{"text": "section {*FUNCTION\\_\\_SDPDA\\_TO\\_LR1\\_OPT*}\ntheory\n  FUNCTION__SDPDA_TO_LR1_OPT\n\nimports\n  PRJ_12_04_06_08__ENTRY\n\nbegin\n\ntheorem F_SDPDA_TO_LR1_OPT__SOUND: \"\n  F_SDPDA_TO_LR1_STD__SpecInput G\n  \\<Longrightarrow> k > 0\n  \\<Longrightarrow> F_SDPDA_TO_LR1_STD__SpecOutput G (F_SDPDA_TO_LR1_OPT G k)\"\n  apply(simp add: F_SDPDA_TO_LR1_STD__SpecInput_def F_SDPDA_TO_LR1_STD__SpecOutput_def)\n  apply(case_tac \"F_SDPDA_TO_LR1_OPT G k\")\n   apply(clarsimp)\n   apply(simp add: F_SDPDA_TO_LR1_OPT_def)\n   apply(case_tac \"F_SDPDA_TO_CFG_OPT G k\")\n    apply(clarsimp)\n    apply(subgoal_tac \"X\" for X)\n     prefer 2\n     apply(rule_tac G=\"G\" in F_SDPDA_TO_CFG_OPT__SOUND2)\n       apply(simp add: F_SDPDA_TO_CFG_STD__SpecInput_def)\n      apply(force)\n     apply(force)\n    apply(rule_tac t=\"epdaS.marked_language G\" and s=\"epdaH.marked_language G\" in ssubst)\n     apply(rule epdaS_to_epdaH_mlang)\n     apply(simp only: valid_simple_dpda_def valid_pda_def valid_dpda_def)\n    apply(force)\n   apply(clarsimp)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac G=\"G\" in F_SDPDA_TO_CFG_OPT__SOUND)\n       apply(simp add: F_SDPDA_TO_CFG_STD__SpecInput_def)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac G=\"G\" in F_SDPDA_TO_CFG_STD__SOUND)\n    apply(simp add: F_SDPDA_TO_CFG_STD__SpecInput_def)\n   apply(simp add: F_SDPDA_TO_CFG_STD__SpecOutput_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac G=\"X\" for X in F_CFG_TRIM__SOUND)\n    apply(simp add: F_CFG_TRIM__SpecInput_def F_SDPDA_TO_CFG_STD__SpecOutput_def)\n   apply(simp add: F_CFG_TRIM__SpecOutput_def)\n   apply (metis CFG_lang_lm_lang_equal)\n  apply(clarsimp)\n  apply(simp add: F_SDPDA_TO_LR1_OPT_def)\n  apply(case_tac \"F_SDPDA_TO_CFG_OPT G k\")\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac G=\"G\" in F_SDPDA_TO_CFG_OPT__SOUND)\n      apply(simp add: F_SDPDA_TO_CFG_STD__SpecInput_def)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac G=\"G\" in F_SDPDA_TO_CFG_STD__SOUND)\n   apply(simp add: F_SDPDA_TO_CFG_STD__SpecInput_def)\n  apply(simp add: F_SDPDA_TO_CFG_STD__SpecOutput_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac G=\"X\" for X in F_CFG_TRIM__SOUND)\n   apply(simp add: F_CFG_TRIM__SpecInput_def F_SDPDA_TO_CFG_STD__SpecOutput_def)\n   apply(force)\n  apply(simp add: F_CFG_TRIM__SpecOutput_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac G'=\"a\" in F_SDPDA_TO_CFG_STD__enforces_cfg_LRk)\n       apply(force)\n      apply(force)\n     apply(simp add: cfg_sub_def)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply (metis CFG_lang_lm_lang_equal)\n  done\n\ntheorem F_SDPDA_TO_LR1_OPT__vs__F_SDPDA_TO_LR1_STD: \"\n  F_SDPDA_TO_LR1_STD__SpecInput G\n  \\<Longrightarrow> k > 0\n  \\<Longrightarrow> F_SDPDA_TO_LR1_STD G = F_SDPDA_TO_LR1_OPT G k\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule F_SDPDA_TO_LR1_STD__SOUND)\n   apply(force)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac G=\"G\" in F_SDPDA_TO_CFG_STD__SOUND)\n   apply(simp add: F_SDPDA_TO_LR1_STD__SpecInput_def F_SDPDA_TO_LR1_STD__SpecOutput_def F_SDPDA_TO_CFG_STD__SpecOutput_def F_SDPDA_TO_CFG_STD__SpecInput_def)\n  apply(simp add: F_SDPDA_TO_LR1_STD__SpecInput_def F_SDPDA_TO_LR1_STD__SpecOutput_def F_SDPDA_TO_CFG_STD__SpecOutput_def F_SDPDA_TO_CFG_STD__SpecInput_def)\n  apply(clarsimp)\n  apply(simp add: F_SDPDA_TO_LR1_STD_def F_SDPDA_TO_LR1_OPT_def)\n  apply(case_tac \"F_SDPDA_TO_CFG_OPT G k\")\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule F_SDPDA_TO_CFG_OPT__SOUND2)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(clarsimp)\n   apply(case_tac \"F_CFG_TRIM (F_SDPDA_TO_CFG_STD G) \")\n    apply(force)\n   apply(clarsimp)\n   apply(rename_tac G2)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac G=\"F_SDPDA_TO_CFG_STD G\" in F_CFG_TRIM__SOUND)\n    apply(simp add: F_CFG_TRIM__SpecInput_def)\n   apply(simp add: F_CFG_TRIM__SpecOutput_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"cfgLM.marked_language G2 = {}\")\n    prefer 2\n    apply(rule_tac t=\"cfgLM.marked_language G2\" and s=\"cfgLM.marked_language (F_SDPDA_TO_CFG_STD G)\" in ssubst)\n     apply(force)\n    apply(rule_tac t=\"cfgLM.marked_language (F_SDPDA_TO_CFG_STD G)\" and s=\"epdaS.marked_language G\" in ssubst)\n     apply(force)\n    apply(rule_tac t=\"epdaS.marked_language G\" and s=\"epdaH.marked_language G\" in ssubst)\n     apply(rule epdaS_to_epdaH_mlang)\n     apply(simp only: valid_simple_dpda_def valid_pda_def valid_dpda_def)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule F_SDPDA_TO_CFG_OPT__SOUND)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac G2)\n  apply(rule sym)\n  apply(rule cfg_equal_trim_by_cfg_sub_and_equal_marked_language)\n       apply(force)\n      apply(force)\n     apply(simp add: cfg_sub_def F_SDPDA_TO_CFG_OPT_def Let_def F_SDPDA_TO_CFG_STD_def)\n     apply(case_tac \"cons_l2 (epda_initial G) (epda_box G)\n              \\<in> (case F_SDPDA_TO_CFG_OPT__nonterminals G k of\n                  cons_tuple2 S2 S3 \\<Rightarrow> S2)\")\n      prefer 2\n      apply(force)\n     apply(clarsimp)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\ntheorem F_SDPDA_TO_LR1_OPT__vs__F_SDPDA_TO_LR1_STD__stronger: \"\n  valid_simple_dpda G\n  \\<Longrightarrow> k > 0\n  \\<Longrightarrow> F_SDPDA_TO_LR1_STD G = F_SDPDA_TO_LR1_OPT G k\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac G=\"G\" in F_SDPDA_TO_CFG_STD__SOUND)\n   apply(simp add: F_SDPDA_TO_LR1_STD__SpecInput_def F_SDPDA_TO_LR1_STD__SpecOutput_def F_SDPDA_TO_CFG_STD__SpecOutput_def F_SDPDA_TO_CFG_STD__SpecInput_def)\n  apply(simp add: F_SDPDA_TO_LR1_STD__SpecInput_def F_SDPDA_TO_LR1_STD__SpecOutput_def F_SDPDA_TO_CFG_STD__SpecOutput_def F_SDPDA_TO_CFG_STD__SpecInput_def)\n  apply(clarsimp)\n  apply(simp add: F_SDPDA_TO_LR1_STD_def F_SDPDA_TO_LR1_OPT_def)\n  apply(case_tac \"F_SDPDA_TO_CFG_OPT G k\")\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule F_SDPDA_TO_CFG_OPT__SOUND2)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(clarsimp)\n   apply(case_tac \"F_CFG_TRIM (F_SDPDA_TO_CFG_STD G) \")\n    apply(force)\n   apply(clarsimp)\n   apply(rename_tac G2)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac G=\"F_SDPDA_TO_CFG_STD G\" in F_CFG_TRIM__SOUND)\n    apply(simp add: F_CFG_TRIM__SpecInput_def)\n   apply(simp add: F_CFG_TRIM__SpecOutput_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"cfgLM.marked_language G2 = {}\")\n    prefer 2\n    apply(rule_tac t=\"cfgLM.marked_language G2\" and s=\"cfgLM.marked_language (F_SDPDA_TO_CFG_STD G)\" in ssubst)\n     apply(force)\n    apply(rule_tac t=\"cfgLM.marked_language (F_SDPDA_TO_CFG_STD G)\" and s=\"epdaS.marked_language G\" in ssubst)\n     apply (metis CFG_lang_lm_lang_equal)\n    apply(rule_tac t=\"epdaS.marked_language G\" and s=\"epdaH.marked_language G\" in ssubst)\n     apply(rule epdaS_to_epdaH_mlang)\n     apply(simp only: valid_simple_dpda_def valid_pda_def valid_dpda_def)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule F_SDPDA_TO_CFG_OPT__SOUND)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac G2)\n  apply(rule sym)\n  apply(rule cfg_equal_trim_by_cfg_sub_and_equal_marked_language)\n       apply(force)\n      apply(force)\n     apply(simp add: cfg_sub_def F_SDPDA_TO_CFG_OPT_def Let_def F_SDPDA_TO_CFG_STD_def)\n     apply(case_tac \"cons_l2 (epda_initial G) (epda_box G)\n              \\<in> (case F_SDPDA_TO_CFG_OPT__nonterminals G k of\n                  cons_tuple2 S2 S3 \\<Rightarrow> S2)\")\n      prefer 2\n      apply(force)\n     apply(clarsimp)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_04_06_08/FUNCTION__SDPDA_TO_LR1_OPT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7279754489059774, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.3497766813416757}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n  The state and error monads in Isabelle,\n*)\n\nchapter \"Monads\"\n\ntheory StateMonad (* FIXME: untested/unused *)\nimports Lib\nbegin\n\ntype_synonym ('s,'a) state_monad = \"'s \\<Rightarrow> 'a \\<times> 's\"\n\ndefinition\n  runState :: \"('s,'a) state_monad \\<Rightarrow> 's \\<Rightarrow> 'a \\<times> 's\"\nwhere\n  \"runState \\<equiv> id\"\n\ndefinition\n  \"return a \\<equiv> \\<lambda>s. (a,s)\"\n\ndefinition\n  bind :: \"('s, 'a) state_monad \\<Rightarrow> ('a \\<Rightarrow> ('s, 'b) state_monad) \\<Rightarrow>\n           ('s, 'b) state_monad\" (infixl \">>=\" 60)\nwhere\n  \"bind f g \\<equiv> (\\<lambda>s. let (v,s') = f s in (g v) s')\"\n\ndefinition\n  \"bind' f g \\<equiv> bind f (\\<lambda>_. g)\"\n\ndeclare bind'_def [iff]\n\n\ndefinition\n  \"get \\<equiv> \\<lambda>s. (s,s)\"\n\ndefinition\n  \"put s \\<equiv> \\<lambda>_. ((),s)\"\n\ndefinition\n  \"gets f \\<equiv> get >>= (\\<lambda>s. return $ f s)\"\n\ndefinition\n  \"modify f \\<equiv> get >>= (\\<lambda>s. put $ f s)\"\n\ndefinition\n  \"when p s \\<equiv> if p then s else return ()\"\n\ndefinition\n  \"unless p s \\<equiv> when (\\<not>p) s\"\n\n\ntext {* The monad laws: *}\n\nlemma return_bind [simp]: \"(return x >>= f) = f x\"\n  by (simp add: return_def bind_def runState_def)\n\nlemma bind_return [simp]: \"(m >>= return) = m\"\n  unfolding bind_def return_def runState_def\n  by (simp add: Let_def split_def)\n\nlemma bind_assoc:\n  fixes m :: \"('s,'a) state_monad\"\n  fixes f :: \"'a \\<Rightarrow> ('s,'b) state_monad\"\n  fixes g :: \"'b \\<Rightarrow> ('s,'c) state_monad\"\n  shows \"(m >>= f) >>= g  =  m >>= (\\<lambda>x. f x >>= g)\"\n  unfolding bind_def\n  by (clarsimp simp add: Let_def split_def)\n\n\ntext {* An errorT state\\_monad (returnOk=return, bindE=bind): *}\n\ndefinition\n  \"returnOk \\<equiv> return o Inr\"\n\ndefinition\n  \"throwError \\<equiv> return o Inl\"\n\ndefinition\n  \"Ok \\<equiv> Inr\"\n\ndefinition\n  lift :: \"('a \\<Rightarrow> ('s, 'e + 'b) state_monad) \\<Rightarrow> 'e+'a \\<Rightarrow> ('s, 'e + 'b) state_monad\"\nwhere\n  \"lift f v \\<equiv> case v of Inl e \\<Rightarrow> throwError e | Inr v' \\<Rightarrow> f v'\"\n\ndefinition\n  lift2 :: \"('c \\<Rightarrow> ('a, 'b + 'e + 'd) state_monad) \\<Rightarrow> 'b+'e+'c \\<Rightarrow> ('a, 'b+'e+'d) state_monad\"\nwhere\n  \"lift2 f v \\<equiv> case v of\n                 Inl e \\<Rightarrow> throwError e\n               | Inr v'' \\<Rightarrow> (case v'' of Inl e' \\<Rightarrow> return $ Inr $ Inl e' | Inr v' \\<Rightarrow> f v')\"\n\n(* This is used if you are just trying to throwError by itself *)\ndefinition\n  raise :: \"'a \\<Rightarrow> 's \\<Rightarrow> ('a + unit) \\<times> 's\"\nwhere\n  \"raise \\<equiv> return \\<circ> Inl\"\n\ndefinition\n  bindE :: \"('s, 'e + 'a) state_monad \\<Rightarrow> ('a \\<Rightarrow> ('s, 'e + 'b) state_monad) \\<Rightarrow>\n            ('s, 'e + 'b) state_monad\"  (infixl \">>=E\" 60)\nwhere\n  \"bindE f g \\<equiv> bind f (lift g)\"\n\n\ndefinition\n  \"bindE' f g \\<equiv> bindE f (\\<lambda>_. g)\"\n\ndefinition\n  liftE :: \"('s,'a) state_monad \\<Rightarrow> ('s, 'e+'a) state_monad\" where\n  \"liftE f \\<equiv> \\<lambda>s. let (v,s') = f s in (Inr v, s')\"\n\ndefinition\n  \"whenE P f \\<equiv> if P then f else returnOk ()\"\n\ndefinition\n  \"unlessE P f \\<equiv> if P then returnOk () else f\"\n\ndefinition\n  \"throw_opt ex x \\<equiv> case x of None \\<Rightarrow> throwError ex | Some v \\<Rightarrow> returnOk v\"\n\ndefinition\n  \"bindEE f g \\<equiv> bind f (lift2 g)\"\ndefinition\n  \"bindEE' f g \\<equiv> bindEE f (\\<lambda>_. g)\"\n\ndefinition\n  \"modifyE \\<equiv> (liftE \\<circ> modify)\"\ndefinition\n  \"getsE x \\<equiv> liftE $ gets x\"\n\nsyntax\n  bindEE :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'c\" (infixl \">>=EE\" 60)\n\ndeclare\n  bindE'_def [iff]\n  bindEE_def [iff]\n  bindEE'_def [iff]\n\nlemma returnOk_bindE [simp]: \"(returnOk x >>=E f) = f x\"\n  unfolding bindE_def return_def returnOk_def\n  by (clarsimp simp: lift_def)\n\nlemma lift_return [simp]:\n  \"lift (return \\<circ> Inr) = return\"\n  by (auto simp: lift_def throwError_def split: sum.splits)\n\nlemma bindE_returnOk [simp]: \"(m >>=E returnOk) = m\"\n  by (simp add: bindE_def returnOk_def)\n\n lemma bindE_assoc:\n  shows \"(m >>=E f) >>=E g  =  m >>=E (\\<lambda>x. f x >>=E g)\"\n  by (auto simp: Let_def bindE_def bind_def lift_def split_def runState_def throwError_def return_def\n           split: sum.splits)\n\nlemma throwError_bindE [simp]:\n  \"throwError E >>=E f = throwError E\"\n  by (simp add: bindE_def bind_def throwError_def lift_def return_def)\n\n\nsubsection \"Syntax for state monad\"\n\n\nnonterminal\n  dobinds and dobind and nobind\n\nsyntax\n  \"_dobind\"    :: \"[pttrn, 'a] => dobind\"             (\"(_ <-/ _)\" 10)\n  \"\"           :: \"dobind => dobinds\"                 (\"_\")\n  \"_nobind\"    :: \"'a => dobind\"                      (\"_\")\n  \"_dobinds\"   :: \"[dobind, dobinds] => dobinds\"      (\"(_);//(_)\")\n\n  \"_do\"        :: \"[dobinds, 'a] => 'a\"               (\"(do (_);//   (_)//od)\" 100)\nsyntax (xsymbols)\n  \"_dobind\"    :: \"[pttrn, 'a] => dobind\"             (\"(_ \\<leftarrow>/ _)\" 10)\n\n\ntranslations\n  \"_do (_dobinds b bs) e\"  == \"_do b (_do bs e)\"\n  \"_do (_nobind b) e\"      == \"CONST bind' b e\"\n  \"do x <- a; e od\"        == \"a >>= (\\<lambda>x. e)\"\n\nlemma \"do x \\<leftarrow> return 1; return 2; return x od = return 1\"\n  by simp\n\n\nsubsection \"Syntax for errorT state monad\"\n\n\nsyntax\n  \"_doE\" :: \"[dobinds, 'a] => 'a\"  (\"(doE (_);//    (_)//odE)\" 100)\n\ntranslations\n  \"_doE (_dobinds b bs) e\"  == \"_doE b (_doE bs e)\"\n  \"_doE (_nobind b) e\"      == \"CONST bindE' b e\"\n  \"doE x <- a; e odE\"       == \"a >>=E (\\<lambda>x. e)\"\n\n\nsubsection \"Syntax for errorT errorT state monad\"\n\nsyntax\n  \"_doEE\" :: \"[dobinds, 'a] => 'a\" (\"(doEE (_);//     (_)//odEE)\" 100)\n\ntranslations\n  \"_doEE (_dobinds b bs) e\"  == \"_doEE b (_doEE bs e)\"\n  \"_doEE (_nobind b) e\"      == \"CONST bindEE' b e\"\n  \"doEE x <- a; e odEE\"      == \"a >>=EE (\\<lambda>x. e)\"\n\nprimrec\n  inc_forloop :: \"nat \\<Rightarrow> 'g::{plus,one} \\<Rightarrow> ('g \\<Rightarrow> ('a, 'b + unit) state_monad) \\<Rightarrow>\n                  ('a, 'b + unit) state_monad\"\nwhere\n  \"inc_forloop 0 current body = returnOk ()\"\n| \"inc_forloop (Suc left) current body = doE body current ; inc_forloop left (current+1) body odE\"\n\nprimrec\n  do_times :: \"nat \\<Rightarrow> ('a, 'b + unit) state_monad \\<Rightarrow> ('a, 'b + unit) state_monad \\<Rightarrow>\n              ('a, 'b + unit) state_monad\"\nwhere\n  \"do_times 0 body increment = returnOk ()\"\n| \"do_times (Suc left) body increment = doE body ; increment ; do_times left body increment odE\"\n\ndefinition\n  function_update :: \"'a \\<Rightarrow> ('b \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'b)\" where\n  \"function_update index modifier f \\<equiv>\n   \\<lambda>x. if x = index then modifier (f x) else (f x)\"\n\nlemma \"doE x \\<leftarrow> returnOk 1; returnOk 2; returnOk x odE = returnOk 1\"\n  by simp\n\nterm \"doEE x \\<leftarrow> returnOk $ Ok 1; returnOk $ Ok 2; returnOk $ Ok x odEE\"\n\ndefinition\n  \"skip \\<equiv> returnOk $ Ok ()\"\n\ndefinition\n  \"liftM f m \\<equiv> do x \\<leftarrow> m; return (f x) od\"\ndefinition\n  \"liftME f m \\<equiv> doE x \\<leftarrow> m; returnOk (f x) odE\"\n\ndefinition\n  \"sequence_x xs \\<equiv> foldr (\\<lambda>x y. x >>= (\\<lambda>_. y)) xs (return ())\"\n\ndefinition\n  \"zipWithM_x f xs ys \\<equiv> sequence_x (zipWith f xs ys)\"\ndefinition\n  \"mapM_x f xs \\<equiv> sequence_x (map f xs)\"\n\ndefinition\n  \"sequence xs \\<equiv> let mcons = (\\<lambda>p q. p >>= (\\<lambda>x. q >>= (\\<lambda>y. return (x#y))))\n                 in foldr mcons xs (return [])\"\n\ndefinition\n  \"mapM f xs \\<equiv> sequence (map f xs)\"\n\ndefinition\n  \"sequenceE_x xs \\<equiv> foldr (\\<lambda>x y. doE uu <- x; y odE) xs (returnOk ())\"\ndefinition\n  \"mapME_x f xs \\<equiv> sequenceE_x (map f xs)\"\n\ndefinition\n  \"sequenceEE_x xs \\<equiv> foldr bindEE' xs (skip)\"\ndefinition\n  \"mapMEE_x f xs \\<equiv> sequenceEE_x (map f xs)\"\n\ndefinition\n  catch :: \"('s, 'a + 'b) state_monad \\<Rightarrow> ('a \\<Rightarrow> ('s, 'b) state_monad) \\<Rightarrow> ('s, 'b) state_monad\"\nwhere\n  \"catch f handler \\<equiv> do x \\<leftarrow> f;\n                        case x of\n                            Inr b \\<Rightarrow> return b\n                          | Inl e \\<Rightarrow> handler e\n                      od\"\n\ndefinition\n  handleE :: \"('s, 'x + 'a) state_monad \\<Rightarrow>\n              ('x \\<Rightarrow> ('s, 'x + 'a) state_monad) \\<Rightarrow>\n              ('s, 'x + 'a) state_monad\" (infix \"<handle>\" 11) where\n  \"f <handle> handler \\<equiv>\n   do v \\<leftarrow> f; case v of Inl e \\<Rightarrow> handler e | Inr v' \\<Rightarrow> return v od\"\n\ndefinition\n  handle_elseE :: \"('s, 'x + 'a) state_monad \\<Rightarrow>\n                   ('x \\<Rightarrow> ('s, 'x + 'a) state_monad) \\<Rightarrow>\n                   ('a \\<Rightarrow> ('s, 'x + 'a) state_monad) \\<Rightarrow>\n                   ('s, 'x + 'a) state_monad\" (\"_ <handle> _ <else> _\" 10)\nwhere\n  \"f <handle> handler <else> continue \\<equiv>\n    do v \\<leftarrow> f;\n       case v of Inl e \\<Rightarrow> handler e\n               | Inr v \\<Rightarrow> continue v\n    od\"\n\ndefinition\n  isSkip :: \"('s, 'a) state_monad \\<Rightarrow> bool\" where\n  \"isSkip m \\<equiv> \\<forall>s. \\<exists>r. m s = (r,s)\"\n\nlemma isSkip_bindI: \"\\<lbrakk> isSkip f; \\<And>x. isSkip (g x) \\<rbrakk> \\<Longrightarrow> isSkip (f >>= g)\"\n  apply (clarsimp simp: isSkip_def bind_def Let_def)\n  apply (erule_tac x=s in allE)\n  apply clarsimp\n  done\n\nlemma isSkip_return [simp,intro!]:\n  \"isSkip (return x)\"\n  by (simp add: isSkip_def return_def)\n\nlemma isSkip_gets [simp,intro!]:\n  \"isSkip (gets x)\"\n  by (simp add: isSkip_def gets_def get_def bind_def return_def)\n\nlemma isSkip_liftE [iff]: \"isSkip (liftE f) = isSkip f\"\n  apply (simp add: isSkip_def liftE_def Let_def split_def)\n  apply rule\n   apply clarsimp\n   apply (case_tac \"f s\")\n   apply (erule_tac x = s in allE)\n   apply simp\n  apply clarsimp\n  apply (case_tac \"f s\")\n  apply (erule_tac x = s in allE)\n  apply simp\n  done\n\nlemma isSkip_liftI [simp, intro!]:\n  \"\\<lbrakk> \\<And>y. x = Inr y \\<Longrightarrow> isSkip (f y) \\<rbrakk> \\<Longrightarrow> isSkip (lift f x)\"\n  by (simp add: lift_def throwError_def return_def isSkip_def split: sum.splits)\n\nlemma isSkip_Error [iff]:\n  \"isSkip (throwError x)\"\n  by (simp add: throwError_def)\n\nlemma isSkip_returnOk [iff]:\n  \"isSkip (returnOk x)\"\n  by (simp add: returnOk_def)\n\nlemma isSkip_throw_opt [iff]:\n  \"isSkip (throw_opt e x)\"\n  by (simp add: throw_opt_def split: option.splits)\n\nlemma nested_bind [simp]:\n  \"do x <- do y <- f; return (g y) od; h x od =\n   do y <- f; h (g y) od\"\n  apply (clarsimp simp add: bind_def)\n  apply (rule ext)\n  apply (clarsimp simp add: Let_def split_def runState_def return_def)\n  done\n\nlemma skip_bind:\n  \"isSkip s \\<Longrightarrow> do _ \\<leftarrow> s; g od = g\"\n  apply (clarsimp simp add: bind_def)\n  apply (rule ext)\n  apply (clarsimp simp add: isSkip_def Let_def)\n  apply (erule_tac x=sa in allE)\n  apply clarsimp\n  done\n\nlemma bind_eqI:\n  \"\\<lbrakk> f = f'; \\<And>x. g x = g' x \\<rbrakk> \\<Longrightarrow> f >>= g = f' >>= g'\"\n  by (simp add: bind_def)\n\n\n\nlemma bind'_cong [fundef_cong]:\n  \"\\<lbrakk> f = f'; \\<And>v s s'. f' s = (v, s') \\<Longrightarrow> g s' = g' s' \\<rbrakk> \\<Longrightarrow> bind' f g = bind' f' g'\"\n  by (auto intro: bind_cong)\n\nlemma bindE_cong[fundef_cong]:\n  \"\\<lbrakk> M = M' ; \\<And>v s s'. M' s = (Inr v, s') \\<Longrightarrow> N v s' = N' v s' \\<rbrakk> \\<Longrightarrow> bindE M N = bindE M' N'\"\n  apply (simp add: bindE_def)\n  apply (rule bind_cong)\n   apply (rule refl)\n  apply (unfold lift_def)\n  apply (case_tac v, simp_all)\n  done\n\nlemma bindE'_cong[fundef_cong]:\n  \"\\<lbrakk> M = M' ; \\<And>v s s'. M' s = (Inr v, s') \\<Longrightarrow> N s' = N' s' \\<rbrakk> \\<Longrightarrow> bindE' M N = bindE' M' N'\"\n  by (auto intro: bindE_cong)\n\ndefinition\n  valid :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) state_monad \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\" (\"\\<lbrace>_\\<rbrace> _ \\<lbrace>_\\<rbrace>\") where\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<equiv> \\<forall>s. P s \\<longrightarrow> split Q (f s)\"\n\ndefinition\n  validE :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'a + 'b) state_monad \\<Rightarrow> ('b \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow>\n             ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\" (\"\\<lbrace>_\\<rbrace> _ \\<lbrace>_\\<rbrace>, \\<lbrace>_\\<rbrace>\") where\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>R\\<rbrace> \\<equiv> \\<forall>s. P s \\<longrightarrow> split (\\<lambda>r s. case r of Inr b \\<Rightarrow> Q b s\n                                                  | Inl a \\<Rightarrow> R a s) (f s)\"\n\nlemma validE_def2:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>R\\<rbrace> \\<equiv> \\<lbrace>P\\<rbrace> f \\<lbrace> \\<lambda>r s. case r of Inr b \\<Rightarrow> Q b s | Inl a \\<Rightarrow> R a s \\<rbrace>\"\n  by (unfold valid_def validE_def)\n\n(* FIXME: modernize *)\nsyntax top :: \"'a \\<Rightarrow> bool\" (\"\\<top>\")\n       bottom :: \"'a \\<Rightarrow> bool\" (\"\\<bottom>\")\n\ntranslations\n  \"\\<top>\" == \"\\<lambda>_. CONST True\"\n  \"\\<bottom>\" == \"\\<lambda>_. CONST False\"\n\ndefinition\n  bipred_conj :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\" (infixl \"And\" 96)\nwhere\n  \"bipred_conj P Q \\<equiv> \\<lambda>x y. P x y \\<and> Q x y\"\n\ndefinition\n  bipred_disj :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\" (infixl \"Or\" 91)\nwhere\n  \"bipred_disj P Q \\<equiv> \\<lambda>x y. P x y \\<or> Q x y\"\n\ndefinition\n  bipred_neg :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\" (\"Not _\") where\n  \"bipred_neg P \\<equiv> \\<lambda>x y. \\<not> P x y\"\n\nsyntax toptop :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (\"\\<top>\\<top>\")\n       botbot :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (\"\\<bottom>\\<bottom>\")\n\ntranslations \"\\<top>\\<top>\" == \"\\<lambda>_ _. CONST True\"\n             \"\\<bottom>\\<bottom>\" == \"\\<lambda>_ _. CONST False\"\n\ndefinition\n  pred_lift_exact :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\" (\"\\<guillemotleft>_,_\\<guillemotright>\") where\n  \"pred_lift_exact P Q \\<equiv> \\<lambda>x y. P x \\<and> Q y\"\n\nlemma pred_lift_taut[simp]: \"\\<guillemotleft>\\<top>,\\<top>\\<guillemotright> = \\<top>\\<top>\"\n  by (simp add:pred_lift_exact_def)\n\nlemma pred_lift_cont_l[simp]: \"\\<guillemotleft>\\<bottom>,x\\<guillemotright> = \\<bottom>\\<bottom>\"\n  by (simp add:pred_lift_exact_def)\n\nlemma pred_lift_cont_r[simp]: \"\\<guillemotleft>x,\\<bottom>\\<guillemotright> = \\<bottom>\\<bottom>\"\n  by (simp add:pred_lift_exact_def)\n\nlemma pred_liftI[intro!]: \"\\<lbrakk> P x; Q y \\<rbrakk> \\<Longrightarrow> \\<guillemotleft>P,Q\\<guillemotright> x y\"\n  by (simp add:pred_lift_exact_def)\n\nlemma pred_exact_split:\n  \"\\<guillemotleft>P,Q\\<guillemotright> = (\\<guillemotleft>P,\\<top>\\<guillemotright> And \\<guillemotleft>\\<top>,Q\\<guillemotright>)\"\n  by (simp add:pred_lift_exact_def bipred_conj_def)\n\nlemma pred_andE[elim!]: \"\\<lbrakk> (A and B) x; \\<lbrakk> A x; B x \\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  by (simp add:pred_conj_def)\n\nlemma pred_andI[intro!]: \"\\<lbrakk> A x; B x \\<rbrakk> \\<Longrightarrow> (A and B) x\"\n  by (simp add:pred_conj_def)\n\nlemma bipred_conj_app[simp]: \"(P And Q) x = (P x and Q x)\"\n  by (simp add:pred_conj_def bipred_conj_def)\n\nlemma bipred_disj_app[simp]: \"(P Or Q) x = (P x or Q x)\"\n  by (simp add:pred_disj_def bipred_disj_def)\n\nlemma pred_conj_app[simp]: \"(P and Q) x = (P x \\<and> Q x)\"\n  by (simp add:pred_conj_def)\n\nlemma pred_disj_app[simp]: \"(P or Q) x = (P x \\<or> Q x)\"\n  by (simp add:pred_disj_def)\n\nlemma pred_notnotD[simp]: \"(not not P) = P\"\n  by (simp add:pred_neg_def)\n\nlemma bipred_notnotD[simp]: \"(Not Not P) = P\"\n  by (simp add:bipred_neg_def)\n\nlemma pred_lift_add[simp]: \"\\<guillemotleft>P,Q\\<guillemotright> x = ((\\<lambda>s. P x) and Q)\"\n  by (simp add:pred_lift_exact_def pred_conj_def)\n\nlemma pred_and_true[simp]: \"(P and \\<top>) = P\"\n  by (simp add:pred_conj_def)\n\nlemma pred_and_true_var[simp]: \"(\\<top> and P) = P\"\n  by (simp add:pred_conj_def)\n\nlemma pred_and_false[simp]: \"(P and \\<bottom>) = \\<bottom>\"\n  by (simp add:pred_conj_def)\n\nlemma pred_and_false_var[simp]: \"(\\<bottom> and P) = \\<bottom>\"\n  by (simp add:pred_conj_def)\n\nlemma seq':\n  \"\\<lbrakk> \\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>;\n     \\<forall>x. P x \\<longrightarrow> \\<lbrace>C\\<rbrace> g x \\<lbrace>D\\<rbrace>;\n     \\<forall>x s. B x s \\<longrightarrow> P x \\<and> C s \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>D\\<rbrace>\"\n  apply (clarsimp simp: valid_def runState_def bind_def Let_def split_def)\n  apply (case_tac \"f s\")\n  apply fastforce\n  done\n\n\nlemma seq:\n  assumes \"\\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>\"\n  assumes \"\\<And>x. P x \\<Longrightarrow> \\<lbrace>C\\<rbrace> g x \\<lbrace>D\\<rbrace>\"\n  assumes \"\\<And>x s. B x s \\<Longrightarrow> P x \\<and> C s\"\n  shows \"\\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>D\\<rbrace>\"\n  using assms by (blast intro: seq')\n\nlemma seq_invar_nobind:\n  assumes f_valid: \"\\<lbrace>A\\<rbrace> f \\<lbrace>\\<guillemotleft>\\<top>,A\\<guillemotright>\\<rbrace>\"\n  assumes g_valid: \"\\<And>x. \\<lbrace>A\\<rbrace> g x \\<lbrace>\\<guillemotleft>\\<top>,A\\<guillemotright>\\<rbrace>\"\n  shows \"\\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>\\<guillemotleft>\\<top>,A\\<guillemotright>\\<rbrace>\"\n  apply(rule_tac B=\"\\<guillemotleft>\\<top>,A\\<guillemotright>\" and C=\"A\" and P=\"\\<top>\" in seq)\n    apply(insert f_valid g_valid)\n    apply(simp_all add:pred_lift_exact_def)\n  done\n\nlemma seq_invar_bind:\n  assumes f_valid: \"\\<lbrace>A\\<rbrace> f \\<lbrace>\\<guillemotleft>B,A\\<guillemotright>\\<rbrace>\"\n  assumes g_valid: \"\\<And>x. P x \\<Longrightarrow> \\<lbrace>A\\<rbrace> g x \\<lbrace>\\<guillemotleft>\\<top>,A\\<guillemotright>\\<rbrace>\"\n  assumes bind: \"\\<And>x. B x \\<Longrightarrow> P x\"\n  shows \"\\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>\\<guillemotleft>\\<top>,A\\<guillemotright>\\<rbrace>\"\n  apply(rule_tac B=\"\\<guillemotleft>B,A\\<guillemotright>\" and C=\"A\" and P=\"P\" in seq)\n    apply(insert f_valid g_valid bind)\n    apply(simp_all add: pred_lift_exact_def)\n  done\n\nlemma seq_noimp:\n  assumes f_valid: \"\\<lbrace>A\\<rbrace> f \\<lbrace>\\<guillemotleft>C,B\\<guillemotright>\\<rbrace>\"\n  assumes g_valid: \"\\<And>x. C x \\<Longrightarrow> \\<lbrace>B\\<rbrace> g x \\<lbrace>D\\<rbrace>\"\n  shows \"\\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>D\\<rbrace>\"\n  apply(rule_tac B=\"\\<guillemotleft>C,B\\<guillemotright>\" and C=\"B\" and P=\"C\" in seq)\n    apply(insert f_valid g_valid, simp_all add:pred_lift_exact_def)\n  done\n\nlemma seq_ext':\n  \"\\<lbrakk> \\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>; \\<forall>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>C\\<rbrace>\"\n  by (clarsimp simp: valid_def runState_def bind_def Let_def split_def)\n\nlemma seq_ext:\n  assumes \"\\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>\" \"\\<And>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>\"\n  shows \"\\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>C\\<rbrace>\"\n  using assms by (blast intro: seq_ext')\n\nlemma seqE':\n  \"\\<lbrakk> \\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>,\\<lbrace>E\\<rbrace>;\n     \\<forall>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>A\\<rbrace> doE x \\<leftarrow> f; g x odE \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  apply(simp add: bindE_def lift_def bind_def Let_def split_def)\n  apply(clarsimp simp: validE_def)\n  apply(rename_tac s r x)\n  apply(case_tac \"fst (f s)\"; case_tac r; fastforce simp:throwError_def return_def)\n  done\n\nlemma seqE:\n  assumes \"\\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>,\\<lbrace>E\\<rbrace>\" \"\\<And>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  shows \"\\<lbrace>A\\<rbrace> doE x \\<leftarrow> f; g x odE \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  using assms by(blast intro: seqE')\n\nlemma get_sp:\n  \"\\<lbrace>P\\<rbrace> get \\<lbrace>\\<lambda>a s. s = a \\<and> P s\\<rbrace>\"\n  by (simp add:get_def valid_def)\n\nlemma put_sp:\n  \"\\<lbrace>\\<top>\\<rbrace> put a \\<lbrace>\\<lambda>_ s. s = a\\<rbrace>\"\n  by (simp add:put_def valid_def)\n\nlemma return_sp:\n  \"\\<lbrace>P\\<rbrace> return a \\<lbrace>\\<lambda>b s. b = a \\<and> P s\\<rbrace>\"\n  by (simp add:return_def valid_def)\n\nlemma hoare_post_conj [intro!]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> a \\<lbrace> Q \\<rbrace>; \\<lbrace> P \\<rbrace> a \\<lbrace> R \\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> a \\<lbrace> Q And R \\<rbrace>\"\n  by (simp add:valid_def split_def bipred_conj_def)\n\nlemma hoare_pre_disj [intro!]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> a \\<lbrace> R \\<rbrace>; \\<lbrace> Q \\<rbrace> a \\<lbrace> R \\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace> P or Q \\<rbrace> a \\<lbrace> R \\<rbrace>\"\n  by (simp add:valid_def pred_disj_def)\n\nlemma hoare_post_taut [iff]: \"\\<lbrace> P \\<rbrace> a \\<lbrace> \\<top>\\<top> \\<rbrace>\"\n  by (simp add:valid_def)\n\nlemma hoare_pre_cont [iff]: \"\\<lbrace> \\<bottom> \\<rbrace> a \\<lbrace> P \\<rbrace>\"\n  by (simp add:valid_def)\n\nlemma hoare_return [intro!]: \"\\<And>x. P x \\<Longrightarrow> \\<lbrace> Q \\<rbrace> return x \\<lbrace> \\<guillemotleft>P,Q\\<guillemotright> \\<rbrace>\"\n  by (simp add:valid_def return_def pred_lift_exact_def)\n\nlemma hoare_return_drop [iff]: \"\\<lbrace> Q \\<rbrace> return x \\<lbrace> \\<guillemotleft>\\<top>,Q\\<guillemotright> \\<rbrace>\"\n  by (simp add:valid_def return_def pred_lift_exact_def)\n\nlemma hoare_return_drop_var [iff]: \"\\<lbrace> Q \\<rbrace> return x \\<lbrace> \\<lambda>r. Q \\<rbrace>\"\n  by (simp add:valid_def return_def pred_lift_exact_def)\n\nlemma hoare_return_only [intro!]: \"\\<And>x. P x \\<Longrightarrow> \\<lbrace> Q \\<rbrace> return x \\<lbrace> \\<guillemotleft>P,\\<top>\\<guillemotright> \\<rbrace>\"\n  by (simp add:valid_def return_def pred_lift_exact_def)\n\nlemma hoare_get [iff]: \"\\<lbrace> P \\<rbrace> get \\<lbrace> \\<guillemotleft>P,P\\<guillemotright> \\<rbrace>\"\n  by (simp add:valid_def get_def pred_lift_exact_def)\n\nlemma hoare_gets [intro!]: \"\\<lbrakk> \\<And>s. P s \\<Longrightarrow> Q (f s) s \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> gets f \\<lbrace> Q \\<rbrace>\"\n  by (simp add:valid_def gets_def get_def bind_def return_def)\n\nlemma hoare_modify [iff]: \"\\<lbrace> P o f \\<rbrace> modify f \\<lbrace> \\<guillemotleft>\\<top>,P\\<guillemotright> \\<rbrace>\"\n  by (simp add:valid_def modify_def pred_lift_exact_def put_def bind_def get_def)\n\nlemma hoare_modifyE [intro!]: \"\\<lbrakk> \\<And>s. P s \\<Longrightarrow> Q (f s) \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> modify f \\<lbrace> \\<guillemotleft>\\<top>,Q\\<guillemotright> \\<rbrace>\"\n  by (simp add:valid_def modify_def pred_lift_exact_def put_def bind_def get_def)\n\nlemma hoare_modifyE_var [intro!]: \"\\<lbrakk> \\<And>s. P s \\<Longrightarrow> Q (f s) \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> modify f \\<lbrace> \\<lambda>r s. Q s \\<rbrace>\"\n  by (simp add:valid_def modify_def pred_lift_exact_def put_def bind_def get_def)\n\nlemma hoare_put [intro!]: \"P x \\<Longrightarrow> \\<lbrace> Q \\<rbrace> put x \\<lbrace> \\<guillemotleft>\\<top>,P\\<guillemotright>\\<rbrace>\"\n  by (simp add:valid_def put_def pred_lift_exact_def)\n\nlemma hoare_if [intro!]:\n  \"\\<lbrakk> P \\<Longrightarrow> \\<lbrace> Q \\<rbrace> a \\<lbrace> R \\<rbrace>; \\<not> P \\<Longrightarrow> \\<lbrace> Q \\<rbrace> b \\<lbrace> R \\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace> Q \\<rbrace> if P then a else b \\<lbrace> R \\<rbrace>\"\n  by (simp add:valid_def)\n\nlemma hoare_when [intro!]:\n  \"\\<lbrakk> \\<lbrakk> P \\<rbrakk> \\<Longrightarrow> \\<lbrace> Q \\<rbrace> a \\<lbrace> \\<guillemotleft>\\<top>,R\\<guillemotright> \\<rbrace>; \\<And>s. \\<lbrakk> \\<not> P; Q s \\<rbrakk> \\<Longrightarrow> R s \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace> Q \\<rbrace> when P a \\<lbrace> \\<guillemotleft>\\<top>,R\\<guillemotright> \\<rbrace>\"\n  by (simp add:valid_def when_def split_def return_def pred_lift_exact_def)\n\nlemma hoare_unless [intro!]:\n  \"\\<lbrakk> \\<And>s. \\<lbrakk> P; Q s \\<rbrakk> \\<Longrightarrow> R s; \\<lbrakk> \\<not> P \\<rbrakk> \\<Longrightarrow> \\<lbrace> Q \\<rbrace> a \\<lbrace> \\<guillemotleft>\\<top>,R\\<guillemotright> \\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace> Q \\<rbrace> unless P a \\<lbrace> \\<guillemotleft>\\<top>,R\\<guillemotright> \\<rbrace>\"\n  by (simp add:valid_def unless_def split_def when_def return_def pred_lift_exact_def)\n\nlemma hoare_pre_subst: \"\\<lbrakk> A = B; \\<lbrace>A\\<rbrace> a \\<lbrace>C\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>B\\<rbrace> a \\<lbrace>C\\<rbrace>\"\n  by (clarsimp simp:valid_def split_def)\n\nlemma hoare_post_subst: \"\\<lbrakk> B = C; \\<lbrace>A\\<rbrace> a \\<lbrace>B\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>A\\<rbrace> a \\<lbrace>C\\<rbrace>\"\n  by (clarsimp simp:valid_def split_def)\n\nlemma hoare_pre_tautI: \"\\<lbrakk> \\<lbrace>A and P\\<rbrace> a \\<lbrace>B\\<rbrace>; \\<lbrace>A and not P\\<rbrace> a \\<lbrace>B\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>A\\<rbrace> a \\<lbrace>B\\<rbrace>\"\n  by (clarsimp simp:valid_def split_def pred_conj_def pred_neg_def, blast)\n\nlemma hoare_return_var[intro!]: \"\\<lbrakk> \\<And>x. P x \\<Longrightarrow> Q x \\<rbrakk> \\<Longrightarrow> (\\<And>x. P x \\<Longrightarrow> \\<lbrace>R\\<rbrace> return x \\<lbrace>\\<guillemotleft>Q,R\\<guillemotright>\\<rbrace>)\"\n  by (rule hoare_return)\n\nlemma hoare_return_drop_imp[intro!]: \"\\<lbrakk> \\<And>s. P s \\<Longrightarrow> Q s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> return x \\<lbrace>\\<guillemotleft>\\<top>,Q\\<guillemotright>\\<rbrace>\"\n by (simp add:valid_def return_def)\n\nlemmas hoare_case_option_inference = option.exhaust\n\nlemma hoare_pre_imp: \"\\<lbrakk> \\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>; \\<And>s. P s \\<Longrightarrow> Q s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>\"\n  by (simp add:valid_def)\n\nlemma hoare_post_imp: \"\\<lbrakk> \\<lbrace>P\\<rbrace> a \\<lbrace>Q\\<rbrace>; \\<And>r s. Q r s \\<Longrightarrow> R r s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>\"\n  by (simp add:valid_def split_def)\n\nlemma hoare_post_impE:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> a \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>; \\<And>r s. Q r s \\<Longrightarrow> R r s; \\<And>e s. E e s \\<Longrightarrow> F e s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>,\\<lbrace>F\\<rbrace>\"\n  apply(clarsimp simp: validE_def)\n  apply(rename_tac s r x)\n  apply(case_tac r; fastforce)\n  done\n\nlemma \"isSkip f \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> \\<guillemotleft>\\<top>,P\\<guillemotright> \\<rbrace>\"\n  apply (clarsimp simp: valid_def split_def isSkip_def)\n  apply (rename_tac s)\n  apply (case_tac \"f s\")\n  apply (erule_tac x=s in allE)\n  apply auto\n  done\n\nend\n", "meta": {"author": "carl88888", "repo": "filesystem", "sha": "2700e011249e8a675f675c5e0fd13efc1a0957f7", "save_path": "github-repos/isabelle/carl88888-filesystem", "path": "github-repos/isabelle/carl88888-filesystem/filesystem-2700e011249e8a675f675c5e0fd13efc1a0957f7/lib/StateMonad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.531209388216861, "lm_q2_score": 0.6584174938590246, "lm_q1q2_score": 0.3497575541041313}}
{"text": "(* Title: SUF_CMA.thy\n  Author: Andreas Lochbihler, ETH Zurich *)\n\ntheory SUF_CMA imports\n  CryptHOL.Computational_Model\n  CryptHOL.Negligible\n  CryptHOL.Environment_Functor\nbegin\n\nsubsection \\<open>Strongly existentially unforgeable signature scheme\\<close>\n\nlocale sig_scheme =\n  fixes key_gen :: \"security \\<Rightarrow> ('vkey \\<times> 'sigkey) spmf\"\n  and sign :: \"security \\<Rightarrow> 'sigkey \\<Rightarrow> 'message \\<Rightarrow> 'signature spmf\"\n  and verify :: \"security \\<Rightarrow> 'vkey \\<Rightarrow> 'message \\<Rightarrow> 'signature \\<Rightarrow> bool\" \\<comment> \\<open>verification is deterministic\\<close>\n  and valid_message :: \"security \\<Rightarrow> 'message \\<Rightarrow> bool\"\n\nlocale suf_cma = sig_scheme +\n  constrains key_gen :: \"security \\<Rightarrow> ('vkey \\<times> 'sigkey) spmf\"\n  and sign :: \"security \\<Rightarrow> 'sigkey \\<Rightarrow> 'message \\<Rightarrow> 'signature spmf\"\n  and verify :: \"security \\<Rightarrow> 'vkey \\<Rightarrow> 'message \\<Rightarrow> 'signature \\<Rightarrow> bool\"\n  and valid_message :: \"security \\<Rightarrow> 'message \\<Rightarrow> bool\"\nbegin\n\ntype_synonym ('vkey', 'sigkey', 'message', 'signature') state_oracle \n  = \"('vkey' \\<times> 'sigkey' \\<times> ('message' \\<times> 'signature') list) option\"\n\nfun vkey_oracle :: \"security \\<Rightarrow> (('vkey, 'sigkey, 'message, 'signature) state_oracle, unit, 'vkey) oracle'\"\nwhere\n  \"vkey_oracle \\<eta> None _ = do {\n     (vkey, sigkey) \\<leftarrow> key_gen \\<eta>;\n     return_spmf (vkey, Some (vkey, sigkey, []))\n   }\"\n| \"\\<And>log. vkey_oracle \\<eta> (Some (vkey, sigkey, log)) _ = return_spmf (vkey, Some (vkey, sigkey, log))\"\n\ncontext notes bind_spmf_cong[fundef_cong] begin\nfunction sign_oracle\n  :: \"security \\<Rightarrow> (('vkey, 'sigkey, 'message, 'signature) state_oracle, 'message, 'signature) oracle'\"\nwhere\n  \"sign_oracle \\<eta> None m = do { (_, \\<sigma>) \\<leftarrow> vkey_oracle \\<eta> None (); sign_oracle \\<eta> \\<sigma> m }\"\n| \"\\<And>log. sign_oracle \\<eta> (Some (vkey, skey, log)) m =\n  (if valid_message \\<eta> m then do {\n    sig \\<leftarrow> sign \\<eta> skey m;\n    return_spmf (sig, Some (vkey, skey, (m, sig) # log)) \n  } else return_pmf None)\"\nby pat_completeness auto\ntermination by(relation \"Wellfounded.measure (\\<lambda>(\\<eta>, \\<sigma>, m). case \\<sigma> of None \\<Rightarrow> 1 | _ \\<Rightarrow> 0)\") auto\nend\n\nlemma lossless_vkey_oracle [simp]:\n  \"lossless_spmf (vkey_oracle \\<eta> \\<sigma> x) \\<longleftrightarrow> (\\<sigma> = None \\<longrightarrow> lossless_spmf (key_gen \\<eta>))\"\nby(cases \"(\\<eta>, \\<sigma>, x)\" rule: vkey_oracle.cases) auto\n\nlemma lossless_sign_oracle [simp]:\n  \"\\<lbrakk> \\<sigma> = None \\<Longrightarrow> lossless_spmf (key_gen \\<eta>);\n    \\<And>skey m. valid_message \\<eta> m \\<Longrightarrow> lossless_spmf (sign \\<eta> skey m) \\<rbrakk>\n  \\<Longrightarrow> lossless_spmf (sign_oracle \\<eta> \\<sigma> m) \\<longleftrightarrow> valid_message \\<eta> m\"\napply(cases \"(\\<eta>, \\<sigma>, m)\" rule: sign_oracle.cases)\napply(auto simp add: split_beta dest: lossless_spmfD_set_spmf_nonempty)\ndone\n\nlemma lossless_sign_oracle_Some: fixes log shows\n  \"lossless_spmf (sign_oracle \\<eta> (Some (vkey, skey, log)) m) \\<longleftrightarrow> lossless_spmf (sign \\<eta> skey m) \\<and> valid_message \\<eta> m\"\nby(simp)\n\nsubsubsection \\<open>Single-user setting\\<close>\n\ntype_synonym 'message' call\\<^sub>1 = \"unit + 'message'\"\ntype_synonym ('vkey', 'signature') ret\\<^sub>1 = \"'vkey' + 'signature'\"\n\ndefinition oracle\\<^sub>1 :: \"security\n  \\<Rightarrow> (('vkey, 'sigkey, 'message, 'signature) state_oracle, 'message call\\<^sub>1, ('vkey, 'signature) ret\\<^sub>1) oracle'\"\nwhere \"oracle\\<^sub>1 \\<eta> = vkey_oracle \\<eta> \\<oplus>\\<^sub>O sign_oracle \\<eta>\"\n\nlemma oracle\\<^sub>1_simps [simp]:\n  \"oracle\\<^sub>1 \\<eta> s (Inl x) = map_spmf (apfst Inl) (vkey_oracle \\<eta> s x)\"\n  \"oracle\\<^sub>1 \\<eta> s (Inr y) = map_spmf (apfst Inr) (sign_oracle \\<eta> s y)\"\nby(simp_all add: oracle\\<^sub>1_def)\n\ntype_synonym ('vkey', 'message', 'signature') adversary\\<^sub>1' = \n  \"(('message' \\<times> 'signature'), 'message' call\\<^sub>1, ('vkey', 'signature') ret\\<^sub>1) gpv\"\ntype_synonym ('vkey', 'message', 'signature') adversary\\<^sub>1 =\n  \"security \\<Rightarrow> ('vkey', 'message', 'signature') adversary\\<^sub>1'\"\n\ndefinition suf_cma\\<^sub>1 :: \"('vkey, 'message, 'signature) adversary\\<^sub>1 \\<Rightarrow> security \\<Rightarrow> bool spmf\"\nwhere\n  \"\\<And>log. suf_cma\\<^sub>1 \\<A> \\<eta> = do {\n    ((m, sig), \\<sigma>) \\<leftarrow> exec_gpv (oracle\\<^sub>1 \\<eta>) (\\<A> \\<eta>) None;\n    return_spmf (\n      case \\<sigma> of None \\<Rightarrow> False\n      | Some (vkey, skey, log) \\<Rightarrow> verify \\<eta> vkey m sig \\<and> (m, sig) \\<notin> set log)\n  }\"\n\ndefinition advantage\\<^sub>1 :: \"('vkey, 'message, 'signature) adversary\\<^sub>1 \\<Rightarrow> advantage\"\nwhere \"advantage\\<^sub>1 \\<A> \\<eta> = spmf (suf_cma\\<^sub>1 \\<A> \\<eta>) True\"\n\nlemma advantage\\<^sub>1_nonneg: \"advantage\\<^sub>1 \\<A> \\<eta> \\<ge> 0\" by(simp add: advantage\\<^sub>1_def pmf_nonneg)\n\nabbreviation secure_for\\<^sub>1 :: \"('vkey, 'message, 'signature) adversary\\<^sub>1 \\<Rightarrow> bool\"\nwhere \"secure_for\\<^sub>1 \\<A> \\<equiv> negligible (advantage\\<^sub>1 \\<A>)\"\n\ndefinition ibounded_by\\<^sub>1' :: \"('vkey, 'message, 'signature) adversary\\<^sub>1' \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere \"ibounded_by\\<^sub>1' \\<A> q = (interaction_any_bounded_by \\<A> q)\"\n\nabbreviation ibounded_by\\<^sub>1 :: \"('vkey, 'message, 'signature) adversary\\<^sub>1 \\<Rightarrow> (security \\<Rightarrow> nat) \\<Rightarrow> bool\"\nwhere \"ibounded_by\\<^sub>1 \\<equiv> rel_envir ibounded_by\\<^sub>1'\"\n\ndefinition lossless\\<^sub>1' :: \"('vkey, 'message, 'signature) adversary\\<^sub>1' \\<Rightarrow> bool\"\nwhere \"lossless\\<^sub>1' \\<A> = (lossless_gpv \\<I>_full \\<A>)\"\n\nabbreviation lossless\\<^sub>1 :: \"('vkey, 'message, 'signature) adversary\\<^sub>1 \\<Rightarrow> bool\"\nwhere \"lossless\\<^sub>1 \\<equiv> pred_envir lossless\\<^sub>1'\"\n\nsubsubsection \\<open>Multi-user setting\\<close>\n\ndefinition oracle\\<^sub>n :: \"security\n  \\<Rightarrow> ('i \\<Rightarrow> ('vkey, 'sigkey, 'message, 'signature) state_oracle, 'i \\<times> 'message call\\<^sub>1, ('vkey, 'signature) ret\\<^sub>1) oracle'\"\nwhere \"oracle\\<^sub>n \\<eta> = family_oracle (\\<lambda>_. oracle\\<^sub>1 \\<eta>)\"\n\nlemma oracle\\<^sub>n_apply [simp]:\n  \"oracle\\<^sub>n \\<eta> s (i, x) = map_spmf (apsnd (fun_upd s i)) (oracle\\<^sub>1 \\<eta> (s i) x)\"\nby(simp add: oracle\\<^sub>n_def)\n\ntype_synonym ('i, 'vkey', 'message', 'signature') adversary\\<^sub>n' = \n  \"(('i \\<times> 'message' \\<times> 'signature'), 'i \\<times> 'message' call\\<^sub>1, ('vkey', 'signature') ret\\<^sub>1) gpv\"\ntype_synonym ('i, 'vkey', 'message', 'signature') adversary\\<^sub>n =\n  \"security \\<Rightarrow> ('i, 'vkey', 'message', 'signature') adversary\\<^sub>n'\"\n\ndefinition suf_cma\\<^sub>n :: \"('i, 'vkey, 'message, 'signature) adversary\\<^sub>n \\<Rightarrow> security \\<Rightarrow> bool spmf\"\nwhere\n  \"\\<And>log. suf_cma\\<^sub>n \\<A> \\<eta> = do {\n    ((i, m, sig), \\<sigma>) \\<leftarrow> exec_gpv (oracle\\<^sub>n \\<eta>) (\\<A> \\<eta>) (\\<lambda>_. None);\n    return_spmf (\n      case \\<sigma> i of None \\<Rightarrow> False\n      | Some (vkey, skey, log) \\<Rightarrow> verify \\<eta> vkey m sig \\<and> (m, sig) \\<notin> set log)\n  }\"\n\ndefinition advantage\\<^sub>n :: \"('i, 'vkey, 'message, 'signature) adversary\\<^sub>n \\<Rightarrow> advantage\"\nwhere \"advantage\\<^sub>n \\<A> \\<eta> = spmf (suf_cma\\<^sub>n \\<A> \\<eta>) True\"\n\nlemma advantage\\<^sub>n_nonneg: \"advantage\\<^sub>n \\<A> \\<eta> \\<ge> 0\" by(simp add: advantage\\<^sub>n_def pmf_nonneg)\n\nabbreviation secure_for\\<^sub>n :: \"('i, 'vkey, 'message, 'signature) adversary\\<^sub>n \\<Rightarrow> bool\"\nwhere \"secure_for\\<^sub>n \\<A> \\<equiv> negligible (advantage\\<^sub>n \\<A>)\"\n\ndefinition ibounded_by\\<^sub>n' :: \"('i, 'vkey, 'message, 'signature) adversary\\<^sub>n' \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere \"ibounded_by\\<^sub>n' \\<A> q = (interaction_any_bounded_by \\<A> q)\"\n\nabbreviation ibounded_by\\<^sub>n :: \"('i, 'vkey, 'message, 'signature) adversary\\<^sub>n \\<Rightarrow> (security \\<Rightarrow> nat) \\<Rightarrow> bool\"\nwhere \"ibounded_by\\<^sub>n \\<equiv> rel_envir ibounded_by\\<^sub>n'\"\n\ndefinition lossless\\<^sub>n' :: \"('i, 'vkey, 'message, 'signature) adversary\\<^sub>n' \\<Rightarrow> bool\"\nwhere \"lossless\\<^sub>n' \\<A> = (lossless_gpv \\<I>_full \\<A>)\"\n\nabbreviation lossless\\<^sub>n :: \"('i, 'vkey, 'message, 'signature) adversary\\<^sub>n \\<Rightarrow> bool\"\nwhere \"lossless\\<^sub>n \\<equiv> pred_envir lossless\\<^sub>n'\"\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Game_Based_Crypto/SUF_CMA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.658417487156366, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.34975754077065635}}
{"text": "theory General_Luby_Rackoff\n  imports Misc_Luby_Rackoff\nbegin\n\ntype_synonym whole = \\<open>half \\<times> half\\<close>\n\n(*                      x       x1       x2      y      D1   D2    D3 *)\ntype_synonym state = \\<open>whole \\<times> whole \\<times> whole \\<times> whole \\<times> db \\<times> db \\<times> db\\<close>\n\ndefinition X :: \\<open>whole update \\<Rightarrow> state update\\<close> where \\<open>X = Fst\\<close>\ndefinition X1 :: \\<open>whole update \\<Rightarrow> state update\\<close> where \\<open>X1 = Snd o Fst\\<close>\ndefinition X2 :: \\<open>whole update \\<Rightarrow> state update\\<close> where \\<open>X2 = Snd o Snd o Fst\\<close>\ndefinition Y :: \\<open>whole update \\<Rightarrow> state update\\<close> where \\<open>Y = Snd o Snd o Snd o Fst\\<close>\ndefinition D1 :: \\<open>db update \\<Rightarrow> state update\\<close> where \\<open>D1 = Snd o Snd o Snd o Snd o Fst\\<close>\ndefinition D2 :: \\<open>db update \\<Rightarrow> state update\\<close> where \\<open>D2 = Snd o Snd o Snd o Snd o Snd o Fst\\<close>\ndefinition D3 :: \\<open>db update \\<Rightarrow> state update\\<close> where \\<open>D3 = Snd o Snd o Snd o Snd o Snd o Snd\\<close>\n\nlemma [simp,register]: \\<open>mutually compatible (X,X1,X2,Y,D1,D2,D3)\\<close>\n  by (auto simp add: X_def X1_def D1_def X2_def D2_def D3_def Y_def)\n\n(* \n\n(* lemma [simp]: \\<open>each register (reg_1_3, reg_2_3, reg_3_3)\\<close>\n  by (auto simp add: reg_1_3_def reg_2_3_def reg_3_3_def) *)\n\n\n(* LR2 as partial function *)\ndefinition LR2 :: \\<open>db \\<Rightarrow> db \\<Rightarrow> whole \\<Rightarrow> whole option\\<close> where\n  \\<open>LR2 D1 D2 = (\\<lambda>(xL,xR). do {\\<alpha> \\<leftarrow> D1 xL; \\<beta> \\<leftarrow> D2 (xR + \\<alpha>); Some (xL + \\<beta>, xR + \\<alpha>)})\\<close>\n  for D1 D2\n\nend", "meta": {"author": "dominique-unruh", "repo": "luby-rackoff-formalization", "sha": "9b4e48a1fe50baac4c93fc4ae4e9dbbaf68b0b2c", "save_path": "github-repos/isabelle/dominique-unruh-luby-rackoff-formalization", "path": "github-repos/isabelle/dominique-unruh-luby-rackoff-formalization/luby-rackoff-formalization-9b4e48a1fe50baac4c93fc4ae4e9dbbaf68b0b2c/General_Luby_Rackoff.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442251201477016, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3497261638255829}}
{"text": "(*  Title:      HOL/IOA/Solve.thy\n    Author:     Tobias Nipkow & Konrad Slind\n    Copyright   1994  TU Muenchen\n*)\n\nsection \\<open>Weak possibilities mapping (abstraction)\\<close>\n\ntheory Solve\nimports IOA\nbegin\n\ndefinition is_weak_pmap :: \"['c \\<Rightarrow> 'a, ('action,'c)ioa,('action,'a)ioa] \\<Rightarrow> bool\" where\n  \"is_weak_pmap f C A \\<equiv>\n   (\\<forall>s\\<in>starts_of(C). f(s)\\<in>starts_of(A)) \\<and>\n   (\\<forall>s t a. reachable C s \\<and>\n            (s,a,t)\\<in>trans_of(C)\n            \\<longrightarrow> (if a\\<in>externals(asig_of(C)) then\n                   (f(s),a,f(t))\\<in>trans_of(A)\n                 else f(s)=f(t)))\"\n\ndeclare mk_trace_thm [simp] trans_in_actions [simp]\n\nlemma trace_inclusion: \n  \"[| IOA(C); IOA(A); externals(asig_of(C)) = externals(asig_of(A));  \n           is_weak_pmap f C A |] ==> traces(C) \\<subseteq> traces(A)\"\n  apply (unfold is_weak_pmap_def traces_def)\n\n  apply (simp (no_asm) add: has_trace_def)\n  apply safe\n  apply (rename_tac ex1 ex2)\n\n  (* choose same trace, therefore same NF *)\n  apply (rule_tac x = \"mk_trace C ex1\" in exI)\n  apply simp\n\n  (* give execution of abstract automata *)\n  apply (rule_tac x = \"(mk_trace A ex1,\\<lambda>i. f (ex2 i))\" in bexI)\n\n  (* Traces coincide *)\n   apply (simp (no_asm_simp) add: mk_trace_def filter_oseq_idemp)\n\n  (* Use lemma *)\n  apply (frule states_of_exec_reachable)\n\n  (* Now show that it's an execution *)\n  apply (simp add: executions_def)\n  apply safe\n\n  (* Start states map to start states *)\n  apply (drule bspec)\n  apply assumption\n\n  (* Show that it's an execution fragment *)\n  apply (simp add: is_execution_fragment_def)\n  apply safe\n\n  apply (erule_tac x = \"ex2 n\" in allE)\n  apply (erule_tac x = \"ex2 (Suc n)\" in allE)\n  apply (erule_tac x = a in allE)\n  apply simp\n  done\n\n(* Lemmata *)\n\nlemma imp_conj_lemma: \"(P \\<Longrightarrow> Q\\<longrightarrow>R) \\<Longrightarrow> P\\<and>Q \\<longrightarrow> R\"\n  by blast\n\n\n(* fist_order_tautology of externals_of_par *)\nlemma externals_of_par_extra:\n  \"a\\<in>externals(asig_of(A1||A2)) =     \n   (a\\<in>externals(asig_of(A1)) \\<and> a\\<in>externals(asig_of(A2)) \\<or>\n   a\\<in>externals(asig_of(A1)) \\<and> a\\<notin>externals(asig_of(A2)) \\<or>\n   a\\<notin>externals(asig_of(A1)) \\<and> a\\<in>externals(asig_of(A2)))\"\n  apply (auto simp add: externals_def asig_of_par asig_comp_def asig_inputs_def asig_outputs_def)\n  done\n\nlemma comp1_reachable: \"[| reachable (C1||C2) s |] ==> reachable C1 (fst s)\"\n  apply (simp add: reachable_def)\n  apply (erule bexE)\n  apply (rule_tac x =\n    \"(filter_oseq (\\<lambda>a. a\\<in>actions (asig_of (C1))) (fst ex) , \\<lambda>i. fst (snd ex i))\" in bexI)\n(* fst(s) is in projected execution *)\n  apply force\n(* projected execution is indeed an execution *)\n  apply (simp cong del: if_weak_cong\n    add: executions_def is_execution_fragment_def par_def starts_of_def\n      trans_of_def filter_oseq_def\n    split: option.split)\n  done\n\n\n(* Exact copy of proof of comp1_reachable for the second\n   component of a parallel composition.     *)\nlemma comp2_reachable: \"[| reachable (C1||C2) s|] ==> reachable C2 (snd s)\"\n  apply (simp add: reachable_def)\n  apply (erule bexE)\n  apply (rule_tac x =\n    \"(filter_oseq (\\<lambda>a. a\\<in>actions (asig_of (C2))) (fst ex) , \\<lambda>i. snd (snd ex i))\" in bexI)\n(* fst(s) is in projected execution *)\n  apply force\n(* projected execution is indeed an execution *)\n  apply (simp cong del: if_weak_cong\n    add: executions_def is_execution_fragment_def par_def starts_of_def\n    trans_of_def filter_oseq_def\n    split: option.split)\n  done\n\ndeclare if_split [split del] if_weak_cong [cong del]\n\n(*Composition of possibility-mappings *)\nlemma fxg_is_weak_pmap_of_product_IOA: \n     \"[| is_weak_pmap f C1 A1;  \n         externals(asig_of(A1))=externals(asig_of(C1)); \n         is_weak_pmap g C2 A2;   \n         externals(asig_of(A2))=externals(asig_of(C2));  \n         compat_ioas C1 C2; compat_ioas A1 A2  |]      \n   ==> is_weak_pmap (\\<lambda>p.(f(fst(p)),g(snd(p)))) (C1||C2) (A1||A2)\"\n  apply (unfold is_weak_pmap_def)\n  apply (rule conjI)\n(* start_states *)\n  apply (simp add: par_def starts_of_def)\n(* transitions *)\n  apply (rule allI)+\n  apply (rule imp_conj_lemma)\n  apply (simp (no_asm) add: externals_of_par_extra)\n  apply (simp (no_asm) add: par_def)\n  apply (simp add: trans_of_def)\n  apply (simplesubst if_split)\n  apply (rule conjI)\n  apply (rule impI)\n  apply (erule disjE)\n(* case 1      a:e(A1) | a:e(A2) *)\n  apply (simp add: comp1_reachable comp2_reachable ext_is_act)\n  apply (erule disjE)\n(* case 2      a:e(A1) | a~:e(A2) *)\n  apply (simp add: comp1_reachable comp2_reachable ext_is_act ext1_ext2_is_not_act2)\n(* case 3      a:~e(A1) | a:e(A2) *)\n  apply (simp add: comp1_reachable comp2_reachable ext_is_act ext1_ext2_is_not_act1)\n(* case 4      a:~e(A1) | a~:e(A2) *)\n  apply (rule impI)\n  apply (subgoal_tac \"a\\<notin>externals (asig_of (A1)) & a\\<notin>externals (asig_of (A2))\")\n(* delete auxiliary subgoal *)\n  prefer 2\n  apply force\n  apply (simp (no_asm) add: conj_disj_distribR cong add: conj_cong split: if_split)\n  apply (tactic \\<open>\n    REPEAT((resolve_tac \\<^context> [conjI, impI] 1 ORELSE eresolve_tac \\<^context> [conjE] 1) THEN\n      asm_full_simp_tac(\\<^context> addsimps [@{thm comp1_reachable}, @{thm comp2_reachable}]) 1)\\<close>)\n  done\n\n\nlemma reachable_rename_ioa: \"[| reachable (rename C g) s |] ==> reachable C s\"\n  apply (simp add: reachable_def)\n  apply (erule bexE)\n  apply (rule_tac x = \"((\\<lambda>i. case (fst ex i) of None \\<Rightarrow> None | Some (x) => g x) ,snd ex)\" in bexI)\n  apply (simp (no_asm))\n(* execution is indeed an execution of C *)\n  apply (simp add: executions_def is_execution_fragment_def par_def\n    starts_of_def trans_of_def rename_def split: option.split)\n  apply force\n  done\n\n\nlemma rename_through_pmap: \"[| is_weak_pmap f C A |] \n                       ==> (is_weak_pmap f (rename C g) (rename A g))\"\n  apply (simp add: is_weak_pmap_def)\n  apply (rule conjI)\n  apply (simp add: rename_def starts_of_def)\n  apply (rule allI)+\n  apply (rule imp_conj_lemma)\n  apply (simp (no_asm) add: rename_def)\n  apply (simp add: externals_def asig_inputs_def asig_outputs_def asig_of_def trans_of_def)\n  apply safe\n  apply (simplesubst if_split)\n  apply (rule conjI)\n  apply (rule impI)\n  apply (erule disjE)\n  apply (erule exE)\n  apply (erule conjE)\n(* x is input *)\n  apply (drule sym)\n  apply (drule sym)\n  apply simp\n  apply hypsubst+\n  apply (cut_tac C = \"C\" and g = \"g\" and s = \"s\" in reachable_rename_ioa)\n  apply assumption\n  apply simp\n(* x is output *)\n  apply (erule exE)\n  apply (erule conjE)\n  apply (drule sym)\n  apply (drule sym)\n  apply simp\n  apply hypsubst+\n  apply (cut_tac C = \"C\" and g = \"g\" and s = \"s\" in reachable_rename_ioa)\n  apply assumption\n  apply simp\n(* x is internal *)\n  apply (simp (no_asm) cong add: conj_cong)\n  apply (rule impI)\n  apply (erule conjE)\n  apply (cut_tac C = \"C\" and g = \"g\" and s = \"s\" in reachable_rename_ioa)\n  apply auto\n  done\n\ndeclare if_split [split] if_weak_cong [cong]\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/IOA/Solve.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3497261564093474}}
{"text": "section\\<open>Theory of Cryptographic Keys for Security Protocols against the General Attacker\\<close>\n\ntheory PublicGA imports EventGA begin\n\nlemma invKey_K: \"K \\<in> symKeys \\<Longrightarrow> invKey K = K\"\nby (simp add: symKeys_def)\n\nsubsection\\<open>Asymmetric Keys\\<close>\n\ndatatype keymode = Signature | Encryption\n\nconsts\n  publicKey :: \"[keymode,agent] => key\"\n\nabbreviation\n  pubEK :: \"agent => key\" where\n  \"pubEK == publicKey Encryption\"\n\nabbreviation\n  pubSK :: \"agent => key\" where\n  \"pubSK == publicKey Signature\"\n\nabbreviation\n  privateKey :: \"[keymode, agent] => key\" where\n  \"privateKey b A == invKey (publicKey b A)\"\n\nabbreviation\n  (*BEWARE!! priEK, priSK DON'T WORK with inj, range, image, etc.*)\n  priEK :: \"agent => key\" where\n  \"priEK A == privateKey Encryption A\"\n\nabbreviation\n  priSK :: \"agent => key\" where\n  \"priSK A == privateKey Signature A\"\n\n\ntext\\<open>These abbreviations give backward compatibility.  They represent the\nsimple situation where the signature and encryption keys are the same.\\<close>\n\nabbreviation\n  pubK :: \"agent => key\" where\n  \"pubK A == pubEK A\"\n\nabbreviation\n  priK :: \"agent => key\" where\n  \"priK A == invKey (pubEK A)\"\n\n\ntext\\<open>By freeness of agents, no two agents have the same key.  Since\n  @{term \"True\\<noteq>False\"}, no agent has identical signing and encryption keys\\<close>\nspecification (publicKey)\n  injective_publicKey:\n    \"publicKey b A = publicKey c A' \\<Longrightarrow> b=c \\<and> A=A'\"\n   apply (rule exI [of _ \n       \"%b A. 2 * case_agent (\\<lambda>n. n + 2) A + case_keymode 0 1 b\"])\n   apply (auto simp add: inj_on_def split: agent.split keymode.split)\n   apply presburger\n   apply presburger\n   done                       \n\n\naxiomatization where\n  (*No private key equals any public key (essential to ensure that private\n    keys are private!) *)\n  privateKey_neq_publicKey [iff]: \"privateKey b A \\<noteq> publicKey c A'\"\n\nlemmas publicKey_neq_privateKey = privateKey_neq_publicKey [THEN not_sym]\ndeclare publicKey_neq_privateKey [iff]\n\n\nsubsection\\<open>Basic properties of @{term pubK} and @{term priK}\\<close>\n\nlemma publicKey_inject [iff]: \"(publicKey b A = publicKey c A') = (b=c \\<and> A=A')\"\nby (blast dest!: injective_publicKey) \n\nlemma not_symKeys_pubK [iff]: \"publicKey b A \\<notin> symKeys\"\nby (simp add: symKeys_def)\n\nlemma not_symKeys_priK [iff]: \"privateKey b A \\<notin> symKeys\"\nby (simp add: symKeys_def)\n\nlemma symKey_neq_priEK: \"K \\<in> symKeys \\<Longrightarrow> K \\<noteq> priEK A\"\nby auto\n\nlemma symKeys_neq_imp_neq: \"(K \\<in> symKeys) \\<noteq> (K' \\<in> symKeys) \\<Longrightarrow> K \\<noteq> K'\"\nby blast\n\nlemma symKeys_invKey_iff [iff]: \"(invKey K \\<in> symKeys) = (K \\<in> symKeys)\"\nby (unfold symKeys_def, auto)\n\nlemma analz_symKeys_Decrypt:\n     \"[| Crypt K X \\<in> analz H;  K \\<in> symKeys;  Key K \\<in> analz H |]  \n      ==> X \\<in> analz H\"\nby (auto simp add: symKeys_def)\n\n\n\nsubsection\\<open>\"Image\" equations that hold for injective functions\\<close>\n\nlemma invKey_image_eq [simp]: \"(invKey x \\<in> invKey`A) = (x \\<in> A)\"\nby auto\n\n(*holds because invKey is injective*)\nlemma publicKey_image_eq [simp]:\n     \"(publicKey b x \\<in> publicKey c ` AA) = (b=c \\<and> x \\<in> AA)\"\nby auto\n\nlemma privateKey_notin_image_publicKey [simp]: \"privateKey b x \\<notin> publicKey c ` AA\"\nby auto\n\nlemma privateKey_image_eq [simp]:\n     \"(privateKey b A \\<in> invKey ` publicKey c ` AS) = (b=c \\<and> A\\<in>AS)\"\nby auto\n\nlemma publicKey_notin_image_privateKey [simp]: \"publicKey b A \\<notin> invKey ` publicKey c ` AS\"\nby auto\n\n\nsubsection\\<open>Symmetric Keys\\<close>\n\ntext\\<open>For some protocols, it is convenient to equip agents with symmetric as\nwell as asymmetric keys.  The theory \\<open>Shared\\<close> assumes that all keys\nare symmetric.\\<close>\n\nconsts\n  shrK    :: \"agent => key\"    \\<comment> \\<open>long-term shared keys\\<close>\n\nspecification (shrK)\n  inj_shrK: \"inj shrK\"\n  \\<comment> \\<open>No two agents have the same long-term key\\<close>\n   apply (rule exI [of _ \"case_agent (\\<lambda>n. n + 2)\"]) \n   apply (simp add: inj_on_def split: agent.split) \n   done\n\naxiomatization where\n  sym_shrK [iff]: \"shrK X \\<in> symKeys\" \\<comment> \\<open>All shared keys are symmetric\\<close>\n\ntext\\<open>Injectiveness: Agents' long-term keys are distinct.\\<close>\nlemmas shrK_injective = inj_shrK [THEN inj_eq]\ndeclare shrK_injective [iff]\n\nlemma invKey_shrK [simp]: \"invKey (shrK A) = shrK A\"\nby (simp add: invKey_K) \n\nlemma analz_shrK_Decrypt:\n     \"[| Crypt (shrK A) X \\<in> analz H; Key(shrK A) \\<in> analz H |] ==> X \\<in> analz H\"\nby auto\n\nlemma analz_Decrypt':\n     \"[| Crypt K X \\<in> analz H; K \\<in> symKeys; Key K \\<in> analz H |] ==> X \\<in> analz H\"\nby (auto simp add: invKey_K)\n\nlemma priK_neq_shrK [iff]: \"shrK A \\<noteq> privateKey b C\"\nby (simp add: symKeys_neq_imp_neq)\n\nlemmas shrK_neq_priK = priK_neq_shrK [THEN not_sym]\ndeclare shrK_neq_priK [simp]\n\nlemma pubK_neq_shrK [iff]: \"shrK A \\<noteq> publicKey b C\"\nby (simp add: symKeys_neq_imp_neq)\n\nlemmas shrK_neq_pubK = pubK_neq_shrK [THEN not_sym]\ndeclare shrK_neq_pubK [simp]\n\nlemma priEK_noteq_shrK [simp]: \"priEK A \\<noteq> shrK B\" \nby auto\n\nlemma publicKey_notin_image_shrK [simp]: \"publicKey b x \\<notin> shrK ` AA\"\nby auto\n\nlemma privateKey_notin_image_shrK [simp]: \"privateKey b x \\<notin> shrK ` AA\"\nby auto\n\nlemma shrK_notin_image_publicKey [simp]: \"shrK x \\<notin> publicKey b ` AA\"\nby auto\n\nlemma shrK_notin_image_privateKey [simp]: \"shrK x \\<notin> invKey ` publicKey b ` AA\" \nby auto\n\nlemma shrK_image_eq [simp]: \"(shrK x \\<in> shrK ` AA) = (x \\<in> AA)\"\nby auto\n\ntext\\<open>For some reason, moving this up can make some proofs loop!\\<close>\ndeclare invKey_K [simp]\n\n\nsubsection\\<open>Initial States of Agents\\<close>\n\noverloading\n  initState \\<equiv> initState\nbegin\n\nprimrec initState where\n\n  initState_Friend:\n    \"initState (Friend i) =    \n       {Key (priEK (Friend i)), Key (priSK (Friend i)), Key (shrK (Friend i))} \\<union> \n       (Key ` range pubEK) \\<union> (Key ` range pubSK)\"\nend\n\n\nlemma used_parts_subset_parts [rule_format]:\n     \"\\<forall>X \\<in> used evs. parts {X} \\<subseteq> used evs\"\napply (induct evs) \n prefer 2\n apply (simp add: used_Cons)\n apply (rule ballI)  \n apply (case_tac a, auto)  \napply (auto dest!: parts_cut) \ntxt\\<open>Base case\\<close>\napply (simp add: used_Nil) \ndone\n\nlemma MPair_used_D: \"\\<lbrace>X,Y\\<rbrace> \\<in> used H \\<Longrightarrow> X \\<in> used H \\<and> Y \\<in> used H\"\nby (drule used_parts_subset_parts, simp, blast)\n\ntext\\<open>There was a similar theorem in Event.thy, so perhaps this one can\n  be moved up if proved directly by induction.\\<close>\nlemma MPair_used [elim!]:\n     \"[| \\<lbrace>X,Y\\<rbrace> \\<in> used H;\n         [| X \\<in> used H; Y \\<in> used H |] ==> P |] \n      ==> P\"\nby (blast dest: MPair_used_D) \n\n\ntext\\<open>Rewrites should not refer to  @{term \"initState(Friend i)\"} because\n  that expression is not in normal form.\\<close>\n\nlemma keysFor_parts_initState [simp]: \"keysFor (parts (initState C)) = {}\"\napply (unfold keysFor_def)\napply (induct_tac \"C\")\napply (auto intro: range_eqI)\ndone\n\nlemma Crypt_notin_initState: \"Crypt K X \\<notin> parts (initState B)\"\nby (induct B, auto)\n\nlemma Crypt_notin_used_empty [simp]: \"Crypt K X \\<notin> used []\"\nby (simp add: Crypt_notin_initState used_Nil)\n\n(*** Basic properties of shrK ***)\n\n(*Agents see their own shared keys!*)\nlemma shrK_in_initState [iff]: \"Key (shrK A) \\<in> initState A\"\nby (induct_tac \"A\", auto)\n\nlemma shrK_in_knows [iff]: \"Key (shrK A) \\<in> knows A evs\"\nby (simp add: initState_subset_knows [THEN subsetD])\n\nlemma shrK_in_used [iff]: \"Key (shrK A) \\<in> used evs\"\nby (rule initState_into_used, blast)\n\n\n(** Fresh keys never clash with long-term shared keys **)\n\n(*Used in parts_induct_tac and analz_Fake_tac to distinguish session keys\n  from long-term shared keys*)\nlemma Key_not_used [simp]: \"Key K \\<notin> used evs \\<Longrightarrow> K \\<notin> range shrK\"\nby blast\n\nlemma shrK_neq: \"Key K \\<notin> used evs \\<Longrightarrow> shrK B \\<noteq> K\"\nby blast\n\nlemmas neq_shrK = shrK_neq [THEN not_sym]\ndeclare neq_shrK [simp]\n\n\nsubsection\\<open>Function @{term \"knows Spy\"}\\<close>\n\nlemma not_SignatureE [elim!]: \"b \\<noteq> Signature \\<Longrightarrow> b = Encryption\"\n  by (cases b, auto) \n\ntext\\<open>Agents see their own private keys!\\<close>\nlemma priK_in_initState [iff]: \"Key (privateKey b A) \\<in> initState A\"\n  by (cases A, auto)\n\ntext\\<open>Agents see all public keys!\\<close>\nlemma publicKey_in_initState [iff]: \"Key (publicKey b A) \\<in> initState B\"\n  by (cases B, auto) \n\ntext\\<open>All public keys are visible\\<close>\nlemma spies_pubK [iff]: \"Key (publicKey b A) \\<in> knows B evs\"\napply (induct_tac \"evs\")\napply (auto simp add: imageI knows_Cons split: event.split)\ndone\n\n\nlemmas analz_spies_pubK = spies_pubK [THEN analz.Inj]\ndeclare analz_spies_pubK [iff]\n\n(*Note: there never is at this stage a lemma about what an agent cannot know*)\n\nlemma publicKey_into_used [iff] :\"Key (publicKey b A) \\<in> used evs\"\napply (rule initState_into_used)\napply (rule publicKey_in_initState [THEN parts.Inj])\ndone\n\nlemma privateKey_into_used [iff]: \"Key (privateKey b A) \\<in> used evs\"\napply(rule initState_into_used)\napply(rule priK_in_initState [THEN parts.Inj])\ndone\n\nlemma Crypt_analz_bad:\n     \"[| Crypt (shrK A) X \\<in> analz (knows A evs) |]  \n      ==> X \\<in> analz (knows A evs)\"\nby force\n\n\nsubsection\\<open>Fresh Nonces\\<close>\n\nlemma Nonce_notin_initState [iff]: \"Nonce N \\<notin> parts (initState B)\"\nby (induct_tac \"B\", auto)\n\nlemma Nonce_notin_used_empty [simp]: \"Nonce N \\<notin> used []\"\nby (simp add: used_Nil)\n\n\nsubsection\\<open>Supply fresh nonces for possibility theorems\\<close>\n\ntext\\<open>In any trace, there is an upper bound N on the greatest nonce in use\\<close>\nlemma Nonce_supply_lemma: \"\\<exists>N. \\<forall>n. N\\<le>n \\<longrightarrow> Nonce n \\<notin> used evs\"\napply (induct_tac \"evs\")\napply (rule_tac x = 0 in exI)\napply (simp_all (no_asm_simp) add: used_Cons split: event.split)\napply safe\napply (rule msg_Nonce_supply [THEN exE], blast elim!: add_leE)+\ndone\n\nlemma Nonce_supply1: \"\\<exists>N. Nonce N \\<notin> used evs\"\nby (rule Nonce_supply_lemma [THEN exE], blast)\n\nlemma Nonce_supply: \"Nonce (SOME N. Nonce N \\<notin> used evs) \\<notin> used evs\"\napply (rule Nonce_supply_lemma [THEN exE])\napply (rule someI, fast)\ndone\n\nsubsection\\<open>Specialized Rewriting for Theorems About @{term analz} and Image\\<close>\n\nlemma insert_Key_singleton: \"insert (Key K) H = Key ` {K} \\<union> H\"\nby blast\n\nlemma insert_Key_image: \"insert (Key K) (Key`KK \\<union> C) = Key ` (insert K KK) \\<union> C\"\nby blast\n\n\nlemma Crypt_imp_keysFor :\"[|Crypt K X \\<in> H; K \\<in> symKeys|] ==> K \\<in> keysFor H\"\nby (drule Crypt_imp_invKey_keysFor, simp)\n\ntext\\<open>Lemma for the trivial direction of the if-and-only-if of the \nSession Key Compromise Theorem\\<close>\nlemma analz_image_freshK_lemma:\n     \"(Key K \\<in> analz (Key`nE \\<union> H)) \\<longrightarrow> (K \\<in> nE | Key K \\<in> analz H)  \\<Longrightarrow>  \n         (Key K \\<in> analz (Key`nE \\<union> H)) = (K \\<in> nE | Key K \\<in> analz H)\"\nby (blast intro: analz_mono [THEN [2] rev_subsetD])\n\nlemmas analz_image_freshK_simps =\n       simp_thms mem_simps \\<comment> \\<open>these two allow its use with @{text \"only:\"}\\<close>\n       disj_comms \n       image_insert [THEN sym] image_Un [THEN sym] empty_subsetI insert_subset\n       analz_insert_eq Un_upper2 [THEN analz_mono, THEN subsetD]\n       insert_Key_singleton \n       Key_not_used insert_Key_image Un_assoc [THEN sym]\n\nML \\<open>\nstructure Public =\nstruct\n\nval analz_image_freshK_ss =\n  simpset_of (@{context}\n    delsimps [image_insert, image_Un]\n    delsimps [@{thm imp_disjL}]    (*reduces blow-up*)\n    addsimps @{thms analz_image_freshK_simps})\n\n(*Tactic for possibility theorems*)\nfun possibility_tac ctxt =\n    REPEAT (*omit used_Says so that Nonces start from different traces!*)\n    (ALLGOALS (simp_tac (ctxt delsimps [@{thm used_Says}]))\n     THEN\n     REPEAT_FIRST (eq_assume_tac ORELSE' \n                   resolve_tac ctxt [refl, conjI, @{thm Nonce_supply}]))\n\n(*For harder protocols (such as Recur) where we have to set up some\n  nonces and keys initially*)\nfun basic_possibility_tac ctxt =\n    REPEAT \n    (ALLGOALS (asm_simp_tac (ctxt setSolver safe_solver))\n     THEN\n     REPEAT_FIRST (resolve_tac ctxt [refl, conjI]))\n\nend\n\\<close>\n\nmethod_setup analz_freshK = \\<open>\n    Scan.succeed (fn ctxt =>\n     (SIMPLE_METHOD\n      (EVERY [REPEAT_FIRST (resolve_tac ctxt [allI, ballI, impI]),\n          REPEAT_FIRST (resolve_tac ctxt @{thms analz_image_freshK_lemma}),\n          ALLGOALS (asm_simp_tac (put_simpset Public.analz_image_freshK_ss ctxt))])))\\<close>\n    \"for proving the Session Key Compromise theorem\"\n\n\nsubsection\\<open>Specialized Methods for Possibility Theorems\\<close>\n\nmethod_setup possibility = \\<open>\n    Scan.succeed (SIMPLE_METHOD o Public.possibility_tac)\\<close>\n    \"for proving possibility theorems\"\n\nmethod_setup basic_possibility = \\<open>\n    Scan.succeed (SIMPLE_METHOD o Public.basic_possibility_tac)\\<close>\n    \"for proving possibility theorems\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Inductive_Confidentiality/GeneralAttacker/PublicGA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3497261564093474}}
{"text": "theory step_rel\nimports memory_model trans_sim\nbegin\n\nlocale step_rel = memory_model\n where actions =  \"actions :: (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action set\"\n    and locations = \"locations :: loc_type set\"\n    and actionIDs = \"actionIDs :: aid_type set\"\n    and times = \"times :: time_type set\"\n    and threads = \"threads :: 'tid set\"\n    and locks = \"locks :: 'lock set\"\n    and names = \"names :: 'name set\"\n    and callIDs = \"callIDs :: 'callID set\" \n    and free_set = \"free_set:: (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n             \\<Rightarrow> time_type \\<Rightarrow> loc_type set\"\n    and can_read = \"can_read:: (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n                 \\<Rightarrow> 'tid \\<Rightarrow> time_type \\<Rightarrow> loc_type \\<Rightarrow> 'val set\"\n    and update_mem = \"update_mem:: (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n                       \\<Rightarrow> time_type \\<Rightarrow> ('tid \\<times> aid_type \\<times>\n                             (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) set\n                        \\<Rightarrow> (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option) \\<Rightarrow> bool\"\n    and start_mem = \"start_mem:: (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\"\n  for actions locations actionIDs times threads locks names callIDs \n         free_set can_read update_mem start_mem +\n  fixes step_rel::\"'tid \\<Rightarrow> time_type \\<Rightarrow> ('node, 'edge_type, 'instr) flowgraph \\<Rightarrow> (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option) \\<Rightarrow> 'config \\<Rightarrow> \n   ('tid \\<times> aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) set \\<Rightarrow> 'config \\<Rightarrow> bool\"\n  and start_state::\"('tid \\<rightharpoonup> ('node, 'edge_type, 'instr) flowgraph)\n                                \\<Rightarrow> time_type \\<Rightarrow> ('tid \\<rightharpoonup> 'config) \\<Rightarrow> (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option) \\<Rightarrow> bool\"\n  and get_point::\"'config \\<Rightarrow> 'node\"\n  and instr_edges::\"'instr \\<Rightarrow> ('edge_type \\<Rightarrow> nat) set\"\n  and Seq::'edge_type\n  assumes start_points [simp]: \"start_state CFGs t S m\n         \\<Longrightarrow> (\\<lambda> x . case S x of Some a \\<Rightarrow> (\\<lambda>C. Some (get_point C)) a \n                              | None \\<Rightarrow> None) = start_points CFGs\"\n      and step_along_edge: \"\\<lbrakk>step_rel tid t G m C ops C'; is_flowgraph G Seq instr_edges; get_point C \\<in> Nodes G\\<rbrakk> \\<Longrightarrow> \n    \\<exists>ty. (get_point C, get_point C', ty) \\<in> Edges (G::('node, 'edge_type, 'instr) flowgraph)\"\n\nbegin\n\nlemma step_safe: \"\\<lbrakk>step_rel tid t G m C ops C'; is_flowgraph G Seq instr_edges; get_point C \\<in> Nodes G\\<rbrakk> \\<Longrightarrow> \n    get_point C' \\<in> Nodes G\"\nby (drule step_along_edge, simp+, simp add: is_flowgraph_def flowgraph_def pointed_graph_def)\n\nabbreviation \"well_formed G \\<equiv> is_flowgraph G Seq instr_edges\"\n\ninductive one_step where\nstep_single [intro!]: \"\\<lbrakk>step_rel tid t G mem C ops C'; update_mem mem t ops mem'\\<rbrakk> \\<Longrightarrow> \n  one_step tid G (t,C, mem) (Suc t,C', mem')\"\n\nlemma one_step_safe: \"\\<lbrakk>one_step tid G (t,C, mem) (t',C', mem'); well_formed G; get_point C \\<in> Nodes G\\<rbrakk> \\<Longrightarrow> \n  get_point C' \\<in> Nodes G\"\nby (erule one_step.cases, rule step_safe, simp+)\n\nlemma one_step_along_edge: \"\\<lbrakk>one_step tid G (t,C, m) (t',C', m'); is_flowgraph G Seq instr_edges; \n  get_point C \\<in> Nodes G\\<rbrakk> \\<Longrightarrow> \\<exists>ty. (get_point C, get_point C', ty) \\<in> Edges G\"\nby (erule one_step.cases, rule step_along_edge, simp+)\n\ninductive conc_step where\nstep_thread [intro]: \"\\<lbrakk>CFGs tid = Some G; states tid = Some C; step_rel tid t G mem C ops C'; \n  update_mem mem t ops mem'\\<rbrakk> \\<Longrightarrow> conc_step CFGs (t,states, mem) (Suc t,states(tid \\<mapsto> C'), mem')\"\n\nabbreviation \"get_points (S::'tid \\<rightharpoonup> 'config) \\<equiv>\n                  (\\<lambda> x . case S x of Some a \\<Rightarrow> (\\<lambda>C. Some (get_point C)) a \n                              | None \\<Rightarrow> None)\"\n\nlemma one_step_conc_step: \"\\<lbrakk>one_step tid G (t,C, m) (t',C', m'); CFGs tid = Some G; states tid = Some C\\<rbrakk> \\<Longrightarrow> \n  conc_step CFGs (t,states, m) (t',states(tid \\<mapsto> C'), m')\"\n  apply (erule one_step.cases)\n  by blast\n\nterm \"safe_points\"\n\nlemma conc_step_safe: \"\\<lbrakk>conc_step CFGs (t,states, mem) (t',states', mem'); tCFG CFGs instr_edges Seq; \n  safe_points CFGs (get_points states)\\<rbrakk> \\<Longrightarrow> \n  safe_points CFGs (get_points states')\"\napply (erule conc_step.cases, clarsimp simp add: safe_points_def)\napply (case_tac \"t = t\", clarsimp)\napply (rule step_safe, simp+)\napply (erule tCFG.CFGs, simp)\napply force\napply (force simp add: map_comp_def)\ndone\n\nlemma conc_steps_safe: \"\\<lbrakk>(conc_step CFGs)^** (t,states, mem) (t',states', mem'); tCFG CFGs instr_edges Seq; \n  safe_points CFGs (get_points states)\\<rbrakk> \\<Longrightarrow> \n  safe_points CFGs (get_points states')\"\nby (drule_tac P=\"\\<lambda>(t,states, mem) (t',states', mem'). safe_points CFGs (get_points states) \\<longrightarrow> \n  safe_points CFGs (get_points states')\" in rtranclp.induct, auto intro: conc_step_safe)\n\ndefinition \"run_prog CFGs C \\<equiv> \\<exists>t C0 mem0. start_state CFGs t C0 mem0 \\<and> (conc_step CFGs)^** (t,C0, mem0) C\"\n\nlemma run_progI [intro]: \"\\<lbrakk>start_state CFGs t C0 mem0; (conc_step CFGs)^** (t,C0, mem0) C\\<rbrakk> \\<Longrightarrow> \n  run_prog CFGs C\"\nby (force simp add: run_prog_def)\n\nlemma run_prog_conc_step [intro]: \"\\<lbrakk>run_prog CFGs C; conc_step CFGs C C'\\<rbrakk> \\<Longrightarrow> run_prog CFGs C'\"\n  by (meson rtranclp.rtrancl_into_rtrancl run_prog_def)\n\nlemma run_prog_conc_steps [intro]: \"\\<lbrakk>run_prog CFGs C; (conc_step CFGs)^** C C'\\<rbrakk> \\<Longrightarrow> run_prog CFGs C'\"\n  by (meson rtranclp_trans run_prog_def)\n\nlemma run_prog_induct [elim]: \"\\<lbrakk>run_prog CFGs C; \\<And>t C0 mem0. start_state CFGs t C0 mem0 \\<Longrightarrow> P (t,C0, mem0); \n \\<And>C C'. run_prog CFGs C \\<Longrightarrow> P C \\<Longrightarrow> conc_step CFGs C C' \\<Longrightarrow> P C'\\<rbrakk> \\<Longrightarrow> P C\"\napply (clarsimp simp add: run_prog_def)\n  by (smt conc_step.cases rtranclp_induct)\n\nlemma run_prog_one_step: \"\\<lbrakk>run_prog CFGs (t,S, mem); S tid = Some s; CFGs tid = Some G;\n one_step tid G (t,s, mem) (t',s', mem')\\<rbrakk> \\<Longrightarrow> run_prog CFGs (t',S(tid \\<mapsto> s'), mem')\"\n  apply (erule run_prog_conc_step)\n  by (simp add: one_step_conc_step)\n\nlemma run_prog_one_steps: \"\\<lbrakk>run_prog CFGs (t,S, mem); S tid = Some s; CFGs tid = Some G;\n (one_step tid G)^** (t,s, mem) (t',s', mem')\\<rbrakk> \\<Longrightarrow> run_prog CFGs (t',S(tid \\<mapsto> s'), mem')\"\napply (drule_tac P=\"\\<lambda>(t,s, mem) (t',s', mem'). run_prog CFGs (t,S, mem) \\<and> S tid = Some s \\<and> CFGs tid = Some G \\<longrightarrow> \n  run_prog CFGs (t',S(tid \\<mapsto> s'), mem')\" in rtranclp.induct, auto simp add: map_upd_triv)\napply (drule_tac mem=ba in run_prog_one_step, simp+, force, simp+)\ndone\n\nlemma run_prog_step: \"\\<lbrakk>run_prog CFGs (t,S, mem); S tid = Some s; CFGs tid = Some G;\n step_rel tid t G mem s ops s'; update_mem mem t ops mem'\\<rbrakk> \\<Longrightarrow> run_prog CFGs (Suc t,S(tid \\<mapsto> s'), mem')\"\n  by (erule run_prog_one_step, auto)\n\nlemma run_prog_safe: \"\\<lbrakk>run_prog CFGs (t,S, mem); tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n  safe_points CFGs (get_points S)\"\nproof - assume \"tCFG CFGs instr_edges Seq\" then interpret tCFG .\nshow \"\\<lbrakk>run_prog CFGs (t,S, mem); tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n  safe_points CFGs (get_points S)\"\nby (clarsimp simp add: run_prog_def, rule conc_steps_safe, simp+)\nqed\n\n(* paths *)\nlemma step_increment_path: \"\\<lbrakk>step_rel tid t G m C a C'; tCFG CFGs instr_edges Seq; CFGs tid = Some G; \n  l \\<in> pre_tCFG.Paths CFGs ps; p = get_point C; p' = get_point C'; ps tid = Some p'; p \\<in> Nodes G\\<rbrakk> \\<Longrightarrow> \n  [ps(tid \\<mapsto> p)] \\<frown> l \\<in> pre_tCFG.Paths CFGs (ps(tid \\<mapsto> p))\"\nproof - assume \"tCFG CFGs instr_edges Seq\" then interpret tCFG .\nshow \"\\<lbrakk>step_rel tid t G m C a C'; tCFG CFGs instr_edges Seq; CFGs tid = Some G; \n  l \\<in> pre_tCFG.Paths CFGs ps; p = get_point C; p' = get_point C'; ps tid = Some p'; p \\<in> Nodes G\\<rbrakk> \\<Longrightarrow> \n  [ps(tid \\<mapsto> p)] \\<frown> l \\<in> pre_tCFG.Paths CFGs (ps(tid \\<mapsto> p))\"\napply (rule pre_tCFG.path_incremental_gen, unfold_locales, simp)\napply (frule step_along_edge)\napply (erule tCFG.CFGs, simp+)\ndone\nqed\n\nlemma step_increment_rpath: \"\\<lbrakk>step_rel tid t G m C a C'; tCFG CFGs instr_edges Seq; CFGs tid = Some G; \n  l \\<in> pre_tCFG.RPaths CFGs ps; p0 = get_point C; p = get_point C'; ps tid = Some p0; p0 \\<in> Nodes G\\<rbrakk> \\<Longrightarrow> \n [ps(tid \\<mapsto> p)] \\<frown> l \\<in> pre_tCFG.RPaths CFGs (ps(tid \\<mapsto> p))\"\nproof - assume \"tCFG CFGs instr_edges Seq\" then interpret tCFG .\nshow \"\\<lbrakk>step_rel tid t G m C a C'; tCFG CFGs instr_edges Seq; CFGs tid = Some G; \n  l \\<in> pre_tCFG.RPaths CFGs ps; p0 = get_point C; p = get_point C'; ps tid = Some p0; p0 \\<in> Nodes G\\<rbrakk> \\<Longrightarrow> \n [ps(tid \\<mapsto> p)] \\<frown> l \\<in> pre_tCFG.RPaths CFGs (ps(tid \\<mapsto> p))\"\napply (rule rpath_incremental_gen, simp+, clarsimp)\napply (frule step_along_edge)\napply (erule tCFG.CFGs, simp+)\ndone\nqed\n\nlemma one_step_increment_path: \"\\<lbrakk>one_step tid G (t,C, m) (t',C', m'); tCFG CFGs instr_edges Seq; CFGs tid = Some G; \n  l \\<in> pre_tCFG.Paths CFGs ps; p = get_point C; p' = get_point C'; ps tid = Some p'; p \\<in> Nodes G\\<rbrakk> \\<Longrightarrow> \n  [ps(tid \\<mapsto> p)] \\<frown> l \\<in> pre_tCFG.Paths CFGs (ps(tid \\<mapsto> p))\"\nby (erule one_step.cases, rule step_increment_path, simp+)\n\nlemma one_step_increment_rpath: \"\\<lbrakk>one_step tid G (t,C, m) (t',C', m'); tCFG CFGs instr_edges Seq; CFGs tid = Some G; \n  l \\<in> pre_tCFG.RPaths CFGs ps; p0 = get_point C; p = get_point C'; ps tid = Some p0; p0 \\<in> Nodes G\\<rbrakk> \\<Longrightarrow> \n [ps(tid \\<mapsto> p)] \\<frown> l \\<in> pre_tCFG.RPaths CFGs (ps(tid \\<mapsto> p))\"\nby (erule one_step.cases, rule step_increment_rpath, simp+)\n\nlemma conc_step_increment_path: \"\\<lbrakk>conc_step CFGs C C'; tCFG CFGs instr_edges Seq; \n  l \\<in> pre_tCFG.Paths CFGs (get_points (fst (snd C'))); safe_points CFGs (get_points (fst (snd C)))\\<rbrakk> \\<Longrightarrow> \n [get_points (fst (snd C))] \\<frown> l \\<in> pre_tCFG.Paths CFGs (get_points (fst (snd C)))\"\napply (auto elim!: conc_step.cases)\napply (frule_tac ps=\"get_points (states(tid \\<mapsto> C'a))\" in step_increment_path, auto simp add: safe_points_def)\napply force\napply (subgoal_tac \"get_points (states(tid \\<mapsto> C'a))(tid \\<mapsto> get_point Ca) = get_points states\", simp)\napply (rule ext, clarsimp simp add: map_comp_def)\ndone\n\nlemma conc_steps_path: \"\\<lbrakk>(conc_step CFGs)^** (t,states, mem) (t',states', mem'); tCFG CFGs instr_edges Seq; \n  l \\<in> pre_tCFG.Paths CFGs (get_points states'); safe_points CFGs (get_points states)\\<rbrakk> \\<Longrightarrow> \n \\<exists>l'. hd (l' @ [l 0]) = get_points states \\<and> l' \\<frown> l \\<in> pre_tCFG.Paths CFGs (get_points states)\"\nproof - assume \"tCFG CFGs instr_edges Seq\" then interpret tCFG .\nshow \"\\<lbrakk>(conc_step CFGs)^** (t,states, mem) (t',states', mem'); tCFG CFGs instr_edges Seq; \n  l \\<in> pre_tCFG.Paths CFGs (get_points states'); safe_points CFGs (get_points states)\\<rbrakk> \\<Longrightarrow> \n \\<exists>l'. hd (l' @ [l 0]) = get_points states \\<and> l' \\<frown> l \\<in> pre_tCFG.Paths CFGs (get_points states)\"\napply (drule_tac P=\"\\<lambda>(t,states, mem) (t',states', mem'). \\<forall>l. l \\<in> pre_tCFG.Paths CFGs (get_points states') \\<and> \n  safe_points CFGs (get_points states) \\<longrightarrow> (\\<exists>l'. hd (l' @ [l 0]) = get_points states \\<and> \n  l' \\<frown> l \\<in> pre_tCFG.Paths CFGs (get_points states))\" in rtranclp.induct, auto)\napply (rule_tac x=\"[]\" in exI, simp)\napply (drule conc_step_increment_path, simp+)\napply (drule conc_steps_safe, simp+)\nby (metis append_is_Nil_conv hd_append2 i_append_assoc i_append_nth_Cons_0 not_Cons_self2)\nqed\n\nlemma run_prog_path: \"\\<lbrakk>run_prog CFGs C; tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n  \\<exists>t C0 mem0. start_state CFGs t C0 mem0 \\<and> (\\<exists>l\\<in>pre_tCFG.Paths CFGs (start_points CFGs). \\<exists>i. l i = get_points (fst (snd C)))\"\nproof - assume \"tCFG CFGs instr_edges Seq\" then interpret tCFG .\nshow \"\\<lbrakk>run_prog CFGs C; tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n  \\<exists>t C0 mem0. start_state CFGs t C0 mem0 \\<and> (\\<exists>l\\<in>pre_tCFG.Paths CFGs (start_points CFGs). \\<exists>i. l i = get_points (fst (snd C)))\"\napply (clarsimp simp add: run_prog_def)\napply (cut_tac q=\"get_points (fst (snd C))\" in exists_path, clarsimp)\napply (case_tac C, clarsimp)\napply (drule conc_steps_path, simp+)\napply clarsimp\napply (rule conjI, force)\napply (rule_tac x=\"l' \\<frown> l\" in bexI, simp_all)\napply (rule_tac x=\"length l'\" in exI, simp)\ndone\nqed\n\n(* The step-star relation as inducing a list of intermediate states. *)\nlemma conc_step_star_steps: \"(conc_step CFGs)^** C C' \\<Longrightarrow> \n \\<exists>l. hd (l @ [C']) = C \\<and> (\\<forall>i<length l. conc_step CFGs (l ! i) ((l @ [C']) ! Suc i))\"\napply (induct rule: rtranclp_induct, auto)\napply (rule_tac x=\"[]\" in exI, simp)\napply (rule_tac x=\"l @ [(a,aa, b)]\" in exI, clarsimp)\napply (rule conjI, case_tac l, simp+)\napply clarsimp\napply (case_tac \"i = length l\", clarsimp simp add: nth_append)\napply (erule_tac x=i in allE, auto simp add: nth_append)\ndone\n\nlemma step_star_path: \"\\<lbrakk>hd (l' @ [C']) = C; \\<forall>i<length l'. conc_step CFGs (l' ! i) ((l' @ [C']) ! Suc i);\n l \\<in> pre_tCFG.Paths CFGs (get_points (fst (snd C'))); safe_points CFGs (get_points (fst (snd C))); \n          tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n map (get_points o (\\<lambda> x . fst (snd x))) l' \\<frown> l \\<in> pre_tCFG.Paths CFGs (get_points (fst (snd C)))\"\napply (induct l' arbitrary: C l, auto)\napply (case_tac l', auto)\napply (drule conc_step_increment_path, simp+)\napply (subgoal_tac \"(get_points aa # map (get_points \\<circ> (\\<lambda> x . fst (snd x))) list) \\<frown> l \\<in> pre_tCFG.Paths CFGs (get_points aa)\")\n   apply (erule_tac x=0 in allE,clarsimp)\napply (drule conc_step_increment_path, simp+)\napply (subgoal_tac \"\\<forall>i<Suc (length list). conc_step CFGs (((a, aa, b) # list) ! i) ((list @ [C']) ! i)\")\napply (subgoal_tac \"safe_points CFGs (get_points aa)\")\napply (erule_tac x=0 in allE, clarsimp, rule conc_step_safe, auto)\ndone\n\nlemma run_prog_steps: \"\\<lbrakk>run_prog CFGs C; tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n \\<exists>l t C0 mem0. start_state CFGs t C0 mem0 \\<and> \n (\\<forall>i<length l. conc_step CFGs (l ! i) ((l @ [C]) ! Suc i)) \\<and>\n (\\<exists>l'\\<in>pre_tCFG.Paths CFGs (get_points (fst (snd C))).\n                 map (get_points o (\\<lambda> x . fst (snd x))) l \\<frown> l' \\<in> pre_tCFG.Paths CFGs (start_points CFGs))\"\nproof - assume \"tCFG CFGs instr_edges Seq\" then interpret tCFG .\nshow \"\\<lbrakk>run_prog CFGs C; tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n \\<exists>l t C0 mem0. start_state CFGs t C0 mem0 \\<and> \n (\\<forall>i<length l. conc_step CFGs (l ! i) ((l @ [C]) ! Suc i)) \\<and>\n (\\<exists>l'\\<in>pre_tCFG.Paths CFGs (get_points (fst (snd C))).\n           map (get_points o (\\<lambda> x . fst (snd x))) l \\<frown> l' \\<in> pre_tCFG.Paths CFGs (start_points CFGs))\"\napply (clarsimp simp add: run_prog_def)\napply (drule conc_step_star_steps, clarsimp)\napply (cut_tac q=\"get_points (fst (snd C))\" in exists_path, clarsimp)\napply (frule step_star_path, simp+)\napply (rule conjI, force+)\ndone\nqed\n\nlemma conc_step_star_path2: \"\\<lbrakk>(conc_step CFGs)^** C C'; l \\<in> pre_tCFG.Paths CFGs (get_points (fst (snd C')));\n safe_points CFGs (get_points (fst (snd C))); tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n \\<exists>l'. hd (l' @ [l 0]) = get_points (fst (snd C)) \\<and> l' \\<frown> l \\<in> pre_tCFG.Paths CFGs (get_points (fst (snd C))) \\<and>\n (\\<forall>i<length l'. \\<exists>C''. l' ! i = get_points (fst (snd C'')) \\<and> (conc_step CFGs)^** C C'' \\<and> (conc_step CFGs)^** C'' C')\"\nproof - assume \"tCFG CFGs instr_edges Seq\" then interpret tCFG .\nshow \"\\<lbrakk>(conc_step CFGs)^** C C'; l \\<in> pre_tCFG.Paths CFGs (get_points (fst (snd C')));\n safe_points CFGs (get_points (fst (snd C))); tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n \\<exists>l'. hd (l' @ [l 0]) = get_points (fst (snd C)) \\<and> l' \\<frown> l \\<in> pre_tCFG.Paths CFGs (get_points (fst (snd C))) \\<and>\n (\\<forall>i<length l'. \\<exists>C''. l' ! i = get_points (fst (snd C'')) \\<and> (conc_step CFGs)^** C C'' \\<and> (conc_step CFGs)^** C'' C')\"\napply (induct arbitrary: l rule: rtranclp_induct, auto)\napply (rule_tac x=\"[]\" in exI, simp)\napply (frule conc_step_increment_path, simp+)\napply (case_tac C, rule conc_steps_safe, simp+)\napply (subgoal_tac \"\\<exists>l'. hd (l' @ [get_points aa]) = get_points (fst (snd C)) \\<and> l' \\<frown> [get_points aa] \\<frown> l \\<in> \n pre_tCFG.Paths CFGs (get_points (fst (snd C))) \\<and> (\\<forall>i<length l'. \\<exists>ab ac. l' ! i = get_points ac \\<and> (\\<exists>ba. \n (conc_step CFGs)^** C (ab, ac, ba) \\<and> (conc_step CFGs)^** (ab, ac, ba) (a,aa, b)))\", clarsimp)\napply (rule_tac x=\"l' @ [get_points aa]\" in exI, clarsimp)\napply (rule conjI, case_tac l', simp+)\napply clarsimp\n   apply (case_tac \"i = length l'\", clarsimp)\n  apply (rule_tac x =a in exI)\napply (rule_tac x=aa in exI, simp, rule_tac x=b in exI, simp)\n   apply (erule_tac x=i in allE, clarsimp)\n  apply (rule_tac x = aba in exI)\napply (rule_tac x=aca in exI, simp add: nth_append)\napply (rule_tac x=baa in exI, simp)\n  by blast\nqed\n\nlemma run_prog_path2: \"\\<lbrakk>run_prog CFGs C; tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n  \\<exists>t C0 mem0. start_state CFGs t C0 mem0 \\<and> (\\<exists>l\\<in>pre_tCFG.Paths CFGs (start_points CFGs). \n    \\<exists>i. l i = get_points (fst (snd C)) \\<and> (\\<forall>j<i. \\<exists>C'. run_prog CFGs C' \\<and> l j = get_points (fst (snd C'))))\"\nproof - assume \"tCFG CFGs instr_edges Seq\" then interpret tCFG .\nshow \"\\<lbrakk>run_prog CFGs C; tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n  \\<exists>t C0 mem0. start_state CFGs t C0 mem0 \\<and> (\\<exists>l\\<in>pre_tCFG.Paths CFGs (start_points CFGs). \n    \\<exists>i. l i = get_points (fst (snd C)) \\<and> (\\<forall>j<i. \\<exists>C'. run_prog CFGs C' \\<and> l j = get_points (fst (snd C'))))\"\napply (clarsimp simp add: run_prog_def)\napply (cut_tac q=\"get_points (fst (snd C))\" in exists_path, clarsimp)\napply (drule conc_step_star_path2, simp+)\napply clarsimp\napply (rule conjI, force)\napply (rule_tac x=\"l' \\<frown> l\" in bexI, simp_all)\napply (rule_tac x=\"length l'\" in exI, clarsimp)\nby smt\nqed\n\nlemma run_prog_rpath: \"\\<lbrakk>run_prog CFGs C; tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n  \\<exists>l. l \\<in> pre_tCFG.RPaths CFGs (get_points (fst (snd C)))\"\nproof - assume \"tCFG CFGs instr_edges Seq\" then interpret tCFG .\nshow \"\\<lbrakk>run_prog CFGs C; tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n  \\<exists>l. l \\<in> pre_tCFG.RPaths CFGs (get_points (fst (snd C)))\"\nby (drule run_prog_path, simp, clarsimp, drule_tac i=i in reverse_path, simp, force)\nqed\n\n(* simulation relations and lifting *)\ndefinition \"lift_reach_sim_rel sim_rel CFGs CFGs' tid C C' \\<equiv> \n run_prog CFGs C \\<and> run_prog CFGs' C' \\<and> (case (C, C') of ((t,states, mem), (t',states', mem')) \\<Rightarrow>\n (\\<exists>s s' G G'. states tid = Some s \\<and> states' tid = Some s' \\<and> CFGs tid = Some G \\<and> CFGs' tid = Some G' \\<and>\n sim_rel G G' (t,s, mem) (t',s', mem')) \\<and> (\\<forall>tid'. tid' \\<noteq> tid \\<longrightarrow> states tid' = states' tid'))\"\n\ndefinition \"add_reach CFGs CFGs' tid sim_rel G G' c c' \\<equiv> \\<exists>S S'. S tid = Some (fst (snd c)) \\<and> \n run_prog CFGs (fst c, S, snd (snd c)) \\<and> S' tid = Some (fst (snd c'))\n         \\<and> run_prog CFGs' (fst c', S', snd (snd c')) \\<and> sim_rel G G' c c'\"\n\nlemma add_reach_sim_rel: \"\\<lbrakk>sim_rel G G' c c'; \\<exists>S S'. S tid = Some (fst (snd c)) \\<and> run_prog CFGs (fst c, S, snd (snd c)) \\<and> \n  S' tid = Some (fst (snd c')) \\<and> run_prog CFGs' (fst c',S', snd (snd c'))\\<rbrakk> \\<Longrightarrow>\n add_reach CFGs CFGs' tid sim_rel G G' c c'\"\nby (simp add: add_reach_def)\n\nend\n\nfun acLoc' where\n\"acLoc' (x,y,z) = (case acLoc z of None \\<Rightarrow> 0 | Some v \\<Rightarrow> v)\"\n\nabbreviation \"get_ptrs S \\<equiv> acLoc' ` S\"\nabbreviation \"get_thread a \\<equiv> (\\<lambda> (x,y,z) . x) a\"\n\nlocale sim_base = step_rel\n  where actions =  \"actions :: (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action set\"\n    and locations = \"locations :: loc_type set\"\n    and actionIDs = \"actionIDs :: aid_type set\"\n    and times = \"times :: time_type set\"\n    and threads = \"threads :: 'tid set\"\n    and locks = \"locks :: 'lock set\"\n    and names = \"names :: 'name set\"\n    and callIDs = \"callIDs :: 'callID set\" \n    and free_set = \"free_set:: (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n             \\<Rightarrow> time_type \\<Rightarrow> loc_type set\"\n    and can_read = \"can_read:: (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n                 \\<Rightarrow> 'tid \\<Rightarrow> time_type \\<Rightarrow> loc_type \\<Rightarrow> 'val set\"\n    and update_mem = \"update_mem:: (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\n                       \\<Rightarrow> time_type \\<Rightarrow> ('tid \\<times> aid_type \\<times>\n                             (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) set\n                        \\<Rightarrow> (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option) \\<Rightarrow> bool\"\n    and start_mem = \"start_mem:: (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option)\"\n  and step_rel = \"step_rel::'tid \\<Rightarrow> time_type \\<Rightarrow> ('node, 'edge_type, 'instr) flowgraph \\<Rightarrow> (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option) \\<Rightarrow> 'config \\<Rightarrow> \n   ('tid \\<times> aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) set \\<Rightarrow> 'config \\<Rightarrow> bool\"\n  and start_state = \"start_state ::\n                    ('tid \\<rightharpoonup> ('node, 'edge_type, 'instr) flowgraph)\n                                \\<Rightarrow> time_type \\<Rightarrow> ('tid \\<rightharpoonup> 'config) \\<Rightarrow> (('tid \\<times> time_type \\<times> loc_type)\n            \\<Rightarrow> (aid_type \\<times> (aid_type, 'val, loc_type, 'lock, 'name, 'callID) action) option) \\<Rightarrow> bool\"\n  and get_point = \"get_point::'config \\<Rightarrow> 'node\"\n  and instr_edges = \"instr_edges:: 'instr \\<Rightarrow> ('edge_type \\<Rightarrow> nat) set\"\n  and Seq = \"Seq :: 'edge_type\"\n +tCFG? : tCFG\n   where CFGs=\"CFGs::('tid \\<rightharpoonup> ('node, 'edge_type, 'instr) flowgraph)\"\n   and instr_edges=\"instr_edges::'instr \\<Rightarrow> ('edge_type \\<Rightarrow> nat) set\"\n  and Seq=\"Seq::'edge_type\" + \n  tCFG': tCFG\n   where CFGs=\"CFGs'::('tid \\<rightharpoonup> ('node, 'edge_type, 'instr) flowgraph)\" \n   and instr_edges=\"instr_edges::'instr \\<Rightarrow> ('edge_type \\<Rightarrow> nat) set\"\n  and Seq=\"Seq::'edge_type\" \n  for actions locations actionIDs times threads locks names callIDs \n         free_set can_read update_mem start_mem step_rel start_state get_point instr_edges Seq\n          CFGs CFGs' +\n  assumes step_read_ops: \"\\<lbrakk>step_rel tid t G mem C ops C'; CFGs tid = Some G; \n    \\<forall>l\\<in>get_ptrs ops. can_read mem tid t l = can_read mem' tid t l; free_set mem = free_set mem'\\<rbrakk> \\<Longrightarrow> \n    step_rel tid t G mem' C ops C'\"\n      and ops_thread: \"\\<lbrakk>step_rel tid t G mem state ops state'; CFGs tid = Some G; a \\<in> ops\\<rbrakk>\n                      \\<Longrightarrow> get_thread a = tid\"\n\n\nbegin\n\nthm step_thread\n\nlemma sim_by_reachable_thread_mem_obs [rule_format]: \n\"\\<lbrakk>tCFG_sim (add_reach CFGs' CFGs tid sim_rel G' G) (=) G' G (one_step tid) obs (get_mem o (\\<lambda> x . snd (snd x))); \n CFGs tid = Some G; CFGs' tid = Some G'; \\<forall>tid'. tid' \\<noteq> tid \\<longrightarrow> CFGs tid' = CFGs' tid'; \\<forall>t mem s t' mem' s'. \n sim_rel G' G (t,s, mem) (t',s', mem') \\<longrightarrow> (\\<forall>S. run_prog CFGs' (t,S, mem) \\<longrightarrow> (free_set mem = free_set mem' \\<and> \n (\\<forall>tid' ops s1 s2. run_prog CFGs' (t,S, mem) \\<and> run_prog CFGs (t',S(tid \\<mapsto> s'), mem') \\<and> S tid = Some s \\<and> \n S tid' = Some s1 \\<and> tid' \\<noteq> tid \\<and> tid' \\<in> dom CFGs \\<longrightarrow> (step_rel tid' t' (the (CFGs tid')) mem s1 ops s2  \\<longrightarrow> \n (\\<forall>l\\<in>get_ptrs ops. can_read mem tid' t l = can_read mem' tid' t' l)) \\<and> \n (step_rel tid' t' (the (CFGs tid')) mem' s1 ops s2  \\<longrightarrow> (\\<forall>mem2. update_mem mem t ops mem2 \\<and> tid \\<notin> get_thread ` ops \\<longrightarrow> \n (\\<exists>mem2'. update_mem mem' t' ops mem2' \\<and> (\\<forall>l\\<in>obs. get_mem mem2' l = get_mem mem2 l)\n       \\<and> sim_rel G' G (t,s, mem2) (t',s', mem2')))))))\\<rbrakk> \\<Longrightarrow> \n tCFG_sim (lift_reach_sim_rel sim_rel CFGs' CFGs tid) (=) CFGs' CFGs conc_step obs (get_mem o (\\<lambda> x . snd (snd x)))\"\napply (simp add: tCFG_sim_def, unfold_locales, clarsimp simp add: trsys_of_tCFG_def)\napply (rule conc_step.cases, simp+, clarsimp simp add: lift_reach_sim_rel_def)\napply (rule conjI, clarsimp)\napply (drule_tac sa=\"(t,C, mem)\" and sb=\"(ab,s', ba)\" in simulation.simulation)\n     apply (clarsimp simp add: add_reach_def)\napply (rule_tac x=states in exI, simp, rule_tac x=ac in exI, simp)\napply (clarsimp simp add: trsys_of_tCFG_def)\napply (rule conjI, erule step_single, simp+)\napply (clarsimp simp add: trsys_of_tCFG_def add_reach_def)\n   apply (erule one_step.cases, clarsimp)\n  apply ((rule exI)+, rule context_conjI)\n    apply (rule_tac tid=tid in step_thread)\n    apply (simp add: dom_def, simp+)\n   apply (rule conjI,erule run_prog_step,simp+)\napply (erule run_prog_step, simp+)\napply clarsimp\n  apply (subgoal_tac \"ac = states(tid \\<mapsto> s')\")\n  apply (thin_tac \"\\<forall>tid'. tid' \\<noteq> tid \\<longrightarrow> states tid' = ac tid'\", clarsimp)\n   apply(erule_tac x = tida in allE)\n   apply (erule_tac x = t in allE)\n   apply (erule_tac x = mem in allE)\n  apply (erule_tac x = s in allE)\n   apply (erule_tac x = ab in allE)\n   apply (erule_tac x = ba in allE)\n  apply (erule_tac x = s' in allE)\n   apply (erule impE, simp)\n  apply (erule impE,simp)\napply (erule_tac x=states in allE, clarsimp)\napply (erule_tac x=tida in allE, erule_tac x=ops in allE, erule_tac x=C in allE, simp, erule impE, \n  simp add: dom_def)\napply (erule_tac x=C' in allE, clarsimp)\n   apply (drule_tac mem=mem and mem'=ba in step_read_ops,simp,clarsimp)\n     apply (case_tac \"acLoc b\",clarsimp)\n  sorry\n(*apply (erule_tac x=mem' in allE, clarsimp)\napply (erule impE, clarsimp)\napply (cut_tac t=ta in ops_thread, simp_all, simp+)\napply clarsimp\napply (rule exI, rule_tac x=mem2' in exI, rule context_conjI, rule_tac t=ta in step_thread, \n simp add: dom_def, simp+)\napply (rule conjI, erule run_prog_conc_step, simp+)\napply (rule conjI, erule run_prog_conc_step, simp+)\napply (clarsimp intro!: ext simp add: restrict_map_def)\napply (rule ext, simp)\ndone*)\n\n(* Slightly reorganized other-threads hypothesis. *)\nlemma sim_by_reachable_thread_obs [rule_format]: \n\"\\<lbrakk>tCFG_sim (add_reach CFGs' CFGs t sim_rel G' G) (=) G' G (one_step tid) obs (get_mem o (\\<lambda> x . snd (snd x))); \n CFGs tid = Some G; CFGs' tid = Some G'; \\<forall>tid'. tid' \\<noteq> tid \\<longrightarrow> CFGs tid' = CFGs' tid'; \n \\<forall>t mem s t' mem' s'. sim_rel G' G (t,s, mem) (t',s', mem') \\<longrightarrow> (free_set mem = free_set mem' \\<and> \n (\\<forall>tid' ops s1 s2 S. run_prog CFGs' (t,S, mem) \\<and> run_prog CFGs (t',S(tid \\<mapsto> s'), mem') \\<and> \n S tid = Some s \\<and> S tid' = Some s1 \\<and> tid' \\<noteq> tid \\<and> tid' \\<in> dom CFGs \\<longrightarrow> \n (step_rel tid' t' (the (CFGs tid')) mem s1 ops s2\n    \\<longrightarrow> (\\<forall>l\\<in>get_ptrs ops. can_read mem tid' t l = can_read mem' tid' t' l)) \\<and>\n (step_rel tid' t' (the (CFGs tid')) mem' s1 ops s2\n   \\<longrightarrow> (\\<forall>mem2. update_mem mem t ops mem2 \\<and> tid \\<notin> get_thread ` ops \\<longrightarrow> \n (\\<exists>mem2'. update_mem mem' t ops mem2'\n      \\<and> (\\<forall>l\\<in>obs. get_mem mem2' l = get_mem mem2 l) \\<and> sim_rel G' G (t,s, mem2) (t',s', mem2'))))))\\<rbrakk> \\<Longrightarrow> \n tCFG_sim (lift_reach_sim_rel sim_rel CFGs' CFGs tid) (=) CFGs' CFGs conc_step obs (get_mem o (\\<lambda> x . snd (snd x)))\"\n  apply (rule sim_by_reachable_thread_mem_obs, simp+)\n  sorry\n\n(*\napply clarsimp\napply (erule_tac x=mem in allE, erule_tac x=s in allE, erule_tac x=mem' in allE, \n  erule_tac x=s' in allE, erule impE, assumption, clarsimp)\napply (erule_tac x=t' in allE, erule_tac x=ops in allE, erule_tac x=s1 in allE, erule impE)\napply (rule_tac x=S in exI, force)\napply (erule_tac x=s2 in allE, force)\ndone\n\nlemma sim_by_reachable_thread [rule_format]: \"\\<lbrakk>tCFG_sim (add_reach CFGs' CFGs t sim_rel G' G) (=) \n G' G (one_step t) UNIV (get_mem o snd); CFGs t = Some G; CFGs' t = Some G'; \n \\<forall>t'. t' \\<noteq> t \\<longrightarrow> CFGs t' = CFGs' t'; \\<forall>mem s mem' s'. sim_rel G' G (s, mem) (s', mem') \\<longrightarrow> \n (free_set mem = free_set mem' \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> can_read mem t' = can_read mem' t') \\<and>\n (\\<forall>ops mem2. update_mem mem ops mem2 \\<and> t \\<notin> get_thread ` ops \\<longrightarrow> \n (\\<exists>mem2'. update_mem mem' ops mem2' \\<and> get_mem mem2' = get_mem mem2 \\<and> sim_rel G' G (s, mem2) (s', mem2'))))\\<rbrakk> \\<Longrightarrow> \n tCFG_sim (lift_reach_sim_rel sim_rel CFGs' CFGs t) (=) CFGs' CFGs conc_step UNIV (get_mem o snd)\"\napply (erule sim_by_reachable_thread_obs, auto simp add: fun_upd_def)\nby (smt UNIV_I UNIV_eq_I domD domI)\n\nlemma sim_no_mem [rule_format]: \"\\<lbrakk>tCFG_sim (add_reach CFGs' CFGs t sim_rel G' G) (=) \n G' G (one_step t) UNIV (get_mem o snd); CFGs t = Some G; CFGs' t = Some G'; \n \\<forall>t'. t' \\<noteq> t \\<longrightarrow> CFGs t' = CFGs' t'; \\<forall>mem s mem' s'. sim_rel G' G (s, mem) (s', mem') \\<longrightarrow> mem = mem';\n \\<forall>s s' mem ops mem'. sim_rel G' G (s, mem) (s', mem) \\<and> t \\<notin> get_thread ` ops \\<and> update_mem mem ops mem' \\<longrightarrow>\n sim_rel G' G (s, mem') (s', mem')\\<rbrakk> \\<Longrightarrow> \n tCFG_sim (lift_reach_sim_rel sim_rel CFGs' CFGs t) (=) CFGs' CFGs conc_step UNIV (get_mem o snd)\"\nby (rule sim_by_reachable_thread, simp+, metis)\n\n*)\nend\n\nend\n", "meta": {"author": "liyili2", "repo": "timed-relaxed-memory-model", "sha": "6d85bc75d8b04228b3e581b945e3f672395f0c66", "save_path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model", "path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model/timed-relaxed-memory-model-6d85bc75d8b04228b3e581b945e3f672395f0c66/step_rel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7217432062975979, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.3495980350927714}}
{"text": "chapter \\<open>IMP with Arrays\\<close>\ntheory IMPArrayHoare\nimports \n  Main \n  \"~~/src/HOL/Library/Monad_Syntax\" \n  \"~~/src/HOL/Eisbach/Eisbach\"\n  \"~~/src/HOL/Library/Rewrite\"\nbegin\n\nML_val \\<open>\n  open Splitter\n\\<close>\n\nML \\<open>\n  local\n    val ctxt = @{context} |> Splitter.del_split @{thm if_split}\n    val ctxt = ctxt \n      delsimps @{thms fun_upd_apply}\n      addsimps @{thms fun_upd_same fun_upd_other}\n  in  \n    val IMP_basic_ss = Simplifier.simpset_of ctxt\n  end\n\\<close>\n\nsetup \\<open>\n  let\n    open Simplifier\n  \n    (* FIXME: Copied from Simplifier, as these things are not exposed to the user *)\n    \n    val simpN = \"simp\";\n    val congN = \"cong\";\n    val onlyN = \"only\";\n    val no_asmN = \"no_asm\";\n    val no_asm_useN = \"no_asm_use\";\n    val no_asm_simpN = \"no_asm_simp\";\n    val asm_lrN = \"asm_lr\";\n    \n    \n    val simp_options =\n     (Args.parens (Args.$$$ no_asmN) >> K simp_tac ||\n      Args.parens (Args.$$$ no_asm_simpN) >> K asm_simp_tac ||\n      Args.parens (Args.$$$ no_asm_useN) >> K full_simp_tac ||\n      Args.parens (Args.$$$ asm_lrN) >> K asm_lr_simp_tac ||\n      Scan.succeed asm_full_simp_tac);\n  \n    fun transform_context f (ctxt,ts) = ((),(Context.map_proof f ctxt,ts))  \n      \n    fun simp_method more_mods meth =\n      Scan.lift simp_options --| transform_context (put_simpset IMP_basic_ss) --|\n        Method.sections (more_mods @ simp_modifiers') >>\n        (fn tac => fn ctxt => METHOD (fn facts => meth ctxt tac facts));\n    \n    (** setup **)\n    \n    fun method_setup more_mods =\n      Method.setup @{binding imp_basic_simp}\n        (simp_method more_mods (fn ctxt => fn tac => fn facts =>\n          HEADGOAL (Method.insert_tac ctxt facts THEN'\n            (CHANGED_PROP oo tac) ctxt)))\n        \"simplification with basic simpset for IMP\"  \n  in\n    method_setup []\n  end\n\\<close>\n\n\n\n\n\ntext \\<open>\n  Extension of IMP by generalized arrays and the common arithmetic and Boolean operations. \n  \n  In this language, each variable stores a map from integers to integers.\n  \n  Initially, all integers are mapped to zero.\n  \n  In an expression, and on the LHS of an assignment, only indexed variables are allowed.\n  That is, all expressions compute with single integers. \n  \\<open> x[3] ::= y[0] + 5 \\<close>\n  \n  The Clear operation resets the mapping of a variable to all zeroes.\n  \\<open>CLR x\\<close>\n  \n  If the index is omitted, variables are indexed at zero. \n  This allows to use the variables as if they held single values.\n  \\<open>x ::= y + 5\\<close> is the same as \\<open>x[0] ::= y[0] + 5\\<close>\n  \n  Summarized: \n    \\<^item> Every variable is an array, but, by default, we only use index zero.\n    \\<^item> Arrays can be indexed by arbitrary integers (including negative ones), \n      and dynamically grow as needed.\n\\<close>\n\n\nsection \\<open>Miscellaneous\\<close>\n(* Required to \"instantiate\" existential without introducing new variable, \n  which would not unify with already introduced schematic *)  \nlemma ex_eq_some: \"(\\<exists>x. P x) \\<longleftrightarrow> P (SOME x. P x)\"\n  by (meson someI)\n  \nsection \\<open>Syntax\\<close>  \n\nsubsection \\<open>Variables and Constants\\<close>\ntype_synonym vname = string\n\ntype_synonym val = int\n\nsubsection \\<open>Arithmetic Expressions\\<close>\ndatatype aexp = \n    N int            -- \\<open>Constant\\<close>\n  | V vname aexp     -- \\<open>Array at index \\<open>x[i]\\<close>\\<close> \n  | Binop \"int \\<Rightarrow> int \\<Rightarrow> int\" aexp aexp -- \\<open>Binary operation\\<close>\n\nabbreviation \"V0 x \\<equiv> V (x) (N 0)\" -- \\<open>Abbreviation for \\<open>x[0]\\<close>\\<close>\n\n\nabbreviation \"Plus \\<equiv> Binop (op+)\"\nabbreviation \"Minus \\<equiv> Binop (op-)\"\nabbreviation \"Times \\<equiv> Binop (op*)\"\n\ntext \\<open>Warning, the following two also give defined results on division by zero!\\<close>\nvalue \"a div (0::int)\" value \"a mod (0::int)\"\nabbreviation \"Div \\<equiv> Binop (op div)\"\nabbreviation \"Mod \\<equiv> Binop (op mod)\"\n\nsubsection \\<open>Boolean Expressions\\<close>\ndatatype bexp = \n    Bc bool    -- \\<open>True or False\\<close>\n  | Not bexp   -- \\<open>Negation\\<close>\n  | BBop \"bool\\<Rightarrow>bool\\<Rightarrow>bool\" bexp bexp   -- \\<open>Binary boolean operation\\<close>\n  | Cmpop \"int \\<Rightarrow> int \\<Rightarrow> bool\" aexp aexp -- \\<open>Comparison operation\\<close>\n\nabbreviation \"And \\<equiv> BBop op \\<and>\"\nabbreviation \"Or \\<equiv> BBop op \\<or>\"\nabbreviation \"BNEq \\<equiv> BBop op \\<noteq>\"\nabbreviation \"BEq \\<equiv> BBop op \\<longleftrightarrow>\"\n\nabbreviation \"Less \\<equiv> Cmpop op <\"\nabbreviation \"Leq \\<equiv> Cmpop op \\<le>\"\nabbreviation \"Greater \\<equiv> Cmpop op >\"\nabbreviation \"Geq \\<equiv> Cmpop op \\<ge>\"\nabbreviation \"Equal \\<equiv> Cmpop op =\"\nabbreviation \"NEqual \\<equiv> Cmpop op \\<noteq>\"\n\nsubsection \\<open>Commands\\<close>\n\ndatatype\n  com = SKIP \n      | Assign vname aexp aexp  -- \\<open> Assignment to index of array. \\<open>x[i] = a\\<close>\\<close>\n      | Clear  vname            -- \\<open> Set all indices of array to 0\\<close>\n      | Seq    com  com         -- \\<open> Sequential composition \\<open>c\\<^sub>1; c\\<^sub>2\\<close>\\<close>\n      | If     bexp com com     -- \\<open> Conditional. \\<open>if (b) c\\<^sub>1 else c\\<^sub>2\\<close>\\<close>\n      | While  bexp com         -- \\<open> While loop. \\<open>while (b) c\\<close>\\<close>\n\nsubsection \\<open>Concrete Syntax\\<close>\n\ntext \\<open>Like the original IMP, we only expose a minimal syntax for commands by default\\<close>\n\nnotation \n  Assign  (\"(_[_] ::= _)\" [1000,900, 41] 41) and\n  Clear   (\"(CLR _)\" [41] 41) and\n  Seq     (\"(_;;/ _)\"  [40, 41] 40) and\n  If      (\"(IF (\\<open>unbreakable\\<close>_) THEN(2/ _/ )ELSE(2/ _))\"  [0, 0, 41] 41) and\n  While   (\"(WHILE (\\<open>unbreakable\\<close>_) DO(2/ _))\"  [0, 41] 41)\n      \ntext \\<open>Shortcut notation for assigning to index 0. \\<close>\nabbreviation Assign0 (\"(_ ::= _)\" [1000, 41] 41)\n  where \"x ::= v \\<equiv> (x[N 0] ::= v)\"\n\nabbreviation true where \"true \\<equiv> Bc True\"\nabbreviation false where \"false \\<equiv> Bc False\"\n  \n\n  \ntext \\<open>\n  However, we provide a bundle with somewhat more fancy syntax.\n\\<close>\n\nabbreviation (input) \"IMP_Variable \\<equiv> V0\"\nsyntax \"_IMPVariable\" :: \"id \\<Rightarrow> aexp\"\ntranslations \"CONST IMP_Variable\" \\<rightharpoonup> \"_IMPVariable\"\n\nabbreviation (input) \"IMP_VariableI \\<equiv> V\"\nsyntax \"_IMPVariableI\" :: \"id \\<Rightarrow> aexp \\<Rightarrow> aexp\"\ntranslations \"CONST IMP_VariableI\" \\<rightharpoonup> \"_IMPVariableI\"\n\nabbreviation (input) \"IMP_Assign x v \\<equiv> Assign x (N 0) v\"\nsyntax \"_IMPAssign\" :: \"id \\<Rightarrow> aexp \\<Rightarrow> com\"\ntranslations \"CONST IMP_Assign\" \\<rightharpoonup> \"_IMPAssign\"\n\nabbreviation (input) \"IMP_AssignI x i v \\<equiv> Assign x i v\"\nsyntax \"_IMPAssignI\" :: \"id \\<Rightarrow> aexp \\<Rightarrow> aexp \\<Rightarrow> com\"\ntranslations \"CONST IMP_AssignI\" \\<rightharpoonup> \"_IMPAssignI\"\n\nabbreviation (input) \"IMP_Clear x \\<equiv> Clear x\"\nsyntax \"_IMPClear\" :: \"id \\<Rightarrow> com\"\ntranslations \"CONST IMP_Clear\" \\<rightharpoonup> \"_IMPClear\"\n\n\nML \\<open>\n  structure IMP_Translation = struct\n  \n    val cfg_var_syntax = Attrib.setup_config_bool @{binding IMP_var_syntax} (K false)\n  \n    fun \n      var_tr ctxt [(c as Const (@{syntax_const \"_constrain\"}, _)) $ t $ u] =\n        c $ var_tr ctxt [t] $ u\n    | var_tr _ [Free (str,_)] = Syntax.const (@{const_syntax V0}) $ HOLogic.mk_string str\n    | var_tr _ ts = raise (TERM (\"IMP_Variable\",ts))\n\n    fun \n      vari_tr ctxt [(c as Const (@{syntax_const \"_constrain\"}, _)) $ t $ u, it] =\n        c $ vari_tr ctxt [t,it] $ u\n    | vari_tr _ [Free (str,_),it] = Syntax.const (@{const_syntax V}) $ HOLogic.mk_string str $ it\n    | vari_tr _ ts = raise (TERM (\"IMP_VariableI\",ts))\n\n    fun \n      ass_tr ctxt [(c as Const (@{syntax_const \"_constrain\"}, _)) $ t $ u, rhst] =\n        c $ ass_tr ctxt [t,rhst] $ u\n    | ass_tr _ [Free (str,_),rhst] = Syntax.const (@{const_syntax Assign0}) $ HOLogic.mk_string str $ rhst\n    | ass_tr _ ts = raise (TERM (\"IMP_AssignI\",ts))\n    \n    fun \n      assi_tr ctxt [(c as Const (@{syntax_const \"_constrain\"}, _)) $ t $ u, it, rhst] =\n        c $ assi_tr ctxt [t,it,rhst] $ u\n    | assi_tr _ [Free (str,_),it,rhst] = Syntax.const (@{const_syntax Assign}) $ HOLogic.mk_string str $ it $ rhst\n    | assi_tr _ ts = raise (TERM (\"IMP_Assign\",ts))\n    \n    fun \n      clr_tr ctxt [(c as Const (@{syntax_const \"_constrain\"}, _)) $ t $ u] =\n        c $ clr_tr ctxt [t] $ u\n    | clr_tr _ [Free (str,_)] = Syntax.const (@{const_syntax Clear}) $ HOLogic.mk_string str\n    | clr_tr _ ts = raise (TERM (\"IMP_Clear\",ts))\n    \n    \n    \n    \n    fun \n      dest_list_syntax (Const (@{const_syntax List.Cons},_)$x$xs) \n        = x::dest_list_syntax xs\n    | dest_list_syntax (Const (@{const_syntax List.Nil},_)) = []\n    | dest_list_syntax _ = raise Match\n    \n    fun \n      dest_char_syntax (Const (@{const_syntax String.Char}, _) $ c) = \n        let\n          val n = Numeral.dest_num_syntax c\n          val s = chr n\n        in\n          s\n        end\n    | dest_char_syntax _ = raise Match    \n    \n    fun dest_var_syntax t = let\n      val s =\n          dest_list_syntax t \n        |> map dest_char_syntax \n        |> implode\n      val _ = Symbol.is_ascii_identifier s orelse raise Match  \n    in\n      s\n    end\n    \n    fun \n      var_tr' _ [t:term] = \n        Syntax.const @{const_syntax \"IMP_Variable\"} $ Syntax.const (dest_var_syntax t)\n    | var_tr' _ [t:term,it] =\n        Syntax.const @{const_syntax \"IMP_VariableI\"} $ Syntax.const (dest_var_syntax t) $ it\n    | var_tr' _ _ = raise Match\n\n    fun \n      ass_tr' _ [t:term,vt] = \n        Syntax.const @{const_syntax \"IMP_Assign\"} $ Syntax.const (dest_var_syntax t) $ vt\n    | ass_tr' _ [t:term,it,vt] =\n        Syntax.const @{const_syntax \"IMP_AssignI\"} $ Syntax.const (dest_var_syntax t) $ it $ vt\n    | ass_tr' _ _ = raise Match\n\n    fun \n      clr_tr' _ [t:term] = \n        Syntax.const @{const_syntax \"IMP_Clear\"} $ Syntax.const (dest_var_syntax t)\n    | clr_tr' _ _ = raise Match\n    \n    \n    fun if_var_syntax f ctxt = \n      if Config.get ctxt cfg_var_syntax then\n        f ctxt\n      else\n        raise Match\n    \n    \n    val _ = Theory.setup (\n      Sign.print_translation [\n        (@{const_syntax \"V0\"}, if_var_syntax var_tr'),\n        (@{const_syntax \"V\"}, if_var_syntax var_tr'),\n        (@{const_syntax \"Assign0\"}, if_var_syntax ass_tr'),\n        (@{const_syntax \"Assign\"}, if_var_syntax ass_tr'),\n        (@{const_syntax \"Clear\"}, if_var_syntax clr_tr')\n      ]\n    )\n    val _ = Theory.setup (\n      Sign.parse_translation [\n        (@{syntax_const \"_IMPVariable\"}, if_var_syntax var_tr),\n        (@{syntax_const \"_IMPVariableI\"}, if_var_syntax vari_tr),\n        (@{syntax_const \"_IMPAssign\"}, if_var_syntax ass_tr),\n        (@{syntax_const \"_IMPAssignI\"}, if_var_syntax assi_tr),\n        (@{syntax_const \"_IMPClear\"}, if_var_syntax clr_tr)\n      ]\n    )\n\n    \n  end\n\\<close>\n\n\nconsts \n  eplus :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\" \n  eminus :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"   \n  etimes :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"   \n  edivide :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\" \n  emodulo :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\" \n  eequal :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'b\"\n  neequal :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'b\"\n  eless :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'b\" \n  egreater :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'b\" \n\nbundle IMP_Syntax begin\n\nnotation IMP_Variable (\"$_\" [100] 100)\nnotation IMP_VariableI (\"_\\<^bold>[_\\<^bold>]\" [100,100] 100)\n\nno_notation \n  Assign0 (\"(_ ::= _)\" [1000, 41] 41) and\n  Assign  (\"(_[_] ::= _)\" [1000,900, 41] 41) and\n  Clear   (\"(CLR _)\" [41] 41)\n\nnotation \n  IMP_Assign (\"(_ ::= _)\" [1000, 41] 41) and\n  IMP_AssignI  (\"(_\\<^bold>[_\\<^bold>] ::= _)\" [1000,0, 41] 41) and\n  IMP_Clear   (\"(CLR _)\" [41] 41)\n\ndeclare [[IMP_var_syntax]]\n\nnotation N (\"\\<acute>_\" [105] 105)\n\n\nno_notation\n  plus  (infixl \"+\" 65) and\n  minus (infixl \"-\" 65) and\n  times (infixl \"*\" 70) and\n  divide (infixl \"div\" 70) and\n  modulo (infixl \"mod\" 70)\n  \nnotation \n  eplus   (infixl \"+\" 65)   and\n  eminus  (infixl \"-\" 65)   and\n  etimes  (infixl \"*\" 70)   and\n  edivide (infixl \"div\" 70) and\n  emodulo (infixl \"mod\" 70)\n  \nadhoc_overloading eplus plus Plus  \nadhoc_overloading eminus minus Minus  \nadhoc_overloading etimes times Times  \nadhoc_overloading edivide divide Div  \nadhoc_overloading emodulo modulo Mod  \n\nnotation Or (infixr \"||\" 30)\nnotation And (infixr \"&&\" 35)\nnotation Not (\"!_\" [90] 90)\n\nno_notation \"Pure.eq\" (infix \"==\" 2)\n\nnotation \n  eequal  (infix \"==\" 50) and\n  neequal (infix \"!=\" 50)\n\nadhoc_overloading eequal BEq Equal  \nadhoc_overloading neequal BNEq NEqual  \n\n\nno_notation \n  less (\"(_/ < _)\"  [51, 51] 50) and\n  greater  (infix \">\" 50) and\n  less_eq  (\"(_/ <= _)\" [51, 51] 50) and\n  greater_eq  (infix \">=\" 50)\n\nnotation \n  eless (infix \"<\"  50) and\n  egreater (infix \">\" 50)\n  \nadhoc_overloading eless less Less  \nadhoc_overloading egreater greater Greater  \n  \nnotation\n  Leq  (\"(_/ <= _)\" [51, 51] 50) and\n  Geq  (infix \">=\" 50)\n  \nend\n  \n  \nsubsection \\<open>Syntax Overview\\<close>\n\ntext \\<open>Activate the Syntax locally in a context\\<close>\ncontext \n  includes IMP_Syntax \nbegin\n\n  subsubsection \\<open>Arithmetic expressions\\<close>\n  \n  text \\<open>Idiosyncrasies: \n    \\<^item> For array indexing, we use bold brackets \\<open>\\<^bold>[ \\<^bold>]\\<close>. Type \\<open>\\ bold [\\<close> and \\<open>\\ bold ]\\<close>\n    \\<^item> Prefixing a variable with \\<open>$\\<close> refers to index 0 of this variable. \n      This way, variables, which hold maps, can conveniently be used as single values.\n  \\<close>\n  \n  term \"$foo\"       term \"V0 ''foo''\"\n  term \"bar\\<^bold>[\\<acute>3\\<^bold>]\"   term \"V ''bar'' (N 3)\" -- \\<open>Type \"\\ bold [\" and \"\\ bold ]\" \\<close>\n\n  term \"$a + $b\"        term \"Plus (V0 ''a'') (V0 ''b'')\"\n  term \"$a + $b * $c\"   term \"Plus (V0 ''a'') (Times (V0 ''b'') (V0 ''c''))\"\n  term \"($a + $b) * $c\" term \"Times (Plus (V0 ''a'') (V0 ''b'')) (V0 ''c'')\"\n  \n  term \"a\\<^bold>[$i\\<^bold>] + $b - $c*$d div $e mod $f\"\n  \n  text \\<open>Boolean Expressions\\<close>\n  text \\<open>Idiosyncrasies: \n    \\<^item> Not \\<open>!\\<close> binds with high priority, higher than any other operator\n  \\<close>\n  \n  term \"$a < $b\"\n  term \"$a > $b\"\n  term \"$a <= $b\"\n  term \"$a >= $b\"\n  term \"$x == $y\"\n  term \"$x != $y\"\n  \n  term \"true && false\"\n  term \"true || false\"\n  term \"true != false\"\n  term \"true == true\"\n  \n  term \"(!true == false)  = ( (!true) == false )\"\n  term \"!(true == false)\"\n\n  text \\<open>Commands\\<close>\n  text \\<open>Idiosyncrasies: \n    \\<^item> Using \\<open>::=\\<close> for assignment, and, again, bold brackets for array indexing\n  \\<close>\n  \n  term \"CLR x\"                term \"Clear ''x''\"\n  term \"x ::= $a + \\<acute>1\"       term \"Assign0 ''x'' (Plus (V0 ''a'') (N 1))\"\n  term \"x\\<^bold>[$i\\<^bold>] ::= $a + \\<acute>1\"   term \"Assign ''x'' (V0 ''i'') (Plus (V0 ''a'') (N 1))\"\n\n\n  term \"x ::= $a;; y ::= $b\"\n  term \"IF $x<\\<acute>5 THEN SKIP ELSE x::=$x - \\<acute>1\"\n  term \"WHILE $x<\\<acute>5 DO x::=$x + \\<acute>1\"\n  \n  \nend\n\n\nsubsection \\<open>Example Program\\<close>\nlocale Imp_Array_Examples begin\nunbundle IMP_Syntax\nabbreviation \"array_sum \\<equiv> \n  CLR r;;             (* It's good practice to clear auxiliary variables before use *)\n  r ::= N 0;;         (* Not strictly necessary, but documents that r is used as plain variable  *)\n  WHILE $l < $h DO (\n    r ::= $r + a\\<^bold>[$l\\<^bold>];;\n    l ::= $l + (\\<acute>1)\n  )\"\n\nterm array_sum\n  \nend\n\n\nsection \\<open>Semantics\\<close>\n\nsubsection \\<open>States and Configuration\\<close>\ntext \\<open>\n  Each variable holds an unlimited amount of values, indexed by integers\n\\<close>\ntype_synonym state = \"vname \\<Rightarrow> (int \\<Rightarrow> val)\"\ntype_synonym config = \"com \\<times> state\"\n\ntext {* A little syntax magic to write larger states compactly: *}\n\n(* All variables hold zeroes initially.\n*)\ndefinition null_state (\"<>\") where\n  \"null_state \\<equiv> \\<lambda>_ _. 0\"\nsyntax \n  \"_State\" :: \"updbinds => 'a\" (\"<_>\")\ntranslations\n  \"_State ms\" == \"_Update <> ms\"\n  \"_State (_updbinds b bs)\" <= \"_Update (_State b) bs\"\n\nlemma null_state_app[simp]: \"<> x = (\\<lambda>_. 0)\" by (auto simp: null_state_def)\n\ntext \\<open>Constructing a generalized array from a list\\<close>\ndefinition vlist :: \"int list \\<Rightarrow> int \\<Rightarrow> int\" where\n  \"vlist l i \\<equiv> if 0\\<le>i \\<and> nat i<length l then l!nat i else 0\"\n\ntext \\<open>Plain variable: Value at index 0 only\\<close>\nabbreviation \"var x \\<equiv> vlist [x]\"\n\nlemma list_nth[simp]: \"\\<lbrakk>0\\<le>i; nat i<length l\\<rbrakk> \\<Longrightarrow> vlist l i = l!nat i\"\n  by (auto simp: vlist_def)\n  \nlemma list_subst[simp]: \"\\<lbrakk> 0\\<le>i; nat i<length l \\<rbrakk> \\<Longrightarrow> (vlist l)(i:=x) = vlist (l[nat i:=x])\"  \n  by (auto simp: vlist_def intro!: ext)\n\nlemma list_fold[simp]: \"(\\<lambda>_. 0)(0:=x) = var x\"\n  by (auto simp: vlist_def intro!: ext)\n\nlemma list_inj[simp]: \"length l = length l' \\<Longrightarrow> vlist l = vlist l' \\<longleftrightarrow> l=l'\"\n  apply (auto simp: vlist_def[abs_def] split: if_splits)\n  by (metis (mono_tags, hide_lams) nat_int nth_equalityI of_nat_0_le_iff)\n  \ndefinition \"imap \\<equiv> id\"  \nlemma imap_app[simp]: \"imap a = a\" by (auto simp: imap_def)\n  \n  \nsubsection \\<open>Arithmetic Expressions\\<close>\n\nfun aval :: \"aexp \\<Rightarrow> state \\<Rightarrow> val\" where\n\"aval (N n) s = n\" |\n\"aval (V x i) s = (s x) (aval i s)\" |\n\"aval (Binop f a1 a2) s = f (aval a1 s) (aval a2 s)\"\n\nsubsection \\<open>Boolean Expressions\\<close>\n\nfun bval :: \"bexp \\<Rightarrow> state \\<Rightarrow> bool\" where\n\"bval (Bc v) s \\<longleftrightarrow> v\" |\n\"bval (Not b) s \\<longleftrightarrow> \\<not>(bval b s)\" |\n\"bval (BBop f b1 b2) s \\<longleftrightarrow> f (bval b1 s) (bval b2 s)\" |\n\"bval (Cmpop f a1 a2) s \\<longleftrightarrow> f (aval a1 s) (aval a2 s)\"\n\nsubsection \\<open>Big-Step\\<close>\n  \ninductive\n  big_step :: \"com \\<times> state \\<Rightarrow> state \\<Rightarrow> bool\" (infix \"\\<Rightarrow>\" 55)\nwhere\nSkip: \"(SKIP,s) \\<Rightarrow> s\" |\nAssign: \"(x[i] ::= a,s) \\<Rightarrow> s(x := ((s x)(aval i s := aval a s)))\" |\nClear: \"(CLR x, s) \\<Rightarrow> s(x:=(\\<lambda>_. 0))\" |\nSeq: \"\\<lbrakk> (c\\<^sub>1,s\\<^sub>1) \\<Rightarrow> s\\<^sub>2;  (c\\<^sub>2,s\\<^sub>2) \\<Rightarrow> s\\<^sub>3 \\<rbrakk> \\<Longrightarrow> (c\\<^sub>1;;c\\<^sub>2, s\\<^sub>1) \\<Rightarrow> s\\<^sub>3\" |\nIfTrue: \"\\<lbrakk> bval b s; (c\\<^sub>1,s) \\<Rightarrow> t \\<rbrakk> \\<Longrightarrow> (IF b THEN c\\<^sub>1 ELSE c\\<^sub>2, s) \\<Rightarrow> t\" |\nIfFalse: \"\\<lbrakk> \\<not>bval b s;  (c\\<^sub>2,s) \\<Rightarrow> t \\<rbrakk> \\<Longrightarrow> (IF b THEN c\\<^sub>1 ELSE c\\<^sub>2, s) \\<Rightarrow> t\" |\nWhileFalse: \"\\<not>bval b s \\<Longrightarrow> (WHILE b DO c,s) \\<Rightarrow> s\" |\nWhileTrue:\n\"\\<lbrakk> bval b s\\<^sub>1;  (c,s\\<^sub>1) \\<Rightarrow> s\\<^sub>2;  (WHILE b DO c, s\\<^sub>2) \\<Rightarrow> s\\<^sub>3 \\<rbrakk> \n\\<Longrightarrow> (WHILE b DO c, s\\<^sub>1) \\<Rightarrow> s\\<^sub>3\"\n\n\nsubsubsection \\<open>Automatic Derivation\\<close>\ntext \\<open>The following is a method to execute a configuration by deriving it's big-step semantics\\<close>\nmethod Bs_simp = simp add: vlist_def\nmethod If = (rule IfTrue, (Bs_simp;fail)) | (rule IfFalse, (Bs_simp;fail))\nmethod While = (rule WhileTrue, (Bs_simp;fail)) | (rule WhileFalse, (Bs_simp;fail))\nmethod BigStep = simp?; ((rule Skip Assign Seq Clear) | If | While)\nmethod BigSteps = BigStep+\n\ncontext Imp_Array_Examples begin\n  schematic_goal \"(array_sum,<''l'':=vlist [1], ''h'':=vlist [5], ''a'':=vlist [100,1,2,3,4,200,300]>) \\<Rightarrow> ?s\"\n    by BigSteps\n\nend\n\nsubsubsection \\<open>Proof Automation Setup\\<close>\ndeclare big_step.intros [intro]\n\nlemmas big_step_induct = big_step.induct[split_format(complete)]\n\ninductive_cases SkipE[elim!]: \"(SKIP,s) \\<Rightarrow> t\"\n\ninductive_cases AssignE[elim!]: \"(x[i] ::= a,s) \\<Rightarrow> t\"\nthm AssignE\ninductive_cases ClearE[elim!]: \"(CLR x,s) \\<Rightarrow> t\"\nthm ClearE\ninductive_cases SeqE[elim!]: \"(c1;;c2,s1) \\<Rightarrow> s3\"\nthm SeqE\ninductive_cases IfE[elim!]: \"(IF b THEN c1 ELSE c2,s) \\<Rightarrow> t\"\nthm IfE\ninductive_cases WhileE[elim]: \"(WHILE b DO c,s) \\<Rightarrow> t\"\nthm WhileE\n\n\nsubsubsection \\<open>Properties\\<close>\n\ntext \\<open>Sequential composition is associative\\<close>\nlemma Seq_assoc:\n  \"(c1;; c2;; c3, s) \\<Rightarrow> s' \\<longleftrightarrow> (c1;; (c2;; c3), s) \\<Rightarrow> s'\"\nproof\n  assume \"(c1;; c2;; c3, s) \\<Rightarrow> s'\"\n  then obtain s1 s2 where\n    c1: \"(c1, s) \\<Rightarrow> s1\" and\n    c2: \"(c2, s1) \\<Rightarrow> s2\" and\n    c3: \"(c3, s2) \\<Rightarrow> s'\" by auto\n  from c2 c3\n  have \"(c2;; c3, s1) \\<Rightarrow> s'\" by (rule Seq)\n  with c1\n  show \"(c1;; (c2;; c3), s) \\<Rightarrow> s'\" by (rule Seq)\nnext\n  -- \"The other direction is analogous\"\n  assume \"(c1;; (c2;; c3), s) \\<Rightarrow> s'\"\n  thus \"(c1;; c2;; c3, s) \\<Rightarrow> s'\" by auto\nqed\n\ntext \\<open>The big-step semantics is deterministic\\<close>\ntheorem big_step_determ: \"\\<lbrakk> (c,s) \\<Rightarrow> t; (c,s) \\<Rightarrow> u \\<rbrakk> \\<Longrightarrow> u = t\"\nproof (induction arbitrary: u rule: big_step.induct)\n  case (Skip s)\n  then show ?case by auto\nnext\n  case (Assign x i a s u)\n  then show ?case by auto\nnext\n  case (Clear x s)\n  then show ?case by auto\nnext\n  case (Seq c\\<^sub>1 s\\<^sub>1 s\\<^sub>2 c\\<^sub>2 s\\<^sub>3)\n  then show ?case by blast\nnext\n  case (IfTrue b s c\\<^sub>1 t c\\<^sub>2)\n  from IfTrue.prems IfTrue.hyps(1) IfTrue.IH\n  show ?case by auto\nnext\n  case (IfFalse b s c\\<^sub>2 t c\\<^sub>1)\n  from IfFalse.prems IfFalse.hyps(1) IfFalse.IH\n  show ?case by auto\nnext\n  case (WhileFalse b s c)\n  then show ?case by auto\nnext\n  case (WhileTrue b s\\<^sub>1 c s\\<^sub>2 s\\<^sub>3) then show ?case by blast\nqed\n\nsubsection \\<open>Small-Step\\<close>\n  \nfun small_step :: \"com * state \\<Rightarrow> com * state\" where\n  \"small_step (SKIP;;c\\<^sub>2,s) = (c\\<^sub>2,s)\"  \n| \"small_step (x[i] ::= a, s) = (SKIP, s(x := ((s x)(aval i s := aval a s))))\"\n| \"small_step (CLR x, s) = (SKIP, s(x:=(\\<lambda>_. 0)))\"\n| \"small_step (c\\<^sub>1;;c\\<^sub>2,s) = (let (c\\<^sub>1',s) = small_step (c\\<^sub>1,s) in (c\\<^sub>1';;c\\<^sub>2,s))\"\n| \"small_step (IF b THEN c1 ELSE c2, s) = (if bval b s then (c1, s) else (c2, s))\"\n| \"small_step (WHILE b DO c,s) = (IF b THEN c;; WHILE b DO c ELSE SKIP,s)\"\n| \"small_step (SKIP,s) = undefined\"\n  \n\nabbreviation is_small_step (infix \"\\<rightarrow>\" 55) \n  where \"is_small_step cs cs' \\<equiv> fst cs \\<noteq> SKIP \\<and> small_step cs = cs'\"\n  \nabbreviation\n  small_steps :: \"com * state \\<Rightarrow> com * state \\<Rightarrow> bool\" (infix \"\\<rightarrow>*\" 55)\n  where \"x \\<rightarrow>* y == (op \\<rightarrow>)\\<^sup>*\\<^sup>* x y\"\n\nsubsubsection{* Proof infrastructure *}\n\ntext{* The default induction rule @{thm[source] small_step.induct} only works\nfor lemmas of the form @{text\"a \\<rightarrow> b \\<Longrightarrow> \\<dots>\"} where @{text a} and @{text b} are\nnot already pairs @{text\"(DUMMY,DUMMY)\"}. We can generate a suitable variant\nof @{thm[source] small_step.induct} for pairs by ``splitting'' the arguments\n@{text\"\\<rightarrow>\"} into pairs: *}\nlemmas small_step_induct = small_step.induct[split_format(complete)]\n\nsubsubsection \"Equivalence with big-step semantics\"\n\nlemma ss_seq2: \"(c,s) \\<rightarrow> (c',s') \\<Longrightarrow> (c;;cx,s) \\<rightarrow> (c';;cx,s')\"\n  by (induction c s arbitrary: c' s' rule: small_step_induct) auto\n\nlemma star_seq2: \"(c1,s) \\<rightarrow>* (c1',s') \\<Longrightarrow> (c1;;c2,s) \\<rightarrow>* (c1';;c2,s')\"\n  apply (induction rule: converse_rtranclp_induct2)\n  apply (auto simp: ss_seq2 converse_rtranclp_into_rtranclp) \n  done\n\nlemma seq_comp:\n  \"\\<lbrakk> (c1,s1) \\<rightarrow>* (SKIP,s2); (c2,s2) \\<rightarrow>* (SKIP,s3) \\<rbrakk>\n   \\<Longrightarrow> (c1;;c2, s1) \\<rightarrow>* (SKIP,s3)\"\nproof -\n  assume a1: \"(c2, s2) \\<rightarrow>* (SKIP, s3)\"\n  assume a2: \"(c1, s1) \\<rightarrow>* (SKIP, s2)\"\n  have \"(SKIP;; c2, s2) \\<rightarrow>* (SKIP, s3)\"\n    using a1 by (simp add: converse_rtranclp_into_rtranclp)\n  then have \"\\<And>p. p \\<rightarrow>* (SKIP, s3) \\<or> \\<not> p \\<rightarrow>* (SKIP;; c2, s2)\"\n    by (metis (lifting) rtranclp.rtrancl_into_rtrancl rtranclp_idemp)\n  then show ?thesis\n    using a2 star_seq2 by blast\nqed  \n  \nlemma big_to_small:\n  \"cs \\<Rightarrow> t \\<Longrightarrow> cs \\<rightarrow>* (SKIP,t)\"\nproof (induction rule: big_step.induct)\n  case Skip show ?case by blast\nnext\n  case Assign then show ?case \n    by (auto intro!: r_into_rtranclp ext)\nnext\n  case Clear then show ?case \n    by (auto intro!: r_into_rtranclp ext)\nnext\n  case Seq thus ?case by (blast intro: seq_comp)\nnext\n  case IfTrue thus ?case \n    by (auto intro: converse_rtranclp_into_rtranclp)\nnext\n  case IfFalse thus ?case \n    by (auto intro: converse_rtranclp_into_rtranclp)\nnext\n  case WhileFalse thus ?case\n    by (fastforce intro: converse_rtranclp_into_rtranclp)\n  \nnext\n  case WhileTrue\n  thus ?case\n    apply (rule_tac converse_rtranclp_into_rtranclp)\n    apply simp\n    apply (rule_tac converse_rtranclp_into_rtranclp)\n    apply simp\n    by (simp add: seq_comp)\n  \nqed\n\nlemma small1_big_continue:\n  \"cs \\<rightarrow> cs' \\<Longrightarrow> cs' \\<Rightarrow> t \\<Longrightarrow> cs \\<Rightarrow> t\"\napply (induction arbitrary: cs' t rule: small_step.induct)\napply (auto split: prod.splits if_splits)\ndone\n\nlemma small_to_big:\n  \"cs \\<rightarrow>* (SKIP,t) \\<Longrightarrow> cs \\<Rightarrow> t\"\napply (induction rule: converse_rtranclp_induct)\napply (auto intro: small1_big_continue)\ndone\n\ntext {*\n  Finally, the equivalence theorem:\n*}\ntheorem big_iff_small:\n  \"cs \\<Rightarrow> t \\<longleftrightarrow> cs \\<rightarrow>* (SKIP,t)\"\n  using small_to_big big_to_small by blast\n\n\nsubsection \\<open>Termination\\<close>\ndefinition \"final cs \\<equiv> \\<nexists>cs'. cs\\<rightarrow>cs'\"\n\nlemma SKIP_final[simp]: \"final (c,s) \\<longleftrightarrow> c=SKIP\"\n  by (auto simp: final_def)\n\n\nsection \\<open>Hoare-Logic for Partial Correctness\\<close>\n\ntype_synonym assn = \"state \\<Rightarrow> bool\"\n\ndefinition\nhoare_valid :: \"('a \\<Rightarrow> assn) \\<Rightarrow> com \\<Rightarrow> ('a \\<Rightarrow> assn) \\<Rightarrow> bool\" (\"\\<Turnstile> {(1_)}/ (_)/ {(1_)}\" 50) where\n\"\\<Turnstile> {P}c{Q} = (\\<forall>s t z. P z s \\<and> (c,s) \\<Rightarrow> t \\<longrightarrow> Q z t)\"\n\ncontext\n  notes [simp] = hoare_valid_def\nbegin\n  lemma hoare_validI: \n    assumes \"\\<And>s t z. \\<lbrakk> P z s; (c,s) \\<Rightarrow> t \\<rbrakk> \\<Longrightarrow> Q z t\"\n    shows \"\\<Turnstile> {P}c{Q}\"\n    using assms by auto\n  \n  lemma conseq_rule: \n    assumes \"\\<And>s z. P z s \\<Longrightarrow> P' z s\"\n    assumes \"\\<Turnstile> {P'} c {Q'}\"\n    assumes \"\\<And>s z. Q' z s \\<Longrightarrow> Q z s\"\n    shows \"\\<Turnstile> {P} c {Q}\"\n    using assms by force\n  \n  (* One-sided versions of the consequence rule *)  \n  lemma conseq_pre_rule: \n    assumes \"\\<Turnstile> {P'} c {Q}\"\n    assumes \"\\<And>z s. P z s \\<Longrightarrow> P' z s\"\n    shows \"\\<Turnstile> {\\<lambda>z. P z} c {\\<lambda>z. Q z}\"\n    using assms using conseq_rule by blast\n  \n  lemma conseq_post_rule: \n    assumes \"\\<And>z s. Q z s \\<Longrightarrow> Q' z s\"\n    assumes \"\\<Turnstile> {P} c {Q}\"\n    shows \"\\<Turnstile> {P} c {Q'}\"\n    using assms using conseq_rule by blast\n  \n  lemma skip_rule: \"\\<Turnstile> {P} SKIP {P}\"\n    by (auto)\n  \n  lemma assign_rule: \"\\<Turnstile> {\\<lambda>z s. P z (s( x := (s x)(aval i s := aval a s) )) } x[i]::=a {P}\"\n    by (auto)\n\n  lemma clear_rule: \"\\<Turnstile> {\\<lambda>z s. P z (s( x := (\\<lambda>_. 0) )) } CLR x {P}\"\n    by (auto)\n    \n  lemma basic_seq_rule:\n    assumes \"\\<Turnstile> {P} c\\<^sub>1 {Q}\" \"\\<Turnstile> {Q} c\\<^sub>2 {R}\"\n    shows \"\\<Turnstile> {P} c\\<^sub>1;;c\\<^sub>2 {R}\"\n    using assms by force\n    \n  definition \"COND b P Q \\<equiv> if b then P else Q\"\n  \n  lemma if_rule:  \n    assumes \"\\<Turnstile> {P1} c\\<^sub>1 {Q}\" \"\\<Turnstile> {P2} c\\<^sub>2 {Q}\"\n    shows \"\\<Turnstile> {\\<lambda>z s. COND (bval b s) (P1 z s) (P2 z s)} IF b THEN c\\<^sub>1 ELSE c\\<^sub>2 {Q}\"\n    using assms unfolding COND_def by auto\n  \n  lemma basic_while_rule:\n    assumes \"\\<Turnstile> {\\<lambda>z s. P z s \\<and> bval b s} c {P}\"\n    shows \"\\<Turnstile> {P} WHILE b DO c {\\<lambda>z s. P z s \\<and> \\<not> bval b s}\"\n  proof (rule hoare_validI)  \n    fix z s t\n    assume \"(WHILE b DO c, s) \\<Rightarrow> t\" \"P z s\" \n    then show \"P z t \\<and> \\<not> bval b t\"\n    proof (induction \"WHILE b DO c\" s t rule: big_step_induct)\n      case (WhileFalse s)\n      then show ?case by simp\n    next\n      case (WhileTrue s\\<^sub>1 s\\<^sub>2 s\\<^sub>3)\n      note IH = \\<open>P z s\\<^sub>2 \\<Longrightarrow> P z s\\<^sub>3 \\<and> \\<not> bval b s\\<^sub>3\\<close>\n      \n      from \\<open>P z s\\<^sub>1\\<close> \\<open>bval b s\\<^sub>1\\<close> \\<open>(c, s\\<^sub>1) \\<Rightarrow> s\\<^sub>2\\<close> \\<open>\\<Turnstile> {\\<lambda>z s. P z s \\<and> bval b s} c {P}\\<close> have \"P z s\\<^sub>2\"\n        unfolding hoare_valid_def by auto\n      with IH show \"P z s\\<^sub>3 \\<and> \\<not> bval b s\\<^sub>3\" .\n    qed\n  qed  \n  \n  \n  text \\<open>We swap the premises of the sequence rule, as our \n    verification condition generator will work on sequences \n    from right to left.\\<close>\n  lemma seq_rule:\n    assumes \"\\<Turnstile> {Q} c\\<^sub>2 {R}\" \"\\<Turnstile> {P} c\\<^sub>1 {Q}\"\n    shows \"\\<Turnstile> {P} c\\<^sub>1;;c\\<^sub>2 {R}\"\n    using basic_seq_rule assms by blast\n  \n  \n  text \\<open>We combine the while-rule with a consequence rule, to\n    make it more usable in verification condition generation\\<close>\n  \n  (* Explicit backwards derivation *)\n  lemma while_rule:\n    assumes \"\\<Turnstile> {R} c {P}\"\n    assumes \"\\<And>z s. \\<lbrakk>P z s; bval b s\\<rbrakk> \\<Longrightarrow> R z s\"\n    assumes \"\\<And>z s. \\<lbrakk>P z s; \\<not>bval b s\\<rbrakk> \\<Longrightarrow> Q z s\"\n    shows \"\\<Turnstile> {P} WHILE b DO c {Q}\"\n    apply (rule conseq_post_rule[where Q=\"\\<lambda>z s. P z s \\<and> \\<not>bval b s\"])\n    apply (rule assms(3); simp)\n    apply (rule basic_while_rule)\n    apply (rule conseq_pre_rule)\n    apply (rule assms(1))\n    apply (rule assms(2); auto)\n    done\n    \n\nend\n\n\nsection \\<open>Hoare-Logic for Total Correctness\\<close>\n\ndefinition\nhoaret_valid :: \"('a \\<Rightarrow> assn) \\<Rightarrow> com \\<Rightarrow> ('a \\<Rightarrow> assn) \\<Rightarrow> bool\" (\"\\<Turnstile>\\<^sub>t {(1_)}/ (_)/ {(1_)}\" 50) where\n\"\\<Turnstile>\\<^sub>t {P}c{Q} = (\\<forall>z s. P z s \\<longrightarrow> (\\<exists>t. (c,s) \\<Rightarrow> t \\<and> Q z t))\"\n\ncontext\n  notes [simp] = hoaret_valid_def\nbegin\n  lemma hoaret_validI: \n    assumes \"\\<And>z s. P z s \\<Longrightarrow> \\<exists>t. (c,s) \\<Rightarrow> t \\<and> Q z t\"\n    shows \"\\<Turnstile>\\<^sub>t {P}c{Q}\"\n    using assms by auto\n  \n  lemma conseq_trule: \n    assumes \"\\<And>z s. P z s \\<Longrightarrow> P' z s\"\n    assumes \"\\<Turnstile>\\<^sub>t {P'} c {Q'}\"\n    assumes \"\\<And>z s. Q' z s \\<Longrightarrow> Q z s\"\n    shows \"\\<Turnstile>\\<^sub>t {P} c {Q}\"\n    using assms by force\n  \n  (* One-sided versions of the consequence rule *)  \n  lemma conseq_pre_trule: \n    assumes \"\\<Turnstile>\\<^sub>t {P'} c {Q}\"\n    assumes \"\\<And>z s. P z s \\<Longrightarrow> P' z s\"\n    shows \"\\<Turnstile>\\<^sub>t {\\<lambda>z. P z} c {\\<lambda>z. Q z}\"\n    using assms using conseq_trule by blast\n  \n  lemma conseq_post_trule: \n    assumes \"\\<And>z s. Q z s \\<Longrightarrow> Q' z s\"\n    assumes \"\\<Turnstile>\\<^sub>t {P} c {Q}\"\n    shows \"\\<Turnstile>\\<^sub>t {P} c {Q'}\"\n    using assms using conseq_trule by metis\n  \n  lemma skip_trule: \"\\<Turnstile>\\<^sub>t {P} SKIP {P}\"\n    by (auto)\n  \n  lemma assign_trule: \"\\<Turnstile>\\<^sub>t {\\<lambda>z s. P z (s( x := (s x)(aval i s := aval a s) )) } x[i]::=a {P}\"\n    by (auto)\n    \n  lemma assign_trule_workaround: (* Workaround to strange unification problem *)\n    assumes \"\\<And>z s. P z (s( x := (s x)(aval i s := aval a s))) = P' z s\"\n    shows \"\\<Turnstile>\\<^sub>t {P'} Assign x i a {P}\"\n    using assms\n    by (auto)\n    \n\n  lemma clear_trule: \"\\<Turnstile>\\<^sub>t {\\<lambda>z s. P z (s( x := (\\<lambda>_. 0) )) } CLR x {P}\"\n    by (auto)\n    \n  lemma basic_seq_trule:\n    assumes \"\\<Turnstile>\\<^sub>t {P} c\\<^sub>1 {Q}\" \"\\<Turnstile>\\<^sub>t {Q} c\\<^sub>2 {R}\"\n    shows \"\\<Turnstile>\\<^sub>t {P} c\\<^sub>1;;c\\<^sub>2 {R}\"\n    using assms by force\n  \n  lemma if_trule:  \n    assumes \"\\<Turnstile>\\<^sub>t {P1} c\\<^sub>1 {Q}\" \"\\<Turnstile>\\<^sub>t {P2} c\\<^sub>2 {Q}\"\n    shows \"\\<Turnstile>\\<^sub>t {\\<lambda>z s. COND (bval b s) (P1 z s) (P2 z s)} IF b THEN c\\<^sub>1 ELSE c\\<^sub>2 {Q}\"\n    using assms unfolding COND_def by force\n  \n  lemma basic_while_trule:\n    assumes WF: \"wf R\"\n    assumes S: \"\\<Turnstile>\\<^sub>t {\\<lambda>(z,s\\<^sub>0) s. P z s \\<and> bval b s \\<and> s=s\\<^sub>0} c {\\<lambda>(z,s\\<^sub>0) s. P z s \\<and> (s,s\\<^sub>0)\\<in>R}\"\n    shows \"\\<Turnstile>\\<^sub>t {P} WHILE b DO c {\\<lambda>z s. P z s \\<and> \\<not> bval b s}\"\n  proof (rule hoaret_validI)  \n    fix z s\n    assume I0: \"P z s\"\n    with WF show \"\\<exists>t. (WHILE b DO c, s) \\<Rightarrow> t \\<and> P z t \\<and> \\<not> bval b t\"\n    proof (induction s rule: wf_induct_rule)\n      case (less s)\n      show ?case proof (cases \"bval b s\")\n        case True\n        with S less.prems obtain s' where \"(c,s) \\<Rightarrow> s'\" \"P z s'\" \"(s',s)\\<in>R\"\n          by auto\n        with less.IH obtain t where \"(WHILE b DO c, s') \\<Rightarrow> t\" \"P z t\" \"\\<not> bval b t\"\n          by blast\n        with WhileTrue[OF True \\<open>(c,s) \\<Rightarrow> s'\\<close>] show ?thesis by blast\n      next  \n        case False\n        with less.prems show ?thesis by auto\n      qed\n    qed\n  qed\n  \n  text \\<open>We swap the premises of the sequence rule, as our \n    verification condition generator will work on sequences \n    from right to left.\\<close>\n  lemma seq_trule:\n    assumes \"\\<Turnstile>\\<^sub>t {Q} c\\<^sub>2 {R}\" \"\\<Turnstile>\\<^sub>t {P} c\\<^sub>1 {Q}\"\n    shows \"\\<Turnstile>\\<^sub>t {P} c\\<^sub>1;;c\\<^sub>2 {R}\"\n    using basic_seq_trule assms by blast\n  \n  \n  text \\<open>We combine the while-rule with a consequence rule, to\n    make it more usable in verification condition generation\\<close>\n  \n  (* Explicit backwards derivation *)\n  lemma while_trule:\n    assumes \"wf R\"\n    assumes \"\\<Turnstile>\\<^sub>t {Ph} c {\\<lambda>(z,s\\<^sub>0) s. P z s \\<and> (s, s\\<^sub>0) \\<in> R}\"\n    assumes \"\\<And>z s. \\<lbrakk>P z s; bval b s\\<rbrakk> \\<Longrightarrow> Ph (z,s) s\"\n    assumes \"\\<And>z s. \\<lbrakk>P z s; \\<not>bval b s\\<rbrakk> \\<Longrightarrow> Q z s\"\n    shows \"\\<Turnstile>\\<^sub>t {\\<lambda>z. P z} WHILE b DO c {\\<lambda>z. Q z}\"\n    apply (rule conseq_post_trule[where Q=\"\\<lambda>z s. P z s \\<and> \\<not>bval b s\"])\n    apply (rule assms; simp)\n    apply (rule basic_while_trule)\n    apply (rule assms)\n    apply (rule conseq_pre_trule)\n    apply (rule assms)\n    apply clarify\n    apply (rule assms; assumption)\n    done\n    \n\nend\n\n\nsection \\<open>Modularity\\<close>\nsubsection \\<open>Re-Using already proved specifications\\<close>\nlemma frame_rule_eq: \n  \"\\<Turnstile> {P} c {Q} \\<longleftrightarrow> (\\<forall>R. \\<Turnstile> {\\<lambda>z s. \\<exists>z'. P z' s \\<and> (\\<forall>t. Q z' t \\<longrightarrow> R z t) } c {R})\"\n  unfolding hoare_valid_def \n  by blast\n\nlemma frame_rule:\n  assumes \"\\<Turnstile> {P} c {Q}\"\n  shows \"\\<Turnstile> {\\<lambda>z s. \\<exists>z'. P z' s \\<and> (\\<forall>t. Q z' t \\<longrightarrow> R z t) } c {R}\"\n  using assms frame_rule_eq by blast\n\nlemma frame_trule_eq: \n  \"\\<Turnstile>\\<^sub>t {P} c {Q} \\<longleftrightarrow> (\\<forall>R. \\<Turnstile>\\<^sub>t {\\<lambda>z s. \\<exists>z'. P z' s \\<and> (\\<forall>t. Q z' t \\<longrightarrow> R z t) } c {R})\"\n  unfolding hoaret_valid_def \n  by blast\n\nlemma frame_trule:\n  assumes \"\\<Turnstile>\\<^sub>t {P} c {Q}\"\n  shows \"\\<Turnstile>\\<^sub>t {\\<lambda>z s. \\<exists>z'. P z' s \\<and> (\\<forall>t. Q z' t \\<longrightarrow> R z t) } c {R}\"\n  using assms frame_trule_eq by blast\n  \nsubsection \\<open>Modified Variables\\<close>  \n\ndefinition eq_on :: \"state \\<Rightarrow> state \\<Rightarrow> vname set \\<Rightarrow> bool\" (\"_ = _ on _\" [50,50,50] 50)\n  where \"s=t on X \\<longleftrightarrow> (\\<forall>x\\<in>X. s x = t x)\"\n  \nlemma eq_on_subst_same[simp]: \n  \"x\\<in>X \\<Longrightarrow> s(x:=v) = t on X \\<longleftrightarrow> t x = v \\<and> s=t on (X-{x})\"  \n  \"x\\<in>X \\<Longrightarrow> s = t(x:=v) on X \\<longleftrightarrow> s x = v \\<and> s=t on (X-{x})\"  \n  by (auto simp: eq_on_def)\n  \nlemma eq_on_subst_other[simp]: \n  \"x\\<notin>X \\<Longrightarrow> s(x:=v) = t on X \\<longleftrightarrow> s=t on X\"\n  \"x\\<notin>X \\<Longrightarrow> s = t(x:=v) on X \\<longleftrightarrow> s=t on X\"\n  by (auto simp: eq_on_def)\n  \nlemma eq_on_refl[simp]: \"s = s on X\"  \n  by (auto simp: eq_on_def)\n  \nsubsubsection \\<open>Syntactic Approximation\\<close>\nfun lhs_vars :: \"com \\<Rightarrow> vname set\" where\n  \"lhs_vars SKIP = {}\"\n| \"lhs_vars (Clear x) = {x}\"  \n| \"lhs_vars (Assign x _ _) = {x}\"\n| \"lhs_vars (Seq c1 c2) = lhs_vars c1 \\<union> lhs_vars c2\"\n| \"lhs_vars (If b c1 c2) = lhs_vars c1 \\<union> lhs_vars c2\"  \n| \"lhs_vars (While b c) = lhs_vars c\"\n  \nlemma lhs_vars_sound: \"(c,s) \\<Rightarrow> t \\<Longrightarrow> s = t on -lhs_vars c\"\n  apply (induction rule: big_step_induct)\n  apply (auto simp: eq_on_def)\n  done\n  \n\nsubsubsection \\<open>Annotation to Hoare Triple\\<close>\n  \ndefinition hoaret_mod_valid\n  :: \"('a \\<Rightarrow> assn) \\<Rightarrow> com \\<Rightarrow> ('a \\<Rightarrow> assn) \\<Rightarrow> vname set \\<Rightarrow> bool\"\n  (\"\\<Turnstile>\\<^sub>t {(1_)}/ (_)/ {(1_)} mod _\" [0,0,0,50] 50)\n  where \"\\<Turnstile>\\<^sub>t {P} c {Q} mod X \\<equiv> \\<Turnstile>\\<^sub>t {\\<lambda>(z,s\\<^sub>0) s. P z s \\<and> s\\<^sub>0=s } c {\\<lambda>(z,s\\<^sub>0) t. Q z t \\<and> s\\<^sub>0=t on -X}\"\n\nlemma frame_mod_trule:\n  assumes \"\\<Turnstile>\\<^sub>t {P} c {Q} mod X\"\n  shows \"\\<Turnstile>\\<^sub>t {\\<lambda>z s. \\<exists>z'. P z' s \\<and> (\\<forall>t. Q z' t \\<and> s=t on -X \\<longrightarrow> R z t) } c {R}\"\n  apply (rule conseq_pre_trule)\n  apply (rule frame_trule)\n  using assms[unfolded hoaret_mod_valid_def] apply assumption\n  by auto\n\ntext \\<open>Annotate Syntactic Approximation\\<close>\nlemma hoaret_modI:\n  assumes \"lhs_vars c \\<subseteq> X\"\n  assumes \"\\<Turnstile>\\<^sub>t {P} c {Q}\"\n  shows \"\\<Turnstile>\\<^sub>t {P} c {Q} mod X\"\n  using assms\n  using lhs_vars_sound\n  unfolding hoaret_mod_valid_def hoaret_valid_def eq_on_def apply simp by fast\n\n\ndefinition hoare_mod_valid\n  :: \"('a \\<Rightarrow> assn) \\<Rightarrow> com \\<Rightarrow> ('a \\<Rightarrow> assn) \\<Rightarrow> vname set \\<Rightarrow> bool\"\n  (\"\\<Turnstile> {(1_)}/ (_)/ {(1_)} mod _\" [0,0,0,50] 50)\n  where \"\\<Turnstile> {P} c {Q} mod X \\<equiv> \\<Turnstile> {\\<lambda>(z,s\\<^sub>0) s. P z s \\<and> s\\<^sub>0=s } c {\\<lambda>(z,s\\<^sub>0) t. Q z t \\<and> s\\<^sub>0=t on -X}\"\n\nlemma frame_mod_rule:\n  assumes \"\\<Turnstile> {P} c {Q} mod X\"\n  shows \"\\<Turnstile> {\\<lambda>z s. \\<exists>z'. P z' s \\<and> (\\<forall>t. Q z' t \\<and> s=t on -X \\<longrightarrow> R z t) } c {R}\"\n  apply (rule conseq_pre_rule)\n  apply (rule frame_rule)\n  using assms[unfolded hoare_mod_valid_def] apply assumption\n  by auto\n\ntext \\<open>Annotate Syntactic Approximation\\<close>\nlemma hoare_modI:\n  assumes \"lhs_vars c \\<subseteq> X\"\n  assumes \"\\<Turnstile> {P} c {Q}\"\n  shows \"\\<Turnstile> {P} c {Q} mod X\"\n  using assms\n  using lhs_vars_sound\n  unfolding hoare_mod_valid_def hoare_valid_def eq_on_def apply simp by fast\n  \n  \n  \nsection \\<open>Verification Condition Generator\\<close>\n\nsubsection \\<open>Simplifier Setup\\<close>\n  named_theorems vcg_vars_mksimps\n\n  (* TODO: These functions may be of general interest *)\n  ML \\<open>\n    fun eq_classes_witness _ [] = []\n      | eq_classes_witness f (x::xs) = let\n          val w = f x\n          val (this,other) = List.partition (fn y => f y = w) xs\n        in\n          (w,x::this)::eq_classes_witness f other\n        end\n  \n    fun gen_assoc_map l = eq_classes_witness fst l |> map (apsnd (map snd))\n  \\<close>\n  \n  ML \\<open>\n    \n    fun add_vars_mksimps ctxt = let\n      \n      fun make_pair thm = let\n        fun get_cname [Const (@{const_name Trueprop},_)$c] = get_cname [c]\n          | get_cname [t$_] = get_cname [t]\n          | get_cname [Const (name,_)] = SOME name\n          | get_cname _ = NONE\n        \n      in\n        case get_cname (Thm.prems_of thm) of\n          SOME n => SOME (n,thm)\n        | NONE => (\n            warning (\"Invalid mksimps_pair thm: \" ^ @{make_string} thm); (* TODO: Pretty-print thm! *)\n            NONE\n        )  \n      end\n        \n      val thms = Named_Theorems.get ctxt @{named_theorems vcg_vars_mksimps}\n      val pairs = map_filter make_pair thms |> gen_assoc_map\n\n      val mksimps_pairs = \n        pairs @ mksimps_pairs |> gen_assoc_map |> map (apsnd flat)\n      val ctxt = Simplifier.set_mksimps (mksimps mksimps_pairs) ctxt\n      \n    in \n      ctxt\n    end  \n      \n  \\<close>\n  \n  method_setup vars_clarsimp = \\<open>\n      Scan.succeed (fn ctxt => SIMPLE_METHOD' (CHANGED_PROP o (\n        let\n          val ctxt = Splitter.del_split @{thm if_split} ctxt\n            delsimps @{thms fun_upd_apply}\n            addsimps @{thms fun_upd_same fun_upd_other}\n        in\n          clarsimp_tac (add_vars_mksimps ctxt)\n        end\n      )))\n  \\<close>\n\nsubsection \\<open>Variable Binding\\<close>\n  definition vbind :: \"vname \\<Rightarrow> ('a \\<Rightarrow> int \\<Rightarrow> val) \\<Rightarrow> 'a \\<Rightarrow> state \\<Rightarrow> bool\" where \"vbind x ty v s \\<equiv> s x = ty v\"\n\n  definition VAR_BIND :: \"vname \\<Rightarrow> _ \\<Rightarrow> ('a \\<Rightarrow> assn) \\<Rightarrow> assn\" where\n    \"VAR_BIND x ty Q s \\<equiv> \\<exists>v. vbind x ty v s \\<and> Q v s\"\n  definition VAR_CHANGED :: \"(int \\<Rightarrow> val) \\<Rightarrow> ('a \\<Rightarrow> int \\<Rightarrow> val) \\<Rightarrow> ('a \\<Rightarrow> assn) \\<Rightarrow> assn\" where\n    \"VAR_CHANGED k ty Q s \\<equiv> \\<exists>v. k = ty v \\<and> Q v s\"\n  \n  definition EQ :: \"(int \\<Rightarrow> val) \\<Rightarrow> ('a \\<Rightarrow> int \\<Rightarrow> val) \\<Rightarrow> 'a \\<Rightarrow> bool\" where\n    \"EQ k ty v \\<equiv> k = ty v\"\n    \n  definition VAR_BIND_FINAL :: \"bool \\<Rightarrow> assn\" where \"VAR_BIND_FINAL x _ = x\"\n    (* Required for protection against eta-contraction on printing, \n      and ensuring that final predicate does not depend on state *)\n\n  text \\<open>Variable bindings in assumptions\\<close>\n  \n  lemma imapD[vcg_vars_mksimps]: \"vbind x ty a s \\<Longrightarrow> s x = ty a\" by (auto simp: vbind_def)\n  \n  lemma eq_onD[vcg_vars_mksimps]: \"a=b on X \\<Longrightarrow> \\<forall>x\\<in>X. a x = b x\"  \n    by (auto simp: eq_on_def)\n  \n  lemma eq_onD2[vcg_vars_mksimps]: \"a=b on X \\<Longrightarrow> \\<forall>x\\<in>X. vbind x ty v a = vbind x ty v b\"  \n    by (auto simp: eq_on_def vbind_def)\n    \n  \n  \n  lemma imap_subst[simp]: \n    \"x\\<noteq>y \\<Longrightarrow> vbind x ty v (s(y:=b)) \\<longleftrightarrow> vbind x ty v s\"\n    \"vbind x ty v (s(x:=b)) \\<longleftrightarrow> b = ty v\"\n    unfolding vbind_def by auto\n\n  lemma VAR_BIND_elim:\n    assumes \"VAR_BIND x ty (\\<lambda>v. Q v) s\"\n    obtains v where \"vbind x ty v s\" \"Q v s\"\n    using assms unfolding VAR_BIND_def by auto\n\n  lemma VAR_BIND_FINAL_elim: \n    assumes \"VAR_BIND_FINAL Q s\"\n    obtains Q using assms unfolding VAR_BIND_FINAL_def by auto\n    \n  lemmas VAR_BIND_elims = VAR_BIND_FINAL_elim VAR_BIND_elim\n    \n  text \\<open>Variable Bindings in Conclusion\\<close>\n  text \\<open>Handle substitutions\\<close>\n  \n  lemma var_bind_simp1: \"x\\<noteq>y \\<Longrightarrow> VAR_BIND x ty Q (s(y:=v)) \\<longleftrightarrow> VAR_BIND x ty (\\<lambda>w s. Q w (s(y:=v))) s\"\n    unfolding VAR_BIND_def vbind_def by auto\n  \n  lemma var_bind_simp2: \"VAR_BIND x ty Q (s(x:=v)) \\<longleftrightarrow> VAR_CHANGED v ty (\\<lambda>w s. Q w (s(x:=v))) s\"  \n    unfolding VAR_BIND_def VAR_CHANGED_def vbind_def by auto\n\n  lemma var_bind_simp3: \"VAR_CHANGED k ty Q (s(x:=v)) \\<longleftrightarrow> VAR_CHANGED k ty (\\<lambda>w s. Q w (s(x:=v))) s\"\n    unfolding VAR_CHANGED_def by auto\n    \n  lemma var_bind_simp4: \"VAR_BIND_FINAL Q (s(x:=v)) = VAR_BIND_FINAL Q s\"\n    by (auto simp: VAR_BIND_FINAL_def)\n\n  lemmas var_bind_simps = var_bind_simp1 var_bind_simp2 var_bind_simp3 \n    var_bind_simp4\n    \n  text \\<open>Resolve Conditionals\\<close>\n  lemma CONDI: \n    assumes \"b \\<Longrightarrow> P\" \"\\<not>b \\<Longrightarrow> Q\"\n    shows \"COND b P Q\"\n    using assms by (auto simp: COND_def)\n  \n    \n  text \\<open>Instantiate\\<close>\n    \n  lemma VAR_BINDI: \n    assumes \"vbind x ty v s\" \"Q v s\"\n    shows \"VAR_BIND x ty Q s\"\n    using assms\n    unfolding VAR_BIND_def VAR_CHANGED_def by auto\n  \n  lemma VAR_CHANGEDI:  \n    assumes \"EQ k ty v\" \"Q v s\"\n    shows \"VAR_CHANGED k ty Q s\"\n    using assms\n    unfolding VAR_CHANGED_def EQ_def by auto\n    \n  lemma VAR_BIND_FINALI: \n    assumes \"Q\"\n    shows \"VAR_BIND_FINAL Q s\"\n    using assms\n    by (auto simp: VAR_BIND_FINAL_def)\n    \n  lemma EQIs:\n    \"EQ a imap a\"\n    \"EQ (ty v) ty v\"\n    unfolding EQ_def by auto\n  \n  method vcg_resolve_binding =  \n    rule VAR_BINDI, assumption\n  | rule VAR_CHANGEDI, rule EQIs\n  \n  method vcg_try_resolve_bindings =\n    (imp_basic_simp add: var_bind_simps)?;\n    (vcg_resolve_binding+)?\n  \n  method vcg_resolve_bindings = match conclusion in \n    \"VAR_BIND _ _ _ _\" \\<Rightarrow> \\<open>vcg_try_resolve_bindings; (rule VAR_BIND_FINALI)\\<close>\n  \\<bar> _ \\<Rightarrow> succeed\n    \n    \nsubsubsection \\<open>Syntax\\<close>\n\n\n\n(*\n(* TODO: How to activate this syntax only in bundle? *)\nnonterminal var_bind and var_binds\n\n\nsyntax\n  \"_var_block\" :: \"var_binds \\<Rightarrow> 'a\" (\"vars _\" [12] 10)\n  \"_var_final\" :: \"var_bind \\<Rightarrow> 'a \\<Rightarrow> var_binds\" (\"_ in _\" [13,12] 12)\n  \"_var_cons\" :: \"var_bind \\<Rightarrow> var_binds \\<Rightarrow> var_binds\" (\"_/ _\" [13,12] 12)\n  \"_var_bind_nvt\" :: \"'a \\<Rightarrow> idt \\<Rightarrow> 'a \\<Rightarrow> var_bind\" (\"'(_ as _ : _')\" [14,14,14] 14)\n  \"_var_bind_nt\" :: \"idt \\<Rightarrow> 'a \\<Rightarrow> var_bind\" (\"'(_ : _')\" [14,14] 14)\n  \"_var_bind_nv\" :: \"'a \\<Rightarrow> idt \\<Rightarrow> var_bind\" (\"'(_ as _')\" [14,14] 14)\n  \"_var_bind_n\" :: \"idt \\<Rightarrow> var_bind\" (\"_\" [14] 14)\n  \nsyntax \n  \"_var_app\" :: \"var_bind \\<Rightarrow> 'a \\<Rightarrow> 'a\" \n  \"_var_bind_s\" :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  \ntranslations\n  \"_var_block (_var_final b Q)\" \\<rightleftharpoons> \"_var_app b (CONST VAR_BIND_FINAL Q)\"\n  \"_var_block (_var_cons b bs)\" \\<rightleftharpoons> \"_var_app b (_var_block bs)\"\n  \"_var_app (_var_bind_nvt x v ty) bs\" \\<rightleftharpoons> \"_var_bind_s x ty (\\<lambda>v. bs)\"\n  \"_var_bind_nv x v\" \\<rightleftharpoons> \"_var_bind_nvt x v (CONST var)\"\n  \"_var_bind_nt x ty\" \\<rightharpoonup> \"_var_bind_nvt (x) x ty\"\n  \"_var_bind_n x\" \\<rightharpoonup> \"_var_bind_nv (x) x\"\n  \"_var_cons b c\" \\<leftharpoondown>  \"_var_final b (_var_block c)\"\n  \n  \n*)  \n\n(*syntax\n  \"_var_block\" :: \"var_binds \\<Rightarrow> 'a\" (\"vars _\" [12] 10)\n  \"_var_final\" :: \"var_bind \\<Rightarrow> 'a \\<Rightarrow> var_binds\" (\"_ in _\" [13,12] 12)\n  \"_var_cons\" :: \"var_bind \\<Rightarrow> var_binds \\<Rightarrow> var_binds\" (\"_,/ _\" [13,12] 12)\n  \"_var_bind_nvt\" :: \"'a \\<Rightarrow> idt \\<Rightarrow> 'a \\<Rightarrow> var_bind\" (\"_ as _ : _\" [14,14,14] 14)\n  \"_var_bind_nt\" :: \"idt \\<Rightarrow> 'a \\<Rightarrow> var_bind\" (\"_ : _\" [14,14] 14)\n  \"_var_bind_nv\" :: \"'a \\<Rightarrow> idt \\<Rightarrow> var_bind\" (\"_ as _\" [14,14] 14)\n  \"_var_bind_n\" :: \"idt \\<Rightarrow> var_bind\" (\"_\" [14] 14)\n*)\n\n(* TODO: How to activate this syntax only in bundle? *)\nnonterminal var_bind and var_binds\n\nsyntax \n  \"_var_blockf\" :: \"var_binds \\<Rightarrow> 'a \\<Rightarrow> 'a\" (\"vars _ in _\" [12,12] 10)\n  \"_var_block\" :: \"var_binds \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  \"_var_final\" :: \"var_bind \\<Rightarrow> var_binds\" (\"_\" [13] 12)\n  \"_var_cons\" :: \"var_bind \\<Rightarrow> var_binds \\<Rightarrow> var_binds\" (\"_/ _\" [13,12] 12)\n  \"_var_bind_nvt\" :: \"'a \\<Rightarrow> idt \\<Rightarrow> 'a \\<Rightarrow> var_bind\" (\"'(_ as _ : _')\" [14,14,14] 14)\n  \"_var_bind_nt\" :: \"idt \\<Rightarrow> 'a \\<Rightarrow> var_bind\" (\"'(_ : _')\" [14,14] 14)\n  \"_var_bind_nv\" :: \"'a \\<Rightarrow> idt \\<Rightarrow> var_bind\" (\"'(_ as _')\" [14,14] 14)\n  \"_var_bind_n\" :: \"idt \\<Rightarrow> var_bind\" (\"_\" [14] 14)\n\n(* Syntax to output odd var-bindings, which can occur for partially unfolded var-binding blocks *)\nsyntax (output)   \n  \"_var_block\" :: \"var_binds \\<Rightarrow> 'a \\<Rightarrow> 'a\" (\"var\\<^sub>n\\<^sub>o\\<^sub>f\\<^sub>i\\<^sub>n\\<^sub>a\\<^sub>l _ in/ _\")\n  \nsyntax \n  \"_var_bind_s\" :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  \ntranslations  \n  \"_var_blockf bs P\" \\<rightleftharpoons> \"_var_block bs (CONST VAR_BIND_FINAL P)\"\n  \"_var_block (_var_cons (_var_bind_nvt x v ty) bs) P\" \\<rightleftharpoons> \"_var_bind_s x ty (\\<lambda>v. _var_block bs P)\"\n  \"_var_block (_var_final (_var_bind_nvt x v ty)) P\" \\<rightleftharpoons> \"_var_bind_s x ty (\\<lambda>v. P)\"\n  \"s\" \\<leftharpoondown> \"_var_final s\"\n  \"_var_blockf (_var_cons b c) P\" \\<leftharpoondown> \"_var_block b (_var_blockf c P)\"\n\ntranslations\n  \"_var_bind_nv x v\" \\<rightleftharpoons> \"_var_bind_nvt x v (CONST var)\"\n  \"_var_bind_nt x ty\" \\<rightharpoonup> \"_var_bind_nvt (x) x ty\"\n  \"_var_bind_n x\" \\<rightharpoonup> \"_var_bind_nv (x) x\"\n\nML \\<open>\n  local\n    open IMP_Translation\n  in\n    fun xform_var_arg (Const (@{syntax_const \"_constrain\"}, _) $ t $ _) = xform_var_arg t\n      | xform_var_arg (Free (str,_)) = SOME (HOLogic.mk_string str)\n      | xform_var_arg _ = NONE\n\n    fun \n      var_bind_s_tr _ [x, ty, q] = let\n        val x = the_default x (xform_var_arg x)\n      in\n        Syntax.const @{const_name VAR_BIND}$x$ty$q\n      end\n    | var_bind_s_tr _ ts = raise (TERM (\"var_bind_s_tr\",ts))\n      \n  \n    fun\n      var_bind_s_tr' _ (x::ts) = let\n        val x = case try dest_var_syntax x of\n          NONE => x\n        | SOME s => Syntax.const s  \n      \n      in\n        list_comb (Syntax.const @{syntax_const \"_var_bind_s\"}, x::ts)\n      end\n    | var_bind_s_tr' _ _ = raise Match\n    \n    fun bound_eq (Ast.Appl [Ast.Constant @{syntax_const \"_constrain\"}, x, _]) y = bound_eq x y\n      | bound_eq (Ast.Appl [Ast.Constant @{syntax_const \"_bound\"}, x]) y = bound_eq x y\n      | bound_eq (Ast.Variable x) y = x = y\n      | bound_eq _ _ = false\n    \n    fun var_same_ast_tr' [(Ast.Constant x), b] = \n      if bound_eq b x then\n        Ast.Appl [Ast.Constant @{syntax_const \"_var_bind_n\"}, b]\n      else raise Match\n    | var_same_ast_tr' [(Ast.Constant x), b, ty] = \n      if bound_eq b x then\n        Ast.Appl [Ast.Constant @{syntax_const \"_var_bind_nt\"}, b, ty]\n      else raise Match\n    | var_same_ast_tr' _ = raise Match  \n    \n    val setup = \n      Sign.parse_translation [\n          (@{syntax_const \"_var_bind_s\"}, var_bind_s_tr)\n        ]\n      #>\n      Sign.print_translation [\n        (@{const_syntax VAR_BIND}, var_bind_s_tr')\n      ]\n      #>\n    Sign.print_ast_translation\n     [(@{syntax_const \"_var_bind_nvt\"}, K var_same_ast_tr'),\n      (@{syntax_const \"_var_bind_nv\"}, K var_same_ast_tr')\n     ];\n      \n    val _ = Theory.setup setup\n      \n  end\n\\<close>\n\nlemma \"(vars a b c in P a b c) s\"\n  unfolding VAR_BIND_FINAL_def\n  oops\n\nlemma \"XP (vars a (b : var) c (x as xx) (''xx.d'' as xxx) (''__y'' as yy : id) in P a b c)\"\n  unfolding VAR_BIND_FINAL_def \n  oops\n\n \nsubsection \\<open>Annotating While Loops\\<close>\ndefinition AWHILE :: \"('a \\<Rightarrow> assn) \\<Rightarrow> bexp \\<Rightarrow> com \\<Rightarrow> com\" (\"(INVAR (_)/ WHILE (\\<open>unbreakable\\<close>_) DO(2/ _))\"  [0, 0, 61] 61)\n  where \"INVAR I WHILE b DO c \\<equiv> WHILE b DO c\"\n\nlemma annot_invar: \"(WHILE b DO c) = (INVAR I WHILE b DO c)\" by (simp add: AWHILE_def)\n  \nlemma awhile_rule:\n  assumes \"\\<Turnstile> {R} c {P}\"\n  assumes \"\\<And>z s. \\<lbrakk>P z s; bval b s\\<rbrakk> \\<Longrightarrow> R z s\"\n  assumes \"\\<And>z s. \\<lbrakk>P z s; \\<not>bval b s\\<rbrakk> \\<Longrightarrow> Q z s\"\n  shows \"\\<Turnstile> {P} INVAR P WHILE b DO c {Q}\"\n  unfolding AWHILE_def by (rule while_rule[OF assms])\n\ndefinition AWHILET :: \"(state\\<times>state) set \\<Rightarrow> ('a \\<Rightarrow> assn) \\<Rightarrow> bexp \\<Rightarrow> com \\<Rightarrow> com\" (\"(VAR (_)/ INVAR (_)/ WHILE (\\<open>unbreakable\\<close>_) DO(2/ _))\"  [0, 0, 0, 61] 61)\n  where \"VAR R INVAR I WHILE b DO c \\<equiv> WHILE b DO c\"\n\nlemma annot_tinvar: \"(WHILE b DO c) = (VAR R INVAR I WHILE b DO c)\" by (simp add: AWHILET_def)\n  \nlemma awhile_trule:\n  fixes R :: \"(state \\<times> state) set\"\n  assumes \"wf R\"\n  assumes \"\\<Turnstile>\\<^sub>t {Ph} c {\\<lambda>(z,s\\<^sub>0) s. P z s \\<and> (s, s\\<^sub>0) \\<in> R}\"\n  assumes \"\\<And>z s. \\<lbrakk>P z s; bval b s\\<rbrakk> \\<Longrightarrow> id Ph (z,s) s\"\n  assumes \"\\<And>z s. \\<lbrakk>P z s; \\<not>bval b s\\<rbrakk> \\<Longrightarrow> Q z s\"\n  shows \"\\<Turnstile>\\<^sub>t {\\<lambda>z. P z} VAR R INVAR P WHILE b DO c {\\<lambda>z. Q z}\"\n  unfolding AWHILET_def\n  by (rule while_trule[OF assms[simplified]])\n  \nlemma lhs_vars_awhile[simp]:\n  \"lhs_vars (INVAR I WHILE b DO c) = lhs_vars c\"\n  \"lhs_vars (VAR R INVAR I WHILE b DO c) = lhs_vars c\"\n  unfolding AWHILE_def AWHILET_def by auto\n  \n  \n  \ntext \\<open>Measure function by aexp\\<close>\nabbreviation \"measure_exp a \\<equiv> measure (nat o aval a)\"\n  \n  \nsubsection \\<open>Basic VCG\\<close>  \n\nnamed_theorems vcg_rules\n\nlemmas [vcg_rules] =\n  skip_rule assign_rule clear_rule seq_rule if_rule awhile_rule\n  skip_trule assign_trule clear_trule seq_trule if_trule awhile_trule conjI\n\nnamed_theorems vcg_init_rules  \nlemmas [vcg_init_rules] = conseq_pre_rule conseq_pre_trule\n  \nmethod vcg_is_no_hoare_triple = match conclusion in \n    \"\\<Turnstile> {_} _ {_}\" \\<Rightarrow> fail \n  \\<bar> \"\\<Turnstile>\\<^sub>t {_} _ {_}\" \\<Rightarrow> fail \n  \\<bar> _ \\<Rightarrow> succeed\n\ndefinition VERIFICATION_CONDITION :: \"bool \\<Rightarrow> bool\" where\n  \"VERIFICATION_CONDITION P = P\"\n\nlemma VC_I: \"P \\<Longrightarrow> VERIFICATION_CONDITION P\" by (simp add: VERIFICATION_CONDITION_def)\nlemma VC_D: \"VERIFICATION_CONDITION P \\<Longrightarrow> P\" by (simp add: VERIFICATION_CONDITION_def)\n\nmethod vcg_rule_wrapper methods m = m; (vcg_is_no_hoare_triple, rule VC_D)?\n\nmethod vcg_rule (* Apply Hoare-rule and tag side conditions *)\n  = vcg_rule_wrapper\\<open>rule vcg_rules | rule frame_mod_rule frame_mod_trule, rule vcg_rules\\<close>\n\nlemma redundant_vbindE:\n  assumes \"vbind x ty v1 s\" \"vbind x ty v2 s\"\n  obtains \"ty v1 = ty v2\"\n  using assms by (auto simp: vbind_def)\n  \nmethod_setup vcg_redundant_vbind = \\<open>\n Scan.succeed (fn ctxt => SIMPLE_METHOD (\n   REPEAT_DETERM1 (FIRSTGOAL (EVERY' [eresolve_tac ctxt @{thms redundant_vbindE}, assume_tac ctxt]))\n ))\\<close>\n  \n  \nmethod vcg_prepare_goal -- \\<open>Applied before processing any goal\\<close>\n  = (elim VAR_BIND_elims conjE)?;((vars_clarsimp| vcg_redundant_vbind)+)?\n  \nlemma thin_imap: \"vbind x ty v s \\<Longrightarrow> P \\<Longrightarrow> P\" .\nlemma thin_eqon: \"s = t on X \\<Longrightarrow> P \\<Longrightarrow> P\" .\n  \nmethod_setup vcg_remove_binding_assms = \\<open>\n Scan.succeed (fn ctxt => SIMPLE_METHOD (\n   REPEAT_DETERM (FIRSTGOAL (eresolve_tac ctxt @{thms thin_imap thin_eqon}))\n ))\\<close>\n\n(*method vcg_remove_binding_assms = ((thin_tac \"imap _ _ _ _\")+)?*)\n\ndefinition \"MOD_VAR_APPROX A B \\<equiv> A\\<subseteq>B\"\nlemma MOD_VAR_APPROXI: \"A\\<subseteq>B \\<Longrightarrow> MOD_VAR_APPROX A B\"\n  by (auto simp: MOD_VAR_APPROX_def)\n\nlemma hoaret_modI_vcg:\n  assumes \"MOD_VAR_APPROX (lhs_vars c) X\"\n  assumes \"\\<Turnstile>\\<^sub>t {P} c {Q}\"\n  shows \"\\<Turnstile>\\<^sub>t {P} c {Q} mod X\"\n  using assms hoaret_modI unfolding MOD_VAR_APPROX_def by blast\n\nlemma hoare_modI_vcg:\n  assumes \"MOD_VAR_APPROX (lhs_vars c) X\"\n  assumes \"\\<Turnstile> {P} c {Q}\"\n  shows \"\\<Turnstile> {P} c {Q} mod X\"\n  using assms hoare_modI unfolding MOD_VAR_APPROX_def by blast\n  \nlemmas [vcg_init_rules] = \n  hoaret_modI_vcg[OF _ conseq_pre_trule]  \n  hoare_modI_vcg[OF _ conseq_pre_rule]  \n    \n  \nmethod solve_mod_var_approx = (rule MOD_VAR_APPROXI; auto; fail)\n\n\n\ndefinition \"INST_VARS X \\<equiv> True\"\n\nlemma INST_VARS_I:\n  \"INST_VARS P \\<Longrightarrow> INST_VARS Q \\<Longrightarrow> INST_VARS (P\\<and>Q)\"\n  \"INST_VARS (x = x)\"\n  by (auto simp add: INST_VARS_def)  \n\nlemma INST_VARS_rem: \"INST_VARS X\" by (auto simp add: INST_VARS_def)  \n\nlemma INST_VARS_begin:\n  \"INST_VARS P \\<Longrightarrow> P \\<Longrightarrow> P\" .\n\nmethod vcg_inst_vars =\n    rule INST_VARS_begin,\n    (((rule INST_VARS_I | rule INST_VARS_rem)+) [])\n\n\nmethod vcg_prepare_vc -- \\<open>Applied to prepare verification condition. May solve it.\\<close>\n  = rule VC_I;(intro conjI impI allI CONDI exI)?;vcg_prepare_goal; (vcg_resolve_bindings; vcg_remove_binding_assms | vcg_try_resolve_bindings); vcg_inst_vars\n\nmethod vcgdbg_prepare_vc -- \\<open>Applied to prepare verification condition. May solve it.\\<close>\n  = rule VC_I;(intro conjI impI allI CONDI exI)?;vcg_prepare_goal; (vcg_resolve_bindings | vcg_try_resolve_bindings); vcg_inst_vars\n  \nmethod vcg_step_solver methods solver \n  = vcg_prepare_goal; ( vcg_rule | vcg_prepare_vc;solver )\nmethod vcg_default_solver = clarsimp?; (safe?;clarsimp?;simp?;solve_mod_var_approx?;fail)?\n\nmethod vcgdbg_step_solver methods solver \n  = vcg_prepare_goal; ( vcg_rule | vcgdbg_prepare_vc;solver )\n\nmethod vcg_step = vcg_step_solver\\<open>vcg_default_solver\\<close>\nmethod vcg_ctd = (vcg_step)+\n\nmethod vcgdbg_step = vcgdbg_step_solver\\<open>vcg_default_solver\\<close>\nmethod vcgdbg_ctd = (vcgdbg_step)+\n\nmethod vcg_init = vcg_rule_wrapper\\<open>rule vcg_init_rules\\<close>\n\nmethod vcg = vcg_init, vcg_ctd\n\nmethod vcg_ctd_raw = (vcg_step_solver\\<open>succeed\\<close>)+\nmethod vcg_raw = vcg_init, vcg_ctd_raw\n  \n\nsubsection \\<open>Deferred VCs\\<close>  \n\ndefinition DEFERRED :: \"bool \\<Rightarrow> bool\" where \"DEFERRED P = P\"\nlemma DEFERREDD: \"DEFERRED P \\<Longrightarrow> P\" by (auto simp: DEFERRED_def)\n\nmethod vcg_can_defer =\n  (\n    match conclusion \n      in \"DEFERRED _\" \\<Rightarrow> fail -- \\<open>Refuse to defer already deferred goals\\<close>\n    \\<bar> \"\\<Turnstile> {_} _ {_}\" \\<Rightarrow> fail  -- \\<open>Refuse to defer Hoare triples (They are no VCs!)\\<close>\n    \\<bar> \"\\<Turnstile>\\<^sub>t {_} _ {_}\" \\<Rightarrow> fail  -- \\<open>Refuse to defer Hoare triples (They are no VCs!)\\<close>\n    \\<bar> _ \\<Rightarrow> succeed)\n\nmethod vcg_defer = \n  vcg_can_defer, rule DEFERREDD, tactic \\<open>FIRSTGOAL defer_tac\\<close>\n\nmethod vcg_all =  \n  (vcg_init, (vcg_ctd, vcg_defer? | vcg_defer)+, (unfold DEFERRED_def)?)\n\n\nend\n", "meta": {"author": "bcliu430", "repo": "ECE5984", "sha": "6846d1bba065999d5b1878d3339677b14768ba90", "save_path": "github-repos/isabelle/bcliu430-ECE5984", "path": "github-repos/isabelle/bcliu430-ECE5984/ECE5984-6846d1bba065999d5b1878d3339677b14768ba90/Tutorials/IMPArrayHoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.34958202995258797}}
{"text": "(* \n    This file is a part of IsarMathLib - \n    a library of formalized mathematics written for Isabelle/Isar.\n\n    Copyright (C) 2012-2013 Daniel de la Concepcion\n\n    This program is free software; Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED \nWARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF \nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. \nIN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, \nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, \nPROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; \nOR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, \nWHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \nOTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, \nEVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *)\n\nsection \\<open>Topology 5\\<close>\n\ntheory Topology_ZF_5 imports Topology_ZF_properties Topology_ZF_examples_1 Topology_ZF_4\nbegin\n\nsubsection\\<open>Some results for separation axioms\\<close>\n\ntext\\<open>First we will give a global characterization of $T_1$-spaces; which is interesting\nbecause it involves the cardinal $\\mathbb{N}$.\\<close>\n\nlemma (in topology0)  T1_cocardinal_coarser:\n  shows \"(T {is T\\<^sub>1}) \\<longleftrightarrow> (CoFinite (\\<Union>T))\\<subseteq>T\"\nproof\n  {\n    assume AS:\"T {is T\\<^sub>1}\"\n    {\n      fix x assume p:\"x\\<in>\\<Union>T\"\n      {\n        fix y assume \"y\\<in>(\\<Union>T)-{x}\"\n        with AS p obtain U where \"U\\<in>T\" \"y\\<in>U\" \"x\\<notin>U\" using isT1_def by blast\n        then have \"U\\<in>T\" \"y\\<in>U\" \"U\\<subseteq>(\\<Union>T)-{x}\" by auto\n        then have \"\\<exists>U\\<in>T. y\\<in>U \\<and> U\\<subseteq>(\\<Union>T)-{x}\" by auto\n      }\n      then have \"\\<forall>y\\<in>(\\<Union>T)-{x}. \\<exists>U\\<in>T. y\\<in>U \\<and> U\\<subseteq>(\\<Union>T)-{x}\" by auto\n      then have \"\\<Union>T-{x}\\<in>T\" using open_neigh_open by auto\n      with p have \"{x} {is closed in}T\" using IsClosed_def by auto\n    }\n    then have pointCl:\"\\<forall>x\\<in>\\<Union>T. {x} {is closed in} T\" by auto\n    {\n      fix A\n      assume AS2:\"A\\<in>FinPow(\\<Union>T)\"\n      let ?p=\"{\\<langle>x,{x}\\<rangle>. x\\<in>A}\"\n      have \"?p\\<in>A\\<rightarrow>{{x}. x\\<in>A}\" using Pi_def unfolding function_def by auto\n      then have \"?p:bij(A,{{x}. x\\<in>A})\" unfolding bij_def inj_def surj_def using apply_equality\n        by auto\n      then have \"A\\<approx>{{x}. x\\<in>A}\" unfolding eqpoll_def by auto\n      with AS2 have \"Finite({{x}. x\\<in>A})\" unfolding FinPow_def using eqpoll_imp_Finite_iff by auto\n      then have \"{{x}. x\\<in>A}\\<in>FinPow({D \\<in> Pow(\\<Union>T) . D {is closed in} T})\" using AS2 pointCl unfolding FinPow_def\n      by (safe, blast+) \n      then have \"(\\<Union>{{x}. x\\<in>A}) {is closed in} T\" using fin_union_cl_is_cl by auto\n      moreover\n      have \"\\<Union>{{x}. x\\<in>A}=A\" by auto\n      ultimately have \"A {is closed in} T\" by simp\n    }\n    then have reg:\"\\<forall>A\\<in>FinPow(\\<Union>T). A {is closed in} T\" by auto\n    {\n      fix U\n      assume AS2:\"U \\<in> CoCardinal(\\<Union>T,nat)\"\n      then have \"U\\<in>Pow(\\<Union>T)\" \"U=0 \\<or> ((\\<Union>T)-U)\\<prec>nat\" using CoCardinal_def by auto\n      then have \"U\\<in>Pow(\\<Union>T)\" \"U=0 \\<or> Finite(\\<Union>T-U)\" using lesspoll_nat_is_Finite by auto\n      then have \"U\\<in>Pow(\\<Union>T)\" \"U\\<in>T\\<or>(\\<Union>T-U) {is closed in} T\" using empty_open topSpaceAssum\n        reg unfolding FinPow_def by auto\n      then have \"U\\<in>Pow(\\<Union>T)\" \"U\\<in>T\\<or>(\\<Union>T-(\\<Union>T-U))\\<in>T\" using IsClosed_def by auto\n      moreover\n      then have \"(\\<Union>T-(\\<Union>T-U))=U\" by blast\n      ultimately have \"U\\<in>T\" by auto\n    }\n    then show \"(CoFinite (\\<Union>T))\\<subseteq>T\" using Cofinite_def by auto\n  }\n  {\n    assume \"(CoFinite (\\<Union>T))\\<subseteq>T\"\n    then have AS:\"CoCardinal(\\<Union>T,nat) \\<subseteq> T\" using Cofinite_def by auto\n    {\n      fix x y\n      assume AS2:\"x\\<in>\\<Union>T\" \"y\\<in>\\<Union>T\"\"x\\<noteq>y\"\n      have \"Finite({y})\" by auto\n      then obtain n where \"{y}\\<approx>n\" \"n\\<in>nat\" using Finite_def by auto\n      then have \"{y}\\<prec>nat\" using n_lesspoll_nat eq_lesspoll_trans by auto\n      then have \"{y} {is closed in} CoCardinal(\\<Union>T,nat)\" using closed_sets_cocardinal\n        AS2(2) by auto\n      then have \"(\\<Union>T)-{y}\\<in>CoCardinal(\\<Union>T,nat)\" using union_cocardinal IsClosed_def by auto\n      with AS have \"(\\<Union>T)-{y}\\<in>T\" by auto\n      moreover\n      with AS2(1,3) have \"x\\<in>((\\<Union>T)-{y}) \\<and> y\\<notin>((\\<Union>T)-{y})\" by auto\n      ultimately have \"\\<exists>V\\<in>T. x\\<in>V\\<and>y\\<notin>V\" by(safe,auto)\n    }\n    then show \"T {is T\\<^sub>1}\" using isT1_def by auto\n  }\nqed\n\ntext\\<open>In the previous proof, it is obvious that we don't need to check\nif ever cofinite set is open. It is enough to check if every singleton is closed.\\<close>\n\ncorollary(in topology0) T1_iff_singleton_closed:\n  shows \"(T {is T\\<^sub>1}) \\<longleftrightarrow> (\\<forall>x\\<in>\\<Union>T. {x}{is closed in}T)\"\nproof\n  assume AS:\"T {is T\\<^sub>1}\"\n  {\n    fix x assume p:\"x\\<in>\\<Union>T\"\n    {\n      fix y assume \"y\\<in>(\\<Union>T)-{x}\"\n      with AS p obtain U where \"U\\<in>T\" \"y\\<in>U\" \"x\\<notin>U\" using isT1_def by blast\n      then have \"U\\<in>T\" \"y\\<in>U\" \"U\\<subseteq>(\\<Union>T)-{x}\" by auto\n      then have \"\\<exists>U\\<in>T. y\\<in>U \\<and> U\\<subseteq>(\\<Union>T)-{x}\" by auto\n    }\n    then have \"\\<forall>y\\<in>(\\<Union>T)-{x}. \\<exists>U\\<in>T. y\\<in>U \\<and> U\\<subseteq>(\\<Union>T)-{x}\" by auto\n    then have \"\\<Union>T-{x}\\<in>T\" using open_neigh_open by auto\n    with p have \"{x} {is closed in}T\" using IsClosed_def by auto\n  }\n  then show pointCl:\"\\<forall>x\\<in>\\<Union>T. {x} {is closed in} T\" by auto\nnext\n  assume pointCl:\"\\<forall>x\\<in>\\<Union>T. {x} {is closed in} T\"\n  {\n    fix A\n    assume AS2:\"A\\<in>FinPow(\\<Union>T)\"\n    let ?p=\"{\\<langle>x,{x}\\<rangle>. x\\<in>A}\"\n    have \"?p\\<in>A\\<rightarrow>{{x}. x\\<in>A}\" using Pi_def unfolding function_def by auto\n    then have \"?p:bij(A,{{x}. x\\<in>A})\" unfolding bij_def inj_def surj_def using apply_equality\n      by auto\n    then have \"A\\<approx>{{x}. x\\<in>A}\" unfolding eqpoll_def by auto\n    with AS2 have \"Finite({{x}. x\\<in>A})\" unfolding FinPow_def using eqpoll_imp_Finite_iff by auto\n    then have \"{{x}. x\\<in>A}\\<in>FinPow({D \\<in> Pow(\\<Union>T) . D {is closed in} T})\" using AS2 pointCl unfolding FinPow_def\n    by (safe, blast+) \n    then have \"(\\<Union>{{x}. x\\<in>A}) {is closed in} T\" using fin_union_cl_is_cl by auto\n    moreover\n    have \"\\<Union>{{x}. x\\<in>A}=A\" by auto\n    ultimately have \"A {is closed in} T\" by simp\n  }\n  then have reg:\"\\<forall>A\\<in>FinPow(\\<Union>T). A {is closed in} T\" by auto\n  {\n    fix U\n    assume AS2:\"U\\<in>CoCardinal(\\<Union>T,nat)\"\n    then have \"U\\<in>Pow(\\<Union>T)\" \"U=0 \\<or> ((\\<Union>T)-U)\\<prec>nat\" using CoCardinal_def by auto\n    then have \"U\\<in>Pow(\\<Union>T)\" \"U=0 \\<or> Finite(\\<Union>T-U)\" using lesspoll_nat_is_Finite by auto\n    then have \"U\\<in>Pow(\\<Union>T)\" \"U\\<in>T\\<or>(\\<Union>T-U) {is closed in} T\" using empty_open topSpaceAssum\n      reg unfolding FinPow_def by auto\n    then have \"U\\<in>Pow(\\<Union>T)\" \"U\\<in>T\\<or>(\\<Union>T-(\\<Union>T-U))\\<in>T\" using IsClosed_def by auto\n    moreover\n    then have \"(\\<Union>T-(\\<Union>T-U))=U\" by blast\n    ultimately have \"U\\<in>T\" by auto\n  }\n  then have \"(CoFinite (\\<Union>T))\\<subseteq>T\" using Cofinite_def by auto\n  then show \"T {is T\\<^sub>1}\" using T1_cocardinal_coarser by auto\nqed\n\ntext\\<open>Secondly, let's show that the \\<open>CoCardinal X Q\\<close>\ntopologies for different sets $Q$ are all ordered\nas the partial order of sets. (The order is linear when considering only cardinals)\\<close>\n\nlemma order_cocardinal_top:\n  fixes X\n  assumes \"Q1\\<lesssim>Q2\"\n  shows \"CoCardinal(X,Q1) \\<subseteq> CoCardinal(X,Q2)\"\nproof\n  fix x\n  assume \"x \\<in> CoCardinal(X,Q1)\"\n  then have \"x\\<in>Pow(X)\" \"x=0\\<or>(X-x)\\<prec>Q1\" using CoCardinal_def by auto\n  with assms have \"x\\<in>Pow(X)\" \"x=0\\<or>(X-x)\\<prec>Q2\" using lesspoll_trans2 by auto\n  then show \"x\\<in>CoCardinal(X,Q2)\" using CoCardinal_def by auto\nqed\n\ncorollary cocardinal_is_T1:\n  fixes X K\n  assumes \"InfCard(K)\"\n  shows \"CoCardinal(X,K) {is T\\<^sub>1}\"\nproof-\n  have \"nat\\<le>K\" using InfCard_def assms by auto\n  then have \"nat\\<subseteq>K\" using le_imp_subset by auto\n  then have \"nat\\<lesssim>K\" \"K\\<noteq>0\"using subset_imp_lepoll by auto\n  then have \"CoCardinal(X,nat) \\<subseteq> CoCardinal(X,K)\" \"\\<Union>CoCardinal(X,K)=X\" using order_cocardinal_top \n    union_cocardinal by auto\n  then show ?thesis using topology0.T1_cocardinal_coarser topology0_CoCardinal assms Cofinite_def\n    by auto\nqed\n\ntext\\<open>In $T_2$-spaces, filters and nets have at most one limit point.\\<close>\n\nlemma (in topology0) T2_imp_unique_limit_filter:\n  assumes \"T {is T\\<^sub>2}\" \"\\<FF> {is a filter on}\\<Union>T\" \"\\<FF> \\<rightarrow>\\<^sub>F x\" \"\\<FF> \\<rightarrow>\\<^sub>F y\"\n  shows \"x=y\"\nproof-\n  {\n    assume \"x\\<noteq>y\"\n    from assms(3,4) have \"x\\<in>\\<Union>T\" \"y\\<in>\\<Union>T\" using FilterConverges_def assms(2)\n      by auto\n    with \\<open>x\\<noteq>y\\<close> have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. x\\<in>U \\<and> y\\<in>V \\<and> U\\<inter>V=0\" using assms(1) isT2_def by auto\n    then obtain U V where \"x\\<in>U\" \"y\\<in>V\" \"U\\<inter>V=0\" \"U\\<in>T\" \"V\\<in>T\" by auto\n    then have \"U\\<in>{A\\<in>Pow(\\<Union>T). x\\<in>Interior(A,T)}\" \"V\\<in>{A\\<in>Pow(\\<Union>T). y\\<in>Interior(A,T)}\" using Top_2_L3 by auto\n    then have \"U\\<in>\\<FF>\" \"V\\<in>\\<FF>\" using FilterConverges_def assms(2) assms(3,4)\n      by auto\n    then have \"U\\<inter>V\\<in>\\<FF>\" using IsFilter_def assms(2) by auto\n    with \\<open>U\\<inter>V=0\\<close> have \"0\\<in>\\<FF>\" by auto\n    then have \"False\" using IsFilter_def assms(2) by auto\n  }\n  then show ?thesis by auto\nqed\n\nlemma (in topology0) T2_imp_unique_limit_net:\n  assumes \"T {is T\\<^sub>2}\" \"N {is a net on}\\<Union>T\" \"N \\<rightarrow>\\<^sub>N x\" \"N \\<rightarrow>\\<^sub>N y\"\n  shows \"x=y\"\nproof-\n  have \"(Filter N..(\\<Union>T)) {is a filter on} (\\<Union>T)\" \"(Filter N..(\\<Union>T)) \\<rightarrow>\\<^sub>F x\" \"(Filter N..(\\<Union>T)) \\<rightarrow>\\<^sub>F y\"\n    using filter_of_net_is_filter(1) net_conver_filter_of_net_conver assms(2)\n    assms(3,4) by auto\n  with assms(1) show ?thesis using T2_imp_unique_limit_filter by auto\nqed\n    \ntext\\<open>In fact, $T_2$-spaces are characterized by this property. For this proof we build\na filter containing the union of two filters.\\<close>\n\nlemma (in topology0) unique_limit_filter_imp_T2:\n  assumes \"\\<forall>x\\<in>\\<Union>T. \\<forall>y\\<in>\\<Union>T. \\<forall>\\<FF>. ((\\<FF> {is a filter on}\\<Union>T) \\<and> (\\<FF> \\<rightarrow>\\<^sub>F x) \\<and> (\\<FF> \\<rightarrow>\\<^sub>F y)) \\<longrightarrow> x=y\"\n  shows \"T {is T\\<^sub>2}\"\nproof-\n  {\n    fix x y\n    assume \"x\\<in>\\<Union>T\" \"y\\<in>\\<Union>T\" \"x\\<noteq>y\"\n    {\n      assume \"\\<forall>U\\<in>T. \\<forall>V\\<in>T. (x\\<in>U \\<and> y\\<in>V) \\<longrightarrow> U\\<inter>V\\<noteq>0\"\n      let ?Ux=\"{A\\<in>Pow(\\<Union>T). x\\<in>int(A)}\"\n      let ?Uy=\"{A\\<in>Pow(\\<Union>T). y\\<in>int(A)}\"\n      let ?FF=\"?Ux \\<union> ?Uy \\<union> {A\\<inter>B. \\<langle>A,B\\<rangle>\\<in>?Ux \\<times> ?Uy}\"\n      have sat:\"?FF {satisfies the filter base condition}\"\n      proof-\n        {\n          fix A B\n          assume \"A\\<in>?FF\" \"B\\<in>?FF\"\n          {\n            assume \"A\\<in>?Ux\" \n            {\n              assume \"B\\<in>?Ux\"\n              with \\<open>x\\<in>\\<Union>T\\<close> \\<open>A\\<in>?Ux\\<close> have \"A\\<inter>B\\<in>?Ux\" using neigh_filter(1) IsFilter_def by auto\n              then have \"A\\<inter>B\\<in>?FF\" by auto\n            }\n            moreover\n            {\n              assume \"B\\<in>?Uy\"\n              with \\<open>A\\<in>?Ux\\<close> have \"A\\<inter>B\\<in>?FF\" by auto\n            }\n            moreover\n            {\n              assume \"B\\<in>{A\\<inter>B. \\<langle>A,B\\<rangle>\\<in>?Ux \\<times> ?Uy}\"\n              then obtain AA BB where \"B=AA\\<inter>BB\" \"AA\\<in>?Ux\" \"BB\\<in>?Uy\" by auto\n              with \\<open>x\\<in>\\<Union>T\\<close> \\<open>A\\<in>?Ux\\<close> have \"A\\<inter>B=(A\\<inter>AA)\\<inter>BB\" \"A\\<inter>AA\\<in>?Ux\" using neigh_filter(1) IsFilter_def by auto\n              with \\<open>BB\\<in>?Uy\\<close> have \"A\\<inter>B\\<in>{A\\<inter>B. \\<langle>A,B\\<rangle>\\<in>?Ux \\<times> ?Uy}\" by auto\n              then have \"A\\<inter>B\\<in>?FF\" by auto\n            }\n            ultimately have \"A\\<inter>B\\<in>?FF\" using \\<open>B\\<in>?FF\\<close> by auto\n          }\n          moreover\n          {\n            assume \"A\\<in>?Uy\" \n            {\n              assume \"B\\<in>?Uy\"\n              with \\<open>y\\<in>\\<Union>T\\<close> \\<open>A\\<in>?Uy\\<close> have \"A\\<inter>B\\<in>?Uy\" using neigh_filter(1) IsFilter_def by auto\n              then have \"A\\<inter>B\\<in>?FF\" by auto\n            }\n            moreover\n            {\n              assume \"B\\<in>?Ux\"\n              with \\<open>A\\<in>?Uy\\<close> have \"B\\<inter>A\\<in>?FF\" by auto\n              moreover have \"A\\<inter>B=B\\<inter>A\" by auto\n              ultimately have \"A\\<inter>B\\<in>?FF\" by auto\n            }\n            moreover\n            {\n              assume \"B\\<in>{A\\<inter>B. \\<langle>A,B\\<rangle>\\<in>?Ux \\<times> ?Uy}\"\n              then obtain AA BB where \"B=AA\\<inter>BB\" \"AA\\<in>?Ux\" \"BB\\<in>?Uy\" by auto\n              with \\<open>y\\<in>\\<Union>T\\<close> \\<open>A\\<in>?Uy\\<close> have \"A\\<inter>B=AA\\<inter>(A\\<inter>BB)\" \"A\\<inter>BB\\<in>?Uy\" using neigh_filter(1) IsFilter_def by auto\n              with \\<open>AA\\<in>?Ux\\<close> have \"A\\<inter>B\\<in>{A\\<inter>B. \\<langle>A,B\\<rangle>\\<in>?Ux \\<times> ?Uy}\" by auto\n              then have \"A\\<inter>B\\<in>?FF\" by auto\n            }\n            ultimately have \"A\\<inter>B\\<in>?FF\" using \\<open>B\\<in>?FF\\<close> by auto\n          }\n          moreover\n          {\n            assume \"A\\<in>{A\\<inter>B. \\<langle>A,B\\<rangle>\\<in>?Ux \\<times> ?Uy}\"\n            then obtain AA BB where \"A=AA\\<inter>BB\" \"AA\\<in>?Ux\" \"BB\\<in>?Uy\" by auto\n            {\n              assume \"B\\<in>?Uy\"\n              with \\<open>BB\\<in>?Uy\\<close> \\<open>y\\<in>\\<Union>T\\<close> have \"B\\<inter>BB\\<in>?Uy\" using neigh_filter(1) IsFilter_def by auto\n              moreover from \\<open>A=AA\\<inter>BB\\<close> have \"A\\<inter>B=AA\\<inter>(B\\<inter>BB)\" by auto\n              ultimately have \"A\\<inter>B\\<in>?FF\" using \\<open>AA\\<in>?Ux\\<close> \\<open>B\\<inter>BB\\<in>?Uy\\<close> by auto\n            }\n            moreover\n            {\n              assume \"B\\<in>?Ux\"\n              with \\<open>AA\\<in>?Ux\\<close> \\<open>x\\<in>\\<Union>T\\<close> have \"B\\<inter>AA\\<in>?Ux\" using neigh_filter(1) IsFilter_def by auto\n              moreover from \\<open>A=AA\\<inter>BB\\<close> have \"A\\<inter>B=(B\\<inter>AA)\\<inter>BB\" by auto\n              ultimately have \"A\\<inter>B\\<in>?FF\" using \\<open>B\\<inter>AA\\<in>?Ux\\<close> \\<open>BB\\<in>?Uy\\<close> by auto\n            }\n            moreover\n            {\n              assume \"B\\<in>{A\\<inter>B. \\<langle>A,B\\<rangle>\\<in>?Ux \\<times> ?Uy}\"\n              then obtain AA2 BB2 where \"B=AA2\\<inter>BB2\" \"AA2\\<in>?Ux\" \"BB2\\<in>?Uy\" by auto\n              from \\<open>B=AA2\\<inter>BB2\\<close> \\<open>A=AA\\<inter>BB\\<close> have \"A\\<inter>B=(AA\\<inter>AA2)\\<inter>(BB\\<inter>BB2)\" by auto\n              moreover\n              from \\<open>AA\\<in>?Ux\\<close>\\<open>AA2\\<in>?Ux\\<close>\\<open>x\\<in>\\<Union>T\\<close> have \"AA\\<inter>AA2\\<in>?Ux\" using neigh_filter(1) IsFilter_def by auto\n              moreover\n              from \\<open>BB\\<in>?Uy\\<close>\\<open>BB2\\<in>?Uy\\<close>\\<open>y\\<in>\\<Union>T\\<close> have \"BB\\<inter>BB2\\<in>?Uy\" using neigh_filter(1) IsFilter_def by auto\n              ultimately have \"A\\<inter>B\\<in>?FF\" by auto\n            }\n            ultimately have \"A\\<inter>B\\<in>?FF\" using \\<open>B\\<in>?FF\\<close> by auto\n          }\n          ultimately have \"A\\<inter>B\\<in>?FF\" using \\<open>A\\<in>?FF\\<close> by auto\n          then have \"\\<exists>D\\<in>?FF. D\\<subseteq>A\\<inter>B\" unfolding Bex_def by auto\n        }\n        then have \"\\<forall>A\\<in>?FF. \\<forall>B\\<in>?FF. \\<exists>D\\<in>?FF. D\\<subseteq>A\\<inter>B\" by force\n        moreover\n        have \"\\<Union>T\\<in>?Ux\" using \\<open>x\\<in>\\<Union>T\\<close> neigh_filter(1) IsFilter_def by auto\n        then have \"?FF\\<noteq>0\" by auto\n        moreover\n        {\n          assume \"0\\<in>?FF\"\n          moreover\n          have \"0\\<notin>?Ux\" using \\<open>x\\<in>\\<Union>T\\<close> neigh_filter(1) IsFilter_def by auto\n          moreover\n          have \"0\\<notin>?Uy\" using \\<open>y\\<in>\\<Union>T\\<close> neigh_filter(1) IsFilter_def by auto\n          ultimately have \"0\\<in>{A\\<inter>B. \\<langle>A,B\\<rangle>\\<in>?Ux \\<times> ?Uy}\" by auto\n          then obtain A B where \"0=A\\<inter>B\" \"A\\<in>?Ux\"\"B\\<in>?Uy\" by auto\n          then have \"x\\<in>int(A)\"\"y\\<in>int(B)\" by auto\n          moreover\n          with \\<open>0=A\\<inter>B\\<close> have \"int(A)\\<inter>int(B)=0\" using Top_2_L1 by auto\n          moreover\n          have \"int(A)\\<in>T\"\"int(B)\\<in>T\" using Top_2_L2 by auto\n          ultimately have \"False\" using \\<open>\\<forall>U\\<in>T. \\<forall>V\\<in>T. x\\<in>U\\<and>y\\<in>V \\<longrightarrow> U\\<inter>V\\<noteq>0\\<close> by auto\n        }\n        then have \"0\\<notin>?FF\" by auto\n        ultimately show ?thesis using SatisfiesFilterBase_def by auto\n      qed\n      moreover\n      have \"?FF\\<subseteq>Pow(\\<Union>T)\" by auto\n      ultimately have bas:\"?FF {is a base filter} {A\\<in>Pow(\\<Union>T). \\<exists>D\\<in>?FF. D\\<subseteq>A}\" \"\\<Union>{A\\<in>Pow(\\<Union>T). \\<exists>D\\<in>?FF. D\\<subseteq>A}=\\<Union>T\" \n        using base_unique_filter_set2[of \"?FF\"] by auto\n      then have fil:\"{A\\<in>Pow(\\<Union>T). \\<exists>D\\<in>?FF. D\\<subseteq>A} {is a filter on} \\<Union>T\" using basic_filter sat by auto\n      have \"\\<forall>U\\<in>Pow(\\<Union>T). x\\<in>int(U) \\<longrightarrow> (\\<exists>D\\<in>?FF. D\\<subseteq>U)\" by auto\n      then have \"{A\\<in>Pow(\\<Union>T). \\<exists>D\\<in>?FF. D\\<subseteq>A} \\<rightarrow>\\<^sub>F x\" using convergence_filter_base2[OF fil bas(1) _ \\<open>x\\<in>\\<Union>T\\<close>] by auto\n      moreover\n      then have \"\\<forall>U\\<in>Pow(\\<Union>T). y\\<in>int(U) \\<longrightarrow> (\\<exists>D\\<in>?FF. D\\<subseteq>U)\" by auto\n      then have \"{A\\<in>Pow(\\<Union>T). \\<exists>D\\<in>?FF. D\\<subseteq>A} \\<rightarrow>\\<^sub>F y\" using convergence_filter_base2[OF fil bas(1) _ \\<open>y\\<in>\\<Union>T\\<close>] by auto\n      ultimately have \"x=y\" using assms fil \\<open>x\\<in>\\<Union>T\\<close>\\<open>y\\<in>\\<Union>T\\<close> by blast\n      with \\<open>x\\<noteq>y\\<close> have \"False\" by auto\n    }\n    then have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. x\\<in>U \\<and> y\\<in>V \\<and> U\\<inter>V=0\" by blast\n  }\n  then show ?thesis using isT2_def by auto\nqed\n\nlemma (in topology0) unique_limit_net_imp_T2:\n  assumes \"\\<forall>x\\<in>\\<Union>T. \\<forall>y\\<in>\\<Union>T. \\<forall>N. ((N {is a net on}\\<Union>T) \\<and> (N \\<rightarrow>\\<^sub>N x) \\<and> (N \\<rightarrow>\\<^sub>N y)) \\<longrightarrow> x=y\"\n  shows \"T {is T\\<^sub>2}\"\nproof-\n  {\n    fix x y \\<FF>\n    assume \"x\\<in>\\<Union>T\" \"y\\<in>\\<Union>T\"\"\\<FF> {is a filter on}\\<Union>T\"\"\\<FF> \\<rightarrow>\\<^sub>F x\"\"\\<FF> \\<rightarrow>\\<^sub>F y\"\n    then have \"(Net(\\<FF>)) {is a net on} \\<Union>T\"\"(Net \\<FF>) \\<rightarrow>\\<^sub>N x\"\"(Net \\<FF>) \\<rightarrow>\\<^sub>N y\"\n      using filter_conver_net_of_filter_conver net_of_filter_is_net by auto\n    with  \\<open>x\\<in>\\<Union>T\\<close> \\<open>y\\<in>\\<Union>T\\<close> have \"x=y\" using assms by blast\n  }\n  then have \"\\<forall>x\\<in>\\<Union>T. \\<forall>y\\<in>\\<Union>T. \\<forall>\\<FF>. ((\\<FF> {is a filter on}\\<Union>T) \\<and> (\\<FF> \\<rightarrow>\\<^sub>F x) \\<and> (\\<FF> \\<rightarrow>\\<^sub>F y)) \\<longrightarrow> x=y\" by auto\n  then show ?thesis using unique_limit_filter_imp_T2 by auto\nqed\n\ntext\\<open>This results make easy to check if a space is $T_2$.\\<close>\n\ntext\\<open>The topology\nwhich comes from a filter as in @{thm \"top_of_filter\"} is not $T_2$ generally.\n  We will see in this file later on, that the exceptions are a consequence of the spectrum.\\<close>\n\ncorollary filter_T2_imp_card1:\n  assumes \"(\\<FF>\\<union>{0}) {is T\\<^sub>2}\" \"\\<FF> {is a filter on} \\<Union>\\<FF>\" \"x\\<in>\\<Union>\\<FF>\"\n  shows \"\\<Union>\\<FF>={x}\"\nproof-\n  {\n    fix y assume \"y\\<in>\\<Union>\\<FF>\"\n    then have \"\\<FF> \\<rightarrow>\\<^sub>F y {in} (\\<FF>\\<union>{0})\" using lim_filter_top_of_filter assms(2) by auto\n    moreover\n    have \"\\<FF> \\<rightarrow>\\<^sub>F x {in} (\\<FF>\\<union>{0})\" using lim_filter_top_of_filter assms(2,3) by auto\n    moreover\n    have \"\\<Union>\\<FF>=\\<Union>(\\<FF>\\<union>{0})\" by auto\n    ultimately\n    have \"y=x\" using topology0.T2_imp_unique_limit_filter[OF topology0_filter[OF assms(2)] assms(1)] assms(2)\n      by auto\n  }\n  then have \"\\<Union>\\<FF>\\<subseteq>{x}\" by auto\n  with assms(3) show ?thesis by auto\nqed\n\ntext\\<open>There are more separation axioms that just $T_0$, $T_1$ or $T_2$\\<close>\n\ndefinition\n  isT3 (\"_{is T\\<^sub>3}\" 90)\n  where \"T{is T\\<^sub>3} \\<equiv> (T{is T\\<^sub>1}) \\<and> (T{is regular})\"\n\ndefinition\n  IsNormal (\"_{is normal}\" 90)\n  where \"T{is normal} \\<equiv> \\<forall>A. A{is closed in}T \\<longrightarrow> (\\<forall>B. B{is closed in}T \\<and> A\\<inter>B=0 \\<longrightarrow>\n  (\\<exists>U\\<in>T. \\<exists>V\\<in>T. A\\<subseteq>U\\<and>B\\<subseteq>V\\<and>U\\<inter>V=0))\"\n\ndefinition\n  isT4 (\"_{is T\\<^sub>4}\" 90)\n  where \"T{is T\\<^sub>4} \\<equiv> (T{is T\\<^sub>1}) \\<and> (T{is normal})\"\n\nlemma (in topology0) T4_is_T3:\n  assumes \"T{is T\\<^sub>4}\" shows \"T{is T\\<^sub>3}\"\nproof-\n  from assms have nor:\"T{is normal}\" using isT4_def by auto\n  from assms have \"T{is T\\<^sub>1}\" using isT4_def by auto\n  then have \"Cofinite (\\<Union>T)\\<subseteq>T\" using T1_cocardinal_coarser by auto\n  {\n    fix A\n    assume AS:\"A{is closed in}T\"\n    {\n      fix x\n      assume \"x\\<in>\\<Union>T-A\"\n      have \"Finite({x})\" by auto\n      then obtain n where \"{x}\\<approx>n\" \"n\\<in>nat\" unfolding Finite_def by auto\n      then have \"{x}\\<lesssim>n\" \"n\\<in>nat\" using eqpoll_imp_lepoll by auto\n      then have \"{x}\\<prec>nat\" using n_lesspoll_nat lesspoll_trans1 by auto\n      with \\<open>x\\<in>\\<Union>T-A\\<close> have \"{x} {is closed in} (Cofinite (\\<Union>T))\" using Cofinite_def \n        closed_sets_cocardinal by auto\n      then have \"\\<Union>T-{x}\\<in>Cofinite(\\<Union>T)\" unfolding IsClosed_def using union_cocardinal Cofinite_def\n        by auto\n      with \\<open>Cofinite (\\<Union>T)\\<subseteq>T\\<close> have \"\\<Union>T-{x}\\<in>T\" by auto\n      with \\<open>x\\<in>\\<Union>T-A\\<close> have \"{x}{is closed in}T\" \"A\\<inter>{x}=0\" using IsClosed_def by auto\n      with nor AS have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. A\\<subseteq>U\\<and>{x}\\<subseteq>V\\<and>U\\<inter>V=0\" unfolding IsNormal_def by blast\n      then have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. A\\<subseteq>U\\<and> x\\<in>V\\<and>U\\<inter>V=0\" by auto\n    }\n    then have \"\\<forall>x\\<in>\\<Union>T-A. \\<exists>U\\<in>T. \\<exists>V\\<in>T. A\\<subseteq>U\\<and> x\\<in>V\\<and>U\\<inter>V=0\" by auto\n  }\n  then have \"T{is regular}\" using IsRegular_def by blast\n  with \\<open>T{is T\\<^sub>1}\\<close> show ?thesis using isT3_def by auto\nqed\n\nlemma (in topology0) T3_is_T2:\n  assumes \"T{is T\\<^sub>3}\" shows \"T{is T\\<^sub>2}\"\nproof-\n  from assms have \"T{is regular}\" using isT3_def by auto\n  from assms have \"T{is T\\<^sub>1}\" using isT3_def by auto\n  then have \"Cofinite (\\<Union>T)\\<subseteq>T\" using T1_cocardinal_coarser by auto\n  {\n    fix x y\n    assume \"x\\<in>\\<Union>T\"\"y\\<in>\\<Union>T\"\"x\\<noteq>y\"\n    have \"Finite({x})\" by auto\n    then obtain n where \"{x}\\<approx>n\" \"n\\<in>nat\" unfolding Finite_def by auto\n    then have \"{x}\\<lesssim>n\" \"n\\<in>nat\" using eqpoll_imp_lepoll by auto\n    then have \"{x}\\<prec>nat\" using n_lesspoll_nat lesspoll_trans1 by auto\n    with \\<open>x\\<in>\\<Union>T\\<close> have \"{x} {is closed in} (Cofinite (\\<Union>T))\" using Cofinite_def \n      closed_sets_cocardinal by auto\n    then have \"\\<Union>T-{x}\\<in>Cofinite(\\<Union>T)\" unfolding IsClosed_def using union_cocardinal Cofinite_def\n       by auto\n    with \\<open>Cofinite (\\<Union>T)\\<subseteq>T\\<close> have \"\\<Union>T-{x}\\<in>T\" by auto\n    with \\<open>x\\<in>\\<Union>T\\<close>\\<open>y\\<in>\\<Union>T\\<close>\\<open>x\\<noteq>y\\<close> have \"{x}{is closed in}T\" \"y\\<in>\\<Union>T-{x}\" using IsClosed_def by auto\n    with \\<open>T{is regular}\\<close> have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. {x}\\<subseteq>U\\<and>y\\<in>V\\<and>U\\<inter>V=0\" unfolding IsRegular_def by force\n    then have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. x\\<in>U\\<and>y\\<in>V\\<and>U\\<inter>V=0\" by auto\n  }\n  then show ?thesis using isT2_def by auto\nqed\n\ntext\\<open>Regularity can be rewritten in terms of existence of certain neighboorhoods.\\<close>\n\nlemma (in topology0) regular_imp_exist_clos_neig:\n  assumes \"T{is regular}\" and \"U\\<in>T\" and \"x\\<in>U\"\n  shows \"\\<exists>V\\<in>T. x\\<in>V \\<and> cl(V)\\<subseteq>U\"\nproof-\n  from assms(2) have \"(\\<Union>T-U){is closed in}T\" using Top_3_L9 by auto moreover\n  from assms(2,3) have \"x\\<in>\\<Union>T\" by auto moreover\n  note assms(1,3) ultimately obtain A B where \"A\\<in>T\" and \"B\\<in>T\" and \"A\\<inter>B=0\" and \"(\\<Union>T-U)\\<subseteq>A\" and \"x\\<in>B\"\n    unfolding IsRegular_def by blast\n  from \\<open>A\\<inter>B=0\\<close> \\<open>B\\<in>T\\<close> have \"B\\<subseteq>\\<Union>T-A\" by auto\n  with \\<open>A\\<in>T\\<close> have \"cl(B)\\<subseteq>\\<Union>T-A\" using Top_3_L9 Top_3_L13 by auto\n  moreover from \\<open>(\\<Union>T-U)\\<subseteq>A\\<close> assms(3) have \"\\<Union>T-A\\<subseteq>U\" by auto\n  moreover note \\<open>x\\<in>B\\<close> \\<open>B\\<in>T\\<close>\n  ultimately have \"B\\<in>T \\<and> x\\<in>B \\<and> cl(B)\\<subseteq>U\" by auto\n  then show ?thesis by auto\nqed\n\nlemma (in topology0) exist_clos_neig_imp_regular:\n  assumes \"\\<forall>x\\<in>\\<Union>T. \\<forall>U\\<in>T. x\\<in>U \\<longrightarrow> (\\<exists>V\\<in>T. x\\<in>V\\<and> cl(V)\\<subseteq>U)\"\n  shows \"T{is regular}\"\nproof-\n  {\n    fix F\n    assume \"F{is closed in}T\" \n    {\n      fix x assume \"x\\<in>\\<Union>T-F\"\n      with \\<open>F{is closed in}T\\<close> have \"x\\<in>\\<Union>T\" \"\\<Union>T-F\\<in>T\" \"F\\<subseteq>\\<Union>T\" unfolding IsClosed_def by auto\n      with assms \\<open>x\\<in>\\<Union>T-F\\<close> have \"\\<exists>V\\<in>T. x\\<in>V \\<and> cl(V)\\<subseteq>\\<Union>T-F\" by auto\n      then obtain V where \"V\\<in>T\" \"x\\<in>V\" \"cl(V)\\<subseteq>\\<Union>T-F\" by auto\n      from \\<open>cl(V)\\<subseteq>\\<Union>T-F\\<close> \\<open>F\\<subseteq>\\<Union>T\\<close> have \"F\\<subseteq>\\<Union>T-cl(V)\" by auto\n      moreover from \\<open>V\\<in>T\\<close> have \"\\<Union>T-(\\<Union>T-V)=V\" by auto\n      then have \"cl(V)=\\<Union>T-int(\\<Union>T-V)\" using Top_3_L11(2)[of \"\\<Union>T-V\"] by auto\n      ultimately have \"F\\<subseteq>int(\\<Union>T-V)\" by auto moreover\n      have \"int(\\<Union>T-V)\\<subseteq>\\<Union>T-V\" using Top_2_L1 by auto\n      then have \"V\\<inter>(int(\\<Union>T-V))=0\" by auto moreover\n      note \\<open>x\\<in>V\\<close>\\<open>V\\<in>T\\<close> ultimately\n      have \"V\\<in>T\" \"int(\\<Union>T-V)\\<in>T\" \"F\\<subseteq>int(\\<Union>T-V) \\<and> x\\<in>V \\<and> (int(\\<Union>T-V))\\<inter>V=0\" using Top_2_L2\n        by auto\n      then have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. F\\<subseteq>U \\<and> x\\<in>V \\<and> U\\<inter>V=0\" by auto\n    }\n    then have \"\\<forall>x\\<in>\\<Union>T-F. \\<exists>U\\<in>T. \\<exists>V\\<in>T. F\\<subseteq>U \\<and> x\\<in>V \\<and> U\\<inter>V=0\" by auto\n  }\n  then show ?thesis using IsRegular_def by blast\nqed\n\nlemma (in topology0) regular_eq:\n  shows \"T{is regular} \\<longleftrightarrow> (\\<forall>x\\<in>\\<Union>T. \\<forall>U\\<in>T. x\\<in>U \\<longrightarrow> (\\<exists>V\\<in>T. x\\<in>V\\<and> cl(V)\\<subseteq>U))\"\n  using regular_imp_exist_clos_neig exist_clos_neig_imp_regular by force\n\ntext\\<open>A Hausdorff space separates compact spaces from points.\\<close>\n\ntheorem (in topology0) T2_compact_point:\n  assumes \"T{is T\\<^sub>2}\" \"A{is compact in}T\" \"x\\<in>\\<Union>T\" \"x\\<notin>A\"\n  shows \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. A\\<subseteq>U \\<and> x\\<in>V \\<and> U\\<inter>V=0\"\nproof-\n  {\n    assume \"A=0\"\n    then have \"A\\<subseteq>0\\<and>x\\<in>\\<Union>T\\<and>(0\\<inter>(\\<Union>T)=0)\" using assms(3) by auto \n    then have ?thesis using empty_open topSpaceAssum unfolding IsATopology_def by auto\n  }\n  moreover\n  {\n    assume noEmpty:\"A\\<noteq>0\"\n    let ?U=\"{\\<langle>U,V\\<rangle>\\<in>T\\<times>T. x\\<in>U\\<and>U\\<inter>V=0}\"\n    {\n      fix y assume \"y\\<in>A\"\n      with \\<open>x\\<notin>A\\<close> assms(4) have \"x\\<noteq>y\" by auto\n      moreover from \\<open>y\\<in>A\\<close> have \"x\\<in>\\<Union>T\"\"y\\<in>\\<Union>T\" using assms(2,3) unfolding IsCompact_def by auto\n      ultimately obtain U V where \"U\\<in>T\"\"V\\<in>T\"\"U\\<inter>V=0\"\"x\\<in>U\"\"y\\<in>V\" using assms(1) unfolding isT2_def by blast\n      then have \"\\<exists>\\<langle>U,V\\<rangle>\\<in>?U. y\\<in>V\" by auto\n    }\n    then have \"\\<forall>y\\<in>A. \\<exists>\\<langle>U,V\\<rangle>\\<in>?U. y\\<in>V\" by auto\n    then have \"A\\<subseteq>\\<Union>{snd(B). B\\<in>?U}\" by auto\n    moreover have \"{snd(B). B\\<in>?U}\\<in>Pow(T)\" by auto\n    ultimately have \"\\<exists>N\\<in>FinPow({snd(B). B\\<in>?U}). A\\<subseteq>\\<Union>N\" using assms(2) unfolding IsCompact_def by auto\n    then obtain N where ss:\"N\\<in>FinPow({snd(B). B\\<in>?U})\" \"A\\<subseteq>\\<Union>N\" by auto\n    with \\<open>{snd(B). B\\<in>?U}\\<in>Pow(T)\\<close> have \"A\\<subseteq>\\<Union>N\" \"N\\<in>Pow(T)\" unfolding FinPow_def by auto\n    then have NN:\"A\\<subseteq>\\<Union>N\" \"\\<Union>N\\<in>T\" using topSpaceAssum unfolding IsATopology_def by auto\n    from ss have \"Finite(N)\"\"N\\<subseteq>{snd(B). B\\<in>?U}\" unfolding FinPow_def by auto\n    then obtain n where \"n\\<in>nat\" \"N\\<approx>n\" unfolding Finite_def by auto\n    then have \"N\\<lesssim>n\" using eqpoll_imp_lepoll by auto\n    from noEmpty \\<open>A\\<subseteq>\\<Union>N\\<close> have NnoEmpty:\"N\\<noteq>0\" by auto\n    let ?QQ=\"{\\<langle>n,{fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}\\<rangle>. n\\<in>N}\"\n    have QQPi:\"?QQ:N\\<rightarrow>{{fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}. n\\<in>N}\" unfolding Pi_def function_def domain_def by auto\n    {\n      fix n assume \"n\\<in>N\"\n      with \\<open>N\\<subseteq>{snd(B). B\\<in>?U}\\<close> obtain B where \"n=snd(B)\" \"B\\<in>?U\" by auto\n      then have \"fst(B)\\<in>{fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}\" by auto\n      then have \"{fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}\\<noteq>0\" by auto moreover\n      from \\<open>n\\<in>N\\<close> have \"\\<langle>n,{fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}\\<rangle>\\<in>?QQ\" by auto\n      with QQPi have \"?QQ`n={fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}\" using apply_equality by auto\n      ultimately have \"?QQ`n\\<noteq>0\" by auto\n    }\n    then have \"\\<forall>n\\<in>N. ?QQ`n\\<noteq>0\" by auto\n    with \\<open>n\\<in>nat\\<close> \\<open>N\\<lesssim>n\\<close> have \"\\<exists>f. f\\<in>Pi(N,\\<lambda>t. ?QQ`t) \\<and> (\\<forall>t\\<in>N. f`t\\<in>?QQ`t)\" using finite_choice unfolding AxiomCardinalChoiceGen_def\n      by auto\n    then obtain f where fPI:\"f\\<in>Pi(N,\\<lambda>t. ?QQ`t)\" \"(\\<forall>t\\<in>N. f`t\\<in>?QQ`t)\" by auto\n    from fPI(1) NnoEmpty have \"range(f)\\<noteq>0\" unfolding Pi_def range_def domain_def converse_def by (safe,blast)\n    {\n      fix t assume \"t\\<in>N\"\n      then have \"f`t\\<in>?QQ`t\" using fPI(2) by auto\n      with \\<open>t\\<in>N\\<close> have \"f`t\\<in>\\<Union>(?QQ``N)\" \"?QQ`t\\<subseteq>\\<Union>(?QQ``N)\" using func_imagedef QQPi by auto\n    }\n    then have reg:\"\\<forall>t\\<in>N. f`t\\<in>\\<Union>(?QQ``N)\"  \"\\<forall>t\\<in>N. ?QQ`t\\<subseteq>\\<Union>(?QQ``N)\" by auto\n    {\n      fix tt assume \"tt\\<in>f\"\n      with fPI(1) have \"tt\\<in>Sigma(N, (`)(?QQ))\" unfolding Pi_def by auto\n      then have \"tt\\<in>(\\<Union>xa\\<in>N. \\<Union>y\\<in>?QQ`xa. {\\<langle>xa,y\\<rangle>})\" unfolding Sigma_def by auto\n      then obtain xa y where \"xa\\<in>N\" \"y\\<in>?QQ`xa\" \"tt=\\<langle>xa,y\\<rangle>\" by auto\n      with reg(2) have \"y\\<in>\\<Union>(?QQ``N)\" by blast\n      with \\<open>tt=\\<langle>xa,y\\<rangle>\\<close> \\<open>xa\\<in>N\\<close> have \"tt\\<in>(\\<Union>xa\\<in>N. \\<Union>y\\<in>\\<Union>(?QQ``N). {\\<langle>xa,y\\<rangle>})\" by auto\n      then have \"tt\\<in>N\\<times>(\\<Union>(?QQ``N))\" unfolding Sigma_def by auto\n    }\n    then have ffun:\"f:N\\<rightarrow>\\<Union>(?QQ``N)\"  using fPI(1) unfolding Pi_def by auto\n    then have \"f\\<in>surj(N,range(f))\" using fun_is_surj by auto\n    with \\<open>N\\<lesssim>n\\<close> \\<open>n\\<in>nat\\<close> have \"range(f)\\<lesssim>N\" using surj_fun_inv_2 nat_into_Ord by auto\n    with \\<open>N\\<lesssim>n\\<close> have \"range(f)\\<lesssim>n\" using lepoll_trans by blast\n    with \\<open>n\\<in>nat\\<close> have \"Finite(range(f))\" using n_lesspoll_nat lesspoll_nat_is_Finite lesspoll_trans1 by auto\n    moreover from ffun have rr:\"range(f)\\<subseteq>\\<Union>(?QQ``N)\" unfolding Pi_def by auto\n    then have \"range(f)\\<subseteq>T\" by auto\n    ultimately have \"range(f)\\<in>FinPow(T)\" unfolding FinPow_def by auto\n    then have \"\\<Inter>range(f)\\<in>T\" using fin_inter_open_open \\<open>range(f)\\<noteq>0\\<close> by auto moreover\n    {\n      fix S assume \"S\\<in>range(f)\"\n      with rr have \"S\\<in>\\<Union>(?QQ``N)\" by blast\n      then have \"\\<exists>B\\<in>(?QQ``N). S \\<in> B\" using Union_iff by auto\n      then obtain B where \"B\\<in>(?QQ``N)\" \"S\\<in>B\" by auto\n      then have \"\\<exists>rr\\<in>N. \\<langle>rr,B\\<rangle>\\<in>?QQ\" unfolding image_def by auto\n      then have \"\\<exists>rr\\<in>N. B={fst(B). B\\<in>{A\\<in>?U. snd(A)=rr}}\" by auto\n      with \\<open>S\\<in>B\\<close> obtain rr where \"\\<langle>S,rr\\<rangle>\\<in>?U\" by auto\n      then have \"x\\<in>S\" by auto\n    }\n    then have \"x\\<in>\\<Inter>range(f)\" using \\<open>range(f)\\<noteq>0\\<close> by auto moreover\n    {\n      fix y assume \"y\\<in>(\\<Union>N)\\<inter>(\\<Inter>range(f))\"\n      then have reg:\"(\\<forall>S\\<in>range(f). y\\<in>S)\\<and>(\\<exists>t\\<in>N. y\\<in>t)\" by auto\n      then obtain t where \"t\\<in>N\" \"y\\<in>t\" by auto\n      then have \"\\<langle>t, {fst(B). B\\<in>{A\\<in>?U. snd(A)=t}}\\<rangle>\\<in>?QQ\" by auto\n      then have \"f`t\\<in>range(f)\" using apply_rangeI ffun by auto\n      with reg have yft:\"y\\<in>f`t\" by auto\n      with \\<open>t\\<in>N\\<close> fPI(2) have \"f`t\\<in>?QQ`t\" by auto\n      with \\<open>t\\<in>N\\<close> have \"f`t\\<in>{fst(B). B\\<in>{A\\<in>?U. snd(A)=t}}\" using apply_equality QQPi by auto\n      then have \"\\<langle>f`t,t\\<rangle>\\<in>?U\" by auto\n      then have \"f`t\\<inter>t=0\" by auto\n      with \\<open>y\\<in>t\\<close> yft have \"False\" by auto\n    }\n    then have \"(\\<Union>N)\\<inter>(\\<Inter>range(f))=0\" by blast moreover\n    note NN\n    ultimately have ?thesis by auto\n  }\n  ultimately show ?thesis by auto\nqed\n\ntext\\<open>A Hausdorff space separates compact spaces from other compact spaces.\\<close>\n\ntheorem (in topology0) T2_compact_compact:\n  assumes \"T{is T\\<^sub>2}\" \"A{is compact in}T\" \"B{is compact in}T\" \"A\\<inter>B=0\"\n  shows \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. A\\<subseteq>U \\<and> B\\<subseteq>V \\<and> U\\<inter>V=0\"\nproof-\n {\n    assume \"B=0\"\n    then have \"A\\<subseteq>\\<Union>T\\<and>B\\<subseteq>0\\<and>((\\<Union>T)\\<inter>0=0)\" using assms(2) unfolding IsCompact_def by auto moreover\n    have \"0\\<in>T\" using empty_open topSpaceAssum by auto moreover\n    have \"\\<Union>T\\<in>T\" using topSpaceAssum unfolding IsATopology_def by auto ultimately\n    have ?thesis by auto\n  }\n  moreover\n  {\n    assume noEmpty:\"B\\<noteq>0\"\n    let ?U=\"{\\<langle>U,V\\<rangle>\\<in>T\\<times>T. A\\<subseteq>U \\<and> U\\<inter>V=0}\"\n    {\n      fix y assume \"y\\<in>B\"\n      then have \"y\\<in>\\<Union>T\" using assms(3) unfolding IsCompact_def by auto\n      with \\<open>y\\<in>B\\<close> have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. A\\<subseteq>U \\<and> y\\<in>V \\<and> U\\<inter>V=0\" using T2_compact_point assms(1,2,4) by auto\n      then have \"\\<exists>\\<langle>U,V\\<rangle>\\<in>?U. y\\<in>V\" by auto\n    }\n    then have \"\\<forall>y\\<in>B. \\<exists>\\<langle>U,V\\<rangle>\\<in>?U. y\\<in>V\" by auto\n    then have \"B\\<subseteq>\\<Union>{snd(B). B\\<in>?U}\" by auto\n    moreover have \"{snd(B). B\\<in>?U}\\<in>Pow(T)\" by auto\n    ultimately have \"\\<exists>N\\<in>FinPow({snd(B). B\\<in>?U}). B\\<subseteq>\\<Union>N\" using assms(3) unfolding IsCompact_def by auto\n    then obtain N where ss:\"N\\<in>FinPow({snd(B). B\\<in>?U})\" \"B\\<subseteq>\\<Union>N\" by auto\n    with \\<open>{snd(B). B\\<in>?U}\\<in>Pow(T)\\<close> have \"B\\<subseteq>\\<Union>N\" \"N\\<in>Pow(T)\" unfolding FinPow_def by auto\n    then have NN:\"B\\<subseteq>\\<Union>N\" \"\\<Union>N\\<in>T\" using topSpaceAssum unfolding IsATopology_def by auto\n    from ss have \"Finite(N)\"\"N\\<subseteq>{snd(B). B\\<in>?U}\" unfolding FinPow_def by auto\n    then obtain n where \"n\\<in>nat\" \"N\\<approx>n\" unfolding Finite_def by auto\n    then have \"N\\<lesssim>n\" using eqpoll_imp_lepoll by auto\n    from noEmpty \\<open>B\\<subseteq>\\<Union>N\\<close> have NnoEmpty:\"N\\<noteq>0\" by auto\n    let ?QQ=\"{\\<langle>n,{fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}\\<rangle>. n\\<in>N}\"\n    have QQPi:\"?QQ:N\\<rightarrow>{{fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}. n\\<in>N}\" unfolding Pi_def function_def domain_def by auto\n    {\n      fix n assume \"n\\<in>N\"\n      with \\<open>N\\<subseteq>{snd(B). B\\<in>?U}\\<close> obtain B where \"n=snd(B)\" \"B\\<in>?U\" by auto\n      then have \"fst(B)\\<in>{fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}\" by auto\n      then have \"{fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}\\<noteq>0\" by auto moreover\n      from \\<open>n\\<in>N\\<close> have \"\\<langle>n,{fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}\\<rangle>\\<in>?QQ\" by auto\n      with QQPi have \"?QQ`n={fst(B). B\\<in>{A\\<in>?U. snd(A)=n}}\" using apply_equality by auto\n      ultimately have \"?QQ`n\\<noteq>0\" by auto\n    }\n    then have \"\\<forall>n\\<in>N. ?QQ`n\\<noteq>0\" by auto\n    with \\<open>n\\<in>nat\\<close> \\<open>N\\<lesssim>n\\<close> have \"\\<exists>f. f\\<in>Pi(N,\\<lambda>t. ?QQ`t) \\<and> (\\<forall>t\\<in>N. f`t\\<in>?QQ`t)\" using finite_choice unfolding AxiomCardinalChoiceGen_def\n      by auto\n    then obtain f where fPI:\"f\\<in>Pi(N,\\<lambda>t. ?QQ`t)\" \"(\\<forall>t\\<in>N. f`t\\<in>?QQ`t)\" by auto\n    from fPI(1) NnoEmpty have \"range(f)\\<noteq>0\" unfolding Pi_def range_def domain_def converse_def by (safe,blast)\n    {\n      fix t assume \"t\\<in>N\"\n      then have \"f`t\\<in>?QQ`t\" using fPI(2) by auto\n      with \\<open>t\\<in>N\\<close> have \"f`t\\<in>\\<Union>(?QQ``N)\" \"?QQ`t\\<subseteq>\\<Union>(?QQ``N)\" using func_imagedef QQPi by auto\n    }\n    then have reg:\"\\<forall>t\\<in>N. f`t\\<in>\\<Union>(?QQ``N)\"  \"\\<forall>t\\<in>N. ?QQ`t\\<subseteq>\\<Union>(?QQ``N)\" by auto\n    {\n      fix tt assume \"tt\\<in>f\"\n      with fPI(1) have \"tt\\<in>Sigma(N, (`)(?QQ))\" unfolding Pi_def by auto\n      then have \"tt\\<in>(\\<Union>xa\\<in>N. \\<Union>y\\<in>?QQ`xa. {\\<langle>xa,y\\<rangle>})\" unfolding Sigma_def by auto\n      then obtain xa y where \"xa\\<in>N\" \"y\\<in>?QQ`xa\" \"tt=\\<langle>xa,y\\<rangle>\" by auto\n      with reg(2) have \"y\\<in>\\<Union>(?QQ``N)\" by blast\n      with \\<open>tt=\\<langle>xa,y\\<rangle>\\<close> \\<open>xa\\<in>N\\<close> have \"tt\\<in>(\\<Union>xa\\<in>N. \\<Union>y\\<in>\\<Union>(?QQ``N). {\\<langle>xa,y\\<rangle>})\" by auto\n      then have \"tt\\<in>N\\<times>(\\<Union>(?QQ``N))\" unfolding Sigma_def by auto\n    }\n    then have ffun:\"f:N\\<rightarrow>\\<Union>(?QQ``N)\"  using fPI(1) unfolding Pi_def by auto\n    then have \"f\\<in>surj(N,range(f))\" using fun_is_surj by auto\n    with \\<open>N\\<lesssim>n\\<close> \\<open>n\\<in>nat\\<close> have \"range(f)\\<lesssim>N\" using surj_fun_inv_2 nat_into_Ord by auto\n    with \\<open>N\\<lesssim>n\\<close> have \"range(f)\\<lesssim>n\" using lepoll_trans by blast\n    with \\<open>n\\<in>nat\\<close> have \"Finite(range(f))\" using n_lesspoll_nat lesspoll_nat_is_Finite lesspoll_trans1 by auto\n    moreover from ffun have rr:\"range(f)\\<subseteq>\\<Union>(?QQ``N)\" unfolding Pi_def by auto\n    then have \"range(f)\\<subseteq>T\" by auto\n    ultimately have \"range(f)\\<in>FinPow(T)\" unfolding FinPow_def by auto\n    then have \"\\<Inter>range(f)\\<in>T\" using fin_inter_open_open \\<open>range(f)\\<noteq>0\\<close> by auto moreover\n    {\n      fix S assume \"S\\<in>range(f)\"\n      with rr have \"S\\<in>\\<Union>(?QQ``N)\" by blast\n      then have \"\\<exists>B\\<in>(?QQ``N). S \\<in> B\" using Union_iff by auto\n      then obtain B where \"B\\<in>(?QQ``N)\" \"S\\<in>B\" by auto\n      then have \"\\<exists>rr\\<in>N. \\<langle>rr,B\\<rangle>\\<in>?QQ\" unfolding image_def by auto\n      then have \"\\<exists>rr\\<in>N. B={fst(B). B\\<in>{A\\<in>?U. snd(A)=rr}}\" by auto\n      with \\<open>S\\<in>B\\<close> obtain rr where \"\\<langle>S,rr\\<rangle>\\<in>?U\" by auto\n      then have \"A\\<subseteq>S\" by auto\n    }\n    then have \"A\\<subseteq>\\<Inter>range(f)\" using \\<open>range(f)\\<noteq>0\\<close> by auto moreover\n    {\n      fix y assume \"y\\<in>(\\<Union>N)\\<inter>(\\<Inter>range(f))\"\n      then have reg:\"(\\<forall>S\\<in>range(f). y\\<in>S)\\<and>(\\<exists>t\\<in>N. y\\<in>t)\" by auto\n      then obtain t where \"t\\<in>N\" \"y\\<in>t\" by auto\n      then have \"\\<langle>t, {fst(B). B\\<in>{A\\<in>?U. snd(A)=t}}\\<rangle>\\<in>?QQ\" by auto\n      then have \"f`t\\<in>range(f)\" using apply_rangeI ffun by auto\n      with reg have yft:\"y\\<in>f`t\" by auto\n      with \\<open>t\\<in>N\\<close> fPI(2) have \"f`t\\<in>?QQ`t\" by auto\n      with \\<open>t\\<in>N\\<close> have \"f`t\\<in>{fst(B). B\\<in>{A\\<in>?U. snd(A)=t}}\" using apply_equality QQPi by auto\n      then have \"\\<langle>f`t,t\\<rangle>\\<in>?U\" by auto\n      then have \"f`t\\<inter>t=0\" by auto\n      with \\<open>y\\<in>t\\<close> yft have \"False\" by auto\n    }\n    then have \"(\\<Inter>range(f))\\<inter>(\\<Union>N)=0\" by blast moreover\n    note NN\n    ultimately have ?thesis by auto\n  }\n  ultimately show ?thesis by auto\nqed\n\ntext\\<open>A compact Hausdorff space is normal.\\<close>\n\ncorollary (in topology0) T2_compact_is_normal:\n  assumes \"T{is T\\<^sub>2}\" \"(\\<Union>T){is compact in}T\"\n  shows \"T{is normal}\" unfolding IsNormal_def\nproof-\n  from assms(2) have car_nat:\"(\\<Union>T){is compact of cardinal}nat{in}T\" using Compact_is_card_nat by auto\n  {\n    fix A B assume \"A{is closed in}T\" \"B{is closed in}T\"\"A\\<inter>B=0\"\n    then have com:\"((\\<Union>T)\\<inter>A){is compact of cardinal}nat{in}T\" \"((\\<Union>T)\\<inter>B){is compact of cardinal}nat{in}T\" using compact_closed[OF car_nat] \n      by auto\n    from \\<open>A{is closed in}T\\<close>\\<open>B{is closed in}T\\<close> have \"(\\<Union>T)\\<inter>A=A\"\"(\\<Union>T)\\<inter>B=B\" unfolding IsClosed_def by auto\n    with com have \"A{is compact of cardinal}nat{in}T\" \"B{is compact of cardinal}nat{in}T\" by auto\n    then have \"A{is compact in}T\"\"B{is compact in}T\" using Compact_is_card_nat by auto\n    with \\<open>A\\<inter>B=0\\<close> have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. A\\<subseteq>U \\<and> B\\<subseteq>V \\<and> U\\<inter>V=0\" using T2_compact_compact assms(1) by auto\n  }\n  then show \" \\<forall>A. A {is closed in} T \\<longrightarrow> (\\<forall>B. B {is closed in} T \\<and> A \\<inter> B = 0 \\<longrightarrow> (\\<exists>U\\<in>T. \\<exists>V\\<in>T. A \\<subseteq> U \\<and> B \\<subseteq> V \\<and> U \\<inter> V = 0))\"\n    by auto\nqed\n\nsubsection\\<open>Hereditability\\<close>\n\ntext\\<open>A topological property is hereditary if whenever a space has it, \nevery subspace also has it.\\<close>\n\ndefinition IsHer (\"_{is hereditary}\" 90)\n  where \"P {is hereditary} \\<equiv> \\<forall>T. T{is a topology} \\<and> P(T) \\<longrightarrow> (\\<forall>A\\<in>Pow(\\<Union>T). P(T{restricted to}A))\"\n\nlemma subspace_of_subspace:\n  assumes \"A\\<subseteq>B\"\"B\\<subseteq>\\<Union>T\"\n  shows \"T{restricted to}A=(T{restricted to}B){restricted to}A\"\nproof\n  from assms have S:\"\\<forall>S\\<in>T. A\\<inter>(B\\<inter>S)=A\\<inter>S\" by auto\n  then show \"T {restricted to} A \\<subseteq> T {restricted to} B {restricted to} A\" unfolding RestrictedTo_def\n    by auto\n  from S show \"T {restricted to} B {restricted to} A \\<subseteq> T {restricted to} A\" unfolding RestrictedTo_def\n    by auto\nqed\n \ntext\\<open>The separation properties $T_0$, $T_1$, $T_2$ y $T_3$ are hereditary.\\<close>\n\ntheorem regular_here:\n  assumes \"T{is regular}\" \"A\\<in>Pow(\\<Union>T)\" shows \"(T{restricted to}A){is regular}\"\nproof-\n  {\n    fix C\n    assume A:\"C{is closed in}(T{restricted to}A)\"\n    {fix y assume \"y\\<in>\\<Union>(T{restricted to}A)\"\"y\\<notin>C\"\n    with A have \"(\\<Union>(T{restricted to}A))-C\\<in>(T{restricted to}A)\"\"C\\<subseteq>\\<Union>(T{restricted to}A)\" \"y\\<in>\\<Union>(T{restricted to}A)\"\"y\\<notin>C\" unfolding IsClosed_def\n      by auto\n    moreover\n    with assms(2) have \"\\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def by auto\n    ultimately have \"A-C\\<in>T{restricted to}A\" \"y\\<in>A\"\"y\\<notin>C\"\"C\\<in>Pow(A)\" by auto\n    then obtain S where \"S\\<in>T\" \"A\\<inter>S=A-C\" \"y\\<in>A\"\"y\\<notin>C\" unfolding RestrictedTo_def by auto\n    then have \"y\\<in>A-C\"\"A\\<inter>S=A-C\" by auto\n    with \\<open>C\\<in>Pow(A)\\<close> have \"y\\<in>A\\<inter>S\"\"C=A-A\\<inter>S\" by auto\n    then have \"y\\<in>S\" \"C=A-S\" by auto\n    with assms(2) have \"y\\<in>S\" \"C\\<subseteq>\\<Union>T-S\" by auto\n    moreover\n    from \\<open>S\\<in>T\\<close> have \"\\<Union>T-(\\<Union>T-S)=S\" by auto\n    moreover\n    with \\<open>S\\<in>T\\<close> have \"(\\<Union>T-S) {is closed in}T\" using IsClosed_def by auto\n    ultimately have \"y\\<in>\\<Union>T-(\\<Union>T-S)\" \"(\\<Union>T-S) {is closed in}T\" by auto\n    with assms(1) have \"\\<forall>y\\<in>\\<Union>T-(\\<Union>T-S). \\<exists>U\\<in>T. \\<exists>V\\<in>T. (\\<Union>T-S)\\<subseteq>U\\<and>y\\<in>V\\<and>U\\<inter>V=0\" unfolding IsRegular_def by auto\n    with \\<open>y\\<in>\\<Union>T-(\\<Union>T-S)\\<close> have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. (\\<Union>T-S)\\<subseteq>U\\<and>y\\<in>V\\<and>U\\<inter>V=0\" by auto\n    then obtain U V where \"U\\<in>T\"\"V\\<in>T\" \"\\<Union>T-S\\<subseteq>U\"\"y\\<in>V\"\"U\\<inter>V=0\" by auto\n    then have \"A\\<inter>U\\<in>(T{restricted to}A)\"\"A\\<inter>V\\<in>(T{restricted to}A)\" \"C\\<subseteq>U\"\"y\\<in>V\"\"(A\\<inter>U)\\<inter>(A\\<inter>V)=0\"\n      unfolding RestrictedTo_def  using \\<open>C\\<subseteq>\\<Union>T-S\\<close> by auto\n    moreover\n    with \\<open>C\\<in>Pow(A)\\<close>\\<open>y\\<in>A\\<close> have \"C\\<subseteq>A\\<inter>U\"\"y\\<in>A\\<inter>V\" by auto\n    ultimately have \"\\<exists>U\\<in>(T{restricted to}A). \\<exists>V\\<in>(T{restricted to}A). C\\<subseteq>U\\<and>y\\<in>V\\<and>U\\<inter>V=0\" by auto\n  }\n    then have \"\\<forall>x\\<in>\\<Union>(T{restricted to}A)-C. \\<exists>U\\<in>(T{restricted to}A). \\<exists>V\\<in>(T{restricted to}A). C\\<subseteq>U\\<and>x\\<in>V\\<and>U\\<inter>V=0\" by auto\n  }\n  then have \"\\<forall>C. C{is closed in}(T{restricted to}A) \\<longrightarrow> (\\<forall>x\\<in>\\<Union>(T{restricted to}A)-C. \\<exists>U\\<in>(T{restricted to}A). \\<exists>V\\<in>(T{restricted to}A). C\\<subseteq>U\\<and>x\\<in>V\\<and>U\\<inter>V=0)\"\n   by blast\n  then show ?thesis using IsRegular_def by auto\nqed\n\ncorollary here_regular:\n  shows \"IsRegular {is hereditary}\" using regular_here IsHer_def by auto\n\ntheorem T1_here:\n  assumes \"T{is T\\<^sub>1}\" \"A\\<in>Pow(\\<Union>T)\" shows \"(T{restricted to}A){is T\\<^sub>1}\"\nproof-\n  from assms(2) have un:\"\\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def by auto\n  {\n    fix x y\n    assume \"x\\<in>A\"\"y\\<in>A\"\"x\\<noteq>y\"\n    with \\<open>A\\<in>Pow(\\<Union>T)\\<close> have \"x\\<in>\\<Union>T\"\"y\\<in>\\<Union>T\"\"x\\<noteq>y\" by auto\n    then have \"\\<exists>U\\<in>T. x\\<in>U\\<and>y\\<notin>U\" using assms(1) isT1_def by auto\n    then obtain U where \"U\\<in>T\"\"x\\<in>U\"\"y\\<notin>U\" by auto\n    with \\<open>x\\<in>A\\<close> have \"A\\<inter>U\\<in>(T{restricted to}A)\" \"x\\<in>A\\<inter>U\" \"y\\<notin>A\\<inter>U\" unfolding RestrictedTo_def by auto\n    then have \"\\<exists>U\\<in>(T{restricted to}A). x\\<in>U\\<and>y\\<notin>U\" by blast\n  }\n  with un have \"\\<forall>x y. x\\<in>\\<Union>(T{restricted to}A) \\<and> y\\<in>\\<Union>(T{restricted to}A) \\<and> x\\<noteq>y \\<longrightarrow> (\\<exists>U\\<in>(T{restricted to}A). x\\<in>U\\<and>y\\<notin>U)\"\n    by auto\n  then show ?thesis using isT1_def by auto\nqed\n\ncorollary here_T1:\n  shows \"isT1 {is hereditary}\" using T1_here IsHer_def by auto\n\nlemma here_and:\n  assumes \"P {is hereditary}\" \"Q {is hereditary}\"\n  shows \"(\\<lambda>T. P(T) \\<and> Q(T)) {is hereditary}\" using assms unfolding IsHer_def by auto\n\ncorollary here_T3:\n  shows \"isT3 {is hereditary}\" using here_and[OF here_T1 here_regular] unfolding IsHer_def isT3_def.\n\nlemma T2_here:\n  assumes \"T{is T\\<^sub>2}\" \"A\\<in>Pow(\\<Union>T)\" shows \"(T{restricted to}A){is T\\<^sub>2}\"\nproof-\n  from assms(2) have un:\"\\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def by auto\n  {\n    fix x y\n    assume \"x\\<in>A\"\"y\\<in>A\"\"x\\<noteq>y\"\n    with \\<open>A\\<in>Pow(\\<Union>T)\\<close> have \"x\\<in>\\<Union>T\"\"y\\<in>\\<Union>T\"\"x\\<noteq>y\" by auto\n    then have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. x\\<in>U\\<and>y\\<in>V\\<and>U\\<inter>V=0\" using assms(1) isT2_def by auto\n    then obtain U V where \"U\\<in>T\" \"V\\<in>T\"\"x\\<in>U\"\"y\\<in>V\"\"U\\<inter>V=0\" by auto\n    with \\<open>x\\<in>A\\<close>\\<open>y\\<in>A\\<close> have \"A\\<inter>U\\<in>(T{restricted to}A)\"\"A\\<inter>V\\<in>(T{restricted to}A)\" \"x\\<in>A\\<inter>U\" \"y\\<in>A\\<inter>V\" \"(A\\<inter>U)\\<inter>(A\\<inter>V)=0\"unfolding RestrictedTo_def by auto\n    then have \"\\<exists>U\\<in>(T{restricted to}A). \\<exists>V\\<in>(T{restricted to}A). x\\<in>U\\<and>y\\<in>V\\<and>U\\<inter>V=0\" unfolding Bex_def by auto\n  }\n  with un have \"\\<forall>x y. x\\<in>\\<Union>(T{restricted to}A) \\<and> y\\<in>\\<Union>(T{restricted to}A) \\<and> x\\<noteq>y \\<longrightarrow> (\\<exists>U\\<in>(T{restricted to}A). \\<exists>V\\<in>(T{restricted to}A). x\\<in>U\\<and>y\\<in>V\\<and>U\\<inter>V=0)\"\n    by auto\n  then show ?thesis using isT2_def by auto\nqed\n\ncorollary here_T2:\n  shows \"isT2 {is hereditary}\" using T2_here IsHer_def by auto\n\nlemma T0_here:\n  assumes \"T{is T\\<^sub>0}\" \"A\\<in>Pow(\\<Union>T)\" shows \"(T{restricted to}A){is T\\<^sub>0}\"\nproof-\n  from assms(2) have un:\"\\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def by auto\n  {\n    fix x y\n    assume \"x\\<in>A\"\"y\\<in>A\"\"x\\<noteq>y\"\n    with \\<open>A\\<in>Pow(\\<Union>T)\\<close> have \"x\\<in>\\<Union>T\"\"y\\<in>\\<Union>T\"\"x\\<noteq>y\" by auto\n    then have \"\\<exists>U\\<in>T. (x\\<in>U\\<and>y\\<notin>U)\\<or>(y\\<in>U\\<and>x\\<notin>U)\" using assms(1) isT0_def by auto\n    then obtain U where \"U\\<in>T\" \"(x\\<in>U\\<and>y\\<notin>U)\\<or>(y\\<in>U\\<and>x\\<notin>U)\" by auto\n    with \\<open>x\\<in>A\\<close>\\<open>y\\<in>A\\<close> have \"A\\<inter>U\\<in>(T{restricted to}A)\" \"(x\\<in>A\\<inter>U\\<and>y\\<notin>A\\<inter>U)\\<or>(y\\<in>A\\<inter>U\\<and>x\\<notin>A\\<inter>U)\" unfolding RestrictedTo_def by auto\n    then have \"\\<exists>U\\<in>(T{restricted to}A). (x\\<in>U\\<and>y\\<notin>U)\\<or>(y\\<in>U\\<and>x\\<notin>U)\" unfolding Bex_def by auto\n  }\n  with un have \"\\<forall>x y. x\\<in>\\<Union>(T{restricted to}A) \\<and> y\\<in>\\<Union>(T{restricted to}A) \\<and> x\\<noteq>y \\<longrightarrow> (\\<exists>U\\<in>(T{restricted to}A). (x\\<in>U\\<and>y\\<notin>U)\\<or>(y\\<in>U\\<and>x\\<notin>U))\"\n    by auto\n  then show ?thesis using isT0_def by auto\nqed\n\ncorollary here_T0:\n  shows \"isT0 {is hereditary}\" using T0_here IsHer_def by auto\n\nsubsection\\<open>Spectrum and anti-properties\\<close>\n\ntext\\<open>The spectrum of a topological property is a class of\nsets such that all topologies defined over that set have that property.\\<close>\n\ntext\\<open>The spectrum of a property gives us the list of sets for which the property doesn't give\nany topological information. Being in the spectrum of a topological property is an invariant\nin the category of sets and function; mening that equipollent sets are in the same\nspectra.\\<close>\n      \ndefinition Spec (\"_ {is in the spectrum of} _\" 99)\n  where \"Spec(K,P) \\<equiv> \\<forall>T. ((T{is a topology} \\<and> \\<Union>T\\<approx>K) \\<longrightarrow> P(T))\"\n\nlemma equipollent_spect:\n  assumes \"A\\<approx>B\" \"B {is in the spectrum of} P\"\n  shows  \"A {is in the spectrum of} P\"\nproof-\n  from assms(2) have \"\\<forall>T. ((T{is a topology} \\<and> \\<Union>T\\<approx>B) \\<longrightarrow> P(T))\" using Spec_def by auto\n  then have \"\\<forall>T. ((T{is a topology} \\<and> \\<Union>T\\<approx>A) \\<longrightarrow> P(T))\" using eqpoll_trans[OF _ assms(1)] by auto\n  then show ?thesis using Spec_def by auto\nqed\n\ntheorem eqpoll_iff_spec:\n  assumes \"A\\<approx>B\"\n  shows \"(B {is in the spectrum of} P) \\<longleftrightarrow> (A {is in the spectrum of} P)\"\nproof\n  assume \"B {is in the spectrum of} P\"\n  with assms equipollent_spect show \"A {is in the spectrum of} P\" by auto\nnext\n  assume \"A {is in the spectrum of} P\"\n  moreover\n  from assms have \"B\\<approx>A\" using eqpoll_sym by auto\n  ultimately show \"B {is in the spectrum of} P\" using equipollent_spect by auto\nqed\n\ntext\\<open>From the previous statement, we see that the spectrum could be formed only by\nrepresentative of clases of sets. If \\emph{AC} holds, this means that the spectrum\ncan be taken as a set or class of cardinal numbers.\\<close>\n\ntext\\<open>Here is an example of the spectrum. The proof lies in the indiscrite filter \\<open>{A}\\<close>\nthat can be build for any set. In this proof, we see that without choice,\nthere is no way to define the sepctrum of a property with cardinals because if a set is not \ncomparable with any ordinal, its cardinal is defined as \\<open>0\\<close> without the set being\nempty.\\<close>\n\ntheorem T4_spectrum:\n  shows \"(A {is in the spectrum of} isT4) \\<longleftrightarrow> A \\<lesssim> 1\"\nproof\n  assume \"A {is in the spectrum of} isT4\"\n  then have reg:\"\\<forall>T. ((T{is a topology} \\<and> \\<Union>T\\<approx>A) \\<longrightarrow> (T {is T\\<^sub>4}))\" using Spec_def by auto\n  {\n    assume \"A\\<noteq>0\"\n    then obtain x where \"x\\<in>A\" by auto\n    then have \"x\\<in>\\<Union>{A}\" by auto\n    moreover\n    then have \"{A} {is a filter on}\\<Union>{A}\" using IsFilter_def by auto\n    moreover\n    then have \"({A}\\<union>{0}) {is a topology} \\<and> \\<Union>({A}\\<union>{0})=A\" using top_of_filter by auto\n    then have top:\"({A}\\<union>{0}) {is a topology}\" \"\\<Union>({A}\\<union>{0})\\<approx>A\" using eqpoll_refl by auto\n    then have \"({A}\\<union>{0}) {is T\\<^sub>4}\" using reg by auto\n    then have \"({A}\\<union>{0}) {is T\\<^sub>2}\" using topology0.T3_is_T2 topology0.T4_is_T3 topology0_def top by auto\n    ultimately have \"\\<Union>{A}={x}\" using filter_T2_imp_card1[of \"{A}\"\"x\"] by auto\n    then have \"A={x}\" by auto\n    then have \"A\\<approx>1\" using singleton_eqpoll_1 by auto\n  }\n  moreover\n  have \"A=0 \\<longrightarrow> A\\<approx>0\" by auto\n  ultimately have \"A\\<approx>1\\<or>A\\<approx>0\" by blast\n  then show \"A\\<lesssim>1\" using empty_lepollI eqpoll_imp_lepoll eq_lepoll_trans by auto\nnext\n  assume \"A\\<lesssim>1\"\n  have \"A=0\\<or>A\\<noteq>0\" by auto\n  then obtain E where \"A=0\\<or>E\\<in>A\" by auto\n  then have \"A\\<approx>0\\<or>E\\<in>A\" by auto\n  with \\<open>A\\<lesssim>1\\<close> have \"A\\<approx>0\\<or>A={E}\" using lepoll_1_is_sing by auto\n  then have \"A\\<approx>0\\<or>A\\<approx>1\" using singleton_eqpoll_1 by auto\n  {\n    fix T\n    assume AS:\"T{is a topology}\"\"\\<Union>T\\<approx>A\"\n    {\n      assume \"A\\<approx>0\"\n      with AS have \"T{is a topology}\" and empty:\"\\<Union>T=0\" using eqpoll_trans eqpoll_0_is_0 by auto\n      then have \"T{is T\\<^sub>2}\" using isT2_def by auto\n      then have \"T{is T\\<^sub>1}\" using T2_is_T1 by auto\n      moreover\n      from empty have \"T\\<subseteq>{0}\" by auto\n      with AS(1) have \"T={0}\" using empty_open by auto\n      from empty have rr:\"\\<forall>A. A{is closed in}T \\<longrightarrow> A=0\" using IsClosed_def by auto\n      have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. 0\\<subseteq>U\\<and>0\\<subseteq>V\\<and>U\\<inter>V=0\" using empty_open AS(1) by auto\n      with rr have \"\\<forall>A. A{is closed in}T \\<longrightarrow> (\\<forall>B. B{is closed in}T \\<and> A\\<inter>B=0 \\<longrightarrow> (\\<exists>U\\<in>T. \\<exists>V\\<in>T. A\\<subseteq>U\\<and>B\\<subseteq>V\\<and>U\\<inter>V=0))\"\n        by blast\n      then have \"T{is normal}\" using IsNormal_def by auto\n      with \\<open>T{is T\\<^sub>1}\\<close> have \"T{is T\\<^sub>4}\" using isT4_def by auto\n    }\n    moreover\n    {\n      assume \"A\\<approx>1\"\n      with AS have \"T{is a topology}\" and NONempty:\"\\<Union>T\\<approx>1\" using eqpoll_trans[of \"\\<Union>T\"\"A\"\"1\"] by auto\n      then have \"\\<Union>T\\<lesssim>1\" using eqpoll_imp_lepoll by auto\n      moreover\n      {\n        assume \"\\<Union>T=0\"\n        then have \"0\\<approx>\\<Union>T\" by auto\n        with NONempty have \"0\\<approx>1\" using eqpoll_trans by blast\n        then have \"0=1\" using eqpoll_0_is_0 eqpoll_sym by auto\n        then have \"False\" by auto\n      }\n      then have \"\\<Union>T\\<noteq>0\" by auto\n      then obtain R where \"R\\<in>\\<Union>T\" by blast\n      ultimately have \"\\<Union>T={R}\" using lepoll_1_is_sing by auto\n      {\n        fix x y\n        assume \"x{is closed in}T\"\"y{is closed in}T\" \"x\\<inter>y=0\"\n        then have \"x\\<subseteq>\\<Union>T\"\"y\\<subseteq>\\<Union>T\" using IsClosed_def by auto\n        then have \"x=0\\<or>y=0\" using \\<open>x\\<inter>y=0\\<close> \\<open>\\<Union>T={R}\\<close> by force\n        {\n          assume \"x=0\"\n          then have \"x\\<subseteq>0\"\"y\\<subseteq>\\<Union>T\" using \\<open>y\\<subseteq>\\<Union>T\\<close> by auto\n          moreover\n          have \"0\\<in>T\"\"\\<Union>T\\<in>T\" using AS(1) IsATopology_def empty_open by auto\n          ultimately have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. x\\<subseteq>U\\<and>y\\<subseteq>V\\<and>U\\<inter>V=0\" by auto\n        }\n        moreover\n        {\n          assume \"x\\<noteq>0\"\n          with \\<open>x=0\\<or>y=0\\<close> have \"y=0\" by auto\n          then have \"x\\<subseteq>\\<Union>T\"\"y\\<subseteq>0\" using \\<open>x\\<subseteq>\\<Union>T\\<close> by auto\n          moreover\n          have \"0\\<in>T\"\"\\<Union>T\\<in>T\" using AS(1) IsATopology_def empty_open by auto\n          ultimately have \"\\<exists>U\\<in>T. \\<exists>V\\<in>T. x\\<subseteq>U\\<and>y\\<subseteq>V\\<and>U\\<inter>V=0\" by auto\n        }\n        ultimately\n        have \"(\\<exists>U\\<in>T. \\<exists>V\\<in>T. x \\<subseteq> U \\<and> y \\<subseteq> V \\<and> U \\<inter> V = 0)\" by blast\n      }\n      then have \"T{is normal}\" using IsNormal_def by auto\n      moreover\n      {\n        fix x y\n        assume \"x\\<in>\\<Union>T\"\"y\\<in>\\<Union>T\"\"x\\<noteq>y\"\n        with \\<open>\\<Union>T={R}\\<close> have \"False\" by auto\n        then have \"\\<exists>U\\<in>T. x\\<in>U\\<and>y\\<notin>U\" by auto\n      }\n      then have \"T{is T\\<^sub>1}\" using isT1_def by auto\n      ultimately have \"T{is T\\<^sub>4}\" using isT4_def by auto\n    }\n    ultimately have \"T{is T\\<^sub>4}\" using \\<open>A\\<approx>0\\<or>A\\<approx>1\\<close> by auto\n  }\n  then have \"\\<forall>T. (T{is a topology} \\<and> \\<Union>T \\<approx> A) \\<longrightarrow> (T{is T\\<^sub>4})\" by auto\n  then show \"A {is in the spectrum of} isT4\" using Spec_def by auto\nqed\n\ntext\\<open>If the topological properties are related, then so are the spectra.\\<close>\n    \nlemma P_imp_Q_spec_inv:\n  assumes \"\\<forall>T. T{is a topology} \\<longrightarrow> (Q(T) \\<longrightarrow> P(T))\"  \"A {is in the spectrum of} Q\"\n  shows \"A {is in the spectrum of} P\"\nproof-\n  from assms(2) have \"\\<forall>T. T{is a topology} \\<and> \\<Union>T \\<approx> A \\<longrightarrow> Q(T)\" using Spec_def by auto\n  with assms(1) have \"\\<forall>T. T{is a topology} \\<and> \\<Union>T \\<approx> A \\<longrightarrow> P(T)\" by auto\n  then show ?thesis using Spec_def by auto\nqed\n\ntext\\<open>Since we already now the spectrum of $T_4$; if we now the spectrum of $T_0$,\nit should be easier to compute the spectrum of $T_1$, $T_2$ and $T_3$.\\<close>\n\ntheorem T0_spectrum:\n  shows \"(A {is in the spectrum of} isT0) \\<longleftrightarrow> A \\<lesssim> 1\"\nproof\n  assume \"A {is in the spectrum of} isT0\"\n  then have reg:\"\\<forall>T. ((T{is a topology} \\<and> \\<Union>T\\<approx>A) \\<longrightarrow> (T {is T\\<^sub>0}))\" using Spec_def by auto\n  {\n    assume \"A\\<noteq>0\"\n    then obtain x where \"x\\<in>A\" by auto\n    then have \"x\\<in>\\<Union>{A}\" by auto\n    moreover\n    then have \"{A} {is a filter on}\\<Union>{A}\" using IsFilter_def by auto\n    moreover\n    then have \"({A}\\<union>{0}) {is a topology} \\<and> \\<Union>({A}\\<union>{0})=A\" using top_of_filter by auto\n    then have \"({A}\\<union>{0}) {is a topology} \\<and> \\<Union>({A}\\<union>{0})\\<approx>A\" using eqpoll_refl by auto\n    then have \"({A}\\<union>{0}) {is T\\<^sub>0}\" using reg by auto\n    {\n      fix y\n      assume \"y\\<in>A\"\"x\\<noteq>y\"\n      with \\<open>({A}\\<union>{0}) {is T\\<^sub>0}\\<close> obtain U where \"U\\<in>({A}\\<union>{0})\" and dis:\"(x \\<in> U \\<and> y \\<notin> U) \\<or> (y \\<in> U \\<and> x \\<notin> U)\" using isT0_def by auto\n      then have \"U=A\" by auto\n      with dis \\<open>y\\<in>A\\<close> \\<open>x\\<in>\\<Union>{A}\\<close> have \"False\" by auto\n    }\n    then have \"\\<forall>y\\<in>A. y=x\" by auto\n    with \\<open>x\\<in>\\<Union>{A}\\<close> have \"A={x}\" by blast\n    then have \"A\\<approx>1\" using singleton_eqpoll_1 by auto\n  }\n  moreover\n  have \"A=0 \\<longrightarrow> A\\<approx>0\" by auto\n  ultimately have \"A\\<approx>1\\<or>A\\<approx>0\" by blast\n  then show \"A\\<lesssim>1\" using empty_lepollI eqpoll_imp_lepoll eq_lepoll_trans by auto\nnext\n  assume \"A\\<lesssim>1\"\n  {\n    fix T\n    assume \"T{is a topology}\"\n    then have \"(T{is T\\<^sub>4})\\<longrightarrow>(T{is T\\<^sub>0})\" using topology0.T4_is_T3 topology0.T3_is_T2 T2_is_T1 T1_is_T0 \n      topology0_def by auto\n  }\n  then have \"\\<forall>T. T{is a topology} \\<longrightarrow> ((T{is T\\<^sub>4})\\<longrightarrow>(T{is T\\<^sub>0}))\" by auto\n  then have \"(A {is in the spectrum of} isT4) \\<longrightarrow> (A {is in the spectrum of} isT0)\"\n    using P_imp_Q_spec_inv[of \"\\<lambda>T. (T{is T\\<^sub>4})\"\"\\<lambda>T. T{is T\\<^sub>0}\"] by auto\n  then show \"(A {is in the spectrum of} isT0)\" using T4_spectrum \\<open>A\\<lesssim>1\\<close> by auto\nqed\n\ntheorem T1_spectrum:\n  shows \"(A {is in the spectrum of} isT1) \\<longleftrightarrow> A \\<lesssim> 1\"\nproof-\n  note T2_is_T1 topology0.T3_is_T2 topology0.T4_is_T3\n  then have \"(A {is in the spectrum of} isT4) \\<longrightarrow> (A {is in the spectrum of} isT1)\"\n    using P_imp_Q_spec_inv[of \"isT4\"\"isT1\"] topology0_def by auto\n  moreover\n  note T1_is_T0\n  then have \"(A {is in the spectrum of} isT1) \\<longrightarrow> (A {is in the spectrum of}isT0)\"\n    using P_imp_Q_spec_inv[of \"isT1\"\"isT0\"] by auto\n  moreover\n  note T0_spectrum T4_spectrum\n  ultimately show ?thesis by blast\nqed\n\ntheorem T2_spectrum:\n  shows \"(A {is in the spectrum of} isT2) \\<longleftrightarrow> A \\<lesssim> 1\"\nproof-\n  note topology0.T3_is_T2 topology0.T4_is_T3\n  then have \"(A {is in the spectrum of} isT4) \\<longrightarrow> (A {is in the spectrum of} isT2)\"\n    using P_imp_Q_spec_inv[of \"isT4\"\"isT2\"] topology0_def by auto\n  moreover\n  note T2_is_T1\n  then have \"(A {is in the spectrum of} isT2) \\<longrightarrow> (A {is in the spectrum of}isT1)\"\n    using P_imp_Q_spec_inv[of \"isT2\"\"isT1\"] by auto\n  moreover\n  note T1_spectrum T4_spectrum\n  ultimately show ?thesis by blast\nqed\n\ntheorem T3_spectrum:\n  shows \"(A {is in the spectrum of} isT3) \\<longleftrightarrow> A \\<lesssim> 1\"\nproof-\n  note topology0.T4_is_T3\n  then have \"(A {is in the spectrum of} isT4) \\<longrightarrow> (A {is in the spectrum of} isT3)\"\n    using P_imp_Q_spec_inv[of \"isT4\"\"isT3\"] topology0_def by auto\n  moreover\n  note topology0.T3_is_T2\n  then have \"(A {is in the spectrum of} isT3) \\<longrightarrow> (A {is in the spectrum of}isT2)\"\n    using P_imp_Q_spec_inv[of \"isT3\"\"isT2\"] topology0_def by auto\n  moreover\n  note T2_spectrum T4_spectrum\n  ultimately show ?thesis by blast\nqed\n\ntheorem compact_spectrum:\n  shows \"(A {is in the spectrum of} (\\<lambda>T. (\\<Union>T) {is compact in}T)) \\<longleftrightarrow> Finite(A)\"\nproof\n  assume \"A {is in the spectrum of} (\\<lambda>T. (\\<Union>T) {is compact in}T)\"\n  then have reg:\"\\<forall>T. T{is a topology} \\<and> \\<Union>T\\<approx>A \\<longrightarrow> ((\\<Union>T) {is compact in}T)\" using Spec_def by auto\n  have \"Pow(A){is a topology} \\<and> \\<Union>Pow(A)=A\" using Pow_is_top by auto\n  then have \"Pow(A){is a topology} \\<and> \\<Union>Pow(A)\\<approx>A\" using eqpoll_refl by auto\n  with reg have \"A{is compact in}Pow(A)\" by auto\n  moreover\n  have \"{{x}. x\\<in>A}\\<in>Pow(Pow(A))\" by auto\n  moreover\n  have \"\\<Union>{{x}. x\\<in>A}=A\" by auto\n  ultimately have \"\\<exists>N\\<in>FinPow({{x}. x\\<in>A}). A\\<subseteq>\\<Union>N\" using IsCompact_def by auto\n  then obtain N where \"N\\<in>FinPow({{x}. x\\<in>A})\" \"A\\<subseteq>\\<Union>N\" by auto\n  then have \"N\\<subseteq>{{x}. x\\<in>A}\" \"Finite(N)\" \"A\\<subseteq>\\<Union>N\" using FinPow_def by auto\n  {\n    fix t\n    assume \"t\\<in>{{x}. x\\<in>A}\"\n    then obtain x where \"x\\<in>A\"\"t={x}\" by auto\n    with \\<open>A\\<subseteq>\\<Union>N\\<close> have \"x\\<in>\\<Union>N\" by auto\n    then obtain B where \"B\\<in>N\"\"x\\<in>B\" by auto\n    with \\<open>N\\<subseteq>{{x}. x\\<in>A}\\<close> have \"B={x}\" by auto\n    with \\<open>t={x}\\<close>\\<open>B\\<in>N\\<close> have \"t\\<in>N\" by auto \n  }\n  with \\<open>N\\<subseteq>{{x}. x\\<in>A}\\<close> have \"N={{x}. x\\<in>A}\" by auto\n  with \\<open>Finite(N)\\<close> have \"Finite({{x}. x\\<in>A})\" by auto\n  let ?B=\"{\\<langle>x,{x}\\<rangle>. x\\<in>A}\"\n  have \"?B:A\\<rightarrow>{{x}. x\\<in>A}\" unfolding Pi_def function_def by auto\n  then have \"?B:bij(A,{{x}. x\\<in>A})\" unfolding bij_def inj_def surj_def using apply_equality by auto\n  then have \"A\\<approx>{{x}. x\\<in>A}\" using eqpoll_def by auto\n  with \\<open>Finite({{x}. x\\<in>A})\\<close> show \"Finite(A)\" using eqpoll_imp_Finite_iff by auto\nnext\n  assume \"Finite(A)\"\n  {\n    fix T assume \"T{is a topology}\" \"\\<Union>T\\<approx>A\"\n    with \\<open>Finite(A)\\<close> have \"Finite(\\<Union>T)\" using eqpoll_imp_Finite_iff by auto\n    then have \"Finite(Pow(\\<Union>T))\" using Finite_Pow by auto\n    moreover\n    have \"T\\<subseteq>Pow(\\<Union>T)\" by auto\n    ultimately have \"Finite(T)\" using subset_Finite by auto\n    {\n      fix M\n      assume \"M\\<in>Pow(T)\"\"\\<Union>T\\<subseteq>\\<Union>M\"\n      with \\<open>Finite(T)\\<close> have \"Finite(M)\" using subset_Finite by auto\n      with \\<open>\\<Union>T\\<subseteq>\\<Union>M\\<close> have \"\\<exists>N\\<in>FinPow(M). \\<Union>T\\<subseteq>\\<Union>N\" using FinPow_def by auto\n    }\n    then have \"(\\<Union>T){is compact in}T\" unfolding IsCompact_def by auto\n  }\n  then show \"A {is in the spectrum of} (\\<lambda>T. (\\<Union>T) {is compact in}T)\" using Spec_def by auto\nqed\n\ntext\\<open>It is, at least for some people, surprising that the spectrum of some properties cannot be completely\ndetermined in \\emph{ZF}.\\<close>\n\ntheorem compactK_spectrum:\n  assumes \"{the axiom of}K{choice holds for subsets}(Pow(K))\" \"Card(K)\"\n  shows \"(A {is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is compact of cardinal} csucc(K){in}T))) \\<longleftrightarrow> (A\\<lesssim>K)\"\nproof\n  assume \"A {is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is compact of cardinal} csucc(K){in}T))\"\n  then have reg:\"\\<forall>T. T{is a topology}\\<and>\\<Union>T\\<approx>A \\<longrightarrow> ((\\<Union>T){is compact of cardinal} csucc(K){in}T)\" using Spec_def by auto\n  then have \"A{is compact of cardinal} csucc(K) {in} Pow(A)\" using Pow_is_top[of \"A\"] by auto\n  then have \"\\<forall>M\\<in>Pow(Pow(A)). A\\<subseteq>\\<Union>M \\<longrightarrow> (\\<exists>N\\<in>Pow(M). A\\<subseteq>\\<Union>N \\<and> N\\<prec>csucc(K))\" unfolding IsCompactOfCard_def by auto\n  moreover\n  have \"{{x}. x\\<in>A}\\<in>Pow(Pow(A))\" by auto\n  moreover\n  have \"A=\\<Union>{{x}. x\\<in>A}\" by auto\n  ultimately have \"\\<exists>N\\<in>Pow({{x}. x\\<in>A}). A\\<subseteq>\\<Union>N \\<and> N\\<prec>csucc(K)\" by auto\n  then obtain N where \"N\\<in>Pow({{x}. x\\<in>A})\" \"A\\<subseteq>\\<Union>N\" \"N\\<prec>csucc(K)\" by auto\n  then have \"N\\<subseteq>{{x}. x\\<in>A}\" \"N\\<prec>csucc(K)\" \"A\\<subseteq>\\<Union>N\" using FinPow_def by auto\n  {\n    fix t\n    assume \"t\\<in>{{x}. x\\<in>A}\"\n    then obtain x where \"x\\<in>A\"\"t={x}\" by auto\n    with \\<open>A\\<subseteq>\\<Union>N\\<close> have \"x\\<in>\\<Union>N\" by auto\n    then obtain B where \"B\\<in>N\"\"x\\<in>B\" by auto\n    with \\<open>N\\<subseteq>{{x}. x\\<in>A}\\<close> have \"B={x}\" by auto\n    with \\<open>t={x}\\<close>\\<open>B\\<in>N\\<close> have \"t\\<in>N\" by auto \n  }\n  with \\<open>N\\<subseteq>{{x}. x\\<in>A}\\<close> have \"N={{x}. x\\<in>A}\" by auto\n  let ?B=\"{\\<langle>x,{x}\\<rangle>. x\\<in>A}\"\n  from \\<open>N={{x}. x\\<in>A}\\<close> have \"?B:A\\<rightarrow> N\" unfolding Pi_def function_def by auto\n  with \\<open>N={{x}. x\\<in>A}\\<close> have \"?B:inj(A,N)\" unfolding inj_def using apply_equality by auto\n  then have \"A\\<lesssim>N\" using lepoll_def by auto\n  with \\<open>N\\<prec>csucc(K)\\<close> have \"A\\<prec>csucc(K)\" using lesspoll_trans1 by auto\n  then show \"A\\<lesssim>K\" using Card_less_csucc_eq_le assms(2) by auto\nnext\n  assume \"A\\<lesssim>K\"\n  {\n    fix T\n    assume \"T{is a topology}\"\"\\<Union>T\\<approx>A\"\n    have \"Pow(\\<Union>T){is a topology}\" using Pow_is_top by auto\n    {\n      fix B\n      assume AS:\"B\\<in>Pow(\\<Union>T)\"\n      then have \"{{i}. i\\<in>B}\\<subseteq>{{i} .i\\<in>\\<Union>T}\" by auto\n      moreover\n      have \"B=\\<Union>{{i}. i\\<in>B}\" by auto\n      ultimately have \"\\<exists>S\\<in>Pow({{i}. i\\<in>\\<Union>T}). B=\\<Union>S\" by auto\n      then have \"B\\<in>{\\<Union>U. U\\<in>Pow({{i}. i\\<in>\\<Union>T})}\" by auto\n    }\n    moreover\n    {\n      fix B\n      assume AS:\"B\\<in>{\\<Union>U. U\\<in>Pow({{i}. i\\<in>\\<Union>T})}\"\n      then have \"B\\<in>Pow(\\<Union>T)\" by auto\n    }\n    ultimately\n    have base:\"{{x}. x\\<in>\\<Union>T} {is a base for}Pow(\\<Union>T)\" unfolding IsAbaseFor_def by auto\n    let ?f=\"{\\<langle>i,{i}\\<rangle>. i\\<in>\\<Union>T}\"\n    have f:\"?f:\\<Union>T\\<rightarrow> {{x}. x\\<in>\\<Union>T}\" using Pi_def function_def by auto\n    moreover\n    {\n      fix w x\n      assume as:\"w\\<in>\\<Union>T\"\"x\\<in>\\<Union>T\"\"?f`w=?f`x\"\n      with f have \"?f`w={w}\" \"?f`x={x}\" using apply_equality by auto\n      with as(3) have \"w=x\" by auto\n    }\n    with f have \"?f:inj(\\<Union>T,{{x}. x\\<in>\\<Union>T})\" unfolding inj_def by auto\n    moreover\n    {\n      fix xa\n      assume \"xa\\<in>{{x}. x\\<in>\\<Union>T}\"\n      then obtain x where \"x\\<in>\\<Union>T\"\"xa={x}\" by auto\n      with f have \"?f`x=xa\" using apply_equality by auto\n      with \\<open>x\\<in>\\<Union>T\\<close> have \"\\<exists>x\\<in>\\<Union>T. ?f`x=xa\" by auto\n    }\n    then have \"\\<forall>xa\\<in>{{x}. x\\<in>\\<Union>T}. \\<exists>x\\<in>\\<Union>T. ?f`x=xa\" by blast\n    ultimately have \"?f:bij(\\<Union>T,{{x}. x\\<in>\\<Union>T})\" unfolding bij_def surj_def by auto\n    then have \"\\<Union>T\\<approx>{{x}. x\\<in>\\<Union>T}\" using eqpoll_def by auto\n    then have \"{{x}. x\\<in>\\<Union>T}\\<approx>\\<Union>T\" using eqpoll_sym by auto\n    with \\<open>\\<Union>T\\<approx>A\\<close> have \"{{x}. x\\<in>\\<Union>T}\\<approx>A\" using eqpoll_trans by blast\n    then have \"{{x}. x\\<in>\\<Union>T}\\<lesssim>A\" using eqpoll_imp_lepoll by auto\n    with \\<open>A\\<lesssim>K\\<close> have \"{{x}. x\\<in>\\<Union>T}\\<lesssim>K\" using lepoll_trans by blast\n    then have \"{{x}. x\\<in>\\<Union>T}\\<prec>csucc(K)\" using assms(2) Card_less_csucc_eq_le by auto\n    with base have \"Pow(\\<Union>T) {is of second type of cardinal}csucc(K)\" unfolding IsSecondOfCard_def by auto\n    moreover\n    have \"\\<Union>Pow(\\<Union>T)=\\<Union>T\" by auto\n    with calculation assms(1) \\<open>Pow(\\<Union>T){is a topology}\\<close> have \"(\\<Union>T) {is compact of cardinal}csucc(K){in}Pow(\\<Union>T)\" \n      using compact_of_cardinal_Q[of \"K\"\"Pow(\\<Union>T)\"] by auto\n    moreover\n    have \"T\\<subseteq>Pow(\\<Union>T)\" by auto\n    ultimately have \"(\\<Union>T) {is compact of cardinal}csucc(K){in}T\" using compact_coarser by auto\n  }\n  then show \"A {is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is compact of cardinal}csucc(K) {in}T))\" using Spec_def by auto\nqed\n\ntheorem compactK_spectrum_reverse:\n  assumes \"\\<forall>A. (A {is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is compact of cardinal} csucc(K){in}T))) \\<longleftrightarrow> (A\\<lesssim>K)\" \"InfCard(K)\"\n  shows \"{the axiom of}K{choice holds for subsets}(Pow(K))\"\nproof-\n  have \"K\\<lesssim>K\" using lepoll_refl by auto\n  then have \"K {is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is compact of cardinal} csucc(K){in}T))\" using assms(1) by auto\n  moreover\n  have \"Pow(K){is a topology}\" using Pow_is_top by auto\n  moreover\n  have \"\\<Union>Pow(K)=K\" by auto\n  then have \"\\<Union>Pow(K)\\<approx>K\" using eqpoll_refl by auto\n  ultimately\n  have \"K {is compact of cardinal} csucc(K){in}Pow(K)\" using Spec_def by auto\n  then show ?thesis using Q_disc_comp_csuccQ_eq_Q_choice_csuccQ assms(2) by auto\nqed\n\ntext\\<open>This last theorem states that if one of the forms of the axiom of choice related to this\ncompactness property fails, then the spectrum will be different. Notice that even for Lindelöf\nspaces that will happend.\\<close>\n\ntext\\<open>The spectrum gives us the posibility to define what an anti-property means.\nA space is anti-\\<open>P\\<close> if the only subspaces which have the property\nare the ones in the spectrum of \\<open>P\\<close>. This concept tries to put together\nspaces that are completely opposite to spaces where \\<open>P(T)\\<close>.\\<close>\n\ndefinition\n  antiProperty (\"_{is anti-}_\" 50)\n  where \"T{is anti-}P \\<equiv> \\<forall>A\\<in>Pow(\\<Union>T). P(T{restricted to}A) \\<longrightarrow> (A {is in the spectrum of} P)\"\n\nabbreviation\n  \"ANTI(P) \\<equiv> \\<lambda>T. (T{is anti-}P)\"\n\ntext\\<open>A first, very simple, but very useful result is the following: when the properties\nare related and the spectra are equal, then the anti-properties are related in the oposite direction.\\<close>\n\ntheorem (in topology0) eq_spect_rev_imp_anti:\n  assumes \"\\<forall>T. T{is a topology} \\<longrightarrow> P(T) \\<longrightarrow> Q(T)\" \"\\<forall>A. (A{is in the spectrum of}Q) \\<longrightarrow> (A{is in the spectrum of}P)\"\n    and \"T{is anti-}Q\"\n  shows \"T{is anti-}P\"\nproof-\n  {\n    fix A\n    assume \"A\\<in>Pow(\\<Union>T)\"\"P(T{restricted to}A)\"\n    with assms(1) have \"Q(T{restricted to}A)\" using Top_1_L4 by auto\n    with assms(3) \\<open>A\\<in>Pow(\\<Union>T)\\<close> have \"A{is in the spectrum of}Q\" using antiProperty_def by auto\n    with assms(2) have \"A{is in the spectrum of}P\" by auto\n  }\n  then show ?thesis using antiProperty_def by auto\nqed\n\ntext\\<open>If a space can be \\<open>P(T)\\<and>Q(T)\\<close> only in case the underlying set is in the\nspectrum of \\<open>P\\<close>; then \\<open>Q(T)\\<longrightarrow>ANTI(P,T)\\<close> when \\<open>Q\\<close> is hereditary.\\<close>\n\ntheorem Q_P_imp_Spec:\n  assumes \"\\<forall>T. ((T{is a topology}\\<and>P(T)\\<and>Q(T))\\<longrightarrow> ((\\<Union>T){is in the spectrum of}P))\"\n    and \"Q{is hereditary}\"\n  shows \"\\<forall>T. T{is a topology} \\<longrightarrow> (Q(T)\\<longrightarrow>(T{is anti-}P))\"\nproof\n  fix T\n  {\n    assume \"T{is a topology}\"\n    {\n      assume \"Q(T)\"\n      {\n        assume \"\\<not>(T{is anti-}P)\"\n        then obtain A where \"A\\<in>Pow(\\<Union>T)\" \"P(T{restricted to}A)\"\"\\<not>(A{is in the spectrum of}P)\"\n          unfolding antiProperty_def by auto\n        from \\<open>Q(T)\\<close>\\<open>T{is a topology}\\<close>\\<open>A\\<in>Pow(\\<Union>T)\\<close> assms(2) have \"Q(T{restricted to}A)\" \n          unfolding IsHer_def by auto\n        moreover\n        note \\<open>P(T{restricted to}A)\\<close> assms(1)\n        moreover\n        from \\<open>T{is a topology}\\<close> have \"(T{restricted to}A){is a topology}\" using topology0.Top_1_L4\n          topology0_def by auto\n        moreover\n        from \\<open>A\\<in>Pow(\\<Union>T)\\<close> have \"\\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def by auto\n        ultimately have \"A{is in the spectrum of}P\" by auto\n        with \\<open>\\<not>(A{is in the spectrum of}P)\\<close> have \"False\" by auto\n      }\n      then have \"T{is anti-}P\" by auto\n    }\n    then have \"Q(T)\\<longrightarrow>(T{is anti-}P)\" by auto\n  }\n  then show \"(T {is a topology}) \\<longrightarrow> (Q(T) \\<longrightarrow> (T{is anti-}P))\" by auto\nqed\n\ntext\\<open>If a topologycal space has an hereditary property, then it has its double-anti property.\\<close>  \n\ntheorem (in topology0)her_P_imp_anti2P:\n  assumes \"P{is hereditary}\" \"P(T)\"\n  shows \"T{is anti-}ANTI(P)\"\nproof-\n  {\n    assume \"\\<not>(T{is anti-}ANTI(P))\"\n    then have \"\\<exists>A\\<in>Pow(\\<Union>T). ((T{restricted to}A){is anti-}P)\\<and>\\<not>(A{is in the spectrum of}ANTI(P))\"\n      unfolding antiProperty_def[of _ \"ANTI(P)\"] by auto\n    then obtain A where A_def:\"A\\<in>Pow(\\<Union>T)\"\"\\<not>(A{is in the spectrum of}ANTI(P))\"\"(T{restricted to}A){is anti-}P\"\n      by auto\n    from \\<open>A\\<in>Pow(\\<Union>T)\\<close> have tot:\"\\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def by auto\n    from A_def have reg:\"\\<forall>B\\<in>Pow(\\<Union>(T{restricted to}A)). P((T{restricted to}A){restricted to}B) \\<longrightarrow> (B{is in the spectrum of}P)\"\n      unfolding antiProperty_def by auto\n    have \"\\<forall>B\\<in>Pow(A). (T{restricted to}A){restricted to}B=T{restricted to}B\" using subspace_of_subspace \\<open>A\\<in>Pow(\\<Union>T)\\<close> by auto\n    then have \"\\<forall>B\\<in>Pow(A). P(T{restricted to}B) \\<longrightarrow> (B{is in the spectrum of}P)\" using reg tot\n      by force\n    moreover\n    have \"\\<forall>B\\<in>Pow(A). P(T{restricted to}B)\" using assms \\<open>A\\<in>Pow(\\<Union>T)\\<close> unfolding IsHer_def using topSpaceAssum by blast\n    ultimately have reg2:\"\\<forall>B\\<in>Pow(A). (B{is in the spectrum of}P)\" by auto\n    from \\<open>\\<not>(A{is in the spectrum of}ANTI(P))\\<close> have \"\\<exists>T. T{is a topology} \\<and> \\<Union>T\\<approx>A \\<and> \\<not>(T{is anti-}P)\"\n      unfolding Spec_def by auto\n    then obtain S where \"S{is a topology}\" \"\\<Union>S\\<approx>A\" \"\\<not>(S{is anti-}P)\" by auto\n    from \\<open>\\<not>(S{is anti-}P)\\<close> have \"\\<exists>B\\<in>Pow(\\<Union>S). P(S{restricted to}B) \\<and> \\<not>(B{is in the spectrum of}P)\" unfolding antiProperty_def by auto\n    then obtain B where B_def:\"\\<not>(B{is in the spectrum of}P)\" \"B\\<in>Pow(\\<Union>S)\" by auto\n    then have \"B\\<lesssim>\\<Union>S\" using subset_imp_lepoll by auto\n    with \\<open>\\<Union>S\\<approx>A\\<close> have \"B\\<lesssim>A\" using lepoll_eq_trans by auto\n    then obtain f where \"f\\<in>inj(B,A)\" unfolding lepoll_def by auto\n    then have \"f\\<in>bij(B,range(f))\" using inj_bij_range by auto\n    then have \"B\\<approx>range(f)\" unfolding eqpoll_def by auto\n    with B_def(1) have \"\\<not>(range(f){is in the spectrum of}P)\" using eqpoll_iff_spec by auto\n    moreover\n    with \\<open>f\\<in>inj(B,A)\\<close> have \"range(f)\\<subseteq>A\" unfolding inj_def Pi_def by auto\n    with reg2 have \"range(f){is in the spectrum of}P\" by auto\n    ultimately have \"False\" by auto\n  }\n  then show ?thesis by auto\nqed\n  \ntext\\<open>The anti-properties are always hereditary\\<close>\n\ntheorem anti_here:\n  shows \"ANTI(P){is hereditary}\"\nproof-\n  {\n    fix T\n    assume \"T {is a topology}\"\"ANTI(P,T)\"\n    {\n      fix A\n      assume \"A\\<in>Pow(\\<Union>T)\"\n      then have \"\\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def by auto\n      moreover\n      {\n        fix B\n        assume \"B\\<in>Pow(A)\"\"P((T{restricted to}A){restricted to}B)\"\n        with \\<open>A\\<in>Pow(\\<Union>T)\\<close> have \"B\\<in>Pow(\\<Union>T)\"\"P(T{restricted to}B)\" using subspace_of_subspace by auto\n        with \\<open>ANTI(P,T)\\<close> have \"B{is in the spectrum of}P\" unfolding antiProperty_def by auto\n      }\n      ultimately have \"\\<forall>B\\<in>Pow(\\<Union>(T{restricted to}A)). (P((T{restricted to}A){restricted to}B)) \\<longrightarrow> (B{is in the spectrum of}P)\"\n        by auto\n      then have \"ANTI(P,(T{restricted to}A))\" unfolding antiProperty_def by auto\n    }\n    then have \"\\<forall>A\\<in>Pow(\\<Union>T). ANTI(P,(T{restricted to}A))\" by auto\n  }\n  then show ?thesis using IsHer_def by auto\nqed\n\ncorollary (in topology0) anti_imp_anti3:\n  assumes \"T{is anti-}P\"\n  shows \"T{is anti-}ANTI(ANTI(P))\"\n  using anti_here her_P_imp_anti2P assms by auto\n\ntext\\<open>In the article \\cite{ReVa80}, we can find some results on anti-properties.\\<close>\n\ntheorem (in topology0) anti_T0:\n  shows \"(T{is anti-}isT0) \\<longleftrightarrow> T={0,\\<Union>T}\"\nproof\n  assume \"T={0,\\<Union>T}\"\n  {\n    fix A\n    assume \"A\\<in>Pow(\\<Union>T)\"\"(T{restricted to}A) {is T\\<^sub>0}\"\n    {\n      fix B\n      assume \"B\\<in>T{restricted to}A\"\n      then obtain S where \"S\\<in>T\" and \"B=A\\<inter>S\" unfolding RestrictedTo_def by auto\n      with \\<open>T={0,\\<Union>T}\\<close> have \"S\\<in>{0,\\<Union>T}\" by auto\n      then have \"S=0\\<or>S=\\<Union>T\" by auto\n      with \\<open>B=A\\<inter>S\\<close>\\<open>A\\<in>Pow(\\<Union>T)\\<close> have \"B=0\\<or>B=A\" by auto\n    }\n    moreover\n    {\n      have \"0\\<in>{0,\\<Union>T}\" \"\\<Union>T\\<in>{0,\\<Union>T}\" by auto\n      with \\<open>T={0,\\<Union>T}\\<close> have \"0\\<in>T\"\"(\\<Union>T)\\<in>T\" by auto\n      then have \"A\\<inter>0\\<in>(T{restricted to}A)\" \"A\\<inter>(\\<Union>T)\\<in>(T{restricted to}A)\" using RestrictedTo_def by auto\n      moreover\n      from \\<open>A\\<in>Pow(\\<Union>T)\\<close> have \"A\\<inter>(\\<Union>T)=A\" by auto\n      ultimately have \"0\\<in>(T{restricted to}A)\" \"A\\<in>(T{restricted to}A)\" by auto\n    }\n    ultimately have \"(T{restricted to}A)={0,A}\" by auto\n    with \\<open>(T{restricted to}A) {is T\\<^sub>0}\\<close> have \"{0,A} {is T\\<^sub>0}\" by auto\n    {\n      assume \"A\\<noteq>0\"\n      then obtain x where \"x\\<in>A\" by blast\n      {\n        fix y\n        assume \"y\\<in>A\"\"x\\<noteq>y\"\n        with \\<open>{0,A} {is T\\<^sub>0}\\<close> obtain U where \"U\\<in>{0,A}\" and dis:\"(x \\<in> U \\<and> y \\<notin> U) \\<or> (y \\<in> U \\<and> x \\<notin> U)\" using isT0_def by auto\n        then have \"U=A\" by auto\n        with dis \\<open>y\\<in>A\\<close> \\<open>x\\<in>A\\<close> have \"False\" by auto\n      }\n      then have \"\\<forall>y\\<in>A. y=x\" by auto\n      with \\<open>x\\<in>A\\<close> have \"A={x}\" by blast\n      then have \"A\\<approx>1\" using singleton_eqpoll_1 by auto\n      then have \"A\\<lesssim>1\" using eqpoll_imp_lepoll by auto\n      then have \"A{is in the spectrum of}isT0\" using T0_spectrum by auto   \n    }\n    moreover\n    {\n      assume \"A=0\"\n      then have \"A\\<approx>0\" by auto\n      then have \"A\\<lesssim>1\" using empty_lepollI eq_lepoll_trans by auto\n      then have \"A{is in the spectrum of}isT0\" using T0_spectrum by auto\n    }\n    ultimately have \"A{is in the spectrum of}isT0\" by auto\n  }\n  then show \"T{is anti-}isT0\" using antiProperty_def by auto\nnext\n  assume \"T{is anti-}isT0\"\n  then have \"\\<forall>A\\<in>Pow(\\<Union>T). (T{restricted to}A){is T\\<^sub>0} \\<longrightarrow> (A{is in the spectrum of}isT0)\" using antiProperty_def by auto\n  then have reg:\"\\<forall>A\\<in>Pow(\\<Union>T). (T{restricted to}A){is T\\<^sub>0} \\<longrightarrow> (A\\<lesssim>1)\" using T0_spectrum by auto\n  {\n    assume \"\\<exists>A\\<in>T. A\\<noteq>0\\<and> A\\<noteq>\\<Union>T\"\n    then obtain A where \"A\\<in>T\"\"A\\<noteq>0\"\"A\\<noteq>\\<Union>T\" by auto\n    then obtain x y where \"x\\<in>A\" \"y\\<in>\\<Union>T-A\" by blast\n    with \\<open>A\\<in>T\\<close> have s:\"{x,y}\\<in>Pow(\\<Union>T)\" \"x\\<noteq>y\" by auto\n    note s\n    moreover\n    {\n      fix b1 b2\n      assume \"b1\\<in>\\<Union>(T{restricted to}{x,y})\"\"b2\\<in>\\<Union>(T{restricted to}{x,y})\"\"b1\\<noteq>b2\"\n      moreover\n      from s have \"\\<Union>(T{restricted to}{x,y})={x,y}\" unfolding RestrictedTo_def by auto\n      ultimately have \"(b1=x\\<and>b2=y)\\<or>(b1=y\\<and>b2=x)\" by auto\n      with \\<open>x\\<noteq>y\\<close> have \"(b1\\<in>{x}\\<and>b2\\<notin>{x}) \\<or> (b2\\<in>{x}\\<and>b1\\<notin>{x})\" by auto\n      moreover\n      from \\<open>y\\<in>\\<Union>T-A\\<close>\\<open>x\\<in>A\\<close> have \"{x}={x,y}\\<inter>A\" by auto\n      with \\<open>A\\<in>T\\<close> have \"{x}\\<in>(T{restricted to}{x,y})\" unfolding RestrictedTo_def by auto\n      ultimately have \"\\<exists>U\\<in>(T{restricted to}{x,y}). (b1\\<in>U\\<and>b2\\<notin>U) \\<or> (b2\\<in>U\\<and>b1\\<notin>U)\" by auto\n    }\n    then have \"(T{restricted to}{x,y}){is T\\<^sub>0}\" using isT0_def by auto\n    ultimately have \"{x,y}\\<lesssim>1\" using reg by auto\n    moreover\n    have \"x\\<in>{x,y}\" by auto\n    ultimately have \"{x,y}={x}\" using lepoll_1_is_sing[of \"{x,y}\"\"x\"] by auto\n    moreover\n    have \"y\\<in>{x,y}\" by auto\n    ultimately have \"y\\<in>{x}\" by auto\n    then have \"y=x\" by auto\n    with \\<open>x\\<noteq>y\\<close> have \"False\" by auto\n  }\n  then have \"T\\<subseteq>{0,\\<Union>T}\" by auto\n  moreover\n  from topSpaceAssum have \"0\\<in>T\"\"\\<Union>T\\<in>T\" using IsATopology_def empty_open by auto\n  ultimately show \"T={0,\\<Union>T}\" by auto\nqed\n\nlemma indiscrete_spectrum:\n  shows \"(A {is in the spectrum of}(\\<lambda>T. T={0,\\<Union>T})) \\<longleftrightarrow> A\\<lesssim>1\"\nproof\n  assume \"(A {is in the spectrum of}(\\<lambda>T. T={0,\\<Union>T}))\"\n  then have reg:\"\\<forall>T. ((T{is a topology} \\<and> \\<Union>T\\<approx>A) \\<longrightarrow> T ={0,\\<Union>T})\" using Spec_def by auto\n  moreover\n  have \"\\<Union>Pow(A)=A\" by auto\n  then have \"\\<Union>Pow(A)\\<approx>A\" by auto\n  moreover\n  have \"Pow(A) {is a topology}\" using Pow_is_top by auto\n  ultimately have P:\"Pow(A)={0,A}\" by auto\n  {\n    assume \"A\\<noteq>0\"\n    then obtain x where \"x\\<in>A\" by blast\n    then have \"{x}\\<in>Pow(A)\" by auto\n    with P have \"{x}=A\" by auto\n    then have \"A\\<approx>1\" using singleton_eqpoll_1 by auto\n    then have \"A\\<lesssim>1\" using eqpoll_imp_lepoll by auto\n  }\n  moreover\n  {\n    assume \"A=0\"\n    then have \"A\\<approx>0\" by auto\n    then have \"A\\<lesssim>1\" using empty_lepollI eq_lepoll_trans by auto\n  }\n  ultimately show \"A\\<lesssim>1\" by auto\nnext\n  assume \"A\\<lesssim>1\"\n  {\n    fix T\n    assume \"T{is a topology}\"\"\\<Union>T\\<approx>A\"\n    {\n      assume \"A=0\"\n      with \\<open>\\<Union>T\\<approx>A\\<close> have \"\\<Union>T\\<approx>0\" by auto\n      then have \"\\<Union>T=0\" using eqpoll_0_is_0 by auto\n      then have \"T\\<subseteq>{0}\" by auto\n      with \\<open>T{is a topology}\\<close> have \"T={0}\" using empty_open by auto\n      then have \"T={0,\\<Union>T}\" by auto\n    }\n    moreover\n    {\n      assume \"A\\<noteq>0\"\n      then obtain E where \"E\\<in>A\" by blast\n      with \\<open>A\\<lesssim>1\\<close> have \"A={E}\" using lepoll_1_is_sing by auto\n      then have \"A\\<approx>1\" using singleton_eqpoll_1 by auto\n      with \\<open>\\<Union>T\\<approx>A\\<close> have NONempty:\"\\<Union>T\\<approx>1\" using eqpoll_trans by blast\n      then have \"\\<Union>T\\<lesssim>1\" using eqpoll_imp_lepoll by auto\n      moreover\n      {\n        assume \"\\<Union>T=0\"\n        then have \"0\\<approx>\\<Union>T\" by auto\n        with NONempty have \"0\\<approx>1\" using eqpoll_trans by blast\n        then have \"0=1\" using eqpoll_0_is_0 eqpoll_sym by auto\n        then have \"False\" by auto\n      }\n      then have \"\\<Union>T\\<noteq>0\" by auto\n      then obtain R where \"R\\<in>\\<Union>T\" by blast\n      ultimately have \"\\<Union>T={R}\" using lepoll_1_is_sing by auto\n      moreover\n      have \"T\\<subseteq>Pow(\\<Union>T)\" by auto\n      ultimately have \"T\\<subseteq>Pow({R})\" by auto\n      then have \"T\\<subseteq>{0,{R}}\" by blast\n      moreover\n      with \\<open>T{is a topology}\\<close> have \"0\\<in>T\"\"\\<Union>T\\<in>T\" using IsATopology_def by auto\n      moreover\n      note \\<open>\\<Union>T={R}\\<close>\n      ultimately have \"T={0,\\<Union>T}\" by auto\n    }\n    ultimately have \"T={0,\\<Union>T}\" by auto\n  }\n  then show \"A {is in the spectrum of}(\\<lambda>T. T={0,\\<Union>T})\" using Spec_def by auto\nqed\n\ntheorem (in topology0) anti_indiscrete:\n  shows \"(T{is anti-}(\\<lambda>T. T={0,\\<Union>T})) \\<longleftrightarrow> T{is T\\<^sub>0}\"\nproof\n  assume \"T{is T\\<^sub>0}\"\n  {\n    fix A\n    assume \"A\\<in>Pow(\\<Union>T)\"\"T{restricted to}A={0,\\<Union>(T{restricted to}A)}\"\n    then have un:\"\\<Union>(T{restricted to}A)=A\" \"T{restricted to}A={0,A}\" using RestrictedTo_def by auto\n    from \\<open>T{is T\\<^sub>0}\\<close>\\<open>A\\<in>Pow(\\<Union>T)\\<close> have \"(T{restricted to}A){is T\\<^sub>0}\" using T0_here by auto\n    {\n      assume \"A=0\"\n      then have \"A\\<approx>0\" by auto\n      then have \"A\\<lesssim>1\" using empty_lepollI eq_lepoll_trans by auto\n    }\n    moreover\n    {\n      assume \"A\\<noteq>0\"\n      then obtain E where \"E\\<in>A\" by blast\n      {\n        fix y\n        assume \"y\\<in>A\"\"y\\<noteq>E\"\n        with \\<open>E\\<in>A\\<close> un have \"y\\<in>\\<Union>(T{restricted to}A)\"\"E\\<in>\\<Union>(T{restricted to}A)\" by auto\n        with \\<open>(T{restricted to}A){is T\\<^sub>0}\\<close>\\<open>y\\<noteq>E\\<close> have \"\\<exists>U\\<in>(T{restricted to}A). (E\\<in>U\\<and>y\\<notin>U)\\<or>(E\\<notin>U\\<and>y\\<in>U)\"\n          unfolding isT0_def by blast\n        then obtain U where \"U\\<in>(T{restricted to}A)\" \"(E\\<in>U\\<and>y\\<notin>U)\\<or>(E\\<notin>U\\<and>y\\<in>U)\" by auto\n        with \\<open>T{restricted to}A={0,A}\\<close> have \"U=0\\<or>U=A\" by auto\n        with \\<open>(E\\<in>U\\<and>y\\<notin>U)\\<or>(E\\<notin>U\\<and>y\\<in>U)\\<close>\\<open>y\\<in>A\\<close>\\<open>E\\<in>A\\<close> have \"False\" by auto\n      }\n      then have \"\\<forall>y\\<in>A. y=E\" by auto\n      with \\<open>E\\<in>A\\<close> have \"A={E}\" by blast\n      then have \"A\\<approx>1\" using singleton_eqpoll_1 by auto\n      then have \"A\\<lesssim>1\" using eqpoll_imp_lepoll by auto\n    }\n    ultimately have \"A\\<lesssim>1\" by auto\n    then have \"A{is in the spectrum of}(\\<lambda>T. T={0,\\<Union>T})\" using indiscrete_spectrum by auto\n  }\n  then show \"T{is anti-}(\\<lambda>T. T={0,\\<Union>T})\" unfolding antiProperty_def by auto\nnext\n  assume \"T{is anti-}(\\<lambda>T. T={0,\\<Union>T})\"\n  then have \"\\<forall>A\\<in>Pow(\\<Union>T). (T{restricted to}A)={0,\\<Union>(T{restricted to}A)} \\<longrightarrow> (A {is in the spectrum of} (\\<lambda>T. T={0,\\<Union>T}))\" using antiProperty_def by auto\n  then have \"\\<forall>A\\<in>Pow(\\<Union>T). (T{restricted to}A)={0,\\<Union>(T{restricted to}A)} \\<longrightarrow> A\\<lesssim>1\" using indiscrete_spectrum by auto\n  moreover\n  have \"\\<forall>A\\<in>Pow(\\<Union>T). \\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def by auto\n  ultimately have reg:\"\\<forall>A\\<in>Pow(\\<Union>T). (T{restricted to}A)={0,A} \\<longrightarrow> A\\<lesssim>1\" by auto\n  {\n    fix x y\n    assume \"x\\<in>\\<Union>T\"\"y\\<in>\\<Union>T\"\"x\\<noteq>y\"\n    {\n      assume \"\\<forall>U\\<in>T. (x\\<in>U\\<and>y\\<in>U)\\<or>(x\\<notin>U\\<and>y\\<notin>U)\"\n      then have \"T{restricted to}{x,y}\\<subseteq>{0,{x,y}}\" unfolding RestrictedTo_def by auto\n      moreover\n      from \\<open>x\\<in>\\<Union>T\\<close>\\<open>y\\<in>\\<Union>T\\<close> have emp:\"0\\<in>T\"\"{x,y}\\<inter>0=0\" and tot: \"{x,y}={x,y}\\<inter>\\<Union>T\" \"\\<Union>T\\<in>T\" using topSpaceAssum empty_open IsATopology_def by auto\n      from emp have \"0\\<in>T{restricted to}{x,y}\" unfolding RestrictedTo_def by auto\n      moreover\n      from tot have \"{x,y}\\<in>T{restricted to}{x,y}\" unfolding RestrictedTo_def by auto\n      ultimately have \"T{restricted to}{x,y}={0,{x,y}}\" by auto\n      with reg \\<open>x\\<in>\\<Union>T\\<close>\\<open>y\\<in>\\<Union>T\\<close> have \"{x,y}\\<lesssim>1\" by auto\n      moreover\n      have \"x\\<in>{x,y}\" by auto\n      ultimately have \"{x,y}={x}\" using lepoll_1_is_sing[of \"{x,y}\"\"x\"] by auto\n      moreover\n      have \"y\\<in>{x,y}\" by auto\n      ultimately have \"y\\<in>{x}\" by auto\n      then have \"y=x\" by auto\n      then have \"False\" using \\<open>x\\<noteq>y\\<close> by auto\n    }\n    then have \"\\<exists>U\\<in>T. (x\\<notin>U\\<or>y\\<notin>U)\\<and>(x\\<in>U\\<or>y\\<in>U)\" by auto\n    then have \"\\<exists>U\\<in>T. (x\\<in>U\\<and>y\\<notin>U)\\<or>(x\\<notin>U\\<and>y\\<in>U)\" by auto\n  }\n  then have \"\\<forall>x y. x\\<in>\\<Union>T\\<and>y\\<in>\\<Union>T\\<and> x\\<noteq>y \\<longrightarrow> (\\<exists>U\\<in>T. (x\\<in>U\\<and>y\\<notin>U)\\<or>(y\\<in>U\\<and>x\\<notin>U))\" by auto\n  then show \"T {is T\\<^sub>0}\" using isT0_def by auto\nqed\n\ntext\\<open>The conclusion is that being $T_0$ is just the opposite to being indiscrete.\\<close>\n\ntext\\<open>Next, let's compute the anti-$T_i$ for $i=1,\\ 2,\\ 3$ or $4$. Surprisingly, \nthey are all the same. Meaning, that the total negation of $T_1$ is enough\nto negate all of these axioms.\\<close>\n\ntheorem anti_T1:\n  shows \"(T{is anti-}isT1) \\<longleftrightarrow> (IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\"\nproof\n  assume \"T{is anti-}isT1\"\n  let ?r=\"{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}\"\n  have \"antisym(?r)\" unfolding antisym_def by auto\n  moreover\n  have \"trans(?r)\" unfolding trans_def by auto\n  moreover\n  {\n    fix A B\n    assume \"A\\<in>T\"\"B\\<in>T\"\n    {\n      assume \"\\<not>(A\\<subseteq>B\\<or>B\\<subseteq>A)\"\n      then have \"A-B\\<noteq>0\"\"B-A\\<noteq>0\" by auto\n      then obtain x y where \"x\\<in>A\"\"x\\<notin>B\"\"y\\<in>B\"\"y\\<notin>A\" \"x\\<noteq>y\" by blast\n      then have \"{x,y}\\<inter>A={x}\"\"{x,y}\\<inter>B={y}\" by auto\n      moreover\n      from \\<open>A\\<in>T\\<close>\\<open>B\\<in>T\\<close> have \"{x,y}\\<inter>A\\<in>T{restricted to}{x,y}\"\"{x,y}\\<inter>B\\<in>T{restricted to}{x,y}\" unfolding\n        RestrictedTo_def by auto\n      ultimately have open_set:\"{x}\\<in>T{restricted to}{x,y}\"\"{y}\\<in>T{restricted to}{x,y}\" by auto\n      have \"x\\<in>\\<Union>T\"\"y\\<in>\\<Union>T\" using \\<open>A\\<in>T\\<close>\\<open>B\\<in>T\\<close>\\<open>x\\<in>A\\<close>\\<open>y\\<in>B\\<close> by auto\n      then have sub:\"{x,y}\\<in>Pow(\\<Union>T)\" by auto\n      then have tot:\"\\<Union>(T{restricted to}{x,y})={x,y}\" unfolding RestrictedTo_def by auto\n      {\n        fix s t\n        assume \"s\\<in>\\<Union>(T{restricted to}{x,y})\"\"t\\<in>\\<Union>(T{restricted to}{x,y})\"\"s\\<noteq>t\"\n        with tot have \"s\\<in>{x,y}\"\"t\\<in>{x,y}\"\"s\\<noteq>t\" by auto\n        then have \"(s=x\\<and>t=y)\\<or>(s=y\\<and>t=x)\" by auto\n        with open_set have \"\\<exists>U\\<in>(T{restricted to}{x,y}). s\\<in>U\\<and>t\\<notin>U\" using \\<open>x\\<noteq>y\\<close> by auto\n      }\n      then have \"(T{restricted to}{x,y}){is T\\<^sub>1}\" unfolding isT1_def by auto\n      with sub \\<open>T{is anti-}isT1\\<close> tot have \"{x,y} {is in the spectrum of}isT1\" using antiProperty_def\n        by auto\n      then have \"{x,y}\\<lesssim>1\" using T1_spectrum by auto\n      moreover\n      have \"x\\<in>{x,y}\" by auto\n      ultimately have \"{x}={x,y}\" using lepoll_1_is_sing[of \"{x,y}\"\"x\"] by auto\n      moreover\n      have \"y\\<in>{x,y}\" by auto\n      ultimately\n      have \"y\\<in>{x}\" by auto\n      then have \"x=y\" by auto\n      then have \"False\" using \\<open>x\\<in>A\\<close>\\<open>y\\<notin>A\\<close> by auto\n    }\n    then have \"A\\<subseteq>B\\<or>B\\<subseteq>A\" by auto\n  }\n  then have \"?r {is total on}T\" using IsTotal_def by auto\n  ultimately\n  show \"IsLinOrder(T,?r)\" using IsLinOrder_def by auto\nnext\n  assume \"IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})\"\n  then have ordTot:\"\\<forall>S\\<in>T. \\<forall>B\\<in>T. S\\<subseteq>B\\<or>B\\<subseteq>S\" unfolding IsLinOrder_def IsTotal_def by auto\n  {\n    fix A\n    assume \"A\\<in>Pow(\\<Union>T)\" and T1:\"(T{restricted to}A) {is T\\<^sub>1}\"\n    then have tot:\"\\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def by auto\n    {\n      fix U V\n      assume \"U\\<in>T{restricted to}A\"\"V\\<in>T{restricted to}A\"\n      then obtain AU AV where \"AU\\<in>T\"\"AV\\<in>T\"\"U=A\\<inter>AU\"\"V=A\\<inter>AV\" unfolding RestrictedTo_def by auto\n      with ordTot have \"U\\<subseteq>V\\<or>V\\<subseteq>U\" by auto\n    }\n    then have ordTotSub:\"\\<forall>S\\<in>T{restricted to}A. \\<forall>B\\<in>T{restricted to}A. S\\<subseteq>B\\<or>B\\<subseteq>S\" by auto\n    {\n      assume \"A=0\"\n      then have \"A\\<approx>0\" by auto\n      moreover\n      have \"0\\<lesssim>1\" using empty_lepollI by auto\n      ultimately have \"A\\<lesssim>1\" using eq_lepoll_trans by auto\n      then have \"A{is in the spectrum of}isT1\" using T1_spectrum by auto\n    }\n    moreover\n    {\n      assume \"A\\<noteq>0\"\n      then obtain t where \"t\\<in>A\" by blast\n      {\n        fix y\n        assume \"y\\<in>A\"\"y\\<noteq>t\"\n        with \\<open>t\\<in>A\\<close> tot T1 obtain U where \"U\\<in>(T{restricted to}A)\"\"y\\<in>U\"\"t\\<notin>U\" unfolding isT1_def\n          by auto\n        from \\<open>y\\<noteq>t\\<close> have \"t\\<noteq>y\" by auto\n        with \\<open>y\\<in>A\\<close>\\<open>t\\<in>A\\<close> tot T1 obtain V where \"V\\<in>(T{restricted to}A)\"\"t\\<in>V\"\"y\\<notin>V\" unfolding isT1_def\n          by auto\n        with \\<open>y\\<in>U\\<close>\\<open>t\\<notin>U\\<close> have \"\\<not>(U\\<subseteq>V\\<or>V\\<subseteq>U)\" by auto\n        with ordTotSub \\<open>U\\<in>(T{restricted to}A)\\<close>\\<open>V\\<in>(T{restricted to}A)\\<close> have \"False\" by auto\n      }\n      then have \"\\<forall>y\\<in>A. y=t\" by auto\n      with \\<open>t\\<in>A\\<close> have \"A={t}\" by blast\n      then have \"A\\<approx>1\" using singleton_eqpoll_1 by auto\n      then have \"A\\<lesssim>1\" using eqpoll_imp_lepoll by auto\n      then have \"A{is in the spectrum of}isT1\" using T1_spectrum by auto\n    }\n    ultimately\n    have \"A{is in the spectrum of}isT1\" by auto\n  }\n  then show \"T{is anti-}isT1\" using antiProperty_def by auto\nqed\n\ncorollary linordtop_here:\n  shows \"(\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})){is hereditary}\"\n  using anti_T1 anti_here[of \"isT1\"] by auto\n\ntheorem (in topology0) anti_T4:\n  shows \"(T{is anti-}isT4) \\<longleftrightarrow> (IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\"\nproof\n  assume \"T{is anti-}isT4\"\n  let ?r=\"{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}\"\n  have \"antisym(?r)\" unfolding antisym_def by auto\n  moreover\n  have \"trans(?r)\" unfolding trans_def by auto\n  moreover\n  {\n    fix A B\n    assume \"A\\<in>T\"\"B\\<in>T\"\n    {\n      assume \"\\<not>(A\\<subseteq>B\\<or>B\\<subseteq>A)\"\n      then have \"A-B\\<noteq>0\"\"B-A\\<noteq>0\" by auto\n      then obtain x y where \"x\\<in>A\"\"x\\<notin>B\"\"y\\<in>B\"\"y\\<notin>A\" \"x\\<noteq>y\" by blast\n      then have \"{x,y}\\<inter>A={x}\"\"{x,y}\\<inter>B={y}\" by auto\n      moreover\n      from \\<open>A\\<in>T\\<close>\\<open>B\\<in>T\\<close> have \"{x,y}\\<inter>A\\<in>T{restricted to}{x,y}\"\"{x,y}\\<inter>B\\<in>T{restricted to}{x,y}\" unfolding\n        RestrictedTo_def by auto\n      ultimately have open_set:\"{x}\\<in>T{restricted to}{x,y}\"\"{y}\\<in>T{restricted to}{x,y}\" by auto\n      have \"x\\<in>\\<Union>T\"\"y\\<in>\\<Union>T\" using \\<open>A\\<in>T\\<close>\\<open>B\\<in>T\\<close>\\<open>x\\<in>A\\<close>\\<open>y\\<in>B\\<close> by auto\n      then have sub:\"{x,y}\\<in>Pow(\\<Union>T)\" by auto\n      then have tot:\"\\<Union>(T{restricted to}{x,y})={x,y}\" unfolding RestrictedTo_def by auto\n      {\n        fix s t\n        assume \"s\\<in>\\<Union>(T{restricted to}{x,y})\"\"t\\<in>\\<Union>(T{restricted to}{x,y})\"\"s\\<noteq>t\"\n        with tot have \"s\\<in>{x,y}\"\"t\\<in>{x,y}\"\"s\\<noteq>t\" by auto\n        then have \"(s=x\\<and>t=y)\\<or>(s=y\\<and>t=x)\" by auto\n        with open_set have \"\\<exists>U\\<in>(T{restricted to}{x,y}). s\\<in>U\\<and>t\\<notin>U\" using \\<open>x\\<noteq>y\\<close> by auto\n      }\n      then have \"(T{restricted to}{x,y}){is T\\<^sub>1}\" unfolding isT1_def by auto\n      moreover\n      {\n        fix s\n        assume AS:\"s{is closed in}(T{restricted to}{x,y})\"\n        {\n          fix t\n          assume AS2:\"t{is closed in}(T{restricted to}{x,y})\"\"s\\<inter>t=0\"\n          have \"(T{restricted to}{x,y}){is a topology}\" using Top_1_L4 by auto\n          with tot have \"0\\<in>(T{restricted to}{x,y})\"\"{x,y}\\<in>(T{restricted to}{x,y})\" using empty_open\n            union_open[where \\<A>=\"T{restricted to}{x,y}\"] by auto\n          moreover\n          note open_set\n          moreover\n          have \"T{restricted to}{x,y}\\<subseteq>Pow(\\<Union>(T{restricted to}{x,y}))\" by blast\n          with tot have \"T{restricted to}{x,y}\\<subseteq>Pow({x,y})\" by auto\n          ultimately have \"T{restricted to}{x,y}={0,{x},{y},{x,y}}\" by blast\n          moreover have \"{0,{x},{y},{x,y}}=Pow({x,y})\" by blast\n          ultimately have P:\"T{restricted to}{x,y}=Pow({x,y})\" by simp\n          with tot have \"{A\\<in>Pow({x,y}). A{is closed in}(T{restricted to}{x,y})}={A \\<in> Pow({x, y}) . A \\<subseteq> {x, y} \\<and> {x, y} - A \\<in> Pow({x, y})}\" using IsClosed_def by simp\n          with P have S:\"{A\\<in>Pow({x,y}). A{is closed in}(T{restricted to}{x,y})}=T{restricted to}{x,y}\" by auto\n          from AS AS2(1) have \"s\\<in>Pow({x,y})\" \"t\\<in>Pow({x,y})\" using IsClosed_def tot by auto\n          moreover\n          note AS2(1) AS\n          ultimately have \"s\\<in>{A\\<in>Pow({x,y}). A{is closed in}(T{restricted to}{x,y})}\"\"t\\<in>{A\\<in>Pow({x,y}). A{is closed in}(T{restricted to}{x,y})}\"\n            by auto\n          with S AS2(2) have \"s\\<in>T{restricted to}{x,y}\" \"t\\<in>T{restricted to}{x,y}\"\"s\\<inter>t=0\" by auto\n          then have \"\\<exists>U\\<in>(T{restricted to}{x,y}). \\<exists>V\\<in>(T{restricted to}{x,y}). s\\<subseteq>U\\<and>t\\<subseteq>V\\<and>U\\<inter>V=0\" by auto\n        }\n        then have \"\\<forall>t. t{is closed in}(T{restricted to}{x,y})\\<and>s\\<inter>t=0 \\<longrightarrow> (\\<exists>U\\<in>(T{restricted to}{x,y}). \\<exists>V\\<in>(T{restricted to}{x,y}). s\\<subseteq>U\\<and>t\\<subseteq>V\\<and>U\\<inter>V=0)\"\n          by auto\n      }\n      then have \"\\<forall>s. s{is closed in}(T{restricted to}{x,y}) \\<longrightarrow> (\\<forall>t. t{is closed in}(T{restricted to}{x,y})\\<and>s\\<inter>t=0 \\<longrightarrow> (\\<exists>U\\<in>(T{restricted to}{x,y}). \\<exists>V\\<in>(T{restricted to}{x,y}). s\\<subseteq>U\\<and>t\\<subseteq>V\\<and>U\\<inter>V=0))\"\n        by auto\n      then have \"(T{restricted to}{x,y}){is normal}\" using IsNormal_def by auto\n      ultimately have \"(T{restricted to}{x,y}){is T\\<^sub>4}\" using isT4_def by auto\n      with sub \\<open>T{is anti-}isT4\\<close> tot have \"{x,y} {is in the spectrum of}isT4\" using antiProperty_def\n        by auto\n      then have \"{x,y}\\<lesssim>1\" using T4_spectrum by auto\n      moreover\n      have \"x\\<in>{x,y}\" by auto\n      ultimately have \"{x}={x,y}\" using lepoll_1_is_sing[of \"{x,y}\"\"x\"] by auto\n      moreover\n      have \"y\\<in>{x,y}\" by auto\n      ultimately\n      have \"y\\<in>{x}\" by auto\n      then have \"x=y\" by auto\n      then have \"False\" using \\<open>x\\<in>A\\<close>\\<open>y\\<notin>A\\<close> by auto\n    }\n    then have \"A\\<subseteq>B\\<or>B\\<subseteq>A\" by auto\n  }\n  then have \"?r {is total on}T\" using IsTotal_def by auto\n  ultimately\n  show \"IsLinOrder(T,?r)\" using IsLinOrder_def by auto\nnext\n  assume \"IsLinOrder(T, {\\<langle>U,V\\<rangle> \\<in> Pow(\\<Union>T) \\<times> Pow(\\<Union>T) . U \\<subseteq> V})\"\n  then have \"T{is anti-}isT1\" using anti_T1 by auto\n  moreover\n  have \"\\<forall>T. T{is a topology} \\<longrightarrow> (T{is T\\<^sub>4}) \\<longrightarrow> (T{is T\\<^sub>1})\" using topology0.T4_is_T3 \n    topology0.T3_is_T2 T2_is_T1 topology0_def by auto\n  moreover\n  have \" \\<forall>A. (A {is in the spectrum of} isT1) \\<longrightarrow> (A {is in the spectrum of} isT4)\" using T1_spectrum T4_spectrum\n    by auto\n  ultimately show \"T{is anti-}isT4\" using eq_spect_rev_imp_anti[of \"isT4\"\"isT1\"] by auto\nqed\n\ntheorem (in topology0) anti_T3:\n  shows \"(T{is anti-}isT3) \\<longleftrightarrow> (IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\"\nproof\n  assume \"T{is anti-}isT3\"\n  moreover\n  have \"\\<forall>T. T{is a topology} \\<longrightarrow> (T{is T\\<^sub>4}) \\<longrightarrow> (T{is T\\<^sub>3})\" using topology0.T4_is_T3 \n    topology0_def by auto\n  moreover\n  have \" \\<forall>A. (A {is in the spectrum of} isT3) \\<longrightarrow> (A {is in the spectrum of} isT4)\" using T3_spectrum T4_spectrum\n    by auto\n  ultimately have \"T{is anti-}isT4\" using eq_spect_rev_imp_anti[of \"isT4\"\"isT3\"] by auto\n  then show \"IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})\" using anti_T4 by auto\nnext\n  assume \"IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})\"\n  then have \"T{is anti-}isT1\" using anti_T1 by auto\n  moreover\n  have \"\\<forall>T. T{is a topology} \\<longrightarrow> (T{is T\\<^sub>3}) \\<longrightarrow> (T{is T\\<^sub>1})\" using\n    topology0.T3_is_T2 T2_is_T1 topology0_def by auto\n  moreover\n  have \" \\<forall>A. (A {is in the spectrum of} isT1) \\<longrightarrow> (A {is in the spectrum of} isT3)\" using T1_spectrum T3_spectrum\n    by auto\n  ultimately show \"T{is anti-}isT3\" using eq_spect_rev_imp_anti[of \"isT3\"\"isT1\"] by auto\nqed\n\ntheorem (in topology0) anti_T2:\n  shows \"(T{is anti-}isT2) \\<longleftrightarrow> (IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\"\nproof\n  assume \"T{is anti-}isT2\"\n  moreover\n  have \"\\<forall>T. T{is a topology} \\<longrightarrow> (T{is T\\<^sub>4}) \\<longrightarrow> (T{is T\\<^sub>2})\" using topology0.T4_is_T3 \n    topology0.T3_is_T2 topology0_def by auto\n  moreover\n  have \" \\<forall>A. (A {is in the spectrum of} isT2) \\<longrightarrow> (A {is in the spectrum of} isT4)\" using T2_spectrum T4_spectrum\n    by auto\n  ultimately have \"T{is anti-}isT4\" using eq_spect_rev_imp_anti[of \"isT4\"\"isT2\"] by auto\n  then show \"IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})\" using anti_T4 by auto\nnext\n  assume \"IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})\"\n  then have \"T{is anti-}isT1\" using anti_T1 by auto\n  moreover\n  have \"\\<forall>T. T{is a topology} \\<longrightarrow> (T{is T\\<^sub>2}) \\<longrightarrow> (T{is T\\<^sub>1})\" using T2_is_T1 by auto\n  moreover\n  have \" \\<forall>A. (A {is in the spectrum of} isT1) \\<longrightarrow> (A {is in the spectrum of} isT2)\" using T1_spectrum T2_spectrum\n    by auto\n  ultimately show \"T{is anti-}isT2\" using eq_spect_rev_imp_anti[of \"isT2\"\"isT1\"] by auto\nqed\n\nlemma linord_spectrum:\n  shows \"(A{is in the spectrum of}(\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))) \\<longleftrightarrow> A\\<lesssim>1\"\nproof\n  assume \"A{is in the spectrum of}(\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\"\n  then have reg:\"\\<forall>T. T{is a topology}\\<and> \\<Union>T\\<approx>A \\<longrightarrow> IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})\"\n    using Spec_def by auto\n  {\n    assume \"A=0\"\n    moreover\n    have \"0\\<lesssim>1\" using empty_lepollI by auto\n    ultimately have \"A\\<lesssim>1\" using eq_lepoll_trans by auto\n  }\n  moreover\n  { \n    assume \"A\\<noteq>0\"\n    then obtain x where \"x\\<in>A\" by blast\n    moreover\n    {\n      fix y\n      assume \"y\\<in>A\"\n      have \"Pow(A) {is a topology}\" using Pow_is_top by auto\n      moreover\n      have \"\\<Union>Pow(A)=A\" by auto\n      then have \"\\<Union>Pow(A)\\<approx>A\" by auto\n      note reg\n      ultimately have \"IsLinOrder(Pow(A),{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>Pow(A))\\<times>Pow(\\<Union>Pow(A)). U\\<subseteq>V})\" by auto\n      then have \"IsLinOrder(Pow(A),{\\<langle>U,V\\<rangle>\\<in>Pow(A)\\<times>Pow(A). U\\<subseteq>V})\" by auto\n      with \\<open>x\\<in>A\\<close>\\<open>y\\<in>A\\<close> have \"{x}\\<subseteq>{y}\\<or>{y}\\<subseteq>{x}\" unfolding IsLinOrder_def IsTotal_def by auto\n      then have \"x=y\" by auto\n    }\n    ultimately have \"A={x}\" by blast\n    then have \"A\\<approx>1\" using singleton_eqpoll_1 by auto\n    then have \"A\\<lesssim>1\" using eqpoll_imp_lepoll by auto\n  }\n  ultimately show \"A\\<lesssim>1\" by auto\nnext\n  assume \"A\\<lesssim>1\"\n  then have ind:\"A{is in the spectrum of}(\\<lambda>T. T={0,\\<Union>T})\" using indiscrete_spectrum by auto\n  {\n    fix T\n    assume AS:\"T{is a topology}\" \"T={0,\\<Union>T}\"\n    have \"trans({\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})\" unfolding trans_def by auto\n    moreover\n    have \"antisym({\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})\" unfolding antisym_def by auto\n    moreover\n    have \"{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}{is total on}T\"\n    proof-\n      {\n        fix aa b\n        assume \"aa\\<in>T\"\"b\\<in>T\"\n        with AS(2) have \"aa\\<in>{0,\\<Union>T}\"\"b\\<in>{0,\\<Union>T}\" by auto\n        then have \"aa=0\\<or>aa=\\<Union>T\"\"b=0\\<or>b=\\<Union>T\" by auto\n        then have \"aa\\<subseteq>b\\<or>b\\<subseteq>aa\" by auto\n        then have \"\\<langle>aa, b\\<rangle> \\<in> Collect(Pow(\\<Union>T) \\<times> Pow(\\<Union>T), split((\\<subseteq>))) \\<or> \\<langle>b, aa\\<rangle> \\<in> Collect(Pow(\\<Union>T) \\<times> Pow(\\<Union>T), split((\\<subseteq>)))\"\n        using \\<open>aa\\<in>T\\<close>\\<open>b\\<in>T\\<close> by auto\n      }\n      then show ?thesis using IsTotal_def by auto\n    qed\n    ultimately have \"IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})\" unfolding IsLinOrder_def by auto\n  }\n  then have \" \\<forall>T. T {is a topology} \\<longrightarrow> T = {0, \\<Union>T} \\<longrightarrow> IsLinOrder(T, {\\<langle>U,V\\<rangle> \\<in> Pow(\\<Union>T) \\<times> Pow(\\<Union>T) . U \\<subseteq> V})\" by auto\n  then show \"A{is in the spectrum of}(\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\"\n    using P_imp_Q_spec_inv[of \"\\<lambda>T. T={0,\\<Union>T}\"\"\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V})\"]\n    ind by auto\nqed\n\ntheorem (in topology0) anti_linord:\n  shows \"(T{is anti-}(\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))) \\<longleftrightarrow> T{is T\\<^sub>1}\"\nproof\n  assume AS:\"T{is anti-}(\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\"\n  {\n    assume \"\\<not>(T{is T\\<^sub>1})\"\n    then obtain x y where \"x\\<in>\\<Union>T\"\"y\\<in>\\<Union>T\"\"x\\<noteq>y\"\"\\<forall>U\\<in>T. x\\<notin>U\\<or>y\\<in>U\" unfolding isT1_def by auto\n    {\n      assume \"{x}\\<in>T{restricted to}{x,y}\"\n      then obtain U where \"U\\<in>T\" \"{x}={x,y}\\<inter>U\" unfolding RestrictedTo_def by auto\n      moreover\n      have \"x\\<in>{x}\" by auto\n      ultimately have \"U\\<in>T\"\"x\\<in>U\" by auto\n      moreover\n      {\n        assume \"y\\<in>U\"\n        then have \"y\\<in>{x,y}\\<inter>U\" by auto\n        with \\<open>{x}={x,y}\\<inter>U\\<close> have \"y\\<in>{x}\" by auto\n        with \\<open>x\\<noteq>y\\<close> have \"False\" by auto\n      }\n      then have \"y\\<notin>U\" by auto\n      moreover\n      note \\<open>\\<forall>U\\<in>T. x\\<notin>U\\<or>y\\<in>U\\<close>\n      ultimately have \"False\" by auto\n    }\n    then have \"{x}\\<notin>T{restricted to}{x,y}\" by auto\n    moreover\n    have tot:\"\\<Union>(T{restricted to}{x,y})={x,y}\" using \\<open>x\\<in>\\<Union>T\\<close>\\<open>y\\<in>\\<Union>T\\<close> unfolding RestrictedTo_def by auto\n    moreover\n    have \"T{restricted to}{x,y}\\<subseteq>Pow(\\<Union>(T{restricted to}{x,y}))\" by auto\n    ultimately have \"T{restricted to}{x,y}\\<subseteq>Pow({x,y})-{{x}}\" by auto\n    moreover\n    have \"Pow({x,y})={0,{x,y},{x},{y}}\" by blast\n    ultimately have \"T{restricted to}{x,y}\\<subseteq>{0,{x,y},{y}}\" by auto\n    moreover\n    have \"IsLinOrder({0,{x,y},{y}},{\\<langle>U,V\\<rangle>\\<in>Pow({x,y})\\<times>Pow({x,y}). U\\<subseteq>V})\"\n    proof-\n      have \"antisym(Collect(Pow({x, y}) \\<times> Pow({x, y}), split((\\<subseteq>))))\" using antisym_def by auto\n      moreover\n      have \"trans(Collect(Pow({x, y}) \\<times> Pow({x, y}), split((\\<subseteq>))))\" using trans_def by auto\n      moreover\n      have \"Collect(Pow({x, y}) \\<times> Pow({x, y}), split((\\<subseteq>))) {is total on} {0, {x, y}, {y}}\" using IsTotal_def by auto\n      ultimately show \"IsLinOrder({0,{x,y},{y}},{\\<langle>U,V\\<rangle>\\<in>Pow({x,y})\\<times>Pow({x,y}). U\\<subseteq>V})\" using IsLinOrder_def by auto\n    qed\n    ultimately have \"IsLinOrder(T{restricted to}{x,y},{\\<langle>U,V\\<rangle>\\<in>Pow({x,y})\\<times>Pow({x,y}). U\\<subseteq>V})\" using ord_linear_subset\n      by auto\n    with tot have \"IsLinOrder(T{restricted to}{x,y},{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>(T{restricted to}{x,y}))\\<times>Pow(\\<Union>(T{restricted to}{x,y})). U\\<subseteq>V})\"\n      by auto\n    then have \"IsLinOrder(T{restricted to}{x,y},Collect(Pow(\\<Union>(T {restricted to} {x,y})) \\<times> Pow(\\<Union>(T {restricted to} {x,y})), split((\\<subseteq>))))\" by auto\n    moreover\n    from \\<open>x\\<in>\\<Union>T\\<close>\\<open>y\\<in>\\<Union>T\\<close> have \"{x,y}\\<in>Pow(\\<Union>T)\" by auto\n    moreover\n    note AS\n    ultimately have \"{x,y}{is in the spectrum of}(\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\" unfolding antiProperty_def\n      by simp\n    then have \"{x,y}\\<lesssim>1\" using linord_spectrum by auto\n    moreover\n    have \"x\\<in>{x,y}\" by auto\n    ultimately have \"{x}={x,y}\" using lepoll_1_is_sing[of \"{x,y}\"\"x\"] by auto\n    moreover\n    have \"y\\<in>{x,y}\" by auto\n    ultimately\n    have \"y\\<in>{x}\" by auto\n    then have \"x=y\" by auto\n    then have \"False\" using \\<open>x\\<noteq>y\\<close> by auto\n  }\n  then show \"T {is T\\<^sub>1}\" by auto\nnext\n  assume T1:\"T {is T\\<^sub>1}\"\n  {\n    fix A\n    assume A_def:\"A\\<in>Pow(\\<Union>T)\"\"IsLinOrder((T{restricted to}A) ,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>(T{restricted to}A))\\<times>Pow(\\<Union>(T{restricted to}A)). U\\<subseteq>V})\"\n    {\n      fix x \n      assume AS1:\"x\\<in>A\"\n      {\n        fix y\n        assume AS:\"y\\<in>A\"\"x\\<noteq>y\"\n        with AS1 have \"{x,y}\\<in>Pow(\\<Union>T)\" using \\<open>A\\<in>Pow(\\<Union>T)\\<close> by auto\n        from \\<open>x\\<in>A\\<close>\\<open>y\\<in>A\\<close> have \"{x,y}\\<in>Pow(A)\" by auto\n        from \\<open>{x,y}\\<in>Pow(\\<Union>T)\\<close> have T11:\"(T{restricted to}{x,y}){is T\\<^sub>1}\" using T1_here T1 by auto\n        moreover\n        have tot:\"\\<Union>(T{restricted to}{x,y})={x,y}\" unfolding RestrictedTo_def using \\<open>{x,y}\\<in>Pow(\\<Union>T)\\<close> by auto\n        moreover\n        note AS(2) \n        ultimately obtain U where \"x\\<in>U\"\"y\\<notin>U\"\"U\\<in>(T{restricted to}{x,y})\" unfolding isT1_def by auto\n        moreover\n        from AS(2) tot T11 obtain V where \"y\\<in>V\"\"x\\<notin>V\"\"V\\<in>(T{restricted to}{x,y})\" unfolding isT1_def by auto\n        ultimately have \"x\\<in>U-V\"\"y\\<in>V-U\"\"U\\<in>(T{restricted to}{x,y})\"\"V\\<in>(T{restricted to}{x,y})\" by auto\n        then have \"\\<not>(U\\<subseteq>V\\<or>V\\<subseteq>U)\"\"U\\<in>(T{restricted to}{x,y})\"\"V\\<in>(T{restricted to}{x,y})\" by auto\n        then have \"\\<not>({\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>(T{restricted to}{x,y}))\\<times>Pow(\\<Union>(T{restricted to}{x,y})). U\\<subseteq>V} {is total on} (T{restricted to}{x,y}))\"\n          unfolding IsTotal_def by auto\n        then have \"\\<not>(IsLinOrder((T{restricted to}{x,y}),{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>(T{restricted to}{x,y}))\\<times>Pow(\\<Union>(T{restricted to}{x,y})). U\\<subseteq>V}))\"\n          unfolding IsLinOrder_def by auto\n        moreover\n        {\n          have \"(T{restricted to}A) {is a topology}\" using Top_1_L4 by auto\n          moreover\n          note A_def(2) linordtop_here\n          ultimately have \"\\<forall>B\\<in>Pow(\\<Union>(T{restricted to}A)). IsLinOrder((T{restricted to}A){restricted to}B ,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>((T{restricted to}A){restricted to}B))\\<times>Pow(\\<Union>((T{restricted to}A){restricted to}B)). U\\<subseteq>V})\"\n            unfolding IsHer_def by auto\n          moreover\n          have tot:\"\\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def using \\<open>A\\<in>Pow(\\<Union>T)\\<close> by auto\n          ultimately have  \"\\<forall>B\\<in>Pow(A). IsLinOrder((T{restricted to}A){restricted to}B ,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>((T{restricted to}A){restricted to}B))\\<times>Pow(\\<Union>((T{restricted to}A){restricted to}B)). U\\<subseteq>V})\" by auto\n          moreover\n          have \"\\<forall>B\\<in>Pow(A). (T{restricted to}A){restricted to}B=T{restricted to}B\" using subspace_of_subspace \\<open>A\\<in>Pow(\\<Union>T)\\<close> by auto\n          ultimately\n          have \"\\<forall>B\\<in>Pow(A). IsLinOrder((T{restricted to}B) ,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>((T{restricted to}A){restricted to}B))\\<times>Pow(\\<Union>((T{restricted to}A){restricted to}B)). U\\<subseteq>V})\" by auto\n          moreover\n          have \"\\<forall>B\\<in>Pow(A). \\<Union>((T{restricted to}A){restricted to}B)=B\" using \\<open>A\\<in>Pow(\\<Union>T)\\<close> unfolding RestrictedTo_def by auto\n          ultimately have \"\\<forall>B\\<in>Pow(A). IsLinOrder((T{restricted to}B) ,{\\<langle>U,V\\<rangle>\\<in>Pow(B)\\<times>Pow(B). U\\<subseteq>V})\" by auto\n          with \\<open>{x,y}\\<in>Pow(A)\\<close> have \"IsLinOrder((T{restricted to}{x,y}) ,{\\<langle>U,V\\<rangle>\\<in>Pow({x,y})\\<times>Pow({x,y}). U\\<subseteq>V})\" by auto\n        }\n        ultimately have \"False\" using tot by auto\n      }\n      then have \"A={x}\" using AS1 by auto\n      then have \"A\\<approx>1\" using singleton_eqpoll_1 by auto\n      then have \"A\\<lesssim>1\" using eqpoll_imp_lepoll by auto\n      then have \"A{is in the spectrum of}(\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\" using linord_spectrum\n        by auto\n    }\n    moreover\n    {\n      assume \"A=0\"\n      then have \"A\\<approx>0\" by auto\n      moreover\n      have \"0\\<lesssim>1\" using empty_lepollI by auto\n      ultimately have \"A\\<lesssim>1\" using eq_lepoll_trans by auto\n      then have \"A{is in the spectrum of}(\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\" using linord_spectrum\n        by auto\n    }\n    ultimately have \"A{is in the spectrum of}(\\<lambda>T. IsLinOrder(T,{\\<langle>U,V\\<rangle>\\<in>Pow(\\<Union>T)\\<times>Pow(\\<Union>T). U\\<subseteq>V}))\" by blast\n  }\n  then show \"T{is anti-}(\\<lambda>T. IsLinOrder(T, {\\<langle>U,V\\<rangle> \\<in> Pow(\\<Union>T) \\<times> Pow(\\<Union>T) . U \\<subseteq> V}))\" unfolding antiProperty_def\n    by auto\nqed\n\ntext\\<open>In conclusion, $T_1$ is also an anti-property.\\<close>\n\ntext\\<open>Let's define some anti-properties that we'll use in the future.\\<close>\n\ndefinition\n  IsAntiComp (\"_{is anti-compact}\")\n  where \"T{is anti-compact} \\<equiv> T{is anti-}(\\<lambda>T. (\\<Union>T){is compact in}T)\"\n\ndefinition\n  IsAntiLin (\"_{is anti-lindeloef}\")\n  where \"T{is anti-lindeloef} \\<equiv> T{is anti-}(\\<lambda>T. ((\\<Union>T){is lindeloef in}T))\"\n\ntext\\<open>Anti-compact spaces are also called pseudo-finite spaces in literature\nbefore the concept of anti-property was defined.\\<close>\n\nend\n\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/Topology_ZF_5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.6261241702517975, "lm_q1q2_score": 0.3495820168544029}}
{"text": "theory flash43Bra  imports flash43Rev\n \n  begin\nlemma onInv43:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv43 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv43 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv43 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash43Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.757794360334681, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.3493559153825312}}
{"text": "section \\<open>Host Properties\\<close>\n\ntheory Wasm_Axioms imports Wasm begin\n\n(* these were originally axioms, but memory now has a concrete representation in the model *)\nlemma mem_grow_size:\n  assumes \"mem_grow m n = m'\"\n  shows \"(mem_size m + (64000 * n)) = mem_size m'\"\n  using assms Abs_mem_inverse Abs_bytes_inverse\n  unfolding mem_grow_def mem_size_def mem_append_def bytes_replicate_def\n  by auto\n\nlemma load_size:\n  \"(load m n off l = None) = (mem_size m < (off + n + l))\"\n  unfolding load_def\n  by (cases \"n + off + l \\<le> mem_size m\") auto\n\nlemma load_packed_size:\n  \"(load_packed sx m n off lp l = None) = (mem_size m < (off + n + lp))\"\n  using load_size\n  unfolding load_packed_def\n  by (cases \"n + off + l \\<le> mem_size m\") auto  \n\nlemma store_size1:\n  \"(store m n off v l = None) = (mem_size m < (off + n + l))\"\n  unfolding store_def\n  by (cases \"n + off + l \\<le> mem_size m\") auto\n\nlemma store_size:\n  assumes \"(store m n off v l = Some m')\"\n  shows \"mem_size m = mem_size m'\"\n  using assms Abs_mem_inverse Abs_bytes_inverse\n  unfolding store_def write_bytes_def bytes_takefill_def\n  by (cases \"n + off + l \\<le> mem_size m\") (auto simp add: mem_size_def)\n\nlemma store_packed_size1:\n  \"(store_packed m n off v l = None) = (mem_size m < (off + n + l))\"\n  using store_size1\n  unfolding store_packed_def\n  by simp\n\nlemma store_packed_size:\n  assumes \"(store_packed m n off v l = Some m')\"\n  shows \"mem_size m = mem_size m'\"\n  using assms store_size\n  unfolding store_packed_def\n  by simp\n\naxiomatization where\n  wasm_deserialise_type:\"typeof (wasm_deserialise bs t) = t\"\n\naxiomatization where\n    host_apply_preserve_store:\" list_all2 types_agree t1s vs \\<Longrightarrow> host_apply s (t1s _> t2s) f vs hs = Some (s', vs') \\<Longrightarrow> store_extension s s'\"\nand host_apply_respect_type:\"list_all2 types_agree t1s vs \\<Longrightarrow> host_apply s (t1s _> t2s) f vs hs = Some (s', vs') \\<Longrightarrow> list_all2 types_agree t2s vs'\"\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/WebAssembly/Wasm_Axioms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6825737214979745, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3492843072252301}}
{"text": "(* Author: Andrew Boyton, 2012\n   Maintainers: Gerwin Klein <kleing at cse.unsw.edu.au>\n                Rafal Kolanski <rafal.kolanski at nicta.com.au>\n*)\n\nsection \"Instantiating capDL as a separation algebra.\"\n\ntheory Abstract_Separation_D\nimports \"../../Sep_Tactics\" Types_D \"../../Map_Extra\"\nbegin\n\n(**************************************\n * Start of lemmas to move elsewhere. *\n **************************************)\n\nlemma inter_empty_not_both:\n\"\\<lbrakk>x \\<in> A; A \\<inter> B = {}\\<rbrakk> \\<Longrightarrow> x \\<notin> B\"\n  by fastforce\n\nlemma union_intersection:\n  \"A \\<inter> (A \\<union> B) = A\"\n  \"B \\<inter> (A \\<union> B) = B\"\n  \"(A \\<union> B) \\<inter> A = A\"\n  \"(A \\<union> B) \\<inter> B = B\"\n  by fastforce+\n\nlemma union_intersection1: \"A \\<inter> (A \\<union> B) = A\"\n  by (rule inf_sup_absorb)\nlemma union_intersection2: \"B \\<inter> (A \\<union> B) = B\"\n  by fastforce\n\n(* This lemma is strictly weaker than restrict_map_disj. *)\nlemma restrict_map_disj':\n  \"S \\<inter> T = {} \\<Longrightarrow> h |` S \\<bottom> h' |` T\"\n  by (auto simp: map_disj_def restrict_map_def dom_def)\n\nlemma map_add_restrict_comm:\n  \"S \\<inter> T = {} \\<Longrightarrow> h |` S ++ h' |` T = h' |` T ++ h |` S\"\n  apply (drule restrict_map_disj')\n  apply (erule map_add_com)\n  done\n\n(************************************\n * End of lemmas to move elsewhere. *\n ************************************)\n\n\n\n(* The state for separation logic has:\n   * The memory heap.\n   * A function for which objects own which fields.\n     In capDL, we say that an object either owns all of its fields, or none of them.\n   These are both taken from the cdl_state.\n *)\n\ndatatype sep_state = SepState cdl_heap cdl_ghost_state\n\n(* Functions to get the heap and the ghost_state from the sep_state. *)\nprimrec sep_heap :: \"sep_state \\<Rightarrow> cdl_heap\"\nwhere  \"sep_heap (SepState h gs) = h\"\n\nprimrec sep_ghost_state :: \"sep_state \\<Rightarrow> cdl_ghost_state\"\nwhere  \"sep_ghost_state (SepState h gs) = gs\"\n\ndefinition\n  the_set :: \"'a option set \\<Rightarrow> 'a set\"\nwhere\n  \"the_set xs = {x. Some x \\<in> xs}\"\n\nlemma the_set_union [simp]:\n  \"the_set (A \\<union> B) = the_set A \\<union> the_set B\"\n  by (fastforce simp: the_set_def)\n\nlemma the_set_inter [simp]:\n  \"the_set (A \\<inter> B) = the_set A \\<inter> the_set B\"\n  by (fastforce simp: the_set_def)\n\nlemma the_set_inter_empty:\n  \"A \\<inter> B = {} \\<Longrightarrow> the_set A \\<inter> the_set B = {}\"\n  by (fastforce simp: the_set_def)\n\n\n(* As the capDL operations mostly take the state (rather than the heap)\n * we need to redefine some of them again to take just the heap.\n *)\ndefinition\n  slots_of_heap :: \"cdl_heap \\<Rightarrow> cdl_object_id \\<Rightarrow> cdl_cap_map\"\nwhere\n  \"slots_of_heap h \\<equiv> \\<lambda>obj_id. \n  case h obj_id of \n    None \\<Rightarrow> Map.empty \n  | Some obj \\<Rightarrow> object_slots obj\"\n\n(* Adds new caps to an object. It won't overwrite on a collision. *)\ndefinition\n  add_to_slots :: \"cdl_cap_map \\<Rightarrow> cdl_object \\<Rightarrow> cdl_object\"\nwhere\n  \"add_to_slots new_val obj \\<equiv> update_slots (new_val ++ (object_slots obj)) obj\"\n\nlemma add_to_slots_assoc:\n  \"add_to_slots x (add_to_slots (y ++ z) obj) = \n   add_to_slots (x ++ y) (add_to_slots z obj)\"\n  apply (clarsimp simp: add_to_slots_def update_slots_def object_slots_def)\n  apply (fastforce simp: cdl_tcb.splits cdl_cnode.splits\n                 split: cdl_object.splits)\n  done\n\n(* Lemmas about add_to_slots, update_slots and object_slots. *)\nlemma add_to_slots_twice [simp]:\n  \"add_to_slots x (add_to_slots y a) = add_to_slots (x ++ y) a\"\n  by (fastforce simp: add_to_slots_def update_slots_def object_slots_def\n              split: cdl_object.splits)\n\nlemma slots_of_heap_empty [simp]: \"slots_of_heap Map.empty object_id = Map.empty\"\n  by (simp add: slots_of_heap_def)\n\nlemma slots_of_heap_empty2 [simp]:\n  \"h obj_id = None \\<Longrightarrow> slots_of_heap h obj_id = Map.empty\"\n  by (simp add: slots_of_heap_def)\n\nlemma update_slots_add_to_slots_empty [simp]:\n  \"update_slots Map.empty (add_to_slots new obj) = update_slots Map.empty obj\"\n  by (clarsimp simp: update_slots_def add_to_slots_def split:cdl_object.splits)\n\nlemma update_object_slots_id [simp]: \"update_slots (object_slots a) a = a\"\n  by (clarsimp simp: update_slots_def object_slots_def\n              split: cdl_object.splits)\n\nlemma update_slots_of_heap_id [simp]:\n  \"h obj_id = Some obj \\<Longrightarrow> update_slots (slots_of_heap h obj_id) obj = obj\"\n  by (clarsimp simp: update_slots_def slots_of_heap_def object_slots_def\n              split: cdl_object.splits)\n\nlemma add_to_slots_empty [simp]: \"add_to_slots Map.empty h = h\"\n  by (simp add: add_to_slots_def)\n\nlemma update_slots_eq:\n  \"update_slots a o1 = update_slots a o2 \\<Longrightarrow> update_slots b o1 = update_slots b o2\"\n  by (fastforce simp: update_slots_def cdl_tcb.splits cdl_cnode.splits\n              split: cdl_object.splits)\n\n\n\n(* If there are not two conflicting objects at a position in two states.\n * Objects conflict if their types are different or their ghost_states collide.\n *)\ndefinition\n  not_conflicting_objects :: \"sep_state \\<Rightarrow> sep_state \\<Rightarrow> cdl_object_id \\<Rightarrow> bool\"\nwhere\n  \"not_conflicting_objects state_a state_b = (\\<lambda>obj_id.\n let heap_a = sep_heap state_a;\n     heap_b = sep_heap state_b;\n     gs_a = sep_ghost_state state_a;\n     gs_b = sep_ghost_state state_b\n in case (heap_a obj_id, heap_b obj_id) of \n    (Some o1, Some o2) \\<Rightarrow> object_type o1 = object_type o2 \\<and> gs_a obj_id \\<inter> gs_b obj_id = {}\n   | _ \\<Rightarrow> True)\"\n\n\n(* \"Cleans\" slots to conform with the compontents. *)\ndefinition\n  clean_slots :: \"cdl_cap_map \\<Rightarrow> cdl_components \\<Rightarrow> cdl_cap_map\"\nwhere\n  \"clean_slots slots cmp \\<equiv> slots |` the_set cmp\"\n\n(* Sets the fields of an object to a \"clean\" state.\n   Because a frame's size is part of it's type, we don't reset it. *)\ndefinition\n  object_clean_fields :: \"cdl_object \\<Rightarrow> cdl_components \\<Rightarrow> cdl_object\"\nwhere\n  \"object_clean_fields obj cmp \\<equiv> if None \\<in> cmp then obj else case obj of\n    Tcb x \\<Rightarrow> Tcb (x\\<lparr>cdl_tcb_fault_endpoint := undefined\\<rparr>)\n  | CNode x \\<Rightarrow> CNode (x\\<lparr>cdl_cnode_size_bits := undefined \\<rparr>)\n  | _ \\<Rightarrow> obj\"\n\n(* Sets the slots of an object to a \"clean\" state. *)\ndefinition\n  object_clean_slots :: \"cdl_object \\<Rightarrow> cdl_components \\<Rightarrow> cdl_object\"\nwhere\n  \"object_clean_slots obj cmp \\<equiv> update_slots (clean_slots (object_slots obj) cmp) obj\"\n\n(* Sets an object to a \"clean\" state. *)\ndefinition\n  object_clean :: \"cdl_object \\<Rightarrow> cdl_components \\<Rightarrow> cdl_object\"\nwhere\n  \"object_clean obj gs \\<equiv> object_clean_slots (object_clean_fields obj gs) gs\"\n\n(* Overrides the left object with the attributes of the right, as specified by the ghost state.\n   If the components for an object are empty, then this object is treated as empty, and thus ignored.\n *)\ndefinition\n  object_add :: \"cdl_object \\<Rightarrow> cdl_object \\<Rightarrow> cdl_components \\<Rightarrow> cdl_components \\<Rightarrow> cdl_object\"\nwhere\n  \"object_add obj_a obj_b cmps_a cmps_b \\<equiv>\n  let clean_obj_a = object_clean obj_a cmps_a;\n      clean_obj_b = object_clean obj_b cmps_b\n  in if (cmps_a = {})\n     then clean_obj_b\n     else if (cmps_b = {})\n     then clean_obj_a\n     else if (None \\<in> cmps_b)\n     then (update_slots (object_slots clean_obj_a ++ object_slots clean_obj_b) clean_obj_b)\n     else (update_slots (object_slots clean_obj_a ++ object_slots clean_obj_b) clean_obj_a)\"\n\n(* Heaps are added by adding their repsective objects.\n * The ghost state tells us which object's fields should be taken.\n * Adding objects of the same type adds their caps\n *   (overwrites the left with the right).\n *)\ndefinition\n  cdl_heap_add :: \"sep_state \\<Rightarrow> sep_state \\<Rightarrow> cdl_heap\"\nwhere\n  \"cdl_heap_add state_a state_b \\<equiv> \\<lambda>obj_id.\n let heap_a = sep_heap state_a;\n     heap_b = sep_heap state_b;\n     gs_a = sep_ghost_state state_a;\n     gs_b = sep_ghost_state state_b\n in case heap_b obj_id of\n      None \\<Rightarrow> heap_a obj_id\n    | Some obj_b \\<Rightarrow> case heap_a obj_id of\n                     None \\<Rightarrow> heap_b obj_id\n                   | Some obj_a \\<Rightarrow> Some (object_add obj_a obj_b (gs_a obj_id) (gs_b obj_id))\"\n\n(* Heaps are added by adding their repsective objects.\n * The ghost state tells us which object's fields should be taken.\n * Adding objects of the same type adds their caps\n *   (overwrites the left with the right).\n *)\ndefinition\n  cdl_ghost_state_add :: \"sep_state \\<Rightarrow> sep_state \\<Rightarrow> cdl_ghost_state\"\nwhere\n  \"cdl_ghost_state_add state_a state_b \\<equiv> \\<lambda>obj_id.\n let heap_a = sep_heap state_a;\n     heap_b = sep_heap state_b;\n     gs_a = sep_ghost_state state_a;\n     gs_b = sep_ghost_state state_b\n in      if heap_a obj_id = None \\<and> heap_b obj_id \\<noteq> None then gs_b obj_id\n    else if heap_b obj_id = None \\<and> heap_a obj_id \\<noteq> None then gs_a obj_id\n    else gs_a obj_id \\<union> gs_b obj_id\"\n\n\n(* Adding states adds their heaps,\n *  and each objects owns whichever fields it owned in either heap.\n *)\ndefinition\n  sep_state_add :: \"sep_state \\<Rightarrow> sep_state \\<Rightarrow> sep_state\"\nwhere\n  \"sep_state_add state_a state_b \\<equiv>\n  let\n    heap_a = sep_heap state_a;\n    heap_b = sep_heap state_b;\n    gs_a = sep_ghost_state state_a;\n    gs_b = sep_ghost_state state_b\n  in\n    SepState (cdl_heap_add state_a state_b) (cdl_ghost_state_add state_a state_b)\"\n\n\n(* Heaps are disjoint if for all of their objects:\n   * the caps of their respective objects are disjoint,\n   * their respective objects don't conflict,\n   * they don't both own any of the same fields.\n*)\ndefinition\n  sep_state_disj :: \"sep_state \\<Rightarrow> sep_state \\<Rightarrow> bool\"\nwhere\n  \"sep_state_disj state_a state_b \\<equiv>\n  let\n    heap_a = sep_heap state_a;\n    heap_b = sep_heap state_b;\n    gs_a = sep_ghost_state state_a;\n    gs_b = sep_ghost_state state_b\n  in\n    \\<forall>obj_id. not_conflicting_objects state_a state_b obj_id\"\n\nlemma not_conflicting_objects_comm:\n  \"not_conflicting_objects h1 h2 obj = not_conflicting_objects h2 h1 obj\"\n  apply (clarsimp simp: not_conflicting_objects_def split:option.splits)\n  apply (fastforce simp: update_slots_def cdl_tcb.splits cdl_cnode.splits\n              split: cdl_object.splits)\n  done\n\nlemma object_clean_comm:\n  \"\\<lbrakk>object_type obj_a = object_type obj_b;\n    object_slots obj_a ++ object_slots obj_b = object_slots obj_b ++ object_slots obj_a; None \\<notin> cmp\\<rbrakk>\n  \\<Longrightarrow> object_clean (add_to_slots (object_slots obj_a) obj_b) cmp =\n      object_clean (add_to_slots (object_slots obj_b) obj_a) cmp\"\n  apply (clarsimp simp: object_type_def split: cdl_object.splits)\n  apply (clarsimp simp: object_clean_def object_clean_slots_def object_clean_fields_def\n                        add_to_slots_def object_slots_def update_slots_def\n                        cdl_tcb.splits cdl_cnode.splits\n                 split: cdl_object.splits)+\n  done\n\nlemma add_to_slots_object_slots:\n  \"object_type y = object_type z\n \\<Longrightarrow> add_to_slots (object_slots (add_to_slots (x) y)) z =\n     add_to_slots (x ++ object_slots y) z\"\n  apply (clarsimp simp: add_to_slots_def update_slots_def object_slots_def)\n  apply (fastforce simp: object_type_def cdl_tcb.splits cdl_cnode.splits\n                 split: cdl_object.splits)\n  done\n\nlemma not_conflicting_objects_empty [simp]:\n  \"not_conflicting_objects s (SepState Map.empty (\\<lambda>obj_id. {})) obj_id\"\n  by (clarsimp simp: not_conflicting_objects_def split:option.splits)\n\nlemma empty_not_conflicting_objects [simp]:\n  \"not_conflicting_objects (SepState Map.empty (\\<lambda>obj_id. {})) s obj_id\"\n  by (clarsimp simp: not_conflicting_objects_def split:option.splits)\n\nlemma not_conflicting_objects_empty_object [elim!]:\n  \"(sep_heap x) obj_id = None \\<Longrightarrow> not_conflicting_objects x y obj_id\"\n  by (clarsimp simp: not_conflicting_objects_def)\n\nlemma empty_object_not_conflicting_objects [elim!]:\n  \"(sep_heap y) obj_id = None \\<Longrightarrow> not_conflicting_objects x y obj_id\"\n  apply (drule not_conflicting_objects_empty_object [where y=x])\n  apply (clarsimp simp: not_conflicting_objects_comm)\n  done\n\nlemma cdl_heap_add_empty [simp]:\n \"cdl_heap_add (SepState h gs) (SepState Map.empty (\\<lambda>obj_id. {})) = h\"\n  by (simp add: cdl_heap_add_def)\n\nlemma empty_cdl_heap_add [simp]:\n  \"cdl_heap_add (SepState Map.empty (\\<lambda>obj_id. {})) (SepState h gs)= h\"\n  apply (simp add: cdl_heap_add_def)\n  apply (rule ext)\n  apply (clarsimp split: option.splits)\n  done\n\nlemma map_add_result_empty1: \"a ++ b = Map.empty \\<Longrightarrow> a = Map.empty\"\n  apply (subgoal_tac \"dom (a++b) = {}\")\n   apply (subgoal_tac \"dom (a) = {}\")\n    apply clarsimp\n   apply (unfold dom_map_add)[1]\n   apply clarsimp\n  apply clarsimp\n  done\n\nlemma map_add_result_empty2: \"a ++ b = Map.empty \\<Longrightarrow> b = Map.empty\"\n  apply (subgoal_tac \"dom (a++b) = {}\")\n   apply (subgoal_tac \"dom (a) = {}\")\n    apply clarsimp\n   apply (unfold dom_map_add)[1]\n   apply clarsimp\n  apply clarsimp\n  done\n\nlemma map_add_emptyE [elim!]: \"\\<lbrakk>a ++ b = Map.empty; \\<lbrakk>a = Map.empty; b = Map.empty\\<rbrakk> \\<Longrightarrow> R\\<rbrakk> \\<Longrightarrow> R\"\n  apply (frule map_add_result_empty1)\n  apply (frule map_add_result_empty2)\n  apply clarsimp\n  done\n\nlemma clean_slots_empty [simp]:\n  \"clean_slots Map.empty cmp = Map.empty\"\n  by (clarsimp simp: clean_slots_def)\n\nlemma object_type_update_slots [simp]:\n  \"object_type (update_slots slots x) = object_type x\"\n  by (clarsimp simp: object_type_def update_slots_def split: cdl_object.splits)\n\nlemma object_type_object_clean_slots [simp]:\n  \"object_type (object_clean_slots x cmp) = object_type x\"\n  by (clarsimp simp: object_clean_slots_def)\n\nlemma object_type_object_clean_fields [simp]:\n  \"object_type (object_clean_fields x cmp) = object_type x\"\n  by (clarsimp simp: object_clean_fields_def object_type_def split: cdl_object.splits)  \n\nlemma object_type_object_clean [simp]:\n  \"object_type (object_clean x cmp) = object_type x\"\n  by (clarsimp simp: object_clean_def)\n\nlemma object_type_add_to_slots [simp]:\n  \"object_type (add_to_slots slots x) = object_type x\"\n  by (clarsimp simp: object_type_def add_to_slots_def update_slots_def split: cdl_object.splits)\n\nlemma object_slots_update_slots [simp]:\n  \"has_slots obj \\<Longrightarrow> object_slots (update_slots slots obj) = slots\"\n  by (clarsimp simp: object_slots_def update_slots_def has_slots_def\n              split: cdl_object.splits)\n\nlemma object_slots_update_slots_empty [simp]:\n  \"\\<not>has_slots obj \\<Longrightarrow> object_slots (update_slots slots obj) = Map.empty\"\n  by (clarsimp simp: object_slots_def update_slots_def has_slots_def\n                 split: cdl_object.splits)\n\nlemma update_slots_no_slots [simp]:\n  \"\\<not>has_slots obj \\<Longrightarrow> update_slots slots obj = obj\"\n  by (clarsimp simp: update_slots_def has_slots_def split: cdl_object.splits)\n\nlemma update_slots_update_slots [simp]:\n  \"update_slots slots (update_slots slots' obj) = update_slots slots obj\"\n  by (clarsimp simp: update_slots_def split: cdl_object.splits)\n\nlemma update_slots_same_object:\n  \"a = b \\<Longrightarrow> update_slots a obj = update_slots b obj\"\n  by (erule arg_cong)\n\nlemma object_type_has_slots:\n  \"\\<lbrakk>has_slots x; object_type x = object_type y\\<rbrakk> \\<Longrightarrow> has_slots y\"\n  by (clarsimp simp: object_type_def has_slots_def split: cdl_object.splits)\n\nlemma object_slots_object_clean_fields [simp]:\n  \"object_slots (object_clean_fields obj cmp) = object_slots obj\"\n  by (clarsimp simp: object_slots_def object_clean_fields_def split: cdl_object.splits)\n\nlemma object_slots_object_clean_slots [simp]:\n  \"object_slots (object_clean_slots obj cmp) = clean_slots (object_slots obj) cmp\"\n  by (clarsimp simp: object_clean_slots_def object_slots_def update_slots_def split: cdl_object.splits)\n\nlemma object_slots_object_clean [simp]:\n  \"object_slots (object_clean obj cmp) = clean_slots (object_slots obj) cmp\"\n  by (clarsimp simp: object_clean_def)\n\nlemma object_slots_add_to_slots [simp]:\n  \"object_type y = object_type z \\<Longrightarrow> object_slots (add_to_slots (object_slots y) z) = object_slots y ++ object_slots z\"\n  by (clarsimp simp: object_slots_def add_to_slots_def update_slots_def object_type_def split: cdl_object.splits)\n\nlemma update_slots_object_clean_slots [simp]:\n  \"update_slots slots (object_clean_slots obj cmp) = update_slots slots obj\"\n  by (clarsimp simp: object_clean_slots_def)\n\nlemma object_clean_fields_idem [simp]:\n  \"object_clean_fields (object_clean_fields obj cmp) cmp = object_clean_fields obj cmp\"\n  by (clarsimp simp: object_clean_fields_def split: cdl_object.splits)\n\nlemma object_clean_slots_idem [simp]:\n  \"object_clean_slots (object_clean_slots obj cmp) cmp = object_clean_slots obj cmp\"\n  apply (case_tac  \"has_slots obj\")\n  apply (clarsimp simp: object_clean_slots_def clean_slots_def)+\n  done\n\nlemma object_clean_fields_object_clean_slots [simp]:\n  \"object_clean_fields (object_clean_slots obj gs) gs = object_clean_slots (object_clean_fields obj gs) gs\"\n  by (clarsimp simp: object_clean_fields_def object_clean_slots_def\n                     clean_slots_def object_slots_def update_slots_def\n              split: cdl_object.splits)\n\nlemma object_clean_idem [simp]:\n  \"object_clean (object_clean obj cmp) cmp = object_clean obj cmp\"\n  by (clarsimp simp: object_clean_def)\n\nlemma has_slots_object_clean_slots:\n \"has_slots (object_clean_slots obj cmp) = has_slots obj\"\n  by (clarsimp simp: has_slots_def object_clean_slots_def update_slots_def split: cdl_object.splits)\n\nlemma has_slots_object_clean_fields:\n \"has_slots (object_clean_fields obj cmp) = has_slots obj\"\n  by (clarsimp simp: has_slots_def object_clean_fields_def split: cdl_object.splits)\n\nlemma has_slots_object_clean:\n \"has_slots (object_clean obj cmp) = has_slots obj\"\n  by (clarsimp simp: object_clean_def has_slots_object_clean_slots has_slots_object_clean_fields)\n\nlemma object_slots_update_slots_object_clean_fields [simp]:\n  \"object_slots (update_slots slots (object_clean_fields obj cmp)) = object_slots (update_slots slots obj)\"\n  apply (case_tac \"has_slots obj\")\n   apply (clarsimp simp: has_slots_object_clean_fields)+\n  done\n\nlemma object_clean_fields_update_slots [simp]:\n \"object_clean_fields (update_slots slots obj) cmp = update_slots slots (object_clean_fields obj cmp)\"\n  by (clarsimp simp: object_clean_fields_def update_slots_def split: cdl_object.splits)\n\nlemma object_clean_fields_twice [simp]:\n  \"(object_clean_fields (object_clean_fields obj cmp') cmp) = object_clean_fields obj (cmp \\<inter> cmp')\"\n  by (clarsimp simp: object_clean_fields_def split: cdl_object.splits)\n\nlemma update_slots_object_clean_fields:\n  \"\\<lbrakk>None \\<notin> cmps; None \\<notin> cmps'; object_type obj = object_type obj'\\<rbrakk>\n    \\<Longrightarrow> update_slots slots (object_clean_fields obj cmps) =\n        update_slots slots (object_clean_fields obj' cmps')\"\n  by (fastforce simp: update_slots_def object_clean_fields_def object_type_def split: cdl_object.splits)\n\nlemma object_clean_fields_no_slots:\n  \"\\<lbrakk>None \\<notin> cmps; None \\<notin> cmps'; object_type obj = object_type obj'; \\<not> has_slots obj; \\<not> has_slots obj'\\<rbrakk>\n    \\<Longrightarrow> object_clean_fields obj cmps = object_clean_fields obj' cmps'\"\n  by (fastforce simp: object_clean_fields_def object_type_def has_slots_def split: cdl_object.splits)\n\nlemma update_slots_object_clean:\n  \"\\<lbrakk>None \\<notin> cmps; None \\<notin> cmps'; object_type obj = object_type obj'\\<rbrakk>\n   \\<Longrightarrow> update_slots slots (object_clean obj cmps) = update_slots slots (object_clean obj' cmps')\"\n  apply (clarsimp simp: object_clean_def object_clean_slots_def)\n  apply (erule (2) update_slots_object_clean_fields)\n  done\n\nlemma cdl_heap_add_assoc':\n  \"\\<forall>obj_id. not_conflicting_objects x z obj_id \\<and>\n            not_conflicting_objects y z obj_id \\<and>\n            not_conflicting_objects x z obj_id \\<Longrightarrow>\n   cdl_heap_add (SepState (cdl_heap_add x y) (cdl_ghost_state_add x y)) z =\n   cdl_heap_add x (SepState (cdl_heap_add y z) (cdl_ghost_state_add y z))\"\n  apply (rule ext)\n  apply (rename_tac obj_id)\n  apply (erule_tac x=obj_id in allE)\n  apply (clarsimp simp: cdl_heap_add_def cdl_ghost_state_add_def not_conflicting_objects_def)\n  apply (simp add: Let_unfold split: option.splits)\n  apply (rename_tac obj_y obj_x obj_z)\n  apply (clarsimp simp: object_add_def clean_slots_def object_clean_def object_clean_slots_def Let_unfold)\n  apply (case_tac \"has_slots obj_z\")\n   apply (subgoal_tac \"has_slots obj_y\")\n    apply (subgoal_tac \"has_slots obj_x\")\n     apply ((clarsimp simp: has_slots_object_clean_fields has_slots_object_clean_slots has_slots_object_clean\n                           map_add_restrict union_intersection | \n            drule inter_empty_not_both | \n            erule update_slots_object_clean_fields |\n            erule object_type_has_slots, simp |\n            simp | safe)+)[3]\n   apply (subgoal_tac \"\\<not> has_slots obj_y\")\n    apply (subgoal_tac \"\\<not> has_slots obj_x\")\n     apply ((clarsimp simp: has_slots_object_clean_fields has_slots_object_clean_slots has_slots_object_clean\n                           map_add_restrict union_intersection | \n            drule inter_empty_not_both | \n            erule object_clean_fields_no_slots |\n            erule object_type_has_slots, simp |\n            simp | safe)+)\n   apply (fastforce simp: object_type_has_slots)+\n  done\n\nlemma cdl_heap_add_assoc:\n  \"\\<lbrakk>sep_state_disj x y; sep_state_disj y z; sep_state_disj x z\\<rbrakk>\n  \\<Longrightarrow> cdl_heap_add (SepState (cdl_heap_add x y) (cdl_ghost_state_add x y)) z =\n      cdl_heap_add x (SepState (cdl_heap_add y z) (cdl_ghost_state_add y z))\"\n  apply (clarsimp simp: sep_state_disj_def)\n  apply (cut_tac cdl_heap_add_assoc')\n   apply fast\n  apply fastforce\n  done\n\nlemma cdl_ghost_state_add_assoc:\n  \"cdl_ghost_state_add (SepState (cdl_heap_add x y) (cdl_ghost_state_add x y)) z =\n   cdl_ghost_state_add x (SepState (cdl_heap_add y z) (cdl_ghost_state_add y z))\"\n  apply (rule ext)\n  apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def Let_unfold)\n  done\n\nlemma clean_slots_map_add_comm:\n  \"cmps_a \\<inter> cmps_b = {}\n  \\<Longrightarrow> clean_slots slots_a cmps_a ++ clean_slots slots_b cmps_b =\n      clean_slots slots_b cmps_b ++ clean_slots slots_a cmps_a\"\n  apply (clarsimp simp: clean_slots_def)\n  apply (drule the_set_inter_empty)\n  apply (erule map_add_restrict_comm)\n  done\n\nlemma object_clean_all:\n  \"object_type obj_a = object_type obj_b \\<Longrightarrow> object_clean obj_b {} = object_clean obj_a {}\"\n  apply (clarsimp simp: object_clean_def object_clean_slots_def clean_slots_def the_set_def)\n  apply (rule_tac cmps'1=\"{}\" and obj'1=\"obj_a\" in trans [OF update_slots_object_clean_fields], fastforce+)\n  done\n\nlemma object_add_comm:\n  \"\\<lbrakk>object_type obj_a = object_type obj_b; cmps_a \\<inter> cmps_b = {}\\<rbrakk>\n  \\<Longrightarrow> object_add obj_a obj_b cmps_a cmps_b = object_add obj_b obj_a cmps_b cmps_a\"\n  apply (clarsimp simp: object_add_def Let_unfold)\n  apply (rule conjI | clarsimp)+\n    apply fastforce\n  apply (rule conjI | clarsimp)+\n   apply (drule_tac slots_a = \"object_slots obj_a\" and slots_b = \"object_slots obj_b\" in clean_slots_map_add_comm)\n   apply fastforce\n  apply (rule conjI | clarsimp)+\n   apply (drule_tac slots_a = \"object_slots obj_a\" and slots_b = \"object_slots obj_b\" in clean_slots_map_add_comm)\n   apply fastforce\n  apply (rule conjI | clarsimp)+\n   apply (erule object_clean_all)\n  apply (clarsimp)\n  apply (rule_tac cmps'1=cmps_b and obj'1=obj_b in trans [OF update_slots_object_clean], assumption+)\n  apply (drule_tac slots_a = \"object_slots obj_a\" and slots_b = \"object_slots obj_b\" in clean_slots_map_add_comm)\n  apply fastforce\n  done\n\nlemma sep_state_add_comm:\n  \"sep_state_disj x y \\<Longrightarrow> sep_state_add x y = sep_state_add y x\"\n  apply (clarsimp simp: sep_state_add_def sep_state_disj_def)\n  apply (rule conjI)\n   apply (case_tac x, case_tac y, clarsimp)\n   apply (rename_tac heap_a gs_a heap_b gs_b)\n   apply (clarsimp simp: cdl_heap_add_def Let_unfold)\n   apply (rule ext)\n   apply (case_tac \"heap_a obj_id\")\n    apply (case_tac \"heap_b obj_id\", simp_all add: slots_of_heap_def)\n   apply (case_tac \"heap_b obj_id\", simp_all add: slots_of_heap_def)\n   apply (rename_tac obj_a obj_b)\n   apply (erule_tac x=obj_id in allE)\n   apply (rule object_add_comm)\n    apply (clarsimp simp: not_conflicting_objects_def)\n   apply (clarsimp simp: not_conflicting_objects_def)\n  apply (rule ext, fastforce simp: cdl_ghost_state_add_def Let_unfold Un_commute)\n  done\n\nlemma add_to_slots_comm:\n  \"\\<lbrakk>object_slots y_obj \\<bottom> object_slots z_obj; update_slots Map.empty y_obj = update_slots Map.empty z_obj \\<rbrakk>\n  \\<Longrightarrow> add_to_slots (object_slots z_obj) y_obj = add_to_slots (object_slots y_obj) z_obj\"\n  by (fastforce simp: add_to_slots_def update_slots_def object_slots_def\n                     cdl_tcb.splits cdl_cnode.splits\n              dest!: map_add_com\n              split: cdl_object.splits)\n\nlemma cdl_heap_add_none1:\n  \"cdl_heap_add x y obj_id = None \\<Longrightarrow> (sep_heap x) obj_id = None\"\n  by (clarsimp simp: cdl_heap_add_def Let_unfold split:option.splits if_split_asm)\n\nlemma cdl_heap_add_none2:\n  \"cdl_heap_add x y obj_id = None \\<Longrightarrow> (sep_heap y) obj_id = None\"\n  by (clarsimp simp: cdl_heap_add_def Let_unfold split:option.splits if_split_asm)\n\nlemma object_type_object_addL:\n  \"object_type obj = object_type obj'\n  \\<Longrightarrow> object_type (object_add obj obj' cmp cmp') = object_type obj\"\n  by (clarsimp simp: object_add_def Let_unfold)\n\nlemma object_type_object_addR:\n  \"object_type obj = object_type obj'\n  \\<Longrightarrow> object_type (object_add obj obj' cmp cmp') = object_type obj'\"\n  by (clarsimp simp: object_add_def Let_unfold)\n\nlemma sep_state_add_disjL:\n  \"\\<lbrakk>sep_state_disj y z; sep_state_disj x (sep_state_add y z)\\<rbrakk> \\<Longrightarrow> sep_state_disj x y\"\n  apply (clarsimp simp: sep_state_disj_def sep_state_add_def)\n  apply (rename_tac obj_id)\n  apply (clarsimp simp: not_conflicting_objects_def)\n  apply (erule_tac x=obj_id in allE)+\n  apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def object_type_object_addR\n                 split: option.splits)\n  done\n\nlemma sep_state_add_disjR:\n  \"\\<lbrakk>sep_state_disj y z; sep_state_disj x (sep_state_add y z)\\<rbrakk> \\<Longrightarrow> sep_state_disj x z\"\n  apply (clarsimp simp: sep_state_disj_def sep_state_add_def)\n  apply (rename_tac obj_id)\n  apply (clarsimp simp: not_conflicting_objects_def)\n  apply (erule_tac x=obj_id in allE)+\n  apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def object_type_object_addR\n                 split: option.splits)\n  done\n\nlemma sep_state_add_disj:\n  \"\\<lbrakk>sep_state_disj y z; sep_state_disj x y; sep_state_disj x z\\<rbrakk> \\<Longrightarrow> sep_state_disj x (sep_state_add y z)\"\n  apply (clarsimp simp: sep_state_disj_def sep_state_add_def)\n  apply (rename_tac obj_id)\n  apply (clarsimp simp: not_conflicting_objects_def)\n  apply (erule_tac x=obj_id in allE)+\n  apply (fastforce simp: cdl_heap_add_def cdl_ghost_state_add_def object_type_object_addR\n                 split: option.splits)\n  done\n\n\n\n\n(*********************************************)\n(* Definition of separation logic for capDL. *)\n(*********************************************)\n\ninstantiation \"sep_state\" :: zero\nbegin\n  definition \"0 \\<equiv> SepState Map.empty (\\<lambda>obj_id. {})\"\n  instance ..\nend\n\ninstantiation \"sep_state\" :: stronger_sep_algebra\nbegin\n\ndefinition \"(##) \\<equiv> sep_state_disj\"\ndefinition \"(+) \\<equiv> sep_state_add\"\n\n\n\n(**********************************************\n * The proof that this is a separation logic. *\n **********************************************)\n\ninstance\n  apply standard\n(* x ## 0 *)\n       apply (simp add: sep_disj_sep_state_def sep_state_disj_def zero_sep_state_def)\n(* x ## y \\<Longrightarrow> y ## x *)\n      apply (clarsimp simp: not_conflicting_objects_comm sep_disj_sep_state_def sep_state_disj_def Let_unfold\n                            map_disj_com not_conflicting_objects_comm Int_commute)\n(* x + 0 = x *)\n     apply (simp add: plus_sep_state_def sep_state_add_def zero_sep_state_def)\n     apply (case_tac x)\n     apply (clarsimp simp: cdl_heap_add_def)\n     apply (rule ext)\n     apply (clarsimp simp: cdl_ghost_state_add_def split:if_split_asm)\n(* x ## y \\<Longrightarrow> x + y = y + x *)\n    apply (clarsimp simp: plus_sep_state_def sep_disj_sep_state_def)\n    apply (erule sep_state_add_comm)\n(* (x + y) + z = x + (y + z) *)\n   apply (simp add: plus_sep_state_def sep_state_add_def)\n   apply (rule conjI)\n   apply (clarsimp simp: sep_disj_sep_state_def)\n    apply (erule (2) cdl_heap_add_assoc)\n   apply (rule cdl_ghost_state_add_assoc)\n(* x ## y + z = (x ## y \\<and> x ## z) *)\n  apply (clarsimp simp: plus_sep_state_def sep_disj_sep_state_def)\n  apply (rule iffI)\n   (* x ## y + z \\<Longrightarrow> (x ## y \\<and> x ## z) *)\n   apply (rule conjI)\n    (* x ## y + z \\<Longrightarrow> (x ## y) *)\n    apply (erule (1) sep_state_add_disjL)\n   (* x ## y + z \\<Longrightarrow> (x ## z) *)\n   apply (erule (1) sep_state_add_disjR)\n  (* x ## y + z \\<Longleftarrow> (x ## y \\<and> x ## z) *)\n  apply clarsimp\n  apply (erule (2) sep_state_add_disj)\n  done\n\nend\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Separation_Algebra/ex/capDL/Abstract_Separation_D.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6825737214979745, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3492843072252301}}
{"text": "subsection \\<open> Oblivious transfer constructed from ETPs \\<close>\n\ntext\\<open>Here we construct the OT protocol based on ETPs given in \\<^cite>\\<open>\"DBLP:books/sp/17/Lindell17\"\\<close> (Chapter 4) and prove\nsemi honest security for both parties. We show information theoretic security for Party 1 and reduce the security of \nParty 2 to the HCP assumption.\\<close>\n\ntheory ETP_OT imports\n  \"HOL-Number_Theory.Cong\"\n  ETP\n  OT_Functionalities\n  Semi_Honest_Def\nbegin\n\ntype_synonym 'range viewP1 = \"((bool \\<times> bool) \\<times> 'range \\<times> 'range) spmf\"\ntype_synonym 'range dist1 = \"((bool \\<times> bool) \\<times> 'range \\<times> 'range) \\<Rightarrow> bool spmf\"\ntype_synonym 'index viewP2 = \"(bool \\<times> 'index \\<times> (bool \\<times> bool)) spmf\"\ntype_synonym 'index dist2 = \"(bool \\<times> 'index \\<times> bool \\<times> bool) \\<Rightarrow> bool spmf\"\ntype_synonym ('index, 'range) advP2 = \"'index \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> 'index dist2 \\<Rightarrow> 'range \\<Rightarrow> bool spmf\"\n\nlemma if_False_True: \"(if x then False else \\<not> False) \\<longleftrightarrow> (if x then False else True)\"\n  by simp\n\nlemma if_then_True [simp]: \"(if b then True else x) \\<longleftrightarrow> (\\<not> b \\<longrightarrow> x)\"\n  by simp\n\nlemma if_else_True [simp]: \"(if b then x else True) \\<longleftrightarrow> (b \\<longrightarrow> x)\"\n  by simp\n\nlemma inj_on_Not [simp]: \"inj_on Not A\"\n  by(auto simp add: inj_on_def)\n\nlocale ETP_base = etp: etp I domain range F F\\<^sub>i\\<^sub>n\\<^sub>v B\n  for I :: \"('index \\<times> 'trap) spmf\" \\<comment> \\<open>samples index and trapdoor\\<close>\n    and domain :: \"'index \\<Rightarrow> 'range set\" \n    and range :: \"'index \\<Rightarrow> 'range set\"\n    and B :: \"'index \\<Rightarrow> 'range \\<Rightarrow> bool\" \\<comment> \\<open>hard core predicate\\<close>\n    and F :: \"'index \\<Rightarrow> 'range \\<Rightarrow> 'range\"\n    and F\\<^sub>i\\<^sub>n\\<^sub>v :: \"'index \\<Rightarrow> 'trap \\<Rightarrow> 'range \\<Rightarrow> 'range\"\nbegin\n\ntext\\<open>The probabilistic program that defines the protocol.\\<close>\n\ndefinition protocol :: \"(bool \\<times> bool) \\<Rightarrow> bool \\<Rightarrow> (unit \\<times> bool) spmf\"\n  where \"protocol input\\<^sub>1 \\<sigma> = do {  \n    let (b\\<^sub>\\<sigma>, b\\<^sub>\\<sigma>') = input\\<^sub>1;\n    (\\<alpha> :: 'index, \\<tau> :: 'trap) \\<leftarrow> I;\n    x\\<^sub>\\<sigma> :: 'range \\<leftarrow> etp.S \\<alpha>;\n    y\\<^sub>\\<sigma>' :: 'range \\<leftarrow> etp.S \\<alpha>;\n    let (y\\<^sub>\\<sigma> :: 'range) = F \\<alpha> x\\<^sub>\\<sigma>;\n    let (x\\<^sub>\\<sigma> :: 'range) = F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> y\\<^sub>\\<sigma>;\n    let (x\\<^sub>\\<sigma>' :: 'range) = F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> y\\<^sub>\\<sigma>';\n    let (\\<beta>\\<^sub>\\<sigma> :: bool) = xor (B \\<alpha> x\\<^sub>\\<sigma>) b\\<^sub>\\<sigma>;\n    let (\\<beta>\\<^sub>\\<sigma>' :: bool) = xor (B \\<alpha> x\\<^sub>\\<sigma>') b\\<^sub>\\<sigma>';\n    return_spmf ((), if \\<sigma> then xor (B \\<alpha> x\\<^sub>\\<sigma>') \\<beta>\\<^sub>\\<sigma>' else xor (B \\<alpha> x\\<^sub>\\<sigma>) \\<beta>\\<^sub>\\<sigma>)}\"\n\nlemma correctness: \"protocol (m0,m1) c = funct_OT_12 (m0,m1) c\"\nproof-\n  have \"(B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> y\\<^sub>\\<sigma>') = (B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> y\\<^sub>\\<sigma>') = m1)) = m1\" \n    for \\<alpha> \\<tau> y\\<^sub>\\<sigma>'  by auto\n  then show ?thesis \n    by(auto simp add: protocol_def funct_OT_12_def Let_def etp.B_F_inv_rewrite bind_spmf_const etp.lossless_S local.etp.lossless_I lossless_weight_spmfD split_def cong: bind_spmf_cong)\nqed\n\ntext \\<open> Party 1 views \\<close>\n\ndefinition R1 :: \"(bool \\<times> bool) \\<Rightarrow> bool \\<Rightarrow> 'range viewP1\"\n  where \"R1 input\\<^sub>1 \\<sigma> = do {\n    let (b\\<^sub>0, b\\<^sub>1) = input\\<^sub>1;\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    x\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n    y\\<^sub>\\<sigma>' \\<leftarrow> etp.S \\<alpha>;\n    let y\\<^sub>\\<sigma> = F \\<alpha> x\\<^sub>\\<sigma>;\n    return_spmf ((b\\<^sub>0, b\\<^sub>1), if \\<sigma> then y\\<^sub>\\<sigma>' else y\\<^sub>\\<sigma>, if \\<sigma> then y\\<^sub>\\<sigma> else y\\<^sub>\\<sigma>')}\"\n\n\n\ndefinition S1 :: \"(bool \\<times> bool) \\<Rightarrow> unit \\<Rightarrow> 'range viewP1\"\n  where \"S1 == (\\<lambda> input\\<^sub>1 (). do {\n    let (b\\<^sub>0, b\\<^sub>1) = input\\<^sub>1;\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    y\\<^sub>0 :: 'range \\<leftarrow> etp.S \\<alpha>;\n    y\\<^sub>1 \\<leftarrow> etp.S \\<alpha>;\n    return_spmf ((b\\<^sub>0, b\\<^sub>1), y\\<^sub>0, y\\<^sub>1)})\" \n\nlemma lossless_S1: \"lossless_spmf (S1 msgs ())\"\n  by(simp add: S1_def local.etp.lossless_I split_def etp.lossless_S)\n\ntext \\<open> Party 2 views \\<close>\n\ndefinition R2 :: \"(bool \\<times> bool) \\<Rightarrow> bool \\<Rightarrow> 'index viewP2\"\n  where \"R2 msgs \\<sigma> = do {\n    let (b0,b1) = msgs;\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    x\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n    y\\<^sub>\\<sigma>' \\<leftarrow> etp.S \\<alpha>;\n    let y\\<^sub>\\<sigma> = F \\<alpha> x\\<^sub>\\<sigma>;\n    let x\\<^sub>\\<sigma> = F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> y\\<^sub>\\<sigma>;\n    let x\\<^sub>\\<sigma>' = F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> y\\<^sub>\\<sigma>';\n    let \\<beta>\\<^sub>\\<sigma> = (B \\<alpha> x\\<^sub>\\<sigma>) \\<oplus> (if \\<sigma> then b1 else b0) ;\n    let \\<beta>\\<^sub>\\<sigma>' = (B \\<alpha> x\\<^sub>\\<sigma>') \\<oplus> (if \\<sigma> then b0 else b1);\n    return_spmf (\\<sigma>, \\<alpha>,(\\<beta>\\<^sub>\\<sigma>, \\<beta>\\<^sub>\\<sigma>'))}\"\n\nlemma lossless_R2: \"lossless_spmf (R2 msgs \\<sigma>)\"\n  by(simp add: R2_def split_def local.etp.lossless_I etp.lossless_S)\n\ndefinition S2 :: \"bool \\<Rightarrow> bool \\<Rightarrow> 'index viewP2\"\n  where \"S2 \\<sigma> b\\<^sub>\\<sigma> = do {\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    x\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n    y\\<^sub>\\<sigma>' \\<leftarrow> etp.S \\<alpha>;\n    let x\\<^sub>\\<sigma>' = F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> y\\<^sub>\\<sigma>';\n    let \\<beta>\\<^sub>\\<sigma> = (B \\<alpha> x\\<^sub>\\<sigma>) \\<oplus> b\\<^sub>\\<sigma>;\n    let \\<beta>\\<^sub>\\<sigma>' = B \\<alpha> x\\<^sub>\\<sigma>';\n    return_spmf (\\<sigma>, \\<alpha>, (\\<beta>\\<^sub>\\<sigma>, \\<beta>\\<^sub>\\<sigma>'))}\"\n\nlemma lossless_S2: \"lossless_spmf (S2 \\<sigma> b\\<^sub>\\<sigma>)\"\n  by(simp add: S2_def local.etp.lossless_I etp.lossless_S split_def)\n\ntext \\<open> Security for Party 1 \\<close>\n\ntext\\<open>We have information theoretic security for Party 1.\\<close>\n\nlemma P1_security: \"R1 input\\<^sub>1 \\<sigma> = funct_OT_12 x y \\<bind> (\\<lambda> (s1, s2). S1 input\\<^sub>1 s1)\" \n  including monad_normalisation\nproof-\n   have \"R1 input\\<^sub>1 \\<sigma> =  do {\n    let (b0,b1) = input\\<^sub>1;\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    y\\<^sub>\\<sigma>' :: 'range \\<leftarrow> etp.S \\<alpha>;\n    y\\<^sub>\\<sigma> \\<leftarrow> map_spmf (\\<lambda> x\\<^sub>\\<sigma>. F \\<alpha> x\\<^sub>\\<sigma>) (etp.S \\<alpha>);\n    return_spmf ((b0,b1), if \\<sigma> then y\\<^sub>\\<sigma>' else y\\<^sub>\\<sigma>, if \\<sigma> then y\\<^sub>\\<sigma> else y\\<^sub>\\<sigma>')}\"\n     by(simp add: bind_map_spmf o_def Let_def R1_def)\n   also have \"... = do {\n    let (b0,b1) = input\\<^sub>1;\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    y\\<^sub>\\<sigma>' :: 'range \\<leftarrow> etp.S \\<alpha>;\n    y\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n    return_spmf ((b0,b1), if \\<sigma> then y\\<^sub>\\<sigma>' else y\\<^sub>\\<sigma>, if \\<sigma> then y\\<^sub>\\<sigma> else y\\<^sub>\\<sigma>')}\"\n     by(simp add: etp.uni_set_samp Let_def split_def cong: bind_spmf_cong)\n   also have \"... = funct_OT_12 x y \\<bind> (\\<lambda> (s1, s2). S1 input\\<^sub>1 s1)\"\n     by(cases \\<sigma>; simp add: S1_def R1_def Let_def funct_OT_12_def)\n   ultimately show ?thesis by auto\nqed \n\ntext \\<open> The adversary used in proof of security for party 2 \\<close>\n\ndefinition \\<A> :: \"('index, 'range) advP2\"\n  where \"\\<A> \\<alpha> \\<sigma> b\\<^sub>\\<sigma> D2 x = do {\n    \\<beta>\\<^sub>\\<sigma>' \\<leftarrow> coin_spmf;\n    x\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n    let \\<beta>\\<^sub>\\<sigma> = (B \\<alpha> x\\<^sub>\\<sigma>) \\<oplus> b\\<^sub>\\<sigma>;\n    d \\<leftarrow> D2(\\<sigma>, \\<alpha>, \\<beta>\\<^sub>\\<sigma>, \\<beta>\\<^sub>\\<sigma>');\n    return_spmf(if d then \\<beta>\\<^sub>\\<sigma>' else \\<not> \\<beta>\\<^sub>\\<sigma>')}\"\n\nlemma lossless_\\<A>: \n  assumes \"\\<forall> view. lossless_spmf (D2 view)\"\n  shows \"y \\<in> set_spmf I \\<longrightarrow>  lossless_spmf (\\<A> (fst y) \\<sigma> b\\<^sub>\\<sigma> D2 x)\"\n  by(simp add: \\<A>_def etp.lossless_S assms)\n\nlemma assm_bound_funct_OT_12: \n  assumes \"etp.HCP_adv \\<A> \\<sigma> (if \\<sigma> then b1 else b0) D \\<le> HCP_ad\"\n  shows \"\\<bar>spmf (funct_OT_12 (b0,b1) \\<sigma> \\<bind> (\\<lambda> (out1,out2). \n              etp.HCP_game \\<A> \\<sigma> out2 D)) True - 1/2\\<bar> \\<le> HCP_ad\"\n(is \"?lhs \\<le> HCP_ad\")\nproof-\n  have \"?lhs = \\<bar>spmf (etp.HCP_game \\<A> \\<sigma> (if \\<sigma> then b1 else b0) D) True - 1/2\\<bar>\" \n    by(simp add: funct_OT_12_def)\n  thus ?thesis using assms etp.HCP_adv_def by simp\nqed\n\nlemma assm_bound_funct_OT_12_collapse: \n  assumes \"\\<forall> b\\<^sub>\\<sigma>. etp.HCP_adv \\<A> \\<sigma> b\\<^sub>\\<sigma> D \\<le> HCP_ad\"\n  shows \"\\<bar>spmf (funct_OT_12 m1 \\<sigma> \\<bind> (\\<lambda> (out1,out2). etp.HCP_game \\<A> \\<sigma> out2 D)) True - 1/2\\<bar> \\<le> HCP_ad\"\n  using assm_bound_funct_OT_12 surj_pair assms by metis \n\ntext \\<open> To prove security for party 2 we split the proof on the cases on party 2's input \\<close>\n\nlemma R2_S2_False:\n  assumes \"((if \\<sigma> then b0 else b1) = False)\" \n  shows \"spmf (R2 (b0,b1) \\<sigma> \\<bind> (D2 :: (bool \\<times> 'index \\<times> bool \\<times> bool) \\<Rightarrow> bool spmf)) True \n                = spmf (funct_OT_12 (b0,b1) \\<sigma> \\<bind> (\\<lambda> (out1,out2). S2 \\<sigma> out2 \\<bind> D2)) True\"\nproof-\n  have \"\\<sigma> \\<Longrightarrow> \\<not> b0\" using assms by simp\n  moreover have \"\\<not> \\<sigma> \\<Longrightarrow> \\<not> b1\" using assms by simp\n  ultimately show ?thesis\n    by(auto simp add: R2_def S2_def split_def local.etp.F_f_inv assms funct_OT_12_def cong: bind_spmf_cong_simp) \nqed\n\nlemma R2_S2_True:\n  assumes \"((if \\<sigma> then b0 else b1) = True)\" \n    and lossless_D: \"\\<forall> a. lossless_spmf (D2 a)\"\n  shows \"\\<bar>(spmf (bind_spmf (R2 (b0,b1) \\<sigma>) D2) True) - spmf (funct_OT_12 (b0,b1) \\<sigma> \\<bind> (\\<lambda> (out1, out2). S2 \\<sigma> out2 \\<bind> (\\<lambda> view. D2 view))) True\\<bar>\n                         = \\<bar>2*((spmf (etp.HCP_game \\<A> \\<sigma> (if \\<sigma> then b1 else b0) D2) True) - 1/2)\\<bar>\"\nproof-\n  have  \"(spmf (funct_OT_12 (b0,b1) \\<sigma> \\<bind> (\\<lambda> (out1, out2). S2 \\<sigma> out2 \\<bind> D2)) True\n              - spmf (bind_spmf (R2 (b0,b1) \\<sigma>) D2) True) \n                    = 2 * ((spmf (etp.HCP_game \\<A> \\<sigma> (if \\<sigma> then b1 else b0) D2) True) - 1/2)\"\n  proof-\n    have  \"((spmf (etp.HCP_game \\<A> \\<sigma> (if \\<sigma> then b1 else b0) D2) True) - 1/2)  = \n                  1/2*(spmf (bind_spmf (S2 \\<sigma> (if \\<sigma> then b1 else b0)) D2) True\n                        - spmf (bind_spmf (R2 (b0,b1) \\<sigma>) D2) True)\"\n      including monad_normalisation\n    proof- \n      have \\<sigma>_true_b0_true: \"\\<sigma> \\<Longrightarrow> b0 = True\" using assms(1) by simp\n      have \\<sigma>_false_b1_true: \"\\<not> \\<sigma> \\<Longrightarrow> b1\" using assms(1) by simp \n      have return_True_False: \"spmf (return_spmf (\\<not> d)) True = spmf (return_spmf d) False\"\n        for d by(cases d; simp)\n      define HCP_game_true where \"HCP_game_true == \\<lambda> \\<sigma> b\\<^sub>\\<sigma>. do {\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    x\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n    x \\<leftarrow> (etp.S \\<alpha>);\n    let \\<beta>\\<^sub>\\<sigma> = (B \\<alpha> x\\<^sub>\\<sigma>) \\<oplus> b\\<^sub>\\<sigma>;\n    let \\<beta>\\<^sub>\\<sigma>' = B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> x); \n    d \\<leftarrow> D2(\\<sigma>, \\<alpha>, \\<beta>\\<^sub>\\<sigma>, \\<beta>\\<^sub>\\<sigma>');\n    let b' = (if d then \\<beta>\\<^sub>\\<sigma>' else \\<not> \\<beta>\\<^sub>\\<sigma>');\n    let b = B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> x);\n    return_spmf (b = b')}\"\n      define HCP_game_false where \"HCP_game_false == \\<lambda> \\<sigma> b\\<^sub>\\<sigma>. do {\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    x\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n    x \\<leftarrow> (etp.S \\<alpha>);\n    let \\<beta>\\<^sub>\\<sigma> = (B \\<alpha> x\\<^sub>\\<sigma>) \\<oplus> b\\<^sub>\\<sigma>;\n    let \\<beta>\\<^sub>\\<sigma>' = \\<not> B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> x); \n    d \\<leftarrow> D2(\\<sigma>, \\<alpha>, \\<beta>\\<^sub>\\<sigma>, \\<beta>\\<^sub>\\<sigma>');\n    let b' = (if d then \\<beta>\\<^sub>\\<sigma>' else \\<not> \\<beta>\\<^sub>\\<sigma>');\n    let b = B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> x);\n    return_spmf (b = b')}\"\n      define HCP_game_\\<A> where \"HCP_game_\\<A> == \\<lambda> \\<sigma> b\\<^sub>\\<sigma>. do {\n    \\<beta>\\<^sub>\\<sigma>' \\<leftarrow> coin_spmf;\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    x \\<leftarrow> etp.S \\<alpha>;\n    x' \\<leftarrow> etp.S \\<alpha>;\n    d \\<leftarrow> D2 (\\<sigma>, \\<alpha>, (B \\<alpha> x) \\<oplus> b\\<^sub>\\<sigma>, \\<beta>\\<^sub>\\<sigma>');\n    let b' = (if d then  \\<beta>\\<^sub>\\<sigma>' else \\<not> \\<beta>\\<^sub>\\<sigma>');\n    return_spmf (B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> x') = b')}\"\n      define S2D where \"S2D == \\<lambda> \\<sigma> b\\<^sub>\\<sigma> . do {\n      (\\<alpha>, \\<tau>) \\<leftarrow> I;\n      x\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n      y\\<^sub>\\<sigma>' \\<leftarrow> etp.S \\<alpha>;\n      let x\\<^sub>\\<sigma>' = F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> y\\<^sub>\\<sigma>';\n      let \\<beta>\\<^sub>\\<sigma> = (B \\<alpha> x\\<^sub>\\<sigma>) \\<oplus> b\\<^sub>\\<sigma>;\n      let \\<beta>\\<^sub>\\<sigma>' = B \\<alpha> x\\<^sub>\\<sigma>';\n      d :: bool \\<leftarrow> D2(\\<sigma>, \\<alpha>, \\<beta>\\<^sub>\\<sigma>, \\<beta>\\<^sub>\\<sigma>');\n      return_spmf d}\"\n      define R2D where \"R2D == \\<lambda> msgs \\<sigma>.  do {\n      let (b0,b1) = msgs;\n      (\\<alpha>, \\<tau>) \\<leftarrow> I;\n      x\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n      y\\<^sub>\\<sigma>' \\<leftarrow> etp.S \\<alpha>;\n      let y\\<^sub>\\<sigma> = F \\<alpha> x\\<^sub>\\<sigma>;\n      let x\\<^sub>\\<sigma> = F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> y\\<^sub>\\<sigma>;\n      let x\\<^sub>\\<sigma>' = F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> y\\<^sub>\\<sigma>';\n      let \\<beta>\\<^sub>\\<sigma> = (B \\<alpha> x\\<^sub>\\<sigma>) \\<oplus> (if \\<sigma> then b1 else b0) ;\n      let \\<beta>\\<^sub>\\<sigma>' = (B \\<alpha> x\\<^sub>\\<sigma>') \\<oplus> (if \\<sigma> then b0 else b1);\n      b :: bool \\<leftarrow> D2(\\<sigma>, \\<alpha>,(\\<beta>\\<^sub>\\<sigma>, \\<beta>\\<^sub>\\<sigma>'));\n      return_spmf b}\"\n      define D_true where \"D_true  == \\<lambda>\\<sigma> b\\<^sub>\\<sigma>. do {\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    x\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n    x \\<leftarrow> (etp.S \\<alpha>);\n    let \\<beta>\\<^sub>\\<sigma> = (B \\<alpha> x\\<^sub>\\<sigma>) \\<oplus> b\\<^sub>\\<sigma>;\n    let \\<beta>\\<^sub>\\<sigma>' = B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> x);\n    d :: bool \\<leftarrow> D2(\\<sigma>, \\<alpha>, \\<beta>\\<^sub>\\<sigma>, \\<beta>\\<^sub>\\<sigma>');\n    return_spmf d}\"\n      define D_false where \"D_false == \\<lambda> \\<sigma> b\\<^sub>\\<sigma>. do {\n    (\\<alpha>, \\<tau>) \\<leftarrow> I;\n    x\\<^sub>\\<sigma> \\<leftarrow> etp.S \\<alpha>;\n    x \\<leftarrow> etp.S \\<alpha>;\n    let \\<beta>\\<^sub>\\<sigma> = (B \\<alpha> x\\<^sub>\\<sigma>) \\<oplus> b\\<^sub>\\<sigma>;\n    let \\<beta>\\<^sub>\\<sigma>' = \\<not> B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> x);\n    d :: bool \\<leftarrow> D2(\\<sigma>, \\<alpha>, \\<beta>\\<^sub>\\<sigma>, \\<beta>\\<^sub>\\<sigma>');\n    return_spmf d}\"\n      have lossless_D_false: \"lossless_spmf (D_false \\<sigma> (if \\<sigma> then b1 else b0))\"\n        apply(auto simp add: D_false_def lossless_D local.etp.lossless_I) \n        using local.etp.lossless_S by auto\n      have \"spmf (etp.HCP_game \\<A> \\<sigma> (if \\<sigma> then b1 else b0) D2) True =  spmf (HCP_game_\\<A> \\<sigma> (if \\<sigma> then b1 else b0)) True\" \n        apply(simp add: etp.HCP_game_def HCP_game_\\<A>_def \\<A>_def split_def etp.F_f_inv)\n        by(rewrite bind_commute_spmf[where q = \"coin_spmf\"]; rewrite bind_commute_spmf[where q = \"coin_spmf\"]; rewrite bind_commute_spmf[where q = \"coin_spmf\"]; auto)+\n      also have \"... = spmf (bind_spmf (map_spmf Not coin_spmf) (\\<lambda>b. if b then HCP_game_true \\<sigma> (if \\<sigma> then b1 else b0) else HCP_game_false \\<sigma> (if \\<sigma> then b1 else b0))) True\"\n        unfolding HCP_game_\\<A>_def HCP_game_true_def HCP_game_false_def \\<A>_def Let_def\n        apply(simp add: split_def cong: if_cong)\n        supply [[simproc del: monad_normalisation]]\n        apply(subst if_distrib[where f = \"bind_spmf _\" for f, symmetric]; simp cong: bind_spmf_cong add: if_distribR )+\n        apply(rewrite in \"_ = \\<hole>\" bind_commute_spmf)\n        apply(rewrite in \"bind_spmf _ \\<hole>\"  in \"_ = \\<hole>\" bind_commute_spmf)\n        apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n        apply(rewrite in \"\\<hole> = _\" bind_commute_spmf)\n        apply(rewrite in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n        apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n        apply(fold map_spmf_conv_bind_spmf)\n        apply(rule conjI; rule impI; simp) \n         apply(simp only: spmf_bind)\n         apply(rule Bochner_Integration.integral_cong[OF refl])+\n         apply clarify\n        subgoal for r r\\<^sub>\\<sigma> \\<alpha> \\<tau> \n          apply(simp only: UNIV_bool spmf_of_set integral_spmf_of_set) \n          apply(simp cong: if_cong split del: if_split)\n          apply(cases \"B r (F\\<^sub>i\\<^sub>n\\<^sub>v r r\\<^sub>\\<sigma> \\<tau>)\") \n          by auto\n        apply(rewrite in \"_ = \\<hole>\" bind_commute_spmf)\n        apply(rewrite in \"bind_spmf _ \\<hole>\"  in \"_ = \\<hole>\" bind_commute_spmf)\n        apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n        apply(rewrite in \"\\<hole> = _\" bind_commute_spmf)\n        apply(rewrite in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n        apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n        apply(simp only: spmf_bind)\n        apply(rule Bochner_Integration.integral_cong[OF refl])+\n        apply clarify\n        subgoal for r r\\<^sub>\\<sigma> \\<alpha> \\<tau> \n          apply(simp only: UNIV_bool spmf_of_set integral_spmf_of_set) \n          apply(simp cong: if_cong split del: if_split)\n          apply(cases \" B r (F\\<^sub>i\\<^sub>n\\<^sub>v r r\\<^sub>\\<sigma> \\<tau>)\") \n          by auto\n        done\n      also have \"... = 1/2*(spmf (HCP_game_true \\<sigma> (if \\<sigma> then b1 else b0)) True) + 1/2*(spmf (HCP_game_false \\<sigma> (if \\<sigma> then b1 else b0)) True)\"\n        by(simp add: spmf_bind UNIV_bool spmf_of_set integral_spmf_of_set)\n      also have \"... = 1/2*(spmf (D_true \\<sigma> (if \\<sigma> then b1 else b0)) True) + 1/2*(spmf (D_false \\<sigma> (if \\<sigma> then b1 else b0)) False)\"   \n      proof-\n        have \"spmf (I \\<bind> (\\<lambda>(\\<alpha>, \\<tau>). etp.S \\<alpha> \\<bind> (\\<lambda>x\\<^sub>\\<sigma>. etp.S \\<alpha> \\<bind> (\\<lambda>x. D2 (\\<sigma>, \\<alpha>, B \\<alpha> x\\<^sub>\\<sigma> = (\\<not> (if \\<sigma> then b1 else b0)), \\<not> B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> x)) \\<bind> (\\<lambda>d. return_spmf (\\<not> d)))))) True \n                = spmf (I \\<bind> (\\<lambda>(\\<alpha>, \\<tau>). etp.S \\<alpha> \\<bind> (\\<lambda>x\\<^sub>\\<sigma>. etp.S \\<alpha> \\<bind> (\\<lambda>x. D2 (\\<sigma>, \\<alpha>, B \\<alpha> x\\<^sub>\\<sigma> = (\\<not> (if \\<sigma> then b1 else b0)), \\<not> B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> x)))))) False\"\n          (is \"?lhs = ?rhs\")\n        proof-\n          have \"?lhs = spmf (I \\<bind> (\\<lambda>(\\<alpha>, \\<tau>). etp.S \\<alpha> \\<bind> (\\<lambda>x\\<^sub>\\<sigma>. etp.S \\<alpha> \\<bind> (\\<lambda>x. D2 (\\<sigma>, \\<alpha>, B \\<alpha> x\\<^sub>\\<sigma> = (\\<not> (if \\<sigma> then b1 else b0)), \\<not> B \\<alpha> (F\\<^sub>i\\<^sub>n\\<^sub>v \\<alpha> \\<tau> x)) \\<bind> (\\<lambda>d. return_spmf (d)))))) False\"\n            by(simp only: split_def return_True_False spmf_bind) \n          then show ?thesis by simp\n        qed\n        then show ?thesis  by(simp add: HCP_game_true_def HCP_game_false_def Let_def D_true_def D_false_def if_distrib[where f=\"(=) _\"] cong: if_cong)   \n      qed\n      also have \"... =  1/2*((spmf (D_true \\<sigma> (if \\<sigma> then b1 else b0) ) True) + (1 - spmf (D_false \\<sigma> (if \\<sigma> then b1 else b0) ) True))\"\n        by(simp add: spmf_False_conv_True lossless_D_false)\n      also have \"... = 1/2 + 1/2* (spmf (D_true \\<sigma> (if \\<sigma> then b1 else b0)) True) - 1/2*(spmf (D_false \\<sigma> (if \\<sigma> then b1 else b0)) True)\" \n        by(simp)     \n      also have \"... =  1/2 + 1/2* (spmf (S2D \\<sigma> (if \\<sigma> then b1 else b0) ) True) - 1/2*(spmf (R2D (b0,b1) \\<sigma> ) True)\"\n        apply(auto  simp add: local.etp.F_f_inv S2D_def R2D_def D_true_def D_false_def  assms split_def cong: bind_spmf_cong_simp)\n         apply(simp add: \\<sigma>_true_b0_true)\n        by(simp add: \\<sigma>_false_b1_true)\n      ultimately show ?thesis by(simp add: S2D_def R2D_def R2_def S2_def split_def)\n    qed\n    then show ?thesis by(auto simp add: funct_OT_12_def)\n  qed\n  thus ?thesis by simp\nqed\n\nlemma P2_adv_bound:\n  assumes lossless_D: \"\\<forall> a. lossless_spmf (D2 a)\"\n  shows \"\\<bar>(spmf (bind_spmf (R2 (b0,b1) \\<sigma>) D2) True) - spmf (funct_OT_12 (b0,b1) \\<sigma> \\<bind> (\\<lambda> (out1, out2). S2 \\<sigma> out2 \\<bind> (\\<lambda> view. D2 view))) True\\<bar>\n                         \\<le> \\<bar>2*((spmf (etp.HCP_game \\<A> \\<sigma> (if \\<sigma> then b1 else b0) D2) True) - 1/2)\\<bar>\"\n  by(cases \"(if \\<sigma> then b0 else b1)\"; auto simp add: R2_S2_False R2_S2_True assms)\n\nsublocale OT_12: sim_det_def R1 S1 R2 S2 funct_OT_12 protocol \n  unfolding sim_det_def_def \n  by(simp add: lossless_R1 lossless_S1 lossless_R2 lossless_S2 funct_OT_12_def)\n\nlemma correct: \"OT_12.correctness m1 m2\"\n  unfolding OT_12.correctness_def  \n  by (metis prod.collapse correctness)\n\nlemma P1_security_inf_the: \"OT_12.perfect_sec_P1 m1 m2\" \n  unfolding OT_12.perfect_sec_P1_def using P1_security by simp \n\nlemma P2_security:\n  assumes \"\\<forall> a. lossless_spmf (D a)\"\n  and \"\\<forall> b\\<^sub>\\<sigma>. etp.HCP_adv \\<A> m2 b\\<^sub>\\<sigma> D \\<le> HCP_ad\"\n  shows \"OT_12.adv_P2 m1 m2 D \\<le> 2 * HCP_ad\"\nproof-\n  have \"spmf (etp.HCP_game \\<A> \\<sigma> (if \\<sigma> then b1 else b0) D) True = spmf (funct_OT_12 (b0,b1) \\<sigma> \\<bind> (\\<lambda> (out1, out2). etp.HCP_game \\<A> \\<sigma> out2 D)) True\"\n    for \\<sigma> b0 b1\n  by(simp add: funct_OT_12_def)\n  hence \"OT_12.adv_P2 m1 m2 D \\<le> \\<bar>2*((spmf (funct_OT_12 m1 m2 \\<bind> (\\<lambda> (out1, out2). etp.HCP_game \\<A> m2 out2 D)) True) - 1/2)\\<bar>\"\n    unfolding OT_12.adv_P2_def using P2_adv_bound assms surj_pair prod.collapse by metis\n  moreover have \"\\<bar>2*((spmf (funct_OT_12 m1 m2 \\<bind> (\\<lambda> (out1, out2). etp.HCP_game \\<A> m2 out2 D)) True) - 1/2)\\<bar> \\<le> \\<bar>2*HCP_ad\\<bar>\" \n  proof -\n    have \"(\\<exists>r. \\<bar>(1::real) / r\\<bar> \\<noteq> 1 / \\<bar>r\\<bar>) \\<or> 2 / \\<bar>1 / (spmf (funct_OT_12 m1 m2 \n                \\<bind> (\\<lambda>(x, y). ((\\<lambda>u b. etp.HCP_game \\<A> m2 b D)::unit \\<Rightarrow> bool \\<Rightarrow> bool spmf) x y)) True - 1 / 2)\\<bar> \n                      \\<le> HCP_ad / (1 / 2)\"\n      using assm_bound_funct_OT_12_collapse assms by auto\n    then show ?thesis\n      by fastforce\n  qed \n  moreover have \"HCP_ad \\<ge> 0\" \n    using assms(2)  local.etp.HCP_adv_def by auto\n  ultimately show ?thesis by argo\nqed\n\nend\n\ntext \\<open> We also consider the asymptotic case for security proofs \\<close>\n\nlocale ETP_sec_para = \n  fixes I :: \"nat \\<Rightarrow> ('index \\<times> 'trap) spmf\"\n    and domain ::  \"'index \\<Rightarrow> 'range set\"\n    and range ::  \"'index \\<Rightarrow> 'range set\"\n    and f :: \"'index \\<Rightarrow> ('range \\<Rightarrow> 'range)\"\n    and F :: \"'index \\<Rightarrow> 'range \\<Rightarrow> 'range\"\n    and F\\<^sub>i\\<^sub>n\\<^sub>v :: \"'index \\<Rightarrow> 'trap \\<Rightarrow> 'range \\<Rightarrow> 'range\"\n    and B :: \"'index \\<Rightarrow> 'range \\<Rightarrow> bool\"\n  assumes ETP_base: \"\\<And> n. ETP_base (I n) domain range F F\\<^sub>i\\<^sub>n\\<^sub>v\"\nbegin\n\nsublocale ETP_base \"(I n)\" domain range \n  using ETP_base  by simp\n\n\n\nlemma P1_sec_asym: \"OT_12.perfect_sec_P1 n m1 m2\"\n  using P1_security_inf_the by simp                                                                \n\nlemma P2_sec_asym: \n  assumes \"\\<forall> a. lossless_spmf (D a)\" \n    and HCP_adv_neg: \"negligible (\\<lambda> n. etp_advantage n)\"\n    and etp_adv_bound: \"\\<forall> b\\<^sub>\\<sigma> n. etp.HCP_adv n \\<A> m2 b\\<^sub>\\<sigma> D \\<le> etp_advantage n\"\n  shows \"negligible (\\<lambda> n. OT_12.adv_P2 n m1 m2 D)\" \nproof-\n  have \"negligible (\\<lambda> n. 2 * etp_advantage n)\" using HCP_adv_neg \n    by (simp add: negligible_cmultI)\n  moreover have \"\\<bar>OT_12.adv_P2 n m1 m2 D\\<bar> = OT_12.adv_P2 n m1 m2 D\" for n unfolding OT_12.adv_P2_def by simp\n  moreover have  \"OT_12.adv_P2 n m1 m2 D \\<le> 2 * etp_advantage n\" for n using assms P2_security by blast\n  ultimately show ?thesis \n    using assms negligible_le HCP_adv_neg P2_security by presburger \nqed\n\nend\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Multi_Party_Computation/ETP_OT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3491914270934561}}
{"text": "theory Inca_to_Ubx_simulation\n  imports List_util Result\n    \"VeriComp.Simulation\"\n    Inca Ubx Ubx_Verification Unboxed_lemmas\nbegin\n\nlemma take_:\"Suc n = length xs \\<Longrightarrow> take n xs = butlast xs\"\n  using butlast_conv_take diff_Suc_1 append_butlast_last_id\n  by (metis butlast_conv_take diff_Suc_1)\n\nlemma append_take_singleton_conv:\"Suc n = length xs \\<Longrightarrow> xs = take n xs @ [xs ! n]\"\nproof (induction xs arbitrary: n)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons x xs)\n  then show ?case\n  proof (cases n)\n    case 0\n    then show ?thesis\n      using Cons\n      by simp\n  next\n    case (Suc n')\n    have \"Suc n' = length xs\"\n      by (rule Cons.prems[unfolded Suc, simplified])\n    from Suc show ?thesis\n      by (auto intro: Cons.IH[OF \\<open>Suc n' = length xs\\<close>])\n  qed\nqed\n\n\nsection \\<open>Locale imports\\<close>\n\nlocale inca_to_ubx_simulation =\n  Sinca: inca\n    Finca_empty Finca_get Finca_add Finca_to_list\n    heap_empty heap_get heap_add heap_to_list\n    uninitialized is_true is_false\n    \\<OO>\\<pp> \\<AA>\\<rr>\\<ii>\\<tt>\\<yy> \\<II>\\<nn>\\<ll>\\<OO>\\<pp> \\<II>\\<nn>\\<ll> \\<II>\\<ss>\\<II>\\<nn>\\<ll> \\<DD>\\<ee>\\<II>\\<nn>\\<ll> +\n  Subx: ubx\n    Fubx_empty Fubx_get Fubx_add Fubx_to_list\n    heap_empty heap_get heap_add heap_to_list\n    uninitialized is_true is_false\n    box_ubx1 unbox_ubx1 box_ubx2 unbox_ubx2\n    \\<OO>\\<pp> \\<AA>\\<rr>\\<ii>\\<tt>\\<yy> \\<II>\\<nn>\\<ll>\\<OO>\\<pp> \\<II>\\<nn>\\<ll> \\<II>\\<ss>\\<II>\\<nn>\\<ll> \\<DD>\\<ee>\\<II>\\<nn>\\<ll> \\<UU>\\<bb>\\<xx>\\<OO>\\<pp> \\<UU>\\<bb>\\<xx> \\<BB>\\<oo>\\<xx> \\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp>\n  for\n    \\<comment> \\<open>Functions environments\\<close>\n    Finca_empty and\n    Finca_get :: \"'fenv_inca \\<Rightarrow> 'fun \\<Rightarrow> ('label, ('dyn, 'var, 'fun, 'label, 'op, 'opinl) Inca.instr) fundef option\" and\n    Finca_add and Finca_to_list and\n\n    Fubx_empty and\n    Fubx_get :: \"'fenv_ubx \\<Rightarrow> 'fun \\<Rightarrow> ('label, ('dyn, 'var, 'fun, 'label, 'op, 'opinl, 'opubx, 'ubx1, 'ubx2) Ubx.instr) fundef option\" and\n    Fubx_add and Fubx_to_list and\n\n    \\<comment> \\<open>Memory heap\\<close>\n    heap_empty and heap_get :: \"'henv \\<Rightarrow> 'var \\<times> 'dyn \\<Rightarrow> 'dyn option\" and heap_add and heap_to_list and\n\n    \\<comment> \\<open>Dynamic values\\<close>\n    uninitialized :: 'dyn and is_true and is_false and\n\n    \\<comment> \\<open>Unboxed values\\<close>\n    box_ubx1 and unbox_ubx1 and\n    box_ubx2 and unbox_ubx2 and\n\n    \\<comment> \\<open>n-ary operations\\<close>\n    \\<OO>\\<pp> and \\<AA>\\<rr>\\<ii>\\<tt>\\<yy> and \\<II>\\<nn>\\<ll>\\<OO>\\<pp> and \\<II>\\<nn>\\<ll> and \\<II>\\<ss>\\<II>\\<nn>\\<ll> and \\<DD>\\<ee>\\<II>\\<nn>\\<ll> and \\<UU>\\<bb>\\<xx>\\<OO>\\<pp> and \\<UU>\\<bb>\\<xx> and \\<BB>\\<oo>\\<xx> and \\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp>\nbegin\n\n\nsection \\<open>Normalization\\<close>\n\nfun norm_instr where\n  \"norm_instr (Ubx.IPush d) = Inca.IPush d\" |\n  \"norm_instr (Ubx.IPushUbx1 n) = Inca.IPush (box_ubx1 n)\" |\n  \"norm_instr (Ubx.IPushUbx2 b) = Inca.IPush (box_ubx2 b)\" |\n  \"norm_instr Ubx.IPop = Inca.IPop\" |\n  \"norm_instr (Ubx.IGet n) = Inca.IGet n\" |\n  \"norm_instr (Ubx.IGetUbx _ n) = Inca.IGet n\" |\n  \"norm_instr (Ubx.ISet n) = Inca.ISet n\" |\n  \"norm_instr (Ubx.ISetUbx _ n) = Inca.ISet n\" |\n  \"norm_instr (Ubx.ILoad x) = Inca.ILoad x\" |\n  \"norm_instr (Ubx.ILoadUbx _ x) = Inca.ILoad x\" |\n  \"norm_instr (Ubx.IStore x) = Inca.IStore x\" |\n  \"norm_instr (Ubx.IStoreUbx _ x) = Inca.IStore x\" |\n  \"norm_instr (Ubx.IOp op) = Inca.IOp op\" |\n  \"norm_instr (Ubx.IOpInl op) = Inca.IOpInl op\" |\n  \"norm_instr (Ubx.IOpUbx op) = Inca.IOpInl (\\<BB>\\<oo>\\<xx> op)\" |\n  \"norm_instr (Ubx.ICJump l\\<^sub>t l\\<^sub>f) = Inca.ICJump l\\<^sub>t l\\<^sub>f\" |\n  \"norm_instr (Ubx.ICall x) = Inca.ICall x\" |\n  \"norm_instr Ubx.IReturn = Inca.IReturn\"\n\nlemma norm_generalize_instr[simp]: \"norm_instr (Subx.generalize_instr instr) = norm_instr instr\"\n  by (cases instr) simp_all\n\nabbreviation norm_eq where\n  \"norm_eq x y \\<equiv> x = norm_instr y\"\n\ndefinition rel_fundefs where\n  \"rel_fundefs f g = (\\<forall>x. rel_option (rel_fundef (=) norm_eq) (f x) (g x))\"\n\nlemma rel_fundefsI:\n  assumes \"\\<And>x. rel_option (rel_fundef (=) norm_eq) (F1 x) (F2 x)\"\n  shows \"rel_fundefs F1 F2\"\n  using assms\n  by (simp add: rel_fundefs_def)\n\nlemma rel_fundefsD:\n  assumes \"rel_fundefs F1 F2\"\n  shows \"rel_option (rel_fundef (=) norm_eq) (F1 x) (F2 x)\"\n  using assms\n  by (simp add: rel_fundefs_def)\n\nlemma rel_fundefs_next_instr:\n  assumes rel_F1_F2: \"rel_fundefs F1 F2\"\n  shows \"rel_option norm_eq (next_instr F1 f l pc) (next_instr F2 f l pc)\"\n  using rel_F1_F2[THEN rel_fundefsD, of f]\nproof (cases rule: option.rel_cases)\n  case None\n  thus ?thesis by (simp add: next_instr_def)\nnext\n  case (Some fd1 fd2)\n  then show ?thesis\n    by (auto simp: next_instr_def intro: rel_fundef_imp_rel_option_instr_at)\nqed\n\nlemma rel_fundefs_next_instr1:\n  assumes rel_F1_F2: \"rel_fundefs F1 F2\" and next_instr1: \"next_instr F1 f l pc = Some instr1\"\n  shows \"\\<exists>instr2. next_instr F2 f l pc = Some instr2 \\<and> norm_eq instr1 instr2\"\n  using rel_fundefs_next_instr[OF rel_F1_F2, of f l pc]\n  unfolding next_instr1\n  unfolding option_rel_Some1\n  by assumption\n\nlemma rel_fundefs_next_instr2:\n  assumes rel_F1_F2: \"rel_fundefs F1 F2\" and next_instr2: \"next_instr F2 f l pc = Some instr2\"\n  shows \"\\<exists>instr1. next_instr F1 f l pc = Some instr1 \\<and> norm_eq instr1 instr2\"\n  using rel_fundefs_next_instr[OF rel_F1_F2, of f l pc]\n  unfolding next_instr2\n  unfolding option_rel_Some2\n  by assumption\n\nlemma rel_fundefs_empty: \"rel_fundefs (\\<lambda>_. None) (\\<lambda>_. None)\"\n  by (simp add: rel_fundefs_def)\n\nlemma rel_fundefs_None1:\n  assumes \"rel_fundefs f g\" and \"f x = None\"\n  shows \"g x = None\"\n  by (metis assms rel_fundefs_def rel_option_None1)\n\nlemma rel_fundefs_None2:\n  assumes \"rel_fundefs f g\" and \"g x = None\"\n  shows \"f x = None\"\n  by (metis assms rel_fundefs_def rel_option_None2)\n\nlemma rel_fundefs_Some1:\n  assumes \"rel_fundefs f g\" and \"f x = Some y\"\n  shows \"\\<exists>z. g x = Some z \\<and> rel_fundef (=) norm_eq y z\"\nproof -\n  from assms(1) have \"rel_option (rel_fundef (=) norm_eq) (f x) (g x)\"\n    unfolding rel_fundefs_def by simp\n  with assms(2) show ?thesis\n    by (simp add: option_rel_Some1)\nqed\n\nlemma rel_fundefs_Some2:\n  assumes \"rel_fundefs f g\" and \"g x = Some y\"\n  shows \"\\<exists>z. f x = Some z \\<and> rel_fundef (=) norm_eq z y\"\nproof -\n  from assms(1) have \"rel_option (rel_fundef (=) norm_eq) (f x) (g x)\"\n    unfolding rel_fundefs_def by simp\n  with assms(2) show ?thesis\n    by (simp add: option_rel_Some2)\nqed\n\nlemma rel_fundefs_rel_option:\n  assumes \"rel_fundefs f g\" and \"\\<And>x y. rel_fundef (=) norm_eq x y \\<Longrightarrow> h x y\"\n  shows \"rel_option h (f z) (g z)\"\nproof -\n  have \"rel_option (rel_fundef (=) norm_eq) (f z) (g z)\"\n    using assms(1)[unfolded rel_fundefs_def] by simp\n  then show ?thesis\n    unfolding rel_option_unfold\n    by (auto simp add: assms(2))\nqed\n\nlemma rel_fundef_generalizeI:\n  assumes \"rel_fundef (=) norm_eq fd1 fd2\"\n  shows \"rel_fundef (=) norm_eq fd1 (Subx.generalize_fundef fd2)\"\n  using assms\n  by (cases rule: fundef.rel_cases)\n    (auto simp: map_ran_def list.rel_map elim: list.rel_mono_strong)\n\nlemma rel_fundefs_generalizeI:\n  assumes \"rel_fundefs (Finca_get F1) (Fubx_get F2)\"\n  shows \"rel_fundefs (Finca_get F1) (Fubx_get (Subx.Fenv.map_entry F2 f Subx.generalize_fundef))\"\nproof (rule rel_fundefsI)\n  fix x\n  show \"rel_option (rel_fundef (=) norm_eq)\n    (Finca_get F1 x) (Fubx_get (Subx.Fenv.map_entry F2 f Subx.generalize_fundef) x)\"\n    unfolding Subx.Fenv.get_map_entry_conv\n    unfolding option.rel_map\n    using assms(1)[THEN rel_fundefsD, of x]\n    by (auto intro: rel_fundef_generalizeI elim: option.rel_mono_strong)\nqed\n\nlemma rel_fundefs_rewriteI:\n  assumes\n    rel_F1_F2: \"rel_fundefs (Finca_get F1) (Fubx_get F2)\" and\n    \"norm_eq instr1' instr2'\"\n  shows \"rel_fundefs\n    (Finca_get (Sinca.Fenv.map_entry F1 f (\\<lambda>fd. rewrite_fundef_body fd l pc instr1')))\n    (Fubx_get (Subx.Fenv.map_entry F2 f (\\<lambda>fd. rewrite_fundef_body fd l pc instr2')))\"\n  (is \"rel_fundefs (Finca_get ?F1') (Fubx_get ?F2')\")\nproof (rule rel_fundefsI)\n  fix x\n  show \"rel_option (rel_fundef (=) norm_eq) (Finca_get ?F1' x) (Fubx_get ?F2' x)\"\n  proof (cases \"f = x\")\n    case True\n    show ?thesis\n      using rel_F1_F2[THEN rel_fundefsD, of x] True assms(2)\n      by (cases rule: option.rel_cases) (auto intro: rel_fundef_rewrite_body)\n  next\n    case False\n    then show ?thesis\n      using rel_F1_F2[THEN rel_fundefsD, of x] by simp\n  qed\nqed\n\n\nsection \\<open>Equivalence of call stacks\\<close>\n\ndefinition norm_stack :: \"('dyn, 'ubx1, 'ubx2) unboxed list \\<Rightarrow> 'dyn list\" where\n  \"norm_stack \\<Sigma> \\<equiv> List.map Subx.norm_unboxed \\<Sigma>\"\n\nlemma norm_stack_Nil[simp]: \"norm_stack [] = []\"\n  by (simp add: norm_stack_def)\n\nlemma norm_stack_Cons[simp]: \"norm_stack (d # \\<Sigma>) = Subx.norm_unboxed d # norm_stack \\<Sigma>\"\n  by (simp add: norm_stack_def)\n\nlemma norm_stack_append: \"norm_stack (xs @ ys) = norm_stack xs @ norm_stack ys\"\n  by (simp add: norm_stack_def)\n\nlemmas drop_norm_stack = drop_map[where f = Subx.norm_unboxed, folded norm_stack_def]\nlemmas take_norm_stack = take_map[where f = Subx.norm_unboxed, folded norm_stack_def]\nlemmas norm_stack_map = map_map[where f = Subx.norm_unboxed, folded norm_stack_def]\n\nlemma norm_box_stack[simp]: \"norm_stack (map Subx.box_operand \\<Sigma>) = norm_stack \\<Sigma>\"\n  by (induction \\<Sigma>) (auto simp: norm_stack_def)\n\nlemma length_norm_stack[simp]: \"length (norm_stack xs) = length xs\"\n  by (simp add: norm_stack_def)\n\ndefinition is_valid_fun_call where\n  \"is_valid_fun_call F f l pc \\<Sigma> g \\<equiv> next_instr F f l pc = Some (ICall g) \\<and>\n      (\\<exists>gd. F g = Some gd \\<and> arity gd \\<le> length \\<Sigma> \\<and> list_all is_dyn_operand (take (arity gd) \\<Sigma>))\"\n\nlemma is_valid_funcall_map_entry_generalize_fundefI:\n  assumes \"is_valid_fun_call (Fubx_get F2) g l pc \\<Sigma> z\"\n  shows \"is_valid_fun_call (Fubx_get (Subx.Fenv.map_entry F2 f Subx.generalize_fundef)) g l pc \\<Sigma> z\"\nproof (cases \"f = z\")\n  case True\n  then show ?thesis\n    using assms\n    by (cases \"z = g\")\n      (auto simp: is_valid_fun_call_def next_instr_def Subx.instr_at_generalize_fundef_conv)\nnext\n  case False\n  then show ?thesis\n    using assms\n    by (cases \"Fubx_get F2 g\")\n      (auto simp: is_valid_fun_call_def next_instr_def\n          Subx.instr_at_generalize_fundef_conv Subx.Fenv.get_map_entry_conv)\nqed\n\nlemma is_valid_fun_call_map_box_operandI:\n  assumes \"is_valid_fun_call (Fubx_get F2) g l pc \\<Sigma> z\"\n  shows \"is_valid_fun_call (Fubx_get F2) g l pc (map Subx.box_operand \\<Sigma>) z\"\n  using assms\n  unfolding is_valid_fun_call_def\n  by (auto simp: take_map list.pred_map list.pred_True)\n\nlemma inst_at_rewrite_fundef_body_disj:\n  \"instr_at (rewrite_fundef_body fd l pc instr) l pc = Some instr \\<or>\n   instr_at (rewrite_fundef_body fd l pc instr) l pc = None\"\nproof (cases fd)\n  case (Fundef bblocks ar locals)\n  show ?thesis\n  proof (cases \"map_of bblocks l\")\n    case None\n    thus ?thesis\n      using Fundef\n      by (simp add: rewrite_fundef_body_def instr_at_def map_entry_map_of_None_conv)\n  next\n    case (Some instr')\n    moreover hence \"l \\<in> fst ` set bblocks\"\n      by (meson domI domIff map_of_eq_None_iff)\n    ultimately show ?thesis\n      using Fundef\n      apply (auto simp add: rewrite_fundef_body_def instr_at_def map_entry_map_of_Some_conv)\n      by (smt (verit, ccfv_threshold) length_list_update nth_list_update_eq option.case_eq_if option.distinct(1) option.sel update_Some_unfold)\n  qed\nqed\n\nlemma is_valid_fun_call_map_entry_conv:\n  assumes \"next_instr (Fubx_get F2) f l pc = Some instr\" \"\\<not> is_fun_call instr\" \"\\<not> is_fun_call instr'\"\n  shows\n    \"is_valid_fun_call (Fubx_get (Subx.Fenv.map_entry F2 f (\\<lambda>fd. rewrite_fundef_body fd l pc instr')))=\n     is_valid_fun_call (Fubx_get F2)\"\nproof (intro ext)\n  fix f' l' pc' \\<Sigma> g\n  show\n    \"is_valid_fun_call (Fubx_get (Subx.Fenv.map_entry F2 f (\\<lambda>fd. rewrite_fundef_body fd l pc instr'))) f' l' pc' \\<Sigma> g =\n     is_valid_fun_call (Fubx_get F2) f' l' pc' \\<Sigma> g\"\n  proof (cases \"f = f'\")\n    case True\n    then show ?thesis\n      using assms\n      apply (cases \"f = g\")\n      by (auto simp: is_valid_fun_call_def next_instr_eq_Some_conv\n          instr_at_rewrite_fundef_body_conv if_split_eq1)\n  next\n    case False\n    then show ?thesis\n      using assms\n      apply (cases \"f = g\")\n      by (auto simp: is_valid_fun_call_def next_instr_eq_Some_conv)\n  qed\nqed\n\nlemma is_valid_fun_call_map_entry_neq_f_neq_l:\n  assumes \"f \\<noteq> g\" \"l \\<noteq> l'\"\n  shows\n    \"is_valid_fun_call (Fubx_get (Subx.Fenv.map_entry F2 f (\\<lambda>fd. rewrite_fundef_body fd l pc instr'))) g l' =\n     is_valid_fun_call (Fubx_get F2) g l'\"\n  apply (intro ext)\n  unfolding is_valid_fun_call_def\n  using assms\n  apply (simp add: next_instr_eq_Some_conv)\n  apply (rule iffI; simp)\n  unfolding Subx.Fenv.get_map_entry_conv\n  apply simp\n   apply (metis arity_rewrite_fundef_body)\n  apply safe\n  by simp\n\ninductive rel_stacktraces for F where\n  rel_stacktraces_Nil:\n    \"rel_stacktraces F opt [] []\" |\n\n  rel_stacktraces_Cons:\n    \"rel_stacktraces F (Some f) st1 st2 \\<Longrightarrow>\n    \\<Sigma>1 = map Subx.norm_unboxed \\<Sigma>2 \\<Longrightarrow>\n    R1 = map Subx.norm_unboxed R2 \\<Longrightarrow>\n    list_all is_dyn_operand R2 \\<Longrightarrow>\n    F f = Some fd2 \\<Longrightarrow> map_of (body fd2) l = Some instrs \\<Longrightarrow>\n    Subx.sp_instrs (map_option funtype \\<circ> F) (return fd2) (take pc instrs) [] (map typeof \\<Sigma>2) \\<Longrightarrow>\n    pred_option (is_valid_fun_call F f l pc \\<Sigma>2) opt \\<Longrightarrow>\n    rel_stacktraces F opt (Frame f l pc R1 \\<Sigma>1 # st1) (Frame f l pc R2 \\<Sigma>2 # st2)\"\n\nlemma rel_stacktraces_map_entry_gneralize_fundefI[intro]:\n  assumes \"rel_stacktraces (Fubx_get F2) opt st1 st2\"\n  shows \"rel_stacktraces (Fubx_get (Subx.Fenv.map_entry F2 f Subx.generalize_fundef))\n    opt st1 (Subx.box_stack f st2)\"\n  using assms(1)\nproof (induction opt st1 st2 rule: rel_stacktraces.induct)\n  case (rel_stacktraces_Nil opt)\n  thus ?case\n    by (auto intro: rel_stacktraces.rel_stacktraces_Nil)\nnext\n  case (rel_stacktraces_Cons g st1 st2 \\<Sigma>1 \\<Sigma>2 R1 R2 gd2 l instrs pc opt)\n  show ?case\n  proof (cases \"f = g\")\n    case True\n    then show ?thesis\n      using rel_stacktraces_Cons\n    apply auto\n     apply (rule rel_stacktraces.rel_stacktraces_Cons)\n             apply assumption\n            apply simp\n           apply (rule refl)\n          apply assumption\n        apply simp\n      by (auto simp add: take_map Subx.map_of_generalize_fundef_conv\n          intro!: Subx.sp_instrs_generalize0\n          intro!: is_valid_funcall_map_entry_generalize_fundefI is_valid_fun_call_map_box_operandI\n          elim!: option.pred_mono_strong)\n  next\n    case False\n    then show ?thesis\n      using rel_stacktraces_Cons\n      by (auto intro: rel_stacktraces.intros is_valid_funcall_map_entry_generalize_fundefI\n          elim!: option.pred_mono_strong)\n  qed\nqed\n\nlemma rel_stacktraces_map_entry_rewrite_fundef_body:\n  assumes\n    \"rel_stacktraces (Fubx_get F2) opt st1 st2\" and\n    \"next_instr (Fubx_get F2) f l pc = Some instr\" and\n    \"\\<And>ret. Subx.sp_instr (map_option funtype \\<circ> Fubx_get F2) ret instr =\n      Subx.sp_instr (map_option funtype \\<circ> Fubx_get F2) ret instr'\" and\n    \"\\<not> is_fun_call instr\" \"\\<not> is_fun_call instr'\"\n  shows \"rel_stacktraces\n    (Fubx_get (Subx.Fenv.map_entry F2 f (\\<lambda>fd. rewrite_fundef_body fd l pc instr'))) opt st1 st2\"\n  using assms(1)\nproof (induction opt st1 st2 rule: rel_stacktraces.induct)\n  case (rel_stacktraces_Nil opt)\n  then show ?case \n    by (auto intro: rel_stacktraces.rel_stacktraces_Nil)\nnext\n  case (rel_stacktraces_Cons g st1 st2 \\<Sigma>1 \\<Sigma>2 R1 R2 gd2 l' instrs pc' opt)\n  show ?case (is \"rel_stacktraces (Fubx_get ?F2') opt ?st1 ?st2\")\n  proof (cases \"f = g\")\n    case True\n    show ?thesis\n    proof (cases \"l' = l\")\n      case True\n      show ?thesis\n        apply (rule rel_stacktraces.rel_stacktraces_Cons)\n        using rel_stacktraces_Cons.IH apply simp\n        using rel_stacktraces_Cons.hyps apply simp\n        using rel_stacktraces_Cons.hyps apply simp\n        using rel_stacktraces_Cons.hyps apply simp\n        using rel_stacktraces_Cons.hyps \\<open>f = g\\<close> apply simp\n        using rel_stacktraces_Cons.hyps True apply simp\n        using rel_stacktraces_Cons.hyps apply simp\n        using rel_stacktraces_Cons.hyps assms \\<open>f = g\\<close> True\n         apply (cases \"pc' \\<le> pc\") []\n         apply (auto simp add: take_update_swap intro!: Subx.sp_instrs_list_update\n            dest!: next_instrD instr_atD) [2]\n        using rel_stacktraces_Cons.hyps\n        unfolding is_valid_fun_call_map_entry_conv[OF assms(2,4,5)]\n        by simp\n    next\n      case False\n      show ?thesis\n      proof (rule rel_stacktraces.rel_stacktraces_Cons)\n        show \"Fubx_get ?F2' g = Some (rewrite_fundef_body gd2 l pc instr')\"\n          unfolding \\<open>f = g\\<close>\n          using rel_stacktraces_Cons.hyps by simp\n      next\n        show \"pred_option (is_valid_fun_call (Fubx_get ?F2') g l' pc' \\<Sigma>2) opt\"\n          unfolding is_valid_fun_call_map_entry_conv[OF assms(2,4,5)]\n          using rel_stacktraces_Cons.hyps by simp\n      qed (insert rel_stacktraces_Cons False, simp_all)\n    qed\n  next\n    case False\n    then show ?thesis\n      using rel_stacktraces_Cons\n      by (auto simp: is_valid_fun_call_map_entry_conv[OF assms(2,4,5)]\n          intro!: rel_stacktraces.rel_stacktraces_Cons)\n  qed\nqed\n\n\nsection \\<open>Simulation relation\\<close>\n\ninductive match (infix \"\\<sim>\" 55) where\n  matchI: \"Subx.wf_state (State F2 H st2) \\<Longrightarrow>\n    rel_fundefs (Finca_get F1) (Fubx_get F2) \\<Longrightarrow>\n    rel_stacktraces (Fubx_get F2) None st1 st2 \\<Longrightarrow>\n    match (State F1 H st1) (State F2 H st2)\"\n\nlemmas matchI[consumes 0, case_names wf_state rel_fundefs rel_stacktraces] = match.intros(1)\n\n\nsection \\<open>Backward simulation\\<close>\n\nlemma map_eq_append_map_drop:\n  \"map f xs = ys @ map f (drop n xs) \\<longleftrightarrow> map f (take n xs) = ys\"\n  by (metis append_same_eq append_take_drop_id map_append)\n\nlemma ap_map_list_cast_Dyn_to_map_norm:\n  assumes \"ap_map_list cast_Dyn xs = Some ys\"\n  shows \"ys = map Subx.norm_unboxed xs\"\nproof -\n  from assms have \"list_all2 (\\<lambda>x y. cast_Dyn x = Some y) xs ys\"\n    by (simp add: ap_map_list_iff_list_all2)\n  thus ?thesis\n    by (induction xs ys rule: list.rel_induct) (auto dest: cast_inversions)\nqed\n\nlemma ap_map_list_cast_Dyn_to_all_Dyn:\n  assumes \"ap_map_list cast_Dyn xs = Some ys\"\n  shows \"list_all (\\<lambda>x. typeof x = None) xs\"\nproof -\n  from assms have \"list_all2 (\\<lambda>x y. cast_Dyn x = Some y) xs ys\"\n    by (simp add: ap_map_list_iff_list_all2)\n  hence \"list_all2 (\\<lambda>x y. typeof x = None) xs ys\"\n    by (auto intro: list.rel_mono_strong cast_Dyn_eq_Some_imp_typeof)\n  thus ?thesis\n    by (induction xs ys rule: list.rel_induct) auto\nqed\n\nlemma ap_map_list_cast_Dyn_map_typeof_replicate_conv:\n  assumes \"ap_map_list cast_Dyn xs = Some ys\" and \"n = length xs\"\n  shows \"map typeof xs = replicate n None\"\n  using assms\n  by (auto simp: list.pred_set intro!: replicate_eq_map[symmetric]\n        dest!: ap_map_list_cast_Dyn_to_all_Dyn)\n\nlemma cast_Dyn_eq_Some_conv_norm_unboxed[simp]: \"cast_Dyn i = Some i' \\<Longrightarrow> Subx.norm_unboxed i = i'\"\n  by (cases i) simp_all\n\nlemma cast_Dyn_eq_Some_conv_typeof[simp]: \"cast_Dyn i = Some i' \\<Longrightarrow> typeof i = None\"\n  by (cases i) simp_all\n\nlemma backward_lockstep_simulation:\n  assumes \"match s1 s2\" and \"Subx.step s2 s2'\"\n  shows \"\\<exists>s1'. Sinca.step s1 s1' \\<and> match s1' s2'\"\n  using assms\nproof (induction s1 s2 rule: match.induct)\n  case (matchI F2 H st2 F1 st1)\n  from matchI(3,1,2,4) show ?case\n  proof (induction \"None :: 'fun option\" st1 st2 rule: rel_stacktraces.induct)\n    case rel_stacktraces_Nil\n    hence False by (auto elim: Subx.step.cases)\n    thus ?case by simp\n  next\n    case (rel_stacktraces_Cons f st1 st2 \\<Sigma>1 \\<Sigma>2 R1 R2 fd2 l instrs pc)\n    note hyps = rel_stacktraces_Cons.hyps\n    note prems = rel_stacktraces_Cons.prems\n    have wf_state2: \"Subx.wf_state (State F2 H (Frame f l pc R2 \\<Sigma>2 # st2))\" using prems by simp\n    have rel_F1_F2: \"rel_fundefs (Finca_get F1) (Fubx_get F2)\" using prems by simp\n    have rel_st1_st2: \"rel_stacktraces (Fubx_get F2) (Some f) st1 st2\" using hyps by simp\n    have \\<Sigma>1_def: \"\\<Sigma>1 = map Subx.norm_unboxed \\<Sigma>2\" using hyps by simp\n    have R1_def: \"R1 = map Subx.norm_unboxed R2\" using hyps by simp\n    have all_dyn_R2: \"list_all is_dyn_operand R2\" using hyps by simp\n    have F2_f: \"Fubx_get F2 f = Some fd2\" using hyps by simp\n    have map_of_fd2_l: \"map_of (body fd2) l = Some instrs\" using hyps by simp\n    have sp_instrs_prefix: \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2) (return fd2)\n      (take pc instrs) [] (map typeof \\<Sigma>2)\"\n      using hyps by simp\n\n    note next_instr2 = rel_fundefs_next_instr2[OF rel_F1_F2]\n    note sp_instrs_prefix' =\n      Subx.sp_instrs_singletonI[THEN Subx.sp_instrs_appendI[OF sp_instrs_prefix]]\n\n    obtain fd1 where\n      F1_f: \"Finca_get F1 f = Some fd1\" and rel_fd1_fd2: \"rel_fundef (=) norm_eq fd1 fd2\"\n      using rel_fundefs_Some2[OF rel_F1_F2 F2_f] by auto\n\n    have wf_F2: \"Subx.wf_fundefs (Fubx_get F2)\"\n      by (rule wf_state2[THEN Subx.wf_stateD, simplified])\n\n    have wf_fd2: \"Subx.wf_fundef (map_option funtype \\<circ> Fubx_get F2) fd2\"\n      using F2_f wf_F2[THEN Subx.wf_fundefsD, THEN spec, of f]\n      by simp\n\n    have\n      instrs_neq_Nil: \"instrs \\<noteq> []\" and\n      all_jumps_in_range: \"list_all (Subx.jump_in_range (fst ` set (body fd2))) instrs\" and\n      sp_instrs_instrs: \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2) (return fd2) instrs [] []\"\n      using list_all_map_of_SomeD[OF wf_fd2[THEN Subx.wf_fundef_all_wf_basic_blockD] map_of_fd2_l]\n      by (auto dest: Subx.wf_basic_blockD)\n\n    have sp_instrs_instrs': \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2) (return fd2)\n      (butlast instrs @ [instrs ! pc]) [] []\" if pc_def: \"pc = length instrs - 1\"\n      unfolding pc_def last_conv_nth[OF instrs_neq_Nil, symmetric]\n      unfolding append_butlast_last_id[OF instrs_neq_Nil]\n      by (rule sp_instrs_instrs)\n\n    have sp_instr_last: \"Subx.sp_instr (map_option funtype \\<circ> Fubx_get F2) (return fd2)\n      (instrs ! pc) (map typeof \\<Sigma>2) []\" if pc_def: \"pc = length instrs - 1\"\n      using sp_instrs_instrs'[OF pc_def]\n      using sp_instrs_prefix[unfolded pc_def butlast_conv_take[symmetric]]\n      by (auto dest!: Subx.sp_instrs_appendD')\n\n    from list_all_map_of_SomeD[OF wf_fd2[THEN Subx.wf_fundef_all_wf_basic_blockD] map_of_fd2_l]\n    have is_jump_nthD: \"\\<And>n. is_jump (instrs ! n) \\<Longrightarrow> n < length instrs \\<Longrightarrow> n = length instrs - 1\"\n      by (auto dest!: Subx.wf_basic_blockD\n            list_all_butlast_not_nthD[of \"\\<lambda>i. \\<not> is_jump i \\<and> \\<not> Ubx.instr.is_return i\", simplified, OF _ disjI1])\n\n    note wf_s2' = Subx.wf_state_step_preservation[OF wf_state2 prems(3)]\n    \n    from prems(3) show ?case\n      using wf_s2'\n    proof (induction \"State F2 H (Frame f l pc R2 \\<Sigma>2 # st2)\" s2' rule: Subx.step.induct)\n      case (step_push d)\n      let ?st1' = \"Frame f l (Suc pc) R1 (d # \\<Sigma>1) # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          using step_push.hyps\n          by (auto intro!: Sinca.step_push dest: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_push.hyps rel_stacktraces_Cons\n          using Subx.sp_instr.Push[THEN sp_instrs_prefix']\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_push.prems rel_F1_F2\n          by (auto intro: match.intros)\n      qed\n    next\n      case (step_push_ubx1 n)\n      let ?st1' = \"Frame f l (Suc pc) R1 (box_ubx1 n # \\<Sigma>1) # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          using step_push_ubx1.hyps\n          by (auto intro!: Sinca.step_push dest: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_push_ubx1.hyps rel_stacktraces_Cons\n          using Subx.sp_instr.PushUbx1[THEN sp_instrs_prefix']\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_push_ubx1.prems rel_F1_F2\n          by (auto intro!: match.intros)\n      qed\n    next\n      case (step_push_ubx2 b)\n      let ?st1' = \"Frame f l (Suc pc) R1 (box_ubx2 b # \\<Sigma>1) # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          using step_push_ubx2.hyps\n          by (auto intro!: Sinca.step_push dest: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_push_ubx2.hyps rel_stacktraces_Cons\n          using Subx.sp_instr.PushUbx2[THEN sp_instrs_prefix']\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_push_ubx2.prems rel_F1_F2\n          by (auto intro!: match.intros)\n      qed\n    next\n      case (step_pop d \\<Sigma>2')\n      let ?st1' = \"Frame f l (Suc pc) R1 (map Subx.norm_unboxed \\<Sigma>2') # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_pop.hyps\n          by (auto intro!: Sinca.step_pop dest: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_pop.hyps rel_stacktraces_Cons\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Pop\n              dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_pop.prems rel_F1_F2\n          by (auto intro!: match.intros)\n      qed\n    next\n      case (step_get n d)\n      let ?st1' = \"Frame f l (Suc pc) R1 (R1 ! n # map Subx.norm_unboxed \\<Sigma>2) # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def R1_def\n          using step_get.hyps\n          by (auto intro!: Sinca.step_get dest: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_get.hyps rel_stacktraces_Cons\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Get\n              dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_get.prems rel_F1_F2\n          by (auto intro!: match.intros)\n      qed\n    next\n      case (step_get_ubx_hit \\<tau> n d blob)\n      let ?st1' = \"Frame f l (Suc pc) R1 (R1 ! n # map Subx.norm_unboxed \\<Sigma>2) # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def R1_def\n          using step_get_ubx_hit.hyps\n          by (auto intro!: Sinca.step_get dest: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_get_ubx_hit.hyps rel_stacktraces_Cons\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.GetUbx\n              dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_get_ubx_hit.prems rel_F1_F2\n          by (auto intro!: match.intros)\n      qed\n    next\n      case (step_get_ubx_miss \\<tau> n d F2')\n      hence \"R1 ! n = d\"\n        by (simp add: R1_def)\n      let ?st1' = \"Frame f l (Suc pc) R1 (R1 ! n # map Subx.norm_unboxed \\<Sigma>2) # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2' H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def R1_def\n          using step_get_ubx_miss.hyps\n          by (auto intro!: Sinca.step_get dest: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2') None ?st1' ?st2'\"\n          apply simp\n        proof (rule rel_stacktraces.intros)\n          show \"rel_stacktraces (Fubx_get F2') (Some f) st1 (Subx.box_stack f st2)\"\n            unfolding step_get_ubx_miss.hyps\n            using rel_st1_st2\n            by (rule rel_stacktraces_map_entry_gneralize_fundefI)\n        next\n          show \"Fubx_get F2' f = Some (Subx.generalize_fundef fd2)\"\n            unfolding step_get_ubx_miss.hyps\n            using F2_f\n            by simp\n        next\n          show \"map_of (body (Subx.generalize_fundef fd2)) l = Some (map Subx.generalize_instr instrs)\"\n            unfolding Subx.map_of_generalize_fundef_conv\n            unfolding map_of_fd2_l\n            by simp\n        next\n          show \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2')\n            (return (Subx.generalize_fundef fd2))\n            (take (Suc pc) (map Subx.generalize_instr instrs))\n            [] (map typeof (OpDyn d # map Subx.box_operand \\<Sigma>2))\"\n            using step_get_ubx_miss.hyps F2_f map_of_fd2_l\n            by (auto simp: take_map take_Suc_conv_app_nth simp del: map_append\n              intro!: sp_instrs_prefix'[THEN Subx.sp_instrs_generalize0] Subx.sp_instr.GetUbx\n              dest!: next_instrD instr_atD)\n        qed (insert R1_def all_dyn_R2 \\<open>R1 ! n = d\\<close>, simp_all)\n        thus \"?MATCH ?s1' (State F2' H ?st2')\"\n          using step_get_ubx_miss.prems rel_F1_F2\n          unfolding step_get_ubx_miss.hyps\n          by (auto intro!: match.intros rel_fundefs_generalizeI)\n      qed\n    next\n      case (step_set n blob d R2' \\<Sigma>2')\n      let ?st1' = \"Frame f l (Suc pc) (map Subx.norm_unboxed R2') (map Subx.norm_unboxed \\<Sigma>2') # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def R1_def\n          using step_set.hyps\n          by (auto simp: map_update intro!: Sinca.step_set dest!: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_set.hyps rel_stacktraces_Cons\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Set\n              intro: list_all_list_updateI\n              dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_set.prems rel_F1_F2\n          by (auto intro!: match.intros)\n      qed\n    next\n      case (step_set_ubx \\<tau> n blob d R2' \\<Sigma>2')\n      let ?st1' = \"Frame f l (Suc pc) (map Subx.norm_unboxed R2') (map Subx.norm_unboxed \\<Sigma>2') # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def R1_def\n          using step_set_ubx.hyps\n          by (auto simp: map_update intro!: Sinca.step_set dest!: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_set_ubx.hyps rel_stacktraces_Cons\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.SetUbx\n              intro: list_all_list_updateI\n              dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_set_ubx.prems rel_F1_F2\n          by (auto intro!: match.intros)\n      qed\n    next\n      case (step_load x i i' d \\<Sigma>2')\n      let ?st1' = \"Frame f l (Suc pc) R1 (d # map Subx.norm_unboxed \\<Sigma>2') # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_load.hyps\n          by (auto intro!: Sinca.step_load dest!: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_load.hyps rel_stacktraces_Cons\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Load\n              dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_load.prems rel_F1_F2\n          by (auto intro!: match.intros)\n      qed\n    next\n      case (step_load_ubx_hit \\<tau> x i i' d blob \\<Sigma>2')\n      let ?st1' = \"Frame f l (Suc pc) R1 (d # map Subx.norm_unboxed \\<Sigma>2') # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_load_ubx_hit.hyps\n          by (auto intro!: Sinca.step_load dest!: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_load_ubx_hit.hyps rel_stacktraces_Cons\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.LoadUbx\n              dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_load_ubx_hit.prems rel_F1_F2\n          by (auto intro!: match.intros)\n      qed\n    next\n      case (step_load_ubx_miss \\<tau> x i i' d F2' \\<Sigma>2')\n      let ?st1' = \"Frame f l (Suc pc) R1 (d # map Subx.norm_unboxed \\<Sigma>2') # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2' H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_load_ubx_miss.hyps\n          by (auto intro!: Sinca.step_load dest!: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2') None ?st1' ?st2'\"\n          apply simp\n        proof (rule rel_stacktraces.intros)\n          show \"rel_stacktraces (Fubx_get F2') (Some f) st1 (Subx.box_stack f st2)\"\n          unfolding step_load_ubx_miss\n          using rel_st1_st2\n          by (rule rel_stacktraces_map_entry_gneralize_fundefI)\n        next\n          show \"Fubx_get F2' f = Some (Subx.generalize_fundef fd2)\"\n            unfolding step_load_ubx_miss.hyps\n            using F2_f by (simp add: Subx.map_of_generalize_fundef_conv)\n        next\n          show \"map_of (body (Subx.generalize_fundef fd2)) l =\n            Some (map Subx.generalize_instr instrs)\"\n            unfolding Subx.map_of_generalize_fundef_conv\n            using step_load_ubx_miss.hyps F2_f map_of_fd2_l\n            by simp\n        next\n          show \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2') (return (Subx.generalize_fundef fd2))\n            (take (Suc pc) (map Subx.generalize_instr instrs))\n            [] (map typeof (OpDyn d # map Subx.box_operand \\<Sigma>2'))\"\n            using step_load_ubx_miss.hyps F2_f map_of_fd2_l\n            by (auto simp: take_map take_Suc_conv_app_nth simp del: map_append\n              intro!: sp_instrs_prefix'[THEN Subx.sp_instrs_generalize0] Subx.sp_instr.LoadUbx\n              dest!: next_instrD instr_atD)\n        qed (insert all_dyn_R2, simp_all add: R1_def)\n        thus \"?MATCH ?s1' (State F2' H ?st2')\"\n          using step_load_ubx_miss.prems rel_F1_F2\n          unfolding step_load_ubx_miss.hyps\n          by (auto intro: match.intros rel_fundefs_generalizeI)\n      qed\n    next\n      case (step_store x i i' y d H' \\<Sigma>2')\n      let ?st1' = \"Frame f l (Suc pc) R1 (map Subx.norm_unboxed \\<Sigma>2') # st1\"\n      let ?s1' = \"State F1 H' ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H' ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_store.hyps\n          by (auto intro: Sinca.step_store dest!: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_store.hyps rel_stacktraces_Cons\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Store\n              dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H' ?st2')\"\n          using step_store.prems rel_F1_F2\n          by (auto intro: match.intros)\n      qed\n    next\n      case (step_store_ubx \\<tau> x i i' blob d H' \\<Sigma>2')\n      let ?st1' = \"Frame f l (Suc pc) R1 (map Subx.norm_unboxed \\<Sigma>2') # st1\"\n      let ?s1' = \"State F1 H' ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H' ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_store_ubx.hyps\n          by (auto intro: Sinca.step_store dest!: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_store_ubx.hyps rel_stacktraces_Cons\n          by (auto simp: take_Suc_conv_app_nth\n              intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.StoreUbx\n              dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H' ?st2')\"\n          using step_store_ubx.prems rel_F1_F2\n          by (auto intro: match.intros)\n      qed\n    next\n      case (step_op op ar \\<Sigma>2' x)\n      let ?st1' = \"Frame f l (Suc pc) R1 (x # drop ar (map Subx.norm_unboxed \\<Sigma>2)) # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_op.hyps\n          by (auto simp: take_map ap_map_list_cast_Dyn_to_map_norm[symmetric]\n              intro!: Sinca.step_op dest!: next_instr2)\n      next\n        have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n          using step_op.hyps rel_stacktraces_Cons\n          by (auto simp: take_Suc_conv_app_nth drop_map map_eq_append_map_drop\n              simp: ap_map_list_cast_Dyn_map_typeof_replicate_conv\n              intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Op\n              dest!: next_instrD instr_atD)\n        thus \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_op.prems rel_F1_F2\n          by (auto intro: match.intros)\n      qed\n    next\n      case (step_op_inl op ar \\<Sigma>2' opinl x F2')\n      let ?F1' = \"Sinca.Fenv.map_entry F1 f (\\<lambda>fd. rewrite_fundef_body fd l pc (Inca.IOpInl opinl))\"\n      let ?st1' = \"Frame f l (Suc pc) R1 (x # drop ar (map Subx.norm_unboxed  \\<Sigma>2)) # st1\"\n      let ?s1' = \"State ?F1' H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2' H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_op_inl.hyps\n          by (auto simp: take_map ap_map_list_cast_Dyn_to_map_norm[symmetric]\n              intro!: Sinca.step_op_inl dest!: next_instr2)\n      next\n        show \"?MATCH ?s1' (State F2' H ?st2')\"\n          using step_op_inl.prems\n        proof (rule match.intros)\n          show \"rel_fundefs (Finca_get ?F1') (Fubx_get F2')\"\n            unfolding step_op_inl.hyps\n            using rel_F1_F2\n            by (auto intro: rel_fundefs_rewriteI)\n        next\n          let ?fd2' = \"rewrite_fundef_body fd2 l pc (Ubx.instr.IOpInl opinl)\"\n          let ?instrs' = \"instrs[pc := Ubx.instr.IOpInl opinl]\"\n          show \"rel_stacktraces (Fubx_get F2') None ?st1' ?st2'\"\n          proof (rule rel_stacktraces.intros)\n            show \"rel_stacktraces (Fubx_get F2') (Some f) st1 st2\"\n              using step_op_inl.hyps rel_st1_st2 Sinca.\\<II>\\<nn>\\<ll>_invertible\n              by (auto simp: Subx.sp_instr_Op_OpInl_conv\n                  intro: rel_stacktraces_map_entry_rewrite_fundef_body)\n          next\n            show \"Fubx_get F2' f = Some ?fd2'\"\n              unfolding step_op_inl.hyps\n              using F2_f by simp\n          next\n            show \"map_of (body ?fd2') l = Some ?instrs'\"\n              using map_of_fd2_l by simp\n          next\n            show \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2')\n              (return (rewrite_fundef_body fd2 l pc (Ubx.instr.IOpInl opinl)))\n              (take (Suc pc) ?instrs') [] (map typeof (OpDyn x # drop ar \\<Sigma>2))\"\n            using rel_stacktraces_Cons step_op_inl.hyps\n            by (auto simp add: take_Suc_conv_app_nth Subx.Fenv.map_option_comp_map_entry\n                map_eq_append_map_drop ap_map_list_cast_Dyn_map_typeof_replicate_conv\n                Sinca.\\<II>\\<nn>\\<ll>_invertible\n                intro!: sp_instrs_prefix' Subx.sp_instr.OpInl\n                dest!: next_instrD instr_atD)\n          qed (insert all_dyn_R2 R1_def, simp_all add: drop_map)\n        qed\n      qed\n    next\n      case (step_op_inl_hit opinl ar \\<Sigma>2' x)\n      let ?st1' = \"Frame f l (Suc pc) R1 (x # drop ar (map Subx.norm_unboxed \\<Sigma>2)) # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_op_inl_hit.hyps\n          by (auto simp: take_map ap_map_list_cast_Dyn_to_map_norm[symmetric]\n              intro!: Sinca.step_op_inl_hit dest!: next_instr2)\n      next\n        show \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_op_inl_hit.prems rel_F1_F2\n        proof (rule match.intros)\n          show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n            using step_op_inl_hit.hyps rel_stacktraces_Cons\n            by (auto simp: take_Suc_conv_app_nth drop_map map_eq_append_map_drop\n                simp: ap_map_list_cast_Dyn_map_typeof_replicate_conv\n                intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.OpInl\n                dest!: next_instrD instr_atD)\n        qed\n      qed\n    next\n      case (step_op_inl_miss opinl ar \\<Sigma>2' x F2')\n      let ?F1' = \"Sinca.Fenv.map_entry F1 f (\\<lambda>fd. rewrite_fundef_body fd l pc (Inca.IOp (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl)))\"\n      let ?st1' = \"Frame f l (Suc pc) R1 (x # drop ar (map Subx.norm_unboxed  \\<Sigma>2)) # st1\"\n      let ?s1' = \"State ?F1' H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2' H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_op_inl_miss.hyps\n          by (auto simp: take_map ap_map_list_cast_Dyn_to_map_norm[symmetric]\n              intro!: Sinca.step_op_inl_miss dest!: next_instr2)\n      next\n        show \"?MATCH ?s1' (State F2' H ?st2')\"\n          using step_op_inl_miss.prems\n        proof (rule match.intros)\n          show \"rel_fundefs (Finca_get ?F1') (Fubx_get F2')\"\n            unfolding step_op_inl_miss.hyps\n            using rel_F1_F2\n            by (auto intro: rel_fundefs_rewriteI)\n        next\n          let ?fd2' = \"rewrite_fundef_body fd2 l pc (Ubx.instr.IOp (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl))\"\n          let ?instrs' = \"instrs[pc := Ubx.instr.IOp (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl)]\"\n          show \"rel_stacktraces (Fubx_get F2') None ?st1' ?st2'\"\n          proof (rule rel_stacktraces.intros)\n            show \"rel_stacktraces (Fubx_get F2') (Some f) st1 st2\"\n              using step_op_inl_miss.hyps rel_st1_st2 Sinca.\\<II>\\<nn>\\<ll>_invertible\n              by (auto intro: rel_stacktraces_map_entry_rewrite_fundef_body\n                  Subx.sp_instr_Op_OpInl_conv[OF refl, symmetric])\n          next\n            show \"Fubx_get F2' f = Some ?fd2'\"\n              unfolding step_op_inl_miss.hyps\n              using F2_f by simp\n          next\n            show \"map_of (body ?fd2') l = Some ?instrs'\"\n              using map_of_fd2_l by simp\n          next\n            show \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2')\n              (return (rewrite_fundef_body fd2 l pc (Ubx.instr.IOp (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl))))\n              (take (Suc pc) ?instrs') [] (map typeof (OpDyn x # drop ar \\<Sigma>2))\"\n            using rel_stacktraces_Cons step_op_inl_miss.hyps\n            by (auto simp add: take_Suc_conv_app_nth Subx.Fenv.map_option_comp_map_entry\n                map_eq_append_map_drop ap_map_list_cast_Dyn_map_typeof_replicate_conv\n                Sinca.\\<II>\\<nn>\\<ll>_invertible\n                intro!: sp_instrs_prefix' Subx.sp_instr.Op\n                dest!: next_instrD instr_atD)\n          qed (insert all_dyn_R2 R1_def, simp_all add: drop_map)\n        qed\n      qed\n    next\n      case (step_op_ubx opubx op ar x)\n      let ?st1' = \"Frame f l (Suc pc) R1 (Subx.norm_unboxed x # drop ar (map Subx.norm_unboxed \\<Sigma>2)) # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_op_ubx.hyps\n          by (auto simp: take_map\n              intro!: Sinca.step_op_inl_hit\n              intro: Subx.\\<UU>\\<bb>\\<xx>\\<OO>\\<pp>_to_\\<II>\\<nn>\\<ll>[THEN Sinca.\\<II>\\<nn>\\<ll>_\\<II>\\<ss>\\<II>\\<nn>\\<ll>] Subx.\\<UU>\\<bb>\\<xx>\\<OO>\\<pp>_correct\n              dest: next_instr2)\n      next\n        show \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_op_ubx.prems rel_F1_F2\n        proof (rule match.intros)\n          show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n            using step_op_ubx.hyps rel_stacktraces_Cons\n            by (auto simp: take_Suc_conv_app_nth drop_map map_eq_append_map_drop\n                intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.OpUbx\n                dest!: next_instrD instr_atD\n                dest!: Subx.\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp>_complete)\n        qed\n      qed\n    next\n      case (step_cjump l\\<^sub>t l\\<^sub>f x d l' \\<Sigma>2')\n      hence \"instr_at fd2 l pc = Some (Ubx.instr.ICJump l\\<^sub>t l\\<^sub>f)\"\n        using F2_f by (auto dest!: next_instrD)\n      hence pc_in_dom: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = Ubx.instr.ICJump l\\<^sub>t l\\<^sub>f\"\n        using map_of_fd2_l by (auto dest!: instr_atD)\n      hence \"{l\\<^sub>t, l\\<^sub>f} \\<subseteq> fst ` set (body fd2)\"\n        using all_jumps_in_range by (auto simp: list_all_length)\n      moreover have \"l' \\<in> {l\\<^sub>t, l\\<^sub>f}\"\n        using step_cjump.hyps by auto\n      ultimately have \"l' \\<in> fst ` set (body fd2)\"\n        by blast\n      then obtain instrs' where map_of_l': \"map_of (body fd2) l' = Some instrs'\"\n        by (auto dest: weak_map_of_SomeI)\n\n      have pc_def: \"pc = length instrs - 1\"\n        using is_jump_nthD[OF _ pc_in_dom] nth_instrs_pc by simp\n      have \\<Sigma>2'_eq_Nil: \"\\<Sigma>2' = []\"\n        using sp_instr_last[OF pc_def] step_cjump.hyps\n        by (auto simp: nth_instrs_pc elim!: Subx.sp_instr.cases)\n\n      let ?st1' = \"Frame f l' 0 R1 (map Subx.norm_unboxed \\<Sigma>2') # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_cjump.hyps\n          by (auto intro!: Sinca.step_cjump dest: next_instr2)\n      next\n        show \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_cjump.prems rel_F1_F2\n        proof (rule match.intros)\n          show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n            using map_of_l' rel_stacktraces_Cons(1,3-5)\n            by (auto simp: \\<Sigma>2'_eq_Nil intro!: rel_stacktraces.intros intro: Subx.sp_instrs.Nil)\n        qed\n      qed\n    next\n      case (step_call g gd2 frame\\<^sub>g)\n      then obtain gd1 where\n        F1_g: \"Finca_get F1 g = Some gd1\" and rel_gd1_gd2: \"rel_fundef (=) norm_eq gd1 gd2\"\n        using rel_fundefs_Some2[OF rel_F1_F2] by auto\n                \n      have wf_gd2: \"Subx.wf_fundef (map_option funtype \\<circ> Fubx_get F2) gd2\"\n        using Subx.wf_fundefs_getD[OF wf_F2] step_call.hyps by simp\n\n      obtain intrs\\<^sub>g where gd2_fst_bblock: \"map_of (body gd2) (fst (hd (body gd2))) = Some intrs\\<^sub>g\"\n        using Subx.wf_fundef_body_neq_NilD[OF wf_gd2]\n        by (metis hd_in_set map_of_eq_None_iff not_Some_eq prod.collapse prod_in_set_fst_image_conv)\n\n      let ?frame\\<^sub>g = \"allocate_frame g gd1 (take (arity gd1) \\<Sigma>1) uninitialized\"\n      let ?st1' = \"?frame\\<^sub>g # Frame f l pc R1 \\<Sigma>1 # st1\"\n      let ?s1' = \"State F1 H ?st1'\"\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n      proof (intro exI conjI)\n        show \"?STEP ?s1'\"\n          unfolding \\<Sigma>1_def\n          using step_call.hyps F1_g rel_gd1_gd2\n          by (auto simp: rel_fundef_arities intro!: Sinca.step_call dest: next_instr2)\n      next\n        show \"?MATCH ?s1' (State F2 H ?st2')\"\n          using step_call.prems rel_F1_F2\n        proof (rule match.intros)\n          have FOO: \"fst (hd (body gd1)) = fst (hd (body gd2))\"\n            apply (rule rel_fundef_rel_fst_hd_bodies[OF rel_gd1_gd2])\n            using Subx.wf_fundefs_getD[OF wf_F2 \\<open>Fubx_get F2 g = Some gd2\\<close>]\n            by (auto dest: Subx.wf_fundef_body_neq_NilD)\n          show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n            unfolding step_call allocate_frame_def FOO\n          proof (rule rel_stacktraces.intros(2))\n            show \"rel_stacktraces (Fubx_get F2) (Some g)\n              (Frame f l pc R1 \\<Sigma>1 # st1) (Frame f l pc R2 \\<Sigma>2 # st2)\"\n              using step_call rel_stacktraces_Cons\n              by (auto simp: is_valid_fun_call_def intro: rel_stacktraces.intros)\n          next\n            show \"take (arity gd1) \\<Sigma>1 @ replicate (fundef_locals gd1) uninitialized =\n              map Subx.norm_unboxed (take (arity gd2) \\<Sigma>2 @\n              replicate (fundef_locals gd2) (OpDyn uninitialized))\"\n              using rel_gd1_gd2\n              by (simp add: rel_fundef_arities rel_fundef_locals take_map \\<Sigma>1_def)\n          next\n            show \"list_all is_dyn_operand (take (arity gd2) \\<Sigma>2 @\n              replicate (fundef_locals gd2) (OpDyn uninitialized))\"\n              using step_call.hyps by auto\n          qed (insert step_call gd2_fst_bblock, simp_all add: Subx.sp_instrs.Nil)\n        qed\n      qed\n    next\n      case (step_return fd2' \\<Sigma>2\\<^sub>g frame\\<^sub>g' g l\\<^sub>g pc\\<^sub>g R2\\<^sub>g st2')\n      hence fd2_fd2'[simp]: \"fd2' = fd2\"\n        using F2_f by simp\n      then obtain fd1 where\n        F1_f: \"Finca_get F1 f = Some fd1\" and rel_fd1_fd2: \"rel_fundef (=) norm_eq fd1 fd2\"\n        using F2_f rel_fundefs_Some2[OF rel_F1_F2] by auto\n      show ?case\n        using rel_st1_st2 unfolding \\<open>Frame g l\\<^sub>g pc\\<^sub>g R2\\<^sub>g \\<Sigma>2\\<^sub>g # st2' = st2\\<close>[symmetric]\n      proof (cases rule: rel_stacktraces.cases)\n        case (rel_stacktraces_Cons st1' \\<Sigma>1\\<^sub>g R1\\<^sub>g gd2 instrs)\n        hence is_valid_call_f: \"is_valid_fun_call (Fubx_get F2) g l\\<^sub>g pc\\<^sub>g \\<Sigma>2\\<^sub>g f\"\n          by simp\n        let ?s1' = \"State F1 H (Frame g l\\<^sub>g (Suc pc\\<^sub>g) R1\\<^sub>g (\\<Sigma>1 @ drop (arity fd2) \\<Sigma>1\\<^sub>g) # st1')\"\n        show ?thesis (is \"\\<exists>x. ?STEP x \\<and> ?MATCH x (State F2 H ?st2')\")\n        proof (intro exI conjI)\n          show \"?STEP ?s1'\"\n            unfolding rel_stacktraces_Cons\n          proof (rule Sinca.step.step_return)\n            show \"next_instr (Finca_get F1) f l pc = Some Inca.instr.IReturn\"\n              using \\<open>next_instr (Fubx_get F2) f l pc = Some Ubx.instr.IReturn\\<close>\n              using rel_fundefs_next_instr2[OF rel_F1_F2]\n              by force\n          next\n            show \"Finca_get F1 f = Some fd1\"\n              by (rule F1_f)\n          qed (insert step_return.hyps rel_fd1_fd2,\n              simp_all add: \\<Sigma>1_def rel_fundef_arities rel_fundef_return)\n        next\n          show \"?MATCH ?s1' (State F2 H ?st2')\"\n            unfolding step_return.hyps\n          proof (rule match.intros)\n            have \"next_instr (Fubx_get F2) g l\\<^sub>g pc\\<^sub>g = Some (Ubx.instr.ICall f)\" and\n              \"arity fd2 \\<le> length \\<Sigma>2\\<^sub>g\" and \"list_all is_dyn_operand (take (arity fd2) \\<Sigma>2\\<^sub>g)\"\n              using is_valid_call_f[unfolded is_valid_fun_call_def] F2_f\n              by simp_all\n            hence\n              pc\\<^sub>g_in_range: \"pc\\<^sub>g < length instrs\" and\n              nth_instrs_pc\\<^sub>g: \"instrs ! pc\\<^sub>g = Ubx.instr.ICall f\"\n              using rel_stacktraces_Cons\n              by (auto dest!: next_instrD instr_atD)\n            have replicate_None: \"replicate (arity fd2) None = map typeof (take (arity fd2) \\<Sigma>2\\<^sub>g)\"\n              using \\<open>arity fd2 \\<le> length \\<Sigma>2\\<^sub>g\\<close> \\<open>list_all is_dyn_operand (take (arity fd2) \\<Sigma>2\\<^sub>g)\\<close>\n              by (auto simp: is_dyn_operand_eq_typeof list_all_iff intro!: replicate_eq_map)\n            show \"rel_stacktraces (Fubx_get F2) None\n             (Frame g l\\<^sub>g (Suc pc\\<^sub>g) R1\\<^sub>g (\\<Sigma>1 @ drop (arity fd2) \\<Sigma>1\\<^sub>g) # st1')\n             (Frame g l\\<^sub>g (Suc pc\\<^sub>g) R2\\<^sub>g (\\<Sigma>2 @ drop (arity fd2') \\<Sigma>2\\<^sub>g) # st2')\"\n              using rel_stacktraces_Cons\n              apply (auto simp: \\<Sigma>1_def drop_map take_Suc_conv_app_nth[OF pc\\<^sub>g_in_range] nth_instrs_pc\\<^sub>g\n                  intro!: rel_stacktraces.intros elim!: Subx.sp_instrs_appendI)\n              apply (rule Subx.sp_instr.Call[of _ _ _ _ _ \"map typeof (drop (arity fd2) \\<Sigma>2\\<^sub>g)\"])\n                apply (simp add: F2_f funtype_def)\n               apply (simp add: replicate_None map_append[symmetric])\n              using \\<open>length \\<Sigma>2 = return fd2'\\<close> \\<open>list_all is_dyn_operand \\<Sigma>2\\<close>\n              by (auto simp: list.pred_set intro: replicate_eq_map[symmetric])\n          qed (insert step_return rel_F1_F2, simp_all)\n        qed\n      qed\n    qed\n  qed\nqed\n\nlemma match_final_backward:\n  assumes \"match s1 s2\" and final_s2: \"final Fubx_get Ubx.IReturn s2\"\n  shows \"final Finca_get Inca.IReturn s1\"\n  using \\<open>match s1 s2\\<close>\nproof (cases s1 s2 rule: match.cases)\n  case (matchI F2 H st2 F1 st1)\n  show ?thesis\n    using final_s2[unfolded matchI]\n  proof (cases _ _ \"State F2 H st2\" rule: final.cases)\n    case (finalI f l pc R \\<Sigma>)\n    then show ?thesis\n      using matchI\n      by (auto intro!: final.intros elim!: rel_stacktraces.cases dest: rel_fundefs_next_instr2)\n  qed\nqed\n\nsublocale inca_to_ubx_simulation:\n  backward_simulation Sinca.step Subx.step\n    \"final Finca_get Inca.IReturn\"\n    \"final Fubx_get Ubx.IReturn\"\n    \"\\<lambda>_ _. False\" \"\\<lambda>_. match\"\n  using match_final_backward backward_lockstep_simulation\n   lockstep_to_plus_backward_simulation[of match Subx.step Sinca.step]\n  by unfold_locales auto\n\n\nsection \\<open>Forward simulation\\<close>\n\nlemma ap_map_list_cast_Dyn_eq_norm_stack:\n  assumes \"list_all (\\<lambda>x. x = None) (map typeof xs)\"\n  shows \"ap_map_list cast_Dyn xs = Some (map Subx.norm_unboxed xs)\"\n  using assms\nproof (induction xs)\n  case Nil\n  thus ?case by simp\nnext\n  case (Cons x xs)\n  from Cons.prems have\n    typeof_x: \"typeof x = None\" and\n    typeof_xs: \"list_all (\\<lambda>x. x = None) (map typeof xs)\"\n    by simp_all\n  obtain x' where \"x = OpDyn x'\"\n    using typeof_unboxed_inversion(1)[OF typeof_x] by auto\n  then show ?case\n    using Cons.IH[OF typeof_xs]\n    by simp\nqed\n\nlemma forward_lockstep_simulation:\n  assumes \"match s1 s2\" and \"Sinca.step s1 s1'\"\n  shows \"\\<exists>s2'. Subx.step s2 s2' \\<and> match s1' s2'\"\n  using assms(1)\nproof (cases s1 s2 rule: match.cases)\n  case (matchI F2 H st2 F1 st1)\n  have s2_def: \"s2 = Global.state.State F2 H st2\" using matchI by simp\n  have rel_F1_F2: \"rel_fundefs (Finca_get F1) (Fubx_get F2)\" using matchI by simp\n  have wf_s2: \"Subx.wf_state s2\" using matchI by simp\n  hence wf_F2: \"Subx.wf_fundefs (Fubx_get F2)\" by (auto simp: s2_def dest: Subx.wf_stateD)\n\n  note wf_s2'I = Subx.wf_state_step_preservation[OF wf_s2]\n\n  from \\<open>rel_stacktraces (Fubx_get F2) None st1 st2\\<close> show ?thesis\n  proof (cases \"Fubx_get F2\" \"None :: 'fun option\" st1 st2 rule: rel_stacktraces.cases)\n    case rel_stacktraces_Nil\n    with matchI assms(2) show ?thesis by (auto elim: Sinca.step.cases)\n  next\n    case (rel_stacktraces_Cons f st1' st2' \\<Sigma>1 \\<Sigma>2 R1 R2 fd2 l instrs pc)\n    have rel_st1'_st2': \"rel_stacktraces (Fubx_get F2) (Some f) st1' st2'\"\n      using rel_stacktraces_Cons by simp\n    have st2_def: \"st2 = Frame f l pc R2 \\<Sigma>2 # st2'\" using rel_stacktraces_Cons by simp\n    have \\<Sigma>1_def: \"\\<Sigma>1 = map Subx.norm_unboxed \\<Sigma>2\" using rel_stacktraces_Cons by simp\n    have all_dyn_R2: \"list_all is_dyn_operand R2\" using rel_stacktraces_Cons by simp\n    have F2_f: \"Fubx_get F2 f = Some fd2\" using rel_stacktraces_Cons by simp\n    have map_of_fd2_l: \"map_of (body fd2) l = Some instrs\" using rel_stacktraces_Cons by simp\n    have sp_instrs_prefix: \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2) (return fd2)\n      (take pc instrs) [] (map typeof \\<Sigma>2)\"\n      using rel_stacktraces_Cons by simp\n    note sp_instrs_prefix' =\n      Subx.sp_instrs_singletonI[THEN Subx.sp_instrs_appendI[OF sp_instrs_prefix]]\n\n    have wf_fd2: \"Subx.wf_fundef (map_option funtype \\<circ> Fubx_get F2) fd2\"\n      using wf_F2 F2_f by (auto dest: Subx.wf_fundefs_getD)\n    hence sp_instrs_instrs:\n      \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2) (return fd2) instrs [] []\"\n      using wf_fd2[THEN Subx.wf_fundef_all_wf_basic_blockD] map_of_fd2_l\n      by (auto dest: list_all_map_of_SomeD[OF _ map_of_fd2_l] dest: Subx.wf_basic_blockD)\n    hence sp_instrs_sufix: \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2) (return fd2)\n      (instrs ! pc # drop (Suc pc) instrs) (map typeof \\<Sigma>2) []\" if \"pc < length instrs\"\n      using that Subx.sp_instrs_appendD'[OF _ sp_instrs_prefix]\n      by (simp add: Cons_nth_drop_Suc)\n\n    have\n      instrs_neq_Nil: \"instrs \\<noteq> []\" and\n      all_jumps_in_range: \"list_all (Subx.jump_in_range (fst ` set (body fd2))) instrs\" and\n      sp_instrs_instrs: \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2) (return fd2) instrs [] []\"\n      using list_all_map_of_SomeD[OF wf_fd2[THEN Subx.wf_fundef_all_wf_basic_blockD] map_of_fd2_l]\n      by (auto dest: Subx.wf_basic_blockD)\n\n    from assms(2)[unfolded matchI rel_stacktraces_Cons] show ?thesis\n    proof (induction \"State F1 H (Frame f l pc (map Subx.norm_unboxed R2) (map Subx.norm_unboxed \\<Sigma>2) # st1')\" s1' rule: Sinca.step.induct)\n      case (step_push d)\n      then obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.IPush d) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      then show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H ?st1') x\")\n      proof (cases instr2)\n        case (IPush d2)\n        let ?st2' = \"Frame f l (Suc pc) R2 (OpDyn d # \\<Sigma>2) # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using next_instr2 norm_eq_instr1_instr2\n            unfolding IPush\n            by (auto simp: s2_def st2_def intro: Subx.step_push)\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using next_instr2 rel_stacktraces_Cons\n              unfolding IPush\n              by (auto simp: next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' intro: Subx.sp_instr.Push)\n          qed (simp_all add: rel_F1_F2)\n        qed\n      next\n        case (IPushUbx1 u)\n        let ?st2' = \"Frame f l (Suc pc) R2 (OpUbx1 u # \\<Sigma>2) # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using next_instr2 norm_eq_instr1_instr2\n            unfolding IPushUbx1\n            by (auto simp: s2_def st2_def intro: Subx.step_push_ubx1)\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using next_instr2 norm_eq_instr1_instr2 rel_stacktraces_Cons\n              unfolding IPushUbx1\n              by (auto simp: next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' intro: Subx.sp_instr.PushUbx1)\n          qed (simp_all add: rel_F1_F2)\n        qed\n      next\n        case (IPushUbx2 u)\n        let ?st2' = \"Frame f l (Suc pc) R2 (OpUbx2 u # \\<Sigma>2) # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using next_instr2 norm_eq_instr1_instr2\n            unfolding IPushUbx2\n            by (auto simp: s2_def st2_def intro: Subx.step_push_ubx2)\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using next_instr2 norm_eq_instr1_instr2 rel_stacktraces_Cons\n              unfolding IPushUbx2\n              by (auto simp: next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' intro: Subx.sp_instr.PushUbx2)\n          qed (simp_all add: rel_F1_F2)\n        qed\n      qed simp_all\n    next\n      case (step_pop d \\<Sigma>1')\n      then obtain u \\<Sigma>2' where\n        \\<Sigma>2_def: \"\\<Sigma>2 = u # \\<Sigma>2'\" and \"d = Subx.norm_unboxed u\" and\n        \\<Sigma>1'_def: \"\\<Sigma>1' = map Subx.norm_unboxed \\<Sigma>2'\"\n        by auto\n      from step_pop obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq Inca.IPop instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      then show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H ?st1') x\")\n      proof (cases instr2)\n        case IPop\n        let ?st2' = \"Frame f l (Suc pc) R2 \\<Sigma>2' # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using next_instr2 norm_eq_instr1_instr2\n            unfolding IPop\n            by (auto simp: s2_def st2_def \\<Sigma>2_def intro: Subx.step_pop)\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using next_instr2 rel_stacktraces_Cons\n              unfolding IPop\n              by (auto simp: \\<Sigma>2_def \\<Sigma>1'_def next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Pop)\n          qed (simp_all add: rel_F1_F2)\n        qed\n      qed simp_all\n    next\n      case (step_get n d)\n      hence nth_R2_n: \"R2 ! n = OpDyn d\"\n        using all_dyn_R2\n        by (metis Subx.norm_unboxed.simps(1) is_dyn_operand_def length_map list_all_length nth_map)\n      from step_get obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.IGet n) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      then show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H ?st1') x\")\n      proof (cases instr2)\n        case (IGet n')\n        hence \"n' = n\" using norm_eq_instr1_instr2 by simp\n        let ?st2' = \"Frame f l (Suc pc) R2 (OpDyn d # \\<Sigma>2) # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using step_get nth_R2_n\n            using next_instr2 norm_eq_instr1_instr2\n            unfolding IGet\n            by (auto simp: s2_def st2_def intro: Subx.step_get)\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using next_instr2 rel_stacktraces_Cons\n              unfolding IGet\n              by (auto simp: next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' intro: Subx.sp_instr.Get)\n          qed (simp_all add: rel_F1_F2)\n        qed\n      next\n        case (IGetUbx \\<tau> n')\n        hence \"n' = n\" using norm_eq_instr1_instr2 by simp\n        show ?thesis\n        proof (cases \"Subx.unbox \\<tau> d\")\n          case None\n          let ?F2' = \"Subx.Fenv.map_entry F2 f Subx.generalize_fundef\"\n          let ?st2' = \"Subx.box_stack f (Frame f l (Suc pc) R2 (OpDyn d # \\<Sigma>2) # st2')\"\n          let ?s2' = \"State ?F2' H ?st2'\"\n          show ?thesis\n          proof (intro exI conjI)\n            show \"?STEP ?s2'\"\n              using step_get nth_R2_n None\n              using next_instr2 norm_eq_instr1_instr2\n              unfolding IGetUbx\n              by (auto simp: s2_def st2_def intro: Subx.step_get_ubx_miss[simplified])\n          next\n            show \"?MATCH (State F1 H ?st1') ?s2'\"\n            proof (rule match.intros)\n              show \"Subx.wf_state ?s2'\"\n                using wf_F2\n                by (auto intro!: Subx.wf_stateI intro: Subx.wf_fundefs_generalize)\n            next\n              show \"rel_fundefs (Finca_get F1) (Fubx_get ?F2')\"\n                using rel_F1_F2\n                by (auto intro: rel_fundefs_generalizeI)\n            next\n              have sp_instrs_gen: \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2) (return fd2)\n                (take (Suc pc) (map Subx.generalize_instr instrs)) [] (map Map.empty (OpDyn d # \\<Sigma>2))\"\n                using rel_stacktraces_Cons step_get.hyps\n                using IGetUbx \\<open>n' = n\\<close>\n                using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n                by (auto simp: take_Suc_conv_app_nth take_map\n                    intro!: Subx.sp_instrs_appendI\n                    intro: Subx.sp_instrs_generalize0 Subx.sp_instr.Get)\n              then show \"rel_stacktraces (Fubx_get ?F2') None ?st1' ?st2'\"\n                apply simp\n              proof (rule rel_stacktraces.intros)\n                show \"rel_stacktraces (Fubx_get ?F2') (Some f) st1' (Subx.box_stack f st2')\"\n                  using rel_st1'_st2' rel_stacktraces_map_entry_gneralize_fundefI by simp\n              next\n                show \"Fubx_get ?F2' f = Some (Subx.generalize_fundef fd2)\"\n                  using F2_f by simp\n              next\n                show \"map_of (body (Subx.generalize_fundef fd2)) l =\n                  Some (map Subx.generalize_instr instrs)\"\n                  using map_of_fd2_l by (simp add: Subx.map_of_generalize_fundef_conv)\n              qed (insert all_dyn_R2 map_of_fd2_l, simp_all add: Subx.map_of_generalize_fundef_conv)\n            qed\n          qed\n        next\n          case (Some u)\n          let ?st2' = \"Frame f l (Suc pc) R2 (u # \\<Sigma>2) # st2'\"\n          let ?s2' = \"State F2 H ?st2'\"\n          show ?thesis\n          proof (intro exI conjI)\n            show \"?STEP ?s2'\"\n              using step_get nth_R2_n Some\n              using next_instr2 norm_eq_instr1_instr2\n              unfolding IGetUbx\n              by (auto simp: s2_def st2_def intro: Subx.step_get_ubx_hit)\n          next\n            show \"?MATCH (State F1 H ?st1') ?s2'\"\n            proof (rule match.intros)\n              show \"Subx.wf_state ?s2'\"\n                using wf_F2 by (auto intro: Subx.wf_stateI)\n            next\n              show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n                using next_instr2 rel_stacktraces_Cons\n                using Some\n                unfolding IGetUbx\n                by (auto simp: next_instr_take_Suc_conv\n                    intro!: rel_stacktraces.intros sp_instrs_prefix' intro: Subx.sp_instr.GetUbx)\n            qed (simp_all add: rel_F1_F2)\n          qed\n        qed\n      qed simp_all\n    next\n      case (step_set n R1' d \\<Sigma>1')\n      then obtain u \\<Sigma>2' where\n        \\<Sigma>2_def: \"\\<Sigma>2 = u # \\<Sigma>2'\" and d_def: \"d = Subx.norm_unboxed u\" and\n        \\<Sigma>1'_def: \"\\<Sigma>1' = map Subx.norm_unboxed \\<Sigma>2'\"\n        by auto\n      from step_set obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.ISet n) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      have pc_in_range: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = instr2\"\n        using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n        by simp_all\n      from next_instr2 norm_eq_instr1_instr2\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H ?st1') x\")\n      proof (cases instr2)\n        case (ISet n')\n        hence \"n' = n\" using norm_eq_instr1_instr2 by simp\n        have typeof_u: \"typeof u = None\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc ISet, simplified]\n          by (auto simp: \\<Sigma>2_def elim: Subx.sp_instrs.cases Subx.sp_instr.cases)\n        hence cast_Dyn_u: \"cast_Dyn u = Some d\"\n          by (auto simp add: d_def dest: Subx.typeof_and_norm_unboxed_imp_cast_Dyn)\n        let ?R2' = \"R2[n := OpDyn d]\"\n        let ?st2' = \"Frame f l (Suc pc) ?R2' \\<Sigma>2' # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using step_set.hyps cast_Dyn_u\n            using next_instr2 norm_eq_instr1_instr2\n            unfolding ISet\n            by (auto simp: s2_def st2_def \\<Sigma>2_def intro: Subx.step_set)\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using next_instr2 rel_stacktraces_Cons\n              unfolding ISet\n              using step_set.hyps cast_Dyn_u\n              by (auto simp: \\<Sigma>1'_def \\<Sigma>2_def map_update next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Set\n                  intro: list_all_list_updateI)\n          qed (simp_all add: rel_F1_F2)\n        qed\n      next\n        case (ISetUbx \\<tau> n')\n        hence \"n' = n\" using norm_eq_instr1_instr2 by simp\n        have typeof_u: \"typeof u = Some \\<tau>\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc ISetUbx, simplified]\n          by (auto simp: \\<Sigma>2_def elim: Subx.sp_instrs.cases Subx.sp_instr.cases)\n        hence cast_and_box_u: \"Subx.cast_and_box \\<tau> u = Some d\"\n          by (auto simp add: d_def dest: Subx.typeof_and_norm_unboxed_imp_cast_and_box)\n        let ?R2' = \"R2[n := OpDyn d]\"\n        let ?st2' = \"Frame f l (Suc pc) ?R2' \\<Sigma>2' # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using step_set cast_and_box_u\n            using next_instr2 norm_eq_instr1_instr2\n            unfolding ISetUbx\n            by (auto simp: s2_def st2_def \\<Sigma>2_def intro: Subx.step_set_ubx)\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using next_instr2 rel_stacktraces_Cons\n              unfolding ISetUbx\n              using step_set.hyps cast_and_box_u\n              by (auto simp: \\<Sigma>1'_def \\<Sigma>2_def map_update next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.SetUbx\n                  intro: list_all_list_updateI)\n          qed (simp_all add: rel_F1_F2)\n        qed\n      qed simp_all\n    next\n      case (step_load x y d \\<Sigma>1')\n      then obtain u \\<Sigma>2' where\n        \\<Sigma>2_def: \"\\<Sigma>2 = u # \\<Sigma>2'\" and d_def: \"y = Subx.norm_unboxed u\" and\n        \\<Sigma>1'_def: \"\\<Sigma>1' = map Subx.norm_unboxed \\<Sigma>2'\"\n        by auto\n      from step_load obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.ILoad x) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      have pc_in_range: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = instr2\"\n        using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n        by simp_all\n      from next_instr2 norm_eq_instr1_instr2\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H ?st1') x\")\n      proof (cases instr2)\n        case (ILoad x')\n        hence \"x' = x\" using norm_eq_instr1_instr2 by simp\n        have typeof_u: \"typeof u = None\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc ILoad, simplified]\n          by (auto simp: \\<Sigma>2_def elim: Subx.sp_instrs.cases Subx.sp_instr.cases)\n        hence cast_Dyn_u: \"cast_Dyn u = Some y\"\n          by (auto simp add: d_def dest: Subx.typeof_and_norm_unboxed_imp_cast_Dyn)\n        let ?st2' = \"Frame f l (Suc pc) R2 (OpDyn d # \\<Sigma>2') # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using step_load.hyps cast_Dyn_u next_instr2\n            unfolding ILoad \\<open>x' = x\\<close>\n            by (auto simp: s2_def st2_def \\<Sigma>2_def intro: Subx.step_load)\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using next_instr2 rel_stacktraces_Cons\n              unfolding ILoad \\<open>x' = x\\<close>\n              using step_load.hyps cast_Dyn_u\n              by (auto simp: \\<Sigma>1'_def \\<Sigma>2_def map_update next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Load\n                  intro: list_all_list_updateI)\n          qed (simp_all add: rel_F1_F2)\n        qed\n      next\n        case (ILoadUbx \\<tau> x')\n        hence \"x' = x\" using norm_eq_instr1_instr2 by simp\n        have typeof_u: \"typeof u = None\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc ILoadUbx, simplified]\n          by (auto simp: \\<Sigma>2_def elim: Subx.sp_instrs.cases Subx.sp_instr.cases)\n        hence cast_Dyn_u: \"cast_Dyn u = Some y\"\n          by (auto simp add: d_def dest: Subx.typeof_and_norm_unboxed_imp_cast_Dyn)\n        show ?thesis\n        proof (cases \"Subx.unbox \\<tau> d\")\n          case None\n          let ?F2' = \"Subx.Fenv.map_entry F2 f Subx.generalize_fundef\"\n          let ?st2' = \"Subx.box_stack f (Frame f l (Suc pc) R2 (OpDyn d # \\<Sigma>2') # st2')\"\n          let ?s2' = \"State ?F2' H ?st2'\"\n          show ?thesis\n          proof (intro exI conjI)\n            show \"?STEP ?s2'\"\n              using step_load.hyps next_instr2 cast_Dyn_u None \n              unfolding ILoadUbx \\<open>x' = x\\<close>\n              by (auto simp add: s2_def st2_def \\<Sigma>2_def intro: Subx.step_load_ubx_miss[simplified])\n          next\n            show \"?MATCH (State F1 H ?st1') ?s2'\"\n            proof (rule match.intros)\n              show \"Subx.wf_state ?s2'\"\n                using wf_F2\n                by (auto intro!: Subx.wf_stateI intro: Subx.wf_fundefs_generalize)\n            next\n              show \"rel_fundefs (Finca_get F1) (Fubx_get ?F2')\"\n                using rel_F1_F2\n                by (auto intro: rel_fundefs_generalizeI)\n            next\n              have \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2) (return fd2)\n                (take (Suc pc) (map Subx.generalize_instr instrs)) [] (None # map Map.empty \\<Sigma>2')\"\n                using rel_stacktraces_Cons step_load.hyps\n                using pc_in_range nth_instrs_pc\n                using ILoadUbx \\<open>x' = x\\<close>\n                by (auto simp: \\<Sigma>2_def take_Suc_conv_app_nth take_map\n                    intro!: Subx.sp_instrs_appendI\n                    intro: Subx.sp_instrs_generalize0 Subx.sp_instr.Load)\n              thus \"rel_stacktraces (Fubx_get ?F2') None ?st1' ?st2'\"\n                apply simp\n              proof (rule rel_stacktraces.intros)\n                show \"Fubx_get ?F2' f = Some (Subx.generalize_fundef fd2)\"\n                  using F2_f by simp\n              next\n                show \"map_of (body (Subx.generalize_fundef fd2)) l =\n                  Some (map Subx.generalize_instr instrs)\"\n                  using map_of_fd2_l\n                  by (simp add: Subx.map_of_generalize_fundef_conv)\n              qed (insert rel_F1_F2 all_dyn_R2 F2_f map_of_fd2_l rel_st1'_st2', auto simp: \\<Sigma>1'_def)\n            qed\n          qed\n        next\n          case (Some u2)\n          let ?st2' = \"Frame f l (Suc pc) R2 (u2 # \\<Sigma>2') # st2'\"\n          let ?s2' = \"State F2 H ?st2'\"\n          show ?thesis\n          proof (intro exI conjI)\n            show \"?STEP ?s2'\"\n              using step_load.hyps next_instr2 cast_Dyn_u Some\n              unfolding ILoadUbx \\<open>x' = x\\<close>\n              by (auto simp add: s2_def st2_def \\<Sigma>2_def intro: Subx.step_load_ubx_hit[simplified])\n          next\n            show \"?MATCH (State F1 H ?st1') ?s2'\"\n            proof (rule match.intros)\n              show \"Subx.wf_state ?s2'\"\n                using wf_F2\n                by (auto intro!: Subx.wf_stateI intro: Subx.wf_fundefs_generalize)\n            next\n              show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n                using next_instr2 rel_stacktraces_Cons\n                using Some typeof_u\n                unfolding ILoadUbx\n                by (auto simp: \\<Sigma>2_def \\<Sigma>1'_def next_instr_take_Suc_conv\n                    intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.LoadUbx)\n            qed (insert rel_F1_F2, simp_all)\n          qed\n        qed\n      qed simp_all\n    next\n      case (step_store x d1 d2 H' \\<Sigma>1')\n      then obtain u1 u2 \\<Sigma>2' where\n        \\<Sigma>2_def: \"\\<Sigma>2 = u1 # u2 # \\<Sigma>2'\" and\n        d1_def: \"d1 = Subx.norm_unboxed u1\" and\n        d2_def: \"d2 = Subx.norm_unboxed u2\" and\n        \\<Sigma>1'_def: \"\\<Sigma>1' = map Subx.norm_unboxed \\<Sigma>2'\"\n        by auto\n      from step_store obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.instr.IStore x) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      have pc_in_range: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = instr2\"\n        using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n        by simp_all\n      from next_instr2 norm_eq_instr1_instr2\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H' ?st1') x\")\n      proof (cases instr2)\n        case (IStore x')\n        hence \"x' = x\" using norm_eq_instr1_instr2 by simp\n        have casts: \"cast_Dyn u1 = Some d1\" \"cast_Dyn u2 = Some d2\"\n          unfolding atomize_conj\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc IStore, simplified]\n          by (auto simp: d1_def d2_def \\<Sigma>2_def elim: Subx.sp_instrs.cases Subx.sp_instr.cases\n              intro: Subx.typeof_and_norm_unboxed_imp_cast_Dyn)\n        let ?st2' = \"Frame f l (Suc pc) R2 \\<Sigma>2' # st2'\"\n        let ?s2' = \"State F2 H' ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using step_store.hyps casts next_instr2\n            unfolding IStore \\<open>x' = x\\<close>\n            by (auto simp: s2_def st2_def \\<Sigma>2_def intro: Subx.step_store)\n        next\n          show \"?MATCH (State F1 H' ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using next_instr2 rel_stacktraces_Cons\n              unfolding IStore \\<open>x' = x\\<close>\n              using step_store.hyps casts\n              by (auto simp: \\<Sigma>1'_def \\<Sigma>2_def map_update next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Store\n                  intro: list_all_list_updateI)\n          qed (insert rel_F1_F2, simp_all)\n        qed\n      next\n        case (IStoreUbx \\<tau> x')\n        hence \"x' = x\" using norm_eq_instr1_instr2 by simp\n        have casts: \"cast_Dyn u1 = Some d1\" \"Subx.cast_and_box \\<tau> u2 = Some d2\"\n          unfolding atomize_conj\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc IStoreUbx, simplified]\n          by (auto simp: d1_def d2_def \\<Sigma>2_def elim: Subx.sp_instrs.cases Subx.sp_instr.cases\n              intro: Subx.typeof_and_norm_unboxed_imp_cast_Dyn\n              intro: Subx.typeof_and_norm_unboxed_imp_cast_and_box)\n        let ?st2' = \"Frame f l (Suc pc) R2 \\<Sigma>2' # st2'\"\n        let ?s2' = \"State F2 H' ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using step_store.hyps casts next_instr2\n            unfolding IStoreUbx \\<open>x' = x\\<close>\n            by (auto simp: s2_def st2_def \\<Sigma>2_def intro: Subx.step_store_ubx)\n        next\n          show \"?MATCH (State F1 H' ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using next_instr2 rel_stacktraces_Cons\n              unfolding IStoreUbx \\<open>x' = x\\<close>\n              using step_store.hyps casts\n              by (auto simp: \\<Sigma>1'_def \\<Sigma>2_def map_update next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.StoreUbx\n                  intro: list_all_list_updateI)\n          qed (insert rel_F1_F2, simp_all)\n        qed\n      qed simp_all\n    next\n      case (step_op op ar x)\n      then obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.IOp op) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      have pc_in_range: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = instr2\"\n        using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n        by simp_all\n      from next_instr2 norm_eq_instr1_instr2\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H ?st1') x\")\n      proof (cases instr2)\n        case (IOp op')\n        hence \"op' = op\" using norm_eq_instr1_instr2 by simp\n        have casts:\n          \"ap_map_list cast_Dyn (take ar \\<Sigma>2) = Some (take ar (map Subx.norm_unboxed \\<Sigma>2))\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc IOp, simplified]\n          using step_op.hyps\n          by (auto simp: \\<open>op' = op\\<close> take_map\n              elim!: Subx.sp_instrs.cases[of _ _ \"x # xs\" for x xs, simplified] Subx.sp_instr.cases\n              intro!: ap_map_list_cast_Dyn_eq_norm_stack[of \"take (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> op) \\<Sigma>2\"]\n              dest!: map_eq_append_replicate_conv)\n        let ?st2' = \"Frame f l (Suc pc) R2 (OpDyn x # drop ar \\<Sigma>2) # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\"\n            using step_op.hyps casts next_instr2\n            unfolding IOp \\<open>op' = op\\<close>\n            by (auto simp: s2_def st2_def intro: Subx.step_op)\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              using wf_F2 by (auto intro: Subx.wf_stateI)\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using step_op.hyps casts next_instr2 rel_stacktraces_Cons\n              unfolding IOp \\<open>op' = op\\<close>\n              by (auto simp: min_absorb2 take_map[symmetric] drop_map[symmetric]\n                  simp: next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.Op\n                  intro: list_all_list_updateI\n                  dest!: ap_map_list_cast_Dyn_replicate[symmetric])\n          qed (insert rel_F1_F2, simp_all)\n        qed\n      qed simp_all\n    next\n      case (step_op_inl op ar opinl x F1')\n      then obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.IOp op) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      have pc_in_range: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = instr2\"\n        using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n        by simp_all\n      from next_instr2 norm_eq_instr1_instr2\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1' H ?st1') x\")\n      proof (cases instr2)\n        case (IOp op')\n        hence \"op' = op\" using norm_eq_instr1_instr2 by simp\n        have casts:\n          \"ap_map_list cast_Dyn (take ar \\<Sigma>2) = Some (take ar (map Subx.norm_unboxed \\<Sigma>2))\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc IOp, simplified]\n          using step_op_inl.hyps\n          by (auto simp: \\<open>op' = op\\<close> take_map\n              elim!: Subx.sp_instrs.cases[of _ _ \"x # xs\" for x xs, simplified] Subx.sp_instr.cases\n              intro!: ap_map_list_cast_Dyn_eq_norm_stack[of \"take (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> op) \\<Sigma>2\"]\n              dest!: map_eq_append_replicate_conv)\n        let ?st2' = \"Frame f l (Suc pc) R2 (OpDyn x # drop ar \\<Sigma>2) # st2'\"\n        let ?F2' = \"Subx.Fenv.map_entry F2 f (\\<lambda>fd. rewrite_fundef_body fd l pc (Ubx.IOpInl opinl))\"\n        let ?s2' = \"State ?F2' H ?st2'\"\n        have step_s2_s2': \"?STEP ?s2'\"\n          using step_op_inl.hyps casts next_instr2\n          unfolding IOp \\<open>op' = op\\<close>\n          by (auto simp: s2_def st2_def intro: Subx.step_op_inl)\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\" by (rule step_s2_s2')\n        next\n          show \"?MATCH (State F1' H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              by (rule Subx.wf_state_step_preservation[OF wf_s2 step_s2_s2'])\n          next\n            show \"rel_fundefs (Finca_get F1') (Fubx_get ?F2')\"\n              using rel_F1_F2 step_op_inl\n              by (auto intro: rel_fundefs_rewriteI)\n          next\n            have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using rel_st1'_st2'\n              apply (rule rel_stacktraces.intros)\n              using step_op_inl.hyps casts next_instr2 rel_stacktraces_Cons\n              unfolding IOp \\<open>op' = op\\<close>\n              by (auto simp: min_absorb2 take_map[symmetric] drop_map[symmetric]\n                  simp: next_instr_take_Suc_conv\n                  intro!: sp_instrs_prefix' Subx.sp_instr.Op\n                  dest!: ap_map_list_cast_Dyn_replicate[symmetric])\n            then show \"rel_stacktraces (Fubx_get ?F2') None ?st1' ?st2'\"\n              apply (rule rel_stacktraces_map_entry_rewrite_fundef_body)\n              apply (rule next_instr2)\n              unfolding IOp \\<open>op' = op\\<close>\n              using Sinca.\\<II>\\<nn>\\<ll>_invertible Subx.sp_instr_Op_OpInl_conv step_op_inl.hyps(4) apply blast\n               apply simp\n              apply simp\n              done\n          qed\n        qed\n      qed simp_all\n    next\n      case (step_op_inl_hit opinl ar x)\n      then obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.IOpInl opinl) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      have pc_in_range: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = instr2\"\n        using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n        by simp_all\n      from next_instr2 norm_eq_instr1_instr2\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H ?st1') x\")\n      proof (cases instr2)\n        case (IOpInl opinl')\n        hence \"opinl' = opinl\" using norm_eq_instr1_instr2 by simp\n        have casts:\n          \"ap_map_list cast_Dyn (take ar \\<Sigma>2) = Some (take ar (map Subx.norm_unboxed \\<Sigma>2))\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc IOpInl, simplified]\n          using step_op_inl_hit.hyps\n          by (auto simp: \\<open>opinl' = opinl\\<close> take_map\n              elim!: Subx.sp_instrs.cases[of _ _ \"x # xs\" for x xs, simplified] Subx.sp_instr.cases\n              intro!: ap_map_list_cast_Dyn_eq_norm_stack[of \"take (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl)) \\<Sigma>2\"]\n              dest!: map_eq_append_replicate_conv)\n        let ?st2' = \"Frame f l (Suc pc) R2 (OpDyn x # drop ar \\<Sigma>2) # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n        have step_s2_s2': \"?STEP ?s2'\"\n          using step_op_inl_hit.hyps casts next_instr2\n          unfolding IOpInl \\<open>opinl' = opinl\\<close>\n          by (auto simp: s2_def st2_def intro: Subx.step_op_inl_hit)\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\" by (rule step_s2_s2')\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              by (rule Subx.wf_state_step_preservation[OF wf_s2 step_s2_s2'])\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using step_op_inl_hit.hyps casts next_instr2 rel_stacktraces_Cons\n              unfolding IOpInl \\<open>opinl' = opinl\\<close>\n              by (auto simp: min_absorb2 take_map[symmetric] drop_map[symmetric]\n                  simp: next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.OpInl\n                  intro: list_all_list_updateI\n                  dest!: ap_map_list_cast_Dyn_replicate[symmetric])\n          qed (insert rel_F1_F2, simp_all)\n        qed\n      next\n        case (IOpUbx opubx)\n        hence \"opinl = \\<BB>\\<oo>\\<xx> opubx\" using norm_eq_instr1_instr2 by simp\n        let ?ar = \"\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> (\\<BB>\\<oo>\\<xx> opubx))\"\n\n        obtain codom where typeof_opubx: \"\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp> opubx = (map typeof (take ?ar \\<Sigma>2), codom)\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc IOpUbx, simplified]\n          by (cases \"\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp> opubx\")\n            (auto simp: eq_append_conv_conj Subx.\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp>_\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> take_map\n              dest!: Subx.sp_instrs_ConsD elim!: Subx.sp_instr.cases)\n\n        obtain u where\n          eval_opubx: \"\\<UU>\\<bb>\\<xx>\\<OO>\\<pp> opubx (take ?ar \\<Sigma>2) = Some u\" and typeof_u: \"typeof u = codom\"\n          using Subx.\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp>_correct[OF typeof_opubx] by auto\n        hence x_def: \"x = Subx.norm_unboxed u\"\n          using step_op_inl_hit.hyps\n          using Subx.\\<UU>\\<bb>\\<xx>\\<OO>\\<pp>_correct[OF eval_opubx]\n          unfolding \\<open>opinl = \\<BB>\\<oo>\\<xx> opubx\\<close> take_map\n          by simp\n\n        let ?st2' = \"Frame f l (Suc pc) R2 (u # drop ?ar \\<Sigma>2) # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n\n        have step_s2_s2': \"?STEP ?s2'\"\n          using step_op_inl_hit.hyps next_instr2\n          unfolding IOpUbx \\<open>opinl = \\<BB>\\<oo>\\<xx> opubx\\<close>\n          using eval_opubx\n          by (auto simp: s2_def st2_def intro!: Subx.step_op_ubx)\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\" by (rule step_s2_s2')\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              by (rule Subx.wf_state_step_preservation[OF wf_s2 step_s2_s2'])\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using step_op_inl_hit.hyps next_instr2 rel_stacktraces_Cons\n              unfolding IOpUbx \\<open>opinl = \\<BB>\\<oo>\\<xx> opubx\\<close> x_def\n              by (auto simp: typeof_opubx typeof_u\n                  simp: min_absorb2 take_map[symmetric] drop_map[symmetric]\n                  simp: next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.OpUbx\n                  dest!: ap_map_list_cast_Dyn_replicate[symmetric])\n          qed (insert rel_F1_F2, simp_all)\n        qed\n      qed simp_all\n    next\n      case (step_op_inl_miss opinl ar x F1')\n      then obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.IOpInl opinl) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      have pc_in_range: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = instr2\"\n        using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n        by simp_all\n      from next_instr2 norm_eq_instr1_instr2\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1' H ?st1') x\")\n      proof (cases instr2)\n        case (IOpInl opinl')\n        hence \"opinl' = opinl\" using norm_eq_instr1_instr2 by simp\n        have casts:\n          \"ap_map_list cast_Dyn (take ar \\<Sigma>2) = Some (take ar (map Subx.norm_unboxed \\<Sigma>2))\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc IOpInl, simplified]\n          using step_op_inl_miss.hyps\n          by (auto simp: \\<open>opinl' = opinl\\<close> take_map\n              elim!: Subx.sp_instrs.cases[of _ _ \"x # xs\" for x xs, simplified] Subx.sp_instr.cases\n              intro!: ap_map_list_cast_Dyn_eq_norm_stack[of \"take (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl)) \\<Sigma>2\"]\n              dest!: map_eq_append_replicate_conv)\n        let ?st2' = \"Frame f l (Suc pc) R2 (OpDyn x # drop ar \\<Sigma>2) # st2'\"\n        let ?F2' = \"Subx.Fenv.map_entry F2 f (\\<lambda>fd. rewrite_fundef_body fd l pc (Ubx.IOp (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl)))\"\n        let ?s2' = \"State ?F2' H ?st2'\"\n        have step_s2_s2': \"?STEP ?s2'\"\n          using step_op_inl_miss.hyps casts next_instr2\n          unfolding IOpInl \\<open>opinl' = opinl\\<close>\n          by (auto simp: s2_def st2_def intro: Subx.step_op_inl_miss)\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\" by (rule step_s2_s2')\n        next\n          show \"?MATCH (State F1' H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              by (rule Subx.wf_state_step_preservation[OF wf_s2 step_s2_s2'])\n          next\n            show \"rel_fundefs (Finca_get F1') (Fubx_get ?F2')\"\n              using rel_F1_F2 step_op_inl_miss.hyps\n              by (auto intro: rel_fundefs_rewriteI)\n          next\n            have \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using rel_st1'_st2'\n              apply (rule rel_stacktraces.intros)\n              using step_op_inl_miss.hyps casts next_instr2 rel_stacktraces_Cons\n              unfolding IOpInl \\<open>opinl' = opinl\\<close>\n              by (auto simp: min_absorb2 take_map[symmetric] drop_map[symmetric]\n                  simp: next_instr_take_Suc_conv\n                  intro!: sp_instrs_prefix' Subx.sp_instr.OpInl\n                  dest!: ap_map_list_cast_Dyn_replicate[symmetric])\n            then show \"rel_stacktraces (Fubx_get ?F2') None ?st1' ?st2'\"\n              apply (rule rel_stacktraces_map_entry_rewrite_fundef_body)\n              apply (rule next_instr2)\n              unfolding IOpInl \\<open>opinl' = opinl\\<close>\n              using Sinca.\\<II>\\<nn>\\<ll>_invertible Subx.sp_instr_Op_OpInl_conv step_op_inl_miss.hyps apply metis\n               apply simp\n              apply simp\n              done\n          qed\n        qed\n      next\n        case (IOpUbx opubx)\n        hence \"opinl = \\<BB>\\<oo>\\<xx> opubx\" using norm_eq_instr1_instr2 by simp\n        let ?ar = \"\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> (\\<BB>\\<oo>\\<xx> opubx))\"\n\n        obtain codom where typeof_opubx: \"\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp> opubx = (map typeof (take ?ar \\<Sigma>2), codom)\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc IOpUbx, simplified]\n          by (cases \"\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp> opubx\")\n            (auto simp: eq_append_conv_conj Subx.\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp>_\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> take_map\n              dest!: Subx.sp_instrs_ConsD elim!: Subx.sp_instr.cases)\n        obtain u where \"\\<UU>\\<bb>\\<xx>\\<OO>\\<pp> opubx (take ?ar \\<Sigma>2) = Some u\"\n          using Subx.\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp>_correct[OF typeof_opubx] by auto\n        hence \"\\<II>\\<ss>\\<II>\\<nn>\\<ll> opinl (take ?ar \\<Sigma>1)\"\n          unfolding \\<Sigma>1_def\n          by (auto simp: \\<open>opinl = \\<BB>\\<oo>\\<xx> opubx\\<close> take_map dest: Subx.\\<UU>\\<bb>\\<xx>\\<OO>\\<pp>_to_\\<II>\\<nn>\\<ll>[THEN Sinca.\\<II>\\<nn>\\<ll>_\\<II>\\<ss>\\<II>\\<nn>\\<ll>])\n        hence False\n          using step_op_inl_miss.hyps\n          by (simp add: \\<Sigma>1_def \\<open>opinl = \\<BB>\\<oo>\\<xx> opubx\\<close>)\n        thus ?thesis by simp\n      qed simp_all\n    next\n      case (step_cjump l\\<^sub>t l\\<^sub>f d l' \\<Sigma>1')\n      then obtain u \\<Sigma>2' where\n        \\<Sigma>2_def: \"\\<Sigma>2 = u # \\<Sigma>2'\" and\n        d_def: \"d = Subx.norm_unboxed u\" and\n        \\<Sigma>1'_def: \"\\<Sigma>1' = map Subx.norm_unboxed \\<Sigma>2'\"\n        by auto\n      from step_cjump.hyps obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.ICJump l\\<^sub>t l\\<^sub>f) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      have pc_in_range: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = instr2\"\n        using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n        by simp_all\n\n      from next_instr2 norm_eq_instr1_instr2\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H ?st1') x\")\n      proof (cases instr2)\n        case (ICJump l\\<^sub>t' l\\<^sub>f')\n        hence \"l\\<^sub>t' = l\\<^sub>t\" and \"l\\<^sub>f' = l\\<^sub>f\" using norm_eq_instr1_instr2 by simp_all\n        hence \"{l\\<^sub>t, l\\<^sub>f} \\<subseteq> fst ` set (body fd2)\"\n          using all_jumps_in_range pc_in_range nth_instrs_pc ICJump by (auto simp: list_all_length)\n        moreover have \"l' \\<in> {l\\<^sub>t, l\\<^sub>f}\"\n          using step_cjump.hyps by auto\n        ultimately have \"l' \\<in> fst ` set (body fd2)\"\n          by blast\n        then obtain instrs' where map_of_l': \"map_of (body fd2) l' = Some instrs'\"\n          by (auto dest: weak_map_of_SomeI)\n\n        have sp_instrs_instrs': \"Subx.sp_instrs (map_option funtype \\<circ> Fubx_get F2) (return fd2)\n          (butlast instrs @ [instrs ! pc]) [] []\" if pc_def: \"pc = length instrs - 1\"\n          unfolding pc_def last_conv_nth[OF instrs_neq_Nil, symmetric]\n          unfolding append_butlast_last_id[OF instrs_neq_Nil]\n          by (rule sp_instrs_instrs)\n  \n        have sp_instr_last: \"Subx.sp_instr (map_option funtype \\<circ> Fubx_get F2) (return fd2)\n          (instrs ! pc) (map typeof \\<Sigma>2) []\" if pc_def: \"pc = length instrs - 1\"\n          using sp_instrs_instrs'[OF pc_def]\n          using sp_instrs_prefix[unfolded pc_def butlast_conv_take[symmetric]]\n          by (auto dest!: Subx.sp_instrs_appendD')\n\n        have is_jump_nthD: \"\\<And>n. is_jump (instrs ! n) \\<Longrightarrow> n < length instrs \\<Longrightarrow> n = length instrs - 1\"\n          using list_all_map_of_SomeD[OF wf_fd2[THEN Subx.wf_fundef_all_wf_basic_blockD] map_of_fd2_l]\n          by (auto dest!: Subx.wf_basic_blockD\n                list_all_butlast_not_nthD[of \"\\<lambda>i. \\<not> is_jump i \\<and> \\<not> Ubx.instr.is_return i\", simplified, OF _ disjI1])\n\n        have pc_def: \"pc = length instrs - 1\"\n          using is_jump_nthD[OF _ pc_in_range] nth_instrs_pc ICJump by simp\n        have \\<Sigma>2'_eq_Nil: \"\\<Sigma>2' = []\"\n          using sp_instr_last[OF pc_def] step_cjump.hyps\n          by (auto simp: \\<Sigma>2_def d_def nth_instrs_pc ICJump elim!: Subx.sp_instr.cases)\n\n        have cast: \"cast_Dyn u = Some d\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc ICJump, simplified]\n          by (auto simp: \\<Sigma>2_def d_def dest!: Subx.sp_instrs_ConsD elim!: Subx.sp_instr.cases\n              intro: Subx.typeof_and_norm_unboxed_imp_cast_Dyn)\n\n        let ?st2' = \"Frame f l' 0 R2 \\<Sigma>2' # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n\n        have step_s2_s2': \"?STEP ?s2'\"\n          using step_cjump.hyps cast next_instr2\n          unfolding ICJump \\<open>l\\<^sub>t' = l\\<^sub>t\\<close> \\<open>l\\<^sub>f' = l\\<^sub>f\\<close>\n          by (auto simp: s2_def st2_def \\<Sigma>2_def intro!: Subx.step_cjump)\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\" by (rule step_s2_s2')\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              by (rule Subx.wf_state_step_preservation[OF wf_s2 step_s2_s2'])\n          next\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              using step_cjump.hyps cast next_instr2 rel_stacktraces_Cons\n              using map_of_l'\n              unfolding ICJump \\<open>l\\<^sub>t' = l\\<^sub>t\\<close> \\<open>l\\<^sub>f' = l\\<^sub>f\\<close> \\<Sigma>1'_def \\<Sigma>2'_eq_Nil\n              by (auto simp: min_absorb2 take_map[symmetric] drop_map[symmetric]\n                  simp: next_instr_take_Suc_conv\n                  intro!: rel_stacktraces.intros sp_instrs_prefix' Subx.sp_instr.CJump\n                  intro: Subx.sp_instrs.Nil\n                  dest!: ap_map_list_cast_Dyn_replicate[symmetric])\n          qed (insert rel_F1_F2, simp_all)\n        qed\n      qed simp_all\n    next\n      case (step_call g gd1 frame\\<^sub>g)\n      then obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq (Inca.ICall g) instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      have pc_in_range: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = instr2\"\n        using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n        by simp_all\n\n      from step_call.hyps obtain gd2 where\n        F2_g: \"Fubx_get F2 g = Some gd2\" and rel_gd1_gd2: \"rel_fundef (=) norm_eq gd1 gd2\"\n        using rel_fundefs_Some1[OF rel_F1_F2] by auto\n                \n      have wf_gd2: \"Subx.wf_fundef (map_option funtype \\<circ> Fubx_get F2) gd2\"\n        by (rule Subx.wf_fundefs_getD[OF wf_F2 F2_g])\n\n      obtain intrs\\<^sub>g where gd2_fst_bblock: \"map_of (body gd2) (fst (hd (body gd2))) = Some intrs\\<^sub>g\"\n        using Subx.wf_fundef_body_neq_NilD[OF wf_gd2]\n        by (metis hd_in_set map_of_eq_None_iff not_Some_eq prod.collapse prod_in_set_fst_image_conv)\n\n      from norm_eq_instr1_instr2\n      show ?case (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H ?st1') x\")\n      proof (cases instr2)\n        case (ICall g')\n        hence \"g' = g\" using norm_eq_instr1_instr2 by simp\n        hence all_dyn_args: \"list_all is_dyn_operand (take (arity gd2) \\<Sigma>2)\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc ICall, simplified]\n          using F2_g\n          by (auto simp: funtype_def eq_append_conv_conj take_map list.pred_set\n              dest!: Subx.sp_instrs_ConsD replicate_eq_impl_Ball_eq elim!: Subx.sp_instr.cases)\n\n        let ?frame\\<^sub>g = \"allocate_frame g gd2 (take (arity gd2) \\<Sigma>2) (OpDyn uninitialized)\"\n        let ?st2' = \"?frame\\<^sub>g # Frame f l pc R2 \\<Sigma>2 # st2'\"\n        let ?s2' = \"State F2 H ?st2'\"\n\n        have step_s2_s2': \"?STEP ?s2'\"\n          using step_call.hyps next_instr2 F2_g rel_gd1_gd2 all_dyn_args\n          unfolding ICall \\<open>g' = g\\<close>\n          by (auto simp: s2_def st2_def rel_fundef_arities intro!: Subx.step_call)\n        show ?thesis\n        proof (intro exI conjI)\n          show \"?STEP ?s2'\" by (rule step_s2_s2')\n        next\n          show \"?MATCH (State F1 H ?st1') ?s2'\"\n          proof (rule match.intros)\n            show \"Subx.wf_state ?s2'\"\n              by (rule Subx.wf_state_step_preservation[OF wf_s2 step_s2_s2'])\n          next\n            have FOO: \"fst (hd (body gd1)) = fst (hd (body gd2))\"\n              apply (rule rel_fundef_rel_fst_hd_bodies[OF rel_gd1_gd2])\n              using Subx.wf_fundefs_getD[OF wf_F2 \\<open>Fubx_get F2 g = Some gd2\\<close>]\n              by (auto dest: Subx.wf_fundef_body_neq_NilD)\n            show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n              unfolding step_call.hyps allocate_frame_def FOO\n            proof (rule rel_stacktraces.intros)\n              show \"Fubx_get F2 g = Some gd2\"\n                by (rule F2_g)\n            next\n              show \"rel_stacktraces (Fubx_get F2) (Some g)\n                (Frame f l pc (map Subx.norm_unboxed R2) (map Subx.norm_unboxed \\<Sigma>2) # st1')\n                (Frame f l pc R2 \\<Sigma>2 # st2')\"\n                using step_call.hyps rel_stacktraces_Cons next_instr2 F2_g rel_gd1_gd2 all_dyn_args\n                unfolding ICall \\<open>g' = g\\<close>\n                by (auto simp: is_valid_fun_call_def rel_fundef_arities intro!: rel_stacktraces.intros)\n            qed (insert rel_gd1_gd2 all_dyn_args gd2_fst_bblock,\n                simp_all add: take_map rel_fundef_arities rel_fundef_locals Subx.sp_instrs.Nil\n                list_all_replicateI)\n          qed (insert rel_F1_F2, simp_all)\n        qed\n      qed simp_all\n    next\n      case (step_return fd1 \\<Sigma>1\\<^sub>g frame\\<^sub>g' g l\\<^sub>g pc\\<^sub>g R1\\<^sub>g st1'')\n      then obtain instr2 where\n        next_instr2: \"next_instr (Fubx_get F2) f l pc = Some instr2\" and\n        norm_eq_instr1_instr2: \"norm_eq Inca.IReturn instr2\"\n        by (auto dest: rel_fundefs_next_instr1[OF rel_F1_F2])\n      have pc_in_range: \"pc < length instrs\" and nth_instrs_pc: \"instrs ! pc = instr2\"\n        using next_instr_get_map_ofD[OF next_instr2 F2_f map_of_fd2_l]\n        by simp_all\n\n      from step_return.hyps have rel_fd1_fd2: \"rel_fundef (=) norm_eq fd1 fd2\"\n        using rel_fundefsD[OF rel_F1_F2, of f] F2_f  by simp\n\n      from norm_eq_instr1_instr2\n      show ?case  (is \"\\<exists>x. ?STEP x \\<and> ?MATCH (State F1 H ?st1') x\")\n      proof (cases instr2)\n        case IReturn\n        have map_typeof_\\<Sigma>2: \"map typeof \\<Sigma>2 = replicate (return fd2) None\"\n          using sp_instrs_sufix[OF pc_in_range, unfolded nth_instrs_pc IReturn, simplified]\n          by (auto elim: Subx.sp_instr.cases dest: Subx.sp_instrs_ConsD)\n        hence all_dyn_\\<Sigma>2: \"list_all is_dyn_operand \\<Sigma>2\"\n          by (auto simp: list.pred_set dest: replicate_eq_impl_Ball_eq[OF sym])\n        show ?thesis\n          using rel_st1'_st2' unfolding \\<open>Frame g l\\<^sub>g pc\\<^sub>g R1\\<^sub>g \\<Sigma>1\\<^sub>g # st1'' = st1'\\<close>[symmetric]\n        proof (cases rule: rel_stacktraces.cases)\n          case (rel_stacktraces_Cons st2'' \\<Sigma>2\\<^sub>g R2\\<^sub>g gd2 instrs\\<^sub>g)\n          let ?st2' = \"Frame g l\\<^sub>g (Suc pc\\<^sub>g) R2\\<^sub>g (\\<Sigma>2 @ drop (arity fd2) \\<Sigma>2\\<^sub>g) # st2''\"\n          let ?s2' = \"State F2 H ?st2'\"\n          have step_s2_s2': \"?STEP ?s2'\"\n            using step_return.hyps next_instr2 F2_f rel_fd1_fd2 rel_stacktraces_Cons all_dyn_\\<Sigma>2\n            unfolding IReturn\n            by (auto simp: s2_def st2_def rel_fundef_arities rel_fundef_return\n                intro: Subx.step_return)\n          show ?thesis\n          proof (intro exI conjI)\n            show \"?STEP ?s2'\" by (rule step_s2_s2')\n          next\n            show \"?MATCH (State F1 H ?st1') ?s2'\"\n            proof (rule match.intros)\n              show \"Subx.wf_state ?s2'\"\n                by (rule Subx.wf_state_step_preservation[OF wf_s2 step_s2_s2'])\n            next\n              have \"Subx.sp_instr (map_option funtype \\<circ> Fubx_get F2) (return gd2)\n                (Ubx.instr.ICall f) (map typeof \\<Sigma>2\\<^sub>g)\n                (replicate (return fd2) None @ map typeof (drop (arity fd2) \\<Sigma>2\\<^sub>g))\"\n                using rel_stacktraces_Cons F2_f\n                using replicate_eq_map[of \"arity fd2\" \"take (arity fd2) \\<Sigma>2\\<^sub>g\" typeof None]\n                by (auto simp: funtype_def is_valid_fun_call_def\n                    simp: min_absorb2 list.pred_set take_map[symmetric] drop_map[symmetric]\n                    intro!: Subx.sp_instr.Call[where \\<Sigma> = \"map typeof (drop (arity fd2) \\<Sigma>2\\<^sub>g)\"])\n              then show \"rel_stacktraces (Fubx_get F2) None ?st1' ?st2'\"\n                unfolding step_return.hyps\n                using rel_stacktraces_Cons rel_fd1_fd2 F2_f\n                using map_typeof_\\<Sigma>2\n                by (auto simp: drop_map rel_fundef_arities is_valid_fun_call_def\n                    simp: next_instr_take_Suc_conv funtype_def\n                    intro!: rel_stacktraces.intros Subx.sp_instrs_appendI[where \\<Sigma> = \"map typeof \\<Sigma>2\\<^sub>g\"])\n            qed (insert rel_F1_F2, simp_all)\n          qed\n        qed\n      qed simp_all\n    qed\n  qed\nqed\n\nlemma match_final_forward:\n  assumes \"match s1 s2\" and final_s1: \"final Finca_get Inca.IReturn s1\"\n  shows \"final Fubx_get Ubx.IReturn s2\"\n  using \\<open>match s1 s2\\<close>\nproof (cases s1 s2 rule: match.cases)\n  case (matchI F2 H st2 F1 st1)\n  show ?thesis\n    using final_s1[unfolded matchI]\n  proof (cases _ _ \"State F1 H st1\" rule: final.cases)\n    case (finalI f l pc R \\<Sigma>)\n    then show ?thesis\n      using matchI\n      by (auto intro!: final.intros elim: rel_stacktraces.cases norm_instr.elims[OF sym]\n          dest: rel_fundefs_next_instr1)\n  qed\nqed\n\nsublocale inca_ubx_forward_simulation:\n  forward_simulation Sinca.step Subx.step\n    \"final Finca_get Inca.IReturn\"\n    \"final Fubx_get Ubx.IReturn\"\n    \"\\<lambda>_ _. False\" \"\\<lambda>_. match\"\n  using match_final_forward forward_lockstep_simulation\n  using lockstep_to_plus_forward_simulation[of match Sinca.step _ Subx.step]\n  by unfold_locales auto\n\n\nsection \\<open>Bisimulation\\<close>\n\nsublocale inca_ubx_bisimulation:\n  bisimulation Sinca.step Subx.step \"final Finca_get Inca.IReturn\" \"final Fubx_get Ubx.IReturn\"\n  \"\\<lambda>_ _. False\" \"\\<lambda>_. match\"\n  by unfold_locales\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Interpreter_Optimizations/Inca_to_Ubx_simulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297745935070808, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3491914116821352}}
{"text": "section \\<open>Lambda Cube Examples\\<close>\n\ntheory Example\nimports Cube\nbegin\n\ntext \\<open>Examples taken from:\n\n  H. Barendregt. Introduction to Generalised Type Systems.\n  J. Functional Programming.\\<close>\n\nmethod_setup depth_solve =\n  \\<open>Attrib.thms >> (fn thms => K (METHOD (fn facts =>\n    (DEPTH_SOLVE (HEADGOAL (ares_tac (facts @ thms)))))))\\<close>\n\nmethod_setup depth_solve1 =\n  \\<open>Attrib.thms >> (fn thms => K (METHOD (fn facts =>\n    (DEPTH_SOLVE_1 (HEADGOAL (ares_tac (facts @ thms)))))))\\<close>\n\nmethod_setup strip_asms =\n  \\<open>Attrib.thms >> (fn thms => K (METHOD (fn facts =>\n    REPEAT (resolve_tac [@{thm strip_b}, @{thm strip_s}] 1 THEN\n    DEPTH_SOLVE_1 (ares_tac (facts @ thms) 1)))))\\<close>\n\n\nsubsection \\<open>Simple types\\<close>\n\nschematic_lemma \"A:* \\<turnstile> A\\<rightarrow>A : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma \"A:* \\<turnstile> \\<Lambda> a:A. a : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma \"A:* B:* b:B \\<turnstile> \\<Lambda> x:A. b : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma \"A:* b:A \\<turnstile> (\\<Lambda> a:A. a)^b: ?T\"\n  by (depth_solve rules)\n\nschematic_lemma \"A:* B:* c:A b:B \\<turnstile> (\\<Lambda> x:A. b)^ c: ?T\"\n  by (depth_solve rules)\n\nschematic_lemma \"A:* B:* \\<turnstile> \\<Lambda> a:A. \\<Lambda> b:B. a : ?T\"\n  by (depth_solve rules)\n\n\nsubsection \\<open>Second-order types\\<close>\n\nschematic_lemma (in L2) \"\\<turnstile> \\<Lambda> A:*. \\<Lambda> a:A. a : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in L2) \"A:* \\<turnstile> (\\<Lambda> B:*.\\<Lambda> b:B. b)^A : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in L2) \"A:* b:A \\<turnstile> (\\<Lambda> B:*.\\<Lambda> b:B. b) ^ A ^ b: ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in L2) \"\\<turnstile> \\<Lambda> B:*.\\<Lambda> a:(\\<Pi> A:*.A).a ^ ((\\<Pi> A:*.A)\\<rightarrow>B) ^ a: ?T\"\n  by (depth_solve rules)\n\n\nsubsection \\<open>Weakly higher-order propositional logic\\<close>\n\nschematic_lemma (in Lomega) \"\\<turnstile> \\<Lambda> A:*.A\\<rightarrow>A : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in Lomega) \"B:* \\<turnstile> (\\<Lambda> A:*.A\\<rightarrow>A) ^ B : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in Lomega) \"B:* b:B \\<turnstile> (\\<Lambda> y:B. b): ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in Lomega) \"A:* F:*\\<rightarrow>* \\<turnstile> F^(F^A): ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in Lomega) \"A:* \\<turnstile> \\<Lambda> F:*\\<rightarrow>*.F^(F^A): ?T\"\n  by (depth_solve rules)\n\n\nsubsection \\<open>LP\\<close>\n\nschematic_lemma (in LP) \"A:* \\<turnstile> A \\<rightarrow> * : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LP) \"A:* P:A\\<rightarrow>* a:A \\<turnstile> P^a: ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LP) \"A:* P:A\\<rightarrow>A\\<rightarrow>* a:A \\<turnstile> \\<Pi> a:A. P^a^a: ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LP) \"A:* P:A\\<rightarrow>* Q:A\\<rightarrow>* \\<turnstile> \\<Pi> a:A. P^a \\<rightarrow> Q^a: ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LP) \"A:* P:A\\<rightarrow>* \\<turnstile> \\<Pi> a:A. P^a \\<rightarrow> P^a: ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LP) \"A:* P:A\\<rightarrow>* \\<turnstile> \\<Lambda> a:A. \\<Lambda> x:P^a. x: ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LP) \"A:* P:A\\<rightarrow>* Q:* \\<turnstile> (\\<Pi> a:A. P^a\\<rightarrow>Q) \\<rightarrow> (\\<Pi> a:A. P^a) \\<rightarrow> Q : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LP) \"A:* P:A\\<rightarrow>* Q:* a0:A \\<turnstile>\n        \\<Lambda> x:\\<Pi> a:A. P^a\\<rightarrow>Q. \\<Lambda> y:\\<Pi> a:A. P^a. x^a0^(y^a0): ?T\"\n  by (depth_solve rules)\n\n\nsubsection \\<open>Omega-order types\\<close>\n\nschematic_lemma (in L2) \"A:* B:* \\<turnstile> \\<Pi> C:*.(A\\<rightarrow>B\\<rightarrow>C)\\<rightarrow>C : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in Lomega2) \"\\<turnstile> \\<Lambda> A:*.\\<Lambda> B:*.\\<Pi> C:*.(A\\<rightarrow>B\\<rightarrow>C)\\<rightarrow>C : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in Lomega2) \"\\<turnstile> \\<Lambda> A:*.\\<Lambda> B:*.\\<Lambda> x:A. \\<Lambda> y:B. x : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in Lomega2) \"A:* B:* \\<turnstile> ?p : (A\\<rightarrow>B) \\<rightarrow> ((B\\<rightarrow>\\<Pi> P:*.P)\\<rightarrow>(A\\<rightarrow>\\<Pi> P:*.P))\"\n  apply (strip_asms rules)\n  apply (rule lam_ss)\n    apply (depth_solve1 rules)\n   prefer 2\n   apply (depth_solve1 rules)\n  apply (rule lam_ss)\n    apply (depth_solve1 rules)\n   prefer 2\n   apply (depth_solve1 rules)\n  apply (rule lam_ss)\n    apply assumption\n   prefer 2\n   apply (depth_solve1 rules)\n  apply (erule pi_elim)\n   apply assumption\n  apply (erule pi_elim)\n   apply assumption\n  apply assumption\n  done\n\n\nsubsection \\<open>Second-order Predicate Logic\\<close>\n\nschematic_lemma (in LP2) \"A:* P:A\\<rightarrow>* \\<turnstile> \\<Lambda> a:A. P^a\\<rightarrow>(\\<Pi> A:*.A) : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LP2) \"A:* P:A\\<rightarrow>A\\<rightarrow>* \\<turnstile>\n    (\\<Pi> a:A. \\<Pi> b:A. P^a^b\\<rightarrow>P^b^a\\<rightarrow>\\<Pi> P:*.P) \\<rightarrow> \\<Pi> a:A. P^a^a\\<rightarrow>\\<Pi> P:*.P : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LP2) \"A:* P:A\\<rightarrow>A\\<rightarrow>* \\<turnstile>\n    ?p: (\\<Pi> a:A. \\<Pi> b:A. P^a^b\\<rightarrow>P^b^a\\<rightarrow>\\<Pi> P:*.P) \\<rightarrow> \\<Pi> a:A. P^a^a\\<rightarrow>\\<Pi> P:*.P\"\n  -- \\<open>Antisymmetry implies irreflexivity:\\<close>\n  apply (strip_asms rules)\n  apply (rule lam_ss)\n    apply (depth_solve1 rules)\n   prefer 2\n   apply (depth_solve1 rules)\n  apply (rule lam_ss)\n    apply assumption\n   prefer 2\n   apply (depth_solve1 rules)\n  apply (rule lam_ss)\n    apply (depth_solve1 rules)\n   prefer 2\n   apply (depth_solve1 rules)\n  apply (erule pi_elim, assumption, assumption?)+\n  done\n\n\nsubsection \\<open>LPomega\\<close>\n\nschematic_lemma (in LPomega) \"A:* \\<turnstile> \\<Lambda> P:A\\<rightarrow>A\\<rightarrow>*.\\<Lambda> a:A. P^a^a : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LPomega) \"\\<turnstile> \\<Lambda> A:*.\\<Lambda> P:A\\<rightarrow>A\\<rightarrow>*.\\<Lambda> a:A. P^a^a : ?T\"\n  by (depth_solve rules)\n\n\nsubsection \\<open>Constructions\\<close>\n\nschematic_lemma (in CC) \"\\<turnstile> \\<Lambda> A:*.\\<Lambda> P:A\\<rightarrow>*.\\<Lambda> a:A. P^a\\<rightarrow>\\<Pi> P:*.P: ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in CC) \"\\<turnstile> \\<Lambda> A:*.\\<Lambda> P:A\\<rightarrow>*.\\<Pi> a:A. P^a: ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in CC) \"A:* P:A\\<rightarrow>* a:A \\<turnstile> ?p : (\\<Pi> a:A. P^a)\\<rightarrow>P^a\"\n  apply (strip_asms rules)\n  apply (rule lam_ss)\n    apply (depth_solve1 rules)\n   prefer 2\n   apply (depth_solve1 rules)\n  apply (erule pi_elim, assumption, assumption)\n  done\n\n\nsubsection \\<open>Some random examples\\<close>\n\nschematic_lemma (in LP2) \"A:* c:A f:A\\<rightarrow>A \\<turnstile>\n    \\<Lambda> a:A. \\<Pi> P:A\\<rightarrow>*.P^c \\<rightarrow> (\\<Pi> x:A. P^x\\<rightarrow>P^(f^x)) \\<rightarrow> P^a : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in CC) \"\\<Lambda> A:*.\\<Lambda> c:A. \\<Lambda> f:A\\<rightarrow>A.\n    \\<Lambda> a:A. \\<Pi> P:A\\<rightarrow>*.P^c \\<rightarrow> (\\<Pi> x:A. P^x\\<rightarrow>P^(f^x)) \\<rightarrow> P^a : ?T\"\n  by (depth_solve rules)\n\nschematic_lemma (in LP2)\n  \"A:* a:A b:A \\<turnstile> ?p: (\\<Pi> P:A\\<rightarrow>*.P^a\\<rightarrow>P^b) \\<rightarrow> (\\<Pi> P:A\\<rightarrow>*.P^b\\<rightarrow>P^a)\"\n  -- \\<open>Symmetry of Leibnitz equality\\<close>\n  apply (strip_asms rules)\n  apply (rule lam_ss)\n    apply (depth_solve1 rules)\n   prefer 2\n   apply (depth_solve1 rules)\n  apply (erule_tac a = \"\\<Lambda> x:A. \\<Pi> Q:A\\<rightarrow>*.Q^x\\<rightarrow>Q^a\" in pi_elim)\n   apply (depth_solve1 rules)\n  apply (unfold beta)\n  apply (erule imp_elim)\n   apply (rule lam_bs)\n     apply (depth_solve1 rules)\n    prefer 2\n    apply (depth_solve1 rules)\n   apply (rule lam_ss)\n     apply (depth_solve1 rules)\n    prefer 2\n    apply (depth_solve1 rules)\n   apply assumption\n  apply assumption\n  done\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/Cube/Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832058771035, "lm_q2_score": 0.6477982315512488, "lm_q1q2_score": 0.34915236760301027}}
{"text": "(*  Title:      HOL/Proofs/Lambda/StrongNorm.thy\n    Author:     Stefan Berghofer\n    Copyright   2000 TU Muenchen\n*)\n\nsection \\<open>Strong normalization for simply-typed lambda calculus\\<close>\n\ntheory StrongNorm imports LambdaType InductTermi begin\n\ntext \\<open>\nFormalization by Stefan Berghofer. Partly based on a paper proof by\nFelix Joachimski and Ralph Matthes @{cite \"Matthes-Joachimski-AML\"}.\n\\<close>\n\n\nsubsection \\<open>Properties of \\<open>IT\\<close>\\<close>\n\nlemma lift_IT [intro!]: \"IT t \\<Longrightarrow> IT (lift t i)\"\n  apply (induct arbitrary: i set: IT)\n    apply (simp (no_asm))\n    apply (rule conjI)\n     apply\n      (rule impI,\n       rule IT.Var,\n       erule listsp.induct,\n       simp (no_asm),\n       simp (no_asm),\n       rule listsp.Cons,\n       blast,\n       assumption)+\n     apply auto\n   done\n\nlemma lifts_IT: \"listsp IT ts \\<Longrightarrow> listsp IT (map (\\<lambda>t. lift t 0) ts)\"\n  by (induct ts) auto\n\nlemma subst_Var_IT: \"IT r \\<Longrightarrow> IT (r[Var i/j])\"\n  apply (induct arbitrary: i j set: IT)\n    txt \\<open>Case \\<^term>\\<open>Var\\<close>:\\<close>\n    apply (simp (no_asm) add: subst_Var)\n    apply\n    ((rule conjI impI)+,\n      rule IT.Var,\n      erule listsp.induct,\n      simp (no_asm),\n      simp (no_asm),\n      rule listsp.Cons,\n      fast,\n      assumption)+\n   txt \\<open>Case \\<^term>\\<open>Lambda\\<close>:\\<close>\n   apply atomize\n   apply simp\n   apply (rule IT.Lambda)\n   apply fast\n  txt \\<open>Case \\<^term>\\<open>Beta\\<close>:\\<close>\n  apply atomize\n  apply (simp (no_asm_use) add: subst_subst [symmetric])\n  apply (rule IT.Beta)\n   apply auto\n  done\n\nlemma Var_IT: \"IT (Var n)\"\n  apply (subgoal_tac \"IT (Var n \\<degree>\\<degree> [])\")\n   apply simp\n  apply (rule IT.Var)\n  apply (rule listsp.Nil)\n  done\n\nlemma app_Var_IT: \"IT t \\<Longrightarrow> IT (t \\<degree> Var i)\"\n  apply (induct set: IT)\n    apply (subst app_last)\n    apply (rule IT.Var)\n    apply simp\n    apply (rule listsp.Cons)\n     apply (rule Var_IT)\n    apply (rule listsp.Nil)\n   apply (rule IT.Beta [where ?ss = \"[]\", unfolded foldl_Nil [THEN eq_reflection]])\n    apply (erule subst_Var_IT)\n   apply (rule Var_IT)\n  apply (subst app_last)\n  apply (rule IT.Beta)\n   apply (subst app_last [symmetric])\n   apply assumption\n  apply assumption\n  done\n\n\nsubsection \\<open>Well-typed substitution preserves termination\\<close>\n\nlemma subst_type_IT:\n  \"\\<And>t e T u i. IT t \\<Longrightarrow> e\\<langle>i:U\\<rangle> \\<turnstile> t : T \\<Longrightarrow>\n    IT u \\<Longrightarrow> e \\<turnstile> u : U \\<Longrightarrow> IT (t[u/i])\"\n  (is \"PROP ?P U\" is \"\\<And>t e T u i. _ \\<Longrightarrow> PROP ?Q t e T u i U\")\nproof (induct U)\n  fix T t\n  assume MI1: \"\\<And>T1 T2. T = T1 \\<Rightarrow> T2 \\<Longrightarrow> PROP ?P T1\"\n  assume MI2: \"\\<And>T1 T2. T = T1 \\<Rightarrow> T2 \\<Longrightarrow> PROP ?P T2\"\n  assume \"IT t\"\n  thus \"\\<And>e T' u i. PROP ?Q t e T' u i T\"\n  proof induct\n    fix e T' u i\n    assume uIT: \"IT u\"\n    assume uT: \"e \\<turnstile> u : T\"\n    {\n      case (Var rs n e1 T'1 u1 i1)\n      assume nT: \"e\\<langle>i:T\\<rangle> \\<turnstile> Var n \\<degree>\\<degree> rs : T'\"\n      let ?ty = \"\\<lambda>t. \\<exists>T'. e\\<langle>i:T\\<rangle> \\<turnstile> t : T'\"\n      let ?R = \"\\<lambda>t. \\<forall>e T' u i.\n        e\\<langle>i:T\\<rangle> \\<turnstile> t : T' \\<longrightarrow> IT u \\<longrightarrow> e \\<turnstile> u : T \\<longrightarrow> IT (t[u/i])\"\n      show \"IT ((Var n \\<degree>\\<degree> rs)[u/i])\"\n      proof (cases \"n = i\")\n        case True\n        show ?thesis\n        proof (cases rs)\n          case Nil\n          with uIT True show ?thesis by simp\n        next\n          case (Cons a as)\n          with nT have \"e\\<langle>i:T\\<rangle> \\<turnstile> Var n \\<degree> a \\<degree>\\<degree> as : T'\" by simp\n          then obtain Ts\n              where headT: \"e\\<langle>i:T\\<rangle> \\<turnstile> Var n \\<degree> a : Ts \\<Rrightarrow> T'\"\n              and argsT: \"e\\<langle>i:T\\<rangle> \\<tturnstile> as : Ts\"\n            by (rule list_app_typeE)\n          from headT obtain T''\n              where varT: \"e\\<langle>i:T\\<rangle> \\<turnstile> Var n : T'' \\<Rightarrow> Ts \\<Rrightarrow> T'\"\n              and argT: \"e\\<langle>i:T\\<rangle> \\<turnstile> a : T''\"\n            by cases simp_all\n          from varT True have T: \"T = T'' \\<Rightarrow> Ts \\<Rrightarrow> T'\"\n            by cases auto\n          with uT have uT': \"e \\<turnstile> u : T'' \\<Rightarrow> Ts \\<Rrightarrow> T'\" by simp\n          from T have \"IT ((Var 0 \\<degree>\\<degree> map (\\<lambda>t. lift t 0)\n            (map (\\<lambda>t. t[u/i]) as))[(u \\<degree> a[u/i])/0])\"\n          proof (rule MI2)\n            from T have \"IT ((lift u 0 \\<degree> Var 0)[a[u/i]/0])\"\n            proof (rule MI1)\n              have \"IT (lift u 0)\" by (rule lift_IT [OF uIT])\n              thus \"IT (lift u 0 \\<degree> Var 0)\" by (rule app_Var_IT)\n              show \"e\\<langle>0:T''\\<rangle> \\<turnstile> lift u 0 \\<degree> Var 0 : Ts \\<Rrightarrow> T'\"\n              proof (rule typing.App)\n                show \"e\\<langle>0:T''\\<rangle> \\<turnstile> lift u 0 : T'' \\<Rightarrow> Ts \\<Rrightarrow> T'\"\n                  by (rule lift_type) (rule uT')\n                show \"e\\<langle>0:T''\\<rangle> \\<turnstile> Var 0 : T''\"\n                  by (rule typing.Var) simp\n              qed\n              from Var have \"?R a\" by cases (simp_all add: Cons)\n              with argT uIT uT show \"IT (a[u/i])\" by simp\n              from argT uT show \"e \\<turnstile> a[u/i] : T''\"\n                by (rule subst_lemma) simp\n            qed\n            thus \"IT (u \\<degree> a[u/i])\" by simp\n            from Var have \"listsp ?R as\"\n              by cases (simp_all add: Cons)\n            moreover from argsT have \"listsp ?ty as\"\n              by (rule lists_typings)\n            ultimately have \"listsp (\\<lambda>t. ?R t \\<and> ?ty t) as\"\n              by simp\n            hence \"listsp IT (map (\\<lambda>t. lift t 0) (map (\\<lambda>t. t[u/i]) as))\"\n              (is \"listsp IT (?ls as)\")\n            proof induct\n              case Nil\n              show ?case by fastforce\n            next\n              case (Cons b bs)\n              hence I: \"?R b\" by simp\n              from Cons obtain U where \"e\\<langle>i:T\\<rangle> \\<turnstile> b : U\" by fast\n              with uT uIT I have \"IT (b[u/i])\" by simp\n              hence \"IT (lift (b[u/i]) 0)\" by (rule lift_IT)\n              hence \"listsp IT (lift (b[u/i]) 0 # ?ls bs)\"\n                by (rule listsp.Cons) (rule Cons)\n              thus ?case by simp\n            qed\n            thus \"IT (Var 0 \\<degree>\\<degree> ?ls as)\" by (rule IT.Var)\n            have \"e\\<langle>0:Ts \\<Rrightarrow> T'\\<rangle> \\<turnstile> Var 0 : Ts \\<Rrightarrow> T'\"\n              by (rule typing.Var) simp\n            moreover from uT argsT have \"e \\<tturnstile> map (\\<lambda>t. t[u/i]) as : Ts\"\n              by (rule substs_lemma)\n            hence \"e\\<langle>0:Ts \\<Rrightarrow> T'\\<rangle> \\<tturnstile> ?ls as : Ts\"\n              by (rule lift_types)\n            ultimately show \"e\\<langle>0:Ts \\<Rrightarrow> T'\\<rangle> \\<turnstile> Var 0 \\<degree>\\<degree> ?ls as : T'\"\n              by (rule list_app_typeI)\n            from argT uT have \"e \\<turnstile> a[u/i] : T''\"\n              by (rule subst_lemma) (rule refl)\n            with uT' show \"e \\<turnstile> u \\<degree> a[u/i] : Ts \\<Rrightarrow> T'\"\n              by (rule typing.App)\n          qed\n          with Cons True show ?thesis\n            by (simp add: comp_def)\n        qed\n      next\n        case False\n        from Var have \"listsp ?R rs\" by simp\n        moreover from nT obtain Ts where \"e\\<langle>i:T\\<rangle> \\<tturnstile> rs : Ts\"\n          by (rule list_app_typeE)\n        hence \"listsp ?ty rs\" by (rule lists_typings)\n        ultimately have \"listsp (\\<lambda>t. ?R t \\<and> ?ty t) rs\"\n          by simp\n        hence \"listsp IT (map (\\<lambda>x. x[u/i]) rs)\"\n        proof induct\n          case Nil\n          show ?case by fastforce\n        next\n          case (Cons a as)\n          hence I: \"?R a\" by simp\n          from Cons obtain U where \"e\\<langle>i:T\\<rangle> \\<turnstile> a : U\" by fast\n          with uT uIT I have \"IT (a[u/i])\" by simp\n          hence \"listsp IT (a[u/i] # map (\\<lambda>t. t[u/i]) as)\"\n            by (rule listsp.Cons) (rule Cons)\n          thus ?case by simp\n        qed\n        with False show ?thesis by (auto simp add: subst_Var)\n      qed\n    next\n      case (Lambda r e1 T'1 u1 i1)\n      assume \"e\\<langle>i:T\\<rangle> \\<turnstile> Abs r : T'\"\n        and \"\\<And>e T' u i. PROP ?Q r e T' u i T\"\n      with uIT uT show \"IT (Abs r[u/i])\"\n        by fastforce\n    next\n      case (Beta r a as e1 T'1 u1 i1)\n      assume T: \"e\\<langle>i:T\\<rangle> \\<turnstile> Abs r \\<degree> a \\<degree>\\<degree> as : T'\"\n      assume SI1: \"\\<And>e T' u i. PROP ?Q (r[a/0] \\<degree>\\<degree> as) e T' u i T\"\n      assume SI2: \"\\<And>e T' u i. PROP ?Q a e T' u i T\"\n      have \"IT (Abs (r[lift u 0/Suc i]) \\<degree> a[u/i] \\<degree>\\<degree> map (\\<lambda>t. t[u/i]) as)\"\n      proof (rule IT.Beta)\n        have \"Abs r \\<degree> a \\<degree>\\<degree> as \\<rightarrow>\\<^sub>\\<beta> r[a/0] \\<degree>\\<degree> as\"\n          by (rule apps_preserves_beta) (rule beta.beta)\n        with T have \"e\\<langle>i:T\\<rangle> \\<turnstile> r[a/0] \\<degree>\\<degree> as : T'\"\n          by (rule subject_reduction)\n        hence \"IT ((r[a/0] \\<degree>\\<degree> as)[u/i])\"\n          using uIT uT by (rule SI1)\n        thus \"IT (r[lift u 0/Suc i][a[u/i]/0] \\<degree>\\<degree> map (\\<lambda>t. t[u/i]) as)\"\n          by (simp del: subst_map add: subst_subst subst_map [symmetric])\n        from T obtain U where \"e\\<langle>i:T\\<rangle> \\<turnstile> Abs r \\<degree> a : U\"\n          by (rule list_app_typeE) fast\n        then obtain T'' where \"e\\<langle>i:T\\<rangle> \\<turnstile> a : T''\" by cases simp_all\n        thus \"IT (a[u/i])\" using uIT uT by (rule SI2)\n      qed\n      thus \"IT ((Abs r \\<degree> a \\<degree>\\<degree> as)[u/i])\" by simp\n    }\n  qed\nqed\n\n\nsubsection \\<open>Well-typed terms are strongly normalizing\\<close>\n\nlemma type_implies_IT:\n  assumes \"e \\<turnstile> t : T\"\n  shows \"IT t\"\n  using assms\nproof induct\n  case Var\n  show ?case by (rule Var_IT)\nnext\n  case Abs\n  show ?case by (rule IT.Lambda) (rule Abs)\nnext\n  case (App e s T U t)\n  have \"IT ((Var 0 \\<degree> lift t 0)[s/0])\"\n  proof (rule subst_type_IT)\n    have \"IT (lift t 0)\" using \\<open>IT t\\<close> by (rule lift_IT)\n    hence \"listsp IT [lift t 0]\" by (rule listsp.Cons) (rule listsp.Nil)\n    hence \"IT (Var 0 \\<degree>\\<degree> [lift t 0])\" by (rule IT.Var)\n    also have \"Var 0 \\<degree>\\<degree> [lift t 0] = Var 0 \\<degree> lift t 0\" by simp\n    finally show \"IT \\<dots>\" .\n    have \"e\\<langle>0:T \\<Rightarrow> U\\<rangle> \\<turnstile> Var 0 : T \\<Rightarrow> U\"\n      by (rule typing.Var) simp\n    moreover have \"e\\<langle>0:T \\<Rightarrow> U\\<rangle> \\<turnstile> lift t 0 : T\"\n      by (rule lift_type) (rule App.hyps)\n    ultimately show \"e\\<langle>0:T \\<Rightarrow> U\\<rangle> \\<turnstile> Var 0 \\<degree> lift t 0 : U\"\n      by (rule typing.App)\n    show \"IT s\" by fact\n    show \"e \\<turnstile> s : T \\<Rightarrow> U\" by fact\n  qed\n  thus ?case by simp\nqed\n\ntheorem type_implies_termi: \"e \\<turnstile> t : T \\<Longrightarrow> termip beta t\"\nproof -\n  assume \"e \\<turnstile> t : T\"\n  hence \"IT t\" by (rule type_implies_IT)\n  thus ?thesis by (rule IT_implies_termi)\nqed\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Proofs/Lambda/StrongNorm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795672, "lm_q2_score": 0.66192288918838, "lm_q1q2_score": 0.3490428766721751}}
{"text": "(*  Title:      HOL/MicroJava/BV/JVMType.thy\n    Author:     Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nsection \\<open>The JVM Type System as Semilattice\\<close>\n\ntheory JVMType\nimports JType\nbegin\n\ntype_synonym locvars_type = \"ty err list\"\ntype_synonym opstack_type = \"ty list\"\ntype_synonym state_type = \"opstack_type \\<times> locvars_type\"\ntype_synonym state = \"state_type option err\"    \\<comment> \\<open>for Kildall\\<close>\ntype_synonym method_type = \"state_type option list\"   \\<comment> \\<open>for BVSpec\\<close>\ntype_synonym class_type = \"sig \\<Rightarrow> method_type\"\ntype_synonym prog_type = \"cname \\<Rightarrow> class_type\"\n\n\ndefinition stk_esl :: \"'c prog \\<Rightarrow> nat \\<Rightarrow> ty list esl\" where\n  \"stk_esl S maxs == upto_esl maxs (JType.esl S)\"\n\ndefinition reg_sl :: \"'c prog \\<Rightarrow> nat \\<Rightarrow> ty err list sl\" where\n  \"reg_sl S maxr == Listn.sl maxr (Err.sl (JType.esl S))\"\n\ndefinition sl :: \"'c prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> state sl\" where\n  \"sl S maxs maxr ==\n  Err.sl(Opt.esl(Product.esl (stk_esl S maxs) (Err.esl(reg_sl S maxr))))\"\n\ndefinition states :: \"'c prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> state set\" where\n  \"states S maxs maxr == fst(sl S maxs maxr)\"\n\ndefinition le :: \"'c prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> state ord\" where\n  \"le S maxs maxr == fst(snd(sl S maxs maxr))\"\n\ndefinition  sup :: \"'c prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> state binop\" where\n  \"sup S maxs maxr == snd(snd(sl S maxs maxr))\"\n\ndefinition sup_ty_opt :: \"['code prog,ty err,ty err] \\<Rightarrow> bool\"\n                 (\"_ \\<turnstile> _ <=o _\" [71,71] 70) where \n  \"sup_ty_opt G == Err.le (subtype G)\"\n\ndefinition sup_loc :: \"['code prog,locvars_type,locvars_type] \\<Rightarrow> bool\" \n              (\"_ \\<turnstile> _ <=l _\"  [71,71] 70) where\n  \"sup_loc G == Listn.le (sup_ty_opt G)\"\n\ndefinition sup_state :: \"['code prog,state_type,state_type] \\<Rightarrow> bool\"   \n               (\"_ \\<turnstile> _ <=s _\"  [71,71] 70) where\n  \"sup_state G == Product.le (Listn.le (subtype G)) (sup_loc G)\"\n\ndefinition sup_state_opt :: \"['code prog,state_type option,state_type option] \\<Rightarrow> bool\" \n                   (\"_ \\<turnstile> _ <='' _\"  [71,71] 70) where\n  \"sup_state_opt G == Opt.le (sup_state G)\"\n\n\nlemma JVM_states_unfold: \n  \"states S maxs maxr == err(opt((\\<Union>{list n (types S) |n. n <= maxs}) \\<times>\n                                  list maxr (err(types S))))\"\n  apply (unfold states_def sl_def Opt.esl_def Err.sl_def\n         stk_esl_def reg_sl_def Product.esl_def\n         Listn.sl_def upto_esl_def JType.esl_def Err.esl_def)\n  by simp\n\n\nlemma JVM_le_unfold:\n \"le S m n == \n  Err.le(Opt.le(Product.le(Listn.le(subtype S))(Listn.le(Err.le(subtype S)))))\" \n  apply (unfold le_def sl_def Opt.esl_def Err.sl_def\n         stk_esl_def reg_sl_def Product.esl_def  \n         Listn.sl_def upto_esl_def JType.esl_def Err.esl_def) \n  by simp\n\nlemma JVM_le_convert:\n  \"le G m n (OK t1) (OK t2) = G \\<turnstile> t1 <=' t2\"\n  by (simp add: JVM_le_unfold Err.le_def lesub_def sup_state_opt_def \n                sup_state_def sup_loc_def sup_ty_opt_def)\n\nlemma JVM_le_Err_conv:\n  \"le G m n = Err.le (sup_state_opt G)\"\n  by (unfold sup_state_opt_def sup_state_def sup_loc_def  \n             sup_ty_opt_def JVM_le_unfold) simp\n\nlemma zip_map [rule_format]:\n  \"\\<forall>a. length a = length b \\<longrightarrow> \n  zip (map f a) (map g b) = map (\\<lambda>(x,y). (f x, g y)) (zip a b)\"\n  apply (induct b) \n   apply simp\n  apply clarsimp\n  apply (case_tac aa)\n  apply simp_all\n  done\n\n\n\nlemma stk_convert:\n  \"Listn.le (subtype G) a b = G \\<turnstile> map OK a <=l map OK b\"\nproof \n  assume \"Listn.le (subtype G) a b\"\n\n  hence le: \"list_all2 (subtype G) a b\"\n    by (unfold Listn.le_def lesub_def)\n  \n  { fix x' y'\n    assume \"length a = length b\"\n           \"(x',y') \\<in> set (zip (map OK a) (map OK b))\"\n    then\n    obtain x y where OK:\n      \"x' = OK x\" \"y' = OK y\" \"(x,y) \\<in> set (zip a b)\"\n      by (auto simp add: zip_map)\n    with le\n    have \"subtype G x y\"\n      by (simp add: list_all2_iff Ball_def)\n    with OK\n    have \"G \\<turnstile> x' <=o y'\"\n      by (simp add: sup_ty_opt_def)\n  }\n  \n  with le\n  show \"G \\<turnstile> map OK a <=l map OK b\"\n    by (unfold sup_loc_def Listn.le_def lesub_def list_all2_iff) auto\nnext\n  assume \"G \\<turnstile> map OK a <=l map OK b\"\n\n  thus \"Listn.le (subtype G) a b\"\n    apply (unfold sup_loc_def list_all2_iff Listn.le_def lesub_def)\n    apply (clarsimp simp add: zip_map)\n    apply (drule bspec, assumption)\n    apply (auto simp add: sup_ty_opt_def subtype_def)\n    done\nqed\n\n\nlemma sup_state_conv:\n  \"(G \\<turnstile> s1 <=s s2) == \n  (G \\<turnstile> map OK (fst s1) <=l map OK (fst s2)) \\<and> (G \\<turnstile> snd s1 <=l snd s2)\"\n  by (auto simp add: sup_state_def stk_convert lesub_def Product.le_def split_beta)\n\n\nlemma subtype_refl [simp]:\n  \"subtype G t t\"\n  by (simp add: subtype_def)\n\ntheorem sup_ty_opt_refl [simp]:\n  \"G \\<turnstile> t <=o t\"\n  by (simp add: sup_ty_opt_def Err.le_def lesub_def split: err.split)\n\nlemma le_list_refl2 [simp]: \n  \"(\\<And>xs. r xs xs) \\<Longrightarrow> Listn.le r xs xs\"\n  by (induct xs, auto simp add: Listn.le_def lesub_def)\n\ntheorem sup_loc_refl [simp]:\n  \"G \\<turnstile> t <=l t\"\n  by (simp add: sup_loc_def)\n\ntheorem sup_state_refl [simp]:\n  \"G \\<turnstile> s <=s s\"\n  by (auto simp add: sup_state_def Product.le_def lesub_def)\n\ntheorem sup_state_opt_refl [simp]:\n  \"G \\<turnstile> s <=' s\"\n  by (simp add: sup_state_opt_def Opt.le_def lesub_def split: option.split)\n  \n\ntheorem anyConvErr [simp]:\n  \"(G \\<turnstile> Err <=o any) = (any = Err)\"\n  by (simp add: sup_ty_opt_def Err.le_def split: err.split)\n\ntheorem OKanyConvOK [simp]:\n  \"(G \\<turnstile> (OK ty') <=o (OK ty)) = (G \\<turnstile> ty' \\<preceq> ty)\"\n  by (simp add: sup_ty_opt_def Err.le_def lesub_def subtype_def)\n\ntheorem sup_ty_opt_OK:\n  \"G \\<turnstile> a <=o (OK b) \\<Longrightarrow> \\<exists> x. a = OK x\"\n  by (clarsimp simp add: sup_ty_opt_def Err.le_def split: err.splits)\n\nlemma widen_PrimT_conv1 [simp]:\n  \"\\<lbrakk> G \\<turnstile> S \\<preceq> T; S = PrimT x\\<rbrakk> \\<Longrightarrow> T = PrimT x\"\n  by (auto elim: widen.cases)\n\ntheorem sup_PTS_eq:\n  \"(G \\<turnstile> OK (PrimT p) <=o X) = (X=Err \\<or> X = OK (PrimT p))\"\n  by (auto simp add: sup_ty_opt_def Err.le_def lesub_def subtype_def \n              split: err.splits)\n\ntheorem sup_loc_Nil [iff]:\n  \"(G \\<turnstile> [] <=l XT) = (XT=[])\"\n  by (simp add: sup_loc_def Listn.le_def)\n\ntheorem sup_loc_Cons [iff]:\n  \"(G \\<turnstile> (Y#YT) <=l XT) = (\\<exists>X XT'. XT=X#XT' \\<and> (G \\<turnstile> Y <=o X) \\<and> (G \\<turnstile> YT <=l XT'))\"\n  by (simp add: sup_loc_def Listn.le_def lesub_def list_all2_Cons1)\n\ntheorem sup_loc_Cons2:\n  \"(G \\<turnstile> YT <=l (X#XT)) = (\\<exists>Y YT'. YT=Y#YT' \\<and> (G \\<turnstile> Y <=o X) \\<and> (G \\<turnstile> YT' <=l XT))\"\n  by (simp add: sup_loc_def Listn.le_def lesub_def list_all2_Cons2)\n\nlemma sup_state_Cons:\n  \"(G \\<turnstile> (x#xt, a) <=s (y#yt, b)) = \n   ((G \\<turnstile> x \\<preceq> y) \\<and> (G \\<turnstile> (xt,a) <=s (yt,b)))\"\n  by (auto simp add: sup_state_def stk_convert lesub_def Product.le_def)\n\n\ntheorem sup_loc_length:\n  \"G \\<turnstile> a <=l b \\<Longrightarrow> length a = length b\"\nproof -\n  assume G: \"G \\<turnstile> a <=l b\"\n  have \"\\<forall>b. (G \\<turnstile> a <=l b) \\<longrightarrow> length a = length b\"\n    by (induct a, auto)\n  with G\n  show ?thesis by blast\nqed\n\ntheorem sup_loc_nth:\n  \"\\<lbrakk> G \\<turnstile> a <=l b; n < length a \\<rbrakk> \\<Longrightarrow> G \\<turnstile> (a!n) <=o (b!n)\"\nproof -\n  assume a: \"G \\<turnstile> a <=l b\" \"n < length a\"\n  have \"\\<forall> n b. (G \\<turnstile> a <=l b) \\<longrightarrow> n < length a \\<longrightarrow> (G \\<turnstile> (a!n) <=o (b!n))\"\n    (is \"?P a\")\n  proof (induct a)\n    show \"?P []\" by simp\n    \n    fix x xs assume IH: \"?P xs\"\n\n    show \"?P (x#xs)\"\n    proof (intro strip)\n      fix n b\n      assume \"G \\<turnstile> (x # xs) <=l b\" \"n < length (x # xs)\"\n      with IH\n      show \"G \\<turnstile> ((x # xs) ! n) <=o (b ! n)\"\n        by (cases n) auto\n    qed\n  qed\n  with a\n  show ?thesis by blast\nqed\n\ntheorem all_nth_sup_loc:\n  \"\\<forall>b. length a = length b \\<longrightarrow> (\\<forall> n. n < length a \\<longrightarrow> (G \\<turnstile> (a!n) <=o (b!n))) \n  \\<longrightarrow> (G \\<turnstile> a <=l b)\" (is \"?P a\")\nproof (induct a)\n  show \"?P []\" by simp\n\n  fix l ls assume IH: \"?P ls\"\n  \n  show \"?P (l#ls)\"\n  proof (intro strip)\n    fix b\n    assume f: \"\\<forall>n. n < length (l # ls) \\<longrightarrow> (G \\<turnstile> ((l # ls) ! n) <=o (b ! n))\"\n    assume l: \"length (l#ls) = length b\"\n    \n    then obtain b' bs where b: \"b = b'#bs\"\n      by (cases b) (simp, simp add: neq_Nil_conv)\n\n    with f\n    have \"\\<forall>n. n < length ls \\<longrightarrow> (G \\<turnstile> (ls!n) <=o (bs!n))\"\n      by auto\n\n    with f b l IH\n    show \"G \\<turnstile> (l # ls) <=l b\"\n      by auto\n  qed\nqed\n\n\ntheorem sup_loc_append:\n  \"length a = length b \\<Longrightarrow> \n   (G \\<turnstile> (a@x) <=l (b@y)) = ((G \\<turnstile> a <=l b) \\<and> (G \\<turnstile> x <=l y))\"\nproof -\n  assume l: \"length a = length b\"\n\n  have \"\\<forall>b. length a = length b \\<longrightarrow> (G \\<turnstile> (a@x) <=l (b@y)) = ((G \\<turnstile> a <=l b) \\<and> \n            (G \\<turnstile> x <=l y))\" (is \"?P a\") \n  proof (induct a)\n    show \"?P []\" by simp\n    \n    fix l ls assume IH: \"?P ls\"    \n    show \"?P (l#ls)\" \n    proof (intro strip)\n      fix b\n      assume \"length (l#ls) = length (b::ty err list)\"\n      with IH\n      show \"(G \\<turnstile> ((l#ls)@x) <=l (b@y)) = ((G \\<turnstile> (l#ls) <=l b) \\<and> (G \\<turnstile> x <=l y))\"\n        by (cases b) auto\n    qed\n  qed\n  with l\n  show ?thesis by blast\nqed\n\ntheorem sup_loc_rev [simp]:\n  \"(G \\<turnstile> (rev a) <=l rev b) = (G \\<turnstile> a <=l b)\"\nproof -\n  have \"\\<forall>b. (G \\<turnstile> (rev a) <=l rev b) = (G \\<turnstile> a <=l b)\" (is \"\\<forall>b. ?Q a b\" is \"?P a\")\n  proof (induct a)\n    show \"?P []\" by simp\n\n    fix l ls assume IH: \"?P ls\"\n\n    { \n      fix b\n      have \"?Q (l#ls) b\"\n      proof (cases b)\n        case Nil\n        thus ?thesis by (auto dest: sup_loc_length)\n      next\n        case (Cons a list)\n        show ?thesis\n        proof\n          assume \"G \\<turnstile> (l # ls) <=l b\"\n          thus \"G \\<turnstile> rev (l # ls) <=l rev b\"\n            by (clarsimp simp add: Cons IH sup_loc_length sup_loc_append)\n        next\n          assume \"G \\<turnstile> rev (l # ls) <=l rev b\"\n          hence G: \"G \\<turnstile> (rev ls @ [l]) <=l (rev list @ [a])\"\n            by (simp add: Cons)          \n          \n          hence \"length (rev ls) = length (rev list)\"\n            by (auto dest: sup_loc_length)\n\n          from this G\n          obtain \"G \\<turnstile> rev ls <=l rev list\" \"G \\<turnstile> l <=o a\"\n            by (simp add: sup_loc_append)\n\n          thus \"G \\<turnstile> (l # ls) <=l b\"\n            by (simp add: Cons IH)\n        qed\n      qed    \n    }\n    thus \"?P (l#ls)\" by blast\n  qed\n\n  thus ?thesis by blast\nqed\n\n\ntheorem sup_loc_update [rule_format]:\n  \"\\<forall> n y. (G \\<turnstile> a <=o b) \\<longrightarrow> n < length y \\<longrightarrow> (G \\<turnstile> x <=l y) \\<longrightarrow> \n          (G \\<turnstile> x[n := a] <=l y[n := b])\" (is \"?P x\")\nproof (induct x)\n  show \"?P []\" by simp\n\n  fix l ls assume IH: \"?P ls\"\n  show \"?P (l#ls)\"\n  proof (intro strip)\n    fix n y\n    assume \"G \\<turnstile>a <=o b\" \"G \\<turnstile> (l # ls) <=l y\" \"n < length y\"\n    with IH\n    show \"G \\<turnstile> (l # ls)[n := a] <=l y[n := b]\"\n      by (cases n) (auto simp add: sup_loc_Cons2 list_all2_Cons1)\n  qed\nqed\n\n\ntheorem sup_state_length [simp]:\n  \"G \\<turnstile> s2 <=s s1 \\<Longrightarrow> \n   length (fst s2) = length (fst s1) \\<and> length (snd s2) = length (snd s1)\"\n  by (auto dest: sup_loc_length simp add: sup_state_def stk_convert lesub_def Product.le_def)\n\ntheorem sup_state_append_snd:\n  \"length a = length b \\<Longrightarrow> \n  (G \\<turnstile> (i,a@x) <=s (j,b@y)) = ((G \\<turnstile> (i,a) <=s (j,b)) \\<and> (G \\<turnstile> (i,x) <=s (j,y)))\"\n  by (auto simp add: sup_state_def stk_convert lesub_def Product.le_def sup_loc_append)\n\ntheorem sup_state_append_fst:\n  \"length a = length b \\<Longrightarrow> \n  (G \\<turnstile> (a@x,i) <=s (b@y,j)) = ((G \\<turnstile> (a,i) <=s (b,j)) \\<and> (G \\<turnstile> (x,i) <=s (y,j)))\"\n  by (auto simp add: sup_state_def stk_convert lesub_def Product.le_def sup_loc_append)\n\ntheorem sup_state_Cons1:\n  \"(G \\<turnstile> (x#xt, a) <=s (yt, b)) = \n   (\\<exists>y yt'. yt=y#yt' \\<and> (G \\<turnstile> x \\<preceq> y) \\<and> (G \\<turnstile> (xt,a) <=s (yt',b)))\"\n  by (auto simp add: sup_state_def stk_convert lesub_def Product.le_def)\n\ntheorem sup_state_Cons2:\n  \"(G \\<turnstile> (xt, a) <=s (y#yt, b)) = \n   (\\<exists>x xt'. xt=x#xt' \\<and> (G \\<turnstile> x \\<preceq> y) \\<and> (G \\<turnstile> (xt',a) <=s (yt,b)))\"\n  by (auto simp add: sup_state_def stk_convert lesub_def Product.le_def sup_loc_Cons2)\n\ntheorem sup_state_ignore_fst:  \n  \"G \\<turnstile> (a, x) <=s (b, y) \\<Longrightarrow> G \\<turnstile> (c, x) <=s (c, y)\"\n  by (simp add: sup_state_def lesub_def Product.le_def)\n\ntheorem sup_state_rev_fst:\n  \"(G \\<turnstile> (rev a, x) <=s (rev b, y)) = (G \\<turnstile> (a, x) <=s (b, y))\"\nproof -\n  have m: \"\\<And>f x. map f (rev x) = rev (map f x)\" by (simp add: rev_map)\n  show ?thesis by (simp add: m sup_state_def stk_convert lesub_def Product.le_def)\nqed\n  \n\nlemma sup_state_opt_None_any [iff]:\n  \"(G \\<turnstile> None <=' any) = True\"\n  by (simp add: sup_state_opt_def Opt.le_def split: option.split)\n\nlemma sup_state_opt_any_None [iff]:\n  \"(G \\<turnstile> any <=' None) = (any = None)\"\n  by (simp add: sup_state_opt_def Opt.le_def split: option.split)\n\nlemma sup_state_opt_Some_Some [iff]:\n  \"(G \\<turnstile> (Some a) <=' (Some b)) = (G \\<turnstile> a <=s b)\"\n  by (simp add: sup_state_opt_def Opt.le_def lesub_def del: split_paired_Ex)\n\nlemma sup_state_opt_any_Some [iff]:\n  \"(G \\<turnstile> (Some a) <=' any) = (\\<exists>b. any = Some b \\<and> G \\<turnstile> a <=s b)\"\n  by (simp add: sup_state_opt_def Opt.le_def lesub_def split: option.split)\n\nlemma sup_state_opt_Some_any:\n  \"(G \\<turnstile> any <=' (Some b)) = (any = None \\<or> (\\<exists>a. any = Some a \\<and> G \\<turnstile> a <=s b))\"\n  by (simp add: sup_state_opt_def Opt.le_def lesub_def split: option.split)\n\n\ntheorem sup_ty_opt_trans [trans]:\n  \"\\<lbrakk>G \\<turnstile> a <=o b; G \\<turnstile> b <=o c\\<rbrakk> \\<Longrightarrow> G \\<turnstile> a <=o c\"\n  by (auto intro: widen_trans \n           simp add: sup_ty_opt_def Err.le_def lesub_def subtype_def \n           split: err.splits)\n\ntheorem sup_loc_trans [trans]:\n  \"\\<lbrakk>G \\<turnstile> a <=l b; G \\<turnstile> b <=l c\\<rbrakk> \\<Longrightarrow> G \\<turnstile> a <=l c\"\nproof -\n  assume G: \"G \\<turnstile> a <=l b\" \"G \\<turnstile> b <=l c\"\n \n  hence \"\\<forall> n. n < length a \\<longrightarrow> (G \\<turnstile> (a!n) <=o (c!n))\"\n  proof (intro strip)\n    fix n \n    assume n: \"n < length a\"\n    with G(1)\n    have \"G \\<turnstile> (a!n) <=o (b!n)\"\n      by (rule sup_loc_nth)\n    also \n    from n G\n    have \"G \\<turnstile> \\<dots> <=o (c!n)\"\n      by - (rule sup_loc_nth, auto dest: sup_loc_length)\n    finally\n    show \"G \\<turnstile> (a!n) <=o (c!n)\" .\n  qed\n\n  with G\n  show ?thesis \n    by (auto intro!: all_nth_sup_loc [rule_format] dest!: sup_loc_length) \nqed\n  \n\ntheorem sup_state_trans [trans]:\n  \"\\<lbrakk>G \\<turnstile> a <=s b; G \\<turnstile> b <=s c\\<rbrakk> \\<Longrightarrow> G \\<turnstile> a <=s c\"\n  by (auto intro: sup_loc_trans simp add: sup_state_def stk_convert Product.le_def lesub_def)\n\ntheorem sup_state_opt_trans [trans]:\n  \"\\<lbrakk>G \\<turnstile> a <=' b; G \\<turnstile> b <=' c\\<rbrakk> \\<Longrightarrow> G \\<turnstile> a <=' c\"\n  by (auto intro: sup_state_trans \n           simp add: sup_state_opt_def Opt.le_def lesub_def \n           split: option.splits)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/MicroJava/BV/JVMType.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6926419704455589, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3490265628749381}}
{"text": "section \\<open>Model Semantics\\<close>\n\n(*\n  Author: Frederik Lyhne Andersen, DTU Compute, 2023\n*)\n\ntheory ModelSemantics imports DatalogBase\nbegin\n\nsubsection \\<open>Definitions\\<close>\n\ndefinition solve_m :: \\<open>rule set \\<Rightarrow> atom set\\<close> (\\<open>\\<bbbM>\\<lparr>_\\<rparr>\\<close>) where\n  \\<open>\\<bbbM>\\<lparr>p\\<rparr> \\<equiv> \\<Inter>{m. m \\<Turnstile>\\<^sub>p p}\\<close>\n\ndefinition solve_m_herbrand :: \\<open>rule set \\<Rightarrow> (nat \\<Rightarrow> nat) \\<Rightarrow> atom set\\<close> (\\<open>\\<bbbM>\\<^sub>\\<bool>\\<lparr>_\\<rparr>\\<^bsub>_\\<^esub>\\<close>) where\n  \\<open>\\<bbbM>\\<^sub>\\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub> \\<equiv> \\<Inter>{m. m \\<subseteq> \\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub> \\<and> m \\<Turnstile>\\<^sub>p p}\\<close>\n\n\nsubsection \\<open>Proofs\\<close>\n\ntheorem finite_solve_m:\n    \\<open>wf_p p ar \\<Longrightarrow> \n     safe_p p \\<Longrightarrow> \n     finite \\<bbbM>\\<lparr>p\\<rparr>\\<close>\nproof -\n  assume a1: \\<open>wf_p p ar\\<close>\n  assume a2: \\<open>safe_p p\\<close>\n  then have \\<open>\\<exists>m. m \\<Turnstile>\\<^sub>p p \\<and> finite m\\<close>\n    using a1 safe_wf_p_finite\n    by simp\n  then have \\<open>finite (\\<Inter> {m. m \\<Turnstile>\\<^sub>p p})\\<close>\n    using finite_Inter\n    by auto\n  then show \\<open>finite \\<bbbM>\\<lparr>p\\<rparr>\\<close> \n    using solve_m_def\n    by simp\nqed\n\ntheorem solve_m_subset_herbrand:\n    \\<open>wf_p p ar \\<Longrightarrow> \n     safe_p p \\<Longrightarrow> \n     \\<bbbM>\\<lparr>p\\<rparr> \\<subseteq> \\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub>\\<close>\n  unfolding solve_m_def\n  using Inter_lower herbrand_sat_prog \n  by auto\n\ntheorem solve_m_wf_interp:\n    \\<open>wf_p p ar \\<Longrightarrow> \n     safe_p p \\<Longrightarrow> \n     wf_i \\<bbbM>\\<lparr>p\\<rparr> ar\\<close>\nproof -\n  assume a1: \\<open>wf_p p ar\\<close>\n  assume a2: \\<open>safe_p p\\<close>\n  have a3: \\<open>wf_i \\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub> ar\\<close>\n    using a1 herbrand_wf_i\n    by simp\n  have \\<open>\\<bbbM>\\<lparr>p\\<rparr> \\<subseteq> \\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub>\\<close>\n    using a1 a2 solve_m_subset_herbrand\n    by simp\n  then have \\<open>finite \\<bbbM>\\<lparr>p\\<rparr> \\<and> (\\<forall>a\\<in>\\<bbbM>\\<lparr>p\\<rparr>. ground_a a \\<and> wf_a a ar)\\<close>\n    using wf_i_def a3 finite_subset\n    by blast\n  then show \\<open>wf_i \\<bbbM>\\<lparr>p\\<rparr> ar\\<close>\n    using wf_i_def\n    by simp\nqed\n\nlemma adom_eval_herbrand:\n    \\<open>wf_p p ar \\<Longrightarrow> \n     safe_p p \\<Longrightarrow> \n     adom \\<bbbM>\\<lparr>p\\<rparr> \\<subseteq> adom \\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub>\\<close>\n  using adom_subset solve_m_subset_herbrand \n  by auto\n\nlemma adom_eval_prog:\n    \\<open>wf_p p ar \\<Longrightarrow> \n     safe_p p \\<Longrightarrow>\n     adom \\<bbbM>\\<lparr>p\\<rparr> \\<subseteq> adom_p p\\<close>\n  using adom_eval_herbrand adom_herbrand_adom_p\n  by blast\n\nlemma solve_m_sat_rule:\n    \\<open>r \\<in> p \\<Longrightarrow> \n     \\<bbbM>\\<lparr>p\\<rparr> \\<Turnstile>\\<^sub>r r\\<close>\nproof (induct r)\n  case (Rule h b)\n  then show ?case \n  proof -\n    assume \\<open>Rule h b \\<in> p\\<close>\n    then have \\<open>\\<forall>x. (\\<forall>r \\<in> p. x \\<Turnstile>\\<^sub>r r) \\<longrightarrow> \n              (\\<forall>v. (\\<forall>a\\<in>set b. \\<lbrakk>a\\<rbrakk>\\<^sub>av \\<in> x) \\<longrightarrow> \\<lbrakk>h\\<rbrakk>\\<^sub>av \\<in> x)\\<close> \n      by auto\n    then have \\<open>\\<forall>x v. (\\<forall>a\\<in>set b. (\\<forall>r \\<in> p. x \\<Turnstile>\\<^sub>r r) \\<longrightarrow> \\<lbrakk>a\\<rbrakk>\\<^sub>av \\<in> x) \\<longrightarrow> \n                     (\\<forall>r \\<in> p. x \\<Turnstile>\\<^sub>r r) \\<longrightarrow> \\<lbrakk>h\\<rbrakk>\\<^sub>av \\<in> x\\<close> \n      by simp\n    then have \\<open>\\<forall>v. (\\<forall>a\\<in>set b. \\<lbrakk>a\\<rbrakk>\\<^sub>av \\<in> \\<Inter> {m. \\<forall>r \\<in> p. m \\<Turnstile>\\<^sub>r r}) \\<longrightarrow> \n                   \\<lbrakk>h\\<rbrakk>\\<^sub>av \\<in> \\<Inter> {m. \\<forall>r \\<in> p. m \\<Turnstile>\\<^sub>r r}\\<close> \n      by simp\n    then have \\<open>\\<Inter> {m. \\<forall>r \\<in> p. m \\<Turnstile>\\<^sub>r r} \\<Turnstile>\\<^sub>r Rule h b\\<close> \n      by simp\n    then show \\<open>\\<bbbM>\\<lparr>p\\<rparr> \\<Turnstile>\\<^sub>r Rule h b\\<close>\n      using solve_m_def sat_prog_def \n      by auto\n  qed\nqed\n\ntheorem solve_m_sat_prog:\n    \\<open>\\<bbbM>\\<lparr>p\\<rparr> \\<Turnstile>\\<^sub>p p\\<close>\n  unfolding sat_prog_def\n  using solve_m_sat_rule \n  by simp\n\ntheorem solve_m_herbrand_equiv:\n    \\<open>wf_p p ar \\<Longrightarrow> \n     safe_p p \\<Longrightarrow> \n     \\<bbbM>\\<lparr>p\\<rparr> = \\<bbbM>\\<^sub>\\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub>\\<close>\nproof\n  show \\<open>\\<bbbM>\\<lparr>p\\<rparr> \\<subseteq> \\<bbbM>\\<^sub>\\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub>\\<close>\n    unfolding solve_m_herbrand_def solve_m_def\n    by auto\nnext\n  assume a1: \\<open>wf_p p ar\\<close>\n  assume a2: \\<open>safe_p p\\<close>\n  have \\<open>\\<bbbM>\\<lparr>p\\<rparr> \\<subseteq> \\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub>\\<close>\n    using a1 a2 solve_m_subset_herbrand\n    by simp\n  then show \\<open>\\<bbbM>\\<^sub>\\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub> \\<subseteq> \\<bbbM>\\<lparr>p\\<rparr>\\<close> \n    using solve_m_sat_prog solve_m_herbrand_def\n    by auto\nqed\n\nlemma solve_m_no_sub:\n    \\<open>\\<not> (\\<exists>m\\<subset>\\<bbbM>\\<lparr>p\\<rparr>. m \\<Turnstile>\\<^sub>p p)\\<close>\n  unfolding solve_m_def\n  by auto\n\ntheorem solve_m_mini:\n    \\<open>\\<bbbM>\\<lparr>p\\<rparr> \\<Turnstile>\\<^sub>m\\<^sub>i\\<^sub>n p\\<close>\n  unfolding min_model_def\n  using solve_m_no_sub solve_m_sat_prog\n  by simp\n\ntheorem solve_m_mini_unique:\n    \\<open>min p = \\<bbbM>\\<lparr>p\\<rparr>\\<close>\n  unfolding min_def\nproof (rule the_equality) \n  show \\<open>\\<bbbM>\\<lparr>p\\<rparr> \\<Turnstile>\\<^sub>m\\<^sub>i\\<^sub>n p\\<close> \n    using solve_m_mini\n    by simp\nnext \n  fix i                           \n  assume a1: \\<open>i \\<Turnstile>\\<^sub>m\\<^sub>i\\<^sub>n p\\<close>\n  then have \\<open>i \\<Turnstile>\\<^sub>p p\\<close> \n    using min_model_def\n    by simp\n  then have \\<open>\\<bbbM>\\<lparr>p\\<rparr> \\<subseteq> i\\<close> \n    using solve_m_def \n    by auto\n  then have \\<open>i = \\<bbbM>\\<lparr>p\\<rparr>\\<close> \n    using a1 min_model_def solve_m_sat_prog \n    by blast\n  then show \\<open>i \\<Turnstile>\\<^sub>m\\<^sub>i\\<^sub>n p \\<Longrightarrow> i = \\<bbbM>\\<lparr>p\\<rparr>\\<close> \n    by auto\nqed\n\ntheorem unique_minimal_model:\n    \\<open>min p \\<Turnstile>\\<^sub>m\\<^sub>i\\<^sub>n p\\<close>\n  using solve_m_mini solve_m_mini_unique\n  by simp\n\nlemma program_subset_model:\n    \\<open>p1 \\<subseteq> p2 \\<Longrightarrow> \n     \\<bbbM>\\<lparr>p1\\<rparr> \\<subseteq> \\<bbbM>\\<lparr>p2\\<rparr>\\<close>\n  unfolding solve_m_def sat_prog_def\n  by auto\n\nlemma program_subset_sat:\n    \\<open>p1 \\<subseteq> p2 \\<Longrightarrow> \n     \\<bbbM>\\<lparr>p2\\<rparr> \\<Turnstile>\\<^sub>p p1\\<close>\n  unfolding sat_prog_def\n  using solve_m_sat_rule \n  by auto\n\nlemma fact_in_model:\n    \\<open>safe_p p \\<Longrightarrow> \n     Rule h [] \\<in> p \\<Longrightarrow> \n     h \\<in> \\<bbbM>\\<lparr>p\\<rparr>\\<close>\n  using solve_m_sat_prog fact_in_interp\n  by simp\n\nlemma syms_solve_m_subset_herbrand_syms:\n    \\<open>wf_p p ar \\<Longrightarrow> \n     safe_p p \\<Longrightarrow> \n     syms \\<bbbM>\\<lparr>p\\<rparr> \\<subseteq> syms \\<bool>\\<lparr>p\\<rparr>\\<^bsub>ar\\<^esub>\\<close>\n  unfolding syms_def\n  using solve_m_subset_herbrand image_mono\n  by auto\n  \ntheorem syms_solve_m_subset_prog_syms:\n    \\<open>wf_p p ar \\<Longrightarrow> \n     safe_p p \\<Longrightarrow> \n     syms \\<bbbM>\\<lparr>p\\<rparr> \\<subseteq> syms_p p\\<close>\n  using syms_solve_m_subset_herbrand_syms syms_herbrand_in_prog_syms \n  by blast\n\nend", "meta": {"author": "FreddyLA", "repo": "DatalogInIsabelle", "sha": "master", "save_path": "github-repos/isabelle/FreddyLA-DatalogInIsabelle", "path": "github-repos/isabelle/FreddyLA-DatalogInIsabelle/DatalogInIsabelle-main/ModelSemantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.3490149188820786}}
{"text": "section \\<open> Failures Divergences Semantics \\<close>\n\ntheory ITree_FDSem\n  imports ITree_CSP\nbegin\n\nsubsection \\<open> Preliminaries \\<close>\n\ndatatype ('e, 's) event = Ev (of_Ev: 'e) | Term 's\n\nabbreviation \"\\<Sigma> \\<equiv> range Ev\"\n\nadhoc_overloading\n  tick Term\n\ntype_synonym ('e, 's) trace = \"('e, 's) event list\"\ntype_synonym ('e, 's) refusal = \"('e, 's) event set\"\n\nlemma map_Ev_eq_iff [simp]: \"map Ev xs = map Ev ys \\<longleftrightarrow> xs = ys\"\n  by (metis event.inject(1) list.inj_map_strong)\n\nlemma of_Ev_Ev [simp]: \"(of_Ev \\<circ> Ev) = id\"\n  by (auto)\n\nlemma map_Ev_of_Ev [simp]: \"set tr \\<subseteq> range Ev \\<Longrightarrow> map (Ev \\<circ> of_Ev) tr = tr\"\n  by (metis (mono_tags, lifting) comp_def event.collapse(1) event.disc(1) map_idI rangeE subset_code(1))\n\nlemma trace_EvE [elim]: \"\\<lbrakk> set tr \\<subseteq> range Ev; \\<And> tr'. tr = map Ev tr' \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> P\"\n  by (metis map_Ev_of_Ev map_map)\n\nlemma map_of_Ev_append [simp]: \"set tr \\<subseteq> range Ev \\<Longrightarrow> map of_Ev tr = tr\\<^sub>1 @ tr\\<^sub>2 \\<longleftrightarrow> tr = (map Ev tr\\<^sub>1 @ map Ev tr\\<^sub>2)\"\n  by (auto)\n\nlemma trace_last_Ev [simp]: \"s @ [a] = map Ev tr \\<longleftrightarrow> (tr \\<noteq> [] \\<and> s = map Ev (butlast tr) \\<and> a = Ev (last tr))\"\n  by (auto simp add: snoc_eq_iff_butlast map_butlast last_map)\n\nlemma Ev_subset_image [simp]: \"(Ev ` A) \\<subseteq> (Ev ` B) \\<longleftrightarrow> A \\<subseteq> B\"\n  by auto\n\nlemma Ev_in_Ev_image [simp]: \"Ev x \\<in> Ev ` A \\<longleftrightarrow> x \\<in> A\"\n  by auto\n\ntext \\<open> Roscoe's multi-step transition relation including termination events. We chose to have a\n  process become @{const deadlock} after terminating. \\<close>\n\ndefinition mstep_to :: \"('e, 's) itree \\<Rightarrow> ('e, 's) trace \\<Rightarrow> ('e, 's) itree \\<Rightarrow> bool\" (\"_ \\<Midarrow>_\\<Rightarrow> _\" [55, 0, 55] 55)\n  where \"P \\<Midarrow>tr\\<Rightarrow> P' \\<equiv> ((set tr \\<subseteq> range Ev \\<and> P \\<midarrow>map of_Ev tr\\<leadsto> P') \\<or> \n                        (\\<exists> tr' x. tr = (map Ev tr') @ [\\<checkmark>(x)] \\<and> P \\<midarrow>tr'\\<leadsto> Ret x \\<and> P' = deadlock))\"\n\nlemma mstep_termE [elim]: \n  \"\\<lbrakk> P \\<Midarrow>tr @ [\\<checkmark>(v)]\\<Rightarrow> P'; \\<And> tr'. \\<lbrakk> tr = map Ev tr'; P \\<midarrow>tr'\\<leadsto> Ret v; P' = deadlock \\<rbrakk> \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\n  by (auto simp add: mstep_to_def)\n\nlemma mstep_stabilises: \"\\<lbrakk> P \\<Midarrow>tr\\<Rightarrow> P'; tr \\<noteq> [] \\<rbrakk> \\<Longrightarrow> stabilises P\"\n  apply (auto simp add: mstep_to_def stabilises_traceI)\n  apply (meson stabilises_traceI)\n  apply (metis diverge_no_Ret_trans diverges_then_diverge)\n  done\n\ndefinition initials :: \"('e, 's) itree \\<Rightarrow> ('e, 's) event set\" (\"\\<I>\") where\n\"\\<I>(P) = {e. \\<exists> P'. P \\<Midarrow>[e]\\<Rightarrow> P'}\"\n\nlemma initials_Vis: \"\\<I>(Vis F) = Ev ` pdom F\"\n  by (auto simp add: initials_def mstep_to_def)\n\nlemma initials_Ret: \"\\<I>(Ret x) = {\\<checkmark> x}\"\n  by (auto simp add: initials_def mstep_to_def)\n\nlemma initials_Sil: \"\\<I>(Sil P) = \\<I>(P)\"\n  apply (auto simp add: initials_def mstep_to_def)\n  apply (metis itree.distinct(5) trace_of_Sils trace_to_SilE trace_to_single_iff)\n  apply blast\n  done\n\nsubsection \\<open> Traces \\<close>\n\ndefinition traces :: \"('e, 's) itree \\<Rightarrow> ('e, 's) trace set\" where\n\"traces P = {map Ev tr | tr. \\<exists> P'. P \\<midarrow>tr\\<leadsto> P'} \\<union> {map Ev tr @ [\\<checkmark>(v)] | tr v. P \\<midarrow>tr\\<leadsto> Ret v}\"\n\nlemma wbisim_eq_traces: \"P \\<approx> Q \\<Longrightarrow> traces(P) = traces(Q)\"\n  apply (auto simp add: traces_def)\n  apply (metis wbisim_step)\n  apply (metis (no_types, opaque_lifting) wbisim_step_terminate)\n  apply (metis (no_types, lifting) wbisim_step wbisim_sym)\n  apply (metis (mono_tags, lifting) wbisim_step_terminate wbisim_sym)\n  done\n\nlemma trace_alt_def: \"traces P = {s. \\<exists> Q. P \\<Midarrow>s\\<Rightarrow> Q}\"\n  by (auto simp add: traces_def mstep_to_def)\n\ndefinition straces :: \"('e, 's) htree \\<Rightarrow> ('s \\<Rightarrow> ('e, 's) trace set)\" (\"traces\\<^sub>s\") where\n\"straces K = (\\<lambda> s. traces (K s))\"\n\nlemma Nil_in_traces [simp]: \"[] \\<in> traces P\"\n  by (auto simp add: traces_def)\n\nlemma traces_prefix_in_Ev: \"tr @ [\\<checkmark>(v)] \\<in> traces(P) \\<Longrightarrow> set tr \\<subseteq> range Ev\"\n  by (auto simp add: traces_def)\n\nlemma term_trace_iff [simp]: \"tr @ [\\<checkmark>(v)] \\<in> traces(P) \\<longleftrightarrow> (set tr \\<subseteq> range Ev \\<and> P \\<midarrow>map of_Ev tr\\<leadsto> Ret v)\"\n  by (auto simp add: traces_def map_idI)\n\nlemma in_tracesI1:\n  assumes \"P \\<midarrow>tr\\<leadsto> P'\" \"t = map Ev tr\"\n  shows \"t \\<in> traces(P)\"\n  using assms traces_def by fastforce\n\nlemma in_tracesE [elim]:\n  assumes\n  \"tr \\<in> traces P\"\n  \"\\<And> P' tr'. \\<lbrakk> tr = map Ev tr'; P \\<midarrow>tr'\\<leadsto> P' \\<rbrakk> \\<Longrightarrow> R\"\n  \"\\<And> P' tr' v. \\<lbrakk> tr = map Ev tr' @ [\\<checkmark>(v)]; P \\<midarrow>tr'\\<leadsto> Ret v \\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  using assms by (auto simp add: traces_def)\n\nlemma not_in_traces [simp]: \"set tr \\<subseteq> range Ev \\<Longrightarrow> tr \\<notin> traces(P) \\<longleftrightarrow> \\<not> (\\<exists> P'. P \\<midarrow>map of_Ev tr\\<leadsto> P')\"\n  by (simp add: traces_def, auto)\n\nlemma traces_single_Term: \"[\\<checkmark> s] \\<in> traces(P) \\<Longrightarrow> \\<exists> n. P = Sils n (Ret s)\"\n  by (auto simp add: traces_def)\n\nlemma traces_Ret: \"traces (Ret x) = {[], [\\<checkmark>(x)]}\"\n  by (auto simp add: traces_def)\n\nlemma traces_Tau: \"traces (Sil P) = traces P\"\n  by (force simp add: traces_def)\n\nlemma traces_Vis: \"traces (Vis F) = {[]} \\<union> {Ev a # tr | a tr. a \\<in> pdom(F) \\<and> tr \\<in> traces(F a)}\"\n  apply (auto elim!: in_tracesE trace_to_VisE)\n  apply (auto simp add: traces_def)\n  apply (metis list.map(2) trace_to_Vis)\n  apply (metis list.simps(9) trace_to_Vis)\n  done\n  \nlemma traces_diverge: \"traces diverge = {[]}\"\n  by (auto simp add: traces_def dest: trace_of_divergent)\n\nlemma traces_bind: \n  \"traces (P \\<bind> Q) = \n  (traces(P) \\<inter> lists (range Ev)) \n  \\<union> {tr\\<^sub>1 @ tr\\<^sub>2 | tr\\<^sub>1 tr\\<^sub>2. \\<exists> v. tr\\<^sub>1 @ [\\<checkmark>(v)] \\<in> traces(P) \\<and> tr\\<^sub>2 \\<in> traces(Q v)}\"\n  apply (auto elim!: in_tracesE trace_to_bindE bind_RetE')\n  apply (auto simp add: traces_def)\n  apply (metis (no_types, lifting) Nil_is_map_conv append_Nil2 image_subset_iff list.set_map map_of_Ev_append range_eqI)\n  apply (smt (z3) Ev_subset_image UNIV_I bind_RetE list.set_map list.simps(8) map_of_Ev_append self_append_conv2 subsetI trace_to_Nil)\n  apply (metis (no_types, opaque_lifting) List.map.id append.simps(1) id_apply image_subset_iff list.set_map list.simps(8) map_map of_Ev_Ev rangeI trace_to_Nil)\n  apply (metis (mono_tags, lifting) Ev_subset_image append.right_neutral list.set_map list.simps(8) map_of_Ev_append top_greatest)\n  apply (metis (no_types, lifting) append.right_neutral list.set_map list.simps(8) map_of_Ev_append subset_image_iff top_greatest)\n  apply (meson trace_to_bind_left)\n  apply (metis (no_types, lifting) map_Ev_of_Ev map_append map_map trace_to_bind)\n  apply (metis (no_types, lifting) map_Ev_of_Ev map_append map_map trace_to_bind)\n  done\n\nlemma T1a [simp]: \"traces(P) \\<noteq> {}\"\n  by (auto simp add: traces_def)\n\nlemma T1b: \n  assumes \"t\\<^sub>1 @ t\\<^sub>2 \\<in> traces(P)\"\n  shows \"t\\<^sub>1 \\<in> traces(P)\"\nproof (cases \"t\\<^sub>2 = []\")\n  case True\n  then show ?thesis using assms by simp\nnext\n  case False\n  note t\\<^sub>2 = this\n  then show ?thesis\n  using assms proof (erule_tac in_tracesE)\n    fix P' tr \n    assume a: \"t\\<^sub>1 @ t\\<^sub>2 = map Ev tr\" \"P \\<midarrow>tr\\<leadsto> P'\"\n    then obtain P'' where \"P \\<midarrow>map of_Ev t\\<^sub>1\\<leadsto> P''\"\n      by (metis UNIV_I append_Nil2 list.set_map map_append map_of_Ev_append subsetI subset_image_iff trace_to_appendE)\n    with a show ?thesis\n      by (metis append_eq_map_conv in_tracesI1 trace_to_appendE)\n  next\n    fix P' tr v\n    assume a: \"t\\<^sub>1 @ t\\<^sub>2 = map Ev tr @ [\\<checkmark> v]\" \"P \\<midarrow>tr\\<leadsto> Ret v\"\n    hence \"(tr = map of_Ev (butlast (t\\<^sub>1 @ t\\<^sub>2)))\"\n      by (metis append_Nil2 assms butlast_snoc list.simps(8) map_of_Ev_append traces_prefix_in_Ev)\n    hence P: \"P \\<midarrow>map of_Ev (butlast (t\\<^sub>1 @ t\\<^sub>2)) \\<leadsto> Ret v\"\n      using a(2) by force\n    then have \"\\<exists> P''. P \\<midarrow>map of_Ev t\\<^sub>1\\<leadsto> P''\"\n    proof (cases \"t\\<^sub>1 = []\")\n      case True\n      thus ?thesis by auto\n    next\n      case False\n      with P t\\<^sub>2 show ?thesis\n        by (force elim:trace_to_appendE simp add: butlast_append)\n    qed\n    thus ?thesis\n      by (metis (no_types, opaque_lifting) UNIV_I a(1) butlast_append butlast_snoc in_tracesI1 le_sup_iff list.set_map map_Ev_of_Ev map_map set_append subsetI subset_image_iff t\\<^sub>2)\n  qed\nqed\n\nlemmas T1 = T1a T1b\n\nsubsection \\<open> Divergences \\<close>\n\ndefinition divergences :: \"('a, 'b) itree \\<Rightarrow> ('a, 'b) trace set\" where\n\"divergences P = {s @ t | s t. set s \\<subseteq> range Ev \\<and> set t \\<subseteq> range Ev \\<and> (\\<exists> Q. P \\<Midarrow>s\\<Rightarrow> Q \\<and> Q\\<Up>)}\"\n\nlemma divergences_alt_def: \n  \"divergences P = {map Ev (s @ t) | s t. (\\<exists> Q. P \\<midarrow>s\\<leadsto> Q \\<and> Q\\<Up>)}\"\n  apply (auto elim!: trace_EvE simp add: divergences_def mstep_to_def)\n  apply blast\n   apply (metis Nil_is_map_conv event.distinct(1) last_map snoc_eq_iff_butlast)\n  apply (force)\n  done\n\nlemma in_divergenceE [elim]:\n  assumes\n  \"tr \\<in> divergences P\"\n  \"\\<And> tr' s. \\<lbrakk> tr = map Ev (tr' @ s); P \\<midarrow>tr'\\<leadsto> diverge \\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  using assms by (auto simp add: divergences_alt_def diverges_then_diverge)\n\nlemma in_divergence_tranI: \"P \\<midarrow>tr\\<leadsto> diverge \\<Longrightarrow> map Ev tr \\<in> divergences(P)\"\n  by (force simp add: divergences_alt_def)\n\nlemma D1: \n  assumes \"s \\<in> divergences P\" \"t \\<in> lists (range Ev)\"\n  shows \"s @ t \\<in> divergences P\"\nproof -\n  obtain tr s' where \"s = map Ev (tr @ s')\" \"P \\<midarrow>tr\\<leadsto> diverge\"\n    using assms(1) by blast\n  with assms(2) show ?thesis\n    apply (auto simp add: divergences_def mstep_to_def)\n    apply (rule_tac x=\"map Ev tr\" in exI)\n    apply (force)\n    done\nqed\n\nlemma D1_prefix: \"\\<lbrakk> s \\<in> divergences P; set t \\<subseteq> range Ev; s \\<le> t \\<rbrakk> \\<Longrightarrow> t \\<in> divergences P\"\n  by (metis (no_types, lifting) D1 Prefix_Order.prefixE in_listsI le_sup_iff set_append subset_code(1))\n\nlemma no_divergences_then_div_free: \"divergences P = {} \\<Longrightarrow> div_free P\"\n  by (auto simp add: divergences_alt_def)\n     (metis div_free_is_no_divergence no_divergence)\n\nlemma div_free_iff_divergences_empty: \"div_free P \\<longleftrightarrow> divergences P = {}\"\n  by (metis div_free_is_no_divergence diverges_diverge ex_in_conv in_divergenceE no_divergence no_divergences_then_div_free)\n  \nlemma wbisim_le_divergences: \n  assumes \"P \\<approx> Q\"\n  shows \"divergences(P) \\<subseteq> divergences(Q)\"\n  using assms\n  by (auto simp add: divergences_alt_def)\n     (metis diverge_wbisim1 diverges_then_diverge wbisim_step)\n\nlemma wbisim_eq_divergences: \n  assumes \"P \\<approx> Q\"\n  shows \"divergences(P) = divergences(Q)\"\n  by (metis antisym_conv assms wbisim_le_divergences wbisim_sym)\n\ndefinition divergence_strict_traces :: \"('e, 's) itree \\<Rightarrow> ('e, 's) trace set\" (\"traces\\<^sub>\\<bottom>\") where\n\"divergence_strict_traces P = traces P \\<union> divergences P\"\n\nlemma F1a: \"traces\\<^sub>\\<bottom>(P) \\<noteq> {}\"\n  by (simp add: divergence_strict_traces_def)\n\nlemma non_divergent_prefix:\n  assumes \"t\\<^sub>1 @ t\\<^sub>2 \\<in> divergences P\" \"t\\<^sub>1 \\<notin> divergences P\" \n  shows \"t\\<^sub>1 \\<in> traces P\"\nproof -\n  obtain tr s where tr: \"t\\<^sub>1 @ t\\<^sub>2 = map Ev (tr @ s)\" \"P \\<midarrow>tr\\<leadsto> diverge\"\n    using assms(1) by blast\n  hence t1: \"set t\\<^sub>1 \\<subseteq> range Ev\"\n    by (metis Ev_subset_image le_sup_iff list.set_map set_append subset_UNIV)\n  hence \"\\<not> (t\\<^sub>1 \\<ge> map Ev tr)\"\n    by (meson D1_prefix assms(2) in_divergence_tranI tr(2))\n  hence \"t\\<^sub>1 < map Ev tr\"\n    by (smt (z3) Prefix_Order.prefix_prefix append_eq_append_conv2 less_list_def map_append order_refl tr(1))\n  thus ?thesis\n    by (metis Prefix_Order.strict_prefixE' T1b in_tracesI1 tr(2))\nqed\n\nlemma F1b: \"t\\<^sub>1 @ t\\<^sub>2 \\<in> traces\\<^sub>\\<bottom>(P) \\<Longrightarrow> t\\<^sub>1 \\<in> traces\\<^sub>\\<bottom>(P)\"\n  by (auto simp add: divergence_strict_traces_def non_divergent_prefix, meson T1b)\n\nlemma divergences_diverge: \"divergences diverge = lists (range Ev)\"\n  by (auto simp add: divergences_alt_def)\n     (metis diverges_diverge map_append self_append_conv2 subsetI trace_EvE trace_to_Nil)\n\nlemma divergences_Ret: \"divergences (Ret x) = {}\"\n  by (simp add: divergences_alt_def)\n\nlemma divergences_Vis: \"divergences (Vis F) = {[Ev e] @ s | e s. e \\<in> pdom(F) \\<and> s \\<in> divergences(F(e)\\<^sub>p)}\" \n  apply (auto simp add: divergences_alt_def)\n  apply (metis (no_types, lifting) append_Cons diverge_not_Vis diverges_diverge diverges_implies_equal list.simps(9) trace_to_VisE)\n  apply (metis Vis_Cons_trns append_Cons list.simps(9))\n  done\n\nlemma divergences_Sil: \"divergences (Sil P) = divergences P\"\n  by (auto simp add: divergences_alt_def)\n     (metis stabilises_Sil trace_to_Nil trace_to_SilE)\n\nsubsection \\<open> Failures \\<close>\n\ntext \\<open> A failure is recorded when there is a trace leading to a stable interaction tree. At this\n  point, the refusal is calculated. \\<close>\n\ndefinition refuses :: \"('e, 's) itree \\<Rightarrow> ('e, 's) refusal \\<Rightarrow> bool\" (infix \"ref\" 65) where\n\"refuses P B = ((\\<exists> F. P = Vis F \\<and> B \\<inter> Ev ` pdom F = {}) \\<or> (\\<exists> x. P = Ret x \\<and> \\<checkmark>(x) \\<notin> B))\"\n\nlemma stable_refuses [simp]: \"P ref A \\<Longrightarrow> stable P\"\n  by (auto simp add: refuses_def)\n\nlemma Ret_refuses [simp]: \"Ret x ref B \\<longleftrightarrow> \\<checkmark>(x) \\<notin> B\"\n  by (simp add: refuses_def)\n\nlemma Vis_refuses [simp]: \"Vis F ref B \\<longleftrightarrow> B \\<inter> Ev ` pdom F = {}\"\n  by (simp add: refuses_def)\n\nlemma Sil_refuses [simp]: \"Sil P ref B = False\"\n  by (simp add: refuses_def)\n\nlemma refuses_down_closed: \"\\<lbrakk> P ref X; Y \\<subseteq> X \\<rbrakk> \\<Longrightarrow> P ref Y\"\n  by (force simp add: refuses_def)\n\ndefinition failure_of :: \"('e list \\<times> 'e set) \\<Rightarrow> ('e, 's) itree \\<Rightarrow> bool\" where\n\"failure_of = (\\<lambda> (tr, E) P. \\<exists> P'. P \\<midarrow>tr\\<leadsto> P' \\<and> is_Vis P' \\<and> E \\<subseteq> (- pdom (un_Vis P')))\"\n\nlemma Vis_trace_to: \"Vis F \\<midarrow>tr\\<leadsto> P \\<longleftrightarrow> ((tr = [] \\<and> P = Vis F) \\<or> (\\<exists> a tr'. a \\<in> pdom(F) \\<and> tr = a # tr' \\<and> (F a) \\<midarrow>tr'\\<leadsto> P))\"\n  by (auto)\n\ndefinition failures :: \"('e, 's) itree \\<Rightarrow> (('e, 's) trace \\<times> ('e, 's) refusal) set\" where\n\"failures P = {(s, X). \\<exists> Q. P \\<Midarrow>s\\<Rightarrow> Q \\<and> Q ref X} \\<union> {(s @ [\\<checkmark>(v)], X) | s v X. \\<exists> Q. P \\<Midarrow>s @ [\\<checkmark>(v)]\\<Rightarrow> Q}\"\n\nlemma failure_simpl_def: \"failures P = {(s, X). \\<exists> Q. P \\<Midarrow>s\\<Rightarrow> Q \\<and> Q ref X}\"\n  by (force simp add: failures_def refuses_def deadlock_def)\n\nlemma in_failuresE [elim]:\n  assumes\n  \"f \\<in> failures P\"\n  \\<comment> \\<open> The process reaches a visible choice, and is refusing all subsets of possible events \\<close>\n  \"\\<And> F B T tr. \\<lbrakk> f = (map Ev tr, B); P \\<midarrow>tr\\<leadsto> Vis F; B \\<inter> Ev ` pdom F = {} \\<rbrakk> \\<Longrightarrow> R\"\n  \\<comment> \\<open> The process reaches a termination event, and is refusing all non-termination events \\<close>\n  \"\\<And> x B T tr. \\<lbrakk> f = (map Ev tr, B - {\\<checkmark>(x)}); P \\<midarrow>tr\\<leadsto> Ret x \\<rbrakk> \\<Longrightarrow> R\"\n  \\<comment> \\<open> The process terminates; technically similar to the previous one. \\<close>\n  \"\\<And> x B T tr. \\<lbrakk> f = (map Ev tr @ [\\<checkmark> x], B); P \\<midarrow>tr\\<leadsto> Ret x \\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  using assms \n  by (auto simp add: failures_def refuses_def mstep_to_def deadlock_def)\n     (metis Diff_insert_absorb map_Ev_of_Ev map_map)\n\nlemma in_failuresI1: \"\\<lbrakk> P \\<midarrow>tr\\<leadsto> Vis F; B \\<inter> Ev ` pdom(F) = {} \\<rbrakk> \\<Longrightarrow> (map Ev tr, B) \\<in> failures P\"\n  by (auto simp add: failures_def mstep_to_def)\n\nlemma in_failuresI2: \"P \\<midarrow>tr\\<leadsto> Ret x \\<Longrightarrow> (map Ev tr, B - {\\<checkmark> x}) \\<in> failures P\"\n  by (auto simp add: failures_def mstep_to_def)\n\nlemma in_failures_iff:\n  \"(tr, B) \\<in> failures P \\<longleftrightarrow> \n        (\\<exists> F tr'. tr = map Ev tr' \\<and> P \\<midarrow>tr'\\<leadsto> Vis F \\<and> B \\<inter> Ev ` pdom(F) = {})\n        \\<or> (\\<exists> x tr'. tr = map Ev tr' \\<and> \\<checkmark> x \\<notin> B \\<and> P \\<midarrow>tr'\\<leadsto> Ret x)\n        \\<or> (\\<exists> x tr'. tr = map Ev tr' @ [\\<checkmark> x] \\<and> P \\<midarrow>tr'\\<leadsto> Ret x)\"\n  by (auto simp add: failures_def mstep_to_def refuses_def)\n     (metis map_Ev_of_Ev map_map, blast+)\n\nlemma failures_term_iff: \n  \"(tr @ [\\<checkmark>(v)], E) \\<in> failures(P) \\<longleftrightarrow> (\\<exists> Q. P \\<Midarrow>tr @ [\\<checkmark>(v)]\\<Rightarrow> Q)\"\n  by (auto simp add: failures_def)\n\nlemma failures_term_Ev_iff: \n  \"(map Ev tr @ [\\<checkmark>(v)], E) \\<in> failures(P) \\<longleftrightarrow> P \\<midarrow>tr\\<leadsto> Ret v\"\n  by (auto simp add: failures_def mstep_to_def)\n\nlemma T2: \"(s, X) \\<in> failures(P) \\<Longrightarrow> s \\<in> traces(P)\"\n  by force\n\nlemma F2: \"\\<lbrakk> (s, X) \\<in> failures(P); Y \\<subseteq> X \\<rbrakk> \\<Longrightarrow> (s, Y) \\<in> failures(P)\"\n  by (auto simp add: failures_def mstep_to_def, meson refuses_down_closed)\n\nlemma F3: \"\\<lbrakk> (s, X) \\<in> failures(P); Y \\<inter> {x. s @ [x] \\<in> traces(P)} = {} \\<rbrakk> \\<Longrightarrow> (s, X \\<union> Y) \\<in> failures(P)\"\n  apply (auto simp add: in_failures_iff traces_def set_eq_iff)\n  apply (rename_tac F tr')\n   apply (drule_tac x=\"F\" in spec)\n  apply (auto)\n  apply (rename_tac F tr' a)\n  apply (drule_tac x=\"Ev a\" in spec)\n  apply (auto)\n  apply (metis Vis_Cons_trns butlast_snoc snoc_eq_iff_butlast trace_to_ConsE trace_to_Nil trace_to_trans)\n  done\n\nlemma wbisim_refusals_eq: \"\\<lbrakk> P \\<approx> Q; stable P; stable Q \\<rbrakk> \\<Longrightarrow> P ref A \\<longleftrightarrow> Q ref A\"\n  apply (auto simp add: refuses_def elim!: wbisim_VisE)\n  apply (metis Vis_Sils is_Ret_Sils is_Vis_Sils itree.exhaust_disc)\n  apply (metis itree.discI(2) wbisim.cases wbisim_RetE)\n  apply (metis (mono_tags, lifting) Vis_Sils is_Ret_Sils is_Vis_Sils itree.exhaust_disc wbisim_Vis_eq wbisim_sym)\n  apply (metis itree.discI(2) wbisim.cases wbisim_RetE wbisim_sym)\n  done\n\nlemma wbisim_le_failures: \n  assumes \"P \\<approx> Q\"\n  shows \"failures(P) \\<subseteq> failures(Q)\"\nproof (safe)\n  fix s X\n  assume \"(s, X) \\<in> failures P\"\n  thus \"(s, X) \\<in> failures Q\"\n    apply (auto simp add: in_failures_iff)\n    apply (smt (verit, best) append.right_neutral assms trace_of_Sils trace_to_trans wbisim_VisE wbisim_step)\n    apply (metis (no_types, lifting) assms wbisim_step_terminate)\n    apply (metis assms wbisim_step_terminate)\n  done\nqed\n\nlemma wbisim_eq_failures: \n  assumes \"P \\<approx> Q\"\n  shows \"failures(P) = failures(Q)\"\n  by (metis antisym_conv assms wbisim_le_failures wbisim_sym)\n\ndefinition stable_failures :: \"('e, 's) itree \\<Rightarrow> (('e, 's) trace \\<times> ('e, 's) refusal) set\" (\"failures\\<^sub>\\<bottom>\") where\n\"stable_failures P = failures(P) \\<union> {(s, X). s \\<in> divergences(P) \\<and> X \\<subseteq> range Ev}\"\n\nlemma diverge_no_failures [dest]: \"failure_of t diverge \\<Longrightarrow> False\"\n  apply (simp add: failure_of_def prod.case_eq_if)\n  apply (auto)\n  done\n\nlemma failures_diverge: \"failures diverge = {}\"\n  by (auto simp add: failures_def refuses_def mstep_to_def)\n\nlemma failures_Sil:\n  \"failures (Sil P) = failures P\"\n  by (simp add: failures_def mstep_to_def, auto)\n\nlemma failures_Ret: \n  \"failures (Ret v) = {([], X) | X. \\<checkmark>(v) \\<notin> X} \\<union> {([\\<checkmark>(v)], X) | X. True}\"\n  by (simp add: failures_def mstep_to_def, safe, simp_all)\n\nlemma failures_Vis:\n  \"failures (Vis F) = {([], X) | X. X \\<inter> Ev ` pdom F = {}} \n                      \\<union> {(Ev a # tr, X) | tr a X. a \\<in> pdom(F) \\<and> (tr, X) \\<in> failures(F a)}\"\n  apply (simp add: failures_def mstep_to_def Vis_trace_to)\n  apply (safe, simp_all)\n  apply force\n  apply blast\n  apply blast\n  apply blast\n  apply (metis list.simps(9) option.sel)\n  apply (metis list.simps(9) option.sel)\n  done\n\nlemma failures_deadlock: \"failures deadlock = {([], X) | X. True}\"\n  by (auto simp add: deadlock_def failures_Vis)\n\nlemma failures_inp:\n  \"wb_prism c \\<Longrightarrow>\n   failures (inp_in c A) = \n    {([], E) | E. \\<forall> x\\<in>A. Ev (build\\<^bsub>c\\<^esub> x) \\<notin> E} \n    \\<union> {([Ev (build\\<^bsub>c\\<^esub> x)], E) | E x. x \\<in> A \\<and> \\<checkmark> () \\<notin> E}\n    \\<union> {([Ev (build\\<^bsub>c\\<^esub> x), \\<checkmark> ()], E) | E x. x \\<in> A}\"\n  by (simp add: inp_in_where_def failures_Vis failures_Ret, safe)\n     (auto simp add: wb_prism.range_build failures_Ret)  \n  \nlemma dom_bind [simp]: \"Map.dom (\\<lambda> x. P x \\<bind> Q) = {x \\<in> Map.dom P. the(P x) \\<in> Map.dom Q}\"\n  by (auto)\n\nlemma refuses_Term_iff: \"Q ref (B \\<union> range \\<checkmark>) \\<longleftrightarrow> (\\<exists>F. Q = Vis F \\<and> B \\<inter> Ev ` pdom F = {})\"\n  by (auto simp add: refuses_def)\n\nlemma failures_Term_iff:\n  \"(map Ev tr, B \\<union> range \\<checkmark>) \\<in> failures P \\<longleftrightarrow> (\\<exists> F. P \\<midarrow>tr\\<leadsto> Vis F \\<and> B \\<inter> Ev ` pdom F = {})\"\n  by (auto simp add: failures_def mstep_to_def refuses_Term_iff)\n     (metis event.simps(4) trace_last_Ev)+\n  \ntext \\<open> Refusing all termination events \\<close>\n\nlemma \"(tr, B \\<union> range \\<checkmark>) \\<in> failures P \\<longleftrightarrow> \n        (\\<exists> F tr'. tr = map Ev tr' \\<and> P \\<midarrow>tr'\\<leadsto> Vis F \\<and> B \\<inter> Ev ` pdom(F) = {})\n        \\<or> (\\<exists> x tr'. tr = map Ev tr' @ [\\<checkmark> x] \\<and> P \\<midarrow>tr'\\<leadsto> Ret x)\"\n  apply (auto simp add: failures_def mstep_to_def refuses_def)\n  apply (metis inf_sup_distrib2 map_Ev_of_Ev map_map sup_eq_bot_iff)\n  apply (metis Vis_refuses refuses_Term_iff)\n  done\n\nlemma failures_bind: \n  \"failures (P \\<bind> Q) = \n    {(s, X). set s \\<subseteq> range Ev \\<and> (s, X \\<union> (range Term)) \\<in> failures(P)}\n    \\<union> {(s @ t, X) | s t X. \\<exists> v. s @ [\\<checkmark>(v)] \\<in> traces(P) \\<and> (t, X) \\<in> failures(Q v)}\"\n  apply (rule set_eqI)\n  apply (clarify)\n  apply (simp add: in_failures_iff)\n  apply (auto elim!: trace_to_bindE bind_VisE' bind_RetE')\n              apply (meson Vis_refuses refuses_Term_iff)\n             apply (metis (no_types, opaque_lifting) List.map.id append.right_neutral id_apply image_subset_iff list.set_map list.simps(8) map_map of_Ev_Ev rangeI trace_to_Nil)\n            apply (metis (no_types, lifting) image_subset_iff list.set_map map_Ev_eq_iff map_Ev_of_Ev map_map rangeI)\n           apply (metis (no_types, opaque_lifting) Ev_subset_image UNIV_I append.right_neutral list.map_comp list.set_map list.simps(8) map_Ev_eq_iff map_Ev_of_Ev subsetI trace_to_Nil)\n          apply (metis (no_types, opaque_lifting) append.right_neutral list.set_map map_append map_of_Ev_append subset_image_iff top_greatest)\n         apply (metis (no_types, opaque_lifting) append_Nil list.set_map list.simps(8) map_of_Ev_append subset_image_iff top_greatest trace_to_Nil)\n        apply (metis (no_types, opaque_lifting) append_Nil list.set_map list.simps(8) map_of_Ev_append subset_image_iff top_greatest trace_to_Nil)\n       apply (metis (no_types, opaque_lifting) append.right_neutral list.set_map list.simps(8) map_of_Ev_append subset_image_iff top_greatest)\n      apply (metis (no_types, opaque_lifting) Ev_subset_image append_Nil list.set_map map_append map_of_Ev_append top_greatest)\n     apply (rename_tac b F tr')\n     apply (drule_tac x=\"map_pfun (\\<lambda> x. bind_itree x Q) F\" in spec)\n     apply (simp)\n     apply (metis Int_Un_distrib2 Un_Int_eq(1) bind_Vis disjoint_iff trace_to_bind_left)\n    apply (metis (no_types, lifting) map_Ev_of_Ev map_append map_map trace_to_bind)+\n  done\n\nlemma failure_Ret_neq_Vis: \n  assumes \"failures(Ret x) = failures(Vis F)\"\n  shows \"False\"\nproof -\n  have \"([\\<checkmark> x], {}) \\<in> failures(Ret x)\"\n    by (auto simp add: failures_Ret)\n  moreover have \"([\\<checkmark> x], {}) \\<notin> failures(Vis F)\"\n    by (auto simp add: failures_Vis)\n  ultimately show ?thesis\n    using assms by blast\nqed\n\nlemma mstep_to_term: \"P \\<Midarrow>[\\<checkmark> v]\\<Rightarrow> P' \\<longleftrightarrow> (\\<exists> n. P = Sils n (Ret v) \\<and> P' = deadlock)\"\n  by (metis append_Nil map_is_Nil_conv mstep_termE mstep_to_def trace_of_Sils trace_to_NilE)\n\nlemma \n  assumes \"P \\<Midarrow>[a]\\<Rightarrow> P'\" \"a \\<notin> \\<I>(P)\" \"is_Vis Q\"\n  shows \"P \\<box> Q \\<Midarrow>[a]\\<Rightarrow> P'\"\nproof -\n  have \"stabilises P\"\n    by (meson assms(1) mstep_stabilises not_Cons_self2)\n  then obtain n P'' where P'': \"P = Sils n P''\" \"stable P''\"\n    by (metis stabilises_def)\n  have \"P'' \\<box> Q \\<Midarrow>[a]\\<Rightarrow> P'\"\n  proof (cases P'')\n    case (Ret x1)\n    then show ?thesis oops\n\n (*\n    next\n    case (Sil x2)\n    then show ?thesis\n      using P'' by force\n  next\n    case (Vis F)\n    with assms(1) P'' obtain e where \"a = Ev e\" \"e \\<in> pdom F\"\n      by (auto simp add: mstep_to_def domIff)\n    with assms P'' show ?thesis\n      apply (simp)\n  oops\n*)\n\nlemma \n  assumes \"\\<I>(P) \\<inter> \\<I>(Q) = {}\"\n  shows \"failures(P \\<box> Q) = {([], X) | X. ([], X) \\<in> failures(P) \\<inter> failures(Q)}\n                         \\<union> {(s, X). (s, X) \\<in> failures P \\<union> failures Q \\<and> s \\<noteq> []}\n                         \\<union> {([], X) | X. X \\<subseteq> range Ev \\<and> (\\<exists> v. [\\<checkmark> v] \\<in> traces(P) \\<union> traces(Q))}\"\n  oops\n\nsubsection \\<open> Determinism \\<close>\n\ndefinition \"deterministic P = (divergences P = {} \\<and> (\\<forall> s a. s @ [a] \\<in> traces(P) \\<longrightarrow> (s, {a}) \\<notin> failures(P)))\"\n\ntext \\<open> Interaction trees satisfy the CSP definition of determinism. \\<close>\n\nlemma div_free_is_determinsitic:\n  \"div_free P \\<Longrightarrow> deterministic P\"\n  apply (auto simp add: deterministic_def divergences_def traces_def failures_def mstep_to_def refuses_def termination_determinsitic)\n  apply (metis div_free_diverge diverges_diverge diverges_implies_equal trace_to_div_free)\n  apply (simp add: domD trace_to_determinstic_choice)\n  apply (metis event.simps(4) last_map list.simps(8) snoc_eq_iff_butlast)\n  apply (metis append_butlast_last_id is_Ret_def trace_to_Ret_end)\n  apply (metis Cons_eq_map_D append_eq_map_conv event.simps(4))\n  apply (metis Nil_is_append_conv Nil_is_map_conv event.simps(4) last_map last_snoc not_Cons_self2)\n  apply (meson trace_to_Ret_excl_Vis)\n  apply (metis event.simps(4) trace_last_Ev)+  \n  done\nhide_const Map.dom\n\nlemma has_Nil_divergence_unstable: \"[] \\<in> divergences Q \\<Longrightarrow> unstable Q\"\n  by (auto simp add: divergences_def diverges_implies_unstable diverges_then_diverge mstep_to_def trace_to_Nil_diverges)\n\nlemma divergences_has_Nil_is_diverge:\n  \"[] \\<in> divergences P \\<Longrightarrow> P = diverge\"\nproof (coinduction arbitrary: P rule: itree_strong_coind')\ncase RetF\n  then show ?case by (simp add: has_Nil_divergence_unstable itree.distinct_disc(2))\nnext\n  case SilF\n  then show ?case by (simp add: has_Nil_divergence_unstable)\nnext\n  case VisF\n  then show ?case by (simp, meson has_Nil_divergence_unstable itree.distinct_disc(6))\nnext\n  case Ret\n  then show ?case by (auto)\nnext\n  case Sil\n  then show ?case by (auto simp add: divergences_Sil, metis diverge.code itree.inject(2))\nnext\n  case Vis\n  then show ?case by (auto simp add: divergences_Vis)\nqed\n\nlemma dom_Vis_ref: \"dom F = - (\\<Union> {E. Vis F ref (Ev ` E)})\"\n  by (auto simp add: refuses_def)\n\nlemma dom_from_traces: \"pdom F = {a. \\<exists> tr. Ev a # tr \\<in> traces (Vis F)}\"\n  by (simp only: dom_Vis_ref traces_Vis, simp add: traces_def mstep_to_def, auto)\n\nlemma dom_from_failures: \"dom F = {a. \\<forall> E. ([], E) \\<in> failures (Vis F) \\<longrightarrow> Ev a \\<notin> E}\"\n  apply (simp only: dom_Vis_ref)\n  apply (simp add: failures_def mstep_to_def refuses_def )\n  apply safe\n    apply (erule trace_to_VisE)\n  apply (simp)\n  apply (metis (no_types, opaque_lifting) Int_insert_left_if0 disjoint_iff image_empty image_insert inf_bot_left singletonI)\n    apply (auto)\n  done\n\nlemma traces_eq_is_Vis: \"\\<lbrakk> traces P = traces Q; is_Vis P; stable Q \\<rbrakk> \\<Longrightarrow> is_Vis Q\"\n  by (metis append_Nil empty_subsetI is_Vis_Sils itree.collapse(1) itree.exhaust_disc list.set(1) list.simps(8) term_trace_iff trace_to.intros(1) traces_single_Term)\n\nlemma traces_eq_is_Ret: \"\\<lbrakk> traces P = traces Q; is_Ret P; stable Q \\<rbrakk> \\<Longrightarrow> is_Ret Q\"\n  by (metis itree.distinct_disc(2) itree.distinct_disc(3) itree.exhaust_disc traces_eq_is_Vis)\n\ntheorem wbisim_implies_fd_equiv:\n  assumes \"failures(P) = failures(Q) \\<and> divergences(P) = divergences(Q)\"\n  shows \"P \\<approx> Q\"\n  using assms\nproof (coinduction arbitrary: P Q rule: wbisim_strong_Sil_coind)\n  case (2 P Q)\n  then show ?case\n    using divergences_has_Nil_is_diverge by (auto simp add: failures_diverge divergences_diverge)\nnext\n  case (3 P' P Q)\n  then show ?case\n    by (metis Sil_wbisim_iff2 failures_Sil wbisim_eq_divergences wbisim_refl)\nnext\n  case (4 P Q)\n  then show ?case\n    by (metis failure_Ret_neq_Vis is_Ret_def is_VisE itree.exhaust_disc) \nnext\n  case (5 F G P Q)\n\n  hence 1: \"failures (Vis F) = failures (Vis G)\"\n    by auto\n\n  have 2: \"divergences (Vis F) = divergences (Vis G)\"\n    using 5 by auto\n\n  have dom: \"dom F = dom G\"\n    by (simp add: 5 dom_from_failures)\n\n  have fd: \"(\\<forall>e\\<in>dom F. (\\<exists>P Q. F(e)\\<^sub>p = P \\<and> G(e)\\<^sub>p = Q \\<and> failures P = failures Q \\<and> divergences P = divergences Q))\"\n  proof\n    fix e\n    assume a: \"e \\<in> dom F\"\n    show \"\\<exists>P Q. F(e)\\<^sub>p = P \\<and> G(e)\\<^sub>p = Q \\<and> failures P = failures Q \\<and> divergences P = divergences Q\"\n    proof -\n      have \"failures (F(e)\\<^sub>p) = failures (G(e)\\<^sub>p)\"\n      proof (auto simp add: set_eq_iff)\n        fix tr E\n        assume \"(tr, E) \\<in> failures (F(e)\\<^sub>p)\"\n        hence i: \"([Ev e] @ tr, E) \\<in> failures (Vis F)\"\n          by (simp add: failures_Vis a)\n        with 1 have \"([Ev e] @ tr, E) \\<in> failures (Vis G)\"\n          by auto\n        thus \"(tr, E) \\<in> failures (G(e)\\<^sub>p) \"\n          by (simp add: failures_Vis)\n      next\n        fix tr E\n        assume \"(tr, E) \\<in> failures (G(e)\\<^sub>p)\"\n        with dom[THEN sym] have i: \"([Ev e] @ tr, E) \\<in> failures (Vis G)\"\n          by (simp add: failures_Vis a)\n        with 1 have \"([Ev e] @ tr, E) \\<in> failures (Vis F)\"\n          by auto\n        thus \"(tr, E) \\<in> failures (F(e)\\<^sub>p) \"\n          by (simp add: failures_Vis)\n      qed\n      moreover have \"divergences(F(e)\\<^sub>p) = divergences(G(e)\\<^sub>p)\"\n      proof (auto simp add: set_eq_iff)\n        fix tr\n        assume \"tr \\<in> divergences (F(e)\\<^sub>p)\"\n        hence i: \"[Ev e] @ tr \\<in> divergences (Vis F)\"\n          by (simp add: divergences_Vis a)\n        with 2 have \"[Ev e] @ tr \\<in> divergences (Vis G)\"\n          by auto\n        thus \"tr \\<in> divergences (G(e)\\<^sub>p) \"\n          by (simp add: divergences_Vis)\n      next\n        fix tr\n        assume \"tr \\<in> divergences (G(e)\\<^sub>p)\"\n        with dom[THEN sym] have i: \"[Ev e] @ tr \\<in> divergences (Vis G)\"\n          by (simp add: divergences_Vis a)\n        with 2 have \"[Ev e] @ tr \\<in> divergences (Vis F)\"\n          by auto\n        thus \"tr \\<in> divergences (F(e)\\<^sub>p) \"\n          by (simp add: divergences_Vis)\n      qed\n      ultimately show ?thesis\n        by auto\n    qed\n  qed\n  with dom show ?case by simp\nnext\n  case (6 x y P Q)\n  then show ?case \n    by (force simp add: failures_Ret divergences_Ret)\nqed (simp)\n\ntheorem wbisim_implies_trace_divergences_equiv:\n  assumes \"traces(P) = traces(Q) \\<and> divergences(P) = divergences(Q)\"\n  shows \"P \\<approx> Q\"\n  using assms\nproof (coinduction arbitrary: P Q rule: wbisim_strong_Sil_coind)\n  case (2 P Q)\n  then show ?case\n    using divergences_has_Nil_is_diverge by (auto simp add: failures_diverge divergences_diverge)\nnext\n  case (3 P' P Q)\n  then show ?case\n    by (metis divergences_Sil traces_Tau)\nnext\n  case (4 P Q)\n  then show ?case\n    by (metis traces_eq_is_Ret traces_eq_is_Vis)\nnext\n  case (5 F G P Q)\n\n  hence 1: \"traces (Vis F) = traces (Vis G)\"\n    by auto\n\n  have 2: \"divergences (Vis F) = divergences (Vis G)\"\n    using 5 by auto\n\n  have dom: \"dom F = dom G\"\n    by (simp add: 5 dom_from_traces)\n\n  have fd: \"(\\<forall>e\\<in>dom F. (\\<exists>P Q. F(e)\\<^sub>p = P \\<and> G(e)\\<^sub>p = Q \\<and> traces P = traces Q \\<and> divergences P = divergences Q))\"\n  proof\n    fix e\n    assume a: \"e \\<in> dom F\"\n    show \"\\<exists>P Q. F(e)\\<^sub>p = P \\<and> G(e)\\<^sub>p = Q \\<and> traces P = traces Q \\<and> divergences P = divergences Q\"\n    proof -\n      have \"traces (F(e)\\<^sub>p) = traces (G(e)\\<^sub>p)\"\n      proof (auto simp add: set_eq_iff)\n        fix tr\n        assume \"tr \\<in> traces (F(e)\\<^sub>p)\"\n        hence i: \"[Ev e] @ tr \\<in> traces (Vis F)\"\n          by (simp add: traces_Vis a)\n        with 1 have \"[Ev e] @ tr \\<in> traces (Vis G)\"\n          by auto\n        thus \"tr \\<in> traces (G(e)\\<^sub>p) \"\n          by (simp add: traces_Vis)\n      next\n        fix tr\n        assume \"tr \\<in> traces (G(e)\\<^sub>p)\"\n        with dom[THEN sym] have i: \"[Ev e] @ tr \\<in> traces (Vis G)\"\n          by (simp add: traces_Vis a)\n        with 1 have \"[Ev e] @ tr \\<in> traces (Vis F)\"\n          by auto\n        thus \"tr \\<in> traces (F(e)\\<^sub>p) \"\n          by (simp add: traces_Vis)\n      qed\n      moreover have \"divergences(F(e)\\<^sub>p) = divergences(G(e)\\<^sub>p)\"\n      proof (auto simp add: set_eq_iff)\n        fix tr\n        assume \"tr \\<in> divergences (F(e)\\<^sub>p)\"\n        hence i: \"[Ev e] @ tr \\<in> divergences (Vis F)\"\n          by (simp add: divergences_Vis a)\n        with 2 have \"[Ev e] @ tr \\<in> divergences (Vis G)\"\n          by auto\n        thus \"tr \\<in> divergences (G(e)\\<^sub>p) \"\n          by (simp add: divergences_Vis)\n      next\n        fix tr\n        assume \"tr \\<in> divergences (G(e)\\<^sub>p)\"\n        with dom[THEN sym] have i: \"[Ev e] @ tr \\<in> divergences (Vis G)\"\n          by (simp add: divergences_Vis a)\n        with 2 have \"[Ev e] @ tr \\<in> divergences (Vis F)\"\n          by auto\n        thus \"tr \\<in> divergences (F(e)\\<^sub>p) \"\n          by (simp add: divergences_Vis)\n      qed\n      ultimately show ?thesis\n        by auto\n    qed\n  qed\n  with dom show ?case by simp\nnext\n  case (6 x y P Q)\n  then show ?case \n    by (force simp add: traces_Ret divergences_Ret)\nqed (simp)\n\nlemma wbisim_iff_traces_divergences_equiv: \n  \"P \\<approx> Q \\<longleftrightarrow> (traces P = traces Q \\<and> divergences P = divergences Q)\"\n  by (meson wbisim_eq_divergences wbisim_eq_traces wbisim_implies_trace_divergences_equiv)\n\nend", "meta": {"author": "isabelle-utp", "repo": "interaction-trees", "sha": "90510d119364f534d2ab61daf2f274060f0a040e", "save_path": "github-repos/isabelle/isabelle-utp-interaction-trees", "path": "github-repos/isabelle/isabelle-utp-interaction-trees/interaction-trees-90510d119364f534d2ab61daf2f274060f0a040e/UTP/ITree_FDSem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.3490149188820786}}
{"text": "section \\<open>Refinement Rule Management\\<close>\ntheory Sepref_Rules\nimports Sepref_Basic Sepref_Constraints\nbegin\n  text \\<open>This theory contains tools for managing the refinement rules used by Sepref\\<close>\n\n  text \\<open>The theories are based on uncurried functions, i.e.,\n    every function has type @{typ \"'a\\<Rightarrow>'b\"}, where @{typ 'a} is the \n    tuple of parameters, or unit if there are none.\n    \\<close>\n\n\n  subsection \\<open>Assertion Interface Binding\\<close>\n  text \\<open>Binding of interface types to refinement assertions\\<close>\n  definition intf_of_assn :: \"('a \\<Rightarrow> _ \\<Rightarrow> assn) \\<Rightarrow> 'b itself \\<Rightarrow> bool\" where\n    [simp]: \"intf_of_assn a b = True\"\n\n  lemma intf_of_assnI: \"intf_of_assn R TYPE('a)\" by simp\n  \n  named_theorems_rev intf_of_assn \\<open>Links between refinement assertions and interface types\\<close>  \n\n  lemma intf_of_assn_fallback: \"intf_of_assn (R :: 'a \\<Rightarrow> _ \\<Rightarrow> assn) TYPE('a)\" by simp\n\n  subsection \\<open>Function Refinement with Precondition\\<close>\n  definition fref :: \"('c \\<Rightarrow> bool) \\<Rightarrow> ('a \\<times> 'c) set \\<Rightarrow> ('b \\<times> 'd) set\n           \\<Rightarrow> (('a \\<Rightarrow> 'b) \\<times> ('c \\<Rightarrow> 'd)) set\"\n    (\"[_]\\<^sub>f _ \\<rightarrow> _\" [0,60,60] 60)         \n  where \"[P]\\<^sub>f R \\<rightarrow> S \\<equiv> {(f,g). \\<forall>x y. P y \\<and> (x,y)\\<in>R \\<longrightarrow> (f x, g y)\\<in>S}\"\n  \n  abbreviation freft (\"_ \\<rightarrow>\\<^sub>f _\" [60,60] 60) where \"R \\<rightarrow>\\<^sub>f S \\<equiv> ([\\<lambda>_. True]\\<^sub>f R \\<rightarrow> S)\"\n  \n  \n\n  lemma fref_cons:  \n    assumes \"(f,g) \\<in> [P]\\<^sub>f R \\<rightarrow> S\"\n    assumes \"\\<And>c a. (c,a)\\<in>R' \\<Longrightarrow> Q a \\<Longrightarrow> P a\"\n    assumes \"R' \\<subseteq> R\"\n    assumes \"S \\<subseteq> S'\"\n    shows \"(f,g) \\<in> [Q]\\<^sub>f R' \\<rightarrow> S'\"\n    using assms\n    unfolding fref_def\n    by fastforce\n\n  lemmas fref_cons' = fref_cons[OF _ _ order_refl order_refl]  \n\n  lemma frefI[intro?]: \n    assumes \"\\<And>x y. \\<lbrakk>P y; (x,y)\\<in>R\\<rbrakk> \\<Longrightarrow> (f x, g y)\\<in>S\"\n    shows \"(f,g)\\<in>fref P R S\"\n    using assms\n    unfolding fref_def\n    by auto\n\n  lemma fref_ncI: \"(f,g)\\<in>R\\<rightarrow>S \\<Longrightarrow> (f,g)\\<in>R\\<rightarrow>\\<^sub>fS\"  \n    apply (rule frefI)\n    apply parametricity\n    done\n\n  lemma frefD: \n    assumes \"(f,g)\\<in>fref P R S\"\n    shows \"\\<lbrakk>P y; (x,y)\\<in>R\\<rbrakk> \\<Longrightarrow> (f x, g y)\\<in>S\"\n    using assms\n    unfolding fref_def\n    by auto\n\n  lemma fref_ncD: \"(f,g)\\<in>R\\<rightarrow>\\<^sub>fS \\<Longrightarrow> (f,g)\\<in>R\\<rightarrow>S\"  \n    apply (rule fun_relI)\n    apply (drule frefD)\n    apply simp\n    apply assumption+\n    done\n\n\n  lemma fref_compI: \n    \"fref P R1 R2 O fref Q S1 S2 \\<subseteq>\n      fref (\\<lambda>x. Q x \\<and> (\\<forall>y. (y,x)\\<in>S1 \\<longrightarrow> P y)) (R1 O S1) (R2 O S2)\"\n    unfolding fref_def\n    apply (auto)\n    apply blast\n    done\n\n  lemma fref_compI':\n    \"\\<lbrakk> (f,g)\\<in>fref P R1 R2; (g,h)\\<in>fref Q S1 S2 \\<rbrakk> \n      \\<Longrightarrow> (f,h) \\<in> fref (\\<lambda>x. Q x \\<and> (\\<forall>y. (y,x)\\<in>S1 \\<longrightarrow> P y)) (R1 O S1) (R2 O S2)\"\n    using fref_compI[of P R1 R2 Q S1 S2]   \n    by auto\n\n  lemma fref_unit_conv:\n    \"(\\<lambda>_. c, \\<lambda>_. a) \\<in> fref P unit_rel S \\<longleftrightarrow> (P () \\<longrightarrow> (c,a)\\<in>S)\"   \n    by (auto simp: fref_def)\n\n  lemma fref_uncurry_conv:\n    \"(uncurry c, uncurry a) \\<in> fref P (R1\\<times>\\<^sub>rR2) S \n    \\<longleftrightarrow> (\\<forall>x1 y1 x2 y2. P (y1,y2) \\<longrightarrow> (x1,y1)\\<in>R1 \\<longrightarrow> (x2,y2)\\<in>R2 \\<longrightarrow> (c x1 x2, a y1 y2) \\<in> S)\"\n    by (auto simp: fref_def)\n\n  lemma fref_mono: \"\\<lbrakk> \\<And>x. P' x \\<Longrightarrow> P x; R' \\<subseteq> R; S \\<subseteq> S' \\<rbrakk> \n    \\<Longrightarrow> fref P R S \\<subseteq> fref P' R' S'\"  \n    unfolding fref_def\n    by auto blast\n\n  lemma fref_composeI:\n    assumes FR1: \"(f,g)\\<in>fref P R1 R2\"\n    assumes FR2: \"(g,h)\\<in>fref Q S1 S2\"\n    assumes C1: \"\\<And>x. P' x \\<Longrightarrow> Q x\"\n    assumes C2: \"\\<And>x y. \\<lbrakk>P' x; (y,x)\\<in>S1\\<rbrakk> \\<Longrightarrow> P y\"\n    assumes R1: \"R' \\<subseteq> R1 O S1\"\n    assumes R2: \"R2 O S2 \\<subseteq> S'\"\n    assumes FH: \"f'=f\" \"h'=h\"\n    shows \"(f',h') \\<in> fref P' R' S'\"\n    unfolding FH\n    apply (rule subsetD[OF fref_mono fref_compI'[OF FR1 FR2]])\n    using C1 C2 apply blast\n    using R1 apply blast\n    using R2 apply blast\n    done\n\n  lemma fref_triv: \"A\\<subseteq>Id \\<Longrightarrow> (f,f)\\<in>[P]\\<^sub>f A \\<rightarrow> Id\"\n    by (auto simp: fref_def)\n\n\n  subsection \\<open>Heap-Function Refinement\\<close>\n  text \\<open>\n    The following relates a heap-function with a pure function.\n    It contains a precondition, a refinement assertion for the arguments\n    before and after execution, and a refinement relation for the result.\n    \\<close>\n  (* TODO: We only use this with keep/destroy information, so we could model\n    the parameter relations as such (('a\\<Rightarrow>'ai \\<Rightarrow> assn) \\<times> bool) *)\n  definition hfref \n    :: \"\n      ('a \\<Rightarrow> bool) \n   \\<Rightarrow> (('a \\<Rightarrow> 'ai \\<Rightarrow> assn) \\<times> ('a \\<Rightarrow> 'ai \\<Rightarrow> assn)) \n   \\<Rightarrow> ('b \\<Rightarrow> 'bi \\<Rightarrow> assn) \n   \\<Rightarrow> (('ai \\<Rightarrow> 'bi Heap) \\<times> ('a\\<Rightarrow>'b nres)) set\"\n   (\"[_]\\<^sub>a _ \\<rightarrow> _\" [0,60,60] 60)\n   where\n    \"[P]\\<^sub>a RS \\<rightarrow> T \\<equiv> { (f,g) . \\<forall>c a.  P a \\<longrightarrow> hn_refine (fst RS a c) (f c) (snd RS a c) T (g a)}\"\n\n  abbreviation hfreft (\"_ \\<rightarrow>\\<^sub>a _\" [60,60] 60) where \"RS \\<rightarrow>\\<^sub>a T \\<equiv> ([\\<lambda>_. True]\\<^sub>a RS \\<rightarrow> T)\"\n\n  lemma hfrefI[intro?]: \n    assumes \"\\<And>c a. P a \\<Longrightarrow> hn_refine (fst RS a c) (f c) (snd RS a c) T (g a)\"\n    shows \"(f,g)\\<in>hfref P RS T\"\n    using assms unfolding hfref_def by blast\n\n  lemma hfrefD: \n    assumes \"(f,g)\\<in>hfref P RS T\"\n    shows \"\\<And>c a. P a \\<Longrightarrow> hn_refine (fst RS a c) (f c) (snd RS a c) T (g a)\"\n    using assms unfolding hfref_def by blast\n\n  lemma hfref_to_ASSERT_conv: \n    \"NO_MATCH (\\<lambda>_. True) P \\<Longrightarrow> (a,b)\\<in>[P]\\<^sub>a R \\<rightarrow> S \\<longleftrightarrow> (a,\\<lambda>x. ASSERT (P x) \\<then> b x) \\<in> R \\<rightarrow>\\<^sub>a S\"  \n    unfolding hfref_def\n    apply (clarsimp; safe; clarsimp?)\n    apply (rule hn_refine_nofailI)\n    apply (simp add: refine_pw_simps)\n    subgoal for xc xa\n      apply (drule spec[of _ xc])\n      apply (drule spec[of _ xa])\n      by simp\n    done\n\n  text \\<open>\n    A pair of argument refinement assertions can be created by the \n    input assertion and the information whether the parameter is kept or destroyed\n    by the function.\n    \\<close>  \n  primrec hf_pres \n    :: \"('a \\<Rightarrow> 'b \\<Rightarrow> assn) \\<Rightarrow> bool \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> assn)\\<times>('a \\<Rightarrow> 'b \\<Rightarrow> assn)\"\n    where \n      \"hf_pres R True = (R,R)\" | \"hf_pres R False = (R,invalid_assn R)\"\n\n  abbreviation hfkeep \n    :: \"('a \\<Rightarrow> 'b \\<Rightarrow> assn) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> assn)\\<times>('a \\<Rightarrow> 'b \\<Rightarrow> assn)\" \n    (\"(_\\<^sup>k)\" [1000] 999)\n    where \"R\\<^sup>k \\<equiv> hf_pres R True\"\n  abbreviation hfdrop \n    :: \"('a \\<Rightarrow> 'b \\<Rightarrow> assn) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> assn)\\<times>('a \\<Rightarrow> 'b \\<Rightarrow> assn)\" \n    (\"(_\\<^sup>d)\" [1000] 999)\n    where \"R\\<^sup>d \\<equiv> hf_pres R False\"\n\n  abbreviation \"hn_kede R kd \\<equiv> hn_ctxt (snd (hf_pres R kd))\"\n  abbreviation \"hn_keep R \\<equiv> hn_kede R True\"\n  abbreviation \"hn_dest R \\<equiv> hn_kede R False\"\n\n  lemma keep_drop_sels[simp]:  \n    \"fst (R\\<^sup>k) = R\"\n    \"snd (R\\<^sup>k) = R\"\n    \"fst (R\\<^sup>d) = R\"\n    \"snd (R\\<^sup>d) = invalid_assn R\"\n    by auto\n\n  lemma hf_pres_fst[simp]: \"fst (hf_pres R k) = R\" by (cases k) auto\n\n  text \\<open>\n    The following operator combines multiple argument assertion-pairs to\n    argument assertion-pairs for the product. It is required to state\n    argument assertion-pairs for uncurried functions.\n    \\<close>  \n  definition hfprod :: \"\n    (('a \\<Rightarrow> 'b \\<Rightarrow> assn)\\<times>('a \\<Rightarrow> 'b \\<Rightarrow> assn)) \n    \\<Rightarrow> (('c \\<Rightarrow> 'd \\<Rightarrow> assn)\\<times>('c \\<Rightarrow> 'd \\<Rightarrow> assn))\n    \\<Rightarrow> ((('a\\<times>'c) \\<Rightarrow> ('b \\<times> 'd) \\<Rightarrow> assn) \\<times> (('a\\<times>'c) \\<Rightarrow> ('b \\<times> 'd) \\<Rightarrow> assn))\"\n    (infixl \"*\\<^sub>a\" 65)\n    where \"RR *\\<^sub>a SS \\<equiv> (prod_assn (fst RR) (fst SS), prod_assn (snd RR) (snd SS))\"\n\n  lemma hfprod_fst_snd[simp]:\n    \"fst (A *\\<^sub>a B) = prod_assn (fst A) (fst B)\" \n    \"snd (A *\\<^sub>a B) = prod_assn (snd A) (snd B)\" \n    unfolding hfprod_def by auto\n\n\n\n  subsubsection \\<open>Conversion from fref to hfref\\<close>  \n  (* TODO: Variant of import-param! Automate this! *)\n  lemma fref_to_pure_hfref':\n    assumes \"(f,g) \\<in> [P]\\<^sub>f R\\<rightarrow>\\<langle>S\\<rangle>nres_rel\"\n    assumes \"\\<And>x. x\\<in>Domain R \\<inter> R\\<inverse>``Collect P \\<Longrightarrow> f x = RETURN (f' x)\"\n    shows \"(return o f', g) \\<in> [P]\\<^sub>a (pure R)\\<^sup>k\\<rightarrow>pure S\"\n    apply (rule hfrefI) apply (rule hn_refineI)\n    using assms\n    apply ((sep_auto simp: fref_def pure_def pw_le_iff pw_nres_rel_iff\n      refine_pw_simps eintros del: exI))\n    apply force\n    done\n\n\n  subsubsection \\<open>Conversion from hfref to hnr\\<close>  \n  text \\<open>This section contains the lemmas. The ML code is further down. \\<close>\n  lemma hf2hnr:\n    assumes \"(f,g) \\<in> [P]\\<^sub>a R \\<rightarrow> S\"\n    shows \"\\<forall>x xi. P x \\<longrightarrow> hn_refine (emp * hn_ctxt (fst R) x xi) (f$xi) (emp * hn_ctxt (snd R) x xi) S (g$x)\"\n    using assms\n    unfolding hfref_def \n    by (auto simp: hn_ctxt_def)\n\n  (*lemma hf2hnr_new:\n    assumes \"(f,g) \\<in> [P]\\<^sub>a R \\<rightarrow> S\"\n    shows \"\\<forall>x xi. (\\<forall>h. h\\<Turnstile>fst R x xi \\<longrightarrow> P x) \\<longrightarrow> hn_refine (emp * hn_ctxt (fst R) x xi) (f xi) (emp * hn_ctxt (snd R) x xi) S (g$x)\"\n    using assms\n    unfolding hfref_def \n    by (auto simp: hn_ctxt_def intro: hn_refine_preI)\n  *)\n\n\n  (* Products that stem from currying are tagged by a special refinement relation *)  \n  definition [simp]: \"to_hnr_prod \\<equiv> prod_assn\"\n\n  lemma to_hnr_prod_fst_snd:\n    \"fst (A *\\<^sub>a B) = to_hnr_prod (fst A) (fst B)\" \n    \"snd (A *\\<^sub>a B) = to_hnr_prod (snd A) (snd B)\" \n    unfolding hfprod_def by auto\n\n  (* Warning: This lemma is carefully set up to be applicable as an unfold rule,\n    for more than one level of uncurrying*)\n  lemma hnr_uncurry_unfold: \"\n    (\\<forall>x xi. P x \\<longrightarrow> \n      hn_refine \n        (\\<Gamma> * hn_ctxt (to_hnr_prod A B) x xi) \n        (fi xi) \n        (\\<Gamma>' * hn_ctxt (to_hnr_prod A' B') x xi) \n        R \n        (f x))\n\\<longleftrightarrow> (\\<forall>b bi a ai. P (a,b) \\<longrightarrow>\n      hn_refine \n        (\\<Gamma> * hn_ctxt B b bi * hn_ctxt A a ai) \n        (fi (ai,bi)) \n        (\\<Gamma>' * hn_ctxt B' b bi * hn_ctxt A' a ai)\n        R\n        (f (a,b))\n    )\"\n    by (auto simp: hn_ctxt_def prod_assn_def star_aci)\n    \n  lemma hnr_intro_dummy:\n    \"\\<forall>x xi. P x \\<longrightarrow> hn_refine (\\<Gamma> x xi) (c xi) (\\<Gamma>' x xi) R (a x) \\<Longrightarrow> \\<forall>x xi. P x \\<longrightarrow> hn_refine (emp*\\<Gamma> x xi) (c xi) (emp*\\<Gamma>' x xi) R (a x)\" \n    by simp\n\n  lemma hn_ctxt_ctxt_fix_conv: \"hn_ctxt (hn_ctxt R) = hn_ctxt R\"\n    by (simp add: hn_ctxt_def[abs_def])\n\n  lemma uncurry_APP: \"uncurry f$(a,b) = f$a$b\" by auto\n\n  (* TODO: Replace by more general rule. *)  \n  lemma norm_RETURN_o: \n    \"\\<And>f. (RETURN o f)$x = (RETURN$(f$x))\"\n    \"\\<And>f. (RETURN oo f)$x$y = (RETURN$(f$x$y))\"\n    \"\\<And>f. (RETURN ooo f)$x$y$z = (RETURN$(f$x$y$z))\"\n    \"\\<And>f. (\\<lambda>x. RETURN ooo f x)$x$y$z$a = (RETURN$(f$x$y$z$a))\"\n    \"\\<And>f. (\\<lambda>x y. RETURN ooo f x y)$x$y$z$a$b = (RETURN$(f$x$y$z$a$b))\"\n    by auto\n\n  lemma norm_return_o: \n    \"\\<And>f. (return o f)$x = (return$(f$x))\"\n    \"\\<And>f. (return oo f)$x$y = (return$(f$x$y))\"\n    \"\\<And>f. (return ooo f)$x$y$z = (return$(f$x$y$z))\"\n    \"\\<And>f. (\\<lambda>x. return ooo f x)$x$y$z$a = (return$(f$x$y$z$a))\"\n    \"\\<And>f. (\\<lambda>x y. return ooo f x y)$x$y$z$a$b = (return$(f$x$y$z$a$b))\"\n    by auto\n\n  \n  lemma hn_val_unit_conv_emp[simp]: \"hn_val unit_rel x y = emp\"\n    by (auto simp: hn_ctxt_def pure_def)\n\n  subsubsection \\<open>Conversion from hnr to hfref\\<close>  \n  text \\<open>This section contains the lemmas. The ML code is further down. \\<close>\n\n  abbreviation \"id_assn \\<equiv> pure Id\"\n  abbreviation \"unit_assn \\<equiv> id_assn :: unit \\<Rightarrow> _\"\n\n  lemma pure_unit_rel_eq_empty: \"unit_assn x y = emp\"  \n    by (auto simp: pure_def)\n\n  lemma uc_hfprod_sel:\n    \"fst (A *\\<^sub>a B) a c = (case (a,c) of ((a1,a2),(c1,c2)) \\<Rightarrow> fst A a1 c1 * fst B a2 c2)\" \n    \"snd (A *\\<^sub>a B) a c = (case (a,c) of ((a1,a2),(c1,c2)) \\<Rightarrow> snd A a1 c1 * snd B a2 c2)\" \n    unfolding hfprod_def prod_assn_def[abs_def] by auto\n\n\n  subsubsection \\<open>Conversion from relation to fref\\<close>  \n  text \\<open>This section contains the lemmas. The ML code is further down. \\<close>\n\n  definition \"CURRY R \\<equiv> { (f,g). (uncurry f, uncurry g) \\<in> R }\"\n\n  lemma fref_param1: \"R\\<rightarrow>S = fref (\\<lambda>_. True) R S\"  \n    by (auto simp: fref_def fun_relD)\n\n  lemma fref_nest: \"fref P1 R1 (fref P2 R2 S) \n    \\<equiv> CURRY (fref (\\<lambda>(a,b). P1 a \\<and> P2 b) (R1\\<times>\\<^sub>rR2) S)\"\n    apply (rule eq_reflection)\n    by (auto simp: fref_def CURRY_def)\n\n  lemma in_CURRY_conv: \"(f,g) \\<in> CURRY R \\<longleftrightarrow> (uncurry f, uncurry g) \\<in> R\"  \n    unfolding CURRY_def by auto\n\n  lemma uncurry0_APP[simp]: \"uncurry0 c $ x = c\" by auto\n\n  lemma fref_param0I: \"(c,a)\\<in>R \\<Longrightarrow> (uncurry0 c, uncurry0 a) \\<in> fref (\\<lambda>_. True) unit_rel R\"\n    by (auto simp: fref_def)\n\n  subsubsection \\<open>Composition\\<close>\n  definition hr_comp :: \"('b \\<Rightarrow> 'c \\<Rightarrow> assn) \\<Rightarrow> ('b \\<times> 'a) set \\<Rightarrow> 'a \\<Rightarrow> 'c \\<Rightarrow> assn\"\n    \\<comment> \\<open>Compose refinement assertion with refinement relation\\<close>\n    where \"hr_comp R1 R2 a c \\<equiv> \\<exists>\\<^sub>Ab. R1 b c * \\<up>((b,a)\\<in>R2)\"\n\n  definition hrp_comp \n    :: \"('d \\<Rightarrow> 'b \\<Rightarrow> assn) \\<times> ('d \\<Rightarrow> 'c \\<Rightarrow> assn)\n        \\<Rightarrow> ('d \\<times> 'a) set \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> assn) \\<times> ('a \\<Rightarrow> 'c \\<Rightarrow> assn)\"\n    \\<comment> \\<open>Compose argument assertion-pair with refinement relation\\<close>    \n    where \"hrp_comp RR' S \\<equiv> (hr_comp (fst RR') S, hr_comp (snd RR') S) \"\n\n  lemma hr_compI: \"(b,a)\\<in>R2 \\<Longrightarrow> R1 b c \\<Longrightarrow>\\<^sub>A hr_comp R1 R2 a c\"  \n    unfolding hr_comp_def\n    by sep_auto\n\n  lemma hr_comp_Id1[simp]: \"hr_comp (pure Id) R = pure R\"  \n    unfolding hr_comp_def[abs_def] pure_def\n    apply (intro ext ent_iffI)\n    by sep_auto+\n\n  lemma hr_comp_Id2[simp]: \"hr_comp R Id = R\"  \n    unfolding hr_comp_def[abs_def]\n    apply (intro ext ent_iffI)\n    by sep_auto+\n    \n  (*lemma hr_comp_invalid[simp]: \"hr_comp (\\<lambda>a c. true) R a c = true * \\<up>(\\<exists>b. (b,a)\\<in>R)\"\n    unfolding hr_comp_def[abs_def]\n    apply (intro ext ent_iffI)\n    apply sep_auto+\n    done*)\n    \n  lemma hr_comp_emp[simp]: \"hr_comp (\\<lambda>a c. emp) R a c = \\<up>(\\<exists>b. (b,a)\\<in>R)\"\n    unfolding hr_comp_def[abs_def]\n    apply (intro ext ent_iffI)\n    apply sep_auto+\n    done\n\n  lemma hr_comp_prod_conv[simp]:\n    \"hr_comp (prod_assn Ra Rb) (Ra' \\<times>\\<^sub>r Rb') \n    = prod_assn (hr_comp Ra Ra') (hr_comp Rb Rb')\"  \n    unfolding hr_comp_def[abs_def] prod_assn_def[abs_def]\n    apply (intro ext ent_iffI)\n    apply solve_entails apply clarsimp apply sep_auto\n    apply clarsimp apply (intro ent_ex_preI)\n    apply (rule ent_ex_postI) apply (sep_auto split: prod.splits)\n    done\n\n  lemma hr_comp_pure: \"hr_comp (pure R) S = pure (R O S)\"  \n    apply (intro ext)\n    apply (rule ent_iffI)\n    unfolding hr_comp_def[abs_def] \n    apply (sep_auto simp: pure_def)+\n    done\n\n  lemma hr_comp_is_pure[safe_constraint_rules]: \"is_pure A \\<Longrightarrow> is_pure (hr_comp A B)\"\n    by (auto simp: hr_comp_pure is_pure_conv)\n\n  lemma hr_comp_the_pure: \"is_pure A \\<Longrightarrow> the_pure (hr_comp A B) = the_pure A O B\"\n    unfolding is_pure_conv\n    by (clarsimp simp: hr_comp_pure)\n\n  lemma rdomp_hrcomp_conv: \"rdomp (hr_comp A R) x \\<longleftrightarrow> (\\<exists>y. rdomp A y \\<and> (y,x)\\<in>R)\"\n    by (auto simp: rdomp_def hr_comp_def)\n\n  lemma hn_rel_compI: \n    \"\\<lbrakk>nofail a; (b,a)\\<in>\\<langle>R2\\<rangle>nres_rel\\<rbrakk> \\<Longrightarrow> hn_rel R1 b c \\<Longrightarrow>\\<^sub>A hn_rel (hr_comp R1 R2) a c\"\n    unfolding hr_comp_def hn_rel_def nres_rel_def\n    apply (clarsimp intro!: ent_ex_preI)\n    apply (drule (1) order_trans)\n    apply (simp add: ret_le_down_conv)\n    by sep_auto\n\n  lemma hr_comp_precise[constraint_rules]:\n    assumes [safe_constraint_rules]: \"precise R\"\n    assumes SV: \"single_valued S\"\n    shows \"precise (hr_comp R S)\"\n    apply (rule preciseI)\n    unfolding hr_comp_def\n    apply clarsimp\n    by (metis SV assms(1) preciseD single_valuedD)\n\n  lemma hr_comp_assoc: \"hr_comp (hr_comp R S) T = hr_comp R (S O T)\"\n    apply (intro ext)\n    unfolding hr_comp_def\n    apply (rule ent_iffI; clarsimp)\n    apply sep_auto\n    apply (rule ent_ex_preI; clarsimp) (* TODO: \n      sep_auto/solve_entails is too eager splitting the subgoal here! *)\n    apply sep_auto\n    done\n\n\n  lemma hnr_comp:\n    assumes R: \"\\<And>b1 c1. P b1 \\<Longrightarrow> hn_refine (R1 b1 c1 * \\<Gamma>) (c c1) (R1p b1 c1 * \\<Gamma>') R (b b1)\"\n    assumes S: \"\\<And>a1 b1. \\<lbrakk>Q a1; (b1,a1)\\<in>R1'\\<rbrakk> \\<Longrightarrow> (b b1,a a1)\\<in>\\<langle>R'\\<rangle>nres_rel\"\n    assumes PQ: \"\\<And>a1 b1. \\<lbrakk>Q a1; (b1,a1)\\<in>R1'\\<rbrakk> \\<Longrightarrow> P b1\"\n    assumes Q: \"Q a1\"\n    shows \"hn_refine \n      (hr_comp R1 R1' a1 c1 * \\<Gamma>) \n      (c c1)\n      (hr_comp R1p R1' a1 c1 * \\<Gamma>') \n      (hr_comp R R') \n      (a a1)\"\n    unfolding hn_refine_alt\n  proof clarsimp\n    assume NF: \"nofail (a a1)\"\n    show \"\n      <hr_comp R1 R1' a1 c1 * \\<Gamma>> \n        c c1 \n      <\\<lambda>r. hn_rel (hr_comp R R') (a a1) r * (hr_comp R1p R1' a1 c1 * \\<Gamma>')>\\<^sub>t\"\n      apply (subst hr_comp_def)\n      apply (clarsimp intro!: norm_pre_ex_rule)\n    proof -\n      fix b1\n      assume R1: \"(b1, a1) \\<in> R1'\"\n\n      from S R1 Q have R': \"(b b1, a a1) \\<in> \\<langle>R'\\<rangle>nres_rel\" by blast\n      with NF have NFB: \"nofail (b b1)\" \n        by (simp add: nres_rel_def pw_le_iff refine_pw_simps)\n      \n      from PQ R1 Q have P: \"P b1\" by blast\n      with NFB R have \"<R1 b1 c1 * \\<Gamma>> c c1 <\\<lambda>r. hn_rel R (b b1) r * (R1p b1 c1 * \\<Gamma>')>\\<^sub>t\"\n        unfolding hn_refine_alt by auto\n      thus \"<R1 b1 c1 * \\<Gamma>> \n        c c1 \n        <\\<lambda>r. hn_rel (hr_comp R R') (a a1) r * (hr_comp R1p R1' a1 c1 * \\<Gamma>')>\\<^sub>t\"\n        apply (rule cons_post_rule)\n        apply (solve_entails)\n        by (intro ent_star_mono hn_rel_compI[OF NF R'] hr_compI[OF R1] ent_refl)\n    qed\n  qed    \n\n  lemma hnr_comp1_aux:\n    assumes R: \"\\<And>b1 c1. P b1 \\<Longrightarrow> hn_refine (hn_ctxt R1 b1 c1) (c c1) (hn_ctxt R1p b1 c1) R (b$b1)\"\n    assumes S: \"\\<And>a1 b1. \\<lbrakk>Q a1; (b1,a1)\\<in>R1'\\<rbrakk> \\<Longrightarrow> (b$b1,a$a1)\\<in>\\<langle>R'\\<rangle>nres_rel\"\n    assumes PQ: \"\\<And>a1 b1. \\<lbrakk>Q a1; (b1,a1)\\<in>R1'\\<rbrakk> \\<Longrightarrow> P b1\"\n    assumes Q: \"Q a1\"\n    shows \"hn_refine \n      (hr_comp R1 R1' a1 c1) \n      (c c1)\n      (hr_comp R1p R1' a1 c1) \n      (hr_comp R R') \n      (a a1)\"\n    using assms hnr_comp[where \\<Gamma>=emp and \\<Gamma>'=emp and a=a and b=b and c=c and P=P and Q=Q]  \n    unfolding hn_ctxt_def\n    by auto\n\n  lemma hfcomp:\n    assumes A: \"(f,g) \\<in> [P]\\<^sub>a RR' \\<rightarrow> S\"\n    assumes B: \"(g,h) \\<in> [Q]\\<^sub>f T \\<rightarrow> \\<langle>U\\<rangle>nres_rel\"\n    shows \"(f,h) \\<in> [\\<lambda>a. Q a \\<and> (\\<forall>a'. (a',a)\\<in>T \\<longrightarrow> P a')]\\<^sub>a \n      hrp_comp RR' T \\<rightarrow> hr_comp S U\"\n    using assms  \n    unfolding fref_def hfref_def hrp_comp_def\n    apply clarsimp\n    apply (rule hnr_comp1_aux[of \n        P \"fst RR'\" f \"snd RR'\" S g \"\\<lambda>a. Q a \\<and> (\\<forall>a'. (a',a)\\<in>T \\<longrightarrow> P a')\" T h U])\n    apply (auto simp: hn_ctxt_def)\n    done\n\n  lemma hfref_weaken_pre_nofail: \n    assumes \"(f,g) \\<in> [P]\\<^sub>a R \\<rightarrow> S\"  \n    shows \"(f,g) \\<in> [\\<lambda>x. nofail (g x) \\<longrightarrow> P x]\\<^sub>a R \\<rightarrow> S\"\n    using assms\n    unfolding hfref_def hn_refine_def\n    by auto\n\n  lemma hfref_cons:\n    assumes \"(f,g) \\<in> [P]\\<^sub>a R \\<rightarrow> S\"\n    assumes \"\\<And>x. P' x \\<Longrightarrow> P x\"\n    assumes \"\\<And>x y. fst R' x y \\<Longrightarrow>\\<^sub>t fst R x y\"\n    assumes \"\\<And>x y. snd R x y \\<Longrightarrow>\\<^sub>t snd R' x y\"\n    assumes \"\\<And>x y. S x y \\<Longrightarrow>\\<^sub>t S' x y\"\n    shows \"(f,g) \\<in> [P']\\<^sub>a R' \\<rightarrow> S'\"\n    unfolding hfref_def\n    apply clarsimp\n    apply (rule hn_refine_cons)\n    apply (rule assms(3))\n    defer\n    apply (rule entt_trans[OF assms(4)]; sep_auto)\n    apply (rule assms(5))\n    apply (frule assms(2))\n    using assms(1)\n    unfolding hfref_def\n    apply auto\n    done\n\n  subsubsection \\<open>Composition Automation\\<close>  \n  text \\<open>This section contains the lemmas. The ML code is further down. \\<close>\n\n  lemma prod_hrp_comp: \n    \"hrp_comp (A *\\<^sub>a B) (C \\<times>\\<^sub>r D) = hrp_comp A C *\\<^sub>a hrp_comp B D\"\n    unfolding hrp_comp_def hfprod_def by simp\n  \n  lemma hrp_comp_keep: \"hrp_comp (A\\<^sup>k) B = (hr_comp A B)\\<^sup>k\"\n    by (auto simp: hrp_comp_def)\n\n  lemma hr_comp_invalid: \"hr_comp (invalid_assn R1) R2 = invalid_assn (hr_comp R1 R2)\"\n    apply (intro ent_iffI entailsI ext)\n    unfolding invalid_assn_def hr_comp_def\n    by auto\n\n  lemma hrp_comp_dest: \"hrp_comp (A\\<^sup>d) B = (hr_comp A B)\\<^sup>d\"\n    by (auto simp: hrp_comp_def hr_comp_invalid)\n\n\n\n  definition \"hrp_imp RR RR' \\<equiv> \n    \\<forall>a b. (fst RR' a b \\<Longrightarrow>\\<^sub>t fst RR a b) \\<and> (snd RR a b \\<Longrightarrow>\\<^sub>t snd RR' a b)\"\n\n  lemma hfref_imp: \"hrp_imp RR RR' \\<Longrightarrow> [P]\\<^sub>a RR \\<rightarrow> S \\<subseteq> [P]\\<^sub>a RR' \\<rightarrow> S\"  \n    apply clarsimp\n    apply (erule hfref_cons)\n    apply (simp_all add: hrp_imp_def)\n    done\n    \n  lemma hrp_imp_refl: \"hrp_imp RR RR\"\n    unfolding hrp_imp_def by auto\n\n  lemma hrp_imp_reflI: \"RR = RR' \\<Longrightarrow> hrp_imp RR RR'\"\n    unfolding hrp_imp_def by auto\n\n\n  lemma hrp_comp_cong: \"hrp_imp A A' \\<Longrightarrow> B=B' \\<Longrightarrow> hrp_imp (hrp_comp A B) (hrp_comp A' B')\"\n    by (sep_auto simp: hrp_imp_def hrp_comp_def hr_comp_def entailst_def)\n    \n  lemma hrp_prod_cong: \"hrp_imp A A' \\<Longrightarrow> hrp_imp B B' \\<Longrightarrow> hrp_imp (A*\\<^sub>aB) (A'*\\<^sub>aB')\"\n    by (sep_auto simp: hrp_imp_def prod_assn_def intro: entt_star_mono)\n\n  lemma hrp_imp_trans: \"hrp_imp A B \\<Longrightarrow> hrp_imp B C \\<Longrightarrow> hrp_imp A C\"  \n    unfolding hrp_imp_def\n    by (fastforce intro: entt_trans)\n\n  lemma fcomp_norm_dflt_init: \"x\\<in>[P]\\<^sub>a R \\<rightarrow> T \\<Longrightarrow> hrp_imp R S \\<Longrightarrow> x\\<in>[P]\\<^sub>a S \\<rightarrow> T\"\n    apply (erule rev_subsetD)\n    by (rule hfref_imp)\n\n  definition \"comp_PRE R P Q S \\<equiv> \\<lambda>x. S x \\<longrightarrow> (P x \\<and> (\\<forall>y. (y,x)\\<in>R \\<longrightarrow> Q x y))\"\n\n  lemma comp_PRE_cong[cong]: \n    assumes \"R\\<equiv>R'\"\n    assumes \"\\<And>x. P x \\<equiv> P' x\"\n    assumes \"\\<And>x. S x \\<equiv> S' x\"\n    assumes \"\\<And>x y. \\<lbrakk>P x; (y,x)\\<in>R; y\\<in>Domain R; S' x \\<rbrakk> \\<Longrightarrow> Q x y \\<equiv> Q' x y\"\n    shows \"comp_PRE R P Q S \\<equiv> comp_PRE R' P' Q' S'\"\n    using assms\n    by (fastforce simp: comp_PRE_def intro!: eq_reflection ext)\n\n  lemma fref_compI_PRE:\n    \"\\<lbrakk> (f,g)\\<in>fref P R1 R2; (g,h)\\<in>fref Q S1 S2 \\<rbrakk> \n      \\<Longrightarrow> (f,h) \\<in> fref (comp_PRE S1 Q (\\<lambda>_. P) (\\<lambda>_. True)) (R1 O S1) (R2 O S2)\"\n    using fref_compI[of P R1 R2 Q S1 S2]   \n    unfolding comp_PRE_def\n    by auto\n\n  lemma PRE_D1: \"(Q x \\<and> P x) \\<longrightarrow> comp_PRE S1 Q (\\<lambda>x _. P x) S x\"\n    by (auto simp: comp_PRE_def)\n\n  lemma PRE_D2: \"(Q x \\<and> (\\<forall>y. (y,x)\\<in>S1 \\<longrightarrow> S x \\<longrightarrow> P x y)) \\<longrightarrow> comp_PRE S1 Q P S x\"\n    by (auto simp: comp_PRE_def)\n\n  lemma fref_weaken_pre: \n    assumes \"\\<And>x. P x \\<longrightarrow> P' x\"  \n    assumes \"(f,h) \\<in> fref P' R S\"\n    shows \"(f,h) \\<in> fref P R S\"\n    apply (rule rev_subsetD[OF assms(2) fref_mono])\n    using assms(1) by auto\n    \n  lemma fref_PRE_D1:\n    assumes \"(f,h) \\<in> fref (comp_PRE S1 Q (\\<lambda>x _. P x) X) R S\"  \n    shows \"(f,h) \\<in> fref (\\<lambda>x. Q x \\<and> P x) R S\"\n    by (rule fref_weaken_pre[OF PRE_D1 assms])\n\n  lemma fref_PRE_D2:\n    assumes \"(f,h) \\<in> fref (comp_PRE S1 Q P X) R S\"  \n    shows \"(f,h) \\<in> fref (\\<lambda>x. Q x \\<and> (\\<forall>y. (y,x)\\<in>S1 \\<longrightarrow> X x \\<longrightarrow> P x y)) R S\"\n    by (rule fref_weaken_pre[OF PRE_D2 assms])\n\n  lemmas fref_PRE_D = fref_PRE_D1 fref_PRE_D2\n\n  lemma hfref_weaken_pre: \n    assumes \"\\<And>x. P x \\<longrightarrow> P' x\"  \n    assumes \"(f,h) \\<in> hfref P' R S\"\n    shows \"(f,h) \\<in> hfref P R S\"\n    using assms\n    by (auto simp: hfref_def)\n\n  lemma hfref_weaken_pre': \n    assumes \"\\<And>x. \\<lbrakk>P x; rdomp (fst R) x\\<rbrakk> \\<Longrightarrow> P' x\"  \n    assumes \"(f,h) \\<in> hfref P' R S\"\n    shows \"(f,h) \\<in> hfref P R S\"\n    apply (rule hfrefI)\n    apply (rule hn_refine_preI)\n    using assms\n    by (auto simp: hfref_def rdomp_def)\n\n  lemma hfref_weaken_pre_nofail': \n    assumes \"(f,g) \\<in> [P]\\<^sub>a R \\<rightarrow> S\"  \n    assumes \"\\<And>x. \\<lbrakk>nofail (g x); Q x\\<rbrakk> \\<Longrightarrow> P x\"\n    shows \"(f,g) \\<in> [Q]\\<^sub>a R \\<rightarrow> S\"\n    apply (rule hfref_weaken_pre[OF _ assms(1)[THEN hfref_weaken_pre_nofail]])\n    using assms(2) \n    by blast\n\n  lemma hfref_compI_PRE_aux:\n    assumes A: \"(f,g) \\<in> [P]\\<^sub>a RR' \\<rightarrow> S\"\n    assumes B: \"(g,h) \\<in> [Q]\\<^sub>f T \\<rightarrow> \\<langle>U\\<rangle>nres_rel\"\n    shows \"(f,h) \\<in> [comp_PRE T Q (\\<lambda>_. P) (\\<lambda>_. True)]\\<^sub>a \n      hrp_comp RR' T \\<rightarrow> hr_comp S U\"\n    apply (rule hfref_weaken_pre[OF _ hfcomp[OF A B]])\n    by (auto simp: comp_PRE_def)\n\n\n  lemma hfref_compI_PRE:\n    assumes A: \"(f,g) \\<in> [P]\\<^sub>a RR' \\<rightarrow> S\"\n    assumes B: \"(g,h) \\<in> [Q]\\<^sub>f T \\<rightarrow> \\<langle>U\\<rangle>nres_rel\"\n    shows \"(f,h) \\<in> [comp_PRE T Q (\\<lambda>x y. P y) (\\<lambda>x. nofail (h x))]\\<^sub>a \n      hrp_comp RR' T \\<rightarrow> hr_comp S U\"\n    using hfref_compI_PRE_aux[OF A B, THEN hfref_weaken_pre_nofail]  \n    apply (rule hfref_weaken_pre[rotated])\n    apply (auto simp: comp_PRE_def)\n    done\n\n  lemma hfref_PRE_D1:\n    assumes \"(f,h) \\<in> hfref (comp_PRE S1 Q (\\<lambda>x _. P x) X) R S\"  \n    shows \"(f,h) \\<in> hfref (\\<lambda>x. Q x \\<and> P x) R S\"\n    by (rule hfref_weaken_pre[OF PRE_D1 assms])\n\n  lemma hfref_PRE_D2:\n    assumes \"(f,h) \\<in> hfref (comp_PRE S1 Q P X) R S\"  \n    shows \"(f,h) \\<in> hfref (\\<lambda>x. Q x \\<and> (\\<forall>y. (y,x)\\<in>S1 \\<longrightarrow> X x \\<longrightarrow> P x y)) R S\"\n    by (rule hfref_weaken_pre[OF PRE_D2 assms])\n\n  lemma hfref_PRE_D3:\n    assumes \"(f,h) \\<in> hfref (comp_PRE S1 Q P X) R S\"  \n    shows \"(f,h) \\<in> hfref (comp_PRE S1 Q P X) R S\"\n    using assms .\n\n  lemmas hfref_PRE_D = hfref_PRE_D1 hfref_PRE_D3\n\n  subsection \\<open>Automation\\<close>  \n  text \\<open>Purity configuration for constraint solver\\<close>\n  lemmas [safe_constraint_rules] = pure_pure\n\n  text \\<open>Configuration for hfref to hnr conversion\\<close>\n  named_theorems to_hnr_post \\<open>to_hnr converter: Postprocessing unfold rules\\<close>\n\n  lemma uncurry0_add_app_tag: \"uncurry0 (RETURN c) = uncurry0 (RETURN$c)\" by simp\n\n  lemmas [to_hnr_post] = norm_RETURN_o norm_return_o\n    uncurry0_add_app_tag uncurry0_apply uncurry0_APP hn_val_unit_conv_emp\n    mult_1[of \"x::assn\" for x] mult_1_right[of \"x::assn\" for x]\n\n  named_theorems to_hfref_post \\<open>to_hfref converter: Postprocessing unfold rules\\<close> \n  lemma prod_casesK[to_hfref_post]: \"case_prod (\\<lambda>_ _. k) = (\\<lambda>_. k)\" by auto\n  lemma uncurry0_hfref_post[to_hfref_post]: \"hfref (uncurry0 True) R S = hfref (\\<lambda>_. True) R S\" \n    apply (fo_rule arg_cong fun_cong)+ by auto\n\n\n  (* Currently not used, we keep it in here anyway. *)  \n  text \\<open>Configuration for relation normalization after composition\\<close>\n  named_theorems fcomp_norm_unfold \\<open>fcomp-normalizer: Unfold theorems\\<close>\n  named_theorems fcomp_norm_simps \\<open>fcomp-normalizer: Simplification theorems\\<close>\n  named_theorems fcomp_norm_init \"fcomp-normalizer: Initialization rules\"  \n  named_theorems fcomp_norm_trans \"fcomp-normalizer: Transitivity rules\"  \n  named_theorems fcomp_norm_cong \"fcomp-normalizer: Congruence rules\"  \n  named_theorems fcomp_norm_norm \"fcomp-normalizer: Normalization rules\"  \n  named_theorems fcomp_norm_refl \"fcomp-normalizer: Reflexivity rules\"  \n\n  text \\<open>Default Setup\\<close>\n  lemmas [fcomp_norm_unfold] = prod_rel_comp nres_rel_comp Id_O_R R_O_Id\n  lemmas [fcomp_norm_unfold] = hr_comp_Id1 hr_comp_Id2\n  lemmas [fcomp_norm_unfold] = hr_comp_prod_conv\n  lemmas [fcomp_norm_unfold] = prod_hrp_comp hrp_comp_keep hrp_comp_dest hr_comp_pure\n  (*lemmas [fcomp_norm_unfold] = prod_casesK uncurry0_hfref_post*)\n\n  lemma [fcomp_norm_simps]: \"CONSTRAINT is_pure P \\<Longrightarrow> pure (the_pure P) = P\" by simp\n  lemmas [fcomp_norm_simps] = True_implies_equals \n\n  lemmas [fcomp_norm_init] = fcomp_norm_dflt_init\n  lemmas [fcomp_norm_trans] = hrp_imp_trans\n  lemmas [fcomp_norm_cong] = hrp_comp_cong hrp_prod_cong\n  (*lemmas [fcomp_norm_norm] = hrp_comp_dest*)\n  lemmas [fcomp_norm_refl] = refl hrp_imp_refl\n\n  lemma ensure_fref_nresI: \"(f,g)\\<in>[P]\\<^sub>f R\\<rightarrow>S \\<Longrightarrow> (RETURN o f, RETURN o g)\\<in>[P]\\<^sub>f R\\<rightarrow>\\<langle>S\\<rangle>nres_rel\" \n    by (auto intro: nres_relI simp: fref_def)\n\n  lemma ensure_fref_nres_unfold:\n    \"\\<And>f. RETURN o (uncurry0 f) = uncurry0 (RETURN f)\" \n    \"\\<And>f. RETURN o (uncurry f) = uncurry (RETURN oo f)\"\n    \"\\<And>f. (RETURN ooo uncurry) f = uncurry (RETURN ooo f)\"\n    by auto\n\n  text \\<open>Composed precondition normalizer\\<close>  \n  named_theorems fcomp_prenorm_simps \\<open>fcomp precondition-normalizer: Simplification theorems\\<close>\n\n  text \\<open>Support for preconditions of the form \\<open>_\\<in>Domain R\\<close>, \n    where \\<open>R\\<close> is the relation of the next more abstract level.\\<close>\n  declare DomainI[fcomp_prenorm_simps]\n\n  lemma auto_weaken_pre_init_hf: \n    assumes \"\\<And>x. PROTECT P x \\<longrightarrow> P' x\"  \n    assumes \"(f,h) \\<in> hfref P' R S\"\n    shows \"(f,h) \\<in> hfref P R S\"\n    using assms\n    by (auto simp: hfref_def)\n\n  lemma auto_weaken_pre_init_f: \n    assumes \"\\<And>x. PROTECT P x \\<longrightarrow> P' x\"  \n    assumes \"(f,h) \\<in> fref P' R S\"\n    shows \"(f,h) \\<in> fref P R S\"\n    using assms\n    by (auto simp: fref_def)\n\n  lemmas auto_weaken_pre_init = auto_weaken_pre_init_hf auto_weaken_pre_init_f  \n\n  lemma auto_weaken_pre_uncurry_step:\n    assumes \"PROTECT f a \\<equiv> f'\"\n    shows \"PROTECT (\\<lambda>(x,y). f x y) (a,b) \\<equiv> f' b\" \n    using assms\n    by (auto simp: curry_def dest!: meta_eq_to_obj_eq intro!: eq_reflection)\n\n  lemma auto_weaken_pre_uncurry_finish:  \n    \"PROTECT f x \\<equiv> f x\" by (auto)\n\n  lemma auto_weaken_pre_uncurry_start:\n    assumes \"P \\<equiv> P'\"\n    assumes \"P'\\<longrightarrow>Q\"\n    shows \"P\\<longrightarrow>Q\"\n    using assms by (auto)\n\n  \n\n  lemma auto_weaken_pre_to_imp_nf:\n    \"(A\\<longrightarrow>B\\<longrightarrow>C) = (A\\<and>B \\<longrightarrow> C)\"\n    \"((A\\<and>B)\\<and>C) = (A\\<and>B\\<and>C)\"\n    by auto\n\n  lemma auto_weaken_pre_add_dummy_imp:\n    \"P \\<Longrightarrow> True \\<longrightarrow> P\" by simp\n\n\n  text \\<open>Synthesis for hfref statements\\<close>  \n  definition hfsynth_ID_R :: \"('a \\<Rightarrow> _ \\<Rightarrow> assn) \\<Rightarrow> 'a \\<Rightarrow> bool\" where\n    [simp]: \"hfsynth_ID_R _ _ \\<equiv> True\"\n\n  lemma hfsynth_ID_R_D:\n    fixes I :: \"'a itself\"\n    assumes \"hfsynth_ID_R R a\"\n    assumes \"intf_of_assn R I\"\n    shows \"a ::\\<^sub>i I\"\n    by simp\n\n  lemma hfsynth_hnr_from_hfI:\n    assumes \"\\<forall>x xi. P x \\<and> hfsynth_ID_R (fst R) x \\<longrightarrow> hn_refine (emp * hn_ctxt (fst R) x xi) (f$xi) (emp * hn_ctxt (snd R) x xi) S (g$x)\"\n    shows \"(f,g) \\<in> [P]\\<^sub>a R \\<rightarrow> S\"\n    using assms\n    unfolding hfref_def \n    by (auto simp: hn_ctxt_def)\n\n\n  lemma hfsynth_ID_R_uncurry_unfold: \n    \"hfsynth_ID_R (to_hnr_prod R S) (a,b) \\<equiv> hfsynth_ID_R R a \\<and> hfsynth_ID_R S b\" \n    \"hfsynth_ID_R (fst (hf_pres R k)) \\<equiv> hfsynth_ID_R R\"\n    by (auto intro!: eq_reflection)\n\n  ML \\<open>\n\n    signature SEPREF_RULES = sig\n      (* Analysis of relations, both fref and fun_rel *)\n      (* \"R1\\<rightarrow>...\\<rightarrow>Rn\\<rightarrow>_\" / \"[_]\\<^sub>f ((R1\\<times>\\<^sub>rR2)...\\<times>\\<^sub>rRn)\"  \\<mapsto>  \"[R1,...,Rn]\" *)\n      val binder_rels: term -> term list \n      (* \"_\\<rightarrow>...\\<rightarrow>_\\<rightarrow>S\" / \"[_]\\<^sub>f _ \\<rightarrow> S\"  \\<mapsto>  \"S\" *)\n      val body_rel: term -> term \n      (* Map \\<rightarrow>/fref to (precond,args,res). NONE if no/trivial precond. *)\n      val analyze_rel: term -> term option * term list * term \n      (* Make trivial (\"\\<lambda>_. True\") precond *)\n      val mk_triv_precond: term list -> term \n      (* Make \"[P]\\<^sub>f ((R1\\<times>\\<^sub>rR2)...\\<times>\\<^sub>rRn) \\<rightarrow> S\". Insert trivial precond if NONE. *)\n      val mk_rel: term option * term list * term -> term \n      (* Map relation to (args,res) *)\n      val strip_rel: term -> term list * term \n\n      (* Make hfprod (op *\\<^sub>a) *)\n      val mk_hfprod : term * term -> term\n      val mk_hfprods : term list -> term\n\n      (* Determine interface type of refinement assertion, using default fallback\n        if necessary. Use named_thms intf_of_assn for configuration. *)\n      val intf_of_assn : Proof.context -> term -> typ\n\n      (*\n        Convert a parametricity theorem in higher-order form to\n        uncurried fref-form. For functions without arguments, \n        a unit-argument is added.\n\n        TODO/FIXME: Currently this only works for higher-order theorems,\n          i.e., theorems of the form (f,g)\\<in>R1\\<rightarrow>\\<dots>\\<rightarrow>Rn. \n          \n          First-order theorems are silently treated as refinement theorems\n          for functions with zero arguments, i.e., a unit-argument is added.\n      *)\n      val to_fref : Proof.context -> thm -> thm\n\n      (* Convert a parametricity or fref theorem to first order form *)\n      val to_foparam : Proof.context -> thm -> thm\n\n      (* Convert schematic hfref goal to hnr-goal *)\n      val prepare_hfref_synth_tac : Proof.context -> tactic'\n\n      (* Convert theorem in hfref-form to hnr-form *)\n      val to_hnr : Proof.context -> thm -> thm\n\n      (* Convert theorem in hnr-form to hfref-form *)\n      val to_hfref: Proof.context -> thm -> thm\n\n      (* Convert theorem to given form, if not yet in this form *)\n      val ensure_fref : Proof.context -> thm -> thm\n      val ensure_fref_nres : Proof.context -> thm -> thm\n      val ensure_hfref : Proof.context -> thm -> thm\n      val ensure_hnr : Proof.context -> thm -> thm\n\n\n      type hnr_analysis = {\n        thm: thm,                     (* Original theorem, may be normalized *)\n        precond: term,                (* Precondition, abstracted over abs-arguments *)\n        prems : term list,            (* Premises not depending on arguments *)\n        ahead: term * bool,           (* Abstract function, has leading RETURN *)\n        chead: term * bool,           (* Concrete function, has leading return *)\n        argrels: (term * bool) list,  (* Argument relations, preserved (keep-flag) *)\n        result_rel: term              (* Result relation *)\n      }\n  \n      val analyze_hnr: Proof.context -> thm -> hnr_analysis\n      val pretty_hnr_analysis: Proof.context -> hnr_analysis -> Pretty.T\n      val mk_hfref_thm: Proof.context -> hnr_analysis -> thm\n  \n  \n\n      (* Simplify precondition of fref/hfref-theorem *)\n      val simplify_precond: Proof.context -> thm -> thm\n\n      (* Normalize hfref-theorem after composition *)\n      val norm_fcomp_rule: Proof.context -> thm -> thm\n\n      (* Replace \"pure ?A\" by \"?A'\" and is_pure constraint, then normalize *)\n      val add_pure_constraints_rule: Proof.context -> thm -> thm\n\n      (* Compose fref/hfref and fref theorem, to produce hfref theorem.\n        The input theorems may also be in ho-param or hnr form, and\n        are converted accordingly.\n      *)\n      val gen_compose : Proof.context -> thm -> thm -> thm\n\n      (* FCOMP-attribute *)\n      val fcomp_attrib: attribute context_parser\n    end\n\n    structure Sepref_Rules: SEPREF_RULES = struct\n\n      local open Refine_Util Relators in\n        fun binder_rels @{mpat \"?F \\<rightarrow> ?G\"} = F::binder_rels G\n          | binder_rels @{mpat \"fref _ ?F _\"} = strip_prodrel_left F\n          | binder_rels _ = []\n    \n        local \n          fun br_aux @{mpat \"_ \\<rightarrow> ?G\"} = br_aux G\n            | br_aux R = R\n        in    \n          fun body_rel @{mpat \"fref _ _ ?G\"} = G\n            | body_rel R = br_aux R\n        end\n    \n        fun strip_rel R = (binder_rels R, body_rel R)   \n    \n        fun analyze_rel @{mpat \"fref (\\<lambda>_. True) ?R ?S\"} = (NONE,strip_prodrel_left R,S)\n          | analyze_rel @{mpat \"fref ?P ?R ?S\"} = (SOME P,strip_prodrel_left R,S)\n          | analyze_rel R = let\n              val (args,res) = strip_rel R\n            in\n              (NONE,args,res)\n            end\n    \n        fun mk_triv_precond Rs = absdummy (map rel_absT Rs |> list_prodT_left) @{term True}\n    \n        fun mk_rel (P,Rs,S) = let \n          val R = list_prodrel_left Rs \n    \n          val P = case P of \n              SOME P => P \n            | NONE => mk_triv_precond Rs\n    \n        in \n          @{mk_term \"fref ?P ?R ?S\"} \n        end\n      end\n\n\n      fun mk_hfprod (a, b) = @{mk_term \"?a*\\<^sub>a?b\"}\n  \n      local \n        fun mk_hfprods_rev [] = @{mk_term \"unit_assn\\<^sup>k\"}\n          | mk_hfprods_rev [Rk] = Rk\n          | mk_hfprods_rev (Rkn::Rks) = mk_hfprod (mk_hfprods_rev Rks, Rkn)\n      in\n        val mk_hfprods = mk_hfprods_rev o rev\n      end\n\n\n      fun intf_of_assn ctxt t = let\n        val orig_ctxt = ctxt\n        val (t,ctxt) = yield_singleton (Variable.import_terms false) t ctxt\n\n        val v = TVar ((\"T\",0),Proof_Context.default_sort ctxt (\"T\",0)) |> Logic.mk_type\n        val goal = @{mk_term \"Trueprop (intf_of_assn ?t ?v)\"}\n\n        val i_of_assn_rls = \n          Named_Theorems_Rev.get ctxt @{named_theorems_rev intf_of_assn}\n          @ @{thms intf_of_assn_fallback}\n\n        fun tac ctxt = REPEAT_ALL_NEW (resolve_tac ctxt i_of_assn_rls)\n\n        val thm = Goal.prove ctxt [] [] goal (fn {context,...} => ALLGOALS (tac context))\n        val intf = case Thm.concl_of thm of\n            @{mpat \"Trueprop (intf_of_assn _ (?v AS\\<^sub>p TYPE (_)))\"} => v \n          | _ => raise THM(\"Intf_of_assn: Proved a different theorem?\",~1,[thm])\n\n        val intf = singleton (Variable.export_terms ctxt orig_ctxt) intf\n          |> Logic.dest_type\n\n      in\n        intf\n      end\n\n      datatype rthm_type = \n        RT_HOPARAM    (* (_,_) \\<in> _ \\<rightarrow> \\<dots> \\<rightarrow> _ *)\n      | RT_FREF       (* (_,_) \\<in> [_]\\<^sub>f _ \\<rightarrow> _ *)\n      | RT_HNR        (* hn_refine _ _ _ _ _ *)\n      | RT_HFREF      (* (_,_) \\<in> [_]\\<^sub>a _ \\<rightarrow> _ *)\n      | RT_OTHER\n\n      fun rthm_type thm =\n        case Thm.concl_of thm |> HOLogic.dest_Trueprop of\n          @{mpat \"(_,_) \\<in> fref _ _ _\"} => RT_FREF\n        | @{mpat \"(_,_) \\<in> hfref _ _ _\"} => RT_HFREF\n        | @{mpat \"hn_refine _ _ _ _ _\"} => RT_HNR\n        | @{mpat \"(_,_) \\<in> _\"} => RT_HOPARAM (* TODO: Distinction between ho-param and fo-param *)\n        | _ => RT_OTHER\n\n\n      fun to_fref ctxt thm = let\n        open Conv\n      in  \n        case Thm.concl_of thm |> HOLogic.dest_Trueprop of\n          @{mpat \"(_,_)\\<in>_\\<rightarrow>_\"} =>\n            Local_Defs.unfold0 ctxt @{thms fref_param1} thm\n            |> fconv_rule (repeat_conv (Refine_Util.ftop_conv (K (rewr_conv @{thm fref_nest})) ctxt))\n            |> Local_Defs.unfold0 ctxt @{thms in_CURRY_conv}\n        | @{mpat \"(_,_)\\<in>_\"} => thm RS @{thm fref_param0I}   \n        | _ => raise THM (\"to_fref: Expected theorem of form (_,_)\\<in>_\",~1,[thm])\n      end\n\n      fun to_foparam ctxt thm = let\n        val unf_thms = @{thms \n          split_tupled_all prod_rel_simp uncurry_apply cnv_conj_to_meta Product_Type.split}\n      in\n        case Thm.concl_of thm of\n          @{mpat \"Trueprop ((_,_) \\<in> fref _ _ _)\"} =>\n            (@{thm frefD} OF [thm])\n            |> forall_intr_vars\n            |> Local_Defs.unfold0 ctxt unf_thms\n            |> Variable.gen_all ctxt\n        | @{mpat \"Trueprop ((_,_) \\<in> _)\"} =>\n            Parametricity.fo_rule thm\n        | _ => raise THM(\"Expected parametricity or fref theorem\",~1,[thm])\n      end\n\n      fun to_hnr ctxt thm =\n        (thm RS @{thm hf2hnr})\n        |> Local_Defs.unfold0 ctxt @{thms to_hnr_prod_fst_snd keep_drop_sels} (* Resolve fst and snd over *\\<^sub>a and R\\<^sup>k, R\\<^sup>d *)\n        |> Local_Defs.unfold0 ctxt @{thms hnr_uncurry_unfold} (* Resolve products for uncurried parameters *)\n        |> Local_Defs.unfold0 ctxt @{thms uncurry_apply uncurry_APP assn_one_left split} (* Remove the uncurry modifiers, the emp-dummy, and unfold product cases *)\n        |> Local_Defs.unfold0 ctxt @{thms hn_ctxt_ctxt_fix_conv} (* Remove duplicate hn_ctxt tagging *)\n        |> Local_Defs.unfold0 ctxt @{thms all_to_meta imp_to_meta HOL.True_implies_equals HOL.implies_True_equals Pure.triv_forall_equality cnv_conj_to_meta} (* Convert to meta-level, remove vacuous condition *)\n        |> Local_Defs.unfold0 ctxt (Named_Theorems.get ctxt @{named_theorems to_hnr_post}) (* Post-Processing *)\n        |> Goal.norm_result ctxt\n        |> Conv.fconv_rule Thm.eta_conversion\n\n      (* Convert schematic hfref-goal to hn_refine goal *)  \n      fun prepare_hfref_synth_tac ctxt = let\n        val i_of_assn_rls = \n          Named_Theorems_Rev.get ctxt @{named_theorems_rev intf_of_assn}\n          @ @{thms intf_of_assn_fallback}\n\n        val to_hnr_post_rls = \n          Named_Theorems.get ctxt @{named_theorems to_hnr_post}\n\n        val i_of_assn_tac = (\n          REPEAT' (\n            DETERM o dresolve_tac ctxt @{thms hfsynth_ID_R_D}\n            THEN' DETERM o SOLVED' (REPEAT_ALL_NEW (resolve_tac ctxt i_of_assn_rls))\n          )\n        )\n      in\n        (* Note: To re-use the to_hnr infrastructure, we first work with\n          $-tags on the abstract function, which are finally removed.\n        *)\n        resolve_tac ctxt @{thms hfsynth_hnr_from_hfI} THEN_ELSE' (\n          SELECT_GOAL (\n            unfold_tac ctxt @{thms to_hnr_prod_fst_snd keep_drop_sels hf_pres_fst} (* Distribute fst,snd over product and hf_pres *)\n            THEN unfold_tac ctxt @{thms hnr_uncurry_unfold hfsynth_ID_R_uncurry_unfold} (* Curry parameters *)\n            THEN unfold_tac ctxt @{thms uncurry_apply uncurry_APP assn_one_left split} (* Curry parameters (II) and remove emp assertion *)\n            (*THEN unfold_tac ctxt @{thms hn_ctxt_ctxt_fix_conv} (* Remove duplicate hn_ctxt (Should not be necessary) *)*)\n            THEN unfold_tac ctxt @{thms all_to_meta imp_to_meta HOL.True_implies_equals HOL.implies_True_equals Pure.triv_forall_equality cnv_conj_to_meta} (* Convert precondition to meta-level *)\n            THEN ALLGOALS i_of_assn_tac (* Generate _::\\<^sub>i_ premises*)\n            THEN unfold_tac ctxt to_hnr_post_rls (* Postprocessing *)\n            THEN unfold_tac ctxt @{thms APP_def} (* Get rid of $ - tags *)\n          )\n        ,\n          K all_tac\n        )\n      end\n\n\n      (************************************)  \n      (* Analyze hnr *)\n      structure Termtab2 = Table(\n        type key = term * term \n        val ord = prod_ord Term_Ord.fast_term_ord Term_Ord.fast_term_ord);\n  \n      type hnr_analysis = {\n        thm: thm,                     \n        precond: term,                \n        prems : term list,\n        ahead: term * bool,           \n        chead: term * bool,           \n        argrels: (term * bool) list,  \n        result_rel: term              \n      }\n  \n    \n      fun analyze_hnr (ctxt:Proof.context) thm = let\n    \n        (* Debug information: Stores string*term pairs, which are pretty-printed on error *)\n        val dbg = Unsynchronized.ref []\n        fun add_dbg msg ts = (\n          dbg := (msg,ts) :: !dbg;\n          ()\n        )\n        fun pretty_dbg (msg,ts) = Pretty.block [\n          Pretty.str msg,\n          Pretty.str \":\",\n          Pretty.brk 1,\n          Pretty.list \"[\" \"]\" (map (Syntax.pretty_term ctxt) ts)\n        ]\n        fun pretty_dbgs l = map pretty_dbg l |> Pretty.fbreaks |> Pretty.block\n    \n        fun trace_dbg msg = Pretty.block [Pretty.str msg, Pretty.fbrk, pretty_dbgs (rev (!dbg))] |> Pretty.string_of |> tracing\n    \n        fun fail msg = (trace_dbg msg; raise THM(msg,~1,[thm])) \n        fun assert cond msg = cond orelse fail msg;\n    \n    \n        (* Heads may have a leading return/RETURN.\n          The following code strips off the leading return, unless it has the form\n          \"return x\" for an argument x\n        *)\n        fun check_strip_leading args t f = (* Handle the case RETURN x, where x is an argument *)\n          if Termtab.defined args f then (t,false) else (f,true)\n    \n        fun strip_leading_RETURN args (t as @{mpat \"RETURN$(?f)\"}) = check_strip_leading args t f\n          | strip_leading_RETURN args (t as @{mpat \"RETURN ?f\"}) = check_strip_leading args t f\n          | strip_leading_RETURN _ t = (t,false)\n    \n        fun strip_leading_return args (t as @{mpat \"return$(?f)\"}) = check_strip_leading args t f\n            | strip_leading_return args (t as @{mpat \"return ?f\"}) = check_strip_leading args t f\n            | strip_leading_return _ t = (t,false)\n    \n    \n        (* The following code strips the arguments of the concrete or abstract\n          function. It knows how to handle APP-tags ($), and stops at PR_CONST-tags.\n    \n          Moreover, it only strips actual arguments that occur in the \n          precondition-section of the hn_refine-statement. This ensures\n          that non-arguments, like maxsize, are treated correctly.\n        *)    \n        fun strip_fun _ (t as @{mpat \"PR_CONST _\"}) = (t,[])\n          | strip_fun s (t as @{mpat \"?f$?x\"}) = check_arg s t f x\n          | strip_fun s (t as @{mpat \"?f ?x\"}) = check_arg s t f x\n          | strip_fun _ f = (f,[])\n        and check_arg s t f x = \n            if Termtab.defined s x then\n              strip_fun s f |> apsnd (curry op :: x)\n            else (t,[])  \n    \n        (* Arguments in the pre/postcondition are wrapped into hn_ctxt tags. \n          This function strips them off. *)    \n        fun dest_hn_ctxt @{mpat \"hn_ctxt ?R ?a ?c\"} = ((a,c),R)\n          | dest_hn_ctxt _ = fail \"Invalid hn_ctxt parameter in pre or postcondition\"\n    \n    \n        fun dest_hn_refine @{mpat \"(hn_refine ?G ?c ?G' ?R ?a)\"} = (G,c,G',R,a) \n          | dest_hn_refine _ = fail \"Conclusion is not a hn_refine statement\"\n    \n        (*\n          Strip separation conjunctions. Special case for \"emp\", which is ignored. \n        *)  \n        fun is_emp @{mpat emp} = true | is_emp _ = false\n  \n        val strip_star' = Sepref_Basic.strip_star #> filter (not o is_emp)\n  \n        (* Compare Termtab2s for equality of keys *)  \n        fun pairs_eq pairs1 pairs2 = \n                  Termtab2.forall (Termtab2.defined pairs1 o fst) pairs2\n          andalso Termtab2.forall (Termtab2.defined pairs2 o fst) pairs1\n    \n    \n        fun atomize_prem @{mpat \"Trueprop ?p\"} = p\n          | atomize_prem _ = fail \"Non-atomic premises\"\n    \n        (* Make HOL conjunction list *)  \n        fun mk_conjs [] = @{const True}\n          | mk_conjs [p] = p\n          | mk_conjs (p::ps) = HOLogic.mk_binop @{const_name \"HOL.conj\"} (p,mk_conjs ps)\n    \n    \n        (***********************)      \n        (* Start actual analysis *)\n    \n        val _ = add_dbg \"thm\" [Thm.prop_of thm]\n        val prems = Thm.prems_of thm\n        val concl = Thm.concl_of thm |> HOLogic.dest_Trueprop\n        val (G,c,G',R,a) = dest_hn_refine concl\n    \n        val pre_pairs = G \n          |> strip_star'\n          |> tap (add_dbg \"precondition\")\n          |> map dest_hn_ctxt\n          |> Termtab2.make\n    \n        val post_pairs = G' \n          |> strip_star'\n          |> tap (add_dbg \"postcondition\")\n          |> map dest_hn_ctxt\n          |> Termtab2.make\n    \n        val _ = assert (pairs_eq pre_pairs post_pairs) \n          \"Parameters in precondition do not match postcondition\"\n    \n        val aa_set = pre_pairs |> Termtab2.keys |> map fst |> Termtab.make_set\n        val ca_set = pre_pairs |> Termtab2.keys |> map snd |> Termtab.make_set\n    \n        val (a,leading_RETURN) = strip_leading_RETURN aa_set a\n        val (c,leading_return) = strip_leading_return ca_set c\n    \n        val _ = add_dbg \"stripped abstract term\" [a]\n        val _ = add_dbg \"stripped concrete term\" [c]\n    \n        val (ahead,aargs) = strip_fun aa_set a;\n        val (chead,cargs) = strip_fun ca_set c;\n    \n        val _ = add_dbg \"abstract head\" [ahead]\n        val _ = add_dbg \"abstract args\" aargs\n        val _ = add_dbg \"concrete head\" [chead]\n        val _ = add_dbg \"concrete args\" cargs\n    \n    \n        val _ = assert (length cargs = length aargs) \"Different number of abstract and concrete arguments\";\n    \n        val _ = assert (not (has_duplicates op aconv aargs)) \"Duplicate abstract arguments\"\n        val _ = assert (not (has_duplicates op aconv cargs)) \"Duplicate concrete arguments\"\n    \n        val argpairs = aargs ~~ cargs\n        val ap_set = Termtab2.make_set argpairs\n        val _ = assert (pairs_eq pre_pairs ap_set) \"Arguments from pre/postcondition do not match operation's arguments\"\n    \n        val pre_rels = map (the o (Termtab2.lookup pre_pairs)) argpairs\n        val post_rels = map (the o (Termtab2.lookup post_pairs)) argpairs\n    \n        val _ = add_dbg \"pre-rels\" pre_rels\n        val _ = add_dbg \"post-rels\" post_rels\n\n        fun adjust_hf_pres @{mpat \"snd (?R\\<^sup>k)\"} = R\n          | adjust_hf_pres t = t\n          \n        val post_rels = map adjust_hf_pres post_rels\n    \n        fun is_invalid R @{mpat \"invalid_assn ?R'\"} = R aconv R'\n          | is_invalid _ @{mpat \"snd (_\\<^sup>d)\"} = true\n          | is_invalid _ _ = false\n    \n        fun is_keep (R,R') =\n          if R aconv R' then true\n          else if is_invalid R R' then false\n          else fail \"Mismatch between pre and post relation for argument\"\n    \n        val keep = map is_keep (pre_rels ~~ post_rels)\n    \n        val argrels = pre_rels ~~ keep\n\n        val aa_set = Termtab.make_set aargs\n        val ca_set = Termtab.make_set cargs\n\n        fun is_precond t =\n          (exists_subterm (Termtab.defined ca_set) t andalso fail \"Premise contains concrete argument\")\n          orelse exists_subterm (Termtab.defined aa_set) t\n\n        val (preconds, prems) = split is_precond prems  \n    \n        val precond = \n          map atomize_prem preconds \n          |> mk_conjs\n          |> fold lambda aargs\n    \n        val _ = add_dbg \"precond\" [precond]\n        val _ = add_dbg \"prems\" prems\n    \n      in\n        {\n          thm = thm,\n          precond = precond,\n          prems = prems,\n          ahead = (ahead,leading_RETURN),\n          chead = (chead,leading_return),\n          argrels = argrels,\n          result_rel = R\n        }\n      end  \n    \n      fun pretty_hnr_analysis \n        ctxt \n        ({thm,precond,ahead,chead,argrels,result_rel,...}) \n        : Pretty.T =\n      let  \n        val _ = thm (* Suppress unused warning for thm *)\n\n        fun pretty_argrel (R,k) = Pretty.block [\n          Syntax.pretty_term ctxt R,\n          if k then Pretty.str \"\\<^sup>k\" else Pretty.str \"\\<^sup>d\"\n        ]\n    \n        val pretty_chead = case chead of \n          (t,false) => Syntax.pretty_term ctxt t \n        | (t,true) => Pretty.block [Pretty.str \"return \", Syntax.pretty_term ctxt t]\n\n        val pretty_ahead = case ahead of \n          (t,false) => Syntax.pretty_term ctxt t \n        | (t,true) => Pretty.block [Pretty.str \"RETURN \", Syntax.pretty_term ctxt t]\n\n      in\n        Pretty.fbreaks [\n          (*Display.pretty_thm ctxt thm,*)\n          Pretty.block [ \n            Pretty.enclose \"[\" \"]\" [pretty_chead, pretty_ahead],\n            Pretty.enclose \"[\" \"]\" [Syntax.pretty_term ctxt precond],\n            Pretty.brk 1,\n            Pretty.block (Pretty.separate \" \\<rightarrow>\" (map pretty_argrel argrels @ [Syntax.pretty_term ctxt result_rel]))\n          ]\n        ] |> Pretty.block\n    \n      end\n    \n    \n      fun mk_hfref_thm \n        ctxt \n        ({thm,precond,prems,ahead,chead,argrels,result_rel}) = \n      let\n    \n        fun mk_keep (R,true) = @{mk_term \"?R\\<^sup>k\"}\n          | mk_keep (R,false) = @{mk_term \"?R\\<^sup>d\"}\n    \n        (* TODO: Move, this is of general use! *)  \n        fun mk_uncurry f = @{mk_term \"uncurry ?f\"}  \n      \n        (* Uncurry function for the given number of arguments. \n          For zero arguments, add a unit-parameter.\n        *)\n        fun rpt_uncurry n t =\n          if n=0 then @{mk_term \"uncurry0 ?t\"}\n          else if n=1 then t \n          else funpow (n-1) mk_uncurry t\n      \n        (* Rewrite uncurried lambda's to \\<lambda>(_,_). _ form. Use top-down rewriting\n          to correctly handle nesting to the left. \n    \n          TODO: Combine with abstraction and  uncurry-procedure,\n            and mark the deviation about uncurry as redundant \n            intermediate step to be eliminated.\n        *)  \n        fun rew_uncurry_lambda t = let\n          val rr = map (Logic.dest_equals o Thm.prop_of) @{thms uncurry_def uncurry0_def}\n          val thy = Proof_Context.theory_of ctxt\n        in \n          Pattern.rewrite_term_top thy rr [] t \n        end  \n    \n        (* Shortcuts for simplification tactics *)\n        fun gsimp_only ctxt sec = let\n          val ss = put_simpset HOL_basic_ss ctxt |> sec\n        in asm_full_simp_tac ss end\n    \n        fun simp_only ctxt thms = gsimp_only ctxt (fn ctxt => ctxt addsimps thms)\n    \n    \n        (********************************)\n        (* Build theorem statement *)\n        (* \\<lbrakk>prems\\<rbrakk> \\<Longrightarrow> (chead,ahead) \\<in> [precond] rels \\<rightarrow> R *)\n    \n        (* Uncurry precondition *)\n        val num_args = length argrels\n        val precond = precond\n          |> rpt_uncurry num_args\n          |> rew_uncurry_lambda (* Convert to nicer \\<lambda>((...,_),_) - form*)\n\n        (* Re-attach leading RETURN/return *)\n        fun mk_RETURN (t,r) = if r then \n            let\n              val T = funpow num_args range_type (fastype_of (fst ahead))\n              val tRETURN = Const (@{const_name RETURN}, T --> Type(@{type_name nres},[T]))\n            in\n              Refine_Util.mk_compN num_args tRETURN t\n            end  \n          else t\n    \n        fun mk_return (t,r) = if r then \n            let\n              val T = funpow num_args range_type (fastype_of (fst chead))\n              val tRETURN = Const (@{const_name return}, T --> Type(@{type_name Heap},[T]))\n            in\n              Refine_Util.mk_compN num_args tRETURN t\n            end  \n          else t\n          \n        (* Hrmpf!: Gone for good from 2015\\<rightarrow>2016. Inserting ctxt-based substitute here. *)  \n        fun certify_inst ctxt (instT, inst) =\n         (map (apsnd (Thm.ctyp_of ctxt)) instT,\n          map (apsnd (Thm.cterm_of ctxt)) inst);\n\n        (*  \n        fun mk_RETURN (t,r) = if r then @{mk_term \"RETURN o ?t\"} else t\n        fun mk_return (t,r) = if r then @{mk_term \"return o ?t\"} else t\n        *)\n    \n        (* Uncurry abstract and concrete function, append leading return *)\n        val ahead = ahead |> mk_RETURN |> rpt_uncurry num_args  \n        val chead = chead |> mk_return |> rpt_uncurry num_args \n    \n        (* Add keep-flags and summarize argument relations to product *)\n        val argrel = map mk_keep argrels |> rev (* TODO: Why this rev? *) |> mk_hfprods\n    \n        (* Produce final result statement *)\n        val result = @{mk_term \"Trueprop ((?chead,?ahead) \\<in> [?precond]\\<^sub>a ?argrel \\<rightarrow> ?result_rel)\"}\n        val result = Logic.list_implies (prems,result)\n    \n        (********************************)\n        (* Prove theorem *)\n    \n        (* Create context and import result statement and original theorem *)\n        val orig_ctxt = ctxt\n        (*val thy = Proof_Context.theory_of ctxt*)\n        val (insts, ctxt) = Variable.import_inst true [result] ctxt\n        val insts' = certify_inst ctxt insts\n        val result = Term_Subst.instantiate insts result\n        val thm = Thm.instantiate insts' thm\n    \n        (* Unfold APP tags. This is required as some APP-tags have also been unfolded by analysis *)\n        val thm = Local_Defs.unfold0 ctxt @{thms APP_def} thm\n    \n        (* Tactic to prove the theorem. \n          A first step uses hfrefI to get a hnr-goal.\n          This is then normalized in several consecutive steps, which \n            get rid of uncurrying. Finally, the original theorem is used for resolution,\n            where the pre- and postcondition, and result relation are connected with \n            a consequence rule, to handle unfolded hn_ctxt-tags, re-ordered relations,\n            and introduced unit-parameters (TODO: \n              Mark artificially introduced unit-parameter specially, it may get confused \n              with intentional unit-parameter, e.g., functional empty_set ()!)\n    \n          *)\n        fun tac ctxt = \n                resolve_tac ctxt @{thms hfrefI}\n          THEN' gsimp_only ctxt (fn c => c \n            addsimps @{thms uncurry_def hn_ctxt_def uncurry0_def\n                            keep_drop_sels uc_hfprod_sel o_apply\n                            APP_def}\n            |> Splitter.add_split @{thm prod.split}\n          ) \n    \n          THEN' TRY o (\n            REPEAT_ALL_NEW (match_tac ctxt @{thms allI impI})\n            THEN' simp_only ctxt @{thms Product_Type.split prod.inject})\n    \n          THEN' TRY o REPEAT_ALL_NEW (ematch_tac ctxt @{thms conjE})\n          THEN' TRY o hyp_subst_tac ctxt\n          THEN' simp_only ctxt @{thms triv_forall_equality}\n          THEN' (\n            resolve_tac ctxt @{thms hn_refine_cons[rotated]} \n            THEN' (resolve_tac ctxt [thm] THEN_ALL_NEW assume_tac ctxt))\n          THEN_ALL_NEW simp_only ctxt \n            @{thms hn_ctxt_def entt_refl pure_unit_rel_eq_empty\n              mult_ac mult_1 mult_1_right keep_drop_sels}  \n    \n        (* Prove theorem *)  \n        val result = Thm.cterm_of ctxt result\n        val rthm = Goal.prove_internal ctxt [] result (fn _ => ALLGOALS (tac ctxt))\n    \n        (* Export statement to original context *)\n        val rthm = singleton (Variable.export ctxt orig_ctxt) rthm\n    \n        (* Post-processing *)\n        val rthm = Local_Defs.unfold0 ctxt (Named_Theorems.get ctxt @{named_theorems to_hfref_post}) rthm\n\n      in\n        rthm\n      end\n  \n      fun to_hfref ctxt = analyze_hnr ctxt #> mk_hfref_thm ctxt\n\n\n\n\n      (***********************************)\n      (* Composition *)\n\n      local\n        fun norm_set_of ctxt = {\n          trans_rules = Named_Theorems.get ctxt @{named_theorems fcomp_norm_trans},\n          cong_rules = Named_Theorems.get ctxt @{named_theorems fcomp_norm_cong},\n          norm_rules = Named_Theorems.get ctxt @{named_theorems fcomp_norm_norm},\n          refl_rules = Named_Theorems.get ctxt @{named_theorems fcomp_norm_refl}\n        }\n    \n        fun init_rules_of ctxt = Named_Theorems.get ctxt @{named_theorems fcomp_norm_init}\n        fun unfold_rules_of ctxt = Named_Theorems.get ctxt @{named_theorems fcomp_norm_unfold}\n        fun simp_rules_of ctxt = Named_Theorems.get ctxt @{named_theorems fcomp_norm_simps}\n\n      in  \n        fun norm_fcomp_rule ctxt = let\n          open PO_Normalizer Refine_Util\n          val norm1 = gen_norm_rule (init_rules_of ctxt) (norm_set_of ctxt) ctxt\n          val norm2 = Local_Defs.unfold0 ctxt (unfold_rules_of ctxt)\n          val norm3 = Conv.fconv_rule (\n            Simplifier.asm_full_rewrite \n              (put_simpset HOL_basic_ss ctxt addsimps simp_rules_of ctxt))\n    \n          val norm = changed_rule (try_rule norm1 o try_rule norm2 o try_rule norm3)\n        in\n          repeat_rule norm\n        end\n      end  \n\n      fun add_pure_constraints_rule ctxt thm = let\n        val orig_ctxt = ctxt\n    \n        val t = Thm.prop_of thm\n    \n        fun \n          cnv (@{mpat (typs) \"pure (mpaq_STRUCT (mpaq_Var ?x _) :: (?'v_c\\<times>?'v_a) set)\"}) = \n          let\n            val T = a --> c --> @{typ assn}\n            val t = Var (x,T)\n            val t = @{mk_term \"(the_pure ?t)\"}\n          in\n            [(x,T,t)]\n          end\n        | cnv (t$u) = union op= (cnv t) (cnv u)\n        | cnv (Abs (_,_,t)) = cnv t  \n        | cnv _ = []\n    \n        val pvars = cnv t\n    \n        val _ = (pvars |> map #1 |> has_duplicates op=) \n          andalso raise TERM (\"Duplicate indexname with different type\",[t]) (* This should not happen *)\n    \n        val substs = map (fn (x,_,t) => (x,t)) pvars\n    \n        val t' = subst_Vars substs t  \n    \n        fun mk_asm (x,T,_) = let\n          val t = Var (x,T)\n          val t = @{mk_term \"Trueprop (CONSTRAINT is_pure ?t)\"}\n        in\n          t\n        end\n    \n        val assms = map mk_asm pvars\n    \n        fun add_prems prems t = let\n          val prems' = Logic.strip_imp_prems t\n          val concl = Logic.strip_imp_concl t\n        in\n          Logic.list_implies (prems@prems', concl)\n        end\n    \n        val t' = add_prems assms t'\n    \n        val (t',ctxt) = yield_singleton (Variable.import_terms true) t' ctxt\n    \n        val thm' = Goal.prove_internal ctxt [] (Thm.cterm_of ctxt t') (fn _ => \n          ALLGOALS (resolve_tac ctxt [thm] THEN_ALL_NEW assume_tac ctxt))\n    \n        val thm' = norm_fcomp_rule ctxt thm'\n\n        val thm' = singleton (Variable.export ctxt orig_ctxt) thm'\n      in\n        thm'\n      end  \n\n\n      val cfg_simp_precond = \n        Attrib.setup_config_bool @{binding fcomp_simp_precond} (K true)\n\n      local\n        fun mk_simp_thm ctxt t = let\n          val st = t\n            |> HOLogic.mk_Trueprop\n            |> Thm.cterm_of ctxt\n            |> Goal.init\n      \n          val ctxt = Context_Position.set_visible false ctxt  \n          val ctxt = ctxt addsimps (\n              refine_pw_simps.get ctxt \n            @ Named_Theorems.get ctxt @{named_theorems fcomp_prenorm_simps}\n            @ @{thms split_tupled_all cnv_conj_to_meta}  \n            )\n          \n          val trace_incomplete_transfer_tac =\n            COND (Thm.prems_of #> exists (strip_all_body #> Logic.strip_imp_concl #> Term.is_open))\n              (print_tac ctxt \"Failed transfer from intermediate level:\") all_tac\n    \n          val tac = \n            ALLGOALS (resolve_tac ctxt @{thms auto_weaken_pre_comp_PRE_I} )\n            THEN ALLGOALS (Simplifier.asm_full_simp_tac ctxt)\n            THEN trace_incomplete_transfer_tac\n            THEN ALLGOALS (TRY o filter_prems_tac ctxt (K false))\n            THEN Local_Defs.unfold0_tac ctxt [Drule.triv_forall_equality]\n      \n          val st' = tac st |> Seq.take 1 |> Seq.list_of\n          val thm = case st' of [st'] => Goal.conclude st' | _ => raise THM(\"Simp_Precond: Simp-Tactic failed\",~1,[st])\n    \n          (* Check generated premises for leftover intermediate stuff *)\n          val _ = exists (Logic.is_all) (Thm.prems_of thm) \n            andalso raise THM(\"Simp_Precond: Transfer from intermediate level failed\",~1,[thm])\n    \n          val thm = \n             thm\n          (*|> map (Simplifier.asm_full_simplify ctxt)*)\n          |> Conv.fconv_rule (Object_Logic.atomize ctxt)\n          |> Local_Defs.unfold0 ctxt @{thms auto_weaken_pre_to_imp_nf}\n    \n          val thm = case Thm.concl_of thm of\n            @{mpat \"Trueprop (_ \\<longrightarrow> _)\"} => thm\n          | @{mpat \"Trueprop _\"} => thm RS @{thm auto_weaken_pre_add_dummy_imp}  \n          | _ => raise THM(\"Simp_Precond: Generated odd theorem, expected form 'P\\<longrightarrow>Q'\",~1,[thm])\n    \n    \n        in\n          thm\n        end\n      in  \n        fun simplify_precond ctxt thm = let\n          val orig_ctxt = ctxt\n          val thm = Refine_Util.OF_fst @{thms auto_weaken_pre_init} [asm_rl,thm]\n          val thm = \n            Local_Defs.unfold0 ctxt @{thms split_tupled_all} thm\n            OF @{thms auto_weaken_pre_uncurry_start}\n      \n          fun rec_uncurry thm =\n            case try (fn () => thm OF @{thms auto_weaken_pre_uncurry_step}) () of\n              NONE => thm OF @{thms auto_weaken_pre_uncurry_finish}\n            | SOME thm => rec_uncurry thm  \n      \n          val thm = rec_uncurry thm  \n            |> Conv.fconv_rule Thm.eta_conversion\n      \n          val t = case Thm.prems_of thm of\n            t::_ => t | _ => raise THM(\"Simp-Precond: Expected at least one premise\",~1,[thm])\n      \n          val (t,ctxt) = yield_singleton (Variable.import_terms false) t ctxt\n          val ((_,t),ctxt) = Variable.focus NONE t ctxt\n          val t = case t of\n            @{mpat \"Trueprop (_ \\<longrightarrow> ?t)\"} => t | _ => raise TERM(\"Simp_Precond: Expected implication\",[t])\n      \n          val simpthm = mk_simp_thm ctxt t  \n            |> singleton (Variable.export ctxt orig_ctxt)\n            \n          val thm = thm OF [simpthm]  \n          val thm = Local_Defs.unfold0 ctxt @{thms prod_casesK} thm\n        in\n          thm\n        end\n\n        fun simplify_precond_if_cfg ctxt =\n          if Config.get ctxt cfg_simp_precond then\n            simplify_precond ctxt\n          else I\n\n      end  \n\n      (* fref O fref *)\n      fun compose_ff ctxt A B = \n          (@{thm fref_compI_PRE} OF [A,B])\n        |> norm_fcomp_rule ctxt\n        |> simplify_precond_if_cfg ctxt\n        |> Conv.fconv_rule Thm.eta_conversion\n\n      (* hfref O fref *)\n      fun compose_hf ctxt A B =\n          (@{thm hfref_compI_PRE} OF [A,B])\n        |> norm_fcomp_rule ctxt\n        |> simplify_precond_if_cfg ctxt\n        |> Conv.fconv_rule Thm.eta_conversion\n        |> add_pure_constraints_rule ctxt\n        |> Conv.fconv_rule Thm.eta_conversion\n\n      fun ensure_fref ctxt thm = case rthm_type thm of\n        RT_HOPARAM => to_fref ctxt thm\n      | RT_FREF => thm\n      | _ => raise THM(\"Expected parametricity or fref theorem\",~1,[thm])\n\n      fun ensure_fref_nres ctxt thm = let\n        val thm = ensure_fref ctxt thm\n      in\n        case Thm.concl_of thm of\n          @{mpat (typs) \"Trueprop (_\\<in>fref _ _ (_::(_ nres\\<times>_)set))\"} => thm\n        | @{mpat \"Trueprop ((_,_)\\<in>fref _ _ _)\"} => \n            (thm RS @{thm ensure_fref_nresI}) |> Local_Defs.unfold0 ctxt @{thms ensure_fref_nres_unfold}\n        | _ => raise THM(\"Expected fref-theorem\",~1,[thm])\n      end\n\n      fun ensure_hfref ctxt thm = case rthm_type thm of\n        RT_HNR => to_hfref ctxt thm\n      | RT_HFREF => thm\n      | _ => raise THM(\"Expected hnr or hfref theorem\",~1,[thm])\n\n      fun ensure_hnr ctxt thm = case rthm_type thm of\n        RT_HNR => thm\n      | RT_HFREF => to_hnr ctxt thm\n      | _ => raise THM(\"Expected hnr or hfref theorem\",~1,[thm])\n\n      fun gen_compose ctxt A B = let\n        val rtA = rthm_type A\n      in\n        if rtA = RT_HOPARAM orelse rtA = RT_FREF then\n          compose_ff ctxt (ensure_fref ctxt A) (ensure_fref ctxt B)\n        else  \n          compose_hf ctxt (ensure_hfref ctxt A) ((ensure_fref_nres ctxt B))\n        \n      end\n\n      val parse_fcomp_flags = Refine_Util.parse_paren_lists \n        (Refine_Util.parse_bool_config \"prenorm\" cfg_simp_precond)\n\n      val fcomp_attrib = parse_fcomp_flags |-- Attrib.thm >> (fn B => Thm.rule_attribute [] (fn context => fn A => \n      let\n        val ctxt = Context.proof_of context\n      in  \n        gen_compose ctxt A B\n      end))\n\n    end\n  \\<close>\n\n  attribute_setup to_fref = \\<open>\n    Scan.succeed (Thm.rule_attribute [] (Sepref_Rules.to_fref o Context.proof_of))\n\\<close> \"Convert parametricity theorem to uncurried fref-form\" \n\n  attribute_setup to_foparam = \\<open>\n      Scan.succeed (Thm.rule_attribute [] (Sepref_Rules.to_foparam o Context.proof_of))\n\\<close> \\<open>Convert param or fref rule to first order rule\\<close>\n  (* Overloading existing param_fo - attribute from Parametricity.thy *)\n  attribute_setup param_fo = \\<open>\n      Scan.succeed (Thm.rule_attribute [] (Sepref_Rules.to_foparam o Context.proof_of))\n\\<close> \\<open>Convert param or fref rule to first order rule\\<close>\n\n  attribute_setup to_hnr = \\<open>\n    Scan.succeed (Thm.rule_attribute [] (Sepref_Rules.to_hnr o Context.proof_of))\n\\<close> \"Convert hfref-rule to hnr-rule\"\n  \n  attribute_setup to_hfref = \\<open>Scan.succeed (\n      Thm.rule_attribute [] (Context.proof_of #> Sepref_Rules.to_hfref)\n    )\\<close> \\<open>Convert hnr to hfref theorem\\<close>\n\n\n  attribute_setup ensure_fref_nres = \\<open>Scan.succeed (\n      Thm.rule_attribute [] (Context.proof_of #> Sepref_Rules.ensure_fref_nres)\n    )\\<close>\n\n  attribute_setup sepref_dbg_norm_fcomp_rule = \\<open>Scan.succeed (\n      Thm.rule_attribute [] (Context.proof_of #> Sepref_Rules.norm_fcomp_rule)\n    )\\<close>\n\n  attribute_setup sepref_simplify_precond = \\<open>Scan.succeed (\n      Thm.rule_attribute [] (Context.proof_of #> Sepref_Rules.simplify_precond)\n    )\\<close> \\<open>Simplify precondition of fref/hfref-theorem\\<close>\n\n  attribute_setup FCOMP = Sepref_Rules.fcomp_attrib \"Composition of refinement rules\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/Sepref_Rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.34897373067887094}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Step_Sim_Pres\n  imports Weak_Late_Step_Sim\nbegin\n\nlemma tauPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"\\<tau>.(P) \\<leadsto><Rel> \\<tau>.(Q)\"\nproof(induct rule: simCases)\n  case(Bound Q' a y)\n  have \"\\<tau>.(Q) \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Input Q' a x)\n  have \"\\<tau>.(Q) \\<longmapsto>a<x> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Free Q' \\<alpha>)\n  have \"\\<tau>.(Q) \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n  thus ?case using PRelQ\n  proof(induct rule: tauCases, auto simp add: pi.inject residual.inject)\n    have \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P\" by(rule Weak_Late_Step_Semantics.Tau)\n    moreover assume \"(P, Q') \\<in> Rel\"\n    ultimately show \"\\<exists>P'. \\<tau>.(P) \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P' \\<and> (P', Q') \\<in> Rel\" by blast\n  qed\nqed\n\nlemma inputPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   x    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"\\<forall>y. (P[x::=y], Q[x::=y]) \\<in> Rel\"\n  and     Eqvt: \"eqvt Rel\"\n\n  shows \"a<x>.P \\<leadsto><Rel> a<x>.Q\"\nproof -\n  show ?thesis using Eqvt\n  proof(induct rule: simCasesCont[of _ \"(P, a, x, Q)\"])\n    case(Bound Q' b y)\n    have \"a<x>.Q \\<longmapsto>b<\\<nu>y> \\<prec> Q'\" by fact\n    hence False by auto\n    thus ?case by simp\n  next\n    case(Input Q' b y)\n    have \"y \\<sharp> (P, a, x, Q)\" by fact\n    hence yFreshP: \"(y::name) \\<sharp> P\" and yineqx: \"y \\<noteq> x\" and \"y \\<noteq> a\" and \"y \\<sharp> Q\"\n      by(simp add: fresh_prod)+\n    have \"a<x>.Q \\<longmapsto>b<y> \\<prec> Q'\" by fact\n    thus ?case using `y \\<noteq> a` `y \\<noteq> x` `y \\<sharp> Q`\n    proof(induct rule: inputCases, auto simp add: subject.inject)\n      have \"\\<forall>u. \\<exists>P'. a<x>.P \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> P' \\<and> (P', ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\"\n      proof(rule allI)\n        fix u\n        have \"a<x>.P \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> ([(x, y)] \\<bullet> P)[y::=u]\" (is \"?goal\")\n        proof -\n          from yFreshP have \"a<x>.P = a<y>.([(x, y)] \\<bullet> P)\" by(rule Agent.alphaInput)\n          moreover have \"a<y>.([(x, y)] \\<bullet> P) \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> ([(x, y)] \\<bullet> P)[y::=u]\" \n            by(rule Weak_Late_Step_Semantics.Input)\n          ultimately show ?goal by(simp add: name_swap)\n        qed\n\n        moreover have \"(([(x, y)] \\<bullet> P)[y::=u], ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\"\n        proof -\n          from PRelQ have \"(P[x::=u], Q[x::=u]) \\<in> Rel\" by auto\n          with `y \\<sharp> P` `y \\<sharp> Q` show ?thesis by(simp add: renaming)\n        qed\n        \n        ultimately show \"\\<exists>P'. a<x>.P \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> P' \\<and> (P', ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\" \n          by blast\n      qed\n      \n      thus \"\\<exists>P''. \\<forall>u. \\<exists>P'. a<x>.P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<y> \\<prec> P' \\<and> (P', ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\" by blast\n    qed\n  next\n    case(Free Q' \\<alpha>)\n    have \"a<x>.Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    hence False by auto\n    thus ?case by simp\n  qed\nqed\n\nlemma outputPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"a{b}.P \\<leadsto><Rel> a{b}.Q\"\nproof(induct rule: simCases)\n  case(Bound Q' c x)\n  have \"a{b}.Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Input Q' c x)\n  have \"a{b}.Q \\<longmapsto>c<x> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Free Q' \\<alpha>)\n  have \"a{b}.Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case using PRelQ\n  proof(induct rule: outputCases, auto simp add: pi.inject residual.inject)\n    have \"a{b}.P \\<Longrightarrow>\\<^sub>la[b] \\<prec> P\" by(rule Weak_Late_Step_Semantics.Output)\n    moreover assume \"(P, Q') \\<in> Rel\"\n    ultimately show \"\\<exists>P'. a{b}.P \\<Longrightarrow>\\<^sub>la[b] \\<prec> P' \\<and> (P', Q') \\<in> Rel\" by blast\n  qed\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"[a\\<frown>b]P \\<leadsto><Rel'> [a\\<frown>b]Q\"\nproof(induct rule: simCases)\n  case(Bound Q' c x)\n  have \"x \\<sharp> [a\\<frown>b]P\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n  have \"[a\\<frown>b]Q \\<longmapsto> c<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case cMatch\n    have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lc<\\<nu>x> \\<prec> P'\"\n                                   and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>\\<^sub>lc<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Match)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nnext\n  case(Input Q' c x)\n  have \"x \\<sharp> [a\\<frown>b]P\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n  have \"[a\\<frown>b]Q \\<longmapsto>c<x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case cMatch\n    have \"Q \\<longmapsto> c<x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\"\n      by(blast dest: simE)\n    have \"\\<forall>u. \\<exists>P'. [a\\<frown>a]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n    proof(rule allI)\n      fix u\n      from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\"\n        by blast\n      from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Match)\n      with P'RelQ' RelRel' show \"\\<exists>P'. [a\\<frown>a]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n        by blast\n    qed\n    thus ?case by blast\n  qed\nnext\n  case(Free Q' \\<alpha>)\n  have \"[a\\<frown>b]Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case cMatch\n    have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Match)\n    with PRel RelRel' show ?case by blast\n  qed\nqed\n\nlemma mismatchPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"[a\\<noteq>b]P \\<leadsto><Rel'> [a\\<noteq>b]Q\"\nproof(cases \"a=b\")\n  assume \"a=b\"\n  thus ?thesis\n    by(auto simp add: weakStepSimDef)\nnext\n  assume aineqb: \"a\\<noteq>b\"\n  show ?thesis\n  proof(induct rule: simCases)\n    case(Bound Q' c x)\n    have \"x \\<sharp> [a\\<noteq>b]P\" by fact\n    hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n    have \"[a\\<noteq>b]Q \\<longmapsto> c<\\<nu>x> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case cMismatch\n      have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n      with PSimQ xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lc<\\<nu>x> \\<prec> P'\"\n                                     and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans aineqb have \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lc<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Mismatch)\n      moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n      ultimately show ?case by blast\n    qed\n  next\n    case(Input Q' c x)\n    have \"x \\<sharp> [a\\<noteq>b]P\" by fact\n    hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n    have \"[a\\<noteq>b]Q \\<longmapsto>c<x> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case cMismatch\n      have \"Q \\<longmapsto> c<x> \\<prec> Q'\" by fact\n      with PSimQ xFreshP obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\"\n        by(blast dest: simE)\n      have \"\\<forall>u. \\<exists>P'. [a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n      proof(rule allI)\n        fix u\n        from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\"\n          by blast\n        from PTrans aineqb have \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Mismatch)\n        with P'RelQ' RelRel' show \"\\<exists>P'. [a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n          by blast\n      qed\n      thus ?case by blast\n    qed\n  next\n    case(Free Q' \\<alpha>)\n    have \"[a\\<noteq>b]Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case cMismatch\n      have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans `a \\<noteq> b` have \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Mismatch)\n      with PRel RelRel' show ?case by blast\n    qed\n  qed\nqed\n\nlemma sumCompose:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n  and   T :: pi\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     RSimT: \"R \\<leadsto><Rel> T\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"P \\<oplus> R \\<leadsto><Rel'> Q \\<oplus> T\"\nproof(induct rule: simCases)\n  case(Bound Q' a x)\n  have \"x \\<sharp> P \\<oplus> R\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n  have \"Q \\<oplus> T \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: sumCases)\n    case cSum1\n    have \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n    with xFreshP PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Sum1)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  next\n    case cSum2\n    have \"T \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n    with xFreshR RSimT obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> R'\" and R'RelQ': \"(R', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from RTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> R'\" by(rule Weak_Late_Step_Semantics.Sum2)\n    moreover from R'RelQ' RelRel' have \"(R', Q') \\<in> Rel'\" by blast\n    ultimately show ?thesis by blast\n  qed\nnext\n  case(Input Q' a x)\n  have \"x \\<sharp> P \\<oplus> R\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n  have \"Q \\<oplus> T \\<longmapsto>a<x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: sumCases)\n    case cSum1\n    have \"Q \\<longmapsto>a<x> \\<prec> Q'\" by fact\n    with xFreshP PSimQ obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\"\n      by(blast dest: simE)\n    have \"\\<forall>u. \\<exists>P'. P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n    proof(rule allI)\n      fix u\n      from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                          and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\" by blast\n      from PTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Sum1)\n      with P'RelQ' RelRel' show \"\\<exists>P'. P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\" by blast\n    qed\n    thus ?case by blast\n  next\n    case cSum2\n    have \"T \\<longmapsto>a<x> \\<prec> Q'\" by fact\n    with xFreshR RSimT obtain R'' where L1: \"\\<forall>u. \\<exists>R'. R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R' \\<and> (R', Q'[x::=u]) \\<in> Rel\" \n      by(blast dest: simE)\n    have \"\\<forall>u. \\<exists>P'. P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n    proof(rule allI)\n      fix u\n      from L1 obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R'\"\n                          and R'RelQ': \"(R', Q'[x::=u]) \\<in> Rel\" by blast\n      from RTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R'\" by(rule Weak_Late_Step_Semantics.Sum2)\n      with R'RelQ' RelRel' show  \"\\<exists>P'. P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\" by blast\n    qed    \n    thus ?case by blast\n  qed\nnext\n  case(Free Q' \\<alpha>)\n  have \"Q \\<oplus> T \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: sumCases)\n    case cSum1\n    have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\" \n      by(blast dest: simE)\n    from PTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Sum1)\n    with RelRel' PRel show ?case by blast\n  next\n    case cSum2\n    have \"T \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    with RSimT obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> R'\" and RRel: \"(R', Q') \\<in> Rel\" \n      by(blast dest: simE)\n    from RTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> R'\" by(rule Weak_Late_Step_Semantics.Sum2)\n    with RelRel' RRel show ?case by blast\n  qed\nqed\n      \nlemma sumPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     Id: \"Id \\<subseteq> Rel\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"P \\<oplus> R \\<leadsto><Rel'> Q \\<oplus> R\"\nproof -\n  from Id have Refl: \"R \\<leadsto><Rel> R\" by(rule reflexive)\n  from PSimQ Refl RelRel' show ?thesis by(rule sumCompose)\nqed\n\nlemma parPres:\n  fixes P     :: pi\n  and   Q     :: pi\n  and   R     :: pi\n  and   Rel   :: \"(pi \\<times> pi) set\"\n  and   Rel'  :: \"(pi \\<times> pi) set\"\n  \n  assumes PSimQ:    \"P \\<leadsto><Rel> Q\"\n  and     PRelQ:    \"(P, Q) \\<in> Rel\"\n  and     Par:      \"\\<And>P Q R. (P, Q) \\<in> Rel \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> R) \\<in> Rel'\"\n  and     Res:      \"\\<And>P Q a. (P, Q) \\<in> Rel' \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> Rel'\"\n  and     EqvtRel:  \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"P \\<parallel> R \\<leadsto><Rel'> Q \\<parallel> R\"\nusing EqvtRel'\nproof(induct rule: simCasesCont[where C=\"(P, Q, R)\"])\n  case(Bound Q' a x)\n  have \"x \\<sharp> (P, Q, R)\" by fact\n  hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" and \"x \\<sharp> Q\" by simp+\n  from `Q \\<parallel> R \\<longmapsto> a<\\<nu>x> \\<prec> Q'` `x \\<sharp> Q` `x \\<sharp> R` show ?case\n  proof(induct rule: parCasesB)\n    case(cPar1 Q')\n    have QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n      \n    from xFreshP PSimQ QTrans obtain P' where PTrans:\"P \\<Longrightarrow>\\<^sub>l a<\\<nu>x> \\<prec> P'\"\n                                          and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l a<\\<nu>x> \\<prec> (P' \\<parallel> R)\" by(rule Weak_Late_Step_Semantics.Par1B)\n    moreover from P'RelQ' have \"(P' \\<parallel> R, Q' \\<parallel> R) \\<in> Rel'\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cPar2 R')\n    have RTrans: \"R \\<longmapsto> a<\\<nu>x> \\<prec> R'\" by fact\n    hence \"R \\<Longrightarrow>\\<^sub>l a<\\<nu>x> \\<prec> R'\"\n      by(auto simp add: weakTransition_def dest: Weak_Late_Step_Semantics.singleActionChain)\n    with xFreshP xFreshR have ParTrans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P \\<parallel> R'\"\n      by(blast intro: Weak_Late_Step_Semantics.Par2B)\n    moreover from PRelQ  have \"(P \\<parallel> R', Q \\<parallel>  R') \\<in> Rel'\" by(rule Par)\n    ultimately show ?case by blast\n  qed\nnext\n  case(Input Q' a x)\n  have \"x \\<sharp> (P, Q, R)\" by fact\n  hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" and \"x \\<sharp> Q\" by simp+\n  from `Q \\<parallel> R \\<longmapsto>a<x> \\<prec> Q'` `x \\<sharp> Q` `x \\<sharp> R`\n  show ?case\n  proof(induct rule: parCasesB)\n    case(cPar1 Q')\n    have QTrans: \"Q \\<longmapsto>a<x> \\<prec> Q'\" by fact\n    from xFreshP PSimQ QTrans obtain P''\n      where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\" \n      by(blast dest: simE)\n    have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u] \\<parallel> R[x::=u]) \\<in> Rel'\"\n    proof(rule allI)\n      fix u\n      from L1 obtain P' where PTrans:\"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                          and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\" by blast\n      from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> (P' \\<parallel> R)\"\n        by(rule Weak_Late_Step_Semantics.Par1B)\n      moreover from P'RelQ'  have \"(P' \\<parallel> R, Q'[x::=u] \\<parallel> R) \\<in> Rel'\" \n        by(rule Par)\n      ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u] \\<parallel> (R[x::=u])) \\<in> Rel'\"\n        using xFreshR\n        by(force simp add: forget)\n    qed\n    thus ?case by force\n  next\n    case(cPar2 R')\n    have RTrans: \"R \\<longmapsto>a<x> \\<prec> R'\" by fact\n    have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R')\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q \\<parallel> R'[x::=u]) \\<in> Rel'\"\n    proof \n      fix u\n      from RTrans have \"R \\<Longrightarrow>\\<^sub>lu in R'\\<rightarrow>a<x> \\<prec> R'[x::=u]\"\n        by(rule Weak_Late_Step_Semantics.singleActionChain)\n      hence \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in P \\<parallel> R'\\<rightarrow>a<x> \\<prec> P \\<parallel> R'[x::=u]\" using `x \\<sharp> P`\n        by(rule Weak_Late_Step_Semantics.Par2B)\n      moreover from PRelQ have \"(P \\<parallel> R'[x::=u], Q \\<parallel>  R'[x::=u]) \\<in> Rel'\" by(rule Par)\n      ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R')\\<rightarrow>a<x> \\<prec> P' \\<and>\n                           (P', Q \\<parallel> R'[x::=u]) \\<in> Rel'\" by blast\n    qed\n    thus ?case using `x \\<sharp> Q` by(fastforce simp add: forget)\n  qed\nnext\n  case(Free QR' \\<alpha>)\n  have \"Q \\<parallel> R \\<longmapsto> \\<alpha> \\<prec> QR'\" by fact\n  thus ?case\n  proof(induct rule: parCasesF[of _ _ _ _ _ \"(P, R)\"])\n    case(cPar1 Q')\n    have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Late_Step_Semantics.Par1F)\n    moreover from PRel have \"(P' \\<parallel> R, Q' \\<parallel> R) \\<in> Rel'\" by(blast intro: Par)\n    ultimately show ?case by blast\n  next\n    case(cPar2 R')\n    have \"R \\<longmapsto> \\<alpha> \\<prec> R'\" by fact\n    hence \"R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> R'\"\n      by(rule Weak_Late_Step_Semantics.singleActionChain)\n    hence \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> (P \\<parallel> R')\" by(rule Weak_Late_Step_Semantics.Par2F)\n    moreover from PRelQ have \"(P \\<parallel> R', Q \\<parallel> R') \\<in> Rel'\" by(blast intro: Par)\n    ultimately show ?case by blast\n  next\n    case(cComm1 Q' R' a b x)\n    have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" and RTrans: \"R \\<longmapsto> a[b] \\<prec> R'\" by fact+\n    have \"x \\<sharp> (P, R)\" by fact\n    hence xFreshP: \"x \\<sharp> P\" by(simp add: fresh_prod)\n    \n    from PSimQ QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>lb in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=b]) \\<in> Rel\"\n      by(blast dest: simE)\n      \n    from RTrans have \"R \\<Longrightarrow>\\<^sub>la[b] \\<prec> R'\"\n      by(rule Weak_Late_Step_Semantics.singleActionChain)\n    \n    with PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P' \\<parallel> R'\" by(rule Weak_Late_Step_Semantics.Comm1)\n    moreover from P'RelQ' have \"(P' \\<parallel> R', Q'[x::=b] \\<parallel> R') \\<in> Rel'\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cComm2 Q' R' a b x)\n    have QTrans: \"Q \\<longmapsto>a[b] \\<prec> Q'\" and RTrans: \"R \\<longmapsto>a<x> \\<prec> R'\" by fact+\n    have \"x \\<sharp> (P, R)\" by fact\n    hence xFreshR: \"x \\<sharp> R\" by(simp add: fresh_prod)\n      \n    from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la[b] \\<prec> P'\"\n                                  and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from RTrans have \"R \\<Longrightarrow>\\<^sub>lb in R'\\<rightarrow>a<x> \\<prec> R'[x::=b]\"\n      by(rule Weak_Late_Step_Semantics.singleActionChain)\n    with PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P' \\<parallel> R'[x::=b]\" by(rule Weak_Late_Step_Semantics.Comm2)\n    moreover from PRel have \"(P' \\<parallel> R'[x::=b], Q' \\<parallel> R'[x::=b]) \\<in> Rel'\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cClose1 Q' R' a x y)\n    have QTrans: \"Q \\<longmapsto>a<x> \\<prec> Q'\" and RTrans: \"R \\<longmapsto>a<\\<nu>y> \\<prec> R'\" by fact+\n    have \"x \\<sharp> (P, R)\" and \"y \\<sharp> (P, R)\" by fact+\n    hence xFreshP: \"x \\<sharp> P\" and yFreshR: \"y \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" by(simp add: fresh_prod)+\n    \n    from PSimQ QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>ly in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=y]) \\<in> Rel\"\n      by(blast dest: simE)\n    from RTrans have \"R \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> R'\" \n      by(auto simp add: weakTransition_def dest: Weak_Late_Step_Semantics.singleActionChain)\n    with PTrans have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R')\" using yFreshP yFreshR \n      by(rule Weak_Late_Step_Semantics.Close1)\n    moreover from P'RelQ' have \"(<\\<nu>y>(P' \\<parallel> R'), <\\<nu>y>(Q'[x::=y] \\<parallel> R')) \\<in> Rel'\"\n      by(blast intro: Par Res)\n    ultimately show ?case by blast\n  next\n    case(cClose2 Q' R' a x y)\n    have QTrans: \"Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" and RTrans: \"R \\<longmapsto>a<x> \\<prec> R'\" by fact+\n    have \"x \\<sharp> (P, R)\" and \"y \\<sharp> (P, R)\" by fact+\n    hence xFreshR: \"x \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" and yFreshR: \"y \\<sharp> R\" by(simp add: fresh_prod)+\n\n    from PSimQ QTrans yFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> P'\"\n                                          and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n\n    from RTrans have \"R \\<Longrightarrow>\\<^sub>ly in R'\\<rightarrow>a<x> \\<prec> R'[x::=y]\"\n      by(rule Weak_Late_Step_Semantics.singleActionChain)\n    with PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R'[x::=y])\" using yFreshP yFreshR\n      by(rule Weak_Late_Step_Semantics.Close2)\n    moreover from P'RelQ' have \"(<\\<nu>y>(P' \\<parallel> R'[x::=y]), <\\<nu>y>(Q' \\<parallel> R'[x::=y])) \\<in> Rel'\"\n      by(blast intro: Par Res)\n    ultimately show ?case by blast\n  qed\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     ResRel: \"\\<And>(P::pi) (Q::pi) (x::name). (P, Q) \\<in> Rel \\<Longrightarrow> (<\\<nu>x>P, <\\<nu>x>Q) \\<in> Rel'\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     EqvtRel: \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"<\\<nu>x>P \\<leadsto><Rel'> <\\<nu>x>Q\"\nproof -\n  from EqvtRel' show ?thesis\n  proof(induct rule: simCasesCont[of _ \"(P, Q, x)\"])\n    case(Bound Q' a y)\n    have Trans: \"<\\<nu>x>Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n    have \"y \\<sharp> (P, Q, x)\" by fact\n    hence yineqx: \"y \\<noteq> x\" and yFreshP: \"y \\<sharp> P\" and \"y \\<sharp> Q\" by(simp add: fresh_prod)+\n    from Trans `y \\<noteq> x` `y \\<sharp> Q` show ?case\n    proof(induct rule: resCasesB)\n      case(cOpen a Q')\n      have QTrans: \"Q \\<longmapsto>a[x] \\<prec> Q'\" and aineqx: \"a \\<noteq> x\" by fact+\n\n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la[x] \\<prec> P'\"\n                                    and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n\n      have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> ([(y, x)] \\<bullet> P')\"\n      proof -\n        from PTrans aineqx have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Open)\n        moreover from PTrans yFreshP have \"y \\<sharp> P'\" by(force intro: Weak_Late_Step_Semantics.freshTransition)\n        ultimately show ?thesis by(simp add: alphaBoundResidual name_swap) \n      qed\n      moreover from EqvtRel P'RelQ' RelRel' have \"([(y, x)] \\<bullet> P', [(y, x)] \\<bullet> Q') \\<in> Rel'\"\n        by(blast intro: eqvtRelI)\n      ultimately show ?case by blast\n    next\n      case(cRes Q')\n      have QTrans: \"Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n      from `x \\<sharp> BoundOutputS a` have \"x \\<noteq> a\" by simp\n\n      from PSimQ yFreshP QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> P'\"\n                                            and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans `x \\<noteq> a` yineqx yFreshP have ResTrans: \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> (<\\<nu>x>P')\"\n        by(blast intro: Weak_Late_Step_Semantics.ResB)\n      moreover from P'RelQ' have \"((<\\<nu>x>P'), (<\\<nu>x>Q')) \\<in> Rel'\"\n        by(rule ResRel)\n      ultimately show ?case by blast\n    qed\n  next\n    case(Input Q' a y)\n    have \"y \\<sharp> (P, Q, x)\" by fact\n    hence yineqx: \"y \\<noteq> x\" and yFreshP: \"y \\<sharp> P\" and \"y \\<sharp> Q\" by(simp add: fresh_prod)+   \n    have \"<\\<nu>x>Q \\<longmapsto>a<y> \\<prec> Q'\" by fact\n    thus ?case using yineqx `y \\<sharp> Q`\n    proof(induct rule: resCasesB)\n      case(cOpen a Q')\n      thus ?case by simp\n    next\n      case(cRes Q')\n      have QTrans: \"Q \\<longmapsto>a<y> \\<prec> Q'\" by fact\n      from `x \\<sharp> InputS a` have \"x \\<noteq> a\" by simp\n      \n      from PSimQ QTrans yFreshP obtain P''\n        where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<y> \\<prec> P' \\<and> (P', Q'[y::=u]) \\<in> Rel\"\n        by(blast dest: simE)\n      have \"\\<forall>u. \\<exists>P'. <\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> P' \\<and> (P', (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n      proof(rule allI)\n        fix u\n        show \"\\<exists>P'. <\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in <\\<nu>x>P''\\<rightarrow>a<y> \\<prec> P' \\<and> (P', (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n        proof(cases \"x=u\")\n          assume xequ: \"x=u\"\n\n          have \"\\<exists>c::name. c \\<sharp> (P, P'', Q', x, y, a)\" by(blast intro: name_exists_fresh)\n          then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshP'': \"c \\<sharp> P''\" and cFreshQ': \"c \\<sharp> Q'\"\n                                and cineqx: \"c \\<noteq> x\" and cineqy: \"c \\<noteq> y\" and cineqa: \"c \\<noteq> a\"\n            by(force simp add: fresh_prod)\n        \n          from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lc in P''\\<rightarrow>a<y> \\<prec> P'\"\n                              and P'RelQ': \"(P', Q'[y::=c]) \\<in> Rel\"\n            by blast\n          have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> <\\<nu>c>([(x, c)] \\<bullet> P')\"\n          proof -\n            from PTrans yineqx `x \\<noteq> a` cineqx have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>lc in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> <\\<nu>x>P'\"\n              by(blast intro: Weak_Late_Step_Semantics.ResB)\n            hence \"([(x, c)] \\<bullet> <\\<nu>x>P) \\<Longrightarrow>\\<^sub>l([(x, c)] \\<bullet> c) in ([(x, c)] \\<bullet> <\\<nu>x>P'')\\<rightarrow>([(x, c)] \\<bullet> a)<([(x, c)] \\<bullet> y)> \\<prec> [(x, c)] \\<bullet> <\\<nu>x>P'\"\n              by(rule Weak_Late_Step_Semantics.eqvtI)\n            moreover from cFreshP have \"<\\<nu>c>([(x, c)] \\<bullet> P) = <\\<nu>x>P\" by(simp add: alphaRes)\n            moreover from cFreshP'' have \"<\\<nu>c>([(x, c)] \\<bullet> P'') = <\\<nu>x>P''\" by(simp add: alphaRes)\n            ultimately show ?thesis using `x \\<noteq> a` cineqa yineqx cineqy cineqx xequ by(simp add: name_calc)\n          qed\n          moreover have \"(<\\<nu>c>([(x, c)] \\<bullet> P'), (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n          proof -\n            from P'RelQ' have \"(<\\<nu>x>P', <\\<nu>x>(Q'[y::=c])) \\<in> Rel'\" by(rule ResRel)\n            with EqvtRel' have \"([(x, c)] \\<bullet> <\\<nu>x>P', [(x, c)] \\<bullet> <\\<nu>x>(Q'[y::=c])) \\<in> Rel'\"  by(rule eqvtRelI)\n            with cineqy yineqx cineqx have \"(<\\<nu>c>([(x, c)] \\<bullet> P'), (<\\<nu>c>([(x, c)] \\<bullet> Q'))[y::=x]) \\<in> Rel'\"\n              by(simp add: name_calc eqvt_subs)\n            with cFreshQ' xequ show ?thesis by(simp add: alphaRes)\n          qed\n          ultimately show ?thesis by blast\n        next\n          assume xinequ: \"x \\<noteq> u\"\n          from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<y> \\<prec> P'\"\n                             and P'RelQ': \"(P', Q'[y::=u]) \\<in> Rel\" by blast\n          \n          from PTrans `x \\<noteq> a` yineqx xinequ have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> <\\<nu>x>P'\"\n            by(blast intro: Weak_Late_Step_Semantics.ResB)\n          moreover from P'RelQ' xinequ yineqx have \"(<\\<nu>x>P', (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n            by(force intro: ResRel)\n          ultimately show ?thesis by blast\n        qed\n      qed\n      thus ?case by blast\n    qed\n  next\n    case(Free Q' \\<alpha>)\n    have \"<\\<nu>x>Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: resCasesF)\n      case(cRes Q')\n      have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\"\n                             and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      \n      have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> <\\<nu>x>P'\"\n      proof -\n        have xFreshAlpha: \"x \\<sharp> \\<alpha>\" by fact\n        with PTrans show ?thesis by(rule Weak_Late_Step_Semantics.ResF)\n      qed\n      moreover from P'RelQ' have \"(<\\<nu>x>P', <\\<nu>x>Q') \\<in> Rel'\" by(rule ResRel)\n      ultimately show ?case by blast\n    qed\n  qed\nqed\n\n\n\n  shows \"!P \\<leadsto><bangRel Rel'> !Q\"\nproof -\n  from eqvtRel' have EqvtBangRel': \"eqvt(bangRel Rel')\" by(rule eqvtBangRel)  \n  from RelRel' have BRelRel': \"\\<And>P Q. (P, Q) \\<in> bangRel Rel \\<Longrightarrow> (P, Q) \\<in> bangRel Rel'\"\n    by(auto intro: bangRelSubset)\n\n  have \"\\<And>Rs P. \\<lbrakk>!Q \\<longmapsto> Rs; (P, !Q) \\<in> bangRel Rel\\<rbrakk> \\<Longrightarrow> weakStepSimAct P Rs P (bangRel Rel')\"\n  proof -\n    fix Rs P\n    assume \"!Q \\<longmapsto> Rs\" and \"(P, !Q) \\<in> bangRel Rel\"\n    thus \"weakStepSimAct P Rs P (bangRel Rel')\"\n    proof(nominal_induct avoiding: P rule: bangInduct)\n      case(cPar1B aa x Q' P)\n      have QTrans: \"Q \\<longmapsto>aa\\<guillemotleft>x\\<guillemotright> \\<prec> Q'\" and xFreshQ: \"x \\<sharp> Q\" by fact+\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        from PRelQ have PSimQ: \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n        from EqvtBangRel' show ?case\n        proof(induct rule: simActBoundCases)\n          case(Input a)\n          have \"aa = InputS a\" by fact\n          with PSimQ QTrans xFreshP obtain P''\n            where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n            by(blast dest: simE)\n          have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and> (P', (Q' \\<parallel> !Q)[x::=u]) \\<in> bangRel Rel'\"\n          proof(rule allI)\n            fix u\n            from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel'\"\n              by blast\n            from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x>\\<prec> P' \\<parallel> R\"\n              by(rule Weak_Late_Step_Semantics.Par1B)\n            moreover have \"(P' \\<parallel> R, (Q' \\<parallel> !Q)[x::=u]) \\<in> bangRel Rel'\"\n            proof -\n              from P'RelQ' RBangRelQ have \"(P' \\<parallel> R, Q'[x::=u] \\<parallel> !Q) \\<in> bangRel Rel'\"\n                by(blast intro: BRelRel' Rel.BRPar)\n              with xFreshQ show ?thesis by(force simp add: forget)\n            qed\n            ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and>\n                                  (P', (Q' \\<parallel> !Q)[x::=u]) \\<in> bangRel Rel'\"\n              by blast\n          qed\n          thus ?case by blast\n        next\n          case(BoundOutput a)\n          have \"aa = BoundOutputS a\" by fact\n          with PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(force dest: simE)\n          from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>la<\\<nu>x>\\<prec> P' \\<parallel> R\"\n            by(rule Weak_Late_Step_Semantics.Par1B)\n          moreover from P'RelQ' RBangRelQ have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel'\"\n            by(blast intro: Rel.BRPar BRelRel')\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cPar1F \\<alpha> Q' P)\n      have QTrans: \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n        \n          from PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Late_Step_Semantics.Par1F)\n          moreover from P'RelQ' RBangRelQ have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel'\"\n            by(blast intro: BRelRel' Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cPar2B aa x Q' P)\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (aa\\<guillemotleft>x\\<guillemotright> \\<prec> Q') P (bangRel Rel')\" by fact\n      have xFreshQ: \"x \\<sharp> Q\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        from RBangRelQ have IH: \"weakStepSimAct R (aa\\<guillemotleft>x\\<guillemotright> \\<prec> Q') R (bangRel Rel')\" by(rule IH)\n        from EqvtBangRel' show ?case\n        proof(induct rule: simActBoundCases)\n          case(Input a)\n          have \"aa = InputS a\" by fact\n          with xFreshR IH obtain  R'' where L1: \"\\<forall>u. \\<exists>R'. R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R' \\<and>\n                                                 (R', Q'[x::=u]) \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n          have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P' \\<and> (P', (Q \\<parallel> Q')[x::=u]) \\<in> bangRel Rel'\"\n          proof(rule allI)\n            fix u\n            from L1 obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                and R'BangRelT': \"(R', Q'[x::=u]) \\<in> bangRel Rel'\"\n              by blast\n            \n            from RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P \\<parallel> R'\"\n              by(rule Weak_Late_Step_Semantics.Par2B)\n            moreover have \"(P \\<parallel> R', (Q \\<parallel> Q')[x::=u]) \\<in> bangRel Rel'\"\n            proof -\n              from PRelQ R'BangRelT' have \"(P \\<parallel> R', Q \\<parallel> Q'[x::=u]) \\<in> bangRel Rel'\"\n                by(blast intro: RelRel' Rel.BRPar)\n              with xFreshQ show ?thesis by(simp add: forget)\n            qed\n            ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P' \\<and> (P', (Q \\<parallel> Q')[x::=u]) \\<in> bangRel Rel'\"\n              by blast\n          qed\n          thus ?case by blast\n        next\n          case(BoundOutput a)\n          have \"aa = BoundOutputS a\" by fact\n          with IH xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> R'\"\n                                      and R'BangRelT': \"(R', Q') \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n\n          from RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P \\<parallel> R'\"\n            by(auto intro: Weak_Late_Step_Semantics.Par2B)\n          moreover from PRelQ R'BangRelT' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> bangRel Rel'\"\n            by(blast intro: RelRel' Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cPar2F \\<alpha> Q')\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (\\<alpha> \\<prec> Q') P (bangRel Rel')\" by fact+\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          from RBangRelQ have \"weakStepSimAct R (\\<alpha> \\<prec> Q') R (bangRel Rel')\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> R'\" and R'BangRelQ': \"(R', Q') \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n\n          from RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P \\<parallel> R'\" by(rule Weak_Late_Step_Semantics.Par2F)\n          moreover from PRelQ R'BangRelQ' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> bangRel Rel'\"\n            by(blast intro: RelRel' Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cComm1 a x Q' b Q'' P)\n      have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (a[b] \\<prec> Q'') P (bangRel Rel')\" by fact+\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" by simp\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>lb in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=b]) \\<in> Rel'\"\n            by(blast dest: simE)\n        \n          from RBangRelQ have \"weakStepSimAct R (a[b] \\<prec> Q'') R (bangRel Rel')\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>la[b] \\<prec> R'\"\n                           and R'RelT': \"(R', Q'') \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> (P' \\<parallel> R')\"\n            by(rule Weak_Late_Step_Semantics.Comm1)\n          moreover from P'RelQ' R'RelT' have \"(P' \\<parallel> R', Q'[x::=b] \\<parallel> Q'') \\<in> bangRel Rel'\"\n            by(blast intro: RelRel' Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cComm2 a b Q' x Q'' P)\n      have QTrans: \"Q \\<longmapsto>a[b] \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (a<x> \\<prec> Q'') P (bangRel Rel')\"\n        by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshR: \"x \\<sharp> R\" by simp\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          \n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la[b] \\<prec> P'\"\n                                  and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n        \n          from RBangRelQ have \"weakStepSimAct R (a<x> \\<prec> Q'') R (bangRel Rel')\"\n            by(rule IH)\n          with xFreshR obtain R' R'' where RTrans: \"R \\<Longrightarrow>\\<^sub>lb in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                       and R'BangRelQ'': \"(R', Q''[x::=b]) \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n        \n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> (P' \\<parallel> R')\"\n            by(rule Weak_Late_Step_Semantics.Comm2)\n          moreover from P'RelQ' R'BangRelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q''[x::=b]) \\<in> bangRel Rel'\"\n            by(rule Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cClose1 a x Q' y Q'' P)\n      have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (a<\\<nu>y> \\<prec> Q'') P (bangRel Rel')\"\n        by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" and \"y \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" and \"y \\<sharp> P \\<parallel> R\" by fact+\n        hence xFreshP: \"x \\<sharp> P\" and yFreshR: \"y \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" by simp+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>ly in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=y]) \\<in> Rel'\"\n            by(blast dest: simE)\n        \n          from RBangRelQ have \"weakStepSimAct R (a<\\<nu>y> \\<prec> Q'') R (bangRel Rel')\" by(rule IH)\n          with yFreshR obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> R'\"\n                                   and R'BangRelQ'': \"(R', Q'') \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n          from PTrans RTrans yFreshP yFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R')\"\n            by(rule Weak_Late_Step_Semantics.Close1)\n          moreover from P'RelQ' R'BangRelQ'' have \"(<\\<nu>y>(P' \\<parallel> R'), <\\<nu>y>(Q'[x::=y] \\<parallel> Q'')) \\<in> bangRel Rel'\"\n            by(force intro: Rel.BRPar Rel.BRRes)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cClose2 a y Q' x Q'')\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>y> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (a<x> \\<prec> Q'') P (bangRel Rel')\"\n        by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" and \"y \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" and \"y \\<sharp> P \\<parallel> R\" by fact+\n        hence xFreshR: \"x \\<sharp> R\" and yFreshR: \"y \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" by simp+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans yFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> P'\"\n                                          and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n\n          from RBangRelQ have \"weakStepSimAct R (a<x> \\<prec> Q'') R (bangRel Rel')\"\n            by(rule IH)\n          with xFreshR obtain R' R'' where RTrans: \"R \\<Longrightarrow>\\<^sub>ly in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                       and R'BangRelT': \"(R', Q''[x::=y]) \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n        \n          from PTrans RTrans yFreshP yFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R')\"\n            by(rule Weak_Late_Step_Semantics.Close2)\n          moreover from P'RelQ' R'BangRelT' have \"(<\\<nu>y>(P' \\<parallel> R'), <\\<nu>y>(Q' \\<parallel> Q''[x::=y])) \\<in> bangRel Rel'\"\n            by(force intro: Rel.BRPar Rel.BRRes)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cBang Rs)\n      have IH: \"\\<And>P. (P, Q \\<parallel> !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P Rs P (bangRel Rel')\"\n        by fact\n      have \"(P, !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRBangCases)\n        case(BRBang P)\n        have PRelQ: \"(P, Q) \\<in> Rel\" by fact\n        hence \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n        with PRelQ have \"(P \\<parallel> !P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by(rule Rel.BRPar)\n        hence \"weakStepSimAct (P \\<parallel> !P) Rs (P \\<parallel> !P) (bangRel Rel')\" by(rule IH)\n        thus ?case\n        proof(simp (no_asm) add: weakStepSimAct_def, auto)\n          fix Q' a x\n          assume \"weakStepSimAct (P \\<parallel> !P) (a<\\<nu>x> \\<prec> Q') (P \\<parallel> !P) (bangRel Rel')\" and \"x \\<sharp> P\"\n          then obtain P' where PTrans: \"(P \\<parallel> !P) \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\"\n                           and P'RelQ': \"(P', Q') \\<in> (bangRel Rel')\"\n            by(simp add: weakStepSimAct_def, blast)\n          from PTrans have \"!P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\"\n            by(rule Weak_Late_Step_Semantics.Bang)\n          with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> bangRel Rel'\" by blast\n        next\n          fix Q' a x\n          assume \"weakStepSimAct (P \\<parallel> !P) (a<x> \\<prec> Q') (P \\<parallel> !P) (bangRel Rel')\" and \"x \\<sharp> P\"\n          then obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<parallel> !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> (bangRel Rel')\"\n            by(simp add: weakStepSimAct_def, blast)\n          have \"\\<forall>u. \\<exists>P'. !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> (bangRel Rel')\"\n          proof(rule allI)\n            fix u\n            from L1 obtain P' where PTrans: \"P \\<parallel> !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                and P'RelQ': \"(P', Q'[x::=u]) \\<in> (bangRel Rel')\"\n              by blast\n            from PTrans have \"!P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Bang)\n            with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> (bangRel Rel')\" by blast\n          qed\n          thus \"\\<exists>P''. \\<forall>u. \\<exists>P'. !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> (bangRel Rel')\" by blast\n        next\n          fix Q' \\<alpha>\n          assume \"weakStepSimAct (P \\<parallel> !P) (\\<alpha> \\<prec> Q') (P \\<parallel> !P) (bangRel Rel')\"\n          then obtain P' where PTrans: \"(P \\<parallel> !P) \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\"\n                           and P'RelQ': \"(P', Q') \\<in> (bangRel Rel')\"\n            by(simp add: weakStepSimAct_def, blast)\n          from PTrans have \"!P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\"\n            by(rule Weak_Late_Step_Semantics.Bang)\n          with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> (bangRel Rel')\" by blast\n        qed\n      qed\n    qed\n  qed   \n  moreover from PRelQ have \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n  ultimately show ?thesis by(simp add: weakStepSim_def)\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Weak_Late_Step_Sim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.34897372228449697}}
{"text": "section \\<open>Implementation of Deterministic Rabin Automata\\<close>\n\ntheory DRA_Implement\nimports\n  \"DRA_Refine\"\n  \"../../Basic/Implement\"\nbegin\n\n  datatype ('label, 'state) drai = drai\n    (alphabeti: \"'label list\")\n    (initiali: \"'state\")\n    (transitioni: \"'label \\<Rightarrow> 'state \\<Rightarrow> 'state\")\n    (conditioni: \"'state rabin gen\")\n\n  definition drai_rel :: \"('label\\<^sub>1 \\<times> 'label\\<^sub>2) set \\<Rightarrow> ('state\\<^sub>1 \\<times> 'state\\<^sub>2) set \\<Rightarrow>\n    (('label\\<^sub>1, 'state\\<^sub>1) drai \\<times> ('label\\<^sub>2, 'state\\<^sub>2) drai) set\" where\n    [to_relAPP]: \"drai_rel L S \\<equiv> {(A\\<^sub>1, A\\<^sub>2).\n      (alphabeti A\\<^sub>1, alphabeti A\\<^sub>2) \\<in> \\<langle>L\\<rangle> list_rel \\<and>\n      (initiali A\\<^sub>1, initiali A\\<^sub>2) \\<in> S \\<and>\n      (transitioni A\\<^sub>1, transitioni A\\<^sub>2) \\<in> L \\<rightarrow> S \\<rightarrow> S \\<and>\n      (conditioni A\\<^sub>1, conditioni A\\<^sub>2) \\<in> \\<langle>rabin_rel S\\<rangle> list_rel}\"\n\n  lemma drai_param[param]:\n    \"(drai, drai) \\<in> \\<langle>L\\<rangle> list_rel \\<rightarrow> S \\<rightarrow> (L \\<rightarrow> S \\<rightarrow> S) \\<rightarrow>\n      \\<langle>rabin_rel S\\<rangle> list_rel \\<rightarrow> \\<langle>L, S\\<rangle> drai_rel\"\n    \"(alphabeti, alphabeti) \\<in> \\<langle>L, S\\<rangle> drai_rel \\<rightarrow> \\<langle>L\\<rangle> list_rel\"\n    \"(initiali, initiali) \\<in> \\<langle>L, S\\<rangle> drai_rel \\<rightarrow> S\"\n    \"(transitioni, transitioni) \\<in> \\<langle>L, S\\<rangle> drai_rel \\<rightarrow> L \\<rightarrow> S \\<rightarrow> S\"\n    \"(conditioni, conditioni) \\<in> \\<langle>L, S\\<rangle> drai_rel \\<rightarrow> \\<langle>rabin_rel S\\<rangle> list_rel\"\n    unfolding drai_rel_def fun_rel_def by auto\n\n  definition drai_dra_rel :: \"('label\\<^sub>1 \\<times> 'label\\<^sub>2) set \\<Rightarrow> ('state\\<^sub>1 \\<times> 'state\\<^sub>2) set \\<Rightarrow>\n    (('label\\<^sub>1, 'state\\<^sub>1) drai \\<times> ('label\\<^sub>2, 'state\\<^sub>2) dra) set\" where\n    [to_relAPP]: \"drai_dra_rel L S \\<equiv> {(A\\<^sub>1, A\\<^sub>2).\n      (alphabeti A\\<^sub>1, alphabet A\\<^sub>2) \\<in> \\<langle>L\\<rangle> list_set_rel \\<and>\n      (initiali A\\<^sub>1, initial A\\<^sub>2) \\<in> S \\<and>\n      (transitioni A\\<^sub>1, transition A\\<^sub>2) \\<in> L \\<rightarrow> S \\<rightarrow> S \\<and>\n      (conditioni A\\<^sub>1, condition A\\<^sub>2) \\<in> \\<langle>rabin_rel S\\<rangle> list_rel}\"\n\n  lemma drai_dra_param[param, autoref_rules]:\n    \"(drai, dra) \\<in> \\<langle>L\\<rangle> list_set_rel \\<rightarrow> S \\<rightarrow> (L \\<rightarrow> S \\<rightarrow> S) \\<rightarrow>\n      \\<langle>rabin_rel S\\<rangle> list_rel \\<rightarrow> \\<langle>L, S\\<rangle> drai_dra_rel\"\n    \"(alphabeti, alphabet) \\<in> \\<langle>L, S\\<rangle> drai_dra_rel \\<rightarrow> \\<langle>L\\<rangle> list_set_rel\"\n    \"(initiali, initial) \\<in> \\<langle>L, S\\<rangle> drai_dra_rel \\<rightarrow> S\"\n    \"(transitioni, transition) \\<in> \\<langle>L, S\\<rangle> drai_dra_rel \\<rightarrow> L \\<rightarrow> S \\<rightarrow> S\"\n    \"(conditioni, condition) \\<in> \\<langle>L, S\\<rangle> drai_dra_rel \\<rightarrow> \\<langle>rabin_rel S\\<rangle> list_rel\"\n    unfolding drai_dra_rel_def fun_rel_def by auto\n\n  definition drai_dra :: \"('label, 'state) drai \\<Rightarrow> ('label, 'state) dra\" where\n    \"drai_dra A \\<equiv> dra (set (alphabeti A)) (initiali A) (transitioni A) (conditioni A)\"\n  definition drai_invar :: \"('label, 'state) drai \\<Rightarrow> bool\" where\n    \"drai_invar A \\<equiv> distinct (alphabeti A)\"\n\n  lemma drai_dra_id_param[param]: \"(drai_dra, id) \\<in> \\<langle>L, S\\<rangle> drai_dra_rel \\<rightarrow> \\<langle>L, S\\<rangle> dra_rel\"\n  proof\n    fix Ai A\n    assume 1: \"(Ai, A) \\<in> \\<langle>L, S\\<rangle> drai_dra_rel\"\n    have 2: \"drai_dra Ai = dra (set (alphabeti Ai)) (initiali Ai) (transitioni Ai) (conditioni Ai)\"\n      unfolding drai_dra_def by rule\n    have 3: \"id A = dra (id (alphabet A)) (initial A) (transition A) (condition A)\" by simp\n    show \"(drai_dra Ai, id A) \\<in> \\<langle>L, S\\<rangle> dra_rel\" unfolding 2 3 using 1 by parametricity\n  qed\n\n  lemma drai_dra_br: \"\\<langle>Id, Id\\<rangle> drai_dra_rel = br drai_dra drai_invar\"\n  proof safe\n    show \"(A, B) \\<in> \\<langle>Id, Id\\<rangle> drai_dra_rel\" if \"(A, B) \\<in> br drai_dra drai_invar\"\n      for A and B :: \"('a, 'b) dra\"\n      using that unfolding drai_dra_rel_def drai_dra_def drai_invar_def\n      by (auto simp: in_br_conv list_set_rel_def)\n    show \"(A, B) \\<in> br drai_dra drai_invar\" if \"(A, B) \\<in> \\<langle>Id, Id\\<rangle> drai_dra_rel\"\n      for A and B :: \"('a, 'b) dra\"\n    proof -\n      have 1: \"(drai_dra A, id B) \\<in> \\<langle>Id, Id\\<rangle> dra_rel\" using that by parametricity\n      have 2: \"drai_invar A\"\n        using drai_dra_param(2 - 5)[param_fo, OF that]\n        by (auto simp: in_br_conv list_set_rel_def drai_invar_def)\n      show ?thesis using 1 2 unfolding in_br_conv by auto\n    qed\n  qed\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Transition_Systems_and_Automata/Automata/DRA/DRA_Implement.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.3489737222844969}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Peter Lammich <peter dot lammich at uni-muenster.de>\n    Maintainer:  Peter Lammich <peter dot lammich at uni-muenster.de>\n*)\n(*\n  Changes since submission on 2009-11-26:\n\n  2009-12-10: OrderedSet, implemented iterators, min, max, to_sorted_list\n\n*)\n\nsection \\<open>\\isaheader{Set Implementation by Red-Black-Tree}\\<close>\ntheory RBTSetImpl\nimports \n  \"../spec/SetSpec\"\n  RBTMapImpl\n  \"../gen_algo/SetByMap\"\n  \"../gen_algo/SetGA\"\nbegin\ntext_raw \\<open>\\label{thy:RBTSetImpl}\\<close>\n(*@impl Set\n  @type ('a::linorder) rs\n  @abbrv rs,r\n  Sets over linearly ordered elements implemented by red-black trees.\n*)\n\nsubsection \"Definitions\"\ntype_synonym\n  'a rs = \"('a::linorder,unit) rm\"\n\nsetup Locale_Code.open_block\ninterpretation rs_sbm: OSetByOMap rm_basic_ops by unfold_locales\nsetup Locale_Code.close_block\n\ndefinition rs_ops :: \"('x::linorder,'x rs) oset_ops\"\n  where [icf_rec_def]: \"rs_ops \\<equiv> rs_sbm.obasic.dflt_oops\"\n\nsetup Locale_Code.open_block\ninterpretation rs: StdOSetDefs rs_ops .\ninterpretation rs: StdOSet rs_ops\n  unfolding rs_ops_def\n  by (rule rs_sbm.obasic.dflt_oops_impl)\n\ninterpretation rs: StdSet_no_invar rs_ops\n  by unfold_locales (simp add: icf_rec_unf SetByMapDefs.invar_def)\nsetup Locale_Code.close_block\n\nsetup \\<open>ICF_Tools.revert_abbrevs \"rs\"\\<close>\n\nlemmas rbt_it_to_it_map_code_unfold[code_unfold] = \n  it_to_it_map_fold'[OF pi_rm]\n  it_to_it_map_fold'[OF pi_rm_rev]\n\nlemma pi_rs[proper_it]:\n  \"proper_it' rs.iteratei rs.iteratei\"\n  \"proper_it' rs.iterateoi rs.iterateoi\"\n  \"proper_it' rs.rev_iterateoi rs.rev_iterateoi\"\n  unfolding rs.iteratei_def[abs_def] rs.iterateoi_def[abs_def] \n    rs.rev_iterateoi_def[abs_def]\n  by (rule proper_it'I icf_proper_iteratorI)+\n\ninterpretation\n  pi_rs: proper_it_loc rs.iteratei rs.iteratei +\n  pi_rs_o: proper_it_loc rs.iterateoi rs.iterateoi +\n  pi_rs_ro: proper_it_loc rs.rev_iterateoi rs.rev_iterateoi\n  by unfold_locales (rule pi_rs)+\n\ndefinition test_codegen where \"test_codegen \\<equiv> (\n  rs.empty,\n  rs.memb,\n  rs.ins,\n  rs.delete,\n  rs.list_it,\n  rs.sng,\n  rs.isEmpty,\n  rs.isSng,\n  rs.ball,\n  rs.bex,\n  rs.size,\n  rs.size_abort,\n  rs.union,\n  rs.union_dj,\n  rs.diff,\n  rs.filter,\n  rs.inter,\n  rs.subset,\n  rs.equal,\n  rs.disjoint,\n  rs.disjoint_witness,\n  rs.sel,\n  rs.to_list,\n  rs.from_list,\n\n  rs.ordered_list_it,\n  rs.rev_list_it,\n  rs.min, \n  rs.max, \n  rs.to_sorted_list,\n  rs.to_rev_list\n)\"\n\nexport_code test_codegen checking SML\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/ICF/impl/RBTSetImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883735630721, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.34889135652099745}}
{"text": "theory Test_Map\n  imports \"../DP_Consistency\"\nbegin\n\nfunction f :: \"nat \\<Rightarrow> int\" where\n  \"f 0 = 0\"\n| \"f (Suc i) = undefined (map f [0..<Suc i])\"\n  by pat_completeness auto\ntermination\n  apply (relation \"measure size\")\n  by (auto intro: wf_mlex mlex_less )\n\nlemma map\\<^sub>T'_cong[fundef_cong]:\n  fixes f g\n  assumes \"\\<And>x. x \\<in> set xs \\<Longrightarrow> f x = g x\" \"xs = ys\"\n  shows   \"map\\<^sub>T' f xs = map\\<^sub>T' g ys\"\n  using assms\n  apply (induction xs arbitrary: ys)\n  subgoal\n    by auto\n  subgoal for x xs ys\n    by (cases ys) auto\n  done\n\nfunction f\\<^sub>T :: \"nat \\<Rightarrow>\\<^sub>T int\" where\n  \"f\\<^sub>T 0 = return 0\"\n| \"f\\<^sub>T (Suc i) = undefined (map\\<^sub>T' f\\<^sub>T [0..<Suc i])\"\n  by pat_completeness auto\ntermination\n  apply (relation \"size <*mlex*> {}\")\n  by (auto intro: wf_mlex mlex_less )\n\n(*\nlemma [fundef_cong]:\n  fixes f g x y\n  assumes \"\\<And> f' g'. f' \\<in> set_state f \\<Longrightarrow> g' \\<in> set_state g \\<Longrightarrow> f' y = g' y\" \"x = y\"\n  shows \"f . (return x) = g . (return y)\"\n    using assms unfolding fun_app_lifted_def by simp\n*)\n\nthm set_state_def\n     (*\nlemma [fundef_cong]:\n  fixes f g x y\n  assumes\n    \"\\<And> f' g' x' y'. f' \\<in> set_state f \\<Longrightarrow> g' \\<in> set_state g \\<Longrightarrow> x' \\<in> set_state x \\<Longrightarrow> y' \\<in> set_state y\n    \\<Longrightarrow> f' x' = g' y'\"\n  shows \"f . x = g . y\"\n    using assms unfolding fun_app_lifted_def sorry *)\n(*\nlemma [fundef_cong]:\n  fixes f g\n  assumes \"\\<And>x xs'. xs' \\<in> set_state xs \\<Longrightarrow> x \\<in> set xs' \\<Longrightarrow> f . (return x) = g . (return x)\" \"xs = ys\"\n  shows   \"map\\<^sub>T . f . xs = map\\<^sub>T . g . ys\"\n    sorry\n*)\n(*\nlemma [fundef_cong]:\n  fixes f g\n  assumes\n    \"\\<And>x xs' f' g'. xs' \\<in> set_state xs \\<Longrightarrow> x \\<in> set xs' \\<Longrightarrow> f' \\<in> set_state f \\<Longrightarrow> g' \\<in> set_state g\n    \\<Longrightarrow> f' x = g' x\" \"xs = ys\"\n  shows   \"map\\<^sub>T . f . xs \\<equiv> map\\<^sub>T . g . ys\"\n    sorry\n *)\n(*\nlemma [fundef_cong]:\n  fixes f g x y\n  assumes \"\\<And> x. do { f' \\<leftarrow> f; x' \\<leftarrow> x; f' x' } = do { g' \\<leftarrow> g; x' \\<leftarrow> x; g' x' }\" \"x = y\"\n  shows \"f . (return x) = g . (return y)\"\n    using assms unfolding fun_app_lifted_def by simp\n\nlemma [fundef_cong]:\n  fixes f g\n  assumes \"\\<And>x xs'. xs' \\<in> set_state xs \\<Longrightarrow> x \\<in> set xs' \\<Longrightarrow> f . (return x) = g . (return x)\" \"xs = ys\"\n  shows   \"map\\<^sub>T . f . xs = map\\<^sub>T . g . ys\"\n    sorry\n*)\n\n(*\nlemma [fundef_cong]:\n  fixes f g\n  assumes\n    \"\\<And>x xs'. xs' \\<in> set_state xs \\<Longrightarrow> x \\<in> set xs' \\<Longrightarrow> do { f' \\<leftarrow> f; f' x} = do { g' \\<leftarrow> g; g' x}\"\n    \"xs = ys\"\n  shows   \"map\\<^sub>T . f . xs = map\\<^sub>T . g . ys\"\n  sorry\n*)\n\nterm map\\<^sub>T' term map\\<^sub>T\nlemma map\\<^sub>T_map\\<^sub>T':\n  \"(map\\<^sub>T . (return ff)) = \\<langle>map\\<^sub>T' ff\\<rangle>\"\n  unfolding map\\<^sub>T_def lift_3_def\n  sorry\n    \n(*\nlemma [fundef_cong]:\n  fixes f g xs ys\n  assumes\n    \"\\<And>x xs'. xs' \\<in> set_state xs \\<Longrightarrow> x \\<in> set xs' \\<Longrightarrow> f x = g x\" \"xs = ys\"\n  shows \"map\\<^sub>T . (return f) . xs = map\\<^sub>T . (return g) . ys\"\n  using assms(2)\n  unfolding map\\<^sub>T_map\\<^sub>T'\n  apply simp\n  unfolding fun_app_lifted_def\n  apply (simp add: left_identity)\n  unfolding bind_def\n  apply simp\n  apply (rule ext)\n  subgoal for M\n    apply (cases \"runState ys M\")\n    apply auto\n    using assms(1)\n    apply auto\n    subgoal premises prems for xs M'\n      using prems(2-)\n      apply (induction xs arbitrary: ys)\n       apply simp\n      apply simp\n      sorry\n    done\n  done\n*)\n      \n      (*\nlemma [fundef_cong]:\n  fixes f g xs\n  assumes\n    \"\\<And>x xs'. xs' \\<in> set_state xs \\<Longrightarrow> x \\<in> set xs' \\<Longrightarrow> f x = g x\"\n  shows \"map\\<^sub>T . (return f) . xs = map\\<^sub>T . (return g) . xs\"\n  sorry\n    term 0 (**)\n*)\n\n(*\nfunction f\\<^sub>T' :: \"nat \\<Rightarrow>\\<^sub>T int\" where\n  \"f\\<^sub>T' 0 = return 0\"\n| \"f\\<^sub>T' (Suc i) = undefined (map\\<^sub>T . (return f\\<^sub>T') . (return ([0..<Suc i])))\"\n  by pat_completeness auto\ntermination\n  apply (relation \"measure size\")\n   apply simp\n  apply (simp add: Monad.return_def)\n  by auto\nterm 0 (**)\n*)\n    thm map\\<^sub>T_def[unfolded lift_3_def]\n  \ncontext dp_consistency\nbegin\n\nlemma map\\<^sub>T_return_return_cong:\n  fixes f g xs\n  assumes \"\\<And>x. x\\<in>set xs \\<Longrightarrow> f x = g x\"\n  shows \"map\\<^sub>T . \\<langle>f\\<rangle> . \\<langle>xs\\<rangle> = map\\<^sub>T . \\<langle>g\\<rangle> . \\<langle>xs\\<rangle>\"\n  unfolding map\\<^sub>T_map\\<^sub>T' return_app_return \n  using assms by (auto intro: map\\<^sub>T'_cong)\n\nlemma map\\<^sub>T_return_upt_cong:\n  fixes f g l r\n  assumes \"\\<And>x. x\\<in>set [l..<r] \\<Longrightarrow> f x = g x\"\n  shows \"map\\<^sub>T . \\<langle>f\\<rangle> . (upt\\<^sub>T . \\<langle>l\\<rangle> . \\<langle>r\\<rangle>) = map\\<^sub>T . \\<langle>g\\<rangle> . (upt\\<^sub>T . \\<langle>l\\<rangle> . \\<langle>r\\<rangle>)\"\n  unfolding upt\\<^sub>T_def lift_33_def return_app_return using assms by (auto intro: map\\<^sub>T_return_return_cong)\nend\n  \nfun fe :: \"nat \\<Rightarrow> nat\" where\n  \"fe 0 = 0\"\n| \"fe (Suc x) = undefined (map (\\<lambda>x. fe x + 1) [0..<Suc x])\"", "meta": {"author": "exprosic", "repo": "praktikum-dp2", "sha": "49a8f1cdca6dadfac0d667aab0bebb2431f2a822", "save_path": "github-repos/isabelle/exprosic-praktikum-dp2", "path": "github-repos/isabelle/exprosic-praktikum-dp2/praktikum-dp2-49a8f1cdca6dadfac0d667aab0bebb2431f2a822/testcases/Test_Map.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.3488913482066966}}
{"text": ";;; -*- syntax: common-lisp; package: KEIM; base: 10; mode: LISP -*-\n;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;\n;;                                                                          ;;\n;;   Copyright (C) 1993 by AG Siekmann, Fachbereich Informatik,             ;;\n;;   Universitaet des Saarlandes, Saarbruecken, Germany.                    ;;\n;;   All rights reserved.                                                   ;;\n;;   For information about this program, write to:                          ;;\n;;     KEIM Project                                                         ;;\n;;     AG Siekmann/FB Informatik                                            ;;\n;;     Universitaet des Saarlandes                                          ;;\n;;     Postfach 1150                                                        ;;\n;;     D-66041 Saarbruecken                                                 ;;\n;;     Germany                                                              ;;\n;;   electronic mail: keim@cs.uni-sb.de                                     ;;\n;;                                                                          ;;\n;;   The author makes no representations about the suitability of this      ;;\n;;   software for any purpose.  It is provided \"AS IS\" without express or   ;;\n;;   implied warranty.  In particular, it must be understood that this      ;;\n;;   software is an experimental version, and is not suitable for use in    ;;\n;;   any safety-critical application, and the author denies a license for   ;;\n;;   such use.                                                              ;;\n;;                                                                          ;;\n;;   You may use, copy, modify and distribute this software for any         ;;\n;;   noncommercial and non-safety-critical purpose.  Use of this software   ;;\n;;   in a commercial product is not included under this license.  You must  ;;\n;;   maintain this copyright statement in all copies of this software that  ;;\n;;   you modify or distribute.                                              ;;\n;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;\n(in-package :omega)\n\n(th~deftheorem first-second-of-pair\n           (in typed-set)\n (conclusion (all-types aa bb (forall  (lam (x aa)\n\t\t\t\t\t (forall (lam (y bb)\n\t\t\t\t\t\t      (and\n\t\t\t\t\t\t       (= (first-of-pair (pair x y)) x)\n\t\t\t\t\t\t       (= (second-of-pair (pair y x)) x)))))))))\n(th~deftheorem pair-equality\n           (in typed-set)\n (conclusion (all-types aa bb\n\t\t\t(forall  (lam (x aa)\n\t\t\t\t      (forall (lam (y bb)\n\t\t\t\t\t\t   (forall (lam (a aa)\n\t\t\t\t\t\t\t\t(forall (lam (b bb)\n\t\t\t\t\t\t      (equiv\n\t\t\t\t\t\t       (= (pair x y)(pair a b))\n\t\t\t\t\t\t       (and (= a x)(= y b))))))))))))))\n\n(th~deftheorem chris-test-1\n           (in base)\n (conclusion (forall  (lam (x o)\n\t(or (= x (or x (not x)))\n            (= x (and x (not x))))))))\n;;;;;;;;;\n\n(th~deftheorem commutativity-of-union\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types bb (forall (lam (X (o bb)) (forall (lam (Y (o bb))\n\t\t\t     (= (union X Y) (union Y X))))))))\n\t       (help \"Commutativity of union.\"))\n\n\n(th~deftheorem commutativity-of-intersection\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types bb (forall (lam (X (o bb)) (forall (lam (Y (o bb))\n\t\t\t     (= (intersection X Y) (intersection Y X))))))))\n\t       (help \"Commutativity of intersection.\"))\n\n(th~deftheorem reflexive-subsetp\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types bb (forall (lam (X (o bb))\n\t\t\t     (subsetp X X)))))\n\t       (help \"Each set is a subset of itself.\"))\n\n(th~deftheorem subsetp-of-union\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types bb (forall (lam (X (o bb)) (forall (lam (A (o bb)) (forall (lam (B (o bb))\n\t\t\t\t(implies (or (subsetp X A)\n\t\t\t\t\t     (subsetp X B))\n\t\t\t\t\t (subsetp X (union A B)))))))))))\n\t       (help \"Subset of union of sets.\"))\n\n(th~deftheorem subsetp-of-intersection\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types bb (forall (lam (X (o bb)) (forall (lam (A (o bb)) (forall (lam (B (o bb))\n\t\t\t\t(implies (and (subsetp X A)\n\t\t\t\t\t      (subsetp X B))\n\t\t\t\t\t (subsetp X (intersection A B)))))))))))\n\t       (help \"Subset of intersection of sets.\"))\n\n(th~deftheorem subsetp-of-union-simple\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types bb (forall (lam (X (o bb)) (forall (lam (A (o bb)) \n\t\t\t\t\t (subsetp X (union A X))))))))\n\t       (help \"Subset of union of sets, special case.\"))\n\n(th~deftheorem union-is-subsetp\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types a (forall (lam (X (o a))\n\t\t\t\t        (forall (lam (Y (o a))\n\t\t\t\t\t(forall (lam (Z (o a))\n\t\t\t\t\t\t     (implies (and (subsetp X Z)\n\t\t\t\t\t\t\t\t   (subsetp Y Z))\n\t\t\t\t\t\t\t      (subsetp (union X Y) Z))))))))))\n\t       (help \"Union of X Y is subset if each X and Y is subset.\"))\n\n(th~deftheorem intersection-is-subsetp\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types a (forall (lam (X (o a))\n\t\t\t\t        (forall (lam (Y (o a))\n\t\t\t\t\t(forall (lam (Z (o a))\n\t\t\t\t\t\t     (implies (or (subsetp X Z)\n\t\t\t\t\t\t\t\t  (subsetp Y Z))\n\t\t\t\t\t\t\t      (subsetp (intersection X Y) Z))))))))))\n\t       (help \"Intersection of X Y is subset if either X or Y is subset.\"))\n\n\n(th~deftheorem intersection-is-subsetp-simple\n\t (in typed-set)\n         (conclusion  (all-types a\n\t\t\t   (forall (lam (X (o a))\n                           (forall (lam (Y (o a))\n                              (subsetp (intersection X Y) X)))))))\n\t (help \"Intersection is subset, special case.\"))\n\n(th~deftheorem union-of-itself\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types bb (forall (lam (X (o bb)) \n\t\t\t\t\t (= X (union X X))))))\n\t       (help \"The union of the same sets S is equal to S.\"))\n\n(th~deftheorem intersection-of-itself\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types bb (forall (lam (X (o bb)) \n\t\t\t\t\t (= X (intersection X X))))))\n\t       (help \"The union of the same sets S is equal to S.\"))\n\n(th~deftheorem distributivity-of-union-to-intersection\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types bb (forall (lam (X (o bb)) (forall (lam (Y (o bb)) (forall (lam (Z (o bb))\n\t\t\t     (= (union (intersection X Y) Z)\n\t\t\t\t(intersection (union X Z) (union Y Z)))))))))))\n\t       (help \"Distributivity of union and intersection.\"))\n\n(th~deftheorem distributivity-of-intersection-to-union\n\t       (in typed-set) \n\t       (category THEOREM)\n\t       (conclusion (all-types bb (forall (lam (X (o bb)) (forall (lam (Y (o bb)) (forall (lam (Z (o bb))\n\t\t\t     (= (intersection (union X Y) Z)\n\t\t\t\t(union (intersection X Z) (intersection Y Z)))))))))))\n\t       (help \"Distributivity of union and intersection.\"))\n\n\n\n\n\n\n\n", "meta": {"author": "theoremprover-museum", "repo": "OMEGA", "sha": "b95b25f8bb16847a2e18d106510446a175f7145a", "save_path": "github-repos/isabelle/theoremprover-museum-OMEGA", "path": "github-repos/isabelle/theoremprover-museum-OMEGA/OMEGA-b95b25f8bb16847a2e18d106510446a175f7145a/theories/typed-set/typed-set-theorems.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.6039318337259583, "lm_q1q2_score": 0.34876783486490925}}
{"text": "(* \n   Title: Psi-calculi   \n   Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Tau_Laws_Weak\n  imports Weaken_Bisimulation Weak_Congruence Tau_Sim Tau_Stat_Imp\nbegin\n\ncontext weakTauLaws begin\n\nlemma tauLaw1:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  \n  shows \"\\<Psi> \\<rhd> \\<tau>.(P) \\<approx> P\"\nproof - \n  let ?X = \"{(\\<Psi>, \\<tau>.(P), P) | \\<Psi> P. True}\" let ?Y = \"{(\\<Psi>, P, \\<tau>.(P)) | \\<Psi> P. True}\"\n  have \"(\\<Psi>, \\<tau>.(P), P) \\<in> ?X \\<union> ?Y\" by auto\n  moreover have \"eqvt(?X \\<union> ?Y)\" by(auto simp add: eqvt_def simp add: eqvts)\n  ultimately have \"\\<Psi> \\<rhd> \\<tau>.(P) \\<approx>\\<^sub>w P\"\n  proof(coinduct rule: weakenTransitiveCoinduct)\n    case(cStatImp \\<Psi> P Q)\n    show ?case\n    proof(cases \"(\\<Psi>, P, Q) \\<in> ?X\")\n      case True\n      {\n        fix \\<Psi> P\n        have \"\\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<(?X \\<union> ?Y \\<union> weakBisim)> P\" by(auto simp add: weakenStatImp_def intro: weakBisimReflexive)\n        moreover have \"(\\<Psi>, \\<tau>.(P), P) \\<in> ?X \\<union> ?Y \\<union> weakBisim\" by auto\n        ultimately have \"\\<Psi> \\<rhd> \\<tau>.(P) \\<lessapprox>\\<^sub>w<(?X \\<union> ?Y \\<union> weakBisim)> P\"\n          by(rule tauLaw1StatImpLeft)\n      }\n      with `(\\<Psi>, P, Q) \\<in> ?X` show ?thesis by auto \n    next\n      case False\n      from `(\\<Psi>, P, Q) \\<notin> ?X` `(\\<Psi>, P, Q) \\<in> ?X \\<union> ?Y` have \"(\\<Psi>, P, Q) \\<in> ?Y\" by auto\n      {\n        fix \\<Psi> P\n        have \"\\<Psi> \\<rhd> P \\<lessapprox><weakBisim> P\" using weakBisimReflexive\n          by(rule weakBisimE)\n        moreover have \"\\<And>\\<Psi> P Q R. \\<lbrakk>\\<Psi> \\<rhd> P \\<approx> Q; \\<Psi> \\<rhd> Q \\<sim> R\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, R) \\<in> ?X \\<union> ?Y \\<union> weakBisim\"\n          by(fastforce intro: weakBisimTransitive strongBisimWeakBisim)\n        ultimately have  \"\\<Psi> \\<rhd> P \\<lessapprox><( ?X \\<union> ?Y \\<union> weakBisim)> \\<tau>.(P)\" by(rule tauLaw1StatImpRight)\n        moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?X \\<union> ?Y \\<union> weakBisim; \\<Psi> \\<simeq> \\<Psi>'\\<rbrakk> \\<Longrightarrow> (\\<Psi>', P, Q) \\<in> ?X \\<union> ?Y \\<union> weakBisim\"\n          by(auto dest: statEqWeakBisim)\n        ultimately have \"\\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<( ?X \\<union> ?Y \\<union> weakBisim)> \\<tau>.(P)\" by(rule weakStatImpWeakenStatImp)\n      }\n      with `(\\<Psi>, P, Q) \\<in> ?Y` show ?thesis by auto\n    qed\n  next\n    case(cSim \\<Psi> P Q)\n    let ?Z = \"{(\\<Psi>, P, Q) | \\<Psi> P Q. \\<exists>P' Q'. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> ?X \\<union> ?Y \\<union> weakenBisim \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n    have \"eqvt ?Z\" \n      apply auto\n      apply(auto simp add: eqvt_def eqvts)\n      apply(rule_tac x=\"(p \\<bullet> (\\<tau>.(Q')))\" in exI)\n      apply(auto intro: bisimClosed)\n      apply(simp add: eqvts)\n      apply(blast intro: bisimClosed weakBisimClosed)\n      apply(rule_tac x=\"(p \\<bullet> P')\" in exI)\n      apply(auto intro: bisimClosed)\n      apply(rule_tac x=\"\\<tau>.(p \\<bullet> P')\" in exI)\n      apply auto\n      apply(drule_tac p=p and Q=b in bisimClosed)\n      apply(simp add: eqvts)\n      apply(rule_tac x=\"(p \\<bullet> P')\" in exI)\n      apply(auto intro: bisimClosed)\n      apply(rule_tac x=\"p \\<bullet> Q'\" in exI)\n      apply auto\n      by(blast intro: bisimClosed dest: weakBisimClosed)+\n    show ?case\n    proof(cases \"(\\<Psi>, P, Q) \\<in> ?X\")\n      case True\n      {\n        fix P\n        have \"\\<Psi> \\<rhd> P \\<leadsto><?Z> P\" using weakenBisimEqWeakBisim by(blast intro: weakSimReflexive weakBisimReflexive bisimReflexive)\n        moreover note `eqvt ?Z`\n        moreover have \"\\<And>\\<Psi> P Q R. \\<lbrakk>\\<Psi> \\<rhd> P \\<sim> Q; (\\<Psi>, Q, R) \\<in> ?Z\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, R) \\<in> ?Z\"\n          by(blast intro: bisimTransitive)\n        ultimately have \"\\<Psi> \\<rhd> \\<tau>.(P) \\<leadsto><?Z> P\"\n          by(rule tauLaw1SimLeft)\n        moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?Z; \\<Psi> \\<simeq> \\<Psi>'\\<rbrakk> \\<Longrightarrow> (\\<Psi>', P, Q) \\<in> ?Z\"\n          by simp (blast intro: statEqWeakBisim statEqBisim)\n        ultimately have \"\\<Psi> \\<rhd> \\<tau>.(P) \\<leadsto>\\<^sub>w<?Z> P\" by(rule weakSimWeakenSim)\n      }\n      with `(\\<Psi>, P, Q) \\<in> ?X` show ?thesis by auto\n    next\n      case False\n      from `(\\<Psi>, P, Q) \\<notin> ?X` `(\\<Psi>, P, Q) \\<in> ?X \\<union> ?Y` have \"(\\<Psi>, P, Q) \\<in> ?Y\" by auto\n      moreover {\n        fix P\n        note `eqvt ?Z`  \n        moreover have \"(\\<Psi>, P, P) \\<in> ?Z\" by simp (blast intro: weakBisimReflexive bisimReflexive)\n        moreover have \"\\<And>\\<Psi> P Q R. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?Z; \\<Psi> \\<rhd> Q \\<sim> R\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, R) \\<in> ?Z\"\n          by(blast intro: bisimTransitive)\n        ultimately have \"\\<Psi> \\<rhd> P \\<leadsto><?Z> \\<tau>.(P)\" by(rule tauLaw1SimRight)\n        moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?Z; \\<Psi> \\<simeq> \\<Psi>'\\<rbrakk> \\<Longrightarrow> (\\<Psi>', P, Q) \\<in> ?Z\"\n          by simp (blast intro: statEqWeakBisim statEqBisim)\n        ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>\\<^sub>w<?Z> \\<tau>.(P)\" by(rule weakSimWeakenSim)\n      }\n      ultimately show ?thesis by auto\n    qed\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by auto\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by auto\n  qed\n  thus ?thesis by simp\nqed\n\nlemma tauLaw3:\n  fixes \\<Psi> :: 'b\n  and   \\<alpha> :: \"'a prefix\"\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P)) \\<approx> \\<alpha>\\<cdot>P\"\nproof -\n  let ?X = \"({(\\<Psi>, \\<alpha>\\<cdot>(\\<tau>.(P)), \\<alpha>\\<cdot>P) | \\<Psi> \\<alpha> P. True})\"\n  let ?Y = \"({(\\<Psi>, \\<alpha>\\<cdot>P, \\<alpha>\\<cdot>(\\<tau>.(P))) | \\<Psi> \\<alpha> P. True})\"\n\n  have \"(\\<Psi>, \\<alpha>\\<cdot>(\\<tau>.(P)), \\<alpha>\\<cdot>P) \\<in> ?X \\<union> ?Y\" by blast\n  moreover have \"eqvt(?X \\<union> ?Y)\" by(fastforce simp add: eqvt_def simp add: eqvts)\n  ultimately have \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P)) \\<approx>\\<^sub>w \\<alpha>\\<cdot>P\"\n  proof(coinduct rule: weakenTransitiveCoinduct)\n    case(cStatImp \\<Psi> P Q)\n    show ?case\n    proof(cases \"(\\<Psi>, P, Q) \\<in> ?X\")\n      case True\n      {\n        fix \\<Psi> \\<alpha> P\n        have \"\\<And>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', \\<alpha>\\<cdot>(\\<tau>.(P)), \\<alpha>\\<cdot>P) \\<in> ?X \\<union> ?Y \\<union> weakenBisim\" by auto\n        hence \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P)) \\<lessapprox><(?X \\<union> ?Y \\<union> weakenBisim)> \\<alpha>\\<cdot>P\" by(rule tauLaw3StatImpLeft)\n        moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?X \\<union> ?Y \\<union> weakenBisim; \\<Psi> \\<simeq> \\<Psi>'\\<rbrakk> \\<Longrightarrow> (\\<Psi>', P, Q) \\<in> ?X \\<union> ?Y \\<union> weakenBisim\"\n          by(fastforce intro: statEqWeakBisim)\n        ultimately have \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P)) \\<lessapprox>\\<^sub>w<(?X \\<union> ?Y \\<union> weakenBisim)> \\<alpha>\\<cdot>P\" by(rule weakStatImpWeakenStatImp)\n      }\n      with `(\\<Psi>, P, Q) \\<in> ?X` show ?thesis by blast\n    next\n      case False\n      {\n        fix \\<Psi> \\<alpha> P\n        have \"\\<And>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', \\<alpha>\\<cdot>P, \\<alpha>\\<cdot>(\\<tau>.(P))) \\<in> ?X \\<union> ?Y \\<union> weakenBisim\" by auto\n        hence \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>P \\<lessapprox><(?X \\<union> ?Y \\<union> weakenBisim)> \\<alpha>\\<cdot>(\\<tau>.(P))\" by(rule tauLaw3StatImpRight)\n        moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?X \\<union> ?Y \\<union> weakenBisim; \\<Psi> \\<simeq> \\<Psi>'\\<rbrakk> \\<Longrightarrow> (\\<Psi>', P, Q) \\<in> ?X \\<union> ?Y \\<union> weakenBisim\"\n          by(fastforce intro: statEqWeakBisim)\n        ultimately have \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>P \\<lessapprox>\\<^sub>w<(?X \\<union> ?Y \\<union> weakenBisim)> \\<alpha>\\<cdot>(\\<tau>.(P))\" by(rule weakStatImpWeakenStatImp)\n      }\n      moreover from `(\\<Psi>, P, Q) \\<notin> ?X` `(\\<Psi>, P, Q) \\<in> ?X \\<union> ?Y` have \"(\\<Psi>, P, Q) \\<in> ?Y\" by blast\n      ultimately show ?thesis by auto\n    qed\n  next\n    case(cSim \\<Psi> P Q)\n    let ?Z = \"{(\\<Psi>, P, Q) | \\<Psi> P Q. \\<exists>P' Q'. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> ?X \\<union> ?Y \\<union> weakenBisim \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n    have \"eqvt ?Z\" \n      apply(clarsimp simp add: eqvt_def)\n      apply(elim disjE)\n      apply(rule_tac x=\"p \\<bullet> P'\" in exI)\n      apply(clarsimp simp add: bisimClosed eqvts)\n      apply(blast intro: bisimClosed eqvts)\n      apply(rule_tac x=\"p \\<bullet> P'\" in exI)\n      apply(clarsimp simp add: bisimClosed eqvts)\n      apply(rule_tac x=\"p \\<bullet> (\\<alpha>\\<cdot>(\\<tau>.(P)))\" in exI)\n      apply(clarsimp simp add: eqvts)\n      apply(rule conjI)\n      apply(rule disjI2)\n      apply(blast intro: bisimClosed eqvts)\n      apply(drule_tac p=p in bisimClosed)\n      apply(drule_tac p=p in bisimClosed)\n      apply(simp add: eqvts)\n      by(blast dest: bisimClosed weakBisimClosed)\n    show ?case\n    proof(cases \"(\\<Psi>, P, Q) \\<in> ?X\")\n      case True\n      note `(\\<Psi>, P, Q) \\<in> ?X`\n      moreover {\n        fix \\<Psi> P \\<alpha>\n        note `eqvt ?Z`\n        moreover have \"(\\<Psi>, P, P) \\<in> ?Z\" using weakenBisimEqWeakBisim by(blast intro: weakBisimReflexive bisimReflexive)\n        moreover have \"\\<And>xvec Tvec. length xvec = length Tvec \\<Longrightarrow> (\\<Psi>, P[xvec::=Tvec], P[xvec::=Tvec]) \\<in> ?Z\"\n           using weakenBisimEqWeakBisim by(blast intro: weakBisimReflexive bisimReflexive)\n        moreover have \"\\<And>\\<Psi> P Q R S. \\<lbrakk>\\<Psi> \\<rhd> P \\<sim> Q; (\\<Psi>, Q, R) \\<in> ?Z; \\<Psi> \\<rhd> R \\<sim> S\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, S) \\<in> ?Z\" by(blast intro: bisimTransitive)\n        moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> ?Z \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> ?Z\" by(blast dest: weakenBisimE(3) bisimE(3))\n        ultimately have \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P)) \\<leadsto><?Z> \\<alpha>\\<cdot>P\" by(rule tauLaw3SimLeft)\n        moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?Z; \\<Psi> \\<simeq> \\<Psi>'\\<rbrakk> \\<Longrightarrow> (\\<Psi>', P, Q) \\<in> ?Z\" by simp (blast dest: statEqWeakBisim statEqBisim)\n        ultimately have \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P)) \\<leadsto>\\<^sub>w<?Z> \\<alpha>\\<cdot>P\" by(rule weakSimWeakenSim)\n      }\n      ultimately show ?thesis by auto\n    next\n      case False\n      from `(\\<Psi>, P, Q) \\<notin> ?X` `(\\<Psi>, P, Q) \\<in> ?X \\<union> ?Y` have \"(\\<Psi>, P, Q) \\<in> ?Y\" by blast\n      moreover {\n        fix \\<Psi> P \\<alpha>\n        note `eqvt ?Z`\n        moreover have \"\\<And>\\<Psi> xvec Tvec. length xvec=length Tvec \\<Longrightarrow> (\\<Psi>, P[xvec::=Tvec], \\<tau>.(P[xvec::=Tvec])) \\<in> ?Z\"\n          by simp (blast intro: weakBisimE(4) bisimReflexive tauLaw1)\n        moreover have \"\\<And>\\<Psi> P Q R S. \\<lbrakk>\\<Psi> \\<rhd> P \\<sim> Q; (\\<Psi>, Q, R) \\<in> ?Z; \\<Psi> \\<rhd> R \\<sim> S\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, S) \\<in> ?Z\" by(blast intro: bisimTransitive)\n        moreover have \"\\<And>\\<Psi>. (\\<Psi>, P, \\<tau>.(P)) \\<in> ?Z\" by simp (blast intro: weakBisimE(4) bisimReflexive tauLaw1)\n        ultimately have \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>P \\<leadsto><?Z> \\<alpha>\\<cdot>(\\<tau>.(P))\" by(rule tauLaw3SimRight)\n        moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?Z; \\<Psi> \\<simeq> \\<Psi>'\\<rbrakk> \\<Longrightarrow> (\\<Psi>', P, Q) \\<in> ?Z\" by simp (blast dest: statEqWeakBisim statEqBisim)\n        ultimately have \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>P \\<leadsto>\\<^sub>w<?Z> \\<alpha>\\<cdot>(\\<tau>.(P))\" by(rule weakSimWeakenSim)\n      }\n      ultimately show ?thesis by auto\n    qed\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by auto\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by blast \n  qed\n  thus ?thesis by simp\nqed\n  \nlemma tauLaw3PsiCong:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P)) \\<doteq> \\<alpha>\\<cdot>P\"\nproof(induct rule: weakPsiCongI)\n  case cWeakBisim\n  show ?case by(rule tauLaw3)\nnext\n  case cSimLeft\n  have \"\\<Psi> \\<rhd> P \\<approx> P\" by(rule weakBisimReflexive)\n  moreover have \"\\<And>\\<Psi> P Q R S. \\<lbrakk>\\<Psi> \\<rhd> P \\<sim> Q; \\<Psi> \\<rhd> Q \\<approx> R; \\<Psi> \\<rhd> R \\<sim> S\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<rhd> P \\<approx> S\"\n    by(blast intro: weakBisimTransitive strongBisimWeakBisim)\n  ultimately show ?case using weakBisimE(3) by(rule tauLaw3CongSimLeft)\nnext\n  case cSimRight\n  have \"\\<Psi> \\<rhd>  P \\<approx> P\" by(rule weakBisimReflexive)\n  moreover have \"\\<And>\\<Psi> P Q R S. \\<lbrakk>\\<Psi> \\<rhd> P \\<sim> Q; \\<Psi> \\<rhd> Q \\<approx> R; \\<Psi> \\<rhd> R \\<sim> S\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<rhd> P \\<approx> S\"\n    by(blast intro: weakBisimTransitive strongBisimWeakBisim)\n  ultimately show ?case using tauLaw1[THEN weakBisimE(4)]\n    by(rule tauLaw3CongSimRight)\nqed\n  \nlemma tauLaw3Cong:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<alpha>\\<cdot>(\\<tau>.(P)) \\<doteq>\\<^sub>c \\<alpha>\\<cdot>P\"\nproof(induct rule: weakCongI)\n  case(cWeakPsiCong \\<Psi> \\<sigma>)\n  show ?case\n  proof(nominal_induct \\<alpha> rule: prefix.strong_inducts)\n  next\n    case(pInput M yvec N)\n    obtain p where \"set p \\<subseteq> set yvec \\<times> set(p \\<bullet> yvec)\" and \"(p \\<bullet> yvec) \\<sharp>* N\" and \"(p \\<bullet> yvec) \\<sharp>* P\" and \"(p \\<bullet> yvec) \\<sharp>* \\<sigma>\"\n      by(rule_tac xvec=yvec and c=\"(N, P, \\<sigma>)\" in name_list_avoiding) auto\n    thus ?case using `wellFormedSubst \\<sigma>` tauLaw3PsiCong[where \\<alpha>=\"pInput (substTerm.seqSubst M \\<sigma>) (p \\<bullet> yvec) (substTerm.seqSubst (p \\<bullet> N) \\<sigma>)\"]\n      by(simp add: inputChainAlpha' eqvts)\n  next\n    case(pOutput M N)\n    thus ?case using  `wellFormedSubst \\<sigma>` tauLaw3PsiCong[where \\<alpha>=\"pOutput (substTerm.seqSubst M \\<sigma>) (substTerm.seqSubst N \\<sigma>)\"]\n      by simp\n  next\n    case pTau\n    thus ?case using  `wellFormedSubst \\<sigma>` tauLaw3PsiCong[where \\<alpha>=\"pTau\"]\n      by simp\n  qed\nqed\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Psi_Calculi/Tau_Laws_Weak.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.6039318337259584, "lm_q1q2_score": 0.34876782608180557}}
{"text": "(*  Title:   UPL.thy\n    Author:  Michikazu Hirata, Tokyo Institute of Technology\n\n*)\nsubsection \\<open> UPL \\<close>\n\ntheory UPL\n  imports PL\n\nbegin\n\ndefinition upl_der :: \"['cont quasi_borel, 'cont assump, 'cont \\<Rightarrow> 'typ, 'typ quasi_borel, ('cont \\<Rightarrow> 'typ) \\<Rightarrow> 'cont \\<Rightarrow> bool] \\<Rightarrow> bool\" where\n\"upl_der \\<Gamma> \\<Psi> t T \\<phi> \\<equiv> (hpprog_typing \\<Gamma> t T \\<and> (\\<exists>\\<phi>'. \\<phi> = (\\<lambda>t k. \\<phi>' k (t k))) \\<and> (\\<forall>k\\<in>qbs_space \\<Gamma>. hp_conjall \\<Psi> k \\<longrightarrow> \\<phi> t k))\"\n\nsyntax\n \"_upl_der\" :: \"any \\<Rightarrow> 'cont quasi_borel \\<Rightarrow> 'cont assump \\<Rightarrow> ('cont \\<Rightarrow> 'typ) \\<Rightarrow> 'typ quasi_borel \\<Rightarrow> (('cont \\<Rightarrow> 'typ) \\<Rightarrow> 'cont \\<Rightarrow> bool) \\<Rightarrow> bool\" (\"_ | _ \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L _ ;; _ | _\" 21)\n\ntranslations\n \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | \\<phi>\" \\<rightleftharpoons> \"CONST upl_der \\<Gamma> \\<Psi> e T \\<phi>\"\n\n(* Example *)\nterm \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L hp_const 1 ;; \\<nat>\\<^sub>Q | \\<lambda>r. hp_const 1 \\<le>\\<^sub>P\\<^sub>L r +\\<^sub>t r\"\n\nlemma upl_phi_equiv1:\n  assumes \"\\<phi> = (\\<lambda>r env. \\<psi> env (r env))\"\n      and \"e k = e' k\"\n    shows \"\\<phi> e k = \\<phi> e' k\"\n  using assms by simp\n\nlemma upl_phi_const:\n  assumes \"\\<phi> = (\\<lambda>r env. \\<psi> env (r env))\"\n  shows \"\\<phi> (hp_const (e k)) k = \\<phi> e k\"\n  by(simp add: assms hp_const_def)\n\ntext \\<open> The completeness theorem w.r.t. derivability is proved by expanding definitions. \\<close>\nlemma pl_upl_complete:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>t t ;; T\"\n      and \"\\<phi> = (\\<lambda>t k. \\<phi>' k (t k))\"\n    shows \"(\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<phi> t) \\<longleftrightarrow> (\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L t ;; T | \\<phi>)\"\n  using assms\n  by(auto simp add: pl_der_def upl_der_def)\n\nlemma pl_if_upl:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>t t ;; T\"\n          \"\\<phi> = (\\<lambda>t k. \\<phi>' k (t k))\"\n      and \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L t ;; T | \\<phi>\"\n    shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<phi> t\"\n  using pl_upl_complete[OF assms(1,2)] assms(3)\n  by simp\n\nlemma upl_if_pl:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>t t ;; T\"\n          \"\\<phi> = (\\<lambda>t k. \\<phi>' k (t k))\"\n      and \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<phi> t\"\n    shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L t ;; T | \\<phi>\"\n  using pl_upl_complete[OF assms(1,2)] assms(3)\n  by simp\n\nlemma upl_const:\n  assumes \"\\<phi> = (\\<lambda>t k. \\<phi>' k (t k))\"\n          \"\\<Gamma> \\<turnstile>\\<^sub>t hp_const c ;; T\"\n      and \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<phi> (hp_const c)\"\n    shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L hp_const c ;; T | \\<phi>\"\n  using assms by(auto simp add: pl_der_def upl_der_def)\n\nlemma upl_var1:\n  assumes \"\\<phi> = (\\<lambda>t k. \\<phi>' k (t k))\"\n      and \"\\<Gamma>,,X | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<phi> var1\"\n    shows \"\\<Gamma>,,X | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L var1 ;; X | \\<phi>\"\n  using assms hpt_var1 by(auto simp add: pl_der_def upl_der_def)\n\nlemma upl_var2:\n  assumes \"\\<phi> = (\\<lambda>t k. \\<phi>' k (t k))\"\n      and \"\\<Gamma>,,Z,,Y | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<phi> var2\"\n    shows \"\\<Gamma>,,Z,,Y | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L var2 ;; Z | \\<phi>\"\n  using assms hpt_var2 by(auto simp add: pl_der_def upl_der_def)\n\nlemma upl_var3:\n  assumes \"\\<phi> = (\\<lambda>t k. \\<phi>' k (t k))\"\n      and \"\\<Gamma>,,Z,,Y,,X | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<phi> var3\"\n    shows \"\\<Gamma>,,Z,,Y,,X | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L var3 ;; Z | \\<phi>\"\n  using assms hpt_var3 by(auto simp add: pl_der_def upl_der_def)\n\nlemma upl_var4:\n  assumes \"\\<phi> = (\\<lambda>t k. \\<phi>' k (t k))\"\n      and \"\\<Gamma>,,Z,,Y,,X,,W | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<phi> var4\"\n    shows \"\\<Gamma>,,Z,,Y,,X,,W | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L var4 ;; Z | \\<phi>\"\n  using assms hpt_var4 by(auto simp add: pl_der_def upl_der_def)\n\nlemma upl_var5:\n  assumes \"\\<phi> = (\\<lambda>t k. \\<phi>' k (t k))\"\n      and \"\\<Gamma>,,Z,,Y,,X,,W,,V | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<phi> var5\"\n    shows \"\\<Gamma>,,Z,,Y,,X,,W,,V | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L var5 ;; Z | \\<phi>\"\n  using assms hpt_var5 by(auto simp add: pl_der_def upl_der_def)\n\n(*         \\<Gamma>, x : X | \\<Psi>,\\<phi>' |-upl e : Y | \\<phi>\n  ----------------------------------------------------\n   \\<Gamma> | \\<Psi> |-upl (\\<lambda>x. e) : X \\<Rightarrow> Y | \\<forall>x. \\<phi>' \\<longrightarrow> \\<phi>[r x/r] *)\nlemma upl_abs:\n  assumes \"\\<Psi> = (\\<lambda>\\<psi>. (\\<lambda>(k,_). \\<psi> k)) `\\<Psi>'\"\n          \"\\<Phi>' = (\\<lambda>x env. curry (hp_conjall \\<Phi>) env x)\"\n          \"\\<phi> = (\\<lambda>r k. \\<phi>' (snd k) (\\<lambda>l. r (l,snd k)) (fst k))\"\n      and \"\\<Gamma>,,X | \\<Psi> \\<union> \\<Phi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | \\<phi>\"\n    shows \"\\<Gamma> | \\<Psi>' \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L hp_lambda e ;; exp_qbs X T | (\\<lambda>r. \\<forall>\\<^sub>P\\<^sub>Lx\\<in>\\<^sub>P\\<^sub>LX. \\<Phi>' x \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi>' x (hp_app r (hp_const x)))\"\nproof(auto simp add: hp_definitions upl_der_def)\n  show \"\\<Gamma> \\<turnstile>\\<^sub>t curry e ;; exp_qbs X T\"\n    using assms(4) hpt_abs[of \\<Gamma> X e T]\n    by(simp add: hp_definitions upl_der_def)\nnext\n  obtain \\<psi> where h:\"\\<phi> = (\\<lambda>t k. \\<psi> k (t k))\"\n    using assms(4) by(auto simp add: upl_der_def)\n  define \\<psi>' where \"\\<psi>' \\<equiv> (\\<lambda>env f. \\<forall>x\\<in>qbs_space X. \\<Phi>' x env \\<longrightarrow> \\<psi> (env,x) (f x))\"\n  have \"\\<And> x r env. \\<phi>' x (\\<lambda>k. r k x) env = \\<psi> (env, x) (r env x)\"\n  proof -\n    fix x r env\n    have \"\\<phi>' x (\\<lambda>k. r k x) env = \\<phi> (case_prod r) (env,x)\"\n      by (simp add: assms(3))\n    also have \"... = (\\<lambda>t k. \\<psi> k (t k)) (case_prod r) (env,x)\"\n      by(simp add: h)\n    finally show \"\\<phi>' x (\\<lambda>k. r k x) env = \\<psi> (env, x) (r env x)\" by simp\n  qed\n  hence \"(\\<lambda>r env. \\<forall>x\\<in>qbs_space X. \\<Phi>' x env \\<longrightarrow> \\<phi>' x (\\<lambda>xa. r xa x) env) = (\\<lambda>r env. \\<psi>' env (r env))\"\n    by(simp add: \\<psi>'_def comp_def qbs_eval_def)\n  thus \" \\<exists>\\<phi>''. (\\<lambda>r env. \\<forall>x\\<in>qbs_space X. \\<Phi>' x env \\<longrightarrow> \\<phi>' x (\\<lambda>xa. r xa x) env) = (\\<lambda>t k. \\<phi>'' k (t k))\"\n    by auto\nnext\n  fix k x\n  assume h:\"k \\<in> qbs_space \\<Gamma>\"\n           \"hp_conjall \\<Psi>' k\"\n           \"x \\<in> qbs_space X\"\n           \"\\<Phi>' x k\"\n  then have \"hp_conjall ((\\<lambda>\\<psi> (k, _). \\<psi> k) ` \\<Psi>' \\<union> \\<Phi>) (k,x)\"\n    by (auto simp add:  assms(1,2) curry_def hp_and_def hp_conjall_union[of \"(\\<lambda>\\<psi> (k, _). \\<psi> k) ` \\<Psi>'\" \\<Phi>] hp_conjall_def)\n    \n  thus \"\\<phi>' x (\\<lambda>xa. e (xa, x)) k\"\n    using h assms by(simp add: upl_der_def hpprog_context_def)\nqed\n\nlemma upl_abs':\n  assumes \"\\<Psi> = (\\<lambda>\\<psi>. (\\<lambda>(k,_). \\<psi> k)) `\\<Psi>'\"\n          \"\\<Phi>' = hp_conjall_fix \\<Phi>\"\n          \"\\<phi> = (\\<lambda>r k. \\<phi>' (hp_const (snd k)) (\\<lambda>l. r (l,snd k)) (fst k))\"\n      and \"\\<Gamma>,,X | \\<Psi> \\<union> \\<Phi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | \\<phi>\"\n    shows \"\\<Gamma> | \\<Psi>' \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L hp_lambda e ;; exp_qbs X T | (\\<lambda>r. \\<forall>\\<^sub>P\\<^sub>Lx\\<in>\\<^sub>P\\<^sub>LX. \\<Phi>' (hp_const x) \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi>' (hp_const x) (hp_app r (hp_const x)))\"\nproof(auto simp add: hp_definitions upl_der_def)\n  show \"\\<Gamma> \\<turnstile>\\<^sub>t curry e ;; exp_qbs X T\"\n    using assms(4) hpt_abs[of \\<Gamma> X e T]\n    by(simp add: hp_definitions upl_der_def)\nnext\n  obtain \\<psi> where h:\"\\<phi> = (\\<lambda>t k. \\<psi> k (t k))\"\n    using assms(4) by(auto simp add: upl_der_def)\n  define \\<psi>' where \"\\<psi>' \\<equiv> (\\<lambda>env f. \\<forall>x\\<in>qbs_space X. \\<Phi>' (hp_const x) env \\<longrightarrow> \\<psi> (env,x) (f x))\"\n  have \"\\<And> x r env. \\<phi>' (hp_const x) (\\<lambda>k. r k x) env = \\<psi> (env, x) (r env x)\"\n  proof -\n    fix x r env\n    have \"\\<phi>' (hp_const x) (\\<lambda>k. r k x) env = \\<phi> (case_prod r) (env,x)\"\n      by (simp add: assms(3))\n    also have \"... = (\\<lambda>t k. \\<psi> k (t k)) (case_prod r) (env,x)\"\n      by(simp add: h)\n    finally show \"\\<phi>' (hp_const x) (\\<lambda>k. r k x) env = \\<psi> (env, x) (r env x)\" by simp\n  qed\n  hence \"(\\<lambda>r env. \\<forall>x\\<in>qbs_space X. \\<Phi>' (hp_const x) env \\<longrightarrow> \\<phi>' (hp_const x) (\\<lambda>xa. r xa x) env) = (\\<lambda>r env. \\<psi>' env (r env))\"\n    by(simp add: \\<psi>'_def comp_def qbs_eval_def)\n  thus \" \\<exists>\\<phi>''. (\\<lambda>r env. \\<forall>x\\<in>qbs_space X. \\<Phi>' (\\<lambda>_. x) env \\<longrightarrow> \\<phi>' (\\<lambda>_. x) (\\<lambda>xa. r xa x) env) = (\\<lambda>t k. \\<phi>'' k (t k))\"\n    by (auto simp add: hp_const_def)\nnext\n  fix k x\n  assume h:\"k \\<in> qbs_space \\<Gamma>\"\n           \"hp_conjall \\<Psi>' k\"\n           \"x \\<in> qbs_space X\"\n           \"\\<Phi>' (\\<lambda>_. x) k\"\n  then have \"hp_conjall ((\\<lambda>\\<psi> (k, _). \\<psi> k) ` \\<Psi>' \\<union> \\<Phi>) (k,x)\"\n    by (auto simp add:  assms(1,2) curry_def hp_and_def hp_conjall_union[of \"(\\<lambda>\\<psi> (k, _). \\<psi> k) ` \\<Psi>'\" \\<Phi>] hp_conjall_def hp_const_def hp_conjall_fix_def)\n  thus \"\\<phi>' (\\<lambda>_. x) (\\<lambda>xa. e (xa, x)) k \"\n    using h assms by(simp add: upl_der_def comp_def qbs_eval_def hpprog_context_def hp_const_def)\nqed\n\n\n(*  \\<Gamma> | \\<Psi> |-upl e : T | \\<phi>    \\<Gamma> | \\<Psi> |-pl \\<phi> e \\<longrightarrow> \\<psi> e\n   --------------------------------------------------\n                \\<Gamma> | \\<Psi> |-upl e : T | \\<psi>               *)\nlemma upl_sub:\n  assumes \"\\<psi> = (\\<lambda>r env. \\<psi>' env (r env))\"\n          \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | \\<phi>\"\n      and \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<phi> e \\<longrightarrow>\\<^sub>P\\<^sub>L \\<psi> e\"\n    shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | \\<psi>\"\n  using assms by(auto simp add: pl_der_def upl_der_def hp_implies_def)\n\n(*  \\<Gamma> | \\<Psi> \\<turnstile>upl f : T1 \\<Rightarrow> T2 | \\<forall>x:T1. \\<phi>1[x/r] \\<longrightarrow> \\<phi>[r x/x]    \\<Gamma> | \\<Psi> \\<turnstile>upl e : T1 | \\<phi>1\n   ----------------------------------------------------------------------------------\n                              \\<Gamma> | \\<Psi> \\<turnstile>upl f x : T2 | \\<phi>[e/x]                          *)\nlemma upl_app:\n  assumes \"\\<phi> = (\\<lambda>t r env. \\<phi>' (t env) env (r env))\"\n          \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L f ;; exp_qbs T1 T2 | (\\<lambda>r. \\<forall>\\<^sub>P\\<^sub>Lx\\<in>\\<^sub>P\\<^sub>LT1. \\<psi> (hp_const x) \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi> (hp_const x) (hp_app r (hp_const x)))\"\n      and \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T1 | \\<psi>\"\n    shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L hp_app f e ;; T2 | \\<phi> e\"\nproof(auto simp add: upl_der_def)\n  show \"\\<Gamma> \\<turnstile>\\<^sub>t hp_app f e ;; T2\"\n    using hpt_app assms(2,3) by(auto simp add: upl_der_def)\nnext\n  show \"\\<exists>\\<phi>'. \\<phi> e = (\\<lambda>t k. \\<phi>' k (t k))\"\n    using assms(1) by auto\nnext\n  obtain \\<psi>' where h1: \"\\<psi> = (\\<lambda>r env. \\<psi>' env (r env))\"\n    using assms(3) by(auto simp add: upl_der_def)\n  fix k\n  assume h:\"k \\<in> qbs_space \\<Gamma>\"\n           \"hp_conjall \\<Psi> k\"\n  then have \"e k \\<in> qbs_space T1\"\n    using assms(3) qbs_morphismE(1)[of e \\<Gamma> T1]\n    by(auto simp add: upl_der_def hpprog_typing_def)\n  moreover have \"(\\<psi> (hp_const (e k)) k)\"\n    using  assms(3) h upl_phi_const[OF h1,of e k]\n    by(simp add: upl_der_def)\n  ultimately have \"\\<phi> (hp_const (e k)) (hp_app f (hp_const (e k))) k\"\n    using h assms(2) by(simp add: upl_der_def hp_implies_def hp_all_def)\n  moreover have \"(\\<phi> (hp_const (e k)) (hp_app f (hp_const (e k))) k) = (\\<phi> e (hp_app f e) k)\"\n    by(simp add: hp_definitions assms(1))\n  ultimately show \"\\<phi> e (hp_app f e) k\"\n    by simp\nqed\n\n\n(*  \\<Gamma> | \\<Psi> \\<turnstile>upl e : T1 \\<times> T2 | \\<phi> [\\<pi>1(r)/r]\n   --------------------------------------\n           \\<Gamma> | \\<Psi> \\<turnstile>upl \\<pi>1 e : T1 | \\<phi>     *)\nlemma upl_proj1:\n  assumes \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T1 \\<Otimes>\\<^sub>Q (T2 :: 't2 quasi_borel) | \\<lambda>r. \\<phi> (hp_fst r)\"\n  shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L hp_fst e ;; T1 | (\\<phi> :: ('env \\<Rightarrow> 't1) \\<Rightarrow> 'env \\<Rightarrow> bool)\"\n  using assms hpt_fst[of \\<Gamma> e T1 T2]\nproof(auto simp add: upl_der_def hp_fst_def)\n  fix \\<phi>' :: \"'env \\<Rightarrow> 't1 \\<times> 't2 \\<Rightarrow> bool\"\n  define fr :: \"'t1 \\<Rightarrow> 't1 \\<times> 't2\"\n    where \"fr \\<equiv> (\\<lambda>k1. (k1,undefined))\"\n  define \\<psi> :: \"'env \\<Rightarrow> 't1 \\<Rightarrow> bool\"\n    where \"\\<psi> \\<equiv> (\\<lambda>env t1. \\<phi>' env (fr t1))\"\n  have hfr:\"\\<And>r'. fst \\<circ> (fr \\<circ> r') = r'\"\n    by(auto simp add: fr_def)\n  assume h1:\"(\\<lambda>r. \\<phi> (\\<lambda>env. fst (r env))) = (\\<lambda>t k. \\<phi>' k (t k))\"\n  have \"\\<And>r' env. \\<phi> r' env = \\<phi>' env (fr (r' env))\"\n  proof -\n    fix r' env\n    have \"\\<phi> r' env = (\\<lambda>r. \\<phi> (\\<lambda>env. fst (r env))) (fr \\<circ> r') env\"\n      using hfr[of r'] by(auto simp add: comp_def)\n    also have \"... = (\\<lambda>t k. \\<phi>' k (t k)) (fr \\<circ> r') env\"\n      by (metis h1)\n    finally show \"\\<phi> r' env = \\<phi>' env (fr (r' env))\"\n      by auto\n  qed\n  hence \"\\<phi> = (\\<lambda>t k. \\<psi> k (t k))\"\n    by(auto simp add: \\<psi>_def)\n  thus \"\\<exists>\\<phi>''. \\<phi> = (\\<lambda>t k. \\<phi>'' k (t k))\"\n    by auto\nqed\n\n(*  \\<Gamma> | \\<Psi> \\<turnstile>upl e : T1 \\<times> T2 | \\<phi> [\\<pi>2(r)/r]\n   --------------------------------------\n           \\<Gamma> | \\<Psi> \\<turnstile>upl \\<pi>2 e : T2 | \\<phi>     *)\nlemma upl_proj2:\n  assumes \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; (T1 :: 't1 quasi_borel) \\<Otimes>\\<^sub>Q T2 | \\<lambda>r. \\<phi> (hp_snd r)\"\n  shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L hp_snd e ;; T2 | (\\<phi> :: ('env \\<Rightarrow> 't2) \\<Rightarrow> 'env \\<Rightarrow> bool)\"\n  using assms hpt_snd[of \\<Gamma> e T1 T2]\nproof(auto simp add: upl_der_def hp_snd_def)\n  fix \\<phi>' :: \"'env \\<Rightarrow> 't1 \\<times> 't2 \\<Rightarrow> bool\"\n  define fr :: \"'t2 \\<Rightarrow> 't1 \\<times> 't2\"\n    where \"fr \\<equiv> (\\<lambda>k2. (undefined,k2))\"\n  define \\<psi> :: \"'env \\<Rightarrow> 't2 \\<Rightarrow> bool\"\n    where \"\\<psi> \\<equiv> (\\<lambda>env t1. \\<phi>' env (fr t1))\"\n  have hfr:\"\\<And>r'. snd \\<circ> (fr \\<circ> r') = r'\"\n    by(auto simp add: fr_def)\n  assume h1:\"(\\<lambda>r. \\<phi> (\\<lambda>env. snd (r env))) = (\\<lambda>t k. \\<phi>' k (t k))\"\n  have \"\\<And>r' env. \\<phi> r' env = \\<phi>' env (fr (r' env))\"\n  proof -\n    fix r' env\n    have \"\\<phi> r' env = (\\<lambda>r. \\<phi> (\\<lambda>env. snd (r env))) (fr \\<circ> r') env\"\n      using hfr[of r'] by(auto simp add: comp_def)\n    also have \"... = (\\<lambda>t k. \\<phi>' k (t k)) (fr \\<circ> r') env\"\n      by (metis h1)\n    finally show \"\\<phi> r' env = \\<phi>' env (fr (r' env))\"\n      by auto\n  qed\n  hence \"\\<phi> = (\\<lambda>t k. \\<psi> k (t k))\"\n    by(auto simp add: \\<psi>_def)\n  thus \"\\<exists>\\<phi>''. \\<phi> = (\\<lambda>t k. \\<phi>'' k (t k))\"\n    by auto\nqed\n\n(* \\<Gamma> | \\<Psi> \\<turnstile>upl e1 : T1 | \\<phi>1     \\<Gamma> | \\<Psi> \\<turnstile>upl e2 : T2 | \\<phi>2    \\<Gamma> | \\<Psi> \\<turnstile>pl \\<forall>x:T1, \\<forall>y:T2, \\<phi>1[x/r] \\<longrightarrow> \\<phi>2[y/r] \\<longrightarrow> \\<phi>[(x,y)/r]\n  -----------------------------------------------------------------------------------------------------------------------\n                                    \\<Gamma> | \\<Psi> \\<turnstile>upl (e1,e2) : T1 \\<times> T2 | \\<phi>                                                    *)\nlemma upl_pair:\n  assumes \"\\<phi> = (\\<lambda>r env. \\<phi>' env (r env))\"\n          \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e1 ;; T1 | \\<phi>1\"\n          \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e2 ;; T2 | \\<phi>2\"\n      and \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>P\\<^sub>L \\<forall>\\<^sub>P\\<^sub>Lx\\<in>\\<^sub>P\\<^sub>LT1. \\<forall>\\<^sub>P\\<^sub>Ly\\<in>\\<^sub>P\\<^sub>LT2. \\<phi>1 (hp_const x) \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi>2 (hp_const y) \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi> (hp_pair (hp_const x) (hp_const y))\"\n    shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L hp_pair e1 e2 ;; T1 \\<Otimes>\\<^sub>Q T2 | \\<phi>\"\n  unfolding upl_der_def apply auto\n  using assms(2,3) hpt_pair[of \\<Gamma> e1 T1 e2 T2] apply(simp add: upl_der_def)\n  using assms(1) apply auto[1]\nproof -\n  fix k\n  assume h:\"k \\<in> qbs_space \\<Gamma>\"\n           \"hp_conjall \\<Psi> k\"\n  then have \"\\<phi>1 (hp_const (e1 k)) k\" \"\\<phi>2 (hp_const (e2 k)) k\"\n    using assms(2,3) by(auto simp add: hp_const_def upl_der_def)\n  moreover have \"e1 k \\<in> qbs_space T1\" \"e2 k \\<in> qbs_space T2\"\n    using qbs_morphismE(1)[of e1 \\<Gamma> T1] qbs_morphismE(1)[of e2 \\<Gamma> T2] assms(2,3) h\n    by(auto simp add: upl_der_def hpprog_typing_def)\n  ultimately have \"\\<phi> (hp_pair (hp_const (e1 k)) (hp_const (e2 k))) k\"\n    using assms(2-4) h by(simp add: upl_der_def hp_definitions pl_der_def)\n  thus \"\\<phi> (hp_pair e1 e2) k\"\n    by(simp add: assms(1) hp_definitions)\nqed\n\n\n(* \\<Gamma> | \\<Psi>, \\<phi>'[0/n] |-upl t0 : T | \\<phi>[0/n]    \\<Gamma>, n : \\<nat>, t : T | \\<Psi>, \\<phi>'[Suc n/n], \\<phi>' \\<longrightarrow> \\<phi>[t/r], t = f n |-upl e : T | \\<phi>[Suc n/n]\n  -------------------------------------------------------------------------------------------------------------------\n                    \\<Gamma> | \\<Psi> |-upl rec t0 (\\<lambda>n t. e) : \\<nat> \\<Rightarrow> T | \\<forall>n. \\<phi>' \\<longrightarrow> \\<phi>[r n/r]                                     *)\nlemma upl_recnat':\n  assumes \"\\<Phi>0 = (\\<lambda>\\<psi>. (\\<lambda>k. \\<psi> (k,0))) `\\<Phi>\"\n          \"\\<Phi>Sn = (\\<lambda>\\<psi>. (\\<lambda>((k,n),_). \\<psi> (k,Suc n))) `\\<Phi>\"\n          \"\\<Phi>' = hp_conjall_fix \\<Phi>\"\n          \"\\<Psi>' = (\\<lambda>\\<psi>. (\\<lambda>((k,_),_). \\<psi> k)) `\\<Psi>\"\n          \"\\<phi>' = (\\<lambda>fn ft k. \\<phi> (hp_const (fn k)) (hp_const (ft k)) (fst (fst k)))\"\n          \"IH = {(\\<lambda>((k,n),t). hp_conjall \\<Phi> (k,n) \\<longrightarrow> \\<phi> (hp_const n) (hp_const t) k)}\"\n          \"\\<And>n. \\<exists>\\<psi>n. \\<phi> (hp_const n) = (\\<lambda>r env. \\<psi>n env (r env))\"\n          \"fn = (\\<lambda>envnt. hp_rec_nat t0 (hp_lambda (hp_lambda e)) (fst (fst envnt)))\"\n          \"\\<Gamma> | \\<Psi> \\<union> \\<Phi>0 \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L t0 ;; T | \\<phi> (hp_const 0)\"\n     and  \"\\<Gamma> ,, \\<nat>\\<^sub>Q ,, T | \\<Psi>' \\<union> \\<Phi>Sn \\<union> IH \\<union> {var1 =\\<^sub>P\\<^sub>L hp_app fn var2}  \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | \\<phi>' (hp_suc var2)\"\n   shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L hp_rec_nat t0 (hp_lambda (hp_lambda e)) ;; (exp_qbs \\<nat>\\<^sub>Q T) | (\\<lambda>r. \\<forall>\\<^sub>P\\<^sub>Ln\\<in>\\<^sub>P\\<^sub>L\\<nat>\\<^sub>Q. \\<Phi>' (hp_const n) \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi> (hp_const n) (hp_app r (hp_const n)))\"\nproof(auto simp add: upl_der_def)\n  show \"\\<Gamma> \\<turnstile>\\<^sub>t hp_rec_nat t0 (hp_lambda (hp_lambda e)) ;; exp_qbs \\<nat>\\<^sub>Q T\"\n    using hpt_recnat'[of \\<Gamma> t0 T e] assms(9,10)\n    by(auto simp add: upl_der_def)\nnext\n  have \"\\<forall>n. \\<exists>\\<psi>n. \\<forall>r env. \\<phi> (hp_const n) r env = \\<psi>n env (r env)\"\n  proof\n    fix n\n    obtain \\<psi>n where \"\\<phi> (hp_const n) = (\\<lambda>r env. \\<psi>n env (r env))\"\n      using assms(7)[of n] by auto\n    thus \"\\<exists>\\<psi>n. \\<forall>r env. \\<phi> (hp_const n) r env = \\<psi>n env (r env)\"\n      by auto\n  qed\n  hence \"\\<exists>\\<psi>. \\<forall>n r env. \\<phi> (hp_const n) r env = \\<psi> n env (r env)\"\n    by(rule choice)\n  then obtain \\<psi> where hp:\"\\<forall>n r env. \\<phi> (hp_const n) r env = \\<psi> n env (r env)\"\n    by auto\n\n  define \\<psi>' where \"\\<psi>' \\<equiv> (\\<lambda>env t. \\<forall>n\\<in>qbs_space \\<nat>\\<^sub>Q. \\<Phi>' (hp_const n) env \\<longrightarrow> \\<psi> n env (t n))\"\n  then have \"(\\<lambda>r. \\<forall>\\<^sub>P\\<^sub>Ln\\<in>\\<^sub>P\\<^sub>L\\<nat>\\<^sub>Q. \\<Phi>' (hp_const n) \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi> (hp_const n) (hp_app r (hp_const n))) = (\\<lambda>t k. \\<psi>' k (t k))\"\n    using hp by(auto simp add: hp_definitions)\n  thus \"\\<exists>\\<psi>'. (\\<lambda>r. \\<forall>\\<^sub>P\\<^sub>Ln\\<in>\\<^sub>P\\<^sub>L\\<nat>\\<^sub>Q. \\<Phi>' (hp_const n) \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi> (hp_const n) (hp_app r (hp_const n))) = (\\<lambda>t k. \\<psi>' k (t k))\"\n    by auto\nnext\n  fix k\n  assume h:\"k \\<in> qbs_space \\<Gamma>\"\n           \"hp_conjall \\<Psi> k\"\n  show \"(\\<forall>\\<^sub>P\\<^sub>Ln\\<in>\\<^sub>P\\<^sub>L\\<nat>\\<^sub>Q. \\<Phi>' (hp_const n) \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi> (hp_const n) (hp_app (hp_rec_nat t0 (hp_lambda (hp_lambda e))) (hp_const n))) k\"\n  proof(auto simp add: hp_all_def hp_implies_def)\n    fix n\n    assume \"\\<Phi>' (hp_const n) k\"\n    then show \"\\<phi> (hp_const n) (hp_app (hp_rec_nat t0 (hp_lambda (hp_lambda e))) (hp_const n)) k\"\n    proof(induction n)\n      case 0\n      then show ?case\n        using assms(1,3,9) h by(force simp add: upl_der_def hp_definitions hp_conjall_fix_def hp_conjall_def)\n    next\n      case ih:(Suc n)\n      let ?f = \"hp_rec_nat t0 (hp_lambda (hp_lambda e))\"\n      let ?env = \"((k,n),?f k n)\"\n      have ht:\"?f k n \\<in> qbs_space T\"\n        using hpt_recnat'[of \\<Gamma> t0 T e] h(1) qbs_morphismE(1)[of ?f \\<Gamma> \"exp_qbs \\<nat>\\<^sub>Q T\"] qbs_morphismE(1)[of \"?f k\" \"\\<nat>\\<^sub>Q\" T] assms(10,9)\n        by(auto simp add: upl_der_def hpprog_typing_def)\n      hence \"?env \\<in> qbs_space (\\<Gamma> ,, \\<nat>\\<^sub>Q ,, T)\"\n        by(simp add: h(1) hpprog_context_def)\n      moreover have \"hp_conjall \\<Psi>' ?env\"\n        using h by(simp add: assms(4) hp_conjall_def)\n      moreover have \"hp_conjall \\<Phi>Sn ?env\"\n        using assms(2,3) ih(2) by(simp add: hp_conjall_fix_def hp_conjall_def hp_const_def)\n      moreover have \"hp_conjall IH ?env\"\n      proof -\n        have \"(hp_app (hp_rec_nat t0 (hp_lambda (hp_lambda e))) (\\<lambda>a. n)) k = hp_const (hp_rec_nat t0 (hp_lambda (hp_lambda e)) k n) k\"\n          by(simp add: hp_definitions)\n        hence \"\\<phi> (hp_const n) (hp_app (hp_rec_nat t0 (hp_lambda (hp_lambda e))) (\\<lambda>a. n)) k = \\<phi> (hp_const n) (hp_const (hp_rec_nat t0 (hp_lambda (hp_lambda e)) k n)) k\"\n          using upl_phi_equiv1[of \"\\<phi> (hp_const n)\" _ \"hp_app (hp_rec_nat t0 (hp_lambda (hp_lambda e))) (\\<lambda>a. n)\" k \"hp_const (hp_rec_nat t0 (hp_lambda (hp_lambda e)) k n)\"] assms(7)[of n]\n          by auto\n        thus ?thesis\n          using ih(1) assms(3)\n          by(simp add: assms(6) hp_conjall_def hp_conjall_fix_def hp_const_def)\n      qed\n      moreover have \"(var1 =\\<^sub>P\\<^sub>L hp_app fn var2) ?env\"\n        by(simp add: assms(8) hp_definitions)\n      ultimately have \"\\<phi>' (hp_suc var2) e ?env\"\n        using assms(10) by(simp add: upl_der_def hp_conjall_union hp_conjall_def,blast)\n      moreover have \"\\<phi>' (hp_suc var2) e ?env = \\<phi> (hp_const (Suc n)) (hp_app ?f (hp_const (Suc n))) k\"\n                     (is \"?lhs = ?rhs\")\n      proof -\n        obtain \\<psi> where hpsi:\"\\<phi> (hp_const (Suc n)) = (\\<lambda>r env. \\<psi> env (r env))\"\n          using assms(7)[of \"Suc n\"] by auto\n        have \"?lhs = \\<phi> (hp_const (hp_suc var2 ((k, n), hp_rec_nat t0 (hp_lambda (hp_lambda e)) k n))) (hp_const (e ((k, n), ?f k n))) k\"\n          by(simp add: assms(5))\n        also have \"... =  \\<phi> (hp_const (Suc n)) (hp_const (e ((k, n), hp_rec_nat t0 (hp_lambda (hp_lambda e)) k n))) k\"\n          by(simp add: hp_definitions)\n        also have \"... = \\<phi> (hp_const (Suc n)) (hp_app (hp_app (hp_lambda (hp_lambda e)) (hp_const n)) (hp_app ?f (hp_const n))) k\"\n          apply(rule upl_phi_equiv1[of \"\\<phi> (hp_const (Suc n))\"],simp_all add: hp_definitions)\n          using hpsi by(auto simp add: hp_const_def)\n        also have \"... = ?rhs\"\n          by(simp add: hp_definitions)\n        finally show ?thesis .\n      qed\n      ultimately show \"\\<phi> (hp_const (Suc n)) (hp_app (hp_rec_nat t0 (hp_lambda (hp_lambda e))) (hp_const (Suc n))) k\"\n        by simp\n    qed\n  qed\nqed\n\n(* \\<Gamma> | \\<Psi> \\<turnstile>upl e : T | \\<phi>1   \\<Gamma> | \\<Psi> \\<turnstile>upl e : T | \\<phi>2\n  ------------------------------------------------\n               \\<Gamma> | \\<Psi> \\<turnstile>upl e : T | \\<phi>1 \\<and> \\<phi>2       *)\nlemma upl_andI:\n  assumes \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | \\<phi>1\"\n      and \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | \\<phi>2\"\n    shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T \n               | (\\<lambda>r. \\<phi>1 r \\<and>\\<^sub>P\\<^sub>L \\<phi>2 r)\"\n  using assms by(auto simp add: upl_der_def hp_and_def)\n\n\n(* \\<Gamma> | \\<Psi>, \\<phi>'[e/r] \\<turnstile>upl e : T | \\<phi>1\n  --------------------------------\n    \\<Gamma> | \\<Psi> \\<turnstile>upl e : T | \\<phi>' \\<longrightarrow> \\<phi>1 *)\nlemma upl_impI:\n  assumes \"\\<Gamma> | \\<Psi> \\<union> \\<Phi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | \\<phi>1\"\n    shows \"\\<Gamma> | \\<Psi>  \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | (\\<lambda>r. hp_conjall \\<Phi> \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi>1 r)\"\nproof(auto simp add: upl_der_def hp_implies_def)\n  show \"\\<Gamma> \\<turnstile>\\<^sub>t e ;; T\"\n    using assms by(simp add: upl_der_def)\nnext\n  obtain \\<phi>1' where 1:\"\\<phi>1 = (\\<lambda>r env. \\<phi>1' env (r env))\"\n    using assms by(auto simp add: upl_der_def)\n  show \"\\<exists>\\<phi>'. (\\<lambda>r env. hp_conjall \\<Phi> env \\<longrightarrow> \\<phi>1 r env) = (\\<lambda>t k. \\<phi>' k (t k))\"\n    by(rule exI[where x=\"\\<lambda>env x. hp_conjall \\<Phi> env \\<longrightarrow> \\<phi>1' env x\"],simp add: 1)\nnext\n  fix k\n  assume \"k \\<in> qbs_space \\<Gamma>\"\n         \"hp_conjall \\<Psi> k\"\n         \"hp_conjall \\<Phi> k\"\n  then show \"\\<phi>1 e k\"\n    using assms\n    by(simp add: hp_conjall_def upl_der_def,blast)\nqed\n\n(* \\<Gamma> | \\<Psi> \\<turnstile>upl e : T | \\<phi>[return r/r]\n  ----------------------------------\n         \\<Gamma> | \\<Psi> \\<turnstile>upl e : P[T] | \\<phi>     *)\nlemma upl_return:\n  assumes \"\\<phi> = (\\<lambda>t k. \\<phi>' k (t k))\"\n      and \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; T | \\<lambda>r. \\<phi> (hp_return T r)\"\n  shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L hp_return T e ;; monadP_qbs T | \\<phi>\"\n  using assms hpt_return[of \\<Gamma> e T] by(auto simp add: upl_der_def hp_return_def)\n\n(* \\<Gamma> | \\<Psi> \\<turnstile>upl e : P[T1] | \\<phi>1     \\<Gamma> | \\<Psi> \\<turnstile>upl f : T1 \\<Rightarrow> P[T2] | \\<forall>s:P[T1]. \\<phi>1[s/r] \\<longrightarrow> \\<phi>2[bind s r/r]\n  --------------------------------------------------------------------------------------------------\n                              \\<Gamma> | \\<Psi> \\<turnstile>upl bind e f : P[T2] | \\<phi>2                                    *)\nlemma upl_bind:\n  assumes \"\\<phi>2 = (\\<lambda>r env. \\<psi>' env (r env))\"\n          \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L e ;; monadP_qbs T1 | \\<phi>1\"\n      and \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L f ;; exp_qbs T1 (monadP_qbs T2) | \\<lambda>r. \\<forall>\\<^sub>P\\<^sub>Ls\\<in>\\<^sub>P\\<^sub>LmonadP_qbs T1. \\<phi>1 (hp_const s) \\<longrightarrow>\\<^sub>P\\<^sub>L \\<phi>2 (hp_const s \\<bind> r)\"\n    shows \"\\<Gamma> | \\<Psi> \\<turnstile>\\<^sub>U\\<^sub>P\\<^sub>L  e \\<bind> f ;; monadP_qbs T2 | \\<phi>2\"\nproof(auto simp add: upl_der_def)\n  show \"\\<Gamma> \\<turnstile>\\<^sub>t e \\<bind> f ;; monadP_qbs T2\"\n    using assms(2,3) hpt_bind[of \\<Gamma> e T1 f T2]\n    by(simp add: upl_der_def)\nnext\n  show \"\\<exists>\\<phi>'. \\<phi>2 = (\\<lambda>t k. \\<phi>' k (t k))\"\n    using assms(1) by auto\nnext\n  fix k\n  assume h:\"k \\<in> qbs_space \\<Gamma>\"\n           \"hp_conjall \\<Psi> k \"\n  then have \"e k \\<in> qbs_space (monadP_qbs T1)\"\n    using assms(2) qbs_morphismE(1)[of e \\<Gamma> \"monadP_qbs T1\"]\n    by(auto simp add: upl_der_def hpprog_typing_def)\n  moreover have \"\\<phi>1 (hp_const (e k)) k\"\n    using upl_phi_const[of \\<phi>1 _ e k] assms(2) h\n    by(auto simp add: upl_der_def)\n  ultimately have \"\\<phi>2 (hp_const (e k) \\<bind> f) k\"\n    using assms(3) h by(simp add: upl_der_def hp_implies_def hp_all_def)\n  moreover have \"(\\<phi>2 (hp_const (e k) \\<bind> f) k) = (\\<phi>2 (e \\<bind> f) k)\"\n    using assms(1) by(simp add: hp_const_def hp_bind_def)\n  ultimately show \"\\<phi>2 (e \\<bind> f) k\"\n    by simp\nqed\n\nend", "meta": {"author": "HirataMichi", "repo": "PPV", "sha": "b6e7c63db742df51ea451f45597bcabe5d095547", "save_path": "github-repos/isabelle/HirataMichi-PPV", "path": "github-repos/isabelle/HirataMichi-PPV/PPV-b6e7c63db742df51ea451f45597bcabe5d095547/PPV/UPL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3487603565866375}}
{"text": "(*  Title:      HOL/Imperative_HOL/Heap.thy\n    Author:     John Matthews, Galois Connections; Alexander Krauss, TU Muenchen\n*)\n\nsection \\<open>A polymorphic heap based on cantor encodings\\<close>\n\ntheory Heap\nimports Main \"HOL-Library.Countable\"\nbegin\n\nsubsection \\<open>Representable types\\<close>\n\ntext \\<open>The type class of representable types\\<close>\n\nclass heap = typerep + countable\n\ninstance unit :: heap ..\n\ninstance bool :: heap ..\n\ninstance nat :: heap ..\n\ninstance prod :: (heap, heap) heap ..\n\ninstance sum :: (heap, heap) heap ..\n\ninstance list :: (heap) heap ..\n\ninstance option :: (heap) heap ..\n\ninstance int :: heap ..\n\ninstance String.literal :: heap ..\n\ninstance typerep :: heap ..\n\n\nsubsection \\<open>A polymorphic heap with dynamic arrays and references\\<close>\n\ntext \\<open>\n  References and arrays are developed in parallel,\n  but keeping them separate makes some later proofs simpler.\n\\<close>\n\ntype_synonym addr = nat \\<comment> \\<open>untyped heap references\\<close>\ntype_synonym heap_rep = nat \\<comment> \\<open>representable values\\<close>\n\nrecord heap =\n  arrays :: \"typerep \\<Rightarrow> addr \\<Rightarrow> heap_rep list\"\n  refs :: \"typerep \\<Rightarrow> addr \\<Rightarrow> heap_rep\"\n  lim  :: addr\n\ndefinition empty :: heap where\n  \"empty = \\<lparr>arrays = (\\<lambda>_ _. []), refs = (\\<lambda>_ _. 0), lim = 0\\<rparr>\"\n\ndatatype 'a array = Array addr \\<comment> \\<open>note the phantom type 'a\\<close>\ndatatype 'a ref = Ref addr \\<comment> \\<open>note the phantom type 'a\\<close>\n\nprimrec addr_of_array :: \"'a array \\<Rightarrow> addr\" where\n  \"addr_of_array (Array x) = x\"\n\nprimrec addr_of_ref :: \"'a ref \\<Rightarrow> addr\" where\n  \"addr_of_ref (Ref x) = x\"\n\nlemma addr_of_array_inj [simp]:\n  \"addr_of_array a = addr_of_array a' \\<longleftrightarrow> a = a'\"\n  by (cases a, cases a') simp_all\n\nlemma addr_of_ref_inj [simp]:\n  \"addr_of_ref r = addr_of_ref r' \\<longleftrightarrow> r = r'\"\n  by (cases r, cases r') simp_all\n\ninstance array :: (type) countable\n  by (rule countable_classI [of addr_of_array]) simp\n\ninstance ref :: (type) countable\n  by (rule countable_classI [of addr_of_ref]) simp\n\ntext \\<open>Syntactic convenience\\<close>\n\nsetup \\<open>\n  Sign.add_const_constraint (@{const_name Array}, SOME @{typ \"nat \\<Rightarrow> 'a::heap array\"})\n  #> Sign.add_const_constraint (@{const_name Ref}, SOME @{typ \"nat \\<Rightarrow> 'a::heap ref\"})\n  #> Sign.add_const_constraint (@{const_name addr_of_array}, SOME @{typ \"'a::heap array \\<Rightarrow> nat\"})\n  #> Sign.add_const_constraint (@{const_name addr_of_ref}, SOME @{typ \"'a::heap ref \\<Rightarrow> nat\"})\n\\<close>\n\nhide_const (open) empty\n\nend\n", "meta": {"author": "bzhan", "repo": "Imperative_HOL_Time", "sha": "09f9bc7a7cf177d3adf1e9ce6adae09a85ebe5ec", "save_path": "github-repos/isabelle/bzhan-Imperative_HOL_Time", "path": "github-repos/isabelle/bzhan-Imperative_HOL_Time/Imperative_HOL_Time-09f9bc7a7cf177d3adf1e9ce6adae09a85ebe5ec/Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.63341026367784, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.34876035658663745}}
{"text": "theory OpSem\nimports Main HOL.Rat (*SetADT*)\nbegin \n\ntype_synonym TS = rat (* Timestamp *)\ntype_synonym T = nat (* Thread ID *)\ntype_synonym L = nat (* Location *)\ntype_synonym V = nat\n\ndefinition \"null = (0 :: nat)\"\n\n\n(* bool: true = release/aquire or false = relaxed*)\ndatatype action =\n    Read bool L V\n  | Write bool L V\n  | Update L V V\n\nfun avar :: \"action \\<Rightarrow> L\" where\n    \"avar (Read _ x v) = x\"\n  | \"avar (Write _ x v) = x\"\n  | \"avar (Update x e v) = x\"\n\nfun wr_val :: \"action \\<Rightarrow> V option\" where\n    \"wr_val (Write _ _ v) =  Some v\"\n  | \"wr_val (Update _ _ v) = Some v\"\n  | \"wr_val _ = None\"\n\nfun rd_val :: \"action \\<Rightarrow> V option\" where\n    \"rd_val (Read _ _ v) = Some v\"\n  | \"rd_val (Update _ v _) = Some v\"\n  | \"rd_val _ = None\"\n\nfun isRA :: \"action \\<Rightarrow> bool\" where\n    \"isRA (Read b _ _) = b\" \n  | \"isRA (Write b _ _) = b\"\n  | \"isRA (Update _ _ _) = True\"\n\nfun isWr :: \"action \\<Rightarrow> bool\" where\n    \"isWr (Read _ _ _) = False\" \n  | \"isWr (Write _ _ _) = True\"\n  | \"isWr (Update _ _ _) = False\"\n\nfun isRd :: \"action \\<Rightarrow> bool\" where\n    \"isRd (Read _ _ _) = True\" \n  | \"isRd (Write _ _ _) = False\"\n  | \"isRd (Update _ _ _) = False\"\n\nfun isUp :: \"action \\<Rightarrow> bool\" where\n    \"isUp (Read _ _ _) = False\" \n  | \"isUp (Write _ _ _) = False\"\n  | \"isUp (Update _ _ _) = True\"\n\n\nabbreviation \"reads a \\<equiv> a \\<in> (dom rd_val)\"\nabbreviation \"writes a \\<equiv> a \\<in> (dom wr_val)\"\n\n\ntype_synonym View = \"L \\<Rightarrow> T\"\n\ntype_synonym event = \"TS \\<times> T \\<times> action\"\n\ndefinition time_stamp :: \"event \\<Rightarrow> TS\" where \"time_stamp e \\<equiv> fst e\"\ndefinition tid :: \"event \\<Rightarrow> T\" where \"tid e \\<equiv> fst (snd e)\"\ndefinition act :: \"event \\<Rightarrow> action\" where \"act e \\<equiv> snd (snd e)\"\n\ndefinition var :: \"L \\<times> TS \\<Rightarrow> L\" where \"var = fst\"\ndefinition tst :: \"L \\<times> TS \\<Rightarrow> TS\" where \"tst = snd\"\n\n\n\nrecord write_record =\n  val :: V\n  is_releasing :: bool\n\n\n\n\nrecord surrey_state =\n  writes :: \"(L \\<times> TS) set\"\n  thrView :: \"T \\<Rightarrow> L \\<Rightarrow> (L \\<times> TS)\"\n  modView :: \"(L \\<times> TS) \\<Rightarrow> L \\<Rightarrow> (L \\<times> TS)\"\n  mods :: \"(L \\<times> TS) \\<Rightarrow> write_record\"\n  covered :: \"(L \\<times> TS) set\"\n\n\ndefinition \"value \\<sigma> w \\<equiv>  val (mods \\<sigma> w)\"\ndefinition \"releasing \\<sigma> w \\<equiv>  is_releasing (mods \\<sigma> w)\"\n\ndefinition \"writes_on \\<sigma> x = {w . var w = x \\<and> w \\<in> writes \\<sigma>}\"\ndefinition \"visible_writes \\<sigma> t x \\<equiv> {w \\<in> writes_on \\<sigma> x . tst(thrView \\<sigma> t x) \\<le> tst w}\"\n\n\n\nlemma writes_on_var [simp]: \"w \\<in> writes_on \\<sigma> x \\<Longrightarrow> var w = x\"\n  by (simp add: writes_on_def)\n\nlemma visible_var [simp]: \"w \\<in> visible_writes \\<sigma> t x \\<Longrightarrow> var w = x\"\n  by (auto simp add: visible_writes_def)\n\nlemma visible_writes_in_writes: \"visible_writes \\<sigma> t x \\<subseteq> writes \\<sigma>\"\n  using visible_writes_def writes_on_def by fastforce\n\ndefinition \"valid_fresh_ts \\<sigma> w ts' \\<equiv> tst w < ts' \\<and> (\\<forall> w' \\<in> writes_on \\<sigma> (var w). tst w < tst w' \\<longrightarrow> ts' < tst w')\"\n\ndefinition \"ts_oride m m' x \\<equiv> if tst (m x) \\<le> tst (m' x) then m' x else m x\"\n\ndefinition rev_app :: \"'s \\<Rightarrow> ('s \\<Rightarrow> 't) \\<Rightarrow> 't\" (infixl \";;\" 150)\n  where\n  \"rev_app s f \\<equiv> f s\"\n\n\ndefinition \n  \"update_thrView t nv \\<sigma> \\<equiv> \\<sigma> \\<lparr> thrView := (thrView \\<sigma>)(t := nv)\\<rparr>\"\n\ndefinition \n  \"update_modView w nv \\<sigma> \\<equiv> \\<sigma> \\<lparr> modView := (modView \\<sigma>)(w := nv) \\<rparr>\"\n\ndefinition \n  \"update_mods w nwr \\<sigma> \\<equiv> \\<sigma> \\<lparr> mods := (mods \\<sigma>)(w := nwr)\\<rparr> \\<lparr>writes := writes \\<sigma> \\<union> {w}\\<rparr>\"\n\ndefinition \n  \"add_cv w \\<sigma> \\<equiv> \\<sigma> \\<lparr> covered := covered \\<sigma> \\<union> {w}\\<rparr>\"\n\ndefinition \"syncing \\<sigma> w b \\<equiv> releasing \\<sigma> w \\<and> b\"\n\nlemma [simp]: \"syncing \\<sigma> w False = False\"\n  by (simp add: syncing_def)\n\nlemma [simp]: \"syncing \\<sigma> w True = releasing \\<sigma> w\"\n  by (simp add: syncing_def)\n\ndefinition\n  \"read_trans t b w \\<sigma>  \\<equiv>\n       let new_thr_idx = (thrView \\<sigma> t)(var w := w) in\n       let new_thr_idx' = \n             if syncing \\<sigma> w b then ts_oride new_thr_idx (modView \\<sigma> w) else new_thr_idx in\n          \\<sigma> ;; update_thrView t new_thr_idx'\"\n\nlemma [simp]: \"\\<not> syncing \\<sigma> w b \\<Longrightarrow> thrView (read_trans t b w \\<sigma>) t = (thrView \\<sigma> t)(var w := w)\"\n  by (simp add: read_trans_def rev_app_def update_thrView_def)\n\nlemma syncing_thrView_read_trans [simp]: \"syncing \\<sigma> w b \\<Longrightarrow>\n                     thrView (read_trans t b w \\<sigma>) t = ts_oride ((thrView \\<sigma> t)(var w := w)) (modView \\<sigma> w)\"\n  by (simp add: read_trans_def rev_app_def update_thrView_def)\n\n\nlemma [simp]: \"t' \\<noteq> t \\<Longrightarrow> thrView (read_trans t b w \\<sigma>) t' = (thrView \\<sigma> t')\"\n  apply (simp add: read_trans_def rev_app_def update_thrView_def) \n  by (metis fun_upd_other surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2))\n\nlemma [simp]: \"var w \\<noteq> x \\<Longrightarrow> b = False \\<Longrightarrow> thrView (read_trans t b w \\<sigma>) t x = thrView \\<sigma> t x\"\n  by (simp add: read_trans_def rev_app_def update_thrView_def Let_def ts_oride_def)\n\nlemma [simp]: \"modView (read_trans t b w \\<sigma>) = modView \\<sigma>\"\n  by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"mods (read_trans t b w \\<sigma>) = mods \\<sigma>\"\n  by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n                                                            \nlemma [simp]: \"covered (read_trans t b w \\<sigma>) = covered \\<sigma>\"\n  by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"writes (read_trans t b w \\<sigma>) = writes \\<sigma>\"\n  by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"writes_on (read_trans t b w \\<sigma>) x = writes_on \\<sigma> x\"\n  apply(unfold writes_on_def)\n  by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\n\nlemma [simp]: \"value (read_trans t False w \\<sigma>) x  = value \\<sigma> x\"\n  apply(unfold value_def)\n  by(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\n\ndefinition\n  \"write_trans t b w v \\<sigma> ts' \\<equiv>\n          \\<sigma> ;; update_thrView t ((thrView \\<sigma> t)(var w := (var w, ts'))) \n            ;; update_modView (var w, ts') ((thrView \\<sigma> t)(var w := (var w, ts')))\n            ;; update_mods (var w, ts') \\<lparr> val = v, is_releasing = b\\<rparr>\"\n\n\nlemma [simp]: \"thrView (write_trans t b w v \\<sigma> ts') t = (thrView \\<sigma> t)(var w := (var w, ts'))\"\n  by (simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"t' \\<noteq> t \\<Longrightarrow> thrView (write_trans t b w v \\<sigma> ts') t' = (thrView \\<sigma> t')\"\n  by (simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' = var w \\<Longrightarrow> tst w' = ts' \\<Longrightarrow> modView (write_trans t b w v \\<sigma> ts') w' = (thrView \\<sigma> t)(var w := (var w, ts'))\"\n  apply (simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n  by (metis prod.collapse tst_def var_def)\n\nlemma [simp]: \"var w' \\<noteq> var w \\<Longrightarrow> modView (write_trans t b w v \\<sigma> ts') w' = modView \\<sigma> w'\"\n  by (auto simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' \\<noteq> var w \\<Longrightarrow> modView (write_trans t b w v \\<sigma> ts') w' y = modView \\<sigma> w' y\"\n  by (auto simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\<noteq> ts' \\<Longrightarrow> modView (write_trans t b w v \\<sigma> ts') w' = modView \\<sigma> w'\"\n  by (auto simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' = var w \\<Longrightarrow> tst w' = ts' \\<Longrightarrow> mods (write_trans t b w v \\<sigma> ts') w' = \\<lparr> val = v, is_releasing = b\\<rparr>\"\n  apply (simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n  by (metis prod.collapse tst_def var_def)\n\nlemma [simp]: \"var w' \\<noteq> var w \\<Longrightarrow> mods (write_trans t b w v \\<sigma> ts') w' = mods \\<sigma> w'\"\n  by (auto simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\<noteq> ts' \\<Longrightarrow> mods (write_trans t b w v \\<sigma> ts') w' = mods \\<sigma> w'\"\n  by (auto simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"covered (write_trans t b w v \\<sigma> ts') = covered \\<sigma>\"\n  by (simp add: write_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"writes (write_trans t b w v \\<sigma> ts') = writes \\<sigma> \\<union> {(var w, ts')}\"\n  by(simp add: Let_def rev_app_def\n                   write_trans_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"x = var w \\<Longrightarrow> writes_on (write_trans t b w v \\<sigma> ts') x = writes_on \\<sigma> x \\<union> {(var w, ts')}\"\n  apply(unfold writes_on_def)\n  apply(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n  using Collect_cong by auto\n\nlemma [simp]: \"y \\<noteq> var w \\<Longrightarrow> writes_on (write_trans t b w v \\<sigma> ts') y = writes_on \\<sigma> y\"\n  apply(unfold writes_on_def)\n  by(auto simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\nlemma [simp]: \"w \\<in> writes_on \\<sigma> y \\<Longrightarrow>  w \\<in> writes_on (write_trans t b w' v \\<sigma> ts') y\"\n  apply(unfold writes_on_def)\n  by simp\n\n\n\n\ndefinition \"update_trans t w v' \\<sigma> ts' \\<equiv> \n       let new_thr_idx = (thrView \\<sigma> t)(var w := (var w, ts')) in\n         let new_thr_idx' =\n             if releasing \\<sigma> w\n             then\n                 ts_oride new_thr_idx (modView \\<sigma> w) \n             else\n                 new_thr_idx \n             in\n                 \\<sigma> ;; update_thrView t new_thr_idx' \n                   ;; update_modView (var w, ts') new_thr_idx'\n                   ;; update_mods (var w, ts') \\<lparr> val = v', is_releasing = True\\<rparr>\n                   ;; add_cv w\"\n\n\ndefinition \"update_trans_a t w v' \\<sigma> ts' \\<equiv> \n       let new_thr_idx = (thrView \\<sigma> t)(var w := (var w, ts')) in\n         let new_thr_idx' =\n             if releasing \\<sigma> w\n             then\n                 ts_oride new_thr_idx (modView \\<sigma> w) \n             else\n                 new_thr_idx \n             in\n                 \\<sigma> ;; update_thrView t new_thr_idx' \n                   ;; update_modView (var w, ts') new_thr_idx'\n                   ;; update_mods (var w, ts') \\<lparr> val = v', is_releasing = False\\<rparr>\n                   ;; add_cv w\"\n\ndefinition \"update_trans_r t w v' \\<sigma> ts' \\<equiv> \n       let new_thr_idx = (thrView \\<sigma> t)(var w := (var w, ts')) in\n                 \\<sigma> ;; update_thrView t new_thr_idx\n                   ;; update_modView (var w, ts') new_thr_idx\n                   ;; update_mods (var w, ts') \\<lparr> val = v', is_releasing = True\\<rparr>\n                   ;; add_cv w\"\n\n\ndefinition \"CAS t w cv nv' \\<sigma> ts' \\<equiv> \n      if value \\<sigma> w = cv\n      then \n        (update_trans t w nv' \\<sigma> ts', True)\n      else \n        (read_trans t False w \\<sigma>, False)\"\n\ndefinition cas_step :: \"T \\<Rightarrow> L \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> surrey_state \\<Rightarrow> surrey_state \\<Rightarrow> bool\"\n  where\n    \"cas_step t l cv nv \\<sigma> \\<sigma>'\\<equiv>\n       \\<exists> w ts'. w \\<in> visible_writes \\<sigma> t l \\<and>\n               w \\<notin> covered \\<sigma> \\<and>\n               valid_fresh_ts \\<sigma> w ts' \\<and>\n       \\<sigma>' = fst(CAS t w cv nv \\<sigma> ts')\"\n\nlemma [simp]: \"\\<not> releasing \\<sigma> w \\<Longrightarrow>\n                     thrView (update_trans  t w v' \\<sigma> ts') t = (thrView \\<sigma> t)(var w := (var w, ts'))\"\n  by (simp add: Let_def rev_app_def update_modView_def update_mods_def update_thrView_def update_trans_def add_cv_def)\n\nlemma [simp]: \"\\<not> releasing \\<sigma> w \\<Longrightarrow>\n                     thrView (update_trans_a  t w v' \\<sigma> ts') t = (thrView \\<sigma> t)(var w := (var w, ts'))\"\n  by (simp add: Let_def rev_app_def update_modView_def update_mods_def update_thrView_def update_trans_a_def add_cv_def)\n\nlemma [simp]: \" releasing \\<sigma> w \\<Longrightarrow> \n                  thrView (update_trans  t w v' \\<sigma> ts') t = ts_oride ((thrView \\<sigma> t)(var w := (var w, ts'))) (modView \\<sigma> w)\"\n  by (auto simp add: Let_def update_trans_def add_cv_def rev_app_def update_modView_def update_mods_def update_thrView_def)\n\nlemma [simp]: \" releasing \\<sigma> w \\<Longrightarrow> \n                  thrView (update_trans_a  t w v' \\<sigma> ts') t = ts_oride ((thrView \\<sigma> t)(var w := (var w, ts'))) (modView \\<sigma> w)\"\n  by (auto simp add: Let_def update_trans_a_def add_cv_def rev_app_def update_modView_def update_mods_def update_thrView_def)\n\n\nlemma [simp]: \"thrView (update_trans_r  t w v' \\<sigma> ts') t = (thrView \\<sigma> t)(var w := (var w, ts'))\"\n  by (simp add: Let_def rev_app_def update_modView_def update_mods_def update_thrView_def update_trans_r_def add_cv_def)\n\n\nlemma [simp]: \"t' \\<noteq> t \\<Longrightarrow> thrView (update_trans  t w v' \\<sigma> ts') t' = (thrView \\<sigma> t')\"\n  by (simp add: Let_def update_trans_def add_cv_def rev_app_def update_modView_def update_mods_def update_thrView_def)\n\n\nlemma [simp]: \"var w' = var w \\<Longrightarrow> tst w' = ts' \\<Longrightarrow>\n             \\<not> releasing \\<sigma> w \\<Longrightarrow> modView (update_trans t w v' \\<sigma> ts') w' = (thrView \\<sigma> t)(var w := (var w, ts'))\"\n  apply (simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n  by (metis prod.collapse tst_def var_def)\n\nlemma [simp]: \"var w' = var w \\<Longrightarrow> tst w' = ts' \\<Longrightarrow>\n             releasing \\<sigma> w \\<Longrightarrow> modView (update_trans t w v' \\<sigma> ts') w' = ts_oride ((thrView \\<sigma> t)(var w := (var w, ts'))) (modView \\<sigma> w)\"\n  apply (simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n  by (metis prod.collapse tst_def var_def)\n\nlemma [simp]: \"var w' \\<noteq> var w \\<Longrightarrow> modView (update_trans t w v' \\<sigma> ts') w' = modView \\<sigma> w'\"\n  by (auto simp add: Let_def fun_upd_idem_iff fun_upd_twist rev_app_def update_modView_def update_mods_def update_thrView_def update_trans_def add_cv_def)\n  \nlemma [simp]: \"tst w' \\<noteq> ts' \\<Longrightarrow> modView (update_trans t w v' \\<sigma> ts') w' = modView \\<sigma> w'\"\n  by (auto simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' \\<noteq> var w \\<Longrightarrow> mods (update_trans t w v' \\<sigma> ts') w' = mods \\<sigma> w'\"\n  by (auto simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"tst w' \\<noteq> ts' \\<Longrightarrow> mods (update_trans t w v' \\<sigma> ts') w' = mods \\<sigma> w'\"\n  by (auto simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"var w' = var w \\<Longrightarrow> tst w' = ts' \\<Longrightarrow>\n             mods (update_trans t w v' \\<sigma> ts') w' = \\<lparr> val = v', is_releasing = True\\<rparr>\"\n  apply (simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n  by (metis prod.collapse tst_def var_def)\n\nlemma [simp]: \"covered (update_trans t w v' \\<sigma> ts')  = covered \\<sigma> \\<union> {w}\"\n  by (simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"writes (update_trans t w v' \\<sigma> ts') = writes \\<sigma> \\<union> {(var w, ts')}\"\n by (auto simp add: Let_def update_trans_def rev_app_def add_cv_def update_thrView_def\n                   update_modView_def update_mods_def)\n\nlemma [simp]: \"x = var w \\<Longrightarrow> writes_on (update_trans t w v' \\<sigma> ts') x = writes_on \\<sigma> x \\<union> {(x, ts')}\"\n  apply(unfold writes_on_def)\n  apply(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n  using Collect_cong by auto\n\nlemma [simp]: \"y \\<noteq> var w \\<Longrightarrow> writes_on (update_trans t w v' \\<sigma> ts') y = writes_on \\<sigma> y\"\n  apply(unfold writes_on_def)\n  by(auto simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n\n\n\n\n\n\ndefinition step :: \"T \\<Rightarrow> action \\<Rightarrow> surrey_state \\<Rightarrow> surrey_state \\<Rightarrow> bool\"\n  where\n    \"step t a \\<sigma> \\<sigma>'\\<equiv>\n       \\<exists> w. w \\<in> visible_writes \\<sigma> t (avar a) \\<and>\n       (case a of\n         Read b x v \\<Rightarrow>\n           v = value \\<sigma> w \\<and>\n           \\<sigma>' = read_trans t b w \\<sigma>\n       | Write b x v \\<Rightarrow> \\<exists> ts'.\n           w \\<notin> covered \\<sigma> \\<and>\n           valid_fresh_ts \\<sigma> w ts' \\<and>\n           \\<sigma>' = write_trans t b w v \\<sigma> ts'\n       | Update x v v' \\<Rightarrow> \\<exists> ts'.\n           v = value \\<sigma> w \\<and> \n           w \\<notin> covered \\<sigma> \\<and>\n           valid_fresh_ts \\<sigma> w ts' \\<and>\n           \\<sigma>' = update_trans t w v' \\<sigma> ts')\n           \"\n\nlemma step_cases:\n       \"step t a \\<sigma> \\<sigma>'\n          \\<Longrightarrow> \n        \\<lbrakk>\\<And> w b x v. \\<sigma>' = read_trans t b w \\<sigma> \\<and> a = Read b x v \\<and> w \\<in> visible_writes \\<sigma> t (avar a) \\<and>\n          v = value \\<sigma> w \\<Longrightarrow> P \\<sigma> (read_trans t b w \\<sigma>)\\<rbrakk>\n         \\<Longrightarrow>\n       \\<lbrakk>\\<And> w b x v ts'. \\<sigma>' = write_trans t b w v \\<sigma> ts' \\<and> a = Write b x v \\<and> w \\<in> visible_writes \\<sigma> t (avar a) \\<and>\n           w \\<notin> covered \\<sigma> \\<and>\n           valid_fresh_ts \\<sigma> w ts'\n           \\<Longrightarrow> P \\<sigma> (write_trans t b w v \\<sigma> ts') \\<rbrakk>\n         \\<Longrightarrow>\n       \\<lbrakk>\\<And> w x v v' ts'. \\<sigma>' = update_trans t w v' \\<sigma> ts' \\<and> a = Update x v v' \\<and>\n           w \\<in> visible_writes \\<sigma> t (avar a) \\<and>\n           v = value \\<sigma> w \\<and>\n           w \\<notin> covered \\<sigma> \\<and>\n           valid_fresh_ts \\<sigma> w ts'\n           \\<Longrightarrow> P \\<sigma> (update_trans t w v' \\<sigma> ts')\\<rbrakk>\n  \\<Longrightarrow> P \\<sigma> \\<sigma>'\"\n  apply(simp add: step_def) apply(case_tac a) by auto\n\n\n\ndefinition \"WrX x v \\<equiv> Write False x v\"\ndefinition \"WrR x v \\<equiv> Write True x v\"\ndefinition \"RdX x v \\<equiv> Read False x v\"\ndefinition \"RdA x v \\<equiv> Read True x v\"\n\n\n\nabbreviation WrX_state_abbr:: \" surrey_state \\<Rightarrow> L \\<Rightarrow> V \\<Rightarrow> T \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"_ [_ := _]\\<^sub>_ _\" [100,100,100,100,100])\n  where \"\\<sigma> [x := v]\\<^sub>t \\<sigma>' \\<equiv> step t (WrX x v) \\<sigma> \\<sigma>'\"\n\nabbreviation WrR_state_abbr:: \" surrey_state \\<Rightarrow> L \\<Rightarrow> V \\<Rightarrow> T \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"_ [_ :=\\<^sup>R _]\\<^sub>_ _\" [100,100,100,100,100])\n  where \"\\<sigma> [x :=\\<^sup>R v]\\<^sub>t \\<sigma>' \\<equiv> step t (WrR x v) \\<sigma> \\<sigma>'\"\n\nabbreviation RdX_state_abbr:: \" surrey_state \\<Rightarrow> V \\<Rightarrow> L \\<Rightarrow> T \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"_ [_ \\<leftarrow> _]\\<^sub>_ _\" [100,100,100,100,100])\n  where \"\\<sigma> [r \\<leftarrow> x]\\<^sub>t \\<sigma>' \\<equiv> step t (RdX x r) \\<sigma> \\<sigma>'\"\n\nabbreviation RdA_state_abbr:: \" surrey_state \\<Rightarrow> V \\<Rightarrow> L \\<Rightarrow> T \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"_ [_ \\<leftarrow>\\<^sup>A _]\\<^sub>_ _\" [100,100,100,100,100])\n  where \"\\<sigma> [r \\<leftarrow>\\<^sup>A x]\\<^sub>t \\<sigma>' \\<equiv> step t (RdA x r) \\<sigma> \\<sigma>'\"\n\nabbreviation Up_state_abbr:: \" surrey_state \\<Rightarrow> L \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> T \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"_ RMW[_, _, _]\\<^sub>_ _\" [100,100,100,100,100,100])\n  where \"\\<sigma> RMW[x, u, v]\\<^sub>t \\<sigma>' \\<equiv> step t (Update x u v) \\<sigma> \\<sigma>'\"\n\nabbreviation Up_A_state_abbr:: \" surrey_state \\<Rightarrow> L \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> T \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"_ RMW\\<^sup>A[_, _, _]\\<^sub>_ _\" [100,100,100,100,100,100])\n  where \"\\<sigma> RMW\\<^sup>A[x, u, v]\\<^sub>t \\<sigma>' \\<equiv> step t (Update x u v) \\<sigma> \\<sigma>'\"\n\nabbreviation Up_R_state_abbr:: \" surrey_state \\<Rightarrow> L \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> T \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"_ RMW\\<^sup>R[_, _, _]\\<^sub>_ _\" [100,100,100,100,100,100])\n  where \"\\<sigma> RMW\\<^sup>R[x, u, v]\\<^sub>t \\<sigma>' \\<equiv> step t (Update x u v) \\<sigma> \\<sigma>'\"\n\n\nabbreviation Swap_state_abbr:: \" surrey_state \\<Rightarrow> L \\<Rightarrow> V \\<Rightarrow> T \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"_ SWAP[_, _]\\<^sub>_ _\" [100,100,100,100,100])\n  where \"\\<sigma> SWAP[x, v]\\<^sub>t \\<sigma>' \\<equiv> \\<exists>u . step t (Update x u v) \\<sigma> \\<sigma>'\"\n\n\ndefinition \"initial_state \\<sigma> I \\<equiv>\n                 \\<exists> F . writes \\<sigma> = {(x, F x) | x. True} \\<and>\n                       (\\<forall> t x. thrView \\<sigma> t x = (x, F x)) \\<and>\n                       (\\<forall> w x. modView \\<sigma> w x = (x, F x)) \\<and>\n                       (\\<forall> w. mods \\<sigma> w = \\<lparr> val = I (var w), is_releasing = False \\<rparr>) \\<and>\n                       covered \\<sigma> = {}\"\n\ndefinition\n  \"wfs \\<sigma> \\<equiv>\n      (\\<forall> t x. thrView \\<sigma> t x \\<in> writes_on \\<sigma> x) \\<and>\n      (\\<forall> w x. modView \\<sigma> w x \\<in> writes_on \\<sigma> x) \\<and>\n      (\\<forall> x. finite(writes_on \\<sigma> x)) \\<and>\n      (\\<forall> w. w \\<in> writes \\<sigma> \\<longrightarrow> modView \\<sigma> w (var w) = w) \\<and>\n      covered \\<sigma> \\<subseteq> writes \\<sigma>\"\n\n\ndefinition \"lastWr \\<sigma> x \\<equiv> (x, Max (tst`(writes_on \\<sigma> x)))\"\n\n\n\ndefinition \"p_obs \\<sigma> t x u \\<equiv> \\<exists> w. w \\<in> visible_writes \\<sigma> t x \\<and> u = value \\<sigma> w\" \n\ndefinition \"d_obs \\<sigma> view x u \\<equiv> view x = lastWr \\<sigma> x \\<and> value \\<sigma> (lastWr \\<sigma> x) = u\"\n\ndefinition \"d_obs_t \\<sigma> t x u \\<equiv> d_obs \\<sigma> (thrView \\<sigma> t) x u\"\n\ndefinition \"c_obs \\<sigma> x u t y v \\<equiv> \n              \\<forall> w \\<in> visible_writes \\<sigma> t x. value \\<sigma> w = u \\<longrightarrow>\n                         d_obs \\<sigma> (modView \\<sigma> w) y v \\<and>\n                         releasing \\<sigma> w\"\n\nabbreviation p_obs_abbr:: \"nat  \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow>  surrey_state \\<Rightarrow> bool\" (\"[_ \\<approx>\\<^sub>_ _] _\" [100, 100, 100, 100])\n  where \"[x \\<approx>\\<^sub>t u] \\<sigma> \\<equiv> p_obs \\<sigma> t x u\"\n\nabbreviation d_obs_abbr:: \"nat  \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"[_ =\\<^sub>_ _] _\" [100, 100, 100, 100])\n  where \"[x =\\<^sub>t u] \\<sigma> \\<equiv> d_obs_t \\<sigma> t x u\"\n\nabbreviation c_obs_abbr:: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"[_ = _]\\<^sub>_\\<lparr>_ = _ \\<rparr> _\" [100, 100, 100, 100, 100, 100])\n  where \"[x = u]\\<^sub>t\\<lparr>y = v\\<rparr> \\<sigma> \\<equiv> c_obs \\<sigma> x u t y v\"\n\n\ndefinition \"covered_v \\<sigma> x v \\<equiv> \\<forall> w .  w \\<in> writes_on \\<sigma> x \\<and> w \\<notin> covered \\<sigma> \\<longrightarrow> w = lastWr \\<sigma> x \\<and> value \\<sigma> w = v\"\n\nabbreviation covered_v_abbr:: \"L \\<Rightarrow> V  \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"cvd[_, _] _\" [100, 100,100])\n  where \"cvd[x, u] \\<sigma> \\<equiv> covered_v \\<sigma> x u\"\n\n\ndefinition \"mo w w'\\<equiv> var(w) = var(w') \\<and> tst(w) < tst(w')\" \n\ndefinition \"enc \\<sigma> view x u \\<equiv> \\<exists> w . w \\<in> writes_on \\<sigma> x \\<and> tst(w) \\<le> tst(view x) \\<and> value \\<sigma> w = u\"\n\ndefinition \"enc_t \\<sigma> t x u \\<equiv>  enc \\<sigma> (thrView \\<sigma> t) x u\"\n\ndefinition \"p_vorder \\<sigma> u x v \\<equiv> \\<exists> w w'.  w \\<in> writes_on \\<sigma> x  \\<and>  w' \\<in> writes_on \\<sigma> x \\<and>\n                                        value \\<sigma> w = u \\<and> value \\<sigma> w' = v \\<and>\n                                        mo w w' \"\n\ndefinition \"d_vorder \\<sigma> u x v \\<equiv> (\\<forall> w w'.  w \\<in> writes_on \\<sigma> x  \\<and>  w' \\<in> writes_on \\<sigma> x \\<and>\n                                        value \\<sigma> w = u \\<and> value \\<sigma> w' = v \\<longrightarrow>\n                                        mo w w') \\<and> p_vorder \\<sigma> u x v\"\n\ndefinition \"init_val \\<sigma> x v \\<equiv> \n  \\<exists> w . w \\<in> writes_on \\<sigma> x \\<and> \n        (\\<forall>w'\\<in> writes_on \\<sigma> x .  w \\<noteq> w' \\<longrightarrow>  mo w w') \\<and> \n        value \\<sigma> w = v\"\n\ndefinition \"amo \\<sigma> x u \\<equiv> \\<not> p_vorder \\<sigma> u x u\"\n\ndefinition \"no_val \\<sigma> x i u \\<equiv> init_val \\<sigma> x i \\<and> \\<not> p_vorder \\<sigma> i x u\"\n\ndefinition \"last_val \\<sigma> x u i \\<equiv> \n                init_val \\<sigma> x i \\<and> p_vorder \\<sigma> i x u \n                \\<and> (\\<forall> w. w \\<noteq> u \\<longrightarrow> \\<not> p_vorder \\<sigma> u x w)\"\n\n\n\nabbreviation p_vorder_abbr:: \"V  \\<Rightarrow> L \\<Rightarrow> V \\<Rightarrow>  surrey_state \\<Rightarrow> bool\" (\"[_ \\<leadsto>\\<^sub>_ _] _\" [100,100,100,100])\n  where \"[u \\<leadsto>\\<^sub>x v] \\<sigma> \\<equiv> p_vorder \\<sigma> u x v\"\n\nabbreviation d_vorder_abbr:: \"V  \\<Rightarrow> L \\<Rightarrow> V \\<Rightarrow>  surrey_state \\<Rightarrow> bool\" (\"[_ \\<hookrightarrow>\\<^sub>_ _] _\" [100,100,100,100])\n  where \"[u \\<hookrightarrow>\\<^sub>x v] \\<sigma> \\<equiv> d_vorder \\<sigma> u x v\"\n\nabbreviation amo_abbr:: \"L \\<Rightarrow> V \\<Rightarrow>  surrey_state \\<Rightarrow> bool\" (\"[\\<one>\\<^sub>_ _] _\" [100,100,100])\n  where \"[\\<one>\\<^sub>x u] \\<sigma> \\<equiv> amo \\<sigma> x u\"\n\nabbreviation no_abbr:: \"L \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"[\\<zero>\\<^sub>_ _]\\<^sub>_ _\" [100,100,100,100])\n  where \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma> \\<equiv> no_val \\<sigma> x i u\"\n\nabbreviation enc_abbr:: \"L \\<Rightarrow> V \\<Rightarrow> T \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"[en _ _]\\<^sub>_ _\" [100,100,100,100])\n  where \"[en x u]\\<^sub>t \\<sigma> \\<equiv> enc_t \\<sigma> t x u\"\n\nabbreviation last_abbr:: \"L \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> T \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"[last _ _ _]\\<^sub>_ _\" [100, 100,100,100,100])\n  where \"[last x i u]\\<^sub>t \\<sigma> \\<equiv> last_val \\<sigma> x u i\"\n\nabbreviation init_abbr:: \"L \\<Rightarrow> V  \\<Rightarrow> surrey_state \\<Rightarrow> bool\" (\"[init _ _] _\" [100, 100,100])\n  where \"[init x v] \\<sigma> \\<equiv> init_val \\<sigma> x v\"\n\n\n\nlemma initially_write_unique: \"initial_state \\<sigma> I \\<Longrightarrow> w \\<in> writes_on \\<sigma> x \\<Longrightarrow> w' \\<in> writes_on \\<sigma> x \\<Longrightarrow> w = w'\"\n  apply(unfold initial_state_def writes_on_def) by auto\n\nlemma initial_wfs: assumes \"initial_state \\<sigma> I\"  shows \"wfs \\<sigma>\"\n  apply(simp add: initial_state_def wfs_def)\n  apply(rule conjI)\n  using assms writes_on_def\n   apply (smt CollectI fst_conv initial_state_def var_def)\n  apply(rule conjI)\n  using assms writes_on_def initial_state_def apply simp\n  apply (smt CollectI fst_conv initial_state_def var_def writes_on_def)\n  apply rule using initially_write_unique[OF assms(1)] \n  apply (smt CollectI Collect_cong finite.emptyI finite.insertI insert_compr not_finite_existsD singletonD writes_on_def)\n    apply(rule conjI)\n  apply (smt CollectD Pair_inject assms initial_state_def)\n  using assms initial_state_def by fastforce\n\n\nlemma [simp]: \"wfs \\<sigma> \\<Longrightarrow> writes_on \\<sigma> x \\<noteq> {}\"\n  apply(simp add: wfs_def)\n  by (metis empty_iff)\n\nlemma [simp]: \"wfs \\<sigma> \\<Longrightarrow> finite(writes_on \\<sigma> x)\"\n  by(simp add: wfs_def)\n\nlemma [simp]: \"wfs \\<sigma> \\<Longrightarrow> thrView \\<sigma> t x \\<in> writes_on \\<sigma> x\"\n  by(simp add: wfs_def)\n\nlemma [simp]: \"wfs \\<sigma> \\<Longrightarrow> modView \\<sigma> w x \\<in> writes_on \\<sigma> x\"\n  using wfs_def by blast\n\n\nlemma [simp]: \"wfs \\<sigma> \\<Longrightarrow> modView (read_trans t b w \\<sigma>) w x \\<in> writes_on (read_trans t b w \\<sigma>) x\"\n  by auto\n\nlemma [simp]: \"wfs \\<sigma> \\<Longrightarrow> writes_on \\<sigma> x =  writes_on (read_trans t b w \\<sigma>) x\"\n  by auto\n\n\nlemma last_write_max: \"wfs \\<sigma> \\<Longrightarrow> w \\<in> writes_on \\<sigma> x \\<Longrightarrow> tst w \\<le> tst (lastWr \\<sigma> x)\"\n  by(simp add: lastWr_def)\nend", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/OpSem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.63341026367784, "lm_q2_score": 0.5506073655352403, "lm_q1q2_score": 0.3487603565866374}}
{"text": "(*\n * Copyright Florian Haftmann\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\nsection \\<open>Ancient comprehensive Word Library\\<close>\n\ntheory Word_Lib_Sumo\nimports\n  \"HOL-Library.Word\"\n  Aligned\n  Bit_Comprehension\n  Bit_Comprehension_Int\n  Bit_Shifts_Infix_Syntax\n  Bits_Int\n  Bitwise_Signed\n  Bitwise\n  Enumeration_Word\n  Generic_set_bit\n  Hex_Words\n  Least_significant_bit\n  More_Arithmetic\n  More_Divides\n  More_Sublist\n  Even_More_List\n  More_Misc\n  Strict_part_mono\n  Legacy_Aliases\n  Most_significant_bit\n  Next_and_Prev\n  Norm_Words\n  Reversed_Bit_Lists\n  Rsplit\n  Signed_Words\n  Syntax_Bundles\n  Typedef_Morphisms\n  Type_Syntax\n  Word_EqI\n  Word_Lemmas\n  Word_8\n  Word_16\n  Word_32\n  Word_Syntax\n  Signed_Division_Word\n  Singleton_Bit_Shifts\n  More_Word_Operations\n  Many_More\nbegin\n\nunbundle bit_operations_syntax\nunbundle bit_projection_infix_syntax\n\ndeclare word_induct2[induct type]\ndeclare word_nat_cases[cases type]\n\ndeclare signed_take_bit_Suc [simp]\n\n(* these generate take_bit terms, which we often don't want for concrete lengths *)\nlemmas of_int_and_nat = unsigned_of_nat unsigned_of_int signed_of_int signed_of_nat\n\nbundle no_take_bit\nbegin\ndeclare of_int_and_nat[simp del]\nend\n\nlemmas bshiftr1_def = bshiftr1_eq\nlemmas is_down_def = is_down_eq\nlemmas is_up_def = is_up_eq\nlemmas mask_def = mask_eq\nlemmas scast_def = scast_eq\nlemmas shiftl1_def = shiftl1_eq\nlemmas shiftr1_def = shiftr1_eq\nlemmas sshiftr1_def = sshiftr1_eq\nlemmas sshiftr_def = sshiftr_eq_funpow_sshiftr1\nlemmas to_bl_def = to_bl_eq\nlemmas ucast_def = ucast_eq\nlemmas unat_def = unat_eq_nat_uint\nlemmas word_cat_def = word_cat_eq\nlemmas word_reverse_def = word_reverse_eq_of_bl_rev_to_bl\nlemmas word_roti_def = word_roti_eq_word_rotr_word_rotl\nlemmas word_rotl_def = word_rotl_eq\nlemmas word_rotr_def = word_rotr_eq\nlemmas word_sle_def = word_sle_eq\nlemmas word_sless_def = word_sless_eq\n\nlemmas uint_0 = uint_nonnegative\nlemmas uint_lt = uint_bounded\nlemmas uint_mod_same = uint_idem\nlemmas of_nth_def = word_set_bits_def\n\nlemmas of_nat_word_eq_iff = word_of_nat_eq_iff\nlemmas of_nat_word_eq_0_iff = word_of_nat_eq_0_iff\nlemmas of_int_word_eq_iff = word_of_int_eq_iff\nlemmas of_int_word_eq_0_iff = word_of_int_eq_0_iff\n\nlemmas word_next_def = word_next_unfold\n\nlemmas word_prev_def = word_prev_unfold\n\nlemmas is_aligned_def = is_aligned_iff_dvd_nat\n\nlemmas word_and_max_simps =\n  word8_and_max_simp\n  word16_and_max_simp\n  word32_and_max_simp\n\nlemma distinct_lemma: \"f x \\<noteq> f y \\<Longrightarrow> x \\<noteq> y\" by auto\n\nlemmas and_bang = word_and_nth\n\nlemmas sdiv_int_def = signed_divide_int_def\nlemmas smod_int_def = signed_modulo_int_def\n\n(* shortcut for some specific lengths *)\nlemma word_fixed_sint_1[simp]:\n  \"sint (1::8 word) = 1\"\n  \"sint (1::16 word) = 1\"\n  \"sint (1::32 word) = 1\"\n  \"sint (1::64 word) = 1\"\n  by (auto simp: sint_word_ariths)\n\ndeclare of_nat_diff [simp]\n\n(* Haskellish names/syntax *)\nnotation (input)\n  bit (\"testBit\")\n\nlemmas cast_simps = cast_simps ucast_down_bl\n\n(* shadows the slightly weaker Word.nth_ucast *)\nlemma nth_ucast:\n  \"(ucast (w::'a::len word)::'b::len word) !! n =\n   (w !! n \\<and> n < min LENGTH('a) LENGTH('b))\"\n  by (auto simp add: bit_simps not_le dest: bit_imp_le_length)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Word_Lib/Word_Lib_Sumo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3486032395372771}}
{"text": "theory Prelude_ExamplePrograms\nimports \"$HETS_LIB/Isabelle/MainHCPairs\"\nuses \"$HETS_LIB/Isabelle/prelude\"\nbegin\n\nML \"Header.initialize\n    [\\\"ga_selector_pre\\\", \\\"ga_injective_suc\\\", \\\"ga_disjoint_0_suc\\\",\n     \\\"ga_selector_undef_pre_0\\\", \\\"X1_def_Nat\\\", \\\"X2_def_Nat\\\",\n     \\\"X3_def_Nat\\\", \\\"X4_def_Nat\\\", \\\"X5_def_Nat\\\", \\\"X6_def_Nat\\\",\n     \\\"X7_def_Nat\\\", \\\"X8_def_Nat\\\", \\\"X9_def_Nat\\\", \\\"decimal_def\\\",\n     \\\"ga_comm___XPlus__\\\", \\\"ga_assoc___XPlus__\\\",\n     \\\"ga_right_unit___XPlus__\\\", \\\"ga_left_unit___XPlus__\\\",\n     \\\"ga_left_comm___XPlus__\\\", \\\"ga_comm___Xx__\\\",\n     \\\"ga_assoc___Xx__\\\", \\\"ga_right_unit___Xx__\\\",\n     \\\"ga_left_unit___Xx__\\\", \\\"ga_left_comm___Xx__\\\", \\\"ga_comm_min\\\",\n     \\\"ga_assoc_min\\\", \\\"ga_left_comm_min\\\", \\\"ga_comm_max\\\",\n     \\\"ga_assoc_max\\\", \\\"ga_right_unit_max\\\", \\\"ga_left_unit_max\\\",\n     \\\"ga_left_comm_max\\\", \\\"leq_def1_Nat\\\", \\\"leq_def2_Nat\\\",\n     \\\"leq_def3_Nat\\\", \\\"geq_def_Nat\\\", \\\"less_def_Nat\\\",\n     \\\"greater_def_Nat\\\", \\\"even_0_Nat\\\", \\\"even_suc_Nat\\\",\n     \\\"odd_def_Nat\\\", \\\"factorial_0\\\", \\\"factorial_suc\\\", \\\"add_0_Nat\\\",\n     \\\"add_suc_Nat\\\", \\\"mult_0_Nat\\\", \\\"mult_suc_Nat\\\", \\\"power_0_Nat\\\",\n     \\\"power_suc_Nat\\\", \\\"min_def_Nat\\\", \\\"max_def_Nat\\\",\n     \\\"subTotal_def1_Nat\\\", \\\"subTotal_def2_Nat\\\", \\\"sub_dom_Nat\\\",\n     \\\"sub_def_Nat\\\", \\\"divide_dom_Nat\\\", \\\"divide_0_Nat\\\",\n     \\\"divide_Pos_Nat\\\", \\\"div_dom_Nat\\\", \\\"div_Nat\\\", \\\"mod_dom_Nat\\\",\n     \\\"mod_Nat\\\", \\\"distr1_Nat\\\", \\\"distr2_Nat\\\", \\\"min_0\\\",\n     \\\"div_mod_Nat\\\", \\\"power_Nat\\\", \\\"Comp1\\\", \\\"IdDef\\\", \\\"FlipDef\\\",\n     \\\"FstDef\\\", \\\"SndDef\\\", \\\"CurryDef\\\", \\\"UncurryDef\\\", \\\"NotFalse\\\",\n     \\\"NotTrue\\\", \\\"AndFalse\\\", \\\"AndTrue\\\", \\\"AndSym\\\", \\\"OrDef\\\",\n     \\\"OtherwiseDef\\\", \\\"AndPrefixDef\\\", \\\"OrPrefixDef\\\", \\\"NotFalse1\\\",\n     \\\"NotTrue1\\\", \\\"notNot1\\\", \\\"notNot2\\\", \\\"EqualTDef\\\",\n     \\\"EqualSymDef\\\", \\\"EqualReflex\\\", \\\"EqualTransT\\\", \\\"DiffDef\\\",\n     \\\"DiffSymDef\\\", \\\"DiffTDef\\\", \\\"DiffFDef\\\", \\\"TE1\\\", \\\"TE2\\\",\n     \\\"TE3\\\", \\\"TE4\\\", \\\"IBE1\\\", \\\"IBE2\\\", \\\"IBE3\\\", \\\"IBE4\\\", \\\"IBE5\\\",\n     \\\"IBE6\\\", \\\"IBE7\\\", \\\"IBE8\\\", \\\"IUE1\\\", \\\"IUE2\\\", \\\"IOE01\\\",\n     \\\"IOE02\\\", \\\"IOE03\\\", \\\"IOE04\\\", \\\"IOE05\\\", \\\"IOE06\\\", \\\"IOE07\\\",\n     \\\"IOE08\\\", \\\"IOE09\\\", \\\"LeIrreflexivity\\\", \\\"LeTAsymmetry\\\",\n     \\\"LeTTransitive\\\", \\\"LeTTotal\\\", \\\"GeDef\\\", \\\"GeIrreflexivity\\\",\n     \\\"GeTAsymmetry\\\", \\\"GeTTransitive\\\", \\\"GeTTotal\\\", \\\"LeqDef\\\",\n     \\\"LeqReflexivity\\\", \\\"LeqTTransitive\\\", \\\"LeqTTotal\\\", \\\"GeqDef\\\",\n     \\\"GeqReflexivity\\\", \\\"GeqTTransitive\\\", \\\"GeqTTotal\\\",\n     \\\"EqTSOrdRel\\\", \\\"EqFSOrdRel\\\", \\\"EqTOrdRel\\\", \\\"EqFOrdRel\\\",\n     \\\"EqTOrdTSubstE\\\", \\\"EqTOrdFSubstE\\\", \\\"EqTOrdTSubstD\\\",\n     \\\"EqTOrdFSubstD\\\", \\\"LeTGeTRel\\\", \\\"LeFGeFRel\\\", \\\"LeqTGetTRel\\\",\n     \\\"LeqFGetFRel\\\", \\\"GeTLeTRel\\\", \\\"GeFLeFRel\\\", \\\"GeqTLeqTRel\\\",\n     \\\"GeqFLeqFRel\\\", \\\"LeTGeFEqFRel\\\", \\\"LeFGeTEqTRel\\\",\n     \\\"LeqTGeFRel\\\", \\\"LeqFGeTRel\\\", \\\"GeTLeFEqFRel\\\", \\\"GeFLeTEqTRel\\\",\n     \\\"GeqTLeFRel\\\", \\\"GeqFLeTRel\\\", \\\"LeqTLeTEqTRel\\\",\n     \\\"LeqFLeFEqFRel\\\", \\\"GeqTGeTEqTRel\\\", \\\"GeqFGeFEqFRel\\\",\n     \\\"LeTGeqFRel\\\", \\\"GeTLeqFRel\\\", \\\"LeLeqDiff\\\", \\\"CmpLTDef\\\",\n     \\\"CmpEQDef\\\", \\\"CmpGTDef\\\", \\\"MaxYDef\\\", \\\"MaxXDef\\\", \\\"MinXDef\\\",\n     \\\"MinYDef\\\", \\\"MaxSym\\\", \\\"MinSym\\\", \\\"TO1\\\", \\\"TO2\\\", \\\"TO3\\\",\n     \\\"TO4\\\", \\\"TO5\\\", \\\"TO6\\\", \\\"TO7\\\", \\\"IOO13\\\", \\\"IOO14\\\",\n     \\\"IOO15\\\", \\\"IOO16\\\", \\\"IOO17\\\", \\\"IOO18\\\", \\\"IOO19\\\", \\\"IOO20\\\",\n     \\\"IOO21\\\", \\\"IOO22\\\", \\\"IOO23\\\", \\\"IOO24\\\", \\\"IOO25\\\", \\\"IOO26\\\",\n     \\\"IOO27\\\", \\\"IOO28\\\", \\\"IOO29\\\", \\\"IOO30\\\", \\\"IOO31\\\", \\\"IOO32\\\",\n     \\\"IOO33\\\", \\\"IBO5\\\", \\\"IBO6\\\", \\\"IBO7\\\", \\\"IBO8\\\", \\\"IBO9\\\",\n     \\\"IBO10\\\", \\\"IBO11\\\", \\\"IBO12\\\", \\\"IUO01\\\", \\\"IUO02\\\", \\\"IUO03\\\",\n     \\\"IUO04\\\", \\\"IUO05\\\", \\\"IUO06\\\", \\\"IUO07\\\", \\\"LengthNil\\\",\n     \\\"LengthCons\\\", \\\"NotDefHead\\\", \\\"HeadDef\\\", \\\"NotDefTail\\\",\n     \\\"TailDef\\\", \\\"FoldrNil\\\", \\\"FoldrCons\\\", \\\"FoldlNil\\\",\n     \\\"FoldlCons\\\", \\\"MapNil\\\", \\\"MapCons\\\", \\\"XPlusXPlusNil\\\",\n     \\\"XPlusXPlusCons\\\", \\\"XPlusXPlusPrefixDef\\\", \\\"FilterNil\\\",\n     \\\"FilterConsT\\\", \\\"FilterConsF\\\", \\\"ZipNil\\\", \\\"ZipConsNil\\\",\n     \\\"ZipConsCons\\\", \\\"UnzipNil\\\", \\\"UnzipCons\\\", \\\"EqualListNilDef\\\",\n     \\\"EqualListDef\\\", \\\"LeListNilFalse\\\", \\\"LeListDef\\\",\n     \\\"FoldlDecomp\\\", \\\"MapDecomp\\\", \\\"MapFunctor\\\", \\\"FilterProm\\\",\n     \\\"LengthNil1\\\", \\\"LengthEqualNil\\\", \\\"LengthEqualCons\\\",\n     \\\"ZipSpec\\\", \\\"InitNil\\\", \\\"InitConsNil\\\", \\\"InitConsCons\\\",\n     \\\"LastNil\\\", \\\"LastConsNil\\\", \\\"LastConsCons\\\", \\\"NullNil\\\",\n     \\\"NullCons\\\", \\\"ReverseNil\\\", \\\"ReverseCons\\\", \\\"Foldr1Nil\\\",\n     \\\"Foldr1ConsNil\\\", \\\"Foldr1ConsCons\\\", \\\"Foldl1Nil\\\",\n     \\\"Foldl1ConsNil\\\", \\\"Foldl1ConsCons\\\", \\\"AndLDef\\\", \\\"OrLDef\\\",\n     \\\"AnyDef\\\", \\\"AllDef\\\", \\\"ConcatDef\\\", \\\"ConcatMapDef\\\",\n     \\\"MaximumDef\\\", \\\"MinimumDef\\\", \\\"TakeWhileNil\\\",\n     \\\"TakeWhileConsT\\\", \\\"TakeWhileConsF\\\", \\\"DropWhileNil\\\",\n     \\\"DropWhileConsT\\\", \\\"DropWhileConsF\\\", \\\"SpanNil\\\", \\\"SpanConsT\\\",\n     \\\"SpanConsF\\\", \\\"SpanThm\\\", \\\"BreakDef\\\", \\\"BreakThm\\\",\n     \\\"QsortNil\\\", \\\"QsortCons\\\", \\\"Program01\\\", \\\"Program02\\\"]\"\n\ntypedecl Unit\n\ndatatype Nat = X0 (\"0''\") | X_suc \"Nat\" (\"suc/'(_')\" [3] 999)\ndatatype Bool = X_False (\"False''\") | X_True (\"True''\")\ndatatype Ordering = EQ | GT | LT\ndatatype 'a List = X_Cons 'a \"'a List\" | X_Nil (\"Nil''\")\n\nconsts\nNot__X :: \"Bool => Bool\" (\"(Not''/ _)\" [56] 56)\nX1 :: \"Nat\" (\"1''\")\nX2 :: \"Nat\" (\"2''\")\nX3 :: \"Nat\" (\"3''\")\nX4 :: \"Nat\" (\"4''\")\nX5 :: \"Nat\" (\"5''\")\nX6 :: \"Nat\" (\"6''\")\nX7 :: \"Nat\" (\"7''\")\nX8 :: \"Nat\" (\"8''\")\nX9 :: \"Nat\" (\"9''\")\nXLtXAmpXAmpXGt :: \"Bool => Bool => Bool\"\nXLtXPlusXPlusXGt :: \"'a List => 'a List => 'a List\"\nXLtXVBarXVBarXGt :: \"Bool => Bool => Bool\"\nX__XAmpXAmp__X :: \"Bool => Bool => Bool\" (\"(_/ &&/ _)\" [54,54] 52)\nX__XAtXAt__X :: \"Nat => Nat => Nat\" (\"(_/ @@/ _)\" [54,54] 52)\nX__XCaret__X :: \"Nat => Nat => Nat\" (\"(_/ ^''/ _)\" [54,54] 52)\nX__XEqXEq__X :: \"'a => 'a => Bool\" (\"(_/ ==''/ _)\" [54,54] 52)\nX__XExclam :: \"Nat => Nat\" (\"(_/ !'')\" [58] 58)\nX__XGtXEq__XX1 :: \"Nat => Nat => bool\" (\"(_/ >=''/ _)\" [44,44] 42)\nX__XGtXEq__XX2 :: \"'a => 'a => Bool\" (\"(_/ >=''''/ _)\" [54,54] 52)\nX__XGt__XX1 :: \"Nat => Nat => bool\" (\"(_/ >''/ _)\" [44,44] 42)\nX__XGt__XX2 :: \"'a => 'a => Bool\" (\"(_/ >''''/ _)\" [54,54] 52)\nX__XLtXEq__XX1 :: \"Nat => Nat => bool\" (\"(_/ <=''/ _)\" [44,44] 42)\nX__XLtXEq__XX2 :: \"'a => 'a => Bool\" (\"(_/ <=''''/ _)\" [54,54] 52)\nX__XLt__XX1 :: \"Nat => Nat => bool\" (\"(_/ <''/ _)\" [44,44] 42)\nX__XLt__XX2 :: \"'a => 'a => Bool\" (\"(_/ <''''/ _)\" [54,54] 52)\nX__XMinusXExclam__X :: \"Nat => Nat => Nat\" (\"(_/ -!/ _)\" [54,54] 52)\nX__XMinusXQuest__X :: \"Nat => Nat => Nat partial\" (\"(_/ -?/ _)\" [54,54] 52)\nX__XPlusXPlus__X :: \"'a List => 'a List => 'a List\" (\"(_/ ++''/ _)\" [54,54] 52)\nX__XPlus__X :: \"Nat => Nat => Nat\" (\"(_/ +''/ _)\" [54,54] 52)\nX__XSlashXEq__X :: \"'a => 'a => Bool\" (\"(_/ '/=/ _)\" [54,54] 52)\nX__XSlashXQuest__X :: \"Nat => Nat => Nat partial\" (\"(_/ '/?/ _)\" [54,54] 52)\nX__XVBarXVBar__X :: \"Bool => Bool => Bool\" (\"(_/ ||/ _)\" [54,54] 52)\nX__Xx__X :: \"Nat => Nat => Nat\" (\"(_/ *''/ _)\" [54,54] 52)\nX__div__X :: \"Nat => Nat => Nat partial\" (\"(_/ div''/ _)\" [54,54] 52)\nX__mod__X :: \"Nat => Nat => Nat partial\" (\"(_/ mod''/ _)\" [54,54] 52)\nX__o__X :: \"('b => 'c) * ('a => 'b) => 'a => 'c\"\nX_all :: \"('a => Bool) => 'a List => Bool\"\nX_andL :: \"Bool List => Bool\" (\"andL/'(_')\" [3] 999)\nX_any :: \"('a => Bool) => 'a List => Bool\"\nX_concat :: \"'a List List => 'a List\" (\"concat''/'(_')\" [3] 999)\nX_curry :: \"('a * 'b => 'c) => 'a => 'b => 'c\"\nX_dropWhile :: \"('a => Bool) => 'a List => 'a List\"\nX_even :: \"Nat => bool\" (\"even''/'(_')\" [3] 999)\nX_filter :: \"('a => Bool) => 'a List => 'a List\"\nX_flip :: \"('a => 'b => 'c) => 'b => 'a => 'c\"\nX_foldl :: \"('a => 'b => 'a) => 'a => 'b List => 'a\"\nX_foldr :: \"('a => 'b => 'b) => 'b => 'a List => 'b\"\nX_fst :: \"'a => 'b => 'a\" (\"fst''/'(_,/ _')\" [3,3] 999)\nX_head :: \"'a List => 'a partial\" (\"head/'(_')\" [3] 999)\nX_id :: \"'a => 'a\" (\"id''/'(_')\" [3] 999)\nX_init :: \"'a List => 'a List partial\" (\"init/'(_')\" [3] 999)\nX_last :: \"'a List => 'a partial\" (\"last''/'(_')\" [3] 999)\nX_length :: \"'a List => Nat\" (\"length''/'(_')\" [3] 999)\nX_map :: \"('a => 'b) => 'a List => 'b List\"\nX_maxX1 :: \"Nat => Nat => Nat\" (\"max''/'(_,/ _')\" [3,3] 999)\nX_maxX2 :: \"'a => 'a => 'a\"\nX_maximum :: \"'d List => 'd\" (\"maximum/'(_')\" [3] 999)\nX_minX1 :: \"Nat => Nat => Nat\" (\"min''/'(_,/ _')\" [3,3] 999)\nX_minX2 :: \"'a => 'a => 'a\"\nX_minimum :: \"'d List => 'd\" (\"minimum/'(_')\" [3] 999)\nX_null :: \"'a List => Bool\" (\"null''/'(_')\" [3] 999)\nX_odd :: \"Nat => bool\" (\"odd''/'(_')\" [3] 999)\nX_orL :: \"Bool List => Bool\" (\"orL/'(_')\" [3] 999)\nX_pre :: \"Nat => Nat partial\" (\"pre/'(_')\" [3] 999)\nX_qsort :: \"'a List => 'a List\" (\"qsort/'(_')\" [3] 999)\nX_reverse :: \"'a List => 'a List\" (\"reverse/'(_')\" [3] 999)\nX_snd :: \"'a => 'b => 'b\" (\"snd''/'(_,/ _')\" [3,3] 999)\nX_tail :: \"'a List => 'a List partial\" (\"tail/'(_')\" [3] 999)\nX_takeWhile :: \"('a => Bool) => 'a List => 'a List\"\nX_unzip :: \"('a * 'b) List => 'a List * 'b List\" (\"unzip/'(_')\" [3] 999)\nX_zip :: \"'a List => 'b List => ('a * 'b) List\"\nbreak :: \"('a => Bool) => 'a List => 'a List * 'a List\"\ncompare :: \"'a => 'a => Ordering\"\nconcatMap :: \"('a => 'b List) => 'a List => 'b List\"\nfoldl1 :: \"('a => 'a => 'a) => 'a List => 'a partial\"\nfoldr1 :: \"('a => 'a => 'a) => 'a List => 'a partial\"\notherwiseH :: \"Bool\"\nspan :: \"('a => Bool) => 'a List => 'a List * 'a List\"\nuncurry :: \"('a => 'b => 'c) => 'a * 'b => 'c\"\n\naxioms\nga_selector_pre [rule_format] :\n\"ALL XX1. pre(suc(XX1)) = makePartial XX1\"\n\nga_injective_suc [rule_format] :\n\"ALL XX1. ALL Y1. suc(XX1) = suc(Y1) = (XX1 = Y1)\"\n\nga_disjoint_0_suc [rule_format] : \"ALL Y1. ~ 0' = suc(Y1)\"\n\nga_selector_undef_pre_0 [rule_format] : \"~ defOp (pre(0'))\"\n\nX1_def_Nat [rule_format] : \"1' = suc(0')\"\n\nX2_def_Nat [rule_format] : \"2' = suc(1')\"\n\nX3_def_Nat [rule_format] : \"3' = suc(2')\"\n\nX4_def_Nat [rule_format] : \"4' = suc(3')\"\n\nX5_def_Nat [rule_format] : \"5' = suc(4')\"\n\nX6_def_Nat [rule_format] : \"6' = suc(5')\"\n\nX7_def_Nat [rule_format] : \"7' = suc(6')\"\n\nX8_def_Nat [rule_format] : \"8' = suc(7')\"\n\nX9_def_Nat [rule_format] : \"9' = suc(8')\"\n\ndecimal_def [rule_format] :\n\"ALL m. ALL X_n. m @@ X_n = (m *' suc(9')) +' X_n\"\n\nga_comm___XPlus__ [rule_format] : \"ALL x. ALL y. x +' y = y +' x\"\n\nga_assoc___XPlus__ [rule_format] :\n\"ALL x. ALL y. ALL z. (x +' y) +' z = x +' (y +' z)\"\n\nga_right_unit___XPlus__ [rule_format] : \"ALL x. x +' 0' = x\"\n\nga_left_unit___XPlus__ [rule_format] : \"ALL x. 0' +' x = x\"\n\nga_left_comm___XPlus__ [rule_format] :\n\"ALL x. ALL y. ALL z. x +' (y +' z) = y +' (x +' z)\"\n\nga_comm___Xx__ [rule_format] : \"ALL x. ALL y. x *' y = y *' x\"\n\nga_assoc___Xx__ [rule_format] :\n\"ALL x. ALL y. ALL z. (x *' y) *' z = x *' (y *' z)\"\n\nga_right_unit___Xx__ [rule_format] : \"ALL x. x *' 1' = x\"\n\nga_left_unit___Xx__ [rule_format] : \"ALL x. 1' *' x = x\"\n\nga_left_comm___Xx__ [rule_format] :\n\"ALL x. ALL y. ALL z. x *' (y *' z) = y *' (x *' z)\"\n\nga_comm_min [rule_format] : \"ALL x. ALL y. min'(x, y) = min'(y, x)\"\n\nga_assoc_min [rule_format] :\n\"ALL x. ALL y. ALL z. min'(min'(x, y), z) = min'(x, min'(y, z))\"\n\nga_left_comm_min [rule_format] :\n\"ALL x. ALL y. ALL z. min'(x, min'(y, z)) = min'(y, min'(x, z))\"\n\nga_comm_max [rule_format] : \"ALL x. ALL y. max'(x, y) = max'(y, x)\"\n\nga_assoc_max [rule_format] :\n\"ALL x. ALL y. ALL z. max'(max'(x, y), z) = max'(x, max'(y, z))\"\n\nga_right_unit_max [rule_format] : \"ALL x. max'(x, 0') = x\"\n\nga_left_unit_max [rule_format] : \"ALL x. max'(0', x) = x\"\n\nga_left_comm_max [rule_format] :\n\"ALL x. ALL y. ALL z. max'(x, max'(y, z)) = max'(y, max'(x, z))\"\n\nleq_def1_Nat [rule_format] : \"ALL X_n. 0' <=' X_n\"\n\nleq_def2_Nat [rule_format] : \"ALL X_n. ~ suc(X_n) <=' 0'\"\n\nleq_def3_Nat [rule_format] :\n\"ALL m. ALL X_n. (suc(m) <=' suc(X_n)) = (m <=' X_n)\"\n\ngeq_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m >=' X_n) = (X_n <=' m)\"\n\nless_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m <' X_n) = (m <=' X_n & ~ m = X_n)\"\n\ngreater_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m >' X_n) = (X_n <' m)\"\n\neven_0_Nat [rule_format] : \"even'(0')\"\n\neven_suc_Nat [rule_format] : \"ALL m. even'(suc(m)) = odd'(m)\"\n\nodd_def_Nat [rule_format] : \"ALL m. odd'(m) = (~ even'(m))\"\n\nfactorial_0 [rule_format] : \"0' !' = 1'\"\n\nfactorial_suc [rule_format] :\n\"ALL X_n. suc(X_n) !' = suc(X_n) *' X_n !'\"\n\nadd_0_Nat [rule_format] : \"ALL m. 0' +' m = m\"\n\nadd_suc_Nat [rule_format] :\n\"ALL m. ALL X_n. suc(X_n) +' m = suc(X_n +' m)\"\n\nmult_0_Nat [rule_format] : \"ALL m. 0' *' m = 0'\"\n\nmult_suc_Nat [rule_format] :\n\"ALL m. ALL X_n. suc(X_n) *' m = (X_n *' m) +' m\"\n\npower_0_Nat [rule_format] : \"ALL m. m ^' 0' = 1'\"\n\npower_suc_Nat [rule_format] :\n\"ALL m. ALL X_n. m ^' suc(X_n) = m *' (m ^' X_n)\"\n\nmin_def_Nat [rule_format] :\n\"ALL m. ALL X_n. min'(m, X_n) = (if m <=' X_n then m else X_n)\"\n\nmax_def_Nat [rule_format] :\n\"ALL m. ALL X_n. max'(m, X_n) = (if m <=' X_n then X_n else m)\"\n\nsubTotal_def1_Nat [rule_format] :\n\"ALL m. ALL X_n. m >' X_n --> X_n -! m = 0'\"\n\nsubTotal_def2_Nat [rule_format] :\n\"ALL m. ALL X_n. m <=' X_n --> makePartial (X_n -! m) = X_n -? m\"\n\nsub_dom_Nat [rule_format] :\n\"ALL m. ALL X_n. defOp (m -? X_n) = (m >=' X_n)\"\n\nsub_def_Nat [rule_format] :\n\"ALL m. ALL X_n. ALL r. m -? X_n = makePartial r = (m = r +' X_n)\"\n\ndivide_dom_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n defOp (m /? X_n) = (~ X_n = 0' & m mod' X_n = makePartial 0')\"\n\ndivide_0_Nat [rule_format] : \"ALL m. ~ defOp (m /? 0')\"\n\ndivide_Pos_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r. X_n >' 0' --> m /? X_n = makePartial r = (m = r *' X_n)\"\n\ndiv_dom_Nat [rule_format] :\n\"ALL m. ALL X_n. defOp (m div' X_n) = (~ X_n = 0')\"\n\ndiv_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m div' X_n = makePartial r =\n (EX s. m = (X_n *' r) +' s & s <' X_n)\"\n\nmod_dom_Nat [rule_format] :\n\"ALL m. ALL X_n. defOp (m mod' X_n) = (~ X_n = 0')\"\n\nmod_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL s.\n m mod' X_n = makePartial s =\n (EX r. m = (X_n *' r) +' s & s <' X_n)\"\n\ndistr1_Nat [rule_format] :\n\"ALL r. ALL s. ALL t. (r +' s) *' t = (r *' t) +' (s *' t)\"\n\ndistr2_Nat [rule_format] :\n\"ALL r. ALL s. ALL t. t *' (r +' s) = (t *' r) +' (t *' s)\"\n\nmin_0 [rule_format] : \"ALL m. min'(m, 0') = 0'\"\n\ndiv_mod_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ~ X_n = 0' -->\n makePartial m =\n (let (Xb5, Xc0) =\n      let (Xb4, Xc3) = m div' X_n\n      in if Xb4 then makePartial (Xc3 *' X_n) else noneOp\n  in if Xb5\n        then let (Xb2, Xc1) = m mod' X_n\n             in if Xb2 then makePartial (Xc0 +' Xc1) else noneOp\n        else noneOp)\"\n\npower_Nat [rule_format] :\n\"ALL m. ALL r. ALL s. m ^' (r +' s) = (m ^' r) *' (m ^' s)\"\n\nComp1 [rule_format] :\n\"ALL f. ALL g. ALL y. X__o__X (f, g) y = f (g y)\"\n\nIdDef [rule_format] : \"ALL x. id'(x) = x\"\n\nFlipDef [rule_format] : \"ALL f. ALL x. ALL y. X_flip f y x = f x y\"\n\nFstDef [rule_format] : \"ALL x. ALL y. fst'(x, y) = x\"\n\nSndDef [rule_format] : \"ALL x. ALL y. snd'(x, y) = y\"\n\nCurryDef [rule_format] :\n\"ALL g. ALL x. ALL y. X_curry g x y = g (x, y)\"\n\nUncurryDef [rule_format] :\n\"ALL f. ALL x. ALL y. uncurry f (x, y) = f x y\"\n\nNotFalse [rule_format] : \"Not' False' = True'\"\n\nNotTrue [rule_format] : \"Not' True' = False'\"\n\nAndFalse [rule_format] : \"ALL x. False' && x = False'\"\n\nAndTrue [rule_format] : \"ALL x. True' && x = x\"\n\nAndSym [rule_format] : \"ALL x. ALL y. x && y = y && x\"\n\nOrDef [rule_format] :\n\"ALL x. ALL y. x || y = Not' (Not' x && Not' y)\"\n\nOtherwiseDef [rule_format] : \"otherwiseH = True'\"\n\nAndPrefixDef [rule_format] :\n\"ALL x. ALL y. XLtXAmpXAmpXGt x y = x && y\"\n\nOrPrefixDef [rule_format] :\n\"ALL x. ALL y. XLtXVBarXVBarXGt x y = x || y\"\n\nNotFalse1 [rule_format] : \"ALL x. Not' x = True' = (x = False')\"\n\nNotTrue1 [rule_format] : \"ALL x. Not' x = False' = (x = True')\"\n\nnotNot1 [rule_format] : \"ALL x. (~ x = True') = (Not' x = True')\"\n\nnotNot2 [rule_format] : \"ALL x. (~ x = False') = (Not' x = False')\"\n\nEqualTDef [rule_format] : \"ALL x. ALL y. x = y --> x ==' y = True'\"\n\nEqualSymDef [rule_format] : \"ALL x. ALL y. x ==' y = y ==' x\"\n\nEqualReflex [rule_format] : \"ALL x. x ==' x = True'\"\n\nEqualTransT [rule_format] :\n\"ALL x.\n ALL y.\n ALL z. x ==' y = True' & y ==' z = True' --> x ==' z = True'\"\n\nDiffDef [rule_format] : \"ALL x. ALL y. x /= y = Not' (x ==' y)\"\n\nDiffSymDef [rule_format] : \"ALL x. ALL y. x /= y = y /= x\"\n\nDiffTDef [rule_format] :\n\"ALL x. ALL y. x /= y = True' = (Not' (x ==' y) = True')\"\n\nDiffFDef [rule_format] :\n\"ALL x. ALL y. x /= y = False' = (x ==' y = True')\"\n\nTE1 [rule_format] : \"ALL x. ALL y. x ==' y = False' --> ~ x = y\"\n\nTE2 [rule_format] :\n\"ALL x. ALL y. Not' (x ==' y) = True' = (x ==' y = False')\"\n\nTE3 [rule_format] :\n\"ALL x. ALL y. Not' (x ==' y) = False' = (x ==' y = True')\"\n\nTE4 [rule_format] :\n\"ALL x. ALL y. (~ x ==' y = True') = (x ==' y = False')\"\n\nIBE1 [rule_format] : \"True' ==' True' = True'\"\n\nIBE2 [rule_format] : \"False' ==' False' = True'\"\n\nIBE3 [rule_format] : \"False' ==' True' = False'\"\n\nIBE4 [rule_format] : \"True' ==' False' = False'\"\n\nIBE5 [rule_format] : \"True' /= False' = True'\"\n\nIBE6 [rule_format] : \"False' /= True' = True'\"\n\nIBE7 [rule_format] : \"Not' (True' ==' False') = True'\"\n\nIBE8 [rule_format] : \"Not' Not' (True' ==' False') = False'\"\n\nIUE1 [rule_format] : \"() ==' () = True'\"\n\nIUE2 [rule_format] : \"() /= () = False'\"\n\nIOE01 [rule_format] : \"LT ==' LT = True'\"\n\nIOE02 [rule_format] : \"EQ ==' EQ = True'\"\n\nIOE03 [rule_format] : \"GT ==' GT = True'\"\n\nIOE04 [rule_format] : \"LT ==' EQ = False'\"\n\nIOE05 [rule_format] : \"LT ==' GT = False'\"\n\nIOE06 [rule_format] : \"EQ ==' GT = False'\"\n\nIOE07 [rule_format] : \"LT /= EQ = True'\"\n\nIOE08 [rule_format] : \"LT /= GT = True'\"\n\nIOE09 [rule_format] : \"EQ /= GT = True'\"\n\nLeIrreflexivity [rule_format] :\n\"ALL x. ALL y. x ==' y = True' --> x <'' y = False'\"\n\nLeTAsymmetry [rule_format] :\n\"ALL x. ALL y. x <'' y = True' --> y <'' x = False'\"\n\nLeTTransitive [rule_format] :\n\"ALL x.\n ALL y.\n ALL z. x <'' y = True' & y <'' z = True' --> x <'' z = True'\"\n\nLeTTotal [rule_format] :\n\"ALL x.\n ALL y. (x <'' y = True' | y <'' x = True') | x ==' y = True'\"\n\nGeDef [rule_format] : \"ALL x. ALL y. x >'' y = y <'' x\"\n\nGeIrreflexivity [rule_format] :\n\"ALL x. ALL y. x ==' y = True' --> x >'' y = False'\"\n\nGeTAsymmetry [rule_format] :\n\"ALL x. ALL y. x >'' y = True' --> y >'' x = False'\"\n\nGeTTransitive [rule_format] :\n\"ALL x.\n ALL y. ALL z. (x >'' y) && (y >'' z) = True' --> x >'' z = True'\"\n\nGeTTotal [rule_format] :\n\"ALL x. ALL y. ((x >'' y) || (y >'' x)) || (x ==' y) = True'\"\n\nLeqDef [rule_format] :\n\"ALL x. ALL y. x <='' y = (x <'' y) || (x ==' y)\"\n\nLeqReflexivity [rule_format] : \"ALL x. x <='' x = True'\"\n\nLeqTTransitive [rule_format] :\n\"ALL x.\n ALL y.\n ALL z. (x <='' y) && (y <='' z) = True' --> x <='' z = True'\"\n\nLeqTTotal [rule_format] :\n\"ALL x. ALL y. (x <='' y) && (y <='' x) = x ==' y\"\n\nGeqDef [rule_format] :\n\"ALL x. ALL y. x >='' y = (x >'' y) || (x ==' y)\"\n\nGeqReflexivity [rule_format] : \"ALL x. x >='' x = True'\"\n\nGeqTTransitive [rule_format] :\n\"ALL x.\n ALL y.\n ALL z. (x >='' y) && (y >='' z) = True' --> x >='' z = True'\"\n\nGeqTTotal [rule_format] :\n\"ALL x. ALL y. (x >='' y) && (y >='' x) = x ==' y\"\n\nEqTSOrdRel [rule_format] :\n\"ALL x.\n ALL y. x ==' y = True' = (x <'' y = False' & x >'' y = False')\"\n\nEqFSOrdRel [rule_format] :\n\"ALL x.\n ALL y. x ==' y = False' = (x <'' y = True' | x >'' y = True')\"\n\nEqTOrdRel [rule_format] :\n\"ALL x.\n ALL y. x ==' y = True' = (x <='' y = True' & x >='' y = True')\"\n\nEqFOrdRel [rule_format] :\n\"ALL x.\n ALL y. x ==' y = False' = (x <='' y = True' | x >='' y = True')\"\n\nEqTOrdTSubstE [rule_format] :\n\"ALL x.\n ALL y.\n ALL z. x ==' y = True' & y <'' z = True' --> x <'' z = True'\"\n\nEqTOrdFSubstE [rule_format] :\n\"ALL x.\n ALL y.\n ALL z. x ==' y = True' & y <'' z = False' --> x <'' z = False'\"\n\nEqTOrdTSubstD [rule_format] :\n\"ALL x.\n ALL y.\n ALL z. x ==' y = True' & z <'' y = True' --> z <'' x = True'\"\n\nEqTOrdFSubstD [rule_format] :\n\"ALL x.\n ALL y.\n ALL z. x ==' y = True' & z <'' y = False' --> z <'' x = False'\"\n\nLeTGeTRel [rule_format] :\n\"ALL x. ALL y. x <'' y = True' = (y >'' x = True')\"\n\nLeFGeFRel [rule_format] :\n\"ALL x. ALL y. x <'' y = False' = (y >'' x = False')\"\n\nLeqTGetTRel [rule_format] :\n\"ALL x. ALL y. x <='' y = True' = (y >='' x = True')\"\n\nLeqFGetFRel [rule_format] :\n\"ALL x. ALL y. x <='' y = False' = (y >='' x = False')\"\n\nGeTLeTRel [rule_format] :\n\"ALL x. ALL y. x >'' y = True' = (y <'' x = True')\"\n\nGeFLeFRel [rule_format] :\n\"ALL x. ALL y. x >'' y = False' = (y <'' x = False')\"\n\nGeqTLeqTRel [rule_format] :\n\"ALL x. ALL y. x >='' y = True' = (y <='' x = True')\"\n\nGeqFLeqFRel [rule_format] :\n\"ALL x. ALL y. x >='' y = False' = (y <='' x = False')\"\n\nLeTGeFEqFRel [rule_format] :\n\"ALL x.\n ALL y. x <'' y = True' = (x >'' y = False' & x ==' y = False')\"\n\nLeFGeTEqTRel [rule_format] :\n\"ALL x.\n ALL y. x <'' y = False' = (x >'' y = True' | x ==' y = True')\"\n\nLeqTGeFRel [rule_format] :\n\"ALL x. ALL y. x <='' y = True' = (x >'' y = False')\"\n\nLeqFGeTRel [rule_format] :\n\"ALL x. ALL y. x <='' y = False' = (x >'' y = True')\"\n\nGeTLeFEqFRel [rule_format] :\n\"ALL x.\n ALL y. x >'' y = True' = (x <'' y = False' & x ==' y = False')\"\n\nGeFLeTEqTRel [rule_format] :\n\"ALL x.\n ALL y. x >'' y = False' = (x <'' y = True' | x ==' y = True')\"\n\nGeqTLeFRel [rule_format] :\n\"ALL x. ALL y. x >='' y = True' = (x <'' y = False')\"\n\nGeqFLeTRel [rule_format] :\n\"ALL x. ALL y. x >='' y = False' = (x <'' y = True')\"\n\nLeqTLeTEqTRel [rule_format] :\n\"ALL x.\n ALL y. x <='' y = True' = (x <'' y = True' | x ==' y = True')\"\n\nLeqFLeFEqFRel [rule_format] :\n\"ALL x.\n ALL y. x <='' y = False' = (x <'' y = False' & x ==' y = False')\"\n\nGeqTGeTEqTRel [rule_format] :\n\"ALL x.\n ALL y. x >='' y = True' = (x >'' y = True' | x ==' y = True')\"\n\nGeqFGeFEqFRel [rule_format] :\n\"ALL x.\n ALL y. x >='' y = False' = (x >'' y = False' & x ==' y = False')\"\n\nLeTGeqFRel [rule_format] :\n\"ALL x. ALL y. x <'' y = True' = (x >='' y = False')\"\n\nGeTLeqFRel [rule_format] :\n\"ALL x. ALL y. x >'' y = True' = (x <='' y = False')\"\n\nLeLeqDiff [rule_format] :\n\"ALL x. ALL y. x <'' y = (x <='' y) && (x /= y)\"\n\nCmpLTDef [rule_format] :\n\"ALL x. ALL y. compare x y ==' LT = x <'' y\"\n\nCmpEQDef [rule_format] :\n\"ALL x. ALL y. compare x y ==' EQ = x ==' y\"\n\nCmpGTDef [rule_format] :\n\"ALL x. ALL y. compare x y ==' GT = x >'' y\"\n\nMaxYDef [rule_format] :\n\"ALL x. ALL y. X_maxX2 x y ==' y = x <='' y\"\n\nMaxXDef [rule_format] :\n\"ALL x. ALL y. X_maxX2 x y ==' x = y <='' x\"\n\nMinXDef [rule_format] :\n\"ALL x. ALL y. X_minX2 x y ==' x = x <='' y\"\n\nMinYDef [rule_format] :\n\"ALL x. ALL y. X_minX2 x y ==' y = y <='' x\"\n\nMaxSym [rule_format] :\n\"ALL x. ALL y. X_maxX2 x y ==' y = X_maxX2 y x ==' y\"\n\nMinSym [rule_format] :\n\"ALL x. ALL y. X_minX2 x y ==' y = X_minX2 y x ==' y\"\n\nTO1 [rule_format] :\n\"ALL x.\n ALL y. (x ==' y = True' | x <'' y = True') = (x <='' y = True')\"\n\nTO2 [rule_format] :\n\"ALL x. ALL y. x ==' y = True' --> x <'' y = False'\"\n\nTO3 [rule_format] :\n\"ALL x.\n ALL y. Not' Not' (x <'' y) = True' | Not' (x <'' y) = True'\"\n\nTO4 [rule_format] :\n\"ALL x. ALL y. x <'' y = True' --> Not' (x ==' y) = True'\"\n\nTO5 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n (x <'' y = True' & y <'' z = True') & z <'' w = True' -->\n x <'' w = True'\"\n\nTO6 [rule_format] :\n\"ALL x. ALL z. z <'' x = True' --> Not' (x <'' z) = True'\"\n\nTO7 [rule_format] :\n\"ALL x. ALL y. x <'' y = True' = (y >'' x = True')\"\n\nIOO13 [rule_format] : \"LT <'' EQ = True'\"\n\nIOO14 [rule_format] : \"EQ <'' GT = True'\"\n\nIOO15 [rule_format] : \"LT <'' GT = True'\"\n\nIOO16 [rule_format] : \"LT <='' EQ = True'\"\n\nIOO17 [rule_format] : \"EQ <='' GT = True'\"\n\nIOO18 [rule_format] : \"LT <='' GT = True'\"\n\nIOO19 [rule_format] : \"EQ >='' LT = True'\"\n\nIOO20 [rule_format] : \"GT >='' EQ = True'\"\n\nIOO21 [rule_format] : \"GT >='' LT = True'\"\n\nIOO22 [rule_format] : \"EQ >'' LT = True'\"\n\nIOO23 [rule_format] : \"GT >'' EQ = True'\"\n\nIOO24 [rule_format] : \"GT >'' LT = True'\"\n\nIOO25 [rule_format] : \"X_maxX2 LT EQ ==' EQ = True'\"\n\nIOO26 [rule_format] : \"X_maxX2 EQ GT ==' GT = True'\"\n\nIOO27 [rule_format] : \"X_maxX2 LT GT ==' GT = True'\"\n\nIOO28 [rule_format] : \"X_minX2 LT EQ ==' LT = True'\"\n\nIOO29 [rule_format] : \"X_minX2 EQ GT ==' EQ = True'\"\n\nIOO30 [rule_format] : \"X_minX2 LT GT ==' LT = True'\"\n\nIOO31 [rule_format] : \"compare LT LT ==' EQ = True'\"\n\nIOO32 [rule_format] : \"compare EQ EQ ==' EQ = True'\"\n\nIOO33 [rule_format] : \"compare GT GT ==' EQ = True'\"\n\nIBO5 [rule_format] : \"False' <'' True' = True'\"\n\nIBO6 [rule_format] : \"False' >='' True' = False'\"\n\nIBO7 [rule_format] : \"True' >='' False' = True'\"\n\nIBO8 [rule_format] : \"True' <'' False' = False'\"\n\nIBO9 [rule_format] : \"X_maxX2 False' True' ==' True' = True'\"\n\nIBO10 [rule_format] : \"X_minX2 False' True' ==' False' = True'\"\n\nIBO11 [rule_format] : \"compare True' True' ==' EQ = True'\"\n\nIBO12 [rule_format] : \"compare False' False' ==' EQ = True'\"\n\nIUO01 [rule_format] : \"() <='' () = True'\"\n\nIUO02 [rule_format] : \"() <'' () = False'\"\n\nIUO03 [rule_format] : \"() >='' () = True'\"\n\nIUO04 [rule_format] : \"() >'' () = False'\"\n\nIUO05 [rule_format] : \"X_maxX2 () () ==' () = True'\"\n\nIUO06 [rule_format] : \"X_minX2 () () ==' () = True'\"\n\nIUO07 [rule_format] : \"compare () () ==' EQ = True'\"\n\nLengthNil [rule_format] : \"length'(Nil') = 0'\"\n\nLengthCons [rule_format] :\n\"ALL x. ALL xs. length'(X_Cons x xs) = suc(length'(xs))\"\n\nNotDefHead [rule_format] : \"~ defOp (head(Nil'))\"\n\nHeadDef [rule_format] :\n\"ALL x. ALL xs. head(X_Cons x xs) = makePartial x\"\n\nNotDefTail [rule_format] : \"~ defOp (tail(Nil'))\"\n\nTailDef [rule_format] :\n\"ALL x. ALL xs. tail(X_Cons x xs) = makePartial xs\"\n\nFoldrNil [rule_format] : \"ALL f. ALL s. X_foldr f s Nil' = s\"\n\nFoldrCons [rule_format] :\n\"ALL f.\n ALL s.\n ALL x. ALL xs. X_foldr f s (X_Cons x xs) = f x (X_foldr f s xs)\"\n\nFoldlNil [rule_format] : \"ALL g. ALL t. X_foldl g t Nil' = t\"\n\nFoldlCons [rule_format] :\n\"ALL g.\n ALL t.\n ALL z. ALL zs. X_foldl g t (X_Cons z zs) = X_foldl g (g t z) zs\"\n\nMapNil [rule_format] : \"ALL h. X_map h Nil' = Nil'\"\n\nMapCons [rule_format] :\n\"ALL h.\n ALL x. ALL xs. X_map h (X_Cons x xs) = X_Cons (h x) (X_map h xs)\"\n\nXPlusXPlusNil [rule_format] : \"ALL l. Nil' ++' l = l\"\n\nXPlusXPlusCons [rule_format] :\n\"ALL l. ALL x. ALL xs. X_Cons x xs ++' l = X_Cons x (xs ++' l)\"\n\nXPlusXPlusPrefixDef [rule_format] :\n\"ALL xs. ALL ys. XLtXPlusXPlusXGt xs ys = xs ++' ys\"\n\nFilterNil [rule_format] : \"ALL p. X_filter p Nil' = Nil'\"\n\nFilterConsT [rule_format] :\n\"ALL p.\n ALL x.\n ALL xs.\n p x = True' -->\n X_filter p (X_Cons x xs) = X_Cons x (X_filter p xs)\"\n\nFilterConsF [rule_format] :\n\"ALL p.\n ALL x.\n ALL xs. p x = False' --> X_filter p (X_Cons x xs) = X_filter p xs\"\n\nZipNil [rule_format] : \"ALL l. X_zip Nil' l = Nil'\"\n\nZipConsNil [rule_format] :\n\"ALL l. ALL x. ALL xs. l = Nil' --> X_zip (X_Cons x xs) l = Nil'\"\n\nZipConsCons [rule_format] :\n\"ALL l.\n ALL x.\n ALL xs.\n ALL y.\n ALL ys.\n l = X_Cons y ys -->\n X_zip (X_Cons x xs) l = X_Cons (x, y) (X_zip xs ys)\"\n\nUnzipNil [rule_format] : \"unzip(Nil') = (Nil', Nil')\"\n\nUnzipCons [rule_format] :\n\"ALL ps.\n ALL x.\n ALL z.\n unzip(X_Cons (x, z) ps) =\n (let (ys, zs) = unzip(ps) in (X_Cons x ys, X_Cons z zs))\"\n\nEqualListNilDef [rule_format] : \"Nil' ==' Nil' = True'\"\n\nEqualListDef [rule_format] :\n\"ALL x.\n ALL xs.\n ALL y.\n ALL ys. X_Cons x xs ==' X_Cons y ys = (x ==' y) && (xs ==' ys)\"\n\nLeListNilFalse [rule_format] : \"Nil' <'' Nil' = False'\"\n\nLeListDef [rule_format] :\n\"ALL w.\n ALL ws.\n ALL z.\n ALL zs. X_Cons z zs <'' X_Cons w ws = (z <'' w) && (zs <'' ws)\"\n\nFoldlDecomp [rule_format] :\n\"ALL e.\n ALL i.\n ALL ts.\n ALL ys. X_foldl i e (ys ++' ts) = X_foldl i (X_foldl i e ys) ts\"\n\nMapDecomp [rule_format] :\n\"ALL f.\n ALL xs. ALL zs. X_map f (xs ++' zs) = X_map f xs ++' X_map f zs\"\n\nMapFunctor [rule_format] :\n\"ALL f.\n ALL g. ALL xs. X_map (X__o__X (g, f)) xs = X_map g (X_map f xs)\"\n\nFilterProm [rule_format] :\n\"ALL f.\n ALL p.\n ALL xs.\n X_filter p (X_map f xs) = X_map f (X_filter (X__o__X (p, f)) xs)\"\n\nLengthNil1 [rule_format] : \"ALL xs. length'(xs) = 0' = (xs = Nil')\"\n\nLengthEqualNil [rule_format] :\n\"ALL ys. length'(Nil') = length'(ys) --> ys = Nil'\"\n\nLengthEqualCons [rule_format] :\n\"ALL x.\n ALL xs.\n ALL y.\n ALL ys.\n length'(X_Cons x xs) = length'(X_Cons y ys) -->\n length'(xs) = length'(ys)\"\n\nZipSpec [rule_format] :\n\"ALL xs.\n ALL ys.\n length'(xs) = length'(ys) --> unzip(X_zip xs ys) = (xs, ys)\"\n\nInitNil [rule_format] : \"~ defOp (init(Nil'))\"\n\nInitConsNil [rule_format] :\n\"ALL x. init(X_Cons x Nil') = makePartial Nil'\"\n\nInitConsCons [rule_format] :\n\"ALL x.\n ALL xs.\n init(X_Cons x xs) =\n (let (Xb1, Xc0) = init(xs)\n  in if Xb1 then makePartial (X_Cons x Xc0) else noneOp)\"\n\nLastNil [rule_format] : \"~ defOp (last'(Nil'))\"\n\nLastConsNil [rule_format] :\n\"ALL x. last'(X_Cons x Nil') = makePartial x\"\n\nLastConsCons [rule_format] :\n\"ALL x. ALL xs. last'(X_Cons x xs) = last'(xs)\"\n\nNullNil [rule_format] : \"null'(Nil') = True'\"\n\nNullCons [rule_format] :\n\"ALL x. ALL xs. null'(X_Cons x xs) = False'\"\n\nReverseNil [rule_format] : \"reverse(Nil') = Nil'\"\n\nReverseCons [rule_format] :\n\"ALL x.\n ALL xs. reverse(X_Cons x xs) = reverse(xs) ++' X_Cons x Nil'\"\n\nFoldr1Nil [rule_format] : \"ALL f. ~ defOp (foldr1 f Nil')\"\n\nFoldr1ConsNil [rule_format] :\n\"ALL f. ALL x. foldr1 f (X_Cons x Nil') = makePartial x\"\n\nFoldr1ConsCons [rule_format] :\n\"ALL f.\n ALL x.\n ALL xs.\n foldr1 f (X_Cons x xs) =\n (let (Xb1, Xc0) = foldr1 f xs\n  in if Xb1 then makePartial (f x Xc0) else noneOp)\"\n\nFoldl1Nil [rule_format] : \"ALL f. ~ defOp (foldl1 f Nil')\"\n\nFoldl1ConsNil [rule_format] :\n\"ALL f. ALL x. foldl1 f (X_Cons x Nil') = makePartial x\"\n\nFoldl1ConsCons [rule_format] :\n\"ALL f.\n ALL x.\n ALL xs.\n foldl1 f (X_Cons x xs) =\n (let (Xb1, Xc0) = foldr1 f xs\n  in if Xb1 then makePartial (f x Xc0) else noneOp)\"\n\nAndLDef [rule_format] :\n\"ALL bs. andL(bs) = X_foldr XLtXAmpXAmpXGt True' bs\"\n\nOrLDef [rule_format] :\n\"ALL bs. orL(bs) = X_foldr XLtXVBarXVBarXGt False' bs\"\n\nAnyDef [rule_format] :\n\"ALL p. ALL xs. X_any p xs = orL(X_map p xs)\"\n\nAllDef [rule_format] :\n\"ALL p. ALL xs. X_all p xs = andL(X_map p xs)\"\n\nConcatDef [rule_format] :\n\"ALL xxs. concat'(xxs) = X_foldr XLtXPlusXPlusXGt Nil' xxs\"\n\nConcatMapDef [rule_format] :\n\"ALL g. ALL xs. concatMap g xs = concat'(X_map g xs)\"\n\nMaximumDef [rule_format] :\n\"ALL ds. makePartial (maximum(ds)) = foldl1 X_maxX2 ds\"\n\nMinimumDef [rule_format] :\n\"ALL ds. makePartial (minimum(ds)) = foldl1 X_minX2 ds\"\n\nTakeWhileNil [rule_format] : \"ALL p. X_takeWhile p Nil' = Nil'\"\n\nTakeWhileConsT [rule_format] :\n\"ALL p.\n ALL x.\n ALL xs.\n p x = True' -->\n X_takeWhile p (X_Cons x xs) = X_Cons x (X_takeWhile p xs)\"\n\nTakeWhileConsF [rule_format] :\n\"ALL p.\n ALL x. ALL xs. p x = False' --> X_takeWhile p (X_Cons x xs) = Nil'\"\n\nDropWhileNil [rule_format] : \"ALL p. X_dropWhile p Nil' = Nil'\"\n\nDropWhileConsT [rule_format] :\n\"ALL p.\n ALL x.\n ALL xs.\n p x = True' --> X_dropWhile p (X_Cons x xs) = X_dropWhile p xs\"\n\nDropWhileConsF [rule_format] :\n\"ALL p.\n ALL x.\n ALL xs. p x = False' --> X_dropWhile p (X_Cons x xs) = X_Cons x xs\"\n\nSpanNil [rule_format] : \"ALL p. span p Nil' = (Nil', Nil')\"\n\nSpanConsT [rule_format] :\n\"ALL p.\n ALL x.\n ALL xs.\n p x = True' -->\n span p (X_Cons x xs) =\n (let (ys, zs) = span p xs in (X_Cons x ys, zs))\"\n\nSpanConsF [rule_format] :\n\"ALL p.\n ALL x.\n ALL xs.\n p x = False' -->\n span p (X_Cons x xs) =\n (let (ys, zs) = span p xs in (Nil', X_Cons x xs))\"\n\nSpanThm [rule_format] :\n\"ALL p. ALL xs. span p xs = (X_takeWhile p xs, X_dropWhile p xs)\"\n\nBreakDef [rule_format] :\n\"ALL p.\n ALL xs. break p xs = (let q = X__o__X (Not__X, p) in span q xs)\"\n\nBreakThm [rule_format] :\n\"ALL p. ALL xs. break p xs = span (X__o__X (Not__X, p)) xs\"\n\nQsortNil [rule_format] : \"qsort(Nil') = Nil'\"\n\nQsortCons [rule_format] :\n\"ALL x.\n ALL xs.\n qsort(X_Cons x xs) =\n (qsort(X_filter (% y. y <'' x) xs) ++' X_Cons x Nil') ++'\n qsort(X_filter (% y. y >='' x) xs)\"\n\ndeclare ga_selector_pre [simp]\ndeclare ga_selector_undef_pre_0 [simp]\ndeclare ga_comm___XPlus__ [simp]\ndeclare ga_assoc___XPlus__ [simp]\ndeclare ga_right_unit___XPlus__ [simp]\ndeclare ga_left_unit___XPlus__ [simp]\ndeclare ga_left_comm___XPlus__ [simp]\ndeclare ga_comm___Xx__ [simp]\ndeclare ga_assoc___Xx__ [simp]\ndeclare ga_right_unit___Xx__ [simp]\ndeclare ga_left_unit___Xx__ [simp]\ndeclare ga_left_comm___Xx__ [simp]\ndeclare ga_comm_min [simp]\ndeclare ga_assoc_min [simp]\ndeclare ga_left_comm_min [simp]\ndeclare ga_comm_max [simp]\ndeclare ga_assoc_max [simp]\ndeclare ga_right_unit_max [simp]\ndeclare ga_left_unit_max [simp]\ndeclare ga_left_comm_max [simp]\ndeclare leq_def1_Nat [simp]\ndeclare leq_def2_Nat [simp]\ndeclare leq_def3_Nat [simp]\ndeclare even_0_Nat [simp]\ndeclare even_suc_Nat [simp]\ndeclare factorial_0 [simp]\ndeclare add_0_Nat [simp]\ndeclare mult_0_Nat [simp]\ndeclare power_0_Nat [simp]\ndeclare subTotal_def1_Nat [simp]\ndeclare subTotal_def2_Nat [simp]\ndeclare sub_dom_Nat [simp]\ndeclare divide_0_Nat [simp]\ndeclare min_0 [simp]\ndeclare Comp1 [simp]\ndeclare IdDef [simp]\ndeclare FlipDef [simp]\ndeclare FstDef [simp]\ndeclare SndDef [simp]\ndeclare CurryDef [simp]\ndeclare UncurryDef [simp]\ndeclare NotFalse [simp]\ndeclare NotTrue [simp]\ndeclare AndFalse [simp]\ndeclare AndTrue [simp]\ndeclare EqualReflex [simp]\ndeclare IBE1 [simp]\ndeclare IBE2 [simp]\ndeclare IBE3 [simp]\ndeclare IBE4 [simp]\ndeclare IBE5 [simp]\ndeclare IBE6 [simp]\ndeclare IBE7 [simp]\ndeclare IBE8 [simp]\ndeclare IOE01 [simp]\ndeclare IOE02 [simp]\ndeclare IOE03 [simp]\ndeclare IOE04 [simp]\ndeclare IOE05 [simp]\ndeclare IOE06 [simp]\ndeclare IOE07 [simp]\ndeclare IOE08 [simp]\ndeclare IOE09 [simp]\ndeclare LeIrreflexivity [simp]\ndeclare LeTAsymmetry [simp]\ndeclare GeIrreflexivity [simp]\ndeclare GeTAsymmetry [simp]\ndeclare GeTTransitive [simp]\ndeclare GeTTotal [simp]\ndeclare LeqReflexivity [simp]\ndeclare LeqTTransitive [simp]\ndeclare LeqTTotal [simp]\ndeclare GeqReflexivity [simp]\ndeclare GeqTTransitive [simp]\ndeclare GeqTTotal [simp]\ndeclare CmpLTDef [simp]\ndeclare CmpEQDef [simp]\ndeclare CmpGTDef [simp]\ndeclare MaxYDef [simp]\ndeclare MaxXDef [simp]\ndeclare MinXDef [simp]\ndeclare MinYDef [simp]\ndeclare TO2 [simp]\ndeclare TO4 [simp]\ndeclare TO6 [simp]\ndeclare IOO13 [simp]\ndeclare IOO14 [simp]\ndeclare IOO15 [simp]\ndeclare IOO16 [simp]\ndeclare IOO17 [simp]\ndeclare IOO18 [simp]\ndeclare IOO19 [simp]\ndeclare IOO20 [simp]\ndeclare IOO21 [simp]\ndeclare IOO22 [simp]\ndeclare IOO23 [simp]\ndeclare IOO24 [simp]\ndeclare IOO25 [simp]\ndeclare IOO26 [simp]\ndeclare IOO27 [simp]\ndeclare IOO28 [simp]\ndeclare IOO29 [simp]\ndeclare IOO30 [simp]\ndeclare IOO31 [simp]\ndeclare IOO32 [simp]\ndeclare IOO33 [simp]\ndeclare IBO5 [simp]\ndeclare IBO6 [simp]\ndeclare IBO7 [simp]\ndeclare IBO8 [simp]\ndeclare IBO9 [simp]\ndeclare IBO10 [simp]\ndeclare IBO11 [simp]\ndeclare IBO12 [simp]\ndeclare IUO05 [simp]\ndeclare IUO06 [simp]\ndeclare IUO07 [simp]\ndeclare LengthNil [simp]\ndeclare LengthCons [simp]\ndeclare NotDefHead [simp]\ndeclare HeadDef [simp]\ndeclare NotDefTail [simp]\ndeclare TailDef [simp]\ndeclare FoldrNil [simp]\ndeclare FoldlNil [simp]\ndeclare MapNil [simp]\ndeclare XPlusXPlusNil [simp]\ndeclare FilterNil [simp]\ndeclare FilterConsF [simp]\ndeclare ZipNil [simp]\ndeclare EqualListNilDef [simp]\ndeclare LeListNilFalse [simp]\ndeclare InitNil [simp]\ndeclare InitConsNil [simp]\ndeclare LastNil [simp]\ndeclare LastConsNil [simp]\ndeclare LastConsCons [simp]\ndeclare NullNil [simp]\ndeclare NullCons [simp]\ndeclare ReverseNil [simp]\ndeclare Foldr1Nil [simp]\ndeclare Foldr1ConsNil [simp]\ndeclare Foldl1Nil [simp]\ndeclare Foldl1ConsNil [simp]\ndeclare TakeWhileNil [simp]\ndeclare TakeWhileConsF [simp]\ndeclare DropWhileNil [simp]\ndeclare DropWhileConsT [simp]\ndeclare DropWhileConsF [simp]\ndeclare SpanNil [simp]\ndeclare QsortNil [simp]\n\ntheorem Program01 :\n\"andL(X_Cons True' (X_Cons True' (X_Cons True' Nil'))) = True'\"\napply(simp only: AndLDef)\napply(simp only: FoldrCons)\napply(simp only: FoldrNil)\napply(simp add: AndPrefixDef)\ndone\n\nML \"Header.record \\\"Program01\\\"\"\n\ntheorem Program02 :\n\"qsort(X_Cons True' (X_Cons False' Nil')) =\n X_Cons False' (X_Cons True' Nil')\"\napply(simp only: QsortCons)\napply(case_tac \"(%y. y <'' True') False'\")\napply(simp only: FilterNil FilterConsT FilterConsF)\napply(simp only: QsortNil)\napply(simp only: XPlusXPlusNil)\napply(simp only: XPlusXPlusCons)\napply(simp only: XPlusXPlusNil)\napply(case_tac \"(%y. y >='' True') False'\")\napply(simp only: FilterNil FilterConsT FilterConsF)\napply(simp only: QsortNil)\napply(simp add: LeFGeTEqTRel)\napply(simp only: FilterNil FilterConsT FilterConsF)\napply(simp only: QsortCons)\napply(simp only: FilterNil FilterConsT FilterConsF)\napply(simp only: QsortNil)\napply(simp only: XPlusXPlusNil)\napply(simp only: XPlusXPlusCons)\napply(simp only: XPlusXPlusNil)\napply(simp only: IBO5)\napply(simp only: FilterNil FilterConsT FilterConsF)\napply(simp only: QsortCons)\napply(simp only: FilterNil FilterConsT FilterConsF)\napply(simp only: QsortNil)\napply(simp only: XPlusXPlusNil)\napply(simp only: XPlusXPlusCons)\napply(simp only: XPlusXPlusNil)\napply(case_tac \"(%y. y >='' True') False'\")\napply(simp only: FilterNil FilterConsT FilterConsF)\napply(simp only: QsortNil)\napply(simp only: XPlusXPlusCons)\napply(simp only: XPlusXPlusNil)\napply(simp only: FilterNil FilterConsT FilterConsF)\napply(simp only: QsortCons)\napply(simp only: FilterNil FilterConsT FilterConsF)\napply(simp only: QsortNil)\napply(simp only: XPlusXPlusNil)\napply(simp only: XPlusXPlusCons)\napply(simp only: XPlusXPlusNil)\napply(simp add: LeFGeTEqTRel)\ndone\n\nML \"Header.record \\\"Program02\\\"\"\n\nend\n", "meta": {"author": "glaubersp", "repo": "HasCASL-Library_Source", "sha": "be605b06acfc124d8e88829cc931a1148ea30460", "save_path": "github-repos/isabelle/glaubersp-HasCASL-Library_Source", "path": "github-repos/isabelle/glaubersp-HasCASL-Library_Source/HasCASL-Library_Source-be605b06acfc124d8e88829cc931a1148ea30460/Prelude.newBool_Cpo.deprecated/Prelude_ExamplePrograms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.34853896456110484}}
{"text": "theory Balance_Opt_LR_Ext\n  imports \n    \"../../Free_Ext\"\n    \"../../Insert/Alloc_Optimized/Balance_Opt_Ext\"\n    Balance_Opt_LR\n    \nbegin\n\n\ncontext rbt_impl\nbegin\n\nlemma balance_left_opt_ext_correct':\n  \"\n  llvm_htriple\n  ( \n    \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) n_p **\n    rbt_assn_ext l {} li **\n    \\<upharpoonleft>key_assn k ki **\n    \\<upharpoonleft>value_assn v vi **\n    rbt_assn_ext r {} ri **\n    color_assn c ci **\n    \\<up>(rbt_sorted (Branch c (rbt_of l) k v (rbt_of r))) **\n    \n    \n    \\<up>(matches_rbt (RP_Branch CP_B RP_Var RP_Var) l_pre) ** \n    \\<up>(inv1 (Branch c l_pre k v (rbt_of r))) **\n    \\<up>(inv2 (Branch c l_pre k v (rbt_of r)))\n  )\n  (balance_left_opt n_p)\n  (\\<lambda>ti_res. EXS t_res.\n    rbt_assn_ext t_res {} ti_res **\n    \\<up>(rbt_of t_res = rbt_balance_left (rbt_of l) k v (rbt_of r)) **\n    ctx(rbt_sorted (rbt_of t_res)) **\n    \\<up>(ptr_of_key t_res ti_res = ptr_of_key (ATBranch c k v ci li ki vi ri l r) n_p) **\n    \\<up>(value_of_key t_res = value_of_key (ATBranch c k v ci li ki vi ri l r))\n  )\n  \"\n  unfolding \n    balance_left_opt_def\n    bl_opt_case_1_def\n    bl_opt_case_2_def\n    bl_opt_case_3_def\n    rotate_left_def\n    rotate_right_def\n    left_def\n    right_def\n  supply sep_context_pureI[fri_red_rules]\n  apply vcg\n  subgoal (*case 1*)\n    apply (cases \"(rbt_of l, k, v, rbt_of r)\" rule: RBT_Impl.balance_left.cases, auto)\n     apply vcg_vok\n    done\n  subgoal (*case 2+*)\n    apply vcg\n\n    subgoal (*case 2*)\n      apply (cases \"(rbt_of l, k, v, rbt_of r)\" rule: RBT_Impl.balance_left.cases, auto)\n      subgoal by vcg_vok\n      subgoal by vcg_vok\n      subgoal by vcg_vok\n      subgoal by vcg_vok\n\n      done\n    subgoal (*case 3+*)\n      apply vcg\n      subgoal (*case 3*)\n        apply (cases \"(rbt_of l, k, v, rbt_of r)\" rule: RBT_Impl.balance_left.cases, auto)\n         supply rbt_greater_trans[intro]\n         supply rbt_less_trans[intro]\n\n        subgoal \n          apply vcg\n          apply vcg_compat\n          subgoal\n            apply (sepEwith \\<open>solves auto | solves pok_solver | solves vok_solver\\<close>)\n            apply simp\n            apply sep\n            done\n          done\n\n        subgoal\n          apply vcg\n          apply vcg_compat\n          subgoal\n            apply (sepEwith \\<open>solves auto | solves pok_solver | solves vok_solver\\<close>)\n            apply simp\n            apply sep\n            done\n          done\n        done\n      subgoal (*case 4*)\n        apply (cases \"(rbt_of l, k, v, rbt_of r)\" rule: RBT_Impl.balance_left.cases)\n                  apply (auto elim: matches_rbt.elims)\n        done\n      done\n    done\n  done\n\n\nlemmas balance_left_opt_ext_correct[vcg_rules] = balance_left_opt_ext_correct'[simplified ctx_def]\n\nlemma balance_right_opt_ext_correct':\n  \"\n  llvm_htriple\n  ( \n    \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) n_p **\n    rbt_assn_ext l {} li **\n    \\<upharpoonleft>key_assn k ki **\n    \\<upharpoonleft>value_assn v vi **\n    rbt_assn_ext r {} ri **\n    color_assn c ci **\n    \\<up>(rbt_sorted (Branch c (rbt_of l) k v (rbt_of r))) **\n\n    \\<up>(matches_rbt (RP_Branch CP_B RP_Var RP_Var) r_pre) **\n    \\<up>(inv1 (Branch c (rbt_of l) k v r_pre)) **\n    \\<up>(inv2 (Branch c (rbt_of l) k v r_pre))\n  )\n  (balance_right_opt n_p)\n  (\\<lambda>ti_res. EXS t_res.\n    rbt_assn_ext t_res {} ti_res **\n    \\<up>(rbt_of t_res = rbt_balance_right (rbt_of l) k v (rbt_of r)) **\n    ctx(rbt_sorted (rbt_of t_res)) **\n    \\<up>(ptr_of_key t_res ti_res = ptr_of_key (ATBranch c k v ci li ki vi ri l r) n_p) **\n    \\<up>(value_of_key t_res = value_of_key (ATBranch c k v ci li ki vi ri l r))\n  )\n  \"\n  unfolding \n    balance_right_opt_def\n    br_opt_case_1_def\n    br_opt_case_2_def\n    br_opt_case_3_def\n    rotate_left_def\n    rotate_right_def\n    left_def\n    right_def\n  apply vcg\n  subgoal (*case 1*)\n    apply (cases \"(rbt_of l, k, v, rbt_of r)\" rule: RBT_Impl.balance_right.cases, auto)\n     apply vcg_vok\n    done\n  subgoal (*case 2+*)\n    apply vcg\n\n    subgoal (*case 2*)\n      apply (cases \"(rbt_of l, k, v, rbt_of r)\" rule: RBT_Impl.balance_right.cases, auto)\n      subgoal by vcg_vok\n      subgoal by vcg_vok\n      subgoal by vcg_vok\n      subgoal by vcg_vok\n      done\n    subgoal (*case 3+*)\n      apply vcg\n      subgoal (*case 3*)\n        apply (cases \"(rbt_of l, k, v, rbt_of r)\" rule: RBT_Impl.balance_right.cases, auto)\n         supply rbt_greater_trans[intro]\n         supply rbt_less_trans[intro]\n\n        subgoal\n          apply vcg\n          apply vcg_compat\n          subgoal\n            apply (sepEwith \\<open>solves auto | solves pok_solver | solves vok_solver\\<close>)\n            apply simp\n            apply sep\n            done\n          done\n\n        subgoal \n          apply vcg\n          apply vcg_compat\n          subgoal\n            apply (sepEwith \\<open>solves auto | solves pok_solver | solves vok_solver\\<close>)\n            apply simp\n            apply sep\n            done\n          done\n        done\n      subgoal (*case 4*)\n        apply (cases \"(rbt_of l, k, v, rbt_of r)\" rule: RBT_Impl.balance_right.cases)\n        by (auto elim: matches_rbt.elims)\n      done\n    done\n  done\n\nlemmas balance_right_opt_ext_correct[vcg_rules] = balance_right_opt_ext_correct'[simplified ctx_def]\n\n\n\nlemma balance_left_opt_ext_combine_correct':\n  \"\n  llvm_htriple\n  ( \n    \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) n_p **\n    rbt_assn_ext l {} li **\n    \\<upharpoonleft>key_assn k ki **\n    \\<upharpoonleft>value_assn v vi **\n    rbt_assn_ext r {} ri **\n    color_assn c ci **\n    \\<up>(rbt_sorted (Branch c (rbt_of l) k v (rbt_of r))) **\n    \\<up>(matches_rbt (RP_Branch CP_B RP_Var RP_Var) (rbt_of r))\n  )\n  (balance_left_opt n_p)\n  (\\<lambda>ti_res. EXS t_res.\n    rbt_assn_ext t_res {} ti_res **\n    \\<up>(rbt_of t_res = rbt_balance_left (rbt_of l) k v (rbt_of r)) **\n    ctx(rbt_sorted (rbt_of t_res)) **\n    \\<up>(ptr_of_key t_res ti_res = ptr_of_key (ATBranch c k v ci li ki vi ri l r) n_p) **\n    \\<up>(value_of_key t_res = value_of_key (ATBranch c k v ci li ki vi ri l r))\n  )\n  \"\n  unfolding \n    balance_left_opt_def\n    bl_opt_case_1_def\n    bl_opt_case_2_def\n    bl_opt_case_3_def\n    rotate_left_def\n    rotate_right_def\n    left_def\n    right_def\n  apply vcg\n  subgoal (*case 1*)\n    apply (cases \"(rbt_of l, k, v, rbt_of r)\" rule: RBT_Impl.balance_left.cases, auto)\n    apply vcg_vok\n    done\n  subgoal (*case 2+*)\n    apply vcg\n\n    subgoal (*case 2*)\n      apply (cases \"(rbt_of l, k, v, rbt_of r)\" rule: RBT_Impl.balance_left.cases, auto)\n       apply vcg_vok\n      done\n    apply vcg (*all other cases unreachable*)\n    done\n  done\n\nlemmas balance_left_opt_ext_combine_correct[vcg_rules] =\n  balance_left_opt_ext_combine_correct'[simplified ctx_def]\n\nend\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Delete/Alloc_Optimized/Balance_Opt_LR_Ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548511303338, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.34853895731816215}}
{"text": "section \\<open>Execution\\<close>\n\ntext \\<open>\n  \\file{Execution} introduces a locale for executions within asynchronous systems.\n\\<close>\n\ntheory Execution\nimports AsynchronousSystem ListUtilities\nbegin\n\nsubsection \\<open>Execution locale definition\\<close>\n\ntext \\<open>\n  A (finite) execution within a system is a list of configurations \\isb{exec}\n  accompanied by a list of messages \\isb{trace} such that the first configuration\n  is initial and every next state can be reached processing the messages\n  in \\isb{trace}.\n\\<close>\nlocale execution =\n  asynchronousSystem trans sends start    \nfor\n  trans :: \"'p \\<Rightarrow> 's \\<Rightarrow> 'v messageValue \\<Rightarrow> 's\" and\n  sends :: \"'p \\<Rightarrow> 's \\<Rightarrow> 'v messageValue \\<Rightarrow> ('p, 'v) message multiset\" and\n  start :: \"'p \\<Rightarrow> 's\"\n+\nfixes\n  exec :: \"('p, 'v, 's ) configuration list\" and\n  trace :: \"('p, 'v) message list\"\nassumes \n  notEmpty: \"length exec \\<ge> 1\" and \n  length: \"length exec - 1 = length trace\" and\n  base: \"initial (hd exec)\" and\n  step: \"\\<lbrakk> i < length exec - 1 ; cfg1 = exec ! i ; cfg2 = exec ! (i + 1) \\<rbrakk>\n      \\<Longrightarrow> ((cfg1 \\<turnstile> trace ! i \\<mapsto> cfg2)) \"\nbegin\n\nabbreviation execMsg ::\n  \"nat \\<Rightarrow> ('p,'v) message\"\nwhere\n  \"execMsg n \\<equiv> (trace ! n)\"\n\nabbreviation execConf ::\n  \"nat \\<Rightarrow> ('p, 'v, 's) configuration\"\nwhere\n  \"execConf n  \\<equiv> (exec ! n)\"\n\nsubsection \\<open>Enabledness and occurrence in the execution\\<close>\n\ndefinition minimalEnabled ::\n  \"('p, 'v) message \\<Rightarrow> bool\"\nwhere\n  \"minimalEnabled msg \\<equiv> (\\<exists> p . isReceiverOf p msg) \n    \\<and> (enabled (last exec) msg)\n    \\<and> (\\<exists> n . n < length exec \\<and> enabled (execConf n) msg \n      \\<and> (\\<forall> n' \\<ge> n . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n'))\n    \\<and> (\\<forall> n' msg' . ((\\<exists> p . isReceiverOf p msg') \n      \\<and> (enabled (last exec) msg') \n      \\<and> n' < length trace \n      \\<and> enabled (execConf n') msg' \n      \\<and> (\\<forall> n'' \\<ge> n' . n'' < length trace \\<longrightarrow> msg' \\<noteq> \n                      (execMsg n''))) \\<longrightarrow> n' \\<ge> n))\"\n\ndefinition firstOccurrence ::\n  \"('p, 'v) message \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere                    \n  \"firstOccurrence msg n \\<equiv> (\\<exists> p . isReceiverOf p msg) \n    \\<and> (enabled (last exec) msg) \\<and> n < (length exec)\n    \\<and> enabled (execConf n) msg \n    \\<and> (\\<forall> n' \\<ge> n . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n'))\n    \\<and> ( n \\<noteq> 0 \\<longrightarrow> (\\<not> enabled (execConf (n - 1)) msg \n      \\<or> msg = execMsg (n - 1)))\"\n\nlemma FirstOccurrenceExists:\nassumes\n  \"enabled (last exec) msg\"\n  \"\\<exists>p. isReceiverOf p msg\"\nshows\n  \"\\<exists> n . firstOccurrence msg n\"\nproof-\n  have \"length exec - 1 < length exec \n    \\<and> (\\<forall> n' \\<ge> (length exec - 1) . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg)\"\n    using length\n    by (metis diff_diff_cancel leD notEmpty zero_less_diff \n      zero_less_one)\n  hence NNotInTrace: \"\\<exists> n < length exec . \n    (\\<forall> n'\\<ge>n . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg)\" by blast\n  hence \"\\<exists> n0 < length exec . \n    (\\<forall> n'\\<ge>n0 . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg) \\<and>\n    ((n0 = 0) \n      \\<or> \\<not> (\\<forall> n' \\<ge> (n0 - 1) . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg))\" \n    using MinPredicate2[of \"\\<lambda>x.(x < length exec \n      \\<and> (\\<forall>n'\\<ge>x.(n'<length trace \\<longrightarrow> trace ! n' \\<noteq> msg)))\"]\n    by auto\n  hence \"\\<exists> n0. n0 < length exec \n    \\<and> (\\<forall> n'\\<ge>n0 . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg) \n    \\<and> ((n0 = 0) \n      \\<or> \\<not> (\\<forall> n' \\<ge> (n0 - 1) . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg))\" \n    by simp\n  from this obtain n0 where N0a: \"n0 < length exec \n    \\<and> (\\<forall> n'\\<ge>n0 . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg) \n    \\<and> ((n0 = 0) \n      \\<or> \\<not> (\\<forall> n' \\<ge> (n0 - 1) . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg))\" \n    by metis\n  hence N0: \"n0 < length exec\" \n    \"(\\<forall> n'\\<ge>n0 . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg)\"\n    \"((n0 = 0) \n      \\<or> \\<not> (\\<forall> n' \\<ge> (n0 - 1) . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg))\" \n    using N0a by auto\n  have N0': \"n0 = 0 \\<or> trace ! (n0 - 1) = msg\"\n  proof(cases \"n0 = 0\", auto)\n    assume N0NotZero: \"n0 > 0\"\n    hence \"\\<not> (\\<forall> n' \\<ge> (n0 - 1) . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg)\" \n      using N0(3) by blast\n    moreover have \"n0 - 1 < length trace\"\n      using N0(1) length N0NotZero \n      by (metis calculation le_less_trans)\n    ultimately show \"execMsg (n0 - Suc 0) = msg\" using N0(2) \n      by (metis One_nat_def Suc_diff_Suc diff_Suc_eq_diff_pred \n         diff_diff_cancel diff_is_0_eq leI nat_le_linear)\n  qed\n  have \"\\<exists> n1 < length exec . \n    (\\<forall> n'\\<ge>n1 . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg) \n    \\<and> enabled (exec ! n1) msg \n    \\<and> (n1 = 0 \\<or> \\<not> enabled (exec ! (n1 - 1)) msg \\<or> trace ! (n1 - 1) = msg)\"\n  proof(cases \"enabled (exec ! n0) msg\")\n    assume \"enabled (execConf n0) msg\"\n    hence \"n0 < length exec\" \n      \"(\\<forall> n'\\<ge>n0 . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg)\" \n      \"enabled (exec ! n0) msg \\<and>\n      (n0 = 0 \\<or> \\<not> enabled (exec ! (n0 - 1)) msg \\<or> trace ! (n0 - 1) = msg)\"\n    using N0 N0' by auto\n    thus \"\\<exists>n1<length exec.\n       (\\<forall>n'\\<ge>n1. n' < length trace \\<longrightarrow> execMsg n' \\<noteq> msg) \n       \\<and> enabled (execConf n1) msg \n       \\<and> (n1 = 0 \\<or> \\<not> enabled (execConf (n1 - 1)) msg \n         \\<or> execMsg (n1 - 1) = msg)\"\n      by metis\n  next\n    assume NotEnabled: \"\\<not> enabled (execConf n0) msg\"\n    have \"last exec = exec ! (length exec - 1)\" using last_conv_nth notEmpty \n      by (metis NNotInTrace length_0_conv less_nat_zero_code)\n    hence EnabledInLast: \"enabled (exec ! (length exec - 1)) msg\" \n      using assms(1) by simp\n    hence \"n0 \\<noteq> length exec - 1\" using NotEnabled by auto\n    hence N0Small: \"n0 < length exec - 1\" using N0(1) by simp\n    hence \"\\<exists> k < length exec - 1 - n0  . \\<not> enabled (execConf (n0 + k)) msg \n      \\<and> enabled (execConf (n0 + k + 1)) msg\"\n      using NatPredicateTippingPoint[of \"length exec - 1 - n0\" \n        \"\\<lambda>x.\\<not>(enabled (exec ! (n0 + x)) msg)\"]\n        assms(1) NotEnabled EnabledInLast by simp\n    then obtain k where K: \" k < length exec - 1 - n0\" \n      \"\\<not> enabled (execConf (n0 + k)) msg\" \n      \"enabled (execConf (n0 + k + 1)) msg\" by blast\n    define n1 where \"n1 = k + n0 + 1\"\n    hence N1: \"n1 \\<ge> n0\" \"\\<not> enabled (execConf (n1 - 1)) msg\" \n      \"enabled (execConf n1) msg\" \"n1 < length exec\"\n      unfolding n1_def using K\n      by (auto simp add: add.commute)\n    have \"\\<forall>n'\\<ge>n1. n' < length trace \\<longrightarrow> execMsg n' \\<noteq> msg\" \n      using N1(1) N0(2) by (metis order_trans)\n    thus \"\\<exists>n1<length exec.\n        (\\<forall>n'\\<ge>n1. n' < length trace \\<longrightarrow> execMsg n' \\<noteq> msg) \n        \\<and> enabled (execConf n1) msg \n        \\<and> (n1 = 0 \\<or> \\<not> enabled (execConf (n1 - 1)) msg \n          \\<or> execMsg (n1 - 1) = msg)\" \n    using N1 by auto\n  qed\n  then obtain n1 where N1: \"n1 < length exec\" \n    \"\\<forall> n'\\<ge>n1 . n' < length trace \\<longrightarrow> trace ! n' \\<noteq> msg\"\n    \"enabled (exec ! n1) msg\"\n    \"n1 = 0 \\<or> \\<not> enabled (exec ! (n1 - 1)) msg \\<or> trace ! (n1 - 1) = msg\" \n    by metis\n  hence \"firstOccurrence msg n1\" using assms unfolding firstOccurrence_def \n    by auto\n  thus \"\\<exists>n. firstOccurrence msg n\" by blast\nqed\n\nlemma ReachableInExecution:\nassumes\n  \"i < length exec\"\n  \"j \\<le> i\"\nshows\n  \"reachable (execConf j) (execConf i)\"\nusing assms proof(induct i, auto)\n  show \"reachable (execConf 0) (execConf 0)\" \n    using reachable.simps by blast\nnext\n  fix ia\n  assume \n    IH: \"(j \\<le> ia \\<Longrightarrow> reachable (execConf j) (execConf ia))\" \n    \"Suc ia < length exec\" \n    \"j \\<le> Suc ia\"  \n    \"i < length exec\" \n    \"j \\<le> i\"\n  show \"reachable (execConf j) (execConf (Suc ia))\" \n  proof(cases \"j = Suc ia\", auto)\n    show \"reachable (execConf (Suc ia)) (execConf (Suc ia))\" \n      using reachable.simps by metis\n  next\n    assume \"j \\<noteq> Suc ia\"\n    hence \"j \\<le> ia\" using IH(3) by simp\n    hence \"reachable (execConf j) (execConf ia)\" using IH(1) by simp\n    moreover have \"reachable (execConf ia) (execConf (Suc ia))\" \n      using reachable.simps\n      by (metis IH(2) Suc_eq_plus1 less_diff_conv local.step)\n    ultimately show \"reachable (execConf j) (execConf (Suc ia))\" \n      using ReachableTrans by blast\n  qed\nqed\n\nlemma LastPoint:\nfixes\n  msg::\"('p, 'v) message\"\nassumes\n  \"enabled (last exec) msg\"\nobtains n where\n  \"n < length exec\"\n  \"enabled (execConf n) msg\"\n  \"\\<forall> n' \\<ge> n .\n    n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n')\"\n  \"\\<forall> n0 . \n      n0 < length exec \n    \\<and> enabled (execConf n0) msg \n    \\<and> (\\<forall> n' \\<ge> n0 .\n        n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n'))\n    \\<longrightarrow> n0 \\<ge> n\"\nproof (cases ?thesis, simp)\n  case False\n  define len where \"len = length exec - 1\"\n  have\n    \"len < length exec\"\n    \"enabled (execConf len) msg\" \n    \"\\<forall> n' \\<ge> len . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n')\"\n    using assms notEmpty length unfolding len_def\n    by (auto, metis One_nat_def last_conv_nth list.size(3) not_one_le_zero)\n  hence \"\\<exists> n . n < length exec \\<and> enabled (execConf n) msg \n    \\<and> (\\<forall> n' \\<ge> n . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n'))\"\n    by blast\n  from MinPredicate[OF this] \n    show ?thesis using that False by blast\nqed\n\nlemma ExistImpliesMinEnabled:\nfixes \n  msg :: \"('p, 'v) message\" and\n  p :: 'p\nassumes \n  \"isReceiverOf p msg\" \n  \"enabled (last exec) msg\"\nshows\n  \"\\<exists> msg' . minimalEnabled msg'\"\nproof-\n  have MsgHasMinTime:\"\\<forall> msg . (enabled (last exec) msg \n    \\<and> (\\<exists> p . isReceiverOf p msg))\n    \\<longrightarrow> (\\<exists> n .  n < length exec \\<and> enabled (execConf n) msg \n        \\<and> (\\<forall> n' \\<ge> n . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n'))\n        \\<and> (\\<forall> n0 .  n0 < length exec \\<and> enabled (execConf n0) msg \n        \\<and> (\\<forall> n' \\<ge> n0 . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n')) \n        \\<longrightarrow> n0 \\<ge> n))\" by (clarify, rule LastPoint, auto)\n  let ?enabledTimes = \"{n::nat . \\<exists> msg . (enabled (last exec) msg \n    \\<and> (\\<exists> p . isReceiverOf p msg))\n    \\<and>  n < length exec \\<and> (enabled (execConf n) msg \n    \\<and> (\\<forall> n' \\<ge> n . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n')))}\"\n  have NotEmpty:\"?enabledTimes \\<noteq> {}\" using assms MsgHasMinTime by blast\n  hence \"\\<exists> n0 . n0 \\<in> ?enabledTimes\" by blast\n  hence \"\\<exists> nMin \\<in> ?enabledTimes . \\<forall> x \\<in> ?enabledTimes . x \\<ge> nMin\" \n    using MinPredicate[of \"\\<lambda>n.(n \\<in> ?enabledTimes)\"] by simp\n  then obtain nMin where NMin: \"nMin \\<in> ?enabledTimes\" \n    \"\\<forall> x \\<in> ?enabledTimes . x \\<ge> nMin\" by blast\n  hence \"\\<exists> msg . (enabled (last exec) msg \\<and> (\\<exists> p . isReceiverOf p msg))\n    \\<and>  nMin < length exec \\<and> (enabled (execConf nMin) msg \n    \\<and> (\\<forall> n' \\<ge> nMin . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n'))\n    \\<and> (\\<forall> n0 .  n0 < length exec \\<and> enabled (execConf n0) msg \n      \\<and> (\\<forall> n' \\<ge> n0 . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n')) \n      \\<longrightarrow> n0 \\<ge> nMin))\" by blast\n  then obtain msg where \"(enabled (last exec) msg \n    \\<and> (\\<exists> p . isReceiverOf p msg))\n    \\<and> nMin < length exec \\<and>(enabled (execConf nMin) msg \n    \\<and> (\\<forall> n' \\<ge> nMin . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n'))\n    \\<and> (\\<forall> n0 .  n0 < length exec \\<and> enabled (execConf n0) msg \n      \\<and> (\\<forall> n' \\<ge> n0 . n' < length trace \\<longrightarrow> msg \\<noteq> (execMsg n')) \n      \\<longrightarrow> n0 \\<ge> nMin))\" by blast\n  moreover have \"(\\<forall> n' msg' . ((\\<exists> p . isReceiverOf p msg') \n    \\<and> (enabled (last exec) msg') \n    \\<and> n' < length trace \\<and> enabled (execConf n') msg' \n    \\<and> (\\<forall> n'' \\<ge> n' . n'' < length trace \\<longrightarrow> msg' \\<noteq> (execMsg n''))) \n      \\<longrightarrow> n' \\<ge> nMin)\"\n  proof(clarify)\n    fix n' msg' p\n    assume Assms:\n      \"isReceiverOf p msg'\" \n      \"enabled (last exec) msg'\" \n      \"n' < length trace\" \n      \"enabled (execConf n') msg'\" \n      \"\\<forall>n'' \\<ge> n'. (n'' < length trace) \\<longrightarrow> (msg' \\<noteq> execMsg n'')\"\n    from Assms(3) have \"n' < length exec\" using length by simp\n    with Assms have \"n' \\<in> ?enabledTimes\" by auto\n    thus \"nMin \\<le> n'\" using NMin(2) by simp\n  qed\n  ultimately have \"minimalEnabled msg\"\n    using minimalEnabled_def by blast\n  thus ?thesis by blast\nqed\n\nlemma StaysEnabledStep:\nassumes\n  En: \"enabled cfg msg\" and\n  Cfg: \"cfg = exec ! n\" and\n  N: \"n < length exec\" \nshows\n  \"enabled (exec ! (n + 1)) msg \n  \\<or> n = (length exec - 1) \n  \\<or> msg = trace ! n\"\nproof(cases \"n = length exec - 1\")\n  case True\n  thus ?thesis by simp\nnext\n  case False\n  with N have N: \"n < length exec - 1\" by simp\n  with Cfg have Step:  \"cfg \\<turnstile> trace ! n \\<mapsto> (exec ! (n + 1))\" \n    using step by simp\n  thus ?thesis proof(cases \"enabled (exec ! (n + 1)) msg\")\n    case True\n    thus ?thesis by simp\n  next\n    case False\n    hence \"\\<not> enabled (exec ! (n + 1)) msg\" by simp\n    thus ?thesis using En enabled_def Step N OnlyOccurenceDisables by blast\n  qed\nqed                          \n\nlemma StaysEnabledHelp:\nassumes\n  \"enabled cfg msg\" and\n  \"cfg = exec ! n\" and\n  \"n < length exec\"    \nshows \n  \"\\<forall> i . i \\<ge> n \\<and> i < (length exec - 1) \\<and> enabled (exec ! i) msg \n  \\<longrightarrow> msg = (trace ! i) \\<or> (enabled (exec ! (i+1)) msg)\"\nproof(clarify)\n  fix i\n  assume \"n \\<le> i\" \"i < length exec - 1\"\n    \"enabled (execConf i) msg\" \"\\<not> enabled (execConf (i + 1)) msg\"\n  thus \"msg = (trace ! i)\"\n    using assms StaysEnabledStep\n    by (metis add.right_neutral add_strict_mono le_add_diff_inverse2\n        nat_neq_iff notEmpty  zero_less_one)\nqed\n\nlemma StaysEnabled:\nassumes En: \"enabled cfg msg\" and\n  \"cfg = exec ! n\" and\n  \"n < length exec\"   \nshows \"enabled (last exec) msg \\<or> (\\<exists> i . i \\<ge> n \\<and> i < (length exec - 1) \n  \\<and> msg = trace ! i )\"\nproof(cases \"enabled (last exec) msg\")\n  case True\n  thus ?thesis by simp\nnext\n  case False \n  hence NotEnabled: \"\\<not> enabled (last exec) msg\" by simp\n  have \"last exec = exec ! (length exec - 1)\" \n    by (metis last_conv_nth list.size(3) notEmpty not_one_le_zero)\n  hence \"\\<exists> l . l \\<ge> n \\<and> last exec = exec ! l \\<and> l = length exec - 1\" \n    using assms(3) by auto\n  then obtain l where L: \"l \\<ge> n\" \"last exec = exec ! l\" \n    \"l = length exec - 1\" by blast\n  have \"(\\<exists> i . i \\<ge> n \\<and> i < (length exec - 1) \\<and> msg = trace ! i )\"  \n  proof (rule ccontr)\n    assume Ass: \" \\<not> (\\<exists>i\\<ge>n. i < length exec - 1 \\<and> msg = execMsg i)\" \n    hence Not: \"\\<forall> i. i < n \\<or> i \\<ge> length exec - 1 \\<or> msg \\<noteq> execMsg i\" \n      by (metis leI)\n    have \"\\<forall> i. i \\<ge> n \\<and> i \\<le> length exec - 1 \\<longrightarrow> enabled (exec ! i) msg\" \n    proof(clarify)\n      fix i \n      assume I: \"n \\<le> i\" \"i \\<le> length exec - 1\"  \n      thus \"enabled (execConf i) msg\"\n        using StaysEnabledHelp[OF assms] assms(1,2) Ass \n        by (induct i, auto, metis Suc_le_lessD le_Suc_eq)\n    qed\n    with NotEnabled L show False by simp\n  qed\n  thus ?thesis by simp\nqed\n\nend \\<comment> \\<open>end of locale Execution\\<close>\n\nsubsection \\<open>Expanding executions to longer executions\\<close>\n\nlemma (in asynchronousSystem) expandExecutionStep:\nfixes \n  cfg :: \"('p, 'v, 's ) configuration\"\nassumes\n  CfgIsReachable: \"(last exec') \\<turnstile> msg \\<mapsto> cMsg\" and\n  ExecIsExecution: \"execution trans sends start exec' trace'\" \nshows\n  \"\\<exists> exec'' trace''. (execution trans sends start exec'' trace'') \n  \\<and> (prefixList exec' exec'') \n  \\<and> (prefixList trace' trace'') \n  \\<and> (last exec'') = cMsg \n  \\<and> (last trace'' = msg)\"\nproof -\n  define execMsg where \"execMsg = exec' @ [cMsg]\"\n  define traceMsg where \"traceMsg = trace' @ [msg]\"\n  have ExecMsgEq: \"\\<forall> i < ((length execMsg) - 1) . execMsg ! i = exec'!i \" \n    using execMsg_def by (auto simp add: nth_append)\n  have TraceMsgEq: \"\\<forall> i < ((length traceMsg) - 1) . traceMsg!i = trace'!i\" \n    using traceMsg_def \n    by (auto simp add: nth_append)\n  have ExecLen: \"(length execMsg) \\<ge> 1\" using execMsg_def by auto\n  have lessLessExec: \"\\<forall> i . i < (length exec') \\<longrightarrow> i < (length execMsg )\" \n    unfolding execMsg_def by auto\n  have ExecLenTraceLen: \"length exec'- 1 = length trace'\" \n    using ExecIsExecution execution.length by auto\n  have lessLessTrace: \"\\<forall> i . i < (length exec' - 1) \\<longrightarrow> i < (length trace')\" \n    using ExecLenTraceLen by auto\n  have Exec'Len: \"length exec' \\<ge> 1\" \n    using ExecIsExecution execution.notEmpty by blast\n  hence \"hd exec' = hd execMsg \" using execMsg_def\n    by (metis One_nat_def hd_append2 length_0_conv not_one_le_zero)\n  moreover have \"initial (hd exec')\" \n    using ExecIsExecution execution.base by blast \n  ultimately have ExecInit: \"initial (hd execMsg)\" using execMsg_def by auto\n  have ExecMsgLen: \"length execMsg - 1 = length traceMsg\" \n    using ExecLenTraceLen unfolding execMsg_def traceMsg_def\n    by (auto,metis Exec'Len Suc_pred length_greater_0_conv list.size(3) \n       not_one_le_zero) \n  have ExecSteps:\"\\<forall> i < length exec' - 1 .\n    ((exec' ! i)  \\<turnstile> trace' ! i \\<mapsto> (exec' ! (i + 1)))\" \n    using ExecIsExecution execution.step by blast\n  have \"\\<forall> i < length execMsg - 1. \n    ((execMsg ! i) \\<turnstile> traceMsg ! i \\<mapsto> (execMsg ! (i + 1)))\" \n    unfolding execMsg_def traceMsg_def\n  proof auto\n    fix i\n    assume IlessLen:\"i < (length exec')\"\n    show \"((exec' @ [cMsg]) ! i) \\<turnstile> ((trace' @ [msg]) ! i) \n      \\<mapsto> ((exec' @ [cMsg]) ! (Suc i))\" \n    proof (cases \"(i < (length exec') - 1)\")\n    case True\n      hence IlessLen1: \"(i < (length exec') - 1)\" by auto\n      hence \"((exec' ! i)  \\<turnstile> trace' ! i \\<mapsto> (exec' ! (i + 1)))\" \n        using ExecSteps by auto\n      with IlessLen1 ExecMsgEq lessLessExec execMsg_def \n      have \"((exec' @ [cMsg]) ! i) \\<turnstile> ((trace') ! i) \n        \\<mapsto> ((exec' @ [cMsg]) ! (Suc i))\" by auto\n      thus \"((exec' @ [cMsg]) ! i) \\<turnstile> ((trace' @ [msg]) ! i) \n        \\<mapsto> ((exec' @ [cMsg]) ! (Suc i))\" \n        using IlessLen1 TraceMsgEq lessLessTrace traceMsg_def by auto\n    next\n    case False\n      with IlessLen have IEqLen1: \"(i = (length exec') - 1)\" by auto\n      thus \"((exec' @ [cMsg]) ! i) \\<turnstile> ((trace' @ [msg]) ! i) \n        \\<mapsto> ((exec' @ [cMsg]) ! (Suc i))\" \n        using  execMsg_def traceMsg_def  CfgIsReachable Exec'Len \n               ExecLenTraceLen ExecMsgEq ExecMsgLen IlessLen   \n        by (metis One_nat_def Suc_eq_plus1 Suc_eq_plus1_left last_conv_nth \n           le_add_diff_inverse length_append less_nat_zero_code list.size(3) \n           list.size(4) nth_append_length)\n    qed\n  qed\n  hence isExecution: \"execution trans sends start execMsg traceMsg\" \n    using ExecLen ExecMsgLen ExecInit  \n    by (unfold_locales ,auto) \n  moreover have \"prefixList exec' execMsg\" unfolding execMsg_def \n    by (metis TailIsPrefixList not_Cons_self2)\n  moreover have \"prefixList trace' traceMsg\" unfolding traceMsg_def \n    by (metis TailIsPrefixList not_Cons_self2)\n  ultimately show ?thesis using execMsg_def traceMsg_def by (metis last_snoc)\nqed\n\nlemma (in asynchronousSystem) expandExecutionReachable:\nfixes \n  cfg :: \"('p, 'v, 's ) configuration\" and\n  cfgLast :: \"('p, 'v, 's ) configuration\"\nassumes\n  CfgIsReachable: \"reachable (cfgLast) cfg\" and\n  ExecIsExecution: \"execution trans sends start exec trace\"  and\n  ExecLast: \"cfgLast = last exec\" \nshows\n  \"\\<exists> exec' trace'. (execution trans sends start exec' trace') \n  \\<and> ((prefixList exec exec' \n    \\<and> prefixList trace trace') \n    \\<or> (exec = exec' \\<and> trace = trace')) \n  \\<and> (last exec') = cfg\"\nusing CfgIsReachable  ExecIsExecution ExecLast \nproof (induct cfgLast cfg rule: reachable.induct, auto)\n  fix msg cfg3 exec' trace'\n  assume \"(last exec') \\<turnstile> msg \\<mapsto> cfg3\"\n         \"execution trans sends start exec' trace'\"\n  hence \"\\<exists> exec'' trace''. (execution trans sends start exec'' trace'') \n    \\<and> (prefixList exec' exec'') \n    \\<and> (prefixList trace' trace'') \\<and> (last exec'') = cfg3 \n    \\<and> (last trace'') = msg\" by (simp add: expandExecutionStep)\n  then obtain  exec'' trace'' where \n    NewExec: \"execution trans sends start exec'' trace''\" \n             \"prefixList exec' exec''\" \"prefixList trace' trace''\" \n             \"last exec'' = cfg3\" by blast\n  assume prefixLists: \"prefixList exec exec'\" \n                      \"prefixList trace trace'\" \n  from prefixLists(1) NewExec(2) have \"prefixList exec exec''\" \n    using PrefixListTransitive by auto\n  moreover from prefixLists(2) NewExec(3) have \n    \"prefixList trace trace''\"  using PrefixListTransitive by auto\n  ultimately show \"\\<exists> exec'' trace'' .\n          execution trans sends start exec'' trace'' \\<and>\n          ((prefixList exec exec'' \\<and> prefixList trace trace'') \n          \\<or> (exec = exec'' \\<and> trace = trace'')) \\<and>\n          last exec'' = cfg3\" using NewExec(1) NewExec(4) by blast\nnext\n  fix msg cfg3\n  assume \"(last exec) \\<turnstile> msg \\<mapsto> cfg3\" \"execution trans sends start exec trace\"\n  then show\n    \"\\<exists>exec' trace'. execution trans sends start exec' trace' \\<and>\n       (prefixList exec exec' \\<and> prefixList trace trace' \n        \\<or> exec = exec' \\<and> trace = trace') \\<and> last exec' = cfg3\" \n    using expandExecutionStep by blast\nqed\n\nlemma (in asynchronousSystem) expandExecution:\nfixes \n  cfg :: \"('p, 'v, 's ) configuration\" and\n  cfgLast :: \"('p, 'v, 's ) configuration\"\nassumes\n  CfgIsReachable: \"stepReachable (last exec) msg cfg\" and\n  ExecIsExecution: \"execution trans sends start exec trace\"\nshows\n  \"\\<exists> exec' trace'. (execution trans sends start exec' trace') \n  \\<and> (prefixList exec exec') \n  \\<and> (prefixList trace trace') \\<and> (last exec') = cfg \n  \\<and> (msg \\<in> set (drop (length trace) trace'))\"  \nproof -\n  from CfgIsReachable obtain c' c'' where \n    Step: \"reachable (last exec) c'\" \"c' \\<turnstile> msg \\<mapsto> c''\" \"reachable c'' cfg\" \n    by (auto simp add: stepReachable_def)\n  from Step(1) ExecIsExecution have \"\\<exists> exec' trace' .\n    execution trans sends start exec' trace' \\<and>\n    ((prefixList exec exec' \\<and> prefixList trace trace') \n    \\<or> (exec = exec' \\<and> trace = trace')) \\<and>\n    last exec' = c'\" by (auto simp add: expandExecutionReachable)\n  then obtain  exec' trace' where Exec': \n    \"execution trans sends start exec' trace'\"\n    \"(prefixList exec exec' \\<and> prefixList trace trace') \n      \\<or> (exec = exec' \\<and> trace = trace')\"\n    \"last exec' = c'\" by blast\n  from Exec'(1) Exec'(3) Step(2) have \"\\<exists> exec'' trace'' . \n    execution trans sends start exec'' trace'' \\<and>\n    prefixList exec' exec'' \\<and> prefixList trace' trace'' \n    \\<and> last exec'' = c'' \\<and> last trace'' = msg\" \n    by (auto simp add: expandExecutionStep)\n  then obtain exec'' trace'' where Exec'': \n    \"execution trans sends start exec'' trace''\"\n    \"prefixList exec' exec''\" \"prefixList trace' trace''\" \n    \"last exec'' = c''\" \"last trace'' = msg\" by blast\n  have PrefixLists: \"prefixList exec exec'' \\<and> prefixList trace trace''\"  \n  proof(cases \"exec = exec' \\<and> trace = trace'\")\n  case True\n    with Exec'' show \"prefixList exec exec'' \\<and> prefixList trace trace''\" \n    by auto\n  next\n  case False\n    with Exec'(2) have Prefix: \"prefixList exec exec'\" \n      \"prefixList trace trace'\" by auto\n    from Prefix(1) Exec''(2) have \"prefixList exec exec''\" \n      using PrefixListTransitive by auto\n    with Prefix(2) Exec''(3) show  \"prefixList exec exec'' \n      \\<and> prefixList trace trace''\" \n      using PrefixListTransitive by auto\n  qed\n  with Exec''(5) have MsgInTrace'': \"msg \\<in> set (drop (length trace) trace'')\" \n    by (metis PrefixListMonotonicity drop_eq_Nil last_drop \n      last_in_set not_le)\n  from Step(3) Exec''(1) Exec''(4) have \"\\<exists> exec''' trace''' .\n    execution trans sends start exec''' trace''' \\<and>\n    ((prefixList exec'' exec''' \\<and> prefixList trace'' trace''') \n    \\<or> (exec'' = exec''' \\<and> trace'' = trace''')) \\<and>\n    last exec''' = cfg\" \n    by (auto simp add: expandExecutionReachable)\n  then obtain exec''' trace''' where Exec''': \n    \"execution trans sends start exec''' trace'''\"\n    \"(prefixList exec'' exec''' \\<and> prefixList trace'' trace''') \n    \\<or> (exec'' = exec''' \\<and> trace'' = trace''')\"\n    \"last exec''' = cfg\" by blast\n  have \"prefixList exec exec''' \\<and> prefixList trace trace''' \n    \\<and> msg \\<in> set (drop (length trace) trace''')\"  \n  proof(cases \"exec'' = exec''' \\<and> trace'' = trace'''\")\n  case True\n    with PrefixLists MsgInTrace'' \n    show \"prefixList exec exec''' \\<and> prefixList trace trace''' \n    \\<and> msg \\<in> set (drop (length trace) trace''')\" by auto\n  next\n  case False\n    with Exec'''(2) have Prefix: \"prefixList exec'' exec'''\" \n      \"prefixList trace'' trace'''\" by auto\n    from Prefix(1) PrefixLists have \"prefixList exec exec'''\" \n      using PrefixListTransitive by auto\n    with Prefix(2) PrefixLists have \"prefixList exec exec''' \n      \\<and> prefixList trace trace'''\"  \n      using PrefixListTransitive by auto\n    moreover have \"msg \\<in> set (drop (length trace) trace''')\" \n      using Prefix(2) PrefixLists MsgInTrace'' \n      by (metis (hide_lams, no_types) PrefixListHasTail append_eq_conv_conj \n         drop_take rev_subsetD set_take_subset)\n    ultimately show ?thesis by auto\n  qed\n  with Exec'''(1) Exec'''(3) show ?thesis by blast\nqed\n\nsubsection \\<open>Infinite and fair executions\\<close>\n\ntext \\<open>\n  Völzer does not give much attention to the definition of the\n  infinite executions. We derive them from finite executions by considering\n  infinite executions to be infinite sequence of finite executions increasing\n  monotonically w.r.t. the list prefix relation.\n\\<close>\n\ndefinition (in asynchronousSystem) infiniteExecution ::\n  \"(nat \\<Rightarrow> (('p, 'v, 's) configuration list)) \n  \\<Rightarrow> (nat \\<Rightarrow> (('p, 'v) message list)) \\<Rightarrow> bool\"\nwhere\n  \"infiniteExecution fe ft \\<equiv>\n    \\<forall> n . execution trans sends start (fe n) (ft n) \\<and> \n      prefixList (fe n) (fe (n+1)) \\<and>\n      prefixList (ft n) (ft (n+1))\"\n\ndefinition (in asynchronousSystem) correctInfinite ::\n  \"(nat \\<Rightarrow> (('p, 'v, 's) configuration list)) \n  \\<Rightarrow> (nat \\<Rightarrow> (('p, 'v) message list)) \\<Rightarrow> 'p \\<Rightarrow> bool\"\nwhere \n  \"correctInfinite fe ft p \\<equiv> \n    infiniteExecution fe ft\n    \\<and> (\\<forall> n . \\<forall> n0 < length (fe n). \\<forall> msg .(enabled ((fe n) ! n0) msg) \n    \\<and> isReceiverOf p msg \n    \\<longrightarrow> (\\<exists> msg' . \\<exists> n' \\<ge> n . \\<exists> n0' \\<ge> n0 .isReceiverOf p msg' \n    \\<and> n0' < length (fe n') \\<and> (msg' = ((ft n') ! n0'))))\"\n\ndefinition (in asynchronousSystem) fairInfiniteExecution ::\n  \"(nat \\<Rightarrow> (('p, 'v, 's) configuration list)) \n  \\<Rightarrow> (nat \\<Rightarrow> (('p, 'v) message list)) \\<Rightarrow> bool\"\nwhere\n  \"fairInfiniteExecution fe ft \\<equiv>\n    infiniteExecution fe ft\n    \\<and> (\\<forall> n . \\<forall> n0 < length (fe n). \\<forall> p . \\<forall> msg . \n      ((enabled ((fe n) ! n0) msg) \n        \\<and> isReceiverOf p msg \\<and> correctInfinite fe ft p ) \n      \\<longrightarrow> (\\<exists> n' \\<ge> n . \\<exists> n0' \\<ge> n0 . n0' < length (ft n') \n        \\<and> (msg = ((ft n') ! n0'))))\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/FLP/Execution.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300573952054, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.34852082649161226}}
{"text": "(*\nTitle: WHATandWHERE-Security\nAuthors: Sylvia Grewe, Alexander Lux, Heiko Mantel, Jens Sauer\n*)\ntheory Type_System\nimports Language_Composition\nbegin\n\nlocale Type_System =\n  WWP?: WHATWHERE_Secure_Programs \"E\" \"BMap\" \"DA\" \"lH\"\n  for E :: \"('exp, 'id, 'val) Evalfunction\"\n  and BMap :: \"'val \\<Rightarrow> bool\"\n  and DA :: \"('id, 'd::order) DomainAssignment\"\n  and lH :: \"('d, 'exp) lHatches\"\n+ \nfixes\nAssignSideCondition :: \"'id \\<Rightarrow> 'exp \\<Rightarrow> nat \\<Rightarrow> bool\"\nand WhileSideCondition :: \"'exp \\<Rightarrow> bool\"\nand IfSideCondition :: \n  \"'exp \\<Rightarrow> ('exp,'id) MWLsCom \\<Rightarrow> ('exp,'id) MWLsCom \\<Rightarrow> bool\" \nassumes semAssignSC: \"AssignSideCondition x e \\<iota> \\<Longrightarrow> \n  e \\<equiv>\\<^bsub>DA x,(htchLoc \\<iota>)\\<^esub> e \\<and> (\\<forall>m m' d \\<iota>'. (m \\<sim>\\<^bsub>d,(htchLoc \\<iota>')\\<^esub> m' \\<and> \n  \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m) =\\<^bsub>d\\<^esub> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m'))\n  \\<longrightarrow> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m) \\<sim>\\<^bsub>d,(htchLoc \\<iota>')\\<^esub> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m'))\" \nand semWhileSC: \"WhileSideCondition e \\<Longrightarrow> \\<forall>d. e \\<equiv>\\<^bsub>d\\<^esub> e\"\nand semIfSC: \"IfSideCondition e c1 c2 \\<Longrightarrow> \\<forall>d. e \\<equiv>\\<^bsub>d\\<^esub> e\"\nbegin\n\n\\<comment> \\<open>Security typing rules for the language commands\\<close>\ninductive\nComSecTyping :: \"('exp, 'id) MWLsCom \\<Rightarrow> bool\"\n  (\"\\<turnstile>\\<^bsub>\\<C>\\<^esub> _\")\nand ComSecTypingL :: \"('exp,'id) MWLsCom list \\<Rightarrow> bool\"\n   (\"\\<turnstile>\\<^bsub>\\<V>\\<^esub> _\")\nwhere\nSkip: \"\\<turnstile>\\<^bsub>\\<C>\\<^esub> skip\\<^bsub>\\<iota>\\<^esub>\" |\nAssign: \"\\<lbrakk> AssignSideCondition x e \\<iota> \\<rbrakk> \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<C>\\<^esub> x :=\\<^bsub>\\<iota>\\<^esub> e\" |\nSpawn: \"\\<lbrakk> \\<turnstile>\\<^bsub>\\<V>\\<^esub> V \\<rbrakk> \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<C>\\<^esub> spawn\\<^bsub>\\<iota>\\<^esub> V\" |\nSeq: \"\\<lbrakk> \\<turnstile>\\<^bsub>\\<C>\\<^esub> c1; \\<turnstile>\\<^bsub>\\<C>\\<^esub> c2 \\<rbrakk> \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<C>\\<^esub> c1;c2\" |\nWhile: \"\\<lbrakk> \\<turnstile>\\<^bsub>\\<C>\\<^esub> c; WhileSideCondition b \\<rbrakk> \n     \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<C>\\<^esub> while\\<^bsub>\\<iota>\\<^esub> b do c od\" |\nIf: \"\\<lbrakk> \\<turnstile>\\<^bsub>\\<C>\\<^esub> c1; \\<turnstile>\\<^bsub>\\<C>\\<^esub> c2; IfSideCondition b c1 c2 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<C>\\<^esub> if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi\" |\nParallel: \"\\<lbrakk> \\<forall>i < length V. \\<turnstile>\\<^bsub>\\<C>\\<^esub> V!i \\<rbrakk> \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<V>\\<^esub> V\"\n\ninductive_cases parallel_cases:\n\"\\<turnstile>\\<^bsub>\\<V>\\<^esub> V\"\n\ndefinition auxiliary_predicate\nwhere\n\"auxiliary_predicate V \\<equiv> unique_PPV V \\<longrightarrow> WHATWHERE_Secure V\" \n\n\\<comment> \\<open>soundness proof of abstract type system\\<close>\ntheorem ComSecTyping_single_is_sound:\n\"\\<lbrakk> \\<turnstile>\\<^bsub>\\<C>\\<^esub> c; unique_PPc c \\<rbrakk>\n  \\<Longrightarrow> WHATWHERE_Secure [c]\"\nproof (induct rule: ComSecTyping_ComSecTypingL.inducts(1)\n    [of _ _ \"auxiliary_predicate\"], simp_all add: auxiliary_predicate_def)\n  fix \\<iota>\n  show \"WHATWHERE_Secure [skip\\<^bsub>\\<iota>\\<^esub>]\"\n    by (metis WHATWHERE_Secure_Skip)\nnext\n  fix x e \\<iota>\n  assume \"AssignSideCondition x e \\<iota>\"\n  thus \"WHATWHERE_Secure [x :=\\<^bsub>\\<iota>\\<^esub> e]\"\n    by (metis WHATWHERE_Secure_Assign semAssignSC)\nnext\n  fix V \\<iota>\n  assume IH: \"unique_PPV V \\<longrightarrow> WHATWHERE_Secure V\"\n  assume uniPPspawn: \"unique_PPc (spawn\\<^bsub>\\<iota>\\<^esub> V)\"\n  hence \"unique_PPV V\"\n    by (simp add: unique_PPV_def unique_PPc_def)\n  with IH have \"WHATWHERE_Secure V\"\n    ..\n  with uniPPspawn show \"WHATWHERE_Secure [spawn\\<^bsub>\\<iota>\\<^esub> V]\"\n    by (metis Compositionality_Spawn)\nnext\n  fix c1 c2\n  assume IH1: \"unique_PPc c1 \\<Longrightarrow> WHATWHERE_Secure [c1]\"\n  assume IH2: \"unique_PPc c2 \\<Longrightarrow> WHATWHERE_Secure [c2]\"\n  assume uniPPc1c2: \"unique_PPc (c1;c2)\"\n  from uniPPc1c2 have uniPPc1: \"unique_PPc c1\"\n    by (simp add: unique_PPc_def)\n  with IH1 have IS1: \"WHATWHERE_Secure [c1]\"\n    .\n  from uniPPc1c2 have uniPPc2: \"unique_PPc c2\"\n    by (simp add: unique_PPc_def)\n  with IH2 have IS2: \"WHATWHERE_Secure [c2]\"\n    .\n\n  from IS1 IS2 uniPPc1c2 show \"WHATWHERE_Secure [c1;c2]\"\n    by (metis Compositionality_Seq)\nnext\n  fix c b \\<iota>\n  assume SC: \"WhileSideCondition b\"\n  assume IH: \"unique_PPc c \\<Longrightarrow> WHATWHERE_Secure [c]\"\n  assume uniPPwhile: \"unique_PPc (while\\<^bsub>\\<iota>\\<^esub> b do c od)\"\n  hence \"unique_PPc c\"\n    by (simp add: unique_PPc_def)\n  with IH have \"WHATWHERE_Secure [c]\"\n    .\n  with uniPPwhile SC show \"WHATWHERE_Secure [while\\<^bsub>\\<iota>\\<^esub> b do c od]\"\n    by (metis Compositionality_While semWhileSC)\nnext\n  fix c1 c2 b \\<iota>\n  assume SC: \"IfSideCondition b c1 c2\"  \n  assume IH1: \"unique_PPc c1 \\<Longrightarrow> WHATWHERE_Secure [c1]\"\n  assume IH2: \"unique_PPc c2 \\<Longrightarrow> WHATWHERE_Secure [c2]\"\n  assume uniPPif: \"unique_PPc (if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi)\"\n  from uniPPif have \"unique_PPc c1\"\n    by (simp add: unique_PPc_def)\n  with IH1 have IS1: \"WHATWHERE_Secure [c1]\"\n    .\n  from uniPPif have \"unique_PPc c2\"\n    by (simp add: unique_PPc_def)\n  with IH2 have IS2: \"WHATWHERE_Secure [c2]\"\n    .\n  from IS1 IS2 SC uniPPif show \n    \"WHATWHERE_Secure [if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi]\"\n    by (metis Compositionality_If semIfSC)\nnext\n  fix V\n  assume IH: \"\\<forall>i < length V. \\<turnstile>\\<^bsub>\\<C>\\<^esub> V ! i \\<and>\n    (unique_PPc (V!i) \\<longrightarrow> WHATWHERE_Secure [V!i])\"\n  have \"unique_PPV V \\<longrightarrow> (\\<forall>i < length V. unique_PPc (V!i))\"\n    by (metis uniPPV_uniPPc)\n  with IH have \"unique_PPV V \\<longrightarrow> (\\<forall>i < length V. WHATWHERE_Secure [V!i])\" \n    by auto\n  thus uniPPV: \"unique_PPV V \\<longrightarrow> WHATWHERE_Secure V\"\n    by (metis parallel_composition)\nqed\n\n\ntheorem ComSecTyping_list_is_sound:\n\"\\<lbrakk> \\<turnstile>\\<^bsub>\\<V>\\<^esub> V; unique_PPV V \\<rbrakk> \\<Longrightarrow> WHATWHERE_Secure V\"\nby (metis ComSecTyping_single_is_sound parallel_cases \n  parallel_composition uniPPV_uniPPc)\n  \nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/WHATandWHERE_Security/Type_System.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300449389326, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3485208203121322}}
{"text": "(*  Title:      HOL/BNF_Least_Fixpoint.thy\n    Author:     Dmitriy Traytel, TU Muenchen\n    Author:     Lorenz Panny, TU Muenchen\n    Author:     Jasmin Blanchette, TU Muenchen\n    Copyright   2012, 2013, 2014\n\nLeast fixpoint (datatype) operation on bounded natural functors.\n*)\n\nsection {* Least Fixpoint (Datatype) Operation on Bounded Natural Functors *}\n\ntheory BNF_Least_Fixpoint\nimports BNF_Fixpoint_Base\nkeywords\n  \"datatype\" :: thy_decl and\n  \"datatype_compat\" :: thy_decl\nbegin\n\nlemma subset_emptyI: \"(\\<And>x. x \\<in> A \\<Longrightarrow> False) \\<Longrightarrow> A \\<subseteq> {}\"\n  by blast\n\nlemma image_Collect_subsetI: \"(\\<And>x. P x \\<Longrightarrow> f x \\<in> B) \\<Longrightarrow> f ` {x. P x} \\<subseteq> B\"\n  by blast\n\nlemma Collect_restrict: \"{x. x \\<in> X \\<and> P x} \\<subseteq> X\"\n  by auto\n\nlemma prop_restrict: \"\\<lbrakk>x \\<in> Z; Z \\<subseteq> {x. x \\<in> X \\<and> P x}\\<rbrakk> \\<Longrightarrow> P x\"\n  by auto\n\nlemma underS_I: \"\\<lbrakk>i \\<noteq> j; (i, j) \\<in> R\\<rbrakk> \\<Longrightarrow> i \\<in> underS R j\"\n  unfolding underS_def by simp\n\nlemma underS_E: \"i \\<in> underS R j \\<Longrightarrow> i \\<noteq> j \\<and> (i, j) \\<in> R\"\n  unfolding underS_def by simp\n\nlemma underS_Field: \"i \\<in> underS R j \\<Longrightarrow> i \\<in> Field R\"\n  unfolding underS_def Field_def by auto\n\nlemma FieldI2: \"(i, j) \\<in> R \\<Longrightarrow> j \\<in> Field R\"\n  unfolding Field_def by auto\n\nlemma fst_convol': \"fst (\\<langle>f, g\\<rangle> x) = f x\"\n  using fst_convol unfolding convol_def by simp\n\nlemma snd_convol': \"snd (\\<langle>f, g\\<rangle> x) = g x\"\n  using snd_convol unfolding convol_def by simp\n\nlemma convol_expand_snd: \"fst o f = g \\<Longrightarrow> \\<langle>g, snd o f\\<rangle> = f\"\n  unfolding convol_def by auto\n\nlemma convol_expand_snd':\n  assumes \"(fst o f = g)\"\n  shows \"h = snd o f \\<longleftrightarrow> \\<langle>g, h\\<rangle> = f\"\nproof -\n  from assms have *: \"\\<langle>g, snd o f\\<rangle> = f\" by (rule convol_expand_snd)\n  then have \"h = snd o f \\<longleftrightarrow> h = snd o \\<langle>g, snd o f\\<rangle>\" by simp\n  moreover have \"\\<dots> \\<longleftrightarrow> h = snd o f\" by (simp add: snd_convol)\n  moreover have \"\\<dots> \\<longleftrightarrow> \\<langle>g, h\\<rangle> = f\" by (subst (2) *[symmetric]) (auto simp: convol_def fun_eq_iff)\n  ultimately show ?thesis by simp\nqed\n\nlemma bij_betwE: \"bij_betw f A B \\<Longrightarrow> \\<forall>a\\<in>A. f a \\<in> B\"\n  unfolding bij_betw_def by auto\n\nlemma bij_betw_imageE: \"bij_betw f A B \\<Longrightarrow> f ` A = B\"\n  unfolding bij_betw_def by auto\n\nlemma f_the_inv_into_f_bij_betw:\n  \"bij_betw f A B \\<Longrightarrow> (bij_betw f A B \\<Longrightarrow> x \\<in> B) \\<Longrightarrow> f (the_inv_into A f x) = x\"\n  unfolding bij_betw_def by (blast intro: f_the_inv_into_f)\n\nlemma ex_bij_betw: \"|A| \\<le>o (r :: 'b rel) \\<Longrightarrow> \\<exists>f B :: 'b set. bij_betw f B A\"\n  by (subst (asm) internalize_card_of_ordLeq) (auto dest!: iffD2[OF card_of_ordIso ordIso_symmetric])\n\nlemma bij_betwI':\n  \"\\<lbrakk>\\<And>x y. \\<lbrakk>x \\<in> X; y \\<in> X\\<rbrakk> \\<Longrightarrow> (f x = f y) = (x = y);\n    \\<And>x. x \\<in> X \\<Longrightarrow> f x \\<in> Y;\n    \\<And>y. y \\<in> Y \\<Longrightarrow> \\<exists>x \\<in> X. y = f x\\<rbrakk> \\<Longrightarrow> bij_betw f X Y\"\n  unfolding bij_betw_def inj_on_def by blast\n\nlemma surj_fun_eq:\n  assumes surj_on: \"f ` X = UNIV\" and eq_on: \"\\<forall>x \\<in> X. (g1 o f) x = (g2 o f) x\"\n  shows \"g1 = g2\"\nproof (rule ext)\n  fix y\n  from surj_on obtain x where \"x \\<in> X\" and \"y = f x\" by blast\n  thus \"g1 y = g2 y\" using eq_on by simp\nqed\n\nlemma Card_order_wo_rel: \"Card_order r \\<Longrightarrow> wo_rel r\"\n  unfolding wo_rel_def card_order_on_def by blast\n\nlemma Cinfinite_limit: \"\\<lbrakk>x \\<in> Field r; Cinfinite r\\<rbrakk> \\<Longrightarrow> \\<exists>y \\<in> Field r. x \\<noteq> y \\<and> (x, y) \\<in> r\"\n  unfolding cinfinite_def by (auto simp add: infinite_Card_order_limit)\n\nlemma Card_order_trans:\n  \"\\<lbrakk>Card_order r; x \\<noteq> y; (x, y) \\<in> r; y \\<noteq> z; (y, z) \\<in> r\\<rbrakk> \\<Longrightarrow> x \\<noteq> z \\<and> (x, z) \\<in> r\"\n  unfolding card_order_on_def well_order_on_def linear_order_on_def\n    partial_order_on_def preorder_on_def trans_def antisym_def by blast\n\nlemma Cinfinite_limit2:\n  assumes x1: \"x1 \\<in> Field r\" and x2: \"x2 \\<in> Field r\" and r: \"Cinfinite r\"\n  shows \"\\<exists>y \\<in> Field r. (x1 \\<noteq> y \\<and> (x1, y) \\<in> r) \\<and> (x2 \\<noteq> y \\<and> (x2, y) \\<in> r)\"\nproof -\n  from r have trans: \"trans r\" and total: \"Total r\" and antisym: \"antisym r\"\n    unfolding card_order_on_def well_order_on_def linear_order_on_def\n      partial_order_on_def preorder_on_def by auto\n  obtain y1 where y1: \"y1 \\<in> Field r\" \"x1 \\<noteq> y1\" \"(x1, y1) \\<in> r\"\n    using Cinfinite_limit[OF x1 r] by blast\n  obtain y2 where y2: \"y2 \\<in> Field r\" \"x2 \\<noteq> y2\" \"(x2, y2) \\<in> r\"\n    using Cinfinite_limit[OF x2 r] by blast\n  show ?thesis\n  proof (cases \"y1 = y2\")\n    case True with y1 y2 show ?thesis by blast\n  next\n    case False\n    with y1(1) y2(1) total have \"(y1, y2) \\<in> r \\<or> (y2, y1) \\<in> r\"\n      unfolding total_on_def by auto\n    thus ?thesis\n    proof\n      assume *: \"(y1, y2) \\<in> r\"\n      with trans y1(3) have \"(x1, y2) \\<in> r\" unfolding trans_def by blast\n      with False y1 y2 * antisym show ?thesis by (cases \"x1 = y2\") (auto simp: antisym_def)\n    next\n      assume *: \"(y2, y1) \\<in> r\"\n      with trans y2(3) have \"(x2, y1) \\<in> r\" unfolding trans_def by blast\n      with False y1 y2 * antisym show ?thesis by (cases \"x2 = y1\") (auto simp: antisym_def)\n    qed\n  qed\nqed\n\nlemma Cinfinite_limit_finite:\n  \"\\<lbrakk>finite X; X \\<subseteq> Field r; Cinfinite r\\<rbrakk> \\<Longrightarrow> \\<exists>y \\<in> Field r. \\<forall>x \\<in> X. (x \\<noteq> y \\<and> (x, y) \\<in> r)\"\nproof (induct X rule: finite_induct)\n  case empty thus ?case unfolding cinfinite_def using ex_in_conv[of \"Field r\"] finite.emptyI by auto\nnext\n  case (insert x X)\n  then obtain y where y: \"y \\<in> Field r\" \"\\<forall>x \\<in> X. (x \\<noteq> y \\<and> (x, y) \\<in> r)\" by blast\n  then obtain z where z: \"z \\<in> Field r\" \"x \\<noteq> z \\<and> (x, z) \\<in> r\" \"y \\<noteq> z \\<and> (y, z) \\<in> r\"\n    using Cinfinite_limit2[OF _ y(1) insert(5), of x] insert(4) by blast\n  show ?case\n    apply (intro bexI ballI)\n    apply (erule insertE)\n    apply hypsubst\n    apply (rule z(2))\n    using Card_order_trans[OF insert(5)[THEN conjunct2]] y(2) z(3)\n    apply blast\n    apply (rule z(1))\n    done\nqed\n\nlemma insert_subsetI: \"\\<lbrakk>x \\<in> A; X \\<subseteq> A\\<rbrakk> \\<Longrightarrow> insert x X \\<subseteq> A\"\n  by auto\n\nlemmas well_order_induct_imp = wo_rel.well_order_induct[of r \"\\<lambda>x. x \\<in> Field r \\<longrightarrow> P x\" for r P]\n\nlemma meta_spec2:\n  assumes \"(\\<And>x y. PROP P x y)\"\n  shows \"PROP P x y\"\n  by (rule assms)\n\nlemma nchotomy_relcomppE:\n  assumes \"\\<And>y. \\<exists>x. y = f x\" \"(r OO s) a c\" \"\\<And>b. r a (f b) \\<Longrightarrow> s (f b) c \\<Longrightarrow> P\"\n  shows P\nproof (rule relcompp.cases[OF assms(2)], hypsubst)\n  fix b assume \"r a b\" \"s b c\"\n  moreover from assms(1) obtain b' where \"b = f b'\" by blast\n  ultimately show P by (blast intro: assms(3))\nqed\n\nlemma predicate2D_vimage2p: \"\\<lbrakk>R \\<le> vimage2p f g S; R x y\\<rbrakk> \\<Longrightarrow> S (f x) (g y)\"\n  unfolding vimage2p_def by auto\n\nlemma id_transfer: \"rel_fun A A id id\"\n  unfolding rel_fun_def by simp\n\nlemma fst_transfer: \"rel_fun (rel_prod A B) A fst fst\"\n  unfolding rel_fun_def by simp\n\nlemma snd_transfer: \"rel_fun (rel_prod A B) B snd snd\"\n  unfolding rel_fun_def by simp\n\nlemma convol_transfer:\n  \"rel_fun (rel_fun R S) (rel_fun (rel_fun R T) (rel_fun R (rel_prod S T))) BNF_Def.convol BNF_Def.convol\"\n  unfolding rel_fun_def convol_def by auto\n\nlemma ssubst_Pair_rhs: \"\\<lbrakk>(r, s) \\<in> R; s' = s\\<rbrakk> \\<Longrightarrow> (r, s') \\<in> R\"\n  by (rule ssubst)\n\nlemma all_mem_range1:\n  \"(\\<And>y. y \\<in> range f \\<Longrightarrow> P y) \\<equiv> (\\<And>x. P (f x)) \"\n  by (rule equal_intr_rule) fast+\n\nlemma all_mem_range2:\n  \"(\\<And>fa y. fa \\<in> range f \\<Longrightarrow> y \\<in> range fa \\<Longrightarrow> P y) \\<equiv> (\\<And>x xa. P (f x xa))\"\n  by (rule equal_intr_rule) fast+\n\nlemma all_mem_range3:\n  \"(\\<And>fa fb y. fa \\<in> range f \\<Longrightarrow> fb \\<in> range fa \\<Longrightarrow> y \\<in> range fb \\<Longrightarrow> P y) \\<equiv> (\\<And>x xa xb. P (f x xa xb))\"\n  by (rule equal_intr_rule) fast+\n\nlemma all_mem_range4:\n  \"(\\<And>fa fb fc y. fa \\<in> range f \\<Longrightarrow> fb \\<in> range fa \\<Longrightarrow> fc \\<in> range fb \\<Longrightarrow> y \\<in> range fc \\<Longrightarrow> P y) \\<equiv>\n   (\\<And>x xa xb xc. P (f x xa xb xc))\"\n  by (rule equal_intr_rule) fast+\n\nlemma all_mem_range5:\n  \"(\\<And>fa fb fc fd y. fa \\<in> range f \\<Longrightarrow> fb \\<in> range fa \\<Longrightarrow> fc \\<in> range fb \\<Longrightarrow> fd \\<in> range fc \\<Longrightarrow>\n     y \\<in> range fd \\<Longrightarrow> P y) \\<equiv>\n   (\\<And>x xa xb xc xd. P (f x xa xb xc xd))\"\n  by (rule equal_intr_rule) fast+\n\nlemma all_mem_range6:\n  \"(\\<And>fa fb fc fd fe ff y. fa \\<in> range f \\<Longrightarrow> fb \\<in> range fa \\<Longrightarrow> fc \\<in> range fb \\<Longrightarrow> fd \\<in> range fc \\<Longrightarrow>\n     fe \\<in> range fd \\<Longrightarrow> ff \\<in> range fe \\<Longrightarrow> y \\<in> range ff \\<Longrightarrow> P y) \\<equiv>\n   (\\<And>x xa xb xc xd xe xf. P (f x xa xb xc xd xe xf))\"\n  by (rule equal_intr_rule) (fastforce, fast)\n\nlemma all_mem_range7:\n  \"(\\<And>fa fb fc fd fe ff fg y. fa \\<in> range f \\<Longrightarrow> fb \\<in> range fa \\<Longrightarrow> fc \\<in> range fb \\<Longrightarrow> fd \\<in> range fc \\<Longrightarrow>\n     fe \\<in> range fd \\<Longrightarrow> ff \\<in> range fe \\<Longrightarrow> fg \\<in> range ff \\<Longrightarrow> y \\<in> range fg \\<Longrightarrow> P y) \\<equiv>\n   (\\<And>x xa xb xc xd xe xf xg. P (f x xa xb xc xd xe xf xg))\"\n  by (rule equal_intr_rule) (fastforce, fast)\n\nlemma all_mem_range8:\n  \"(\\<And>fa fb fc fd fe ff fg fh y. fa \\<in> range f \\<Longrightarrow> fb \\<in> range fa \\<Longrightarrow> fc \\<in> range fb \\<Longrightarrow> fd \\<in> range fc \\<Longrightarrow>\n     fe \\<in> range fd \\<Longrightarrow> ff \\<in> range fe \\<Longrightarrow> fg \\<in> range ff \\<Longrightarrow> fh \\<in> range fg \\<Longrightarrow> y \\<in> range fh \\<Longrightarrow> P y) \\<equiv>\n   (\\<And>x xa xb xc xd xe xf xg xh. P (f x xa xb xc xd xe xf xg xh))\"\n  by (rule equal_intr_rule) (fastforce, fast)\n\nlemmas all_mem_range = all_mem_range1 all_mem_range2 all_mem_range3 all_mem_range4 all_mem_range5\n  all_mem_range6 all_mem_range7 all_mem_range8\n\nML_file \"Tools/BNF/bnf_lfp_util.ML\"\nML_file \"Tools/BNF/bnf_lfp_tactics.ML\"\nML_file \"Tools/BNF/bnf_lfp.ML\"\nML_file \"Tools/BNF/bnf_lfp_compat.ML\"\nML_file \"Tools/BNF/bnf_lfp_rec_sugar_more.ML\"\nML_file \"Tools/BNF/bnf_lfp_size.ML\"\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/BNF_Least_Fixpoint.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.34839763850849137}}
{"text": "(*  Title:      HOL/Library/Quotient_List.thy\n    Author:     Cezary Kaliszyk and Christian Urban\n*)\n\nsection \\<open>Quotient infrastructure for the list type\\<close>\n\ntheory Quotient_List\nimports Quotient_Set Quotient_Product Quotient_Option\nbegin\n\nsubsection \\<open>Rules for the Quotient package\\<close>\n\nlemma map_id [id_simps]:\n  \"map id = id\"\n  by (fact List.map.id)\n\nlemma list_all2_eq [id_simps]:\n  \"list_all2 (op =) = (op =)\"\nproof (rule ext)+\n  fix xs ys\n  show \"list_all2 (op =) xs ys \\<longleftrightarrow> xs = ys\"\n    by (induct xs ys rule: list_induct2') simp_all\nqed\n\nlemma reflp_list_all2:\n  assumes \"reflp R\"\n  shows \"reflp (list_all2 R)\"\nproof (rule reflpI)\n  from assms have *: \"\\<And>xs. R xs xs\" by (rule reflpE)\n  fix xs\n  show \"list_all2 R xs xs\"\n    by (induct xs) (simp_all add: *)\nqed\n\nlemma list_symp:\n  assumes \"symp R\"\n  shows \"symp (list_all2 R)\"\nproof (rule sympI)\n  from assms have *: \"\\<And>xs ys. R xs ys \\<Longrightarrow> R ys xs\" by (rule sympE)\n  fix xs ys\n  assume \"list_all2 R xs ys\"\n  then show \"list_all2 R ys xs\"\n    by (induct xs ys rule: list_induct2') (simp_all add: *)\nqed\n\nlemma list_transp:\n  assumes \"transp R\"\n  shows \"transp (list_all2 R)\"\nproof (rule transpI)\n  from assms have *: \"\\<And>xs ys zs. R xs ys \\<Longrightarrow> R ys zs \\<Longrightarrow> R xs zs\" by (rule transpE)\n  fix xs ys zs\n  assume \"list_all2 R xs ys\" and \"list_all2 R ys zs\"\n  then show \"list_all2 R xs zs\"\n    by (induct arbitrary: zs) (auto simp: list_all2_Cons1 intro: *)\nqed\n\nlemma list_equivp [quot_equiv]:\n  \"equivp R \\<Longrightarrow> equivp (list_all2 R)\"\n  by (blast intro: equivpI reflp_list_all2 list_symp list_transp elim: equivpE)\n\nlemma list_quotient3 [quot_thm]:\n  assumes \"Quotient3 R Abs Rep\"\n  shows \"Quotient3 (list_all2 R) (map Abs) (map Rep)\"\nproof (rule Quotient3I)\n  from assms have \"\\<And>x. Abs (Rep x) = x\" by (rule Quotient3_abs_rep)\n  then show \"\\<And>xs. map Abs (map Rep xs) = xs\" by (simp add: comp_def)\nnext\n  from assms have \"\\<And>x y. R (Rep x) (Rep y) \\<longleftrightarrow> x = y\" by (rule Quotient3_rel_rep)\n  then show \"\\<And>xs. list_all2 R (map Rep xs) (map Rep xs)\"\n    by (simp add: list_all2_map1 list_all2_map2 list_all2_eq)\nnext\n  fix xs ys\n  from assms have \"\\<And>x y. R x x \\<and> R y y \\<and> Abs x = Abs y \\<longleftrightarrow> R x y\" by (rule Quotient3_rel)\n  then show \"list_all2 R xs ys \\<longleftrightarrow> list_all2 R xs xs \\<and> list_all2 R ys ys \\<and> map Abs xs = map Abs ys\"\n    by (induct xs ys rule: list_induct2') auto\nqed\n\ndeclare [[mapQ3 list = (list_all2, list_quotient3)]]\n\nlemma cons_prs [quot_preserve]:\n  assumes q: \"Quotient3 R Abs Rep\"\n  shows \"(Rep ---> (map Rep) ---> (map Abs)) (op #) = (op #)\"\n  by (auto simp add: fun_eq_iff comp_def Quotient3_abs_rep [OF q])\n\nlemma cons_rsp [quot_respect]:\n  assumes q: \"Quotient3 R Abs Rep\"\n  shows \"(R ===> list_all2 R ===> list_all2 R) (op #) (op #)\"\n  by auto\n\nlemma nil_prs [quot_preserve]:\n  assumes q: \"Quotient3 R Abs Rep\"\n  shows \"map Abs [] = []\"\n  by simp\n\nlemma nil_rsp [quot_respect]:\n  assumes q: \"Quotient3 R Abs Rep\"\n  shows \"list_all2 R [] []\"\n  by simp\n\nlemma map_prs_aux:\n  assumes a: \"Quotient3 R1 abs1 rep1\"\n  and     b: \"Quotient3 R2 abs2 rep2\"\n  shows \"(map abs2) (map ((abs1 ---> rep2) f) (map rep1 l)) = map f l\"\n  by (induct l)\n     (simp_all add: Quotient3_abs_rep[OF a] Quotient3_abs_rep[OF b])\n\nlemma map_prs [quot_preserve]:\n  assumes a: \"Quotient3 R1 abs1 rep1\"\n  and     b: \"Quotient3 R2 abs2 rep2\"\n  shows \"((abs1 ---> rep2) ---> (map rep1) ---> (map abs2)) map = map\"\n  and   \"((abs1 ---> id) ---> map rep1 ---> id) map = map\"\n  by (simp_all only: fun_eq_iff map_prs_aux[OF a b] comp_def)\n    (simp_all add: Quotient3_abs_rep[OF a] Quotient3_abs_rep[OF b])\n\nlemma map_rsp [quot_respect]:\n  assumes q1: \"Quotient3 R1 Abs1 Rep1\"\n  and     q2: \"Quotient3 R2 Abs2 Rep2\"\n  shows \"((R1 ===> R2) ===> (list_all2 R1) ===> list_all2 R2) map map\"\n  and   \"((R1 ===> op =) ===> (list_all2 R1) ===> op =) map map\"\n  unfolding list_all2_eq [symmetric] by (rule list.map_transfer)+\n\nlemma foldr_prs_aux:\n  assumes a: \"Quotient3 R1 abs1 rep1\"\n  and     b: \"Quotient3 R2 abs2 rep2\"\n  shows \"abs2 (foldr ((abs1 ---> abs2 ---> rep2) f) (map rep1 l) (rep2 e)) = foldr f l e\"\n  by (induct l) (simp_all add: Quotient3_abs_rep[OF a] Quotient3_abs_rep[OF b])\n\nlemma foldr_prs [quot_preserve]:\n  assumes a: \"Quotient3 R1 abs1 rep1\"\n  and     b: \"Quotient3 R2 abs2 rep2\"\n  shows \"((abs1 ---> abs2 ---> rep2) ---> (map rep1) ---> rep2 ---> abs2) foldr = foldr\"\n  apply (simp add: fun_eq_iff)\n  by (simp only: fun_eq_iff foldr_prs_aux[OF a b])\n     (simp)\n\nlemma foldl_prs_aux:\n  assumes a: \"Quotient3 R1 abs1 rep1\"\n  and     b: \"Quotient3 R2 abs2 rep2\"\n  shows \"abs1 (foldl ((abs1 ---> abs2 ---> rep1) f) (rep1 e) (map rep2 l)) = foldl f e l\"\n  by (induct l arbitrary:e) (simp_all add: Quotient3_abs_rep[OF a] Quotient3_abs_rep[OF b])\n\nlemma foldl_prs [quot_preserve]:\n  assumes a: \"Quotient3 R1 abs1 rep1\"\n  and     b: \"Quotient3 R2 abs2 rep2\"\n  shows \"((abs1 ---> abs2 ---> rep1) ---> rep1 ---> (map rep2) ---> abs1) foldl = foldl\"\n  by (simp add: fun_eq_iff foldl_prs_aux [OF a b])\n\nlemma foldl_rsp[quot_respect]:\n  assumes q1: \"Quotient3 R1 Abs1 Rep1\"\n  and     q2: \"Quotient3 R2 Abs2 Rep2\"\n  shows \"((R1 ===> R2 ===> R1) ===> R1 ===> list_all2 R2 ===> R1) foldl foldl\"\n  by (rule foldl_transfer)\n\nlemma foldr_rsp[quot_respect]:\n  assumes q1: \"Quotient3 R1 Abs1 Rep1\"\n  and     q2: \"Quotient3 R2 Abs2 Rep2\"\n  shows \"((R1 ===> R2 ===> R2) ===> list_all2 R1 ===> R2 ===> R2) foldr foldr\"\n  by (rule foldr_transfer)\n\nlemma list_all2_rsp:\n  assumes r: \"\\<forall>x y. R x y \\<longrightarrow> (\\<forall>a b. R a b \\<longrightarrow> S x a = T y b)\"\n  and l1: \"list_all2 R x y\"\n  and l2: \"list_all2 R a b\"\n  shows \"list_all2 S x a = list_all2 T y b\"\n  using l1 l2\n  by (induct arbitrary: a b rule: list_all2_induct,\n    auto simp: list_all2_Cons1 list_all2_Cons2 r)\n\nlemma [quot_respect]:\n  \"((R ===> R ===> op =) ===> list_all2 R ===> list_all2 R ===> op =) list_all2 list_all2\"\n  by (rule list.rel_transfer)\n\nlemma [quot_preserve]:\n  assumes a: \"Quotient3 R abs1 rep1\"\n  shows \"((abs1 ---> abs1 ---> id) ---> map rep1 ---> map rep1 ---> id) list_all2 = list_all2\"\n  apply (simp add: fun_eq_iff)\n  apply clarify\n  apply (induct_tac xa xb rule: list_induct2')\n  apply (simp_all add: Quotient3_abs_rep[OF a])\n  done\n\nlemma [quot_preserve]:\n  assumes a: \"Quotient3 R abs1 rep1\"\n  shows \"(list_all2 ((rep1 ---> rep1 ---> id) R) l m) = (l = m)\"\n  by (induct l m rule: list_induct2') (simp_all add: Quotient3_rel_rep[OF a])\n\nlemma list_all2_find_element:\n  assumes a: \"x \\<in> set a\"\n  and b: \"list_all2 R a b\"\n  shows \"\\<exists>y. (y \\<in> set b \\<and> R x y)\"\n  using b a by induct auto\n\nlemma list_all2_refl:\n  assumes a: \"\\<And>x y. R x y = (R x = R y)\"\n  shows \"list_all2 R x x\"\n  by (induct x) (auto simp add: a)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Library/Quotient_List.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.6859494485880927, "lm_q1q2_score": 0.34833326828881167}}
{"text": "theory \"Arity-Nominal\"\nimports Arity \"Launchbury.Nominal-HOLCF\"\nbegin\n\nlemma join_eqvt[eqvt]: \"\\<pi> \\<bullet> (x \\<squnion> (y :: 'a :: {Finite_Join_cpo, cont_pt})) = (\\<pi> \\<bullet> x) \\<squnion> (\\<pi> \\<bullet> y)\"\n  by (rule is_joinI[symmetric]) (auto simp add: perm_below_to_right)\n\n\ninstantiation Arity :: pure\nbegin\n  definition \"p \\<bullet> (a::Arity) = a\"\ninstance\n  apply standard\n  apply (auto simp add: permute_Arity_def)\n  done\nend\n\n\ninstance Arity :: cont_pt by standard (simp add: pure_permute_id)\ninstance Arity :: pure_cont_pt ..\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/Arity-Nominal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3482894268451717}}
{"text": "theory Hoare_Lift imports Hoare_Indexed Hoare_Indexed_Sound Hoare_Direct\n  \"../Lifter/Lifter\" \"../Composition/Composition\" \"../Composition/Dominant\"\nbegin\n\n(* TODO rename this file to Hoare_Direct_Lift (or Hoare_Step_Lift...) *)\n(* TODO: do we still need this? *)\n\n(*\n * This file contains some abstractions for lifting Hoare rules expressed on a single language\n * into Hoare rules expressed on merged languages.\n *\n * Note that this isn't particularly suitable for languages that deal with control -\n * see Language_Components/Imp_Ctl and Language_Components/Seq to see how we deal with\n * those cases.\n *\n * For languages without control, this is a more general approach (as we show here,\n * the \"dominant\" style of reasoning used in Imp_Ctl and Seq is a special case of this.)\n *)\n\n(* This version does not take a valid set. It is usually not what we want. *)\ndefinition lift_pred_noS_s ::\n  \"('a1, 'b1) syn_lifting \\<Rightarrow>\n   ('a1, 'a2, 'b2 :: Pord) lifting \\<Rightarrow>\n   'b1 \\<Rightarrow>\n   ('a2 \\<Rightarrow> bool) \\<Rightarrow>\n   ('b2 \\<Rightarrow> bool)\"\n  where\n\"lift_pred_noS_s l' l syn P st =\n P (LOut l (l' syn) st)\"\n\ndefinition lift_pred_s ::\n  \"('a1, 'b1) syn_lifting \\<Rightarrow>\n   ('a1, 'a2, 'b2 :: Pord) lifting \\<Rightarrow>\n   ('a1 \\<Rightarrow> 'b2 set) \\<Rightarrow>\n   'b1 \\<Rightarrow>\n   ('a2 \\<Rightarrow> bool) \\<Rightarrow>\n   ('b2 \\<Rightarrow> bool)\"\n  where\n\"lift_pred_s l' l S syn P st =\n  (lift_pred_noS_s l' l syn P st \\<and> st \\<in> S (l' syn))\"\n\n(* When we lift a function on which a certain Hoare triple holds,\n * we know that an analogous Hoare triple holds on the lifted function and\n * lifted predicates.\n *)\nlemma Vlift :\n  assumes Valid : \"lifting_valid_weak l S\" \n  assumes V: \"(sem) % {{P}} x {{Q}}\"\n  assumes Syn : \"l' x' = x\"\n  shows \"(lift_map_s l' l sem) % {{lift_pred_noS_s l' l x' P}} x' {{lift_pred_noS_s l' l x' Q}}\"\nproof-\n\n  interpret Valid : lifting_valid_weak l S\n    using Valid.\n\n  show \" lift_map_s l' l\n     sem % {{lift_pred_noS_s l' l x'\n              P}} x' {{lift_pred_noS_s l' l x' Q}}\"\n using V Syn\n  unfolding HTS_def HT_def lift_pred_noS_s_def lift_map_s_def \n  by(auto simp add: Valid.put_get)\nqed\n\n(* not especially useful - better to separate out the valid-set *)\nlemma Vlift_valid :\n  assumes Valid : \"lifting_valid_weak l S\" \n  assumes V: \"(sem) % {{P}} x {{Q}}\"\n  assumes Syn : \"l' x' = x\"\n  shows \"(lift_map_s l' l sem) % {{lift_pred_s l' l S x' P}} x' {{lift_pred_s l' l S x' Q}}\"\nproof-\n  interpret Valid : lifting_valid_weak l S\n    using Valid.\n\n  show \" lift_map_s l' l\n     sem % {{lift_pred_s l' l S x'\n              P}} x' {{lift_pred_s l' l S x' Q}}\"\n using V Syn\n  unfolding HTS_def HT_def lift_pred_s_def lift_map_s_def lift_pred_noS_s_def\n  using Valid.put_S\n  by(auto simp add: Valid.put_get)\nqed\n\n(* Now, some stuff from Hoare_Lift. *)\ndefinition lift_pred_valid_ok_s ::\n  \"('a1, 'b1) syn_lifting \\<Rightarrow>\n   ('a1, 'a2, 'b2 :: {Pord, Okay}) lifting \\<Rightarrow>\n   'b1 \\<Rightarrow>\n   ('a2 \\<Rightarrow> bool) \\<Rightarrow>\n   ('b2 \\<Rightarrow> bool)\"\n  where\n\"lift_pred_valid_ok_s l' l syn P st =\n  (lift_pred_noS_s l' l syn P st \\<and> st \\<in> ok_S)\" \n\nlemma Vlift_valid_ok :\n  assumes Valid : \"lifting_valid_weak_ok l S\" \n  assumes V: \"(sem) % {{P}} x {{Q}}\"\n  assumes Syn : \"l' x' = x\"\n  shows \"(lift_map_s l' l sem) % {{lift_pred_valid_ok_s l' l x' P}} x' {{lift_pred_valid_ok_s l' l  x' Q}}\"\nproof-\n\n  interpret Valid : lifting_valid_weak_ok l S\n    using Valid.\n\n  show ?thesis\n\n using V Syn\n  unfolding HTS_def HT_def lift_pred_s_def lift_map_s_def lift_pred_s_def lift_pred_valid_ok_s_def\n    lift_pred_noS_s_def\n  using Valid.put_S Valid.ok_S_put\n  by(auto simp add: Valid.put_get)\nqed\n\n\n(*\n * Intuitively, the only way for a Hoare triple that is valid on a language component\n * in isolation to fail to hold after being merged with another language is if\n * another language \"overrides\" that construct for some piece(s) of syntax.\n * This is why we have to weaken the conclusion, requiring only that there exists\n * a lesser (in the information-ordering sense) state on which the triple does hold.\n *)\nlemma Vmerge :\n  assumes Pres : \"sups_pres (set l) S\"\n  assumes Sem : \"f \\<in> set l\"\n  assumes P_S : \"\\<And> st . P st \\<Longrightarrow> st \\<in> S x\"\n  assumes V : \"(f) % {{P}} x {{Q}}\"\n  shows \"(pcomps l) % \n         {{P}}\n         x\n         {{(\\<lambda> st . \\<exists> st_sub . Q st_sub \\<and> st_sub <[ st)}}\"\nproof(rule HTSI)\n  fix a \n  assume HP : \"P a\"\n\n  have Conc_f : \"Q (f x a)\"\n    using HTSE[OF V HP]\n    by auto\n\n  have Elem : \"f x a \\<in> (\\<lambda>f. f x a) ` set l\"\n    using Sem by auto\n\n  have Nemp : \"l \\<noteq> []\" using Sem by (cases l; auto)\n\n  have Conc' : \"f x a <[ pcomps l x a\"\n    using is_supD1[OF sups_pres_pcomps_sup'[OF Pres Nemp] Elem] P_S[OF HP]\n    by auto\n\n  show \"\\<exists>st_sub. Q st_sub \\<and> st_sub <[ pcomps l x a\"\n    using Conc_f Conc'\n    by auto\nqed\n    \n(* Another way of looking a vmerge: if we know the conclusion is monotonic,\n * then we know that a triple with that conclusion still holds after a merge *)\nlemma Vmerge_mono :\n  assumes Pres : \"sups_pres (set l) S\"\n  assumes Sem : \"f \\<in> set l\"\n  assumes Mono : \"Pord.is_monop1 Q\"\n  assumes P_S : \"\\<And> st . P st \\<Longrightarrow> st \\<in> S x\"\n  assumes V : \"(f) % {{P}} x {{Q}}\"\n  shows \"(pcomps l) % \n         {{P}}\n         x\n         {{Q}}\"\nproof(-)\n  have PC : \"(pcomps l) % {{P}} x {{(\\<lambda>st. \\<exists>st_sub. Q st_sub \\<and> st_sub <[ st)}}\"\n    using Vmerge[OF Pres Sem P_S V]\n    by auto\n\n  show \"(pcomps l) % {{P}} x {{Q}}\"\n  proof(rule HTS_Conseq[OF PC])\n    show \"\\<And> x . P x \\<Longrightarrow> P x\" by auto\n  next\n    fix x\n    show \"\\<exists>st_sub. Q st_sub \\<and> st_sub <[ x \\<Longrightarrow> Q x\"\n    proof(clarify)\n      fix x st_sub\n      assume Hi1 : \"Q st_sub\"\n      assume Hi2 : \"st_sub <[ x\"\n      show \"Q x\" using Hi1 Hi2 Mono unfolding is_monop1_def\n        by(auto)\n    qed\n  qed\nqed\n\n\n(* a (almost) weaker version of l_ortho, that\n   talks about when liftings are orthogonal in the sense\n   that arbitrary lifted functions preserve sups at runtime *)\n(* this and the following definitions may not be particularly useful anymore\n * (TODO - decide if they are worth keeping *)\n(*\ndefinition l_ortho_run ::\n  \"('x, 'a1, 'b :: Mergeable, 'z1) lifting_scheme \\<Rightarrow>\n   ('x, 'a2, 'b, 'z2) lifting_scheme \\<Rightarrow>\n   bool\" where\n\"l_ortho_run l1 l2 = \n  (\\<forall> x1 x2 . sups_pres {(\\<lambda>syn . LUpd l1 syn x1), (\\<lambda> syn . LUpd l2 syn x2)})\"\n\nlemma leq_sup :\n  assumes H : \"x1 <[ x2\"\n  shows \"is_sup {x1, x2} x2\"\nproof(rule is_supI)\n  fix x\n  assume \"x \\<in> {x1, x2}\"\n  then show \"x <[ x2\" using H leq_refl by auto\nnext\n  fix x'\n  assume \"is_ub {x1, x2} x'\"\n  then show \"x2 <[ x'\"\n    by(auto simp add: is_ub_def)\nqed\n*)\n\n(* \n * When dealing with single-step languages, we have an important special case - that is,\n * the case where the single-step language is _dominant_ (see Composition/Dominant.thy)\n * for one or more pieces of syntax. In such cases we can show that the\n * lifted version of the rule holds without side conditions.\n *)\n\n(* However, we might be able to avoid reasoning about liftings at all in such cases (?)\n * by playing the same parametricity trick as with the control languages?\n *)\n\n\n(*\n(* TODO: why is 'b being forced to be Mergeableb? *)\nlemma prio_ortho_run :\n  fixes tf :: \"('x, 'a1, 'b :: Mergeableb) lifting\"\n  fixes tg :: \"('x, 'a2, 'b ) lifting\"\n  assumes H0 : \"\\<And> s p . f1 s p \\<noteq> g1 s p\"\n  shows \"l_ortho_run (prio_l f0 f1 tf) (prio_l g0 g1 tg)\"\n  unfolding l_ortho_run_def sups_pres_def\nproof(clarify)\n  fix x1 x2 syn\n  fix st :: \"'b md_prio\"\n\n  obtain p st' where St : \"st = mdp p st'\" by(cases st; auto)\n\n  have Conc' : \"has_sup {(LUpd (prio_l f0 f1 tf) syn x1 st),\n                         (LUpd (prio_l g0 g1 tg) syn x2 st)}\"\n  proof(cases \"f1 syn p \\<le> g1 syn p\")\n    case True\n    then have True' : \"f1 syn p < g1 syn p\" using H0[of syn p] by auto\n    then have Gt : \"(LUpd (prio_l f0 f1 tf) syn x1 st) <[ (LUpd (prio_l g0 g1 tg) syn x2 st)\"\n      using St\n      by(auto simp add: prio_l_def prio_pleq)\n\n    show ?thesis using leq_sup[OF Gt] by (auto simp add: has_sup_def)\n  next\n    case False\n    then have False' : \"g1 syn p < f1 syn p\" using H0[of syn p] by auto\n    then have Gt : \"(LUpd (prio_l g0 g1 tg) syn x2 st) <[ (LUpd (prio_l f0 f1 tf) syn x1 st)\"\n      using St\n      by(auto simp add: prio_l_def prio_pleq)\n    show ?thesis using is_sup_comm2[OF leq_sup[OF Gt]] by (auto simp add: has_sup_def)\n  qed\n\n  thus \"has_sup\n        ((\\<lambda>f. f syn st) ` \n         {\\<lambda>syn. LUpd (prio_l f0 f1 tf) syn x1, \\<lambda>syn. LUpd (prio_l g0 g1 tg) syn x2})\"\n    by(auto)\nqed\n*)\n(*\nlemma l_ortho_imp_weak :\n\n  fixes tf :: \"('x, 'a1, 'b :: Mergeable) lifting\"\n  fixes tg :: \"('x, 'a2, 'b ) lifting\"\n(* TODO: make sure these really need to be the same valid-set\n   i don't intuitively understand why this should be *)\n\n  assumes Hvf :  \"lifting_valid tf Sf\"\n  assumes Hvg :  \"lifting_valid tg Sg\"\n  assumes Hs : \"Sf = Sg\"\n  assumes H: \"l_ortho tf tg\"\n  shows \"l_ortho_run tf tg\"\n  unfolding l_ortho_run_def sups_pres_def\nproof(clarify)\n  fix x1 x2 syn st\n\n  have Orth : \"LUpd tf syn x1 (LUpd tg syn x2 st) = LUpd tg syn x2 (LUpd tf syn x1 st)\"\n    using l_orthoDI[OF H, of syn x1 x2 st] by auto\n\n  have Ub : \"is_ub {LUpd tf syn x1 st, LUpd tg syn x2 st} (LUpd tf syn x1 (LUpd tg syn x2 st))\"\n  proof(rule is_ubI)\n    fix x\n    assume Hx : \"x \\<in> {LUpd tf syn x1 st, LUpd tg syn x2 st}\"\n\n    then consider (1) \"x = LUpd tf syn x1 st\" |\n                  (2) \"x = LUpd tg syn x2 st\" by auto\n\n    then show \"x <[ LUpd tf syn x1 (LUpd tg syn x2 st)\"\n    proof cases\n      case 1\n\n      have Sg : \"x \\<in> Sg syn\"\n        using lifting_validDP[OF Hvf] unfolding 1 Orth Hs by auto\n\n      then show ?thesis\n        using lifting_validDI[OF Hvg Sg]\n        unfolding 1 Orth by auto\n    next\n      case 2\n      have Sf : \"x \\<in> Sf syn\"\n        using lifting_validDP[OF Hvg] unfolding 2 Orth Hs by auto\n\n      then show ?thesis\n        using lifting_validDI[OF Hvf Sf]\n        unfolding 2 sym[OF Orth] by auto\n    qed\n  qed\n\n  hence Ub' : \"has_ub {LUpd tf syn x1 st, LUpd tg syn x2 st}\"\n    by(auto simp add: has_ub_def)\n\n  have Sup : \"has_sup {LUpd tf syn x1 st, LUpd tg syn x2 st}\" \n    using complete2[OF Ub'] by auto\n\n  thus \"has_sup ((\\<lambda>f. f syn st) ` {\\<lambda>syn. LUpd tf syn x1, \\<lambda>syn. LUpd tg syn x2})\"\n    by auto\nqed\n*)\n\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Hoare/Hoare_Lift.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370308082623217, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.34828904686660667}}
{"text": "(*  Title:       An Ordered Resolution Prover for First-Order Clauses\n    Author:      Anders Schlichtkrull <andschl at dtu.dk>, 2016, 2017\n    Author:      Jasmin Blanchette <j.c.blanchette at vu.nl>, 2014, 2017\n    Author:      Dmitriy Traytel <traytel at inf.ethz.ch>, 2014\n    Maintainer:  Anders Schlichtkrull <andschl at dtu.dk>\n*)\n\nsection \\<open>An Ordered Resolution Prover for First-Order Clauses\\<close>\n\ntheory FO_Ordered_Resolution_Prover\n  imports FO_Ordered_Resolution\nbegin\n\ntext \\<open>\nThis material is based on Section 4.3 (``A Simple Resolution Prover for First-Order Clauses'') of\nBachmair and Ganzinger's chapter. Specifically, it formalizes the RP prover defined in Figure 5 and\nits related lemmas and theorems, including Lemmas 4.10 and 4.11 and Theorem 4.13 (completeness).\n\\<close>\n\ndefinition is_least :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"is_least P n \\<longleftrightarrow> P n \\<and> (\\<forall>n' < n. \\<not> P n')\"\n\nlemma least_exists: \"P n \\<Longrightarrow> \\<exists>n. is_least P n\"\n  using exists_least_iff unfolding is_least_def by auto\n\ntext \\<open>\nThe following corresponds to page 42 and 43 of Section 4.3, from the explanation of RP to\nLemma 4.10.\n\\<close>\n\ntype_synonym 'a state = \"'a clause set \\<times> 'a clause set \\<times> 'a clause set\"\n\nlocale FO_resolution_prover =\n  FO_resolution subst_atm id_subst comp_subst renamings_apart atm_of_atms mgu less_atm +\n  selection S\n  for\n    S :: \"('a :: wellorder) clause \\<Rightarrow> 'a clause\" and\n    subst_atm :: \"'a \\<Rightarrow> 's \\<Rightarrow> 'a\" and\n    id_subst :: \"'s\" and\n    comp_subst :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's\" and\n    renamings_apart :: \"'a clause list \\<Rightarrow> 's list\" and\n    atm_of_atms :: \"'a list \\<Rightarrow> 'a\" and\n    mgu :: \"'a set set \\<Rightarrow> 's option\" and\n    less_atm :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\" +\n  assumes\n    sel_stable: \"\\<And>\\<rho> C. is_renaming \\<rho> \\<Longrightarrow> S (C \\<cdot> \\<rho>) = S C \\<cdot> \\<rho>\"\nbegin\n\nfun N_of_state :: \"'a state \\<Rightarrow> 'a clause set\" where\n  \"N_of_state (N, P, Q) = N\"\n\nfun P_of_state :: \"'a state \\<Rightarrow> 'a clause set\" where\n  \"P_of_state (N, P, Q) = P\"\n\ntext \\<open>\n\\<open>O\\<close> denotes relation composition in Isabelle, so the formalization uses \\<open>Q\\<close> instead.\n\\<close>\n\nfun Q_of_state :: \"'a state \\<Rightarrow> 'a clause set\" where\n  \"Q_of_state (N, P, Q) = Q\"\n\nabbreviation clss_of_state :: \"'a state \\<Rightarrow> 'a clause set\" where\n  \"clss_of_state St \\<equiv> N_of_state St \\<union> P_of_state St \\<union> Q_of_state St\"\n\nabbreviation grounding_of_state :: \"'a state \\<Rightarrow> 'a clause set\" where\n  \"grounding_of_state St \\<equiv> grounding_of_clss (clss_of_state St)\"\n\ninterpretation ord_FO_resolution: inference_system \"ord_FO_\\<Gamma> S\" .\n\ntext \\<open>\nThe following inductive predicate formalizes the resolution prover in Figure 5.\n\\<close>\n\ninductive RP :: \"'a state \\<Rightarrow> 'a state \\<Rightarrow> bool\" (infix \"\\<leadsto>\" 50) where\n  tautology_deletion: \"Neg A \\<in># C \\<Longrightarrow> Pos A \\<in># C \\<Longrightarrow> (N \\<union> {C}, P, Q) \\<leadsto> (N, P, Q)\"\n| forward_subsumption: \"D \\<in> P \\<union> Q \\<Longrightarrow> subsumes D C \\<Longrightarrow> (N \\<union> {C}, P, Q) \\<leadsto> (N, P, Q)\"\n| backward_subsumption_P: \"D \\<in> N \\<Longrightarrow> strictly_subsumes D C \\<Longrightarrow> (N, P \\<union> {C}, Q) \\<leadsto> (N, P, Q)\"\n| backward_subsumption_Q: \"D \\<in> N \\<Longrightarrow> strictly_subsumes D C \\<Longrightarrow> (N, P, Q \\<union> {C}) \\<leadsto> (N, P, Q)\"\n| forward_reduction: \"D + {#L'#} \\<in> P \\<union> Q \\<Longrightarrow> - L = L' \\<cdot>l \\<sigma> \\<Longrightarrow> D \\<cdot> \\<sigma> \\<subseteq># C \\<Longrightarrow>\n    (N \\<union> {C + {#L#}}, P, Q) \\<leadsto> (N \\<union> {C}, P, Q)\"\n| backward_reduction_P: \"D + {#L'#} \\<in> N \\<Longrightarrow> - L = L' \\<cdot>l \\<sigma> \\<Longrightarrow> D \\<cdot> \\<sigma> \\<subseteq># C \\<Longrightarrow>\n    (N, P \\<union> {C + {#L#}}, Q) \\<leadsto> (N, P \\<union> {C}, Q)\"\n| backward_reduction_Q: \"D + {#L'#} \\<in> N \\<Longrightarrow> - L = L' \\<cdot>l \\<sigma> \\<Longrightarrow> D \\<cdot> \\<sigma> \\<subseteq># C \\<Longrightarrow>\n    (N, P, Q \\<union> {C + {#L#}}) \\<leadsto> (N, P \\<union> {C}, Q)\"\n| clause_processing: \"(N \\<union> {C}, P, Q) \\<leadsto> (N, P \\<union> {C}, Q)\"\n| inference_computation: \"N = concls_of (ord_FO_resolution.inferences_between Q C) \\<Longrightarrow>\n    ({}, P \\<union> {C}, Q) \\<leadsto> (N, P, Q \\<union> {C})\"\n\n\n\ndefinition Sup_state :: \"'a state llist \\<Rightarrow> 'a state\" where\n  \"Sup_state Sts =\n   (Sup_llist (lmap N_of_state Sts), Sup_llist (lmap P_of_state Sts),\n    Sup_llist (lmap Q_of_state Sts))\"\n\ndefinition Liminf_state :: \"'a state llist \\<Rightarrow> 'a state\" where\n  \"Liminf_state Sts =\n   (Liminf_llist (lmap N_of_state Sts), Liminf_llist (lmap P_of_state Sts),\n    Liminf_llist (lmap Q_of_state Sts))\"\n\ncontext\n  fixes Sts Sts' :: \"'a state llist\"\n  assumes Sts: \"lfinite Sts\" \"lfinite Sts'\" \"\\<not> lnull Sts\" \"\\<not> lnull Sts'\" \"llast Sts' = llast Sts\"\nbegin\n\nlemma\n  N_of_Liminf_state_fin: \"N_of_state (Liminf_state Sts') = N_of_state (Liminf_state Sts)\" and\n  P_of_Liminf_state_fin: \"P_of_state (Liminf_state Sts') = P_of_state (Liminf_state Sts)\" and\n  Q_of_Liminf_state_fin: \"Q_of_state (Liminf_state Sts') = Q_of_state (Liminf_state Sts)\"\n  using Sts by (simp_all add: Liminf_state_def lfinite_Liminf_llist llast_lmap)\n\nlemma Liminf_state_fin: \"Liminf_state Sts' = Liminf_state Sts\"\n  using N_of_Liminf_state_fin P_of_Liminf_state_fin Q_of_Liminf_state_fin\n  by (simp add: Liminf_state_def)\n\nend\n\ncontext\n  fixes Sts Sts' :: \"'a state llist\"\n  assumes Sts: \"\\<not> lfinite Sts\" \"emb Sts Sts'\"\nbegin\n\nlemma\n  N_of_Liminf_state_inf: \"N_of_state (Liminf_state Sts') \\<subseteq> N_of_state (Liminf_state Sts)\" and\n  P_of_Liminf_state_inf: \"P_of_state (Liminf_state Sts') \\<subseteq> P_of_state (Liminf_state Sts)\" and\n  Q_of_Liminf_state_inf: \"Q_of_state (Liminf_state Sts') \\<subseteq> Q_of_state (Liminf_state Sts)\"\n  using Sts by (simp_all add: Liminf_state_def emb_Liminf_llist_infinite emb_lmap)\n\nlemma clss_of_Liminf_state_inf:\n  \"clss_of_state (Liminf_state Sts') \\<subseteq> clss_of_state (Liminf_state Sts)\"\n  using N_of_Liminf_state_inf P_of_Liminf_state_inf Q_of_Liminf_state_inf by blast\n\nend\n\ndefinition fair_state_seq :: \"'a state llist \\<Rightarrow> bool\" where\n  \"fair_state_seq Sts \\<longleftrightarrow> N_of_state (Liminf_state Sts) = {} \\<and> P_of_state (Liminf_state Sts) = {}\"\n\ntext \\<open>\nThe following formalizes Lemma 4.10.\n\\<close>\n\ncontext\n  fixes Sts :: \"'a state llist\"\nbegin\n\ndefinition S_Q :: \"'a clause \\<Rightarrow> 'a clause\" where\n  \"S_Q = S_M S (Q_of_state (Liminf_state Sts))\"\n\ninterpretation sq: selection S_Q\n  unfolding S_Q_def using S_M_selects_subseteq S_M_selects_neg_lits selection_axioms\n  by unfold_locales auto\n\ninterpretation gr: ground_resolution_with_selection S_Q\n  by unfold_locales\n\ninterpretation sr: standard_redundancy_criterion_reductive gr.ord_\\<Gamma>\n  by unfold_locales\n\ninterpretation sr: standard_redundancy_criterion_counterex_reducing gr.ord_\\<Gamma>\n  \"ground_resolution_with_selection.INTERP S_Q\"\n  by unfold_locales\n\ntext \\<open>\nThe extension of ordered resolution mentioned in 4.10. We let it consist of all sound rules.\n\\<close>\n\ndefinition ground_sound_\\<Gamma>:: \"'a inference set\" where\n  \"ground_sound_\\<Gamma> = {Infer CC D E | CC D E. (\\<forall>I. I \\<Turnstile>m CC \\<longrightarrow> I \\<Turnstile> D \\<longrightarrow> I \\<Turnstile> E)}\"\n\ntext \\<open>\nWe prove that we indeed defined an extension.\n\\<close>\n\nlemma gd_ord_\\<Gamma>_ngd_ord_\\<Gamma>: \"gr.ord_\\<Gamma> \\<subseteq> ground_sound_\\<Gamma>\"\n  unfolding ground_sound_\\<Gamma>_def using gr.ord_\\<Gamma>_def gr.ord_resolve_sound by fastforce\n\nlemma sound_ground_sound_\\<Gamma>: \"sound_inference_system ground_sound_\\<Gamma>\"\n  unfolding sound_inference_system_def ground_sound_\\<Gamma>_def by auto\n\nlemma sat_preserving_ground_sound_\\<Gamma>: \"sat_preserving_inference_system ground_sound_\\<Gamma>\"\n  using sound_ground_sound_\\<Gamma> sat_preserving_inference_system.intro\n    sound_inference_system.\\<Gamma>_sat_preserving by blast\n\ndefinition sr_ext_Ri :: \"'a clause set \\<Rightarrow> 'a inference set\" where\n  \"sr_ext_Ri N = sr.Ri N \\<union> (ground_sound_\\<Gamma> - gr.ord_\\<Gamma>)\"\n\ninterpretation sr_ext:\n  sat_preserving_redundancy_criterion ground_sound_\\<Gamma> sr.Rf sr_ext_Ri\n  unfolding sat_preserving_redundancy_criterion_def sr_ext_Ri_def\n  using sat_preserving_ground_sound_\\<Gamma> redundancy_criterion_standard_extension gd_ord_\\<Gamma>_ngd_ord_\\<Gamma>\n    sr.redundancy_criterion_axioms by auto\n\nlemma strict_subset_subsumption_redundant_clause:\n  assumes\n    sub: \"D \\<cdot> \\<sigma> \\<subset># C\" and\n    ground_\\<sigma>: \"is_ground_subst \\<sigma>\"\n  shows \"C \\<in> sr.Rf (grounding_of_cls D)\"\nproof -\n  from sub have \"\\<forall>I. I \\<Turnstile> D \\<cdot> \\<sigma> \\<longrightarrow> I \\<Turnstile> C\"\n    unfolding true_cls_def by blast\n  moreover have \"C > D \\<cdot> \\<sigma>\"\n    using sub by (simp add: subset_imp_less_mset)\n  moreover have \"D \\<cdot> \\<sigma> \\<in> grounding_of_cls D\"\n    using ground_\\<sigma> by (metis (mono_tags) mem_Collect_eq substitution_ops.grounding_of_cls_def)\n  ultimately have \"set_mset {#D \\<cdot> \\<sigma>#} \\<subseteq> grounding_of_cls D\"\n    \"(\\<forall>I. I \\<Turnstile>m {#D \\<cdot> \\<sigma>#} \\<longrightarrow> I \\<Turnstile> C)\"\n    \"(\\<forall>D'. D' \\<in># {#D \\<cdot> \\<sigma>#} \\<longrightarrow> D' < C)\"\n    by auto\n  then show ?thesis\n    using sr.Rf_def by blast\nqed\n\nlemma strict_subset_subsumption_redundant_clss:\n  assumes\n    \"D \\<cdot> \\<sigma> \\<subset># C\" and\n    \"is_ground_subst \\<sigma>\" and\n    \"D \\<in> CC\"\n  shows \"C \\<in> sr.Rf (grounding_of_clss CC)\"\n  using assms\nproof -\n  have \"C \\<in> sr.Rf (grounding_of_cls D)\"\n    using strict_subset_subsumption_redundant_clause assms by auto\n  then show ?thesis\n    using assms unfolding grounding_of_clss_def\n    by (metis (no_types) sr.Rf_mono sup_ge1 SUP_absorb contra_subsetD)\nqed\n\nlemma strict_subset_subsumption_grounding_redundant_clss:\n  assumes\n    D\\<sigma>_subset_C: \"D \\<cdot> \\<sigma> \\<subset># C\" and\n    D_in_St: \"D \\<in> CC\"\n  shows \"grounding_of_cls C \\<subseteq> sr.Rf (grounding_of_clss CC)\"\nproof\n  fix C\\<mu>\n  assume \"C\\<mu> \\<in> grounding_of_cls C\"\n  then obtain \\<mu> where\n    \\<mu>_p: \"C\\<mu> = C \\<cdot> \\<mu> \\<and> is_ground_subst \\<mu>\"\n    unfolding grounding_of_cls_def by auto\n  have D\\<sigma>\\<mu>C\\<mu>: \"D \\<cdot> \\<sigma> \\<cdot> \\<mu> \\<subset># C \\<cdot> \\<mu>\"\n    using D\\<sigma>_subset_C subst_subset_mono by auto\n  then show \"C\\<mu> \\<in> sr.Rf (grounding_of_clss CC)\"\n    using \\<mu>_p strict_subset_subsumption_redundant_clss[of D \"\\<sigma> \\<odot> \\<mu>\" \"C \\<cdot> \\<mu>\"] D_in_St by auto\nqed\n\nlemma derive_if_remove_subsumed:\n  assumes\n    \"D \\<in> clss_of_state St\" and\n    \"subsumes D C\"\n  shows \"sr_ext.derive (grounding_of_state St \\<union> grounding_of_cls C) (grounding_of_state St)\"\nproof -\n  from assms obtain \\<sigma> where\n    \"D \\<cdot> \\<sigma> = C \\<or> D \\<cdot> \\<sigma> \\<subset># C\"\n    by (auto simp: subsumes_def subset_mset_def)\n  then have \"D \\<cdot> \\<sigma> = C \\<or> D \\<cdot> \\<sigma> \\<subset># C\"\n    by (simp add: subset_mset_def)\n  then show ?thesis\n  proof\n    assume \"D \\<cdot> \\<sigma> = C\"\n    then have \"grounding_of_cls C \\<subseteq> grounding_of_cls D\"\n      using subst_cls_eq_grounding_of_cls_subset_eq\n      by (auto dest: sym)\n    then have \"(grounding_of_state St \\<union> grounding_of_cls C) = grounding_of_state St\"\n      using assms unfolding grounding_of_clss_def by auto\n    then show ?thesis\n      by (auto intro: sr_ext.derive.intros)\n  next\n    assume a: \"D \\<cdot> \\<sigma> \\<subset># C\"\n    then have \"grounding_of_cls C \\<subseteq> sr.Rf (grounding_of_state St)\"\n      using strict_subset_subsumption_grounding_redundant_clss assms by auto\n    then show ?thesis\n      unfolding grounding_of_clss_def by (force intro: sr_ext.derive.intros)\n  qed\nqed\n\nlemma reduction_in_concls_of:\n  assumes\n    \"C\\<mu> \\<in> grounding_of_cls C\" and\n    \"D + {#L'#} \\<in> CC\" and\n    \"- L = L' \\<cdot>l \\<sigma>\" and\n    \"D \\<cdot> \\<sigma> \\<subseteq># C\"\n  shows \"C\\<mu> \\<in> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \\<union> {C + {#L#}})))\"\nproof -\n  from assms\n  obtain \\<mu> where\n    \\<mu>_p: \"C\\<mu> = C \\<cdot> \\<mu> \\<and> is_ground_subst \\<mu>\"\n    unfolding grounding_of_cls_def by auto\n\n  define \\<gamma> where\n    \"\\<gamma> = Infer {#(C + {#L#}) \\<cdot> \\<mu>#} ((D + {#L'#}) \\<cdot> \\<sigma> \\<cdot> \\<mu>) (C \\<cdot> \\<mu>)\"\n\n  have \"(D + {#L'#}) \\<cdot> \\<sigma> \\<cdot> \\<mu> \\<in> grounding_of_clss (CC \\<union> {C + {#L#}})\"\n    unfolding grounding_of_clss_def grounding_of_cls_def\n    by (rule UN_I[of \"D + {#L'#}\"], use assms(2) in simp,\n        metis (mono_tags, lifting) \\<mu>_p is_ground_comp_subst mem_Collect_eq subst_cls_comp_subst)\n  moreover have \"(C + {#L#}) \\<cdot> \\<mu> \\<in> grounding_of_clss (CC \\<union> {C + {#L#}})\"\n    using \\<mu>_p unfolding  grounding_of_clss_def grounding_of_cls_def by auto\n  moreover have\n    \"\\<forall>I. I \\<Turnstile> D \\<cdot> \\<sigma> \\<cdot> \\<mu> + {#- (L  \\<cdot>l \\<mu>)#} \\<longrightarrow> I \\<Turnstile> C  \\<cdot> \\<mu> + {#L  \\<cdot>l \\<mu>#} \\<longrightarrow> I \\<Turnstile> D \\<cdot> \\<sigma> \\<cdot> \\<mu> + C \\<cdot> \\<mu>\"\n    by auto\n  then have \"\\<forall>I. I \\<Turnstile> (D + {#L'#}) \\<cdot> \\<sigma> \\<cdot> \\<mu> \\<longrightarrow> I \\<Turnstile> (C + {#L#}) \\<cdot> \\<mu> \\<longrightarrow> I \\<Turnstile> D \\<cdot> \\<sigma> \\<cdot> \\<mu> + C \\<cdot> \\<mu>\"\n    using assms\n    by (metis add_mset_add_single subst_cls_add_mset subst_cls_union subst_minus)\n  then have \"\\<forall>I. I \\<Turnstile> (D + {#L'#}) \\<cdot> \\<sigma> \\<cdot> \\<mu> \\<longrightarrow> I \\<Turnstile> (C + {#L#}) \\<cdot> \\<mu> \\<longrightarrow> I \\<Turnstile> C \\<cdot> \\<mu>\"\n    using assms by (metis (no_types, lifting) subset_mset.le_iff_add subst_cls_union true_cls_union)\n  then have \"\\<forall>I. I \\<Turnstile>m {#(D + {#L'#}) \\<cdot> \\<sigma> \\<cdot> \\<mu>#} \\<longrightarrow> I \\<Turnstile> (C + {#L#}) \\<cdot> \\<mu> \\<longrightarrow> I \\<Turnstile> C \\<cdot> \\<mu>\"\n    by (meson true_cls_mset_singleton)\n  ultimately have \"\\<gamma> \\<in> sr_ext.inferences_from (grounding_of_clss (CC \\<union> {C + {#L#}}))\"\n    unfolding sr_ext.inferences_from_def unfolding ground_sound_\\<Gamma>_def infer_from_def \\<gamma>_def by auto\n  then have \"C \\<cdot> \\<mu> \\<in> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \\<union> {C + {#L#}})))\"\n    using image_iff unfolding \\<gamma>_def by fastforce\n  then show \"C\\<mu> \\<in> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \\<union> {C + {#L#}})))\"\n    using \\<mu>_p by auto\nqed\n\nlemma reduction_derivable:\n  assumes\n    \"D + {#L'#} \\<in> CC\" and\n    \"- L = L' \\<cdot>l \\<sigma>\" and\n    \"D \\<cdot> \\<sigma> \\<subseteq># C\"\n  shows \"sr_ext.derive (grounding_of_clss (CC \\<union> {C + {#L#}})) (grounding_of_clss (CC \\<union> {C}))\"\nproof -\n  from assms have \"grounding_of_clss (CC \\<union> {C}) - grounding_of_clss (CC \\<union> {C + {#L#}})\n    \\<subseteq> concls_of (sr_ext.inferences_from (grounding_of_clss (CC \\<union> {C + {#L#}})))\"\n    using reduction_in_concls_of unfolding grounding_of_clss_def by auto\n  moreover\n  have \"grounding_of_cls (C + {#L#}) \\<subseteq> sr.Rf (grounding_of_clss (CC \\<union> {C}))\"\n    using strict_subset_subsumption_grounding_redundant_clss[of C \"id_subst\"]\n    by auto\n  then have \"grounding_of_clss (CC \\<union> {C + {#L#}}) - grounding_of_clss (CC \\<union> {C})\n    \\<subseteq> sr.Rf (grounding_of_clss (CC \\<union> {C}))\"\n    unfolding grounding_of_clss_def by auto\n  ultimately show\n    \"sr_ext.derive (grounding_of_clss (CC \\<union> {C + {#L#}})) (grounding_of_clss (CC \\<union> {C}))\"\n    using sr_ext.derive.intros[of \"grounding_of_clss (CC \\<union> {C})\"\n        \"grounding_of_clss (CC \\<union> {C + {#L#}})\"]\n    by auto\nqed\n\ntext \\<open>\nThe following corresponds the part of Lemma 4.10 that states we have a theorem proving process:\n\\<close>\n\nlemma RP_ground_derive:\n  \"St \\<leadsto> St' \\<Longrightarrow> sr_ext.derive (grounding_of_state St) (grounding_of_state St')\"\nproof (induction rule: RP.induct)\n  case (tautology_deletion A C N P Q)\n  {\n    fix C\\<sigma>\n    assume \"C\\<sigma> \\<in> grounding_of_cls C\"\n    then obtain \\<sigma> where\n      \"C\\<sigma> = C \\<cdot> \\<sigma>\"\n      unfolding grounding_of_cls_def by auto\n    then have \"Neg (A \\<cdot>a \\<sigma>) \\<in># C\\<sigma> \\<and> Pos (A \\<cdot>a \\<sigma>) \\<in># C\\<sigma>\"\n      using tautology_deletion Neg_Melem_subst_atm_subst_cls Pos_Melem_subst_atm_subst_cls by auto\n    then have \"C\\<sigma> \\<in> sr.Rf (grounding_of_state (N, P, Q))\"\n      using sr.tautology_Rf by auto\n  }\n  then have \"grounding_of_state (N \\<union> {C}, P, Q) - grounding_of_state (N, P, Q)\n    \\<subseteq> sr.Rf (grounding_of_state (N, P, Q))\"\n    unfolding grounding_of_clss_def by auto\n  moreover have \"grounding_of_state (N, P, Q) - grounding_of_state (N \\<union> {C}, P, Q) = {}\"\n    unfolding grounding_of_clss_def by auto\n  ultimately show ?case\n    using sr_ext.derive.intros[of \"grounding_of_state (N, P, Q)\"\n      \"grounding_of_state (N \\<union> {C}, P, Q)\"]\n    by auto\nnext\n  case (forward_subsumption D P Q C N)\n  then show ?case\n    using derive_if_remove_subsumed[of D \"(N, P, Q)\" C] unfolding grounding_of_clss_def\n    by (simp add: sup_commute sup_left_commute)\nnext\n  case (backward_subsumption_P D N C P Q)\n  then show ?case\n    using derive_if_remove_subsumed[of D \"(N, P, Q)\" C] strictly_subsumes_def\n    unfolding grounding_of_clss_def by (simp add: sup_commute sup_left_commute)\nnext\n  case (backward_subsumption_Q D N C P Q)\n  then show ?case\n    using derive_if_remove_subsumed[of D \"(N, P, Q)\" C] strictly_subsumes_def\n    unfolding grounding_of_clss_def by (simp add: sup_commute sup_left_commute)\nnext\n  case (forward_reduction D L' P Q L \\<sigma> C N)\n  then show ?case\n    using reduction_derivable[of _ _ \"N \\<union> P \\<union> Q\"] by force\nnext\n  case (backward_reduction_P D L' N L \\<sigma> C P Q)\n  then show ?case\n    using reduction_derivable[of _ _ \"N \\<union> P \\<union> Q\"] by force\nnext\n  case (backward_reduction_Q D L' N L \\<sigma> C P Q)\n  then show ?case\n    using reduction_derivable[of _ _ \"N \\<union> P \\<union> Q\"] by force\nnext\n  case (clause_processing N C P Q)\n  then show ?case\n    using sr_ext.derive.intros by auto\nnext\n  case (inference_computation N Q C P)\n  {\n    fix E\\<mu>\n    assume \"E\\<mu> \\<in> grounding_of_clss N\"\n    then obtain \\<mu> E where\n      E_\\<mu>_p: \"E\\<mu> = E \\<cdot> \\<mu> \\<and> E \\<in> N \\<and> is_ground_subst \\<mu>\"\n      unfolding grounding_of_clss_def grounding_of_cls_def by auto\n    then have E_concl: \"E \\<in> concls_of (ord_FO_resolution.inferences_between Q C)\"\n      using inference_computation by auto\n    then obtain \\<gamma> where\n      \\<gamma>_p: \"\\<gamma> \\<in> ord_FO_\\<Gamma> S \\<and> infer_from (Q \\<union> {C}) \\<gamma> \\<and> C \\<in># prems_of \\<gamma> \\<and> concl_of \\<gamma> = E\"\n      unfolding ord_FO_resolution.inferences_between_def by auto\n    then obtain CC CAs D AAs As \\<sigma> where\n      \\<gamma>_p2: \"\\<gamma> = Infer CC D E \\<and> ord_resolve_rename S CAs D AAs As \\<sigma> E \\<and> mset CAs = CC\"\n      unfolding ord_FO_\\<Gamma>_def by auto\n    define \\<rho> where\n      \"\\<rho> = hd (renamings_apart (D # CAs))\"\n    define \\<rho>s where\n      \"\\<rho>s = tl (renamings_apart (D # CAs))\"\n    define \\<gamma>_ground where\n      \"\\<gamma>_ground = Infer (mset (CAs \\<cdot>\\<cdot>cl \\<rho>s) \\<cdot>cm \\<sigma> \\<cdot>cm \\<mu>) (D \\<cdot> \\<rho> \\<cdot> \\<sigma> \\<cdot> \\<mu>) (E \\<cdot> \\<mu>)\"\n    have \"\\<forall>I. I \\<Turnstile>m mset (CAs \\<cdot>\\<cdot>cl \\<rho>s) \\<cdot>cm \\<sigma> \\<cdot>cm \\<mu> \\<longrightarrow> I \\<Turnstile> D \\<cdot> \\<rho> \\<cdot> \\<sigma> \\<cdot> \\<mu> \\<longrightarrow> I \\<Turnstile> E \\<cdot> \\<mu>\"\n      using ord_resolve_rename_ground_inst_sound[of _ _ _ _ _ _ _ _ _ _ \\<mu>] \\<rho>_def \\<rho>s_def E_\\<mu>_p \\<gamma>_p2\n      by auto\n    then have \"\\<gamma>_ground \\<in> {Infer cc d e | cc d e. \\<forall>I. I \\<Turnstile>m cc \\<longrightarrow> I \\<Turnstile> d \\<longrightarrow> I \\<Turnstile> e}\"\n      unfolding \\<gamma>_ground_def by auto\n    moreover have \"set_mset (prems_of \\<gamma>_ground) \\<subseteq> grounding_of_state ({}, P \\<union> {C}, Q)\"\n    proof -\n      have \"D = C \\<or> D \\<in> Q\"\n        unfolding \\<gamma>_ground_def using E_\\<mu>_p \\<gamma>_p2 \\<gamma>_p unfolding infer_from_def\n        unfolding grounding_of_clss_def grounding_of_cls_def by simp\n      then have \"D \\<cdot> \\<rho> \\<cdot> \\<sigma> \\<cdot> \\<mu> \\<in> grounding_of_cls C \\<or> (\\<exists>x \\<in> Q. D \\<cdot> \\<rho> \\<cdot> \\<sigma> \\<cdot> \\<mu> \\<in> grounding_of_cls x)\"\n        using E_\\<mu>_p\n        unfolding grounding_of_cls_def\n        by (metis (mono_tags, lifting) is_ground_comp_subst mem_Collect_eq subst_cls_comp_subst)\n      then have \"(D \\<cdot> \\<rho> \\<cdot> \\<sigma> \\<cdot> \\<mu> \\<in> grounding_of_cls C \\<or>\n        (\\<exists>x \\<in> P. D \\<cdot> \\<rho> \\<cdot> \\<sigma> \\<cdot> \\<mu> \\<in> grounding_of_cls x) \\<or>\n        (\\<exists>x \\<in> Q. D \\<cdot> \\<rho> \\<cdot> \\<sigma> \\<cdot> \\<mu> \\<in> grounding_of_cls x))\"\n        by metis\n      moreover have \"\\<forall>i < length (CAs \\<cdot>\\<cdot>cl \\<rho>s \\<cdot>cl \\<sigma> \\<cdot>cl \\<mu>). (CAs \\<cdot>\\<cdot>cl \\<rho>s \\<cdot>cl \\<sigma> \\<cdot>cl \\<mu>) ! i \\<in>\n        {C \\<cdot> \\<sigma> |\\<sigma>. is_ground_subst \\<sigma>} \\<union>\n        ((\\<Union>C \\<in> P. {C \\<cdot> \\<sigma> | \\<sigma>. is_ground_subst \\<sigma>}) \\<union> (\\<Union>C\\<in>Q. {C \\<cdot> \\<sigma> | \\<sigma>. is_ground_subst \\<sigma>}))\"\n      proof (rule, rule)\n        fix i\n        assume \"i < length (CAs \\<cdot>\\<cdot>cl \\<rho>s \\<cdot>cl \\<sigma> \\<cdot>cl \\<mu>)\"\n        then have a: \"i < length CAs \\<and> i < length \\<rho>s\"\n          by simp\n        moreover from a have \"CAs ! i \\<in> {C} \\<union> Q\"\n          using \\<gamma>_p2 \\<gamma>_p unfolding infer_from_def\n          by (metis (no_types, lifting) Un_subset_iff inference.sel(1) set_mset_union\n              sup_commute nth_mem_mset subsetCE)\n        ultimately have \"(CAs \\<cdot>\\<cdot>cl \\<rho>s \\<cdot>cl \\<sigma> \\<cdot>cl \\<mu>) ! i \\<in>\n          {C \\<cdot> \\<sigma> |\\<sigma>. is_ground_subst \\<sigma>} \\<or>\n          ((CAs \\<cdot>\\<cdot>cl \\<rho>s \\<cdot>cl \\<sigma> \\<cdot>cl \\<mu>) ! i \\<in> (\\<Union>C\\<in>P. {C \\<cdot> \\<sigma> |\\<sigma>. is_ground_subst \\<sigma>}) \\<or>\n          (CAs \\<cdot>\\<cdot>cl \\<rho>s \\<cdot>cl \\<sigma> \\<cdot>cl \\<mu>) ! i \\<in> (\\<Union>C \\<in> Q. {C \\<cdot> \\<sigma> | \\<sigma>. is_ground_subst \\<sigma>}))\"\n          using E_\\<mu>_p \\<gamma>_p2 \\<gamma>_p\n          unfolding \\<gamma>_ground_def infer_from_def grounding_of_clss_def grounding_of_cls_def\n          apply -\n          apply (cases \"CAs ! i = C\")\n          subgoal\n            apply (rule disjI1)\n            apply (rule Set.CollectI)\n            apply (rule_tac x = \"(\\<rho>s ! i) \\<odot> \\<sigma> \\<odot> \\<mu>\" in exI)\n            using \\<rho>s_def using renamings_apart_length by (auto; fail)\n          subgoal\n            apply (rule disjI2)\n            apply (rule disjI2)\n            apply (rule_tac a = \"CAs ! i\" in UN_I)\n            subgoal by blast\n            subgoal\n              apply (rule Set.CollectI)\n              apply (rule_tac x = \"(\\<rho>s ! i) \\<odot> \\<sigma> \\<odot> \\<mu>\" in exI)\n              using \\<rho>s_def using renamings_apart_length by (auto; fail)\n            done\n          done\n        then show \"(CAs \\<cdot>\\<cdot>cl \\<rho>s \\<cdot>cl \\<sigma> \\<cdot>cl \\<mu>) ! i \\<in> {C \\<cdot> \\<sigma> |\\<sigma>. is_ground_subst \\<sigma>} \\<union>\n          ((\\<Union>C \\<in> P. {C \\<cdot> \\<sigma> |\\<sigma>. is_ground_subst \\<sigma>}) \\<union> (\\<Union>C \\<in> Q. {C \\<cdot> \\<sigma> |\\<sigma>. is_ground_subst \\<sigma>}))\"\n          by blast\n      qed\n      then have \"\\<forall>x \\<in># mset (CAs \\<cdot>\\<cdot>cl \\<rho>s \\<cdot>cl \\<sigma> \\<cdot>cl \\<mu>). x \\<in> {C \\<cdot> \\<sigma> |\\<sigma>. is_ground_subst \\<sigma>} \\<union>\n        ((\\<Union>C \\<in> P. {C \\<cdot> \\<sigma> |\\<sigma>. is_ground_subst \\<sigma>}) \\<union> (\\<Union>C \\<in> Q. {C \\<cdot> \\<sigma> |\\<sigma>. is_ground_subst \\<sigma>}))\"\n        by (metis (lifting) in_set_conv_nth set_mset_mset)\n      then have \"set_mset (mset (CAs \\<cdot>\\<cdot>cl \\<rho>s) \\<cdot>cm \\<sigma> \\<cdot>cm \\<mu>) \\<subseteq>\n        grounding_of_cls C \\<union> grounding_of_clss P \\<union> grounding_of_clss Q\"\n        unfolding grounding_of_cls_def grounding_of_clss_def\n        using mset_subst_cls_list_subst_cls_mset by auto\n      ultimately show ?thesis\n        unfolding \\<gamma>_ground_def grounding_of_clss_def by auto\n    qed\n    ultimately have\n      \"E \\<cdot> \\<mu> \\<in> concls_of (sr_ext.inferences_from (grounding_of_state ({}, P \\<union> {C}, Q)))\"\n      unfolding sr_ext.inferences_from_def inference_system.inferences_from_def ground_sound_\\<Gamma>_def\n        infer_from_def\n      using \\<gamma>_ground_def by (metis (mono_tags, lifting) image_eqI inference.sel(3) mem_Collect_eq)\n    then have \"E\\<mu> \\<in> concls_of (sr_ext.inferences_from (grounding_of_state ({}, P \\<union> {C}, Q)))\"\n      using E_\\<mu>_p by auto\n  }\n  then have \"grounding_of_state (N, P, Q \\<union> {C}) - grounding_of_state ({}, P \\<union> {C}, Q)\n    \\<subseteq> concls_of (sr_ext.inferences_from (grounding_of_state ({}, P \\<union> {C}, Q)))\"\n    unfolding grounding_of_clss_def by auto\n  moreover have \"grounding_of_state ({}, P \\<union> {C}, Q) - grounding_of_state (N, P, Q \\<union> {C}) = {}\"\n    unfolding grounding_of_clss_def by auto\n  ultimately show ?case\n    using sr_ext.derive.intros[of \"(grounding_of_state (N, P, Q \\<union> {C}))\"\n        \"(grounding_of_state ({}, P \\<union> {C}, Q))\"] by auto\nqed\n\ntext \\<open>\nA useful consequence:\n\\<close>\n\ntheorem RP_model: \"St \\<leadsto> St' \\<Longrightarrow> I \\<Turnstile>s grounding_of_state St' \\<longleftrightarrow> I \\<Turnstile>s grounding_of_state St\"\nproof (drule RP_ground_derive, erule sr_ext.derive.cases, hypsubst)\n  let\n    ?gSt = \"grounding_of_state St\" and\n    ?gSt' = \"grounding_of_state St'\"\n\n  assume\n    deduct: \"?gSt' - ?gSt \\<subseteq> concls_of (sr_ext.inferences_from ?gSt)\" (is \"_ \\<subseteq> ?concls\") and\n    delete: \"?gSt - ?gSt' \\<subseteq> sr.Rf ?gSt'\"\n\n  show \"I \\<Turnstile>s ?gSt' \\<longleftrightarrow> I \\<Turnstile>s ?gSt\"\n  proof\n    assume bef: \"I \\<Turnstile>s ?gSt\"\n    then have \"I \\<Turnstile>s ?concls\"\n      unfolding ground_sound_\\<Gamma>_def inference_system.inferences_from_def true_clss_def\n        true_cls_mset_def\n      by (auto simp add: image_def infer_from_def dest!: spec[of _ I])\n    then have diff: \"I \\<Turnstile>s ?gSt' - ?gSt\"\n      using deduct by (blast intro: true_clss_mono)\n    then show \"I \\<Turnstile>s ?gSt'\"\n      using bef unfolding true_clss_def by blast\n  next\n    assume aft: \"I \\<Turnstile>s ?gSt'\"\n    have \"I \\<Turnstile>s ?gSt' \\<union> sr.Rf ?gSt'\"\n      by (rule sr.Rf_model) (smt Diff_eq_empty_iff Diff_subset Un_Diff aft\n          standard_redundancy_criterion.Rf_mono sup_bot.right_neutral sup_ge1 true_clss_mono)\n    then have \"I \\<Turnstile>s sr.Rf ?gSt'\"\n      using true_clss_union by blast\n    then have diff: \"I \\<Turnstile>s ?gSt - ?gSt'\"\n      using delete by (blast intro: true_clss_mono)\n    then show \"I \\<Turnstile>s ?gSt\"\n      using aft unfolding true_clss_def by blast\n  qed\nqed\n\ntext \\<open>\nAnother formulation of the part of Lemma 4.10 that states we have a theorem proving process:\n\\<close>\n\nlemma ground_derive_chain: \"chain (\\<leadsto>) Sts \\<Longrightarrow> chain sr_ext.derive (lmap grounding_of_state Sts)\"\n  using RP_ground_derive by (simp add: chain_lmap[of \"(\\<leadsto>)\"])\n\ntext \\<open>\nThe following is used prove to Lemma 4.11:\n\\<close>\n\nlemma Sup_llist_grounding_of_state_ground:\n  assumes \"C \\<in> Sup_llist (lmap grounding_of_state Sts)\"\n  shows \"is_ground_cls C\"\nproof -\n  have \"\\<exists>j. enat j < llength (lmap grounding_of_state Sts)\n    \\<and> C \\<in> lnth (lmap grounding_of_state Sts) j\"\n    using assms Sup_llist_imp_exists_index by fast\n  then show ?thesis\n    unfolding grounding_of_clss_def grounding_of_cls_def by auto\nqed\n\nlemma Liminf_grounding_of_state_ground:\n  \"C \\<in> Liminf_llist (lmap grounding_of_state Sts) \\<Longrightarrow> is_ground_cls C\"\n  using Liminf_llist_subset_Sup_llist[of \"lmap grounding_of_state Sts\"]\n    Sup_llist_grounding_of_state_ground\n  by blast\n\nlemma in_Sup_llist_in_Sup_state:\n  assumes \"C \\<in> Sup_llist (lmap grounding_of_state Sts)\"\n  shows \"\\<exists>D \\<sigma>. D \\<in> clss_of_state (Sup_state Sts) \\<and> D \\<cdot> \\<sigma> = C \\<and> is_ground_subst \\<sigma>\"\nproof -\n  from assms obtain i where\n    i_p: \"enat i < llength Sts \\<and> C \\<in> lnth (lmap grounding_of_state Sts) i\"\n    using Sup_llist_imp_exists_index by fastforce\n  then obtain D \\<sigma> where\n    \"D \\<in> clss_of_state (lnth Sts i) \\<and> D \\<cdot> \\<sigma> = C \\<and> is_ground_subst \\<sigma>\"\n    using assms unfolding grounding_of_clss_def grounding_of_cls_def by fastforce\n  then have \"D \\<in> clss_of_state (Sup_state Sts) \\<and> D \\<cdot> \\<sigma> = C \\<and> is_ground_subst \\<sigma>\"\n    using i_p unfolding Sup_state_def\n    by (metis (no_types, lifting) UnCI UnE contra_subsetD N_of_state.simps P_of_state.simps\n        Q_of_state.simps llength_lmap lnth_lmap lnth_subset_Sup_llist)\n  then show ?thesis\n    by auto\nqed\n\nlemma\n  N_of_state_Liminf: \"N_of_state (Liminf_state Sts) = Liminf_llist (lmap N_of_state Sts)\" and\n  P_of_state_Liminf: \"P_of_state (Liminf_state Sts) = Liminf_llist (lmap P_of_state Sts)\"\n  unfolding Liminf_state_def by auto\n\nlemma eventually_removed_from_N:\n  assumes\n    d_in: \"D \\<in> N_of_state (lnth Sts i)\" and\n    fair: \"fair_state_seq Sts\" and\n    i_Sts: \"enat i < llength Sts\"\n  shows \"\\<exists>l. D \\<in> N_of_state (lnth Sts l) \\<and> D \\<notin> N_of_state (lnth Sts (Suc l)) \\<and> i \\<le> l\n    \\<and> enat (Suc l) < llength Sts\"\nproof (rule ccontr)\n  assume a: \"\\<not> ?thesis\"\n  have \"i \\<le> l \\<Longrightarrow> enat l < llength Sts \\<Longrightarrow> D \\<in> N_of_state (lnth Sts l)\" for l\n    using d_in by (induction l, blast, metis a Suc_ile_eq le_SucE less_imp_le)\n  then have \"D \\<in> Liminf_llist (lmap N_of_state Sts)\"\n    unfolding Liminf_llist_def using i_Sts by auto\n  then show False\n    using fair unfolding fair_state_seq_def by (simp add: N_of_state_Liminf)\nqed\n\nlemma eventually_removed_from_P:\n  assumes\n    d_in: \"D \\<in> P_of_state (lnth Sts i)\" and\n    fair: \"fair_state_seq Sts\" and\n    i_Sts: \"enat i < llength Sts\"\n  shows \"\\<exists>l. D \\<in> P_of_state (lnth Sts l) \\<and> D \\<notin> P_of_state (lnth Sts (Suc l)) \\<and> i \\<le> l\n    \\<and> enat (Suc l) < llength Sts\"\nproof (rule ccontr)\n  assume a: \"\\<not> ?thesis\"\n  have \"i \\<le> l \\<Longrightarrow> enat l < llength Sts \\<Longrightarrow> D \\<in> P_of_state (lnth Sts l)\" for l\n    using d_in by (induction l, blast, metis a Suc_ile_eq le_SucE less_imp_le)\n  then have \"D \\<in> Liminf_llist (lmap P_of_state Sts)\"\n    unfolding Liminf_llist_def using i_Sts by auto\n  then show False\n    using fair unfolding fair_state_seq_def by (simp add: P_of_state_Liminf)\nqed\n\nlemma instance_if_subsumed_and_in_limit:\n  assumes\n    deriv: \"chain (\\<leadsto>) Sts\" and\n    ns: \"Gs = lmap grounding_of_state Sts\" and\n    c: \"C \\<in> Liminf_llist Gs - sr.Rf (Liminf_llist Gs)\" and\n    d: \"D \\<in> clss_of_state (lnth Sts i)\" \"enat i < llength Sts\" \"subsumes D C\"\n  shows \"\\<exists>\\<sigma>. D \\<cdot> \\<sigma> = C \\<and> is_ground_subst \\<sigma>\"\nproof -\n  let ?Ps = \"\\<lambda>i. P_of_state (lnth Sts i)\"\n  let ?Qs = \"\\<lambda>i. Q_of_state (lnth Sts i)\"\n\n  have ground_C: \"is_ground_cls C\"\n    using c using Liminf_grounding_of_state_ground ns by auto\n\n  have derivns: \"chain sr_ext.derive Gs\"\n    using ground_derive_chain deriv ns by auto\n\n  have \"\\<exists>\\<sigma>. D \\<cdot> \\<sigma> = C\"\n  proof (rule ccontr)\n    assume \"\\<nexists>\\<sigma>. D \\<cdot> \\<sigma> = C\"\n    moreover from d(3) obtain \\<tau>_proto where\n      \"D \\<cdot> \\<tau>_proto \\<subseteq># C\" unfolding subsumes_def\n      by blast\n    then obtain \\<tau> where\n      \\<tau>_p: \"D \\<cdot> \\<tau> \\<subseteq># C \\<and> is_ground_subst \\<tau>\"\n      using ground_C by (metis is_ground_cls_mono make_ground_subst subset_mset.order_refl)\n    ultimately have subsub: \"D \\<cdot> \\<tau> \\<subset># C\"\n      using subset_mset.le_imp_less_or_eq by auto\n    moreover have \"is_ground_subst \\<tau>\"\n      using \\<tau>_p by auto\n    moreover have \"D \\<in> clss_of_state (lnth Sts i)\"\n      using d by auto\n    ultimately have \"C \\<in> sr.Rf (grounding_of_state (lnth Sts i))\"\n      using strict_subset_subsumption_redundant_clss by auto\n    then have \"C \\<in> sr.Rf (Sup_llist Gs)\"\n      using d ns by (smt contra_subsetD llength_lmap lnth_lmap lnth_subset_Sup_llist sr.Rf_mono)\n    then have \"C \\<in> sr.Rf (Liminf_llist Gs)\"\n      unfolding ns using local.sr_ext.Rf_limit_Sup derivns ns by auto\n    then show False\n      using c by auto\n  qed\n  then obtain \\<sigma> where\n    \"D \\<cdot> \\<sigma> = C \\<and> is_ground_subst \\<sigma>\"\n    using ground_C by (metis make_ground_subst)\n  then show ?thesis\n    by auto\nqed\n\nlemma from_Q_to_Q_inf:\n  assumes\n    deriv: \"chain (\\<leadsto>) Sts\" and\n    fair: \"fair_state_seq Sts\" and\n    ns: \"Gs = lmap grounding_of_state Sts\" and\n    c: \"C \\<in> Liminf_llist Gs - sr.Rf (Liminf_llist Gs)\" and\n    d: \"D \\<in> Q_of_state (lnth Sts i)\" \"enat i < llength Sts\" \"subsumes D C\" and\n    d_least: \"\\<forall>E \\<in> {E. E \\<in> (clss_of_state (Sup_state Sts)) \\<and> subsumes E C}.\n      \\<not> strictly_subsumes E D\"\n  shows \"D \\<in> Q_of_state (Liminf_state Sts)\"\nproof -\n  let ?Ps = \"\\<lambda>i. P_of_state (lnth Sts i)\"\n  let ?Qs = \"\\<lambda>i. Q_of_state (lnth Sts i)\"\n\n  have ground_C: \"is_ground_cls C\"\n    using c using Liminf_grounding_of_state_ground ns by auto\n\n  have derivns: \"chain sr_ext.derive Gs\"\n    using ground_derive_chain deriv ns by auto\n\n  have \"\\<exists>\\<sigma>. D \\<cdot> \\<sigma> = C \\<and> is_ground_subst \\<sigma>\"\n    using instance_if_subsumed_and_in_limit[OF deriv] c d unfolding ns by blast\n  then obtain \\<sigma> where\n    \\<sigma>: \"D \\<cdot> \\<sigma> = C\" \"is_ground_subst \\<sigma>\"\n    by auto\n\n  have in_Sts_in_Sts_Suc:\n    \"\\<forall>l \\<ge> i. enat (Suc l) < llength Sts \\<longrightarrow> D \\<in> Q_of_state (lnth Sts l) \\<longrightarrow>\n       D \\<in> Q_of_state (lnth Sts (Suc l))\"\n  proof (rule, rule, rule, rule)\n    fix l\n    assume\n      len: \"i \\<le> l\" and\n      llen: \"enat (Suc l) < llength Sts\" and\n      d_in_q: \"D \\<in> Q_of_state (lnth Sts l)\"\n\n    have \"lnth Sts l \\<leadsto> lnth Sts (Suc l)\"\n      using llen deriv chain_lnth_rel by blast\n    then show \"D \\<in> Q_of_state (lnth Sts (Suc l))\"\n    proof (cases rule: RP.cases)\n      case (backward_subsumption_Q D' N D_removed P Q)\n      moreover\n      {\n        assume \"D_removed = D\"\n        then obtain D_subsumes where\n          D_subsumes_p: \"D_subsumes \\<in> N \\<and> strictly_subsumes D_subsumes D\"\n          using backward_subsumption_Q by auto\n        moreover from D_subsumes_p have \"subsumes D_subsumes C\"\n          using d subsumes_trans unfolding strictly_subsumes_def by blast\n        moreover from backward_subsumption_Q have \"D_subsumes \\<in> clss_of_state (Sup_state Sts)\"\n          using D_subsumes_p llen\n          by (metis (no_types) UnI1 N_of_state.simps llength_lmap lnth_lmap lnth_subset_Sup_llist\n              rev_subsetD Sup_state_def)\n        ultimately have False\n          using d_least unfolding subsumes_def by auto\n      }\n      ultimately show ?thesis\n        using d_in_q by auto\n    next\n      case (backward_reduction_Q E L' N L \\<sigma> D' P Q)\n      {\n        assume \"D' + {#L#} = D\"\n        then have D'_p: \"strictly_subsumes D' D \\<and> D' \\<in> ?Ps (Suc l)\"\n          using subset_strictly_subsumes[of D' D] backward_reduction_Q by auto\n        then have subc: \"subsumes D' C\"\n          using d(3) subsumes_trans unfolding strictly_subsumes_def by auto\n        from D'_p have \"D' \\<in> clss_of_state (Sup_state Sts)\"\n          using llen by (metis (no_types) UnI1 P_of_state.simps llength_lmap lnth_lmap\n              lnth_subset_Sup_llist subsetCE sup_ge2 Sup_state_def)\n        then have False\n          using d_least D'_p subc by auto\n      }\n      then show ?thesis\n        using backward_reduction_Q d_in_q by auto\n    qed (use d_in_q in auto)\n  qed\n  have D_in_Sts: \"D \\<in> Q_of_state (lnth Sts l)\" and D_in_Sts_Suc: \"D \\<in> Q_of_state (lnth Sts (Suc l))\"\n    if l_i: \"l \\<ge> i\" and enat: \"enat (Suc l) < llength Sts\" for l\n  proof -\n    show \"D \\<in> Q_of_state (lnth Sts l)\"\n      using l_i enat\n      apply (induction \"l - i\" arbitrary: l)\n      subgoal using d by auto\n      subgoal using d(1) in_Sts_in_Sts_Suc\n        by (metis (no_types, lifting) Suc_ile_eq add_Suc_right add_diff_cancel_left' le_SucE\n            le_Suc_ex less_imp_le)\n      done\n    then show \"D \\<in> Q_of_state (lnth Sts (Suc l))\"\n      using l_i enat in_Sts_in_Sts_Suc by blast\n  qed\n  have \"i \\<le> x \\<Longrightarrow> enat x < llength Sts \\<Longrightarrow> D \\<in> Q_of_state (lnth Sts x)\" for x\n    apply (cases x)\n    subgoal using d(1) by (auto intro!: exI[of _ i] simp: less_Suc_eq)\n    subgoal for x'\n      using d(1) D_in_Sts_Suc[of x'] by (cases \\<open>i \\<le> x'\\<close>) (auto simp: not_less_eq_eq)\n    done\n  then have \"D \\<in> Liminf_llist (lmap Q_of_state Sts)\"\n    unfolding Liminf_llist_def by (auto intro!: exI[of _ i] simp: d)\n  then show ?thesis\n    unfolding Liminf_state_def by auto\nqed\n\nlemma from_P_to_Q:\n  assumes\n    deriv: \"chain (\\<leadsto>) Sts\" and\n    fair: \"fair_state_seq Sts\" and\n    ns: \"Gs = lmap grounding_of_state Sts\" and\n    c: \"C \\<in> Liminf_llist Gs - sr.Rf (Liminf_llist Gs)\" and\n    d: \"D \\<in> P_of_state (lnth Sts i)\" \"enat i < llength Sts\" \"subsumes D C\" and\n    d_least: \"\\<forall>E \\<in> {E. E \\<in> (clss_of_state (Sup_state Sts)) \\<and> subsumes E C}.\n      \\<not> strictly_subsumes E D\"\n  shows \"\\<exists>l. D \\<in> Q_of_state (lnth Sts l) \\<and> enat l < llength Sts\"\nproof -\n  let ?Ns = \"\\<lambda>i. N_of_state (lnth Sts i)\"\n  let ?Ps = \"\\<lambda>i. P_of_state (lnth Sts i)\"\n  let ?Qs = \"\\<lambda>i. Q_of_state (lnth Sts i)\"\n\n  have ground_C: \"is_ground_cls C\"\n    using c using Liminf_grounding_of_state_ground ns by auto\n\n  have derivns: \"chain sr_ext.derive Gs\"\n    using ground_derive_chain deriv ns by auto\n\n  have \"\\<exists>\\<sigma>. D \\<cdot> \\<sigma> = C \\<and> is_ground_subst \\<sigma>\"\n    using instance_if_subsumed_and_in_limit[OF deriv] ns c d by blast\n  then obtain \\<sigma> where\n    \\<sigma>: \"D \\<cdot> \\<sigma> = C\" \"is_ground_subst \\<sigma>\"\n    by auto\n\n  obtain l where\n    l_p: \"D \\<in> P_of_state (lnth Sts l) \\<and> D \\<notin> P_of_state (lnth Sts (Suc l)) \\<and> i \\<le> l\n      \\<and> enat (Suc l) < llength Sts\"\n    using fair using eventually_removed_from_P d unfolding ns by auto\n  then have l_Gs: \"enat (Suc l) < llength Gs\"\n    using ns by auto\n  from l_p have \"lnth Sts l \\<leadsto> lnth Sts (Suc l)\"\n    using deriv using chain_lnth_rel by auto\n  then show ?thesis\n  proof (cases rule: RP.cases)\n    case (backward_subsumption_P D' N D_twin P Q)\n    note lrhs = this(1,2) and D'_p = this(3,4)\n    then have twins: \"D_twin = D\" \"?Ns (Suc l) = N\" \"?Ns l = N\"  \"?Ps (Suc l) = P\"\n      \"?Ps l = P \\<union> {D_twin}\" \"?Qs (Suc l) = Q\" \"?Qs l = Q\"\n      using l_p by auto\n    note D'_p = D'_p[unfolded twins(1)]\n    then have subc: \"subsumes D' C\"\n      unfolding strictly_subsumes_def subsumes_def using \\<sigma>\n      by (metis subst_cls_comp_subst subst_cls_mono_mset)\n    from D'_p have \"D' \\<in> clss_of_state (Sup_state Sts)\"\n      unfolding twins(2)[symmetric] using l_p\n      by (metis (no_types) UnI1 N_of_state.simps llength_lmap lnth_lmap lnth_subset_Sup_llist\n          subsetCE Sup_state_def)\n    then have False\n      using d_least D'_p subc by auto\n    then show ?thesis\n      by auto\n  next\n    case (backward_reduction_P E L' N L \\<sigma> D' P Q)\n    then have twins: \"D' + {#L#} = D\" \"?Ns (Suc l) = N\" \"?Ns l = N\"  \"?Ps (Suc l) = P \\<union> {D'}\"\n      \"?Ps l = P \\<union> {D' + {#L#}}\" \"?Qs (Suc l) = Q\" \"?Qs l = Q\"\n      using l_p by auto\n    then have D'_p: \"strictly_subsumes D' D \\<and> D' \\<in> ?Ps (Suc l)\"\n      using subset_strictly_subsumes[of D' D] by auto\n    then have subc: \"subsumes D' C\"\n      using d(3) subsumes_trans unfolding strictly_subsumes_def by auto\n    from D'_p have \"D' \\<in> clss_of_state (Sup_state Sts)\"\n      using l_p by (metis (no_types) UnI1 P_of_state.simps llength_lmap lnth_lmap\n          lnth_subset_Sup_llist subsetCE sup_ge2 Sup_state_def)\n    then have False\n      using d_least D'_p subc by auto\n    then show ?thesis\n      by auto\n  next\n    case (inference_computation N Q D_twin P)\n    then have twins: \"D_twin = D\" \"?Ps (Suc l) = P\" \"?Ps l = P \\<union> {D_twin}\"\n      \"?Qs (Suc l) = Q \\<union> {D_twin}\" \"?Qs l = Q\"\n      using l_p by auto\n    then show ?thesis\n      using d \\<sigma> l_p by auto\n  qed (use l_p in auto)\nqed\n\nlemma from_N_to_P_or_Q:\n  assumes\n    deriv: \"chain (\\<leadsto>) Sts\" and\n    fair: \"fair_state_seq Sts\" and\n    ns: \"Gs = lmap grounding_of_state Sts\" and\n    c: \"C \\<in> Liminf_llist Gs - sr.Rf (Liminf_llist Gs)\" and\n    d: \"D \\<in> N_of_state (lnth Sts i)\" \"enat i < llength Sts\" \"subsumes D C\" and\n    d_least: \"\\<forall>E \\<in> {E. E \\<in> (clss_of_state (Sup_state Sts)) \\<and> subsumes E C}. \\<not> strictly_subsumes E D\"\n  shows \"\\<exists>l D' \\<sigma>'. D' \\<in> P_of_state (lnth Sts l) \\<union> Q_of_state (lnth Sts l) \\<and>\n    enat l < llength Sts \\<and>\n    (\\<forall>E \\<in> {E. E \\<in> (clss_of_state (Sup_state Sts)) \\<and> subsumes E C}. \\<not> strictly_subsumes E D') \\<and>\n    D' \\<cdot> \\<sigma>' = C \\<and> is_ground_subst \\<sigma>' \\<and> subsumes D' C\"\nproof -\n  let ?Ns = \"\\<lambda>i. N_of_state (lnth Sts i)\"\n  let ?Ps = \"\\<lambda>i. P_of_state (lnth Sts i)\"\n  let ?Qs = \"\\<lambda>i. Q_of_state (lnth Sts i)\"\n\n  have ground_C: \"is_ground_cls C\"\n    using c using Liminf_grounding_of_state_ground ns by auto\n\n  have derivns: \"chain sr_ext.derive Gs\"\n    using ground_derive_chain deriv ns by auto\n\n  have \"\\<exists>\\<sigma>. D \\<cdot> \\<sigma> = C \\<and> is_ground_subst \\<sigma>\"\n    using instance_if_subsumed_and_in_limit[OF deriv] ns c d by blast\n  then obtain \\<sigma> where\n    \\<sigma>: \"D \\<cdot> \\<sigma> = C\" \"is_ground_subst \\<sigma>\"\n    by auto\n\n  from c have no_taut: \"\\<not> (\\<exists>A. Pos A \\<in># C \\<and> Neg A \\<in># C)\"\n    using sr.tautology_Rf by auto\n\n  have \"\\<exists>l. D \\<in> N_of_state (lnth Sts l)\n    \\<and> D \\<notin> N_of_state (lnth Sts (Suc l)) \\<and> i \\<le> l \\<and> enat (Suc l) < llength Sts\"\n    using fair using eventually_removed_from_N d unfolding ns by auto\n  then obtain l where\n    l_p: \"D \\<in> N_of_state (lnth Sts l) \\<and> D \\<notin> N_of_state (lnth Sts (Suc l)) \\<and> i \\<le> l\n      \\<and> enat (Suc l) < llength Sts\"\n    by auto\n  then have l_Gs: \"enat (Suc l) < llength Gs\"\n    using ns by auto\n  from l_p have \"lnth Sts l \\<leadsto> lnth Sts (Suc l)\"\n    using deriv using chain_lnth_rel by auto\n  then show ?thesis\n  proof (cases rule: RP.cases)\n    case (tautology_deletion A D_twin N P Q)\n    then have \"D_twin = D\"\n      using l_p by auto\n    then have \"Pos (A \\<cdot>a \\<sigma>) \\<in># C \\<and> Neg (A \\<cdot>a \\<sigma>) \\<in># C\"\n      using tautology_deletion(3,4) \\<sigma>\n      by (metis Melem_subst_cls eql_neg_lit_eql_atm eql_pos_lit_eql_atm)\n    then have False\n      using no_taut by metis\n    then show ?thesis\n      by blast\n  next\n    case (forward_subsumption D' P Q D_twin N)\n    note lrhs = this(1,2) and D'_p = this(3,4)\n    then have twins: \"D_twin = D\" \"?Ns (Suc l) = N\" \"?Ns l = N \\<union> {D_twin}\"  \"?Ps (Suc l) = P \"\n      \"?Ps l = P\" \"?Qs (Suc l) = Q\" \"?Qs l = Q\"\n      using l_p by auto\n    note D'_p = D'_p[unfolded twins(1)]\n    from D'_p(2) have subs: \"subsumes D' C\"\n      using d(3) by (blast intro: subsumes_trans)\n    moreover have \"D' \\<in> clss_of_state (Sup_state Sts)\"\n      using twins D'_p l_p unfolding Sup_state_def\n      by simp (metis (no_types) contra_subsetD llength_lmap lnth_lmap lnth_subset_Sup_llist)\n    ultimately have \"\\<not> strictly_subsumes D' D\"\n      using d_least by auto\n    then have \"subsumes D D'\"\n      unfolding strictly_subsumes_def using D'_p by auto\n    then have v: \"variants D D'\"\n      using D'_p unfolding variants_iff_subsumes by auto\n    then have mini: \"\\<forall>E \\<in> {E \\<in> clss_of_state (Sup_state Sts). subsumes E C}.\n      \\<not> strictly_subsumes E D'\"\n      using d_least D'_p neg_strictly_subsumes_variants[of _ D D'] by auto\n\n    from v have \"\\<exists>\\<sigma>'. D' \\<cdot> \\<sigma>' = C\"\n      using \\<sigma> variants_imp_exists_substitution variants_sym by (metis subst_cls_comp_subst)\n    then have \"\\<exists>\\<sigma>'. D' \\<cdot> \\<sigma>' = C \\<and> is_ground_subst \\<sigma>'\"\n      using ground_C by (meson make_ground_subst refl)\n    then obtain \\<sigma>' where\n      \\<sigma>'_p: \"D' \\<cdot> \\<sigma>' = C \\<and> is_ground_subst \\<sigma>'\"\n      by metis\n\n    show ?thesis\n      using D'_p twins l_p subs mini \\<sigma>'_p by auto\n  next\n    case (forward_reduction E L' P Q L \\<sigma> D' N)\n    then have twins: \"D' + {#L#} = D\" \"?Ns (Suc l) = N \\<union> {D'}\" \"?Ns l = N \\<union> {D' + {#L#}}\"\n      \"?Ps (Suc l) = P \" \"?Ps l = P\" \"?Qs (Suc l) = Q\" \"?Qs l = Q\"\n      using l_p by auto\n    then have D'_p: \"strictly_subsumes D' D \\<and> D' \\<in> ?Ns (Suc l)\"\n      using subset_strictly_subsumes[of D' D] by auto\n    then have subc: \"subsumes D' C\"\n      using d(3) subsumes_trans unfolding strictly_subsumes_def by blast\n    from D'_p have \"D' \\<in> clss_of_state (Sup_state Sts)\"\n      using l_p by (metis (no_types) UnI1 N_of_state.simps llength_lmap lnth_lmap\n          lnth_subset_Sup_llist subsetCE Sup_state_def)\n    then have False\n      using d_least D'_p subc by auto\n    then show ?thesis\n      by auto\n  next\n    case (clause_processing N D_twin P Q)\n    then have twins:  \"D_twin = D\" \"?Ns (Suc l) = N\" \"?Ns l = N \\<union> {D}\"  \"?Ps (Suc l) = P \\<union> {D}\"\n      \"?Ps l = P\" \"?Qs (Suc l) = Q\" \"?Qs l = Q\"\n      using l_p by auto\n    then show ?thesis\n      using d \\<sigma> l_p d_least by blast\n  qed (use l_p in auto)\nqed\n\nlemma eventually_in_Qinf:\n  assumes\n    deriv: \"chain (\\<leadsto>) Sts\" and\n    D_p: \"D \\<in> clss_of_state (Sup_state Sts)\"\n      \"subsumes D C\" \"\\<forall>E \\<in> {E. E \\<in> (clss_of_state (Sup_state Sts)) \\<and> subsumes E C}.\n       \\<not> strictly_subsumes E D\" and\n    fair: \"fair_state_seq Sts\" and\n    ns: \"Gs = lmap grounding_of_state Sts\" and\n    c: \"C \\<in> Liminf_llist Gs - sr.Rf (Liminf_llist Gs)\" and\n    ground_C: \"is_ground_cls C\"\n  shows \"\\<exists>D' \\<sigma>'. D' \\<in> Q_of_state (Liminf_state Sts) \\<and> D' \\<cdot> \\<sigma>' = C \\<and> is_ground_subst \\<sigma>'\"\nproof -\n  let ?Ns = \"\\<lambda>i. N_of_state (lnth Sts i)\"\n  let ?Ps = \"\\<lambda>i. P_of_state (lnth Sts i)\"\n  let ?Qs = \"\\<lambda>i. Q_of_state (lnth Sts i)\"\n\n  from D_p obtain i where\n    i_p: \"i < llength Sts\" \"D \\<in> ?Ns i \\<or> D \\<in> ?Ps i \\<or> D \\<in> ?Qs i\"\n    unfolding Sup_state_def\n    by simp_all (metis (no_types) Sup_llist_imp_exists_index llength_lmap lnth_lmap)\n\n  have derivns: \"chain sr_ext.derive Gs\"\n    using ground_derive_chain deriv ns by auto\n\n  have \"\\<exists>\\<sigma>. D \\<cdot> \\<sigma> = C \\<and> is_ground_subst \\<sigma>\"\n    using instance_if_subsumed_and_in_limit[OF deriv ns c] D_p i_p by blast\n  then obtain \\<sigma> where\n    \\<sigma>: \"D \\<cdot> \\<sigma> = C\" \"is_ground_subst \\<sigma>\"\n    by blast\n\n  {\n    assume a: \"D \\<in> ?Ns i\"\n    then obtain D' \\<sigma>' l where D'_p:\n      \"D' \\<in> ?Ps l \\<union> ?Qs l\"\n      \"D' \\<cdot> \\<sigma>' = C\"\n      \"enat l < llength Sts\"\n      \"is_ground_subst \\<sigma>'\"\n      \"\\<forall>E \\<in> {E. E \\<in> (clss_of_state (Sup_state Sts)) \\<and> subsumes E C}. \\<not> strictly_subsumes E D'\"\n      \"subsumes D' C\"\n      using from_N_to_P_or_Q deriv fair ns c i_p(1) D_p(2) D_p(3) by blast\n    then obtain l' where\n      l'_p: \"D' \\<in> ?Qs l'\" \"l' < llength Sts\"\n      using from_P_to_Q[OF deriv fair ns c _ D'_p(3) D'_p(6) D'_p(5)] by blast\n    then have \"D' \\<in> Q_of_state (Liminf_state Sts)\"\n      using from_Q_to_Q_inf[OF deriv fair ns c _ l'_p(2)] D'_p by auto\n    then have ?thesis\n      using D'_p by auto\n  }\n  moreover\n  {\n    assume a: \"D \\<in> ?Ps i\"\n    then obtain l' where\n      l'_p: \"D \\<in> ?Qs l'\" \"l' < llength Sts\"\n      using from_P_to_Q[OF deriv fair ns c a i_p(1) D_p(2) D_p(3)] by auto\n    then have \"D \\<in> Q_of_state (Liminf_state Sts)\"\n      using from_Q_to_Q_inf[OF deriv fair ns c l'_p(1) l'_p(2)] D_p(3) \\<sigma>(1) \\<sigma>(2) D_p(2) by auto\n    then have ?thesis\n      using D_p \\<sigma> by auto\n  }\n  moreover\n  {\n    assume a: \"D \\<in> ?Qs i\"\n    then have \"D \\<in> Q_of_state (Liminf_state Sts)\"\n      using from_Q_to_Q_inf[OF deriv fair ns c a i_p(1)] \\<sigma> D_p(2,3) by auto\n    then have ?thesis\n      using D_p \\<sigma> by auto\n  }\n  ultimately show ?thesis\n    using i_p by auto\nqed\n\ntext \\<open>\nThe following corresponds to Lemma 4.11:\n\\<close>\n\nlemma fair_imp_Liminf_minus_Rf_subset_ground_Liminf_state:\n  assumes\n    deriv: \"chain (\\<leadsto>) Sts\" and\n    fair: \"fair_state_seq Sts\" and\n    ns: \"Gs = lmap grounding_of_state Sts\"\n  shows \"Liminf_llist Gs - sr.Rf (Liminf_llist Gs)\n    \\<subseteq> grounding_of_clss (Q_of_state (Liminf_state Sts))\"\nproof\n  let ?Ns = \"\\<lambda>i. N_of_state (lnth Sts i)\"\n  let ?Ps = \"\\<lambda>i. P_of_state (lnth Sts i)\"\n  let ?Qs = \"\\<lambda>i. Q_of_state (lnth Sts i)\"\n\n  have SQinf: \"clss_of_state (Liminf_state Sts) = Liminf_llist (lmap Q_of_state Sts)\"\n    using fair unfolding fair_state_seq_def Liminf_state_def by auto\n\n  fix C\n  assume C_p: \"C \\<in> Liminf_llist Gs - sr.Rf (Liminf_llist Gs)\"\n  then have \"C \\<in> Sup_llist Gs\"\n    using Liminf_llist_subset_Sup_llist[of Gs] by blast\n  then obtain D_proto where\n    \"D_proto \\<in> clss_of_state (Sup_state Sts) \\<and> subsumes D_proto C\"\n    using in_Sup_llist_in_Sup_state unfolding ns subsumes_def by blast\n  then obtain D where\n    D_p: \"D \\<in> clss_of_state (Sup_state Sts)\"\n    \"subsumes D C\"\n    \"\\<forall>E \\<in> {E. E \\<in> clss_of_state (Sup_state Sts) \\<and> subsumes E C}. \\<not> strictly_subsumes E D\"\n    using strictly_subsumes_has_minimum[of \"{E. E \\<in> clss_of_state (Sup_state Sts) \\<and> subsumes E C}\"]\n    by auto\n\n  have ground_C: \"is_ground_cls C\"\n    using C_p using Liminf_grounding_of_state_ground ns by auto\n\n  have \"\\<exists>D' \\<sigma>'. D' \\<in> Q_of_state (Liminf_state Sts) \\<and> D' \\<cdot> \\<sigma>' = C \\<and> is_ground_subst \\<sigma>'\"\n    using eventually_in_Qinf[of D C Gs] using D_p(1-3) deriv fair ns C_p ground_C by auto\n  then obtain D' \\<sigma>' where\n    D'_p: \"D' \\<in> Q_of_state (Liminf_state Sts) \\<and> D' \\<cdot> \\<sigma>' = C \\<and> is_ground_subst \\<sigma>'\"\n    by blast\n  then have \"D' \\<in> clss_of_state (Liminf_state Sts)\"\n    by simp\n  then have \"C \\<in> grounding_of_state (Liminf_state Sts)\"\n    unfolding grounding_of_clss_def grounding_of_cls_def using D'_p by auto\n  then show \"C \\<in> grounding_of_clss (Q_of_state (Liminf_state Sts))\"\n    using SQinf fair fair_state_seq_def by auto\nqed\n\ntext \\<open>\nThe following corresponds to (one direction of) Theorem 4.13:\n\\<close>\n\nlemma subseteq_Liminf_state_eventually_always:\n  fixes CC\n  assumes\n    \"finite CC\" and\n    \"CC \\<noteq> {}\" and\n    \"CC \\<subseteq> Q_of_state (Liminf_state Sts)\"\n  shows \"\\<exists>j. enat j < llength Sts \\<and> (\\<forall>j' \\<ge> enat j. j' < llength Sts \\<longrightarrow> CC \\<subseteq> Q_of_state (lnth Sts j'))\"\nproof -\n  from assms(3) have \"\\<forall>C \\<in> CC. \\<exists>j. enat j < llength Sts \\<and>\n    (\\<forall>j' \\<ge> enat j. j' < llength Sts \\<longrightarrow> C \\<in> Q_of_state (lnth Sts j'))\"\n    unfolding Liminf_state_def Liminf_llist_def by force\n  then obtain f where\n    f_p: \"\\<forall>C \\<in> CC. f C < llength Sts \\<and> (\\<forall>j' \\<ge> enat (f C). j' < llength Sts \\<longrightarrow> C \\<in> Q_of_state (lnth Sts j'))\"\n    by moura\n\n  define j :: nat where\n    \"j = Max (f ` CC)\"\n\n  have \"enat j < llength Sts\"\n    unfolding j_def using f_p assms(1)\n    by (metis (mono_tags) Max_in assms(2) finite_imageI imageE image_is_empty)\n  moreover have \"\\<forall>C j'. C \\<in> CC \\<longrightarrow> enat j \\<le> j' \\<longrightarrow> j' < llength Sts \\<longrightarrow> C \\<in> Q_of_state (lnth Sts j')\"\n  proof (intro allI impI)\n    fix C :: \"'a clause\" and j' :: nat\n    assume a: \"C \\<in> CC\" \"enat j \\<le> enat j'\" \"enat j' < llength Sts\"\n    then have \"f C \\<le> j'\"\n      unfolding j_def using assms(1) Max.bounded_iff by auto\n    then show \"C \\<in> Q_of_state (lnth Sts j')\"\n      using f_p a by auto\n  qed\n  ultimately show ?thesis\n    by auto\nqed\n\nlemma empty_clause_in_Q_of_Liminf_state:\n  assumes\n    deriv: \"chain (\\<leadsto>) Sts\" and\n    fair: \"fair_state_seq Sts\" and\n    empty_in: \"{#} \\<in> Liminf_llist (lmap grounding_of_state Sts)\"\n  shows \"{#} \\<in> Q_of_state (Liminf_state Sts)\"\nproof -\n  define Gs :: \"'a clause set llist\" where\n    ns: \"Gs = lmap grounding_of_state Sts\"\n  from empty_in have in_Liminf_not_Rf: \"{#} \\<in> Liminf_llist Gs - sr.Rf (Liminf_llist Gs)\"\n    unfolding ns sr.Rf_def by auto\n  then have \"{#} \\<in> grounding_of_clss (Q_of_state (Liminf_state Sts))\"\n    using fair_imp_Liminf_minus_Rf_subset_ground_Liminf_state[OF deriv fair ns] by auto\n  then show ?thesis\n    unfolding grounding_of_clss_def grounding_of_cls_def by auto\nqed\n\nlemma grounding_of_state_Liminf_state_subseteq:\n  \"grounding_of_state (Liminf_state Sts) \\<subseteq> Liminf_llist (lmap grounding_of_state Sts)\"\nproof\n  fix C :: \"'a clause\"\n  assume \"C \\<in> grounding_of_state (Liminf_state Sts)\"\n  then obtain D \\<sigma> where\n    D_\\<sigma>_p: \"D \\<in> clss_of_state (Liminf_state Sts)\" \"D \\<cdot> \\<sigma> = C\" \"is_ground_subst \\<sigma>\"\n    unfolding grounding_of_clss_def grounding_of_cls_def by auto\n  then have ii: \"D \\<in> Liminf_llist (lmap N_of_state Sts)\n    \\<or> D \\<in> Liminf_llist (lmap P_of_state Sts) \\<or> D \\<in> Liminf_llist (lmap Q_of_state Sts)\"\n    unfolding Liminf_state_def by simp\n  then have \"C \\<in> Liminf_llist (lmap grounding_of_clss (lmap N_of_state Sts))\n    \\<or> C \\<in> Liminf_llist (lmap grounding_of_clss (lmap P_of_state Sts))\n    \\<or> C \\<in> Liminf_llist (lmap grounding_of_clss (lmap Q_of_state Sts))\"\n    unfolding Liminf_llist_def grounding_of_clss_def grounding_of_cls_def\n    using D_\\<sigma>_p\n    apply -\n    apply (erule disjE)\n    subgoal\n      apply (rule disjI1)\n      using D_\\<sigma>_p by auto\n    subgoal\n      apply (erule disjE)\n      subgoal\n        apply (rule disjI2)\n        apply (rule disjI1)\n        using D_\\<sigma>_p by auto\n      subgoal\n        apply (rule disjI2)\n        apply (rule disjI2)\n        using D_\\<sigma>_p by auto\n      done\n    done\n  then show \"C \\<in> Liminf_llist (lmap grounding_of_state Sts)\"\n    unfolding Liminf_llist_def grounding_of_clss_def by auto\nqed\n\ntheorem RP_sound:\n  assumes\n    deriv: \"chain (\\<leadsto>) Sts\" and\n    \"{#} \\<in> clss_of_state (Liminf_state Sts)\"\n  shows \"\\<not> satisfiable (grounding_of_state (lhd Sts))\"\nproof -\n  from assms have \"{#} \\<in> grounding_of_state (Liminf_state Sts)\"\n    unfolding grounding_of_clss_def by (force intro: ex_ground_subst)\n  then have \"{#} \\<in> Liminf_llist (lmap grounding_of_state Sts)\"\n    using grounding_of_state_Liminf_state_subseteq by auto\n  then have \"\\<not> satisfiable (Liminf_llist (lmap grounding_of_state Sts))\"\n    using true_clss_def by auto\n  then have \"\\<not> satisfiable (lhd (lmap grounding_of_state Sts))\"\n    using sr_ext.sat_limit_iff ground_derive_chain deriv by blast\n  then show ?thesis\n    using chain_not_lnull deriv by fastforce\nqed\n\ntheorem RP_saturated_if_fair:\n  assumes\n    deriv: \"chain (\\<leadsto>) Sts\" and\n    fair: \"fair_state_seq Sts\" and\n    empty_Q0: \"Q_of_state (lhd Sts) = {}\"\n  shows \"sr.saturated_upto (Liminf_llist (lmap grounding_of_state Sts))\"\nproof -\n  define Gs :: \"'a clause set llist\" where\n    ns: \"Gs = lmap grounding_of_state Sts\"\n\n  let ?N = \"\\<lambda>i. grounding_of_state (lnth Sts i)\"\n\n  let ?Ns = \"\\<lambda>i. N_of_state (lnth Sts i)\"\n  let ?Ps = \"\\<lambda>i. P_of_state (lnth Sts i)\"\n  let ?Qs = \"\\<lambda>i. Q_of_state (lnth Sts i)\"\n\n  have ground_ns_in_ground_limit_st:\n    \"Liminf_llist Gs - sr.Rf (Liminf_llist Gs) \\<subseteq> grounding_of_clss (Q_of_state (Liminf_state Sts))\"\n    using fair deriv fair_imp_Liminf_minus_Rf_subset_ground_Liminf_state ns by blast\n\n  have derivns: \"chain sr_ext.derive Gs\"\n    using ground_derive_chain deriv ns by auto\n\n  {\n    fix \\<gamma> :: \"'a inference\"\n    assume \\<gamma>_p: \"\\<gamma> \\<in> gr.ord_\\<Gamma>\"\n    let ?CC = \"side_prems_of \\<gamma>\"\n    let ?DA = \"main_prem_of \\<gamma>\"\n    let ?E = \"concl_of \\<gamma>\"\n    assume a: \"set_mset ?CC \\<union> {?DA}\n      \\<subseteq> Liminf_llist (lmap grounding_of_state Sts)\n        - sr.Rf (Liminf_llist (lmap grounding_of_state Sts))\"\n\n    have ground_ground_Liminf: \"is_ground_clss (Liminf_llist (lmap grounding_of_state Sts))\"\n      using Liminf_grounding_of_state_ground unfolding is_ground_clss_def by auto\n\n    have ground_cc: \"is_ground_clss (set_mset ?CC)\"\n      using a ground_ground_Liminf is_ground_clss_def by auto\n\n    have ground_da: \"is_ground_cls ?DA\"\n      using a grounding_ground singletonI ground_ground_Liminf\n      by (simp add: Liminf_grounding_of_state_ground)\n\n    from \\<gamma>_p obtain CAs AAs As where\n      CAs_p: \"gr.ord_resolve CAs ?DA AAs As ?E \\<and> mset CAs = ?CC\"\n      unfolding gr.ord_\\<Gamma>_def by auto\n\n    have DA_CAs_in_ground_Liminf:\n      \"{?DA} \\<union> set CAs \\<subseteq> grounding_of_clss (Q_of_state (Liminf_state Sts))\"\n      using a CAs_p fair unfolding fair_state_seq_def\n      by (metis (no_types, lifting) Un_empty_left ground_ns_in_ground_limit_st a ns set_mset_mset\n          subset_trans sup_commute)\n\n    then have ground_cas: \"is_ground_cls_list CAs\"\n      using CAs_p unfolding is_ground_cls_list_def by auto\n\n    have \"\\<exists>\\<sigma>. ord_resolve S_Q CAs ?DA AAs As \\<sigma> ?E\"\n      by (rule ground_ord_resolve_imp_ord_resolve[OF ground_da ground_cas\n            gr.ground_resolution_with_selection_axioms CAs_p[THEN conjunct1]])\n    then obtain \\<sigma> where\n      \\<sigma>_p: \"ord_resolve S_Q CAs ?DA AAs As \\<sigma> ?E\"\n      by auto\n    then obtain \\<eta>s' \\<eta>' \\<eta>2' CAs' DA' AAs' As' \\<tau>' E' where s_p:\n      \"is_ground_subst \\<eta>'\"\n      \"is_ground_subst_list \\<eta>s'\"\n      \"is_ground_subst \\<eta>2'\"\n      \"ord_resolve_rename S CAs' DA' AAs' As' \\<tau>' E'\"\n      \"CAs' \\<cdot>\\<cdot>cl \\<eta>s' = CAs\"\n      \"DA' \\<cdot> \\<eta>' = ?DA\"\n      \"E' \\<cdot> \\<eta>2' = ?E\"\n      \"{DA'} \\<union> set CAs' \\<subseteq> Q_of_state (Liminf_state Sts)\"\n      using ord_resolve_rename_lifting[OF sel_stable, of \"Q_of_state (Liminf_state Sts)\" CAs ?DA]\n        \\<sigma>_p[unfolded S_Q_def] selection_axioms DA_CAs_in_ground_Liminf by metis\n    from this(8) have \"\\<exists>j. enat j < llength Sts \\<and> (set CAs' \\<union> {DA'} \\<subseteq> ?Qs j)\"\n      unfolding Liminf_llist_def\n      using subseteq_Liminf_state_eventually_always[of \"{DA'} \\<union> set CAs'\"] by auto\n    then obtain j where\n      j_p: \"is_least (\\<lambda>j. enat j < llength Sts \\<and> set CAs' \\<union> {DA'} \\<subseteq> ?Qs j) j\"\n      using least_exists[of \"\\<lambda>j. enat j < llength Sts \\<and> set CAs' \\<union> {DA'} \\<subseteq> ?Qs j\"] by force\n    then have j_p': \"enat j < llength Sts\" \"set CAs' \\<union> {DA'} \\<subseteq> ?Qs j\"\n      unfolding is_least_def by auto\n    then have jn0: \"j \\<noteq> 0\"\n      using empty_Q0 by (metis bot_eq_sup_iff gr_implies_not_zero insert_not_empty llength_lnull\n          lnth_0_conv_lhd sup.orderE)\n    then have j_adds_CAs': \"\\<not> set CAs' \\<union> {DA'} \\<subseteq> ?Qs (j - 1)\" \"set CAs' \\<union> {DA'} \\<subseteq> ?Qs j\"\n      using j_p unfolding is_least_def\n       apply (metis (no_types) One_nat_def Suc_diff_Suc Suc_ile_eq diff_diff_cancel diff_zero\n          less_imp_le less_one neq0_conv zero_less_diff)\n      using j_p'(2) by blast\n    have \"lnth Sts (j - 1) \\<leadsto> lnth Sts j\"\n      using j_p'(1) jn0 deriv chain_lnth_rel[of _ _ \"j - 1\"] by force\n    then obtain C' where C'_p:\n      \"?Ns (j - 1) = {}\"\n      \"?Ps (j - 1) = ?Ps j \\<union> {C'}\"\n      \"?Qs j = ?Qs (j - 1) \\<union> {C'}\"\n      \"?Ns j = concls_of (ord_FO_resolution.inferences_between (?Qs (j - 1)) C')\"\n      \"C' \\<in> set CAs' \\<union> {DA'}\"\n      \"C' \\<notin> ?Qs (j - 1)\"\n      using j_adds_CAs' by (induction rule: RP.cases) auto\n    have \"E' \\<in> ?Ns j\"\n    proof -\n      have \"E' \\<in> concls_of (ord_FO_resolution.inferences_between (Q_of_state (lnth Sts (j - 1))) C')\"\n        unfolding infer_from_def ord_FO_\\<Gamma>_def inference_system.inferences_between_def\n        apply (rule_tac x = \"Infer (mset CAs') DA' E'\" in image_eqI)\n        subgoal by auto\n        subgoal\n          unfolding infer_from_def\n          by (rule ord_resolve_rename.cases[OF s_p(4)]) (use s_p(4) C'_p(3,5) j_p'(2) in force)\n        done\n      then show ?thesis\n        using C'_p(4) by auto\n    qed\n    then have \"E' \\<in> clss_of_state (lnth Sts j)\"\n      using j_p' by auto\n    then have \"?E \\<in> grounding_of_state (lnth Sts j)\"\n      using s_p(7) s_p(3) unfolding grounding_of_clss_def grounding_of_cls_def by force\n    then have \"\\<gamma> \\<in> sr.Ri (grounding_of_state (lnth Sts j))\"\n      using sr.Ri_effective \\<gamma>_p by auto\n    then have \"\\<gamma> \\<in> sr_ext_Ri (?N j)\"\n      unfolding sr_ext_Ri_def by auto\n    then have \"\\<gamma> \\<in> sr_ext_Ri (Sup_llist (lmap grounding_of_state Sts))\"\n      using j_p' contra_subsetD llength_lmap lnth_lmap lnth_subset_Sup_llist sr_ext.Ri_mono by smt\n    then have \"\\<gamma> \\<in> sr_ext_Ri (Liminf_llist (lmap grounding_of_state Sts))\"\n      using sr_ext.Ri_limit_Sup[of Gs] derivns ns by blast\n  }\n  then have \"sr_ext.saturated_upto (Liminf_llist (lmap grounding_of_state Sts))\"\n    unfolding sr_ext.saturated_upto_def sr_ext.inferences_from_def infer_from_def sr_ext_Ri_def\n    by auto\n  then show ?thesis\n    using gd_ord_\\<Gamma>_ngd_ord_\\<Gamma> sr.redundancy_criterion_axioms\n      redundancy_criterion_standard_extension_saturated_upto_iff[of gr.ord_\\<Gamma>]\n    unfolding sr_ext_Ri_def by auto\nqed\n\ncorollary RP_complete_if_fair:\n  assumes\n    deriv: \"chain (\\<leadsto>) Sts\" and\n    fair: \"fair_state_seq Sts\" and\n    empty_Q0: \"Q_of_state (lhd Sts) = {}\" and\n    unsat: \"\\<not> satisfiable (grounding_of_state (lhd Sts))\"\n  shows \"{#} \\<in> Q_of_state (Liminf_state Sts)\"\nproof -\n  have \"\\<not> satisfiable (Liminf_llist (lmap grounding_of_state Sts))\"\n    using unsat sr_ext.sat_limit_iff[OF ground_derive_chain] chain_not_lnull deriv by fastforce\n  moreover have \"sr.saturated_upto (Liminf_llist (lmap grounding_of_state Sts))\"\n    by (rule RP_saturated_if_fair[OF deriv fair empty_Q0, simplified])\n  ultimately have \"{#} \\<in> Liminf_llist (lmap grounding_of_state Sts)\"\n    using sr.saturated_upto_complete_if by auto\n  then show ?thesis\n    using empty_clause_in_Q_of_Liminf_state[OF deriv fair] by auto\nqed\n\nend\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Ordered_Resolution_Prover/FO_Ordered_Resolution_Prover.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.546738151984614, "lm_q1q2_score": 0.34828903933149513}}
{"text": "(*  Title:       Prover Architectures of the Saturation Framework\n *  Author:      Sophie Tourret <stourret at mpi-inf.mpg.de>, 2019-2020 *)\n\nsection \\<open>Prover Architectures\\<close>\n\ntext \\<open>This section covers all the results presented in the section 4 of the report.\n  This is where abstract architectures of provers are defined and proven\n  dynamically refutationally complete.\\<close>\n\ntheory Prover_Architectures\n  imports Labeled_Lifting_to_Non_Ground_Calculi\nbegin\n\nsubsection \\<open>Basis of the Prover Architectures\\<close>\n\nlocale Prover_Architecture_Basis = labeled_lifting_with_red_crit_family Bot_F Inf_F Bot_G Q entails_q Inf_G\n  Red_Inf_q Red_F_q \\<G>_F_q \\<G>_Inf_q l Inf_FL\n  for\n    Bot_F :: \"'f set\"\n    and Inf_F :: \"'f inference set\"\n    and Bot_G :: \"'g set\"\n    and Q :: \"'q itself\"\n    and entails_q :: \"'q \\<Rightarrow> ('g set \\<Rightarrow> 'g set \\<Rightarrow> bool)\"\n    and Inf_G :: \\<open>'g inference set\\<close>\n    and Red_Inf_q :: \"'q \\<Rightarrow> ('g set \\<Rightarrow> 'g inference set)\"\n    and Red_F_q :: \"'q \\<Rightarrow> ('g set \\<Rightarrow> 'g set)\"\n    and \\<G>_F_q :: \"'q \\<Rightarrow> 'f \\<Rightarrow> 'g set\"\n    and \\<G>_Inf_q :: \"'q \\<Rightarrow> 'f inference \\<Rightarrow> 'g inference set option\"\n    and l :: \"'l itself\"\n    and Inf_FL :: \\<open>('f \\<times> 'l) inference set\\<close>\n  + fixes\n    Equiv_F :: \"('f \\<times> 'f) set\" and\n    Prec_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<cdot>\\<succ>\" 50) and\n    Prec_l :: \"'l \\<Rightarrow> 'l \\<Rightarrow> bool\" (infix \"\\<sqsubset>l\" 50)\n  assumes\n    equiv_F_is_equiv_rel: \"equiv UNIV Equiv_F\" and\n    wf_prec_F: \"minimal_element (Prec_F) UNIV\" and\n    wf_prec_l: \"minimal_element (Prec_l) UNIV\" and\n    compat_equiv_prec: \"(C1,D1) \\<in> equiv_F \\<Longrightarrow> (C2,D2) \\<in> equiv_F \\<Longrightarrow> C1 \\<cdot>\\<succ> C2 \\<Longrightarrow> D1 \\<cdot>\\<succ> D2\" and\n    equiv_F_grounding: \"(C1,C2) \\<in> equiv_F \\<Longrightarrow> \\<G>_F_q q C1 = \\<G>_F_q q C2\" and\n    prec_F_grounding: \"C1 \\<cdot>\\<succ> C2 \\<Longrightarrow> \\<G>_F_q q C1 \\<subseteq> \\<G>_F_q q C2\" and\n    static_ref_comp: \"static_refutational_complete_calculus Bot_F Inf_F (\\<Turnstile>\\<inter>)\n      no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q\n      no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_F_Q\"\nbegin\n\ndefinition equiv_F_fun :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<doteq>\" 50) where\n  \"equiv_F_fun C D \\<equiv> (C,D) \\<in> Equiv_F\"\n\ndefinition Prec_eq_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<cdot>\\<succeq>\" 50) where\n  \"Prec_eq_F C D \\<equiv> ((C,D) \\<in> Equiv_F \\<or> C \\<cdot>\\<succ> D)\"\n\ndefinition Prec_FL :: \"('f \\<times> 'l) \\<Rightarrow> ('f \\<times> 'l) \\<Rightarrow> bool\" (infix \"\\<sqsubset>\" 50) where\n  \"Prec_FL Cl1 Cl2 \\<equiv> (fst Cl1 \\<cdot>\\<succ> fst Cl2) \\<or> (fst Cl1 \\<doteq> fst Cl2 \\<and> snd Cl1 \\<sqsubset>l snd Cl2)\"\n\nlemma wf_prec_FL: \"minimal_element (\\<sqsubset>) UNIV\"\nproof\n  show \"po_on (\\<sqsubset>) UNIV\" unfolding po_on_def\n  proof\n    show \"irreflp_on (\\<sqsubset>) UNIV\" unfolding irreflp_on_def Prec_FL_def\n    proof\n      fix a\n      assume a_in: \"a \\<in> (UNIV::('f \\<times> 'l) set)\"\n      have \"\\<not> (fst a \\<cdot>\\<succ> fst a)\" using wf_prec_F minimal_element.min_elt_ex by force\n      moreover have \"\\<not> (snd a \\<sqsubset>l snd a)\" using wf_prec_l minimal_element.min_elt_ex by force\n      ultimately show \"\\<not> (fst a \\<cdot>\\<succ> fst a \\<or> fst a \\<doteq> fst a \\<and> snd a \\<sqsubset>l snd a)\" by blast\n    qed\n  next\n    show \"transp_on (\\<sqsubset>) UNIV\" unfolding transp_on_def Prec_FL_def\n    proof (simp, intro allI impI)\n      fix a1 b1 a2 b2 a3 b3\n      assume trans_hyp:\"(a1 \\<cdot>\\<succ> a2 \\<or> a1 \\<doteq> a2 \\<and> b1 \\<sqsubset>l b2) \\<and> (a2 \\<cdot>\\<succ> a3 \\<or> a2 \\<doteq> a3 \\<and> b2 \\<sqsubset>l b3)\"\n      have \"a1 \\<cdot>\\<succ> a2 \\<Longrightarrow> a2 \\<cdot>\\<succ> a3 \\<Longrightarrow> a1 \\<cdot>\\<succ> a3\" using wf_prec_F compat_equiv_prec by blast\n      moreover have \"a1 \\<cdot>\\<succ> a2 \\<Longrightarrow> a2 \\<doteq> a3 \\<Longrightarrow> a1 \\<cdot>\\<succ> a3\" using wf_prec_F compat_equiv_prec by blast\n      moreover have \"a1 \\<doteq> a2 \\<Longrightarrow> a2 \\<cdot>\\<succ> a3 \\<Longrightarrow> a1 \\<cdot>\\<succ> a3\" using wf_prec_F compat_equiv_prec by blast\n      moreover have \"b1 \\<sqsubset>l b2 \\<Longrightarrow> b2 \\<sqsubset>l b3 \\<Longrightarrow> b1 \\<sqsubset>l b3\"\n        using wf_prec_l unfolding minimal_element_def po_on_def transp_on_def by (meson UNIV_I)\n      moreover have \"a1 \\<doteq> a2 \\<Longrightarrow> a2 \\<doteq> a3 \\<Longrightarrow> a1 \\<doteq> a3\"\n        using equiv_F_is_equiv_rel equiv_class_eq unfolding equiv_F_fun_def by fastforce\n      ultimately show \"(a1 \\<cdot>\\<succ> a3 \\<or> a1 \\<doteq> a3 \\<and> b1 \\<sqsubset>l b3)\" using trans_hyp by blast\n    qed\n  qed\nnext\n  show \"wfp_on (\\<sqsubset>) UNIV\" unfolding wfp_on_def\n  proof\n    assume contra: \"\\<exists>f. \\<forall>i. f i \\<in> UNIV \\<and> f (Suc i) \\<sqsubset> f i\"\n    then obtain f where f_in: \"\\<forall>i. f i \\<in> UNIV\" and f_suc: \"\\<forall>i. f (Suc i) \\<sqsubset> f i\" by blast\n    define f_F where \"f_F = (\\<lambda>i. fst (f i))\"\n    define f_L where \"f_L = (\\<lambda>i. snd (f i))\"\n    have uni_F: \"\\<forall>i. f_F i \\<in> UNIV\" using f_in by simp\n    have uni_L: \"\\<forall>i. f_L i \\<in> UNIV\" using f_in by simp\n    have decomp: \"\\<forall>i. f_F (Suc i) \\<cdot>\\<succ> f_F i \\<or> f_L (Suc i) \\<sqsubset>l f_L i\"\n      using f_suc unfolding Prec_FL_def f_F_def f_L_def by blast\n    define I_F where \"I_F = { i |i. f_F (Suc i) \\<cdot>\\<succ> f_F i}\"\n    define I_L where \"I_L = { i |i. f_L (Suc i) \\<sqsubset>l f_L i}\"\n    have \"I_F \\<union> I_L = UNIV\" using decomp unfolding I_F_def I_L_def by blast\n    then have \"finite I_F \\<Longrightarrow> \\<not> finite I_L\" by (metis finite_UnI infinite_UNIV_nat)\n    moreover have \"infinite I_F \\<Longrightarrow> \\<exists>f. \\<forall>i. f i \\<in> UNIV \\<and> f (Suc i) \\<cdot>\\<succ> f i\"\n      using uni_F unfolding I_F_def by (meson compat_equiv_prec iso_tuple_UNIV_I not_finite_existsD)\n    moreover have \"infinite I_L \\<Longrightarrow> \\<exists>f. \\<forall>i. f i \\<in> UNIV \\<and> f (Suc i) \\<sqsubset>l f i\"\n      using uni_L unfolding I_L_def\n      by (metis UNIV_I compat_equiv_prec decomp minimal_element_def wf_prec_F wfp_on_def)\n    ultimately show False using wf_prec_F wf_prec_l by (metis minimal_element_def wfp_on_def)\n  qed\nqed\n\nlemma labeled_static_ref_comp:\n  \"static_refutational_complete_calculus Bot_FL Inf_FL (\\<Turnstile>\\<inter>L) with_labels.Red_Inf_Q with_labels.Red_F_Q\"\n  using labeled_static_ref[OF static_ref_comp] .\n\nlemma standard_labeled_lifting_family: \"lifting_with_wf_ordering_family Bot_FL Inf_FL Bot_G\n  (entails_q q) Inf_G (Red_Inf_q q) (Red_F_q q) (\\<G>_F_L_q q) (\\<G>_Inf_L_q q) (\\<lambda>g. Prec_FL)\"\nproof -\n  fix q\n  have \"lifting_with_wf_ordering_family Bot_FL Inf_FL Bot_G (entails_q q) Inf_G\n    (Red_Inf_q q) (Red_F_q q) (\\<G>_F_L_q q) (\\<G>_Inf_L_q q) (\\<lambda>g. Labeled_Empty_Order)\"\n    using ord_fam_lifted_q .\n  then have \"standard_lifting Bot_FL Inf_FL Bot_G Inf_G (entails_q q) (Red_Inf_q q) (Red_F_q q)\n    (\\<G>_F_L_q q) (\\<G>_Inf_L_q q)\"\n    using lifted_q by blast\n  then show \"lifting_with_wf_ordering_family Bot_FL Inf_FL Bot_G (entails_q q) Inf_G (Red_Inf_q q)\n    (Red_F_q q) (\\<G>_F_L_q q) (\\<G>_Inf_L_q q) (\\<lambda>g. Prec_FL)\"\n    using wf_prec_FL\n    by (simp add: lifting_with_wf_ordering_family.intro lifting_with_wf_ordering_family_axioms.intro)\nqed\n\nsublocale labeled_ord_red_crit_fam: standard_lifting_with_red_crit_family Inf_FL Bot_G Inf_G Q\n  entails_q Red_Inf_q Red_F_q\n  Bot_FL \\<G>_F_L_q \\<G>_Inf_L_q \"\\<lambda>g. Prec_FL\"\n  using standard_labeled_lifting_family\n    no_labels.Ground_family.calculus_with_red_crit_family_axioms\n  by (simp add: standard_lifting_with_red_crit_family.intro\n    standard_lifting_with_red_crit_family_axioms.intro)\n\nlemma entail_equiv:\n  \"labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.entails_Q N1 N2 = (N1 \\<Turnstile>\\<inter>L N2)\"\n  unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.entails_Q_def\n    entails_\\<G>_L_Q_def entails_\\<G>_L_q_def labeled_ord_red_crit_fam.entails_\\<G>_q_def\n     labeled_ord_red_crit_fam.\\<G>_set_q_def \\<G>_set_L_q_def\n  by simp\n\nlemma entail_equiv2: \"labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.entails_Q = (\\<Turnstile>\\<inter>L)\"\n  using entail_equiv by auto\n\nlemma red_inf_equiv: \"labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q N =\n  with_labels.Red_Inf_Q N\"\n  unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q_def\n    with_labels.Red_Inf_Q_def labeled_ord_red_crit_fam.Red_Inf_\\<G>_q_def Red_Inf_\\<G>_L_q_def\n    labeled_ord_red_crit_fam.\\<G>_set_q_def \\<G>_set_L_q_def\n  by simp\n\nlemma red_inf_equiv2: \"labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q =\n  with_labels.Red_Inf_Q\"\n  using red_inf_equiv by auto\n\nlemma empty_red_f_equiv: \"labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.Red_F_Q N =\n  with_labels.Red_F_Q N\"\n  unfolding labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.Red_F_Q_def\n    with_labels.Red_F_Q_def labeled_ord_red_crit_fam.Red_F_\\<G>_empty_q_def Red_F_\\<G>_empty_L_q_def\n    labeled_ord_red_crit_fam.\\<G>_set_q_def \\<G>_set_L_q_def Labeled_Empty_Order_def\n  by simp\n\nlemma empty_red_f_equiv2: \"labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.Red_F_Q =\n  with_labels.Red_F_Q\"\n  using empty_red_f_equiv by auto\n\nlemma labeled_ordered_static_ref_comp:\n  \"static_refutational_complete_calculus Bot_FL Inf_FL\n  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.entails_Q\n  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q\n  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q\"\n  using labeled_ord_red_crit_fam.static_empty_ord_inter_equiv_static_inter empty_red_f_equiv2\n    red_inf_equiv2 entail_equiv2 labeled_static_ref_comp\n  by argo\n\ninterpretation stat_ref_calc: static_refutational_complete_calculus Bot_FL Inf_FL\n  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.entails_Q\n  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q\n  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q\n  by (rule labeled_ordered_static_ref_comp)\n\nlemma labeled_ordered_dynamic_ref_comp:\n  \"dynamic_refutational_complete_calculus Bot_FL Inf_FL\n  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.entails_Q\n  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q\n  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q\"\n  by (rule stat_ref_calc.dynamic_refutational_complete_calculus_axioms)\n\n(* lem:redundant-labeled-inferences *)\nlemma labeled_red_inf_eq_red_inf: \"\\<iota> \\<in> Inf_FL \\<Longrightarrow>\n  \\<iota> \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q N \\<equiv>\n  (to_F \\<iota>) \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` N)\" for \\<iota>\nproof -\n  fix \\<iota>\n  assume i_in: \"\\<iota> \\<in> Inf_FL\"\n  have \"\\<iota> \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q N \\<Longrightarrow>\n    (to_F \\<iota>) \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` N)\"\n  proof -\n    assume i_in2: \"\\<iota> \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q N\"\n    then have \"X \\<in> labeled_ord_red_crit_fam.Red_Inf_\\<G>_q ` UNIV \\<Longrightarrow> \\<iota> \\<in> X N\" for X\n      unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q_def by blast\n    obtain X0 where \"X0 \\<in> labeled_ord_red_crit_fam.Red_Inf_\\<G>_q ` UNIV\" by blast\n    then obtain q0 where x0_is: \"X0 N = labeled_ord_red_crit_fam.Red_Inf_\\<G>_q q0 N\" by blast\n    then obtain Y0 where y0_is: \"Y0 (fst ` N) = to_F ` (X0 N)\" by auto\n    have \"Y0 (fst ` N) = no_labels.Red_Inf_\\<G>_q q0 (fst ` N)\"\n      unfolding  y0_is\n    proof\n      show \"to_F ` X0 N \\<subseteq> no_labels.Red_Inf_\\<G>_q q0 (fst ` N)\"\n      proof\n        fix \\<iota>0\n        assume i0_in: \"\\<iota>0 \\<in> to_F ` X0 N\"\n        then have i0_in2: \"\\<iota>0 \\<in> to_F ` (labeled_ord_red_crit_fam.Red_Inf_\\<G>_q q0 N)\"\n          using x0_is by argo\n        then obtain \\<iota>0_FL where i0_FL_in: \"\\<iota>0_FL \\<in> Inf_FL\" and i0_to_i0_FL: \"\\<iota>0 = to_F \\<iota>0_FL\" and\n          subs1: \"((\\<G>_Inf_L_q q0 \\<iota>0_FL) \\<noteq> None \\<and>\n            the (\\<G>_Inf_L_q q0 \\<iota>0_FL) \\<subseteq> Red_Inf_q q0 (labeled_ord_red_crit_fam.\\<G>_set_q q0 N))\n            \\<or> ((\\<G>_Inf_L_q q0 \\<iota>0_FL = None) \\<and>\n            \\<G>_F_L_q q0 (concl_of \\<iota>0_FL) \\<subseteq> (labeled_ord_red_crit_fam.\\<G>_set_q q0 N \\<union>\n              Red_F_q q0 (labeled_ord_red_crit_fam.\\<G>_set_q q0 N)))\"\n          unfolding labeled_ord_red_crit_fam.Red_Inf_\\<G>_q_def by blast\n        have concl_swap: \"fst (concl_of \\<iota>0_FL) = concl_of \\<iota>0\"\n          unfolding concl_of_def i0_to_i0_FL to_F_def by simp\n        have i0_in3: \"\\<iota>0 \\<in> Inf_F\"\n          using i0_to_i0_FL Inf_FL_to_Inf_F[OF i0_FL_in] unfolding to_F_def by blast\n        {\n          assume\n            not_none: \"\\<G>_Inf_q q0 \\<iota>0 \\<noteq> None\" and\n            \"the (\\<G>_Inf_q q0 \\<iota>0) \\<noteq> {}\"\n          then obtain \\<iota>1 where i1_in: \"\\<iota>1 \\<in> the (\\<G>_Inf_q q0 \\<iota>0)\" by blast\n          have \"the (\\<G>_Inf_q q0 \\<iota>0) \\<subseteq> Red_Inf_q q0 (no_labels.\\<G>_set_q q0 (fst ` N))\"\n            using subs1 i0_to_i0_FL not_none\n            unfolding no_labels.\\<G>_set_q_def labeled_ord_red_crit_fam.\\<G>_set_q_def\n              \\<G>_Inf_L_q_def \\<G>_F_L_q_def by auto\n        }\n        moreover {\n          assume\n            is_none: \"\\<G>_Inf_q q0 \\<iota>0 = None\"\n          then have \"\\<G>_F_q q0 (concl_of \\<iota>0) \\<subseteq> no_labels.\\<G>_set_q q0 (fst ` N)\n            \\<union> Red_F_q q0 (no_labels.\\<G>_set_q q0 (fst ` N))\"\n            using subs1 i0_to_i0_FL concl_swap\n            unfolding no_labels.\\<G>_set_q_def labeled_ord_red_crit_fam.\\<G>_set_q_def\n              \\<G>_Inf_L_q_def \\<G>_F_L_q_def by simp\n        }\n        ultimately show \"\\<iota>0 \\<in> no_labels.Red_Inf_\\<G>_q q0 (fst ` N)\"\n          unfolding no_labels.Red_Inf_\\<G>_q_def using i0_in3 by auto\n       qed\n     next\n       show \"no_labels.Red_Inf_\\<G>_q q0 (fst ` N) \\<subseteq> to_F ` X0 N\"\n       proof\n         fix \\<iota>0\n         assume i0_in: \"\\<iota>0 \\<in> no_labels.Red_Inf_\\<G>_q q0 (fst ` N)\"\n         then have i0_in2: \"\\<iota>0 \\<in> Inf_F\"\n           unfolding no_labels.Red_Inf_\\<G>_q_def by blast\n         obtain \\<iota>0_FL where i0_FL_in: \"\\<iota>0_FL \\<in> Inf_FL\" and i0_to_i0_FL: \"\\<iota>0 = to_F \\<iota>0_FL\"\n           using Inf_F_to_Inf_FL[OF i0_in2] unfolding to_F_def\n           by (metis Ex_list_of_length fst_conv inference.exhaust_sel inference.inject map_fst_zip)\n         have concl_swap: \"fst (concl_of \\<iota>0_FL) = concl_of \\<iota>0\"\n           unfolding concl_of_def i0_to_i0_FL to_F_def by simp\n         have subs1: \"((\\<G>_Inf_L_q q0 \\<iota>0_FL) \\<noteq> None \\<and>\n           the (\\<G>_Inf_L_q q0 \\<iota>0_FL) \\<subseteq> Red_Inf_q q0 (labeled_ord_red_crit_fam.\\<G>_set_q q0 N))\n           \\<or> ((\\<G>_Inf_L_q q0 \\<iota>0_FL = None) \\<and>\n           \\<G>_F_L_q q0 (concl_of \\<iota>0_FL) \\<subseteq> (labeled_ord_red_crit_fam.\\<G>_set_q q0 N \\<union>\n             Red_F_q q0 (labeled_ord_red_crit_fam.\\<G>_set_q q0 N)))\"\n           using i0_in i0_to_i0_FL concl_swap\n           unfolding no_labels.Red_Inf_\\<G>_q_def \\<G>_Inf_L_q_def no_labels.\\<G>_set_q_def\n             labeled_ord_red_crit_fam.\\<G>_set_q_def \\<G>_F_L_q_def\n           by simp\n         then have \"\\<iota>0_FL \\<in> labeled_ord_red_crit_fam.Red_Inf_\\<G>_q q0 N\"\n           using i0_FL_in unfolding labeled_ord_red_crit_fam.Red_Inf_\\<G>_q_def\n           by simp\n         then show \"\\<iota>0 \\<in> to_F ` X0 N\"\n           using x0_is i0_to_i0_FL i0_in2 by blast\n       qed\n     qed\n    then have \"Y \\<in> no_labels.Red_Inf_\\<G>_q ` UNIV \\<Longrightarrow> (to_F \\<iota>) \\<in> Y (fst ` N)\" for Y\n      using i_in2 no_labels.lifted_calc_w_red_crit_family.Red_Inf_Q_def\n        red_inf_equiv2 red_inf_impl by fastforce\n    then show \"(to_F \\<iota>) \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` N)\"\n      unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q_def\n        no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q_def\n      by blast\n    qed\n  moreover have \"(to_F \\<iota>) \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` N) \\<Longrightarrow>\n    \\<iota> \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q N\"\n  proof -\n    assume to_F_in: \"to_F \\<iota> \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` N)\"\n    have imp_to_F: \"X \\<in> no_labels.Red_Inf_\\<G>_q ` UNIV \\<Longrightarrow> to_F \\<iota> \\<in> X (fst ` N)\" for X\n      using to_F_in unfolding no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q_def\n      by blast\n    then have to_F_in2: \"to_F \\<iota> \\<in> no_labels.Red_Inf_\\<G>_q q (fst ` N)\" for q\n      by fast\n    have \"labeled_ord_red_crit_fam.Red_Inf_\\<G>_q q N =\n      {\\<iota>0_FL \\<in> Inf_FL. to_F \\<iota>0_FL \\<in> no_labels.Red_Inf_\\<G>_q q (fst ` N)}\" for q\n    proof\n      show \"labeled_ord_red_crit_fam.Red_Inf_\\<G>_q q N \\<subseteq>\n        {\\<iota>0_FL \\<in> Inf_FL. to_F \\<iota>0_FL \\<in> no_labels.Red_Inf_\\<G>_q q (fst ` N)}\"\n      proof\n        fix q0 \\<iota>1\n        assume\n          i1_in: \"\\<iota>1 \\<in> labeled_ord_red_crit_fam.Red_Inf_\\<G>_q q0 N\"\n        have i1_in2: \"\\<iota>1 \\<in> Inf_FL\"\n          using i1_in unfolding labeled_ord_red_crit_fam.Red_Inf_\\<G>_q_def by blast\n          then have to_F_i1_in: \"to_F \\<iota>1 \\<in> Inf_F\"\n          using Inf_FL_to_Inf_F unfolding to_F_def by simp\n        have concl_swap: \"fst (concl_of \\<iota>1) = concl_of (to_F \\<iota>1)\"\n          unfolding concl_of_def to_F_def by simp\n        then have i1_to_F_in: \"to_F \\<iota>1 \\<in> no_labels.Red_Inf_\\<G>_q q0 (fst ` N)\"\n          using i1_in to_F_i1_in\n          unfolding labeled_ord_red_crit_fam.Red_Inf_\\<G>_q_def no_labels.Red_Inf_\\<G>_q_def\n            \\<G>_Inf_L_q_def labeled_ord_red_crit_fam.\\<G>_set_q_def no_labels.\\<G>_set_q_def \\<G>_F_L_q_def\n            by force\n        show \"\\<iota>1 \\<in> {\\<iota>0_FL \\<in> Inf_FL. to_F \\<iota>0_FL \\<in> no_labels.Red_Inf_\\<G>_q q0 (fst ` N)}\"\n          using i1_in2 i1_to_F_in by blast\n      qed\n    next\n      show \"{\\<iota>0_FL \\<in> Inf_FL. to_F \\<iota>0_FL \\<in> no_labels.Red_Inf_\\<G>_q q (fst ` N)} \\<subseteq>\n        labeled_ord_red_crit_fam.Red_Inf_\\<G>_q q N\"\n      proof\n        fix q0 \\<iota>1\n        assume\n          i1_in: \"\\<iota>1 \\<in> {\\<iota>0_FL \\<in> Inf_FL. to_F \\<iota>0_FL \\<in> no_labels.Red_Inf_\\<G>_q q0 (fst ` N)}\"\n        then have i1_in2: \"\\<iota>1 \\<in> Inf_FL\" by blast\n        then have to_F_i1_in: \"to_F \\<iota>1 \\<in> Inf_F\"\n          using Inf_FL_to_Inf_F unfolding to_F_def by simp\n        have concl_swap: \"fst (concl_of \\<iota>1) = concl_of (to_F \\<iota>1)\"\n          unfolding concl_of_def to_F_def by simp\n        then have \"((\\<G>_Inf_L_q q0 \\<iota>1) \\<noteq> None \\<and>\n          the (\\<G>_Inf_L_q q0 \\<iota>1) \\<subseteq> Red_Inf_q q0 (labeled_ord_red_crit_fam.\\<G>_set_q q0 N))\n          \\<or> ((\\<G>_Inf_L_q q0 \\<iota>1 = None) \\<and>\n          \\<G>_F_L_q q0 (concl_of \\<iota>1) \\<subseteq> (labeled_ord_red_crit_fam.\\<G>_set_q q0 N \\<union>\n            Red_F_q q0 (labeled_ord_red_crit_fam.\\<G>_set_q q0 N)))\"\n          using i1_in unfolding no_labels.Red_Inf_\\<G>_q_def \\<G>_Inf_L_q_def\n            labeled_ord_red_crit_fam.\\<G>_set_q_def no_labels.\\<G>_set_q_def \\<G>_F_L_q_def\n          by auto\n        then show \"\\<iota>1 \\<in> labeled_ord_red_crit_fam.Red_Inf_\\<G>_q q0 N\"\n          using i1_in2 unfolding labeled_ord_red_crit_fam.Red_Inf_\\<G>_q_def\n          by blast\n      qed\n    qed\n    then have \"\\<iota> \\<in> labeled_ord_red_crit_fam.Red_Inf_\\<G>_q q N\" for q\n      using to_F_in2 i_in\n      unfolding labeled_ord_red_crit_fam.Red_Inf_\\<G>_q_def\n        no_labels.Red_Inf_\\<G>_q_def \\<G>_Inf_L_q_def labeled_ord_red_crit_fam.\\<G>_set_q_def\n        no_labels.\\<G>_set_q_def \\<G>_F_L_q_def\n      by auto\n    then show \"\\<iota> \\<in> labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q N\"\n      unfolding labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q_def\n      by blast\n  qed\n  ultimately show \"\\<iota> \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_Inf_Q N \\<equiv>\n    (to_F \\<iota>) \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` N)\"\n    by argo\nqed\n\n(* lem:redundant-labeled-formulas *)\nlemma red_labeled_clauses: \\<open>C \\<in> no_labels.Red_F_\\<G>_empty (fst ` N) \\<or> (\\<exists>C' \\<in> (fst ` N). C \\<cdot>\\<succ> C') \\<or>\n  (\\<exists>(C',L') \\<in> N. (L' \\<sqsubset>l L \\<and> C \\<cdot>\\<succeq> C')) \\<Longrightarrow>\n  (C,L) \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N\\<close>\nproof -\n  assume \\<open>C \\<in> no_labels.Red_F_\\<G>_empty (fst ` N) \\<or>\n    (\\<exists>C' \\<in> (fst ` N). C \\<cdot>\\<succ> C') \\<or> (\\<exists>(C',L') \\<in> N. (L' \\<sqsubset>l L \\<and> C \\<cdot>\\<succeq> C'))\\<close>\n  moreover have i: \\<open>C \\<in> no_labels.Red_F_\\<G>_empty (fst ` N) \\<Longrightarrow>\n    (C,L) \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N\\<close>\n  proof -\n    assume \"C \\<in> no_labels.Red_F_\\<G>_empty (fst ` N)\"\n    then have \"C \\<in> no_labels.Red_F_\\<G>_empty_q q (fst ` N)\" for q\n      unfolding no_labels.Red_F_\\<G>_empty_def by fast\n    then have g_in_red: \"\\<G>_F_q q C \\<subseteq> Red_F_q q (no_labels.\\<G>_set_q q (fst ` N))\" for q\n      unfolding no_labels.Red_F_\\<G>_empty_q_def by blast\n    have \"no_labels.\\<G>_set_q q (fst ` N) = labeled_ord_red_crit_fam.\\<G>_set_q q N\" for q\n      unfolding no_labels.\\<G>_set_q_def labeled_ord_red_crit_fam.\\<G>_set_q_def \\<G>_F_L_q_def by simp\n    then have \"\\<G>_F_L_q q (C,L) \\<subseteq> Red_F_q q (labeled_ord_red_crit_fam.\\<G>_set_q q N)\" for q\n      using g_in_red unfolding \\<G>_F_L_q_def by simp\n    then show \"(C,L) \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N\"\n      unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q_def\n        labeled_ord_red_crit_fam.Red_F_\\<G>_q_g_def by blast\n  qed\n  moreover have ii: \\<open>\\<exists>C' \\<in> (fst ` N). C \\<cdot>\\<succ> C' \\<Longrightarrow>\n    (C,L) \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N\\<close>\n  proof -\n    assume \"\\<exists>C' \\<in> (fst ` N). C \\<cdot>\\<succ> C'\"\n    then obtain C' where c'_in: \"C' \\<in> (fst ` N)\" and c_prec_c': \"C \\<cdot>\\<succ> C'\" by blast\n    obtain L' where c'_l'_in: \"(C',L') \\<in> N\" using c'_in by auto\n    have c'_l'_prec: \"(C',L') \\<sqsubset> (C,L)\"\n      using c_prec_c' unfolding Prec_FL_def by (meson UNIV_I compat_equiv_prec)\n    have c_in_c'_g: \"\\<G>_F_q q C \\<subseteq> \\<G>_F_q q C'\" for q\n      using prec_F_grounding[OF c_prec_c'] by presburger\n    then have \"\\<G>_F_L_q q (C,L) \\<subseteq> \\<G>_F_L_q q (C',L')\" for q\n      unfolding no_labels.\\<G>_set_q_def labeled_ord_red_crit_fam.\\<G>_set_q_def \\<G>_F_L_q_def by auto\n    then have \"(C,L) \\<in> labeled_ord_red_crit_fam.Red_F_\\<G>_q_g q N\" for q\n      unfolding labeled_ord_red_crit_fam.Red_F_\\<G>_q_g_def using c'_l'_in c'_l'_prec by blast\n    then show \"(C,L) \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N\"\n      unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q_def by blast\n  qed\n  moreover have iii: \\<open>\\<exists>(C',L') \\<in> N. (L' \\<sqsubset>l L \\<and> C \\<cdot>\\<succeq> C')  \\<Longrightarrow>\n    (C,L) \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N\\<close>\n  proof -\n    assume \"\\<exists>(C',L') \\<in> N. (L' \\<sqsubset>l L \\<and> C \\<cdot>\\<succeq> C')\"\n    then obtain C' L' where c'_l'_in: \"(C',L') \\<in> N\" and l'_sub_l: \"L' \\<sqsubset>l L\" and c'_sub_c: \"C \\<cdot>\\<succeq> C'\"\n      by fast\n    have \"(C,L) \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N\" if \"C \\<cdot>\\<succ> C'\"\n      using that c'_l'_in ii by fastforce\n    moreover {\n      assume equiv_c_c': \"C \\<doteq> C'\"\n      then have equiv_c'_c: \"C' \\<doteq> C\"\n        using equiv_F_is_equiv_rel equiv_F_fun_def equiv_class_eq_iff by fastforce\n      then have c'_l'_prec: \"(C',L') \\<sqsubset> (C,L)\"\n        using l'_sub_l unfolding Prec_FL_def by simp\n      have \"\\<G>_F_q q C = \\<G>_F_q q C'\" for q\n        using equiv_F_grounding equiv_c'_c by blast\n      then have \"\\<G>_F_L_q q (C,L) = \\<G>_F_L_q q (C',L')\" for q\n        unfolding no_labels.\\<G>_set_q_def labeled_ord_red_crit_fam.\\<G>_set_q_def \\<G>_F_L_q_def by auto\n      then have \"(C,L) \\<in> labeled_ord_red_crit_fam.Red_F_\\<G>_q_g q N\" for q\n        unfolding labeled_ord_red_crit_fam.Red_F_\\<G>_q_g_def using c'_l'_in c'_l'_prec by blast\n      then have \"(C,L) \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N\"\n        unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q_def by blast\n    }\n    ultimately show \"(C,L) \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N\"\n      using c'_sub_c unfolding Prec_eq_F_def equiv_F_fun_def equiv_F_is_equiv_rel by blast\n  qed\n  ultimately show \\<open>(C,L) \\<in> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N\\<close>\n    by blast\nqed\n\nend\n\nsubsection \\<open>Given Clause Architecture\\<close>\n\nlocale Given_Clause = Prover_Architecture_Basis Bot_F Inf_F Bot_G Q entails_q Inf_G Red_Inf_q\n  Red_F_q \\<G>_F_q \\<G>_Inf_q l Inf_FL Equiv_F Prec_F Prec_l\n  for\n    Bot_F :: \"'f set\" and\n    Inf_F :: \"'f inference set\" and\n    Bot_G :: \"'g set\" and\n    Q :: \"'q itself\" and\n    entails_q :: \"'q \\<Rightarrow> ('g set \\<Rightarrow> 'g set \\<Rightarrow> bool)\" and\n    Inf_G :: \\<open>'g inference set\\<close> and\n    Red_Inf_q :: \"'q \\<Rightarrow> ('g set \\<Rightarrow> 'g inference set)\" and\n    Red_F_q :: \"'q \\<Rightarrow> ('g set \\<Rightarrow> 'g set)\" and\n    \\<G>_F_q :: \"'q \\<Rightarrow> 'f \\<Rightarrow> 'g set\"  and\n    \\<G>_Inf_q :: \"'q \\<Rightarrow> 'f inference \\<Rightarrow> 'g inference set option\" and\n    l :: \"'l itself\" and\n    Inf_FL :: \\<open>('f \\<times> 'l) inference set\\<close> and\n    Equiv_F :: \"('f \\<times> 'f) set\" and\n    Prec_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<cdot>\\<succ>\" 50) and\n    Prec_l :: \"'l \\<Rightarrow> 'l \\<Rightarrow> bool\" (infix \"\\<sqsubset>l\" 50)\n  + fixes\n    active :: \"'l\"\n  assumes\n    inf_have_premises: \"\\<iota>F \\<in> Inf_F \\<Longrightarrow> length (prems_of \\<iota>F) > 0\" and\n    active_minimal: \"l2 \\<noteq> active \\<Longrightarrow> active \\<sqsubset>l l2\" and\n    at_least_two_labels: \"\\<exists>l2. active \\<sqsubset>l l2\" and\n    inf_never_active: \"\\<iota> \\<in> Inf_FL \\<Longrightarrow> snd (concl_of \\<iota>) \\<noteq> active\"\nbegin\n\nlemma labeled_inf_have_premises: \"\\<iota> \\<in> Inf_FL \\<Longrightarrow> set (prems_of \\<iota>) \\<noteq> {}\"\n  using inf_have_premises Inf_FL_to_Inf_F by fastforce\n\ndefinition active_subset :: \"('f \\<times> 'l) set \\<Rightarrow> ('f \\<times> 'l) set\" where\n  \"active_subset M = {CL \\<in> M. snd CL = active}\"\n\ndefinition non_active_subset :: \"('f \\<times> 'l) set \\<Rightarrow> ('f \\<times> 'l) set\" where\n  \"non_active_subset M = {CL \\<in> M. snd CL \\<noteq> active}\"\n\ninductive Given_Clause_step :: \"('f \\<times> 'l) set \\<Rightarrow> ('f \\<times> 'l) set \\<Rightarrow> bool\" (infix \"\\<Longrightarrow>GC\" 50) where\n  process: \"N1 = N \\<union> M \\<Longrightarrow> N2 = N \\<union> M' \\<Longrightarrow> N \\<inter> M = {} \\<Longrightarrow>\n    M \\<subseteq>  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q (N \\<union> M') \\<Longrightarrow>\n    active_subset M' = {} \\<Longrightarrow> N1 \\<Longrightarrow>GC N2\" |\n  infer: \"N1 = N \\<union> {(C,L)} \\<Longrightarrow> {(C,L)} \\<inter> N = {} \\<Longrightarrow> N2 = N \\<union> {(C,active)} \\<union> M \\<Longrightarrow> L \\<noteq> active \\<Longrightarrow>\n    active_subset M = {} \\<Longrightarrow>\n    no_labels.Non_ground.Inf_from2 (fst ` (active_subset N)) {C} \\<subseteq>\n      no_labels.lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (N \\<union> {(C,active)} \\<union> M)) \\<Longrightarrow>\n    N1 \\<Longrightarrow>GC N2\"\n\nabbreviation derive :: \"('f \\<times> 'l) set \\<Rightarrow> ('f \\<times> 'l) set \\<Rightarrow> bool\" (infix \"\\<rhd>RedL\" 50) where\n  \"derive \\<equiv> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.derive\"\n\nlemma one_step_equiv: \"N1 \\<Longrightarrow>GC N2 \\<Longrightarrow> N1 \\<rhd>RedL N2\"\nproof (cases N1 N2 rule: Given_Clause_step.cases)\n  show \"N1 \\<Longrightarrow>GC N2 \\<Longrightarrow> N1 \\<Longrightarrow>GC N2\" by blast\nnext\n  fix N M M'\n  assume\n    gc_step: \"N1 \\<Longrightarrow>GC N2\" and\n    n1_is: \"N1 = N \\<union> M\" and\n    n2_is: \"N2 = N \\<union> M'\" and\n    empty_inter: \"N \\<inter> M = {}\" and\n    m_red: \"M \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q (N \\<union> M')\" and\n    active_empty: \"active_subset M' = {}\"\n  have \"N1 - N2 \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N2\"\n    using n1_is n2_is empty_inter m_red by auto\n  then show \"labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.derive N1 N2\"\n    unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.derive.simps by blast\nnext\n  fix N C L M\n  assume\n    gc_step: \"N1 \\<Longrightarrow>GC N2\" and\n    n1_is: \"N1 = N \\<union> {(C,L)}\" and\n    not_active: \"L \\<noteq> active\" and\n    n2_is: \"N2 = N \\<union> {(C, active)} \\<union> M\" and\n    empty_inter: \"{(C,L)} \\<inter> N = {}\" and\n    active_empty: \"active_subset M = {}\"\n  have \"(C, active) \\<in> N2\" using n2_is by auto\n  moreover have \"C \\<cdot>\\<succeq> C\" using Prec_eq_F_def equiv_F_is_equiv_rel equiv_class_eq_iff by fastforce\n  moreover have \"active \\<sqsubset>l L\" using active_minimal[OF not_active] .\n  ultimately have \"{(C,L)} \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N2\"\n    using red_labeled_clauses by blast\n  moreover have \"(C,L) \\<notin> M \\<Longrightarrow> N1 - N2 = {(C,L)}\" using n1_is n2_is empty_inter not_active by auto\n  moreover have \"(C,L) \\<in> M \\<Longrightarrow> N1 - N2 = {}\" using n1_is n2_is by auto\n  ultimately have \"N1 - N2 \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N2\"\n    using empty_red_f_equiv[of N2] by blast\n  then show \"labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.derive N1 N2\"\n    unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.derive.simps\n    by blast\nqed\n\nabbreviation fair :: \"('f \\<times> 'l) set llist \\<Rightarrow> bool\" where\n  \"fair \\<equiv> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.fair\"\n\n(* lem:gc-derivations-are-red-derivations *)\nlemma gc_to_red: \"chain (\\<Longrightarrow>GC) D \\<Longrightarrow> chain (\\<rhd>RedL) D\"\n  using one_step_equiv Lazy_List_Chain.chain_mono by blast\n\nlemma (in-) all_ex_finite_set: \"(\\<forall>(j::nat)\\<in>{0..<m}. \\<exists>(n::nat). P j n) \\<Longrightarrow>\n  (\\<forall>n1 n2. \\<forall>j\\<in>{0..<m}. P j n1 \\<longrightarrow> P j n2 \\<longrightarrow> n1 = n2) \\<Longrightarrow> finite {n. \\<exists>j \\<in> {0..<m}. P j n}\" for m P\nproof -\n  fix m::nat and P:: \"nat \\<Rightarrow> nat \\<Rightarrow> bool\"\n  assume\n    allj_exn: \"\\<forall>j\\<in>{0..<m}. \\<exists>n. P j n\" and\n    uniq_n: \"\\<forall>n1 n2. \\<forall>j\\<in>{0..<m}. P j n1 \\<longrightarrow> P j n2 \\<longrightarrow> n1 = n2\"\n  have \"{n. \\<exists>j \\<in> {0..<m}. P j n} = (\\<Union>((\\<lambda>j. {n. P j n}) ` {0..<m}))\" by blast\n  then have imp_finite: \"(\\<forall>j\\<in>{0..<m}. finite {n. P j n}) \\<Longrightarrow> finite {n. \\<exists>j \\<in> {0..<m}. P j n}\"\n    using finite_UN[of \"{0..<m}\" \"\\<lambda>j. {n. P j n}\"] by simp\n  have \"\\<forall>j\\<in>{0..<m}. \\<exists>!n. P j n\" using allj_exn uniq_n by blast\n  then have \"\\<forall>j\\<in>{0..<m}. finite {n. P j n}\" by (metis bounded_nat_set_is_finite lessI mem_Collect_eq)\n  then show \"finite {n. \\<exists>j \\<in> {0..<m}. P j n}\" using imp_finite by simp\nqed\n\n(* lem:fair-gc-derivations *)\nlemma gc_fair: \"chain (\\<Longrightarrow>GC) D \\<Longrightarrow> llength D > 0 \\<Longrightarrow> active_subset (lnth D 0) = {} \\<Longrightarrow>\n  non_active_subset (Liminf_llist D) = {} \\<Longrightarrow> fair D\"\nproof -\n  assume\n    deriv: \"chain (\\<Longrightarrow>GC) D\" and\n    non_empty: \"llength D > 0\" and\n    init_state: \"active_subset (lnth D 0) = {}\" and\n    final_state: \"non_active_subset (Liminf_llist D) = {}\"\n  show \"fair D\"\n    unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.fair_def\n  proof\n    fix \\<iota>\n    assume i_in: \"\\<iota> \\<in> with_labels.Inf_from (Liminf_llist D)\"\n    have i_in_inf_fl: \"\\<iota> \\<in> Inf_FL\" using i_in unfolding with_labels.Inf_from_def by blast\n    have \"Liminf_llist D = active_subset (Liminf_llist D)\"\n      using final_state unfolding non_active_subset_def active_subset_def by blast\n    then have i_in2: \"\\<iota> \\<in> with_labels.Inf_from (active_subset (Liminf_llist D))\" using i_in by simp\n    define m where \"m = length (prems_of \\<iota>)\"\n    then have m_def_F: \"m = length (prems_of (to_F \\<iota>))\" unfolding to_F_def by simp\n    have i_in_F: \"to_F \\<iota> \\<in> Inf_F\"\n      using i_in Inf_FL_to_Inf_F unfolding with_labels.Inf_from_def to_F_def by blast\n    then have m_pos: \"m > 0\" using m_def_F using inf_have_premises by blast\n    have exist_nj: \"\\<forall>j \\<in> {0..<m}. (\\<exists>nj. enat (Suc nj) < llength D \\<and>\n      (prems_of \\<iota>)!j \\<notin> active_subset (lnth D nj) \\<and>\n      (\\<forall>k. k > nj \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (lnth D k)))\"\n    proof clarify\n      fix j\n      assume j_in: \"j \\<in> {0..<m}\"\n      then obtain C where c_is: \"(C,active) = (prems_of \\<iota>)!j\"\n        using i_in2 unfolding m_def with_labels.Inf_from_def active_subset_def\n        by (smt Collect_mem_eq Collect_mono_iff atLeastLessThan_iff nth_mem old.prod.exhaust snd_conv)\n      then have \"(C,active) \\<in> Liminf_llist D\"\n        using j_in i_in unfolding m_def with_labels.Inf_from_def by force\n      then obtain nj where nj_is: \"enat nj < llength D\" and\n        c_in2: \"(C,active) \\<in> \\<Inter> (lnth D ` {k. nj \\<le> k \\<and> enat k < llength D})\"\n        unfolding Liminf_llist_def using init_state by blast\n      then have c_in3: \"\\<forall>k. k \\<ge> nj \\<longrightarrow> enat k < llength D \\<longrightarrow> (C,active) \\<in> (lnth D k)\" by blast\n      have nj_pos: \"nj > 0\" using init_state c_in2 nj_is unfolding active_subset_def by fastforce\n      obtain nj_min where nj_min_is: \"nj_min = (LEAST nj. enat nj < llength D \\<and>\n        (C,active) \\<in> \\<Inter> (lnth D ` {k. nj \\<le> k \\<and> enat k < llength D}))\" by blast\n      then have in_allk: \"\\<forall>k. k \\<ge> nj_min \\<longrightarrow> enat k < llength D \\<longrightarrow> (C,active) \\<in> (lnth D k)\"\n        using c_in3 nj_is c_in2\n        by (metis (mono_tags, lifting) INT_E LeastI_ex mem_Collect_eq)\n      have njm_smaller_D: \"enat nj_min < llength D\"\n        using nj_min_is\n        by (smt LeastI_ex \\<open>\\<And>thesis. (\\<And>nj. \\<lbrakk>enat nj < llength D;\n          (C, active) \\<in> \\<Inter> (lnth D ` {k. nj \\<le> k \\<and> enat k < llength D})\\<rbrakk> \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close>)\n      have \"nj_min > 0\"\n        using nj_is c_in2 nj_pos nj_min_is\n        by (metis (mono_tags, lifting) Collect_empty_eq \\<open>(C, active) \\<in> Liminf_llist D\\<close>\n          \\<open>Liminf_llist D = active_subset (Liminf_llist D)\\<close>\n          \\<open>\\<forall>k\\<ge>nj_min. enat k < llength D \\<longrightarrow> (C, active) \\<in> lnth D k\\<close> active_subset_def init_state\n          linorder_not_less mem_Collect_eq non_empty zero_enat_def)\n      then obtain njm_prec where nj_prec_is: \"Suc njm_prec = nj_min\" using gr0_conv_Suc by auto\n      then have njm_prec_njm: \"njm_prec < nj_min\" by blast\n      then have njm_prec_njm_enat: \"enat njm_prec < enat nj_min\" by simp\n      have njm_prec_smaller_d: \"njm_prec < llength D\"\n        using  HOL.no_atp(15)[OF njm_smaller_D njm_prec_njm_enat] .\n      have njm_prec_all_suc: \"\\<forall>k>njm_prec. enat k < llength D \\<longrightarrow> (C, active) \\<in> lnth D k\"\n        using nj_prec_is in_allk by simp\n      have notin_njm_prec: \"(C, active) \\<notin> lnth D njm_prec\"\n      proof (rule ccontr)\n        assume \"\\<not> (C, active) \\<notin> lnth D njm_prec\"\n        then have absurd_hyp: \"(C, active) \\<in> lnth D njm_prec\" by simp\n        have prec_smaller: \"enat njm_prec < llength D\" using nj_min_is nj_prec_is\n          by (smt LeastI_ex Suc_leD \\<open>\\<And>thesis. (\\<And>nj. \\<lbrakk>enat nj < llength D;\n            (C, active) \\<in> \\<Inter> (lnth D ` {k. nj \\<le> k \\<and> enat k < llength D})\\<rbrakk> \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close>\n            enat_ord_simps(1) le_eq_less_or_eq le_less_trans)\n        have \"(C,active) \\<in> \\<Inter> (lnth D ` {k. njm_prec \\<le> k \\<and> enat k < llength D})\"\n          proof -\n            {\n            fix k\n            assume k_in: \"njm_prec \\<le> k \\<and> enat k < llength D\"\n            have \"k = njm_prec \\<Longrightarrow> (C,active) \\<in> lnth D k\" using absurd_hyp by simp\n            moreover have \"njm_prec < k \\<Longrightarrow> (C,active) \\<in> lnth D k\"\n              using nj_prec_is in_allk k_in by simp\n            ultimately have \"(C,active) \\<in> lnth D k\" using k_in by fastforce\n            }\n            then show \"(C,active) \\<in> \\<Inter> (lnth D ` {k. njm_prec \\<le> k \\<and> enat k < llength D})\" by blast\n          qed\n        then have \"enat njm_prec < llength D \\<and>\n          (C,active) \\<in> \\<Inter> (lnth D ` {k. njm_prec \\<le> k \\<and> enat k < llength D})\"\n          using prec_smaller by blast\n        then show False\n          using nj_min_is nj_prec_is Orderings.wellorder_class.not_less_Least njm_prec_njm by blast\n      qed\n      then have notin_active_subs_njm_prec: \"(C, active) \\<notin> active_subset (lnth D njm_prec)\"\n        unfolding active_subset_def by blast\n      then show \"\\<exists>nj. enat (Suc nj) < llength D \\<and> (prems_of \\<iota>)!j \\<notin> active_subset (lnth D nj) \\<and>\n        (\\<forall>k. k > nj \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (lnth D k))\"\n        using c_is njm_prec_all_suc njm_prec_smaller_d by (metis (mono_tags, lifting)\n          active_subset_def mem_Collect_eq nj_prec_is njm_smaller_D snd_conv)\n    qed\n    have uniq_nj: \"j \\<in> {0..<m} \\<Longrightarrow>\n      (enat (Suc nj1) < llength D \\<and>\n      (prems_of \\<iota>)!j \\<notin> active_subset (lnth D nj1) \\<and>\n      (\\<forall>k. k > nj1 \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (lnth D k))) \\<Longrightarrow>\n      (enat (Suc nj2) < llength D \\<and>\n      (prems_of \\<iota>)!j \\<notin> active_subset (lnth D nj2) \\<and>\n      (\\<forall>k. k > nj2 \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (lnth D k))) \\<Longrightarrow> nj1=nj2\"\n    proof (clarify, rule ccontr)\n      fix j nj1 nj2\n      assume \"j \\<in> {0..<m}\" and\n        nj1_d: \"enat (Suc nj1) < llength D\" and\n        nj2_d: \"enat (Suc nj2) < llength D\" and\n        nj1_notin: \"prems_of \\<iota> ! j \\<notin> active_subset (lnth D nj1)\" and\n        k_nj1: \"\\<forall>k>nj1. enat k < llength D \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (lnth D k)\" and\n        nj2_notin: \"prems_of \\<iota> ! j \\<notin> active_subset (lnth D nj2)\" and\n        k_nj2: \"\\<forall>k>nj2. enat k < llength D \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (lnth D k)\" and\n        diff_12: \"nj1 \\<noteq> nj2\"\n      have \"nj1 < nj2 \\<Longrightarrow> False\"\n      proof -\n        assume prec_12: \"nj1 < nj2\"\n        have \"enat nj2 < llength D\" using nj2_d using Suc_ile_eq less_trans by blast\n        then have \"prems_of \\<iota> ! j \\<in> active_subset (lnth D nj2)\"\n          using k_nj1 prec_12 by simp\n        then show False using nj2_notin by simp\n      qed\n      moreover have \"nj1 > nj2 \\<Longrightarrow> False\"\n      proof -\n        assume prec_21: \"nj2 < nj1\"\n        have \"enat nj1 < llength D\" using nj1_d using Suc_ile_eq less_trans by blast\n        then have \"prems_of \\<iota> ! j \\<in> active_subset (lnth D nj1)\"\n          using k_nj2 prec_21\n          by simp\n        then show False using nj1_notin by simp\n      qed\n      ultimately show False using diff_12 by linarith\n    qed\n    define nj_set where \"nj_set = {nj. (\\<exists>j\\<in>{0..<m}. enat (Suc nj) < llength D \\<and>\n      (prems_of \\<iota>)!j \\<notin> active_subset (lnth D nj) \\<and>\n      (\\<forall>k. k > nj \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (lnth D k)))}\"\n    then have nj_not_empty: \"nj_set \\<noteq> {}\"\n    proof -\n      have zero_in: \"0 \\<in> {0..<m}\" using m_pos by simp\n      then obtain n0 where \"enat (Suc n0) < llength D\" and\n        \"prems_of \\<iota> ! 0 \\<notin> active_subset (lnth D n0)\" and\n        \"\\<forall>k>n0. enat k < llength D \\<longrightarrow> prems_of \\<iota> ! 0 \\<in> active_subset (lnth D k)\"\n        using exist_nj by fast\n      then have \"n0 \\<in> nj_set\" unfolding nj_set_def using zero_in by blast\n      then show \"nj_set \\<noteq> {}\" by auto\n    qed\n    have nj_finite: \"finite nj_set\"\n      using uniq_nj all_ex_finite_set[OF exist_nj]\n      by (metis (no_types, lifting) Suc_ile_eq dual_order.strict_implies_order\n        linorder_neqE_nat nj_set_def)\n    (* the n below in the n-1 from the pen-and-paper proof *)\n    have \"\\<exists>n \\<in> nj_set. \\<forall>nj \\<in> nj_set. nj \\<le> n\"\n      using nj_not_empty nj_finite using Max_ge Max_in by blast\n    then obtain n where n_in: \"n \\<in> nj_set\" and n_bigger: \"\\<forall>nj \\<in> nj_set. nj \\<le> n\" by blast\n    then obtain j0 where j0_in: \"j0 \\<in> {0..<m}\" and suc_n_length: \"enat (Suc n) < llength D\" and\n      j0_notin: \"(prems_of \\<iota>)!j0 \\<notin> active_subset (lnth D n)\" and\n      j0_allin: \"(\\<forall>k. k > n \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j0 \\<in> active_subset (lnth D k))\"\n      unfolding nj_set_def by blast\n    obtain C0 where C0_is: \"(prems_of \\<iota>)!j0 = (C0,active)\" using j0_in\n        using i_in2 unfolding m_def with_labels.Inf_from_def active_subset_def\n        by (smt Collect_mem_eq Collect_mono_iff atLeastLessThan_iff nth_mem old.prod.exhaust snd_conv)\n    then have C0_prems_i: \"(C0,active) \\<in> set (prems_of \\<iota>)\" using in_set_conv_nth j0_in m_def by force\n    have C0_in: \"(C0,active) \\<in> (lnth D (Suc n))\"\n      using C0_is j0_allin suc_n_length by (simp add: active_subset_def)\n    have C0_notin: \"(C0,active) \\<notin> (lnth D n)\" using C0_is j0_notin unfolding active_subset_def by simp\n    have step_n: \"lnth D n \\<Longrightarrow>GC lnth D (Suc n)\"\n      using deriv chain_lnth_rel n_in unfolding nj_set_def by blast\n    have \"\\<exists>N C L M. (lnth D n = N \\<union> {(C,L)} \\<and> {(C,L)} \\<inter> N = {} \\<and>\n      lnth D (Suc n) = N \\<union> {(C,active)} \\<union> M \\<and> L \\<noteq> active \\<and>\n      active_subset M = {} \\<and>\n      no_labels.Non_ground.Inf_from2 (fst ` (active_subset N)) {C} \\<subseteq>\n      no_labels.lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (N \\<union> {(C,active)} \\<union> M)))\"\n    proof -\n      have proc_or_infer: \"(\\<exists>N1 N M N2 M'. lnth D n = N1 \\<and> lnth D (Suc n) = N2 \\<and> N1 = N \\<union> M \\<and>\n         N2 = N \\<union> M' \\<and> N \\<inter> M = {} \\<and>\n         M \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q (N \\<union> M') \\<and>\n         active_subset M' = {}) \\<or>\n       (\\<exists>N1 N C L N2 M. lnth D n = N1 \\<and> lnth D (Suc n) = N2 \\<and> N1 = N \\<union> {(C, L)} \\<and>\n         {(C, L)} \\<inter> N = {} \\<and> N2 = N \\<union> {(C, active)} \\<union> M \\<and>\n         L \\<noteq> active \\<and> active_subset M = {} \\<and>\n         no_labels.Non_ground.Inf_from2 (fst ` (active_subset N)) {C} \\<subseteq>\n           no_labels.lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (N \\<union> {(C,active)} \\<union> M)))\"\n        using Given_Clause_step.simps[of \"lnth D n\" \"lnth D (Suc n)\"] step_n by blast\n      show ?thesis\n        using C0_in C0_notin proc_or_infer j0_in C0_is\n        by (smt Un_iff active_subset_def mem_Collect_eq snd_conv sup_bot.right_neutral)\n    qed\n    then obtain N M L where inf_from_subs:\n      \"no_labels.Non_ground.Inf_from2 (fst ` (active_subset N)) {C0} \\<subseteq>\n      no_labels.lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (N \\<union> {(C0,active)} \\<union> M))\" and\n      nth_d_is: \"lnth D n = N \\<union> {(C0,L)}\" and\n      suc_nth_d_is: \"lnth D (Suc n) = N \\<union> {(C0,active)} \\<union> M\" and\n      l_not_active: \"L \\<noteq> active\"\n      using C0_in C0_notin j0_in C0_is using active_subset_def by fastforce\n    have \"j \\<in> {0..<m} \\<Longrightarrow> (prems_of \\<iota>)!j \\<noteq> (prems_of \\<iota>)!j0 \\<Longrightarrow> (prems_of \\<iota>)!j \\<in> (active_subset N)\" for j\n    proof -\n      fix j\n      assume j_in: \"j \\<in> {0..<m}\" and\n      j_not_j0: \"(prems_of \\<iota>)!j \\<noteq> (prems_of \\<iota>)!j0\"\n      obtain nj where nj_len: \"enat (Suc nj) < llength D\" and\n        nj_prems: \"(prems_of \\<iota>)!j \\<notin> active_subset (lnth D nj)\" and\n        nj_greater: \"(\\<forall>k. k > nj \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (lnth D k))\"\n        using exist_nj j_in by blast\n      then have \"nj \\<in> nj_set\" unfolding nj_set_def using j_in by blast\n      moreover have \"nj \\<noteq> n\"\n      proof (rule ccontr)\n        assume \"\\<not> nj \\<noteq> n\"\n        then have \"(prems_of \\<iota>)!j = (C0,active)\"\n          using C0_in C0_notin Given_Clause_step.simps[of \"lnth D n\" \"lnth D (Suc n)\"] step_n\n          by (smt Un_iff Un_insert_right nj_greater nj_prems active_subset_def empty_Collect_eq\n            insertE lessI mem_Collect_eq prod.sel(2) suc_n_length)\n        then show False using j_not_j0 C0_is by simp\n      qed\n      ultimately have \"nj < n\" using n_bigger by force\n      then have \"(prems_of \\<iota>)!j \\<in> (active_subset (lnth D n))\"\n        using nj_greater n_in Suc_ile_eq dual_order.strict_implies_order unfolding nj_set_def by blast\n      then show \"(prems_of \\<iota>)!j \\<in> (active_subset N)\"\n        using nth_d_is l_not_active unfolding active_subset_def by force\n    qed\n    then have \"set (prems_of \\<iota>) \\<subseteq> active_subset N \\<union> {(C0, active)}\"\n      using C0_prems_i C0_is m_def by (metis Un_iff atLeast0LessThan in_set_conv_nth insertCI lessThan_iff subrelI)\n    moreover have \"\\<not> (set (prems_of \\<iota>) \\<subseteq> active_subset N - {(C0, active)})\"  using C0_prems_i by blast\n    ultimately have \"\\<iota> \\<in> with_labels.Inf_from2 (active_subset N) {(C0,active)}\"\n      using i_in_inf_fl unfolding with_labels.Inf_from2_def with_labels.Inf_from_def by blast\n    then have \"to_F \\<iota> \\<in> no_labels.Non_ground.Inf_from2 (fst ` (active_subset N)) {C0}\"\n      unfolding to_F_def with_labels.Inf_from2_def with_labels.Inf_from_def\n        no_labels.Non_ground.Inf_from2_def no_labels.Non_ground.Inf_from_def using Inf_FL_to_Inf_F\n      by force\n    then have \"to_F \\<iota> \\<in> no_labels.lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (lnth D (Suc n)))\"\n      using suc_nth_d_is inf_from_subs by fastforce\n    then have \"\\<forall>q. (\\<G>_Inf_q q (to_F \\<iota>) \\<noteq> None \\<and>\n      the (\\<G>_Inf_q q (to_F \\<iota>)) \\<subseteq> Red_Inf_q q (\\<Union> (\\<G>_F_q q ` (fst ` (lnth D (Suc n))))))\n      \\<or> (\\<G>_Inf_q q (to_F \\<iota>) = None \\<and>\n      \\<G>_F_q q (concl_of (to_F \\<iota>)) \\<subseteq> (\\<Union> (\\<G>_F_q q ` (fst ` (lnth D (Suc n))))) \\<union>\n        Red_F_q q (\\<Union> (\\<G>_F_q q ` (fst ` (lnth D (Suc n))))))\"\n      unfolding to_F_def no_labels.lifted_calc_w_red_crit_family.Red_Inf_Q_def\n        no_labels.Red_Inf_\\<G>_q_def no_labels.\\<G>_set_q_def\n      by fastforce\n    then have \"\\<iota> \\<in> with_labels.Red_Inf_Q (lnth D (Suc n))\"\n      unfolding to_F_def with_labels.Red_Inf_Q_def Red_Inf_\\<G>_L_q_def \\<G>_Inf_L_q_def \\<G>_set_L_q_def\n        \\<G>_F_L_q_def using i_in_inf_fl by auto\n    then show \"\\<iota> \\<in>\n      labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.inter_red_crit_calculus.Sup_Red_Inf_llist D\"\n      unfolding\n        labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.inter_red_crit_calculus.Sup_Red_Inf_llist_def\n      using red_inf_equiv2 suc_n_length by auto\n  qed\nqed\n\n(* thm:gc-completeness *)\ntheorem gc_complete: \"chain (\\<Longrightarrow>GC) D \\<Longrightarrow> llength D > 0 \\<Longrightarrow> active_subset (lnth D 0) = {} \\<Longrightarrow>\n  non_active_subset (Liminf_llist D) = {} \\<Longrightarrow> B \\<in> Bot_F \\<Longrightarrow>\n  no_labels.entails_\\<G>_Q (fst ` (lnth D 0)) {B} \\<Longrightarrow>\n  \\<exists>i. enat i < llength D \\<and> (\\<exists>BL\\<in> Bot_FL. BL \\<in> (lnth D i))\"\nproof -\n  fix B\n  assume\n    deriv: \"chain (\\<Longrightarrow>GC) D\" and\n    not_empty_d: \"llength D > 0\" and\n    init_state: \"active_subset (lnth D 0) = {}\" and\n    final_state: \"non_active_subset (Liminf_llist D) = {}\" and\n    b_in: \"B \\<in> Bot_F\" and\n    bot_entailed: \"no_labels.entails_\\<G>_Q (fst ` (lnth D 0)) {B}\"\n  have labeled_b_in: \"(B,active) \\<in> Bot_FL\" unfolding Bot_FL_def using b_in by simp\n  have not_empty_d2: \"\\<not> lnull D\" using not_empty_d by force\n  have labeled_bot_entailed: \"entails_\\<G>_L_Q  (lnth D 0) {(B,active)}\"\n    using labeled_entailment_lifting bot_entailed by fastforce\n  have \"fair D\" using gc_fair[OF deriv not_empty_d init_state final_state] .\n  then have \"\\<exists>i \\<in> {i. enat i < llength D}. \\<exists>BL\\<in>Bot_FL. BL \\<in> lnth D i\"\n    using labeled_ordered_dynamic_ref_comp labeled_b_in not_empty_d2 gc_to_red[OF deriv]\n      labeled_bot_entailed entail_equiv\n    unfolding dynamic_refutational_complete_calculus_def\n      dynamic_refutational_complete_calculus_axioms_def by blast\n  then show ?thesis by blast\nqed\n\nend\n\nsubsection \\<open>Lazy Given Clause Architecture\\<close>\n\nlocale Lazy_Given_Clause = Prover_Architecture_Basis Bot_F Inf_F Bot_G Q entails_q Inf_G Red_Inf_q\n  Red_F_q \\<G>_F_q \\<G>_Inf_q l Inf_FL Equiv_F Prec_F Prec_l\n  for\n    Bot_F :: \"'f set\" and\n    Inf_F :: \"'f inference set\" and\n    Bot_G :: \"'g set\" and\n    Q :: \"'q itself\" and\n    entails_q :: \"'q \\<Rightarrow> ('g set \\<Rightarrow> 'g set \\<Rightarrow> bool)\" and\n    Inf_G :: \\<open>'g inference set\\<close> and\n    Red_Inf_q :: \"'q \\<Rightarrow> ('g set \\<Rightarrow> 'g inference set)\" and\n    Red_F_q :: \"'q \\<Rightarrow> ('g set \\<Rightarrow> 'g set)\" and\n    \\<G>_F_q :: \"'q \\<Rightarrow> 'f \\<Rightarrow> 'g set\"  and\n    \\<G>_Inf_q :: \"'q \\<Rightarrow> 'f inference \\<Rightarrow> 'g inference set option\" and\n    l :: \"'l itself\" and\n    Inf_FL :: \\<open>('f \\<times> 'l) inference set\\<close> and\n    Equiv_F :: \"('f \\<times> 'f) set\" and\n    Prec_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<cdot>\\<succ>\" 50) and\n    Prec_l :: \"'l \\<Rightarrow> 'l \\<Rightarrow> bool\" (infix \"\\<sqsubset>l\" 50)\n  + fixes\n    active :: \"'l\"\n  assumes\n    active_minimal: \"l2 \\<noteq> active \\<Longrightarrow> active \\<sqsubset>l l2\" and\n    at_least_two_labels: \"\\<exists>l2. active \\<sqsubset>l l2\" and\n    inf_never_active: \"\\<iota> \\<in> Inf_FL \\<Longrightarrow> snd (concl_of \\<iota>) \\<noteq> active\"\nbegin\n\ndefinition active_subset :: \"('f \\<times> 'l) set \\<Rightarrow> ('f \\<times> 'l) set\" where\n  \"active_subset M = {CL \\<in> M. snd CL = active}\"\n\ndefinition non_active_subset :: \"('f \\<times> 'l) set \\<Rightarrow> ('f \\<times> 'l) set\" where\n  \"non_active_subset M = {CL \\<in> M. snd CL \\<noteq> active}\"\n\ninductive Lazy_Given_Clause_step :: \"('f inference set) \\<times> (('f \\<times> 'l) set) \\<Rightarrow>\n  ('f inference set) \\<times> (('f \\<times> 'l) set) \\<Rightarrow> bool\" (infix \"\\<Longrightarrow>LGC\" 50) where\n  process: \"N1 = N \\<union> M \\<Longrightarrow> N2 = N \\<union> M' \\<Longrightarrow> N \\<inter> M = {} \\<Longrightarrow>\n    M \\<subseteq>  labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q (N \\<union> M') \\<Longrightarrow>\n    active_subset M' = {} \\<Longrightarrow> (T,N1) \\<Longrightarrow>LGC (T,N2)\" |\n  schedule_infer: \"T2 = T1 \\<union> T' \\<Longrightarrow> N1 = N \\<union> {(C,L)} \\<Longrightarrow> {(C,L)} \\<inter> N = {} \\<Longrightarrow> N2 = N \\<union> {(C,active)} \\<Longrightarrow>\n    L \\<noteq> active \\<Longrightarrow> T' = no_labels.Non_ground.Inf_from2 (fst ` (active_subset N)) {C} \\<Longrightarrow>\n    (T1,N1) \\<Longrightarrow>LGC (T2,N2)\" |\n  compute_infer: \"T1 = T2 \\<union> {\\<iota>} \\<Longrightarrow> T2 \\<inter> {\\<iota>} = {} \\<Longrightarrow> N2 = N1 \\<union> M \\<Longrightarrow> active_subset M = {} \\<Longrightarrow>\n    \\<iota> \\<in> no_labels.lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (N1 \\<union> M)) \\<Longrightarrow>\n    (T1,N1) \\<Longrightarrow>LGC (T2,N2)\" |\n  delete_orphans: \"T1 = T2 \\<union> T' \\<Longrightarrow> T2 \\<inter> T' = {} \\<Longrightarrow>\n    T' \\<inter> no_labels.Non_ground.Inf_from (fst ` (active_subset N)) = {} \\<Longrightarrow> (T1,N) \\<Longrightarrow>LGC (T2,N)\"\n\nabbreviation derive :: \"('f \\<times> 'l) set \\<Rightarrow> ('f \\<times> 'l) set \\<Rightarrow> bool\" (infix \"\\<rhd>RedL\" 50) where\n  \"derive \\<equiv> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.derive\"\n\nlemma premise_free_inf_always_from: \"\\<iota> \\<in> Inf_F \\<Longrightarrow> length (prems_of \\<iota>) = 0 \\<Longrightarrow>\n  \\<iota> \\<in> no_labels.Non_ground.Inf_from N\"\n  unfolding no_labels.Non_ground.Inf_from_def by simp\n\nlemma one_step_equiv: \"(T1,N1) \\<Longrightarrow>LGC (T2,N2) \\<Longrightarrow> N1 \\<rhd>RedL N2\"\nproof (cases \"(T1,N1)\" \"(T2,N2)\" rule: Lazy_Given_Clause_step.cases)\n  show \"(T1,N1) \\<Longrightarrow>LGC (T2,N2) \\<Longrightarrow> (T1,N1) \\<Longrightarrow>LGC (T2,N2)\" by blast\nnext\n  fix N M M'\n  assume\n    n1_is: \"N1 = N \\<union> M\" and\n    n2_is: \"N2 = N \\<union> M'\" and\n    empty_inter: \"N \\<inter> M = {}\" and\n    m_red: \"M \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q (N \\<union> M')\"\n  have \"N1 - N2 \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N2\"\n    using n1_is n2_is empty_inter m_red by auto\n  then show \"N1 \\<rhd>RedL N2\"\n    unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.derive.simps by blast\nnext\n  fix N C L M\n  assume\n    n1_is: \"N1 = N \\<union> {(C,L)}\" and\n    not_active: \"L \\<noteq> active\" and\n    n2_is: \"N2 = N \\<union> {(C, active)}\"\n  have \"(C, active) \\<in> N2\" using n2_is by auto\n  moreover have \"C \\<cdot>\\<succeq> C\" using Prec_eq_F_def equiv_F_is_equiv_rel equiv_class_eq_iff by fastforce\n  moreover have \"active \\<sqsubset>l L\" using active_minimal[OF not_active] .\n  ultimately have \"{(C,L)} \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N2\"\n    using red_labeled_clauses by blast\n  then have \"N1 - N2 \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N2\"\n    using empty_red_f_equiv[of N2] using n1_is n2_is by blast\n  then show \"N1 \\<rhd>RedL N2\"\n    unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.derive.simps\n    by blast\nnext\n  fix M\n  assume\n    n2_is: \"N2 = N1 \\<union> M\"\n  have \"N1 - N2 \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N2\"\n    using n2_is by blast\n  then show \"N1 \\<rhd>RedL N2\"\n    unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.derive.simps\n    by blast\nnext\n  assume n2_is: \"N2 = N1\"\n  have \"N1 - N2 \\<subseteq> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.Red_F_Q N2\"\n    using n2_is by blast\n  then show \"N1 \\<rhd>RedL N2\"\n    unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.derive.simps\n    by blast\nqed\n\nabbreviation fair :: \"('f \\<times> 'l) set llist \\<Rightarrow> bool\" where\n  \"fair \\<equiv> labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.fair\"\n\n(* lem:lgc-derivations-are-red-derivations *)\nlemma lgc_to_red: \"chain (\\<Longrightarrow>LGC) D \\<Longrightarrow> chain (\\<rhd>RedL) (lmap snd D)\"\n  using one_step_equiv Lazy_List_Chain.chain_mono by (smt chain_lmap prod.collapse)\n\n(* lem:fair-lgc-derivations *)\nlemma lgc_fair: \"chain (\\<Longrightarrow>LGC) D \\<Longrightarrow> llength D > 0 \\<Longrightarrow> active_subset (snd (lnth D 0)) = {} \\<Longrightarrow>\n  non_active_subset (Liminf_llist (lmap snd D)) = {} \\<Longrightarrow> (\\<forall>\\<iota> \\<in> Inf_F. length (prems_of \\<iota>) = 0 \\<longrightarrow>\n  \\<iota> \\<in> (fst (lnth D 0))) \\<Longrightarrow>\n  Liminf_llist (lmap fst D) = {} \\<Longrightarrow> fair (lmap snd D)\"\nproof -\n  assume\n    deriv: \"chain (\\<Longrightarrow>LGC) D\" and\n    non_empty: \"llength D > 0\" and\n    init_state: \"active_subset (snd (lnth D 0)) = {}\" and\n    final_state: \"non_active_subset (Liminf_llist (lmap snd D)) = {}\" and\n    no_prems_init_active: \"\\<forall>\\<iota> \\<in> Inf_F. length (prems_of \\<iota>) = 0 \\<longrightarrow> \\<iota> \\<in> (fst (lnth D 0))\" and\n    final_schedule: \"Liminf_llist (lmap fst D) = {}\"\n  show \"fair (lmap snd D)\"\n    unfolding labeled_ord_red_crit_fam.lifted_calc_w_red_crit_family.inter_red_crit_calculus.fair_def\n  proof\n    fix \\<iota>\n    assume i_in: \"\\<iota> \\<in> with_labels.Inf_from (Liminf_llist (lmap snd D))\"\n    have i_in_inf_fl: \"\\<iota> \\<in> Inf_FL\" using i_in unfolding with_labels.Inf_from_def by blast\n    have \"Liminf_llist (lmap snd D) = active_subset (Liminf_llist (lmap snd D))\"\n      using final_state unfolding non_active_subset_def active_subset_def by blast\n    then have i_in2: \"\\<iota> \\<in> with_labels.Inf_from (active_subset (Liminf_llist (lmap snd D)))\"\n      using i_in by simp\n    define m where \"m = length (prems_of \\<iota>)\"\n    then have m_def_F: \"m = length (prems_of (to_F \\<iota>))\" unfolding to_F_def by simp\n    have i_in_F: \"to_F \\<iota> \\<in> Inf_F\"\n      using i_in Inf_FL_to_Inf_F unfolding with_labels.Inf_from_def to_F_def by blast\n    have exist_nj: \"\\<forall>j \\<in> {0..<m}. (\\<exists>nj. enat (Suc nj) < llength D \\<and>\n      (prems_of \\<iota>)!j \\<notin> active_subset (snd (lnth D nj)) \\<and>\n      (\\<forall>k. k > nj \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (snd (lnth D k))))\"\n    proof clarify\n      fix j\n      assume j_in: \"j \\<in> {0..<m}\"\n      then obtain C where c_is: \"(C,active) = (prems_of \\<iota>)!j\"\n        using i_in2 unfolding m_def with_labels.Inf_from_def active_subset_def\n        by (smt Collect_mem_eq Collect_mono_iff atLeastLessThan_iff nth_mem old.prod.exhaust snd_conv)\n      then have \"(C,active) \\<in> Liminf_llist (lmap snd D)\"\n        using j_in i_in unfolding m_def with_labels.Inf_from_def by force\n      then obtain nj where nj_is: \"enat nj < llength D\" and\n        c_in2: \"(C,active) \\<in> \\<Inter> (snd ` (lnth D ` {k. nj \\<le> k \\<and> enat k < llength D}))\"\n        unfolding Liminf_llist_def using init_state by fastforce\n      then have c_in3: \"\\<forall>k. k \\<ge> nj \\<longrightarrow> enat k < llength D \\<longrightarrow> (C,active) \\<in> snd (lnth D k)\" by blast\n      have nj_pos: \"nj > 0\" using init_state c_in2 nj_is unfolding active_subset_def by fastforce\n      obtain nj_min where nj_min_is: \"nj_min = (LEAST nj. enat nj < llength D \\<and>\n        (C,active) \\<in> \\<Inter> (snd ` (lnth D ` {k. nj \\<le> k \\<and> enat k < llength D})))\" by blast\n      then have in_allk: \"\\<forall>k. k \\<ge> nj_min \\<longrightarrow> enat k < llength D \\<longrightarrow> (C,active) \\<in> snd (lnth D k)\"\n        using c_in3 nj_is c_in2 INT_E LeastI_ex\n        by (smt INT_iff INT_simps(10) c_is image_eqI mem_Collect_eq)\n      have njm_smaller_D: \"enat nj_min < llength D\"\n        using nj_min_is\n        by (smt LeastI_ex \\<open>\\<And>thesis. (\\<And>nj. \\<lbrakk>enat nj < llength D;\n          (C, active) \\<in> \\<Inter> (snd ` (lnth D ` {k. nj \\<le> k \\<and> enat k < llength D}))\\<rbrakk> \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close>)\n      have \"nj_min > 0\"\n        using nj_is c_in2 nj_pos nj_min_is\n        by (metis (mono_tags, lifting) active_subset_def emptyE in_allk init_state mem_Collect_eq\n          non_empty not_less snd_conv zero_enat_def)\n      then obtain njm_prec where nj_prec_is: \"Suc njm_prec = nj_min\" using gr0_conv_Suc by auto\n      then have njm_prec_njm: \"njm_prec < nj_min\" by blast\n      then have njm_prec_njm_enat: \"enat njm_prec < enat nj_min\" by simp\n      have njm_prec_smaller_d: \"njm_prec < llength D\"\n        using  HOL.no_atp(15)[OF njm_smaller_D njm_prec_njm_enat] .\n      have njm_prec_all_suc: \"\\<forall>k>njm_prec. enat k < llength D \\<longrightarrow> (C, active) \\<in> snd (lnth D k)\"\n        using nj_prec_is in_allk by simp\n      have notin_njm_prec: \"(C, active) \\<notin> snd (lnth D njm_prec)\"\n      proof (rule ccontr)\n        assume \"\\<not> (C, active) \\<notin> snd (lnth D njm_prec)\"\n        then have absurd_hyp: \"(C, active) \\<in> snd (lnth D njm_prec)\" by simp\n        have prec_smaller: \"enat njm_prec < llength D\" using nj_min_is nj_prec_is\n          by (smt LeastI_ex Suc_leD \\<open>\\<And>thesis. (\\<And>nj. \\<lbrakk>enat nj < llength D;\n            (C, active) \\<in> \\<Inter> (snd ` (lnth D ` {k. nj \\<le> k \\<and> enat k < llength D}))\\<rbrakk> \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close>\n            enat_ord_simps(1) le_eq_less_or_eq le_less_trans)\n        have \"(C,active) \\<in> \\<Inter> (snd ` (lnth D ` {k. njm_prec \\<le> k \\<and> enat k < llength D}))\"\n          proof -\n            {\n            fix k\n            assume k_in: \"njm_prec \\<le> k \\<and> enat k < llength D\"\n            have \"k = njm_prec \\<Longrightarrow> (C,active) \\<in> snd (lnth D k)\" using absurd_hyp by simp\n            moreover have \"njm_prec < k \\<Longrightarrow> (C,active) \\<in> snd (lnth D k)\"\n              using nj_prec_is in_allk k_in by simp\n            ultimately have \"(C,active) \\<in> snd (lnth D k)\" using k_in by fastforce\n            }\n            then show \"(C,active) \\<in> \\<Inter> (snd ` (lnth D ` {k. njm_prec \\<le> k \\<and> enat k < llength D}))\"\n              by blast\n          qed\n        then have \"enat njm_prec < llength D \\<and>\n          (C,active) \\<in> \\<Inter> (snd ` (lnth D ` {k. njm_prec \\<le> k \\<and> enat k < llength D}))\"\n          using prec_smaller by blast\n        then show False\n          using nj_min_is nj_prec_is Orderings.wellorder_class.not_less_Least njm_prec_njm by blast\n      qed\n      then have notin_active_subs_njm_prec: \"(C, active) \\<notin> active_subset (snd (lnth D njm_prec))\"\n        unfolding active_subset_def by blast\n      then show \"\\<exists>nj. enat (Suc nj) < llength D \\<and> (prems_of \\<iota>)!j \\<notin> active_subset (snd (lnth D nj)) \\<and>\n        (\\<forall>k. k > nj \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (snd (lnth D k)))\"\n        using c_is njm_prec_all_suc njm_prec_smaller_d by (metis (mono_tags, lifting)\n          active_subset_def mem_Collect_eq nj_prec_is njm_smaller_D snd_conv)\n    qed\n    define nj_set where \"nj_set = {nj. (\\<exists>j\\<in>{0..<m}. enat (Suc nj) < llength D \\<and>\n      (prems_of \\<iota>)!j \\<notin> active_subset (snd (lnth D nj)) \\<and>\n      (\\<forall>k. k > nj \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (snd (lnth D k))))}\"\n    {\n      assume m_null: \"m = 0\"\n      then have \"enat 0 < llength D \\<and> to_F \\<iota> \\<in> fst (lnth D 0)\"\n        using no_prems_init_active i_in_F non_empty m_def_F zero_enat_def by auto\n      then have \"\\<exists>n. enat n < llength D \\<and> to_F \\<iota> \\<in> fst (lnth D n)\"\n        by blast\n    }\n    moreover {\n      assume m_pos: \"m > 0\"\n      have uniq_nj: \"j \\<in> {0..<m} \\<Longrightarrow>\n        (enat (Suc nj1) < llength D \\<and>\n        (prems_of \\<iota>)!j \\<notin> active_subset (snd (lnth D nj1)) \\<and>\n        (\\<forall>k. k > nj1 \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (snd (lnth D k)))) \\<Longrightarrow>\n        (enat (Suc nj2) < llength D \\<and>\n        (prems_of \\<iota>)!j \\<notin> active_subset (snd (lnth D nj2)) \\<and>\n        (\\<forall>k. k > nj2 \\<longrightarrow> enat k < llength D \\<longrightarrow> (prems_of \\<iota>)!j \\<in> active_subset (snd (lnth D k)))) \\<Longrightarrow>\n        nj1=nj2\"\n      proof (clarify, rule ccontr)\n        fix j nj1 nj2\n        assume \"j \\<in> {0..<m}\" and\n          nj1_d: \"enat (Suc nj1) < llength D\" and\n          nj2_d: \"enat (Suc nj2) < llength D\" and\n          nj1_notin: \"prems_of \\<iota> ! j \\<notin> active_subset (snd (lnth D nj1))\" and\n          k_nj1: \"\\<forall>k>nj1. enat k < llength D \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (snd (lnth D k))\" and\n          nj2_notin: \"prems_of \\<iota> ! j \\<notin> active_subset (snd (lnth D nj2))\" and\n          k_nj2: \"\\<forall>k>nj2. enat k < llength D \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (snd (lnth D k))\" and\n          diff_12: \"nj1 \\<noteq> nj2\"\n        have \"nj1 < nj2 \\<Longrightarrow> False\"\n        proof -\n          assume prec_12: \"nj1 < nj2\"\n          have \"enat nj2 < llength D\" using nj2_d using Suc_ile_eq less_trans by blast\n          then have \"prems_of \\<iota> ! j \\<in> active_subset (snd (lnth D nj2))\"\n            using k_nj1 prec_12 by simp\n          then show False using nj2_notin by simp\n        qed\n        moreover have \"nj1 > nj2 \\<Longrightarrow> False\"\n        proof -\n          assume prec_21: \"nj2 < nj1\"\n          have \"enat nj1 < llength D\" using nj1_d using Suc_ile_eq less_trans by blast\n          then have \"prems_of \\<iota> ! j \\<in> active_subset (snd (lnth D nj1))\"\n            using k_nj2 prec_21\n            by simp\n          then show False using nj1_notin by simp\n        qed\n        ultimately show False using diff_12 by linarith\n      qed\n            have nj_not_empty: \"nj_set \\<noteq> {}\"\n      proof -\n        have zero_in: \"0 \\<in> {0..<m}\" using m_pos by simp\n        then obtain n0 where \"enat (Suc n0) < llength D\" and\n          \"prems_of \\<iota> ! 0 \\<notin> active_subset (snd (lnth D n0))\" and\n          \"\\<forall>k>n0. enat k < llength D \\<longrightarrow> prems_of \\<iota> ! 0 \\<in> active_subset (snd (lnth D k))\"\n          using exist_nj by fast\n        then have \"n0 \\<in> nj_set\" unfolding nj_set_def using zero_in by blast\n        then show \"nj_set \\<noteq> {}\" by auto\n      qed\n      have nj_finite: \"finite nj_set\"\n        using uniq_nj all_ex_finite_set[OF exist_nj] by (metis (no_types, lifting) Suc_ile_eq\n          dual_order.strict_implies_order linorder_neqE_nat nj_set_def)\n      have \"\\<exists>n \\<in> nj_set. \\<forall>nj \\<in> nj_set. nj \\<le> n\"\n        using nj_not_empty nj_finite using Max_ge Max_in by blast\n      then obtain n where n_in: \"n \\<in> nj_set\" and n_bigger: \"\\<forall>nj \\<in> nj_set. nj \\<le> n\" by blast\n      then obtain j0 where j0_in: \"j0 \\<in> {0..<m}\" and suc_n_length: \"enat (Suc n) < llength D\" and\n        j0_notin: \"(prems_of \\<iota>)!j0 \\<notin> active_subset (snd (lnth D n))\" and\n        j0_allin: \"(\\<forall>k. k > n \\<longrightarrow> enat k < llength D \\<longrightarrow>\n          (prems_of \\<iota>)!j0 \\<in> active_subset (snd (lnth D k)))\"\n        unfolding nj_set_def by blast\n      obtain C0 where C0_is: \"(prems_of \\<iota>)!j0 = (C0,active)\"\n        using j0_in i_in2 unfolding m_def with_labels.Inf_from_def active_subset_def\n        by (smt Collect_mem_eq Collect_mono_iff atLeastLessThan_iff nth_mem old.prod.exhaust snd_conv)\n      then have C0_prems_i: \"(C0,active) \\<in> set (prems_of \\<iota>)\" using in_set_conv_nth j0_in m_def by force\n      have C0_in: \"(C0,active) \\<in> (snd (lnth D (Suc n)))\"\n        using C0_is j0_allin suc_n_length by (simp add: active_subset_def)\n      have C0_notin: \"(C0,active) \\<notin> (snd (lnth D n))\"\n        using C0_is j0_notin unfolding active_subset_def by simp\n      have step_n: \"lnth D n \\<Longrightarrow>LGC lnth D (Suc n)\"\n        using deriv chain_lnth_rel n_in unfolding nj_set_def by blast\n      have is_scheduled: \"\\<exists>T2 T1 T' N1 N C L N2. lnth D n = (T1, N1) \\<and> lnth D (Suc n) = (T2, N2) \\<and>\n        T2 = T1 \\<union> T' \\<and> N1 = N \\<union> {(C, L)} \\<and> {(C, L)} \\<inter> N = {} \\<and> N2 = N \\<union> {(C, active)} \\<and> L \\<noteq> active \\<and>\n        T' = no_labels.Non_ground.Inf_from2 (fst ` active_subset N) {C}\"\n        using Lazy_Given_Clause_step.simps[of \"lnth D n\" \"lnth D (Suc n)\"] step_n C0_in C0_notin\n        unfolding active_subset_def by fastforce\n      then obtain T2 T1 T' N1 N L N2 where nth_d_is: \"lnth D n = (T1, N1)\" and\n        suc_nth_d_is: \"lnth D (Suc n) = (T2, N2)\" and t2_is: \"T2 = T1 \\<union> T'\" and\n        n1_is: \"N1 = N \\<union> {(C0, L)}\" \"{(C0, L)} \\<inter> N = {}\" \"N2 = N \\<union> {(C0, active)}\" and\n        l_not_active: \"L \\<noteq> active\" and\n        tp_is: \"T' = no_labels.Non_ground.Inf_from2 (fst ` active_subset N) {C0}\"\n        using C0_in C0_notin j0_in C0_is using active_subset_def by fastforce\n      have \"j \\<in> {0..<m} \\<Longrightarrow> (prems_of \\<iota>)!j \\<noteq> (prems_of \\<iota>)!j0 \\<Longrightarrow> (prems_of \\<iota>)!j \\<in> (active_subset N)\"\n        for j\n      proof -\n        fix j\n        assume j_in: \"j \\<in> {0..<m}\" and\n        j_not_j0: \"(prems_of \\<iota>)!j \\<noteq> (prems_of \\<iota>)!j0\"\n        obtain nj where nj_len: \"enat (Suc nj) < llength D\" and\n          nj_prems: \"(prems_of \\<iota>)!j \\<notin> active_subset (snd (lnth D nj))\" and\n          nj_greater: \"(\\<forall>k. k > nj \\<longrightarrow> enat k < llength D \\<longrightarrow>\n            (prems_of \\<iota>)!j \\<in> active_subset (snd (lnth D k)))\"\n          using exist_nj j_in by blast\n        then have \"nj \\<in> nj_set\" unfolding nj_set_def using j_in by blast\n        moreover have \"nj \\<noteq> n\"\n        proof (rule ccontr)\n          assume \"\\<not> nj \\<noteq> n\"\n          then have \"(prems_of \\<iota>)!j = (C0,active)\"\n            using C0_in C0_notin Lazy_Given_Clause_step.simps[of \"lnth D n\" \"lnth D (Suc n)\"] step_n\n              active_subset_def is_scheduled nj_greater nj_prems suc_n_length by auto\n          then show False using j_not_j0 C0_is by simp\n        qed\n        ultimately have \"nj < n\" using n_bigger by force\n        then have \"(prems_of \\<iota>)!j \\<in> (active_subset (snd (lnth D n)))\"\n          using nj_greater n_in Suc_ile_eq dual_order.strict_implies_order\n          unfolding nj_set_def by blast\n        then show \"(prems_of \\<iota>)!j \\<in> (active_subset N)\"\n          using nth_d_is l_not_active n1_is unfolding active_subset_def by force\n      qed\n      then have prems_i_active: \"set (prems_of \\<iota>) \\<subseteq> active_subset N \\<union> {(C0, active)}\"\n        using C0_prems_i C0_is m_def\n        by (metis Un_iff atLeast0LessThan in_set_conv_nth insertCI lessThan_iff subrelI)\n      moreover have \"\\<not> (set (prems_of \\<iota>) \\<subseteq> active_subset N - {(C0, active)})\"  using C0_prems_i by blast\n      ultimately have \"\\<iota> \\<in> with_labels.Inf_from2 (active_subset N) {(C0,active)}\"\n        using i_in_inf_fl prems_i_active unfolding with_labels.Inf_from2_def with_labels.Inf_from_def\n        by blast\n      then have \"to_F \\<iota> \\<in> no_labels.Non_ground.Inf_from2 (fst ` (active_subset N)) {C0}\"\n        unfolding to_F_def with_labels.Inf_from2_def with_labels.Inf_from_def\n          no_labels.Non_ground.Inf_from2_def no_labels.Non_ground.Inf_from_def\n        using Inf_FL_to_Inf_F by force\n      then have i_in_t2: \"to_F \\<iota> \\<in> T2\" using tp_is t2_is by simp\n      have \"j \\<in> {0..<m} \\<Longrightarrow> (\\<forall>k. k > n \\<longrightarrow> enat k < llength D \\<longrightarrow>\n        (prems_of \\<iota>)!j \\<in> active_subset (snd (lnth D k)))\" for j\n      proof (cases \"j = j0\")\n        case True\n        assume \"j = j0\"\n        then show \"(\\<forall>k. k > n \\<longrightarrow> enat k < llength D \\<longrightarrow>\n          (prems_of \\<iota>)!j \\<in> active_subset (snd (lnth D k)))\" using j0_allin by simp\n      next\n        case False\n        assume j_in: \"j \\<in> {0..<m}\" and\n          \"j \\<noteq> j0\"\n        obtain nj where nj_len: \"enat (Suc nj) < llength D\" and\n          nj_prems: \"(prems_of \\<iota>)!j \\<notin> active_subset (snd (lnth D nj))\" and\n          nj_greater: \"(\\<forall>k. k > nj \\<longrightarrow> enat k < llength D \\<longrightarrow>\n            (prems_of \\<iota>)!j \\<in> active_subset (snd (lnth D k)))\"\n          using exist_nj j_in by blast\n        then have \"nj \\<in> nj_set\" unfolding nj_set_def using j_in by blast\n        then show \"(\\<forall>k. k > n \\<longrightarrow> enat k < llength D \\<longrightarrow>\n          (prems_of \\<iota>)!j \\<in> active_subset (snd (lnth D k)))\"\n          using nj_greater n_bigger by auto\n      qed\n      then have allj_allk: \"(\\<forall>c\\<in> set (prems_of \\<iota>). (\\<forall>k. k > n \\<longrightarrow> enat k < llength D \\<longrightarrow>\n        c \\<in> active_subset (snd (lnth D k))))\"\n        using m_def by (metis atLeast0LessThan in_set_conv_nth lessThan_iff)\n      have \"\\<forall>c\\<in> set (prems_of \\<iota>). snd c = active\"\n        using prems_i_active unfolding active_subset_def by auto\n      then have ex_n_i_in: \"\\<exists>n. enat (Suc n) < llength D \\<and> to_F \\<iota> \\<in> fst (lnth D (Suc n)) \\<and>\n        (\\<forall>c\\<in> set (prems_of \\<iota>). snd c = active) \\<and>\n        (\\<forall>c\\<in> set (prems_of \\<iota>). (\\<forall>k. k > n \\<longrightarrow> enat k < llength D \\<longrightarrow>\n          c \\<in> active_subset (snd (lnth D k))))\"\n        using allj_allk i_in_t2 suc_nth_d_is fstI n_in nj_set_def\n        by auto\n      then have \"\\<exists>n. enat n < llength D \\<and> to_F \\<iota> \\<in> fst (lnth D n) \\<and>\n        (\\<forall>c\\<in> set (prems_of \\<iota>). snd c = active) \\<and> (\\<forall>c\\<in> set (prems_of \\<iota>). (\\<forall>k. k \\<ge> n \\<longrightarrow>\n          enat k < llength D \\<longrightarrow> c \\<in> active_subset (snd (lnth D k))))\"\n        by auto\n    }\n    ultimately obtain n T2 N2 where i_in_suc_n: \"to_F \\<iota> \\<in> fst (lnth D n)\" and\n      all_prems_active_after: \"m > 0 \\<Longrightarrow> (\\<forall>c\\<in> set (prems_of \\<iota>). (\\<forall>k. k \\<ge> n \\<longrightarrow> enat k < llength D \\<longrightarrow>\n                  c \\<in> active_subset (snd (lnth D k))))\" and\n      suc_n_length: \"enat n < llength D\" and suc_nth_d_is: \"lnth D n = (T2, N2)\"\n      by (metis less_antisym old.prod.exhaust zero_less_Suc)\n    then have i_in_t2: \"to_F \\<iota> \\<in> T2\" by simp\n    have \"\\<exists>p\\<ge>n. enat (Suc p) < llength D \\<and> to_F \\<iota> \\<in> (fst (lnth D p)) \\<and> to_F \\<iota> \\<notin> (fst (lnth D (Suc p)))\"\n    proof (rule ccontr)\n      assume\n        contra: \"\\<not> (\\<exists>p\\<ge>n. enat (Suc p) < llength D \\<and> to_F \\<iota> \\<in> (fst (lnth D p)) \\<and>\n                     to_F \\<iota> \\<notin> (fst (lnth D (Suc p))))\"\n      then have i_in_suc: \"p0 \\<ge> n \\<Longrightarrow> enat (Suc p0) < llength D \\<Longrightarrow> to_F \\<iota> \\<in> (fst (lnth D p0)) \\<Longrightarrow>\n        to_F \\<iota> \\<in> (fst (lnth D (Suc p0)))\" for p0\n        by blast\n      have \"p0 \\<ge> n \\<Longrightarrow> enat p0 < llength D \\<Longrightarrow> to_F \\<iota> \\<in> (fst (lnth D p0))\" for p0\n      proof (induction rule: nat_induct_at_least)\n        case base\n        then show ?case using i_in_t2 suc_nth_d_is\n        by simp\n      next\n        case (Suc p0)\n        assume p_bigger_n: \"n \\<le> p0\" and\n          induct_hyp: \"enat p0 < llength D \\<Longrightarrow> to_F \\<iota> \\<in> fst (lnth D p0)\" and\n          sucsuc_smaller_d: \"enat (Suc p0) < llength D\"\n        have suc_p_bigger_n: \"n \\<le> p0\" using p_bigger_n by simp\n        have suc_smaller_d: \"enat p0 < llength D\"\n          using sucsuc_smaller_d Suc_ile_eq dual_order.strict_implies_order by blast\n        then have \"to_F \\<iota> \\<in> fst (lnth D p0)\" using induct_hyp by blast\n        then show ?case using i_in_suc[OF suc_p_bigger_n sucsuc_smaller_d] by blast\n      qed\n      then have i_in_all_bigger_n: \"\\<forall>j. j \\<ge> n \\<and> enat j < llength D \\<longrightarrow> to_F \\<iota> \\<in> (fst (lnth D j))\"\n        by presburger\n      have \"llength (lmap fst D) = llength D\" by force\n      then have \"to_F \\<iota> \\<in> \\<Inter> (lnth (lmap fst D) ` {j. n \\<le> j \\<and> enat j < llength (lmap fst D)})\"\n        using i_in_all_bigger_n using Suc_le_D by auto\n      then have \"to_F \\<iota> \\<in> Liminf_llist (lmap fst D)\"\n        unfolding Liminf_llist_def using suc_n_length by auto\n      then show False using final_schedule by fast\n    qed\n    then obtain p where p_greater_n: \"p \\<ge> n\" and p_smaller_d: \"enat (Suc p) < llength D\" and\n      i_in_p: \"to_F \\<iota> \\<in> (fst (lnth D p))\" and i_notin_suc_p: \"to_F \\<iota> \\<notin> (fst (lnth D (Suc p)))\"\n      by blast\n    have p_neq_n: \"Suc p \\<noteq> n\" using i_notin_suc_p i_in_suc_n by blast\n    have step_p: \"lnth D p \\<Longrightarrow>LGC lnth D (Suc p)\" using deriv p_smaller_d chain_lnth_rel by blast\n    then have \"\\<exists>T1 T2 \\<iota> N2 N1 M. lnth D p = (T1, N1) \\<and> lnth D (Suc p) = (T2, N2) \\<and>\n      T1 = T2 \\<union> {\\<iota>} \\<and> T2 \\<inter> {\\<iota>} = {} \\<and> N2 = N1 \\<union> M \\<and> active_subset M = {} \\<and>\n      \\<iota> \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (N1 \\<union> M))\"\n    proof -\n      have ci_or_do: \"(\\<exists>T1 T2 \\<iota> N2 N1 M. lnth D p = (T1, N1) \\<and> lnth D (Suc p) = (T2, N2) \\<and>\n        T1 = T2 \\<union> {\\<iota>} \\<and> T2 \\<inter> {\\<iota>} = {} \\<and> N2 = N1 \\<union> M \\<and> active_subset M = {} \\<and>\n        \\<iota> \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (N1 \\<union> M))) \\<or>\n        (\\<exists>T1 T2 T' N. lnth D p = (T1, N) \\<and> lnth D (Suc p) = (T2, N) \\<and>\n        T1 = T2 \\<union> T' \\<and> T2 \\<inter> T' = {} \\<and>\n        T' \\<inter> no_labels.Non_ground.Inf_from (fst ` active_subset N) = {})\"\n        using Lazy_Given_Clause_step.simps[of \"lnth D p\" \"lnth D (Suc p)\"] step_p i_in_p i_notin_suc_p\n        by fastforce\n      then have p_greater_n_strict: \"n < Suc p\"\n        using suc_nth_d_is p_greater_n i_in_t2 i_notin_suc_p le_eq_less_or_eq by force\n      have \"m > 0 \\<Longrightarrow> j \\<in> {0..<m} \\<Longrightarrow> (prems_of (to_F \\<iota>))!j \\<in> (fst ` (active_subset (snd (lnth D p))))\"\n        for j\n      proof -\n        fix j\n        assume\n          m_pos: \"m > 0\" and\n          j_in: \"j \\<in> {0..<m}\"\n        then have \"(prems_of \\<iota>)!j \\<in> (active_subset (snd (lnth D p)))\"\n          using all_prems_active_after[OF m_pos] p_smaller_d m_def p_greater_n p_neq_n\n          by (meson Suc_ile_eq atLeastLessThan_iff dual_order.strict_implies_order nth_mem\n            p_greater_n_strict)\n        then have \"fst ((prems_of \\<iota>)!j) \\<in> (fst ` (active_subset (snd (lnth D p))))\"\n          by blast\n        then show \"(prems_of (to_F \\<iota>))!j \\<in> (fst ` (active_subset (snd (lnth D p))))\"\n        unfolding to_F_def using j_in m_def by simp\n      qed\n      then have prems_i_active_p: \"m > 0 \\<Longrightarrow>\n        to_F \\<iota> \\<in> no_labels.Non_ground.Inf_from (fst ` active_subset (snd (lnth D p)))\"\n        using i_in_F unfolding no_labels.Non_ground.Inf_from_def\n        by (smt atLeast0LessThan in_set_conv_nth lessThan_iff m_def_F mem_Collect_eq subsetI)\n      have \"m = 0 \\<Longrightarrow> (\\<exists>T1 T2 \\<iota> N2 N1 M. lnth D p = (T1, N1) \\<and> lnth D (Suc p) = (T2, N2) \\<and>\n        T1 = T2 \\<union> {\\<iota>} \\<and> T2 \\<inter> {\\<iota>} = {} \\<and> N2 = N1 \\<union> M \\<and> active_subset M = {} \\<and>\n        \\<iota> \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (N1 \\<union> M)))\"\n        using ci_or_do premise_free_inf_always_from[of \"to_F \\<iota>\" \"fst ` active_subset _\", OF i_in_F]\n          m_def i_in_p i_notin_suc_p m_def_F by auto\n      then show \"(\\<exists>T1 T2 \\<iota> N2 N1 M. lnth D p = (T1, N1) \\<and> lnth D (Suc p) = (T2, N2) \\<and>\n        T1 = T2 \\<union> {\\<iota>} \\<and> T2 \\<inter> {\\<iota>} = {} \\<and> N2 = N1 \\<union> M \\<and> active_subset M = {} \\<and>\n        \\<iota> \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (N1 \\<union> M)))\"\n        using ci_or_do i_in_p i_notin_suc_p prems_i_active_p unfolding active_subset_def\n        by force\n    qed\n    then obtain T1p T2p N1p N2p Mp where  \"lnth D p = (T1p, N1p)\" and\n      suc_p_is: \"lnth D (Suc p) = (T2p, N2p)\" and \"T1p = T2p \\<union> {to_F \\<iota>}\" and \"T2p \\<inter> {to_F \\<iota>} = {}\" and\n      n2p_is: \"N2p = N1p \\<union> Mp\"and \"active_subset Mp = {}\" and\n      i_in_red_inf: \"to_F \\<iota> \\<in> no_labels.empty_ord_lifted_calc_w_red_crit_family.Red_Inf_Q\n        (fst ` (N1p \\<union> Mp))\"\n      using i_in_p i_notin_suc_p by fastforce\n    have \"to_F \\<iota> \\<in> no_labels.lifted_calc_w_red_crit_family.Red_Inf_Q (fst ` (snd (lnth D (Suc p))))\"\n      using i_in_red_inf suc_p_is n2p_is by fastforce\n    then have \"\\<forall>q. (\\<G>_Inf_q q (to_F \\<iota>) \\<noteq> None \\<and>\n      the (\\<G>_Inf_q q (to_F \\<iota>)) \\<subseteq> Red_Inf_q q (\\<Union> (\\<G>_F_q q ` (fst ` (snd (lnth D (Suc p)))))))\n      \\<or> (\\<G>_Inf_q q (to_F \\<iota>) = None \\<and>\n      \\<G>_F_q q (concl_of (to_F \\<iota>)) \\<subseteq> (\\<Union> (\\<G>_F_q q ` (fst ` (snd (lnth D (Suc p)))))) \\<union>\n        Red_F_q q (\\<Union> (\\<G>_F_q q ` (fst ` (snd (lnth D (Suc p)))))))\"\n      unfolding to_F_def no_labels.lifted_calc_w_red_crit_family.Red_Inf_Q_def\n        no_labels.Red_Inf_\\<G>_q_def no_labels.\\<G>_set_q_def\n      by fastforce\n    then have \"\\<iota> \\<in> with_labels.Red_Inf_Q (snd (lnth D (Suc p)))\"\n      unfolding to_F_def with_labels.Red_Inf_Q_def Red_Inf_\\<G>_L_q_def \\<G>_Inf_L_q_def \\<G>_set_L_q_def\n        \\<G>_F_L_q_def using i_in_inf_fl by auto\n    then show \"\\<iota> \\<in> labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.inter_red_crit_calculus.Sup_Red_Inf_llist (lmap snd D)\"\n      unfolding\n        labeled_ord_red_crit_fam.empty_ord_lifted_calc_w_red_crit_family.inter_red_crit_calculus.Sup_Red_Inf_llist_def\n      using red_inf_equiv2 suc_n_length p_smaller_d by auto\n  qed\nqed\n\n(* thm:lgc-completeness *)\ntheorem lgc_complete: \"chain (\\<Longrightarrow>LGC) D \\<Longrightarrow> llength D > 0 \\<Longrightarrow> active_subset (snd (lnth D 0)) = {} \\<Longrightarrow>\n  non_active_subset (Liminf_llist (lmap snd D)) = {} \\<Longrightarrow>\n  (\\<forall>\\<iota> \\<in> Inf_F. length (prems_of \\<iota>) = 0 \\<longrightarrow> \\<iota> \\<in> (fst (lnth D 0))) \\<Longrightarrow>\n  Liminf_llist (lmap fst D) = {} \\<Longrightarrow> B \\<in> Bot_F \\<Longrightarrow> no_labels.entails_\\<G>_Q (fst ` (snd (lnth D 0))) {B} \\<Longrightarrow>\n  \\<exists>i. enat i < llength D \\<and> (\\<exists>BL\\<in> Bot_FL. BL \\<in> (snd (lnth D i)))\"\nproof -\n  fix B\n  assume\n    deriv: \"chain (\\<Longrightarrow>LGC) D\" and\n    not_empty_d: \"llength D > 0\" and\n    init_state: \"active_subset (snd (lnth D 0)) = {}\" and\n    final_state: \"non_active_subset (Liminf_llist (lmap snd D)) = {}\" and\n    no_prems_init_active: \"\\<forall>\\<iota> \\<in> Inf_F. length (prems_of \\<iota>) = 0 \\<longrightarrow> \\<iota> \\<in> (fst (lnth D 0))\" and\n    final_schedule: \"Liminf_llist (lmap fst D) = {}\" and\n    b_in: \"B \\<in> Bot_F\" and\n    bot_entailed: \"no_labels.entails_\\<G>_Q (fst ` (snd (lnth D 0))) {B}\"\n  have labeled_b_in: \"(B,active) \\<in> Bot_FL\" unfolding Bot_FL_def using b_in by simp\n  have not_empty_d2: \"\\<not> lnull (lmap snd D)\" using not_empty_d by force\n  have simp_snd_lmap: \"lnth (lmap snd D) 0 = snd (lnth D 0)\"\n    using lnth_lmap[of 0 D snd] not_empty_d by (simp add: zero_enat_def)\n  have labeled_bot_entailed: \"entails_\\<G>_L_Q  (snd (lnth D 0)) {(B,active)}\"\n    using labeled_entailment_lifting bot_entailed by fastforce\n  have \"fair (lmap snd D)\"\n    using lgc_fair[OF deriv not_empty_d init_state final_state no_prems_init_active final_schedule] .\n  then have \"\\<exists>i \\<in> {i. enat i < llength D}. \\<exists>BL\\<in>Bot_FL. BL \\<in> (snd (lnth D i))\"\n    using labeled_ordered_dynamic_ref_comp labeled_b_in not_empty_d2 lgc_to_red[OF deriv]\n      labeled_bot_entailed entail_equiv simp_snd_lmap\n    unfolding dynamic_refutational_complete_calculus_def\n      dynamic_refutational_complete_calculus_axioms_def\n    by (metis (mono_tags, lifting) llength_lmap lnth_lmap mem_Collect_eq)\n  then show ?thesis by blast\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Saturation_Framework/Prover_Architectures.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.348289039331495}}
{"text": "(*<*)\ntheory Sugar\nimports \"~~/src/HOL/Library/LaTeXsugar\" \"~~/src/HOL/Library/OptionalSugar\"\nbegin\n(*>*)\ntext{*\n\\section{Introduction}\n\nThis document is for those Isabelle users who have mastered\nthe art of mixing \\LaTeX\\ text and Isabelle theories and never want to\ntypeset a theorem by hand anymore because they have experienced the\nbliss of writing \\verb!@!\\verb!{thm[display,mode=latex_sum] setsum_Suc_diff [no_vars]}!\nand seeing Isabelle typeset it for them:\n@{thm[display,mode=latex_sum] setsum_Suc_diff[no_vars]}\nNo typos, no omissions, no sweat.\nIf you have not experienced that joy, read Chapter 4, \\emph{Presenting\nTheories}, @{cite LNCS2283} first.\n\nIf you have mastered the art of Isabelle's \\emph{antiquotations},\ni.e.\\ things like the above \\verb!@!\\verb!{thm...}!, beware: in your vanity\nyou may be tempted to think that all readers of the stunning ps or pdf\ndocuments you can now produce at the drop of a hat will be struck with\nawe at the beauty unfolding in front of their eyes. Until one day you\ncome across that very critical of readers known as the ``common referee''.\nHe has the nasty habit of refusing to understand unfamiliar notation\nlike Isabelle's infamous @{text\"\\<lbrakk> \\<rbrakk> \\<Longrightarrow>\"} no matter how many times you\nexplain it in your paper. Even worse, he thinks that using @{text\"\\<lbrakk>\n\\<rbrakk>\"} for anything other than denotational semantics is a cardinal sin\nthat must be punished by instant rejection.\n\n\nThis document shows you how to make Isabelle and \\LaTeX\\ cooperate to\nproduce ordinary looking mathematics that hides the fact that it was\ntypeset by a machine. You merely need to load the right files:\n\\begin{itemize}\n\\item Import theory \\texttt{LaTeXsugar} in the header of your own\ntheory.  You may also want bits of \\texttt{OptionalSugar}, which you can\ncopy selectively into your own theory or import as a whole.  Both\ntheories live in \\texttt{HOL/Library} and are found automatically.\n\n\\item Should you need additional \\LaTeX\\ packages (the text will tell\nyou so), you include them at the beginning of your \\LaTeX\\ document,\ntypically in \\texttt{root.tex}. For a start, you should\n\\verb!\\usepackage{amssymb}! --- otherwise typesetting\n@{prop[source]\"\\<not>(\\<exists>x. P x)\"} will fail because the AMS symbol\n@{text\"\\<nexists>\"} is missing.\n\\end{itemize}\n\n\n\\section{HOL syntax}\n\n\\subsection{Logic}\n\nThe formula @{prop[source]\"\\<not>(\\<exists>x. P x)\"} is typeset as @{prop\"~(EX x. P x)\"}.\n\nThe predefined constructs @{text\"if\"}, @{text\"let\"} and\n@{text\"case\"} are set in sans serif font to distinguish them from\nother functions. This improves readability:\n\\begin{itemize}\n\\item @{term\"if b then e\\<^sub>1 else e\\<^sub>2\"} instead of @{text\"if b then e\\<^sub>1 else e\\<^sub>2\"}.\n\\item @{term\"let x = e\\<^sub>1 in e\\<^sub>2\"} instead of @{text\"let x = e\\<^sub>1 in e\\<^sub>2\"}.\n\\item @{term\"case x of True \\<Rightarrow> e\\<^sub>1 | False \\<Rightarrow> e\\<^sub>2\"} instead of\\\\\n      @{text\"case x of True \\<Rightarrow> e\\<^sub>1 | False \\<Rightarrow> e\\<^sub>2\"}.\n\\end{itemize}\n\n\\subsection{Sets}\n\nAlthough set syntax in HOL is already close to\nstandard, we provide a few further improvements:\n\\begin{itemize}\n\\item @{term\"{x. P}\"} instead of @{text\"{x. P}\"}.\n\\item @{term\"{}\"} instead of @{text\"{}\"}, where\n @{term\"{}\"} is also input syntax.\n\\item @{term\"insert a (insert b (insert c M))\"} instead of @{text\"insert a (insert b (insert c M))\"}.\n\\item @{term\"card A\"} instead of @{text\"card A\"}.\n\\end{itemize}\n\n\n\\subsection{Lists}\n\nIf lists are used heavily, the following notations increase readability:\n\\begin{itemize}\n\\item @{term\"x # xs\"} instead of @{text\"x # xs\"},\n      where @{term\"x # xs\"} is also input syntax.\n\\item @{term\"length xs\"} instead of @{text\"length xs\"}.\n\\item @{term\"nth xs n\"} instead of @{text\"nth xs n\"},\n      the $n$th element of @{text xs}.\n\n\\item Human readers are good at converting automatically from lists to\nsets. Hence \\texttt{OptionalSugar} contains syntax for suppressing the\nconversion function @{const set}: for example, @{prop[source]\"x \\<in> set xs\"}\nbecomes @{prop\"x \\<in> set xs\"}.\n\n\\item The @{text\"@\"} operation associates implicitly to the right,\nwhich leads to unpleasant line breaks if the term is too long for one\nline. To avoid this, \\texttt{OptionalSugar} contains syntax to group\n@{text\"@\"}-terms to the left before printing, which leads to better\nline breaking behaviour:\n@{term[display]\"term\\<^sub>0 @ term\\<^sub>1 @ term\\<^sub>2 @ term\\<^sub>3 @ term\\<^sub>4 @ term\\<^sub>5 @ term\\<^sub>6 @ term\\<^sub>7 @ term\\<^sub>8 @ term\\<^sub>9 @ term\\<^sub>1\\<^sub>0\"}\n\n\\end{itemize}\n\n\n\\subsection{Numbers}\n\nCoercions between numeric types are alien to mathematicians who\nconsider, for example, @{typ nat} as a subset of @{typ int}.\n\\texttt{OptionalSugar} contains syntax for suppressing numeric coercions such\nas @{const int} @{text\"::\"} @{typ\"nat \\<Rightarrow> int\"}. For example,\n@{term[source]\"int 5\"} is printed as @{term \"int 5\"}. Embeddings of types\n@{typ nat}, @{typ int}, @{typ real} are covered; non-injective coercions such\nas @{const nat} @{text\"::\"} @{typ\"int \\<Rightarrow> nat\"} are not and should not be\nhidden.\n\n\n\\section{Printing theorems}\n\n\\subsection{Question marks}\n\nIf you print anything, especially theorems, containing\nschematic variables they are prefixed with a question mark:\n\\verb!@!\\verb!{thm conjI}! results in @{thm conjI}. Most of the time\nyou would rather not see the question marks. There is an attribute\n\\verb!no_vars! that you can attach to the theorem that turns its\nschematic into ordinary free variables: \\verb!@!\\verb!{thm conjI[no_vars]}!\nresults in @{thm conjI[no_vars]}.\n\nThis \\verb!no_vars! business can become a bit tedious.\nIf you would rather never see question marks, simply put\n\\begin{quote}\n\\verb!options [show_question_marks = false]!\n\\end{quote}\ninto the relevant \\texttt{ROOT} file, just before the \\texttt{theories} for that session.\nThe rest of this document is produced with this flag set to \\texttt{false}.\n\nHint: Setting \\verb!show_question_marks! to \\texttt{false} only\nsuppresses question marks; variables that end in digits,\ne.g. @{text\"x1\"}, are still printed with a trailing @{text\".0\"},\ne.g. @{text\"x1.0\"}, their internal index. This can be avoided by\nturning the last digit into a subscript: write \\verb!x\\<^sub>1! and\nobtain the much nicer @{text\"x\\<^sub>1\"}. *}\n\n(*<*)declare [[show_question_marks = false]](*>*)\n\nsubsection {*Qualified names*}\n\ntext{* If there are multiple declarations of the same name, Isabelle prints\nthe qualified name, for example @{text \"T.length\"}, where @{text T} is the\ntheory it is defined in, to distinguish it from the predefined @{const[source]\n\"List.length\"}. In case there is no danger of confusion, you can insist on\nshort names (no qualifiers) by setting the \\verb!names_short!\nconfiguration option in the context.\n\n\n\\subsection {Variable names\\label{sec:varnames}}\n\nIt sometimes happens that you want to change the name of a\nvariable in a theorem before printing it. This can easily be achieved\nwith the help of Isabelle's instantiation attribute \\texttt{where}:\n@{thm conjI[where P = \\<phi> and Q = \\<psi>]} is the result of\n\\begin{quote}\n\\verb!@!\\verb!{thm conjI[where P = \\<phi> and Q = \\<psi>]}!\n\\end{quote}\nTo support the ``\\_''-notation for irrelevant variables\nthe constant \\texttt{DUMMY} has been introduced:\n@{thm fst_conv[of _ DUMMY]} is produced by\n\\begin{quote}\n\\verb!@!\\verb!{thm fst_conv[of _ DUMMY]}!\n\\end{quote}\nVariables that are bound by quantifiers or lambdas cannot be renamed\nlike this. Instead, the attribute \\texttt{rename\\_abs} does the\njob. It expects a list of names or underscores, similar to the\n\\texttt{of} attribute:\n\\begin{quote}\n\\verb!@!\\verb!{thm split_paired_All[rename_abs _ l r]}!\n\\end{quote}\nproduces @{thm split_paired_All[rename_abs _ l r]}.\n\n\n\\subsection{Inference rules}\n\nTo print theorems as inference rules you need to include Didier\nR\\'emy's \\texttt{mathpartir} package~@{cite mathpartir}\nfor typesetting inference rules in your \\LaTeX\\ file.\n\nWriting \\verb!@!\\verb!{thm[mode=Rule] conjI}! produces\n@{thm[mode=Rule] conjI}, even in the middle of a sentence.\nIf you prefer your inference rule on a separate line, maybe with a name,\n\\begin{center}\n@{thm[mode=Rule] conjI} {\\sc conjI}\n\\end{center}\nis produced by\n\\begin{quote}\n\\verb!\\begin{center}!\\\\\n\\verb!@!\\verb!{thm[mode=Rule] conjI} {\\sc conjI}!\\\\\n\\verb!\\end{center}!\n\\end{quote}\nIt is not recommended to use the standard \\texttt{display} option\ntogether with \\texttt{Rule} because centering does not work and because\nthe line breaking mechanisms of \\texttt{display} and \\texttt{mathpartir} can\nclash.\n\nOf course you can display multiple rules in this fashion:\n\\begin{quote}\n\\verb!\\begin{center}!\\\\\n\\verb!@!\\verb!{thm[mode=Rule] conjI} {\\sc conjI} \\\\[1ex]!\\\\\n\\verb!@!\\verb!{thm[mode=Rule] conjE} {\\sc disjI$_1$} \\qquad!\\\\\n\\verb!@!\\verb!{thm[mode=Rule] disjE} {\\sc disjI$_2$}!\\\\\n\\verb!\\end{center}!\n\\end{quote}\nyields\n\\begin{center}\\small\n@{thm[mode=Rule] conjI} {\\sc conjI} \\\\[1ex]\n@{thm[mode=Rule] disjI1} {\\sc disjI$_1$} \\qquad\n@{thm[mode=Rule] disjI2} {\\sc disjI$_2$}\n\\end{center}\n\nThe \\texttt{mathpartir} package copes well if there are too many\npremises for one line:\n\\begin{center}\n@{prop[mode=Rule] \"\\<lbrakk> A \\<longrightarrow> B; B \\<longrightarrow> C; C \\<longrightarrow> D; D \\<longrightarrow> E; E \\<longrightarrow> F; F \\<longrightarrow> G;\n G \\<longrightarrow> H; H \\<longrightarrow> I; I \\<longrightarrow> J; J \\<longrightarrow> K \\<rbrakk> \\<Longrightarrow> A \\<longrightarrow> K\"}\n\\end{center}\n\nLimitations: 1. Premises and conclusion must each not be longer than\nthe line.  2. Premises that are @{text\"\\<Longrightarrow>\"}-implications are again\ndisplayed with a horizontal line, which looks at least unusual.\n\n\nIn case you print theorems without premises no rule will be printed by the\n\\texttt{Rule} print mode. However, you can use \\texttt{Axiom} instead:\n\\begin{quote}\n\\verb!\\begin{center}!\\\\\n\\verb!@!\\verb!{thm[mode=Axiom] refl} {\\sc refl}! \\\\\n\\verb!\\end{center}!\n\\end{quote}\nyields\n\\begin{center}\n@{thm[mode=Axiom] refl} {\\sc refl} \n\\end{center}\n\n\n\\subsection{Displays and font sizes}\n\nWhen displaying theorems with the \\texttt{display} option, for example as in\n\\verb!@!\\verb!{thm[display] refl}! @{thm[display] refl} the theorem is\nset in small font. It uses the \\LaTeX-macro \\verb!\\isastyle!,\nwhich is also the style that regular theory text is set in, e.g. *}\n\nlemma \"t = t\"\n(*<*)oops(*>*)\n\ntext{* \\noindent Otherwise \\verb!\\isastyleminor! is used,\nwhich does not modify the font size (assuming you stick to the default\n\\verb!\\isabellestyle{it}! in \\texttt{root.tex}). If you prefer\nnormal font size throughout your text, include\n\\begin{quote}\n\\verb!\\renewcommand{\\isastyle}{\\isastyleminor}!\n\\end{quote}\nin \\texttt{root.tex}. On the other hand, if you like the small font,\njust put \\verb!\\isastyle! in front of the text in question,\ne.g.\\ at the start of one of the center-environments above.\n\nThe advantage of the display option is that you can display a whole\nlist of theorems in one go. For example,\n\\verb!@!\\verb!{thm[display] append.simps}!\ngenerates @{thm[display] append.simps}\n\n\n\\subsection{If-then}\n\nIf you prefer a fake ``natural language'' style you can produce\nthe body of\n\\newtheorem{theorem}{Theorem}\n\\begin{theorem}\n@{thm[mode=IfThen] le_trans}\n\\end{theorem}\nby typing\n\\begin{quote}\n\\verb!@!\\verb!{thm[mode=IfThen] le_trans}!\n\\end{quote}\n\nIn order to prevent odd line breaks, the premises are put into boxes.\nAt times this is too drastic:\n\\begin{theorem}\n@{prop[mode=IfThen] \"longpremise \\<Longrightarrow> longerpremise \\<Longrightarrow> P(f(f(f(f(f(f(f(f(f(x)))))))))) \\<Longrightarrow> longestpremise \\<Longrightarrow> conclusion\"}\n\\end{theorem}\nIn which case you should use \\texttt{IfThenNoBox} instead of\n\\texttt{IfThen}:\n\\begin{theorem}\n@{prop[mode=IfThenNoBox] \"longpremise \\<Longrightarrow> longerpremise \\<Longrightarrow> P(f(f(f(f(f(f(f(f(f(x)))))))))) \\<Longrightarrow> longestpremise \\<Longrightarrow> conclusion\"}\n\\end{theorem}\n\n\n\\subsection{Doing it yourself\\label{sec:yourself}}\n\nIf for some reason you want or need to present theorems your\nown way, you can extract the premises and the conclusion explicitly\nand combine them as you like:\n\\begin{itemize}\n\\item \\verb!@!\\verb!{thm (prem 1)! $thm$\\verb!}!\nprints premise 1 of $thm$.\n\\item \\verb!@!\\verb!{thm (concl)! $thm$\\verb!}!\nprints the conclusion of $thm$.\n\\end{itemize}\nFor example, ``from @{thm (prem 2) conjI} and\n@{thm (prem 1) conjI} we conclude @{thm (concl) conjI}''\nis produced by\n\\begin{quote}\n\\verb!from !\\verb!@!\\verb!{thm (prem 2) conjI}! \\verb!and !\\verb!@!\\verb!{thm (prem 1) conjI}!\\\\\n\\verb!we conclude !\\verb!@!\\verb!{thm (concl) conjI}!\n\\end{quote}\nThus you can rearrange or hide premises and typeset the theorem as you like.\nStyles like \\verb!(prem 1)! are a general mechanism explained\nin \\S\\ref{sec:styles}.\n\n\n\\subsection{Patterns}\n\n\nIn \\S\\ref{sec:varnames} we shows how to create patterns containing ``@{term DUMMY}''.\nYou can drive this game even further and extend the syntax of let\nbindings such that certain functions like @{term fst}, @{term hd}, \netc.\\ are printed as patterns. \\texttt{OptionalSugar} provides the following:\n\n\\begin{center}\n\\begin{tabular}{l@ {~~produced by~~}l}\n@{term \"let x = fst p in t\"} & \\verb!@!\\verb!{term \"let x = fst p in t\"}!\\\\\n@{term \"let x = snd p in t\"} & \\verb!@!\\verb!{term \"let x = snd p in t\"}!\\\\\n@{term \"let x = hd xs in t\"} & \\verb!@!\\verb!{term \"let x = hd xs in t\"}!\\\\\n@{term \"let x = tl xs in t\"} & \\verb!@!\\verb!{term \"let x = tl xs in t\"}!\\\\\n@{term \"let x = the y in t\"} & \\verb!@!\\verb!{term \"let x = the y in t\"}!\\\\\n\\end{tabular}\n\\end{center}\n\n\n\\section {Styles\\label{sec:styles}}\n\nThe \\verb!thm! antiquotation works nicely for single theorems, but\nsets of equations as used in definitions are more difficult to\ntypeset nicely: people tend to prefer aligned @{text \"=\"} signs.\n\nTo deal with such cases where it is desirable to dive into the structure\nof terms and theorems, Isabelle offers antiquotations featuring ``styles'':\n\n\\begin{quote}\n\\verb!@!\\verb!{thm (style) thm}!\\\\\n\\verb!@!\\verb!{prop (style) thm}!\\\\\n\\verb!@!\\verb!{term (style) term}!\\\\\n\\verb!@!\\verb!{term_type (style) term}!\\\\\n\\verb!@!\\verb!{typeof (style) term}!\\\\\n\\end{quote}\n\n A ``style'' is a transformation of a term. There are predefined\n styles, namely \\verb!lhs! and \\verb!rhs!, \\verb!prem! with one argument, and \\verb!concl!.\nFor example, the output\n\\begin{center}\n\\begin{tabular}{l@ {~~@{text \"=\"}~~}l}\n@{thm (lhs) append_Nil} & @{thm (rhs) append_Nil}\\\\\n@{thm (lhs) append_Cons} & @{thm (rhs) append_Cons}\n\\end{tabular}\n\\end{center}\nis produced by the following code:\n\\begin{quote}\n  \\verb!\\begin{center}!\\\\\n  \\verb!\\begin{tabular}{l@ {~~!\\verb!@!\\verb!{text \"=\"}~~}l}!\\\\\n  \\verb!@!\\verb!{thm (lhs) append_Nil} & @!\\verb!{thm (rhs) append_Nil}\\\\!\\\\\n  \\verb!@!\\verb!{thm (lhs) append_Cons} & @!\\verb!{thm (rhs) append_Cons}!\\\\\n  \\verb!\\end{tabular}!\\\\\n  \\verb!\\end{center}!\n\\end{quote}\nNote the space between \\verb!@! and \\verb!{! in the tabular argument.\nIt prevents Isabelle from interpreting \\verb!@ {~~...~~}! \nas an antiquotation. The styles \\verb!lhs! and \\verb!rhs!\nextract the left hand side (or right hand side respectively) from the\nconclusion of propositions consisting of a binary operator\n(e.~g.~@{text \"=\"}, @{text \"\\<equiv>\"}, @{text \"<\"}).\n\nLikewise, \\verb!concl! may be used as a style to show just the\nconclusion of a proposition. For example, take \\verb!hd_Cons_tl!:\n\\begin{center}\n  @{thm hd_Cons_tl}\n\\end{center}\nTo print just the conclusion,\n\\begin{center}\n  @{thm (concl) hd_Cons_tl}\n\\end{center}\ntype\n\\begin{quote}\n  \\verb!\\begin{center}!\\\\\n  \\verb!@!\\verb!{thm (concl) hd_Cons_tl}!\\\\\n  \\verb!\\end{center}!\n\\end{quote}\nBeware that any options must be placed \\emph{before} the style, as in this example.\n\nFurther use cases can be found in \\S\\ref{sec:yourself}.\nIf you are not afraid of ML, you may also define your own styles.\nHave a look at module @{ML_structure Term_Style}.\n\n\n\\section {Proofs}\n\nFull proofs, even if written in beautiful Isar style, are\nlikely to be too long and detailed to be included in conference\npapers, but some key lemmas might be of interest.\nIt is usually easiest to put them in figures like the one in Fig.\\\n\\ref{fig:proof}. This was achieved with the \\isakeyword{text\\_raw} command:\n*}\ntext_raw {*\n  \\begin{figure}\n  \\begin{center}\\begin{minipage}{0.6\\textwidth}  \n  \\isastyleminor\\isamarkuptrue\n*}\nlemma True\nproof -\n  -- \"pretty trivial\"\n  show True by force\nqed\ntext_raw {*    \n  \\end{minipage}\\end{center}\n  \\caption{Example proof in a figure.}\\label{fig:proof}\n  \\end{figure}\n*}\ntext {*\n\n\\begin{quote}\n\\small\n\\verb!text_raw {!\\verb!*!\\\\\n\\verb!  \\begin{figure}!\\\\\n\\verb!  \\begin{center}\\begin{minipage}{0.6\\textwidth}!\\\\\n\\verb!  \\isastyleminor\\isamarkuptrue!\\\\\n\\verb!*!\\verb!}!\\\\\n\\verb!lemma True!\\\\\n\\verb!proof -!\\\\\n\\verb!  -- \"pretty trivial\"!\\\\\n\\verb!  show True by force!\\\\\n\\verb!qed!\\\\\n\\verb!text_raw {!\\verb!*!\\\\\n\\verb!  \\end{minipage}\\end{center}!\\\\\n\\verb!  \\caption{Example proof in a figure.}\\label{fig:proof}!\\\\\n\\verb!  \\end{figure}!\\\\\n\\verb!*!\\verb!}!\n\\end{quote}\n\nOther theory text, e.g.\\ definitions, can be put in figures, too.\n\n\\section{Theory snippets}\n\nThis section describes how to include snippets of a theory text in some other \\LaTeX\\ document.\nThe typical scenario is that the description of your theory is not part of the theory text but\na separate document that antiquotes bits of the theory. This works well for terms and theorems\nbut there are no antiquotations, for example, for function definitions or proofs. Even if there are antiquotations,\nthe output is usually a reformatted (by Isabelle) version of the input and may not look like\nyou wanted it to look. Here is how to include a snippet of theory text (in \\LaTeX\\ form) in some\nother \\LaTeX\\ document, in 4 easy steps. Beware that these snippets are not processed by\nany antiquotation mechanism: the resulting \\LaTeX\\ text is more or less exactly what you wrote\nin the theory, without any added sugar.\n\n\\subsection{Theory markup}\n\nInclude some markers at the beginning and the end of the theory snippet you want to cut out.\nYou have to place the following lines before and after the snippet, where snippets must always be\nconsecutive lines of theory text:\n\\begin{quote}\n\\verb!\\text_raw{!\\verb!*\\snip{!\\emph{snippetname}\\verb!}{1}{2}{%*!\\verb!}!\\\\\n\\emph{theory text}\\\\\n\\verb!\\text_raw{!\\verb!*!\\verb!}%endsnip*!\\verb!}!\n\\end{quote}\nwhere \\emph{snippetname} should be a unique name for the snippet. The numbers \\texttt{1}\nand \\texttt{2} are explained in a moment.\n\n\\subsection{Generate the \\texttt{.tex} file}\n\nRun your theory \\texttt{T} with the \\texttt{isabelle} \\texttt{build} tool\nto generate the \\LaTeX-file \\texttt{T.tex} which is needed for the next step,\nextraction of marked snippets.\nYou may also want to process \\texttt{T.tex} to generate a pdf document.\nThis requires a definition of \\texttt{\\char`\\\\snippet}:\n\\begin{verbatim}\n\\newcommand{\\repeatisanl}[1]\n  {\\ifnum#1=0\\else\\isanewline\\repeatisanl{\\numexpr#1-1}\\fi}\n\\newcommand{\\snip}[4]{\\repeatisanl#2#4\\repeatisanl#3}\n\\end{verbatim}\nParameter 2 and 3 of \\texttt{\\char`\\\\snippet} are numbers (the \\texttt{1}\nand \\texttt{2} above) and determine how many newlines are inserted before and after the snippet.\nUnfortunately \\texttt{text\\_raw} eats up all preceding and following newlines\nand they have to be inserted again in this manner. Otherwise the document generated from \\texttt{T.tex}\nwill look ugly around the snippets. It can take some iterations to get the number of required\nnewlines exactly right.\n\n\\subsection{Extract marked snippets}\n\\label{subsec:extract}\n\nExtract the marked bits of text with a shell-level script, e.g.\n\\begin{quote}\n\\verb!sed -n '/\\\\snip{/,/endsnip/p' T.tex > !\\emph{snippets}\\verb!.tex!\n\\end{quote}\nFile \\emph{snippets}\\texttt{.tex} (the name is arbitrary) now contains a sequence of blocks like this\n\\begin{quote}\n\\verb!\\snip{!\\emph{snippetname}\\verb!}{1}{2}{%!\\\\\n\\emph{theory text}\\\\\n\\verb!}%endsnip!\n\\end{quote}\n\n\\subsection{Including snippets}\n\nIn the preamble of the document where the snippets are to be used you define \\texttt{\\char`\\\\snip}\nand input \\emph{snippets}\\texttt{.tex}:\n\\begin{verbatim}\n\\newcommand{\\snip}[4]\n  {\\expandafter\\newcommand\\csname #1\\endcsname{#4}}\n\\input{snippets}\n\\end{verbatim}\nThis definition of \\texttt{\\char`\\\\snip} simply has the effect of defining for each snippet\n\\emph{snippetname} a \\LaTeX\\ command \\texttt{\\char`\\\\}\\emph{snippetname}\nthat produces the corresponding snippet text. In the body of your document you can display that text\nlike this:\n\\begin{quote}\n\\verb!\\begin{isabelle}!\\\\\n\\texttt{\\char`\\\\}\\emph{snippetname}\\\\\n\\verb!\\end{isabelle}!\n\\end{quote}\nThe \\texttt{isabelle} environment is the one defined in the standard file\n\\texttt{isabelle.sty} which most likely you are loading anyway.\n\n\n\\section{Antiquotation}\n\nYou want to show a constant and its type? Instead of going\n\\verb!@!\\verb!{const myconst}! \\verb!@!\\verb!{text \"::\"}! \\verb!@!\\verb!{typeof myconst}!,\nyou can just write \\verb!@!\\verb!{const_typ myconst}! using the new antiquotation\n\\texttt{const\\_typ} defined in \\texttt{LaTeXsugar}. For example,\n\\verb!@!\\verb!{const_typ length}! produces @{const_typ length}.\n\n*}\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/Doc/Sugar/Sugar.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.6370307875894138, "lm_q1q2_score": 0.34828903556393914}}
{"text": "theory SimpleVariantHF imports HOML MFilter BaseDefs\nbegin\n(*Definition: Set of supersets of X, we call this \\<H>\\<F> X*)\nabbreviation HF::\"\\<gamma>\\<Rightarrow>(\\<gamma>\\<Rightarrow>\\<sigma>)\"  where \"HF X \\<equiv> \\<lambda>Y.(X\\<^bold>\\<sqsubseteq>Y)\"\n\n(*Postulate: \\<H>\\<F> \\<G> is a filter; i.e., Hauptfilter of \\<G>*) \naxiomatization where F1: \"\\<lfloor>Filter (HF \\<G>)\\<rfloor>\" \n\n(*Necessary existence of a Godlike entity*) \ntheorem T6: \"\\<lfloor>\\<^bold>\\<box>(\\<^bold>\\<exists>\\<^sup>E \\<G>)\\<rfloor>\" using F1 by auto (*Proof found*)\n\ntheorem T6again: \"\\<lfloor>\\<^bold>\\<box>(\\<^bold>\\<exists>\\<^sup>E \\<G>)\\<rfloor>\"  \nproof -\n have T3': \"\\<lfloor>\\<^bold>\\<exists>\\<^sup>E \\<G>\\<rfloor>\" using F1 by auto\n have T6:  \"\\<lfloor>\\<^bold>\\<box>(\\<^bold>\\<exists>\\<^sup>E \\<G>)\\<rfloor>\" using T3' by blast \n thus ?thesis by simp qed\n\n(*Possible existence of Godlike entity not implied*)\nlemma T3: \"\\<lfloor>\\<^bold>\\<diamond>(\\<^bold>\\<exists>\\<^sup>E \\<G>)\\<rfloor>\" nitpick oops (*Countermodel*)\n\n(*Axiom T enforces possible existence of Godlike entity*)\naxiomatization \nlemma T3: assumes T: \"\\<lfloor>\\<^bold>\\<forall>\\<phi>.((\\<^bold>\\<box>\\<phi>) \\<^bold>\\<rightarrow> \\<phi>)\\<rfloor>\"\n          shows \"\\<lfloor>\\<^bold>\\<diamond>(\\<^bold>\\<exists>\\<^sup>E \\<G>)\\<rfloor>\"     using F1 T by auto\n\nlemma True nitpick[satisfy] oops (*Consistency*)\n\n(*Modal collapse: not implied anymore*)\nlemma MC: \"\\<lfloor>\\<^bold>\\<forall>\\<Phi>.(\\<Phi> \\<^bold>\\<rightarrow> \\<^bold>\\<box>\\<Phi>)\\<rfloor>\" nitpick oops (*Countermodel*)\nlemma MT: \"\\<lfloor>\\<^bold>\\<forall>x y.(((\\<G> x) \\<^bold>\\<and> (\\<G> y)) \\<^bold>\\<rightarrow> (x\\<^bold>=y))\\<rfloor>\" \n          nitpick oops (*Countermodel*)\nend\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/Computational-Metaphysics/2020-KR/SimpleVariantHF.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702761768248, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.348284712053662}}
{"text": "theory TimeRange\nimports Semantics PositiveAccounts QuiescentResult Timeout TransactionBound\nbegin\n\ntheorem inIntervalIdempotentToIntersectInterval :\n  \"inInterval (min1, max1) (min2, max2) =\n     (intersectInterval (Bounded min1, Bounded max1) (min2, max2) = (Bounded min1, Bounded max1))\"\n  apply (cases min2)\n  apply (cases max2)\n    apply simp\n  subgoal for a\n    by auto[1]\n    apply (cases max2)\n    subgoal for a\n      by auto\n    subgoal for a b\n      by auto\n    done\n\nlemma inIntervalIdempotency1 :\n  \"inInterval (x, y) (intersectInterval b c) \\<Longrightarrow> inInterval (x, y) b\"\n  apply (cases b)\n  apply (cases c)\n  subgoal for b1 b2 c1 c2\n    apply (simp only:inInterval.simps)\n    apply (cases b1)\n    apply (cases c1)\n    apply (smt (verit, best) OptBoundTimeInterval.intersectInterval.simps OptBoundTimeInterval.maxLow.simps(1) OptBoundTimeInterval.minHigh.elims assoc commute inIntervalIdempotentToIntersectInterval)\n    apply (smt (verit, ccfv_threshold) OptBoundTimeInterval.inInterval.simps(2) OptBoundTimeInterval.inInterval.simps(4) OptBoundTimeInterval.intersectInterval.simps OptBoundTimeInterval.maxLow.simps(2) OptBoundTimeInterval.minHigh.elims OptBoundTimeInterval.minHigh.simps(2) inIntervalIdempotentToIntersectInterval maxLow_comm)\n    apply (cases c1)\n    apply simp\n    apply (smt (verit, ccfv_threshold) OptBoundTimeInterval.inInterval.simps(3) OptBoundTimeInterval.inInterval.simps(4) OptBoundTimeInterval.minHigh.elims)\n    by (smt (verit) Groups.abel_semigroup.commute Groups.semigroup.assoc OptBoundTimeInterval.intersectInterval.simps OptBoundTimeInterval.maxLow.simps(3) OptBoundTimeInterval.minHigh.elims abel_semigroup_axioms inIntervalIdempotentToIntersectInterval semigroup_axioms)\n  done\n\nlemma inIntervalIdempotency2 :\n  \"inInterval (x, y) (intersectInterval b c) \\<Longrightarrow> inInterval (x, y) c\"\n  apply (cases b)\n  apply (cases c)\n  subgoal for b1 b2 c1 c2\n    apply (simp only:intersectInterval.simps)\n    apply (cases b1)\n    apply (cases c1)\n    apply (metis OptBoundTimeInterval.intersectInterval.simps commute inIntervalIdempotency1)\n    apply (metis OptBoundTimeInterval.intersectInterval.simps commute inIntervalIdempotency1)\n    apply simp\n    by (metis OptBoundTimeInterval.intersectInterval.simps inIntervalIdempotency1 minHigh_comm)\n  done\n\nlemma compatibleIdempotencyWhen :\n  \"b \\<le> a2 \\<Longrightarrow> b \\<le> a1 \\<Longrightarrow>\n   inInterval (a1, a2) (calculateNonAmbiguousInterval n ct (When a b c)) \\<Longrightarrow>\n   inInterval (a1, a2) (calculateNonAmbiguousInterval n ct c)\"\n  apply (induction a)\n  apply (smt (verit, best) OptBoundTimeInterval.inInterval.simps(2) Semantics.calculateNonAmbiguousInterval.simps(4) inIntervalIdempotency2)\n  subgoal for c1 c2\n    apply (cases c1)\n    apply simp\n    apply (cases \"gtIfNone n 0\")\n     apply simp\n    using inIntervalIdempotency2 apply blast\n    by presburger\n  done\n\nlemma calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_When :\n   \"inInterval (x, y) (calculateNonAmbiguousInterval n ct (When a b c)) \\<Longrightarrow>\n    y < b \\<or> x \\<ge> b\"\n  apply (induction a arbitrary:x y n ct b c)\n  subgoal for x y n ct b c\n    apply (cases \"ct < b\")\n     apply simp\n    apply auto\n    using OptBoundTimeInterval.inInterval.simps(3) inIntervalIdempotency1 by blast\n  subgoal for a1 a2 x y n ct b c\n    apply (cases a1)\n    apply (simp only:calculateNonAmbiguousInterval.simps)\n    subgoal for a ac\n      apply (cases \"gtIfNone n 0\")\n       apply simp\n      using inIntervalIdempotency2 apply blast\n      by simp\n    done\n  done\n\nlemma calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_reduceContractStep :\n\"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct contract) \\<Longrightarrow>\n reduceContractStep env state contract \\<noteq> AmbiguousTimeIntervalReductionError\"\n  apply (cases contract)\n  apply (cases \"refundOne (accounts state)\")\n  apply auto[1]\n       apply auto[1]\n  subgoal for a b c d e\n    by (auto split:bool.splits simp add:Let_def)\n     apply simp\n  subgoal for a b c\n    apply (auto split:prod.splits)\n    subgoal for x y\n      using calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_When by blast\n    done\n  apply (simp add:Let_def)\n  by simp\n\nlemma resultOfReduceIsCompatibleToo :\n  \"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct contract) \\<Longrightarrow>\n   reduceContractStep env state contract = Reduced x11 x12 x13 x14 \\<Longrightarrow>\n   inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct x14)\"\n  apply (cases contract)\n  using reduceStepClose_is_Close apply blast\n  subgoal for a b c d e\n    apply (cases \"evalValue env state d \\<le> 0\")\n    by (simp_all add:Let_def)\n    apply (smt (verit, del_insts) OptBoundTimeInterval.inInterval.elims(3) Semantics.ReduceStepResult.inject Semantics.calculateNonAmbiguousInterval.simps(3) Semantics.reduceContractStep.simps(3) inIntervalIdempotency1 inIntervalIdempotency2)\n  subgoal for a b c\n    apply (cases \"timeInterval env\")\n    apply (simp only:reduceContractStep.simps Let_def prod.case)\n    subgoal for a1 a2\n      apply (cases \"a2 < b\")\n       apply simp\n      apply simp\n      apply (cases \"b \\<le> a1\")\n       apply simp\n       apply (meson compatibleIdempotencyWhen linorder_not_le)\n      by simp\n    done\n  apply (metis Semantics.ReduceStepResult.inject Semantics.calculateNonAmbiguousInterval.simps(6) Semantics.reduceContractStep.simps(5))\n  by simp\n\nlemma resultOfReductionLoopQuiescentIsCompatibleToo :\n  \"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct contract) \\<Longrightarrow>\n   reductionLoop b env state contract wa ef = ContractQuiescent x11 x12 x13 x14 x15 \\<Longrightarrow>\n   inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct x15)\"\n  apply (induction b env state contract wa ef rule:reductionLoop.induct)\n  subgoal for reduced env state contract warnings payments\n    apply (simp only:reductionLoop.simps[of reduced env state contract warnings payments])\n    apply (cases \"reduceContractStep env state contract\")\n    subgoal for warning effect newState ncontract\n      apply (simp only:Let_def ReduceStepResult.case)\n      using resultOfReduceIsCompatibleToo by presburger\n     apply force\n    by simp\n  done\n\nlemma resultOfReduceUntilQuiescentIsCompatibleToo :\n  \"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct contract) \\<Longrightarrow>\n   reduceContractUntilQuiescent env state contract = ContractQuiescent x11 x12 x13 x14 x15 \\<Longrightarrow>\n   inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct x15)\"\n  by (metis Semantics.reduceContractUntilQuiescent.simps resultOfReductionLoopQuiescentIsCompatibleToo)\n\nlemma calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_reduceContractUntilQuiescent :\n\"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct contract) \\<Longrightarrow>\n reductionLoop b env state contract wa err \\<noteq> RRAmbiguousTimeIntervalError\"\n  apply (induction b env state contract wa err rule:reductionLoop.induct)\n  subgoal for reduced env state contract warnings payments\n    apply (simp only:reductionLoop.simps[of reduced env state contract warnings payments])\n    apply (cases \"reduceContractStep env state contract\")\n      apply (simp only:ReduceStepResult.case Let_def)\n    using resultOfReduceIsCompatibleToo apply presburger\n     apply simp\n    using calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_reduceContractStep by auto\n  done\n\nfun childCase :: \"Contract \\<Rightarrow> Case list \\<Rightarrow> bool\" where\n\"childCase c Nil = False\" |\n\"childCase c (Cons (Case _ h) t) = ((h = c) \\<or> childCase c t)\"\n\nlemma successInApplyCasesReturnChildCase :\n\"applyCases env sta h l = Applied nwa nsta ncont \\<Longrightarrow> childCase ncont l\"\n  apply (induction l)\n   apply simp\n  subgoal for f t\n    apply (cases h)\n      apply (cases f)\n    subgoal for x11 x12 x13 x14 x1 x2\n      apply (cases x1)\n      apply (meson Semantics.ApplyResult.inject)\n        apply (metis Semantics.ApplyResult.inject Semantics.applyCases.simps(1) TimeRange.childCase.simps(2))\n       apply simp\n      by simp\n    apply (cases f)\n    subgoal for x21 x22 x1 x2\n      apply (cases x1)\n        apply simp\n       apply (metis Semantics.ApplyResult.inject Semantics.applyCases.simps(2) TimeRange.childCase.simps(2))\n      by simp\n    apply (cases f)\n    subgoal for x1 x2\n      apply (cases x1)\n    apply simp\n    apply simp\n      by (metis Semantics.ApplyResult.inject Semantics.applyCases.simps(3) TimeRange.childCase.simps(2))\n    done\n  done\n\nlemma resultOfApplyCaseIsCompatibleToo_aux :\n\"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct (When x41 x42 x43)) \\<Longrightarrow>\n childCase ncont x41 \\<Longrightarrow> ct < x42 \\<Longrightarrow> gtIfNone n 0 \\<Longrightarrow>\n inInterval (timeInterval env) (calculateNonAmbiguousInterval (subIfSome n 1) ct ncont)\"\n  apply (induction x41)\n   apply simp\n  subgoal for h t\n    apply (cases h)\n    subgoal for x y\n      apply simp\n      by (smt (verit, best) OptBoundTimeInterval.inInterval.elims(3) inIntervalIdempotency1 inIntervalIdempotency2)\n  done\n  done\n\nlemma resultOfApplyCaseIsCompatibleToo :\n\"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct (When x41 x42 x43)) \\<Longrightarrow>\n applyCases env sta h x41 = Applied nwa nsta ncont \\<Longrightarrow> ct < x42 \\<Longrightarrow> gtIfNone n 0 \\<Longrightarrow>\n inInterval (timeInterval env) (calculateNonAmbiguousInterval (subIfSome n 1) ct ncont)\"\n  by (simp add: resultOfApplyCaseIsCompatibleToo_aux successInApplyCasesReturnChildCase)\n\nfun ifCaseLt :: \"POSIXTime \\<Rightarrow> Contract \\<Rightarrow> bool\" where\n\"ifCaseLt ct (When a b c) = (ct < b)\" |\n\"ifCaseLt _ _ = True\"\n\nlemma resultOfApplyInputIsCompatibleToo :\n\"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct cont) \\<Longrightarrow>\n applyInput env sta h cont = Applied nwa nsta ncont \\<Longrightarrow> ifCaseLt ct cont \\<Longrightarrow> gtIfNone n 0 \\<Longrightarrow>\n inInterval (timeInterval env) (calculateNonAmbiguousInterval (subIfSome n 1) ct ncont)\"\n  apply (cases cont)\n  apply simp_all\n  by (simp add: resultOfApplyCaseIsCompatibleToo)\n\nlemma geIfNone_redListSize :\n  \"geIfNone n (int (length (h # t))) \\<Longrightarrow> geIfNone (subIfSome n 1) (int (length t))\"\n  by (smt (verit, ccfv_threshold) Semantics.geIfNone.elims(1) Semantics.geIfNone.simps(2) Semantics.subIfSome.elims impossible_Cons of_nat_le_iff)\n\nfun isValidInterval :: \"POSIXTime \\<times> POSIXTime \\<Rightarrow> bool\" where\n\"isValidInterval (a, b) = (a \\<le> b)\"\n\nlemma reduceStep_ifCaseLtCt_aux : \"inInterval (a, b) (calculateNonAmbiguousInterval n ct (When x41 x42 x43)) \\<Longrightarrow>\n                                   a \\<le> b \\<Longrightarrow> env = \\<lparr>timeInterval = (a, b)\\<rparr> \\<Longrightarrow> b < x42 \\<Longrightarrow> ct < x42\"\n  apply (induction x41)\n   apply simp\n   apply (smt (verit, best) OptBoundTimeInterval.inInterval.simps(3) inIntervalIdempotency1)\n  subgoal for h t\n    apply simp\n    apply (cases h)\n    apply simp\n  using inIntervalIdempotency2 by presburger\n  done\n\nlemma reduceStep_ifCaseLtCt : \"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct (When x41 x42 x43)) \\<Longrightarrow>\n                               reduceContractStep env state (When x41 x42 x43) = NotReduced \\<Longrightarrow> isValidInterval (timeInterval env) \\<Longrightarrow> ct < x42\"\n  apply (cases env)\n  subgoal for timeInterv\n    apply (cases timeInterv)\n    apply simp\n    subgoal for a b\n      apply (cases \"b < x42\")\n       apply simp\n      using reduceStep_ifCaseLtCt_aux apply blast\n      by (metis Semantics.ReduceStepResult.distinct(5) Semantics.ReduceStepResult.simps(3))\n    done\n  done\n\nlemma reduceLoop_ifCaseLtCt : \"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct cont) \\<Longrightarrow>\n                               reductionLoop b env state cont wa ef = ContractQuiescent x11 x12 x13 x14 x15 \\<Longrightarrow> isValidInterval (timeInterval env) \\<Longrightarrow> ifCaseLt ct x15\"\n  apply (induction b env state cont wa ef rule:reductionLoop.induct)\n  subgoal for reduced env state contract warnings payments\n  apply (cases \"x15 = Close\")\n  apply simp\n  apply (cases x15)\n  apply simp\n  apply simp\n  apply simp\n    apply (simp only:reductionLoop.simps[of reduced env state contract warnings payments])\n    apply (cases \"reduceContractStep env state contract\")\n    apply (simp only:ReduceStepResult.case)\n    using resultOfReduceIsCompatibleToo apply presburger\n    apply (simp only:ReduceStepResult.case ifCaseLt.simps)\n       apply (simp add: reduceStep_ifCaseLtCt)\n    apply force\n    using TimeRange.ifCaseLt.simps(5) apply blast\n    using TimeRange.ifCaseLt.simps(6) by blast\n  done\n\nlemma reduceContractUntilQuiescent_ifCaseLtCt : \"inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct cont) \\<Longrightarrow>\n                                                 reduceContractUntilQuiescent env state cont = ContractQuiescent x11 x12 x13 x14 x15 \\<Longrightarrow>\n                                                 isValidInterval (timeInterval env) \\<Longrightarrow> ifCaseLt ct x15\"\n  apply (simp only:reduceContractUntilQuiescent.simps)\n  by (simp add: reduceLoop_ifCaseLtCt)\n\nlemma calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_applyAllLoop :\n\"geIfNone n (int (length inps)) \\<Longrightarrow>\n inInterval (timeInterval env) (calculateNonAmbiguousInterval n ct c) \\<Longrightarrow>\n isValidInterval (timeInterval env) \\<Longrightarrow>\n applyAllLoop b env s c inps wa ef \\<noteq>\n ApplyAllAmbiguousTimeIntervalError\"\n  apply (induction b env s c inps wa ef arbitrary: n ct rule:applyAllLoop.induct)\n  subgoal for contractChanged env state contract inputs warnings payments n ct\n    apply (simp only:applyAllLoop.simps[of contractChanged env state contract inputs warnings payments])\n    apply (cases \"reduceContractUntilQuiescent env state contract\")\n     apply (simp only:ReduceResult.case)\n    apply (cases inputs)\n    apply (simp only:list.cases)\n      apply force\n     apply (simp only:list.cases)\n    subgoal for x11 x12 x13 x14 x15 h t\n      apply (cases \"applyInput env x14 h x15\")\n       apply (simp only:ApplyResult.case)\n      subgoal fact for nwa nsta ncont\n        subgoal premises fact\n        apply (rule fact(1)[of x11 x12 x13 x14 x15 h t nwa nsta ncont \"subIfSome n 1\" \"ct\"])\n            apply auto\n            apply (simp add: fact(7))\n            using fact(2) geIfNone_redListSize apply auto[1]\n            apply (rule resultOfApplyInputIsCompatibleToo[of env n ct x15 x14 h nwa nsta])\n            using fact(3) fact(5) resultOfReduceUntilQuiescentIsCompatibleToo apply blast\n            apply (simp add: fact(7))\n            using fact(3) fact(4) fact(5) reduceContractUntilQuiescent_ifCaseLtCt apply blast\n            using Semantics.gtIfNone.elims(3) fact(2) of_nat_le_iff by fastforce\n          done\n        by (metis Semantics.ApplyAllResult.distinct(5) Semantics.ApplyResult.simps(5))\n      using calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_reduceContractUntilQuiescent by auto\n    done\n\nlemma calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_applyAllInputs :\n\"geIfNone n (int (length inps)) \\<Longrightarrow>\n inInterval (minInterv, maxInterv) (calculateNonAmbiguousInterval n ct c) \\<Longrightarrow>\n isValidInterval (minInterv, maxInterv) \\<Longrightarrow>\n applyAllInputs \\<lparr> timeInterval = (minInterv, maxInterv) \\<rparr> s c inps\n    \\<noteq> ApplyAllAmbiguousTimeIntervalError\"\n  apply (simp only:applyAllInputs.simps)\n  using calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_applyAllLoop by auto\n\ntheorem calculateNonAmbiguousIntervalAvoidsAmbiguousInterval :\n  \"geIfNone n (int (length (inputs tx))) \\<Longrightarrow>\n   inInterval (interval tx) (calculateNonAmbiguousInterval n ct c) \\<Longrightarrow>\n   computeTransaction tx s c \\<noteq> TransactionError TEAmbiguousTimeIntervalError\"\n  apply (simp only:computeTransaction.simps Let_def)\n  apply (cases tx)\n  subgoal for interv inps\n    apply (cases interv)\n    subgoal for minInterv maxInterv\n      apply (simp add:Let_def del:applyAllInputs.simps)\n      apply (cases \"applyAllInputs \\<lparr>timeInterval = (max minInterv (minTime s), maxInterv)\\<rparr>\n           (s\\<lparr>minTime := max minInterv (minTime s)\\<rparr>) c inps\")\n      apply simp\n       apply simp\n      apply (simp del:applyAllInputs.simps)\n      apply (cases s)\n      apply (simp del:applyAllInputs.simps)\n      subgoal for accounts choices boundValues minTime\n        apply (cases \"minInterv \\<le> minTime\")\n        apply (simp del:applyAllInputs.simps)\n         apply (smt (verit, ccfv_threshold) OptBoundTimeInterval.inInterval.elims(3) OptBoundTimeInterval.inInterval.simps(2) OptBoundTimeInterval.inInterval.simps(3) OptBoundTimeInterval.inInterval.simps(4) TimeRange.isValidInterval.simps calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_applyAllInputs)\n        by (metis Lattices.linorder_class.max.absorb4 Lattices.linorder_class.max.commute TimeRange.isValidInterval.simps calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_applyAllInputs linorder_not_le)\n      done\n    done\n  done\n\ncorollary calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_bounded :\n  \"n \\<ge> (int (length (inputs tx))) \\<Longrightarrow>\n   inInterval (interval tx) (calculateNonAmbiguousInterval (Some n) ct c) \\<Longrightarrow>\n   computeTransaction tx s c \\<noteq> TransactionError TEAmbiguousTimeIntervalError\"\n  using Semantics.geIfNone.simps(2) calculateNonAmbiguousIntervalAvoidsAmbiguousInterval by blast\n\ncorollary calculateNonAmbiguousIntervalAvoidsAmbiguousInterval_unbounded :\n  \"inInterval (interval tx) (calculateNonAmbiguousInterval None ct c) \\<Longrightarrow>\n   computeTransaction tx s c \\<noteq> TransactionError TEAmbiguousTimeIntervalError\"\n  by (meson Semantics.geIfNone.simps(1) calculateNonAmbiguousIntervalAvoidsAmbiguousInterval)\n\nend\n", "meta": {"author": "input-output-hk", "repo": "marlowe", "sha": "d2f7b3108894b7c3169c71214f1a2772716544bf", "save_path": "github-repos/isabelle/input-output-hk-marlowe", "path": "github-repos/isabelle/input-output-hk-marlowe/marlowe-d2f7b3108894b7c3169c71214f1a2772716544bf/isabelle/Core/TimeRange.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.7490872131147275, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.3482518224727491}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory NonDetMonadVCG\nimports\n  NonDetMonadLemmas\n  \"wp/WP\"\n  \"wp/WPC\"\n  \"Strengthen\"\nbegin\n\n(* Wrap up the standard usage pattern of wp/wpc/simp into its own command: *)\nmethod wpsimp uses wp simp =\n  ((determ \\<open>wp add: wp|wpc|clarsimp simp: simp\\<close>)+)[1]\n\ndeclare K_def [simp]\n\nsection \"Satisfiability\"\n\ntext {*\n  The dual to validity: an existential instead of a universal\n  quantifier for the post condition. In refinement, it is\n  often sufficient to know that there is one state that\n  satisfies a condition.\n*}\ndefinition\n  exs_valid :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a, 'b) nondet_monad \\<Rightarrow>\n                ('b \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  (\"\\<lbrace>_\\<rbrace> _ \\<exists>\\<lbrace>_\\<rbrace>\")\nwhere\n \"exs_valid P f Q \\<equiv> (\\<forall>s. P s \\<longrightarrow> (\\<exists>(rv, s') \\<in> fst (f s). Q rv s'))\"\n\n\ntext {* The above for the exception monad *}\ndefinition\n  ex_exs_validE :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a, 'e + 'b) nondet_monad \\<Rightarrow>\n                    ('b \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> ('e \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> bool\"\n   (\"\\<lbrace>_\\<rbrace> _ \\<exists>\\<lbrace>_\\<rbrace>, \\<lbrace>_\\<rbrace>\")\nwhere\n \"ex_exs_validE P f Q E \\<equiv>\n     exs_valid P f (\\<lambda>rv. case rv of Inl e \\<Rightarrow> E e | Inr v \\<Rightarrow> Q v)\"\n\n\nsection \"Lemmas\"\n\nsubsection {* Determinism *}\n\nlemma det_set_iff:\n  \"det f \\<Longrightarrow> (r \\<in> fst (f s)) = (fst (f s) = {r})\"\n  apply (simp add: det_def)\n  apply (rule iffI)\n  apply (erule_tac x=s in allE)\n  apply auto\n  done\n\nlemma return_det [iff]:\n  \"det (return x)\"\n  by (simp add: det_def return_def)\n\nlemma put_det [iff]:\n  \"det (put s)\"\n  by (simp add: det_def put_def)\n\nlemma get_det [iff]:\n  \"det get\"\n  by (simp add: det_def get_def)\n\nlemma det_gets [iff]:\n  \"det (gets f)\"\n  by (auto simp add: gets_def det_def get_def return_def bind_def)\n\nlemma det_UN:\n  \"det f \\<Longrightarrow> (\\<Union>x \\<in> fst (f s). g x) = (g (THE x. x \\<in> fst (f s)))\"\n  unfolding det_def\n  apply simp\n  apply (drule spec [of _ s])\n  apply clarsimp\n  done\n\nlemma bind_detI [simp, intro!]:\n  \"\\<lbrakk> det f; \\<forall>x. det (g x) \\<rbrakk> \\<Longrightarrow> det (f >>= g)\"\n  apply (simp add: bind_def det_def split_def)\n  apply clarsimp\n  apply (erule_tac x=s in allE)\n  apply clarsimp\n  apply (erule_tac x=\"a\" in allE)\n  apply (erule_tac x=\"b\" in allE)\n  apply clarsimp\n  done\n\nlemma the_run_stateI:\n  \"fst (M s) = {s'} \\<Longrightarrow> the_run_state M s = s'\"\n  by (simp add: the_run_state_def)\n\nlemma the_run_state_det:\n  \"\\<lbrakk> s' \\<in> fst (M s); det M \\<rbrakk> \\<Longrightarrow> the_run_state M s = s'\"\n  by (simp add: the_run_stateI det_set_iff)\n\nsubsection \"Lifting and Alternative Basic Definitions\"\n\nlemma liftE_liftM: \"liftE = liftM Inr\"\n  apply (rule ext)\n  apply (simp add: liftE_def liftM_def)\n  done\n\nlemma liftME_liftM: \"liftME f = liftM (case_sum Inl (Inr \\<circ> f))\"\n  apply (rule ext)\n  apply (simp add: liftME_def liftM_def bindE_def returnOk_def lift_def)\n  apply (rule_tac f=\"bind x\" in arg_cong)\n  apply (rule ext)\n  apply (case_tac xa)\n   apply (simp_all add: lift_def throwError_def)\n  done\n\nlemma liftE_bindE:\n  \"(liftE a) >>=E b = a >>= b\"\n  apply (simp add: liftE_def bindE_def lift_def bind_assoc)\n  done\n\nlemma liftM_id[simp]: \"liftM id = id\"\n  apply (rule ext)\n  apply (simp add: liftM_def)\n  done\n\nlemma liftM_bind:\n  \"(liftM t f >>= g) = (f >>= (\\<lambda>x. g (t x)))\"\n  by (simp add: liftM_def bind_assoc)\n\nlemma gets_bind_ign: \"gets f >>= (\\<lambda>x. m) = m\"\n  apply (rule ext)\n  apply (simp add: bind_def simpler_gets_def)\n  done\n\nlemma get_bind_apply: \"(get >>= f) x = f x x\"\n  by (simp add: get_def bind_def)\n\n\n\nlemma exec_get:\n  \"(get >>= m) s = m s s\"\n  by (simp add: get_def bind_def)\n\nlemma bind_eqI:\n  \"\\<lbrakk> f = f'; \\<And>x. g x = g' x \\<rbrakk> \\<Longrightarrow> f >>= g = f' >>= g'\"\n  apply (rule ext)\n  apply (simp add: bind_def)\n  apply (auto simp: split_def)\n  done\n\nsubsection \"Simplification Rules for Lifted And/Or\"\n\nlemma pred_andE[elim!]: \"\\<lbrakk> (A and B) x; \\<lbrakk> A x; B x \\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  by(simp add:pred_conj_def)\n\nlemma pred_andI[intro!]: \"\\<lbrakk> A x; B x \\<rbrakk> \\<Longrightarrow> (A and B) x\"\n  by(simp add:pred_conj_def)\n\nlemma pred_conj_app[simp]: \"(P and Q) x = (P x \\<and> Q x)\"\n  by(simp add:pred_conj_def)\n\nlemma bipred_andE[elim!]: \"\\<lbrakk> (A And B) x y; \\<lbrakk> A x y; B x y \\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  by(simp add:bipred_conj_def)\n\nlemma bipred_andI[intro!]: \"\\<lbrakk> A x y; B x y \\<rbrakk> \\<Longrightarrow> (A And B) x y\"\n  by (simp add:bipred_conj_def)\n\nlemma bipred_conj_app[simp]: \"(P And Q) x = (P x and Q x)\"\n  by(simp add:pred_conj_def bipred_conj_def)\n\nlemma pred_disjE[elim!]: \"\\<lbrakk> (P or Q) x; P x \\<Longrightarrow> R; Q x \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  by (fastforce simp: pred_disj_def)\n\nlemma pred_disjI1[intro]: \"P x \\<Longrightarrow> (P or Q) x\"\n  by (simp add: pred_disj_def)\n\nlemma pred_disjI2[intro]: \"Q x \\<Longrightarrow> (P or Q) x\"\n  by (simp add: pred_disj_def)\n\nlemma pred_disj_app[simp]: \"(P or Q) x = (P x \\<or> Q x)\"\n  by auto\n\nlemma bipred_disjI1[intro]: \"P x y \\<Longrightarrow> (P Or Q) x y\"\n  by (simp add: bipred_disj_def)\n\nlemma bipred_disjI2[intro]: \"Q x y \\<Longrightarrow> (P Or Q) x y\"\n  by (simp add: bipred_disj_def)\n\nlemma bipred_disj_app[simp]: \"(P Or Q) x = (P x or Q x)\"\n  by(simp add:pred_disj_def bipred_disj_def)\n\nlemma pred_notnotD[simp]: \"(not not P) = P\"\n  by(simp add:pred_neg_def)\n\nlemma pred_and_true[simp]: \"(P and \\<top>) = P\"\n  by(simp add:pred_conj_def)\n\nlemma pred_and_true_var[simp]: \"(\\<top> and P) = P\"\n  by(simp add:pred_conj_def)\n\nlemma pred_and_false[simp]: \"(P and \\<bottom>) = \\<bottom>\"\n  by(simp add:pred_conj_def)\n\nlemma pred_and_false_var[simp]: \"(\\<bottom> and P) = \\<bottom>\"\n  by(simp add:pred_conj_def)\n\nsubsection \"Hoare Logic Rules\"\n\nlemma validE_def2:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>R\\<rbrace> \\<equiv> \\<forall>s. P s \\<longrightarrow> (\\<forall>(r,s') \\<in> fst (f s). case r of Inr b \\<Rightarrow> Q b s'\n                                                              | Inl a \\<Rightarrow> R a s')\"\n  by (unfold valid_def validE_def)\n\nlemma seq':\n  \"\\<lbrakk> \\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>;\n     \\<forall>x. P x \\<longrightarrow> \\<lbrace>C\\<rbrace> g x \\<lbrace>D\\<rbrace>;\n     \\<forall>x s. B x s \\<longrightarrow> P x \\<and> C s \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>D\\<rbrace>\"\n  apply (clarsimp simp: valid_def bind_def)\n  apply fastforce\n  done\n\nlemma seq:\n  assumes f_valid: \"\\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>\"\n  assumes g_valid: \"\\<And>x. P x \\<Longrightarrow> \\<lbrace>C\\<rbrace> g x \\<lbrace>D\\<rbrace>\"\n  assumes bind:  \"\\<And>x s. B x s \\<Longrightarrow> P x \\<and> C s\"\n  shows \"\\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>D\\<rbrace>\"\napply (insert f_valid g_valid bind)\napply (blast intro: seq')\ndone\n\nlemma seq_ext':\n  \"\\<lbrakk> \\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>;\n     \\<forall>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>C\\<rbrace>\"\n  by (fastforce simp: valid_def bind_def Let_def split_def)\n\nlemma seq_ext:\n  assumes f_valid: \"\\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>\"\n  assumes g_valid: \"\\<And>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>\"\n  shows \"\\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>C\\<rbrace>\"\n apply(insert f_valid g_valid)\n apply(blast intro: seq_ext')\ndone\n\nlemma seqE':\n  \"\\<lbrakk> \\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>,\\<lbrace>E\\<rbrace>;\n     \\<forall>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>A\\<rbrace> doE x \\<leftarrow> f; g x odE \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  apply(simp add:bindE_def lift_def bind_def Let_def split_def)\n  apply(clarsimp simp:validE_def2)\n  apply (fastforce simp add: throwError_def return_def lift_def\n                  split: sum.splits)\n  done\n\nlemma seqE:\n  assumes f_valid: \"\\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  assumes g_valid: \"\\<And>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  shows \"\\<lbrace>A\\<rbrace> doE x \\<leftarrow> f; g x odE \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  apply(insert f_valid g_valid)\n  apply(blast intro: seqE')\n  done\n\nlemma hoare_TrueI: \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>_. \\<top>\\<rbrace>\"\n  by (simp add: valid_def)\n\nlemma hoareE_TrueI: \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>_. \\<top>\\<rbrace>, \\<lbrace>\\<lambda>r. \\<top>\\<rbrace>\"\n  by (simp add: validE_def valid_def)\n\nlemma hoare_True_E_R [simp]:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. True\\<rbrace>, -\"\n  by (auto simp add: validE_R_def validE_def valid_def split: sum.splits)\n\nlemma hoare_post_conj [intro!]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> a \\<lbrace> Q \\<rbrace>; \\<lbrace> P \\<rbrace> a \\<lbrace> R \\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> a \\<lbrace> Q And R \\<rbrace>\"\n  by (fastforce simp: valid_def split_def bipred_conj_def)\n\nlemma hoare_pre_disj [intro!]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> a \\<lbrace> R \\<rbrace>; \\<lbrace> Q \\<rbrace> a \\<lbrace> R \\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace> P or Q \\<rbrace> a \\<lbrace> R \\<rbrace>\"\n  by (simp add:valid_def pred_disj_def)\n\nlemma hoare_conj:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P and P'\\<rbrace> f \\<lbrace>Q And Q'\\<rbrace>\"\n  unfolding valid_def by auto\n\nlemma hoare_post_taut: \"\\<lbrace> P \\<rbrace> a \\<lbrace> \\<top>\\<top> \\<rbrace>\"\n  by (simp add:valid_def)\n\nlemma wp_post_taut: \"\\<lbrace>\\<lambda>r. True\\<rbrace> f \\<lbrace>\\<lambda>r s. True\\<rbrace>\"\n  by (rule hoare_post_taut)\n\nlemma wp_post_tautE: \"\\<lbrace>\\<lambda>r. True\\<rbrace> f \\<lbrace>\\<lambda>r s. True\\<rbrace>,\\<lbrace>\\<lambda>f s. True\\<rbrace>\"\nproof -\n  have P: \"\\<And>r. (case r of Inl a \\<Rightarrow> True | _ \\<Rightarrow> True) = True\"\n    by (case_tac r, simp_all)\n  show ?thesis\n    by (simp add: validE_def P wp_post_taut)\nqed\n\nlemma hoare_pre_cont [simp]: \"\\<lbrace> \\<bottom> \\<rbrace> a \\<lbrace> P \\<rbrace>\"\n  by (simp add:valid_def)\n\n\nsubsection {* Strongest Postcondition Rules *}\n\nlemma get_sp:\n  \"\\<lbrace>P\\<rbrace> get \\<lbrace>\\<lambda>a s. s = a \\<and> P s\\<rbrace>\"\n  by(simp add:get_def valid_def)\n\nlemma put_sp:\n  \"\\<lbrace>\\<top>\\<rbrace> put a \\<lbrace>\\<lambda>_ s. s = a\\<rbrace>\"\n  by(simp add:put_def valid_def)\n\nlemma return_sp:\n  \"\\<lbrace>P\\<rbrace> return a \\<lbrace>\\<lambda>b s. b = a \\<and> P s\\<rbrace>\"\n  by(simp add:return_def valid_def)\n\nlemma assert_sp:\n  \"\\<lbrace> P \\<rbrace> assert Q \\<lbrace> \\<lambda>r s. P s \\<and> Q \\<rbrace>\"\n  by (simp add: assert_def fail_def return_def valid_def)\n\nlemma hoare_gets_sp:\n  \"\\<lbrace>P\\<rbrace> gets f \\<lbrace>\\<lambda>rv s. rv = f s \\<and> P s\\<rbrace>\"\n  by (simp add: valid_def simpler_gets_def)\n\nlemma hoare_return_drop_var [iff]: \"\\<lbrace> Q \\<rbrace> return x \\<lbrace> \\<lambda>r. Q \\<rbrace>\"\n  by (simp add:valid_def return_def)\n\nlemma hoare_gets [intro!]: \"\\<lbrakk> \\<And>s. P s \\<Longrightarrow> Q (f s) s \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> gets f \\<lbrace> Q \\<rbrace>\"\n  by (simp add:valid_def gets_def get_def bind_def return_def)\n\nlemma hoare_modifyE_var [intro!]:\n  \"\\<lbrakk> \\<And>s. P s \\<Longrightarrow> Q (f s) \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> modify f \\<lbrace> \\<lambda>r s. Q s \\<rbrace>\"\n  by(simp add: valid_def modify_def put_def get_def bind_def)\n\nlemma hoare_if [intro!]:\n  \"\\<lbrakk> P \\<Longrightarrow> \\<lbrace> Q \\<rbrace> a \\<lbrace> R \\<rbrace>; \\<not> P \\<Longrightarrow> \\<lbrace> Q \\<rbrace> b \\<lbrace> R \\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace> Q \\<rbrace> if P then a else b \\<lbrace> R \\<rbrace>\"\n  by (simp add:valid_def)\n\nlemma hoare_pre_subst: \"\\<lbrakk> A = B; \\<lbrace>A\\<rbrace> a \\<lbrace>C\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>B\\<rbrace> a \\<lbrace>C\\<rbrace>\"\n  by(clarsimp simp:valid_def split_def)\n\nlemma hoare_post_subst: \"\\<lbrakk> B = C; \\<lbrace>A\\<rbrace> a \\<lbrace>B\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>A\\<rbrace> a \\<lbrace>C\\<rbrace>\"\n  by(clarsimp simp:valid_def split_def)\n\nlemma hoare_pre_tautI: \"\\<lbrakk> \\<lbrace>A and P\\<rbrace> a \\<lbrace>B\\<rbrace>; \\<lbrace>A and not P\\<rbrace> a \\<lbrace>B\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>A\\<rbrace> a \\<lbrace>B\\<rbrace>\"\n  by(fastforce simp:valid_def split_def pred_conj_def pred_neg_def)\n\nlemma hoare_pre_imp: \"\\<lbrakk> \\<And>s. P s \\<Longrightarrow> Q s; \\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>\"\n  by (fastforce simp add:valid_def)\n\nlemma hoare_post_imp: \"\\<lbrakk> \\<And>r s. Q r s \\<Longrightarrow> R r s; \\<lbrace>P\\<rbrace> a \\<lbrace>Q\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>\"\n  by(fastforce simp:valid_def split_def)\n\nlemma hoare_post_impErr': \"\\<lbrakk> \\<lbrace>P\\<rbrace> a \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>;\n                           \\<forall>r s. Q r s \\<longrightarrow> R r s;\n                           \\<forall>e s. E e s \\<longrightarrow> F e s \\<rbrakk> \\<Longrightarrow>\n                         \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>,\\<lbrace>F\\<rbrace>\"\n apply (simp add: validE_def)\n apply (rule_tac Q=\"\\<lambda>r s. case r of Inl a \\<Rightarrow> E a s | Inr b \\<Rightarrow> Q b s\" in hoare_post_imp)\n  apply (case_tac r)\n   apply simp_all\n done\n\nlemma hoare_post_impErr: \"\\<lbrakk> \\<lbrace>P\\<rbrace> a \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>;\n                          \\<And>r s. Q r s \\<Longrightarrow> R r s;\n                          \\<And>e s. E e s \\<Longrightarrow> F e s \\<rbrakk> \\<Longrightarrow>\n                         \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>,\\<lbrace>F\\<rbrace>\"\n apply (blast intro: hoare_post_impErr')\n done\n\nlemma hoare_validE_cases:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>, \\<lbrace> \\<lambda>_ _. True \\<rbrace>; \\<lbrace> P \\<rbrace> f \\<lbrace> \\<lambda>_ _. True \\<rbrace>, \\<lbrace> R \\<rbrace> \\<rbrakk>\n  \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>, \\<lbrace> R \\<rbrace>\"\n  by (simp add: validE_def valid_def split: sum.splits) blast\n\nlemma hoare_post_imp_dc:\n  \"\\<lbrakk>\\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>r. Q\\<rbrace>; \\<And>s. Q s \\<Longrightarrow> R s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>r. R\\<rbrace>,\\<lbrace>\\<lambda>r. R\\<rbrace>\"\n  by (simp add: validE_def valid_def split: sum.splits) blast\n\nlemma hoare_post_imp_dc2:\n  \"\\<lbrakk>\\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>r. Q\\<rbrace>; \\<And>s. Q s \\<Longrightarrow> R s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>r. R\\<rbrace>,\\<lbrace>\\<lambda>r s. True\\<rbrace>\"\n  by (simp add: validE_def valid_def split: sum.splits) blast\n\nlemma hoare_post_imp_dc2E:\n  \"\\<lbrakk>\\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>r. Q\\<rbrace>; \\<And>s. Q s \\<Longrightarrow> R s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>r s. True\\<rbrace>, \\<lbrace>\\<lambda>r. R\\<rbrace>\"\n  by (simp add: validE_def valid_def split: sum.splits) fast\n\nlemma hoare_post_imp_dc2E_actual:\n  \"\\<lbrakk>\\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>r. R\\<rbrace>\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>r s. True\\<rbrace>, \\<lbrace>\\<lambda>r. R\\<rbrace>\"\n  by (simp add: validE_def valid_def split: sum.splits) fast\n\nlemma hoare_post_imp_dc2_actual:\n  \"\\<lbrakk>\\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>r. R\\<rbrace>\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>r. R\\<rbrace>, \\<lbrace>\\<lambda>r s. True\\<rbrace>\"\n  by (simp add: validE_def valid_def split: sum.splits) fast\n\nlemma hoare_post_impE: \"\\<lbrakk> \\<And>r s. Q r s \\<Longrightarrow> R r s; \\<lbrace>P\\<rbrace> a \\<lbrace>Q\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>\"\n  by (fastforce simp:valid_def split_def)\n\nlemma hoare_conjD1:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q rv and R rv\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q rv\\<rbrace>\"\n  unfolding valid_def by auto\n\nlemma hoare_conjD2:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q rv and R rv\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. R rv\\<rbrace>\"\n  unfolding valid_def by auto\n\nlemma hoare_post_disjI1:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q rv\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q rv or R rv\\<rbrace>\"\n  unfolding valid_def by auto\n\nlemma hoare_post_disjI2:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. R rv\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q rv or R rv\\<rbrace>\"\n  unfolding valid_def by auto\n\nlemma hoare_weaken_pre:\n  \"\\<lbrakk>\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>; \\<And>s. P s \\<Longrightarrow> Q s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>\"\n  apply (rule hoare_pre_imp)\n   prefer 2\n   apply assumption\n  apply blast\n  done\n\nlemma hoare_strengthen_post:\n  \"\\<lbrakk>\\<lbrace>P\\<rbrace> a \\<lbrace>Q\\<rbrace>; \\<And>r s. Q r s \\<Longrightarrow> R r s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>\"\n  apply (rule hoare_post_imp)\n   prefer 2\n   apply assumption\n  apply blast\n  done\n\nlemma use_valid: \"\\<lbrakk>(r, s') \\<in> fst (f s); \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>; P s \\<rbrakk> \\<Longrightarrow> Q r s'\"\n  apply (simp add: valid_def)\n  apply blast\n  done\n\nlemma use_validE_norm: \"\\<lbrakk> (Inr r', s') \\<in> fst (B s); \\<lbrace> P \\<rbrace> B \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>; P s \\<rbrakk> \\<Longrightarrow> Q r' s'\"\n  apply (clarsimp simp: validE_def valid_def)\n  apply force\n  done\n\nlemma use_validE_except: \"\\<lbrakk> (Inl r', s') \\<in> fst (B s); \\<lbrace> P \\<rbrace> B \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>; P s \\<rbrakk> \\<Longrightarrow> E r' s'\"\n  apply (clarsimp simp: validE_def valid_def)\n  apply force\n  done\n\nlemma in_inv_by_hoareD:\n  \"\\<lbrakk> \\<And>P. \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>_. P\\<rbrace>; (x,s') \\<in> fst (f s) \\<rbrakk> \\<Longrightarrow> s' = s\"\n  by (auto simp add: valid_def) blast\n\nsubsection \"Satisfiability\"\n\nlemma exs_hoare_post_imp: \"\\<lbrakk>\\<And>r s. Q r s \\<Longrightarrow> R r s; \\<lbrace>P\\<rbrace> a \\<exists>\\<lbrace>Q\\<rbrace>\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<exists>\\<lbrace>R\\<rbrace>\"\n  apply (simp add: exs_valid_def)\n  apply safe\n  apply (erule_tac x=s in allE, simp)\n  apply blast\n  done\n\nlemma use_exs_valid: \"\\<lbrakk>\\<lbrace>P\\<rbrace> f \\<exists>\\<lbrace>Q\\<rbrace>; P s \\<rbrakk> \\<Longrightarrow> \\<exists>(r, s') \\<in> fst (f s). Q r s'\"\n  by (simp add: exs_valid_def)\n\ndefinition \"exs_postcondition P f \\<equiv> (\\<lambda>a b. \\<exists>(rv, s)\\<in> f a b. P rv s)\"\n\nlemma exs_valid_is_triple:\n  \"exs_valid P f Q = triple_judgement P f (exs_postcondition Q (\\<lambda>s f. fst (f s)))\"\n  by (simp add: triple_judgement_def exs_postcondition_def exs_valid_def)\n\nlemmas [wp_trip] = exs_valid_is_triple\n\nlemma exs_valid_weaken_pre [wp_comb]:\n  \"\\<lbrakk> \\<lbrace> P' \\<rbrace> f \\<exists>\\<lbrace> Q \\<rbrace>; \\<And>s. P s \\<Longrightarrow> P' s \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<exists>\\<lbrace> Q \\<rbrace>\"\n  apply atomize\n  apply (clarsimp simp: exs_valid_def)\n  done\n\nlemma exs_valid_chain:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<exists>\\<lbrace> Q \\<rbrace>; \\<And>s. R s \\<Longrightarrow> P s; \\<And>r s. Q r s \\<Longrightarrow> S r s \\<rbrakk> \\<Longrightarrow> \\<lbrace> R \\<rbrace> f \\<exists>\\<lbrace> S \\<rbrace>\"\n  apply atomize\n  apply (fastforce simp: exs_valid_def Bex_def)\n  done\n\nlemma exs_valid_assume_pre:\n  \"\\<lbrakk> \\<And>s. P s \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<exists>\\<lbrace> Q \\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<exists>\\<lbrace> Q \\<rbrace>\"\n  apply (fastforce simp: exs_valid_def)\n  done\n\nlemma exs_valid_bind [wp_split]:\n    \"\\<lbrakk> \\<And>x. \\<lbrace>B x\\<rbrace> g x \\<exists>\\<lbrace>C\\<rbrace>; \\<lbrace>A\\<rbrace> f \\<exists>\\<lbrace>B\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace> A \\<rbrace> f >>= (\\<lambda>x. g x) \\<exists>\\<lbrace> C \\<rbrace>\"\n  apply atomize\n  apply (clarsimp simp: exs_valid_def bind_def')\n  apply blast\n  done\n\nlemma exs_valid_return [wp]:\n    \"\\<lbrace> Q v \\<rbrace> return v \\<exists>\\<lbrace> Q \\<rbrace>\"\n  by (clarsimp simp: exs_valid_def return_def)\n\nlemma exs_valid_select [wp]:\n    \"\\<lbrace> \\<lambda>s. \\<exists>r \\<in> S. Q r s \\<rbrace> select S \\<exists>\\<lbrace> Q \\<rbrace>\"\n  by (clarsimp simp: exs_valid_def select_def)\n\nlemma exs_valid_get [wp]:\n    \"\\<lbrace> \\<lambda>s. Q s s \\<rbrace> get \\<exists>\\<lbrace> Q \\<rbrace>\"\n  by (clarsimp simp: exs_valid_def get_def)\n\nlemma exs_valid_gets [wp]:\n    \"\\<lbrace> \\<lambda>s. Q (f s) s \\<rbrace> gets f \\<exists>\\<lbrace> Q \\<rbrace>\"\n  by (clarsimp simp: gets_def) wp\n\nlemma exs_valid_put [wp]:\n    \"\\<lbrace> Q v \\<rbrace> put v \\<exists>\\<lbrace> Q \\<rbrace>\"\n  by (clarsimp simp: put_def exs_valid_def)\n\nlemma exs_valid_state_assert [wp]:\n    \"\\<lbrace> \\<lambda>s. Q () s \\<and> G s \\<rbrace> state_assert G \\<exists>\\<lbrace> Q \\<rbrace>\"\n  by (clarsimp simp: state_assert_def exs_valid_def get_def\n           assert_def bind_def' return_def)\n\nlemmas exs_valid_guard = exs_valid_state_assert\n\nlemma exs_valid_fail [wp]:\n    \"\\<lbrace> \\<lambda>_. False \\<rbrace> fail \\<exists>\\<lbrace> Q \\<rbrace>\"\n  by (clarsimp simp: fail_def exs_valid_def)\n\nlemma exs_valid_condition [wp]:\n    \"\\<lbrakk> \\<lbrace> P \\<rbrace> L \\<exists>\\<lbrace> Q \\<rbrace>; \\<lbrace> P' \\<rbrace> R \\<exists>\\<lbrace> Q \\<rbrace> \\<rbrakk> \\<Longrightarrow>\n          \\<lbrace> \\<lambda>s. (C s \\<and> P s) \\<or> (\\<not> C s \\<and> P' s) \\<rbrace> condition C L R \\<exists>\\<lbrace> Q \\<rbrace>\"\n  by (clarsimp simp: condition_def exs_valid_def split: sum.splits)\n\n\nsubsection MISC\n\nlemma hoare_return_simp:\n  \"\\<lbrace>P\\<rbrace> return x \\<lbrace>Q\\<rbrace> = (\\<forall>s. P s \\<longrightarrow> Q x s)\"\n  by (simp add: valid_def return_def)\n\nlemma hoare_gen_asm:\n  \"(P \\<Longrightarrow> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>) \\<Longrightarrow> \\<lbrace>P' and K P\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  by (fastforce simp add: valid_def)\n\nlemma hoare_when_wp [wp]:\n \"\\<lbrakk> P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> f \\<lbrace>R\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>if P then Q else R ()\\<rbrace> when P f \\<lbrace>R\\<rbrace>\"\n  by (clarsimp simp: when_def valid_def return_def)\n\nlemma hoare_conjI:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>; \\<lbrace>P\\<rbrace> f \\<lbrace>R\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. Q r s \\<and> R r s\\<rbrace>\"\n  unfolding valid_def by blast\n\nlemma hoare_disjI1:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. Q r s \\<or>  R r s \\<rbrace>\"\n  unfolding valid_def by blast\n\nlemma hoare_disjI2:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>R\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. Q r s \\<or>  R r s \\<rbrace>\"\n  unfolding valid_def by blast\n\nlemma hoare_assume_pre:\n  \"(\\<And>s. P s \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>) \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  by (auto simp: valid_def)\n\nlemma hoare_returnOk_sp:\n  \"\\<lbrace>P\\<rbrace> returnOk x \\<lbrace>\\<lambda>r s. r = x \\<and> P s\\<rbrace>, \\<lbrace>Q\\<rbrace>\"\n  by (simp add: valid_def validE_def returnOk_def return_def)\n\nlemma hoare_assume_preE:\n  \"(\\<And>s. P s \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>R\\<rbrace>) \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>R\\<rbrace>\"\n  by (auto simp: valid_def validE_def)\n\nlemma hoare_allI:\n  \"(\\<And>x. \\<lbrace>P\\<rbrace>f\\<lbrace>Q x\\<rbrace>) \\<Longrightarrow> \\<lbrace>P\\<rbrace>f\\<lbrace>\\<lambda>r s. \\<forall>x. Q x r s\\<rbrace>\"\n  by (simp add: valid_def) blast\n\nlemma validE_allI:\n  \"(\\<And>x. \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. Q x r s\\<rbrace>,\\<lbrace>E\\<rbrace>) \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. \\<forall>x. Q x r s\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (fastforce simp: valid_def validE_def split: sum.splits)\n\nlemma hoare_exI:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q x\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. \\<exists>x. Q x r s\\<rbrace>\"\n  by (simp add: valid_def) blast\n\nlemma hoare_impI:\n  \"(R \\<Longrightarrow> \\<lbrace>P\\<rbrace>f\\<lbrace>Q\\<rbrace>) \\<Longrightarrow> \\<lbrace>P\\<rbrace>f\\<lbrace>\\<lambda>r s. R \\<longrightarrow> Q r s\\<rbrace>\"\n  by (simp add: valid_def) blast\n\nlemma validE_impI:\n  \" \\<lbrakk>\\<And>E. \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>_ _. True\\<rbrace>,\\<lbrace>E\\<rbrace>; (P' \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>)\\<rbrakk> \\<Longrightarrow>\n         \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. P' \\<longrightarrow> Q r s\\<rbrace>, \\<lbrace>E\\<rbrace>\"\n  by (fastforce simp: validE_def valid_def split: sum.splits)\n\nlemma hoare_case_option_wp:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f None \\<lbrace>Q\\<rbrace>;\n     \\<And>x.  \\<lbrace>P' x\\<rbrace> f (Some x) \\<lbrace>Q' x\\<rbrace> \\<rbrakk>\n  \\<Longrightarrow> \\<lbrace>case_option P P' v\\<rbrace> f v \\<lbrace>\\<lambda>rv. case v of None \\<Rightarrow> Q rv | Some x \\<Rightarrow> Q' x rv\\<rbrace>\"\n  by (cases v) auto\n\nsubsection \"Reasoning directly about states\"\n\nlemma in_throwError:\n  \"((v, s') \\<in> fst (throwError e s)) = (v = Inl e \\<and> s' = s)\"\n  by (simp add: throwError_def return_def)\n\nlemma in_returnOk:\n  \"((v', s') \\<in> fst (returnOk v s)) = (v' = Inr v \\<and> s' = s)\"\n  by (simp add: returnOk_def return_def)\n\nlemma in_bind:\n  \"((r,s') \\<in> fst ((do x \\<leftarrow> f; g x od) s)) =\n   (\\<exists>s'' x. (x, s'') \\<in> fst (f s) \\<and> (r, s') \\<in> fst (g x s''))\"\n  apply (simp add: bind_def split_def)\n  apply force\n  done\n\nlemma in_bindE_R:\n  \"((Inr r,s') \\<in> fst ((doE x \\<leftarrow> f; g x odE) s)) =\n  (\\<exists>s'' x. (Inr x, s'') \\<in> fst (f s) \\<and> (Inr r, s') \\<in> fst (g x s''))\"\n  apply (simp add: bindE_def lift_def split_def bind_def)\n  apply (clarsimp simp: throwError_def return_def lift_def split: sum.splits)\n  apply safe\n   apply (case_tac a)\n    apply fastforce\n   apply fastforce\n  apply force\n  done\n\nlemma in_bindE_L:\n  \"((Inl r, s') \\<in> fst ((doE x \\<leftarrow> f; g x odE) s)) \\<Longrightarrow>\n  (\\<exists>s'' x. (Inr x, s'') \\<in> fst (f s) \\<and> (Inl r, s') \\<in> fst (g x s'')) \\<or> ((Inl r, s') \\<in> fst (f s))\"\n  apply (simp add: bindE_def lift_def bind_def)\n  apply safe\n  apply (simp add: return_def throwError_def lift_def split_def split: sum.splits if_split_asm)\n  apply force\n  done\n\nlemma in_liftE:\n  \"((v, s') \\<in> fst (liftE f s)) = (\\<exists>v'. v = Inr v' \\<and> (v', s') \\<in> fst (f s))\"\n  by (force simp add: liftE_def bind_def return_def split_def)\n\nlemma in_whenE:  \"((v, s') \\<in> fst (whenE P f s)) = ((P \\<longrightarrow> (v, s') \\<in> fst (f s)) \\<and>\n                                                   (\\<not>P \\<longrightarrow> v = Inr () \\<and> s' = s))\"\n  by (simp add: whenE_def in_returnOk)\n\nlemma inl_whenE:\n  \"((Inl x, s') \\<in> fst (whenE P f s)) = (P \\<and> (Inl x, s') \\<in> fst (f s))\"\n  by (auto simp add: in_whenE)\n\nlemma in_fail:\n  \"r \\<in> fst (fail s) = False\"\n  by (simp add: fail_def)\n\nlemma in_return:\n  \"(r, s') \\<in> fst (return v s) = (r = v \\<and> s' = s)\"\n  by (simp add: return_def)\n\nlemma in_assert:\n  \"(r, s') \\<in> fst (assert P s) = (P \\<and> s' = s)\"\n  by (simp add: assert_def return_def fail_def)\n\nlemma in_assertE:\n  \"(r, s') \\<in> fst (assertE P s) = (P \\<and> r = Inr () \\<and> s' = s)\"\n  by (simp add: assertE_def returnOk_def return_def fail_def)\n\nlemma in_assert_opt:\n  \"(r, s') \\<in> fst (assert_opt v s) = (v = Some r \\<and> s' = s)\"\n  by (auto simp: assert_opt_def in_fail in_return split: option.splits)\n\nlemma in_get:\n  \"(r, s') \\<in> fst (get s) = (r = s \\<and> s' = s)\"\n  by (simp add: get_def)\n\nlemma in_gets:\n  \"(r, s') \\<in> fst (gets f s) = (r = f s \\<and> s' = s)\"\n  by (simp add: simpler_gets_def)\n\nlemma in_put:\n  \"(r, s') \\<in> fst (put x s) = (s' = x \\<and> r = ())\"\n  by (simp add: put_def)\n\nlemma in_when:\n  \"(v, s') \\<in> fst (when P f s) = ((P \\<longrightarrow> (v, s') \\<in> fst (f s)) \\<and> (\\<not>P \\<longrightarrow> v = () \\<and> s' = s))\"\n  by (simp add: when_def in_return)\n\nlemma in_modify:\n  \"(v, s') \\<in> fst (modify f s) = (s'=f s \\<and> v = ())\"\n  by (simp add: modify_def bind_def get_def put_def)\n\nlemma gets_the_in_monad:\n  \"((v, s') \\<in> fst (gets_the f s)) = (s' = s \\<and> f s = Some v)\"\n  by (auto simp: gets_the_def in_bind in_gets in_assert_opt split: option.split)\n\nlemma in_alternative:\n  \"(r,s') \\<in> fst ((f \\<sqinter> g) s) = ((r,s') \\<in> fst (f s) \\<or> (r,s') \\<in> fst (g s))\"\n  by (simp add: alternative_def)\n\nlemmas in_monad = inl_whenE in_whenE in_liftE in_bind in_bindE_L\n                  in_bindE_R in_returnOk in_throwError in_fail\n                  in_assertE in_assert in_return in_assert_opt\n                  in_get in_gets in_put in_when unlessE_whenE\n                  unless_when in_modify gets_the_in_monad\n                  in_alternative\n\nsubsection \"Non-Failure\"\n\nlemma no_failD:\n  \"\\<lbrakk> no_fail P m; P s \\<rbrakk> \\<Longrightarrow> \\<not>(snd (m s))\"\n  by (simp add: no_fail_def)\n\nlemma non_fail_modify [wp,simp]:\n  \"no_fail \\<top> (modify f)\"\n  by (simp add: no_fail_def modify_def get_def put_def bind_def)\n\nlemma non_fail_gets_simp[simp]:\n  \"no_fail P (gets f)\"\n  unfolding no_fail_def gets_def get_def return_def bind_def\n  by simp\n\nlemma non_fail_gets:\n  \"no_fail \\<top> (gets f)\"\n  by simp\n\nlemma non_fail_select [simp]:\n  \"no_fail \\<top> (select S)\"\n  by (simp add: no_fail_def select_def)\n\nlemma no_fail_pre:\n  \"\\<lbrakk> no_fail P f; \\<And>s. Q s \\<Longrightarrow> P s\\<rbrakk> \\<Longrightarrow> no_fail Q f\"\n  by (simp add: no_fail_def)\n\nlemma no_fail_alt [wp]:\n  \"\\<lbrakk> no_fail P f; no_fail Q g \\<rbrakk> \\<Longrightarrow> no_fail (P and Q) (f OR g)\"\n  by (simp add: no_fail_def alternative_def)\n\nlemma no_fail_return [simp, wp]:\n  \"no_fail \\<top> (return x)\"\n  by (simp add: return_def no_fail_def)\n\nlemma no_fail_get [simp, wp]:\n  \"no_fail \\<top> get\"\n  by (simp add: get_def no_fail_def)\n\nlemma no_fail_put [simp, wp]:\n  \"no_fail \\<top> (put s)\"\n  by (simp add: put_def no_fail_def)\n\nlemma no_fail_when [wp]:\n  \"(P \\<Longrightarrow> no_fail Q f) \\<Longrightarrow> no_fail (if P then Q else \\<top>) (when P f)\"\n  by (simp add: when_def)\n\nlemma no_fail_unless [wp]:\n  \"(\\<not>P \\<Longrightarrow> no_fail Q f) \\<Longrightarrow> no_fail (if P then \\<top> else Q) (unless P f)\"\n  by (simp add: unless_def when_def)\n\nlemma no_fail_fail [simp, wp]:\n  \"no_fail \\<bottom> fail\"\n  by (simp add: fail_def no_fail_def)\n\nlemmas [wp] = non_fail_gets\n\nlemma no_fail_assert [simp, wp]:\n  \"no_fail (\\<lambda>_. P) (assert P)\"\n  by (simp add: assert_def)\n\nlemma no_fail_assert_opt [simp, wp]:\n  \"no_fail (\\<lambda>_. P \\<noteq> None) (assert_opt P)\"\n  by (simp add: assert_opt_def split: option.splits)\n\nlemma no_fail_case_option [wp]:\n  assumes f: \"no_fail P f\"\n  assumes g: \"\\<And>x. no_fail (Q x) (g x)\"\n  shows \"no_fail (if x = None then P else Q (the x)) (case_option f g x)\"\n  by (clarsimp simp add: f g)\n\nlemma no_fail_if [wp]:\n  \"\\<lbrakk> P \\<Longrightarrow> no_fail Q f; \\<not>P \\<Longrightarrow> no_fail R g \\<rbrakk> \\<Longrightarrow>\n  no_fail (if P then Q else R) (if P then f else g)\"\n  by simp\n\nlemma no_fail_apply [wp]:\n  \"no_fail P (f (g x)) \\<Longrightarrow> no_fail P (f $ g x)\"\n  by simp\n\nlemma no_fail_undefined [simp, wp]:\n  \"no_fail \\<bottom> undefined\"\n  by (simp add: no_fail_def)\n\nlemma no_fail_returnOK [simp, wp]:\n  \"no_fail \\<top> (returnOk x)\"\n  by (simp add: returnOk_def)\n\ntext {* Empty results implies non-failure *}\n\nlemma empty_fail_modify [simp]:\n  \"empty_fail (modify f)\"\n  by (simp add: empty_fail_def simpler_modify_def)\n\nlemma empty_fail_gets [simp]:\n  \"empty_fail (gets f)\"\n  by (simp add: empty_fail_def simpler_gets_def)\n\nlemma empty_failD:\n  \"\\<lbrakk> empty_fail m; fst (m s) = {} \\<rbrakk> \\<Longrightarrow> snd (m s)\"\n  by (simp add: empty_fail_def)\n\nlemma empty_fail_select_f [simp]:\n  assumes ef: \"fst S = {} \\<Longrightarrow> snd S\"\n  shows \"empty_fail (select_f S)\"\n  by (fastforce simp add: empty_fail_def select_f_def intro: ef)\n\nlemma empty_fail_bind [simp]:\n  \"\\<lbrakk> empty_fail a; \\<And>x. empty_fail (b x) \\<rbrakk> \\<Longrightarrow> empty_fail (a >>= b)\"\n  apply (simp add: bind_def empty_fail_def split_def)\n  apply clarsimp\n  apply (case_tac \"fst (a s) = {}\")\n   apply blast\n  apply (clarsimp simp: ex_in_conv [symmetric])\n  done\n\nlemma empty_fail_return [simp]:\n  \"empty_fail (return x)\"\n  by (simp add: empty_fail_def return_def)\n\nlemma empty_fail_mapM [simp]:\n  assumes m: \"\\<And>x. empty_fail (m x)\"\n  shows \"empty_fail (mapM m xs)\"\nproof (induct xs)\n  case Nil\n  thus ?case by (simp add: mapM_def sequence_def)\nnext\n  case Cons\n  have P: \"\\<And>m x xs. mapM m (x # xs) = (do y \\<leftarrow> m x; ys \\<leftarrow> (mapM m xs); return (y # ys) od)\"\n    by (simp add: mapM_def sequence_def Let_def)\n  from Cons\n  show ?case by (simp add: P m)\nqed\n\nlemma empty_fail [simp]:\n  \"empty_fail fail\"\n  by (simp add: fail_def empty_fail_def)\n\nlemma empty_fail_assert_opt [simp]:\n  \"empty_fail (assert_opt x)\"\n  by (simp add: assert_opt_def split: option.splits)\n\nlemma empty_fail_mk_ef:\n  \"empty_fail (mk_ef o m)\"\n  by (simp add: empty_fail_def mk_ef_def)\n\nsubsection \"Failure\"\n\nlemma fail_wp: \"\\<lbrace>\\<lambda>x. True\\<rbrace> fail \\<lbrace>Q\\<rbrace>\"\n  by (simp add: valid_def fail_def)\n\nlemma failE_wp: \"\\<lbrace>\\<lambda>x. True\\<rbrace> fail \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (simp add: validE_def fail_wp)\n\nlemma fail_update [iff]:\n  \"fail (f s) = fail s\"\n  by (simp add: fail_def)\n\n\ntext {* We can prove postconditions using hoare triples *}\n\nlemma post_by_hoare: \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>; P s; (r, s') \\<in> fst (f s) \\<rbrakk> \\<Longrightarrow> Q r s'\"\n  apply (simp add: valid_def)\n  apply blast\n  done\n\ntext {* Weakest Precondition Rules *}\n\nlemma hoare_vcg_prop:\n  \"\\<lbrace>\\<lambda>s. P\\<rbrace> f \\<lbrace>\\<lambda>rv s. P\\<rbrace>\"\n  by (simp add: valid_def)\n\nlemma return_wp:\n  \"\\<lbrace>P x\\<rbrace> return x \\<lbrace>P\\<rbrace>\"\n  by(simp add:valid_def return_def)\n\nlemma get_wp:\n  \"\\<lbrace>\\<lambda>s. P s s\\<rbrace> get \\<lbrace>P\\<rbrace>\"\n  by(simp add:valid_def split_def get_def)\n\nlemma gets_wp:\n  \"\\<lbrace>\\<lambda>s. P (f s) s\\<rbrace> gets f \\<lbrace>P\\<rbrace>\"\n  by(simp add:valid_def split_def gets_def return_def get_def bind_def)\n\nlemma modify_wp:\n  \"\\<lbrace>\\<lambda>s. P () (f s)\\<rbrace> modify f \\<lbrace>P\\<rbrace>\"\n  by(simp add:valid_def split_def modify_def get_def put_def bind_def)\n\nlemma put_wp:\n \"\\<lbrace>\\<lambda>s. P () x\\<rbrace> put x \\<lbrace>P\\<rbrace>\"\n by(simp add:valid_def put_def)\n\nlemma returnOk_wp:\n  \"\\<lbrace>P x\\<rbrace> returnOk x \\<lbrace>P\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n by(simp add:validE_def2 returnOk_def return_def)\n\nlemma throwError_wp:\n  \"\\<lbrace>E e\\<rbrace> throwError e \\<lbrace>P\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by(simp add:validE_def2 throwError_def return_def)\n\nlemma returnOKE_R_wp : \"\\<lbrace>P x\\<rbrace> returnOk x \\<lbrace>P\\<rbrace>, -\"\n  by (simp add: validE_R_def validE_def valid_def returnOk_def return_def)\n\nlemma liftE_wp:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> liftE f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by(clarsimp simp:valid_def validE_def2 liftE_def split_def Let_def bind_def return_def)\n\nlemma catch_wp:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>E x\\<rbrace> handler x \\<lbrace>Q\\<rbrace>; \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>P\\<rbrace> catch f handler \\<lbrace>Q\\<rbrace>\"\n apply (unfold catch_def valid_def validE_def return_def)\n apply (fastforce simp: bind_def split: sum.splits)\n done\n\nlemma handleE'_wp:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>F x\\<rbrace> handler x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>; \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>F\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>P\\<rbrace> f <handle2> handler \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n apply (unfold handleE'_def valid_def validE_def return_def)\n apply (fastforce simp: bind_def split: sum.splits)\n done\n\nlemma handleE_wp:\n  assumes x: \"\\<And>x. \\<lbrace>F x\\<rbrace> handler x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  assumes y: \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>F\\<rbrace>\"\n  shows      \"\\<lbrace>P\\<rbrace> f <handle> handler \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (simp add: handleE_def handleE'_wp [OF x y])\n\nlemma hoare_vcg_split_if:\n \"\\<lbrakk> P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> f \\<lbrace>S\\<rbrace>; \\<not>P \\<Longrightarrow> \\<lbrace>R\\<rbrace> g \\<lbrace>S\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n  \\<lbrace>\\<lambda>s. (P \\<longrightarrow> Q s) \\<and> (\\<not>P \\<longrightarrow> R s)\\<rbrace> if P then f else g \\<lbrace>S\\<rbrace>\"\n  by simp\n\nlemma hoare_vcg_split_ifE:\n \"\\<lbrakk> P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> f \\<lbrace>S\\<rbrace>,\\<lbrace>E\\<rbrace>; \\<not>P \\<Longrightarrow> \\<lbrace>R\\<rbrace> g \\<lbrace>S\\<rbrace>,\\<lbrace>E\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n  \\<lbrace>\\<lambda>s. (P \\<longrightarrow> Q s) \\<and> (\\<not>P \\<longrightarrow> R s)\\<rbrace> if P then f else g \\<lbrace>S\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by simp\n\nlemma hoare_liftM_subst: \"\\<lbrace>P\\<rbrace> liftM f m \\<lbrace>Q\\<rbrace> = \\<lbrace>P\\<rbrace> m \\<lbrace>Q \\<circ> f\\<rbrace>\"\n  apply (simp add: liftM_def bind_def return_def split_def)\n  apply (simp add: valid_def Ball_def)\n  apply (rule_tac f=All in arg_cong)\n  apply (rule ext)\n  apply fastforce\n  done\n\nlemma liftE_validE[simp]: \"\\<lbrace>P\\<rbrace> liftE f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace> = \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  apply (simp add: liftE_liftM validE_def hoare_liftM_subst o_def)\n  done\n\nlemma liftM_wp: \"\\<lbrace>P\\<rbrace> m \\<lbrace>Q \\<circ> f\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> liftM f m \\<lbrace>Q\\<rbrace>\"\n  by (simp add: hoare_liftM_subst)\n\nlemma hoare_liftME_subst: \"\\<lbrace>P\\<rbrace> liftME f m \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace> = \\<lbrace>P\\<rbrace> m \\<lbrace>Q \\<circ> f\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  apply (simp add: validE_def liftME_liftM hoare_liftM_subst o_def)\n  apply (rule_tac f=\"valid P m\" in arg_cong)\n  apply (rule ext)+\n  apply (case_tac x, simp_all)\n  done\n\nlemma liftME_wp: \"\\<lbrace>P\\<rbrace> m \\<lbrace>Q \\<circ> f\\<rbrace>,\\<lbrace>E\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> liftME f m \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (simp add: hoare_liftME_subst)\n\n(* FIXME: Move *)\nlemma o_const_simp[simp]: \"(\\<lambda>x. C) \\<circ> f = (\\<lambda>x. C)\"\n  by (simp add: o_def)\n\nlemma hoare_vcg_split_case_option:\n \"\\<lbrakk> \\<And>x. x = None \\<Longrightarrow> \\<lbrace>P x\\<rbrace> f x \\<lbrace>R x\\<rbrace>;\n    \\<And>x y. x = Some y \\<Longrightarrow> \\<lbrace>Q x y\\<rbrace> g x y \\<lbrace>R x\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n  \\<lbrace>\\<lambda>s. (x = None \\<longrightarrow> P x s) \\<and>\n       (\\<forall>y. x = Some y \\<longrightarrow> Q x y s)\\<rbrace>\n  case x of None \\<Rightarrow> f x\n          | Some y \\<Rightarrow> g x y\n  \\<lbrace>R x\\<rbrace>\"\n apply(simp add:valid_def split_def)\n apply(case_tac x, simp_all)\ndone\n\nlemma hoare_vcg_split_case_optionE:\n assumes none_case: \"\\<And>x. x = None \\<Longrightarrow> \\<lbrace>P x\\<rbrace> f x \\<lbrace>R x\\<rbrace>,\\<lbrace>E x\\<rbrace>\"\n assumes some_case: \"\\<And>x y. x = Some y \\<Longrightarrow> \\<lbrace>Q x y\\<rbrace> g x y \\<lbrace>R x\\<rbrace>,\\<lbrace>E x\\<rbrace>\"\n shows \"\\<lbrace>\\<lambda>s. (x = None \\<longrightarrow> P x s) \\<and>\n             (\\<forall>y. x = Some y \\<longrightarrow> Q x y s)\\<rbrace>\n        case x of None \\<Rightarrow> f x\n                | Some y \\<Rightarrow> g x y\n        \\<lbrace>R x\\<rbrace>,\\<lbrace>E x\\<rbrace>\"\n apply(case_tac x, simp_all)\n  apply(rule none_case, simp)\n apply(rule some_case, simp)\ndone\n\nlemma hoare_vcg_split_case_sum:\n \"\\<lbrakk> \\<And>x a. x = Inl a \\<Longrightarrow> \\<lbrace>P x a\\<rbrace> f x a \\<lbrace>R x\\<rbrace>;\n    \\<And>x b. x = Inr b \\<Longrightarrow> \\<lbrace>Q x b\\<rbrace> g x b \\<lbrace>R x\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n  \\<lbrace>\\<lambda>s. (\\<forall>a. x = Inl a \\<longrightarrow> P x a s) \\<and>\n       (\\<forall>b. x = Inr b \\<longrightarrow> Q x b s) \\<rbrace>\n  case x of Inl a \\<Rightarrow> f x a\n          | Inr b \\<Rightarrow> g x b\n  \\<lbrace>R x\\<rbrace>\"\n apply(simp add:valid_def split_def)\n apply(case_tac x, simp_all)\ndone\n\nlemma hoare_vcg_split_case_sumE:\n  assumes left_case: \"\\<And>x a. x = Inl a \\<Longrightarrow> \\<lbrace>P x a\\<rbrace> f x a \\<lbrace>R x\\<rbrace>\"\n  assumes right_case: \"\\<And>x b. x = Inr b \\<Longrightarrow> \\<lbrace>Q x b\\<rbrace> g x b \\<lbrace>R x\\<rbrace>\"\n  shows \"\\<lbrace>\\<lambda>s. (\\<forall>a. x = Inl a \\<longrightarrow> P x a s) \\<and>\n              (\\<forall>b. x = Inr b \\<longrightarrow> Q x b s) \\<rbrace>\n         case x of Inl a \\<Rightarrow> f x a\n                 | Inr b \\<Rightarrow> g x b\n         \\<lbrace>R x\\<rbrace>\"\n apply(case_tac x, simp_all)\n  apply(rule left_case, simp)\n apply(rule right_case, simp)\ndone\n\nlemma hoare_vcg_precond_imp:\n \"\\<lbrakk> \\<lbrace>Q\\<rbrace> f \\<lbrace>R\\<rbrace>; \\<And>s. P s \\<Longrightarrow> Q s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>R\\<rbrace>\"\n  by (fastforce simp add:valid_def)\n\nlemma hoare_vcg_precond_impE:\n \"\\<lbrakk> \\<lbrace>Q\\<rbrace> f \\<lbrace>R\\<rbrace>,\\<lbrace>E\\<rbrace>; \\<And>s. P s \\<Longrightarrow> Q s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>R\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (fastforce simp add:validE_def2)\n\nlemma hoare_seq_ext:\n  assumes g_valid: \"\\<And>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>\"\n  assumes f_valid: \"\\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>\"\n  shows \"\\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>C\\<rbrace>\"\n apply(insert f_valid g_valid)\n apply(blast intro: seq_ext')\ndone\n\nlemma hoare_vcg_seqE:\n  assumes g_valid: \"\\<And>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  assumes f_valid: \"\\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  shows \"\\<lbrace>A\\<rbrace> doE x \\<leftarrow> f; g x odE \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n apply(insert f_valid g_valid)\n apply(blast intro: seqE')\ndone\n\nlemma hoare_seq_ext_nobind:\n  \"\\<lbrakk> \\<lbrace>B\\<rbrace> g \\<lbrace>C\\<rbrace>;\n     \\<lbrace>A\\<rbrace> f \\<lbrace>\\<lambda>r s. B s\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>A\\<rbrace> do f; g od \\<lbrace>C\\<rbrace>\"\n  apply (clarsimp simp: valid_def bind_def Let_def split_def)\n  apply fastforce\ndone\n\nlemma hoare_seq_ext_nobindE:\n  \"\\<lbrakk> \\<lbrace>B\\<rbrace> g \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>;\n     \\<lbrace>A\\<rbrace> f \\<lbrace>\\<lambda>r s. B s\\<rbrace>,\\<lbrace>E\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>A\\<rbrace> doE f; g odE \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  apply (clarsimp simp:validE_def)\n  apply (simp add:bindE_def Let_def split_def bind_def lift_def)\n  apply (fastforce simp add: valid_def throwError_def return_def lift_def\n                  split: sum.splits)\n  done\n\nlemma hoare_chain:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>;\n    \\<And>s. R s \\<Longrightarrow> P s;\n    \\<And>r s. Q r s \\<Longrightarrow> S r s \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>R\\<rbrace> f \\<lbrace>S\\<rbrace>\"\n  by(fastforce simp add:valid_def split_def)\n\nlemma validE_weaken:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> A \\<lbrace>Q'\\<rbrace>,\\<lbrace>E'\\<rbrace>; \\<And>s. P s \\<Longrightarrow> P' s; \\<And>r s. Q' r s \\<Longrightarrow> Q r s; \\<And>r s. E' r s \\<Longrightarrow> E r s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> A \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (fastforce simp: validE_def2 split: sum.splits)\n\nlemmas hoare_chainE = validE_weaken\n\nlemma hoare_vcg_handle_elseE:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>;\n     \\<And>e. \\<lbrace>E e\\<rbrace> g e \\<lbrace>R\\<rbrace>,\\<lbrace>F\\<rbrace>;\n     \\<And>x. \\<lbrace>Q x\\<rbrace> h x \\<lbrace>R\\<rbrace>,\\<lbrace>F\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>P\\<rbrace> f <handle> g <else> h \\<lbrace>R\\<rbrace>,\\<lbrace>F\\<rbrace>\"\n  apply (simp add: handle_elseE_def validE_def)\n  apply (rule seq_ext)\n   apply assumption\n  apply (case_tac x, simp_all)\n  done\n\nlemma alternative_valid:\n  assumes x: \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  assumes y: \"\\<lbrace>P\\<rbrace> f' \\<lbrace>Q\\<rbrace>\"\n  shows      \"\\<lbrace>P\\<rbrace> f OR f' \\<lbrace>Q\\<rbrace>\"\n  apply (simp add: valid_def alternative_def)\n  apply safe\n   apply (simp add: post_by_hoare [OF x])\n  apply (simp add: post_by_hoare [OF y])\n  done\n\nlemma alternative_wp:\n  assumes x: \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  assumes y: \"\\<lbrace>P'\\<rbrace> f' \\<lbrace>Q\\<rbrace>\"\n  shows      \"\\<lbrace>P and P'\\<rbrace> f OR f' \\<lbrace>Q\\<rbrace>\"\n  apply (rule alternative_valid)\n   apply (rule hoare_pre_imp [OF _ x], simp)\n  apply (rule hoare_pre_imp [OF _ y], simp)\n  done\n\nlemma alternativeE_wp:\n  assumes x: \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\" and y: \"\\<lbrace>P'\\<rbrace> f' \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  shows      \"\\<lbrace>P and P'\\<rbrace> f OR f' \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  apply (unfold validE_def)\n  apply (wp add: x y alternative_wp | simp | fold validE_def)+\n  done\n\nlemma alternativeE_R_wp:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,-; \\<lbrace>P'\\<rbrace> f' \\<lbrace>Q\\<rbrace>,- \\<rbrakk> \\<Longrightarrow> \\<lbrace>P and P'\\<rbrace> f OR f' \\<lbrace>Q\\<rbrace>,-\"\n  apply (simp add: validE_R_def)\n  apply (rule alternativeE_wp)\n   apply assumption+\n  done\n\nlemma alternative_R_wp:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f -,\\<lbrace>Q\\<rbrace>; \\<lbrace>P'\\<rbrace> g -,\\<lbrace>Q\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P and P'\\<rbrace> f \\<sqinter> g -, \\<lbrace>Q\\<rbrace>\"\n  by (fastforce simp: alternative_def validE_E_def validE_def valid_def)\n\nlemma select_wp: \"\\<lbrace>\\<lambda>s. \\<forall>x \\<in> S. Q x s\\<rbrace> select S \\<lbrace>Q\\<rbrace>\"\n  by (simp add: select_def valid_def)\n\nlemma select_f_wp:\n  \"\\<lbrace>\\<lambda>s. \\<forall>x\\<in>fst S. Q x s\\<rbrace> select_f S \\<lbrace>Q\\<rbrace>\"\n  by (simp add: select_f_def valid_def)\n\nlemma state_select_wp [wp]: \"\\<lbrace> \\<lambda>s. \\<forall>t. (s, t) \\<in> f \\<longrightarrow> P () t \\<rbrace> state_select f \\<lbrace> P \\<rbrace>\"\n  apply (clarsimp simp: state_select_def)\n  apply (clarsimp simp: valid_def)\n  done\n\nlemma condition_wp [wp]:\n  \"\\<lbrakk> \\<lbrace> Q \\<rbrace> A \\<lbrace> P \\<rbrace>;  \\<lbrace> R \\<rbrace> B \\<lbrace> P \\<rbrace>  \\<rbrakk> \\<Longrightarrow> \\<lbrace> \\<lambda>s. if C s then Q s else R s \\<rbrace> condition C A B \\<lbrace> P \\<rbrace>\"\n  apply (clarsimp simp: condition_def)\n  apply (clarsimp simp: valid_def pred_conj_def pred_neg_def split_def)\n  done\n\nlemma conditionE_wp [wp]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> A \\<lbrace> Q \\<rbrace>,\\<lbrace> R \\<rbrace>; \\<lbrace> P' \\<rbrace> B \\<lbrace> Q \\<rbrace>,\\<lbrace> R \\<rbrace> \\<rbrakk> \\<Longrightarrow>  \\<lbrace> \\<lambda>s. if C s then P s else P' s \\<rbrace> condition C A B \\<lbrace>Q\\<rbrace>,\\<lbrace>R\\<rbrace>\"\n  apply (clarsimp simp: condition_def)\n  apply (clarsimp simp: validE_def valid_def)\n  done\n\nlemma state_assert_wp [wp]: \"\\<lbrace> \\<lambda>s. f s \\<longrightarrow> P () s \\<rbrace> state_assert f \\<lbrace> P \\<rbrace>\"\n  apply (clarsimp simp: state_assert_def get_def\n    assert_def bind_def valid_def return_def fail_def)\n  done\n\ntext {* The weakest precondition handler which works on conjunction *}\n\nlemma hoare_vcg_conj_lift:\n  assumes x: \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  assumes y: \"\\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>\"\n  shows      \"\\<lbrace>\\<lambda>s. P s \\<and> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>\"\n  apply (subst bipred_conj_def[symmetric], rule hoare_post_conj)\n   apply (rule hoare_pre_imp [OF _ x], simp)\n  apply (rule hoare_pre_imp [OF _ y], simp)\n  done\n\nlemma hoare_vcg_conj_liftE1:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,-; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>,\\<lbrace>E\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n  \\<lbrace>P and P'\\<rbrace> f \\<lbrace>\\<lambda>r s. Q r s \\<and> Q' r s\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  unfolding valid_def validE_R_def validE_def\n  apply (clarsimp simp: split_def split: sum.splits)\n  apply (erule allE, erule (1) impE)\n  apply (erule allE, erule (1) impE)\n  apply (drule (1) bspec)\n  apply (drule (1) bspec)\n  apply clarsimp\n  done\n\nlemma hoare_vcg_disj_lift:\n  assumes x: \"\\<lbrace>P\\<rbrace>  f \\<lbrace>Q\\<rbrace>\"\n  assumes y: \"\\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>\"\n  shows      \"\\<lbrace>\\<lambda>s. P s \\<or> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<or> Q' rv s\\<rbrace>\"\n  apply (simp add: valid_def)\n  apply safe\n   apply (erule(1) post_by_hoare [OF x])\n  apply (erule notE)\n  apply (erule(1) post_by_hoare [OF y])\n  done\n\nlemma hoare_vcg_const_Ball_lift:\n  \"\\<lbrakk> \\<And>x. x \\<in> S \\<Longrightarrow> \\<lbrace>P x\\<rbrace> f \\<lbrace>Q x\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. \\<forall>x\\<in>S. P x s\\<rbrace> f \\<lbrace>\\<lambda>rv s. \\<forall>x\\<in>S. Q x rv s\\<rbrace>\"\n  by (fastforce simp: valid_def)\n\nlemma hoare_vcg_const_Ball_lift_R:\n \"\\<lbrakk> \\<And>x. x \\<in> S \\<Longrightarrow> \\<lbrace>P x\\<rbrace> f \\<lbrace>Q x\\<rbrace>,- \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. \\<forall>x \\<in> S. P x s\\<rbrace> f \\<lbrace>\\<lambda>rv s. \\<forall>x \\<in> S. Q x rv s\\<rbrace>,-\"\n  apply (simp add: validE_R_def validE_def)\n  apply (rule hoare_strengthen_post)\n   apply (erule hoare_vcg_const_Ball_lift)\n  apply (simp split: sum.splits)\n  done\n\nlemma hoare_vcg_all_lift:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>P x\\<rbrace> f \\<lbrace>Q x\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. \\<forall>x. P x s\\<rbrace> f \\<lbrace>\\<lambda>rv s. \\<forall>x. Q x rv s\\<rbrace>\"\n  by (fastforce simp: valid_def)\n\nlemma hoare_vcg_all_lift_R: \n  \"(\\<And>x. \\<lbrace>P x\\<rbrace> f \\<lbrace>Q x\\<rbrace>, -) \\<Longrightarrow> \\<lbrace>\\<lambda>s. \\<forall>x. P x s\\<rbrace> f \\<lbrace>\\<lambda>rv s. \\<forall>x. Q x rv s\\<rbrace>, -\"\n  by (rule hoare_vcg_const_Ball_lift_R[where S=UNIV, simplified])\n\nlemma hoare_vcg_const_imp_lift:\n  \"\\<lbrakk> P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> m \\<lbrace>R\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. P \\<longrightarrow> Q s\\<rbrace> m \\<lbrace>\\<lambda>rv s. P \\<longrightarrow> R rv s\\<rbrace>\"\n  by (cases P, simp_all add: hoare_vcg_prop)\n\nlemma hoare_vcg_const_imp_lift_R:\n  \"(P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> m \\<lbrace>R\\<rbrace>,-) \\<Longrightarrow> \\<lbrace>\\<lambda>s. P \\<longrightarrow> Q s\\<rbrace> m \\<lbrace>\\<lambda>rv s. P \\<longrightarrow> R rv s\\<rbrace>,-\"\n  by (fastforce simp: validE_R_def validE_def valid_def split_def split: sum.splits)\n\nlemma hoare_weak_lift_imp:\n  \"\\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P \\<longrightarrow> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. P \\<longrightarrow> Q rv s\\<rbrace>\"\n  by (auto simp add: valid_def split_def)\n\nlemma hoare_vcg_ex_lift:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>P x\\<rbrace> f \\<lbrace>Q x\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. \\<exists>x. P x s\\<rbrace> f \\<lbrace>\\<lambda>rv s. \\<exists>x. Q x rv s\\<rbrace>\"\n  by (clarsimp simp: valid_def, blast)\n\nlemma hoare_vcg_ex_lift_R1:\n  \"(\\<And>x. \\<lbrace>P x\\<rbrace> f \\<lbrace>Q\\<rbrace>, -) \\<Longrightarrow> \\<lbrace>\\<lambda>s. \\<exists>x. P x s\\<rbrace> f \\<lbrace>Q\\<rbrace>, -\"\n  by (fastforce simp: valid_def validE_R_def validE_def split: sum.splits)\n\n(* for instantiations *)\nlemma hoare_triv:    \"\\<lbrace>P\\<rbrace>f\\<lbrace>Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace>f\\<lbrace>Q\\<rbrace>\" .\nlemma hoare_trivE:   \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\" .\nlemma hoare_trivE_R: \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,- \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,-\" .\nlemma hoare_trivR_R: \"\\<lbrace>P\\<rbrace> f -,\\<lbrace>E\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f -,\\<lbrace>E\\<rbrace>\" .\n\nlemma hoare_weaken_preE_E:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f -,\\<lbrace>Q\\<rbrace>; \\<And>s. P s \\<Longrightarrow> P' s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f -,\\<lbrace>Q\\<rbrace>\"\n  by (fastforce simp add: validE_E_def validE_def valid_def)\n\nlemma hoare_vcg_E_conj:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f -,\\<lbrace>E\\<rbrace>; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>,\\<lbrace>E'\\<rbrace> \\<rbrakk>\n    \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s\\<rbrace> f \\<lbrace>Q'\\<rbrace>, \\<lbrace>\\<lambda>rv s. E rv s \\<and> E' rv s\\<rbrace>\"\n  apply (unfold validE_def validE_E_def)\n  apply (rule hoare_post_imp [OF _ hoare_vcg_conj_lift], simp_all)\n  apply (case_tac r, simp_all)\n  done\n\nlemma hoare_vcg_E_elim:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f -,\\<lbrace>E\\<rbrace>; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>,- \\<rbrakk>\n    \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (rule hoare_post_impErr [OF hoare_vcg_E_conj],\n      (simp add: validE_R_def)+)\n\nlemma hoare_vcg_R_conj:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,-; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>,- \\<rbrakk>\n    \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>,-\"\n  apply (unfold validE_R_def validE_def)\n  apply (rule hoare_post_imp [OF _ hoare_vcg_conj_lift], simp_all)\n  apply (case_tac r, simp_all)\n  done\n\nlemma valid_validE:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q\\<rbrace>,\\<lbrace>\\<lambda>rv. Q\\<rbrace>\"\n  apply (simp add: validE_def)\n  done\n\nlemma valid_validE2:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>_. Q'\\<rbrace>; \\<And>s. Q' s \\<Longrightarrow> Q s; \\<And>s. Q' s \\<Longrightarrow> E s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>_. Q\\<rbrace>,\\<lbrace>\\<lambda>_. E\\<rbrace>\"\n  unfolding valid_def validE_def\n  by (clarsimp split: sum.splits) blast\n\nlemma validE_valid: \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q\\<rbrace>,\\<lbrace>\\<lambda>rv. Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q\\<rbrace>\"\n  apply (unfold validE_def)\n  apply (rule hoare_post_imp)\n   defer\n   apply assumption\n  apply (case_tac r, simp_all)\n  done\n\nlemma valid_validE_R:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q\\<rbrace>,-\"\n  by (simp add: validE_R_def hoare_post_impErr [OF valid_validE])\n\nlemma valid_validE_E:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv. Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f -,\\<lbrace>\\<lambda>rv. Q\\<rbrace>\"\n  by (simp add: validE_E_def hoare_post_impErr [OF valid_validE])\n\nlemma validE_validE_R: \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>\\<top>\\<top>\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,-\"\n  by (simp add: validE_R_def)\n\nlemma validE_R_validE: \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,- \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>\\<top>\\<top>\\<rbrace>\"\n  by (simp add: validE_R_def)\n\nlemma hoare_post_imp_R: \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>,-; \\<And>r s. Q' r s \\<Longrightarrow> Q r s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,-\"\n  apply (unfold validE_R_def)\n  apply (rule hoare_post_impErr, simp+)\n  done\n\nlemma hoare_post_comb_imp_conj:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>; \\<And>s. P s \\<Longrightarrow> P' s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>\"\n  apply (rule hoare_pre_imp)\n   defer\n   apply (rule hoare_vcg_conj_lift)\n    apply assumption+\n  apply simp\n  done\n\nlemma hoare_vcg_precond_impE_R: \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>,-; \\<And>s. P s \\<Longrightarrow> P' s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,-\"\n  by (unfold validE_R_def, rule hoare_vcg_precond_impE, simp+)\n\nlemma valid_is_triple:\n  \"valid P f Q = triple_judgement P f (postcondition Q (\\<lambda>s f. fst (f s)))\"\n  by (simp add: triple_judgement_def valid_def postcondition_def)\n\nlemma validE_is_triple:\n  \"validE P f Q E = triple_judgement P f\n    (postconditions (postcondition Q (\\<lambda>s f. {(rv, s'). (Inr rv, s') \\<in> fst (f s)}))\n          (postcondition E (\\<lambda>s f. {(rv, s'). (Inl rv, s') \\<in> fst (f s)})))\"\n  apply (simp add: validE_def triple_judgement_def valid_def postcondition_def\n                   postconditions_def split_def split: sum.split)\n  apply fastforce\n  done\n\nlemma validE_R_is_triple:\n  \"validE_R P f Q = triple_judgement P f\n     (postcondition Q (\\<lambda>s f. {(rv, s'). (Inr rv, s') \\<in> fst (f s)}))\"\n  by (simp add: validE_R_def validE_is_triple postconditions_def postcondition_def)\n\nlemma validE_E_is_triple:\n  \"validE_E P f E = triple_judgement P f\n     (postcondition E (\\<lambda>s f. {(rv, s'). (Inl rv, s') \\<in> fst (f s)}))\"\n  by (simp add: validE_E_def validE_is_triple postconditions_def postcondition_def)\n\nlemmas hoare_wp_combs =\n  hoare_post_comb_imp_conj hoare_vcg_precond_imp hoare_vcg_conj_lift\n\nlemmas hoare_wp_combsE =\n  hoare_vcg_precond_impE\n  hoare_vcg_precond_impE_R\n  validE_validE_R\n  hoare_vcg_R_conj\n  hoare_vcg_E_elim\n  hoare_vcg_E_conj\n\nlemmas hoare_wp_state_combsE =\n  hoare_vcg_precond_impE[OF valid_validE]\n  hoare_vcg_precond_impE_R[OF valid_validE_R]\n  valid_validE_R\n  hoare_vcg_R_conj[OF valid_validE_R]\n  hoare_vcg_E_elim[OF valid_validE_E]\n  hoare_vcg_E_conj[OF valid_validE_E]\n\nlemmas hoare_wp_splits [wp_split] =\n  hoare_seq_ext hoare_vcg_seqE handleE'_wp handleE_wp\n  validE_validE_R [OF hoare_vcg_seqE [OF validE_R_validE]]\n  validE_validE_R [OF handleE'_wp [OF validE_R_validE]]\n  validE_validE_R [OF handleE_wp [OF validE_R_validE]]\n  catch_wp hoare_vcg_split_if hoare_vcg_split_ifE\n  validE_validE_R [OF hoare_vcg_split_ifE [OF validE_R_validE validE_R_validE]]\n  liftM_wp liftME_wp\n  validE_validE_R [OF liftME_wp [OF validE_R_validE]]\n  validE_valid\n\nlemmas [wp_comb] = hoare_wp_state_combsE hoare_wp_combsE  hoare_wp_combs\n\nlemmas [wp] = hoare_vcg_prop\n              wp_post_taut\n              return_wp\n              put_wp\n              get_wp\n              gets_wp\n              modify_wp\n              returnOk_wp\n              throwError_wp\n              fail_wp\n              failE_wp\n              liftE_wp\n              select_f_wp\n\nlemmas [wp_trip] = valid_is_triple validE_is_triple validE_E_is_triple validE_R_is_triple\n\n\ntext {* Simplifications on conjunction *}\n\nlemma hoare_post_eq: \"\\<lbrakk> Q = Q'; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  by simp\nlemma hoare_post_eqE1: \"\\<lbrakk> Q = Q'; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>,\\<lbrace>E\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by simp\nlemma hoare_post_eqE2: \"\\<lbrakk> E = E'; \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E'\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by simp\nlemma hoare_post_eqE_R: \"\\<lbrakk> Q = Q'; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>,- \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,-\"\n  by simp\n\nlemma pred_conj_apply_elim: \"(\\<lambda>r. Q r and Q' r) = (\\<lambda>r s. Q r s \\<and> Q' r s)\"\n  by (simp add: pred_conj_def)\nlemma pred_conj_conj_elim: \"(\\<lambda>r s. (Q r and Q' r) s \\<and> Q'' r s) = (\\<lambda>r s. Q r s \\<and> Q' r s \\<and> Q'' r s)\"\n  by simp\nlemma conj_assoc_apply: \"(\\<lambda>r s. (Q r s \\<and> Q' r s) \\<and> Q'' r s) = (\\<lambda>r s. Q r s \\<and> Q' r s \\<and> Q'' r s)\"\n  by simp\nlemma all_elim: \"(\\<lambda>rv s. \\<forall>x. P rv s) = P\"\n  by simp\nlemma all_conj_elim: \"(\\<lambda>rv s. (\\<forall>x. P rv s) \\<and> Q rv s) = (\\<lambda>rv s. P rv s \\<and> Q rv s)\"\n  by simp\n\nlemmas vcg_rhs_simps = pred_conj_apply_elim pred_conj_conj_elim\n          conj_assoc_apply all_elim all_conj_elim\n\nlemma if_apply_reduct: \"\\<lbrace>P\\<rbrace> If P' (f x) (g x) \\<lbrace>Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> If P' f g x \\<lbrace>Q\\<rbrace>\"\n  by (cases P', simp_all)\nlemma if_apply_reductE: \"\\<lbrace>P\\<rbrace> If P' (f x) (g x) \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> If P' f g x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (cases P', simp_all)\nlemma if_apply_reductE_R: \"\\<lbrace>P\\<rbrace> If P' (f x) (g x) \\<lbrace>Q\\<rbrace>,- \\<Longrightarrow> \\<lbrace>P\\<rbrace> If P' f g x \\<lbrace>Q\\<rbrace>,-\"\n  by (cases P', simp_all)\n\nlemmas hoare_wp_simps [wp_split] =\n  vcg_rhs_simps [THEN hoare_post_eq] vcg_rhs_simps [THEN hoare_post_eqE1]\n  vcg_rhs_simps [THEN hoare_post_eqE2] vcg_rhs_simps [THEN hoare_post_eqE_R]\n  if_apply_reduct if_apply_reductE if_apply_reductE_R TrueI\n\nschematic_goal if_apply_test: \"\\<lbrace>?Q\\<rbrace> (if A then returnOk else K fail) x \\<lbrace>P\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by wpsimp\n\nlemma hoare_elim_pred_conj:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. Q r s \\<and> Q' r s\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r. Q r and Q' r\\<rbrace>\"\n  by (unfold pred_conj_def)\n\nlemma hoare_elim_pred_conjE1:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. Q r s \\<and> Q' r s\\<rbrace>,\\<lbrace>E\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r. Q r and Q' r\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (unfold pred_conj_def)\n\nlemma hoare_elim_pred_conjE2:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>\\<lambda>x s. E x s \\<and> E' x s\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>\\<lambda>x. E x and E' x\\<rbrace>\"\n  by (unfold pred_conj_def)\n\nlemma hoare_elim_pred_conjE_R:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. Q r s \\<and> Q' r s\\<rbrace>,- \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r. Q r and Q' r\\<rbrace>,-\"\n  by (unfold pred_conj_def)\n\nlemmas hoare_wp_pred_conj_elims =\n  hoare_elim_pred_conj hoare_elim_pred_conjE1\n  hoare_elim_pred_conjE2 hoare_elim_pred_conjE_R\n\nlemmas hoare_weaken_preE = hoare_vcg_precond_impE\n\nlemmas hoare_pre [wp_pre] =\n  hoare_weaken_pre\n  hoare_weaken_preE\n  hoare_vcg_precond_impE_R\n  hoare_weaken_preE_E\n\ndeclare no_fail_pre [wp_pre]\n\nbundle no_pre = hoare_pre [wp_pre del] no_fail_pre [wp_pre del]\n\ntext {* Miscellaneous lemmas on hoare triples *}\n\nlemma hoare_vcg_mp:\n  assumes a: \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  assumes b: \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. Q r s \\<longrightarrow> Q' r s\\<rbrace>\"\n  shows \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>\"\n  using assms\n  by (auto simp: valid_def split_def)\n\n(* note about this precond stuff: rules get a chance to bind directly\n   before any of their combined forms. As a result, these precondition\n   implication rules are only used when needed. *)\n\nlemma hoare_add_post:\n  assumes r: \"\\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>\"\n  assumes impP: \"\\<And>s. P s \\<Longrightarrow> P' s\"\n  assumes impQ: \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q' rv s \\<longrightarrow> Q rv s\\<rbrace>\"\n  shows \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  apply (rule hoare_chain)\n    apply (rule hoare_vcg_conj_lift)\n     apply (rule r)\n    apply (rule impQ)\n   apply simp\n   apply (erule impP)\n  apply simp\n  done\n\nlemma hoare_whenE_wp:\n  \"(P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> f \\<lbrace>R\\<rbrace>, \\<lbrace>E\\<rbrace>) \\<Longrightarrow> \\<lbrace>if P then Q else R ()\\<rbrace> whenE P f \\<lbrace>R\\<rbrace>, \\<lbrace>E\\<rbrace>\"\n  unfolding whenE_def by clarsimp wp\n\nlemma hoare_gen_asmE:\n  \"(P \\<Longrightarrow> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>,-) \\<Longrightarrow> \\<lbrace>P' and K P\\<rbrace> f \\<lbrace>Q\\<rbrace>, -\"\n  by (simp add: validE_R_def validE_def valid_def) blast\n\nlemma hoare_list_case:\n  assumes P1: \"\\<lbrace>P1\\<rbrace> f f1 \\<lbrace>Q\\<rbrace>\"\n  assumes P2: \"\\<And>y ys. xs = y#ys \\<Longrightarrow> \\<lbrace>P2 y ys\\<rbrace> f (f2 y ys) \\<lbrace>Q\\<rbrace>\"\n  shows \"\\<lbrace>case xs of [] \\<Rightarrow> P1 | y#ys \\<Rightarrow> P2 y ys\\<rbrace>\n         f (case xs of [] \\<Rightarrow> f1 | y#ys \\<Rightarrow> f2 y ys)\n         \\<lbrace>Q\\<rbrace>\"\n  apply (cases xs; simp)\n   apply (rule P1)\n  apply (rule P2)\n  apply simp\n  done\n\nlemma hoare_unless_wp:\n  \"(\\<not>P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> f \\<lbrace>R\\<rbrace>) \\<Longrightarrow> \\<lbrace>if P then R () else Q\\<rbrace> unless P f \\<lbrace>R\\<rbrace>\"\n  unfolding unless_def by wp auto\n\nlemma hoare_use_eq:\n  assumes x: \"\\<And>P. \\<lbrace>\\<lambda>s. P (f s)\\<rbrace> m \\<lbrace>\\<lambda>rv s. P (f s)\\<rbrace>\"\n  assumes y: \"\\<And>f. \\<lbrace>\\<lambda>s. P f s\\<rbrace> m \\<lbrace>\\<lambda>rv s. Q f s\\<rbrace>\"\n  shows \"\\<lbrace>\\<lambda>s. P (f s) s\\<rbrace> m \\<lbrace>\\<lambda>rv s. Q (f s :: 'c :: type) s \\<rbrace>\"\n  apply (rule_tac Q=\"\\<lambda>rv s. \\<exists>f'. f' = f s \\<and> Q f' s\" in hoare_post_imp)\n   apply simp\n  apply (wpsimp wp: hoare_vcg_ex_lift x y)\n  done\n\nlemma hoare_return_sp:\n  \"\\<lbrace>P\\<rbrace> return x \\<lbrace>\\<lambda>r. P and K (r = x)\\<rbrace>\"\n  by (simp add: valid_def return_def)\n\nlemma hoare_fail_any [simp]:\n  \"\\<lbrace>P\\<rbrace> fail \\<lbrace>Q\\<rbrace>\" by wp\n\nlemma hoare_failE [simp]: \"\\<lbrace>P\\<rbrace> fail \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\" by  wp\n\nlemma hoare_FalseE [simp]:\n  \"\\<lbrace>\\<lambda>s. False\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (simp add: valid_def validE_def)\n\nlemma hoare_K_bind [wp]:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> K_bind f x \\<lbrace>Q\\<rbrace>\"\n  by simp\n\ntext {* Setting up the precondition case splitter. *}\n\nlemma wpc_helper_valid:\n  \"\\<lbrace>Q\\<rbrace> g \\<lbrace>S\\<rbrace> \\<Longrightarrow> wpc_helper (P, P') (Q, Q') \\<lbrace>P\\<rbrace> g \\<lbrace>S\\<rbrace>\"\n  by (clarsimp simp: wpc_helper_def elim!: hoare_pre)\n\nlemma wpc_helper_validE:\n  \"\\<lbrace>Q\\<rbrace> f \\<lbrace>R\\<rbrace>,\\<lbrace>E\\<rbrace> \\<Longrightarrow> wpc_helper (P, P') (Q, Q') \\<lbrace>P\\<rbrace> f \\<lbrace>R\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  by (clarsimp simp: wpc_helper_def elim!: hoare_pre)\n\nlemma wpc_helper_validE_R:\n  \"\\<lbrace>Q\\<rbrace> f \\<lbrace>R\\<rbrace>,- \\<Longrightarrow> wpc_helper (P, P') (Q, Q') \\<lbrace>P\\<rbrace> f \\<lbrace>R\\<rbrace>,-\"\n  by (clarsimp simp: wpc_helper_def elim!: hoare_pre)\n\nlemma wpc_helper_validR_R:\n  \"\\<lbrace>Q\\<rbrace> f -,\\<lbrace>E\\<rbrace> \\<Longrightarrow> wpc_helper (P, P') (Q, Q') \\<lbrace>P\\<rbrace> f -,\\<lbrace>E\\<rbrace>\"\n  by (clarsimp simp: wpc_helper_def elim!: hoare_pre)\n\nlemma wpc_helper_no_fail_final:\n  \"no_fail Q f \\<Longrightarrow> wpc_helper (P, P') (Q, Q') (no_fail P f)\"\n  by (clarsimp simp: wpc_helper_def elim!: no_fail_pre)\n\nlemma wpc_helper_empty_fail_final:\n  \"empty_fail f \\<Longrightarrow> wpc_helper (P, P') (Q, Q') (empty_fail f)\"\n  by (clarsimp simp: wpc_helper_def)\n\nlemma wpc_helper_validNF:\n  \"\\<lbrace>Q\\<rbrace> g \\<lbrace>S\\<rbrace>! \\<Longrightarrow> wpc_helper (P, P') (Q, Q') \\<lbrace>P\\<rbrace> g \\<lbrace>S\\<rbrace>!\"\n  apply (clarsimp simp: wpc_helper_def)\n  by (metis hoare_wp_combs(2) no_fail_pre validNF_def)\n\nwpc_setup \"\\<lambda>m. \\<lbrace>P\\<rbrace> m \\<lbrace>Q\\<rbrace>\" wpc_helper_valid\nwpc_setup \"\\<lambda>m. \\<lbrace>P\\<rbrace> m \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\" wpc_helper_validE\nwpc_setup \"\\<lambda>m. \\<lbrace>P\\<rbrace> m \\<lbrace>Q\\<rbrace>,-\" wpc_helper_validE_R\nwpc_setup \"\\<lambda>m. \\<lbrace>P\\<rbrace> m -,\\<lbrace>E\\<rbrace>\" wpc_helper_validR_R\nwpc_setup \"\\<lambda>m. no_fail P m\" wpc_helper_no_fail_final\nwpc_setup \"\\<lambda>m. empty_fail m\" wpc_helper_empty_fail_final\nwpc_setup \"\\<lambda>m. \\<lbrace>P\\<rbrace> m \\<lbrace>Q\\<rbrace>!\" wpc_helper_validNF\n\nlemma in_liftM:\n \"((r, s') \\<in> fst (liftM t f s)) = (\\<exists>r'. (r', s') \\<in> fst (f s) \\<and> r = t r')\"\n  apply (simp add: liftM_def return_def bind_def)\n  apply (simp add: Bex_def)\n  done\n\n(* FIXME: eliminate *)\nlemmas handy_liftM_lemma = in_liftM\n\nlemma hoare_fun_app_wp[wp]:\n  \"\\<lbrace>P\\<rbrace> f' x \\<lbrace>Q'\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f' $ x \\<lbrace>Q'\\<rbrace>\"\n  \"\\<lbrace>P\\<rbrace> f x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f $ x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  \"\\<lbrace>P\\<rbrace> f x \\<lbrace>Q\\<rbrace>,- \\<Longrightarrow> \\<lbrace>P\\<rbrace> f $ x \\<lbrace>Q\\<rbrace>,-\"\n  \"\\<lbrace>P\\<rbrace> f x -,\\<lbrace>E\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f $ x -,\\<lbrace>E\\<rbrace>\"\n  by simp+\n\nlemma hoare_validE_pred_conj:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace>f\\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>; \\<lbrace>P\\<rbrace>f\\<lbrace>R\\<rbrace>,\\<lbrace>E\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace>f\\<lbrace>Q And R\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  unfolding valid_def validE_def by (simp add: split_def split: sum.splits)\n\nlemma hoare_validE_conj:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace>f\\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>; \\<lbrace>P\\<rbrace>f\\<lbrace>R\\<rbrace>,\\<lbrace>E\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. Q r s \\<and> R r s\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  unfolding valid_def validE_def by (simp add: split_def split: sum.splits)\n\nlemma hoare_valid_validE:\n  \"\\<lbrace>P\\<rbrace>f\\<lbrace>\\<lambda>r. Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace>f\\<lbrace>\\<lambda>r. Q\\<rbrace>,\\<lbrace>\\<lambda>r. Q\\<rbrace>\"\n  unfolding valid_def validE_def by (simp add: split_def split: sum.splits)\n\nlemma liftE_validE_E [wp]:\n  \"\\<lbrace>\\<top>\\<rbrace> liftE f -, \\<lbrace>Q\\<rbrace>\"\n  by (clarsimp simp: validE_E_def valid_def)\n\nlemma validE_validE_E [wp_comb]:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<top>\\<top>\\<rbrace>, \\<lbrace>E\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f -, \\<lbrace>E\\<rbrace>\"\n  by (simp add: validE_E_def)\n\nlemma validE_E_validE:\n  \"\\<lbrace>P\\<rbrace> f -, \\<lbrace>E\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<top>\\<top>\\<rbrace>, \\<lbrace>E\\<rbrace>\"\n  by (simp add: validE_E_def)\n\n(*\n * if_validE_E:\n *\n * \\<lbrakk>?P1 \\<Longrightarrow> \\<lbrace>?Q1\\<rbrace> ?f1 -, \\<lbrace>?E\\<rbrace>; \\<not> ?P1 \\<Longrightarrow> \\<lbrace>?R1\\<rbrace> ?g1 -, \\<lbrace>?E\\<rbrace>\\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. (?P1 \\<longrightarrow> ?Q1 s) \\<and> (\\<not> ?P1 \\<longrightarrow> ?R1 s)\\<rbrace> if ?P1 then ?f1 else ?g1 -, \\<lbrace>?E\\<rbrace>\n *)\nlemmas if_validE_E [wp_split] =\n  validE_validE_E [OF hoare_vcg_split_ifE [OF validE_E_validE validE_E_validE]]\n\nlemma returnOk_E [wp]:\n  \"\\<lbrace>\\<top>\\<rbrace> returnOk r -, \\<lbrace>Q\\<rbrace>\"\n  by (simp add: validE_E_def) wp\n\nlemma hoare_drop_imp:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. R r s \\<longrightarrow> Q r s\\<rbrace>\"\n  by (auto simp: valid_def)\n\nlemma hoare_drop_impE:\n  \"\\<lbrakk>\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r. Q\\<rbrace>, \\<lbrace>E\\<rbrace>\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. R r s \\<longrightarrow> Q s\\<rbrace>, \\<lbrace>E\\<rbrace>\"\n  by (metis (lifting, mono_tags) hoare_post_impErr')\n\nlemma hoare_drop_impE_R:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,- \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. R r s \\<longrightarrow> Q r s\\<rbrace>, -\"\n  by (auto simp: validE_R_def validE_def valid_def split_def split: sum.splits)\n\nlemma hoare_drop_impE_E:\n  \"\\<lbrace>P\\<rbrace> f -,\\<lbrace>Q\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f -,\\<lbrace>\\<lambda>r s. R r s \\<longrightarrow> Q r s\\<rbrace>\"\n  by (auto simp: validE_E_def validE_def valid_def split_def split: sum.splits)\n\nlemmas hoare_drop_imps = hoare_drop_imp hoare_drop_impE_R hoare_drop_impE_E\n\nlemma bind_det_exec:\n  \"fst (a s) = {(r,s')} \\<Longrightarrow> fst ((a >>= b) s) = fst (b r s')\"\n  by (simp add: bind_def)\n\nlemma in_bind_det_exec:\n  \"fst (a s) = {(r,s')} \\<Longrightarrow> (s'' \\<in> fst ((a >>= b) s)) = (s'' \\<in> fst (b r s'))\"\n  by (simp add: bind_def)\n\nlemma exec_put:\n  \"(put s' >>= m) s = m () s'\"\n  by (simp add: bind_def put_def)\n\nlemma bind_execI:\n  \"\\<lbrakk> (r'',s'') \\<in> fst (f s); \\<exists>x \\<in> fst (g r'' s''). P x \\<rbrakk> \\<Longrightarrow>\n  \\<exists>x \\<in> fst ((f >>= g) s). P x\"\n  by (force simp: in_bind split_def bind_def)\n\nlemma True_E_E [wp]: \"\\<lbrace>\\<top>\\<rbrace> f -,\\<lbrace>\\<top>\\<top>\\<rbrace>\"\n  by (auto simp: validE_E_def validE_def valid_def split: sum.splits)\n\n(*\n * \\<lbrakk>\\<And>x. \\<lbrace>?B1 x\\<rbrace> ?g1 x -, \\<lbrace>?E\\<rbrace>; \\<lbrace>?P\\<rbrace> ?f1 \\<lbrace>?B1\\<rbrace>, \\<lbrace>?E\\<rbrace>\\<rbrakk> \\<Longrightarrow> \\<lbrace>?P\\<rbrace> ?f1 >>=E ?g1 -, \\<lbrace>?E\\<rbrace>\n *)\nlemmas [wp_split] =\n  validE_validE_E [OF hoare_vcg_seqE [OF validE_E_validE]]\n\nlemma case_option_wp:\n  assumes x: \"\\<And>x. \\<lbrace>P x\\<rbrace> m x \\<lbrace>Q\\<rbrace>\"\n  assumes y: \"\\<lbrace>P'\\<rbrace> m' \\<lbrace>Q\\<rbrace>\"\n  shows      \"\\<lbrace>\\<lambda>s. (x = None \\<longrightarrow> P' s) \\<and> (x \\<noteq> None \\<longrightarrow> P (the x) s)\\<rbrace>\n                case_option m' m x \\<lbrace>Q\\<rbrace>\"\n  apply (cases x; simp)\n   apply (rule y)\n  apply (rule x)\n  done\n\nlemma case_option_wpE:\n  assumes x: \"\\<And>x. \\<lbrace>P x\\<rbrace> m x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  assumes y: \"\\<lbrace>P'\\<rbrace> m' \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  shows      \"\\<lbrace>\\<lambda>s. (x = None \\<longrightarrow> P' s) \\<and> (x \\<noteq> None \\<longrightarrow> P (the x) s)\\<rbrace>\n                case_option m' m x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>\"\n  apply (cases x; simp)\n   apply (rule y)\n  apply (rule x)\n  done\n\nlemma in_bindE:\n  \"(rv, s') \\<in> fst ((f >>=E (\\<lambda>rv'. g rv')) s) =\n  ((\\<exists>ex. rv = Inl ex \\<and> (Inl ex, s') \\<in> fst (f s)) \\<or>\n  (\\<exists>rv' s''. (rv, s') \\<in> fst (g rv' s'') \\<and> (Inr rv', s'') \\<in> fst (f s)))\"\n  apply (rule iffI)\n   apply (clarsimp simp: bindE_def bind_def)\n   apply (case_tac a)\n    apply (clarsimp simp: lift_def throwError_def return_def)\n   apply (clarsimp simp: lift_def)\n  apply safe\n   apply (clarsimp simp: bindE_def bind_def)\n   apply (erule rev_bexI)\n   apply (simp add: lift_def throwError_def return_def)\n  apply (clarsimp simp: bindE_def bind_def)\n  apply (erule rev_bexI)\n  apply (simp add: lift_def)\n  done\n\n(*\n * \\<lbrace>?P\\<rbrace> ?m1 -, \\<lbrace>?E\\<rbrace> \\<Longrightarrow> \\<lbrace>?P\\<rbrace> liftME ?f1 ?m1 -, \\<lbrace>?E\\<rbrace>\n *)\nlemmas [wp_split] = validE_validE_E [OF liftME_wp, simplified, OF validE_E_validE]\n\nlemma assert_A_True[simp]: \"assert True = return ()\"\n  by (simp add: assert_def)\n\nlemma assert_wp [wp]: \"\\<lbrace>\\<lambda>s. P \\<longrightarrow> Q () s\\<rbrace> assert P \\<lbrace>Q\\<rbrace>\"\n  by (cases P, (simp add: assert_def | wp)+)\n\nlemma list_cases_wp:\n  assumes a: \"\\<lbrace>P_A\\<rbrace> a \\<lbrace>Q\\<rbrace>\"\n  assumes b: \"\\<And>x xs. ts = x#xs \\<Longrightarrow> \\<lbrace>P_B x xs\\<rbrace> b x xs \\<lbrace>Q\\<rbrace>\"\n  shows \"\\<lbrace>case_list P_A P_B ts\\<rbrace> case ts of [] \\<Rightarrow> a | x # xs \\<Rightarrow> b x xs \\<lbrace>Q\\<rbrace>\"\n  by (cases ts, auto simp: a b)\n\n(* FIXME: make wp *)\nlemma whenE_throwError_wp:\n  \"\\<lbrace>\\<lambda>s. \\<not>Q \\<longrightarrow> P s\\<rbrace> whenE Q (throwError e) \\<lbrace>\\<lambda>rv. P\\<rbrace>, -\"\n  unfolding whenE_def by wpsimp\n\nlemma select_throwError_wp:\n  \"\\<lbrace>\\<lambda>s. \\<forall>x\\<in>S. Q x s\\<rbrace> select S >>= throwError -, \\<lbrace>Q\\<rbrace>\"\n  by (simp add: bind_def throwError_def return_def select_def validE_E_def\n                validE_def valid_def)\n\n\nsection \"validNF Rules\"\n\nsubsection \"Basic validNF theorems\"\n\nlemma validNF [intro?]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>; no_fail P f \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>!\"\n  by (clarsimp simp: validNF_def)\n\nlemma validNF_valid: \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  by (clarsimp simp: validNF_def)\n\nlemma validNF_no_fail: \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>! \\<rbrakk> \\<Longrightarrow> no_fail P f\"\n  by (clarsimp simp: validNF_def)\n\nlemma snd_validNF:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>!; P s \\<rbrakk> \\<Longrightarrow> \\<not> snd (f s)\"\n  by (clarsimp simp: validNF_def no_fail_def)\n\nlemma use_validNF:\n  \"\\<lbrakk> (r', s') \\<in> fst (f s); \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>!; P s \\<rbrakk> \\<Longrightarrow> Q r' s'\"\n  by (fastforce simp: validNF_def valid_def)\n\nsubsection \"validNF weakest pre-condition rules\"\n\nlemma validNF_return [wp]:\n  \"\\<lbrace> P x \\<rbrace> return x \\<lbrace> P \\<rbrace>!\"\n  by (wp validNF)+\n\nlemma validNF_get [wp]:\n  \"\\<lbrace> \\<lambda>s. P s s  \\<rbrace> get \\<lbrace> P \\<rbrace>!\"\n  by (wp validNF)+\n\nlemma validNF_put [wp]:\n  \"\\<lbrace> \\<lambda>s. P () x  \\<rbrace> put x \\<lbrace> P \\<rbrace>!\"\n  by (wp validNF)+\n\nlemma validNF_K_bind [wp]:\n  \"\\<lbrace> P \\<rbrace> x \\<lbrace> Q \\<rbrace>! \\<Longrightarrow> \\<lbrace> P \\<rbrace> K_bind x f \\<lbrace> Q \\<rbrace>!\"\n  by simp\n\nlemma validNF_fail [wp]:\n  \"\\<lbrace> \\<lambda>s. False \\<rbrace> fail \\<lbrace> Q \\<rbrace>!\"\n  by (clarsimp simp: validNF_def fail_def no_fail_def)\n\nlemma validNF_prop [wp_unsafe]:\n  \"\\<lbrakk> no_fail (\\<lambda>s. P) f \\<rbrakk> \\<Longrightarrow> \\<lbrace> \\<lambda>s. P \\<rbrace> f \\<lbrace> \\<lambda>rv s. P \\<rbrace>!\"\n  by (wp validNF)+\n\nlemma validNF_post_conj [intro!]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> a \\<lbrace> Q \\<rbrace>!; \\<lbrace> P \\<rbrace> a \\<lbrace> R \\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> a \\<lbrace> Q And R \\<rbrace>!\"\n  by (clarsimp simp: validNF_def)\n\nlemma no_fail_or:\n  \"\\<lbrakk>no_fail P a; no_fail Q a\\<rbrakk> \\<Longrightarrow> no_fail (P or Q) a\"\n  by (clarsimp simp: no_fail_def)\n\nlemma validNF_pre_disj [intro!]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> a \\<lbrace> R \\<rbrace>!; \\<lbrace> Q \\<rbrace> a \\<lbrace> R \\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace> P or Q \\<rbrace> a \\<lbrace> R \\<rbrace>!\"\n  by (rule validNF) (auto dest: validNF_valid validNF_no_fail intro: no_fail_or)\n\n(*\n * Set up combination rules for WP, which also requires\n * a \"wp_trip\" rule for validNF.\n *)\n\ndefinition \"validNF_property Q s b \\<equiv> \\<not> snd (b s) \\<and> (\\<forall>(r', s') \\<in> fst (b s). Q r' s')\"\n\nlemma validNF_is_triple [wp_trip]:\n  \"validNF P f Q = triple_judgement P f (validNF_property Q)\"\n  apply (clarsimp simp: validNF_def triple_judgement_def validNF_property_def)\n  apply (auto simp: no_fail_def valid_def)\n  done\n\nlemma validNF_weaken_pre [wp_comb]:\n  \"\\<lbrakk>\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>!; \\<And>s. P s \\<Longrightarrow> Q s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>!\"\n  by (metis hoare_pre_imp no_fail_pre validNF_def)\n\nlemma validNF_post_comb_imp_conj:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>!; \\<And>s. P s \\<Longrightarrow> P' s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>!\"\n  by (fastforce simp: validNF_def valid_def)\n\nlemma validNF_post_comb_conj_L:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s \\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>!\"\n  apply (clarsimp simp: validNF_def valid_def no_fail_def)\n  apply force\n  done\n\nlemma validNF_post_comb_conj_R:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s \\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>!\"\n  apply (clarsimp simp: validNF_def valid_def no_fail_def)\n  apply force\n  done\n\nlemma validNF_post_comb_conj:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s \\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>!\"\n  apply (clarsimp simp: validNF_def valid_def no_fail_def)\n  apply force\n  done\n\nlemma validNF_split_if [wp_split]:\n  \"\\<lbrakk>P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> f \\<lbrace>S\\<rbrace>!; \\<not> P \\<Longrightarrow> \\<lbrace>R\\<rbrace> g \\<lbrace>S\\<rbrace>!\\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. (P \\<longrightarrow> Q s) \\<and> (\\<not> P \\<longrightarrow> R s)\\<rbrace> if P then f else g \\<lbrace>S\\<rbrace>!\"\n  by simp\n\nlemma validNF_vcg_conj_lift:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>!; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n      \\<lbrace>\\<lambda>s. P s \\<and> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>!\"\n  apply (subst bipred_conj_def[symmetric], rule validNF_post_conj)\n   apply (erule validNF_weaken_pre, fastforce)\n  apply (erule validNF_weaken_pre, fastforce)\n  done\n\nlemma validNF_vcg_disj_lift:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>!; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n       \\<lbrace>\\<lambda>s. P s \\<or> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<or> Q' rv s\\<rbrace>!\"\n  apply (clarsimp simp: validNF_def)\n  apply safe\n   apply (auto intro!: hoare_vcg_disj_lift)[1]\n  apply (clarsimp simp: no_fail_def)\n  done\n\nlemma validNF_vcg_all_lift [wp]:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>P x\\<rbrace> f \\<lbrace>Q x\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. \\<forall>x. P x s\\<rbrace> f \\<lbrace>\\<lambda>rv s. \\<forall>x. Q x rv s\\<rbrace>!\"\n  apply atomize\n  apply (rule validNF)\n   apply (clarsimp simp: validNF_def)\n   apply (rule hoare_vcg_all_lift)\n   apply force\n  apply (clarsimp simp: no_fail_def validNF_def)\n  done\n\nlemma validNF_bind [wp_split]:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>!; \\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n       \\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>C\\<rbrace>!\"\n  apply (rule validNF)\n   apply (metis validNF_valid hoare_seq_ext)\n  apply (clarsimp simp: no_fail_def validNF_def bind_def' valid_def)\n  apply blast\n  done\n\nlemmas validNF_seq_ext = validNF_bind\n\nsubsection \"validNF compound rules\"\n\nlemma validNF_state_assert [wp]:\n  \"\\<lbrace> \\<lambda>s. P () s \\<and> G s  \\<rbrace> state_assert G \\<lbrace> P \\<rbrace>!\"\n  apply (rule validNF)\n   apply wpsimp\n  apply (clarsimp simp: no_fail_def state_assert_def\n              bind_def' assert_def return_def get_def)\n  done\n\nlemma validNF_modify [wp]:\n  \"\\<lbrace> \\<lambda>s. P () (f s) \\<rbrace> modify f \\<lbrace> P \\<rbrace>!\"\n  apply (clarsimp simp: modify_def)\n  apply wp\n  done\n\nlemma validNF_gets [wp]:\n  \"\\<lbrace>\\<lambda>s. P (f s) s\\<rbrace> gets f \\<lbrace>P\\<rbrace>!\"\n  apply (clarsimp simp: gets_def)\n  apply wp\n  done\n\nlemma validNF_condition [wp]:\n  \"\\<lbrakk> \\<lbrace> Q \\<rbrace> A \\<lbrace>P\\<rbrace>!; \\<lbrace> R \\<rbrace> B \\<lbrace>P\\<rbrace>!\\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. if C s then Q s else R s\\<rbrace> condition C A B \\<lbrace>P\\<rbrace>!\"\n  apply rule\n   apply (drule validNF_valid)+\n   apply (erule (1) condition_wp)\n  apply (drule validNF_no_fail)+\n  apply (clarsimp simp: no_fail_def condition_def)\n  done\n\nlemma validNF_alt_def:\n  \"validNF P m Q = (\\<forall>s. P s \\<longrightarrow> ((\\<forall>(r', s') \\<in> fst (m s). Q r' s') \\<and> \\<not> snd (m s)))\"\n  by (fastforce simp: validNF_def valid_def no_fail_def)\n\nlemma validNF_assert [wp]:\n    \"\\<lbrace> (\\<lambda>s. P) and (R ()) \\<rbrace> assert P \\<lbrace> R \\<rbrace>!\"\n  apply (rule validNF)\n   apply (clarsimp simp: valid_def in_return)\n  apply (clarsimp simp: no_fail_def return_def)\n  done\n\nlemma validNF_false_pre:\n  \"\\<lbrace> \\<lambda>_. False \\<rbrace> P \\<lbrace> Q \\<rbrace>!\"\n  by (clarsimp simp: validNF_def no_fail_def)\n\nlemma validNF_chain:\n   \"\\<lbrakk>\\<lbrace>P'\\<rbrace> a \\<lbrace>R'\\<rbrace>!; \\<And>s. P s \\<Longrightarrow> P' s; \\<And>r s. R' r s \\<Longrightarrow> R r s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>!\"\n  by (fastforce simp: validNF_def valid_def no_fail_def Ball_def)\n\nlemma validNF_case_prod [wp]:\n  \"\\<lbrakk> \\<And>x y. validNF (P x y) (B x y) Q \\<rbrakk> \\<Longrightarrow> validNF (case_prod P v) (case_prod (\\<lambda>x y. B x y) v) Q\"\n  by (metis prod.exhaust split_conv)\n\nlemma validE_NF_case_prod [wp]:\n    \"\\<lbrakk> \\<And>a b. \\<lbrace>P a b\\<rbrace> f a b \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n          \\<lbrace>case x of (a, b) \\<Rightarrow> P a b\\<rbrace> case x of (a, b) \\<Rightarrow> f a b \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  apply (clarsimp simp: validE_NF_alt_def)\n  apply (erule validNF_case_prod)\n  done\n\nlemma no_fail_is_validNF_True: \"no_fail P s = (\\<lbrace> P \\<rbrace> s \\<lbrace> \\<lambda>_ _. True \\<rbrace>!)\"\n  by (clarsimp simp: no_fail_def validNF_def valid_def)\n\nsubsection \"validNF reasoning in the exception monad\"\n\nlemma validE_NF [intro?]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>; no_fail P f \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>!\"\n  apply (clarsimp simp: validE_NF_def)\n  done\n\nlemma validE_NF_valid:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>\"\n  apply (clarsimp simp: validE_NF_def)\n  done\n\nlemma validE_NF_no_fail:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>! \\<rbrakk> \\<Longrightarrow> no_fail P f\"\n  apply (clarsimp simp: validE_NF_def)\n  done\n\nlemma validE_NF_weaken_pre [wp_comb]:\n   \"\\<lbrakk>\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>,\\<lbrace>E\\<rbrace>!; \\<And>s. P s \\<Longrightarrow> Q s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>,\\<lbrace>E\\<rbrace>!\"\n  apply (clarsimp simp: validE_NF_alt_def)\n  apply (erule validNF_weaken_pre)\n  apply simp\n  done\n\nlemma validE_NF_post_comb_conj_L:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace> E \\<rbrace>!; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>, \\<lbrace> \\<lambda>_ _. True \\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s \\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>, \\<lbrace> E \\<rbrace>!\"\n  apply (clarsimp simp: validE_NF_alt_def validE_def validNF_def\n          valid_def no_fail_def split: sum.splits)\n  apply force\n  done\n\nlemma validE_NF_post_comb_conj_R:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace> \\<lambda>_ _. True \\<rbrace>; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>, \\<lbrace> E \\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s \\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>, \\<lbrace> E \\<rbrace>!\"\n  apply (clarsimp simp: validE_NF_alt_def validE_def validNF_def\n          valid_def no_fail_def split: sum.splits)\n  apply force\n  done\n\nlemma validE_NF_post_comb_conj:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace> E \\<rbrace>!; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>, \\<lbrace> E \\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s \\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>, \\<lbrace> E \\<rbrace>!\"\n  apply (clarsimp simp: validE_NF_alt_def validE_def validNF_def\n          valid_def no_fail_def split: sum.splits)\n  apply force\n  done\n\nlemma validE_NF_chain:\n   \"\\<lbrakk>\\<lbrace>P'\\<rbrace> a \\<lbrace>R'\\<rbrace>,\\<lbrace>E'\\<rbrace>!;\n    \\<And>s. P s \\<Longrightarrow> P' s;\n    \\<And>r' s'. R' r' s' \\<Longrightarrow> R r' s';\n    \\<And>r'' s''. E' r'' s'' \\<Longrightarrow> E r'' s''\\<rbrakk> \\<Longrightarrow>\n  \\<lbrace>\\<lambda>s. P s \\<rbrace> a \\<lbrace>\\<lambda>r' s'. R r' s'\\<rbrace>,\\<lbrace>\\<lambda>r'' s''. E r'' s''\\<rbrace>!\"\n  by (fastforce simp: validE_NF_def validE_def2 no_fail_def Ball_def split: sum.splits)\n\nlemma validE_NF_bind_wp [wp]:\n  \"\\<lbrakk>\\<And>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>, \\<lbrace>E\\<rbrace>!; \\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>, \\<lbrace>E\\<rbrace>!\\<rbrakk> \\<Longrightarrow> \\<lbrace>A\\<rbrace> f >>=E (\\<lambda>x. g x) \\<lbrace>C\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  apply (unfold validE_NF_alt_def bindE_def)\n  apply (rule validNF_bind [rotated])\n   apply assumption\n  apply (clarsimp simp: lift_def throwError_def split: sum.splits)\n  apply wpsimp\n  done\n\nlemma validNF_catch [wp]:\n  \"\\<lbrakk>\\<And>x. \\<lbrace>E x\\<rbrace> handler x \\<lbrace>Q\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace>!\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f <catch> (\\<lambda>x. handler x) \\<lbrace>Q\\<rbrace>!\"\n  apply (unfold validE_NF_alt_def catch_def)\n  apply (rule validNF_bind [rotated])\n   apply assumption\n  apply (clarsimp simp: lift_def throwError_def split: sum.splits)\n  apply wp\n  done\n\nlemma validNF_throwError [wp]:\n  \"\\<lbrace>E e\\<rbrace> throwError e \\<lbrace>P\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  by (unfold validE_NF_alt_def throwError_def o_def) wpsimp\n\nlemma validNF_returnOk [wp]:\n  \"\\<lbrace>P e\\<rbrace> returnOk e \\<lbrace>P\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  by (clarsimp simp: validE_NF_alt_def returnOk_def) wpsimp\n\nlemma validNF_whenE [wp]:\n  \"(P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> f \\<lbrace>R\\<rbrace>, \\<lbrace>E\\<rbrace>!) \\<Longrightarrow> \\<lbrace>if P then Q else R ()\\<rbrace> whenE P f \\<lbrace>R\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  unfolding whenE_def by clarsimp wp\n\nlemma validNF_nobindE [wp]:\n  \"\\<lbrakk> \\<lbrace>B\\<rbrace> g \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>!;\n     \\<lbrace>A\\<rbrace> f \\<lbrace>\\<lambda>r s. B s\\<rbrace>,\\<lbrace>E\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>A\\<rbrace> doE f; g odE \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>!\"\n  by clarsimp wp\n\n(*\n * Setup triple rules for validE_NF so that we can use the\n * \"wp_comb\" attribute.\n *)\n\ndefinition \"validE_NF_property Q E s b \\<equiv> \\<not> snd (b s)\n       \\<and> (\\<forall>(r', s') \\<in> fst (b s). case r' of Inl x \\<Rightarrow> E x s' | Inr x \\<Rightarrow> Q x s')\"\n\nlemma validE_NF_is_triple [wp_trip]:\n  \"validE_NF P f Q E = triple_judgement P f (validE_NF_property Q E)\"\n  apply (clarsimp simp: validE_NF_def validE_def2 no_fail_def triple_judgement_def\n           validE_NF_property_def split: sum.splits)\n  apply blast\n  done\n\nlemmas [wp_comb] = validE_NF_weaken_pre\n\nlemma validNF_cong:\n   \"\\<lbrakk> \\<And>s. P s = P' s; \\<And>s. P s \\<Longrightarrow> m s = m' s;\n           \\<And>r' s' s. \\<lbrakk> P s; (r', s') \\<in> fst (m s) \\<rbrakk> \\<Longrightarrow> Q r' s' = Q' r' s' \\<rbrakk> \\<Longrightarrow>\n     (\\<lbrace> P \\<rbrace> m \\<lbrace> Q \\<rbrace>!) = (\\<lbrace> P' \\<rbrace> m' \\<lbrace> Q' \\<rbrace>!)\"\n  by (fastforce simp: validNF_alt_def)\n\nlemma validE_NF_liftE [wp]:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>! \\<Longrightarrow> \\<lbrace>P\\<rbrace> liftE f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>!\"\n  by (wpsimp simp: validE_NF_alt_def liftE_def)\n\nlemma validE_NF_handleE' [wp]:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>F x\\<rbrace> handler x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>F\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>P\\<rbrace> f <handle2> (\\<lambda>x. handler x) \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>!\"\n  apply (unfold validE_NF_alt_def handleE'_def)\n  apply (rule validNF_bind [rotated])\n   apply assumption\n  apply (clarsimp split: sum.splits)\n  apply wpsimp\n  done\n\nlemma validE_NF_handleE [wp]:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>F x\\<rbrace> handler x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>F\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>P\\<rbrace> f <handle> handler \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>!\"\n  apply (unfold handleE_def)\n  apply (metis validE_NF_handleE')\n  done\n\nlemma validE_NF_condition [wp]:\n  \"\\<lbrakk> \\<lbrace> Q \\<rbrace> A \\<lbrace>P\\<rbrace>,\\<lbrace> E \\<rbrace>!; \\<lbrace> R \\<rbrace> B \\<lbrace>P\\<rbrace>,\\<lbrace> E \\<rbrace>!\\<rbrakk>\n      \\<Longrightarrow> \\<lbrace>\\<lambda>s. if C s then Q s else R s\\<rbrace> condition C A B \\<lbrace>P\\<rbrace>,\\<lbrace> E \\<rbrace>!\"\n  apply rule\n   apply (drule validE_NF_valid)+\n   apply wp\n  apply (drule validE_NF_no_fail)+\n  apply (clarsimp simp: no_fail_def condition_def)\n  done\n\ntext {* Strengthen setup. *}\n\ncontext strengthen_implementation begin\n\nlemma strengthen_hoare [strg]:\n  \"(\\<And>r s. st F (op \\<longrightarrow>) (Q r s) (R r s))\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>) (\\<lbrace>P\\<rbrace> f \\<lbrace>R\\<rbrace>)\"\n  by (cases F, auto elim: hoare_strengthen_post)\n\nlemma strengthen_validE_R_cong[strg]:\n  \"(\\<And>r s. st F (op \\<longrightarrow>) (Q r s) (R r s))\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, -) (\\<lbrace>P\\<rbrace> f \\<lbrace>R\\<rbrace>, -)\"\n  by (cases F, auto intro: hoare_post_imp_R)\n\nlemma strengthen_validE_cong[strg]:\n  \"(\\<And>r s. st F (op \\<longrightarrow>) (Q r s) (R r s))\n    \\<Longrightarrow> (\\<And>r s. st F (op \\<longrightarrow>) (S r s) (T r s))\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>S\\<rbrace>) (\\<lbrace>P\\<rbrace> f \\<lbrace>R\\<rbrace>, \\<lbrace>T\\<rbrace>)\"\n  by (cases F, auto elim: hoare_post_impErr)\n\nlemma strengthen_validE_E_cong[strg]:\n  \"(\\<And>r s. st F (op \\<longrightarrow>) (S r s) (T r s))\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (\\<lbrace>P\\<rbrace> f -, \\<lbrace>S\\<rbrace>) (\\<lbrace>P\\<rbrace> f -, \\<lbrace>T\\<rbrace>)\"\n  by (cases F, auto elim: hoare_post_impErr simp: validE_E_def)\n\nend\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/lib/Monad_WP/NonDetMonadVCG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3481511269961152}}
{"text": "(* Title: While_SPMF.thy\n   Author: Andreas Lochbihler, ETH Zurich *)\n\ntheory While_SPMF imports\n  MFMC_Countable.Rel_PMF_Characterisation\n  \"HOL-Types_To_Sets.Types_To_Sets\"\n  \"HOL-Library.Complete_Partial_Order2\"\nbegin\n\ntext \\<open>\n  This theory defines a probabilistic while combinator for discrete (sub-)probabilities and\n  formalises rules for probabilistic termination similar to those by Hurd \\<^cite>\\<open>\"Hurd2002TPHOLs\"\\<close>\n  and McIver and Morgan \\<^cite>\\<open>\"McIverMorgan2005\"\\<close>.\n\\<close>\n\nsection \\<open>Miscellaneous library additions\\<close>\n\nfun map_option_set :: \"('a \\<Rightarrow> 'b option set) \\<Rightarrow> 'a option \\<Rightarrow> 'b option set\"\nwhere\n  \"map_option_set f None = {None}\"\n| \"map_option_set f (Some x) = f x\"\n\nlemma None_in_map_option_set:\n  \"None \\<in> map_option_set f x \\<longleftrightarrow> None \\<in> Set.bind (set_option x) f \\<or> x = None\"\nby(cases x) simp_all\n\nlemma None_in_map_option_set_None [intro!]: \"None \\<in> map_option_set f None\"\nby simp\n\nlemma None_in_map_option_set_Some [intro!]: \"None \\<in> f x \\<Longrightarrow> None \\<in> map_option_set f (Some x)\"\nby simp\n\nlemma Some_in_map_option_set [intro!]: \"Some y \\<in> f x \\<Longrightarrow> Some y \\<in> map_option_set f (Some x)\"\nby simp\n\nlemma map_option_set_singleton [simp]: \"map_option_set (\\<lambda>x. {f x}) y = {Option.bind y f}\"\nby(cases y) simp_all\n\nlemma Some_eq_bind_conv: \"Some y = Option.bind x f \\<longleftrightarrow> (\\<exists>z. x = Some z \\<and> f z = Some y)\"\nby(cases x) auto\n\nlemma map_option_set_bind: \"map_option_set f (Option.bind x g) = map_option_set (map_option_set f \\<circ> g) x\"\nby(cases x) simp_all\n\nlemma Some_in_map_option_set_conv: \"Some y \\<in> map_option_set f x \\<longleftrightarrow> (\\<exists>z. x = Some z \\<and> Some y \\<in> f z)\"\nby(cases x) auto\n\n\ninterpretation rel_spmf_characterisation by unfold_locales(rule rel_pmf_measureI)\nhide_fact (open) rel_pmf_measureI\n\nlemma Sup_conv_fun_lub: \"Sup = fun_lub Sup\"\n  by(auto simp add: Sup_fun_def fun_eq_iff fun_lub_def intro: arg_cong[where f=Sup])\n\nlemma le_conv_fun_ord: \"(\\<le>) = fun_ord (\\<le>)\"\n  by(auto simp add: fun_eq_iff fun_ord_def le_fun_def)\n\nlemmas parallel_fixp_induct_2_1 = parallel_fixp_induct_uc[\n  of _ _ _ _ \"case_prod\" _ \"curry\" \"\\<lambda>x. x\" _ \"\\<lambda>x. x\",\n  where P=\"\\<lambda>f g. P (curry f) g\",\n  unfolded case_prod_curry curry_case_prod curry_K,\n  OF _ _ _ _ _ _ refl refl]\n  for P\n\nlemma monotone_Pair:\n  \"\\<lbrakk> monotone ord orda f; monotone ord ordb g \\<rbrakk>\n  \\<Longrightarrow> monotone ord (rel_prod orda ordb) (\\<lambda>x. (f x, g x))\"\nby(simp add: monotone_def)\n\nlemma cont_Pair:\n  \"\\<lbrakk> cont lub ord luba orda f; cont lub ord lubb ordb g \\<rbrakk>\n  \\<Longrightarrow> cont lub ord (prod_lub luba lubb) (rel_prod orda ordb) (\\<lambda>x. (f x, g x))\"\nby(rule contI)(auto simp add: prod_lub_def image_image dest!: contD)\n\nlemma mcont_Pair:\n  \"\\<lbrakk> mcont lub ord luba orda f; mcont lub ord lubb ordb g \\<rbrakk>\n  \\<Longrightarrow> mcont lub ord (prod_lub luba lubb) (rel_prod orda ordb) (\\<lambda>x. (f x, g x))\"\nby(rule mcontI)(simp_all add: monotone_Pair mcont_mono cont_Pair)\n\nlemma mono2mono_emeasure_spmf [THEN lfp.mono2mono]:\n  shows monotone_emeasure_spmf:\n  \"monotone (ord_spmf (=)) (\\<le>) (\\<lambda>p. emeasure (measure_spmf p))\"\n  by(rule monotoneI le_funI ord_spmf_eqD_emeasure)+\n\nlemma cont_emeasure_spmf: \"cont lub_spmf (ord_spmf (=)) Sup (\\<le>) (\\<lambda>p. emeasure (measure_spmf p))\"\n  by (rule contI) (simp add: emeasure_lub_spmf fun_eq_iff image_comp)\n\nlemma mcont2mcont_emeasure_spmf [THEN lfp.mcont2mcont, cont_intro]:\n  shows mcont_emeasure_spmf: \"mcont lub_spmf (ord_spmf (=)) Sup (\\<le>) (\\<lambda>p. emeasure (measure_spmf p))\"\n  by(simp add: mcont_def monotone_emeasure_spmf cont_emeasure_spmf)\n\nlemma mcont2mcont_emeasure_spmf' [THEN lfp.mcont2mcont, cont_intro]:\n  shows mcont_emeasure_spmf': \"mcont lub_spmf (ord_spmf (=)) Sup (\\<le>) (\\<lambda>p. emeasure (measure_spmf p) A)\"\n  using mcont_emeasure_spmf[unfolded Sup_conv_fun_lub le_conv_fun_ord]\n  by(subst (asm) mcont_fun_lub_apply) blast\n\nlemma mcont_bind_pmf [cont_intro]:\n  assumes g: \"\\<And>y. mcont luba orda lub_spmf (ord_spmf (=)) (g y)\"\n  shows \"mcont luba orda lub_spmf (ord_spmf (=)) (\\<lambda>x. bind_pmf p (\\<lambda>y. g y x))\"\nusing mcont_bind_spmf[where f=\"\\<lambda>_. spmf_of_pmf p\" and g=g, OF _ assms] by(simp)\n\nlemma ennreal_less_top_iff: \"x < \\<top> \\<longleftrightarrow> x \\<noteq> (\\<top> :: ennreal)\"\n  by(cases x) simp_all\n\nlemma type_definition_Domainp: \n  fixes Rep Abs A T\n  assumes type: \"type_definition Rep Abs A\"\n  assumes T_def: \"T \\<equiv> (\\<lambda>(x::'a) (y::'b). x = Rep y)\"\n  shows \"Domainp T = (\\<lambda>x. x \\<in> A)\"\nproof -\n  interpret type_definition Rep Abs A by(rule type)\n  show ?thesis unfolding Domainp_iff[abs_def] T_def fun_eq_iff by(metis Abs_inverse Rep)\nqed\n\ncontext includes lifting_syntax begin\n\nlemma weight_spmf_parametric [transfer_rule]:\n  \"(rel_spmf A ===> (=)) weight_spmf weight_spmf\"\nby(simp add: rel_fun_def rel_spmf_weightD)\n\nlemma lossless_spmf_parametric [transfer_rule]:\n  \"(rel_spmf A ===> (=)) lossless_spmf lossless_spmf\"\nby(simp add: rel_fun_def lossless_spmf_def rel_spmf_weightD)\n\nlemma UNIV_parametric_pred: \"rel_pred R UNIV UNIV\"\n  by(auto intro!: rel_predI)\nend\n\nlemma bind_spmf_spmf_of_set:\n  \"\\<And>A. \\<lbrakk> finite A; A \\<noteq> {} \\<rbrakk> \\<Longrightarrow> bind_spmf (spmf_of_set A) = bind_pmf (pmf_of_set A)\"\nby(simp add: spmf_of_set_def fun_eq_iff del: spmf_of_pmf_pmf_of_set)\n\nlemma set_pmf_bind_spmf: \"set_pmf (bind_spmf M f) = set_pmf M \\<bind> map_option_set (set_pmf \\<circ> f)\"\nby(auto 4 3 simp add: bind_spmf_def split: option.splits intro: rev_bexI)\n\nlemma set_pmf_spmf_of_set:\n  \"set_pmf (spmf_of_set A) = (if finite A \\<and> A \\<noteq> {} then Some ` A else {None})\"\nby(simp add: spmf_of_set_def spmf_of_pmf_def del: spmf_of_pmf_pmf_of_set)\n\ndefinition measure_measure_spmf :: \"'a spmf \\<Rightarrow> 'a set \\<Rightarrow> real\"\nwhere [simp]: \"measure_measure_spmf p = measure (measure_spmf p)\"\n\nlemma measure_measure_spmf_parametric [transfer_rule]:\n  includes lifting_syntax shows\n  \"(rel_spmf A ===> rel_pred A ===> (=)) measure_measure_spmf measure_measure_spmf\"\nunfolding measure_measure_spmf_def[abs_def] by(rule measure_spmf_parametric)\n\nlemma of_nat_le_one_cancel_iff [simp]:\n  fixes n :: nat shows \"real n \\<le> 1 \\<longleftrightarrow> n \\<le> 1\"\nby linarith\n\nlemma of_int_ceiling_less_add_one [simp]: \"of_int \\<lceil>r\\<rceil> < r + 1\"\n  by linarith\n\nlemma lessThan_subset_Collect: \"{..<x} \\<subseteq> Collect P \\<longleftrightarrow> (\\<forall>y<x. P y)\"\n  by(auto simp add: lessThan_def)\n\nlemma spmf_ub_tight:\n  assumes ub: \"\\<And>x. spmf p x \\<le> f x\"\n  and sum: \"(\\<integral>\\<^sup>+ x. f x \\<partial>count_space UNIV) = weight_spmf p\"\n  shows \"spmf p x = f x\"\nproof -\n  have [rule_format]: \"\\<forall>x. f x \\<le> spmf p x\"\n  proof(rule ccontr)\n    assume \"\\<not> ?thesis\"\n    then obtain x where x: \"spmf p x < f x\" by(auto simp add: not_le)\n    have *: \"(\\<integral>\\<^sup>+ y. ennreal (f y) * indicator (- {x}) y \\<partial>count_space UNIV) \\<noteq> \\<top>\"\n      by(rule neq_top_trans[where y=\"weight_spmf p\"], simp)(auto simp add: sum[symmetric] intro!: nn_integral_mono split: split_indicator)\n      \n    have \"weight_spmf p = \\<integral>\\<^sup>+ y. spmf p y \\<partial>count_space UNIV\"\n      by(simp add: nn_integral_spmf space_measure_spmf measure_spmf.emeasure_eq_measure)\n    also have \"\\<dots> = (\\<integral>\\<^sup>+ y. ennreal (spmf p y) * indicator (- {x}) y \\<partial>count_space UNIV) +\n      (\\<integral>\\<^sup>+ y. spmf p y * indicator {x} y \\<partial>count_space UNIV)\"\n      by(subst nn_integral_add[symmetric])(auto intro!: nn_integral_cong split: split_indicator)\n    also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+ y. ennreal (f y) * indicator (- {x}) y \\<partial>count_space UNIV) + spmf p x\"\n      using ub by(intro add_mono nn_integral_mono)(auto split: split_indicator intro: ennreal_leI)\n    also have \"\\<dots> < (\\<integral>\\<^sup>+ y. ennreal (f y) * indicator (- {x}) y \\<partial>count_space UNIV) + (\\<integral>\\<^sup>+ y. f y * indicator {x} y \\<partial>count_space UNIV)\"\n      using * x by(simp add: ennreal_less_iff)\n    also have \"\\<dots> = (\\<integral>\\<^sup>+ y. ennreal (f y) \\<partial>count_space UNIV)\"\n      by(subst nn_integral_add[symmetric])(auto intro: nn_integral_cong split: split_indicator)\n    also have \"\\<dots> = weight_spmf p\" using sum by simp\n    finally show False by simp\n  qed\n  from this[of x] ub[of x] show ?thesis by simp\nqed\n\nsection \\<open>Probabilistic while loop\\<close>\n\nlocale loop_spmf = \n  fixes guard :: \"'a \\<Rightarrow> bool\"\n  and body :: \"'a \\<Rightarrow> 'a spmf\"\nbegin\n\ncontext notes [[function_internals]] begin\n\npartial_function (spmf) while :: \"'a \\<Rightarrow> 'a spmf\"\nwhere \"while s = (if guard s then bind_spmf (body s) while else return_spmf s)\"\n\nend\n\nlemma while_fixp_induct [case_names adm bottom step]:\n  assumes \"spmf.admissible P\"\n  and \"P (\\<lambda>while. return_pmf None)\"\n  and \"\\<And>while'. P while' \\<Longrightarrow> P (\\<lambda>s. if guard s then body s \\<bind> while' else return_spmf s)\"\n  shows \"P while\"\n  using assms by(rule while.fixp_induct)\n\nlemma while_simps:\n  \"guard s \\<Longrightarrow> while s = bind_spmf (body s) while\"\n  \"\\<not> guard s \\<Longrightarrow> while s = return_spmf s\"\nby(rewrite while.simps; simp; fail)+\n\nend\n\nlemma while_spmf_parametric [transfer_rule]:\n  includes lifting_syntax shows\n  \"((S ===> (=)) ===> (S ===> rel_spmf S) ===> S ===> rel_spmf S) loop_spmf.while loop_spmf.while\"\nunfolding loop_spmf.while_def[abs_def]\napply(rule rel_funI)\napply(rule rel_funI)\napply(rule fixp_spmf_parametric[OF loop_spmf.while.mono loop_spmf.while.mono])\nsubgoal premises [transfer_rule] by transfer_prover\ndone\n\nlemma loop_spmf_while_cong:\n  \"\\<lbrakk> guard = guard'; \\<And>s. guard' s \\<Longrightarrow> body s = body' s \\<rbrakk>\n  \\<Longrightarrow> loop_spmf.while guard body = loop_spmf.while guard' body'\"\nunfolding loop_spmf.while_def[abs_def] by(simp cong: if_cong)\n\nsection \\<open>Rules for probabilistic termination\\<close>\n\ncontext loop_spmf begin\n\nsubsection \\<open>0/1 termination laws\\<close>\n\nlemma termination_0_1_immediate:\n  assumes p: \"\\<And>s. guard s \\<Longrightarrow> spmf (map_spmf guard (body s)) False \\<ge> p\"\n  and p_pos: \"0 < p\"\n  and lossless: \"\\<And>s. guard s \\<Longrightarrow> lossless_spmf (body s)\"\n  shows \"lossless_spmf (while s)\"\nproof -\n  have \"\\<forall>s. lossless_spmf (while s)\"\n  proof(rule ccontr)\n    assume \"\\<not> ?thesis\"\n    then obtain s where s: \"\\<not> lossless_spmf (while s)\" by blast\n    hence True: \"guard s\" by(simp add: while.simps split: if_split_asm)\n\n    from p[OF this] have p_le_1: \"p \\<le> 1\" using pmf_le_1 by(rule order_trans)\n    have new_bound: \"p * (1 - k) + k \\<le> weight_spmf (while s)\" \n      if k: \"0 \\<le> k\" \"k \\<le> 1\" and k_le: \"\\<And>s. k \\<le> weight_spmf (while s)\" for k s\n    proof(cases \"guard s\")\n      case False\n      have \"p * (1 - k) + k \\<le> 1 * (1 - k) + k\" using p_le_1 k by(intro mult_right_mono add_mono; simp)\n      also have \"\\<dots> \\<le> 1\" by simp\n      finally show ?thesis using False by(simp add: while.simps)\n    next\n      case True\n      let ?M = \"\\<lambda>s. measure_spmf (body s)\"\n      have bounded: \"\\<bar>\\<integral> s''. weight_spmf (while s'') \\<partial>?M s'\\<bar> \\<le> 1\" for s'\n        using integral_nonneg_AE[of \"\\<lambda>s''. weight_spmf (while s'')\" \"?M s'\"]\n        by(auto simp add: weight_spmf_nonneg weight_spmf_le_1 intro!: measure_spmf.nn_integral_le_const integral_real_bounded)\n      have \"p \\<le> measure (?M s) {s'. \\<not> guard s'}\" using p[OF True]\n        by(simp add: spmf_conv_measure_spmf measure_map_spmf vimage_def)\n      hence \"p * (1 - k) + k \\<le> measure (?M s) {s'. \\<not> guard s'} * (1 - k) + k\"\n        using k by(intro add_mono mult_right_mono)(simp_all)\n      also have \"\\<dots> = \\<integral> s'. indicator {s'. \\<not> guard s'} s' * (1 - k) +  k \\<partial>?M s\"\n        using True by(simp add: ennreal_less_top_iff lossless lossless_weight_spmfD)\n      also have \"\\<dots> = \\<integral> s'. indicator {s'. \\<not> guard s'} s' + indicator {s'. guard s'} s' * k \\<partial>?M s\"\n        by(rule Bochner_Integration.integral_cong)(simp_all split: split_indicator)\n      also have \"\\<dots> = \\<integral> s'. indicator {s'. \\<not> guard s'} s' + indicator {s'. guard s'} s' * \\<integral> s''. k \\<partial>?M s' \\<partial>?M s\"\n        by(rule Bochner_Integration.integral_cong)(auto simp add: lossless lossless_weight_spmfD split: split_indicator)\n      also have \"\\<dots> \\<le> \\<integral> s'. indicator {s'. \\<not> guard s'} s' + indicator {s'. guard s'} s' * \\<integral> s''. weight_spmf (while s'') \\<partial>?M s' \\<partial>?M s\"\n        using k bounded\n        by(intro integral_mono integrable_add measure_spmf.integrable_const_bound[where B=1] add_mono mult_left_mono)\n          (simp_all add: weight_spmf_nonneg weight_spmf_le_1 mult_le_one k_le split: split_indicator)\n      also have \"\\<dots> = \\<integral>s'. (if \\<not> guard s' then 1 else \\<integral> s''. weight_spmf (while s'') \\<partial>?M s') \\<partial>?M s\"\n        by(rule Bochner_Integration.integral_cong)(simp_all split: split_indicator)\n      also have \"\\<dots> = \\<integral> s'. weight_spmf (while s') \\<partial>measure_spmf (body s)\"\n        by(rule Bochner_Integration.integral_cong; simp add: while.simps weight_bind_spmf o_def)\n      also have \"\\<dots> = weight_spmf (while s)\" using True\n        by(simp add: while.simps weight_bind_spmf o_def)\n      finally show ?thesis .\n    qed\n\n    define k where \"k \\<equiv> INF s. weight_spmf (while s)\"\n    define k' where \"k' \\<equiv> p * (1 - k) + k\"\n    from s have \"weight_spmf (while s) < 1\"\n      using weight_spmf_le_1[of \"while s\"] by(simp add: lossless_spmf_def)\n    then have \"k < 1\"\n      unfolding k_def by(rewrite cINF_less_iff)(auto intro!: bdd_belowI2 weight_spmf_nonneg)\n\n    have \"0 \\<le> k\" unfolding k_def by(auto intro: cINF_greatest simp add: weight_spmf_nonneg)\n    moreover from \\<open>k < 1\\<close> have \"k \\<le> 1\" by simp\n    moreover have \"k \\<le> weight_spmf (while s)\" for s unfolding k_def\n      by(rule cINF_lower)(auto intro!: bdd_belowI2 weight_spmf_nonneg)\n    ultimately have \"\\<And>s. k' \\<le> weight_spmf (while s)\"\n      unfolding k'_def by(rule new_bound)\n    hence \"k' \\<le> k\" unfolding k_def by(auto intro: cINF_greatest)\n    also have \"k < k'\" using p_pos \\<open>k < 1\\<close> by(auto simp add: k'_def)\n    finally show False by simp\n  qed\n  thus ?thesis by blast\nqed\n\nprimrec iter :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a spmf\"\nwhere\n  \"iter 0 s = return_spmf s\"\n| \"iter (Suc n) s = (if guard s then bind_spmf (body s) (iter n) else return_spmf s)\"\n\nlemma iter_unguarded [simp]: \"\\<not> guard s \\<Longrightarrow> iter n s = return_spmf s\"\n  by(induction n) simp_all\n  \nlemma iter_bind_iter: \"bind_spmf (iter m s) (iter n) = iter (m + n) s\"\n  by(induction m arbitrary: s) simp_all\n\nlemma iter_Suc2: \"iter (Suc n) s = bind_spmf (iter n s) (\\<lambda>s. if guard s then body s else return_spmf s)\"\n  using iter_bind_iter[of n s 1, symmetric]\n  by(simp del: iter.simps)(rule bind_spmf_cong; simp cong: bind_spmf_cong)\n\nlemma lossless_iter: \"(\\<And>s. guard s \\<Longrightarrow> lossless_spmf (body s)) \\<Longrightarrow> lossless_spmf (iter n s)\"\n  by(induction n arbitrary: s) simp_all\n\nlemma iter_mono_emeasure1:\n  \"emeasure (measure_spmf (iter n s)) {s. \\<not> guard s} \\<le> emeasure (measure_spmf (iter (Suc n) s)) {s. \\<not> guard s}\"\n  (is \"?lhs \\<le> ?rhs\")\nproof(cases \"guard s\")\n  case True\n  have \"?lhs = emeasure (measure_spmf (bind_spmf (iter n s) return_spmf)) {s. \\<not> guard s}\" by simp\n  also have \"\\<dots> = \\<integral>\\<^sup>+ s'. emeasure (measure_spmf (return_spmf s')) {s. \\<not> guard s} \\<partial>measure_spmf (iter n s)\"\n    by(simp del: bind_return_spmf add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n  also have \"\\<dots> \\<le> \\<integral>\\<^sup>+ s'. emeasure (measure_spmf (if guard s' then body s' else return_spmf s')) {s. \\<not> guard s} \\<partial>measure_spmf (iter n s)\"\n    by(rule nn_integral_mono)(simp add: measure_spmf_return_spmf)\n  also have \"\\<dots> = ?rhs\"\n    by(simp add: iter_Suc2 measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra del: iter.simps)\n  finally show ?thesis .\nqed simp\n\nlemma weight_while_conv_iter:\n  \"weight_spmf (while s) = (SUP n. measure (measure_spmf (iter n s)) {s. \\<not> guard s})\"\n  (is \"?lhs = ?rhs\")\nproof(rule antisym)\n  have \"emeasure (measure_spmf (while s)) UNIV \\<le> (SUP n. emeasure (measure_spmf (iter n s)) {s. \\<not> guard s})\"\n    (is \"_ \\<le> (SUP n. ?f n s)\")\n  proof(induction arbitrary: s rule: while_fixp_induct)\n    case adm show ?case by simp\n    case bottom show ?case by simp\n    case (step while')\n    show ?case (is \"?lhs' \\<le> ?rhs'\")\n    proof(cases \"guard s\")\n      case True\n      have inc: \"incseq ?f\" by(rule incseq_SucI le_funI iter_mono_emeasure1)+\n\n      from True have \"?lhs' = \\<integral>\\<^sup>+ s'. emeasure (measure_spmf (while' s')) UNIV \\<partial>measure_spmf (body s)\"\n        by(simp add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n      also have \"\\<dots> \\<le> \\<integral>\\<^sup>+ s'. (SUP n. ?f n s') \\<partial>measure_spmf (body s)\"\n        by(rule nn_integral_mono)(rule step.IH)\n      also have \"\\<dots> = (SUP n. \\<integral>\\<^sup>+ s'. ?f n s' \\<partial>measure_spmf (body s))\" using inc\n        by(subst nn_integral_monotone_convergence_SUP) simp_all\n      also have \"\\<dots> = (SUP n. ?f (Suc n) s)\" using True\n        by(simp add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n      also have \"\\<dots> \\<le> (SUP n. ?f n s)\"\n        by(rule SUP_mono)(auto intro: exI[where x=\"Suc _\"])\n      finally show ?thesis .\n    next\n      case False\n      then have \"?lhs' = emeasure (measure_spmf (iter 0 s)) {s. \\<not> guard s}\" \n        by(simp add: measure_spmf_return_spmf)\n      also have \\<open>\\<dots> \\<le> ?rhs'\\<close> by(rule SUP_upper) simp\n      finally show ?thesis .\n    qed\n  qed\n  also have \"\\<dots> = ennreal (SUP n. measure (measure_spmf (iter n s)) {s. \\<not> guard s})\"\n    by(subst ennreal_SUP)(fold measure_spmf.emeasure_eq_measure, auto simp add: not_less measure_spmf.subprob_emeasure_le_1 intro!: exI[where x=\"1\"])\n  also have \"0 \\<le> (SUP n. measure (measure_spmf (iter n s)) {s. \\<not> guard s})\"\n    by(rule cSUP_upper2)(auto intro!: bdd_aboveI[where M=1] simp add: measure_spmf.subprob_measure_le_1)\n  ultimately show \"?lhs \\<le> ?rhs\" by(simp add: measure_spmf.emeasure_eq_measure space_measure_spmf)\n  \n  show \"?rhs \\<le> ?lhs\"\n  proof(rule cSUP_least)\n    show \"measure (measure_spmf (iter n s)) {s. \\<not> guard s} \\<le> weight_spmf (while s)\" (is \"?f n s \\<le> _\") for n\n    proof(induction n arbitrary: s)\n      case 0 show ?case\n        by(simp add: measure_spmf_return_spmf measure_return while_simps split: split_indicator)\n    next\n      case (Suc n)\n      show ?case\n      proof(cases \"guard s\")\n        case True\n        have \"?f (Suc n) s = \\<integral>\\<^sup>+ s'. ?f n s' \\<partial>measure_spmf (body s)\"\n          using True unfolding measure_spmf.emeasure_eq_measure[symmetric]\n          by(simp add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n        also have \"\\<dots> \\<le> \\<integral>\\<^sup>+ s'. weight_spmf (while s') \\<partial>measure_spmf (body s)\"\n          by(rule nn_integral_mono ennreal_leI Suc.IH)+\n        also have \"\\<dots> = weight_spmf (while s)\"\n          using True unfolding measure_spmf.emeasure_eq_measure[symmetric] space_measure_spmf\n          by(simp add: while_simps measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n        finally show ?thesis by(simp)\n      next\n        case False then show ?thesis\n          by(simp add: measure_spmf_return_spmf measure_return while_simps split: split_indicator)\n      qed\n    qed\n  qed simp\nqed\n\nlemma termination_0_1:\n  assumes p: \"\\<And>s. guard s \\<Longrightarrow> p \\<le> weight_spmf (while s)\"\n    and p_pos: \"0 < p\"\n    and lossless: \"\\<And>s. guard s \\<Longrightarrow> lossless_spmf (body s)\"\n  shows \"lossless_spmf (while s)\"\n  unfolding lossless_spmf_def\nproof(rule antisym)\n  let ?X = \"{s. \\<not> guard s}\"\n  show \"weight_spmf (while s) \\<le> 1\" by(rule weight_spmf_le_1)\n  \n  define p' where \"p' \\<equiv> p / 2\"\n  have p'_pos: \"p' > 0\" and \"p' < p\" using p_pos by(simp_all add: p'_def)\n  \n  have \"\\<exists>n. p' < measure (measure_spmf (iter n s)) ?X\" if \"guard s\" for s using p[OF that] \\<open>p' < p\\<close>\n    unfolding weight_while_conv_iter\n    by(subst (asm) le_cSUP_iff)(auto intro!: measure_spmf.subprob_measure_le_1)\n  then obtain N where p': \"p' \\<le> measure (measure_spmf (iter (N s) s)) ?X\" if \"guard s\" for s\n    using p by atomize_elim(rule choice, force dest: order.strict_implies_order)\n\n  interpret fuse: loop_spmf guard \"\\<lambda>s. iter (N s) s\" .\n  \n  have \"1 = weight_spmf (fuse.while s)\"\n    by(rule lossless_weight_spmfD[symmetric])\n      (rule fuse.termination_0_1_immediate; auto simp add: spmf_map vimage_def intro: p' p'_pos lossless_iter lossless)\n  also have \"\\<dots> \\<le> (\\<Squnion>n. measure (measure_spmf (iter n s)) ?X)\"\n    unfolding fuse.weight_while_conv_iter\n  proof(rule cSUP_least)\n    fix n\n    have \"emeasure (measure_spmf (fuse.iter n s)) ?X \\<le> (SUP n. emeasure (measure_spmf (iter n s)) ?X)\"\n    proof(induction n arbitrary: s)\n      case 0 show ?case by(auto intro!: SUP_upper2[where i=0])\n    next\n      case (Suc n)\n      have inc: \"incseq (\\<lambda>n s'. emeasure (measure_spmf (iter n s')) ?X)\"\n        by(rule incseq_SucI le_funI iter_mono_emeasure1)+\n\n      have \"emeasure (measure_spmf (fuse.iter (Suc n) s)) ?X = emeasure (measure_spmf (iter (N s) s \\<bind> fuse.iter n)) ?X\"\n        by simp\n      also have \"\\<dots> = \\<integral>\\<^sup>+ s'. emeasure (measure_spmf (fuse.iter n s')) ?X \\<partial>measure_spmf (iter (N s) s)\"\n        by(simp add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n      also have \"\\<dots> \\<le> \\<integral>\\<^sup>+ s'. (SUP n. emeasure (measure_spmf (iter n s')) ?X) \\<partial>measure_spmf (iter (N s) s)\"\n        by(rule nn_integral_mono Suc.IH)+\n      also have \"\\<dots> = (SUP n. \\<integral>\\<^sup>+ s'. emeasure (measure_spmf (iter n s')) ?X \\<partial>measure_spmf (iter (N s) s))\"\n        by(rule nn_integral_monotone_convergence_SUP[OF inc]) simp\n      also have \"\\<dots> = (SUP n. emeasure (measure_spmf (bind_spmf (iter (N s) s) (iter n))) ?X)\"\n        by(simp add: measure_spmf_bind o_def emeasure_bind[where N=\"measure_spmf _\"] space_measure_spmf Pi_def space_subprob_algebra)\n      also have \"\\<dots> = (SUP n. emeasure (measure_spmf (iter (N s + n) s)) ?X)\" by(simp add: iter_bind_iter)\n      also have \"\\<dots> \\<le> (SUP n. emeasure (measure_spmf (iter n s)) ?X)\" by(rule SUP_mono) auto\n      finally show ?case .\n    qed\n    also have \"\\<dots> = ennreal (SUP n. measure (measure_spmf (iter n s)) ?X)\"\n      by(subst ennreal_SUP)(fold measure_spmf.emeasure_eq_measure, auto simp add: not_less measure_spmf.subprob_emeasure_le_1 intro!: exI[where x=\"1\"])\n    also have \"0 \\<le> (SUP n. measure (measure_spmf (iter n s)) ?X)\"\n      by(rule cSUP_upper2)(auto intro!: bdd_aboveI[where M=1] simp add: measure_spmf.subprob_measure_le_1)\n    ultimately show \"measure (measure_spmf (fuse.iter n s)) ?X \\<le> \\<dots>\"\n      by(simp add: measure_spmf.emeasure_eq_measure)\n  qed simp\n  finally show  \"1 \\<le> weight_spmf (while s)\" unfolding weight_while_conv_iter .\nqed\n\nend\n\nlemma termination_0_1_immediate_invar:\n  fixes I :: \"'s \\<Rightarrow> bool\"\n  assumes p: \"\\<And>s. \\<lbrakk> guard s; I s \\<rbrakk> \\<Longrightarrow> spmf (map_spmf guard (body s)) False \\<ge> p\"\n  and p_pos: \"0 < p\"\n  and lossless: \"\\<And>s. \\<lbrakk> guard s; I s \\<rbrakk> \\<Longrightarrow> lossless_spmf (body s)\"\n  and invar: \"\\<And>s s'. \\<lbrakk> s' \\<in> set_spmf (body s); I s; guard s \\<rbrakk> \\<Longrightarrow> I s'\"\n  and I: \"I s\"\n  shows \"lossless_spmf (loop_spmf.while guard body s)\"\n  including lifting_syntax\nproof -\n  { assume \"\\<exists>(Rep :: 's' \\<Rightarrow> 's) Abs. type_definition Rep Abs {s. I s}\"\n    then obtain Rep :: \"'s' \\<Rightarrow> 's\" and Abs where td: \"type_definition Rep Abs {s. I s}\" by blast\n    then interpret td: type_definition Rep Abs \"{s. I s}\" .\n    define cr where \"cr \\<equiv> \\<lambda>x y. x = Rep y\"\n    have [transfer_rule]: \"bi_unique cr\" \"right_total cr\" using td cr_def by(rule typedef_bi_unique typedef_right_total)+\n    have [transfer_domain_rule]: \"Domainp cr = I\" using type_definition_Domainp[OF td cr_def] by simp\n\n    define guard' where \"guard' \\<equiv> (Rep ---> id) guard\"\n    have [transfer_rule]: \"(cr ===> (=)) guard guard'\" by(simp add: rel_fun_def cr_def guard'_def)\n    define body1 where \"body1 \\<equiv> \\<lambda>s. if guard s then body s else return_pmf None\"\n    define body1' where \"body1' \\<equiv> (Rep ---> map_spmf Abs) body1\"\n    have [transfer_rule]: \"(cr ===> rel_spmf cr) body1 body1'\"\n      by(auto simp add: rel_fun_def body1'_def body1_def cr_def spmf_rel_map td.Rep[simplified] invar td.Abs_inverse intro!: rel_spmf_reflI)\n    define s' where \"s' \\<equiv> Abs s\"\n    have [transfer_rule]: \"cr s s'\" by(simp add: s'_def cr_def I td.Abs_inverse)\n\n    have \"\\<And>s. guard' s \\<Longrightarrow> p \\<le> spmf (map_spmf guard' (body1' s)) False\"\n      by(transfer fixing: p)(simp add: body1_def p)\n    moreover note p_pos\n    moreover have \"\\<And>s. guard' s \\<Longrightarrow> lossless_spmf (body1' s)\" by transfer(simp add: lossless body1_def)\n    ultimately have \"lossless_spmf (loop_spmf.while guard' body1' s')\" by(rule loop_spmf.termination_0_1_immediate)\n    hence \"lossless_spmf (loop_spmf.while guard body1 s)\" by transfer }\n  from this[cancel_type_definition] I show ?thesis by(auto cong: loop_spmf_while_cong)\nqed\n\nlemma termination_0_1_invar:\n  fixes I :: \"'s \\<Rightarrow> bool\"\n  assumes p: \"\\<And>s. \\<lbrakk> guard s; I s \\<rbrakk> \\<Longrightarrow> p \\<le> weight_spmf (loop_spmf.while guard body s)\"\n    and p_pos: \"0 < p\"\n    and lossless: \"\\<And>s. \\<lbrakk> guard s; I s \\<rbrakk> \\<Longrightarrow> lossless_spmf (body s)\"\n    and invar: \"\\<And>s s'. \\<lbrakk> s' \\<in> set_spmf (body s); I s; guard s \\<rbrakk> \\<Longrightarrow> I s'\"\n    and I: \"I s\"\n  shows \"lossless_spmf (loop_spmf.while guard body s)\"\n  including lifting_syntax\nproof-\n  { assume \"\\<exists>(Rep :: 's' \\<Rightarrow> 's) Abs. type_definition Rep Abs {s. I s}\"\n    then obtain Rep :: \"'s' \\<Rightarrow> 's\" and Abs where td: \"type_definition Rep Abs {s. I s}\" by blast\n    then interpret td: type_definition Rep Abs \"{s. I s}\" .\n    define cr where \"cr \\<equiv> \\<lambda>x y. x = Rep y\"\n    have [transfer_rule]: \"bi_unique cr\" \"right_total cr\" using td cr_def by(rule typedef_bi_unique typedef_right_total)+\n    have [transfer_domain_rule]: \"Domainp cr = I\" using type_definition_Domainp[OF td cr_def] by simp\n\n    define guard' where \"guard' \\<equiv> (Rep ---> id) guard\"\n    have [transfer_rule]: \"(cr ===> (=)) guard guard'\" by(simp add: rel_fun_def cr_def guard'_def)\n    define body1 where \"body1 \\<equiv> \\<lambda>s. if guard s then body s else return_pmf None\"\n    define body1' where \"body1' \\<equiv> (Rep ---> map_spmf Abs) body1\"\n    have [transfer_rule]: \"(cr ===> rel_spmf cr) body1 body1'\"\n      by(auto simp add: rel_fun_def body1'_def body1_def cr_def spmf_rel_map td.Rep[simplified] invar td.Abs_inverse intro!: rel_spmf_reflI)\n    define s' where \"s' \\<equiv> Abs s\"\n    have [transfer_rule]: \"cr s s'\" by(simp add: s'_def cr_def I td.Abs_inverse)\n    \n    interpret loop_spmf guard' body1' .\n\n    note UNIV_parametric_pred[transfer_rule]\n    have \"\\<And>s. guard' s \\<Longrightarrow> p \\<le> weight_spmf (while s)\"\n      unfolding measure_measure_spmf_def[symmetric] space_measure_spmf\n      by(transfer fixing: p)(simp add: body1_def p[simplified space_measure_spmf] cong: loop_spmf_while_cong)\n    moreover note p_pos\n    moreover have \"\\<And>s. guard' s \\<Longrightarrow> lossless_spmf (body1' s)\" by transfer(simp add: lossless body1_def)\n    ultimately have \"lossless_spmf (while s')\" by(rule termination_0_1)\n    hence \"lossless_spmf (loop_spmf.while guard body1 s)\" by transfer }\n  from this[cancel_type_definition] I show ?thesis by(auto cong: loop_spmf_while_cong)\nqed\n\nsubsection \\<open>Variant rule\\<close>\n\ncontext loop_spmf begin\n\nlemma termination_variant:\n  fixes bound :: nat\n  assumes bound: \"\\<And>s. guard s \\<Longrightarrow> f s \\<le> bound\"\n  and step: \"\\<And>s. guard s \\<Longrightarrow> p \\<le> spmf (map_spmf (\\<lambda>s'. f s' < f s) (body s)) True\"\n  and p_pos: \"0 < p\"\n  and lossless: \"\\<And>s. guard s \\<Longrightarrow> lossless_spmf (body s)\"\n  shows \"lossless_spmf (while s)\"\nproof -\n  define p' and n where \"p' \\<equiv> min p 1\" and \"n \\<equiv> bound + 1\"\n  have p'_pos: \"0 < p'\" and p'_le_1: \"p' \\<le> 1\" \n    and step': \"guard s \\<Longrightarrow> p' \\<le> measure (measure_spmf (body s)) {s'. f s' < f s}\" for s\n    using p_pos step[of s] by(simp_all add: p'_def spmf_map vimage_def)\n  have \"p' ^ n \\<le> weight_spmf (while s)\" if \"f s < n\" for s using that\n  proof(induction n arbitrary: s)\n    case 0 thus ?case by simp\n  next\n    case (Suc n)\n    show ?case\n    proof(cases \"guard s\")\n      case False\n      hence \"weight_spmf (while s) = 1\" by(simp add: while.simps)\n      thus ?thesis using p'_le_1 p_pos \n        by simp(meson less_eq_real_def mult_le_one p'_pos power_le_one zero_le_power)\n    next\n      case True\n      let ?M = \"measure_spmf (body s)\"\n      have \"p' ^ Suc n \\<le> (\\<integral> s'. indicator {s'. f s' < f s} s' \\<partial>?M) * p' ^ n\"\n        using step'[OF True] p'_pos by(simp add: mult_right_mono)\n      also have \"\\<dots> = (\\<integral> s'. indicator {s'. f s' < f s} s' * p' ^ n \\<partial>?M)\" by simp\n      also have \"\\<dots> \\<le> (\\<integral> s'. indicator {s'. f s' < f s} s' * weight_spmf (while s') \\<partial>?M)\"\n        using Suc.prems p'_le_1 p'_pos\n        by(intro integral_mono)(auto simp add: Suc.IH power_le_one weight_spmf_le_1 split: split_indicator intro!: measure_spmf.integrable_const_bound[where B=1])\n      also have \"\\<dots> \\<le> \\<dots> + (\\<integral> s'. indicator {s'. f s' \\<ge> f s} s' * weight_spmf (while s') \\<partial>?M)\"\n        by(simp add: integral_nonneg_AE weight_spmf_nonneg)\n      also have \"\\<dots> = \\<integral> s'. weight_spmf (while s') \\<partial>?M\"\n        by(subst Bochner_Integration.integral_add[symmetric])\n          (auto intro!: Bochner_Integration.integral_cong measure_spmf.integrable_const_bound[where B=1] weight_spmf_le_1 split: split_indicator)\n      also have \"\\<dots> = weight_spmf (while s)\"\n        using True by(subst (1 2) while.simps)(simp add: weight_bind_spmf o_def)\n      finally show ?thesis .\n    qed\n  qed\n  moreover have \"0 < p' ^ n\" using p'_pos by simp\n  ultimately show ?thesis using lossless\n  proof(rule termination_0_1_invar)\n    show \"f s < n\" if \"guard s\" \"guard s \\<longrightarrow> f s < n\" for s using that by simp\n    show \"guard s \\<longrightarrow> f s < n\" using bound[of s] by(auto simp add: n_def)\n    show \"guard s' \\<longrightarrow> f s' < n\" for s' using bound[of s'] by(clarsimp simp add: n_def)\n  qed\nqed\n\nend\n\nlemma termination_variant_invar:\n  fixes bound :: nat and I :: \"'s \\<Rightarrow> bool\"\n  assumes bound: \"\\<And>s. \\<lbrakk> guard s; I s \\<rbrakk> \\<Longrightarrow> f s \\<le> bound\"\n  and step: \"\\<And>s. \\<lbrakk> guard s; I s \\<rbrakk> \\<Longrightarrow> p \\<le> spmf (map_spmf (\\<lambda>s'. f s' < f s) (body s)) True\"\n  and p_pos: \"0 < p\"\n  and lossless: \"\\<And>s. \\<lbrakk> guard s; I s \\<rbrakk> \\<Longrightarrow> lossless_spmf (body s)\"\n  and invar: \"\\<And>s s'. \\<lbrakk> s' \\<in> set_spmf (body s); I s; guard s \\<rbrakk> \\<Longrightarrow> I s'\"\n  and I: \"I s\"\n  shows \"lossless_spmf (loop_spmf.while guard body s)\"\n  including lifting_syntax\nproof -\n  { assume \"\\<exists>(Rep :: 's' \\<Rightarrow> 's) Abs. type_definition Rep Abs {s. I s}\"\n    then obtain Rep :: \"'s' \\<Rightarrow> 's\" and Abs where td: \"type_definition Rep Abs {s. I s}\" by blast\n    then interpret td: type_definition Rep Abs \"{s. I s}\" .\n    define cr where \"cr \\<equiv> \\<lambda>x y. x = Rep y\"\n    have [transfer_rule]: \"bi_unique cr\" \"right_total cr\" using td cr_def by(rule typedef_bi_unique typedef_right_total)+\n    have [transfer_domain_rule]: \"Domainp cr = I\" using type_definition_Domainp[OF td cr_def] by simp\n\n    define guard' where \"guard' \\<equiv> (Rep ---> id) guard\"\n    have [transfer_rule]: \"(cr ===> (=)) guard guard'\" by(simp add: rel_fun_def cr_def guard'_def)\n    define body1 where \"body1 \\<equiv> \\<lambda>s. if guard s then body s else return_pmf None\"\n    define body1' where \"body1' \\<equiv> (Rep ---> map_spmf Abs) body1\"\n    have [transfer_rule]: \"(cr ===> rel_spmf cr) body1 body1'\"\n      by(auto simp add: rel_fun_def body1'_def body1_def cr_def spmf_rel_map td.Rep[simplified] invar td.Abs_inverse intro!: rel_spmf_reflI)\n    define s' where \"s' \\<equiv> Abs s\"\n    have [transfer_rule]: \"cr s s'\" by(simp add: s'_def cr_def I td.Abs_inverse)\n    define f' where \"f' \\<equiv> (Rep ---> id) f\"\n    have [transfer_rule]: \"(cr ===> (=)) f f'\" by(simp add: rel_fun_def cr_def f'_def)\n\n    have \"\\<And>s. guard' s \\<Longrightarrow> f' s \\<le> bound\" by(transfer fixing: bound)(rule bound)\n    moreover have \"\\<And>s. guard' s \\<Longrightarrow> p \\<le> spmf (map_spmf (\\<lambda>s'. f' s' < f' s) (body1' s)) True\"\n      by(transfer fixing: p)(simp add: step body1_def)\n    note this p_pos\n    moreover have \"\\<And>s. guard' s \\<Longrightarrow> lossless_spmf (body1' s)\"\n      by transfer(simp add: body1_def lossless)\n    ultimately have \"lossless_spmf (loop_spmf.while guard' body1' s')\" by(rule loop_spmf.termination_variant)\n    hence \"lossless_spmf (loop_spmf.while guard body1 s)\" by transfer }\n  from this[cancel_type_definition] I show ?thesis by(auto cong: loop_spmf_while_cong)\nqed\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Probabilistic_While/While_SPMF.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3481511269961152}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * Contributions by:\n *   2012 Lars Noschinski <noschinl@in.tum.de>\n *     Option monad while loop formalisation.\n *)\n\ntheory OptionMonad\nimports \"../Lib\" (* FIXME: reduce dependencies *)\nbegin\n\ntype_synonym ('s,'a) lookup = \"'s \\<Rightarrow> 'a option\"\n\ntext {* Similar to map_option but the second function returns option as well *}\ndefinition\n  opt_map :: \"('s,'a) lookup \\<Rightarrow> ('a \\<Rightarrow> 'b option) \\<Rightarrow> ('s,'b) lookup\" (infixl \"|>\" 54)\nwhere\n  \"f |> g \\<equiv> \\<lambda>s. case f s of None \\<Rightarrow> None | Some x \\<Rightarrow> g x\"\n\nlemma opt_map_cong [fundef_cong]:\n  \"\\<lbrakk> f = f'; \\<And>v s. f s = Some v \\<Longrightarrow> g v = g' v\\<rbrakk> \\<Longrightarrow> f |> g = f' |> g'\"\n  by (rule ext) (simp add: opt_map_def split: option.splits)\n\nlemma in_opt_map_eq:\n  \"((f |> g) s = Some v) = (\\<exists>v'. f s = Some v' \\<and> g v' = Some v)\"\n  by (simp add: opt_map_def split: option.splits)\n\nlemma opt_mapE:\n  \"\\<lbrakk> (f |> g) s = Some v; \\<And>v'. \\<lbrakk>f s = Some v'; g v' = Some v \\<rbrakk> \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp: in_opt_map_eq)\n\n\ndefinition\n  obind :: \"('s,'a) lookup \\<Rightarrow> ('a \\<Rightarrow> ('s,'b) lookup) \\<Rightarrow> ('s,'b) lookup\" (infixl \"|>>\" 53)\nwhere\n  \"f |>> g \\<equiv> \\<lambda>s. case f s of None \\<Rightarrow> None | Some x \\<Rightarrow> g x s\"\n\ndefinition\n  \"ofail = K None\"\n\ndefinition\n  \"oreturn = K o Some\"\n\ndefinition\n  \"oassert P \\<equiv> if P then oreturn () else ofail\"\n\ntext {* \n  If the result can be an exception.\n  Corresponding bindE would be analogous to lifting in NonDetMonad.\n*}\n\ndefinition\n  \"oreturnOk x = K (Some (Inr x))\"\n\ndefinition\n  \"othrow e = K (Some (Inl e))\"\n\ndefinition\n  \"oguard G \\<equiv> (\\<lambda>s. if G s then Some () else None)\"\n\ndefinition\n  \"ocondition c L R \\<equiv> (\\<lambda>s. if c s then L s else R s)\"\n\ndefinition\n  \"oskip \\<equiv> oreturn ()\"\n\ntext {* Monad laws *}\nlemma oreturn_bind [simp]: \"(oreturn x |>> f) = f x\"\n  by (auto simp add: oreturn_def obind_def K_def)\n\nlemma obind_return [simp]: \"(m |>> oreturn) = m\"\n  by (auto simp add: oreturn_def obind_def K_def split: option.splits)\n \nlemma obind_assoc: \n  \"(m |>> f) |>> g  =  m |>> (\\<lambda>x. f x |>> g)\"\n  by (auto simp add: oreturn_def obind_def K_def split: option.splits)\n\n\ntext {* Binding fail *}\n\nlemma obind_fail [simp]:\n  \"f |>> (\\<lambda>_. ofail) = ofail\"\n  by (auto simp add: ofail_def obind_def K_def split: option.splits)\n\nlemma ofail_bind [simp]:\n  \"ofail |>> m = ofail\"\n  by (auto simp add: ofail_def obind_def K_def split: option.splits)\n\n\n\ntext {* Function package setup *}\nlemma opt_bind_cong [fundef_cong]:\n  \"\\<lbrakk> f = f'; \\<And>v s. f' s = Some v \\<Longrightarrow> g v s = g' v s \\<rbrakk> \\<Longrightarrow> f |>> g = f' |>> g'\"\n  by (rule ext) (simp add: obind_def split: option.splits)\n\nlemma opt_bind_cong_apply [fundef_cong]:\n  \"\\<lbrakk> f s = f' s; \\<And>v. f' s = Some v \\<Longrightarrow> g v s = g' v s \\<rbrakk> \\<Longrightarrow> (f |>> g) s = (f' |>> g') s\"\n  by (simp add: obind_def split: option.splits)\n\nlemma oassert_bind_cong [fundef_cong]:\n  \"\\<lbrakk> P = P'; P' \\<Longrightarrow> m = m' \\<rbrakk> \\<Longrightarrow> oassert P |>> m = oassert P' |>> m'\"\n  by (auto simp: oassert_def)\n\nlemma oassert_bind_cong_apply [fundef_cong]:\n  \"\\<lbrakk> P = P'; P' \\<Longrightarrow> m () s = m' () s \\<rbrakk> \\<Longrightarrow> (oassert P |>> m) s = (oassert P' |>> m') s\"\n  by (auto simp: oassert_def)\n\nlemma oreturn_bind_cong [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' = m' x' \\<rbrakk> \\<Longrightarrow> oreturn x |>> m = oreturn x' |>> m'\"\n  by simp\n\nlemma oreturn_bind_cong_apply [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' s = m' x' s \\<rbrakk> \\<Longrightarrow> (oreturn x |>> m) s = (oreturn x' |>> m') s\"\n  by simp\n\nlemma oreturn_bind_cong2 [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' = m' x' \\<rbrakk> \\<Longrightarrow> (oreturn $ x) |>> m = (oreturn $ x') |>> m'\"\n  by simp\n\nlemma oreturn_bind_cong2_apply [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' s = m' x' s \\<rbrakk> \\<Longrightarrow> ((oreturn $ x) |>> m) s = ((oreturn $ x') |>> m') s\"\n  by simp\n\nlemma ocondition_cong [fundef_cong]:\n\"\\<lbrakk>c = c'; \\<And>s. c' s \\<Longrightarrow> l s = l' s; \\<And>s. \\<not>c' s \\<Longrightarrow> r s = r' s\\<rbrakk>\n  \\<Longrightarrow> ocondition c l r = ocondition c' l' r'\"\n  by (auto simp: ocondition_def)\n\n\ntext {* Decomposition *}\n\nlemma ocondition_K_true [simp]:\n  \"ocondition (\\<lambda>_. True) T F = T\"\n  by (simp add: ocondition_def)\n\nlemma ocondition_K_false [simp]:\n  \"ocondition (\\<lambda>_. False) T F = F\"\n  by (simp add: ocondition_def)\n\nlemma ocondition_False:\n    \"\\<lbrakk> \\<And>s. \\<not> P s \\<rbrakk> \\<Longrightarrow> ocondition P L R = R\"\n  by (rule ext, clarsimp simp: ocondition_def)\n\nlemma ocondition_True:\n    \"\\<lbrakk> \\<And>s. P s \\<rbrakk> \\<Longrightarrow> ocondition P L R = L\"\n  by (rule ext, clarsimp simp: ocondition_def)\n\nlemma in_oreturn [simp]:\n  \"(oreturn x s = Some v) = (v = x)\"\n  by (auto simp: oreturn_def K_def)\n\nlemma oreturnE:\n  \"\\<lbrakk>oreturn x s = Some v; v = x \\<Longrightarrow> P x\\<rbrakk> \\<Longrightarrow> P v\"\n  by simp\n\nlemma in_ofail [simp]:\n  \"ofail s \\<noteq> Some v\"\n  by (auto simp: ofail_def K_def)\n\nlemma ofailE:\n  \"ofail s = Some v \\<Longrightarrow> P\"\n  by simp\n\nlemma in_oassert_eq [simp]:\n  \"(oassert P s = Some v) = P\"\n  by (simp add: oassert_def)\n\nlemma oassertE:\n  \"\\<lbrakk> oassert P s = Some v; P \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\n  by simp\n\nlemma in_obind_eq:\n  \"((f |>> g) s = Some v) = (\\<exists>v'. f s = Some v' \\<and> g v' s = Some v)\"\n  by (simp add: obind_def split: option.splits)\n\nlemma obindE:\n  \"\\<lbrakk> (f |>> g) s = Some v; \n     \\<And>v'. \\<lbrakk>f s = Some v'; g v' s = Some v\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp: in_obind_eq)\n\nlemma in_othrow_eq [simp]:\n  \"(othrow e s = Some v) = (v = Inl e)\"\n  by (auto simp: othrow_def K_def) \n\nlemma othrowE:\n  \"\\<lbrakk>othrow e s = Some v; v = Inl e \\<Longrightarrow> P (Inl e)\\<rbrakk> \\<Longrightarrow> P v\"\n  by simp\n\nlemma in_oreturnOk_eq [simp]:\n  \"(oreturnOk x s = Some v) = (v = Inr x)\"\n  by (auto simp: oreturnOk_def K_def) \n\nlemma oreturnOkE:\n  \"\\<lbrakk>oreturnOk x s = Some v; v = Inr x \\<Longrightarrow> P (Inr x)\\<rbrakk> \\<Longrightarrow> P v\"\n  by simp\n\nlemmas omonadE [elim!] =\n  opt_mapE obindE oreturnE ofailE othrowE oreturnOkE oassertE\n\nsection {* \"While\" loops over option monad. *}\n\ntext {*\n  This is an inductive definition of a while loop over the plain option monad\n  (without passing through a state)\n*}\n\ninductive_set\n  option_while' :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'a option) \\<Rightarrow> 'a option rel\"\n  for C B\nwhere\n    final: \"\\<not> C r \\<Longrightarrow> (Some r, Some r) \\<in> option_while' C B\"\n  | fail: \"\\<lbrakk> C r; B r = None \\<rbrakk> \\<Longrightarrow> (Some r, None) \\<in> option_while' C B\"\n  | step: \"\\<lbrakk> C r;  B r = Some r'; (Some r', sr'') \\<in> option_while' C B \\<rbrakk>\n           \\<Longrightarrow> (Some r, sr'') \\<in> option_while' C B\"\n\ndefinition\n  \"option_while C B r \\<equiv>\n    (if (\\<exists>s. (Some r, s) \\<in> option_while' C B) then\n      (THE s. (Some r, s) \\<in> option_while' C B) else None)\"\n\nlemma option_while'_inj:\n  assumes \"(s,s') \\<in> option_while' C B\" \"(s, s'') \\<in> option_while' C B\"\n  shows \"s' = s''\"\n  using assms by (induct rule: option_while'.induct) (auto elim: option_while'.cases)\n\n\n\nlemma option_while'_THE:\n  assumes \"(Some r, sr') \\<in> option_while' C B\"\n  shows \"(THE s. (Some r, s) \\<in> option_while' C B) = sr'\"\n  using assms by (blast dest: option_while'_inj)\n\nlemma option_while_simps:\n  \"\\<not> C s \\<Longrightarrow> option_while C B s = Some s\"\n  \"C s \\<Longrightarrow> B s = None \\<Longrightarrow> option_while C B s = None\"\n  \"C s \\<Longrightarrow> B s = Some s' \\<Longrightarrow> option_while C B s = option_while C B s'\"\n  \"(Some s, ss') \\<in> option_while' C B \\<Longrightarrow> option_while C B s = ss'\"\n  using option_while'_inj_step[of C s B s']\n  by (auto simp: option_while_def option_while'_THE\n      intro: option_while'.intros\n      dest: option_while'_inj\n      elim: option_while'.cases)\n\nlemma option_while_rule:\n  assumes \"option_while C B s = Some s'\"\n  assumes \"I s\"\n  assumes istep: \"\\<And>s s'. C s \\<Longrightarrow> I s \\<Longrightarrow> B s = Some s' \\<Longrightarrow> I s'\"\n  shows \"I s' \\<and> \\<not> C s'\" \nproof -\n  { fix ss ss' assume \"(ss, ss') \\<in> option_while' C B\" \"ss = Some s\" \"ss' = Some s'\"\n    then have ?thesis using `I s`\n      by (induct arbitrary: s) (auto intro: istep) }\n  then show ?thesis using assms(1)\n    by (auto simp: option_while_def option_while'_THE split: if_split_asm)\nqed\n\nlemma option_while'_term:\n  assumes \"I r\"\n  assumes \"wf M\"\n  assumes step_less: \"\\<And>r r'. \\<lbrakk>I r; C r; B r = Some r'\\<rbrakk> \\<Longrightarrow> (r',r) \\<in> M\"\n  assumes step_I: \"\\<And>r r'. \\<lbrakk>I r; C r; B r = Some r'\\<rbrakk> \\<Longrightarrow> I r'\"\n  obtains sr' where \"(Some r, sr') \\<in> option_while' C B\"\n  apply atomize_elim\n  using assms(2,1)\nproof induct\n  case (less r)\n  show ?case\n  proof (cases \"C r\" \"B r\" rule: bool.exhaust[case_product option.exhaust])\n    case (True_Some r')\n    then have \"(r',r) \\<in> M\" \"I r'\"\n      by (auto intro: less step_less step_I)\n    then obtain sr' where \"(Some r', sr') \\<in> option_while' C B\"\n      by atomize_elim (rule less)\n    then have \"(Some r, sr') \\<in> option_while' C B\"\n      using True_Some by (auto intro: option_while'.intros)\n    then show ?thesis ..\n  qed (auto intro: option_while'.intros)\nqed\n\nlemma option_while_rule':\n  assumes \"option_while C B s = ss'\"\n  assumes \"wf M\"\n  assumes \"I (Some s)\"\n  assumes less: \"\\<And>s s'. C s \\<Longrightarrow> I (Some s) \\<Longrightarrow> B s = Some s' \\<Longrightarrow> (s', s) \\<in> M\"\n  assumes step: \"\\<And>s s'. C s \\<Longrightarrow> I (Some s) \\<Longrightarrow> B s = Some s' \\<Longrightarrow> I (Some s')\"\n  assumes final: \"\\<And>s. C s \\<Longrightarrow> I (Some s) \\<Longrightarrow> B s = None \\<Longrightarrow> I None\"\n  shows \"I ss' \\<and> (case ss' of Some s' \\<Rightarrow> \\<not> C s' | _ \\<Rightarrow> True)\" \nproof -\n  def ss \\<equiv> \"Some s\"\n  obtain ss1' where \"(Some s, ss1') \\<in> option_while' C B\"\n    using assms(3,2,4,5) by (rule option_while'_term)\n  then have *: \"(ss, ss') \\<in> option_while' C B\" using `option_while C B s = ss'`\n    by (auto simp: option_while_simps ss_def)\n  show ?thesis\n  proof (cases ss')\n    case (Some s') with * ss_def show ?thesis using `I _`\n      by (induct arbitrary:s) (auto intro: step)\n  next\n    case None with * ss_def show ?thesis using `I _`\n      by (induct arbitrary:s) (auto intro: step final)\n  qed\nqed\n\nsection {* Lift @{term option_while} to the @{typ \"('a,'s) lookup\"} monad  *}\n\ndefinition\n  owhile :: \"('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> ('s,'a) lookup) \\<Rightarrow> 'a \\<Rightarrow> ('s,'a) lookup\"\nwhere\n \"owhile c b a \\<equiv> \\<lambda>s. option_while (\\<lambda>a. c a s) (\\<lambda>a. b a s) a\"\n\nlemma owhile_unroll:\n  \"owhile C B r = ocondition (C r) (B r |>> owhile C B) (oreturn r)\"\n  by (auto simp: ocondition_def obind_def oreturn_def owhile_def\n           option_while_simps K_def split: option.split)\n\ntext {* rule for terminating loops *}\n\nlemma owhile_rule:\n  assumes \"I r s\"\n  assumes \"wf M\"\n  assumes less: \"\\<And>r r'. \\<lbrakk>I r s; C r s; B r s = Some r'\\<rbrakk> \\<Longrightarrow> (r',r) \\<in> M\"\n  assumes step: \"\\<And>r r'. \\<lbrakk>I r s; C r s; B r s = Some r'\\<rbrakk> \\<Longrightarrow> I r' s\"\n  assumes fail: \"\\<And>r r'. \\<lbrakk>I r s; C r s; B r s = None\\<rbrakk> \\<Longrightarrow> Q None\"\n  assumes final: \"\\<And>r. \\<lbrakk>I r s; \\<not>C r s\\<rbrakk> \\<Longrightarrow> Q (Some r)\"\n  shows \"Q (owhile C B r s)\"\nproof -\n  let ?rs' = \"owhile C B r s\"\n  have \"(case ?rs' of Some r \\<Rightarrow> I r s | _ \\<Rightarrow> Q None)\n      \\<and> (case ?rs' of Some r' \\<Rightarrow> \\<not> C r' s | _ \\<Rightarrow> True)\"\n    by (rule option_while_rule'[where B=\"\\<lambda>r. B r s\" and s=r, OF _ `wf _`])\n       (auto simp: owhile_def intro: assms)\n  then show ?thesis by (auto intro: final split: option.split_asm)\nqed\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/lib/Monad_WP/OptionMonad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.3481511269961152}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n(*\n * Contributions by:\n *   2012 Lars Noschinski <noschinl@in.tum.de>\n *     Option monad while loop formalisation.\n *)\n\ntheory OptionMonad\nimports Lib\nbegin\n\ntype_synonym ('s,'a) lookup = \"'s \\<Rightarrow> 'a option\"\n\ntext {* Similar to map_option but the second function returns option as well *}\ndefinition\n  opt_map :: \"('s,'a) lookup \\<Rightarrow> ('a \\<Rightarrow> 'b option) \\<Rightarrow> ('s,'b) lookup\" (infixl \"|>\" 54)\nwhere\n  \"f |> g \\<equiv> \\<lambda>s. case f s of None \\<Rightarrow> None | Some x \\<Rightarrow> g x\"\n\nlemma opt_map_cong [fundef_cong]:\n  \"\\<lbrakk> f = f'; \\<And>v s. f s = Some v \\<Longrightarrow> g v = g' v\\<rbrakk> \\<Longrightarrow> f |> g = f' |> g'\"\n  by (rule ext) (simp add: opt_map_def split: option.splits)\n\nlemma in_opt_map_eq:\n  \"((f |> g) s = Some v) = (\\<exists>v'. f s = Some v' \\<and> g v' = Some v)\"\n  by (simp add: opt_map_def split: option.splits)\n\nlemma opt_mapE:\n  \"\\<lbrakk> (f |> g) s = Some v; \\<And>v'. \\<lbrakk>f s = Some v'; g v' = Some v \\<rbrakk> \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp: in_opt_map_eq)\n\n\ndefinition\n  obind :: \"('s,'a) lookup \\<Rightarrow> ('a \\<Rightarrow> ('s,'b) lookup) \\<Rightarrow> ('s,'b) lookup\" (infixl \"|>>\" 53)\nwhere\n  \"f |>> g \\<equiv> \\<lambda>s. case f s of None \\<Rightarrow> None | Some x \\<Rightarrow> g x s\"\n\ndefinition\n  \"ofail = K None\"\n\ndefinition\n  \"oreturn = K o Some\"\n\ndefinition\n  \"oassert P \\<equiv> if P then oreturn () else ofail\"\n\ntext {* \n  If the result can be an exception.\n  Corresponding bindE would be analogous to lifting in NonDetMonad.\n*}\n\ndefinition\n  \"oreturnOk x = K (Some (Inr x))\"\n\ndefinition\n  \"othrow e = K (Some (Inl e))\"\n\ndefinition\n  \"oguard G \\<equiv> (\\<lambda>s. if G s then Some () else None)\"\n\ndefinition\n  \"ocondition c L R \\<equiv> (\\<lambda>s. if c s then L s else R s)\"\n\ndefinition\n  \"oskip \\<equiv> oreturn ()\"\n\ntext {* Monad laws *}\nlemma oreturn_bind [simp]: \"(oreturn x |>> f) = f x\"\n  by (auto simp add: oreturn_def obind_def K_def intro!: ext)\n\nlemma obind_return [simp]: \"(m |>> oreturn) = m\"\n  by (auto simp add: oreturn_def obind_def K_def intro!: ext split: option.splits)\n \nlemma obind_assoc: \n  \"(m |>> f) |>> g  =  m |>> (\\<lambda>x. f x |>> g)\"\n  by (auto simp add: oreturn_def obind_def K_def intro!: ext split: option.splits)\n\n\ntext {* Binding fail *}\n\nlemma obind_fail [simp]:\n  \"f |>> (\\<lambda>_. ofail) = ofail\"\n  by (auto simp add: ofail_def obind_def K_def intro!: ext split: option.splits)\n\nlemma ofail_bind [simp]:\n  \"ofail |>> m = ofail\"\n  by (auto simp add: ofail_def obind_def K_def intro!: ext split: option.splits)\n\n\n\ntext {* Function package setup *}\nlemma opt_bind_cong [fundef_cong]:\n  \"\\<lbrakk> f = f'; \\<And>v s. f' s = Some v \\<Longrightarrow> g v s = g' v s \\<rbrakk> \\<Longrightarrow> f |>> g = f' |>> g'\"\n  by (rule ext) (simp add: obind_def split: option.splits)\n\nlemma opt_bind_cong_apply [fundef_cong]:\n  \"\\<lbrakk> f s = f' s; \\<And>v. f' s = Some v \\<Longrightarrow> g v s = g' v s \\<rbrakk> \\<Longrightarrow> (f |>> g) s = (f' |>> g') s\"\n  by (simp add: obind_def split: option.splits)\n\nlemma oassert_bind_cong [fundef_cong]:\n  \"\\<lbrakk> P = P'; P' \\<Longrightarrow> m = m' \\<rbrakk> \\<Longrightarrow> oassert P |>> m = oassert P' |>> m'\"\n  by (auto simp: oassert_def)\n\nlemma oassert_bind_cong_apply [fundef_cong]:\n  \"\\<lbrakk> P = P'; P' \\<Longrightarrow> m () s = m' () s \\<rbrakk> \\<Longrightarrow> (oassert P |>> m) s = (oassert P' |>> m') s\"\n  by (auto simp: oassert_def)\n\nlemma oreturn_bind_cong [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' = m' x' \\<rbrakk> \\<Longrightarrow> oreturn x |>> m = oreturn x' |>> m'\"\n  by simp\n\nlemma oreturn_bind_cong_apply [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' s = m' x' s \\<rbrakk> \\<Longrightarrow> (oreturn x |>> m) s = (oreturn x' |>> m') s\"\n  by simp\n\nlemma oreturn_bind_cong2 [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' = m' x' \\<rbrakk> \\<Longrightarrow> (oreturn $ x) |>> m = (oreturn $ x') |>> m'\"\n  by simp\n\nlemma oreturn_bind_cong2_apply [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' s = m' x' s \\<rbrakk> \\<Longrightarrow> ((oreturn $ x) |>> m) s = ((oreturn $ x') |>> m') s\"\n  by simp\n\nlemma ocondition_cong [fundef_cong]:\n\"\\<lbrakk>c = c'; \\<And>s. c' s \\<Longrightarrow> l s = l' s; \\<And>s. \\<not>c' s \\<Longrightarrow> r s = r' s\\<rbrakk>\n  \\<Longrightarrow> ocondition c l r = ocondition c' l' r'\"\n  by (auto simp: ocondition_def)\n\n\ntext {* Decomposition *}\n\nlemma ocondition_K_true [simp]:\n  \"ocondition (\\<lambda>_. True) T F = T\"\n  by (simp add: ocondition_def)\n\nlemma ocondition_K_false [simp]:\n  \"ocondition (\\<lambda>_. False) T F = F\"\n  by (simp add: ocondition_def)\n\nlemma ocondition_False:\n    \"\\<lbrakk> \\<And>s. \\<not> P s \\<rbrakk> \\<Longrightarrow> ocondition P L R = R\"\n  by (rule ext, clarsimp simp: ocondition_def)\n\nlemma ocondition_True:\n    \"\\<lbrakk> \\<And>s. P s \\<rbrakk> \\<Longrightarrow> ocondition P L R = L\"\n  by (rule ext, clarsimp simp: ocondition_def)\n\nlemma in_oreturn [simp]:\n  \"(oreturn x s = Some v) = (v = x)\"\n  by (auto simp: oreturn_def K_def)\n\nlemma oreturnE:\n  \"\\<lbrakk>oreturn x s = Some v; v = x \\<Longrightarrow> P x\\<rbrakk> \\<Longrightarrow> P v\"\n  by simp\n\nlemma in_ofail [simp]:\n  \"ofail s \\<noteq> Some v\"\n  by (auto simp: ofail_def K_def)\n\nlemma ofailE:\n  \"ofail s = Some v \\<Longrightarrow> P\"\n  by simp\n\nlemma in_oassert_eq [simp]:\n  \"(oassert P s = Some v) = P\"\n  by (simp add: oassert_def)\n\nlemma oassertE:\n  \"\\<lbrakk> oassert P s = Some v; P \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\n  by simp\n\nlemma in_obind_eq:\n  \"((f |>> g) s = Some v) = (\\<exists>v'. f s = Some v' \\<and> g v' s = Some v)\"\n  by (simp add: obind_def split: option.splits)\n\nlemma obindE:\n  \"\\<lbrakk> (f |>> g) s = Some v; \n     \\<And>v'. \\<lbrakk>f s = Some v'; g v' s = Some v\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp: in_obind_eq)\n\nlemma in_othrow_eq [simp]:\n  \"(othrow e s = Some v) = (v = Inl e)\"\n  by (auto simp: othrow_def K_def) \n\nlemma othrowE:\n  \"\\<lbrakk>othrow e s = Some v; v = Inl e \\<Longrightarrow> P (Inl e)\\<rbrakk> \\<Longrightarrow> P v\"\n  by simp\n\nlemma in_oreturnOk_eq [simp]:\n  \"(oreturnOk x s = Some v) = (v = Inr x)\"\n  by (auto simp: oreturnOk_def K_def) \n\nlemma oreturnOkE:\n  \"\\<lbrakk>oreturnOk x s = Some v; v = Inr x \\<Longrightarrow> P (Inr x)\\<rbrakk> \\<Longrightarrow> P v\"\n  by simp\n\nlemmas omonadE [elim!] =\n  opt_mapE obindE oreturnE ofailE othrowE oreturnOkE oassertE\n\nsection {* \"While\" loops over option monad. *}\n\ntext {*\n  This is an inductive definition of a while loop over the plain option monad\n  (without passing through a state)\n*}\n\ninductive_set\n  option_while' :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'a option) \\<Rightarrow> 'a option rel\"\n  for C B\nwhere\n    final: \"\\<not> C r \\<Longrightarrow> (Some r, Some r) \\<in> option_while' C B\"\n  | fail: \"\\<lbrakk> C r; B r = None \\<rbrakk> \\<Longrightarrow> (Some r, None) \\<in> option_while' C B\"\n  | step: \"\\<lbrakk> C r;  B r = Some r'; (Some r', sr'') \\<in> option_while' C B \\<rbrakk>\n           \\<Longrightarrow> (Some r, sr'') \\<in> option_while' C B\"\n\ndefinition\n  \"option_while C B r \\<equiv>\n    (if (\\<exists>s. (Some r, s) \\<in> option_while' C B) then\n      (THE s. (Some r, s) \\<in> option_while' C B) else None)\"\n\nlemma option_while'_inj:\n  assumes \"(s,s') \\<in> option_while' C B\" \"(s, s'') \\<in> option_while' C B\"\n  shows \"s' = s''\"\n  using assms by (induct rule: option_while'.induct) (auto elim: option_while'.cases)\n\n\n\nlemma option_while'_THE:\n  assumes \"(Some r, sr') \\<in> option_while' C B\"\n  shows \"(THE s. (Some r, s) \\<in> option_while' C B) = sr'\"\n  using assms by (blast dest: option_while'_inj)\n\nlemma option_while_simps:\n  \"\\<not> C s \\<Longrightarrow> option_while C B s = Some s\"\n  \"C s \\<Longrightarrow> B s = None \\<Longrightarrow> option_while C B s = None\"\n  \"C s \\<Longrightarrow> B s = Some s' \\<Longrightarrow> option_while C B s = option_while C B s'\"\n  \"(Some s, ss') \\<in> option_while' C B \\<Longrightarrow> option_while C B s = ss'\"\n  using option_while'_inj_step[of C s B s']\n  by (auto simp: option_while_def option_while'_THE\n      intro: option_while'.intros\n      dest: option_while'_inj\n      elim: option_while'.cases)\n\nlemma option_while_rule:\n  assumes \"option_while C B s = Some s'\"\n  assumes \"I s\"\n  assumes istep: \"\\<And>s s'. C s \\<Longrightarrow> I s \\<Longrightarrow> B s = Some s' \\<Longrightarrow> I s'\"\n  shows \"I s' \\<and> \\<not> C s'\" \nproof -\n  { fix ss ss' assume \"(ss, ss') \\<in> option_while' C B\" \"ss = Some s\" \"ss' = Some s'\"\n    then have ?thesis using `I s`\n      by (induct arbitrary: s) (auto intro: istep) }\n  then show ?thesis using assms(1)\n    by (auto simp: option_while_def option_while'_THE split: split_if_asm)\nqed\n\nlemma option_while'_term:\n  assumes \"I r\"\n  assumes \"wf M\"\n  assumes step_less: \"\\<And>r r'. \\<lbrakk>I r; C r; B r = Some r'\\<rbrakk> \\<Longrightarrow> (r',r) \\<in> M\"\n  assumes step_I: \"\\<And>r r'. \\<lbrakk>I r; C r; B r = Some r'\\<rbrakk> \\<Longrightarrow> I r'\"\n  obtains sr' where \"(Some r, sr') \\<in> option_while' C B\"\n  apply atomize_elim\n  using assms(2,1)\nproof induct\n  case (less r)\n  show ?case\n  proof (cases \"C r\" \"B r\" rule: bool.exhaust[case_product option.exhaust])\n    case (True_Some r')\n    then have \"(r',r) \\<in> M\" \"I r'\"\n      by (auto intro: less step_less step_I)\n    then obtain sr' where \"(Some r', sr') \\<in> option_while' C B\"\n      by atomize_elim (rule less)\n    then have \"(Some r, sr') \\<in> option_while' C B\"\n      using True_Some by (auto intro: option_while'.intros)\n    then show ?thesis ..\n  qed (auto intro: option_while'.intros)\nqed\n\nlemma option_while_rule':\n  assumes \"option_while C B s = ss'\"\n  assumes \"wf M\"\n  assumes \"I (Some s)\"\n  assumes less: \"\\<And>s s'. C s \\<Longrightarrow> I (Some s) \\<Longrightarrow> B s = Some s' \\<Longrightarrow> (s', s) \\<in> M\"\n  assumes step: \"\\<And>s s'. C s \\<Longrightarrow> I (Some s) \\<Longrightarrow> B s = Some s' \\<Longrightarrow> I (Some s')\"\n  assumes final: \"\\<And>s. C s \\<Longrightarrow> I (Some s) \\<Longrightarrow> B s = None \\<Longrightarrow> I None\"\n  shows \"I ss' \\<and> (case ss' of Some s' \\<Rightarrow> \\<not> C s' | _ \\<Rightarrow> True)\" \nproof -\n  def ss \\<equiv> \"Some s\"\n  obtain ss1' where \"(Some s, ss1') \\<in> option_while' C B\"\n    using assms(3,2,4,5) by (rule option_while'_term)\n  then have *: \"(ss, ss') \\<in> option_while' C B\" using `option_while C B s = ss'`\n    by (auto simp: option_while_simps ss_def)\n  show ?thesis\n  proof (cases ss')\n    case (Some s') with * ss_def show ?thesis using `I _`\n      by (induct arbitrary:s) (auto intro: step)\n  next\n    case None with * ss_def show ?thesis using `I _`\n      by (induct arbitrary:s) (auto intro: step final)\n  qed\nqed\n\nsection {* Lift @{term option_while} to the @{typ \"('a,'s) lookup\"} monad  *}\n\ndefinition\n  owhile :: \"('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> ('s,'a) lookup) \\<Rightarrow> 'a \\<Rightarrow> ('s,'a) lookup\"\nwhere\n \"owhile c b a \\<equiv> \\<lambda>s. option_while (\\<lambda>a. c a s) (\\<lambda>a. b a s) a\"\n\nlemma owhile_unroll:\n  \"owhile C B r = ocondition (C r) (B r |>> owhile C B) (oreturn r)\"\n  by (auto simp: ocondition_def obind_def oreturn_def owhile_def\n           option_while_simps K_def split: option.split)\n\ntext {* rule for terminating loops *}\n\nlemma owhile_rule:\n  assumes \"I r s\"\n  assumes \"wf M\"\n  assumes less: \"\\<And>r r'. \\<lbrakk>I r s; C r s; B r s = Some r'\\<rbrakk> \\<Longrightarrow> (r',r) \\<in> M\"\n  assumes step: \"\\<And>r r'. \\<lbrakk>I r s; C r s; B r s = Some r'\\<rbrakk> \\<Longrightarrow> I r' s\"\n  assumes fail: \"\\<And>r r'. \\<lbrakk>I r s; C r s; B r s = None\\<rbrakk> \\<Longrightarrow> Q None\"\n  assumes final: \"\\<And>r. \\<lbrakk>I r s; \\<not>C r s\\<rbrakk> \\<Longrightarrow> Q (Some r)\"\n  shows \"Q (owhile C B r s)\"\nproof -\n  let ?rs' = \"owhile C B r s\"\n  have \"(case ?rs' of Some r \\<Rightarrow> I r s | _ \\<Rightarrow> Q None)\n      \\<and> (case ?rs' of Some r' \\<Rightarrow> \\<not> C r' s | _ \\<Rightarrow> True)\"\n    by (rule option_while_rule'[where B=\"\\<lambda>r. B r s\" and s=r, OF _ `wf _`])\n       (auto simp: owhile_def intro: assms)\n  then show ?thesis by (auto intro: final split: option.split_asm)\nqed\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/lib/OptionMonad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961013, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.34815112699611517}}
{"text": "(*<*)\ntheory T10MaximalHintikkaIngles\nimports T8TeoriaHintikkaIngles   \nbegin\n(*>*)\n\nsubsection \\<open> Conjuntos maximales y conjuntos de Hintikka \\<close>\n\ntext \\<open>\n  \\label{maximalhintikka}\n\n  En esta sección mostramos que si $\\mathcal {C}$ es una propiedad de\n  consistencia proposicional que además es cerrada por subconjuntos, $M$\n  es un conjunto maximal de $\\mathcal{C}$ y $M$ pertenence a\n  $\\mathcal{C}$ entonces, $M$ es un conjunto de Hintikka.\n\n  \\begin{teorema}\\label{MaximalHintikkaP}\n  Sea $\\mathcal{C}$ una colección de conjuntos de fórmulas tal que, \n  \\begin{itemize}\n  \\item (hip1) $\\mathcal{C}$ es una propiedad de consistencia proposicional.\n  \\item (hip2) $M$ es un elemento maximal de $\\mathcal{C}$.\n  \\item (hip3) $M\\in \\mathcal{C}$.\n  \\end{itemize}\n  Entonces $M$ es un conjunto de Hintikka.\n  \\end{teorema}\n\n  \\begin{demostracion}\n\n  A continuación mostramos que $M$ cumple las propiedades que definen un\n  conjunto de Hintikka (definición \\ref{DefhintikkaP}).  Las propiedades\n  (1) y (2) se cumplen por las hipótesis $(hip1)$ y $(hip3)$; las\n  propiedades (3) a (5) se demuestran usando las hipótesis $(hip1)$,\n  $(hip2)$ y $(hip3)$:\n\n  3. Supongamos que $\\neg \\neg F \\in M$, hay que demostrar que $F \\in\n  M$. Tenemos que, si $\\neg \\neg F \\in M$ entonces $M\\cup \\{F\\} \\in\n  \\mathcal{C}$, puesto que $\\mathcal{C}$ es una propiedad de\n  consistencia. También se tiene que para cualquier $S'\\in\n  \\mathcal{C}$, si $M\\subseteq S'$ entonces $M = S'$, puesto que $M$ es\n  un elemento maximal de $\\mathcal{C}$.\n\n  De lo anterior y puesto que $M\\subseteq M\\cup \\{F\\}$ tenemos que $M =\n  M\\cup \\{F\\}$, y por lo tanto, $F \\in M$.\n   \n  4. Supongamos que $\\alpha \\in M$.  Hay que demostrar que $\\alpha_1 \\in\n  M$ y $\\alpha_2 \\in M$.  Tene\\-mos que, si $\\alpha \\in M$ entonces $M\\cup\n  \\{\\alpha_1, \\alpha_2\\}\\in \\mathcal{C}$, ya que $\\mathcal{C}$ es\n  propiedad de consistencia.  También se tiene que para cualquier $S'\\in\n  \\mathcal{C}$, si $M\\subseteq S'$ entonces $M = S'$, puesto que $M$ es\n  un elemento maximal de $\\mathcal{C}$.\n\n  De lo anterior y puesto que $M\\subseteq M\\cup \\{\\alpha_1, \\alpha_2\\}$\n  tenemos que, $M = M\\cup \\{\\alpha_1, \\alpha_2\\}$. Luego $\\alpha_1 \\in\n  M$ y $\\alpha_2 \\in M$.\n\n  5. Supongamos que $\\beta\\in M$.  Hay que demostrar que $\\beta_1 \\in M$\n  o $\\beta_2 \\in M$.  Puesto que $\\mathcal{C}$ es una propiedad de\n  consistencia tenemos que, si $\\beta \\in M$ entonces, $M\\cup\n  \\{\\beta_1\\}\\in \\mathcal{C}$ o $M\\cup \\{\\beta_2\\}\\in \\mathcal{C}$.  A\n  partir de la anterior disyunción demostramos por el método de\n  eliminación de la disyunción que, $\\beta_1\\in M$ o $\\beta_2\\in M$.\n\n  (a) Supongamos que $M\\cup \\{\\beta_1\\}\\in \\mathcal{C}$.  Puesto que $M$\n  es un elemento maximal de $\\mathcal{C}$ tenemos que para cualquier\n  $S'\\in \\mathcal{C}$, si $M\\subseteq S'$ entonces $M = S'$.  De lo\n  anterior y puesto que $M\\subseteq M\\cup \\{\\beta_1\\}$ tenemos que, $M =\n  M\\cup \\{\\beta_1\\}$.  Luego $\\beta_1\\in M$, y por lo tanto, $\\beta_1\\in\n  M$ o $\\beta_2\\in M$.\n\n  (b) Supongamos que $M\\cup \\{\\beta_2\\}\\in \\mathcal{C}$. La demostración\n  es igual que la del caso anterior.  \n  \\end{demostracion}\n\n  Los siguientes lemas corresponden a la formalización de cada una de\n  las partes del teorema anterior. \n\\<close>\n\nlemma exten_hintikkaP1:\n  assumes  hip1: \"consistenceP \\<C>\" and hip2: \"M \\<in> \\<C>\"\n  shows   \"\\<forall>p. \\<not> (atom p \\<in> M \\<and> (\\<not>.atom p) \\<in> M)\"\n(*<*)\nproof -\n  show ?thesis using hip1 hip2 by(unfold consistenceP_def) simp \nqed\n(*>*)\n\ntext \\<open> \\<close>\n\nlemma exten_hintikkaP2: \n  assumes hip1: \"consistenceP \\<C>\" and hip2: \"M \\<in> \\<C>\"  \n  shows \"FF \\<notin> M\"\n(*<*)\nproof -\n  show ?thesis using hip1 hip2 by(unfold consistenceP_def) simp \nqed\n(*>*)\n\ntext \\<open> \\<close>\n\nlemma exten_hintikkaP3:\n  assumes  hip1: \"consistenceP \\<C>\" and hip2: \"M \\<in> \\<C>\"  \n  shows \"(\\<not>.TT) \\<notin> M\"\n(*<*)\nproof -\n  show ?thesis using hip1 hip2 by(unfold consistenceP_def) simp\nqed\n(*>*)\n\ntext \\<open> \\<close>\n\nlemma exten_hintikkaP4:\n  assumes  hip1: \"consistenceP \\<C>\" and hip2: \"maximal M \\<C>\" and hip3: \"M \\<in> \\<C>\"  \n  shows \"\\<forall>F. (\\<not>.\\<not>.F) \\<in> M \\<longrightarrow> F \\<in> M\" \n(*<*)\nproof (rule allI impI)+  \n  fix F \n  assume h1: \"(\\<not>.\\<not>.F) \\<in> M\"\n  show \"F \\<in> M\"\n  proof -   \n    have \"(\\<not>.\\<not>.F) \\<in> M \\<longrightarrow> M \\<union> {F} \\<in> \\<C>\"\n      using hip1 hip3 by (unfold consistenceP_def) simp    \n    hence \"M \\<union> {F} \\<in> \\<C>\" using h1 by simp  \n    moreover \n    have  \"\\<forall>M'\\<in>\\<C>. M \\<subseteq> M' \\<longrightarrow> M = M'\" using hip2 by (unfold maximal_def)\n    moreover\n    have \"M \\<subseteq> M \\<union> {F}\" by auto\n    ultimately\n    have \"M = M \\<union> {F}\" by auto \n    thus \"F \\<in> M\" by auto\n  qed\nqed\n(*>*)\n\ntext \\<open> \\<close>\n\nlemma exten_hintikkaP5:\n  assumes hip1: \"consistenceP \\<C>\" and hip2: \"maximal M \\<C>\" and hip3: \"M \\<in> \\<C>\"  \n  shows \"\\<forall>F. (FormulaAlfa F) \\<and> F \\<in> M \\<longrightarrow> (Comp1 F \\<in> M \\<and> Comp2 F \\<in> M)\"\n(*<*)      \nproof (rule allI impI)+  \n  fix F \n  assume h1: \"(FormulaAlfa F) \\<and> F \\<in> M\"\n  show \"Comp1 F \\<in> M \\<and> Comp2 F \\<in> M\"\n  proof -\n    have \"(FormulaAlfa F) \\<and> F \\<in> M \\<longrightarrow> M \\<union> {Comp1 F, Comp2 F} \\<in> \\<C>\"\n      using hip1 hip3 by (unfold consistenceP_def) simp\n    hence  \"M \\<union> {Comp1 F, Comp2 F} \\<in> \\<C>\" using h1 by simp\n    moreover\n    have \"\\<forall>M'\\<in>\\<C>. M \\<subseteq> M' \\<longrightarrow> M = M'\" using hip2 by (unfold maximal_def) \n    moreover\n    have \"M \\<subseteq> M \\<union> {Comp1 F, Comp2 F}\" by auto\n    ultimately     \n    have \"M = M \\<union> {Comp1 F, Comp2 F}\"  by simp     \n    thus \"Comp1 F \\<in> M \\<and> Comp2 F \\<in> M\" by auto\n  qed\nqed\n(*>*)\n\ntext \\<open> \\<close>\n\nlemma exten_hintikkaP6:\n  assumes hip1: \"consistenceP \\<C>\" and hip2: \"maximal M \\<C>\" and  hip3: \"M \\<in> \\<C>\"  \n  shows \"\\<forall>F. (FormulaBeta F) \\<and> F \\<in> M \\<longrightarrow> Comp1 F \\<in> M \\<or> Comp2 F \\<in> M\" \n(*<*)     \nproof (rule allI impI)+  \n  fix F \n  assume h1: \"(FormulaBeta F) \\<and> F \\<in> M\"\n  show \"Comp1 F \\<in> M \\<or> Comp2 F \\<in> M\"\n  proof -    \n    have \"(FormulaBeta F) \\<and> F \\<in> M \\<longrightarrow> M \\<union> {Comp1 F} \\<in> \\<C> \\<or> M \\<union> {Comp2 F} \\<in> \\<C>\"\n      using hip1 hip3 by (unfold consistenceP_def) simp\n    hence  \"M \\<union> {Comp1 F} \\<in> \\<C> \\<or> M \\<union> {Comp2 F} \\<in> \\<C>\" using h1 by simp\n    thus ?thesis\n    proof (rule disjE)\n      assume \"M \\<union> {Comp1 F} \\<in> \\<C>\"\n      moreover  \n      have \"\\<forall>M'\\<in>\\<C>. M \\<subseteq> M' \\<longrightarrow> M = M'\" using hip2 by (unfold maximal_def)\n      moreover\n      have \"M \\<subseteq> M \\<union> {Comp1 F}\" by auto\n      ultimately\n      have \"M = M \\<union> {Comp1 F}\" by simp\n      hence \"Comp1 F \\<in> M\" by auto\n      thus \"Comp1 F \\<in> M \\<or> Comp2 F \\<in> M\" by simp\n    next \n      assume \"M \\<union> {Comp2 F} \\<in> \\<C>\"\n      moreover  \n      have \"\\<forall>M'\\<in>\\<C>. M \\<subseteq> M' \\<longrightarrow> M = M'\" using hip2 by (unfold maximal_def)\n      moreover\n      have \"M \\<subseteq> M \\<union> {Comp2 F}\" by auto\n      ultimately\n      have \"M = M \\<union> {Comp2 F}\" by simp\n      hence \"Comp2 F \\<in> M\" by auto\n      thus \"Comp1 F \\<in> M \\<or> Comp2 F \\<in> M\" by simp\n    qed\n  qed\nqed\n(*>*)\n\ntext \\<open> \n  Por último, tenemos la formalización del teorema\n  \\ref{MaximalHintikkaP}. \n\\<close>\n\ntheorem MaximalHintikkaP:\n  assumes hip1: \"consistenceP \\<C>\" and hip2: \"maximal M \\<C>\" and  hip3: \"M \\<in> \\<C>\"\n  shows \"hintikkaP M\"\nproof (unfold hintikkaP_def)     \n  show \"(\\<forall>P. \\<not> (atom P \\<in> M \\<and> \\<not>.atom P \\<in> M)) \\<and>\n        FF \\<notin> M \\<and>\n        \\<not>.TT \\<notin> M \\<and>\n        (\\<forall>F. \\<not>.\\<not>.F \\<in> M \\<longrightarrow> F \\<in> M) \\<and>\n        (\\<forall>F. FormulaAlfa F \\<and> F \\<in> M \\<longrightarrow> Comp1 F \\<in> M \\<and> Comp2 F \\<in> M) \\<and>\n        (\\<forall>F. FormulaBeta F \\<and> F \\<in> M \\<longrightarrow> Comp1 F \\<in> M \\<or> Comp2 F \\<in> M)\"\n    using exten_hintikkaP1[OF hip1 hip3] \n          exten_hintikkaP2[OF hip1 hip3] \n          exten_hintikkaP3[OF hip1 hip3] \n          exten_hintikkaP4[OF hip1 hip2 hip3]\n          exten_hintikkaP5[OF hip1 hip2 hip3] \n          exten_hintikkaP6[OF hip1 hip2 hip3]         \n    by blast\nqed   \n   \n(*<*)         \nend\n(*<*)\n", "meta": {"author": "mayalarincon", "repo": "halltheorem", "sha": "6c694d6b154df4576b648810a5ec2f1814a0c99b", "save_path": "github-repos/isabelle/mayalarincon-halltheorem", "path": "github-repos/isabelle/mayalarincon-halltheorem/halltheorem-6c694d6b154df4576b648810a5ec2f1814a0c99b/ExistenciaModelosIngles/T10MaximalHintikkaIngles.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.615087848460224, "lm_q1q2_score": 0.3481511230023776}}
{"text": "theory flash39Bra  imports flash39Rev\n \n  begin\nlemma onInv39:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv39 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv39 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv39 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash39Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7549149978955811, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.34802848098438455}}
{"text": "theory Hnr_Frame \n  imports Hnr_Base \nbegin\n\nlemma hnr_frame:\n  assumes\n    \"\\<Gamma>\\<^sub>P \\<Longrightarrow>\\<^sub>A \\<Gamma> * F\"\n    \"hnr \\<Gamma> fi \\<Gamma>' f\"\n  shows\n    \"hnr \\<Gamma>\\<^sub>P fi (\\<lambda>r ri. \\<Gamma>' r ri * F) f\"\n  apply(rule hnrI)\n  using hnrD[OF assms(2)] assms(1) fi_rule\n  apply(cases f)\n  apply sep_auto+\n  by fastforce\n\nattribute_setup framed =\n    \\<open>Scan.succeed (Thm.rule_attribute [] (fn _ => fn thm => @{thm hnr_frame} OF [asm_rl, thm]))\\<close>\n    \\<open>Add frame to hnr rule\\<close>\n\nlemma frame_prepare:\n  assumes\n    \"emp * P * emp \\<Longrightarrow>\\<^sub>A emp * Q * F\"\n  shows\n    \"P \\<Longrightarrow>\\<^sub>A Q * F\"\n  using assms\n  by sep_auto\n\nlemma split_id_assn: \"id_assn p pi = id_assn (fst p) (fst pi) * id_assn (snd p) (snd pi)\"\n  by(cases p)(auto simp: id_rel_def)\n\nmethod frame_norm_assoc = \n  (simp only: mult.left_assoc[where 'a=assn] split_id_assn fst_conv snd_conv)?\n\nmethod frame_prepare = rule frame_prepare, frame_norm_assoc\n\nlemma frame_no_match: \n  assumes\n    \"Ps1 * (P * Ps2) \\<Longrightarrow>\\<^sub>A Qs * Q * F\"\n  shows\n    \"Ps1 * P * Ps2 \\<Longrightarrow>\\<^sub>A Qs * Q * F\"\n  using assms\n  by (simp add: mult.assoc)\n\nlemma frame_match_pure:\n  assumes\n    \"Ps1 * \\<up>(P) * Ps2 \\<Longrightarrow>\\<^sub>A Qs * F\"\n  shows\n    \"Ps1 * \\<up>(P) * Ps2 \\<Longrightarrow>\\<^sub>A Qs * \\<up>(P) * F\"\n  using assms\n  by simp\n\nlemma frame_match:\n  assumes\n    \"P \\<Longrightarrow>\\<^sub>A Q\"\n    \"Ps1 * Ps2 \\<Longrightarrow>\\<^sub>A Qs * F\"\n  shows\n    \"Ps1 * P * Ps2 \\<Longrightarrow>\\<^sub>A Qs * Q * F\"\n  using assms\n  by (metis assn_aci(10) ent_star_mono)\n\nlemma frame_match_emp:\n   assumes\n    \"Ps \\<Longrightarrow>\\<^sub>A Qs * F\"\n  shows\n    \"Ps \\<Longrightarrow>\\<^sub>A Qs * emp * F\"\n  using assms\n  by sep_auto\n\nlemma frame_done: \"F * emp \\<Longrightarrow>\\<^sub>A emp * F\" \n  by sep_auto\n\nmethod frame_try_match methods match_atom = then_else \n  \\<open>rule frame_match_pure | rule frame_match, (match_atom; fail) | rule frame_match_emp\\<close> \n  \\<open>frame_norm_assoc\\<close> \n  \\<open>rule frame_no_match, frame_try_match match_atom\\<close>\n\nmethod frame_done = simp only: assn_one_left mult_1_right[where 'a=assn], rule ent_refl  \n\nmethod hnr_frame_inference methods match_atom =\n  frame_prepare, (frame_try_match match_atom)+, frame_done\n          \nend\n", "meta": {"author": "balazstothofficial", "repo": "arrays-in-isabelle", "sha": "9d5dd28b0b3d245dae534d546879045a54b4244f", "save_path": "github-repos/isabelle/balazstothofficial-arrays-in-isabelle", "path": "github-repos/isabelle/balazstothofficial-arrays-in-isabelle/arrays-in-isabelle-9d5dd28b0b3d245dae534d546879045a54b4244f/Hnr_Frame.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.3478638190587141}}
{"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n *  Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Unsigned_Mult_Typed\n  imports VHDL_Hoare_Typed Bits_Int_Aux\nbegin\n\ndatatype sig = A | B | C\n\ndefinition mult :: \"sig conc_stmt\" where\n  \"mult \\<equiv> process {A, B} : Bassign_trans C (Bmult (Bsig A) (Bsig B)) 1\"\n\nlemma potential_tyenv:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans C (Bmult (Bsig A) (Bsig B)) 1)\"\n  shows \"\\<exists>len1>0. \\<exists>len2>0. \\<Gamma> A = Lty Uns len1 \\<and> \\<Gamma> B = Lty Uns len2 \\<and> \\<Gamma> C = Lty Uns (len1 + len2)\n                   \\<or> \\<Gamma> A = Lty Sig len1 \\<and> \\<Gamma> B = Lty Sig len2 \\<and> \\<Gamma> C = Lty Sig (len1 + len2)\"\nproof (rule seq_wt_cases(4)[OF assms])\n  assume \"bexp_wt \\<Gamma> (Bmult (Bsig A) (Bsig B)) (\\<Gamma> C)\"\n  obtain len1 len2 where \" \\<Gamma> A = Lty Uns len1 \\<and> \\<Gamma> B = Lty Uns len2 \\<and> \\<Gamma> C = Lty Uns (len1 + len2)\n                              \\<or> \\<Gamma> A = Lty Sig len1 \\<and> \\<Gamma> B = Lty Sig len2 \\<and> \\<Gamma> C = Lty Sig (len1 + len2)\"\n    and \"0 < len1\" and \"0 < len2\"\n    apply (rule bexp_wt_cases_slice(5)[OF \\<open>bexp_wt \\<Gamma> (Bmult (Bsig A) (Bsig B)) (\\<Gamma> C)\\<close>])\n    by (metis bexp_wt_cases_slice(2))+\n  thus ?thesis\n    by auto\nqed\n\nlocale unsigned_multiplication =\n  fixes \\<Gamma> :: \"sig tyenv\"\n  fixes len len1 len2 :: nat\n  assumes len_def: \"len = len1 + len2\"\n  assumes atype: \"\\<Gamma> A = Lty Uns len1\" and btype: \"\\<Gamma> B = Lty Uns len2\" and ctype: \"\\<Gamma> C = Lty Uns len\"\n  assumes len1: \"0 < len1\" and len2: \"0 < len2\"\nbegin\n\nlemma well_typed:\n  \"seq_wt \\<Gamma> (Bassign_trans C (Bmult (Bsig A) (Bsig B)) 1)\"\n  apply (rule seq_wt.intros(4))\n  unfolding ctype len_def apply (rule bexp_wt.intros(17))\n      apply (rule bexp_wt.intros(3))+\n      apply (rule atype[symmetric])\n     apply (rule bexp_wt.intros)\n     apply (rule btype[symmetric])\n  using len1 len2 by auto\n\nabbreviation \"lof_wline tw sig n \\<equiv> lval_of (wline_of tw sig n)\"\n\ndefinition inv :: \"sig assn2\" where\n  \"inv tw \\<equiv> (lof_wline tw C (fst tw) =\n                  bin_to_bl len (bl_to_bin (lof_wline tw A (fst tw - 1)) * bl_to_bin (lof_wline tw B (fst tw - 1))))\"\n\ndefinition inv2 :: \"sig assn2\" where\n  \"inv2 tw \\<equiv> (disjnt {A, B} (event_of tw) \\<longrightarrow> (\\<forall>i > fst tw. lof_wline tw C i = lof_wline tw C (fst tw)))\"\n\nlemma inv_next_time:\n  fixes tw\n  defines \"v \\<equiv> eval_world_raw2 tw (Bmult (Bsig A) (Bsig B))\"\n  defines \"tw' \\<equiv> tw[C, 1 :=\\<^sub>2 v]\"\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  shows   \"inv (fst tw' + 1, snd tw')\"\nproof - \n  have bexpA: \"bexp_wt \\<Gamma> (Bsig A) (Lty Uns len1)\" and bexpB: \"bexp_wt \\<Gamma> (Bsig B) (Lty Uns len2)\"\n    using unsigned_multiplication_axioms unfolding unsigned_multiplication_def by (metis bexp_wt.intros(3))+\n  obtain bsA bsB where evalA: \"eval_world_raw (fst tw) (snd tw) (Bsig A) = Lv Uns bsA\" and\" length bsA = len1 \" and\n                       evalB: \"eval_world_raw (fst tw) (snd tw) (Bsig B) = Lv Uns bsB\" and\" length bsB = len2 \"\n      using eval_world_raw_lv[OF bexpA `wityping \\<Gamma> (snd tw)`] eval_world_raw_lv[OF bexpB `wityping \\<Gamma> (snd tw)`] by blast\n  have \"lof_wline tw' C (fst tw + 1) = lval_of v\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = bin_to_bl len (bl_to_bin (lof_wline tw A (fst tw)) * bl_to_bin (lof_wline tw B (fst tw)))\"\n    using evalA evalB `length bsA = len1` `length bsB = len2`\n    unfolding v_def eval_world_raw.simps eval_arith.simps len_def Let_def by auto\n  finally show ?thesis\n    unfolding inv_def tw'_def worldline_upd2_def worldline_upd_def  by auto\nqed\n\nlemma inv2_next_time:\n  fixes tw v\n  defines \"tw' \\<equiv> tw[C, 1 :=\\<^sub>2 v]\"\n  shows   \"inv2 (fst tw' + 1, snd tw')\"\n  unfolding inv2_def tw'_def worldline_upd2_def worldline_upd_def by auto\n\nlemma mult_conc_hoare:\n  \"\\<And>tw. inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw) \\<Longrightarrow> inv (fst tw + 1, snd tw)\"\nproof -\n  fix tw\n  assume \"inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw)\"\n  hence \"inv tw\" and \"inv2 tw\" and \"disjnt {A, B} (event_of tw)\"\n    by auto\n  have \"lof_wline tw C (fst tw + 1) = lof_wline tw C (fst tw)\"\n    using `inv2 tw` `disjnt {A, B} (event_of tw)` unfolding inv2_def by auto \n  also have \"... = bin_to_bl len (bl_to_bin (lval_of (wline_of tw A (get_time tw - 1))) * bl_to_bin (lval_of (wline_of tw B (get_time tw - 1))))\"\n    using `inv tw` unfolding inv_def by auto\n  also have \"... = bin_to_bl len (bl_to_bin (lval_of (wline_of tw A (fst tw))) * bl_to_bin (lval_of (wline_of tw B (fst tw))))\"\n    using `disjnt {A, B} (event_of tw)`  unfolding event_of_alt_def  \n    by (smt diff_0_eq_0 disjnt_insert1 mem_Collect_eq)\n  finally show \"inv (fst tw + 1, snd tw)\"\n    unfolding inv_def by auto\nqed\n\nlemma mult_conc_hoare2:\n  \"\\<And>tw. inv2 tw \\<and> disjnt {A, B} (event_of tw) \\<Longrightarrow> inv2 (fst tw + 1, snd tw)\"\n  unfolding inv2_def by auto\n\nlemma conc_stmt_wf_mult:\n  \"conc_stmt_wf mult\"\n  unfolding mult_def conc_stmt_wf_def by auto  \n\nlemma nonneg_delay_conc_mult:\n  \"nonneg_delay_conc mult\"\n  unfolding mult_def by auto\n\nlemma nonneg_delay_conc_mult':\n  \"nonneg_delay_conc ( process {A, B} : Bassign_trans C (Bmult (Bsig A) (Bsig B)) 1)\"\n  using nonneg_delay_conc_mult unfolding mult_def by auto\n\nlemma conc_wt_mult:\n  \"conc_wt \\<Gamma> mult\"\n  unfolding mult_def  by (meson conc_wt.intros(1) well_typed)\n\nlemma conc_wt_mult':\n  \"conc_wt \\<Gamma> ( process {A, B} : Bassign_trans C (Bmult (Bsig A) (Bsig B)) 1)\"\n  using conc_wt_mult unfolding mult_def by auto\n\nlemma mult_conc_sim2':\n  \"\\<Gamma> \\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. inv tw \\<and> inv2 tw\\<rbrace> mult \\<lbrace>\\<lambda>tw. inv tw \\<and> inv2 tw\\<rbrace>\"\n  apply (rule While_Suc)\n  apply (rule Conseq'[where P=\"wp3_conc \\<Gamma> mult (\\<lambda>tw. inv  (fst tw + 1, snd tw) \\<and> \n                                                      inv2 (fst tw + 1, snd tw))\", rotated])\n  apply (rule wp3_conc_is_pre, rule conc_stmt_wf_mult, rule nonneg_delay_conc_mult, rule conc_wt_mult, simp)\n  unfolding mult_def  wp3_conc_single'[OF conc_wt_mult' nonneg_delay_conc_mult'] wp3_fun.simps\n  using inv_next_time inv2_next_time mult_conc_hoare mult_conc_hoare2 by presburger\n\ntext \\<open>Initialisation preserves the invariant\\<close>\n\nlemma nonneg_delay_mult:\n  \" nonneg_delay (Bassign_trans C (Bmult (Bsig A) (Bsig B)) 1)\"\n  using nonneg_delay_conc_mult' by auto\n\nlemma seq_wt:\n  \"seq_wt \\<Gamma> (Bassign_trans C (Bmult (Bsig A) (Bsig B)) 1)\"\n  using well_typed by blast\n\nlemma init_sat_nand_inv_comb:\n  \"init_sim2_hoare_wt \\<Gamma> (\\<lambda>tw. fst tw = 0) mult (\\<lambda>tw. inv tw \\<and> inv2 tw)\"\n  unfolding mult_def\n  apply (rule AssignI_suc, rule SingleI)\n  apply (rule Conseq3[where Q=\"\\<lambda>tw. inv (fst tw + 1, snd tw) \\<and> inv2 (fst tw + 1, snd tw)\", rotated])\n  apply (rule wp3_fun_is_pre[OF well_typed nonneg_delay_mult], simp)\n  unfolding wp3_fun.simps using inv_next_time inv2_next_time by blast\n\nlemma correctness:\n  assumes \"sim_fin2 w (i + 1) mult tw'\" and \"wityping \\<Gamma> w\"\n  shows \"lof_wline tw' C (i + 1) = bin_to_bl len (bl_to_bin (lof_wline tw' A i) * bl_to_bin (lof_wline tw' B i))\"\n  using grand_correctness[OF assms conc_stmt_wf_mult conc_wt_mult nonneg_delay_conc_mult mult_conc_sim2' init_sat_nand_inv_comb]\n  unfolding mult_def inv_def by (metis (no_types, lifting) add_diff_cancel_right' assms(1)\n  sim_fin2.cases world_maxtime_lt_fst_tres)\nend\n\nend\n", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Unsigned_Mult_Typed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.6187804337438501, "lm_q1q2_score": 0.3478638190587141}}
{"text": "header {* Bit Block Transfer and Other Array Optimizations *}\ntheory Array_Blit\nimports \n  \"../Sep_Main\" \n  \"~~/src/HOL/Library/Code_Target_Numeral\"\nbegin\n\nsubsection \"Definition\"\n\n  primrec blit :: \"_ array \\<Rightarrow> nat \\<Rightarrow> _ array \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> unit Heap\" where\n    \"blit _ _ _ _ 0 = return ()\"\n  | \"blit src si dst di (Suc l) = do {\n      x \\<leftarrow> Array.nth src si;\n      Array.upd di x dst;\n      blit src (si+1) dst (di+1) l\n    }\"\n  \n  lemma blit_rule[sep_heap_rules]:\n    assumes LEN: \"si+len \\<le> length lsrc\" \"di+len \\<le> length ldst\"\n    shows\n    \"< src \\<mapsto>\\<^sub>a lsrc \n      * dst \\<mapsto>\\<^sub>a ldst >\n    blit src si dst di len\n    <\\<lambda>_. src \\<mapsto>\\<^sub>a lsrc \n      * dst \\<mapsto>\\<^sub>a (take di ldst @ take len (drop si lsrc) @ drop (di+len) ldst)\n    >\"\n    using LEN\n  proof (induction len arbitrary: si di ldst)\n    case 0 thus ?case by sep_auto\n  next\n    case (Suc len) \n    note [sep_heap_rules] = Suc.IH\n\n    have [simp]: \"\\<And>x. lsrc ! si # take len (drop (Suc si) lsrc) @ x\n      = take (Suc len) (drop si lsrc) @ x\"\n      apply simp\n      by (metis Suc.prems(1) add_Suc_right Cons_nth_drop_Suc\n        less_Suc_eq_le add.commute not_less_eq take_Suc_Cons \n        Nat.trans_le_add2)\n\n    from Suc.prems show ?case\n      by (sep_auto simp: take_update_last drop_upd_irrelevant)\n  qed\n\n  definition nth_oo where \"nth_oo v a i \\<equiv> do {\n    l\\<leftarrow>Array.len a;\n    if i<l then\n      Array.nth a i\n    else \n      return v\n  }\"\n\n  definition upd_oo where \"upd_oo f i x a \\<equiv> do {\n    l\\<leftarrow>Array.len a;\n    if i<l then\n      Array.upd i x a\n    else\n      f\n  }\"\n\nML_val Array.update\n\nsubsection \"Code Generator Setup\"\n  code_printing code_module \"array_blit\" \\<rightharpoonup> (SML)\n    {*\n    fun array_blit src si dst di len = \n      ArraySlice.copy {\n        di=di,\n        src = ArraySlice.slice (src,si,SOME len),\n        dst=dst}\n\n    fun array_nth_oo v a i () = Array.sub(a,i) handle Subscript => v\n    fun array_upd_oo f i x a () = \n      (Array.update(a,i,x); a) handle Subscript => f ()\n\n    *}\n\n  definition blit' where\n    [code del]: \"blit' src si dst di len \n      = blit src (nat_of_integer si) dst (nat_of_integer di) \n          (nat_of_integer len)\"\n\n  \n\n  (* TODO: Export to other languages: OCaml, Haskell, Scala *)\n  code_printing constant blit' \\<rightharpoonup>\n    (SML) \"(fn/ ()/ => /array'_blit _ _ _ _ _)\"\n    and (Scala) \"('_: Unit)/=>/ System.arraycopy((_).array,(_).as'_Int,(_).array,(_).as'_Int,(_).as'_Int)\"\n  \n  definition [code del]: \"nth_oo' v a == nth_oo v a o nat_of_integer\"\n  definition [code del]: \"upd_oo' f == upd_oo f o nat_of_integer\"\n\n  lemma [code]: \n    \"nth_oo v a == nth_oo' v a o integer_of_nat\"\n    \"upd_oo f == upd_oo' f o integer_of_nat\"\n    by (simp_all add: nth_oo'_def upd_oo'_def o_def)\n\n  text {* Fallbacks *}\n  lemmas [code] = nth_oo'_def[unfolded nth_oo_def[abs_def]]\n  lemmas [code] = upd_oo'_def[unfolded upd_oo_def[abs_def]]\n\n  code_printing constant nth_oo' \\<rightharpoonup> (SML) \"array'_nth'_oo _ _ _\"\n    | constant upd_oo' \\<rightharpoonup> (SML) \"array'_upd'_oo _ _ _ _\"\n\nsubsection {* Derived Functions *}\n  definition \"array_shrink a s \\<equiv> do {\n    (* Avoiding the need for default value *)\n    l\\<leftarrow>Array.len a;\n    if l=s then \n      return a\n    else if l=0 then \n      Array.of_list []\n    else do {\n      x\\<leftarrow>Array.nth a 0;\n      a'\\<leftarrow>Array.new s x;\n      blit a 0 a' 0 s;\n      return a'\n    }\n  }\"\n\n  lemma array_shrink_rule[sep_heap_rules]:\n    assumes \"s\\<le>length la\"\n    shows \"< a\\<mapsto>\\<^sub>ala > array_shrink a s <\\<lambda>a'. a'\\<mapsto>\\<^sub>atake s la >\\<^sub>t\"\n    using assms unfolding array_shrink_def\n    by sep_auto\n\n  definition \"array_grow a s x \\<equiv> do {\n    l\\<leftarrow>Array.len a;\n    if l=s then \n      return a\n    else do {\n      a'\\<leftarrow>Array.new s x;\n      blit a 0 a' 0 l;\n      return a'\n    }\n  }\"\n\n  lemma array_grow_rule[sep_heap_rules]:\n    assumes \"s\\<ge>length la\"\n    shows \"\n      < a\\<mapsto>\\<^sub>ala > \n        array_grow a s x \n      <\\<lambda>a'. a'\\<mapsto>\\<^sub>a (la @ replicate (s-length la) x)>\\<^sub>t\"\n    using assms\n    unfolding array_grow_def\n    by sep_auto\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Separation_Logic_Imperative_HOL/Examples/Array_Blit.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.6187804337438501, "lm_q1q2_score": 0.34786381905871405}}
{"text": "(*  Title:      HOL/Auth/KerberosIV.thy\n    Author:     Giampaolo Bella, Cambridge University Computer Laboratory\n    Copyright   1998  University of Cambridge\n*)\n\nsection\\<open>The Kerberos Protocol, Version IV\\<close>\n\ntheory KerberosIV imports Public begin\n\ntext\\<open>The \"u\" prefix indicates theorems referring to an updated version of the protocol. The \"r\" suffix indicates theorems where the confidentiality assumptions are relaxed by the corresponding arguments.\\<close>\n\nabbreviation\n  Kas :: agent where \"Kas == Server\"\n\nabbreviation\n  Tgs :: agent where \"Tgs == Friend 0\"\n\n\naxiomatization where\n  Tgs_not_bad [iff]: \"Tgs \\<notin> bad\"\n   \\<comment> \\<open>Tgs is secure --- we already know that Kas is secure\\<close>\n\ndefinition\n (* authKeys are those contained in an authTicket *)\n    authKeys :: \"event list \\<Rightarrow> key set\" where\n    \"authKeys evs = {authK. \\<exists>A Peer Ta. Says Kas A\n                        (Crypt (shrK A) \\<lbrace>Key authK, Agent Peer, Number Ta,\n               (Crypt (shrK Peer) \\<lbrace>Agent A, Agent Peer, Key authK, Number Ta\\<rbrace>)\n                  \\<rbrace>) \\<in> set evs}\"\n\ndefinition\n (* A is the true creator of X if she has sent X and X never appeared on\n    the trace before this event. Recall that traces grow from head. *)\n  Issues :: \"[agent, agent, msg, event list] \\<Rightarrow> bool\"\n             (\"_ Issues _ with _ on _\" [50, 0, 0, 50] 50) where\n   \"(A Issues B with X on evs) =\n      (\\<exists>Y. Says A B Y \\<in> set evs \\<and> X \\<in> parts {Y} \\<and>\n        X \\<notin> parts (spies (takeWhile (\\<lambda>z. z \\<noteq> Says A B Y) (rev evs))))\"\n\ndefinition\n (* Yields the subtrace of a given trace from its beginning to a given event *)\n  before :: \"[event, event list] \\<Rightarrow> event list\" (\"before _ on _\" [0, 50] 50)\n  where \"(before ev on evs) = takeWhile (\\<lambda>z. z \\<noteq> ev) (rev evs)\"\n\ndefinition\n (* States than an event really appears only once on a trace *)\n  Unique :: \"[event, event list] \\<Rightarrow> bool\" (\"Unique _ on _\" [0, 50] 50)\n  where \"(Unique ev on evs) = (ev \\<notin> set (tl (dropWhile (\\<lambda>z. z \\<noteq> ev) evs)))\"\n\n\nconsts\n    (*Duration of the authentication key*)\n    authKlife   :: nat\n\n    (*Duration of the service key*)\n    servKlife   :: nat\n\n    (*Duration of an authenticator*)\n    authlife   :: nat\n\n    (*Upper bound on the time of reaction of a server*)\n    replylife   :: nat\n\nspecification (authKlife)\n  authKlife_LB [iff]: \"2 \\<le> authKlife\"\n    by blast\n\nspecification (servKlife)\n  servKlife_LB [iff]: \"2 + authKlife \\<le> servKlife\"\n    by blast\n\nspecification (authlife)\n  authlife_LB [iff]: \"Suc 0 \\<le> authlife\"\n    by blast\n\nspecification (replylife)\n  replylife_LB [iff]: \"Suc 0 \\<le> replylife\"\n    by blast\n\nabbreviation\n  (*The current time is the length of the trace*)\n  CT :: \"event list \\<Rightarrow> nat\" where\n  \"CT == length\"\n\nabbreviation\n  expiredAK :: \"[nat, event list] \\<Rightarrow> bool\" where\n  \"expiredAK Ta evs == authKlife + Ta < CT evs\"\n\nabbreviation\n  expiredSK :: \"[nat, event list] \\<Rightarrow> bool\" where\n  \"expiredSK Ts evs == servKlife + Ts < CT evs\"\n\nabbreviation\n  expiredA :: \"[nat, event list] \\<Rightarrow> bool\" where\n  \"expiredA T evs == authlife + T < CT evs\"\n\nabbreviation\n  valid :: \"[nat, nat] \\<Rightarrow> bool\" (\"valid _ wrt _\" [0, 50] 50) where\n  \"valid T1 wrt T2 == T1 \\<le> replylife + T2\"\n\n(*---------------------------------------------------------------------*)\n\n\n(* Predicate formalising the association between authKeys and servKeys *)\ndefinition AKcryptSK :: \"[key, key, event list] \\<Rightarrow> bool\" where\n  \"AKcryptSK authK servK evs ==\n     \\<exists>A B Ts.\n       Says Tgs A (Crypt authK\n                     \\<lbrace>Key servK, Agent B, Number Ts,\n                       Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace> \\<rbrace>)\n         \\<in> set evs\"\n\ninductive_set kerbIV :: \"event list set\"\n  where\n\n   Nil:  \"[] \\<in> kerbIV\"\n\n | Fake: \"\\<lbrakk> evsf \\<in> kerbIV;  X \\<in> synth (analz (spies evsf)) \\<rbrakk>\n          \\<Longrightarrow> Says Spy B X  # evsf \\<in> kerbIV\"\n\n(* FROM the initiator *)\n | K1:   \"\\<lbrakk> evs1 \\<in> kerbIV \\<rbrakk>\n          \\<Longrightarrow> Says A Kas \\<lbrace>Agent A, Agent Tgs, Number (CT evs1)\\<rbrace> # evs1\n          \\<in> kerbIV\"\n\n(* Adding the timestamp serves to A in K3 to check that\n   she doesn't get a reply too late. This kind of timeouts are ordinary.\n   If a server's reply is late, then it is likely to be fake. *)\n\n(*---------------------------------------------------------------------*)\n\n(*FROM Kas *)\n | K2:  \"\\<lbrakk> evs2 \\<in> kerbIV; Key authK \\<notin> used evs2; authK \\<in> symKeys;\n            Says A' Kas \\<lbrace>Agent A, Agent Tgs, Number T1\\<rbrace> \\<in> set evs2 \\<rbrakk>\n          \\<Longrightarrow> Says Kas A\n                (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number (CT evs2),\n                      (Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK,\n                          Number (CT evs2)\\<rbrace>)\\<rbrace>) # evs2 \\<in> kerbIV\"\n(*\n  The internal encryption builds the authTicket.\n  The timestamp doesn't change inside the two encryptions: the external copy\n  will be used by the initiator in K3; the one inside the\n  authTicket by Tgs in K4.\n*)\n\n(*---------------------------------------------------------------------*)\n\n(* FROM the initiator *)\n | K3:  \"\\<lbrakk> evs3 \\<in> kerbIV;\n            Says A Kas \\<lbrace>Agent A, Agent Tgs, Number T1\\<rbrace> \\<in> set evs3;\n            Says Kas' A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n              authTicket\\<rbrace>) \\<in> set evs3;\n            valid Ta wrt T1\n         \\<rbrakk>\n          \\<Longrightarrow> Says A Tgs \\<lbrace>authTicket,\n                           (Crypt authK \\<lbrace>Agent A, Number (CT evs3)\\<rbrace>),\n                           Agent B\\<rbrace> # evs3 \\<in> kerbIV\"\n(*The two events amongst the premises allow A to accept only those authKeys\n  that are not issued late. *)\n\n(*---------------------------------------------------------------------*)\n\n(* FROM Tgs *)\n(* Note that the last temporal check is not mentioned in the original MIT\n   specification. Adding it makes many goals \"available\" to the peers. \n   Theorems that exploit it have the suffix `_u', which stands for updated \n   protocol.\n*)\n | K4:  \"\\<lbrakk> evs4 \\<in> kerbIV; Key servK \\<notin> used evs4; servK \\<in> symKeys;\n            B \\<noteq> Tgs;  authK \\<in> symKeys;\n            Says A' Tgs \\<lbrace>\n             (Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK,\n                                 Number Ta\\<rbrace>),\n             (Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>), Agent B\\<rbrace>\n                \\<in> set evs4;\n            \\<not> expiredAK Ta evs4;\n            \\<not> expiredA T2 evs4;\n            servKlife + (CT evs4) \\<le> authKlife + Ta\n         \\<rbrakk>\n          \\<Longrightarrow> Says Tgs A\n                (Crypt authK \\<lbrace>Key servK, Agent B, Number (CT evs4),\n                               Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK,\n                                                Number (CT evs4)\\<rbrace> \\<rbrace>)\n                # evs4 \\<in> kerbIV\"\n(* Tgs creates a new session key per each request for a service, without\n   checking if there is still a fresh one for that service.\n   The cipher under Tgs' key is the authTicket, the cipher under B's key\n   is the servTicket, which is built now.\n   NOTE that the last temporal check is not present in the MIT specification.\n\n*)\n\n(*---------------------------------------------------------------------*)\n\n(* FROM the initiator *)\n | K5:  \"\\<lbrakk> evs5 \\<in> kerbIV; authK \\<in> symKeys; servK \\<in> symKeys;\n            Says A Tgs\n                \\<lbrace>authTicket, Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>,\n                  Agent B\\<rbrace>\n              \\<in> set evs5;\n            Says Tgs' A\n             (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n                \\<in> set evs5;\n            valid Ts wrt T2 \\<rbrakk>\n          \\<Longrightarrow> Says A B \\<lbrace>servTicket,\n                         Crypt servK \\<lbrace>Agent A, Number (CT evs5)\\<rbrace> \\<rbrace>\n               # evs5 \\<in> kerbIV\"\n(* Checks similar to those in K3. *)\n\n(*---------------------------------------------------------------------*)\n\n(* FROM the responder*)\n  | K6:  \"\\<lbrakk> evs6 \\<in> kerbIV;\n            Says A' B \\<lbrace>\n              (Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>),\n              (Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>)\\<rbrace>\n            \\<in> set evs6;\n            \\<not> expiredSK Ts evs6;\n            \\<not> expiredA T3 evs6\n         \\<rbrakk>\n          \\<Longrightarrow> Says B A (Crypt servK (Number T3))\n               # evs6 \\<in> kerbIV\"\n(* Checks similar to those in K4. *)\n\n(*---------------------------------------------------------------------*)\n\n(* Leaking an authK... *)\n | Oops1: \"\\<lbrakk> evsO1 \\<in> kerbIV;  A \\<noteq> Spy;\n              Says Kas A\n                (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n                                  authTicket\\<rbrace>)  \\<in> set evsO1;\n              expiredAK Ta evsO1 \\<rbrakk>\n          \\<Longrightarrow> Says A Spy \\<lbrace>Agent A, Agent Tgs, Number Ta, Key authK\\<rbrace>\n               # evsO1 \\<in> kerbIV\"\n\n(*---------------------------------------------------------------------*)\n\n(*Leaking a servK... *)\n | Oops2: \"\\<lbrakk> evsO2 \\<in> kerbIV;  A \\<noteq> Spy;\n              Says Tgs A\n                (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n                   \\<in> set evsO2;\n              expiredSK Ts evsO2 \\<rbrakk>\n          \\<Longrightarrow> Says A Spy \\<lbrace>Agent A, Agent B, Number Ts, Key servK\\<rbrace>\n               # evsO2 \\<in> kerbIV\"\n\n(*---------------------------------------------------------------------*)\n\ndeclare Says_imp_knows_Spy [THEN parts.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\n\nsubsection\\<open>Lemmas about lists, for reasoning about  Issues\\<close>\n\nlemma spies_Says_rev: \"spies (evs @ [Says A B X]) = insert X (spies evs)\"\napply (induct_tac \"evs\")\napply (rename_tac [2] a b)\napply (induct_tac [2] a, auto)\ndone\n\nlemma spies_Gets_rev: \"spies (evs @ [Gets A X]) = spies evs\"\napply (induct_tac \"evs\")\napply (rename_tac [2] a b)\napply (induct_tac [2] a, auto)\ndone\n\nlemma spies_Notes_rev: \"spies (evs @ [Notes A X]) =\n          (if A\\<in>bad then insert X (spies evs) else spies evs)\"\napply (induct_tac \"evs\")\napply (rename_tac [2] a b)\napply (induct_tac [2] a, auto)\ndone\n\nlemma spies_evs_rev: \"spies evs = spies (rev evs)\"\napply (induct_tac \"evs\")\napply (rename_tac [2] a b)\napply (induct_tac [2] a)\napply (simp_all (no_asm_simp) add: spies_Says_rev spies_Gets_rev spies_Notes_rev)\ndone\n\nlemmas parts_spies_evs_revD2 = spies_evs_rev [THEN equalityD2, THEN parts_mono]\n\nlemma spies_takeWhile: \"spies (takeWhile P evs) \\<subseteq> spies evs\"\napply (induct_tac \"evs\")\napply (rename_tac [2] a b)\napply (induct_tac [2] \"a\", auto)\ntxt\\<open>Resembles \\<open>used_subset_append\\<close> in theory Event.\\<close>\ndone\n\nlemmas parts_spies_takeWhile_mono = spies_takeWhile [THEN parts_mono]\n\n\nsubsection\\<open>Lemmas about \\<^term>\\<open>authKeys\\<close>\\<close>\n\nlemma authKeys_empty: \"authKeys [] = {}\"\nunfolding authKeys_def\napply (simp (no_asm))\ndone\n\nlemma authKeys_not_insert:\n \"(\\<forall>A Ta akey Peer.\n   ev \\<noteq> Says Kas A (Crypt (shrK A) \\<lbrace>akey, Agent Peer, Ta,\n              (Crypt (shrK Peer) \\<lbrace>Agent A, Agent Peer, akey, Ta\\<rbrace>)\\<rbrace>))\n       \\<Longrightarrow> authKeys (ev # evs) = authKeys evs\"\n  unfolding authKeys_def by auto\n\nlemma authKeys_insert:\n  \"authKeys\n     (Says Kas A (Crypt (shrK A) \\<lbrace>Key K, Agent Peer, Number Ta,\n      (Crypt (shrK Peer) \\<lbrace>Agent A, Agent Peer, Key K, Number Ta\\<rbrace>)\\<rbrace>) # evs)\n       = insert K (authKeys evs)\"\n  unfolding authKeys_def by auto\n\nlemma authKeys_simp:\n   \"K \\<in> authKeys\n    (Says Kas A (Crypt (shrK A) \\<lbrace>Key K', Agent Peer, Number Ta,\n     (Crypt (shrK Peer) \\<lbrace>Agent A, Agent Peer, Key K', Number Ta\\<rbrace>)\\<rbrace>) # evs)\n        \\<Longrightarrow> K = K' | K \\<in> authKeys evs\"\n  unfolding authKeys_def by auto\n\nlemma authKeysI:\n   \"Says Kas A (Crypt (shrK A) \\<lbrace>Key K, Agent Tgs, Number Ta,\n     (Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key K, Number Ta\\<rbrace>)\\<rbrace>) \\<in> set evs\n        \\<Longrightarrow> K \\<in> authKeys evs\"\n  unfolding authKeys_def by auto\n\nlemma authKeys_used: \"K \\<in> authKeys evs \\<Longrightarrow> Key K \\<in> used evs\"\nby (simp add: authKeys_def, blast)\n\n\nsubsection\\<open>Forwarding Lemmas\\<close>\n\ntext\\<open>--For reasoning about the encrypted portion of message K3--\\<close>\nlemma K3_msg_in_parts_spies:\n     \"Says Kas' A (Crypt KeyA \\<lbrace>authK, Peer, Ta, authTicket\\<rbrace>)\n               \\<in> set evs \\<Longrightarrow> authTicket \\<in> parts (spies evs)\"\nby blast\n\nlemma Oops_range_spies1:\n     \"\\<lbrakk> Says Kas A (Crypt KeyA \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>)\n           \\<in> set evs ;\n         evs \\<in> kerbIV \\<rbrakk> \\<Longrightarrow> authK \\<notin> range shrK \\<and> authK \\<in> symKeys\"\napply (erule rev_mp)\napply (erule kerbIV.induct, auto)\ndone\n\ntext\\<open>--For reasoning about the encrypted portion of message K5--\\<close>\nlemma K5_msg_in_parts_spies:\n     \"Says Tgs' A (Crypt authK \\<lbrace>servK, Agent B, Ts, servTicket\\<rbrace>)\n               \\<in> set evs \\<Longrightarrow> servTicket \\<in> parts (spies evs)\"\nby blast\n\nlemma Oops_range_spies2:\n     \"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Ts, servTicket\\<rbrace>)\n           \\<in> set evs ;\n         evs \\<in> kerbIV \\<rbrakk> \\<Longrightarrow> servK \\<notin> range shrK \\<and> servK \\<in> symKeys\"\napply (erule rev_mp)\napply (erule kerbIV.induct, auto)\ndone\n\nlemma Says_ticket_parts:\n     \"Says S A (Crypt K \\<lbrace>SesKey, B, TimeStamp, Ticket\\<rbrace>) \\<in> set evs\n      \\<Longrightarrow> Ticket \\<in> parts (spies evs)\"\nby blast\n\n(*Spy never sees another agent's shared key! (unless it's lost at start)*)\nlemma Spy_see_shrK [simp]:\n     \"evs \\<in> kerbIV \\<Longrightarrow> (Key (shrK A) \\<in> parts (spies evs)) = (A \\<in> bad)\"\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\napply (blast+)\ndone\n\nlemma Spy_analz_shrK [simp]:\n     \"evs \\<in> kerbIV \\<Longrightarrow> (Key (shrK A) \\<in> analz (spies evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"\\<lbrakk> Key (shrK A) \\<in> parts (spies evs);  evs \\<in> kerbIV \\<rbrakk> \\<Longrightarrow> A\\<in>bad\"\nby (blast dest: Spy_see_shrK)\n\nlemmas Spy_analz_shrK_D = analz_subset_parts [THEN subsetD, THEN Spy_see_shrK_D, dest!]\n\ntext\\<open>Nobody can have used non-existent keys!\\<close>\nlemma new_keys_not_used [simp]:\n    \"\\<lbrakk>Key K \\<notin> used evs; K \\<in> symKeys; evs \\<in> kerbIV\\<rbrakk>\n     \\<Longrightarrow> K \\<notin> keysFor (parts (spies evs))\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply (force dest!: keysFor_parts_insert)\ntxt\\<open>Others\\<close>\napply (force dest!: analz_shrK_Decrypt)+\ndone\n\n(*Earlier, all protocol proofs declared this theorem.\n  But few of them actually need it! (Another is Yahalom) *)\nlemma new_keys_not_analzd:\n \"\\<lbrakk>evs \\<in> kerbIV; K \\<in> symKeys; Key K \\<notin> used evs\\<rbrakk>\n  \\<Longrightarrow> K \\<notin> keysFor (analz (spies evs))\"\nby (blast dest: new_keys_not_used intro: keysFor_mono [THEN subsetD])\n\n\n\nsubsection\\<open>Lemmas for reasoning about predicate \"before\"\\<close>\n\nlemma used_Says_rev: \"used (evs @ [Says A B X]) = parts {X} \\<union> (used evs)\"\napply (induct_tac \"evs\")\napply simp\napply (rename_tac a b)\napply (induct_tac \"a\")\napply auto\ndone\n\nlemma used_Notes_rev: \"used (evs @ [Notes A X]) = parts {X} \\<union> (used evs)\"\napply (induct_tac \"evs\")\napply simp\napply (rename_tac a b)\napply (induct_tac \"a\")\napply auto\ndone\n\nlemma used_Gets_rev: \"used (evs @ [Gets B X]) = used evs\"\napply (induct_tac \"evs\")\napply simp\napply (rename_tac a b)\napply (induct_tac \"a\")\napply auto\ndone\n\nlemma used_evs_rev: \"used evs = used (rev evs)\"\napply (induct_tac \"evs\")\napply simp\napply (rename_tac a b)\napply (induct_tac \"a\")\napply (simp add: used_Says_rev)\napply (simp add: used_Gets_rev)\napply (simp add: used_Notes_rev)\ndone\n\nlemma used_takeWhile_used [rule_format]: \n      \"x \\<in> used (takeWhile P X) \\<longrightarrow> x \\<in> used X\"\napply (induct_tac \"X\")\napply simp\napply (rename_tac a b)\napply (induct_tac \"a\")\napply (simp_all add: used_Nil)\napply (blast dest!: initState_into_used)+\ndone\n\nlemma set_evs_rev: \"set evs = set (rev evs)\"\nby auto\n\nlemma takeWhile_void [rule_format]:\n      \"x \\<notin> set evs \\<longrightarrow> takeWhile (\\<lambda>z. z \\<noteq> x) evs = evs\"\nby auto\n\n\nsubsection\\<open>Regularity Lemmas\\<close>\ntext\\<open>These concern the form of items passed in messages\\<close>\n\ntext\\<open>Describes the form of all components sent by Kas\\<close>\nlemma Says_Kas_message_form:\n     \"\\<lbrakk> Says Kas A (Crypt K \\<lbrace>Key authK, Agent Peer, Number Ta, authTicket\\<rbrace>)\n           \\<in> set evs;\n         evs \\<in> kerbIV \\<rbrakk> \\<Longrightarrow>  \n  K = shrK A \\<and> Peer = Tgs \\<and>\n  authK \\<notin> range shrK \\<and> authK \\<in> authKeys evs \\<and> authK \\<in> symKeys \\<and> \n  authTicket = (Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>) \\<and>\n  Key authK \\<notin> used(before \n           Says Kas A (Crypt K \\<lbrace>Key authK, Agent Peer, Number Ta, authTicket\\<rbrace>)\n                   on evs) \\<and>\n  Ta = CT (before \n           Says Kas A (Crypt K \\<lbrace>Key authK, Agent Peer, Number Ta, authTicket\\<rbrace>)\n           on evs)\"\nunfolding before_def\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (simp_all (no_asm) add: authKeys_def authKeys_insert, blast, blast)\ntxt\\<open>K2\\<close>\napply (simp (no_asm) add: takeWhile_tail)\napply (rule conjI)\napply (metis Key_not_used authKeys_used length_rev set_rev takeWhile_void used_evs_rev)\napply blast+\ndone\n\n\n\n(*This lemma is essential for proving Says_Tgs_message_form:\n\n  the session key authK\n  supplied by Kas in the authentication ticket\n  cannot be a long-term key!\n\n  Generalised to any session keys (both authK and servK).\n*)\nlemma SesKey_is_session_key:\n     \"\\<lbrakk> Crypt (shrK Tgs_B) \\<lbrace>Agent A, Agent Tgs_B, Key SesKey, Number T\\<rbrace>\n            \\<in> parts (spies evs); Tgs_B \\<notin> bad;\n         evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> SesKey \\<notin> range shrK\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all, blast)\ndone\n\nlemma authTicket_authentic:\n     \"\\<lbrakk> Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\n           \\<in> parts (spies evs);\n         evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n                 Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n            \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake, K4\\<close>\napply (blast+)\ndone\n\nlemma authTicket_crypt_authK:\n     \"\\<lbrakk> Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\n           \\<in> parts (spies evs);\n         evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> authK \\<in> authKeys evs\"\napply (frule authTicket_authentic, assumption)\napply (simp (no_asm) add: authKeys_def)\napply blast\ndone\n\ntext\\<open>Describes the form of servK, servTicket and authK sent by Tgs\\<close>\nlemma Says_Tgs_message_form:\n     \"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n           \\<in> set evs;\n         evs \\<in> kerbIV \\<rbrakk>\n  \\<Longrightarrow> B \\<noteq> Tgs \\<and> \n      authK \\<notin> range shrK \\<and> authK \\<in> authKeys evs \\<and> authK \\<in> symKeys \\<and>\n      servK \\<notin> range shrK \\<and> servK \\<notin> authKeys evs \\<and> servK \\<in> symKeys \\<and>\n      servTicket = (Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>) \\<and>\n      Key servK \\<notin> used (before\n        Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n                        on evs) \\<and>\n      Ts = CT(before \n        Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n              on evs) \"\nunfolding before_def\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (simp_all add: authKeys_insert authKeys_not_insert authKeys_empty authKeys_simp, blast)\ntxt\\<open>We need this simplification only for Message 4\\<close>\napply (simp (no_asm) add: takeWhile_tail)\napply auto\ntxt\\<open>Five subcases of Message 4\\<close>\napply (blast dest!: SesKey_is_session_key)\napply (blast dest: authTicket_crypt_authK)\napply (blast dest!: authKeys_used Says_Kas_message_form)\ntxt\\<open>subcase: used before\\<close>\napply (metis used_evs_rev used_takeWhile_used)\ntxt\\<open>subcase: CT before\\<close>\napply (metis length_rev set_evs_rev takeWhile_void)\ndone\n\nlemma authTicket_form:\n     \"\\<lbrakk> Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         A \\<notin> bad;\n         evs \\<in> kerbIV \\<rbrakk>\n    \\<Longrightarrow> authK \\<notin> range shrK \\<and> authK \\<in> symKeys \\<and> \n        authTicket = Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Ta\\<rbrace>\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\napply (blast+)\ndone\n\ntext\\<open>This form holds also over an authTicket, but is not needed below.\\<close>\nlemma servTicket_form:\n     \"\\<lbrakk> Crypt authK \\<lbrace>Key servK, Agent B, Ts, servTicket\\<rbrace>\n              \\<in> parts (spies evs);\n            Key authK \\<notin> analz (spies evs);\n            evs \\<in> kerbIV \\<rbrakk>\n         \\<Longrightarrow> servK \\<notin> range shrK \\<and> servK \\<in> symKeys \\<and> \n    (\\<exists>A. servTicket = Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Ts\\<rbrace>)\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all, blast)\ndone\n\ntext\\<open>Essentially the same as \\<open>authTicket_form\\<close>\\<close>\nlemma Says_kas_message_form:\n     \"\\<lbrakk> Says Kas' A (Crypt (shrK A)\n              \\<lbrace>Key authK, Agent Tgs, Ta, authTicket\\<rbrace>) \\<in> set evs;\n         evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> authK \\<notin> range shrK \\<and> authK \\<in> symKeys \\<and> \n          authTicket =\n                  Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Ta\\<rbrace>\n          | authTicket \\<in> analz (spies evs)\"\nby (blast dest: analz_shrK_Decrypt authTicket_form\n                Says_imp_spies [THEN analz.Inj])\n\nlemma Says_tgs_message_form:\n \"\\<lbrakk> Says Tgs' A (Crypt authK \\<lbrace>Key servK, Agent B, Ts, servTicket\\<rbrace>)\n       \\<in> set evs;  authK \\<in> symKeys;\n     evs \\<in> kerbIV \\<rbrakk>\n  \\<Longrightarrow> servK \\<notin> range shrK \\<and>\n      (\\<exists>A. servTicket =\n              Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Ts\\<rbrace>)\n       | servTicket \\<in> analz (spies evs)\"\nby (metis Says_imp_analz_Spy Says_imp_parts_knows_Spy analz.Decrypt analz.Snd invKey_K servTicket_form)\n\n\nsubsection\\<open>Authenticity theorems: confirm origin of sensitive messages\\<close>\n\nlemma authK_authentic:\n     \"\\<lbrakk> Crypt (shrK A) \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         A \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>)\n            \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>K4\\<close>\napply (blast dest!: authTicket_authentic [THEN Says_Kas_message_form])\ndone\n\ntext\\<open>If a certain encrypted message appears then it originated with Tgs\\<close>\nlemma servK_authentic:\n     \"\\<lbrakk> Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Key authK \\<notin> analz (spies evs);\n         authK \\<notin> range shrK;\n         evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> \\<exists>A. Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>K2\\<close>\napply blast\ntxt\\<open>K4\\<close>\napply auto\ndone\n\nlemma servK_authentic_bis:\n     \"\\<lbrakk> Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Key authK \\<notin> analz (spies evs);\n         B \\<noteq> Tgs;\n         evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> \\<exists>A. Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>K4\\<close>\napply blast\ndone\n\ntext\\<open>Authenticity of servK for B\\<close>\nlemma servTicket_authentic_Tgs:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs); B \\<noteq> Tgs;  B \\<notin> bad;\n         evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> \\<exists>authK.\n       Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts,\n                   Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\\<rbrace>)\n       \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\napply blast+\ndone\n\ntext\\<open>Anticipated here from next subsection\\<close>\nlemma K4_imp_K2:\n\"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n      \\<in> set evs;  evs \\<in> kerbIV\\<rbrakk>\n   \\<Longrightarrow> \\<exists>Ta. Says Kas A\n        (Crypt (shrK A)\n         \\<lbrace>Key authK, Agent Tgs, Number Ta,\n           Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n        \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all, auto)\napply (blast dest!: Says_imp_spies [THEN parts.Inj, THEN parts.Fst, THEN authTicket_authentic])\ndone\n\ntext\\<open>Anticipated here from next subsection\\<close>\nlemma u_K4_imp_K2:\n\"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n      \\<in> set evs; evs \\<in> kerbIV\\<rbrakk>\n   \\<Longrightarrow> \\<exists>Ta. (Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n           Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n             \\<in> set evs\n          \\<and> servKlife + Ts \\<le> authKlife + Ta)\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all, auto)\napply (blast dest!: Says_imp_spies [THEN parts.Inj, THEN parts.Fst, THEN authTicket_authentic])\ndone\n\nlemma servTicket_authentic_Kas:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);  B \\<noteq> Tgs;  B \\<notin> bad;\n         evs \\<in> kerbIV \\<rbrakk>\n  \\<Longrightarrow> \\<exists>authK Ta.\n       Says Kas A\n         (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n            Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n        \\<in> set evs\"\nby (blast dest!: servTicket_authentic_Tgs K4_imp_K2)\n\nlemma u_servTicket_authentic_Kas:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);  B \\<noteq> Tgs;  B \\<notin> bad;\n         evs \\<in> kerbIV \\<rbrakk>\n  \\<Longrightarrow> \\<exists>authK Ta. Says Kas A (Crypt(shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n           Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n             \\<in> set evs\n           \\<and> servKlife + Ts \\<le> authKlife + Ta\"\nby (blast dest!: servTicket_authentic_Tgs u_K4_imp_K2)\n\nlemma servTicket_authentic:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);  B \\<noteq> Tgs;  B \\<notin> bad;\n         evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> \\<exists>Ta authK.\n     Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n                   Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n       \\<in> set evs\n     \\<and> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts,\n                   Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\\<rbrace>)\n       \\<in> set evs\"\nby (blast dest: servTicket_authentic_Tgs K4_imp_K2)\n\nlemma u_servTicket_authentic:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);  B \\<noteq> Tgs;  B \\<notin> bad;\n         evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> \\<exists>Ta authK.\n     (Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n                   Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n       \\<in> set evs\n     \\<and> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts,\n                   Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\\<rbrace>)\n       \\<in> set evs\n     \\<and> servKlife + Ts \\<le> authKlife + Ta)\"\nby (blast dest: servTicket_authentic_Tgs u_K4_imp_K2)\n\nlemma u_NotexpiredSK_NotexpiredAK:\n     \"\\<lbrakk> \\<not> expiredSK Ts evs; servKlife + Ts \\<le> authKlife + Ta \\<rbrakk>\n      \\<Longrightarrow> \\<not> expiredAK Ta evs\"\n  by (metis le_less_trans)\n\n\nsubsection\\<open>Reliability: friendly agents send something if something else happened\\<close>\n\nlemma K3_imp_K2:\n     \"\\<lbrakk> Says A Tgs\n             \\<lbrace>authTicket, Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>, Agent B\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> \\<exists>Ta. Says Kas A (Crypt (shrK A)\n                      \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>)\n                   \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all, blast, blast)\napply (blast dest: Says_imp_spies [THEN parts.Inj, THEN authK_authentic])\ndone\n\ntext\\<open>Anticipated here from next subsection. An authK is encrypted by one and only one Shared key. A servK is encrypted by one and only one authK.\\<close>\nlemma Key_unique_SesKey:\n     \"\\<lbrakk> Crypt K  \\<lbrace>Key SesKey,  Agent B, T, Ticket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt K' \\<lbrace>Key SesKey,  Agent B', T', Ticket'\\<rbrace>\n           \\<in> parts (spies evs);  Key SesKey \\<notin> analz (spies evs);\n         evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> K=K' \\<and> B=B' \\<and> T=T' \\<and> Ticket=Ticket'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake, K2, K4\\<close>\napply (blast+)\ndone\n\nlemma Tgs_authenticates_A:\n  \"\\<lbrakk>  Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace> \\<in> parts (spies evs); \n      Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\n           \\<in> parts (spies evs);\n      Key authK \\<notin> analz (spies evs); A \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> \\<exists> B. Says A Tgs \\<lbrace>\n          Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>,\n          Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>, Agent B \\<rbrace> \\<in> set evs\"  \napply (drule authTicket_authentic, assumption, rotate_tac 4)\napply (erule rev_mp, erule rev_mp, erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [5] Says_ticket_parts)\napply (frule_tac [7] Says_ticket_parts)\napply (simp_all (no_asm_simp) add: all_conj_distrib)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>K2\\<close>\napply (force dest!: Crypt_imp_keysFor)\ntxt\\<open>K3\\<close>\napply (blast dest: Key_unique_SesKey)\ntxt\\<open>K5\\<close>\napply (metis K3_imp_K2 Key_unique_SesKey Spy_see_shrK parts.Body parts.Fst \n             Says_imp_knows_Spy [THEN parts.Inj])\ndone\n\nlemma Says_K5:\n     \"\\<lbrakk> Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace> \\<in> parts (spies evs);\n         Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts,\n                                     servTicket\\<rbrace>) \\<in> set evs;\n         Key servK \\<notin> analz (spies evs);\n         A \\<notin> bad; B \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> Says A B \\<lbrace>servTicket, Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [5] Says_ticket_parts)\napply (frule_tac [7] Says_ticket_parts)\napply (simp_all (no_asm_simp) add: all_conj_distrib)\napply blast\ntxt\\<open>K3\\<close>\napply (blast dest: authK_authentic Says_Kas_message_form Says_Tgs_message_form)\ntxt\\<open>K4\\<close>\napply (force dest!: Crypt_imp_keysFor)\ntxt\\<open>K5\\<close>\napply (blast dest: Key_unique_SesKey)\ndone\n\ntext\\<open>Anticipated here from next subsection\\<close>\nlemma unique_CryptKey:\n     \"\\<lbrakk> Crypt (shrK B)  \\<lbrace>Agent A,  Agent B,  Key SesKey, T\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt (shrK B') \\<lbrace>Agent A', Agent B', Key SesKey, T'\\<rbrace>\n           \\<in> parts (spies evs);  Key SesKey \\<notin> analz (spies evs);\n         evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> A=A' \\<and> B=B' \\<and> T=T'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake, K2, K4\\<close>\napply (blast+)\ndone\n\nlemma Says_K6:\n     \"\\<lbrakk> Crypt servK (Number T3) \\<in> parts (spies evs);\n         Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts,\n                                     servTicket\\<rbrace>) \\<in> set evs;\n         Key servK \\<notin> analz (spies evs);\n         A \\<notin> bad; B \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Says B A (Crypt servK (Number T3)) \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [5] Says_ticket_parts)\napply (frule_tac [7] Says_ticket_parts)\napply (simp_all (no_asm_simp))\napply blast\napply (metis Crypt_imp_invKey_keysFor invKey_K new_keys_not_used)\napply (clarify)\napply (frule Says_Tgs_message_form, assumption)\napply (metis K3_msg_in_parts_spies parts.Fst Says_imp_knows_Spy [THEN parts.Inj] \n             unique_CryptKey) \ndone\n\ntext\\<open>Needs a unicity theorem, hence moved here\\<close>\nlemma servK_authentic_ter:\n \"\\<lbrakk> Says Kas A\n    (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>) \\<in> set evs;\n     Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n       \\<in> parts (spies evs);\n     Key authK \\<notin> analz (spies evs);\n     evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs\"\napply (frule Says_Kas_message_form, assumption)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all, blast)\ntxt\\<open>K2\\<close>\napply (blast dest!: servK_authentic Says_Tgs_message_form authKeys_used)\ntxt\\<open>K4 remain\\<close>\napply (blast dest!: unique_CryptKey)\ndone\n\n\nsubsection\\<open>Unicity Theorems\\<close>\n\ntext\\<open>The session key, if secure, uniquely identifies the Ticket\n   whether authTicket or servTicket. As a matter of fact, one can read\n   also Tgs in the place of B.\\<close>\n\n\n(*\n  At reception of any message mentioning A, Kas associates shrK A with\n  a new authK. Realistic, as the user gets a new authK at each login.\n  Similarly, at reception of any message mentioning an authK\n  (a legitimate user could make several requests to Tgs - by K3), Tgs\n  associates it with a new servK.\n\n  Therefore, a goal like\n\n   \"evs \\<in> kerbIV\n     \\<Longrightarrow> Key Kc \\<notin> analz (spies evs) \\<longrightarrow>\n           (\\<exists>K' B' T' Ticket'. \\<forall>K B T Ticket.\n            Crypt Kc \\<lbrace>Key K, Agent B, T, Ticket\\<rbrace>\n             \\<in> parts (spies evs) \\<longrightarrow> K=K' \\<and> B=B' \\<and> T=T' \\<and> Ticket=Ticket')\"\n\n  would fail on the K2 and K4 cases.\n*)\n\nlemma unique_authKeys:\n     \"\\<lbrakk> Says Kas A\n              (Crypt Ka \\<lbrace>Key authK, Agent Tgs, Ta, X\\<rbrace>) \\<in> set evs;\n         Says Kas A'\n              (Crypt Ka' \\<lbrace>Key authK, Agent Tgs, Ta', X'\\<rbrace>) \\<in> set evs;\n         evs \\<in> kerbIV \\<rbrakk> \\<Longrightarrow> A=A' \\<and> Ka=Ka' \\<and> Ta=Ta' \\<and> X=X'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\ntxt\\<open>K2\\<close>\napply blast\ndone\n\ntext\\<open>servK uniquely identifies the message from Tgs\\<close>\nlemma unique_servKeys:\n     \"\\<lbrakk> Says Tgs A\n              (Crypt K \\<lbrace>Key servK, Agent B, Ts, X\\<rbrace>) \\<in> set evs;\n         Says Tgs A'\n              (Crypt K' \\<lbrace>Key servK, Agent B', Ts', X'\\<rbrace>) \\<in> set evs;\n         evs \\<in> kerbIV \\<rbrakk> \\<Longrightarrow> A=A' \\<and> B=B' \\<and> K=K' \\<and> Ts=Ts' \\<and> X=X'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\ntxt\\<open>K4\\<close>\napply blast\ndone\n\ntext\\<open>Revised unicity theorems\\<close>\n\nlemma Kas_Unique:\n     \"\\<lbrakk> Says Kas A\n              (Crypt Ka \\<lbrace>Key authK, Agent Tgs, Ta, authTicket\\<rbrace>) \\<in> set evs;\n        evs \\<in> kerbIV \\<rbrakk> \\<Longrightarrow> \n   Unique (Says Kas A (Crypt Ka \\<lbrace>Key authK, Agent Tgs, Ta, authTicket\\<rbrace>)) \n   on evs\"\napply (erule rev_mp, erule kerbIV.induct, simp_all add: Unique_def)\napply blast\ndone\n\nlemma Tgs_Unique:\n     \"\\<lbrakk> Says Tgs A\n              (Crypt authK \\<lbrace>Key servK, Agent B, Ts, servTicket\\<rbrace>) \\<in> set evs;\n        evs \\<in> kerbIV \\<rbrakk> \\<Longrightarrow> \n  Unique (Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Ts, servTicket\\<rbrace>)) \n  on evs\"\napply (erule rev_mp, erule kerbIV.induct, simp_all add: Unique_def)\napply blast\ndone\n\n\nsubsection\\<open>Lemmas About the Predicate \\<^term>\\<open>AKcryptSK\\<close>\\<close>\n\nlemma not_AKcryptSK_Nil [iff]: \"\\<not> AKcryptSK authK servK []\"\nby (simp add: AKcryptSK_def)\n\nlemma AKcryptSKI:\n \"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, X \\<rbrace>) \\<in> set evs;\n     evs \\<in> kerbIV \\<rbrakk> \\<Longrightarrow> AKcryptSK authK servK evs\"\nunfolding AKcryptSK_def\napply (blast dest: Says_Tgs_message_form)\ndone\n\nlemma AKcryptSK_Says [simp]:\n   \"AKcryptSK authK servK (Says S A X # evs) =\n     (Tgs = S \\<and>\n      (\\<exists>B Ts. X = Crypt authK\n                \\<lbrace>Key servK, Agent B, Number Ts,\n                  Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace> \\<rbrace>)\n     | AKcryptSK authK servK evs)\"\nby (auto simp add: AKcryptSK_def)\n\n\n(*A fresh authK cannot be associated with any other\n  (with respect to a given trace). *)\nlemma Auth_fresh_not_AKcryptSK:\n     \"\\<lbrakk> Key authK \\<notin> used evs; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK authK servK evs\"\nunfolding AKcryptSK_def\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all, blast)\ndone\n\n(*A fresh servK cannot be associated with any other\n  (with respect to a given trace). *)\nlemma Serv_fresh_not_AKcryptSK:\n \"Key servK \\<notin> used evs \\<Longrightarrow> \\<not> AKcryptSK authK servK evs\"\n  unfolding AKcryptSK_def by blast\n\nlemma authK_not_AKcryptSK:\n     \"\\<lbrakk> Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, tk\\<rbrace>\n           \\<in> parts (spies evs);  evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK K authK evs\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>K2: by freshness\\<close>\napply (simp add: AKcryptSK_def)\ntxt\\<open>K4\\<close>\napply (blast+)\ndone\n\ntext\\<open>A secure serverkey cannot have been used to encrypt others\\<close>\nlemma servK_not_AKcryptSK:\n \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key SK, Number Ts\\<rbrace> \\<in> parts (spies evs);\n     Key SK \\<notin> analz (spies evs);  SK \\<in> symKeys;\n     B \\<noteq> Tgs;  evs \\<in> kerbIV \\<rbrakk>\n  \\<Longrightarrow> \\<not> AKcryptSK SK K evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all, blast)\ntxt\\<open>K4\\<close>\napply (metis Auth_fresh_not_AKcryptSK Crypt_imp_keysFor new_keys_not_used parts.Fst parts.Snd Says_imp_knows_Spy [THEN parts.Inj] unique_CryptKey)\ndone\n\ntext\\<open>Long term keys are not issued as servKeys\\<close>\nlemma shrK_not_AKcryptSK:\n     \"evs \\<in> kerbIV \\<Longrightarrow> \\<not> AKcryptSK K (shrK A) evs\"\nunfolding AKcryptSK_def\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, auto)\ndone\n\ntext\\<open>The Tgs message associates servK with authK and therefore not with any\n  other key authK.\\<close>\nlemma Says_Tgs_AKcryptSK:\n     \"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, X \\<rbrace>)\n           \\<in> set evs;\n         authK' \\<noteq> authK;  evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK authK' servK evs\"\nunfolding AKcryptSK_def\napply (blast dest: unique_servKeys)\ndone\n\ntext\\<open>Equivalently\\<close>\nlemma not_different_AKcryptSK:\n     \"\\<lbrakk> AKcryptSK authK servK evs;\n        authK' \\<noteq> authK;  evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK authK' servK evs  \\<and> servK \\<in> symKeys\"\napply (simp add: AKcryptSK_def)\napply (blast dest: unique_servKeys Says_Tgs_message_form)\ndone\n\nlemma AKcryptSK_not_AKcryptSK:\n     \"\\<lbrakk> AKcryptSK authK servK evs;  evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK servK K evs\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\napply (metis Auth_fresh_not_AKcryptSK Says_imp_spies authK_not_AKcryptSK \n             authKeys_used authTicket_crypt_authK parts.Fst parts.Inj)\ndone\n\ntext\\<open>The only session keys that can be found with the help of session keys are\n  those sent by Tgs in step K4.\\<close>\n\ntext\\<open>We take some pains to express the property\n  as a logical equivalence so that the simplifier can apply it.\\<close>\nlemma Key_analz_image_Key_lemma:\n     \"P \\<longrightarrow> (Key K \\<in> analz (Key`KK \\<union> H)) \\<longrightarrow> (K\\<in>KK | Key K \\<in> analz H)\n      \\<Longrightarrow>\n      P \\<longrightarrow> (Key K \\<in> analz (Key`KK \\<union> H)) = (K\\<in>KK | Key K \\<in> analz H)\"\nby (blast intro: analz_mono [THEN subsetD])\n\n\nlemma AKcryptSK_analz_insert:\n     \"\\<lbrakk> AKcryptSK K K' evs; K \\<in> symKeys; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Key K' \\<in> analz (insert (Key K) (spies evs))\"\napply (simp add: AKcryptSK_def, clarify)\napply (drule Says_imp_spies [THEN analz.Inj, THEN analz_insertI], auto)\ndone\n\nlemma authKeys_are_not_AKcryptSK:\n     \"\\<lbrakk> K \\<in> authKeys evs \\<union> range shrK;  evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> \\<forall>SK. \\<not> AKcryptSK SK K evs \\<and> K \\<in> symKeys\"\napply (simp add: authKeys_def AKcryptSK_def)\napply (blast dest: Says_Kas_message_form Says_Tgs_message_form)\ndone\n\nlemma not_authKeys_not_AKcryptSK:\n     \"\\<lbrakk> K \\<notin> authKeys evs;\n         K \\<notin> range shrK; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> \\<forall>SK. \\<not> AKcryptSK K SK evs\"\napply (simp add: AKcryptSK_def)\napply (blast dest: Says_Tgs_message_form)\ndone\n\n\nsubsection\\<open>Secrecy Theorems\\<close>\n\ntext\\<open>For the Oops2 case of the next theorem\\<close>\nlemma Oops2_not_AKcryptSK:\n     \"\\<lbrakk> evs \\<in> kerbIV;\n         Says Tgs A (Crypt authK\n                     \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n           \\<in> set evs \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK servK SK evs\"\nby (blast dest: AKcryptSKI AKcryptSK_not_AKcryptSK)\n   \ntext\\<open>Big simplification law for keys SK that are not crypted by keys in KK\n It helps prove three, otherwise hard, facts about keys. These facts are\n exploited as simplification laws for analz, and also \"limit the damage\"\n in case of loss of a key to the spy. See ESORICS98.\n [simplified by LCP]\\<close>\nlemma Key_analz_image_Key [rule_format (no_asm)]:\n     \"evs \\<in> kerbIV \\<Longrightarrow>\n      (\\<forall>SK KK. SK \\<in> symKeys \\<and> KK \\<subseteq> -(range shrK) \\<longrightarrow>\n       (\\<forall>K \\<in> KK. \\<not> AKcryptSK K SK evs)   \\<longrightarrow>\n       (Key SK \\<in> analz (Key`KK \\<union> (spies evs))) =\n       (SK \\<in> KK | Key SK \\<in> analz (spies evs)))\"\napply (erule kerbIV.induct)\napply (frule_tac [10] Oops_range_spies2)\napply (frule_tac [9] Oops_range_spies1)\napply (frule_tac [7] Says_tgs_message_form)\napply (frule_tac [5] Says_kas_message_form)\napply (safe del: impI intro!: Key_analz_image_Key_lemma [THEN impI])\ntxt\\<open>Case-splits for Oops1 and message 5: the negated case simplifies using\n the induction hypothesis\\<close>\napply (case_tac [11] \"AKcryptSK authK SK evsO1\")\napply (case_tac [8] \"AKcryptSK servK SK evs5\")\napply (simp_all del: image_insert\n        add: analz_image_freshK_simps AKcryptSK_Says shrK_not_AKcryptSK\n             Oops2_not_AKcryptSK Auth_fresh_not_AKcryptSK\n       Serv_fresh_not_AKcryptSK Says_Tgs_AKcryptSK Spy_analz_shrK)\ntxt\\<open>Fake\\<close> \napply spy_analz\ntxt\\<open>K2\\<close>\napply blast \ntxt\\<open>K3\\<close>\napply blast \ntxt\\<open>K4\\<close>\napply (blast dest!: authK_not_AKcryptSK)\ntxt\\<open>K5\\<close>\napply (case_tac \"Key servK \\<in> analz (spies evs5) \")\ntxt\\<open>If servK is compromised then the result follows directly...\\<close>\napply (simp (no_asm_simp) add: analz_insert_eq Un_upper2 [THEN analz_mono, THEN subsetD])\ntxt\\<open>...therefore servK is uncompromised.\\<close>\ntxt\\<open>The AKcryptSK servK SK evs5 case leads to a contradiction.\\<close>\napply (blast elim!: servK_not_AKcryptSK [THEN [2] rev_notE] del: allE ballE)\ntxt\\<open>Another K5 case\\<close>\napply blast \ntxt\\<open>Oops1\\<close>\napply simp \napply (blast dest!: AKcryptSK_analz_insert)\ndone\n\ntext\\<open>First simplification law for analz: no session keys encrypt\nauthentication keys or shared keys.\\<close>\nlemma analz_insert_freshK1:\n     \"\\<lbrakk> evs \\<in> kerbIV;  K \\<in> authKeys evs \\<union> range shrK;\n        SesKey \\<notin> range shrK \\<rbrakk>\n      \\<Longrightarrow> (Key K \\<in> analz (insert (Key SesKey) (spies evs))) =\n          (K = SesKey | Key K \\<in> analz (spies evs))\"\napply (frule authKeys_are_not_AKcryptSK, assumption)\napply (simp del: image_insert\n            add: analz_image_freshK_simps add: Key_analz_image_Key)\ndone\n\n\ntext\\<open>Second simplification law for analz: no service keys encrypt any other keys.\\<close>\nlemma analz_insert_freshK2:\n     \"\\<lbrakk> evs \\<in> kerbIV;  servK \\<notin> (authKeys evs); servK \\<notin> range shrK;\n        K \\<in> symKeys \\<rbrakk>\n      \\<Longrightarrow> (Key K \\<in> analz (insert (Key servK) (spies evs))) =\n          (K = servK | Key K \\<in> analz (spies evs))\"\napply (frule not_authKeys_not_AKcryptSK, assumption, assumption)\napply (simp del: image_insert\n            add: analz_image_freshK_simps add: Key_analz_image_Key)\ndone\n\n\ntext\\<open>Third simplification law for analz: only one authentication key encrypts a certain service key.\\<close>\n\nlemma analz_insert_freshK3:\n \"\\<lbrakk> AKcryptSK authK servK evs;\n    authK' \\<noteq> authK; authK' \\<notin> range shrK; evs \\<in> kerbIV \\<rbrakk>\n        \\<Longrightarrow> (Key servK \\<in> analz (insert (Key authK') (spies evs))) =\n                (servK = authK' | Key servK \\<in> analz (spies evs))\"\napply (drule_tac authK' = authK' in not_different_AKcryptSK, blast, assumption)\napply (simp del: image_insert\n            add: analz_image_freshK_simps add: Key_analz_image_Key)\ndone\n\nlemma analz_insert_freshK3_bis:\n \"\\<lbrakk> Says Tgs A\n            (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n        \\<in> set evs; \n     authK \\<noteq> authK'; authK' \\<notin> range shrK; evs \\<in> kerbIV \\<rbrakk>\n        \\<Longrightarrow> (Key servK \\<in> analz (insert (Key authK') (spies evs))) =\n                (servK = authK' | Key servK \\<in> analz (spies evs))\"\napply (frule AKcryptSKI, assumption)\napply (simp add: analz_insert_freshK3)\ndone\n\ntext\\<open>a weakness of the protocol\\<close>\nlemma authK_compromises_servK:\n     \"\\<lbrakk> Says Tgs A\n              (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n           \\<in> set evs;  authK \\<in> symKeys;\n         Key authK \\<in> analz (spies evs); evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<in> analz (spies evs)\"\n  by (metis Says_imp_analz_Spy analz.Fst analz_Decrypt')\n\nlemma servK_notin_authKeysD:\n     \"\\<lbrakk> Crypt authK \\<lbrace>Key servK, Agent B, Ts,\n                      Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Ts\\<rbrace>\\<rbrace>\n           \\<in> parts (spies evs);\n         Key servK \\<notin> analz (spies evs);\n         B \\<noteq> Tgs; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> servK \\<notin> authKeys evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (simp add: authKeys_def)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all)\napply (blast+)\ndone\n\n\ntext\\<open>If Spy sees the Authentication Key sent in msg K2, then\n    the Key has expired.\\<close>\nlemma Confidentiality_Kas_lemma [rule_format]:\n     \"\\<lbrakk> authK \\<in> symKeys; A \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Says Kas A\n               (Crypt (shrK A)\n                  \\<lbrace>Key authK, Agent Tgs, Number Ta,\n          Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n            \\<in> set evs \\<longrightarrow>\n          Key authK \\<in> analz (spies evs) \\<longrightarrow>\n          expiredAK Ta evs\"\napply (erule kerbIV.induct)\napply (frule_tac [10] Oops_range_spies2)\napply (frule_tac [9] Oops_range_spies1)\napply (frule_tac [7] Says_tgs_message_form)\napply (frule_tac [5] Says_kas_message_form)\napply (safe del: impI conjI impCE)\napply (simp_all (no_asm_simp) add: Says_Kas_message_form less_SucI analz_insert_eq not_parts_not_analz analz_insert_freshK1 pushes)\ntxt\\<open>Fake\\<close>\napply spy_analz\ntxt\\<open>K2\\<close>\napply blast\ntxt\\<open>K4\\<close>\napply blast\ntxt\\<open>Level 8: K5\\<close>\napply (blast dest: servK_notin_authKeysD Says_Kas_message_form intro: less_SucI)\ntxt\\<open>Oops1\\<close>\napply (blast dest!: unique_authKeys intro: less_SucI)\ntxt\\<open>Oops2\\<close>\napply (blast dest: Says_Tgs_message_form Says_Kas_message_form)\ndone\n\nlemma Confidentiality_Kas:\n     \"\\<lbrakk> Says Kas A\n              (Crypt Ka \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>)\n           \\<in> set evs;\n         \\<not> expiredAK Ta evs;\n         A \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Key authK \\<notin> analz (spies evs)\"\nby (blast dest: Says_Kas_message_form Confidentiality_Kas_lemma)\n\ntext\\<open>If Spy sees the Service Key sent in msg K4, then\n    the Key has expired.\\<close>\n\nlemma Confidentiality_lemma [rule_format]:\n     \"\\<lbrakk> Says Tgs A\n            (Crypt authK\n               \\<lbrace>Key servK, Agent B, Number Ts,\n                 Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\\<rbrace>)\n           \\<in> set evs;\n        Key authK \\<notin> analz (spies evs);\n        servK \\<in> symKeys;\n        A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<in> analz (spies evs) \\<longrightarrow>\n          expiredSK Ts evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (rule_tac [9] impI)+\n  \\<comment> \\<open>The Oops1 case is unusual: must simplify\n    \\<^term>\\<open>Authkey \\<notin> analz (spies (ev#evs))\\<close>, not letting\n   \\<open>analz_mono_contra\\<close> weaken it to\n   \\<^term>\\<open>Authkey \\<notin> analz (spies evs)\\<close>,\n  for we then conclude \\<^term>\\<open>authK \\<noteq> authKa\\<close>.\\<close>\napply analz_mono_contra\napply (frule_tac [10] Oops_range_spies2)\napply (frule_tac [9] Oops_range_spies1)\napply (frule_tac [7] Says_tgs_message_form)\napply (frule_tac [5] Says_kas_message_form)\napply (safe del: impI conjI impCE)\napply (simp_all add: less_SucI new_keys_not_analzd Says_Kas_message_form Says_Tgs_message_form analz_insert_eq not_parts_not_analz analz_insert_freshK1 analz_insert_freshK2 analz_insert_freshK3_bis pushes)\ntxt\\<open>Fake\\<close>\n     apply spy_analz\ntxt\\<open>K2\\<close>\n    apply (blast intro: parts_insertI less_SucI)\ntxt\\<open>K4\\<close>\n   apply (blast dest: authTicket_authentic Confidentiality_Kas)\ntxt\\<open>K5\\<close>\n  apply (metis Says_imp_spies Says_ticket_parts Tgs_not_bad analz_insert_freshK2 \n             less_SucI parts.Inj servK_notin_authKeysD unique_CryptKey)\ntxt\\<open>Oops1\\<close> \n apply (blast dest: Says_Kas_message_form Says_Tgs_message_form intro: less_SucI)\ntxt\\<open>Oops2\\<close>\napply (blast dest: Says_imp_spies [THEN parts.Inj] Key_unique_SesKey intro: less_SucI)\ndone\n\n\ntext\\<open>In the real world Tgs can't check wheter authK is secure!\\<close>\nlemma Confidentiality_Tgs:\n     \"\\<lbrakk> Says Tgs A\n              (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n           \\<in> set evs;\n         Key authK \\<notin> analz (spies evs);\n         \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<notin> analz (spies evs)\"\nby (blast dest: Says_Tgs_message_form Confidentiality_lemma)\n\ntext\\<open>In the real world Tgs CAN check what Kas sends!\\<close>\nlemma Confidentiality_Tgs_bis:\n     \"\\<lbrakk> Says Kas A\n               (Crypt Ka \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>)\n           \\<in> set evs;\n         Says Tgs A\n              (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n           \\<in> set evs;\n         \\<not> expiredAK Ta evs; \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<notin> analz (spies evs)\"\nby (blast dest!: Confidentiality_Kas Confidentiality_Tgs)\n\ntext\\<open>Most general form\\<close>\nlemmas Confidentiality_Tgs_ter = authTicket_authentic [THEN Confidentiality_Tgs_bis]\n\nlemmas Confidentiality_Auth_A = authK_authentic [THEN Confidentiality_Kas]\n\ntext\\<open>Needs a confidentiality guarantee, hence moved here.\n      Authenticity of servK for A\\<close>\nlemma servK_authentic_bis_r:\n     \"\\<lbrakk> Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredAK Ta evs; A \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow>Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs\"\nby (blast dest: authK_authentic Confidentiality_Auth_A servK_authentic_ter)\n\nlemma Confidentiality_Serv_A:\n     \"\\<lbrakk> Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredAK Ta evs; \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<notin> analz (spies evs)\"\napply (drule authK_authentic, assumption, assumption)\napply (blast dest: Confidentiality_Kas Says_Kas_message_form servK_authentic_ter Confidentiality_Tgs_bis)\ndone\n\nlemma Confidentiality_B:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredSK Ts evs; \\<not> expiredAK Ta evs;\n         A \\<notin> bad;  B \\<notin> bad; B \\<noteq> Tgs; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<notin> analz (spies evs)\"\napply (frule authK_authentic)\napply (frule_tac [3] Confidentiality_Kas)\napply (frule_tac [6] servTicket_authentic, auto)\napply (blast dest!: Confidentiality_Tgs_bis dest: Says_Kas_message_form servK_authentic unique_servKeys unique_authKeys)\ndone\n(*\nThe proof above is fast.  It can be done in one command in 17 secs:\napply (blast dest: authK_authentic servK_authentic\n                               Says_Kas_message_form servTicket_authentic\n                               unique_servKeys unique_authKeys\n                               Confidentiality_Kas\n                               Confidentiality_Tgs_bis)\nIt is very brittle: we can't use this command partway\nthrough the script above.\n*)\n\nlemma u_Confidentiality_B:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad;  B \\<noteq> Tgs; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<notin> analz (spies evs)\"\nby (blast dest: u_servTicket_authentic u_NotexpiredSK_NotexpiredAK Confidentiality_Tgs_bis)\n\n\n\nsubsection\\<open>Parties authentication: each party verifies \"the identity of\n       another party who generated some data\" (quoted from Neuman and Ts'o).\\<close>\n\ntext\\<open>These guarantees don't assess whether two parties agree on\n         the same session key: sending a message containing a key\n         doesn't a priori state knowledge of the key.\\<close>\n\n\ntext\\<open>\\<open>Tgs_authenticates_A\\<close> can be found above\\<close>\n\nlemma A_authenticates_Tgs:\n \"\\<lbrakk> Says Kas A\n    (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>) \\<in> set evs;\n     Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n       \\<in> parts (spies evs);\n     Key authK \\<notin> analz (spies evs);\n     evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs\"\napply (frule Says_Kas_message_form, assumption)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [7] K5_msg_in_parts_spies)\napply (frule_tac [5] K3_msg_in_parts_spies, simp_all, blast)\ntxt\\<open>K2\\<close>\napply (blast dest!: servK_authentic Says_Tgs_message_form authKeys_used)\ntxt\\<open>K4\\<close>\napply (blast dest!: unique_CryptKey)\ndone\n\n\nlemma B_authenticates_A:\n     \"\\<lbrakk> Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace> \\<in> parts (spies evs);\n        Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);\n        Key servK \\<notin> analz (spies evs);\n        A \\<notin> bad; B \\<notin> bad; B \\<noteq> Tgs; evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> Says A B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>,\n               Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>\\<rbrace> \\<in> set evs\"\nby (blast dest: servTicket_authentic_Tgs intro: Says_K5)\n\ntext\\<open>The second assumption tells B what kind of key servK is.\\<close>\nlemma B_authenticates_A_r:\n     \"\\<lbrakk> Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace> \\<in> parts (spies evs);\n         Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredSK Ts evs; \\<not> expiredAK Ta evs;\n         B \\<noteq> Tgs; A \\<notin> bad;  B \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n   \\<Longrightarrow> Says A B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>,\n                  Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace> \\<rbrace> \\<in> set evs\"\nby (blast intro: Says_K5 dest: Confidentiality_B servTicket_authentic_Tgs)\n\ntext\\<open>\\<open>u_B_authenticates_A\\<close> would be the same as \\<open>B_authenticates_A\\<close> because the servK confidentiality assumption is yet unrelaxed\\<close>\n\nlemma u_B_authenticates_A_r:\n     \"\\<lbrakk> Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace> \\<in> parts (spies evs);\n         Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredSK Ts evs;\n         B \\<noteq> Tgs; A \\<notin> bad;  B \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n   \\<Longrightarrow> Says A B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>,\n                  Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace> \\<rbrace> \\<in> set evs\"\nby (blast intro: Says_K5 dest: u_Confidentiality_B servTicket_authentic_Tgs)\n\nlemma A_authenticates_B:\n     \"\\<lbrakk> Crypt servK (Number T3) \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Key authK \\<notin> analz (spies evs); Key servK \\<notin> analz (spies evs);\n         A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Says B A (Crypt servK (Number T3)) \\<in> set evs\"\nby (blast dest: authK_authentic servK_authentic Says_Kas_message_form Key_unique_SesKey K4_imp_K2 intro: Says_K6)\n\nlemma A_authenticates_B_r:\n     \"\\<lbrakk> Crypt servK (Number T3) \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredAK Ta evs; \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> Says B A (Crypt servK (Number T3)) \\<in> set evs\"\napply (frule authK_authentic)\napply (frule_tac [3] Says_Kas_message_form)\napply (frule_tac [4] Confidentiality_Kas)\napply (frule_tac [7] servK_authentic)\nprefer 8 apply blast\napply (erule_tac [9] exE)\napply (frule_tac [9] K4_imp_K2)\napply assumption+\napply (blast dest: Key_unique_SesKey intro!: Says_K6 dest: Confidentiality_Tgs\n)\ndone\n\n\nsubsection\\<open>Key distribution guarantees\n       An agent knows a session key if he used it to issue a cipher.\n       These guarantees also convey a stronger form of \n       authentication - non-injective agreement on the session key\\<close>\n\n\nlemma Kas_Issues_A:\n   \"\\<lbrakk> Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>) \\<in> set evs;\n      evs \\<in> kerbIV \\<rbrakk>\n  \\<Longrightarrow> Kas Issues A with (Crypt (shrK A) \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>) \n          on evs\"\nunfolding Issues_def\napply (rule exI)\napply (rule conjI, assumption)\napply (simp (no_asm))\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply (frule_tac [5] Says_ticket_parts)\napply (frule_tac [7] Says_ticket_parts)\napply (simp_all (no_asm_simp) add: all_conj_distrib)\ntxt\\<open>K2\\<close>\napply (simp add: takeWhile_tail)\napply (blast dest: authK_authentic parts_spies_takeWhile_mono [THEN subsetD] parts_spies_evs_revD2 [THEN subsetD])\ndone\n\nlemma A_authenticates_and_keydist_to_Kas:\n  \"\\<lbrakk> Crypt (shrK A) \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace> \\<in> parts (spies evs);\n     A \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> Kas Issues A with (Crypt (shrK A) \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>) \n          on evs\"\nby (blast dest: authK_authentic Kas_Issues_A)\n\nlemma honest_never_says_newer_timestamp_in_auth:\n     \"\\<lbrakk> (CT evs) \\<le> T; A \\<notin> bad; Number T \\<in> parts {X}; evs \\<in> kerbIV \\<rbrakk> \n     \\<Longrightarrow> \\<forall> B Y.  Says A B \\<lbrace>Y, X\\<rbrace> \\<notin> set evs\"\napply (erule rev_mp)\napply (erule kerbIV.induct)\napply force+\ndone\n\nlemma honest_never_says_current_timestamp_in_auth:\n     \"\\<lbrakk> (CT evs) = T; Number T \\<in> parts {X}; evs \\<in> kerbIV \\<rbrakk> \n     \\<Longrightarrow> \\<forall> A B Y. A \\<notin> bad \\<longrightarrow> Says A B \\<lbrace>Y, X\\<rbrace> \\<notin> set evs\"\n  by (metis eq_imp_le honest_never_says_newer_timestamp_in_auth)\n\nlemma A_trusts_secure_authenticator:\n    \"\\<lbrakk> Crypt K \\<lbrace>Agent A, Number T\\<rbrace> \\<in> parts (spies evs);\n       Key K \\<notin> analz (spies evs); evs \\<in> kerbIV \\<rbrakk>\n\\<Longrightarrow> \\<exists> B X. Says A Tgs \\<lbrace>X, Crypt K \\<lbrace>Agent A, Number T\\<rbrace>, Agent B\\<rbrace> \\<in> set evs \\<or> \n           Says A B \\<lbrace>X, Crypt K \\<lbrace>Agent A, Number T\\<rbrace>\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [5] Says_ticket_parts)\napply (frule_tac [7] Says_ticket_parts)\napply (simp_all add: all_conj_distrib)\napply blast+\ndone\n\nlemma A_Issues_Tgs:\n  \"\\<lbrakk> Says A Tgs \\<lbrace>authTicket, Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>, Agent B\\<rbrace>\n       \\<in> set evs; \n     Key authK \\<notin> analz (spies evs);  \n     A \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> A Issues Tgs with (Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>) on evs\"\nunfolding Issues_def\napply (rule exI)\napply (rule conjI, assumption)\napply (simp (no_asm))\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [5] Says_ticket_parts)\napply (frule_tac [7] Says_ticket_parts)\napply (simp_all (no_asm_simp) add: all_conj_distrib)\ntxt\\<open>fake\\<close>\napply blast\ntxt\\<open>K3\\<close>\n(*\napply clarify\napply (drule Says_imp_knows_Spy [THEN parts.Inj, THEN authK_authentic, THEN Says_Kas_message_form], assumption, assumption, assumption)\n*)\napply (simp add: takeWhile_tail)\napply auto\napply (force dest!: authK_authentic Says_Kas_message_form)\napply (drule parts_spies_takeWhile_mono [THEN subsetD, THEN parts_spies_evs_revD2 [THEN subsetD]])\napply (drule A_trusts_secure_authenticator, assumption, assumption)\napply (simp add: honest_never_says_current_timestamp_in_auth)\ndone\n\nlemma Tgs_authenticates_and_keydist_to_A:\n  \"\\<lbrakk>  Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace> \\<in> parts (spies evs); \n      Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\n           \\<in> parts (spies evs);\n     Key authK \\<notin> analz (spies evs);  \n     A \\<notin> bad; evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> A Issues Tgs with (Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>) on evs\"\nby (blast dest: A_Issues_Tgs Tgs_authenticates_A)\n\nlemma Tgs_Issues_A:\n    \"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket \\<rbrace>)\n         \\<in> set evs; \n       Key authK \\<notin> analz (spies evs);  evs \\<in> kerbIV \\<rbrakk>\n  \\<Longrightarrow> Tgs Issues A with \n          (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket \\<rbrace>) on evs\"\nunfolding Issues_def\napply (rule exI)\napply (rule conjI, assumption)\napply (simp (no_asm))\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [5] Says_ticket_parts)\napply (frule_tac [7] Says_ticket_parts)\napply (simp_all (no_asm_simp) add: all_conj_distrib)\ntxt\\<open>K4\\<close>\napply (simp add: takeWhile_tail)\n(*Last two thms installed only to derive authK \\<notin> range shrK*)\napply (metis knows_Spy_partsEs(2) parts.Fst usedI used_evs_rev used_takeWhile_used)\ndone\n\nlemma A_authenticates_and_keydist_to_Tgs:\n\"\\<lbrakk>Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace> \\<in> parts (spies evs);\n  Key authK \\<notin> analz (spies evs); B \\<noteq> Tgs; evs \\<in> kerbIV \\<rbrakk>\n \\<Longrightarrow> \\<exists>A. Tgs Issues A with \n          (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket \\<rbrace>) on evs\"\nby (blast dest: Tgs_Issues_A servK_authentic_bis)\n\n\n\nlemma B_Issues_A:\n     \"\\<lbrakk> Says B A (Crypt servK (Number T3)) \\<in> set evs;\n         Key servK \\<notin> analz (spies evs);\n         A \\<notin> bad;  B \\<notin> bad; B \\<noteq> Tgs; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> B Issues A with (Crypt servK (Number T3)) on evs\"\nunfolding Issues_def\napply (rule exI)\napply (rule conjI, assumption)\napply (simp (no_asm))\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [5] Says_ticket_parts)\napply (frule_tac [7] Says_ticket_parts)\napply (simp_all (no_asm_simp) add: all_conj_distrib)\napply blast\ntxt\\<open>K6 requires numerous lemmas\\<close>\napply (simp add: takeWhile_tail)\napply (blast dest: servTicket_authentic parts_spies_takeWhile_mono [THEN subsetD] parts_spies_evs_revD2 [THEN subsetD] intro: Says_K6)\ndone\n\nlemma B_Issues_A_r:\n     \"\\<lbrakk> Says B A (Crypt servK (Number T3)) \\<in> set evs;\n         Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n            \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n            \\<in> parts (spies evs);\n         Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredSK Ts evs; \\<not> expiredAK Ta evs;\n         A \\<notin> bad;  B \\<notin> bad; B \\<noteq> Tgs; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> B Issues A with (Crypt servK (Number T3)) on evs\"\nby (blast dest!: Confidentiality_B B_Issues_A)\n\nlemma u_B_Issues_A_r:\n     \"\\<lbrakk> Says B A (Crypt servK (Number T3)) \\<in> set evs;\n         Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n            \\<in> parts (spies evs);\n         \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad; B \\<noteq> Tgs; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> B Issues A with (Crypt servK (Number T3)) on evs\"\nby (blast dest!: u_Confidentiality_B B_Issues_A)\n\nlemma A_authenticates_and_keydist_to_B:\n     \"\\<lbrakk> Crypt servK (Number T3) \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Key authK \\<notin> analz (spies evs); Key servK \\<notin> analz (spies evs);\n         A \\<notin> bad;  B \\<notin> bad; B \\<noteq> Tgs; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> B Issues A with (Crypt servK (Number T3)) on evs\"\nby (blast dest!: A_authenticates_B B_Issues_A)\n\nlemma A_authenticates_and_keydist_to_B_r:\n     \"\\<lbrakk> Crypt servK (Number T3) \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredAK Ta evs; \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad; B \\<noteq> Tgs; evs \\<in> kerbIV \\<rbrakk>\n      \\<Longrightarrow> B Issues A with (Crypt servK (Number T3)) on evs\"\nby (blast dest!: A_authenticates_B_r Confidentiality_Serv_A B_Issues_A)\n\n\nlemma A_Issues_B:\n     \"\\<lbrakk> Says A B \\<lbrace>servTicket, Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         Key servK \\<notin> analz (spies evs);\n         B \\<noteq> Tgs; A \\<notin> bad;  B \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n   \\<Longrightarrow> A Issues B with (Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>) on evs\"\nunfolding Issues_def\napply (rule exI)\napply (rule conjI, assumption)\napply (simp (no_asm))\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV.induct, analz_mono_contra)\napply (frule_tac [5] Says_ticket_parts)\napply (frule_tac [7] Says_ticket_parts)\napply (simp_all (no_asm_simp))\napply clarify\ntxt\\<open>K5\\<close>\napply auto\napply (simp add: takeWhile_tail)\ntxt\\<open>Level 15: case analysis necessary because the assumption doesn't state\n  the form of servTicket. The guarantee becomes stronger.\\<close>\napply (blast dest: Says_imp_spies [THEN analz.Inj, THEN analz_Decrypt']\n                   K3_imp_K2 servK_authentic_ter\n                   parts_spies_takeWhile_mono [THEN subsetD]\n                   parts_spies_evs_revD2 [THEN subsetD]\n             intro: Says_K5)\napply (simp add: takeWhile_tail)\ndone\n\nlemma A_Issues_B_r:\n     \"\\<lbrakk> Says A B \\<lbrace>servTicket, Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredAK Ta evs; \\<not> expiredSK Ts evs;\n         B \\<noteq> Tgs; A \\<notin> bad;  B \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n   \\<Longrightarrow> A Issues B with (Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>) on evs\"\nby (blast dest!: Confidentiality_Serv_A A_Issues_B)\n\nlemma B_authenticates_and_keydist_to_A:\n     \"\\<lbrakk> Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace> \\<in> parts (spies evs);\n         Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);\n         Key servK \\<notin> analz (spies evs);\n         B \\<noteq> Tgs; A \\<notin> bad;  B \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n   \\<Longrightarrow> A Issues B with (Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>) on evs\"\nby (blast dest: B_authenticates_A A_Issues_B)\n\nlemma B_authenticates_and_keydist_to_A_r:\n     \"\\<lbrakk> Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace> \\<in> parts (spies evs);\n         Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredSK Ts evs; \\<not> expiredAK Ta evs;\n         B \\<noteq> Tgs; A \\<notin> bad;  B \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n   \\<Longrightarrow> A Issues B with (Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>) on evs\"\nby (blast dest: B_authenticates_A Confidentiality_B A_Issues_B)\n\ntext\\<open>\\<open>u_B_authenticates_and_keydist_to_A\\<close> would be the same as \\<open>B_authenticates_and_keydist_to_A\\<close> because the\n servK confidentiality assumption is yet unrelaxed\\<close>\n\nlemma u_B_authenticates_and_keydist_to_A_r:\n     \"\\<lbrakk> Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace> \\<in> parts (spies evs);\n         Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredSK Ts evs;\n         B \\<noteq> Tgs; A \\<notin> bad;  B \\<notin> bad;  evs \\<in> kerbIV \\<rbrakk>\n   \\<Longrightarrow> A Issues B with (Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>) on evs\"\nby (blast dest: u_B_authenticates_A_r u_Confidentiality_B A_Issues_B)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/KerberosIV.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7122321964553657, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3477711551242359}}
{"text": "(*  Title:      HOL/MicroJava/J/TypeRel.thy\n    Author:     David von Oheimb, Technische Universitaet Muenchen\n*)\n\nsection \\<open>Relations between Java Types\\<close>\n\ntheory TypeRel\nimports Decl\nbegin\n\n\\<comment> \\<open>direct subclass, cf. 8.1.3\\<close>\n\ninductive_set\n  subcls1 :: \"'c prog => (cname \\<times> cname) set\"\n  and subcls1' :: \"'c prog => cname \\<Rightarrow> cname => bool\" (\"_ \\<turnstile> _ \\<prec>C1 _\" [71,71,71] 70)\n  for G :: \"'c prog\"\nwhere\n  \"G \\<turnstile> C \\<prec>C1 D \\<equiv> (C, D) \\<in> subcls1 G\"\n  | subcls1I: \"\\<lbrakk>class G C = Some (D,rest); C \\<noteq> Object\\<rbrakk> \\<Longrightarrow> G \\<turnstile> C \\<prec>C1 D\"\n\nabbreviation\n  subcls  :: \"'c prog => cname \\<Rightarrow> cname => bool\" (\"_ \\<turnstile> _ \\<preceq>C _\"  [71,71,71] 70)\n  where \"G \\<turnstile> C \\<preceq>C D \\<equiv> (C, D) \\<in> (subcls1 G)\\<^sup>*\"\n\nlemma subcls1D: \n  \"G\\<turnstile>C\\<prec>C1D \\<Longrightarrow> C \\<noteq> Object \\<and> (\\<exists>fs ms. class G C = Some (D,fs,ms))\"\napply (erule subcls1.cases)\napply auto\ndone\n\nlemma subcls1_def2:\n  \"subcls1 P =\n     (SIGMA C:{C. is_class P C}. {D. C\\<noteq>Object \\<and> fst (the (class P C))=D})\"\n  by (auto simp add: is_class_def dest: subcls1D intro: subcls1I)\n\nlemma finite_subcls1: \"finite (subcls1 G)\"\napply(simp add: subcls1_def2 del: mem_Sigma_iff)\napply(rule finite_SigmaI [OF finite_is_class])\napply(rule_tac B = \"{fst (the (class G C))}\" in finite_subset)\napply  auto\ndone\n\nlemma subcls_is_class: \"(C, D) \\<in> (subcls1 G)\\<^sup>+  \\<Longrightarrow> is_class G C\"\napply (unfold is_class_def)\napply(erule trancl_trans_induct)\napply (auto dest!: subcls1D)\ndone\n\nlemma subcls_is_class2 [rule_format (no_asm)]: \n  \"G\\<turnstile>C\\<preceq>C D \\<Longrightarrow> is_class G D \\<longrightarrow> is_class G C\"\napply (unfold is_class_def)\napply (erule rtrancl_induct)\napply  (drule_tac [2] subcls1D)\napply  auto\ndone\n\ndefinition class_rec :: \"'c prog \\<Rightarrow> cname \\<Rightarrow> 'a \\<Rightarrow>\n    (cname \\<Rightarrow> fdecl list \\<Rightarrow> 'c mdecl list \\<Rightarrow> 'a \\<Rightarrow> 'a) \\<Rightarrow> 'a\" where\n  \"class_rec G == wfrec ((subcls1 G)\\<inverse>)\n    (\\<lambda>r C t f. case class G C of\n         None \\<Rightarrow> undefined\n       | Some (D,fs,ms) \\<Rightarrow> \n           f C fs ms (if C = Object then t else r D t f))\"\n\nlemma class_rec_lemma:\n  assumes wf: \"wf ((subcls1 G)\\<inverse>)\"\n    and cls: \"class G C = Some (D, fs, ms)\"\n  shows \"class_rec G C t f = f C fs ms (if C=Object then t else class_rec G D t f)\"\n  by (subst wfrec_def_adm[OF class_rec_def])\n     (auto simp: assms adm_wf_def fun_eq_iff subcls1I split: option.split)\n\ndefinition\n  \"wf_class G = wf ((subcls1 G)\\<inverse>)\"\n\n\n\ntext \\<open>Code generator setup\\<close>\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool)\n  subcls1p \n  .\n\ndeclare subcls1_def [code_pred_def]\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<times> o \\<Rightarrow> bool, i \\<Rightarrow> i \\<times> i \\<Rightarrow> bool)\n  [inductify]\n  subcls1 \n  .\n\ndefinition subcls' where \"subcls' G = (subcls1p G)\\<^sup>*\\<^sup>*\"\n\ncode_pred\n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool)\n  [inductify]\n  subcls'\n  .\n\nlemma subcls_conv_subcls' [code_unfold]:\n  \"(subcls1 G)\\<^sup>* = {(C, D). subcls' G C D}\"\nby(simp add: subcls'_def subcls1_def rtrancl_def)\n\nlemma class_rec_code [code]:\n  \"class_rec G C t f = \n  (if wf_class G then \n    (case class G C of\n       None \\<Rightarrow> class_rec G C t f\n     | Some (D, fs, ms) \\<Rightarrow> \n       if C = Object then f Object fs ms t else f C fs ms (class_rec G D t f))\n   else class_rec G C t f)\"\napply(cases \"wf_class G\")\n apply(unfold class_rec_def wf_class_def)\n apply(subst wfrec, assumption)\n apply(cases \"class G C\")\n  apply(simp add: wfrec)\n apply clarsimp\n apply(rename_tac D fs ms)\n apply(rule_tac f=\"f C fs ms\" in arg_cong)\n apply(clarsimp simp add: cut_def)\n apply(blast intro: subcls1I)\napply simp\ndone\n\nlemma wf_class_code [code]:\n  \"wf_class G \\<longleftrightarrow> (\\<forall>(C, rest) \\<in> set G. C \\<noteq> Object \\<longrightarrow> \\<not> G \\<turnstile> fst (the (class G C)) \\<preceq>C C)\"\nproof\n  assume \"wf_class G\"\n  hence wf: \"wf (((subcls1 G)\\<^sup>+)\\<inverse>)\" unfolding wf_class_def by(rule wf_converse_trancl)\n  hence acyc: \"acyclic ((subcls1 G)\\<^sup>+)\" by(auto dest: wf_acyclic)\n  show \"\\<forall>(C, rest) \\<in> set G. C \\<noteq> Object \\<longrightarrow> \\<not> G \\<turnstile> fst (the (class G C)) \\<preceq>C C\"\n  proof(safe)\n    fix C D fs ms\n    assume \"(C, D, fs, ms) \\<in> set G\"\n      and \"C \\<noteq> Object\"\n      and subcls: \"G \\<turnstile> fst (the (class G C)) \\<preceq>C C\"\n    from \\<open>(C, D, fs, ms) \\<in> set G\\<close> obtain D' fs' ms'\n      where \"class\": \"class G C = Some (D', fs', ms')\"\n      unfolding class_def by(auto dest!: weak_map_of_SomeI)\n    hence \"G \\<turnstile> C \\<prec>C1 D'\" using \\<open>C \\<noteq> Object\\<close> ..\n    hence *: \"(C, D') \\<in> (subcls1 G)\\<^sup>+\" ..\n    also from * acyc have \"C \\<noteq> D'\" by(auto simp add: acyclic_def)\n    with subcls \"class\" have \"(D', C) \\<in> (subcls1 G)\\<^sup>+\" by(auto dest: rtranclD)\n    finally show False using acyc by(auto simp add: acyclic_def)\n  qed\nnext\n  assume rhs[rule_format]: \"\\<forall>(C, rest) \\<in> set G. C \\<noteq> Object \\<longrightarrow> \\<not> G \\<turnstile> fst (the (class G C)) \\<preceq>C C\"\n  have \"acyclic (subcls1 G)\"\n  proof(intro acyclicI strip notI)\n    fix C\n    assume \"(C, C) \\<in> (subcls1 G)\\<^sup>+\"\n    thus False\n    proof(cases)\n      case base\n      then obtain rest where \"class G C = Some (C, rest)\"\n        and \"C \\<noteq> Object\" by cases\n      from \\<open>class G C = Some (C, rest)\\<close> have \"(C, C, rest) \\<in> set G\"\n        unfolding class_def by(rule map_of_SomeD)\n      with \\<open>C \\<noteq> Object\\<close> \\<open>class G C = Some (C, rest)\\<close>\n      have \"\\<not> G \\<turnstile> C \\<preceq>C C\" by(auto dest: rhs)\n      thus False by simp\n    next\n      case (step D)\n      from \\<open>G \\<turnstile> D \\<prec>C1 C\\<close> obtain rest where \"class G D = Some (C, rest)\"\n        and \"D \\<noteq> Object\" by cases\n      from \\<open>class G D = Some (C, rest)\\<close> have \"(D, C, rest) \\<in> set G\"\n        unfolding class_def by(rule map_of_SomeD)\n      with \\<open>D \\<noteq> Object\\<close> \\<open>class G D = Some (C, rest)\\<close>\n      have \"\\<not> G \\<turnstile> C \\<preceq>C D\" by(auto dest: rhs)\n      moreover from \\<open>(C, D) \\<in> (subcls1 G)\\<^sup>+\\<close>\n      have \"G \\<turnstile> C \\<preceq>C D\" by(rule trancl_into_rtrancl)\n      ultimately show False by contradiction\n    qed\n  qed\n  thus \"wf_class G\" unfolding wf_class_def\n    by(rule finite_acyclic_wf_converse[OF finite_subcls1])\nqed\n\ndefinition \"method\" :: \"'c prog \\<times> cname => (sig \\<rightharpoonup> cname \\<times> ty \\<times> 'c)\"\n  \\<comment> \\<open>methods of a class, with inheritance, overriding and hiding, cf. 8.4.6\\<close>\n  where [code]: \"method \\<equiv> \\<lambda>(G,C). class_rec G C Map.empty (\\<lambda>C fs ms ts.\n                           ts ++ map_of (map (\\<lambda>(s,m). (s,(C,m))) ms))\"\n\ndefinition fields :: \"'c prog \\<times> cname => ((vname \\<times> cname) \\<times> ty) list\"\n  \\<comment> \\<open>list of fields of a class, including inherited and hidden ones\\<close>\n  where [code]: \"fields \\<equiv> \\<lambda>(G,C). class_rec G C [] (\\<lambda>C fs ms ts.\n                           map (\\<lambda>(fn,ft). ((fn,C),ft)) fs @ ts)\"\n\ndefinition field :: \"'c prog \\<times> cname => (vname \\<rightharpoonup> cname \\<times> ty)\"\n  where [code]: \"field == map_of o (map (\\<lambda>((fn,fd),ft). (fn,(fd,ft)))) o fields\"\n\nlemma method_rec_lemma: \"[|class G C = Some (D,fs,ms); wf ((subcls1 G)\\<inverse>)|] ==>\n  method (G,C) = (if C = Object then Map.empty else method (G,D)) ++  \n  map_of (map (\\<lambda>(s,m). (s,(C,m))) ms)\"\napply (unfold method_def)\napply (simp split del: if_split)\napply (erule (1) class_rec_lemma [THEN trans])\napply auto\ndone\n\nlemma fields_rec_lemma: \"[|class G C = Some (D,fs,ms); wf ((subcls1 G)\\<inverse>)|] ==>\n fields (G,C) = \n  map (\\<lambda>(fn,ft). ((fn,C),ft)) fs @ (if C = Object then [] else fields (G,D))\"\napply (unfold fields_def)\napply (simp split del: if_split)\napply (erule (1) class_rec_lemma [THEN trans])\napply auto\ndone\n\nlemma field_fields: \n\"field (G,C) fn = Some (fd, fT) \\<Longrightarrow> map_of (fields (G,C)) (fn, fd) = Some fT\"\napply (unfold field_def)\napply (rule table_of_remap_SomeD)\napply simp\ndone\n\n\n\\<comment> \\<open>widening, viz. method invocation conversion,cf. 5.3 i.e. sort of syntactic subtyping\\<close>\ninductive\n  widen   :: \"'c prog => [ty   , ty   ] => bool\" (\"_ \\<turnstile> _ \\<preceq> _\"   [71,71,71] 70)\n  for G :: \"'c prog\"\nwhere\n  refl   [intro!, simp]:       \"G\\<turnstile>      T \\<preceq> T\"   \\<comment> \\<open>identity conv., cf. 5.1.1\\<close>\n| subcls         : \"G\\<turnstile>C\\<preceq>C D ==> G\\<turnstile>Class C \\<preceq> Class D\"\n| null   [intro!]:             \"G\\<turnstile>     NT \\<preceq> RefT R\"\n\ncode_pred widen .\n\nlemmas refl = HOL.refl\n\n\\<comment> \\<open>casting conversion, cf. 5.5 / 5.1.5\\<close>\n\\<comment> \\<open>left out casts on primitve types\\<close>\ninductive\n  cast    :: \"'c prog => [ty   , ty   ] => bool\" (\"_ \\<turnstile> _ \\<preceq>? _\"  [71,71,71] 70)\n  for G :: \"'c prog\"\nwhere\n  widen:  \"G\\<turnstile> C\\<preceq> D ==> G\\<turnstile>C \\<preceq>? D\"\n| subcls: \"G\\<turnstile> D\\<preceq>C C ==> G\\<turnstile>Class C \\<preceq>? Class D\"\n\nlemma widen_PrimT_RefT [iff]: \"(G\\<turnstile>PrimT pT\\<preceq>RefT rT) = False\"\napply (rule iffI)\napply (erule widen.cases)\napply auto\ndone\n\nlemma widen_RefT: \"G\\<turnstile>RefT R\\<preceq>T ==> \\<exists>t. T=RefT t\"\napply (ind_cases \"G\\<turnstile>RefT R\\<preceq>T\")\napply auto\ndone\n\nlemma widen_RefT2: \"G\\<turnstile>S\\<preceq>RefT R ==> \\<exists>t. S=RefT t\"\napply (ind_cases \"G\\<turnstile>S\\<preceq>RefT R\")\napply auto\ndone\n\nlemma widen_Class: \"G\\<turnstile>Class C\\<preceq>T ==> \\<exists>D. T=Class D\"\napply (ind_cases \"G\\<turnstile>Class C\\<preceq>T\")\napply auto\ndone\n\nlemma widen_Class_NullT [iff]: \"(G\\<turnstile>Class C\\<preceq>NT) = False\"\napply (rule iffI)\napply (ind_cases \"G\\<turnstile>Class C\\<preceq>NT\")\napply auto\ndone\n\nlemma widen_Class_Class [iff]: \"(G\\<turnstile>Class C\\<preceq> Class D) = (G\\<turnstile>C\\<preceq>C D)\"\napply (rule iffI)\napply (ind_cases \"G\\<turnstile>Class C \\<preceq> Class D\")\napply (auto elim: widen.subcls)\ndone\n\nlemma widen_NT_Class [simp]: \"G \\<turnstile> T \\<preceq> NT \\<Longrightarrow> G \\<turnstile> T \\<preceq> Class D\"\nby (ind_cases \"G \\<turnstile> T \\<preceq> NT\",  auto)\n\nlemma cast_PrimT_RefT [iff]: \"(G\\<turnstile>PrimT pT\\<preceq>? RefT rT) = False\"\napply (rule iffI)\napply (erule cast.cases)\napply auto\ndone\n\nlemma cast_RefT: \"G \\<turnstile> C \\<preceq>? Class D \\<Longrightarrow> \\<exists> rT. C = RefT rT\"\napply (erule cast.cases)\napply simp apply (erule widen.cases) \napply auto\ndone\n\ntheorem widen_trans[trans]: \"\\<lbrakk>G\\<turnstile>S\\<preceq>U; G\\<turnstile>U\\<preceq>T\\<rbrakk> \\<Longrightarrow> G\\<turnstile>S\\<preceq>T\"\nproof -\n  assume \"G\\<turnstile>S\\<preceq>U\" thus \"\\<And>T. G\\<turnstile>U\\<preceq>T \\<Longrightarrow> G\\<turnstile>S\\<preceq>T\"\n  proof induct\n    case (refl T T') thus \"G\\<turnstile>T\\<preceq>T'\" .\n  next\n    case (subcls C D T)\n    then obtain E where \"T = Class E\" by (blast dest: widen_Class)\n    with subcls show \"G\\<turnstile>Class C\\<preceq>T\" by auto\n  next\n    case (null R RT)\n    then obtain rt where \"RT = RefT rt\" by (blast dest: widen_RefT)\n    thus \"G\\<turnstile>NT\\<preceq>RT\" by auto\n  qed\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/MicroJava/J/TypeRel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.34754701792942383}}
{"text": "section \\<open>Sets by Lists that Own their Elements\\<close>\ntheory IICF_List_SetO\nimports \"../Intf/IICF_Set\"\nbegin\n  text \\<open>Minimal implementation, only supporting a few operations\\<close>\n\n  definition \"lso_assn A \\<equiv> hr_comp (list_assn A) (br set (\\<lambda>_. True))\"\n  lemmas [fcomp_norm_unfold] = lso_assn_def[symmetric]\n  lemma lso_is_pure[safe_constraint_rules]: \"is_pure A \\<Longrightarrow> is_pure (lso_assn A)\"\n    unfolding lso_assn_def by safe_constraint\n\n  lemma lso_empty_aref: \"(uncurry0 (RETURN []), uncurry0 (RETURN op_set_empty)) \n    \\<in> unit_rel  \\<rightarrow>\\<^sub>f \\<langle>br set (\\<lambda>_. True)\\<rangle>nres_rel\"\n    by (auto simp: in_br_conv intro!: frefI nres_relI)\n\n  lemma lso_ins_aref: \"(uncurry (RETURN oo ((#) )), uncurry (RETURN oo op_set_insert)) \n    \\<in> Id \\<times>\\<^sub>r br set (\\<lambda>_. True) \\<rightarrow>\\<^sub>f \\<langle>br set (\\<lambda>_. True)\\<rangle>nres_rel\"\n    by (auto simp: in_br_conv intro!: frefI nres_relI)\n\n  sepref_decl_impl (no_register) lso_empty: hn_Nil[to_hfref] uses lso_empty_aref .  \n  definition [simp]: \"op_lso_empty \\<equiv> op_set_empty\"\n  lemma lso_fold_custom_empty:\n    \"{} = op_lso_empty\"\n    \"op_set_empty = op_lso_empty\"\n    by auto\n  lemmas [sepref_fr_rules] = lso_empty_hnr[folded op_lso_empty_def]\n\n  sepref_decl_impl lso_insert: hn_Cons[to_hfref] uses lso_ins_aref .\n    \n  thm hn_Cons[FCOMP lso_ins_aref]  \n\n  (* TODO: Allow (controlled) backtracking over comb-rules, then we can have a general list-bex operation! *)\n  definition [simp]: \"op_lso_bex P S \\<equiv> \\<exists>x\\<in>S. P x\"\n  lemma fold_lso_bex: \"Bex \\<equiv> \\<lambda>s P. op_lso_bex P s\" by auto\n\n  definition [simp]: \"mop_lso_bex P S \\<equiv> ASSERT (\\<forall>x\\<in>S. \\<exists>y. P x = RETURN y) \\<then> RETURN (\\<exists>x\\<in>S. P x = RETURN True)\"\n\n  lemma op_mop_lso_bex:  \"RETURN (op_lso_bex P S) = mop_lso_bex (RETURN o P) S\" by simp\n\n  sepref_register op_lso_bex\n  lemma lso_bex_arity[sepref_monadify_arity]: \n    \"op_lso_bex \\<equiv> \\<lambda>\\<^sub>2P s. SP op_lso_bex$(\\<lambda>\\<^sub>2x. P$x)$s\" by (auto intro!: eq_reflection ext)\n  lemma op_lso_bex_monadify[sepref_monadify_comb]:  \n    \"EVAL$(op_lso_bex$(\\<lambda>\\<^sub>2x. P x)$s) \\<equiv> (\\<bind>) $(EVAL$s)$(\\<lambda>\\<^sub>2s. mop_lso_bex$(\\<lambda>\\<^sub>2x. EVAL $ P x)$s)\" by simp\n\n  definition \"lso_abex P l \\<equiv> nfoldli l (Not) (\\<lambda>x _. P x) False\"\n  lemma lso_abex_to_set: \"lso_abex P l \\<le> mop_lso_bex P (set l)\"\n  proof -\n    { fix b\n      have \"nfoldli l (Not) (\\<lambda>x _. P x) b \\<le> ASSERT (\\<forall>x\\<in>set l. \\<exists>y. P x = RETURN y) \\<then> RETURN ((\\<exists>x\\<in>set l. P x = RETURN True) \\<or> b)\"\n        apply (induction l arbitrary: b) \n        applyS simp\n        applyS (clarsimp simp add: pw_le_iff refine_pw_simps; blast) \n        done\n    } from this[of False] show ?thesis by (simp add: lso_abex_def)\n  qed    \n\n\n\n  locale lso_bex_impl_loc = \n    fixes Pi and P :: \"'a \\<Rightarrow> bool nres\"\n    fixes li :: \"'c list\" and l :: \"'a list\"\n    fixes A :: \"'a \\<Rightarrow> 'c \\<Rightarrow> assn\"\n    fixes F :: assn\n    \n    assumes Prl: \"\\<And>x xi. \\<lbrakk>x\\<in>set l\\<rbrakk> \\<Longrightarrow> hn_refine (F * hn_ctxt A x xi) (Pi xi) (F * hn_ctxt A x xi) bool_assn (P x)\"\n  begin  \n    sepref_register l\n    sepref_register P\n\n    lemma [sepref_comb_rules]:\n      assumes \"\\<Gamma> \\<Longrightarrow>\\<^sub>t F' * F * hn_ctxt A x xi\"\n      assumes \"x\\<in>set l\"\n      shows \"hn_refine \\<Gamma> (Pi xi) (F' * F * hn_ctxt A x xi) bool_assn (P$x)\"\n      using hn_refine_frame[OF Prl[OF assms(2)], of \\<Gamma> F'] assms(1)\n      by (simp add: assn_assoc)\n\n\n    schematic_goal lso_bex_impl: \n      \"hn_refine (hn_ctxt (list_assn A) l li * F) (?c) (F * hn_ctxt (list_assn A) l li) bool_assn (lso_abex P l)\"\n      unfolding lso_abex_def[abs_def]\n      by sepref\n  end    \n  concrete_definition lso_bex_impl uses lso_bex_impl_loc.lso_bex_impl  \n  \n  lemma hn_lso_bex[sepref_prep_comb_rule,sepref_comb_rules]: \n    assumes FR: \"\\<Gamma> \\<Longrightarrow>\\<^sub>t hn_ctxt (lso_assn A) s li * F\"\n    assumes Prl: \"\\<And>x xi. \\<lbrakk>x\\<in>s\\<rbrakk> \\<Longrightarrow> hn_refine (F * hn_ctxt A x xi) (Pi xi) (F * hn_ctxt A x xi) bool_assn (P x)\"\n    notes [simp del] = mop_lso_bex_def\n    shows \"hn_refine \\<Gamma> (lso_bex_impl Pi li) (F * hn_ctxt (lso_assn A) s li) bool_assn (mop_lso_bex$(\\<lambda>\\<^sub>2x. P x)$s)\"\n    apply (rule hn_refine_cons_pre[OF FR])\n    apply (clarsimp simp: hn_ctxt_def lso_assn_def hr_comp_def in_br_conv hnr_pre_ex_conv)\n    apply (rule hn_refine_preI)\n    apply (drule mod_starD; clarsimp)\n    apply (rule hn_refine_ref[OF lso_abex_to_set])\n  proof -\n    fix l assume [simp]: \"s=set l\"\n\n    from Prl have Prl': \"\\<And>x xi. \\<lbrakk>x\\<in>set l\\<rbrakk> \\<Longrightarrow> hn_refine (F * hn_ctxt A x xi) (Pi xi) (F * hn_ctxt A x xi) bool_assn (P x)\"\n      by simp\n\n    show \"hn_refine (list_assn A l li * F) (lso_bex_impl Pi li) (\\<exists>\\<^sub>Aba. F * list_assn A ba li * \\<up> (set l = set ba)) bool_assn\n           (lso_abex P l)\"\n      apply (rule hn_refine_cons[OF _ lso_bex_impl.refine])\n      applyS (simp add: hn_ctxt_def; rule entt_refl)\n      apply1 unfold_locales apply1 (rule Prl') applyS simp\n      applyS (sep_auto intro!: enttI simp: hn_ctxt_def)\n      applyS (rule entt_refl)\n      done\n  qed    \n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/IICF/Impl/IICF_List_SetO.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583270090337583, "lm_q2_score": 0.6224593312018546, "lm_q1q2_score": 0.347535856635085}}
{"text": "(*\n  Title:      Blackboard.thy\n  Author:     Diego Marmsoler\n*)\nsection \"A Theory of Blackboard Architectures\"\ntext\\<open>\n  In the following, we formalize the specification of the blackboard pattern as described in~\\cite{Marmsoler2018c}.\n\\<close>\n\ntheory Blackboard\nimports Publisher_Subscriber\nbegin\n\nsubsection \"Problems and Solutions\"\ntext \\<open>\n  Blackboards work with problems and solutions for them.\n\\<close>\ntypedecl PROB\nconsts sb :: \"(PROB \\<times> PROB) set\"\naxiomatization where sbWF: \"wf sb\"\ntypedecl SOL\nconsts solve:: \"PROB \\<Rightarrow> SOL\"\n\nsubsection \"Blackboard Architectures\"\ntext \\<open>\n  In the following, we describe the locale for the blackboard pattern.\n\\<close>\nlocale blackboard = publisher_subscriber bbactive bbcmp ksactive kscmp bbrp bbcs kscs ksrp\n  for bbactive :: \"'bid \\<Rightarrow> cnf \\<Rightarrow> bool\" (\"\\<parallel>_\\<parallel>\\<^bsub>_\\<^esub>\" [0,110]60)\n    and bbcmp :: \"'bid \\<Rightarrow> cnf \\<Rightarrow> 'BB\" (\"\\<sigma>\\<^bsub>_\\<^esub>(_)\" [0,110]60)\n    and ksactive :: \"'kid \\<Rightarrow> cnf \\<Rightarrow> bool\" (\"\\<parallel>_\\<parallel>\\<^bsub>_\\<^esub>\" [0,110]60)\n    and kscmp :: \"'kid \\<Rightarrow> cnf \\<Rightarrow> 'KS\" (\"\\<sigma>\\<^bsub>_\\<^esub>(_)\" [0,110]60)\n    and bbrp :: \"'BB \\<Rightarrow> (PROB set) subscription set\"\n    and bbcs :: \"'BB \\<Rightarrow> (PROB \\<times> SOL)\"\n    and kscs :: \"'KS \\<Rightarrow> (PROB \\<times> SOL) set\"\n    and ksrp :: \"'KS \\<Rightarrow> (PROB set) subscription\" +\n  fixes bbns :: \"'BB \\<Rightarrow> (PROB \\<times> SOL) set\"\n    and ksns :: \"'KS \\<Rightarrow> (PROB \\<times> SOL)\"\n    and bbop :: \"'BB \\<Rightarrow> PROB\"\n    and ksop :: \"'KS \\<Rightarrow> PROB set\"\n    and prob :: \"'kid \\<Rightarrow> PROB\"\n  assumes\n    ks1: \"\\<forall>p. \\<exists>ks. p=prob ks\" \\<comment> \\<open>Component Parameter\\<close>\n    \\<comment> \\<open>Assertions about component behavior.\\<close>\n    and bhvbb1: \"\\<And>t t' bId p s. \\<lbrakk>t \\<in> arch\\<rbrakk> \\<Longrightarrow> pb.eval bId t t' 0\n      (\\<box>\\<^sub>b ([\\<lambda>bb. (p,s)\\<in>bbns bb]\\<^sub>b\n      \\<longrightarrow>\\<^sup>b (\\<diamond>\\<^sub>b [\\<lambda>bb. (p,s) = bbcs bb]\\<^sub>b)))\"\n    and bhvbb2: \"\\<And>t t' bId P q. \\<lbrakk>t\\<in>arch\\<rbrakk> \\<Longrightarrow> pb.eval bId t t' 0\n      (\\<box>\\<^sub>b ([\\<lambda>bb. sub P \\<in> bbrp bb \\<and> q \\<in> P]\\<^sub>b \\<longrightarrow>\\<^sup>b\n      (\\<diamond>\\<^sub>b [\\<lambda>bb. q = bbop bb]\\<^sub>b)))\"\n    and bhvbb3: \"\\<And>t t' bId p . \\<lbrakk>t\\<in>arch\\<rbrakk> \\<Longrightarrow> pb.eval bId t t' 0\n      (\\<box>\\<^sub>b ([\\<lambda>bb. p = bbop(bb)]\\<^sub>b \\<longrightarrow>\\<^sup>b\n      ([\\<lambda>bb. p=bbop(bb)]\\<^sub>b \\<WW>\\<^sub>b [\\<lambda>bb. (p,solve(p)) = bbcs(bb)]\\<^sub>b)))\"\n    and bhvks1: \"\\<And>t t' kId p P. \\<lbrakk>t\\<in>arch; p = prob kId\\<rbrakk> \\<Longrightarrow> sb.eval kId t t' 0\n      (\\<box>\\<^sub>b ([\\<lambda>ks. sub P = ksrp ks]\\<^sub>b \\<and>\\<^sup>b\n      (\\<forall>\\<^sub>b q. ((sb.pred (q\\<in>P)) \\<longrightarrow>\\<^sup>b (\\<diamond>\\<^sub>b ([\\<lambda>ks. (q,solve(q)) \\<in> kscs ks]\\<^sub>b))))\n      \\<longrightarrow>\\<^sup>b (\\<diamond>\\<^sub>b [\\<lambda>ks. (p, solve p) = ksns ks]\\<^sub>b)))\"\n    and bhvks2: \"\\<And>t t' kId p P q. \\<lbrakk>t \\<in> arch;p = prob kId\\<rbrakk> \\<Longrightarrow> sb.eval kId t t' 0\n      (\\<box>\\<^sub>b [\\<lambda>ks. sub P = ksrp ks \\<and> q \\<in> P \\<longrightarrow> (q,p) \\<in> sb]\\<^sub>b)\"\n    and bhvks3: \"\\<And>t t' kId p. \\<lbrakk>t\\<in>arch;p = prob kId\\<rbrakk> \\<Longrightarrow> sb.eval kId t t' 0\n      (\\<box>\\<^sub>b ([\\<lambda>ks. p\\<in>ksop ks]\\<^sub>b \\<longrightarrow>\\<^sup>b (\\<diamond>\\<^sub>b [\\<lambda>ks. (\\<exists>P. sub P = ksrp ks)]\\<^sub>b)))\"\n    and bhvks4: \"\\<And>t t' kId p P. \\<lbrakk>t\\<in>arch; p\\<in>P\\<rbrakk> \\<Longrightarrow> sb.eval kId t t' 0\n      (\\<box>\\<^sub>b ([\\<lambda>ks. sub P = ksrp ks]\\<^sub>b \\<longrightarrow>\\<^sup>b\n      ((\\<not>\\<^sup>b (\\<exists>\\<^sub>b P'. (sb.pred (p\\<in>P') \\<and>\\<^sup>b [\\<lambda>ks. unsub P' = ksrp ks]\\<^sub>b))) \\<WW>\\<^sub>b\n      [\\<lambda>ks. (p,solve p) \\<in> kscs ks]\\<^sub>b)))\"\n\n    \\<comment> \\<open>Assertions about component activation.\\<close>\n    and actks:\n      \"\\<And>t n kid p. \\<lbrakk>t \\<in> arch; \\<parallel>kid\\<parallel>\\<^bsub>t n\\<^esub>; p=prob kid; p\\<in>ksop (\\<sigma>\\<^bsub>kid\\<^esub>(t n))\\<rbrakk>\n      \\<Longrightarrow> (\\<exists>n'\\<ge>n. \\<parallel>kid\\<parallel>\\<^bsub>t n'\\<^esub> \\<and> (p, solve p) = ksns (\\<sigma>\\<^bsub>kid\\<^esub>(t n')) \\<and>\n      (\\<forall>n''\\<ge>n. n''<n' \\<longrightarrow> \\<parallel>kid\\<parallel>\\<^bsub>t n''\\<^esub>))\n      \\<or> (\\<forall>n'\\<ge>n. (\\<parallel>kid\\<parallel>\\<^bsub>t n'\\<^esub> \\<and> (\\<not>(p, solve p) = ksns (\\<sigma>\\<^bsub>kid\\<^esub>(t n')))))\"\n\n    \\<comment> \\<open>Assertions about connections.\\<close>\n    and conn1: \"\\<And>k bid. \\<parallel>bid\\<parallel>\\<^bsub>k\\<^esub>\n      \\<Longrightarrow> bbns (\\<sigma>\\<^bsub>bid\\<^esub>(k)) = (\\<Union>kid\\<in>{kid. \\<parallel>kid\\<parallel>\\<^bsub>k\\<^esub>}. {ksns (\\<sigma>\\<^bsub>kid\\<^esub>(k))})\"\n    and conn2: \"\\<And>k kid. \\<parallel>kid\\<parallel>\\<^bsub>k\\<^esub>\n      \\<Longrightarrow> ksop (\\<sigma>\\<^bsub>kid\\<^esub>(k)) = (\\<Union>bid\\<in>{bid. \\<parallel>bid\\<parallel>\\<^bsub>k\\<^esub>}. {bbop (\\<sigma>\\<^bsub>bid\\<^esub>(k))})\"\nbegin\n  notation sb.lNAct (\"\\<langle>_ \\<Leftarrow> _\\<rangle>\\<^bsub>_\\<^esub>\")\n  notation sb.nxtAct (\"\\<langle>_ \\<rightarrow> _\\<rangle>\\<^bsub>_\\<^esub>\")\n  notation pb.lNAct (\"\\<langle>_ \\<Leftarrow> _\\<rangle>\\<^bsub>_\\<^esub>\")\n  notation pb.nxtAct (\"\\<langle>_ \\<rightarrow> _\\<rangle>\\<^bsub>_\\<^esub>\")\n\n  subsubsection \"Calculus Interpretation\"\n  text \\<open>\n  \\noindent\n  @{thm[source] pb.baIA}: @{thm pb.baIA [no_vars]}\n\\<close>\n  text \\<open>\n  \\noindent\n  @{thm[source] sb.baIA}: @{thm sb.baIA [no_vars]}\n\\<close>\n\n  subsubsection \"Results from Singleton\"\n  abbreviation \"the_bb \\<equiv> the_pb\"\n  text \\<open>\n  \\noindent\n  @{thm[source] pb.ts_prop(1)}: @{thm pb.ts_prop(1) [no_vars]}\n\\<close>\n  text \\<open>\n  \\noindent\n  @{thm[source] pb.ts_prop(2)}: @{thm pb.ts_prop(2) [no_vars]}\n\\<close>\n  subsubsection \"Results from Publisher Subscriber\"\n  text \\<open>\n\t\\noindent\n\t@{thm[source] msgDelivery}: @{thm msgDelivery [no_vars]}\n\\<close>\n  lemma conn2_bb:\n    fixes k and kid::'kid\n    assumes \"\\<parallel>kid\\<parallel>\\<^bsub>k\\<^esub>\"\n    shows \"bbop (\\<sigma>\\<^bsub>the_bb\\<^esub>(k))\\<in>ksop (\\<sigma>\\<^bsub>kid\\<^esub>(k))\"\n  proof -\n    from assms have \"ksop (\\<sigma>\\<^bsub>kid\\<^esub>(k)) = (\\<Union>bid\\<in>{bid. \\<parallel>bid\\<parallel>\\<^bsub>k\\<^esub>}. {bbop (\\<sigma>\\<^bsub>bid\\<^esub>(k))})\" using conn2 by simp\n    moreover have \"(\\<Union>bid.{bid. \\<parallel>bid\\<parallel>\\<^bsub>k\\<^esub>})={the_bb}\" using pb.ts_prop(1) by auto\n    hence \"(\\<Union>bid\\<in>{bid. \\<parallel>bid\\<parallel>\\<^bsub>k\\<^esub>}. {bbop (\\<sigma>\\<^bsub>bid\\<^esub>(k))}) = {bbop (\\<sigma>\\<^bsub>the_bb\\<^esub>(k))}\" by auto\n    ultimately show ?thesis by simp\n  qed\n\n  subsubsection \"Knowledge Sources\"\n  text \\<open>\n    In the following we introduce an abbreviation for knowledge sources which are able to solve a specific problem.\n\\<close>\n  definition sKs:: \"PROB \\<Rightarrow> 'kid\" where\n    \"sKs p \\<equiv> (SOME kid. p = prob kid)\"\n\n  lemma sks_prob:\n    \"p = prob (sKs p)\"\n  using sKs_def someI_ex[of \"\\<lambda>kid. p = prob kid\"] ks1 by auto\n\n  subsubsection \"Architectural Guarantees\"\n  text\\<open>\n    The following theorem verifies that a problem is eventually solved by the pattern even if no knowledge source exist which can solve the problem on its own.\n    It assumes, however, that for every open sub problem, a corresponding knowledge source able to solve the problem will be eventually activated.\n\\<close>\n  lemma pSolved_Ind:\n    fixes t and t'::\"nat \\<Rightarrow>'BB\" and p and t''::\"nat \\<Rightarrow>'KS\"\n    assumes \"t\\<in>arch\" and\n      \"\\<forall>n. (\\<exists>n'\\<ge>n. \\<parallel>sKs (bbop(\\<sigma>\\<^bsub>the_bb\\<^esub>(t n)))\\<parallel>\\<^bsub>t n'\\<^esub>)\"\n    shows\n      \"\\<forall>n. (\\<exists>P. sub P \\<in> bbrp(\\<sigma>\\<^bsub>the_bb\\<^esub>(t n)) \\<and> p \\<in> P) \\<longrightarrow>\n        (\\<exists>m\\<ge>n. (p,solve(p)) = bbcs (\\<sigma>\\<^bsub>the_bb\\<^esub>(t m)))\" (*\\eqref{eq:bb:g}*)\n  \\<comment> \\<open>The proof is by well-founded induction over the subproblem relation @{term sb}\\<close>\n  proof (rule wf_induct[where r=sb])\n    \\<comment> \\<open>We first show that the subproblem relation is indeed well-founded ...\\<close>\n    show \"wf sb\" by (simp add: sbWF)\n  next\n    \\<comment> \\<open>... then we show that a problem @{term p} is indeed solved\\<close>\n    \\<comment> \\<open>if all its sub-problems @{term p'} are eventually solved\\<close>\n    fix p assume indH: \"\\<forall>p'. (p', p) \\<in> sb \\<longrightarrow> (\\<forall>n. (\\<exists>P. sub P \\<in> bbrp (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n)) \\<and> p'\\<in>P)\n      \\<longrightarrow> (\\<exists>m\\<ge>n. (p',solve(p')) = bbcs (\\<sigma>\\<^bsub>the_bb\\<^esub>(t m))))\"\n    show \"\\<forall>n. (\\<exists>P. sub P \\<in> bbrp (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n)) \\<and> p \\<in> P)\n      \\<longrightarrow> (\\<exists>m\\<ge>n. (p,solve(p)) = bbcs (\\<sigma>\\<^bsub>the_bb\\<^esub>(t m)))\"\n    proof\n      fix n\\<^sub>0 show \"(\\<exists>P. sub P \\<in> bbrp (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n\\<^sub>0)) \\<and> p \\<in> P) \\<longrightarrow>\n      (\\<exists>m\\<ge>n\\<^sub>0. (p,solve(p)) = bbcs (\\<sigma>\\<^bsub>the_bb\\<^esub>(t m)))\"\n      proof\n        assume \"\\<exists>P. sub P \\<in> bbrp (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n\\<^sub>0)) \\<and> p \\<in> P\"\n        moreover have \"(\\<exists>P. sub P \\<in> bbrp (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n\\<^sub>0)) \\<and> p \\<in> P) \\<longrightarrow> (\\<exists>n'\\<ge>n\\<^sub>0. p=bbop(\\<sigma>\\<^bsub>the_bb\\<^esub>(t n')))\"\n        proof\n          assume \"\\<exists>P. sub P \\<in> bbrp (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n\\<^sub>0)) \\<and> p \\<in> P\"\n          then obtain P where \"sub P \\<in> bbrp (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n\\<^sub>0))\" and \"p \\<in> P\" by auto\n          hence \"pb.eval the_bb t t' n\\<^sub>0 [\\<lambda>bb. sub P \\<in> bbrp bb \\<and> p \\<in> P]\\<^sub>b\" using pb.baI by simp\n          moreover from pb.globE[OF bhvbb2] have\n            \"pb.eval the_bb t t' n\\<^sub>0 ([\\<lambda>bb. sub P \\<in> bbrp bb \\<and> p \\<in> P]\\<^sub>b \\<longrightarrow>\\<^sup>b \\<diamond>\\<^sub>b [\\<lambda>bb. p = bbop bb]\\<^sub>b)\"\n            using \\<open>t\\<in>arch\\<close> by simp\n          ultimately have \"pb.eval the_bb t t' n\\<^sub>0 (\\<diamond>\\<^sub>b [\\<lambda>bb. p = bbop bb]\\<^sub>b)\" using pb.impE by blast\n          then obtain n' where \"n'\\<ge>n\\<^sub>0\" and \"pb.eval the_bb t t' n' [\\<lambda>bb. p = bbop bb]\\<^sub>b\"\n            using pb.evtE by blast\n          hence \"p=bbop(\\<sigma>\\<^bsub>the_bb\\<^esub>(t n'))\" using pb.baE by auto\n          with \\<open>n'\\<ge>n\\<^sub>0\\<close> show \"\\<exists>n'\\<ge>n\\<^sub>0. p=bbop(\\<sigma>\\<^bsub>the_bb\\<^esub>(t n'))\" by auto\n        qed\n        ultimately obtain n where \"n\\<ge>n\\<^sub>0\" and \"p=bbop(\\<sigma>\\<^bsub>the_bb\\<^esub>(t n))\" by auto\n\n        \\<comment> \\<open>Problem p is provided at the output of the blackboard until it is solved\\<close>\n        \\<comment> \\<open>or forever...\\<close>\n        from pb.globE[OF bhvbb3] have\n          \"pb.eval the_bb t t' n ([\\<lambda> bb. p = bbop(bb)]\\<^sub>b \\<longrightarrow>\\<^sup>b\n          ([\\<lambda> bb. p=bbop(bb)]\\<^sub>b \\<WW>\\<^sub>b [\\<lambda>bb. (p,solve(p)) = bbcs(bb)]\\<^sub>b))\"\n          using \\<open>t\\<in>arch\\<close> by auto\n        moreover from \\<open>p = bbop (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n))\\<close> have\n          \"pb.eval the_bb t t' n [\\<lambda> bb. p=bbop bb]\\<^sub>b\"\n          using \\<open>t\\<in>arch\\<close> pb.baI by simp\n        ultimately have \"pb.eval the_bb t t' n\n          ([\\<lambda> bb. p=bbop(bb)]\\<^sub>b \\<WW>\\<^sub>b [\\<lambda> bb. (p,solve(p)) = bbcs(bb)]\\<^sub>b)\"\n          using pb.impE by blast\n        hence \"pb.eval the_bb t t' n (([\\<lambda> bb. p=bbop bb]\\<^sub>b \\<UU>\\<^sub>b\n          [\\<lambda> bb. (p,solve(p)) = bbcs bb]\\<^sub>b) \\<or>\\<^sup>b (\\<box>\\<^sub>b [\\<lambda> bb. p=bbop bb]\\<^sub>b))\"\n          using pb.wuntil_def by simp\n        hence \"pb.eval the_bb t t' n\n          ([\\<lambda>bb. p=bbop bb]\\<^sub>b \\<UU>\\<^sub>b [\\<lambda>bb. (p,solve(p)) = bbcs bb]\\<^sub>b) \\<or>\n          (pb.eval the_bb t t' n (\\<box>\\<^sub>b [\\<lambda> bb. p=bbop bb]\\<^sub>b))\"\n          using pb.disjE by simp\n        thus \"\\<exists>m\\<ge>n\\<^sub>0. (p,solve p) = bbcs(\\<sigma>\\<^bsub>the_bb\\<^esub>(t m))\"\n        \\<comment> \\<open>We need to consider both cases, the case in which the problem is eventually\\<close>\n        \\<comment> \\<open>solved and the case in which the problem is always provided as an output\\<close>\n        proof\n          \\<comment> \\<open>First we consider the case in which the problem is eventually solved:\\<close>\n          assume \"pb.eval the_bb t t' n\n            ([\\<lambda>bb. p=bbop bb]\\<^sub>b \\<UU>\\<^sub>b [\\<lambda>bb. (p,solve(p)) = bbcs bb]\\<^sub>b)\"\n          hence \"\\<exists>i\\<ge>n. (pb.eval the_bb t t' i\n            [\\<lambda>bb. (p,solve(p)) = bbcs bb]\\<^sub>b \\<and>\n            (\\<forall>k\\<ge>n. k<i \\<longrightarrow> pb.eval the_bb t t' k [\\<lambda>bb. p = bbop bb]\\<^sub>b))\"\n            using \\<open>t\\<in>arch\\<close> pb.untilE by simp\n          then obtain i where \"i\\<ge>n\" and\n            \"pb.eval the_bb t t' i [\\<lambda>bb. (p,solve(p)) = bbcs bb]\\<^sub>b\" by auto\n          hence \"(p,solve(p)) = bbcs(\\<sigma>\\<^bsub>the_bb\\<^esub>(t i))\"\n            using \\<open>t\\<in>arch\\<close> pb.baEA by auto\n          moreover from \\<open>i\\<ge>n\\<close> \\<open>n\\<ge>n\\<^sub>0\\<close> have \"i\\<ge>n\\<^sub>0\" by simp\n          ultimately show ?thesis by auto\n        next\n          \\<comment> \\<open>Now we consider the case in which p is always provided at the output\\<close>\n          \\<comment> \\<open>of the blackboard:\\<close>\n          assume \"pb.eval the_bb t t' n\n            (\\<box>\\<^sub>b [\\<lambda>bb. p=bbop bb]\\<^sub>b)\"\n          hence \"\\<forall>n'\\<ge>n. (pb.eval the_bb t t' n' [\\<lambda>bb. p = bbop bb]\\<^sub>b)\"\n            using \\<open>t\\<in>arch\\<close> pb.globE by auto\n          hence outp: \"\\<forall>n'\\<ge>n. (p = bbop (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n')))\"\n            using \\<open>t\\<in>arch\\<close> pb.baE by blast\n\n          \\<comment> \\<open>thus, by assumption there exists a KS which is able to solve p and which\\<close>\n          \\<comment> \\<open>is active at @{text n'}...\\<close>\n          with assms(2) have \"\\<exists>n'\\<ge>n. \\<parallel>sKs p\\<parallel>\\<^bsub>t n'\\<^esub>\" by auto\n          then obtain n\\<^sub>k where \"n\\<^sub>k\\<ge>n\" and \"\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>k\\<^esub>\" by auto\n          \\<comment> \\<open>... and get the problem as its input.\\<close>\n          moreover from \\<open>n\\<^sub>k\\<ge>n\\<close> have \"p = bbop (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n\\<^sub>k))\"\n            using outp by simp\n          ultimately have \"p\\<in>ksop(\\<sigma>\\<^bsub>sKs p\\<^esub>(t n\\<^sub>k))\" using conn2_bb[of \"sKs p\" \"t n\\<^sub>k\"] by simp\n\n          \\<comment> \\<open>thus the ks will either solve the problem or not solve it and\\<close>\n          \\<comment> \\<open>be activated forever\\<close>\n          hence \"(\\<exists>n'\\<ge>n\\<^sub>k. \\<parallel>sKs p\\<parallel>\\<^bsub>t n'\\<^esub> \\<and>\n            (p, solve p) = ksns (\\<sigma>\\<^bsub>sKs p\\<^esub>(t n')) \\<and>\n            (\\<forall>n''\\<ge>n\\<^sub>k. n''<n' \\<longrightarrow> \\<parallel>sKs p\\<parallel>\\<^bsub>t n''\\<^esub>)) \\<or>\n            (\\<forall>n'\\<ge>n\\<^sub>k. (\\<parallel>sKs p\\<parallel>\\<^bsub>t n'\\<^esub> \\<and>\n            (\\<not>(p, solve p) = ksns (\\<sigma>\\<^bsub>sKs p\\<^esub>(t n')))))\"\n            using \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>k\\<^esub>\\<close> actks[of t \"sKs p\"] \\<open>t\\<in>arch\\<close> sks_prob by simp\n          thus ?thesis\n          proof\n            \\<comment> \\<open>if the ks solves it\\<close>\n            assume \"\\<exists>n'\\<ge>n\\<^sub>k. \\<parallel>sKs p\\<parallel>\\<^bsub>t n'\\<^esub> \\<and> (p, solve p) = ksns (\\<sigma>\\<^bsub>sKs p\\<^esub>t n')\n              \\<and> (\\<forall>n''\\<ge>n\\<^sub>k. n'' < n' \\<longrightarrow> \\<parallel>sKs p\\<parallel>\\<^bsub>t n''\\<^esub>)\"\n            \\<comment> \\<open>it is forwarded to the blackboard\\<close>\n            then obtain n\\<^sub>s where \"n\\<^sub>s\\<ge>n\\<^sub>k\" and \"\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>s\\<^esub>\"\n              and \"(p, solve p) = ksns (\\<sigma>\\<^bsub>sKs p\\<^esub>t n\\<^sub>s)\" by auto\n            moreover have \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub> = n\\<^sub>s\"\n              by (simp add: \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>s\\<^esub>\\<close> sb.nxtAct_active)\n            ultimately have\n              \"(p,solve(p)) \\<in> bbns (\\<sigma>\\<^bsub>the_bb\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>)))\"\n              using conn1[OF pb.ts_prop(2)] \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>s\\<^esub>\\<close> by auto\n\n            \\<comment> \\<open>finally, the blackboard will forward the solution which finishes the proof.\\<close>\n            with bhvbb1 have \"pb.eval the_bb t t' (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>)\n              (\\<diamond>\\<^sub>b [\\<lambda>bb. (p, solve p) = bbcs bb]\\<^sub>b)\"\n              using \\<open>t\\<in>arch\\<close> pb.globE pb.impE[of the_bb t t'] by blast\n            then obtain n\\<^sub>f where \"n\\<^sub>f\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>\" and\n              \"pb.eval the_bb t t' n\\<^sub>f [\\<lambda>bb. (p, solve p) = bbcs bb]\\<^sub>b\"\n              using \\<open>t\\<in>arch\\<close> pb.evtE[of t t' \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>\"] by auto\n            hence \"(p, solve p) = bbcs (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n\\<^sub>f))\"\n              using \\<open>t \\<in> arch\\<close> pb.baEA by auto\n            moreover have \"n\\<^sub>f\\<ge>n\\<^sub>0\"\n            proof -\n              from \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>k\\<^esub>\\<close> have \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>k\\<^esub>\\<ge>n\\<^sub>k\"\n                using sb.nxtActI by blast\n              with \\<open>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub> = n\\<^sub>s\\<close> show ?thesis\n                using \\<open>n\\<^sub>f\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>\\<close> \\<open>n\\<^sub>s\\<ge>n\\<^sub>k\\<close> \\<open>n\\<^sub>k\\<ge>n\\<close> \\<open>n\\<ge>n\\<^sub>0\\<close> by arith\n            qed\n            ultimately show ?thesis by auto\n          next\n            \\<comment> \\<open>otherwise, we derive a contradiction\\<close>\n            assume case_ass: \"\\<forall>n'\\<ge>n\\<^sub>k. \\<parallel>sKs p\\<parallel>\\<^bsub>t n'\\<^esub> \\<and> \\<not>(p, solve p) = ksns (\\<sigma>\\<^bsub>sKs p\\<^esub>t n')\"\n\n            \\<comment> \\<open>first, the KS will eventually register for the subproblems P it requires to solve p...\\<close>\n            from \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>k\\<^esub>\\<close> have \"\\<exists>i\\<ge>0. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\" by auto\n            moreover have \"\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>0\\<^esub> \\<le> n\\<^sub>k\" by simp\n            ultimately have \"sb.eval (sKs p) t t'' n\\<^sub>k\n              ([\\<lambda>ks. p\\<in>ksop ks]\\<^sub>b \\<longrightarrow>\\<^sup>b (\\<diamond>\\<^sub>b [\\<lambda>ks. \\<exists>P. sub P = ksrp ks]\\<^sub>b))\"\n              using sb.globEA[OF _ bhvks3[of t p \"sKs p\" t'']] \\<open>t\\<in>arch\\<close> sks_prob by simp\n            moreover have \"sb.eval (sKs p) t t'' n\\<^sub>k [\\<lambda>ks. p \\<in> ksop ks]\\<^sub>b\"\n            proof -\n              from \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>k\\<^esub>\\<close> have \"\\<exists>n'\\<ge>n\\<^sub>k. \\<parallel>sKs p\\<parallel>\\<^bsub>t n'\\<^esub>\" by auto\n              moreover have \"p \\<in> ksop (\\<sigma>\\<^bsub>sKs p\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>k\\<^esub>)))\"\n              proof -\n                from \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>k\\<^esub>\\<close> have \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>k\\<^esub>=n\\<^sub>k\"\n                  using sb.nxtAct_active by blast\n                with \\<open>p\\<in>ksop(\\<sigma>\\<^bsub>sKs p\\<^esub>(t n\\<^sub>k))\\<close> show ?thesis by simp\n              qed\n              ultimately show ?thesis using sb.baIA[of n\\<^sub>k \"sKs p\" t] by blast\n            qed\n            ultimately have \"sb.eval (sKs p) t t'' n\\<^sub>k (\\<diamond>\\<^sub>b [\\<lambda>ks. \\<exists>P. sub P = ksrp ks]\\<^sub>b)\"\n              using sb.impE by blast\n            then obtain n\\<^sub>r where \"n\\<^sub>r\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>k\\<^esub>\" and\n              \"\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub> \\<and>\n              (\\<forall>n''\\<ge>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>. n'' \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\n              \\<longrightarrow> sb.eval (sKs p) t t'' n'' [\\<lambda>ks. \\<exists>P. sub P = ksrp ks]\\<^sub>b) \\<or>\n              \\<not> (\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>) \\<and>\n              sb.eval (sKs p) t t'' n\\<^sub>r [\\<lambda>ks. \\<exists>P. sub P = ksrp ks]\\<^sub>b\"\n              using \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>k\\<^esub>\\<close> sb.evtEA[of n\\<^sub>k \"sKs p\" t] by blast\n            moreover from case_ass have \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>k\\<^esub>\\<ge>n\\<^sub>k\" using sb.nxtActI by blast\n            with \\<open>n\\<^sub>r\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>k\\<^esub>\\<close> have \"n\\<^sub>r\\<ge>n\\<^sub>k\" by arith\n            hence \"\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\" using case_ass by auto\n            hence \"n\\<^sub>r \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\" using sb.nxtActLe by simp\n            moreover have \"n\\<^sub>r \\<ge> \\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\" by simp\n            ultimately have\n              \"sb.eval (sKs p) t t'' n\\<^sub>r [\\<lambda>ks. \\<exists>P. sub P = ksrp ks]\\<^sub>b\" by blast\n            with \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> obtain P where\n              \"sub P = ksrp (\\<sigma>\\<^bsub>sKs p\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)))\"\n              using sb.baEA by blast\n            hence \"sb.eval (sKs p) t t'' n\\<^sub>r [\\<lambda>ks. sub P = ksrp ks]\\<^sub>b\"\n              using \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> sb.baIA sks_prob by blast\n\n            \\<comment> \\<open>the knowledgesource will eventually get a solution for each required subproblem:\\<close>\n            moreover have \"sb.eval (sKs p) t t'' n\\<^sub>r (\\<forall>\\<^sub>b p'. (sb.pred (p'\\<in>P) \\<longrightarrow>\\<^sup>b\n              (\\<diamond>\\<^sub>b [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b)))\"\n            proof -\n              have \"\\<forall>p'. sb.eval (sKs p) t t'' n\\<^sub>r (sb.pred (p'\\<in>P) \\<longrightarrow>\\<^sup>b\n                (\\<diamond>\\<^sub>b [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b))\"\n              proof\n                \\<comment> \\<open>by induction hypothesis, the blackboard will eventually provide solutions for subproblems\\<close>\n                fix p'\n                have \"sb.eval (sKs p) t t'' n\\<^sub>r (sb.pred (p'\\<in>P)) \\<longrightarrow>\n                  (sb.eval (sKs p) t t'' n\\<^sub>r\n                  (\\<diamond>\\<^sub>b [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b))\"\n                proof\n                  assume \"sb.eval (sKs p) t t'' n\\<^sub>r (sb.pred (p'\\<in>P))\"\n                  hence \"p' \\<in> P\" using sb.predE by blast\n                  thus \"(sb.eval (sKs p) t t'' n\\<^sub>r (\\<diamond>\\<^sub>b [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b))\"\n                  proof -\n                    have \"\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>0\\<^esub> \\<le> n\\<^sub>r\" by simp\n                    moreover from \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>k\\<^esub>\\<close> have \"\\<exists>i\\<ge>0. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\" by auto\n                    ultimately have \"sb.eval (sKs p) t t'' n\\<^sub>r ([\\<lambda>ks. sub P = ksrp ks]\\<^sub>b\n                      \\<longrightarrow>\\<^sup>b ((\\<not>\\<^sup>b (\\<exists>\\<^sub>b P'. (sb.pred (p'\\<in>P') \\<and>\\<^sup>b [\\<lambda>ks. unsub P' = ksrp ks]\\<^sub>b))) \\<WW>\\<^sub>b\n                      [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b))\"\n                      using sb.globEA[OF _ bhvks4[of t p' P \"sKs p\" t'']]\n                      \\<open>t\\<in>arch\\<close> \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>k\\<^esub>\\<close> \\<open>p'\\<in>P\\<close> by simp\n                    with \\<open>sb.eval (sKs p) t t'' n\\<^sub>r [\\<lambda>ks. sub P = ksrp ks]\\<^sub>b\\<close> have\n                      \"sb.eval (sKs p) t t'' n\\<^sub>r ((\\<not>\\<^sup>b (\\<exists>\\<^sub>b P'. (sb.pred (p'\\<in>P') \\<and>\\<^sup>b\n                      [\\<lambda>ks. unsub P' = ksrp ks]\\<^sub>b))) \\<WW>\\<^sub>b [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b)\"\n                      using sb.impE[of \"(sKs p)\" t t'' n\\<^sub>r \"[\\<lambda>ks. sub P = ksrp ks]\\<^sub>b\"] by blast\n                    hence \"sb.eval (sKs p) t t'' n\\<^sub>r ((\\<not>\\<^sup>b (\\<exists>\\<^sub>b P'. (sb.pred (p'\\<in>P') \\<and>\\<^sup>b\n                      [\\<lambda>ks. unsub P' = ksrp ks]\\<^sub>b))) \\<UU>\\<^sub>b [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b) \\<or>\n                      sb.eval (sKs p) t t'' n\\<^sub>r (\\<box>\\<^sub>b (\\<not>\\<^sup>b (\\<exists>\\<^sub>b P'. (sb.pred (p'\\<in>P') \\<and>\\<^sup>b\n                      [\\<lambda>ks. unsub P' = ksrp ks]\\<^sub>b))))\" using sb.wuntil_def by auto\n                    thus \"(sb.eval (sKs p) t t'' n\\<^sub>r (\\<diamond>\\<^sub>b [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b))\"\n                    proof\n                      let ?\\<gamma>'=\"\\<not>\\<^sup>b (\\<exists>\\<^sub>b P'. (sb.pred (p'\\<in>P') \\<and>\\<^sup>b ([\\<lambda>ks. unsub P' = ksrp ks]\\<^sub>b)))\"\n                      let ?\\<gamma>=\"[\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b\"\n                      assume \"sb.eval (sKs p) t t'' n\\<^sub>r (?\\<gamma>' \\<UU>\\<^sub>b ?\\<gamma>)\"\n                      with \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> obtain n' where \"n'\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\" and\n                        lass: \"(\\<exists>i\\<ge>n'. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>) \\<and> (\\<forall>n''\\<ge>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n'\\<^esub>. n'' \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n'\\<^esub>\n                        \\<longrightarrow> sb.eval (sKs p) t t'' n'' ?\\<gamma>) \\<and>\n                        (\\<forall>n''\\<ge>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>. n'' < \\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n'\\<^esub>\n                        \\<longrightarrow> sb.eval (sKs p) t t'' n'' ?\\<gamma>') \\<or>\n                        \\<not> (\\<exists>i\\<ge>n'. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>) \\<and> sb.eval (sKs p) t t'' n' ?\\<gamma> \\<and>\n                        (\\<forall>n''\\<ge>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>. n'' < n' \\<longrightarrow> sb.eval (sKs p) t t'' n'' ?\\<gamma>')\"\n                        using sb.untilEA[of n\\<^sub>r \"sKs p\" t t''] \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> by blast\n                      thus \"?thesis\"\n                      proof cases\n                        assume \"\\<exists>i\\<ge>n'. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\"\n                        with lass have \"\\<forall>n''\\<ge>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n'\\<^esub>. n'' \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n'\\<^esub>\n                          \\<longrightarrow> sb.eval (sKs p) t t'' n'' ?\\<gamma>\" by auto\n                        moreover have \"n'\\<ge>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n'\\<^esub>\" by simp\n                        moreover have \"n' \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n'\\<^esub>\"\n                          using \\<open>\\<exists>i\\<ge>n'. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> sb.nxtActLe by simp\n                        ultimately have \"sb.eval (sKs p) t t'' n' ?\\<gamma>\" by simp\n                        moreover have \"\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n'\" using \\<open>n\\<^sub>r \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\\<close>\n                        \\<open>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n\\<^sub>r\\<close> \\<open>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n'\\<close> by linarith\n                        ultimately show ?thesis using \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> \\<open>\\<exists>i\\<ge>n'. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close>\n                          \\<open>n'\\<ge>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n'\\<^esub>\\<close> \\<open>n' \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n'\\<^esub>\\<close>\n                          sb.evtIA[of n\\<^sub>r \"sKs p\" t n' t'' ?\\<gamma>] by blast\n                      next\n                        assume \"\\<not> (\\<exists>i\\<ge>n'. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>)\"\n                        with lass have \"sb.eval (sKs p) t t'' n' ?\\<gamma> \\<and>\n                          (\\<forall>n''\\<ge>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>. n'' < n' \\<longrightarrow> sb.eval (sKs p) t t'' n'' ?\\<gamma>')\" by auto\n                        moreover have \"\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n'\"\n                          using \\<open>n\\<^sub>r \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\\<close> \\<open>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n\\<^sub>r\\<close>\n                          \\<open>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n'\\<close> by linarith\n                        ultimately show ?thesis using \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> \\<open>\\<not> (\\<exists>i\\<ge>n'. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>)\\<close>\n                            sb.evtIA[of n\\<^sub>r \"sKs p\" t n' t'' ?\\<gamma>] by blast\n                      qed\n                    next\n                      assume cass: \"sb.eval (sKs p) t t'' n\\<^sub>r\n                        (\\<box>\\<^sub>b (\\<not>\\<^sup>b (\\<exists>\\<^sub>b P'. (sb.pred (p'\\<in>P') \\<and>\\<^sup>b [\\<lambda>ks. unsub P' = ksrp ks]\\<^sub>b))))\"\n\n                      have \"sub P = ksrp (\\<sigma>\\<^bsub>sKs p\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>))) \\<and>\n                        p' \\<in> P \\<longrightarrow> (p', p) \\<in> sb\"\n                      proof -\n                        have \"\\<exists>i\\<ge>0. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\" using \\<open>\\<exists>i\\<ge>0. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> by auto\n                        moreover have \"\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>0\\<^esub> \\<le> (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)\" by simp\n                        ultimately have \"sb.eval (sKs p) t t'' (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)\n                          [\\<lambda>ks. sub P = ksrp ks \\<and> p' \\<in> P \\<longrightarrow> (p', p) \\<in> sb]\\<^sub>b\"\n                          using sb.globEA[OF _ bhvks2[of t p \"sKs p\" t'' P]] \\<open>t \\<in> arch\\<close> sks_prob by blast\n                        moreover from \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> have\n                          \"\\<parallel>sKs p\\<parallel>\\<^bsub>t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)\\<^esub>\" using sb.nxtActI by blast\n                        ultimately show ?thesis\n                          using sb.baEANow[of \"sKs p\" t t'' \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\"] by simp\n                      qed\n                      with \\<open>p' \\<in> P\\<close> have \"(p', p) \\<in> sb\"\n                        using \\<open>sub P = ksrp (\\<sigma>\\<^bsub>sKs p\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)))\\<close>\n                        sks_prob by simp\n                      moreover from \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> have \"\\<parallel>sKs p\\<parallel>\\<^bsub>t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)\\<^esub>\"\n                        using sb.nxtActI by blast\n                        with \\<open>sub P = ksrp (\\<sigma>\\<^bsub>sKs p\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)))\\<close>\n                          have \"sub P \\<in> bbrp (\\<sigma>\\<^bsub>the_bb\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)))\"\n                          using conn1A by auto\n                      with \\<open> p' \\<in> P\\<close> have \"sub P \\<in> bbrp (\\<sigma>\\<^bsub>the_bb\\<^esub>t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)) \\<and> p' \\<in> P\" by auto\n                      ultimately obtain m where \"m\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\" and \"(p', solve p') = bbcs (\\<sigma>\\<^bsub>the_bb\\<^esub>(t m))\"\n                        using indH by auto\n\n                      \\<comment> \\<open>and due to the publisher subscriber property,\\<close>\n                      \\<comment> \\<open>the knowledge source will receive them\\<close>\n                      moreover have\n                        \"\\<nexists>n P. \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n \\<and> n \\<le> m \\<and> \\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^esub> \\<and>\n                        unsub P = ksrp (\\<sigma>\\<^bsub>sKs p\\<^esub>(t n)) \\<and> p' \\<in> P\"\n                      proof\n                        assume \"\\<exists>n P'. \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n \\<and> n \\<le> m \\<and> \\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^esub> \\<and>\n                          unsub P' = ksrp (\\<sigma>\\<^bsub>sKs p\\<^esub>(t n)) \\<and> p' \\<in> P'\"\n                        then obtain n P' where\n                          \"\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^esub>\" and \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n\" and \"n \\<le> m\" and\n                          \"unsub P' = ksrp (\\<sigma>\\<^bsub>sKs p\\<^esub>(t n))\" and \"p' \\<in> P'\" by auto\n                        hence \"sb.eval (sKs p) t t'' n (\\<exists>\\<^sub>b P'. sb.pred (p'\\<in>P') \\<and>\\<^sup>b\n                          [\\<lambda>ks. unsub P' = ksrp ks]\\<^sub>b)\" by blast\n                        moreover have \"\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n\"\n                          using \\<open>n\\<^sub>r \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\\<close> \\<open>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n\\<^sub>r\\<close>\n                          \\<open>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> n\\<close> by linarith\n                        with cass have \"sb.eval (sKs p) t t'' n (\\<not>\\<^sup>b (\\<exists>\\<^sub>b P'. (sb.pred (p'\\<in>P')\n                          \\<and>\\<^sup>b [\\<lambda>ks. unsub P' = ksrp ks]\\<^sub>b)))\"\n                          using sb.globEA[of n\\<^sub>r \"sKs p\" t t''\n                          \"\\<not>\\<^sup>b (\\<exists>\\<^sub>bP'. sb.pred (p' \\<in> P') \\<and>\\<^sup>b [\\<lambda>ks. unsub P' = ksrp ks]\\<^sub>b)\" n]\n                          \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> by auto\n                        ultimately show False using sb.negE by auto\n                      qed\n                      moreover from \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> have\n                        \"\\<parallel>sKs p\\<parallel>\\<^bsub>t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)\\<^esub>\" using sb.nxtActI by blast\n                      moreover have \"sub P = ksrp (\\<sigma>\\<^bsub>sKs p\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)))\"\n                        using \\<open>sub P = ksrp (\\<sigma>\\<^bsub>sKs p\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>)))\\<close> .\n                      moreover from \\<open>m\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\\<close> have \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> m\" by simp\n                      moreover from \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close>\n                        have \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\\<ge>n\\<^sub>r\" using sb.nxtActI by blast\n                      hence \"m\\<ge>n\\<^sub>k\" using \\<open>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> m\\<close> \\<open>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>k\\<^esub> \\<le> n\\<^sub>r\\<close>\n                        \\<open>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>k\\<^esub> \\<ge> n\\<^sub>k\\<close> by simp\n                      with case_ass have \"\\<parallel>sKs p\\<parallel>\\<^bsub>t m\\<^esub>\" by simp\n                      ultimately have \"(p', solve p') \\<in> kscs (\\<sigma>\\<^bsub>sKs p\\<^esub>(t m))\"\n                        and \"\\<parallel>sKs p\\<parallel>\\<^bsub>t m\\<^esub>\"\n                        using \\<open>t \\<in> arch\\<close> msgDelivery[of t \"sKs p\" \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\" P m p' \"solve p'\"]\n                        \\<open>p' \\<in> P\\<close> by auto\n                      hence \"sb.eval (sKs p) t t'' m [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b\"\n                        using sb.baIANow by simp\n                      moreover have \"m \\<ge> \\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>m\\<^esub>\" by simp\n                      moreover from \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t m\\<^esub>\\<close> have \"m \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>m\\<^esub>\"\n                        using sb.nxtActLe by auto\n                      moreover from \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> have\n                        \"\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\" by simp\n                      with \\<open>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> m\\<close> have \"\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<le> m\" by arith\n                      ultimately show \"sb.eval (sKs p) t t'' n\\<^sub>r\n                        (\\<diamond>\\<^sub>b [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b)\"\n                        using \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> sb.evtIA by blast\n                    qed\n                  qed\n                qed\n                thus \"sb.eval (sKs p) t t'' n\\<^sub>r (sb.pred (p'\\<in>P) \\<longrightarrow>\\<^sup>b\n                  (\\<diamond>\\<^sub>b [\\<lambda>ks. (p',solve p') \\<in> kscs ks]\\<^sub>b))\"\n                  using sb.impI by auto\n              qed\n              thus ?thesis using sb.allI by blast\n            qed\n\n            \\<comment> \\<open>Thus, the knowlege source will eventually solve the problem at hand...\\<close>\n            ultimately have \"sb.eval (sKs p) t t'' n\\<^sub>r\n              ([\\<lambda>ks. sub P = ksrp ks]\\<^sub>b \\<and>\\<^sup>b\n              (\\<forall>\\<^sub>b q. (sb.pred (q \\<in> P) \\<longrightarrow>\\<^sup>b \\<diamond>\\<^sub>b [\\<lambda>ks. (q, solve q) \\<in> kscs ks]\\<^sub>b)))\"\n              using sb.conjI by simp\n            moreover from \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> have \"\\<exists>i\\<ge>0. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\" by blast\n            hence \"sb.eval (sKs p) t t'' n\\<^sub>r\n              (([\\<lambda>ks. sub P = ksrp ks]\\<^sub>b \\<and>\\<^sup>b\n              (\\<forall>\\<^sub>b q. (sb.pred (q \\<in> P) \\<longrightarrow>\\<^sup>b\n              \\<diamond>\\<^sub>b [\\<lambda>ks. (q, solve q) \\<in> kscs ks]\\<^sub>b))) \\<longrightarrow>\\<^sup>b\n              (\\<diamond>\\<^sub>b [\\<lambda>ks. (p, solve p) = ksns ks]\\<^sub>b))\" using \\<open>t \\<in> arch\\<close>\n              sb.globEA[OF _ bhvks1[of t p \"sKs p\" t'' P]] sks_prob by simp\n            ultimately have \"sb.eval (sKs p) t t'' n\\<^sub>r\n              (\\<diamond>\\<^sub>b [\\<lambda>ks. (p,solve(p))=ksns(ks)]\\<^sub>b)\"\n              using sb.impE[of \"sKs p\" t t'' n\\<^sub>r] by blast\n\n            \\<comment> \\<open>and forward it to the blackboard\\<close>\n            then obtain n\\<^sub>s where \"n\\<^sub>s\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\" and\n              \"(\\<exists>i\\<ge>n\\<^sub>s. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub> \\<and>\n              (\\<forall>n''\\<ge>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>. n'' \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub> \\<longrightarrow>\n              sb.eval (sKs p) t t'' n'' [\\<lambda>ks. (p,solve(p))=ksns(ks)]\\<^sub>b)) \\<or>\n              \\<not> (\\<exists>i\\<ge>n\\<^sub>s. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>) \\<and>\n              sb.eval (sKs p) t t'' n\\<^sub>s [\\<lambda>ks. (p,solve(p))=ksns(ks)]\\<^sub>b\"\n              using sb.evtEA[of n\\<^sub>r \"sKs p\" t] \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> by blast\n            moreover from \\<open>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub> \\<ge> n\\<^sub>r\\<close> \\<open>n\\<^sub>r\\<ge>n\\<^sub>k\\<close> \\<open>n\\<^sub>s\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\\<close>\n              have \"n\\<^sub>s\\<ge>n\\<^sub>k\" by arith\n            with case_ass have \"\\<exists>i\\<ge>n\\<^sub>s. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\" by auto\n            moreover have \"n\\<^sub>s\\<ge>\\<langle>sKs p \\<Leftarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>\" by simp\n            moreover from \\<open>\\<exists>i\\<ge>n\\<^sub>s. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> have \"n\\<^sub>s \\<le> \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>\"\n              using sb.nxtActLe by simp\n            ultimately have \"sb.eval (sKs p) t t'' n\\<^sub>s [\\<lambda>ks. (p,solve(p))=ksns(ks)]\\<^sub>b\"\n              using sb.evtEA[of n\\<^sub>r \"sKs p\" t] \\<open>\\<exists>i\\<ge>n\\<^sub>r. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> by blast\n            with \\<open>\\<exists>i\\<ge>n\\<^sub>s. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close> have\n              \"(p,solve(p)) = ksns (\\<sigma>\\<^bsub>sKs p\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>)))\"\n              using sb.baEA[of n\\<^sub>s \"sKs p\" t t'' \"\\<lambda>ks. (p, solve p) = ksns ks\"] by auto\n            moreover from \\<open>\\<exists>i\\<ge>n\\<^sub>s. \\<parallel>sKs p\\<parallel>\\<^bsub>t i\\<^esub>\\<close>\n              have \"\\<parallel>sKs p\\<parallel>\\<^bsub>t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>)\\<^esub>\" using sb.nxtActI by simp\n            ultimately have \"(p,solve(p)) \\<in> bbns (\\<sigma>\\<^bsub>the_bb\\<^esub>(t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>)))\"\n              using conn1[OF pb.ts_prop(2)[of \"t (\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>)\"]] by auto\n            hence \"pb.eval the_bb t t' \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub> [\\<lambda>bb. (p,solve(p)) \\<in> bbns bb]\\<^sub>b\"\n              using \\<open>t\\<in>arch\\<close> pb.baI by simp\n\n            \\<comment> \\<open>finally, the blackboard will forward the solution which finishes the proof.\\<close>\n            with bhvbb1 have \"pb.eval the_bb t t' \\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>\n              (\\<diamond>\\<^sub>b [\\<lambda>bb. (p, solve p) = bbcs bb]\\<^sub>b)\"\n              using \\<open>t\\<in>arch\\<close> pb.globE pb.impE[of the_bb t t'] by blast\n            then obtain n\\<^sub>f where \"n\\<^sub>f\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>\" and\n              \"pb.eval the_bb t t' n\\<^sub>f [\\<lambda>bb. (p, solve p) = bbcs bb]\\<^sub>b\"\n              using \\<open>t\\<in>arch\\<close> pb.evtE[of t t' \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>\"] by auto\n            hence \"(p, solve p) = bbcs (\\<sigma>\\<^bsub>the_bb\\<^esub>(t n\\<^sub>f))\"\n              using \\<open>t \\<in> arch\\<close> pb.baEA by auto\n            moreover have \"n\\<^sub>f\\<ge>n\\<^sub>0\"\n            proof -\n              from \\<open>\\<exists>n'''\\<ge>n\\<^sub>s. \\<parallel>sKs p\\<parallel>\\<^bsub>t n'''\\<^esub>\\<close> have \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>\\<ge>n\\<^sub>s\"\n                using sb.nxtActLe by simp\n              moreover from \\<open>n\\<^sub>k\\<ge>n\\<close> and \\<open>\\<parallel>sKs p\\<parallel>\\<^bsub>t n\\<^sub>k\\<^esub>\\<close> have \"\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>k\\<^esub>\\<ge>n\\<^sub>k\"\n                using sb.nxtActI by blast\n              ultimately show ?thesis\n                using \\<open>n\\<^sub>f\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>s\\<^esub>\\<close> \\<open>n\\<^sub>s\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\\<close>\n                \\<open>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>r\\<^esub>\\<ge>n\\<^sub>r\\<close> \\<open>n\\<^sub>r\\<ge>\\<langle>sKs p \\<rightarrow> t\\<rangle>\\<^bsub>n\\<^sub>k\\<^esub>\\<close> \\<open>n\\<^sub>k\\<ge>n\\<close> \\<open>n\\<ge>n\\<^sub>0\\<close> by arith\n            qed\n            ultimately show ?thesis by auto\n          qed\n        qed\n      qed\n    qed\n  qed\n\n  theorem pSolved:\n    fixes t and t'::\"nat \\<Rightarrow>'BB\" and t''::\"nat \\<Rightarrow>'KS\"\n    assumes \"t\\<in>arch\" and\n      \"\\<forall>n. (\\<exists>n'\\<ge>n. \\<parallel>sKs (bbop(\\<sigma>\\<^bsub>the_bb\\<^esub>(t n)))\\<parallel>\\<^bsub>t n'\\<^esub>)\"\n    shows\n      \"\\<forall>n. (\\<forall>P. (sub P \\<in> bbrp(\\<sigma>\\<^bsub>the_bb\\<^esub>(t n))\n        \\<longrightarrow> (\\<forall>p \\<in> P. (\\<exists>m\\<ge>n. (p,solve(p)) = bbcs (\\<sigma>\\<^bsub>the_bb\\<^esub>(t m))))))\"\n    using assms pSolved_Ind by blast\nend\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Architectural_Design_Patterns/Blackboard.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.34753585530659964}}
{"text": "theory Lambda\nimports \"../Nominal2\" \nbegin\n\natom_decl name\n\nnominal_datatype lam =\n  Var \"name\"\n| App \"lam\" \"lam\"\n| Lam x::\"name\" l::\"lam\"  bind x in l (\"Lam [_]. _\" [100, 100] 100)\n\nlemma fresh_fun_eqvt_app3:\n  assumes a: \"eqvt f\"\n  and b: \"a \\<sharp> x\" \"a \\<sharp> y\" \"a \\<sharp> z\"\n  shows \"a \\<sharp> f x y z\"\n  using fresh_fun_eqvt_app[OF a b(1)] a b\n  by (metis fresh_fun_app)\n\nlemma fresh_fun_eqvt_app4:\n  assumes a: \"eqvt f\"\n  and b: \"a \\<sharp> x\" \"a \\<sharp> y\" \"a \\<sharp> z\" \"a \\<sharp> w\"\n  shows \"a \\<sharp> f x y z w\"\n  using fresh_fun_eqvt_app[OF a b(1)] a b\n  by (metis fresh_fun_app)\n\nlemma the_default_pty:\n  assumes f_def: \"f == (\\<lambda>x::'a. THE_default d (G x))\"\n  and unique: \"\\<exists>!y. G x y\"\n  and pty: \"\\<And>x y. G x y \\<Longrightarrow> P x y\"\n  shows \"P x (f x)\"\n  apply(subst f_def)\n  apply (rule ex1E[OF unique])\n  apply (subst THE_default1_equality[OF unique])\n  apply assumption\n  apply (rule pty)\n  apply assumption\n  done\n\nlemma Abs_lst1_fcb2:\n  fixes a b :: \"'a :: at\"\n    and S T :: \"'b :: fs\"\n    and c::\"'c::fs\"\n  assumes e: \"(Abs_lst [atom a] T) = (Abs_lst [atom b] S)\"\n  and fcb: \"\\<And>a T. atom a \\<sharp> f a T c\"\n  and fresh: \"{atom a, atom b} \\<sharp>* c\"\n  and perm1: \"\\<And>p. supp p \\<sharp>* c \\<Longrightarrow> p \\<bullet> (f a T c) = f (p \\<bullet> a) (p \\<bullet> T) c\"\n  and perm2: \"\\<And>p. supp p \\<sharp>* c \\<Longrightarrow> p \\<bullet> (f b S c) = f (p \\<bullet> b) (p \\<bullet> S) c\"\n  shows \"f a T c = f b S c\"\nproof -\n  have fin1: \"finite (supp (f a T c))\"\n    apply(rule_tac S=\"supp (a, T, c)\" in supports_finite)\n    apply(simp add: supports_def)\n    apply(simp add: fresh_def[symmetric])\n    apply(clarify)\n    apply(subst perm1)\n    apply(simp add: supp_swap fresh_star_def)\n    apply(simp add: swap_fresh_fresh fresh_Pair)\n    apply(simp add: finite_supp)\n    done\n  have fin2: \"finite (supp (f b S c))\"\n    apply(rule_tac S=\"supp (b, S, c)\" in supports_finite)\n    apply(simp add: supports_def)\n    apply(simp add: fresh_def[symmetric])\n    apply(clarify)\n    apply(subst perm2)\n    apply(simp add: supp_swap fresh_star_def)\n    apply(simp add: swap_fresh_fresh fresh_Pair)\n    apply(simp add: finite_supp)\n    done\n  obtain d::\"'a::at\" where fr: \"atom d \\<sharp> (a, b, S, T, c, f a T c, f b S c)\" \n    using obtain_fresh'[where x=\"(a, b, S, T, c, f a T c, f b S c)\"]\n    apply(auto simp add: finite_supp supp_Pair fin1 fin2)\n    done\n  have \"(a \\<leftrightarrow> d) \\<bullet> (Abs_lst [atom a] T) = (b \\<leftrightarrow> d) \\<bullet> (Abs_lst [atom b] S)\" \n    apply(simp (no_asm_use) only: flip_def)\n    apply(subst swap_fresh_fresh)\n    apply(simp add: Abs_fresh_iff)\n    using fr\n    apply(simp add: Abs_fresh_iff)\n    apply(subst swap_fresh_fresh)\n    apply(simp add: Abs_fresh_iff)\n    using fr\n    apply(simp add: Abs_fresh_iff)\n    apply(rule e)\n    done\n  then have \"Abs_lst [atom d] ((a \\<leftrightarrow> d) \\<bullet> T) = Abs_lst [atom d] ((b \\<leftrightarrow> d) \\<bullet> S)\"\n    apply (simp add: swap_atom flip_def)\n    done\n  then have eq: \"(a \\<leftrightarrow> d) \\<bullet> T = (b \\<leftrightarrow> d) \\<bullet> S\"\n    by (simp add: Abs1_eq_iff)\n  have \"f a T c = (a \\<leftrightarrow> d) \\<bullet> f a T c\"\n    unfolding flip_def\n    apply(rule sym)\n    apply(rule swap_fresh_fresh)\n    using fcb[where a=\"a\"] \n    apply(simp)\n    using fr\n    apply(simp add: fresh_Pair)\n    done\n  also have \"... = f d ((a \\<leftrightarrow> d) \\<bullet> T) c\"\n    unfolding flip_def\n    apply(subst perm1)\n    using fresh fr\n    apply(simp add: supp_swap fresh_star_def fresh_Pair)\n    apply(simp)\n    done\n  also have \"... = f d ((b \\<leftrightarrow> d) \\<bullet> S) c\" using eq by simp\n  also have \"... = (b \\<leftrightarrow> d) \\<bullet> f b S c\"\n    unfolding flip_def\n    apply(subst perm2)\n    using fresh fr\n    apply(simp add: supp_swap fresh_star_def fresh_Pair)\n    apply(simp)\n    done\n  also have \"... = f b S c\"   \n    apply(rule flip_fresh_fresh)\n    using fcb[where a=\"b\"] \n    apply(simp)\n    using fr\n    apply(simp add: fresh_Pair)\n    done\n  finally show ?thesis by simp\nqed\n\nlocale test =\n  fixes f1::\"name \\<Rightarrow> name list \\<Rightarrow> ('a::pt)\"\n    and f2::\"lam \\<Rightarrow> lam \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> name list \\<Rightarrow> ('a::pt)\"\n    and f3::\"name \\<Rightarrow> lam \\<Rightarrow> 'a \\<Rightarrow> name list \\<Rightarrow> ('a::pt)\"\n  assumes fs: \"finite (supp (f1, f2, f3))\"\n    and eq: \"eqvt f1\" \"eqvt f2\" \"eqvt f3\"\n    and fcb1: \"\\<And>l n. atom ` set l \\<sharp>* f1 n l\"\n    and fcb2: \"\\<And>l t1 t2 r1 r2. atom ` set l \\<sharp>* (r1, r2) \\<Longrightarrow> atom ` set l \\<sharp>* f2 t1 t2 r1 r2 l\"\n    and fcb3: \"\\<And>t l r. atom ` set (x # l) \\<sharp>* r \\<Longrightarrow> atom ` set (x # l) \\<sharp>* f3 x t r l\"\nbegin\n\nnominal_function (invariant \"\\<lambda>(x, l) y. atom ` set l \\<sharp>* y\")\n  f\nwhere\n  \"f (Var x) l = f1 x l\"\n| \"f (App t1 t2) l = f2 t1 t2 (f t1 l) (f t2 l) l\"\n| \"atom x \\<sharp> l \\<Longrightarrow> (f (Lam [x].t) l) = f3 x t (f t (x # l)) l\"\n  apply (simp add: eqvt_def f_graph_def)\n  apply (rule, perm_simp)\n  apply (simp only: eq[unfolded eqvt_def])\n  apply (erule f_graph.induct)\n  apply (simp add: fcb1)\n  apply (simp add: fcb2 fresh_star_Pair)\n  apply simp\n  apply (subgoal_tac \"atom ` set (xa # l) \\<sharp>* f3 xa t (f_sum (t, xa # l)) l\")\n  apply (simp add: fresh_star_def)\n  apply (rule fcb3)\n  apply (simp add: fresh_star_def fresh_def)\n  apply simp_all\n  apply(case_tac x)\n  apply(rule_tac y=\"a\" and c=\"b\" in lam.strong_exhaust)\n  apply(auto simp add: fresh_star_def)\n  apply(erule_tac Abs_lst1_fcb2)\n--\"?\"\n  apply (subgoal_tac \"atom ` set (a # la) \\<sharp>* f3 a T (f_sumC (T, a # la)) la\")\n  apply (simp add: fresh_star_def)\n  apply (rule fcb3)\n  apply (simp add: fresh_star_def)\n  apply (rule fresh_fun_eqvt_app4[OF eq(3)])\n  apply (simp add: fresh_at_base)\n  apply assumption\n  apply (erule fresh_eqvt_at)\n  apply (simp add: finite_supp)\n  apply (simp add: fresh_Pair fresh_Cons fresh_at_base)\n  apply assumption\n  apply (subgoal_tac \"\\<And>p y r l. p \\<bullet> (f3 x y r l) = f3 (p \\<bullet> x) (p \\<bullet> y) (p \\<bullet> r) (p \\<bullet> l)\")\n  apply (subgoal_tac \"(atom x \\<rightleftharpoons> atom xa) \\<bullet> la = la\")\n  apply (simp add: eqvt_at_def)\n  apply (simp add: swap_fresh_fresh)\n  apply (simp add: permute_fun_app_eq eq[unfolded eqvt_def])\n  apply simp\n  done\n\ntermination\n  by (relation \"measure (\\<lambda>(x,_). size x)\") (auto simp add: lam.size)\n\nend\n\nsection {* Locally Nameless Terms *}\n\nnominal_datatype ln = \n  LNBnd nat\n| LNVar name\n| LNApp ln ln\n| LNLam ln\n\nfun\n  lookup :: \"name list \\<Rightarrow> nat \\<Rightarrow> name \\<Rightarrow> ln\" \nwhere\n  \"lookup [] n x = LNVar x\"\n| \"lookup (y # ys) n x = (if x = y then LNBnd n else (lookup ys (n + 1) x))\"\n\nlemma lookup_eqvt[eqvt]:\n  shows \"(p \\<bullet> lookup xs n x) = lookup (p \\<bullet> xs) (p \\<bullet> n) (p \\<bullet> x)\"\n  by (induct xs arbitrary: n) (simp_all add: permute_pure)\n\nlemma fresh_at_list: \"atom x \\<sharp> xs \\<longleftrightarrow> x \\<notin> set xs\"\n  unfolding fresh_def supp_set[symmetric]\n  apply (induct xs)\n  apply (simp add: supp_set_empty)\n  apply simp\n  apply auto\n  apply (simp_all add: insert_absorb UnI2 finite_set supp_of_finite_insert supp_at_base)\n  done\n\ninterpretation trans: test\n  \"%x l. lookup l 0 x\"\n  \"%t1 t2 r1 r2 l. LNApp r1 r2\"\n  \"%n t r l. LNLam r\"\n  apply default\n  apply (auto simp add: pure_fresh supp_Pair)\n  apply (simp_all add: fresh_def supp_def permute_fun_def permute_pure lookup_eqvt)[3]\n  apply (simp_all add: eqvt_def permute_fun_def permute_pure lookup_eqvt)\n  apply (simp add: fresh_star_def)\n  apply (rule_tac x=\"0 :: nat\" in spec)\n  apply (induct_tac l)\n  apply (simp add: ln.fresh pure_fresh)\n  apply (auto simp add: ln.fresh pure_fresh)[1]\n  apply (case_tac \"a \\<in> set list\")\n  apply simp\n  apply (rule_tac f=\"lookup\" in fresh_fun_eqvt_app3)\n  unfolding eqvt_def\n  apply rule\n  using eqvts_raw(35)\n  apply auto[1]\n  apply (simp add: fresh_at_list)\n  apply (simp add: pure_fresh)\n  apply (simp add: fresh_at_base)\n  apply (simp add: fresh_star_Pair fresh_star_def ln.fresh)\n  apply (simp add: fresh_star_def ln.fresh)\n  done\n\nthm trans.f.simps\n\nlemma lam_strong_exhaust2:\n  \"\\<lbrakk>\\<And>name. y = Var name \\<Longrightarrow> P; \n    \\<And>lam1 lam2. y = App lam1 lam2 \\<Longrightarrow> P;\n    \\<And>name lam. \\<lbrakk>{atom name} \\<sharp>* c; y = Lam [name]. lam\\<rbrakk> \\<Longrightarrow> P;\n    finite (supp c)\\<rbrakk>\n    \\<Longrightarrow> P\"\nsorry\n\nnominal_function\n  g\nwhere\n  \"(~finite (supp (g1, g2, g3))) \\<Longrightarrow> g g1 g2 g3 t = t\"\n| \"finite (supp (g1, g2, g3)) \\<Longrightarrow> g g1 g2 g3 (Var x) = g1 x\"\n| \"finite (supp (g1, g2, g3)) \\<Longrightarrow> g g1 g2 g3 (App t1 t2) = g2 t1 t2 (g g1 g2 g3 t1) (g g1 g2 g3 t2)\"\n| \"finite (supp (g1, g2, g3)) \\<Longrightarrow> atom x \\<sharp> (g1,g2,g3) \\<Longrightarrow> (g g1 g2 g3 (Lam [x].t)) = g3 x t (g g1 g2 g3 t)\"\n  apply (simp add: eqvt_def g_graph_def)\n  apply (rule, perm_simp, rule)\n  apply simp_all\n  apply (case_tac x)\n  apply (case_tac \"finite (supp (a, b, c))\")\n  prefer 2\n  apply simp\n  apply(rule_tac y=\"d\" and c=\"(a,b,c)\" in lam_strong_exhaust2)\n  apply auto\n  apply blast\n  apply (simp add: Abs1_eq_iff fresh_star_def)\n  sorry\n\ntermination\n  by (relation \"measure (\\<lambda>(_,_,_,t). size t)\") (simp_all add: lam.size)\n\nend\n", "meta": {"author": "goodlyrottenapple", "repo": "Nominal2-Isabelle", "sha": "214274ed6db74c19b8694fc5c8dd9cafa13b056a", "save_path": "github-repos/isabelle/goodlyrottenapple-Nominal2-Isabelle", "path": "github-repos/isabelle/goodlyrottenapple-Nominal2-Isabelle/Nominal2-Isabelle-214274ed6db74c19b8694fc5c8dd9cafa13b056a/Nominal/Ex/Lambda_F_T_FCB2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.34753584748593885}}
{"text": "theory Extract_Certificate\n  imports\n    Worklist_Algorithms.Unified_PW_Impl\n    Worklist_Algorithms.Next_Key\n    DBM.DBM_Operations_Impl_Refine\n    Worklist_Algorithms.Leadsto_Impl\nbegin\n\nsubsection \\<open>Turning a map into a list\\<close>\n\ndefinition list_of_map where\n  \"list_of_map m \\<equiv> do\n      {\n        (xs, m) \\<leftarrow> WHILEIT\n          (\\<lambda> (xs, m'). finite (dom m') \\<and> m = m' ++ map_of xs \\<and> dom m' \\<inter> dom (map_of xs) = {})\n             (\\<lambda> (_, m). Map.empty \\<noteq> m)\n            (\\<lambda> (xs, m). do\n              {\n                k \\<leftarrow> next_key m;\n                let (x, m) = op_map_extract k m;\n                ASSERT (x \\<noteq> None);\n                RETURN ((k, the x) # xs, m)\n              }\n            )\n            ([], m);\n        RETURN xs\n      }\n  \"\n\ncontext\nbegin\n\nprivate definition\n  \"ran_of_map_var = (inv_image (measure (card o dom)) (\\<lambda> (a, b). b))\"\n\nprivate lemma wf_ran_of_map_var:\n  \"wf ran_of_map_var\"\n  unfolding ran_of_map_var_def by auto\n\n(* XXX Maybe move *)\nprivate lemma insert_restrict_ran:\n  \"insert v (ran (m |` (- {k}))) = ran m \" if \"m k = Some v\"\n  using that unfolding ran_def restrict_map_def by force\n\nprivate lemma 1:\n  \"(m |` (- {x}))(x \\<mapsto> y) = m\" if \"m x = Some y\"\n  using that unfolding restrict_map_def by auto\n\nprivate lemma 2:\n  \"(m1 ++ m2)(x \\<mapsto> y) = m1(x \\<mapsto> y) ++ m2\" if \"x \\<notin> dom m2\"\n  using that by auto\n\nlemma list_of_map_correct[refine]:\n  \"list_of_map m \\<le> SPEC (\\<lambda> r. map_of r = m)\" if \"finite (dom m)\"\n  using that unfolding list_of_map_def next_key_def\n  apply (refine_vcg wf_ran_of_map_var)\n         apply (clarsimp; fail)+\n  subgoal for s xs m' x v xs' xs1 xs'1\n    unfolding dom_def apply (clarsimp simp: map_upd_eq_restrict)\n    apply (subst 2)\n     apply auto\n    apply (subst 1)\n     apply auto\n    done\n  unfolding ran_of_map_var_def by (fastforce intro: card_Diff1_less split: if_split_asm)+\n\nend \\<comment> \\<open>End of private context for auxiliary facts and definitions\\<close>\n\ncontext\n  fixes K :: \"_ \\<Rightarrow> _ :: {hashable, heap} \\<Rightarrow> assn\"\n  assumes is_pure_K[safe_constraint_rules]: \"is_pure K\"\n  and left_unique_K[safe_constraint_rules]: \"IS_LEFT_UNIQUE (the_pure K)\"\n  and right_unique_K[safe_constraint_rules]: \"IS_RIGHT_UNIQUE (the_pure K)\"\n  notes [sepref_fr_rules] = hm_it_next_key_next_key''[OF is_pure_K]\nbegin\n\nsepref_definition list_of_map_impl is\n  \"list_of_map\" :: \"(hm.hms_assn' K A)\\<^sup>d \\<rightarrow>\\<^sub>a (list_assn (K \\<times>\\<^sub>a A))\"\n  unfolding list_of_map_def hm.hms_assn'_id_hms_assn[symmetric]\n  unfolding op_map_is_empty_def[symmetric]\n  unfolding hm.hms_fold_custom_empty HOL_list.fold_custom_empty\n  by sepref\n\nend (* Anonymous context for setup *)\n\nlemmas list_of_map_impl_code[code] =\n  list_of_map_impl_def[of \"pure Id\", simplified, OF Sepref_Constraints.safe_constraint_rules(41)]\n\ncontext\n  notes [sepref_fr_rules] = hm_it_next_key_next_key'[folded hm.hms_assn'_id_hms_assn]\nbegin\n\nsepref_definition list_of_map_impl' is\n  \"list_of_map\" :: \"(hm.hms_assn A)\\<^sup>d \\<rightarrow>\\<^sub>a (list_assn (id_assn \\<times>\\<^sub>a A))\"\n  unfolding list_of_map_def hm.hms_assn'_id_hms_assn[symmetric]\n  unfolding op_map_is_empty_def[symmetric]\n  unfolding hm.hms_fold_custom_empty HOL_list.fold_custom_empty\n  by sepref\n\nend (* Anonymous context for setup *)\n\ncontext Worklist_Map2_Impl\nbegin\n\ndefinition extract_certificate :: \"_ nres\" where\n  \"extract_certificate = do {\n   (_, passed) \\<leftarrow> pw_algo_map2;\n   list_of_map passed\n  }\"\n\ncontext\nbegin\n\nprivate definition\n  \"pw_algo_map2_copy = pw_algo_map2\"\n\nsepref_register pw_algo_map2_copy\n\nlemma pw_algo_map2_copy_fold:\n  \"PR_CONST pw_algo_map2_copy = pw_algo_map2\"\n  unfolding pw_algo_map2_copy_def by simp\n\nlemmas [sepref_fr_rules] =\n  pw_algo_map2_impl.refine_raw[folded pw_algo_map2_copy_fold]\n  list_of_map_impl.refine[OF pure_K left_unique_K right_unique_K]\n\nsepref_thm extract_certificate_impl is\n  \"uncurry0 extract_certificate\" :: \"unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a (list_assn (K \\<times>\\<^sub>a lso_assn A))\"\n  unfolding extract_certificate_def pw_algo_map2_copy_def[symmetric] by sepref\n\nend\n\nend\n\nconcrete_definition extract_certificate_impl\n  uses Worklist_Map2_Impl.extract_certificate_impl.refine_raw\n\nprint_theorems\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Certificate_Checking/Extract_Certificate.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.6224593312018545, "lm_q1q2_score": 0.3475358474859388}}
{"text": "(* Author: Joshua Schneider, ETH Zurich *)\n\nsection \\<open>Lifting with applicative functors\\<close>\n\ntheory Applicative\nimports Main\nkeywords \"applicative\" :: thy_goal and \"print_applicative\" :: diag\nbegin\n\nsubsection \\<open>Equality restricted to a set\\<close>\n\ndefinition eq_on :: \"'a set \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> bool\"\nwhere [simp]: \"eq_on A = (\\<lambda>x y. x \\<in> A \\<and> x = y)\"\n\nlemma rel_fun_eq_onI: \"(\\<And>x. x \\<in> A \\<Longrightarrow> R (f x) (g x)) \\<Longrightarrow> rel_fun (eq_on A) R f g\"\nby auto\n\n\nsubsection \\<open>Proof automation\\<close>\n\nlemma arg1_cong: \"x = y \\<Longrightarrow> f x z = f y z\"\nby (rule arg_cong)\n\nlemma UNIV_E: \"x \\<in> UNIV \\<Longrightarrow> P \\<Longrightarrow> P\" .\n\ncontext begin\n\nprivate named_theorems combinator_unfold\nprivate named_theorems combinator_repr\n\nprivate definition \"B g f x \\<equiv> g (f x)\"\nprivate definition \"C f x y \\<equiv> f y x\"\nprivate definition \"I x \\<equiv> x\"\nprivate definition \"K x y \\<equiv> x\"\nprivate definition \"S f g x \\<equiv> (f x) (g x)\"\nprivate definition \"T x f \\<equiv> f x\"\nprivate definition \"W f x \\<equiv> f x x\"\n\nlemmas [abs_def, combinator_unfold] = B_def C_def I_def K_def S_def T_def W_def\nlemmas [combinator_repr] = combinator_unfold\n\nprivate definition \"cpair \\<equiv> Pair\"\nprivate definition \"cuncurry \\<equiv> case_prod\"\n\nprivate lemma uncurry_pair: \"cuncurry f (cpair x y) = f x y\"\nunfolding cpair_def cuncurry_def by simp\n\nML_file \"applicative.ML\"\n\nlocal_setup \\<open>Applicative.setup_combinators\n [(\"B\", @{thm B_def}),\n  (\"C\", @{thm C_def}),\n  (\"I\", @{thm I_def}),\n  (\"K\", @{thm K_def}),\n  (\"S\", @{thm S_def}),\n  (\"T\", @{thm T_def}),\n  (\"W\", @{thm W_def})]\\<close>\n\nprivate attribute_setup combinator_eq =\n  \\<open>Scan.lift (Scan.option (Args.$$$ \"weak\" |--\n    Scan.optional (Args.colon |-- Scan.repeat1 Args.name) []) >>\n    Applicative.combinator_rule_attrib)\\<close>\n\nlemma [combinator_eq]: \"B \\<equiv> S (K S) K\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"C \\<equiv> S (S (K (S (K S) K)) S) (K K)\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"I \\<equiv> W K\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"I \\<equiv> C K ()\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"S \\<equiv> B (B W) (B B C)\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"T \\<equiv> C I\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"W \\<equiv> S S (S K)\" unfolding combinator_unfold .\n\nlemma [combinator_eq weak: C]:\n  \"C \\<equiv> C (B B (B B (B W (C (B C (B (B B) (C B (cuncurry (K I))))) (cuncurry K))))) cpair\"\nunfolding combinator_unfold uncurry_pair .\n\nend (* context *)\n\n\nmethod_setup applicative_unfold =\n  \\<open>Applicative.parse_opt_afun >> (fn opt_af => fn ctxt =>\n    SIMPLE_METHOD' (Applicative.unfold_wrapper_tac ctxt opt_af))\\<close>\n  \"unfold into an applicative expression\"\n\nmethod_setup applicative_fold =\n  \\<open>Applicative.parse_opt_afun >> (fn opt_af => fn ctxt =>\n    SIMPLE_METHOD' (Applicative.fold_wrapper_tac ctxt opt_af))\\<close>\n  \"fold an applicative expression\"\n\nmethod_setup applicative_nf =\n  \\<open>Applicative.parse_opt_afun >> (fn opt_af => fn ctxt =>\n    SIMPLE_METHOD' (Applicative.normalize_wrapper_tac ctxt opt_af))\\<close>\n  \"prove an equation that has been lifted to an applicative functor, using normal forms\"\n\nmethod_setup applicative_lifting =\n  \\<open>Applicative.parse_opt_afun >> (fn opt_af => fn ctxt =>\n    SIMPLE_METHOD' (Applicative.lifting_wrapper_tac ctxt opt_af))\\<close>\n  \"prove an equation that has been lifted to an applicative functor\"\n\nML \\<open>Outer_Syntax.local_theory_to_proof @{command_keyword \"applicative\"}\n  \"register applicative functors\"\n  (Parse.binding --\n    Scan.optional (@{keyword \"(\"} |-- Parse.list Parse.short_ident --| @{keyword \")\"}) [] --\n    (@{keyword \"for\"} |-- Parse.reserved \"pure\" |-- @{keyword \":\"} |-- Parse.term) --\n    (Parse.reserved \"ap\" |-- @{keyword \":\"} |-- Parse.term) --\n    Scan.option (Parse.reserved \"rel\" |-- @{keyword \":\"} |-- Parse.term) --\n    Scan.option (Parse.reserved \"set\" |-- @{keyword \":\"} |-- Parse.term) >>\n    Applicative.applicative_cmd)\\<close>\n\nML \\<open>Outer_Syntax.command @{command_keyword \"print_applicative\"}\n  \"print registered applicative functors\"\n  (Scan.succeed (Toplevel.keep (Applicative.print_afuns o Toplevel.context_of)))\\<close>\n\nattribute_setup applicative_unfold =\n  \\<open>Scan.lift (Scan.option Parse.name >> Applicative.add_unfold_attrib)\\<close>\n  \"register rules for unfolding into applicative expressions\"\n\nattribute_setup applicative_lifted =\n  \\<open>Scan.lift (Parse.name >> Applicative.forward_lift_attrib)\\<close>\n  \"lift an equation to an applicative functor\"\n\n\nsubsection \\<open>Overloaded applicative operators\\<close>\n\nconsts\n  pure :: \"'a \\<Rightarrow> 'b\"\n  ap :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'c\"\n\nbundle applicative_syntax\nbegin\n  notation ap (infixl \"\\<diamondop>\" 70)\nend\n\nhide_const (open) ap\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Applicative_Lifting/Applicative.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.6224593312018546, "lm_q1q2_score": 0.3475358474859388}}
{"text": "(*  Title:      Jinja/Compiler/WellType1.thy\n\n    Author:     Tobias Nipkow\n    Copyright   2003 Technische Universitaet Muenchen\n*)\n\nheader {* \\isaheader{Well-Formedness of Intermediate Language} *}\n\ntheory J1WellForm\nimports \"../J/JWellForm\" J1\nbegin\n\nsubsection \"Well-Typedness\"\n\ntype_synonym \n  env\\<^sub>1  = \"ty list\"   --\"type environment indexed by variable number\"\n\ninductive\n  WT\\<^sub>1 :: \"[J\\<^sub>1_prog,env\\<^sub>1, expr\\<^sub>1     , ty     ] \\<Rightarrow> bool\"\n         (\"(_,_ \\<turnstile>\\<^sub>1/ _ :: _)\"   [51,51,51]50)\n  and WTs\\<^sub>1 :: \"[J\\<^sub>1_prog,env\\<^sub>1, expr\\<^sub>1 list, ty list] \\<Rightarrow> bool\"\n         (\"(_,_ \\<turnstile>\\<^sub>1/ _ [::] _)\" [51,51,51]50)\n  for P :: J\\<^sub>1_prog\nwhere\n  \n  WTNew\\<^sub>1:\n  \"is_class P C  \\<Longrightarrow>\n  P,E \\<turnstile>\\<^sub>1 new C :: Class C\"\n\n| WTCast\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: Class D;  is_class P C;  P \\<turnstile> C \\<preceq>\\<^sup>* D \\<or> P \\<turnstile> D \\<preceq>\\<^sup>* C \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 Cast C e :: Class C\"\n\n| WTVal\\<^sub>1:\n  \"typeof v = Some T \\<Longrightarrow>\n  P,E \\<turnstile>\\<^sub>1 Val v :: T\"\n\n| WTVar\\<^sub>1:\n  \"\\<lbrakk> E!i = T; i < size E \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 Var i :: T\"\n\n| WTBinOp\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 :: T\\<^sub>1;  P,E \\<turnstile>\\<^sub>1 e\\<^sub>2 :: T\\<^sub>2;\n     case bop of Eq \\<Rightarrow> (P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1) \\<and> T = Boolean\n               | Add \\<Rightarrow> T\\<^sub>1 = Integer \\<and> T\\<^sub>2 = Integer \\<and> T = Integer \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2 :: T\"\n\n| WTLAss\\<^sub>1:\n  \"\\<lbrakk> E!i = T;  i < size E; P,E \\<turnstile>\\<^sub>1 e :: T';  P \\<turnstile> T' \\<le> T \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 i:=e :: Void\"\n\n| WTFAcc\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: Class C;  P \\<turnstile> C sees F:T in D \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 e\\<bullet>F{D} :: T\"\n\n| WTFAss\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 :: Class C;  P \\<turnstile> C sees F:T in D;  P,E \\<turnstile>\\<^sub>1 e\\<^sub>2 :: T';  P \\<turnstile> T' \\<le> T \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2 :: Void\"\n\n| WTCall\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: Class C; P \\<turnstile> C sees M:Ts' \\<rightarrow> T = m in D;\n    P,E \\<turnstile>\\<^sub>1 es [::] Ts;  P \\<turnstile> Ts [\\<le>] Ts' \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 e\\<bullet>M(es) :: T\"\n\n| WTBlock\\<^sub>1:\n  \"\\<lbrakk> is_type P T; P,E@[T] \\<turnstile>\\<^sub>1 e::T' \\<rbrakk>\n  \\<Longrightarrow>  P,E \\<turnstile>\\<^sub>1 {i:T; e} :: T'\"\n\n| WTSeq\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1::T\\<^sub>1;  P,E \\<turnstile>\\<^sub>1 e\\<^sub>2::T\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow>  P,E \\<turnstile>\\<^sub>1 e\\<^sub>1;;e\\<^sub>2 :: T\\<^sub>2\"\n\n| WTCond\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: Boolean;  P,E \\<turnstile>\\<^sub>1 e\\<^sub>1::T\\<^sub>1;  P,E \\<turnstile>\\<^sub>1 e\\<^sub>2::T\\<^sub>2;\n    P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1;  P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<longrightarrow> T = T\\<^sub>2; P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1 \\<longrightarrow> T = T\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n\n| WTWhile\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: Boolean;  P,E \\<turnstile>\\<^sub>1 c::T \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 while (e) c :: Void\"\n\n| WTThrow\\<^sub>1:\n  \"P,E \\<turnstile>\\<^sub>1 e :: Class C  \\<Longrightarrow>\n  P,E \\<turnstile>\\<^sub>1 throw e :: Void\"\n\n| WTTry\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 :: T;  P,E@[Class C] \\<turnstile>\\<^sub>1 e\\<^sub>2 :: T; is_class P C \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 try e\\<^sub>1 catch(C i) e\\<^sub>2 :: T\"\n\n| WTNil\\<^sub>1:\n  \"P,E \\<turnstile>\\<^sub>1 [] [::] []\"\n\n| WTCons\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: T;  P,E \\<turnstile>\\<^sub>1 es [::] Ts \\<rbrakk>\n  \\<Longrightarrow>  P,E \\<turnstile>\\<^sub>1 e#es [::] T#Ts\"\n\n(*<*)\ndeclare  WT\\<^sub>1_WTs\\<^sub>1.intros[intro!]\ndeclare WTNil\\<^sub>1[iff]\n\nlemmas WT\\<^sub>1_WTs\\<^sub>1_induct = WT\\<^sub>1_WTs\\<^sub>1.induct [split_format (complete)]\n  and WT\\<^sub>1_WTs\\<^sub>1_inducts = WT\\<^sub>1_WTs\\<^sub>1.inducts [split_format (complete)]\n\ninductive_cases eee[elim!]:\n  \"P,E \\<turnstile>\\<^sub>1 Val v :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 Var i :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 Cast D e :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 i:=e :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 {i:U; e} :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1;;e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 while (e) c :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 throw e :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 try e\\<^sub>1 catch(C i) e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 e\\<bullet>F{D} :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1\\<bullet>F{D}:=e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 new C :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 e\\<bullet>M(es) :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 [] [::] Ts\"\n  \"P,E \\<turnstile>\\<^sub>1 e#es [::] Ts\"\n(*>*)\n\nlemma WTs\\<^sub>1_same_size: \"\\<And>Ts. P,E \\<turnstile>\\<^sub>1 es [::] Ts \\<Longrightarrow> size es = size Ts\"\n(*<*)by (induct es type:list) auto(*>*)\n\n\nlemma WT\\<^sub>1_unique:\n  \"P,E \\<turnstile>\\<^sub>1 e :: T\\<^sub>1 \\<Longrightarrow> (\\<And>T\\<^sub>2. P,E \\<turnstile>\\<^sub>1 e :: T\\<^sub>2 \\<Longrightarrow> T\\<^sub>1 = T\\<^sub>2)\" and\n  \"P,E \\<turnstile>\\<^sub>1 es [::] Ts\\<^sub>1 \\<Longrightarrow> (\\<And>Ts\\<^sub>2. P,E \\<turnstile>\\<^sub>1 es [::] Ts\\<^sub>2 \\<Longrightarrow> Ts\\<^sub>1 = Ts\\<^sub>2)\"\n(*<*)\napply(induct rule:WT\\<^sub>1_WTs\\<^sub>1.inducts)\napply blast\napply blast\napply clarsimp\napply blast\napply clarsimp\napply(case_tac bop)\napply clarsimp\napply clarsimp\napply blast\napply (blast dest:sees_field_idemp sees_field_fun)\napply blast\napply (blast dest:sees_method_idemp sees_method_fun)\napply blast\napply blast\napply blast\napply blast\napply clarify\napply blast\napply blast\napply blast\ndone\n(*>*)\n\n\nlemma assumes wf: \"wf_prog p P\"\nshows WT\\<^sub>1_is_type: \"P,E \\<turnstile>\\<^sub>1 e :: T \\<Longrightarrow> set E \\<subseteq> types P \\<Longrightarrow> is_type P T\"\nand \"P,E \\<turnstile>\\<^sub>1 es [::] Ts \\<Longrightarrow> True\"\n(*<*)\napply(induct rule:WT\\<^sub>1_WTs\\<^sub>1.inducts)\napply simp\napply simp\napply (simp add:typeof_lit_is_type)\napply (blast intro:nth_mem)\napply(simp split:bop.splits)\napply simp\napply (simp add:sees_field_is_type[OF _ wf])\napply simp\napply(fastforce dest!: sees_wf_mdecl[OF wf] simp:wf_mdecl_def)\napply simp\napply simp\napply blast\napply simp\napply simp\napply simp\napply simp\napply simp\ndone\n(*>*)\n\n\nsubsection{* Well-formedness*}\n\n--\"Indices in blocks increase by 1\"\n\nprimrec \\<B> :: \"expr\\<^sub>1 \\<Rightarrow> nat \\<Rightarrow> bool\"\n  and \\<B>s :: \"expr\\<^sub>1 list \\<Rightarrow> nat \\<Rightarrow> bool\" where\n\"\\<B> (new C) i = True\" |\n\"\\<B> (Cast C e) i = \\<B> e i\" |\n\"\\<B> (Val v) i = True\" |\n\"\\<B> (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2) i = (\\<B> e\\<^sub>1 i \\<and> \\<B> e\\<^sub>2 i)\" |\n\"\\<B> (Var j) i = True\" |\n\"\\<B> (e\\<bullet>F{D}) i = \\<B> e i\" |\n\"\\<B> (j:=e) i = \\<B> e i\" |\n\"\\<B> (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2) i = (\\<B> e\\<^sub>1 i \\<and> \\<B> e\\<^sub>2 i)\" |\n\"\\<B> (e\\<bullet>M(es)) i = (\\<B> e i \\<and> \\<B>s es i)\" |\n\"\\<B> ({j:T ; e}) i = (i = j \\<and> \\<B> e (i+1))\" |\n\"\\<B> (e\\<^sub>1;;e\\<^sub>2) i = (\\<B> e\\<^sub>1 i \\<and> \\<B> e\\<^sub>2 i)\" |\n\"\\<B> (if (e) e\\<^sub>1 else e\\<^sub>2) i = (\\<B> e i \\<and> \\<B> e\\<^sub>1 i \\<and> \\<B> e\\<^sub>2 i)\" |\n\"\\<B> (throw e) i = \\<B> e i\" |\n\"\\<B> (while (e) c) i = (\\<B> e i \\<and> \\<B> c i)\" |\n\"\\<B> (try e\\<^sub>1 catch(C j) e\\<^sub>2) i = (\\<B> e\\<^sub>1 i \\<and> i=j \\<and> \\<B> e\\<^sub>2 (i+1))\" |\n\n\"\\<B>s [] i = True\" |\n\"\\<B>s (e#es) i = (\\<B> e i \\<and> \\<B>s es i)\"\n\n\ndefinition wf_J\\<^sub>1_mdecl :: \"J\\<^sub>1_prog \\<Rightarrow> cname \\<Rightarrow> expr\\<^sub>1 mdecl \\<Rightarrow> bool\"\nwhere\n  \"wf_J\\<^sub>1_mdecl P C  \\<equiv>  \\<lambda>(M,Ts,T,body).\n    (\\<exists>T'. P,Class C#Ts \\<turnstile>\\<^sub>1 body :: T' \\<and> P \\<turnstile> T' \\<le> T) \\<and>\n    \\<D> body \\<lfloor>{..size Ts}\\<rfloor> \\<and> \\<B> body (size Ts + 1)\"\n\nlemma wf_J\\<^sub>1_mdecl[simp]:\n  \"wf_J\\<^sub>1_mdecl P C (M,Ts,T,body) \\<equiv>\n    ((\\<exists>T'. P,Class C#Ts \\<turnstile>\\<^sub>1 body :: T' \\<and> P \\<turnstile> T' \\<le> T) \\<and>\n     \\<D> body \\<lfloor>{..size Ts}\\<rfloor> \\<and> \\<B> body (size Ts + 1))\"\n(*<*)by (simp add:wf_J\\<^sub>1_mdecl_def)(*>*)\n\nabbreviation \"wf_J\\<^sub>1_prog == wf_prog wf_J\\<^sub>1_mdecl\"\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/Compiler/J1WellForm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.34749755709560654}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory MoreCorres\nimports \"Lib.ExtraCorres\"\nbegin\n\n(* FIXME: move all of this into ExtraCorres *)\n\n(*\n * If both systems perform non-determinism where the splits are\n * equivalent, we can prove each pair separately.\n *)\nlemma corres_alternate_match:\n  \"\\<lbrakk> corres_underlying sr nf nf' r P P' a c;\n     corres_underlying sr nf nf' r P P' b d \\<rbrakk> \\<Longrightarrow>\n   corres_underlying sr nf nf' r P P' (a \\<sqinter> b) (c \\<sqinter> d)\"\n  apply (simp add: corres_underlying_def alternative_def)\n  apply (clarsimp)\n  apply (drule (1) bspec, clarsimp)+\n  apply fastforce\n  done\n\n(*\n * If the concrete system performs non-determinism where the abstract\n * system does not, we must show that both branches of the concrete\n * system refine the abstract system.\n *)\nlemma corres_alternate_split:\n  \"\\<lbrakk> corres_underlying sr nf nf' r P Q a x;\n     corres_underlying sr nf nf' r P' Q' a y \\<rbrakk> \\<Longrightarrow>\n   corres_underlying sr nf nf' r (P and P') (Q and Q') a (x \\<sqinter> y)\"\n  apply (simp add: corres_underlying_def alternative_def)\n  apply (clarsimp)\n  apply (drule (1) bspec, clarsimp)+\n  apply fastforce\n  done\n\n(*\n * Two select statements are equivalent if the concrete's select set is\n * a subset of the abstract's select set.\n *)\nlemma corres_select_equiv:\n  \"\\<lbrakk> \\<forall>a' \\<in> A'. \\<exists>a \\<in> A. r a a' \\<rbrakk> \\<Longrightarrow> corres_underlying sr nf nf' r \\<top> \\<top> (select A) (select A')\"\n  apply (clarsimp simp: corres_underlying_def)\n  apply (clarsimp simp: split_def)\n  apply (clarsimp simp: select_def)\n  done\n\n(*\n * Where there is an 'if' statement in the concrete system not present\n * in the abstract system, we must show that both branches are a  valid\n * refinement. Happily, we get to assume the outcome of the 'if'\n * statement when proving the refinement.\n *\n * This will likely need to be used with 'stronger_corres_guard_imp'.\n *)\nlemma corres_if_rhs:\n  \"\\<lbrakk>  G \\<Longrightarrow> corres_underlying sr nf nf' rvr P  Q  a b;\n     \\<not>G \\<Longrightarrow> corres_underlying sr nf nf' rvr P' Q' a c \\<rbrakk> \\<Longrightarrow>\n   corres_underlying sr nf nf' rvr\n       (\\<lambda>s. (G \\<longrightarrow> P s) \\<and> (\\<not>G \\<longrightarrow> P' s)) (\\<lambda>s. (G \\<longrightarrow> Q s) \\<and> (\\<not>G \\<longrightarrow> Q' s))\n       a (if G then b else c)\"\n  by (auto elim: corres_guard_imp)\n\n(* Bind distributes over non-deterministic choice. *)\nlemma alternative_bind_distrib: \"((f \\<sqinter> g) >>= h) = ((f >>= h) \\<sqinter> (g >>= h))\"\n  apply (auto simp: alternative_def bind_def split_def intro!: prod_eqI)\n  done\n\n(* Bind distributes over non-deterministic choice. *)\nlemma alternative_bind_distrib_2: \"(do f; (a \\<sqinter> b) od) = ((do f; a od) \\<sqinter> (do f; b od))\"\n  apply (auto simp: alternative_def bind_def split_def intro!: prod_eqI)\n  done\n\n(* \"bindE\" distributes over non-deterministic choice. *)\nlemma alternative_bindE_distrib: \"((f \\<sqinter> g) >>=E h) = ((f >>=E h) \\<sqinter> (g >>=E h))\"\n  by (simp add: bindE_def alternative_bind_distrib)\n\n(*\n * Two arbitrary return statements correspond if our return relation\n * doesn't care about them.\n *)\nlemma corres_return_dc [simp]:\n  \"corres_underlying sr nf nf' dc \\<top> \\<top> (return a) (return b)\"\n  apply (clarsimp simp: corres_underlying_def dc_def return_def)\n  done\n\n(* If our return relation doesn't matter, return statements are meaningless. *)\nlemma corres_return_dc_rhs:\n  \"corres_underlying sr nf nf' dc G G' P P' \\<Longrightarrow> corres_underlying sr nf nf' dc G G' P (do P'; return a od)\"\n  by (fastforce simp: corres_underlying_def dc_def return_def bind_def)\n\n(* If our return relation doesn't matter, return statements are meaningless. *)\nlemma corres_return_dc_lhs:\n  \"corres_underlying sr nf nf' dc G G' P P'\n    \\<Longrightarrow> corres_underlying sr nf nf' dc G G' (do P; return a od) P'\"\n  by (simp add: liftM_def[symmetric])\n\n(* liftE distributes inside bind. *)\nlemma liftE_distrib: \"(liftE (A >>= (\\<lambda>_. B))) = ((liftE A) >>=E (\\<lambda>x. (liftE B)))\"\n  apply (clarsimp simp: liftE_def bindE_def)\n  apply (subst bind_assoc)+\n  apply (clarsimp simp: bind_def lift_def)\n  done\n\n(* liftE distributes inside alternate. *)\nlemma liftE_alternative_distrib: \"(liftE (a \\<sqinter> b)) = ((liftE a) \\<sqinter> (liftE b))\"\n  by (metis alternative_bind_distrib bindE_returnOk liftE_bindE)\n\nlemma corres_skip_catch:\n  \"corres_underlying sr nf nf' dc P P' f g \\<Longrightarrow>\n   corres_underlying sr nf nf' dc P P' f (g <catch> (\\<lambda>_. return x))\"\n  by (clarsimp simp: corres_underlying_def catch_def return_def bind_def\n                     split_def\n               split: sum.splits)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/drefine/MoreCorres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.689305616785446, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.34734535367853997}}
{"text": "(*  Title:      Jinja/Compiler/TypeComp.thy\n\n    Author:     Tobias Nipkow\n    Copyright   TUM 2003\n*)\n\nsection \\<open>Preservation of Well-Typedness\\<close>\n\ntheory TypeComp\nimports Compiler \"../BV/BVSpec\"\nbegin\n\n(*<*)\ndeclare nth_append[simp]\n(*>*)\n\nlocale TC0 =\n  fixes P :: \"J\\<^sub>1_prog\" and mxl :: nat\nbegin\n\ndefinition \"ty E e = (THE T. P,E \\<turnstile>\\<^sub>1 e :: T)\"\n\ndefinition \"ty\\<^sub>l E A' = map (\\<lambda>i. if i \\<in> A' \\<and> i < size E then OK(E!i) else Err) [0..<mxl]\"\n\ndefinition \"ty\\<^sub>i' ST E A = (case A of None \\<Rightarrow> None | \\<lfloor>A'\\<rfloor> \\<Rightarrow> Some(ST, ty\\<^sub>l E A'))\"\n\ndefinition \"after E A ST e = ty\\<^sub>i' (ty E e # ST) E (A \\<squnion> \\<A> e)\"\n\nend\n\nlemma (in TC0) ty_def2 [simp]: \"P,E \\<turnstile>\\<^sub>1 e :: T \\<Longrightarrow> ty E e = T\"\n(*<*)by(unfold ty_def) (blast intro: the_equality WT\\<^sub>1_unique)(*>*)\n\nlemma (in TC0) [simp]: \"ty\\<^sub>i' ST E None = None\"\n(*<*)by (simp add: ty\\<^sub>i'_def)(*>*)\n\nlemma (in TC0) ty\\<^sub>l_app_diff[simp]:\n \"ty\\<^sub>l (E@[T]) (A - {size E}) = ty\\<^sub>l E A\"\n(*<*)by(auto simp add:ty\\<^sub>l_def hyperset_defs)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>i'_app_diff[simp]:\n \"ty\\<^sub>i' ST (E @ [T]) (A \\<ominus> size E) = ty\\<^sub>i' ST E A\"\n(*<*)by(auto simp add:ty\\<^sub>i'_def hyperset_defs)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>l_antimono:\n \"A \\<subseteq> A' \\<Longrightarrow> P \\<turnstile> ty\\<^sub>l E A' [\\<le>\\<^sub>\\<top>] ty\\<^sub>l E A\"\n(*<*)by(auto simp:ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>i'_antimono:\n \"A \\<subseteq> A' \\<Longrightarrow> P \\<turnstile> ty\\<^sub>i' ST E \\<lfloor>A'\\<rfloor> \\<le>' ty\\<^sub>i' ST E \\<lfloor>A\\<rfloor>\"\n(*<*)by(auto simp:ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>l_env_antimono:\n \"P \\<turnstile> ty\\<^sub>l (E@[T]) A [\\<le>\\<^sub>\\<top>] ty\\<^sub>l E A\" \n(*<*)by(auto simp:ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>i'_env_antimono:\n \"P \\<turnstile> ty\\<^sub>i' ST (E@[T]) A \\<le>' ty\\<^sub>i' ST E A\" \n(*<*)by(auto simp:ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>i'_incr:\n \"P \\<turnstile> ty\\<^sub>i' ST (E @ [T]) \\<lfloor>insert (size E) A\\<rfloor> \\<le>' ty\\<^sub>i' ST E \\<lfloor>A\\<rfloor>\"\n(*<*)by(auto simp:ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>l_incr:\n \"P \\<turnstile> ty\\<^sub>l (E @ [T]) (insert (size E) A) [\\<le>\\<^sub>\\<top>] ty\\<^sub>l E A\"\n(*<*)by(auto simp: hyperset_defs ty\\<^sub>l_def list_all2_conv_all_nth)(*>*)\n\n\nlemma (in TC0) ty\\<^sub>l_in_types:\n \"set E \\<subseteq> types P \\<Longrightarrow> ty\\<^sub>l E A \\<in> nlists mxl (err (types P))\"\n(*<*)by(auto simp add:ty\\<^sub>l_def intro!:nlistsI dest!: nth_mem)(*>*)\n\nlocale TC1 = TC0\nbegin\n\nprimrec compT :: \"ty list \\<Rightarrow> nat hyperset \\<Rightarrow> ty list \\<Rightarrow> expr\\<^sub>1 \\<Rightarrow> ty\\<^sub>i' list\" and\n   compTs :: \"ty list \\<Rightarrow> nat hyperset \\<Rightarrow> ty list \\<Rightarrow> expr\\<^sub>1 list \\<Rightarrow> ty\\<^sub>i' list\" where\n\"compT E A ST (new C) = []\"\n| \"compT E A ST (Cast C e) =  \n   compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (Val v) = []\"\n| \"compT E A ST (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2) =\n  (let ST\\<^sub>1 = ty E e\\<^sub>1#ST; A\\<^sub>1 = A \\<squnion> \\<A> e\\<^sub>1 in\n   compT E A ST e\\<^sub>1 @ [after E A ST e\\<^sub>1] @\n   compT E A\\<^sub>1 ST\\<^sub>1 e\\<^sub>2 @ [after E A\\<^sub>1 ST\\<^sub>1 e\\<^sub>2])\"\n| \"compT E A ST (Var i) = []\"\n| \"compT E A ST (i := e) = compT E A ST e @\n   [after E A ST e, ty\\<^sub>i' ST E (A \\<squnion> \\<A> e \\<squnion> \\<lfloor>{i}\\<rfloor>)]\"\n| \"compT E A ST (e\\<bullet>F{D}) = \n   compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2) =\n  (let ST\\<^sub>1 = ty   E e\\<^sub>1#ST; A\\<^sub>1 = A \\<squnion> \\<A> e\\<^sub>1; A\\<^sub>2 = A\\<^sub>1 \\<squnion> \\<A> e\\<^sub>2 in\n   compT E A ST e\\<^sub>1 @ [after E A ST e\\<^sub>1] @\n   compT E A\\<^sub>1 ST\\<^sub>1 e\\<^sub>2 @ [after E A\\<^sub>1 ST\\<^sub>1 e\\<^sub>2] @\n   [ty\\<^sub>i' ST E A\\<^sub>2])\"\n| \"compT E A ST {i:T; e} = compT (E@[T]) (A\\<ominus>i) ST e\"\n| \"compT E A ST (e\\<^sub>1;;e\\<^sub>2) =\n  (let A\\<^sub>1 = A \\<squnion> \\<A> e\\<^sub>1 in\n   compT E A ST e\\<^sub>1 @ [after E A ST e\\<^sub>1, ty\\<^sub>i' ST E A\\<^sub>1] @\n   compT E A\\<^sub>1 ST e\\<^sub>2)\"\n| \"compT E A ST (if (e) e\\<^sub>1 else e\\<^sub>2) =\n   (let A\\<^sub>0 = A \\<squnion> \\<A> e; \\<tau> = ty\\<^sub>i' ST E A\\<^sub>0 in\n    compT E A ST e @ [after E A ST e, \\<tau>] @\n    compT E A\\<^sub>0 ST e\\<^sub>1 @ [after E A\\<^sub>0 ST e\\<^sub>1, \\<tau>] @\n    compT E A\\<^sub>0 ST e\\<^sub>2)\"\n| \"compT E A ST (while (e) c) =\n   (let A\\<^sub>0 = A \\<squnion> \\<A> e;  A\\<^sub>1 = A\\<^sub>0 \\<squnion> \\<A> c; \\<tau> = ty\\<^sub>i' ST E A\\<^sub>0 in\n    compT E A ST e @ [after E A ST e, \\<tau>] @\n    compT E A\\<^sub>0 ST c @ [after E A\\<^sub>0 ST c, ty\\<^sub>i' ST E A\\<^sub>1, ty\\<^sub>i' ST E A\\<^sub>0])\"\n| \"compT E A ST (throw e) = compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (e\\<bullet>M(es)) =\n   compT E A ST e @ [after E A ST e] @\n   compTs E (A \\<squnion> \\<A> e) (ty   E e # ST) es\"\n| \"compT E A ST (try e\\<^sub>1 catch(C i) e\\<^sub>2) =\n   compT E A ST e\\<^sub>1 @ [after E A ST e\\<^sub>1] @\n   [ty\\<^sub>i' (Class C#ST) E A, ty\\<^sub>i' ST (E@[Class C]) (A \\<squnion> \\<lfloor>{i}\\<rfloor>)] @\n   compT (E@[Class C]) (A \\<squnion> \\<lfloor>{i}\\<rfloor>) ST e\\<^sub>2\"\n| \"compTs E A ST [] = []\"\n| \"compTs  E A ST (e#es) = compT E A ST e @ [after E A ST e] @\n                            compTs E (A \\<squnion> (\\<A> e)) (ty E e # ST) es\"\n\ndefinition compT\\<^sub>a :: \"ty list \\<Rightarrow> nat hyperset \\<Rightarrow> ty list \\<Rightarrow> expr\\<^sub>1 \\<Rightarrow> ty\\<^sub>i' list\" where\n  \"compT\\<^sub>a E A ST e = compT E A ST e @ [after E A ST e]\"\n\nend\n\nlemma compE\\<^sub>2_not_Nil[simp]: \"compE\\<^sub>2 e \\<noteq> []\"\n(*<*)by(induct e) auto(*>*)\n\nlemma (in TC1) compT_sizes[simp]:\nshows \"\\<And>E A ST. size(compT E A ST e) = size(compE\\<^sub>2 e) - 1\"\nand \"\\<And>E A ST. size(compTs E A ST es) = size(compEs\\<^sub>2 es)\"\n(*<*)\nby(induct e and es rule: compE\\<^sub>2.induct compEs\\<^sub>2.induct)\n  (auto split:bop.splits nat_diff_split)\n(*>*)\n\n\nlemma (in TC1) [simp]: \"\\<And>ST E. \\<lfloor>\\<tau>\\<rfloor> \\<notin> set (compT E None ST e)\"\nand [simp]: \"\\<And>ST E. \\<lfloor>\\<tau>\\<rfloor> \\<notin> set (compTs E None ST es)\"\n(*<*)by(induct e and es rule: compT.induct compTs.induct) (simp_all add:after_def)(*>*)\n\n\nlemma (in TC0) pair_eq_ty\\<^sub>i'_conv:\n  \"(\\<lfloor>(ST, LT)\\<rfloor> = ty\\<^sub>i' ST\\<^sub>0 E A) =\n  (case A of None \\<Rightarrow> False | Some A \\<Rightarrow> (ST = ST\\<^sub>0 \\<and> LT = ty\\<^sub>l E A))\"\n(*<*)by(simp add:ty\\<^sub>i'_def)(*>*)\n\n\nlemma (in TC0) pair_conv_ty\\<^sub>i':\n  \"\\<lfloor>(ST, ty\\<^sub>l E A)\\<rfloor> = ty\\<^sub>i' ST E \\<lfloor>A\\<rfloor>\"\n(*<*)by(simp add:ty\\<^sub>i'_def)(*>*)\n\n(*<*)\ndeclare (in TC0)\n  ty\\<^sub>i'_antimono [intro!] after_def[simp]\n  pair_conv_ty\\<^sub>i'[simp] pair_eq_ty\\<^sub>i'_conv[simp]\n(*>*)\n\n\nlemma (in TC1) compT_LT_prefix:\n \"\\<And>E A ST\\<^sub>0. \\<lbrakk> \\<lfloor>(ST,LT)\\<rfloor> \\<in> set(compT E A ST\\<^sub>0 e); \\<B> e (size E) \\<rbrakk>\n               \\<Longrightarrow> P \\<turnstile> \\<lfloor>(ST,LT)\\<rfloor> \\<le>' ty\\<^sub>i' ST E A\"\nand\n \"\\<And>E A ST\\<^sub>0. \\<lbrakk> \\<lfloor>(ST,LT)\\<rfloor> \\<in> set(compTs E A ST\\<^sub>0 es); \\<B>s es (size E) \\<rbrakk>\n               \\<Longrightarrow> P \\<turnstile> \\<lfloor>(ST,LT)\\<rfloor> \\<le>' ty\\<^sub>i' ST E A\"\n(*<*)\nproof(induct e and es rule: compT.induct compTs.induct)\n  case FAss thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case BinOp thus ?case\n    by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans split:bop.splits)\nnext\n  case Seq thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case While thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case Cond thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case Block thus ?case\n    by(force simp add:hyperset_defs ty\\<^sub>i'_def simp del:pair_conv_ty\\<^sub>i'\n             elim!:sup_state_opt_trans)\nnext\n  case Call thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case Cons_exp thus ?case\n    by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case TryCatch thus ?case\n    by(fastforce simp:hyperset_defs intro!:(* ty\\<^sub>i'_env_antimono *) ty\\<^sub>i'_incr\n                elim!:sup_state_opt_trans)\nqed (auto simp:hyperset_defs)\n\ndeclare (in TC0)\n  ty\\<^sub>i'_antimono [rule del] after_def[simp del]\n  pair_conv_ty\\<^sub>i'[simp del] pair_eq_ty\\<^sub>i'_conv[simp del]\n(*>*)\n\n\n\n\nlemma (in TC0) after_in_states:\nassumes wf: \"wf_prog p P\" and wt: \"P,E \\<turnstile>\\<^sub>1 e :: T\"\n  and Etypes: \"set E \\<subseteq> types P\" and STtypes: \"set ST \\<subseteq> types P\"\n  and stack: \"size ST + max_stack e \\<le> mxs\"\nshows \"OK (after E A ST e) \\<in> states P mxs mxl\"\n(*<*)\nproof -\n  have \"size ST + 1 \\<le> mxs\" using max_stack1[of e] wt stack\n    by fastforce\n  then show ?thesis using assms\n    by(simp add: after_def ty\\<^sub>i'_def JVM_states_unfold ty\\<^sub>l_in_types)\n      (blast intro!:nlistsI WT\\<^sub>1_is_type)\nqed\n(*>*)\n\n\nlemma (in TC0) OK_ty\\<^sub>i'_in_statesI[simp]:\n  \"\\<lbrakk> set E \\<subseteq> types P; set ST \\<subseteq> types P; size ST \\<le> mxs \\<rbrakk>\n  \\<Longrightarrow> OK (ty\\<^sub>i' ST E A) \\<in> states P mxs mxl\"\n(*<*)\nby(simp add:ty\\<^sub>i'_def JVM_states_unfold ty\\<^sub>l_in_types)\n  (blast intro!:nlistsI)\n(*>*)\n\n\nlemma is_class_type_aux: \"is_class P C \\<Longrightarrow> is_type P (Class C)\"\n(*<*)by(simp)(*>*)\n\n(*<*)\ndeclare is_type_simps[simp del] subsetI[rule del]\n(*>*)\n\ntheorem (in TC1) compT_states:\nassumes wf: \"wf_prog p P\"\nshows \"\\<And>E T A ST.\n  \\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: T; set E \\<subseteq> types P; set ST \\<subseteq> types P;\n    size ST + max_stack e \\<le> mxs; size E + max_vars e \\<le> mxl \\<rbrakk>\n  \\<Longrightarrow> OK ` set(compT E A ST e) \\<subseteq> states P mxs mxl\"\n(*<*)(is \"\\<And>E T A ST. PROP ?P e E T A ST\")(*>*)\n\nand \"\\<And>E Ts A ST.\n  \\<lbrakk> P,E \\<turnstile>\\<^sub>1 es[::]Ts;  set E \\<subseteq> types P; set ST \\<subseteq> types P;\n    size ST + max_stacks es \\<le> mxs; size E + max_varss es \\<le> mxl \\<rbrakk>\n  \\<Longrightarrow> OK ` set(compTs E A ST es) \\<subseteq> states P mxs mxl\"\n(*<*)(is \"\\<And>E Ts A ST. PROP ?Ps es E Ts A ST\")\nproof(induct e and es rule: compT.induct compTs.induct)\n  case new thus ?case by(simp)\nnext\n  case (Cast C e) thus ?case by (auto simp:after_in_states[OF wf])\nnext\n  case Val thus  ?case by(simp)\nnext\n  case Var thus ?case by(simp)\nnext\n  case LAss thus ?case  by(auto simp:after_in_states[OF wf])\nnext\n  case FAcc thus ?case by(auto simp:after_in_states[OF wf])\nnext\n  case FAss thus ?case\n    by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n  case Seq thus ?case\n    by(auto simp:image_Un after_in_states[OF wf])\nnext\n  case BinOp thus ?case\n    by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n  case Cond thus ?case\n    by(force simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n  case While thus ?case\n    by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n  case Block thus ?case by(auto)\nnext\n  case (TryCatch e\\<^sub>1 C i e\\<^sub>2)\n  moreover have \"size ST + 1 \\<le> mxs\" using TryCatch.prems max_stack1[of e\\<^sub>1] by auto\n  ultimately show ?case  \n    by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf]\n                  is_class_type_aux)\nnext\n  case Nil_exp thus ?case by simp\nnext\n  case Cons_exp thus ?case\n    by(auto simp:image_Un  WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n  case throw thus ?case\n    by(auto simp: WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nnext\n  case Call thus ?case\n    by(auto simp:image_Un WT\\<^sub>1_is_type[OF wf] after_in_states[OF wf])\nqed\n\ndeclare is_type_simps[simp] subsetI[intro!]\n(*>*)\n\n\ndefinition shift :: \"nat \\<Rightarrow> ex_table \\<Rightarrow> ex_table\"\nwhere\n  \"shift n xt \\<equiv> map (\\<lambda>(from,to,C,handler,depth). (from+n,to+n,C,handler+n,depth)) xt\"\n\n\n\n\nlemma [simp]: \"shift n [] = []\"\n(*<*)by(simp add:shift_def)(*>*)\n\nlemma [simp]: \"shift n (xt\\<^sub>1 @ xt\\<^sub>2) = shift n xt\\<^sub>1 @ shift n xt\\<^sub>2\"\n(*<*)by(simp add:shift_def)(*>*)\n\nlemma [simp]: \"shift m (shift n xt) = shift (m+n) xt\"\n(*<*)by(induct xt)(auto simp:shift_def)(*>*)\n\nlemma [simp]: \"pcs (shift n xt) = {pc+n|pc. pc \\<in> pcs xt}\"\n(*<*)\nproof -\n  { fix x f t C h d\n    assume \"(f,t,C,h,d) \\<in> set xt\" and \"f + n \\<le> x\"\n      and \"x < t + n\"\n    then have \"\\<exists>pc. x = pc + n \\<and> (\\<exists>x\\<in>set xt. pc \\<in> (case x of (f, t, C, h, d) \\<Rightarrow> {f..<t}))\"\n      by(rule_tac x = \"x-n\" in exI) (force split:nat_diff_split)\n  }\n  then show ?thesis by(auto simp:shift_def pcs_def) fast\nqed\n(*>*)\n\n\nlemma shift_compxE\\<^sub>2:\nshows \"\\<And>pc pc' d. shift pc (compxE\\<^sub>2 e pc' d) = compxE\\<^sub>2 e (pc' + pc) d\"\nand  \"\\<And>pc pc' d. shift pc (compxEs\\<^sub>2 es pc' d) = compxEs\\<^sub>2 es (pc' + pc) d\"\n(*<*)\nby(induct e and es rule: compxE\\<^sub>2.induct compxEs\\<^sub>2.induct)\n  (auto simp:shift_def ac_simps)\n(*>*)\n\n\nlemma compxE\\<^sub>2_size_convs[simp]:\nshows \"n \\<noteq> 0 \\<Longrightarrow> compxE\\<^sub>2 e n d = shift n (compxE\\<^sub>2 e 0 d)\"\nand \"n \\<noteq> 0 \\<Longrightarrow> compxEs\\<^sub>2 es n d = shift n (compxEs\\<^sub>2 es 0 d)\"\n(*<*)by(simp_all add:shift_compxE\\<^sub>2)(*>*)\n\nlocale TC2 = TC1 +\n  fixes T\\<^sub>r :: ty and mxs :: pc\nbegin\n\ndefinition\n  wt_instrs :: \"instr list \\<Rightarrow> ex_table \\<Rightarrow> ty\\<^sub>i' list \\<Rightarrow> bool\"\n    (\"(\\<turnstile> _, _ /[::]/ _)\" [0,0,51] 50) where\n  \"\\<turnstile> is,xt [::] \\<tau>s \\<longleftrightarrow> size is < size \\<tau>s \\<and> pcs xt \\<subseteq> {0..<size is} \\<and>\n  (\\<forall>pc< size is. P,T\\<^sub>r,mxs,size \\<tau>s,xt \\<turnstile> is!pc,pc :: \\<tau>s)\"\n\nend\n\nnotation TC2.wt_instrs (\"(_,_,_ \\<turnstile>/ _, _ /[::]/ _)\" [50,50,50,50,50,51] 50)\n\n(*<*)\nlemmas (in TC2) wt_defs =\n  wt_instrs_def wt_instr_def app_def eff_def norm_eff_def\n(*>*)\n\nlemma (in TC2) [simp]: \"\\<tau>s \\<noteq> [] \\<Longrightarrow> \\<turnstile> [],[] [::] \\<tau>s\"\n(*<*) by (simp add: wt_defs) (*>*)\n\nlemma [simp]: \"eff i P pc et None = []\"\n(*<*)by (simp add: Effect.eff_def)(*>*)\n\n(*<*)\ndeclare split_comp_eq[simp del]\n(*>*)\n\nlemma wt_instr_appR:\n \"\\<lbrakk> P,T,m,mpc,xt \\<turnstile> is!pc,pc :: \\<tau>s;\n    pc < size is; size is < size \\<tau>s; mpc \\<le> size \\<tau>s; mpc \\<le> mpc' \\<rbrakk>\n  \\<Longrightarrow> P,T,m,mpc',xt \\<turnstile> is!pc,pc :: \\<tau>s@\\<tau>s'\"\n(*<*)by (fastforce simp:wt_instr_def app_def)(*>*)\n\n\nlemma relevant_entries_shift [simp]:\n  \"relevant_entries P i (pc+n) (shift n xt) = shift n (relevant_entries P i pc xt)\"\n(*<*)\nproof(induct xt)\n  case Nil\n  then show ?case by (simp add: relevant_entries_def shift_def)\nnext\n  case (Cons a xt)\n  then show ?case \n    by (auto simp add: relevant_entries_def shift_def is_relevant_entry_def)\nqed\n(*>*)\n\n\nlemma [simp]:\n  \"xcpt_eff i P (pc+n) \\<tau> (shift n xt) =\n   map (\\<lambda>(pc,\\<tau>). (pc + n, \\<tau>)) (xcpt_eff i P pc \\<tau> xt)\"\n(*<*)\nproof -\n  obtain ST LT where \"\\<tau> = (ST, LT)\" by(cases \\<tau>) simp\n  then show ?thesis by(simp add: xcpt_eff_def) (auto simp add: shift_def)\nqed\n(*>*)\n\n\nlemma  [simp]:\n  \"app\\<^sub>i (i, P, pc, m, T, \\<tau>) \\<Longrightarrow>\n   eff i P (pc+n) (shift n xt) (Some \\<tau>) =\n   map (\\<lambda>(pc,\\<tau>). (pc+n,\\<tau>)) (eff i P pc xt (Some \\<tau>))\"\n(*<*)by(cases \"i\") (auto simp add:eff_def norm_eff_def)(*>*)\n\n\nlemma [simp]:\n  \"xcpt_app i P (pc+n) mxs (shift n xt) \\<tau> = xcpt_app i P pc mxs xt \\<tau>\"\n(*<*)by (simp add: xcpt_app_def) (auto simp add: shift_def)(*>*)\n\n\nlemma wt_instr_appL:\nassumes \"P,T,m,mpc,xt \\<turnstile> i,pc :: \\<tau>s\" and \"pc < size \\<tau>s\" and \"mpc \\<le> size \\<tau>s\"\nshows \"P,T,m,mpc + size \\<tau>s',shift (size \\<tau>s') xt \\<turnstile> i,pc+size \\<tau>s' :: \\<tau>s'@\\<tau>s\"\n(*<*)\nproof -\n  let ?t = \"(\\<tau>s'@\\<tau>s)!(pc+size \\<tau>s')\"\n  show ?thesis\n  proof(cases ?t)\n    case (Some \\<tau>)\n    obtain ST LT where [simp]: \"\\<tau> = (ST, LT)\" by(cases \\<tau>) simp\n    have \"app\\<^sub>i (i, P, pc + length \\<tau>s', m, T, \\<tau>)\"\n      using Some assms by(cases \"i\") (auto simp:wt_instr_def app_def)\n    moreover {\n      fix pc' \\<tau>' assume \"(pc',\\<tau>') \\<in> set (eff i P pc xt ?t)\"\n      then have \"P \\<turnstile> \\<tau>' \\<le>' \\<tau>s!pc'\" and \"pc' < mpc\"\n        using Some assms by(auto simp:wt_instr_def app_def)\n    }\n    ultimately show ?thesis using Some assms\n      by(fastforce simp:wt_instr_def app_def)\n  qed (auto simp:wt_instr_def app_def)\nqed\n(*>*)\n\n\nlemma wt_instr_Cons:\nassumes wti: \"P,T,m,mpc - 1,[] \\<turnstile> i,pc - 1 :: \\<tau>s\"\n  and pcl: \"0 < pc\" and mpcl: \"0 < mpc\"\n  and pcu: \"pc < size \\<tau>s + 1\" and mpcu: \"mpc \\<le> size \\<tau>s + 1\"\nshows \"P,T,m,mpc,[] \\<turnstile> i,pc :: \\<tau>#\\<tau>s\"\n(*<*)\nproof -\n  have \"pc - 1 < length \\<tau>s\" using pcl pcu by arith\n  moreover have \"mpc - 1 \\<le> length \\<tau>s\" using mpcl mpcu by arith\n  ultimately have\n    \"P,T,m,mpc - 1 + length [\\<tau>],shift (length [\\<tau>]) [] \\<turnstile> i,pc - 1 + length [\\<tau>] :: [\\<tau>] @ \\<tau>s\"\n    by(rule wt_instr_appL[where \\<tau>s' = \"[\\<tau>]\", OF wti])\n  then show ?thesis using pcl mpcl by (simp split:nat_diff_split_asm)\nqed\n(*>*)\n\n\nlemma wt_instr_append:\nassumes wti: \"P,T,m,mpc - size \\<tau>s',[] \\<turnstile> i,pc - size \\<tau>s' :: \\<tau>s\"\n  and pcl: \"size \\<tau>s' \\<le> pc\" and mpcl: \"size \\<tau>s' \\<le> mpc\"\n  and pcu: \"pc < size \\<tau>s + size \\<tau>s'\" and mpcu: \"mpc \\<le> size \\<tau>s + size \\<tau>s'\"\nshows \"P,T,m,mpc,[] \\<turnstile> i,pc :: \\<tau>s'@\\<tau>s\"\n(*<*)\nproof -\n  have \"pc - length \\<tau>s' < length \\<tau>s\" using pcl pcu by arith\n  moreover have \"mpc - length \\<tau>s' \\<le> length \\<tau>s\" using mpcl mpcu by arith\nthm wt_instr_appL[where \\<tau>s' = \"\\<tau>s'\", OF wti]\n  ultimately have \"P,T,m,mpc - length \\<tau>s' + length \\<tau>s',shift (length \\<tau>s') []\n                     \\<turnstile> i,pc - length \\<tau>s' + length \\<tau>s' :: \\<tau>s' @ \\<tau>s\"\n    by(rule wt_instr_appL[where \\<tau>s' = \"\\<tau>s'\", OF wti])\n  then show ?thesis using pcl mpcl by (simp split:nat_diff_split_asm)\nqed\n(*>*)\n\n\nlemma xcpt_app_pcs:\n  \"pc \\<notin> pcs xt \\<Longrightarrow> xcpt_app i P pc mxs xt \\<tau>\"\n(*<*)\nby (auto simp add: xcpt_app_def relevant_entries_def is_relevant_entry_def pcs_def)\n(*>*)\n\n\nlemma xcpt_eff_pcs:\n  \"pc \\<notin> pcs xt \\<Longrightarrow> xcpt_eff i P pc \\<tau> xt = []\"\n(*<*)\nby (cases \\<tau>)\n   (auto simp add: is_relevant_entry_def xcpt_eff_def relevant_entries_def pcs_def\n           intro!: filter_False)\n(*>*)\n\n\nlemma pcs_shift:\n  \"pc < n \\<Longrightarrow> pc \\<notin> pcs (shift n xt)\" \n(*<*)by (auto simp add: shift_def pcs_def)(*>*)\n\n\nlemma wt_instr_appRx:\n  \"\\<lbrakk> P,T,m,mpc,xt \\<turnstile> is!pc,pc :: \\<tau>s; pc < size is; size is < size \\<tau>s; mpc \\<le> size \\<tau>s \\<rbrakk>\n  \\<Longrightarrow> P,T,m,mpc,xt @ shift (size is) xt' \\<turnstile> is!pc,pc :: \\<tau>s\"\n(*<*)by (auto simp:wt_instr_def eff_def app_def xcpt_app_pcs xcpt_eff_pcs)(*>*)\n\n\nlemma wt_instr_appLx: \n  \"\\<lbrakk> P,T,m,mpc,xt \\<turnstile> i,pc :: \\<tau>s; pc \\<notin> pcs xt' \\<rbrakk>\n  \\<Longrightarrow> P,T,m,mpc,xt'@xt \\<turnstile> i,pc :: \\<tau>s\"\n(*<*)by (auto simp:wt_instr_def app_def eff_def xcpt_app_pcs xcpt_eff_pcs)(*>*)\n\n\nlemma (in TC2) wt_instrs_extR:\n  \"\\<turnstile> is,xt [::] \\<tau>s \\<Longrightarrow> \\<turnstile> is,xt [::] \\<tau>s @ \\<tau>s'\"\n(*<*)by(auto simp add:wt_instrs_def wt_instr_appR)(*>*)\n\n\nlemma (in TC2) wt_instrs_ext:\nassumes wt\\<^sub>1: \"\\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2\" and wt\\<^sub>2: \"\\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>s\\<^sub>2\"\n  and \\<tau>s_size: \"size \\<tau>s\\<^sub>1 = size is\\<^sub>1\"\n shows \"\\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2\"\n(*<*)\nproof -\n  let ?is = \"is\\<^sub>1@is\\<^sub>2\" and ?xt = \"xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2\"\n    and ?\\<tau>s = \"\\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2\"\n  have \"size ?is < size ?\\<tau>s\" using wt\\<^sub>2 \\<tau>s_size by(fastforce simp:wt_instrs_def)\n  moreover have \"pcs ?xt \\<subseteq> {0..<size ?is}\" using wt\\<^sub>1 wt\\<^sub>2\n    by(fastforce simp:wt_instrs_def)\n  moreover {\n    fix pc assume pc: \"pc<size ?is\"\n    have \"P,T\\<^sub>r,mxs,size ?\\<tau>s,?xt \\<turnstile> ?is!pc,pc :: ?\\<tau>s\"\n    proof(cases \"pc < length is\\<^sub>1\")\n      case True then show ?thesis using wt\\<^sub>1 pc\n        by(fastforce simp: wt_instrs_def wt_instr_appRx)\n    next\n      case False\n      then have \"pc - length is\\<^sub>1 < length is\\<^sub>2\" using pc by fastforce\n      then have \"P,T\\<^sub>r,mxs,length \\<tau>s\\<^sub>2,xt\\<^sub>2 \\<turnstile> is\\<^sub>2 ! (pc - length is\\<^sub>1),pc - length is\\<^sub>1 :: \\<tau>s\\<^sub>2\"\n        using wt\\<^sub>2 by(clarsimp simp: wt_instrs_def)\n      moreover have \"pc - length is\\<^sub>1 < length \\<tau>s\\<^sub>2\" using pc wt\\<^sub>2\n        by(clarsimp simp: wt_instrs_def) arith\n      moreover have \"length \\<tau>s\\<^sub>2 \\<le> length \\<tau>s\\<^sub>2\" by simp\n      moreover have \"pc - length is\\<^sub>1 + length \\<tau>s\\<^sub>1 \\<notin> pcs xt\\<^sub>1\" using wt\\<^sub>1 \\<tau>s_size\n        by(fastforce simp: wt_instrs_def)\n      ultimately have \"P,T\\<^sub>r,mxs,length \\<tau>s\\<^sub>2 + length \\<tau>s\\<^sub>1,xt\\<^sub>1 @ shift (length \\<tau>s\\<^sub>1) xt\\<^sub>2\n                         \\<turnstile> is\\<^sub>2 ! (pc - length is\\<^sub>1),pc - length is\\<^sub>1 + length \\<tau>s\\<^sub>1 :: \\<tau>s\\<^sub>1 @ \\<tau>s\\<^sub>2\"\n        by(rule wt_instr_appLx[OF wt_instr_appL[where \\<tau>s' = \"\\<tau>s\\<^sub>1\"]])\n      then show ?thesis using False \\<tau>s_size by(simp add:add.commute)\n    qed\n  }\n  ultimately show ?thesis by(clarsimp simp:wt_instrs_def)\nqed\n(*>*)\n\ncorollary (in TC2) wt_instrs_ext2:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>s\\<^sub>2; \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2; size \\<tau>s\\<^sub>1 = size is\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2\"\n(*<*)by(rule wt_instrs_ext)(*>*)\n\n\ncorollary (in TC2) wt_instrs_ext_prefix [trans]:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2; \\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>s\\<^sub>3;\n     size \\<tau>s\\<^sub>1 = size is\\<^sub>1; prefix \\<tau>s\\<^sub>3 \\<tau>s\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2\"\n(*<*)by(bestsimp simp:prefix_def elim: wt_instrs_ext dest:wt_instrs_extR)(*>*)\n\n\ncorollary (in TC2) wt_instrs_app:\n  assumes is\\<^sub>1: \"\\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1@[\\<tau>]\"\n  assumes is\\<^sub>2: \"\\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>#\\<tau>s\\<^sub>2\"\n  assumes s: \"size \\<tau>s\\<^sub>1 = size is\\<^sub>1\"\n  shows \"\\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1@shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>s\\<^sub>1@\\<tau>#\\<tau>s\\<^sub>2\"\n(*<*)\nproof -\n  from is\\<^sub>1 have \"\\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] (\\<tau>s\\<^sub>1@[\\<tau>])@\\<tau>s\\<^sub>2\"\n    by (rule wt_instrs_extR)\n  hence \"\\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1@\\<tau>#\\<tau>s\\<^sub>2\" by simp\n  from this is\\<^sub>2 s show ?thesis by (rule wt_instrs_ext) \nqed\n(*>*)\n\n\ncorollary (in TC2) wt_instrs_app_last[trans]:\nassumes \"\\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>#\\<tau>s\\<^sub>2\" \"\\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1\"\n  \"last \\<tau>s\\<^sub>1 = \\<tau>\" \"size \\<tau>s\\<^sub>1 = size is\\<^sub>1+1\"\nshows \"\\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1@shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2\"\n(*<*)\nusing assms proof(cases \\<tau>s\\<^sub>1 rule:rev_cases)\n  case (snoc ys y)\n  then show ?thesis using assms by(simp add:wt_instrs_app)\nqed simp\n(*>*)\n\n\ncorollary (in TC2) wt_instrs_append_last[trans]:\nassumes wtis: \"\\<turnstile> is,xt [::] \\<tau>s\" and wti: \"P,T\\<^sub>r,mxs,mpc,[] \\<turnstile> i,pc :: \\<tau>s\"\n  and pc: \"pc = size is\" and mpc: \"mpc = size \\<tau>s\" and is_\\<tau>s: \"size is + 1 < size \\<tau>s\"\nshows \"\\<turnstile> is@[i],xt [::] \\<tau>s\"\n(*<*)\nproof -\n  have pc_xt: \"pc \\<notin> pcs xt\" using wtis pc by (fastforce simp:wt_instrs_def)\n  have \"pcs xt \\<subseteq> {..<Suc (length is)}\" using wtis by (fastforce simp:wt_instrs_def)\n  moreover {\n    fix pc' assume pc': \"\\<not> pc' < length is\" \"pc' < Suc (length is)\"\n    have \"P,T\\<^sub>r,mxs,length \\<tau>s,xt \\<turnstile> i,pc' :: \\<tau>s\"\n      using wt_instr_appLx[where xt = \"[]\",simplified,OF wti pc_xt]\n            less_antisym[OF pc'] pc mpc by simp\n  }\n  ultimately show ?thesis using wtis is_\\<tau>s by(clarsimp simp add:wt_instrs_def)\nqed\n(*>*)\n\n\ncorollary (in TC2) wt_instrs_app2:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>'#\\<tau>s\\<^sub>2;  \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>#\\<tau>s\\<^sub>1@[\\<tau>'];\n     xt' = xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2;  size \\<tau>s\\<^sub>1+1 = size is\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is\\<^sub>1@is\\<^sub>2,xt' [::] \\<tau>#\\<tau>s\\<^sub>1@\\<tau>'#\\<tau>s\\<^sub>2\"\n(*<*)using wt_instrs_app[where ?\\<tau>s\\<^sub>1.0 = \"\\<tau> # \\<tau>s\\<^sub>1\"] by simp (*>*)\n\n\ncorollary (in TC2) wt_instrs_app2_simp[trans,simp]:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>'#\\<tau>s\\<^sub>2;  \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>#\\<tau>s\\<^sub>1@[\\<tau>']; size \\<tau>s\\<^sub>1+1 = size is\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1@shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>#\\<tau>s\\<^sub>1@\\<tau>'#\\<tau>s\\<^sub>2\"\n(*<*)using wt_instrs_app[where ?\\<tau>s\\<^sub>1.0 = \"\\<tau> # \\<tau>s\\<^sub>1\"] by simp(*>*)\n\n\ncorollary (in TC2) wt_instrs_Cons[simp]:\n  \"\\<lbrakk> \\<tau>s \\<noteq> []; \\<turnstile> [i],[] [::] [\\<tau>,\\<tau>']; \\<turnstile> is,xt [::] \\<tau>'#\\<tau>s \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> i#is,shift 1 xt [::] \\<tau>#\\<tau>'#\\<tau>s\"\n(*<*)\nusing wt_instrs_app2[where ?is\\<^sub>1.0 = \"[i]\" and ?\\<tau>s\\<^sub>1.0 = \"[]\" and ?is\\<^sub>2.0 = \"is\"\n                      and ?xt\\<^sub>1.0 = \"[]\"]\nby simp\n\n\ncorollary (in TC2) wt_instrs_Cons2[trans]:\n  assumes \\<tau>s: \"\\<turnstile> is,xt [::] \\<tau>s\"\n  assumes i: \"P,T\\<^sub>r,mxs,mpc,[] \\<turnstile> i,0 :: \\<tau>#\\<tau>s\"\n  assumes mpc: \"mpc = size \\<tau>s + 1\"\n  shows \"\\<turnstile> i#is,shift 1 xt [::] \\<tau>#\\<tau>s\"\n(*<*)\nproof -\n  from \\<tau>s have \"\\<tau>s \\<noteq> []\" by (auto simp: wt_instrs_def)\n  with mpc i have \"\\<turnstile> [i],[] [::] [\\<tau>]@\\<tau>s\" by (simp add: wt_instrs_def)\n  with \\<tau>s show ?thesis by (fastforce dest: wt_instrs_ext)\nqed\n(*>*)\n\n\nlemma (in TC2) wt_instrs_last_incr[trans]:\nassumes wtis: \"\\<turnstile> is,xt [::] \\<tau>s@[\\<tau>]\" and ss: \"P \\<turnstile> \\<tau> \\<le>' \\<tau>'\"\nshows \"\\<turnstile> is,xt [::] \\<tau>s@[\\<tau>']\"\n(*<*)\nproof -\n  let ?\\<tau>s = \"\\<tau>s@[\\<tau>]\" and ?\\<tau>s' = \"\\<tau>s@[\\<tau>']\"\n  { fix pc assume pc: \"pc< size is\"\n    let ?i = \"is!pc\"\n    have app_pc: \"app (is ! pc) P mxs T\\<^sub>r pc (length ?\\<tau>s) xt (\\<tau>s ! pc)\"\n      using wtis pc by(clarsimp simp add:wt_instrs_def wt_instr_def)\n    then have Apc\\<tau>': \"\\<And>pc' \\<tau>'. (pc',\\<tau>') \\<in> set (eff ?i P pc xt (?\\<tau>s!pc))\n     \\<Longrightarrow> pc' < length ?\\<tau>s\"\n      using wtis pc by(fastforce simp add:wt_instrs_def app_def)\n    have Aepc\\<tau>': \"\\<And>pc' \\<tau>'. (pc',\\<tau>') \\<in> set (eff ?i P pc xt (?\\<tau>s!pc))\n     \\<Longrightarrow> P \\<turnstile> \\<tau>' \\<le>' ?\\<tau>s!pc'\"\n      using wtis pc by(fastforce simp add:wt_instrs_def wt_instr_def)\n    { fix pc1 \\<tau>1 assume pc\\<tau>1: \"(pc1,\\<tau>1) \\<in> set (eff ?i P pc xt (?\\<tau>s'!pc))\"\n      then have epc\\<tau>': \"(pc1,\\<tau>1) \\<in> set (eff ?i P pc xt (?\\<tau>s!pc))\"\n          using wtis pc by(simp add:wt_instrs_def)\n      have \"P \\<turnstile> \\<tau>1 \\<le>' ?\\<tau>s'!pc1\"\n      proof(cases \"pc1 < length \\<tau>s\")\n        case True\n        then show ?thesis using wtis pc pc\\<tau>1\n          by(fastforce simp add:wt_instrs_def wt_instr_def)\n      next\n        case False\n        then have \"pc1 < length ?\\<tau>s\" using Apc\\<tau>'[OF epc\\<tau>'] by simp\n        then have [simp]: \"pc1 = size \\<tau>s\" using False by clarsimp\n        have \"P \\<turnstile> \\<tau>1 \\<le>' \\<tau>\" using Aepc\\<tau>'[OF epc\\<tau>'] by simp\n        then have \"P \\<turnstile> \\<tau>1 \\<le>' \\<tau>'\" by(rule sup_state_opt_trans[OF _ ss])\n        then show ?thesis by simp\n      qed\n    }\n    then have \"P,T\\<^sub>r,mxs,size ?\\<tau>s',xt \\<turnstile> is!pc,pc :: ?\\<tau>s'\" using wtis pc\n      by(clarsimp simp add:wt_instrs_def wt_instr_def)\n  }\n  then show ?thesis using wtis by(simp add:wt_instrs_def)\nqed\n(*>*)\n\n\nlemma [iff]: \"xcpt_app i P pc mxs [] \\<tau>\"\n(*<*)by (simp add: xcpt_app_def relevant_entries_def)(*>*)\n\n\nlemma [simp]: \"xcpt_eff i P pc \\<tau> [] = []\"\n(*<*)by (simp add: xcpt_eff_def relevant_entries_def)(*>*)\n\n\nlemma (in TC2) wt_New:\n  \"\\<lbrakk> is_class P C; size ST < mxs \\<rbrakk> \\<Longrightarrow>\n   \\<turnstile> [New C],[] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (Class C#ST) E A]\"\n(*<*)by(simp add:wt_defs ty\\<^sub>i'_def)(*>*)\n\n\nlemma (in TC2) wt_Cast:\n  \"is_class P C \\<Longrightarrow>\n   \\<turnstile> [Checkcast C],[] [::] [ty\\<^sub>i' (Class D # ST) E A, ty\\<^sub>i' (Class C # ST) E A]\"\n(*<*)by(simp add: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_Push:\n  \"\\<lbrakk> size ST < mxs; typeof v = Some T \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> [Push v],[] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (T#ST) E A]\"\n(*<*)by(simp add: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_Pop:\n \"\\<turnstile> [Pop],[] [::] (ty\\<^sub>i' (T#ST) E A # ty\\<^sub>i' ST E A # \\<tau>s)\"\n(*<*)by(simp add: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_CmpEq:\n  \"\\<lbrakk> P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1\\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> [CmpEq],[] [::] [ty\\<^sub>i' (T\\<^sub>2 # T\\<^sub>1 # ST) E A, ty\\<^sub>i' (Boolean # ST) E A]\"\n(*<*) by(auto simp:ty\\<^sub>i'_def wt_defs elim!: refTE not_refTE) (*>*)\n\n\nlemma (in TC2) wt_IAdd:\n  \"\\<turnstile> [IAdd],[] [::] [ty\\<^sub>i' (Integer#Integer#ST) E A, ty\\<^sub>i' (Integer#ST) E A]\"\n(*<*)by(simp add:ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_Load:\n  \"\\<lbrakk> size ST < mxs; size E \\<le> mxl; i \\<in>\\<in> A; i < size E \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> [Load i],[] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (E!i # ST) E A]\"\n(*<*)by(auto simp add:ty\\<^sub>i'_def wt_defs ty\\<^sub>l_def hyperset_defs)(*>*)\n\n\nlemma (in TC2) wt_Store:\n \"\\<lbrakk> P \\<turnstile> T \\<le> E!i; i < size E; size E \\<le> mxl \\<rbrakk> \\<Longrightarrow>\n  \\<turnstile> [Store i],[] [::] [ty\\<^sub>i' (T#ST) E A, ty\\<^sub>i' ST E (\\<lfloor>{i}\\<rfloor> \\<squnion> A)]\"\n(*<*)\nby(auto simp:hyperset_defs nth_list_update ty\\<^sub>i'_def wt_defs ty\\<^sub>l_def\n        intro:list_all2_all_nthI)\n(*>*)\n\n\nlemma (in TC2) wt_Get:\n \"\\<lbrakk> P \\<turnstile> C sees F:T in D \\<rbrakk> \\<Longrightarrow>\n  \\<turnstile> [Getfield F D],[] [::] [ty\\<^sub>i' (Class C # ST) E A, ty\\<^sub>i' (T # ST) E A]\"\n(*<*)by(auto simp: ty\\<^sub>i'_def wt_defs dest: sees_field_idemp sees_field_decl_above)(*>*)\n\n\nlemma (in TC2) wt_Put:\n  \"\\<lbrakk> P \\<turnstile> C sees F:T in D; P \\<turnstile> T' \\<le> T \\<rbrakk> \\<Longrightarrow>\n  \\<turnstile> [Putfield F D],[] [::] [ty\\<^sub>i' (T' # Class C # ST) E A, ty\\<^sub>i' ST E A]\"\n(*<*)by(auto intro: sees_field_idemp sees_field_decl_above simp: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_Throw:\n  \"\\<turnstile> [Throw],[] [::] [ty\\<^sub>i' (Class C # ST) E A, \\<tau>']\"\n(*<*)by(auto simp: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\nlemma (in TC2) wt_IfFalse:\n  \"\\<lbrakk> 2 \\<le> i; nat i < size \\<tau>s + 2; P \\<turnstile> ty\\<^sub>i' ST E A \\<le>' \\<tau>s ! nat(i - 2) \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> [IfFalse i],[] [::] ty\\<^sub>i' (Boolean # ST) E A # ty\\<^sub>i' ST E A # \\<tau>s\"\n(*<*)\nby(simp add: ty\\<^sub>i'_def wt_defs eval_nat_numeral nat_diff_distrib)\n(*>*)\n\n\nlemma wt_Goto:\n \"\\<lbrakk> 0 \\<le> int pc + i; nat (int pc + i) < size \\<tau>s; size \\<tau>s \\<le> mpc;\n    P \\<turnstile> \\<tau>s!pc \\<le>' \\<tau>s ! nat (int pc + i) \\<rbrakk>\n \\<Longrightarrow> P,T,mxs,mpc,[] \\<turnstile> Goto i,pc :: \\<tau>s\"\n(*<*)by(clarsimp simp add: TC2.wt_defs)(*>*)\n\n\nlemma (in TC2) wt_Invoke:\n  \"\\<lbrakk> size es = size Ts'; P \\<turnstile> C sees M: Ts\\<rightarrow>T = m in D; P \\<turnstile> Ts' [\\<le>] Ts \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> [Invoke M (size es)],[] [::] [ty\\<^sub>i' (rev Ts' @ Class C # ST) E A, ty\\<^sub>i' (T#ST) E A]\"\n(*<*)by(fastforce simp add: ty\\<^sub>i'_def wt_defs)(*>*)\n\n\ncorollary (in TC2) wt_instrs_app3[simp]:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>2,[] [::] (\\<tau>' # \\<tau>s\\<^sub>2);  \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau> # \\<tau>s\\<^sub>1 @ [\\<tau>']; size \\<tau>s\\<^sub>1+1 = size is\\<^sub>1\\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> (is\\<^sub>1 @ is\\<^sub>2),xt\\<^sub>1 [::] \\<tau> # \\<tau>s\\<^sub>1 @ \\<tau>' # \\<tau>s\\<^sub>2\"\n(*<*)using wt_instrs_app2[where ?xt\\<^sub>2.0 = \"[]\"] by (simp add:shift_def)(*>*)\n\n\ncorollary (in TC2) wt_instrs_Cons3[simp]:\n  \"\\<lbrakk> \\<tau>s \\<noteq> []; \\<turnstile> [i],[] [::] [\\<tau>,\\<tau>']; \\<turnstile> is,[] [::] \\<tau>'#\\<tau>s \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> (i # is),[] [::] \\<tau> # \\<tau>' # \\<tau>s\"\n(*<*)\nusing wt_instrs_Cons[where ?xt = \"[]\"]\nby (simp add:shift_def)\n\n(*<*)\ndeclare nth_append[simp del]\ndeclare [[simproc del: list_to_set_comprehension]]\n(*>*)\n\nlemma (in TC2) wt_instrs_xapp[trans]:\nassumes wtis: \"\\<turnstile> is\\<^sub>1 @ is\\<^sub>2, xt [::] \\<tau>s\\<^sub>1 @ ty\\<^sub>i' (Class C # ST) E A # \\<tau>s\\<^sub>2\"\n  and P_\\<tau>s\\<^sub>1: \"\\<forall>\\<tau> \\<in> set \\<tau>s\\<^sub>1. \\<forall>ST' LT'. \\<tau> = Some(ST',LT') \\<longrightarrow> \n    size ST \\<le> size ST' \\<and> P \\<turnstile> Some (drop (size ST' - size ST) ST',LT') \\<le>' ty\\<^sub>i' ST E A\"\n  and is_\\<tau>s: \"size is\\<^sub>1 = size \\<tau>s\\<^sub>1\" and PC: \"is_class P C\" and ST_mxs: \"size ST < mxs\"\nshows \"\\<turnstile> is\\<^sub>1 @ is\\<^sub>2, xt @ [(0,size is\\<^sub>1 - 1,C,size is\\<^sub>1,size ST)] [::] \\<tau>s\\<^sub>1 @ ty\\<^sub>i' (Class C # ST) E A # \\<tau>s\\<^sub>2\"\n(*<*)(is \"\\<turnstile> ?is, xt@[?xte] [::] ?\\<tau>s\" is \"\\<turnstile> ?is, ?xt' [::] ?\\<tau>s\")\nproof -\n  let ?is = \"is\\<^sub>1 @ is\\<^sub>2\" and ?\\<tau>s = \"\\<tau>s\\<^sub>1 @ ty\\<^sub>i' (Class C # ST) E A # \\<tau>s\\<^sub>2\"\n  let ?xte = \"(0,size is\\<^sub>1 - 1,C,size is\\<^sub>1,size ST)\"\n  let ?xt' = \"xt @ [?xte]\"\n  have P_\\<tau>s\\<^sub>1': \"\\<And>\\<tau>. \\<tau> \\<in> set \\<tau>s\\<^sub>1 \\<Longrightarrow> (\\<forall>ST' LT'. \\<tau> = Some(ST',LT') \\<longrightarrow>\n     size ST \\<le> size ST' \\<and> P \\<turnstile> Some (drop (size ST' - size ST) ST',LT') \\<le>' ty\\<^sub>i' ST E A)\"\n    using P_\\<tau>s\\<^sub>1 by fast\n  have \"size ?is < size ?\\<tau>s\" and \"pcs ?xt' \\<subseteq> {0..<size ?is}\"\n    and P_pc: \"\\<And>pc. pc< size ?is \\<Longrightarrow> P,T\\<^sub>r,mxs,size ?\\<tau>s,xt \\<turnstile> ?is!pc,pc :: ?\\<tau>s\"\n    using wtis by(simp_all add:wt_instrs_def)\n  moreover {\n    fix pc let ?mpc = \"size ?\\<tau>s\" and ?i = \"?is!pc\" and ?t = \"?\\<tau>s!pc\"\n    assume \"pc< size ?is\"\n    then have wti: \"P,T\\<^sub>r,mxs,?mpc,xt \\<turnstile> ?i,pc :: ?\\<tau>s\" by(rule P_pc)\n    then have app: \"app ?i P mxs T\\<^sub>r pc ?mpc xt ?t\"\n       and eff_ss: \"\\<And>pc' \\<tau>'. (pc',\\<tau>') \\<in> set (eff ?i P pc xt (?\\<tau>s!pc))\n                           \\<Longrightarrow> P \\<turnstile> \\<tau>' \\<le>' ?\\<tau>s!pc'\"\n      by(fastforce simp add: wt_instr_def)+\n    have \"app ?i P mxs T\\<^sub>r pc ?mpc ?xt' ?t\n             \\<and> (\\<forall>(pc',\\<tau>') \\<in> set (eff ?i P pc ?xt' ?t). P \\<turnstile> \\<tau>' \\<le>' ?\\<tau>s!pc')\"\n    proof (cases ?t)\n      case (Some \\<tau>)\n      obtain ST' LT' where \\<tau>: \"\\<tau> = (ST', LT')\" by(cases \\<tau>) simp\n      have app\\<^sub>i: \"app\\<^sub>i (?i,P,pc,mxs,T\\<^sub>r,\\<tau>)\" and xcpt_app: \"xcpt_app ?i P pc mxs xt \\<tau>\"\n         and eff_pc: \"\\<And>pc' \\<tau>'. (pc',\\<tau>') \\<in> set (eff ?i P pc xt ?t) \\<Longrightarrow> pc' < ?mpc\"\n        using Some app by(fastforce simp add: app_def)+\n      have \"xcpt_app ?i P pc mxs ?xt' \\<tau>\"\n      proof(cases \"pc < length \\<tau>s\\<^sub>1 - 1\")\n        case False then show ?thesis using Some \\<tau> is_\\<tau>s xcpt_app\n          by (clarsimp simp: xcpt_app_def relevant_entries_def\n                             is_relevant_entry_def)\n      next\n        case True\n        then have True': \"pc < length \\<tau>s\\<^sub>1\" by simp\n        then have \"\\<tau>s\\<^sub>1 ! pc = ?t\" by(fastforce simp: nth_append)\n        moreover have \\<tau>s\\<^sub>1_pc: \"\\<tau>s\\<^sub>1 ! pc \\<in> set \\<tau>s\\<^sub>1\" by(rule nth_mem[OF True'])\n        ultimately show ?thesis\n         using Some \\<tau> PC ST_mxs xcpt_app P_\\<tau>s\\<^sub>1'[OF \\<tau>s\\<^sub>1_pc]\n          by (simp add: xcpt_app_def relevant_entries_def)\n      qed\n      moreover {\n        fix pc' \\<tau>' assume efft: \"(pc',\\<tau>') \\<in> set (eff ?i P pc ?xt' ?t)\"\n        have \"pc' < ?mpc \\<and> P \\<turnstile> \\<tau>' \\<le>' ?\\<tau>s!pc'\" (is \"?P1 \\<and> ?P2\")\n        proof(cases \"(pc',\\<tau>') \\<in> set (eff ?i P pc xt ?t)\")\n          case True\n          have ?P1 using True by(rule eff_pc)\n          moreover have ?P2 using True by(rule eff_ss)\n          ultimately show ?thesis by simp\n        next\n          case False\n          then have xte: \"(pc',\\<tau>') \\<in> set (xcpt_eff ?i P pc \\<tau> [?xte])\"\n            using efft Some by(clarsimp simp: eff_def)\n          then have ?P1 using Some \\<tau> is_\\<tau>s\n            by(clarsimp simp: xcpt_eff_def relevant_entries_def split: if_split_asm)\n          moreover have ?P2\n          proof(cases \"pc < length \\<tau>s\\<^sub>1 - 1\")\n            case False': False\n            then show ?thesis using False Some \\<tau> xte is_\\<tau>s\n              by(simp add: xcpt_eff_def relevant_entries_def is_relevant_entry_def)\n          next\n            case True\n            then have True': \"pc < length \\<tau>s\\<^sub>1\" by simp\n            have \\<tau>s\\<^sub>1_pc: \"\\<tau>s\\<^sub>1 ! pc \\<in> set \\<tau>s\\<^sub>1\" by(rule nth_mem[OF True'])\n            have \"P \\<turnstile> \\<lfloor>(Class C # drop (length ST' - length ST) ST', LT')\\<rfloor>\n                         \\<le>' ty\\<^sub>i' (Class C # ST) E A\"\n               using True' Some \\<tau> P_\\<tau>s\\<^sub>1'[OF \\<tau>s\\<^sub>1_pc]\n              by (fastforce simp: nth_append ty\\<^sub>i'_def)\n            then show ?thesis using \\<tau> xte is_\\<tau>s\n              by(simp add: xcpt_eff_def relevant_entries_def split: if_split_asm)\n          qed\n          ultimately show ?thesis by simp\n        qed\n      }\n      ultimately show ?thesis using Some app\\<^sub>i by(fastforce simp add: app_def)\n    qed simp\n    then have \"P,T\\<^sub>r,mxs,size ?\\<tau>s,?xt' \\<turnstile> ?is!pc,pc :: ?\\<tau>s\"\n      by(simp add: wt_instr_def)\n  }\n  ultimately show ?thesis by(simp add:wt_instrs_def)\nqed\n\ndeclare [[simproc add: list_to_set_comprehension]]\ndeclare nth_append[simp]\n(*>*)\n\nlemma drop_Cons_Suc:\n  \"\\<And>xs. drop n xs = y#ys \\<Longrightarrow> drop (Suc n) xs = ys\"\nproof(induct n)\n  case (Suc n) then show ?case by(simp add: drop_Suc)\nqed simp\n\nlemma drop_mess:\nassumes \"Suc (length xs\\<^sub>0) \\<le> length xs\"\n  and \"drop (length xs - Suc (length xs\\<^sub>0)) xs = x # xs\\<^sub>0\"\nshows \"drop (length xs - length xs\\<^sub>0) xs = xs\\<^sub>0\"\nusing assms proof(cases xs)\n  case (Cons a list) then show ?thesis using assms\n  proof(cases \"length list - length xs\\<^sub>0\")\n    case Suc then show ?thesis using Cons assms\n      by (simp add: Suc_diff_le drop_Cons_Suc)\n  qed simp\nqed simp\n\n(*<*)\ndeclare (in TC0)\n  after_def[simp] pair_eq_ty\\<^sub>i'_conv[simp]\n(*>*)\n\nlemma (in TC1) compT_ST_prefix:\n \"\\<And>E A ST\\<^sub>0. \\<lfloor>(ST,LT)\\<rfloor> \\<in> set(compT E A ST\\<^sub>0 e) \\<Longrightarrow> \n  size ST\\<^sub>0 \\<le> size ST \\<and> drop (size ST - size ST\\<^sub>0) ST = ST\\<^sub>0\"\nand\n \"\\<And>E A ST\\<^sub>0. \\<lfloor>(ST,LT)\\<rfloor> \\<in> set(compTs E A ST\\<^sub>0 es) \\<Longrightarrow> \n  size ST\\<^sub>0 \\<le> size ST \\<and> drop (size ST - size ST\\<^sub>0) ST = ST\\<^sub>0\"\n(*<*)\nproof(induct e and es rule: compT.induct compTs.induct)\n  case (FAss e\\<^sub>1 F D e\\<^sub>2)\n  moreover {\n    let ?ST\\<^sub>0 = \"ty E e\\<^sub>1 # ST\\<^sub>0\"\n    fix A assume \"\\<lfloor>(ST, LT)\\<rfloor> \\<in> set (compT E A ?ST\\<^sub>0 e\\<^sub>2)\"\n    with FAss\n    have \"length ?ST\\<^sub>0 \\<le> length ST \\<and> drop (size ST - size ?ST\\<^sub>0) ST = ?ST\\<^sub>0\" by blast\n    hence ?case  by (clarsimp simp add: drop_mess)\n  }\n  ultimately show ?case by auto\nnext\n  case TryCatch thus ?case by auto\nnext\n  case Block thus ?case by auto\nnext\n  case Seq thus ?case by auto\nnext\n  case While thus ?case by auto\nnext\n  case Cond thus ?case by auto\nnext\n  case (Call e M es)\n  moreover {\n    let ?ST\\<^sub>0 = \"ty E e # ST\\<^sub>0\"\n    fix A assume \"\\<lfloor>(ST, LT)\\<rfloor> \\<in> set (compTs E A ?ST\\<^sub>0 es)\"\n    with Call\n    have \"length ?ST\\<^sub>0 \\<le> length ST \\<and> drop (size ST - size ?ST\\<^sub>0) ST = ?ST\\<^sub>0\" by blast\n    hence ?case  by (clarsimp simp add: drop_mess)\n  }\n  ultimately show ?case by auto\nnext\n  case (Cons_exp e es)\n  moreover {\n    let ?ST\\<^sub>0 = \"ty E e # ST\\<^sub>0\"\n    fix A assume \"\\<lfloor>(ST, LT)\\<rfloor> \\<in> set (compTs E A ?ST\\<^sub>0 es)\"\n    with Cons_exp\n    have \"length ?ST\\<^sub>0 \\<le> length ST \\<and> drop (size ST - size ?ST\\<^sub>0) ST = ?ST\\<^sub>0\" by blast\n    hence ?case  by (clarsimp simp add: drop_mess)\n  }\n  ultimately show ?case by auto\nnext\n  case (BinOp e\\<^sub>1 bop e\\<^sub>2)\n  moreover {\n    let ?ST\\<^sub>0 = \"ty E e\\<^sub>1 # ST\\<^sub>0\"\n    fix A assume \"\\<lfloor>(ST, LT)\\<rfloor> \\<in> set (compT E A ?ST\\<^sub>0 e\\<^sub>2)\"\n    with BinOp \n    have \"length ?ST\\<^sub>0 \\<le> length ST \\<and> drop (size ST - size ?ST\\<^sub>0) ST = ?ST\\<^sub>0\" by blast\n    hence ?case by (clarsimp simp add: drop_mess)\n  }\n  ultimately show ?case by auto\nnext\n  case new thus ?case by auto\nnext\n  case Val thus ?case by auto    \nnext\n  case Cast thus ?case by auto\nnext\n  case Var thus ?case by auto\nnext\n  case LAss thus ?case by auto\nnext\n  case throw thus ?case by auto\nnext\n  case FAcc thus ?case by auto\nnext\n  case Nil_exp thus ?case by auto\nqed \n\ndeclare (in TC0) \n  after_def[simp del] pair_eq_ty\\<^sub>i'_conv[simp del]\n(*>*)\n\n(* FIXME *)\nlemma fun_of_simp [simp]: \"fun_of S x y = ((x,y) \\<in> S)\" \n(*<*) by (simp add: fun_of_def)(*>*)\n\ntheorem (in TC2) compT_wt_instrs: \"\\<And>E T A ST.\n  \\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: T; \\<D> e A; \\<B> e (size E); \n    size ST + max_stack e \\<le> mxs; size E + max_vars e \\<le> mxl \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> compE\\<^sub>2 e, compxE\\<^sub>2 e 0 (size ST) [::]\n                 ty\\<^sub>i' ST E A # compT E A ST e @ [after E A ST e]\"\n(*<*)(is \"\\<And>E T A ST. PROP ?P e E T A ST\")(*>*)\n\nand \"\\<And>E Ts A ST.\n  \\<lbrakk> P,E \\<turnstile>\\<^sub>1 es[::]Ts;  \\<D>s es A; \\<B>s es (size E); \n    size ST + max_stacks es \\<le> mxs; size E + max_varss es \\<le> mxl \\<rbrakk>\n  \\<Longrightarrow> let \\<tau>s = ty\\<^sub>i' ST E A # compTs E A ST es in\n       \\<turnstile> compEs\\<^sub>2 es,compxEs\\<^sub>2 es 0 (size ST) [::] \\<tau>s \\<and>\n       last \\<tau>s = ty\\<^sub>i' (rev Ts @ ST) E (A \\<squnion> \\<A>s es)\"\n(*<*)\n(is \"\\<And>E Ts A ST. PROP ?Ps es E Ts A ST\")\nproof(induct e and es rule: compxE\\<^sub>2.induct compxEs\\<^sub>2.induct)\n  case (TryCatch e\\<^sub>1 C i e\\<^sub>2)\n  hence [simp]: \"i = size E\" by simp\n  have wt\\<^sub>1: \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 :: T\" and wt\\<^sub>2: \"P,E@[Class C] \\<turnstile>\\<^sub>1 e\\<^sub>2 :: T\"\n    and \"class\": \"is_class P C\" using TryCatch by auto\n  let ?A\\<^sub>1 = \"A \\<squnion> \\<A> e\\<^sub>1\" let ?A\\<^sub>i = \"A \\<squnion> \\<lfloor>{i}\\<rfloor>\" let ?E\\<^sub>i = \"E @ [Class C]\"\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>1 = \"compT E A ST e\\<^sub>1\"\n  let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' (T#ST) E ?A\\<^sub>1\" let ?\\<tau>\\<^sub>2 = \"ty\\<^sub>i' (Class C#ST) E A\"\n  let ?\\<tau>\\<^sub>3 = \"ty\\<^sub>i' ST ?E\\<^sub>i ?A\\<^sub>i\" let ?\\<tau>s\\<^sub>2 = \"compT ?E\\<^sub>i ?A\\<^sub>i ST e\\<^sub>2\"\n  let ?\\<tau>\\<^sub>2' = \"ty\\<^sub>i' (T#ST) ?E\\<^sub>i (?A\\<^sub>i \\<squnion> \\<A> e\\<^sub>2)\"\n  let ?\\<tau>' = \"ty\\<^sub>i' (T#ST) E (A \\<squnion> \\<A> e\\<^sub>1 \\<sqinter> (\\<A> e\\<^sub>2 \\<ominus> i))\"\n  let ?go = \"Goto (int(size(compE\\<^sub>2 e\\<^sub>2)) + 2)\"\n  have \"PROP ?P e\\<^sub>2 ?E\\<^sub>i T ?A\\<^sub>i ST\" by fact\n  hence \"\\<turnstile> compE\\<^sub>2 e\\<^sub>2,compxE\\<^sub>2 e\\<^sub>2 0 (size ST) [::] (?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2) @ [?\\<tau>\\<^sub>2']\"\n    using TryCatch.prems by(auto simp:after_def)\n  also have \"?A\\<^sub>i \\<squnion> \\<A> e\\<^sub>2 = (A \\<squnion> \\<A> e\\<^sub>2) \\<squnion> \\<lfloor>{size E}\\<rfloor>\"\n    by(fastforce simp:hyperset_defs)\n  also have \"P \\<turnstile> ty\\<^sub>i' (T#ST) ?E\\<^sub>i \\<dots> \\<le>' ty\\<^sub>i' (T#ST) E (A \\<squnion> \\<A> e\\<^sub>2)\"\n    by(simp add:hyperset_defs ty\\<^sub>l_incr ty\\<^sub>i'_def)\n  also have \"P \\<turnstile> \\<dots> \\<le>' ty\\<^sub>i' (T#ST) E (A \\<squnion> \\<A> e\\<^sub>1 \\<sqinter> (\\<A> e\\<^sub>2 \\<ominus> i))\"\n    by(auto intro!: ty\\<^sub>l_antimono simp:hyperset_defs ty\\<^sub>i'_def)\n  also have \"(?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2) @ [?\\<tau>'] = ?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2 @ [?\\<tau>']\" by simp\n  also have \"\\<turnstile> [Store i],[] [::] ?\\<tau>\\<^sub>2 # [] @ [?\\<tau>\\<^sub>3]\"\n    using TryCatch.prems\n    by(auto simp:nth_list_update wt_defs ty\\<^sub>i'_def ty\\<^sub>l_def\n      list_all2_conv_all_nth hyperset_defs)\n  also have \"[] @ (?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2 @ [?\\<tau>']) = (?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2 @ [?\\<tau>'])\" by simp\n  also have \"P,T\\<^sub>r,mxs,size(compE\\<^sub>2 e\\<^sub>2)+3,[] \\<turnstile> ?go,0 :: ?\\<tau>\\<^sub>1#?\\<tau>\\<^sub>2#?\\<tau>\\<^sub>3#?\\<tau>s\\<^sub>2 @ [?\\<tau>']\"\n    by (auto simp: hyperset_defs ty\\<^sub>i'_def wt_defs nth_Cons nat_add_distrib\n      fun_of_def intro: ty\\<^sub>l_antimono list_all2_refl split:nat.split)\n  also have \"\\<turnstile> compE\\<^sub>2 e\\<^sub>1,compxE\\<^sub>2 e\\<^sub>1 0 (size ST) [::] ?\\<tau> # ?\\<tau>s\\<^sub>1 @ [?\\<tau>\\<^sub>1]\"\n    using TryCatch by(auto simp:after_def)\n  also have \"?\\<tau> # ?\\<tau>s\\<^sub>1 @ ?\\<tau>\\<^sub>1 # ?\\<tau>\\<^sub>2 # ?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2 @ [?\\<tau>'] =\n             (?\\<tau> # ?\\<tau>s\\<^sub>1 @ [?\\<tau>\\<^sub>1]) @ ?\\<tau>\\<^sub>2 # ?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2 @ [?\\<tau>']\" by simp\n  also have \"compE\\<^sub>2 e\\<^sub>1 @ ?go  # [Store i] @ compE\\<^sub>2 e\\<^sub>2 =\n             (compE\\<^sub>2 e\\<^sub>1 @ [?go]) @ (Store i # compE\\<^sub>2 e\\<^sub>2)\" by simp\n  also \n  let \"?Q \\<tau>\" = \"\\<forall>ST' LT'. \\<tau> = \\<lfloor>(ST', LT')\\<rfloor> \\<longrightarrow> \n    size ST \\<le> size ST' \\<and> P \\<turnstile> Some (drop (size ST' - size ST) ST',LT') \\<le>' ty\\<^sub>i' ST E A\"\n  {\n    have \"?Q (ty\\<^sub>i' ST E A)\" by (clarsimp simp add: ty\\<^sub>i'_def)\n    moreover have \"?Q (ty\\<^sub>i' (T # ST) E ?A\\<^sub>1)\" \n      by (fastforce simp add: ty\\<^sub>i'_def hyperset_defs intro!: ty\\<^sub>l_antimono)\n    moreover have \"\\<And>\\<tau>. \\<tau> \\<in> set (compT E A ST e\\<^sub>1) \\<Longrightarrow> ?Q \\<tau>\" using TryCatch.prems\n      by clarsimp (frule compT_ST_prefix,\n                   fastforce dest!: compT_LT_prefix simp add: ty\\<^sub>i'_def)\n    ultimately\n    have \"\\<forall>\\<tau>\\<in>set (ty\\<^sub>i' ST E A # compT E A ST e\\<^sub>1 @ [ty\\<^sub>i' (T # ST) E ?A\\<^sub>1]). ?Q \\<tau>\" \n      by auto\n  }\n  also from TryCatch.prems max_stack1[of e\\<^sub>1] have \"size ST + 1 \\<le> mxs\" by auto\n  ultimately show ?case using wt\\<^sub>1 wt\\<^sub>2 TryCatch.prems \"class\"\n    by (simp add:after_def)\nnext\n  case new thus ?case by(auto simp add:after_def wt_New)\nnext\n  case (BinOp e\\<^sub>1 bop e\\<^sub>2) \n  let ?op = \"case bop of Eq \\<Rightarrow> [CmpEq] | Add \\<Rightarrow> [IAdd]\"\n  have T: \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2 :: T\" by fact\n  then obtain T\\<^sub>1 T\\<^sub>2 where T\\<^sub>1: \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 :: T\\<^sub>1\" and T\\<^sub>2: \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>2 :: T\\<^sub>2\" and \n    bopT: \"case bop of Eq \\<Rightarrow> (P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1) \\<and> T = Boolean \n                    | Add \\<Rightarrow> T\\<^sub>1 = Integer \\<and> T\\<^sub>2 = Integer \\<and> T = Integer\" by auto\n  let ?A\\<^sub>1 = \"A \\<squnion> \\<A> e\\<^sub>1\" let ?A\\<^sub>2 = \"?A\\<^sub>1 \\<squnion> \\<A> e\\<^sub>2\"\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>1 = \"compT E A ST e\\<^sub>1\"\n  let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' (T\\<^sub>1#ST) E ?A\\<^sub>1\" let ?\\<tau>s\\<^sub>2 = \"compT E ?A\\<^sub>1 (T\\<^sub>1#ST) e\\<^sub>2\"\n  let ?\\<tau>\\<^sub>2 = \"ty\\<^sub>i' (T\\<^sub>2#T\\<^sub>1#ST) E ?A\\<^sub>2\" let ?\\<tau>' = \"ty\\<^sub>i' (T#ST) E ?A\\<^sub>2\"\n  from bopT have \"\\<turnstile> ?op,[] [::] [?\\<tau>\\<^sub>2,?\\<tau>']\" \n    by (cases bop) (auto simp add: wt_CmpEq wt_IAdd)\n  also have \"PROP ?P e\\<^sub>2 E T\\<^sub>2 ?A\\<^sub>1 (T\\<^sub>1#ST)\" by fact\n  with BinOp.prems T\\<^sub>2 \n  have \"\\<turnstile> compE\\<^sub>2 e\\<^sub>2, compxE\\<^sub>2 e\\<^sub>2 0 (size (T\\<^sub>1#ST)) [::] ?\\<tau>\\<^sub>1#?\\<tau>s\\<^sub>2@[?\\<tau>\\<^sub>2]\" \n    by (auto simp: after_def)\n  also from BinOp T\\<^sub>1 have \"\\<turnstile> compE\\<^sub>2 e\\<^sub>1, compxE\\<^sub>2 e\\<^sub>1 0 (size ST) [::] ?\\<tau>#?\\<tau>s\\<^sub>1@[?\\<tau>\\<^sub>1]\" \n    by (auto simp: after_def)\n  finally show ?case using T T\\<^sub>1 T\\<^sub>2 by (simp add: after_def hyperUn_assoc)\nnext\n  case (Cons_exp e es)\n  have \"P,E \\<turnstile>\\<^sub>1 e # es [::] Ts\" by fact\n  then obtain T\\<^sub>e Ts' where \n    T\\<^sub>e: \"P,E \\<turnstile>\\<^sub>1 e :: T\\<^sub>e\" and Ts': \"P,E \\<turnstile>\\<^sub>1 es [::] Ts'\" and\n    Ts: \"Ts = T\\<^sub>e#Ts'\" by auto\n  let ?A\\<^sub>e = \"A \\<squnion> \\<A> e\"  \n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>e = \"compT E A ST e\"  \n  let ?\\<tau>\\<^sub>e = \"ty\\<^sub>i' (T\\<^sub>e#ST) E ?A\\<^sub>e\" let ?\\<tau>s' = \"compTs E ?A\\<^sub>e (T\\<^sub>e#ST) es\"\n  let ?\\<tau>s = \"?\\<tau> # ?\\<tau>s\\<^sub>e @ (?\\<tau>\\<^sub>e # ?\\<tau>s')\"\n  have Ps: \"PROP ?Ps es E Ts' ?A\\<^sub>e (T\\<^sub>e#ST)\" by fact\n  with Cons_exp.prems T\\<^sub>e Ts'\n  have \"\\<turnstile> compEs\\<^sub>2 es, compxEs\\<^sub>2 es 0 (size (T\\<^sub>e#ST)) [::] ?\\<tau>\\<^sub>e#?\\<tau>s'\" by (simp add: after_def)\n  also from Cons_exp T\\<^sub>e have \"\\<turnstile> compE\\<^sub>2 e, compxE\\<^sub>2 e 0 (size ST) [::] ?\\<tau>#?\\<tau>s\\<^sub>e@[?\\<tau>\\<^sub>e]\" \n    by (auto simp: after_def)\n  moreover\n  from Ps Cons_exp.prems T\\<^sub>e Ts' Ts\n  have \"last ?\\<tau>s = ty\\<^sub>i' (rev Ts@ST) E (?A\\<^sub>e \\<squnion> \\<A>s es)\" by simp\n  ultimately show ?case using T\\<^sub>e by (simp add: after_def hyperUn_assoc)\nnext\n  case (FAss e\\<^sub>1 F D e\\<^sub>2)\n  hence Void: \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2 :: Void\" by auto\n  then obtain C T T' where    \n    C: \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 :: Class C\" and sees: \"P \\<turnstile> C sees F:T in D\" and\n    T': \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>2 :: T'\" and T'_T: \"P \\<turnstile> T' \\<le> T\" by auto\n  let ?A\\<^sub>1 = \"A \\<squnion> \\<A> e\\<^sub>1\" let ?A\\<^sub>2 = \"?A\\<^sub>1 \\<squnion> \\<A> e\\<^sub>2\"  \n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>1 = \"compT E A ST e\\<^sub>1\"\n  let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' (Class C#ST) E ?A\\<^sub>1\" let ?\\<tau>s\\<^sub>2 = \"compT E ?A\\<^sub>1 (Class C#ST) e\\<^sub>2\"\n  let ?\\<tau>\\<^sub>2 = \"ty\\<^sub>i' (T'#Class C#ST) E ?A\\<^sub>2\" let ?\\<tau>\\<^sub>3 = \"ty\\<^sub>i' ST E ?A\\<^sub>2\"\n  let ?\\<tau>' = \"ty\\<^sub>i' (Void#ST) E ?A\\<^sub>2\"\n  from FAss.prems sees T'_T \n  have \"\\<turnstile> [Putfield F D,Push Unit],[] [::] [?\\<tau>\\<^sub>2,?\\<tau>\\<^sub>3,?\\<tau>']\"\n    by (fastforce simp add: wt_Push wt_Put)\n  also have \"PROP ?P e\\<^sub>2 E T' ?A\\<^sub>1 (Class C#ST)\" by fact\n  with FAss.prems T' \n  have \"\\<turnstile> compE\\<^sub>2 e\\<^sub>2, compxE\\<^sub>2 e\\<^sub>2 0 (size ST+1) [::] ?\\<tau>\\<^sub>1#?\\<tau>s\\<^sub>2@[?\\<tau>\\<^sub>2]\"\n    by (auto simp add: after_def hyperUn_assoc) \n  also from FAss C have \"\\<turnstile> compE\\<^sub>2 e\\<^sub>1, compxE\\<^sub>2 e\\<^sub>1 0 (size ST) [::] ?\\<tau>#?\\<tau>s\\<^sub>1@[?\\<tau>\\<^sub>1]\" \n    by (auto simp add: after_def)\n  finally show ?case using Void C T' by (simp add: after_def hyperUn_assoc) \nnext\n  case Val thus ?case by(auto simp:after_def wt_Push)\nnext\n  case Cast thus ?case by (auto simp:after_def wt_Cast)\nnext\n  case (Block i T\\<^sub>i e)\n  let ?\\<tau>s = \"ty\\<^sub>i' ST E A # compT (E @ [T\\<^sub>i]) (A\\<ominus>i) ST e\"\n  have IH: \"PROP ?P e (E@[T\\<^sub>i]) T (A\\<ominus>i) ST\" by fact\n  hence \"\\<turnstile> compE\\<^sub>2 e, compxE\\<^sub>2 e 0 (size ST) [::]\n         ?\\<tau>s @ [ty\\<^sub>i' (T#ST) (E@[T\\<^sub>i]) (A\\<ominus>(size E) \\<squnion> \\<A> e)]\"\n    using Block.prems by (auto simp add: after_def)\n  also have \"P \\<turnstile> ty\\<^sub>i' (T # ST) (E@[T\\<^sub>i]) (A \\<ominus> size E \\<squnion> \\<A> e) \\<le>'\n                 ty\\<^sub>i' (T # ST) (E@[T\\<^sub>i]) ((A \\<squnion> \\<A> e) \\<ominus> size E)\"\n     by(auto simp add:hyperset_defs intro: ty\\<^sub>i'_antimono)\n  also have \"\\<dots> = ty\\<^sub>i' (T # ST) E (A \\<squnion> \\<A> e)\" by simp\n  also have \"P \\<turnstile> \\<dots> \\<le>' ty\\<^sub>i' (T # ST) E (A \\<squnion> (\\<A> e \\<ominus> i))\"\n     by(auto simp add:hyperset_defs intro: ty\\<^sub>i'_antimono)\n  finally show ?case using Block.prems by(simp add: after_def)\nnext\n  case Var thus ?case by(auto simp:after_def wt_Load)\nnext\n  case FAcc thus ?case by(auto simp:after_def wt_Get)\nnext\n  case (LAss i e) thus ?case using max_stack1[of e]\n    by(auto simp: hyper_insert_comm after_def wt_Store wt_Push)\nnext\n  case Nil_exp thus ?case by auto\nnext\n  case throw thus ?case by(auto simp add: after_def wt_Throw)\nnext\n  case (While e c)\n  obtain Tc where wte: \"P,E \\<turnstile>\\<^sub>1 e :: Boolean\" and wtc: \"P,E \\<turnstile>\\<^sub>1 c :: Tc\"\n    and [simp]: \"T = Void\" using While by auto\n  have [simp]: \"ty E (while (e) c) = Void\" using While by simp\n  let ?A\\<^sub>0 = \"A \\<squnion> \\<A> e\" let ?A\\<^sub>1 = \"?A\\<^sub>0 \\<squnion> \\<A> c\"\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>e = \"compT E A ST e\"\n  let ?\\<tau>\\<^sub>e = \"ty\\<^sub>i' (Boolean#ST) E ?A\\<^sub>0\" let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' ST E ?A\\<^sub>0\"\n  let ?\\<tau>s\\<^sub>c = \"compT E ?A\\<^sub>0 ST c\" let ?\\<tau>\\<^sub>c = \"ty\\<^sub>i' (Tc#ST) E ?A\\<^sub>1\"\n  let ?\\<tau>\\<^sub>2 = \"ty\\<^sub>i' ST E ?A\\<^sub>1\" let ?\\<tau>' = \"ty\\<^sub>i' (Void#ST) E ?A\\<^sub>0\"\n  let ?\\<tau>s = \"(?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e]) @ ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c, ?\\<tau>\\<^sub>2, ?\\<tau>\\<^sub>1, ?\\<tau>']\"\n  have \"\\<turnstile> [],[] [::] [] @ ?\\<tau>s\" by(simp add:wt_instrs_def)\n  also\n  have \"PROP ?P e E Boolean A ST\" by fact\n  hence \"\\<turnstile> compE\\<^sub>2 e,compxE\\<^sub>2 e 0 (size ST) [::] ?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e]\"\n    using While.prems by (auto simp:after_def)\n  also\n  have \"[] @ ?\\<tau>s = (?\\<tau> # ?\\<tau>s\\<^sub>e) @ ?\\<tau>\\<^sub>e # ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c,?\\<tau>\\<^sub>2,?\\<tau>\\<^sub>1,?\\<tau>']\" by simp\n  also\n  let ?n\\<^sub>e = \"size(compE\\<^sub>2 e)\"  let ?n\\<^sub>c = \"size(compE\\<^sub>2 c)\"\n  let ?if = \"IfFalse (int ?n\\<^sub>c + 3)\"\n  have \"\\<turnstile> [?if],[] [::] ?\\<tau>\\<^sub>e # ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c, ?\\<tau>\\<^sub>2, ?\\<tau>\\<^sub>1, ?\\<tau>']\" \n  proof-{\n      show ?thesis\n        apply (rule wt_IfFalse)\n          apply simp\n         apply simp\n        apply (subgoal_tac \"length (compE\\<^sub>2 c) = length (compT E (A \\<squnion> \\<A> e) ST c) + 1\" \n                           \"nat (int (length (compE\\<^sub>2 c)) + 3 - 2) > length (compT E (A \\<squnion> \\<A> e) ST c)\")\n          apply simp+\n        done\n    }\n  qed\n  also\n  have \"(?\\<tau> # ?\\<tau>s\\<^sub>e) @ (?\\<tau>\\<^sub>e # ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c, ?\\<tau>\\<^sub>2, ?\\<tau>\\<^sub>1, ?\\<tau>']) = ?\\<tau>s\" by simp\n  also\n  have \"PROP ?P c E Tc ?A\\<^sub>0 ST\" by fact\n  hence \"\\<turnstile> compE\\<^sub>2 c,compxE\\<^sub>2 c 0 (size ST) [::] ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c]\"\n    using While.prems wtc by (auto simp:after_def)\n  also have \"?\\<tau>s = (?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e,?\\<tau>\\<^sub>1] @ ?\\<tau>s\\<^sub>c) @ [?\\<tau>\\<^sub>c,?\\<tau>\\<^sub>2,?\\<tau>\\<^sub>1,?\\<tau>']\" by simp\n  also have \"\\<turnstile> [Pop],[] [::] [?\\<tau>\\<^sub>c, ?\\<tau>\\<^sub>2]\"  by(simp add:wt_Pop)\n  also have \"(?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e,?\\<tau>\\<^sub>1] @ ?\\<tau>s\\<^sub>c) @ [?\\<tau>\\<^sub>c,?\\<tau>\\<^sub>2,?\\<tau>\\<^sub>1,?\\<tau>'] = ?\\<tau>s\" by simp\n  also let ?go = \"Goto (-int(?n\\<^sub>c+?n\\<^sub>e+2))\"\n  have \"P \\<turnstile> ?\\<tau>\\<^sub>2 \\<le>' ?\\<tau>\" by(fastforce intro: ty\\<^sub>i'_antimono simp: hyperset_defs)\n  hence \"P,T\\<^sub>r,mxs,size ?\\<tau>s,[] \\<turnstile> ?go,?n\\<^sub>e+?n\\<^sub>c+2 :: ?\\<tau>s\" \n  proof-{\n      let ?t1 = \"ty\\<^sub>i' ST E A\" let ?t2 = \"ty\\<^sub>i' (Boolean # ST) E (A \\<squnion> \\<A> e)\" let ?t3 = \"ty\\<^sub>i' ST E (A \\<squnion> \\<A> e)\"\n      let ?t4 = \"[ty\\<^sub>i' (Tc # ST) E (A \\<squnion> \\<A> e \\<squnion> \\<A> c), ty\\<^sub>i' ST E (A \\<squnion> \\<A> e \\<squnion> \\<A> c), ty\\<^sub>i' ST E (A \\<squnion> \\<A> e), ty\\<^sub>i' (Void # ST) E (A \\<squnion> \\<A> e)]\"\n      let ?c = \" compT E (A \\<squnion> \\<A> e) ST c\" let ?e = \"compT E A ST e\" \n      assume ass: \"P \\<turnstile> ty\\<^sub>i' ST E (A \\<squnion> \\<A> e \\<squnion> \\<A> c) \\<le>' ?t1\"      \n      show ?thesis\n        apply (rule wt_Goto)\n        apply simp\n          apply simp\n         apply simp\n      proof-{\n          let ?s1 = \"((?t1 # ?e @ [?t2]) @ ?t3 # ?c)\"          \n          have \"length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c) + 2 > length ?s1\" by auto\n          hence \"(?s1 @ ?t4) ! (length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c) + 2) =\n                     ?t4 ! (length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c) + 2 - length ?s1)\" \n            by (auto simp only:nth_append split: if_splits)\n          hence \"(?s1 @ ?t4) ! (length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c) + 2) = ty\\<^sub>i' ST E (A \\<squnion> \\<A> e \\<squnion> \\<A> c)\" \n            using compT_sizes by auto \n          hence \"P \\<turnstile> (?s1 @ ?t4) ! (length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c) + 2) \\<le>' ty\\<^sub>i' ST E A\" \n            using ass by simp\n          thus \"P \\<turnstile> ((?t1 # ?e @ [?t2]) @ ?t3 # ?c @ ?t4) ! (length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c) + 2) \\<le>'\n                    ((?t1 # ?e @ [?t2]) @ ?t3 # ?c @ ?t4) ! nat (int (length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c) + 2) +\n                      - int (length (compE\\<^sub>2 c) + length (compE\\<^sub>2 e) + 2))\"\n            by simp\n        }qed\n    }qed\n  also have \"?\\<tau>s = (?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e,?\\<tau>\\<^sub>1] @ ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c, ?\\<tau>\\<^sub>2]) @ [?\\<tau>\\<^sub>1, ?\\<tau>']\"\n    by simp\n  also have \"\\<turnstile> [Push Unit],[] [::] [?\\<tau>\\<^sub>1,?\\<tau>']\"\n    using While.prems max_stack1[of c] by(auto simp add:wt_Push)\n  finally show ?case using wtc wte\n    by (simp add:after_def)\nnext\n  case (Cond e e\\<^sub>1 e\\<^sub>2)\n  obtain T\\<^sub>1 T\\<^sub>2 where wte: \"P,E \\<turnstile>\\<^sub>1 e :: Boolean\"\n    and wt\\<^sub>1: \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 :: T\\<^sub>1\" and wt\\<^sub>2: \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>2 :: T\\<^sub>2\"\n    and sub\\<^sub>1: \"P \\<turnstile> T\\<^sub>1 \\<le> T\" and sub\\<^sub>2: \"P \\<turnstile> T\\<^sub>2 \\<le> T\"\n    using Cond by auto\n  have [simp]: \"ty E (if (e) e\\<^sub>1 else e\\<^sub>2) = T\" using Cond by simp\n  let ?A\\<^sub>0 = \"A \\<squnion> \\<A> e\" let ?A\\<^sub>2 = \"?A\\<^sub>0 \\<squnion> \\<A> e\\<^sub>2\" let ?A\\<^sub>1 = \"?A\\<^sub>0 \\<squnion> \\<A> e\\<^sub>1\"\n  let ?A' = \"?A\\<^sub>0 \\<squnion> \\<A> e\\<^sub>1 \\<sqinter> \\<A> e\\<^sub>2\"\n  let ?\\<tau>\\<^sub>2 = \"ty\\<^sub>i' ST E ?A\\<^sub>0\" let ?\\<tau>' = \"ty\\<^sub>i' (T#ST) E ?A'\"\n  let ?\\<tau>s\\<^sub>2 = \"compT E ?A\\<^sub>0 ST e\\<^sub>2\"\n  have \"PROP ?P e\\<^sub>2 E T\\<^sub>2 ?A\\<^sub>0 ST\" by fact\n  hence \"\\<turnstile> compE\\<^sub>2 e\\<^sub>2, compxE\\<^sub>2 e\\<^sub>2 0 (size ST) [::] (?\\<tau>\\<^sub>2#?\\<tau>s\\<^sub>2) @ [ty\\<^sub>i' (T\\<^sub>2#ST) E ?A\\<^sub>2]\"\n    using Cond.prems wt\\<^sub>2 by(auto simp add:after_def)\n  also have \"P \\<turnstile> ty\\<^sub>i' (T\\<^sub>2#ST) E ?A\\<^sub>2 \\<le>' ?\\<tau>'\" using sub\\<^sub>2\n    by(auto simp add: hyperset_defs ty\\<^sub>i'_def intro!: ty\\<^sub>l_antimono)\n  also\n  let ?\\<tau>\\<^sub>3 = \"ty\\<^sub>i' (T\\<^sub>1 # ST) E ?A\\<^sub>1\"\n  let ?g\\<^sub>2 = \"Goto(int (size (compE\\<^sub>2 e\\<^sub>2) + 1))\"\n  from sub\\<^sub>1 have \"P,T\\<^sub>r,mxs,size(compE\\<^sub>2 e\\<^sub>2)+2,[] \\<turnstile> ?g\\<^sub>2,0 :: ?\\<tau>\\<^sub>3#(?\\<tau>\\<^sub>2#?\\<tau>s\\<^sub>2)@[?\\<tau>']\"\n    by(auto simp: hyperset_defs wt_defs nth_Cons ty\\<^sub>i'_def\n             split:nat.split intro!: ty\\<^sub>l_antimono)\n  also\n  let ?\\<tau>s\\<^sub>1 = \"compT E ?A\\<^sub>0 ST e\\<^sub>1\"\n  have \"PROP ?P e\\<^sub>1 E T\\<^sub>1 ?A\\<^sub>0 ST\" by fact\n  hence \"\\<turnstile> compE\\<^sub>2 e\\<^sub>1,compxE\\<^sub>2 e\\<^sub>1 0 (size ST) [::] ?\\<tau>\\<^sub>2 # ?\\<tau>s\\<^sub>1 @ [?\\<tau>\\<^sub>3]\"\n    using Cond.prems wt\\<^sub>1 by(auto simp add:after_def)\n  also\n  let ?\\<tau>s\\<^sub>1\\<^sub>2 = \"?\\<tau>\\<^sub>2 # ?\\<tau>s\\<^sub>1 @ ?\\<tau>\\<^sub>3 # (?\\<tau>\\<^sub>2 # ?\\<tau>s\\<^sub>2) @ [?\\<tau>']\"\n  let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' (Boolean#ST) E ?A\\<^sub>0\"\n  let ?g\\<^sub>1 = \"IfFalse(int (size (compE\\<^sub>2 e\\<^sub>1) + 2))\"\n  let ?code = \"compE\\<^sub>2 e\\<^sub>1 @ ?g\\<^sub>2 # compE\\<^sub>2 e\\<^sub>2\"\n  have \"\\<turnstile> [?g\\<^sub>1],[] [::] [?\\<tau>\\<^sub>1] @ ?\\<tau>s\\<^sub>1\\<^sub>2\"  \n  proof-{\n    show ?thesis \n      apply clarsimp\n      apply (rule wt_IfFalse)\n        apply (simp only:nat_add_distrib)\n       apply simp\n      apply (auto simp only:nth_append split:if_splits)     \n      apply (simp only:compT_sizes)\n      apply simp\n      done\n  }qed\n  also (wt_instrs_ext2) have \"[?\\<tau>\\<^sub>1] @ ?\\<tau>s\\<^sub>1\\<^sub>2 = ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>1\\<^sub>2\" by simp also\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\"\n  have \"PROP ?P e E Boolean A ST\" by fact\n  hence \"\\<turnstile> compE\\<^sub>2 e, compxE\\<^sub>2 e 0 (size ST) [::] ?\\<tau> # compT E A ST e @ [?\\<tau>\\<^sub>1]\"\n    using Cond.prems wte by(auto simp add:after_def)\n  finally show ?case using wte wt\\<^sub>1 wt\\<^sub>2 by(simp add:after_def hyperUn_assoc)\nnext\n  case (Call e M es)\n  obtain C D Ts m Ts' where C: \"P,E \\<turnstile>\\<^sub>1 e :: Class C\"\n    and \"method\": \"P \\<turnstile> C sees M:Ts \\<rightarrow> T = m in D\"\n    and wtes: \"P,E \\<turnstile>\\<^sub>1 es [::] Ts'\" and subs: \"P \\<turnstile> Ts' [\\<le>] Ts\"\n    using Call.prems by auto\n  from wtes have same_size: \"size es = size Ts'\" by(rule WTs\\<^sub>1_same_size)\n  let ?A\\<^sub>0 = \"A \\<squnion> \\<A> e\" let ?A\\<^sub>1 = \"?A\\<^sub>0 \\<squnion> \\<A>s es\"\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>e = \"compT E A ST e\"\n  let ?\\<tau>\\<^sub>e = \"ty\\<^sub>i' (Class C # ST) E ?A\\<^sub>0\"\n  let ?\\<tau>s\\<^sub>e\\<^sub>s = \"compTs E ?A\\<^sub>0 (Class C # ST) es\"\n  let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' (rev Ts' @ Class C # ST) E ?A\\<^sub>1\"\n  let ?\\<tau>' = \"ty\\<^sub>i' (T # ST) E ?A\\<^sub>1\"\n  have \"\\<turnstile> [Invoke M (size es)],[] [::] [?\\<tau>\\<^sub>1,?\\<tau>']\"\n    by(rule wt_Invoke[OF same_size \"method\" subs])\n  also\n  have \"PROP ?Ps es E Ts' ?A\\<^sub>0 (Class C # ST)\" by fact\n  hence \"\\<turnstile> compEs\\<^sub>2 es,compxEs\\<^sub>2 es 0 (size ST+1) [::] ?\\<tau>\\<^sub>e # ?\\<tau>s\\<^sub>e\\<^sub>s\"\n        \"last (?\\<tau>\\<^sub>e # ?\\<tau>s\\<^sub>e\\<^sub>s) = ?\\<tau>\\<^sub>1\"\n    using Call.prems wtes by(auto simp add:after_def)\n  also have \"(?\\<tau>\\<^sub>e # ?\\<tau>s\\<^sub>e\\<^sub>s) @ [?\\<tau>'] = ?\\<tau>\\<^sub>e # ?\\<tau>s\\<^sub>e\\<^sub>s @ [?\\<tau>']\" by simp\n  also have \"\\<turnstile> compE\\<^sub>2 e,compxE\\<^sub>2 e 0 (size ST) [::] ?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e]\"\n    using Call C by(auto simp add:after_def)\n  finally show ?case using Call.prems C by(simp add:after_def hyperUn_assoc)\nnext\n  case Seq thus ?case\n    by(auto simp:after_def)\n      (fastforce simp:wt_Push wt_Pop hyperUn_assoc\n                intro:wt_instrs_app2 wt_instrs_Cons)\nqed\n(*>*)\n\n\nlemma [simp]: \"types (compP f P) = types P\"\n(*<*)by auto(*>*)\n\nlemma [simp]: \"states (compP f P) mxs mxl = states P mxs mxl\"\n(*<*)by (simp add: JVM_states_unfold)(*>*)\n\nlemma [simp]: \"app\\<^sub>i (i, compP f P, pc, mpc, T, \\<tau>) = app\\<^sub>i (i, P, pc, mpc, T, \\<tau>)\"\n(*<*)(is \"?A = ?B\")\nproof -\n  obtain ST LT where \\<tau>: \"\\<tau> = (ST, LT)\" by(cases \\<tau>) simp\n  then show ?thesis proof(cases i)\n    case Invoke show ?thesis\n    proof(rule iffI)\n      assume ?A then show ?B using Invoke \\<tau>\n        by auto (fastforce dest!: sees_method_compPD)\n    next\n      assume ?B then show ?A using Invoke \\<tau>\n        by auto (force dest: sees_method_compP)\n    qed\n  qed auto\nqed\n(*>*)\n  \nlemma [simp]: \"is_relevant_entry (compP f P) i = is_relevant_entry P i\"\n(*<*)\nproof -\n  { fix pc e\n    have \"is_relevant_entry (compP f P) i pc e = is_relevant_entry P i pc e\"\n      by(cases i) (auto simp: is_relevant_entry_def)\n  }\n  then show ?thesis by fast\nqed\n(*>*)\n\nlemma [simp]: \"relevant_entries (compP f P) i pc xt = relevant_entries P i pc xt\"\n(*<*) by (simp add: relevant_entries_def)(*>*)\n\nlemma [simp]: \"app i (compP f P) mpc T pc mxl xt \\<tau> = app i P mpc T pc mxl xt \\<tau>\"\n(*<*)\nby (simp add: app_def xcpt_app_def eff_def xcpt_eff_def norm_eff_def)\n   (fastforce simp add: image_def)\n(*>*)\n\nlemma [simp]:\nassumes \"app i P mpc T pc mxl xt \\<tau>\"\nshows \"eff i (compP f P) pc xt \\<tau> = eff i P pc xt \\<tau>\"\n(*<*)\nusing assms\nproof(clarsimp simp: eff_def norm_eff_def xcpt_eff_def app_def, cases i)\nqed auto\n(*>*)\n\nlemma [simp]: \"subtype (compP f P) = subtype P\"\n(*<*)by (rule ext)+ simp(*>*)\n  \nlemma [simp]: \"compP f P \\<turnstile> \\<tau> \\<le>' \\<tau>' = P \\<turnstile> \\<tau> \\<le>' \\<tau>'\"\n(*<*) by (simp add: sup_state_opt_def sup_state_def sup_ty_opt_def)(*>*)\n\nlemma [simp]: \"compP f P,T,mpc,mxl,xt \\<turnstile> i,pc :: \\<tau>s = P,T,mpc,mxl,xt \\<turnstile> i,pc :: \\<tau>s\"\n(*<*)by (simp add: wt_instr_def cong: conj_cong)(*>*)\n\ndeclare TC1.compT_sizes[simp]  TC0.ty_def2[simp]\n\ncontext TC2\nbegin\n\nlemma compT_method:\n  fixes e and A and C and Ts and mxl\\<^sub>0\n  defines [simp]: \"E \\<equiv> Class C # Ts\"\n    and [simp]: \"A \\<equiv> \\<lfloor>{..size Ts}\\<rfloor>\"\n    and [simp]: \"A' \\<equiv> A \\<squnion> \\<A> e\"\n    and [simp]: \"mxl\\<^sub>0 \\<equiv> max_vars e\"\n  assumes mxs: \"max_stack e = mxs\"\n    and mxl: \"Suc (length Ts + max_vars e) = mxl\"\n  assumes wf: \"wf_prog p P\" and wte: \"P,E \\<turnstile>\\<^sub>1 e :: T\" and \\<D>: \"\\<D> e A\"\n    and \\<B>: \"\\<B> e (size E)\" and E_P: \"set E \\<subseteq> types P\" and wid: \"P \\<turnstile> T \\<le> T\\<^sub>r\"\n  shows \"wt_method (compP\\<^sub>2 P) C Ts T\\<^sub>r mxs mxl\\<^sub>0 (compE\\<^sub>2 e @ [Return])\n    (compxE\\<^sub>2 e 0 0) (ty\\<^sub>i' [] E A # compT\\<^sub>a E A [] e)\"\n(*<*)(is \"wt_method ?P C Ts T\\<^sub>r mxs mxl\\<^sub>0 ?is ?xt ?\\<tau>s\")\nproof -\n  let ?n = \"length E + mxl\\<^sub>0\"\n  have wt_compE: \"P,T\\<^sub>r,mxs \\<turnstile> compE\\<^sub>2 e, compxE\\<^sub>2 e 0 (length []) [::]\n        TC0.ty\\<^sub>i' ?n [] E A # TC1.compT P ?n E A [] e @[TC0.after P ?n E A [] e]\"\n    using mxs TC2.compT_wt_instrs [OF wte \\<D> \\<B>, of \"[]\" mxs ?n T\\<^sub>r] by simp\n\n  have \"OK (ty\\<^sub>i' [T] E A') \\<in> states P mxs mxl\"\n    using mxs WT\\<^sub>1_is_type[OF wf wte E_P] max_stack1[of e] OK_ty\\<^sub>i'_in_statesI[OF E_P]\n      by simp\n  moreover have \"OK ` set (compT E A [] e) \\<subseteq> states P mxs mxl\"\n    using mxs mxl wid compT_states(1)[OF wf wte E_P] by simp\n  ultimately have \"check_types ?P mxs ?n (map OK ?\\<tau>s)\"\n    using mxl wte E_P by (simp add: compT\\<^sub>a_def after_def check_types_def)\n  moreover have \"wt_start ?P C Ts mxl\\<^sub>0 ?\\<tau>s\" using mxl\n    by (auto simp: wt_start_def ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth nth_Cons\n             split: nat.split)\n  moreover {\n    fix pc assume pc: \"pc < size ?is\"\n    then have \"?P,T\\<^sub>r,mxs,size ?is,?xt \\<turnstile> ?is!pc,pc :: ?\\<tau>s\"\n    proof(cases \"pc < length (compE\\<^sub>2 e)\")\n      case True\n      then show ?thesis using mxs wte wt_compE\n        by (clarsimp simp: compT\\<^sub>a_def mxl after_def wt_instrs_def)\n    next\n      case False\n      have \"length (compE\\<^sub>2 e) = pc\" using less_antisym[OF False] pc by simp\n      then show ?thesis using mxl wte E_P wid\n        by (clarsimp simp: compT\\<^sub>a_def after_def wt_defs xcpt_app_pcs xcpt_eff_pcs ty\\<^sub>i'_def)\n    qed\n  }\n  moreover have \"0 < size ?is\" and \"size ?\\<tau>s = size ?is\"\n    using wte by (simp_all add: compT\\<^sub>a_def)\n  ultimately show ?thesis by(simp add: wt_method_def)\nqed\n(*>*)\n\nend\n\ndefinition compTP :: \"J\\<^sub>1_prog \\<Rightarrow> ty\\<^sub>P\" where\n  \"compTP P C M = (\n  let (D,Ts,T,e) = method P C M;\n       E = Class C # Ts;\n       A = \\<lfloor>{..size Ts}\\<rfloor>;\n       mxl = 1 + size Ts + max_vars e\n  in  (TC0.ty\\<^sub>i' mxl [] E A # TC1.compT\\<^sub>a P mxl E A [] e))\"\n\ntheorem wt_compP\\<^sub>2:\nassumes wf: \"wf_J\\<^sub>1_prog P\" shows \"wf_jvm_prog (compP\\<^sub>2 P)\"\n(*<*)\nproof -\n  let ?\\<Phi> = \"compTP P\" and ?f = compMb\\<^sub>2\n  let ?wf\\<^sub>2 = \"\\<lambda>P C (M, Ts, T\\<^sub>r, mxs, mxl\\<^sub>0, is, xt).\n              wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (?\\<Phi> C M)\"\n    and ?P = \"compP ?f P\"\n  { fix C M Ts T m\n    assume cM: \"P \\<turnstile> C sees M :  Ts\\<rightarrow>T = m in C\"\n      and wfm: \"wf_mdecl wf_J\\<^sub>1_mdecl P C (M,Ts,T,m)\"\n    then have Ts_types: \"\\<forall>T'\\<in>set Ts. is_type P T'\"\n     and T_type: \"is_type P T\" and wfm\\<^sub>1: \"wf_J\\<^sub>1_mdecl P C (M,Ts,T,m)\"\n      by(simp_all add: wf_mdecl_def)\n    then obtain T' where wte: \"P,Class C#Ts \\<turnstile>\\<^sub>1 m :: T'\" and wid: \"P \\<turnstile> T' \\<le> T\"\n       and \\<D>: \"\\<D> m \\<lfloor>{..size Ts}\\<rfloor>\" and \\<B>: \"\\<B> m (Suc (size Ts))\"\n      by(auto simp: wf_mdecl_def)\n    have CTs_P: \"is_class P C \\<and> set Ts \\<subseteq> types P\"\n      using sees_wf_mdecl[OF wf cM] sees_method_is_class[OF cM]\n       by (clarsimp simp: wf_mdecl_def)\n\n    have \"?wf\\<^sub>2 ?P C (M,Ts,T,?f m)\"\n      using cM TC2.compT_method [simplified, OF _ _ wf wte \\<D> \\<B> CTs_P wid]\n       by(simp add: compTP_def)\n    then have \"wf_mdecl ?wf\\<^sub>2 ?P C (M, Ts, T, ?f m)\"\n      using Ts_types T_type by(simp add: wf_mdecl_def)\n  }\n  then have \"wf_prog ?wf\\<^sub>2 (compP ?f P)\" by(rule wf_prog_compPI[OF _ wf])\n  then show ?thesis by (simp add: wf_jvm_prog_def wf_jvm_prog_phi_def) fast\nqed\n(*>*)\n\ntheorem wt_J2JVM:\n  \"wf_J_prog P \\<Longrightarrow> wf_jvm_prog (J2JVM P)\"\n(*<*)\nby(simp only:o_def J2JVM_def)\n  (blast intro:wt_compP\\<^sub>2 compP\\<^sub>1_pres_wf)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Jinja/Compiler/TypeComp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.689305616785446, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.34734535367853997}}
{"text": "theory SimpleAllocator\n  imports Prelims\nbegin\n\nlocale SimpleAllocator =\n  (* variables *)\n  fixes unsat :: \"(Client \\<Rightarrow> Resource set) stfun\"\n  fixes alloc :: \"(Client \\<Rightarrow> Resource set) stfun\"\n  assumes bv: \"basevars (unsat, alloc)\"\n    (* set of available resources *)\n  fixes available :: \"Resource set stfun\"\n  defines \"available s \\<equiv> - (\\<Union>c. alloc s c)\"\n    (* initial state *)\n  fixes InitState :: stpred\n  defines \"InitState \\<equiv> PRED (\\<forall>c. id<alloc,#c> = #{} \\<and> id<unsat,#c> = #{})\"\n    (* client requests resources *)\n  fixes Request :: \"Client \\<Rightarrow> Resource set \\<Rightarrow> action\"\n  defines \"Request c S \\<equiv> ACT #S \\<noteq> #{} \\<and> id<$unsat,#c> = #{} \\<and> id<$alloc,#c> = #{}\n                    \\<and> #(finite S)\n                    \\<and> updated unsat c (add S)\n                    \\<and> unchanged alloc\"\n    (* allocator allocates resources *)\n  fixes Allocate :: \"Client \\<Rightarrow> Resource set \\<Rightarrow> action\"\n  defines \"Allocate c S \\<equiv> ACT (#S \\<noteq> #{} \\<and> (#S \\<subseteq> ($available \\<inter> id<$unsat,#c>))\n                    \\<and> (updated alloc c (add S))\n                    \\<and> (updated unsat c (del S)))\"\n    (* client returns resources *)\n  fixes Return :: \"Client \\<Rightarrow> Resource set \\<Rightarrow> action\"\n  defines \"Return c S \\<equiv> ACT (#S \\<noteq> #{} \\<and> #S \\<subseteq> id<$alloc,#c>\n                    \\<and> updated alloc c (del S)\n                    \\<and> unchanged unsat)\"\n    (* next-state relation *)\n  fixes Next :: action\n  defines \"Next \\<equiv> ACT (\\<exists> c S. Request c S \\<or> Allocate c S \\<or> Return c S)\"\n    (* fairness of Return *)\n  fixes ReturnFair :: \"Client \\<Rightarrow> temporal\"\n  defines \"ReturnFair c \\<equiv> TEMP WF(\\<exists>S. id<$alloc,#c> = #S \\<and> Return c S)_(unsat,alloc)\"\n    (* fairness of Allocate *)\n  fixes AllocateFair :: \"Client \\<Rightarrow> temporal\"\n  defines \"AllocateFair c \\<equiv> TEMP SF(\\<exists>S. Allocate c S)_(unsat,alloc)\"\n    (* full specification *)\n  fixes SimpleAllocator :: temporal\n  defines \"SimpleAllocator \\<equiv> TEMP (Init InitState \\<and> \\<box>[Next]_(unsat,alloc) \\<and>  (\\<forall>c. ReturnFair c) \\<and> (\\<forall>c. AllocateFair c))\"\n    (* mutual exclusion safety property *)\n  fixes MutualExclusion :: stpred\n  defines \"MutualExclusion \\<equiv> PRED \\<forall> c1 c2. #c1 \\<noteq> #c2 \\<longrightarrow> id<alloc,#c1> \\<inter> id<alloc,#c2> = #{}\"\n    (* finiteness safety property *)\n  fixes FiniteRequests :: stpred\n  defines \"FiniteRequests \\<equiv> PRED \\<forall> c. finite<id<unsat,#c>>\"\n    (* overall safety property *)\n  fixes Safety :: stpred\n  defines \"Safety \\<equiv> PRED (MutualExclusion \\<and> FiniteRequests)\"\n    (* allocation liveness property *)\n  fixes Liveness :: temporal\n  defines \"Liveness \\<equiv> TEMP (\\<forall> c r. #r \\<in> id<unsat,#c> \\<leadsto> #r \\<in> id<alloc,#c>)\"\n\ncontext SimpleAllocator\nbegin\n\ntheorem safety: \"\\<turnstile> SimpleAllocator \\<longrightarrow> \\<box>Safety\"\nproof invariant\n  fix sigma\n  assume sigma: \"sigma \\<Turnstile> SimpleAllocator\"\n\n  from sigma show \"sigma \\<Turnstile> Init Safety\"\n    by (auto simp add: Safety_def FiniteRequests_def MutualExclusion_def SimpleAllocator_def InitState_def Init_def)\n\n  show \"sigma \\<Turnstile> stable Safety\"\n  proof (intro Stable)\n    from sigma show \"sigma \\<Turnstile> \\<box>[Next]_(unsat,alloc)\" by (simp add: SimpleAllocator_def)\n\n    show \"\\<turnstile> $Safety \\<and> [Next]_(unsat, alloc) \\<longrightarrow> Safety$\"\n    proof (intro actionI temp_impI, clarsimp)\n      fix s t\n      assume s: \"s \\<Turnstile> Safety\" and st: \"(s,t) \\<Turnstile> [Next]_(unsat, alloc)\"\n\n      show \"t \\<Turnstile> Safety\"\n      proof (cases \"(s,t) \\<Turnstile> unchanged (unsat,alloc)\")\n        case True with s show ?thesis\n          by (auto simp add: Safety_def MutualExclusion_def FiniteRequests_def)\n      next\n        case False\n        with st have st: \"(s,t) \\<Turnstile> Next\" by (auto simp add: square_def)\n        then obtain c S where \"((s,t) \\<Turnstile> Request c S) \\<or> ((s,t) \\<Turnstile> Allocate c S) \\<or> ((s,t) \\<Turnstile> Return c S)\"\n          by (auto simp add: Next_def)\n        thus ?thesis\n        proof (elim disjE)\n          assume \"(s,t) \\<Turnstile> Request c S\"\n          with s show ?thesis\n            by (auto simp add: Safety_def MutualExclusion_def Request_def FiniteRequests_def updated_def add_def modifyAt_def)\n        next\n          assume \"(s,t) \\<Turnstile> Allocate c S\"\n          with s show ?thesis\n            by (auto simp add: Safety_def MutualExclusion_def Allocate_def available_def updated_def modifyAt_def add_def FiniteRequests_def del_def)\n        next\n          assume \"(s,t) \\<Turnstile> Return c S\" with s show ?thesis\n            by (auto simp add: Safety_def MutualExclusion_def FiniteRequests_def Return_def modifyAt_def updated_def del_def)\n        qed\n      qed\n    qed\n  qed\nqed\n\nlemma infinitely_often_available: \"\\<turnstile> SimpleAllocator \\<longrightarrow> \\<box>\\<diamond>(#r \\<in> available)\"\nproof (intro unstable_implies_infinitely_often)\n  have \"\\<turnstile> SimpleAllocator \\<longrightarrow> (#r \\<notin> available \\<leadsto> (\\<exists>c. #r \\<in> id<alloc,#c>))\"\n    by (intro imp_imp_leadsto, auto simp add: available_def)\n  also have \"\\<turnstile> SimpleAllocator \\<longrightarrow> ((\\<exists>c. #r \\<in> id<alloc,#c>) \\<leadsto> #r \\<in> available)\"\n  proof (intro imp_exists_leadstoI)\n    fix c\n\n    define SqN where \"SqN \\<equiv> ACT [Next]_(unsat,alloc)\"\n    define Saf where \"Saf \\<equiv> ACT $Safety\"\n    define E   where \"E \\<equiv> ACT (\\<exists>S. id<$alloc,#c> = #S \\<and> Return c S)\"\n    define L   where \"L \\<equiv> TEMP WF(E)_(unsat,alloc)\"\n    define P   where \"P \\<equiv> PRED (#r \\<in> id<alloc, #c>)\"\n    define Q   where \"Q \\<equiv> PRED (#r \\<in> available)\"\n\n    have \"\\<turnstile> SimpleAllocator \\<longrightarrow> \\<box>(SqN \\<and> Saf) \\<and> L\"\n    proof (intro temp_imp_conjI temp_imp_box_conjI)\n      show \"\\<turnstile> SimpleAllocator \\<longrightarrow> L\"\n        \"\\<turnstile> SimpleAllocator \\<longrightarrow> \\<box>SqN\"\n        by (auto simp add: SimpleAllocator_def ReturnFair_def L_def SqN_def E_def)\n      from safety show \"\\<turnstile> SimpleAllocator \\<longrightarrow> \\<box>Saf\" by (simp add: more_temp_simps Saf_def)\n    qed\n\n    also have \"\\<turnstile> \\<box>(SqN \\<and> Saf) \\<and> L \\<longrightarrow> (P \\<leadsto> Q)\"\n      unfolding L_def\n    proof (intro WF1)\n      show \"\\<turnstile> $P \\<and> SqN \\<and> Saf \\<longrightarrow> P$ \\<or> Q$\"\n      proof (intro actionI temp_impI, elim temp_conjE)\n        fix s t\n        assume \"(s,t) \\<Turnstile> $P\" hence r: \"r \\<in> alloc s c\" by (simp add: P_def)\n        assume \"(s,t) \\<Turnstile> Saf\" hence s: \"s \\<Turnstile> Safety\" by (simp add: Saf_def)\n        assume B: \"(s,t) \\<Turnstile> SqN\"\n        show \"(s,t) \\<Turnstile> P$ \\<or> Q$\"\n        proof (cases \"(s,t) \\<Turnstile> unchanged (unsat,alloc)\")\n          case True with r show ?thesis by (simp add: P_def)\n        next\n          case False\n          with B obtain c' S where \"((s,t) \\<Turnstile> Request c' S) \\<or> ((s,t) \\<Turnstile> Allocate c' S) \\<or> ((s,t) \\<Turnstile> Return c' S)\"\n            by (auto simp add: square_def Next_def SqN_def)\n          thus ?thesis\n          proof (elim disjE)\n            assume \"(s,t) \\<Turnstile> Request c' S\"\n            with r show ?thesis by (auto simp add: Request_def P_def)\n          next\n            assume \"(s,t) \\<Turnstile> Allocate c' S\"\n            with r show ?thesis\n              by (auto simp add: Allocate_def updated_def add_def P_def modifyAt_def)\n          next\n            assume \"(s,t) \\<Turnstile> Return c' S\"\n            hence [simp]: \"alloc t c'' = (if c' = c'' then del S else id) (alloc s c'')\" for c''\n              by (simp add: updated_def Return_def)\n            from r s show ?thesis\n              by (auto simp add: available_def del_def Safety_def MutualExclusion_def P_def Q_def)\n          qed\n        qed\n      qed\n\n      show \"\\<turnstile> ($P \\<and> SqN \\<and> Saf) \\<and> <E>_(unsat, alloc) \\<longrightarrow> Q$\"\n      proof (intro actionI temp_impI, elim temp_conjE)\n        fix s t\n        assume \"(s,t) \\<Turnstile> <E>_(unsat, alloc)\"\n        hence [simp]: \"alloc t c' = (if c = c' then del (alloc s c) else id) (alloc s c')\" for c'\n          by (auto simp add: angle_def Return_def E_def updated_def)\n\n        assume \"(s,t) \\<Turnstile> Saf\" hence mutex: \"s \\<Turnstile> MutualExclusion\" by (simp add: Saf_def Safety_def)\n        assume \"(s,t) \\<Turnstile> $P\"\n        with mutex show \"(s,t) \\<Turnstile> Q$\"\n          by (auto simp add: P_def Q_def available_def del_def MutualExclusion_def)\n      qed\n\n      show \"\\<turnstile> $P \\<and> SqN \\<and> Saf \\<longrightarrow> $Enabled (<E>_(unsat, alloc))\"\n      proof (intro actionI temp_impI, elim temp_conjE)\n        fix s t\n        assume \"(s,t) \\<Turnstile> ($P)\" hence r: \"r \\<in> alloc s c\" by (simp add: P_def)\n\n        from basevars [OF bv]\n        obtain u where\n          \"alloc u = (\\<lambda>a'. (if c = a' then del (alloc s c) else id) (alloc s a'))\"\n          and u: \"unsat u = unsat s\" by auto\n\n        hence [simp]: \"alloc u c' = (if c = c' then del (alloc s c) else id) (alloc s c')\" for c' by auto\n\n        from r have \"alloc u c \\<noteq> alloc s c\" by (auto simp add: del_def)\n        hence ne: \"alloc u \\<noteq> alloc s\" by force\n\n        from u ne r show \"(s,t) \\<Turnstile> $Enabled (<E>_(unsat, alloc))\"\n          by (simp add: enabled_def angle_def E_def, unfold Return_def, intro exI [where x = u],\n              auto simp add: updated_def, intro ext, auto simp add: modifyAt_def)\n      qed\n    qed\n\n    finally show \"\\<turnstile> SimpleAllocator \\<longrightarrow> (#r \\<in> id<alloc, #c> \\<leadsto> #r \\<in> available)\"\n      by (simp add: P_def Q_def)\n  qed\n  finally show \"\\<turnstile> SimpleAllocator \\<longrightarrow> (#r \\<notin> available \\<leadsto> #r \\<in> available)\".\nqed\n\ndefinition isWaitingFor :: \"Client \\<Rightarrow> Resource \\<Rightarrow> Resource set \\<Rightarrow> stpred\"\n  where \"isWaitingFor c r S \\<equiv> PRED id<unsat,#c> = #S \\<and> #r \\<in> #S\"\n\ndefinition hasResource :: \"Client \\<Rightarrow> Resource \\<Rightarrow> stpred\"\n  where \"hasResource c r \\<equiv> PRED #r \\<in> id<alloc,#c>\"\n\ndefinition less_finite_Resource_set where \"less_finite_Resource_set \\<equiv> {(S1 :: Resource set, S2). finite S2 \\<and> S1 \\<subset> S2}\"\n\nlemma wf_less_finite_Resource_set: \"wf less_finite_Resource_set\"\n  unfolding less_finite_Resource_set_def by (intro wf_less_finite)\n\nlemma less_Resource_set_simp[simp]:\n  \"((S1,S2) \\<in> less_finite_Resource_set) = ((S1 \\<subset> S2) \\<and> finite S2)\"\n  by (auto simp add: less_finite_Resource_set_def)\n\nlemma Liveness: \"\\<turnstile> SimpleAllocator \\<longrightarrow> Liveness\" unfolding Liveness_def\nproof (intro imp_forall)\n  fix c r\n\n  define N   where \"N  \\<equiv> ACT [Next]_(unsat,alloc)\"\n  define A   where \"A  \\<equiv> ACT (\\<exists>S. Allocate c S)\"\n  define F   where \"F  \\<equiv> TEMP (\\<diamond>(#r \\<in> available) \\<and> \\<box>Safety)\"\n  define Sp  where \"Sp \\<equiv> TEMP \\<box>N \\<and> SF(A)_(unsat,alloc) \\<and> \\<box>F\"\n\n  from safety\n  have \"\\<turnstile> SimpleAllocator \\<longrightarrow> Sp\"\n    unfolding Sp_def\n  proof (intro temp_imp_conjI)\n    show \"\\<turnstile> SimpleAllocator \\<longrightarrow> \\<box>N\" by (auto simp add: N_def SimpleAllocator_def)\n    show \"\\<turnstile> SimpleAllocator \\<longrightarrow> SF(A)_(unsat, alloc)\"\n      by (auto simp add: A_def SimpleAllocator_def AllocateFair_def)\n\n    from infinitely_often_available split_box_conj boxInit_stp safety\n    show \"\\<turnstile> SimpleAllocator \\<longrightarrow> \\<box>F\"\n      unfolding F_def by (auto simp add: Valid_def more_temp_simps)\n  qed\n\n  also have \"\\<turnstile> Sp \\<longrightarrow> (#r \\<in> id<unsat, #c> \\<leadsto> (\\<exists>S. isWaitingFor c r S))\"\n    unfolding isWaitingFor_def\n    by (intro imp_imp_leadsto, auto)\n\n  moreover have \"\\<turnstile> Sp \\<longrightarrow> ((\\<exists>S. isWaitingFor c r S) \\<leadsto> hasResource c r)\"\n  proof (intro imp_exists_leadstoI wf_imp_leadsto[where G = \"hasResource c r\", OF wf_less_finite_Resource_set], simp)\n    fix S0\n    define P where \"P \\<equiv> PRED isWaitingFor c r S0 \\<and> #(finite S0)\"\n\n    have \"\\<turnstile> Sp \\<longrightarrow> (isWaitingFor c r S0 \\<leadsto> P)\"\n    proof (intro imp_box_imp_leadsto)\n      have \"\\<turnstile> Sp \\<longrightarrow> \\<box>FiniteRequests\"\n        unfolding Sp_def F_def Safety_def by (auto simp add: more_temp_simps)\n\n      also have \"\\<turnstile> \\<box>FiniteRequests \\<longrightarrow> \\<box>(isWaitingFor c r S0 \\<longrightarrow> P)\"\n        by (intro STL4, auto simp add: FiniteRequests_def isWaitingFor_def P_def)\n\n      finally show  \"\\<turnstile> Sp \\<longrightarrow> \\<box>(isWaitingFor c r S0 \\<longrightarrow> P)\".\n    qed\n\n    also have \"\\<turnstile> Sp \\<longrightarrow> (P \\<leadsto> hasResource c r \\<or> (\\<exists>y. #(y \\<subset> S0 \\<and> finite S0) \\<and> isWaitingFor c r y))\"\n      unfolding Sp_def\n    proof (intro SF1)\n      show \"\\<turnstile> $P \\<and> N \\<longrightarrow> P$ \\<or> (hasResource c r \\<or> (\\<exists>y. #(y \\<subset> S0 \\<and> finite S0) \\<and> isWaitingFor c r y))$\"\n        unfolding N_def square_def\n      proof (intro actionI temp_impI, elim temp_conjE temp_disjE)\n        fix s t\n        assume \"(s,t) \\<Turnstile> $P\" \"(s,t) \\<Turnstile> unchanged (unsat, alloc)\"\n        thus \"(s,t) \\<Turnstile> P$ \\<or> (hasResource c r \\<or> (\\<exists>y. #(y \\<subset> S0 \\<and> finite S0) \\<and> isWaitingFor c r y))$\"\n          by (auto simp add: isWaitingFor_def P_def)\n      next\n        fix s t\n        assume \"(s,t) \\<Turnstile> $P\"\n        hence waiting: \"s \\<Turnstile> isWaitingFor c r S0\" and finite_S0: \"finite S0\" unfolding P_def by auto\n        assume \"(s,t) \\<Turnstile> Next\"\n        thus \"(s,t) \\<Turnstile> P$ \\<or> (hasResource c r \\<or> (\\<exists>y. #(y \\<subset> S0 \\<and> finite S0) \\<and> isWaitingFor c r y))$\"\n        proof (unfold Next_def, elim temp_exE temp_disjE)\n          fix c' S\n          assume \"(s,t) \\<Turnstile> Request c' S\"\n          with waiting have \"t \\<Turnstile> isWaitingFor c r S0\"\n            by (auto simp add: isWaitingFor_def Request_def updated_def modifyAt_def)\n          with finite_S0 show ?thesis unfolding P_def by simp\n        next\n          fix c' S\n          assume \"(s,t) \\<Turnstile> Return c' S\"\n          with waiting have \"t \\<Turnstile> isWaitingFor c r S0\"\n            by (auto simp add: isWaitingFor_def Return_def)\n          with finite_S0 show ?thesis unfolding P_def by simp\n        next\n          fix c' S\n          assume Allocate: \"(s,t) \\<Turnstile> Allocate c' S\"\n          show ?thesis\n          proof (cases \"c = c'\")\n            case False\n            with waiting Allocate have \"t \\<Turnstile> isWaitingFor c r S0\"\n              by (auto simp add: isWaitingFor_def Allocate_def updated_def)\n            with finite_S0 show ?thesis unfolding P_def by simp\n          next\n            case True\n            with Allocate have Allocate: \"(s,t) \\<Turnstile> Allocate c S\" by simp\n\n            show ?thesis\n            proof (cases \"r \\<in> S\")\n              case False\n              with waiting Allocate\n              have \"(s,t) \\<Turnstile> (isWaitingFor c r (S0-S))$\"\n                by (auto simp add: Allocate_def updated_def isWaitingFor_def)\n              hence \"(s,t) \\<Turnstile> (\\<exists>y. #(y \\<subset> S0 \\<and> finite S0) \\<and> isWaitingFor c r y)$\"\n              proof (intro action_afterI temp_exI [of _ \"S0-S\"] temp_conjI, auto)\n                assume \"S0-S = S0\" with Allocate waiting\n                show False by (auto simp add: isWaitingFor_def Allocate_def)\n              qed (intro finite_S0)\n              thus ?thesis by simp\n            next\n              case True\n              with Allocate have \"t \\<Turnstile> hasResource c r\"\n                by (auto simp add: Allocate_def hasResource_def updated_def)\n              thus ?thesis by simp\n            qed\n          qed\n        qed\n      qed\n\n      have \"\\<turnstile> (($P \\<and> N) \\<and> <A>_(unsat, alloc))\n        \\<longrightarrow> (\\<exists>S. $isWaitingFor c r S0 \\<and> $#(finite S0) \\<and> Allocate c S)\" unfolding P_def A_def angle_def by auto\n      also have \"\\<turnstile> (\\<exists>S. $isWaitingFor c r S0 \\<and> $#(finite S0) \\<and> Allocate c S)\n        \\<longrightarrow> ((hasResource c r \\<or> (\\<exists>y. #(y \\<subset> S0 \\<and> finite S0) \\<and> isWaitingFor c r y))$)\"\n      proof (intro temp_ex_impI)\n        fix S\n        show \"\\<turnstile> $isWaitingFor c r S0 \\<and> $#(finite S0) \\<and> Allocate c S \\<longrightarrow> (hasResource c r \\<or> (\\<exists>y. #(y \\<subset> S0 \\<and> finite S0) \\<and> isWaitingFor c r y))$\"\n        proof (cases \"r \\<in> S\")\n          case True\n          hence \"\\<turnstile> $isWaitingFor c r S0 \\<and> Allocate c S \\<longrightarrow> (hasResource c r)$\"\n            by (auto simp add: isWaitingFor_def Allocate_def hasResource_def updated_def)\n          thus ?thesis by auto\n        next\n          case False\n          hence \"\\<turnstile> $isWaitingFor c r S0 \\<and> Allocate c S \\<longrightarrow> (isWaitingFor c r (S0-S))$\"\n            by (auto simp add: isWaitingFor_def Allocate_def updated_def)\n          moreover from False have \"\\<turnstile> $isWaitingFor c r S0 \\<and> Allocate c S \\<longrightarrow> #(S0-S \\<subset> S0)\"\n            by (auto simp add: isWaitingFor_def Allocate_def updated_def available_def, blast)\n          ultimately show ?thesis\n            apply auto\n            by (smt Valid_def unl_after unl_before unl_con unl_lift2)\n        qed\n      qed\n      finally show \"\\<turnstile> ($P \\<and> N) \\<and> <A>_(unsat, alloc) \\<longrightarrow> (hasResource c r \\<or> (\\<exists>y. #(y \\<subset> S0 \\<and> finite S0) \\<and> isWaitingFor c r y))$\".\n\n      have \"\\<turnstile> \\<box>P \\<and> \\<box>N \\<and> \\<box>F \\<longrightarrow> (\\<box>P \\<and> \\<box>\\<diamond>(#r \\<in> available))\"\n        by (auto simp add: isWaitingFor_def F_def more_temp_simps split_box_conj)\n\n      also have \"\\<turnstile> (\\<box>P \\<and> \\<box>\\<diamond>(#r \\<in> available)) \\<longrightarrow> \\<diamond>(P \\<and> #r \\<in> available)\"\n        by (intro imp_infinitely_often_implies_eventually box_conj_box_dmd)\n\n      also have \"\\<turnstile> \\<diamond>(P \\<and> #r \\<in> available) \\<longrightarrow> \\<diamond>(Enabled (<A>_(unsat, alloc)))\"\n      proof (intro DmdImpl, intro intI temp_impI, elim temp_conjE)\n        fix w\n        assume \"w \\<Turnstile> P\" hence w: \"w \\<Turnstile> isWaitingFor c r S0\" \"finite S0\" by (simp_all add: P_def)\n        assume \"w \\<Turnstile> #r \\<in> available\" note w = w this\n\n        from basevars [OF bv]\n        obtain u where u:\n          \"alloc u = modifyAt (alloc w) c (add {r})\"\n          \"unsat u = modifyAt (unsat w) c (del {r})\" by auto\n\n        show \"w \\<Turnstile> Enabled (<A>_(unsat, alloc))\"\n        proof (auto simp add: angle_def enabled_def A_def Allocate_def updated_def modifyAt_def,\n            intro exI [of _ u] conjI exI [of _ \"{r}\"] u impI)\n          from w show \"{r} \\<noteq> {}\" \"{r} \\<subseteq> available w\" \"{r} \\<subseteq> unsat w c\"\n            by (auto simp add: isWaitingFor_def)\n\n          assume \"unsat u = unsat w\"\n          hence \"unsat u c = unsat w c\" by simp\n          with u w show \"alloc u \\<noteq> alloc w\"\n            by (auto simp add: isWaitingFor_def)\n        qed\n      qed\n      finally show \"\\<turnstile> \\<box>P \\<and> \\<box>N \\<and> \\<box>F \\<longrightarrow> \\<diamond>Enabled (<A>_(unsat, alloc))\" .\n    qed\n    finally show \"\\<turnstile> Sp \\<longrightarrow> (isWaitingFor c r S0 \\<leadsto> hasResource c r \\<or> (\\<exists>y. #(y \\<subset> S0 \\<and> finite S0) \\<and> isWaitingFor c r y))\".\n  qed\n  ultimately show \"\\<turnstile> SimpleAllocator \\<longrightarrow> (#r \\<in> id<unsat, #c> \\<leadsto> #r \\<in> id<alloc, #c>)\"\n    unfolding hasResource_def\n    by (meson imp_leadsto_transitive temp_imp_trans)\nqed\n\nend\n\nend", "meta": {"author": "DaveCTurner", "repo": "tla-examples", "sha": "fd566a8bd41fbb317d2f0f7aa58e3086f4aff46f", "save_path": "github-repos/isabelle/DaveCTurner-tla-examples", "path": "github-repos/isabelle/DaveCTurner-tla-examples/tla-examples-fd566a8bd41fbb317d2f0f7aa58e3086f4aff46f/Allocator/SimpleAllocator.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6893056040203135, "lm_q2_score": 0.5039061705290806, "lm_q1q2_score": 0.347345347246111}}
{"text": "theory SINVAR_Dependability_norefl_impl\nimports SINVAR_Dependability_norefl \"../TopoS_Interface_impl\"\nbegin\n\n\ncode_identifier code_module SINVAR_Dependability_norefl_impl => (Scala) SINVAR_Dependability_norefl\n\n\nsubsubsection \\<open>SecurityInvariant Dependability norefl List Implementation\\<close>\n\n\nfun sinvar :: \"'v list_graph \\<Rightarrow> ('v \\<Rightarrow> dependability_level) \\<Rightarrow> bool\" where\n  \"sinvar G nP = (\\<forall> (e1,e2) \\<in> set (edgesL G). (num_reachable_norefl G e1) \\<le> (nP e1))\"\n\n\nvalue \"sinvar \n    \\<lparr> nodesL = [1::nat,2,3,4], edgesL = [(1,2), (2,3), (3,4), (8,9),(9,8)] \\<rparr>\n    (\\<lambda>e. 3)\"\nvalue \"sinvar \n    \\<lparr> nodesL = [1::nat,2,3,4,8,9,10], edgesL = [(1,2), (2,3), (3,4), (8,9),(9,8)] \\<rparr>\n    (\\<lambda>e. 2)\"\n\n\n\ndefinition Dependability_norefl_offending_list:: \"'v list_graph \\<Rightarrow> ('v \\<Rightarrow> dependability_level) \\<Rightarrow> ('v \\<times> 'v) list list\" where\n  \"Dependability_norefl_offending_list = Generic_offending_list sinvar\"\n\n\n\ndefinition \"NetModel_node_props P = (\\<lambda> i. (case (node_properties P) i of Some property \\<Rightarrow> property | None \\<Rightarrow> SINVAR_Dependability_norefl.default_node_properties))\"\n\n\ndefinition \"Dependability_norefl_eval G P = (wf_list_graph G \\<and>\n  sinvar G (SecurityInvariant.node_props SINVAR_Dependability_norefl.default_node_properties P))\"\n\n\n\nlemma sinvar_correct: \"wf_list_graph G \\<Longrightarrow> SINVAR_Dependability_norefl.sinvar (list_graph_to_graph G) nP = sinvar G nP\"\n   apply(simp)\n   apply(rule all_edges_list_I)\n   apply(simp add: fun_eq_iff)\n   apply(clarify)\n   apply(rename_tac x)\n   apply(drule_tac v=\"x\" in  num_reachable_norefl_correct)\n   apply presburger\ndone\n\n\n\ninterpretation Dependability_norefl_impl:TopoS_List_Impl \n  where default_node_properties=SINVAR_Dependability_norefl.default_node_properties\n  and sinvar_spec=SINVAR_Dependability_norefl.sinvar\n  and sinvar_impl=sinvar\n  and receiver_violation=SINVAR_Dependability_norefl.receiver_violation\n  and offending_flows_impl=Dependability_norefl_offending_list\n  and node_props_impl=NetModel_node_props\n  and eval_impl=Dependability_norefl_eval\n apply(unfold TopoS_List_Impl_def)\n apply(rule conjI)\n  apply(rule conjI)\n   apply(simp add: TopoS_Dependability_norefl; fail)\n  apply(intro allI impI)\n  apply(fact sinvar_correct)\n apply(rule conjI)\n  apply(unfold Dependability_norefl_offending_list_def)\n  apply(intro allI impI)\n  apply(rule Generic_offending_list_correct)\n   apply(assumption)\n  apply(simp only: sinvar_correct)\n apply(rule conjI)\n  apply(intro allI)\n  apply(simp only: NetModel_node_props_def)\n  apply(metis Dependability.node_props.simps Dependability.node_props_eq_node_props_formaldef)\n apply(simp only: Dependability_norefl_eval_def)\n apply(intro allI impI)\n apply(rule TopoS_eval_impl_proofrule[OF TopoS_Dependability_norefl])\n apply(simp only: sinvar_correct)\ndone\n\n\nsubsubsection \\<open>packing\\<close>\n  definition SINVAR_LIB_Dependability_norefl :: \"('v::vertex, SINVAR_Dependability_norefl.dependability_level) TopoS_packed\" where\n    \"SINVAR_LIB_Dependability_norefl \\<equiv> \n    \\<lparr> nm_name = ''Dependability_norefl'', \n      nm_receiver_violation = SINVAR_Dependability_norefl.receiver_violation,\n      nm_default = SINVAR_Dependability_norefl.default_node_properties, \n      nm_sinvar = sinvar,\n      nm_offending_flows = Dependability_norefl_offending_list, \n      nm_node_props = NetModel_node_props,\n      nm_eval = Dependability_norefl_eval\n      \\<rparr>\"\n  interpretation SINVAR_LIB_Dependability_norefl_interpretation: TopoS_modelLibrary SINVAR_LIB_Dependability_norefl\n      SINVAR_Dependability_norefl.sinvar\n    apply(unfold TopoS_modelLibrary_def SINVAR_LIB_Dependability_norefl_def)\n    apply(rule conjI)\n     apply(simp)\n    apply(simp)\n    by(unfold_locales)\n\n\nhide_fact (open) sinvar_correct\nhide_const (open) sinvar NetModel_node_props\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Security_Invariants/SINVAR_Dependability_norefl_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442251064863698, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.34722652274188986}}
{"text": "theory InferVar\n  imports WTLemma\nbegin\n  \n    (* ##### TO MOVE *)\n  \nlemma add_rem_use_env: \"add_use_env (rem_use_env r_s x) x (r_s x) = r_s\"    \n  apply (case_tac \"\\<forall> x'. add_use_env (rem_use_env r_s x) x (r_s x) x' = r_s x'\")  \n   apply (auto)\n  apply (simp add: add_use_env_def)\n  apply (case_tac \"x = x'\")\n   apply (auto)\n  apply (simp add: rem_use_env_def)\n  done  \n  \nlemma max_aff_leq: \"\\<lbrakk> aff_leq a1 ax; aff_leq a2 ax \\<rbrakk> \\<Longrightarrow> aff_leq (max_aff a1 a2) ax\"    \n  apply (case_tac a1)\n    apply (auto)\n   apply (case_tac a2)\n     apply (auto)\n  apply (case_tac a2)\n    apply (auto)\n  done  \n  \n    (* ##### extended environment definitions *)\n    (* schema types *)\n  \ntype_synonym p_var = nat\ntype_synonym t_var = nat\n\ndatatype s_perm = SPerm p_perm | SVar p_var\n  \ndatatype s_aff = AffConst p_aff | AffVar p_var\n\ndatatype x_perm = XPerm s_perm | XType nat | XComp x_perm x_perm | XLift x_perm s_perm | XIfZero x_perm x_perm\n  \ndatatype s_type =\n   IntScheme | UnitScheme | BoolScheme\n  | VarScheme t_var\n  | ArrayScheme s_type  \n  | PairScheme s_type s_type s_perm\n  | FunScheme s_type s_type s_perm s_aff\n  | ChanScheme s_type c_end\n\ndefinition pure_fun_s where\n  \"pure_fun_s t1 t2 a = FunScheme t1 t2 (SPerm UsePerm) a\"\n  \n    (* schema perm envs *)\n\ntype_synonym perm_var_env = \"res_id \\<Rightarrow> x_perm\"      \n    \ndefinition empty_var_env where\n  \"empty_var_env = (\\<lambda> x. XPerm (SPerm NoPerm))\"  \n  \ndefinition one_var_env where\n  \"one_var_env x q = (\\<lambda> x'. if x' = x then q else XPerm (SPerm NoPerm))\" \n  \ndefinition add_var_env where\n  \"add_var_env r_s x q = (\\<lambda> x'. if x' = x then q else r_s x)\"\n  \ndefinition rem_var_env where\n  \"rem_var_env r_s x = (\\<lambda> x'. if x' = x then XPerm (SPerm NoPerm) else r_s x')\"  \n  \ndefinition comp_var_env where\n  \"comp_var_env r_s r_x = (\\<lambda> x. if r_s x = XPerm (SPerm NoPerm) \\<and> r_x x = XPerm (SPerm NoPerm) then XPerm (SPerm NoPerm) else XComp (r_s x) (r_x x))\"\n\ndefinition lift_var_env where\n  \"lift_var_env r_s r = (\\<lambda> x. if r_s x = XPerm (SPerm NoPerm) then r_s x else XLift (r_s x) r)\"\n  \ndefinition ifz_var_env where\n  \"ifz_var_env r r_s = (\\<lambda> x. if r_s x = XPerm (SPerm NoPerm) then XPerm (SPerm NoPerm) else XIfZero r (r_s x))\"\n\n    (* solution substitution *)\n  \ntype_synonym 'a subst_env = \"('a, nat) gen_env\"  \n  \ntype_synonym type_subst = \"s_type subst_env\"\ntype_synonym dir_type_subst = \"p_type subst_env\"  \n  \ntype_synonym perm_subst = \"nat \\<Rightarrow> p_perm\"  \n\nfun sol_subst_aff where\n  \"sol_subst_aff p_sub (AffConst a) = a\"\n| \"sol_subst_aff p_sub (AffVar x) = as_aff (p_sub x)\"  \n  \nfun sol_subst_perm :: \"perm_subst \\<Rightarrow> s_perm \\<Rightarrow> p_perm\" where\n  \"sol_subst_perm p_sub (SPerm p) = p\"  \n| \"sol_subst_perm p_sub (SVar x) = p_sub x\"\n  \nfun dir_subst_permx :: \"dir_type_subst \\<Rightarrow> perm_subst \\<Rightarrow> x_perm \\<Rightarrow> p_perm\" where\n  \"dir_subst_permx t_sub p_sub (XPerm p) = (sol_subst_perm p_sub p)\"\n| \"dir_subst_permx t_sub p_sub (XType a) = (case t_sub a of\n    None \\<Rightarrow> NoPerm\n    | Some tau \\<Rightarrow> as_perm (req_type tau))\"\n| \"dir_subst_permx t_sub p_sub (XComp p1 p2) = union_perm (dir_subst_permx t_sub p_sub p1) (dir_subst_permx t_sub p_sub p2)\"\n| \"dir_subst_permx t_sub p_sub (XLift p q) = (if sol_subst_perm p_sub q = OwnPerm \\<and>\n  dir_subst_permx t_sub p_sub p \\<noteq> NoPerm then OwnPerm else dir_subst_permx t_sub p_sub p)\"\n| \"dir_subst_permx t_sub p_sub (XIfZero p q) = (if dir_subst_permx t_sub p_sub p = NoPerm then NoPerm else dir_subst_permx t_sub p_sub q)\"  \n\ndefinition dir_subst_penv :: \"dir_type_subst \\<Rightarrow> perm_subst \\<Rightarrow> perm_var_env \\<Rightarrow> perm_use_env\" where\n  \"dir_subst_penv t_sub p_sub r_s = (\\<lambda> x. dir_subst_permx t_sub p_sub (r_s x))\"    \n  \nfun dir_subst_type :: \"dir_type_subst \\<Rightarrow> perm_subst \\<Rightarrow> s_type \\<Rightarrow> p_type \\<Rightarrow> bool\" where\n  \"dir_subst_type t_sub p_sub IntScheme tau' = (tau' = IntTy)\"  \n| \"dir_subst_type t_sub p_sub UnitScheme tau' = (tau' = UnitTy)\"\n| \"dir_subst_type t_sub p_sub BoolScheme tau' = (tau' = BoolTy)\"\n| \"dir_subst_type t_sub p_sub (VarScheme a) tau' = (t_sub a = Some tau')\"\n| \"dir_subst_type t_sub p_sub (ArrayScheme tau) tau' = (\\<exists> tau_x.\n  dir_subst_type t_sub p_sub tau tau_x \\<and> tau' = ArrayTy tau_x)\"\n| \"dir_subst_type t_sub p_sub (PairScheme t1 t2 p) tau' = (\\<exists> t1_x t2_x.\n  dir_subst_type t_sub p_sub t1 t1_x \\<and> dir_subst_type t_sub p_sub t2 t2_x \\<and>\n  tau' = PairTy t1_x t2_x (sol_subst_perm p_sub p))\"\n| \"dir_subst_type t_sub p_sub (FunScheme t1 t2 p q) tau' = (\\<exists> t1_x t2_x.\n  dir_subst_type t_sub p_sub t1 t1_x \\<and> dir_subst_type t_sub p_sub t2 t2_x \\<and>\n  tau' = FunTy t1_x t2_x (sol_subst_perm p_sub p) (sol_subst_aff p_sub q))\"\n| \"dir_subst_type t_sub p_sub (ChanScheme tau c_end) tau' = (\\<exists> tau_x.\n  dir_subst_type t_sub p_sub tau tau_x \\<and> tau' = ChanTy tau_x c_end)\"   \n  \ndefinition dir_subst_tenv :: \"dir_type_subst \\<Rightarrow> nat res_env => pt_env\" where\n  \"dir_subst_tenv t_sub env_v = (\\<lambda> x. case env_v x of\n    None \\<Rightarrow> None\n    | Some a \\<Rightarrow> t_sub a)\"\n  \nfun full_subst_type_f :: \"dir_type_subst \\<Rightarrow> perm_subst \\<Rightarrow> p_type \\<Rightarrow> s_type \\<Rightarrow> p_type\" where\n  \"full_subst_type_f t_sub p_sub tau_n IntScheme = IntTy\"\n| \"full_subst_type_f t_sub p_sub tau_n UnitScheme = UnitTy\"  \n| \"full_subst_type_f t_sub p_sub tau_n BoolScheme = BoolTy\"\n| \"full_subst_type_f t_sub p_sub tau_n (VarScheme x) = (case t_sub x of\n    None \\<Rightarrow> tau_n\n    | Some tau \\<Rightarrow> tau\n  )\"\n| \"full_subst_type_f t_sub p_sub tau_n (ArrayScheme tau) = ArrayTy (full_subst_type_f t_sub p_sub tau_n tau)\"  \n| \"full_subst_type_f t_sub p_sub tau_n (PairScheme t1 t2 p) =\n    PairTy (full_subst_type_f t_sub p_sub tau_n t1) (full_subst_type_f t_sub p_sub tau_n t2) (sol_subst_perm p_sub p)\"\n| \"full_subst_type_f t_sub p_sub tau_n (FunScheme t1 t2 p q) = FunTy (full_subst_type_f t_sub p_sub tau_n t1)\n  (full_subst_type_f t_sub p_sub tau_n t2) (sol_subst_perm p_sub p) (sol_subst_aff p_sub q)\"  \n| \"full_subst_type_f t_sub p_sub tau_n (ChanScheme tau c_end) = ChanTy (full_subst_type_f t_sub p_sub tau_n tau) c_end\"  \n  \ndefinition full_subst_type where\n  \"full_subst_type t_sub p_sub tau_n tau_v = full_subst_type_f t_sub p_sub tau_n tau_v\"  \n  \ndefinition fill_tsub :: \"dir_type_subst \\<Rightarrow> p_type \\<Rightarrow> dir_type_subst\" where  \n  \"fill_tsub t_sub tau_n = (\\<lambda> x. case t_sub x of None \\<Rightarrow> Some tau_n | Some tau \\<Rightarrow> Some tau)\"\n  \n    (* ##### lemmas *)\n  \nlemma subst_empty_var_env: \"dir_subst_penv t_sub p_sub empty_var_env = empty_use_env\"  \n  apply (case_tac \"\\<forall> x. dir_subst_penv t_sub p_sub empty_var_env x = empty_use_env x\")\n   apply (auto)\n  apply (simp add: empty_var_env_def)\n  apply (simp add: empty_use_env_def)\n  apply (simp add: dir_subst_penv_def)\n  done\n  \n    \nlemma end_req_aff_leq_perm: \"\\<lbrakk> aff_leq (req_type tau) (sol_subst_perm p_sub (SVar p)) \\<rbrakk> \\<Longrightarrow>\n  leq_perm (end_req_perm tau) (dir_subst_permx t_sub p_sub (one_var_env x (XPerm (SVar p)) x))\"    \n  apply (simp add: one_var_env_def)\n  apply (simp add: end_req_perm_def)\n  apply (case_tac \"req_type tau\")\n    apply (auto)\n   apply (case_tac \"sol_subst_perm p_sub (SVar p)\")\n     apply (auto)\n  apply (case_tac \"sol_subst_perm p_sub (SVar p)\")\n    apply (auto)\n  done\n    \nlemma lift_sol_subst_penv: \"lift_use_env (dir_subst_penv t_sub p_sub r_s) (sol_subst_perm p_sub r) = dir_subst_penv t_sub p_sub (lift_var_env r_s r)\"     \n  apply (case_tac \"\\<forall> x. lift_use_env (dir_subst_penv t_sub p_sub r_s) (sol_subst_perm p_sub r) x = dir_subst_penv t_sub p_sub (lift_var_env r_s r) x\")\n  apply (auto)\n  apply (simp add: dir_subst_penv_def)\n  apply (simp add: lift_var_env_def)\n  apply (case_tac \"sol_subst_perm p_sub r\")\n    apply (auto)\n  done\n \nlemma lift_sol_subst_penvx: \"lift_use_env (dir_subst_penv t_sub p_sub r_s) (p_sub r) = dir_subst_penv t_sub p_sub (lift_var_env r_s (SVar r))\"     \n  apply (case_tac \"\\<forall> x. lift_use_env (dir_subst_penv t_sub p_sub r_s) (p_sub r) x = dir_subst_penv t_sub p_sub (lift_var_env r_s (SVar r)) x\")\n  apply (auto)\n  apply (simp add: dir_subst_penv_def)\n  apply (simp add: lift_var_env_def)\n  apply (case_tac \"p_sub r\")\n    apply (auto)\n  done    \n    \nlemma comp_sol_subst_penv: \"dir_subst_penv t_sub p_sub (comp_var_env r_s r_x) = comp_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_x)\"    \n  apply (case_tac \"\\<forall> x. dir_subst_penv t_sub p_sub (comp_var_env r_s r_x) x = comp_use_env (dir_subst_penv t_sub p_sub r_s) (dir_subst_penv t_sub p_sub r_x) x\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: comp_var_env_def)\n  apply (simp add: dir_subst_penv_def)\n  apply (case_tac \"r_s x = XPerm (SPerm NoPerm) \\<and> r_x x = XPerm (SPerm NoPerm)\")\n   apply (auto)\n  done\n    \nlemma dist_comp_leq_var_env: \"\\<lbrakk> leq_use_env (dir_subst_penv t_sub p_sub r_x1) r_s;\n  leq_use_env (dir_subst_penv t_sub p_sub r_x2) r_s \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (dir_subst_penv t_sub p_sub (comp_var_env r_x1 r_x2)) r_s\"\n  apply (simp add: comp_sol_subst_penv)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (simp_all)\n  done\n\nlemma comp_leq_var_env1: \"\\<lbrakk> leq_use_env r_x (dir_subst_penv t_sub p_sub r_s1) \\<rbrakk> \\<Longrightarrow>\n  leq_use_env r_x (dir_subst_penv t_sub p_sub (comp_var_env r_s1 r_s2))\"    \n  apply (simp add: comp_sol_subst_penv)\n  apply (rule_tac comp_leq_use_env1)\n  apply (simp)\n  done\n    \nlemma comp_leq_var_env2: \"\\<lbrakk> leq_use_env r_x (dir_subst_penv t_sub p_sub r_s2) \\<rbrakk> \\<Longrightarrow>\n  leq_use_env r_x (dir_subst_penv t_sub p_sub (comp_var_env r_s1 r_s2))\"    \n  apply (simp add: comp_sol_subst_penv)\n  apply (rule_tac comp_leq_use_env2)\n  apply (simp)\n  done\n\nlemma lift_leq_var_env: \"\\<lbrakk> leq_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_s) \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub (lift_var_env r_s r))\"        \n  apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_s r)\" and s=\"lift_use_env (dir_subst_penv t_sub p_sub r_s) (sol_subst_perm p_sub r)\" in subst)\n   apply (rule_tac lift_sol_subst_penv)\n  apply (rule_tac lift_leq_use_env)\n  apply (simp)\n  done\n \nlemma dist_lift_leq_var_env: \"\\<lbrakk> leq_use_env (dir_subst_penv t_sub p_sub r_x) (dir_subst_penv t_sub p_sub r_s) \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (dir_subst_penv t_sub p_sub (lift_var_env r_x r)) (dir_subst_penv t_sub p_sub (lift_var_env r_s r))\"\n  apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_s r)\" and s=\"lift_use_env (dir_subst_penv t_sub p_sub r_s) (sol_subst_perm p_sub r)\" in subst)\n   apply (rule_tac lift_sol_subst_penv)\n  apply (rule_tac t=\"dir_subst_penv t_sub p_sub (lift_var_env r_x r)\" and s=\"lift_use_env (dir_subst_penv t_sub p_sub r_x) (sol_subst_perm p_sub r)\" in subst)\n   apply (rule_tac lift_sol_subst_penv)\n  apply (rule_tac dist_lift_leq_use_env)\n  apply (simp)\n  done\n  \nlemma empty_leq_var_env: \"leq_use_env (dir_subst_penv t_sub p_sub empty_var_env) r_s\"    \n  apply (simp add: dir_subst_penv_def)\n  apply (simp add: empty_var_env_def)\n  apply (simp add: leq_use_env_def)\n  done\n\nlemma if_zero_leq_var_env: \"\\<lbrakk> leq_use_env (dir_subst_penv t_sub p_sub r_x) r_s \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (dir_subst_penv t_sub p_sub (ifz_var_env q r_x)) r_s\"\n  apply (simp add: leq_use_env_def)\n  apply (simp add: dir_subst_penv_def)\n  apply (simp add: ifz_var_env_def)\n  done   \n    \nlemma if_zero_pos_var_env: \"\\<lbrakk> dir_subst_permx t_sub p_sub r \\<noteq> NoPerm \\<rbrakk> \\<Longrightarrow> dir_subst_penv t_sub p_sub (ifz_var_env r r_s) = dir_subst_penv t_sub p_sub r_s\"    \n  apply (case_tac \"\\<forall> x. dir_subst_penv t_sub p_sub (ifz_var_env r r_s) x = dir_subst_penv t_sub p_sub r_s x\")\n   apply (auto)\n  apply (simp add: ifz_var_env_def)\n  apply (simp add: dir_subst_penv_def)\n  apply (auto)\n  done\n    \nlemma rem_sol_subst_penv: \"dir_subst_penv t_sub p_sub (rem_var_env r_s x) = rem_use_env (dir_subst_penv t_sub p_sub r_s) x\"    \n  apply (case_tac \"\\<forall> x'. dir_subst_penv t_sub p_sub (rem_var_env r_s x) x' = rem_use_env (dir_subst_penv t_sub p_sub r_s) x x'\")  \n   apply (auto)\n  apply (simp add: dir_subst_penv_def)\n  apply (simp add: rem_var_env_def)\n  apply (simp add: rem_use_env_def)\n  apply (case_tac \"x = x'\")\n   apply (auto)\n  done\n\n    (* variable type environment lemmas *)    \n\nlemma add_sol_subst_tenv: \"add_env (dir_subst_tenv (fill_tsub t_sub tau_n) env) (Var x) (full_subst_type t_sub p_sub tau_n (VarScheme a)) =\n  dir_subst_tenv (fill_tsub t_sub tau_n) (add_env env (Var x) a)\"    \n  apply (case_tac \"\\<forall> y. add_env (dir_subst_tenv (fill_tsub t_sub tau_n) env) (Var x) (full_subst_type t_sub p_sub tau_n (VarScheme a)) y =\n  dir_subst_tenv (fill_tsub t_sub tau_n) (add_env env (Var x) a) y\")\n   apply (auto)\n  apply (simp add: full_subst_type_def)\n  apply (simp add: fill_tsub_def)\n  apply (simp add: add_env_def)\n  apply (simp add: dir_subst_tenv_def)\n  apply (case_tac \"Var x = y\")\n   apply (auto)\n   apply (case_tac \"t_sub a\")\n    apply (auto)\n  apply (case_tac \"env y\")\n   apply (auto)\n   apply (simp add: dir_subst_tenv_def)\n  apply (simp add: dir_subst_tenv_def)\n  done        \n    \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/InferVar.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3471673714072752}}
{"text": "section \"Insider Framework\"\ntext \\<open>In the Isabelle/HOL theory for Insiders, one expresses policies over\nactions @{text \\<open>get, move, eval\\<close>}, and @{text \\<open>put\\<close>}.\\<close>\nsubsection \\<open>Actors and actions\\<close>\ntext \\<open>The theory Airinsider is an instance of the Insider framework for the case study\n     of airplane insiders. Although the Isabelle Insider framework is a generic framework\n     the actual semantics of the actions is specific to applications. Therefore we use here\n     an \"instance\" of the framework in the form of a theory \"Airinsider\" but the main part of \n     definitions and declarations is the same.\\<close>\ntheory AirInsider\n  imports MC\nbegin\ntext \\<open>An actor may be enabled to \n\\begin{itemize}\n\\item @{text \\<open>get\\<close>} data or physical items, like keys,\n\\item @{text \\<open>move\\<close>} to a location,\n\\item @{text \\<open>eval\\<close>} a program,\n\\item @{text \\<open>put\\<close>} data at locations or physical items -- like airplanes --\n``to the ground''.\n\\end{itemize}\nThe precise semantics of these actions is refined in the state transition \nrules for the concrete infrastructure.\nThe framework abstracts from concrete data -- actions have no parameters:\\<close>\ndatatype action = get | move | eval | put\n\ntext \\<open>The human component is the {\\it Actor} which is represented by an abstract\ntype @{text \\<open>actor\\<close>} and a function @{text \\<open>Actor\\<close>}\nthat creates elements of that type from identities (of type @{text \\<open>string\\<close>}):\n\nWe use an abstract type declaration actor that can later be instantiated by a more\n      concrete type.\\<close>\ntypedecl actor \ntype_synonym identity = string\nconsts Actor :: \"identity \\<Rightarrow> actor\" \ntext \\<open>Note that it would seem more natural and simpler to just \ndefine @{text \\<open>actor\\<close>} as a datatype over identities with a constructor @{text \\<open>Actor\\<close>}\ninstead of a simple constant together with a type declaration like, for example,\nin the Isabelle inductive approach to security protocol verification \\cite{pau:97, pau:98}. \nThis would, however, make the constructor @{text \\<open>Actor\\<close>} an injective function\nby the underlying foundation of datatypes therefore excluding the fine\ngrained modelling that is at the core of the insider definition:\nIn fact, it defines the function @{text \\<open>Actor\\<close>} to be injective\nfor all except insiders and explicitly enables insiders to have\ndifferent roles by identifying @{text \\<open>Actor\\<close>} images.\n\nAlternatives to the type declaration do not work.\n\n@{text \\<open>context\n\n  fixes Abs Rep actor\n\n  assumes td: \"type_definition Abs Rep actor\"\n\nbegin\n\ndefinition Actor where \"Actor = Abs\"\n\\<close>}\n...doesn't work as an alternative to the actor @{term \\<open>typedecl\\<close>} because \nin @{text \\<open>type_definition\\<close>} above the @{text \\<open>actor\\<close>} is a set not a type!\nSo can't be used for our purposes. \n\nTrying a locale instead for polymorphic type Actor is a suggested alternative \n\\cite{mw:09}.\n\n@{text \n\\<open>locale ACT =\n  fixes Actor :: \"string \\<Rightarrow> 'actor\"\nbegin ...\\<close>\n}\nThat is a nice idea and works quite far but clashes with the generic\n@{text \\<open>state_transition\\<close>} later (it's not possible to instantiate within a locale\nand outside of it we cannot instantiate @{text \\<open>'a infrastructure\\<close>} to state (clearly \nan abstract thing as an instance is strange).\\<close>\n\ndefinition ID :: \"[actor, string] \\<Rightarrow> bool\"\nwhere \"ID a s \\<equiv> (a = Actor s)\"\n\nsubsection \\<open>Infrastructure graphs and policies\\<close>\ntext\\<open>Actors are contained in an infrastructure graph. An @{text \\<open>igraph\\<close>} contains\na set of location pairs representing the topology of the infrastructure\nas a graph of nodes and a list of actor identities associated to each node \n(location) in the graph.\nAlso an @{text \\<open>igraph\\<close>} associates actors to a pair of string sets by\na pair-valued function whose first range component is a set describing\nthe credentials in the possession of an actor and the second component\nis a set defining the roles the actor can take on. Finally, an  @{text \\<open>igraph\\<close>} \nassigns locations to a pair of a string that defines\nthe state of the component. \nCorresponding projection functions for each of these components of an \n@{text \\<open>igraph\\<close>} are provided; they are named @{text \\<open>gra\\<close>} for the actual set of pairs of\nlocations, @{text \\<open>agra\\<close>} for the actor map, @{text \\<open>cgra\\<close>} for the credentials,\nand @{text \\<open>lgra\\<close>} for the state of a location and the data at that location.\\<close>\ndatatype location = Location nat\ndatatype igraph = Lgraph \"(location * location)set\" \"location \\<Rightarrow> identity list\"\n                         \"actor \\<Rightarrow> (string list * string list)\"  \"location \\<Rightarrow> string list\"\ntext \\<open>Atomic policies of type @{text \\<open>apolicy\\<close>}\ndescribe prerequisites for actions to be granted to actors given by\npairs of predicates (conditions) and sets of (enabled) actions:\\<close>\ntype_synonym  apolicy = \"((actor \\<Rightarrow> bool) * action set)\"\n\ndatatype infrastructure = \n         Infrastructure \"igraph\" \n                        \"[igraph, location] \\<Rightarrow> apolicy set\" \n                       \nprimrec loc :: \"location \\<Rightarrow> nat\"\nwhere  \"loc(Location n) = n\"\nprimrec gra :: \"igraph \\<Rightarrow> (location * location)set\"\nwhere  \"gra(Lgraph g a c l) = g\"\nprimrec agra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> identity list)\"\nwhere  \"agra(Lgraph g a c l) = a\"\nprimrec cgra :: \"igraph \\<Rightarrow> (actor \\<Rightarrow> string list * string list)\"\nwhere  \"cgra(Lgraph g a c l) = c\"\nprimrec lgra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> string list)\"\nwhere  \"lgra(Lgraph g a c l) = l\"\n\ndefinition nodes :: \"igraph \\<Rightarrow> location set\" \nwhere \"nodes g == { x. (? y. ((x,y): gra g) | ((y,x): gra g))}\"\ndefinition actors_graph :: \"igraph \\<Rightarrow> identity set\"  \nwhere  \"actors_graph g == {x. ? y. y : nodes g \\<and> x \\<in> set(agra g y)}\"\nprimrec graphI :: \"infrastructure \\<Rightarrow> igraph\"\nwhere \"graphI (Infrastructure g d) = g\"\nprimrec delta :: \"[infrastructure, igraph, location] \\<Rightarrow> apolicy set\"\nwhere \"delta (Infrastructure g d) = d\"\nprimrec tspace :: \"[infrastructure, actor ] \\<Rightarrow> string list * string list\"\n  where \"tspace (Infrastructure g d) = cgra g\"\nprimrec lspace :: \"[infrastructure, location ] \\<Rightarrow> string list\"\nwhere \"lspace (Infrastructure g d) = lgra g\"\ndefinition credentials :: \"string list * string list \\<Rightarrow> string set\"\n  where  \"credentials lxl \\<equiv> set (fst lxl)\"\ndefinition has :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"has G ac \\<equiv> snd ac \\<in> credentials(cgra G (fst ac))\"\ndefinition roles :: \"string list * string list \\<Rightarrow> string set\"\n  where  \"roles lxl \\<equiv> set (snd lxl)\"\ndefinition role :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"role G ac \\<equiv> snd ac \\<in> roles(cgra G (fst ac))\"\ndefinition isin :: \"[igraph,location, string] \\<Rightarrow> bool\" \n  where \"isin G l s \\<equiv> s \\<in> set(lgra G l)\"\n\nsubsection \\<open>Insider predicate\\<close>\ntext \\<open>The human actor's level is modelled in the Isabelle Insider framework by assigning\nthe individual actor's psychological disposition\\footnote{Note that the determination of \nthe psychological state of an actor is not done using the formal system. It is up to a \npsychologist to determine this. However, if for instance, an actor is classified as \n@{text \\<open>disgruntled\\<close>} then this may have an influence on what they are allowed to do according \nto a company policy and this can be formally described and reasoned about in Isabelle.} \n@{text \\<open>actor_state\\<close>} to each actor's identity.\\<close>\ndatatype psy_states = happy | depressed | disgruntled | angry | stressed\ndatatype motivations = financial | political | revenge | curious | competitive_advantage | power | peer_recognition\n\ntext \\<open>The values used for the definition of the types\n@{text \\<open>motivations\\<close>} and @{text \\<open>psy_state\\<close>}\nare based on a taxonomy from psychological insider research \\cite{nblgcww:14}.\nThe transition to become an insider is represented by a {\\it Catalyst} that tips the insider \nover the edge so he acts as an insider formalized as a ``tipping point'' \npredicate.\\<close>\ndatatype actor_state = Actor_state \"psy_states\" \"motivations set\"\nprimrec motivation :: \"actor_state \\<Rightarrow> motivations set\" \nwhere \"motivation  (Actor_state p m) =  m\"\nprimrec psy_state :: \"actor_state \\<Rightarrow> psy_states\" \nwhere \"psy_state  (Actor_state p m) = p\"\n\ndefinition tipping_point :: \"actor_state \\<Rightarrow> bool\" where\n  \"tipping_point a \\<equiv> ((motivation a \\<noteq> {}) \\<and> (happy \\<noteq> psy_state a))\"\n\ntext \\<open>To embed the fact that the attacker is an insider, the actor can then\nimpersonate other actors. In the Isabelle Insider framework, the \npredicate @{text \\<open>Insider\\<close>} must be used as a {\\it locale} assumption\nto enable impersonation for the insider:\nthis assumption entails that an insider @{text \\<open>Actor ''Eve''\\<close>} can act like \ntheir alter ego, say @{text \\<open>Actor ''Charly''\\<close>} within the context of the locale.\nThis is realized by the predicate  @{text \\<open>UasI\\<close>}:\n@{text \\<open>UasI\\<close>} and @{text \\<open>UasI'\\<close>} are the central predicates allowing to specify Insiders.\nThey define which identities can be mapped to the same role by the @{text \\<open>Actor\\<close>} function\n(an impersonation predicate \"@{text \\<open>a\\<close>} can act as @{text \\<open>b\\<close>}\").\nFor all other identities, @{text \\<open>Actor\\<close>} is defined as injective on those identities.\nThe first one is stronger and allows substitution of the insider in any context; the second \none is parameterized over a context predicate to describe this.\\<close>\ndefinition UasI ::  \"[identity, identity] \\<Rightarrow> bool \" \nwhere \"UasI a b \\<equiv> (Actor a = Actor b) \\<and> (\\<forall> x y. x \\<noteq> a \\<and> y \\<noteq> a \\<and> Actor x = Actor y \\<longrightarrow> x = y)\"\ndefinition UasI' ::  \"[actor \\<Rightarrow> bool, identity, identity] \\<Rightarrow> bool \" \nwhere \"UasI' P a b \\<equiv> P (Actor b) \\<longrightarrow> P (Actor a)\"\n\ntext \\<open>Two versions of Insider predicate corresponding to @{text \\<open>UasI\\<close>} and @{text \\<open>UasI'\\<close>}\nexist. Under the assumption that the tipping point has been reached for a person @{text \\<open>a\\<close>}\nthen @{text \\<open>a\\<close>} can impersonate all @{text \\<open>b\\<close>} (take all of @{text \\<open>b\\<close>}'s \"roles\") where\nthe @{text \\<open>b\\<close>}'s are specified by a given set of identities.\\<close>\ndefinition Insider :: \"[identity, identity set, identity \\<Rightarrow> actor_state] \\<Rightarrow> bool\" \nwhere \"Insider a C as \\<equiv> (tipping_point (as a) \\<longrightarrow> (\\<forall> b\\<in>C. UasI a b))\"\ndefinition Insider' :: \"[actor \\<Rightarrow> bool, identity, identity set, identity \\<Rightarrow> actor_state] \\<Rightarrow> bool\" \nwhere \"Insider' P a C as \\<equiv> (tipping_point (as a) \\<longrightarrow> (\\<forall> b\\<in>C. UasI' P a b \\<and> inj_on Actor C))\"\ntext \\<open>The predicate @{text \\<open>atI\\<close>} -- mixfix syntax @{text \\<open>@\\<^bsub>G\\<^esub>\\<close>} -- expresses that an actor (identity) \n      is at a certain location in an igraph.\\<close>\ndefinition atI :: \"[identity, igraph, location] \\<Rightarrow> bool\" (\"_ @\\<^bsub>(_)\\<^esub> _\" 50)\nwhere \"a @\\<^bsub>G\\<^esub> l \\<equiv> a \\<in> set(agra G l)\"\ntext \\<open>The enables predicate is the central definition of the behaviour as given by a policy\nthat specifies what actions are allowed in a certain location for what actors.\nPolicies specify the expected behaviour of actors of an infrastructure. \nThey are defined by the @{text \\<open>enables\\<close>} predicate:\nan actor @{text \\<open>h\\<close>} is enabled to perform an action @{text \\<open>a\\<close>} \nin infrastructure @{text \\<open>I\\<close>}, at location @{text \\<open>l\\<close>}\nif there exists a pair @{text \\<open>(p,e)\\<close>} in the local policy of @{text \\<open>l\\<close>}\n(@{text \\<open>delta I l\\<close>} projects to the local policy) such that the action \n@{text \\<open>a\\<close>} is a member of the action set @{text \\<open>e\\<close>} and the policy \npredicate @{text \\<open>p\\<close>} holds for actor @{text \\<open>h\\<close>}.\\<close>\ndefinition enables :: \"[infrastructure, location, actor, action] \\<Rightarrow> bool\"\nwhere\n\"enables I l a a' \\<equiv>  (\\<exists> (p,e) \\<in> delta I (graphI I) l. a' \\<in> e \\<and> p a)\"\ntext \\<open>For example, the @{text \\<open>apolicy\\<close>} pair @{text \\<open>(\\<lambda> x. True, {move})\\<close>}\nspecifies that all actors are enabled to perform action @{text \\<open>move\\<close>}.\\<close>\n\ntext \\<open>The behaviour is the good behaviour, i.e. everything allowed by the policy of \nInfrastructure @{text \\<open>I\\<close>}.\\<close>\ndefinition behaviour :: \"infrastructure \\<Rightarrow> (location * actor * action)set\"\nwhere \"behaviour I \\<equiv> {(t,a,a'). enables I t a a'}\"\n\ntext \\<open>The misbehaviour is the complement of behaviour of an Infrastructure @{text \\<open>I\\<close>}.\\<close>\ndefinition misbehaviour :: \"infrastructure \\<Rightarrow> (location * actor * action)set\"\n  where \"misbehaviour I \\<equiv> -(behaviour I)\"\n\ntext \\<open>We prove some basic lemmas for the predicate @{text \\<open>enable\\<close>}.\\<close>\nlemma not_enableI: \"(\\<forall> (p,e) \\<in> delta I (graphI I) l. (\\<not>(h : e) | (\\<not>(p(a))))) \n                     \\<Longrightarrow> \\<not>(enables I l a h)\"\n  by (simp add: enables_def, blast)\n\nlemma not_enableI2: \"\\<lbrakk>\\<And> p e. (p,e) \\<in> delta I (graphI I) l \\<Longrightarrow>\n                 (\\<not>(t : e) |  (\\<not>(p(a)))) \\<rbrakk> \\<Longrightarrow> \\<not>(enables I l a t)\"\n by (rule not_enableI, rule ballI, auto)\n\nlemma not_enableE: \"\\<lbrakk> \\<not>(enables I l a t); (p,e) \\<in> delta I (graphI I) l \\<rbrakk>\n                 \\<Longrightarrow> (\\<not>(t : e) |  (\\<not>(p(a))))\"\n  by (simp add: enables_def, rule impI, force)\n\nlemma not_enableE2: \"\\<lbrakk> \\<not>(enables I l a t); (p,e) \\<in> delta I (graphI I) l;\n                     t : e \\<rbrakk> \\<Longrightarrow> (\\<not>(p(a)))\"\n  by (simp add: enables_def, force)\n\nsubsection \"State transition on infrastructures\"\ntext \\<open>The state transition defines how actors may act on infrastructures through actions\n    within the boundaries of the policy. It is given as an inductive definition over the \n    states which are infrastructures.  This state transition relation is dependent on actions but also on\n    enabledness and the current state of the infrastructure.\n\n    First we introduce some auxiliary functions dealing\n    with repetitions in lists and actors moving in an @{text \\<open>igraph\\<close>} and some \n    constructions to deal with lists of actors in locations for the semantics of action \n    @{text \\<open>move\\<close>}.\\<close>\nprimrec del :: \"['a, 'a list] \\<Rightarrow> 'a list\"\nwhere \ndel_nil: \"del a [] = []\" |\ndel_cons: \"del a (x#ls) = (if x = a then ls else x # (del a ls))\"\n\nprimrec jonce :: \"['a, 'a list] \\<Rightarrow> bool\"\nwhere\njonce_nil: \"jonce a [] = False\" |\njonce_cons: \"jonce a (x#ls) = (if x = a then (a \\<notin> (set ls)) else jonce a ls)\"\n\nprimrec nodup :: \"['a, 'a list] \\<Rightarrow> bool\"\n  where \n    nodup_nil: \"nodup a [] = True\" |\n    nodup_step: \"nodup a (x # ls) = (if x = a then (a \\<notin> (set ls)) else nodup a ls)\"\n\ndefinition move_graph_a :: \"[identity, location, location, igraph] \\<Rightarrow> igraph\"\nwhere \"move_graph_a n l l' g \\<equiv> Lgraph (gra g) \n                    (if n \\<in> set ((agra g) l) &  n \\<notin> set ((agra g) l') then \n                     ((agra g)(l := del n (agra g l)))(l' := (n # (agra g l')))\n                     else (agra g))(cgra g)(lgra g)\"\n\ntext \\<open>State transition relation over infrastructures (the states) defining the \n   semantics of actions in systems with humans and potentially insiders.\\<close>\ninductive state_transition_in :: \"[infrastructure, infrastructure] \\<Rightarrow> bool\" (\"(_ \\<rightarrow>\\<^sub>n _)\" 50)\nwhere\n  move: \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; l \\<in> nodes G; l' \\<in> nodes G;\n          (a) \\<in> actors_graph(graphI I); enables I l' (Actor a) move;\n         I' = Infrastructure (move_graph_a a l l' (graphI I))(delta I) \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\" \n| get : \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; a' @\\<^bsub>G\\<^esub> l; has G (Actor a, z);\n        enables I l (Actor a) get;\n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)\n                           ((cgra G)(Actor a' := \n                                (z # (fst(cgra G (Actor a'))), snd(cgra G (Actor a')))))\n                           (lgra G))\n                   (delta I)\n         \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| put : \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; enables I l (Actor a) put;\n        I' = Infrastructure \n                  (Lgraph (gra G)(agra G)(cgra G)\n                          ((lgra G)(l := [z])))\n                   (delta I) \\<rbrakk>\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"  \n| put_remote : \"\\<lbrakk> G = graphI I; enables I l (Actor a) put;\n        I' = Infrastructure \n                  (Lgraph (gra G)(agra G)(cgra G)\n                            ((lgra G)(l := [z])))\n                    (delta I) \\<rbrakk>\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n  \ntext \\<open>Note that the type infrastructure can now be instantiated to the axiomatic type class \n      @{text\\<open>state\\<close>} which enables the use of the underlying Kripke structures and CTL.\n      We need to show that this infrastructure is a state as given in MC.thy\\<close>\ninstantiation \"infrastructure\" :: state\nbegin\ndefinition \n   state_transition_infra_def: \"(i \\<rightarrow>\\<^sub>i i') =  (i \\<rightarrow>\\<^sub>n (i' :: infrastructure))\"\n\ninstance\n  by (rule MC.class.MC.state.of_class.intro)\n\ndefinition state_transition_in_refl (\"(_ \\<rightarrow>\\<^sub>n* _)\" 50)\nwhere \"s \\<rightarrow>\\<^sub>n* s' \\<equiv> ((s,s') \\<in> {(x,y). state_transition_in x y}\\<^sup>*)\"\n\ntext \\<open>Lemmas about the auxiliary functions @{text \\<open>del, jonce, nodup\\<close>} are provided.\\<close> \nlemma del_del[rule_format]: \"n \\<in> set (del a S) \\<longrightarrow> n \\<in> set S\"\n  by (induct_tac S, auto)\n    \nlemma del_dec[rule_format]: \"a \\<in> set S \\<longrightarrow> length (del a S) < length S\"  \n  by (induct_tac S, auto)\n\nlemma del_sort[rule_format]: \"\\<forall> n. (Suc n ::nat) \\<le> length (l) \\<longrightarrow> n \\<le> length (del a (l))\"   \n  by (induct_tac l, simp, clarify, case_tac n, simp, simp)\n    \nlemma del_jonce: \"jonce a l \\<longrightarrow> a \\<notin> set (del a l)\"\n  by (induct_tac l, auto)\n    \nlemma del_nodup[rule_format]: \"nodup a l \\<longrightarrow> a \\<notin> set(del a l)\"\n  by (induct_tac l, auto)\n    \nlemma nodup_up[rule_format]: \"a \\<in> set (del a l) \\<longrightarrow> a \\<in> set l\"\n  by (induct_tac l, auto)\n    \nlemma del_up [rule_format]: \"a \\<in> set (del aa l) \\<longrightarrow> a \\<in> set l\"\n  by (induct_tac l, auto)\n\nlemma nodup_notin[rule_format]:   \"a \\<notin> set list \\<longrightarrow> nodup a list\"\n  by (induct_tac list, auto)\n    \nlemma nodup_down[rule_format]: \"nodup a l \\<longrightarrow> nodup a (del a l)\"\n  by (induct_tac l, simp+, clarify, erule nodup_notin)\n\nlemma del_notin_down[rule_format]: \"a \\<notin> set list \\<longrightarrow> a \\<notin> set (del aa list) \"\n  by (induct_tac list, auto)\n\nlemma del_not_a[rule_format]: \" x \\<noteq> a \\<longrightarrow> x \\<in> set l \\<longrightarrow> x \\<in> set (del a l)\"\n  by (induct_tac l, auto)\n      \nlemma nodup_down_notin[rule_format]: \"nodup a l \\<longrightarrow> nodup a (del aa l)\"\n  by (induct_tac l, simp+, rule conjI, clarify, erule nodup_notin, (rule impI)+,\n      erule del_notin_down)\n    \nlemma move_graph_eq: \"move_graph_a a l l g = g\"  \n  by (simp add: move_graph_a_def, case_tac g, force)\n\ntext \\<open>Some useful properties about the invariance of the nodes, the actors, and the policy \n   with respect to the  state transition are provided.\\<close> \nlemma delta_invariant: \"\\<forall> z z'. (z \\<rightarrow>\\<^sub>n z') \\<longrightarrow>  delta(z) = delta(z')\"    \n  by (clarify, erule state_transition_in.cases, simp+)\n\nlemma init_state_policy0: \n  assumes \"\\<forall> z z'. (z \\<rightarrow>\\<^sub>n z') \\<longrightarrow>  delta(z) = delta(z')\"\n      and \"(x,y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n    shows \"delta(x) = delta(y)\"\nproof -\n  have ind: \"(x,y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\n             \\<longrightarrow> delta(x) = delta(y)\"\n  proof (insert assms, erule rtrancl.induct)\n    show \"(\\<And> a::infrastructure.\n       (\\<forall>(z::infrastructure)(z'::infrastructure). (z \\<rightarrow>\\<^sub>n z') \\<longrightarrow> (delta z = delta z')) \\<Longrightarrow>\n       (((a, a) \\<in> {(x ::infrastructure, y :: infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*) \\<longrightarrow>\n       (delta a = delta a)))\"\n    by (rule impI, rule refl)\nnext fix a b c\n  assume a0: \"\\<forall>(z::infrastructure) z'::infrastructure. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow> delta z = delta z'\"\n     and a1: \"(a, b) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n     and a2: \"(a, b) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<longrightarrow>\n         delta a = delta b\"\n     and a3: \"(b, c) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\"\n     show \"(a, c) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<longrightarrow>\n       delta a = delta c\"\n  proof -\n    have a4: \"delta b = delta c\" using a0 a1 a2 a3 by simp\n    show ?thesis using a0 a1 a2 a3 by simp\n  qed\nqed\nshow ?thesis \n  by (insert ind, insert assms(2), simp)\nqed\n\nlemma init_state_policy: \"\\<lbrakk> (x,y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<rbrakk> \\<Longrightarrow> \n                          delta(x) = delta(y)\"  \n  by (rule init_state_policy0, rule delta_invariant)\n\nlemma same_nodes0[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow> nodes(graphI z) = nodes(graphI z')\"   \n  by (clarify, erule state_transition_in.cases, \n       (simp add: move_graph_a_def atI_def actors_graph_def nodes_def)+)\n\nlemma same_nodes: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \n                   \\<Longrightarrow> nodes(graphI y) = nodes(graphI I)\"  \n  by (erule rtrancl_induct, rule refl, drule CollectD, simp, drule same_nodes0, simp)  \n\nlemma same_actors0[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow> actors_graph(graphI z) = actors_graph(graphI z')\"   \nproof (clarify, erule state_transition_in.cases)\n  show \"\\<And>(z::infrastructure) (z'::infrastructure) (G::igraph) (I::infrastructure) (a::char list)\n       (l::location) (a'::char list) (za::char list) I'::infrastructure.\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       a' @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       has G (Actor a, za) \\<Longrightarrow>\n       enables I l (Actor a) get \\<Longrightarrow>\n       I' =\n       Infrastructure\n        (Lgraph (gra G) (agra G)\n          ((cgra G)(Actor a' := (za # fst (cgra G (Actor a')), snd (cgra G (Actor a'))))) (lgra G))\n        (delta I) \\<Longrightarrow>\n       actors_graph (graphI z) = actors_graph (graphI z')\"\n     by (simp add: actors_graph_def nodes_def)\n next show \"\\<And>(z::infrastructure) (z'::infrastructure) (G::igraph) (I::infrastructure) (a::char list)\n       (l::location) (I'::infrastructure) za::char list.\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       enables I l (Actor a) put \\<Longrightarrow>\n       I' = Infrastructure (Lgraph (gra G) (agra G) (cgra G) ((lgra G)(l := [za]))) (delta I) \\<Longrightarrow>\n       actors_graph (graphI z) = actors_graph (graphI z')\"\n   by (simp add: actors_graph_def nodes_def)\nnext show \"\\<And>(z::infrastructure) (z'::infrastructure) (G::igraph) (I::infrastructure) (l::location)\n       (a::char list) (I'::infrastructure) za::char list.\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = graphI I \\<Longrightarrow>\n       enables I l (Actor a) put \\<Longrightarrow>\n       I' = Infrastructure (Lgraph (gra G) (agra G) (cgra G) ((lgra G)(l := [za]))) (delta I) \\<Longrightarrow>\n       actors_graph (graphI z) = actors_graph (graphI z')\"\n    by (simp add: actors_graph_def nodes_def)\nnext fix z z' G I a l l' I'\n  show \"z = I \\<Longrightarrow> z' = I' \\<Longrightarrow> G = graphI I \\<Longrightarrow> a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> nodes G \\<Longrightarrow> l' \\<in> nodes G \\<Longrightarrow> a \\<in> actors_graph (graphI I) \\<Longrightarrow>\n       enables I l' (Actor a) move \\<Longrightarrow>\n       I' = Infrastructure (move_graph_a a l l' (graphI I)) (delta I) \\<Longrightarrow>\n       actors_graph (graphI z) = actors_graph (graphI z')\"\n  proof (rule equalityI)\n    show \"z = I \\<Longrightarrow> z' = I' \\<Longrightarrow> G = graphI I \\<Longrightarrow> a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n    l \\<in> nodes G \\<Longrightarrow> l' \\<in> nodes G \\<Longrightarrow> a \\<in> actors_graph (graphI I) \\<Longrightarrow>\n    enables I l' (Actor a) move \\<Longrightarrow>\n    I' = Infrastructure (move_graph_a a l l' (graphI I)) (delta I) \\<Longrightarrow>\n    actors_graph (graphI z) \\<subseteq> actors_graph (graphI z')\"\n  by (rule subsetI, simp add: actors_graph_def ,(erule exE)+, case_tac \"x = a\",\n      rule_tac x = \"l'\" in exI, simp add: move_graph_a_def nodes_def atI_def,\n      rule_tac x = ya in exI, rule conjI, simp add: move_graph_a_def nodes_def atI_def,\n      (erule conjE)+, simp add: move_graph_a_def, rule conjI, clarify,\n      simp add: move_graph_a_def nodes_def atI_def, rule del_not_a, assumption+, clarify)\nnext show \"z = I \\<Longrightarrow> z' = I' \\<Longrightarrow> G = graphI I \\<Longrightarrow> a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n    l \\<in> nodes G \\<Longrightarrow> l' \\<in> nodes G \\<Longrightarrow> a \\<in> actors_graph (graphI I) \\<Longrightarrow>\n    enables I l' (Actor a) move \\<Longrightarrow>\n    I' = Infrastructure (move_graph_a a l l' (graphI I)) (delta I) \\<Longrightarrow>\n    actors_graph (graphI z') \\<subseteq> actors_graph (graphI z)\"\n  by (rule subsetI, simp add: actors_graph_def, (erule exE)+,\n      case_tac \"x = a\", rule_tac x = \"l\" in exI, simp add: move_graph_a_def nodes_def atI_def,\n      rule_tac x = ya in exI, rule conjI, simp add: move_graph_a_def nodes_def atI_def,\n      (erule conjE)+, simp add: move_graph_a_def, case_tac \"ya = l\", simp,\n      case_tac \"a \\<in> set (agra (graphI I) l) \\<and> a \\<notin> set (agra (graphI I) l')\", simp,\n      case_tac \"l = l'\", simp+, erule del_up, simp,\n      case_tac \"a \\<in> set (agra (graphI I) l) \\<and> a \\<notin> set (agra (graphI I) l')\", simp,\n      case_tac \"ya = l'\", simp+)\nqed\nqed\n\nlemma same_actors: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \n              \\<Longrightarrow> actors_graph(graphI I) = actors_graph(graphI y)\"\nproof (erule rtrancl_induct)\n  show \"actors_graph (graphI I) = actors_graph (graphI I)\"\n    by (rule refl)\nnext show \"\\<And>(y::infrastructure) z::infrastructure.\n       (I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       (y, z) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n       actors_graph (graphI I) = actors_graph (graphI y) \\<Longrightarrow>\n       actors_graph (graphI I) = actors_graph (graphI z)\"\n    by (drule CollectD, simp, drule same_actors0, simp)  \nqed\n\nend\nend", "meta": {"author": "flokam", "repo": "IsabelleInsider", "sha": "17ddb9cc04969788fde58fd1990f124aa1664e7c", "save_path": "github-repos/isabelle/flokam-IsabelleInsider", "path": "github-repos/isabelle/flokam-IsabelleInsider/IsabelleInsider-17ddb9cc04969788fde58fd1990f124aa1664e7c/AirInsider.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.34716736367074236}}
{"text": "(* \n    This file is a part of IsarMathLib - \n    a library of formalized mathematics for Isabelle/Isar.\n\n    Copyright (C) 2011, 2012  Slawomir Kolodynski\n\n    This program is free software Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,\nINCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\nPARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,\nINDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE, DATA, OR PROFITS OR\nBUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\nSTRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE\nUSE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\nsection \\<open>Topology 3\\<close>\n\ntheory Topology_ZF_3 imports Topology_ZF_2 FiniteSeq_ZF\n\nbegin\n\ntext\\<open>\\<open>Topology_ZF_1\\<close> theory describes how we can define  a topology on a product\nof two topological spaces. One way to generalize that is to construct topology for a cartesian\nproduct of $n$ topological spaces. The cartesian product approach is somewhat inconvenient though.\nAnother way to approach product topology on $X^n$ is to model cartesian product as sets of \nsequences (of length $n$) of elements of $X$. This means that having a topology on $X$ we want\nto define a toplogy on the space $n\\rightarrow X$, where $n$ is a natural number (recall that \n$n = \\{ 0,1,...,n-1\\}$ in ZF). However, this in turn can be done more generally by defining a \ntopology on any function space $I\\rightarrow X$, where $I$ is any set of indices. This is what we \ndo in this theory.\\<close>\n\nsubsection\\<open>The base of the product topology\\<close>\n\ntext\\<open>In this section we define the base of the product topology.\\<close>\n\ntext\\<open>Suppose $\\mathcal{X} = I\\rightarrow \\bigcup T$ is a space of functions from some index set $I$\nto the carrier of a topology $T$. Then take a finite collection of open sets $W:N\\rightarrow T$ \nindexed by $N\\subseteq I$. We can define a subset of $\\mathcal{X}$ that models the cartesian product of $W$.\n\\<close>\n\ndefinition\n  \"FinProd(\\<X>,W) \\<equiv> {x\\<in>\\<X>. \\<forall> i\\<in>domain(W). x`(i) \\<in> W`(i)}\"\n\ntext\\<open>Now we define the base of the product topology as the collection of all finite products \n(in the sense defined above) of open sets. \n\\<close>\n\ndefinition\n  \"ProductTopBase(I,T) \\<equiv>  \\<Union>N\\<in>FinPow(I).{FinProd(I\\<rightarrow>\\<Union>T,W). W\\<in>N\\<rightarrow>T}\"\n\ntext\\<open>Finally, we define the product topology on sequences. We use the ''Seq'' \nprefix although the definition is good for any index sets, not only natural numbers.\\<close>\n\ndefinition\n  \"SeqProductTopology(I,T) \\<equiv> {\\<Union>B. B \\<in> Pow(ProductTopBase(I,T))}\"\n\ntext\\<open>Product topology base is closed with respect to intersections.\\<close>\n\nlemma prod_top_base_inter: \n  assumes A1: \"T {is a topology}\" and  \n  A2: \"U \\<in> ProductTopBase(I,T)\"  \"V \\<in> ProductTopBase(I,T)\"\n  shows \"U\\<inter>V \\<in> ProductTopBase(I,T)\"\nproof -\n  let ?\\<X> = \"I\\<rightarrow>\\<Union>T\"  \n  from A2 obtain N\\<^sub>1  W\\<^sub>1 N\\<^sub>2 W\\<^sub>2 where \n    I: \"N\\<^sub>1 \\<in> FinPow(I)\"  \"W\\<^sub>1\\<in>N\\<^sub>1\\<rightarrow>T\"  \"U = FinProd(?\\<X>,W\\<^sub>1)\" and\n    II: \"N\\<^sub>2 \\<in> FinPow(I)\"  \"W\\<^sub>2\\<in>N\\<^sub>2\\<rightarrow>T\"  \"V = FinProd(?\\<X>,W\\<^sub>2)\"\n    using ProductTopBase_def by auto\n  let ?N\\<^sub>3 = \"N\\<^sub>1 \\<union> N\\<^sub>2\"\n  let ?W\\<^sub>3 = \"{\\<langle>i,if i \\<in> N\\<^sub>1-N\\<^sub>2 then W\\<^sub>1`(i) \n        else if i \\<in> N\\<^sub>2-N\\<^sub>1 then  W\\<^sub>2`(i) \n        else (W\\<^sub>1`(i)) \\<inter> (W\\<^sub>2`(i))\\<rangle>. i \\<in> ?N\\<^sub>3}\"\n  from A1 I II have \"\\<forall>i \\<in> N\\<^sub>1 \\<inter> N\\<^sub>2.  (W\\<^sub>1`(i) \\<inter> W\\<^sub>2`(i)) \\<in> T\"\n      using apply_funtype IsATopology_def by auto\n  moreover from I II have \"\\<forall>i\\<in>N\\<^sub>1-N\\<^sub>2. W\\<^sub>1`(i) \\<in> T\" and \"\\<forall>i\\<in>N\\<^sub>2-N\\<^sub>1. W\\<^sub>2`(i) \\<in> T\" \n      using apply_funtype by auto\n  ultimately have  \"?W\\<^sub>3:?N\\<^sub>3\\<rightarrow>T\" by (rule fun_union_overlap)\n  with I II have \"FinProd(?\\<X>,?W\\<^sub>3) \\<in> ProductTopBase(I,T)\" using union_finpow ProductTopBase_def\n    by auto\n  moreover have \"U\\<inter>V = FinProd(?\\<X>,?W\\<^sub>3)\"\n  proof\n    { fix x assume \"x\\<in>U\" and \"x\\<in>V\"\n      with \\<open>U = FinProd(?\\<X>,W\\<^sub>1)\\<close>  \\<open>W\\<^sub>1\\<in>N\\<^sub>1\\<rightarrow>T\\<close> and  \\<open>V = FinProd(?\\<X>,W\\<^sub>2)\\<close>  \\<open>W\\<^sub>2\\<in>N\\<^sub>2\\<rightarrow>T\\<close>\n      have \"x\\<in>?\\<X>\" and \"\\<forall>i\\<in>N\\<^sub>1. x`(i) \\<in> W\\<^sub>1`(i)\" and \"\\<forall>i\\<in>N\\<^sub>2. x`(i) \\<in> W\\<^sub>2`(i)\"\n        using func1_1_L1 FinProd_def by auto\n      with \\<open>?W\\<^sub>3:?N\\<^sub>3\\<rightarrow>T\\<close> \\<open>x\\<in>?\\<X>\\<close> have \"x \\<in> FinProd(?\\<X>,?W\\<^sub>3)\"  \n        using ZF_fun_from_tot_val func1_1_L1 FinProd_def by auto\n    } thus \"U\\<inter>V \\<subseteq> FinProd(?\\<X>,?W\\<^sub>3)\" by auto\n    { fix x assume \"x \\<in> FinProd(?\\<X>,?W\\<^sub>3)\"\n      with \\<open>?W\\<^sub>3:?N\\<^sub>3\\<rightarrow>T\\<close> have \"x:I\\<rightarrow>\\<Union>T\" and III: \"\\<forall>i\\<in>?N\\<^sub>3. x`(i) \\<in> ?W\\<^sub>3`(i)\"\n        using FinProd_def func1_1_L1 by auto\n     { fix i assume \"i\\<in>N\\<^sub>1\" \n       with \\<open>?W\\<^sub>3:?N\\<^sub>3\\<rightarrow>T\\<close> have \"?W\\<^sub>3`(i) \\<subseteq> W\\<^sub>1`(i)\" using ZF_fun_from_tot_val by auto\n       with III \\<open>i\\<in>N\\<^sub>1\\<close> have \"x`(i) \\<in> W\\<^sub>1`(i)\" by auto\n     } with \\<open>W\\<^sub>1\\<in>N\\<^sub>1\\<rightarrow>T\\<close> \\<open>x:I\\<rightarrow>\\<Union>T\\<close> \\<open>U = FinProd(?\\<X>,W\\<^sub>1)\\<close> \n      have \"x \\<in> U\" using func1_1_L1 FinProd_def by auto\n      moreover\n      { fix i assume \"i\\<in>N\\<^sub>2\" \n        with \\<open>?W\\<^sub>3:?N\\<^sub>3\\<rightarrow>T\\<close> have \"?W\\<^sub>3`(i) \\<subseteq> W\\<^sub>2`(i)\" using ZF_fun_from_tot_val by auto\n        with III \\<open>i\\<in>N\\<^sub>2\\<close> have \"x`(i) \\<in> W\\<^sub>2`(i)\" by auto\n      } with \\<open>W\\<^sub>2\\<in>N\\<^sub>2\\<rightarrow>T\\<close> \\<open>x:I\\<rightarrow>\\<Union>T\\<close> \\<open>V = FinProd(?\\<X>,W\\<^sub>2)\\<close> have \"x\\<in>V\" \n          using func1_1_L1 FinProd_def by auto \n      ultimately have \"x \\<in> U\\<inter>V\" by simp\n    } thus \"FinProd(?\\<X>,?W\\<^sub>3) \\<subseteq> U\\<inter>V\" by auto\n  qed\n    ultimately show ?thesis by simp\nqed \n\ntext\\<open>In the next theorem we show the collection of sets defined above as \n\\<open>ProductTopBase(\\<X>,T)\\<close> satisfies the base condition. This is a condition, defined in \n\\<open>Topology_ZF_1\\<close> that allows to claim that this collection is a base for some topology.\\<close>\n\ntheorem prod_top_base_is_base: assumes \"T {is a topology}\" \n  shows \"ProductTopBase(I,T) {satisfies the base condition}\"\n  using assms prod_top_base_inter inter_closed_base by simp\n\ntext\\<open>The (sequence) product topology is indeed a topology on the space of sequences.\nIn the proof we are using the fact that $(\\emptyset\\rightarrow X) = \\{\\emptyset\\}$.\\<close>\n\ntheorem seq_prod_top_is_top:  assumes \"T {is a topology}\"\n  shows \n  \"SeqProductTopology(I,T) {is a topology}\" and \n  \"ProductTopBase(I,T) {is a base for} SeqProductTopology(I,T)\" and\n  \"\\<Union>SeqProductTopology(I,T) = (I\\<rightarrow>\\<Union>T)\"\nproof -\n  from assms show \"SeqProductTopology(I,T) {is a topology}\" and \n    I: \"ProductTopBase(I,T) {is a base for} SeqProductTopology(I,T)\"\n      using prod_top_base_is_base SeqProductTopology_def Top_1_2_T1\n        by auto\n  from I have \"\\<Union>SeqProductTopology(I,T) = \\<Union>ProductTopBase(I,T)\"\n    using Top_1_2_L5 by simp\n  also have \"\\<Union>ProductTopBase(I,T) = (I\\<rightarrow>\\<Union>T)\"\n  proof\n    show \"\\<Union>ProductTopBase(I,T) \\<subseteq> (I\\<rightarrow>\\<Union>T)\" using ProductTopBase_def FinProd_def\n      by auto\n    have \"0 \\<in> FinPow(I)\" using empty_in_finpow by simp\n    hence \"{FinProd(I\\<rightarrow>\\<Union>T,W). W\\<in>0\\<rightarrow>T} \\<subseteq> (\\<Union>N\\<in>FinPow(I).{FinProd(I\\<rightarrow>\\<Union>T,W). W\\<in>N\\<rightarrow>T})\"\n      by blast\n    then show \"(I\\<rightarrow>\\<Union>T) \\<subseteq> \\<Union>ProductTopBase(I,T)\" using ProductTopBase_def FinProd_def\n      by auto\n  qed     \n  finally show \"\\<Union>SeqProductTopology(I,T) = (I\\<rightarrow>\\<Union>T)\" by simp\nqed\n\nsubsection\\<open>Finite product of topologies\\<close>\n\ntext\\<open>As a special case of the space of functions $I\\rightarrow X$ we can consider space of lists\nof elements of $X$, i.e. space $n\\rightarrow X$, where $n$ is a natural number (recall that in ZF \nset theory $n=\\{0,1,...,n-1\\}$). Such spaces model finite cartesian products $X^n$ \nbut are easier to deal with in formalized way (than the said products). \nThis section discusses natural topology defined on $n\\rightarrow X$ where $X$ is a topological space.\n\\<close>\n\ntext\\<open>When the index set is finite, the definition of \\<open>ProductTopBase(I,T)\\<close> \ncan be simplifed.\\<close>\n\nlemma fin_prod_def_nat: assumes A1: \"n\\<in>nat\" and A2: \"T {is a topology}\"  \n  shows \"ProductTopBase(n,T) = {FinProd(n\\<rightarrow>\\<Union>T,W). W\\<in>n\\<rightarrow>T}\"\nproof\n  from A1 have \"n \\<in> FinPow(n)\" using nat_finpow_nat fin_finpow_self by auto\n  then show \"{FinProd(n\\<rightarrow>\\<Union>T,W). W\\<in>n\\<rightarrow>T} \\<subseteq> ProductTopBase(n,T)\" using ProductTopBase_def\n    by auto\n  { fix B assume \"B \\<in> ProductTopBase(n,T)\"\n    then obtain N W where  \"N \\<in> FinPow(n)\" and \"W \\<in> N\\<rightarrow>T\" and \"B = FinProd(n\\<rightarrow>\\<Union>T,W)\"\n      using ProductTopBase_def by auto\n    let ?W\\<^sub>n = \"{\\<langle>i,if i\\<in>N then W`(i) else \\<Union>T\\<rangle>. i\\<in>n}\"\n    from A2  \\<open>N \\<in> FinPow(n)\\<close>  \\<open>W\\<in>N\\<rightarrow>T\\<close> have \"\\<forall>i\\<in>n. (if i\\<in>N then W`(i) else \\<Union>T) \\<in> T\"\n      using apply_funtype FinPow_def IsATopology_def by auto\n    then have \"?W\\<^sub>n:n\\<rightarrow>T\" by (rule ZF_fun_from_total)\n    moreover have \"B = FinProd(n\\<rightarrow>\\<Union>T,?W\\<^sub>n)\"\n    proof\n      { fix x assume \"x\\<in>B\"\n        with \\<open>B = FinProd(n\\<rightarrow>\\<Union>T,W)\\<close> have \"x \\<in> n\\<rightarrow>\\<Union>T\" using FinProd_def by simp\n        moreover have \"\\<forall>i\\<in>domain(?W\\<^sub>n). x`(i) \\<in> ?W\\<^sub>n`(i)\"\n        proof\n          fix i assume \"i \\<in> domain(?W\\<^sub>n)\"\n          with \\<open>?W\\<^sub>n:n\\<rightarrow>T\\<close> have \"i\\<in>n\" using func1_1_L1 by simp \n          with \\<open>x:n\\<rightarrow>\\<Union>T\\<close> have \"x`(i) \\<in> \\<Union>T\" using apply_funtype by blast\n          with \\<open>x\\<in>B\\<close> \\<open>B = FinProd(n\\<rightarrow>\\<Union>T,W)\\<close> \\<open>W \\<in> N\\<rightarrow>T\\<close> \\<open>?W\\<^sub>n:n\\<rightarrow>T\\<close> \\<open>i\\<in>n\\<close>\n          show \"x`(i) \\<in> ?W\\<^sub>n`(i)\" using func1_1_L1 FinProd_def ZF_fun_from_tot_val \n            by simp\n        qed\n        ultimately have \"x \\<in> FinProd(n\\<rightarrow>\\<Union>T,?W\\<^sub>n)\" using FinProd_def by simp\n      } thus \"B \\<subseteq> FinProd(n\\<rightarrow>\\<Union>T,?W\\<^sub>n)\" by auto\n      next\n      { fix x assume \"x \\<in> FinProd(n\\<rightarrow>\\<Union>T,?W\\<^sub>n)\"    \n        then have \"x \\<in> n\\<rightarrow>\\<Union>T\" and \"\\<forall>i\\<in>domain(?W\\<^sub>n). x`(i) \\<in> ?W\\<^sub>n`(i)\" \n          using  FinProd_def by auto\n        with \\<open>?W\\<^sub>n:n\\<rightarrow>T\\<close> and \\<open>N \\<in> FinPow(n)\\<close> have \"\\<forall>i\\<in>N. x`(i) \\<in> ?W\\<^sub>n`(i)\"\n          using func1_1_L1 FinPow_def by auto\n        moreover from \\<open>?W\\<^sub>n:n\\<rightarrow>T\\<close> and \\<open>N \\<in> FinPow(n)\\<close> \n        have \"\\<forall>i\\<in>N. ?W\\<^sub>n`(i) = W`(i)\"\n          using ZF_fun_from_tot_val FinPow_def by auto\n        ultimately have \"\\<forall>i\\<in>N. x`(i) \\<in> W`(i)\" by simp\n        with \\<open>W \\<in> N\\<rightarrow>T\\<close> \\<open>x \\<in> n\\<rightarrow>\\<Union>T\\<close> \\<open>B = FinProd(n\\<rightarrow>\\<Union>T,W)\\<close> have \"x\\<in>B\"\n          using func1_1_L1 FinProd_def by simp\n     } thus \"FinProd(n\\<rightarrow>\\<Union>T,?W\\<^sub>n) \\<subseteq> B\" by auto\n  qed \n    ultimately have \"B \\<in> {FinProd(n\\<rightarrow>\\<Union>T,W). W\\<in>n\\<rightarrow>T}\" by auto\n  } thus \"ProductTopBase(n,T) \\<subseteq> {FinProd(n\\<rightarrow>\\<Union>T,W). W\\<in>n\\<rightarrow>T}\" by auto\nqed\n\ntext\\<open>A technical lemma providing a formula for finite product on one topological space.\\<close>\n\nlemma single_top_prod: assumes A1: \"W:1\\<rightarrow>\\<tau>\" \n  shows \"FinProd(1\\<rightarrow>\\<Union>\\<tau>,W) = { {\\<langle>0,y\\<rangle>}. y \\<in> W`(0)}\"\nproof -\n  have \"1 = {0}\" by auto\n  from A1 have \"domain(W) = {0}\" using func1_1_L1 by auto\n  then have \"FinProd(1\\<rightarrow>\\<Union>\\<tau>,W) = {x \\<in> 1\\<rightarrow>\\<Union>\\<tau>. x`(0) \\<in> W`(0)}\"\n    using FinProd_def by simp\n  also have \"{x \\<in> 1\\<rightarrow>\\<Union>\\<tau>. x`(0) \\<in> W`(0)} = { {\\<langle>0,y\\<rangle>}. y \\<in> W`(0)}\"\n  proof\n    from \\<open>1 = {0}\\<close> show \"{x \\<in> 1\\<rightarrow>\\<Union>\\<tau>. x`(0) \\<in> W`(0)} \\<subseteq> { {\\<langle>0,y\\<rangle>}. y \\<in> W`(0)}\"\n      using func_singleton_pair by auto \n    { fix x assume \"x \\<in> { {\\<langle>0,y\\<rangle>}. y \\<in> W`(0)}\"\n      then obtain y where \"x = {\\<langle>0,y\\<rangle>}\" and II: \"y \\<in> W`(0)\" by auto\n      with A1 have \"y \\<in> \\<Union>\\<tau>\" using apply_funtype by auto\n      with \\<open>x = {\\<langle>0,y\\<rangle>}\\<close>  \\<open>1 = {0}\\<close> have \"x:1\\<rightarrow>\\<Union>\\<tau>\" using pair_func_singleton\n        by auto\n      with \\<open>x = {\\<langle>0,y\\<rangle>}\\<close> II have \"x \\<in> {x \\<in> 1\\<rightarrow>\\<Union>\\<tau>. x`(0) \\<in> W`(0)}\"\n        using pair_val by simp\n    } thus \"{ {\\<langle>0,y\\<rangle>}. y \\<in> W`(0)} \\<subseteq> {x \\<in> 1\\<rightarrow>\\<Union>\\<tau>. x`(0) \\<in> W`(0)}\" by auto\n  qed\n  finally show ?thesis by simp \nqed\n\ntext\\<open>Intuitively, the topological space of singleton lists valued in $X$ \n  is the same as $X$. However, each element of this space is a list of length one,\n  i.e a set consisting of a pair $\\langle 0, x\\rangle$ where $x$ is an element of $X$.\n  The next lemma provides a formula for the product topology in the corner case when we have \n  only one factor and shows that the product topology of one space is essentially the same as \n  the space.\\<close>\n\nlemma singleton_prod_top: assumes A1: \"\\<tau> {is a topology}\" \n  shows \n    \"SeqProductTopology(1,\\<tau>) = { { {\\<langle>0,y\\<rangle>}. y\\<in>U }. U\\<in>\\<tau>}\" and\n    \"IsAhomeomorphism(\\<tau>,SeqProductTopology(1,\\<tau>),{\\<langle>y,{\\<langle>0,y\\<rangle>}\\<rangle>.y \\<in> \\<Union>\\<tau>})\"\nproof -\n  have \"{0} = 1\" by auto\n  let ?b = \"{\\<langle>y,{\\<langle>0,y\\<rangle>}\\<rangle>.y \\<in> \\<Union>\\<tau>}\"\n  have \"?b \\<in> bij(\\<Union>\\<tau>,1\\<rightarrow>\\<Union>\\<tau>)\" using list_singleton_bij by blast\n  with A1 have \"{?b``(U). U\\<in>\\<tau>} {is a topology}\" and \"IsAhomeomorphism(\\<tau>, {?b``(U). U\\<in>\\<tau>},?b)\"\n    using bij_induced_top by auto\n  moreover have \"\\<forall>U\\<in>\\<tau>. ?b``(U) = { {\\<langle>0,y\\<rangle>}. y\\<in>U }\"\n  proof\n    fix U assume \"U\\<in>\\<tau>\"\n    from \\<open>?b \\<in> bij(\\<Union>\\<tau>,1\\<rightarrow>\\<Union>\\<tau>)\\<close> have \"?b:\\<Union>\\<tau>\\<rightarrow>(1\\<rightarrow>\\<Union>\\<tau>)\" using bij_def inj_def\n      by simp\n    { fix y assume \"y \\<in> \\<Union>\\<tau>\"\n      with \\<open>?b:\\<Union>\\<tau>\\<rightarrow>(1\\<rightarrow>\\<Union>\\<tau>)\\<close> have \"?b`(y) = {\\<langle>0,y\\<rangle>}\" using ZF_fun_from_tot_val\n        by simp\n    } hence \"\\<forall>y \\<in> \\<Union>\\<tau>. ?b`(y) = {\\<langle>0,y\\<rangle>}\" by auto\n    with  \\<open>U\\<in>\\<tau>\\<close> \\<open>?b:\\<Union>\\<tau>\\<rightarrow>(1\\<rightarrow>\\<Union>\\<tau>)\\<close> show \" ?b``(U) = { {\\<langle>0,y\\<rangle>}. y\\<in>U }\"\n      using func_imagedef by auto \n  qed\n  moreover have \"ProductTopBase(1,\\<tau>) = { { {\\<langle>0,y\\<rangle>}. y\\<in>U }. U\\<in>\\<tau>}\"\n  proof\n    { fix V assume \"V \\<in> ProductTopBase(1,\\<tau>)\"\n      with A1 obtain W where \"W:1\\<rightarrow>\\<tau>\" and \"V = FinProd(1\\<rightarrow>\\<Union>\\<tau>,W)\"\n        using fin_prod_def_nat by auto\n      then have \"V \\<in> { { {\\<langle>0,y\\<rangle>}. y\\<in>U }. U\\<in>\\<tau>}\" using apply_funtype single_top_prod\n        by auto \n    } thus \"ProductTopBase(1,\\<tau>) \\<subseteq> { { {\\<langle>0,y\\<rangle>}. y\\<in>U }. U\\<in>\\<tau>}\" by auto\n  { fix V assume \"V \\<in> { { {\\<langle>0,y\\<rangle>}. y\\<in>U }. U\\<in>\\<tau>}\"\n    then obtain U where \"U\\<in>\\<tau>\" and \"V = { {\\<langle>0,y\\<rangle>}. y\\<in>U }\" by auto \n    let ?W = \"{\\<langle>0,U\\<rangle>}\"\n    from \\<open>U\\<in>\\<tau>\\<close> have \"?W:{0}\\<rightarrow>\\<tau>\" using pair_func_singleton by simp   \n    with \\<open>{0} = 1\\<close> have \"?W:1\\<rightarrow>\\<tau>\" and \"?W`(0) = U\" using pair_val by auto\n    with \\<open>V = { {\\<langle>0,y\\<rangle>}. y\\<in>U }\\<close> have \"V = FinProd(1\\<rightarrow>\\<Union>\\<tau>,?W)\"\n      using single_top_prod by simp \n    with A1 \\<open>?W:1\\<rightarrow>\\<tau>\\<close> have \"V \\<in> ProductTopBase(1,\\<tau>)\" using fin_prod_def_nat\n      by auto\n   } thus \"{ { {\\<langle>0,y\\<rangle>}. y\\<in>U }. U\\<in>\\<tau>} \\<subseteq> ProductTopBase(1,\\<tau>)\" by auto \n  qed\n  ultimately have I: \"ProductTopBase(1,\\<tau>) {is a topology}\" and \n    II: \"IsAhomeomorphism(\\<tau>, ProductTopBase(1,\\<tau>),?b)\" by auto\n  from A1 have \"ProductTopBase(1,\\<tau>) {is a base for} SeqProductTopology(1,\\<tau>)\" \n    using seq_prod_top_is_top by simp\n  with I have \"ProductTopBase(1,\\<tau>) = SeqProductTopology(1,\\<tau>)\" by (rule base_topology)\n  with \\<open>ProductTopBase(1,\\<tau>) = { { {\\<langle>0,y\\<rangle>}. y\\<in>U }. U\\<in>\\<tau>}\\<close> II show\n    \"SeqProductTopology(1,\\<tau>) = { { {\\<langle>0,y\\<rangle>}. y\\<in>U }. U\\<in>\\<tau>}\" and\n    \"IsAhomeomorphism(\\<tau>,SeqProductTopology(1,\\<tau>),{\\<langle>y,{\\<langle>0,y\\<rangle>}\\<rangle>.y \\<in> \\<Union>\\<tau>})\" by auto\nqed\n\ntext\\<open>A special corner case of \\<open>finite_top_prod_homeo\\<close>: a space $X$ \n  is homeomorphic to the space of one element lists of $X$.\\<close>\n\ntheorem singleton_prod_top1: assumes A1: \"\\<tau> {is a topology}\" \n  shows \"IsAhomeomorphism(SeqProductTopology(1,\\<tau>),\\<tau>,{\\<langle>x,x`(0)\\<rangle>. x\\<in>1\\<rightarrow>\\<Union>\\<tau>})\"\nproof -\n  have \"{\\<langle>x,x`(0)\\<rangle>. x\\<in>1\\<rightarrow>\\<Union>\\<tau>} = converse({\\<langle>y,{\\<langle>0,y\\<rangle>}\\<rangle>.y\\<in>\\<Union>\\<tau>})\" \n    using list_singleton_bij by blast\n  with A1 show ?thesis using singleton_prod_top homeo_inv by simp\nqed \n \ntext\\<open>A technical lemma describing the carrier of a (cartesian) product topology of  \nthe (sequence) product topology of $n$ copies of topology $\\tau$ and another \ncopy of $\\tau$.\\<close>\n\nlemma finite_prod_top: assumes \"\\<tau> {is a topology}\" and  \"T = SeqProductTopology(n,\\<tau>)\"\n  shows \"(\\<Union>ProductTopology(T,\\<tau>)) = (n\\<rightarrow>\\<Union>\\<tau>)\\<times>\\<Union>\\<tau>\"\n  using assms Top_1_4_T1 seq_prod_top_is_top by simp\n\ntext\\<open>If $U$ is a set from the base of $X^n$ and $V$ is open in $X$, then $U\\times V$\nis in the base of $X^{n+1}$. The next lemma is an analogue of this fact for the \nfunction space approach.\\<close>\n\nlemma finite_prod_succ_base: assumes A1: \"\\<tau> {is a topology}\" and A2: \"n \\<in> nat\" and \n  A3: \"U \\<in> ProductTopBase(n,\\<tau>)\" and A4: \"V\\<in>\\<tau>\"\n  shows \"{x \\<in> succ(n)\\<rightarrow>\\<Union>\\<tau>. Init(x) \\<in> U \\<and> x`(n) \\<in> V} \\<in> ProductTopBase(succ(n),\\<tau>)\"\n  proof -\n    let ?B = \"{x \\<in> succ(n)\\<rightarrow>\\<Union>\\<tau>. Init(x) \\<in> U \\<and> x`(n) \\<in> V}\"\n    from A1 A2 have \"ProductTopBase(n,\\<tau>) = {FinProd(n\\<rightarrow>\\<Union>\\<tau>,W). W\\<in>n\\<rightarrow>\\<tau>}\"\n      using fin_prod_def_nat by simp\n    with A3 obtain W\\<^sub>U where \"W\\<^sub>U:n\\<rightarrow>\\<tau>\" and \"U =FinProd(n\\<rightarrow>\\<Union>\\<tau>,W\\<^sub>U)\" by auto\n    let ?W = \"Append(W\\<^sub>U,V)\"\n    from A4 and \\<open>W\\<^sub>U:n\\<rightarrow>\\<tau>\\<close> have \"?W:succ(n)\\<rightarrow>\\<tau>\" using append_props by simp\n    moreover have \"?B = FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,?W)\"\n    proof\n      { fix x assume \"x\\<in>?B\"\n        with \\<open>?W:succ(n)\\<rightarrow>\\<tau>\\<close> have \"x \\<in> succ(n)\\<rightarrow>\\<Union>\\<tau>\" and \"domain(?W) = succ(n)\" using func1_1_L1 \n          by auto\n        moreover from A2 A4 \\<open>x\\<in>?B\\<close> \\<open>U =FinProd(n\\<rightarrow>\\<Union>\\<tau>,W\\<^sub>U)\\<close> \\<open>W\\<^sub>U:n\\<rightarrow>\\<tau>\\<close> \\<open>x \\<in> succ(n)\\<rightarrow>\\<Union>\\<tau>\\<close> \n        have \"\\<forall>i\\<in>succ(n). x`(i) \\<in> ?W`(i)\" using func1_1_L1 FinProd_def init_props append_props\n          by simp \n        ultimately have \"x \\<in> FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,?W)\" using FinProd_def by simp \n      } thus \"?B \\<subseteq> FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,?W)\" by auto\n      next\n      { fix x assume \"x \\<in> FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,?W)\"\n        then have \"x:succ(n)\\<rightarrow>\\<Union>\\<tau>\" and I: \"\\<forall>i \\<in> domain(?W). x`(i) \\<in> ?W`(i)\"\n          using FinProd_def by auto\n        moreover have \"Init(x) \\<in> U\"\n        proof -\n          from A2 and \\<open>x:succ(n)\\<rightarrow>\\<Union>\\<tau>\\<close> have \"Init(x):n\\<rightarrow>\\<Union>\\<tau>\" using init_props by simp \n          moreover have \"\\<forall>i\\<in>domain(W\\<^sub>U). Init(x)`(i) \\<in> W\\<^sub>U`(i)\"\n          proof -\n            from A2 \\<open>x \\<in> FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,?W)\\<close> \\<open>?W:succ(n)\\<rightarrow>\\<tau>\\<close> have \"\\<forall>i\\<in>n. x`(i) \\<in> ?W`(i)\"\n              using FinProd_def func1_1_L1 by simp \n            moreover from A2 \\<open>x: succ(n)\\<rightarrow>\\<Union>\\<tau>\\<close> have \"\\<forall>i\\<in>n. Init(x)`(i) = x`(i)\"\n              using init_props by simp\n            moreover from A4 and \\<open>W\\<^sub>U:n\\<rightarrow>\\<tau>\\<close> have \"\\<forall>i\\<in>n. ?W`(i) =  W\\<^sub>U`(i)\"\n              using append_props by simp\n            ultimately have \"\\<forall>i\\<in>n. Init(x)`(i) \\<in> W\\<^sub>U`(i)\" by simp\n            with \\<open>W\\<^sub>U:n\\<rightarrow>\\<tau>\\<close> show ?thesis using func1_1_L1 by simp \n          qed\n          ultimately have \"Init(x) \\<in> FinProd(n\\<rightarrow>\\<Union>\\<tau>,W\\<^sub>U)\" using FinProd_def by simp\n          with \\<open>U =FinProd(n\\<rightarrow>\\<Union>\\<tau>,W\\<^sub>U)\\<close> show ?thesis by simp \n        qed\n        moreover have \"x`(n) \\<in> V\"       \n        proof -  \n          from \\<open>?W:succ(n)\\<rightarrow>\\<tau>\\<close> I  have \"x`(n) \\<in> ?W`(n)\" using func1_1_L1 by simp\n          moreover from A4 \\<open>W\\<^sub>U:n\\<rightarrow>\\<tau>\\<close> have \"?W`(n) = V\" using append_props by simp\n          ultimately show ?thesis by simp \n        qed\n        ultimately have \"x\\<in>?B\" by simp  \n      } thus \"FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,?W) \\<subseteq> ?B\" by auto\n    qed\n    moreover from A1 A2 have \n      \"ProductTopBase(succ(n),\\<tau>) = {FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,W). W\\<in>succ(n)\\<rightarrow>\\<tau>}\"\n      using fin_prod_def_nat by simp\n    ultimately show ?thesis by auto\n qed\n\ntext\\<open>If $U$ is open in $X^n$ and $V$ is open in $X$, then $U\\times V$ is open in $X^{n+1}$. \nThe next lemma is an analogue of this fact for the function space approach.\\<close>\n\nlemma finite_prod_succ: assumes A1: \"\\<tau> {is a topology}\" and A2: \"n \\<in> nat\" and \n  A3: \"U \\<in> SeqProductTopology(n,\\<tau>)\" and A4: \"V\\<in>\\<tau>\"\n  shows \"{x \\<in> succ(n)\\<rightarrow>\\<Union>\\<tau>. Init(x) \\<in> U \\<and> x`(n) \\<in> V} \\<in> SeqProductTopology(succ(n),\\<tau>)\"\n  proof -\n     from A1 have \"ProductTopBase(n,\\<tau>) {is a base for} SeqProductTopology(n,\\<tau>)\" and \n      I: \"ProductTopBase(succ(n),\\<tau>) {is a base for} SeqProductTopology(succ(n),\\<tau>)\" and \n      II: \"SeqProductTopology(succ(n),\\<tau>) {is a topology}\"\n        using seq_prod_top_is_top by auto\n    with A3 have \"\\<exists>\\<B> \\<in> Pow(ProductTopBase(n,\\<tau>)). U = \\<Union>\\<B>\" using Top_1_2_L1 by simp\n    then obtain \\<B> where \"\\<B> \\<subseteq> ProductTopBase(n,\\<tau>)\" and \"U = \\<Union>\\<B>\" by auto\n    then have \n    \"{x:succ(n)\\<rightarrow>\\<Union>\\<tau>. Init(x) \\<in> U \\<and> x`(n) \\<in> V} = (\\<Union>B\\<in>\\<B>.{x:succ(n)\\<rightarrow>\\<Union>\\<tau>. Init(x) \\<in> B \\<and> x`(n) \\<in> V})\"\n      by auto\n    moreover from A1 A2 A4 \\<open>\\<B> \\<subseteq> ProductTopBase(n,\\<tau>)\\<close> have\n      \"\\<forall>B\\<in>\\<B>. ({x:succ(n)\\<rightarrow>\\<Union>\\<tau>. Init(x) \\<in> B \\<and> x`(n) \\<in> V} \\<in> ProductTopBase(succ(n),\\<tau>))\"\n      using finite_prod_succ_base by auto\n    with I II have \n      \"(\\<Union>B\\<in>\\<B>.{x:succ(n)\\<rightarrow>\\<Union>\\<tau>. Init(x) \\<in> B \\<and> x`(n) \\<in> V}) \\<in> SeqProductTopology(succ(n),\\<tau>)\"\n      using base_sets_open union_indexed_open by auto\n    ultimately show ?thesis by simp\n  qed\n\n    \ntext\\<open>In the \\<open>Topology_ZF_2\\<close> theory we define product topology of two topological spaces.\nThe next lemma explains in what sense the topology on finite lists of length $n$ of \nelements of topological space $X$ can be thought as a model of the product topology on the cartesian \nproduct of $n$ copies of that space. Namely, we show that the space of lists of length $n+1$ \nof elements of $X$  is homeomorphic to the product topology (as defined in \\<open>Topology_ZF_2\\<close>) \nof two spaces: the space of lists of length $n$ and $X$. Recall that if $\\mathcal{B}$ is a base \n(i.e. satisfies the base condition), then the collection $\\{\\bigcup B| B \\in Pow(\\mathcal{B})\\}$ \nis a topology (generated by $\\mathcal{B}$).\\<close>\n\ntheorem finite_top_prod_homeo: assumes A1: \"\\<tau> {is a topology}\" and A2: \"n \\<in> nat\" and \n  A3: \"f = {\\<langle>x,\\<langle>Init(x),x`(n)\\<rangle>\\<rangle>. x \\<in> succ(n)\\<rightarrow>\\<Union>\\<tau>}\" and\n  A4: \"T = SeqProductTopology(n,\\<tau>)\" and\n  A5: \"S = SeqProductTopology(succ(n),\\<tau>)\"\nshows \"IsAhomeomorphism(S,ProductTopology(T,\\<tau>),f)\"\nproof -\n  let ?C = \"ProductCollection(T,\\<tau>)\"\n  let ?B = \"ProductTopBase(succ(n),\\<tau>)\"\n  from A1 A4 have \"T {is a topology}\" using seq_prod_top_is_top by simp\n  with A1 A5  have \"S {is a topology}\" and \" ProductTopology(T,\\<tau>) {is a topology}\" \n        using seq_prod_top_is_top  Top_1_4_T1 by auto\n  moreover \n  from assms have \"f \\<in> bij(\\<Union>S,\\<Union>ProductTopology(T,\\<tau>))\"\n    using lists_cart_prod seq_prod_top_is_top Top_1_4_T1 by simp\n  then have \"f: \\<Union>S\\<rightarrow>\\<Union>ProductTopology(T,\\<tau>)\" using bij_is_fun by simp\n  ultimately have \"two_top_spaces0(S,ProductTopology(T,\\<tau>),f)\" using two_top_spaces0_def by simp\n  moreover note \\<open>f \\<in> bij(\\<Union>S,\\<Union>ProductTopology(T,\\<tau>))\\<close>\n  moreover from A1 A5 have \"?B {is a base for} S\"\n    using seq_prod_top_is_top by simp\n  moreover from A1 \\<open>T {is a topology}\\<close> have \"?C {is a base for} ProductTopology(T,\\<tau>)\" \n    using Top_1_4_T1 by auto\n  moreover have  \"\\<forall>W\\<in>?C. f-``(W) \\<in> S\"\n  proof\n      fix W assume \"W\\<in>?C\"\n      then obtain U V where \"U\\<in>T\" \"V\\<in>\\<tau>\" and \"W = U\\<times>V\" using ProductCollection_def by auto  \n      from A1 A5 \\<open>f: \\<Union>S\\<rightarrow>\\<Union>ProductTopology(T,\\<tau>)\\<close> have \"f: (succ(n)\\<rightarrow>\\<Union>\\<tau>)\\<rightarrow>\\<Union>ProductTopology(T,\\<tau>)\"\n        using seq_prod_top_is_top by simp\n      with assms \\<open>W = U\\<times>V\\<close> \\<open>U\\<in>T\\<close> \\<open>V\\<in>\\<tau>\\<close> show \"f-``(W) \\<in> S\" \n        using ZF_fun_from_tot_val func1_1_L15 finite_prod_succ by simp \n  qed\n  moreover have \"\\<forall>V\\<in>?B. f``(V) \\<in> ProductTopology(T,\\<tau>)\"\n  proof\n    fix V assume \"V\\<in>?B\"\n    with A1 A2 obtain W\\<^sub>V where \"W\\<^sub>V \\<in> succ(n)\\<rightarrow>\\<tau>\" and \"V = FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,W\\<^sub>V)\" \n      using fin_prod_def_nat by auto\n    let ?U = \"FinProd(n\\<rightarrow>\\<Union>\\<tau>,Init(W\\<^sub>V))\"\n    let ?W = \"W\\<^sub>V`(n)\"\n    have \"?U \\<in> T\"\n    proof - \n      from A1 A2 \\<open>W\\<^sub>V \\<in> succ(n)\\<rightarrow>\\<tau>\\<close> have \"?U \\<in> ProductTopBase(n,\\<tau>)\" \n        using fin_prod_def_nat init_props by auto\n      with A1 A4 show ?thesis using seq_prod_top_is_top base_sets_open by blast\n    qed\n    from A1 \\<open>W\\<^sub>V \\<in> succ(n)\\<rightarrow>\\<tau>\\<close> \\<open>T {is a topology}\\<close> \\<open>?U \\<in> T\\<close> have \"?U\\<times>?W \\<in> ProductTopology(T,\\<tau>)\"\n      using apply_funtype prod_open_open_prod by simp\n    moreover have \"f``(V) = ?U\\<times>?W\"\n    proof -\n      from A2 \\<open>W\\<^sub>V: succ(n)\\<rightarrow>\\<tau>\\<close> have \"Init(W\\<^sub>V): n\\<rightarrow>\\<tau>\" and III: \"\\<forall>k\\<in>n. Init(W\\<^sub>V)`(k) = W\\<^sub>V`(k)\" \n        using init_props by auto\n      then have \"domain(Init(W\\<^sub>V)) = n\" using func1_1_L1 by simp\n      have \"f``(V) = {\\<langle>Init(x),x`(n)\\<rangle>. x\\<in>V}\"\n      proof -\n        have \"f``(V) = {f`(x). x\\<in>V}\"\n        proof -\n          from A1 A5 have \"?B {is a base for} S\" using seq_prod_top_is_top by simp \n          with \\<open>V\\<in>?B\\<close> have \"V \\<subseteq> \\<Union>S\" using IsAbaseFor_def by auto\n          with \\<open>f: \\<Union>S\\<rightarrow>\\<Union>ProductTopology(T,\\<tau>)\\<close> show ?thesis using func_imagedef by simp\n        qed\n        moreover have \"\\<forall>x\\<in>V. f`(x) = \\<langle>Init(x),x`(n)\\<rangle>\"\n        proof -\n          from A1 A3 A5 \\<open>V = FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,W\\<^sub>V)\\<close> have \"V \\<subseteq> \\<Union>S\" and \n            fdef: \"f = {\\<langle>x,\\<langle>Init(x),x`(n)\\<rangle>\\<rangle>. x \\<in> \\<Union>S}\" using seq_prod_top_is_top FinProd_def \n            by auto \n          from \\<open>f: \\<Union>S\\<rightarrow>\\<Union>ProductTopology(T,\\<tau>)\\<close> fdef have \"\\<forall>x \\<in> \\<Union>S. f`(x) = \\<langle>Init(x),x`(n)\\<rangle>\" \n            by (rule ZF_fun_from_tot_val0)  \n          with \\<open>V \\<subseteq> \\<Union>S\\<close> show ?thesis by auto  \n        qed\n        ultimately show ?thesis by simp \n      qed\n      also have \"{\\<langle>Init(x),x`(n)\\<rangle>. x\\<in>V} = ?U\\<times>?W\"\n      proof\n        { fix y assume \"y \\<in> {\\<langle>Init(x),x`(n)\\<rangle>. x\\<in>V}\"\n          then obtain x where I: \"y = \\<langle>Init(x),x`(n)\\<rangle>\" and \"x\\<in>V\" by auto \n          with \\<open>V = FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,W\\<^sub>V)\\<close> have \n            \"x:succ(n)\\<rightarrow>\\<Union>\\<tau>\" and II: \"\\<forall>k\\<in>domain(W\\<^sub>V). x`(k) \\<in> W\\<^sub>V`(k)\" \n            unfolding FinProd_def by auto\n          with A2 \\<open>W\\<^sub>V: succ(n)\\<rightarrow>\\<tau>\\<close> have IV: \"\\<forall>k\\<in>n. Init(x)`(k) = x`(k)\" \n            using init_props by simp \n          have \"Init(x) \\<in> ?U\"\n          proof -\n            from A2 \\<open>x:succ(n)\\<rightarrow>\\<Union>\\<tau>\\<close> have \"Init(x): n\\<rightarrow>\\<Union>\\<tau>\" using init_props by simp \n            moreover have \"\\<forall>k\\<in>domain(Init(W\\<^sub>V)). Init(x)`(k) \\<in> Init(W\\<^sub>V)`(k)\"\n            proof -\n              from A2 \\<open>W\\<^sub>V: succ(n)\\<rightarrow>\\<tau>\\<close> have \"Init(W\\<^sub>V): n\\<rightarrow>\\<tau>\" using init_props by simp\n              then have \"domain(Init(W\\<^sub>V)) = n\" using func1_1_L1 by simp\n              note III IV  \\<open>domain(Init(W\\<^sub>V)) = n\\<close>\n              moreover from II \\<open>W\\<^sub>V \\<in> succ(n)\\<rightarrow>\\<tau>\\<close> have \"\\<forall>k\\<in>n. x`(k) \\<in> W\\<^sub>V`(k)\" \n                using func1_1_L1 by simp\n              ultimately show ?thesis by simp \n            qed\n            ultimately show \"Init(x) \\<in> ?U\" using FinProd_def by simp\n          qed\n          moreover from \\<open>W\\<^sub>V: succ(n)\\<rightarrow>\\<tau>\\<close> II have \"x`(n) \\<in> ?W\" using func1_1_L1 by simp\n          ultimately have \"\\<langle>Init(x),x`(n)\\<rangle> \\<in> ?U\\<times>?W\" by simp \n          with I have \"y \\<in> ?U\\<times>?W\" by simp \n        } thus \"{\\<langle>Init(x),x`(n)\\<rangle>. x\\<in>V} \\<subseteq> ?U\\<times>?W\" by auto\n        { fix y assume \"y \\<in> ?U\\<times>?W\"\n          then have \"fst(y) \\<in> ?U\" and \"snd(y) \\<in> ?W\" by auto\n          with \\<open>domain(Init(W\\<^sub>V)) = n\\<close> have \"fst(y): n\\<rightarrow>\\<Union>\\<tau>\" and \n            V: \"\\<forall>k\\<in>n. fst(y)`(k) \\<in> Init(W\\<^sub>V)`(k)\"\n            using FinProd_def by auto\n          from \\<open>W\\<^sub>V: succ(n)\\<rightarrow>\\<tau>\\<close> have \"?W \\<in> \\<tau>\" using apply_funtype by simp\n          with \\<open>snd(y) \\<in> ?W\\<close> have \"snd(y) \\<in> \\<Union>\\<tau>\" by auto     \n          let ?x = \"Append(fst(y),snd(y))\"\n          have \"?x\\<in>V\"\n          proof -\n            from \\<open>fst(y): n\\<rightarrow>\\<Union>\\<tau>\\<close> \\<open>snd(y) \\<in> \\<Union>\\<tau>\\<close> have \"?x:succ(n)\\<rightarrow>\\<Union>\\<tau>\" using append_props by simp\n            moreover have \"\\<forall>i\\<in>domain(W\\<^sub>V). ?x`(i) \\<in> W\\<^sub>V`(i)\"             \n            proof -\n              from \\<open>fst(y): n\\<rightarrow>\\<Union>\\<tau>\\<close> \\<open>snd(y) \\<in> \\<Union>\\<tau>\\<close> \n                have \"\\<forall>k\\<in>n. ?x`(k) = fst(y)`(k)\" and \"?x`(n) = snd(y)\" \n                using append_props by auto\n              moreover from III V have \"\\<forall>k\\<in>n. fst(y)`(k) \\<in> W\\<^sub>V`(k)\" by simp \n              moreover note \\<open>snd(y) \\<in> ?W\\<close>\n              ultimately have \"\\<forall>i\\<in>succ(n). ?x`(i) \\<in> W\\<^sub>V`(i)\" by simp\n              with \\<open>W\\<^sub>V \\<in> succ(n)\\<rightarrow>\\<tau>\\<close> show ?thesis using func1_1_L1 by simp \n            qed\n            ultimately have \"?x \\<in> FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,W\\<^sub>V)\" using FinProd_def by simp\n            with \\<open>V = FinProd(succ(n)\\<rightarrow>\\<Union>\\<tau>,W\\<^sub>V)\\<close> show \"?x\\<in>V\" by simp  \n          qed\n          moreover from A2 \\<open>y \\<in> ?U\\<times>?W\\<close> \\<open>fst(y): n\\<rightarrow>\\<Union>\\<tau>\\<close> \\<open>snd(y) \\<in> \\<Union>\\<tau>\\<close> have \"y = \\<langle>Init(?x),?x`(n)\\<rangle>\"\n            using init_append append_props by auto  \n          ultimately have \"y \\<in> {\\<langle>Init(x),x`(n)\\<rangle>. x\\<in>V}\" by auto \n        } thus \"?U\\<times>?W \\<subseteq> {\\<langle>Init(x),x`(n)\\<rangle>. x\\<in>V}\" by auto\n      qed\n      finally show \"f``(V) = ?U\\<times>?W\" by simp \n    qed\n    ultimately show \"f``(V) \\<in> ProductTopology(T,\\<tau>)\" by simp \n  qed\n  ultimately show ?thesis using two_top_spaces0.bij_base_open_homeo by simp \nqed\n   \n\nend\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/Topology_ZF_3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.6261241772283034, "lm_q1q2_score": 0.34716736367074236}}
{"text": "theory flash7Bra  imports flash7Rev\n \n  begin\nlemma onInv7:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv7  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv7  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv7 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash7Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7341195269001831, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.3470061702301259}}
{"text": "theory Type_Eval\nimports Check_Execute \"../Typing/Type_Checker\" \nbegin\n\n\n  term MT\n\n  context wt_program_loc begin\n\n    definition wt_valuation :: \"memory \\<Rightarrow> typing \\<Rightarrow> valuation \\<Rightarrow> bool\" where\n      \"wt_valuation \\<mu> ty vs \\<equiv> (dom ty = dom vs) \n        \\<and> (\\<forall>x T addr. ty x = Some T \\<and> vs x = Some addr \\<longrightarrow> wf_ty SM T \\<and> wt_addr \\<mu> T addr)\"\n  \n    lemma wt_valuation_empty[simp]: \n      \"wt_valuation \\<mu> Map.empty vs \\<longleftrightarrow> vs=Map.empty\"\n      \"wt_valuation \\<mu> tys Map.empty \\<longleftrightarrow> tys=Map.empty\"\n      by (auto simp: wt_valuation_def)\n\n\n\n    lemma wt_valuation_add: \"\n      \\<lbrakk>wt_valuation \\<mu> T1 v1; wt_valuation \\<mu> T2 v2\\<rbrakk> \n      \\<Longrightarrow> wt_valuation \\<mu> (T1++T2) (v1++v2)\"\n      unfolding wt_valuation_def\n      apply clarsimp apply blast done\n\n\n    context \n      fixes \\<mu> :: memory \n      assumes WTM[simp, intro!]: \"wt_mem SM \\<mu>\" \n    begin    \n\n      lemma nsp_wf:\n        assumes \"norm_struct_ptr \\<pi> (lv,ty) = return (lv',ty')\"\n        assumes \"wf_ty SM ty\"\n        shows \"wf_ty SM ty'\"\n        using assms\n        apply (cases \"(lv,ty)\" rule: norm_struct_ptr.cases)\n        apply (auto split: Error_Monad.bind_splits option.splits \n          simp: elookup_def) \n        done\n\n      lemma wf_varty:\n        assumes \"wf_fun_decl SM fd\"\n        assumes \"varty \\<pi> fd x = return T\"\n        shows \"wf_ty SM T\"\n        using assms WF\n        by (auto   \n          simp: varty_def elookup_def ET_def wf_fun_decl_def wf_vdecls_def\n          simp: wf_program_def Let_def\n          dest!: map_of_SomeD\n          split: option.splits)\n\n      primrec wf_rty where \"wf_rty (_,ty) = wf_ty SM ty\" \n\n      lemma ty_op1_wf:\n        assumes \"ty_op1 f rty = return rty'\"\n        assumes \"wf_rty rty\"\n        shows \"wf_rty rty'\"\n        using assms\n        apply (cases \"(f,rty)\" rule: ty_op1.cases)\n        apply simp_all\n        apply (simp_all split: Error_Monad.bind_splits)\n        apply (auto simp: resolve_mname_def elookup_def SM_mt_wf split: option.splits)\n        done\n\n      lemma wf_norm_array_ty[simp, intro!]:\n        \"wf_ty SM ty \\<Longrightarrow> wf_ty SM (norm_array_ty ty)\"  \n        by (cases ty rule: norm_array_ty.cases) auto\n\n      lemma wf_ty_ptr_add:\n        \"\\<lbrakk>ty_ptr_add ty1 ty2 = Some ty'; wf_ty SM ty1; wf_ty SM ty2\\<rbrakk> \\<Longrightarrow> wf_rty ty'\"\n        apply (cases \"(ty1,ty2)\" rule: ty_ptr_add.cases)\n        by auto\n\n      lemma wf_ty_arith_binop:\n        \"\\<lbrakk>ty_arith_binop ty1 ty2 = Some ty'; wf_ty SM ty1; wf_ty SM ty2\\<rbrakk> \\<Longrightarrow> wf_rty ty'\"\n        apply (cases \"(ty1,ty2)\" rule: ty_arith_binop.cases)\n        by auto\n\n      lemma wf_ty_arith_comp:\n        \"\\<lbrakk>ty_arith_comp ty1 ty2 = Some ty'; wf_ty SM ty1; wf_ty SM ty2\\<rbrakk> \\<Longrightarrow> wf_rty ty'\"\n        apply (cases \"(ty1,ty2)\" rule: ty_arith_comp.cases)\n        by auto\n\n      lemma wf_ty_ptr_diff:\n        \"\\<lbrakk>ty_ptr_diff ty1 ty2 = Some ty'; wf_ty SM ty1; wf_ty SM ty2\\<rbrakk> \\<Longrightarrow> wf_rty ty'\"\n        apply (cases \"(ty1,ty2)\" rule: ty_ptr_diff.cases)\n        by (auto split: Option.bind_splits)\n        \n      lemma wf_ty_ptr_comp:\n        \"\\<lbrakk>ty_ptr_comp ty1 ty2 = Some ty'; wf_ty SM ty1; wf_ty SM ty2\\<rbrakk> \\<Longrightarrow> wf_rty ty'\"\n        apply (cases \"(ty1,ty2)\" rule: ty_ptr_comp.cases)\n        by (auto split: Option.bind_splits)\n\n      lemma wf_ty_ptr_eq:\n        \"\\<lbrakk>ty_ptr_eq ty1 ty2 = Some ty';wf_ty SM ty1; wf_ty SM ty2\\<rbrakk> \\<Longrightarrow> wf_rty ty'\"\n        apply (cases \"(ty1,ty2)\" rule: ty_ptr_eq.cases)\n        by (auto split: Option.bind_splits)\n\n      lemma wf_ty_index:\n        \"\\<lbrakk>ty_index ty1 ty2 = Some ty'; wf_ty SM ty1; wf_ty SM ty2\\<rbrakk> \\<Longrightarrow> wf_rty ty'\"\n        apply (cases \"(ty1,ty2)\" rule: ty_index.cases)\n        by (auto split: Option.bind_splits)\n\n\n      lemma ty_op2_wf:\n        assumes \"ty_op2 f rty1 rty2 = return rty'\"\n        assumes \"wf_rty rty1\"\n        assumes \"wf_rty rty2\"\n        shows \"wf_rty rty'\"\n        using assms\n        apply (cases f)\n        apply (auto \n          simp: ty_op2_def orelse_def \n          dest: wf_ty_ptr_add wf_ty_arith_binop wf_ty_ptr_diff \n          dest: wf_ty_ptr_comp wf_ty_arith_comp wf_ty_ptr_eq wf_ty_index\n          split: option.splits prod.splits)\n        done\n\n      lemma wf_ty_exp: \n        assumes \"ty_exp \\<pi> fd e = return rty\"\n        assumes WFD: \"wf_fun_decl SM fd\"\n        shows \"wf_rty rty\"\n      proof -\n        {\n          assume \"ty_exp_aux \\<pi> fd e = return rty\" \n          hence \"wf_rty rty\"\n            apply (induction e arbitrary: rty)\n            apply (rename_tac f rty) apply (case_tac f)\n            apply (auto \n              split: Error_Monad.bind_splits \n              intro: wf_varty[OF WFD]\n              elim!: nsp_wf) [3]\n            apply (fastforce \n              split: Error_Monad.bind_splits \n              dest: ty_op1_wf elim!: nsp_wf) []\n            apply (fastforce \n              split: Error_Monad.bind_splits \n              dest: ty_op2_wf elim!: nsp_wf) []\n            done            \n        } thus ?thesis  \n          using assms\n          by (auto simp: ty_exp_def \n              split: error.splits pre_error.splits ck_error.splits option.splits)\n      qed  \n        \n    \n\n      definition \"wt_res \\<equiv> \\<lambda>(lv,T) r. case r of\n        res.L addr \\<Rightarrow> wt_addr \\<mu> T addr \\<and> lv\n      | res.R v \\<Rightarrow> wt_val SM \\<mu> T v \\<and> \\<not>lv \\<and> \\<not>ty.is_Array T\"\n    \n      lemma wt_res_simps[simp]: \n        \"wt_res rty (res.L addr) \\<longleftrightarrow> (case rty of (lv,T) \\<Rightarrow> wt_addr \\<mu> T addr \\<and> lv)\"\n        \"wt_res rty (res.R v) \\<longleftrightarrow> (case rty of (lv,T) \\<Rightarrow> wt_val SM \\<mu> T v \\<and> \\<not>lv \\<and> \\<not>ty.is_Array T)\"\n        \"wt_res (True,T) r \\<longleftrightarrow> (\\<exists>addr. r = res.L addr \\<and> wt_addr \\<mu> T addr)\"\n        \"wt_res (False,T) r \\<longleftrightarrow> (\\<exists>v. r = res.R v \\<and> wt_val SM \\<mu> T v \\<and> \\<not>ty.is_Array T)\"\n        apply (auto simp: wt_res_def) \n        apply (auto split: res.splits)\n        done\n\n      lemma mk_repr_ndspec[e_vcg]: \"nd_spec (\\<lambda>_. True) (mk_repr i)\"\n        by (e_vcg simp: mk_repr_def)\n  \n\n      lemma to_rval_spec[e_vcg]:\n        assumes \"wt_res (lv,ty) r\"\n        assumes \"wf_ty SM ty\"\n        shows \"nd_spec (\\<lambda>v. wt_val SM \\<mu> (norm_array_ty ty) v \\<and> v\\<noteq>val.Uninit) (to_rval \\<mu> r)\"\n        using assms\n        apply (cases r; simp)\n        apply (e_vcg' vcg del: cnv_array_to_eptr_spec)\n        apply (auto simp: val.is_Array_def wt_val_ty_conv elim!: wt_val.cases) []\n        apply e_vcg'\n        apply (auto simp: wt_val_ty_conv elim!: wt_val.cases) []\n        apply e_vcg'\n        apply (auto simp: wt_val_ty_conv elim!: wt_val.cases) []\n        done\n\n      lemma to_int_spec[e_vcg]: \n        assumes \"wt_res (lv,ty.I) x\"\n        shows \"nd_spec (\\<lambda>_. True) (to_int \\<mu> x)\"\n        using assms\n        apply (cases x; simp)\n        unfolding to_int_def\n        apply (e_vcg simp: wt_val_ty_conv)\n        apply (e_vcg simp: wt_val_ty_conv)\n        done\n\n      lemma un_arith_op_spec[e_vcg]:  \n        assumes \"wt_res (lv,ty.I) x\"\n        assumes [e_vcg]: \"\\<And>i. nd_spec (\\<lambda>_. True) (f i)\"\n        shows \"nd_spec (wt_res (False, ty.I)) (un_arith_op \\<mu> f x)\"\n        using assms(1)\n        unfolding un_arith_op_def\n        apply (e_vcg simp: wt_val_ty_conv)\n        done\n\n      lemma to_ptr_spec[e_vcg]:\n        assumes \"wt_res (lv,T) r\"\n        assumes \"norm_array_ty T = ty.Ptr T'\"\n        assumes \"wf_ty SM T\"\n        shows \"nd_spec (wt_addr \\<mu> T') (to_ptr \\<mu> r)\"\n        using assms\n        apply (cases T; simp)\n        unfolding to_ptr_def\n\n        apply (e_vcg split: val.split  simp: wt_val_ty_conv)\n        apply (e_vcg split: val.split  simp: wt_val_ty_conv)\n        done        \n\n      lemma nsp_eq:\n        assumes \"norm_struct_ptr \\<pi> (lv,T) = return (lv',T')\"\n        shows \"nty_eq T' T \\<and> lv'=lv\"\n        using assms\n        apply (cases \"(lv,T)\" rule: norm_struct_ptr.cases)\n        apply (auto split: Error_Monad.bind_splits)\n        done        \n\n      lemma rmn_eq_typing_of[simp]: \n        \"resolve_mname sname mts x = return T \\<longleftrightarrow> typing_of mts x = Some T\"  \n        by (auto simp: resolve_mname_def)\n        \n      lemma wtv_struct_lookupD:\n        assumes \"typing_of mts name = Some ty\"\n        assumes \"wt_val SM \\<mu> (ty.Struct sname mts) (val.Struct ms)\"\n        shows \"\\<exists>v. map_of ms name = Some v \\<and> wt_val SM \\<mu> ty v\"\n        using assms\n        apply (auto simp: wt_val_ty_conv)\n        apply fastforce\n        done\n\n      lemma memb_op_spec[e_vcg]:\n        assumes \"wt_res (True,ty.Struct sname mts) v\"\n        assumes \"resolve_mname sname mts name = return ty\"\n        assumes \"wf_ty SM (ty.Struct sname mts)\"\n        shows \"nd_spec (wt_res (True,ty)) (memb_op \\<mu> name v)\"\n        using assms\n        apply (cases \"(name, v)\" rule: memb_op.cases)\n        apply (e_vcg)\n        apply (e_vcg simp: elookup_def dest!: wtv_struct_lookupD)\n        done      \n\n      lemma deref_op_spec[e_vcg]:\n        assumes \"wt_res (lv,ty.Ptr ty) r\"\n        assumes \"wf_ty SM ty\"\n        shows \"nd_spec (wt_res (True,ty)) (deref_op \\<mu> r)\"\n        using assms\n        by (e_vcg simp: deref_op_def)\n\n      lemma membp_op_spec[e_vcg]:\n        assumes \"wt_res (lv,ty.Ptr (ty.Struct sname mts)) v\"\n        assumes \"resolve_mname sname mts name = return ty\"\n        assumes \"wf_ty SM (ty.Struct sname mts)\"\n        shows \"nd_spec (wt_res (True,ty)) (membp_op \\<mu> name v)\"\n        using assms\n        unfolding membp_op_def\n        by e_vcg\n\n      lemma wt_res_cong:\n        assumes \"nty_eq ty ty'\"\n        assumes [simp]: \"wf_ty SM ty\" \"wf_ty SM ty'\"\n        shows \"wt_res (lv,ty) r \\<longleftrightarrow> wt_res (lv,ty') r\"\n        using assms(1)\n        by (fastforce simp: wt_res_def wt_addr_cong wt_val_cong ty.is_Array_def\n          split: res.splits)\n\n      lemma nsp_wt_res:\n        assumes \"norm_struct_ptr \\<pi> rty = return rty'\"\n        assumes WFRTY: \"wf_rty rty\"\n        shows \"(wt_res rty r \\<longleftrightarrow> wt_res rty' r) \\<and> (fst rty'= fst rty) \\<and> wf_rty rty'\"\n      proof -\n        obtain lv lv' ty ty' where [simp]:\n          \"rty = (lv,ty)\" \"rty' = (lv',ty')\"\n          by (cases rty; cases rty'; simp)\n\n        from nsp_wf assms have WFRTY': \"wf_rty rty'\"\n          by simp\n  \n        from nsp_eq[of lv ty lv' ty'] assms(1) have \n          1: \"nty_eq ty' ty\" and [simp]: \"lv'=lv\" by auto\n\n        from 1 WFRTY WFRTY' show ?thesis \n          by (auto dest!: wt_res_cong)\n      qed    \n\n      lemma ty_ptr_add_conv:\n        \"ty_ptr_add ty1 ty2 = Some rty \\<longleftrightarrow> (\\<exists>T. ty1 = ty.Ptr T \\<and> ty2 = ty.I \\<and> rty = (False,ty.Ptr T))\"\n        apply (cases \"(ty1,ty2)\" rule: ty_ptr_add.cases)\n        by auto\n\n      lemma ty_arith_binop_conv:\n        \"ty_arith_binop ty1 ty2 = Some rty \\<longleftrightarrow> ty1=ty.I \\<and> ty2=ty.I \\<and> rty=(False,ty.I)\"\n        apply (cases \"(ty1,ty2)\" rule: ty_arith_binop.cases)\n        by auto\n\n      lemma ty_arith_comp_conv:\n        \"ty_arith_comp ty1 ty2 = Some rty \\<longleftrightarrow> ty1=ty.I \\<and> ty2=ty.I \\<and> rty=(False,ty.I)\"\n        apply (cases \"(ty1,ty2)\" rule: ty_arith_comp.cases)\n        by auto\n\n      lemma ty_ptr_diff_conv: \n        \"ty_ptr_diff ty1 ty2 = Some rty \\<longleftrightarrow> (\\<exists>T. ty1 = ty.Ptr T \\<and> ty2 = ty.Ptr T \\<and> rty = (False,ty.I))\"\n        apply (cases \"(ty1,ty2)\" rule: ty_ptr_diff.cases)\n        apply (auto split: Option.bind_splits)\n        done  \n\n      lemma ty_ptr_comp_conv: \n        \"ty_ptr_comp ty1 ty2 = Some rty \\<longleftrightarrow> (\\<exists>T. ty1 = ty.Ptr T \\<and> ty2 = ty.Ptr T \\<and> rty = (False,ty.I))\"\n        apply (cases \"(ty1,ty2)\" rule: ty_ptr_comp.cases)\n        apply (auto split: Option.bind_splits)\n        done  \n\n      lemma ty_ptr_eq_conv: \n        \"ty_ptr_eq ty1 ty2 = Some rty \\<longleftrightarrow> rty = (False,ty.I) \\<and> \n          (\n            (\\<exists>T. ty1 = ty.Ptr T \\<and> ty2 = ty.Ptr T)\n          \\<or> (\\<exists>T. ty1 = ty.Ptr T \\<and> ty2 = ty.Null)  \n          \\<or> (\\<exists>T. ty1 = ty.Null \\<and> ty2 = ty.Ptr T)\n          \\<or> (ty1 = ty.Null \\<and> ty2 = ty.Null)\n          )\"\n        apply (cases \"(ty1,ty2)\" rule: ty_ptr_eq.cases)\n        apply (auto split: Option.bind_splits)\n        done  \n\n      lemma ty_index_conv: \n        \"ty_index ty1 ty2 = Some rty \\<longleftrightarrow> (\\<exists>T. ty1 = ty.Ptr T \\<and> ty2 = ty.I \\<and> rty = (True,T))\"\n        apply (cases \"(ty1,ty2)\" rule: ty_index.cases)\n        apply (auto split: Option.bind_splits)\n        done  \n\n\n      lemma norm_array_tyI_conv[simp]:\n        \"norm_array_ty T = ty.I \\<longleftrightarrow> T = ty.I\"\n        by (cases T) auto\n\n      (*lemma norm_array_ty_conv:\n        \"norm_array_ty (lv,T) = (lv',ty.Ptr T') \\<longleftrightarrow> (lv'=lv \\<and> T=ty.Ptr T' \\<or> (\\<exists>n. lv'=False \\<and> T=ty.Array n T'))\"\n        \"\\<not>ty.is_Ptr T' \\<Longrightarrow> norm_array_ty (lv,T) = (lv',T') \\<longleftrightarrow> lv'=lv \\<and> T=T' \\<and> \\<not>ty.is_Array T\"\n        apply (cases \"(lv,T)\" rule: norm_array_ty.cases; auto)\n        apply (cases T; cases T'; auto)\n        done*)\n\n      lemma bin_arith_op_spec[e_vcg]:\n        assumes \"wt_res (lv1,ty.I) r1\"\n        assumes \"wt_res (lv2,ty.I) r2\"\n        assumes [e_vcg]: \"\\<And>i1 i2. nd_spec (\\<lambda>_. True) (f i1 i2)\"\n        shows \"nd_spec (wt_res (False,ty.I)) (bin_arith_op \\<mu> f r1 r2)\"\n        using assms(1,2)\n        by (e_vcg simp: bin_arith_op_def wt_val_ty_conv)\n\n      lemma eval_exp_spec[e_vcg]:\n        assumes WTV: \"wt_valuation \\<mu> (ET \\<pi> fd) EV\"\n        assumes WTF: \"wf_fun_decl SM fd\"\n        assumes TE: \"ty_exp \\<pi> fd e = return rty\"\n        shows \"nd_spec (\\<lambda>r. wt_res rty r) (eval_exp EV \\<mu> e)\"\n        using TE\n      proof (induction e arbitrary: rty)\n        case (E0 f)\n  \n        show ?case proof (cases f)\n          case [simp]: (Const i)\n          with E0 have [simp]: \"rty = (False,ty.I)\"\n            by (auto simp: ty_exp_def\n              split: error.splits pre_error.splits \n                Error_Monad.bind_split_asm ck_error.splits prod.splits option.splits)\n  \n          show ?thesis\n            by (e_vcg intro: wt_val.intros)\n        next\n          case [simp]: (Null)\n          from E0 have [simp]: \"rty = (False,ty.Null)\"\n            by (auto simp: ty_exp_def\n              split: error.splits pre_error.splits \n                Error_Monad.bind_split_asm ck_error.splits prod.splits option.splits)\n  \n          show ?thesis  \n            by (e_vcg intro: wt_val.intros)\n        next\n          case [simp]: (Var x)\n  \n          from E0 obtain Th T lv where\n            VT: \"varty \\<pi> fd x = return Th\"\n            and NSP: \"norm_struct_ptr \\<pi> (True,Th) = return (lv,T)\"\n            and [simp]: \"rty = (lv,T)\"\n            by (auto simp: ty_exp_def\n                norm_struct_ptr_pres_lv[where lv=True]\n              split: error.splits pre_error.splits \n                Error_Monad.bind_split_asm ck_error.splits prod.splits option.splits)\n          hence [simp]: \"lv = True\" by (blast dest: norm_struct_ptr_pres_lv)  \n  \n          from VT have [simp]: \"ET \\<pi> fd x = Some Th\"\n            by (auto simp: varty_def)\n  \n          from WTV obtain addr where \n            [simp]: \"EV x = Some addr\"\n            and WFTH[simp]: \"wf_ty SM Th\"\n            and WTH: \"wt_addr \\<mu> Th addr\"\n            apply (auto simp: wt_valuation_def dom_def) apply fastforce\n            done\n            \n          from NSP have EQ: \"nty_eq T Th\"\n            apply (cases \"((True,Th))\" rule: norm_struct_ptr.cases)\n            apply (auto split: Error_Monad.bind_splits)\n            done\n\n          from nsp_wf[OF NSP] have WFT: \"wf_ty SM T\" by simp \n\n          show ?thesis using WTH wt_addr_cong[OF EQ WFT WFTH]\n            by (cases addr) auto\n        qed\n      next\n        case (E1 f e)\n        \n        from E1.prems obtain rtya rtyb where\n          TA: \"ty_exp \\<pi> fd e = return rtya\" \n          and TB: \"ty_op1 f rtya = return rtyb\"\n          and T: \"norm_struct_ptr \\<pi> rtyb = return rty\"\n          by (auto \n            simp: ty_exp_def\n            split: Error_Monad.bind_splits ck_error.splits option.splits\n            split: error.splits pre_error.splits)\n\n        from E1.IH[OF TA] have [e_vcg]: \"nd_spec (wt_res rtya) (eval_exp EV \\<mu> e)\" .  \n\n        from wf_ty_exp[OF TA WTF] have \"wf_rty rtya\" by simp\n        from wf_ty_exp[OF E1.prems WTF] have \"wf_rty rty\" .\n\n        show ?case\n          using TB T\n          apply (cases \"(f,rtya)\" rule: ty_op1.cases)\n          apply clarsimp_all\n          apply (e_vcg simp: iop_uminus_def)\n          apply (e_vcg simp: iop_Not_def)\n          apply (e_vcg simp: iop_BNot_def)\n          using \\<open>wf_rty rtya\\<close> \\<open>wf_rty rty\\<close>\n          apply (e_vcg dest: nsp_wt_res)\n\n          apply (e_vcg split: Error_Monad.bind_split_asm simp: wt_val_ty_conv)\n            \n          using \\<open>wf_rty rtya\\<close> \\<open>wf_rty rty\\<close>  \n          apply (e_vcg \n            split: Error_Monad.bind_split_asm\n            dest!: nsp_eq SM_mt_wf wt_addr_cong\n            )\n\n          using \\<open>wf_rty rtya\\<close>  \n          apply (e_vcg \n            split: Error_Monad.bind_split_asm\n            dest!: nsp_wt_res simp: SM_mt_wf\n            )\n          done\n      next\n        case (E2 f e1 e2)\n\n        from E2.prems obtain rty1a rty2a rtyb where\n          TA: \"ty_exp \\<pi> fd e1 = return rty1a\" \"ty_exp \\<pi> fd e2 = return rty2a\"\n          and TB: \"ty_op2 f rty1a rty2a = return rtyb\"\n          and T: \"norm_struct_ptr \\<pi> rtyb = return rty\"\n          by (auto \n            simp: ty_exp_def\n            split: Error_Monad.bind_splits ck_error.splits option.splits\n            split: error.splits pre_error.splits)\n\n        from E2.IH(1)[OF TA(1)] have \n          [e_vcg]: \"nd_spec (wt_res rty1a) (eval_exp EV \\<mu> e1)\" .  \n        from E2.IH(2)[OF TA(2)] have \n          [e_vcg]: \"nd_spec (wt_res rty2a) (eval_exp EV \\<mu> e2)\" .  \n\n        from wf_ty_exp[OF TA(1) WTF] wf_ty_exp[OF TA(2) WTF] have \n          WFA: \"wf_rty rty1a\" \"wf_rty rty2a\" \n          by simp_all\n\n        from ty_op2_wf[OF TB] WFA have WFB: \"wf_rty rtyb\" by simp  \n\n        from wf_ty_exp[OF E2.prems WTF] have WFT: \"wf_rty rty\" .\n\n        have \"nd_spec (wt_res rtyb) (eval_exp EV \\<mu> (exp.E2 f e1 e2))\"\n          using TB\n          apply (cases rty1a; cases rty2a; simp)\n          apply (cases f; simp_all add: ty_op2_def split: option.splits)\n          apply (clarsimp_all \n              simp: orelse_def rvop2_def[abs_def] \n              simp: ty_arith_binop_conv ty_ptr_add_conv ty_ptr_diff_conv \n                ty_ptr_comp_conv ty_arith_comp_conv ty_ptr_eq_conv ty_index_conv\n              split: option.splits)\n          \n          using WFA\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv)\n          apply safe []\n          apply (e_vcg' simp: wt_val_ty_conv)\n          apply (e_vcg simp: wt_val_ty_conv dest: wf_norm_array_ty)\n\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_plus_def)\n\n          using WFA\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv)\n          apply (clarsimp simp: wt_val_ty_conv)\n          apply (safe; simp) []\n          apply (e_vcg dest: wf_norm_array_ty simp: wt_val_ty_conv)\n\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_minus_def)\n          \n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_mult_def)\n\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_div_def)\n          \n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_mod_def)\n\n          using WFA\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv)\n          apply (clarsimp simp: wt_val_ty_conv)\n          apply (safe; simp add: wt_val_ty_conv) []\n          apply (e_vcg simp: wt_val_ty_conv\n            simp: addr_less_def split: ptr_comp_res.split)\n\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_less_def)\n\n          using WFA\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv)\n          apply (clarsimp simp: wt_val_ty_conv)\n          apply (safe; simp add: wt_val_ty_conv) []\n          apply (e_vcg simp: wt_val_ty_conv\n            simp: addr_leq_def split: ptr_comp_res.split)\n          \n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_le_def)\n\n          using WFA\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv)\n          apply (safe; clarsimp simp: wt_val_ty_conv; safe; simp add: wt_val_ty_conv)\n          apply (e_vcg simp: wt_val_ty_conv\n            simp: addr_eq_def split: ptr_comp_res.split)\n          \n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_eq_def)\n\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_And_def)\n\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_Or_def)\n\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_BAnd_def)\n\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_BOr_def)\n\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv iop_BXor_def)\n\n          using WFA\n          apply (e_vcg' simp: rvop2_def wt_val_ty_conv index_op_def)\n          apply (safe; clarsimp simp: wt_val_ty_conv)\n          apply (e_vcg simp: wt_val_ty_conv)\n          done\n        also have \"wt_res rtyb = wt_res rty\"\n          using nsp_wt_res[OF T \\<open>wf_rty rtyb\\<close>] by auto\n        finally show ?case by simp \n      qed  \n    end\n\n    typ state\n\n    definition wt_raddr :: \"memory \\<Rightarrow> ty option \\<Rightarrow> addr option \\<Rightarrow> bool\" where\n      \"wt_raddr \\<mu> ty addr \\<equiv> case (ty,addr) of\n        (Some ty, Some addr) \\<Rightarrow> wt_addr \\<mu> ty addr\n      | (_, None) \\<Rightarrow> True\n      | _ \\<Rightarrow> False\"\n\n    lemma wt_raddr_Some[simp]: \"wt_raddr \\<mu> (Some ty) (Some addr) \\<longleftrightarrow> wt_addr \\<mu> ty addr\" \n      by (auto simp: wt_raddr_def split: option.split)\n      \n    lemma wt_raddr_None[simp]: \"wt_raddr \\<mu> x None\"\n      by (auto simp: wt_raddr_def split: option.split)\n\n    lemma wt_raddr_mono: \n      assumes \"wt_raddr \\<mu> rt ra\"\n      assumes \"\\<mu> \\<subseteq>\\<^sub>\\<mu> \\<mu>'\"\n      shows \"wt_raddr \\<mu>' rt ra\"\n      using assms wt_addr_mono\n      by (auto simp: wt_raddr_def split: option.splits)\n\n\n    definition wt_stack_frame :: \"memory \\<Rightarrow> stack_frame \\<Rightarrow> bool\" where\n      \"wt_stack_frame \\<mu> \\<equiv> \\<lambda>(fd,c,l,r). \n        fd \\<in> set (program.functs \\<pi>)\n      \\<and> wf_com SM c\n      \\<and> ty_com \\<pi> fd c = return () \n      \\<and> wt_valuation \\<mu> (typing_of (fun_decl.params fd @ fun_decl.locals fd)) l\n      \\<and> wt_raddr \\<mu> (fun_decl.rtype fd) r\n      \"\n\n    definition wt_state :: \"state \\<Rightarrow> bool\" where\n      \"wt_state \\<equiv> \\<lambda>(\\<sigma>,\\<gamma>,\\<mu>). \n        wt_mem SM \\<mu> \n      \\<and> wt_valuation \\<mu> (typing_of (program.globals \\<pi>)) \\<gamma>\n      \\<and> (\\<forall>fr\\<in>set \\<sigma>. wt_stack_frame \\<mu> fr)\"\n\n    lemma cfg_pres_wfcom:  \n      assumes \"cfg c e c'\"\n      assumes \"wf_com SM c\"\n      shows \"wf_com SM c'\"\n      using assms\n      apply induction\n      apply (auto)\n      done\n\n    lemma cfg_pres_tycom1:\n      assumes \"cfg c e c'\"\n      assumes \"ty_com1 \\<pi> fd c = return ()\"\n      shows \"ty_com1 \\<pi> fd c' = return ()\"\n      using assms\n      apply induction\n      apply (auto split: Error_Monad.bind_splits)\n      done\n\n    lemma cfg_pres_tycom2:\n      assumes \"cfg c e c'\"\n      assumes \"ty_com2 fd c\"\n      assumes \"e \\<noteq> label.Effect (effect.Func fcom.Returnv)\"\n      assumes \"\\<forall>x. e \\<noteq> label.Effect (effect.Func (fcom.Return x))\"\n      shows \"ty_com2 fd c'\"\n      using assms\n      apply induction\n      apply (clarsimp_all simp: ty_com_def split: Error_Monad.bind_splits)\n      apply (rename_tac c; case_tac c; simp)\n      apply (rename_tac c; case_tac c; auto)\n      done\n\n    lemma cfg_pres_tycom:  \n      assumes C: \"cfg c e c'\"\n      assumes TC: \"ty_com \\<pi> fd c = return ()\"\n      assumes NRV: \"e \\<noteq> label.Effect (effect.Func fcom.Returnv)\"\n      assumes NR: \"\\<forall>x. e \\<noteq> label.Effect (effect.Func (fcom.Return x))\"\n      shows \"ty_com \\<pi> fd c' = return ()\"\n      using cfg_pres_tycom1[OF C, of fd] cfg_pres_tycom2[OF C _ NRV NR, of fd] TC\n      by (auto simp: ty_com_def split: Error_Monad.bind_splits)\n\n\n    lemma ty_cfg_cases[consumes 3, case_names assign malloc free return returnv callfun callfunv pos neg]:\n      assumes \"cfg c e c'\"\n      assumes \"wf_com SM c\"\n      assumes \"ty_com \\<pi> fd c = return ()\"\n      obtains \n        e1 e2 T1 T2 where \"e = label.Effect (effect.Basic (bcom.Assign e1 e2))\"\n          \"ty_exp \\<pi> fd e1 = return T1\" \"ty_exp \\<pi> fd e2 = return T2\"\n          \"ty_assign T1 T2 = return ()\"\n      | e1 T e2 T1 where \"e = label.Effect (effect.Basic (bcom.Malloc e1 T e2))\"\n          \"ty_exp \\<pi> fd e1 = return T1\" \"assert_int_exp \\<pi> fd e2 = return ()\"\n          \"ty_assign T1 (False,ty.Ptr T) = return ()\" \"wf_ty SM T\"\n      | e1 lv1 T1' where \"e = label.Effect (effect.Basic (bcom.Free e1))\"  \n          \"ty_exp \\<pi> fd e1 = return (lv1,T1')\" \"ty.is_Ptr (norm_array_ty T1')\"\n      | e1 lv1 T1' where \"e = label.Effect (effect.Func (fcom.Return e1))\"    \n          \"ty_exp \\<pi> fd e1 = return (lv1,T1')\" \"RT fd = Some (norm_array_ty T1')\"\n      | \"e = label.Effect (effect.Func (fcom.Returnv))\"    \n          \"RT fd = None\"\n      | e1 name args where \"e = label.Effect (effect.Func (fcom.Callfun e1 name args))\"\n          \"fun_compat \\<pi> fd e1 name args = return ()\"\n      | name args where \"e = label.Effect (effect.Func (fcom.Callfunv name args))\"\n          \"fun_compatv \\<pi> fd name args = return ()\"\n      | \"e = label.Effect effect.Skip\"    \n      | e1 where \"e = label.Guard (guard.Pos e1)\" \"assert_int_ptr_exp \\<pi> fd e1 = return ()\"\n      | e1 where \"e = label.Guard (guard.Neg e1)\" \"assert_int_ptr_exp \\<pi> fd e1 = return ()\"\n    proof -\n      from assms(3) have \"ty_com1 \\<pi> fd c = return ()\"\n        by (auto simp: ty_com_def split: Error_Monad.bind_splits)\n      with assms(1,2) that show ?thesis  \n        apply (induction)\n        apply (simp_all)\n        apply (rename_tac c)\n        apply (case_tac c; auto split: Error_Monad.bind_splits simp: Let_def)\n        apply (rename_tac c)\n        apply (case_tac c; auto split: Error_Monad.bind_splits simp: Let_def)\n        apply (auto split: Error_Monad.bind_splits) []\n        apply (auto split: Error_Monad.bind_splits) []\n        apply (auto split: Error_Monad.bind_splits) []\n        done\n    qed    \n      \n\n    lemmas edge_split_e_vcg[e_vcg] = edge.split[where P=\"e_spec P E T\" for P E T, THEN iffD2, unfolded split_rule_unfolds]\n  \n    lemma efold_invar:\n      assumes \"I s\"\n      assumes \"\\<And>x s. \\<lbrakk>x\\<in>set l; I s\\<rbrakk> \\<Longrightarrow> nd_spec I (f x s)\"\n      shows \"nd_spec I (efold f l s)\"\n      using assms\n      apply (induction l arbitrary: s)\n      apply e_vcg+\n      done\n\n\n    lemma destroy_frame_spec[e_vcg]: \n      \"\\<lbrakk>wt_mem SM \\<mu>\\<rbrakk> \\<Longrightarrow> nd_spec (\\<lambda>\\<mu>'. wt_mem SM \\<mu>' \\<and> \\<mu> \\<subseteq>\\<^sub>\\<mu> \\<mu>') (destroy_frame fr \\<mu>)\"\n      unfolding destroy_frame_def\n      apply (clarsimp split: prod.split)\n      apply (e_vcg vcg: efold_invar intro: mem_ord_trans)\n      done\n\n    lemma wt_valuation_mono:\n      assumes \"wt_valuation \\<mu> ty vs\"\n      assumes \"\\<mu> \\<subseteq>\\<^sub>\\<mu> \\<mu>'\"\n      shows \"wt_valuation \\<mu>' ty vs\"\n      using assms(1)\n      using wt_addr_mono[OF _ assms(2)]\n      by (auto simp: wt_valuation_def)\n\n    lemma wt_stack_frame_mono:\n      assumes \"wt_stack_frame \\<mu> fr\"\n      assumes M: \"\\<mu> \\<subseteq>\\<^sub>\\<mu> \\<mu>'\"\n      shows \"wt_stack_frame \\<mu>' fr\"\n      using assms(2,1)\n      by (auto \n        simp: wt_stack_frame_def \n          wt_valuation_mono[OF _ M] wt_addr_mono[OF _ M] wt_raddr_def \n        split: option.splits)\n\n    lemma wt_stack_frames_mono:\n      assumes \"\\<forall>fr\\<in>set stk. wt_stack_frame \\<mu> fr\"\n      assumes \"\\<mu> \\<subseteq>\\<^sub>\\<mu> \\<mu>'\"\n      shows \"\\<forall>fr\\<in>set stk. wt_stack_frame \\<mu>' fr\"\n      using assms wt_stack_frame_mono by auto\n\n    (* TODO/FIXME: Ad-Hoc hack to transfer heap properties! *)  \n    lemmas mo_monos = wt_addr_mono wt_raddr_mono wt_stack_frame_mono wt_val_mono\n      wt_valuation_mono wt_stack_frames_mono\n\n    lemmas tagged_monos = mo_monos[THEN ID_TAGI]\n\n\n    lemma eval_args_spec[e_vcg]:\n      assumes WTM[simp]: \"wt_mem SM \\<mu>\"\n      assumes WTV: \"wt_valuation \\<mu> (ET \\<pi> fd) ev\"\n      assumes WTF: \"wf_fun_decl SM fd\"\n      assumes ARGS: \"emap (ty_exp \\<pi> fd) args = return Ts\"\n      shows \"nd_spec (\\<lambda>vs. list_all2 (wt_val SM \\<mu>) (map (norm_array_ty o snd) Ts) vs) (eval_args args ev \\<mu>)\"\n      using ARGS unfolding eval_args_def\n      apply (induction args arbitrary: Ts)\n      apply e_vcg'\n      using WTV WTF\n      apply (e_vcg split: Error_Monad.bind_split_asm \n        dest: wf_ty_exp[OF WTM _ WTF] \n        simp: wf_rty.simps[OF WTM])\n      done\n\n    lemma return_ty_assignD:\n      assumes TYA: \"ty_assign' T' T = return ()\"\n      assumes FEX: \"mk_fun_map \\<pi> name = Some fdn\"\n      assumes RTY: \"fun_decl.rtype fdn = Some T\"\n      shows \"T'=T\"\n    proof -\n      from FEX have \"ty_fdecl \\<pi> fdn = return ()\" using WT\n        unfolding wt_program_def ty_program_def\n        apply (auto simp: Let_def wf_fun_decls_def mk_fun_map_def in_set_conv_decomp\n          dest!: map_of_SomeD\n          )\n        apply (cases \"ty_fdecl \\<pi> fdn\")\n        apply (auto split: ck_error.splits option.splits)\n        done\n\n      with RTY have \"\\<not>ty.is_Array T \\<and> T\\<noteq>ty.Null\" \n        apply (cases T)\n        apply (auto simp: ty_fdecl_def RT_def split: Error_Monad.bind_splits option.splits)\n        done\n      with TYA show ?thesis  \n        apply (cases T)\n        apply (auto simp: ty_assign'_def Let_def)\n        done\n    qed    \n\n    lemma wt_valuation_upd:\n      assumes \"wt_valuation \\<mu> tys vs\"\n      assumes \"wt_addr \\<mu> ty v\"\n      assumes \"wf_ty SM ty\"\n      shows \"wt_valuation \\<mu> (tys(name\\<mapsto>ty)) (vs(name\\<mapsto>v))\"\n      using assms\n      unfolding wt_valuation_def\n      by auto\n\n    (*\n      map with state:\n        f :: x \\<Rightarrow> s \\<Rightarrow> (y,s)\n        l :: x list\n        s0 :: s\n\n      \\<rightarrow> efold (\\<lambda>x (l,s). do { (y,s) \\<leftarrow> f x s; return (y#l, s) })  \n\n    definition emap_st :: \"('a \\<Rightarrow> 's \\<Rightarrow> ('b\\<times>'s,'e) error) \\<Rightarrow> 'a list \\<Rightarrow> 's \\<Rightarrow> (('b list\\<times>'s),'e) error\"\n    where \"emap_st f l s0 \\<equiv> do {\n      efold (\\<lambda>a (l,s). do { (b,s) \\<leftarrow> f a s; return (b#l,s) }) l ([],s0)\n    }\"\n\n    lemma\n      fixes f\n      defines \"emf \\<equiv> \\<lambda>a (l,s). do { (b,s) \\<leftarrow> f a s; return (b#l,s) }\"\n      shows \"efold emf l (l0,s0) = do { (l',s) \\<leftarrow> efold emf l ([],s0); return (l'@l0,s) }\"\n    proof -\n      have U: \"\\<And>l. efold emf l = (\\<lambda>(l',s). efold emf l (l',s))\" by auto\n      show ?thesis\n      proof (induction l arbitrary: l0 s0)\n        case (Cons a l)\n        show ?case\n          apply simp\n          apply (subst U)\n          apply (subst Cons.IH)\n          apply simp\n\n        apply simp\n        apply simp\n        apply (subst U)\n        apply \n\n    lemma emap_st_simps:\n      \"emap_st f [] s0 = return ([],s0)\"\n      \"emap_st f (a#l) s = do { (b,s) \\<leftarrow> f a s; (l',s) \\<leftarrow> emap_st f l s; return (b#l',s)}\"\n      apply (auto simp: emap_st_def split: prod.splits Error_Monad.bind_splits)\n      \n\n    lemma emap_st_rule:\n      assumes INV0: \"st_inv s\"\n      assumes STEP: \"\\<And>a s. \\<lbrakk> st_inv s; a\\<in>set l \\<rbrakk> \\<Longrightarrow> e_spec (\\<lambda>(b,s'). st_inv s' \\<and> link_prop a b) E T (f a s)\"\n      shows \"e_spec (\\<lambda>(l',s'). list_all2 (link_prop) l l') E T (emap_st f l s)\"\n      using INV0\n      apply (induction l arbitrary: s)\n      apply (simp add: emap_st_def)\n\n    *)  \n\n\n\n    lemma alloc_params_spec[e_vcg]:\n      fixes decls :: \"(char list \\<times> ty) list\" and vals :: \"val list\"\n      assumes VALS_VALID: \"list_all2 (wt_val SM \\<mu>) (map snd decls) vals\"\n      assumes \"wt_mem SM \\<mu>\"\n      assumes WF_VDECLS: \"wf_vdecls SM decls\"\n      shows \"nd_spec (\\<lambda>(vs,\\<mu>'). \\<mu>\\<subseteq>\\<^sub>\\<mu>\\<mu>' \\<and> wt_mem SM \\<mu>' \\<and> wt_valuation \\<mu>' (typing_of decls) vs) (alloc_params decls vals \\<mu>)\"\n      apply (simp add: alloc_params_def)\n      apply e_vcg'\n    proof -\n      case goal1\n      assume LEN_EQ: \"length decls = length vals\"\n      let \"nd_spec ?P (efold ?f _ _)\" = ?case\n\n      def TAG\\<equiv>\"\\<lambda>x::bool. x\"\n\n      {\n        fix \\<mu>0 vs0 ts0\n        assume \"\\<mu> \\<subseteq>\\<^sub>\\<mu> \\<mu>0\"\n        and \"wt_mem SM \\<mu>0\"\n        and \"wt_valuation \\<mu>0 ts0 vs0\"\n        and \"TAG (dom ts0 \\<inter> (dom (typing_of decls)) = {})\"\n        with LEN_EQ VALS_VALID WF_VDECLS have \"nd_spec \n          ((\\<lambda>(vs,\\<mu>'). \\<mu>0\\<subseteq>\\<^sub>\\<mu>\\<mu>' \\<and> wt_mem SM \\<mu>' \\<and> wt_valuation \\<mu>' (ts0 ++ typing_of decls) (vs))) \n          (efold ?f (zip decls vals) (vs0,\\<mu>0))\"\n          apply (induction arbitrary: vs0 \\<mu>0 ts0 rule: list_induct2)\n          apply simp\n          apply (e_vcg' \n            simp: wt_val_mono wf_vdecls_def nonzero_tyI[OF WF]\n            simp: valid_decls_def\n            elim!: mem_ord_trans\n            )\n          apply (drule wt_valuation_mono, assumption)\n          apply (rule wt_valuation_upd; assumption)\n\n          apply (auto simp: TAG_def) []\n          apply (auto elim: mem_ord_trans \n            simp: TAG_def dom_map_of_conv_image_fst)\n          done\n      } note GEN = this\n\n      from GEN[OF mem_ord_refl \\<open>wt_mem SM \\<mu>\\<close>, of Map.empty Map.empty]\n        show ?case\n        by (auto simp: TAG_def)\n    next\n      case goal2 with list_all2_lengthD[OF VALS_VALID] have False by simp\n      thus ?case ..\n    qed    \n\n    lemma alloc_vdecls_spec[e_vcg]:\n      fixes decls :: \"(char list \\<times> ty) list\" and vals :: \"val list\"\n      assumes WTM: \"wt_mem SM \\<mu>\"\n      assumes WF_VDECLS: \"wf_vdecls SM decls\"\n      shows \"nd_spec (\\<lambda>(vs,\\<mu>'). \n          \\<mu>\\<subseteq>\\<^sub>\\<mu>\\<mu>' \n        \\<and> wt_mem SM \\<mu>' \n        \\<and> wt_valuation \\<mu>' (typing_of decls) vs) \n      (alloc_vdecls decls \\<mu>)\"\n      apply (simp add: alloc_vdecls_def)\n    proof -\n      case goal1\n      let \"nd_spec _ (efold ?f _ _)\" = ?case\n  \n      def TAG\\<equiv>\"\\<lambda>x::bool. x\"\n\n      {\n        fix vs0 ts0\n        assume \"wt_valuation \\<mu> ts0 vs0\"\n        and \"wt_mem SM \\<mu>\"\n        and \"wf_vdecls SM decls\"\n        and \"TAG (dom ts0 \\<inter> dom (typing_of decls) = {})\"\n        hence \"nd_spec (\\<lambda>(vs, \\<mu>').\n            \\<mu> \\<subseteq>\\<^sub>\\<mu> \\<mu>' \n          \\<and> wt_mem SM \\<mu>' \n          \\<and> wt_valuation \\<mu>' (ts0 ++ typing_of decls) vs)\n          (efold ?f decls (vs0,\\<mu>))\"\n          apply (induction decls arbitrary: vs0 ts0 \\<mu>)\n          apply simp\n          apply (e_vcg' simp: nonzero_tyI[OF WF])\n          apply (drule wt_valuation_mono, assumption)\n          apply (rule wt_valuation_upd; assumption)\n\n          apply (auto simp: TAG_def) []\n          apply (auto elim: mem_ord_trans dest: map_of_SomeD \n            simp: TAG_def dom_map_of_conv_image_fst)\n          done \n      } note aux=this\n      \n      from aux[of Map.empty Map.empty, OF _ WTM WF_VDECLS] show ?case\n        by (auto simp: TAG_def)\n    qed   \n\n\n    lemma rp_ty_imp_nty_eq: \"\\<lbrakk>valid_rp_type ty\\<rbrakk> \\<Longrightarrow> norm_array_ty ty = ty\"\n      by (cases ty) auto\n\n    lemma map_nty_param_eq:\n      assumes FD: \"mk_fun_map \\<pi> name = Some fdn\"  \n      shows \"map (norm_array_ty \\<circ> snd) (fun_decl.params fdn) = map snd (fun_decl.params fdn)\"\n    proof -\n      have VR: \"\\<forall>ty\\<in>set (map snd (fun_decl.params fdn)). valid_rp_type ty\"\n        using ty_fdeclI[OF assms]\n        by (auto simp: ty_fdecl_def split: Error_Monad.bind_splits)\n      {\n        fix l\n        assume \"\\<forall>ty\\<in>set l. valid_rp_type ty\"\n        hence \"map norm_array_ty l = l\"\n          by (induction l) (auto simp: rp_ty_imp_nty_eq)\n      } \n      from this[OF VR] show ?thesis by auto \n    qed  \n\n\n    lemma op_call_spec[e_vcg]: \n      assumes FD: \"mk_fun_map \\<pi> name = Some fdn\"\n      assumes PT: \"list_all2 (wt_val SM \\<mu>) (map (norm_array_ty \\<circ> snd) (fun_decl.params fdn)) argvs\"\n      assumes RA: \"\\<And>addr. rtv = Some addr \\<Longrightarrow> \\<exists>T. fun_decl.rtype fdn = Some T \\<and> wt_addr \\<mu> T addr\"\n      assumes WTS: \"wt_state (\\<sigma>,\\<gamma>,\\<mu>)\"\n      shows \"nd_spec wt_state (op_call rtv fdn argvs (\\<sigma>,\\<gamma>,\\<mu>))\"\n    proof -\n      from FD have FDIF[simp]: \"fdn \\<in> set (program.functs \\<pi>)\"\n        by (auto simp: mk_fun_map_def dest: map_of_SomeD)\n\n      from wf_fdeclI[OF FD] have WFFD: \"wf_fun_decl SM fdn\" .\n      hence \n        aux1: \"wf_vdecls SM (fun_decl.params fdn)\"\n        and aux2: \"wf_vdecls SM (fun_decl.locals fdn)\"\n        and aux3: \"\n          dom (typing_of (fun_decl.params fdn)) \n        \\<inter> dom (typing_of (fun_decl.locals fdn)) = {}\"\n        by (auto simp: wf_fun_decl_def dest: map_of_SomeD)\n        \n\n      from WFFD have [simp]: \"wf_com SM (fun_decl.body fdn)\"    \n        by (auto simp: wf_fun_decl_def)\n\n      from ty_fdeclI[OF FD] have \n        [simp]: \"ty_com \\<pi> fdn (fun_decl.body fdn) = return ()\"\n        by (auto simp: ty_fdecl_def split: Error_Monad.bind_splits)\n\n\n      show ?thesis\n        unfolding op_call_def create_frame_def\n        using PT WTS FD aux1 aux2\n        apply (e_vcg' simp: wt_state_def map_nty_param_eq)\n        apply clarsimp\n        apply ((drule (1) tagged_monos)+; unfold ID_TAG_def)+\n        apply (auto \n          simp: wt_stack_frame_def map_add_comm[OF aux3, symmetric]\n          simp: wt_valuation_add\n          ) []\n        apply (cases rtv; simp) apply auto []\n        apply (drule RA)\n        apply clarsimp\n        apply ((drule (1) tagged_monos)+; unfold ID_TAG_def)+\n        apply auto\n        done\n    qed    \n\n    lemma ty_assign'_wtD:\n      assumes \"ty_assign' ty1 ty2 = return ()\"\n      assumes \"wt_val SM \\<mu> (norm_array_ty ty2) x\"\n      shows \"wt_val SM \\<mu> ty1 x\"\n      using assms unfolding ty_assign'_def\n      by (auto simp: Let_def wt_val_ty_conv is_Ptr_def)\n\n    lemma ss_step_spec[e_vcg]:\n      assumes NE: \"\\<not>is_empty_stack s\"\n      assumes WT: \"wt_state s\"\n      shows \"nd_spec (wt_state) (ss_step \\<pi> s)\"\n    proof -  \n      from NE obtain fd c l rt \\<sigma>' \\<gamma> \\<mu> where [simp]: \"s = ((fd,c,l,rt)#\\<sigma>',\\<gamma>,\\<mu>)\"\n        by (cases s) (auto simp: neq_Nil_conv)\n\n      from WT have \n        WTM[simp]: \"wt_mem SM \\<mu>\"  \n        and WTG: \"wt_valuation \\<mu> (typing_of (program.globals \\<pi>)) \\<gamma>\"\n        and WT_TOP_FR: \"wt_stack_frame \\<mu> (fd,c,l,rt)\"\n        and WTFRS: \"(\\<forall>fr\\<in>set \\<sigma>'. wt_stack_frame \\<mu> fr)\"\n        by (auto simp: wt_state_def)\n\n      from WT_TOP_FR have  \n        FD: \"fd \\<in> set (program.functs \\<pi>)\"\n        and WFC: \"wf_com SM c\"\n        and TYC: \"ty_com \\<pi> fd c = return ()\"\n        and WTL: \"wt_valuation \\<mu> (typing_of (fun_decl.params fd @ fun_decl.locals fd)) l\"\n        and WTRA: \"wt_raddr \\<mu> (fun_decl.rtype fd) rt\"\n        by (auto simp: wt_stack_frame_def)\n\n      from WTL WTG\n      have WTV: \"wt_valuation \\<mu> (ET \\<pi> fd) (\\<gamma> ++ l)\"  \n        apply (auto simp: ET_def)\n        apply (metis wt_valuation_add map_add_assoc)\n        done\n\n      from FD WF have WFFD[simp]: \"wf_fun_decl SM fd\"\n        unfolding wf_program_def\n        by (auto simp: Let_def wf_fun_decls_def)\n        \n      from WFFD have WFRT[simp]: \"\\<And>T. RT fd = Some T \\<Longrightarrow> wf_ty SM T\" \n        unfolding wf_fun_decl_def RT_def by auto\n\n      {\n        fix c'\n        assume \"rt=None\"\n        hence \"nd_spec wt_state\n          (op_return None ((fd, c', l, rt) # \\<sigma>', \\<gamma>, \\<mu>))\"\n          using WTG WTFRS\n          by (e_vcg \n            simp: op_return_def assign_return_value_def wt_state_def\n            intro: wt_valuation_mono wt_stack_frame_mono)\n      } note aux_returnv0 = this\n\n      {\n        assume \"c = com.Skip\"\n        hence \"rt=None\" using TYC WTRA\n          by (auto simp: ty_com_def wt_raddr_def RT_def split: option.splits)\n        note aux_returnv0[OF this]  \n      } note aux_return_skip = this\n\n      {\n        fix c'\n        assume \"RT fd = None\"\n        hence \"rt = None\" using WT_TOP_FR\n          by (auto simp: wt_stack_frame_def RT_def wt_raddr_def split: option.splits)\n        note aux_returnv0[OF this]  \n      } note aux_returnv = this\n\n      {\n        fix e lv T\n        assume \"ty_exp \\<pi> fd e = return (lv,T)\"\n        from wf_ty_exp[OF WTM this WFFD] have \"wf_ty SM T\"\n          unfolding wf_rty_def[OF WTM] by simp\n      } note [simp] = this\n\n      {\n        fix eff c'\n        assume \"c \\<noteq> com.Skip\"\n        and \"cfg_step c = edge.Effect eff c'\"\n        hence CFG: \"cfg c (label.Effect eff) c'\"\n          by (rule step2cfg1)\n        note TYC' = cfg_pres_tycom[OF CFG TYC]  \n        note WFC' = cfg_pres_wfcom[OF CFG WFC]  \n\n\n        from CFG have \n          \"nd_spec wt_state (effect \\<pi> eff ((fd, c', l, rt) # \\<sigma>', \\<gamma>, \\<mu>))\"  \n          using WFC TYC WTV\n          apply (cases rule: ty_cfg_cases)\n          apply (simp_all add: lift_def)\n\n          apply (clarsimp \n            simp: ty_assign_def comp_evs_def\n            split: Error_Monad.bind_split_asm)\n          apply (e_vcg' simp: ty_assign'_wtD)\n\n          apply (auto simp: wt_val_ty_conv is_Ptr_def) []\n          using WFC' TYC' WTG WTL WTFRS FD WTRA\n          apply (clarsimp dest!: mem_eqD1 \n            simp: wt_state_def wt_valuation_mono wt_stack_frames_mono)\n\n          apply ((drule (1) tagged_monos)+; unfold ID_TAG_def)\n            apply (auto simp: wt_stack_frame_def) []\n        \n          apply (clarsimp \n            simp: ty_assign_def Let_def comp_evs_def\n            simp: assert_int_exp_def\n            dest: wf_ty_exp\n            split: Error_Monad.bind_split_asm)\n          apply (rule e_vcg | rule e_cons, rule e_vcg)+\n          using WTV WTM WFFD WTFRS WTG WTL WTRA\n          apply simp_all\n          apply clarsimp\n          apply (rule e_vcg | rule e_cons, rule e_vcg)+\n          apply simp_all\n          apply (rule e_vcg | rule e_cons, rule e_vcg)+\n          apply simp_all\n          apply (rule e_vcg | rule e_cons, rule e_vcg)+\n          apply (simp_all add: nonzero_tyI[OF WF])\n\n          apply clarsimp\n          apply ((drule (1) tagged_monos)+; unfold ID_TAG_def)\n          apply (rule e_vcg | rule e_cons, rule e_vcg)+\n          apply simp\n          apply simp\n          apply (auto simp add: wt_val_ty_conv ty_assign'_def Let_def) []\n          apply simp\n\n          apply (clarsimp dest!: mem_eqD1)\n          apply ((drule (1) tagged_monos)+; unfold ID_TAG_def)\n\n          apply (simp add: wt_state_def)\n            apply (auto simp: wt_stack_frame_def FD WFC' TYC') []\n          apply simp apply simp  \n          \n          apply (clarsimp \n            simp: ty_assign_def Let_def comp_evs_def is_Ptr_def\n            dest: wf_ty_exp\n            split: Error_Monad.bind_split_asm)\n          apply e_vcg'\n          apply (rule WTM)\n\n          using WTG\n          apply clarsimp\n          apply ((drule (1) tagged_monos)+; unfold ID_TAG_def)\n          apply (clarsimp simp: wt_state_def)\n            apply (auto simp: wt_stack_frame_def FD WFC' TYC') []\n\n          apply (clarsimp simp: eval_exp'_alt comp_evs_def \n            op_return_def assign_return_value_def)  \n          apply (e_vcg')\n          apply clarsimp\n          apply ((drule (1) tagged_monos)+; unfold ID_TAG_def)\n          apply (clarsimp simp: wt_state_def)\n          apply (clarsimp simp: wt_raddr_def RT_def split: option.splits)\n\n          using WTG\n          apply (clarsimp dest!: mem_eqD1) apply (drule (1) mem_ord_trans)\n          apply ((drule (1) tagged_monos)+; unfold ID_TAG_def)\n          apply (clarsimp simp: wt_state_def)\n\n          apply (e_vcg' vcg: aux_returnv)\n\n          apply (clarsimp \n            simp: fun_compat_def resolve_fname_def lookup_fun_def eval_exp'_alt comp_evs_def\n            simp: Let_def lift'_def args_compat_def ty_assign_def o2e_def\n            split: Error_Monad.bind_split_asm option.splits)\n          apply (drule return_ty_assignD; assumption?; simp)\n\n          apply (e_vcg' simp del: map_map simp: map_map[symmetric])\n          using WFC' TYC' FD\n          apply (simp add: wt_state_def wt_stack_frame_def)\n          \n          apply (clarsimp \n            simp: fun_compatv_def resolve_fname_def lookup_fun_def eval_exp'_alt comp_evs_def\n            simp: Let_def lift'_def args_compat_def ty_assign_def o2e_def\n            split: Error_Monad.bind_split_asm option.splits)\n          apply (e_vcg' simp del: map_map simp: map_map[symmetric])\n          using WFC' TYC' FD\n          apply (simp add: wt_state_def wt_stack_frame_def)\n          \n          using WFC' TYC' FD\n          apply (simp add: wt_state_def wt_stack_frame_def)\n          done\n      } note aux_effect = this    \n            \n      from TYC WTRA have [simp]: \"c=com.Skip \\<Longrightarrow> rt=None\"  \n        by (auto simp: ty_com_def wt_raddr_def RT_def split: option.splits)\n\n      {\n        fix b c1 c2\n        assume NS[simp]: \"c\\<noteq>com.Skip\"\n        and STEP: \"cfg_step c = edge.Cond b c1 c2\"\n\n        from step2cfg2[OF NS STEP] have \n          CFG1: \"cfg c (label.Guard (guard.Pos b)) c1\"\n          and CFG2: \"cfg c (label.Guard (guard.Neg b)) c2\"\n          by auto\n\n        have WTS1: \"wt_state (upd_com c1 s)\"\n          using cfg_pres_tycom[OF CFG1 TYC, simplified] cfg_pres_wfcom[OF CFG1 WFC] \n          WTG FD WTFRS WT_TOP_FR\n          by (auto simp: wt_state_def wt_stack_frame_def)\n\n        have WTS2: \"wt_state (upd_com c2 s)\"\n          using cfg_pres_tycom[OF CFG2 TYC, simplified] cfg_pres_wfcom[OF CFG2 WFC] \n          WTG FD WTFRS WT_TOP_FR\n          by (auto simp: wt_state_def wt_stack_frame_def)\n\n        from CFG1 WFC TYC have IPE: \"assert_int_ptr_exp \\<pi> fd b = return ()\" \n          by (cases rule: ty_cfg_cases; simp)\n\n        {\n          fix ty v\n          assume \"ty = ty.I \\<or> ty = ty.Null \\<or> is_Ptr ty\"\n          and \"wt_val SM \\<mu> (norm_array_ty ty) v\"\n          and \"v \\<noteq> val.Uninit\"\n          hence \"nd_spec (\\<lambda>_. True) (to_bool_aux \\<mu> v)\"\n            apply (auto simp: wt_val_ty_conv is_Ptr_def)\n            apply e_vcg'\n            done\n        } note [e_vcg] = this \n\n\n        have \"nd_spec\n          (\\<lambda>bv. nd_spec wt_state\n                (do {\n                   x \\<leftarrow> to_rval' s bv;\n                   bv \\<leftarrow> to_bool_aux' s x;\n                   if bv\n                   then return (upd_com c1 s)\n                   else return (upd_com c2 s)\n                 }))\n          (eval_exp (\\<gamma> ++ l) \\<mu> b)\"\n          using IPE WTV \n          apply (clarsimp \n            simp: assert_int_ptr_exp_def \n            simp: to_rval'_def to_bool_aux'_def\n            split: Error_Monad.bind_split_asm)\n          using WTS1 WTS2\n          apply e_vcg'\n          done        \n      } note aux_guard = this    \n\n      show ?thesis\n        apply (e_vcg' simp: ss_step_def eval_exp'_def Let_def)\n        apply (clarsimp_all simp: Let_def)\n\n        using aux_return_skip apply simp\n\n        using aux_effect apply simp\n\n        using aux_guard apply (simp add: lift'_def comp_evs_def cong: if_cong) \n        done\n    qed    \n\n    theorem initial_state_spec[e_vcg]: \n      -- \\<open>Main theorem: Initial state is well-typed\\<close>\n      \"nd_spec wt_state (initial_state \\<pi>)\"\n    proof -\n      have [simp]: \n        \"lookup_fun \\<pi> main_fname = return main_fd\"\n        using main_exists\n        by (auto simp: lookup_fun_def)\n\n      from wf_fdeclI[OF main_exists] have \n        [simp]: \n          \"wf_vdecls SM (fun_decl.locals main_fd)\" \n        by (auto simp: wf_fun_decl_def)\n\n      show ?thesis\n        unfolding initial_state_def create_frame_def\n        apply (e_vcg' simp: wf_vdecls)\n        apply clarsimp\n        apply ((drule (1) tagged_monos)+; unfold ID_TAG_def)+\n        (* TODO/FIXME: Two notions for fun exists: Via FM, and via set functs!*)\n        using wf_fdeclI[OF main_exists] ty_fdeclI[OF main_exists]\n        apply (clarsimp \n          simp: wt_state_def wt_stack_frame_def \n          simp: wf_fun_decl_def ty_fdecl_def\n          split: Error_Monad.bind_split_asm)\n        using main_exists\n        apply (auto simp: mk_fun_map_def dest: map_of_SomeD)\n        done\n    qed    \n\n    lemma small_steps_pres_wt_state:\n      assumes \"nd_spec wt_state s\"\n      assumes \"small_steps \\<pi> s s'\"\n      shows \"nd_spec wt_state s'\"\n      using assms(2,1) \n      apply (induction rule: star.induct)\n      apply simp\n      apply (clarsimp elim!: small_step'.cases)\n      apply (frule ss_imp_no_empty)\n      apply (clarsimp simp: small_step_iff_ss_step)\n      apply rprems\n      apply e_vcg'\n      done\n      \n    theorem interp_spec:\n      -- \\<open>Main theorem: Interpretation yields no static errors \n          and preserves typing\\<close>\n      assumes \"wt_state s\"\n      shows \"e_spec wt_state is_EDynamic (\\<not>terminates \\<pi> s) (interp \\<pi> s)\"  \n    proof (cases \"interp \\<pi> s = ENonterm\")\n      case True with interp_correct have \"\\<not>terminates \\<pi> s\"\n        by simp\n      with True show ?thesis by simp  \n    next\n      case False with interp_correct have \"yields \\<pi> s (interp \\<pi> s)\" by simp\n      hence \"small_steps \\<pi> (return s) (interp \\<pi> s)\" by (auto simp: yields_def)\n      from small_steps_pres_wt_state[OF _ this] assms False\n      show ?thesis by (auto simp: pw_espec_iff)\n    qed  \n  end\n\n  (* TODO/FIXME: Consider monad that always terminates, or\n    automatic syntactic termination check with def-unfolding! *)  \n\n  \n\n  lemma [simp]: \"ty_exp_aux \\<pi> fd e \\<noteq> ENonterm\"\n    apply (induction e)\n    apply (simp_all split: Error_Monad.bind_split, safe, simp_all)\n\n    apply (rename_tac f; case_tac f; \n      auto split: Error_Monad.bind_splits simp: varty_def)\n\n    apply (rename_tac f e lv v; case_tac \"(f,(lv,v))\" rule: ty_op1.cases; \n      auto split: Error_Monad.bind_splits simp: resolve_mname_def)\n\n    apply (rename_tac f e lv1 v1 lv2 v2; \n      case_tac f; \n      auto \n        split: Error_Monad.bind_splits option.splits\n        simp: resolve_mname_def ty_op2_def)\n    done  \n\n  lemma [simp]: \"ty_exp \\<pi> fd e \\<noteq> ENonterm\"\n    by (auto simp: ty_exp_def split: error.splits pre_error.splits ck_error.splits option.splits)  \n\n\n  lemma [simp]: \"ty_com1 \\<pi> fd c \\<noteq> ENonterm\"\n    apply (induction c rule: ty_com1.induct)\n    by (auto \n      simp: ty_assign_def ty_assign'_def Let_def\n      simp: assert_int_ptr_exp_def assert_int_exp_def\n      simp: fun_compat_def fun_compatv_def resolve_fname_def args_compat_def\n      dest!: emap_nontermD'\n      split: Error_Monad.bind_split\n      )\n\n  lemma [simp]: \"ty_com \\<pi> fd c \\<noteq> ENonterm\"\n    by (auto \n      simp: ty_com_def assert_def\n      split: Error_Monad.bind_split)\n    \n\n  lemma [simp]: \"ty_fdecl \\<pi> fd \\<noteq> ENonterm\"\n    by (auto \n      simp: ty_fdecl_def \n      dest!: efold_nontermD'\n      split: Error_Monad.bind_split option.split)  \n\n  lemma [simp]: \"wt_program \\<pi> \\<noteq> ENonterm\"\n    by (auto \n      simp: wt_program_def ty_program_def\n      dest!: efold_nontermD'\n      split: Error_Monad.bind_split option.splits\n      split: error.splits pre_error.splits ck_error.splits\n      )  \n\n  theorem check_execute_spec:\n    -- \\<open>Main theorem: Check-Execute yields no static errors\\<close>  \n    shows \"e_spec \n      (\\<lambda>_. True) \n      (\\<lambda>Inl _ \\<Rightarrow> True | Inr e \\<Rightarrow> is_EDynamic e) \n      (\\<exists>s. initial_state \\<pi> = return s \\<and> \\<not>terminates \\<pi> s) \n      (check_execute \\<pi>)\"\n    unfolding check_execute_def\n    apply (cases \"wt_program \\<pi>\")\n    defer\n    apply e_vcg'\n    apply e_vcg'\n    apply simp\n    apply (e_vcg' \n      vcg: wt_program_loc.initial_state_spec[THEN espec_add_ret] wt_program_loc.interp_spec)\n    apply (unfold_locales; auto simp: wt_program_def split: Error_Monad.bind_splits)\n    apply (unfold_locales; auto simp: wt_program_def split: Error_Monad.bind_splits)\n    done\n\nend\n\n", "meta": {"author": "glimonta", "repo": "thesis", "sha": "1ef0e434ea7e98c4eb29ffe7bde668cb1951e4ed", "save_path": "github-repos/isabelle/glimonta-thesis", "path": "github-repos/isabelle/glimonta-thesis/thesis-1ef0e434ea7e98c4eb29ffe7bde668cb1951e4ed/src/Semantics/Type_Eval.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7279754371026368, "lm_q2_score": 0.4765796510636759, "lm_q1q2_score": 0.3469382797973016}}
{"text": "(*  Title:      HOL/Auth/CertifiedEmail.thy\n    Author:     Giampaolo Bella, Christiano Longo and Lawrence C Paulson\n*)\n\nsection{*The Certified Electronic Mail Protocol by Abadi et al.*}\n\ntheory CertifiedEmail imports Public begin\n\nabbreviation\n  TTP :: agent where\n  \"TTP == Server\"\n\nabbreviation\n  RPwd :: \"agent => key\" where\n  \"RPwd == shrK\"\n\n \n(*FIXME: the four options should be represented by pairs of 0 or 1.\n  Right now only BothAuth is modelled.*)\nconsts\n  NoAuth   :: nat\n  TTPAuth  :: nat\n  SAuth    :: nat\n  BothAuth :: nat\n\ntext{*We formalize a fixed way of computing responses.  Could be better.*}\ndefinition \"response\" :: \"agent => agent => nat => msg\" where\n   \"response S R q == Hash {|Agent S, Key (shrK R), Nonce q|}\"\n\n\ninductive_set certified_mail :: \"event list set\"\n  where\n\n  Nil: --{*The empty trace*}\n     \"[] \\<in> certified_mail\"\n\n| Fake: --{*The Spy may say anything he can say.  The sender field is correct,\n          but agents don't use that information.*}\n      \"[| evsf \\<in> certified_mail; X \\<in> synth(analz(spies evsf))|] \n       ==> Says Spy B X # evsf \\<in> certified_mail\"\n\n| FakeSSL: --{*The Spy may open SSL sessions with TTP, who is the only agent\n    equipped with the necessary credentials to serve as an SSL server.*}\n         \"[| evsfssl \\<in> certified_mail; X \\<in> synth(analz(spies evsfssl))|]\n          ==> Notes TTP {|Agent Spy, Agent TTP, X|} # evsfssl \\<in> certified_mail\"\n\n| CM1: --{*The sender approaches the recipient.  The message is a number.*}\n \"[|evs1 \\<in> certified_mail;\n    Key K \\<notin> used evs1;\n    K \\<in> symKeys;\n    Nonce q \\<notin> used evs1;\n    hs = Hash{|Number cleartext, Nonce q, response S R q, Crypt K (Number m)|};\n    S2TTP = Crypt(pubEK TTP) {|Agent S, Number BothAuth, Key K, Agent R, hs|}|]\n  ==> Says S R {|Agent S, Agent TTP, Crypt K (Number m), Number BothAuth, \n                 Number cleartext, Nonce q, S2TTP|} # evs1 \n        \\<in> certified_mail\"\n\n| CM2: --{*The recipient records @{term S2TTP} while transmitting it and her\n     password to @{term TTP} over an SSL channel.*}\n \"[|evs2 \\<in> certified_mail;\n    Gets R {|Agent S, Agent TTP, em, Number BothAuth, Number cleartext, \n             Nonce q, S2TTP|} \\<in> set evs2;\n    TTP \\<noteq> R;  \n    hr = Hash {|Number cleartext, Nonce q, response S R q, em|} |]\n  ==> \n   Notes TTP {|Agent R, Agent TTP, S2TTP, Key(RPwd R), hr|} # evs2\n      \\<in> certified_mail\"\n\n| CM3: --{*@{term TTP} simultaneously reveals the key to the recipient and gives\n         a receipt to the sender.  The SSL channel does not authenticate \n         the client (@{term R}), but @{term TTP} accepts the message only \n         if the given password is that of the claimed sender, @{term R}.\n         He replies over the established SSL channel.*}\n \"[|evs3 \\<in> certified_mail;\n    Notes TTP {|Agent R, Agent TTP, S2TTP, Key(RPwd R), hr|} \\<in> set evs3;\n    S2TTP = Crypt (pubEK TTP) \n                     {|Agent S, Number BothAuth, Key k, Agent R, hs|};\n    TTP \\<noteq> R;  hs = hr;  k \\<in> symKeys|]\n  ==> \n   Notes R {|Agent TTP, Agent R, Key k, hr|} # \n   Gets S (Crypt (priSK TTP) S2TTP) # \n   Says TTP S (Crypt (priSK TTP) S2TTP) # evs3 \\<in> certified_mail\"\n\n| Reception:\n \"[|evsr \\<in> certified_mail; Says A B X \\<in> set evsr|]\n  ==> Gets B X#evsr \\<in> certified_mail\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare analz_into_parts [dest]\n\n(*A \"possibility property\": there are traces that reach the end*)\nlemma \"[| Key K \\<notin> used []; K \\<in> symKeys |] ==> \n       \\<exists>S2TTP. \\<exists>evs \\<in> certified_mail.\n           Says TTP S (Crypt (priSK TTP) S2TTP) \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] certified_mail.Nil\n                    [THEN certified_mail.CM1, THEN certified_mail.Reception,\n                     THEN certified_mail.CM2, \n                     THEN certified_mail.CM3]) \napply (possibility, auto) \ndone\n\n\nlemma Gets_imp_Says:\n \"[| Gets B X \\<in> set evs; evs \\<in> certified_mail |] ==> \\<exists>A. Says A B X \\<in> set evs\"\napply (erule rev_mp)\napply (erule certified_mail.induct, auto)\ndone\n\n\nlemma Gets_imp_parts_knows_Spy:\n     \"[|Gets A X \\<in> set evs; evs \\<in> certified_mail|] ==> X \\<in> parts(spies evs)\"\napply (drule Gets_imp_Says, simp)\napply (blast dest: Says_imp_knows_Spy parts.Inj) \ndone\n\nlemma CM2_S2TTP_analz_knows_Spy:\n \"[|Gets R {|Agent A, Agent B, em, Number AO, Number cleartext, \n              Nonce q, S2TTP|} \\<in> set evs;\n    evs \\<in> certified_mail|] \n  ==> S2TTP \\<in> analz(spies evs)\"\napply (drule Gets_imp_Says, simp) \napply (blast dest: Says_imp_knows_Spy analz.Inj) \ndone\n\nlemmas CM2_S2TTP_parts_knows_Spy = \n    CM2_S2TTP_analz_knows_Spy [THEN analz_subset_parts [THEN subsetD]]\n\nlemma hr_form_lemma [rule_format]:\n \"evs \\<in> certified_mail\n  ==> hr \\<notin> synth (analz (spies evs)) --> \n      (\\<forall>S2TTP. Notes TTP {|Agent R, Agent TTP, S2TTP, pwd, hr|}\n          \\<in> set evs --> \n      (\\<exists>clt q S em. hr = Hash {|Number clt, Nonce q, response S R q, em|}))\"\napply (erule certified_mail.induct)\napply (synth_analz_mono_contra, simp_all, blast+)\ndone \n\ntext{*Cannot strengthen the first disjunct to @{term \"R\\<noteq>Spy\"} because\nthe fakessl rule allows Spy to spoof the sender's name.  Maybe can\nstrengthen the second disjunct with @{term \"R\\<noteq>Spy\"}.*}\nlemma hr_form:\n \"[|Notes TTP {|Agent R, Agent TTP, S2TTP, pwd, hr|} \\<in> set evs;\n    evs \\<in> certified_mail|]\n  ==> hr \\<in> synth (analz (spies evs)) | \n      (\\<exists>clt q S em. hr = Hash {|Number clt, Nonce q, response S R q, em|})\"\nby (blast intro: hr_form_lemma) \n\nlemma Spy_dont_know_private_keys [dest!]:\n    \"[|Key (privateKey b A) \\<in> parts (spies evs); evs \\<in> certified_mail|]\n     ==> A \\<in> bad\"\napply (erule rev_mp) \napply (erule certified_mail.induct, simp_all)\ntxt{*Fake*}\napply (blast dest: Fake_parts_insert_in_Un) \ntxt{*Message 1*}\napply blast  \ntxt{*Message 3*}\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: parts_insert2) \n apply (force dest!: parts_insert_subset_Un [THEN [2] rev_subsetD] \n                     analz_subset_parts [THEN subsetD], blast) \ndone\n\nlemma Spy_know_private_keys_iff [simp]:\n    \"evs \\<in> certified_mail\n     ==> (Key (privateKey b A) \\<in> parts (spies evs)) = (A \\<in> bad)\"\nby blast \n\nlemma Spy_dont_know_TTPKey_parts [simp]:\n     \"evs \\<in> certified_mail ==> Key (privateKey b TTP) \\<notin> parts(spies evs)\" \nby simp\n\nlemma Spy_dont_know_TTPKey_analz [simp]:\n     \"evs \\<in> certified_mail ==> Key (privateKey b TTP) \\<notin> analz(spies evs)\"\nby auto\n\ntext{*Thus, prove any goal that assumes that @{term Spy} knows a private key\nbelonging to @{term TTP}*}\ndeclare Spy_dont_know_TTPKey_parts [THEN [2] rev_notE, elim!]\n\n\nlemma CM3_k_parts_knows_Spy:\n \"[| evs \\<in> certified_mail;\n     Notes TTP {|Agent A, Agent TTP,\n                 Crypt (pubEK TTP) {|Agent S, Number AO, Key K, \n                 Agent R, hs|}, Key (RPwd R), hs|} \\<in> set evs|]\n  ==> Key K \\<in> parts(spies evs)\"\napply (rotate_tac 1)\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all)\n   apply (blast  intro:parts_insertI)\ntxt{*Fake SSL*}\napply (blast dest: parts.Body) \ntxt{*Message 2*}\napply (blast dest!: Gets_imp_Says elim!: knows_Spy_partsEs)\ntxt{*Message 3*}\napply (metis parts_insertI)\ndone\n\nlemma Spy_dont_know_RPwd [rule_format]:\n    \"evs \\<in> certified_mail ==> Key (RPwd A) \\<in> parts(spies evs) --> A \\<in> bad\"\napply (erule certified_mail.induct, simp_all) \ntxt{*Fake*}\napply (blast dest: Fake_parts_insert_in_Un) \ntxt{*Message 1*}\napply blast  \ntxt{*Message 3*}\napply (frule CM3_k_parts_knows_Spy, assumption)\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: parts_insert2) \napply (force dest!: parts_insert_subset_Un [THEN [2] rev_subsetD]\n                    analz_subset_parts [THEN subsetD])\ndone\n\n\nlemma Spy_know_RPwd_iff [simp]:\n    \"evs \\<in> certified_mail ==> (Key (RPwd A) \\<in> parts(spies evs)) = (A\\<in>bad)\"\nby (auto simp add: Spy_dont_know_RPwd) \n\nlemma Spy_analz_RPwd_iff [simp]:\n    \"evs \\<in> certified_mail ==> (Key (RPwd A) \\<in> analz(spies evs)) = (A\\<in>bad)\"\nby (metis Spy_know_RPwd_iff Spy_spies_bad_shrK analz.Inj analz_into_parts)\n\ntext{*Unused, but a guarantee of sorts*}\ntheorem CertAutenticity:\n     \"[|Crypt (priSK TTP) X \\<in> parts (spies evs); evs \\<in> certified_mail|] \n      ==> \\<exists>A. Says TTP A (Crypt (priSK TTP) X) \\<in> set evs\"\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all) \ntxt{*Fake*}\napply (blast dest: Spy_dont_know_private_keys Fake_parts_insert_in_Un)\ntxt{*Message 1*}\napply blast \ntxt{*Message 3*}\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: parts_insert2 parts_insert_knows_A) \n apply (blast dest!: Fake_parts_sing_imp_Un, blast)\ndone\n\n\nsubsection{*Proving Confidentiality Results*}\n\nlemma analz_image_freshK [rule_format]:\n \"evs \\<in> certified_mail ==>\n   \\<forall>K KK. invKey (pubEK TTP) \\<notin> KK -->\n          (Key K \\<in> analz (Key`KK Un (spies evs))) =\n          (K \\<in> KK | Key K \\<in> analz (spies evs))\"\napply (erule certified_mail.induct)\napply (drule_tac [6] A=TTP in symKey_neq_priEK) \napply (erule_tac [6] disjE [OF hr_form]) \napply (drule_tac [5] CM2_S2TTP_analz_knows_Spy) \nprefer 9\napply (elim exE)\napply (simp_all add: synth_analz_insert_eq\n                     subset_trans [OF _ subset_insertI]\n                     subset_trans [OF _ Un_upper2] \n                del: image_insert image_Un add: analz_image_freshK_simps)\ndone\n\n\nlemma analz_insert_freshK:\n  \"[| evs \\<in> certified_mail;  KAB \\<noteq> invKey (pubEK TTP) |] ==>\n      (Key K \\<in> analz (insert (Key KAB) (spies evs))) =\n      (K = KAB | Key K \\<in> analz (spies evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\ntext{*@{term S2TTP} must have originated from a valid sender\n    provided @{term K} is secure.  Proof is surprisingly hard.*}\n\nlemma Notes_SSL_imp_used:\n     \"[|Notes B {|Agent A, Agent B, X|} \\<in> set evs|] ==> X \\<in> used evs\"\nby (blast dest!: Notes_imp_used)\n\n\n(*The weaker version, replacing \"used evs\" by \"parts (spies evs)\", \n   isn't inductive: message 3 case can't be proved *)\nlemma S2TTP_sender_lemma [rule_format]:\n \"evs \\<in> certified_mail ==>\n    Key K \\<notin> analz (spies evs) -->\n    (\\<forall>AO. Crypt (pubEK TTP)\n           {|Agent S, Number AO, Key K, Agent R, hs|} \\<in> used evs -->\n    (\\<exists>m ctxt q. \n        hs = Hash{|Number ctxt, Nonce q, response S R q, Crypt K (Number m)|} &\n        Says S R\n           {|Agent S, Agent TTP, Crypt K (Number m), Number AO,\n             Number ctxt, Nonce q,\n             Crypt (pubEK TTP)\n              {|Agent S, Number AO, Key K, Agent R, hs |}|} \\<in> set evs))\" \napply (erule certified_mail.induct, analz_mono_contra)\napply (drule_tac [5] CM2_S2TTP_parts_knows_Spy, simp)\napply (simp add: used_Nil Crypt_notin_initState, simp_all)\ntxt{*Fake*}\napply (blast dest: Fake_parts_sing [THEN subsetD]\n             dest!: analz_subset_parts [THEN subsetD])  \ntxt{*Fake SSL*}\napply (blast dest: Fake_parts_sing [THEN subsetD]\n             dest: analz_subset_parts [THEN subsetD])  \ntxt{*Message 1*}\napply (clarsimp, blast)\ntxt{*Message 2*}\napply (simp add: parts_insert2, clarify) \napply (metis parts_cut Un_empty_left usedI)\ntxt{*Message 3*} \napply (blast dest: Notes_SSL_imp_used used_parts_subset_parts) \ndone \n\nlemma S2TTP_sender:\n \"[|Crypt (pubEK TTP) {|Agent S, Number AO, Key K, Agent R, hs|} \\<in> used evs;\n    Key K \\<notin> analz (spies evs);\n    evs \\<in> certified_mail|]\n  ==> \\<exists>m ctxt q. \n        hs = Hash{|Number ctxt, Nonce q, response S R q, Crypt K (Number m)|} &\n        Says S R\n           {|Agent S, Agent TTP, Crypt K (Number m), Number AO,\n             Number ctxt, Nonce q,\n             Crypt (pubEK TTP)\n              {|Agent S, Number AO, Key K, Agent R, hs |}|} \\<in> set evs\" \nby (blast intro: S2TTP_sender_lemma) \n\n\ntext{*Nobody can have used non-existent keys!*}\nlemma new_keys_not_used [simp]:\n    \"[|Key K \\<notin> used evs; K \\<in> symKeys; evs \\<in> certified_mail|]\n     ==> K \\<notin> keysFor (parts (spies evs))\"\napply (erule rev_mp) \napply (erule certified_mail.induct, simp_all) \ntxt{*Fake*}\napply (force dest!: keysFor_parts_insert) \ntxt{*Message 1*}\napply blast \ntxt{*Message 3*}\napply (frule CM3_k_parts_knows_Spy, assumption)\napply (frule_tac hr_form, assumption) \napply (force dest!: keysFor_parts_insert)\ndone\n\n\ntext{*Less easy to prove @{term \"m'=m\"}.  Maybe needs a separate unicity\ntheorem for ciphertexts of the form @{term \"Crypt K (Number m)\"}, \nwhere @{term K} is secure.*}\nlemma Key_unique_lemma [rule_format]:\n     \"evs \\<in> certified_mail ==>\n       Key K \\<notin> analz (spies evs) -->\n       (\\<forall>m cleartext q hs.\n        Says S R\n           {|Agent S, Agent TTP, Crypt K (Number m), Number AO,\n             Number cleartext, Nonce q,\n             Crypt (pubEK TTP) {|Agent S, Number AO, Key K, Agent R, hs|}|}\n          \\<in> set evs -->\n       (\\<forall>m' cleartext' q' hs'.\n       Says S' R'\n           {|Agent S', Agent TTP, Crypt K (Number m'), Number AO',\n             Number cleartext', Nonce q',\n             Crypt (pubEK TTP) {|Agent S', Number AO', Key K, Agent R', hs'|}|}\n          \\<in> set evs --> R' = R & S' = S & AO' = AO & hs' = hs))\" \napply (erule certified_mail.induct, analz_mono_contra, simp_all)\n prefer 2\n txt{*Message 1*}\n apply (blast dest!: Says_imp_knows_Spy [THEN parts.Inj] new_keys_not_used Crypt_imp_keysFor)\ntxt{*Fake*}\napply (auto dest!: usedI S2TTP_sender analz_subset_parts [THEN subsetD]) \ndone\n\ntext{*The key determines the sender, recipient and protocol options.*}\nlemma Key_unique:\n      \"[|Says S R\n           {|Agent S, Agent TTP, Crypt K (Number m), Number AO,\n             Number cleartext, Nonce q,\n             Crypt (pubEK TTP) {|Agent S, Number AO, Key K, Agent R, hs|}|}\n          \\<in> set evs;\n         Says S' R'\n           {|Agent S', Agent TTP, Crypt K (Number m'), Number AO',\n             Number cleartext', Nonce q',\n             Crypt (pubEK TTP) {|Agent S', Number AO', Key K, Agent R', hs'|}|}\n          \\<in> set evs;\n         Key K \\<notin> analz (spies evs);\n         evs \\<in> certified_mail|]\n       ==> R' = R & S' = S & AO' = AO & hs' = hs\"\nby (rule Key_unique_lemma, assumption+)\n\n\nsubsection{*The Guarantees for Sender and Recipient*}\n\ntext{*A Sender's guarantee:\n      If Spy gets the key then @{term R} is bad and @{term S} moreover\n      gets his return receipt (and therefore has no grounds for complaint).*}\ntheorem S_fairness_bad_R:\n      \"[|Says S R {|Agent S, Agent TTP, Crypt K (Number m), Number AO, \n                     Number cleartext, Nonce q, S2TTP|} \\<in> set evs;\n         S2TTP = Crypt (pubEK TTP) {|Agent S, Number AO, Key K, Agent R, hs|};\n         Key K \\<in> analz (spies evs);\n         evs \\<in> certified_mail;\n         S\\<noteq>Spy|]\n      ==> R \\<in> bad & Gets S (Crypt (priSK TTP) S2TTP) \\<in> set evs\"\napply (erule rev_mp)\napply (erule ssubst)\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all)\ntxt{*Fake*}\napply spy_analz\ntxt{*Fake SSL*}\napply spy_analz\ntxt{*Message 3*}\napply (frule_tac hr_form, assumption)\napply (elim disjE exE) \napply (simp_all add: synth_analz_insert_eq  \n                     subset_trans [OF _ subset_insertI]\n                     subset_trans [OF _ Un_upper2] \n                del: image_insert image_Un add: analz_image_freshK_simps) \napply (simp_all add: symKey_neq_priEK analz_insert_freshK)\napply (blast dest: Notes_SSL_imp_used S2TTP_sender Key_unique)+\ndone\n\ntext{*Confidentially for the symmetric key*}\ntheorem Spy_not_see_encrypted_key:\n      \"[|Says S R {|Agent S, Agent TTP, Crypt K (Number m), Number AO, \n                     Number cleartext, Nonce q, S2TTP|} \\<in> set evs;\n         S2TTP = Crypt (pubEK TTP) {|Agent S, Number AO, Key K, Agent R, hs|};\n         evs \\<in> certified_mail;\n         S\\<noteq>Spy; R \\<notin> bad|]\n      ==> Key K \\<notin> analz(spies evs)\"\nby (blast dest: S_fairness_bad_R) \n\n\ntext{*Agent @{term R}, who may be the Spy, doesn't receive the key\n until @{term S} has access to the return receipt.*} \ntheorem S_guarantee:\n     \"[|Says S R {|Agent S, Agent TTP, Crypt K (Number m), Number AO, \n                    Number cleartext, Nonce q, S2TTP|} \\<in> set evs;\n        S2TTP = Crypt (pubEK TTP) {|Agent S, Number AO, Key K, Agent R, hs|};\n        Notes R {|Agent TTP, Agent R, Key K, hs|} \\<in> set evs;\n        S\\<noteq>Spy;  evs \\<in> certified_mail|]\n     ==> Gets S (Crypt (priSK TTP) S2TTP) \\<in> set evs\"\napply (erule rev_mp)\napply (erule ssubst)\napply (erule rev_mp)\napply (erule certified_mail.induct, simp_all)\ntxt{*Message 1*}\napply (blast dest: Notes_imp_used) \ntxt{*Message 3*}\napply (blast dest: Notes_SSL_imp_used S2TTP_sender Key_unique S_fairness_bad_R) \ndone\n\n\ntext{*If @{term R} sends message 2, and a delivery certificate exists, \n then @{term R} receives the necessary key.  This result is also important\n to @{term S}, as it confirms the validity of the return receipt.*}\ntheorem RR_validity:\n  \"[|Crypt (priSK TTP) S2TTP \\<in> used evs;\n     S2TTP = Crypt (pubEK TTP)\n               {|Agent S, Number AO, Key K, Agent R, \n                 Hash {|Number cleartext, Nonce q, r, em|}|};\n     hr = Hash {|Number cleartext, Nonce q, r, em|};\n     R\\<noteq>Spy;  evs \\<in> certified_mail|]\n  ==> Notes R {|Agent TTP, Agent R, Key K, hr|} \\<in> set evs\"\napply (erule rev_mp)\napply (erule ssubst)\napply (erule ssubst)\napply (erule certified_mail.induct, simp_all)\ntxt{*Fake*} \napply (blast dest: Fake_parts_sing [THEN subsetD]\n             dest!: analz_subset_parts [THEN subsetD])  \ntxt{*Fake SSL*}\napply (blast dest: Fake_parts_sing [THEN subsetD]\n            dest!: analz_subset_parts [THEN subsetD])  \ntxt{*Message 2*}\napply (drule CM2_S2TTP_parts_knows_Spy, assumption)\napply (force dest: parts_cut)\ntxt{*Message 3*}\napply (frule_tac hr_form, assumption)\napply (elim disjE exE, simp_all) \napply (blast dest: Fake_parts_sing [THEN subsetD]\n             dest!: analz_subset_parts [THEN subsetD]) \ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/CertifiedEmail.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544335934766, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.34689580973590656}}
{"text": "(*  Title:      HOL/HOLCF/IOA/NTP/Impl.thy\n    Author:     Tobias Nipkow & Konrad Slind\n*)\n\nsection {* The implementation *}\n\ntheory Impl\nimports Sender Receiver Abschannel\nbegin\n\ntype_synonym 'm impl_state\n  = \"'m sender_state * 'm receiver_state * 'm packet multiset * bool multiset\"\n  (*  sender_state   *  receiver_state   *    srch_state      * rsch_state *)\n\n\ndefinition\n  impl_ioa :: \"('m action, 'm impl_state)ioa\" where\n  impl_def: \"impl_ioa == (sender_ioa || receiver_ioa || srch_ioa || rsch_ioa)\"\n\ndefinition sen :: \"'m impl_state => 'm sender_state\" where \"sen = fst\"\ndefinition rec :: \"'m impl_state => 'm receiver_state\" where \"rec = fst o snd\"\ndefinition srch :: \"'m impl_state => 'm packet multiset\" where \"srch = fst o snd o snd\"\ndefinition rsch :: \"'m impl_state => bool multiset\" where \"rsch = snd o snd o snd\"\n\ndefinition\n  hdr_sum :: \"'m packet multiset => bool => nat\" where\n  \"hdr_sum M b == countm M (%pkt. hdr(pkt) = b)\"\n\n(* Lemma 5.1 *)\ndefinition\n  \"inv1(s) ==\n     (!b. count (rsent(rec s)) b = count (srcvd(sen s)) b + count (rsch s) b)\n   & (!b. count (ssent(sen s)) b\n          = hdr_sum (rrcvd(rec s)) b + hdr_sum (srch s) b)\"\n\n(* Lemma 5.2 *)\ndefinition\n  \"inv2(s) ==\n  (rbit(rec(s)) = sbit(sen(s)) &\n   ssending(sen(s)) &\n   count (rsent(rec s)) (~sbit(sen s)) <= count (ssent(sen s)) (~sbit(sen s)) &\n   count (ssent(sen s)) (~sbit(sen s)) <= count (rsent(rec s)) (sbit(sen s)))\n   |\n  (rbit(rec(s)) = (~sbit(sen(s))) &\n   rsending(rec(s)) &\n   count (ssent(sen s)) (~sbit(sen s)) <= count (rsent(rec s)) (sbit(sen s)) &\n   count (rsent(rec s)) (sbit(sen s)) <= count (ssent(sen s)) (sbit(sen s)))\"\n\n(* Lemma 5.3 *)\ndefinition\n  \"inv3(s) ==\n   rbit(rec(s)) = sbit(sen(s))\n   --> (!m. sq(sen(s))=[] | m ~= hd(sq(sen(s)))\n        -->  count (rrcvd(rec s)) (sbit(sen(s)),m)\n             + count (srch s) (sbit(sen(s)),m)\n            <= count (rsent(rec s)) (~sbit(sen s)))\"\n\n(* Lemma 5.4 *)\ndefinition \"inv4(s) == rbit(rec(s)) = (~sbit(sen(s))) --> sq(sen(s)) ~= []\"\n\n\nsubsection {* Invariants *}\n\ndeclare le_SucI [simp]\n\nlemmas impl_ioas =\n  impl_def sender_ioa_def receiver_ioa_def srch_ioa_thm [THEN eq_reflection]\n  rsch_ioa_thm [THEN eq_reflection]\n\nlemmas \"transitions\" =\n  sender_trans_def receiver_trans_def srch_trans_def rsch_trans_def\n\n\nlemmas [simp] =\n  ioa_triple_proj starts_of_par trans_of_par4 in_sender_asig\n  in_receiver_asig in_srch_asig in_rsch_asig\n\ndeclare let_weak_cong [cong]\n\n\n\nlemma [simp]:\n  \"a:actions(sender_asig)\n  | a:actions(receiver_asig)\n  | a:actions(srch_asig)\n  | a:actions(rsch_asig)\"\n  by (induct a) simp_all\n\ndeclare split_paired_All [simp del]\n\n\n(* Three Simp_sets in different sizes\n----------------------------------------------\n\n1) simpset() does not unfold the transition relations\n2) ss unfolds transition relations\n3) renname_ss unfolds transitions and the abstract channel *)\n\nML {*\nval ss = simpset_of (@{context} addsimps @{thms \"transitions\"});\nval rename_ss = simpset_of (put_simpset ss @{context} addsimps @{thms unfold_renaming});\n\nfun tac ctxt =\n  asm_simp_tac (put_simpset ss ctxt\n    |> Simplifier.add_cong @{thm conj_cong} |> Splitter.add_split @{thm split_if})\nfun tac_ren ctxt =\n  asm_simp_tac (put_simpset rename_ss ctxt\n    |> Simplifier.add_cong @{thm conj_cong} |> Splitter.add_split @{thm split_if})\n*}\n\n\nsubsubsection {* Invariant 1 *}\n\nlemma raw_inv1: \"invariant impl_ioa inv1\"\n\napply (unfold impl_ioas)\napply (rule invariantI)\napply (simp add: inv1_def hdr_sum_def srcvd_def ssent_def rsent_def rrcvd_def)\n\napply (simp (no_asm) del: trans_of_par4 add: imp_conjR inv1_def)\n\ntxt {* Split proof in two *}\napply (rule conjI)\n\n(* First half *)\napply (simp add: Impl.inv1_def split del: split_if)\napply (induct_tac a)\n\napply (tactic \"EVERY1[tac @{context}, tac @{context}, tac @{context}, tac @{context}]\")\napply (tactic \"tac @{context} 1\")\napply (tactic \"tac_ren @{context} 1\")\n\ntxt {* 5 + 1 *}\n\napply (tactic \"tac @{context} 1\")\napply (tactic \"tac_ren @{context} 1\")\n\ntxt {* 4 + 1 *}\napply (tactic {* EVERY1[tac @{context}, tac @{context}, tac @{context}, tac @{context}] *})\n\n\ntxt {* Now the other half *}\napply (simp add: Impl.inv1_def split del: split_if)\napply (induct_tac a)\napply (tactic \"EVERY1 [tac @{context}, tac @{context}]\")\n\ntxt {* detour 1 *}\napply (tactic \"tac @{context} 1\")\napply (tactic \"tac_ren @{context} 1\")\napply (rule impI)\napply (erule conjE)+\napply (simp (no_asm_simp) add: hdr_sum_def Multiset.count_def Multiset.countm_nonempty_def\n  split add: split_if)\ntxt {* detour 2 *}\napply (tactic \"tac @{context} 1\")\napply (tactic \"tac_ren @{context} 1\")\napply (rule impI)\napply (erule conjE)+\napply (simp add: Impl.hdr_sum_def Multiset.count_def Multiset.countm_nonempty_def\n  Multiset.delm_nonempty_def split add: split_if)\napply (rule allI)\napply (rule conjI)\napply (rule impI)\napply hypsubst\napply (rule pred_suc [THEN iffD1])\napply (drule less_le_trans)\napply (cut_tac eq_packet_imp_eq_hdr [unfolded Packet.hdr_def, THEN countm_props])\napply assumption\napply assumption\n\napply (rule countm_done_delm [THEN mp, symmetric])\napply (rule refl)\napply (simp (no_asm_simp) add: Multiset.count_def)\n\napply (rule impI)\napply (simp add: neg_flip)\napply hypsubst\napply (rule countm_spurious_delm)\napply (simp (no_asm))\n\napply (tactic \"EVERY1 [tac @{context}, tac @{context}, tac @{context},\n  tac @{context}, tac @{context}, tac @{context}]\")\n\ndone\n\n\n\nsubsubsection {* INVARIANT 2 *}\n\nlemma raw_inv2: \"invariant impl_ioa inv2\"\n\n  apply (rule invariantI1)\n  txt {* Base case *}\n  apply (simp add: inv2_def receiver_projections sender_projections impl_ioas)\n\n  apply (simp (no_asm_simp) add: impl_ioas split del: split_if)\n  apply (induct_tac \"a\")\n\n  txt {* 10 cases. First 4 are simple, since state doesn't change *}\n\n  ML_prf {* val tac2 = asm_full_simp_tac (put_simpset ss @{context} addsimps [@{thm inv2_def}]) *}\n\n  txt {* 10 - 7 *}\n  apply (tactic \"EVERY1 [tac2,tac2,tac2,tac2]\")\n  txt {* 6 *}\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm Impl.inv1_def}]\n                               (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct1] 1 *})\n\n  txt {* 6 - 5 *}\n  apply (tactic \"EVERY1 [tac2,tac2]\")\n\n  txt {* 4 *}\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm Impl.inv1_def}]\n                                (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct1] 1 *})\n  apply (tactic \"tac2 1\")\n\n  txt {* 3 *}\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm Impl.inv1_def}]\n    (@{thm raw_inv1} RS @{thm invariantE})] 1 *})\n\n  apply (tactic \"tac2 1\")\n  apply (tactic {* fold_goals_tac @{context} [rewrite_rule @{context} [@{thm Packet.hdr_def}]\n    (@{thm Impl.hdr_sum_def})] *})\n  apply arith\n\n  txt {* 2 *}\n  apply (tactic \"tac2 1\")\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm Impl.inv1_def}]\n                               (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct1] 1 *})\n  apply (intro strip)\n  apply (erule conjE)+\n  apply simp\n\n  txt {* 1 *}\n  apply (tactic \"tac2 1\")\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm Impl.inv1_def}]\n                               (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct2] 1 *})\n  apply (intro strip)\n  apply (erule conjE)+\n  apply (tactic {* fold_goals_tac @{context}\n    [rewrite_rule @{context} [@{thm Packet.hdr_def}] (@{thm Impl.hdr_sum_def})] *})\n  apply simp\n\n  done\n\n\nsubsubsection {* INVARIANT 3 *}\n\nlemma raw_inv3: \"invariant impl_ioa inv3\"\n\n  apply (rule invariantI)\n  txt {* Base case *}\n  apply (simp add: Impl.inv3_def receiver_projections sender_projections impl_ioas)\n\n  apply (simp (no_asm_simp) add: impl_ioas split del: split_if)\n  apply (induct_tac \"a\")\n\n  ML_prf {* val tac3 = asm_full_simp_tac (put_simpset ss @{context} addsimps [@{thm inv3_def}]) *}\n\n  txt {* 10 - 8 *}\n\n  apply (tactic \"EVERY1[tac3,tac3,tac3]\")\n\n  apply (tactic \"tac_ren @{context} 1\")\n  apply (intro strip, (erule conjE)+)\n  apply hypsubst\n  apply (erule exE)\n  apply simp\n\n  txt {* 7 *}\n  apply (tactic \"tac3 1\")\n  apply (tactic \"tac_ren @{context} 1\")\n  apply force\n\n  txt {* 6 - 3 *}\n\n  apply (tactic \"EVERY1[tac3,tac3,tac3,tac3]\")\n\n  txt {* 2 *}\n  apply (tactic \"asm_full_simp_tac (put_simpset ss @{context}) 1\")\n  apply (simp (no_asm) add: inv3_def)\n  apply (intro strip, (erule conjE)+)\n  apply (rule imp_disjL [THEN iffD1])\n  apply (rule impI)\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm Impl.inv2_def}]\n    (@{thm raw_inv2} RS @{thm invariantE})] 1 *})\n  apply simp\n  apply (erule conjE)+\n  apply (rule_tac j = \"count (ssent (sen s)) (~sbit (sen s))\" and\n    k = \"count (rsent (rec s)) (sbit (sen s))\" in le_trans)\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm inv1_def}]\n                                (@{thm raw_inv1} RS @{thm invariantE}) RS conjunct2] 1 *})\n  apply (simp add: hdr_sum_def Multiset.count_def)\n  apply (rule add_le_mono)\n  apply (rule countm_props)\n  apply (simp (no_asm))\n  apply (rule countm_props)\n  apply (simp (no_asm))\n  apply assumption\n\n  txt {* 1 *}\n  apply (tactic \"tac3 1\")\n  apply (intro strip, (erule conjE)+)\n  apply (rule imp_disjL [THEN iffD1])\n  apply (rule impI)\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm Impl.inv2_def}]\n    (@{thm raw_inv2} RS @{thm invariantE})] 1 *})\n  apply simp\n  done\n\n\nsubsubsection {* INVARIANT 4 *}\n\nlemma raw_inv4: \"invariant impl_ioa inv4\"\n\n  apply (rule invariantI)\n  txt {* Base case *}\n  apply (simp add: Impl.inv4_def receiver_projections sender_projections impl_ioas)\n\n  apply (simp (no_asm_simp) add: impl_ioas split del: split_if)\n  apply (induct_tac \"a\")\n\n  ML_prf {* val tac4 =  asm_full_simp_tac (put_simpset ss @{context} addsimps [@{thm inv4_def}]) *}\n\n  txt {* 10 - 2 *}\n\n  apply (tactic \"EVERY1[tac4,tac4,tac4,tac4,tac4,tac4,tac4,tac4,tac4]\")\n\n  txt {* 2 b *}\n\n  apply (intro strip, (erule conjE)+)\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm Impl.inv2_def}]\n                               (@{thm raw_inv2} RS @{thm invariantE})] 1 *})\n  apply simp\n\n  txt {* 1 *}\n  apply (tactic \"tac4 1\")\n  apply (intro strip, (erule conjE)+)\n  apply (rule ccontr)\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm Impl.inv2_def}]\n                               (@{thm raw_inv2} RS @{thm invariantE})] 1 *})\n  apply (tactic {* forward_tac [rewrite_rule @{context} [@{thm Impl.inv3_def}]\n                               (@{thm raw_inv3} RS @{thm invariantE})] 1 *})\n  apply simp\n  apply (rename_tac m, erule_tac x = \"m\" in allE)\n  apply simp\n  done\n\n\ntext {* rebind them *}\n\nlemmas inv1 = raw_inv1 [THEN invariantE, unfolded inv1_def]\n  and inv2 = raw_inv2 [THEN invariantE, unfolded inv2_def]\n  and inv3 = raw_inv3 [THEN invariantE, unfolded inv3_def]\n  and inv4 = raw_inv4 [THEN invariantE, unfolded inv4_def]\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/IOA/NTP/Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.3467699116908309}}
{"text": "(*  Title:      Word_Misc.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nchapter {* More about words *}\n\ntheory Word_Misc imports\n  \"~~/src/HOL/Word/Word\"\n  More_Bits_Int\nbegin\n\ntext {*\n  The separate code target @{text SML_word} collects setups for the\n  code generator that PolyML does not provide.\n*}\n\nsetup {* Code_Target.add_derived_target (\"SML_word\", [(Code_ML.target_SML, I)]) *}\n\ncode_identifier code_module Word_Misc \\<rightharpoonup>\n  (SML) Word and (Haskell) Word and (OCaml) Word and (Scala) Word\n\ncontext\nincludes integer.lifting\nbegin\nlift_definition word_of_integer :: \"integer \\<Rightarrow> 'a :: len0 word\" is word_of_int .\n\nlemma word_of_integer_code [code]: \"word_of_integer n = word_of_int (int_of_integer n)\"\nby(simp add: word_of_integer.rep_eq)\nend\n\nlemma shiftr_zero_size: \"size x \\<le> n \\<Longrightarrow> x >> n = (0 :: 'a :: len0 word)\"\nby(rule word_eqI)(auto simp add: nth_shiftr dest: test_bit_size)\n\nlemma mask_full [simp]: \"mask (len_of TYPE('a :: len)) = (-1 :: 'a word)\"\nby(simp add: mask_def word_pow_0)\n\nlemma set_bit_beyond: fixes x :: \"'a :: len0 word\" shows\n  \"size x \\<le> n \\<Longrightarrow> set_bit x n b = x\"\nby(auto intro: word_eqI simp add: test_bit_set_gen word_size)\n\nlemma word_of_int_code [code abstract]:\n  \"uint (word_of_int x :: 'a word) = x AND bin_mask (len_of TYPE('a :: len0))\"\nby(simp add: uint_word_of_int and_bin_mask_conv_mod)\n\n\ncontext begin interpretation lifting_syntax .\n\nlemma shiftl_transfer [transfer_rule]:\n  \"(pcr_word ===> op = ===> pcr_word) op << op <<\"\nby(auto intro!: rel_funI word_eqI simp add: word.pcr_cr_eq cr_word_def word_size nth_shiftl)\n\nend\n\nlemma set_bits_K_False [simp]: \"set_bits (\\<lambda>_. False) = (0 :: 'a :: len0 word)\"\nby(rule word_eqI)(simp add: test_bit.eq_norm)\n\nlemma test_bit_1' [simp]: \"(1 :: 'a :: len0 word) !! n \\<longleftrightarrow> 0 < len_of TYPE('a) \\<and> n = 0\"\nby(cases n)(simp_all only: one_word_def test_bit_wi bin_nth.simps, simp_all)\n\nlemma mask_0 [simp]: \"mask 0 = 0\"\nby(simp add: Word.mask_def)\n\nlemma shiftl0 [simp]: \"x << 0 = (x :: 'a :: len0 word)\"\nby (metis shiftl_rev shiftr_x_0 word_rev_gal)\n\nlemma mask_1: \"mask 1 = 1\"\nby(simp add: mask_def)\n\nlemma mask_Suc_0: \"mask (Suc 0) = 1\"\nby(simp add: mask_def)\n\nlemma mask_numeral: \"mask (numeral n) = 2 * mask (pred_numeral n) + 1\"\nunfolding mask_def by transfer(simp, simp add: shiftl_int_def)\n\nlemma bin_last_bintrunc: \"bin_last (bintrunc l n) = (l > 0 \\<and> bin_last n)\"\nby(cases l) simp_all\n\nlemma word_and_1:\n  fixes n :: \"_ word\"\n  shows \"n AND 1 = (if n !! 0 then 1 else 0)\"\nby transfer(rule bin_rl_eqI, simp_all add: bin_rest_trunc bin_last_bintrunc)\n\nlemma bintrunc_shiftl: \"bintrunc n (m << i) = bintrunc (n - i) m << i\"\nproof(induct i arbitrary: n)\n  case (Suc i)\n  thus ?case by(cases n) simp_all\nqed simp\n\nlemma uint_shiftl: \"uint (n << i) = bintrunc (size n) (uint n << i)\"\nunfolding word_size by transfer(simp add: bintrunc_shiftl)\n\ncontext fixes f :: \"nat \\<Rightarrow> bool\" begin\n\nfun set_bits_aux :: \"'a word \\<Rightarrow> nat \\<Rightarrow> 'a :: len0 word\"\nwhere\n  \"set_bits_aux w 0 = w\"\n| \"set_bits_aux w (Suc n) = set_bits_aux ((w << 1) OR (if f n then 1 else 0)) n\"\n\nlemma set_bits_aux_conv: \"set_bits_aux w n = (w << n) OR (set_bits f AND mask n)\"\napply(induct w n rule: set_bits_aux.induct)\napply(auto 4 3 intro: word_eqI simp add: word_ao_nth nth_shiftl test_bit.eq_norm word_size not_less less_Suc_eq)\ndone\n\ncorollary set_bits_conv_set_bits_aux:\n  \"set_bits f = (set_bits_aux 0 (len_of TYPE('a)) :: 'a :: len word)\"\nby(simp add: set_bits_aux_conv)\n\nend\n\nlemma word_test_bit_set_bits: \"(BITS n. f n :: 'a :: len0 word) !! n \\<longleftrightarrow> n < len_of TYPE('a) \\<and> f n\"\nby(auto simp add: word_set_bits_def test_bit_bl word_bl.Abs_inverse word_size)\n\nlemma word_of_int_conv_set_bits: \"word_of_int i = (BITS n. i !! n)\"\nby(rule word_eqI)(simp add: word_test_bit_set_bits)\n\ntext {*\n  Division on @{typ \"'a word\"} is unsigned, but Scala and OCaml only have signed division and modulus.\n*}\ndefinition word_sdiv :: \"'a :: len word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixl \"sdiv\" 70)\nwhere [code]:\n  \"x sdiv y =\n   (let x' = sint x; y' = sint y;\n        negative = (x' < 0) \\<noteq> (y' < 0);\n        result = abs x' div abs y'\n    in word_of_int (if negative then -result else result))\"\n\ndefinition word_smod :: \"'a :: len word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixl \"smod\" 70)\nwhere [code]:\n  \"x smod y =\n   (let x' = sint x; y' = sint y;\n        negative = (x' < 0);\n        result = abs x' mod abs y'\n    in word_of_int (if negative then -result else result))\"\n\nlemma sdiv_smod_id: \"(a sdiv b) * b + (a smod b) = a\"\nproof -\n  note [simp] = word_sdiv_def word_smod_def\n  have F5: \"\\<forall>u::'a word. - (- u) = u\" by (metis word_sint.Rep_inverse' minus_minus wi_hom_neg)\n  have F7: \"\\<forall>v u::'a word. u + v = v + u\" by(metis add.left_commute add_0_right)\n  have F8: \"\\<forall>(w::'a word) (v::int) u::int. word_of_int u + word_of_int v * w = word_of_int (u + v * sint w)\"\n    by (metis word_sint.Rep_inverse wi_hom_syms(1) wi_hom_syms(3))\n  have \"\\<exists>u. u = - sint b \\<and> word_of_int (sint a mod u + - (- u * (sint a div u))) = a\"\n    using F5 by (metis minus_minus word_sint.Rep_inverse' mult_minus_left add.commute zmod_zdiv_equality)\n  hence \"word_of_int (sint a mod - sint b + - (sint b * (sint a div - sint b))) = a\" by (metis equation_minus_iff)\n  hence \"word_of_int (sint a mod - sint b) + word_of_int (- (sint a div - sint b)) * b = a\"\n    using F8 by(metis mult.commute mult_minus_left)\n  hence eq: \"word_of_int (- (sint a div - sint b)) * b + word_of_int (sint a mod - sint b) = a\" using F7 by metis\n\n  show ?thesis\n  proof(cases \"sint a < 0\")\n    case True note a = this\n    show ?thesis\n    proof(cases \"sint b < 0\")\n      case True\n      with a show ?thesis\n        by simp (metis F7 F8 eq minus_equation_iff minus_mult_minus semiring_div_class.mod_div_equality')\n    next\n      case False\n      from eq have \"word_of_int (- (- sint a div sint b)) * b + word_of_int (- (- sint a mod sint b)) = a\"\n        by (metis div_minus_right mod_minus_right)\n      with a False show ?thesis by simp\n    qed\n  next\n    case False note a = this\n    show ?thesis\n    proof(cases \"sint b < 0\")\n      case True\n      with a eq show ?thesis by simp\n    next\n      case False with a show ?thesis\n        by simp (metis wi_hom_add wi_hom_mult add.commute mult.commute word_sint.Rep_inverse add.commute zmod_zdiv_equality)\n    qed\n  qed\nqed\n\nlemma nat_div_eq_Suc_0_iff: \"n div m = Suc 0 \\<longleftrightarrow> n \\<ge> m \\<and> n < 2 * (m :: nat)\"\n  apply (auto simp add: sdl)\n  using not_less apply fastforce\n  apply (metis One_nat_def Suc_1 div_eq_0_iff lessI neq0_conv td_gal_lt)\n  done\n\nlemma word_div_lt_eq_0:\n  fixes x :: \"'a :: len word\"\n  shows \"x < y \\<Longrightarrow> x div y = 0\"\nby(simp only: word_div_def zero_word_def uint_nat zdiv_int[symmetric] transfer_int_nat_numerals(1) word_less_def div_less)\n\nlemma Suc_0_lt_2p_len_of: \"Suc 0 < 2 ^ len_of TYPE('a :: len)\"\nby (metis One_nat_def len_gt_0 one_less_numeral_iff one_less_power semiring_norm(76))\n\nlemma unat_p2: \"n < len_of TYPE('a :: len) \\<Longrightarrow> unat (2 ^ n :: 'a word) = 2 ^ n\"\nproof(induct n)\n  case 0 thus ?case by simp\nnext\n  case (Suc n)\n  then obtain n' where \"len_of TYPE('a) = Suc n'\" by(cases \"len_of TYPE('a)\") simp_all\n  with Suc show ?case by(simp add: unat_word_ariths bintrunc_mod2p int_mod_eq')\nqed\n\nlemma div_half_nat:\n  fixes x y :: nat\n  assumes \"y \\<noteq> 0\"\n  shows \"(x div y, x mod y) = (let q = 2 * (x div 2 div y); r = x - q * y in if y \\<le> r then (q + 1, r - y) else (q, r))\"\nproof -\n  let ?q = \"2 * (x div 2 div y)\"\n  have q: \"?q = x div y - x div y mod 2\"\n    by(metis div_mult2_eq mult.commute mult_div_cancel)\n  let ?r = \"x - ?q * y\"\n  have r: \"?r = x mod y + x div y mod 2 * y\"\n    by(simp add: q diff_mult_distrib div_mod_equality')(metis diff_diff_cancel mod_less_eq_dividend mod_mult2_eq add.commute mult.commute)\n\n  show ?thesis\n  proof(cases \"y \\<le> x - ?q * y\")\n    case True\n    hence \"x div y mod 2 \\<noteq> 0\" unfolding r\n      by(metis Divides.mod_div_equality' True assms diff_is_0_eq div_le_mono mod_by_0 mod_div_trivial mod_self mod_simps(1) mult_div_cancel q)\n    hence \"x div y = ?q + 1\" unfolding q\n      by(metis le_add_diff_inverse mod_2_not_eq_zero_eq_one_nat mod_less_eq_dividend add.commute)\n    moreover hence \"x mod y = ?r - y\"\n      by simp(metis Divides.mod_div_equality' diff_commute diff_diff_left mult_Suc)\n    ultimately show ?thesis using True by(simp add: Let_def)\n  next\n    case False\n    hence \"x div y mod 2 = 0\" unfolding r\n      by(simp add: not_le)(metis Nat.add_0_right assms div_less div_mult_self2 mod_div_trivial mult.commute)\n    hence \"x div y = ?q\" unfolding q by simp\n    moreover hence \"x mod y = ?r\" by (metis mod_div_equality')\n    ultimately show ?thesis using False by(simp add: Let_def)\n  qed\nqed\n\nlemma div_half_word:\n  fixes x y :: \"'a :: len word\"\n  assumes \"y \\<noteq> 0\"\n  shows \"(x div y, x mod y) = (let q = (x >> 1) div y << 1; r = x - q * y in if y \\<le> r then (q + 1, r - y) else (q, r))\"\nproof -\n  obtain n where n: \"x = of_nat n\" \"n < 2 ^ len_of TYPE('a)\" by(cases x)\n  obtain m where m: \"y = of_nat m\" \"m < 2 ^ len_of TYPE('a)\" by(cases y)\n  let ?q = \"(x >> 1) div y << 1\"\n  let ?q' = \"2 * (n div 2 div m)\"\n  have \"n div 2 div m < 2 ^ len_of TYPE('a)\" using n by (metis of_nat_inverse unat_lt2p uno_simps(2))\n  hence q: \"?q = of_nat ?q'\" using n m\n    apply(simp add: shiftr_def shiftr1_def bin_rest_def uint_nat unat_of_nat shiftl_def shiftl1_def Bit_def word_div_def word_of_nat)\nby (metis of_nat_inverse of_nat_numeral uno_simps(2) word_of_nat zdiv_int of_nat_mult)\n\n  from assms have \"m \\<noteq> 0\" using m by -(rule notI, simp)\n\n  from n have \"2 * (n div 2 div m) < 2 ^ len_of TYPE('a)\"\n    by(metis mult.commute div_mult2_eq mult_div_cancel less_imp_diff_less of_nat_inverse unat_lt2p uno_simps(2))\n  moreover\n  have \"2 * (n div 2 div m) * m < 2 ^ len_of TYPE('a)\" using n unfolding div_mult2_eq[symmetric]\n    by(subst (2) mult.commute)(simp add: div_mod_equality' diff_mult_distrib mult_div_cancel div_mult2_eq)\n  moreover have \"2 * (n div 2 div m) * m \\<le> n\"\n    by(metis div_mult2_eq div_mult_le mult.assoc mult.commute)\n  ultimately\n  have r: \"x - ?q * y = of_nat (n - ?q' * m)\"\n    and \"y \\<le> x - ?q * y \\<Longrightarrow> of_nat (n - ?q' * m) - y = of_nat (n - ?q' * m - m)\"\n    using n m unfolding q\n    by(simp_all add: word_sub_wi word_mult_def uint_nat unat_of_nat of_nat_mult [symmetric] word_of_nat[symmetric] zdiff_int word_le_nat_alt del: of_nat_mult)\n  thus ?thesis using n m div_half_nat[OF `m \\<noteq> 0`, of n] unfolding q\n    by(simp add: word_le_nat_alt word_div_def word_mod_def uint_nat unat_of_nat zmod_int[symmetric] zdiv_int[symmetric] word_of_nat[symmetric])(simp add: Let_def split del: split_if split: if_split_asm)\nqed\n\n\nlemma word_div_eq_1_iff: \"n div m = 1 \\<longleftrightarrow> n \\<ge> m \\<and> unat n < 2 * unat (m :: 'a :: len word)\"\napply(simp only: word_arith_nat_defs word_le_nat_alt nat_div_eq_Suc_0_iff[symmetric])\napply(rule word_unat.Abs_inject)\n apply(simp only: unat_div[symmetric] word_unat.Rep)\napply(simp add: unats_def Suc_0_lt_2p_len_of)\ndone\n\ntext {*\n  This algorithm implements unsigned division in terms of signed division.\n  Taken from Hacker's Delight.\n*}\n\nlemma divmod_via_sdivmod:\n  fixes x y :: \"'a :: len word\"\n  assumes \"y \\<noteq> 0\"\n  shows\n  \"(x div y, x mod y) =\n  (if 1 << (len_of TYPE('a) - 1) \\<le> y then if x < y then (0, x) else (1, x - y)\n   else let q = ((x >> 1) sdiv y) << 1;\n            r = x - q * y\n        in if r \\<ge> y then (q + 1, r - y) else (q, r))\"\nproof(cases \"1 << (len_of TYPE('a) - 1) \\<le> y\")\n  case True\n  note y = this\n  show ?thesis\n  proof(cases \"x < y\")\n    case True\n    hence \"x mod y = x\"\n      by(cases x)(cases y, simp add: word_mod_def uint_nat unat_of_nat zmod_int[symmetric] word_of_nat[symmetric] mod_less word_less_nat_alt)\n    thus ?thesis using True y by(simp add: word_div_lt_eq_0)\n  next\n    case False\n    obtain n where n: \"y = of_nat n\" \"n < 2 ^ len_of TYPE('a)\" by(cases y)\n    have \"unat x < 2 ^ len_of TYPE('a)\" by(rule unat_lt2p)\n    also have \"\\<dots> = 2 * 2 ^ (len_of TYPE('a) - 1)\"\n      by(metis Suc_pred len_gt_0 power_Suc One_nat_def)\n    also have \"\\<dots> \\<le> 2 * n\" using y n\n      by(simp add: word_le_nat_alt unat_of_nat unat_p2)\n    finally have div: \"x div of_nat n = 1\" using False n\n      by(simp add: word_div_eq_1_iff not_less word_le_nat_alt unat_of_nat)\n    moreover have \"x mod y = x - x div y * y\"\n      by (metis add_diff_cancel2 word_mod_div_equality)\n    with div n have \"x mod y = x - y\" by simp\n    ultimately show ?thesis using False y n by simp\n  qed\nnext\n  case False\n  note y = this\n  obtain n where n: \"x = of_nat n\" \"n < 2 ^ len_of TYPE('a)\" by(cases x)\n  hence \"int n div 2 + 2 ^ (len_of TYPE('a) - Suc 0) < 2 ^ len_of TYPE('a)\"\n    by(cases \"len_of TYPE('a)\")(simp_all, simp only: int_numeral[symmetric] zdiv_int[symmetric] of_nat_power [symmetric])\n  with y n have \"sint (x >> 1) = uint (x >> 1)\"\n    by(simp add: sint_uint sbintrunc_mod2p shiftr_div_2n)(simp add: int_mod_eq' uint_nat unat_of_nat)\n  moreover have \"uint y + 2 ^ (len_of TYPE('a) - Suc 0) < 2 ^ len_of TYPE('a)\" using y\n    by(cases \"len_of TYPE('a)\")(simp_all add: not_le, metis lessI word_2p_lem word_less_def word_size)\n  hence \"sint y = uint y\" by(simp add: sint_uint sbintrunc_mod2p int_mod_eq')\n  ultimately show ?thesis using y\n    by(subst div_half_word[OF assms])(simp add: word_sdiv_def uint_div[symmetric])\nqed\n\nlemma word_of_int_via_signed:\n  fixes mask\n  assumes mask_def: \"mask = bin_mask (len_of TYPE('a))\"\n  and shift_def: \"shift = 1 << len_of TYPE('a)\"\n  and index_def: \"index = len_of TYPE('a) - 1\"\n  and overflow_def:\"overflow = 1 << (len_of TYPE('a) - 1)\"\n  and least_def: \"least = - overflow\"\n  shows\n  \"(word_of_int i :: 'a :: len word) =\n   (let i' = i AND mask\n    in if i' !! index then\n         if i' - shift < least \\<or> overflow \\<le> i' - shift then arbitrary1 i' else word_of_int (i' - shift)\n       else if i' < least \\<or> overflow \\<le> i' then arbitrary2 i' else word_of_int i')\"\nproof -\n  def i' \\<equiv> \"i AND mask\"\n  have \"shift = mask + 1\" unfolding assms by(simp add: bin_mask_p1_conv_shift)\n  hence \"i' < shift\" by(simp add: mask_def i'_def int_and_le)\n  show ?thesis\n  proof(cases \"i' !! index\")\n    case True\n    hence unf: \"i' = overflow OR i'\" unfolding assms i'_def\n      by(auto intro!: bin_eqI simp add: bin_nth_ops)\n    have \"overflow \\<le> i'\" by(subst unf)(rule le_int_or, simp add: bin_sign_and assms i'_def)\n    hence \"i' - shift < least \\<longleftrightarrow> False\" unfolding assms\n      by(cases \"len_of TYPE('a)\")(simp_all add: not_less Bit_def)\n    moreover\n    have \"overflow \\<le> i' - shift \\<longleftrightarrow> False\" using `i' < shift` unfolding assms\n      by(cases \"len_of TYPE('a)\")(auto simp add: not_le Bit_def elim: less_le_trans)\n    moreover\n    have \"word_of_int (i' - shift) = (word_of_int i :: 'a word)\" using `i' < shift`\n      by(auto intro!: word_eqI simp add: i'_def shift_def mask_def bin_nth_ops bin_nth_minus_p2 bin_sign_and)\n    ultimately show ?thesis using True by(simp add: Let_def i'_def)\n  next\n    case False\n    hence \"i' = i AND bin_mask (len_of TYPE('a) - 1)\" unfolding assms i'_def\n      by(clarsimp simp add: i'_def bin_nth_ops intro!: bin_eqI)(cases \"len_of TYPE('a)\", auto simp add: less_Suc_eq)\n    also have \"\\<dots> \\<le> bin_mask (len_of TYPE('a) - 1)\" by(rule int_and_le) simp\n    also have \"\\<dots> < overflow\" unfolding overflow_def\n      by(simp add: bin_mask_p1_conv_shift[symmetric])\n    also\n    have \"least \\<le> 0\" unfolding least_def overflow_def by simp\n    have \"0 \\<le> i'\" by(simp add: i'_def mask_def bin_mask_ge0)\n    hence \"least \\<le> i'\" using `least \\<le> 0` by simp\n    moreover\n    have \"word_of_int i' = (word_of_int i :: 'a word)\"\n      by(rule word_eqI)(auto simp add: i'_def bin_nth_ops mask_def)\n    ultimately show ?thesis using False by(simp add: Let_def i'_def)\n  qed\nqed\n\nlemma word_and_mask_or_conv_and_mask:\n  \"n !! index \\<Longrightarrow> (n AND mask index) OR (1 << index) = n AND mask (index + 1)\"\nby(rule word_eqI)(auto simp add: word_ao_nth word_size nth_shiftl simp del: shiftl_1)\n\nlemma uint_and_mask_or_full:\n  fixes n :: \"'a :: len word\"\n  assumes \"n !! (len_of TYPE('a) - 1)\"\n  and \"mask1 = mask (len_of TYPE('a) - 1)\"\n  and \"mask2 = 1 << len_of TYPE('a) - 1\"\n  shows \"uint (n AND mask1) OR mask2 = uint n\"\nproof -\n  have \"mask2 = uint (1 << len_of TYPE('a) - 1 :: 'a word)\" using assms\n    by(simp add: uint_shiftl word_size bintrunc_shiftl del: shiftl_1)(metis One_nat_def Suc_diff_Suc bintrunc_minus bintrunc_shiftl diff_self_eq_0 len_gt_0 len_num1 lessI uint_1 uint_word_arith_bintrs(8))\n  hence \"uint (n AND mask1) OR mask2 = uint (n AND mask1 OR (1 << len_of TYPE('a) - 1 :: 'a word))\"\n    by(simp add: uint_or)\n  also have \"\\<dots> = uint (n AND mask (len_of TYPE('a) - 1 + 1))\"\n    using assms by(simp only: word_and_mask_or_conv_and_mask)\n  also have \"\\<dots> = uint n\" by simp\n  finally show ?thesis .\nqed\n\nsection {* Quickcheck conversion functions *}\n\nnotation scomp (infixl \"\\<circ>\\<rightarrow>\" 60)\n\ndefinition qc_random_cnv ::\n  \"(natural \\<Rightarrow> 'a::term_of) \\<Rightarrow> natural \\<Rightarrow> Random.seed\n    \\<Rightarrow> ('a \\<times> (unit \\<Rightarrow> Code_Evaluation.term)) \\<times> Random.seed\"\n  where \"qc_random_cnv a_of_natural i = Random.range (i + 1) \\<circ>\\<rightarrow> (\\<lambda>k. Pair (\n       let n = a_of_natural k\n       in (n, \\<lambda>_. Code_Evaluation.term_of n)))\"\n\nno_notation scomp (infixl \"\\<circ>\\<rightarrow>\" 60)\n\ndefinition qc_exhaustive_cnv :: \"(natural \\<Rightarrow> 'a) \\<Rightarrow> ('a \\<Rightarrow> (bool \\<times> term list) option)\n  \\<Rightarrow> natural \\<Rightarrow> (bool \\<times> term list) option\"\nwhere\n  \"qc_exhaustive_cnv a_of_natural f d =\n   Quickcheck_Exhaustive.exhaustive (%x. f (a_of_natural x)) d\"\n\ndefinition qc_full_exhaustive_cnv ::\n  \"(natural \\<Rightarrow> ('a::term_of)) \\<Rightarrow> ('a \\<times> (unit \\<Rightarrow> term) \\<Rightarrow> (bool \\<times> term list) option)\n  \\<Rightarrow> natural \\<Rightarrow> (bool \\<times> term list) option\"\nwhere\n  \"qc_full_exhaustive_cnv a_of_natural f d = Quickcheck_Exhaustive.full_exhaustive\n  (%(x, xt). f (a_of_natural x, %_. Code_Evaluation.term_of (a_of_natural x))) d\"\n\ndeclare [[quickcheck_narrowing_ghc_options = \"-XTypeSynonymInstances\"]]\n\ndefinition qc_narrowing_drawn_from :: \"'a list \\<Rightarrow> integer \\<Rightarrow> _\"\nwhere\n  \"qc_narrowing_drawn_from xs =\n   foldr Quickcheck_Narrowing.sum (map Quickcheck_Narrowing.cons (butlast xs)) (Quickcheck_Narrowing.cons (last xs))\"\n\nlocale quickcheck_narrowing_samples =\n  fixes a_of_integer :: \"integer \\<Rightarrow> 'a \\<times> 'a :: {partial_term_of, term_of}\"\n  and zero :: \"'a\"\n  and tr :: \"typerep\"\nbegin\n\nfunction narrowing_samples :: \"integer \\<Rightarrow> 'a list\"\nwhere\n  \"narrowing_samples i =\n   (if i > 0 then let (a, a') = a_of_integer i in narrowing_samples (i - 1) @ [a, a'] else [zero])\"\nby pat_completeness auto\ntermination including integer.lifting\nproof(relation \"measure nat_of_integer\")\n  fix i :: integer\n  assume \"0 < i\"\n  thus \"(i - 1, i) \\<in> measure nat_of_integer\"\n    by simp(transfer, simp)\nqed simp\n\ndefinition partial_term_of_sample :: \"integer \\<Rightarrow> 'a\"\nwhere\n  \"partial_term_of_sample i =\n  (if i < 0 then undefined\n   else if i = 0 then zero\n   else if i mod 2 = 0 then snd (a_of_integer (i div 2))\n   else fst (a_of_integer (i div 2 + 1)))\"\n\nlemma partial_term_of_code:\n  \"partial_term_of (ty :: 'a itself) (Quickcheck_Narrowing.Narrowing_variable p t) \\<equiv>\n    Code_Evaluation.Free (STR ''_'') tr\"\n  \"partial_term_of (ty :: 'a itself) (Quickcheck_Narrowing.Narrowing_constructor i []) \\<equiv>\n   Code_Evaluation.term_of (partial_term_of_sample i)\"\nby (rule partial_term_of_anything)+\n\nend\n\nlemmas [code] =\n  quickcheck_narrowing_samples.narrowing_samples.simps\n  quickcheck_narrowing_samples.partial_term_of_sample_def\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Native_Word/Word_Misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.5813030906443134, "lm_q1q2_score": 0.3467084396262223}}
{"text": "header {* \\isaheader{Set Implementation by Arrays} *}\ntheory ArraySetImpl\nimports \n  \"../spec/SetSpec\" \n  \"ArrayMapImpl\" \n  \"../gen_algo/SetByMap\" \n  \"../gen_algo/SetGA\"\nbegin\ntext_raw {*\\label{thy:ArraySetImpl}*}\n\n(*@impl Set\n  @type ias\n  @abbrv ias,is\n  Sets of natural numbers implemented by arrays.\n*)\n\nsubsection \"Definitions\"\ntype_synonym ias = \"(unit) iam\"\n\nsetup Locale_Code.open_block\ninterpretation ias_sbm!: OSetByOMap iam_basic_ops by unfold_locales\nsetup Locale_Code.close_block\ndefinition ias_ops :: \"(nat,ias) oset_ops\"\n  where [icf_rec_def]:\n  \"ias_ops \\<equiv> ias_sbm.obasic.dflt_oops\"\n\nsetup Locale_Code.open_block\ninterpretation ias!: StdOSet ias_ops\n  unfolding ias_ops_def by (rule ias_sbm.obasic.dflt_oops_impl)\ninterpretation ias!: StdSet_no_invar ias_ops\n  by unfold_locales (simp add: icf_rec_unf SetByMapDefs.invar_def)\nsetup Locale_Code.close_block\n\nsetup {* ICF_Tools.revert_abbrevs \"ias\"*}\n\nlemmas ias_it_to_it_map_code_unfold[code_unfold] = \n  it_to_it_map_fold'[OF pi_iam]\n  it_to_it_map_fold'[OF pi_iam_rev]\n\nlemma pi_ias[proper_it]: \n  \"proper_it' ias.iteratei ias.iteratei\"\n  \"proper_it' ias.iterateoi ias.iterateoi\"\n  \"proper_it' ias.rev_iterateoi ias.rev_iterateoi\"\n  unfolding ias.iteratei_def[abs_def] ias.iterateoi_def[abs_def] \n    ias.rev_iterateoi_def[abs_def]\n  apply (rule proper_it'I icf_proper_iteratorI)+\n  done\n\ninterpretation \n  pi_ias: proper_it_loc ias.iteratei ias.iteratei +\n  pi_ias_o: proper_it_loc ias.iterateoi ias.iterateoi +\n  pi_ias_ro: proper_it_loc ias.rev_iterateoi ias.rev_iterateoi\n  apply unfold_locales by (rule pi_ias)+\n\ndefinition test_codegen where \"test_codegen \\<equiv> (\n  ias.empty,\n  ias.memb,\n  ias.ins,\n  ias.delete,\n  ias.list_it,\n  ias.sng,\n  ias.isEmpty,\n  ias.isSng,\n  ias.ball,\n  ias.bex,\n  ias.size,\n  ias.size_abort,\n  ias.union,\n  ias.union_dj,\n  ias.diff,\n  ias.filter,\n  ias.inter,\n  ias.subset,\n  ias.equal,\n  ias.disjoint,\n  ias.disjoint_witness,\n  ias.sel,\n  ias.to_list,\n  ias.from_list,\n\n  ias.ordered_list_it,\n  ias.rev_list_it,\n  ias.min, \n  ias.max, \n  ias.to_sorted_list,\n  ias.to_rev_list\n)\"\n\nexport_code test_codegen in SML\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/ICF/impl/ArraySetImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5813030906443134, "lm_q2_score": 0.5964331462646255, "lm_q1q2_score": 0.34670843128633866}}
{"text": "theory IHT_Dynamic_Array_More\nimports IHT_Dynamic_Array \"../Asymptotics/Asymptotics_1D\"\nbegin\n\nfun dyn_array_P' :: \"'a::heap list \\<times> nat \\<Rightarrow> nat\" where\n  \"dyn_array_P' (xs, n) = 4 * n\"\nsetup \\<open>add_rewrite_rule @{thm dyn_array_P'.simps}\\<close>\n\nlemma dyn_array_new_P' [rewrite]:\n  \"dyn_array_P' (replicate 5 0, 0) = 0\" by auto2\n\nlemma dyn_array_double_length_P' [rewrite]:\n  \"dyn_array_P' (double_length_fun (xs, n)) = dyn_array_P' (xs, n)\" by auto2\n\nlemma dyn_array_push_array_basic_P' [resolve]:\n  \"n \\<le> length xs \\<Longrightarrow>\n   dyn_array_P' (xs, n) + 16 \\<ge>\\<^sub>t dyn_array_P' (push_array_basic_fun x (xs, n)) + 12\" by auto2\n\nlemma update_P' [rewrite]:\n  \"i < n \\<Longrightarrow> dyn_array_P' (list_update xs i x, n) = dyn_array_P' (xs, n)\" by auto2\n\nlemma dyn_array_destroy_P' [resolve]:\n  \"dyn_array_P' (xs, n) + 3 \\<ge>\\<^sub>t 4 * n + 3\" by auto2\n\nsetup \\<open>del_prfstep_thm @{thm dyn_array_P'.simps}\\<close>\n\nfun dyn_array'' :: \"'a::heap list \\<times> nat \\<Rightarrow> 'a dynamic_array \\<Rightarrow> assn\" where\n  \"dyn_array'' (xs, n) r = dyn_array' (xs, n) r * $(dyn_array_P' (xs, n))\"\nsetup \\<open>add_rewrite_ent_rule @{thm dyn_array''.simps}\\<close>\n\nlemma dyn_array_new_rule'' [hoare_triple]:\n  \"<$7>\n   dyn_array_new\n   <dyn_array'' (replicate 5 0, 0)>\\<^sub>t\"\n@proof\n  @have \"7 \\<ge>\\<^sub>t 7 + dyn_array_P' (replicate 5 0, 0)\"\n@qed\n\nlemma double_length_rule'' [hoare_triple]:\n  \"length xs = n \\<Longrightarrow>\n   <dyn_array'' (xs, n) p * $5>\n   double_length p\n   <dyn_array'' (double_length_fun (xs, n))>\\<^sub>t\"\n@proof\n  @have \"dyn_array_P' (xs, n) + 5 \\<ge>\\<^sub>t dyn_array_P' (double_length_fun (xs, n)) + 5\"\n@qed\n\nlemma push_array_basic_rule'' [hoare_triple]:\n  \"n < length xs \\<Longrightarrow>\n   <dyn_array'' (xs, n) p * $16>\n    push_array_basic x p\n   <dyn_array'' (list_update xs n x, n + 1)>\\<^sub>t\"\n@proof\n  @have \"dyn_array_P' (xs, n) + 16 \\<ge>\\<^sub>t dyn_array_P' (push_array_basic_fun x (xs, n)) + 12\"\n@qed\n \nlemma array_length_rule'' [hoare_triple]:\n  \"<dyn_array'' (xs, n) p * $1>\n   array_length p\n   <\\<lambda>r. dyn_array'' (xs, n) p * \\<up>(r = n)>\" by auto2\n\nlemma array_max_rule'' [hoare_triple]:\n  \"<dyn_array'' (xs, n) p * $1>\n   array_max p\n   <\\<lambda>r. dyn_array'' (xs, n) p * \\<up>(r = length xs)>\" by auto2\n\nlemma array_nth_rule'' [hoare_triple]:\n  \"i < n \\<Longrightarrow> n \\<le> length xs \\<Longrightarrow>\n   <dyn_array'' (xs, n) p * $1>\n   array_nth p i\n   <\\<lambda>r. dyn_array'' (xs, n) p * \\<up>(r = xs ! i)>\" by auto2\n\nlemma array_upd_rule'' [hoare_triple]:\n  \"i < n \\<Longrightarrow> n \\<le> length xs \\<Longrightarrow>\n   <dyn_array'' (xs, n) p * $2>\n   array_upd i x p\n   <\\<lambda>_. dyn_array'' (list_update xs i x, n) p>\" by auto2\n\nlemma destroy_rule'' [hoare_triple]:\n  \"n \\<le> length xs \\<Longrightarrow>\n   <dyn_array'' (xs, n) d * $3>\n   destroy d\n   <\\<lambda>r. r \\<mapsto>\\<^sub>a take n xs>\\<^sub>t\"\n@proof \n  @have \"dyn_array_P' (xs, n) + 3 \\<ge>\\<^sub>t 4 * n + 3\"\n@qed\n\nsetup \\<open>del_prfstep_thm @{thm dyn_array''.simps}\\<close>\n\nsection \\<open>Derived operations\\<close>\n\nlemma push_array_rule'' [hoare_triple]:\n  \"n \\<le> length xs \\<Longrightarrow>\n   <dyn_array'' (xs, n) p * $23>\n   push_array x p\n   <dyn_array'' (push_array_fun x (xs, n))>\\<^sub>t\" by auto2\n\nsection \\<open>Abstract assertion\\<close>\n\nfun abs_array :: \"'a::heap list \\<times> nat \\<Rightarrow> 'a list\" where\n  \"abs_array (xs, n) = take n xs\"\nsetup \\<open>add_rewrite_rule @{thm abs_array.simps}\\<close>\n\nlemma double_length_abs [rewrite]:\n  \"length xs = n \\<Longrightarrow> abs_array (double_length_fun (xs, n)) = abs_array (xs, n)\" by auto2\n\nlemma push_array_basic_abs [rewrite]:\n  \"n < length xs \\<Longrightarrow> abs_array (push_array_basic_fun x (xs, n)) = abs_array (xs, n) @ [x]\"\n@proof @have \"length (take n xs @ [x]) = n + 1\" @qed\n\nlemma push_array_fun_abs [rewrite]:\n  \"n \\<le> length xs \\<Longrightarrow> abs_array (push_array_fun x (xs, n)) = abs_array (xs, n) @ [x]\" by auto2\n\ndefinition dyn_array :: \"'a::heap list \\<Rightarrow> 'a dynamic_array \\<Rightarrow> assn\" where [rewrite_ent]:\n  \"dyn_array xs a = (\\<exists>\\<^sub>Ap. dyn_array'' p a * \\<up>(snd p \\<le> length (fst p)) * \\<up>(xs = abs_array p))\"\n\nlemma dyn_array_new_rule [hoare_triple]:\n  \"<$7>\n   dyn_array_new\n   <dyn_array []>\\<^sub>t\" by auto2\n\nlemma array_length_rule [hoare_triple]:\n  \"<dyn_array xs p * $1>\n    array_length p\n   <\\<lambda>r. dyn_array xs p * \\<up>(r = length xs)>\" by auto2\n\nlemma array_nth_rule [hoare_triple]:\n  \"i < length xs \\<Longrightarrow>\n   <dyn_array xs p * $1>\n    array_nth p i\n   <\\<lambda>r. dyn_array xs p * \\<up>(r = xs ! i)>\" by auto2\n\nlemma array_upd_rule [hoare_triple]:\n  \"i < length xs \\<Longrightarrow>\n   <dyn_array xs p * $2>\n    array_upd i x p\n   <\\<lambda>_. dyn_array (list_update xs i x) p>\" by auto2\n\nlemma push_array_rule [hoare_triple]:\n  \"<dyn_array xs p * $23>\n    push_array x p\n   <dyn_array (xs @ [x])>\\<^sub>t\" by auto2\n\nlemma destroy_rule [hoare_triple]:\n  \"<dyn_array xs p * $3>\n    destroy p\n   <\\<lambda>r. r \\<mapsto>\\<^sub>a xs>\\<^sub>t\" by auto2\n\nsetup \\<open>del_simple_datatype \"dynamic_array\"\\<close>\nsetup \\<open>del_prfstep_thm @{thm dyn_array_def}\\<close>\n\nsection \\<open>More operations\\<close>\n\ndefinition array_swap :: \"'a::heap dynamic_array \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> unit Heap\" where\n  \"array_swap d i j = do {\n    x \\<leftarrow> array_nth d i;\n    y \\<leftarrow> array_nth d j;\n    array_upd i y d;\n    array_upd j x d;\n    return ()\n   }\"\n\nlemma array_swap_rule [hoare_triple]:\n  \"i < length xs \\<Longrightarrow> j < length xs \\<Longrightarrow>\n   <dyn_array xs p * $7>\n   array_swap p i j\n   <\\<lambda>_. dyn_array (list_swap xs i j) p>\" by auto2\n\ntext \\<open>Filter with dynamic array\\<close>\n\nfun dfilter_aux_fun :: \"'a list \\<Rightarrow> nat \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'a list\" where\n  \"dfilter_aux_fun xs 0 P = []\"\n| \"dfilter_aux_fun xs (Suc n) P = (\n     if P (xs ! n)\n     then dfilter_aux_fun xs n P @ [xs ! n]\n     else dfilter_aux_fun xs n P)\"\nsetup \\<open>fold add_rewrite_rule @{thms dfilter_aux_fun.simps}\\<close>\n\nlemma dfilter_aux_fun_ind [rewrite]:\n  \"i \\<le> length xs \\<Longrightarrow> dfilter_aux_fun xs i P = filter P (take i xs)\"        \n  by (induct i) (auto simp add: take_Suc_conv_app_nth)\n \nlemma filtertake_Suc [rewrite]:\n  \"i < length xs \\<Longrightarrow> P (xs !i) \\<Longrightarrow> filter P (take (Suc i) xs) = filter P (take i xs) @ [xs ! i]\"\n  \"i < length xs \\<Longrightarrow> ~ P (xs !i) \\<Longrightarrow> filter P (take (Suc i) xs) = filter P (take i xs)\"\n  by (auto simp add: take_Suc_conv_app_nth) \n\nfun dfilter_aux :: \"('a::{zero,heap}) array \\<Rightarrow> 'a dynamic_array \\<Rightarrow> nat \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'a dynamic_array Heap\" where\n  \"dfilter_aux a d 0 P = return d\"\n| \"dfilter_aux a d (Suc i) P = do {\n     d' \\<leftarrow> dfilter_aux a d i P;\n     x \\<leftarrow> Array_Time.nth a i;\n     if P x then push_array x d' else return d'\n   }\"\n\nlemma dfilter_aux_rule [hoare_triple]:\n  \"i \\<le> length xs \\<Longrightarrow>\n   <a \\<mapsto>\\<^sub>a xs * dyn_array [] d * $(i * 24 + 1)>\n    dfilter_aux a d i P\n   <\\<lambda>r. a \\<mapsto>\\<^sub>a xs * dyn_array (filter P (take i xs)) r>\\<^sub>t\"\n@proof @induct i @qed\n\ndefinition dfilter_impl :: \"'a::{zero,heap} array \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'a dynamic_array Heap\" where\n  \"dfilter_impl a P = do {\n     d \\<leftarrow> dyn_array_new;\n     alen \\<leftarrow> Array_Time.len a;\n     dfilter_aux a d alen P\n   }\" \n\ndefinition dfilter_impl_time :: \"nat \\<Rightarrow> nat\" where [rewrite]:\n  \"dfilter_impl_time l = 8 + 1 + (24 * l + 1)\"\n\nlemma dfilter_impl_rule[hoare_triple]:\n  \"<a \\<mapsto>\\<^sub>a xs * $(dfilter_impl_time (length xs))>\n    dfilter_impl a P  \n   <\\<lambda>r. a \\<mapsto>\\<^sub>a xs * dyn_array (filter P xs) r>\\<^sub>t\" by auto2\n\nlemma dfilter_impl_time_bound [asym_bound]: \"(\\<lambda>n. dfilter_impl_time n) \\<in> \\<Theta>(\\<lambda>n. n)\"\n  unfolding dfilter_impl_time_def by auto2\n\nsetup \\<open>del_prfstep_thm @{thm dfilter_impl_time_def}\\<close>\n\nend\n", "meta": {"author": "bzhan", "repo": "Imperative_HOL_Time", "sha": "09f9bc7a7cf177d3adf1e9ce6adae09a85ebe5ec", "save_path": "github-repos/isabelle/bzhan-Imperative_HOL_Time", "path": "github-repos/isabelle/bzhan-Imperative_HOL_Time/Imperative_HOL_Time-09f9bc7a7cf177d3adf1e9ce6adae09a85ebe5ec/Examples/IHT_Dynamic_Array_More.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.3467084312863385}}
{"text": "section \\<open>Memoization\\label{sec:memo}\\<close>\n\ntheory Optimal_BST_Memo\nimports\n  Optimal_BST\n  \"Monad_Memo_DP.State_Main\"\n  \"HOL-Library.Product_Lexorder\"\n  \"HOL-Library.RBT_Mapping\"\n  Optimal_BST_Examples\nbegin\n\ntext \\<open>This theory memoizes the recursive algorithms with the help of our generic memoization\nframework. Note that currently only the tree building (function @{const Optimal_BST.opt_bst}) is memoized but not the computation of \\<open>w\\<close>.\\<close>\n\nglobal_interpretation Wpl\nwhere a = a and b = b for a b\ndefines w_ab = w and wpl_ab = \"wpl.wpl w_ab\" .\n\ntext \\<open>First we express @{const argmin} via @{const fold}.\nPrimarily because we have a monadic version of @{const fold} already.\nAt the same time we improve efficiency.\\<close>\n\nlemma fold_argmin: \"fold (\\<lambda>x (m,fm). let fx = f x in if fx \\<le> fm then (x,fx) else (m,fm)) xs (x,f x)\n = (argmin f (x#xs), f(argmin f (x#xs)))\"\nby (induction xs arbitrary: x) (auto simp: Let_def split: prod.split)\n\nlemma argmin_fold: \"argmin f xs = (case xs of [] \\<Rightarrow> undefined |\n  x#xs \\<Rightarrow> fst(fold (\\<lambda>x (m,fm). let fx = f x in if fx \\<le> fm then (x,fx) else (m,fm)) xs (x,f x)))\"\napply(auto simp:fold_argmin split: list.split)\napply (meson argmin.elims list.distinct(1))\ndone\n\ntext \\<open>The actual memoization of the cubic algorithm:\\<close>\n\ncontext Optimal_BST\nbegin\n\nmemoize_fun opt_bst\\<^sub>m: opt_bst with_memory dp_consistency_mapping\nmonadifies (state) opt_bst.simps[unfolded argmin_fold]\n(* FIXME why not argmin_argmin2? memoize_prover breaks!\nHow about opt_bst_wpl?\n*)\nthm opt_bst\\<^sub>m'.simps\n\nmemoize_correct\nby memoize_prover\n\nlemmas [code] = opt_bst\\<^sub>m.memoized_correct\n\nend\n\ntext \\<open>Code generation:\\<close>\n\nglobal_interpretation Optimal_BST\nwhere w = \"w_ab a b\"\nrewrites \"wpl.wpl (w_ab a b) = wpl_ab a b\" for a b\ndefines opt_bst_ab = opt_bst and opt_bst_ab' = opt_bst\\<^sub>m'\nby(simp add: wpl_ab_def)\n\ntext \\<open>Examples:\\<close>\n\nlemma \"opt_bst_ab a_ex1 b_ex1 0 3 = t_opt_ex1\"\nby eval\n\nlemma \"opt_bst_ab a_ex2 b_ex2 0 13 = t_opt_ex2\"\nby eval\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Optimal_BST/Optimal_BST_Memo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5964331462646254, "lm_q1q2_score": 0.3467084312863385}}
{"text": "subsection \\<open>The Bellman-Ford Algorithm\\<close>\n\ntheory Bellman_Ford\n  imports\n    \"HOL-Library.IArray\"\n    \"HOL-Library.Code_Target_Numeral\"\n    \"HOL-Library.Product_Lexorder\"\n    \"HOL-Library.RBT_Mapping\"\n    \"../heap_monad/Heap_Main\"\n    Example_Misc\n    \"../util/Tracing\"\n    \"../util/Ground_Function\"\nbegin\n\nsubsubsection \\<open>Misc\\<close>\n\nlemma nat_le_cases:\n  fixes n :: nat\n  assumes \"i \\<le> n\"\n  obtains \"i < n\" | \"i = n\"\n  using assms by (cases \"i = n\") auto\n\ncontext dp_consistency_iterator\nbegin\n\nlemma crel_vs_iterate_state:\n  \"crel_vs (=) () (iter_state f x)\" if \"((=) ===>\\<^sub>T R) g f\"\n  by (metis crel_vs_iterate_state iter_state_iterate_state that)\n\nlemma consistent_crel_vs_iterate_state:\n  \"crel_vs (=) () (iter_state f x)\" if \"consistentDP f\"\n  using consistentDP_def crel_vs_iterate_state that by simp\n\nend\n\ninstance extended :: (countable) countable\nproof standard\n  obtain to_nat :: \"'a \\<Rightarrow> nat\" where \"inj to_nat\"\n    by auto\n  let ?f = \"\\<lambda> x. case x of Fin n \\<Rightarrow> to_nat n + 2 | Pinf \\<Rightarrow> 0 | Minf \\<Rightarrow> 1\"\n  from \\<open>inj _ \\<close> have \"inj ?f\"\n    by (auto simp: inj_def split: extended.split)\n  then show \"\\<exists>to_nat :: 'a extended \\<Rightarrow> nat. inj to_nat\"\n    by auto\nqed\n\ninstance extended :: (heap) heap ..\n\ninstantiation \"extended\" :: (conditionally_complete_lattice) complete_lattice\nbegin\n\ndefinition\n  \"Inf A = (\n    if A = {} \\<or> A = {\\<infinity>} then \\<infinity>\n    else if -\\<infinity> \\<in> A \\<or> \\<not> bdd_below (Fin -` A) then -\\<infinity>\n    else Fin (Inf (Fin -` A)))\"\n\ndefinition\n  \"Sup A = (\n    if A = {} \\<or> A = {-\\<infinity>} then -\\<infinity>\n    else if \\<infinity> \\<in> A \\<or> \\<not> bdd_above (Fin -` A) then \\<infinity>\n    else Fin (Sup (Fin -` A)))\"\n\ninstance\nproof standard\n  have [dest]: \"Inf (Fin -` A) \\<le> x\" if \"Fin x \\<in> A\" \"bdd_below (Fin -` A)\" for A and x :: 'a\n    using that by (intro cInf_lower) auto\n  have *: False if \"\\<not> z \\<le> Inf (Fin -` A)\" \"\\<And>x. x \\<in> A \\<Longrightarrow> Fin z \\<le> x\" \"Fin x \\<in> A\" for A and x z :: 'a\n    using cInf_greatest[of \"Fin -` A\" z] that vimage_eq by force\n  show \"Inf A \\<le> x\" if \"x \\<in> A\" for x :: \"'a extended\" and A\n    using that unfolding Inf_extended_def by (cases x) auto\n  show \"z \\<le> Inf A\" if \"\\<And>x. x \\<in> A \\<Longrightarrow> z \\<le> x\" for z :: \"'a extended\" and A\n    using that\n    unfolding Inf_extended_def\n    apply (clarsimp; safe)\n         apply force\n        apply force\n    subgoal\n      by (cases z; force simp: bdd_below_def)\n    subgoal\n      by (cases z; force simp: bdd_below_def)\n    subgoal for x y\n      by (cases z; cases y) (auto elim: *)\n    subgoal for x y\n      by (cases z; cases y; simp; metis * less_eq_extended.elims(2))\n    done\n  have [dest]: \"x \\<le> Sup (Fin -` A)\" if \"Fin x \\<in> A\" \"bdd_above (Fin -` A)\" for A and x :: 'a\n    using that by (intro cSup_upper) auto\n  have *: False if \"\\<not> Sup (Fin -` A) \\<le> z\" \"\\<And>x. x \\<in> A \\<Longrightarrow> x \\<le> Fin z\" \"Fin x \\<in> A\" for A and x z :: 'a\n    using cSup_least[of \"Fin -` A\" z] that vimage_eq by force\n  show \"x \\<le> Sup A\" if \"x \\<in> A\" for x :: \"'a extended\" and A\n    using that unfolding Sup_extended_def by (cases x) auto\n  show \"Sup A \\<le> z\" if \"\\<And>x. x \\<in> A \\<Longrightarrow> x \\<le> z\" for z :: \"'a extended\" and A\n    using that\n    unfolding Sup_extended_def\n    apply (clarsimp; safe)\n         apply force\n        apply force\n    subgoal\n      by (cases z; force)\n    subgoal\n      by (cases z; force)\n    subgoal for x y\n      by (cases z; cases y) (auto elim: *)\n    subgoal for x y\n      by (cases z; cases y; simp; metis * extended.exhaust)\n    done\n  show \"Inf {} = (top::'a extended)\"\n    unfolding Inf_extended_def top_extended_def by simp\n  show \"Sup {} = (bot::'a extended)\"\n    unfolding Sup_extended_def bot_extended_def by simp\nqed\n\nend\n\ninstance \"extended\" :: (\"{conditionally_complete_lattice,linorder}\") complete_linorder ..\n\n\nlemma Minf_eq_zero[simp]: \"-\\<infinity> = 0 \\<longleftrightarrow> False\" and Pinf_eq_zero[simp]: \"\\<infinity> = 0 \\<longleftrightarrow> False\"\n  unfolding zero_extended_def by auto\n\nlemma Sup_int:\n  fixes x :: int and X :: \"int set\"\n  assumes \"X \\<noteq> {}\" \"bdd_above X\"\n  shows \"Sup X \\<in> X \\<and> (\\<forall>y\\<in>X. y \\<le> Sup X)\"\nproof -\n  from assms obtain x y where \"X \\<subseteq> {..y}\" \"x \\<in> X\"\n    by (auto simp: bdd_above_def)\n  then have *: \"finite (X \\<inter> {x..y})\" \"X \\<inter> {x..y} \\<noteq> {}\" and \"x \\<le> y\"\n    by (auto simp: subset_eq)\n  have \"\\<exists>!x\\<in>X. (\\<forall>y\\<in>X. y \\<le> x)\"\n  proof\n    { fix z assume \"z \\<in> X\"\n      have \"z \\<le> Max (X \\<inter> {x..y})\"\n      proof cases\n        assume \"x \\<le> z\" with \\<open>z \\<in> X\\<close> \\<open>X \\<subseteq> {..y}\\<close> *(1) show ?thesis\n          by (auto intro!: Max_ge)\n      next\n        assume \"\\<not> x \\<le> z\"\n        then have \"z < x\" by simp\n        also have \"x \\<le> Max (X \\<inter> {x..y})\"\n          using \\<open>x \\<in> X\\<close> *(1) \\<open>x \\<le> y\\<close> by (intro Max_ge) auto\n        finally show ?thesis by simp\n      qed }\n    note le = this\n    with Max_in[OF *] show ex: \"Max (X \\<inter> {x..y}) \\<in> X \\<and> (\\<forall>z\\<in>X. z \\<le> Max (X \\<inter> {x..y}))\" by auto\n\n    fix z assume *: \"z \\<in> X \\<and> (\\<forall>y\\<in>X. y \\<le> z)\"\n    with le have \"z \\<le> Max (X \\<inter> {x..y})\"\n      by auto\n    moreover have \"Max (X \\<inter> {x..y}) \\<le> z\"\n      using * ex by auto\n    ultimately show \"z = Max (X \\<inter> {x..y})\"\n      by auto\n  qed\n  then show \"Sup X \\<in> X \\<and> (\\<forall>y\\<in>X. y \\<le> Sup X)\"\n    unfolding Sup_int_def by (rule theI')\nqed\n\nlemmas Sup_int_in = Sup_int[THEN conjunct1]\n\nlemma Inf_int_in:\n  fixes S :: \"int set\"\n  assumes \"S \\<noteq> {}\" \"bdd_below S\"\n  shows \"Inf S \\<in> S\"\n  using assms unfolding Inf_int_def by (smt Sup_int_in bdd_above_uminus image_iff image_is_empty)\n\n\nlemma finite_setcompr_eq_image: \"finite {f x |x. P x} \\<longleftrightarrow> finite (f ` {x. P x})\"\n  by (simp add: setcompr_eq_image)\n\nlemma finite_lists_length_le1: \"finite {xs. length xs \\<le> i \\<and> set xs \\<subseteq> {0..(n::nat)}}\" for i\n  by (auto intro: finite_subset[OF _ finite_lists_length_le[OF finite_atLeastAtMost]])\n\nlemma finite_lists_length_le2: \"finite {xs. length xs + 1 \\<le> i \\<and> set xs \\<subseteq> {0..(n::nat)}}\" for i\n  by (auto intro: finite_subset[OF _ finite_lists_length_le1[of \"i\"]])\n\nlemmas [simp] =\n  finite_setcompr_eq_image finite_lists_length_le2[simplified] finite_lists_length_le1\n\n\nlemma get_return:\n  \"run_state (State_Monad.bind State_Monad.get (\\<lambda> m. State_Monad.return (f m))) m = (f m, m)\"\n  by (simp add: State_Monad.bind_def State_Monad.get_def)\n\n\nlemma list_pidgeonhole:\n  assumes \"set xs \\<subseteq> S\" \"card S < length xs\" \"finite S\"\n  obtains as a bs cs where \"xs = as @ a # bs @ a # cs\"\nproof -\n  from assms have \"\\<not> distinct xs\"\n    by (metis card_mono distinct_card not_le)\n  then show ?thesis\n    by (metis append.assoc append_Cons not_distinct_conv_prefix split_list that)\nqed\n\nlemma path_eq_cycleE:\n  assumes \"v # ys @ [t] = as @ a # bs @ a # cs\"\n  obtains (Nil_Nil) \"as = []\" \"cs = []\" \"v = a\" \"a = t\" \"ys = bs\"\n  | (Nil_Cons) cs' where \"as = []\" \"v = a\" \"ys = bs @ a # cs'\" \"cs = cs' @ [t]\"\n  | (Cons_Nil) as' where \"as = v # as'\" \"cs = []\" \"a = t\" \"ys = as' @ a # bs\"\n  | (Cons_Cons) as' cs' where \"as = v # as'\" \"cs = cs' @ [t]\" \"ys = as' @ a # bs @ a # cs'\"\n  using assms by (auto simp: Cons_eq_append_conv append_eq_Cons_conv append_eq_append_conv2)\n\nlemma le_add_same_cancel1:\n  \"a + b \\<ge> a \\<longleftrightarrow> b \\<ge> 0\" if \"a < \\<infinity>\" \"-\\<infinity> < a\" for a b :: \"int extended\"\n  using that by (cases a; cases b) (auto simp add: zero_extended_def)\n\nlemma add_gt_minfI:\n  assumes \"-\\<infinity> < a\" \"-\\<infinity> < b\"\n  shows \"-\\<infinity> < a + b\"\n  using assms by (cases a; cases b) auto\n\nlemma add_lt_infI:\n  assumes \"a < \\<infinity>\" \"b < \\<infinity>\"\n  shows \"a + b < \\<infinity>\"\n  using assms by (cases a; cases b) auto\n\nlemma sum_list_not_infI:\n  \"sum_list xs < \\<infinity>\" if \"\\<forall> x \\<in> set xs. x < \\<infinity>\" for xs :: \"int extended list\"\n  using that\n  apply (induction xs)\n   apply (simp add: zero_extended_def)+\n  by (smt less_extended_simps(2) plus_extended.elims)\n\nlemma sum_list_not_minfI:\n  \"sum_list xs > -\\<infinity>\" if \"\\<forall> x \\<in> set xs. x > -\\<infinity>\" for xs :: \"int extended list\"\n  using that by (induction xs) (auto intro: add_gt_minfI simp: zero_extended_def)\n\n\n\nsubsubsection \\<open>Single-Sink Shortest Path Problem\\<close>\n\ndatatype bf_result = Path \"nat list\" int | No_Path | Computation_Error\n\ncontext\n  fixes n :: nat and W :: \"nat \\<Rightarrow> nat \\<Rightarrow> int extended\"\nbegin\n\ncontext\n  fixes t :: nat \\<comment> \\<open>Final node\\<close>\nbegin\n\ntext \\<open>\n  The correctness proof closely follows Kleinberg \\<open>&\\<close> Tardos: \"Algorithm Design\",\n  chapter \"Dynamic Programming\" \\<^cite>\\<open>\"Kleinberg-Tardos\"\\<close>\n\\<close>\n\nfun weight :: \"nat list \\<Rightarrow> int extended\" where\n  \"weight [v] = 0\"\n| \"weight (v # w # xs) = W v w + weight (w # xs)\"\n\ndefinition\n  \"OPT i v = (\n    Min (\n      {weight (v # xs @ [t]) | xs. length xs + 1 \\<le> i \\<and> set xs \\<subseteq> {0..n}} \\<union>\n      {if t = v then 0 else \\<infinity>}\n    )\n  )\"\n\nlemma weight_alt_def':\n  \"weight (s # xs) + w = snd (fold (\\<lambda>j (i, x). (j, W i j + x)) xs (s, w))\"\n  by (induction xs arbitrary: s w; simp; smt add.commute add.left_commute)\n\nlemma weight_alt_def:\n  \"weight (s # xs) = snd (fold (\\<lambda>j (i, x). (j, W i j + x)) xs (s, 0))\"\n  by (rule weight_alt_def'[of s xs 0, simplified])\n\nlemma weight_append:\n  \"weight (xs @ a # ys) = weight (xs @ [a]) + weight (a # ys)\"\n  by (induction xs rule: weight.induct; simp add: add.assoc)\n\nlemma OPT_0:\n  \"OPT 0 v = (if t = v then 0 else \\<infinity>)\"\n  unfolding OPT_def by simp\n\n\nsubsubsection \\<open>Functional Correctness\\<close>\n\nlemma OPT_cases:\n  obtains (path) xs where \"OPT i v = weight (v # xs @ [t])\" \"length xs + 1 \\<le> i\" \"set xs \\<subseteq> {0..n}\"\n  | (sink) \"v = t\" \"OPT i v = 0\"\n  | (unreachable) \"v \\<noteq> t\" \"OPT i v = \\<infinity>\"\n  unfolding OPT_def\n  using Min_in[of \"{weight (v # xs @ [t]) |xs. length xs + 1 \\<le> i \\<and> set xs \\<subseteq> {0..n}}\n    \\<union> {if t = v then 0 else \\<infinity>}\"]\n  by (auto simp: finite_lists_length_le2[simplified] split: if_split_asm)\n\nlemma OPT_Suc:\n  \"OPT (Suc i) v = min (OPT i v) (Min {OPT i w + W v w | w. w \\<le> n})\" (is \"?lhs = ?rhs\")\n  if \"t \\<le> n\"\nproof -\n  have \"OPT i w + W v w \\<ge> OPT (Suc i) v\" if \"w \\<le> n\" for w\n    using OPT_cases[of i w]\n  proof cases\n    case (path xs)\n    with \\<open>w \\<le> n\\<close> show ?thesis\n      by (subst OPT_def) (auto intro!: Min_le exI[where x = \"w # xs\"] simp: add.commute)\n  next\n    case sink\n    then show ?thesis\n      by (subst OPT_def) (auto intro!: Min_le exI[where x = \"[]\"])\n  next\n    case unreachable\n    then show ?thesis\n      by simp\n  qed\n  then have \"Min {OPT i w + W v w |w. w \\<le> n} \\<ge> OPT (Suc i) v\"\n    by (auto intro!: Min.boundedI)\n  moreover have \"OPT i v \\<ge> OPT (Suc i) v\"\n    unfolding OPT_def by (rule Min_antimono) auto\n  ultimately have \"?lhs \\<le> ?rhs\"\n    by simp\n\n  from OPT_cases[of \"Suc i\" v] have \"?lhs \\<ge> ?rhs\"\n  proof cases\n    case (path xs)\n    note [simp] = path(1)\n    from path consider\n      (zero) \"i = 0\" \"length xs = 0\" | (new) \"i > 0\" \"length xs = i\" | (old) \"length xs < i\"\n      by (cases \"length xs = i\") auto\n    then show ?thesis\n    proof cases\n      case zero\n      with path have \"OPT (Suc i) v = W v t\"\n        by simp\n      also have \"W v t = OPT i t + W v t\"\n        unfolding OPT_def using \\<open>i = 0\\<close> by auto\n      also have \"\\<dots> \\<ge> Min {OPT i w + W v w |w. w \\<le> n}\"\n        using \\<open>t \\<le> n\\<close> by (auto intro: Min_le)\n      finally show ?thesis\n        by (rule min.coboundedI2)\n    next\n      case new\n      with \\<open>_ = i\\<close> obtain u ys where [simp]: \"xs = u # ys\"\n        by (cases xs) auto\n      from path have \"OPT i u \\<le> weight (u # ys @ [t])\"\n        unfolding OPT_def by (intro Min_le) auto\n      from path have \"Min {OPT i w + W v w |w. w \\<le> n} \\<le> W v u + OPT i u\"\n        by (intro Min_le) (auto simp: add.commute)\n      also from \\<open>OPT i u \\<le> _\\<close> have \"\\<dots> \\<le> OPT (Suc i) v\"\n        by (simp add: add_left_mono)\n      finally show ?thesis\n        by (rule min.coboundedI2)\n    next\n      case old\n      with path have \"OPT i v \\<le> OPT (Suc i) v\"\n        by (auto 4 3 intro: Min_le simp: OPT_def)\n      then show ?thesis\n        by (rule min.coboundedI1)\n    qed\n  next\n    case unreachable\n    then show ?thesis\n      by simp\n  next\n    case sink\n    then have \"OPT i v \\<le> OPT (Suc i) v\"\n      unfolding OPT_def by simp\n    then show ?thesis\n      by (rule min.coboundedI1)\n  qed\n\n  with \\<open>?lhs \\<le> ?rhs\\<close> show ?thesis\n    by (rule order.antisym)\nqed\n\nfun bf :: \"nat \\<Rightarrow> nat \\<Rightarrow> int extended\" where\n  \"bf 0 v = (if t = v then 0 else \\<infinity>)\"\n| \"bf (Suc i) v = min_list\n      (bf i v # [W v w + bf i w . w \\<leftarrow> [0 ..< Suc n]])\"\n\nlemmas [simp del] = bf.simps\nlemmas bf_simps[simp] = bf.simps[unfolded min_list_fold]\n\nlemma bf_correct:\n  \"OPT i j = bf i j\" if \\<open>t \\<le> n\\<close>\nproof (induction i arbitrary: j)\n  case 0\n  then show ?case\n    by (simp add: OPT_0)\nnext\n  case (Suc i)\n  have *:\n    \"{bf i w + W j w |w. w \\<le> n} = set (map (\\<lambda>w. W j w + bf i w) [0..<Suc n])\"\n    by (fastforce simp: add.commute image_def)\n  from Suc \\<open>t \\<le> n\\<close> show ?case\n    by (simp add: OPT_Suc del: upt_Suc, subst Min.set_eq_fold[symmetric], auto simp: *)\nqed\n\n\nsubsubsection \\<open>Functional Memoization\\<close>\n\nmemoize_fun bf\\<^sub>m: bf with_memory dp_consistency_mapping monadifies (state) bf.simps\n\ntext \\<open>Generated Definitions\\<close>\ncontext includes state_monad_syntax begin\nthm bf\\<^sub>m'.simps bf\\<^sub>m_def\nend\n\ntext \\<open>Correspondence Proof\\<close>\nmemoize_correct\n  by memoize_prover\nprint_theorems\nlemmas [code] = bf\\<^sub>m.memoized_correct\n\ninterpretation iterator\n  \"\\<lambda> (x, y). x \\<le> n \\<and> y \\<le> n\"\n  \"\\<lambda> (x, y). if y < n then (x, y + 1) else (x + 1, 0)\"\n  \"\\<lambda> (x, y). x * (n + 1) + y\"\n  by (rule table_iterator_up)\n\ninterpretation bottom_up: dp_consistency_iterator_empty\n  \"\\<lambda> (_::(nat \\<times> nat, int extended) mapping). True\"\n  \"\\<lambda> (x, y). bf x y\"\n  \"\\<lambda> k. do {m \\<leftarrow> State_Monad.get; State_Monad.return (Mapping.lookup m k :: int extended option)}\"\n  \"\\<lambda> k v. do {m \\<leftarrow> State_Monad.get; State_Monad.set (Mapping.update k v m)}\"\n  \"\\<lambda> (x, y). x \\<le> n \\<and> y \\<le> n\"\n  \"\\<lambda> (x, y). if y < n then (x, y + 1) else (x + 1, 0)\"\n  \"\\<lambda> (x, y). x * (n + 1) + y\"\n  Mapping.empty ..\n\ndefinition\n  \"iter_bf = iter_state (\\<lambda> (x, y). bf\\<^sub>m' x y)\"\n\nlemma iter_bf_unfold[code]:\n  \"iter_bf = (\\<lambda> (i, j).\n    (if i \\<le> n \\<and> j \\<le> n\n     then do {\n            bf\\<^sub>m' i j;\n            iter_bf (if j < n then (i, j + 1) else (i + 1, 0))\n          }\n     else State_Monad.return ()))\"\n  unfolding iter_bf_def by (rule ext) (safe, clarsimp simp: iter_state_unfold)\n\nlemmas bf_memoized = bf\\<^sub>m.memoized[OF bf\\<^sub>m.crel]\nlemmas bf_bottom_up = bottom_up.memoized[OF bf\\<^sub>m.crel, folded iter_bf_def]\n\ntext \\<open>\nThis will be our final implementation, which includes detection of negative cycles.\nSee the corresponding section below for the correctness proof.\n\\<close>\ndefinition\n  \"bellman_ford \\<equiv>\n    do {\n      _  \\<leftarrow> iter_bf (n, n);\n      xs \\<leftarrow> State_Main.map\\<^sub>T' (\\<lambda>i. bf\\<^sub>m' n i) [0..<n+1];\n      ys \\<leftarrow> State_Main.map\\<^sub>T' (\\<lambda>i. bf\\<^sub>m' (n + 1) i) [0..<n+1];\n      State_Monad.return (if xs = ys then Some xs else None)\n    }\"\n\ncontext\n  includes state_monad_syntax\nbegin\n\nlemma bellman_ford_alt_def:\n  \"bellman_ford \\<equiv>\n    do {\n      _  \\<leftarrow> iter_bf (n, n);\n      (\\<langle>\\<lambda>xs. \\<langle>\\<lambda>ys. State_Monad.return (if xs = ys then Some xs else None)\\<rangle>\n      . (State_Main.map\\<^sub>T . \\<langle>\\<lambda>i. bf\\<^sub>m' (n + 1) i\\<rangle> . \\<langle>[0..<n+1]\\<rangle>)\\<rangle>)\n      . (State_Main.map\\<^sub>T . \\<langle>\\<lambda>i. bf\\<^sub>m' n i\\<rangle>       . \\<langle>[0..<n+1]\\<rangle>)\n    }\"\n  unfolding\n    State_Monad_Ext.fun_app_lifted_def bellman_ford_def State_Main.map\\<^sub>T_def bind_left_identity\n  .\n\nend\n\n\n\nsubsubsection \\<open>Imperative Memoization\\<close>\n\ncontext\n  fixes mem :: \"nat ref \\<times> nat ref \\<times> int extended option array ref \\<times> int extended option array ref\"\n  assumes mem_is_init: \"mem = result_of (init_state (n + 1) 1 0) Heap.empty\"\nbegin\n\nlemma [intro]:\n  \"dp_consistency_heap_array_pair' (n + 1) fst snd id 1 0 mem\"\n  by (standard; simp add: mem_is_init injective_def)\n\ninterpretation iterator\n  \"\\<lambda> (x, y). x \\<le> n \\<and> y \\<le> n\"\n  \"\\<lambda> (x, y). if y < n then (x, y + 1) else (x + 1, 0)\"\n  \"\\<lambda> (x, y). x * (n + 1) + y\"\n  by (rule table_iterator_up)\n\nlemma [intro]:\n  \"dp_consistency_heap_array_pair_iterator (n + 1) fst snd id 1 0 mem\n  (\\<lambda> (x, y). if y < n then (x, y + 1) else (x + 1, 0))\n  (\\<lambda> (x, y). x * (n + 1) + y)\n  (\\<lambda> (x, y). x \\<le> n \\<and> y \\<le> n)\"\n  by (standard; simp add: mem_is_init injective_def)\n\nmemoize_fun bf\\<^sub>h: bf\n  with_memory (default_proof) dp_consistency_heap_array_pair_iterator\n  where size = \"n + 1\"\n    and key1 = \"fst :: nat \\<times> nat \\<Rightarrow> nat\" and key2 = \"snd :: nat \\<times> nat \\<Rightarrow> nat\"\n    and k1 = \"1 :: nat\" and k2 = \"0 :: nat\"\n    and to_index = \"id :: nat \\<Rightarrow> nat\"\n    and mem = mem\n    and cnt = \"\\<lambda> (x, y). x \\<le> n \\<and> y \\<le> n\"\n    and nxt = \"\\<lambda> (x :: nat, y). if y < n then (x, y + 1) else (x + 1, 0)\"\n    and sizef = \"\\<lambda> (x, y). x * (n + 1) + y\"\nmonadifies (heap) bf.simps\n\nmemoize_correct\n  by memoize_prover\n\nlemmas memoized_empty = bf\\<^sub>h.memoized_empty[OF bf\\<^sub>h.consistent_DP_iter_and_compute[OF bf\\<^sub>h.crel]]\nlemmas iter_heap_unfold = iter_heap_unfold\n\nend (* Fixed Memory *)\n\n\nsubsubsection \\<open>Detecting Negative Cycles\\<close>\n\ndefinition\n  \"shortest v = (\n    Inf (\n      {weight (v # xs @ [t]) | xs. set xs \\<subseteq> {0..n}} \\<union>\n      {if t = v then 0 else \\<infinity>}\n    )\n  )\"\n\ndefinition\n  \"is_path xs \\<equiv> weight (xs @ [t]) < \\<infinity>\"\n\ndefinition\n  \"has_negative_cycle \\<equiv>\n  \\<exists>xs a ys. set (a # xs @ ys) \\<subseteq> {0..n} \\<and> weight (a # xs @ [a]) < 0 \\<and> is_path (a # ys)\"\n\ndefinition\n  \"reaches a \\<equiv> \\<exists>xs. is_path (a # xs) \\<and> a \\<le> n \\<and> set xs \\<subseteq> {0..n}\"\n\nlemma fold_sum_aux':\n  assumes \"\\<forall>u \\<in> set (a # xs). \\<forall>v \\<in> set (xs @ [b]). f v + W u v \\<ge> f u\"\n  shows \"sum_list (map f (a # xs)) \\<le> sum_list (map f (xs @ [b])) + weight (a # xs @ [b])\"\n  using assms\n  by (induction xs arbitrary: a; simp)\n     (smt ab_semigroup_add_class.add_ac(1) add.left_commute add_mono)\n\nlemma fold_sum_aux:\n  assumes \"\\<forall>u \\<in> set (a # xs). \\<forall>v \\<in> set (a # xs). f v + W u v \\<ge> f u\"\n  shows \"sum_list (map f (a # xs @ [a])) \\<le> sum_list (map f (a # xs @ [a])) + weight (a # xs @ [a])\"\n  using fold_sum_aux'[of a xs a f] assms\n  by auto (metis (no_types, opaque_lifting) add.assoc add.commute add_left_mono)\n\ncontext\nbegin\n\nprivate definition \"is_path2 xs \\<equiv> weight xs < \\<infinity>\"\n\nprivate lemma is_path2_remove_cycle:\n  assumes \"is_path2 (as @ a # bs @ a # cs)\"\n  shows \"is_path2 (as @ a # cs)\"\nproof -\n  have \"weight (as @ a # bs @ a # cs) =\n    weight (as @ [a]) + weight (a # bs @ [a]) + weight (a # cs)\"\n    by (metis Bellman_Ford.weight_append append_Cons append_assoc)\n  with assms have \"weight (as @ [a]) < \\<infinity>\" \"weight (a # cs) < \\<infinity>\"\n    unfolding is_path2_def\n    by (simp, metis Pinf_add_right antisym less_extended_simps(4) not_less add.commute)+\n  then show ?thesis\n    unfolding is_path2_def by (subst weight_append) (rule add_lt_infI)\nqed\n\nprivate lemma is_path_eq:\n  \"is_path xs \\<longleftrightarrow> is_path2 (xs @ [t])\"\n  unfolding is_path_def is_path2_def ..\n\nlemma is_path_remove_cycle:\n  assumes \"is_path (as @ a # bs @ a # cs)\"\n  shows \"is_path (as @ a # cs)\"\n  using assms unfolding is_path_eq by (simp add: is_path2_remove_cycle)\n\nlemma is_path_remove_cycle2:\n  assumes \"is_path (as @ t # cs)\"\n  shows \"is_path as\"\n  using assms unfolding is_path_eq by (simp add: is_path2_remove_cycle)\n\nend (* private lemmas *)\n\nlemma is_path_shorten:\n  assumes \"is_path (i # xs)\" \"i \\<le> n\" \"set xs \\<subseteq> {0..n}\" \"t \\<le> n\" \"t \\<noteq> i\"\n  obtains xs where \"is_path (i # xs)\" \"i \\<le> n\" \"set xs \\<subseteq> {0..n}\" \"length xs < n\"\nproof (cases \"length xs < n\")\n  case True\n  with assms show ?thesis\n    by (auto intro: that)\nnext\n  case False\n  then have \"length xs \\<ge> n\"\n    by auto\n  with assms(1,3) show ?thesis\n  proof (induction \"length xs\" arbitrary: xs rule: less_induct)\n    case less\n    then have \"length (i # xs @ [t]) > card ({0..n})\"\n      by auto\n    moreover from less.prems \\<open>i \\<le> n\\<close> \\<open>t \\<le> n\\<close> have \"set (i # xs @ [t]) \\<subseteq> {0..n}\"\n      by auto\n    ultimately obtain a as bs cs where *: \"i # xs @ [t] = as @ a # bs @ a # cs\"\n      by (elim list_pidgeonhole) auto\n    obtain ys where ys: \"is_path (i # ys)\" \"length ys < length xs\" \"set (i # ys) \\<subseteq> {0..n}\"\n      apply atomize_elim\n      using *\n    proof (cases rule: path_eq_cycleE)\n      case Nil_Nil\n      with \\<open>t \\<noteq> i\\<close> show \"\\<exists>ys. is_path (i # ys) \\<and> length ys < length xs \\<and> set (i # ys) \\<subseteq> {0..n}\"\n        by auto\n    next\n      case (Nil_Cons cs')\n      then show \"\\<exists>ys. is_path (i # ys) \\<and> length ys < length xs \\<and> set (i # ys) \\<subseteq> {0..n}\"\n        using \\<open>set (i # xs @ [t]) \\<subseteq> {0..n}\\<close> \\<open>is_path (i # xs)\\<close> is_path_remove_cycle[of \"[]\"]\n        by - (rule exI[where x = cs'], simp)\n    next\n      case (Cons_Nil as')\n      then show \"\\<exists>ys. is_path (i # ys) \\<and> length ys < length xs \\<and> set (i # ys) \\<subseteq> {0..n}\"\n        using \\<open>set (i # xs @ [t]) \\<subseteq> {0..n}\\<close> \\<open>is_path (i # xs)\\<close>\n        by - (rule exI[where x = as'], auto intro: is_path_remove_cycle2)\n    next\n      case (Cons_Cons as' cs')\n      then show \"\\<exists>ys. is_path (i # ys) \\<and> length ys < length xs \\<and> set (i # ys) \\<subseteq> {0..n}\"\n        using \\<open>set (i # xs @ [t]) \\<subseteq> {0..n}\\<close> \\<open>is_path (i # xs)\\<close> is_path_remove_cycle[of \"i # as'\"]\n        by - (rule exI[where x = \"as' @ a # cs'\"], auto)\n    qed\n    then show ?thesis\n      by (cases \"n \\<le> length ys\") (auto intro: that less)\n  qed\nqed\n\nlemma reaches_non_inf_path:\n  assumes \"reaches i\" \"i \\<le> n\" \"t \\<le> n\"\n  shows \"OPT n i < \\<infinity>\"\nproof (cases \"t = i\")\n  case True\n  with \\<open>i \\<le> n\\<close> \\<open>t \\<le> n\\<close> have \"OPT n i \\<le> 0\"\n    unfolding OPT_def\n    by (auto intro: Min_le simp: finite_lists_length_le2[simplified])\n  then show ?thesis\n    using less_linear by (fastforce simp: zero_extended_def)\nnext\n  case False\n  from assms(1) obtain xs where \"is_path (i # xs)\" \"i \\<le> n\" \"set xs \\<subseteq> {0..n}\"\n    unfolding reaches_def by safe\n  then obtain xs where xs: \"is_path (i # xs)\" \"i \\<le> n\" \"set xs \\<subseteq> {0..n}\" \"length xs < n\"\n    using \\<open>t \\<noteq> i\\<close> \\<open>t \\<le> n\\<close> by (auto intro: is_path_shorten)\n  then have \"weight (i # xs @ [t]) < \\<infinity>\"\n    unfolding is_path_def by auto\n  with xs(2-) show ?thesis\n    unfolding OPT_def\n    by (elim order.strict_trans1[rotated])\n       (auto simp: setcompr_eq_image finite_lists_length_le2[simplified])\nqed\n\nlemma OPT_sink_le_0:\n  \"OPT i t \\<le> 0\"\n  unfolding OPT_def by (auto simp: finite_lists_length_le2[simplified])\n\nlemma is_path_appendD:\n  assumes \"is_path (as @ a # bs)\"\n  shows \"is_path (a # bs)\"\n  using assms weight_append[of as a \"bs @ [t]\"] unfolding is_path_def\n  by simp (metis Pinf_add_right add.commute less_extended_simps(4) not_less_iff_gr_or_eq)\n\nlemma has_negative_cycleI:\n  assumes \"set (a # xs @ ys) \\<subseteq> {0..n}\" \"weight (a # xs @ [a]) < 0\" \"is_path (a # ys)\"\n  shows has_negative_cycle\n  using assms unfolding has_negative_cycle_def by auto\n\nlemma OPT_cases2:\n  obtains (path) xs where\n    \"v \\<noteq> t\" \"OPT i v \\<noteq> \\<infinity>\" \"OPT i v = weight (v # xs @ [t])\" \"length xs + 1 \\<le> i\" \"set xs \\<subseteq> {0..n}\"\n  | (unreachable) \"v \\<noteq> t\" \"OPT i v = \\<infinity>\"\n  | (sink) \"v = t\" \"OPT i v \\<le> 0\"\n  unfolding OPT_def\n  using Min_in[of \"{weight (v # xs @ [t]) |xs. length xs + 1 \\<le> i \\<and> set xs \\<subseteq> {0..n}}\n    \\<union> {if t = v then 0 else \\<infinity>}\"]\n  by (cases \"v = t\"; force simp: finite_lists_length_le2[simplified] split: if_split_asm)\n\nlemma shortest_le_OPT:\n  assumes \"v \\<le> n\"\n  shows \"shortest v \\<le> OPT i v\"\n  unfolding OPT_def shortest_def\n  apply (subst Min_Inf)\n    apply (simp add: setcompr_eq_image finite_lists_length_le2[simplified]; fail)+\n  apply (rule Inf_superset_mono)\n  apply auto\n  done\n\n\ncontext\n  assumes W_wellformed: \"\\<forall>i \\<le> n. \\<forall>j \\<le> n. W i j > -\\<infinity>\"\n  assumes \"t \\<le> n\"\nbegin\n\nlemma weight_not_minfI:\n  \"-\\<infinity> < weight xs\" if \"set xs \\<subseteq> {0..n}\" \"xs \\<noteq> []\"\n  using that using W_wellformed \\<open>t \\<le> n\\<close>\n  by (induction xs rule: induct_list012) (auto intro: add_gt_minfI simp: zero_extended_def)\n\nlemma OPT_not_minfI:\n  \"OPT n i > -\\<infinity>\" if \"i \\<le> n\"\nproof -\n  have \"OPT n i \\<in>\n    {weight (i # xs @ [t]) |xs. length xs + 1 \\<le> n \\<and> set xs \\<subseteq> {0..n}} \\<union> {if t = i then 0 else \\<infinity>}\"\n    unfolding OPT_def\n    by (rule Min_in) (auto simp: setcompr_eq_image finite_lists_length_le2[simplified])\n  with that \\<open>t \\<le> n\\<close> show ?thesis\n    by (auto 4 3 intro!: weight_not_minfI simp: zero_extended_def)\nqed\n\ntheorem detects_cycle:\n  assumes has_negative_cycle\n  shows \"\\<exists>i \\<le> n. OPT (n + 1) i < OPT n i\"\nproof -\n  from assms \\<open>t \\<le> n\\<close> obtain xs a ys where cycle:\n    \"a \\<le> n\" \"set xs \\<subseteq> {0..n}\" \"set ys \\<subseteq> {0..n}\"\n    \"weight (a # xs @ [a]) < 0\" \"is_path (a # ys)\"\n    unfolding has_negative_cycle_def by clarsimp\n  then have \"reaches a\"\n    unfolding reaches_def by auto\n  have reaches: \"reaches x\" if \"x \\<in> set xs\" for x\n  proof -\n    from that obtain as bs where \"xs = as @ x # bs\"\n      by atomize_elim (rule split_list)\n    with cycle have \"weight (x # bs @ [a]) < \\<infinity>\"\n      using weight_append[of \"a # as\" x \"bs @ [a]\"]\n      by simp (metis Pinf_add_right Pinf_le add.commute less_eq_extended.simps(2) not_less)\n\n    moreover from \\<open>reaches a\\<close> obtain cs where \"local.weight (a # cs @ [t]) < \\<infinity>\" \"set cs \\<subseteq> {0..n}\"\n      unfolding reaches_def is_path_def by auto\n    ultimately show ?thesis\n      unfolding reaches_def is_path_def\n      using \\<open>a \\<le> n\\<close> weight_append[of \"x # bs\" a \"cs @ [t]\"] cycle(2) \\<open>xs = _\\<close>\n      by - (rule exI[where x = \"bs @ [a] @ cs\"], auto intro: add_lt_infI)\n  qed\n  let ?S = \"sum_list (map (OPT n) (a # xs @ [a]))\"\n  obtain u v where \"u \\<le> n\" \"v \\<le> n\" \"OPT n v + W u v < OPT n u\"\n  proof (atomize_elim, rule ccontr)\n    assume \"\\<nexists>u v. u \\<le> n \\<and> v \\<le> n \\<and> OPT n v + W u v < OPT n u\"\n    then have \"?S \\<le> ?S + weight (a # xs @ [a])\"\n      using cycle(1-3) by (subst fold_sum_aux; fastforce simp: subset_eq)\n    moreover have \"?S > -\\<infinity>\"\n      using cycle(1-4) by (intro sum_list_not_minfI, auto intro!: OPT_not_minfI)\n    moreover have \"?S < \\<infinity>\"\n      using reaches \\<open>t \\<le> n\\<close> cycle(1,2)\n      by (intro sum_list_not_infI) (auto intro: reaches_non_inf_path \\<open>reaches a\\<close> simp: subset_eq)\n    ultimately have \"weight (a # xs @ [a]) \\<ge> 0\"\n      by (simp add: le_add_same_cancel1)\n    with \\<open>weight _ < 0\\<close> show False\n      by simp\n  qed\n  then show ?thesis\n    by -\n       (rule exI[where x = u],\n        auto 4 4 intro: Min.coboundedI min.strict_coboundedI2 elim: order.strict_trans1[rotated]\n          simp: OPT_Suc[OF \\<open>t \\<le> n\\<close>])\nqed\n\ncorollary bf_detects_cycle:\n  assumes has_negative_cycle\n  shows \"\\<exists>i \\<le> n. bf (n + 1) i < bf n i\"\n  using detects_cycle[OF assms] unfolding bf_correct[OF \\<open>t \\<le> n\\<close>] .\n\nlemma shortest_cases:\n  assumes \"v \\<le> n\"\n  obtains (path) xs where \"shortest v = weight (v # xs @ [t])\" \"set xs \\<subseteq> {0..n}\"\n  | (sink) \"v = t\" \"shortest v = 0\"\n  | (unreachable) \"v \\<noteq> t\" \"shortest v = \\<infinity>\"\n  | (negative_cycle) \"shortest v = -\\<infinity>\" \"\\<forall>x. \\<exists>xs. set xs \\<subseteq> {0..n} \\<and> weight (v # xs @ [t]) < Fin x\"\nproof -\n  let ?S = \"{weight (v # xs @ [t]) | xs. set xs \\<subseteq> {0..n}} \\<union> {if t = v then 0 else \\<infinity>}\"\n  have \"?S \\<noteq> {}\"\n    by auto\n  have Minf_lowest: False if  \"-\\<infinity> < a\" \"-\\<infinity> = a\" for a :: \"int extended\"\n    using that by auto\n  show ?thesis\n  proof (cases \"shortest v\")\n    case (Fin x)\n    then have \"-\\<infinity> \\<notin> ?S\" \"bdd_below (Fin -` ?S)\" \"?S \\<noteq> {\\<infinity>}\" \"x = Inf (Fin -` ?S)\"\n      unfolding shortest_def Inf_extended_def by (auto split: if_split_asm)\n    from this(1-3) have \"x \\<in> Fin -` ?S\"\n      unfolding \\<open>x = _\\<close>\n      by (intro Inf_int_in, auto simp: zero_extended_def)\n        (smt empty_iff extended.exhaust insertI2 mem_Collect_eq vimage_eq)\n    with \\<open>shortest v = _\\<close> show ?thesis\n      unfolding vimage_eq by (auto split: if_split_asm intro: that)\n  next\n    case Pinf\n    with \\<open>?S \\<noteq> {}\\<close> have \"t \\<noteq> v\"\n      unfolding shortest_def Inf_extended_def by (auto split: if_split_asm)\n    with \\<open>_ = \\<infinity>\\<close> show ?thesis\n      by (auto intro: that)\n  next\n    case Minf\n    then have \"?S \\<noteq> {}\" \"?S \\<noteq> {\\<infinity>}\" \"-\\<infinity> \\<in> ?S \\<or> \\<not> bdd_below (Fin -` ?S)\"\n      unfolding shortest_def Inf_extended_def by (auto split: if_split_asm)\n    from this(3) have \"\\<forall>x. \\<exists>xs. set xs \\<subseteq> {0..n} \\<and> weight (v # xs @ [t]) < Fin x\"\n    proof\n      assume \"-\\<infinity> \\<in> ?S\"\n      with weight_not_minfI have False\n        using \\<open>v \\<le> n\\<close> \\<open>t \\<le> n\\<close> by (auto split: if_split_asm elim: Minf_lowest[rotated])\n      then show ?thesis ..\n    next\n      assume \"\\<not> bdd_below (Fin -` ?S)\"\n      show ?thesis\n      proof\n        fix x :: int\n        let ?m = \"min x (-1)\"\n        from \\<open>\\<not> bdd_below _\\<close> obtain m where \"Fin m \\<in> ?S\" \"m < ?m\"\n          unfolding bdd_below_def by - (simp, drule spec[of _ \"?m\"], force)\n        then show \"\\<exists>xs. set xs \\<subseteq> {0..n} \\<and> weight (v # xs @ [t]) < Fin x\"\n          by (auto split: if_split_asm simp: zero_extended_def) (metis less_extended_simps(1))+\n      qed\n    qed\n    with \\<open>shortest v = _\\<close> show ?thesis\n      by (auto intro: that)\n  qed\nqed\n\nlemma simple_paths:\n  assumes \"\\<not> has_negative_cycle\" \"weight (v # xs @ [t]) < \\<infinity>\" \"set xs \\<subseteq> {0..n}\" \"v \\<le> n\"\n  obtains ys where\n    \"weight (v # ys @ [t]) \\<le> weight (v # xs @ [t])\" \"set ys \\<subseteq> {0..n}\" \"length ys < n\" | \"v = t\"\n  using assms(2-)\nproof (atomize_elim, induction \"length xs\" arbitrary: xs rule: less_induct)\n  case (less ys)\n  note ys = less.prems(1,2)\n  note IH = less.hyps\n  have path: \"is_path (v # ys)\"\n    using is_path_def not_less_iff_gr_or_eq ys(1) by fastforce\n  show ?case\n  proof (cases \"length ys \\<ge> n\")\n    case True\n    with ys \\<open>v \\<le> n\\<close> \\<open>t \\<le> n\\<close> obtain a as bs cs where \"v # ys @ [t] = as @ a # bs @ a # cs\"\n      by - (rule list_pidgeonhole[of \"v # ys @ [t]\" \"{0..n}\"], auto)\n    then show ?thesis\n    proof (cases rule: path_eq_cycleE)\n      case Nil_Nil\n      then show ?thesis\n        by simp\n    next\n      case (Nil_Cons cs')\n      then have *: \"weight (v # ys @ [t]) = weight (a # bs @ [a]) + weight (a # cs' @ [t])\"\n        by (simp add: weight_append[of \"a # bs\" a \"cs' @ [t]\", simplified])\n      show ?thesis\n      proof (cases \"weight (a # bs @ [a]) < 0\")\n        case True\n        with Nil_Cons \\<open>set ys \\<subseteq> _\\<close> path show ?thesis\n          using assms(1) by (force intro: has_negative_cycleI[of a bs ys])\n      next\n        case False\n        then have \"weight (a # bs @ [a]) \\<ge> 0\"\n          by auto\n        with * ys have \"weight (a # cs' @ [t]) \\<le> weight (v # ys @ [t])\"\n          using add_mono not_le by fastforce\n        with Nil_Cons \\<open>length ys \\<ge> n\\<close> ys show ?thesis\n          using IH[of cs'] by simp (meson le_less_trans order_trans)\n      qed\n    next\n      case (Cons_Nil as')\n      with ys have *: \"weight (v # ys @ [t]) = weight (v # as' @ [t]) + weight (a # bs @ [a])\"\n        using weight_append[of \"v # as'\" t \"bs @ [t]\"] by simp\n      show ?thesis\n      proof (cases \"weight (a # bs @ [a]) < 0\")\n        case True\n        with Cons_Nil \\<open>set ys \\<subseteq> _\\<close> path assms(1) show ?thesis\n          using is_path_appendD[of \"v # as'\"] by (force intro: has_negative_cycleI[of a bs bs])\n      next\n        case False\n        then have \"weight (a # bs @ [a]) \\<ge> 0\"\n          by auto\n        with * ys(1) have \"weight (v # as' @ [t]) \\<le> weight (v # ys @ [t])\"\n          using add_left_mono by fastforce\n        with Cons_Nil \\<open>length ys \\<ge> n\\<close> \\<open>v \\<le> n\\<close> ys show ?thesis\n          using IH[of as'] by simp (meson le_less_trans order_trans)\n      qed\n    next\n      case (Cons_Cons as' cs')\n      with ys have *:\n        \"weight (v # ys @ [t]) = weight (v # as' @ a # cs' @ [t]) + weight (a # bs @ [a])\"\n        using\n          weight_append[of \"v # as'\" a \"bs @ a # cs' @ [t]\"]\n          weight_append[of \"a # bs\" a \"cs' @ [t]\"]\n          weight_append[of \"v # as'\" a \"cs' @ [t]\"]\n        by (simp add: algebra_simps)\n      show ?thesis\n      proof (cases \"weight (a # bs @ [a]) < 0\")\n        case True\n        with Cons_Cons \\<open>set ys \\<subseteq> _\\<close> path assms(1) show ?thesis\n          using is_path_appendD[of \"v # as'\"]\n          by (force intro: has_negative_cycleI[of a bs \"bs @ a # cs'\"])\n      next\n        case False\n        then have \"weight (a # bs @ [a]) \\<ge> 0\"\n          by auto\n        with * ys have \"weight (v # as' @ a # cs' @ [t]) \\<le> weight (v # ys @ [t])\"\n          using add_left_mono by fastforce\n        with Cons_Cons \\<open>v \\<le> n\\<close> ys show ?thesis\n          using is_path_remove_cycle2 IH[of \"as' @ a # cs'\"]\n          by simp (meson le_less_trans order_trans)\n      qed\n    qed\n  next\n    case False\n    with \\<open>set ys \\<subseteq> _\\<close> show ?thesis\n      by auto\n  qed\nqed\n\ntheorem shorter_than_OPT_n_has_negative_cycle:\n  assumes \"shortest v < OPT n v\" \"v \\<le> n\"\n  shows has_negative_cycle\nproof -\n  from assms obtain ys where ys:\n    \"weight (v # ys @ [t]) < OPT n v\" \"set ys \\<subseteq> {0..n}\"\n    apply (cases rule: OPT_cases2[of v n]; cases rule: shortest_cases[OF \\<open>v \\<le> n\\<close>]; simp)\n      apply (metis uminus_extended.cases)\n    using less_extended_simps(2) less_trans apply blast\n    apply (metis less_eq_extended.elims(2) less_extended_def zero_extended_def)\n    done\n  show ?thesis\n  proof (cases \"v = t\")\n    case True\n    with ys \\<open>t \\<le> n\\<close> show ?thesis\n      using OPT_sink_le_0[of n] unfolding has_negative_cycle_def is_path_def\n      using less_extended_def by force\n  next\n    case False\n    show ?thesis\n    proof (rule ccontr)\n      assume \"\\<not> has_negative_cycle\"\n      with False False ys \\<open>v \\<le> n\\<close> obtain xs where\n        \"weight (v # xs @ [t]) \\<le> weight (v # ys @ [t])\" \"set xs \\<subseteq> {0..n}\" \"length xs < n\"\n        using less_extended_def by (fastforce elim!: simple_paths[of v ys])\n      then have \"OPT n v \\<le> weight (v # xs @ [t])\"\n        unfolding OPT_def by (intro Min_le) auto\n      with \\<open>_ \\<le> weight (v # ys @ [t])\\<close> \\<open>weight (v # ys @ [t]) < OPT n v\\<close> show False\n        by simp\n    qed\n  qed\nqed\n\ncorollary detects_cycle_has_negative_cycle:\n  assumes \"OPT (n + 1) v < OPT n v\" \"v \\<le> n\"\n  shows has_negative_cycle\n  using assms shortest_le_OPT[of v \"n + 1\"] shorter_than_OPT_n_has_negative_cycle[of v] by auto\n\ncorollary bellman_ford_detects_cycle:\n  \"has_negative_cycle \\<longleftrightarrow> (\\<exists>v \\<le> n. OPT (n + 1) v < OPT n v)\"\n  using detects_cycle_has_negative_cycle detects_cycle by blast\n\ncorollary bellman_ford_shortest_paths:\n  assumes \"\\<not> has_negative_cycle\"\n  shows \"\\<forall>v \\<le> n. bf n v = shortest v\"\nproof -\n  have \"OPT n v \\<le> shortest v\" if \"v \\<le> n\" for v\n    using that assms shorter_than_OPT_n_has_negative_cycle[of v] by force\n  then show ?thesis\n    unfolding bf_correct[OF \\<open>t \\<le> n\\<close>, symmetric]\n    by (safe, rule order.antisym) (auto elim: shortest_le_OPT)\nqed\n\nlemma OPT_mono:\n  \"OPT m v \\<le> OPT n v\" if \\<open>v \\<le> n\\<close> \\<open>n \\<le> m\\<close>\n  using that unfolding OPT_def by (intro Min_antimono) auto\n\ncorollary bf_fix:\n  assumes \"\\<not> has_negative_cycle\" \"m \\<ge> n\"\n  shows \"\\<forall>v \\<le> n. bf m v = bf n v\"\nproof (intro allI impI)\n  fix v assume \"v \\<le> n\"\n  from \\<open>v \\<le> n\\<close> \\<open>n \\<le> m\\<close> have \"shortest v \\<le> OPT m v\"\n    by (simp add: shortest_le_OPT)\n  moreover from \\<open>v \\<le> n\\<close> \\<open>n \\<le> m\\<close> have \"OPT m v \\<le> OPT n v\"\n    by (rule OPT_mono)\n  moreover from \\<open>v \\<le> n\\<close> assms have \"OPT n v \\<le> shortest v\"\n    using shorter_than_OPT_n_has_negative_cycle[of v] by force\n  ultimately show \"bf m v = bf n v\"\n    unfolding bf_correct[OF \\<open>t \\<le> n\\<close>, symmetric] by simp\nqed\n\nlemma bellman_ford_correct':\n  \"bf\\<^sub>m.crel_vs (=) (if has_negative_cycle then None else Some (map shortest [0..<n+1])) bellman_ford\"\nproof -\n  include state_monad_syntax app_syntax\n  let ?l = \"if has_negative_cycle then None else Some (map shortest [0..<n + 1])\"\n  let ?r = \"(\\<lambda>xs. (\\<lambda>ys. (if xs = ys then Some xs else None))\n    $ (map $ \\<llangle>bf (n + 1)\\<rrangle> $ \\<llangle>[0..<n + 1]\\<rrangle>)) $ (map $ \\<llangle>bf n\\<rrangle> $ \\<llangle>[0..<n + 1]\\<rrangle>)\"\n  note crel_bf\\<^sub>m' = bf\\<^sub>m.crel[unfolded bf\\<^sub>m.consistentDP_def, THEN rel_funD,\n      of \"(m, x)\" \"(m, y)\" for m x y, unfolded prod.case]\n  have \"?l = ?r\"\n    supply [simp del] = bf_simps\n    supply [simp add] =\n      bf_fix[rule_format, symmetric] bellman_ford_shortest_paths[rule_format, symmetric]\n    unfolding Wrap_def App_def using bf_detects_cycle by (fastforce elim: nat_le_cases)\n  \\<comment> \\<open>Slightly transform the goal, then apply parametric reasoning like usual.\\<close>\n  show ?thesis\n    \\<comment> \\<open>Roughly \\<close>\n    unfolding bellman_ford_alt_def \\<open>?l = ?r\\<close> \\<comment> \\<open>Obtain parametric form.\\<close>\n    apply (rule bf\\<^sub>m.crel_vs_bind_ignore[rotated]) \\<comment> \\<open>Drop bind.\\<close>\n     apply (rule bottom_up.consistent_crel_vs_iterate_state[OF bf\\<^sub>m.crel, folded iter_bf_def])\n    apply (subst Transfer.Rel_def[symmetric]) \\<comment> \\<open>Setup typical goal for automated reasoner.\\<close>\n    \\<comment> \\<open>We need to reason manually because we are not in the context where \\<open>bf\\<^sub>m\\<close> was defined.\\<close>\n    \\<comment> \\<open>This is roughly what @{method \"memoize_prover_match_step\"}/\\<open>Transform_Tactic.step_tac\\<close> does.\\<close>\n    apply (tactic \\<open>Transform_Tactic.solve_relator_tac \\<^context> 1\\<close>\n          | rule HOL.refl\n          | rule bf\\<^sub>m.dp_match_rule\n          | rule bf\\<^sub>m.crel_vs_return_ext\n          | (subst Rel_def, rule crel_bf\\<^sub>m')\n          | tactic \\<open>Transform_Tactic.transfer_raw_tac \\<^context> 1\\<close>)+\n    done\nqed\n\ntheorem bellman_ford_correct:\n  \"fst (run_state bellman_ford Mapping.empty) =\n  (if has_negative_cycle then None else Some (map shortest [0..<n+1]))\"\n  using bf\\<^sub>m.cmem_empty bellman_ford_correct'[unfolded bf\\<^sub>m.crel_vs_def, rule_format, of Mapping.empty]\n  unfolding bf\\<^sub>m.crel_vs_def by auto\n\nend (* Wellformedness *)\n\nend (* Final Node *)\n\nend (* Bellman Ford *)\n\n\n\nsubsubsection \\<open>Extracting an Executable Constant for the Imperative Implementation\\<close>\n\nground_function (prove_termination) bf\\<^sub>h'_impl: bf\\<^sub>h'.simps\n\nlemma bf\\<^sub>h'_impl_def:\n  fixes n :: nat\n  fixes mem :: \"nat ref \\<times> nat ref \\<times> int extended option array ref \\<times> int extended option array ref\"\n  assumes mem_is_init: \"mem = result_of (init_state (n + 1) 1 0) Heap.empty\"\n  shows \"bf\\<^sub>h'_impl n w t mem = bf\\<^sub>h' n w t mem\"\nproof -\n  have \"bf\\<^sub>h'_impl n w t mem i j = bf\\<^sub>h' n w t mem i j\" for i j\n    by (induction rule: bf\\<^sub>h'.induct[OF mem_is_init];\n        simp add: bf\\<^sub>h'.simps[OF mem_is_init]; solve_cong simp\n       )\n  then show ?thesis\n    by auto\nqed\n\ndefinition\n  \"iter_bf_heap n w t mem = iterator_defs.iter_heap\n      (\\<lambda>(x, y). x \\<le> n \\<and> y \\<le> n)\n      (\\<lambda>(x, y). if y < n then (x, y + 1) else (x + 1, 0))\n      (\\<lambda>(x, y). bf\\<^sub>h'_impl n w t mem x y)\"\n\nlemma iter_bf_heap_unfold[code]:\n  \"iter_bf_heap n w t mem = (\\<lambda> (i, j).\n    (if i \\<le> n \\<and> j \\<le> n\n     then do {\n            bf\\<^sub>h'_impl n w t mem i j;\n            iter_bf_heap n w t mem (if j < n then (i, j + 1) else (i + 1, 0))\n          }\n     else Heap_Monad.return ()))\"\n  unfolding iter_bf_heap_def by (rule ext) (safe, simp add: iter_heap_unfold)\n\ndefinition\n  \"bf_impl n w t i j = do {\n    mem \\<leftarrow> (init_state (n + 1) (1::nat) (0::nat) ::\n      (nat ref \\<times> nat ref \\<times> int extended option array ref \\<times> int extended option array ref) Heap);\n    iter_bf_heap n w t mem (0, 0);\n    bf\\<^sub>h'_impl n w t mem i j\n  }\"\n\nlemma bf_impl_correct:\n  \"bf n w t i j = result_of (bf_impl n w t i j) Heap.empty\"\n  using memoized_empty[OF HOL.refl, of n w t \"(i, j)\"]\n  by (simp add:\n        execute_bind_success[OF succes_init_state] bf_impl_def bf\\<^sub>h'_impl_def iter_bf_heap_def\n      )\n\n\nsubsubsection \\<open>Test Cases\\<close>\n\ndefinition\n  \"G\\<^sub>1_list = [[(1 :: nat,-6 :: int), (2,4), (3,5)], [(3,10)], [(3,2)], []]\"\n\ndefinition\n  \"G\\<^sub>2_list = [[(1 :: nat,-6 :: int), (2,4), (3,5)], [(3,10)], [(3,2)], [(0, -5)]]\"\n\ndefinition\n  \"G\\<^sub>3_list = [[(1 :: nat,-1 :: int), (2,2)], [(2,5), (3,4)], [(3,2), (4,3)], [(2,-2), (4,2)], []]\"\n\ndefinition\n  \"G\\<^sub>4_list = [[(1 :: nat,-1 :: int), (2,2)], [(2,5), (3,4)], [(3,2), (4,3)], [(2,-3), (4,2)], []]\"\n\ndefinition\n  \"graph_of a i j = case_option \\<infinity> (Fin o snd) (List.find (\\<lambda> p. fst p = j) (a !! i))\"\n\ndefinition \"test_bf = bf_impl 3 (graph_of (IArray G\\<^sub>1_list)) 3 3 0\"\n\ncode_reflect Test functions test_bf\n\ntext \\<open>One can see a trace of the calls to the memory in the output\\<close>\nML \\<open>Test.test_bf ()\\<close>\n\nlemma bottom_up_alt[code]:\n  \"bf n W t i j =\n     fst (run_state\n      (iter_bf n W t (0, 0) \\<bind> (\\<lambda>_. bf\\<^sub>m' n W t i j))\n      Mapping.empty)\"\n  using bf_bottom_up by auto\n\ndefinition\n  \"bf_ia n W t i j = (let W' = graph_of (IArray W) in\n    fst (run_state\n      (iter_bf n W' t (i, j) \\<bind> (\\<lambda>_. bf\\<^sub>m' n W' t i j))\n      Mapping.empty)\n  )\"\n\n\\<comment> \\<open>Component tests.\\<close>\nlemma\n  \"fst (run_state (bf\\<^sub>m' 3 (graph_of (IArray G\\<^sub>1_list)) 3 3 0) Mapping.empty) = 4\"\n  \"bf 3 (graph_of (IArray G\\<^sub>1_list)) 3 3 0 = 4\"\n  by eval+\n\n\\<comment> \\<open>Regular test cases.\\<close>\nlemma\n  \"fst (run_state (bellman_ford 3 (graph_of (IArray G\\<^sub>1_list)) 3) Mapping.empty) = Some [4, 10, 2, 0]\"\n  \"fst (run_state (bellman_ford 4 (graph_of (IArray G\\<^sub>3_list)) 4) Mapping.empty) = Some [4, 5, 3, 1, 0]\"\n  by eval+\n\n\\<comment> \\<open>Test detection of negative cycles.\\<close>\nlemma\n  \"fst (run_state (bellman_ford 3 (graph_of (IArray G\\<^sub>2_list)) 3) Mapping.empty) = None\"\n  \"fst (run_state (bellman_ford 4 (graph_of (IArray G\\<^sub>4_list)) 4) Mapping.empty) = None\"\n  by eval+\n\nend (* Theory *)", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Monad_Memo_DP/example/Bellman_Ford.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.5964331462646255, "lm_q1q2_score": 0.3467084226337857}}
{"text": "(*  Title:      HOL/HOLCF/IOA/Sequence.thy\n    Author:     Olaf Müller\n*)\n\nsection \\<open>Sequences over flat domains with lifted elements\\<close>\n\ntheory Sequence\nimports Seq\nbegin\n\ndefault_sort type\n\ntype_synonym 'a Seq = \"'a lift seq\"\n\ndefinition Consq :: \"'a \\<Rightarrow> 'a Seq \\<rightarrow> 'a Seq\"\n  where \"Consq a = (LAM s. Def a ## s)\"\n\ndefinition Filter :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a Seq \\<rightarrow> 'a Seq\"\n  where \"Filter P = sfilter \\<cdot> (flift2 P)\"\n\ndefinition Map :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a Seq \\<rightarrow> 'b Seq\"\n  where \"Map f = smap \\<cdot> (flift2 f)\"\n\ndefinition Forall :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a Seq \\<Rightarrow> bool\"\n  where \"Forall P = sforall (flift2 P)\"\n\ndefinition Last :: \"'a Seq \\<rightarrow> 'a lift\"\n  where \"Last = slast\"\n\ndefinition Dropwhile :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a Seq \\<rightarrow> 'a Seq\"\n  where \"Dropwhile P = sdropwhile \\<cdot> (flift2 P)\"\n\ndefinition Takewhile :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a Seq \\<rightarrow> 'a Seq\"\n  where \"Takewhile P = stakewhile \\<cdot> (flift2 P)\"\n\ndefinition Zip :: \"'a Seq \\<rightarrow> 'b Seq \\<rightarrow> ('a * 'b) Seq\"\n  where \"Zip =\n    (fix \\<cdot> (LAM h t1 t2.\n      case t1 of\n        nil \\<Rightarrow> nil\n      | x ## xs \\<Rightarrow>\n          (case t2 of\n            nil \\<Rightarrow> UU\n          | y ## ys \\<Rightarrow>\n              (case x of\n                UU \\<Rightarrow> UU\n              | Def a \\<Rightarrow>\n                  (case y of\n                    UU \\<Rightarrow> UU\n                  | Def b \\<Rightarrow> Def (a, b) ## (h \\<cdot> xs \\<cdot> ys))))))\"\n\ndefinition Flat :: \"'a Seq seq \\<rightarrow> 'a Seq\"\n  where \"Flat = sflat\"\n\ndefinition Filter2 :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a Seq \\<rightarrow> 'a Seq\"\n  where \"Filter2 P =\n    (fix \\<cdot>\n      (LAM h t.\n        case t of\n          nil \\<Rightarrow> nil\n        | x ## xs \\<Rightarrow>\n            (case x of\n              UU \\<Rightarrow> UU\n            | Def y \\<Rightarrow> (if P y then x ## (h \\<cdot> xs) else h \\<cdot> xs))))\"\n\nabbreviation Consq_syn  (\"(_/\\<leadsto>_)\" [66, 65] 65)\n  where \"a \\<leadsto> s \\<equiv> Consq a \\<cdot> s\"\n\n\nsubsection \\<open>List enumeration\\<close>\n\nsyntax\n  \"_totlist\" :: \"args \\<Rightarrow> 'a Seq\"  (\"[(_)!]\")\n  \"_partlist\" :: \"args \\<Rightarrow> 'a Seq\"  (\"[(_)?]\")\ntranslations\n  \"[x, xs!]\" \\<rightleftharpoons> \"x \\<leadsto> [xs!]\"\n  \"[x!]\" \\<rightleftharpoons> \"x\\<leadsto>nil\"\n  \"[x, xs?]\" \\<rightleftharpoons> \"x \\<leadsto> [xs?]\"\n  \"[x?]\" \\<rightleftharpoons> \"x \\<leadsto> CONST bottom\"\n\n\ndeclare andalso_and [simp]\ndeclare andalso_or [simp]\n\n\nsubsection \\<open>Recursive equations of operators\\<close>\n\nsubsubsection \\<open>Map\\<close>\n\nlemma Map_UU: \"Map f \\<cdot> UU = UU\"\n  by (simp add: Map_def)\n\nlemma Map_nil: \"Map f \\<cdot> nil = nil\"\n  by (simp add: Map_def)\n\nlemma Map_cons: \"Map f \\<cdot> (x \\<leadsto> xs) = (f x) \\<leadsto> Map f \\<cdot> xs\"\n  by (simp add: Map_def Consq_def flift2_def)\n\n\nsubsubsection \\<open>Filter\\<close>\n\nlemma Filter_UU: \"Filter P \\<cdot> UU = UU\"\n  by (simp add: Filter_def)\n\nlemma Filter_nil: \"Filter P \\<cdot> nil = nil\"\n  by (simp add: Filter_def)\n\nlemma Filter_cons: \"Filter P \\<cdot> (x \\<leadsto> xs) = (if P x then x \\<leadsto> (Filter P \\<cdot> xs) else Filter P \\<cdot> xs)\"\n  by (simp add: Filter_def Consq_def flift2_def If_and_if)\n\n\nsubsubsection \\<open>Forall\\<close>\n\nlemma Forall_UU: \"Forall P UU\"\n  by (simp add: Forall_def sforall_def)\n\nlemma Forall_nil: \"Forall P nil\"\n  by (simp add: Forall_def sforall_def)\n\nlemma Forall_cons: \"Forall P (x \\<leadsto> xs) = (P x \\<and> Forall P xs)\"\n  by (simp add: Forall_def sforall_def Consq_def flift2_def)\n\n\nsubsubsection \\<open>Conc\\<close>\n\nlemma Conc_cons: \"(x \\<leadsto> xs) @@ y = x \\<leadsto> (xs @@ y)\"\n  by (simp add: Consq_def)\n\n\nsubsubsection \\<open>Takewhile\\<close>\n\nlemma Takewhile_UU: \"Takewhile P \\<cdot> UU = UU\"\n  by (simp add: Takewhile_def)\n\nlemma Takewhile_nil: \"Takewhile P \\<cdot> nil = nil\"\n  by (simp add: Takewhile_def)\n\nlemma Takewhile_cons:\n  \"Takewhile P \\<cdot> (x \\<leadsto> xs) = (if P x then x \\<leadsto> (Takewhile P \\<cdot> xs) else nil)\"\n  by (simp add: Takewhile_def Consq_def flift2_def If_and_if)\n\n\nsubsubsection \\<open>DropWhile\\<close>\n\nlemma Dropwhile_UU: \"Dropwhile P \\<cdot> UU = UU\"\n  by (simp add: Dropwhile_def)\n\nlemma Dropwhile_nil: \"Dropwhile P \\<cdot> nil = nil\"\n  by (simp add: Dropwhile_def)\n\nlemma Dropwhile_cons: \"Dropwhile P \\<cdot> (x \\<leadsto> xs) = (if P x then Dropwhile P \\<cdot> xs else x \\<leadsto> xs)\"\n  by (simp add: Dropwhile_def Consq_def flift2_def If_and_if)\n\n\nsubsubsection \\<open>Last\\<close>\n\nlemma Last_UU: \"Last \\<cdot> UU = UU\"\n  by (simp add: Last_def)\n\nlemma Last_nil: \"Last \\<cdot> nil = UU\"\n  by (simp add: Last_def)\n\nlemma Last_cons: \"Last \\<cdot> (x \\<leadsto> xs) = (if xs = nil then Def x else Last \\<cdot> xs)\"\n  by (cases xs) (simp_all add: Last_def Consq_def)\n\n\nsubsubsection \\<open>Flat\\<close>\n\nlemma Flat_UU: \"Flat \\<cdot> UU = UU\"\n  by (simp add: Flat_def)\n\nlemma Flat_nil: \"Flat \\<cdot> nil = nil\"\n  by (simp add: Flat_def)\n\nlemma Flat_cons: \"Flat \\<cdot> (x ## xs) = x @@ (Flat \\<cdot> xs)\"\n  by (simp add: Flat_def Consq_def)\n\n\nsubsubsection \\<open>Zip\\<close>\n\nlemma Zip_unfold:\n  \"Zip =\n    (LAM t1 t2.\n      case t1 of\n        nil \\<Rightarrow> nil\n      | x ## xs \\<Rightarrow>\n          (case t2 of\n            nil \\<Rightarrow> UU\n          | y ## ys \\<Rightarrow>\n              (case x of\n                UU \\<Rightarrow> UU\n              | Def a \\<Rightarrow>\n                  (case y of\n                    UU \\<Rightarrow> UU\n                  | Def b \\<Rightarrow> Def (a, b) ## (Zip \\<cdot> xs \\<cdot> ys)))))\"\n  apply (rule trans)\n  apply (rule fix_eq4)\n  apply (rule Zip_def)\n  apply (rule beta_cfun)\n  apply simp\n  done\n\nlemma Zip_UU1: \"Zip \\<cdot> UU \\<cdot> y = UU\"\n  apply (subst Zip_unfold)\n  apply simp\n  done\n\nlemma Zip_UU2: \"x \\<noteq> nil \\<Longrightarrow> Zip \\<cdot> x \\<cdot> UU = UU\"\n  apply (subst Zip_unfold)\n  apply simp\n  apply (cases x)\n  apply simp_all\n  done\n\nlemma Zip_nil: \"Zip \\<cdot> nil \\<cdot> y = nil\"\n  apply (subst Zip_unfold)\n  apply simp\n  done\n\nlemma Zip_cons_nil: \"Zip \\<cdot> (x \\<leadsto> xs) \\<cdot> nil = UU\"\n  apply (subst Zip_unfold)\n  apply (simp add: Consq_def)\n  done\n\nlemma Zip_cons: \"Zip \\<cdot> (x \\<leadsto> xs) \\<cdot> (y \\<leadsto> ys) = (x, y) \\<leadsto> Zip \\<cdot> xs \\<cdot> ys\"\n  apply (rule trans)\n  apply (subst Zip_unfold)\n  apply simp\n  apply (simp add: Consq_def)\n  done\n\nlemmas [simp del] =\n  sfilter_UU sfilter_nil sfilter_cons\n  smap_UU smap_nil smap_cons\n  sforall2_UU sforall2_nil sforall2_cons\n  slast_UU slast_nil slast_cons\n  stakewhile_UU  stakewhile_nil  stakewhile_cons\n  sdropwhile_UU  sdropwhile_nil  sdropwhile_cons\n  sflat_UU sflat_nil sflat_cons\n  szip_UU1 szip_UU2 szip_nil szip_cons_nil szip_cons\n\nlemmas [simp] =\n  Filter_UU Filter_nil Filter_cons\n  Map_UU Map_nil Map_cons\n  Forall_UU Forall_nil Forall_cons\n  Last_UU Last_nil Last_cons\n  Conc_cons\n  Takewhile_UU Takewhile_nil Takewhile_cons\n  Dropwhile_UU Dropwhile_nil Dropwhile_cons\n  Zip_UU1 Zip_UU2 Zip_nil Zip_cons_nil Zip_cons\n\n\nsubsection \\<open>Cons\\<close>\n\nlemma Consq_def2: \"a \\<leadsto> s = Def a ## s\"\n  by (simp add: Consq_def)\n\nlemma Seq_exhaust: \"x = UU \\<or> x = nil \\<or> (\\<exists>a s. x = a \\<leadsto> s)\"\n  apply (simp add: Consq_def2)\n  apply (cut_tac seq.nchotomy)\n  apply (fast dest: not_Undef_is_Def [THEN iffD1])\n  done\n\nlemma Seq_cases: obtains \"x = UU\" | \"x = nil\" | a s where \"x = a \\<leadsto> s\"\n  apply (cut_tac x=\"x\" in Seq_exhaust)\n  apply (erule disjE)\n  apply simp\n  apply (erule disjE)\n  apply simp\n  apply (erule exE)+\n  apply simp\n  done\n\nlemma Cons_not_UU: \"a \\<leadsto> s \\<noteq> UU\"\n  apply (subst Consq_def2)\n  apply simp\n  done\n\nlemma Cons_not_less_UU: \"\\<not> (a \\<leadsto> x) \\<sqsubseteq> UU\"\n  apply (rule notI)\n  apply (drule below_antisym)\n  apply simp\n  apply (simp add: Cons_not_UU)\n  done\n\nlemma Cons_not_less_nil: \"\\<not> a \\<leadsto> s \\<sqsubseteq> nil\"\n  by (simp add: Consq_def2)\n\nlemma Cons_not_nil: \"a \\<leadsto> s \\<noteq> nil\"\n  by (simp add: Consq_def2)\n\nlemma Cons_not_nil2: \"nil \\<noteq> a \\<leadsto> s\"\n  by (simp add: Consq_def2)\n\nlemma Cons_inject_eq: \"a \\<leadsto> s = b \\<leadsto> t \\<longleftrightarrow> a = b \\<and> s = t\"\n  by (simp add: Consq_def2 scons_inject_eq)\n\nlemma Cons_inject_less_eq: \"a \\<leadsto> s \\<sqsubseteq> b \\<leadsto> t \\<longleftrightarrow> a = b \\<and> s \\<sqsubseteq> t\"\n  by (simp add: Consq_def2)\n\nlemma seq_take_Cons: \"seq_take (Suc n) \\<cdot> (a \\<leadsto> x) = a \\<leadsto> (seq_take n \\<cdot> x)\"\n  by (simp add: Consq_def)\n\nlemmas [simp] =\n  Cons_not_nil2 Cons_inject_eq Cons_inject_less_eq seq_take_Cons\n  Cons_not_UU Cons_not_less_UU Cons_not_less_nil Cons_not_nil\n\n\nsubsection \\<open>Induction\\<close>\n\nlemma Seq_induct:\n  assumes \"adm P\"\n    and \"P UU\"\n    and \"P nil\"\n    and \"\\<And>a s. P s \\<Longrightarrow> P (a \\<leadsto> s)\"\n  shows \"P x\"\n  apply (insert assms)\n  apply (erule (2) seq.induct)\n  apply defined\n  apply (simp add: Consq_def)\n  done\n\nlemma Seq_FinitePartial_ind:\n  assumes \"P UU\"\n    and \"P nil\"\n    and \"\\<And>a s. P s \\<Longrightarrow> P (a \\<leadsto> s)\"\n  shows \"seq_finite x \\<longrightarrow> P x\"\n  apply (insert assms)\n  apply (erule (1) seq_finite_ind)\n  apply defined\n  apply (simp add: Consq_def)\n  done\n\nlemma Seq_Finite_ind:\n  assumes \"Finite x\"\n    and \"P nil\"\n    and \"\\<And>a s. Finite s \\<Longrightarrow> P s \\<Longrightarrow> P (a \\<leadsto> s)\"\n  shows \"P x\"\n  apply (insert assms)\n  apply (erule (1) Finite.induct)\n  apply defined\n  apply (simp add: Consq_def)\n  done\n\n\nsubsection \\<open>\\<open>HD\\<close> and \\<open>TL\\<close>\\<close>\n\nlemma HD_Cons [simp]: \"HD \\<cdot> (x \\<leadsto> y) = Def x\"\n  by (simp add: Consq_def)\n\nlemma TL_Cons [simp]: \"TL \\<cdot> (x \\<leadsto> y) = y\"\n  by (simp add: Consq_def)\n\n\nsubsection \\<open>\\<open>Finite\\<close>, \\<open>Partial\\<close>, \\<open>Infinite\\<close>\\<close>\n\nlemma Finite_Cons [simp]: \"Finite (a \\<leadsto> xs) = Finite xs\"\n  by (simp add: Consq_def2 Finite_cons)\n\nlemma FiniteConc_1: \"Finite (x::'a Seq) \\<Longrightarrow> Finite y \\<longrightarrow> Finite (x @@ y)\"\n  apply (erule Seq_Finite_ind)\n  apply simp_all\n  done\n\nlemma FiniteConc_2: \"Finite (z::'a Seq) \\<Longrightarrow> \\<forall>x y. z = x @@ y \\<longrightarrow> Finite x \\<and> Finite y\"\n  apply (erule Seq_Finite_ind)\n  text \\<open>\\<open>nil\\<close>\\<close>\n  apply (intro strip)\n  apply (rule_tac x=\"x\" in Seq_cases, simp_all)\n  text \\<open>\\<open>cons\\<close>\\<close>\n  apply (intro strip)\n  apply (rule_tac x=\"x\" in Seq_cases, simp_all)\n  apply (rule_tac x=\"y\" in Seq_cases, simp_all)\n  done\n\nlemma FiniteConc [simp]: \"Finite (x @@ y) \\<longleftrightarrow> Finite (x::'a Seq) \\<and> Finite y\"\n  apply (rule iffI)\n  apply (erule FiniteConc_2 [rule_format])\n  apply (rule refl)\n  apply (rule FiniteConc_1 [rule_format])\n  apply auto\n  done\n\n\nlemma FiniteMap1: \"Finite s \\<Longrightarrow> Finite (Map f \\<cdot> s)\"\n  apply (erule Seq_Finite_ind)\n  apply simp_all\n  done\n\nlemma FiniteMap2: \"Finite s \\<Longrightarrow> \\<forall>t. s = Map f \\<cdot> t \\<longrightarrow> Finite t\"\n  apply (erule Seq_Finite_ind)\n  apply (intro strip)\n  apply (rule_tac x=\"t\" in Seq_cases, simp_all)\n  text \\<open>\\<open>main case\\<close>\\<close>\n  apply auto\n  apply (rule_tac x=\"t\" in Seq_cases, simp_all)\n  done\n\nlemma Map2Finite: \"Finite (Map f \\<cdot> s) = Finite s\"\n  apply auto\n  apply (erule FiniteMap2 [rule_format])\n  apply (rule refl)\n  apply (erule FiniteMap1)\n  done\n\n\nlemma FiniteFilter: \"Finite s \\<Longrightarrow> Finite (Filter P \\<cdot> s)\"\n  apply (erule Seq_Finite_ind)\n  apply simp_all\n  done\n\n\nsubsection \\<open>\\<open>Conc\\<close>\\<close>\n\nlemma Conc_cong: \"\\<And>x::'a Seq. Finite x \\<Longrightarrow> (x @@ y) = (x @@ z) \\<longleftrightarrow> y = z\"\n  apply (erule Seq_Finite_ind)\n  apply simp_all\n  done\n\nlemma Conc_assoc: \"(x @@ y) @@ z = (x::'a Seq) @@ y @@ z\"\n  apply (rule_tac x=\"x\" in Seq_induct)\n  apply simp_all\n  done\n\nlemma nilConc [simp]: \"s@@ nil = s\"\n  apply (induct s)\n  apply simp\n  apply simp\n  apply simp\n  apply simp\n  done\n\n\n(*Should be same as nil_is_Conc2 when all nils are turned to right side!*)\nlemma nil_is_Conc: \"nil = x @@ y \\<longleftrightarrow> (x::'a Seq) = nil \\<and> y = nil\"\n  apply (rule_tac x=\"x\" in Seq_cases)\n  apply auto\n  done\n\nlemma nil_is_Conc2: \"x @@ y = nil \\<longleftrightarrow> (x::'a Seq) = nil \\<and> y = nil\"\n  apply (rule_tac x=\"x\" in Seq_cases)\n  apply auto\n  done\n\n\nsubsection \\<open>Last\\<close>\n\nlemma Finite_Last1: \"Finite s \\<Longrightarrow> s \\<noteq> nil \\<longrightarrow> Last \\<cdot> s \\<noteq> UU\"\n  by (erule Seq_Finite_ind) simp_all\n\nlemma Finite_Last2: \"Finite s \\<Longrightarrow> Last \\<cdot> s = UU \\<longrightarrow> s = nil\"\n  by (erule Seq_Finite_ind) auto\n\n\nsubsection \\<open>Filter, Conc\\<close>\n\nlemma FilterPQ: \"Filter P \\<cdot> (Filter Q \\<cdot> s) = Filter (\\<lambda>x. P x \\<and> Q x) \\<cdot> s\"\n  by (rule_tac x=\"s\" in Seq_induct) simp_all\n\nlemma FilterConc: \"Filter P \\<cdot> (x @@ y) = (Filter P \\<cdot> x @@ Filter P \\<cdot> y)\"\n  by (simp add: Filter_def sfiltersconc)\n\n\nsubsection \\<open>Map\\<close>\n\nlemma MapMap: \"Map f \\<cdot> (Map g \\<cdot> s) = Map (f \\<circ> g) \\<cdot> s\"\n  by (rule_tac x=\"s\" in Seq_induct) simp_all\n\nlemma MapConc: \"Map f \\<cdot> (x @@ y) = (Map f \\<cdot> x) @@ (Map f \\<cdot> y)\"\n  by (rule_tac x=\"x\" in Seq_induct) simp_all\n\nlemma MapFilter: \"Filter P \\<cdot> (Map f \\<cdot> x) = Map f \\<cdot> (Filter (P \\<circ> f) \\<cdot> x)\"\n  by (rule_tac x=\"x\" in Seq_induct) simp_all\n\nlemma nilMap: \"nil = (Map f \\<cdot> s) \\<longrightarrow> s = nil\"\n  by (rule_tac x=\"s\" in Seq_cases) simp_all\n\nlemma ForallMap: \"Forall P (Map f \\<cdot> s) = Forall (P \\<circ> f) s\"\n  apply (rule_tac x=\"s\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\n\nsubsection \\<open>Forall\\<close>\n\nlemma ForallPForallQ1: \"Forall P ys \\<and> (\\<forall>x. P x \\<longrightarrow> Q x) \\<longrightarrow> Forall Q ys\"\n  apply (rule_tac x=\"ys\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\nlemmas ForallPForallQ =\n  ForallPForallQ1 [THEN mp, OF conjI, OF _ allI, OF _ impI]\n\nlemma Forall_Conc_impl: \"Forall P x \\<and> Forall P y \\<longrightarrow> Forall P (x @@ y)\"\n  apply (rule_tac x=\"x\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\nlemma Forall_Conc [simp]: \"Finite x \\<Longrightarrow> Forall P (x @@ y) \\<longleftrightarrow> Forall P x \\<and> Forall P y\"\n  by (erule Seq_Finite_ind) simp_all\n\nlemma ForallTL1: \"Forall P s \\<longrightarrow> Forall P (TL \\<cdot> s)\"\n  apply (rule_tac x=\"s\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\nlemmas ForallTL = ForallTL1 [THEN mp]\n\nlemma ForallDropwhile1: \"Forall P s \\<longrightarrow> Forall P (Dropwhile Q \\<cdot> s)\"\n  apply (rule_tac x=\"s\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\nlemmas ForallDropwhile = ForallDropwhile1 [THEN mp]\n\n\n(*only admissible in t, not if done in s*)\nlemma Forall_prefix: \"\\<forall>s. Forall P s \\<longrightarrow> t \\<sqsubseteq> s \\<longrightarrow> Forall P t\"\n  apply (rule_tac x=\"t\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  apply (intro strip)\n  apply (rule_tac x=\"sa\" in Seq_cases)\n  apply simp\n  apply auto\n  done\n\nlemmas Forall_prefixclosed = Forall_prefix [rule_format]\n\nlemma Forall_postfixclosed: \"Finite h \\<Longrightarrow> Forall P s \\<Longrightarrow> s= h @@ t \\<Longrightarrow> Forall P t\"\n  by auto\n\n\nlemma ForallPFilterQR1:\n  \"(\\<forall>x. P x \\<longrightarrow> Q x = R x) \\<and> Forall P tr \\<longrightarrow> Filter Q \\<cdot> tr = Filter R \\<cdot> tr\"\n  apply (rule_tac x=\"tr\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\nlemmas ForallPFilterQR = ForallPFilterQR1 [THEN mp, OF conjI, OF allI]\n\n\nsubsection \\<open>Forall, Filter\\<close>\n\nlemma ForallPFilterP: \"Forall P (Filter P \\<cdot> x)\"\n  by (simp add: Filter_def Forall_def forallPsfilterP)\n\n(*holds also in other direction, then equal to forallPfilterP*)\nlemma ForallPFilterPid1: \"Forall P x \\<longrightarrow> Filter P \\<cdot> x = x\"\n  apply (rule_tac x=\"x\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def Filter_def)\n  apply simp_all\n  done\n\nlemmas ForallPFilterPid = ForallPFilterPid1 [THEN mp]\n\n(*holds also in other direction*)\nlemma ForallnPFilterPnil1: \"Finite ys \\<Longrightarrow> Forall (\\<lambda>x. \\<not> P x) ys \\<longrightarrow> Filter P \\<cdot> ys = nil\"\n  by (erule Seq_Finite_ind) simp_all\n\nlemmas ForallnPFilterPnil = ForallnPFilterPnil1 [THEN mp]\n\n\n(*holds also in other direction*)\nlemma ForallnPFilterPUU1: \"\\<not> Finite ys \\<and> Forall (\\<lambda>x. \\<not> P x) ys \\<longrightarrow> Filter P \\<cdot> ys = UU\"\n  apply (rule_tac x=\"ys\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\nlemmas ForallnPFilterPUU = ForallnPFilterPUU1 [THEN mp, OF conjI]\n\n\n(*inverse of ForallnPFilterPnil*)\nlemma FilternPnilForallP [rule_format]: \"Filter P \\<cdot> ys = nil \\<longrightarrow> Forall (\\<lambda>x. \\<not> P x) ys \\<and> Finite ys\"\n  apply (rule_tac x=\"ys\" in Seq_induct)\n  text \\<open>adm\\<close>\n  apply (simp add: Forall_def sforall_def)\n  text \\<open>base cases\\<close>\n  apply simp\n  apply simp\n  text \\<open>main case\\<close>\n  apply simp\n  done\n\n(*inverse of ForallnPFilterPUU*)\nlemma FilternPUUForallP:\n  assumes \"Filter P \\<cdot> ys = UU\"\n  shows \"Forall (\\<lambda>x. \\<not> P x) ys \\<and> \\<not> Finite ys\"\nproof\n  show \"Forall (\\<lambda>x. \\<not> P x) ys\"\n  proof (rule classical)\n    assume \"\\<not> ?thesis\"\n    then have \"Filter P \\<cdot> ys \\<noteq> UU\"\n      apply (rule rev_mp)\n      apply (induct ys rule: Seq_induct)\n      apply (simp add: Forall_def sforall_def)\n      apply simp_all\n      done\n    with assms show ?thesis by contradiction\n  qed\n  show \"\\<not> Finite ys\"\n  proof\n    assume \"Finite ys\"\n    then have \"Filter P\\<cdot>ys \\<noteq> UU\"\n      by (rule Seq_Finite_ind) simp_all\n    with assms show False by contradiction\n  qed\nqed\n\n\nlemma ForallQFilterPnil:\n  \"Forall Q ys \\<Longrightarrow> Finite ys \\<Longrightarrow> (\\<And>x. Q x \\<Longrightarrow> \\<not> P x) \\<Longrightarrow> Filter P \\<cdot> ys = nil\"\n  apply (erule ForallnPFilterPnil)\n  apply (erule ForallPForallQ)\n  apply auto\n  done\n\nlemma ForallQFilterPUU: \"\\<not> Finite ys \\<Longrightarrow> Forall Q ys \\<Longrightarrow> (\\<And>x. Q x \\<Longrightarrow> \\<not> P x) \\<Longrightarrow> Filter P \\<cdot> ys = UU\"\n  apply (erule ForallnPFilterPUU)\n  apply (erule ForallPForallQ)\n  apply auto\n  done\n\n\nsubsection \\<open>Takewhile, Forall, Filter\\<close>\n\nlemma ForallPTakewhileP [simp]: \"Forall P (Takewhile P \\<cdot> x)\"\n  by (simp add: Forall_def Takewhile_def sforallPstakewhileP)\n\n\nlemma ForallPTakewhileQ [simp]: \"(\\<And>x. Q x \\<Longrightarrow> P x) \\<Longrightarrow> Forall P (Takewhile Q \\<cdot> x)\"\n  apply (rule ForallPForallQ)\n  apply (rule ForallPTakewhileP)\n  apply auto\n  done\n\n\nlemma FilterPTakewhileQnil [simp]:\n  \"Finite (Takewhile Q \\<cdot> ys) \\<Longrightarrow> (\\<And>x. Q x \\<Longrightarrow> \\<not> P x) \\<Longrightarrow> Filter P \\<cdot> (Takewhile Q \\<cdot> ys) = nil\"\n  apply (erule ForallnPFilterPnil)\n  apply (rule ForallPForallQ)\n  apply (rule ForallPTakewhileP)\n  apply auto\n  done\n\nlemma FilterPTakewhileQid [simp]:\n  \"(\\<And>x. Q x \\<Longrightarrow> P x) \\<Longrightarrow> Filter P \\<cdot> (Takewhile Q \\<cdot> ys) = Takewhile Q \\<cdot> ys\"\n  apply (rule ForallPFilterPid)\n  apply (rule ForallPForallQ)\n  apply (rule ForallPTakewhileP)\n  apply auto\n  done\n\n\nlemma Takewhile_idempotent: \"Takewhile P \\<cdot> (Takewhile P \\<cdot> s) = Takewhile P \\<cdot> s\"\n  apply (rule_tac x=\"s\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\nlemma ForallPTakewhileQnP [simp]:\n  \"Forall P s \\<longrightarrow> Takewhile (\\<lambda>x. Q x \\<or> (\\<not> P x)) \\<cdot> s = Takewhile Q \\<cdot> s\"\n  apply (rule_tac x=\"s\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\nlemma ForallPDropwhileQnP [simp]:\n  \"Forall P s \\<longrightarrow> Dropwhile (\\<lambda>x. Q x \\<or> (\\<not> P x)) \\<cdot> s = Dropwhile Q \\<cdot> s\"\n  apply (rule_tac x=\"s\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\n\nlemma TakewhileConc1: \"Forall P s \\<longrightarrow> Takewhile P \\<cdot> (s @@ t) = s @@ (Takewhile P \\<cdot> t)\"\n  apply (rule_tac x=\"s\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\nlemmas TakewhileConc = TakewhileConc1 [THEN mp]\n\nlemma DropwhileConc1: \"Finite s \\<Longrightarrow> Forall P s \\<longrightarrow> Dropwhile P \\<cdot> (s @@ t) = Dropwhile P \\<cdot> t\"\n  by (erule Seq_Finite_ind) simp_all\n\nlemmas DropwhileConc = DropwhileConc1 [THEN mp]\n\n\nsubsection \\<open>Coinductive characterizations of Filter\\<close>\n\nlemma divide_Seq_lemma:\n  \"HD \\<cdot> (Filter P \\<cdot> y) = Def x \\<longrightarrow>\n    y = (Takewhile (\\<lambda>x. \\<not> P x) \\<cdot> y) @@ (x \\<leadsto> TL \\<cdot> (Dropwhile (\\<lambda>a. \\<not> P a) \\<cdot> y)) \\<and>\n    Finite (Takewhile (\\<lambda>x. \\<not> P x) \\<cdot> y) \\<and> P x\"\n  (* FIX: pay attention: is only admissible with chain-finite package to be added to\n          adm test and Finite f x admissibility *)\n  apply (rule_tac x=\"y\" in Seq_induct)\n  apply (simp add: adm_subst [OF _ adm_Finite])\n  apply simp\n  apply simp\n  apply (case_tac \"P a\")\n   apply simp\n   apply blast\n  text \\<open>\\<open>\\<not> P a\\<close>\\<close>\n  apply simp\n  done\n\nlemma divide_Seq: \"(x \\<leadsto> xs) \\<sqsubseteq> Filter P \\<cdot> y \\<Longrightarrow>\n  y = ((Takewhile (\\<lambda>a. \\<not> P a) \\<cdot> y) @@ (x \\<leadsto> TL \\<cdot> (Dropwhile (\\<lambda>a. \\<not> P a) \\<cdot> y))) \\<and>\n  Finite (Takewhile (\\<lambda>a. \\<not> P a) \\<cdot> y) \\<and> P x\"\n  apply (rule divide_Seq_lemma [THEN mp])\n  apply (drule_tac f=\"HD\" and x=\"x \\<leadsto> xs\" in  monofun_cfun_arg)\n  apply simp\n  done\n\n\nlemma nForall_HDFilter: \"\\<not> Forall P y \\<longrightarrow> (\\<exists>x. HD \\<cdot> (Filter (\\<lambda>a. \\<not> P a) \\<cdot> y) = Def x)\"\n  unfolding not_Undef_is_Def [symmetric]\n  apply (induct y rule: Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\n\nlemma divide_Seq2:\n  \"\\<not> Forall P y \\<Longrightarrow>\n    \\<exists>x. y = Takewhile P\\<cdot>y @@ (x \\<leadsto> TL \\<cdot> (Dropwhile P \\<cdot> y)) \\<and> Finite (Takewhile P \\<cdot> y) \\<and> \\<not> P x\"\n  apply (drule nForall_HDFilter [THEN mp])\n  apply safe\n  apply (rule_tac x=\"x\" in exI)\n  apply (cut_tac P1=\"\\<lambda>x. \\<not> P x\" in divide_Seq_lemma [THEN mp])\n  apply auto\n  done\n\n\nlemma divide_Seq3:\n  \"\\<not> Forall P y \\<Longrightarrow> \\<exists>x bs rs. y = (bs @@ (x\\<leadsto>rs)) \\<and> Finite bs \\<and> Forall P bs \\<and> \\<not> P x\"\n  apply (drule divide_Seq2)\n  apply fastforce\n  done\n\nlemmas [simp] = FilterPQ FilterConc Conc_cong\n\n\nsubsection \\<open>Take-lemma\\<close>\n\nlemma seq_take_lemma: \"(\\<forall>n. seq_take n \\<cdot> x = seq_take n \\<cdot> x') \\<longleftrightarrow> x = x'\"\n  apply (rule iffI)\n  apply (rule seq.take_lemma)\n  apply auto\n  done\n\nlemma take_reduction1:\n  \"\\<forall>n. ((\\<forall>k. k < n \\<longrightarrow> seq_take k \\<cdot> y1 = seq_take k \\<cdot> y2) \\<longrightarrow>\n    seq_take n \\<cdot> (x @@ (t \\<leadsto> y1)) =  seq_take n \\<cdot> (x @@ (t \\<leadsto> y2)))\"\n  apply (rule_tac x=\"x\" in Seq_induct)\n  apply simp_all\n  apply (intro strip)\n  apply (case_tac \"n\")\n  apply auto\n  apply (case_tac \"n\")\n  apply auto\n  done\n\nlemma take_reduction:\n  \"x = y \\<Longrightarrow> s = t \\<Longrightarrow> (\\<And>k. k < n \\<Longrightarrow> seq_take k \\<cdot> y1 = seq_take k \\<cdot> y2)\n    \\<Longrightarrow> seq_take n \\<cdot> (x @@ (s \\<leadsto> y1)) = seq_take n \\<cdot> (y @@ (t \\<leadsto> y2))\"\n  by (auto intro!: take_reduction1 [rule_format])\n\n\ntext \\<open>\n  Take-lemma and take-reduction for \\<open>\\<sqsubseteq>\\<close> instead of \\<open>=\\<close>.\n\\<close>\n          \nlemma take_reduction_less1:\n  \"\\<forall>n. ((\\<forall>k. k < n \\<longrightarrow> seq_take k \\<cdot> y1 \\<sqsubseteq> seq_take k\\<cdot>y2) \\<longrightarrow>\n    seq_take n \\<cdot> (x @@ (t \\<leadsto> y1)) \\<sqsubseteq> seq_take n \\<cdot> (x @@ (t \\<leadsto> y2)))\"\n  apply (rule_tac x=\"x\" in Seq_induct)\n  apply simp_all\n  apply (intro strip)\n  apply (case_tac \"n\")\n  apply auto\n  apply (case_tac \"n\")\n  apply auto\n  done\n\nlemma take_reduction_less:\n  \"x = y \\<Longrightarrow> s = t \\<Longrightarrow> (\\<And>k. k < n \\<Longrightarrow> seq_take k \\<cdot> y1 \\<sqsubseteq> seq_take k \\<cdot> y2) \\<Longrightarrow>\n    seq_take n \\<cdot> (x @@ (s \\<leadsto> y1)) \\<sqsubseteq> seq_take n \\<cdot> (y @@ (t \\<leadsto> y2))\"\n  by (auto intro!: take_reduction_less1 [rule_format])\n\nlemma take_lemma_less1:\n  assumes \"\\<And>n. seq_take n \\<cdot> s1 \\<sqsubseteq> seq_take n \\<cdot> s2\"\n  shows \"s1 \\<sqsubseteq> s2\"\n  apply (rule_tac t=\"s1\" in seq.reach [THEN subst])\n  apply (rule_tac t=\"s2\" in seq.reach [THEN subst])\n  apply (rule lub_mono)\n  apply (rule seq.chain_take [THEN ch2ch_Rep_cfunL])\n  apply (rule seq.chain_take [THEN ch2ch_Rep_cfunL])\n  apply (rule assms)\n  done\n\nlemma take_lemma_less: \"(\\<forall>n. seq_take n \\<cdot> x \\<sqsubseteq> seq_take n \\<cdot> x') \\<longleftrightarrow> x \\<sqsubseteq> x'\"\n  apply (rule iffI)\n  apply (rule take_lemma_less1)\n  apply auto\n  apply (erule monofun_cfun_arg)\n  done\n\n\ntext \\<open>Take-lemma proof principles.\\<close>\n\nlemma take_lemma_principle1:\n  assumes \"\\<And>s. Forall Q s \\<Longrightarrow> A s \\<Longrightarrow> f s = g s\"\n    and \"\\<And>s1 s2 y. Forall Q s1 \\<Longrightarrow> Finite s1 \\<Longrightarrow>\n      \\<not> Q y \\<Longrightarrow> A (s1 @@ y \\<leadsto> s2) \\<Longrightarrow> f (s1 @@ y \\<leadsto> s2) = g (s1 @@ y \\<leadsto> s2)\"\n  shows \"A x \\<longrightarrow> f x = g x\"\n  using assms by (cases \"Forall Q x\") (auto dest!: divide_Seq3)\n\nlemma take_lemma_principle2:\n  assumes \"\\<And>s. Forall Q s \\<Longrightarrow> A s \\<Longrightarrow> f s = g s\"\n    and \"\\<And>s1 s2 y. Forall Q s1 \\<Longrightarrow> Finite s1 \\<Longrightarrow> \\<not> Q y \\<Longrightarrow> A (s1 @@ y \\<leadsto> s2) \\<Longrightarrow>\n      \\<forall>n. seq_take n \\<cdot> (f (s1 @@ y \\<leadsto> s2)) = seq_take n \\<cdot> (g (s1 @@ y \\<leadsto> s2))\"\n  shows \"A x \\<longrightarrow> f x = g x\"\n  using assms\n  apply (cases \"Forall Q x\")\n  apply (auto dest!: divide_Seq3)\n  apply (rule seq.take_lemma)\n  apply auto\n  done\n\n\ntext \\<open>\n  Note: in the following proofs the ordering of proof steps is very important,\n  as otherwise either \\<open>Forall Q s1\\<close> would be in the IH as assumption (then\n  rule useless) or it is not possible to strengthen the IH apply doing a\n  forall closure of the sequence \\<open>t\\<close> (then rule also useless). This is also\n  the reason why the induction rule (\\<open>nat_less_induct\\<close> or \\<open>nat_induct\\<close>) has to\n  to be imbuilt into the rule, as induction has to be done early and the take\n  lemma has to be used in the trivial direction afterwards for the\n  \\<open>Forall Q x\\<close> case.\n\\<close>\n\nlemma take_lemma_induct:\n  assumes \"\\<And>s. Forall Q s \\<Longrightarrow> A s \\<Longrightarrow> f s = g s\"\n    and \"\\<And>s1 s2 y n.\n      \\<forall>t. A t \\<longrightarrow> seq_take n \\<cdot> (f t) = seq_take n \\<cdot> (g t) \\<Longrightarrow>\n      Forall Q s1 \\<Longrightarrow> Finite s1 \\<Longrightarrow> \\<not> Q y \\<Longrightarrow> A (s1 @@ y \\<leadsto> s2) \\<Longrightarrow>\n      seq_take (Suc n) \\<cdot> (f (s1 @@ y \\<leadsto> s2)) =\n      seq_take (Suc n) \\<cdot> (g (s1 @@ y \\<leadsto> s2))\"\n  shows \"A x \\<longrightarrow> f x = g x\"\n  apply (insert assms)\n  apply (rule impI)\n  apply (rule seq.take_lemma)\n  apply (rule mp)\n  prefer 2 apply assumption\n  apply (rule_tac x=\"x\" in spec)\n  apply (rule nat.induct)\n  apply simp\n  apply (rule allI)\n  apply (case_tac \"Forall Q xa\")\n  apply (force intro!: seq_take_lemma [THEN iffD2, THEN spec])\n  apply (auto dest!: divide_Seq3)\n  done\n\n\nlemma take_lemma_less_induct:\n  assumes \"\\<And>s. Forall Q s \\<Longrightarrow> A s \\<Longrightarrow> f s = g s\"\n    and \"\\<And>s1 s2 y n.\n      \\<forall>t m. m < n \\<longrightarrow> A t \\<longrightarrow> seq_take m \\<cdot> (f t) = seq_take m \\<cdot> (g t) \\<Longrightarrow>\n      Forall Q s1 \\<Longrightarrow> Finite s1 \\<Longrightarrow> \\<not> Q y \\<Longrightarrow> A (s1 @@ y \\<leadsto> s2) \\<Longrightarrow>\n      seq_take n \\<cdot> (f (s1 @@ y \\<leadsto> s2)) =\n      seq_take n \\<cdot> (g (s1 @@ y \\<leadsto> s2))\"\n  shows \"A x \\<longrightarrow> f x = g x\"\n  apply (insert assms)\n  apply (rule impI)\n  apply (rule seq.take_lemma)\n  apply (rule mp)\n  prefer 2 apply assumption\n  apply (rule_tac x=\"x\" in spec)\n  apply (rule nat_less_induct)\n  apply (rule allI)\n  apply (case_tac \"Forall Q xa\")\n  apply (force intro!: seq_take_lemma [THEN iffD2, THEN spec])\n  apply (auto dest!: divide_Seq3)\n  done\n\n\n\nlemma take_lemma_in_eq_out:\n  assumes \"A UU \\<Longrightarrow> f UU = g UU\"\n    and \"A nil \\<Longrightarrow> f nil = g nil\"\n    and \"\\<And>s y n.\n      \\<forall>t. A t \\<longrightarrow> seq_take n \\<cdot> (f t) = seq_take n \\<cdot> (g t) \\<Longrightarrow> A (y \\<leadsto> s) \\<Longrightarrow>\n      seq_take (Suc n) \\<cdot> (f (y \\<leadsto> s)) =\n      seq_take (Suc n) \\<cdot> (g (y \\<leadsto> s))\"\n  shows \"A x \\<longrightarrow> f x = g x\"\n  apply (insert assms)\n  apply (rule impI)\n  apply (rule seq.take_lemma)\n  apply (rule mp)\n  prefer 2 apply assumption\n  apply (rule_tac x=\"x\" in spec)\n  apply (rule nat.induct)\n  apply simp\n  apply (rule allI)\n  apply (rule_tac x=\"xa\" in Seq_cases)\n  apply simp_all\n  done\n\n\nsubsection \\<open>Alternative take_lemma proofs\\<close>\n\nsubsubsection \\<open>Alternative Proof of FilterPQ\\<close>\n\ndeclare FilterPQ [simp del]\n\n\n(*In general: How to do this case without the same adm problems\n  as for the entire proof?*)\nlemma Filter_lemma1:\n  \"Forall (\\<lambda>x. \\<not> (P x \\<and> Q x)) s \\<longrightarrow>\n    Filter P \\<cdot> (Filter Q \\<cdot> s) = Filter (\\<lambda>x. P x \\<and> Q x) \\<cdot> s\"\n  apply (rule_tac x=\"s\" in Seq_induct)\n  apply (simp add: Forall_def sforall_def)\n  apply simp_all\n  done\n\nlemma Filter_lemma2: \"Finite s \\<Longrightarrow>\n  Forall (\\<lambda>x. \\<not> P x \\<or> \\<not> Q x) s \\<longrightarrow> Filter P \\<cdot> (Filter Q \\<cdot> s) = nil\"\n  by (erule Seq_Finite_ind) simp_all\n\nlemma Filter_lemma3: \"Finite s \\<Longrightarrow>\n  Forall (\\<lambda>x. \\<not> P x \\<or> \\<not> Q x) s \\<longrightarrow> Filter (\\<lambda>x. P x \\<and> Q x) \\<cdot> s = nil\"\n  by (erule Seq_Finite_ind) simp_all\n\nlemma FilterPQ_takelemma: \"Filter P \\<cdot> (Filter Q \\<cdot> s) = Filter (\\<lambda>x. P x \\<and> Q x) \\<cdot> s\"\n  apply (rule_tac A1=\"\\<lambda>x. True\" and Q1=\"\\<lambda>x. \\<not> (P x \\<and> Q x)\" and x1=\"s\" in\n    take_lemma_induct [THEN mp])\n  (*better support for A = \\<lambda>x. True*)\n  apply (simp add: Filter_lemma1)\n  apply (simp add: Filter_lemma2 Filter_lemma3)\n  apply simp\n  done\n\ndeclare FilterPQ [simp]\n\n\nsubsubsection \\<open>Alternative Proof of \\<open>MapConc\\<close>\\<close>\n\nlemma MapConc_takelemma: \"Map f \\<cdot> (x @@ y) = (Map f \\<cdot> x) @@ (Map f \\<cdot> y)\"\n  apply (rule_tac A1=\"\\<lambda>x. True\" and x1=\"x\" in take_lemma_in_eq_out [THEN mp])\n  apply auto\n  done\n\nML \\<open>\nfun Seq_case_tac ctxt s i =\n  Rule_Insts.res_inst_tac ctxt [(((\"x\", 0), Position.none), s)] [] @{thm Seq_cases} i\n  THEN hyp_subst_tac ctxt i THEN hyp_subst_tac ctxt (i + 1) THEN hyp_subst_tac ctxt (i + 2);\n\n(* on a\\<leadsto>s only simp_tac, as full_simp_tac is uncomplete and often causes errors *)\nfun Seq_case_simp_tac ctxt s i =\n  Seq_case_tac ctxt s i\n  THEN asm_simp_tac ctxt (i + 2)\n  THEN asm_full_simp_tac ctxt (i + 1)\n  THEN asm_full_simp_tac ctxt i;\n\n(* rws are definitions to be unfolded for admissibility check *)\nfun Seq_induct_tac ctxt s rws i =\n  Rule_Insts.res_inst_tac ctxt [(((\"x\", 0), Position.none), s)] [] @{thm Seq_induct} i\n  THEN (REPEAT_DETERM (CHANGED (asm_simp_tac ctxt (i + 1))))\n  THEN simp_tac (ctxt addsimps rws) i;\n\nfun Seq_Finite_induct_tac ctxt i =\n  eresolve_tac ctxt @{thms Seq_Finite_ind} i\n  THEN (REPEAT_DETERM (CHANGED (asm_simp_tac ctxt i)));\n\nfun pair_tac ctxt s =\n  Rule_Insts.res_inst_tac ctxt [(((\"y\", 0), Position.none), s)] [] @{thm prod.exhaust}\n  THEN' hyp_subst_tac ctxt THEN' asm_full_simp_tac ctxt;\n\n(* induction on a sequence of pairs with pairsplitting and simplification *)\nfun pair_induct_tac ctxt s rws i =\n  Rule_Insts.res_inst_tac ctxt [(((\"x\", 0), Position.none), s)] [] @{thm Seq_induct} i\n  THEN pair_tac ctxt \"a\" (i + 3)\n  THEN (REPEAT_DETERM (CHANGED (simp_tac ctxt (i + 1))))\n  THEN simp_tac (ctxt addsimps rws) i;\n\\<close>\n\nmethod_setup Seq_case =\n  \\<open>Scan.lift Parse.embedded >> (fn s => fn ctxt => SIMPLE_METHOD' (Seq_case_tac ctxt s))\\<close>\n\nmethod_setup Seq_case_simp =\n  \\<open>Scan.lift Parse.embedded >> (fn s => fn ctxt => SIMPLE_METHOD' (Seq_case_simp_tac ctxt s))\\<close>\n\nmethod_setup Seq_induct =\n  \\<open>Scan.lift Parse.embedded --\n    Scan.optional ((Scan.lift (Args.$$$ \"simp\" -- Args.colon) |-- Attrib.thms)) []\n    >> (fn (s, rws) => fn ctxt => SIMPLE_METHOD' (Seq_induct_tac ctxt s rws))\\<close>\n\nmethod_setup Seq_Finite_induct =\n  \\<open>Scan.succeed (SIMPLE_METHOD' o Seq_Finite_induct_tac)\\<close>\n\nmethod_setup pair =\n  \\<open>Scan.lift Parse.embedded >> (fn s => fn ctxt => SIMPLE_METHOD' (pair_tac ctxt s))\\<close>\n\nmethod_setup pair_induct =\n  \\<open>Scan.lift Parse.embedded --\n    Scan.optional ((Scan.lift (Args.$$$ \"simp\" -- Args.colon) |-- Attrib.thms)) []\n    >> (fn (s, rws) => fn ctxt => SIMPLE_METHOD' (pair_induct_tac ctxt s rws))\\<close>\n\nlemma Mapnil: \"Map f \\<cdot> s = nil \\<longleftrightarrow> s = nil\"\n  by (Seq_case_simp s)\n\nlemma MapUU: \"Map f \\<cdot> s = UU \\<longleftrightarrow> s = UU\"\n  by (Seq_case_simp s)\n\nlemma MapTL: \"Map f \\<cdot> (TL \\<cdot> s) = TL \\<cdot> (Map f \\<cdot> s)\"\n  by (Seq_induct s)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/Sequence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.5964331462646255, "lm_q1q2_score": 0.3467084226337857}}
{"text": "theory ASC_Sufficiency\n  imports ASC_Suite\nbegin\n\nsection \\<open> Sufficiency of the test suite to test for reduction \\<close>\n\ntext \\<open>\nThis section provides a proof that the test suite generated by the adaptive state counting algorithm\nis sufficient to test for reduction.\n\\<close>\n\nsubsection \\<open> Properties of minimal sequences to failures extending the deterministic state cover \\<close>\n\ntext \\<open>\nThe following two lemmata show that minimal sequences to failures extending the deterministic state\ncover do not with their extending suffix visit any state twice or visit a state also reached by a\nsequence in the chosen permutation of reactions to the deterministic state cover.\n\\<close>\n\nlemma minimal_sequence_to_failure_extending_implies_Rep_Pre :\n  assumes \"minimal_sequence_to_failure_extending V M1 M2 vs xs\"\n  and     \"OFSM M1\"\n  and     \"OFSM M2\"\n  and     \"test_tools M2 M1 FAIL PM V \\<Omega>\"\n  and     \"V'' \\<in> N (vs@xs') M1 V\"\n  and     \"prefix xs' xs\"\n  shows \"\\<not> Rep_Pre M2 M1 vs xs'\"\nproof \n  assume \"Rep_Pre M2 M1 vs xs'\" \n  then obtain xs1 xs2 s1 s2 where  \"prefix xs1 xs2\"   \n                                   \"prefix xs2 xs'\"\n                                   \"xs1 \\<noteq> xs2\"\n                                   \"io_targets M2 (initial M2) (vs @ xs1) = {s2}\" \n                                   \"io_targets M2 (initial M2) (vs @ xs2) = {s2}\"\n                                   \"io_targets M1 (initial M1) (vs @ xs1) = {s1}\"\n                                   \"io_targets M1 (initial M1) (vs @ xs2) = {s1}\"\n    by auto\n  then have \"s2 \\<in> io_targets M2 (initial M2) (vs @ xs1)\"\n            \"s2 \\<in> io_targets M2 (initial M2) (vs @ xs2)\"\n            \"s1 \\<in> io_targets M1 (initial M1) (vs @ xs1)\"\n            \"s1 \\<in> io_targets M1 (initial M1) (vs @ xs2)\"            \n    by auto\n\n  have \"vs@xs1 \\<in> L M1\" \n    using io_target_implies_L[OF \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs1)\\<close>] by assumption\n  have \"vs@xs2 \\<in> L M1\" \n    using io_target_implies_L[OF \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs2)\\<close>] by assumption\n  have \"vs@xs1 \\<in> L M2\" \n    using io_target_implies_L[OF \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs1)\\<close>] by assumption\n  have \"vs@xs2 \\<in> L M2\" \n    using io_target_implies_L[OF \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs2)\\<close>] by assumption\n\n  obtain tr1_1 where \"path M1 (vs@xs1 || tr1_1) (initial M1)\" \n                     \"length tr1_1 = length (vs@xs1)\" \n                     \"target (vs@xs1 || tr1_1) (initial M1) = s1\"\n    using \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs1)\\<close> by auto\n  obtain tr1_2 where \"path M1 (vs@xs2 || tr1_2) (initial M1)\" \n                     \"length tr1_2 = length (vs@xs2)\" \n                     \"target (vs@xs2 || tr1_2) (initial M1) = s1\"\n    using \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs2)\\<close> by auto \n  obtain tr2_1 where \"path M2 (vs@xs1 || tr2_1) (initial M2)\" \n                     \"length tr2_1 = length (vs@xs1)\" \n                     \"target (vs@xs1 || tr2_1) (initial M2) = s2\"\n    using \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs1)\\<close> by auto\n  obtain tr2_2 where \"path M2 (vs@xs2 || tr2_2) (initial M2)\"\n                     \"length tr2_2 = length (vs@xs2)\"\n                     \"target (vs@xs2 || tr2_2) (initial M2) = s2\"\n    using \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs2)\\<close> by auto \n\n\n  have \"productF M2 M1 FAIL PM\" \n    using assms(4) by auto\n  have \"well_formed M1\" \n    using assms(2) by auto\n  have \"well_formed M2\" \n    using assms(3) by auto\n  have \"observable PM\"\n    by (meson assms(2) assms(3) assms(4) observable_productF)\n\n  have \"length (vs@xs1) = length tr2_1\"\n    using \\<open>length tr2_1 = length (vs @ xs1)\\<close> by presburger\n  then have \"length tr2_1 = length tr1_1\" \n    using \\<open>length tr1_1 = length (vs@xs1)\\<close> by presburger\n\n  have \"vs@xs1 \\<in> L PM\" \n    using productF_path_inclusion[OF \\<open>length (vs@xs1) = length tr2_1\\<close> \\<open>length tr2_1 = length tr1_1\\<close> \n                                     \\<open>productF M2 M1 FAIL PM\\<close> \\<open>well_formed M2\\<close> \\<open>well_formed M1\\<close>]\n    by (meson Int_iff \\<open>productF M2 M1 FAIL PM\\<close> \\<open>vs @ xs1 \\<in> L M1\\<close> \\<open>vs @ xs1 \\<in> L M2\\<close> \\<open>well_formed M1\\<close> \n        \\<open>well_formed M2\\<close> productF_language)\n    \n\n  have \"length (vs@xs2) = length tr2_2\"\n    using \\<open>length tr2_2 = length (vs @ xs2)\\<close> by presburger\n  then have \"length tr2_2 = length tr1_2\" \n    using \\<open>length tr1_2 = length (vs@xs2)\\<close> by presburger\n\n  have \"vs@xs2 \\<in> L PM\" \n    using productF_path_inclusion[OF \\<open>length (vs@xs2) = length tr2_2\\<close> \\<open>length tr2_2 = length tr1_2\\<close> \n                                     \\<open>productF M2 M1 FAIL PM\\<close> \\<open>well_formed M2\\<close> \\<open>well_formed M1\\<close>]\n    by (meson Int_iff \\<open>productF M2 M1 FAIL PM\\<close> \\<open>vs @ xs2 \\<in> L M1\\<close> \\<open>vs @ xs2 \\<in> L M2\\<close> \\<open>well_formed M1\\<close> \n        \\<open>well_formed M2\\<close> productF_language)\n\n\n  \n\n  have \"io_targets PM (initial M2, initial M1) (vs @ xs1) = {(s2, s1)}\" \n    using productF_path_io_targets_reverse\n          [OF \\<open>productF M2 M1 FAIL PM\\<close> \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs1)\\<close> \n              \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs1)\\<close> \\<open>vs @ xs1 \\<in> L M2\\<close> \\<open>vs @ xs1 \\<in> L M1\\<close> ]\n  proof -\n    have \"\\<forall>c f. c \\<noteq> initial (f::('a, 'b, 'c) FSM) \\<or> c \\<in> nodes f\"\n      by blast\n    then show ?thesis\n      by (metis (no_types) \\<open>\\<lbrakk>observable M2; observable M1; well_formed M2; well_formed M1; \n                             initial M2 \\<in> nodes M2; initial M1 \\<in> nodes M1\\<rbrakk> \n                            \\<Longrightarrow> io_targets PM (initial M2, initial M1) (vs @ xs1) = {(s2, s1)}\\<close> \n          assms(2) assms(3))\n  qed \n\n  have \"io_targets PM (initial M2, initial M1) (vs @ xs2) = {(s2, s1)}\" \n    using productF_path_io_targets_reverse\n          [OF \\<open>productF M2 M1 FAIL PM\\<close> \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs2)\\<close> \n              \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs2)\\<close> \\<open>vs @ xs2 \\<in> L M2\\<close> \\<open>vs @ xs2 \\<in> L M1\\<close> ]\n  proof -\n    have \"\\<forall>c f. c \\<noteq> initial (f::('a, 'b, 'c) FSM) \\<or> c \\<in> nodes f\"\n      by blast\n    then show ?thesis\n      by (metis (no_types) \\<open>\\<lbrakk>observable M2; observable M1; well_formed M2; well_formed M1; \n                             initial M2 \\<in> nodes M2; initial M1 \\<in> nodes M1\\<rbrakk> \n                            \\<Longrightarrow> io_targets PM (initial M2, initial M1) (vs @ xs2) = {(s2, s1)}\\<close> \n          assms(2) assms(3))\n  qed\n\n  have \"prefix (vs @ xs1) (vs @ xs2)\"\n    using \\<open>prefix xs1 xs2\\<close> by auto\n\n\n\n  have \"sequence_to_failure M1 M2 (vs@xs)\" \n    using assms(1) by auto\n  \n\n  have \"prefix (vs@xs1) (vs@xs')\"\n    using \\<open>prefix xs1 xs2\\<close> \\<open>prefix xs2 xs'\\<close> prefix_order.dual_order.trans same_prefix_prefix \n    by blast \n  have \"prefix (vs@xs2) (vs@xs')\"\n    using \\<open>prefix xs2 xs'\\<close> prefix_order.dual_order.trans same_prefix_prefix by blast \n\n   \n\n  have \"io_targets PM (initial PM) (vs @ xs1) = {(s2,s1)}\"\n    using \\<open>io_targets PM (initial M2, initial M1) (vs @ xs1) = {(s2, s1)}\\<close> assms(4) by auto\n  have \"io_targets PM (initial PM) (vs @ xs2) = {(s2,s1)}\"\n    using \\<open>io_targets PM (initial M2, initial M1) (vs @ xs2) = {(s2, s1)}\\<close> assms(4) by auto\n\n\n  have \"(vs @ xs2) @ (drop (length xs2) xs) = vs@xs\"\n    by (metis \\<open>prefix xs2 xs'\\<close>  append_eq_appendI append_eq_conv_conj assms(6) prefixE) \n  moreover have \"io_targets PM (initial PM) (vs@xs) = {FAIL}\" \n    using sequence_to_failure_reaches_FAIL_ob[OF \\<open>sequence_to_failure M1 M2 (vs@xs)\\<close> assms(2,3) \n                                                 \\<open>productF M2 M1 FAIL PM\\<close>] \n    by assumption\n  ultimately have \"io_targets PM (initial PM) ((vs @ xs2) @ (drop (length xs2) xs)) = {FAIL}\" \n    by auto\n  \n  have \"io_targets PM (s2,s1) (drop (length xs2) xs) = {FAIL}\" \n    using observable_io_targets_split\n          [OF \\<open>observable PM\\<close>\n              \\<open>io_targets PM (initial PM) ((vs @ xs2) @ (drop (length xs2) xs)) = {FAIL}\\<close>\n              \\<open>io_targets PM (initial PM) (vs @ xs2) = {(s2, s1)}\\<close>] \n    by assumption\n\n  have \"io_targets PM (initial PM) (vs@xs1@(drop (length xs2) xs)) = {FAIL}\"\n    using observable_io_targets_append\n          [OF \\<open>observable PM\\<close> \\<open>io_targets PM (initial PM) (vs @ xs1) = {(s2,s1)}\\<close> \n              \\<open>io_targets PM (s2,s1) (drop (length xs2) xs) = {FAIL}\\<close>] \n    by simp\n  have \"sequence_to_failure M1 M2 (vs@xs1@(drop (length xs2) xs))\"\n    using sequence_to_failure_alt_def\n          [OF \\<open>io_targets PM (initial PM) (vs@xs1@(drop (length xs2) xs)) = {FAIL}\\<close> assms(2,3)]\n          assms(4) \n    by blast \n\n  have \"length xs1 < length xs2\"\n    using \\<open>prefix xs1 xs2\\<close> \\<open>xs1 \\<noteq> xs2\\<close> prefix_length_prefix by fastforce     \n  have \"xs = (xs1 @ (drop (length xs1) xs))\"\n    by (metis (no_types) \\<open>(vs @ xs2) @ drop (length xs2) xs = vs @ xs\\<close> \\<open>prefix xs1 xs2\\<close> \n        append_assoc append_eq_conv_conj prefixE)\n  have \"length xs1 < length xs\"\n    using \\<open>prefix xs1 xs2\\<close> \\<open>prefix xs2 xs'\\<close> \\<open>xs = xs1 @ drop (length xs1) xs\\<close> \\<open>xs1 \\<noteq> xs2\\<close> \n          assms(6) leI \n    by fastforce \n  have \"length (xs1@(drop (length xs2) xs)) < length xs\"\n    using \\<open>length xs1 < length xs2\\<close> \\<open>length xs1 < length xs\\<close> by auto\n\n\n  have \"vs \\<in> L\\<^sub>i\\<^sub>n M1 V \n        \\<and> sequence_to_failure M1 M2 (vs @ xs1@(drop (length xs2) xs)) \n        \\<and> length (xs1@(drop (length xs2) xs)) < length xs\"\n    using \\<open>length (xs1 @ drop (length xs2) xs) < length xs\\<close> \n          \\<open>sequence_to_failure M1 M2 (vs @ xs1 @ drop (length xs2) xs)\\<close> \n          assms(1) minimal_sequence_to_failure_extending.simps \n    by blast\n  \n  then have \"\\<not> minimal_sequence_to_failure_extending V M1 M2 vs xs\"\n    by (meson minimal_sequence_to_failure_extending.elims(2))\n   \n\n  then show \"False\" \n    using assms(1) by linarith\nqed\n  \n\n\n\nlemma minimal_sequence_to_failure_extending_implies_Rep_Cov :\n  assumes \"minimal_sequence_to_failure_extending V M1 M2 vs xs\"\n  and     \"OFSM M1\"\n  and     \"OFSM M2\"\n  and     \"test_tools M2 M1 FAIL PM V \\<Omega>\"\n  and     \"V'' \\<in> N (vs@xsR) M1 V\"\n  and     \"prefix xsR xs\"\nshows \"\\<not> Rep_Cov M2 M1 V'' vs xsR\"\nproof \n  assume \"Rep_Cov M2 M1 V'' vs xsR\"\n  then obtain xs' vs' s2 s1 where \"xs' \\<noteq> []\" \n                                  \"prefix xs' xsR\" \n                                  \"vs' \\<in> V''\"\n                                  \"io_targets M2 (initial M2) (vs @ xs') = {s2}\" \n                                  \"io_targets M2 (initial M2) (vs') = {s2}\"\n                                  \"io_targets M1 (initial M1) (vs @ xs') = {s1}\" \n                                  \"io_targets M1 (initial M1) (vs') = {s1}\"\n    by auto\n\n  then have \"s2 \\<in> io_targets M2 (initial M2) (vs @ xs')\"\n            \"s2 \\<in> io_targets M2 (initial M2) (vs')\"\n            \"s1 \\<in> io_targets M1 (initial M1) (vs @ xs')\"\n            \"s1 \\<in> io_targets M1 (initial M1) (vs')\"            \n    by auto\n\n  have \"vs@xs' \\<in> L M1\" \n    using io_target_implies_L[OF \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs')\\<close>] by assumption\n  have \"vs' \\<in> L M1\" \n    using io_target_implies_L[OF \\<open>s1 \\<in> io_targets M1 (initial M1) (vs')\\<close>] by assumption\n  have \"vs@xs' \\<in> L M2\" \n    using io_target_implies_L[OF \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs')\\<close>] by assumption\n  have \"vs' \\<in> L M2\" \n    using io_target_implies_L[OF \\<open>s2 \\<in> io_targets M2 (initial M2) (vs')\\<close>] by assumption\n\n  obtain tr1_1 where \"path M1 (vs@xs' || tr1_1) (initial M1)\"\n                     \"length tr1_1 = length (vs@xs')\"\n                     \"target (vs@xs' || tr1_1) (initial M1) = s1\"\n    using \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs')\\<close> by auto\n  obtain tr1_2 where \"path M1 (vs' || tr1_2) (initial M1)\"\n                     \"length tr1_2 = length (vs')\"\n                     \"target (vs' || tr1_2) (initial M1) = s1\"\n    using \\<open>s1 \\<in> io_targets M1 (initial M1) (vs')\\<close> by auto \n  obtain tr2_1 where \"path M2 (vs@xs' || tr2_1) (initial M2)\"\n                     \"length tr2_1 = length (vs@xs')\"\n                     \"target (vs@xs' || tr2_1) (initial M2) = s2\"\n    using \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs')\\<close> by auto\n  obtain tr2_2 where \"path M2 (vs' || tr2_2) (initial M2)\"\n                     \"length tr2_2 = length (vs')\"\n                     \"target (vs' || tr2_2) (initial M2) = s2\" \n    using \\<open>s2 \\<in> io_targets M2 (initial M2) (vs')\\<close> by auto \n\n\n  have \"productF M2 M1 FAIL PM\" \n    using assms(4) by auto\n  have \"well_formed M1\" \n    using assms(2) by auto\n  have \"well_formed M2\" \n    using assms(3) by auto\n  have \"observable PM\"\n    by (meson assms(2) assms(3) assms(4) observable_productF)\n\n  have \"length (vs@xs') = length tr2_1\"\n    using \\<open>length tr2_1 = length (vs @ xs')\\<close> by presburger\n  then have \"length tr2_1 = length tr1_1\" \n    using \\<open>length tr1_1 = length (vs@xs')\\<close> by presburger\n\n  have \"vs@xs' \\<in> L PM\" \n    using productF_path_inclusion[OF \\<open>length (vs@xs') = length tr2_1\\<close> \\<open>length tr2_1 = length tr1_1\\<close> \n                                     \\<open>productF M2 M1 FAIL PM\\<close> \\<open>well_formed M2\\<close> \\<open>well_formed M1\\<close>]\n    by (meson Int_iff \\<open>productF M2 M1 FAIL PM\\<close> \\<open>vs @ xs' \\<in> L M1\\<close> \\<open>vs @ xs' \\<in> L M2\\<close> \\<open>well_formed M1\\<close>\n        \\<open>well_formed M2\\<close> productF_language)\n    \n\n  have \"length (vs') = length tr2_2\"\n    using \\<open>length tr2_2 = length (vs')\\<close> by presburger\n  then have \"length tr2_2 = length tr1_2\" \n    using \\<open>length tr1_2 = length (vs')\\<close> by presburger\n\n  have \"vs' \\<in> L PM\" \n    using productF_path_inclusion[OF \\<open>length (vs') = length tr2_2\\<close> \\<open>length tr2_2 = length tr1_2\\<close> \n                                     \\<open>productF M2 M1 FAIL PM\\<close> \\<open>well_formed M2\\<close> \\<open>well_formed M1\\<close>]\n    by (meson Int_iff \\<open>productF M2 M1 FAIL PM\\<close> \\<open>vs' \\<in> L M1\\<close> \\<open>vs' \\<in> L M2\\<close> \\<open>well_formed M1\\<close> \n        \\<open>well_formed M2\\<close> productF_language)\n\n\n  \n\n  have \"io_targets PM (initial M2, initial M1) (vs @ xs') = {(s2, s1)}\" \n    using productF_path_io_targets_reverse\n          [OF \\<open>productF M2 M1 FAIL PM\\<close> \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs')\\<close> \n              \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs')\\<close> \\<open>vs @ xs' \\<in> L M2\\<close> \\<open>vs @ xs' \\<in> L M1\\<close> ]\n  proof -\n    have \"\\<forall>c f. c \\<noteq> initial (f::('a, 'b, 'c) FSM) \\<or> c \\<in> nodes f\"\n      by blast\n    then show ?thesis\n      by (metis (no_types) \\<open>\\<lbrakk>observable M2; observable M1; well_formed M2; well_formed M1; \n                              initial M2 \\<in> nodes M2; initial M1 \\<in> nodes M1\\<rbrakk> \n                            \\<Longrightarrow> io_targets PM (initial M2, initial M1) (vs @ xs') = {(s2, s1)}\\<close> \n          assms(2) assms(3))\n  qed \n\n  have \"io_targets PM (initial M2, initial M1) (vs') = {(s2, s1)}\" \n    using productF_path_io_targets_reverse\n          [OF \\<open>productF M2 M1 FAIL PM\\<close> \\<open>s2 \\<in> io_targets M2 (initial M2) (vs')\\<close> \n              \\<open>s1 \\<in> io_targets M1 (initial M1) (vs')\\<close> \\<open>vs' \\<in> L M2\\<close> \\<open>vs' \\<in> L M1\\<close> ]\n  proof -\n    have \"\\<forall>c f. c \\<noteq> initial (f::('a, 'b, 'c) FSM) \\<or> c \\<in> nodes f\"\n      by blast\n    then show ?thesis\n      by (metis (no_types) \\<open>\\<lbrakk>observable M2; observable M1; well_formed M2; well_formed M1; \n                              initial M2 \\<in> nodes M2; initial M1 \\<in> nodes M1\\<rbrakk> \n                            \\<Longrightarrow> io_targets PM (initial M2, initial M1) (vs') = {(s2, s1)}\\<close> \n          assms(2) assms(3))\n  qed\n  have \"io_targets PM (initial PM) (vs') = {(s2, s1)}\"\n    by (metis (no_types) \\<open>io_targets PM (initial M2, initial M1) vs' = {(s2, s1)}\\<close> \n        \\<open>productF M2 M1 FAIL PM\\<close> productF_simps(4))\n   \n\n  have \"sequence_to_failure M1 M2 (vs@xs)\" \n    using assms(1) by auto\n\n  have \"xs = xs' @ (drop (length xs') xs)\"\n    by (metis \\<open>prefix xs' xsR\\<close> append_assoc append_eq_conv_conj assms(6) prefixE)\n  then have \"io_targets PM (initial M2, initial M1) (vs @ xs' @ (drop (length xs') xs)) = {FAIL}\"\n    by (metis \\<open>productF M2 M1 FAIL PM\\<close> \\<open>sequence_to_failure M1 M2 (vs @ xs)\\<close> assms(2) assms(3) \n        productF_simps(4) sequence_to_failure_reaches_FAIL_ob)\n  then have \"io_targets PM (initial M2, initial M1) ((vs @ xs') @ (drop (length xs') xs)) = {FAIL}\"    \n    by auto\n  have \"io_targets PM (s2, s1) (drop (length xs') xs) = {FAIL}\" \n    using observable_io_targets_split\n          [OF \\<open>observable PM\\<close> \n              \\<open>io_targets PM (initial M2,initial M1) ((vs @ xs') @ (drop (length xs') xs)) = {FAIL}\\<close> \n              \\<open>io_targets PM (initial M2, initial M1) (vs @ xs') = {(s2, s1)}\\<close>] \n    by assumption\n\n  have \"io_targets PM (initial PM) (vs' @ (drop (length xs') xs)) = {FAIL}\" \n    using observable_io_targets_append\n          [OF \\<open>observable PM\\<close> \\<open>io_targets PM (initial PM) (vs') = {(s2, s1)}\\<close>\n              \\<open>io_targets PM (s2, s1) (drop (length xs') xs) = {FAIL}\\<close>] \n    by assumption\n\n  have \"sequence_to_failure M1 M2 (vs' @ (drop (length xs') xs))\"   \n    using sequence_to_failure_alt_def\n          [OF \\<open>io_targets PM (initial PM) (vs' @ (drop (length xs') xs)) = {FAIL}\\<close> assms(2,3)] \n          assms(4) \n    by blast\n\n  have \"length (drop (length xs') xs) < length xs\"\n    by (metis (no_types) \\<open>xs = xs' @ drop (length xs') xs\\<close> \\<open>xs' \\<noteq> []\\<close> length_append \n        length_greater_0_conv less_add_same_cancel2)   \n\n  have \"vs' \\<in> L\\<^sub>i\\<^sub>n M1 V\" \n  proof -\n    have \"V'' \\<in> Perm V M1\" \n      using assms(5) unfolding N.simps by blast\n\n    then obtain f where f_def : \"V'' = image f V \n                                  \\<and> (\\<forall> v \\<in> V . f v \\<in> language_state_for_input M1 (initial M1) v)\"\n      unfolding Perm.simps by blast\n    then obtain v where \"v \\<in> V\" \"vs' = f v\" \n      using \\<open>vs' \\<in> V''\\<close> by auto\n    then have \"vs' \\<in> language_state_for_input M1 (initial M1) v\" \n      using f_def by auto\n    \n    have \"language_state_for_input M1 (initial M1) v = L\\<^sub>i\\<^sub>n M1 {v}\"\n      by auto\n    moreover have \"{v} \\<subseteq> V\" \n      using \\<open>v \\<in> V\\<close> by blast   \n    ultimately have \"language_state_for_input M1 (initial M1) v \\<subseteq> L\\<^sub>i\\<^sub>n M1 V\"\n      unfolding language_state_for_inputs.simps language_state_for_input.simps by blast\n    then show ?thesis\n      using\\<open>vs' \\<in> language_state_for_input M1 (initial M1) v\\<close> by blast\n  qed\n  \n  have \"\\<not> minimal_sequence_to_failure_extending V M1 M2 vs xs\" \n    using \\<open>vs' \\<in> L\\<^sub>i\\<^sub>n M1 V\\<close>\n          \\<open>sequence_to_failure M1 M2 (vs' @ (drop (length xs') xs))\\<close>\n          \\<open>length (drop (length xs') xs) < length xs\\<close>\n    using minimal_sequence_to_failure_extending.elims(2) by blast \n  then show \"False\" \n    using assms(1) by linarith\nqed\n\n\n\n\nlemma mstfe_no_repetition :\n  assumes \"minimal_sequence_to_failure_extending V M1 M2 vs xs\"\n  and     \"OFSM M1\"\n  and     \"OFSM M2\"\n  and     \"test_tools M2 M1 FAIL PM V \\<Omega>\"\n  and     \"V'' \\<in> N (vs@xs') M1 V\"\n  and     \"prefix xs' xs\"\nshows \"\\<not> Rep_Pre M2 M1 vs xs'\"\n  and \"\\<not> Rep_Cov M2 M1 V'' vs xs'\"\n  using minimal_sequence_to_failure_extending_implies_Rep_Pre[OF assms]\n        minimal_sequence_to_failure_extending_implies_Rep_Cov[OF assms]\n  by linarith+\n\n\nsubsection \\<open> Sufficiency of the test suite to test for reduction \\<close>\n\ntext \\<open>\nThe following lemma proves that set of input sequences generated in the final iteration of the\n@{verbatim TS} function constitutes a test suite sufficient to test for reduction the FSMs it has \nbeen generated for.\n\nThis proof is performed by contradiction: If the test suite is not sufficient, then some minimal\nsequence to a failure extending the deterministic state cover must exist. Due to the test suite\nbeing assumed insufficient, this sequence cannot be contained in it and hence a prefix of it must\nhave been contained in one of the sets calculated by the @{verbatim R} function. This is only \npossible if the prefix is not a minimal sequence to a failure extending the deterministic state \ncover or if the test suite observes a failure, both of which violates the assumptions.\n\\<close>\n\n\nlemma asc_sufficiency :\n  assumes \"OFSM M1\"\n  and     \"OFSM M2\"\n  and     \"asc_fault_domain M2 M1 m\"\n  and     \"test_tools M2 M1 FAIL PM V \\<Omega>\"\n  and     \"final_iteration M2 M1 \\<Omega> V m i\"  \nshows \"M1 \\<preceq>\\<lbrakk>(TS M2 M1 \\<Omega> V m i) . \\<Omega>\\<rbrakk> M2 \\<longrightarrow> M1 \\<preceq> M2\"\nproof \n  assume \"atc_io_reduction_on_sets M1 (TS M2 M1 \\<Omega> V m i) \\<Omega> M2\"\n  show \"M1 \\<preceq> M2\"\n  proof (rule ccontr)\n  \n    let ?TS = \"\\<lambda> n . TS M2 M1 \\<Omega> V m n\"\n    let ?C = \"\\<lambda> n . C M2 M1 \\<Omega> V m n\"\n    let ?RM = \"\\<lambda> n . RM M2 M1 \\<Omega> V m n\"\n  \n  \n    assume \"\\<not> M1 \\<preceq> M2\"\n    obtain vs xs where \"minimal_sequence_to_failure_extending V M1 M2 vs xs\" \n      using  assms(1) assms(2) assms(4) \n             minimal_sequence_to_failure_extending_det_state_cover_ob[OF _ _ _ _ \\<open>\\<not> M1 \\<preceq> M2\\<close>, of V]\n      by blast \n  \n    then have \"vs \\<in> L\\<^sub>i\\<^sub>n M1 V\" \n              \"sequence_to_failure M1 M2 (vs @ xs)\" \n              \"\\<not> (\\<exists> io' . \\<exists> w' \\<in> L\\<^sub>i\\<^sub>n M1 V . sequence_to_failure M1 M2 (w' @ io') \n                                                          \\<and> length io' < length xs)\"\n      by auto\n  \n    then have \"vs@xs \\<in> L M1 - L M2\" \n      by auto\n  \n    have \"vs@xs \\<in> L\\<^sub>i\\<^sub>n M1 {map fst (vs@xs)}\"\n      by (metis (full_types) Diff_iff \\<open>vs @ xs \\<in> L M1 - L M2\\<close> insertI1 \n          language_state_for_inputs_map_fst)\n  \n    have \"vs@xs \\<notin> L\\<^sub>i\\<^sub>n M2 {map fst (vs@xs)}\"\n      by (meson Diff_iff \\<open>vs @ xs \\<in> L M1 - L M2\\<close> language_state_for_inputs_in_language_state \n          subsetCE) \n  \n    have \"finite V\" \n      using det_state_cover_finite assms(4,2) by auto\n    then have \"finite (?TS i)\"\n      using TS_finite[of V M2] assms(2) by auto\n    then have \"io_reduction_on M1 (?TS i) M2\" \n      using io_reduction_from_atc_io_reduction\n            [OF \\<open>atc_io_reduction_on_sets M1 (TS M2 M1 \\<Omega> V m i) \\<Omega> M2\\<close>] \n      by auto\n  \n    have \"map fst (vs@xs) \\<notin> ?TS i\"\n    proof -\n      have f1: \"\\<forall>ps P Pa. (ps::('a \\<times> 'b) list) \\<notin> P - Pa \\<or> ps \\<in> P \\<and> ps \\<notin> Pa\"\n        by blast\n      have \"\\<forall>P Pa ps. \\<not> P \\<subseteq> Pa \\<or> (ps::('a \\<times> 'b) list) \\<in> Pa \\<or> ps \\<notin> P\"\n        by blast\n      then show ?thesis\n        using f1 by (metis (no_types) \\<open>vs @ xs \\<in> L M1 - L M2\\<close> \\<open>io_reduction_on M1 (?TS i) M2\\<close> \n                     language_state_for_inputs_in_language_state language_state_for_inputs_map_fst)\n    qed \n  \n    have \"map fst vs \\<in> V\"\n      using \\<open>vs \\<in> L\\<^sub>i\\<^sub>n M1 V\\<close> by auto \n    \n    let ?stf = \"map fst (vs@xs)\"\n    let ?stfV = \"map fst vs\"\n    let ?stfX = \"map fst xs\"\n    have \"?stf = ?stfV @ ?stfX\"\n      by simp \n  \n    then have \"?stfV @ ?stfX \\<notin> ?TS i\"\n      using \\<open>?stf \\<notin> ?TS i\\<close> by auto \n  \n    have \"mcp (?stfV @ ?stfX) V ?stfV\"\n      by (metis \\<open>map fst (vs @ xs) = map fst vs @ map fst xs\\<close> \n          \\<open>minimal_sequence_to_failure_extending V M1 M2 vs xs\\<close> assms(1) assms(2) assms(4) \n          minimal_sequence_to_failure_extending_mcp)\n  \n    have \"set ?stf \\<subseteq> inputs M1\"\n      by (meson DiffD1 \\<open>vs @ xs \\<in> L M1 - L M2\\<close> assms(1) language_state_inputs) \n    then have \"set ?stf \\<subseteq> inputs M2\"\n      using assms(3) by blast \n    moreover have \"set ?stf = set ?stfV \\<union> set ?stfX\"\n      by simp \n    ultimately have \"set ?stfX \\<subseteq> inputs M2\"\n      by blast \n  \n  \n    obtain xr j where \"xr \\<noteq> ?stfX\" \n                      \"prefix xr ?stfX\" \n                      \"Suc j \\<le> i\" \n                      \"?stfV@xr \\<in> RM M2 M1 \\<Omega> V m (Suc j)\"\n      using TS_non_containment_causes_final_suc[OF \\<open>?stfV @ ?stfX \\<notin> ?TS i\\<close> \n            \\<open>mcp (?stfV @ ?stfX) V ?stfV\\<close> \\<open>set ?stfX \\<subseteq> inputs M2\\<close> assms(5,2)] \n      by blast\n  \n    \n    let ?yr = \"take (length xr) (map snd xs)\"\n    have \"length ?yr = length xr\"\n      using \\<open>prefix xr (map fst xs)\\<close> prefix_length_le by fastforce \n    have \"(xr || ?yr) = take (length xr) xs\"\n      by (metis (no_types, hide_lams) \\<open>prefix xr (map fst xs)\\<close> append_eq_conv_conj prefixE take_zip\n          zip_map_fst_snd) \n  \n    have \"prefix (vs@(xr || ?yr)) (vs@xs)\"\n      by (simp add: \\<open>xr || take (length xr) (map snd xs) = take (length xr) xs\\<close> take_is_prefix)\n  \n    have \"xr = take (length xr) (map fst xs)\"\n      by (metis \\<open>length (take (length xr) (map snd xs)) = length xr\\<close> \n          \\<open>xr || take (length xr) (map snd xs) = take (length xr) xs\\<close> map_fst_zip take_map) \n  \n    have \"vs@(xr || ?yr) \\<in> L M1\"\n      by (metis DiffD1 \\<open>prefix (vs @ (xr || take (length xr) (map snd xs))) (vs @ xs)\\<close> \n          \\<open>vs @ xs \\<in> L M1 - L M2\\<close> language_state_prefix prefixE) \n  \n    then have \"vs@(xr || ?yr) \\<in> L\\<^sub>i\\<^sub>n M1 {?stfV @ xr}\"\n      by (metis \\<open>length (take (length xr) (map snd xs)) = length xr\\<close> insertI1 \n          language_state_for_inputs_map_fst map_append map_fst_zip) \n  \n    have \"length xr < length xs\"\n      by (metis \\<open>xr = take (length xr) (map fst xs)\\<close> \\<open>xr \\<noteq> map fst xs\\<close> not_le_imp_less take_all \n          take_map)\n  \n  \n  \n    from \\<open>?stfV@xr \\<in> RM M2 M1 \\<Omega> V m (Suc j)\\<close> have \"?stfV@xr \\<in> {xs' \\<in> C M2 M1 \\<Omega> V m (Suc j) .\n        (\\<not> (L\\<^sub>i\\<^sub>n M1 {xs'} \\<subseteq> L\\<^sub>i\\<^sub>n M2 {xs'}))\n        \\<or> (\\<forall> io \\<in> L\\<^sub>i\\<^sub>n M1 {xs'} .\n            (\\<exists> V'' \\<in> N io M1 V .  \n              (\\<exists> S1 . \n                (\\<exists> vs xs .\n                  io = (vs@xs)\n                  \\<and> mcp (vs@xs) V'' vs\n                  \\<and> S1 \\<subseteq> nodes M2\n                  \\<and> (\\<forall> s1 \\<in> S1 . \\<forall> s2 \\<in> S1 .\n                    s1 \\<noteq> s2 \\<longrightarrow> \n                      (\\<forall> io1 \\<in> RP M2 s1 vs xs V'' .\n                         \\<forall> io2 \\<in> RP M2 s2 vs xs V'' .\n                           B M1 io1 \\<Omega> \\<noteq> B M1 io2 \\<Omega> ))\n                  \\<and> m < LB M2 M1 vs xs (TS M2 M1 \\<Omega> V m j \\<union> V) S1 \\<Omega> V'' ))))}\" \n      unfolding RM.simps by blast\n  \n    moreover have \"\\<forall> xs' \\<in> ?C (Suc j) . L\\<^sub>i\\<^sub>n M1 {xs'} \\<subseteq> L\\<^sub>i\\<^sub>n M2 {xs'}\"\n    proof \n      fix xs' assume \"xs' \\<in> ?C (Suc j)\"\n      from \\<open>Suc j \\<le> i\\<close> have \"?C (Suc j) \\<subseteq> ?TS i\"\n        using C_subset TS_subset by blast \n      then have \"{xs'} \\<subseteq> ?TS i\" \n        using \\<open>xs' \\<in> ?C (Suc j)\\<close> by blast\n      show \"L\\<^sub>i\\<^sub>n M1 {xs'} \\<subseteq> L\\<^sub>i\\<^sub>n M2 {xs'}\" \n        using io_reduction_on_subset[OF \\<open>io_reduction_on M1 (?TS i) M2\\<close> \\<open>{xs'} \\<subseteq> ?TS i\\<close>] \n        by assumption\n    qed\n  \n    ultimately have \"(\\<forall> io \\<in> L\\<^sub>i\\<^sub>n M1 {?stfV@xr} .\n            (\\<exists> V'' \\<in> N io M1 V .  \n              (\\<exists> S1 . \n                (\\<exists> vs xs .\n                  io = (vs@xs)\n                  \\<and> mcp (vs@xs) V'' vs\n                  \\<and> S1 \\<subseteq> nodes M2\n                  \\<and> (\\<forall> s1 \\<in> S1 . \\<forall> s2 \\<in> S1 .\n                    s1 \\<noteq> s2 \\<longrightarrow> \n                      (\\<forall> io1 \\<in> RP M2 s1 vs xs V'' .\n                         \\<forall> io2 \\<in> RP M2 s2 vs xs V'' .\n                           B M1 io1 \\<Omega> \\<noteq> B M1 io2 \\<Omega> ))\n                  \\<and> m < LB M2 M1 vs xs (TS M2 M1 \\<Omega> V m j \\<union> V) S1 \\<Omega> V'' ))))\"\n      by blast \n  \n    then have \"\n            (\\<exists> V'' \\<in> N (vs@(xr || ?yr)) M1 V .  \n              (\\<exists> S1 . \n                (\\<exists> vs' xs' .\n                  vs@(xr || ?yr) = (vs'@xs')\n                  \\<and> mcp (vs'@xs') V'' vs'\n                  \\<and> S1 \\<subseteq> nodes M2\n                  \\<and> (\\<forall> s1 \\<in> S1 . \\<forall> s2 \\<in> S1 .\n                    s1 \\<noteq> s2 \\<longrightarrow> \n                      (\\<forall> io1 \\<in> RP M2 s1 vs' xs' V'' .\n                         \\<forall> io2 \\<in> RP M2 s2 vs' xs' V'' .\n                           B M1 io1 \\<Omega> \\<noteq> B M1 io2 \\<Omega> ))\n                  \\<and> m < LB M2 M1 vs' xs' (TS M2 M1 \\<Omega> V m j \\<union> V) S1 \\<Omega> V'' )))\"\n      using \\<open>vs@(xr || ?yr) \\<in> L\\<^sub>i\\<^sub>n M1 {?stfV @ xr}\\<close>\n      by blast \n  \n    then obtain V'' S1 vs' xs' where RM_impl :  \n                                     \"V'' \\<in> N (vs@(xr || ?yr)) M1 V\"\n                                     \"vs@(xr || ?yr) = (vs'@xs')\"\n                                     \"mcp (vs'@xs') V'' vs'\"\n                                     \"S1 \\<subseteq> nodes M2\"\n                                     \"(\\<forall> s1 \\<in> S1 . \\<forall> s2 \\<in> S1 .\n                                       s1 \\<noteq> s2 \\<longrightarrow> \n                                          (\\<forall> io1 \\<in> RP M2 s1 vs' xs' V'' .\n                                             \\<forall> io2 \\<in> RP M2 s2 vs' xs' V'' .\n                                               B M1 io1 \\<Omega> \\<noteq> B M1 io2 \\<Omega> ))\"\n                                     \" m < LB M2 M1 vs' xs' (TS M2 M1 \\<Omega> V m j \\<union> V) S1 \\<Omega> V''\"\n      by blast\n  \n   \n    have \"?stfV = mcp' (map fst (vs @ (xr || take (length xr) (map snd xs)))) V\"\n      by (metis (full_types) \\<open>length (take (length xr) (map snd xs)) = length xr\\<close> \n          \\<open>mcp (map fst vs @ map fst xs) V (map fst vs)\\<close> \\<open>prefix xr (map fst xs)\\<close> map_append \n          map_fst_zip mcp'_intro mcp_prefix_of_suffix) \n  \n    have \"is_det_state_cover M2 V\"\n      using assms(4) by blast \n    moreover have \"well_formed M2\" \n      using assms(2) by auto\n    moreover have \"finite V\" \n      using det_state_cover_finite assms(4,2) by auto\n    ultimately have \"vs \\<in> V''\"  \n                    \"vs = mcp' (vs @ (xr || take (length xr) (map snd xs))) V''\"\n      using N_mcp_prefix[OF \\<open>?stfV = mcp' (map fst (vs @ (xr || take (length xr) (map snd xs)))) V\\<close> \n            \\<open>V'' \\<in> N (vs@(xr || ?yr)) M1 V\\<close>, of M2] \n      by simp+\n    \n    have \"vs' = vs\"\n      by (metis (no_types) \\<open>mcp (vs' @ xs') V'' vs'\\<close> \n          \\<open>vs = mcp' (vs @ (xr || take (length xr) (map snd xs))) V''\\<close> \n          \\<open>vs @ (xr || take (length xr) (map snd xs)) = vs' @ xs'\\<close> mcp'_intro)\n     \n    then have \"xs' = (xr || ?yr)\"\n      using \\<open>vs @ (xr || take (length xr) (map snd xs)) = vs' @ xs'\\<close> by blast  \n  \n  \n    have \"V \\<subseteq> ?TS i\"\n    proof -\n      have \"1 \\<le> i\"\n        using \\<open>Suc j \\<le> i\\<close> by linarith\n      then have \"?TS 1 \\<subseteq> ?TS i\"\n        using TS_subset by blast   \n      then show ?thesis \n        by auto\n    qed\n      \n    have \"?stfV@xr \\<in> ?C (Suc j)\" \n      using \\<open>?stfV@xr \\<in> RM M2 M1 \\<Omega> V m (Suc j)\\<close> unfolding RM.simps by blast\n  \n  \n  \n    \\<comment> \\<open>show that the prerequisites (@{verbatim Prereq}) for @{verbatim LB} are met by construction\\<close>\n  \n    have \"(\\<forall>vs'a\\<in>V''. prefix vs'a (vs' @ xs') \\<longrightarrow> length vs'a \\<le> length vs')\"\n      using \\<open>mcp (vs' @ xs') V'' vs'\\<close> by auto\n  \n    moreover have \"atc_io_reduction_on_sets M1 (?TS j \\<union> V) \\<Omega> M2\"   \n    proof -\n      have \"j < i\" \n        using \\<open>Suc j \\<le> i\\<close> by auto\n      then have \"?TS j \\<subseteq> ?TS i\" \n        by (simp add: TS_subset) \n      then show ?thesis \n        using atc_io_reduction_on_subset\n              [OF \\<open>atc_io_reduction_on_sets M1 (TS M2 M1 \\<Omega> V m i) \\<Omega> M2\\<close>, of \"?TS j\"]\n        by (meson Un_subset_iff \\<open>V \\<subseteq> ?TS i\\<close> \\<open>atc_io_reduction_on_sets M1 (TS M2 M1 \\<Omega> V m i) \\<Omega> M2\\<close>\n            atc_io_reduction_on_subset) \n    qed\n  \n    moreover have \"finite (?TS j \\<union> V)\"\n    proof -\n      have \"finite (?TS j)\"\n        using TS_finite[OF \\<open>finite V\\<close>, of M2 M1 \\<Omega> m j] assms(2) by auto \n      then show ?thesis \n        using \\<open>finite V\\<close> by blast\n    qed\n  \n    moreover have \"V \\<subseteq> ?TS j \\<union> V\" \n      by blast\n  \n    moreover have \"(\\<forall> p . (prefix p xs' \\<and> p \\<noteq> xs') \\<longrightarrow> map fst (vs' @ p) \\<in> ?TS j \\<union> V)\"\n    proof \n      fix p \n      show \"prefix p xs' \\<and> p \\<noteq> xs' \\<longrightarrow> map fst (vs' @ p) \\<in> TS M2 M1 \\<Omega> V m j \\<union> V\"\n      proof\n        assume \"prefix p xs' \\<and> p \\<noteq> xs'\"\n  \n        have \"prefix (map fst (vs' @ p)) (map fst (vs' @ xs'))\"\n          by (simp add: \\<open>prefix p xs' \\<and> p \\<noteq> xs'\\<close> map_mono_prefix)\n        have \"prefix (map fst (vs' @ p)) (?stfV @ xr)\"\n          using \\<open>length (take (length xr) (map snd xs)) = length xr\\<close> \n                \\<open>prefix (map fst (vs' @ p)) (map fst (vs' @ xs'))\\<close> \n                \\<open>vs' = vs\\<close> \\<open>xs' = xr || take (length xr) (map snd xs)\\<close> \n          by auto\n        then have \"prefix (map fst vs' @ map fst p) (?stfV @ xr)\"\n          by simp \n        then have \"prefix (map fst p) xr\"\n          by (simp add: \\<open>vs' = vs\\<close>)\n  \n        have \"?stfV @ xr \\<in> ?TS (Suc j)\" \n        proof (cases j)\n          case 0\n          then show ?thesis\n            using \\<open>map fst vs @ xr \\<in> C M2 M1 \\<Omega> V m (Suc j)\\<close> by auto  \n        next\n          case (Suc nat)\n          then show ?thesis\n            using TS.simps(3) \\<open>map fst vs @ xr \\<in> C M2 M1 \\<Omega> V m (Suc j)\\<close> by blast \n        qed\n  \n        have \"mcp (map fst vs @ xr) V (map fst vs)\"\n          using \\<open>mcp (map fst vs @ map fst xs) V (map fst vs)\\<close> \\<open>prefix xr (map fst xs)\\<close> \n                mcp_prefix_of_suffix \n          by blast \n  \n        have \"map fst vs @ map fst p \\<in> TS M2 M1 \\<Omega> V m (Suc j)\"\n          using TS_prefix_containment[OF \\<open>?stfV @ xr \\<in> ?TS (Suc j)\\<close> \n                                         \\<open>mcp (map fst vs @ xr) V (map fst vs)\\<close> \n                                         \\<open>prefix (map fst p) xr\\<close>] \n          by assumption\n   \n  \n        have \"Suc (length xr) = (Suc j)\" \n          using C_index[OF \\<open>?stfV@xr \\<in> ?C (Suc j)\\<close> \\<open>mcp (map fst vs @ xr) V (map fst vs)\\<close>] \n          by assumption\n        \n        have\"Suc (length p) < (Suc j)\"\n        proof -\n          have \"map fst xs' = xr\"\n            by (metis \\<open>xr = take (length xr) (map fst xs)\\<close> \n                \\<open>xr || take (length xr) (map snd xs) = take (length xr) xs\\<close> \n                \\<open>xs' = xr || take (length xr) (map snd xs)\\<close> take_map)\n          then show ?thesis\n            by (metis (no_types) Suc_less_eq \\<open>Suc (length xr) = Suc j\\<close> \\<open>prefix p xs' \\<and> p \\<noteq> xs'\\<close> \n                append_eq_conv_conj length_map nat_less_le prefixE prefix_length_le take_all)\n        qed\n  \n        have \"mcp (map fst vs @ map fst p) V (map fst vs)\"\n          using \\<open>mcp (map fst vs @ xr) V (map fst vs)\\<close> \\<open>prefix (map fst p) xr\\<close> mcp_prefix_of_suffix \n          by blast \n  \n        then have \"map fst vs @ map fst p \\<in> ?C (Suc (length (map fst p)))\" \n          using TS_index(2)[OF \\<open>map fst vs @ map fst p \\<in> TS M2 M1 \\<Omega> V m (Suc j)\\<close>] by auto\n  \n        have \"map fst vs @ map fst p \\<in> ?TS j\"\n          using TS_union[of M2 M1 \\<Omega> V m j]\n        proof -\n          have \"Suc (length p) \\<in> {0..<Suc j}\"\n            using \\<open>Suc (length p) < Suc j\\<close> by force\n          then show ?thesis\n            by (metis UN_I \\<open>TS M2 M1 \\<Omega> V m j = (\\<Union>j\\<in>set [0..<Suc j]. C M2 M1 \\<Omega> V m j)\\<close> \n                \\<open>map fst vs @ map fst p \\<in> C M2 M1 \\<Omega> V m (Suc (length (map fst p)))\\<close> \n                length_map set_upt)\n        qed \n  \n        then show \"map fst (vs' @ p) \\<in> TS M2 M1 \\<Omega> V m j \\<union> V\"\n          by (simp add: \\<open>vs' = vs\\<close>) \n      qed\n    qed\n  \n    \n    moreover have \"vs' @ xs' \\<in> L M2 \\<inter> L M1\"\n      by (metis (no_types, lifting) IntI RM_impl(2) \n          \\<open>\\<forall>xs'\\<in>C M2 M1 \\<Omega> V m (Suc j). L\\<^sub>i\\<^sub>n M1 {xs'} \\<subseteq> L\\<^sub>i\\<^sub>n M2 {xs'}\\<close> \n          \\<open>map fst vs @ xr \\<in> C M2 M1 \\<Omega> V m (Suc j)\\<close> \n          \\<open>vs @ (xr || take (length xr) (map snd xs)) \\<in> L\\<^sub>i\\<^sub>n M1 {map fst vs @ xr}\\<close> \n          language_state_for_inputs_in_language_state subsetCE)\n      \n          \n    \n    ultimately have \"Prereq M2 M1 vs' xs' (?TS j \\<union> V) S1 \\<Omega> V''\"\n      using RM_impl(4,5) unfolding Prereq.simps by blast\n  \n    have \"V'' \\<in> Perm V M1\"\n      using \\<open>V'' \\<in> N (vs@(xr || ?yr)) M1 V\\<close> unfolding N.simps by blast\n  \n    have \\<open>prefix (xr || ?yr) xs\\<close>\n      by (simp add: \\<open>xr || take (length xr) (map snd xs) = take (length xr) xs\\<close> take_is_prefix)\n  \n  \n    \\<comment> \\<open> show that furthermore neither @{verbatim Rep_Pre} nor @{verbatim Rep_Cov} holds \\<close>\n\n    have \"\\<not> Rep_Pre M2 M1 vs (xr || ?yr)\"\n      using minimal_sequence_to_failure_extending_implies_Rep_Pre\n            [OF \\<open>minimal_sequence_to_failure_extending V M1 M2 vs xs\\<close> assms(1,2) \n                \\<open>test_tools M2 M1 FAIL PM V \\<Omega>\\<close> RM_impl(1) \n                \\<open>prefix (xr || take (length xr) (map snd xs)) xs\\<close>]\n      by assumption\n    then have \"\\<not> Rep_Pre M2 M1 vs' xs'\"\n      using \\<open>vs' = vs\\<close> \\<open>xs' = xr || ?yr\\<close> by blast \n  \n    have \"\\<not> Rep_Cov M2 M1 V'' vs (xr || ?yr)\" \n      using minimal_sequence_to_failure_extending_implies_Rep_Cov\n            [OF \\<open>minimal_sequence_to_failure_extending V M1 M2 vs xs\\<close> assms(1,2) \n                \\<open>test_tools M2 M1 FAIL PM V \\<Omega>\\<close> RM_impl(1) \n                \\<open>prefix (xr || take (length xr) (map snd xs)) xs\\<close>]\n      by assumption\n    then have \"\\<not> Rep_Cov M2 M1 V'' vs' xs'\"\n      using \\<open>vs' = vs\\<close> \\<open>xs' = xr || ?yr\\<close> by blast \n  \n    have \"vs'@xs' \\<in> L M1\"\n      using \\<open>vs @ (xr || take (length xr) (map snd xs)) \\<in> L M1\\<close> \n            \\<open>vs' = vs\\<close> \\<open>xs' = xr || take (length xr) (map snd xs)\\<close> \n      by blast \n    \n  \n    \\<comment> \\<open> therefore it is impossible to remove the prefix of the minimal sequence to a failure,\n         as this would require @{verbatim M1} to have more than m states \\<close>\n    \n    have \"LB M2 M1 vs' xs' (?TS j \\<union> V) S1 \\<Omega> V'' \\<le> card (nodes M1)\"\n      using LB_count[OF \\<open>vs'@xs' \\<in> L M1\\<close> assms(1,2,3) \\<open>test_tools M2 M1 FAIL PM V \\<Omega>\\<close> \n                        \\<open>V'' \\<in> Perm V M1\\<close> \\<open>Prereq M2 M1 vs' xs' (?TS j \\<union> V) S1 \\<Omega> V''\\<close> \n                        \\<open>\\<not> Rep_Pre M2 M1 vs' xs'\\<close> \\<open> \\<not> Rep_Cov M2 M1 V'' vs' xs'\\<close>]\n      by assumption\n    then have \"LB M2 M1 vs' xs' (?TS j \\<union> V) S1 \\<Omega> V'' \\<le> m\" \n      using assms(3) by linarith\n  \n    then show \"False\" \n      using \\<open>m < LB M2 M1 vs' xs' (?TS j \\<union> V) S1 \\<Omega> V''\\<close> by linarith\n  qed\nqed\n\n\n\n\nsubsection \\<open> Main result \\<close>\n\ntext \\<open>\nThe following lemmata add to the previous result to show that some FSM @{verbatim M1} is a reduction \nof FSM @{verbatim M2} if and only if it is a reduction on the test suite generated by the adaptive \nstate counting algorithm for these FSMs.\n\\<close>\n\nlemma asc_soundness :\n  assumes     \"OFSM M1\"\n  and         \"OFSM M2\"\nshows \"M1 \\<preceq> M2 \\<longrightarrow> atc_io_reduction_on_sets M1 T \\<Omega> M2\"\n  using atc_io_reduction_on_sets_reduction assms by blast\n\n\n\nlemma asc_main_theorem :\n  assumes \"OFSM M1\"\n  and     \"OFSM M2\"\n  and     \"asc_fault_domain M2 M1 m\"\n  and     \"test_tools M2 M1 FAIL PM V \\<Omega>\"\n  and     \"final_iteration M2 M1 \\<Omega> V m i\"\nshows     \"M1 \\<preceq> M2 \\<longleftrightarrow> atc_io_reduction_on_sets M1 (TS M2 M1 \\<Omega> V m i) \\<Omega> M2\"\nby (metis asc_sufficiency assms(1-5) atc_io_reduction_on_sets_reduction)\n\n\n\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Adaptive_State_Counting/ASC/ASC_Sufficiency.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6825737473266735, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.34661904713800074}}
{"text": "(*  Title:       Given Clause Prover Architectures\n *  Author:      Sophie Tourret <stourret at mpi-inf.mpg.de>, 2019-2020 *)\n\nsection \\<open>Given Clause Prover Architectures\\<close>\n\ntext \\<open>This section covers all the results presented in the section 4 of the report.\n  This is where abstract architectures of provers are defined and proven\n  dynamically refutationally complete.\\<close>\n\ntheory Given_Clause_Architectures\n  imports\n    Lambda_Free_RPOs.Lambda_Free_Util\n    Labeled_Lifting_to_Non_Ground_Calculi\nbegin\n\n\nsubsection \\<open>Basis of the Given Clause Prover Architectures\\<close>\n\nlocale given_clause_basis = std?: labeled_lifting_intersection Bot_F Inf_F Bot_G Q\n  entails_q Inf_G_q Red_I_q Red_F_q \\<G>_F_q \\<G>_I_q\n  \"{\\<iota>\\<^sub>F\\<^sub>L :: ('f \\<times> 'l) inference. Infer (map fst (prems_of \\<iota>\\<^sub>F\\<^sub>L)) (fst (concl_of \\<iota>\\<^sub>F\\<^sub>L)) \\<in> Inf_F}\"\n  for\n    Bot_F :: \"'f set\"\n    and Inf_F :: \"'f inference set\"\n    and Bot_G :: \"'g set\"\n    and Q :: \"'q set\"\n    and entails_q :: \"'q \\<Rightarrow> 'g set \\<Rightarrow> 'g set \\<Rightarrow> bool\"\n    and Inf_G_q :: \\<open>'q \\<Rightarrow> 'g inference set\\<close>\n    and Red_I_q :: \"'q \\<Rightarrow> 'g set \\<Rightarrow> 'g inference set\"\n    and Red_F_q :: \"'q \\<Rightarrow> 'g set \\<Rightarrow> 'g set\"\n    and \\<G>_F_q :: \"'q \\<Rightarrow> 'f \\<Rightarrow> 'g set\"\n    and \\<G>_I_q :: \"'q \\<Rightarrow> 'f inference \\<Rightarrow> 'g inference set option\"\n  + fixes\n    Equiv_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<doteq>\" 50) and\n    Prec_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<prec>\\<cdot>\" 50) and\n    Prec_L :: \"'l \\<Rightarrow> 'l \\<Rightarrow> bool\" (infix \"\\<sqsubset>L\" 50) and\n    active :: \"'l\"\n  assumes\n    equiv_equiv_F: \"equivp (\\<doteq>)\" and\n    wf_prec_F: \"minimal_element (\\<prec>\\<cdot>) UNIV\" and\n    wf_prec_L: \"minimal_element (\\<sqsubset>L) UNIV\" and\n    compat_equiv_prec: \"C1 \\<doteq> D1 \\<Longrightarrow> C2 \\<doteq> D2 \\<Longrightarrow> C1 \\<prec>\\<cdot> C2 \\<Longrightarrow> D1 \\<prec>\\<cdot> D2\" and\n    equiv_F_grounding: \"q \\<in> Q \\<Longrightarrow> C1 \\<doteq> C2 \\<Longrightarrow> \\<G>_F_q q C1 \\<subseteq> \\<G>_F_q q C2\" and\n    prec_F_grounding: \"q \\<in> Q \\<Longrightarrow> C2 \\<prec>\\<cdot> C1 \\<Longrightarrow> \\<G>_F_q q C1 \\<subseteq> \\<G>_F_q q C2\" and\n    active_minimal: \"l2 \\<noteq> active \\<Longrightarrow> active \\<sqsubset>L l2\" and\n    at_least_two_labels: \"\\<exists>l2. active \\<sqsubset>L l2\" and\n    static_ref_comp: \"statically_complete_calculus Bot_F Inf_F (\\<Turnstile>\\<inter>\\<G>)\n      no_labels.Red_I_\\<G> no_labels.Red_F_\\<G>_empty\"\nbegin\n\nabbreviation Inf_FL :: \"('f \\<times> 'l) inference set\" where\n  \"Inf_FL \\<equiv> {\\<iota>\\<^sub>F\\<^sub>L. Infer (map fst (prems_of \\<iota>\\<^sub>F\\<^sub>L)) (fst (concl_of \\<iota>\\<^sub>F\\<^sub>L)) \\<in> Inf_F}\"\n\nabbreviation Prec_eq_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<preceq>\\<cdot>\" 50) where\n  \"C \\<preceq>\\<cdot> D \\<equiv> C \\<doteq> D \\<or> C \\<prec>\\<cdot> D\"\n\ndefinition Prec_FL :: \"('f \\<times> 'l) \\<Rightarrow> ('f \\<times> 'l) \\<Rightarrow> bool\" (infix \"\\<sqsubset>\" 50) where\n  \"Cl1 \\<sqsubset> Cl2 \\<longleftrightarrow> fst Cl1 \\<prec>\\<cdot> fst Cl2 \\<or> (fst Cl1 \\<doteq> fst Cl2 \\<and> snd Cl1 \\<sqsubset>L snd Cl2)\"\n\nlemma irrefl_prec_F: \"\\<not> C \\<prec>\\<cdot> C\"\n  by (simp add: minimal_element.po[OF wf_prec_F, unfolded po_on_def irreflp_on_def])\n\nlemma trans_prec_F: \"C1 \\<prec>\\<cdot> C2 \\<Longrightarrow> C2 \\<prec>\\<cdot> C3 \\<Longrightarrow> C1 \\<prec>\\<cdot> C3\"\n  by (auto intro: minimal_element.po[OF wf_prec_F, unfolded po_on_def transp_on_def, THEN conjunct2,\n        simplified, rule_format])\n\nlemma wf_prec_FL: \"minimal_element (\\<sqsubset>) UNIV\"\nproof\n  show \"po_on (\\<sqsubset>) UNIV\" unfolding po_on_def\n  proof\n    show \"irreflp (\\<sqsubset>)\" unfolding irreflp_on_def Prec_FL_def\n    proof\n      fix Cl\n      assume a_in: \"Cl \\<in> (UNIV::('f \\<times> 'l) set)\"\n      have \"\\<not> (fst Cl \\<prec>\\<cdot> fst Cl)\" using wf_prec_F minimal_element.min_elt_ex by force\n      moreover have \"\\<not> (snd Cl \\<sqsubset>L snd Cl)\" using wf_prec_L minimal_element.min_elt_ex by force\n      ultimately show \"\\<not> (fst Cl \\<prec>\\<cdot> fst Cl \\<or> fst Cl \\<doteq> fst Cl \\<and> snd Cl \\<sqsubset>L snd Cl)\" by blast\n    qed\n  next\n    show \"transp (\\<sqsubset>)\" unfolding Prec_FL_def\n    proof (rule transpI)\n      fix Cl1 Cl2 Cl3\n      assume trans_hyps:\n        \"(fst Cl1 \\<prec>\\<cdot> fst Cl2 \\<or> fst Cl1 \\<doteq> fst Cl2 \\<and> snd Cl1 \\<sqsubset>L snd Cl2)\"\n        \"(fst Cl2 \\<prec>\\<cdot> fst Cl3 \\<or> fst Cl2 \\<doteq> fst Cl3 \\<and> snd Cl2 \\<sqsubset>L snd Cl3)\"\n      have \"fst Cl1 \\<prec>\\<cdot> fst Cl2 \\<Longrightarrow> fst Cl2 \\<doteq> fst Cl3 \\<Longrightarrow> fst Cl1 \\<prec>\\<cdot> fst Cl3\"\n        using compat_equiv_prec by (metis equiv_equiv_F equivp_def)\n      moreover have \"fst Cl1 \\<doteq> fst Cl2 \\<Longrightarrow> fst Cl2 \\<prec>\\<cdot> fst Cl3 \\<Longrightarrow> fst Cl1 \\<prec>\\<cdot> fst Cl3\"\n        using compat_equiv_prec by (metis equiv_equiv_F equivp_def)\n      moreover have \"snd Cl1 \\<sqsubset>L snd Cl2 \\<Longrightarrow> snd Cl2 \\<sqsubset>L snd Cl3 \\<Longrightarrow> snd Cl1 \\<sqsubset>L snd Cl3\"\n        using wf_prec_L unfolding minimal_element_def po_on_def transp_def by (meson UNIV_I)\n      moreover have \"fst Cl1 \\<doteq> fst Cl2 \\<Longrightarrow> fst Cl2 \\<doteq> fst Cl3 \\<Longrightarrow> fst Cl1 \\<doteq> fst Cl3\"\n        using equiv_equiv_F by (meson equivp_transp)\n      ultimately show \"fst Cl1 \\<prec>\\<cdot> fst Cl3 \\<or> fst Cl1 \\<doteq> fst Cl3 \\<and> snd Cl1 \\<sqsubset>L snd Cl3\"\n        using trans_hyps trans_prec_F by blast\n    qed\n  qed\nnext\n  show \"wfp_on (\\<sqsubset>) UNIV\" unfolding wfp_on_def\n  proof\n    assume contra: \"\\<exists>f. \\<forall>i. f i \\<in> UNIV \\<and> f (Suc i) \\<sqsubset> f i\"\n    then obtain f where\n      f_suc: \"\\<forall>i. f (Suc i) \\<sqsubset> f i\"\n      by blast\n\n    define R :: \"(('f \\<times> 'l) \\<times> ('f \\<times> 'l)) set\" where\n      \"R = {(Cl1, Cl2). fst Cl1 \\<prec>\\<cdot> fst Cl2}\"\n    define S :: \"(('f \\<times> 'l) \\<times> ('f \\<times> 'l)) set\" where\n      \"S = {(Cl1, Cl2). fst Cl1 \\<doteq> fst Cl2 \\<and> snd Cl1 \\<sqsubset>L snd Cl2}\"\n\n    obtain k where\n      f_chain: \"\\<forall>i. (f (Suc (i + k)), f (i + k)) \\<in> S\"\n    proof (atomize_elim, rule wf_infinite_down_chain_compatible[of R f S])\n      show \"wf R\"\n        unfolding R_def using wf_app[OF wf_prec_F[unfolded minimal_element_def, THEN conjunct2,\n              unfolded wfp_on_UNIV wfP_def]]\n        by force\n    next\n      show \"\\<forall>i. (f (Suc i), f i) \\<in> R \\<union> S\"\n        using f_suc unfolding R_def S_def Prec_FL_def by blast\n    next\n      show \"R O S \\<subseteq> R\"\n        unfolding R_def S_def using compat_equiv_prec equiv_equiv_F equivp_reflp by fastforce\n    qed\n\n    define g where\n      \"\\<And>i. g i = f (i + k)\"\n\n    have g_chain: \"\\<forall>i. (g (Suc i), g i) \\<in> S\"\n      unfolding g_def using f_chain by simp\n    have wf_s: \"wf S\"\n      unfolding S_def\n      by (rule wf_subset[OF wf_app[OF wf_prec_L[unfolded minimal_element_def, THEN conjunct2,\n                unfolded wfp_on_UNIV wfP_def], of snd]])\n        fast\n    show False\n      using g_chain[unfolded S_def]\n        wf_s[unfolded S_def, folded wfP_def wfp_on_UNIV, unfolded wfp_on_def]\n      by auto\n  qed\nqed\n\ndefinition active_subset :: \"('f \\<times> 'l) set \\<Rightarrow> ('f \\<times> 'l) set\" where\n  \"active_subset M = {CL \\<in> M. snd CL = active}\"\n\ndefinition passive_subset :: \"('f \\<times> 'l) set \\<Rightarrow> ('f \\<times> 'l) set\" where\n  \"passive_subset M = {CL \\<in> M. snd CL \\<noteq> active}\"\n\nlemma active_subset_insert[simp]:\n  \"active_subset (insert Cl N) = (if snd Cl = active then {Cl} else {}) \\<union> active_subset N\"\n  unfolding active_subset_def by auto\n\nlemma active_subset_union[simp]: \"active_subset (M \\<union> N) = active_subset M \\<union> active_subset N\"\n  unfolding active_subset_def by auto\n\nlemma passive_subset_insert[simp]:\n  \"passive_subset (insert Cl N) = (if snd Cl \\<noteq> active then {Cl} else {}) \\<union> passive_subset N\"\n  unfolding passive_subset_def by auto\n\nlemma passive_subset_union[simp]: \"passive_subset (M \\<union> N) = passive_subset M \\<union> passive_subset N\"\n  unfolding passive_subset_def by auto\n\nsublocale std?: statically_complete_calculus Bot_FL Inf_FL \"(\\<Turnstile>\\<inter>\\<G>L)\" Red_I Red_F\n  using labeled_static_ref[OF static_ref_comp] .\n\nlemma labeled_tiebreaker_lifting:\n  assumes q_in: \"q \\<in> Q\"\n  shows \"tiebreaker_lifting Bot_FL Inf_FL Bot_G (entails_q q) (Inf_G_q q)\n    (Red_I_q q) (Red_F_q q) (\\<G>_F_L_q q) (\\<G>_I_L_q q) (\\<lambda>g. Prec_FL)\"\nproof -\n  have \"tiebreaker_lifting Bot_FL Inf_FL Bot_G (entails_q q) (Inf_G_q q)\n    (Red_I_q q) (Red_F_q q) (\\<G>_F_L_q q) (\\<G>_I_L_q q) (\\<lambda>g Cl Cl'. False)\"\n    using ord_fam_lifted_q[OF q_in] .\n  then have \"standard_lifting Inf_FL Bot_G (Inf_G_q q) (entails_q q) (Red_I_q q)\n    (Red_F_q q) Bot_FL (\\<G>_F_L_q q) (\\<G>_I_L_q q)\"\n    using lifted_q[OF q_in] by blast\n  then show \"tiebreaker_lifting Bot_FL Inf_FL Bot_G (entails_q q) (Inf_G_q q)\n    (Red_I_q q) (Red_F_q q) (\\<G>_F_L_q q) (\\<G>_I_L_q q) (\\<lambda>g. Prec_FL)\"\n    using wf_prec_FL by (simp add: tiebreaker_lifting.intro tiebreaker_lifting_axioms.intro)\nqed\n\nsublocale lifting_intersection Inf_FL Bot_G Q Inf_G_q entails_q Red_I_q Red_F_q\n  Bot_FL \\<G>_F_L_q \\<G>_I_L_q \"\\<lambda>g. Prec_FL\"\n  using labeled_tiebreaker_lifting unfolding lifting_intersection_def\n  by (simp add: lifting_intersection_axioms.intro\n      no_labels.ground.consequence_relation_family_axioms\n      no_labels.ground.inference_system_family_axioms)\n\nnotation derive (infix \"\\<rhd>L\" 50)\n\nlemma std_Red_I_eq: \"std.Red_I = Red_I_\\<G>\"\n  unfolding Red_I_\\<G>_q_def Red_I_\\<G>_L_q_def by simp\n\nlemma std_Red_F_eq: \"std.Red_F = Red_F_\\<G>_empty\"\n  unfolding Red_F_\\<G>_empty_q_def Red_F_\\<G>_empty_L_q_def by simp\n\nsublocale statically_complete_calculus Bot_FL Inf_FL \"(\\<Turnstile>\\<inter>\\<G>L)\" Red_I Red_F\n  by unfold_locales (use statically_complete std_Red_I_eq in auto)\n\n(* lem:redundant-labeled-inferences *)\nlemma labeled_red_inf_eq_red_inf:\n  assumes i_in: \"\\<iota> \\<in> Inf_FL\"\n  shows \"\\<iota> \\<in> Red_I N \\<longleftrightarrow> to_F \\<iota> \\<in> no_labels.Red_I_\\<G> (fst ` N)\"\nproof\n  assume i_in2: \"\\<iota> \\<in> Red_I N\"\n  then have \"X \\<in> Red_I_\\<G>_q ` Q \\<Longrightarrow> \\<iota> \\<in> X N\" for X\n    unfolding Red_I_def by blast\n  obtain X0 where \"X0 \\<in> Red_I_\\<G>_q ` Q\"\n    using Q_nonempty by blast\n  then obtain q0 where x0_is: \"X0 N = Red_I_\\<G>_q q0 N\" by blast\n  then obtain Y0 where y0_is: \"Y0 (fst ` N) = to_F ` (X0 N)\" by auto\n  have \"Y0 (fst ` N) = no_labels.Red_I_\\<G>_q q0 (fst ` N)\"\n    unfolding  y0_is\n  proof\n    show \"to_F ` X0 N \\<subseteq> no_labels.Red_I_\\<G>_q q0 (fst ` N)\"\n    proof\n      fix \\<iota>0\n      assume i0_in: \"\\<iota>0 \\<in> to_F ` X0 N\"\n      then have i0_in2: \"\\<iota>0 \\<in> to_F ` Red_I_\\<G>_q q0 N\"\n        using x0_is by argo\n      then obtain \\<iota>0_FL where i0_FL_in: \"\\<iota>0_FL \\<in> Inf_FL\" and i0_to_i0_FL: \"\\<iota>0 = to_F \\<iota>0_FL\" and\n        subs1: \"((\\<G>_I_L_q q0 \\<iota>0_FL) \\<noteq> None \\<and>\n            the (\\<G>_I_L_q q0 \\<iota>0_FL) \\<subseteq> Red_I_q q0 (\\<G>_Fset_q q0 N))\n            \\<or> ((\\<G>_I_L_q q0 \\<iota>0_FL = None) \\<and>\n            \\<G>_F_L_q q0 (concl_of \\<iota>0_FL) \\<subseteq> \\<G>_Fset_q q0 N \\<union> Red_F_q q0 (\\<G>_Fset_q q0 N))\"\n        unfolding Red_I_\\<G>_q_def by blast\n      have concl_swap: \"fst (concl_of \\<iota>0_FL) = concl_of \\<iota>0\"\n        unfolding concl_of_def i0_to_i0_FL to_F_def by simp\n      have i0_in3: \"\\<iota>0 \\<in> Inf_F\"\n        using i0_to_i0_FL Inf_FL_to_Inf_F[OF i0_FL_in] unfolding to_F_def by blast\n      {\n        assume\n          not_none: \"\\<G>_I_q q0 \\<iota>0 \\<noteq> None\" and\n          \"the (\\<G>_I_q q0 \\<iota>0) \\<noteq> {}\"\n        then obtain \\<iota>1 where i1_in: \"\\<iota>1 \\<in> the (\\<G>_I_q q0 \\<iota>0)\" by blast\n        have \"the (\\<G>_I_q q0 \\<iota>0) \\<subseteq> Red_I_q q0 (no_labels.\\<G>_Fset_q q0 (fst ` N))\"\n          using subs1 i0_to_i0_FL not_none by auto\n      }\n      moreover {\n        assume\n          is_none: \"\\<G>_I_q q0 \\<iota>0 = None\"\n        then have \"\\<G>_F_q q0 (concl_of \\<iota>0) \\<subseteq> no_labels.\\<G>_Fset_q q0 (fst ` N)\n            \\<union> Red_F_q q0 (no_labels.\\<G>_Fset_q q0 (fst ` N))\"\n          using subs1 i0_to_i0_FL concl_swap by simp\n      }\n      ultimately show \"\\<iota>0 \\<in> no_labels.Red_I_\\<G>_q q0 (fst ` N)\"\n        unfolding no_labels.Red_I_\\<G>_q_def using i0_in3 by auto\n    qed\n  next\n    show \"no_labels.Red_I_\\<G>_q q0 (fst ` N) \\<subseteq> to_F ` X0 N\"\n    proof\n      fix \\<iota>0\n      assume i0_in: \"\\<iota>0 \\<in> no_labels.Red_I_\\<G>_q q0 (fst ` N)\"\n      then have i0_in2: \"\\<iota>0 \\<in> Inf_F\"\n        unfolding no_labels.Red_I_\\<G>_q_def by blast\n      obtain \\<iota>0_FL where i0_FL_in: \"\\<iota>0_FL \\<in> Inf_FL\" and i0_to_i0_FL: \"\\<iota>0 = to_F \\<iota>0_FL\"\n        using Inf_F_to_Inf_FL[OF i0_in2] unfolding to_F_def\n        by (smt (verit) Ex_list_of_length fst_conv inference.exhaust_sel inference.sel(1)\n            inference.sel(2) map_fst_zip)\n      have concl_swap: \"fst (concl_of \\<iota>0_FL) = concl_of \\<iota>0\"\n        unfolding concl_of_def i0_to_i0_FL to_F_def by simp\n      have subs1: \"((\\<G>_I_L_q q0 \\<iota>0_FL) \\<noteq> None \\<and>\n           the (\\<G>_I_L_q q0 \\<iota>0_FL) \\<subseteq> Red_I_q q0 (\\<G>_Fset_q q0 N))\n           \\<or> ((\\<G>_I_L_q q0 \\<iota>0_FL = None) \\<and>\n           \\<G>_F_L_q q0 (concl_of \\<iota>0_FL) \\<subseteq> (\\<G>_Fset_q q0 N \\<union> Red_F_q q0 (\\<G>_Fset_q q0 N)))\"\n        using i0_in i0_to_i0_FL concl_swap unfolding no_labels.Red_I_\\<G>_q_def by simp\n      then have \"\\<iota>0_FL \\<in> Red_I_\\<G>_q q0 N\"\n        using i0_FL_in unfolding Red_I_\\<G>_q_def by simp\n      then show \"\\<iota>0 \\<in> to_F ` X0 N\"\n        using x0_is i0_to_i0_FL i0_in2 by blast\n    qed\n  qed\n  then have \"Y \\<in> no_labels.Red_I_\\<G>_q ` Q \\<Longrightarrow> to_F \\<iota> \\<in> Y (fst ` N)\" for Y\n    using i_in2 no_labels.Red_I_def std_Red_I_eq red_inf_impl by force\n  then show \"to_F \\<iota> \\<in> no_labels.Red_I_\\<G> (fst ` N)\"\n    unfolding Red_I_def no_labels.Red_I_\\<G>_def by blast\nnext\n  assume to_F_in: \"to_F \\<iota> \\<in> no_labels.Red_I_\\<G> (fst ` N)\"\n  have imp_to_F: \"X \\<in> no_labels.Red_I_\\<G>_q ` Q \\<Longrightarrow> to_F \\<iota> \\<in> X (fst ` N)\" for X\n    using to_F_in unfolding no_labels.Red_I_\\<G>_def by blast\n  then have to_F_in2: \"to_F \\<iota> \\<in> no_labels.Red_I_\\<G>_q q (fst ` N)\" if \"q \\<in> Q\" for q\n    using that by auto\n  have \"Red_I_\\<G>_q q N = {\\<iota>0_FL \\<in> Inf_FL. to_F \\<iota>0_FL \\<in> no_labels.Red_I_\\<G>_q q (fst ` N)}\" for q\n  proof\n    show \"Red_I_\\<G>_q q N \\<subseteq> {\\<iota>0_FL \\<in> Inf_FL. to_F \\<iota>0_FL \\<in> no_labels.Red_I_\\<G>_q q (fst ` N)}\"\n    proof\n      fix q0 \\<iota>1\n      assume\n        i1_in: \"\\<iota>1 \\<in> Red_I_\\<G>_q q0 N\"\n      have i1_in2: \"\\<iota>1 \\<in> Inf_FL\"\n        using i1_in unfolding Red_I_\\<G>_q_def by blast\n      then have to_F_i1_in: \"to_F \\<iota>1 \\<in> Inf_F\"\n        using Inf_FL_to_Inf_F unfolding to_F_def by blast\n      have concl_swap: \"fst (concl_of \\<iota>1) = concl_of (to_F \\<iota>1)\"\n        unfolding concl_of_def to_F_def by simp\n      then have i1_to_F_in: \"to_F \\<iota>1 \\<in> no_labels.Red_I_\\<G>_q q0 (fst ` N)\"\n        using i1_in to_F_i1_in unfolding Red_I_\\<G>_q_def no_labels.Red_I_\\<G>_q_def by force\n      show \"\\<iota>1 \\<in> {\\<iota>0_FL \\<in> Inf_FL. to_F \\<iota>0_FL \\<in> no_labels.Red_I_\\<G>_q q0 (fst ` N)}\"\n        using i1_in2 i1_to_F_in by blast\n    qed\n  next\n    show \"{\\<iota>0_FL \\<in> Inf_FL. to_F \\<iota>0_FL \\<in> no_labels.Red_I_\\<G>_q q (fst ` N)} \\<subseteq> Red_I_\\<G>_q q N\"\n    proof\n      fix q0 \\<iota>1\n      assume\n        i1_in: \"\\<iota>1 \\<in> {\\<iota>0_FL \\<in> Inf_FL. to_F \\<iota>0_FL \\<in> no_labels.Red_I_\\<G>_q q0 (fst ` N)}\"\n      then have i1_in2: \"\\<iota>1 \\<in> Inf_FL\" by blast\n      then have to_F_i1_in: \"to_F \\<iota>1 \\<in> Inf_F\"\n        using Inf_FL_to_Inf_F unfolding to_F_def by blast\n      have concl_swap: \"fst (concl_of \\<iota>1) = concl_of (to_F \\<iota>1)\"\n        unfolding concl_of_def to_F_def by simp\n      then have \"((\\<G>_I_L_q q0 \\<iota>1) \\<noteq> None \\<and> the (\\<G>_I_L_q q0 \\<iota>1) \\<subseteq> Red_I_q q0 (\\<G>_Fset_q q0 N))\n        \\<or> (\\<G>_I_L_q q0 \\<iota>1 = None \\<and>\n          \\<G>_F_L_q q0 (concl_of \\<iota>1) \\<subseteq> \\<G>_Fset_q q0 N \\<union> Red_F_q q0 (\\<G>_Fset_q q0 N))\"\n        using i1_in unfolding no_labels.Red_I_\\<G>_q_def by auto\n      then show \"\\<iota>1 \\<in> Red_I_\\<G>_q q0 N\"\n        using i1_in2 unfolding Red_I_\\<G>_q_def by blast\n    qed\n  qed\n  then have \"\\<iota> \\<in> Red_I_\\<G>_q q N\" if \"q \\<in> Q\" for q\n    using that to_F_in2 i_in unfolding Red_I_\\<G>_q_def no_labels.Red_I_\\<G>_q_def by auto\n  then show \"\\<iota> \\<in> Red_I_\\<G> N\"\n    unfolding Red_I_\\<G>_def by blast\nqed\n\n(* lem:redundant-labeled-formulas *)\nlemma red_labeled_clauses:\n  assumes \\<open>C \\<in> no_labels.Red_F_\\<G>_empty (fst ` N) \\<or>\n    (\\<exists>C' \\<in> fst ` N. C' \\<prec>\\<cdot> C) \\<or> (\\<exists>(C', L') \\<in> N. L' \\<sqsubset>L L \\<and> C' \\<preceq>\\<cdot> C)\\<close>\n  shows \\<open>(C, L) \\<in> Red_F N\\<close>\nproof -\n  note assms\n  moreover have i: \\<open>C \\<in> no_labels.Red_F_\\<G>_empty (fst ` N) \\<Longrightarrow> (C, L) \\<in> Red_F N\\<close>\n  proof -\n    assume \"C \\<in> no_labels.Red_F_\\<G>_empty (fst ` N)\"\n    then have \"C \\<in> no_labels.Red_F_\\<G>_empty_q q (fst ` N)\" if \"q \\<in> Q\" for q\n      unfolding no_labels.Red_F_\\<G>_empty_def using that by fast\n    then have g_in_red: \"\\<G>_F_q q C \\<subseteq> Red_F_q q (no_labels.\\<G>_Fset_q q (fst ` N))\" if \"q \\<in> Q\" for q\n      unfolding no_labels.Red_F_\\<G>_empty_q_def using that by blast\n    have \"\\<G>_F_L_q q (C, L) \\<subseteq> Red_F_q q (\\<G>_Fset_q q N)\" if \"q \\<in> Q\" for q\n      using that g_in_red by simp\n    then show ?thesis\n      unfolding Red_F_def Red_F_\\<G>_q_def by blast\n  qed\n  moreover have ii: \\<open>\\<exists>C' \\<in> fst ` N. C' \\<prec>\\<cdot> C \\<Longrightarrow> (C, L) \\<in> Red_F N\\<close>\n  proof -\n    assume \"\\<exists>C' \\<in> fst ` N. C' \\<prec>\\<cdot> C\"\n    then obtain C' where c'_in: \"C' \\<in> fst ` N\" and c_prec_c': \"C' \\<prec>\\<cdot> C\" by blast\n    obtain L' where c'_l'_in: \"(C', L') \\<in> N\" using c'_in by auto\n    have c'_l'_prec: \"(C', L') \\<sqsubset> (C, L)\"\n      using c_prec_c' unfolding Prec_FL_def by simp\n    have c_in_c'_g: \"\\<G>_F_q q C \\<subseteq> \\<G>_F_q q C'\" if \"q \\<in> Q\" for q\n      using prec_F_grounding[OF that c_prec_c'] by presburger\n    then have \"\\<G>_F_L_q q (C, L) \\<subseteq> \\<G>_F_L_q q (C', L')\" if \"q \\<in> Q\" for q\n      using that by auto\n    then have \"(C, L) \\<in> Red_F_\\<G>_q q N\" if \"q \\<in> Q\" for q\n      unfolding Red_F_\\<G>_q_def using that c'_l'_in c'_l'_prec by blast\n    then show ?thesis\n      unfolding Red_F_def by blast\n  qed\n  moreover have iii: \\<open>\\<exists>(C', L') \\<in> N. L' \\<sqsubset>L L \\<and> C' \\<preceq>\\<cdot> C \\<Longrightarrow> (C, L) \\<in> Red_F N\\<close>\n  proof -\n    assume \"\\<exists>(C', L') \\<in> N. L' \\<sqsubset>L L \\<and> C' \\<preceq>\\<cdot> C\"\n    then obtain C' L' where c'_l'_in: \"(C', L') \\<in> N\" and l'_sub_l: \"L' \\<sqsubset>L L\" and c'_sub_c: \"C' \\<preceq>\\<cdot> C\"\n      by fast\n    have \"(C, L) \\<in> Red_F N\" if \"C' \\<prec>\\<cdot> C\"\n      using that c'_l'_in ii by fastforce\n    moreover {\n      assume equiv_c_c': \"C \\<doteq> C'\"\n      then have equiv_c'_c: \"C' \\<doteq> C\"\n        using equiv_equiv_F by (simp add: equivp_symp)\n      then have c'_l'_prec: \"(C', L') \\<sqsubset> (C, L)\"\n        using l'_sub_l unfolding Prec_FL_def by simp\n      have \"\\<G>_F_q q C = \\<G>_F_q q C'\" if \"q \\<in> Q\" for q\n        using that equiv_F_grounding equiv_c_c' equiv_c'_c by (simp add: set_eq_subset)\n      then have \"\\<G>_F_L_q q (C, L) = \\<G>_F_L_q q (C', L')\" if \"q \\<in> Q\" for q\n        using that by auto\n      then have \"(C, L) \\<in> Red_F_\\<G>_q q N\" if \"q \\<in> Q\" for q\n        unfolding Red_F_\\<G>_q_def using that c'_l'_in c'_l'_prec by blast\n      then have ?thesis\n        unfolding Red_F_def by blast\n    }\n    ultimately show ?thesis\n      using c'_sub_c equiv_equiv_F equivp_symp by fastforce\n  qed\n  ultimately show ?thesis\n    by blast\nqed\n\nend\n  \n  \nsubsection \\<open>Given Clause Procedure\\<close>\n\nlocale given_clause = given_clause_basis Bot_F Inf_F Bot_G Q entails_q Inf_G_q Red_I_q\n  Red_F_q \\<G>_F_q \\<G>_I_q Equiv_F Prec_F Prec_L active\n  for\n    Bot_F :: \"'f set\" and\n    Inf_F :: \"'f inference set\" and\n    Bot_G :: \"'g set\" and\n    Q :: \"'q set\" and\n    entails_q :: \"'q \\<Rightarrow> 'g set \\<Rightarrow> 'g set \\<Rightarrow> bool\" and\n    Inf_G_q :: \\<open>'q \\<Rightarrow> 'g inference set\\<close> and\n    Red_I_q :: \"'q \\<Rightarrow> 'g set \\<Rightarrow> 'g inference set\" and\n    Red_F_q :: \"'q \\<Rightarrow> 'g set \\<Rightarrow> 'g set\" and\n    \\<G>_F_q :: \"'q \\<Rightarrow> 'f \\<Rightarrow> 'g set\"  and\n    \\<G>_I_q :: \"'q \\<Rightarrow> 'f inference \\<Rightarrow> 'g inference set option\" and\n    Equiv_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<doteq>\" 50) and\n    Prec_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<prec>\\<cdot>\" 50) and\n    Prec_L :: \"'l \\<Rightarrow> 'l \\<Rightarrow> bool\" (infix \"\\<sqsubset>L\" 50) and\n    active :: 'l +\n  assumes\n    inf_have_prems: \"\\<iota>F \\<in> Inf_F \\<Longrightarrow> prems_of \\<iota>F \\<noteq> []\"\nbegin\n\nlemma labeled_inf_have_prems: \"\\<iota> \\<in> Inf_FL \\<Longrightarrow> prems_of \\<iota> \\<noteq> []\"\n  using inf_have_prems by fastforce\n\ninductive step :: \"('f \\<times> 'l) set \\<Rightarrow> ('f \\<times> 'l) set \\<Rightarrow> bool\" (infix \"\\<leadsto>GC\" 50) where\n  process: \"N1 = N \\<union> M \\<Longrightarrow> N2 = N \\<union> M' \\<Longrightarrow> M \\<subseteq> Red_F (N \\<union> M') \\<Longrightarrow>\n    active_subset M' = {} \\<Longrightarrow> N1 \\<leadsto>GC N2\"\n| infer: \"N1 = N \\<union> {(C, L)} \\<Longrightarrow> N2 = N \\<union> {(C, active)} \\<union> M \\<Longrightarrow> L \\<noteq> active \\<Longrightarrow>\n    active_subset M = {} \\<Longrightarrow>\n    no_labels.Inf_between (fst ` active_subset N) {C}\n    \\<subseteq> no_labels.Red_I (fst ` (N \\<union> {(C, active)} \\<union> M)) \\<Longrightarrow>\n    N1 \\<leadsto>GC N2\"\n  \nlemma one_step_equiv: \"N1 \\<leadsto>GC N2 \\<Longrightarrow> N1 \\<rhd>L N2\"\nproof (cases N1 N2 rule: step.cases)\n  show \"N1 \\<leadsto>GC N2 \\<Longrightarrow> N1 \\<leadsto>GC N2\" by blast\nnext\n  fix N M M'\n  assume\n    gc_step: \"N1 \\<leadsto>GC N2\" and\n    n1_is: \"N1 = N \\<union> M\" and\n    n2_is: \"N2 = N \\<union> M'\" and\n    m_red: \"M \\<subseteq> Red_F (N \\<union> M')\" and\n    active_empty: \"active_subset M' = {}\"\n  have \"N1 - N2 \\<subseteq> Red_F N2\"\n    using n1_is n2_is m_red by auto\n  then show \"N1 \\<rhd>L N2\"\n    unfolding derive.simps by blast\nnext\n  fix N C L M\n  assume\n    gc_step: \"N1 \\<leadsto>GC N2\" and\n    n1_is: \"N1 = N \\<union> {(C, L)}\" and\n    not_active: \"L \\<noteq> active\" and\n    n2_is: \"N2 = N \\<union> {(C, active)} \\<union> M\" and\n    active_empty: \"active_subset M = {}\"\n  have \"(C, active) \\<in> N2\" using n2_is by auto\n  moreover have \"C \\<preceq>\\<cdot> C\" using equiv_equiv_F by (metis equivp_def)\n  moreover have \"active \\<sqsubset>L L\" using active_minimal[OF not_active] .\n  ultimately have \"{(C, L)} \\<subseteq> Red_F N2\"\n    using red_labeled_clauses by blast\n  moreover have \"N1 - N2 = {} \\<or> N1 - N2 = {(C, L)}\" using n1_is n2_is by blast\n  ultimately have \"N1 - N2 \\<subseteq> Red_F N2\"\n    using std_Red_F_eq by blast\n  then show \"N1 \\<rhd>L N2\"\n    unfolding derive.simps by blast\nqed\n\n(* lem:gc-derivations-are-red-derivations *)\nlemma gc_to_red: \"chain (\\<leadsto>GC) Ns \\<Longrightarrow> chain (\\<rhd>L) Ns\"\n  using one_step_equiv Lazy_List_Chain.chain_mono by blast\n\nlemma (in-) all_ex_finite_set: \"(\\<forall>(j::nat)\\<in>{0..<m}. \\<exists>(n::nat). P j n) \\<Longrightarrow>\n  (\\<forall>n1 n2. \\<forall>j\\<in>{0..<m}. P j n1 \\<longrightarrow> P j n2 \\<longrightarrow> n1 = n2) \\<Longrightarrow> finite {n. \\<exists>j \\<in> {0..<m}. P j n}\" for m P\nproof -\n  fix m::nat and P:: \"nat \\<Rightarrow> nat \\<Rightarrow> bool\"\n  assume\n    allj_exn: \"\\<forall>j\\<in>{0..<m}. \\<exists>n. P j n\" and\n    uniq_n: \"\\<forall>n1 n2. \\<forall>j\\<in>{0..<m}. P j n1 \\<longrightarrow> P j n2 \\<longrightarrow> n1 = n2\"\n  have \"{n. \\<exists>j \\<in> {0..<m}. P j n} = (\\<Union>((\\<lambda>j. {n. P j n}) ` {0..<m}))\" by blast\n  then have imp_finite: \"(\\<forall>j\\<in>{0..<m}. finite {n. P j n}) \\<Longrightarrow> finite {n. \\<exists>j \\<in> {0..<m}. P j n}\"\n    using finite_UN[of \"{0..<m}\" \"\\<lambda>j. {n. P j n}\"] by simp\n  have \"\\<forall>j\\<in>{0..<m}. \\<exists>!n. P j n\" using allj_exn uniq_n by blast\n  then have \"\\<forall>j\\<in>{0..<m}. finite {n. P j n}\" by (metis bounded_nat_set_is_finite lessI mem_Collect_eq)\n  then show \"finite {n. \\<exists>j \\<in> {0..<m}. P j n}\" using imp_finite by simp\nqed\n\n(* lem:fair-gc-derivations *)\nlemma gc_fair:\n  assumes\n    deriv: \"chain (\\<leadsto>GC) Ns\" and\n    init_state: \"active_subset (lhd Ns) = {}\" and\n    final_state: \"passive_subset (Liminf_llist Ns) = {}\"\n  shows \"fair Ns\"\n  unfolding fair_def\nproof\n  fix \\<iota>\n  assume i_in: \"\\<iota> \\<in> Inf_from (Liminf_llist Ns)\"\n  note lhd_is = lhd_conv_lnth[OF chain_not_lnull[OF deriv]]\n  have i_in_inf_fl: \"\\<iota> \\<in> Inf_FL\" using i_in unfolding Inf_from_def by blast\n  have \"Liminf_llist Ns = active_subset (Liminf_llist Ns)\"\n    using final_state unfolding passive_subset_def active_subset_def by blast\n  then have i_in2: \"\\<iota> \\<in> Inf_from (active_subset (Liminf_llist Ns))\" using i_in by simp\n  define m where \"m = length (prems_of \\<iota>)\"\n  then have m_def_F: \"m = length (prems_of (to_F \\<iota>))\" unfolding to_F_def by simp\n  have i_in_F: \"to_F \\<iota> \\<in> Inf_F\"\n    using i_in Inf_FL_to_Inf_F unfolding Inf_from_def to_F_def by blast\n  then have m_pos: \"m > 0\" using m_def_F using inf_have_prems by blast\n  have exist_nj: \"\\<forall>j \\<in> {0..<m}. (\\<exists>nj. enat (Suc nj) < llength Ns \\<and>\n      prems_of \\<iota> ! j \\<notin> active_subset (lnth Ns nj) \\<and>\n      (\\<forall>k. k > nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (lnth Ns k)))\"\n  proof clarify\n    fix j\n    assume j_in: \"j \\<in> {0..<m}\"\n    then obtain C where c_is: \"(C, active) = prems_of \\<iota> ! j\"\n      using i_in2 unfolding m_def Inf_from_def active_subset_def\n      by (smt Collect_mem_eq Collect_mono_iff atLeastLessThan_iff nth_mem old.prod.exhaust snd_conv)\n    then have \"(C, active) \\<in> Liminf_llist Ns\"\n      using j_in i_in unfolding m_def Inf_from_def by force\n    then obtain nj where nj_is: \"enat nj < llength Ns\" and\n      c_in2: \"(C, active) \\<in> \\<Inter> (lnth Ns ` {k. nj \\<le> k \\<and> enat k < llength Ns})\"\n      unfolding Liminf_llist_def using init_state by blast\n    then have c_in3: \"\\<forall>k. k \\<ge> nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow> (C, active) \\<in> lnth Ns k\" by blast\n    have nj_pos: \"nj > 0\" using init_state c_in2 nj_is\n      unfolding active_subset_def lhd_is by force\n    obtain nj_min where nj_min_is: \"nj_min = (LEAST nj. enat nj < llength Ns \\<and>\n        (C, active) \\<in> \\<Inter> (lnth Ns ` {k. nj \\<le> k \\<and> enat k < llength Ns}))\" by blast\n    then have in_allk: \"\\<forall>k. k \\<ge> nj_min \\<longrightarrow> enat k < llength Ns \\<longrightarrow> (C, active) \\<in> (lnth Ns k)\"\n      using c_in3 nj_is c_in2\n      by (metis (mono_tags, lifting) INT_E LeastI_ex mem_Collect_eq)\n    have njm_smaller_D: \"enat nj_min < llength Ns\"\n      using nj_min_is\n      by (smt LeastI_ex \\<open>\\<And>thesis. (\\<And>nj. \\<lbrakk>enat nj < llength Ns;\n          (C, active) \\<in> \\<Inter> (lnth Ns ` {k. nj \\<le> k \\<and> enat k < llength Ns})\\<rbrakk> \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close>)\n    have \"nj_min > 0\"\n      using nj_is c_in2 nj_pos nj_min_is lhd_is\n      by (metis (mono_tags, lifting) Collect_empty_eq \\<open>(C, active) \\<in> Liminf_llist Ns\\<close>\n          \\<open>Liminf_llist Ns = active_subset (Liminf_llist Ns)\\<close>\n          \\<open>\\<forall>k\\<ge>nj_min. enat k < llength Ns \\<longrightarrow> (C, active) \\<in> lnth Ns k\\<close> active_subset_def init_state\n          linorder_not_less mem_Collect_eq zero_enat_def chain_length_pos[OF deriv])\n    then obtain njm_prec where nj_prec_is: \"Suc njm_prec = nj_min\" using gr0_conv_Suc by auto\n    then have njm_prec_njm: \"njm_prec < nj_min\" by blast\n    then have njm_prec_njm_enat: \"enat njm_prec < enat nj_min\" by simp\n    have njm_prec_smaller_d: \"njm_prec < llength Ns\"\n      by (rule less_trans[OF njm_prec_njm_enat njm_smaller_D])\n    have njm_prec_all_suc: \"\\<forall>k>njm_prec. enat k < llength Ns \\<longrightarrow> (C, active) \\<in> lnth Ns k\"\n      using nj_prec_is in_allk by simp\n    have notin_njm_prec: \"(C, active) \\<notin> lnth Ns njm_prec\"\n    proof (rule ccontr)\n      assume \"\\<not> (C, active) \\<notin> lnth Ns njm_prec\"\n      then have absurd_hyp: \"(C, active) \\<in> lnth Ns njm_prec\" by simp\n      have prec_smaller: \"enat njm_prec < llength Ns\" using nj_min_is nj_prec_is\n        by (smt LeastI_ex Suc_leD \\<open>\\<And>thesis. (\\<And>nj. \\<lbrakk>enat nj < llength Ns;\n            (C, active) \\<in> \\<Inter> (lnth Ns ` {k. nj \\<le> k \\<and> enat k < llength Ns})\\<rbrakk> \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close>\n            enat_ord_simps(1) le_eq_less_or_eq le_less_trans)\n      have \"(C, active) \\<in> \\<Inter> (lnth Ns ` {k. njm_prec \\<le> k \\<and> enat k < llength Ns})\"\n      proof -\n        {\n          fix k\n          assume k_in: \"njm_prec \\<le> k \\<and> enat k < llength Ns\"\n          have \"k = njm_prec \\<Longrightarrow> (C, active) \\<in> lnth Ns k\" using absurd_hyp by simp\n          moreover have \"njm_prec < k \\<Longrightarrow> (C, active) \\<in> lnth Ns k\"\n            using nj_prec_is in_allk k_in by simp\n          ultimately have \"(C, active) \\<in> lnth Ns k\" using k_in by fastforce\n        }\n        then show \"(C, active) \\<in> \\<Inter> (lnth Ns ` {k. njm_prec \\<le> k \\<and> enat k < llength Ns})\" by blast\n      qed\n      then have \"enat njm_prec < llength Ns \\<and>\n          (C, active) \\<in> \\<Inter> (lnth Ns ` {k. njm_prec \\<le> k \\<and> enat k < llength Ns})\"\n        using prec_smaller by blast\n      then show False\n        using nj_min_is nj_prec_is Orderings.wellorder_class.not_less_Least njm_prec_njm by blast\n    qed\n    then have notin_active_subs_njm_prec: \"(C, active) \\<notin> active_subset (lnth Ns njm_prec)\"\n      unfolding active_subset_def by blast\n    then show \"\\<exists>nj. enat (Suc nj) < llength Ns \\<and> prems_of \\<iota> ! j \\<notin> active_subset (lnth Ns nj) \\<and>\n        (\\<forall>k. k > nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (lnth Ns k))\"\n      using c_is njm_prec_all_suc njm_prec_smaller_d by (metis (mono_tags, lifting)\n          active_subset_def mem_Collect_eq nj_prec_is njm_smaller_D snd_conv)\n  qed\n  define nj_set where \"nj_set = {nj. (\\<exists>j\\<in>{0..<m}. enat (Suc nj) < llength Ns \\<and>\n      prems_of \\<iota> ! j \\<notin> active_subset (lnth Ns nj) \\<and>\n      (\\<forall>k. k > nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (lnth Ns k)))}\"\n  then have nj_not_empty: \"nj_set \\<noteq> {}\"\n  proof -\n    have zero_in: \"0 \\<in> {0..<m}\" using m_pos by simp\n    then obtain n0 where \"enat (Suc n0) < llength Ns\" and\n      \"prems_of \\<iota> ! 0 \\<notin> active_subset (lnth Ns n0)\" and\n      \"\\<forall>k>n0. enat k < llength Ns \\<longrightarrow> prems_of \\<iota> ! 0 \\<in> active_subset (lnth Ns k)\"\n      using exist_nj by fast\n    then have \"n0 \\<in> nj_set\" unfolding nj_set_def using zero_in by blast\n    then show \"nj_set \\<noteq> {}\" by auto\n  qed\n  have nj_finite: \"finite nj_set\"\n    using all_ex_finite_set[OF exist_nj]\n    by (metis (no_types, lifting) Suc_ile_eq dual_order.strict_implies_order\n        linorder_neqE_nat nj_set_def)\n      (* the n below in the n-1 from the pen-and-paper proof *)\n  have \"\\<exists>n \\<in> nj_set. \\<forall>nj \\<in> nj_set. nj \\<le> n\"\n    using nj_not_empty nj_finite using Max_ge Max_in by blast\n  then obtain n where n_in: \"n \\<in> nj_set\" and n_bigger: \"\\<forall>nj \\<in> nj_set. nj \\<le> n\" by blast\n  then obtain j0 where j0_in: \"j0 \\<in> {0..<m}\" and suc_n_length: \"enat (Suc n) < llength Ns\" and\n    j0_notin: \"prems_of \\<iota> ! j0 \\<notin> active_subset (lnth Ns n)\" and\n    j0_allin: \"(\\<forall>k. k > n \\<longrightarrow> enat k < llength Ns \\<longrightarrow> prems_of \\<iota> ! j0 \\<in> active_subset (lnth Ns k))\"\n    unfolding nj_set_def by blast\n  obtain C0 where C0_is: \"prems_of \\<iota> ! j0 = (C0, active)\" using j0_in\n    using i_in2 unfolding m_def Inf_from_def active_subset_def\n    by (smt Collect_mem_eq Collect_mono_iff atLeastLessThan_iff nth_mem old.prod.exhaust snd_conv)\n  then have C0_prems_i: \"(C0, active) \\<in> set (prems_of \\<iota>)\" using in_set_conv_nth j0_in m_def by force\n  have C0_in: \"(C0, active) \\<in> (lnth Ns (Suc n))\"\n    using C0_is j0_allin suc_n_length by (simp add: active_subset_def)\n  have C0_notin: \"(C0, active) \\<notin> (lnth Ns n)\" using C0_is j0_notin unfolding active_subset_def by simp\n  have step_n: \"lnth Ns n \\<leadsto>GC lnth Ns (Suc n)\"\n    using deriv chain_lnth_rel n_in unfolding nj_set_def by blast\n  have \"\\<exists>N C L M. (lnth Ns n = N \\<union> {(C, L)} \\<and>\n      lnth Ns (Suc n) = N \\<union> {(C, active)} \\<union> M \\<and> L \\<noteq> active \\<and> active_subset M = {} \\<and>\n      no_labels.Inf_between (fst ` active_subset N) {C}\n      \\<subseteq> no_labels.Red_I (fst ` (N \\<union> {(C, active)} \\<union> M)))\"\n  proof -\n    have proc_or_infer: \"(\\<exists>N1 N M N2 M'. lnth Ns n = N1 \\<and> lnth Ns (Suc n) = N2 \\<and> N1 = N \\<union> M \\<and>\n         N2 = N \\<union> M' \\<and> M \\<subseteq> Red_F (N \\<union> M') \\<and> active_subset M' = {}) \\<or>\n       (\\<exists>N1 N C L N2 M. lnth Ns n = N1 \\<and> lnth Ns (Suc n) = N2 \\<and> N1 = N \\<union> {(C, L)} \\<and>\n         N2 = N \\<union> {(C, active)} \\<union> M \\<and> L \\<noteq> active \\<and> active_subset M = {} \\<and>\n         no_labels.Inf_between (fst ` active_subset N) {C} \\<subseteq>\n           no_labels.Red_I (fst ` (N \\<union> {(C, active)} \\<union> M)))\"\n      using step.simps[of \"lnth Ns n\" \"lnth Ns (Suc n)\"] step_n by blast\n    show ?thesis\n      using C0_in C0_notin proc_or_infer j0_in C0_is\n      by (smt Un_iff active_subset_def mem_Collect_eq snd_conv sup_bot.right_neutral)\n  qed\n  then obtain N M L where inf_from_subs:\n    \"no_labels.Inf_between (fst ` active_subset N) {C0}\n     \\<subseteq> no_labels.Red_I (fst ` (N \\<union> {(C0, active)} \\<union> M))\" and\n    nth_d_is: \"lnth Ns n = N \\<union> {(C0, L)}\" and\n    suc_nth_d_is: \"lnth Ns (Suc n) = N \\<union> {(C0, active)} \\<union> M\" and\n    l_not_active: \"L \\<noteq> active\"\n    using C0_in C0_notin j0_in C0_is using active_subset_def by fastforce\n  have \"j \\<in> {0..<m} \\<Longrightarrow> prems_of \\<iota> ! j \\<noteq> prems_of \\<iota> ! j0 \\<Longrightarrow> prems_of \\<iota> ! j \\<in> (active_subset N)\" for j\n  proof -\n    fix j\n    assume j_in: \"j \\<in> {0..<m}\" and\n      j_not_j0: \"prems_of \\<iota> ! j \\<noteq> prems_of \\<iota> ! j0\"\n    obtain nj where nj_len: \"enat (Suc nj) < llength Ns\" and\n      nj_prems: \"prems_of \\<iota> ! j \\<notin> active_subset (lnth Ns nj)\" and\n      nj_greater: \"(\\<forall>k. k > nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (lnth Ns k))\"\n      using exist_nj j_in by blast\n    then have \"nj \\<in> nj_set\" unfolding nj_set_def using j_in by blast\n    moreover have \"nj \\<noteq> n\"\n    proof (rule ccontr)\n      assume \"\\<not> nj \\<noteq> n\"\n      then have \"prems_of \\<iota> ! j = (C0, active)\"\n        using C0_in C0_notin step.simps[of \"lnth Ns n\" \"lnth Ns (Suc n)\"] step_n\n        by (smt Un_iff nth_d_is suc_nth_d_is l_not_active active_subset_def insertCI insertE lessI\n            mem_Collect_eq nj_greater nj_prems snd_conv suc_n_length)\n      then show False using j_not_j0 C0_is by simp\n    qed\n    ultimately have \"nj < n\" using n_bigger by force\n    then have \"prems_of \\<iota> ! j \\<in> (active_subset (lnth Ns n))\"\n      using nj_greater n_in Suc_ile_eq dual_order.strict_implies_order unfolding nj_set_def by blast\n    then show \"prems_of \\<iota> ! j \\<in> (active_subset N)\"\n      using nth_d_is l_not_active unfolding active_subset_def by force\n  qed\n  then have \"set (prems_of \\<iota>) \\<subseteq> active_subset N \\<union> {(C0, active)}\"\n    using C0_prems_i C0_is m_def\n    by (metis Un_iff atLeast0LessThan in_set_conv_nth insertCI lessThan_iff subrelI)\n  moreover have \"\\<not> (set (prems_of \\<iota>) \\<subseteq> active_subset N - {(C0, active)})\" using C0_prems_i by blast\n  ultimately have \"\\<iota> \\<in> Inf_between (active_subset N) {(C0, active)}\"\n    using i_in_inf_fl unfolding Inf_between_def Inf_from_def by blast\n  then have \"to_F \\<iota> \\<in> no_labels.Inf_between (fst ` active_subset N) {C0}\"\n    unfolding to_F_def Inf_between_def Inf_from_def\n      no_labels.Inf_between_def no_labels.Inf_from_def using Inf_FL_to_Inf_F\n    by force\n  then have \"to_F \\<iota> \\<in> no_labels.Red_I (fst ` (lnth Ns (Suc n)))\"\n    using suc_nth_d_is inf_from_subs by fastforce\n  then have \"\\<forall>q \\<in> Q. (\\<G>_I_q q (to_F \\<iota>) \\<noteq> None \\<and>\n      the (\\<G>_I_q q (to_F \\<iota>)) \\<subseteq> Red_I_q q (\\<Union> (\\<G>_F_q q ` fst ` lnth Ns (Suc n))))\n      \\<or> (\\<G>_I_q q (to_F \\<iota>) = None \\<and>\n      \\<G>_F_q q (concl_of (to_F \\<iota>)) \\<subseteq> \\<Union> (\\<G>_F_q q ` fst ` lnth Ns (Suc n)) \\<union>\n        Red_F_q q (\\<Union> (\\<G>_F_q q ` fst ` lnth Ns (Suc n))))\"\n    unfolding to_F_def no_labels.Red_I_def no_labels.Red_I_\\<G>_q_def by blast\n  then have \"\\<iota> \\<in> Red_I_\\<G> (lnth Ns (Suc n))\"\n    using i_in_inf_fl unfolding Red_I_\\<G>_def Red_I_\\<G>_q_def by (simp add: to_F_def)\n  then show \"\\<iota> \\<in> Sup_llist (lmap Red_I_\\<G> Ns)\"\n    unfolding Sup_llist_def using suc_n_length by auto\nqed\n\ntheorem gc_complete_Liminf:\n  assumes\n    deriv: \"chain (\\<leadsto>GC) Ns\" and\n    init_state: \"active_subset (lhd Ns) = {}\" and\n    final_state: \"passive_subset (Liminf_llist Ns) = {}\" and\n    b_in: \"B \\<in> Bot_F\" and\n    bot_entailed: \"no_labels.entails_\\<G> (fst ` lhd Ns) {B}\"\n  shows \"\\<exists>BL \\<in> Bot_FL. BL \\<in> Liminf_llist Ns\"\nproof -\n  note lhd_is = lhd_conv_lnth[OF chain_not_lnull[OF deriv]]\n  have labeled_b_in: \"(B, active) \\<in> Bot_FL\" using b_in by simp\n  have labeled_bot_entailed: \"entails_\\<G>_L (lhd Ns) {(B, active)}\"\n    using labeled_entailment_lifting bot_entailed lhd_is by fastforce\n  have fair: \"fair Ns\" using gc_fair[OF deriv init_state final_state] .\n  then show ?thesis\n    using dynamically_complete_Liminf[OF labeled_b_in gc_to_red[OF deriv] fair\n        labeled_bot_entailed]\n    by blast\nqed\n\n(* thm:gc-completeness *)\ntheorem gc_complete:\n  assumes\n    deriv: \"chain (\\<leadsto>GC) Ns\" and\n    init_state: \"active_subset (lhd Ns) = {}\" and\n    final_state: \"passive_subset (Liminf_llist Ns) = {}\" and\n    b_in: \"B \\<in> Bot_F\" and\n    bot_entailed: \"no_labels.entails_\\<G> (fst ` lhd Ns) {B}\"\n  shows \"\\<exists>i. enat i < llength Ns \\<and> (\\<exists>BL \\<in> Bot_FL. BL \\<in> lnth Ns i)\"\nproof -\n  note lhd_is = lhd_conv_lnth[OF chain_not_lnull[OF deriv]]\n  have \"\\<exists>BL\\<in>Bot_FL. BL \\<in> Liminf_llist Ns\"\n    using assms by (rule gc_complete_Liminf)\n  then show ?thesis\n    unfolding Liminf_llist_def by auto\nqed\n\nend\n\n\nsubsection \\<open>Lazy Given Clause Procedure\\<close>\n\nlocale lazy_given_clause = given_clause_basis Bot_F Inf_F Bot_G Q entails_q Inf_G_q Red_I_q\n  Red_F_q \\<G>_F_q \\<G>_I_q Equiv_F Prec_F Prec_L active\n  for\n    Bot_F :: \"'f set\" and\n    Inf_F :: \"'f inference set\" and\n    Bot_G :: \"'g set\" and\n    Q :: \"'q set\" and\n    entails_q :: \"'q \\<Rightarrow> 'g set \\<Rightarrow> 'g set \\<Rightarrow> bool\" and\n    Inf_G_q :: \\<open>'q \\<Rightarrow> 'g inference set\\<close> and\n    Red_I_q :: \"'q \\<Rightarrow> 'g set \\<Rightarrow> 'g inference set\" and\n    Red_F_q :: \"'q \\<Rightarrow> 'g set \\<Rightarrow> 'g set\" and\n    \\<G>_F_q :: \"'q \\<Rightarrow> 'f \\<Rightarrow> 'g set\"  and\n    \\<G>_I_q :: \"'q \\<Rightarrow> 'f inference \\<Rightarrow> 'g inference set option\" and\n    Equiv_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<doteq>\" 50) and\n    Prec_F :: \"'f \\<Rightarrow> 'f \\<Rightarrow> bool\" (infix \"\\<prec>\\<cdot>\" 50) and\n    Prec_L :: \"'l \\<Rightarrow> 'l \\<Rightarrow> bool\" (infix \"\\<sqsubset>L\" 50) and\n    active :: 'l\nbegin\n\ninductive step :: \"'f inference set \\<times> ('f \\<times> 'l) set \\<Rightarrow>\n  'f inference set \\<times> ('f \\<times> 'l) set \\<Rightarrow> bool\" (infix \"\\<leadsto>LGC\" 50) where\n  process: \"N1 = N \\<union> M \\<Longrightarrow> N2 = N \\<union> M' \\<Longrightarrow> M \\<subseteq> Red_F (N \\<union> M') \\<Longrightarrow>\n    active_subset M' = {} \\<Longrightarrow> (T, N1) \\<leadsto>LGC (T, N2)\" |\n  schedule_infer: \"T2 = T1 \\<union> T' \\<Longrightarrow> N1 = N \\<union> {(C, L)} \\<Longrightarrow> N2 = N \\<union> {(C, active)} \\<Longrightarrow>\n    L \\<noteq> active \\<Longrightarrow> T' = no_labels.Inf_between (fst ` active_subset N) {C} \\<Longrightarrow>\n    (T1, N1) \\<leadsto>LGC (T2, N2)\" |\n  compute_infer: \"T1 = T2 \\<union> {\\<iota>} \\<Longrightarrow> N2 = N1 \\<union> M \\<Longrightarrow> active_subset M = {} \\<Longrightarrow>\n    \\<iota> \\<in> no_labels.Red_I (fst ` (N1 \\<union> M)) \\<Longrightarrow> (T1, N1) \\<leadsto>LGC (T2, N2)\" |\n  delete_orphan_infers: \"T1 = T2 \\<union> T' \\<Longrightarrow>\n    T' \\<inter> no_labels.Inf_from (fst ` active_subset N) = {} \\<Longrightarrow> (T1, N) \\<leadsto>LGC (T2, N)\"\n\nlemma premise_free_inf_always_from: \"\\<iota> \\<in> Inf_F \\<Longrightarrow> prems_of \\<iota> = [] \\<Longrightarrow> \\<iota> \\<in> no_labels.Inf_from N\"\n  unfolding no_labels.Inf_from_def by simp\n\nlemma one_step_equiv: \"(T1, N1) \\<leadsto>LGC (T2, N2) \\<Longrightarrow> N1 \\<rhd>L N2\"\nproof (cases \"(T1, N1)\" \"(T2, N2)\" rule: step.cases)\n  show \"(T1, N1) \\<leadsto>LGC (T2, N2) \\<Longrightarrow> (T1, N1) \\<leadsto>LGC (T2, N2)\" by blast\nnext\n  fix N M M'\n  assume\n    n1_is: \"N1 = N \\<union> M\" and\n    n2_is: \"N2 = N \\<union> M'\" and\n    m_red: \"M \\<subseteq> Red_F (N \\<union> M')\"\n  have \"N1 - N2 \\<subseteq> Red_F N2\"\n    using n1_is n2_is m_red by auto\n  then show \"N1 \\<rhd>L N2\"\n    unfolding derive.simps by blast\nnext\n  fix N C L M\n  assume\n    n1_is: \"N1 = N \\<union> {(C, L)}\" and\n    not_active: \"L \\<noteq> active\" and\n    n2_is: \"N2 = N \\<union> {(C, active)}\"\n  have \"(C, active) \\<in> N2\" using n2_is by auto\n  moreover have \"C \\<preceq>\\<cdot> C\" by (metis equivp_def equiv_equiv_F)\n  moreover have \"active \\<sqsubset>L L\" using active_minimal[OF not_active] .\n  ultimately have \"{(C, L)} \\<subseteq> Red_F N2\"\n    using red_labeled_clauses by blast\n  then have \"N1 - N2 \\<subseteq> Red_F N2\"\n    using std_Red_F_eq using n1_is n2_is by blast\n  then show \"N1 \\<rhd>L N2\"\n    unfolding derive.simps by blast\nnext\n  fix M\n  assume\n    n2_is: \"N2 = N1 \\<union> M\"\n  have \"N1 - N2 \\<subseteq> Red_F N2\"\n    using n2_is by blast\n  then show \"N1 \\<rhd>L N2\"\n    unfolding derive.simps by blast\nnext\n  assume n2_is: \"N2 = N1\"\n  have \"N1 - N2 \\<subseteq> Red_F N2\"\n    using n2_is by blast\n  then show \"N1 \\<rhd>L N2\"\n    unfolding derive.simps by blast\nqed\n\n(* lem:lgc-derivations-are-red-derivations *)\nlemma lgc_to_red: \"chain (\\<leadsto>LGC) Ns \\<Longrightarrow> chain (\\<rhd>L) (lmap snd Ns)\"\n  using one_step_equiv Lazy_List_Chain.chain_mono by (smt chain_lmap prod.collapse)\n\n(* lem:fair-lgc-derivations *)\nlemma lgc_fair:\n  assumes\n    deriv: \"chain (\\<leadsto>LGC) Ns\" and\n    init_state: \"active_subset (snd (lhd Ns)) = {}\" and\n    final_state: \"passive_subset (Liminf_llist (lmap snd Ns)) = {}\" and\n    no_prems_init: \"\\<forall>\\<iota> \\<in> Inf_F. prems_of \\<iota> = [] \\<longrightarrow> \\<iota> \\<in> fst (lhd Ns)\" and\n    final_schedule: \"Liminf_llist (lmap fst Ns) = {}\"\n  shows \"fair (lmap snd Ns)\"\n  unfolding fair_def\nproof\n  fix \\<iota>\n  assume i_in: \"\\<iota> \\<in> Inf_from (Liminf_llist (lmap snd Ns))\"\n  note lhd_is = lhd_conv_lnth[OF chain_not_lnull[OF deriv]]\n  have i_in_inf_fl: \"\\<iota> \\<in> Inf_FL\" using i_in unfolding Inf_from_def by blast\n  have \"Liminf_llist (lmap snd Ns) = active_subset (Liminf_llist (lmap snd Ns))\"\n    using final_state unfolding passive_subset_def active_subset_def by blast\n  then have i_in2: \"\\<iota> \\<in> Inf_from (active_subset (Liminf_llist (lmap snd Ns)))\"\n    using i_in by simp\n  define m where \"m = length (prems_of \\<iota>)\"\n  then have m_def_F: \"m = length (prems_of (to_F \\<iota>))\" unfolding to_F_def by simp\n  have i_in_F: \"to_F \\<iota> \\<in> Inf_F\"\n    using i_in Inf_FL_to_Inf_F unfolding Inf_from_def to_F_def by blast\n  have exist_nj: \"\\<forall>j \\<in> {0..<m}. (\\<exists>nj. enat (Suc nj) < llength Ns \\<and>\n      prems_of \\<iota> ! j \\<notin> active_subset (snd (lnth Ns nj)) \\<and>\n      (\\<forall>k. k > nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (snd (lnth Ns k))))\"\n  proof clarify\n    fix j\n    assume j_in: \"j \\<in> {0..<m}\"\n    then obtain C where c_is: \"(C, active) = prems_of \\<iota> ! j\"\n      using i_in2 unfolding m_def Inf_from_def active_subset_def\n      by (smt Collect_mem_eq Collect_mono_iff atLeastLessThan_iff nth_mem old.prod.exhaust snd_conv)\n    then have \"(C, active) \\<in> Liminf_llist (lmap snd Ns)\"\n      using j_in i_in unfolding m_def Inf_from_def by force\n    then obtain nj where nj_is: \"enat nj < llength Ns\" and\n      c_in2: \"(C, active) \\<in> \\<Inter> (snd ` (lnth Ns ` {k. nj \\<le> k \\<and> enat k < llength Ns}))\"\n      unfolding Liminf_llist_def using init_state by fastforce\n    then have c_in3: \"\\<forall>k. k \\<ge> nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow> (C, active) \\<in> snd (lnth Ns k)\" by blast\n    have nj_pos: \"nj > 0\" using init_state c_in2 nj_is unfolding active_subset_def lhd_is by fastforce\n    obtain nj_min where nj_min_is: \"nj_min = (LEAST nj. enat nj < llength Ns \\<and>\n        (C, active) \\<in> \\<Inter> (snd ` (lnth Ns ` {k. nj \\<le> k \\<and> enat k < llength Ns})))\" by blast\n    then have in_allk: \"\\<forall>k. k \\<ge> nj_min \\<longrightarrow> enat k < llength Ns \\<longrightarrow> (C, active) \\<in> snd (lnth Ns k)\"\n      using c_in3 nj_is c_in2 INT_E LeastI_ex\n        [of \"\\<lambda>n. enat n < llength Ns\n            \\<and> (C, active) \\<in> \\<Inter> (snd ` lnth Ns ` {na. n \\<le> na \\<and> enat na < llength Ns})\"]\n      by blast\n    have njm_smaller_D: \"enat nj_min < llength Ns\"\n      using nj_min_is\n      by (smt LeastI_ex \\<open>\\<And>thesis. (\\<And>nj. \\<lbrakk>enat nj < llength Ns;\n          (C, active) \\<in> \\<Inter> (snd ` (lnth Ns ` {k. nj \\<le> k \\<and> enat k < llength Ns}))\\<rbrakk> \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close>)\n    have \"nj_min > 0\"\n      using nj_is c_in2 nj_pos nj_min_is lhd_is\n      by (metis (mono_tags, lifting) active_subset_def emptyE in_allk init_state mem_Collect_eq\n          not_less snd_conv zero_enat_def chain_length_pos[OF deriv])\n    then obtain njm_prec where nj_prec_is: \"Suc njm_prec = nj_min\" using gr0_conv_Suc by auto\n    then have njm_prec_njm: \"njm_prec < nj_min\" by blast\n    then have njm_prec_njm_enat: \"enat njm_prec < enat nj_min\" by simp\n    have njm_prec_smaller_d: \"njm_prec < llength Ns\"\n      by (rule less_trans[OF njm_prec_njm_enat njm_smaller_D])\n    have njm_prec_all_suc: \"\\<forall>k>njm_prec. enat k < llength Ns \\<longrightarrow> (C, active) \\<in> snd (lnth Ns k)\"\n      using nj_prec_is in_allk by simp\n    have notin_njm_prec: \"(C, active) \\<notin> snd (lnth Ns njm_prec)\"\n    proof (rule ccontr)\n      assume \"\\<not> (C, active) \\<notin> snd (lnth Ns njm_prec)\"\n      then have absurd_hyp: \"(C, active) \\<in> snd (lnth Ns njm_prec)\" by simp\n      have prec_smaller: \"enat njm_prec < llength Ns\" using nj_min_is nj_prec_is\n        by (smt LeastI_ex Suc_leD \\<open>\\<And>thesis. (\\<And>nj. \\<lbrakk>enat nj < llength Ns;\n            (C, active) \\<in> \\<Inter> (snd ` (lnth Ns ` {k. nj \\<le> k \\<and> enat k < llength Ns}))\\<rbrakk> \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close>\n            enat_ord_simps(1) le_eq_less_or_eq le_less_trans)\n      have \"(C, active) \\<in> \\<Inter> (snd ` (lnth Ns ` {k. njm_prec \\<le> k \\<and> enat k < llength Ns}))\"\n      proof -\n        {\n          fix k\n          assume k_in: \"njm_prec \\<le> k \\<and> enat k < llength Ns\"\n          have \"k = njm_prec \\<Longrightarrow> (C, active) \\<in> snd (lnth Ns k)\" using absurd_hyp by simp\n          moreover have \"njm_prec < k \\<Longrightarrow> (C, active) \\<in> snd (lnth Ns k)\"\n            using nj_prec_is in_allk k_in by simp\n          ultimately have \"(C, active) \\<in> snd (lnth Ns k)\" using k_in by fastforce\n        }\n        then show \"(C, active) \\<in> \\<Inter> (snd ` (lnth Ns ` {k. njm_prec \\<le> k \\<and> enat k < llength Ns}))\"\n          by blast\n      qed\n      then have \"enat njm_prec < llength Ns \\<and>\n          (C, active) \\<in> \\<Inter> (snd ` (lnth Ns ` {k. njm_prec \\<le> k \\<and> enat k < llength Ns}))\"\n        using prec_smaller by blast\n      then show False\n        using nj_min_is nj_prec_is Orderings.wellorder_class.not_less_Least njm_prec_njm by blast\n    qed\n    then have notin_active_subs_njm_prec: \"(C, active) \\<notin> active_subset (snd (lnth Ns njm_prec))\"\n      unfolding active_subset_def by blast\n    then show \"\\<exists>nj. enat (Suc nj) < llength Ns \\<and> prems_of \\<iota> ! j \\<notin> active_subset (snd (lnth Ns nj)) \\<and>\n        (\\<forall>k. k > nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (snd (lnth Ns k)))\"\n      using c_is njm_prec_all_suc njm_prec_smaller_d by (metis (mono_tags, lifting)\n          active_subset_def mem_Collect_eq nj_prec_is njm_smaller_D snd_conv)\n  qed\n  define nj_set where \"nj_set = {nj. (\\<exists>j\\<in>{0..<m}. enat (Suc nj) < llength Ns \\<and>\n      prems_of \\<iota> ! j \\<notin> active_subset (snd (lnth Ns nj)) \\<and>\n      (\\<forall>k. k > nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow> prems_of \\<iota> ! j \\<in> active_subset (snd (lnth Ns k))))}\"\n  {\n    assume m_null: \"m = 0\"\n    then have \"enat 0 < llength Ns \\<and> to_F \\<iota> \\<in> fst (lhd Ns)\"\n      using no_prems_init i_in_F m_def_F zero_enat_def chain_length_pos[OF deriv] by auto\n    then have \"\\<exists>n. enat n < llength Ns \\<and> to_F \\<iota> \\<in> fst (lnth Ns n)\"\n      unfolding lhd_is by blast\n  }\n  moreover {\n    assume m_pos: \"m > 0\"\n    have nj_not_empty: \"nj_set \\<noteq> {}\"\n    proof -\n      have zero_in: \"0 \\<in> {0..<m}\" using m_pos by simp\n      then obtain n0 where \"enat (Suc n0) < llength Ns\" and\n        \"prems_of \\<iota> ! 0 \\<notin> active_subset (snd (lnth Ns n0))\" and\n        \"\\<forall>k>n0. enat k < llength Ns \\<longrightarrow> prems_of \\<iota> ! 0 \\<in> active_subset (snd (lnth Ns k))\"\n        using exist_nj by fast\n      then have \"n0 \\<in> nj_set\" unfolding nj_set_def using zero_in by blast\n      then show \"nj_set \\<noteq> {}\" by auto\n    qed\n    have nj_finite: \"finite nj_set\"\n      using all_ex_finite_set[OF exist_nj] by (metis (no_types, lifting) Suc_ile_eq\n          dual_order.strict_implies_order linorder_neqE_nat nj_set_def)\n    have \"\\<exists>n \\<in> nj_set. \\<forall>nj \\<in> nj_set. nj \\<le> n\"\n      using nj_not_empty nj_finite using Max_ge Max_in by blast\n    then obtain n where n_in: \"n \\<in> nj_set\" and n_bigger: \"\\<forall>nj \\<in> nj_set. nj \\<le> n\" by blast\n    then obtain j0 where j0_in: \"j0 \\<in> {0..<m}\" and suc_n_length: \"enat (Suc n) < llength Ns\" and\n      j0_notin: \"prems_of \\<iota> ! j0 \\<notin> active_subset (snd (lnth Ns n))\" and\n      j0_allin: \"(\\<forall>k. k > n \\<longrightarrow> enat k < llength Ns \\<longrightarrow>\n          prems_of \\<iota> ! j0 \\<in> active_subset (snd (lnth Ns k)))\"\n      unfolding nj_set_def by blast\n    obtain C0 where C0_is: \"prems_of \\<iota> ! j0 = (C0, active)\"\n      using j0_in i_in2 unfolding m_def Inf_from_def active_subset_def\n      by (smt Collect_mem_eq Collect_mono_iff atLeastLessThan_iff nth_mem old.prod.exhaust snd_conv)\n    then have C0_prems_i: \"(C0, active) \\<in> set (prems_of \\<iota>)\" using in_set_conv_nth j0_in m_def by force\n    have C0_in: \"(C0, active) \\<in> (snd (lnth Ns (Suc n)))\"\n      using C0_is j0_allin suc_n_length by (simp add: active_subset_def)\n    have C0_notin: \"(C0, active) \\<notin> (snd (lnth Ns n))\"\n      using C0_is j0_notin unfolding active_subset_def by simp\n    have step_n: \"lnth Ns n \\<leadsto>LGC lnth Ns (Suc n)\"\n      using deriv chain_lnth_rel n_in unfolding nj_set_def by blast\n    have is_scheduled: \"\\<exists>T2 T1 T' N1 N C L N2. lnth Ns n = (T1, N1) \\<and> lnth Ns (Suc n) = (T2, N2) \\<and>\n        T2 = T1 \\<union> T' \\<and> N1 = N \\<union> {(C, L)} \\<and> N2 = N \\<union> {(C, active)} \\<and> L \\<noteq> active \\<and>\n        T' = no_labels.Inf_between (fst ` active_subset N) {C}\"\n      using step.simps[of \"lnth Ns n\" \"lnth Ns (Suc n)\"] step_n C0_in C0_notin\n      unfolding active_subset_def by fastforce\n    then obtain T2 T1 T' N1 N L N2 where nth_d_is: \"lnth Ns n = (T1, N1)\" and\n      suc_nth_d_is: \"lnth Ns (Suc n) = (T2, N2)\" and t2_is: \"T2 = T1 \\<union> T'\" and\n      n1_is: \"N1 = N \\<union> {(C0, L)}\" \"N2 = N \\<union> {(C0, active)}\" and\n      l_not_active: \"L \\<noteq> active\" and\n      tp_is: \"T' = no_labels.Inf_between (fst ` active_subset N) {C0}\"\n      using C0_in C0_notin j0_in C0_is using active_subset_def by fastforce\n    have \"j \\<in> {0..<m} \\<Longrightarrow> prems_of \\<iota> ! j \\<noteq> prems_of \\<iota> ! j0 \\<Longrightarrow> prems_of \\<iota> ! j \\<in> (active_subset N)\"\n      for j\n    proof -\n      fix j\n      assume j_in: \"j \\<in> {0..<m}\" and\n        j_not_j0: \"prems_of \\<iota> ! j \\<noteq> prems_of \\<iota> ! j0\"\n      obtain nj where nj_len: \"enat (Suc nj) < llength Ns\" and\n        nj_prems: \"prems_of \\<iota> ! j \\<notin> active_subset (snd (lnth Ns nj))\" and\n        nj_greater: \"(\\<forall>k. k > nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow>\n            prems_of \\<iota> ! j \\<in> active_subset (snd (lnth Ns k)))\"\n        using exist_nj j_in by blast\n      then have \"nj \\<in> nj_set\" unfolding nj_set_def using j_in by blast\n      moreover have \"nj \\<noteq> n\"\n      proof (rule ccontr)\n        assume \"\\<not> nj \\<noteq> n\"\n        then have \"prems_of \\<iota> ! j = (C0, active)\"\n          using C0_in C0_notin step.simps[of \"lnth Ns n\" \"lnth Ns (Suc n)\"] step_n\n            active_subset_def is_scheduled nj_greater nj_prems suc_n_length by auto\n        then show False using j_not_j0 C0_is by simp\n      qed\n      ultimately have \"nj < n\" using n_bigger by force\n      then have \"prems_of \\<iota> ! j \\<in> (active_subset (snd (lnth Ns n)))\"\n        using nj_greater n_in Suc_ile_eq dual_order.strict_implies_order\n        unfolding nj_set_def by blast\n      then show \"prems_of \\<iota> ! j \\<in> (active_subset N)\"\n        using nth_d_is l_not_active n1_is unfolding active_subset_def by force\n    qed\n    then have prems_i_active: \"set (prems_of \\<iota>) \\<subseteq> active_subset N \\<union> {(C0, active)}\"\n      using C0_prems_i C0_is m_def\n      by (metis Un_iff atLeast0LessThan in_set_conv_nth insertCI lessThan_iff subrelI)\n    moreover have \"\\<not> (set (prems_of \\<iota>) \\<subseteq> active_subset N - {(C0, active)})\" using C0_prems_i by blast\n    ultimately have \"\\<iota> \\<in> Inf_between (active_subset N) {(C0, active)}\"\n      using i_in_inf_fl prems_i_active unfolding Inf_between_def Inf_from_def by blast\n    then have \"to_F \\<iota> \\<in> no_labels.Inf_between (fst ` active_subset N) {C0}\"\n      unfolding to_F_def Inf_between_def Inf_from_def\n        no_labels.Inf_between_def no_labels.Inf_from_def\n      using Inf_FL_to_Inf_F by force\n    then have i_in_t2: \"to_F \\<iota> \\<in> T2\" using tp_is t2_is by simp\n    have \"j \\<in> {0..<m} \\<Longrightarrow> (\\<forall>k. k > n \\<longrightarrow> enat k < llength Ns \\<longrightarrow>\n        prems_of \\<iota> ! j \\<in> active_subset (snd (lnth Ns k)))\" for j\n    proof (cases \"j = j0\")\n      case True\n      assume \"j = j0\"\n      then show \"(\\<forall>k. k > n \\<longrightarrow> enat k < llength Ns \\<longrightarrow>\n          prems_of \\<iota> ! j \\<in> active_subset (snd (lnth Ns k)))\" using j0_allin by simp\n    next\n      case False\n      assume j_in: \"j \\<in> {0..<m}\" and\n        \"j \\<noteq> j0\"\n      obtain nj where nj_len: \"enat (Suc nj) < llength Ns\" and\n        nj_prems: \"prems_of \\<iota> ! j \\<notin> active_subset (snd (lnth Ns nj))\" and\n        nj_greater: \"(\\<forall>k. k > nj \\<longrightarrow> enat k < llength Ns \\<longrightarrow>\n            prems_of \\<iota> ! j \\<in> active_subset (snd (lnth Ns k)))\"\n        using exist_nj j_in by blast\n      then have \"nj \\<in> nj_set\" unfolding nj_set_def using j_in by blast\n      then show \"(\\<forall>k. k > n \\<longrightarrow> enat k < llength Ns \\<longrightarrow>\n          prems_of \\<iota> ! j \\<in> active_subset (snd (lnth Ns k)))\"\n        using nj_greater n_bigger by auto\n    qed\n    then have allj_allk: \"(\\<forall>c\\<in> set (prems_of \\<iota>). (\\<forall>k. k > n \\<longrightarrow> enat k < llength Ns \\<longrightarrow>\n        c \\<in> active_subset (snd (lnth Ns k))))\"\n      using m_def by (metis atLeast0LessThan in_set_conv_nth lessThan_iff)\n    have \"\\<forall>c\\<in> set (prems_of \\<iota>). snd c = active\"\n      using prems_i_active unfolding active_subset_def by auto\n    then have ex_n_i_in: \"\\<exists>n. enat (Suc n) < llength Ns \\<and> to_F \\<iota> \\<in> fst (lnth Ns (Suc n)) \\<and>\n        (\\<forall>c\\<in> set (prems_of \\<iota>). snd c = active) \\<and>\n        (\\<forall>c\\<in> set (prems_of \\<iota>). (\\<forall>k. k > n \\<longrightarrow> enat k < llength Ns \\<longrightarrow>\n          c \\<in> active_subset (snd (lnth Ns k))))\"\n      using allj_allk i_in_t2 suc_nth_d_is fstI n_in nj_set_def\n      by auto\n    then have \"\\<exists>n. enat n < llength Ns \\<and> to_F \\<iota> \\<in> fst (lnth Ns n) \\<and>\n        (\\<forall>c\\<in> set (prems_of \\<iota>). snd c = active) \\<and> (\\<forall>c\\<in> set (prems_of \\<iota>). (\\<forall>k. k \\<ge> n \\<longrightarrow>\n          enat k < llength Ns \\<longrightarrow> c \\<in> active_subset (snd (lnth Ns k))))\"\n      by auto\n  }\n  ultimately obtain n T2 N2 where i_in_suc_n: \"to_F \\<iota> \\<in> fst (lnth Ns n)\" and\n    all_prems_active_after: \"m > 0 \\<Longrightarrow> (\\<forall>c\\<in> set (prems_of \\<iota>). (\\<forall>k. k \\<ge> n \\<longrightarrow> enat k < llength Ns \\<longrightarrow>\n                  c \\<in> active_subset (snd (lnth Ns k))))\" and\n    suc_n_length: \"enat n < llength Ns\" and suc_nth_d_is: \"lnth Ns n = (T2, N2)\"\n    by (metis less_antisym old.prod.exhaust zero_less_Suc)\n  then have i_in_t2: \"to_F \\<iota> \\<in> T2\" by simp\n  have \"\\<exists>p\\<ge>n. enat (Suc p) < llength Ns \\<and> to_F \\<iota> \\<in> (fst (lnth Ns p)) \\<and> to_F \\<iota> \\<notin> (fst (lnth Ns (Suc p)))\"\n  proof (rule ccontr)\n    assume\n      contra: \"\\<not> (\\<exists>p\\<ge>n. enat (Suc p) < llength Ns \\<and> to_F \\<iota> \\<in> (fst (lnth Ns p)) \\<and>\n                     to_F \\<iota> \\<notin> (fst (lnth Ns (Suc p))))\"\n    then have i_in_suc: \"p0 \\<ge> n \\<Longrightarrow> enat (Suc p0) < llength Ns \\<Longrightarrow> to_F \\<iota> \\<in> (fst (lnth Ns p0)) \\<Longrightarrow>\n        to_F \\<iota> \\<in> (fst (lnth Ns (Suc p0)))\" for p0\n      by blast\n    have \"p0 \\<ge> n \\<Longrightarrow> enat p0 < llength Ns \\<Longrightarrow> to_F \\<iota> \\<in> (fst (lnth Ns p0))\" for p0\n    proof (induction rule: nat_induct_at_least)\n      case base\n      then show ?case using i_in_t2 suc_nth_d_is\n        by simp\n    next\n      case (Suc p0)\n      assume p_bigger_n: \"n \\<le> p0\" and\n        induct_hyp: \"enat p0 < llength Ns \\<Longrightarrow> to_F \\<iota> \\<in> fst (lnth Ns p0)\" and\n        sucsuc_smaller_d: \"enat (Suc p0) < llength Ns\"\n      have suc_p_bigger_n: \"n \\<le> p0\" using p_bigger_n by simp\n      have suc_smaller_d: \"enat p0 < llength Ns\"\n        using sucsuc_smaller_d Suc_ile_eq dual_order.strict_implies_order by blast\n      then have \"to_F \\<iota> \\<in> fst (lnth Ns p0)\" using induct_hyp by blast\n      then show ?case using i_in_suc[OF suc_p_bigger_n sucsuc_smaller_d] by blast\n    qed\n    then have i_in_all_bigger_n: \"\\<forall>j. j \\<ge> n \\<and> enat j < llength Ns \\<longrightarrow> to_F \\<iota> \\<in> (fst (lnth Ns j))\"\n      by presburger\n    have \"llength (lmap fst Ns) = llength Ns\" by force\n    then have \"to_F \\<iota> \\<in> \\<Inter> (lnth (lmap fst Ns) ` {j. n \\<le> j \\<and> enat j < llength (lmap fst Ns)})\"\n      using i_in_all_bigger_n using Suc_le_D by auto\n    then have \"to_F \\<iota> \\<in> Liminf_llist (lmap fst Ns)\"\n      unfolding Liminf_llist_def using suc_n_length by auto\n    then show False using final_schedule by fast\n  qed\n  then obtain p where p_greater_n: \"p \\<ge> n\" and p_smaller_d: \"enat (Suc p) < llength Ns\" and\n    i_in_p: \"to_F \\<iota> \\<in> (fst (lnth Ns p))\" and i_notin_suc_p: \"to_F \\<iota> \\<notin> (fst (lnth Ns (Suc p)))\"\n    by blast\n  have p_neq_n: \"Suc p \\<noteq> n\" using i_notin_suc_p i_in_suc_n by blast\n  have step_p: \"lnth Ns p \\<leadsto>LGC lnth Ns (Suc p)\" using deriv p_smaller_d chain_lnth_rel by blast\n  then have \"\\<exists>T1 T2 \\<iota> N2 N1 M. lnth Ns p = (T1, N1) \\<and> lnth Ns (Suc p) = (T2, N2) \\<and>\n      T1 = T2 \\<union> {\\<iota>} \\<and> N2 = N1 \\<union> M \\<and> active_subset M = {} \\<and>\n      \\<iota> \\<in> no_labels.Red_I_\\<G> (fst ` (N1 \\<union> M))\"\n  proof -\n    have ci_or_do: \"(\\<exists>T1 T2 \\<iota> N2 N1 M. lnth Ns p = (T1, N1) \\<and> lnth Ns (Suc p) = (T2, N2) \\<and>\n        T1 = T2 \\<union> {\\<iota>} \\<and> N2 = N1 \\<union> M \\<and> active_subset M = {} \\<and>\n        \\<iota> \\<in> no_labels.Red_I_\\<G> (fst ` (N1 \\<union> M))) \\<or>\n        (\\<exists>T1 T2 T' N. lnth Ns p = (T1, N) \\<and> lnth Ns (Suc p) = (T2, N) \\<and>\n        T1 = T2 \\<union> T' \\<and> T' \\<inter> no_labels.Inf_from (fst ` active_subset N) = {})\"\n      using step.simps[of \"lnth Ns p\" \"lnth Ns (Suc p)\"] step_p i_in_p i_notin_suc_p by fastforce\n    then have p_greater_n_strict: \"n < Suc p\"\n      using suc_nth_d_is p_greater_n i_in_t2 i_notin_suc_p le_eq_less_or_eq by force\n    have \"m > 0 \\<Longrightarrow> j \\<in> {0..<m} \\<Longrightarrow> prems_of (to_F \\<iota>) ! j \\<in> fst ` active_subset (snd (lnth Ns p))\"\n      for j\n    proof -\n      fix j\n      assume\n        m_pos: \"m > 0\" and\n        j_in: \"j \\<in> {0..<m}\"\n      then have \"prems_of \\<iota> ! j \\<in> (active_subset (snd (lnth Ns p)))\"\n        using all_prems_active_after[OF m_pos] p_smaller_d m_def p_greater_n p_neq_n\n        by (meson Suc_ile_eq atLeastLessThan_iff dual_order.strict_implies_order nth_mem\n            p_greater_n_strict)\n      then have \"fst (prems_of \\<iota> ! j) \\<in> fst ` active_subset (snd (lnth Ns p))\"\n        by blast\n      then show \"prems_of (to_F \\<iota>) ! j \\<in> fst ` active_subset (snd (lnth Ns p))\"\n        unfolding to_F_def using j_in m_def by simp\n    qed\n    then have prems_i_active_p: \"m > 0 \\<Longrightarrow>\n        to_F \\<iota> \\<in> no_labels.Inf_from (fst ` active_subset (snd (lnth Ns p)))\"\n      using i_in_F unfolding no_labels.Inf_from_def\n      by (smt atLeast0LessThan in_set_conv_nth lessThan_iff m_def_F mem_Collect_eq subsetI)\n    have \"m = 0 \\<Longrightarrow> (\\<exists>T1 T2 \\<iota> N2 N1 M. lnth Ns p = (T1, N1) \\<and> lnth Ns (Suc p) = (T2, N2) \\<and>\n        T1 = T2 \\<union> {\\<iota>} \\<and> N2 = N1 \\<union> M \\<and> active_subset M = {} \\<and>\n        \\<iota> \\<in> no_labels.Red_I_\\<G> (fst ` (N1 \\<union> M)))\"\n      using ci_or_do premise_free_inf_always_from[of \"to_F \\<iota>\" \"fst ` active_subset _\", OF i_in_F]\n        m_def i_in_p i_notin_suc_p m_def_F by auto\n    then show \"(\\<exists>T1 T2 \\<iota> N2 N1 M. lnth Ns p = (T1, N1) \\<and> lnth Ns (Suc p) = (T2, N2) \\<and>\n        T1 = T2 \\<union> {\\<iota>} \\<and> N2 = N1 \\<union> M \\<and> active_subset M = {} \\<and>\n        \\<iota> \\<in> no_labels.Red_I_\\<G> (fst ` (N1 \\<union> M)))\"\n      using ci_or_do i_in_p i_notin_suc_p prems_i_active_p unfolding active_subset_def by force\n  qed\n  then obtain T1p T2p N1p N2p Mp where  \"lnth Ns p = (T1p, N1p)\" and\n    suc_p_is: \"lnth Ns (Suc p) = (T2p, N2p)\" and \"T1p = T2p \\<union> {to_F \\<iota>}\" and \"T2p \\<inter> {to_F \\<iota>} = {}\" and\n    n2p_is: \"N2p = N1p \\<union> Mp\"and \"active_subset Mp = {}\" and\n    i_in_red_inf: \"to_F \\<iota> \\<in> no_labels.Red_I_\\<G>\n        (fst ` (N1p \\<union> Mp))\"\n    using i_in_p i_notin_suc_p by fastforce\n  have \"to_F \\<iota> \\<in> no_labels.Red_I (fst ` (snd (lnth Ns (Suc p))))\"\n    using i_in_red_inf suc_p_is n2p_is by fastforce\n  then have \"\\<forall>q \\<in> Q. (\\<G>_I_q q (to_F \\<iota>) \\<noteq> None \\<and>\n      the (\\<G>_I_q q (to_F \\<iota>)) \\<subseteq> Red_I_q q (\\<Union> (\\<G>_F_q q ` fst ` snd (lnth Ns (Suc p)))))\n      \\<or> (\\<G>_I_q q (to_F \\<iota>) = None \\<and>\n      \\<G>_F_q q (concl_of (to_F \\<iota>)) \\<subseteq> \\<Union> (\\<G>_F_q q ` fst ` snd (lnth Ns (Suc p))) \\<union>\n        Red_F_q q (\\<Union> (\\<G>_F_q q ` fst ` snd (lnth Ns (Suc p)))))\"\n    unfolding to_F_def no_labels.Red_I_def no_labels.Red_I_\\<G>_q_def by blast\n  then have \"\\<iota> \\<in> Red_I_\\<G> (snd (lnth Ns (Suc p)))\"\n    using i_in_inf_fl unfolding Red_I_\\<G>_def Red_I_\\<G>_q_def by (simp add: to_F_def)\n  then show \"\\<iota> \\<in> Sup_llist (lmap Red_I_\\<G> (lmap snd Ns))\"\n    unfolding Sup_llist_def using suc_n_length p_smaller_d by auto\nqed\n\ntheorem lgc_complete_Liminf:\n  assumes\n    deriv: \"chain (\\<leadsto>LGC) Ns\" and\n    init_state: \"active_subset (snd (lhd Ns)) = {}\" and\n    final_state: \"passive_subset (Liminf_llist (lmap snd Ns)) = {}\" and\n    no_prems_init: \"\\<forall>\\<iota> \\<in> Inf_F. prems_of \\<iota> = [] \\<longrightarrow> \\<iota> \\<in> fst (lhd Ns)\" and\n    final_schedule: \"Liminf_llist (lmap fst Ns) = {}\" and\n    b_in: \"B \\<in> Bot_F\" and\n    bot_entailed: \"no_labels.entails_\\<G> (fst ` snd (lhd Ns)) {B}\"\n  shows \"\\<exists>BL \\<in> Bot_FL. BL \\<in> Liminf_llist (lmap snd Ns)\"\nproof -\n  have labeled_b_in: \"(B, active) \\<in> Bot_FL\" using b_in by simp\n  have simp_snd_lmap: \"lhd (lmap snd Ns) = snd (lhd Ns)\"\n    by (rule llist.map_sel(1)[OF chain_not_lnull[OF deriv]])\n  have labeled_bot_entailed: \"entails_\\<G>_L (snd (lhd Ns)) {(B, active)}\"\n    using labeled_entailment_lifting bot_entailed by fastforce\n  have \"fair (lmap snd Ns)\"\n    using lgc_fair[OF deriv init_state final_state no_prems_init final_schedule] .\n  then show ?thesis\n    using dynamically_complete_Liminf labeled_b_in lgc_to_red[OF deriv]\n      labeled_bot_entailed simp_snd_lmap std_Red_I_eq\n    by presburger\nqed\n\n(* thm:lgc-completeness *)\ntheorem lgc_complete:\n  assumes\n    deriv: \"chain (\\<leadsto>LGC) Ns\" and\n    init_state: \"active_subset (snd (lhd Ns)) = {}\" and\n    final_state: \"passive_subset (Liminf_llist (lmap snd Ns)) = {}\" and\n    no_prems_init: \"\\<forall>\\<iota> \\<in> Inf_F. prems_of \\<iota> = [] \\<longrightarrow> \\<iota> \\<in> fst (lhd Ns)\" and\n    final_schedule: \"Liminf_llist (lmap fst Ns) = {}\" and\n    b_in: \"B \\<in> Bot_F\" and\n    bot_entailed: \"no_labels.entails_\\<G> (fst ` snd (lhd Ns)) {B}\"\n  shows \"\\<exists>i. enat i < llength Ns \\<and> (\\<exists>BL \\<in> Bot_FL. BL \\<in> snd (lnth Ns i))\"\nproof -\n  have \"\\<exists>BL\\<in>Bot_FL. BL \\<in> Liminf_llist (lmap snd Ns)\"\n    using assms by (rule lgc_complete_Liminf)\n  then show ?thesis\n    unfolding Liminf_llist_def by auto\nqed\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Saturation_Framework/Given_Clause_Architectures.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3464639026463391}}
{"text": "(*  Title:      HOL/Library/Phantom_Type.thy\n    Author:     Andreas Lochbihler\n*)\n\nsection \\<open>A generic phantom type\\<close>\n\ntheory Phantom_Type\nimports Main\nbegin\n\ndatatype ('a, 'b) phantom = phantom (of_phantom: 'b)\n\nlemma type_definition_phantom': \"type_definition of_phantom phantom UNIV\"\nby(unfold_locales) simp_all\n\nlemma phantom_comp_of_phantom [simp]: \"phantom \\<circ> of_phantom = id\"\n  and of_phantom_comp_phantom [simp]: \"of_phantom \\<circ> phantom = id\"\nby(simp_all add: o_def id_def)\n\nsyntax \"_Phantom\" :: \"type \\<Rightarrow> logic\" (\"(1Phantom/(1'(_')))\")\ntranslations\n  \"Phantom('t)\" => \"CONST phantom :: _ \\<Rightarrow> ('t, _) phantom\"\n\ntyped_print_translation \\<open>\n  let\n    fun phantom_tr' ctxt (Type (@{type_name fun}, [_, Type (@{type_name phantom}, [T, _])])) ts =\n          list_comb\n            (Syntax.const @{syntax_const \"_Phantom\"} $ Syntax_Phases.term_of_typ ctxt T, ts)\n      | phantom_tr' _ _ _ = raise Match;\n  in [(@{const_syntax phantom}, phantom_tr')] end\n\\<close>\n\nlemma of_phantom_inject [simp]:\n  \"of_phantom x = of_phantom y \\<longleftrightarrow> x = y\"\nby(cases x y rule: phantom.exhaust[case_product phantom.exhaust]) simp\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Library/Phantom_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5736784074525098, "lm_q1q2_score": 0.34646265258178166}}
{"text": "theory Substitution\nimports Terms\nbegin\n\ntext {* Defining a substitution function on terms turned out to be slightly tricky. *}\n\nfun subst_var :: \"var \\<Rightarrow> var \\<Rightarrow> var \\<Rightarrow> var\" (\"_[_::v=_]\" [1000,100,100] 1000)\n  where \"x[y ::v= z] = (if x = y then z else x)\"\n\n(* Helper lemmas provided by Christian Urban *)\n\n\n\nlemma Projr_permute:\n  assumes a: \"\\<exists>y. f = Inr y\"\n  shows \"(p \\<bullet> (Sum_Type.projr f)) = Sum_Type.projr (p \\<bullet> f)\"\nusing a by auto\n\nnominal_function  (default \"case_sum (\\<lambda>x. Inl undefined) (\\<lambda>x. Inr undefined)\",\n                  invariant \"\\<lambda> a r . (\\<forall> as y z . ((a = Inr (as, y, z) \\<and> atom ` domA as \\<sharp>* (y, z)) \\<longrightarrow> map (\\<lambda>x . atom (fst x))  (Sum_Type.projr r) = map (\\<lambda>x . atom (fst x)) as))\")\n  subst :: \"exp \\<Rightarrow> var \\<Rightarrow> var \\<Rightarrow> exp\" (\"_[_::=_]\" [1000,100,100] 1000)\nand\n  subst_heap :: \"heap \\<Rightarrow> var \\<Rightarrow> var \\<Rightarrow> heap\" (\"_[_::h=_]\" [1000,100,100] 1000)\nwhere\n  \"(Var x)[y ::= z] = Var (x[y ::v= z])\"\n |\"(App e v)[y ::= z] = App (e[y ::= z]) (v[y ::v= z])\"\n |\"atom ` domA as \\<sharp>* (y,z) \\<Longrightarrow> (Let as body)[y ::= z] = Let (as[y ::h= z]) (body[y ::= z])\" \n |\"atom x \\<sharp> (y,z) \\<Longrightarrow> (Lam [x].e)[y ::= z] = Lam [x].(e[y::=z])\"\n |\"[][y ::h= z] = []\"\n |\"((v,e)# as)[y ::h= z] = (v, e[y ::= z])# (as[y ::h= z])\"\nproof-\n\nhave eqvt_at_subst: \"\\<And> e y z . eqvt_at subst_subst_heap_sumC (Inl (e, y, z)) \\<Longrightarrow> eqvt_at (\\<lambda>(a, b, c). subst a b c) (e, y, z)\"\n  apply(simp add: eqvt_at_def subst_def)\n  apply(rule)\n  apply(subst Projl_permute)\n  apply(thin_tac \"?X\")+\n  apply (simp add: subst_subst_heap_sumC_def)\n  apply (simp add: THE_default_def)\n  apply (case_tac \"Ex1 (subst_subst_heap_graph (Inl (e, y, z)))\")\n  apply(simp)\n  apply(auto)[1]\n  apply (erule_tac x=\"x\" in allE)\n  apply simp\n  apply(cases rule: subst_subst_heap_graph.cases)\n  apply(assumption)\n  apply(rule_tac x=\"Sum_Type.projl x\" in exI)\n  apply(clarify)\n  apply (rule the1_equality)\n  apply blast \n  apply(simp (no_asm) only: sum.sel)\n  apply(rule_tac x=\"Sum_Type.projl x\" in exI)\n  apply(clarify)\n  apply (rule the1_equality)\n  apply blast \n  apply(simp (no_asm) only: sum.sel)\n  apply(rule_tac x=\"Sum_Type.projl x\" in exI)\n  apply(clarify)\n  apply (rule the1_equality)\n  apply blast \n  apply(simp (no_asm) only: sum.sel)\n  apply(rule_tac x=\"Sum_Type.projl x\" in exI)\n  apply(clarify)\n  apply (rule the1_equality)\n  apply blast \n  apply(simp (no_asm) only: sum.sel)\n  apply (metis Inr_not_Inl)\n  apply (metis Inr_not_Inl)\n  apply(simp)\n  apply(perm_simp)\n  apply(simp)\ndone\n\nhave eqvt_at_subst_heap: \"\\<And> as y z . eqvt_at subst_subst_heap_sumC (Inr (as, y, z)) \\<Longrightarrow> eqvt_at (\\<lambda>(a, b, c). subst_heap a b c) (as, y, z)\"\n  apply(simp add: eqvt_at_def subst_heap_def)\n  apply(rule)\n  apply(subst Projr_permute)\n  apply(thin_tac \"?X\")+\n  apply (simp add: subst_subst_heap_sumC_def)\n  apply (simp add: THE_default_def)\n  apply (case_tac \"Ex1 (subst_subst_heap_graph (Inr (as, y, z)))\")\n  apply(simp)\n  apply(auto)[1]\n  apply (erule_tac x=\"x\" in allE)\n  apply simp\n  apply(cases rule: subst_subst_heap_graph.cases)\n  apply(assumption)\n  apply (metis (mono_tags) Inr_not_Inl)+\n  apply(rule_tac x=\"Sum_Type.projr x\" in exI)\n  apply(clarify)\n  apply (rule the1_equality)\n  apply auto[1]\n  apply(simp (no_asm) only: sum.sel)\n  \n  apply(rule_tac x=\"Sum_Type.projr x\" in exI)\n  apply(clarify)\n  apply (rule the1_equality)\n  apply auto[1]\n  apply(simp (no_asm) only: sum.sel)\n  \n  apply(simp)\n  apply(perm_simp)\n  apply(simp)\ndone\n\n{\n(* Equivariance of the graph *)\ncase goal1 thus ?case\n  unfolding eqvt_def subst_subst_heap_graph_aux_def\n  by simp\n\n(* The invariant *)\nnext case goal2 thus ?case\n  by (induct rule: subst_subst_heap_graph.induct)(auto simp add: exp_assn.bn_defs fresh_star_insert)\n\n(* Exhaustiveness *)\nnext case (goal3 P x) show ?case\n  proof(cases x)\n  case (Inl a) thus P\n    proof(cases a)\n    case (fields a1 a2 a3)\n    thus P using Inl goal3\n      apply (rule_tac y =\"a1\" and c =\"(a2, a3)\" in exp_strong_exhaust)\n      apply (auto simp add: fresh_star_def)\n      apply metis\n    done\n  qed\n  next\n  case (Inr a) thus P\n    proof (cases a)\n    case (fields a1 a2 a3)\n    thus P using Inr goal3\n      by (metis heapToAssn.cases)\n  qed\nqed\n\nnext case (goal15 e y2 z2 as e2 y z as2) thus ?case\n  apply -\n  apply (drule eqvt_at_subst)+\n  apply (drule eqvt_at_subst_heap)+\n  apply (simp only: meta_eq_to_obj_eq[OF subst_def, symmetric, unfolded fun_eq_iff]\n    meta_eq_to_obj_eq[OF subst_heap_def, symmetric, unfolded fun_eq_iff])\n  (* No _sum any more at this point! *)\n  apply (auto simp add: Abs_fresh_iff)\n  apply (drule_tac\n    c = \"(y, z)\" and\n    as = \"(map (\\<lambda>x. atom (fst x)) e)\" and\n    bs = \"(map (\\<lambda>x. atom (fst x)) e2)\" and\n    f = \"\\<lambda> a b c . [a]lst. (subst (fst b) y z, subst_heap (snd b) y z )\" in Abs_lst_fcb2)\n  apply (simp add: perm_supp_eq fresh_Pair fresh_star_def Abs_fresh_iff)\n  apply (metis domA_def image_image image_set)\n  apply (metis domA_def image_image image_set)\n  apply (simp add: eqvt_at_def, simp add: fresh_star_Pair perm_supp_eq)\n  apply (simp add: eqvt_at_def, simp add: fresh_star_Pair perm_supp_eq)\n  apply (simp add: eqvt_at_def)\n  done\n\nnext case (goal19 x2 y2 z2 e2 x y z e) thus ?case\n  apply -\n  apply (drule eqvt_at_subst)+\n  apply (simp only: Abs_fresh_iff meta_eq_to_obj_eq[OF subst_def, symmetric, unfolded fun_eq_iff])\n  (* No _sum any more at this point! *)\n  apply (simp add: eqvt_at_def)\n  apply rule\n  apply (erule_tac x = \"(x2 \\<leftrightarrow> c)\" in allE)\n  apply (erule_tac x = \"(x \\<leftrightarrow> c)\" in allE)\n  apply auto\n  done\n}\nqed(auto)\n\nnominal_termination (eqvt) by lexicographic_order\n\nlemma shows\n  True and bn_subst[simp]: \"domA (subst_heap as y z) = domA as\"\nby(induct rule:subst_subst_heap.induct)\n  (auto simp add: exp_assn.bn_defs fresh_star_insert)\n\nlemma subst_noop[simp]:\nshows \"e[y ::= y] = e\" and \"as[y::h=y]= as\"\nby(induct e y y and as y y rule:subst_subst_heap.induct)\n  (auto simp add:fresh_star_Pair exp_assn.bn_defs)\n\nlemma subst_is_fresh[simp]:\nassumes \"atom y \\<sharp> z\"\nshows\n  \"atom y \\<sharp> e[y ::= z]\"\nand\n \"atom ` domA as \\<sharp>* y \\<Longrightarrow> atom y \\<sharp> as[y::h=z]\"\nusing assms\nby(induct e y z and as y z rule:subst_subst_heap.induct)\n  (auto simp add:fresh_at_base fresh_star_Pair fresh_star_insert fresh_Nil fresh_Cons)\n\nlemma\n subst_pres_fresh: \"x \\<sharp> e \\<Longrightarrow> x \\<sharp> z \\<Longrightarrow> x \\<sharp> e[y ::= z]\"\nand\n \"x \\<sharp> \\<Gamma> \\<Longrightarrow> x \\<sharp> z \\<Longrightarrow> x \\<notin> atom ` domA \\<Gamma> \\<Longrightarrow> x \\<sharp> (\\<Gamma>[y ::h= z])\"\nby(induct e y z and \\<Gamma> y z rule:subst_subst_heap.induct)\n  (auto simp add:fresh_star_Pair exp_assn.bn_defs fresh_Cons)\n\nlemma subst_fresh_noop: \"atom x \\<sharp> e \\<Longrightarrow> e[x ::= y] = e\"\n  and subst_heap_fresh_noop: \"atom x \\<sharp> \\<Gamma> \\<Longrightarrow>  \\<Gamma>[x ::h= y] = \\<Gamma>\"\nby (nominal_induct  e and \\<Gamma> avoiding: x y rule:exp_heap_strong_induct)\n  (auto simp add: fresh_star_def fresh_Pair fresh_at_base fresh_Cons simp del: exp_assn.eq_iff)\n\nlemma supp_subst: \"supp (e[y::=x]) \\<subseteq> (supp e - {atom y}) \\<union> supp x\"\nproof-\n  have \"\\<And> a. (a \\<sharp> e \\<or> a = atom y) \\<Longrightarrow> a \\<sharp> x \\<Longrightarrow> a \\<sharp> e[y::=x]\"\n    by (auto intro: subst_pres_fresh)\n  thus ?thesis by (auto simp add: fresh_def)\nqed\n\nlemma fv_subst_subset: \"fv (e[y ::= x]) \\<subseteq> (fv e - {y}) \\<union> {x}\"\nproof-\n  have \"fv (e[y ::= x]) = {v. atom v \\<in> supp (e[y ::= x])}\" unfolding fv_def..\n  also have \"\\<dots> \\<subseteq> {v. atom v \\<in> ((supp e - {atom y}) \\<union> supp x)}\"\n    using supp_subst by auto\n  also have \"\\<dots> = (fv e - {y}) \\<union> {x}\"\n    using supp_subst by (auto simp add: fv_def supp_at_base)\n  finally show ?thesis.\nqed\n\nlemma fresh_star_at_base:\n  fixes x :: \"'a :: at_base\"\n  shows \"S \\<sharp>* x \\<longleftrightarrow> atom x \\<notin> S\"\n  by (metis fresh_at_base(2) fresh_star_def)\n\nlemma subst_swap_same: \"atom x \\<sharp> e \\<Longrightarrow>  (x \\<leftrightarrow> y) \\<bullet> e = e[y ::=x]\"\n  and \"atom x \\<sharp> \\<Gamma> \\<Longrightarrow> atom `domA \\<Gamma> \\<sharp>* y \\<Longrightarrow> (x \\<leftrightarrow> y) \\<bullet> \\<Gamma> = \\<Gamma>[y ::h= x]\"\nby(nominal_induct  e and \\<Gamma> avoiding: x y rule:exp_heap_strong_induct)\n  (auto simp add: fresh_star_Pair fresh_star_at_base fresh_Cons simp del: exp_assn.eq_iff)\n\nlemma subst_subst_back: \"atom x \\<sharp> e \\<Longrightarrow>  e[y::=x][x::=y] = e\" \n  and \"atom x \\<sharp> \\<Gamma> \\<Longrightarrow> atom `domA \\<Gamma> \\<sharp>* y  \\<Longrightarrow> \\<Gamma>[y::h=x][x::h=y] = \\<Gamma>\"\nby(nominal_induct  e and \\<Gamma> avoiding: x y rule:exp_heap_strong_induct)\n  (auto simp add: fresh_star_Pair fresh_star_at_base fresh_star_Cons fresh_Cons  exp_assn.bn_defs simp del: exp_assn.eq_iff)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Launchbury/Substitution.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3464626525817816}}
{"text": "theory Scratch\n  imports \"../DP_Consistency\"\nbegin\nterm int\nterm fold\n  \ncontext dp_consistency\nbegin\ncontext\n  includes lifting_syntax\nbegin\nterm 0 (**)\n\n\ndefinition ceq :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> ('param \\<rightharpoonup> 'result, 'a) state \\<Rightarrow> ('param \\<rightharpoonup> 'result, 'a) state \\<Rightarrow> bool\" where\n  \"ceq R s0 s1 \\<equiv> (eq_onp cmem ===> rel_prod R (eq_onp cmem)) (runState s0) (runState s1)\"\n  \nlemma ceq_intro:\n  fixes R s0 s1\n  assumes \"\\<And>M v0 M0 v1 M1. \\<lbrakk>cmem M; runState s0 M = (v0,M0); runState s1 M = (v1,M1)\\<rbrakk> \\<Longrightarrow> R v0 v1 \\<and> M0=M1 \\<and> cmem M1\"\n  shows \"ceq R s0 s1\"\n  unfolding ceq_def eq_onp_def rel_fun_def rel_prod_conv by (auto split: prod.split dest: assms)\nterm 0 (**)\n\nlemma ceq_elim:\n  fixes R s0 s1\n  assumes \"ceq R s0 s1\" \"cmem M\"\n  obtains v0 M0 v1 M1 where \"runState s0 M = (v0, M0)\" \"runState s1 M = (v1, M1)\" \"R v0 v1\" \"M0=M1\" \"cmem M1\"\n  using assms unfolding ceq_def eq_onp_def rel_fun_def by (blast elim: rel_prod.cases)\n    \nterm 0 (**)\n  \nlemma id\\<^sub>T_cong:\n  fixes R x y\n  shows \"(R ===> ceq R) return return\"\n  unfolding rel_fun_def return_def by (fastforce intro: ceq_intro)\nthm id\\<^sub>T_cong[THEN rel_funD]\nterm 0 (**)\n  \nlemma bind_cong[transfer_rule]:\n  fixes R0 R1\n  shows \"(ceq R0 ===> (R0 ===> ceq R1) ===> ceq R1) (op \\<bind>) (op \\<bind>)\"\n  unfolding rel_fun_def bind_def by (fastforce intro!: ceq_intro elim!: ceq_elim)\nthm bind_cong[THEN rel_funD, THEN rel_funD]\nterm 0 (**)\n\nlemma app\\<^sub>T_cong[transfer_rule]:\n  shows \"(ceq (R0 ===> ceq R1) ===> ceq R0 ===> ceq R1) (op .) (op .)\"\n  unfolding fun_app_lifted_def by transfer_prover\nthm app\\<^sub>T_cong[THEN rel_funD, THEN rel_funD]\nterm 0 (**)\n  \nlemma map\\<^sub>T_cong:\n  assumes \"ceq R0 xs\\<^sub>T ys\\<^sub>T\"\n  assumes \"\\<And>M. cmem M \\<Longrightarrow> case (runState f\\<^sub>T M, runState g\\<^sub>T M) of ((f, Mf), (g, Mg)) \\<Rightarrow>\n            Mf = Mg \\<and> cmem Mg \\<and> (case runState ys\\<^sub>T Mg of (ys, Mys) \\<Rightarrow> (\\<forall>x\\<in>set ys. ceq R1 (f x) (g x)))\"\n  shows \"ceq (list_all2 R1) (map\\<^sub>T . f\\<^sub>T . xs\\<^sub>T) (map\\<^sub>T . g\\<^sub>T . ys\\<^sub>T)\"\n  oops\n    \nlemma\n  assumes \"ceq R0 xs\\<^sub>T ys\\<^sub>T\"\n  assumes \"\\<And>M. cmem M \\<Longrightarrow> case (runState f\\<^sub>T M, runState g\\<^sub>T M) of ((f, Mf), (g, Mg)) \\<Rightarrow>\n            Mf = Mg \\<and> cmem Mg \\<and> (case runState ys\\<^sub>T Mg of (ys, Mys) \\<Rightarrow> (\\<forall>x\\<in>set ys. ceq R1 (f x) (g x)))\"\n  assumes \"ceq (\\<lambda>f g. (\\<forall>M. cmem M \\<longrightarrow> )) f\\<^sub>T g\\<^sub>T\"\n  shows \"ceq (list_all2 R1) (map\\<^sub>T . f\\<^sub>T . xs\\<^sub>T) (map\\<^sub>T . g\\<^sub>T . ys\\<^sub>T)\"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n", "meta": {"author": "exprosic", "repo": "praktikum-dp2", "sha": "49a8f1cdca6dadfac0d667aab0bebb2431f2a822", "save_path": "github-repos/isabelle/exprosic-praktikum-dp2", "path": "github-repos/isabelle/exprosic-praktikum-dp2/praktikum-dp2-49a8f1cdca6dadfac0d667aab0bebb2431f2a822/scratch/Scratch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.546738151984614, "lm_q1q2_score": 0.3463095570113094}}
{"text": "theory CallArityEnd2EndSafe\nimports CallArityEnd2End CardArityTransformSafe CoCallImplSafe CoCallImplTTreeSafe TTreeImplCardinalitySafe\nbegin\n\nlocale CallArityEnd2EndSafe\nbegin\nsublocale CoCallImplSafe.\nsublocale CallArityEnd2End.\n\nabbreviation transform_syn' (\"\\<T>\\<^bsub>_\\<^esub>\") where \"\\<T>\\<^bsub>a\\<^esub> \\<equiv> transform a\"\n\nlemma end2end:\n  \"c \\<Rightarrow>\\<^sup>* c' \\<Longrightarrow>\n  \\<not> boring_step c' \\<Longrightarrow>\n  heap_upds_ok_conf c \\<Longrightarrow>\n  consistent (ae, ce, a, as, r) c \\<Longrightarrow>\n  \\<exists>ae' ce' a' as' r'. consistent  (ae', ce', a', as', r') c' \\<and> conf_transform  (ae, ce, a, as, r) c \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform  (ae', ce', a', as', r') c'\"\n  by (rule card_arity_transform_safe)\n\ntheorem end2end_closed:\n  assumes closed: \"fv e = ({} :: var set)\"\n  assumes \"([], e, []) \\<Rightarrow>\\<^sup>* (\\<Gamma>,v,[])\" and \"isVal v\"\n  obtains \\<Gamma>' and v'\n  where \"([], \\<T>\\<^bsub>0\\<^esub> e, []) \\<Rightarrow>\\<^sup>* (\\<Gamma>',v',[])\" and \"isVal v'\"\n    and \"card (domA \\<Gamma>') \\<le> card (domA \\<Gamma>)\"\nproof-\n  note assms(2)\n  moreover\n  have \"\\<not> boring_step (\\<Gamma>,v,[])\" by (simp add: boring_step.simps)\n  moreover\n  have \"heap_upds_ok_conf ([], e, [])\" by simp\n  moreover\n  have \"consistent (\\<bottom>,\\<bottom>,0,[],[]) ([], e, [])\" using closed by (rule closed_consistent)\n  ultimately\n  obtain ae ce a as r where\n    *: \"consistent  (ae, ce, a, as, r) (\\<Gamma>,v,[])\" and\n    **: \"conf_transform  (\\<bottom>, \\<bottom>, 0, [], []) ([],e,[]) \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae, ce, a, as, r) (\\<Gamma>,v,[])\"\n    by (metis end2end)\n\n  let ?\\<Gamma> = \"map_transform Aeta_expand ae (map_transform transform ae (restrictA (-set r) \\<Gamma>))\"\n  let ?v = \"transform a v\"\n\n  from * have \"set r \\<subseteq> domA \\<Gamma>\" by auto\n\n  have \"conf_transform  (\\<bottom>, \\<bottom>, 0, [], []) ([],e,[]) = ([],transform 0 e,[])\" by simp\n  with **\n  have \"([], transform 0 e, []) \\<Rightarrow>\\<^sub>G\\<^sup>* (?\\<Gamma>, ?v, map Dummy (rev r))\" by simp\n\n  have \"isVal ?v\" using \\<open>isVal v\\<close> by simp\n\n  have \"fv (transform 0 e) = ({} :: var set)\" using closed\n    by (auto dest: subsetD[OF fv_transform])\n\n  note sestoftUnGC'[OF \\<open>([], transform 0 e, []) \\<Rightarrow>\\<^sub>G\\<^sup>* (?\\<Gamma>, ?v, map Dummy (rev r))\\<close> \\<open>isVal ?v\\<close> \\<open>fv (transform 0 e) = {}\\<close>]\n  then obtain \\<Gamma>'\n    where \"([], transform 0 e, []) \\<Rightarrow>\\<^sup>* (\\<Gamma>', ?v, [])\"\n    and \"?\\<Gamma> = restrictA (- set r) \\<Gamma>'\"\n    and \"set r \\<subseteq> domA \\<Gamma>'\"\n    by auto\n\n  have \"card (domA \\<Gamma>) = card (domA ?\\<Gamma> \\<union> (set r \\<inter> domA \\<Gamma>))\"\n    by (rule arg_cong[where f = card]) auto\n  also have \"\\<dots> = card (domA ?\\<Gamma>) + card (set r \\<inter> domA \\<Gamma>)\"\n    by (rule card_Un_disjoint) auto\n  also note \\<open>?\\<Gamma> = restrictA (- set r) \\<Gamma>'\\<close>\n  also have \"set r \\<inter> domA \\<Gamma> = set r \\<inter> domA \\<Gamma>'\"\n    using \\<open>set r \\<subseteq> domA \\<Gamma>\\<close>  \\<open>set r \\<subseteq> domA \\<Gamma>'\\<close> by auto\n  also have \"card (domA (restrictA (- set r) \\<Gamma>')) + card (set r \\<inter> domA \\<Gamma>') = card (domA \\<Gamma>')\"\n    by (subst card_Un_disjoint[symmetric]) (auto intro: arg_cong[where f = card])\n  finally\n  have \"card (domA \\<Gamma>') \\<le> card (domA \\<Gamma>)\" by simp\n  with \\<open>([], transform 0 e, []) \\<Rightarrow>\\<^sup>* (\\<Gamma>', ?v, [])\\<close>  \\<open>isVal ?v\\<close>\n  show thesis using that by blast\nqed\n\nlemma fresh_var_eqE[elim_format]: \"fresh_var e = x \\<Longrightarrow> x \\<notin>  fv e\"\n  by (metis fresh_var_not_free)\n\nlemma example1:\n  fixes e :: exp\n  fixes f g x y z :: var\n  assumes Aexp_e: \"\\<And>a. Aexp e\\<cdot>a = esing x\\<cdot>(up\\<cdot>a) \\<squnion> esing y\\<cdot>(up\\<cdot>a)\"\n  assumes ccExp_e: \"\\<And>a. CCexp e\\<cdot>a = \\<bottom>\"\n  assumes [simp]: \"transform 1 e = e\"\n  assumes \"isVal e\"\n  assumes disj: \"y \\<noteq> f\" \"y \\<noteq> g\" \"x \\<noteq> y\" \"z \\<noteq> f\" \"z \\<noteq> g\" \"y \\<noteq> x\"\n  assumes fresh: \"atom z \\<sharp> e\"\n  shows \"transform 1 (let y be  App (Var f) g in (let x be e in (Var x))) = \n         let y be (Lam [z]. App (App (Var f) g) z) in (let x be (Lam [z]. App e z) in (Var x))\"\nproof-\n  from arg_cong[where f = edom, OF Aexp_e]\n  have \"x \\<in> fv e\" by simp (metis Aexp_edom' insert_subset)\n  hence [simp]: \"\\<not> nonrec [(x,e)]\"\n    by (simp add: nonrec_def)\n \n  from \\<open>isVal e\\<close>\n  have [simp]: \"thunks [(x, e)] = {}\"\n    by (simp add: thunks_Cons)\n\n  have [simp]: \"CCfix [(x, e)]\\<cdot>(esing x\\<cdot>(up\\<cdot>1) \\<squnion> esing y\\<cdot>(up\\<cdot>1), \\<bottom>) = \\<bottom>\"\n    unfolding CCfix_def\n    apply (simp add: fix_bottom_iff ccBindsExtra_simp)\n    apply (simp add: ccBind_eq disj ccExp_e)\n    done\n\n  have [simp]: \"Afix [(x, e)]\\<cdot>(esing x\\<cdot>(up\\<cdot>1)) = esing x\\<cdot>(up\\<cdot>1) \\<squnion> esing y\\<cdot>(up\\<cdot>1)\"\n    unfolding Afix_def\n    apply simp\n    apply (rule fix_eqI)\n    apply (simp add: disj Aexp_e)\n    apply (case_tac \"z x\")\n    apply (auto simp add: disj Aexp_e)\n    done\n\n  have [simp]: \"Aheap [(y, App (Var f) g)] (let x be e in Var x)\\<cdot>1 = esing y\\<cdot>((Aexp (let x be e in Var x )\\<cdot>1) y)\"\n    by (auto simp add:  Aheap_nonrec_simp ABind_nonrec_eq pure_fresh fresh_at_base disj)\n\n  have [simp]: \"(Aexp (let x be e in Var x)\\<cdot>1) = esing y\\<cdot>(up\\<cdot>1)\"\n    by (simp add: env_restr_join disj)\n    \n  have [simp]: \"Aheap [(x, e)] (Var x)\\<cdot>1 = esing x\\<cdot>(up\\<cdot>1)\"\n    by (simp add: env_restr_join disj)\n\n  have [simp]: \"Aeta_expand 1 (App (Var f) g) = (Lam [z]. App (App (Var f) g) z)\"\n    apply (simp add: one_is_inc_zero del: exp_assn.eq_iff)\n    apply (subst change_Lam_Variable[of z \"fresh_var (App (Var f) g)\"])\n    apply (auto simp add: fresh_Pair fresh_at_base pure_fresh disj intro!: flip_fresh_fresh  elim!: fresh_var_eqE)\n    done\n\n  have [simp]: \"Aeta_expand 1 e = (Lam [z]. App e z)\"\n    apply (simp add: one_is_inc_zero del: exp_assn.eq_iff)\n    apply (subst change_Lam_Variable[of z \"fresh_var e\"])\n    apply (auto simp add: fresh_Pair fresh_at_base pure_fresh disj fresh intro!: flip_fresh_fresh  elim!: fresh_var_eqE)\n    done\n\n  show ?thesis\n    by (simp del: Let_eq_iff add: map_transform_Cons disj[symmetric])\nqed\n\n\nend\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/CallArityEnd2EndSafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.63341026367784, "lm_q2_score": 0.546738151984614, "lm_q1q2_score": 0.3463095570113093}}
{"text": "theory Inca_to_Ubx_compiler\n  imports Inca_to_Ubx_simulation Result\n    Inca_Verification\n    \"VeriComp.Compiler\"\n    \"HOL-Library.Monad_Syntax\"\nbegin\n\nsection \\<open>Generic program rewriting\\<close>\n\nprimrec monadic_fold_map where\n  \"monadic_fold_map f acc [] = Some (acc, [])\" |\n  \"monadic_fold_map f acc (x # xs) = do {\n    (acc', x') \\<leftarrow> f acc x;\n    (acc'', xs') \\<leftarrow> monadic_fold_map f acc' xs;\n    Some (acc'', x' # xs')\n  }\"\n\nlemma monadic_fold_map_length:\n  \"monadic_fold_map f acc xs = Some (acc', xs') \\<Longrightarrow> length xs = length xs'\"\n  by (induction xs arbitrary: acc xs') (auto simp: bind_eq_Some_conv)\n\nlemma monadic_fold_map_ConsD[dest]:\n  assumes \"monadic_fold_map f a (x # xs) = Some (c, ys)\"\n  shows \"\\<exists>y ys' b. ys = y # ys' \\<and> f a x = Some (b, y) \\<and> monadic_fold_map f b xs = Some (c, ys')\"\n  using assms\n  by (auto simp add: bind_eq_Some_conv)\n\nlemma monadic_fold_map_eq_Some_conv:\n  \"monadic_fold_map f a (x # xs) = Some (c, ys) \\<longleftrightarrow>\n    (\\<exists>y ys' b. f a x = Some (b, y) \\<and> monadic_fold_map f b xs = Some (c, ys') \\<and> ys = y # ys')\"\n  by (auto simp add: bind_eq_Some_conv)\n\nlemma monadic_fold_map_eq_Some_conv':\n  \"monadic_fold_map f a (x # xs) = Some p \\<longleftrightarrow>\n    (\\<exists>y ys' b. f a x = Some (b, y) \\<and> monadic_fold_map f b xs = Some (fst p, ys') \\<and> snd p = y # ys')\"\n  by (cases p) (auto simp add: bind_eq_Some_conv)\n\nlemma monadic_fold_map_list_all2:\n  assumes \"monadic_fold_map f acc xs = Some (acc', ys)\" and\n    \"\\<And>acc acc' x y. f acc x = Some (acc', y) \\<Longrightarrow> P x y\"\n  shows \"list_all2 P xs ys\"\n  using assms(1)\nproof (induction xs arbitrary: acc ys)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons x xs)\n  show ?case\n    using Cons.prems\n    by (auto simp: bind_eq_Some_conv intro: assms(2) Cons.IH)\nqed\n\nlemma monadic_fold_map_list_all:\n  assumes \"monadic_fold_map f acc xs = Some (acc', ys)\" and\n    \"\\<And>acc acc' x y. f acc x = Some (acc', y) \\<Longrightarrow> P y\"\n  shows \"list_all P ys\"\nproof -\n  have \"list_all2 (\\<lambda>_. P) xs ys\"\n    using assms\n    by (auto elim: monadic_fold_map_list_all2)\n  thus ?thesis\n    by (auto elim: list_rel_imp_pred2)\nqed\n\nfun gen_pop_push where\n  \"gen_pop_push instr (domain, codomain) \\<Sigma> = (\n    let ar = length domain in\n    if ar \\<le> length \\<Sigma> \\<and> take ar \\<Sigma> = domain then\n      Some (instr, codomain @ drop ar \\<Sigma>)\n    else\n      None\n  )\"\n\ncontext inca_to_ubx_simulation begin\n\nsection \\<open>Lifting\\<close>\n\nfun lift_instr :: \"_ \\<Rightarrow> _ \\<Rightarrow> _ \\<Rightarrow> _ \\<Rightarrow> _ \\<Rightarrow> _ \\<Rightarrow>\n  ((_, _, _, _, _, _, 'opubx, 'ubx1, 'ubx2) Ubx.instr \\<times> _) option\" where\n  \"lift_instr F L ret N (Inca.IPush d) \\<Sigma> = Some (IPush d, None # \\<Sigma>)\" |\n  \"lift_instr F L ret N Inca.IPop (_ # \\<Sigma>) = Some (IPop, \\<Sigma>)\" |\n  \"lift_instr F L ret N (Inca.IGet n) \\<Sigma> = (if n < N then Some (IGet n, None # \\<Sigma>) else None)\" |\n  \"lift_instr F L ret N (Inca.ISet n) (None # \\<Sigma>) = (if n < N then Some (ISet n, \\<Sigma>) else None)\" |\n  \"lift_instr F L ret N (Inca.ILoad x) (None # \\<Sigma>) = Some (ILoad x, None # \\<Sigma>)\" |\n  \"lift_instr F L ret N (Inca.IStore x) (None # None # \\<Sigma>) = Some (IStore x, \\<Sigma>)\" |\n  \"lift_instr F L ret N (Inca.IOp op) \\<Sigma> =\n    gen_pop_push (IOp op) (replicate (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> op) None, [None]) \\<Sigma>\" |\n  \"lift_instr F L ret N (Inca.IOpInl opinl) \\<Sigma> =\n    gen_pop_push (IOpInl opinl) (replicate (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl)) None, [None]) \\<Sigma>\" |\n  \"lift_instr F L ret N (Inca.ICJump l\\<^sub>t l\\<^sub>f) [None] =\n    (if List.member L l\\<^sub>t \\<and> List.member L l\\<^sub>f then Some (ICJump l\\<^sub>t l\\<^sub>f, []) else None)\" |\n  \"lift_instr F L ret N (Inca.ICall f) \\<Sigma> = do {\n    (ar, ret) \\<leftarrow> F f;\n    gen_pop_push (ICall f) (replicate ar None, replicate ret None) \\<Sigma>\n  }\" |\n  \"lift_instr F L ret N Inca.IReturn \\<Sigma> =\n    (if \\<Sigma> = replicate ret None then Some (IReturn, []) else None)\" |\n  \"lift_instr _ _ _ _ _ _ = None\"\n\ndefinition lift_instrs where\n  \"lift_instrs F L ret N \\<equiv>\n    monadic_fold_map (\\<lambda>\\<Sigma> instr. map_option prod.swap (lift_instr F L ret N instr \\<Sigma>))\"\n\nlemma lift_instrs_length:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"length xs = length ys\"\n  using assms unfolding lift_instrs_def\n  by (auto intro: monadic_fold_map_length)\n\nlemma lift_instrs_not_Nil: \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys) \\<Longrightarrow> xs \\<noteq> [] \\<longleftrightarrow> ys \\<noteq> []\"\n  using lift_instrs_length by fastforce\n\nlemma lift_instrs_NilD[dest]:\n  assumes \"lift_instrs F L ret N \\<Sigma>i [] = Some (\\<Sigma>o, ys)\"\n  shows \"\\<Sigma>o = \\<Sigma>i \\<and> ys = []\"\n  using assms\n  by (simp_all add: lift_instrs_def)\n\nlemmas Some_eq_bind_conv =\n  bind_eq_Some_conv[unfolded eq_commute[of \"Option.bind f g\" \"Some x\" for f g x]]\n\nlemma lift_instr_is_jump:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Inca.is_jump x \\<longleftrightarrow> Ubx.is_jump y\"\n  using assms\n  by (rule lift_instr.elims)\n    (auto simp add: if_split_eq2 Let_def Some_eq_bind_conv)\n\nlemma lift_instr_is_return:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Inca.is_return x \\<longleftrightarrow> Ubx.is_return y\"\n  using assms\n  by (rule lift_instr.elims)\n    (auto simp add: if_split_eq2 Let_def Some_eq_bind_conv)\n\nlemma lift_instrs_all_not_jump_not_return:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows\n    \"list_all (\\<lambda>i. \\<not> Inca.is_jump i \\<and> \\<not> Inca.is_return i) xs \\<longleftrightarrow>\n     list_all (\\<lambda>i. \\<not> Ubx.is_jump i \\<and> \\<not> Ubx.is_return i) ys\"\n  using assms\nproof (induction xs arbitrary: \\<Sigma>i \\<Sigma>o ys)\n  case Nil\n  then show ?case by (simp add: lift_instrs_def)\nnext\n  case (Cons x xs)\n  from Cons.prems show ?case\n    apply (simp add: lift_instrs_def bind_eq_Some_conv)\n    apply (fold lift_instrs_def)\n    by (auto simp add: Cons.IH lift_instr_is_jump lift_instr_is_return)\nqed\n\nlemma lift_instrs_all_butlast_not_jump_not_return:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows\n    \"list_all (\\<lambda>i. \\<not> Inca.is_jump i \\<and> \\<not> Inca.is_return i) (butlast xs) \\<longleftrightarrow>\n     list_all (\\<lambda>i. \\<not> Ubx.is_jump i \\<and> \\<not> Ubx.is_return i) (butlast ys)\"\n  using lift_instrs_length[OF assms(1)] assms unfolding lift_instrs_def\nproof (induction xs ys arbitrary: \\<Sigma>i \\<Sigma>o rule: list_induct2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons x xs y ys)\n  thus ?case\n    by (auto simp add: bind_eq_Some_conv lift_instr_is_jump lift_instr_is_return)\nqed\n\nlemma lift_instr_sp:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.sp_instr F ret y \\<Sigma>i \\<Sigma>o\"\n  using assms\n  apply (induction F L ret N x \\<Sigma>i rule: lift_instr.induct;\n      auto simp: Let_def intro: Subx.sp_instr.intros)\n    apply (rule Subx.sp_instr.Op, metis append_take_drop_id)\n   apply (rule Subx.sp_instr.OpInl, metis append_take_drop_id)\n  apply (auto simp add: bind_eq_Some_conv intro!: Subx.sp_instr.Call, metis append_take_drop_id)\n  done\n\nlemma lift_instrs_sp:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"Subx.sp_instrs F ret ys \\<Sigma>i \\<Sigma>o\"\n  using assms unfolding lift_instrs_def\nproof (induction xs arbitrary: \\<Sigma>i \\<Sigma>o ys)\n  case Nil\n  thus ?case by (auto intro: Subx.sp_instrs.Nil)\nnext\n  case (Cons x xs)\n  from Cons.prems show ?case\n    by (auto simp add: bind_eq_Some_conv intro: Subx.sp_instrs.Cons lift_instr_sp Cons.IH)\nqed\n\nlemma lift_instr_fun_call_in_range:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.fun_call_in_range F y\"\n  using assms\n  by (induction F L ret N x \\<Sigma>i rule: lift_instr.induct) (auto simp: Let_def bind_eq_Some_conv)\n\nlemma lift_instrs_all_fun_call_in_range:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.fun_call_in_range F) ys\"\n  using assms unfolding lift_instrs_def\n  by (auto intro!: monadic_fold_map_list_all intro: lift_instr_fun_call_in_range)\n\nlemma lift_instr_local_var_in_range:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.local_var_in_range N y\"\n  using assms\n  by (induction F L ret N x \\<Sigma>i rule: lift_instr.induct) (auto simp: Let_def bind_eq_Some_conv)\n\nlemma lift_instrs_all_local_var_in_range:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.local_var_in_range N) ys\"\n  using assms unfolding lift_instrs_def\n  by (auto intro!: monadic_fold_map_list_all intro: lift_instr_local_var_in_range)\n\nlemma lift_instr_jump_in_range:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.jump_in_range (set L) y\"\n  using assms\n  by (induction F L ret N x \\<Sigma>i rule: lift_instr.induct)\n    (auto simp: Let_def bind_eq_Some_conv in_set_member)\n\nlemma lift_instrs_all_jump_in_range:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.jump_in_range (set L)) ys\"\n  using assms unfolding lift_instrs_def\n  by (auto intro!: monadic_fold_map_list_all intro: lift_instr_jump_in_range)\n\nlemma lift_instr_norm:\n  \"lift_instr F L ret N instr1 \\<Sigma>1 = Some (instr2, \\<Sigma>2) \\<Longrightarrow> norm_eq instr1 instr2\"\n  by (induction instr1 \\<Sigma>1 rule: lift_instr.induct) (auto simp: Let_def bind_eq_Some_conv)\n\nlemma lift_instrs_all_norm:\n  assumes \"lift_instrs F L ret N \\<Sigma>1 instrs1 = Some (\\<Sigma>2, instrs2)\"\n  shows \"list_all2 norm_eq instrs1 instrs2\"\n  using assms unfolding lift_instrs_def\n  by (auto simp: lift_instr_norm elim!: monadic_fold_map_list_all2)\n\n\nsection \\<open>Optimization\\<close>\n\ncontext\n  fixes load_oracle :: \"nat \\<Rightarrow> type option\"\nbegin\n\ndefinition orelse :: \"'a option \\<Rightarrow> 'a option \\<Rightarrow> 'a option\"  (infixr \"orelse\" 55) where\n  \"x orelse y = (case x of Some x' \\<Rightarrow> Some x' | None \\<Rightarrow> y)\"\n\nlemma None_orelse[simp]: \"None orelse y = y\"\n  by (simp add: orelse_def)\n\nlemma orelse_None[simp]: \"x orelse None = x\"\n  by (cases x) (simp_all add: orelse_def)\n\nlemma Some_orelse[simp]: \"Some x orelse y = Some x\"\n  by (simp add: orelse_def)\n\nlemma orelse_eq_Some_conv:\n  \"x orelse y = Some z \\<longleftrightarrow> (x = Some z \\<or> x = None \\<and> y = Some z)\"\n  by (cases x) simp_all\n\nlemma orelse_eq_SomeE:\n  assumes\n    \"x orelse y = Some z\" and\n    \"x = Some z \\<Longrightarrow> P\" and\n    \"x = None \\<Longrightarrow> y = Some z \\<Longrightarrow> P\"\n  shows \"P\"\n  using assms(1)\n  unfolding orelse_def\n  by (cases x; auto intro: assms(2,3))\n\nfun drop_prefix where\n  \"drop_prefix [] ys = Some ys\" |\n  \"drop_prefix (x # xs) (y # ys) = (if x = y then drop_prefix xs ys else None)\" |\n  \"drop_prefix _ _ = None \"\n\nlemma drop_prefix_append_prefix[simp]: \"drop_prefix xs (xs @ ys) = Some ys\"\n  by (induction xs) simp_all\n\nlemma drop_prefix_eq_Some_conv: \"drop_prefix xs ys = Some zs \\<longleftrightarrow> ys = xs @ zs\"\n  by (induction xs ys arbitrary: zs rule: drop_prefix.induct)\n    (auto simp: if_split_eq1)\n\nfun optim_instr where\n  \"optim_instr _ _ _ (IPush d) \\<Sigma> =\n    Some Pair \\<diamondop> (Some IPushUbx1 \\<diamondop> (unbox_ubx1 d)) \\<diamondop> Some (Some Ubx1 # \\<Sigma>) orelse\n    Some Pair \\<diamondop> (Some IPushUbx2 \\<diamondop> (unbox_ubx2 d)) \\<diamondop> Some (Some Ubx2 # \\<Sigma>) orelse\n    Some (IPush d, None # \\<Sigma>)\n  \" |\n  \"optim_instr _ _ _ (IPushUbx1 n) \\<Sigma> = Some (IPushUbx1 n, Some Ubx1 # \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IPushUbx2 b) \\<Sigma> = Some (IPushUbx2 b, Some Ubx2 # \\<Sigma>)\" |\n  \"optim_instr _ _ _ IPop (_ # \\<Sigma>) = Some (IPop, \\<Sigma>)\" |\n  \"optim_instr _ _ pc (IGet n) \\<Sigma> =\n    map_option (\\<lambda>\\<tau>. (IGetUbx \\<tau> n, Some \\<tau> # \\<Sigma>)) (load_oracle pc) orelse\n    Some (IGet n, None # \\<Sigma>)\" |\n  \"optim_instr _ _ pc (IGetUbx \\<tau> n) \\<Sigma> = Some (IGetUbx \\<tau> n, Some \\<tau> # \\<Sigma>)\" |\n  \"optim_instr _ _ _ (ISet n) (None # \\<Sigma>) = Some (ISet n, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (ISet n) (Some \\<tau> # \\<Sigma>) = Some (ISetUbx \\<tau> n, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (ISetUbx _ n) (None # \\<Sigma>) = Some (ISet n, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (ISetUbx _ n) (Some \\<tau> # \\<Sigma>) = Some (ISetUbx \\<tau> n, \\<Sigma>)\" |\n  \"optim_instr _ _ pc (ILoad x) (None # \\<Sigma>) =\n    map_option (\\<lambda>\\<tau>. (ILoadUbx \\<tau> x, Some \\<tau> # \\<Sigma>)) (load_oracle pc) orelse\n    Some (ILoad x, None # \\<Sigma>)\" |\n  \"optim_instr _ _ _ (ILoadUbx \\<tau> x) (None # \\<Sigma>) = Some (ILoadUbx \\<tau> x, Some \\<tau> # \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IStore x) (None # None # \\<Sigma>) = Some (IStore x, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IStore x) (None # Some \\<tau> # \\<Sigma>) = Some (IStoreUbx \\<tau> x, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IStoreUbx _ x) (None # None # \\<Sigma>) = Some (IStore x, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IStoreUbx _ x) (None # Some \\<tau> # \\<Sigma>) = Some (IStoreUbx \\<tau> x, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IOp op) \\<Sigma> =\n    map_option (\\<lambda>\\<Sigma>o. (IOp op, None # \\<Sigma>o)) (drop_prefix (replicate (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> op) None) \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IOpInl opinl) \\<Sigma> = (\n    let ar = \\<AA>\\<rr>\\<ii>\\<tt>\\<yy> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl) in\n    if ar \\<le> length \\<Sigma> then\n      case \\<UU>\\<bb>\\<xx> opinl (take ar \\<Sigma>) of\n        None \\<Rightarrow> map_option (\\<lambda>\\<Sigma>o. (IOpInl opinl, None # \\<Sigma>o)) (drop_prefix (replicate ar None) \\<Sigma>) |\n        Some opubx \\<Rightarrow> map_option (\\<lambda>\\<Sigma>o. (IOpUbx opubx, snd (\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp> opubx) # \\<Sigma>o))\n          (drop_prefix (fst (\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp> opubx)) \\<Sigma>)\n    else\n      None\n  )\" |\n  \"optim_instr _ _ _ (IOpUbx opubx) \\<Sigma> =\n    (let p = \\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp> opubx in\n     map_option (\\<lambda>\\<Sigma>o. (IOpUbx opubx, snd p # \\<Sigma>o)) (drop_prefix (fst p) \\<Sigma>))\" |\n  \"optim_instr _ _ _ (ICJump l\\<^sub>t l\\<^sub>f) [None] = Some (ICJump l\\<^sub>t l\\<^sub>f, []) \" |\n  \"optim_instr F _ _ (ICall f) \\<Sigma> = do {\n    (ar, ret) \\<leftarrow> F f;\n    \\<Sigma>o \\<leftarrow> drop_prefix (replicate ar None) \\<Sigma>;\n    Some (ICall f, replicate ret None @ \\<Sigma>o)\n  }\" |\n  \"optim_instr _ ret _ IReturn \\<Sigma> = (if \\<Sigma> = replicate ret None then Some (IReturn, []) else None)\" |\n  \"optim_instr _ _ _ _ _ = None\"\n\ndefinition optim_instrs where\n  \"optim_instrs F ret \\<equiv> \\<lambda>pc \\<Sigma>i instrs.\n    map_option (\\<lambda>((_, \\<Sigma>o), instrs'). (\\<Sigma>o, instrs'))\n      (monadic_fold_map (\\<lambda>(pc, \\<Sigma>) instr.\n        map_option (\\<lambda>(instr', \\<Sigma>o). ((Suc pc, \\<Sigma>o), instr')) (optim_instr F ret pc instr \\<Sigma>))\n      (pc, \\<Sigma>i) instrs)\"\n\nlemma optim_instrs_Cons_eq_Some_conv:\n  \"optim_instrs F ret pc \\<Sigma>i (instr # instrs) = Some (\\<Sigma>o, ys) \\<longleftrightarrow> (\\<exists>y ys' \\<Sigma>.\n    ys = y # ys' \\<and>\n    optim_instr F ret pc instr \\<Sigma>i = Some (y, \\<Sigma>) \\<and>\n    optim_instrs F ret (Suc pc) \\<Sigma> instrs = Some (\\<Sigma>o, ys'))\"\n  unfolding optim_instrs_def\n  by (auto simp: bind_eq_Some_conv)\n\nlemma optim_instrs_length:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"length xs = length ys\"\n  using assms unfolding optim_instrs_def\n  by (auto intro: monadic_fold_map_length)\n\nlemma optim_instrs_not_Nil: \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys) \\<Longrightarrow> xs \\<noteq> [] \\<longleftrightarrow> ys \\<noteq> []\"\n  using optim_instrs_length by fastforce\n\nlemma optim_instrs_NilD[dest]:\n  assumes \"optim_instrs F ret pc \\<Sigma>i [] = Some (\\<Sigma>o, ys)\"\n  shows \"\\<Sigma>o = \\<Sigma>i \\<and> ys = []\"\n  using assms\n  by (simp_all add: optim_instrs_def)\n\nlemma optim_instrs_ConsD[dest]:\n  assumes \"optim_instrs F ret pc \\<Sigma>i (x # xs) = Some (\\<Sigma>o, ys)\"\n  shows \"\\<exists>y ys' \\<Sigma>. ys = y # ys' \\<and>\n    optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>) \\<and>\n    optim_instrs F ret (Suc pc) \\<Sigma> xs = Some (\\<Sigma>o, ys')\"\n  using assms\n  unfolding optim_instrs_def\n  by (auto simp: bind_eq_Some_conv)\n\nlemma optim_instr_norm:\n  assumes \"optim_instr F ret pc instr1 \\<Sigma>1 = Some (instr2, \\<Sigma>2)\"\n  shows \"norm_instr instr1 = norm_instr instr2\"\n  using assms\n  by (cases \"(F, ret, pc, instr1, \\<Sigma>1)\" rule: optim_instr.cases)\n    (auto simp: ap_option_eq_Some_conv Let_def if_split_eq1 bind_eq_Some_conv option.case_eq_if\n      orelse_eq_Some_conv\n      dest!: Subx.box_unbox_inverse dest: Subx.\\<UU>\\<bb>\\<xx>_invertible)\n\nlemma optim_instrs_all_norm:\n  assumes \"optim_instrs F ret pc \\<Sigma>1 instrs1 = Some (\\<Sigma>2, instrs2)\"\n  shows \"list_all2 (\\<lambda>i1 i2. norm_instr i1 = norm_instr i2) instrs1 instrs2\"\n  using assms unfolding optim_instrs_def\n  by (auto simp: optim_instr_norm elim!: monadic_fold_map_list_all2)\n\nlemma optim_instr_is_jump:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"is_jump x \\<longleftrightarrow> is_jump y\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases;\n      simp add: orelse_eq_Some_conv ap_option_eq_Some_conv bind_eq_Some_conv\n        Let_def if_split_eq1 option.case_eq_if;\n      safe; simp)\n\nlemma optim_instr_is_return:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"is_return x \\<longleftrightarrow> is_return y\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases;\n      simp add: orelse_eq_Some_conv ap_option_eq_Some_conv bind_eq_Some_conv\n        Let_def if_split_eq1 option.case_eq_if;\n      safe; simp)\n\nlemma optim_instrs_all_butlast_not_jump_not_return:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows\n    \"list_all (\\<lambda>i. \\<not> is_jump i \\<and> \\<not> is_return i) (butlast xs) \\<longleftrightarrow>\n     list_all (\\<lambda>i. \\<not> is_jump i \\<and> \\<not> is_return i) (butlast ys)\"\n  using optim_instrs_length[OF assms(1)] assms\nproof (induction xs ys arbitrary: pc \\<Sigma>i \\<Sigma>o rule: list_induct2)\n  case Nil\n  thus ?case by simp\nnext\n  case (Cons x xs y ys)\n  from Cons.prems obtain \\<Sigma> where\n    optim_x: \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>)\" and\n    optim_xs: \"optim_instrs F ret (Suc pc) \\<Sigma> xs = Some (\\<Sigma>o, ys)\"\n    by auto\n  show ?case\n    using Cons.hyps\n    using optim_x optim_xs\n    apply (simp add: Cons.IH optim_instr_is_jump optim_instr_is_return)\n    by fastforce\nqed\n\nlemma optim_instr_jump_in_range:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.jump_in_range L x \\<longleftrightarrow> Subx.jump_in_range L y\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases)\n    (auto simp: ap_option_eq_Some_conv Let_def if_split_eq1 option.case_eq_if\n      bind_eq_Some_conv orelse_eq_Some_conv)\n\nlemma optim_instrs_all_jump_in_range:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.jump_in_range L) xs \\<longleftrightarrow> list_all (Subx.jump_in_range L) ys\"\n  using assms\n  by (induction xs arbitrary: pc \\<Sigma>i \\<Sigma>o ys) (auto simp: optim_instr_jump_in_range)\n\nlemma optim_instr_fun_call_in_range:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.fun_call_in_range F x \\<longleftrightarrow> Subx.fun_call_in_range F y\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases)\n    (auto simp: ap_option_eq_Some_conv Let_def if_split_eq1 option.case_eq_if\n      bind_eq_Some_conv orelse_eq_Some_conv)\n\nlemma optim_instrs_all_fun_call_in_range:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.fun_call_in_range F) xs \\<longleftrightarrow> list_all (Subx.fun_call_in_range F) ys\"\n  using assms\n  by (induction xs arbitrary: pc \\<Sigma>i \\<Sigma>o ys) (auto simp: optim_instr_fun_call_in_range)\n\nlemma optim_instr_local_var_in_range:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.local_var_in_range N x \\<longleftrightarrow> Subx.local_var_in_range N y\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases)\n    (auto simp: ap_option_eq_Some_conv Let_def if_split_eq1 option.case_eq_if\n      bind_eq_Some_conv orelse_eq_Some_conv)\n\nlemma optim_instrs_all_local_var_in_range:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.local_var_in_range N) xs \\<longleftrightarrow> list_all (Subx.local_var_in_range N) ys\"\n  using assms\n  by (induction xs arbitrary: pc \\<Sigma>i \\<Sigma>o ys) (auto simp: optim_instr_local_var_in_range)\n\nlemma optim_instr_sp:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.sp_instr F ret y \\<Sigma>i \\<Sigma>o\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases)\n    (auto simp add: Let_def if_split_eq1 option.case_eq_if\n      simp: ap_option_eq_Some_conv orelse_eq_Some_conv drop_prefix_eq_Some_conv bind_eq_Some_conv\n      intro: Subx.sp_instr.intros)\n\nlemma optim_instrs_sp:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"Subx.sp_instrs F ret ys \\<Sigma>i \\<Sigma>o\"\n  using assms\n  by (induction xs arbitrary: pc \\<Sigma>i \\<Sigma>o ys)\n    (auto intro!: Subx.sp_instrs.intros optim_instr_sp)\n\n\nsection \\<open>Compilation of function definition\\<close>\n\ndefinition compile_basic_block where\n  \"compile_basic_block F L ret N \\<equiv>\n    ap_map_prod Some (\\<lambda>i1. do {\n      _ \\<leftarrow> if i1 \\<noteq> [] then Some () else None;\n      _ \\<leftarrow> if list_all (\\<lambda>i. \\<not> Inca.is_jump i \\<and> \\<not> Inca.is_return i) (butlast i1) then Some () else None;\n      (\\<Sigma>o, i2) \\<leftarrow> lift_instrs F L ret N ([] :: type option list) i1;\n      if \\<Sigma>o = [] then\n        case optim_instrs F ret 0 ([] :: type option list) i2 of\n          Some (\\<Sigma>o', i2') \\<Rightarrow> Some (if \\<Sigma>o' = [] then i2' else i2) |\n          None \\<Rightarrow> Some i2\n      else\n        None\n    })\"\n\nlemma compile_basic_block_rel_prod_all_norm_eq:\n  assumes \"compile_basic_block F L ret N bblock1 = Some bblock2\"\n  shows \"rel_prod (=) (list_all2 norm_eq) bblock1 bblock2\"\n  using assms\n  unfolding compile_basic_block_def\n  apply (auto simp add: ap_map_prod_eq_Some_conv bind_eq_Some_conv\n      simp: if_split_eq1\n      intro: lift_instrs_all_norm\n      dest!: optim_instrs_all_norm lift_instrs_all_norm)\n  subgoal premises prems for _ xs zs ys\n    using \\<open>list_all2 norm_eq xs ys\\<close>\n  proof (rule list_all2_trans[of norm_eq \"\\<lambda>i. norm_eq (norm_instr i)\" norm_eq xs ys zs, simplified])\n    show \"list_all2 (\\<lambda>i. norm_eq (norm_instr i)) ys zs\"\n    proof (cases \"optim_instrs F ret 0 [] ys\")\n      case None\n      with prems show ?thesis by (simp add: list.rel_refl)\n    next\n      case (Some p)\n      with prems show ?thesis\n        by (cases p) (auto simp: list.rel_refl intro: optim_instrs_all_norm)\n    qed\n  qed\n  done\n\nlemma list_all_iff_butlast_last:\n  assumes \"xs \\<noteq> []\"\n  shows \"list_all P xs \\<longleftrightarrow> list_all P (butlast xs) \\<and> P (last xs)\"\n  using assms\n  by (induction xs) auto\n\nlemma compile_basic_block_wf:\n  assumes \"compile_basic_block F L ret N x = Some y\"\n  shows \"Subx.wf_basic_block F (set L) ret N y\"\nproof -\n  obtain f instrs1 instrs2 instrs3 where\n    x_def: \"x = (f, instrs1)\" and\n    y_def: \"y = (f, instrs3)\" and\n    \"instrs1 \\<noteq> []\" and\n    all_not_jump_not_return_instrs1:\n      \"list_all (\\<lambda>i. \\<not> Inca.is_jump i \\<and> \\<not> Inca.is_return i) (butlast instrs1)\" and\n    lift_instrs1: \"lift_instrs F L ret N ([] :: type option list) instrs1 = Some ([], instrs2)\" and\n    instr4_defs: \"instrs3 = instrs2 \\<or>\n      optim_instrs F ret 0 ([] :: type option list) instrs2 = Some ([], instrs3)\"\n    using assms\n    unfolding compile_basic_block_def\n    apply (auto simp: ap_map_prod_eq_Some_conv bind_eq_Some_conv if_split_eq1 option.case_eq_if)\n    by blast\n\n  have \"instrs3 \\<noteq> []\"\n    using instr4_defs \\<open>instrs1 \\<noteq> []\\<close>\n    using lift_instrs_not_Nil[OF lift_instrs1]\n    by (auto simp: optim_instrs_not_Nil)\n  moreover have \"list_all (Subx.local_var_in_range N) instrs3\"\n    using instr4_defs lift_instrs1\n    by (auto dest: lift_instrs_all_local_var_in_range simp: optim_instrs_all_local_var_in_range)\n  moreover have \"list_all (Subx.fun_call_in_range F) instrs3\"\n    using instr4_defs lift_instrs1\n    by (auto dest: lift_instrs_all_fun_call_in_range simp: optim_instrs_all_fun_call_in_range)\n  moreover have \"list_all (Subx.jump_in_range (set L)) instrs3\"\n    using instr4_defs lift_instrs1\n    by (auto dest: lift_instrs_all_jump_in_range simp: optim_instrs_all_jump_in_range)\n  moreover have \"list_all (\\<lambda>i. \\<not> Ubx.instr.is_jump i \\<and> \\<not> Ubx.instr.is_return i) (butlast instrs3)\"\n    using instr4_defs lift_instrs1 all_not_jump_not_return_instrs1\n    by (auto simp:\n        lift_instrs_all_butlast_not_jump_not_return\n        optim_instrs_all_butlast_not_jump_not_return)\n  moreover have \"Subx.sp_instrs F ret instrs3 [] []\"\n    using instr4_defs lift_instrs1\n    by (auto intro: lift_instrs_sp optim_instrs_sp)\n  ultimately show ?thesis\n    by (auto simp: y_def intro!: Subx.wf_basic_blockI)\nqed\n\nfun compile_fundef where\n  \"compile_fundef F (Fundef bblocks1 ar ret locals) = do {\n    _ \\<leftarrow> if bblocks1 = [] then None else Some ();\n    bblocks2 \\<leftarrow> ap_map_list (compile_basic_block F (map fst bblocks1) ret (ar + locals)) bblocks1;\n    Some (Fundef bblocks2 ar ret locals)\n  }\"\n\nlemma compile_fundef_arities: \"compile_fundef F fd1 = Some fd2 \\<Longrightarrow> arity fd1 = arity fd2\"\n  by (cases fd1) (auto simp: bind_eq_Some_conv)\n\nlemma compile_fundef_returns: \"compile_fundef F fd1 = Some fd2 \\<Longrightarrow> return fd1 = return fd2\"\n  by (cases fd1) (auto simp: bind_eq_Some_conv)\n\nlemma compile_fundef_locals:\n  \"compile_fundef F fd1 = Some fd2 \\<Longrightarrow> fundef_locals fd1 = fundef_locals fd2\"\n  by (cases fd1) (auto simp: bind_eq_Some_conv)\n\nlemma if_then_None_else_Some_eq[simp]:\n  \"(if a then None else Some b) = Some c \\<longleftrightarrow> \\<not> a \\<and> b = c\"\n  \"(if a then None else Some b) = None \\<longleftrightarrow> a\"\n  by (cases a) simp_all\n\nlemma\n  assumes \"compile_fundef F fd1 = Some fd2\"\n  shows\n    rel_compile_fundef: \"rel_fundef (=) norm_eq fd1 fd2\" (is ?REL) and\n    wf_compile_fundef: \"Subx.wf_fundef F fd2\" (is ?WF)\n  unfolding atomize_conj\nproof (cases fd1)\n  case (Fundef bblocks1 ar ret locals)\n  with assms obtain bblocks2 where\n    \"bblocks1 \\<noteq> []\" and\n    lift_bblocks1:\n      \"ap_map_list (compile_basic_block F (map fst bblocks1) ret (ar + locals)) bblocks1 = Some bblocks2\" and\n    fd2_def: \"fd2 = Fundef bblocks2 ar ret locals\"\n    by (auto simp add: bind_eq_Some_conv)\n\n  show \"?REL \\<and> ?WF\"\n  proof (rule conjI)\n    show ?REL\n      unfolding Fundef fd2_def\n    proof (rule fundef.rel_intros)\n      show \"list_all2 (rel_prod (=) (list_all2 norm_eq)) bblocks1 bblocks2\"\n        using lift_bblocks1\n        unfolding ap_map_list_iff_list_all2\n        by (auto elim: list.rel_mono_strong intro: compile_basic_block_rel_prod_all_norm_eq)\n    qed simp_all\n  next\n    have \"bblocks2 \\<noteq> []\"\n      using \\<open>bblocks1 \\<noteq> []\\<close> length_ap_map_list[OF lift_bblocks1] by force\n    moreover have \"list_all (Subx.wf_basic_block F (fst ` set bblocks1) ret (ar + locals)) bblocks2\"\n      using lift_bblocks1\n      unfolding ap_map_list_iff_list_all2\n      by (auto elim!: list_rel_imp_pred2 dest: compile_basic_block_wf)\n    moreover have \"fst ` set bblocks1 = fst ` set bblocks2\"\n      using lift_bblocks1\n      unfolding ap_map_list_iff_list_all2\n      by (induction bblocks1 bblocks2 rule: list.rel_induct)\n        (auto simp add: compile_basic_block_def ap_map_prod_eq_Some_conv)\n    ultimately show ?WF\n      unfolding fd2_def\n      by (auto intro: Subx.wf_fundefI)\n  qed\nqed\n\nend\n\nend\n\nlocale inca_ubx_compiler =\n  inca_to_ubx_simulation Finca_empty Finca_get\n  for\n    Finca_empty and\n    Finca_get :: \"_ \\<Rightarrow> 'fun \\<Rightarrow> _ option\" +\n  fixes\n    load_oracle :: \"'fun \\<Rightarrow> nat \\<Rightarrow> type option\"\nbegin\n\n\nsection \\<open>Compilation of function environment\\<close>\n\ndefinition compile_env_entry where\n  \"compile_env_entry F \\<equiv> \\<lambda>p. ap_map_prod Some (compile_fundef (load_oracle (fst p)) F) p\"\n\nlemma rel_compile_env_entry:\n  assumes \"compile_env_entry F (f, fd1) = Some (f, fd2)\"\n  shows \"rel_fundef (=) norm_eq fd1 fd2\"\n  using assms unfolding compile_env_entry_def\n  by (auto simp: ap_map_prod_eq_Some_conv intro!: rel_compile_fundef)\n\ndefinition compile_env where\n  \"compile_env e \\<equiv> do {\n    let fundefs1 = Finca_to_list e;\n    fundefs2 \\<leftarrow> ap_map_list (compile_env_entry (map_option funtype \\<circ> Finca_get e)) fundefs1;\n    Some (Subx.Fenv.from_list fundefs2)\n  }\"\n\nlemma rel_ap_map_list_ap_map_list_compile_env_entries:\n  assumes \"ap_map_list (compile_env_entry F) xs = Some ys\"\n  shows \"rel_fundefs (Finca_get (Sinca.Fenv.from_list xs)) (Fubx_get (Subx.Fenv.from_list ys))\"\n  using assms\nproof (induction xs arbitrary: ys)\n  case Nil\n  thus ?case\n    using rel_fundefs_empty by simp\nnext\n  case (Cons x xs)\n  from Cons.prems obtain y ys' where\n    ys_def: \"ys = y # ys'\" and\n    compile_env_x: \"compile_env_entry F x = Some y\" and\n    compile_env_xs: \"ap_map_list (compile_env_entry F) xs = Some ys'\"\n    by (auto simp add: ap_option_eq_Some_conv)\n\n  obtain f fd1 fd2 where\n    prods: \"x = (f, fd1)\" \"y = (f, fd2)\" and \"compile_fundef (load_oracle f) F fd1 = Some fd2\"\n    using compile_env_x\n    by (cases x) (auto simp: compile_env_entry_def eq_fst_iff ap_map_prod_eq_Some_conv)\n\n  have \"rel_fundef (=) norm_eq fd1 fd2\"\n    using compile_env_x[unfolded prods]\n    by (auto intro: rel_compile_env_entry)\n  thus ?case\n    using Cons.IH[OF compile_env_xs, THEN rel_fundefsD]\n    unfolding prods ys_def\n    unfolding Sinca.Fenv.from_list_correct Subx.Fenv.from_list_correct\n    by (auto intro: rel_fundefsI)\nqed\n\nlemma rel_fundefs_compile_env:\n  assumes \"compile_env F1 = Some F2\"\n  shows \"rel_fundefs (Finca_get F1) (Fubx_get F2)\"\nproof -\n  from assms obtain xs where\n    ap_map_list_F1: \"ap_map_list (compile_env_entry (map_option funtype \\<circ> Finca_get F1)) (Finca_to_list F1) = Some xs\" and\n    F2_def: \"F2 = Subx.Fenv.from_list xs\"\n    by (auto simp: compile_env_def bind_eq_Some_conv)\n\n  show ?thesis\n    using rel_ap_map_list_ap_map_list_compile_env_entries[OF ap_map_list_F1]\n    unfolding F2_def Sinca.Fenv.get_from_list_to_list\n    by assumption\nqed\n\n\nsection \\<open>Compilation of program\\<close>\n\nfun compile where\n  \"compile (Prog F1 H f) = Some Prog \\<diamondop> compile_env F1 \\<diamondop> Some H \\<diamondop> Some f\"\n\nlemma ap_map_list_cong:\n  assumes \"\\<And>x. x \\<in> set ys \\<Longrightarrow> f x = g x\" and \"xs = ys\"\n  shows \"ap_map_list f xs = ap_map_list g ys\"\n  using assms\n  by (induction xs arbitrary: ys) auto\n\nlemma compile_env_wf_fundefs:\n  assumes \"compile_env F1 = Some F2\"\n  shows \"Subx.wf_fundefs (Fubx_get F2)\"\nproof (intro Subx.wf_fundefsI allI)\n  fix f\n  obtain xs where\n    ap_map_list_F1: \"ap_map_list (compile_env_entry (map_option funtype \\<circ> Finca_get F1)) (Finca_to_list F1) = Some xs\" and\n    F2_def: \"F2 = Subx.Fenv.from_list xs\"\n    using assms by (auto simp: compile_env_def bind_eq_Some_conv)\n\n  have rel_map_of_F1_xs:\n    \"\\<And>f. rel_option (\\<lambda>x y. compile_fundef (load_oracle f) (map_option funtype \\<circ> Finca_get F1) x = Some y)\n      (map_of (Finca_to_list F1) f) (map_of xs f)\"\n    using ap_map_list_F1\n    by (auto simp: compile_env_entry_def ap_map_prod_eq_Some_conv\n        dest: ap_map_list_imp_rel_option_map_of)\n\n  have funtype_F1_eq_funtype_F2:\n    \"map_option funtype \\<circ> Finca_get F1 = map_option funtype \\<circ> Fubx_get F2\"\n  proof (rule ext, simp)\n    fix x\n    show \"map_option funtype (Finca_get F1 x) = map_option funtype (Fubx_get F2 x)\"\n      unfolding F2_def Subx.Fenv.from_list_correct Sinca.Fenv.to_list_correct[symmetric]\n      using rel_map_of_F1_xs[of x]\n      by (cases rule: option.rel_cases)\n        (simp_all add: funtype_def compile_fundef_arities compile_fundef_returns)\n  qed\n\n  show \"pred_option (Subx.wf_fundef (map_option funtype \\<circ> Fubx_get F2)) (Fubx_get F2 f) \"\n  proof (cases \"map_of (Finca_to_list F1) f\")\n    case None\n    thus ?thesis\n      using rel_map_of_F1_xs[of f, unfolded None]\n      by (simp add: F2_def Subx.Fenv.from_list_correct)\n  next\n    case (Some fd1)\n    show ?thesis\n      using rel_map_of_F1_xs[of f, unfolded Some option_rel_Some1]\n      unfolding funtype_F1_eq_funtype_F2 F2_def Subx.Fenv.from_list_correct\n      by (auto intro: wf_compile_fundef)\n  qed\nqed\n\nlemma compile_load:\n  assumes\n    compile_p1: \"compile p1 = Some p2\" and\n    load: \"Subx.load p2 s2\"\n  shows \"\\<exists>s1. Sinca.load p1 s1 \\<and> match s1 s2\"\nproof -\n  obtain F1 H main where p1_def: \"p1 = Prog F1 H main\"\n    by (cases p1) simp\n  then obtain F2 where\n    compile_F1: \"compile_env F1 = Some F2\" and\n    p2_def: \"p2 = Prog F2 H main\"\n    using compile_p1\n    by (auto simp: ap_option_eq_Some_conv)\n\n  note rel_F1_F2 = rel_fundefs_compile_env[OF compile_F1]\n\n  show ?thesis\n    using assms(2) unfolding p2_def Subx.load_def\n  proof (cases _ _ _ s2 rule: Global.load.cases)\n    case (1 fd2)\n    then obtain fd1 where\n      F1_main: \"Finca_get F1 main = Some fd1\" and rel_fd1_fd2: \"rel_fundef (=) norm_eq fd1 fd2\"\n      using rel_fundefs_Some2[OF rel_F1_F2]\n      by auto\n      \n    let ?s1 = \"State F1 H [allocate_frame main fd1 [] uninitialized]\"\n\n    show ?thesis\n    proof (intro exI conjI)\n      show \"Sinca.load p1 ?s1\"\n        unfolding Sinca.load_def p1_def\n        using 1 F1_main rel_fd1_fd2\n        by (auto simp: rel_fundef_arities intro!: Global.load.intros dest: rel_fundef_body_length)\n    next\n      have \"Subx.wf_state s2\"\n        unfolding 1\n        using compile_F1\n        by (auto intro!: Subx.wf_stateI intro: compile_env_wf_fundefs)\n      then show \"match ?s1 s2\"\n        using 1 rel_F1_F2 rel_fd1_fd2\n        by (auto simp: allocate_frame_def rel_fundef_locals\n            simp: rel_fundef_rel_fst_hd_bodies[OF rel_fd1_fd2 disjI2]\n            intro!: match.intros rel_stacktraces.intros intro: Subx.sp_instrs.Nil)\n    qed\n  qed\nqed\n\ninterpretation std_to_inca_compiler:\n  compiler Sinca.step Subx.step \"final Finca_get Inca.IReturn\" \"final Fubx_get Ubx.IReturn\"\n    Sinca.load Subx.load\n    \"\\<lambda>_ _. False\" \"\\<lambda>_. match\" compile\nusing compile_load\n  by unfold_locales auto\n\n\nsubsection \\<open>Completeness of compilation\\<close>\n\nlemma lift_instr_None_preservation:\n  assumes \"lift_instr F L ret N instr \\<Sigma> = Some (instr', \\<Sigma>')\" and \"list_all ((=) None) \\<Sigma>\"\n  shows \"list_all ((=) None) \\<Sigma>'\"\n  using assms\n  by (cases \"(F, L, ret, N, instr, \\<Sigma>)\" rule: lift_instr.cases)\n    (auto simp: Let_def bind_eq_Some_conv)\n\nlemma lift_instr_complete:\n  assumes\n    \"Sinca.local_var_in_range N instr\" and\n    \"Sinca.jump_in_range (set L) instr\" and\n    \"Sinca.fun_call_in_range F instr\" and\n    \"Sinca.sp_instr F ret instr (length \\<Sigma>) k\" and\n    \"list_all ((=) None) \\<Sigma>\"\n  shows \"\\<exists>instr' \\<Sigma>'. lift_instr F L ret N instr \\<Sigma> = Some (instr', \\<Sigma>') \\<and> length \\<Sigma>' = k\"\n  using assms\n  by (cases \"(F, L, ret, N, instr, \\<Sigma>)\" rule: lift_instr.cases)\n    (auto simp add: in_set_member Let_def\n      dest: Map.domD dest!: list_all_eq_const_imp_replicate' elim: Sinca.sp_instr.cases)\n\nlemma lift_instrs_complete:\n  fixes \\<Sigma> :: \"type option list\"\n  assumes\n    \"list_all (Sinca.local_var_in_range N) instrs\" and\n    \"list_all (Sinca.jump_in_range (set L)) instrs\" and\n    \"list_all (Sinca.fun_call_in_range F) instrs\" and\n    \"Sinca.sp_instrs F ret instrs (length \\<Sigma>) k\" and\n    \"list_all ((=) None) \\<Sigma>\"\n  shows \"\\<exists>\\<Sigma>' instrs'. lift_instrs F L ret N \\<Sigma> instrs = Some (\\<Sigma>', instrs') \\<and> length \\<Sigma>' = k\"\n  using assms\nproof (induction instrs arbitrary: \\<Sigma>)\n  case Nil\n  thus ?case\n    unfolding lift_instrs_def\n    by (auto elim: Sinca.sp_instrs.cases)\nnext\n  case (Cons instr instrs')\n  from Cons.prems(4) obtain k' where\n    sp_head: \"Sinca.sp_instr F ret instr (length \\<Sigma>) k'\" and\n    sp_tail: \"Sinca.sp_instrs F ret instrs' k' k\"\n    by (cases rule: Sinca.sp_instrs.cases) simp\n\n  have inv_instrs':\n    \"list_all (Sinca.local_var_in_range N) instrs'\"\n    \"list_all (Sinca.jump_in_range (set L)) instrs'\"\n    \"list_all (Sinca.fun_call_in_range F) instrs'\"\n    using Cons.prems(1-3) by simp_all\n\n  from Cons.prems(1-3,5) obtain instr2 \\<Sigma>tmp where\n    lift_head: \"lift_instr F L ret N instr \\<Sigma> = Some (instr2, \\<Sigma>tmp)\" and\n    \"length \\<Sigma>tmp = k'\"\n    using lift_instr_complete[OF _ _ _ sp_head, of N L] by auto\n  hence \"list_all ((=) None) \\<Sigma>tmp\"\n    by (meson Cons.prems(5) lift_instr_None_preservation)\n  then obtain instrs2 and \\<Sigma>' :: \"type option list\" where\n    lift_tail: \"lift_instrs F L ret N \\<Sigma>tmp instrs' = Some (\\<Sigma>', instrs2)\" and\n    \"length \\<Sigma>' = k\"\n    using Cons.IH[OF inv_instrs', of \\<Sigma>tmp] sp_tail\n    unfolding \\<open>length \\<Sigma>tmp = k'\\<close>\n    by auto\n  show ?case\n  proof (intro exI conjI)\n    show \"lift_instrs F L ret N \\<Sigma> (instr # instrs') = Some (\\<Sigma>', instr2 # instrs2)\"\n      using lift_head lift_tail\n      by (simp add: lift_instrs_def)\n  next\n    show \"length \\<Sigma>' = k\"\n      by (rule \\<open>length \\<Sigma>' = k\\<close>)\n  qed\nqed\n\nlemma optim_instr_complete:\n  assumes sp: \"Subx.sp_instr F ret instr \\<Sigma> \\<Sigma>'\"\n  shows \"\\<exists>\\<Sigma>'' instr'. optim_instr \\<O> F ret pc instr \\<Sigma> = Some (instr', \\<Sigma>'') \\<and> length \\<Sigma>' = length \\<Sigma>''\"\n  using sp\nproof (cases F ret instr \\<Sigma> \\<Sigma>' rule: Subx.sp_instr.cases)\n  case (Push d)\n  thus ?thesis\n    by (cases \"unbox_ubx1 d\"; cases \"unbox_ubx2 d\") simp_all\nnext\n  case (Get n)\n  thus ?thesis\n    by (cases \"\\<O> pc\") simp_all\nnext\n  case (Load x \\<Sigma>)\n  then show ?thesis\n    by (cases \"\\<O> pc\") simp_all\nnext\n  case (OpInl opinl \\<Sigma>)\n  then show ?thesis\n    by (cases \"\\<UU>\\<bb>\\<xx> opinl (replicate (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl)) None)\")\n      (simp_all add: Let_def Subx.\\<UU>\\<bb>\\<xx>_opubx_type)\nqed simp_all\n\nlemma compile_basic_block_complete:\n  assumes wf_bblock1: \"Sinca.wf_basic_block F (set L) ret n bblock1\"\n  shows \"\\<exists>bblock2. compile_basic_block \\<O> F L ret n bblock1 = Some bblock2\"\nproof (cases bblock1)\n  case (Pair label instrs1)\n  moreover obtain instrs2 where\n    \"lift_instrs F L ret n ([] :: type option list) instrs1 = Some ([], instrs2)\"\n    using wf_bblock1[unfolded Pair, simplified]\n    using lift_instrs_complete[of n instrs1 L F ret \"[]\" 0]\n    by (auto simp: Sinca.wf_basic_block_def)\n  ultimately show ?thesis\n    using wf_bblock1[unfolded Pair, simplified]\n    apply (simp add: compile_basic_block_def ap_map_prod_eq_Some_conv)\n    by (cases \"optim_instrs \\<O> F ret 0 [] instrs2\") (auto simp: Sinca.wf_basic_block_def)\nqed\n\nlemma bind_eq_map_option[simp]: \"x \\<bind> (\\<lambda>y. Some (f y)) = map_option f x\"\n  by (cases x) simp_all\n\nlemma compile_fundef_complete:\n  assumes wf_fd1: \"Sinca.wf_fundef F fd1\"\n  shows \"\\<exists>fd2. compile_fundef \\<O> F fd1 = Some fd2\"\nproof (cases fd1)\n  case (Fundef bblocks ar ret locals)\n  then obtain bblock bblocks' where bblocks_def: \"bblocks = bblock # bblocks'\"\n    using wf_fd1 by (cases bblocks; auto simp: Sinca.wf_fundef_def)\n  obtain label instrs where \"bblock = (label, instrs)\"\n    by (cases bblock) simp\n  show ?thesis\n    using wf_fd1\n    by (auto simp add: Fundef Sinca.wf_fundef_def\n        intro!: ex_ap_map_list_eq_SomeI intro: compile_basic_block_complete\n        elim!: list.pred_mono_strong)\nqed\n\nlemma compile_env_entry_complete:\n  assumes wf_fd1: \"Sinca.wf_fundef F fd1\"\n  shows \"\\<exists>fd2. compile_env_entry F (f, fd1) = Some fd2\"\n    using compile_fundef_complete[OF wf_fd1]\n    by (simp add: compile_env_entry_def ap_map_prod_eq_Some_conv)\n\nlemma compile_env_complete:\n  assumes wf_F1: \"pred_map (Sinca.wf_fundef (map_option funtype \\<circ> Finca_get F1)) (Finca_get F1)\"\n  shows \"\\<exists>F2. compile_env F1 = Some F2\"\nproof -\n  show ?thesis\n    using wf_F1\n    by (auto simp add: compile_env_def\n        intro: ex_ap_map_list_eq_SomeI Sinca.Fenv.to_list_list_allI compile_env_entry_complete\n          pred_map_get)\nqed\n\ntheorem compile_complete:\n  assumes wf_p1: \"Sinca.wf_prog p1\"\n  shows \"\\<exists>p2. compile p1 = Some p2\"\nproof (cases p1)\n  case (Prog F1 H main)\n  then show ?thesis\n    using wf_p1 unfolding Sinca.wf_prog_def\n    by (auto simp: Let_def dest: compile_env_complete)\nqed\n\nend\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Interpreter_Optimizations/Inca_to_Ubx_compiler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3463095570113093}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |               November 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2009         |\n            |                   June 2009  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_law_dist\nimports CSP_F_law_basic CSP_F_law_decompo CSP_T_law_dist\n        CSP_F_law_alpha_par\nbegin\n\n(*****************************************************************\n\n      distribution over internal choice\n\n         1. (P1 |~| P2) [+] Q\n         2. Q [+] (P1 |~| P2)\n         3. (P1 |~| P2) |[X]| Q\n         4. Q |[X]| (P1 |~| P2)\n         5. (P1 |~| P2) -- X\n         6. (P1 |~| P2) [[r]]\n         7. (P1 |~| P2) ;; Q\n         8. (P1 |~| P2) |. n\n         9. !! x:X .. (P1 |~| P2)\n\n *****************************************************************)\n\n(*********************************************************\n                dist law for Ext_choice (l)\n *********************************************************)\n\nlemma cspF_Ext_choice_dist_l: \n  \"(P1 |~| P2) [+] Q =F[M,M]\n   (P1 [+] Q) |~| (P2 [+] Q)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Ext_choice_dist_l)\napply (rule order_antisym)\napply (rule, simp add: in_traces in_failures, fast)+\ndone\n\n(*********************************************************\n                dist law for Ext_choice (r)\n *********************************************************)\n\nlemma cspF_Ext_choice_dist_r: \n  \"P [+] (Q1 |~| Q2) =F[M,M]\n   (P [+] Q1) |~| (P [+] Q2)\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_Ext_choice_dist_l)\napply (rule cspF_decompo)\napply (rule cspF_commut)+\ndone\n\n(*********************************************************\n                dist law for Parallel (l)\n *********************************************************)\n\nlemma cspF_Parallel_dist_l: \n  \"(P1 |~| P2) |[X]| Q =F[M,M]\n   (P1 |[X]| Q) |~| (P2 |[X]| Q)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Parallel_dist_l)\napply (rule order_antisym)\n\n  apply (rule, simp add: in_failures)\n  apply (elim disjE conjE exE)\n  apply (rule disjI1)\n  apply (rule_tac x=\"Y\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (fast)\n  apply (rule disjI2)\n  apply (rule_tac x=\"Y\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (fast)\n\n  apply (rule, simp add: in_failures)\n  apply (elim disjE conjE exE)\n  apply (rule_tac x=\"Y\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (fast)\n  apply (rule_tac x=\"Y\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (fast)\ndone\n\n(*********************************************************\n                dist law for Parallel (r)\n *********************************************************)\n\nlemma cspF_Parallel_dist_r: \n  \"P |[X]| (Q1 |~| Q2) =F[M,M]\n   (P |[X]| Q1) |~| (P |[X]| Q2)\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_Parallel_dist_l)\napply (rule cspF_decompo)\napply (rule cspF_commut)+\ndone\n\n(*********************************************************\n                dist law for Hiding\n *********************************************************)\n\nlemma cspF_Hiding_dist: \n  \"(P1 |~| P2) -- X =F[M,M]\n   (P1 -- X) |~| (P2 -- X)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Hiding_dist)\napply (rule order_antisym)\napply (rule, simp add: in_failures, fast)+\ndone\n\n(*********************************************************\n               dist law for Renaming\n *********************************************************)\n\nlemma cspF_Renaming_dist: \n  \"(P1 |~| P2) [[r]] =F[M,M]\n   (P1 [[r]]) |~| (P2 [[r]])\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Renaming_dist)\napply (rule order_antisym)\napply (rule, simp add: in_failures, fast)+\ndone\n\n(*********************************************************\n         dist law for Sequential composition\n *********************************************************)\n\nlemma cspF_Seq_compo_dist: \n  \"(P1 |~| P2) ;; Q =F[M,M]\n   (P1 ;; Q) |~| (P2 ;; Q)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Seq_compo_dist)\napply (rule order_antisym)\napply (rule, simp add: in_traces in_failures, fast)+\ndone\n\n(*********************************************************\n               dist law for Depth_rest\n *********************************************************)\n\nlemma cspF_Depth_rest_dist: \n  \"(P1 |~| P2) |. n =F[M,M]\n   (P1 |. n) |~| (P2 |. n)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Depth_rest_dist)\napply (rule order_antisym)\napply (rule, simp add: in_failures)\napply (rule, simp add: in_failures)\napply (fast)\ndone\n\n(*********************************************************\n               dist law for Rep_int_choice\n *********************************************************)\n\nlemma cspF_Rep_int_choice_sum_dist:\n  \"!! c:C .. (Pf c |~| Qf c) =F[M,M] (!! c:C .. Pf c) |~| (!! c:C .. Qf c)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_dist)\napply (rule order_antisym)\napply (rule, simp add: in_failures, fast)+\ndone\n\nlemma cspF_Rep_int_choice_nat_dist:\n  \"!nat n:N .. (Pf n |~| Qf n) =F[M,M] (!nat n:N .. Pf n) |~| (!nat n:N .. Qf n)\"\nby (simp add: Rep_int_choice_ss_def cspF_Rep_int_choice_sum_dist)\n\nlemma cspF_Rep_int_choice_set_dist:\n  \"!set X:Xs .. (Pf X |~| Qf X) =F[M,M] (!set X:Xs .. Pf X) |~| (!set X:Xs .. Qf X)\"\nby (simp add: Rep_int_choice_ss_def cspF_Rep_int_choice_sum_dist)\n\nlemma cspF_Rep_int_choice_com_dist:\n  \"! a:X .. (Pf a |~| Qf a) =F[M,M] (! a:X .. Pf a) |~| (! a:X .. Qf a)\"\nby (simp add: Rep_int_choice_com_def cspF_Rep_int_choice_set_dist)\n\nlemma cspF_Rep_int_choice_f_dist:\n  \"inj f ==>\n   !<f> a:X .. (Pf a |~| Qf a) =F[M,M] (!<f> a:X .. Pf a) |~| (!<f> a:X .. Qf a)\"\nby (simp add: Rep_int_choice_f_def cspF_Rep_int_choice_com_dist)\n\nlemmas cspF_Rep_int_choice_dist =\n       cspF_Rep_int_choice_sum_dist\n       cspF_Rep_int_choice_nat_dist\n       cspF_Rep_int_choice_set_dist\n       cspF_Rep_int_choice_com_dist\n       cspF_Rep_int_choice_f_dist\n\n(*********************************************************\n                     dist laws\n *********************************************************)\n\nlemmas cspF_dist = cspF_Ext_choice_dist_l cspF_Ext_choice_dist_r\n                   cspF_Parallel_dist_l   cspF_Parallel_dist_r\n                   cspF_Hiding_dist       cspF_Renaming_dist\n                   cspF_Seq_compo_dist    cspF_Depth_rest_dist\n                   cspF_Rep_int_choice_dist\n\n\n(*****************************************************************\n\n      distribution over replicated internal choice\n\n         1. (!! :C .. Pf) [+] Q\n         2. Q [+] (!! :C .. Pf)\n         3. (!! :C .. Pf) |[X]| Q\n         4. Q |[X]| (!! :C .. Pf)\n         5. (!! :C .. Pf) -- X\n         6. (!! :C .. Pf) [[r]]\n         7. (!! :C .. Pf) |. n\n\n *****************************************************************)\n\n(*********************************************************\n                Rep_dist law for Ext_choice (l)\n *********************************************************)\n\nlemma cspF_Ext_choice_Dist_sum_l_nonempty: \n  \"sumset C ~= {} ==> (!! :C .. Pf) [+] Q =F[M,M]\n                      !! c:C .. (Pf c [+] Q)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Dist_nonempty)\napply (rule order_antisym)\napply (rule, simp add: in_traces in_failures, fast)+\ndone\n\n(*** Dist ***)\n\nlemma cspF_Ext_choice_Dist_sum_l: \n  \"(!! :C .. Pf) [+] Q =F[M,M]\n   IF (sumset C={}) THEN (DIV [+] Q) ELSE (!! c:C .. (Pf c [+] Q))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_decompo)\napply (rule cspF_Rep_int_choice_empty)\napply (simp_all)\n\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_Ext_choice_Dist_sum_l_nonempty)\napply (simp)\ndone\n\n(*********************************************************\n                Dist_sum law for Ext_choice (r)\n *********************************************************)\n\nlemma cspF_Ext_choice_Dist_sum_r_nonempty: \n  \"sumset C ~= {} ==> P [+] (!! :C .. Qf) =F[M,M]\n               !! c:C .. (P [+] Qf c)\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_Ext_choice_Dist_sum_l_nonempty, simp)\napply (rule cspF_decompo, simp)\napply (rule cspF_commut)\ndone\n\n(*** Dist ***)\n\nlemma cspF_Ext_choice_Dist_sum_r: \n  \"P [+] (!! :C .. Qf) =F[M,M]\n   IF (sumset C={}) THEN (P [+] DIV) ELSE (!! c:C .. (P [+] Qf c))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_decompo)\napply (simp)\napply (simp add: cspF_Rep_int_choice_empty)\n\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_Ext_choice_Dist_sum_r_nonempty)\napply (simp)\ndone\n\n(*********************************************************\n                Dist_sum law for Parallel (l)\n *********************************************************)\n\nlemma cspF_Parallel_Dist_sum_l_nonempty: \n  \"sumset C ~= {} ==>\n     (!! :C .. Pf) |[X]| Q =F[M,M]\n     !! c:C .. (Pf c |[X]| Q)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Dist_nonempty)\napply (rule order_antisym)\n\n(* domF *)\n  apply (rule)\n  apply (simp add: in_failures)\n  apply (elim conjE exE bexE)\n   apply (rule_tac x=\"c\" in bexI)\n   apply (rule_tac x=\"Y\" in exI)\n   apply (rule_tac x=\"Z\" in exI)\n   apply (fast)\n   apply (simp)\n  (* *)\n  apply (rule)\n  apply (simp add: in_failures)\n  apply (elim conjE exE bexE)\n   apply (rule_tac x=\"Y\" in exI)\n   apply (rule_tac x=\"Z\" in exI)\n   apply (fast)\ndone\n\n(*** Dist ***)\n\nlemma cspF_Parallel_Dist_sum_l: \n  \"(!! :C .. Pf) |[X]| Q =F[M,M]\n   IF (sumset C={}) THEN (DIV |[X]| Q) ELSE (!! c:C .. (Pf c |[X]| Q))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_decompo)\napply (simp)\napply (simp add: cspF_Rep_int_choice_empty)\napply (simp)\n\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_Parallel_Dist_sum_l_nonempty)\napply (simp)\ndone\n\n(*********************************************************\n                Dist_sum law for Parallel (r)\n *********************************************************)\n\nlemma cspF_Parallel_Dist_sum_r_nonempty: \n  \"sumset C ~= {} ==>\n     P |[X]| (!! :C .. Qf) =F[M,M]\n     !! c:C .. (P |[X]| Qf c)\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_Parallel_Dist_sum_l_nonempty, simp)\napply (rule cspF_decompo, simp)\napply (rule cspF_commut)\ndone\n\n(*** Dist ***)\n\nlemma cspF_Parallel_Dist_sum_r: \n  \"P |[X]| (!! :C .. Qf) =F[M,M]\n   IF (sumset C={}) THEN (P |[X]| DIV) ELSE (!! c:C .. (P |[X]| Qf c))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (simp add: cspF_Rep_int_choice_empty)\n\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_Parallel_Dist_sum_r_nonempty)\napply (simp)\ndone\n\n(*********************************************************\n                Dist_sum law for Hiding\n *********************************************************)\n\nlemma cspF_Hiding_Dist_sum: \n  \"(!! :C .. Pf) -- X =F[M,M]\n   !! c:C .. (Pf c -- X)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Dist)\napply (rule order_antisym)\napply (rule, simp add: in_failures, fast)+\ndone\n\n(*********************************************************\n                Dist_sum law for Renaming\n *********************************************************)\n\nlemma cspF_Renaming_Dist_sum: \n  \"(!! :C .. Pf) [[r]] =F[M,M]\n   !! c:C .. (Pf c [[r]])\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Dist)\napply (rule order_antisym)\napply (rule, simp add: in_failures, fast)+\ndone\n\n(*********************************************************\n          Dist_sum law for Sequential composition\n *********************************************************)\n\nlemma cspF_Seq_compo_Dist_sum: \n  \"(!! :C .. Pf) ;; Q =F[M,M]\n   !! c:C .. (Pf c ;; Q)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Dist)\napply (rule order_antisym)\napply (rule, simp add: in_traces in_failures)\napply (force)\napply (rule, simp add: in_traces in_failures)\napply (force)\ndone\n\n(*********************************************************\n                Dist_sum law for Depth_rest\n *********************************************************)\n\nlemma cspF_Depth_rest_Dist_sum: \n  \"(!! :C .. Pf) |. m =F[M,M]\n   !! c:C .. (Pf c |. m)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Dist)\napply (rule order_antisym)\napply (rule, simp add: in_failures)\napply (rule, simp add: in_failures)\ndone\n\n(*********************************************************\n                     Dist_sum laws\n *********************************************************)\n\nlemmas cspF_Dist_sum = cspF_Ext_choice_Dist_sum_l cspF_Ext_choice_Dist_sum_r\n                        cspF_Parallel_Dist_sum_l   cspF_Parallel_Dist_sum_r\n                        cspF_Hiding_Dist_sum       cspF_Renaming_Dist_sum\n                        cspF_Seq_compo_Dist_sum    cspF_Depth_rest_Dist_sum\n\nlemmas cspF_Dist_sum_nonempty = \n       cspF_Ext_choice_Dist_sum_l_nonempty cspF_Ext_choice_Dist_sum_r_nonempty\n       cspF_Parallel_Dist_sum_l_nonempty   cspF_Parallel_Dist_sum_r_nonempty\n       cspF_Hiding_Dist_sum       cspF_Renaming_Dist_sum\n       cspF_Seq_compo_Dist_sum    cspF_Depth_rest_Dist_sum\n\n(*****************************************************************\n\n      distribution of internal bind over ...\n\n         1. (!nat :N .. Pf) [+] Q\n         2. Q [+] (!nat :N .. Pf)\n         3. (!nat :N .. Pf) |[X]| Q\n         4. Q |[X]| (!nat :N .. Pf)\n         5. (!nat :N .. Pf) -- X\n         6. (!nat :N .. Pf) [[r]]\n         7. (!nat :N .. Pf) |. n\n\n *****************************************************************)\n\n(*********************************************************\n                Dist law for Ext_choice (l)\n *********************************************************)\n\nlemma cspF_Ext_choice_Dist_nat_l_nonempty: \n  \"N ~= {} ==> (!nat :N .. Pf) [+] Q =F[M,M]\n               !nat n:N .. (Pf n [+] Q)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Ext_choice_Dist_nat_l: \n  \"(!nat :N .. Pf) [+] Q =F[M,M]\n   IF (N={}) THEN (DIV [+] Q) ELSE (!nat n:N .. (Pf n [+] Q))\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspF_rw_left)\napply (rule cspF_Dist_sum)\napply (simp)\ndone\n\n(*********************************************************\n                Dist_nat law for Ext_choice (r)\n *********************************************************)\n\nlemma cspF_Ext_choice_Dist_nat_r_nonempty: \n  \"N ~= {} ==> P [+] (!nat :N .. Qf) =F[M,M]\n               !nat n:N .. (P [+] Qf n)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Ext_choice_Dist_nat_r: \n  \"P [+] (!nat :N .. Qf) =F[M,M]\n   IF (N={}) THEN (P [+] DIV) ELSE (!nat n:N .. (P [+] Qf n))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Dist_sum, simp)\n\n(*********************************************************\n                Dist_nat law for Parallel (l)\n *********************************************************)\n\nlemma cspF_Parallel_Dist_nat_l_nonempty: \n  \"N ~= {} ==>\n     (!nat :N .. Pf) |[X]| Q =F[M,M]\n     !nat n:N .. (Pf n |[X]| Q)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Parallel_Dist_nat_l: \n  \"(!nat :N .. Pf) |[X]| Q =F[M,M]\n   IF (N={}) THEN (DIV |[X]| Q) ELSE (!nat n:N .. (Pf n |[X]| Q))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Dist_sum, simp)\n\n(*********************************************************\n                Dist_nat law for Parallel (r)\n *********************************************************)\n\nlemma cspF_Parallel_Dist_nat_r_nonempty: \n  \"N ~= {} ==>\n     P |[X]| (!nat :N .. Qf) =F[M,M]\n     !nat n:N .. (P |[X]| Qf n)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Parallel_Dist_nat_r: \n  \"P |[X]| (!nat :N .. Qf) =F[M,M]\n   IF (N={}) THEN (P |[X]| DIV) ELSE (!nat n:N .. (P |[X]| Qf n))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Dist_sum, simp)\n\n(*********************************************************\n                Dist_nat law for Hiding\n *********************************************************)\n\nlemma cspF_Hiding_Dist_nat: \n  \"(!nat :N .. Pf) -- X =F[M,M]\n   !nat n:N .. (Pf n -- X)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*********************************************************\n                Dist_nat law for Renaming\n *********************************************************)\n\nlemma cspF_Renaming_Dist_nat: \n  \"(!nat :N .. Pf) [[r]] =F[M,M]\n   !nat n:N .. (Pf n [[r]])\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*********************************************************\n          Dist_nat law for Sequential composition\n *********************************************************)\n\nlemma cspF_Seq_compo_Dist_nat: \n  \"(!nat :N .. Pf) ;; Q =F[M,M]\n   !nat n:N .. (Pf n ;; Q)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*********************************************************\n                Dist_nat law for Depth_rest\n *********************************************************)\n\nlemma cspF_Depth_rest_Dist_nat: \n  \"(!nat :N .. Pf) |. m =F[M,M]\n   !nat n:N .. (Pf n |. m)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*********************************************************\n                     Dist_nat laws\n *********************************************************)\n\nlemmas cspF_Dist_nat = cspF_Ext_choice_Dist_nat_l cspF_Ext_choice_Dist_nat_r\n                        cspF_Parallel_Dist_nat_l   cspF_Parallel_Dist_nat_r\n                        cspF_Hiding_Dist_nat       cspF_Renaming_Dist_nat\n                        cspF_Seq_compo_Dist_nat    cspF_Depth_rest_Dist_nat\n\nlemmas cspF_Dist_nat_nonempty = \n       cspF_Ext_choice_Dist_nat_l_nonempty cspF_Ext_choice_Dist_nat_r_nonempty\n       cspF_Parallel_Dist_nat_l_nonempty   cspF_Parallel_Dist_nat_r_nonempty\n       cspF_Hiding_Dist_nat       cspF_Renaming_Dist_nat\n       cspF_Seq_compo_Dist_nat    cspF_Depth_rest_Dist_nat\n\n(*****************************************************************\n\n      distribution of internal bind over ...\n\n         1. (!set :Xs .. Pf) [+] Q\n         2. Q [+] (!set :Xs .. Pf)\n         3. (!set :Xs .. Pf) |[X]| Q\n         4. Q |[X]| (!set :Xs .. Pf)\n         5. (!set :Xs .. Pf) -- X\n         6. (!set :Xs .. Pf) [[r]]\n         7. (!set :Xs .. Pf) |. n\n\n *****************************************************************)\n\n(*********************************************************\n                Dist law for Ext_choice (l)\n *********************************************************)\n\nlemma cspF_Ext_choice_Dist_set_l_nonempty: \n  \"Xs ~= {} ==> (!set :Xs .. Pf) [+] Q =F[M,M]\n               !set X:Xs .. (Pf X [+] Q)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Ext_choice_Dist_set_l: \n  \"(!set :Xs .. Pf) [+] Q =F[M,M]\n   IF (Xs={}) THEN (DIV [+] Q) ELSE (!set X:Xs .. (Pf X [+] Q))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Dist_sum, simp)\n\n(*********************************************************\n                Dist_set law for Ext_choice (r)\n *********************************************************)\n\nlemma cspF_Ext_choice_Dist_set_r_nonempty: \n  \"Xs ~= {} ==> P [+] (!set :Xs .. Qf) =F[M,M]\n               !set X:Xs .. (P [+] Qf X)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Ext_choice_Dist_set_r: \n  \"P [+] (!set :Xs .. Qf) =F[M,M]\n   IF (Xs={}) THEN (P [+] DIV) ELSE (!set X:Xs .. (P [+] Qf X))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Dist_sum, simp)\n\n(*********************************************************\n                Dist_set law for Parallel (l)\n *********************************************************)\n\nlemma cspF_Parallel_Dist_set_l_nonempty: \n  \"Xs ~= {} ==>\n     (!set :Xs .. Pf) |[Y]| Q =F[M,M]\n     !set X:Xs .. (Pf X |[Y]| Q)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Parallel_Dist_set_l: \n  \"(!set :Xs .. Pf) |[Y]| Q =F[M,M]\n   IF (Xs={}) THEN (DIV |[Y]| Q) ELSE (!set X:Xs .. (Pf X |[Y]| Q))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Dist_sum, simp)\n\n(*********************************************************\n                Dist_set law for Parallel (r)\n *********************************************************)\n\nlemma cspF_Parallel_Dist_set_r_nonempty: \n  \"Xs ~= {} ==>\n     P |[Y]| (!set :Xs .. Qf) =F[M,M]\n     !set X:Xs .. (P |[Y]| Qf X)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Parallel_Dist_set_r: \n  \"P |[Y]| (!set :Xs .. Qf) =F[M,M]\n   IF (Xs={}) THEN (P |[Y]| DIV) ELSE (!set X:Xs .. (P |[Y]| Qf X))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Dist_sum, simp)\n\n(*********************************************************\n                Dist_set law for Hiding\n *********************************************************)\n\nlemma cspF_Hiding_Dist_set: \n  \"(!set :Xs .. Pf) -- Y =F[M,M]\n   !set X:Xs .. (Pf X -- Y)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*********************************************************\n                Dist_set law for Renaming\n *********************************************************)\n\nlemma cspF_Renaming_Dist_set: \n  \"(!set :Xs .. Pf) [[r]] =F[M,M]\n   !set X:Xs .. (Pf X [[r]])\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*********************************************************\n          Dist_set law for Sequential composition\n *********************************************************)\n\nlemma cspF_Seq_compo_Dist_set: \n  \"(!set :Xs .. Pf) ;; Q =F[M,M]\n   !set X:Xs .. (Pf X ;; Q)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*********************************************************\n                Dist_set law for Depth_rest\n *********************************************************)\n\nlemma cspF_Depth_rest_Dist_set: \n  \"(!set :Xs .. Pf) |. m =F[M,M]\n   !set X:Xs .. (Pf X |. m)\"\nby (simp add: Rep_int_choice_ss_def cspF_Dist_sum_nonempty)\n\n(*********************************************************\n                     Dist_set laws\n *********************************************************)\n\nlemmas cspF_Dist_set = cspF_Ext_choice_Dist_set_l cspF_Ext_choice_Dist_set_r\n                        cspF_Parallel_Dist_set_l   cspF_Parallel_Dist_set_r\n                        cspF_Hiding_Dist_set       cspF_Renaming_Dist_set\n                        cspF_Seq_compo_Dist_set    cspF_Depth_rest_Dist_set\n\nlemmas cspF_Dist_set_nonempty = \n       cspF_Ext_choice_Dist_set_l_nonempty cspF_Ext_choice_Dist_set_r_nonempty\n       cspF_Parallel_Dist_set_l_nonempty   cspF_Parallel_Dist_set_r_nonempty\n       cspF_Hiding_Dist_set       cspF_Renaming_Dist_set\n       cspF_Seq_compo_Dist_set    cspF_Depth_rest_Dist_set\n\n(*****************************************************************\n\n      for convenience\n\n         1. (! :X .. Pf) [+] Q\n         2. Q [+] (! :X .. Pf)\n         3. (! :X .. Pf) |[X]| Q\n         4. Q |[X]| (! :X .. Pf)\n         5. (! :X .. Pf) -- X\n         6. (! :X .. Pf) [[r]]\n         7. (! :X .. Pf) |. n\n\n *****************************************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Ext_choice_Dist_com_l_nonempty: \n  \"X ~= {}\n   ==> (! :X .. Pf) [+] Q =F[M,M] ! x:X .. (Pf x [+] Q)\"\nby (simp add: Rep_int_choice_com_def cspF_Dist_set_nonempty)\n\nlemma cspF_Ext_choice_Dist_com_r_nonempty: \n  \"X ~= {}\n   ==> P [+] (! :X .. Qf) =F[M,M] ! x:X .. (P [+] Qf x)\"\nby (simp add: Rep_int_choice_com_def cspF_Dist_set_nonempty)\n\nlemma cspF_Parallel_Dist_com_l_nonempty: \n  \"Y ~= {}\n   ==> (! :Y .. Pf) |[X]| Q =F[M,M] ! x:Y .. (Pf x |[X]| Q)\"\nby (simp add: Rep_int_choice_com_def cspF_Dist_set_nonempty)\n\nlemma cspF_Parallel_Dist_com_r_nonempty: \n  \"Y ~= {}\n   ==> P |[X]| (! :Y .. Qf) =F[M,M] ! x:Y .. (P |[X]| Qf x)\"\nby (simp add: Rep_int_choice_com_def cspF_Dist_set_nonempty)\n\nlemma cspF_Ext_choice_Dist_com_l: \n  \"(! :X .. Pf) [+] Q =F[M,M] \n   IF (X ={}) THEN (DIV [+] Q) ELSE (! x:X .. (Pf x [+] Q))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspF_rw_left, rule cspF_Dist_set, simp)\n\nlemma cspF_Ext_choice_Dist_com_r: \n  \"P [+] (! :X .. Qf) =F[M,M]\n   IF (X ={}) THEN (P [+] DIV) ELSE (! x:X .. (P [+] Qf x))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspF_rw_left, rule cspF_Dist_set, simp)\n\nlemma cspF_Parallel_Dist_com_l: \n  \"(! :Y .. Pf) |[X]| Q =F[M,M]\n   IF (Y ={}) THEN (DIV |[X]| Q) ELSE (! x:Y .. (Pf x |[X]| Q))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspF_rw_left, rule cspF_Dist_set, simp)\n\nlemma cspF_Parallel_Dist_com_r: \n  \"P |[X]| (! :Y .. Qf) =F[M,M] \n   IF (Y ={}) THEN (P |[X]| DIV) ELSE (! x:Y .. (P |[X]| Qf x))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspF_rw_left, rule cspF_Dist_set, simp)\n\nlemma cspF_Hiding_Dist_com: \n  \"(! :Y .. Pf) -- X =F[M,M] ! x:Y .. (Pf x -- X)\"\nby (simp add: Rep_int_choice_com_def cspF_Dist_set_nonempty)\n\nlemma cspF_Renaming_Dist_com: \n  \"(! :X .. Pf) [[r]] =F[M,M] ! x:X .. (Pf x [[r]])\"\nby (simp add: Rep_int_choice_com_def cspF_Dist_set_nonempty)\n\nlemma cspF_Seq_compo_Dist_com:\n  \"(! :X .. Pf) ;; Q =F[M,M] ! x:X .. (Pf x ;; Q)\"\nby (simp add: Rep_int_choice_com_def cspF_Dist_set_nonempty)\n\nlemma cspF_Depth_rest_Dist_com: \n  \"(! :X .. Pf) |. n =F[M,M] ! x:X .. (Pf x |. n)\"\nby (simp add: Rep_int_choice_com_def cspF_Dist_set_nonempty)\n\n(*********************************************************\n                     Dist laws\n *********************************************************)\n\nlemmas cspF_Dist_com = cspF_Ext_choice_Dist_com_l cspF_Ext_choice_Dist_com_r\n                           cspF_Parallel_Dist_com_l   cspF_Parallel_Dist_com_r\n                           cspF_Hiding_Dist_com       cspF_Renaming_Dist_com\n                           cspF_Seq_compo_Dist_com    cspF_Depth_rest_Dist_com\n\nlemmas cspF_Dist_com_nonempty = \n       cspF_Ext_choice_Dist_com_l_nonempty cspF_Ext_choice_Dist_com_r_nonempty\n       cspF_Parallel_Dist_com_l_nonempty   cspF_Parallel_Dist_com_r_nonempty\n       cspF_Hiding_Dist_com       cspF_Renaming_Dist_com\n       cspF_Seq_compo_Dist_com    cspF_Depth_rest_Dist_com\n\n\n(*****************************************************************\n\n      for convenience\n\n         1. (!<f> :X .. Pf) [+] Q\n         2. Q [+] (!<f> :X .. Pf)\n         3. (!<f> :X .. Pf) |[X]| Q\n         4. Q |[X]| (!<f> :X .. Pf)\n         5. (!<f> :X .. Pf) -- X\n         6. (!<f> :X .. Pf) [[r]]\n         7. (!<f> :X .. Pf) |. n\n\n *****************************************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Ext_choice_Dist_f_l_nonempty: \n  \"[| inj f ; X ~= {} |]\n   ==> (!<f> :X .. Pf) [+] Q =F[M,M] !<f> x:X .. (Pf x [+] Q)\"\nby (simp add: Rep_int_choice_f_def cspF_Dist_com_nonempty)\n\nlemma cspF_Ext_choice_Dist_f_r_nonempty: \n  \"[| inj f ; X ~= {} |]\n   ==> P [+] (!<f> :X .. Qf) =F[M,M] !<f> x:X .. (P [+] Qf x)\"\nby (simp add: Rep_int_choice_f_def cspF_Dist_com_nonempty)\n\nlemma cspF_Parallel_Dist_f_l_nonempty: \n  \"[| inj f ; Y ~= {} |]\n   ==> (!<f> :Y .. Pf) |[X]| Q =F[M,M] !<f> x:Y .. (Pf x |[X]| Q)\"\nby (simp add: Rep_int_choice_f_def cspF_Dist_com_nonempty)\n\nlemma cspF_Parallel_Dist_f_r_nonempty: \n  \"[| inj f ; Y ~= {} |]\n   ==> P |[X]| (!<f> :Y .. Qf) =F[M,M] !<f> x:Y .. (P |[X]| Qf x)\"\nby (simp add: Rep_int_choice_f_def cspF_Dist_com_nonempty)\n\nlemma cspF_Ext_choice_Dist_f_l: \n  \"(!<f> :X .. Pf) [+] Q =F[M,M] \n   IF (X ={}) THEN (DIV [+] Q) ELSE (!<f> x:X .. (Pf x [+] Q))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspF_rw_left, rule cspF_Dist_com, simp)\n\nlemma cspF_Ext_choice_Dist_f_r: \n  \"P [+] (!<f> :X .. Qf) =F[M,M]\n   IF (X ={}) THEN (P [+] DIV) ELSE (!<f> x:X .. (P [+] Qf x))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspF_rw_left, rule cspF_Dist_com, simp)\n\nlemma cspF_Parallel_Dist_f_l: \n  \"(!<f> :Y .. Pf) |[X]| Q =F[M,M]\n   IF (Y ={}) THEN (DIV |[X]| Q) ELSE (!<f> x:Y .. (Pf x |[X]| Q))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspF_rw_left, rule cspF_Dist_com, simp)\n\nlemma cspF_Parallel_Dist_f_r: \n  \"P |[X]| (!<f> :Y .. Qf) =F[M,M] \n   IF (Y ={}) THEN (P |[X]| DIV) ELSE (!<f> x:Y .. (P |[X]| Qf x))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspF_rw_left, rule cspF_Dist_com, simp)\n\nlemma cspF_Hiding_Dist_f: \n  \"(!<f> :Y .. Pf) -- X =F[M,M] !<f> x:Y .. (Pf x -- X)\"\nby (simp add: Rep_int_choice_f_def cspF_Dist_com)\n\nlemma cspF_Renaming_Dist_f: \n  \"(!<f> :X .. Pf) [[r]] =F[M,M] !<f> x:X .. (Pf x [[r]])\"\nby (simp add: Rep_int_choice_f_def cspF_Dist_com)\n\nlemma cspF_Seq_compo_Dist_f:\n  \"(!<f> :X .. Pf) ;; Q =F[M,M] !<f> x:X .. (Pf x ;; Q)\"\nby (simp add: Rep_int_choice_f_def cspF_Dist_com)\n\nlemma cspF_Depth_rest_Dist_f: \n  \"(!<f> :X .. Pf) |. n =F[M,M] !<f> x:X .. (Pf x |. n)\"\nby (simp add: Rep_int_choice_f_def cspF_Dist_com)\n\n(*********************************************************\n                     Dist laws\n *********************************************************)\n\nlemmas cspF_Dist_f = cspF_Ext_choice_Dist_f_l cspF_Ext_choice_Dist_f_r\n                           cspF_Parallel_Dist_f_l   cspF_Parallel_Dist_f_r\n                           cspF_Hiding_Dist_f       cspF_Renaming_Dist_f\n                           cspF_Seq_compo_Dist_f    cspF_Depth_rest_Dist_f\n\nlemmas cspF_Dist_f_nonempty = \n       cspF_Ext_choice_Dist_f_l_nonempty cspF_Ext_choice_Dist_f_r_nonempty\n       cspF_Parallel_Dist_f_l_nonempty   cspF_Parallel_Dist_f_r_nonempty\n       cspF_Hiding_Dist_f       cspF_Renaming_Dist_f\n       cspF_Seq_compo_Dist_f    cspF_Depth_rest_Dist_f\n\n(*** all rules ***)\n\nlemmas cspF_Dist = cspF_Dist_sum\n                   cspF_Dist_nat cspF_Dist_set cspF_Dist_com cspF_Dist_f\n\nlemmas cspF_Dist_nonempty = cspF_Dist_sum_nonempty\n                            cspF_Dist_nat_nonempty\n                            cspF_Dist_set_nonempty\n                            cspF_Dist_com_nonempty\n                            cspF_Dist_f_nonempty\n\n(*****************************************************************\n\n      additional distribution over replicated internal choice\n\n         1. (!! :X .. (a -> P))\n         2. (!! :Y .. (? :X -> P))\n\n *****************************************************************)\n\n(*********************************************************\n              Dist law for Act_prefix\n *********************************************************)\n\nlemma cspF_Act_prefix_Dist_sum:\n  \"sumset C ~= {} ==> \n   a -> (!! :C .. Pf) =F[M,M] !! c:C .. (a -> Pf c)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Act_prefix_Dist)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE)\n  apply (force)\n\n  apply (elim conjE exE bexE)\n  apply (rule_tac x=\"c\" in bexI)\n  apply (force)\n  apply (simp)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE bexE exE)\n  apply (simp)\n  apply (simp)\n  apply (rule_tac x=\"c\" in bexI)\n  apply (simp)\n  apply (simp)\ndone\n\n(*********************************************************\n              Dist_nat law for Ext_pre_choice\n *********************************************************)\n\nlemma cspF_Ext_pre_choice_Dist_sum:\n  \"sumset C ~= {} ==> \n   ? x:X -> (!! c:C .. (Pf c) x) =F[M,M] !! c:C .. (? :X -> (Pf c))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Ext_pre_choice_Dist)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE)\n  apply (force)\n\n  apply (elim conjE exE bexE)\n  apply (rule_tac x=\"c\" in bexI)\n  apply (force)\n  apply (simp)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE bexE)\n  apply (simp)\n  apply (simp)\n  apply (rule_tac x=\"c\" in bexI)\n  apply (simp)\n  apply (simp)\ndone\n\n(*****************************************************************\n                     for convenienve\n *****************************************************************)\n\n(* nat *)\n\nlemma cspF_Act_prefix_Dist_nat:\n  \"N ~= {} ==> \n   a -> (!nat :N .. Pf) =F[M,M] !nat n:N .. (a -> Pf n)\"\nby (simp add: Rep_int_choice_ss_def cspF_Act_prefix_Dist_sum)\n\nlemma cspF_Ext_pre_choice_Dist_nat:\n  \"N ~= {} ==> \n   ? x:X -> (!nat n:N .. (Pf n) x) =F[M,M] !nat n:N .. (? :X -> (Pf n))\"\nby (simp add: Rep_int_choice_ss_def cspF_Ext_pre_choice_Dist_sum)\n\n(* set *)\n\nlemma cspF_Act_prefix_Dist_set:\n  \"Xs ~= {} ==> \n   a -> (!set :Xs .. Pf) =F[M,M] !set X:Xs .. (a -> Pf X)\"\nby (simp add: Rep_int_choice_ss_def cspF_Act_prefix_Dist_sum)\n\nlemma cspF_Ext_pre_choice_Dist_set:\n  \"Ys ~= {} ==> \n   ? x:X -> (!set Y:Ys .. (Pf Y) x) =F[M,M] !set Y:Ys .. (? :X -> (Pf Y))\"\nby (simp add: Rep_int_choice_ss_def cspF_Ext_pre_choice_Dist_sum)\n\n(* com *)\n\nlemma cspF_Act_prefix_Dist_com:\n  \"X ~= {} ==> \n   a -> (! :X .. Pf) =F[M,M] ! x:X .. (a -> Pf x)\"\nby (simp add: Rep_int_choice_com_def cspF_Act_prefix_Dist_set)\n\nlemma cspF_Ext_pre_choice_Dist_com:\n  \"Y ~= {} ==> \n   ? x:X -> (! y:Y .. (Pf y) x) =F[M,M] ! y:Y .. (? :X -> (Pf y))\"\nby (simp add: Rep_int_choice_com_def cspF_Ext_pre_choice_Dist_set)\n\n(* f *)\n\nlemma cspF_Act_prefix_Dist_f:\n  \"X ~= {} ==> \n   a -> (!<f> :X .. Pf) =F[M,M] !<f> x:X .. (a -> Pf x)\"\nby (simp add: Rep_int_choice_f_def cspF_Act_prefix_Dist_com)\n\nlemma cspF_Ext_pre_choice_Dist_f:\n  \"Y ~= {} ==> \n   ? x:X -> (!<f> y:Y .. (Pf y) x) =F[M,M] !<f> y:Y .. (? :X -> (Pf y))\"\nby (simp add: Rep_int_choice_f_def cspF_Ext_pre_choice_Dist_com)\n\n(*** arias ***)\n\nlemmas cspF_Act_prefix_Dist \n     = cspF_Act_prefix_Dist_sum\n       cspF_Act_prefix_Dist_nat\n       cspF_Act_prefix_Dist_set\n       cspF_Act_prefix_Dist_com\n       cspF_Act_prefix_Dist_f\n\nlemmas cspF_Ext_pre_choice_Dist\n     = cspF_Ext_pre_choice_Dist_sum\n       cspF_Ext_pre_choice_Dist_nat\n       cspF_Ext_pre_choice_Dist_set\n       cspF_Ext_pre_choice_Dist_com\n       cspF_Ext_pre_choice_Dist_f\n\n(*****************************************************************\n      distribution over external choice\n         1. (P1 [+] P2) [[r]]\n         2. (P1 [+] P2) |. n\n *****************************************************************)\n\n(*********************\n     [[r]]-[+]-dist\n *********************)\n\nlemma cspF_Renaming_Ext_dist: \n  \"(P1 [+] P2) [[r]] =F[M,M]\n   (P1 [[r]]) [+] (P2 [[r]])\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Renaming_Ext_dist)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures in_traces)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures in_traces)\n apply (force)\ndone\n\n(*********************\n     |.-[+]-dist\n *********************)\n\nlemma cspF_Depth_rest_Ext_dist: \n  \"(P1 [+] P2) |. n =F[M,M]\n   (P1 |. n) [+] (P2 |. n)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Depth_rest_Ext_dist)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures in_traces)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures in_traces)\n apply (force)\ndone\n\nlemmas cspF_Ext_dist = cspF_Renaming_Ext_dist cspF_Depth_rest_Ext_dist\n\n(*---------------------------------------------------------*\n |                   complex distribution                  |\n *---------------------------------------------------------*)\n\n(*********************\n     !!-input-!set\n *********************)\n\nlemma cspF_Rep_int_choice_sum_input_set:\n  \"(!! c:C .. (? :(Yf c) -> Rff c))\n   =F[M,M]\n   (!set Y : {(Yf c)|c. c: sumset C} .. \n      (? a : Y -> (!! c:{c:C. a : Yf c}s .. Rff c a)))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_input_set)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (elim disjE conjE exE bexE)\n apply (simp_all)\n apply (force)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\napply (rule_tac x=\"c\" in bexI)\napply (simp)\napply (simp)\napply (rule_tac x=\"ca\" in bexI)\napply (simp)\napply (simp)\ndone\n\nlemma cspF_Rep_int_choice_nat_input_set:\n  \"(!nat n:N .. (? :(Yf n) -> Rff n))\n   =F[M,M]\n   (!set Y : {(Yf n)|n. n:N} .. (? a : Y -> (!nat n:{n:N. a : Yf n} .. Rff n a)))\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspF_rw_left)\napply (rule cspF_Rep_int_choice_sum_input_set)\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspF_decompo)\napply (auto)\napply (rule_tac x=\"type2 n\" in exI)\nby (auto)\n\nlemma cspF_Rep_int_choice_set_input_set:\n  \"(!set X:Xs .. (? :(Yf X) -> Rff X))\n   =F[M,M]\n   (!set Y : {(Yf X)|X. X:Xs} .. (? a : Y -> (!set X:{X:Xs. a : Yf X} .. Rff X a)))\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspF_rw_left)\napply (rule cspF_Rep_int_choice_sum_input_set)\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspF_decompo)\napply (auto)\napply (rule_tac x=\"type1 X\" in exI)\nby (auto)\n\nlemmas cspF_Rep_int_choice_input_set =\n       cspF_Rep_int_choice_sum_input_set\n       cspF_Rep_int_choice_nat_input_set\n       cspF_Rep_int_choice_set_input_set\n\n(*-------------------------------*\n          !!-[+]-Dist\n *-------------------------------*)\n\nlemma cspF_Rep_int_choice_Ext_Dist_sum:\n  \"ALL c:sumset C. (Qf c = SKIP | Qf c = DIV) ==>\n   (!! c:C .. (Pf c [+] Qf c)) =F[M,M]\n   ((!! :C .. Pf) [+] (!! :C .. Qf))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_Ext_Dist)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures in_traces)\n apply (elim conjE exE bexE disjE)\n\n  apply (drule_tac x=\"c\" in bspec, simp)\n  apply (erule disjE)\n  apply (simp add: in_failures)\n  apply (rule disjI2)\n  apply (rule disjI2)\n  apply (rule_tac x=\"c\" in bexI)\n  apply (simp add: in_traces)\n  apply (simp)\n\n  apply (simp add: in_failures)\n  apply (force)\n\n  apply (drule_tac x=\"c\" in bspec, simp)\n  apply (erule disjE)\n  apply (simp add: in_failures)\n  apply (rule disjI2)\n  apply (rule_tac x=\"c\" in bexI)\n  apply (simp add: in_failures)\n  apply (simp)\n\n  apply (simp add: in_failures)\n  apply (force)\n\n  apply (drule_tac x=\"c\" in bspec, simp)\n  apply (erule disjE)\n  apply (simp add: in_failures)\n  apply (rule disjI2)\n  apply (rule disjI2)\n  apply (rule_tac x=\"c\" in bexI)\n  apply (simp add: in_traces)\n  apply (simp)\n\n  apply (simp add: in_traces)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures in_traces)\n apply (elim conjE exE bexE disjE)\n apply (simp_all)\n\n  apply (case_tac \"EX c: sumset C. Qf c = SKIP\")\n  apply (erule bexE)\n  apply (rule_tac x=\"cb\" in bexI)\n  apply (simp add: in_failures in_traces)\n   apply (case_tac \"Qf ca = SKIP\")\n   apply (simp add: in_failures)\n   apply (case_tac \"Qf ca = DIV\")\n   apply (simp add: in_failures)\n   apply (fast)\n  apply (simp)\n\n  apply (simp add: in_failures in_traces)\n\n  apply (force)\n  apply (force)\n  apply (force)\n  apply (force)\ndone\n\nlemma cspF_Rep_int_choice_Ext_Dist_nat:\n  \"ALL n:N. (Qf n = SKIP | Qf n = DIV) ==>\n   (!nat n:N .. (Pf n [+] Qf n)) =F[M,M]\n   ((!nat :N .. Pf) [+] (!nat :N .. Qf))\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspF_Rep_int_choice_Ext_Dist_sum)\nby (auto)\n\nlemma cspF_Rep_int_choice_Ext_Dist_set:\n  \"ALL X:Xs. (Qf X = SKIP | Qf X = DIV) ==>\n   (!set X:Xs .. (Pf X [+] Qf X)) =F[M,M]\n   ((!set :Xs .. Pf) [+] (!set :Xs .. Qf))\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspF_Rep_int_choice_Ext_Dist_sum)\nby (auto)\n\nlemma cspF_Rep_int_choice_Ext_Dist_com:\n  \"ALL a:X. (Qf a = SKIP | Qf a = DIV) ==>\n   (! a:X .. (Pf a [+] Qf a)) =F[M,M]\n   ((! :X .. Pf) [+] (! :X .. Qf))\"\napply (simp add: Rep_int_choice_com_def)\napply (rule cspF_Rep_int_choice_Ext_Dist_set)\nby (auto)\n\nlemma cspF_Rep_int_choice_Ext_Dist_f:\n  \"[| inj f ; ALL a:X. (Qf a = SKIP | Qf a = DIV) |] ==>\n   (!<f> a:X .. (Pf a [+] Qf a)) =F[M,M]\n   ((!<f> :X .. Pf) [+] (!<f> :X .. Qf))\"\napply (simp add: Rep_int_choice_f_def)\napply (rule cspF_Rep_int_choice_Ext_Dist_com)\nby (auto)\n\nlemmas cspF_Rep_int_choice_Ext_Dist =\n       cspF_Rep_int_choice_Ext_Dist_sum\n       cspF_Rep_int_choice_Ext_Dist_nat\n       cspF_Rep_int_choice_Ext_Dist_set\n       cspF_Rep_int_choice_Ext_Dist_com\n       cspF_Rep_int_choice_Ext_Dist_f\n\n(*-------------------------------*\n          !!-input-Dist\n *-------------------------------*)\n\n(* SKIP *)\n\nlemma cspF_Rep_int_choice_input_Dist_SKIP:\n  \"(!set X:Xs .. (? :X -> Pf)) [+] SKIP =F[M,M]\n   (? :(Union Xs) -> Pf) [+] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_input_Dist)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces in_failures)\n apply (elim conjE exE disjE bexE)\n apply (simp_all)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_traces in_failures)\n apply (elim conjE exE disjE bexE)\n apply (simp_all)\n apply (force)\ndone\n\n(* DIV *)\n\nlemma cspF_Rep_int_choice_input_Dist_DIV:\n  \"(!set X:Xs .. (? :X -> Pf)) [+] DIV =F[M,M] (? :(Union Xs) -> Pf) [+] DIV\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_int_choice_input_Dist)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces in_failures)\n apply (elim conjE exE disjE bexE)\n apply (simp_all)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_traces in_failures)\n apply (elim conjE exE disjE bexE)\n apply (simp_all)\n apply (force)\ndone\n\n(* SKIP or DIV *)\n\nlemma cspF_Rep_int_choice_input_Dist:\n  \"Q = SKIP | Q = DIV ==>\n   (!set X:Xs .. (? :X -> Pf)) [+] Q =F[M,M] (? :(Union Xs) -> Pf) [+] Q\"\napply (erule disjE)\napply (simp add: cspF_Rep_int_choice_input_Dist_SKIP)\napply (simp add: cspF_Rep_int_choice_input_Dist_DIV)\ndone\n\n(*-------------------------------*\n          !!-Ext-choice-SKIP\n *-------------------------------*)\n\nlemma cspF_Rep_int_choice_sum_Ext_choice:\n  \"Q = SKIP | Q = DIV ==>\n  (!! c:C .. (? :(Xf c) -> Pf c)) [+] Q\n    =F[M,M] (? x:Union {(Xf c)|c. c: sumset C} -> \n                (!! c:{c:C. x: Xf c}s  .. Pf c x)) [+] Q\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_Rep_int_choice_input_set)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left)\napply (rule cspF_Rep_int_choice_input_Dist)\napply (simp)\napply (simp)\ndone\n\n(*** nat ***)\n\nlemma cspF_Rep_int_choice_nat_Ext_choice:\n  \"Q = SKIP | Q = DIV ==>\n  (!nat n:N .. (? :(Xf n) -> Pf n)) [+] Q\n    =F[M,M] (? x:Union {(Xf n)|n. n:N} -> (!nat n:{n:N. x: Xf n}  .. Pf n x)) [+] Q\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_Rep_int_choice_input_set)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left)\napply (rule cspF_Rep_int_choice_input_Dist)\napply (simp)\napply (simp)\ndone\n\n(*** set ***)\n\nlemma cspF_Rep_int_choice_set_Ext_choice:\n  \"Q = SKIP | Q = DIV ==>\n  (!set X:Xs .. (? :(Xf X) -> Pf X)) [+] Q\n    =F[M,M] (? x:Union {(Xf X)|X. X:Xs} -> (!set X:{X:Xs. x: Xf X}  .. Pf X x)) [+] Q\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_Rep_int_choice_input_set)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left)\napply (rule cspF_Rep_int_choice_input_Dist)\napply (simp)\napply (simp)\ndone\n\nlemmas cspF_Rep_int_choice_Ext_choice =\n       cspF_Rep_int_choice_sum_Ext_choice\n       cspF_Rep_int_choice_nat_Ext_choice\n       cspF_Rep_int_choice_set_Ext_choice\n\n\n(* =================================================== *\n |             addition for CSP-Prover 5               |\n * =================================================== *)\n\n(* --------------------------------------------------- *\n     distribution hiding over sequential composition\n * --------------------------------------------------- *)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Seq_compo_hide_dist: \n  \"(P ;; Q) -- X =F[M,M] (P -- X) ;; (Q -- X)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Seq_compo_hide_dist)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  (* 1 *)\n apply (rule disjI1)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n\n  (* 2 *)\n apply (rule disjI2)\n apply (rule_tac x=\"sb --tr X\" in exI)\n apply (rule_tac x=\"t --tr X\" in exI)\n apply (simp)\n apply (rule conjI)\n  apply (simp add: in_traces)\n  apply (rule_tac x=\"sb ^^^ <Tick>\" in exI)\n  apply (simp)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n  (* 1 *)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (simp)\n  (* 2 *)\n  apply (simp add: in_traces)\n  apply (elim conjE exE)\n  apply (insert trace_last_noTick_or_Tick)\n  apply (drule_tac x=\"sc\" in spec)\n  apply (elim disjE conjE exE)\n\n   apply (subgoal_tac \"noTick(sc --tr X)\")\n   apply (rotate_tac 4)\n   apply (drule sym)\n   apply (simp del: hide_tr_noTick)\n   apply (simp)\n\n   apply (simp)\n   apply (rule_tac x=\"sd ^^^ sb\" in exI)\n   apply (simp)\n   apply (rule disjI2)\n   apply (rule_tac x=\"sd\" in exI)\n   apply (rule_tac x=\"sb\" in exI)\n   apply (simp)\ndone\n\n(* --------------------------------------------------- *\n         distribution hiding over interleaving\n * --------------------------------------------------- *)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Interleave_hide_dist: \n  \"(P ||| Q) -- X =F[M,M] (P -- X) ||| (Q -- X)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Interleave_hide_dist)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE)\n apply (simp)\n\n apply (rule_tac x=\"(Ev ` X Un Y) Int Xa\" in exI)\n apply (rule_tac x=\"(Ev ` X Un Z) Int Xa\" in exI)\n apply (intro conjI)\n\n (* 1 *)\n  apply (force)\n\n (* 2 *)\n  apply (force)\n\n (* 3 *)\n  apply (rule_tac x=\"sb --tr X\" in exI)\n  apply (rule_tac x=\"t --tr X\" in exI)\n  apply (simp add: interleave_of_hide_tr_ex)\n  apply (intro conjI)\n\n   apply (force)\n\n   apply (rule_tac x=\"sb\" in exI)\n   apply (simp)\n   apply (subgoal_tac \"Ev ` X Un (Ev ` X Un Y) Int Xa <= Y\")\n   apply (rule memF_F2)\n   apply (simp)\n   apply (simp)\n   apply (force)\n\n   apply (rule_tac x=\"t\" in exI)\n   apply (simp)\n   apply (subgoal_tac \"Ev ` X Un (Ev ` X Un Z) Int Xa <= Z\")\n   apply (rule memF_F2)\n   apply (simp)\n   apply (simp)\n   apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE)\n apply (simp add: interleave_of_hide_tr_ex)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"v\" in exI)\n apply (simp)\n apply (rule_tac x=\"Ev ` X Un Y\" in exI)\n apply (rule_tac x=\"Ev ` X Un Z\" in exI)\n apply (intro conjI)\n  apply (force)\n  apply (force)\n  apply (force)\ndone\n\n\n(* --------------------------------------------------- *\n    distribution renaming over sequential composition\n * --------------------------------------------------- *)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Seq_compo_renaming_dist: \n  \"(P ;; Q) [[r]] =F[M,M] (P [[r]]) ;; (Q [[r]])\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Seq_compo_renaming_dist)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  (* 1 *)\n apply (rule disjI1)\n apply (simp add: ren_tr_noTick_left)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp add: ren_inv_insert_Tick)\n\n  (* 2 *)\n apply (rule disjI2)\n apply (simp add: ren_tr_appt_decompo_left)\n apply (elim conjE exE)\n apply (simp)\n apply (rule_tac x=\"t1\" in exI)\n apply (rule_tac x=\"t2\" in exI)\n apply (simp)\n apply (rule conjI)\n  apply (simp add: in_traces)\n  apply (rule_tac x=\"sb ^^^ <Tick>\" in exI)\n  apply (simp add: ren_tr_noTick_left)\n\n  apply (simp add: ren_tr_noTick_left)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n  (* 1 *)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (simp add: ren_inv_insert_Tick)\n  apply (simp add: ren_tr_noTick_right)\n\n  (* 2 *)\n  apply (simp add: in_traces)\n  apply (elim conjE exE)\n  apply (simp add: ren_tr_appt_decompo_right)\n  apply (elim conjE exE)\n  apply (simp)\n  apply (rule_tac x=\"s1 ^^^ sb\" in exI)\n  apply (simp)\n\n  apply (rule conjI)\n   apply (rule_tac x=\"s1\" in exI)\n   apply (rule_tac x=\"sb\" in exI)\n   apply (simp)\n\n   apply (rule disjI2)\n   apply (rule_tac x=\"s1\" in exI)\n   apply (rule_tac x=\"sb\" in exI)\n   apply (simp)\ndone\n\n\n\n\n(* --------------------------------------------------- *\n         distribution renaming over interleaving\n * --------------------------------------------------- *)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Interleave_renaming_dist: \n  \"(P ||| Q) [[r]] =F[M,M] (P [[r]]) ||| (Q [[r]])\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Interleave_renaming_dist)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE)\n  apply (case_tac \"Tick ~: Y & Tick ~: Z\")\n\n  apply (rule_tac x=\"X\" in exI)\n  apply (rule_tac x=\"X\" in exI)\n  apply (simp)\n  apply (insert interleave_of_ren_tr_only_if_all)\n  apply (drule_tac x=\"sa\" in spec)\n  apply (drule_tac x=\"r\" in spec)\n  apply (drule_tac x=\"s\" in spec)\n  apply (drule_tac x=\"sb\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (simp)\n  apply (elim conjE exE)\n  apply (rule_tac x=\"s'\" in exI)\n  apply (rule_tac x=\"t'\" in exI)\n  apply (force)\n\n  apply (subgoal_tac \"Tick : X\")\n\n  apply (rule_tac x=\"(X-{Tick}) Un (Y Int {Tick})\" in exI)\n  apply (rule_tac x=\"(X-{Tick}) Un (Z Int {Tick})\" in exI)\n  apply (intro conjI)\n\n   apply (force)\n   apply (force)\n\n   apply (drule_tac x=\"sa\" in spec)\n   apply (drule_tac x=\"r\" in spec)\n   apply (drule_tac x=\"s\" in spec)\n   apply (drule_tac x=\"sb\" in spec)\n   apply (drule_tac x=\"t\" in spec)\n   apply (simp)\n   apply (elim conjE exE)\n   apply (rule_tac x=\"s'\" in exI)\n   apply (rule_tac x=\"t'\" in exI)\n   apply (simp)\n   apply (intro conjI)\n\n    apply (rule_tac x=\"sb\" in exI)\n    apply (simp)\n    apply (rule memF_F2)\n    apply (simp)\n    apply (force)\n\n    apply (rule_tac x=\"t\" in exI)\n    apply (simp)\n    apply (rule memF_F2)\n    apply (simp)\n    apply (force)\n\n  apply (simp add: ren_inv_def)\n  apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (erule rem_asmE)\n apply (insert interleave_of_ren_tr_if_all)\n  apply (drule_tac x=\"s\" in spec)\n  apply (drule_tac x=\"r\" in spec)\n  apply (drule_tac x=\"sb\" in spec)\n  apply (drule_tac x=\"sc\" in spec)\n  apply (drule_tac x=\"sa\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (simp)\n  apply (elim conjE exE)\n\n   apply (rule_tac x=\"u\" in exI)\n   apply (simp)\n   apply (rule_tac x=\"[[r]]inv Y\" in exI)\n   apply (rule_tac x=\"[[r]]inv Z\" in exI)\n\n  apply (simp add: ren_inv_def)\n  apply (auto)\ndone\n\n(* --------------------------------------------------- *\n     distribution internal choice over prefix\n * --------------------------------------------------- *)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Act_prefix_dist:\n  \"a -> (P |~| Q) =F[M,M] (a -> P) |~| (a -> Q)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Act_prefix_dist)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE)\n  apply (force)\n\n  apply (elim conjE exE disjE bexE)\n  apply (force)\n  apply (force)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE bexE exE)\n  apply (simp)\n  apply (simp)\n  apply (force)\n  apply (force)\ndone\n\nlemma cspF_Int_choice_Act_prefix_delay:\n  \"(a -> P) |~| (a -> Q) =F[M,M] a -> (P |~| Q)\"\napply (rule cspF_sym)\napply (simp add: cspF_Act_prefix_dist)\ndone\n\nlemma cspF_Int_choice_Act_prefix_delay_eq:\n  \"a = b ==> (a -> P) |~| (b -> Q) =F[M,M] a -> (P |~| Q)\"\napply (simp add: cspF_Int_choice_Act_prefix_delay)\ndone\n\n\n(* --------------------------------------------------- *\n     distribution internal choice over prefix choice\n * --------------------------------------------------- *)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Ext_pre_choice_dist:\n  \"? x:X -> (Pf x |~| Qf x) =F[M,M] (? x:X -> Pf x) |~| (? x:X -> Qf x)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Ext_pre_choice_dist)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE)\n  apply (force)\n\n  apply (elim conjE exE disjE bexE)\n  apply (force)\n  apply (force)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE bexE exE)\n  apply (simp)\n  apply (simp)\n  apply (force)\n  apply (force)\ndone\n\nlemma cspF_Int_choice_Ext_pre_choice_delay:\n  \"(? x:X -> Pf x) |~| (? x:X -> Qf x)  =F[M,M] ? x:X -> (Pf x |~| Qf x)\"\napply (rule cspF_sym)\napply (simp add: cspF_Ext_pre_choice_dist)\ndone\n\nlemma cspF_Int_choice_Ext_pre_choice_delay_eq:\n  \"X = Y ==> (? x:X -> Pf x) |~| (? x:Y -> Qf x)  =F[M,M] ? x:X -> (Pf x |~| Qf x)\"\napply (simp add: cspF_Int_choice_Ext_pre_choice_delay)\ndone\n\n(*  replicated internal choice *)\n\nlemma cspF_Act_prefix_delay_sum:\n  \"!! c:C .. (a -> Pf c) =F[M,M] \n   IF (sumset C = {}) THEN DIV ELSE (a -> (!! c:C .. (Pf c)))\"\napply (rule cspF_rw_right)\napply (rule cspF_IF_split)\napply (case_tac \"sumset C = {}\")\napply (simp add: cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_sym)\napply (simp add: cspF_Act_prefix_Dist)\ndone\n\nlemma cspF_Ext_pre_choice_delay_sum:\n  \"!! c:C .. (? :X -> (Pf c)) =F[M,M] \n   IF (sumset C = {}) THEN DIV ELSE (? x:X -> (!! c:C .. (Pf c) x))\"\napply (rule cspF_rw_right)\napply (rule cspF_IF_split)\napply (case_tac \"sumset C = {}\")\napply (simp add: cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_sym)\napply (simp add: cspF_Ext_pre_choice_Dist)\ndone\n\nlemma cspF_Act_prefix_delay_nat:\n  \"!nat n:N .. (a -> Pf n) =F[M,M] \n   IF (N = {}) THEN DIV ELSE (a -> (!nat n:N .. (Pf n)))\"\napply (rule cspF_rw_right)\napply (rule cspF_IF_split)\napply (case_tac \"N = {}\")\napply (simp add: cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_sym)\napply (simp add: cspF_Act_prefix_Dist)\ndone\n\nlemma cspF_Ext_pre_choice_delay_nat:\n  \"!nat n:N .. (? :X -> (Pf n)) =F[M,M] \n   IF (N = {}) THEN DIV ELSE (? x:X -> (!nat n:N .. (Pf n) x))\"\napply (rule cspF_rw_right)\napply (rule cspF_IF_split)\napply (case_tac \"N = {}\")\napply (simp add: cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_sym)\napply (simp add: cspF_Ext_pre_choice_Dist)\ndone\n\nlemma cspF_Act_prefix_delay_set:\n  \"!set X:Xs .. (a -> Pf X) =F[M,M] \n   IF (Xs = {}) THEN DIV ELSE (a -> (!set X:Xs .. (Pf X)))\"\napply (rule cspF_rw_right)\napply (rule cspF_IF_split)\napply (case_tac \"Xs = {}\")\napply (simp add: cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_sym)\napply (simp add: cspF_Act_prefix_Dist)\ndone\n\nlemma cspF_Ext_pre_choice_delay_set:\n  \"!set Y:Xs .. (? :X -> (Pf Y)) =F[M,M] \n   IF (Xs = {}) THEN DIV ELSE (? x:X -> (!set Y:Xs .. (Pf Y) x))\"\napply (rule cspF_rw_right)\napply (rule cspF_IF_split)\napply (case_tac \"Xs = {}\")\napply (simp add: cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_sym)\napply (simp add: cspF_Ext_pre_choice_Dist)\ndone\n\nlemma cspF_Act_prefix_delay_com:\n  \"! x:X .. (a -> Pf x) =F[M,M] \n   IF (X = {}) THEN DIV ELSE (a -> (! :X .. Pf))\"\napply (rule cspF_rw_right)\napply (rule cspF_IF_split)\napply (case_tac \"X = {}\")\napply (simp add: cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_sym)\napply (simp add: cspF_Act_prefix_Dist)\ndone\n\nlemma cspF_Ext_pre_choice_delay_com:\n  \"! y:Y .. (? :X -> (Pf y)) =F[M,M] \n   IF (Y = {}) THEN DIV ELSE (? x:X -> (! y:Y .. (Pf y) x))\"\napply (rule cspF_rw_right)\napply (rule cspF_IF_split)\napply (case_tac \"Y = {}\")\napply (simp add: cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_sym)\napply (simp add: cspF_Ext_pre_choice_Dist)\ndone\n\nlemma cspF_Act_prefix_delay_f:\n  \"inj f ==> \n   !<f> x:X .. (a -> Pf x) =F[M,M] \n   IF (X = {}) THEN DIV ELSE (a -> (!<f> :X .. Pf))\"\napply (rule cspF_rw_right)\napply (rule cspF_IF_split)\napply (case_tac \"X = {}\")\napply (simp add: cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_sym)\napply (simp add: cspF_Act_prefix_Dist)\ndone\n\nlemma cspF_Ext_pre_choice_delay_f:\n  \"inj f ==> \n   !<f> y:Y .. (? :X -> (Pf y)) =F[M,M] \n   IF (Y = {}) THEN DIV ELSE (? x:X -> (!<f> y:Y .. (Pf y) x))\"\napply (rule cspF_rw_right)\napply (rule cspF_IF_split)\napply (case_tac \"Y = {}\")\napply (simp add: cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_sym)\napply (simp add: cspF_Ext_pre_choice_Dist)\ndone\n\nlemmas cspF_choice_delay =\n       cspF_Int_choice_Act_prefix_delay\n       cspF_Int_choice_Ext_pre_choice_delay\n       cspF_Act_prefix_delay_sum\n       cspF_Ext_pre_choice_delay_sum\n       cspF_Act_prefix_delay_nat\n       cspF_Ext_pre_choice_delay_nat\n       cspF_Act_prefix_delay_set\n       cspF_Ext_pre_choice_delay_set\n       cspF_Act_prefix_delay_com\n       cspF_Ext_pre_choice_delay_com\n       cspF_Act_prefix_delay_f\n       cspF_Ext_pre_choice_delay_f\n\nlemmas cspF_choice_delay_eq =\n       cspF_Int_choice_Act_prefix_delay_eq\n       cspF_Int_choice_Ext_pre_choice_delay_eq\n\n(*********************************************************\n                       P |[X,Y]| Q\n *********************************************************)\n\n(* ---------- *\n    |~| left\n * ---------- *)\n\nlemma cspF_Alpha_Parallel_dist_l: \n  \"(P1 |~| P2) |[X,Y]| Q =F[M,M]\n   (P1 |[X,Y]| Q) |~| (P2 |[X,Y]| Q)\"\napply (simp add: Alpha_parallel_def)\n\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_dist)\napply (rule cspF_reflex)\napply (rule cspF_rw_left)\napply (rule cspF_dist)\napply (simp)\ndone\n\n(* ---------- *\n    |~| right\n * ---------- *)\nlemma cspF_Alpha_Parallel_dist_r: \n  \"P |[X,Y]| (Q1 |~| Q2) =F[M,M]\n   (P |[X,Y]| Q1) |~| (P |[X,Y]| Q2)\"\napply (simp add: Alpha_parallel_def)\n\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_reflex)\napply (rule cspF_dist)\napply (rule cspF_rw_left)\napply (rule cspF_dist)\napply (simp)\ndone\n\n(* ---------- *\n    !! left\n * ---------- *)\n\nlemma cspF_Alpha_Parallel_Dist_sum_l_nonempty: \n  \"sumset C ~= {} ==>\n     (!! :C .. Pf) |[X,Y]| Q =F[M,M]\n     !! c:C .. (Pf c |[X,Y]| Q)\"\napply (simp add: Alpha_parallel_def)\n\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_Parallel_Dist_sum_l_nonempty)\napply (simp)\napply (rule cspF_reflex)\napply (rule cspF_rw_left)\napply (rule cspF_Parallel_Dist_sum_l_nonempty)\napply (simp)\napply (simp)\ndone\n\nlemma cspF_Alpha_Parallel_Dist_sum_l: \n  \"(!! :C .. Pf) |[X,Y]| Q =F[M,M]\n   IF (sumset C={}) THEN (DIV |[X,Y]| Q) ELSE (!! c:C .. (Pf c |[X,Y]| Q))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_decompo_Alpha_parallel)\napply (simp)+\napply (simp add: cspF_Rep_int_choice_empty)\napply (simp)\n\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_Alpha_Parallel_Dist_sum_l_nonempty)\napply (simp)\ndone\n\n(* ---------- *\n    !! right\n * ---------- *)\n\nlemma cspF_Alpha_Parallel_Dist_sum_r_nonempty: \n  \"sumset C ~= {} ==>\n     P |[X,Y]| (!! :C .. Qf) =F[M,M]\n     !! c:C .. (P |[X,Y]| Qf c)\"\napply (rule cspF_rw_left)\napply (rule cspF_Alpha_parallel_commut)\napply (rule cspF_rw_left)\napply (rule cspF_Alpha_Parallel_Dist_sum_l_nonempty, simp)\napply (rule cspF_decompo, simp)\napply (rule cspF_Alpha_parallel_commut)\ndone\n\nlemma cspF_Alpha_Parallel_Dist_sum_r: \n  \"P |[X,Y]| (!! :C .. Qf) =F[M,M]\n   IF (sumset C={}) THEN (P |[X,Y]| DIV) ELSE (!! c:C .. (P |[X,Y]| Qf c))\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_decompo_Alpha_parallel)\napply (simp)+\napply (simp add: cspF_Rep_int_choice_empty)\napply (simp)\n\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_Alpha_Parallel_Dist_sum_r_nonempty)\napply (simp)\ndone\n\n(* ---------- *\n   !nat left\n * ---------- *)\n\nlemma cspF_Alpha_Parallel_Dist_nat_l_nonempty: \n  \"N ~= {} ==>\n     (!nat :N .. Pf) |[X,Y]| Q =F[M,M]\n     !nat n:N .. (Pf n |[X,Y]| Q)\"\nby (simp add: Rep_int_choice_ss_def cspF_Alpha_Parallel_Dist_sum_l_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Alpha_Parallel_Dist_nat_l: \n  \"(!nat :N .. Pf) |[X,Y]| Q =F[M,M]\n   IF (N={}) THEN (DIV |[X,Y]| Q) ELSE (!nat n:N .. (Pf n |[X,Y]| Q))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Alpha_Parallel_Dist_sum_l, simp)\n\n(* ---------- *\n   !nat right\n * ---------- *)\n\nlemma cspF_Alpha_Parallel_Dist_nat_r_nonempty: \n  \"N ~= {} ==>\n     P |[X,Y]| (!nat :N .. Qf) =F[M,M]\n     !nat n:N .. (P |[X,Y]| Qf n)\"\nby (simp add: Rep_int_choice_ss_def cspF_Alpha_Parallel_Dist_sum_r_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Alpha_Parallel_Dist_nat_r: \n  \"P |[X,Y]| (!nat :N .. Qf) =F[M,M]\n   IF (N={}) THEN (P |[X,Y]| DIV) ELSE (!nat n:N .. (P |[X,Y]| Qf n))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Alpha_Parallel_Dist_sum_r, simp)\n\n(* ---------- *\n   !set left\n * ---------- *)\n\nlemma cspF_Alpha_Parallel_Dist_set_l_nonempty: \n  \"Xs ~= {} ==>\n     (!set :Xs .. Pf) |[Y,Z]| Q =F[M,M]\n     !set X:Xs .. (Pf X |[Y,Z]| Q)\"\nby (simp add: Rep_int_choice_ss_def cspF_Alpha_Parallel_Dist_sum_l_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Alpha_Parallel_Dist_set_l: \n  \"(!set :Xs .. Pf) |[Y,Z]| Q =F[M,M]\n   IF (Xs={}) THEN (DIV |[Y,Z]| Q) ELSE (!set X:Xs .. (Pf X |[Y,Z]| Q))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Alpha_Parallel_Dist_sum_l, simp)\n\n(* ---------- *\n   !set right\n * ---------- *)\n\nlemma cspF_Alpha_Parallel_Dist_set_r_nonempty: \n  \"Xs ~= {} ==>\n     P |[Y,Z]| (!set :Xs .. Qf) =F[M,M]\n     !set X:Xs .. (P |[Y,Z]| Qf X)\"\nby (simp add: Rep_int_choice_ss_def cspF_Alpha_Parallel_Dist_sum_r_nonempty)\n\n(*** Dist ***)\n\nlemma cspF_Alpha_Parallel_Dist_set_r: \n  \"P |[Y,Z]| (!set :Xs .. Qf) =F[M,M]\n   IF (Xs={}) THEN (P |[Y,Z]| DIV) ELSE (!set X:Xs .. (P |[Y,Z]| Qf X))\"\napply (simp add: Rep_int_choice_ss_def)\nby (rule cspF_rw_left, rule cspF_Alpha_Parallel_Dist_sum_r, simp)\n\n(* ---------- *\n     ! left\n * ---------- *)\n\nlemma cspF_Alpha_Parallel_Dist_com_l_nonempty: \n  \"A ~= {}\n   ==> (! :A .. Pf) |[X,Y]| Q =F[M,M] ! x:A .. (Pf x |[X,Y]| Q)\"\nby (simp add: Rep_int_choice_com_def cspF_Alpha_Parallel_Dist_set_l_nonempty)\n\nlemma cspF_Alpha_Parallel_Dist_com_l: \n  \"(! :A .. Pf) |[X,Y]| Q =F[M,M]\n   IF (A ={}) THEN (DIV |[X,Y]| Q) ELSE (! x:A .. (Pf x |[X,Y]| Q))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspF_rw_left, rule cspF_Alpha_Parallel_Dist_set_l, simp)\n\n(* ---------- *\n     ! right\n * ---------- *)\n\nlemma cspF_Alpha_Parallel_Dist_com_r_nonempty: \n  \"A ~= {}\n   ==> P |[X,Y]| (! :A .. Qf) =F[M,M] ! x:A .. (P |[X,Y]| Qf x)\"\nby (simp add: Rep_int_choice_com_def cspF_Alpha_Parallel_Dist_set_r_nonempty)\n\nlemma cspF_Alpha_Parallel_Dist_com_r: \n  \"P |[X,Y]| (! :A .. Qf) =F[M,M] \n   IF (A ={}) THEN (P |[X,Y]| DIV) ELSE (! x:A .. (P |[X,Y]| Qf x))\"\napply (simp add: Rep_int_choice_com_def)\nby (rule cspF_rw_left, rule cspF_Alpha_Parallel_Dist_set_r, simp)\n\n(* ---------- *\n   !<f> left\n * ---------- *)\n\nlemma cspF_Alpha_Parallel_Dist_f_l_nonempty: \n  \"[| inj f ; A ~= {} |]\n   ==> (!<f> :A .. Pf) |[X,Y]| Q =F[M,M] !<f> x:A .. (Pf x |[X,Y]| Q)\"\nby (simp add: Rep_int_choice_f_def cspF_Alpha_Parallel_Dist_com_l_nonempty)\n\nlemma cspF_Alpha_Parallel_Dist_f_l: \n  \"(!<f> :A .. Pf) |[X,Y]| Q =F[M,M]\n   IF (A ={}) THEN (DIV |[X,Y]| Q) ELSE (!<f> x:A .. (Pf x |[X,Y]| Q))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspF_rw_left, rule cspF_Alpha_Parallel_Dist_com_l, simp)\n\nlemma cspF_Alpha_Parallel_Dist_f_r_nonempty: \n  \"[| inj f ; A ~= {} |]\n   ==> P |[X,Y]| (!<f> :A .. Qf) =F[M,M] !<f> x:A .. (P |[X,Y]| Qf x)\"\nby (simp add: Rep_int_choice_f_def cspF_Alpha_Parallel_Dist_com_r_nonempty)\n\nlemma cspF_Alpha_Parallel_Dist_f_r: \n  \"P |[X,Y]| (!<f> :A .. Qf) =F[M,M] \n   IF (A ={}) THEN (P |[X,Y]| DIV) ELSE (!<f> x:A .. (P |[X,Y]| Qf x))\"\napply (simp add: Rep_int_choice_f_def)\nby (rule cspF_rw_left, rule cspF_Alpha_Parallel_Dist_com_r, simp)\n\nlemmas cspF_dist_Alpha_Parallel =\n       cspF_Alpha_Parallel_dist_l\n       cspF_Alpha_Parallel_dist_r \n\nlemmas cspF_Dist_Alpha_Parallel =\n      cspF_Alpha_Parallel_Dist_sum_l \n      cspF_Alpha_Parallel_Dist_sum_r \n      cspF_Alpha_Parallel_Dist_nat_l \n      cspF_Alpha_Parallel_Dist_nat_r \n      cspF_Alpha_Parallel_Dist_set_l \n      cspF_Alpha_Parallel_Dist_set_r \n      cspF_Alpha_Parallel_Dist_com_l \n      cspF_Alpha_Parallel_Dist_com_r \n      cspF_Alpha_Parallel_Dist_f_l \n      cspF_Alpha_Parallel_Dist_f_r \n\nlemmas cspF_Dist_Alpha_Parallel_nonempty =\n      cspF_Alpha_Parallel_Dist_sum_l_nonempty \n      cspF_Alpha_Parallel_Dist_sum_r_nonempty \n      cspF_Alpha_Parallel_Dist_nat_l_nonempty \n      cspF_Alpha_Parallel_Dist_nat_r_nonempty \n      cspF_Alpha_Parallel_Dist_set_l_nonempty \n      cspF_Alpha_Parallel_Dist_set_r_nonempty \n      cspF_Alpha_Parallel_Dist_com_l_nonempty\n      cspF_Alpha_Parallel_Dist_com_r_nonempty \n      cspF_Alpha_Parallel_Dist_f_l_nonempty \n      cspF_Alpha_Parallel_Dist_f_r_nonempty \n\n\n\n(****************** to add them again ******************)\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_law_dist.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.63341024983754, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.34630954944428916}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Strong_Early_Sim\n  imports Early_Semantics Rel\nbegin\n\ndefinition \"strongSimEarly\" :: \"pi \\<Rightarrow> (pi \\<times> pi) set \\<Rightarrow> pi \\<Rightarrow> bool\" (\"_ \\<leadsto>[_] _\" [80, 80, 80] 80) where\n  \"P \\<leadsto>[Rel] Q \\<equiv> (\\<forall>a y Q'. Q \\<longmapsto>a<\\<nu>y> \\<prec> Q' \\<longrightarrow> y \\<sharp> P \\<longrightarrow> (\\<exists>P'. P \\<longmapsto>a<\\<nu>y> \\<prec> P' \\<and> (P', Q') \\<in> Rel)) \\<and>\n                 (\\<forall>\\<alpha> Q'. Q \\<longmapsto>\\<alpha> \\<prec> Q' \\<longrightarrow> (\\<exists>P'. P \\<longmapsto>\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel))\"\n\n\n\n  assumes \"P \\<leadsto>[A] P'\"\n  and     \"A \\<subseteq> B\"\n\n  shows \"P \\<leadsto>[B] P'\"\nusing assms\nby(fastforce simp add: strongSimEarly_def)\n\nlemma freshUnit[simp]:\n  fixes y :: name\n\n  shows \"y \\<sharp> ()\"\nby(auto simp add: fresh_def supp_unit)\n\nlemma simCasesCont[consumes 1, case_names Bound Free]:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   C   :: \"'a::fs_name\"\n\n  assumes Eqvt:  \"eqvt Rel\"\n  and     Bound: \"\\<And>a y Q'. \\<lbrakk>Q \\<longmapsto> a<\\<nu>y> \\<prec> Q'; y \\<sharp> P; y \\<sharp> Q; y \\<sharp> C\\<rbrakk> \\<Longrightarrow> \\<exists>P'. P \\<longmapsto> a<\\<nu>y> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  and     Free:  \"\\<And>\\<alpha> Q'. Q \\<longmapsto> \\<alpha> \\<prec> Q' \\<Longrightarrow> \\<exists>P'. P \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n\n  shows \"P \\<leadsto>[Rel] Q\"\nproof -\n  from Free show ?thesis\n  proof(auto simp add: strongSimEarly_def)\n    fix Q' a y\n    assume yFreshP: \"(y::name) \\<sharp> P\"\n    assume Trans: \"Q \\<longmapsto> a<\\<nu>y> \\<prec> Q'\"\n    have \"\\<exists>c::name. c \\<sharp> (P, Q', y, Q, C)\" by(blast intro: name_exists_fresh)\n    then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshQ': \"c \\<sharp> Q'\" and cFreshC: \"c \\<sharp> C\"\n                          and cineqy: \"c \\<noteq> y\" and \"c \\<sharp> Q\"\n      by(force simp add: fresh_prod name_fresh)\n\n    from Trans cFreshQ' have \"Q \\<longmapsto> a<\\<nu>c> \\<prec> ([(y, c)] \\<bullet> Q')\" by(simp add: alphaBoundOutput)\n    hence \"\\<exists>P'. P \\<longmapsto> a<\\<nu>c> \\<prec> P' \\<and> (P', [(y, c)] \\<bullet> Q') \\<in> Rel\" using \\<open>c \\<sharp> P\\<close> \\<open>c \\<sharp> Q\\<close> \\<open>c \\<sharp> C\\<close>\n      by(rule Bound)\n    then obtain P' where PTrans: \"P \\<longmapsto> a<\\<nu>c> \\<prec> P'\" and P'RelQ': \"(P', [(y, c)] \\<bullet> Q') \\<in> Rel\"\n      by blast\n\n    from PTrans yFreshP cineqy have yFreshP': \"y \\<sharp> P'\" by(force intro: freshTransition)\n    with PTrans have \"P \\<longmapsto> a<\\<nu>y> \\<prec> ([(y, c)] \\<bullet> P')\" by(simp add: alphaBoundOutput name_swap)\n    moreover have \"([(y, c)] \\<bullet> P', Q') \\<in> Rel\" (is \"?goal\")\n    proof -\n      from Eqvt P'RelQ' have \"([(y, c)] \\<bullet> P', [(y, c)] \\<bullet> [(y, c)] \\<bullet> Q') \\<in> Rel\"\n        by(rule eqvtRelI)\n      with cineqy show ?goal by(simp add: name_calc)\n    qed\n    ultimately show \"\\<exists>P'. P \\<longmapsto>a<\\<nu>y> \\<prec> P' \\<and> (P', Q') \\<in> Rel\" by blast\n  qed\nqed\n\nlemma simCases[consumes 0, case_names Bound Free]:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   C   :: \"'a::fs_name\"\n\n  assumes Bound: \"\\<And>a y Q'. \\<lbrakk>Q \\<longmapsto> a<\\<nu>y> \\<prec> Q'; y \\<sharp> P\\<rbrakk> \\<Longrightarrow> \\<exists>P'. P \\<longmapsto> a<\\<nu>y> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  and     Free:  \"\\<And>\\<alpha> Q'. Q \\<longmapsto> \\<alpha> \\<prec> Q' \\<Longrightarrow> \\<exists>P'. P \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n\n  shows \"P \\<leadsto>[Rel] Q\"\nusing assms\nby(auto simp add: strongSimEarly_def)\n\nlemma elim:\n  fixes P   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   Q   :: pi\n  and   a   :: name\n  and   x   :: name\n  and   Q'  :: pi\n\n  assumes \"P \\<leadsto>[Rel] Q\"\n\n  shows \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q' \\<Longrightarrow> x \\<sharp> P \\<Longrightarrow> \\<exists>P'. P \\<longmapsto> a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  and   \"Q \\<longmapsto> \\<alpha> \\<prec> Q' \\<Longrightarrow> \\<exists>P'. P \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\nusing assms by(simp add: strongSimEarly_def)+\n\nlemma eqvtI:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   perm :: \"name prm\"\n\n  assumes Sim: \"P \\<leadsto>[Rel] Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"(perm \\<bullet> P) \\<leadsto>[Rel'] (perm \\<bullet> Q)\"\nproof(induct rule: simCases)\n  case(Bound a y Q')\n  have Trans: \"(perm \\<bullet> Q) \\<longmapsto> a<\\<nu>y> \\<prec> Q'\" by fact\n  have yFreshP: \"y \\<sharp> perm \\<bullet> P\" by fact\n  \n  from Trans have \"(rev perm \\<bullet> (perm \\<bullet> Q)) \\<longmapsto> rev perm \\<bullet> (a<\\<nu>y> \\<prec> Q')\"\n    by(rule TransitionsEarly.eqvt)\n  hence \"Q \\<longmapsto> (rev perm \\<bullet> a)<\\<nu>(rev perm \\<bullet> y)> \\<prec> (rev perm \\<bullet> Q')\" \n    by(simp add: name_rev_per)\n  moreover from yFreshP have \"(rev perm \\<bullet> y) \\<sharp> P\" by(simp add: name_fresh_left)\n  ultimately have \"\\<exists>P'. P \\<longmapsto> (rev perm \\<bullet> a)<\\<nu>(rev perm \\<bullet> y)> \\<prec> P' \\<and> (P', rev perm \\<bullet> Q') \\<in> Rel\" using Sim\n    by(force intro: elim)\n  then obtain P' where PTrans: \"P \\<longmapsto> (rev perm \\<bullet> a)<\\<nu>(rev perm \\<bullet> y)> \\<prec> P'\" and P'RelQ': \"(P', rev perm \\<bullet> Q') \\<in> Rel\"\n    by blast\n  \n  from PTrans have \"(perm \\<bullet> P) \\<longmapsto> perm \\<bullet> ((rev perm \\<bullet> a)<\\<nu>(rev perm \\<bullet> y)> \\<prec> P')\" by(rule TransitionsEarly.eqvt)\n  hence L1: \"(perm \\<bullet> P) \\<longmapsto> a<\\<nu>y> \\<prec> (perm \\<bullet> P')\" by(simp add: name_per_rev)\n  from P'RelQ' RelRel' have \"(P', rev perm \\<bullet> Q') \\<in> Rel'\" by blast\n  with EqvtRel' have \"(perm \\<bullet> P', perm \\<bullet> (rev perm \\<bullet> Q')) \\<in> Rel'\"\n    by(rule eqvtRelI)\n  hence \"(perm \\<bullet> P', Q') \\<in> Rel'\" by(simp add: name_per_rev)\n  with L1 show ?case by blast\nnext\n  case(Free \\<alpha> Q')\n  have Trans: \"(perm \\<bullet> Q) \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n\n  from Trans have \"(rev perm \\<bullet> (perm \\<bullet> Q)) \\<longmapsto> rev perm \\<bullet> (\\<alpha> \\<prec> Q')\"\n    by(rule TransitionsEarly.eqvt)\n  hence \"Q \\<longmapsto> (rev perm \\<bullet> \\<alpha>) \\<prec> (rev perm \\<bullet> Q')\" \n    by(simp add: name_rev_per)\n  with Sim have \"\\<exists>P'. P \\<longmapsto> (rev perm \\<bullet> \\<alpha>) \\<prec> P' \\<and> (P', (rev perm \\<bullet> Q')) \\<in> Rel\"\n    by(force intro: elim)\n  then obtain P' where PTrans: \"P \\<longmapsto> (rev perm \\<bullet> \\<alpha>) \\<prec> P'\" and PRel: \"(P', (rev perm \\<bullet> Q')) \\<in> Rel\" by blast\n  \n  from PTrans have \"(perm \\<bullet> P) \\<longmapsto> perm \\<bullet> ((rev perm \\<bullet> \\<alpha>)\\<prec> P')\" by(rule TransitionsEarly.eqvt)\n  hence L1: \"(perm \\<bullet> P) \\<longmapsto> \\<alpha> \\<prec> (perm \\<bullet> P')\" by(simp add: name_per_rev)\n  from PRel EqvtRel' RelRel'  have \"((perm \\<bullet> P'), (perm \\<bullet> (rev perm \\<bullet> Q'))) \\<in> Rel'\"\n    by(force intro: eqvtRelI)\n  hence \"((perm \\<bullet> P'), Q') \\<in> Rel'\" by(simp add: name_per_rev)\n  with L1 show ?case by blast\nqed\n\n\n(*****************Reflexivity and transitivity*********************)\n\nlemma reflexive:\n  fixes P   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n\n  assumes \"Id \\<subseteq> Rel\"\n\n  shows \"P \\<leadsto>[Rel] P\"\nusing assms\nby(auto simp add: strongSimEarly_def)\n\nlemmas fresh_prod[simp]\n\n\n\n  assumes PSimQ: \"P \\<leadsto>[Rel] Q\"\n  and     QSimR: \"Q \\<leadsto>[Rel'] R\"\n  and     Eqvt': \"eqvt Rel''\"\n  and     Trans: \"Rel O Rel' \\<subseteq> Rel''\"\n\n  shows \"P \\<leadsto>[Rel''] R\"\nproof -\n  from Eqvt' show ?thesis\n  proof(induct rule: simCasesCont[where C=Q])\n    case(Bound a y R')\n    have RTrans: \"R \\<longmapsto> a<\\<nu>y> \\<prec> R'\" by fact\n\n    from QSimR RTrans \\<open>y \\<sharp> Q\\<close> have \"\\<exists>Q'. Q \\<longmapsto> a<\\<nu>y> \\<prec> Q' \\<and> (Q', R') \\<in> Rel'\"\n      by(rule elim)\n    then obtain Q' where QTrans: \"Q \\<longmapsto> a<\\<nu>y> \\<prec> Q'\" and Q'Rel'R': \"(Q', R') \\<in> Rel'\" by blast\n    from PSimQ QTrans \\<open>y \\<sharp> P\\<close> have \"\\<exists>P'. P \\<longmapsto> a<\\<nu>y> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n      by(rule elim)\n    then obtain P' where PTrans: \"P \\<longmapsto> a<\\<nu>y> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" by blast\n\n    moreover from P'RelQ' Q'Rel'R' Trans have \"(P', R') \\<in> Rel''\" by blast\n\n    ultimately show ?case by blast\n  next\n    case(Free \\<alpha> R')\n    have RTrans: \"R \\<longmapsto> \\<alpha> \\<prec> R'\" by fact\n    with QSimR have \"\\<exists>Q'. Q \\<longmapsto> \\<alpha> \\<prec> Q' \\<and> (Q', R') \\<in> Rel'\" by(rule elim)\n    then obtain Q' where QTrans: \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" and Q'RelR': \"(Q', R') \\<in> Rel'\" by blast\n    from PSimQ QTrans have \"\\<exists>P'. P \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\" by(rule elim)\n    then obtain P' where PTrans: \"P \\<longmapsto> \\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" by blast\n    from P'RelQ' Q'RelR' Trans have \"(P', R') \\<in> Rel''\" by blast\n    with PTrans show \"\\<exists>P'. P \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', R') \\<in> Rel''\" by blast\n  qed\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Strong_Early_Sim.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3462784684960045}}
{"text": "theory DBM_Operations_Impl_Refine\n  imports\n    DBM_Operations_Impl\n    \"HOL-Library.IArray\"\n    TA_Library.Imperative_Loops\nbegin\n\nlemma rev_map_fold_append_aux:\n  \"fold (\\<lambda> x xs. f x # xs) xs zs @ ys = fold (\\<lambda> x xs. f x # xs) xs (zs@ys)\"\n  by (induction xs arbitrary: zs) auto\n\nlemma rev_map_fold:\n  \"rev (map f xs) = fold (\\<lambda> x xs. f x # xs) xs []\"\n  by (induction xs; simp add: rev_map_fold_append_aux)\n\nlemma map_rev_fold:\n  \"map f xs = rev (fold (\\<lambda> x xs. f x # xs) xs [])\"\n  using rev_map_fold rev_swap by fastforce\n\nlemma pointwise_cmp_iff:\n  \"pointwise_cmp P n M M' \\<longleftrightarrow> list_all2 P (take ((n + 1) * (n + 1)) xs) (take ((n + 1) * (n + 1)) ys)\"\n  if \"\\<forall>i\\<le>n. \\<forall>j\\<le>n. xs ! (i + i * n + j) = M i j\"\n    \"\\<forall>i\\<le>n. \\<forall>j\\<le>n. ys ! (i + i * n + j) = M' i j\"\n    \"(n + 1) * (n + 1) \\<le> length xs\" \"(n + 1) * (n + 1) \\<le> length ys\"\n  using that unfolding pointwise_cmp_def\n  unfolding list_all2_conv_all_nth\n  apply clarsimp\n  apply safe\n  subgoal premises prems for x\n  proof -\n    let ?i = \"x div (n + 1)\" let ?j = \"x mod (n + 1)\"\n    from \\<open>x < _\\<close> have \"?i < Suc n\" \"?j \\<le>n\"\n      by (simp add: less_mult_imp_div_less)+\n    with prems have\n      \"xs ! (?i + ?i * n + ?j) = M ?i ?j\" \"ys ! (?i + ?i * n + ?j) = M' ?i ?j\"\n      \"P (M ?i ?j) (M' ?i ?j)\"\n      by auto\n    moreover have \"?i + ?i * n + ?j = x\"\n      by (metis ab_semigroup_add_class.add.commute mod_div_mult_eq mult_Suc_right plus_1_eq_Suc)\n    ultimately show \\<open>P (xs ! x) (ys ! x)\\<close>\n      by auto\n  qed\n  subgoal for i j\n    apply (erule allE[of _ i], erule impE, simp)\n    apply (erule allE[of _ i], erule impE, simp)\n    apply (erule allE[of _ \"i + i * n + j\"], erule impE)\n    subgoal\n      by (rule le_imp_less_Suc) (auto intro!: add_mono simp: algebra_simps)\n    apply (erule allE[of _ j], erule impE, simp)\n    apply (erule allE[of _ j], erule impE, simp)\n    apply simp\n    done\n  done\n\nfun intersperse :: \"'a \\<Rightarrow> 'a list \\<Rightarrow> 'a list\" where\n  \"intersperse sep (x # y # xs) = x # sep # intersperse sep (y # xs)\" |\n  \"intersperse _ xs = xs\"\n\nlemma the_pure_id_assn_eq[simp]:\n  \"the_pure (\\<lambda>a c. \\<up> (c = a)) = Id\"\nproof -\n  have *: \"(\\<lambda>a c. \\<up> (c = a)) = pure Id\"\n    unfolding pure_def by simp\n  show ?thesis\n    by (subst *) simp\nqed\n\nlemma pure_eq_conv:\n  \"(\\<lambda>a c. \\<up> (c = a)) = id_assn\"\n  using is_pure_assn_def is_pure_iff_pure_assn is_pure_the_pure_id_eq the_pure_id_assn_eq by blast\n\nsection \\<open>Refinement\\<close>\n\ninstance DBMEntry :: (\"{countable}\") countable\n  apply (rule\n    countable_classI[of\n      \"(\\<lambda>Le (a::'a) \\<Rightarrow> to_nat (0::nat,a) |\n           DBM.Lt a \\<Rightarrow> to_nat (1::nat,a) |\n            DBM.INF \\<Rightarrow> to_nat (2::nat,undefined::'a) )\"])\napply (simp split: DBMEntry.splits)\ndone\n\ninstance DBMEntry :: (\"{heap}\") heap ..\n\ndefinition dbm_subset' :: \"nat \\<Rightarrow> ('t :: {linorder, zero}) DBM' \\<Rightarrow> 't DBM' \\<Rightarrow> bool\" where\n  \"dbm_subset' n M M' \\<equiv> pointwise_cmp (\\<le>) n (curry M) (curry M')\"\n\nlemma dbm_subset'_alt_def:\n  \"dbm_subset' n M M' \\<equiv>\n    list_all (\\<lambda>i. list_all (\\<lambda>j. (op_mtx_get M (i, j) \\<le> op_mtx_get M' (i, j))) [0..<Suc n])\n      [0..<Suc n]\"\n  by (simp add: dbm_subset'_def pointwise_cmp_alt_def neutral)\n\nlemma dbm_subset_alt_def'[code]:\n  \"dbm_subset n M M' \\<longleftrightarrow>\n    list_ex (\\<lambda>i. op_mtx_get M (i, i) < 0) [0..<Suc n] \\<or>\n    list_all (\\<lambda>i. list_all (\\<lambda>j. (op_mtx_get M (i, j) \\<le> op_mtx_get M' (i, j))) [0..<Suc n])\n      [0..<Suc n]\"\n  by (simp add: dbm_subset_def check_diag_alt_def pointwise_cmp_alt_def neutral)\n\ndefinition\n  \"mtx_line_to_iarray m M = IArray (map (\\<lambda>i. M (0, i)) [0..<Suc m])\"\n\ndefinition\n  \"mtx_line m (M :: _ DBM') = map (\\<lambda>i. M (0, i)) [0..<Suc m]\"\n\nlocale DBM_Impl =\n  fixes n :: nat\nbegin\n\nabbreviation\n  mtx_assn :: \"(nat \\<times> nat \\<Rightarrow> ('a :: {linordered_ab_monoid_add, heap})) \\<Rightarrow> 'a array \\<Rightarrow> assn\"\nwhere\n  \"mtx_assn \\<equiv> asmtx_assn (Suc n) id_assn\"\n\nabbreviation \"clock_assn \\<equiv> nbn_assn (Suc n)\"\n\nlemmas Relation.IdI[where a = \\<infinity>, sepref_import_param]\nlemma [sepref_import_param]: \"((+),(+)) \\<in> Id\\<rightarrow>Id\\<rightarrow>Id\" by simp\nlemma [sepref_import_param]: \"(uminus,uminus) \\<in> (Id::(_*_)set)\\<rightarrow>Id\" by simp\nlemma [sepref_import_param]: \"(Lt,Lt) \\<in> Id\\<rightarrow>Id\" by simp\nlemma [sepref_import_param]: \"(Le,Le) \\<in> Id\\<rightarrow>Id\" by simp\nlemma [sepref_import_param]: \"(\\<infinity>,\\<infinity>) \\<in> Id\" by simp\nlemma [sepref_import_param]: \"(min :: _ DBMEntry \\<Rightarrow> _, min) \\<in> Id \\<rightarrow> Id \\<rightarrow> Id\" by simp\nlemma [sepref_import_param]: \"(Suc, Suc) \\<in> Id \\<rightarrow> Id\" by simp\n\nlemma [sepref_import_param]: \"(norm_lower, norm_lower) \\<in> Id\\<rightarrow>Id\\<rightarrow>Id\" by simp\nlemma [sepref_import_param]: \"(norm_upper, norm_upper) \\<in> Id\\<rightarrow>Id\\<rightarrow>Id\" by simp\nlemma [sepref_import_param]: \"(norm_diag,  norm_diag) \\<in> Id\\<rightarrow>Id\" by simp\n\nend\n\n\ndefinition zero_clock :: \"_ :: linordered_cancel_ab_monoid_add\" where\n  \"zero_clock = 0\"\n\nsepref_register zero_clock\n\nlemma [sepref_import_param]: \"(zero_clock, zero_clock) \\<in> Id\" by simp\n\nlemmas [sepref_opt_simps] = zero_clock_def\n\n\ncontext\n  fixes n :: nat\nbegin\n\ninterpretation DBM_Impl n .\n\nsepref_definition reset_canonical_upd_impl' is\n  \"uncurry2 (uncurry (\\<lambda>x. RETURN ooo reset_canonical_upd x))\" ::\n  \"[\\<lambda>(((_,i),j),_). i\\<le>n \\<and> j\\<le>n]\\<^sub>a mtx_assn\\<^sup>d *\\<^sub>a nat_assn\\<^sup>k  *\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\<rightarrow> mtx_assn\"\n  unfolding reset_canonical_upd_alt_def op_mtx_set_def[symmetric] by sepref\n\nsepref_definition reset_canonical_upd_impl is\n  \"uncurry2 (uncurry (\\<lambda>x. RETURN ooo reset_canonical_upd x))\" ::\n  \"[\\<lambda>(((_,i),j),_). i\\<le>n \\<and> j\\<le>n]\\<^sub>a mtx_assn\\<^sup>d *\\<^sub>a nat_assn\\<^sup>k  *\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\<rightarrow> mtx_assn\"\n  unfolding reset_canonical_upd_alt_def op_mtx_set_def[symmetric] by sepref\n\nsepref_definition up_canonical_upd_impl is\n  \"uncurry (RETURN oo up_canonical_upd)\" :: \"[\\<lambda>(_,i). i\\<le>n]\\<^sub>a mtx_assn\\<^sup>d *\\<^sub>a nat_assn\\<^sup>k \\<rightarrow> mtx_assn\"\n  unfolding up_canonical_upd_def op_mtx_set_def[symmetric] by sepref\n\nlemma [sepref_import_param]:\n  \"(Le 0, 0) \\<in> Id\"\n  unfolding neutral by simp\n\n(* XXX Not sure if this is dangerous *)\nsepref_register 0\n\nsepref_definition check_diag_impl' is\n  \"uncurry (RETURN oo check_diag)\" ::\n  \"[\\<lambda>(i, _). i\\<le>n]\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a mtx_assn\\<^sup>k \\<rightarrow> bool_assn\"\n  unfolding check_diag_alt_def list_ex_foldli neutral[symmetric] by sepref\n\nlemma [sepref_opt_simps]:\n  \"(x = True) = x\"\n  by simp\n\nsepref_definition dbm_subset'_impl2 is\n  \"uncurry2 (RETURN ooo dbm_subset')\" ::\n  \"[\\<lambda>((i, _), _). i\\<le>n]\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a mtx_assn\\<^sup>k *\\<^sub>a mtx_assn\\<^sup>k \\<rightarrow> bool_assn\"\nunfolding dbm_subset'_alt_def list_all_foldli by sepref\n\ndefinition\n  \"dbm_subset'_impl' \\<equiv> \\<lambda>m a b.\n    do {\n    imp_for 0 ((m + 1) * (m + 1)) Heap_Monad.return\n      (\\<lambda>i _. do {\n        x \\<leftarrow> Array.nth a i; y \\<leftarrow> Array.nth b i; Heap_Monad.return (x \\<le> y)\n      })\n      True\n    }\"\n\nlemma imp_for_list_all2_spec:\n  \"\n  <a \\<mapsto>\\<^sub>a xs * b \\<mapsto>\\<^sub>a ys>\n  imp_for 0 n' Heap_Monad.return\n    (\\<lambda>i _. do {\n      x \\<leftarrow> Array.nth a i; y \\<leftarrow> Array.nth b i; Heap_Monad.return (P x y)\n    })\n    True\n  <\\<lambda>r. \\<up>(r \\<longleftrightarrow> list_all2 P (take n' xs) (take n' ys)) * a \\<mapsto>\\<^sub>a xs * b \\<mapsto>\\<^sub>a ys>\\<^sub>t\"\n  if \"n' \\<le> length xs\" \"n' \\<le> length ys\"\n  apply (rule cons_rule[rotated 2])\n    apply (rule imp_for_list_all2'[where xs = xs and ys = ys and R = id_assn and S = id_assn])\n        apply (use that in simp; fail)+\n    apply (sep_auto simp: pure_def array_assn_def is_array_def)+\n  done\n\nlemma dbm_subset'_impl'_refine:\n  \"(uncurry2 dbm_subset'_impl', uncurry2 (RETURN \\<circ>\\<circ>\\<circ> dbm_subset'))\n\\<in> [\\<lambda>((i, _), _). i = n]\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a local.mtx_assn\\<^sup>k *\\<^sub>a local.mtx_assn\\<^sup>k \\<rightarrow> bool_assn\"\n  apply sepref_to_hoare\n  unfolding dbm_subset'_impl'_def\n  unfolding amtx_assn_def hr_comp_def is_amtx_def\n(* XXX The simp rules for imp_for need a name *)\n  apply (sep_auto heap: imp_for_list_all2_spec simp only:)\n    apply (simp; intro add_mono mult_mono; simp; fail)+\n  apply sep_auto\n\n  subgoal for b bi ba bia l la a bb\n    unfolding dbm_subset'_def by (simp add: pointwise_cmp_iff[where xs = l and ys = la])\n\n  subgoal for b bi ba bia l la a bb\n    unfolding dbm_subset'_def by (simp add: pointwise_cmp_iff[where xs = l and ys = la])\n  done\n\nsepref_register check_diag ::\n  \"nat \\<Rightarrow> _ :: {linordered_cancel_ab_monoid_add,heap} DBMEntry i_mtx \\<Rightarrow> bool\"\n\nsepref_register dbm_subset' ::\n  \"nat \\<Rightarrow> 'a :: {linordered_cancel_ab_monoid_add,heap} DBMEntry i_mtx \\<Rightarrow> 'a DBMEntry i_mtx \\<Rightarrow> bool\"\n\nlemmas [sepref_fr_rules] = dbm_subset'_impl'_refine check_diag_impl'.refine\n\nsepref_definition dbm_subset_impl' is\n  \"uncurry2 (RETURN ooo dbm_subset)\" ::\n  \"[\\<lambda>((i, _), _). i=n]\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a mtx_assn\\<^sup>k *\\<^sub>a mtx_assn\\<^sup>k \\<rightarrow> bool_assn\"\nunfolding dbm_subset_def dbm_subset'_def[symmetric] short_circuit_conv by sepref\n\ncontext\n  notes [id_rules] = itypeI[of n \"TYPE (nat)\"]\n    and [sepref_import_param] = IdI[of n]\nbegin\n\nsepref_definition dbm_subset_impl is\n  \"uncurry (RETURN oo PR_CONST (dbm_subset n))\" :: \"mtx_assn\\<^sup>k *\\<^sub>a mtx_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  unfolding dbm_subset_def dbm_subset'_def[symmetric] short_circuit_conv PR_CONST_def by sepref\n\nsepref_definition check_diag_impl is\n  \"RETURN o PR_CONST (check_diag n)\" :: \"mtx_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  unfolding check_diag_alt_def list_ex_foldli neutral[symmetric] PR_CONST_def by sepref\n\nsepref_definition dbm_subset'_impl is\n  \"uncurry (RETURN oo PR_CONST (dbm_subset' n))\" :: \"mtx_assn\\<^sup>k *\\<^sub>a mtx_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  unfolding dbm_subset'_alt_def list_all_foldli PR_CONST_def by sepref\n\nend\n\nabbreviation\n  \"iarray_assn x y \\<equiv> pure (br IArray (\\<lambda>_. True)) y x\"\n\nlemma [sepref_fr_rules]:\n  \"(uncurry (return oo IArray.sub), uncurry (RETURN oo op_list_get))\n  \\<in> iarray_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\<rightarrow>\\<^sub>a id_assn\"\nunfolding br_def by sepref_to_hoare sep_auto\n\nlemmas extra_defs = extra_upd_def upd_line_def upd_line_0_def\n\nsepref_definition norm_upd_impl is\n  \"uncurry2 (RETURN ooo norm_upd)\" ::\n   \"[\\<lambda>((_, xs), i). length xs > n \\<and> i\\<le>n]\\<^sub>a mtx_assn\\<^sup>d *\\<^sub>a iarray_assn\\<^sup>k *\\<^sub>a nat_assn\\<^sup>k \\<rightarrow> mtx_assn\"\n  unfolding norm_upd_def extra_defs zero_clock_def[symmetric] by sepref\n\nsepref_definition norm_upd_impl' is\n  \"uncurry2 (RETURN ooo norm_upd)\" ::\n   \"[\\<lambda>((_, xs), i). length xs > n \\<and> i\\<le>n]\\<^sub>a mtx_assn\\<^sup>d *\\<^sub>a (list_assn id_assn)\\<^sup>k *\\<^sub>a nat_assn\\<^sup>k \\<rightarrow> mtx_assn\"\n  unfolding norm_upd_def extra_defs zero_clock_def[symmetric] by sepref\n\nsepref_definition extra_lu_upd_impl is\n  \"uncurry3 (\\<lambda>x. RETURN ooo (extra_lu_upd x))\" ::\n  \"[\\<lambda>(((_, ys), xs), i). length xs > n \\<and> length ys > n \\<and> i\\<le>n]\\<^sub>a\n    mtx_assn\\<^sup>d *\\<^sub>a iarray_assn\\<^sup>k *\\<^sub>a iarray_assn\\<^sup>k *\\<^sub>a nat_assn\\<^sup>k \\<rightarrow> mtx_assn\"\n  unfolding extra_lu_upd_def extra_defs zero_clock_def[symmetric] by sepref\n\nsepref_definition mtx_line_to_list_impl is\n  \"uncurry (RETURN oo PR_CONST mtx_line)\" ::\n  \"[\\<lambda>(m, _). m \\<le> n]\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a mtx_assn\\<^sup>k \\<rightarrow> list_assn id_assn\"\n  unfolding mtx_line_def HOL_list.fold_custom_empty PR_CONST_def map_rev_fold by sepref\n\ncontext\n  fixes m :: nat assumes \"m \\<le> n\"\n  notes [id_rules] = itypeI[of m \"TYPE (nat)\"]\n    and [sepref_import_param] = IdI[of m]\nbegin\n\nsepref_definition mtx_line_to_list_impl2 is\n  \"RETURN o PR_CONST mtx_line m\" :: \"mtx_assn\\<^sup>k \\<rightarrow>\\<^sub>a list_assn id_assn\"\n  unfolding mtx_line_def HOL_list.fold_custom_empty PR_CONST_def map_rev_fold\n  apply sepref_dbg_keep\n  using \\<open>m \\<le> n\\<close>\n  apply sepref_dbg_trans_keep\n  apply sepref_dbg_opt\n  apply sepref_dbg_cons_solve\n  apply sepref_dbg_cons_solve\n  apply sepref_dbg_constraints\n  done\n\nend\n\nlemma IArray_impl:\n  \"(return o IArray, RETURN o id) \\<in> (list_assn id_assn)\\<^sup>k \\<rightarrow>\\<^sub>a iarray_assn\"\n  by sepref_to_hoare (sep_auto simp: br_def list_assn_pure_conv pure_eq_conv)\n\ndefinition\n  \"mtx_line_to_iarray_impl m M = (mtx_line_to_list_impl2 m M \\<bind> return o IArray)\"\n\nlemmas mtx_line_to_iarray_impl_ht =\n  mtx_line_to_list_impl2.refine[to_hnr, unfolded hn_refine_def hn_ctxt_def, simplified]\n\nlemmas IArray_ht = IArray_impl[to_hnr, unfolded hn_refine_def hn_ctxt_def, simplified]\n\nlemma mtx_line_to_iarray_impl_refine[sepref_fr_rules]:\n  \"(uncurry mtx_line_to_iarray_impl, uncurry (RETURN \\<circ>\\<circ> mtx_line))\n  \\<in> [\\<lambda>(m, _). m \\<le> n]\\<^sub>a nat_assn\\<^sup>k *\\<^sub>a mtx_assn\\<^sup>k \\<rightarrow> iarray_assn\"\n  unfolding mtx_line_to_iarray_impl_def hfref_def\n  apply clarsimp\n  apply sepref_to_hoare\n  apply (sep_auto\n    heap: mtx_line_to_iarray_impl_ht IArray_ht simp: br_def pure_eq_conv list_assn_pure_conv)\n  apply (simp add: pure_def)\n  done\n\nsepref_register \"mtx_line\" :: \"nat \\<Rightarrow> ('ef) DBMEntry i_mtx \\<Rightarrow> 'ef DBMEntry list\"\n\nlemma [sepref_import_param]: \"(dbm_lt :: _ DBMEntry \\<Rightarrow> _, dbm_lt) \\<in> Id \\<rightarrow> Id \\<rightarrow> Id\" by simp\n\nsepref_definition extra_lup_upd_impl is\n  \"uncurry3 (\\<lambda>x. RETURN ooo (extra_lup_upd x))\" ::\n   \"[\\<lambda>(((_, ys), xs), i). length xs > n \\<and> length ys > n \\<and> i\\<le>n]\\<^sub>a\n    mtx_assn\\<^sup>d *\\<^sub>a iarray_assn\\<^sup>k *\\<^sub>a iarray_assn\\<^sup>k *\\<^sub>a nat_assn\\<^sup>k \\<rightarrow> mtx_assn\"\n  unfolding extra_lup_upd_alt_def2 extra_defs zero_clock_def[symmetric] mtx_line_def[symmetric]\n  by sepref\n\ntext \\<open>DBM to List\\<close>\ndefinition dbm_to_list :: \"(nat \\<times> nat \\<Rightarrow> 'a) \\<Rightarrow> 'a list\" where\n  \"dbm_to_list M \\<equiv>\n  rev $ fold (\\<lambda>i xs. fold (\\<lambda>j xs. M (i, j) # xs) [0..<Suc n] xs) [0..<Suc n] []\"\n\ncontext\n  notes [id_rules] = itypeI[of n \"TYPE (nat)\"]\n    and [sepref_import_param] = IdI[of n]\nbegin\n\nsepref_definition dbm_to_list_impl is\n  \"RETURN o PR_CONST dbm_to_list\" :: \"mtx_assn\\<^sup>k \\<rightarrow>\\<^sub>a list_assn id_assn\"\n  unfolding dbm_to_list_def HOL_list.fold_custom_empty PR_CONST_def by sepref\n\ntext \\<open>DBM to String\\<close>\n\ncontext\n  fixes show_clock :: \"nat \\<Rightarrow> string\"\n    and show_num :: \"'a :: {linordered_ab_group_add,heap} \\<Rightarrow> string\"\nbegin\n\ndefinition\n  \"make_string e i j \\<equiv>\n    if i = j then if e < 0 then Some (''EMPTY'') else None\n    else\n    if i = 0 then\n    case e of\n      DBMEntry.Le a \\<Rightarrow> if a = 0 then None else Some (show_clock j @ '' >= '' @ show_num (- a))\n    | DBMEntry.Lt a \\<Rightarrow> Some (show_clock j @ '' > ''  @ show_num (- a))\n    | _ \\<Rightarrow> None\n    else if j = 0 then\n    case e of\n      DBMEntry.Le a \\<Rightarrow> Some (show_clock i @ '' <= '' @ show_num a)\n    | DBMEntry.Lt a \\<Rightarrow> Some (show_clock i @ '' < ''  @ show_num a)\n    | _ \\<Rightarrow> None\n    else\n    case e of\n      DBMEntry.Le a \\<Rightarrow> Some (show_clock i @ '' - '' @ show_clock j @ '' <= '' @ show_num a)\n    | DBMEntry.Lt a \\<Rightarrow> Some (show_clock i @ '' - '' @ show_clock j @ '' < '' @ show_num a)\n    | _ \\<Rightarrow> None\n\"\n\ndefinition\n  \"dbm_list_to_string xs \\<equiv>\n  (concat o intersperse '', '' o rev o snd o snd) $ fold (\\<lambda>e (i, j, acc).\n    let\n      v = make_string e i j;\n      j = (j + 1) mod (n + 1);\n      i = (if j = 0 then i + 1 else i)\n    in\n    case v of\n      None \\<Rightarrow> (i, j, acc)\n    | Some s \\<Rightarrow> (i, j, s # acc)\n  ) xs (0, 0, [])\n\"\n\nlemma [sepref_import_param]:\n  \"(dbm_list_to_string, PR_CONST dbm_list_to_string) \\<in> \\<langle>Id\\<rangle>list_rel \\<rightarrow> \\<langle>Id\\<rangle>list_rel\"\n  by simp\n\ndefinition show_dbm where\n  \"show_dbm M \\<equiv> PR_CONST dbm_list_to_string (dbm_to_list M)\"\n\nsepref_register \"PR_CONST local.dbm_list_to_string\"\nsepref_register dbm_to_list :: \"'b i_mtx \\<Rightarrow> 'b list\"\n\nlemmas [sepref_fr_rules] = dbm_to_list_impl.refine\n\nsepref_definition show_dbm_impl is\n  \"RETURN o show_dbm\" :: \"mtx_assn\\<^sup>k \\<rightarrow>\\<^sub>a list_assn id_assn\"\n  unfolding show_dbm_def by sepref\n\nend (* Context for show functions *)\n\nend (* Context for importing n *)\n\nend (* Context for DBM dimension n *)\n\n\n\n\nexport_code\n  norm_upd_impl\n  reset_canonical_upd_impl\n  up_canonical_upd_impl\n  dbm_subset_impl\n  dbm_subset\n  show_dbm_impl\nchecking SML\n\nexport_code\n  norm_upd_impl\n  reset_canonical_upd_impl\n  up_canonical_upd_impl\n  dbm_subset_impl\n  dbm_subset\n  show_dbm_impl\nchecking SML_imp\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/DBM/DBM_Operations_Impl_Refine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.6076631698328916, "lm_q1q2_score": 0.3462784684960045}}
{"text": "theory Class2\nimports Class1\nbegin\n\ntext \\<open>Reduction\\<close>\n\nlemma fin_not_Cut:\n  assumes a: \"fin M x\"\n  shows \"\\<not>(\\<exists>a M' x N'. M = Cut <a>.M' (x).N')\"\nusing a\nby (induct) (auto)\n\nlemma fresh_not_fin:\n  assumes a: \"x\\<sharp>M\"\n  shows \"\\<not>fin M x\"\nproof -\n  have \"fin M x \\<Longrightarrow> x\\<sharp>M \\<Longrightarrow> False\" by (induct rule: fin.induct) (auto simp add: abs_fresh fresh_atm)\n  with a show \"\\<not>fin M x\" by blast\nqed\n\nlemma fresh_not_fic:\n  assumes a: \"a\\<sharp>M\"\n  shows \"\\<not>fic M a\"\nproof -\n  have \"fic M a \\<Longrightarrow> a\\<sharp>M \\<Longrightarrow> False\" by (induct rule: fic.induct) (auto simp add: abs_fresh fresh_atm)\n  with a show \"\\<not>fic M a\" by blast\nqed\n\nlemma c_redu_subst1:\n  assumes a: \"M \\<longrightarrow>\\<^sub>c M'\" \"c\\<sharp>M\" \"y\\<sharp>P\"\n  shows \"M{y:=<c>.P} \\<longrightarrow>\\<^sub>c M'{y:=<c>.P}\"\nusing a\nproof(nominal_induct avoiding: y c P rule: c_redu.strong_induct)\n  case (left M a N x)\n  then show ?case\n    apply -\n    apply(simp)\n    apply(rule conjI)\n    apply(force)\n    apply(auto)\n    apply(subgoal_tac \"M{a:=(x).N}{y:=<c>.P} = M{y:=<c>.P}{a:=(x).(N{y:=<c>.P})}\")(*A*)\n    apply(simp)\n    apply(rule c_redu.intros)\n    apply(rule not_fic_subst1)\n    apply(simp)\n    apply(simp add: subst_fresh)\n    apply(simp add: subst_fresh)\n    apply(simp add: abs_fresh fresh_atm)\n    apply(rule subst_subst2)\n    apply(simp add: fresh_prod fresh_atm)\n    apply(simp add: fresh_prod fresh_atm)\n    apply(simp add: fresh_prod fresh_atm)\n    apply(simp)\n    done\nnext\n  case (right N x a M)\n  then show ?case\n    apply -\n    apply(simp)\n    apply(rule conjI)\n    (* case M = Ax y a *)\n    apply(rule impI)\n    apply(subgoal_tac \"N{x:=<a>.Ax y a}{y:=<c>.P} = N{y:=<c>.P}{x:=<c>.P}\")\n    apply(simp)\n    apply(rule c_redu.right)\n    apply(rule not_fin_subst2)\n    apply(simp)\n    apply(rule subst_fresh)\n    apply(simp add: abs_fresh)\n    apply(simp add: abs_fresh)\n    apply(rule sym)\n    apply(rule interesting_subst1')\n    apply(simp add: fresh_atm)\n    apply(simp)\n    apply(simp)\n    (* case M \\<noteq> Ax y a*)\n    apply(rule impI)\n    apply(subgoal_tac \"N{x:=<a>.M}{y:=<c>.P} = N{y:=<c>.P}{x:=<a>.(M{y:=<c>.P})}\")\n    apply(simp)\n    apply(rule c_redu.right)\n    apply(rule not_fin_subst2)\n    apply(simp)\n    apply(simp add: subst_fresh)\n    apply(simp add: subst_fresh)\n    apply(simp add: abs_fresh fresh_atm)\n    apply(rule subst_subst3)\n    apply(simp_all add: fresh_atm fresh_prod)\n    done\nqed\n\nlemma c_redu_subst2:\n  assumes a: \"M \\<longrightarrow>\\<^sub>c M'\" \"c\\<sharp>P\" \"y\\<sharp>M\"\n  shows \"M{c:=(y).P} \\<longrightarrow>\\<^sub>c M'{c:=(y).P}\"\nusing a\nproof(nominal_induct avoiding: y c P rule: c_redu.strong_induct)\n  case (right N x a M)\n  then show ?case\n    apply -\n    apply(simp)\n    apply(rule conjI)\n    apply(force)\n    apply(auto)\n    apply(subgoal_tac \"N{x:=<a>.M}{c:=(y).P} = N{c:=(y).P}{x:=<a>.(M{c:=(y).P})}\")(*A*)\n    apply(simp)\n    apply(rule c_redu.intros)\n    apply(rule not_fin_subst1)\n    apply(simp)\n    apply(simp add: subst_fresh)\n    apply(simp add: subst_fresh)\n    apply(simp add: abs_fresh fresh_atm)\n    apply(rule subst_subst1)\n    apply(simp add: fresh_prod fresh_atm)\n    apply(simp add: fresh_prod fresh_atm)\n    apply(simp add: fresh_prod fresh_atm)\n    apply(simp)\n    done\nnext\n  case (left M a N x)\n  then show ?case\n    apply -\n    apply(simp)\n    apply(rule conjI)\n    (* case N = Ax x c *)\n    apply(rule impI)\n    apply(subgoal_tac \"M{a:=(x).Ax x c}{c:=(y).P} = M{c:=(y).P}{a:=(y).P}\")\n    apply(simp)\n    apply(rule c_redu.left)\n    apply(rule not_fic_subst2)\n    apply(simp)\n    apply(simp)\n    apply(rule subst_fresh)\n    apply(simp add: abs_fresh)\n    apply(rule sym)\n    apply(rule interesting_subst2')\n    apply(simp add: fresh_atm)\n    apply(simp)\n    apply(simp)\n    (* case M \\<noteq> Ax y a*)\n    apply(rule impI)\n    apply(subgoal_tac \"M{a:=(x).N}{c:=(y).P} = M{c:=(y).P}{a:=(x).(N{c:=(y).P})}\")\n    apply(simp)\n    apply(rule c_redu.left)\n    apply(rule not_fic_subst2)\n    apply(simp)\n    apply(simp add: subst_fresh)\n    apply(simp add: subst_fresh)\n    apply(simp add: abs_fresh fresh_atm)\n    apply(rule subst_subst4)\n    apply(simp add: fresh_prod fresh_atm)\n    apply(simp add: fresh_prod fresh_atm)\n    apply(simp add: fresh_prod fresh_atm)\n    apply(simp add: fresh_prod fresh_atm)\n    apply(simp)\n    done\nqed\n\nlemma c_redu_subst1':\n  assumes a: \"M \\<longrightarrow>\\<^sub>c M'\" \n  shows \"M{y:=<c>.P} \\<longrightarrow>\\<^sub>c M'{y:=<c>.P}\"\nusing a\nproof -\n  obtain y'::\"name\"   where fs1: \"y'\\<sharp>(M,M',P,P,y)\" by (rule exists_fresh(1), rule fin_supp, blast)\n  obtain c'::\"coname\" where fs2: \"c'\\<sharp>(M,M',P,P,c)\" by (rule exists_fresh(2), rule fin_supp, blast)\n  have \"M{y:=<c>.P} = ([(y',y)]\\<bullet>M){y':=<c'>.([(c',c)]\\<bullet>P)}\" using fs1 fs2\n    apply -\n    apply(rule trans)\n    apply(rule_tac y=\"y'\" in subst_rename(3))\n    apply(simp)\n    apply(rule subst_rename(4))\n    apply(simp)\n    done\n  also have \"\\<dots> \\<longrightarrow>\\<^sub>c ([(y',y)]\\<bullet>M'){y':=<c'>.([(c',c)]\\<bullet>P)}\" using fs1 fs2\n    apply -\n    apply(rule c_redu_subst1)\n    apply(simp add: c_redu.eqvt a)\n    apply(simp_all add: fresh_left calc_atm fresh_prod)\n    done\n  also have \"\\<dots> = M'{y:=<c>.P}\" using fs1 fs2\n    apply -\n    apply(rule sym)\n    apply(rule trans)\n    apply(rule_tac y=\"y'\" in subst_rename(3))\n    apply(simp)\n    apply(rule subst_rename(4))\n    apply(simp)\n    done\n  finally show ?thesis by simp\nqed\n\nlemma c_redu_subst2':\n  assumes a: \"M \\<longrightarrow>\\<^sub>c M'\" \n  shows \"M{c:=(y).P} \\<longrightarrow>\\<^sub>c M'{c:=(y).P}\"\nusing a\nproof -\n  obtain y'::\"name\"   where fs1: \"y'\\<sharp>(M,M',P,P,y)\" by (rule exists_fresh(1), rule fin_supp, blast)\n  obtain c'::\"coname\" where fs2: \"c'\\<sharp>(M,M',P,P,c)\" by (rule exists_fresh(2), rule fin_supp, blast)\n  have \"M{c:=(y).P} = ([(c',c)]\\<bullet>M){c':=(y').([(y',y)]\\<bullet>P)}\" using fs1 fs2\n    apply -\n    apply(rule trans)\n    apply(rule_tac c=\"c'\" in subst_rename(1))\n    apply(simp)\n    apply(rule subst_rename(2))\n    apply(simp)\n    done\n  also have \"\\<dots> \\<longrightarrow>\\<^sub>c ([(c',c)]\\<bullet>M'){c':=(y').([(y',y)]\\<bullet>P)}\" using fs1 fs2\n    apply -\n    apply(rule c_redu_subst2)\n    apply(simp add: c_redu.eqvt a)\n    apply(simp_all add: fresh_left calc_atm fresh_prod)\n    done\n  also have \"\\<dots> = M'{c:=(y).P}\" using fs1 fs2\n    apply -\n    apply(rule sym)\n    apply(rule trans)\n    apply(rule_tac c=\"c'\" in subst_rename(1))\n    apply(simp)\n    apply(rule subst_rename(2))\n    apply(simp)\n    done\n\n  finally show ?thesis by simp\nqed\n\nlemma aux1:\n  assumes a: \"M = M'\" \"M' \\<longrightarrow>\\<^sub>l M''\"\n  shows \"M \\<longrightarrow>\\<^sub>l M''\"\nusing a by simp\n  \nlemma aux2:\n  assumes a: \"M \\<longrightarrow>\\<^sub>l M'\" \"M' = M''\"\n  shows \"M \\<longrightarrow>\\<^sub>l M''\"\nusing a by simp\n\nlemma aux3:\n  assumes a: \"M = M'\" \"M' \\<longrightarrow>\\<^sub>a* M''\"\n  shows \"M \\<longrightarrow>\\<^sub>a* M''\"\nusing a by simp\n\nlemma aux4:\n  assumes a: \"M = M'\"\n  shows \"M \\<longrightarrow>\\<^sub>a* M'\"\nusing a by blast\n\nlemma l_redu_subst1:\n  assumes a: \"M \\<longrightarrow>\\<^sub>l M'\" \n  shows \"M{y:=<c>.P} \\<longrightarrow>\\<^sub>a* M'{y:=<c>.P}\"\nusing a\nproof(nominal_induct M M' avoiding: y c P rule: l_redu.strong_induct)\n  case LAxR\n  then show ?case\n    apply -\n    apply(rule aux3)\n    apply(rule better_Cut_substn)\n    apply(simp add: abs_fresh)\n    apply(simp)\n    apply(simp add: fresh_atm)\n    apply(auto)\n    apply(rule aux4)\n    apply(simp add: trm.inject alpha calc_atm fresh_atm)\n    apply(rule a_star_trans)\n    apply(rule a_starI)\n    apply(rule al_redu)\n    apply(rule l_redu.intros)\n    apply(simp add: subst_fresh)\n    apply(simp add: fresh_atm)\n    apply(rule fic_subst2)\n    apply(simp_all)\n    apply(rule aux4)\n    apply(rule subst_comm')\n    apply(simp_all)\n    done\nnext\n  case LAxL\n  then show ?case\n    apply -\n    apply(rule aux3)\n    apply(rule better_Cut_substn)\n    apply(simp add: abs_fresh)\n    apply(simp)\n    apply(simp add: trm.inject fresh_atm)\n    apply(auto)\n    apply(rule aux4)\n    apply(rule sym)\n    apply(rule fin_substn_nrename)\n    apply(simp_all)\n    apply(rule a_starI)\n    apply(rule al_redu)\n    apply(rule aux2)\n    apply(rule l_redu.intros)\n    apply(simp add: subst_fresh)\n    apply(simp add: fresh_atm)\n    apply(rule fin_subst1)\n    apply(simp_all)\n    apply(rule subst_comm')\n    apply(simp_all)\n    done\nnext\n  case (LNot v M N u a b)\n  then show ?case\n  proof -\n    { assume asm: \"N\\<noteq>Ax y b\"\n      have \"(Cut <a>.NotR (u).M a (v).NotL <b>.N v){y:=<c>.P} = \n        (Cut <a>.NotR (u).(M{y:=<c>.P}) a (v).NotL <b>.(N{y:=<c>.P}) v)\" using LNot\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>l (Cut <b>.(N{y:=<c>.P}) (u).(M{y:=<c>.P}))\" using LNot\n        by (auto intro: l_redu.intros simp add: subst_fresh)\n      also have \"\\<dots> = (Cut <b>.N (u).M){y:=<c>.P}\" using LNot asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally have ?thesis by auto\n    }\n    moreover\n    { assume asm: \"N=Ax y b\"\n      have \"(Cut <a>.NotR (u).M a (v).NotL <b>.N v){y:=<c>.P} = \n        (Cut <a>.NotR (u).(M{y:=<c>.P}) a (v).NotL <b>.(N{y:=<c>.P}) v)\" using LNot\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* (Cut <b>.(N{y:=<c>.P}) (u).(M{y:=<c>.P}))\" using LNot\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <b>.(Cut <c>.P (y).Ax y b) (u).(M{y:=<c>.P}))\" using LNot asm\n        by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* (Cut <b>.(P[c\\<turnstile>c>b]) (u).(M{y:=<c>.P}))\" \n      proof (cases \"fic P c\")\n        case True \n        assume \"fic P c\"\n        then show ?thesis using LNot\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutL_intro)\n          apply(rule al_redu)\n          apply(rule better_LAxR_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fic P c\" \n        then show ?thesis\n          apply -\n          apply(rule a_star_CutL)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_left)\n          apply(simp)\n          apply(simp add: subst_with_ax2)\n          done\n      qed\n      also have \"\\<dots> = (Cut <b>.N (u).M){y:=<c>.P}\" using LNot asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(rule sym)\n        apply(rule crename_swap)\n        apply(simp)\n        done\n      finally have \"(Cut <a>.NotR (u).M a (v).NotL <b>.N v){y:=<c>.P} \\<longrightarrow>\\<^sub>a* (Cut <b>.N (u).M){y:=<c>.P}\" \n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nnext\n  case (LAnd1 b a1 M1 a2 M2 N z u)\n  then show ?case\n  proof -\n    { assume asm: \"M1\\<noteq>Ax y a1\"\n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL1 (u).N z){y:=<c>.P} = \n        Cut <b>.AndR <a1>.(M1{y:=<c>.P}) <a2>.(M2{y:=<c>.P}) b (z).AndL1 (u).(N{y:=<c>.P}) z\" \n        using LAnd1 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a1>.(M1{y:=<c>.P}) (u).(N{y:=<c>.P})\"\n        using LAnd1\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <a1>.M1 (u).N){y:=<c>.P}\" using LAnd1 asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally \n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL1 (u).N z){y:=<c>.P} \\<longrightarrow>\\<^sub>a* (Cut <a1>.M1 (u).N){y:=<c>.P}\"\n        by simp\n    } \n    moreover\n    { assume asm: \"M1=Ax y a1\"\n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL1 (u).N z){y:=<c>.P} = \n        Cut <b>.AndR <a1>.(M1{y:=<c>.P}) <a2>.(M2{y:=<c>.P}) b (z).AndL1 (u).(N{y:=<c>.P}) z\" \n        using LAnd1 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a1>.(M1{y:=<c>.P}) (u).(N{y:=<c>.P})\"\n        using LAnd1\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a1>.(Cut <c>.P (y). Ax y a1) (u).(N{y:=<c>.P})\" \n        using LAnd1 asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a1>.P[c\\<turnstile>c>a1] (u).(N{y:=<c>.P})\"\n      proof (cases \"fic P c\")\n        case True \n        assume \"fic P c\"\n        then show ?thesis using LAnd1\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutL_intro)\n          apply(rule al_redu)\n          apply(rule better_LAxR_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fic P c\" \n        then show ?thesis\n          apply -\n          apply(rule a_star_CutL)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_left)\n          apply(simp)\n          apply(simp add: subst_with_ax2)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a1>.M1 (u).N){y:=<c>.P}\" using LAnd1 asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(rule sym)\n        apply(rule crename_swap)\n        apply(simp)\n        done\n      finally \n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL1 (u).N z){y:=<c>.P} \\<longrightarrow>\\<^sub>a* (Cut <a1>.M1 (u).N){y:=<c>.P}\"\n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nnext\n  case (LAnd2 b a1 M1 a2 M2 N z u)\n  then show ?case\n  proof -\n    { assume asm: \"M2\\<noteq>Ax y a2\"\n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL2 (u).N z){y:=<c>.P} = \n        Cut <b>.AndR <a1>.(M1{y:=<c>.P}) <a2>.(M2{y:=<c>.P}) b (z).AndL2 (u).(N{y:=<c>.P}) z\" \n        using LAnd2 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a2>.(M2{y:=<c>.P}) (u).(N{y:=<c>.P})\"\n        using LAnd2\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <a2>.M2 (u).N){y:=<c>.P}\" using LAnd2 asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally \n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL2 (u).N z){y:=<c>.P} \\<longrightarrow>\\<^sub>a* (Cut <a2>.M2 (u).N){y:=<c>.P}\"\n        by simp\n    } \n    moreover\n    { assume asm: \"M2=Ax y a2\"\n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL2 (u).N z){y:=<c>.P} = \n        Cut <b>.AndR <a1>.(M1{y:=<c>.P}) <a2>.(M2{y:=<c>.P}) b (z).AndL2 (u).(N{y:=<c>.P}) z\" \n        using LAnd2 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a2>.(M2{y:=<c>.P}) (u).(N{y:=<c>.P})\"\n        using LAnd2\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a2>.(Cut <c>.P (y). Ax y a2) (u).(N{y:=<c>.P})\" \n        using LAnd2 asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a2>.P[c\\<turnstile>c>a2] (u).(N{y:=<c>.P})\"\n      proof (cases \"fic P c\")\n        case True \n        assume \"fic P c\"\n        then show ?thesis using LAnd2 asm\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutL_intro)\n          apply(rule al_redu)\n          apply(rule better_LAxR_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fic P c\" \n        then show ?thesis\n          apply -\n          apply(rule a_star_CutL)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_left)\n          apply(simp)\n          apply(simp add: subst_with_ax2)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a2>.M2 (u).N){y:=<c>.P}\" using LAnd2 asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(rule sym)\n        apply(rule crename_swap)\n        apply(simp)\n        done\n      finally \n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL2 (u).N z){y:=<c>.P} \\<longrightarrow>\\<^sub>a* (Cut <a2>.M2 (u).N){y:=<c>.P}\"\n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nnext\n  case (LOr1 b a M N1 N2 z x1 x2 y c P)\n  then show ?case\n  proof -\n    { assume asm: \"M\\<noteq>Ax y a\"\n      have \"(Cut <b>.OrR1 <a>.M b (z).OrL (x1).N1 (x2).N2 z){y:=<c>.P} = \n        Cut <b>.OrR1 <a>.(M{y:=<c>.P}) b (z).OrL (x1).(N1{y:=<c>.P}) (x2).(N2{y:=<c>.P}) z\" \n        using LOr1 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(M{y:=<c>.P}) (x1).(N1{y:=<c>.P})\"\n        using LOr1\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <a>.M (x1).N1){y:=<c>.P}\" using LOr1 asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally \n      have \"(Cut <b>.OrR1 <a>.M b (z).OrL (x1).N1 (x2).N2 z){y:=<c>.P} \\<longrightarrow>\\<^sub>a* (Cut <a>.M (x1).N1){y:=<c>.P}\"\n        by simp\n    } \n    moreover\n    { assume asm: \"M=Ax y a\"\n      have \"(Cut <b>.OrR1 <a>.M b (z).OrL (x1).N1 (x2).N2 z){y:=<c>.P} = \n        Cut <b>.OrR1 <a>.(M{y:=<c>.P}) b (z).OrL (x1).(N1{y:=<c>.P}) (x2).(N2{y:=<c>.P}) z\" \n        using LOr1 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(M{y:=<c>.P}) (x1).(N1{y:=<c>.P})\"\n        using LOr1\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a>.(Cut <c>.P (y). Ax y a) (x1).(N1{y:=<c>.P})\" \n        using LOr1 asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.P[c\\<turnstile>c>a] (x1).(N1{y:=<c>.P})\"\n      proof (cases \"fic P c\")\n        case True \n        assume \"fic P c\"\n        then show ?thesis using LOr1\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutL_intro)\n          apply(rule al_redu)\n          apply(rule better_LAxR_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fic P c\" \n        then show ?thesis\n          apply -\n          apply(rule a_star_CutL)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_left)\n          apply(simp)\n          apply(simp add: subst_with_ax2)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a>.M (x1).N1){y:=<c>.P}\" using LOr1 asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(rule sym)\n        apply(rule crename_swap)\n        apply(simp)\n        done\n      finally \n      have \"(Cut <b>.OrR1 <a>.M b (z).OrL (x1).N1 (x2).N2 z){y:=<c>.P} \\<longrightarrow>\\<^sub>a* (Cut <a>.M (x1).N1){y:=<c>.P}\"\n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nnext\n  case (LOr2 b a M N1 N2 z x1 x2 y c P)\n  then show ?case\n  proof -\n    { assume asm: \"M\\<noteq>Ax y a\"\n      have \"(Cut <b>.OrR2 <a>.M b (z).OrL (x1).N1 (x2).N2 z){y:=<c>.P} = \n        Cut <b>.OrR2 <a>.(M{y:=<c>.P}) b (z).OrL (x1).(N1{y:=<c>.P}) (x2).(N2{y:=<c>.P}) z\" \n        using LOr2 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(M{y:=<c>.P}) (x2).(N2{y:=<c>.P})\"\n        using LOr2\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <a>.M (x2).N2){y:=<c>.P}\" using LOr2 asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally \n      have \"(Cut <b>.OrR2 <a>.M b (z).OrL (x1).N1 (x2).N2 z){y:=<c>.P} \\<longrightarrow>\\<^sub>a* (Cut <a>.M (x2).N2){y:=<c>.P}\"\n        by simp\n    } \n    moreover\n    { assume asm: \"M=Ax y a\"\n      have \"(Cut <b>.OrR2 <a>.M b (z).OrL (x1).N1 (x2).N2 z){y:=<c>.P} = \n        Cut <b>.OrR2 <a>.(M{y:=<c>.P}) b (z).OrL (x1).(N1{y:=<c>.P}) (x2).(N2{y:=<c>.P}) z\" \n        using LOr2 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(M{y:=<c>.P}) (x2).(N2{y:=<c>.P})\"\n        using LOr2\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a>.(Cut <c>.P (y). Ax y a) (x2).(N2{y:=<c>.P})\" \n        using LOr2 asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.P[c\\<turnstile>c>a] (x2).(N2{y:=<c>.P})\"\n      proof (cases \"fic P c\")\n        case True \n        assume \"fic P c\"\n        then show ?thesis using LOr2\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutL_intro)\n          apply(rule al_redu)\n          apply(rule better_LAxR_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fic P c\" \n        then show ?thesis\n          apply -\n          apply(rule a_star_CutL)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_left)\n          apply(simp)\n          apply(simp add: subst_with_ax2)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a>.M (x2).N2){y:=<c>.P}\" using LOr2 asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(rule sym)\n        apply(rule crename_swap)\n        apply(simp)\n        done\n      finally \n      have \"(Cut <b>.OrR2 <a>.M b (z).OrL (x1).N1 (x2).N2 z){y:=<c>.P} \\<longrightarrow>\\<^sub>a* (Cut <a>.M (x2).N2){y:=<c>.P}\"\n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nnext\n  case (LImp z N u Q x M b a d y c P)\n  then show ?case\n  proof -\n    { assume asm: \"N\\<noteq>Ax y d\"\n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){y:=<c>.P} = \n        Cut <b>.ImpR (x).<a>.(M{y:=<c>.P}) b (z).ImpL <d>.(N{y:=<c>.P}) (u).(Q{y:=<c>.P}) z\" \n        using LImp by (simp add: fresh_prod abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(N{y:=<c>.P})  (x).(M{y:=<c>.P})) (u).(Q{y:=<c>.P})\"\n        using LImp\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <a>.(Cut <d>.N  (x).M) (u).Q){y:=<c>.P}\" using LImp asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally \n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){y:=<c>.P} \\<longrightarrow>\\<^sub>a* \n                     (Cut <a>.(Cut <d>.N  (x).M) (u).Q){y:=<c>.P}\"\n        by simp\n    } \n    moreover\n    { assume asm: \"N=Ax y d\"\n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){y:=<c>.P} = \n        Cut <b>.ImpR (x).<a>.(M{y:=<c>.P}) b (z).ImpL <d>.(N{y:=<c>.P}) (u).(Q{y:=<c>.P}) z\" \n        using LImp by (simp add: subst_fresh abs_fresh fresh_atm fresh_prod)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(N{y:=<c>.P})  (x).(M{y:=<c>.P})) (u).(Q{y:=<c>.P})\"\n        using LImp\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a>.(Cut <d>.(Cut <c>.P (y).Ax y d)  (x).(M{y:=<c>.P})) (u).(Q{y:=<c>.P})\"\n        using LImp asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(P[c\\<turnstile>c>d]) (x).(M{y:=<c>.P})) (u).(Q{y:=<c>.P})\"\n      proof (cases \"fic P c\")\n        case True \n        assume \"fic P c\"\n        then show ?thesis using LImp\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutL_intro)\n          apply(rule a_Cut_l)\n          apply(simp add: subst_fresh abs_fresh)\n          apply(simp add: abs_fresh fresh_atm)\n          apply(rule al_redu)\n          apply(rule better_LAxR_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fic P c\" \n        then show ?thesis using LImp\n          apply -\n          apply(rule a_star_CutL)\n          apply(rule a_star_CutL)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_left)\n          apply(simp)\n          apply(simp add: subst_with_ax2)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a>.(Cut <d>.N (x).M) (u).Q){y:=<c>.P}\" using LImp asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha)\n        apply(rule sym)\n        apply(rule crename_swap)\n        apply(simp)\n        done\n      finally \n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){y:=<c>.P} \\<longrightarrow>\\<^sub>a* \n               (Cut <a>.(Cut <d>.N (x).M) (u).Q){y:=<c>.P}\"\n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nqed\n\nlemma l_redu_subst2:\n  assumes a: \"M \\<longrightarrow>\\<^sub>l M'\" \n  shows \"M{c:=(y).P} \\<longrightarrow>\\<^sub>a* M'{c:=(y).P}\"\nusing a\nproof(nominal_induct M M' avoiding: y c P rule: l_redu.strong_induct)\n  case LAxR\n  then show ?case\n    apply -\n    apply(rule aux3)\n    apply(rule better_Cut_substc)\n    apply(simp add: abs_fresh)\n    apply(simp add: abs_fresh)\n    apply(simp add: trm.inject fresh_atm)\n    apply(auto)\n    apply(rule aux4)\n    apply(rule sym)\n    apply(rule fic_substc_crename)\n    apply(simp_all)\n    apply(rule a_starI)\n    apply(rule al_redu)\n    apply(rule aux2)\n    apply(rule l_redu.intros)\n    apply(simp add: subst_fresh)\n    apply(simp add: fresh_atm)\n    apply(rule fic_subst1)\n    apply(simp_all)\n    apply(rule subst_comm')\n    apply(simp_all)\n    done\nnext\n  case LAxL\n  then show ?case\n    apply -\n    apply(rule aux3)\n    apply(rule better_Cut_substc)\n    apply(simp)\n    apply(simp add: abs_fresh)\n    apply(simp add: fresh_atm)\n    apply(auto)\n    apply(rule aux4)\n    apply(simp add: trm.inject alpha calc_atm fresh_atm)\n    apply(rule a_star_trans)\n    apply(rule a_starI)\n    apply(rule al_redu)\n    apply(rule l_redu.intros)\n    apply(simp add: subst_fresh)\n    apply(simp add: fresh_atm)\n    apply(rule fin_subst2)\n    apply(simp_all)\n    apply(rule aux4)\n    apply(rule subst_comm')\n    apply(simp_all)\n    done\nnext\n  case (LNot v M N u a b)\n  then show ?case\n  proof -\n    { assume asm: \"M\\<noteq>Ax u c\"\n      have \"(Cut <a>.NotR (u).M a (v).NotL <b>.N v){c:=(y).P} = \n        (Cut <a>.NotR (u).(M{c:=(y).P}) a (v).NotL <b>.(N{c:=(y).P}) v)\" using LNot\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>l (Cut <b>.(N{c:=(y).P}) (u).(M{c:=(y).P}))\" using LNot\n        by (auto intro: l_redu.intros simp add: subst_fresh)\n      also have \"\\<dots> = (Cut <b>.N (u).M){c:=(y).P}\" using LNot asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally have ?thesis by auto\n    }\n    moreover\n    { assume asm: \"M=Ax u c\"\n      have \"(Cut <a>.NotR (u).M a (v).NotL <b>.N v){c:=(y).P} = \n        (Cut <a>.NotR (u).(M{c:=(y).P}) a (v).NotL <b>.(N{c:=(y).P}) v)\" using LNot\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* (Cut <b>.(N{c:=(y).P}) (u).(M{c:=(y).P}))\" using LNot\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <b>.(N{c:=(y).P}) (u).(Cut <c>.(Ax u c) (y).P))\" using LNot asm\n        by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* (Cut <b>.(N{c:=(y).P})  (u).(P[y\\<turnstile>n>u]))\" \n      proof (cases \"fin P y\")\n        case True \n        assume \"fin P y\"\n        then show ?thesis using LNot\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutR_intro)\n          apply(rule al_redu)\n          apply(rule better_LAxL_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fin P y\" \n        then show ?thesis\n          apply -\n          apply(rule a_star_CutR)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_right)\n          apply(simp)\n          apply(simp add: subst_with_ax1)\n          done\n      qed\n      also have \"\\<dots> = (Cut <b>.N (u).M){c:=(y).P}\" using LNot asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(rule sym)\n        apply(rule nrename_swap)\n        apply(simp)\n        done\n      finally have \"(Cut <a>.NotR (u).M a (v).NotL <b>.N v){c:=(y).P} \\<longrightarrow>\\<^sub>a* (Cut <b>.N (u).M){c:=(y).P}\" \n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nnext\n  case (LAnd1 b a1 M1 a2 M2 N z u)\n  then show ?case\n  proof -\n    { assume asm: \"N\\<noteq>Ax u c\"\n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL1 (u).N z){c:=(y).P} = \n        Cut <b>.AndR <a1>.(M1{c:=(y).P}) <a2>.(M2{c:=(y).P}) b (z).AndL1 (u).(N{c:=(y).P}) z\" \n        using LAnd1 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a1>.(M1{c:=(y).P}) (u).(N{c:=(y).P})\"\n        using LAnd1\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <a1>.M1 (u).N){c:=(y).P}\" using LAnd1 asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally \n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL1 (u).N z){c:=(y).P} \\<longrightarrow>\\<^sub>a* (Cut <a1>.M1 (u).N){c:=(y).P}\"\n        by simp\n    } \n    moreover\n    { assume asm: \"N=Ax u c\"\n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL1 (u).N z){c:=(y).P} = \n        Cut <b>.AndR <a1>.(M1{c:=(y).P}) <a2>.(M2{c:=(y).P}) b (z).AndL1 (u).(N{c:=(y).P}) z\" \n        using LAnd1 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a1>.(M1{c:=(y).P}) (u).(N{c:=(y).P})\"\n        using LAnd1\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a1>.(M1{c:=(y).P}) (u).(Cut <c>.(Ax u c) (y).P)\" \n        using LAnd1 asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a1>.(M1{c:=(y).P}) (u).(P[y\\<turnstile>n>u])\"\n      proof (cases \"fin P y\")\n        case True \n        assume \"fin P y\"\n        then show ?thesis using LAnd1\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutR_intro)\n          apply(rule al_redu)\n          apply(rule better_LAxL_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fin P y\" \n        then show ?thesis\n          apply -\n          apply(rule a_star_CutR)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_right)\n          apply(simp)\n          apply(simp add: subst_with_ax1)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a1>.M1 (u).N){c:=(y).P}\" using LAnd1 asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(rule sym)\n        apply(rule nrename_swap)\n        apply(simp)\n        done\n      finally \n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL1 (u).N z){c:=(y).P} \\<longrightarrow>\\<^sub>a* (Cut <a1>.M1 (u).N){c:=(y).P}\"\n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nnext\n  case (LAnd2 b a1 M1 a2 M2 N z u)\n  then show ?case\n  proof -\n    { assume asm: \"N\\<noteq>Ax u c\"\n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL2 (u).N z){c:=(y).P} = \n        Cut <b>.AndR <a1>.(M1{c:=(y).P}) <a2>.(M2{c:=(y).P}) b (z).AndL2 (u).(N{c:=(y).P}) z\" \n        using LAnd2 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a2>.(M2{c:=(y).P}) (u).(N{c:=(y).P})\"\n        using LAnd2\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <a2>.M2 (u).N){c:=(y).P}\" using LAnd2 asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally \n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL2 (u).N z){c:=(y).P} \\<longrightarrow>\\<^sub>a* (Cut <a2>.M2 (u).N){c:=(y).P}\"\n        by simp\n    } \n    moreover\n    { assume asm: \"N=Ax u c\"\n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL2 (u).N z){c:=(y).P} = \n        Cut <b>.AndR <a1>.(M1{c:=(y).P}) <a2>.(M2{c:=(y).P}) b (z).AndL2 (u).(N{c:=(y).P}) z\" \n        using LAnd2 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a2>.(M2{c:=(y).P}) (u).(N{c:=(y).P})\"\n        using LAnd2\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a2>.(M2{c:=(y).P}) (u).(Cut <c>.(Ax u c) (y).P)\" \n        using LAnd2 asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a2>.(M2{c:=(y).P}) (u).(P[y\\<turnstile>n>u])\"\n      proof (cases \"fin P y\")\n        case True \n        assume \"fin P y\"\n        then show ?thesis using LAnd2\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutR_intro)\n          apply(rule al_redu)\n          apply(rule better_LAxL_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fin P y\" \n        then show ?thesis\n          apply -\n          apply(rule a_star_CutR)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_right)\n          apply(simp)\n          apply(simp add: subst_with_ax1)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a2>.M2 (u).N){c:=(y).P}\" using LAnd2 asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(rule sym)\n        apply(rule nrename_swap)\n        apply(simp)\n        done\n      finally \n      have \"(Cut <b>.AndR <a1>.M1 <a2>.M2 b (z).AndL2 (u).N z){c:=(y).P} \\<longrightarrow>\\<^sub>a* (Cut <a2>.M2 (u).N){c:=(y).P}\"\n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nnext\n  case (LOr1 b a M N1 N2 z x1 x2 y c P)\n  then show ?case\n  proof -\n    { assume asm: \"N1\\<noteq>Ax x1 c\"\n      have \"(Cut <b>.OrR1 <a>.M b (z).OrL (x1).N1 (x2).N2 z){c:=(y).P} = \n        Cut <b>.OrR1 <a>.(M{c:=(y).P}) b (z).OrL (x1).(N1{c:=(y).P}) (x2).(N2{c:=(y).P}) z\" \n        using LOr1 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(M{c:=(y).P}) (x1).(N1{c:=(y).P})\"\n        using LOr1\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <a>.M (x1).N1){c:=(y).P}\" using LOr1 asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally \n      have \"(Cut <b>.OrR1 <a>.M b (z).OrL (x1).N1 (x2).N2 z){c:=(y).P} \\<longrightarrow>\\<^sub>a* (Cut <a>.M (x1).N1){c:=(y).P}\"\n        by simp\n    } \n    moreover\n    { assume asm: \"N1=Ax x1 c\"\n      have \"(Cut <b>.OrR1 <a>.M b (z).OrL (x1).N1 (x2).N2 z){c:=(y).P} = \n        Cut <b>.OrR1 <a>.(M{c:=(y).P}) b (z).OrL (x1).(N1{c:=(y).P}) (x2).(N2{c:=(y).P}) z\" \n        using LOr1 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(M{c:=(y).P}) (x1).(N1{c:=(y).P})\"\n        using LOr1\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a>.(M{c:=(y).P}) (x1).(Cut <c>.(Ax x1 c) (y).P)\" \n        using LOr1 asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(M{c:=(y).P})   (x1).(P[y\\<turnstile>n>x1])\"\n      proof (cases \"fin P y\")\n        case True \n        assume \"fin P y\"\n        then show ?thesis using LOr1\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutR_intro)\n          apply(rule al_redu)\n          apply(rule better_LAxL_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fin P y\" \n        then show ?thesis\n          apply -\n          apply(rule a_star_CutR)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_right)\n          apply(simp)\n          apply(simp add: subst_with_ax1)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a>.M (x1).N1){c:=(y).P}\" using LOr1 asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(rule sym)\n        apply(rule nrename_swap)\n        apply(simp)\n        done\n      finally \n      have \"(Cut <b>.OrR1 <a>.M b (z).OrL (x1).N1 (x2).N2 z){c:=(y).P} \\<longrightarrow>\\<^sub>a* (Cut <a>.M (x1).N1){c:=(y).P}\"\n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nnext\n  case (LOr2 b a M N1 N2 z x1 x2 y c P)\n  then show ?case\n  proof -\n    { assume asm: \"N2\\<noteq>Ax x2 c\"\n      have \"(Cut <b>.OrR2 <a>.M b (z).OrL (x1).N1 (x2).N2 z){c:=(y).P} = \n        Cut <b>.OrR2 <a>.(M{c:=(y).P}) b (z).OrL (x1).(N1{c:=(y).P}) (x2).(N2{c:=(y).P}) z\" \n        using LOr2 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(M{c:=(y).P}) (x2).(N2{c:=(y).P})\"\n        using LOr2\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <a>.M (x2).N2){c:=(y).P}\" using LOr2 asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally \n      have \"(Cut <b>.OrR2 <a>.M b (z).OrL (x1).N1 (x2).N2 z){c:=(y).P} \\<longrightarrow>\\<^sub>a* (Cut <a>.M (x2).N2){c:=(y).P}\"\n        by simp\n    } \n    moreover\n    { assume asm: \"N2=Ax x2 c\"\n      have \"(Cut <b>.OrR2 <a>.M b (z).OrL (x1).N1 (x2).N2 z){c:=(y).P} = \n        Cut <b>.OrR2 <a>.(M{c:=(y).P}) b (z).OrL (x1).(N1{c:=(y).P}) (x2).(N2{c:=(y).P}) z\" \n        using LOr2 by (simp add: subst_fresh abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(M{c:=(y).P}) (x2).(N2{c:=(y).P})\"\n        using LOr2\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a>.(M{c:=(y).P}) (x2).(Cut <c>.(Ax x2 c) (y).P)\" \n        using LOr2 asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(M{c:=(y).P}) (x2).(P[y\\<turnstile>n>x2])\"\n      proof (cases \"fin P y\")\n        case True \n        assume \"fin P y\"\n        then show ?thesis using LOr2\n          apply -\n          apply(rule a_starI)\n          apply(rule better_CutR_intro)\n          apply(rule al_redu)\n          apply(rule better_LAxL_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fin P y\" \n        then show ?thesis\n          apply -\n          apply(rule a_star_CutR)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_right)\n          apply(simp)\n          apply(simp add: subst_with_ax1)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a>.M (x2).N2){c:=(y).P}\" using LOr2 asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(rule sym)\n        apply(rule nrename_swap)\n        apply(simp)\n        done\n      finally \n      have \"(Cut <b>.OrR2 <a>.M b (z).OrL (x1).N1 (x2).N2 z){c:=(y).P} \\<longrightarrow>\\<^sub>a* (Cut <a>.M (x2).N2){c:=(y).P}\"\n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nnext\n  case (LImp z N u Q x M b a d y c P)\n  then show ?case\n  proof -\n    { assume asm: \"M\\<noteq>Ax x c \\<and> Q\\<noteq>Ax u c\"\n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){c:=(y).P} = \n        Cut <b>.ImpR (x).<a>.(M{c:=(y).P}) b (z).ImpL <d>.(N{c:=(y).P}) (u).(Q{c:=(y).P}) z\" \n        using LImp by (simp add: fresh_prod abs_fresh fresh_atm)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(M{c:=(y).P})) (u).(Q{c:=(y).P})\"\n        using LImp\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = (Cut <a>.(Cut <d>.N  (x).M) (u).Q){c:=(y).P}\" using LImp asm\n        by (simp add: subst_fresh abs_fresh fresh_atm)\n      finally \n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){c:=(y).P} \\<longrightarrow>\\<^sub>a* \n                     (Cut <a>.(Cut <d>.N  (x).M) (u).Q){c:=(y).P}\"\n        by simp\n    } \n    moreover\n    { assume asm: \"M=Ax x c \\<and> Q\\<noteq>Ax u c\"\n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){c:=(y).P} = \n        Cut <b>.ImpR (x).<a>.(M{c:=(y).P}) b (z).ImpL <d>.(N{c:=(y).P}) (u).(Q{c:=(y).P}) z\" \n        using LImp by (simp add: subst_fresh abs_fresh fresh_atm fresh_prod)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(M{c:=(y).P})) (u).(Q{c:=(y).P})\"\n        using LImp\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(Cut <c>.Ax x c (y).P)) (u).(Q{c:=(y).P})\"\n        using LImp asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(P[y\\<turnstile>n>x])) (u).(Q{c:=(y).P})\"\n      proof (cases \"fin P y\")\n        case True \n        assume \"fin P y\"\n        then show ?thesis using LImp\n          apply -\n          apply(rule a_star_CutL)\n          apply(rule a_star_CutR)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule al_redu)\n          apply(rule better_LAxL_intro)\n          apply(simp)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fin P y\" \n        then show ?thesis using LImp\n          apply -\n          apply(rule a_star_CutL)\n          apply(rule a_star_CutR)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_right)\n          apply(simp)\n          apply(simp add: subst_with_ax1)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a>.(Cut <d>.N (x).M) (u).Q){c:=(y).P}\" using LImp asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha)\n        apply(simp add: nrename_swap)\n        done\n      finally \n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){c:=(y).P} \\<longrightarrow>\\<^sub>a* \n               (Cut <a>.(Cut <d>.N (x).M) (u).Q){c:=(y).P}\"\n        by simp\n    }\n     moreover\n    { assume asm: \"M\\<noteq>Ax x c \\<and> Q=Ax u c\"\n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){c:=(y).P} = \n        Cut <b>.ImpR (x).<a>.(M{c:=(y).P}) b (z).ImpL <d>.(N{c:=(y).P}) (u).(Q{c:=(y).P}) z\" \n        using LImp by (simp add: subst_fresh abs_fresh fresh_atm fresh_prod)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(M{c:=(y).P})) (u).(Q{c:=(y).P})\"\n        using LImp\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(M{c:=(y).P})) (u).(Cut <c>.Ax u c (y).P)\"\n        using LImp asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(M{c:=(y).P})) (u).(P[y\\<turnstile>n>u])\"\n      proof (cases \"fin P y\")\n        case True \n        assume \"fin P y\"\n        then show ?thesis using LImp\n          apply -\n          apply(rule a_star_CutR)\n          apply(rule a_starI)\n          apply(rule al_redu)\n          apply(rule better_LAxL_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fin P y\" \n        then show ?thesis using LImp\n          apply -\n          apply(rule a_star_CutR)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_right)\n          apply(simp)\n          apply(simp add: subst_with_ax1)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a>.(Cut <d>.N (x).M) (u).Q){c:=(y).P}\" using LImp asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(simp add: alpha fresh_atm)\n        apply(simp add: nrename_swap)\n        done\n      finally \n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){c:=(y).P} \\<longrightarrow>\\<^sub>a* \n               (Cut <a>.(Cut <d>.N (x).M) (u).Q){c:=(y).P}\"\n        by simp\n    }\n     moreover\n    { assume asm: \"M=Ax x c \\<and> Q=Ax u c\"\n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){c:=(y).P} = \n        Cut <b>.ImpR (x).<a>.(M{c:=(y).P}) b (z).ImpL <d>.(N{c:=(y).P}) (u).(Q{c:=(y).P}) z\" \n        using LImp by (simp add: subst_fresh abs_fresh fresh_atm fresh_prod)\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(M{c:=(y).P})) (u).(Q{c:=(y).P})\"\n        using LImp\n        apply -\n        apply(rule a_starI)\n        apply(rule al_redu)\n        apply(auto intro: l_redu.intros simp add: subst_fresh abs_fresh)\n        done\n      also have \"\\<dots> = Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(Cut <c>.Ax x c (y).P)) (u).(Cut <c>.Ax u c (y).P)\"\n        using LImp asm by simp\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(Cut <c>.Ax x c (y).P)) (u).(P[y\\<turnstile>n>u])\"\n      proof (cases \"fin P y\")\n        case True \n        assume \"fin P y\"\n        then show ?thesis using LImp\n          apply -\n          apply(rule a_star_CutR)\n          apply(rule a_starI)\n          apply(rule al_redu)\n          apply(rule better_LAxL_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fin P y\" \n        then show ?thesis using LImp\n          apply -\n          apply(rule a_star_CutR)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_right)\n          apply(simp)\n          apply(simp add: subst_with_ax1)\n          done\n      qed\n      also have \"\\<dots> \\<longrightarrow>\\<^sub>a* Cut <a>.(Cut <d>.(N{c:=(y).P})  (x).(P[y\\<turnstile>n>x])) (u).(P[y\\<turnstile>n>u])\"\n      proof (cases \"fin P y\")\n        case True \n        assume \"fin P y\"\n        then show ?thesis using LImp\n          apply -\n          apply(rule a_star_CutL)\n          apply(rule a_star_CutR)\n          apply(rule a_starI)\n          apply(rule al_redu)\n          apply(rule better_LAxL_intro)\n          apply(simp)\n          done\n      next\n        case False \n        assume \"\\<not>fin P y\" \n        then show ?thesis using LImp\n          apply -\n          apply(rule a_star_CutL)\n          apply(rule a_star_CutR)\n          apply(rule a_star_trans)\n          apply(rule a_starI)\n          apply(rule ac_redu)\n          apply(rule better_right)\n          apply(simp)\n          apply(simp add: subst_with_ax1)\n          done\n      qed\n      also have \"\\<dots> = (Cut <a>.(Cut <d>.N (x).M) (u).Q){c:=(y).P}\" using LImp asm\n        apply -\n        apply(auto simp add: subst_fresh abs_fresh)\n        apply(simp add: trm.inject)\n        apply(rule conjI)\n        apply(simp add: alpha fresh_atm trm.inject)\n        apply(simp add: nrename_swap)\n        apply(simp add: alpha fresh_atm trm.inject)\n        apply(simp add: nrename_swap)\n        done\n      finally \n      have \"(Cut <b>.ImpR (x).<a>.M b (z).ImpL <d>.N (u).Q z){c:=(y).P} \\<longrightarrow>\\<^sub>a* \n               (Cut <a>.(Cut <d>.N (x).M) (u).Q){c:=(y).P}\"\n        by simp\n    }\n    ultimately show ?thesis by blast\n  qed\nqed\n\nlemma a_redu_subst1:\n  assumes a: \"M \\<longrightarrow>\\<^sub>a M'\"\n  shows \"M{y:=<c>.P} \\<longrightarrow>\\<^sub>a* M'{y:=<c>.P}\"\nusing a\nproof(nominal_induct avoiding: y c P rule: a_redu.strong_induct)\n  case al_redu\n  then show ?case by (simp only: l_redu_subst1)\nnext\n  case ac_redu\n  then show ?case\n    apply -\n    apply(rule a_starI)\n    apply(rule a_redu.ac_redu)\n    apply(simp only: c_redu_subst1')\n    done\nnext\n  case (a_Cut_l a N x M M' y c P)\n  then show ?case\n    apply(simp add: subst_fresh fresh_a_redu)\n    apply(rule conjI)\n    apply(rule impI)+\n    apply(simp)\n    apply(drule ax_do_not_a_reduce)\n    apply(simp)\n    apply(rule impI)\n    apply(rule conjI)\n    apply(rule impI)\n    apply(simp)\n    apply(drule_tac x=\"y\" in meta_spec)\n    apply(drule_tac x=\"c\" in meta_spec)\n    apply(drule_tac x=\"P\" in meta_spec)\n    apply(simp)\n    apply(rule a_star_trans)\n    apply(rule a_star_CutL)\n    apply(assumption)\n    apply(rule a_star_trans)\n    apply(rule_tac M'=\"P[c\\<turnstile>c>a]\" in a_star_CutL)\n    apply(case_tac \"fic P c\")\n    apply(rule a_starI)\n    apply(rule al_redu)\n    apply(rule better_LAxR_intro)\n    apply(simp)\n    apply(rule a_star_trans)\n    apply(rule a_starI)\n    apply(rule ac_redu)\n    apply(rule better_left)\n    apply(simp)\n    apply(rule subst_with_ax2)\n    apply(rule aux4)\n    apply(simp add: trm.inject)\n    apply(simp add: alpha fresh_atm)\n    apply(simp add: crename_swap)\n    apply(rule impI)\n    apply(rule a_star_CutL)\n    apply(auto)\n    done\nnext\n  case (a_Cut_r a N x M M' y c P)\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_CutR)\n    apply(auto)[1]\n    apply(rule a_star_CutR)\n    apply(auto)[1]\n    done\nnext\n  case a_NotL\n  then show ?case \n    apply(auto)\n    apply(generate_fresh \"name\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutR)\n    apply(rule a_star_NotL)\n    apply(auto)[1]\n    apply(rule a_star_NotL)\n    apply(auto)[1]\n    done\nnext\n  case a_NotR\n  then show ?case \n    apply(auto)\n    apply(rule a_star_NotR)\n    apply(auto)[1]\n    done\nnext\n  case a_AndR_l\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_AndR)\n    apply(auto)\n    done\nnext\n  case a_AndR_r\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_AndR)\n    apply(auto)\n    done\nnext\n  case a_AndL1\n  then show ?case \n    apply(auto)\n    apply(generate_fresh \"name\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutR)\n    apply(rule a_star_AndL1)\n    apply(auto)[1]\n    apply(rule a_star_AndL1)\n    apply(auto)[1]\n    done\nnext\n  case a_AndL2\n  then show ?case \n    apply(auto)\n    apply(generate_fresh \"name\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutR)\n    apply(rule a_star_AndL2)\n    apply(auto)[1]\n    apply(rule a_star_AndL2)\n    apply(auto)[1]\n    done\nnext\n  case a_OrR1\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_OrR1)\n    apply(auto)\n    done\nnext\n  case a_OrR2\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_OrR2)\n    apply(auto)\n    done\nnext\n  case a_OrL_l\n  then show ?case \n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(generate_fresh \"name\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutR)\n    apply(rule a_star_OrL)\n    apply(auto)\n    apply(rule a_star_OrL)\n    apply(auto)\n    done\nnext\n  case a_OrL_r\n  then show ?case \n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(generate_fresh \"name\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutR)\n    apply(rule a_star_OrL)\n    apply(auto)\n    apply(rule a_star_OrL)\n    apply(auto)\n    done\nnext\n  case a_ImpR\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_ImpR)\n    apply(auto)\n    done\nnext\n  case a_ImpL_r\n  then show ?case \n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(generate_fresh \"name\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutR)\n    apply(rule a_star_ImpL)\n    apply(auto)\n    apply(rule a_star_ImpL)\n    apply(auto)\n    done\nnext\n  case a_ImpL_l\n  then show ?case \n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(generate_fresh \"name\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutR)\n    apply(rule a_star_ImpL)\n    apply(auto)\n    apply(rule a_star_ImpL)\n    apply(auto)\n    done\nqed\n\nlemma a_redu_subst2:\n  assumes a: \"M \\<longrightarrow>\\<^sub>a M'\"\n  shows \"M{c:=(y).P} \\<longrightarrow>\\<^sub>a* M'{c:=(y).P}\"\nusing a\nproof(nominal_induct avoiding: y c P rule: a_redu.strong_induct)\n  case al_redu\n  then show ?case by (simp only: l_redu_subst2)\nnext\n  case ac_redu\n  then show ?case\n    apply -\n    apply(rule a_starI)\n    apply(rule a_redu.ac_redu)\n    apply(simp only: c_redu_subst2')\n    done\nnext\n  case (a_Cut_r a N x M M' y c P)\n  then show ?case\n    apply(simp add: subst_fresh fresh_a_redu)\n    apply(rule conjI)\n    apply(rule impI)+\n    apply(simp)\n    apply(drule ax_do_not_a_reduce)\n    apply(simp)\n    apply(rule impI)\n    apply(rule conjI)\n    apply(rule impI)\n    apply(simp)\n    apply(drule_tac x=\"c\" in meta_spec)\n    apply(drule_tac x=\"y\" in meta_spec)\n    apply(drule_tac x=\"P\" in meta_spec)\n    apply(simp)\n    apply(rule a_star_trans)\n    apply(rule a_star_CutR)\n    apply(assumption)\n    apply(rule a_star_trans)\n    apply(rule_tac N'=\"P[y\\<turnstile>n>x]\" in a_star_CutR)\n    apply(case_tac \"fin P y\")\n    apply(rule a_starI)\n    apply(rule al_redu)\n    apply(rule better_LAxL_intro)\n    apply(simp)\n    apply(rule a_star_trans)\n    apply(rule a_starI)\n    apply(rule ac_redu)\n    apply(rule better_right)\n    apply(simp)\n    apply(rule subst_with_ax1)\n    apply(rule aux4)\n    apply(simp add: trm.inject)\n    apply(simp add: alpha fresh_atm)\n    apply(simp add: nrename_swap)\n    apply(rule impI)\n    apply(rule a_star_CutR)\n    apply(auto)\n    done\nnext\n  case (a_Cut_l a N x M M' y c P)\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_CutL)\n    apply(auto)[1]\n    apply(rule a_star_CutL)\n    apply(auto)[1]\n    done\nnext\n  case a_NotR\n  then show ?case \n    apply(auto)\n    apply(generate_fresh \"coname\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutL)\n    apply(rule a_star_NotR)\n    apply(auto)[1]\n    apply(rule a_star_NotR)\n    apply(auto)[1]\n    done\nnext\n  case a_NotL\n  then show ?case \n    apply(auto)\n    apply(rule a_star_NotL)\n    apply(auto)[1]\n    done\nnext\n  case a_AndR_l\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(generate_fresh \"coname\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutL)\n    apply(rule a_star_AndR)\n    apply(auto)\n    apply(rule a_star_AndR)\n    apply(auto)\n    done\nnext\n  case a_AndR_r\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(generate_fresh \"coname\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutL)\n    apply(rule a_star_AndR)\n    apply(auto)\n    apply(rule a_star_AndR)\n    apply(auto)\n    done\nnext\n  case a_AndL1\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_AndL1)\n    apply(auto)\n    done\nnext\n  case a_AndL2\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_AndL2)\n    apply(auto)\n    done\nnext\n  case a_OrR1\n  then show ?case \n    apply(auto)\n    apply(generate_fresh \"coname\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutL)\n    apply(rule a_star_OrR1)\n    apply(auto)[1]\n    apply(rule a_star_OrR1)\n    apply(auto)[1]\n    done\nnext\n  case a_OrR2\n  then show ?case \n    apply(auto)\n    apply(generate_fresh \"coname\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutL)\n    apply(rule a_star_OrR2)\n    apply(auto)[1]\n    apply(rule a_star_OrR2)\n    apply(auto)[1]\n    done\nnext\n  case a_OrL_l\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_OrL)\n    apply(auto)\n    done\nnext\n  case a_OrL_r\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_OrL)\n    apply(auto)\n    done\nnext\n  case a_ImpR\n  then show ?case \n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(generate_fresh \"coname\")\n    apply(fresh_fun_simp)\n    apply(fresh_fun_simp)\n    apply(simp add: subst_fresh)\n    apply(rule a_star_CutL)\n    apply(rule a_star_ImpR)\n    apply(auto)\n    apply(rule a_star_ImpR)\n    apply(auto)\n    done\nnext\n  case a_ImpL_l\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_ImpL)\n    apply(auto)\n    done\nnext\n  case a_ImpL_r\n  then show ?case\n    apply(auto simp add: subst_fresh fresh_a_redu)\n    apply(rule a_star_ImpL)\n    apply(auto)\n    done\nqed\n\nlemma a_star_subst1:\n  assumes a: \"M \\<longrightarrow>\\<^sub>a* M'\"\n  shows \"M{y:=<c>.P} \\<longrightarrow>\\<^sub>a* M'{y:=<c>.P}\"\nusing a\napply(induct)\napply(blast)\napply(drule_tac y=\"y\" and c=\"c\" and P=\"P\" in a_redu_subst1)\napply(auto)\ndone\n\nlemma a_star_subst2:\n  assumes a: \"M \\<longrightarrow>\\<^sub>a* M'\"\n  shows \"M{c:=(y).P} \\<longrightarrow>\\<^sub>a* M'{c:=(y).P}\"\nusing a\napply(induct)\napply(blast)\napply(drule_tac y=\"y\" and c=\"c\" and P=\"P\" in a_redu_subst2)\napply(auto)\ndone\n\ntext \\<open>Candidates and SN\\<close>\n\ntext \\<open>SNa\\<close>\n\ninductive \n  SNa :: \"trm \\<Rightarrow> bool\"\nwhere\n  SNaI: \"(\\<And>M'. M \\<longrightarrow>\\<^sub>a M' \\<Longrightarrow> SNa M') \\<Longrightarrow> SNa M\"\n\nlemma SNa_induct[consumes 1]:\n  assumes major: \"SNa M\"\n  assumes hyp: \"\\<And>M'. SNa M' \\<Longrightarrow> (\\<forall>M''. M'\\<longrightarrow>\\<^sub>a M'' \\<longrightarrow> P M'' \\<Longrightarrow> P M')\"\n  shows \"P M\"\n  apply (rule major[THEN SNa.induct])\n  apply (rule hyp)\n  apply (rule SNaI)\n  apply (blast)+\n  done\n\n\nlemma double_SNa_aux:\n  assumes a_SNa: \"SNa a\"\n  and b_SNa: \"SNa b\"\n  and hyp: \"\\<And>x z.\n    (\\<And>y. x\\<longrightarrow>\\<^sub>a y \\<Longrightarrow> SNa y) \\<Longrightarrow>\n    (\\<And>y. x\\<longrightarrow>\\<^sub>a y \\<Longrightarrow> P y z) \\<Longrightarrow>\n    (\\<And>u. z\\<longrightarrow>\\<^sub>a u \\<Longrightarrow> SNa u) \\<Longrightarrow>\n    (\\<And>u. z\\<longrightarrow>\\<^sub>a u \\<Longrightarrow> P x u) \\<Longrightarrow> P x z\"\n  shows \"P a b\"\nproof -\n  from a_SNa\n  have r: \"\\<And>b. SNa b \\<Longrightarrow> P a b\"\n  proof (induct a rule: SNa.induct)\n    case (SNaI x)\n    note SNa' = this\n    have \"SNa b\" by fact\n    thus ?case\n    proof (induct b rule: SNa.induct)\n      case (SNaI y)\n      show ?case\n        apply (rule hyp)\n        apply (erule SNa')\n        apply (erule SNa')\n        apply (rule SNa.SNaI)\n        apply (erule SNaI)+\n        done\n    qed\n  qed\n  from b_SNa show ?thesis by (rule r)\nqed\n\nlemma double_SNa:\n  \"\\<lbrakk>SNa a; SNa b; \\<forall>x z. ((\\<forall>y. x\\<longrightarrow>\\<^sub>ay \\<longrightarrow> P y z) \\<and> (\\<forall>u. z\\<longrightarrow>\\<^sub>a u \\<longrightarrow> P x u)) \\<longrightarrow> P x z\\<rbrakk> \\<Longrightarrow> P a b\"\napply(rule_tac double_SNa_aux)\napply(assumption)+\napply(blast)\ndone\n\nlemma a_preserves_SNa:\n  assumes a: \"SNa M\" \"M\\<longrightarrow>\\<^sub>a M'\"\n  shows \"SNa M'\"\nusing a \nby (erule_tac SNa.cases) (simp)\n\nlemma a_star_preserves_SNa:\n  assumes a: \"SNa M\" and b: \"M\\<longrightarrow>\\<^sub>a* M'\"\n  shows \"SNa M'\"\nusing b a\nby (induct) (auto simp add: a_preserves_SNa)\n\nlemma Ax_in_SNa:\n  shows \"SNa (Ax x a)\"\napply(rule SNaI)\napply(erule a_redu.cases, auto)\napply(erule l_redu.cases, auto)\napply(erule c_redu.cases, auto)\ndone\n\nlemma NotL_in_SNa:\n  assumes a: \"SNa M\"\n  shows \"SNa (NotL <a>.M x)\"\nusing a\napply(induct)\napply(rule SNaI)\napply(erule a_redu.cases, auto)\napply(erule l_redu.cases, auto)\napply(erule c_redu.cases, auto)\napply(auto simp add: trm.inject alpha)\napply(rotate_tac 1)\napply(drule_tac x=\"[(a,aa)]\\<bullet>M'a\" in meta_spec)\napply(simp add: a_redu.eqvt)\napply(subgoal_tac \"NotL <a>.([(a,aa)]\\<bullet>M'a) x = NotL <aa>.M'a x\")\napply(simp)\napply(simp add: trm.inject alpha fresh_a_redu)\ndone\n\nlemma NotR_in_SNa:\n  assumes a: \"SNa M\"\n  shows \"SNa (NotR (x).M a)\"\nusing a\napply(induct)\napply(rule SNaI)\napply(erule a_redu.cases, auto)\napply(erule l_redu.cases, auto)\napply(erule c_redu.cases, auto)\napply(auto simp add: trm.inject alpha)\napply(rotate_tac 1)\napply(drule_tac x=\"[(x,xa)]\\<bullet>M'a\" in meta_spec)\napply(simp add: a_redu.eqvt)\napply(rule_tac s=\"NotR (x).([(x,xa)]\\<bullet>M'a) a\" in subst)\napply(simp add: trm.inject alpha fresh_a_redu)\napply(simp)\ndone\n\nlemma AndL1_in_SNa:\n  assumes a: \"SNa M\"\n  shows \"SNa (AndL1 (x).M y)\"\nusing a\napply(induct)\napply(rule SNaI)\napply(erule a_redu.cases, auto)\napply(erule l_redu.cases, auto)\napply(erule c_redu.cases, auto)\napply(auto simp add: trm.inject alpha)\napply(rotate_tac 1)\napply(drule_tac x=\"[(x,xa)]\\<bullet>M'a\" in meta_spec)\napply(simp add: a_redu.eqvt)\napply(rule_tac s=\"AndL1 x.([(x,xa)]\\<bullet>M'a) y\" in subst)\napply(simp add: trm.inject alpha fresh_a_redu)\napply(simp)\ndone\n\nlemma AndL2_in_SNa:\n  assumes a: \"SNa M\"\n  shows \"SNa (AndL2 (x).M y)\"\nusing a\napply(induct)\napply(rule SNaI)\napply(erule a_redu.cases, auto)\napply(erule l_redu.cases, auto)\napply(erule c_redu.cases, auto)\napply(auto simp add: trm.inject alpha)\napply(rotate_tac 1)\napply(drule_tac x=\"[(x,xa)]\\<bullet>M'a\" in meta_spec)\napply(simp add: a_redu.eqvt)\napply(rule_tac s=\"AndL2 x.([(x,xa)]\\<bullet>M'a) y\" in subst)\napply(simp add: trm.inject alpha fresh_a_redu)\napply(simp)\ndone\n\nlemma OrR1_in_SNa:\n  assumes a: \"SNa M\"\n  shows \"SNa (OrR1 <a>.M b)\"\nusing a\napply(induct)\napply(rule SNaI)\napply(erule a_redu.cases, auto)\napply(erule l_redu.cases, auto)\napply(erule c_redu.cases, auto)\napply(auto simp add: trm.inject alpha)\napply(rotate_tac 1)\napply(drule_tac x=\"[(a,aa)]\\<bullet>M'a\" in meta_spec)\napply(simp add: a_redu.eqvt)\napply(rule_tac s=\"OrR1 <a>.([(a,aa)]\\<bullet>M'a) b\" in subst)\napply(simp add: trm.inject alpha fresh_a_redu)\napply(simp)\ndone\n\nlemma OrR2_in_SNa:\n  assumes a: \"SNa M\"\n  shows \"SNa (OrR2 <a>.M b)\"\nusing a\napply(induct)\napply(rule SNaI)\napply(erule a_redu.cases, auto)\napply(erule l_redu.cases, auto)\napply(erule c_redu.cases, auto)\napply(auto simp add: trm.inject alpha)\napply(rotate_tac 1)\napply(drule_tac x=\"[(a,aa)]\\<bullet>M'a\" in meta_spec)\napply(simp add: a_redu.eqvt)\napply(rule_tac s=\"OrR2 <a>.([(a,aa)]\\<bullet>M'a) b\" in subst)\napply(simp add: trm.inject alpha fresh_a_redu)\napply(simp)\ndone\n\nlemma ImpR_in_SNa:\n  assumes a: \"SNa M\"\n  shows \"SNa (ImpR (x).<a>.M b)\"\nusing a\napply(induct)\napply(rule SNaI)\napply(erule a_redu.cases, auto)\napply(erule l_redu.cases, auto)\napply(erule c_redu.cases, auto)\napply(auto simp add: trm.inject alpha abs_fresh abs_perm calc_atm)\napply(rotate_tac 1)\napply(drule_tac x=\"[(a,aa)]\\<bullet>M'a\" in meta_spec)\napply(simp add: a_redu.eqvt)\napply(rule_tac s=\"ImpR (x).<a>.([(a,aa)]\\<bullet>M'a) b\" in subst)\napply(simp add: trm.inject alpha fresh_a_redu)\napply(simp)\napply(rotate_tac 1)\napply(drule_tac x=\"[(x,xa)]\\<bullet>M'a\" in meta_spec)\napply(simp add: a_redu.eqvt)\napply(rule_tac s=\"ImpR (x).<a>.([(x,xa)]\\<bullet>M'a) b\" in subst)\napply(simp add: trm.inject alpha fresh_a_redu abs_fresh abs_perm calc_atm)\napply(simp)\napply(rotate_tac 1)\napply(drule_tac x=\"[(a,aa)]\\<bullet>[(x,xa)]\\<bullet>M'a\" in meta_spec)\napply(simp add: a_redu.eqvt)\napply(rule_tac s=\"ImpR (x).<a>.([(a,aa)]\\<bullet>[(x,xa)]\\<bullet>M'a) b\" in subst)\napply(simp add: trm.inject alpha fresh_a_redu abs_fresh abs_perm calc_atm)\napply(simp add: fresh_left calc_atm fresh_a_redu)\napply(simp)\ndone\n\nlemma AndR_in_SNa:\n  assumes a: \"SNa M\" \"SNa N\"\n  shows \"SNa (AndR <a>.M <b>.N c)\"\napply(rule_tac a=\"M\" and b=\"N\" in double_SNa)\napply(rule a)+\napply(auto)\napply(rule SNaI)\napply(drule a_redu_AndR_elim)\napply(auto)\ndone\n\nlemma OrL_in_SNa:\n  assumes a: \"SNa M\" \"SNa N\"\n  shows \"SNa (OrL (x).M (y).N z)\"\napply(rule_tac a=\"M\" and b=\"N\" in double_SNa)\napply(rule a)+\napply(auto)\napply(rule SNaI)\napply(drule a_redu_OrL_elim)\napply(auto)\ndone\n\nlemma ImpL_in_SNa:\n  assumes a: \"SNa M\" \"SNa N\"\n  shows \"SNa (ImpL <a>.M (y).N z)\"\napply(rule_tac a=\"M\" and b=\"N\" in double_SNa)\napply(rule a)+\napply(auto)\napply(rule SNaI)\napply(drule a_redu_ImpL_elim)\napply(auto)\ndone\n\nlemma SNa_eqvt:\n  fixes pi1::\"name prm\"\n  and   pi2::\"coname prm\"\n  shows \"SNa M \\<Longrightarrow> SNa (pi1\\<bullet>M)\"\n  and   \"SNa M \\<Longrightarrow> SNa (pi2\\<bullet>M)\"\napply -\napply(induct rule: SNa.induct)\napply(rule SNaI)\napply(drule_tac pi=\"(rev pi1)\" in a_redu.eqvt(1))\napply(rotate_tac 1)\napply(drule_tac x=\"(rev pi1)\\<bullet>M'\" in meta_spec)\napply(perm_simp)\napply(induct rule: SNa.induct)\napply(rule SNaI)\napply(drule_tac pi=\"(rev pi2)\" in a_redu.eqvt(2))\napply(rotate_tac 1)\napply(drule_tac x=\"(rev pi2)\\<bullet>M'\" in meta_spec)\napply(perm_simp)\ndone\n\ntext \\<open>set operators\\<close>\n\ndefinition AXIOMSn :: \"ty \\<Rightarrow> ntrm set\" where\n  \"AXIOMSn B \\<equiv> { (x):(Ax y b) | x y b. True }\"\n\ndefinition AXIOMSc::\"ty \\<Rightarrow> ctrm set\" where\n  \"AXIOMSc B \\<equiv> { <a>:(Ax y b) | a y b. True }\"\n\ndefinition BINDINGn::\"ty \\<Rightarrow> ctrm set \\<Rightarrow> ntrm set\" where\n  \"BINDINGn B X \\<equiv> { (x):M | x M. \\<forall>a P. <a>:P\\<in>X \\<longrightarrow> SNa (M{x:=<a>.P})}\"\n\ndefinition BINDINGc::\"ty \\<Rightarrow> ntrm set \\<Rightarrow> ctrm set\" where\n  \"BINDINGc B X \\<equiv> { <a>:M | a M. \\<forall>x P. (x):P\\<in>X \\<longrightarrow> SNa (M{a:=(x).P})}\"\n\nlemma BINDINGn_decreasing:\n  shows \"X\\<subseteq>Y \\<Longrightarrow> BINDINGn B Y \\<subseteq> BINDINGn B X\"\nby (simp add: BINDINGn_def) (blast) \n\nlemma BINDINGc_decreasing:\n  shows \"X\\<subseteq>Y \\<Longrightarrow> BINDINGc B Y \\<subseteq> BINDINGc B X\"\nby (simp add: BINDINGc_def) (blast) \n  \nnominal_primrec\n  NOTRIGHT :: \"ty \\<Rightarrow> ntrm set \\<Rightarrow> ctrm set\"\nwhere\n \"NOTRIGHT (NOT B) X = { <a>:NotR (x).M a | a x M. fic (NotR (x).M a) a \\<and> (x):M \\<in> X }\"\napply(rule TrueI)+\ndone\n\nlemma NOTRIGHT_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(NOTRIGHT (NOT B) X)) = NOTRIGHT (NOT B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>a\" in exI) \napply(rule_tac x=\"pi\\<bullet>xb\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fic.eqvt(1))\napply(simp)\napply(rule_tac x=\"(xb):M\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>(<a>:NotR (xa).M a)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fic.eqvt(1))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: swap_simps)\ndone\n\nlemma NOTRIGHT_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(NOTRIGHT (NOT B) X)) = NOTRIGHT (NOT B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>a\" in exI) \napply(rule_tac x=\"pi\\<bullet>xb\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fic.eqvt(2))\napply(simp)\napply(rule_tac x=\"(xb):M\" in exI)\napply(simp)\napply(rule_tac x=\"<((rev pi)\\<bullet>a)>:NotR ((rev pi)\\<bullet>xa).((rev pi)\\<bullet>M) ((rev pi)\\<bullet>a)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fic.eqvt(2))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: swap_simps)\ndone\n  \nnominal_primrec\n  NOTLEFT :: \"ty \\<Rightarrow> ctrm set \\<Rightarrow> ntrm set\"\nwhere\n \"NOTLEFT (NOT B) X = { (x):NotL <a>.M x | a x M. fin (NotL <a>.M x) x \\<and> <a>:M \\<in> X }\"\napply(rule TrueI)+\ndone\n\nlemma NOTLEFT_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(NOTLEFT (NOT B) X)) = NOTLEFT (NOT B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>a\" in exI) \napply(rule_tac x=\"pi\\<bullet>xb\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fin.eqvt(1))\napply(simp)\napply(rule_tac x=\"<a>:M\" in exI)\napply(simp)\napply(rule_tac x=\"(((rev pi)\\<bullet>xa)):NotL <((rev pi)\\<bullet>a)>.((rev pi)\\<bullet>M) ((rev pi)\\<bullet>xa)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fin.eqvt(1))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: swap_simps)\ndone\n\nlemma NOTLEFT_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(NOTLEFT (NOT B) X)) = NOTLEFT (NOT B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>a\" in exI) \napply(rule_tac x=\"pi\\<bullet>xb\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fin.eqvt(2))\napply(simp)\napply(rule_tac x=\"<a>:M\" in exI)\napply(simp)\napply(rule_tac x=\"(((rev pi)\\<bullet>xa)):NotL <((rev pi)\\<bullet>a)>.((rev pi)\\<bullet>M) ((rev pi)\\<bullet>xa)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fin.eqvt(2))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: swap_simps)\ndone\n  \nnominal_primrec\n  ANDRIGHT :: \"ty \\<Rightarrow> ctrm set \\<Rightarrow> ctrm set \\<Rightarrow> ctrm set\"\nwhere\n \"ANDRIGHT (B AND C) X Y = \n            { <c>:AndR <a>.M <b>.N c | c a b M N. fic (AndR <a>.M <b>.N c) c \\<and> <a>:M \\<in> X \\<and> <b>:N \\<in> Y }\"\napply(rule TrueI)+\ndone\n\nlemma ANDRIGHT_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(ANDRIGHT (A AND B) X Y)) = ANDRIGHT (A AND B) (pi\\<bullet>X) (pi\\<bullet>Y)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>c\" in exI)\napply(rule_tac x=\"pi\\<bullet>a\" in exI)\napply(rule_tac x=\"pi\\<bullet>b\" in exI)\napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(rule_tac x=\"pi\\<bullet>N\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fic.eqvt(1))\napply(simp)\napply(rule conjI)\napply(rule_tac x=\"<a>:M\" in exI)\napply(simp)\napply(rule_tac x=\"<b>:N\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>(<c>:AndR <a>.M <b>.N c)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>c\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>b\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>N\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fic.eqvt(1))\napply(simp)\napply(drule sym)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: swap_simps)\ndone\n\nlemma ANDRIGHT_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(ANDRIGHT (A AND B) X Y)) = ANDRIGHT (A AND B) (pi\\<bullet>X) (pi\\<bullet>Y)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>c\" in exI)\napply(rule_tac x=\"pi\\<bullet>a\" in exI)\napply(rule_tac x=\"pi\\<bullet>b\" in exI)\napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(rule_tac x=\"pi\\<bullet>N\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fic.eqvt(2))\napply(simp)\napply(rule conjI)\napply(rule_tac x=\"<a>:M\" in exI)\napply(simp)\napply(rule_tac x=\"<b>:N\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>(<c>:AndR <a>.M <b>.N c)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>c\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>b\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>N\" in exI)\napply(simp)\napply(drule_tac pi=\"rev pi\" in fic.eqvt(2))\napply(simp)\napply(drule sym)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp)\ndone\n\nnominal_primrec\n  ANDLEFT1 :: \"ty \\<Rightarrow> ntrm set \\<Rightarrow> ntrm set\"\nwhere\n \"ANDLEFT1 (B AND C) X = { (y):AndL1 (x).M y | x y M. fin (AndL1 (x).M y) y \\<and> (x):M \\<in> X }\"\napply(rule TrueI)+\ndone\n\nlemma ANDLEFT1_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(ANDLEFT1 (A AND B) X)) = ANDLEFT1 (A AND B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI) \napply(rule_tac x=\"pi\\<bullet>y\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fin.eqvt(1))\napply(simp)\napply(rule_tac x=\"(xb):M\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>((y):AndL1 (xa).M y)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>y\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp)\napply(drule_tac pi=\"rev pi\" in fin.eqvt(1))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp)\ndone\n\nlemma ANDLEFT1_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(ANDLEFT1 (A AND B) X)) = ANDLEFT1 (A AND B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI) \napply(rule_tac x=\"pi\\<bullet>y\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fin.eqvt(2))\napply(simp)\napply(rule_tac x=\"(xb):M\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>((y):AndL1 (xa).M y)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>y\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fin.eqvt(2))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: swap_simps)\ndone\n\nnominal_primrec\n  ANDLEFT2 :: \"ty \\<Rightarrow> ntrm set \\<Rightarrow> ntrm set\"\nwhere\n \"ANDLEFT2 (B AND C) X = { (y):AndL2 (x).M y | x y M. fin (AndL2 (x).M y) y \\<and> (x):M \\<in> X }\"\napply(rule TrueI)+\ndone\n\nlemma ANDLEFT2_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(ANDLEFT2 (A AND B) X)) = ANDLEFT2 (A AND B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI) \napply(rule_tac x=\"pi\\<bullet>y\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fin.eqvt(1))\napply(simp)\napply(rule_tac x=\"(xb):M\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>((y):AndL2 (xa).M y)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>y\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp)\napply(drule_tac pi=\"rev pi\" in fin.eqvt(1))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp)\ndone\n\nlemma ANDLEFT2_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(ANDLEFT2 (A AND B) X)) = ANDLEFT2 (A AND B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI) \napply(rule_tac x=\"pi\\<bullet>y\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fin.eqvt(2))\napply(simp)\napply(rule_tac x=\"(xb):M\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>((y):AndL2 (xa).M y)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>y\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fin.eqvt(2))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: swap_simps)\ndone\n\nnominal_primrec\n  ORLEFT :: \"ty \\<Rightarrow> ntrm set \\<Rightarrow> ntrm set \\<Rightarrow> ntrm set\"\nwhere\n \"ORLEFT (B OR C) X Y = \n            { (z):OrL (x).M (y).N z | x y z M N. fin (OrL (x).M (y).N z) z \\<and> (x):M \\<in> X \\<and> (y):N \\<in> Y }\"\napply(rule TrueI)+\ndone\n\nlemma ORLEFT_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(ORLEFT (A OR B) X Y)) = ORLEFT (A OR B) (pi\\<bullet>X) (pi\\<bullet>Y)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI)\napply(rule_tac x=\"pi\\<bullet>y\" in exI)\napply(rule_tac x=\"pi\\<bullet>z\" in exI)\napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(rule_tac x=\"pi\\<bullet>N\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fin.eqvt(1))\napply(simp)\napply(rule conjI)\napply(rule_tac x=\"(xb):M\" in exI)\napply(simp)\napply(rule_tac x=\"(y):N\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>((z):OrL (xa).M (y).N z)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>y\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>z\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>N\" in exI)\napply(simp)\napply(drule_tac pi=\"rev pi\" in fin.eqvt(1))\napply(simp)\napply(drule sym)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp)\ndone\n\nlemma ORLEFT_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(ORLEFT (A OR B) X Y)) = ORLEFT (A OR B) (pi\\<bullet>X) (pi\\<bullet>Y)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI)\napply(rule_tac x=\"pi\\<bullet>y\" in exI)\napply(rule_tac x=\"pi\\<bullet>z\" in exI)\napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(rule_tac x=\"pi\\<bullet>N\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fin.eqvt(2))\napply(simp)\napply(rule conjI)\napply(rule_tac x=\"(xb):M\" in exI)\napply(simp)\napply(rule_tac x=\"(y):N\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>((z):OrL (xa).M (y).N z)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>y\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>z\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>N\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fin.eqvt(2))\napply(simp)\napply(drule sym)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: swap_simps)\ndone\n\nnominal_primrec\n  ORRIGHT1 :: \"ty \\<Rightarrow> ctrm set \\<Rightarrow> ctrm set\"\nwhere\n \"ORRIGHT1 (B OR C) X = { <b>:OrR1 <a>.M b | a b M. fic (OrR1 <a>.M b) b \\<and> <a>:M \\<in> X }\"\napply(rule TrueI)+\ndone\n\nlemma ORRIGHT1_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(ORRIGHT1 (A OR B) X)) = ORRIGHT1 (A OR B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>a\" in exI) \napply(rule_tac x=\"pi\\<bullet>b\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fic.eqvt(1))\napply(simp)\napply(rule_tac x=\"<a>:M\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>(<b>:OrR1 <a>.M b)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>b\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fic.eqvt(1))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: swap_simps)\ndone\n\nlemma ORRIGHT1_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(ORRIGHT1 (A OR B) X)) = ORRIGHT1 (A OR B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>a\" in exI) \napply(rule_tac x=\"pi\\<bullet>b\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fic.eqvt(2))\napply(simp)\napply(rule_tac x=\"<a>:M\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>(<b>:OrR1 <a>.M b)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>b\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp)\napply(drule_tac pi=\"rev pi\" in fic.eqvt(2))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp)\ndone\n\nnominal_primrec\n  ORRIGHT2 :: \"ty \\<Rightarrow> ctrm set \\<Rightarrow> ctrm set\"\nwhere\n \"ORRIGHT2 (B OR C) X = { <b>:OrR2 <a>.M b | a b M. fic (OrR2 <a>.M b) b \\<and> <a>:M \\<in> X }\"\napply(rule TrueI)+\ndone\n\nlemma ORRIGHT2_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(ORRIGHT2 (A OR B) X)) = ORRIGHT2 (A OR B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>a\" in exI) \napply(rule_tac x=\"pi\\<bullet>b\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fic.eqvt(1))\napply(simp)\napply(rule_tac x=\"<a>:M\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>(<b>:OrR2 <a>.M b)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>b\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fic.eqvt(1))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: swap_simps)\ndone\n\nlemma ORRIGHT2_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(ORRIGHT2 (A OR B) X)) = ORRIGHT2 (A OR B) (pi\\<bullet>X)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>a\" in exI) \napply(rule_tac x=\"pi\\<bullet>b\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fic.eqvt(2))\napply(simp)\napply(rule_tac x=\"<a>:M\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>(<b>:OrR2 <a>.M b)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>b\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp)\napply(drule_tac pi=\"rev pi\" in fic.eqvt(2))\napply(simp)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp)\ndone\n\nnominal_primrec\n  IMPRIGHT :: \"ty \\<Rightarrow> ntrm set \\<Rightarrow> ctrm set \\<Rightarrow> ntrm set \\<Rightarrow> ctrm set \\<Rightarrow> ctrm set\"\nwhere\n \"IMPRIGHT (B IMP C) X Y Z U= \n        { <b>:ImpR (x).<a>.M b | x a b M. fic (ImpR (x).<a>.M b) b \n                                        \\<and> (\\<forall>z P. x\\<sharp>(z,P) \\<and> (z):P \\<in> Z \\<longrightarrow> (x):(M{a:=(z).P}) \\<in> X)\n                                        \\<and> (\\<forall>c Q. a\\<sharp>(c,Q) \\<and> <c>:Q \\<in> U \\<longrightarrow> <a>:(M{x:=<c>.Q}) \\<in> Y)}\"\napply(rule TrueI)+\ndone\n\nlemma IMPRIGHT_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(IMPRIGHT (A IMP B) X Y Z U)) = IMPRIGHT (A IMP B) (pi\\<bullet>X) (pi\\<bullet>Y) (pi\\<bullet>Z) (pi\\<bullet>U)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI)\napply(rule_tac x=\"pi\\<bullet>a\" in exI)\napply(rule_tac x=\"pi\\<bullet>b\" in exI)\napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fic.eqvt(1))\napply(simp)\napply(rule conjI)\napply(auto)[1]\napply(rule_tac x=\"(xb):(M{a:=((rev pi)\\<bullet>z).((rev pi)\\<bullet>P)})\" in exI)\napply(perm_simp add: csubst_eqvt)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp)\napply(simp add: fresh_right)\napply(auto)[1]\napply(rule_tac x=\"<a>:(M{xb:=<((rev pi)\\<bullet>c)>.((rev pi)\\<bullet>Q)})\" in exI)\napply(perm_simp add: nsubst_eqvt)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: swap_simps fresh_left)\napply(rule_tac x=\"(rev pi)\\<bullet>(<b>:ImpR xa.<a>.M b)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>b\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fic.eqvt(1))\napply(simp add: swap_simps)\napply(rule conjI)\napply(auto)[1]\napply(drule_tac x=\"pi\\<bullet>z\" in spec)\napply(drule_tac x=\"pi\\<bullet>P\" in spec)\napply(drule mp)\napply(simp add: fresh_right)\napply(rule_tac x=\"(z):P\" in exI)\napply(simp)\napply(auto)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: csubst_eqvt fresh_right)\napply(auto)[1]\napply(drule_tac x=\"pi\\<bullet>c\" in spec)\napply(drule_tac x=\"pi\\<bullet>Q\" in spec)\napply(drule mp)\napply(simp add: swap_simps fresh_left)\napply(rule_tac x=\"<c>:Q\" in exI)\napply(simp add: swap_simps)\napply(auto)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: nsubst_eqvt)\ndone\n\nlemma IMPRIGHT_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(IMPRIGHT (A IMP B) X Y Z U)) = IMPRIGHT (A IMP B) (pi\\<bullet>X) (pi\\<bullet>Y) (pi\\<bullet>Z) (pi\\<bullet>U)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI)\napply(rule_tac x=\"pi\\<bullet>a\" in exI)\napply(rule_tac x=\"pi\\<bullet>b\" in exI)\napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fic.eqvt(2))\napply(simp)\napply(rule conjI)\napply(auto)[1]\napply(rule_tac x=\"(xb):(M{a:=((rev pi)\\<bullet>z).((rev pi)\\<bullet>P)})\" in exI)\napply(perm_simp add: csubst_eqvt)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: swap_simps fresh_left)\napply(auto)[1]\napply(rule_tac x=\"<a>:(M{xb:=<((rev pi)\\<bullet>c)>.((rev pi)\\<bullet>Q)})\" in exI)\napply(perm_simp add: nsubst_eqvt)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: fresh_right)\napply(rule_tac x=\"(rev pi)\\<bullet>(<b>:ImpR xa.<a>.M b)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>b\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fic.eqvt(2))\napply(simp add: swap_simps)\napply(rule conjI)\napply(auto)[1]\napply(drule_tac x=\"pi\\<bullet>z\" in spec)\napply(drule_tac x=\"pi\\<bullet>P\" in spec)\napply(simp add: swap_simps fresh_left)\napply(drule mp)\napply(rule_tac x=\"(z):P\" in exI)\napply(simp add: swap_simps)\napply(auto)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: csubst_eqvt fresh_right)\napply(auto)[1]\napply(drule_tac x=\"pi\\<bullet>c\" in spec)\napply(drule_tac x=\"pi\\<bullet>Q\" in spec)\napply(simp add: fresh_right)\napply(drule mp)\napply(rule_tac x=\"<c>:Q\" in exI)\napply(simp)\napply(auto)[1]\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: nsubst_eqvt fresh_right)\ndone\n\nnominal_primrec\n  IMPLEFT :: \"ty \\<Rightarrow> ctrm set \\<Rightarrow> ntrm set \\<Rightarrow> ntrm set\"\nwhere\n \"IMPLEFT (B IMP C) X Y = \n        { (y):ImpL <a>.M (x).N y | x a y M N. fin (ImpL <a>.M (x).N y) y \\<and> <a>:M \\<in> X \\<and> (x):N \\<in> Y }\"\napply(rule TrueI)+\ndone\n\nlemma IMPLEFT_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(IMPLEFT (A IMP B) X Y)) = IMPLEFT (A IMP B) (pi\\<bullet>X) (pi\\<bullet>Y)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI) \napply(rule_tac x=\"pi\\<bullet>a\" in exI)\napply(rule_tac x=\"pi\\<bullet>y\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI) \napply(rule_tac x=\"pi\\<bullet>N\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fin.eqvt(1))\napply(simp)\napply(rule conjI)\napply(rule_tac x=\"<a>:M\" in exI)\napply(simp)\napply(rule_tac x=\"(xb):N\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>((y):ImpL <a>.M (xa).N y)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>y\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>N\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fin.eqvt(1))\napply(simp)\napply(drule sym)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: swap_simps)\ndone\n\nlemma IMPLEFT_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(IMPLEFT (A IMP B) X Y)) = IMPLEFT (A IMP B) (pi\\<bullet>X) (pi\\<bullet>Y)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI) \napply(rule_tac x=\"pi\\<bullet>a\" in exI)\napply(rule_tac x=\"pi\\<bullet>y\" in exI) \napply(rule_tac x=\"pi\\<bullet>M\" in exI) \napply(rule_tac x=\"pi\\<bullet>N\" in exI)\napply(simp)\napply(rule conjI)\napply(drule_tac pi=\"pi\" in fin.eqvt(2))\napply(simp)\napply(rule conjI)\napply(rule_tac x=\"<a>:M\" in exI)\napply(simp)\napply(rule_tac x=\"(xb):N\" in exI)\napply(simp)\napply(rule_tac x=\"(rev pi)\\<bullet>((y):ImpL <a>.M (xa).N y)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"(rev pi)\\<bullet>xa\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>a\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>y\" in exI) \napply(rule_tac x=\"(rev pi)\\<bullet>M\" in exI)\napply(rule_tac x=\"(rev pi)\\<bullet>N\" in exI)\napply(simp add: swap_simps)\napply(drule_tac pi=\"rev pi\" in fin.eqvt(2))\napply(simp)\napply(drule sym)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: swap_simps)\ndone\n\nlemma sum_cases:\n shows \"(\\<exists>y. x=Inl y) \\<or> (\\<exists>y. x=Inr y)\"\napply(rule_tac s=\"x\" in sumE)\napply(auto)\ndone\n\nfunction\n  NEGc::\"ty \\<Rightarrow> ntrm set \\<Rightarrow> ctrm set\"\nand\n  NEGn::\"ty \\<Rightarrow> ctrm set \\<Rightarrow> ntrm set\"\nwhere\n  \"NEGc (PR A)    X = AXIOMSc (PR A) \\<union> BINDINGc (PR A) X\"  \n| \"NEGc (NOT C)   X = AXIOMSc (NOT C) \\<union> BINDINGc (NOT C) X \n                         \\<union> NOTRIGHT (NOT C) (lfp (NEGn C \\<circ> NEGc C))\"  \n| \"NEGc (C AND D) X = AXIOMSc (C AND D) \\<union> BINDINGc (C AND D) X \n                     \\<union> ANDRIGHT (C AND D) (NEGc C (lfp (NEGn C \\<circ> NEGc C))) (NEGc D (lfp (NEGn D \\<circ> NEGc D)))\"\n| \"NEGc (C OR D)  X = AXIOMSc (C OR D) \\<union> BINDINGc (C OR D) X  \n                         \\<union> ORRIGHT1 (C OR D) (NEGc C (lfp (NEGn C \\<circ> NEGc C))) \n                         \\<union> ORRIGHT2 (C OR D) (NEGc D (lfp (NEGn D \\<circ> NEGc D)))\"\n| \"NEGc (C IMP D) X = AXIOMSc (C IMP D) \\<union> BINDINGc (C IMP D) X \n    \\<union> IMPRIGHT (C IMP D) (lfp (NEGn C \\<circ> NEGc C)) (NEGc D (lfp (NEGn D \\<circ> NEGc D))) \n                          (lfp (NEGn D \\<circ> NEGc D)) (NEGc C (lfp (NEGn C \\<circ> NEGc C)))\"\n| \"NEGn (PR A)    X = AXIOMSn (PR A) \\<union> BINDINGn (PR A) X\"   \n| \"NEGn (NOT C)   X = AXIOMSn (NOT C) \\<union> BINDINGn (NOT C) X \n                         \\<union> NOTLEFT (NOT C) (NEGc C (lfp (NEGn C \\<circ> NEGc C)))\"  \n| \"NEGn (C AND D) X = AXIOMSn (C AND D) \\<union> BINDINGn (C AND D) X \n                         \\<union> ANDLEFT1 (C AND D) (lfp (NEGn C \\<circ> NEGc C)) \n                         \\<union> ANDLEFT2 (C AND D) (lfp (NEGn D \\<circ> NEGc D))\"\n| \"NEGn (C OR D)  X = AXIOMSn (C OR D) \\<union> BINDINGn (C OR D) X \n                         \\<union> ORLEFT (C OR D) (lfp (NEGn C \\<circ> NEGc C)) (lfp (NEGn D \\<circ> NEGc D))\"\n| \"NEGn (C IMP D) X = AXIOMSn (C IMP D) \\<union> BINDINGn (C IMP D) X \n                         \\<union> IMPLEFT (C IMP D) (NEGc C (lfp (NEGn C \\<circ> NEGc C))) (lfp (NEGn D \\<circ> NEGc D))\"\nusing ty_cases sum_cases \napply(auto simp add: ty.inject)\napply(drule_tac x=\"x\" in meta_spec)\napply(fastforce simp add: ty.inject)\ndone\n\ntermination\napply(relation \"measure (case_sum (size\\<circ>fst) (size\\<circ>fst))\")\napply(simp_all)\ndone\n\ntext \\<open>Candidates\\<close>\n\nlemma test1:\n  shows \"x\\<in>(X\\<union>Y) = (x\\<in>X \\<or> x\\<in>Y)\"\nby blast\n\nlemma test2:\n  shows \"x\\<in>(X\\<inter>Y) = (x\\<in>X \\<and> x\\<in>Y)\"\nby blast\n\nlemma big_inter_eqvt:\n  fixes pi1::\"name prm\"\n  and   X::\"('a::pt_name) set set\"\n  and   pi2::\"coname prm\"\n  and   Y::\"('b::pt_coname) set set\"\n  shows \"(pi1\\<bullet>(\\<Inter>X)) = \\<Inter>(pi1\\<bullet>X)\"\n  and   \"(pi2\\<bullet>(\\<Inter>Y)) = \\<Inter>(pi2\\<bullet>Y)\"\napply(auto simp add: perm_set_def)\napply(rule_tac x=\"(rev pi1)\\<bullet>x\" in exI)\napply(perm_simp)\napply(rule ballI)\napply(drule_tac x=\"pi1\\<bullet>xa\" in spec)\napply(auto)\napply(drule_tac x=\"xa\" in spec)\napply(auto)[1]\napply(rule_tac x=\"(rev pi1)\\<bullet>xb\" in exI)\napply(perm_simp)\napply(simp add: pt_set_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: pt_set_bij[OF pt_name_inst, OF at_name_inst])\napply(simp add: pt_set_bij1[OF pt_name_inst, OF at_name_inst])\napply(rule_tac x=\"(rev pi2)\\<bullet>x\" in exI)\napply(perm_simp)\napply(rule ballI)\napply(drule_tac x=\"pi2\\<bullet>xa\" in spec)\napply(auto)\napply(drule_tac x=\"xa\" in spec)\napply(auto)[1]\napply(rule_tac x=\"(rev pi2)\\<bullet>xb\" in exI)\napply(perm_simp)\napply(simp add: pt_set_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: pt_set_bij[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: pt_set_bij1[OF pt_coname_inst, OF at_coname_inst])\ndone\n\nlemma lfp_eqvt:\n  fixes pi1::\"name prm\"\n  and   f::\"'a set \\<Rightarrow> ('a::pt_name) set\"\n  and   pi2::\"coname prm\"\n  and   g::\"'b set \\<Rightarrow> ('b::pt_coname) set\"\n  shows \"pi1\\<bullet>(lfp f) = lfp (pi1\\<bullet>f)\"\n  and   \"pi2\\<bullet>(lfp g) = lfp (pi2\\<bullet>g)\"\napply(simp add: lfp_def)\napply(simp add: big_inter_eqvt)\napply(simp add: pt_Collect_eqvt[OF pt_name_inst, OF at_name_inst])\napply(subgoal_tac \"{u. (pi1\\<bullet>f) u \\<subseteq> u} = {u. ((rev pi1)\\<bullet>((pi1\\<bullet>f) u)) \\<subseteq> ((rev pi1)\\<bullet>u)}\")\napply(perm_simp)\napply(rule Collect_cong)\napply(rule iffI)\napply(rule subseteq_eqvt(1)[THEN iffD1])\napply(simp add: perm_bool)\napply(drule subseteq_eqvt(1)[THEN iffD2])\napply(simp add: perm_bool)\napply(simp add: lfp_def)\napply(simp add: big_inter_eqvt)\napply(simp add: pt_Collect_eqvt[OF pt_coname_inst, OF at_coname_inst])\napply(subgoal_tac \"{u. (pi2\\<bullet>g) u \\<subseteq> u} = {u. ((rev pi2)\\<bullet>((pi2\\<bullet>g) u)) \\<subseteq> ((rev pi2)\\<bullet>u)}\")\napply(perm_simp)\napply(rule Collect_cong)\napply(rule iffI)\napply(rule subseteq_eqvt(2)[THEN iffD1])\napply(simp add: perm_bool)\napply(drule subseteq_eqvt(2)[THEN iffD2])\napply(simp add: perm_bool)\ndone\n\nabbreviation\n  CANDn::\"ty \\<Rightarrow> ntrm set\"  (\"\\<parallel>'(_')\\<parallel>\" [60] 60) \nwhere\n  \"\\<parallel>(B)\\<parallel> \\<equiv> lfp (NEGn B \\<circ> NEGc B)\" \n\nabbreviation\n  CANDc::\"ty \\<Rightarrow> ctrm set\"  (\"\\<parallel><_>\\<parallel>\" [60] 60)\nwhere\n  \"\\<parallel><B>\\<parallel> \\<equiv> NEGc B (\\<parallel>(B)\\<parallel>)\"\n\nlemma NEGn_decreasing:\n  shows \"X\\<subseteq>Y \\<Longrightarrow> NEGn B Y \\<subseteq> NEGn B X\"\nby (nominal_induct B rule: ty.strong_induct)\n   (auto dest: BINDINGn_decreasing)\n\nlemma NEGc_decreasing:\n  shows \"X\\<subseteq>Y \\<Longrightarrow> NEGc B Y \\<subseteq> NEGc B X\"\nby (nominal_induct B rule: ty.strong_induct)\n   (auto dest: BINDINGc_decreasing)\n\nlemma mono_NEGn_NEGc:\n  shows \"mono (NEGn B \\<circ> NEGc B)\"\n  and   \"mono (NEGc B \\<circ> NEGn B)\"\nproof -\n  have \"\\<forall>X Y. X\\<subseteq>Y \\<longrightarrow> NEGn B (NEGc B X) \\<subseteq> NEGn B (NEGc B Y)\"\n  proof (intro strip)\n    fix X::\"ntrm set\" and Y::\"ntrm set\"\n    assume \"X\\<subseteq>Y\"\n    then have \"NEGc B Y \\<subseteq> NEGc B X\" by (simp add: NEGc_decreasing)\n    then show \"NEGn B (NEGc B X) \\<subseteq> NEGn B (NEGc B Y)\" by (simp add: NEGn_decreasing)\n  qed\n  then show \"mono (NEGn B \\<circ> NEGc B)\" by (simp add: mono_def)\nnext\n  have \"\\<forall>X Y. X\\<subseteq>Y \\<longrightarrow> NEGc B (NEGn B X) \\<subseteq> NEGc B (NEGn B Y)\"\n  proof (intro strip)\n    fix X::\"ctrm set\" and Y::\"ctrm set\"\n    assume \"X\\<subseteq>Y\"\n    then have \"NEGn B Y \\<subseteq> NEGn B X\" by (simp add: NEGn_decreasing)\n    then show \"NEGc B (NEGn B X) \\<subseteq> NEGc B (NEGn B Y)\" by (simp add: NEGc_decreasing)\n  qed\n  then show \"mono (NEGc B \\<circ> NEGn B)\" by (simp add: mono_def)\nqed\n\nlemma NEG_simp:\n  shows \"\\<parallel><B>\\<parallel> = NEGc B (\\<parallel>(B)\\<parallel>)\"\n  and   \"\\<parallel>(B)\\<parallel> = NEGn B (\\<parallel><B>\\<parallel>)\"\nproof -\n  show \"\\<parallel><B>\\<parallel> = NEGc B (\\<parallel>(B)\\<parallel>)\" by simp\nnext\n  have \"\\<parallel>(B)\\<parallel> \\<equiv> lfp (NEGn B \\<circ> NEGc B)\" by simp\n  then have \"\\<parallel>(B)\\<parallel> = (NEGn B \\<circ> NEGc B) (\\<parallel>(B)\\<parallel>)\" using mono_NEGn_NEGc def_lfp_unfold by blast\n  then show \"\\<parallel>(B)\\<parallel> = NEGn B (\\<parallel><B>\\<parallel>)\" by simp\nqed\n\nlemma NEG_elim:\n  shows \"M \\<in> \\<parallel><B>\\<parallel> \\<Longrightarrow> M \\<in> NEGc B (\\<parallel>(B)\\<parallel>)\"\n  and   \"N \\<in> \\<parallel>(B)\\<parallel> \\<Longrightarrow> N \\<in> NEGn B (\\<parallel><B>\\<parallel>)\"\nusing NEG_simp by (blast)+\n\nlemma NEG_intro:\n  shows \"M \\<in> NEGc B (\\<parallel>(B)\\<parallel>) \\<Longrightarrow> M \\<in> \\<parallel><B>\\<parallel>\"\n  and   \"N \\<in> NEGn B (\\<parallel><B>\\<parallel>) \\<Longrightarrow> N \\<in> \\<parallel>(B)\\<parallel>\"\nusing NEG_simp by (blast)+\n\nlemma NEGc_simps:\n  shows \"NEGc (PR A) (\\<parallel>(PR A)\\<parallel>) = AXIOMSc (PR A) \\<union> BINDINGc (PR A) (\\<parallel>(PR A)\\<parallel>)\"  \n  and   \"NEGc (NOT C) (\\<parallel>(NOT C)\\<parallel>) = AXIOMSc (NOT C) \\<union> BINDINGc (NOT C) (\\<parallel>(NOT C)\\<parallel>) \n                                        \\<union> (NOTRIGHT (NOT C) (\\<parallel>(C)\\<parallel>))\"  \n  and   \"NEGc (C AND D) (\\<parallel>(C AND D)\\<parallel>) = AXIOMSc (C AND D) \\<union> BINDINGc (C AND D) (\\<parallel>(C AND D)\\<parallel>) \n                                        \\<union> (ANDRIGHT (C AND D) (\\<parallel><C>\\<parallel>) (\\<parallel><D>\\<parallel>))\"\n  and   \"NEGc (C OR D) (\\<parallel>(C OR D)\\<parallel>) = AXIOMSc (C OR D) \\<union> BINDINGc (C OR D)  (\\<parallel>(C OR D)\\<parallel>)\n                                        \\<union> (ORRIGHT1 (C OR D) (\\<parallel><C>\\<parallel>)) \\<union> (ORRIGHT2 (C OR D) (\\<parallel><D>\\<parallel>))\"\n  and   \"NEGc (C IMP D) (\\<parallel>(C IMP D)\\<parallel>) = AXIOMSc (C IMP D) \\<union> BINDINGc (C IMP D) (\\<parallel>(C IMP D)\\<parallel>) \n          \\<union> (IMPRIGHT (C IMP D) (\\<parallel>(C)\\<parallel>) (\\<parallel><D>\\<parallel>) (\\<parallel>(D)\\<parallel>) (\\<parallel><C>\\<parallel>))\"\nby (simp_all only: NEGc.simps)\n\nlemma AXIOMS_in_CANDs:\n  shows \"AXIOMSn B \\<subseteq> (\\<parallel>(B)\\<parallel>)\"\n  and   \"AXIOMSc B \\<subseteq> (\\<parallel><B>\\<parallel>)\"\nproof -\n  have \"AXIOMSn B \\<subseteq> NEGn B (\\<parallel><B>\\<parallel>)\"\n    by (nominal_induct B rule: ty.strong_induct) (auto)\n  then show \"AXIOMSn B \\<subseteq> \\<parallel>(B)\\<parallel>\" using NEG_simp by blast\nnext\n  have \"AXIOMSc B \\<subseteq> NEGc B (\\<parallel>(B)\\<parallel>)\"\n    by (nominal_induct B rule: ty.strong_induct) (auto)\n  then show \"AXIOMSc B \\<subseteq> \\<parallel><B>\\<parallel>\" using NEG_simp by blast\nqed\n\nlemma Ax_in_CANDs:\n  shows \"(y):Ax x a \\<in> \\<parallel>(B)\\<parallel>\"\n  and   \"<b>:Ax x a \\<in> \\<parallel><B>\\<parallel>\"\nproof -\n  have \"(y):Ax x a \\<in> AXIOMSn B\" by (auto simp add: AXIOMSn_def)\n  also have \"AXIOMSn B \\<subseteq> \\<parallel>(B)\\<parallel>\" by (rule AXIOMS_in_CANDs)\n  finally show \"(y):Ax x a \\<in> \\<parallel>(B)\\<parallel>\" by simp\nnext\n  have \"<b>:Ax x a \\<in> AXIOMSc B\" by (auto simp add: AXIOMSc_def)\n  also have \"AXIOMSc B \\<subseteq> \\<parallel><B>\\<parallel>\" by (rule AXIOMS_in_CANDs)\n  finally show \"<b>:Ax x a \\<in> \\<parallel><B>\\<parallel>\" by simp\nqed\n\nlemma AXIOMS_eqvt_aux_name:\n  fixes pi::\"name prm\"\n  shows \"M \\<in> AXIOMSn B \\<Longrightarrow> (pi\\<bullet>M) \\<in> AXIOMSn B\" \n  and   \"N \\<in> AXIOMSc B \\<Longrightarrow> (pi\\<bullet>N) \\<in> AXIOMSc B\"\napply(auto simp add: AXIOMSn_def AXIOMSc_def)\napply(rule_tac x=\"pi\\<bullet>x\" in exI)\napply(rule_tac x=\"pi\\<bullet>y\" in exI)\napply(rule_tac x=\"pi\\<bullet>b\" in exI)\napply(simp)\napply(rule_tac x=\"pi\\<bullet>a\" in exI)\napply(rule_tac x=\"pi\\<bullet>y\" in exI)\napply(rule_tac x=\"pi\\<bullet>b\" in exI)\napply(simp)\ndone\n\nlemma AXIOMS_eqvt_aux_coname:\n  fixes pi::\"coname prm\"\n  shows \"M \\<in> AXIOMSn B \\<Longrightarrow> (pi\\<bullet>M) \\<in> AXIOMSn B\" \n  and   \"N \\<in> AXIOMSc B \\<Longrightarrow> (pi\\<bullet>N) \\<in> AXIOMSc B\"\napply(auto simp add: AXIOMSn_def AXIOMSc_def)\napply(rule_tac x=\"pi\\<bullet>x\" in exI)\napply(rule_tac x=\"pi\\<bullet>y\" in exI)\napply(rule_tac x=\"pi\\<bullet>b\" in exI)\napply(simp)\napply(rule_tac x=\"pi\\<bullet>a\" in exI)\napply(rule_tac x=\"pi\\<bullet>y\" in exI)\napply(rule_tac x=\"pi\\<bullet>b\" in exI)\napply(simp)\ndone\n\nlemma AXIOMS_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>AXIOMSn B) = AXIOMSn B\" \n  and   \"(pi\\<bullet>AXIOMSc B) = AXIOMSc B\"\napply(auto)\napply(simp add: pt_set_bij1a[OF pt_name_inst, OF at_name_inst])\napply(drule_tac pi=\"pi\" in AXIOMS_eqvt_aux_name(1))\napply(perm_simp)\napply(drule_tac pi=\"rev pi\" in AXIOMS_eqvt_aux_name(1))\napply(simp add: pt_set_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp add: pt_set_bij1a[OF pt_name_inst, OF at_name_inst])\napply(drule_tac pi=\"pi\" in AXIOMS_eqvt_aux_name(2))\napply(perm_simp)\napply(drule_tac pi=\"rev pi\" in AXIOMS_eqvt_aux_name(2))\napply(simp add: pt_set_bij1[OF pt_name_inst, OF at_name_inst])\ndone\n\nlemma AXIOMS_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>AXIOMSn B) = AXIOMSn B\" \n  and   \"(pi\\<bullet>AXIOMSc B) = AXIOMSc B\"\napply(auto)\napply(simp add: pt_set_bij1a[OF pt_coname_inst, OF at_coname_inst])\napply(drule_tac pi=\"pi\" in AXIOMS_eqvt_aux_coname(1))\napply(perm_simp)\napply(drule_tac pi=\"rev pi\" in AXIOMS_eqvt_aux_coname(1))\napply(simp add: pt_set_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: pt_set_bij1a[OF pt_coname_inst, OF at_coname_inst])\napply(drule_tac pi=\"pi\" in AXIOMS_eqvt_aux_coname(2))\napply(perm_simp)\napply(drule_tac pi=\"rev pi\" in AXIOMS_eqvt_aux_coname(2))\napply(simp add: pt_set_bij1[OF pt_coname_inst, OF at_coname_inst])\ndone\n\nlemma BINDING_eqvt_name:\n  fixes pi::\"name prm\"\n  shows \"(pi\\<bullet>(BINDINGn B X)) = BINDINGn B (pi\\<bullet>X)\" \n  and   \"(pi\\<bullet>(BINDINGc B Y)) = BINDINGc B (pi\\<bullet>Y)\" \napply(auto simp add: BINDINGn_def BINDINGc_def perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI)\napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"(rev pi)\\<bullet>a\" in spec)\napply(drule_tac x=\"(rev pi)\\<bullet>P\" in spec)\napply(drule mp)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp)\napply(drule_tac ?pi1.0=\"pi\" in SNa_eqvt(1))\napply(perm_simp add: nsubst_eqvt)\napply(rule_tac x=\"(rev pi\\<bullet>xa):(rev pi\\<bullet>M)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"rev pi\\<bullet>xa\" in exI)\napply(rule_tac x=\"rev pi\\<bullet>M\" in exI)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"pi\\<bullet>a\" in spec)\napply(drule_tac x=\"pi\\<bullet>P\" in spec)\napply(drule mp)\napply(force)\napply(drule_tac ?pi1.0=\"rev pi\" in SNa_eqvt(1))\napply(perm_simp add: nsubst_eqvt)\napply(rule_tac x=\"pi\\<bullet>a\" in exI)\napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"(rev pi)\\<bullet>x\" in spec)\napply(drule_tac x=\"(rev pi)\\<bullet>P\" in spec)\napply(drule mp)\napply(drule sym)\napply(drule pt_bij1[OF pt_name_inst, OF at_name_inst])\napply(simp)\napply(drule_tac ?pi1.0=\"pi\" in SNa_eqvt(1))\napply(perm_simp add: csubst_eqvt)\napply(rule_tac x=\"<(rev pi\\<bullet>a)>:(rev pi\\<bullet>M)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"rev pi\\<bullet>a\" in exI)\napply(rule_tac x=\"rev pi\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(auto)[1]\napply(drule_tac x=\"pi\\<bullet>x\" in spec)\napply(drule_tac x=\"pi\\<bullet>P\" in spec)\napply(drule mp)\napply(force)\napply(drule_tac ?pi1.0=\"rev pi\" in SNa_eqvt(1))\napply(perm_simp add: csubst_eqvt)\ndone\n\nlemma BINDING_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows \"(pi\\<bullet>(BINDINGn B X)) = BINDINGn B (pi\\<bullet>X)\" \n  and   \"(pi\\<bullet>(BINDINGc B Y)) = BINDINGc B (pi\\<bullet>Y)\" \napply(auto simp add: BINDINGn_def BINDINGc_def perm_set_def)\napply(rule_tac x=\"pi\\<bullet>xb\" in exI)\napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"(rev pi)\\<bullet>a\" in spec)\napply(drule_tac x=\"(rev pi)\\<bullet>P\" in spec)\napply(drule mp)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp)\napply(drule_tac ?pi2.0=\"pi\" in SNa_eqvt(2))\napply(perm_simp add: nsubst_eqvt)\napply(rule_tac x=\"(rev pi\\<bullet>xa):(rev pi\\<bullet>M)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"rev pi\\<bullet>xa\" in exI)\napply(rule_tac x=\"rev pi\\<bullet>M\" in exI)\napply(simp add: swap_simps)\napply(auto)[1]\napply(drule_tac x=\"pi\\<bullet>a\" in spec)\napply(drule_tac x=\"pi\\<bullet>P\" in spec)\napply(drule mp)\napply(force)\napply(drule_tac ?pi2.0=\"rev pi\" in SNa_eqvt(2))\napply(perm_simp add: nsubst_eqvt)\napply(rule_tac x=\"pi\\<bullet>a\" in exI)\napply(rule_tac x=\"pi\\<bullet>M\" in exI)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"(rev pi)\\<bullet>x\" in spec)\napply(drule_tac x=\"(rev pi)\\<bullet>P\" in spec)\napply(drule mp)\napply(drule sym)\napply(drule pt_bij1[OF pt_coname_inst, OF at_coname_inst])\napply(simp)\napply(drule_tac ?pi2.0=\"pi\" in SNa_eqvt(2))\napply(perm_simp add: csubst_eqvt)\napply(rule_tac x=\"<(rev pi\\<bullet>a)>:(rev pi\\<bullet>M)\" in exI)\napply(perm_simp)\napply(rule_tac x=\"rev pi\\<bullet>a\" in exI)\napply(rule_tac x=\"rev pi\\<bullet>M\" in exI)\napply(simp)\napply(auto)[1]\napply(drule_tac x=\"pi\\<bullet>x\" in spec)\napply(drule_tac x=\"pi\\<bullet>P\" in spec)\napply(drule mp)\napply(force)\napply(drule_tac ?pi2.0=\"rev pi\" in SNa_eqvt(2))\napply(perm_simp add: csubst_eqvt)\ndone\n\nlemma CAND_eqvt_name:\n  fixes pi::\"name prm\"\n  shows   \"(pi\\<bullet>(\\<parallel>(B)\\<parallel>)) = (\\<parallel>(B)\\<parallel>)\"\n  and     \"(pi\\<bullet>(\\<parallel><B>\\<parallel>)) = (\\<parallel><B>\\<parallel>)\"\nproof (nominal_induct B rule: ty.strong_induct)\n  case (PR X)\n  { case 1 show ?case \n      apply -\n      apply(simp add: lfp_eqvt)\n      apply(simp add: perm_fun_def)\n      apply(simp add: union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name)\n      apply(perm_simp)\n    done\n  next\n    case 2 show ?case\n      apply -\n      apply(simp only: NEGc_simps)\n      apply(simp add: union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name)\n      apply(simp add: lfp_eqvt)\n      apply(simp add: comp_def)\n      apply(simp add: perm_fun_def)\n      apply(simp add: union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name)\n      apply(perm_simp)\n      done\n  }\nnext\n  case (NOT B)\n  have ih1: \"pi\\<bullet>(\\<parallel>(B)\\<parallel>) = (\\<parallel>(B)\\<parallel>)\" by fact\n  have ih2: \"pi\\<bullet>(\\<parallel><B>\\<parallel>) = (\\<parallel><B>\\<parallel>)\" by fact\n  have g: \"pi\\<bullet>(\\<parallel>(NOT B)\\<parallel>) = (\\<parallel>(NOT B)\\<parallel>)\"\n    apply -\n    apply(simp only: lfp_eqvt)\n    apply(simp only: comp_def)\n    apply(simp only: perm_fun_def)\n    apply(simp only: NEGc.simps NEGn.simps)\n    apply(simp only: union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name NOTRIGHT_eqvt_name NOTLEFT_eqvt_name)\n    apply(perm_simp add: ih1 ih2)\n    done\n  { case 1 show ?case by (rule g)\n  next \n    case 2 show ?case\n      by (simp only: NEGc_simps union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name NOTRIGHT_eqvt_name ih1 ih2 g)\n  }\nnext\n  case (AND A B)\n  have ih1: \"pi\\<bullet>(\\<parallel>(A)\\<parallel>) = (\\<parallel>(A)\\<parallel>)\" by fact\n  have ih2: \"pi\\<bullet>(\\<parallel><A>\\<parallel>) = (\\<parallel><A>\\<parallel>)\" by fact\n  have ih3: \"pi\\<bullet>(\\<parallel>(B)\\<parallel>) = (\\<parallel>(B)\\<parallel>)\" by fact\n  have ih4: \"pi\\<bullet>(\\<parallel><B>\\<parallel>) = (\\<parallel><B>\\<parallel>)\" by fact\n  have g: \"pi\\<bullet>(\\<parallel>(A AND B)\\<parallel>) = (\\<parallel>(A AND B)\\<parallel>)\"\n    apply -\n    apply(simp only: lfp_eqvt)\n    apply(simp only: comp_def)\n    apply(simp only: perm_fun_def)\n    apply(simp only: NEGc.simps NEGn.simps)\n    apply(simp only: union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name ANDRIGHT_eqvt_name \n                     ANDLEFT2_eqvt_name ANDLEFT1_eqvt_name)\n    apply(perm_simp add: ih1 ih2 ih3 ih4)\n    done\n  { case 1 show ?case by (rule g)\n  next \n    case 2 show ?case\n      by (simp only: NEGc_simps union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name \n                     ANDRIGHT_eqvt_name ANDLEFT1_eqvt_name ANDLEFT2_eqvt_name ih1 ih2 ih3 ih4 g)\n  }\nnext\n  case (OR A B)\n  have ih1: \"pi\\<bullet>(\\<parallel>(A)\\<parallel>) = (\\<parallel>(A)\\<parallel>)\" by fact\n  have ih2: \"pi\\<bullet>(\\<parallel><A>\\<parallel>) = (\\<parallel><A>\\<parallel>)\" by fact\n  have ih3: \"pi\\<bullet>(\\<parallel>(B)\\<parallel>) = (\\<parallel>(B)\\<parallel>)\" by fact\n  have ih4: \"pi\\<bullet>(\\<parallel><B>\\<parallel>) = (\\<parallel><B>\\<parallel>)\" by fact\n  have g: \"pi\\<bullet>(\\<parallel>(A OR B)\\<parallel>) = (\\<parallel>(A OR B)\\<parallel>)\"\n    apply -\n    apply(simp only: lfp_eqvt)\n    apply(simp only: comp_def)\n    apply(simp only: perm_fun_def)\n    apply(simp only: NEGc.simps NEGn.simps)\n    apply(simp only: union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name ORRIGHT1_eqvt_name \n                     ORRIGHT2_eqvt_name ORLEFT_eqvt_name)\n    apply(perm_simp add: ih1 ih2 ih3 ih4)\n    done\n  { case 1 show ?case by (rule g)\n  next \n    case 2 show ?case\n      by (simp only: NEGc_simps union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name \n                     ORRIGHT1_eqvt_name ORRIGHT2_eqvt_name ORLEFT_eqvt_name ih1 ih2 ih3 ih4 g)\n  }\nnext\n  case (IMP A B)\n  have ih1: \"pi\\<bullet>(\\<parallel>(A)\\<parallel>) = (\\<parallel>(A)\\<parallel>)\" by fact\n  have ih2: \"pi\\<bullet>(\\<parallel><A>\\<parallel>) = (\\<parallel><A>\\<parallel>)\" by fact\n  have ih3: \"pi\\<bullet>(\\<parallel>(B)\\<parallel>) = (\\<parallel>(B)\\<parallel>)\" by fact\n  have ih4: \"pi\\<bullet>(\\<parallel><B>\\<parallel>) = (\\<parallel><B>\\<parallel>)\" by fact\n  have g: \"pi\\<bullet>(\\<parallel>(A IMP B)\\<parallel>) = (\\<parallel>(A IMP B)\\<parallel>)\"\n    apply -\n    apply(simp only: lfp_eqvt)\n    apply(simp only: comp_def)\n    apply(simp only: perm_fun_def)\n    apply(simp only: NEGc.simps NEGn.simps)\n    apply(simp only: union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name IMPRIGHT_eqvt_name IMPLEFT_eqvt_name)\n    apply(perm_simp add: ih1 ih2 ih3 ih4)\n    done\n  { case 1 show ?case by (rule g)\n  next \n    case 2 show ?case\n      by (simp only: NEGc_simps union_eqvt AXIOMS_eqvt_name BINDING_eqvt_name \n                     IMPRIGHT_eqvt_name IMPLEFT_eqvt_name ih1 ih2 ih3 ih4 g)\n  }\nqed\n\nlemma CAND_eqvt_coname:\n  fixes pi::\"coname prm\"\n  shows   \"(pi\\<bullet>(\\<parallel>(B)\\<parallel>)) = (\\<parallel>(B)\\<parallel>)\"\n  and     \"(pi\\<bullet>(\\<parallel><B>\\<parallel>)) = (\\<parallel><B>\\<parallel>)\"\nproof (nominal_induct B rule: ty.strong_induct)\n  case (PR X)\n  { case 1 show ?case \n      apply -\n      apply(simp add: lfp_eqvt)\n      apply(simp add: perm_fun_def)\n      apply(simp add: union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname)\n      apply(perm_simp)\n    done\n  next\n    case 2 show ?case\n      apply -\n      apply(simp only: NEGc_simps)\n      apply(simp add: union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname)\n      apply(simp add: lfp_eqvt)\n      apply(simp add: comp_def)\n      apply(simp add: perm_fun_def)\n      apply(simp add: union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname)\n      apply(perm_simp)\n      done\n  }\nnext\n  case (NOT B)\n  have ih1: \"pi\\<bullet>(\\<parallel>(B)\\<parallel>) = (\\<parallel>(B)\\<parallel>)\" by fact\n  have ih2: \"pi\\<bullet>(\\<parallel><B>\\<parallel>) = (\\<parallel><B>\\<parallel>)\" by fact\n  have g: \"pi\\<bullet>(\\<parallel>(NOT B)\\<parallel>) = (\\<parallel>(NOT B)\\<parallel>)\"\n    apply -\n    apply(simp only: lfp_eqvt)\n    apply(simp only: comp_def)\n    apply(simp only: perm_fun_def)\n    apply(simp only: NEGc.simps NEGn.simps)\n    apply(simp only: union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname \n            NOTRIGHT_eqvt_coname NOTLEFT_eqvt_coname)\n    apply(perm_simp add: ih1 ih2)\n    done\n  { case 1 show ?case by (rule g)\n  next \n    case 2 show ?case\n      by (simp only: NEGc_simps union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname \n              NOTRIGHT_eqvt_coname ih1 ih2 g)\n  }\nnext\n  case (AND A B)\n  have ih1: \"pi\\<bullet>(\\<parallel>(A)\\<parallel>) = (\\<parallel>(A)\\<parallel>)\" by fact\n  have ih2: \"pi\\<bullet>(\\<parallel><A>\\<parallel>) = (\\<parallel><A>\\<parallel>)\" by fact\n  have ih3: \"pi\\<bullet>(\\<parallel>(B)\\<parallel>) = (\\<parallel>(B)\\<parallel>)\" by fact\n  have ih4: \"pi\\<bullet>(\\<parallel><B>\\<parallel>) = (\\<parallel><B>\\<parallel>)\" by fact\n  have g: \"pi\\<bullet>(\\<parallel>(A AND B)\\<parallel>) = (\\<parallel>(A AND B)\\<parallel>)\"\n    apply -\n    apply(simp only: lfp_eqvt)\n    apply(simp only: comp_def)\n    apply(simp only: perm_fun_def)\n    apply(simp only: NEGc.simps NEGn.simps)\n    apply(simp only: union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname ANDRIGHT_eqvt_coname \n                     ANDLEFT2_eqvt_coname ANDLEFT1_eqvt_coname)\n    apply(perm_simp add: ih1 ih2 ih3 ih4)\n    done\n  { case 1 show ?case by (rule g)\n  next \n    case 2 show ?case\n      by (simp only: NEGc_simps union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname \n                     ANDRIGHT_eqvt_coname ANDLEFT1_eqvt_coname ANDLEFT2_eqvt_coname ih1 ih2 ih3 ih4 g)\n  }\nnext\n  case (OR A B)\n  have ih1: \"pi\\<bullet>(\\<parallel>(A)\\<parallel>) = (\\<parallel>(A)\\<parallel>)\" by fact\n  have ih2: \"pi\\<bullet>(\\<parallel><A>\\<parallel>) = (\\<parallel><A>\\<parallel>)\" by fact\n  have ih3: \"pi\\<bullet>(\\<parallel>(B)\\<parallel>) = (\\<parallel>(B)\\<parallel>)\" by fact\n  have ih4: \"pi\\<bullet>(\\<parallel><B>\\<parallel>) = (\\<parallel><B>\\<parallel>)\" by fact\n  have g: \"pi\\<bullet>(\\<parallel>(A OR B)\\<parallel>) = (\\<parallel>(A OR B)\\<parallel>)\"\n    apply -\n    apply(simp only: lfp_eqvt)\n    apply(simp only: comp_def)\n    apply(simp only: perm_fun_def)\n    apply(simp only: NEGc.simps NEGn.simps)\n    apply(simp only: union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname ORRIGHT1_eqvt_coname \n                     ORRIGHT2_eqvt_coname ORLEFT_eqvt_coname)\n    apply(perm_simp add: ih1 ih2 ih3 ih4)\n    done\n  { case 1 show ?case by (rule g)\n  next \n    case 2 show ?case\n      by (simp only: NEGc_simps union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname \n                     ORRIGHT1_eqvt_coname ORRIGHT2_eqvt_coname ORLEFT_eqvt_coname ih1 ih2 ih3 ih4 g)\n  }\nnext\n  case (IMP A B)\n  have ih1: \"pi\\<bullet>(\\<parallel>(A)\\<parallel>) = (\\<parallel>(A)\\<parallel>)\" by fact\n  have ih2: \"pi\\<bullet>(\\<parallel><A>\\<parallel>) = (\\<parallel><A>\\<parallel>)\" by fact\n  have ih3: \"pi\\<bullet>(\\<parallel>(B)\\<parallel>) = (\\<parallel>(B)\\<parallel>)\" by fact\n  have ih4: \"pi\\<bullet>(\\<parallel><B>\\<parallel>) = (\\<parallel><B>\\<parallel>)\" by fact\n  have g: \"pi\\<bullet>(\\<parallel>(A IMP B)\\<parallel>) = (\\<parallel>(A IMP B)\\<parallel>)\"\n    apply -\n    apply(simp only: lfp_eqvt)\n    apply(simp only: comp_def)\n    apply(simp only: perm_fun_def)\n    apply(simp only: NEGc.simps NEGn.simps)\n    apply(simp only: union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname IMPRIGHT_eqvt_coname \n         IMPLEFT_eqvt_coname)\n    apply(perm_simp add: ih1 ih2 ih3 ih4)\n    done\n  { case 1 show ?case by (rule g)\n  next \n    case 2 show ?case\n      by (simp only: NEGc_simps union_eqvt AXIOMS_eqvt_coname BINDING_eqvt_coname \n                     IMPRIGHT_eqvt_coname IMPLEFT_eqvt_coname ih1 ih2 ih3 ih4 g)\n  }\nqed\n\ntext \\<open>Elimination rules for the set-operators\\<close>\n\nlemma BINDINGc_elim:\n  assumes a: \"<a>:M \\<in> BINDINGc B (\\<parallel>(B)\\<parallel>)\"\n  shows \"\\<forall>x P. ((x):P)\\<in>(\\<parallel>(B)\\<parallel>) \\<longrightarrow> SNa (M{a:=(x).P})\"\nusing a\napply(auto simp add: BINDINGc_def)\napply(auto simp add: ctrm.inject alpha)\napply(drule_tac x=\"[(a,aa)]\\<bullet>x\" in spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>P\" in spec)\napply(drule mp)\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname)\napply(drule_tac ?pi2.0=\"[(a,aa)]\" in SNa_eqvt(2))\napply(perm_simp add: csubst_eqvt)\ndone\n\nlemma BINDINGn_elim:\n  assumes a: \"(x):M \\<in> BINDINGn B (\\<parallel><B>\\<parallel>)\"\n  shows \"\\<forall>c P. (<c>:P)\\<in>(\\<parallel><B>\\<parallel>) \\<longrightarrow> SNa (M{x:=<c>.P})\"\nusing a\napply(auto simp add: BINDINGn_def)\napply(auto simp add: ntrm.inject alpha)\napply(drule_tac x=\"[(x,xa)]\\<bullet>c\" in spec)\napply(drule_tac x=\"[(x,xa)]\\<bullet>P\" in spec)\napply(drule mp)\napply(drule_tac pi=\"[(x,xa)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name)\napply(drule_tac ?pi1.0=\"[(x,xa)]\" in SNa_eqvt(1))\napply(perm_simp add: nsubst_eqvt)\ndone\n\nlemma NOTRIGHT_elim:\n  assumes a: \"<a>:M \\<in> NOTRIGHT (NOT B) (\\<parallel>(B)\\<parallel>)\"\n  obtains x' M' where \"M = NotR (x').M' a\" and \"fic (NotR (x').M' a) a\" and \"(x'):M' \\<in> (\\<parallel>(B)\\<parallel>)\"\nusing a\napply(auto simp add: ctrm.inject alpha abs_fresh calc_atm)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\ndone\n\nlemma NOTLEFT_elim:\n  assumes a: \"(x):M \\<in> NOTLEFT (NOT B) (\\<parallel><B>\\<parallel>)\"\n  obtains a' M' where \"M = NotL <a'>.M' x\" and \"fin (NotL <a'>.M' x) x\" and \"<a'>:M' \\<in> (\\<parallel><B>\\<parallel>)\"\nusing a\napply(auto simp add: ntrm.inject alpha abs_fresh calc_atm)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(x,xa)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\ndone\n\nlemma ANDRIGHT_elim:\n  assumes a: \"<a>:M \\<in> ANDRIGHT (B AND C) (\\<parallel><B>\\<parallel>) (\\<parallel><C>\\<parallel>)\"\n  obtains d' M' e' N' where \"M = AndR <d'>.M' <e'>.N' a\" and \"fic (AndR <d'>.M' <e'>.N' a) a\" \n                      and \"<d'>:M' \\<in> (\\<parallel><B>\\<parallel>)\" and \"<e'>:N' \\<in> (\\<parallel><C>\\<parallel>)\"\nusing a\napply(auto simp add: ctrm.inject alpha abs_fresh calc_atm fresh_atm)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(a,c)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(a,c)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" and x=\"<a>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(case_tac \"a=b\")\napply(simp)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(b,c)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(b,c)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,c)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,c)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,c)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(case_tac \"c=b\")\napply(simp)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(a,c)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(a,c)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(case_tac \"a=aa\")\napply(simp)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(aa,c)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(aa,c)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,c)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,c)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,c)]\" and x=\"<aa>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(case_tac \"c=aa\")\napply(simp)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" and x=\"<a>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"[(a,c)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(a,c)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" and x=\"<a>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(case_tac \"a=aa\")\napply(simp)\napply(case_tac \"aa=b\")\napply(simp)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(b,c)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(b,c)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,c)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,c)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,c)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(case_tac \"c=b\")\napply(simp)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(aa,b)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"[(aa,b)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,b)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(aa,c)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(aa,c)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,c)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,c)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,c)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(case_tac \"c=aa\")\napply(simp)\napply(case_tac \"a=b\")\napply(simp)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(b,aa)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"[(b,aa)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,aa)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,aa)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(case_tac \"aa=b\")\napply(simp)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(case_tac \"a=b\")\napply(simp)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"[(b,c)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"c\" in meta_spec)\napply(drule_tac x=\"[(b,c)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,c)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,c)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(b,c)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(case_tac \"c=b\")\napply(simp)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"[(a,c)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(a,c)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,c)]\" and x=\"<b>:N\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\ndone \n\nlemma ANDLEFT1_elim:\n  assumes a: \"(x):M \\<in> ANDLEFT1 (B AND C) (\\<parallel>(B)\\<parallel>)\"\n  obtains x' M' where \"M = AndL1 (x').M' x\" and \"fin (AndL1 (x').M' x) x\" and \"(x'):M' \\<in> (\\<parallel>(B)\\<parallel>)\"\nusing a [[ hypsubst_thin = true ]]\napply(auto simp add: ntrm.inject alpha abs_fresh calc_atm)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>M\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(case_tac \"x=xa\")\napply(simp)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(xa,y)]\\<bullet>M\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(case_tac \"y=xa\")\napply(simp)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"[(x,xa)]\\<bullet>M\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>M\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\ndone\n\nlemma ANDLEFT2_elim:\n  assumes a: \"(x):M \\<in> ANDLEFT2 (B AND C) (\\<parallel>(C)\\<parallel>)\"\n  obtains x' M' where \"M = AndL2 (x').M' x\" and \"fin (AndL2 (x').M' x) x\" and \"(x'):M' \\<in> (\\<parallel>(C)\\<parallel>)\"\nusing a [[ hypsubst_thin = true ]]\napply(auto simp add: ntrm.inject alpha abs_fresh calc_atm)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>M\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(case_tac \"x=xa\")\napply(simp)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(xa,y)]\\<bullet>M\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(case_tac \"y=xa\")\napply(simp)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"[(x,xa)]\\<bullet>M\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>M\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\ndone\n\nlemma ORRIGHT1_elim:\n  assumes a: \"<a>:M \\<in> ORRIGHT1 (B OR C) (\\<parallel><B>\\<parallel>)\"\n  obtains a' M' where \"M = OrR1 <a'>.M' a\" and \"fic (OrR1 <a'>.M' a) a\" and \"<a'>:M' \\<in> (\\<parallel><B>\\<parallel>)\"\nusing a\napply(auto simp add: ctrm.inject alpha abs_fresh calc_atm)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(case_tac \"a=aa\")\napply(simp)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(aa,b)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(case_tac \"b=aa\")\napply(simp)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\ndone\n\nlemma ORRIGHT2_elim:\n  assumes a: \"<a>:M \\<in> ORRIGHT2 (B OR C) (\\<parallel><C>\\<parallel>)\"\n  obtains a' M' where \"M = OrR2 <a'>.M' a\" and \"fic (OrR2 <a'>.M' a) a\" and \"<a'>:M' \\<in> (\\<parallel><C>\\<parallel>)\"\nusing a\napply(auto simp add: ctrm.inject alpha abs_fresh calc_atm)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(case_tac \"a=aa\")\napply(simp)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(aa,b)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(case_tac \"b=aa\")\napply(simp)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\napply(simp)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(simp)\ndone\n\nlemma ORLEFT_elim:\n  assumes a: \"(x):M \\<in> ORLEFT (B OR C) (\\<parallel>(B)\\<parallel>) (\\<parallel>(C)\\<parallel>)\"\n  obtains y' M' z' N' where \"M = OrL (y').M' (z').N' x\" and \"fin (OrL (y').M' (z').N' x) x\" \n                      and \"(y'):M' \\<in> (\\<parallel>(B)\\<parallel>)\" and \"(z'):N' \\<in> (\\<parallel>(C)\\<parallel>)\"\nusing a\napply(auto simp add: ntrm.inject alpha abs_fresh calc_atm fresh_atm)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(x,z)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(x,z)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" and x=\"(x):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(case_tac \"x=y\")\napply(simp)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(y,z)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(y,z)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,z)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,z)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,z)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(case_tac \"z=y\")\napply(simp)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(x,z)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(x,z)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(case_tac \"x=xa\")\napply(simp)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(xa,z)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(xa,z)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,z)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,z)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,z)]\" and x=\"(xa):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(case_tac \"z=xa\")\napply(simp)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"[(x,xa)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"[(x,xa)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" and x=\"(x):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"[(x,z)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(x,z)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" and x=\"(x):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(case_tac \"x=xa\")\napply(simp)\napply(case_tac \"xa=y\")\napply(simp)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(y,z)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(y,z)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,z)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,z)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,z)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(case_tac \"z=y\")\napply(simp)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(xa,y)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"[(xa,y)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,y)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(xa,z)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(xa,z)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,z)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,z)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,z)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(case_tac \"z=xa\")\napply(simp)\napply(case_tac \"x=y\")\napply(simp)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(y,xa)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"[(y,xa)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,xa)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,xa)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,xa)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(case_tac \"xa=y\")\napply(simp)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"[(x,xa)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(x,xa)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(case_tac \"x=y\")\napply(simp)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"[(y,z)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"z\" in meta_spec)\napply(drule_tac x=\"[(y,z)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,z)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,z)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(y,z)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(case_tac \"z=y\")\napply(simp)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"[(x,z)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(x,z)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,z)]\" and x=\"(y):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\ndone\n\nlemma IMPRIGHT_elim:\n  assumes a: \"<a>:M \\<in> IMPRIGHT (B IMP C) (\\<parallel>(B)\\<parallel>) (\\<parallel><C>\\<parallel>) (\\<parallel>(C)\\<parallel>) (\\<parallel><B>\\<parallel>)\"\n  obtains x' a' M' where \"M = ImpR (x').<a'>.M' a\" and \"fic (ImpR (x').<a'>.M' a) a\" \n                   and \"\\<forall>z P. x'\\<sharp>(z,P) \\<and> (z):P \\<in> \\<parallel>(C)\\<parallel> \\<longrightarrow> (x'):(M'{a':=(z).P}) \\<in> \\<parallel>(B)\\<parallel>\" \n                   and \"\\<forall>c Q. a'\\<sharp>(c,Q) \\<and> <c>:Q \\<in> \\<parallel><B>\\<parallel> \\<longrightarrow> <a'>:(M'{x':=<c>.Q}) \\<in> \\<parallel><C>\\<parallel>\"\nusing a\napply(auto simp add: ctrm.inject alpha abs_fresh calc_atm)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(auto)[1]\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule_tac x=\"z\" in spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>P\" in spec)\napply(simp add: fresh_prod fresh_left calc_atm)\napply(drule_tac pi=\"[(a,b)]\" and x=\"(x):Ma{a:=(z).([(a,b)]\\<bullet>P)}\" \n                                     in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: calc_atm csubst_eqvt CAND_eqvt_coname)\napply(drule meta_mp)\napply(auto)[1]\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add:  CAND_eqvt_coname)\napply(rotate_tac 2)\napply(drule_tac x=\"[(a,b)]\\<bullet>c\" in spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Q\" in spec)\napply(simp add: fresh_prod fresh_left)\napply(drule mp)\napply(simp add: calc_atm)\napply(drule_tac pi=\"[(a,b)]\" and x=\"<a>:Ma{x:=<([(a,b)]\\<bullet>c)>.([(a,b)]\\<bullet>Q)}\" \n                                        in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: nsubst_eqvt CAND_eqvt_coname)\napply(simp add: calc_atm)\napply(case_tac \"a=aa\")\napply(simp)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"b\" in meta_spec)\napply(drule_tac x=\"[(aa,b)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(aa,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(auto)[1]\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule_tac x=\"z\" in spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>P\" in spec)\napply(simp add: fresh_prod fresh_left calc_atm)\napply(drule_tac pi=\"[(a,b)]\" and x=\"(x):Ma{a:=(z).([(a,b)]\\<bullet>P)}\" \n                                     in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: calc_atm csubst_eqvt  CAND_eqvt_coname)\napply(drule meta_mp)\napply(auto)[1]\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname)\napply(drule_tac x=\"[(a,b)]\\<bullet>c\" in spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Q\" in spec)\napply(simp)\napply(simp add: fresh_prod fresh_left)\napply(drule mp)\napply(simp add: calc_atm)\napply(drule_tac pi=\"[(a,b)]\" and x=\"<a>:Ma{x:=<([(a,b)]\\<bullet>c)>.([(a,b)]\\<bullet>Q)}\" \n                                      in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: nsubst_eqvt CAND_eqvt_coname)\napply(simp add: calc_atm)\napply(simp)\napply(case_tac \"b=aa\")\napply(simp)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,aa)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(auto)[1]\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm CAND_eqvt_coname)\napply(drule_tac x=\"z\" in spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>P\" in spec)\napply(simp add: fresh_prod fresh_left calc_atm)\napply(drule_tac pi=\"[(a,aa)]\" and x=\"(x):Ma{aa:=(z).([(a,aa)]\\<bullet>P)}\" \n                                    in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: calc_atm csubst_eqvt  CAND_eqvt_coname)\napply(drule meta_mp)\napply(auto)[1]\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add:  CAND_eqvt_coname)\napply(drule_tac x=\"[(a,aa)]\\<bullet>c\" in spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>Q\" in spec)\napply(simp)\napply(simp add: fresh_prod fresh_left)\napply(drule mp)\napply(simp add: calc_atm)\napply(drule_tac pi=\"[(a,aa)]\" and x=\"<aa>:Ma{x:=<([(a,aa)]\\<bullet>c)>.([(a,aa)]\\<bullet>Q)}\" \n                                    in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: nsubst_eqvt  CAND_eqvt_coname)\napply(simp add: calc_atm)\napply(simp)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"aa\" in meta_spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Ma\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(auto)[1]\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: calc_atm  CAND_eqvt_coname)\napply(drule_tac x=\"z\" in spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>P\" in spec)\napply(simp add: fresh_prod fresh_left calc_atm)\napply(drule_tac pi=\"[(a,b)]\" and x=\"(x):Ma{aa:=(z).([(a,b)]\\<bullet>P)}\" \n                                          in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: calc_atm csubst_eqvt  CAND_eqvt_coname)\napply(drule meta_mp)\napply(auto)[1]\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add:  CAND_eqvt_coname)\napply(drule_tac x=\"[(a,b)]\\<bullet>c\" in spec)\napply(drule_tac x=\"[(a,b)]\\<bullet>Q\" in spec)\napply(simp add: fresh_prod fresh_left)\napply(drule mp)\napply(simp add: calc_atm)\napply(drule_tac pi=\"[(a,b)]\" and x=\"<aa>:Ma{x:=<([(a,b)]\\<bullet>c)>.([(a,b)]\\<bullet>Q)}\" \n                                        in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: nsubst_eqvt  CAND_eqvt_coname)\napply(simp add: calc_atm)\ndone\n\nlemma IMPLEFT_elim:\n  assumes a: \"(x):M \\<in> IMPLEFT (B IMP C) (\\<parallel><B>\\<parallel>) (\\<parallel>(C)\\<parallel>)\"\n  obtains x' a' M' N' where \"M = ImpL <a'>.M' (x').N' x\" and \"fin (ImpL <a'>.M' (x').N' x) x\" \n                   and \"<a'>:M' \\<in> \\<parallel><B>\\<parallel>\" and \"(x'):N' \\<in> \\<parallel>(C)\\<parallel>\"\nusing a\napply(auto simp add: ntrm.inject alpha abs_fresh calc_atm)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" and x=\"(x):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: calc_atm  CAND_eqvt_name)\napply(simp)\napply(case_tac \"x=xa\")\napply(simp)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(xa,y)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"y\" in meta_spec)\napply(drule_tac x=\"[(xa,y)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(xa,y)]\" and x=\"(xa):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(case_tac \"y=xa\")\napply(simp)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(x,xa)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"x\" in meta_spec)\napply(drule_tac x=\"[(x,xa)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" and x=\"<a>:Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm  CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,xa)]\" and x=\"(xa):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\napply(simp)\napply(drule_tac x=\"a\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>Ma\" in meta_spec)\napply(drule_tac x=\"xa\" in meta_spec)\napply(drule_tac x=\"[(x,y)]\\<bullet>N\" in meta_spec)\napply(simp)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(drule meta_mp)\napply(drule_tac pi=\"[(x,y)]\" and x=\"(xa):N\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: calc_atm CAND_eqvt_name)\napply(simp)\ndone\n\nlemma CANDs_alpha:\n  shows \"<a>:M \\<in> (\\<parallel><B>\\<parallel>) \\<Longrightarrow> [a].M = [b].N \\<Longrightarrow> <b>:N \\<in> (\\<parallel><B>\\<parallel>)\"\n  and   \"(x):M \\<in> (\\<parallel>(B)\\<parallel>) \\<Longrightarrow> [x].M = [y].N \\<Longrightarrow> (y):N \\<in> (\\<parallel>(B)\\<parallel>)\"\napply(auto simp add: alpha)\napply(drule_tac pi=\"[(a,b)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(perm_simp add: CAND_eqvt_coname calc_atm)\napply(drule_tac pi=\"[(x,y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name calc_atm)\ndone\n\nlemma CAND_NotR_elim:\n  assumes a: \"<a>:NotR (x).M a \\<in> (\\<parallel><B>\\<parallel>)\" \"<a>:NotR (x).M a \\<notin> BINDINGc B (\\<parallel>(B)\\<parallel>)\"\n  shows \"\\<exists>B'. B = NOT B' \\<and> (x):M \\<in> (\\<parallel>(B')\\<parallel>)\" \nusing a\napply(nominal_induct B rule: ty.strong_induct)\napply(simp_all add: ty.inject AXIOMSc_def ctrm.inject alpha)\napply(auto intro: CANDs_alpha simp add: trm.inject calc_atm abs_fresh fresh_atm)\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(auto simp add: CAND_eqvt_coname calc_atm intro: CANDs_alpha)\ndone\n\nlemma CAND_NotL_elim_aux:\n  assumes a: \"(x):NotL <a>.M x \\<in> NEGn B (\\<parallel><B>\\<parallel>)\" \"(x):NotL <a>.M x \\<notin> BINDINGn B (\\<parallel><B>\\<parallel>)\"\n  shows \"\\<exists>B'. B = NOT B' \\<and> <a>:M \\<in> (\\<parallel><B'>\\<parallel>)\" \nusing a\napply(nominal_induct B rule: ty.strong_induct)\napply(simp_all add: ty.inject AXIOMSn_def ntrm.inject alpha)\napply(auto intro: CANDs_alpha simp add: trm.inject calc_atm abs_fresh fresh_atm)\napply(drule_tac pi=\"[(x,xa)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(auto simp add: CAND_eqvt_name calc_atm intro: CANDs_alpha)\ndone\n\nlemmas CAND_NotL_elim = CAND_NotL_elim_aux[OF NEG_elim(2)]\n\nlemma CAND_AndR_elim:\n  assumes a: \"<a>:AndR <b>.M <c>.N a \\<in> (\\<parallel><B>\\<parallel>)\" \"<a>:AndR <b>.M <c>.N a \\<notin> BINDINGc B (\\<parallel>(B)\\<parallel>)\"\n  shows \"\\<exists>B1 B2. B = B1 AND B2 \\<and> <b>:M \\<in> (\\<parallel><B1>\\<parallel>) \\<and> <c>:N \\<in> (\\<parallel><B2>\\<parallel>)\" \nusing a\napply(nominal_induct B rule: ty.strong_induct)\napply(simp_all add: ty.inject AXIOMSc_def ctrm.inject alpha)\napply(auto intro: CANDs_alpha simp add: trm.inject calc_atm abs_fresh fresh_atm)\napply(drule_tac pi=\"[(a,ca)]\" and x=\"<a>:Ma\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(drule_tac pi=\"[(a,ca)]\" and x=\"<a>:Na\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(drule_tac pi=\"[(a,ca)]\" and x=\"<a>:Ma\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(case_tac \"a=ba\")\napply(simp)\napply(drule_tac pi=\"[(ba,ca)]\" and x=\"<ba>:Na\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(case_tac \"ca=ba\")\napply(simp)\napply(drule_tac pi=\"[(a,ba)]\" and x=\"<ba>:Na\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(drule_tac pi=\"[(a,ca)]\" and x=\"<ba>:Na\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(case_tac \"a=aa\")\napply(simp)\napply(drule_tac pi=\"[(aa,ca)]\" and x=\"<aa>:Ma\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(case_tac \"ca=aa\")\napply(simp)\napply(drule_tac pi=\"[(a,aa)]\" and x=\"<aa>:Ma\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(drule_tac pi=\"[(a,ca)]\" and x=\"<aa>:Ma\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(drule_tac pi=\"[(a,ca)]\" and x=\"<a>:Na\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(case_tac \"a=aa\")\napply(simp)\napply(drule_tac pi=\"[(aa,ca)]\" and x=\"<aa>:Ma\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(case_tac \"ca=aa\")\napply(simp)\napply(drule_tac pi=\"[(a,aa)]\" and x=\"<aa>:Ma\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(drule_tac pi=\"[(a,ca)]\" and x=\"<aa>:Ma\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(case_tac \"a=ba\")\napply(simp)\napply(drule_tac pi=\"[(ba,ca)]\" and x=\"<ba>:Na\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(case_tac \"ca=ba\")\napply(simp)\napply(drule_tac pi=\"[(a,ba)]\" and x=\"<ba>:Na\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(drule_tac pi=\"[(a,ca)]\" and x=\"<ba>:Na\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_coname calc_atm)\napply(auto intro: CANDs_alpha)[1]\ndone\n\nlemma CAND_OrR1_elim:\n  assumes a: \"<a>:OrR1 <b>.M a \\<in> (\\<parallel><B>\\<parallel>)\" \"<a>:OrR1 <b>.M a \\<notin> BINDINGc B (\\<parallel>(B)\\<parallel>)\"\n  shows \"\\<exists>B1 B2. B = B1 OR B2 \\<and> <b>:M \\<in> (\\<parallel><B1>\\<parallel>)\" \nusing a\napply(nominal_induct B rule: ty.strong_induct)\napply(simp_all add: ty.inject AXIOMSc_def ctrm.inject alpha)\napply(auto intro: CANDs_alpha simp add: trm.inject calc_atm abs_fresh fresh_atm)\napply(drule_tac pi=\"[(a,ba)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(auto simp add: CAND_eqvt_coname calc_atm intro: CANDs_alpha)\napply(case_tac \"a=aa\")\napply(simp)\napply(drule_tac pi=\"[(aa,ba)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(auto simp add: CAND_eqvt_coname calc_atm intro: CANDs_alpha)\napply(case_tac \"ba=aa\")\napply(simp)\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(auto simp add: CAND_eqvt_coname calc_atm intro: CANDs_alpha)\napply(drule_tac pi=\"[(a,ba)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(auto simp add: CAND_eqvt_coname calc_atm intro: CANDs_alpha)\ndone\n\nlemma CAND_OrR2_elim:\n  assumes a: \"<a>:OrR2 <b>.M a \\<in> (\\<parallel><B>\\<parallel>)\" \"<a>:OrR2 <b>.M a \\<notin> BINDINGc B (\\<parallel>(B)\\<parallel>)\"\n  shows \"\\<exists>B1 B2. B = B1 OR B2 \\<and> <b>:M \\<in> (\\<parallel><B2>\\<parallel>)\" \nusing a\napply(nominal_induct B rule: ty.strong_induct)\napply(simp_all add: ty.inject AXIOMSc_def ctrm.inject alpha)\napply(auto intro: CANDs_alpha simp add: trm.inject calc_atm abs_fresh fresh_atm)\napply(drule_tac pi=\"[(a,ba)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(auto simp add: CAND_eqvt_coname calc_atm intro: CANDs_alpha)\napply(case_tac \"a=aa\")\napply(simp)\napply(drule_tac pi=\"[(aa,ba)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(auto simp add: CAND_eqvt_coname calc_atm intro: CANDs_alpha)\napply(case_tac \"ba=aa\")\napply(simp)\napply(drule_tac pi=\"[(a,aa)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(auto simp add: CAND_eqvt_coname calc_atm intro: CANDs_alpha)\napply(drule_tac pi=\"[(a,ba)]\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(auto simp add: CAND_eqvt_coname calc_atm intro: CANDs_alpha)\ndone\n\nlemma CAND_OrL_elim_aux:\n  assumes a: \"(x):(OrL (y).M (z).N x) \\<in> NEGn B (\\<parallel><B>\\<parallel>)\" \"(x):(OrL (y).M (z).N x) \\<notin> BINDINGn B (\\<parallel><B>\\<parallel>)\"\n  shows \"\\<exists>B1 B2. B = B1 OR B2 \\<and> (y):M \\<in> (\\<parallel>(B1)\\<parallel>) \\<and> (z):N \\<in> (\\<parallel>(B2)\\<parallel>)\" \nusing a\napply(nominal_induct B rule: ty.strong_induct)\napply(simp_all add: ty.inject AXIOMSn_def ntrm.inject alpha)\napply(auto intro: CANDs_alpha simp add: trm.inject calc_atm abs_fresh fresh_atm)\napply(drule_tac pi=\"[(x,za)]\" and x=\"(x):Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(drule_tac pi=\"[(x,za)]\" and x=\"(x):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(drule_tac pi=\"[(x,za)]\" and x=\"(x):Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(case_tac \"x=ya\")\napply(simp)\napply(drule_tac pi=\"[(ya,za)]\" and x=\"(ya):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(case_tac \"za=ya\")\napply(simp)\napply(drule_tac pi=\"[(x,ya)]\" and x=\"(ya):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(drule_tac pi=\"[(x,za)]\" and x=\"(ya):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(case_tac \"x=xa\")\napply(simp)\napply(drule_tac pi=\"[(xa,za)]\" and x=\"(xa):Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(case_tac \"za=xa\")\napply(simp)\napply(drule_tac pi=\"[(x,xa)]\" and x=\"(xa):Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(drule_tac pi=\"[(x,za)]\" and x=\"(xa):Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(drule_tac pi=\"[(x,za)]\" and x=\"(x):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(case_tac \"x=xa\")\napply(simp)\napply(drule_tac pi=\"[(xa,za)]\" and x=\"(xa):Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(case_tac \"za=xa\")\napply(simp)\napply(drule_tac pi=\"[(x,xa)]\" and x=\"(xa):Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(drule_tac pi=\"[(x,za)]\" and x=\"(xa):Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(case_tac \"x=ya\")\napply(simp)\napply(drule_tac pi=\"[(ya,za)]\" and x=\"(ya):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(case_tac \"za=ya\")\napply(simp)\napply(drule_tac pi=\"[(x,ya)]\" and x=\"(ya):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(drule_tac pi=\"[(x,za)]\" and x=\"(ya):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\ndone\n\nlemmas CAND_OrL_elim = CAND_OrL_elim_aux[OF NEG_elim(2)]\n\nlemma CAND_AndL1_elim_aux:\n  assumes a: \"(x):(AndL1 (y).M x) \\<in> NEGn B (\\<parallel><B>\\<parallel>)\" \"(x):(AndL1 (y).M x) \\<notin> BINDINGn B (\\<parallel><B>\\<parallel>)\"\n  shows \"\\<exists>B1 B2. B = B1 AND B2 \\<and> (y):M \\<in> (\\<parallel>(B1)\\<parallel>)\" \nusing a\napply(nominal_induct B rule: ty.strong_induct)\napply(simp_all add: ty.inject AXIOMSn_def ntrm.inject alpha)\napply(auto intro: CANDs_alpha simp add: trm.inject calc_atm abs_fresh fresh_atm)\napply(drule_tac pi=\"[(x,ya)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(auto simp add: CAND_eqvt_name calc_atm intro: CANDs_alpha)\napply(case_tac \"x=xa\")\napply(simp)\napply(drule_tac pi=\"[(xa,ya)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(auto simp add: CAND_eqvt_name calc_atm intro: CANDs_alpha)\napply(case_tac \"ya=xa\")\napply(simp)\napply(drule_tac pi=\"[(x,xa)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(auto simp add: CAND_eqvt_name calc_atm intro: CANDs_alpha)\napply(drule_tac pi=\"[(x,ya)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(auto simp add: CAND_eqvt_name calc_atm intro: CANDs_alpha)\ndone\n\nlemmas CAND_AndL1_elim = CAND_AndL1_elim_aux[OF NEG_elim(2)]\n\nlemma CAND_AndL2_elim_aux:\n  assumes a: \"(x):(AndL2 (y).M x) \\<in> NEGn B (\\<parallel><B>\\<parallel>)\" \"(x):(AndL2 (y).M x) \\<notin> BINDINGn B (\\<parallel><B>\\<parallel>)\"\n  shows \"\\<exists>B1 B2. B = B1 AND B2 \\<and> (y):M \\<in> (\\<parallel>(B2)\\<parallel>)\" \nusing a\napply(nominal_induct B rule: ty.strong_induct)\napply(simp_all add: ty.inject AXIOMSn_def ntrm.inject alpha)\napply(auto intro: CANDs_alpha simp add: trm.inject calc_atm abs_fresh fresh_atm)\napply(drule_tac pi=\"[(x,ya)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(auto simp add: CAND_eqvt_name calc_atm intro: CANDs_alpha)\napply(case_tac \"x=xa\")\napply(simp)\napply(drule_tac pi=\"[(xa,ya)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(auto simp add: CAND_eqvt_name calc_atm intro: CANDs_alpha)\napply(case_tac \"ya=xa\")\napply(simp)\napply(drule_tac pi=\"[(x,xa)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(auto simp add: CAND_eqvt_name calc_atm intro: CANDs_alpha)\napply(drule_tac pi=\"[(x,ya)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(auto simp add: CAND_eqvt_name calc_atm intro: CANDs_alpha)\ndone\n\nlemmas CAND_AndL2_elim = CAND_AndL2_elim_aux[OF NEG_elim(2)]\n\nlemma CAND_ImpL_elim_aux:\n  assumes a: \"(x):(ImpL <a>.M (z).N x) \\<in> NEGn B (\\<parallel><B>\\<parallel>)\" \"(x):(ImpL <a>.M (z).N x) \\<notin> BINDINGn B (\\<parallel><B>\\<parallel>)\"\n  shows \"\\<exists>B1 B2. B = B1 IMP B2 \\<and> <a>:M \\<in> (\\<parallel><B1>\\<parallel>) \\<and> (z):N \\<in> (\\<parallel>(B2)\\<parallel>)\" \nusing a\napply(nominal_induct B rule: ty.strong_induct)\napply(simp_all add: ty.inject AXIOMSn_def ntrm.inject alpha)\napply(auto intro: CANDs_alpha simp add: trm.inject calc_atm abs_fresh fresh_atm)\napply(drule_tac pi=\"[(x,y)]\" and x=\"<aa>:Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(drule_tac pi=\"[(x,y)]\" and x=\"(x):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(drule_tac pi=\"[(x,y)]\" and x=\"<aa>:Ma\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(case_tac \"x=xa\")\napply(simp)\napply(drule_tac pi=\"[(xa,y)]\" and x=\"(xa):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(case_tac \"y=xa\")\napply(simp)\napply(drule_tac pi=\"[(x,xa)]\" and x=\"(xa):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\napply(simp)\napply(drule_tac pi=\"[(x,y)]\" and x=\"(xa):Nb\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name calc_atm)\napply(auto intro: CANDs_alpha)[1]\ndone\n\nlemmas CAND_ImpL_elim = CAND_ImpL_elim_aux[OF NEG_elim(2)]\n\nlemma CAND_ImpR_elim:\n  assumes a: \"<a>:ImpR (x).<b>.M a \\<in> (\\<parallel><B>\\<parallel>)\" \"<a>:ImpR (x).<b>.M a \\<notin> BINDINGc B (\\<parallel>(B)\\<parallel>)\"\n  shows \"\\<exists>B1 B2. B = B1 IMP B2 \\<and> \n                 (\\<forall>z P. x\\<sharp>(z,P) \\<and> (z):P \\<in> \\<parallel>(B2)\\<parallel> \\<longrightarrow> (x):(M{b:=(z).P}) \\<in> \\<parallel>(B1)\\<parallel>) \\<and>\n                 (\\<forall>c Q. b\\<sharp>(c,Q) \\<and> <c>:Q \\<in> \\<parallel><B1>\\<parallel> \\<longrightarrow> <b>:(M{x:=<c>.Q}) \\<in> \\<parallel><B2>\\<parallel>)\" \nusing a\napply(nominal_induct B rule: ty.strong_induct)\napply(simp_all add: ty.inject AXIOMSc_def ctrm.inject alpha)\napply(auto intro: CANDs_alpha simp add: trm.inject calc_atm abs_fresh fresh_atm fresh_prod fresh_bij)\napply(generate_fresh \"name\") \napply(generate_fresh \"coname\")\napply(drule_tac a=\"ca\" and z=\"c\" in alpha_name_coname)\napply(simp) \napply(simp) \napply(simp) \napply(drule_tac x=\"[(xa,c)]\\<bullet>[(aa,ca)]\\<bullet>[(b,ca)]\\<bullet>[(x,c)]\\<bullet>z\" in spec)\napply(drule_tac x=\"[(xa,c)]\\<bullet>[(aa,ca)]\\<bullet>[(b,ca)]\\<bullet>[(x,c)]\\<bullet>P\" in spec)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm fresh_prod fresh_atm)[1]\napply(rule conjI)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule_tac pi=\"[(x,c)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(b,ca)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(aa,ca)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,c)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,c)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(aa,ca)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(b,ca)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(x,c)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(generate_fresh \"name\")\napply(generate_fresh \"coname\")\napply(drule_tac a=\"cb\" and z=\"ca\" in alpha_name_coname)\napply(simp)\napply(simp)\napply(simp)\napply(drule_tac x=\"[(xa,ca)]\\<bullet>[(aa,cb)]\\<bullet>[(b,cb)]\\<bullet>[(x,ca)]\\<bullet>c\" in spec)\napply(drule_tac x=\"[(xa,ca)]\\<bullet>[(aa,cb)]\\<bullet>[(b,cb)]\\<bullet>[(x,ca)]\\<bullet>Q\" in spec)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm fresh_prod fresh_atm)[1]\napply(rule conjI)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule_tac pi=\"[(x,ca)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(b,cb)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(aa,cb)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,ca)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,ca)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(aa,cb)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(b,cb)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(x,ca)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(generate_fresh \"name\")\napply(generate_fresh \"coname\")\napply(drule_tac a=\"ca\" and z=\"c\" in alpha_name_coname)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(auto)[1]\napply(simp)\napply(drule_tac x=\"[(a,ba)]\\<bullet>[(xa,c)]\\<bullet>[(ba,ca)]\\<bullet>[(b,ca)]\\<bullet>[(x,c)]\\<bullet>z\" in spec)\napply(drule_tac x=\"[(a,ba)]\\<bullet>[(xa,c)]\\<bullet>[(ba,ca)]\\<bullet>[(b,ca)]\\<bullet>[(x,c)]\\<bullet>P\" in spec)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm fresh_prod fresh_atm)[1]\napply(rule conjI)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule_tac pi=\"[(x,c)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(b,ca)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(ba,ca)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,c)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,ba)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,ba)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(xa,c)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(ba,ca)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(b,ca)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(x,c)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(generate_fresh \"name\")\napply(generate_fresh \"coname\")\napply(drule_tac a=\"cb\" and z=\"ca\" in alpha_name_coname)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(auto)[1]\napply(simp)\napply(drule_tac x=\"[(a,ba)]\\<bullet>[(xa,ca)]\\<bullet>[(ba,cb)]\\<bullet>[(b,cb)]\\<bullet>[(x,ca)]\\<bullet>c\" in spec)\napply(drule_tac x=\"[(a,ba)]\\<bullet>[(xa,ca)]\\<bullet>[(ba,cb)]\\<bullet>[(b,cb)]\\<bullet>[(x,ca)]\\<bullet>Q\" in spec)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm fresh_prod fresh_atm)[1]\napply(rule conjI)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule_tac pi=\"[(x,ca)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(b,cb)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(ba,cb)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,ca)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,ba)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,ba)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(xa,ca)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(ba,cb)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(b,cb)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(x,ca)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(case_tac \"a=aa\")\napply(simp)\napply(generate_fresh \"name\")\napply(generate_fresh \"coname\")\napply(drule_tac a=\"ca\" and z=\"c\" in alpha_name_coname)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(auto)[1]\napply(simp)\napply(drule_tac x=\"[(aa,ba)]\\<bullet>[(xa,c)]\\<bullet>[(ba,ca)]\\<bullet>[(b,ca)]\\<bullet>[(x,c)]\\<bullet>z\" in spec)\napply(drule_tac x=\"[(aa,ba)]\\<bullet>[(xa,c)]\\<bullet>[(ba,ca)]\\<bullet>[(b,ca)]\\<bullet>[(x,c)]\\<bullet>P\" in spec)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm fresh_prod fresh_atm)[1]\napply(rule conjI)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule_tac pi=\"[(x,c)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(b,ca)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(ba,ca)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,c)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(aa,ba)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(aa,ba)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(xa,c)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(ba,ca)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(b,ca)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(x,c)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(simp)\napply(case_tac \"ba=aa\")\napply(simp)\napply(generate_fresh \"name\")\napply(generate_fresh \"coname\")\napply(drule_tac a=\"ca\" and z=\"c\" in alpha_name_coname)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(auto)[1]\napply(simp)\napply(drule_tac x=\"[(a,aa)]\\<bullet>[(xa,c)]\\<bullet>[(a,ca)]\\<bullet>[(b,ca)]\\<bullet>[(x,c)]\\<bullet>z\" in spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>[(xa,c)]\\<bullet>[(a,ca)]\\<bullet>[(b,ca)]\\<bullet>[(x,c)]\\<bullet>P\" in spec)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm fresh_prod fresh_atm)[1]\napply(rule conjI)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule_tac pi=\"[(x,c)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(b,ca)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,ca)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,c)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,aa)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,aa)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(xa,c)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(a,ca)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(b,ca)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(x,c)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(simp)\napply(generate_fresh \"name\")\napply(generate_fresh \"coname\")\napply(drule_tac a=\"ca\" and z=\"c\" in alpha_name_coname)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(auto)[1]\napply(simp)\napply(drule_tac x=\"[(a,ba)]\\<bullet>[(xa,c)]\\<bullet>[(aa,ca)]\\<bullet>[(b,ca)]\\<bullet>[(x,c)]\\<bullet>z\" in spec)\napply(drule_tac x=\"[(a,ba)]\\<bullet>[(xa,c)]\\<bullet>[(aa,ca)]\\<bullet>[(b,ca)]\\<bullet>[(x,c)]\\<bullet>P\" in spec)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm fresh_prod fresh_atm)[1]\napply(rule conjI)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule_tac pi=\"[(x,c)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(b,ca)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(aa,ca)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,c)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,ba)]\" and X=\"\\<parallel>(ty2)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,ba)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(xa,c)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(aa,ca)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(b,ca)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(x,c)]\" and X=\"\\<parallel>(ty1)\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(case_tac \"a=aa\")\napply(simp)\napply(generate_fresh \"name\")\napply(generate_fresh \"coname\")\napply(drule_tac a=\"cb\" and z=\"ca\" in alpha_name_coname)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(auto)[1]\napply(simp)\napply(drule_tac x=\"[(aa,ba)]\\<bullet>[(xa,ca)]\\<bullet>[(ba,cb)]\\<bullet>[(b,cb)]\\<bullet>[(x,ca)]\\<bullet>c\" in spec)\napply(drule_tac x=\"[(aa,ba)]\\<bullet>[(xa,ca)]\\<bullet>[(ba,cb)]\\<bullet>[(b,cb)]\\<bullet>[(x,ca)]\\<bullet>Q\" in spec)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm fresh_prod fresh_atm)[1]\napply(rule conjI)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule_tac pi=\"[(x,ca)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(b,cb)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(ba,cb)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,ca)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(aa,ba)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(aa,ba)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(xa,ca)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(ba,cb)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(b,cb)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(x,ca)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(simp)\napply(case_tac \"ba=aa\")\napply(simp)\napply(generate_fresh \"name\")\napply(generate_fresh \"coname\")\napply(drule_tac a=\"cb\" and z=\"ca\" in alpha_name_coname)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(auto)[1]\napply(simp)\napply(drule_tac x=\"[(a,aa)]\\<bullet>[(xa,ca)]\\<bullet>[(a,cb)]\\<bullet>[(b,cb)]\\<bullet>[(x,ca)]\\<bullet>c\" in spec)\napply(drule_tac x=\"[(a,aa)]\\<bullet>[(xa,ca)]\\<bullet>[(a,cb)]\\<bullet>[(b,cb)]\\<bullet>[(x,ca)]\\<bullet>Q\" in spec)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm fresh_prod fresh_atm)[1]\napply(rule conjI)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule_tac pi=\"[(x,ca)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(b,cb)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,cb)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,ca)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,aa)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,aa)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(xa,ca)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(a,cb)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(b,cb)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(x,ca)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(simp)\napply(generate_fresh \"name\")\napply(generate_fresh \"coname\")\napply(drule_tac a=\"cb\" and z=\"ca\" in alpha_name_coname)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(simp add: fresh_left calc_atm fresh_prod fresh_atm)\napply(auto)[1]\napply(simp)\napply(drule_tac x=\"[(a,ba)]\\<bullet>[(xa,ca)]\\<bullet>[(aa,cb)]\\<bullet>[(b,cb)]\\<bullet>[(x,ca)]\\<bullet>c\" in spec)\napply(drule_tac x=\"[(a,ba)]\\<bullet>[(xa,ca)]\\<bullet>[(aa,cb)]\\<bullet>[(b,cb)]\\<bullet>[(x,ca)]\\<bullet>Q\" in spec)\napply(drule mp)\napply(rule conjI)\napply(auto simp add: calc_atm fresh_prod fresh_atm)[1]\napply(rule conjI)\napply(auto simp add: fresh_left calc_atm fresh_prod fresh_atm)[1]\napply(drule_tac pi=\"[(x,ca)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(b,cb)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(aa,cb)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(xa,ca)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,ba)]\" and X=\"\\<parallel><ty1>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(a,ba)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(xa,ca)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(aa,cb)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\napply(drule_tac pi=\"[(b,cb)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_coname_inst, OF at_coname_inst])\napply(simp add: CAND_eqvt_name CAND_eqvt_coname)\napply(drule_tac pi=\"[(x,ca)]\" and X=\"\\<parallel><ty2>\\<parallel>\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(perm_simp add: CAND_eqvt_name CAND_eqvt_coname csubst_eqvt nsubst_eqvt)\ndone\n\ntext \\<open>Main lemma 1\\<close>\n\nlemma AXIOMS_imply_SNa:\n  shows \"<a>:M \\<in> AXIOMSc B \\<Longrightarrow> SNa M\"\n  and   \"(x):M \\<in> AXIOMSn B \\<Longrightarrow> SNa M\"\napply -\napply(auto simp add: AXIOMSn_def AXIOMSc_def ntrm.inject ctrm.inject alpha)\napply(rule Ax_in_SNa)+\ndone\n\nlemma BINDING_imply_SNa:\n  shows \"<a>:M \\<in> BINDINGc B (\\<parallel>(B)\\<parallel>) \\<Longrightarrow> SNa M\"\n  and   \"(x):M \\<in> BINDINGn B (\\<parallel><B>\\<parallel>) \\<Longrightarrow> SNa M\"\napply -\napply(auto simp add: BINDINGn_def BINDINGc_def ntrm.inject ctrm.inject alpha)\napply(drule_tac x=\"x\" in spec)\napply(drule_tac x=\"Ax x a\" in spec)\napply(drule mp)\napply(rule Ax_in_CANDs)\napply(drule a_star_preserves_SNa)\napply(rule subst_with_ax2)\napply(simp add: crename_id)\napply(drule_tac x=\"x\" in spec)\napply(drule_tac x=\"Ax x aa\" in spec)\napply(drule mp)\napply(rule Ax_in_CANDs)\napply(drule a_star_preserves_SNa)\napply(rule subst_with_ax2)\napply(simp add: crename_id SNa_eqvt)\napply(drule_tac x=\"a\" in spec)\napply(drule_tac x=\"Ax x a\" in spec)\napply(drule mp)\napply(rule Ax_in_CANDs)\napply(drule a_star_preserves_SNa)\napply(rule subst_with_ax1)\napply(simp add: nrename_id)\napply(drule_tac x=\"a\" in spec)\napply(drule_tac x=\"Ax xa a\" in spec)\napply(drule mp)\napply(rule Ax_in_CANDs)\napply(drule a_star_preserves_SNa)\napply(rule subst_with_ax1)\napply(simp add: nrename_id SNa_eqvt)\ndone\n\nlemma CANDs_imply_SNa:\n  shows \"<a>:M \\<in> \\<parallel><B>\\<parallel> \\<Longrightarrow> SNa M\"\n  and   \"(x):M \\<in> \\<parallel>(B)\\<parallel> \\<Longrightarrow> SNa M\"\nproof(induct B arbitrary: a x M rule: ty.induct)\n  case (PR X)\n  { case 1 \n    have \"<a>:M \\<in> \\<parallel><PR X>\\<parallel>\" by fact\n    then have \"<a>:M \\<in> NEGc (PR X) (\\<parallel>(PR X)\\<parallel>)\" by simp\n    then have \"<a>:M \\<in> AXIOMSc (PR X) \\<union> BINDINGc (PR X) (\\<parallel>(PR X)\\<parallel>)\" by simp\n    moreover\n    { assume \"<a>:M \\<in> AXIOMSc (PR X)\"\n      then have \"SNa M\" by (simp add: AXIOMS_imply_SNa)\n    }\n    moreover\n    { assume \"<a>:M \\<in> BINDINGc (PR X) (\\<parallel>(PR X)\\<parallel>)\"\n      then have \"SNa M\" by (simp add: BINDING_imply_SNa)\n    }\n    ultimately show \"SNa M\" by blast \n  next\n    case 2\n    have \"(x):M \\<in> (\\<parallel>(PR X)\\<parallel>)\" by fact\n    then have \"(x):M \\<in> NEGn (PR X) (\\<parallel><PR X>\\<parallel>)\" using NEG_simp by blast\n    then have \"(x):M \\<in> AXIOMSn (PR X) \\<union> BINDINGn (PR X) (\\<parallel><PR X>\\<parallel>)\" by simp\n    moreover\n    { assume \"(x):M \\<in> AXIOMSn (PR X)\"\n      then have \"SNa M\" by (simp add: AXIOMS_imply_SNa)\n    }\n    moreover\n    { assume \"(x):M \\<in> BINDINGn (PR X) (\\<parallel><PR X>\\<parallel>)\"\n      then have \"SNa M\" by (simp only: BINDING_imply_SNa)\n    }\n    ultimately show \"SNa M\" by blast\n  }\nnext\n  case (NOT B)\n  have ih1: \"\\<And>a M. <a>:M \\<in> \\<parallel><B>\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  have ih2: \"\\<And>x M. (x):M \\<in> \\<parallel>(B)\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  { case 1\n    have \"<a>:M \\<in> (\\<parallel><NOT B>\\<parallel>)\" by fact\n    then have \"<a>:M \\<in> NEGc (NOT B) (\\<parallel>(NOT B)\\<parallel>)\" by simp\n    then have \"<a>:M \\<in> AXIOMSc (NOT B) \\<union> BINDINGc (NOT B) (\\<parallel>(NOT B)\\<parallel>) \\<union> NOTRIGHT (NOT B) (\\<parallel>(B)\\<parallel>)\" by simp\n     moreover\n    { assume \"<a>:M \\<in> AXIOMSc (NOT B)\"\n      then have \"SNa M\" by (simp add: AXIOMS_imply_SNa)\n    }\n    moreover\n    { assume \"<a>:M \\<in> BINDINGc (NOT B) (\\<parallel>(NOT B)\\<parallel>)\"\n      then have \"SNa M\" by (simp only: BINDING_imply_SNa)\n    }\n     moreover\n    { assume \"<a>:M \\<in> NOTRIGHT (NOT B) (\\<parallel>(B)\\<parallel>)\"\n      then obtain x' M' where eq: \"M = NotR (x').M' a\" and \"(x'):M' \\<in> (\\<parallel>(B)\\<parallel>)\"\n        using NOTRIGHT_elim by blast\n      then have \"SNa M'\" using ih2 by blast\n      then have \"SNa M\" using eq by (simp add: NotR_in_SNa)\n    }\n    ultimately show \"SNa M\" by blast\n  next\n    case 2\n    have \"(x):M \\<in> (\\<parallel>(NOT B)\\<parallel>)\" by fact\n    then have \"(x):M \\<in> NEGn (NOT B) (\\<parallel><NOT B>\\<parallel>)\" using NEG_simp by blast\n    then have \"(x):M \\<in> AXIOMSn (NOT B) \\<union> BINDINGn (NOT B) (\\<parallel><NOT B>\\<parallel>) \\<union> NOTLEFT (NOT B) (\\<parallel><B>\\<parallel>)\" \n      by (simp only: NEGn.simps)\n     moreover\n    { assume \"(x):M \\<in> AXIOMSn (NOT B)\"\n      then have \"SNa M\" by (simp add: AXIOMS_imply_SNa)\n    }\n    moreover\n    { assume \"(x):M \\<in> BINDINGn (NOT B) (\\<parallel><NOT B>\\<parallel>)\"\n      then have \"SNa M\" by (simp only: BINDING_imply_SNa)\n    }\n     moreover\n    { assume \"(x):M \\<in> NOTLEFT (NOT B) (\\<parallel><B>\\<parallel>)\"\n      then obtain a' M' where eq: \"M = NotL <a'>.M' x\" and \"<a'>:M' \\<in> (\\<parallel><B>\\<parallel>)\"\n        using NOTLEFT_elim by blast\n      then have \"SNa M'\" using ih1 by blast\n      then have \"SNa M\" using eq by (simp add: NotL_in_SNa)\n    }\n    ultimately show \"SNa M\" by blast\n  }\nnext\n  case (AND A B)\n  have ih1: \"\\<And>a M. <a>:M \\<in> \\<parallel><A>\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  have ih2: \"\\<And>x M. (x):M \\<in> \\<parallel>(A)\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  have ih3: \"\\<And>a M. <a>:M \\<in> \\<parallel><B>\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  have ih4: \"\\<And>x M. (x):M \\<in> \\<parallel>(B)\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  { case 1\n    have \"<a>:M \\<in> (\\<parallel><A AND B>\\<parallel>)\" by fact\n    then have \"<a>:M \\<in> NEGc (A AND B) (\\<parallel>(A AND B)\\<parallel>)\" by simp\n    then have \"<a>:M \\<in> AXIOMSc (A AND B) \\<union> BINDINGc (A AND B) (\\<parallel>(A AND B)\\<parallel>) \n                                  \\<union> ANDRIGHT (A AND B) (\\<parallel><A>\\<parallel>) (\\<parallel><B>\\<parallel>)\" by simp\n     moreover\n    { assume \"<a>:M \\<in> AXIOMSc (A AND B)\"\n      then have \"SNa M\" by (simp add: AXIOMS_imply_SNa)\n    }\n    moreover\n    { assume \"<a>:M \\<in> BINDINGc (A AND B) (\\<parallel>(A AND B)\\<parallel>)\"\n      then have \"SNa M\" by (simp only: BINDING_imply_SNa)\n    }\n     moreover\n    { assume \"<a>:M \\<in> ANDRIGHT (A AND B) (\\<parallel><A>\\<parallel>) (\\<parallel><B>\\<parallel>)\"\n      then obtain a' M' b' N' where eq: \"M = AndR <a'>.M' <b'>.N' a\" \n                                and \"<a'>:M' \\<in> (\\<parallel><A>\\<parallel>)\" and \"<b'>:N' \\<in> (\\<parallel><B>\\<parallel>)\"\n        by (erule_tac ANDRIGHT_elim, blast)\n      then have \"SNa M'\" and \"SNa N'\" using ih1 ih3 by blast+\n      then have \"SNa M\" using eq by (simp add: AndR_in_SNa)\n    }\n    ultimately show \"SNa M\" by blast\n  next\n    case 2\n    have \"(x):M \\<in> (\\<parallel>(A AND B)\\<parallel>)\" by fact\n    then have \"(x):M \\<in> NEGn (A AND B) (\\<parallel><A AND B>\\<parallel>)\" using NEG_simp by blast\n    then have \"(x):M \\<in> AXIOMSn (A AND B) \\<union> BINDINGn (A AND B) (\\<parallel><A AND B>\\<parallel>) \n                       \\<union> ANDLEFT1 (A AND B) (\\<parallel>(A)\\<parallel>) \\<union> ANDLEFT2 (A AND B) (\\<parallel>(B)\\<parallel>)\" \n      by (simp only: NEGn.simps)\n     moreover\n    { assume \"(x):M \\<in> AXIOMSn (A AND B)\"\n      then have \"SNa M\" by (simp add: AXIOMS_imply_SNa)\n    }\n    moreover\n    { assume \"(x):M \\<in> BINDINGn (A AND B) (\\<parallel><A AND B>\\<parallel>)\"\n      then have \"SNa M\" by (simp only: BINDING_imply_SNa)\n    }\n     moreover\n    { assume \"(x):M \\<in> ANDLEFT1 (A AND B) (\\<parallel>(A)\\<parallel>)\"\n      then obtain x' M' where eq: \"M = AndL1 (x').M' x\" and \"(x'):M' \\<in> (\\<parallel>(A)\\<parallel>)\"\n        using ANDLEFT1_elim by blast\n      then have \"SNa M'\" using ih2 by blast\n      then have \"SNa M\" using eq by (simp add: AndL1_in_SNa)\n    }\n    moreover\n    { assume \"(x):M \\<in> ANDLEFT2 (A AND B) (\\<parallel>(B)\\<parallel>)\"\n      then obtain x' M' where eq: \"M = AndL2 (x').M' x\" and \"(x'):M' \\<in> (\\<parallel>(B)\\<parallel>)\"\n        using ANDLEFT2_elim by blast\n      then have \"SNa M'\" using ih4 by blast\n      then have \"SNa M\" using eq by (simp add: AndL2_in_SNa)\n    }\n    ultimately show \"SNa M\" by blast\n  }\nnext\n  case (OR A B)\n  have ih1: \"\\<And>a M. <a>:M \\<in> \\<parallel><A>\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  have ih2: \"\\<And>x M. (x):M \\<in> \\<parallel>(A)\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  have ih3: \"\\<And>a M. <a>:M \\<in> \\<parallel><B>\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  have ih4: \"\\<And>x M. (x):M \\<in> \\<parallel>(B)\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  { case 1\n    have \"<a>:M \\<in> (\\<parallel><A OR B>\\<parallel>)\" by fact\n    then have \"<a>:M \\<in> NEGc (A OR B) (\\<parallel>(A OR B)\\<parallel>)\" by simp\n    then have \"<a>:M \\<in> AXIOMSc (A OR B) \\<union> BINDINGc (A OR B) (\\<parallel>(A OR B)\\<parallel>) \n                                  \\<union> ORRIGHT1 (A OR B) (\\<parallel><A>\\<parallel>) \\<union> ORRIGHT2 (A OR B) (\\<parallel><B>\\<parallel>)\" by simp\n     moreover\n    { assume \"<a>:M \\<in> AXIOMSc (A OR B)\"\n      then have \"SNa M\" by (simp add: AXIOMS_imply_SNa)\n    }\n    moreover\n    { assume \"<a>:M \\<in> BINDINGc (A OR B) (\\<parallel>(A OR B)\\<parallel>)\"\n      then have \"SNa M\" by (simp only: BINDING_imply_SNa)\n    }\n     moreover\n    { assume \"<a>:M \\<in> ORRIGHT1 (A OR B) (\\<parallel><A>\\<parallel>)\"\n      then obtain a' M' where eq: \"M = OrR1 <a'>.M' a\" \n                                and \"<a'>:M' \\<in> (\\<parallel><A>\\<parallel>)\" \n        by (erule_tac ORRIGHT1_elim, blast)\n      then have \"SNa M'\" using ih1 by blast\n      then have \"SNa M\" using eq by (simp add: OrR1_in_SNa)\n    }\n     moreover\n    { assume \"<a>:M \\<in> ORRIGHT2 (A OR B) (\\<parallel><B>\\<parallel>)\"\n      then obtain a' M' where eq: \"M = OrR2 <a'>.M' a\" and \"<a'>:M' \\<in> (\\<parallel><B>\\<parallel>)\" \n        using ORRIGHT2_elim by blast\n      then have \"SNa M'\" using ih3 by blast\n      then have \"SNa M\" using eq by (simp add: OrR2_in_SNa)\n    }\n    ultimately show \"SNa M\" by blast\n  next\n    case 2\n    have \"(x):M \\<in> (\\<parallel>(A OR B)\\<parallel>)\" by fact\n    then have \"(x):M \\<in> NEGn (A OR B) (\\<parallel><A OR B>\\<parallel>)\" using NEG_simp by blast\n    then have \"(x):M \\<in> AXIOMSn (A OR B) \\<union> BINDINGn (A OR B) (\\<parallel><A OR B>\\<parallel>) \n                       \\<union> ORLEFT (A OR B) (\\<parallel>(A)\\<parallel>) (\\<parallel>(B)\\<parallel>)\" \n      by (simp only: NEGn.simps)\n     moreover\n    { assume \"(x):M \\<in> AXIOMSn (A OR B)\"\n      then have \"SNa M\" by (simp add: AXIOMS_imply_SNa)\n    }\n    moreover\n    { assume \"(x):M \\<in> BINDINGn (A OR B) (\\<parallel><A OR B>\\<parallel>)\"\n      then have \"SNa M\" by (simp only: BINDING_imply_SNa)\n    }\n     moreover\n    { assume \"(x):M \\<in> ORLEFT (A OR B) (\\<parallel>(A)\\<parallel>) (\\<parallel>(B)\\<parallel>)\"\n      then obtain x' M' y' N' where eq: \"M = OrL (x').M' (y').N' x\" \n                                and \"(x'):M' \\<in> (\\<parallel>(A)\\<parallel>)\" and  \"(y'):N' \\<in> (\\<parallel>(B)\\<parallel>)\"\n        by (erule_tac ORLEFT_elim, blast)\n      then have \"SNa M'\" and \"SNa N'\" using ih2 ih4 by blast+\n      then have \"SNa M\" using eq by (simp add: OrL_in_SNa)\n    }\n    ultimately show \"SNa M\" by blast\n  }\nnext \n  case (IMP A B)\n  have ih1: \"\\<And>a M. <a>:M \\<in> \\<parallel><A>\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  have ih2: \"\\<And>x M. (x):M \\<in> \\<parallel>(A)\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  have ih3: \"\\<And>a M. <a>:M \\<in> \\<parallel><B>\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  have ih4: \"\\<And>x M. (x):M \\<in> \\<parallel>(B)\\<parallel> \\<Longrightarrow> SNa M\" by fact\n  { case 1\n    have \"<a>:M \\<in> (\\<parallel><A IMP B>\\<parallel>)\" by fact\n    then have \"<a>:M \\<in> NEGc (A IMP B) (\\<parallel>(A IMP B)\\<parallel>)\" by simp\n    then have \"<a>:M \\<in> AXIOMSc (A IMP B) \\<union> BINDINGc (A IMP B) (\\<parallel>(A IMP B)\\<parallel>) \n                                  \\<union> IMPRIGHT (A IMP B) (\\<parallel>(A)\\<parallel>) (\\<parallel><B>\\<parallel>) (\\<parallel>(B)\\<parallel>) (\\<parallel><A>\\<parallel>)\" by simp\n     moreover\n    { assume \"<a>:M \\<in> AXIOMSc (A IMP B)\"\n      then have \"SNa M\" by (simp add: AXIOMS_imply_SNa)\n    }\n    moreover\n    { assume \"<a>:M \\<in> BINDINGc (A IMP B) (\\<parallel>(A IMP B)\\<parallel>)\"\n      then have \"SNa M\" by (simp only: BINDING_imply_SNa)\n    }\n     moreover\n    { assume \"<a>:M \\<in> IMPRIGHT (A IMP B) (\\<parallel>(A)\\<parallel>) (\\<parallel><B>\\<parallel>) (\\<parallel>(B)\\<parallel>) (\\<parallel><A>\\<parallel>)\"\n      then obtain x' a' M' where eq: \"M = ImpR (x').<a'>.M' a\" \n                           and imp: \"\\<forall>z P. x'\\<sharp>(z,P) \\<and> (z):P \\<in> \\<parallel>(B)\\<parallel> \\<longrightarrow> (x'):(M'{a':=(z).P}) \\<in> \\<parallel>(A)\\<parallel>\"    \n        by (erule_tac IMPRIGHT_elim, blast)\n      obtain z::\"name\" where fs: \"z\\<sharp>x'\" by (rule_tac exists_fresh, rule fin_supp, blast)\n      have \"(z):Ax z a'\\<in> \\<parallel>(B)\\<parallel>\" by (simp add: Ax_in_CANDs)\n      with imp fs have \"(x'):(M'{a':=(z).Ax z a'}) \\<in> \\<parallel>(A)\\<parallel>\" by (simp add: fresh_prod fresh_atm)\n      then have \"SNa (M'{a':=(z).Ax z a'})\" using ih2 by blast\n      moreover \n      have \"M'{a':=(z).Ax z a'} \\<longrightarrow>\\<^sub>a* M'[a'\\<turnstile>c>a']\" by (simp add: subst_with_ax2)\n      ultimately have \"SNa (M'[a'\\<turnstile>c>a'])\" by (simp add: a_star_preserves_SNa)\n      then have \"SNa M'\" by (simp add: crename_id)\n      then have \"SNa M\" using eq by (simp add: ImpR_in_SNa)\n    }\n    ultimately show \"SNa M\" by blast\n  next\n    case 2\n    have \"(x):M \\<in> (\\<parallel>(A IMP B)\\<parallel>)\" by fact\n    then have \"(x):M \\<in> NEGn (A IMP B) (\\<parallel><A IMP B>\\<parallel>)\" using NEG_simp by blast\n    then have \"(x):M \\<in> AXIOMSn (A IMP B) \\<union> BINDINGn (A IMP B) (\\<parallel><A IMP B>\\<parallel>) \n                       \\<union> IMPLEFT (A IMP B) (\\<parallel><A>\\<parallel>) (\\<parallel>(B)\\<parallel>)\" \n      by (simp only: NEGn.simps)\n     moreover\n    { assume \"(x):M \\<in> AXIOMSn (A IMP B)\"\n      then have \"SNa M\" by (simp add: AXIOMS_imply_SNa)\n    }\n    moreover\n    { assume \"(x):M \\<in> BINDINGn (A IMP B) (\\<parallel><A IMP B>\\<parallel>)\"\n      then have \"SNa M\" by (simp only: BINDING_imply_SNa)\n    }\n     moreover\n    { assume \"(x):M \\<in> IMPLEFT (A IMP B) (\\<parallel><A>\\<parallel>) (\\<parallel>(B)\\<parallel>)\"\n      then obtain a' M' y' N' where eq: \"M = ImpL <a'>.M' (y').N' x\" \n                                and \"<a'>:M' \\<in> (\\<parallel><A>\\<parallel>)\" and  \"(y'):N' \\<in> (\\<parallel>(B)\\<parallel>)\"\n        by (erule_tac IMPLEFT_elim, blast)\n      then have \"SNa M'\" and \"SNa N'\" using ih1 ih4 by blast+\n      then have \"SNa M\" using eq by (simp add: ImpL_in_SNa)\n    }\n    ultimately show \"SNa M\" by blast\n  }\nqed \n\ntext \\<open>Main lemma 2\\<close>\n\nlemma AXIOMS_preserved:\n  shows \"<a>:M \\<in> AXIOMSc B \\<Longrightarrow> M \\<longrightarrow>\\<^sub>a* M' \\<Longrightarrow> <a>:M' \\<in> AXIOMSc B\"\n  and   \"(x):M \\<in> AXIOMSn B \\<Longrightarrow> M \\<longrightarrow>\\<^sub>a* M' \\<Longrightarrow> (x):M' \\<in> AXIOMSn B\"\n  apply(simp_all add: AXIOMSc_def AXIOMSn_def)\n  apply(auto simp add: ntrm.inject ctrm.inject alpha)\n  apply(drule ax_do_not_a_star_reduce)\n  apply(auto)\n  apply(drule ax_do_not_a_star_reduce)\n  apply(auto)\n  apply(drule ax_do_not_a_star_reduce)\n  apply(auto)\n  apply(drule ax_do_not_a_star_reduce)\n  apply(auto)\n  done  \n\nlemma BINDING_preserved:\n  shows \"<a>:M \\<in> BINDINGc B (\\<parallel>(B)\\<parallel>) \\<Longrightarrow> M \\<longrightarrow>\\<^sub>a* M' \\<Longrightarrow> <a>:M' \\<in> BINDINGc B (\\<parallel>(B)\\<parallel>)\"\n  and   \"(x):M \\<in> BINDINGn B (\\<parallel><B>\\<parallel>) \\<Longrightarrow> M \\<longrightarrow>\\<^sub>a* M' \\<Longrightarrow> (x):M' \\<in> BINDINGn B (\\<parallel><B>\\<parallel>)\"\nproof -\n  assume red: \"M \\<longrightarrow>\\<^sub>a* M'\"\n  assume asm: \"<a>:M \\<in> BINDINGc B (\\<parallel>(B)\\<parallel>)\"\n  {\n    fix x::\"name\" and  P::\"trm\"\n    from asm have \"((x):P) \\<in> (\\<parallel>(B)\\<parallel>) \\<Longrightarrow> SNa (M{a:=(x).P})\" by (simp add: BINDINGc_elim)\n    moreover\n    have \"M{a:=(x).P} \\<longrightarrow>\\<^sub>a* M'{a:=(x).P}\" using red by (simp add: a_star_subst2)\n    ultimately \n    have \"((x):P) \\<in> (\\<parallel>(B)\\<parallel>) \\<Longrightarrow> SNa (M'{a:=(x).P})\" by (simp add: a_star_preserves_SNa)\n  }\n  then show \"<a>:M' \\<in> BINDINGc B (\\<parallel>(B)\\<parallel>)\" by (auto simp add: BINDINGc_def)\nnext\n  assume red: \"M \\<longrightarrow>\\<^sub>a* M'\"\n  assume asm: \"(x):M \\<in> BINDINGn B (\\<parallel><B>\\<parallel>)\"\n  {\n    fix c::\"coname\" and  P::\"trm\"\n    from asm have \"(<c>:P) \\<in> (\\<parallel><B>\\<parallel>) \\<Longrightarrow> SNa (M{x:=<c>.P})\" by (simp add: BINDINGn_elim)\n    moreover\n    have \"M{x:=<c>.P} \\<longrightarrow>\\<^sub>a* M'{x:=<c>.P}\" using red by (simp add: a_star_subst1)\n    ultimately \n    have \"(<c>:P) \\<in> (\\<parallel><B>\\<parallel>) \\<Longrightarrow> SNa (M'{x:=<c>.P})\" by (simp add: a_star_preserves_SNa)\n  }\n  then show \"(x):M' \\<in> BINDINGn B (\\<parallel><B>\\<parallel>)\" by (auto simp add: BINDINGn_def)\nqed\n    \nlemma CANDs_preserved:\n  shows \"<a>:M \\<in> \\<parallel><B>\\<parallel> \\<Longrightarrow> M \\<longrightarrow>\\<^sub>a* M' \\<Longrightarrow> <a>:M' \\<in> \\<parallel><B>\\<parallel>\"\n  and   \"(x):M \\<in> \\<parallel>(B)\\<parallel> \\<Longrightarrow> M \\<longrightarrow>\\<^sub>a* M' \\<Longrightarrow> (x):M' \\<in> \\<parallel>(B)\\<parallel>\" \nproof(nominal_induct B arbitrary: a x M M' rule: ty.strong_induct) \n  case (PR X)\n  { case 1 \n    have asm: \"M \\<longrightarrow>\\<^sub>a* M'\" by fact\n    have \"<a>:M \\<in> \\<parallel><PR X>\\<parallel>\" by fact\n    then have \"<a>:M \\<in> NEGc (PR X) (\\<parallel>(PR X)\\<parallel>)\" by simp\n    then have \"<a>:M \\<in> AXIOMSc (PR X) \\<union> BINDINGc (PR X) (\\<parallel>(PR X)\\<parallel>)\" by simp\n    moreover\n    { assume \"<a>:M \\<in> AXIOMSc (PR X)\"\n      then have \"<a>:M' \\<in> AXIOMSc (PR X)\" using asm by (simp only: AXIOMS_preserved)\n    }\n    moreover\n    { assume \"<a>:M \\<in> BINDINGc (PR X) (\\<parallel>(PR X)\\<parallel>)\"\n      then have \"<a>:M' \\<in> BINDINGc (PR X) (\\<parallel>(PR X)\\<parallel>)\" using asm by (simp add: BINDING_preserved)\n    }\n    ultimately have \"<a>:M' \\<in> AXIOMSc (PR X) \\<union> BINDINGc (PR X) (\\<parallel>(PR X)\\<parallel>)\" by blast\n    then have \"<a>:M' \\<in> NEGc (PR X) (\\<parallel>(PR X)\\<parallel>)\" by simp\n    then show \"<a>:M' \\<in> (\\<parallel><PR X>\\<parallel>)\" using NEG_simp by blast\n  next\n    case 2\n    have asm: \"M \\<longrightarrow>\\<^sub>a* M'\" by fact\n    have \"(x):M \\<in> \\<parallel>(PR X)\\<parallel>\" by fact\n    then have \"(x):M \\<in> NEGn (PR X) (\\<parallel><PR X>\\<parallel>)\" using NEG_simp by blast\n    then have \"(x):M \\<in> AXIOMSn (PR X) \\<union> BINDINGn (PR X) (\\<parallel><PR X>\\<parallel>)\" by simp\n    moreover\n    { assume \"(x):M \\<in> AXIOMSn (PR X)\"\n      then have \"(x):M' \\<in> AXIOMSn (PR X)\" using asm by (simp only: AXIOMS_preserved) \n    }\n    moreover\n    { assume \"(x):M \\<in> BINDINGn (PR X) (\\<parallel><PR X>\\<parallel>)\"\n      then have \"(x):M' \\<in> BINDINGn (PR X) (\\<parallel><PR X>\\<parallel>)\" using asm by (simp only: BINDING_preserved)\n    }\n    ultimately have \"(x):M' \\<in> AXIOMSn (PR X) \\<union> BINDINGn (PR X) (\\<parallel><PR X>\\<parallel>)\" by blast\n    then have \"(x):M' \\<in> NEGn (PR X) (\\<parallel><PR X>\\<parallel>)\" by simp\n    then show \"(x):M' \\<in> (\\<parallel>(PR X)\\<parallel>)\" using NEG_simp by blast\n  }\nnext\n  case (IMP A B)\n  have ih1: \"\\<And>a M M'. \\<lbrakk><a>:M \\<in> \\<parallel><A>\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> <a>:M' \\<in> \\<parallel><A>\\<parallel>\" by fact\n  have ih2: \"\\<And>x M M'. \\<lbrakk>(x):M \\<in> \\<parallel>(A)\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> (x):M' \\<in> \\<parallel>(A)\\<parallel>\" by fact\n  have ih3: \"\\<And>a M M'. \\<lbrakk><a>:M \\<in> \\<parallel><B>\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> <a>:M' \\<in> \\<parallel><B>\\<parallel>\" by fact\n  have ih4: \"\\<And>x M M'. \\<lbrakk>(x):M \\<in> \\<parallel>(B)\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> (x):M' \\<in> \\<parallel>(B)\\<parallel>\" by fact\n  { case 1 \n    have asm: \"M \\<longrightarrow>\\<^sub>a* M'\" by fact\n    have \"<a>:M \\<in> \\<parallel><A IMP B>\\<parallel>\" by fact\n    then have \"<a>:M \\<in> NEGc (A IMP B) (\\<parallel>(A IMP B)\\<parallel>)\" by simp\n    then have \"<a>:M \\<in> AXIOMSc (A IMP B) \\<union> BINDINGc (A IMP B) (\\<parallel>(A IMP B)\\<parallel>) \n                            \\<union> IMPRIGHT (A IMP B) (\\<parallel>(A)\\<parallel>) (\\<parallel><B>\\<parallel>) (\\<parallel>(B)\\<parallel>) (\\<parallel><A>\\<parallel>)\" by simp\n    moreover\n    { assume \"<a>:M \\<in> AXIOMSc (A IMP B)\"\n      then have \"<a>:M' \\<in> AXIOMSc (A IMP B)\" using asm by (simp only: AXIOMS_preserved)\n    }\n    moreover\n    { assume \"<a>:M \\<in> BINDINGc (A IMP B) (\\<parallel>(A IMP B)\\<parallel>)\"\n      then have \"<a>:M' \\<in> BINDINGc (A IMP B) (\\<parallel>(A IMP B)\\<parallel>)\" using asm by (simp only: BINDING_preserved)\n    }\n    moreover\n    { assume \"<a>:M \\<in> IMPRIGHT (A IMP B) (\\<parallel>(A)\\<parallel>) (\\<parallel><B>\\<parallel>) (\\<parallel>(B)\\<parallel>) (\\<parallel><A>\\<parallel>)\"\n      then obtain x' a' N' where eq: \"M = ImpR (x').<a'>.N' a\" and fic: \"fic (ImpR (x').<a'>.N' a) a\"\n                           and imp1: \"\\<forall>z P. x'\\<sharp>(z,P) \\<and> (z):P \\<in> \\<parallel>(B)\\<parallel> \\<longrightarrow> (x'):(N'{a':=(z).P}) \\<in> \\<parallel>(A)\\<parallel>\" \n                           and imp2: \"\\<forall>c Q. a'\\<sharp>(c,Q) \\<and> <c>:Q \\<in> \\<parallel><A>\\<parallel> \\<longrightarrow> <a'>:(N'{x':=<c>.Q}) \\<in> \\<parallel><B>\\<parallel>\"\n        using IMPRIGHT_elim by blast\n      from eq asm obtain N'' where eq': \"M' = ImpR (x').<a'>.N'' a\" and red: \"N' \\<longrightarrow>\\<^sub>a* N''\" \n        using a_star_redu_ImpR_elim by (blast)\n      from imp1 have \"\\<forall>z P. x'\\<sharp>(z,P) \\<and> (z):P \\<in> \\<parallel>(B)\\<parallel> \\<longrightarrow> (x'):(N''{a':=(z).P}) \\<in> \\<parallel>(A)\\<parallel>\" using red ih2\n        apply(auto)\n        apply(drule_tac x=\"z\" in spec)\n        apply(drule_tac x=\"P\" in spec)\n        apply(simp)\n        apply(drule_tac a_star_subst2)\n        apply(blast)\n        done\n      moreover\n      from imp2 have \"\\<forall>c Q. a'\\<sharp>(c,Q) \\<and> <c>:Q \\<in> \\<parallel><A>\\<parallel> \\<longrightarrow> <a'>:(N''{x':=<c>.Q}) \\<in> \\<parallel><B>\\<parallel>\" using red ih3\n        apply(auto)\n        apply(drule_tac x=\"c\" in spec)\n        apply(drule_tac x=\"Q\" in spec)\n        apply(simp)\n        apply(drule_tac a_star_subst1)\n        apply(blast)\n        done\n      moreover\n      from fic have \"fic M' a\" using eq asm by (simp add: fic_a_star_reduce)\n      ultimately have \"<a>:M' \\<in> IMPRIGHT (A IMP B) (\\<parallel>(A)\\<parallel>) (\\<parallel><B>\\<parallel>) (\\<parallel>(B)\\<parallel>) (\\<parallel><A>\\<parallel>)\" using eq' by auto\n    }\n    ultimately have \"<a>:M' \\<in> AXIOMSc (A IMP B) \\<union> BINDINGc (A IMP B) (\\<parallel>(A IMP B)\\<parallel>)\n                                            \\<union> IMPRIGHT (A IMP B) (\\<parallel>(A)\\<parallel>) (\\<parallel><B>\\<parallel>) (\\<parallel>(B)\\<parallel>) (\\<parallel><A>\\<parallel>)\" by blast\n    then have \"<a>:M' \\<in> NEGc (A IMP B) (\\<parallel>(A IMP B)\\<parallel>)\" by simp\n    then show \"<a>:M' \\<in> (\\<parallel><A IMP B>\\<parallel>)\" using NEG_simp by blast\n  next\n    case 2\n    have asm: \"M \\<longrightarrow>\\<^sub>a* M'\" by fact\n    have \"(x):M \\<in> \\<parallel>(A IMP B)\\<parallel>\" by fact\n    then have \"(x):M \\<in> NEGn (A IMP B) (\\<parallel><A IMP B>\\<parallel>)\" using NEG_simp by blast\n    then have \"(x):M \\<in> AXIOMSn (A IMP B) \\<union> BINDINGn (A IMP B) (\\<parallel><A IMP B>\\<parallel>) \n                                              \\<union> IMPLEFT (A IMP B) (\\<parallel><A>\\<parallel>) (\\<parallel>(B)\\<parallel>)\" by simp\n    moreover\n    { assume \"(x):M \\<in> AXIOMSn (A IMP B)\"\n      then have \"(x):M' \\<in> AXIOMSn (A IMP B)\" using asm by (simp only: AXIOMS_preserved)\n    }\n    moreover\n    { assume \"(x):M \\<in> BINDINGn (A IMP B) (\\<parallel><A IMP B>\\<parallel>)\"\n      then have \"(x):M' \\<in> BINDINGn (A IMP B) (\\<parallel><A IMP B>\\<parallel>)\" using asm by (simp only: BINDING_preserved)\n    }\n    moreover\n    { assume \"(x):M \\<in> IMPLEFT (A IMP B) (\\<parallel><A>\\<parallel>) (\\<parallel>(B)\\<parallel>)\"\n      then obtain a' T' y' N' where eq: \"M = ImpL <a'>.T' (y').N' x\" \n                             and fin: \"fin (ImpL <a'>.T' (y').N' x) x\"\n                             and imp1: \"<a'>:T' \\<in> \\<parallel><A>\\<parallel>\" and imp2: \"(y'):N' \\<in> \\<parallel>(B)\\<parallel>\"\n        by (erule_tac IMPLEFT_elim, blast)\n      from eq asm obtain T'' N'' where eq': \"M' = ImpL <a'>.T'' (y').N'' x\" \n                                 and red1: \"T' \\<longrightarrow>\\<^sub>a* T''\"  and red2: \"N' \\<longrightarrow>\\<^sub>a* N''\"\n        using a_star_redu_ImpL_elim by blast\n      from fin have \"fin M' x\" using eq asm by (simp add: fin_a_star_reduce)\n      moreover\n      from imp1 red1 have \"<a'>:T'' \\<in> \\<parallel><A>\\<parallel>\" using ih1 by simp\n      moreover\n      from imp2 red2 have \"(y'):N'' \\<in> \\<parallel>(B)\\<parallel>\" using ih4 by simp\n      ultimately have \"(x):M' \\<in> IMPLEFT (A IMP B) (\\<parallel><A>\\<parallel>) (\\<parallel>(B)\\<parallel>)\" using eq' by (simp, blast) \n    }\n    ultimately have \"(x):M' \\<in> AXIOMSn (A IMP B) \\<union> BINDINGn (A IMP B) (\\<parallel><A IMP B>\\<parallel>)\n                                              \\<union> IMPLEFT (A IMP B) (\\<parallel><A>\\<parallel>) (\\<parallel>(B)\\<parallel>)\" by blast\n    then have \"(x):M' \\<in> NEGn (A IMP B) (\\<parallel><A IMP B>\\<parallel>)\" by simp\n    then show \"(x):M' \\<in> (\\<parallel>(A IMP B)\\<parallel>)\" using NEG_simp by blast\n  }\nnext\n  case (AND A B)\n  have ih1: \"\\<And>a M M'. \\<lbrakk><a>:M \\<in> \\<parallel><A>\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> <a>:M' \\<in> \\<parallel><A>\\<parallel>\" by fact\n  have ih2: \"\\<And>x M M'. \\<lbrakk>(x):M \\<in> \\<parallel>(A)\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> (x):M' \\<in> \\<parallel>(A)\\<parallel>\" by fact\n  have ih3: \"\\<And>a M M'. \\<lbrakk><a>:M \\<in> \\<parallel><B>\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> <a>:M' \\<in> \\<parallel><B>\\<parallel>\" by fact\n  have ih4: \"\\<And>x M M'. \\<lbrakk>(x):M \\<in> \\<parallel>(B)\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> (x):M' \\<in> \\<parallel>(B)\\<parallel>\" by fact\n  { case 1 \n    have asm: \"M \\<longrightarrow>\\<^sub>a* M'\" by fact\n    have \"<a>:M \\<in> \\<parallel><A AND B>\\<parallel>\" by fact\n    then have \"<a>:M \\<in> NEGc (A AND B) (\\<parallel>(A AND B)\\<parallel>)\" by simp\n    then have \"<a>:M \\<in> AXIOMSc (A AND B) \\<union> BINDINGc (A AND B) (\\<parallel>(A AND B)\\<parallel>) \n                                              \\<union> ANDRIGHT (A AND B) (\\<parallel><A>\\<parallel>) (\\<parallel><B>\\<parallel>)\" by simp\n    moreover\n    { assume \"<a>:M \\<in> AXIOMSc (A AND B)\"\n      then have \"<a>:M' \\<in> AXIOMSc (A AND B)\" using asm by (simp only: AXIOMS_preserved)\n    }\n    moreover\n    { assume \"<a>:M \\<in> BINDINGc (A AND B) (\\<parallel>(A AND B)\\<parallel>)\"\n      then have \"<a>:M' \\<in> BINDINGc (A AND B) (\\<parallel>(A AND B)\\<parallel>)\" using asm by (simp only: BINDING_preserved)\n    }\n    moreover\n    { assume \"<a>:M \\<in> ANDRIGHT (A AND B) (\\<parallel><A>\\<parallel>) (\\<parallel><B>\\<parallel>)\"\n      then obtain a' T' b' N' where eq: \"M = AndR <a'>.T' <b'>.N' a\" \n                              and fic: \"fic (AndR <a'>.T' <b'>.N' a) a\"\n                           and imp1: \"<a'>:T' \\<in> \\<parallel><A>\\<parallel>\" and imp2: \"<b'>:N' \\<in> \\<parallel><B>\\<parallel>\"\n        using ANDRIGHT_elim by blast\n      from eq asm obtain T'' N'' where eq': \"M' = AndR <a'>.T'' <b'>.N'' a\" \n                          and red1: \"T' \\<longrightarrow>\\<^sub>a* T''\" and red2: \"N' \\<longrightarrow>\\<^sub>a* N''\" \n        using a_star_redu_AndR_elim by blast\n      from fic have \"fic M' a\" using eq asm by (simp add: fic_a_star_reduce)\n      moreover\n      from imp1 red1 have \"<a'>:T'' \\<in> \\<parallel><A>\\<parallel>\" using ih1 by simp\n      moreover\n      from imp2 red2 have \"<b'>:N'' \\<in> \\<parallel><B>\\<parallel>\" using ih3 by simp\n      ultimately have \"<a>:M' \\<in> ANDRIGHT (A AND B) (\\<parallel><A>\\<parallel>) (\\<parallel><B>\\<parallel>)\" using eq' by (simp, blast) \n    }\n    ultimately have \"<a>:M' \\<in> AXIOMSc (A AND B) \\<union> BINDINGc (A AND B) (\\<parallel>(A AND B)\\<parallel>)\n                                              \\<union> ANDRIGHT (A AND B) (\\<parallel><A>\\<parallel>) (\\<parallel><B>\\<parallel>)\" by blast\n    then have \"<a>:M' \\<in> NEGc (A AND B) (\\<parallel>(A AND B)\\<parallel>)\" by simp\n    then show \"<a>:M' \\<in> (\\<parallel><A AND B>\\<parallel>)\" using NEG_simp by blast\n  next\n    case 2\n    have asm: \"M \\<longrightarrow>\\<^sub>a* M'\" by fact\n    have \"(x):M \\<in> \\<parallel>(A AND B)\\<parallel>\" by fact\n    then have \"(x):M \\<in> NEGn (A AND B) (\\<parallel><A AND B>\\<parallel>)\" using NEG_simp by blast\n    then have \"(x):M \\<in> AXIOMSn (A AND B) \\<union> BINDINGn (A AND B) (\\<parallel><A AND B>\\<parallel>) \n                                     \\<union> ANDLEFT1 (A AND B) (\\<parallel>(A)\\<parallel>) \\<union> ANDLEFT2 (A AND B) (\\<parallel>(B)\\<parallel>)\" by simp\n    moreover\n    { assume \"(x):M \\<in> AXIOMSn (A AND B)\"\n      then have \"(x):M' \\<in> AXIOMSn (A AND B)\" using asm by (simp only: AXIOMS_preserved)\n    }\n    moreover\n    { assume \"(x):M \\<in> BINDINGn (A AND B) (\\<parallel><A AND B>\\<parallel>)\"\n      then have \"(x):M' \\<in> BINDINGn (A AND B) (\\<parallel><A AND B>\\<parallel>)\" using asm by (simp only: BINDING_preserved)\n    }\n    moreover\n    { assume \"(x):M \\<in> ANDLEFT1 (A AND B) (\\<parallel>(A)\\<parallel>)\"\n      then obtain y' N' where eq: \"M = AndL1 (y').N' x\" \n                             and fin: \"fin (AndL1 (y').N' x) x\" and imp: \"(y'):N' \\<in> \\<parallel>(A)\\<parallel>\"\n        by (erule_tac ANDLEFT1_elim, blast)\n      from eq asm obtain N'' where eq': \"M' = AndL1 (y').N'' x\" and red1: \"N' \\<longrightarrow>\\<^sub>a* N''\"\n        using a_star_redu_AndL1_elim by blast\n      from fin have \"fin M' x\" using eq asm by (simp add: fin_a_star_reduce)\n      moreover\n      from imp red1 have \"(y'):N'' \\<in> \\<parallel>(A)\\<parallel>\" using ih2 by simp\n      ultimately have \"(x):M' \\<in> ANDLEFT1 (A AND B) (\\<parallel>(A)\\<parallel>)\" using eq' by (simp, blast) \n    }\n     moreover\n    { assume \"(x):M \\<in> ANDLEFT2 (A AND B) (\\<parallel>(B)\\<parallel>)\"\n      then obtain y' N' where eq: \"M = AndL2 (y').N' x\" \n                             and fin: \"fin (AndL2 (y').N' x) x\" and imp: \"(y'):N' \\<in> \\<parallel>(B)\\<parallel>\"\n        by (erule_tac ANDLEFT2_elim, blast)\n      from eq asm obtain N'' where eq': \"M' = AndL2 (y').N'' x\" and red1: \"N' \\<longrightarrow>\\<^sub>a* N''\"\n        using a_star_redu_AndL2_elim by blast\n      from fin have \"fin M' x\" using eq asm by (simp add: fin_a_star_reduce)\n      moreover\n      from imp red1 have \"(y'):N'' \\<in> \\<parallel>(B)\\<parallel>\" using ih4 by simp\n      ultimately have \"(x):M' \\<in> ANDLEFT2 (A AND B) (\\<parallel>(B)\\<parallel>)\" using eq' by (simp, blast) \n    }\n    ultimately have \"(x):M' \\<in> AXIOMSn (A AND B) \\<union> BINDINGn (A AND B) (\\<parallel><A AND B>\\<parallel>)\n                               \\<union> ANDLEFT1 (A AND B) (\\<parallel>(A)\\<parallel>) \\<union> ANDLEFT2 (A AND B) (\\<parallel>(B)\\<parallel>)\" by blast\n    then have \"(x):M' \\<in> NEGn (A AND B) (\\<parallel><A AND B>\\<parallel>)\" by simp\n    then show \"(x):M' \\<in> (\\<parallel>(A AND B)\\<parallel>)\" using NEG_simp by blast\n  }\nnext    \n case (OR A B)\n  have ih1: \"\\<And>a M M'. \\<lbrakk><a>:M \\<in> \\<parallel><A>\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> <a>:M' \\<in> \\<parallel><A>\\<parallel>\" by fact\n  have ih2: \"\\<And>x M M'. \\<lbrakk>(x):M \\<in> \\<parallel>(A)\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> (x):M' \\<in> \\<parallel>(A)\\<parallel>\" by fact\n  have ih3: \"\\<And>a M M'. \\<lbrakk><a>:M \\<in> \\<parallel><B>\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> <a>:M' \\<in> \\<parallel><B>\\<parallel>\" by fact\n  have ih4: \"\\<And>x M M'. \\<lbrakk>(x):M \\<in> \\<parallel>(B)\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> (x):M' \\<in> \\<parallel>(B)\\<parallel>\" by fact\n  { case 1 \n    have asm: \"M \\<longrightarrow>\\<^sub>a* M'\" by fact\n    have \"<a>:M \\<in> \\<parallel><A OR B>\\<parallel>\" by fact\n    then have \"<a>:M \\<in> NEGc (A OR B) (\\<parallel>(A OR B)\\<parallel>)\" by simp\n    then have \"<a>:M \\<in> AXIOMSc (A OR B) \\<union> BINDINGc (A OR B) (\\<parallel>(A OR B)\\<parallel>) \n                          \\<union> ORRIGHT1 (A OR B) (\\<parallel><A>\\<parallel>) \\<union> ORRIGHT2 (A OR B) (\\<parallel><B>\\<parallel>)\" by simp\n    moreover\n    { assume \"<a>:M \\<in> AXIOMSc (A OR B)\"\n      then have \"<a>:M' \\<in> AXIOMSc (A OR B)\" using asm by (simp only: AXIOMS_preserved)\n    }\n    moreover\n    { assume \"<a>:M \\<in> BINDINGc (A OR B) (\\<parallel>(A OR B)\\<parallel>)\"\n      then have \"<a>:M' \\<in> BINDINGc (A OR B) (\\<parallel>(A OR B)\\<parallel>)\" using asm by (simp only: BINDING_preserved)\n    }\n    moreover\n    { assume \"<a>:M \\<in> ORRIGHT1 (A OR B) (\\<parallel><A>\\<parallel>)\"\n      then obtain a' N' where eq: \"M = OrR1 <a'>.N' a\" \n                              and fic: \"fic (OrR1 <a'>.N' a) a\" and imp1: \"<a'>:N' \\<in> \\<parallel><A>\\<parallel>\"\n        using ORRIGHT1_elim by blast\n      from eq asm obtain N'' where eq': \"M' = OrR1 <a'>.N'' a\" and red1: \"N' \\<longrightarrow>\\<^sub>a* N''\" \n        using a_star_redu_OrR1_elim by blast\n      from fic have \"fic M' a\" using eq asm by (simp add: fic_a_star_reduce)\n      moreover\n      from imp1 red1 have \"<a'>:N'' \\<in> \\<parallel><A>\\<parallel>\" using ih1 by simp\n      ultimately have \"<a>:M' \\<in> ORRIGHT1 (A OR B) (\\<parallel><A>\\<parallel>)\" using eq' by (simp, blast) \n    }\n    moreover\n    { assume \"<a>:M \\<in> ORRIGHT2 (A OR B) (\\<parallel><B>\\<parallel>)\"\n      then obtain a' N' where eq: \"M = OrR2 <a'>.N' a\" \n                              and fic: \"fic (OrR2 <a'>.N' a) a\" and imp1: \"<a'>:N' \\<in> \\<parallel><B>\\<parallel>\"\n        using ORRIGHT2_elim by blast\n      from eq asm obtain N'' where eq': \"M' = OrR2 <a'>.N'' a\" and red1: \"N' \\<longrightarrow>\\<^sub>a* N''\" \n        using a_star_redu_OrR2_elim by blast\n      from fic have \"fic M' a\" using eq asm by (simp add: fic_a_star_reduce)\n      moreover\n      from imp1 red1 have \"<a'>:N'' \\<in> \\<parallel><B>\\<parallel>\" using ih3 by simp\n      ultimately have \"<a>:M' \\<in> ORRIGHT2 (A OR B) (\\<parallel><B>\\<parallel>)\" using eq' by (simp, blast) \n    }\n    ultimately have \"<a>:M' \\<in> AXIOMSc (A OR B) \\<union> BINDINGc (A OR B) (\\<parallel>(A OR B)\\<parallel>)\n                                \\<union> ORRIGHT1 (A OR B) (\\<parallel><A>\\<parallel>) \\<union> ORRIGHT2 (A OR B) (\\<parallel><B>\\<parallel>)\" by blast\n    then have \"<a>:M' \\<in> NEGc (A OR B) (\\<parallel>(A OR B)\\<parallel>)\" by simp\n    then show \"<a>:M' \\<in> (\\<parallel><A OR B>\\<parallel>)\" using NEG_simp by blast\n  next\n    case 2\n    have asm: \"M \\<longrightarrow>\\<^sub>a* M'\" by fact\n    have \"(x):M \\<in> \\<parallel>(A OR B)\\<parallel>\" by fact\n    then have \"(x):M \\<in> NEGn (A OR B) (\\<parallel><A OR B>\\<parallel>)\" using NEG_simp by blast\n    then have \"(x):M \\<in> AXIOMSn (A OR B) \\<union> BINDINGn (A OR B) (\\<parallel><A OR B>\\<parallel>) \n                                     \\<union> ORLEFT (A OR B) (\\<parallel>(A)\\<parallel>) (\\<parallel>(B)\\<parallel>)\" by simp\n    moreover\n    { assume \"(x):M \\<in> AXIOMSn (A OR B)\"\n      then have \"(x):M' \\<in> AXIOMSn (A OR B)\" using asm by (simp only: AXIOMS_preserved)\n    }\n    moreover\n    { assume \"(x):M \\<in> BINDINGn (A OR B) (\\<parallel><A OR B>\\<parallel>)\"\n      then have \"(x):M' \\<in> BINDINGn (A OR B) (\\<parallel><A OR B>\\<parallel>)\" using asm by (simp only: BINDING_preserved)\n    }\n    moreover\n    { assume \"(x):M \\<in> ORLEFT (A OR B) (\\<parallel>(A)\\<parallel>) (\\<parallel>(B)\\<parallel>)\"\n      then obtain y' T' z' N' where eq: \"M = OrL (y').T' (z').N' x\" \n                             and fin: \"fin (OrL (y').T' (z').N' x) x\" \n                             and imp1: \"(y'):T' \\<in> \\<parallel>(A)\\<parallel>\" and imp2: \"(z'):N' \\<in> \\<parallel>(B)\\<parallel>\"\n        by (erule_tac ORLEFT_elim, blast)\n      from eq asm obtain T'' N'' where eq': \"M' = OrL (y').T'' (z').N'' x\" \n                and red1: \"T' \\<longrightarrow>\\<^sub>a* T''\" and red2: \"N' \\<longrightarrow>\\<^sub>a* N''\"\n        using a_star_redu_OrL_elim by blast\n      from fin have \"fin M' x\" using eq asm by (simp add: fin_a_star_reduce)\n      moreover\n      from imp1 red1 have \"(y'):T'' \\<in> \\<parallel>(A)\\<parallel>\" using ih2 by simp\n      moreover\n      from imp2 red2 have \"(z'):N'' \\<in> \\<parallel>(B)\\<parallel>\" using ih4 by simp\n      ultimately have \"(x):M' \\<in> ORLEFT (A OR B) (\\<parallel>(A)\\<parallel>) (\\<parallel>(B)\\<parallel>)\" using eq' by (simp, blast) \n    }\n    ultimately have \"(x):M' \\<in> AXIOMSn (A OR B) \\<union> BINDINGn (A OR B) (\\<parallel><A OR B>\\<parallel>)\n                               \\<union> ORLEFT (A OR B) (\\<parallel>(A)\\<parallel>) (\\<parallel>(B)\\<parallel>)\" by blast\n    then have \"(x):M' \\<in> NEGn (A OR B) (\\<parallel><A OR B>\\<parallel>)\" by simp\n    then show \"(x):M' \\<in> (\\<parallel>(A OR B)\\<parallel>)\" using NEG_simp by blast\n  }\nnext\n  case (NOT A)\n  have ih1: \"\\<And>a M M'. \\<lbrakk><a>:M \\<in> \\<parallel><A>\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> <a>:M' \\<in> \\<parallel><A>\\<parallel>\" by fact\n  have ih2: \"\\<And>x M M'. \\<lbrakk>(x):M \\<in> \\<parallel>(A)\\<parallel>; M \\<longrightarrow>\\<^sub>a* M'\\<rbrakk> \\<Longrightarrow> (x):M' \\<in> \\<parallel>(A)\\<parallel>\" by fact\n  { case 1 \n    have asm: \"M \\<longrightarrow>\\<^sub>a* M'\" by fact\n    have \"<a>:M \\<in> \\<parallel><NOT A>\\<parallel>\" by fact\n    then have \"<a>:M \\<in> NEGc (NOT A) (\\<parallel>(NOT A)\\<parallel>)\" by simp\n    then have \"<a>:M \\<in> AXIOMSc (NOT A) \\<union> BINDINGc (NOT A) (\\<parallel>(NOT A)\\<parallel>) \n                                              \\<union> NOTRIGHT (NOT A) (\\<parallel>(A)\\<parallel>)\" by simp\n    moreover\n    { assume \"<a>:M \\<in> AXIOMSc (NOT A)\"\n      then have \"<a>:M' \\<in> AXIOMSc (NOT A)\" using asm by (simp only: AXIOMS_preserved)\n    }\n    moreover\n    { assume \"<a>:M \\<in> BINDINGc (NOT A) (\\<parallel>(NOT A)\\<parallel>)\"\n      then have \"<a>:M' \\<in> BINDINGc (NOT A) (\\<parallel>(NOT A)\\<parallel>)\" using asm by (simp only: BINDING_preserved)\n    }\n    moreover\n    { assume \"<a>:M \\<in> NOTRIGHT (NOT A) (\\<parallel>(A)\\<parallel>)\"\n      then obtain y' N' where eq: \"M = NotR (y').N' a\" \n                              and fic: \"fic (NotR (y').N' a) a\" and imp: \"(y'):N' \\<in> \\<parallel>(A)\\<parallel>\"\n        using NOTRIGHT_elim by blast\n      from eq asm obtain N'' where eq': \"M' = NotR (y').N'' a\" and red: \"N' \\<longrightarrow>\\<^sub>a* N''\" \n        using a_star_redu_NotR_elim by blast\n      from fic have \"fic M' a\" using eq asm by (simp add: fic_a_star_reduce)\n      moreover\n      from imp red have \"(y'):N'' \\<in> \\<parallel>(A)\\<parallel>\" using ih2 by simp\n      ultimately have \"<a>:M' \\<in> NOTRIGHT (NOT A) (\\<parallel>(A)\\<parallel>)\" using eq' by (simp, blast) \n    }\n    ultimately have \"<a>:M' \\<in> AXIOMSc (NOT A) \\<union> BINDINGc (NOT A) (\\<parallel>(NOT A)\\<parallel>)\n                                              \\<union> NOTRIGHT (NOT A) (\\<parallel>(A)\\<parallel>)\" by blast\n    then have \"<a>:M' \\<in> NEGc (NOT A) (\\<parallel>(NOT A)\\<parallel>)\" by simp\n    then show \"<a>:M' \\<in> (\\<parallel><NOT A>\\<parallel>)\" using NEG_simp by blast\n  next\n    case 2\n    have asm: \"M \\<longrightarrow>\\<^sub>a* M'\" by fact\n    have \"(x):M \\<in> \\<parallel>(NOT A)\\<parallel>\" by fact\n    then have \"(x):M \\<in> NEGn (NOT A) (\\<parallel><NOT A>\\<parallel>)\" using NEG_simp by blast\n    then have \"(x):M \\<in> AXIOMSn (NOT A) \\<union> BINDINGn (NOT A) (\\<parallel><NOT A>\\<parallel>) \n                                     \\<union> NOTLEFT (NOT A) (\\<parallel><A>\\<parallel>)\" by simp\n    moreover\n    { assume \"(x):M \\<in> AXIOMSn (NOT A)\"\n      then have \"(x):M' \\<in> AXIOMSn (NOT A)\" using asm by (simp only: AXIOMS_preserved)\n    }\n    moreover\n    { assume \"(x):M \\<in> BINDINGn (NOT A) (\\<parallel><NOT A>\\<parallel>)\"\n      then have \"(x):M' \\<in> BINDINGn (NOT A) (\\<parallel><NOT A>\\<parallel>)\" using asm by (simp only: BINDING_preserved)\n    }\n    moreover\n    { assume \"(x):M \\<in> NOTLEFT (NOT A) (\\<parallel><A>\\<parallel>)\"\n      then obtain a' N' where eq: \"M = NotL <a'>.N' x\" \n                             and fin: \"fin (NotL <a'>.N' x) x\" and imp: \"<a'>:N' \\<in> \\<parallel><A>\\<parallel>\"\n        by (erule_tac NOTLEFT_elim, blast)\n      from eq asm obtain N'' where eq': \"M' = NotL <a'>.N'' x\" and red1: \"N' \\<longrightarrow>\\<^sub>a* N''\"\n        using a_star_redu_NotL_elim by blast\n      from fin have \"fin M' x\" using eq asm by (simp add: fin_a_star_reduce)\n      moreover\n      from imp red1 have \"<a'>:N'' \\<in> \\<parallel><A>\\<parallel>\" using ih1 by simp\n      ultimately have \"(x):M' \\<in> NOTLEFT (NOT A) (\\<parallel><A>\\<parallel>)\" using eq' by (simp, blast) \n    }\n    ultimately have \"(x):M' \\<in> AXIOMSn (NOT A) \\<union> BINDINGn (NOT A) (\\<parallel><NOT A>\\<parallel>)\n                               \\<union> NOTLEFT (NOT A) (\\<parallel><A>\\<parallel>)\" by blast\n    then have \"(x):M' \\<in> NEGn (NOT A) (\\<parallel><NOT A>\\<parallel>)\" by simp\n    then show \"(x):M' \\<in> (\\<parallel>(NOT A)\\<parallel>)\" using NEG_simp by blast\n  }\nqed\n\nlemma CANDs_preserved_single:\n  shows \"<a>:M \\<in> \\<parallel><B>\\<parallel> \\<Longrightarrow> M \\<longrightarrow>\\<^sub>a M' \\<Longrightarrow> <a>:M' \\<in> \\<parallel><B>\\<parallel>\"\n  and   \"(x):M \\<in> \\<parallel>(B)\\<parallel> \\<Longrightarrow> M \\<longrightarrow>\\<^sub>a M' \\<Longrightarrow> (x):M' \\<in> \\<parallel>(B)\\<parallel>\"\nby (auto simp add: a_starI CANDs_preserved)\n\nlemma fic_CANDS:\n  assumes a: \"\\<not>fic M a\"\n  and     b: \"<a>:M \\<in> \\<parallel><B>\\<parallel>\"\n  shows \"<a>:M \\<in> AXIOMSc B \\<or> <a>:M \\<in> BINDINGc B (\\<parallel>(B)\\<parallel>)\"\nusing a b\napply(nominal_induct B rule: ty.strong_induct)\napply(simp)\napply(simp)\napply(erule disjE)\napply(simp)\napply(erule disjE)\napply(simp)\napply(auto simp add: ctrm.inject)[1]\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(auto simp add: calc_atm)[1]\napply(drule_tac pi=\"[(a,aa)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(simp)\napply(erule disjE)\napply(simp)\napply(erule disjE)\napply(simp)\napply(auto simp add: ctrm.inject)[1]\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(erule conjE)+\napply(simp)\napply(drule_tac pi=\"[(a,c)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(simp)\napply(erule disjE)\napply(simp)\napply(erule disjE)\napply(simp)\napply(auto simp add: ctrm.inject)[1]\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(erule conjE)+\napply(simp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(erule conjE)+\napply(simp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\napply(simp)\napply(erule disjE)\napply(simp)\napply(erule disjE)\napply(simp)\napply(auto simp add: ctrm.inject)[1]\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(erule conjE)+\napply(simp)\napply(drule_tac pi=\"[(a,b)]\" in fic.eqvt(2))\napply(simp add: calc_atm)\ndone\n\nlemma fin_CANDS_aux:\n  assumes a: \"\\<not>fin M x\"\n  and     b: \"(x):M \\<in> (NEGn B (\\<parallel><B>\\<parallel>))\"\n  shows \"(x):M \\<in> AXIOMSn B \\<or> (x):M \\<in> BINDINGn B (\\<parallel><B>\\<parallel>)\"\nusing a b\napply(nominal_induct B rule: ty.strong_induct)\napply(simp)\napply(simp)\napply(erule disjE)\napply(simp)\napply(erule disjE)\napply(simp)\napply(auto simp add: ntrm.inject)[1]\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(auto simp add: calc_atm)[1]\napply(drule_tac pi=\"[(x,xa)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(simp)\napply(erule disjE)\napply(simp)\napply(erule disjE)\napply(simp)\napply(auto simp add: ntrm.inject)[1]\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(erule conjE)+\napply(simp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(erule conjE)+\napply(simp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(simp)\napply(erule disjE)\napply(simp)\napply(erule disjE)\napply(simp)\napply(auto simp add: ntrm.inject)[1]\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(erule conjE)+\napply(simp)\napply(drule_tac pi=\"[(x,z)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\napply(simp)\napply(erule disjE)\napply(simp)\napply(erule disjE)\napply(simp)\napply(auto simp add: ntrm.inject)[1]\napply(simp add: alpha)\napply(erule disjE)\napply(simp)\napply(erule conjE)+\napply(simp)\napply(drule_tac pi=\"[(x,y)]\" in fin.eqvt(1))\napply(simp add: calc_atm)\ndone\n\nlemma fin_CANDS:\n  assumes a: \"\\<not>fin M x\"\n  and     b: \"(x):M \\<in> (\\<parallel>(B)\\<parallel>)\"\n  shows \"(x):M \\<in> AXIOMSn B \\<or> (x):M \\<in> BINDINGn B (\\<parallel><B>\\<parallel>)\"\napply(rule fin_CANDS_aux)\napply(rule a)\napply(rule NEG_elim)\napply(rule b)\ndone\n\nlemma BINDING_implies_CAND:\n  shows \"<c>:M \\<in> BINDINGc B (\\<parallel>(B)\\<parallel>) \\<Longrightarrow> <c>:M \\<in> (\\<parallel><B>\\<parallel>)\"\n  and   \"(x):N \\<in> BINDINGn B (\\<parallel><B>\\<parallel>) \\<Longrightarrow> (x):N \\<in> (\\<parallel>(B)\\<parallel>)\"\napply -\napply(nominal_induct B rule: ty.strong_induct)\napply(auto)\napply(rule NEG_intro)\napply(nominal_induct B rule: ty.strong_induct)\napply(auto)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Nominal/Examples/Class2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3462784603982487}}
{"text": "(*\n  Author: Mohammad Abdulaziz, Fred Kurz\n*)\ntheory SAS_Plus_STRIPS\n  imports \"STRIPS_Semantics\" \"SAS_Plus_Semantics\" \n    \"Map_Supplement\"\nbegin\n\nsection \"SAS+/STRIPS Equivalence\"\n\ntext \\<open> The following part is concerned with showing the equivalent expressiveness of SAS+ and\nSTRIPS as discussed in \\autoref{sub:equivalence-sas-plus-strips}. \\<close>\n\nsubsection \"Translation of SAS+ Problems to STRIPS Problems\"\n\ndefinition possible_assignments_for \n  :: \"('variable, 'domain) sas_plus_problem \\<Rightarrow> 'variable \\<Rightarrow> ('variable \\<times> 'domain) list\" \n  where \"possible_assignments_for \\<Psi> v \\<equiv> [(v, a). a \\<leftarrow> the (range_of \\<Psi> v)]\"\n\ndefinition all_possible_assignments_for\n  :: \"('variable, 'domain) sas_plus_problem \\<Rightarrow> ('variable \\<times> 'domain) list\"\n  where \"all_possible_assignments_for \\<Psi> \n    \\<equiv> concat [possible_assignments_for \\<Psi> v. v \\<leftarrow> variables_of \\<Psi>]\" \n\ndefinition state_to_strips_state\n  :: \"('variable, 'domain) sas_plus_problem \n    \\<Rightarrow> ('variable, 'domain) state \n    \\<Rightarrow> ('variable, 'domain) assignment strips_state\" \n  (\"\\<phi>\\<^sub>S _ _\" 99)\n  where \"state_to_strips_state \\<Psi> s \n    \\<equiv> let defined = filter (\\<lambda>v. s v \\<noteq> None) (variables_of \\<Psi>) in\n      map_of (map (\\<lambda>(v, a). ((v, a), the (s v) = a)) \n        (concat [possible_assignments_for \\<Psi> v. v \\<leftarrow> defined]))\"\n\ndefinition sasp_op_to_strips\n  :: \"('variable, 'domain) sas_plus_problem\n    \\<Rightarrow> ('variable, 'domain) sas_plus_operator\n    \\<Rightarrow> ('variable, 'domain) assignment strips_operator\" \n  (\"\\<phi>\\<^sub>O _ _\" 99)\n  where \"sasp_op_to_strips \\<Psi> op \\<equiv> let\n      pre = precondition_of op\n      ; add = effect_of op\n      ; delete = [(v, a'). (v, a) \\<leftarrow> effect_of op, a' \\<leftarrow> filter ((\\<noteq>) a) (the (range_of \\<Psi> v))]\n    in STRIPS_Representation.operator_for pre add delete\"\n\ndefinition sas_plus_problem_to_strips_problem\n  :: \"('variable, 'domain) sas_plus_problem \\<Rightarrow> ('variable, 'domain) assignment strips_problem\" \n  (\"\\<phi> _ \" 99)\n  where \"sas_plus_problem_to_strips_problem \\<Psi> \\<equiv> let \n      vs = [as. v \\<leftarrow> variables_of \\<Psi>, as \\<leftarrow> (possible_assignments_for \\<Psi>) v]\n      ; ops = map (sasp_op_to_strips \\<Psi>) (operators_of \\<Psi>)\n      ; I = state_to_strips_state \\<Psi> (initial_of \\<Psi>)\n      ; G = state_to_strips_state \\<Psi> (goal_of \\<Psi>)\n    in STRIPS_Representation.problem_for vs ops I G\"\n\ndefinition sas_plus_parallel_plan_to_strips_parallel_plan\n  :: \"('variable, 'domain) sas_plus_problem\n    \\<Rightarrow> ('variable, 'domain) sas_plus_parallel_plan\n    \\<Rightarrow> ('variable \\<times> 'domain) strips_parallel_plan\" \n  (\"\\<phi>\\<^sub>P _ _\" 99)\n  where \"sas_plus_parallel_plan_to_strips_parallel_plan \\<Psi> \\<psi>\n    \\<equiv> [[sasp_op_to_strips \\<Psi> op. op \\<leftarrow> ops]. ops \\<leftarrow> \\<psi>]\"\n\n(* TODO first argument should be ('variable, 'domain) strips_problem *)\ndefinition strips_state_to_state\n  :: \"('variable, 'domain) sas_plus_problem\n    \\<Rightarrow> ('variable, 'domain) assignment strips_state\n    \\<Rightarrow> ('variable, 'domain) state\" \n  (\"\\<phi>\\<^sub>S\\<inverse> _ _\" 99)\n  where \"strips_state_to_state \\<Psi> s \n    \\<equiv> map_of (filter (\\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \\<Psi>))\"\n\n(* TODO remove problem argument *)\ndefinition strips_op_to_sasp \n  :: \"('variable, 'domain) sas_plus_problem \n    \\<Rightarrow> ('variable \\<times> 'domain) strips_operator\n    \\<Rightarrow> ('variable, 'domain) sas_plus_operator\"\n  (\"\\<phi>\\<^sub>O\\<inverse> _ _\" 99)\n  where \"strips_op_to_sasp \\<Psi> op \n    \\<equiv> let \n        precondition = strips_operator.precondition_of op\n        ; effect = strips_operator.add_effects_of op \n      in \\<lparr> precondition_of = precondition, effect_of = effect \\<rparr>\" \n\n(* TODO \\<open>strips_parallel_plan_to_sas_plus_parallel_plan \\<leadsto> \\<phi>_P\\<inverse>\\<close> and \n\\<open>strips_op_to_sasp \\<leadsto> \\<phi>_O\\<inverse>\\<close> *)\ndefinition strips_parallel_plan_to_sas_plus_parallel_plan\n  :: \"('variable, 'domain) sas_plus_problem\n    \\<Rightarrow> ('variable \\<times> 'domain) strips_parallel_plan\n    \\<Rightarrow> ('variable, 'domain) sas_plus_parallel_plan\" \n  (\"\\<phi>\\<^sub>P\\<inverse> _ _\" 99)\n  where \"strips_parallel_plan_to_sas_plus_parallel_plan \\<Pi> \\<pi>\n    \\<equiv> [[strips_op_to_sasp \\<Pi> op. op \\<leftarrow> ops]. ops \\<leftarrow> \\<pi>]\"\n\ntext \\<open> To set up the equivalence proof context, we declare a common locale \n\\isaname{sas_plus_strips_equivalence} for both the STRIPS and SAS+ formalisms and make it a \nsublocale of both locale \\isaname{strips} as well as \\isaname{sas_plus}.\nThe declaration itself is omitted for brevity since it basically just joins locales \n\\isaname{sas_plus} and \\isaname{strips} while renaming the locale parameter to avoid name clashes.\nThe sublocale proofs are shown below.\n\\footnote{We append a suffix identifying the respective formalism to the the parameter names \npassed to the parameter names in the locale. This is necessary to avoid ambiguous names in the \nsublocale declarations. For example, without addition of suffixes the type for \\<open>initial_of\\<close> is \nambiguous and will therefore not be bound to either \\<open>strips_problem.initial_of\\<close> or \n\\<open>sas_plus_problem.initial_of\\<close>. \nIsabelle in fact considers it to be a a free variable in this case. We also qualify the parent \nlocales in the sublocale declarations by adding \\texttt{strips:} and \\texttt{sas\\_plus:} before \nthe respective parent locale identifiers. } \\<close>\n\ndefinition \"range_of_strips \\<Pi> x \\<equiv> { True, False }\"\n\ncontext\nbegin\n\n\\<comment> \\<open> Set-up simp rules. \\<close>\n\n\nlemmas [simp] = range_of'_def\n\nlemma is_valid_problem_sas_plus_dom_sas_plus_problem_range_of:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n  shows \"\\<forall>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). v \\<in> dom (sas_plus_problem.range_of \\<Psi>)\"\n  using assms(1) is_valid_problem_sas_plus_then(1)\n  unfolding is_valid_problem_sas_plus_def\n  by (meson domIff list.pred_set)\n\nlemma possible_assignments_for_set_is:\n  assumes \"v \\<in> dom (sas_plus_problem.range_of \\<Psi>)\"\n  shows \"set (possible_assignments_for \\<Psi> v) \n    = { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v }\" \nproof -\n  have \"sas_plus_problem.range_of \\<Psi> v \\<noteq> None\"\n    using assms(1) \n    by auto\n  thus  ?thesis \n    unfolding possible_assignments_for_def\n    by fastforce\nqed\n\nlemma all_possible_assignments_for_set_is:\n  assumes \"\\<forall>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). range_of \\<Psi> v \\<noteq> None\" \n  shows \"set (all_possible_assignments_for \\<Psi>)\n    = (\\<Union>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\" \nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n  have \"set (all_possible_assignments_for \\<Psi>) = \n    (\\<Union>(set ` (\\<lambda>v. map (\\<lambda>(v, a). (v, a)) (possible_assignments_for \\<Psi> v)) ` set ?vs))\"\n    unfolding all_possible_assignments_for_def set_concat\n    using set_map \n    by auto\n  also have \"\\<dots> = (\\<Union>((\\<lambda>v. set (possible_assignments_for \\<Psi> v)) ` set ?vs))\"\n    using image_comp set_map\n    by simp\n  (* TODO slow *)\n  also have \"\\<dots> = (\\<Union>((\\<lambda>v. { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v }) ` set ?vs))\"\n    using possible_assignments_for_set_is assms \n    by fastforce\n  finally show ?thesis\n    by force\nqed\n\nlemma state_to_strips_state_dom_is_i[simp]:\n  assumes \"\\<forall>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). v \\<in> dom (sas_plus_problem.range_of \\<Psi>)\"\n  shows \"set (concat \n      [possible_assignments_for \\<Psi> v. v \\<leftarrow> filter (\\<lambda>v. s v \\<noteq> None) (variables_of \\<Psi>)])\n    = (\\<Union>v \\<in> { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None }. \n      { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\" \nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n  let ?defined = \"filter (\\<lambda>v. s v \\<noteq> None) ?vs\"\n  let ?l = \"concat [possible_assignments_for \\<Psi> v. v \\<leftarrow> ?defined]\"\n  have nb: \"set ?defined = { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None }\" \n    unfolding set_filter\n    by force\n  have \"set ?l = \\<Union>(set ` set (map (possible_assignments_for \\<Psi>) ?defined ))\" \n    unfolding set_concat image_Union\n    by blast\n  also have \"\\<dots> = \\<Union>(set ` (possible_assignments_for \\<Psi>) ` set ?defined)\" \n    unfolding set_map\n    by blast\n  also have \"\\<dots> = (\\<Union>v \\<in> set ?defined. set (possible_assignments_for \\<Psi> v))\"\n    by blast\n  also have \"\\<dots> = (\\<Union>v \\<in> { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None }.\n    set (possible_assignments_for \\<Psi> v))\"\n    using nb \n    by argo\n  finally show ?thesis\n    using possible_assignments_for_set_is \n      is_valid_problem_sas_plus_dom_sas_plus_problem_range_of assms(1)\n    by fastforce\nqed\n\nlemma state_to_strips_state_dom_is:\n  \\<comment> \\<open> NOTE A transformed state is defined on all possible assignments for all variables defined \nin the original state. \\<close>\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"dom (\\<phi>\\<^sub>S \\<Psi> s) \n    = (\\<Union>v \\<in> { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None }. \n      { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n  let ?l = \"concat [possible_assignments_for \\<Psi> v. v \\<leftarrow> filter (\\<lambda>v. s v \\<noteq> None) ?vs]\"\n  have nb: \"\\<forall>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). v \\<in> dom (sas_plus_problem.range_of \\<Psi>)\"\n    using is_valid_problem_sas_plus_dom_sas_plus_problem_range_of assms(1)\n    by fastforce\n  have \"dom (\\<phi>\\<^sub>S \\<Psi> s) = fst ` set (map (\\<lambda>(v, a). ((v, a), the (s v) = a)) ?l)\" \n    unfolding state_to_strips_state_def \n      SAS_Plus_STRIPS.state_to_strips_state_def \n    using dom_map_of_conv_image_fst[of \"map (\\<lambda>(v, a). ((v, a), the (s v) = a)) ?l\"]\n    by presburger\n  also have \"\\<dots> = fst ` (\\<lambda>(v, a). ((v, a), the (s v) = a)) ` set ?l\" \n    unfolding set_map\n    by blast\n  also have \"\\<dots> = (\\<lambda>(v, a). fst  ((v, a), the (s v) = a)) ` set ?l\"\n    unfolding image_comp[of fst \"\\<lambda>(v, a). ((v, a), the (s v) = a)\"] comp_apply[of \n        fst \"\\<lambda>(v, a). ((v, a), the (s v) = a)\"] prod.case_distrib\n    by blast\n  finally show ?thesis\n    unfolding state_to_strips_state_dom_is_i[OF nb]\n    by force\nqed\n\ncorollary state_to_strips_state_dom_element_iff:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"(v, a) \\<in> dom (\\<phi>\\<^sub>S \\<Psi> s) \\<longleftrightarrow> v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\n    \\<and> s v \\<noteq> None\n    \\<and> a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\"\n  show ?thesis \n    proof (rule iffI)\n      assume \"(v, a) \\<in> dom (\\<phi>\\<^sub>S \\<Psi> s)\" \n      then have \"v \\<in> { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None }\"\n          and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n        unfolding state_to_strips_state_dom_is[OF assms(1)]\n        by force+\n      moreover have \"v \\<in> set ?vs\" and \"s v \\<noteq> None\" \n        using calculation(1) \n        by fastforce+\n      ultimately show \n        \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None \\<and> a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n        by force\n    next \n      assume \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None \\<and> a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n      then have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n        and \"s v \\<noteq> None\"\n        and a_in_range_of_v: \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n        by simp+\n      then have \"v \\<in> { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None }\"\n        by force\n      thus \"(v, a) \\<in> dom (\\<phi>\\<^sub>S \\<Psi> s)\"\n        unfolding state_to_strips_state_dom_is[OF assms(1)]\n        using a_in_range_of_v\n        by blast\n    qed\nqed\n\nlemma state_to_strips_state_range_is:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"(v, a) \\<in> dom (\\<phi>\\<^sub>S \\<Psi> s)\" \n  shows \"(\\<phi>\\<^sub>S \\<Psi> s) (v, a) = Some (the (s v) = a)\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\" \n  let ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\"\n    and ?defined = \"filter (\\<lambda>v. s v \\<noteq> None) ?vs\"\n  let ?l = \"concat [possible_assignments_for \\<Psi> v. v \\<leftarrow> ?defined]\"\n  have v_in_set_vs: \"v \\<in> set ?vs\" \n    and s_of_v_is_not_None: \"s v \\<noteq> None\" \n    and a_in_range_of_v: \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    using assms(2)\n    unfolding state_to_strips_state_dom_is[OF assms(1)]\n    by fastforce+\n  moreover {\n    have \"\\<forall>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). v \\<in> dom (sas_plus_problem.range_of \\<Psi>)\"\n      using assms(1) is_valid_problem_sas_plus_then(1)\n      unfolding is_valid_problem_sas_plus_def\n      by fastforce\n    moreover have \"(v, a) \\<in> set ?l\" \n      unfolding state_to_strips_state_dom_is_i[OF calculation(1)]\n      using s_of_v_is_not_None a_in_range_of_v v_in_set_vs\n      by fastforce\n    moreover have \"set ?l \\<noteq> {}\" \n      using calculation\n      by fastforce\n    \\<comment> \\<open> TODO slow. \\<close>\n    ultimately have \"(\\<phi>\\<^sub>S \\<Psi> s) (v, a) = Some (the (s v) = a)\"\n      using map_of_from_function_graph_is_some_if[of \n          ?l \"(v, a)\" \"\\<lambda>(v, a). the (s v) = a\"] \n      unfolding SAS_Plus_STRIPS.state_to_strips_state_def\n        state_to_strips_state_def Let_def case_prod_beta'\n      by fastforce\n  }\n  thus ?thesis.\nqed\n\n\n\\<comment> \\<open> Show that a STRIPS state corresponding to a SAS+ state via transformation is consistent\nw.r.t. to the variable subset with same left component (i.e. the original SAS+ variable). This is\nthe consistency notion corresponding to SAS+ consistency: i.e. if no two assignments with different\nvalues for the same variable exist in the SAS+ state, then assigning the corresponding assignment\nboth to @{text \"True\"} is impossible. Vice versa, if both are assigned to @{text \"True\"} then the\nassignment variables must be the same SAS+ variable/SAS+ value pair. \\<close>\nlemma state_to_strips_state_effect_consistent:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"(v, a) \\<in> dom (\\<phi>\\<^sub>S \\<Psi> s)\"\n    and \"(v, a') \\<in> dom (\\<phi>\\<^sub>S \\<Psi> s)\"\n    and \"(\\<phi>\\<^sub>S \\<Psi> s) (v, a) = Some True\"\n    and  \"(\\<phi>\\<^sub>S \\<Psi> s) (v, a') = Some True\"\n  shows \"(v, a) = (v, a')\" \nproof -\n  have \"the (s v) = a\" and \"the (s v) = a'\"\n    using state_to_strips_state_range_is[OF assms(1)] assms(2, 3, 4, 5)\n    by fastforce+\n  thus ?thesis \n    by argo\nqed\n\n\nlemma sasp_op_to_strips_set_delete_effects_is:\n  assumes \"is_valid_operator_sas_plus \\<Psi> op\" \n  shows \"set (strips_operator.delete_effects_of (\\<phi>\\<^sub>O \\<Psi> op)) \n    = (\\<Union>(v, a) \\<in> set (effect_of op). { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\"\nproof -\n  let ?D = \"range_of \\<Psi>\"\n    and ?effect = \"effect_of op\" \n  let ?delete = \"[(v, a'). (v, a) \\<leftarrow> ?effect, a' \\<leftarrow> filter ((\\<noteq>) a) (the (?D v))]\"\n  {\n    fix v a\n    assume \"(v, a) \\<in> set ?effect\"\n    then have \"(\\<R>\\<^sub>+ \\<Psi> v) = set (the (?D v))\"\n      using assms \n      using is_valid_operator_sas_plus_then_range_of_sas_plus_op_is_set_range_of_op\n      by fastforce\n    hence \"set (filter ((\\<noteq>) a) (the (?D v))) = { a' \\<in> \\<R>\\<^sub>+ \\<Psi> v. a' \\<noteq> a }\"\n      unfolding set_filter \n      by blast\n  } note nb = this\n  {\n    \\<comment> \\<open> TODO slow. \\<close>\n    have \"set ?delete = \\<Union>(set ` (\\<lambda>(v, a). map (Pair v) (filter ((\\<noteq>) a) (the (?D v)))) \n      ` (set ?effect))\" \n      using set_concat\n      by simp\n    also have \"\\<dots> = \\<Union>((\\<lambda>(v, a). Pair v ` set (filter ((\\<noteq>) a) (the (?D v)))) \n      ` (set ?effect))\"\n      unfolding image_comp[of set] set_map \n      by auto\n    \\<comment> \\<open> TODO slow. \\<close>\n    also have \"\\<dots> = (\\<Union>(v, a) \\<in> set ?effect. Pair v ` { a' \\<in> \\<R>\\<^sub>+ \\<Psi> v. a' \\<noteq> a })\" \n      using nb \n      by fast\n    finally have \"set ?delete = (\\<Union>(v, a) \\<in> set ?effect.\n      { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\" \n      by blast\n  }\n  thus ?thesis\n    unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def\n      sasp_op_to_strips_def Let_def\n    by force \nqed\n\nlemma sas_plus_problem_to_strips_problem_variable_set_is:\n  \\<comment> \\<open> The variable set of \\<open>\\<Pi>\\<close> is the set of all possible \nassignments that are possible using the variables of \\<open>\\<V>\\<close> and the corresponding domains. \\<close>\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n  shows \"set ((\\<phi> \\<Psi>)\\<^sub>\\<V>) = (\\<Union>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\"\nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n    and ?vs = \"variables_of \\<Psi>\"\n  {\n    have \"set (strips_problem.variables_of ?\\<Pi>) \n      = set [as. v \\<leftarrow> ?vs, as \\<leftarrow> possible_assignments_for \\<Psi> v]\"\n      unfolding sas_plus_problem_to_strips_problem_def \n        SAS_Plus_STRIPS.sas_plus_problem_to_strips_problem_def\n      by force\n    also have \"\\<dots> = (\\<Union>(set ` (\\<lambda>v. possible_assignments_for \\<Psi> v) ` set ?vs))\" \n      using set_concat\n      by auto\n    also have \"\\<dots> = (\\<Union>((set \\<circ> possible_assignments_for \\<Psi>) ` set ?vs))\" \n      using image_comp[of set \"\\<lambda>v. possible_assignments_for \\<Psi> v\" \"set ?vs\"]\n      by argo\n    finally have \"set (strips_problem.variables_of ?\\<Pi>) \n      = (\\<Union>v \\<in> set ?vs. set (possible_assignments_for \\<Psi> v))\"\n      unfolding o_apply\n      by blast\n  }\n  moreover have \"\\<forall>v \\<in> set ?vs. v \\<in> dom (sas_plus_problem.range_of \\<Psi>)\"\n    using is_valid_problem_sas_plus_dom_sas_plus_problem_range_of assms\n    by force\n  ultimately show ?thesis\n    using possible_assignments_for_set_is\n    by force \nqed\n\ncorollary sas_plus_problem_to_strips_problem_variable_set_element_iff:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"(v, a) \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<V>)  \\<longleftrightarrow> v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n  unfolding sas_plus_problem_to_strips_problem_variable_set_is[OF assms]\n  by fast\n\nlemma sasp_op_to_strips_effect_consistent:\n  assumes \"op = \\<phi>\\<^sub>O \\<Psi> op'\" \n    and \"op' \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\"\n    and \"is_valid_operator_sas_plus \\<Psi> op'\"\n  shows \"(v, a) \\<in> set (add_effects_of op) \\<longrightarrow> (v, a) \\<notin> set (delete_effects_of op)\"\n    and \"(v, a) \\<in> set (delete_effects_of op) \\<longrightarrow> (v, a) \\<notin> set (add_effects_of op)\"\nproof -\n  have nb: \"(\\<forall>(v, a) \\<in> set (effect_of op'). \\<forall>(v', a') \\<in> set (effect_of op'). v \\<noteq> v' \\<or> a = a')\" \n    using assms(3)\n    unfolding is_valid_operator_sas_plus_def \n      SAS_Plus_Representation.is_valid_operator_sas_plus_def list_all_iff ListMem_iff Let_def\n    by argo\n  {\n    fix v a\n    assume v_a_in_add_effects_of_op: \"(v, a) \\<in> set (add_effects_of op)\" \n    have \"(v, a) \\<notin> set (delete_effects_of op)\" \n      proof (rule ccontr)\n        assume \"\\<not>(v, a) \\<notin> set (delete_effects_of op)\" \n        moreover have \"(v, a) \\<in> \n          (\\<Union>(v, a') \\<in> set (effect_of op'). { (v, a'') \n            | a''. a'' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a'' \\<noteq> a' })\"\n          using calculation sasp_op_to_strips_set_delete_effects_is \n            assms \n          by blast\n        moreover obtain a' where \"(v, a') \\<in> set (effect_of op')\" and \"a \\<noteq> a'\" \n          using calculation\n          by blast\n        moreover have \"(v, a') \\<in> set (add_effects_of op)\" \n          using assms(1) calculation(3)\n          unfolding sasp_op_to_strips_def\n            SAS_Plus_STRIPS.sasp_op_to_strips_def\n            Let_def\n          by fastforce\n        moreover have \"(v, a) \\<in> set (effect_of op')\" and \"(v, a') \\<in> set (effect_of op')\" \n          using assms(1) v_a_in_add_effects_of_op calculation(5)\n          unfolding sasp_op_to_strips_def \n            SAS_Plus_STRIPS.sasp_op_to_strips_def\n            Let_def \n          by force+\n        ultimately show False \n          using nb \n          by fast\n      qed\n  }\n  moreover {\n    fix v a\n    assume v_a_in_delete_effects_of_op: \"(v, a) \\<in> set (delete_effects_of op)\" \n    have \"(v, a) \\<notin> set (add_effects_of op)\" \n      proof (rule ccontr)\n        assume \"\\<not>(v, a) \\<notin> set (add_effects_of op)\" \n        moreover have \"(v, a) \\<in> set (add_effects_of op)\" \n          using calculation \n          by blast\n        moreover have \"(v, a) \\<in> \n          (\\<Union>(v, a') \\<in> set (effect_of op'). { (v, a'') \n            | a''. a'' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a'' \\<noteq> a' })\"\n          using sasp_op_to_strips_set_delete_effects_is  \n            nb assms(1, 3) v_a_in_delete_effects_of_op\n          by force\n        moreover obtain a' where \"(v, a') \\<in> set (effect_of op')\" and \"a \\<noteq> a'\" \n          using calculation\n          by blast\n        moreover have \"(v, a') \\<in> set (add_effects_of op)\" \n          using assms(1) calculation(4)\n          unfolding sasp_op_to_strips_def \n            SAS_Plus_STRIPS.sasp_op_to_strips_def\n            Let_def\n          by fastforce\n        moreover have \"(v, a) \\<in> set (effect_of op')\" and \"(v, a') \\<in> set (effect_of op')\" \n          using assms(1) calculation(2, 6)\n          unfolding sasp_op_to_strips_def \n            SAS_Plus_STRIPS.sasp_op_to_strips_def Let_def \n          by force+\n        ultimately show False \n          using nb \n          by fast\n      qed\n    }\n    ultimately show \"(v, a) \\<in> set (add_effects_of op) \n      \\<longrightarrow> (v, a) \\<notin> set (delete_effects_of op)\"\n      and \"(v, a) \\<in> set (delete_effects_of op) \n      \\<longrightarrow> (v, a) \\<notin> set (add_effects_of op)\"\n      by blast+\n  qed\n\nlemma is_valid_problem_sas_plus_then_strips_transformation_too_iii:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n  shows \"list_all (is_valid_operator_strips (\\<phi> \\<Psi>))\n    (strips_problem.operators_of (\\<phi> \\<Psi>))\"\nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?vs = \"strips_problem.variables_of ?\\<Pi>\"\n  {\n    fix op\n    assume \"op \\<in> set (strips_problem.operators_of ?\\<Pi>)\" \n    \\<comment> \\<open> TODO slow. \\<close>\n    then obtain op' \n      where op_is: \"op = \\<phi>\\<^sub>O \\<Psi> op'\" \n        and op'_in_operators: \"op' \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n      unfolding SAS_Plus_STRIPS.sas_plus_problem_to_strips_problem_def\n        sas_plus_problem_to_strips_problem_def \n        sasp_op_to_strips_def \n      by auto\n    then have is_valid_op': \"is_valid_operator_sas_plus \\<Psi> op'\"\n      using sublocale_sas_plus_finite_domain_representation_ii(2)[OF assms]\n      by blast\n    moreover {\n      fix v a\n      assume \"(v, a) \\<in> set (strips_operator.precondition_of op)\"\n      \\<comment> \\<open> TODO slow. \\<close>\n      then have \"(v, a) \\<in> set (sas_plus_operator.precondition_of op')\" \n        using op_is\n        unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def \n          sasp_op_to_strips_def\n        by force\n      moreover have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n        using is_valid_op' calculation\n        using is_valid_operator_sas_plus_then(1)\n        by fastforce \n      moreover have  \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n        using is_valid_op' calculation(1)\n        using is_valid_operator_sas_plus_then(2) \n        by fast\n      ultimately have \"(v, a) \\<in> set ?vs\" \n        using sas_plus_problem_to_strips_problem_variable_set_element_iff[OF assms(1)]\n        by force\n    }\n    moreover {\n      fix v a\n      assume \"(v, a) \\<in> set (strips_operator.add_effects_of op)\"\n      then have \"(v, a) \\<in> set (effect_of op')\" \n        using op_is\n        unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def\n          sasp_op_to_strips_def\n        by force\n      then have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n        using is_valid_operator_sas_plus_then is_valid_op'\n        by fastforce+\n      hence \"(v, a) \\<in> set ?vs\" \n        using sas_plus_problem_to_strips_problem_variable_set_element_iff[OF assms(1)]\n        by force\n    }\n    moreover {\n      fix v a'\n      assume v_a'_in_delete_effects: \"(v, a') \\<in> set (strips_operator.delete_effects_of op)\"\n      moreover have \"set (strips_operator.delete_effects_of op) \n        =  (\\<Union>(v, a) \\<in> set (effect_of op'). \n          { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\"\n        using sasp_op_to_strips_set_delete_effects_is[OF is_valid_op']\n          op_is\n        by simp\n      \\<comment> \\<open> TODO slow. \\<close>\n      ultimately obtain a \n        where \"(v, a) \\<in> set (effect_of op')\" \n          and a'_in: \"a' \\<in> { a' \\<in> \\<R>\\<^sub>+ \\<Psi> v. a' \\<noteq> a }\"\n        by blast \n      moreover have \"is_valid_operator_sas_plus \\<Psi> op'\"\n        using op'_in_operators assms(1) \n          is_valid_problem_sas_plus_then(2)\n        by blast\n      moreover have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n        using is_valid_operator_sas_plus_then calculation(1, 3)\n        by fast\n      moreover have \"a' \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n        using a'_in \n        by blast\n      ultimately have \"(v, a') \\<in> set ?vs\" \n        using sas_plus_problem_to_strips_problem_variable_set_element_iff[OF assms(1)]\n        by force\n    }\n    ultimately have \"set (strips_operator.precondition_of op) \\<subseteq> set ?vs\n      \\<and> set (strips_operator.add_effects_of op) \\<subseteq> set ?vs\n      \\<and> set (strips_operator.delete_effects_of op) \\<subseteq> set ?vs\n      \\<and> (\\<forall>v\\<in>set (add_effects_of op). v \\<notin> set (delete_effects_of op))\n      \\<and> (\\<forall>v\\<in>set (delete_effects_of op). v \\<notin> set (add_effects_of op))\"\n      using sasp_op_to_strips_effect_consistent[OF \n          op_is op'_in_operators is_valid_op']\n      by fast+\n  }\n  thus ?thesis\n    unfolding is_valid_operator_strips_def STRIPS_Representation.is_valid_operator_strips_def \n      list_all_iff ListMem_iff Let_def \n    by blast\nqed\n\nlemma is_valid_problem_sas_plus_then_strips_transformation_too_iv:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"\\<forall>x. ((\\<phi> \\<Psi>)\\<^sub>I) x \\<noteq> None\n    \\<longleftrightarrow> ListMem x (strips_problem.variables_of (\\<phi> \\<Psi>))\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?I = \"initial_of \\<Psi>\"\n    and ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?vs' = \"strips_problem.variables_of ?\\<Pi>\"\n    and ?I' = \"strips_problem.initial_of ?\\<Pi>\"\n  {\n    fix x\n    have \"?I' x \\<noteq> None \\<longleftrightarrow> ListMem x ?vs'\" \n      proof (rule iffI)\n        assume I'_of_x_is_not_None: \"?I' x \\<noteq> None\"\n        then have \"x \\<in> dom ?I'\" \n          by blast\n        moreover obtain v a where x_is: \"x = (v, a)\" \n          by fastforce\n        ultimately have \"(v, a) \\<in> dom ?I'\" \n          by blast\n        then have \"v \\<in> set ?vs\" \n            and \"?I v \\<noteq> None\"\n            and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n          using state_to_strips_state_dom_element_iff[OF assms(1), of v a  ?I] \n          unfolding sas_plus_problem_to_strips_problem_def \n            SAS_Plus_STRIPS.sas_plus_problem_to_strips_problem_def \n            state_to_strips_state_def\n            SAS_Plus_STRIPS.state_to_strips_state_def \n          by simp+\n        thus \"ListMem x ?vs'\"\n          unfolding ListMem_iff\n          using sas_plus_problem_to_strips_problem_variable_set_element_iff[OF assms(1)] \n            x_is\n          by auto\n      next \n        assume list_mem_x_vs': \"ListMem x ?vs'\"\n        then obtain v a where x_is: \"x = (v, a)\" \n          by fastforce\n        then have \"(v, a) \\<in> set ?vs'\" \n          using list_mem_x_vs'\n          unfolding ListMem_iff\n          by blast\n        then have \"v \\<in> set ?vs\" and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n          using sas_plus_problem_to_strips_problem_variable_set_element_iff[OF assms(1)]\n          by force+\n        moreover have \"?I v \\<noteq> None\" \n          using is_valid_problem_sas_plus_then(3) assms(1) calculation(1)\n          by auto\n        ultimately have \"(v, a) \\<in> dom ?I'\" \n          using state_to_strips_state_dom_element_iff[OF assms(1), of v a ?I]\n          unfolding SAS_Plus_STRIPS.sas_plus_problem_to_strips_problem_def \n            sas_plus_problem_to_strips_problem_def\n            SAS_Plus_STRIPS.state_to_strips_state_def\n            state_to_strips_state_def\n          by force \n        thus \"?I' x \\<noteq> None\"\n          using x_is \n          by fastforce\n      qed\n  }\n  thus ?thesis\n    by simp\nqed\n\nprivate lemma is_valid_problem_sas_plus_then_strips_transformation_too_v:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"\\<forall>x. ((\\<phi> \\<Psi>)\\<^sub>G) x \\<noteq> None\n    \\<longrightarrow> ListMem x (strips_problem.variables_of (\\<phi> \\<Psi>))\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?D = \"range_of \\<Psi>\"\n    and ?G = \"goal_of \\<Psi>\"\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?vs' = \"strips_problem.variables_of ?\\<Pi>\"\n    and ?G' = \"strips_problem.goal_of ?\\<Pi>\" \n  have nb: \"?G' = \\<phi>\\<^sub>S \\<Psi> ?G\" \n    by simp\n  {\n    fix x\n    assume \"?G' x \\<noteq> None\" \n    moreover obtain v a where \"x = (v, a)\" \n      by fastforce\n    moreover have \"(v, a) \\<in> dom ?G'\" \n      using domIff calculation(1, 2)\n      by blast\n    moreover have \"v \\<in> set ?vs\" and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n      using state_to_strips_state_dom_is[OF assms(1), of ?G] nb calculation(3)\n      by auto+\n    ultimately have \"x \\<in> set ?vs'\"\n      using sas_plus_problem_to_strips_problem_variable_set_element_iff[OF assms(1)]\n      by auto\n  }\n  thus ?thesis \n    unfolding ListMem_iff\n    by simp\nqed\n\ntext \\<open> We now show that given \\<^term>\\<open>\\<Psi>\\<close> is a valid SASPlus problem, then \\<^term>\\<open>\\<Pi> \\<equiv> \\<phi> \\<Psi>\\<close> is a valid\nSTRIPS problem as well. \nThe proof unfolds the definition of \\<^term>\\<open>is_valid_problem_strips\\<close> and then shows each of the conjuncts \nfor \\<^term>\\<open>\\<Pi>\\<close>. These are:\n\\begin{itemize}\n  \\item \\<^term>\\<open>\\<Pi>\\<close> has at least one variable;\n  \\item \\<^term>\\<open>\\<Pi>\\<close> has at least one operator;\n  \\item all operators are valid STRIPS operators;\n  \\item \\<^term>\\<open>(\\<Pi>::'a strips_problem)\\<^sub>I\\<close> is defined for all variables in \\<^term>\\<open>(\\<Pi>::'a strips_problem)\\<^sub>\\<V>\\<close>; and finally,\n  \\item if \\<^term>\\<open>((\\<Pi>::'a strips_problem)\\<^sub>G) x\\<close> is defined, then \\<^term>\\<open>x\\<close> is in \\<^term>\\<open>(\\<Pi>::'a strips_problem)\\<^sub>\\<V>\\<close>.\n\\end{itemize} \\<close>\n\ntheorem\n  is_valid_problem_sas_plus_then_strips_transformation_too:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"is_valid_problem_strips (\\<phi> \\<Psi>)\" \nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  have \"list_all (is_valid_operator_strips (\\<phi> \\<Psi>))\n   (strips_problem.operators_of (\\<phi> \\<Psi>))\" \n    using is_valid_problem_sas_plus_then_strips_transformation_too_iii[OF assms].\n  moreover have \"\\<forall>x. (((\\<phi> \\<Psi>)\\<^sub>I) x \\<noteq> None) =\n    ListMem x (strips_problem.variables_of (\\<phi> \\<Psi>))\" \n    using is_valid_problem_sas_plus_then_strips_transformation_too_iv[OF assms].\n  moreover have \"\\<forall>x. ((\\<phi> \\<Psi>)\\<^sub>G) x \\<noteq> None \\<longrightarrow>\n    ListMem x (strips_problem.variables_of (\\<phi> \\<Psi>))\" \n    using is_valid_problem_sas_plus_then_strips_transformation_too_v[OF assms].\n  ultimately show ?thesis \n    using is_valid_problem_strips_def \n    unfolding STRIPS_Representation.is_valid_problem_strips_def\n    by fastforce\nqed \n\nlemma set_filter_all_possible_assignments_true_is:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n  shows \"set (filter (\\<lambda>(v, a). s (v, a) = Some True) \n      (all_possible_assignments_for \\<Psi>))\n    =  (\\<Union>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). Pair v ` { a \\<in> \\<R>\\<^sub>+ \\<Psi> v. s (v, a) = Some True })\"\nproof -\n  let ?vs = \"sas_plus_problem.variables_of \\<Psi>\"\n    and ?P = \"(\\<lambda>(v, a). s (v, a) = Some True)\"\n  let ?l = \"filter ?P (all_possible_assignments_for \\<Psi>)\"\n  have \"set ?l = set (concat (map (filter ?P) (map (possible_assignments_for \\<Psi>) ?vs)))\" \n    unfolding all_possible_assignments_for_def\n      filter_concat[of ?P \"map (possible_assignments_for \\<Psi>) (sas_plus_problem.variables_of \\<Psi>)\"]\n    by simp\n  also have \"\\<dots> = set (concat (map (\\<lambda>v. filter ?P (possible_assignments_for \\<Psi> v)) ?vs))\" \n    unfolding map_map comp_apply \n    by blast\n  also have \"\\<dots> = set (concat (map (\\<lambda>v. map (Pair v) \n    (filter (?P \\<circ> Pair v) (the (range_of \\<Psi> v)))) ?vs))\" \n    unfolding possible_assignments_for_def filter_map\n    by blast\n  also have \"\\<dots> = set (concat (map (\\<lambda>v. map (Pair v) (filter (\\<lambda>a. s (v, a) = Some True) \n    (the (range_of \\<Psi> v)))) ?vs))\" \n    unfolding comp_apply\n    by fast\n  also have \"\\<dots> = \\<Union>(set ` ((\\<lambda>v. map (Pair v) (filter (\\<lambda>a. s (v, a) = Some True) \n    (the (range_of \\<Psi> v)))) ` set ?vs))\"\n    unfolding set_concat set_map..\n  also have \"\\<dots> = (\\<Union>v \\<in> set ?vs. Pair v ` set (filter (\\<lambda>a. s (v, a) = Some True) \n    (the (range_of \\<Psi> v))))\" \n    unfolding image_comp[of set] comp_apply set_map..\n  also have \"\\<dots> = (\\<Union>v \\<in> set ?vs. Pair v \n    ` { a \\<in> set (the (range_of \\<Psi> v)). s (v, a) = Some True })\"\n    unfolding set_filter..\n  finally show ?thesis \n    using set_the_range_of_is_range_of_sas_plus_if[OF assms(1)]\n    by auto\nqed\n\nlemma strips_state_to_state_dom_is: \n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n  shows \"dom (\\<phi>\\<^sub>S\\<inverse> \\<Psi> s) \n    = (\\<Union>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). \n      { v | a. a \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> s (v, a) = Some True })\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?s' = \"\\<phi>\\<^sub>S\\<inverse> \\<Psi> s\" \n    and ?P = \"(\\<lambda>(v, a). s (v, a) = Some True)\"\n  let ?l = \"filter ?P (all_possible_assignments_for \\<Psi>)\"\n  { \n    have \"fst ` set ?l = fst ` (\\<Union>v \\<in> set ?vs. Pair v \n      ` { a \\<in> \\<R>\\<^sub>+ \\<Psi> v. s (v, a) = Some True })\"\n      unfolding set_filter_all_possible_assignments_true_is[OF assms]\n      by auto\n    also have \"\\<dots> = (\\<Union>v \\<in> set ?vs. fst ` Pair v \n      ` { a \\<in> \\<R>\\<^sub>+ \\<Psi> v. s (v, a) = Some True })\" \n      by blast\n    also have \"\\<dots> = (\\<Union>v \\<in> set ?vs. (\\<lambda>a. fst (Pair v a)) ` \n      { a \\<in> \\<R>\\<^sub>+ \\<Psi> v. s (v, a) = Some True })\" \n      unfolding image_comp[of fst] comp_apply\n      by blast\n    finally have \"fst ` set ?l = (\\<Union>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). \n      { v | a. a \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> s (v, a) = Some True })\" \n      unfolding setcompr_eq_image fst_conv \n      by simp\n  }\n  thus ?thesis\n    unfolding SAS_Plus_STRIPS.strips_state_to_state_def \n      strips_state_to_state_def dom_map_of_conv_image_fst\n    by blast\nqed\n\nlemma strips_state_to_state_range_is: \n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n    and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    and \"(v, a) \\<in> dom s'\"\n    and \"\\<forall>(v, a) \\<in> dom s'. \\<forall>(v, a') \\<in> dom s'. s' (v, a) = Some True \\<and> s' (v, a') = Some True \n      \\<longrightarrow> (v, a) = (v, a')\" \n  shows \"(\\<phi>\\<^sub>S\\<inverse> \\<Psi> s') v = Some a \\<longleftrightarrow> the (s' (v, a))\" \nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?D = \"range_of \\<Psi>\"\n    and ?s = \"\\<phi>\\<^sub>S\\<inverse> \\<Psi> s'\"\n  let ?as = \"all_possible_assignments_for \\<Psi>\"\n  let ?l = \"filter (\\<lambda>(v, a). s' (v, a) = Some True) ?as\"\n  show ?thesis \n    proof (rule iffI)\n      assume s_of_v_is_Some_a: \"?s v = Some a\" \n      {\n        have \"(v, a) \\<in> set ?l\" \n          using s_of_v_is_Some_a \n          unfolding SAS_Plus_STRIPS.strips_state_to_state_def \n            strips_state_to_state_def \n          using map_of_SomeD\n          by fast\n        hence \"s' (v, a) = Some True\"\n          unfolding all_possible_assignments_for_set_is set_filter\n          by blast\n      }\n      thus \"the (s' (v, a))\"\n        by simp\n    next \n      assume the_of_s'_of_v_a_is: \"the (s' (v, a))\"\n      then have s'_of_v_a_is_Some_true: \"s' (v, a) = Some True\"\n        using assms(4) domIff \n        by force\n      \\<comment> \\<open> TODO slow. \\<close>\n      moreover {\n        fix v v' a a'\n        assume \"(v, a) \\<in> set ?l\" and \"(v', a') \\<in> set ?l\"\n        then have \"v \\<noteq> v' \\<or> a = a'\" \n        using assms(5)\n        by fastforce\n      }\n      moreover {\n        have \"\\<forall>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). sas_plus_problem.range_of \\<Psi> v \\<noteq> None\"  \n          using is_valid_problem_sas_plus_then(1) assms(1)\n            range_of_not_empty \n          by force\n        (* TODO slow. *)\n        moreover have \"set ?l = Set.filter (\\<lambda>(v, a). s' (v, a) = Some True) \n          (\\<Union>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). { (v, a) | a.  a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\"\n          using all_possible_assignments_for_set_is calculation\n          by force\n        ultimately have \"(v, a) \\<in> set ?l\" \n          using assms(2, 3) s'_of_v_a_is_Some_true\n          by simp\n      }\n      ultimately show \"?s v = Some a\"  \n        using map_of_constant_assignments_defined_if[of ?l v a]\n        unfolding SAS_Plus_STRIPS.strips_state_to_state_def\n          strips_state_to_state_def\n        by blast\n    qed\nqed\n\n\\<comment> \\<open> NOTE A technical lemma which characterizes the return values for possible assignments \n@{text \"(v, a)\"} when used as variables on a state @{text \"s\"} which was transformed from. \\<close> \n\n\n\\<comment> \\<open> NOTE Show that the transformed strips state is consistent for pairs of assignments \n@{text \"(v, a)\"} and @{text \"(v, a')\"} in the same variable domain. \\<close>\n(* TODO make private. *)\ncorollary strips_state_to_state_inverse_is_ii:\nassumes \"is_valid_problem_sas_plus \\<Psi>\"\n  and \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n  and \"s v = Some a\"  \n  and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n  and \"a' \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n  and \"a' \\<noteq> a\"\nshows \"(\\<phi>\\<^sub>S \\<Psi> s) (v, a') = Some False\"\nproof -\n  have \"s v \\<noteq> None\" \n    using assms(3) \n    by simp\n  moreover have \"the (s v) \\<noteq> a'\" \n    using assms(3, 6) \n    by simp \n  ultimately show ?thesis \n    using strips_state_to_state_inverse_is_i[OF assms(1, 2) _ assms(5)]\n    by force\nqed\n\n\\<comment> \\<open> NOTE Follows from the corollary above by contraposition. \\<close>\n(* TODO make private. *)\ncorollary strips_state_to_state_inverse_is_iii:\nassumes \"is_valid_problem_sas_plus \\<Psi>\"\n  and \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n  and \"s v = Some a\" \n  and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n  and \"a' \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n  and \"(\\<phi>\\<^sub>S \\<Psi> s) (v, a) = Some True\"\n  and \"(\\<phi>\\<^sub>S \\<Psi> s) (v, a') = Some True\"\nshows \"a = a'\"\nproof -\n  have \"s v \\<noteq> None\" \n    using assms(3)\n    by blast\n  thus ?thesis \n    using strips_state_to_state_inverse_is_i[OF assms(1, 2)] assms(4, 5, 6, 7)\n    by auto\nqed\n\n(* TODO make private. *)\nlemma strips_state_to_state_inverse_is_iv:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"dom s \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n    and \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n    and \"s v = Some a\" \n    and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n  shows \"(\\<phi>\\<^sub>S\\<inverse> \\<Psi> (\\<phi>\\<^sub>S \\<Psi> s)) v = Some a\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\"\n  let ?s'' = \"\\<phi>\\<^sub>S\\<inverse> \\<Psi> ?s'\" \n  let ?P = \"\\<lambda>(v, a). ?s' (v, a) = Some True\"\n  let ?as = \"filter ?P (all_possible_assignments_for \\<Psi>)\" \n    and ?As = \"Set.filter ?P (\\<Union>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). \n      { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\"\n  {\n    have \"\\<forall>v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+). range_of \\<Psi> v \\<noteq> None\"\n      using sublocale_sas_plus_finite_domain_representation_ii(1)[OF assms(1)] \n        range_of_not_empty\n      by force\n    (* TODO slow. *)\n    hence \"set ?as = ?As\"\n      unfolding set_filter \n      using all_possible_assignments_for_set_is\n      by force\n  } note nb = this\n  moreover {\n    {\n      fix v v' a a' \n      assume \"(v, a) \\<in> set ?as\" \n        and \"(v', a') \\<in> set ?as\" \n      then have \"(v, a) \\<in> ?As\" and \"(v', a') \\<in> ?As\" \n        using nb \n        by blast+\n      then have v_in_set_vs: \"v \\<in> set ?vs\" and v'_in_set_vs: \"v' \\<in> set ?vs\"\n        and a_in_range_of_v: \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n        and a'_in_range_of_v: \"a' \\<in> \\<R>\\<^sub>+ \\<Psi> v'\" \n        and s'_of_v_a_is: \"?s' (v, a) = Some True\" and s'_of_v'_a'_is: \"?s' (v', a') = Some True\" \n        by fastforce+\n      then have \"(v, a) \\<in> dom ?s'\"  \n        by blast\n      then have s_of_v_is_Some_a: \"s v = Some a\"  \n        using state_to_strips_state_dom_element_iff[OF assms(1)]\n          state_to_strips_state_range_is[OF assms(1)] s'_of_v_a_is \n           by auto\n      have \"v \\<noteq> v' \\<or> a = a'\"\n        proof (rule ccontr)\n          assume \"\\<not>(v \\<noteq> v' \\<or> a = a')\"\n          then have \"v = v'\" and \"a \\<noteq> a'\" \n            by simp+\n          thus False\n            using a'_in_range_of_v a_in_range_of_v assms(1) v'_in_set_vs s'_of_v'_a'_is \n              s'_of_v_a_is s_of_v_is_Some_a strips_state_to_state_inverse_is_iii\n            by force\n        qed\n    }\n    moreover {\n      have \"s v \\<noteq> None\" \n        using assms(4)\n        by simp\n      then have \"?s' (v, a) = Some True\" \n        using strips_state_to_state_inverse_is_i[OF assms(1, 3) _ assms(5)] \n          assms(4)\n        by simp\n      (* TODO slow *)\n      hence \"(v, a) \\<in> set ?as\" \n        using all_possible_assignments_for_set_is assms(3, 5) nb\n        by simp\n    }\n    ultimately have \"map_of ?as v = Some a\" \n      using map_of_constant_assignments_defined_if[of ?as v a] \n      by blast\n  }\n  \\<comment> \\<open> TODO slow. \\<close>\n  thus ?thesis\n    unfolding SAS_Plus_STRIPS.strips_state_to_state_def\n      strips_state_to_state_def all_possible_assignments_for_def\n    by simp\nqed\n\n(* TODO the constraints on the state @{text \"s\"} could be refactored into a definition of valid \nstates for a problem description. *)\n(* TODO The proof is not very elegant. Should be simplified. *)\n\\<comment> \\<open> Show that that \\<open>\\<phi>\\<^sub>S\\<inverse> \\<Psi>\\<close> is the inverse of \\<open>\\<phi>\\<^sub>S \\<Psi>\\<close>. The additional constraints \n\\<^term>\\<open>dom s = set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\\<close> and \\<^term>\\<open>\\<forall>v \\<in> dom s. the (s v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\\<close> are needed because the \ntransformation functions only take into account variables and domains declared in the problem \ndescription. They also sufficiently characterize a state that was transformed from SAS+ to STRIPS. \\<close>\nlemma strips_state_to_state_inverse_is:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"dom s \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n    and \"\\<forall>v \\<in> dom s. the (s v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n  shows \"s = (\\<phi>\\<^sub>S\\<inverse> \\<Psi> (\\<phi>\\<^sub>S \\<Psi> s))\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?D = \"range_of \\<Psi>\"\n  let ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\" \n  let ?s'' = \"\\<phi>\\<^sub>S\\<inverse> \\<Psi> ?s'\"\n  \\<comment> \\<open> NOTE Show the thesis by proving that @{text \"s\"} and @{text \"?s'\"} are mutual submaps. \\<close>\n  {\n    fix v\n    assume v_in_dom_s: \"v \\<in> dom s\"\n    then have v_in_set_vs: \"v \\<in> set ?vs\" \n      using assms(2) \n      by auto\n    then obtain a \n      where the_s_v_is_a: \"s v = Some a\" \n        and a_in_dom_v: \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n      using assms(2, 3) v_in_dom_s\n      by force\n    moreover have \"?s'' v = Some a\" \n      using strips_state_to_state_inverse_is_iv[OF assms(1, 2)] v_in_set_vs\n        the_s_v_is_a a_in_dom_v \n      by force\n    ultimately have \"s v = ?s'' v\"\n      by argo\n  } note nb = this\n  moreover {\n    fix v\n    assume \"v \\<in> dom ?s''\"\n    then obtain a \n      where \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n        and \"?s' (v, a) = Some True\" \n      using strips_state_to_state_dom_is[OF assms(1)]\n      by blast\n    then have \"(v, a) \\<in> dom ?s'\" \n      by blast\n    then have \"s v \\<noteq> None\" \n      using state_to_strips_state_dom_is[OF assms(1)]\n      by simp\n    then obtain a where \"s v = Some a\" \n      by blast\n    hence \"?s'' v = s v\"\n      using nb \n      by fastforce\n  }\n  \\<comment> \\<open> TODO slow.\\<close>\n  ultimately show ?thesis \n    using map_le_antisym[of s ?s''] map_le_def\n    unfolding strips_state_to_state_def \n      state_to_strips_state_def\n    by blast\nqed\n\n\\<comment> \\<open> An important lemma which shows that the submap relation does not change if we transform the \nstates on either side from SAS+ to STRIPS. \n% TODO what is this called generally? Predicate monotony?? \\<close>\nlemma state_to_strips_state_map_le_iff:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"dom s \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n    and \"\\<forall>v \\<in> dom s. the (s v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n  shows \"s \\<subseteq>\\<^sub>m t \\<longleftrightarrow> (\\<phi>\\<^sub>S \\<Psi> s) \\<subseteq>\\<^sub>m (\\<phi>\\<^sub>S \\<Psi> t)\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?D = \"range_of \\<Psi>\"\n    and ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\" \n    and ?t' = \"\\<phi>\\<^sub>S \\<Psi> t\" \n  show ?thesis\n    proof (rule iffI)\n      assume s_map_le_t: \"s \\<subseteq>\\<^sub>m t\"\n      {\n        fix v a\n        assume \"(v, a) \\<in> dom ?s'\" \n        moreover have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" and \"s v \\<noteq> None\" and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n          using state_to_strips_state_dom_is[OF assms(1)] calculation \n          by blast+\n        moreover have \"?s' (v, a) = Some (the (s v) = a)\"\n          using state_to_strips_state_range_is[OF assms(1)] calculation(1) \n          by meson\n        moreover have \"v \\<in> dom s\" \n          using calculation(3)\n          by auto \n        moreover have \"s v = t v\" \n          using s_map_le_t calculation(6) \n          unfolding map_le_def\n          by blast\n        moreover have \"t v \\<noteq> None\" \n          using calculation(3, 7)\n          by argo\n        moreover have \"(v, a) \\<in> dom ?t'\" \n          using state_to_strips_state_dom_is[OF assms(1)] calculation(2, 4, 8) \n          by blast\n        moreover have \"?t' (v, a) = Some (the (t v) = a)\" \n          using state_to_strips_state_range_is[OF assms(1)] calculation(9)\n          by simp\n        ultimately have \"?s' (v, a) = ?t' (v, a)\"\n          by presburger\n      }\n      thus \"?s' \\<subseteq>\\<^sub>m ?t'\" \n        unfolding map_le_def \n        by fast\n    next\n      assume s'_map_le_t': \"?s' \\<subseteq>\\<^sub>m ?t'\"\n      {\n        fix v \n        assume v_in_dom_s: \"v \\<in> dom s\" \n        moreover obtain a where the_of_s_of_v_is_a: \"the (s v) = a\" \n          by blast\n        moreover have v_in_vs: \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n          and s_of_v_is_not_None: \"s v \\<noteq> None\" \n          and a_in_range_of_v: \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n          using assms(2, 3) v_in_dom_s calculation\n          by blast+\n        moreover have \"(v, a) \\<in> dom ?s'\"  \n          using state_to_strips_state_dom_is[OF assms(1)] \n            calculation(3, 4, 5)\n          by simp\n        moreover have \"?s' (v, a) = ?t' (v, a)\"\n          using s'_map_le_t' calculation\n          unfolding map_le_def \n          by blast\n        moreover have \"(v, a) \\<in> dom ?t'\" \n          using calculation \n          unfolding domIff\n          by argo\n        moreover have \"?s' (v, a) = Some (the (s v) = a)\"\n          and \"?t' (v, a) = Some (the (t v) = a)\" \n          using state_to_strips_state_range_is[OF assms(1)] calculation\n          by fast+\n        moreover have \"s v = Some a\" \n          using calculation(2, 4) \n          by force\n        moreover have \"?s' (v, a) = Some True\" \n          using calculation(9, 11)\n          by fastforce\n        moreover have \"?t' (v, a) = Some True\" \n          using calculation(7, 12)\n          by argo\n        moreover have \"the (t v) = a\" \n          using calculation(10, 13) try0\n          by force\n        moreover {\n          have \"v \\<in> dom t\" \n            using state_to_strips_state_dom_element_iff[OF assms(1)] \n              calculation(8) \n            by auto\n          hence \"t v = Some a\"\n            using calculation(14)\n            by force\n        }\n        ultimately have \"s v = t v\"\n          by argo\n      }\n      thus \"s \\<subseteq>\\<^sub>m t\"\n        unfolding map_le_def\n        by simp\n    qed\nqed\n\n\\<comment> \\<open> We also show that \\<open>\\<phi>\\<^sub>O\\<inverse> \\<Pi>\\<close> is the inverse of \\<open>\\<phi>\\<^sub>O \\<Psi>\\<close>. Note that this proof is completely \nmechanical since both the precondition and effect lists are simply being copied when transforming \nfrom SAS+ to STRIPS and when transforming back from STRIPS to SAS+. \\<close>\n(* TODO rename \\<open>sasp_op_to_strips_inverse_is\\<close> *)\n(* TODO prune assumptions (not required) *)\nlemma sas_plus_operator_inverse_is:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n  shows \"(\\<phi>\\<^sub>O\\<inverse> \\<Psi> (\\<phi>\\<^sub>O \\<Psi> op)) = op\"\nproof -\n  let ?op = \"\\<phi>\\<^sub>O\\<inverse> \\<Psi> (\\<phi>\\<^sub>O \\<Psi> op)\"\n  have \"precondition_of ?op = precondition_of op\"\n    unfolding SAS_Plus_STRIPS.strips_op_to_sasp_def\n      strips_op_to_sasp_def\n      SAS_Plus_STRIPS.sasp_op_to_strips_def\n      sasp_op_to_strips_def\n    by fastforce\n  moreover have \"effect_of ?op = effect_of op\" \n    unfolding SAS_Plus_STRIPS.strips_op_to_sasp_def\n      strips_op_to_sasp_def\n      SAS_Plus_STRIPS.sasp_op_to_strips_def\n      sasp_op_to_strips_def\n    by force\n  ultimately show ?thesis \n    by simp\nqed\n\n\\<comment> \\<open> Note that we have to make the assumption that \\<open>op'\\<close> is a member of the operator set of the \ninduced STRIPS problem \\<open>\\<phi> \\<Psi>\\<close>. This implies that \\<open>op'\\<close> was transformed from an \n\\<open>op \\<in> operators_of \\<Psi>\\<close>. If we don't make this assumption, then multiple STRIPS operators of the \nform  \\<open>\\<lparr> precondition_of = [], add_effects_of = [], delete_effects_of = [(v, a), ...] \\<rparr>\\<close> correspond \nto one SAS+ operator (since the delete effects are being discarded in the transformation function). \n\\<close>\nlemma strips_operator_inverse_is:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\" \n  shows \"(\\<phi>\\<^sub>O \\<Psi> (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op')) = op'\" \n  proof -\n    let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n    obtain op where \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" and \"op' = \\<phi>\\<^sub>O \\<Psi> op\" \n      using assms \n      by auto\n    moreover have \"\\<phi>\\<^sub>O\\<inverse> \\<Psi> op' = op\" \n      using sas_plus_operator_inverse_is[OF assms(1) calculation(1)] calculation(2)\n      by blast\n    ultimately show ?thesis\n      by argo\n  qed\n\n(* \n  \\<^item> TODO Simplify | refactor proof. \n  \\<^item> TODO make private. *)\nlemma sas_plus_equivalent_to_strips_i_a_I:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"set ops' \\<subseteq> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    and \"STRIPS_Semantics.are_all_operators_applicable (\\<phi>\\<^sub>S \\<Psi> s) ops'\"\n    and \"op \\<in> set [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\" \n  shows \"map_of (precondition_of op) \\<subseteq>\\<^sub>m (\\<phi>\\<^sub>S\\<inverse> \\<Psi> (\\<phi>\\<^sub>S \\<Psi> s))\" \nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n    and ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\" \n  let ?s = \"\\<phi>\\<^sub>S\\<inverse> \\<Psi> ?s'\" \n    and ?D = \"range_of \\<Psi>\"\n    and ?ops = \"[\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\" \n    and ?pre = \"precondition_of op\" \n  have nb\\<^sub>1: \"\\<forall>(v, a) \\<in> dom ?s'. \n    \\<forall>(v, a') \\<in> dom ?s'. \n      ?s' (v, a) = Some True \\<and> ?s' (v, a') = Some True\n      \\<longrightarrow> (v, a) = (v, a')\" \n    using state_to_strips_state_effect_consistent[OF assms(1)] \n    by blast\n  {\n    fix op'\n    assume \"op' \\<in> set ops'\" \n    moreover have \"op' \\<in> set ((?\\<Pi>)\\<^sub>\\<O>)\"\n      using assms(2) calculation \n      by blast\n    ultimately have \"\\<exists>op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+). op' = (\\<phi>\\<^sub>O \\<Psi> op)\" \n      by auto\n  } note nb\\<^sub>2 = this\n  {\n    fix op\n    assume \"op \\<in> set ?ops\" \n    then obtain op' where \"op' \\<in> set ops'\" and \"op = \\<phi>\\<^sub>O\\<inverse> \\<Psi> op'\" \n      using assms(4) \n      by auto\n    moreover obtain op'' where \"op'' \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" and \"op' = \\<phi>\\<^sub>O \\<Psi> op''\" \n      using nb\\<^sub>2 calculation(1)\n      by blast\n    moreover have \"op = op''\"\n      using sas_plus_operator_inverse_is[OF assms(1) calculation(3)] calculation(2, 4)  \n      by blast\n    ultimately have \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\"\n      by blast\n  } note nb\\<^sub>3 = this\n  {\n    fix op v a\n    assume \"op \\<in> set ?ops\" \n      and v_a_in_precondition_of_op': \"(v, a) \\<in> set (precondition_of op)\"\n    moreover obtain op' where \"op' \\<in> set ops'\" and \"op = \\<phi>\\<^sub>O\\<inverse> \\<Psi> op'\" \n      using calculation(1) \n      by auto\n    moreover have \"strips_operator.precondition_of op' = precondition_of op\" \n      using calculation(4) \n      unfolding SAS_Plus_STRIPS.strips_op_to_sasp_def\n        strips_op_to_sasp_def\n      by simp\n    ultimately have \"\\<exists>op' \\<in> set ops'. op = (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op')\n      \\<and> (v, a) \\<in> set (strips_operator.precondition_of op')\" \n      by metis\n  } note nb\\<^sub>4 = this\n  {\n    fix op' v a\n    assume \"op' \\<in> set ops'\" \n      and v_a_in_precondition_of_op': \"(v, a) \\<in> set (strips_operator.precondition_of op')\"\n    moreover have s'_of_v_a_is_Some_True: \"?s' (v, a) = Some True\" \n      using assms(3) calculation(1, 2) \n      unfolding are_all_operators_applicable_set\n      by blast\n    moreover {\n      obtain op where \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" and \"op' = \\<phi>\\<^sub>O \\<Psi> op\" \n        using nb\\<^sub>2 calculation(1) \n        by blast\n      moreover have \"strips_operator.precondition_of op' = precondition_of op\" \n        using calculation(2) \n        unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def\n          sasp_op_to_strips_def\n        by simp\n      moreover have \"(v, a) \\<in> set (precondition_of op)\"\n        using v_a_in_precondition_of_op' calculation(3)\n        by argo\n      moreover have \"is_valid_operator_sas_plus \\<Psi> op\" \n        using is_valid_problem_sas_plus_then(2) assms(1) calculation(1)\n        unfolding is_valid_operator_sas_plus_def\n        by auto\n      moreover have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n        using is_valid_operator_sas_plus_then(1,2) calculation(4, 5)\n        unfolding is_valid_operator_sas_plus_def\n        by fastforce+\n      moreover have \"v \\<in> dom ?s\" \n        using strips_state_to_state_dom_is[OF assms(1), of ?s'] \n          s'_of_v_a_is_Some_True calculation(6, 7)\n        by blast\n      moreover have \"(v, a) \\<in> dom ?s'\" \n        using s'_of_v_a_is_Some_True domIff \n        by blast\n      ultimately have \"?s v = Some a\"\n        using strips_state_to_state_range_is[OF assms(1) _ _ _ nb\\<^sub>1] \n          s'_of_v_a_is_Some_True \n        by simp\n    }\n    hence \"?s v = Some a\".\n  } note nb\\<^sub>5 = this\n  {\n    fix v\n    assume \"v \\<in> dom (map_of ?pre)\"\n    then obtain a where \"map_of ?pre v = Some a\"\n      by fast\n    moreover have \"(v, a) \\<in> set ?pre\" \n      using map_of_SomeD calculation\n      by fast\n    moreover {\n      have \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n        using assms(4) nb\\<^sub>3\n        by blast\n      then have \"is_valid_operator_sas_plus \\<Psi> op\" \n        using is_valid_problem_sas_plus_then(2) assms(1)\n        unfolding is_valid_operator_sas_plus_def\n        by auto\n      hence \"\\<forall>(v, a) \\<in> set ?pre. \\<forall>(v', a') \\<in> set ?pre. v \\<noteq> v' \\<or> a = a'\"\n        using is_valid_operator_sas_plus_then(5)\n        unfolding is_valid_operator_sas_plus_def\n        by fast\n    }\n    moreover have \"map_of ?pre v = Some a\"\n      using map_of_constant_assignments_defined_if[of ?pre] calculation(2, 3)\n      by blast\n    moreover obtain op' where \"op' \\<in> set ops'\" \n      and \"(v, a) \\<in> set (strips_operator.precondition_of op')\" \n      using nb\\<^sub>4[OF assms(4) calculation(2)]\n      by blast\n    moreover have \"?s v = Some a\" \n      using nb\\<^sub>5 calculation(5, 6) \n      by fast\n    ultimately have \"map_of ?pre v = ?s v\"\n      by argo\n  }\n  thus ?thesis \n    unfolding map_le_def\n    by blast\nqed\n\nlemma to_sas_plus_list_of_transformed_sas_plus_problem_operators_structure:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"set ops' \\<subseteq> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    and \"op \\<in> set [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\" \n  shows \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+) \\<and> (\\<exists>op' \\<in> set ops'. op' = \\<phi>\\<^sub>O \\<Psi> op)\"\nproof - \n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  obtain op' where \"op' \\<in> set ops'\" and \"op = \\<phi>\\<^sub>O\\<inverse> \\<Psi> op'\" \n    using assms(3) \n    by auto\n  moreover have \"op' \\<in> set ((?\\<Pi>)\\<^sub>\\<O>)\"\n    using assms(2) calculation(1) \n    by blast\n  moreover obtain op'' where \"op'' \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" and \"op' = \\<phi>\\<^sub>O \\<Psi> op''\" \n    using calculation(3) \n    by auto\n  moreover have \"op = op''\" \n    using sas_plus_operator_inverse_is[OF assms(1) calculation(4)] calculation(2, 5) \n    by presburger\n  ultimately show ?thesis \n    by blast\nqed\n\n(* \\<^item> TODO Prune premises (2nd premise and \\<open>are_all_operators_applicable s' ops'\\<close> can be removed?). \n   \\<^item> TODO make private. \n   \\<^item> TODO adjust nb indexes *)\nlemma sas_plus_equivalent_to_strips_i_a_II:\n  fixes \\<Psi> :: \"('variable, 'domain) sas_plus_problem\"\n  fixes s :: \"('variable, 'domain) state\" \n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"set ops' \\<subseteq> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    and \"STRIPS_Semantics.are_all_operators_applicable (\\<phi>\\<^sub>s \\<Psi> s) ops' \n      \\<and> STRIPS_Semantics.are_all_operator_effects_consistent ops'\"\n  shows \"are_all_operator_effects_consistent [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\" \nproof -\n  let ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\"\n  let ?s = \"\\<phi>\\<^sub>S\\<inverse> \\<Psi> ?s'\"\n    and ?ops = \"[\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\"\n    and ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  have nb: \"\\<forall>(v, a) \\<in> dom ?s'. \n    \\<forall>(v, a') \\<in> dom ?s'. \n      ?s' (v, a) = Some True \\<and> ?s' (v, a') = Some True\n      \\<longrightarrow> (v, a) = (v, a')\" \n    using state_to_strips_state_effect_consistent[OF assms(1)] \n    by blast\n  {\n    fix op\\<^sub>1' op\\<^sub>2'\n    assume \"op\\<^sub>1' \\<in> set ops'\" and \"op\\<^sub>2' \\<in> set ops'\"\n    hence \"STRIPS_Semantics.are_operator_effects_consistent op\\<^sub>1' op\\<^sub>2'\" \n      using assms(3)\n      unfolding STRIPS_Semantics.are_all_operator_effects_consistent_def list_all_iff\n      by blast\n  } note nb\\<^sub>1 = this\n  {\n    fix op\\<^sub>1 op\\<^sub>1' op\\<^sub>2 op\\<^sub>2'\n    assume op\\<^sub>1_in_ops: \"op\\<^sub>1 \\<in> set ?ops\"\n      and op\\<^sub>1'_in_ops': \"op\\<^sub>1' \\<in> set ops'\" \n      and op\\<^sub>1'_is: \"op\\<^sub>1' = \\<phi>\\<^sub>O \\<Psi> op\\<^sub>1\" \n      and is_valid_op\\<^sub>1: \"is_valid_operator_sas_plus \\<Psi> op\\<^sub>1\"\n      and op\\<^sub>2_in_ops: \"op\\<^sub>2 \\<in> set ?ops\"\n      and op\\<^sub>2'_in_ops': \"op\\<^sub>2' \\<in> set ops'\" \n      and op\\<^sub>2'_is: \"op\\<^sub>2' = \\<phi>\\<^sub>O \\<Psi> op\\<^sub>2\"\n      and is_valid_op\\<^sub>2: \"is_valid_operator_sas_plus \\<Psi> op\\<^sub>2\"\n    have \"\\<forall>(v, a) \\<in> set (add_effects_of op\\<^sub>1'). \\<forall>(v', a') \\<in> set (add_effects_of op\\<^sub>2').\n          v \\<noteq> v' \\<or> a = a'\" \n      proof (rule ccontr)\n        assume \"\\<not>(\\<forall>(v, a) \\<in> set (add_effects_of op\\<^sub>1'). \\<forall>(v', a') \\<in> set (add_effects_of op\\<^sub>2'). \n        v \\<noteq> v' \\<or> a = a')\"\n        then obtain v v' a a' where \"(v, a) \\<in> set (add_effects_of op\\<^sub>1')\" \n          and \"(v', a') \\<in> set (add_effects_of op\\<^sub>2')\" \n          and \"v = v'\" \n          and \"a \\<noteq> a'\" \n          by blast\n        \\<comment> \\<open> TODO slow. \\<close>\n        moreover have \"(v, a) \\<in> set (effect_of op\\<^sub>1)\"  \n          using op\\<^sub>1'_is op\\<^sub>2'_is calculation(1, 2)\n          unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def\n            sasp_op_to_strips_def \n          by force\n        moreover {\n          have \"(v', a') \\<in> set (effect_of op\\<^sub>2)\" \n            using op\\<^sub>2'_is calculation(2) \n            unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def\n              sasp_op_to_strips_def\n            by force\n          hence \"a' \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n            using is_valid_operator_sas_plus_then is_valid_op\\<^sub>2 calculation(3)\n            by fastforce\n        }\n        moreover have \"(v, a') \\<in> set (delete_effects_of op\\<^sub>1')\" \n          using sasp_op_to_strips_set_delete_effects_is\n            op\\<^sub>1'_is is_valid_op\\<^sub>1 calculation(3, 4, 5, 6)\n          by blast\n        moreover have \"\\<not>STRIPS_Semantics.are_operator_effects_consistent op\\<^sub>1' op\\<^sub>2'\" \n          unfolding STRIPS_Semantics.are_operator_effects_consistent_def list_ex_iff \n          using calculation(2, 3, 7)\n          by meson\n        ultimately show False \n          using assms(3) op\\<^sub>1'_in_ops' op\\<^sub>2'_in_ops'\n          unfolding STRIPS_Semantics.are_all_operator_effects_consistent_def list_all_iff\n          by blast\n      qed\n  } note nb\\<^sub>3 = this\n  {\n    fix op\\<^sub>1 op\\<^sub>2\n    assume op\\<^sub>1_in_ops: \"op\\<^sub>1 \\<in> set ?ops\" and op\\<^sub>2_in_ops: \"op\\<^sub>2 \\<in> set ?ops\" \n    moreover have op\\<^sub>1_in_operators_of_\\<Psi>: \"op\\<^sub>1 \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n      and op\\<^sub>2_in_operators_of_\\<Psi>: \"op\\<^sub>2 \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n      using to_sas_plus_list_of_transformed_sas_plus_problem_operators_structure[OF \n          assms(1, 2)] calculation\n      by blast+\n    moreover have is_valid_operator_op\\<^sub>1: \"is_valid_operator_sas_plus \\<Psi> op\\<^sub>1\" \n      and is_valid_operator_op\\<^sub>2: \"is_valid_operator_sas_plus \\<Psi> op\\<^sub>2\" \n      using is_valid_problem_sas_plus_then(2) op\\<^sub>1_in_operators_of_\\<Psi> op\\<^sub>2_in_operators_of_\\<Psi>\n        assms(1)\n      unfolding is_valid_operator_sas_plus_def\n      by auto+\n    moreover obtain op\\<^sub>1' op\\<^sub>2' \n      where op\\<^sub>1_in_ops': \"op\\<^sub>1' \\<in> set ops'\" \n        and op\\<^sub>1_is: \"op\\<^sub>1' = \\<phi>\\<^sub>O \\<Psi> op\\<^sub>1\"\n        and op\\<^sub>2_in_ops': \"op\\<^sub>2' \\<in> set ops'\"\n        and op\\<^sub>2_is: \"op\\<^sub>2' = \\<phi>\\<^sub>O \\<Psi> op\\<^sub>2\"\n      using to_sas_plus_list_of_transformed_sas_plus_problem_operators_structure[OF \n          assms(1, 2)] op\\<^sub>1_in_ops op\\<^sub>2_in_ops\n      by blast\n    \\<comment> \\<open> TODO slow.\\<close>\n    ultimately have \"\\<forall>(v, a) \\<in> set (add_effects_of op\\<^sub>1'). \\<forall>(v', a') \\<in> set (add_effects_of op\\<^sub>2').\n          v \\<noteq> v' \\<or> a = a'\" \n      using nb\\<^sub>3 \n      by auto\n    hence \"are_operator_effects_consistent op\\<^sub>1 op\\<^sub>2\"\n      using op\\<^sub>1_is op\\<^sub>2_is \n      unfolding are_operator_effects_consistent_def\n        sasp_op_to_strips_def \n        SAS_Plus_STRIPS.sasp_op_to_strips_def\n        list_all_iff Let_def\n      by simp\n  }\n  thus ?thesis \n    unfolding are_all_operator_effects_consistent_def list_all_iff \n    by fast\nqed\n\n\\<comment> \\<open> A technical lemmas used in \\<open>sas_plus_equivalent_to_strips_i_a\\<close> showing that \nthe execution precondition is linear w.r.t. to STRIPS transformation to SAS+. \n\nThe second premise states that the given STRIPS state corresponds to a consistent SAS+ state (i.e.\nno two assignments of the same variable to different values exist). \\<close>\n(* \n  \\<^item> TODO make private. \n  \\<^item> TODO decrement suffix *)\nlemma sas_plus_equivalent_to_strips_i_a_IV: \n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"set ops' \\<subseteq> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    and \"STRIPS_Semantics.are_all_operators_applicable (\\<phi>\\<^sub>S \\<Psi> s) ops' \n      \\<and> STRIPS_Semantics.are_all_operator_effects_consistent ops'\"\n  shows \"are_all_operators_applicable_in (\\<phi>\\<^sub>S\\<inverse> \\<Psi> (\\<phi>\\<^sub>S \\<Psi> s)) [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops'] \\<and>\n    are_all_operator_effects_consistent [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\" \nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n    and ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\"\n  let ?vs' = \"strips_problem.variables_of ?\\<Pi>\"\n    and ?ops' = \"strips_problem.operators_of ?\\<Pi>\" \n    and ?vs = \"variables_of \\<Psi>\"\n    and ?D = \"range_of \\<Psi>\"\n    and ?s = \"\\<phi>\\<^sub>S\\<inverse> \\<Psi> ?s'\"\n    and ?ops = \"[\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\"\n  have nb: \"\\<forall>(v, a) \\<in> dom ?s'. \n    \\<forall>(v, a') \\<in> dom (\\<phi>\\<^sub>S \\<Psi> s). \n      ?s' (v, a) = Some True \\<and> ?s' (v, a') = Some True\n      \\<longrightarrow> (v, a) = (v, a')\" \n    using state_to_strips_state_effect_consistent[OF assms(1)] \n    by blast\n  {\n    have \"STRIPS_Semantics.are_all_operators_applicable ?s' ops'\" \n      using assms(3)\n      by simp\n    moreover have \"list_all (\\<lambda>op. map_of (precondition_of op) \\<subseteq>\\<^sub>m ?s) ?ops\"\n      using sas_plus_equivalent_to_strips_i_a_I[OF assms(1) assms(2)] calculation\n      unfolding list_all_iff\n      by blast\n    moreover have \"list_all (\\<lambda>op. list_all (are_operator_effects_consistent op) ?ops) ?ops\" \n      using sas_plus_equivalent_to_strips_i_a_II assms nb\n      unfolding are_all_operator_effects_consistent_def is_valid_operator_sas_plus_def list_all_iff \n      by blast\n    ultimately have \"are_all_operators_applicable_in ?s ?ops\" \n      unfolding are_all_operators_applicable_in_def is_operator_applicable_in_def list_all_iff\n      by argo\n  }\n  moreover have \"are_all_operator_effects_consistent ?ops\" \n    using sas_plus_equivalent_to_strips_i_a_II assms nb\n    by simp\n  ultimately show ?thesis\n    by simp\nqed\n\n(* TODO:\n  \\<^item> prune premises + make private. \n  \\<^item> decrement suffixes \n*)\nlemma sas_plus_equivalent_to_strips_i_a_VI:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"dom s \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n    and \"\\<forall>v \\<in> dom s. the (s v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    and \"set ops' \\<subseteq> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    and \"are_all_operators_applicable_in s [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops'] \\<and>\n      are_all_operator_effects_consistent [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\"  \n  shows \"STRIPS_Semantics.are_all_operators_applicable (\\<phi>\\<^sub>S \\<Psi> s) ops'\"\nproof -   \n  let ?vs = \"variables_of \\<Psi>\" \n    and ?D = \"range_of \\<Psi>\"\n    and ?\\<Pi> = \"\\<phi> \\<Psi>\" \n    and ?ops = \"[\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\" \n    and ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\"\n  \\<comment> \\<open> TODO refactor. \\<close>\n  {\n    fix op' \n    assume \"op' \\<in> set ops'\" \n    moreover obtain op where \"op \\<in> set ?ops\" and \"op = \\<phi>\\<^sub>O\\<inverse> \\<Psi> op'\" \n      using calculation\n      by force\n    moreover obtain op'' where \"op'' \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" and \"op' = \\<phi>\\<^sub>O \\<Psi> op''\" \n      using assms(4) calculation(1) \n      by auto\n    moreover have \"is_valid_operator_sas_plus \\<Psi> op''\" \n      using is_valid_problem_sas_plus_then(2) assms(1) calculation(4)\n      unfolding is_valid_operator_sas_plus_def\n      by auto\n    moreover have \"op = op''\" \n      using sas_plus_operator_inverse_is[OF assms(1)] calculation(3, 4, 5)\n      by blast\n    ultimately have \"\\<exists>op \\<in> set ?ops. op \\<in> set ?ops \\<and> op = (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op') \n      \\<and> is_valid_operator_sas_plus \\<Psi> op\"\n      by blast\n  } note nb\\<^sub>1 = this\n  have nb\\<^sub>2: \"\\<forall>(v, a) \\<in> dom ?s'. \n    \\<forall>(v, a') \\<in> dom ?s'. \n      ?s' (v, a) = Some True \\<and> ?s' (v, a') = Some True\n      \\<longrightarrow> (v, a) = (v, a')\" \n    using state_to_strips_state_effect_consistent[OF assms(1), of _ _ s]\n    by blast\n  {\n    fix op\n    assume \"op \\<in> set ?ops\" \n    hence \"map_of (precondition_of op) \\<subseteq>\\<^sub>m s\" \n      using assms(5) \n      unfolding are_all_operators_applicable_in_def \n        is_operator_applicable_in_def list_all_iff\n      by blast\n  } note nb\\<^sub>3 = this\n  {\n    fix op'\n    assume \"op' \\<in> set ops'\" \n    then obtain op where op_in_ops: \"op \\<in> set ?ops\" \n      and op_is: \"op = (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op')\" \n      and is_valid_operator_op: \"is_valid_operator_sas_plus \\<Psi> op\" \n      using nb\\<^sub>1\n      by force\n    moreover have preconditions_are_consistent: \n      \"\\<forall>(v, a) \\<in> set (precondition_of op). \\<forall>(v', a') \\<in> set (precondition_of op). v \\<noteq> v' \\<or> a = a'\" \n      using is_valid_operator_sas_plus_then(5) calculation(3) \n      unfolding is_valid_operator_sas_plus_def\n      by fast\n    moreover {\n      fix v a\n      assume \"(v, a) \\<in> set (strips_operator.precondition_of op')\"\n      moreover have v_a_in_precondition_of_op: \"(v, a) \\<in> set (precondition_of op)\" \n        using op_is calculation \n        unfolding SAS_Plus_STRIPS.strips_op_to_sasp_def\n          strips_op_to_sasp_def\n        by auto\n      moreover have \"map_of (precondition_of op) v = Some a\" \n        using map_of_constant_assignments_defined_if[OF \n            preconditions_are_consistent calculation(2)]\n        by blast\n      moreover have s_of_v_is: \"s v = Some a\" \n        using nb\\<^sub>3[OF op_in_ops] calculation(3) \n        unfolding map_le_def \n        by force\n      moreover have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n        using is_valid_operator_sas_plus_then(1, 2) is_valid_operator_op\n          v_a_in_precondition_of_op \n        unfolding is_valid_operator_sas_plus_def \n          SAS_Plus_Representation.is_valid_operator_sas_plus_def Let_def list_all_iff ListMem_iff\n        by auto+\n      moreover have \"(v, a) \\<in> dom ?s'\" \n        using state_to_strips_state_dom_is[OF assms(1)] s_of_v_is \n        calculation \n        by simp\n      moreover have \"(\\<phi>\\<^sub>S\\<inverse> \\<Psi> ?s') v = Some a\" \n        using strips_state_to_state_inverse_is[OF assms(1, 2, 3)] s_of_v_is\n        by argo\n      \\<comment> \\<open> TODO slow. \\<close>\n      ultimately have \"?s' (v, a) = Some True\" \n        using strips_state_to_state_range_is[OF assms(1)] nb\\<^sub>2 \n        by auto\n    }\n    ultimately have \"\\<forall>(v, a) \\<in> set (strips_operator.precondition_of op'). ?s' (v, a) = Some True\" \n      by fast\n  }\n  thus ?thesis \n    unfolding are_all_operators_applicable_def is_operator_applicable_in_def \n      STRIPS_Representation.is_operator_applicable_in_def list_all_iff\n    by simp\nqed\n\n(* TODO Prune premises. *)\n\n\nlemma sas_plus_equivalent_to_strips_i_a_VIII:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"dom s \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n    and \"\\<forall>v \\<in> dom s. the (s v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    and \"set ops' \\<subseteq> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    and \"are_all_operators_applicable_in s [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops'] \\<and>\n    are_all_operator_effects_consistent [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\"  \n  shows \"STRIPS_Semantics.are_all_operators_applicable (\\<phi>\\<^sub>S \\<Psi> s) ops' \n    \\<and> STRIPS_Semantics.are_all_operator_effects_consistent ops'\"\n  using sas_plus_equivalent_to_strips_i_a_VI sas_plus_equivalent_to_strips_i_a_VII assms\n  by fastforce\n\n(* TODO refactor. *)\nlemma sas_plus_equivalent_to_strips_i_a_IX:\n  assumes \"dom s \\<subseteq> V\"\n    and \"\\<forall>op \\<in> set ops. \\<forall>(v, a) \\<in> set (effect_of op). v \\<in> V\" \n  shows \"dom (execute_parallel_operator_sas_plus s ops) \\<subseteq> V\"  \nproof -\n  show ?thesis \n    using assms\n    proof (induction ops arbitrary: s)\n      case Nil \n      then show ?case\n        unfolding execute_parallel_operator_sas_plus_def\n        by simp \n    next\n      case (Cons op ops)\n      let ?s' = \"s ++ map_of (effect_of op)\" \n      \\<comment> \\<open> TODO Wrap IH instantiation in block. \\<close>\n      {\n        have \"\\<forall>(v, a) \\<in> set (effect_of op). v \\<in> V\" \n          using Cons.prems(2)\n          by fastforce\n        moreover have \"fst ` set (effect_of op) \\<subseteq> V\" \n          using calculation\n          by fastforce\n        ultimately have \"dom ?s' \\<subseteq> V\" \n          unfolding dom_map_add dom_map_of_conv_image_fst\n          using Cons.prems(1)\n          by blast\n      }\n      moreover have \"\\<forall>op \\<in> set ops. \\<forall>(v, a) \\<in> set (effect_of op). v \\<in> V\"\n        using Cons.prems(2)\n        by fastforce\n      ultimately have \"dom (execute_parallel_operator_sas_plus ?s' ops) \\<subseteq> V\"\n        using Cons.IH[of ?s']\n        by fast\n      thus ?case \n        unfolding execute_parallel_operator_sas_plus_cons.\n    qed\nqed\n\n\\<comment> \\<open> NOTE Show that the domain value constraint on states is monotonous w.r.t. to valid operator \nexecution. I.e. if a parallel operator is executed on a state for which the domain value constraint \nholds, the domain value constraint will also hold on the resultant state. \\<close>\n(* TODO refactor. \n  TODO Rewrite lemma without domain function, i.e. \\<open>set (the (D v)) \\<leadsto> D\\<close> *)\nlemma sas_plus_equivalent_to_strips_i_a_X:\n  assumes \"dom s \\<subseteq> V\"\n    and \"V \\<subseteq> dom D\"\n    and \"\\<forall>v \\<in> dom s. the (s v) \\<in> set (the (D v))\" \n    and \"\\<forall>op \\<in> set ops. \\<forall>(v, a) \\<in> set (effect_of op). v \\<in> V \\<and> a \\<in> set (the (D v))\" \n  shows \"\\<forall>v \\<in> dom (execute_parallel_operator_sas_plus s ops). \n    the (execute_parallel_operator_sas_plus s ops v) \\<in> set (the (D v))\"  \nproof -\n  show ?thesis \n    using assms\n    proof (induction ops arbitrary: s)\n      case Nil \n      then show ?case\n        unfolding execute_parallel_operator_sas_plus_def\n        by simp \n    next\n      case (Cons op ops)\n      let ?s' = \"s ++ map_of (effect_of op)\" \n      {\n        {\n          have \"\\<forall>(v, a) \\<in> set (effect_of op). v \\<in> V\" \n            using Cons.prems(4)\n            by fastforce\n          moreover have \"fst ` set (effect_of op) \\<subseteq> V\" \n            using calculation\n            by fastforce\n          ultimately have \"dom ?s' \\<subseteq> V\" \n            unfolding dom_map_add dom_map_of_conv_image_fst\n            using Cons.prems(1)\n            by blast\n        }\n        moreover {\n          fix v\n          assume v_in_dom_s': \"v \\<in> dom ?s'\"\n          hence \"the (?s' v) \\<in> set (the (D v))\" \n            proof (cases \"v \\<in> dom (map_of (effect_of op))\")\n              case True\n              moreover have \"?s' v = (map_of (effect_of op)) v\"\n                unfolding map_add_dom_app_simps(1)[OF True]\n                by blast\n              moreover obtain a where \"(map_of (effect_of op)) v = Some a\" \n                using calculation(1) \n                by fast\n              moreover have \"(v, a) \\<in> set (effect_of op)\" \n                using map_of_SomeD calculation(3)\n                by fast\n              moreover have \"a \\<in> set (the (D v))\"\n                using Cons.prems(4) calculation(4)\n                by fastforce\n              ultimately show ?thesis\n                by force\n            next\n              case False\n              then show ?thesis\n                unfolding map_add_dom_app_simps(3)[OF False]\n                using Cons.prems(3) v_in_dom_s'\n                by fast\n            qed\n        }\n        moreover have \"\\<forall>op \\<in> set ops. \\<forall>(v, a) \\<in> set (effect_of op). v \\<in> V \\<and> a \\<in> set (the (D v))\" \n          using Cons.prems(4)\n          by auto\n        ultimately have \"\\<forall>v \\<in> dom (execute_parallel_operator_sas_plus ?s' ops).\n          the (execute_parallel_operator_sas_plus ?s' ops v) \\<in> set (the (D v))\" \n          using Cons.IH[of \"s ++ map_of (effect_of op)\", OF _ Cons.prems(2)]\n          by meson\n      }\n      thus ?case \n        unfolding execute_parallel_operator_sas_plus_cons\n        by blast\n    qed\nqed\n\nlemma transfom_sas_plus_problem_to_strips_problem_operators_valid:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n  obtains op \n  where \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\"\n    and \"op' = (\\<phi>\\<^sub>O \\<Psi> op)\" \"is_valid_operator_sas_plus \\<Psi> op\" \nproof -\n  {\n    obtain op where \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" and \"op' = \\<phi>\\<^sub>O \\<Psi> op\" \n      using assms \n      by auto\n    moreover have \"is_valid_operator_sas_plus \\<Psi> op\" \n      using is_valid_problem_sas_plus_then(2) assms(1) calculation(1)\n      by auto\n    ultimately have \"\\<exists>op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+). op' = (\\<phi>\\<^sub>O \\<Psi> op)\n      \\<and> is_valid_operator_sas_plus \\<Psi> op\"\n      by blast\n  } \n  thus ?thesis \n    using that\n    by blast\nqed\n\nlemma sas_plus_equivalent_to_strips_i_a_XI:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\" \n  shows \"(\\<phi>\\<^sub>S \\<Psi> s) ++ map_of (effect_to_assignments op') \n    = \\<phi>\\<^sub>S \\<Psi> (s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op')))\"\nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\" \n  let ?vs = \"variables_of \\<Psi>\"\n    and?ops = \"operators_of \\<Psi>\" \n    and ?ops' = \"strips_problem.operators_of ?\\<Pi>\"\n  let ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\"                 \n  let ?t = \"?s' ++ map_of (effect_to_assignments op')\"\n    and ?t' = \"\\<phi>\\<^sub>S \\<Psi> (s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op')))\"\n  obtain op where op'_is: \"op' = (\\<phi>\\<^sub>O \\<Psi> op)\" \n    and op_in_ops: \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n    and is_valid_operator_op: \"is_valid_operator_sas_plus \\<Psi> op\"\n    using transfom_sas_plus_problem_to_strips_problem_operators_valid[OF assms]\n    by auto\n  have nb\\<^sub>1: \"(\\<phi>\\<^sub>O\\<inverse> \\<Psi> op') = op\" \n    using sas_plus_operator_inverse_is[OF assms(1)] op'_is op_in_ops \n    by blast\n  \\<comment> \\<open> TODO refactor. \\<close>\n  {\n\n    (*have \"fst ` set (effect_to_assignments op') \\<equiv>\nfst ` ((\\<lambda>v. (v, True)) ` set (add_effects_of op') \\<union> (\\<lambda>v. (v, False)) ` set (delete_effects_of op'))\"\n      \n      by auto\n    then*) have \"dom (map_of (effect_to_assignments op')) \n      = set (strips_operator.add_effects_of op') \\<union> set (strips_operator.delete_effects_of op')\"\n      unfolding dom_map_of_conv_image_fst\n      by force\n    \\<comment> \\<open> TODO slow.\\<close>\n    also have \"\\<dots> = set (effect_of op) \\<union> set (strips_operator.delete_effects_of op')\" \n      using op'_is \n      unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def\n        sasp_op_to_strips_def \n      by auto\n    \\<comment> \\<open> TODO slow.\\<close>\n    finally have \"dom (map_of (effect_to_assignments op')) = set (effect_of op)\n      \\<union> (\\<Union>(v, a) \\<in> set (effect_of op). { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\" \n      using sasp_op_to_strips_set_delete_effects_is[OF \n          is_valid_operator_op] op'_is\n      by argo\n  } note nb\\<^sub>2 = this\n  have nb\\<^sub>3: \"dom ?t = dom ?s' \\<union> set (effect_of op)\n    \\<union> (\\<Union>(v, a) \\<in> set (effect_of op). { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\" \n    unfolding nb\\<^sub>2 dom_map_add\n    by blast\n  \\<comment> \\<open> TODO refactor. \\<close>\n  have nb\\<^sub>4: \"dom (s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))) \n    = dom s \\<union> fst ` set (effect_of op)\"\n    unfolding dom_map_add dom_map_of_conv_image_fst nb\\<^sub>1\n    by fast\n  {\n    let ?u = \"s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))\"\n    have \"dom ?t' = (\\<Union>v \\<in> { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> ?u v \\<noteq> None }. \n      { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\" \n      using state_to_strips_state_dom_is[OF assms(1)]\n      by presburger\n  } note nb\\<^sub>5 = this\n  \\<comment> \\<open> TODO refactor. \\<close>\n  have nb\\<^sub>6: \"set (add_effects_of op') = set (effect_of op)\"\n    using op'_is \n    unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def\n      sasp_op_to_strips_def\n    by auto\n  \\<comment> \\<open> TODO refactor. \\<close>\n  have nb\\<^sub>7: \"set (delete_effects_of op') = (\\<Union>(v, a) \\<in> set (effect_of op). \n      { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\" \n    using sasp_op_to_strips_set_delete_effects_is[OF \n        is_valid_operator_op] op'_is\n    by argo\n  \\<comment> \\<open> TODO refactor. \\<close>\n  {\n    let ?Add = \"set (effect_of op)\" \n    let ?Delete = \"(\\<Union>(v, a) \\<in> set (effect_of op). \n      { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\" \n    have dom_add: \"dom (map_of (map (\\<lambda>v. (v, True)) (add_effects_of op'))) = ?Add\" \n      unfolding dom_map_of_conv_image_fst set_map image_comp comp_apply \n      using nb\\<^sub>6\n      by simp\n    have dom_delete: \"dom (map_of (map (\\<lambda>v. (v, False)) (delete_effects_of op'))) = ?Delete\"\n      unfolding dom_map_of_conv_image_fst set_map image_comp comp_apply \n      using nb\\<^sub>7\n      by auto\n    {\n      {\n        fix v a \n        assume v_a_in_dom_add: \"(v, a) \\<in> dom (map_of (map (\\<lambda>v. (v, True)) (add_effects_of op')))\"\n        have \"(v, a) \\<notin> dom (map_of (map (\\<lambda>v. (v, False)) (delete_effects_of op')))\" \n          proof (rule ccontr) \n            assume \"\\<not>((v, a) \\<notin> dom (map_of (map (\\<lambda>v. (v, False)) (delete_effects_of op'))))\"\n            then have \"(v, a) \\<in> ?Delete\" and \"(v, a) \\<in> ?Add\"\n              using dom_add dom_delete v_a_in_dom_add\n              by argo+   \n            moreover have \"\\<forall>(v', a') \\<in> ?Add. v \\<noteq> v' \\<or> a = a'\"\n              using is_valid_operator_sas_plus_then(6) is_valid_operator_op\n                calculation(2)\n              unfolding is_valid_operator_sas_plus_def\n              by fast\n            ultimately show False\n              by fast\n          qed\n      }\n      hence \"disjnt (dom (map_of (map (\\<lambda>v. (v, True)) (add_effects_of op')))) \n        (dom (map_of (map (\\<lambda>v. (v, False)) (delete_effects_of op'))))\"\n        unfolding disjnt_def Int_def\n        using nb\\<^sub>7\n        by simp\n    }\n    hence \"dom (map_of (map (\\<lambda>v. (v, True)) (add_effects_of op'))) = ?Add\"\n      and \"dom (map_of (map (\\<lambda>v. (v, False)) (delete_effects_of op'))) = ?Delete\"\n      and \"disjnt (dom (map_of (map (\\<lambda>v. (v, True)) (add_effects_of op')))) \n        (dom (map_of (map (\\<lambda>v. (v, False)) (delete_effects_of op'))))\" \n      using dom_add dom_delete\n      by blast+\n  } note nb\\<^sub>8 = this\n  \\<comment> \\<open> TODO refactor. \\<close>\n  {\n    let ?Add = \"set (effect_of op)\" \n    let ?Delete = \"(\\<Union>(v, a) \\<in> set (effect_of op). \n      { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\" \n    \\<comment> \\<open> TODO slow.\\<close>\n    have \"\\<forall>(v, a) \\<in> ?Add. map_of (effect_to_assignments op') (v, a) = Some True\" \n      and \"\\<forall>(v, a) \\<in> ?Delete. map_of (effect_to_assignments op') (v, a) = Some False\"\n      proof -\n        {\n          fix v a\n          assume \"(v, a) \\<in> ?Add\" \n          hence \"map_of (effect_to_assignments op') (v, a) = Some True\"\n            unfolding effect_to_assignments_simp\n            using  nb\\<^sub>6 map_of_defined_if_constructed_from_list_of_constant_assignments[of \n                \"map (\\<lambda>v. (v, True)) (add_effects_of op')\" True \"add_effects_of op'\"]\n            by force\n        }\n        moreover {\n          fix v a\n          assume \"(v, a) \\<in> ?Delete\"\n          moreover have \"(v, a) \\<in> dom (map_of (map (\\<lambda>v. (v, False)) (delete_effects_of op')))\"\n            using nb\\<^sub>8(2) calculation(1)\n            by argo\n          moreover have \"(v, a) \\<notin> dom (map_of (map (\\<lambda>v. (v, True)) (add_effects_of op')))\" \n            using nb\\<^sub>8\n            unfolding disjnt_def \n            using calculation(1)\n            by blast\n          moreover have \"map_of (effect_to_assignments op') (v, a) \n            = map_of (map (\\<lambda>v. (v, False)) (delete_effects_of op')) (v, a)\"\n            unfolding effect_to_assignments_simp map_of_append \n            using map_add_dom_app_simps(3)[OF calculation(3)]\n            by presburger \n          \\<comment> \\<open> TODO slow. \\<close>\n          ultimately have \"map_of (effect_to_assignments op') (v, a) = Some False\"\n            using map_of_defined_if_constructed_from_list_of_constant_assignments[\n                of \"map (\\<lambda>v. (v, False)) (delete_effects_of op')\" False \"delete_effects_of op'\"]\n               nb\\<^sub>7\n            by auto\n        }\n        ultimately show \"\\<forall>(v, a) \\<in> ?Add. map_of (effect_to_assignments op') (v, a) = Some True\" \n          and \"\\<forall>(v, a) \\<in> ?Delete. map_of (effect_to_assignments op') (v, a) = Some False\" \n          by blast+\n      qed\n  } note nb\\<^sub>9 = this\n  {\n    fix v a\n    assume \"(v, a) \\<in> set (effect_of op)\"\n    moreover have \"\\<forall>(v, a) \\<in> set (effect_of op). \\<forall>(v', a') \\<in> set (effect_of op). v \\<noteq> v' \\<or> a = a'\"\n      using is_valid_operator_sas_plus_then is_valid_operator_op\n      unfolding is_valid_operator_sas_plus_def\n      by fast\n    ultimately have \"map_of (effect_of op) v = Some a\" \n      using map_of_constant_assignments_defined_if[of \"effect_of op\"]\n      by presburger\n  } note nb\\<^sub>1\\<^sub>0 = this\n  {\n    fix v a\n    assume v_a_in_effect_of_op: \"(v, a) \\<in> set (effect_of op)\"\n      and \"(s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))) v \\<noteq> None\"\n    moreover have \"v \\<in> set ?vs\"\n        using is_valid_operator_op is_valid_operator_sas_plus_then(3) calculation(1)\n        by fastforce \n    moreover {\n      have \"is_valid_problem_strips ?\\<Pi>\"\n        using is_valid_problem_sas_plus_then_strips_transformation_too \n          assms(1) \n        by blast\n      thm calculation(1) nb\\<^sub>6 assms(2)\n      moreover have \"set (add_effects_of op') \\<subseteq> set ((?\\<Pi>)\\<^sub>\\<V>)\" \n        using assms(2) is_valid_problem_strips_operator_variable_sets(2)\n          calculation \n        by blast\n      moreover have \"(v, a) \\<in> set ((?\\<Pi>)\\<^sub>\\<V>)\"\n        using v_a_in_effect_of_op nb\\<^sub>6 calculation(2) \n        by blast\n      ultimately have \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n        using sas_plus_problem_to_strips_problem_variable_set_element_iff[OF \n            assms(1)]\n        by fast\n    }\n    \\<comment> \\<open> TODO slow. \\<close>\n    ultimately have \"(v, a) \\<in> dom (\\<phi>\\<^sub>S \\<Psi> (s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))))\"  \n      using state_to_strips_state_dom_is[OF assms(1), of \n          \"s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))\"]\n      by simp\n  } note nb\\<^sub>1\\<^sub>1 = this\n  {\n    fix v a\n    assume \"(v, a) \\<in> set (effect_of op)\"\n    moreover have \"v \\<in> dom (map_of (effect_of op))\" \n      unfolding dom_map_of_conv_image_fst \n      using calculation\n      by force \n    moreover have \"(s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))) v = Some a\" \n      unfolding map_add_dom_app_simps(1)[OF calculation(2)] nb\\<^sub>1\n      using nb\\<^sub>1\\<^sub>0 calculation(1)\n      by blast\n    moreover have \"(s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))) v \\<noteq> None\" \n      using calculation(3)\n      by auto\n    moreover have \"(v, a) \\<in> dom (\\<phi>\\<^sub>S \\<Psi> (s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))))\"\n      using nb\\<^sub>1\\<^sub>1 calculation(1, 4)\n      by presburger\n    ultimately have \"(\\<phi>\\<^sub>S \\<Psi> (s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op')))) (v, a) = Some True\" \n      using state_to_strips_state_range_is[OF assms(1)]\n      by simp\n  } note nb\\<^sub>1\\<^sub>2 = this\n  {\n    fix v a'\n    assume \"(v, a') \\<in> dom (map_of (effect_to_assignments op'))\"   \n      and \"(v, a') \\<in>  (\\<Union>(v, a) \\<in> set (effect_of op).\n        { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\"\n    moreover have \"v \\<in> dom (map_of (effect_of op))\" \n      unfolding dom_map_of_conv_image_fst \n      using calculation(2)\n      by force\n    moreover have \"v \\<in> set ?vs\"\n      using calculation(3) is_valid_operator_sas_plus_then(3) is_valid_operator_op\n      unfolding dom_map_of_conv_image_fst is_valid_operator_sas_plus_def\n      by fastforce\n    moreover obtain a where \"(v, a) \\<in> set (effect_of op)\" \n      and \"a' \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n      and \"a' \\<noteq> a\" \n      using calculation(2)\n      by blast\n    moreover have \"(s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))) v = Some a\" \n      unfolding map_add_dom_app_simps(1)[OF calculation(3)] nb\\<^sub>1\n      using nb\\<^sub>1\\<^sub>0 calculation(5)\n      by blast\n    moreover have \"(s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))) v \\<noteq> None\" \n      using calculation(8) \n      by auto\n    \\<comment> \\<open> TODO slow. \\<close>\n    moreover have \"(v, a') \\<in> dom (\\<phi>\\<^sub>S \\<Psi> (s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))))\"\n      using state_to_strips_state_dom_is[OF assms(1), of \n        \"s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))\"] calculation(4, 6, 9)\n      by simp\n    \\<comment> \\<open> TODO slow. \\<close>\n    ultimately have \"(\\<phi>\\<^sub>S \\<Psi> (s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op')))) (v, a') = Some False\" \n      using state_to_strips_state_range_is[OF assms(1), \n          of v a' \"s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))\"]\n      by simp\n  } note nb\\<^sub>1\\<^sub>3 = this\n  {\n    fix v a\n    assume \"(v, a) \\<in> dom ?t\" \n      and \"(v, a) \\<notin> dom (map_of (effect_to_assignments op'))\"\n    moreover have \"(v, a) \\<in> dom ?s'\" \n      using calculation(1, 2)\n      unfolding dom_map_add\n      by blast\n    moreover have \"?t (v, a) = ?s' (v, a)\" \n      unfolding map_add_dom_app_simps(3)[OF calculation(2)]..\n    ultimately have \"?t (v, a) = Some (the (s v) = a)\"\n      using state_to_strips_state_range_is[OF assms(1)] \n      by presburger\n  } note nb\\<^sub>1\\<^sub>4 = this\n  {\n    fix v a\n    assume \"(v, a) \\<in> dom ?t\" \n      and v_a_not_in: \"(v, a) \\<notin> dom (map_of (effect_to_assignments op'))\"\n    moreover have \"(v, a) \\<in> dom ?s'\" \n      using calculation(1, 2)\n      unfolding dom_map_add\n      by blast\n    moreover have \"(v, a) \\<in> (\\<Union> v \\<in> { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None }.\n      { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\"\n      using state_to_strips_state_dom_is[OF assms(1)] calculation(3)\n      by presburger\n    moreover have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" and \"s v \\<noteq> None\" and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n      using calculation(4)\n      by blast+\n    \\<comment> \\<open> NOTE Hasn't this been proved before? \\<close>\n    moreover {\n      have \"dom (map_of (effect_to_assignments op')) = (\\<Union>(v, a) \\<in> set (effect_of op). { (v, a) }) \n        \\<union> (\\<Union>(v, a) \\<in> set (effect_of op). \n          { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\"\n        unfolding nb\\<^sub>2\n        by blast\n      also have \"\\<dots> = (\\<Union>(v, a) \\<in> set (effect_of op). { (v, a) } \n          \\<union> { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\" \n        by blast\n      finally have \"dom (map_of (effect_to_assignments op')) \n        = (\\<Union>(v, a) \\<in> set (effect_of op). { (v, a) } \n          \\<union> { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\"\n        by auto\n      then have \"(v, a) \\<notin> (\\<Union>(v, a) \\<in> set (effect_of op). \n        { (v, a) | a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\" \n        using v_a_not_in\n        by blast\n    }\n    \\<comment> \\<open> TODO slow. \\<close>\n    moreover have \"v \\<notin> dom (map_of (effect_of op))\" \n      using dom_map_of_conv_image_fst calculation \n      by fastforce\n    moreover have \"(s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))) v = s v\" \n      unfolding nb\\<^sub>1 map_add_dom_app_simps(3)[OF calculation(9)]\n      by simp\n    \\<comment> \\<open> TODO slow. \\<close>\n    moreover have \"(v, a) \\<in> dom ?t'\" \n      using state_to_strips_state_dom_is[OF assms(1), of \n        \"s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))\"] calculation(5, 6, 7, 8, 10)\n      by simp\n    ultimately have \"?t' (v, a) = Some (the (s v) = a)\" \n      using state_to_strips_state_range_is[OF assms(1)]\n      by presburger\n  } note nb\\<^sub>1\\<^sub>5 = this\n  \\<comment> \\<open> TODO refactor. \\<close>\n  have nb\\<^sub>1\\<^sub>6: \"dom ?t = (\\<Union> v \\<in> { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None }. \n      { (v, a) | a. a \\<in> (\\<R>\\<^sub>+ \\<Psi> v) }) \n    \\<union> set (effect_of op) \n    \\<union> (\\<Union>(v, a)\\<in>set (effect_of op).\n      {(v, a') |a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a})\"\n    unfolding dom_map_add nb\\<^sub>2\n    using state_to_strips_state_dom_is[OF assms(1), of s]\n    by auto\n  {\n    {\n      fix v a\n      assume \"(v, a) \\<in> dom ?t\"\n      then consider (A) \"(v, a) \\<in> dom (\\<phi>\\<^sub>S \\<Psi> s)\" \n        | (B) \"(v, a) \\<in> dom (map_of (effect_to_assignments op'))\" \n        by fast\n      hence \"(v, a) \\<in> dom ?t'\" \n        proof (cases)\n          case A\n          then have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" and \"s v \\<noteq> None\" and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n            unfolding state_to_strips_state_dom_element_iff[OF assms(1)]\n            by blast+\n          thm map_add_None state_to_strips_state_dom_element_iff[OF assms(1)]\n          moreover have \"(s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))) v \\<noteq> None\" \n            using calculation(2)\n            by simp\n          ultimately show ?thesis \n            unfolding state_to_strips_state_dom_element_iff[OF assms(1)]\n            by blast\n        next\n          case B\n          then have \"(v, a) \\<in> \n              set (effect_of op) \n              \\<union> (\\<Union>(v, a)\\<in>set (effect_of op). { (v, a') | a'. a' \\<in> \\<R>\\<^sub>+ \\<Psi> v \\<and> a' \\<noteq> a })\" \n            unfolding nb\\<^sub>2\n            by blast\n          then consider (B\\<^sub>1) \"(v, a) \\<in> set (effect_of op)\" \n            | (B\\<^sub>2) \"(v, a) \\<in> (\\<Union>(v, a)\\<in>set (effect_of op). \n            { (v, a') | a'. a' \\<in> \\<R>\\<^sub>+ \\<Psi> v \\<and> a' \\<noteq> a })\"\n            by blast\n          thm nb\\<^sub>1\\<^sub>2 nb\\<^sub>1\\<^sub>3 nb\\<^sub>2\n          thus ?thesis\n            proof (cases)\n              case B\\<^sub>1\n              then show ?thesis\n                using nb\\<^sub>1\\<^sub>2\n                by fast\n            next\n              case B\\<^sub>2\n              then show ?thesis\n                using nb\\<^sub>1\\<^sub>3 B\n                by blast\n            qed \n        qed \n    } \n    moreover {\n      let ?u = \"s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))\"\n      fix v a\n      assume v_a_in_dom_t': \"(v, a) \\<in> dom ?t'\"\n      thm nb\\<^sub>5\n      then have v_in_vs: \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n        and u_of_v_is_not_None: \"?u v \\<noteq> None\" \n        and a_in_range_of_v: \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n        using state_to_strips_state_dom_element_iff[OF assms(1)]\n          v_a_in_dom_t'\n        by meson+\n      {\n        assume \"(v, a) \\<notin> dom ?t\" \n        then have contradiction: \"(v, a) \\<notin> \n          (\\<Union>v \\<in> { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None}. { (v, a) |a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v }) \n          \\<union> set (effect_of op) \n          \\<union> (\\<Union>(v, a)\\<in>set (effect_of op). {(v, a') |a'. a' \\<in> \\<R>\\<^sub>+ \\<Psi> v \\<and> a' \\<noteq> a})\" \n          unfolding nb\\<^sub>1\\<^sub>6\n          by fast\n        hence False \n          proof (cases \"map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op')) v = None\")\n            case True\n            then have \"s v \\<noteq> None\" \n              using u_of_v_is_not_None\n              by simp\n            then have \"(v, a) \\<in> (\\<Union>v \\<in> { v | v. v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> s v \\<noteq> None}. \n              { (v, a) |a. a \\<in> \\<R>\\<^sub>+ \\<Psi> v })\" \n              using v_in_vs a_in_range_of_v \n              by blast\n            thus ?thesis \n              using contradiction\n              by blast\n          next\n            case False\n            then have \"v \\<in> dom (map_of (effect_of op))\" \n              using u_of_v_is_not_None nb\\<^sub>1 \n              by blast\n            then obtain a' where map_of_effect_of_op_v_is: \"map_of (effect_of op) v = Some a'\" \n              by blast\n            then have v_a'_in: \"(v, a') \\<in> set (effect_of op)\" \n              using map_of_SomeD \n              by fast\n            then show ?thesis\n              proof (cases \"a = a'\")\n                case True\n                then have \"(v, a) \\<in> set (effect_of op)\" \n                  using v_a'_in\n                  by blast\n                then show ?thesis \n                  using contradiction\n                  by blast\n              next\n                case False\n                then have \"(v, a) \\<in> (\\<Union>(v, a)\\<in>set (effect_of op). \n                  {(v, a') |a'. a' \\<in> \\<R>\\<^sub>+ \\<Psi> v \\<and> a' \\<noteq> a})\" \n                  using v_a'_in calculation a_in_range_of_v\n                  by blast\n                thus ?thesis\n                  using contradiction\n                  by fast\n              qed\n          qed\n      }\n      hence \"(v, a) \\<in> dom ?t\"\n        by argo\n    }\n    moreover have \"dom ?t \\<subseteq> dom ?t'\" and \"dom ?t' \\<subseteq> dom ?t\" \n      subgoal \n        using calculation(1) subrelI[of \"dom ?t\" \"dom ?t'\"]\n        by fast\n      subgoal\n        using calculation(2) subrelI[of \"dom ?t'\" \"dom ?t\"]\n        by argo\n      done\n    ultimately have \"dom ?t = dom ?t'\"\n      by force\n  } note nb\\<^sub>1\\<^sub>7 = this\n  {\n    fix v a\n    assume v_a_in_dom_t: \"(v, a) \\<in> dom ?t\" \n    hence \"?t (v, a) = ?t' (v, a)\"\n      proof (cases \"(v, a) \\<in> dom (map_of (effect_to_assignments op'))\")\n        case True\n        \\<comment> \\<open> TODO slow. \\<close>\n        \\<comment> \\<open> NOTE Split on the (disjunct) domain variable sets of \n          @{text \"map_of (effect_to_assignments op')\"}. \\<close> \n        then consider (A1) \"(v, a) \\<in> set (effect_of op)\" \n          | (A2) \"(v, a) \\<in> (\\<Union>(v, a) \\<in> set (effect_of op).\n            { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and> a' \\<noteq> a })\"\n          using nb\\<^sub>2\n          by fastforce\n        then show ?thesis \n          proof (cases)\n            case A1\n            then have \"?t (v, a) = Some True\" \n              unfolding map_add_dom_app_simps(1)[OF True]\n              using nb\\<^sub>9(1)\n              by fast\n            moreover have \"?t' (v, a) = Some True\"\n              using nb\\<^sub>1\\<^sub>2[OF A1].\n            ultimately show ?thesis..\n          next\n            case A2\n            then have \"?t (v, a) = Some False\" \n              unfolding map_add_dom_app_simps(1)[OF True]\n              using nb\\<^sub>9(2)\n              by blast\n            moreover have \"?t' (v, a) = Some False\"\n              using nb\\<^sub>1\\<^sub>3[OF True A2].\n            ultimately show ?thesis..\n          qed\n      next\n        case False\n        moreover have \"?t (v, a) = Some (the (s v) = a)\" \n          using nb\\<^sub>1\\<^sub>4[OF v_a_in_dom_t False].\n        moreover have \"?t' (v, a) = Some (the (s v) = a)\" \n          using nb\\<^sub>1\\<^sub>5[OF v_a_in_dom_t False].\n        ultimately show ?thesis \n          by argo\n      qed\n  } note nb\\<^sub>1\\<^sub>8 = this\n  moreover {\n    fix v a\n    assume \"(v, a) \\<in> dom ?t'\" \n    hence \"?t (v, a) = ?t' (v, a)\" \n      using nb\\<^sub>1\\<^sub>7 nb\\<^sub>1\\<^sub>8\n      by presburger\n  }\n  \\<comment> \\<open> TODO slow.\\<close>\n  ultimately have \"?t \\<subseteq>\\<^sub>m ?t'\" and \"?t' \\<subseteq>\\<^sub>m ?t\" \n    unfolding map_le_def \n    by fastforce+\n  thus ?thesis\n    using map_le_antisym[of ?t ?t'] \n    by fast\nqed\n\n\\<comment> \\<open> NOTE This is the essential step in the SAS+/STRIPS equivalence theorem. We show that executing\na given parallel STRIPS operator @{text \"ops'\"} on the corresponding STRIPS state \n@{text \"s' = \\<phi>\\<^sub>S \\<Psi> s\"} yields the same state as executing the transformed SAS+ parallel operator\n@{text \"ops = [\\<phi>\\<^sub>O\\<inverse> (\\<phi> \\<Psi>) op'. op' \\<leftarrow> ops']\"} on the original SAS+ state @{text \"s\"} and the \ntransforming the resultant SAS+ state to its corresponding STRIPS state. \\<close>\n(* TODO refactor. *)\nlemma sas_plus_equivalent_to_strips_i_a_XII:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"\\<forall>op' \\<in> set ops'. op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\" \n  shows \"execute_parallel_operator (\\<phi>\\<^sub>S \\<Psi> s) ops' \n    = \\<phi>\\<^sub>S \\<Psi> (execute_parallel_operator_sas_plus s [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops'])\" \nusing assms\nproof (induction ops' arbitrary: s)\n  case Nil\n  then show ?case \n    unfolding execute_parallel_operator_def execute_parallel_operator_sas_plus_def \n    by simp\nnext\n  case (Cons op' ops')\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?t' = \"(\\<phi>\\<^sub>S \\<Psi> s) ++ map_of (effect_to_assignments op')\"\n    and ?t = \"s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'))\"\n  have nb\\<^sub>1: \"?t' = \\<phi>\\<^sub>S \\<Psi> ?t\" \n    using sas_plus_equivalent_to_strips_i_a_XI[OF assms(1)] Cons.prems(2)\n    by force\n  {\n    have \"\\<forall>op' \\<in> set ops'. op' \\<in> set (strips_problem.operators_of ?\\<Pi>)\" \n      using Cons.prems(2) \n      by simp\n    then have \"execute_parallel_operator (\\<phi>\\<^sub>S \\<Psi> ?t) ops' \n      = \\<phi>\\<^sub>S \\<Psi> (execute_parallel_operator_sas_plus ?t [\\<phi>\\<^sub>O\\<inverse> \\<Psi> x. x \\<leftarrow> ops'])\"\n      using Cons.IH[OF Cons.prems(1), of ?t]\n      by fastforce\n    hence \"execute_parallel_operator ?t' ops'\n      = \\<phi>\\<^sub>S \\<Psi> (execute_parallel_operator_sas_plus ?t [\\<phi>\\<^sub>O\\<inverse> \\<Psi> x. x \\<leftarrow> ops'])\" \n      using nb\\<^sub>1\n      by argo\n  }\n  thus ?case \n    by simp\nqed\n\nlemma sas_plus_equivalent_to_strips_i_a_XIII: \n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"\\<forall>op' \\<in> set ops'. op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    and \"(\\<phi>\\<^sub>S \\<Psi> G) \\<subseteq>\\<^sub>m execute_parallel_plan \n      (execute_parallel_operator (\\<phi>\\<^sub>S \\<Psi> I) ops') \\<pi>\"\n  shows \"(\\<phi>\\<^sub>S \\<Psi> G) \\<subseteq>\\<^sub>m execute_parallel_plan \n    (\\<phi>\\<^sub>S \\<Psi> (execute_parallel_operator_sas_plus I [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops'])) \\<pi>\"\nproof -\n  let ?I' = \"(\\<phi>\\<^sub>S \\<Psi> I)\"\n    and ?G' = \"\\<phi>\\<^sub>S \\<Psi> G\" \n    and ?ops = \"[\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\" \n    and ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?J = \"execute_parallel_operator_sas_plus I ?ops\"\n  {\n    fix v a\n    assume \"(v, a) \\<in> dom ?G'\"\n    then have \"?G' (v, a) = execute_parallel_plan \n      (execute_parallel_operator ?I' ops') \\<pi> (v, a)\"\n      using assms(3) \n      unfolding map_le_def\n      by auto\n    hence \"?G' (v, a) = execute_parallel_plan (\\<phi>\\<^sub>S \\<Psi> ?J) \\<pi> (v, a)\" \n      using sas_plus_equivalent_to_strips_i_a_XII[OF assms(1, 2)]\n      by simp\n  }\n  thus ?thesis \n    unfolding map_le_def\n    by fast\nqed\n\n\\<comment> \\<open> NOTE This is a more abstract formulation of the proposition in \n\\<open>sas_plus_equivalent_to_strips_i\\<close> which is better suited for induction proofs. We essentially claim \nthat given a plan the execution in STRIPS semantics of which solves the problem of reaching a \ntransformed goal state \\<open>\\<phi>\\<^sub>S \\<Psi> G\\<close> from a transformed initial state \\<open>\\<phi>\\<^sub>S \\<Psi> I\\<close>---such as \nthe goal and initial state of an induced STRIPS problem for a SAS+ problem---is equivalent to an\nexecution in SAS+ semantics of the transformed plan \\<open>\\<phi>\\<^sub>P\\<inverse> (\\<phi> \\<Psi>) \\<pi>\\<close> w.r.t to the original \ninitial state \\<open>I\\<close> and original goal state \\<open>G\\<close>. \\<close> \nlemma sas_plus_equivalent_to_strips_i_a:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"dom I \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n    and \"\\<forall>v \\<in> dom I. the (I v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    and \"dom G \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n    and \"\\<forall>v \\<in> dom G. the (G v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    and \"\\<forall>ops' \\<in> set \\<pi>. \\<forall>op' \\<in> set ops'. op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    and \"(\\<phi>\\<^sub>S \\<Psi> G) \\<subseteq>\\<^sub>m execute_parallel_plan (\\<phi>\\<^sub>S \\<Psi> I) \\<pi>\"\n  shows \"G \\<subseteq>\\<^sub>m execute_parallel_plan_sas_plus I (\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>)\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?\\<psi> = \"\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>\"\n  show ?thesis \n    using assms\n    proof (induction \\<pi> arbitrary: I)\n      case Nil\n      then have \"(\\<phi>\\<^sub>S \\<Psi> G) \\<subseteq>\\<^sub>m (\\<phi>\\<^sub>S \\<Psi> I)\" \n        by fastforce\n      then have \"G \\<subseteq>\\<^sub>m I\" \n        using state_to_strips_state_map_le_iff[OF assms(1, 4, 5)]\n        by blast\n      thus ?case \n        unfolding SAS_Plus_STRIPS.strips_parallel_plan_to_sas_plus_parallel_plan_def\n          strips_parallel_plan_to_sas_plus_parallel_plan_def \n        by fastforce\n    next\n      case (Cons ops' \\<pi>)\n      let ?D = \"range_of \\<Psi>\"\n        and ?\\<Pi> = \"\\<phi> \\<Psi>\" \n        and ?I' = \"\\<phi>\\<^sub>S \\<Psi> I\"\n        and ?G' = \"\\<phi>\\<^sub>S \\<Psi> G\"\n      let ?ops = \"[\\<phi>\\<^sub>O\\<inverse> \\<Psi> op'. op' \\<leftarrow> ops']\" \n      let ?J = \"execute_parallel_operator_sas_plus I ?ops\"\n        and ?J' = \"execute_parallel_operator ?I' ops'\" \n      have nb\\<^sub>1: \"set ops' \\<subseteq> set ((?\\<Pi>)\\<^sub>\\<O>)\" \n        using Cons.prems(6)\n        unfolding STRIPS_Semantics.is_parallel_solution_for_problem_def list_all_iff ListMem_iff\n        by fastforce\n      {\n        fix op \n        assume \"op \\<in> set ?ops\" \n        moreover obtain op' where \"op' \\<in> set ops'\" and \"op = \\<phi>\\<^sub>O\\<inverse> \\<Psi> op'\" \n          using calculation \n          by auto\n        moreover have \"op' \\<in> set ((?\\<Pi>)\\<^sub>\\<O>)\"\n          using nb\\<^sub>1 calculation(2)\n          by blast\n        moreover obtain op'' where \"op'' \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" and \"op' = \\<phi>\\<^sub>O \\<Psi> op''\" \n          using calculation(4) \n          by auto\n        moreover have \"op = op''\" \n          using sas_plus_operator_inverse_is[OF assms(1) calculation(5)] calculation(3, 6) \n          by presburger\n        ultimately have \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+) \\<and> (\\<exists>op' \\<in> set ops'. op' = \\<phi>\\<^sub>O \\<Psi> op)\" \n          by blast\n      } note nb\\<^sub>2 = this\n      {\n        fix op v a\n        assume \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" and \"(v, a) \\<in> set (effect_of op)\" \n        moreover have \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n          using nb\\<^sub>2 calculation(1)\n          by blast\n        moreover have \"is_valid_operator_sas_plus \\<Psi> op\"\n          using is_valid_problem_sas_plus_then(2) Cons.prems(1) calculation(3) \n          by blast\n        ultimately have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n          using is_valid_operator_sas_plus_then(3) \n          by fastforce\n      } note nb\\<^sub>3 = this\n      {\n        fix op\n        assume \"op \\<in> set ?ops\" \n        then have \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n          using nb\\<^sub>2 \n          by blast\n        then have \"is_valid_operator_sas_plus \\<Psi> op\"\n          using is_valid_problem_sas_plus_then(2) Cons.prems(1)\n          by blast\n        hence \"\\<forall>(v, a) \\<in> set (effect_of op). v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \n          \\<and> a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n          using is_valid_operator_sas_plus_then(3,4) \n          by fast\n      } note nb\\<^sub>4 = this\n      show ?case \n        proof (cases \"STRIPS_Semantics.are_all_operators_applicable ?I' ops' \n          \\<and> STRIPS_Semantics.are_all_operator_effects_consistent ops'\")\n          case True\n          {\n            {\n              have \"dom I \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n                using Cons.prems(2)\n                by blast\n              hence \"(\\<phi>\\<^sub>S\\<inverse> \\<Psi> ?I') = I\"\n                using strips_state_to_state_inverse_is[OF \n                    Cons.prems(1) _ Cons.prems(3)]\n                by argo\n            }\n            then have \"are_all_operators_applicable_in I ?ops\n              \\<and> are_all_operator_effects_consistent ?ops\" \n              using sas_plus_equivalent_to_strips_i_a_IV[OF assms(1) nb\\<^sub>1, of I] True\n              by simp\n            moreover have \"(\\<phi>\\<^sub>P\\<inverse> \\<Psi> (ops' # \\<pi>)) = ?ops # (\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>)\" \n              unfolding SAS_Plus_STRIPS.strips_parallel_plan_to_sas_plus_parallel_plan_def\n                strips_parallel_plan_to_sas_plus_parallel_plan_def\n                SAS_Plus_STRIPS.strips_op_to_sasp_def\n                  strips_op_to_sasp_def  \n              by simp\n            ultimately have \"execute_parallel_plan_sas_plus I (\\<phi>\\<^sub>P\\<inverse> \\<Psi> (ops' # \\<pi>)) \n              = execute_parallel_plan_sas_plus ?J (\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>)\" \n              by force\n          } note nb\\<^sub>5 = this\n          \\<comment> \\<open> Show the goal using the IH. \\<close>\n          {\n            have dom_J_subset_eq_vs: \"dom ?J \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n              using sas_plus_equivalent_to_strips_i_a_IX[OF Cons.prems(2)] nb\\<^sub>2 nb\\<^sub>4\n              by blast\n            moreover {\n              have \"set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<subseteq> dom (range_of \\<Psi>)\"\n                using is_valid_problem_sas_plus_then(1)[OF assms(1)]\n                by fastforce\n              moreover have \"\\<forall>v \\<in> dom I. the (I v) \\<in> set (the (range_of \\<Psi> v))\"\n                using Cons.prems(2, 3) assms(1) set_the_range_of_is_range_of_sas_plus_if \n                by force\n              moreover have \"\\<forall>op \\<in> set ?ops. \\<forall>(v, a) \\<in> set (effect_of op).\n                v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \\<and> a \\<in> set (the (?D v))\" \n                using set_the_range_of_is_range_of_sas_plus_if assms(1) nb\\<^sub>4 \n                by fastforce\n              moreover have v_in_dom_J_range: \"\\<forall>v \\<in> dom ?J. the (?J v) \\<in> set (the (?D v))\" \n                using sas_plus_equivalent_to_strips_i_a_X[of \n                    I \"set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" ?D ?ops, OF Cons.prems(2)] calculation(1, 2, 3)\n                by fastforce\n              {\n                fix v \n                assume \"v \\<in> dom ?J\"\n                moreover have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n                  using nb\\<^sub>2 calculation dom_J_subset_eq_vs \n                  by blast\n                moreover have \"set (the (range_of \\<Psi> v)) = \\<R>\\<^sub>+ \\<Psi> v\" \n                  using set_the_range_of_is_range_of_sas_plus_if[OF assms(1)] \n                    calculation(2)\n                  by presburger\n                ultimately have \"the (?J v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n                  using nb\\<^sub>3 v_in_dom_J_range\n                  by blast\n              }\n              ultimately have \"\\<forall>v \\<in> dom ?J. the (?J v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n                by fast\n            }\n            moreover have \"\\<forall>ops' \\<in> set \\<pi>. \\<forall>op'\\<in>set ops'. op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n              using Cons.prems(6)\n              by simp\n            moreover {\n              have \"?G' \\<subseteq>\\<^sub>m execute_parallel_plan ?J' \\<pi>\" \n                using Cons.prems(7) True\n                by auto\n              hence \"(\\<phi>\\<^sub>S \\<Psi> G) \\<subseteq>\\<^sub>m execute_parallel_plan (\\<phi>\\<^sub>S \\<Psi> ?J) \\<pi>\"\n                using sas_plus_equivalent_to_strips_i_a_XIII[OF Cons.prems(1)] nb\\<^sub>1\n                by blast\n            }\n            ultimately have \"G \\<subseteq>\\<^sub>m execute_parallel_plan_sas_plus I (\\<phi>\\<^sub>P\\<inverse> \\<Psi> (ops' # \\<pi>))\"\n              using Cons.IH[of ?J, OF Cons.prems(1) _ _ Cons.prems(4, 5)] Cons.prems(6) nb\\<^sub>5 \n              by presburger\n          }\n          thus ?thesis.\n        next\n          case False\n          then have \"?G' \\<subseteq>\\<^sub>m ?I'\" \n            using Cons.prems(7)\n            by force\n          moreover {\n            have \"dom I \\<subseteq> set ?vs\" \n              using Cons.prems(2)\n              by simp\n            hence \"\\<not>(are_all_operators_applicable_in I ?ops\n              \\<and> are_all_operator_effects_consistent ?ops)\" \n              using sas_plus_equivalent_to_strips_i_a_VIII[OF Cons.prems(1) _ Cons.prems(3) nb\\<^sub>1] \n                False\n              by force\n          }\n          moreover {\n            have \"(\\<phi>\\<^sub>P\\<inverse> \\<Psi> (ops' # \\<pi>)) = ?ops # (\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>)\" \n              unfolding SAS_Plus_STRIPS.strips_parallel_plan_to_sas_plus_parallel_plan_def\n                strips_parallel_plan_to_sas_plus_parallel_plan_def\n                SAS_Plus_STRIPS.strips_op_to_sasp_def\n                strips_op_to_sasp_def\n              by simp\n            hence \"G \\<subseteq>\\<^sub>m execute_parallel_plan_sas_plus I (?ops # (\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>))\n              \\<longleftrightarrow> G \\<subseteq>\\<^sub>m I\" \n              using calculation(2)\n              by force\n          }\n          ultimately show ?thesis \n            using state_to_strips_state_map_le_iff[OF Cons.prems(1, 4, 5)] \n            unfolding SAS_Plus_STRIPS.strips_parallel_plan_to_sas_plus_parallel_plan_def\n              strips_parallel_plan_to_sas_plus_parallel_plan_def\n              SAS_Plus_STRIPS.strips_op_to_sasp_def\n              strips_op_to_sasp_def\n            by force\n        qed\n    qed\nqed\n\n\\<comment> \\<open> NOTE Show that a solution for the induced STRIPS problem for the given valid SAS+ problem, \n  corresponds to a solution for the given SAS+ problem.\n\nNote that in the context of the SAS+ problem solving pipeline, we\n\\begin{enumerate}\n  \\item convert the given valid SAS+ @{text \"\\<Psi>\"} problem to the corresponding STRIPS problem \n@{text \"\\<Pi>\"} (this is implicitely also valid by lemma \n@{text \"is_valid_problem_sas_plus_then_strips_transformation_too\"}); then,\n  \\item get a solution @{text \"\\<pi>\"}---if it exists---for the induced STRIPS problem by executing \nSATPlan; and finally,\n  \\item convert @{text \"\\<pi>\"} back to a solution @{text \"\\<psi>\"} for the SAS+ problem.\n\\end{enumerate} \\<close>\nlemma sas_plus_equivalent_to_strips_i:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"STRIPS_Semantics.is_parallel_solution_for_problem \n    (\\<phi> \\<Psi>) \\<pi>\"\n  shows \"goal_of \\<Psi> \\<subseteq>\\<^sub>m execute_parallel_plan_sas_plus \n    (sas_plus_problem.initial_of \\<Psi>) (\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>)\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?I = \"initial_of \\<Psi>\" \n    and ?G = \"goal_of \\<Psi>\"\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?G' = \"strips_problem.goal_of ?\\<Pi>\"\n    and ?I' = \"strips_problem.initial_of ?\\<Pi>\"\n  let ?\\<psi> = \"\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>\"\n  have \"dom ?I \\<subseteq> set ?vs\" \n    using is_valid_problem_sas_plus_then(3) assms(1)\n    by auto\n  moreover have \"\\<forall>v \\<in> dom ?I. the (?I v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    using is_valid_problem_sas_plus_then(4) assms(1) calculation\n    by auto\n  moreover have \"dom ?G \\<subseteq> set ?vs\"  and \"\\<forall>v \\<in> dom ?G. the (?G v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    using is_valid_problem_sas_plus_then(5, 6) assms(1)\n    by blast+\n  moreover have \"\\<forall>ops'\\<in>set \\<pi>. \\<forall>op'\\<in>set ops'. op' \\<in> set ((?\\<Pi>)\\<^sub>\\<O>)\"\n    using is_parallel_solution_for_problem_operator_set[OF assms(2)]\n    by simp\n  moreover {\n    have \"?G' \\<subseteq>\\<^sub>m execute_parallel_plan ?I' \\<pi>\"\n      using assms(2) \n      unfolding STRIPS_Semantics.is_parallel_solution_for_problem_def..\n    moreover have \"?G' = \\<phi>\\<^sub>S \\<Psi> ?G\" and \"?I' = \\<phi>\\<^sub>S \\<Psi> ?I\" \n      by simp+\n    ultimately have \"(\\<phi>\\<^sub>S \\<Psi> ?G) \\<subseteq>\\<^sub>m execute_parallel_plan (\\<phi>\\<^sub>S \\<Psi> ?I) \\<pi>\"\n      by simp\n  }\n  ultimately show ?thesis \n    using sas_plus_equivalent_to_strips_i_a[OF assms(1)]\n    by simp\nqed\n\n\\<comment> \\<open> NOTE Show that the operators for a given solution @{text \"\\<pi>\"} to the induced STRIPS problem \nfor a given SAS+ problem correspond to operators of the SAS+ problem. \\<close>\nlemma sas_plus_equivalent_to_strips_ii:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"STRIPS_Semantics.is_parallel_solution_for_problem (\\<phi> \\<Psi>) \\<pi>\"\n  shows \"list_all (list_all (\\<lambda>op. ListMem op (operators_of \\<Psi>))) (\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>)\" \nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\" \n  let ?ops = \"operators_of \\<Psi>\" \n    and ?\\<psi> = \"\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>\"\n  have \"is_valid_problem_strips ?\\<Pi>\" \n    using is_valid_problem_sas_plus_then_strips_transformation_too[OF assms(1)]\n    by simp \n  have nb\\<^sub>1: \"\\<forall>op' \\<in> set ((?\\<Pi>)\\<^sub>\\<O>). (\\<exists>op \\<in> set ?ops. op' = (\\<phi>\\<^sub>O \\<Psi> op))\"  \n    by auto\n  {\n    fix ops' op' op\n    assume \"ops' \\<in> set \\<pi>\" and \"op' \\<in> set ops'\" \n    then have \"op' \\<in> set (strips_problem.operators_of ?\\<Pi>)\"\n      using is_parallel_solution_for_problem_operator_set[OF assms(2)]\n      by simp\n    then obtain op where \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" and \"op' = (\\<phi>\\<^sub>O \\<Psi> op)\" \n      by auto\n    then have \"(\\<phi>\\<^sub>O\\<inverse> \\<Psi> op') \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\"\n      using sas_plus_operator_inverse_is[OF assms(1)]\n      by presburger\n  }\n  thus ?thesis \n    unfolding list_all_iff ListMem_iff \n      strips_parallel_plan_to_sas_plus_parallel_plan_def\n      SAS_Plus_STRIPS.strips_parallel_plan_to_sas_plus_parallel_plan_def\n      SAS_Plus_STRIPS.strips_op_to_sasp_def\n      strips_op_to_sasp_def\n    by auto\nqed\n\ntext \\<open> We now show that for a parallel solution \\<^term>\\<open>\\<pi>\\<close> of \\<^term>\\<open>\\<Pi>\\<close> the SAS+ plan \n\\<^term>\\<open>\\<psi> \\<equiv> \\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>\\<close> yielded by the STRIPS to SAS+ plan transformation is a solution for \n\\<^term>\\<open>\\<Psi>\\<close>. The proof uses the definition of parallel STRIPS solutions and shows that the \nexecution of \\<^term>\\<open>\\<psi>\\<close> on the initial state of the SAS+ problem yields a state satisfying the \nproblem's goal state, i.e.\n  @{text[display, indent=4]\"G \\<subseteq>\\<^sub>m execute_parallel_plan_sas_plus I \\<psi>\"}\nand by showing that all operators in all parallel operators of \\<^term>\\<open>\\<psi>\\<close> are operators of the \nproblem. \\<close>\n\ntheorem\n  sas_plus_equivalent_to_strips:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"STRIPS_Semantics.is_parallel_solution_for_problem (\\<phi> \\<Psi>) \\<pi>\" \n  shows \"is_parallel_solution_for_problem \\<Psi> (\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>)\"\nproof -\n  let ?I = \"initial_of \\<Psi>\"\n    and ?G = \"goal_of \\<Psi>\" \n    and ?ops = \"operators_of \\<Psi>\"\n    and ?\\<psi> = \"\\<phi>\\<^sub>P\\<inverse> \\<Psi> \\<pi>\"\n  show ?thesis\n    unfolding is_parallel_solution_for_problem_def Let_def\n    proof (rule conjI)\n      show \"?G \\<subseteq>\\<^sub>m execute_parallel_plan_sas_plus ?I ?\\<psi>\"\n        using sas_plus_equivalent_to_strips_i[OF assms].\n    next \n      show \"list_all (list_all (\\<lambda>op. ListMem op ?ops)) ?\\<psi>\" \n        using sas_plus_equivalent_to_strips_ii[OF assms].\n    qed\nqed\n\nprivate lemma strips_equivalent_to_sas_plus_i_a_I:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"\\<forall>op \\<in> set ops. op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n    and \"op' \\<in> set [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops]\"\n  obtains op where \"op \\<in> set ops\" \n    and \"op' = \\<phi>\\<^sub>O \\<Psi> op\"\nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\" \n  let ?ops = \"operators_of \\<Psi>\"\n  obtain op where \"op \\<in> set ops\" and \"op' = \\<phi>\\<^sub>O \\<Psi> op\" \n    using assms(3) \n    by auto\n  thus ?thesis \n    using that\n    by blast\nqed\n\nprivate corollary strips_equivalent_to_sas_plus_i_a_II:\n  assumes\"is_valid_problem_sas_plus \\<Psi>\"\n    and \"\\<forall>op \\<in> set ops. op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n    and \"op' \\<in> set [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops]\"\n  shows \"op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    and \"is_valid_operator_strips (\\<phi> \\<Psi>) op'\"\nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\" \n  let ?ops = \"operators_of \\<Psi>\"\n    and ?ops' = \"strips_problem.operators_of ?\\<Pi>\"\n  obtain op where op_in: \"op \\<in> set ops\" and op'_is: \"op' = \\<phi>\\<^sub>O \\<Psi> op\" \n    using strips_equivalent_to_sas_plus_i_a_I[OF assms].\n  then have nb: \"op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    using assms(2) op_in op'_is \n    by fastforce\n  thus \"op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n    and \"is_valid_operator_strips ?\\<Pi> op'\" \n    proof -\n      have \"\\<forall>op' \\<in> set ?ops'. is_valid_operator_strips ?\\<Pi> op'\"\n        using is_valid_problem_sas_plus_then_strips_transformation_too_iii[OF assms(1)]\n        unfolding list_all_iff. \n      thus \"is_valid_operator_strips ?\\<Pi> op'\" \n        using nb\n        by fastforce\n    qed fastforce\nqed\n\n(* TODO make private *)\nlemma strips_equivalent_to_sas_plus_i_a_III:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"\\<forall>op \\<in> set ops. op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\"\n  shows \"execute_parallel_operator (\\<phi>\\<^sub>S \\<Psi> s) [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops]\n    = (\\<phi>\\<^sub>S \\<Psi> (execute_parallel_operator_sas_plus s ops))\"\nproof -\n  {\n    fix op s\n    assume \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n    moreover have \"(\\<phi>\\<^sub>O \\<Psi> op) \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n      using calculation \n      by simp\n    moreover have \"(\\<phi>\\<^sub>S \\<Psi> s) ++ map_of (effect_to_assignments (\\<phi>\\<^sub>O \\<Psi> op))\n      = (\\<phi>\\<^sub>S \\<Psi> (s ++ map_of (effect_of (\\<phi>\\<^sub>O\\<inverse> \\<Psi> (\\<phi>\\<^sub>O \\<Psi> op)))))\"\n      using sas_plus_equivalent_to_strips_i_a_XI[OF assms(1) calculation(2)]\n      by blast\n    moreover have \"(\\<phi>\\<^sub>O\\<inverse> \\<Psi> (\\<phi>\\<^sub>O \\<Psi> op)) = op\"\n      using sas_plus_operator_inverse_is[OF assms(1) calculation(1)].\n    ultimately have \"(\\<phi>\\<^sub>S \\<Psi> s) \\<then> (\\<phi>\\<^sub>O \\<Psi> op)\n      = (\\<phi>\\<^sub>S \\<Psi> (s \\<then>\\<^sub>+ op))\" \n      unfolding execute_operator_def execute_operator_sas_plus_def \n      by simp\n  } note nb\\<^sub>1 = this\n  show ?thesis \n    using assms\n    proof (induction ops arbitrary: s)\n      case Nil\n      then show ?case \n        unfolding execute_parallel_operator_def execute_parallel_operator_sas_plus_def \n        by simp\n    next\n      case (Cons op ops)\n      let ?t = \"s \\<then>\\<^sub>+ op\"\n      let ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\" \n        and ?ops' = \"[\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> op # ops]\"\n      let ?t' = \"?s' \\<then> (\\<phi>\\<^sub>O \\<Psi> op)\"\n      have \"execute_parallel_operator ?s' ?ops' \n        = execute_parallel_operator ?t' [\\<phi>\\<^sub>O \\<Psi> x. x \\<leftarrow> ops]\"\n        unfolding execute_operator_def\n        by simp\n      moreover have \"(\\<phi>\\<^sub>S \\<Psi> (execute_parallel_operator_sas_plus s (op # ops)))\n        = (\\<phi>\\<^sub>S \\<Psi> (execute_parallel_operator_sas_plus ?t ops))\" \n        unfolding execute_operator_sas_plus_def\n        by simp\n      moreover {\n        have \"?t' = (\\<phi>\\<^sub>S \\<Psi> ?t)\"\n          using nb\\<^sub>1 Cons.prems(2)\n          by simp\n        hence \"execute_parallel_operator ?t'[\\<phi>\\<^sub>O \\<Psi> x. x \\<leftarrow> ops] \n          = (\\<phi>\\<^sub>S \\<Psi> (execute_parallel_operator_sas_plus ?t ops))\" \n          using Cons.IH[of ?t] Cons.prems\n          by simp\n      }\n      ultimately show ?case \n        by argo\n    qed\nqed\n\nprivate lemma strips_equivalent_to_sas_plus_i_a_IV:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"\\<forall>op \\<in> set ops. op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\"\n    and \"are_all_operators_applicable_in I ops \n    \\<and> are_all_operator_effects_consistent ops\"\n  shows \"STRIPS_Semantics.are_all_operators_applicable (\\<phi>\\<^sub>S \\<Psi> I) [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops]\n    \\<and> STRIPS_Semantics.are_all_operator_effects_consistent [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops]\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\" \n    and ?ops = \"operators_of \\<Psi>\" \n  let ?I' = \"\\<phi>\\<^sub>S \\<Psi> I\" \n    and ?ops' = \"[\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops]\"\n  have nb\\<^sub>1: \"\\<forall>op \\<in> set ops. is_operator_applicable_in I op\"\n    using assms(3) \n    unfolding are_all_operators_applicable_in_def list_all_iff\n    by blast\n  have nb\\<^sub>2: \"\\<forall>op \\<in> set ops. is_valid_operator_sas_plus \\<Psi> op\"\n    using is_valid_problem_sas_plus_then(2) assms(1, 2)\n    unfolding is_valid_operator_sas_plus_def\n    by auto\n  have nb\\<^sub>3: \"\\<forall>op \\<in> set ops. map_of (precondition_of op) \\<subseteq>\\<^sub>m I\" \n    using nb\\<^sub>1 \n    unfolding is_operator_applicable_in_def list_all_iff \n    by blast\n  {\n    fix op\\<^sub>1 op\\<^sub>2\n    assume \"op\\<^sub>1 \\<in> set ops\" and \"op\\<^sub>2 \\<in> set ops\" \n    hence \"are_operator_effects_consistent op\\<^sub>1 op\\<^sub>2\" \n      using assms(3)\n      unfolding are_all_operator_effects_consistent_def list_all_iff \n      by blast\n  } note nb\\<^sub>4 = this\n  {\n    fix op\\<^sub>1 op\\<^sub>2\n    assume \"op\\<^sub>1 \\<in> set ops\" and \"op\\<^sub>2 \\<in> set ops\"\n    hence \"\\<forall>(v, a) \\<in> set (effect_of op\\<^sub>1). \\<forall>(v', a') \\<in> set (effect_of op\\<^sub>2).\n      v \\<noteq> v' \\<or> a = a'\"\n      using nb\\<^sub>4\n      unfolding are_operator_effects_consistent_def Let_def list_all_iff\n      by presburger\n  } note nb\\<^sub>5 = this\n  {\n    fix op\\<^sub>1' op\\<^sub>2' I\n    assume \"op\\<^sub>1' \\<in> set ?ops'\" \n      and \"op\\<^sub>2' \\<in> set ?ops'\" \n      and \"\\<exists>(v, a) \\<in> set (add_effects_of op\\<^sub>1'). \\<exists>(v', a') \\<in> set (delete_effects_of op\\<^sub>2').\n        (v, a) = (v', a')\" \n    moreover obtain op\\<^sub>1 op\\<^sub>2\n      where \"op\\<^sub>1 \\<in> set ops\" \n          and \"op\\<^sub>1' = \\<phi>\\<^sub>O \\<Psi> op\\<^sub>1\" \n        and \"op\\<^sub>2 \\<in> set ops\" \n          and \"op\\<^sub>2' = \\<phi>\\<^sub>O \\<Psi> op\\<^sub>2\" \n      using strips_equivalent_to_sas_plus_i_a_I[OF assms(1, 2)] calculation(1, 2) \n      by auto\n    moreover have \"is_valid_operator_sas_plus \\<Psi> op\\<^sub>1\"\n       and is_valid_operator_op\\<^sub>2: \"is_valid_operator_sas_plus \\<Psi> op\\<^sub>2\"\n      using calculation(4, 6) nb\\<^sub>2 \n       by blast+\n    moreover obtain v v' a a' \n      where \"(v, a) \\<in> set (add_effects_of op\\<^sub>1')\" \n        and \"(v', a') \\<in> set (delete_effects_of op\\<^sub>2')\"\n        and \"(v, a) = (v', a')\" \n      using calculation\n      by blast\n    moreover have \"(v, a) \\<in> set (effect_of op\\<^sub>1)\" \n      using calculation(5, 10) \n      unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def\n        sasp_op_to_strips_def Let_def\n      by fastforce\n    moreover have \"v = v'\" and \"a = a'\"\n      using calculation(12) \n      by simp+\n    moreover {\n      have \"(v', a') \\<in> (\\<Union>(v, a) \\<in> set (effect_of op\\<^sub>2). \n        { (v, a') | a'. a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v) \\<and>  a' \\<noteq> a })\"\n        using sasp_op_to_strips_set_delete_effects_is \n          calculation(7, 9, 11)\n        by blast\n      then obtain v'' a'' where \"(v'', a'') \\<in> set (effect_of op\\<^sub>2)\" \n        and \"(v', a') \\<in> { (v'', a''') | a'''. a''' \\<in> (\\<R>\\<^sub>+ \\<Psi> v'') \\<and>  a''' \\<noteq> a'' }\"\n        by blast\n      moreover have \"(v', a'') \\<in> set (effect_of op\\<^sub>2)\" \n        using calculation \n        by blast\n      moreover have \"a' \\<in> \\<R>\\<^sub>+ \\<Psi> v''\" and \"a' \\<noteq> a''\"\n        using calculation(1, 2) \n        by fast+\n      ultimately have \"\\<exists>a''. (v', a'') \\<in> set (effect_of op\\<^sub>2) \\<and> a' \\<in> (\\<R>\\<^sub>+ \\<Psi> v') \n        \\<and> a' \\<noteq> a''\" \n        by blast\n    }\n    moreover obtain a'' where \"a' \\<in> \\<R>\\<^sub>+ \\<Psi> v'\" \n      and \"(v', a'') \\<in> set (effect_of op\\<^sub>2)\" \n      and \"a' \\<noteq> a''\"\n      using calculation(16)\n      by blast\n    moreover have \"\\<exists>(v, a) \\<in> set (effect_of op\\<^sub>1). (\\<exists>(v', a') \\<in> set (effect_of op\\<^sub>2). \n      v = v' \\<and> a \\<noteq> a')\"\n      using calculation(13, 14, 15, 17, 18, 19)\n      by blast\n    \\<comment> \\<open> TODO slow. \\<close>\n    ultimately have \"\\<exists>op\\<^sub>1 \\<in> set ops. \\<exists>op\\<^sub>2 \\<in> set ops. \\<not>are_operator_effects_consistent op\\<^sub>1 op\\<^sub>2\"\n      unfolding are_operator_effects_consistent_def list_all_iff\n      by fastforce\n  } note nb\\<^sub>6 = this\n  show ?thesis\n    proof (rule conjI)\n      {\n        fix op' \n        assume \"op' \\<in> set ?ops'\" \n        moreover obtain op where op_in: \"op \\<in> set ops\" \n          and op'_is: \"op' = \\<phi>\\<^sub>O \\<Psi> op\"\n          and op'_in: \"op' \\<in> set ((\\<phi> \\<Psi>)\\<^sub>\\<O>)\"\n          and is_valid_op': \"is_valid_operator_strips (\\<phi> \\<Psi>) op'\"\n          using strips_equivalent_to_sas_plus_i_a_I[OF assms(1, 2)]\n            strips_equivalent_to_sas_plus_i_a_II[OF assms(1, 2)] calculation \n          by metis\n        moreover have is_valid_op: \"is_valid_operator_sas_plus \\<Psi> op\"\n          using nb\\<^sub>2 calculation(2)..\n        {\n          fix v a\n          assume v_a_in_preconditions': \"(v, a) \\<in> set (strips_operator.precondition_of op')\"\n          have v_a_in_preconditions: \"(v, a) \\<in> set (precondition_of op)\" \n            using op'_is\n            unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def\n              sasp_op_to_strips_def Let_def\n            using v_a_in_preconditions' \n            by force\n          moreover have \"v \\<in> set ?vs\" and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n            using is_valid_operator_sas_plus_then(1,2) is_valid_op calculation(1)\n            by fastforce+\n          moreover {\n            have \"\\<forall>(v, a) \\<in> set (precondition_of op). \\<forall>(v', a') \\<in> set (precondition_of op).\n              v \\<noteq> v' \\<or> a = a'\" \n              using is_valid_operator_sas_plus_then(5) is_valid_op\n              by fast\n            hence \"map_of (precondition_of op) v = Some a\" \n              using map_of_constant_assignments_defined_if[OF _ v_a_in_preconditions]\n              by blast\n          }\n          moreover have \"v \\<in> dom (map_of (precondition_of op))\" \n            using calculation(4)\n            by blast\n          moreover have \"I v = Some a\" \n            using nb\\<^sub>3 \n            unfolding map_le_def \n            using op_in calculation(4, 5)\n            by metis\n          moreover have \"(v, a) \\<in> dom ?I'\" \n            using state_to_strips_state_dom_element_iff[OF assms(1)] \n              calculation(2, 3, 6)\n            by simp\n          ultimately have \"?I' (v, a) = Some True\" \n            using state_to_strips_state_range_is[OF assms(1)]\n            by simp\n        }\n        hence \"STRIPS_Representation.is_operator_applicable_in ?I' op'\" \n          unfolding \n            STRIPS_Representation.is_operator_applicable_in_def \n            Let_def list_all_iff \n          by fast\n      }\n      thus \"are_all_operators_applicable ?I' ?ops'\"\n        unfolding are_all_operators_applicable_def list_all_iff\n        by blast\n    next \n      {\n        fix op\\<^sub>1' op\\<^sub>2'\n        assume op\\<^sub>1'_in_ops': \"op\\<^sub>1' \\<in> set ?ops'\" and op\\<^sub>2'_in_ops': \"op\\<^sub>2' \\<in> set ?ops'\" \n        have \"STRIPS_Semantics.are_operator_effects_consistent op\\<^sub>1' op\\<^sub>2'\" \n          unfolding STRIPS_Semantics.are_operator_effects_consistent_def Let_def\n          \\<comment> \\<open> TODO proof is symmetrical... refactor into nb. \\<close>\n          proof (rule conjI)          \n            show \"\\<not>list_ex (\\<lambda>x. list_ex ((=) x) (delete_effects_of op\\<^sub>2')) \n              (add_effects_of op\\<^sub>1')\"\n              proof (rule ccontr)\n                assume \"\\<not>\\<not>list_ex (\\<lambda>v. list_ex ((=) v) (delete_effects_of op\\<^sub>2')) \n                  (add_effects_of op\\<^sub>1')\" \n                then have \"\\<exists>(v, a) \\<in> set (delete_effects_of op\\<^sub>2'). \n                  \\<exists>(v', a') \\<in> set (add_effects_of op\\<^sub>1'). (v, a) = (v', a')\" \n                  unfolding list_ex_iff \n                  by fastforce\n                then obtain op\\<^sub>1 op\\<^sub>2 where \"op\\<^sub>1 \\<in> set ops\"\n                  and \"op\\<^sub>2 \\<in> set ops\" \n                  and \"\\<not>are_operator_effects_consistent op\\<^sub>1 op\\<^sub>2\" \n                  using nb\\<^sub>6[OF op\\<^sub>1'_in_ops' op\\<^sub>2'_in_ops']\n                  by blast\n                thus False \n                  using nb\\<^sub>4\n                  by blast              \n              qed\n          next\n            show \"\\<not>list_ex (\\<lambda>v. list_ex ((=) v) (add_effects_of op\\<^sub>2')) (delete_effects_of op\\<^sub>1')\" \n              proof (rule ccontr)\n                assume \"\\<not>\\<not>list_ex (\\<lambda>v. list_ex ((=) v) (add_effects_of op\\<^sub>2')) \n                  (delete_effects_of op\\<^sub>1')\" \n                then have \"\\<exists>(v, a) \\<in> set (delete_effects_of op\\<^sub>1'). \n                  \\<exists>(v', a') \\<in> set (add_effects_of op\\<^sub>2'). (v, a) = (v', a')\" \n                  unfolding list_ex_iff\n                  by fastforce\n                then obtain op\\<^sub>1 op\\<^sub>2 where \"op\\<^sub>1 \\<in> set ops\"\n                  and \"op\\<^sub>2 \\<in> set ops\" \n                  and \"\\<not>are_operator_effects_consistent op\\<^sub>1 op\\<^sub>2\" \n                  using nb\\<^sub>6[OF op\\<^sub>2'_in_ops' op\\<^sub>1'_in_ops']\n                  by blast\n                thus False \n                  using nb\\<^sub>4\n                  by blast\n              qed\n          qed\n      }\n      thus \"STRIPS_Semantics.are_all_operator_effects_consistent ?ops'\" \n        unfolding STRIPS_Semantics.are_all_operator_effects_consistent_def list_all_iff\n        by blast\n    qed\nqed\n\nprivate lemma strips_equivalent_to_sas_plus_i_a_V:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"\\<forall>op \\<in> set ops. op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\"\n    and \"\\<not>(are_all_operators_applicable_in s ops \n    \\<and> are_all_operator_effects_consistent ops)\"\n  shows \"\\<not>(STRIPS_Semantics.are_all_operators_applicable (\\<phi>\\<^sub>S \\<Psi> s) [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops]\n    \\<and> STRIPS_Semantics.are_all_operator_effects_consistent [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops])\"\nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?ops = \"operators_of \\<Psi>\" \n  let ?s' = \"\\<phi>\\<^sub>S \\<Psi> s\"\n    and ?ops' = \"[\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops]\"\n  {\n    fix op\n    assume \"op \\<in> set ops\" \n    hence \"\\<exists>op' \\<in> set ?ops'. op' = \\<phi>\\<^sub>O \\<Psi> op\" \n      by simp\n  } note nb\\<^sub>1 = this\n  {\n    fix op\n    assume \"op \\<in> set ops\" \n    then have \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n      using assms(2) \n      by blast\n    then have \"is_valid_operator_sas_plus \\<Psi> op\"\n      using is_valid_problem_sas_plus_then(2) assms(1)\n      unfolding is_valid_operator_sas_plus_def\n      by auto\n    hence \"\\<forall>(v, a) \\<in> set (precondition_of op). \\<forall>(v', a') \\<in> set (precondition_of op).\n      v \\<noteq> v' \\<or> a = a'\" \n      using is_valid_operator_sas_plus_then(5)\n      unfolding is_valid_operator_sas_plus_def\n      by fast\n  } note nb\\<^sub>2 = this\n  {\n    consider (A) \"\\<not>are_all_operators_applicable_in s ops\" \n      | (B) \"\\<not>are_all_operator_effects_consistent ops\" \n      using assms(3)\n      by blast\n    hence \"\\<not>STRIPS_Semantics.are_all_operators_applicable ?s' ?ops' \n      \\<or> \\<not>STRIPS_Semantics.are_all_operator_effects_consistent ?ops'\"\n      proof (cases)\n        case A\n        then obtain op where op_in: \"op \\<in> set ops\" \n          and not_precondition_map_le_s: \"\\<not>(map_of (precondition_of op) \\<subseteq>\\<^sub>m s)\"\n          using A\n          unfolding are_all_operators_applicable_in_def list_all_iff \n            is_operator_applicable_in_def\n          by blast\n        then obtain op' where op'_in: \"op' \\<in> set ?ops'\" and op'_is: \"op' = \\<phi>\\<^sub>O \\<Psi> op\" \n          using nb\\<^sub>1\n          by blast\n        have \"\\<not>are_all_operators_applicable ?s' ?ops'\" \n          proof (rule ccontr)\n            assume \"\\<not>\\<not>are_all_operators_applicable ?s' ?ops'\"\n            then have all_operators_applicable: \"are_all_operators_applicable ?s' ?ops'\"\n              by simp\n            moreover {\n              fix v \n              assume \"v \\<in> dom (map_of (precondition_of op))\" \n              moreover obtain a where \"map_of (precondition_of op) v = Some a\" \n                using calculation\n                by blast\n              moreover have \"(v, a) \\<in> set (precondition_of op)\"\n                using map_of_SomeD[OF calculation(2)].\n              moreover have \"(v, a) \\<in> set (strips_operator.precondition_of op')\"\n                using op'_is \n                unfolding sasp_op_to_strips_def\n                  SAS_Plus_STRIPS.sasp_op_to_strips_def\n                using calculation(3) \n                by auto \n              moreover have \"?s' (v, a) = Some True\"\n                using all_operators_applicable calculation \n                unfolding are_all_operators_applicable_def \n                    STRIPS_Representation.is_operator_applicable_in_def \n                    is_operator_applicable_in_def Let_def list_all_iff \n                using op'_in\n                by fast\n              moreover have \"(v, a) \\<in> dom ?s'\" \n                using calculation(5)\n                by blast\n              moreover have \"(v, a) \\<in> set (precondition_of op)\" \n                using op'_is calculation(3)\n                unfolding sasp_op_to_strips_def Let_def\n                by fastforce\n              moreover have \"v \\<in> set ?vs\" \n                and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n                and \"s v \\<noteq> None\" \n                using state_to_strips_state_dom_element_iff[OF assms(1)]\n                  calculation(6)\n                by simp+\n              moreover have \"?s' (v, a) = Some (the (s v) = a)\" \n                using state_to_strips_state_range_is[OF \n                    assms(1) calculation(6)].\n              moreover have \"the (s v) = a\" \n                using calculation(5, 11)\n                by fastforce\n              moreover have \"s v = Some a\" \n                using calculation(12) option.collapse[OF calculation(10)]\n                by argo\n              moreover have \"map_of (precondition_of op) v = Some a\"\n                using map_of_constant_assignments_defined_if[OF nb\\<^sub>2[OF op_in] calculation(7)].\n              ultimately have \"map_of (precondition_of op) v = s v\"\n                by argo\n            }\n            then have \"map_of (precondition_of op) \\<subseteq>\\<^sub>m s\" \n              unfolding map_le_def\n              by blast\n            thus False \n              using not_precondition_map_le_s\n              by simp\n          qed\n        thus ?thesis \n          by simp\n      next\n        case B\n        {\n          obtain op\\<^sub>1 op\\<^sub>2 v v' a a' \n            where \"op\\<^sub>1 \\<in> set ops\"\n              and op\\<^sub>2_in: \"op\\<^sub>2 \\<in> set ops\"\n              and v_a_in: \"(v, a) \\<in> set (effect_of op\\<^sub>1)\"\n              and v'_a'_in: \"(v', a') \\<in> set (effect_of op\\<^sub>2)\" \n              and v_is: \"v = v'\" and a_is: \"a \\<noteq> a'\"  \n            using B \n            unfolding are_all_operator_effects_consistent_def \n              are_operator_effects_consistent_def list_all_iff Let_def\n            by blast\n          moreover obtain op\\<^sub>1' op\\<^sub>2' where \"op\\<^sub>1' \\<in> set ?ops'\" and \"op\\<^sub>1' = \\<phi>\\<^sub>O \\<Psi> op\\<^sub>1\"\n            and \"op\\<^sub>1' \\<in> set ?ops'\" and op\\<^sub>2'_is: \"op\\<^sub>2' = \\<phi>\\<^sub>O \\<Psi> op\\<^sub>2\"\n            using nb\\<^sub>1[OF calculation(1)] nb\\<^sub>1[OF calculation(2)]\n            by blast\n          moreover have \"(v, a) \\<in> set (add_effects_of op\\<^sub>1')\"\n            using calculation(3, 8)\n            unfolding SAS_Plus_STRIPS.sasp_op_to_strips_def\n              sasp_op_to_strips_def Let_def\n            by force\n          moreover {\n            have \"is_valid_operator_sas_plus \\<Psi> op\\<^sub>1\" \n              using assms(2) calculation(1) is_valid_problem_sas_plus_then(2) assms(1)\n              unfolding is_valid_operator_sas_plus_def \n              by auto\n            moreover have \"is_valid_operator_sas_plus \\<Psi> op\\<^sub>2\"\n              using sublocale_sas_plus_finite_domain_representation_ii(2)[\n                  OF assms(1)] assms(2) op\\<^sub>2_in \n              by blast \n            moreover have \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n              using is_valid_operator_sas_plus_then(4) calculation v_a_in\n              unfolding is_valid_operator_sas_plus_def\n              by fastforce\n            ultimately have \"(v, a) \\<in> set (delete_effects_of op\\<^sub>2')\" \n              using sasp_op_to_strips_set_delete_effects_is[of \\<Psi> op\\<^sub>2]\n                v'_a'_in v_is a_is \n              using op\\<^sub>2'_is \n              by blast\n          }\n          \\<comment> \\<open> TODO slow. \\<close>\n          ultimately have \"\\<exists>op\\<^sub>1' \\<in> set ?ops'. \\<exists>op\\<^sub>2' \\<in> set ?ops'. \n            \\<exists>(v, a) \\<in> set (delete_effects_of op\\<^sub>2'). \\<exists>(v', a') \\<in> set (add_effects_of op\\<^sub>1').\n            (v, a) = (v', a')\"\n            by fastforce\n        }\n        then have \"\\<not>STRIPS_Semantics.are_all_operator_effects_consistent ?ops'\" \n          unfolding STRIPS_Semantics.are_all_operator_effects_consistent_def \n            STRIPS_Semantics.are_operator_effects_consistent_def list_all_iff list_ex_iff Let_def \n          by blast\n        thus ?thesis \n          by simp \n      qed\n  }\n  thus ?thesis \n    by blast\nqed\n\n(* TODO make private *)\nlemma strips_equivalent_to_sas_plus_i_a:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"dom I \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n    and \"\\<forall>v \\<in> dom I. the (I v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    and \"dom G \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n    and \"\\<forall>v \\<in> dom G. the (G v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    and \"\\<forall>ops \\<in> set \\<psi>. \\<forall>op \\<in> set ops. op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\"\n    and \"G \\<subseteq>\\<^sub>m execute_parallel_plan_sas_plus I \\<psi>\" \n  shows \"(\\<phi>\\<^sub>S \\<Psi> G) \\<subseteq>\\<^sub>m execute_parallel_plan (\\<phi>\\<^sub>S \\<Psi> I) (\\<phi>\\<^sub>P \\<Psi> \\<psi>)\" \nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n    and ?G' = \"\\<phi>\\<^sub>S \\<Psi> G\"\n  show ?thesis \n    using assms\n    proof (induction \\<psi> arbitrary: I)\n      case Nil\n      let ?I' = \"\\<phi>\\<^sub>S \\<Psi> I\"\n      have \"G \\<subseteq>\\<^sub>m I\" \n        using Nil\n        by simp\n      moreover have \"?G' \\<subseteq>\\<^sub>m ?I'\"\n        using state_to_strips_state_map_le_iff[OF Nil.prems(1, 4, 5)] \n          calculation..\n      ultimately show ?case \n        unfolding SAS_Plus_STRIPS.sas_plus_parallel_plan_to_strips_parallel_plan_def\n          sas_plus_parallel_plan_to_strips_parallel_plan_def\n        by simp\n    next\n      case (Cons ops \\<psi>)\n      let ?vs = \"variables_of \\<Psi>\"\n        and ?ops = \"operators_of \\<Psi>\"\n        and ?J = \"execute_parallel_operator_sas_plus I ops\" \n        and ?\\<pi> = \"\\<phi>\\<^sub>P \\<Psi> (ops # \\<psi>)\"\n      let ?I' = \"\\<phi>\\<^sub>S \\<Psi> I\"\n        and ?J' = \"\\<phi>\\<^sub>S \\<Psi> ?J\"\n        and ?ops' = \"[\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops]\"\n      {\n        fix op v a\n        assume \"op \\<in> set ops\" and \"(v, a) \\<in> set (effect_of op)\" \n        moreover have \"op \\<in> set ?ops\"\n          using Cons.prems(6) calculation(1)\n          by simp\n        moreover have \"is_valid_operator_sas_plus \\<Psi> op\" \n          using is_valid_problem_sas_plus_then(2) Cons.prems(1) calculation(3)\n          unfolding is_valid_operator_sas_plus_def\n          by auto\n        ultimately have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n          and \"a \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n          using is_valid_operator_sas_plus_then(3,4)\n          by fastforce+\n      } note nb\\<^sub>1 = this\n      show ?case\n      proof (cases \"are_all_operators_applicable_in I ops \n        \\<and> are_all_operator_effects_consistent ops\")\n        case True\n        {\n          have \"(\\<phi>\\<^sub>P \\<Psi> (ops # \\<psi>)) = ?ops' # (\\<phi>\\<^sub>P \\<Psi> \\<psi>)\"\n            unfolding sas_plus_parallel_plan_to_strips_parallel_plan_def\n              SAS_Plus_STRIPS.sas_plus_parallel_plan_to_strips_parallel_plan_def \n              sasp_op_to_strips_def\n              SAS_Plus_STRIPS.sasp_op_to_strips_def\n            by simp\n          moreover have \"\\<forall>op \\<in> set ops. op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\" \n            using Cons.prems(6)\n            by simp\n          moreover have \"STRIPS_Semantics.are_all_operators_applicable ?I' ?ops'\" \n            and \"STRIPS_Semantics.are_all_operator_effects_consistent ?ops'\" \n            using strips_equivalent_to_sas_plus_i_a_IV[OF Cons.prems(1) _ True] calculation\n            by blast+\n          ultimately have \"execute_parallel_plan ?I' ?\\<pi> \n            = execute_parallel_plan (execute_parallel_operator ?I' ?ops') (\\<phi>\\<^sub>P \\<Psi> \\<psi>)\"\n            by fastforce\n        }\n        \\<comment> \\<open> NOTE Instantiate the IH on the next state of the SAS+ execution \n          \\<open>execute_parallel_operator_sas_plus I ops\\<close>. \\<close>\n        moreover\n        {\n          {\n            have \"dom I \\<subseteq> set (sas_plus_problem.variables_of \\<Psi>)\"\n              using Cons.prems(2)\n              by blast\n            moreover have \"\\<forall>op \\<in> set ops. \\<forall>(v, a) \\<in> set (effect_of op). \n              v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n              using nb\\<^sub>1(1) \n              by blast\n            ultimately have \"dom ?J \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n              using sas_plus_equivalent_to_strips_i_a_IX[of I \"set ?vs\"]\n              by simp\n          } note nb\\<^sub>2 = this\n          moreover {\n            have \"dom I \\<subseteq> set (sas_plus_problem.variables_of \\<Psi>)\"\n              using Cons.prems(2)\n              by blast\n            moreover have \"set (sas_plus_problem.variables_of \\<Psi>)\n              \\<subseteq> dom (range_of \\<Psi>)\"\n              using is_valid_problem_sas_plus_dom_sas_plus_problem_range_of assms(1)\n              by auto\n           moreover {\n              fix v \n              assume \"v \\<in> dom I\"  \n              moreover have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n                using Cons.prems(2) calculation\n                by blast\n              ultimately have \"the (I v) \\<in> set (the (range_of \\<Psi> v))\" \n                using Cons.prems(3)\n                using set_the_range_of_is_range_of_sas_plus_if[OF assms(1)]\n                by blast\n            }\n            moreover have \"\\<forall>op\\<in>set ops. \\<forall>(v, a)\\<in>set (effect_of op).\n              v \\<in> set (sas_plus_problem.variables_of \\<Psi>) \\<and> a \\<in> set (the (range_of \\<Psi> v))\"\n              using set_the_range_of_is_range_of_sas_plus_if[OF assms(1)] nb\\<^sub>1(1) nb\\<^sub>1(2)\n              by force\n            moreover have nb\\<^sub>3: \"\\<forall>v \\<in> dom ?J. the (?J v) \\<in> set (the (range_of \\<Psi> v))\" \n              using sas_plus_equivalent_to_strips_i_a_X[of I \"set ?vs\" \"range_of \\<Psi>\" ops] \n                calculation\n              by fast\n            moreover {\n              fix v\n              assume \"v \\<in> dom ?J\"\n              moreover have \"v \\<in> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\"\n                using nb\\<^sub>2 calculation\n                by blast\n              moreover have \"set (the (range_of \\<Psi> v)) = \\<R>\\<^sub>+ \\<Psi> v\" \n                using set_the_range_of_is_range_of_sas_plus_if[OF assms(1)] \n                  calculation(2)\n                by presburger\n              ultimately have \"the (?J v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n                using nb\\<^sub>3\n                by blast\n            }\n            ultimately have \"\\<forall>v \\<in> dom ?J. the (?J v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n              by fast\n          }\n          moreover have \"\\<forall>ops\\<in>set \\<psi>. \\<forall>op\\<in>set ops. op \\<in> set ?ops\" \n            using Cons.prems(6)\n            by auto\n          moreover have \"G \\<subseteq>\\<^sub>m execute_parallel_plan_sas_plus ?J \\<psi>\" \n            using Cons.prems(7) True\n            by simp\n          ultimately have \"(\\<phi>\\<^sub>S \\<Psi> G) \\<subseteq>\\<^sub>m execute_parallel_plan ?J' (\\<phi>\\<^sub>P \\<Psi> \\<psi>)\"\n            using Cons.IH[of ?J, OF Cons.prems(1) _ _ Cons.prems(4, 5)]\n            by fastforce\n        }\n        moreover have \"execute_parallel_operator ?I' ?ops' = ?J'\" \n          using assms(1) strips_equivalent_to_sas_plus_i_a_III[OF assms(1)] Cons.prems(6)\n          by auto\n        ultimately show ?thesis\n          by argo\n      next\n        case False\n        then have nb: \"G \\<subseteq>\\<^sub>m I\" \n          using Cons.prems(7)\n          by force\n        moreover {\n          have \"?\\<pi> = ?ops' # (\\<phi>\\<^sub>P \\<Psi> \\<psi>)\"\n            unfolding sas_plus_parallel_plan_to_strips_parallel_plan_def\n              SAS_Plus_STRIPS.sas_plus_parallel_plan_to_strips_parallel_plan_def \n              sasp_op_to_strips_def\n              SAS_Plus_STRIPS.sasp_op_to_strips_def Let_def\n            by auto\n          moreover have \"set ?ops' \\<subseteq> set (strips_problem.operators_of ?\\<Pi>)\"\n            using strips_equivalent_to_sas_plus_i_a_II(1)[OF assms(1)] Cons.prems(6)\n            by auto\n          moreover have \"\\<not>(STRIPS_Semantics.are_all_operators_applicable ?I' ?ops' \n            \\<and> STRIPS_Semantics.are_all_operator_effects_consistent ?ops')\"\n            using strips_equivalent_to_sas_plus_i_a_V[OF assms(1) _ False] Cons.prems(6)\n            by force \n          ultimately have \"execute_parallel_plan ?I' ?\\<pi> = ?I'\"\n            by auto\n        }\n        moreover have \"?G' \\<subseteq>\\<^sub>m ?I'\" \n          using state_to_strips_state_map_le_iff[OF Cons.prems(1, 4, 5)] nb\n          by blast\n        ultimately show ?thesis \n          by presburger\n        qed \n    qed\nqed\n\n(* TODO make private *)\nlemma strips_equivalent_to_sas_plus_i:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"is_parallel_solution_for_problem \\<Psi> \\<psi>\"\n  shows \"(strips_problem.goal_of (\\<phi> \\<Psi>)) \\<subseteq>\\<^sub>m execute_parallel_plan \n    (strips_problem.initial_of (\\<phi> \\<Psi>)) (\\<phi>\\<^sub>P \\<Psi> \\<psi>)\" \nproof -\n  let ?vs = \"variables_of \\<Psi>\"\n    and ?ops = \"operators_of \\<Psi>\"\n    and ?I = \"initial_of \\<Psi>\"\n    and ?G = \"goal_of \\<Psi>\"\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?I' = \"strips_problem.initial_of ?\\<Pi>\"\n    and ?G' = \"strips_problem.goal_of ?\\<Pi>\"\n  have \"dom ?I \\<subseteq> set ?vs\"\n    using is_valid_problem_sas_plus_then(3) assms(1)\n    by auto\n  moreover have \"\\<forall>v\\<in>dom ?I. the (?I v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\" \n    using is_valid_problem_sas_plus_then(4) assms(1) calculation\n    by auto\n  moreover have \"dom ?G \\<subseteq> set ((\\<Psi>)\\<^sub>\\<V>\\<^sub>+)\" \n    using is_valid_problem_sas_plus_then(5) assms(1)\n    by auto\n  moreover have \"\\<forall>v \\<in> dom ?G. the (?G v) \\<in> \\<R>\\<^sub>+ \\<Psi> v\"\n    using is_valid_problem_sas_plus_then(6) assms(1)\n    by auto\n  moreover have \"\\<forall>ops \\<in> set \\<psi>. \\<forall>op \\<in> set ops. op \\<in> set ?ops\"\n    using is_parallel_solution_for_problem_plan_operator_set[OF assms(2)]\n    by fastforce\n  moreover have \"?G \\<subseteq>\\<^sub>m execute_parallel_plan_sas_plus ?I \\<psi>\" \n    using assms(2) \n    unfolding is_parallel_solution_for_problem_def\n    by simp\n  (* TODO slow *)\n  ultimately show ?thesis\n    using strips_equivalent_to_sas_plus_i_a[OF assms(1), of ?I ?G \\<psi>]\n    unfolding sas_plus_problem_to_strips_problem_def\n      SAS_Plus_STRIPS.sas_plus_problem_to_strips_problem_def \n      state_to_strips_state_def\n      SAS_Plus_STRIPS.state_to_strips_state_def\n    by force\nqed\n\n(* TODO make private *)\nlemma strips_equivalent_to_sas_plus_ii:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"is_parallel_solution_for_problem \\<Psi> \\<psi>\"\n  shows \"list_all (list_all (\\<lambda>op. ListMem op (strips_problem.operators_of (\\<phi> \\<Psi>)))) (\\<phi>\\<^sub>P \\<Psi> \\<psi>)\" \nproof -\n  let ?ops = \"operators_of \\<Psi>\"\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?ops' = \"strips_problem.operators_of ?\\<Pi>\"\n    and ?\\<pi> = \"\\<phi>\\<^sub>P \\<Psi> \\<psi>\"\n  have \"is_valid_problem_strips ?\\<Pi>\" \n    using is_valid_problem_sas_plus_then_strips_transformation_too[OF assms(1)]\n    by simp \n  have nb\\<^sub>1: \"\\<forall>op \\<in> set ?ops. (\\<exists>op' \\<in> set ?ops'. op' = (\\<phi>\\<^sub>O \\<Psi> op))\" \n    unfolding sas_plus_problem_to_strips_problem_def\n      SAS_Plus_STRIPS.sas_plus_problem_to_strips_problem_def Let_def \n      sasp_op_to_strips_def\n    by force\n  {\n    fix ops op op'\n    assume \"ops \\<in> set \\<psi>\" and \"op \\<in> set ops\" \n    moreover have \"op \\<in> set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\"\n      using is_parallel_solution_for_problem_plan_operator_set[OF assms(2)] \n        calculation\n      by blast\n    moreover obtain op' where \"op' \\<in> set ?ops'\" and \"op' = (\\<phi>\\<^sub>O \\<Psi> op)\" \n      using nb\\<^sub>1 calculation(3)\n      by auto\n    ultimately have \"(\\<phi>\\<^sub>O \\<Psi> op) \\<in> set ?ops'\"\n      by blast\n  }\n  thus ?thesis \n    unfolding list_all_iff ListMem_iff Let_def  \n      sas_plus_problem_to_strips_problem_def\n      SAS_Plus_STRIPS.sas_plus_problem_to_strips_problem_def\n      sas_plus_parallel_plan_to_strips_parallel_plan_def\n      SAS_Plus_STRIPS.sas_plus_parallel_plan_to_strips_parallel_plan_def \n      sasp_op_to_strips_def\n      SAS_Plus_STRIPS.sasp_op_to_strips_def \n      Let_def \n    by auto\nqed\n\ntext \\<open> The following lemma proves the complementary proposition to theorem \n\\ref{isathm:equivalence-parallel-strips-parallel-sas-plus}. Namely, given a parallel solution\n\\<^term>\\<open>\\<psi>\\<close> for a SAS+ problem, the transformation to a STRIPS plan \\<^term>\\<open>\\<phi>\\<^sub>P \\<Psi> \\<psi>\\<close> also is a solution \nto the corresponding STRIPS problem \\<^term>\\<open>\\<Pi> \\<equiv> (\\<phi> \\<Psi>)\\<close>. In this direction, we have to show that the \nexecution of the transformed plan reaches the goal state \\<^term>\\<open>G' \\<equiv> strips_problem.goal_of \\<Pi>\\<close> \nof the corresponding STRIPS problem, i.e.\n  @{text[display, indent=4] \"G' \\<subseteq>\\<^sub>m execute_parallel_plan I' \\<pi>\"} \nand that all operators in the transformed plan \\<^term>\\<open>\\<pi>\\<close> are operators of \\<^term>\\<open>\\<Pi>\\<close>. \\<close>\n\ntheorem\n  strips_equivalent_to_sas_plus:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n    and \"is_parallel_solution_for_problem \\<Psi> \\<psi>\"\n  shows \"STRIPS_Semantics.is_parallel_solution_for_problem (\\<phi> \\<Psi>) (\\<phi>\\<^sub>P \\<Psi> \\<psi>)\"\nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?I' = \"strips_problem.initial_of ?\\<Pi>\"\n    and ?G' = \"strips_problem.goal_of ?\\<Pi>\"\n    and ?ops' = \"strips_problem.operators_of ?\\<Pi>\"\n    and ?\\<pi> = \"\\<phi>\\<^sub>P \\<Psi> \\<psi>\"\n  show ?thesis\n    unfolding STRIPS_Semantics.is_parallel_solution_for_problem_def \n    proof (rule conjI)\n      show \"?G' \\<subseteq>\\<^sub>m execute_parallel_plan ?I' ?\\<pi>\"\n        using strips_equivalent_to_sas_plus_i[OF assms]\n        by simp\n    next \n      show \"list_all (list_all (\\<lambda>op. ListMem op ?ops')) ?\\<pi>\" \n        using strips_equivalent_to_sas_plus_ii[OF assms].\n    qed\nqed\n\nlemma embedded_serial_sas_plus_plan_operator_structure:\n  assumes \"ops \\<in> set (embed \\<psi>)\"\n  obtains op \n  where \"op \\<in> set \\<psi>\" \n    and \"[\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops] = [\\<phi>\\<^sub>O \\<Psi> op]\"\nproof -\n  let ?\\<psi>' = \"embed \\<psi>\"\n  {\n    have \"?\\<psi>' = [[op]. op \\<leftarrow> \\<psi>]\"\n      by (induction \\<psi>; force)\n    moreover obtain op where \"ops = [op]\" and \"op \\<in> set \\<psi>\" \n      using assms calculation \n      by fastforce\n    ultimately have \"\\<exists>op \\<in> set \\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops] = [\\<phi>\\<^sub>O \\<Psi> op]\"\n      by auto\n  }\n  thus ?thesis \n    using that\n    by meson\nqed\n\nprivate lemma serial_sas_plus_equivalent_to_serial_strips_i: \n  assumes \"ops \\<in> set (\\<phi>\\<^sub>P \\<Psi> (embed \\<psi>))\"\n  obtains op where \"op \\<in> set \\<psi>\" and \"ops = [\\<phi>\\<^sub>O \\<Psi> op]\"  \nproof -\n  let ?\\<psi>' = \"embed \\<psi>\" \n  {\n    have \"set (\\<phi>\\<^sub>P \\<Psi> (embed \\<psi>)) = { [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops]  | ops. ops \\<in> set ?\\<psi>' }\"\n      \n      unfolding sas_plus_parallel_plan_to_strips_parallel_plan_def  \n        SAS_Plus_STRIPS.sas_plus_parallel_plan_to_strips_parallel_plan_def\n        sasp_op_to_strips_def set_map\n      using setcompr_eq_image  \n      by blast\n    moreover obtain ops' where \"ops' \\<in> set ?\\<psi>'\" and \"ops = [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> ops']\" \n      using assms(1) calculation\n      by blast\n    moreover obtain op where \"op \\<in> set \\<psi>\" and \"ops = [\\<phi>\\<^sub>O \\<Psi> op]\" \n      using embedded_serial_sas_plus_plan_operator_structure calculation(2, 3)\n      by blast\n    ultimately have \"\\<exists>op \\<in> set \\<psi>. ops = [\\<phi>\\<^sub>O \\<Psi> op]\"\n      by meson\n  }\n  thus ?thesis \n    using that..\nqed\n\nprivate lemma serial_sas_plus_equivalent_to_serial_strips_ii[simp]:\n  \"concat (\\<phi>\\<^sub>P \\<Psi> (embed \\<psi>)) = [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\" \nproof -\n  let ?\\<psi>' = \"List_Supplement.embed \\<psi>\"\n  have \"concat (\\<phi>\\<^sub>P \\<Psi> ?\\<psi>') = map (\\<lambda>op. \\<phi>\\<^sub>O \\<Psi> op) (concat ?\\<psi>')\" \n    unfolding sas_plus_parallel_plan_to_strips_parallel_plan_def\n      SAS_Plus_STRIPS.sas_plus_parallel_plan_to_strips_parallel_plan_def\n      sasp_op_to_strips_def\n      SAS_Plus_STRIPS.sasp_op_to_strips_def Let_def\n      map_concat\n    by blast\n  also have \"\\<dots> = map (\\<lambda>op. \\<phi>\\<^sub>O \\<Psi> op) \\<psi>\" \n    unfolding concat_is_inverse_of_embed[of \\<psi>]..\n  finally show \"concat (\\<phi>\\<^sub>P \\<Psi> (embed \\<psi>)) = [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\".\nqed\n\ntext \\<open> Having established the equivalence of parallel STRIPS and SAS+, we can now show the \nequivalence in the serial case. The proof combines the \nembedding theorem for serial SAS+ solutions (\\ref{isathm:serial-sas-plus-embedding}), the parallel \nplan equivalence theorem \\ref{isathm:equivalence-parallel-sas-plus-parallel-strips}, and the \nflattening theorem for parallel STRIPS plans (\\ref{isathm:embedded-serial-plan-flattening-strips}).\nMore precisely, given a serial SAS+ solution \\<^term>\\<open>\\<psi>\\<close> for a SAS+ problem \\<^term>\\<open>\\<Psi>\\<close>, the embedding \ntheorem confirms that the embedded plan \\<^term>\\<open>embed \\<psi>\\<close> is an equivalent parallel solution to\n\\<^term>\\<open>\\<Psi>\\<close>. By parallel plan equivalence, \\<^term>\\<open>\\<pi> \\<equiv> \\<phi>\\<^sub>P \\<Psi> (embed \\<psi>)\\<close> is a parallel solution for the \ncorresponding STRIPS problem \\<^term>\\<open>\\<phi> \\<Psi>\\<close>. Moreover, since \\<^term>\\<open>embed \\<psi>\\<close> is a plan consisting of \nsingleton parallel operators, the same is true for \\<^term>\\<open>\\<pi>\\<close>. Hence, the flattening lemma applies \nand \\<^term>\\<open>concat \\<pi>\\<close> is a serial solution for \\<^term>\\<open>\\<phi> \\<Psi>\\<close>. Since \\<^term>\\<open>concat\\<close> moreover can be shown \nto be the inverse of \\<^term>\\<open>embed\\<close>, the term \n  @{text[display, indent=4] \"concat \\<pi> = concat (\\<phi>\\<^sub>P \\<Psi> (embed \\<psi>))\"}\ncan be reduced to the intuitive form \n  @{text[display, indent=4] \"\\<pi> = [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\"}\nwhich concludes the proof. \\<close>\n\ntheorem \n  serial_sas_plus_equivalent_to_serial_strips:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"SAS_Plus_Semantics.is_serial_solution_for_problem \\<Psi> \\<psi>\"\n  shows \"STRIPS_Semantics.is_serial_solution_for_problem (\\<phi> \\<Psi>) [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\" \nproof -\n  let ?\\<psi>' = \"embed \\<psi>\"\n    and ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?\\<pi>' = \"\\<phi>\\<^sub>P \\<Psi> ?\\<psi>'\"\n  let ?\\<pi> = \"concat ?\\<pi>'\"\n  {\n    have \"SAS_Plus_Semantics.is_parallel_solution_for_problem \\<Psi> ?\\<psi>'\"\n      using execute_serial_plan_sas_plus_is_execute_parallel_plan_sas_plus[OF assms]\n      by simp\n    hence \"STRIPS_Semantics.is_parallel_solution_for_problem ?\\<Pi> ?\\<pi>'\"\n      using strips_equivalent_to_sas_plus[OF assms(1)]\n      by simp\n  }\n  moreover have \"?\\<pi> = [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\"\n    by simp\n  moreover have \"is_valid_problem_strips ?\\<Pi>\"\n      using is_valid_problem_sas_plus_then_strips_transformation_too[OF assms(1)].\n  moreover have \"\\<forall>ops \\<in> set ?\\<pi>'. \\<exists>op \\<in> set \\<psi>. ops = [\\<phi>\\<^sub>O \\<Psi> op]\" \n    using serial_sas_plus_equivalent_to_serial_strips_i[of _ \\<Psi> \\<psi>]\n    by metis\n  ultimately show ?thesis\n    using STRIPS_Semantics.flattening_lemma[of ?\\<Pi>]\n    by metis\nqed\n\n\nlemma embedded_serial_strips_plan_operator_structure:\n  assumes \"ops' \\<in> set (embed \\<pi>)\"\n  obtains op \n    where \"op \\<in> set \\<pi>\" and \"[\\<phi>\\<^sub>O\\<inverse> \\<Pi> op. op \\<leftarrow> ops'] = [\\<phi>\\<^sub>O\\<inverse> \\<Pi> op]\"\nproof -\n  let ?\\<pi>' = \"embed \\<pi>\" \n  {\n    have \"?\\<pi>' = [[op]. op \\<leftarrow> \\<pi>]\"\n      by (induction \\<pi>; force)\n    moreover obtain op where \"ops' = [op]\" and \"op \\<in> set \\<pi>\" \n      using calculation assms \n      by fastforce\n    ultimately have \"\\<exists>op \\<in> set \\<pi>. [\\<phi>\\<^sub>O\\<inverse> \\<Pi> op. op \\<leftarrow> ops'] = [\\<phi>\\<^sub>O\\<inverse> \\<Pi> op]\"\n      by auto\n  }\n  thus ?thesis \n    using that\n    by meson\nqed\n\nprivate lemma serial_strips_equivalent_to_serial_sas_plus_i: \n  assumes \"ops \\<in> set (\\<phi>\\<^sub>P\\<inverse> \\<Pi> (embed \\<pi>))\"\n  obtains op where \"op \\<in> set \\<pi>\" and \"ops = [\\<phi>\\<^sub>O\\<inverse> \\<Pi> op]\"  \nproof -\n  let ?\\<pi>' = \"embed \\<pi>\" \n  {\n    have \"set (\\<phi>\\<^sub>P\\<inverse> \\<Pi> (embed \\<pi>)) = { [\\<phi>\\<^sub>O\\<inverse> \\<Pi> op. op \\<leftarrow> ops]  | ops. ops \\<in> set ?\\<pi>' }\"\n      unfolding strips_parallel_plan_to_sas_plus_parallel_plan_def\n        SAS_Plus_STRIPS.strips_parallel_plan_to_sas_plus_parallel_plan_def\n        strips_op_to_sasp_def set_map\n      using setcompr_eq_image \n      by blast\n    moreover obtain ops' where \"ops' \\<in> set ?\\<pi>'\" and \"ops = [\\<phi>\\<^sub>O\\<inverse> \\<Pi> op. op \\<leftarrow> ops']\" \n      using assms(1) calculation\n      by blast\n    moreover obtain op where \"op \\<in> set \\<pi>\" and \"ops = [\\<phi>\\<^sub>O\\<inverse> \\<Pi> op]\" \n      using embedded_serial_strips_plan_operator_structure calculation(2, 3)\n      by blast\n    ultimately have \"\\<exists>op \\<in> set \\<pi>. ops = [\\<phi>\\<^sub>O\\<inverse> \\<Pi> op]\" \n      by meson\n  }\n  thus ?thesis \n    using that..\nqed\n\nprivate lemma serial_strips_equivalent_to_serial_sas_plus_ii[simp]:\n  \"concat (\\<phi>\\<^sub>P\\<inverse> \\<Pi> (embed \\<pi>)) = [\\<phi>\\<^sub>O\\<inverse> \\<Pi> op. op \\<leftarrow> \\<pi>]\" \nproof -\n  let ?\\<pi>' = \"List_Supplement.embed \\<pi>\"\n  have \"concat (\\<phi>\\<^sub>P\\<inverse> \\<Pi> ?\\<pi>') = map (\\<lambda>op. \\<phi>\\<^sub>O\\<inverse> \\<Pi> op) (concat ?\\<pi>')\" \n    unfolding strips_parallel_plan_to_sas_plus_parallel_plan_def\n      SAS_Plus_STRIPS.strips_parallel_plan_to_sas_plus_parallel_plan_def\n      strips_op_to_sasp_def\n      SAS_Plus_STRIPS.strips_op_to_sasp_def Let_def\n      map_concat \n    by simp\n  also have \"\\<dots> = map (\\<lambda>op. \\<phi>\\<^sub>O\\<inverse> \\<Pi> op) \\<pi>\" \n    unfolding concat_is_inverse_of_embed[of \\<pi>]..\n  finally show \"concat (\\<phi>\\<^sub>P\\<inverse> \\<Pi> (embed \\<pi>)) = [\\<phi>\\<^sub>O\\<inverse> \\<Pi> op. op \\<leftarrow> \\<pi>]\".\nqed\n\ntext \\<open> Using the analogous lemmas for the opposite direction, we can show the counterpart to \ntheorem \\ref{isathm:equivalence-serial-sas-plus-serial-strips} which shows that serial solutions \nto STRIPS solutions can be transformed to serial SAS+ solutions via composition of embedding, \ntransformation and flattening. \\<close>\n\ntheorem \n  serial_strips_equivalent_to_serial_sas_plus:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\" \n    and \"STRIPS_Semantics.is_serial_solution_for_problem (\\<phi> \\<Psi>) \\<pi>\"\n  shows \"SAS_Plus_Semantics.is_serial_solution_for_problem \\<Psi> [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op. op \\<leftarrow> \\<pi>]\" \nproof -\n  let ?\\<pi>' = \"embed \\<pi>\"\n    and ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?\\<psi>' = \"\\<phi>\\<^sub>P\\<inverse> \\<Psi> ?\\<pi>'\"\n  let ?\\<psi> = \"concat ?\\<psi>'\"\n  {\n    have \"STRIPS_Semantics.is_parallel_solution_for_problem ?\\<Pi> ?\\<pi>'\"\n      using embedding_lemma[OF \n          is_valid_problem_sas_plus_then_strips_transformation_too[OF assms(1)] assms(2)].\n    hence \"SAS_Plus_Semantics.is_parallel_solution_for_problem \\<Psi> ?\\<psi>'\"\n      using sas_plus_equivalent_to_strips[OF assms(1)]\n      by simp\n  }\n  moreover have \"?\\<psi> = [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op. op \\<leftarrow> \\<pi>]\"\n    by simp\n  moreover have \"is_valid_problem_strips ?\\<Pi>\"\n      using is_valid_problem_sas_plus_then_strips_transformation_too[OF assms(1)].\n  moreover have \"\\<forall>ops \\<in> set ?\\<psi>'. \\<exists>op \\<in> set \\<pi>. ops = [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op]\" \n    using serial_strips_equivalent_to_serial_sas_plus_i\n    by metis\n  ultimately show ?thesis\n    using flattening_lemma[OF assms(1)]\n    by metis\nqed\n\nsubsection \"Equivalence of SAS+ and STRIPS\" \n\n\\<comment> \\<open> Define the sets of plans with upper length bound as well as the sets of solutions with \nupper length bound for  SAS problems and induced STRIPS problems.\n\n We keep this polymorphic by not specifying concrete types so it applies to both STRIPS and \nSAS+ plans. \\<close>\nabbreviation bounded_plan_set \n  where \"bounded_plan_set ops k \\<equiv> { \\<pi>. set \\<pi> \\<subseteq> set ops \\<and> length \\<pi> = k }\"\n\ndefinition bounded_solution_set_sas_plus' \n  :: \"('variable, 'domain) sas_plus_problem \n    \\<Rightarrow> nat\n    \\<Rightarrow> ('variable, 'domain) sas_plus_plan set\" \n  where \"bounded_solution_set_sas_plus' \\<Psi> k \n    \\<equiv> { \\<psi>. is_serial_solution_for_problem \\<Psi> \\<psi> \\<and> length \\<psi> = k}\"\n\nabbreviation bounded_solution_set_sas_plus\n  :: \"('variable, 'domain) sas_plus_problem \n    \\<Rightarrow> nat\n    \\<Rightarrow> ('variable, 'domain) sas_plus_plan set\" \n  where \"bounded_solution_set_sas_plus \\<Psi> N \n    \\<equiv> (\\<Union>k \\<in> {0..N}. bounded_solution_set_sas_plus' \\<Psi> k)\"\n\ndefinition bounded_solution_set_strips'\n  :: \"('variable \\<times> 'domain) strips_problem \n    \\<Rightarrow> nat\n    \\<Rightarrow> ('variable \\<times> 'domain) strips_plan set\" \n  where \"bounded_solution_set_strips' \\<Pi> k\n    \\<equiv> { \\<pi>. STRIPS_Semantics.is_serial_solution_for_problem \\<Pi> \\<pi> \\<and> length \\<pi> = k }\"\n\nabbreviation bounded_solution_set_strips\n  :: \"('variable \\<times> 'domain) strips_problem \n    \\<Rightarrow> nat \n    \\<Rightarrow> ('variable \\<times> 'domain) strips_plan set\" \n  where \"bounded_solution_set_strips \\<Pi> N \\<equiv> (\\<Union>k \\<in> {0..N}. bounded_solution_set_strips' \\<Pi> k)\"\n\n\\<comment> \\<open> Show that plan transformation for all SAS Plus solutions yields a STRIPS solution for the\ninduced STRIPS problem with same length. \n\nWe first show injectiveness of plan transformation \\<open>\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\\<close> on the set of plans \n\\<open>P\\<^sub>k \\<equiv> bounded_plan_set (operators_of \\<Psi>) k\\<close> with length bound \\<open>k\\<close>. The injectiveness of \n\\<open>Sol\\<^sub>k \\<equiv> bounded_solution_set_sas_plus \\<Psi> k\\<close>---the set of solutions with length bound \\<open>k\\<close>--then \nfollows from the subset relation \\<open>Sol\\<^sub>k \\<subseteq> P\\<^sub>k\\<close>. \\<close>\nlemma sasp_op_to_strips_injective:\n  assumes \"(\\<phi>\\<^sub>O \\<Psi> op\\<^sub>1) = (\\<phi>\\<^sub>O \\<Psi> op\\<^sub>2)\"\n  shows \"op\\<^sub>1 = op\\<^sub>2\" \n  proof  -\n    let ?op\\<^sub>1' = \"\\<phi>\\<^sub>O \\<Psi> op\\<^sub>1\" \n      and ?op\\<^sub>2' = \"\\<phi>\\<^sub>O \\<Psi> op\\<^sub>2\" \n    {\n      have \"strips_operator.precondition_of ?op\\<^sub>1' = strips_operator.precondition_of ?op\\<^sub>2'\"\n        using assms \n        by argo\n      hence \"sas_plus_operator.precondition_of op\\<^sub>1 = sas_plus_operator.precondition_of op\\<^sub>2\"\n        unfolding sasp_op_to_strips_def\n          SAS_Plus_STRIPS.sasp_op_to_strips_def\n          Let_def \n        by simp\n    }\n    moreover {\n      have \"strips_operator.add_effects_of ?op\\<^sub>1' = strips_operator.add_effects_of ?op\\<^sub>2'\"\n        using assms \n        unfolding sasp_op_to_strips_def Let_def \n        by argo\n      hence \"sas_plus_operator.effect_of op\\<^sub>1 = sas_plus_operator.effect_of op\\<^sub>2\"\n        unfolding sasp_op_to_strips_def Let_def\n          SAS_Plus_STRIPS.sasp_op_to_strips_def\n        by simp\n    }\n    ultimately show ?thesis \n      by simp\n  qed\n\nlemma sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_i_a:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"inj_on (\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]) (bounded_plan_set (sas_plus_problem.operators_of \\<Psi>) k)\" \n  proof -\n    let ?ops = \"sas_plus_problem.operators_of \\<Psi>\"\n      (* TODO refactor transformation definitions *)\n      and ?\\<phi>\\<^sub>P = \"\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\"\n    let ?P = \"bounded_plan_set ?ops\"\n    {\n      fix \\<psi>\\<^sub>1 \\<psi>\\<^sub>2\n      assume \\<psi>\\<^sub>1_in: \"\\<psi>\\<^sub>1 \\<in> ?P k\" \n        and \\<psi>\\<^sub>2_in: \"\\<psi>\\<^sub>2 \\<in> ?P k\" \n        and \\<phi>\\<^sub>P_of_\\<psi>\\<^sub>1_is_\\<phi>\\<^sub>P_of_\\<psi>\\<^sub>2: \"(?\\<phi>\\<^sub>P \\<psi>\\<^sub>1) = (?\\<phi>\\<^sub>P \\<psi>\\<^sub>2)\"\n      hence \"\\<psi>\\<^sub>1 = \\<psi>\\<^sub>2\"\n        proof (induction k arbitrary: \\<psi>\\<^sub>1 \\<psi>\\<^sub>2)\n          case 0\n          then have \"length \\<psi>\\<^sub>1 = 0\" \n            and \"length \\<psi>\\<^sub>2 = 0\" \n            using \\<psi>\\<^sub>1_in \\<psi>\\<^sub>2_in\n            unfolding bounded_solution_set_sas_plus'_def \n            by blast+\n          then show ?case \n            by blast\n        next\n          case (Suc k)\n          moreover have \"length \\<psi>\\<^sub>1 = Suc k\" and \"length \\<psi>\\<^sub>2 = Suc k\"\n            using length_Suc_conv Suc(2, 3) \n            unfolding bounded_solution_set_sas_plus'_def\n            by blast+\n          moreover obtain op\\<^sub>1 \\<psi>\\<^sub>1' where \"\\<psi>\\<^sub>1 = op\\<^sub>1 # \\<psi>\\<^sub>1'\" \n            and \"set (op\\<^sub>1 # \\<psi>\\<^sub>1') \\<subseteq> set ?ops\"\n            and \"length \\<psi>\\<^sub>1' = k\" \n            using calculation(5) Suc(2)\n            unfolding length_Suc_conv\n            by blast\n          moreover obtain op\\<^sub>2 \\<psi>\\<^sub>2' where \"\\<psi>\\<^sub>2 = op\\<^sub>2 # \\<psi>\\<^sub>2'\" \n            and \"set (op\\<^sub>2 # \\<psi>\\<^sub>2') \\<subseteq> set ?ops\" \n            and \"length \\<psi>\\<^sub>2' = k\"\n            using calculation(6) Suc(3)\n            unfolding length_Suc_conv\n            by blast\n          moreover have \"set \\<psi>\\<^sub>1' \\<subseteq> set ?ops\" and \"set \\<psi>\\<^sub>2' \\<subseteq> set ?ops\" \n            using calculation(8, 11) \n            by auto+\n          moreover have \"\\<psi>\\<^sub>1' \\<in> ?P k\" and \"\\<psi>\\<^sub>2' \\<in> ?P k\"\n            using calculation(9, 12, 13, 14)\n            by fast+\n          moreover have \"?\\<phi>\\<^sub>P \\<psi>\\<^sub>1' = ?\\<phi>\\<^sub>P \\<psi>\\<^sub>2'\" \n            using Suc.prems(3) calculation(7, 10) \n            by fastforce\n          moreover have \"\\<psi>\\<^sub>1' = \\<psi>\\<^sub>2'\" \n            using Suc.IH[of \\<psi>\\<^sub>1' \\<psi>\\<^sub>2', OF calculation(15, 16, 17)]\n            by simp\n          moreover have \"?\\<phi>\\<^sub>P \\<psi>\\<^sub>1 = (\\<phi>\\<^sub>O \\<Psi> op\\<^sub>1) # ?\\<phi>\\<^sub>P \\<psi>\\<^sub>1'\" \n            and \"?\\<phi>\\<^sub>P \\<psi>\\<^sub>2 = (\\<phi>\\<^sub>O \\<Psi> op\\<^sub>2) # ?\\<phi>\\<^sub>P \\<psi>\\<^sub>2'\"\n            using Suc.prems(3) calculation(7, 10) \n            by fastforce+\n          moreover have \"(\\<phi>\\<^sub>O \\<Psi> op\\<^sub>1) = (\\<phi>\\<^sub>O \\<Psi> op\\<^sub>2)\" \n            using Suc.prems(3) calculation(17, 19, 20)\n            by simp\n          moreover have \"op\\<^sub>1 = op\\<^sub>2\" \n            using sasp_op_to_strips_injective[OF calculation(21)].\n          ultimately show ?case \n            by argo\n        qed\n    }\n    thus ?thesis \n      unfolding inj_on_def \n      by blast\n  qed\n\nprivate corollary sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_i_b:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"inj_on (\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]) (bounded_solution_set_sas_plus' \\<Psi> k)\"\n  proof -\n    let ?ops = \"sas_plus_problem.operators_of \\<Psi>\"\n      and ?\\<phi>\\<^sub>P = \"\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\"\n    {\n      fix \\<psi>\n      assume \"\\<psi> \\<in> bounded_solution_set_sas_plus' \\<Psi> k\" \n      then have \"set \\<psi> \\<subseteq> set ?ops\" \n        and \"length \\<psi> = k\" \n        unfolding bounded_solution_set_sas_plus'_def is_serial_solution_for_problem_def Let_def \n          list_all_iff ListMem_iff \n        by fast+\n      hence \"\\<psi> \\<in> bounded_plan_set ?ops k\" \n         by blast\n    }\n    hence \"bounded_solution_set_sas_plus' \\<Psi> k \\<subseteq> bounded_plan_set ?ops k\" \n      by blast\n    moreover have \"inj_on ?\\<phi>\\<^sub>P (bounded_plan_set ?ops k)\" \n      using sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_i_a[OF assms(1)].\n    ultimately show ?thesis\n      using inj_on_subset[of ?\\<phi>\\<^sub>P \"bounded_plan_set ?ops k\" \"bounded_solution_set_sas_plus' \\<Psi> k\"]\n      by fast\n  qed\n\n(*\nlemma \"card ((\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]) ` (bounded_solution_set_sas_plus' \\<Psi> k)) \n  = card (bounded_solution_set_strips' (\\<phi> \\<Psi>) k)\"  sorry\n*)\n\n\\<comment> \\<open> Show that mapping plan transformation \\<open>\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\\<close> over the solution set for a \ngiven SAS+ problem yields the solution set for the induced STRIPS problem. \\<close>\nprivate lemma sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_i_c:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"(\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]) ` (bounded_solution_set_sas_plus' \\<Psi> k) \n    = bounded_solution_set_strips' (\\<phi> \\<Psi>) k\" \n proof -\n   let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n     and ?\\<phi>\\<^sub>P = \"\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\"\n   let ?Sol\\<^sub>k = \"bounded_solution_set_sas_plus' \\<Psi> k\"\n    and ?Sol\\<^sub>k' = \"bounded_solution_set_strips' ?\\<Pi> k\"\n   {\n     assume \"?\\<phi>\\<^sub>P ` ?Sol\\<^sub>k \\<noteq> ?Sol\\<^sub>k'\" \n     then consider (A) \"\\<exists>\\<pi> \\<in> ?\\<phi>\\<^sub>P ` ?Sol\\<^sub>k. \\<pi> \\<notin> ?Sol\\<^sub>k'\"\n       | (B) \"\\<exists>\\<pi> \\<in> ?Sol\\<^sub>k'. \\<pi> \\<notin>  ?\\<phi>\\<^sub>P ` ?Sol\\<^sub>k\"\n       by blast\n     hence False \n       proof (cases)\n         case A\n         moreover obtain \\<pi> where \"\\<pi> \\<in> ?\\<phi>\\<^sub>P ` ?Sol\\<^sub>k\" and \"\\<pi> \\<notin> ?Sol\\<^sub>k'\"\n           using calculation\n           by blast\n         moreover obtain \\<psi> where \"length \\<psi> = k\" \n           and \"SAS_Plus_Semantics.is_serial_solution_for_problem \\<Psi> \\<psi>\" \n           and \"\\<pi> = ?\\<phi>\\<^sub>P \\<psi>\" \n           using calculation(2)\n           unfolding bounded_solution_set_sas_plus'_def \n           by blast\n         moreover have \"length \\<pi> = k\" and \"STRIPS_Semantics.is_serial_solution_for_problem ?\\<Pi> \\<pi>\"\n           subgoal \n             using calculation(4, 6) by auto\n           subgoal\n             using serial_sas_plus_equivalent_to_serial_strips\n               assms(1) calculation(5) calculation(6) \n             by blast\n           done\n         moreover have \"\\<pi> \\<in> ?Sol\\<^sub>k'\" \n           unfolding bounded_solution_set_strips'_def \n           using calculation(7, 8) \n           by simp\n         ultimately show ?thesis\n           by fast\n       next\n         case B\n         moreover obtain \\<pi> where \"\\<pi> \\<in> ?Sol\\<^sub>k'\" and \"\\<pi> \\<notin> ?\\<phi>\\<^sub>P ` ?Sol\\<^sub>k\"\n           using calculation\n           by blast\n         moreover have \"STRIPS_Semantics.is_serial_solution_for_problem ?\\<Pi> \\<pi>\"\n           and \"length \\<pi> = k\"\n           using calculation(2)\n           unfolding bounded_solution_set_strips'_def \n           by simp+\n         \\<comment> \\<open> Construct the counter example \\<open>\\<psi> \\<equiv> [\\<phi>\\<^sub>O\\<inverse> ?\\<Pi> op. op \\<leftarrow> \\<pi>]\\<close> and show that \\<open>\\<psi> \\<in> ?Sol\\<^sub>k\\<close>\n            as well as \\<open>?\\<phi>\\<^sub>P \\<psi> = \\<pi>\\<close> hence \\<open>\\<pi> \\<in> ?\\<phi>\\<^sub>P ` ?Sol\\<^sub>k\\<close>. \\<close>\n         moreover have \"length [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op. op \\<leftarrow> \\<pi>] = k\"\n           and \"SAS_Plus_Semantics.is_serial_solution_for_problem \\<Psi> [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op. op \\<leftarrow> \\<pi>]\" \n           subgoal \n             using calculation(5) \n             by simp\n           subgoal \n             using serial_strips_equivalent_to_serial_sas_plus[OF assms(1)] \n               calculation(4)\n             by simp\n           done\n         moreover have \"[\\<phi>\\<^sub>O\\<inverse> \\<Psi> op. op \\<leftarrow> \\<pi>] \\<in> ?Sol\\<^sub>k\" \n           unfolding bounded_solution_set_sas_plus'_def \n           using calculation(6, 7) \n           by blast\n         (* TODO refactor transformation lemmas *)\n         moreover {\n           have \"\\<forall>op \\<in> set \\<pi>. op \\<in> set ((?\\<Pi>)\\<^sub>\\<O>)\"\n             using calculation(4)\n             unfolding STRIPS_Semantics.is_serial_solution_for_problem_def list_all_iff ListMem_iff\n             by simp\n           hence \"?\\<phi>\\<^sub>P [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op. op \\<leftarrow> \\<pi>] = \\<pi>\" \n             proof (induction \\<pi>)\n               case (Cons op \\<pi>)\n               moreover have \"?\\<phi>\\<^sub>P [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op. op \\<leftarrow> op # \\<pi>] \n                = (\\<phi>\\<^sub>O \\<Psi> (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op)) # ?\\<phi>\\<^sub>P [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op. op \\<leftarrow> \\<pi>]\"\n                 by simp\n               moreover have \"op \\<in>  set ((?\\<Pi>)\\<^sub>\\<O>)\" \n                 using Cons.prems\n                 by simp\n               moreover have \"(\\<phi>\\<^sub>O \\<Psi> (\\<phi>\\<^sub>O\\<inverse> \\<Psi> op)) = op\"\n                 using strips_operator_inverse_is[OF assms(1) calculation(4)].\n               moreover have \"?\\<phi>\\<^sub>P [\\<phi>\\<^sub>O\\<inverse> \\<Psi> op. op \\<leftarrow> \\<pi>] = \\<pi>\" \n                 using Cons.IH Cons.prems \n                 by auto\n               ultimately show ?case \n                 by argo\n             qed simp\n         }\n         moreover have \"\\<pi> \\<in> ?\\<phi>\\<^sub>P ` ?Sol\\<^sub>k\" \n           using calculation(8, 9) \n           by force\n         ultimately show ?thesis\n           by blast\n      qed\n   }\n   thus ?thesis \n     by blast\n  qed\n\nprivate lemma sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_i_d:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"card (bounded_solution_set_sas_plus' \\<Psi> k) \\<le> card (bounded_solution_set_strips' (\\<phi> \\<Psi>) k)\"\n  proof -\n    let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n      and ?\\<phi>\\<^sub>P = \"\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]\"\n    let ?Sol\\<^sub>k = \"bounded_solution_set_sas_plus' \\<Psi> k\"\n      and ?Sol\\<^sub>k' = \"bounded_solution_set_strips' ?\\<Pi> k\"\n    have \"card (?\\<phi>\\<^sub>P ` ?Sol\\<^sub>k) = card (?Sol\\<^sub>k)\"\n     using sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_i_b[OF assms(1)] \n       card_image \n     by blast\n    moreover have \"?\\<phi>\\<^sub>P ` ?Sol\\<^sub>k = ?Sol\\<^sub>k'\"\n     using sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_i_c[OF assms(1)].\n    ultimately show ?thesis \n     by simp\n  qed\n\n\\<comment> \\<open> The set of fixed length plans with operators in a given operator set is finite. \\<close>\nlemma bounded_plan_set_finite:\n  shows \"finite { \\<pi>. set \\<pi> \\<subseteq> set ops \\<and> length \\<pi> = k }\"\n  proof (induction k)\n    case (Suc k)\n    let ?P = \"{ \\<pi>. set \\<pi> \\<subseteq> set ops \\<and> length \\<pi> = k }\"\n      and ?P' = \"{ \\<pi>. set \\<pi> \\<subseteq> set ops \\<and> length \\<pi> = Suc k }\"  \n    let ?P'' = \"(\\<Union>op \\<in> set ops. (\\<Union>\\<pi> \\<in> ?P. { op # \\<pi> }))\" \n    {\n      have \"\\<forall>op \\<pi>. finite { op # \\<pi> }\"\n        by simp\n      then have \"\\<forall>op. finite (\\<Union>\\<pi> \\<in> ?P. { op # \\<pi> })\" \n        using finite_UN[of ?P] Suc \n        by blast\n      hence \"finite ?P''\" \n        using finite_UN[of \"set ops\"]\n        by blast\n    }\n    moreover {\n      {\n        fix \\<pi>\n        assume \"\\<pi> \\<in> ?P'\"\n        moreover have \"set \\<pi> \\<subseteq> set ops\" \n          and \"length \\<pi> = Suc k\" \n          using calculation \n          by simp+\n        moreover obtain op \\<pi>' where \"\\<pi> = op # \\<pi>'\" \n          using calculation (3)\n          unfolding length_Suc_conv \n          by fast\n        moreover have \"set \\<pi>' \\<subseteq> set ops\" and \"op \\<in> set ops\"\n          using calculation(2, 4) \n          by simp+\n        moreover have \"length \\<pi>' = k\"\n          using calculation(3, 4) \n          by auto\n        moreover have \"\\<pi>' \\<in> ?P\" \n          using calculation(5, 7)\n          by blast\n        ultimately have \"\\<pi> \\<in> ?P''\"\n          by blast\n      }\n      hence \"?P' \\<subseteq> ?P''\"\n        by blast\n    }\n    ultimately show ?case \n      using rev_finite_subset[of ?P'' ?P']\n      by blast\n  qed force\n\n\\<comment> \\<open> The set of fixed length SAS+ solutions are subsets of the set of plans with fixed length and \ntherefore also finite. \\<close>\nprivate lemma sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_ii_a:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"finite (bounded_solution_set_sas_plus' \\<Psi> k)\"\nproof -\n  let ?Ops = \"set ((\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\"\n  let ?Sol\\<^sub>k = \"bounded_solution_set_sas_plus' \\<Psi> k\"\n    and ?P\\<^sub>k = \"{ \\<pi>. set \\<pi> \\<subseteq> ?Ops \\<and> length \\<pi> = k }\"\n  {\n    fix \\<psi>\n    assume \"\\<psi> \\<in> ?Sol\\<^sub>k\"\n    then have \"length \\<psi> = k\" and \"set \\<psi> \\<subseteq> ?Ops\"\n      unfolding bounded_solution_set_sas_plus'_def \n        SAS_Plus_Semantics.is_serial_solution_for_problem_def Let_def list_all_iff ListMem_iff\n      by fastforce+\n    hence \"\\<psi> \\<in> ?P\\<^sub>k\" \n      by blast\n  }\n  then have \"?Sol\\<^sub>k \\<subseteq> ?P\\<^sub>k\" \n    by force\n  thus ?thesis\n    using bounded_plan_set_finite rev_finite_subset[of ?P\\<^sub>k ?Sol\\<^sub>k]\n    by auto\nqed\n\n\\<comment> \\<open> The set of fixed length STRIPS solutions are subsets of the set of plans with fixed length and \ntherefore also finite. \\<close>\nprivate lemma sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_ii_b:\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"finite (bounded_solution_set_strips' (\\<phi> \\<Psi>) k)\"\nproof -\n  let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n  let ?Ops = \"set ((?\\<Pi>)\\<^sub>\\<O>)\"\n  let ?Sol\\<^sub>k = \"bounded_solution_set_strips' ?\\<Pi> k\"\n    and ?P\\<^sub>k = \"{ \\<pi>. set \\<pi> \\<subseteq> ?Ops \\<and> length \\<pi> = k }\"\n  {\n    fix \\<pi>\n    assume \"\\<pi> \\<in> ?Sol\\<^sub>k\"\n    then have \"length \\<pi> = k\" and \"set \\<pi> \\<subseteq> ?Ops\"\n      unfolding bounded_solution_set_strips'_def \n        STRIPS_Semantics.is_serial_solution_for_problem_def Let_def list_all_iff ListMem_iff\n      by fastforce+\n    hence \"\\<pi> \\<in> ?P\\<^sub>k\" \n      by blast\n  }\n  then have \"?Sol\\<^sub>k \\<subseteq> ?P\\<^sub>k\" \n    by force\n  thus ?thesis\n    using bounded_plan_set_finite rev_finite_subset[of ?P\\<^sub>k ?Sol\\<^sub>k] \n    unfolding state_to_strips_state_def\n      SAS_Plus_STRIPS.state_to_strips_state_def operators_of_def\n    by blast\nqed\n\ntext \\<open> With the results on the equivalence of SAS+ and STRIPS solutions, we can now show that given \nproblems in both formalisms, the solution sets have the same size.\nThis is the property required by the definition of planning formalism equivalence presented earlier \nin theorem \\ref{thm:solution-sets-sas-plus-strips-f} (\\autoref{sub:equivalence-sas-plus-strips}) and \nthus end up with the desired equivalence result.\n\nThe proof uses the finiteness and disjunctiveness of the solution sets for either problem to be \nable to equivalently transform the set cardinality over the union of sets of solutions with bounded \nlengths into a sum over the cardinality of the sets of solutions with bounded length. Moreover, \nsince we know that for each SAS+ solution with a given length an equivalent STRIPS solution exists \nin the solution set of the transformed problem with the same length, both sets must have the same \ncardinality. \n\nHence the cardinality of the  SAS+ solution set over all lengths up to a given upper bound \\<^term>\\<open>N\\<close> \nhas the same size as the solution set of the corresponding STRIPS problem over all length up to a \ngiven upper bound \\<^term>\\<open>N\\<close>. \\<close>\n\ntheorem\n  assumes \"is_valid_problem_sas_plus \\<Psi>\"\n  shows \"card (bounded_solution_set_sas_plus \\<Psi> N) \n    = card (bounded_solution_set_strips (\\<phi> \\<Psi>) N)\" \n  proof -\n    let ?\\<Pi> = \"\\<phi> \\<Psi>\"\n      and ?R = \"{0..N}\" \n    \\<comment> \\<open> Due to the disjoint nature of the bounded solution sets for fixed plan length for different \n    lengths, we can sum the individual set cardinality to obtain the cardinality of the overall SAS+ \n    resp. STRIPS solution sets. \\<close>\n    have finite_R: \"finite ?R\" \n      by simp\n    moreover {\n      have \"\\<forall>k \\<in> ?R. finite (bounded_solution_set_sas_plus' \\<Psi> k)\" \n        using sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_ii_a[OF \n            assms(1)]..\n      moreover have \"\\<forall>j \\<in> ?R. \\<forall>k \\<in> ?R. j \\<noteq> k \n        \\<longrightarrow> bounded_solution_set_sas_plus' \\<Psi> j \n          \\<inter> bounded_solution_set_sas_plus' \\<Psi> k = {}\"\n        unfolding bounded_solution_set_sas_plus'_def \n        by blast\n      (* TODO slow. *)\n      ultimately have \"card (bounded_solution_set_sas_plus \\<Psi> N)\n        = (\\<Sum>k \\<in> ?R. card (bounded_solution_set_sas_plus' \\<Psi> k))\"\n        using card_UN_disjoint \n        by blast\n    }\n    moreover {\n      have \"\\<forall>k \\<in> ?R. finite (bounded_solution_set_strips' ?\\<Pi> k)\" \n        using sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_ii_b[OF \n            assms(1)]..\n      moreover have \"\\<forall>j \\<in> ?R. \\<forall>k \\<in> ?R. j \\<noteq> k \n        \\<longrightarrow> bounded_solution_set_strips' ?\\<Pi> j \n          \\<inter> bounded_solution_set_strips' ?\\<Pi> k = {}\"\n        unfolding bounded_solution_set_strips'_def\n        by blast\n      (* TODO slow. *)\n      ultimately have \"card (bounded_solution_set_strips ?\\<Pi> N)\n        = (\\<Sum>k \\<in> ?R. card (bounded_solution_set_strips' ?\\<Pi> k))\"\n        using card_UN_disjoint\n        by blast\n    }\n    moreover {\n      fix k\n      have \"card (bounded_solution_set_sas_plus' \\<Psi> k)\n        = card ((\\<lambda>\\<psi>. [\\<phi>\\<^sub>O \\<Psi> op. op \\<leftarrow> \\<psi>]) \n          ` bounded_solution_set_sas_plus' \\<Psi> k)\"\n        using sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_i_b[OF assms]\n          card_image[symmetric] \n        by blast\n      hence \"card (bounded_solution_set_sas_plus' \\<Psi> k)\n        = card (bounded_solution_set_strips' ?\\<Pi> k)\" \n        using sas_plus_formalism_and_induced_strips_formalism_are_equally_expressive_i_c[OF assms]\n        by presburger\n    } \n    ultimately show ?thesis\n      by presburger\n  qed\n\n\nend\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Verified_SAT_Based_AI_Planning/SAS_Plus_STRIPS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819591324416, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.34605352095346736}}
{"text": "theory BeispielZahlenwelt2\nimports Zahlenwelt BeispielPerson Aenderung KategorischerImperativ\nbegin\n\nsection\\<open>Beispiel: Zahlenwelt2\\<close>\ntext\\<open>In diesem Abschnitt werden wir ein weiteres Beispiel sehen.\\<close>\n\ntext\\<open>Dieses Beispiel ist ähnlich zum Beispiel Zahlenwelt in Abschnitt \\ref{sec:bspzahlenwelt}.\nAllerdings führen wir einige Erweiterungen ein:\n  \\<^item> Jeder Person wird weiterhin ihr Besitz zugeordnet.\n  \\<^item> Neben dem Besitz gibt es auch ein Modell von Konsens.\n    Dabei soll Konsens die Liste aller bereits getroffenen Abmachungen darstellen,\n    bzw modellieren, zu was die Leute bereit wären.\n    So lässt sich beispielsweise Schenken (Besitzübergang mit Konsens)\n    von Stehlen (Besitzübergang ohne Konsens) unterscheiden.\n  \\<^item> Es gibt eine spezielle Entität, nämlich den Staat.\n    Diese Entität ist nicht in der Menge der natürlichen Personen enthalten.\n    Dies erlaubt es z.B. den Staat in Handlungsabsichten hardzucoden und\n    gleichzeitig eine wohlgeformte Handlungsabsicht zu haben.\n    TODO: machen\n  \\<^item> Als weitere spezielle Entität wird die Umwelt eingeführt.\n\\<close>\n\nrecord zahlenwelt =\n  besitz :: \\<open>person \\<Rightarrow> int\\<close>\n  konsens :: \\<open>(person, int) globaler_konsens\\<close>\n  staatsbesitz :: \\<open>int\\<close> \\<comment>\\<open>Der Staat ist keine natürliche Person und damit besonders.\\<close>\n  umwelt :: \\<open>int\\<close>\n\ndefinition initialwelt :: \\<open>zahlenwelt\\<close>\n  where\n\\<open>initialwelt \\<equiv> \\<lparr>\n  besitz = (\\<euro>(Alice := 5, Bob := 10, Carol := -3)),\n  konsens = (\\<lambda>_. [])(\n    Alice := [to_abmachung [Gewinnt Alice 3], to_abmachung [Gewinnt Alice 3, Verliert Bob 3]],\n    Bob := [to_abmachung [Gewinnt Alice 3, Verliert Bob 3]]),\n  staatsbesitz = 9000,\n  umwelt = 600\n \\<rparr>\\<close>\n\n\n\ntext\\<open>Mein persönlicher Besitz:\\<close>\nfun meins :: \\<open>person \\<Rightarrow> zahlenwelt \\<Rightarrow> int\\<close> where\n  \\<open>meins p welt = (besitz welt) p\\<close>\n\nbeispiel \\<open>meins Carol initialwelt = -3\\<close> by eval\n\n(*<*)\ndefinition zahlenwps :: \\<open>person \\<Rightarrow> person \\<Rightarrow> zahlenwelt \\<Rightarrow> zahlenwelt\\<close> where\n  \\<open>zahlenwps p1 p2 welt = \n      welt\\<lparr> besitz := swap p1 p2 (besitz welt),\n            konsens := konsensswap p1 p2 (konsens welt) \\<rparr>\\<close>\n\n\nbeispiel \\<open>zahlenwps Alice Bob initialwelt\n= \\<lparr>\n  besitz = (\\<euro>(Alice := 10, Bob := 5, Carol := -3)),\n  konsens = (\\<lambda>_. [])(\n    Alice := [to_abmachung [Gewinnt Bob 3, Verliert Alice 3]],\n    Bob := [to_abmachung [Gewinnt Bob 3], to_abmachung [Gewinnt Bob 3, Verliert Alice 3]]),\n  staatsbesitz = 9000,\n  umwelt = 600\n \\<rparr>\\<close> by eval\n\n\nbeispiel \\<open>zahlenwps Alice Carol initialwelt\n= \\<lparr>\n  besitz = (\\<euro>(Alice := -3, Bob := 10, Carol := 5)),\n  konsens = (\\<lambda>_. [])(\n    Bob := [to_abmachung [Gewinnt Carol 3, Verliert Bob 3]],\n    Carol := [to_abmachung [Gewinnt Carol 3], to_abmachung [Gewinnt Carol 3, Verliert Bob 3]]),\n  staatsbesitz = 9000,\n  umwelt = 600\n \\<rparr>\\<close> by eval\n\n(*<*)\nlemma zahlenwps_id: \\<open>zahlenwps p1 p2 (zahlenwps p1 p2 welt) = welt\\<close>\n  by(simp add: zahlenwps_def)\n\nlemma zahlenwps_sym: \\<open>zahlenwps p1 p2 = zahlenwps p2 p1\\<close>\n  apply(simp add: fun_eq_iff zahlenwps_def)\n  by (simp add: swap_symmetric konsensswap_sym)\n\nlemma zahlenwps_same: \\<open>zahlenwps p p w = w\\<close>\n  by(cases \\<open>w\\<close>, simp add: zahlenwps_def)\n\nlemma besitz_zahlenwps[simp]: \\<open>besitz (zahlenwps p1 p2 welt) = swap p1 p2 (besitz welt)\\<close>\n  by(simp add: zahlenwps_def)\n\nlemma besitz_zahlenwps_apply: \\<open>besitz (zahlenwps p1 p2 welt) p2 = besitz welt p1\\<close>\n  by (simp add: swap_b)\n\nlemma besitz_zahlenwps_nothing: \\<open>pX \\<noteq> p1 \\<Longrightarrow>\n       pX \\<noteq> p2 \\<Longrightarrow>\n       besitz (zahlenwps p1 p2 welt) pX = besitz welt pX\\<close>\n  by (simp add: swap_nothing)\n(*>*)\n\n\ndefinition enthaelt_konsens :: \\<open>(person, int) abmachung \\<Rightarrow> zahlenwelt \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>enthaelt_konsens abmachung welt \\<equiv> Aenderung.enthaelt_konsens abmachung (konsens welt)\\<close>\n\nlemma enthaelt_konsens_swap:\n  \\<open>enthaelt_konsens (swap p1 p2 a) (zahlenwps p1 p2 welt) = enthaelt_konsens a welt\\<close> \n  by(simp add: enthaelt_konsens_def zahlenwps_def Aenderung.enthaelt_konsens_swap)\n(*>*)\n\n\ntext\\<open>Wenn \\<^const>\\<open>reverse_engineer_abmachung\\<close> hier nicht genau die gleiche Abmachung\nberechnet wie später eingelöst, dann wird das ganze exploitable.\nDa eine \\<^typ>\\<open>('person, 'etwas) abmachung\\<close> aber eine eindeutige Darstellung sein sollte,\nmüsst das so funktionieren.\\<close>\ndefinition einvernehmlich :: \\<open>zahlenwelt handlung \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>einvernehmlich h \\<equiv>\n    let abmachung = reverse_engineer_abmachung (map_handlung besitz h)\n    in enthaelt_konsens abmachung (vorher h)\n        \\<and> konsens_wurde_entfernt abmachung (konsens (vorher h)) (konsens (nachher h))\\<close>\n(*TODO: hier will konsens_wurde_entfernt dazu? Neuer name! Einvernehmlich?*)\n\n\n(*<*)\nlemma einvernehmlich_swap:\n  \\<open>einvernehmlich (map_handlung (zahlenwps p1 p2) h) = einvernehmlich h\\<close>\n  apply(cases \\<open>h\\<close>, rename_tac vor nach, simp)\n  apply(simp add: einvernehmlich_def)\n  apply(case_tac \\<open>vor\\<close>, case_tac \\<open>nach\\<close>, simp add: zahlenwps_def)\n  apply(simp add: reverse_engineer_abmachung_swap)\n  apply(simp add: Aenderung.enthaelt_konsens_swap BeispielZahlenwelt2.enthaelt_konsens_def)\n  apply(simp add: konsens_wurde_entfernt_swap)\n  by metis (*wtf?*)\n\nlemma einvernehmlich_swap_nachher_handeln:\n  \\<open>einvernehmlich (Handlung (zahlenwps p1 p2 welt) (nachher_handeln p1 (zahlenwps p1 p2 welt) ha)) =\n    einvernehmlich (Handlung welt (zahlenwps p1 p2 (nachher_handeln p1 (zahlenwps p2 p1 welt) ha)))\\<close>\n  apply (metis (no_types, opaque_lifting) handlung.map einvernehmlich_swap zahlenwps_id zahlenwps_sym)\n  done\n\nlemma einvernehmlich_noop: \\<open>einvernehmlich (Handlung welt welt)\\<close>\n  apply(simp add: einvernehmlich_def reverse_engineer_abmachung_same)\n  by(code_simp)\n\nlemma nicht_ausfuehrbar_einvernehmlich:\n  \\<open>\\<not> ausfuehrbar p welt ha \\<Longrightarrow> einvernehmlich (handeln p welt ha)\\<close>\n  apply(simp add: handeln_def nicht_ausfuehrbar_nachher_handeln einvernehmlich_noop)\n  done\n(*>*)\n\n\ntext\\<open>Eine Handlung die keine Änderung bewirkt hat keine Betroffenen und damit immer Konsens.\\<close>\nlemma \\<open>einvernehmlich (handeln p welt (Handlungsabsicht (\\<lambda>p w. Some w)))\\<close>\n  apply(simp add: einvernehmlich_def Let_def)\n  apply(simp add: handeln_def nachher_handeln.simps reverse_engineer_abmachung_same)\n  apply(code_simp)\n  done\n  \nbeispiel\n  \\<open>einvernehmlich (handeln Alice initialwelt\n    (Handlungsabsicht (\\<lambda>p w. Some\n       (w\\<lparr> besitz := \\<lbrakk>\\<lbrakk>(besitz w)(Alice += 3)\\<rbrakk>(Bob -= 3)\\<rbrakk>,\n           konsens := konsens_entfernen (to_abmachung [Gewinnt Alice (3::int), Verliert Bob 3]) (konsens w) \\<rparr>))))\\<close>\n  by eval\nbeispiel \\<open>\\<not> einvernehmlich (handeln Alice initialwelt\n          (Handlungsabsicht (\\<lambda>p w. Some (w\\<lparr> besitz := \\<lbrakk>\\<lbrakk>(besitz w)(Alice += 3)\\<rbrakk>(Bob -= 3)\\<rbrakk> \\<rparr>))))\\<close>\n  by eval\nbeispiel \\<open>\\<not> einvernehmlich (handeln Alice initialwelt\n          (Handlungsabsicht (\\<lambda>p w. Some (w\\<lparr> besitz := \\<lbrakk>\\<lbrakk>(besitz w)(Alice += 4)\\<rbrakk>(Bob -= 4)\\<rbrakk> \\<rparr>))))\\<close>\n  by eval\n\n\n\ndefinition abmachung_ausfuehren\n  :: \\<open>(person, int) abmachung \\<Rightarrow> zahlenwelt \\<Rightarrow> zahlenwelt\\<close>\nwhere\n  \\<open>abmachung_ausfuehren abmachung welt \\<equiv>\n    welt\\<lparr> besitz := Aenderung.abmachung_ausfuehren abmachung (besitz welt) \\<rparr>\\<close>\n\nbeispiel \\<open>abmachung_ausfuehren (to_abmachung [Gewinnt Alice 3]) initialwelt\n  = initialwelt\\<lparr> besitz := \\<lbrakk>(besitz initialwelt)(Alice += 3)\\<rbrakk>\\<rparr>\\<close>\n  by eval\n\n\ntext\\<open>Um eine \\<^typ>\\<open>(person, int) abmachung\\<close> einzulösen wird diese erst ausgeführt\nund danach aus dem globalen Konsens entfernt, damit die Abmachung\nnicht mehrfach eingelöst werden kann.\\<close>\ndefinition abmachung_einloesen :: \\<open>(person, int) abmachung \\<Rightarrow> zahlenwelt \\<Rightarrow> zahlenwelt option\\<close> where\n  \\<open>abmachung_einloesen delta welt \\<equiv> \n  if enthaelt_konsens delta welt\n  then Some ((abmachung_ausfuehren delta welt)\\<lparr> konsens := konsens_entfernen delta (konsens welt)\\<rparr>)\n  else None\\<close>\n\n\nbeispiel \\<open>abmachung_einloesen (to_abmachung [Gewinnt Alice 3, Verliert Bob 3]) initialwelt\n = Some\n  \\<lparr>\n    besitz = (\\<euro>(Alice := 8, Bob := 7, Carol := -3)),\n    konsens = (\\<lambda>_. [])(\n      Alice := [to_abmachung [Gewinnt Alice 3]],\n      Bob := []),\n    staatsbesitz = 9000,\n    umwelt = 600\n   \\<rparr>\\<close>\n  by eval\n\nbeispiel \\<open>abmachung_einloesen (to_abmachung [Gewinnt Alice 3]) initialwelt\n = Some\n  \\<lparr>\n    besitz = (\\<euro>(Alice := 8, Bob := 10, Carol := -3)),\n    konsens = (\\<lambda>_. [])(\n      Alice := [to_abmachung [Gewinnt Alice 3, Verliert Bob 3]],\n      Bob := [to_abmachung [Gewinnt Alice 3, Verliert Bob 3]]),\n    staatsbesitz = 9000,\n    umwelt = 600\n   \\<rparr>\\<close>\n  by eval\n\nbeispiel \\<open>abmachung_einloesen (to_abmachung [Verliert Bob 3]) initialwelt = None\\<close>\n  by eval\n\n(*<*)\nlemma abmachung_einloesen_some_entahelt_konsens:\n  \\<open>abmachung_einloesen a welt = Some welt' \\<Longrightarrow> enthaelt_konsens a welt\\<close>\n  by(simp add: abmachung_einloesen_def split: if_split_asm)\n\nlemma abmachung_einloesen_reverse_engineer:\n  \\<open>abmachung_einloesen a welt = Some welt'\n    \\<Longrightarrow> reverse_engineer_abmachung (Handlung (besitz welt) (besitz welt')) = a\\<close>\n  apply(simp add: abmachung_einloesen_def split: if_split_asm)\n  apply(simp add: abmachung_ausfuehren_def)\n  apply(simp add: reverse_engineer_abmachung)\n  by force\n\nlemma zahlenwelt_abmachung_ausfuehren_swap:\n  \\<open>(BeispielZahlenwelt2.abmachung_ausfuehren (swap p1 p2 a) (zahlenwps p1 p2 welt)) =\n       zahlenwps p2 p1 (BeispielZahlenwelt2.abmachung_ausfuehren a welt)\\<close>\n    apply(simp add: BeispielZahlenwelt2.abmachung_ausfuehren_def)\n  by(simp add: zahlenwps_def abmachung_ausfuehren_swap konsensswap_sym)\n\nlemma abmachung_einloesen_zahlenwps_pullout:\n  \\<open>abmachung_einloesen (swap p1 p2 a) (zahlenwps p1 p2 welt)\n    = map_option (zahlenwps p2 p1) (abmachung_einloesen a welt)\\<close>\n  apply(simp add: abmachung_einloesen_def enthaelt_konsens_swap)\n  apply(clarsimp)\n  apply(simp add: zahlenwelt_abmachung_ausfuehren_swap)\n  apply(simp add: zahlenwps_def konsens_entfernen_konsensswap)\n  by (metis konsens_entfernen_konsensswap konsensswap_id)\n(*>*)\n\n\ntext\\<open>Die Handlungsabsicht \\<^const>\\<open>abmachung_einloesen\\<close> stellt keine\n\\<^const>\\<open>wohlgeformte_handlungsabsicht\\<close> dar, da in der Abmachung Personen\nhardcedoded sind.\n\\<close>\nbeispiel \\<open>\\<not> wohlgeformte_handlungsabsicht zahlenwps initialwelt\n         (Handlungsabsicht (\\<lambda>p w. abmachung_einloesen (to_abmachung [Gewinnt Alice 3]) w))\\<close>\n  by eval\n\n\ntext\\<open>Wir können aber schnell eine wohlgeformte Handlungsabsicht daraus bauen,\nindem wir nicht die Abmachung an sich in die Handlungsabsicht hardcoden,\nsondern indem wir eine bestehende Abmachung in der Welt referenzieren.\\<close>\ndefinition existierende_abmachung_einloesen :: \\<open>person \\<Rightarrow> zahlenwelt \\<Rightarrow> zahlenwelt option\\<close> where\n  \\<open>existierende_abmachung_einloesen p welt \\<equiv> \n  case (konsens welt) p\n  of [] \\<Rightarrow> None\n  |  d#_ \\<Rightarrow> abmachung_einloesen d welt\\<close>\n\nlemma \\<open>wohlgeformte_handlungsabsicht zahlenwps initialwelt\n         (Handlungsabsicht existierende_abmachung_einloesen)\\<close>\n  by eval\n\n(*<*)\n\nlemma existierende_abmachung_einloesen_map_zahlenwps:\n  \\<open>map_option (zahlenwps p2 p1) (existierende_abmachung_einloesen p2 (zahlenwps p1 p2 welt)) =\n    existierende_abmachung_einloesen p1 welt\\<close>\n  apply(simp add: existierende_abmachung_einloesen_def)\n  apply(simp add: zahlenwps_def swap_b konsensswap_def)\n  apply(case_tac \\<open>konsens welt p1\\<close>)\n   apply(simp; fail)\n  apply(simp)\n  using abmachung_einloesen_zahlenwps_pullout\n  by (metis swap2 swap_symmetric zahlenwps_id)\n\nlemma existierende_abmachung_einloesen_zahlenwps_pullout:\n  \\<open>existierende_abmachung_einloesen p (zahlenwps p1 p2 welt)\n    = map_option (zahlenwps p2 p1) (existierende_abmachung_einloesen (swap p1 p2 id p) welt)\\<close>\n  apply(cases \\<open>p = p1\\<close>)\n  apply(simp add: swap_a)\n  apply (metis existierende_abmachung_einloesen_map_zahlenwps zahlenwps_id)\n  apply(cases \\<open>p = p2\\<close>)\n  apply(simp add: swap_b)\n   apply (metis existierende_abmachung_einloesen_map_zahlenwps zahlenwps_id zahlenwps_sym)\n  apply(simp add: swap_nothing)\n\n  apply(simp add: existierende_abmachung_einloesen_def)\n  apply(simp add: zahlenwps_def konsensswap_def swap_nothing)\n  apply(case_tac \\<open>konsens welt p\\<close>)\n   apply(simp; fail)\n  apply(simp)\n  using abmachung_einloesen_zahlenwps_pullout by simp\n(*>*)\n\ntext\\<open>In jeder Welt ist damit die Handlungsabsicht wohlgeformt.\\<close>\nlemma wohlgeformte_handlungsabsicht_existierende_abmachung_einloesen:\n  \\<open>wohlgeformte_handlungsabsicht zahlenwps welt\n         (Handlungsabsicht existierende_abmachung_einloesen)\\<close>\n  apply(simp add: wohlgeformte_handlungsabsicht.simps)\n  apply(cases \\<open>welt\\<close>, simp)\n  using existierende_abmachung_einloesen_map_zahlenwps by simp\n\n\n\ntext\\<open>Es ist nur möglich eine \\<^const>\\<open>existierende_abmachung_einloesen\\<close>,\nwenn alle Betroffenen auch zustimmen.\nEs is beispielsweise nicht möglich, dass \\<^const>\\<open>Alice\\<close> eine Handlung\nausführt, die \\<^const>\\<open>Carol\\<close> betrifft, ohne deren Zustimmung.\\<close>\nbeispiel \\<open>\\<not> ausfuehrbar Alice\n  \\<lparr>\n    besitz = (\\<euro>(Alice := 5, Bob := 10, Carol := -3)),\n    konsens = (\\<lambda>_. [])(\n      Alice := [to_abmachung [Verliert Carol 3]]\n      ),\n    staatsbesitz = 9000,\n    umwelt = 600\n  \\<rparr>\n  (Handlungsabsicht existierende_abmachung_einloesen)\\<close>\n  by eval\ntext\\<open>Nur wenn \\<^const>\\<open>Carol\\<close> zustimmt wird die Handlung möglich.\\<close>\nbeispiel \\<open>ausfuehrbar Alice\n  \\<lparr>\n    besitz = (\\<euro>(Alice := 5, Bob := 10, Carol := -3)),\n    konsens = (\\<lambda>_. [])(\n      Alice := [to_abmachung [Verliert Carol 3]],\n      Carol := [to_abmachung [Verliert Carol 3]]\n      ),\n    staatsbesitz = 9000,\n    umwelt = 600\n  \\<rparr>\n  (Handlungsabsicht existierende_abmachung_einloesen)\\<close>\n  by eval\n\n(*bissal doof:*)\ntext\\<open>Da \\<^const>\\<open>Alice\\<close> nicht betroffen is, bleibt \\<^term>\\<open>[Verliert Carol 3]\\<close> bei \\<^const>\\<open>Alice\\<close> übrig.\\<close>\nbeispiel \\<open>nachher_handeln Alice\n  \\<lparr>\n    besitz = (\\<euro>(Alice := 5, Bob := 10, Carol := -3)),\n    konsens = (\\<lambda>_. [])(\n      Alice := [to_abmachung [Verliert Carol 3]],\n      Carol := [to_abmachung [Verliert Carol 3]]\n      ),\n    staatsbesitz = 9000,\n    umwelt = 600\n  \\<rparr>\n  (Handlungsabsicht existierende_abmachung_einloesen)\n= \\<lparr>\n    besitz = (\\<euro>(Alice := 5, Bob := 10, Carol := -6)),\n    konsens = (\\<lambda>_. [])(\n      Alice := [to_abmachung [Verliert Carol 3]],\n      Carol := []\n      ),\n    staatsbesitz = 9000,\n    umwelt = 600\n  \\<rparr>\\<close>\n  by eval\n\n\ntext\\<open>Für\\<^const>\\<open>existierende_abmachung_einloesen\\<close> gilt immer \\<^const>\\<open>einvernehmlich\\<close>.\nDas \\<^const>\\<open>reverse_engineer_abmachung\\<close> macht also das Richtige.\\<close>\nlemma einvernehmlich_existierende_abmachung_einloesen:\n  \\<open>einvernehmlich (handeln p welt (Handlungsabsicht existierende_abmachung_einloesen))\\<close>\n  apply(simp add: einvernehmlich_def handeln_def nachher_handeln.simps)\n  apply(cases \\<open>existierende_abmachung_einloesen p welt\\<close>)\n  apply(simp)\n  using einvernehmlich_def einvernehmlich_noop apply fastforce\n  apply(simp)\n  apply(rename_tac welt')\n  apply(simp add: existierende_abmachung_einloesen_def split:list.split_asm)\n  apply(frule abmachung_einloesen_some_entahelt_konsens)\n  apply(simp add: abmachung_einloesen_reverse_engineer)\n  using BeispielZahlenwelt2.enthaelt_konsens_def abmachung_einloesen_def\n    konsens_wurde_entfernt_konsens_entfernen by fastforce\n\nfun stehlen :: \\<open>int \\<Rightarrow> int \\<Rightarrow> person \\<Rightarrow> zahlenwelt \\<Rightarrow> zahlenwelt option\\<close> where\n  \\<open>stehlen beute opfer_nach_besitz dieb welt =\n        map_option (\\<lambda>b. welt\\<lparr>besitz := b\\<rparr>) (Zahlenwelt.stehlen beute opfer_nach_besitz dieb (besitz welt))\\<close>\n\nbeispiel\\<open>stehlen 3 10 Alice initialwelt =\nSome \\<lparr>\n  besitz = (\\<euro>(Alice := 8, Bob := 7, Carol := -3)),\n  konsens = (\\<lambda>_. [])(\n    Alice := [to_abmachung [Gewinnt Alice 3], to_abmachung [Gewinnt Alice 3, Verliert Bob 3]],\n    Bob := [to_abmachung [Gewinnt Alice 3, Verliert Bob 3]]),\n  staatsbesitz = 9000,\n  umwelt = 600\n \\<rparr>\\<close> by eval\n\ntext\\<open>\\<^const>\\<open>stehlen\\<close> und \\<^const>\\<open>existierende_abmachung_einloesen\\<close> können ununterscheidbar sein,\nwas den \\<^const>\\<open>besitz\\<close> betrifft.\nDer Hauptunterschied ist, ob \\<^const>\\<open>konsens\\<close> eingelöst wurde oder nicht.\\<close>\nbeispiel\n \\<open>besitz (the (stehlen 3 10 Alice initialwelt)) =\n  besitz (the (existierende_abmachung_einloesen Bob initialwelt))\\<close>\n \\<open>konsens (the (stehlen 3 10 Alice initialwelt)) \\<noteq>\n  konsens (the (existierende_abmachung_einloesen Bob initialwelt))\\<close>\n  by code_simp+\n\n(*<*)\nlemma besitz_sel_update: \\<open>map_option besitz (map_option (\\<lambda>b. w\\<lparr>besitz := b\\<rparr>) b) = b\\<close>\n  apply(cases \\<open>b\\<close>)\n   apply(simp; fail)\n  apply(simp)\n  done\n\nlemma wohlgeformte_handlungsabsicht_stehlen:\n  \\<open>wohlgeformte_handlungsabsicht zahlenwps welt (Handlungsabsicht (stehlen n p))\\<close>\n  apply(rule wfh_generalize_worldI[OF wohlgeformte_handlungsabsicht_stehlen,\n        where sel=\\<open>besitz\\<close>\n        and makeZ=\\<open>\\<lambda>b other. case other of (k, s, u) \\<Rightarrow> zahlenwelt.make b k s u\\<close>\n        and sel_other=\\<open>\\<lambda>w. (konsens w, staatsbesitz w, umwelt w)\\<close>\n        , of \\<open>welt\\<close> \\<open>besitz welt\\<close> _ \\<open>n\\<close> \\<open>p\\<close>])\n          apply(simp; fail)\n         apply(simp add: zahlenwps_def; fail)\n        apply(simp add: besitz_sel_update; fail)\n       apply(case_tac \\<open>w\\<close>, simp add: zahlenwelt.defs; fail)\n      apply(simp, force)\n     apply(simp add: stehlen_swap_None; fail)\n    apply(simp add: zahlenwelt.defs zahlenwps_def; fail)\n   apply(simp add: zahlenwps_id zahlenwps_sym; fail)\n  apply(simp add: zahlenwps_sym; fail)\n  done\n(* I case above proof fails, here is a version without wfh_generalize_worldI.\n(*This is mostly a copy of wohlgeformte_handlungsabsicht_stehlen and this sucks.*)\n  apply(case_tac \\<open>welt\\<close>, simp add: wohlgeformte_handlungsabsicht.simps Zahlenwelt.stehlen.simps)\n  apply(simp add: zahlenwps_def)\n  apply(simp add: opfer_eindeutig_nach_besitz_auswaehlen_swap_enumall)\n  apply(simp add: opfer_eindeutig_nach_besitz_auswaehlen_the_single_elem_enumall)\n  apply(simp add: the_single_elem)\n  apply(safe)\n   apply (simp add: zahlenwps_def swap_def Fun.swap_def konsensswap_sym; fail)\n  apply (simp add: zahlenwps_def swap_def Fun.swap_def konsensswap_sym fun_upd_twist)\n  done\n*)\n(*>*)\n\ntext\\<open>Ressourcen können nicht aus dem Nichts erschaffen werden.\nDiese Handlungsabsicht entnimmt der Natur und weist einer Person zu.\\<close>\nfun abbauen :: \\<open>nat \\<Rightarrow> person \\<Rightarrow> zahlenwelt \\<Rightarrow> zahlenwelt option\\<close> where\n  \\<open>abbauen i p welt = Some (welt\\<lparr> besitz := \\<lbrakk>(besitz welt)(p += int i)\\<rbrakk>, umwelt := (umwelt welt) - int i \\<rparr>)\\<close>\n\n(*<*)\nlemma wohlgeformte_handlungsabsicht_abbauen:\n  \\<open>wohlgeformte_handlungsabsicht zahlenwps welt (Handlungsabsicht (abbauen n))\\<close>\n  apply(case_tac \\<open>welt\\<close>, simp add: wohlgeformte_handlungsabsicht.simps)\n  apply(simp add: zahlenwps_def swap_def Fun.swap_def)\n  by (simp add: konsensswap_sym)\n(*>*)\n\n\ntext\\<open>Diese Handlungsabsicht weist allen Personen ein Besitz von 0 zu.\nDies vernichtet allen Besitz.\nPersonen mit Schulden (negativem Besitz) könnten jedoch profitieren.\\<close>\nfun reset :: \\<open>person \\<Rightarrow> zahlenwelt \\<Rightarrow> zahlenwelt option\\<close> where\n  \\<open>reset ich welt = Some (welt\\<lparr> besitz := \\<lambda> _. 0\\<rparr>)\\<close>\n\n(*<*)\nlemma wohlgeformte_handlungsabsicht_reset:\n  \\<open>wohlgeformte_handlungsabsicht zahlenwps welt (Handlungsabsicht reset)\\<close>\n  apply(simp add: wohlgeformte_handlungsabsicht.simps handeln_def nachher_handeln.simps)\n  apply(simp add: zahlenwps_def konsensswap_sym)\n  apply(simp add: swap_def fun_eq_iff)\n  done\n(*>*)\n\ntext\\<open>Die Handlungsabsicht die alles kaputt macht.\nDie Handlungsabsicht sucht sich den minimalen Besitz aller Personen und\nweist allen Personen Eins weniger zu.\nDamit haben alle Personen definitiv weniger als zuvor.\\<close>\nfun alles_kaputt_machen :: \\<open>person \\<Rightarrow> zahlenwelt \\<Rightarrow> zahlenwelt option\\<close> where\n  \\<open>alles_kaputt_machen ich welt = Some (welt\\<lparr> besitz := \\<lambda> _. Min ((besitz welt) ` UNIV) - 1 \\<rparr>)\\<close>\n\nlemma alles_kaputt_machen_code[code]:\n  \\<open>alles_kaputt_machen ich welt =\n   Some (welt\\<lparr> besitz := (\\<lambda>_. min_list (map (besitz welt) enum_class.enum) -1)\\<rparr>)\\<close>\n  apply(cases \\<open>welt\\<close>, simp add: alles_kaputt_machen_code_help)\n  done\n\n\n(*<*)\ndeclare alles_kaputt_machen.simps[simp del]\n\nlemma wohlgeformte_handlungsabsicht_alles_kaputt_machen:\n  \\<open>wohlgeformte_handlungsabsicht zahlenwps welt (Handlungsabsicht alles_kaputt_machen)\\<close>\n  apply(simp add: wohlgeformte_handlungsabsicht.simps)\n  apply(simp add: alles_kaputt_machen_code)\n  apply(simp add: zahlenwps_def konsensswap_sym)\n  apply(case_tac \\<open>welt\\<close>, simp add: fun_eq_iff)\n  apply(simp add: min_list_swap_int_enum)\n  by (simp add: swap_def)\n(*>*)\n\n\n\ntext\\<open>Die unmögliche Handlungsabsicht, welche immer scheitert.\\<close>\nfun unmoeglich :: \\<open>person \\<Rightarrow> zahlenwelt \\<Rightarrow> zahlenwelt option\\<close> where\n  \\<open>unmoeglich _ _ = None\\<close>\n\n\n\ntext\\<open>Die Beispielhandlungsabsichten, die wir betrachten wollen.\\<close>\ndefinition \\<open>handlungsabsichten \\<equiv> [\n  Handlungsabsicht (abbauen 5),\n  Handlungsabsicht (stehlen 3 10),\n  Handlungsabsicht existierende_abmachung_einloesen,\n  Handlungsabsicht reset,\n  Handlungsabsicht alles_kaputt_machen,\n  Handlungsabsicht unmoeglich\n]\\<close>\n\nlemma wfh_handlungsabsichten:\n  \\<open>ha \\<in> set handlungsabsichten \\<Longrightarrow> wohlgeformte_handlungsabsicht zahlenwps welt ha\\<close>\n  apply(simp add: handlungsabsichten_def)\n  apply(safe)\n       apply(simp add: wohlgeformte_handlungsabsicht_abbauen; fail)\n      apply(simp add: wohlgeformte_handlungsabsicht_stehlen; fail)\n     apply(simp add: wohlgeformte_handlungsabsicht_existierende_abmachung_einloesen; fail)\n    apply(simp add: wohlgeformte_handlungsabsicht_reset; fail)\n  apply(simp add: wohlgeformte_handlungsabsicht_alles_kaputt_machen; fail)\n  by (simp add: wohlgeformte_handlungsabsicht.simps)\n\n\n\n\nfun individueller_fortschritt :: \\<open>person \\<Rightarrow> zahlenwelt handlung \\<Rightarrow> bool\\<close> where\n  \\<open>individueller_fortschritt p (Handlung vor nach) \\<longleftrightarrow> (meins p vor) \\<le> (meins p nach)\\<close>\n\ndefinition maxime_altruistischer_fortschritt :: \\<open>(person, zahlenwelt) maxime\\<close> where\n  \\<open>maxime_altruistischer_fortschritt \\<equiv>\n      Maxime (\\<lambda>ich h. \\<forall>pX. individueller_fortschritt pX h)\\<close>\n\n(*existierende_abmachung_einloesen macht, dass die Maxime nicht erfuellt.*)\nbeispiel \\<open>erzeuge_beispiel\n  zahlenwps initialwelt\n  handlungsabsichten\n  maxime_altruistischer_fortschritt\n= Some\n  \\<lparr>\n   bsp_erfuellte_maxime = False,\n   bsp_erlaubte_handlungen = [\n      Handlungsabsicht (abbauen 5),\n      Handlungsabsicht unmoeglich],\n   bsp_verbotene_handlungen = [\n      Handlungsabsicht (stehlen 3 10),\n      Handlungsabsicht reset,\n      Handlungsabsicht alles_kaputt_machen],\n   bsp_uneindeutige_handlungen = [\n      Handlungsabsicht existierende_abmachung_einloesen]\n  \\<rparr>\\<close> by beispiel_tac\n\n\ndefinition maxime_hatte_konsens :: \\<open>(person, zahlenwelt) maxime\\<close> where\n  \\<open>maxime_hatte_konsens \\<equiv> Maxime (\\<lambda>ich h. einvernehmlich h)\\<close>\n\n\nbeispiel \\<open>\\<forall>h \\<in> set (alle_moeglichen_handlungen initialwelt (Handlungsabsicht existierende_abmachung_einloesen)).\n wohlgeformte_maxime_auf\n    h zahlenwps \n    maxime_hatte_konsens\\<close> by eval\n\nlemma \\<open>wohlgeformte_maxime zahlenwps maxime_hatte_konsens\\<close>\n  by(simp add: wohlgeformte_maxime_def wohlgeformte_maxime_auf_def\n               maxime_hatte_konsens_def einvernehmlich_swap)\n\nbeispiel \\<open>erzeuge_beispiel\n  zahlenwps initialwelt\n  [Handlungsabsicht existierende_abmachung_einloesen]\n  maxime_hatte_konsens\n= Some\n  \\<lparr>\n   bsp_erfuellte_maxime = True,\n   bsp_erlaubte_handlungen = [Handlungsabsicht existierende_abmachung_einloesen],\n   bsp_verbotene_handlungen = [],\n   bsp_uneindeutige_handlungen = []\\<rparr>\\<close>\n  by beispiel_tac\n\nbeispiel \\<open>erzeuge_beispiel\n  zahlenwps initialwelt\n  [Handlungsabsicht (abbauen 5),\n   Handlungsabsicht (stehlen 3 10),\n   Handlungsabsicht reset,\n   Handlungsabsicht alles_kaputt_machen,\n   Handlungsabsicht unmoeglich]\n  maxime_altruistischer_fortschritt\n= Some\n  \\<lparr>\n   bsp_erfuellte_maxime = True,\n   bsp_erlaubte_handlungen = [\n      Handlungsabsicht (abbauen 5),\n      Handlungsabsicht unmoeglich],\n   bsp_verbotene_handlungen = [\n      Handlungsabsicht (stehlen 3 10),\n      Handlungsabsicht reset,\n      Handlungsabsicht alles_kaputt_machen],\n   bsp_uneindeutige_handlungen = []\\<rparr>\\<close>\n  by beispiel_tac\n\n\nbeispiel \\<open>erzeuge_beispiel\n  zahlenwps initialwelt\n  handlungsabsichten\n  (MaximeDisj maxime_altruistischer_fortschritt maxime_hatte_konsens)\n= Some\n  \\<lparr>\n   bsp_erfuellte_maxime = True,\n   bsp_erlaubte_handlungen = [\n      Handlungsabsicht (abbauen 5),\n      Handlungsabsicht existierende_abmachung_einloesen,\n      Handlungsabsicht unmoeglich],\n   bsp_verbotene_handlungen = [\n      Handlungsabsicht (stehlen 3 10),\n      Handlungsabsicht reset,\n      Handlungsabsicht alles_kaputt_machen],\n   bsp_uneindeutige_handlungen = []\\<rparr>\\<close>\n  by beispiel_tac\n\n  \n\n\n\n\nlemma \\<open>maxime_und_handlungsabsicht_generalisieren zahlenwps welt\n     maxime_hatte_konsens (Handlungsabsicht existierende_abmachung_einloesen) p\\<close>\n  apply(simp add: maxime_und_handlungsabsicht_generalisieren_def maxime_hatte_konsens_def)\n  apply(clarsimp)\n  apply(simp add: einvernehmlich_existierende_abmachung_einloesen)\n  done\n  \nlemma mhg_katimp_maxime_hatte_konsens:\n  \\<open>\\<forall>p. maxime_und_handlungsabsicht_generalisieren zahlenwps welt maxime_hatte_konsens ha p \\<Longrightarrow>\n    wohlgeformte_handlungsabsicht zahlenwps welt ha \\<Longrightarrow>\n    kategorischer_imperativ_auf ha welt maxime_hatte_konsens\\<close>\n  apply(simp add: maxime_hatte_konsens_def)\n  apply(erule globale_maxime_katimp)\n      subgoal by(simp add: handeln_def einvernehmlich_noop ist_noop_def)\n     subgoal by(simp add: wpsm_kommutiert_handlung_raw einvernehmlich_swap_nachher_handeln) \n    subgoal using zahlenwps_sym by fastforce\n   subgoal by(simp add: zahlenwps_id)\n  by simp\n\n\nlemma wpsm_kommutiert_altruistischer_fortschritt:\n  \\<open>wpsm_kommutiert maxime_altruistischer_fortschritt zahlenwps welt\\<close>\n  apply(simp add: maxime_altruistischer_fortschritt_def wpsm_kommutiert_def handeln_def nachher_handeln.simps)\n  apply(safe)\n   apply(case_tac \\<open>pX = p1\\<close>)\n    apply(erule_tac x=\\<open>p2\\<close> in allE)\n    apply (simp add: swap_a swap_b zahlenwps_sym; fail)\n   apply(case_tac \\<open>pX = p2\\<close>)\n    apply(erule_tac x=\\<open>p1\\<close> in allE)\n    apply (simp add: swap_a swap_b zahlenwps_sym; fail)\n   apply(erule_tac x=\\<open>pX\\<close> in allE)\n   apply(simp add: besitz_zahlenwps_nothing zahlenwps_sym swap_nothing; fail)\n  by (metis swap_a swap_b swap_nothing zahlenwps_sym)\n\nlemma mhg_katimp_maxime_altruistischer_fortschritt:\n  \\<open>\\<forall>p. maxime_und_handlungsabsicht_generalisieren zahlenwps welt maxime_altruistischer_fortschritt ha p \\<Longrightarrow>\n    wohlgeformte_handlungsabsicht zahlenwps welt ha \\<Longrightarrow>\n    kategorischer_imperativ_auf ha welt maxime_altruistischer_fortschritt\\<close>\n  apply(simp add: maxime_altruistischer_fortschritt_def)\n  apply(erule globale_maxime_katimp)\n      subgoal by(simp add: handeln_def einvernehmlich_noop ist_noop_def)\n     subgoal using wpsm_kommutiert_altruistischer_fortschritt by(simp add: maxime_altruistischer_fortschritt_def) \n    subgoal using zahlenwps_sym by fastforce\n   subgoal by(simp add: zahlenwps_id)\n  by simp\n\ntext\\<open>Folgendes Theorem zeigt, dass das \\<^const>\\<open>MaximeDisj\\<close> Konstrukt in jeder Welt funktioniert.\\<close>\ntheorem\n  \\<open>ex_erfuellbare_instanz maxime_altruistischer_fortschritt welt ha \\<and>\n    (\\<forall>p. maxime_und_handlungsabsicht_generalisieren\n          zahlenwps welt maxime_altruistischer_fortschritt ha p)\n   \\<or>\n   ex_erfuellbare_instanz maxime_hatte_konsens welt ha \\<and>\n    (\\<forall>p. maxime_und_handlungsabsicht_generalisieren\n          zahlenwps welt maxime_hatte_konsens ha p) \\<Longrightarrow>\n    wohlgeformte_handlungsabsicht zahlenwps welt ha \\<Longrightarrow>\n    kategorischer_imperativ_auf ha welt\n      (MaximeDisj maxime_altruistischer_fortschritt maxime_hatte_konsens)\\<close>\n  apply(rule kategorischer_imperativ_auf_MaximeDisjI2)\n  apply(elim disjE)\n   using mhg_katimp_maxime_altruistischer_fortschritt apply simp\n  using mhg_katimp_maxime_hatte_konsens apply simp\n  done\n\ntext\\<open>Wir könnten zusätzlich noch eine Maxime einführen,\nwelche besagt, dass die Umwelt nicht zerstört werden darf.\\<close>\ndefinition maxime_keine_umweltzerstoerung :: \\<open>(person, zahlenwelt) maxime\\<close> where\n  \\<open>maxime_keine_umweltzerstoerung \\<equiv>\n      Maxime (\\<lambda>_ h. umwelt (vorher h) \\<le> umwelt (nachher h))\\<close>\n\ntext\\<open>Folgendes Beispiel ist wie die vorherigen Beispiel.\nZusätzlich fügen wir jedoch noch \\<^const>\\<open>maxime_keine_umweltzerstoerung\\<close> via \\<^const>\\<open>MaximeConj\\<close> hinzu.\\<close>\nbeispiel\\<open>erzeuge_beispiel\n  zahlenwps initialwelt\n  handlungsabsichten\n  (MaximeConj (MaximeDisj maxime_altruistischer_fortschritt maxime_hatte_konsens)\n              maxime_keine_umweltzerstoerung)\n= Some\n  \\<lparr>\n   bsp_erfuellte_maxime = True,\n   bsp_erlaubte_handlungen = [\n      Handlungsabsicht existierende_abmachung_einloesen,\n      Handlungsabsicht unmoeglich],\n   bsp_verbotene_handlungen = [\n      Handlungsabsicht (abbauen 5),\n      Handlungsabsicht (stehlen 3 10),\n      Handlungsabsicht reset,\n      Handlungsabsicht alles_kaputt_machen],\n   bsp_uneindeutige_handlungen = []\\<rparr>\\<close>\n  by beispiel_tac\ntext\\<open>Das Ergebnis ist fast wie in vorherigen Beispielen.\nAllerdings ist \\<^const>\\<open>abbauen\\<close> nun Teil der verbotenen Handlungsabsichten,\nda dabei Umwelt abgebaut wird.\\<close>\n\nend", "meta": {"author": "diekmann", "repo": "kant", "sha": "fd8cd77b199114d0a8f6b5ad5e0c63a2c4a88902", "save_path": "github-repos/isabelle/diekmann-kant", "path": "github-repos/isabelle/diekmann-kant/kant-fd8cd77b199114d0a8f6b5ad5e0c63a2c4a88902/Formal/BeispielZahlenwelt2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.6513548782017745, "lm_q1q2_score": 0.346005816693504}}
{"text": "(*  Title:      HOL/ex/Iff_Oracle.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Author:     Makarius\n*)\n\nsection \\<open>Example of Declaring an Oracle\\<close>\n\ntheory Iff_Oracle\nimports Main\nbegin\n\nsubsection \\<open>Oracle declaration\\<close>\n\ntext \\<open>\n  This oracle makes tautologies of the form @{prop \"P \\<longleftrightarrow> P \\<longleftrightarrow> P \\<longleftrightarrow> P\"}.\n  The length is specified by an integer, which is checked to be even\n  and positive.\n\\<close>\n\noracle iff_oracle = \\<open>\n  let\n    fun mk_iff 1 = Var ((\"P\", 0), @{typ bool})\n      | mk_iff n = HOLogic.mk_eq (Var ((\"P\", 0), @{typ bool}), mk_iff (n - 1));\n  in\n    fn (thy, n) =>\n      if n > 0 andalso n mod 2 = 0\n      then Thm.cterm_of thy (HOLogic.mk_Trueprop (mk_iff n))\n      else raise Fail (\"iff_oracle: \" ^ string_of_int n)\n  end\n\\<close>\n\n\nsubsection \\<open>Oracle as low-level rule\\<close>\n\nML \\<open>iff_oracle (@{theory}, 2)\\<close>\nML \\<open>iff_oracle (@{theory}, 10)\\<close>\n\nML \\<open>\n  Thm.peek_status (iff_oracle (@{theory}, 10));\n  @{assert} (#oracle it);\n\\<close>\n\ntext \\<open>These oracle calls had better fail.\\<close>\n\nML \\<open>\n  (iff_oracle (@{theory}, 5); error \"Bad oracle\")\n    handle Fail _ => writeln \"Oracle failed, as expected\"\n\\<close>\n\nML \\<open>\n  (iff_oracle (@{theory}, 1); error \"Bad oracle\")\n    handle Fail _ => writeln \"Oracle failed, as expected\"\n\\<close>\n\n\nsubsection \\<open>Oracle as proof method\\<close>\n\nmethod_setup iff =\n  \\<open>Scan.lift Parse.nat >> (fn n => fn ctxt =>\n    SIMPLE_METHOD\n      (HEADGOAL (rtac (iff_oracle (Proof_Context.theory_of ctxt, n)))\n        handle Fail _ => no_tac))\\<close>\n\n\nlemma \"A \\<longleftrightarrow> A\"\n  by (iff 2)\n\nlemma \"A \\<longleftrightarrow> A \\<longleftrightarrow> A \\<longleftrightarrow> A \\<longleftrightarrow> A \\<longleftrightarrow> A \\<longleftrightarrow> A \\<longleftrightarrow> A \\<longleftrightarrow> A \\<longleftrightarrow> A\"\n  by (iff 10)\n\nlemma \"A \\<longleftrightarrow> A \\<longleftrightarrow> A \\<longleftrightarrow> A \\<longleftrightarrow> A\"\n  apply (iff 5)?\n  oops\n\nlemma A\n  apply (iff 1)?\n  oops\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/ex/Iff_Oracle.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3460058095032025}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory Deterministic_AC\nimports\n  \"../invariant-abstract/$L4V_ARCH/ArchDetSchedSchedule_AI\"\nbegin\n\n(*This theory defines an abstract \"integrity\" property over\n  the extensible specification that the deterministic specification\n  is shown to preserve. Essentially it demonstrates that the only\n  elements altered in the cdt_list are the given parameters and\n  their descendants. *)\n\n(* Analagous to the Control edges that pas_refined imposes. *)\ndefinition all_children where\n\"all_children P m \\<equiv> (\\<forall>c p. m c = Some p \\<longrightarrow> P p \\<longrightarrow> P c)\"\n\nprimrec list_filter :: \"'a list \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'a list\" where\n  \"list_filter [] P = []\" |\n  \"list_filter (x # xs) P = (if (P x) then (list_filter xs P)\n                             else x # (list_filter xs P))\"\n\nabbreviation\n\"filtered_eq P list list' \\<equiv> list_filter list P = list_filter list' P\"\n\nlemma list_filter_distr[simp]: \"list_filter (list @ list') P = (list_filter list P) @ (list_filter list' P)\"\n  apply (induct list,simp+)\n  done\n\nlemma list_filter_empty[simp]: \"\\<forall>x \\<in> set list. P x \\<Longrightarrow> list_filter list P = []\"\n  apply (induct list,simp+)\n  done\n\nlemma list_filter_replace_list: \"\\<forall>x \\<in> set list'. P x \\<Longrightarrow> P a \\<Longrightarrow>\n filtered_eq P (list_replace_list list a list') list\"\n  apply (induct list,simp+)\n  done\n\nlemma list_filter_insert_after: \"P b \\<Longrightarrow> \n filtered_eq P (list_insert_after list a b) list\"\n  apply (induct list,simp+)\n  done\n\nlemma list_filter_swap: \"P b \\<Longrightarrow> P a \\<Longrightarrow>\n filtered_eq P (list_swap list a b) list\"\n  apply (induct list,(simp add: list_swap_def)+)\n  done\n\nlemma list_filter_replace: \"P b \\<Longrightarrow> P a \\<Longrightarrow>\n filtered_eq P (list_replace list a b) list\"\n  apply (induct list,(simp add: list_replace_def)+)\n  done\n\nlemma list_filter_remove: \"P a \\<Longrightarrow>\n filtered_eq P (list_remove list a) list\"\n  apply (induct list,simp+)\n  done\n\n\n(* Here P is meant to decide whether a cslot_ptr is part of the current\n   subject. Integrity is said to hold of two cdt_lists if either an\n   entry is part of the current subject, or their lists are equivalent\n   with all entries from the current subject removed. \n  \n   We use this to reason that changes to a non-subject entry are only allowed\n   if that entry's list contains a child that is part of the current subject.\n   It is stated in this way so that the property can be shown to be transitive.*)\n\ndefinition list_integ where\n\"list_integ P t t' \\<equiv>  \\<forall>x. P x \\<or> (filtered_eq P (cdt_list t x) (cdt_list t' x))\"\n\n\nlemma update_cdt_list_wp:\n  \"\\<lbrace>(\\<lambda>s. P (s\\<lparr>cdt_list := f (cdt_list s)\\<rparr>))\\<rbrace> update_cdt_list f \\<lbrace>\\<lambda>_.P\\<rbrace>\"\n  apply (simp add: update_cdt_list_def set_cdt_list_def)\n  apply wp\n  done\n\n\nlemma cap_move_list_integrity:\n  notes split_paired_All[simp del]\n  shows\n  \"\\<lbrace>list_integ P st and K(P src) and K(P dest)\\<rbrace> cap_move_ext src dest src_p dest_p \\<lbrace>\\<lambda>_. list_integ P st\\<rbrace>\"\n  apply (simp add: cap_move_ext_def split del: if_split)\n  apply (wp update_cdt_list_wp)\n  apply (intro impI conjI allI | simp add: list_filter_replace list_filter_remove split: option.splits | elim conjE | simp add: list_integ_def)+\n  done\n\nlemma cap_insert_list_integrity:\n  notes split_paired_All[simp del]\n  shows\n  \"\\<lbrace>list_integ P st and K(P src) and K(P dest)\\<rbrace> cap_insert_ext src_parent src dest src_p dest_p \\<lbrace>\\<lambda>_. list_integ P st\\<rbrace>\"\n  apply (simp add: cap_insert_ext_def split del: if_split)\n  apply (wp update_cdt_list_wp)\n  apply (intro impI conjI allI | simp add: list_filter_insert_after list_filter_remove split: option.splits | elim conjE | simp add: list_integ_def)+\n  done\n\nlemma create_cap_list_integrity:\n  notes split_paired_All[simp del]\n  shows\n  \"\\<lbrace>list_integ P st and K(P dest)\\<rbrace> create_cap_ext untyped dest dest_p \\<lbrace>\\<lambda>_. list_integ P st\\<rbrace>\"\n  apply (simp add: create_cap_ext_def split del: if_split)\n  apply (wp update_cdt_list_wp)\n  apply (intro impI conjI allI | simp add: list_filter_replace list_filter_remove split: option.splits | elim conjE | simp add: list_integ_def)+\n  done\n\n\nlemma empty_slot_list_integrity:\n  notes split_paired_All[simp del]\n  shows\n  \"\\<lbrace>list_integ P st and (\\<lambda>s. valid_list_2 (cdt_list s) m) and K(P slot) and K( all_children P m)\\<rbrace> empty_slot_ext slot slot_p \\<lbrace>\\<lambda>_. list_integ P st\\<rbrace>\"\n  apply (simp add: empty_slot_ext_def split del: if_split)\n  apply (wp update_cdt_list_wp)\n  apply (intro impI conjI allI | simp add: list_filter_replace_list list_filter_remove split: option.splits | elim conjE  | simp add: list_integ_def)+\n  apply (drule_tac x=\"the slot_p\" in spec)\n  apply (elim disjE)\n   apply (simp add: all_children_def valid_list_2_def list_filter_replace_list)+\n  done\n\n\nlemma cap_swap_list_integrity:\n  notes split_paired_All[simp del]\n  shows\n  \"\\<lbrace>list_integ P st and K(P slot1) and K(P slot2)\\<rbrace> cap_swap_ext slot1 slot2 slot1_p slot2_p \\<lbrace>\\<lambda>_. list_integ P st\\<rbrace>\"\n  apply (simp add: cap_swap_ext_def split del: if_split)\n  apply (wp update_cdt_list_wp)\n  apply (intro impI conjI allI | simp add: list_filter_replace list_filter_swap split: option.splits | elim conjE | simp add: list_integ_def)+ (* slow *)\n  done\n\nlemma null_filter: \"\\<forall>x \\<in> set list. \\<not> P x \\<Longrightarrow> list_filter list P = list\"\n  apply (induct list,simp+)\n  done\n\nlemma neq_filtered_ex: \"list \\<noteq> list' \\<Longrightarrow> filtered_eq P list list' \\<Longrightarrow> \\<exists>x \\<in> set list \\<union> set list'. P x\"\n  apply (rule ccontr)\n  apply (simp add: null_filter)\n  done\n\nlemma weaken_filter: \"(\\<forall>s. P s \\<longrightarrow> T s) \\<Longrightarrow> filtered_eq T (list_filter list P) list\"\n  apply (induct list,simp+)\n  done\n\nlemma weaken_filter_eq: \"(\\<forall>s. P s \\<longrightarrow> T s) \\<Longrightarrow> filtered_eq P list list' \\<Longrightarrow> filtered_eq T list list'\"\n  apply (subst weaken_filter[symmetric],assumption)\n  apply (simp add: weaken_filter)\n  done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/access-control/Deterministic_AC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6513548511303336, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.34600580231290085}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory signed_div\nimports \"../CTranslation\"\nbegin\n\ninstall_C_file \"signed_div.c\"\n\ncontext signed_div\nbegin\n\nlemma f_result:\n  \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== CALL f(5, -1) \\<lbrace> \\<acute>ret__int = -5 \\<rbrace>\"\n  apply vcg\n  apply (clarsimp simp: sdiv_word_def sdiv_int_def)\n  done\n\nlemma word_not_minus_one [simp]:\n  \"0 \\<noteq> (-1 :: word32)\"\n  by (metis word_msb_0 word_msb_n1)\n\nlemma f_overflow:\n  shows \"\\<lbrakk> a_' s = of_int (-2^31); b_' s = -1 \\<rbrakk> \\<Longrightarrow> \\<Gamma> \\<turnstile> \\<langle> Call f_'proc ,Normal s\\<rangle> \\<Rightarrow> Fault SignedArithmetic\"\n  apply (rule exec.Call [where \\<Gamma>=\\<Gamma>, OF f_impl, simplified f_body_def creturn_def])\n  apply (rule exec.CatchMiss)\n  apply (subst exec.simps, clarsimp simp del: word_neq_0_conv simp: sdiv_word_def sdiv_int_def)+\n  apply simp\n  done\n\nlemma g_result:\n  \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== CALL g(-5, 10) \\<lbrace> \\<acute>ret__int = -5 \\<rbrace>\"\n  apply vcg\n  apply (clarsimp simp: smod_word_def smod_int_def sdiv_int_def)\n  done\n\nlemma h_result:\n  \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== CALL h(5, -1) \\<lbrace> \\<acute>ret__int = 0 \\<rbrace>\"\n  apply vcg\n  apply (simp add: word_div_def uint_word_ariths)\n  done\n\nlemma i_result:\n  \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== CALL f(5, -1) \\<lbrace> \\<acute>ret__int = -5 \\<rbrace>\"\n  apply vcg\n  apply (clarsimp simp: sdiv_word_def sdiv_int_def)\n  done\n\nend\n\nend\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/testfiles/signed_div.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370308082623217, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.34582063605531865}}
{"text": "theory Lift_Triv\n  imports \"../Lifter\"\n\nbegin\n\n(*\n * triv\n *)\n(* we are revisiting this because automation seems to be having\n * problems with triv in the presence of certain kinds of polymorphism.\n * i wonder if we need an explicit type paramete?\n *)\ndefinition triv_l ::\n  \"('x, 'a :: Bogus, 'a md_triv) lifting\" where\n\"triv_l =\n  LMake (\\<lambda> s a _ . mdt a) (\\<lambda> s b . (case b of (mdt b') \\<Rightarrow> b')) (\\<lambda> s . mdt bogus)\"\n\nlocale triv_l_valid_weak =\n  fixes T :: \"('a :: Bogus) itself\"\n\nsublocale triv_l_valid_weak \\<subseteq>\n  out : lifting_valid_weak \"triv_l :: ('b, 'a, 'a md_triv) lifting\" \"(\\<lambda> _ . UNIV)\"\nproof\n  fix s :: 'b\n  fix a :: \"'a :: Bogus\"\n  fix b :: \"'a md_triv\"\n  show \"LOut (triv_l) s (LUpd (triv_l) s a b) = a\"\n    by(auto simp add:triv_l_def split:md_triv.splits)\nnext\n  fix s :: 'b\n  fix b :: \"'a md_triv\"\n\n  show \"b <[ LUpd triv_l s (LOut triv_l s b) b\"\n   by(auto simp add:triv_l_def triv_pleq\n          split:md_triv.splits)\nnext\n  fix s :: 'b\n  fix a :: \"'a\"\n  fix b :: \"'a md_triv\"\n  show \"LUpd triv_l s a b \\<in> UNIV\" by auto\nqed\n\nlemma (in triv_l_valid_weak) ax :\n  shows \"lifting_valid_weak (triv_l :: ('b, 'a, 'a md_triv) lifting) (\\<lambda> _ :: 'b . UNIV)\"\n  using out.lifting_valid_weak_axioms\n  by auto\n\nlemma (in triv_l_valid_weak) ax_g :\n  assumes \"S' = (\\<lambda> _ . UNIV)\"\n  shows \"lifting_valid_weak (triv_l :: ('b, 'a, 'a md_triv) lifting) S'\"\n  using out.lifting_valid_weak_axioms assms\n  by auto\n\nlocale triv_l_valid_ok_ext =\n  fixes T :: \"('a :: Bogus) itself\"\n\nsublocale triv_l_valid_ok_ext \\<subseteq>\n  out : lifting_valid_ok_ext \"(triv_l :: ('b, 'a, 'a md_triv) lifting)\" \"(\\<lambda> _ :: 'b . UNIV)\"\nproof\n  show \"\\<And> S . ok_S \\<subseteq> UNIV\" by auto\nnext\n  fix s :: 'b\n  fix a :: 'a\n  fix b :: \"'a md_triv\"\n  show \"b \\<in> ok_S \\<Longrightarrow> LUpd triv_l s a b \\<in> ok_S\"\n    by(auto simp add: triv_l_def triv_ok_S)\nqed\n\nlemma (in triv_l_valid_ok_ext) ax :\n  shows \"lifting_valid_ok_ext (triv_l :: ('b, 'a, 'a md_triv) lifting) (\\<lambda> _ :: 'b . UNIV)\"\n  using out.lifting_valid_ok_ext_axioms\n  by auto\n\nlemma (in triv_l_valid_ok_ext) ax_g :\n  assumes \"S' = (\\<lambda> _ . UNIV)\"\n  shows \"lifting_valid_ok_ext (triv_l :: ('b, 'a, 'a md_triv) lifting) S'\"\n  using assms out.lifting_valid_ok_ext_axioms\n  by auto\n\nlocale triv_l_valid_pres_ext =\n  fixes T :: \"('a :: Bogus) itself\"\n\nsublocale triv_l_valid_pres_ext \\<subseteq>\n  out : lifting_valid_pres_ext \"(triv_l :: ('b, 'a, 'a md_triv) lifting)\" \"\\<lambda> (_ :: 'b) . UNIV\"\n\nproof\n  fix v :: \"'a md_triv\"\n  fix V :: \"'a md_triv set\"\n  fix supr :: \"'a md_triv\"\n  fix s :: 'b\n  fix f\n\n  assume Nemp : \"v \\<in> V\"\n  assume H : \"is_sup V supr\"\n\n  show \"is_sup (LMap triv_l f s ` V) (LMap triv_l f s supr)\"\n  proof(rule is_supI)\n    fix x\n\n    assume \"x \\<in> LMap triv_l f s ` V\"\n\n    then obtain x0 where X0 : \"x0 \\<in> V\" \"LMap triv_l f s x0 = x\"\n      by(auto)\n\n    obtain x0' where X0' : \"x0 = mdt x0'\"\n      by(cases x0; auto)\n\n    obtain supr' where Supr' : \"supr = mdt supr'\"\n      by(cases supr; auto)\n\n    have Eq : \"x0' = supr'\"\n      using is_supD1[OF H X0(1)] X0' Supr'\n      by(auto simp add: triv_pleq)\n\n    show \"x <[ LMap triv_l f s supr\"\n      using X0' X0 Eq Supr'\n      by(auto simp add: triv_pleq)\n  next\n    fix y\n    assume Ub : \"is_ub (LMap triv_l f s ` V) y\"\n\n    obtain y' where Y' : \"y = mdt y'\" by(cases y; auto)\n\n    obtain v' where V' : \"v = mdt v'\" by(cases v; auto)\n\n    have Eq1 : \"y = LMap triv_l f s v\"\n      using is_ubE[OF Ub, of \"LMap triv_l f s v\"] Nemp\n      by(auto simp add: triv_pleq)\n\n    have  \"supr = v\"\n      using is_supD1[OF H Nemp] by(auto simp add: triv_pleq)\n\n    hence Eq2 : \"LMap triv_l f s supr = LMap triv_l f s v\" by simp\n\n    show \"LMap triv_l f s supr <[ y\"\n      using Eq1 Eq2\n      by(simp add: triv_pleq)\n  qed\nqed\n\nlemma (in triv_l_valid_pres_ext) ax :\n  shows \"lifting_valid_pres_ext (triv_l :: ('b, 'a, 'a md_triv) lifting) (\\<lambda> _ . UNIV)\"\n  using out.lifting_valid_pres_ext_axioms\n  by auto\n\nlemma (in triv_l_valid_pres_ext) ax_g :\n  assumes \"S' = (\\<lambda> _ . UNIV)\"\n  shows \"lifting_valid_pres_ext (triv_l :: ('b, 'a, 'a md_triv) lifting) S'\"\n  using assms out.lifting_valid_pres_ext_axioms\n  by auto\n\nlocale triv_l_valid_pairwise_ext =\n  fixes T :: \"'a itself\"\n\nsublocale triv_l_valid_pairwise_ext \\<subseteq>\n  out : lifting_valid_pairwise_ext \"\\<lambda> (_ :: 'b) . (UNIV :: 'a md_triv set)\"\nproof\n  fix x1 x2 x3 s12 s23 s13 s123 :: \"'a md_triv\"\n\n  show \"s123 \\<in> UNIV\"\n    by auto\nqed\n\nlemma (in triv_l_valid_pairwise_ext) ax :\n  shows \"lifting_valid_pairwise_ext (\\<lambda> (_ :: 'b) . (UNIV :: 'a md_triv set))\"\n  using out.lifting_valid_pairwise_ext_axioms\n  by auto\n\nlemma (in triv_l_valid_pairwise_ext) ax_g :\n  assumes \"S' = (\\<lambda> (_ :: 'b) . (UNIV :: 'a md_triv set))\"\n  shows \"lifting_valid_pairwise_ext S'\"\n  using assms out.lifting_valid_pairwise_ext_axioms\n  by auto\n\nlocale triv_l_valid_oc_ext =\n  fixes T :: \"('a :: Bogus) itself\"\n\nsublocale triv_l_valid_oc_ext \\<subseteq>\n  out: lifting_valid_oc_ext \"(triv_l :: ('b, 'a, 'a md_triv) lifting)\" \"\\<lambda> (_ :: 'b) . (UNIV :: 'a md_triv set)\"\nproof\n  fix x2 Xs \n  fix supr :: \"'a md_triv\" \n  fix s :: 'b\n  fix r :: 'a\n  fix w :: \"'a md_triv\"\n  assume W: \"w \\<in> Xs\"\n  assume Supr : \"is_sup Xs supr\"\n  assume Compat :\n    \"(\\<And>x. x \\<in> Xs \\<Longrightarrow>\n             LOut triv_l s x = r)\"\n\n  have Supr_W : \"supr = w\"\n    using is_supD1[OF Supr W]\n    by(auto simp add: triv_pleq)\n\n  hence \"w = mdt r\"\n    using Compat[OF W]\n    by(cases w; auto simp add: triv_pleq triv_l_def)\n\n  then show \"LOut triv_l s supr = r\"\n    using Supr_W\n    by(auto simp add: triv_l_def)\nqed\n\nlemma (in triv_l_valid_oc_ext) ax :\n  shows \"lifting_valid_oc_ext (triv_l :: ('b, 'a, 'a md_triv) lifting)\"\n  using out.lifting_valid_oc_ext_axioms\n  by auto\n\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Lifter/Instances/Lift_Triv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.34582062857361023}}
{"text": "theory Example \nimports HNR_While\nbegin\n\n\nlemma assumes    \"a = (\\<lambda>s. SPECT [s-1\\<mapsto>1])\" \n    shows ex4_ref: \"(whileT (\\<lambda>s. s>0) (\\<lambda>s. RETURNT (s-1)) (S::nat)) \\<le> (whileT (\\<lambda>s. s>0) a (S::nat))\"\n  apply(rule whileT_mono)\n  unfolding assms \n  by (simp add: RETURNT_def le_fun_def)\n\nlemma k: \"(emp \\<Longrightarrow>\\<^sub>A \\<up> (s = S) * true) \\<longleftrightarrow> s=S\" \n  apply rule\n  apply (smt assn_ext entailsD' entailsI mod_false' mult.left_neutral pure_assn_eq_conv)   \n  using assn_times_comm entails_pure_post entails_true by fastforce\nlemma k2: \"(emp \\<Longrightarrow>\\<^sub>A \\<up> (s = S) ) \\<longleftrightarrow> s=S\" \n  apply rule\n  apply (smt assn_ext entailsD' entailsI mod_false' mult.left_neutral pure_assn_eq_conv)   \n  using entails_pure' entails_triv by blast \n\nlemma extr: \"pHeap h as n \\<Turnstile> \\<up>B = (pHeap h as n \\<Turnstile> emp \\<and> B)\"\n  using one_assn_rule pure_assn_rule by auto  \n \nlemma R: \"((s,s') \\<in> Rs \\<Longrightarrow> hn_refine (emp) (c s) (G s' s) R (a s'))\n    \\<Longrightarrow> hn_refine (hn_ctxt (pure Rs) s' s) (c s) (G s' s) R (a s')\"\n  unfolding hn_refine_def by (auto simp: hn_ctxt_def pure_def extr)\n\n\nthm hnr_uRETURN_pass\n\nlemma moneq: \"(\\<lambda>s. RETURNT (0 < s)) = (\\<lambda>s. RETURNT 0 \\<bind> (%c. RETURNT (c < s)))\"\n  by (auto intro!: pw_eqI)\n\nlemma moneq_min: \"(\\<lambda>s. RETURNT (s - 1)) = (\\<lambda>s. RETURNT 1 \\<bind> (%c. RETURNT (s - c)))\"\n  by (auto intro!: pw_eqI)\n\nlemma x0: \"RETURNT x \\<le> RETURNT 0 \\<longleftrightarrow> x=0\"\n  by (auto simp: RETURNT_def le_fun_def split: if_splits)  \n\n\n\nlemma zuf: \"\\<up> True * true =  true\"  \n  by (simp add: abel_semigroup.commute assn_ext mult.abel_semigroup_axioms)  \n\nlemma hn_refine_less: \" hn_refine (hn_val nat_rel s' s * hn_val nat_rel x' x)\n           (ureturn (x < s))\n       (hn_val nat_rel s' s * hn_val nat_rel x' x)\n       (pure bool_rel) (RETURNT (x' < s'))\"\n  unfolding hn_refine_def apply (auto simp: zuf mult.assoc  execute_ureturn pure_def hn_ctxt_def)\n   apply(rule exI[where x=0]) apply (auto simp: zero_enat_def relH_def )      \n    using models_in_range top_assn_rule by blast \n\n\nlemma hn_refine_minus: \" hn_refine (hn_val nat_rel s' s * hn_val nat_rel x' x)\n           (ureturn (x - s))\n       (hn_val nat_rel s' s * hn_val nat_rel x' x)\n       (pure nat_rel) (RETURNT (x' - s'))\"\n  unfolding hn_refine_def apply (auto simp: zuf mult.assoc  execute_ureturn pure_def hn_ctxt_def)\n   apply(rule exI[where x=0]) apply (auto simp: zero_enat_def relH_def )      \n    using models_in_range top_assn_rule by blast \n\n\nschematic_goal first:\n  assumes \"a = (whileT (\\<lambda>s. s>0) (\\<lambda>s. RETURNT (s-1)) (S::nat))\"\n  shows \"hn_refine emp ?c ?\\<Gamma> (pure Id) a\"\n  unfolding assms \n  apply(subst whileT_I')\n  apply(subst WHILEIT_to_monadic) apply(subst moneq)  apply(subst moneq_min)\n  apply(rule hn_monadic_WHILE_aux[where \\<Gamma>=\"emp\"])\n      apply (simp add: hn_ctxt_def pure_def k entailst_def ) \n  \n     apply (simp del: nres_bind_left_identity)\n     apply(rule hnr_bind)  \n       apply(rule hnr_frame[OF hnr_uRETURN_pure[where R=nat_rel]])\n        apply simp\n       apply (simp add: ) apply(rule entt_refl)\n      apply (simp  )  \n      apply(rule hn_refine_less)\n  apply(simp add: mult.assoc)\n  apply(rule match_first) \n     apply(rule match_rest) apply (simp)\n\n  apply(simp add: entailst_def)\n    apply(rule match_rest) apply (simp)\n\n   apply (simp del: nres_bind_left_identity)\n     apply(rule hnr_bind)  \n     apply(rule hnr_frame[OF hnr_uRETURN_pure[where R=nat_rel]])    \n        apply simp\n       apply (simp add: ) apply(rule entt_refl)\n      apply (simp  )  \n     apply(rule hn_refine_cons_pre[OF _ hn_refine_minus])\n  apply(simp add: entailst_def)\n    apply rotatel apply(rule match_first)   apply(rule match_rest) apply simp\n   apply rotatel apply(rule match_first) apply (rule match_rest) apply simp\n  \n  apply (simp add: hn_ctxt_def pure_def k)  \n  by (simp add: ent_imp_entt)  \n\nthm first extract_cost_ub hnr_refine\n\n\nlemma entails_ex': \"((\\<exists>\\<^sub>Ax. P x) \\<Longrightarrow>\\<^sub>A Q) \\<longleftrightarrow> (\\<forall>x. (P x \\<Longrightarrow>\\<^sub>A Q))\"\n  using entails_ex by blast\n\nthm ex4_ref ex4'\nlemma \"S \\<le> n \\<Longrightarrow> <$ n> (heap_WHILET (\\<lambda>s. ureturn 0 \\<bind> (\\<lambda>x'. ureturn (x' < s))) (\\<lambda>s. ureturn (Suc 0) \\<bind> (\\<lambda>x'. ureturn (s - x'))) S) <\\<lambda>r. \\<up> (r = 0)>\\<^sub>t\"\nproof -\n  assume as: \"S \\<le> n\"\n  from ex4_ref have \"whileT (op < 0) (\\<lambda>s. RETURNT (s - 1)) S \\<le> whileT (op < 0) (\\<lambda>s. SPECT [s - 1 \\<mapsto> 1]) S\" by auto\n  also from as ex4' have \"\\<dots> \\<le> SPECT (\\<lambda>s. if s = 0 then Some (enat n) else None) \" by simp\n  finally have spec: \"whileT (op < 0) (\\<lambda>s. RETURNT (s - 1)) S \\<le> SPECT (\\<lambda>s. if s = 0 then Some (enat n) else None)\" .\n\n  let ?P= \"(heap_WHILET (\\<lambda>s. ureturn 0 \\<bind> (\\<lambda>x'. ureturn (x' < s))) (\\<lambda>s. ureturn (Suc 0) \\<bind> (\\<lambda>x'. ureturn (s - x'))) S)\"\n  from hnr_refine[OF spec first] have \"hn_refine emp ?P (emp * hn_invalid (pure nat_rel) S S) (pure nat_rel)\n   (SPECT (\\<lambda>s. if s = 0 then Some (enat n) else None))\" by auto\n\n  from extract_cost_ub[OF this, where Cost_ub=n] have \"< $ n> ?P <\\<lambda>r. emp * hn_invalid (pure nat_rel) S S * (\\<exists>\\<^sub>Ara. pure nat_rel ra r * \\<up> (ra \\<in> dom (\\<lambda>s. if s = 0 then Some (enat n) else None)))>\\<^sub>t\"\n    by simp\n  then show \"<$ n> ?P <\\<lambda>r. \\<up> (r = 0)>\\<^sub>t\"\n      apply(rule post_rule)\n    apply (simp add: pure_def hn_ctxt_def invalid_assn_def)\n       apply (auto simp: )\n    apply rotatel apply rotatel apply(simp add: ex_distrib_star[symmetric] entails_ex'  )\n    apply auto  \n    by (smt SepAuto.mod_pure_star_dist abel_semigroup.commute entails_def entails_true mult.abel_semigroup_axioms pure_conj)\nqed\n  \n\n\nthm hnr_refine[OF _ first]\n\n\nend", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3458206285736102}}
{"text": "(*  Title:      Jinja/J/Conform.thy\n\n    Author:     David von Oheimb, Tobias Nipkow\n    Copyright   1999 Technische Universitaet Muenchen\n*)\n\nsection \\<open>Conformance Relations for Type Soundness Proofs\\<close>\n\ntheory Conform\nimports Exceptions\nbegin\n\ndefinition conf :: \"'m prog \\<Rightarrow> heap \\<Rightarrow> val \\<Rightarrow> ty \\<Rightarrow> bool\"   (\"_,_ \\<turnstile> _ :\\<le> _\"  [51,51,51,51] 50)\nwhere\n  \"P,h \\<turnstile> v :\\<le> T  \\<equiv>\n  \\<exists>T'. typeof\\<^bsub>h\\<^esub> v = Some T' \\<and> P \\<turnstile> T' \\<le> T\"\n\ndefinition oconf :: \"'m prog \\<Rightarrow> heap \\<Rightarrow> obj \\<Rightarrow> bool\"   (\"_,_ \\<turnstile> _ \\<surd>\" [51,51,51] 50)\nwhere\n  \"P,h \\<turnstile> obj \\<surd>  \\<equiv>\n  let (C,fs) = obj in \\<forall>F D T. P \\<turnstile> C has F:T in D \\<longrightarrow>\n  (\\<exists>v. fs(F,D) = Some v \\<and> P,h \\<turnstile> v :\\<le> T)\"\n\ndefinition hconf :: \"'m prog \\<Rightarrow> heap \\<Rightarrow> bool\"  (\"_ \\<turnstile> _ \\<surd>\" [51,51] 50)\nwhere\n  \"P \\<turnstile> h \\<surd>  \\<equiv>\n  (\\<forall>a obj. h a = Some obj \\<longrightarrow> P,h \\<turnstile> obj \\<surd>) \\<and> preallocated h\"\n\ndefinition lconf :: \"'m prog \\<Rightarrow> heap \\<Rightarrow> (vname \\<rightharpoonup> val) \\<Rightarrow> (vname \\<rightharpoonup> ty) \\<Rightarrow> bool\"   (\"_,_ \\<turnstile> _ '(:\\<le>') _\" [51,51,51,51] 50)\nwhere\n  \"P,h \\<turnstile> l (:\\<le>) E  \\<equiv>\n  \\<forall>V v. l V = Some v \\<longrightarrow> (\\<exists>T. E V = Some T \\<and> P,h \\<turnstile> v :\\<le> T)\"\n\nabbreviation\n  confs :: \"'m prog \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> ty list \\<Rightarrow> bool\" \n             (\"_,_ \\<turnstile> _ [:\\<le>] _\" [51,51,51,51] 50) where\n  \"P,h \\<turnstile> vs [:\\<le>] Ts \\<equiv> list_all2 (conf P h) vs Ts\"\n\n\nsubsection\\<open>Value conformance \\<open>:\\<le>\\<close>\\<close>\n\nlemma conf_Null [simp]: \"P,h \\<turnstile> Null :\\<le> T  =  P \\<turnstile> NT \\<le> T\"\n(*<*)\napply (unfold conf_def)\napply (simp (no_asm))\ndone\n(*>*)\n\nlemma typeof_conf[simp]: \"typeof\\<^bsub>h\\<^esub> v = Some T \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T\"\n(*<*)\napply (unfold conf_def)\napply (induct v)\napply auto\ndone\n(*>*)\n\nlemma typeof_lit_conf[simp]: \"typeof v = Some T \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T\"\n(*<*)by (rule typeof_conf[OF typeof_lit_typeof])(*>*)\n\nlemma defval_conf[simp]: \"P,h \\<turnstile> default_val T :\\<le> T\"\n(*<*)\napply (unfold conf_def)\napply (cases T)\napply auto\ndone\n(*>*)\n\nlemma conf_upd_obj: \"h a = Some(C,fs) \\<Longrightarrow> (P,h(a\\<mapsto>(C,fs')) \\<turnstile> x :\\<le> T) = (P,h \\<turnstile> x :\\<le> T)\"\n(*<*)\napply (unfold conf_def)\napply (rule val.induct)\napply (auto simp:fun_upd_apply)\ndone\n(*>*)\n\nlemma conf_widen: \"P,h \\<turnstile> v :\\<le> T \\<Longrightarrow> P \\<turnstile> T \\<le> T' \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T'\"\n(*<*)\napply (unfold conf_def)\napply (induct v)\napply (auto intro: widen_trans)\ndone\n(*>*)\n\nlemma conf_hext: \"h \\<unlhd> h' \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T \\<Longrightarrow> P,h' \\<turnstile> v :\\<le> T\"\n(*<*)\napply (unfold conf_def)\napply (induct v)\napply (auto dest: hext_objD)\ndone\n(*>*)\n\nlemma conf_ClassD: \"P,h \\<turnstile> v :\\<le> Class C \\<Longrightarrow>\n  v = Null \\<or> (\\<exists>a obj T. v = Addr a \\<and>  h a = Some obj \\<and> obj_ty obj = T \\<and>  P \\<turnstile> T \\<le> Class C)\"\n(*<*)\napply (unfold conf_def)\napply(induct \"v\")\napply(auto)\ndone\n(*>*)\n\nlemma conf_NT [iff]: \"P,h \\<turnstile> v :\\<le> NT = (v = Null)\"\n(*<*)by (auto simp add: conf_def)(*>*)\n\nlemma non_npD: \"\\<lbrakk> v \\<noteq> Null; P,h \\<turnstile> v :\\<le> Class C \\<rbrakk>\n  \\<Longrightarrow> \\<exists>a C' fs. v = Addr a \\<and> h a = Some(C',fs) \\<and> P \\<turnstile> C' \\<preceq>\\<^sup>* C\"\n(*<*)\napply (drule conf_ClassD)\napply auto\ndone\n(*>*)\n\n\nsubsection\\<open>Value list conformance \\<open>[:\\<le>]\\<close>\\<close>\n\nlemma confs_widens [trans]: \"\\<lbrakk>P,h \\<turnstile> vs [:\\<le>] Ts; P \\<turnstile> Ts [\\<le>] Ts'\\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> vs [:\\<le>] Ts'\"\n(*<*)\n  apply (rule list_all2_trans)\n    apply (rule conf_widen, assumption, assumption)\n   apply assumption\n  apply assumption\n  done\n(*>*)\n\nlemma confs_rev: \"P,h \\<turnstile> rev s [:\\<le>] t = (P,h \\<turnstile> s [:\\<le>] rev t)\"\n(*<*)\n  apply rule\n  apply (rule subst [OF list_all2_rev])\n  apply simp\n  apply (rule subst [OF list_all2_rev])\n  apply simp\n  done\n(*>*)\n\nlemma confs_conv_map:\n  \"\\<And>Ts'. P,h \\<turnstile> vs [:\\<le>] Ts' = (\\<exists>Ts. map typeof\\<^bsub>h\\<^esub> vs = map Some Ts \\<and> P \\<turnstile> Ts [\\<le>] Ts')\"\n(*<*)\napply(induct vs)\n apply simp\napply(case_tac Ts')\napply(auto simp add:conf_def)\ndone\n(*>*)\n\nlemma confs_hext: \"P,h \\<turnstile> vs [:\\<le>] Ts \\<Longrightarrow> h \\<unlhd> h' \\<Longrightarrow> P,h' \\<turnstile> vs [:\\<le>] Ts\"\n(*<*)by (erule list_all2_mono, erule conf_hext, assumption)(*>*)\n\nlemma confs_Cons2: \"P,h \\<turnstile> xs [:\\<le>] y#ys = (\\<exists>z zs. xs = z#zs \\<and> P,h \\<turnstile> z :\\<le> y \\<and> P,h \\<turnstile> zs [:\\<le>] ys)\"\n(*<*)by (rule list_all2_Cons2)(*>*)\n\n\nsubsection \"Object conformance\"\n\nlemma oconf_hext: \"P,h \\<turnstile> obj \\<surd> \\<Longrightarrow> h \\<unlhd> h' \\<Longrightarrow> P,h' \\<turnstile> obj \\<surd>\"\n(*<*)\napply (unfold oconf_def)\napply (fastforce elim:conf_hext)\ndone\n(*>*)\n\nlemma oconf_init_fields:\n \"P \\<turnstile> C has_fields FDTs \\<Longrightarrow> P,h \\<turnstile> (C, init_fields FDTs) \\<surd>\"\nby(fastforce simp add: has_field_def oconf_def init_fields_def map_of_map\n            dest: has_fields_fun)\n\nlemma oconf_fupd [intro?]:\n  \"\\<lbrakk> P \\<turnstile> C has F:T in D; P,h \\<turnstile> v :\\<le> T; P,h \\<turnstile> (C,fs) \\<surd> \\<rbrakk> \n  \\<Longrightarrow> P,h \\<turnstile> (C, fs((F,D)\\<mapsto>v)) \\<surd>\"\n(*<*)\n  apply (unfold oconf_def has_field_def)\n  apply clarsimp\n  apply (drule (1) has_fields_fun)\n  apply (auto simp add: fun_upd_apply)\n  done                                    \n(*>*)\n\n(*<*)\nlemmas oconf_new = oconf_hext [OF _ hext_new]\nlemmas oconf_upd_obj = oconf_hext [OF _ hext_upd_obj]\n(*>*)\n\nsubsection \"Heap conformance\"\n\nlemma hconfD: \"\\<lbrakk> P \\<turnstile> h \\<surd>; h a = Some obj \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> obj \\<surd>\"\n(*<*)\napply (unfold hconf_def)\napply (fast)\ndone\n(*>*)\n\nlemma hconf_new: \"\\<lbrakk> P \\<turnstile> h \\<surd>; h a = None; P,h \\<turnstile> obj \\<surd> \\<rbrakk> \\<Longrightarrow> P \\<turnstile> h(a\\<mapsto>obj) \\<surd>\"\n(*<*)by (unfold hconf_def) (auto intro: oconf_new preallocated_new)(*>*)\n\nlemma hconf_upd_obj: \"\\<lbrakk> P \\<turnstile> h\\<surd>; h a = Some(C,fs); P,h \\<turnstile> (C,fs')\\<surd> \\<rbrakk> \\<Longrightarrow> P \\<turnstile> h(a\\<mapsto>(C,fs'))\\<surd>\"\n(*<*)by (unfold hconf_def) (auto intro: oconf_upd_obj preallocated_upd_obj)(*>*)\n\n\nsubsection \"Local variable conformance\"\n\nlemma lconf_hext: \"\\<lbrakk> P,h \\<turnstile> l (:\\<le>) E; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> l (:\\<le>) E\"\n(*<*)\napply (unfold lconf_def)\napply  (fast elim: conf_hext)\ndone\n(*>*)\n\nlemma lconf_upd:\n  \"\\<lbrakk> P,h \\<turnstile> l (:\\<le>) E; P,h \\<turnstile> v :\\<le> T; E V = Some T \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> l(V\\<mapsto>v) (:\\<le>) E\"\n(*<*)\napply (unfold lconf_def)\napply auto\ndone\n(*>*)\n\nlemma lconf_empty[iff]: \"P,h \\<turnstile> Map.empty (:\\<le>) E\"\n(*<*)by(simp add:lconf_def)(*>*)\n\nlemma lconf_upd2: \"\\<lbrakk>P,h \\<turnstile> l (:\\<le>) E; P,h \\<turnstile> v :\\<le> T\\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> l(V\\<mapsto>v) (:\\<le>) E(V\\<mapsto>T)\"\n(*<*)by(simp add:lconf_def)(*>*)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/Common/Conform.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3458206285736102}}
{"text": "section {*I\\_epda\\_H*}\ntheory\n  I_epda_H\n\nimports\n  I_epda_base\n\nbegin\n\nrecord ('state, 'event, 'stack) epdaH_conf =\n  epdaH_conf_state :: \"'state\"\n  epdaH_conf_history :: \"'event list\"\n  epdaH_conf_stack :: \"'stack list\"\n\ndefinition epdaH_get_fixed_scheduler :: \"\n  ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> 'event list\"\n  where\n    \"epdaH_get_fixed_scheduler c \\<equiv>\n  []\"\ndeclare epdaH_get_fixed_scheduler_def [simp add]\n\ndefinition epdaH_get_fixed_scheduler_DB :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation\n  \\<Rightarrow> nat\n  \\<Rightarrow> 'event list\"\n  where\n    \"epdaH_get_fixed_scheduler_DB G d n \\<equiv>\n  []\"\ndeclare epdaH_get_fixed_scheduler_DB_def [simp add]\n\ndefinition epdaH_configurations :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf set\"\n  where\n    \"epdaH_configurations G \\<equiv>\n  {\\<lparr>epdaH_conf_state = q, epdaH_conf_history = h, epdaH_conf_stack = s\\<rparr> |\n  q s h.\n  q \\<in> epda_states G\n  \\<and> set s \\<subseteq> epda_gamma G\n  \\<and> set h \\<subseteq> epda_events G}\"\n\ndefinition epdaH_initial_configurations :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf set\"\n  where\n    \"epdaH_initial_configurations G \\<equiv>\n  {c.\n    epdaH_conf_state c = epda_initial G\n    \\<and> epdaH_conf_history c = []\n    \\<and> epdaH_conf_stack c = [epda_box G]}\n  \\<inter> epdaH_configurations G\"\n\ndefinition epdaH_marking_configurations :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf set\"\n  where\n    \"epdaH_marking_configurations G \\<equiv>\n  {c. epdaH_conf_state c \\<in> epda_marking G}\n  \\<inter> epdaH_configurations G\"\n\ndefinition epdaH_string_state :: \"\n  ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> 'event list\"\n  where\n    \"epdaH_string_state c \\<equiv>\n  epdaH_conf_history c\"\n\ndefinition epdaH_marking_condition :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation\n  \\<Rightarrow> bool\"\n  where\n    \"epdaH_marking_condition G d \\<equiv>\n  \\<exists>i e c.\n  d i = Some (pair e c)\n  \\<and> c \\<in> epdaH_marking_configurations G\n  \\<and> (\\<forall>j e' c'.\n     j > i\n     \\<and> d j = Some (pair e' c')\n     \\<longrightarrow> epdaH_string_state c = epdaH_string_state c')\"\n\ndefinition epdaH_step_relation :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> ('state, 'event, 'stack) epda_step_label\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> bool\"\n  where\n    \"epdaH_step_relation G c1 e c2 \\<equiv>\n  e \\<in> epda_delta G\n  \\<and> epdaH_conf_state c1 = edge_src e\n  \\<and> epdaH_conf_state c2 = edge_trg e\n  \\<and> epdaH_conf_history c2\n      = epdaH_conf_history c1 @ option_to_list (edge_event e)\n  \\<and> (\\<exists>w.\n     epdaH_conf_stack c1 = edge_pop e @ w\n     \\<and> epdaH_conf_stack c2 = edge_push e @ w)\"\n\ndefinition epdaH_marked_effect :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation\n  \\<Rightarrow> 'event list set\"\n  where\n    \"epdaH_marked_effect G d \\<equiv>\n  {w. \\<exists>i e c.\n      d i = Some (pair e c)\n      \\<and> c \\<in> epdaH_marking_configurations G\n      \\<and> w = epdaH_conf_history c\n      \\<and> (\\<forall>j e' c'.\n         j > i\n         \\<and> d j = Some(pair e' c')\n         \\<longrightarrow> epdaH_string_state c = epdaH_string_state c')}\"\n\ndefinition epdaH_unmarked_effect :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation\n  \\<Rightarrow> 'event list set\"\n  where\n    \"epdaH_unmarked_effect G d \\<equiv>\n  {w. \\<exists>i e c.\n      d i = Some (pair e c)\n      \\<and> w = epdaH_conf_history c}\"\n\ndefinition epdaH_get_destinations :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation_configuration\n  \\<Rightarrow> ('state, 'event, 'stack) epda_destinations set\"\n  where\n    \"epdaH_get_destinations G der_conf \\<equiv>\n  case der_conf of pair e c \\<Rightarrow>\n    {state (epdaH_conf_state c)}\n    \\<union> (case e of None \\<Rightarrow> {} | Some e' \\<Rightarrow> {edge e'})\"\n\nlemma epdaH_inst_AX_initial_configuration_belongs: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> epdaH_initial_configurations G \\<subseteq> epdaH_configurations G)\"\n  apply(clarsimp)\n  apply(rename_tac G x)(*strict*)\n  apply(simp add: epdaH_initial_configurations_def)\n  done\n\nlemma epdaH_inst_AX_step_relation_preserves_belongs: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> (\\<forall>c1 e c2. epdaH_step_relation G c1 e c2 \\<longrightarrow> c1 \\<in> epdaH_configurations G \\<longrightarrow> e \\<in> epda_step_labels G \\<and> c2 \\<in> epdaH_configurations G))\"\n  apply(clarsimp)\n  apply(rename_tac G c1 e c2)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac G c1 e c2)(*strict*)\n   apply(simp add: epdaH_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac G c1 e c2 w)(*strict*)\n   apply(simp add: epda_step_labels_def)\n  apply(rename_tac G c1 e c2)(*strict*)\n  apply(simp add: epda_step_labels_def epdaH_step_relation_def epdaH_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G e c2 h w)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac G e c2 h w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G e h w)(*strict*)\n  apply(simp add: valid_epda_def)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"e\"\n      in ballE)\n   apply(rename_tac G e h w)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G e h w)(*strict*)\n  apply(simp add: valid_epda_step_label_def)\n  apply(clarsimp)\n  apply(simp add: option_to_set_def option_to_list_def)\n  apply(clarsimp)\n  apply(rename_tac G e h w x)(*strict*)\n  apply(simp add: may_terminated_by_def append_language_def kleene_star_def)\n  apply(clarsimp)\n  apply(rename_tac G e h w x a aa)(*strict*)\n  apply(erule_tac\n      P=\"edge_push e = aa @ [epda_box G]\"\n      in disjE)\n   apply(rename_tac G e h w x a aa)(*strict*)\n   apply(clarsimp)\n   apply(blast)\n  apply(rename_tac G e h w x a aa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G e h w x a)(*strict*)\n  apply(blast)\n  done\n\ninterpretation \"epdaH\" : loc_autHF_0\n  (* TSstructure *)\n  \"valid_epda\"\n  (* configurations *)\n  \"epdaH_configurations\"\n  (* initial_configurations *)\n  \"epdaH_initial_configurations\"\n  (* step_labels *)\n  \"epda_step_labels\"\n  (* step_relation *)\n  \"epdaH_step_relation\"\n  (* effects *)\n  \"epda_effects\"\n  (* marking_condition *)\n  \"epdaH_marking_condition\"\n  (* marked_effect *)\n  \"epdaH_marked_effect\"\n  (* unmarked_effect *)\n  \"epdaH_unmarked_effect\"\n  (* destinations *)\n  \"epda_destinations\"\n  (* get_destinations *)\n  \"epdaH_get_destinations\"\n  apply(simp add: LOCALE_DEFS)\n  apply(simp add: epdaH_inst_AX_initial_configuration_belongs epdaH_inst_AX_step_relation_preserves_belongs )\n  done\n\nlemma epdaH_inst_AX_effect_inclusion1: \"\n  (\\<forall>M f. epdaH_marking_condition M f \\<longrightarrow> epdaH_marked_effect M f \\<subseteq> epdaH_unmarked_effect M f)\"\n  apply(clarsimp)\n  apply(rename_tac M f x)(*strict*)\n  apply(simp add: epdaH_unmarked_effect_def epdaH_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M f i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(rule_tac\n      x=\"e\"\n      in exI)\n  apply(rule_tac\n      x=\"c\"\n      in exI)\n  apply(clarsimp)\n  done\n\nlemma epdaH_inst_lang_sound: \"\n  (\\<forall>M. valid_epda M \\<longrightarrow> epdaH.unmarked_language M \\<subseteq> epda_effects M)\"\n  apply(clarsimp)\n  apply(rename_tac M x)(*strict*)\n  apply(simp add: epdaH.unmarked_language_def epdaH_unmarked_effect_def epda_effects_def)\n  apply(clarsimp)\n  apply(rename_tac M xa d i e c)(*strict*)\n  apply(subgoal_tac \"c \\<in> epdaH_configurations M\")\n   apply(rename_tac M xa d i e c)(*strict*)\n   apply(simp add: epdaH_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac M xa d i e q s h)(*strict*)\n   apply(force)\n  apply(rename_tac M xa d i e c)(*strict*)\n  apply(rule epdaH.belongs_configurations)\n   apply(rename_tac M xa d i e c)(*strict*)\n   apply(rule epdaH.derivation_initial_belongs)\n    apply(rename_tac M xa d i e c)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d i e c)(*strict*)\n   apply(force)\n  apply(rename_tac M xa d i e c)(*strict*)\n  apply(force)\n  done\n\nlemma epdaH_inst_AX_marking_condition_implies_existence_of_effect: \"\n  (\\<forall>M. valid_epda M \\<longrightarrow> (\\<forall>f. epdaH.derivation_initial M f \\<longrightarrow> epdaH_marking_condition M f \\<longrightarrow> epdaH_marked_effect M f \\<noteq> {}))\"\n  apply(simp add: epdaH_marking_condition_def epdaH_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M f i e c)(*strict*)\n  apply(force)\n  done\n\nlemma epdaH_inst_AX_unmarked_effect_persists: \"\n   (\\<forall>G. valid_epda G \\<longrightarrow>\n         (\\<forall>d. ATS.derivation_initial epdaH_initial_configurations\n               epdaH_step_relation G d \\<longrightarrow>\n              (\\<forall>n. epdaH_unmarked_effect G (derivation_take d n)\n                   \\<subseteq> epdaH_unmarked_effect G d)))\"\n  apply(clarsimp)\n  apply(rename_tac x d n xa)(*strict*)\n  apply(simp add: epdaH_unmarked_effect_def derivation_take_def)\n  apply(clarsimp)\n  apply(rename_tac x d n i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(rule_tac\n      x=\"e\"\n      in exI)\n  apply(rule_tac\n      x=\"c\"\n      in exI)\n  apply(clarsimp)\n  apply(case_tac \"i\\<le>n\")\n   apply(rename_tac x d n i e c)(*strict*)\n   apply(force)\n  apply(rename_tac x d n i e c)(*strict*)\n  apply(force)\n  done\n\nlemma epdaH_inst_ATS_axioms: \"\n  ATS_Language_axioms valid_epda epdaH_initial_configurations\n     epdaH_step_relation epda_effects epdaH_marking_condition\n     epdaH_marked_effect epdaH_unmarked_effect\"\n  apply(simp add: ATS_Language_axioms_def)\n  apply(simp add: epdaH_inst_AX_effect_inclusion1 epdaH_inst_lang_sound epdaH_inst_AX_marking_condition_implies_existence_of_effect epdaH_inst_AX_unmarked_effect_persists )\n  done\n\nprint_locale loc_autHF_1\ninterpretation \"epdaH\" : loc_autHF_1\n  (* TSstructure *)\n  \"valid_epda\"\n  (* configurations *)\n  \"epdaH_configurations\"\n  (* initial_configurations *)\n  \"epdaH_initial_configurations\"\n  (* step_labels *)\n  \"epda_step_labels\"\n  (* step_relation *)\n  \"epdaH_step_relation\"\n  (* effects *)\n  \"epda_effects\"\n  (* marking_condition *)\n  \"epdaH_marking_condition\"\n  (* marked_effect *)\n  \"epdaH_marked_effect\"\n  (* unmarked_effect *)\n  \"epdaH_unmarked_effect\"\n  (* destinations *)\n  \"epda_destinations\"\n  (* get_destinations *)\n  \"epdaH_get_destinations\"\n  apply(simp add: LOCALE_DEFS)\n  apply(simp add: epdaH_inst_AX_initial_configuration_belongs epdaH_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: epdaH_inst_ATS_axioms )\n  done\n\ndefinition epdaH_set_history :: \"\n  ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\"\n  where\n    \"epdaH_set_history c h \\<equiv>\n  c \\<lparr>epdaH_conf_history := h\\<rparr>\"\n\nlemma epdaH_inst_AX_initial_history_empty: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> (\\<forall>c. c \\<in> epdaH_initial_configurations G \\<longrightarrow> epdaH_conf_history c = []))\"\n  apply(simp add: epdaH_initial_configurations_def)\n  done\n\nlemma epdaH_inst_AX_steps_extend_history: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> (\\<forall>c. c \\<in> epdaH_configurations G \\<longrightarrow> (\\<forall>e c'. epdaH_step_relation G c e c' \\<longrightarrow> (\\<exists>hf\\<in> epda_effects G. epdaH_conf_history c' = epdaH_conf_history c @ hf))))\"\n  apply(clarsimp)\n  apply(rename_tac G c e c')(*strict*)\n  apply(subgoal_tac \"SSe \\<in> epda_step_labels SSG \\<and> SSc2 \\<in> epdaH_configurations SSG\" for SSe SSG SSc2)\n   apply(rename_tac G c e c')(*strict*)\n   prefer 2\n   apply(rule epdaH.AX_step_relation_preserves_belongs)\n     apply(rename_tac G c e c')(*strict*)\n     apply(force)\n    apply(rename_tac G c e c')(*strict*)\n    apply(force)\n   apply(rename_tac G c e c')(*strict*)\n   apply(force)\n  apply(rename_tac G c e c')(*strict*)\n  apply(clarsimp)\n  apply(simp add: epdaH_step_relation_def epda_effects_def epda_step_labels_def)\n  apply(clarsimp)\n  apply(rename_tac G c e c' x w)(*strict*)\n  apply(subgoal_tac \"valid_epda_step_label G e\")\n   apply(rename_tac G c e c' x w)(*strict*)\n   prefer 2\n   apply(simp add: valid_epda_def)\n  apply(rename_tac G c e c' x w)(*strict*)\n  apply(simp add: valid_epda_step_label_def)\n  apply(clarsimp)\n  apply(simp add: option_to_list_def option_to_set_def)\n  apply(force)\n  done\n\nlemma epdaH_inst_AX_empty_history_is_history: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> [] \\<in> epda_effects G)\"\n  apply(simp add: epda_effects_def)\n  done\n\nlemma epdaH_inst_AX_set_get_history: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> (\\<forall>c. c \\<in> epdaH_configurations G \\<longrightarrow> epdaH_set_history c (epdaH_conf_history c) = c))\"\n  apply(clarsimp)\n  apply(rename_tac G c)(*strict*)\n  apply(simp add: epdaH_set_history_def)\n  done\n\nlemma epdaH_inst_AX_get_set_history: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> (\\<forall>c. c \\<in> epdaH_configurations G \\<longrightarrow> (\\<forall>h. h \\<in> epda_effects G \\<longrightarrow> epdaH_conf_history (epdaH_set_history c h) = h)))\"\n  apply(clarsimp)\n  apply(rename_tac G c h)(*strict*)\n  apply(simp add: epdaH_set_history_def)\n  done\n\nlemma epdaH_inst_AX_join_history_fragments_closed: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> (\\<forall>hf1. hf1 \\<in> epda_effects G \\<longrightarrow> (\\<forall>hf2. hf2 \\<in> epda_effects G \\<longrightarrow> hf1 @ hf2 \\<in> epda_effects G)))\"\n  apply(clarsimp)\n  apply(rename_tac G hf1 hf2)(*strict*)\n  apply(simp add: epda_effects_def)\n  done\n\nlemma epdaH_inst_AX_get_history_closed: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> (\\<forall>c. c \\<in> epdaH_configurations G \\<longrightarrow> epdaH_conf_history c \\<in> epda_effects G))\"\n  apply(clarsimp)\n  apply(rename_tac G c)(*strict*)\n  apply(simp add: epda_effects_def epdaH_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G x q s h)(*strict*)\n  apply(force)\n  done\n\nlemma epdaH_inst_AX_mutual_prefix: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> (\\<forall>hf1. hf1 \\<in> epda_effects G \\<longrightarrow> (\\<forall>hf2. hf2 \\<in> epda_effects G \\<longrightarrow> (\\<forall>hf3. hf3 \\<in> epda_effects G \\<longrightarrow> (\\<forall>hf4. hf4 \\<in> epda_effects G \\<longrightarrow> hf1 @ hf2 = hf3 @ hf4 \\<longrightarrow> (\\<exists>hf\\<in> epda_effects G. hf1 @ hf = hf3) \\<or> (\\<exists>hf\\<in> epda_effects G. hf3 @ hf = hf1))))))\"\n  apply(clarsimp)\n  apply(rename_tac G hf1 hf2 hf3 hf4)(*strict*)\n  apply(simp add: epda_effects_def epdaH_configurations_def)\n  apply(subgoal_tac \"prefix hf1 hf3 \\<or> prefix hf3 hf1\")\n   apply(rename_tac G hf1 hf2 hf3 hf4)(*strict*)\n   prefer 2\n   apply(rule mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac G hf1 hf2 hf3 hf4)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac G hf1 hf2 hf3 hf4)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n  apply(rename_tac G hf1 hf2 hf3 hf4)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G hf2 hf3 c)(*strict*)\n  apply(force)\n  done\n\nlemma epdaH_inst_ATS_History_axioms: \"\n  ATS_History_axioms valid_epda epdaH_configurations\n     epdaH_initial_configurations epdaH_step_relation epda_effects\n     epda_effects epda_empty_history epda_empty_history_fragment\n     epdaH_set_history (@) (@) epdaH_conf_history\"\n  apply(simp add: ATS_History_axioms_def)\n  apply(simp add: epdaH_inst_AX_mutual_prefix epdaH_inst_AX_initial_history_empty epdaH_inst_AX_steps_extend_history epdaH_inst_AX_empty_history_is_history epdaH_inst_AX_set_get_history epdaH_inst_AX_get_set_history epdaH_inst_AX_join_history_fragments_closed epdaH_inst_AX_get_history_closed )\n  done\n\nprint_locale loc_autHF_2\ninterpretation \"epdaH\" : loc_autHF_2\n  (* TSstructure *)\n  \"valid_epda\"\n  (* configurations *)\n  \"epdaH_configurations\"\n  (* initial_configurations *)\n  \"epdaH_initial_configurations\"\n  (* step_labels *)\n  \"epda_step_labels\"\n  (* step_relation *)\n  \"epdaH_step_relation\"\n  (* effects *)\n  \"epda_effects\"\n  (* marking_condition *)\n  \"epdaH_marking_condition\"\n  (* marked_effect *)\n  \"epdaH_marked_effect\"\n  (* unmarked_effect *)\n  \"epdaH_unmarked_effect\"\n  (* destinations *)\n  \"epda_destinations\"\n  (* get_destinations *)\n  \"epdaH_get_destinations\"\n  (* histories *)\n  \"epda_effects\"\n  (* history_fragments *)\n  \"epda_effects\"\n  (* empty_history *)\n  epda_empty_history\n  (* empty_history_fragment *)\n  epda_empty_history_fragment\n  (* set_history *)\n  \"epdaH_set_history\"\n  (* extend_history *)\n  \"append\"\n  (* join_history_fragments *)\n  \"append\"\n  (* get_history *)\n  \"epdaH_conf_history\"\n  apply(simp add: LOCALE_DEFS)\n  apply(simp add: epdaH_inst_AX_initial_configuration_belongs epdaH_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: epdaH_inst_ATS_axioms epdaH_inst_ATS_History_axioms )\n  done\n\nlemma epdaH_inst_lang_finite: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> epdaH.finite_marked_language G = epdaH.marked_language G)\"\n  apply(clarsimp)\n  apply(rename_tac G)(*strict*)\n  apply(simp add: epdaH.finite_marked_language_def epdaH.marked_language_def)\n  apply(rule order_antisym)\n   apply(rename_tac G)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G x d n)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: epdaH.derivation_initial_def)\n  apply(rename_tac G)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G x d)(*strict*)\n  apply(simp add: epdaH_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G d i e c)(*strict*)\n  apply(rule_tac\n      x=\"derivation_take d i\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac G d i e c)(*strict*)\n   apply(rule epdaH.derivation_take_preserves_derivation_initial)\n   apply(force)\n  apply(rename_tac G d i e c)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G d i e c)(*strict*)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac G d i e c)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G d i e c)(*strict*)\n   apply(simp add: epdaH_marking_condition_def)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rename_tac G d i e c ia ea ca)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac G d i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(rule maximum_of_domain_derivation_take)\n  apply(force)\n  done\n\nlemma epdaH_inst_AX_unmarked_language_finite: \"\n  (\\<forall>G. valid_epda G \\<longrightarrow> epdaH.finite_unmarked_language G = epdaH.unmarked_language G)\"\n  apply(clarsimp)\n  apply(rename_tac G)(*strict*)\n  apply(simp add: epdaH.finite_unmarked_language_def epdaH.unmarked_language_def)\n  apply(rule order_antisym)\n   apply(rename_tac G)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G x d n)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: epdaH.derivation_initial_def)\n  apply(rename_tac G)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G x d)(*strict*)\n  apply(simp add: epdaH_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G d i e c)(*strict*)\n  apply(rule_tac\n      x=\"derivation_take d i\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac G d i e c)(*strict*)\n   apply(rule epdaH.derivation_take_preserves_derivation_initial)\n   apply(force)\n  apply(rename_tac G d i e c)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G d i e c)(*strict*)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac G d i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(rule maximum_of_domain_derivation_take)\n  apply(force)\n  done\n\nlemma epdaH_inst_ATS_SchedF_Basic_axioms: \"\n  ATS_SchedF_Basic_axioms valid_epda epda_fixed_schedulers\n     epda_empty_fixed_scheduler\"\n  apply(simp add: ATS_SchedF_Basic_axioms_def)\n  done\n\nlemma epdaH_inst_ATS_SchedF_SB_axioms: \"\n  ATS_SchedF_SB_axioms valid_epda epdaH_configurations epdaH_step_relation\n     epda_fixed_scheduler_extendable epdaH_get_fixed_scheduler\"\n  apply(simp add: ATS_SchedF_SB_axioms_def)\n  done\n\nprint_locale loc_autHF_3\ninterpretation \"epdaH\" : loc_autHF_3\n  (* TSstructure *)\n  \"valid_epda\"\n  (* configurations *)\n  \"epdaH_configurations\"\n  (* initial_configurations *)\n  \"epdaH_initial_configurations\"\n  (* step_labels *)\n  \"epda_step_labels\"\n  (* step_relation *)\n  \"epdaH_step_relation\"\n  (* effects *)\n  \"epda_effects\"\n  (* marking_condition *)\n  \"epdaH_marking_condition\"\n  (* marked_effect *)\n  \"epdaH_marked_effect\"\n  (* unmarked_effect *)\n  \"epdaH_unmarked_effect\"\n  (* destinations *)\n  \"epda_destinations\"\n  (* get_destinations *)\n  \"epdaH_get_destinations\"\n  (* histories *)\n  \"epda_effects\"\n  (* history_fragments *)\n  \"epda_effects\"\n  (* empty_history *)\n  epda_empty_history\n  (* empty_history_fragment *)\n  epda_empty_history_fragment\n  (* set_history *)\n  \"epdaH_set_history\"\n  (* extend_history *)\n  \"append\"\n  (* join_history_fragments *)\n  \"append\"\n  (* get_history *)\n  \"epdaH_conf_history\"\n  (* fixed_schedulers *)\n  epda_fixed_schedulers\n  (* empty_fixed_scheduler *)\n  epda_empty_fixed_scheduler\n  (* fixed_scheduler_extendable *)\n  epda_fixed_scheduler_extendable\n  (* get_fixed_scheduler *)\n  epdaH_get_fixed_scheduler\n  apply(simp add: LOCALE_DEFS)\n  apply(simp add: epdaH_inst_AX_initial_configuration_belongs epdaH_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: epdaH_inst_ATS_axioms epdaH_inst_ATS_History_axioms epdaH_inst_ATS_SchedF_Basic_axioms epdaH_inst_ATS_SchedF_SB_axioms )\n  done\n\nlemma epdaH_inst_ATS_SchedF_DB_axioms: \"\n  ATS_SchedF_DB_axioms valid_epda epdaH_configurations epda_step_labels\n     epdaH_step_relation epda_fixed_schedulers\n     epda_fixed_scheduler_extendable epdaH_get_fixed_scheduler_DB\"\n  apply(simp add: ATS_SchedF_DB_axioms_def)\n  done\n\nlemma epdaH_inst_ATS_SchedF_SDB_axioms: \"\n  ATS_SchedF_SDB_axioms valid_epda epdaH_initial_configurations\n     epdaH_step_relation epdaH_get_fixed_scheduler\n     epdaH_get_fixed_scheduler_DB\"\n  apply(simp add: ATS_SchedF_SDB_axioms_def)\n  done\n\nlemma epdaH_inst_ATS_determHIST_SB_axioms: \"\n  ATS_determHIST_SB_axioms valid_epda epdaH_configurations epdaH_step_relation\n     epdaH_conf_history epda_fixed_scheduler_extendable\n     epdaH_get_fixed_scheduler\"\n  apply(simp add: ATS_determHIST_SB_axioms_def)\n  done\n\ninterpretation \"epdaH\" : loc_autHF_6\n  (* TSstructure *)\n  \"valid_epda\"\n  (* configurations *)\n  \"epdaH_configurations\"\n  (* initial_configurations *)\n  \"epdaH_initial_configurations\"\n  (* step_labels *)\n  \"epda_step_labels\"\n  (* step_relation *)\n  \"epdaH_step_relation\"\n  (* effects *)\n  \"epda_effects\"\n  (* marking_condition *)\n  \"epdaH_marking_condition\"\n  (* marked_effect *)\n  \"epdaH_marked_effect\"\n  (* unmarked_effect *)\n  \"epdaH_unmarked_effect\"\n  (* destinations *)\n  \"epda_destinations\"\n  (* get_destinations *)\n  \"epdaH_get_destinations\"\n  (* histories *)\n  \"epda_effects\"\n  (* history_fragments *)\n  \"epda_effects\"\n  (* empty_history *)\n  epda_empty_history\n  (* empty_history_fragment *)\n  epda_empty_history_fragment\n  (* set_history *)\n  \"epdaH_set_history\"\n  (* extend_history *)\n  \"append\"\n  (* join_history_fragments *)\n  \"append\"\n  (* get_history *)\n  \"epdaH_conf_history\"\n  (* fixed_schedulers *)\n  epda_fixed_schedulers\n  (* empty_fixed_scheduler *)\n  epda_empty_fixed_scheduler\n  (* fixed_scheduler_extendable *)\n  epda_fixed_scheduler_extendable\n  (* get_fixed_scheduler *)\n  epdaH_get_fixed_scheduler\n  (* get_fixed_scheduler_DB *)\n  epdaH_get_fixed_scheduler_DB\n  apply(simp add: LOCALE_DEFS)\n  apply(simp add: epdaH_inst_AX_initial_configuration_belongs epdaH_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: epdaH_inst_ATS_axioms epdaH_inst_ATS_History_axioms epdaH_inst_ATS_SchedF_Basic_axioms epdaH_inst_ATS_SchedF_SB_axioms epdaH_inst_ATS_SchedF_SDB_axioms epdaH_inst_ATS_determHIST_SB_axioms )\n  apply(simp add: epdaH_inst_ATS_SchedF_DB_axioms)\n  done\n\nlemma epdaH_inst_ATS_Language_by_Finite_Derivations_axioms: \"\n  ATS_Language_by_Finite_Derivations_axioms valid_epda\n     epdaH_initial_configurations epdaH_step_relation\n     epdaH_marking_condition epdaH_marked_effect epdaH_unmarked_effect\"\n  apply(simp add: ATS_Language_by_Finite_Derivations_axioms_def)\n  apply(simp add: epdaH_inst_lang_finite epdaH_inst_AX_unmarked_language_finite )\n  done\n\ninterpretation \"epdaH\" : loc_autHF_7\n  (* TSstructure *)\n  \"valid_epda\"\n  (* configurations *)\n  \"epdaH_configurations\"\n  (* initial_configurations *)\n  \"epdaH_initial_configurations\"\n  (* step_labels *)\n  \"epda_step_labels\"\n  (* step_relation *)\n  \"epdaH_step_relation\"\n  (* effects *)\n  \"epda_effects\"\n  (* marking_condition *)\n  \"epdaH_marking_condition\"\n  (* marked_effect *)\n  \"epdaH_marked_effect\"\n  (* unmarked_effect *)\n  \"epdaH_unmarked_effect\"\n  (* destinations *)\n  \"epda_destinations\"\n  (* get_destinations *)\n  \"epdaH_get_destinations\"\n  (* histories *)\n  \"epda_effects\"\n  (* history_fragments *)\n  \"epda_effects\"\n  (* empty_history *)\n  epda_empty_history\n  (* empty_history_fragment *)\n  epda_empty_history_fragment\n  (* set_history *)\n  \"epdaH_set_history\"\n  (* extend_history *)\n  \"append\"\n  (* join_history_fragments *)\n  \"append\"\n  (* get_history *)\n  \"epdaH_conf_history\"\n  (* fixed_schedulers *)\n  epda_fixed_schedulers\n  (* empty_fixed_scheduler *)\n  epda_empty_fixed_scheduler\n  (* fixed_scheduler_extendable *)\n  epda_fixed_scheduler_extendable\n  (* get_fixed_scheduler *)\n  epdaH_get_fixed_scheduler\n  (* get_fixed_scheduler_DB *)\n  epdaH_get_fixed_scheduler_DB\n  apply(simp add: LOCALE_DEFS)\n  apply(simp add: epdaH_inst_AX_initial_configuration_belongs epdaH_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: epdaH_inst_ATS_axioms epdaH_inst_ATS_History_axioms epdaH_inst_ATS_SchedF_Basic_axioms epdaH_inst_ATS_SchedF_SB_axioms epdaH_inst_ATS_SchedF_DB_axioms epdaH_inst_ATS_SchedF_SDB_axioms epdaH_inst_ATS_determHIST_SB_axioms epdaH_inst_ATS_Language_by_Finite_Derivations_axioms )\n  done\n\nlemma epdaH_inst_AX_is_forward_target_deterministic_correspond_SB: \"\n  \\<forall>G. valid_epda G \\<longrightarrow>\n        ATS.is_forward_target_deterministic_accessible\n         epdaH_initial_configurations epdaH_step_relation G =\n        ATS_determHIST_SB.is_forward_target_deterministicHist_SB_long\n         epdaH_initial_configurations epdaH_step_relation epda_effects (@)\n         (@) epdaH_conf_history epda_fixed_scheduler_extendable\n         epdaH_get_fixed_scheduler G\"\n  apply(clarsimp)\n  apply(rename_tac G)(*strict*)\n  apply(rule order_antisym)\n   apply(rename_tac G)(*strict*)\n   apply(clarsimp)\n   apply(rule epdaH.is_forward_target_deterministic_accessible_implies_is_forward_target_deterministicHist_SB_long)\n    apply(rename_tac G)(*strict*)\n    apply(force)\n   apply(rename_tac G)(*strict*)\n   apply(force)\n  apply(rename_tac G)(*strict*)\n  apply(clarsimp)\n  apply(simp add: epdaH.is_forward_target_deterministic_accessible_def)\n  apply(simp add: epdaH.is_forward_target_deterministicHist_SB_long_def)\n  apply(clarsimp)\n  apply(rename_tac G c c1 c2 e)(*strict*)\n  apply(erule_tac\n      x=\"c\"\n      in ballE)\n   apply(rename_tac G c c1 c2 e)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G c c1 c2 e)(*strict*)\n  apply(erule_tac\n      x=\"c1\"\n      in allE)\n  apply(erule_tac\n      x=\"c2\"\n      in allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"e\"\n      in allE)\n  apply(clarsimp)\n  apply(simp add: epdaH_step_relation_def)\n  apply(clarsimp)\n  done\n\nlemma epdaH_inst_ATS_HistoryCT_SB_axioms: \"\n  ATS_HistoryCT_SB_axioms valid_epda epdaH_initial_configurations\n     epdaH_step_relation epda_effects (@) (@) epdaH_conf_history\n     epda_fixed_scheduler_extendable epdaH_get_fixed_scheduler\"\n  apply(simp add: ATS_HistoryCT_SB_axioms_def)\n  apply(simp add: epdaH_inst_AX_is_forward_target_deterministic_correspond_SB )\n  done\n\ninterpretation \"epdaH\" : loc_autHF_8\n  (* TSstructure *)\n  \"valid_epda\"\n  (* configurations *)\n  \"epdaH_configurations\"\n  (* initial_configurations *)\n  \"epdaH_initial_configurations\"\n  (* step_labels *)\n  \"epda_step_labels\"\n  (* step_relation *)\n  \"epdaH_step_relation\"\n  (* effects *)\n  \"epda_effects\"\n  (* marking_condition *)\n  \"epdaH_marking_condition\"\n  (* marked_effect *)\n  \"epdaH_marked_effect\"\n  (* unmarked_effect *)\n  \"epdaH_unmarked_effect\"\n  (* destinations *)\n  \"epda_destinations\"\n  (* get_destinations *)\n  \"epdaH_get_destinations\"\n  (* histories *)\n  \"epda_effects\"\n  (* history_fragments *)\n  \"epda_effects\"\n  (* empty_history *)\n  epda_empty_history\n  (* empty_history_fragment *)\n  epda_empty_history_fragment\n  (* set_history *)\n  \"epdaH_set_history\"\n  (* extend_history *)\n  \"append\"\n  (* join_history_fragments *)\n  \"append\"\n  (* get_history *)\n  \"epdaH_conf_history\"\n  (* fixed_schedulers *)\n  epda_fixed_schedulers\n  (* empty_fixed_scheduler *)\n  epda_empty_fixed_scheduler\n  (* fixed_scheduler_extendable *)\n  epda_fixed_scheduler_extendable\n  (* get_fixed_scheduler *)\n  epdaH_get_fixed_scheduler\n  (* get_fixed_scheduler_DB *)\n  epdaH_get_fixed_scheduler_DB\n  apply(simp add: LOCALE_DEFS)\n  apply(simp add: epdaH_inst_AX_initial_configuration_belongs epdaH_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: epdaH_inst_ATS_axioms epdaH_inst_ATS_History_axioms epdaH_inst_ATS_SchedF_Basic_axioms epdaH_inst_ATS_SchedF_SB_axioms epdaH_inst_ATS_SchedF_DB_axioms epdaH_inst_ATS_SchedF_SDB_axioms epdaH_inst_ATS_determHIST_SB_axioms epdaH_inst_ATS_Language_by_Finite_Derivations_axioms epdaH_inst_ATS_HistoryCT_SB_axioms )\n  done\n\nlemma epdaH_inst_AX_is_forward_target_deterministic_correspond_DB: \"\n  \\<forall>G. valid_epda G \\<longrightarrow>\n        ATS.is_forward_target_deterministic_accessible\n         epdaH_initial_configurations epdaH_step_relation G =\n        ATS_determHIST_DB.is_forward_target_deterministicHist_DB_long\n         epdaH_initial_configurations epdaH_step_relation epda_effects (@)\n         (@) epdaH_conf_history epda_fixed_scheduler_extendable\n         epdaH_get_fixed_scheduler_DB G\"\n  apply(clarsimp)\n  apply(rename_tac G)(*strict*)\n  apply(rule order_antisym)\n   apply(rename_tac G)(*strict*)\n   apply(clarsimp)\n   apply(rule epdaH.is_forward_target_deterministic_accessible_implies_is_forward_target_deterministicHist_DB_long)\n    apply(rename_tac G)(*strict*)\n    apply(force)\n   apply(rename_tac G)(*strict*)\n   apply(force)\n  apply(rename_tac G)(*strict*)\n  apply(clarsimp)\n  apply(simp add: epdaH.is_forward_target_deterministic_accessible_def)\n  apply(simp add: epdaH.is_forward_target_deterministicHist_DB_long_def)\n  apply(clarsimp)\n  apply(rename_tac G c c1 c2 e)(*strict*)\n  apply(simp add: epdaH_step_relation_def)\n  apply(clarsimp)\n  done\n\nlemma epdaH_inst_ATS_HistoryCT_DB_axioms: \"\n  ATS_HistoryCT_DB_axioms valid_epda epdaH_initial_configurations\n     epdaH_step_relation epda_effects (@) (@) epdaH_conf_history\n     epda_fixed_scheduler_extendable epdaH_get_fixed_scheduler_DB\"\n  apply(simp add: ATS_HistoryCT_DB_axioms_def)\n  apply(simp add: epdaH_inst_AX_is_forward_target_deterministic_correspond_DB )\n  done\n\ninterpretation \"epdaH\" : loc_autHF_9\n  (* TSstructure *)\n  \"valid_epda\"\n  (* configurations *)\n  \"epdaH_configurations\"\n  (* initial_configurations *)\n  \"epdaH_initial_configurations\"\n  (* step_labels *)\n  \"epda_step_labels\"\n  (* step_relation *)\n  \"epdaH_step_relation\"\n  (* effects *)\n  \"epda_effects\"\n  (* marking_condition *)\n  \"epdaH_marking_condition\"\n  (* marked_effect *)\n  \"epdaH_marked_effect\"\n  (* unmarked_effect *)\n  \"epdaH_unmarked_effect\"\n  (* destinations *)\n  \"epda_destinations\"\n  (* get_destinations *)\n  \"epdaH_get_destinations\"\n  (* histories *)\n  \"epda_effects\"\n  (* history_fragments *)\n  \"epda_effects\"\n  (* empty_history *)\n  epda_empty_history\n  (* empty_history_fragment *)\n  epda_empty_history_fragment\n  (* set_history *)\n  \"epdaH_set_history\"\n  (* extend_history *)\n  \"append\"\n  (* join_history_fragments *)\n  \"append\"\n  (* get_history *)\n  \"epdaH_conf_history\"\n  (* fixed_schedulers *)\n  epda_fixed_schedulers\n  (* empty_fixed_scheduler *)\n  epda_empty_fixed_scheduler\n  (* fixed_scheduler_extendable *)\n  epda_fixed_scheduler_extendable\n  (* get_fixed_scheduler *)\n  epdaH_get_fixed_scheduler\n  (* get_fixed_scheduler_DB *)\n  epdaH_get_fixed_scheduler_DB\n  apply(simp add: LOCALE_DEFS)\n  apply(simp add: epdaH_inst_AX_initial_configuration_belongs epdaH_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: epdaH_inst_ATS_axioms epdaH_inst_ATS_History_axioms epdaH_inst_ATS_SchedF_Basic_axioms epdaH_inst_ATS_SchedF_SB_axioms epdaH_inst_ATS_SchedF_DB_axioms epdaH_inst_ATS_SchedF_SDB_axioms epdaH_inst_ATS_determHIST_SB_axioms epdaH_inst_ATS_Language_by_Finite_Derivations_axioms epdaH_inst_ATS_HistoryCT_SB_axioms epdaH_inst_ATS_HistoryCT_DB_axioms )\n  done\n\nlemma equal_by_mutual_extension: \"\n  w = v @ h1\n  \\<Longrightarrow> v = w @ h2\n  \\<Longrightarrow> w = v\"\n  apply(force)\n  done\n\nlemma epdaH_inst_AX_BF_BraSBRest_DetHSB_LaOp_axioms: \"\n   \\<forall>M. valid_epda M \\<longrightarrow>\n        ATS_determHIST_SB.is_forward_deterministicHist_SB\n         epdaH_initial_configurations epdaH_step_relation epda_effects (@)\n         (@) epdaH_conf_history epda_fixed_scheduler_extendable\n         epdaH_get_fixed_scheduler M \\<longrightarrow>\n        nonblockingness_language\n         (epdaH.unmarked_language M)\n         (ATS_Language0.marked_language epdaH_initial_configurations\n           epdaH_step_relation epdaH_marking_condition epdaH_marked_effect\n           M) \\<longrightarrow>\n        ATS_SchedF_SB.Nonblockingness_branching_restricted epdaH_configurations\n         epdaH_initial_configurations epda_step_labels epdaH_step_relation\n         epdaH_marking_condition epda_fixed_scheduler_extendable\n         epdaH_get_fixed_scheduler M\"\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: epdaH.Nonblockingness_branching_restricted_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. dh n= Some (pair e c)\")\n   apply(rename_tac M dh n)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"M\"\n      in epdaH.some_position_has_details_before_max_dom)\n     apply(rename_tac M dh n)(*strict*)\n     apply (metis epdaH.derivation_initial_is_derivation)\n    apply(rename_tac M dh n)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n)(*strict*)\n   apply(force)\n  apply(rename_tac M dh n)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e c)(*strict*)\n  apply(subgoal_tac \"epdaH_conf_history c \\<in> prefix_closure (epdaH.marked_language M)\")\n   apply(rename_tac M dh n e c)(*strict*)\n   prefer 2\n   apply(simp add: nonblockingness_language_def)\n   apply(rename_tac M dh n e c)(*strict*)\n   apply(rule_tac\n      A=\" epdaH.unmarked_language M\"\n      in set_mp)\n    apply(rename_tac M dh n e c)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c)(*strict*)\n   apply(thin_tac \" epdaH.unmarked_language M \\<subseteq> (prefix_closure (epdaH.marked_language M))\")\n   apply(rename_tac M dh n e c)(*strict*)\n   apply(simp add: epdaH.unmarked_language_def)\n   apply(rule_tac\n      x=\"dh\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: epdaH.derivation_initial_def)\n   apply(simp add: epdaH_unmarked_effect_def)\n   apply(clarsimp)\n   apply(force)\n  apply(rename_tac M dh n e c)(*strict*)\n  apply(thin_tac \"nonblockingness_language (epdaH.unmarked_language M) (epdaH.marked_language M)\")\n  apply(rename_tac M dh n e c)(*strict*)\n  apply(simp add: prefix_closure_def epdaH.marked_language_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n e c d ca)(*strict*)\n  apply(simp add: epdaH_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n e c d ca i ea cb)(*strict*)\n  apply(subgoal_tac \"\\<exists>i e c. d i = Some (pair e c) \\<and> c \\<in> epdaH_marking_configurations M \\<and> (\\<forall>j e' c'. i < j \\<and> d j = Some (pair e' c') \\<longrightarrow> epdaH_conf_history c = epdaH_conf_history c' )\")\n   apply(rename_tac M dh n e c d ca i ea cb)(*strict*)\n   prefer 2\n   apply(simp add: epdaH_marking_condition_def epdaH_string_state_def)\n  apply(rename_tac M dh n e c d ca i ea cb)(*strict*)\n  apply(thin_tac \"epdaH_marking_condition M d\")\n  apply(clarsimp)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n  apply(subgoal_tac \"dh 0 = d 0\")\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   prefer 2\n   apply(simp add: epdaH.derivation_initial_def)\n   apply(case_tac \"d 0\")\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc b)(*strict*)\n   apply(case_tac \"dh 0\")\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc b a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc b a option ba)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc b ba)(*strict*)\n   apply(simp add: epdaH_initial_configurations_def)\n    (*\n  what should dc be?\n  ia \\<le> i \\<le> n : d@i ~ d@ia; d@ia ~~ dh@ia \\<Longrightarrow> dh@n ~ dh@ia; dc = []\n  ia \\<le> n \\<le> i : d@i ~ d@ia; d@ia ~~ dh@ia \\<Longrightarrow> dh@n ~ dh@ia; dc = []\n  n \\<le> ia \\<le> i : d@ia ~ d@ia \\<Longrightarrow> dc = d (n\\<dots>ia)\n  i \\<le> ia \\<le> n : d@ia ~ dh@ia \\<Longrightarrow> dh@n ~ dh@ia; dc = []\n  i \\<le> n \\<le> ia : d@n ~ dh@n; dc = d (n\\<dots>ia)\n  n \\<le> i \\<le> ia : d@n ~ dh@n; dc = d (n\\<dots>ia)\n  ia \\<le> n \\<Longrightarrow> dc = []\n  n \\<le> ia \\<Longrightarrow> dc = d (n\\<dots>ia)\n*)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n  apply(case_tac \"ia\\<le>n\")\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   apply(rule_tac\n      x=\"der1 c\"\n      in exI)\n   apply(rule_tac\n      t=\"derivation_append dh (der1 c) n\"\n      and s=\"dh\"\n      in ssubst)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    apply(rule ext)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc x)(*strict*)\n    apply(simp add: derivation_append_def)\n    apply(clarsimp)\n    apply(simp add: der1_def)\n    apply(case_tac \"dh x\")\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc x)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc x a)(*strict*)\n    apply(rule_tac\n      m=\"x\"\n      and d=\"dh\"\n      in epdaH.no_some_beyond_maximum_of_domain)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc x a)(*strict*)\n       apply(simp add: epdaH.derivation_initial_def)\n       apply(force)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc x a)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc x a)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc x a)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    apply(rule epdaH.der1_is_derivation)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    apply(rule epdaH.der1_belongs)\n    apply(rule epdaH.belongs_configurations)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n     apply(rule epdaH.derivation_initial_belongs)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(rule der1_maximum_of_domain)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    apply(simp add: derivation_append_fit_def der1_def)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   apply(simp add: epdaH_marking_condition_def)\n    (*\n  where does it accept continuously?\n  ia \\<le> i \\<le> n : d@i ~ d@ia; d@ia ~~ dh@ia \\<Longrightarrow> d@ia=dh@ia; @ia @i\n  ia \\<le> n \\<le> i : d@i ~ d@ia; d@ia ~~ dh@ia \\<Longrightarrow> dh@n ~ dh@ia; @ia\n  i \\<le> ia \\<le> n : d@ia ~ dh@ia \\<Longrightarrow> dh@n ~ dh@ia; @ia\n  *)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   apply(rule_tac\n      x=\"ia\"\n      in exI)\n   apply(subgoal_tac \"dh ia = d ia\")\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    prefer 2\n    apply(subgoal_tac \"\\<exists>e c. dh ia = Some (pair e c)\")\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n     prefer 2\n     apply(rule epdaH.some_position_has_details_before_max_dom)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n       apply(simp add: epdaH.derivation_initial_def)\n       apply(force)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(subgoal_tac \"\\<exists>ca'. epdaH_conf_history c @ ca' = epdaH_conf_history cc\")\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     prefer 2\n     apply(case_tac \"i\\<le>ia\")\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n      prefer 2\n      apply(erule_tac\n      x=\"i\"\n      and P=\"\\<lambda>i. \\<forall>e' c'. ia < i \\<and> d i = Some (pair e' c') \\<longrightarrow> epdaH_conf_history cc = epdaH_conf_history c'\"\n      in allE)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n      apply(clarsimp)\n      apply(force)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(subgoal_tac \"\\<exists>ca'. epdaH_conf_history cb @ ca' = epdaH_conf_history cc\")\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n      apply(clarsimp)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n      apply(rule_tac\n      x=\"ca @ ca'\"\n      in exI)\n      apply(rule_tac\n      t=\"epdaH_conf_history cc\"\n      and s=\"epdaH_conf_history cb @ ca'\"\n      in ssubst)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n      apply(rule_tac\n      t=\"epdaH_conf_history cb\"\n      and s=\"epdaH_conf_history c @ ca\"\n      in ssubst)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n      apply(simp (no_asm))\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(subgoal_tac \"\\<exists>h\\<in> epda_effects M. epdaH_conf_history cc = epdaH_conf_history cb @ h\")\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n      prefer 2\n      apply(rule_tac\n      d=\"d\"\n      and n=\"i\"\n      and m=\"ia-i\"\n      in epdaH.steps_extend_history_derivation)\n          apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n          apply(force)\n         apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n         apply(simp add: epdaH.derivation_initial_def)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n        apply(simp add: epdaH_marking_configurations_def)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n       apply(simp add: get_configuration_def)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n      apply(simp add: get_configuration_def)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(clarsimp)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(erule exE)+\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n    apply(rule_tac\n      ?d1.0=\"dh\"\n      and n=\"ia\"\n      and m=\"ia\"\n      and ?d2.0=\"d\"\n      and x=\"0\"\n      and y=\"0\"\n      in epdaH.is_forward_deterministicHist_derivations_coincide)\n               apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n               apply(force)\n              apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n              apply(simp add: epdaH.derivation_initial_def)\n             apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n             apply(force)\n            apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n            apply(force)\n           apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n           apply(force)\n          apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n          apply(force)\n         apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n         apply(force)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n     apply(simp add: get_configuration_def)\n     apply(subgoal_tac \"\\<exists>h\\<in> epda_effects M. epdaH_conf_history c = epdaH_conf_history cd @ h\")\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n      prefer 2\n      apply(rule_tac\n      d=\"dh\"\n      and n=\"ia\"\n      and m=\"n-ia\"\n      in epdaH.steps_extend_history_derivation)\n          apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n          apply(force)\n         apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n         apply(simp add: epdaH.derivation_initial_def)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n        apply(simp add: epdaH_marking_configurations_def)\n        apply(rule epdaH.belongs_configurations)\n         apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n         apply(rule epdaH.derivation_initial_belongs)\n          apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n          apply(force)\n         apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n         apply(force)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n       apply(simp add: get_configuration_def)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n      apply(simp add: get_configuration_def)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n     apply(erule bexE)+\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n     apply(subgoal_tac \"cb \\<in> epdaH_configurations M\")\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n      prefer 2\n      apply(rule_tac\n      d=\"d\"\n      in epdaH.belongs_configurations)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n       apply(rule epdaH.derivation_initial_belongs)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n     apply(case_tac \"ia\\<le>i\")\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n      apply(subgoal_tac \"epdaH_conf_history cc = epdaH_conf_history cb\")\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n       prefer 2\n       apply(case_tac \"ia<i\")\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n        apply(erule_tac\n      x=\"i\"\n      and P=\"\\<lambda>i. \\<forall>e' c'. ia < i \\<and> d i = Some (pair e' c') \\<longrightarrow> epdaH_conf_history cc = epdaH_conf_history c'\"\n      in allE)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n        apply(clarsimp)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n       apply(clarsimp)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n      apply(clarsimp)\n      apply(rule_tac\n      x=\"h@ca\"\n      in bexI)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n       apply(clarsimp)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n      apply(simp add: epda_effects_def)\n      apply(simp add: epdaH_configurations_def)\n      apply(clarsimp)\n      apply(rename_tac M dh n e c d ca i ea ia eb cc ec \"cd\" h x q s)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n     apply(subgoal_tac \"\\<exists>h\\<in> epda_effects M. epdaH_conf_history cc = epdaH_conf_history cb @ h\")\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n      prefer 2\n      apply(rule_tac\n      d=\"d\"\n      and n=\"i\"\n      and m=\"ia-i\"\n      in epdaH.steps_extend_history_derivation)\n          apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n          apply(force)\n         apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n         apply(simp add: epdaH.derivation_initial_def)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n        apply(simp add: epdaH_marking_configurations_def)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n       apply(simp add: get_configuration_def)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n      apply(simp add: get_configuration_def)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h ha)(*strict*)\n     apply(rule_tac\n      x=\"h @ ca @ ha\"\n      in bexI)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h ha)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca' h ha)(*strict*)\n     apply(simp add: epda_effects_def)\n     apply(simp add: epdaH_configurations_def)\n     apply(clarsimp)\n     apply(rename_tac M dh n e c d ca i ea ia eb cc ec \"cd\" h ha x q s)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" ca')(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(subgoal_tac \"\\<exists>h\\<in> epda_effects M. epdaH_conf_history c = epdaH_conf_history cc @ h\")\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"dh\"\n      and n=\"ia\"\n      and m=\"n-ia\"\n      in epdaH.steps_extend_history_derivation)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n       apply(simp add: epdaH.derivation_initial_def)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n      apply(simp add: epdaH_marking_configurations_def)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n     apply(simp add: get_configuration_def)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    apply(simp add: get_configuration_def)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   apply(erule bexE)+\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n   apply(subgoal_tac \"h@ca=[]\")\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n    prefer 2\n    apply(case_tac \"ia\\<le>i\")\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n     apply(case_tac \"ia<i\")\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n      apply(erule_tac\n      x=\"i\"\n      and P=\"\\<lambda>i. \\<forall>e' c'. ia < i \\<and> d i = Some (pair e' c') \\<longrightarrow> epdaH_conf_history cc = epdaH_conf_history c'\"\n      in allE)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n    apply(subgoal_tac \"\\<exists>h\\<in> epda_effects M. epdaH_conf_history cc = epdaH_conf_history cb @ h\")\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n     prefer 2\n     apply(rule_tac\n      d=\"d\"\n      and n=\"i\"\n      and m=\"ia-i\"\n      in epdaH.steps_extend_history_derivation)\n         apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n         apply(force)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n        apply(simp add: epdaH.derivation_initial_def)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n       apply(simp add: epdaH_marking_configurations_def)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n      apply(simp add: get_configuration_def)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n     apply(simp add: get_configuration_def)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc h)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n   apply(erule_tac\n      x=\"j\"\n      and P=\"\\<lambda>j. \\<forall>e' c'. ia < j \\<and> d j = Some (pair e' c') \\<longrightarrow> epdaH_conf_history cb = epdaH_conf_history c'\"\n      in allE)\n   apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"j\\<le>n\")\n    apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"dh\"\n      in epdaH.allPreMaxDomSome_prime)\n      apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n      apply(simp add: epdaH.derivation_initial_def)\n      apply(force)\n     apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n   apply(subgoal_tac \"\\<exists>h\\<in> epda_effects M. epdaH_conf_history c = epdaH_conf_history c' @ h\")\n    apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"dh\"\n      and n=\"j\"\n      and m=\"n-j\"\n      in epdaH.steps_extend_history_derivation)\n        apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n       apply(simp add: epdaH.derivation_initial_def)\n      apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n      apply(simp add: epdaH_marking_configurations_def)\n      apply(rule epdaH.belongs_configurations)\n       apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n       apply(rule epdaH.derivation_initial_belongs)\n        apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n     apply(simp add: get_configuration_def)\n    apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n    apply(simp add: get_configuration_def)\n   apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n   apply(subgoal_tac \"\\<exists>h\\<in> epda_effects M. epdaH_conf_history c' = epdaH_conf_history cc @ h\")\n    apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"dh\"\n      and n=\"ia\"\n      and m=\"j-ia\"\n      in epdaH.steps_extend_history_derivation)\n        apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n       apply(simp add: epdaH.derivation_initial_def)\n      apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n      apply(simp add: epdaH_marking_configurations_def)\n     apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n     apply(simp add: get_configuration_def)\n    apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n    apply(simp add: get_configuration_def)\n   apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n   apply(case_tac \"d j\")\n    apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c')(*strict*)\n    apply(clarify)\n    apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c' h ha)(*strict*)\n    apply(simp add: epdaH_string_state_def)\n   apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c' a)(*strict*)\n   apply(simp add: epdaH_string_state_def)\n   apply(clarify)\n   apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c' a h ha)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c' a h ha option b)(*strict*)\n   apply(clarify)\n   apply(rule_tac\n      ?h2.0=\"ha\"\n      and ?h1.0=\"h\"\n      in equal_by_mutual_extension)\n    apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c' a h ha option b)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c d i ea cb ia eb cc j e' c' a h ha option b)(*strict*)\n   apply(force)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n  apply(subgoal_tac \"ia>n\")\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n  apply(thin_tac \"\\<not> ia \\<le> n\")\n  apply(subgoal_tac \"\\<exists>e c. d n = Some (pair e c)\")\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"ia\"\n      in epdaH.pre_some_position_is_some_position)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n   apply(force)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n  apply(subgoal_tac \"cd \\<in> epdaH_configurations M\")\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      in epdaH.belongs_configurations)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(rule epdaH.derivation_initial_belongs)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(force)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n  apply(subgoal_tac \"c \\<in> epdaH_configurations M\")\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"dh\"\n      in epdaH.belongs_configurations)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(rule epdaH.derivation_initial_belongs)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(force)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n  apply(subgoal_tac \"d n = dh n\")\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   prefer 2\n   apply(rule sym)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(rule_tac\n      ?d1.0=\"dh\"\n      and n=\"n\"\n      and m=\"ia\"\n      and ?d2.0=\"d\"\n      and x=\"0\"\n      and y=\"0\"\n      in epdaH.is_forward_deterministicHist_derivations_coincide)\n              apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n              apply(force)\n             apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n             apply(simp add: epdaH.derivation_initial_def)\n            apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n            apply(force)\n           apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n           apply(force)\n          apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n          apply(force)\n         apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n         apply(simp add: epdaH.derivation_initial_def)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n        apply(case_tac \"d 0\")\n         apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n         apply(clarsimp)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" a)(*strict*)\n        apply(clarsimp)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n       apply(case_tac \"dh 0\")\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n        apply(clarsimp)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" a)(*strict*)\n       apply(clarsimp)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    prefer 2\n    apply(simp add: get_configuration_def)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(case_tac \"ia<i\")\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(erule_tac\n      x=\"i\"\n      and P=\"\\<lambda>j. \\<forall>e' c'. i < j \\<and> d j = Some (pair e' c') \\<longrightarrow> epdaH_string_state cb = epdaH_string_state c'\"\n      in allE)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"ca\"\n      in bexI)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(subgoal_tac \"cb \\<in> epdaH_configurations M\")\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(subgoal_tac \"cc \\<in> epdaH_configurations M\")\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n      apply(simp add: epdaH_configurations_def epda_effects_def)\n      apply(clarsimp)\n      apply(rename_tac M dh n e d ca i ea ia eb ec x q qa qb qc s sa sb sc h ha hc)(*strict*)\n      apply(rule_tac\n      A=\"set ca\"\n      in set_mp)\n       apply(rename_tac M dh n e d ca i ea ia eb ec x q qa qb qc s sa sb sc h ha hc)(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e d ca i ea ia eb ec x q qa qb qc s sa sb sc h ha hc)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply (metis epdaH.belongs_configurations epdaH.derivation_initial_belongs)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply (metis epdaH.belongs_configurations epdaH.derivation_initial_belongs)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(subgoal_tac \"i\\<le>ia\")\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>hf\\<in> epda_effects M. epdaH_conf_history cc = epdaH_conf_history cb @ hf\")\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"d\"\n      and n=\"i\"\n      and m=\"ia-i\"\n      in epdaH.steps_extend_history_derivation)\n        apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n      apply (metis epdaH.belongs_configurations epdaH.derivation_initial_belongs)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(simp add: get_configuration_def)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(simp add: get_configuration_def)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n   apply(rule_tac\n      x=\"ca@hf\"\n      in bexI)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n   apply(subgoal_tac \"cb \\<in> epdaH_configurations M\")\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n    apply(subgoal_tac \"cc \\<in> epdaH_configurations M\")\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n     apply(simp add: epdaH_configurations_def epda_effects_def)\n     apply(clarsimp)\n     apply(rename_tac M dh n e d ca i ea ia eb ec hf x q qa qb qc s sa sb sc h ha)(*strict*)\n     apply(rule_tac\n      A=\"set ca\"\n      in set_mp)\n      apply(rename_tac M dh n e d ca i ea ia eb ec hf x q qa qb qc s sa sb sc h ha)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e d ca i ea ia eb ec hf x q qa qb qc s sa sb sc h ha)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n    apply (metis epdaH.belongs_configurations epdaH.derivation_initial_belongs)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\" hf)(*strict*)\n   apply (metis epdaH.belongs_configurations epdaH.derivation_initial_belongs)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n  apply(rule_tac\n      x=\"derivation_drop (derivation_take d ia) n\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(rule_tac\n      m=\"ia-n\"\n      in epdaH.derivation_drop_preserves_derivation_prime)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(rule epdaH.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n  apply(rule conjI)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(rule epdaH.derivation_drop_preserves_belongs)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(rule epdaH.derivation_take_preserves_derivation)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(rule epdaH.derivation_take_preserves_belongs)\n    apply(rule epdaH.derivation_initial_belongs)\n     apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n  apply(rule conjI)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(rule_tac\n      x=\"ia-n\"\n      in exI)\n   apply(simp add: maximum_of_domain_def derivation_drop_def derivation_take_def)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n  apply(rule conjI)\n   apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(simp add: derivation_append_fit_def derivation_drop_def derivation_take_def)\n  apply(rename_tac M dh n e c d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n  apply(simp add: epdaH_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n  apply(rule_tac\n      x=\"ia\"\n      in exI)\n  apply(rule_tac\n      x=\"eb\"\n      in exI)\n  apply(rule_tac\n      x=\"cc\"\n      in exI)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac M dh n d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n   apply(simp add: derivation_append_def derivation_drop_def derivation_take_def)\n  apply(rename_tac M dh n d ca i ea cb ia eb cc ec \"cd\")(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n d ca i ea cb ia eb cc ec \"cd\" j e' c')(*strict*)\n  apply(simp add: derivation_append_def derivation_drop_def derivation_take_def)\n  done\n\nlemma epdaH_inst_BF_BraSBRest_DetHSB_LaOp_axioms: \"\n  BF_BraSBRest_DetHSB_LaOp_axioms valid_epda epdaH_configurations\n     epdaH_initial_configurations epda_step_labels epdaH_step_relation\n     epdaH_marking_condition epdaH_marked_effect epdaH_unmarked_effect\n     epda_effects (@) (@) epdaH_conf_history\n     epda_fixed_scheduler_extendable epdaH_get_fixed_scheduler\"\n  apply(simp add: BF_BraSBRest_DetHSB_LaOp_axioms_def)\n  apply(rule epdaH_inst_AX_BF_BraSBRest_DetHSB_LaOp_axioms)\n  done\n\nlemma epdaH_inst_BF_BraSBRest_DetHDB_LaOp_axioms: \"\n  BF_BraSBRest_DetHDB_LaOp_axioms valid_epda epdaH_configurations\n     epdaH_initial_configurations epda_step_labels epdaH_step_relation\n     epdaH_marking_condition epdaH_marked_effect epdaH_unmarked_effect\n     epda_effects (@) (@) epdaH_conf_history\n     epda_fixed_scheduler_extendable epdaH_get_fixed_scheduler_DB\n     epdaH_get_fixed_scheduler\"\n  apply(simp add: BF_BraSBRest_DetHDB_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(subgoal_tac \"epdaH.is_forward_deterministicHist_SB M\")\n   apply(rename_tac M)(*strict*)\n   apply (metis epdaH_inst_AX_BF_BraSBRest_DetHSB_LaOp_axioms)\n  apply(rename_tac M)(*strict*)\n  apply(thin_tac \"nonblockingness_language (epdaH.unmarked_language M) (epdaH.marked_language M)\")\n  apply(rename_tac M)(*strict*)\n  apply(rule_tac\n      t=\"epdaH.is_forward_deterministicHist_SB M\"\n      and s=\"epdaH.is_forward_deterministicHist_DB M\"\n      in ssubst)\n   apply(rename_tac M)(*strict*)\n   apply (rule epdaH.is_forward_deterministic_correspond_DB_SB)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(force)\n  done\n\nlemma epdaH_inst_BF_BraDBRest_DetHSB_LaOp_axioms: \"\n  BF_BraDBRest_DetHSB_LaOp_axioms valid_epda epdaH_configurations\n     epdaH_initial_configurations epda_step_labels epdaH_step_relation\n     epdaH_marking_condition epdaH_marked_effect epdaH_unmarked_effect\n     epda_effects (@) (@) epdaH_conf_history\n     epda_fixed_scheduler_extendable epdaH_get_fixed_scheduler\n     epdaH_get_fixed_scheduler_DB\"\n  apply(simp add: BF_BraDBRest_DetHSB_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(rule_tac\n      t=\"epdaH.Nonblockingness_branching_restricted_DB M\"\n      and s=\"epdaH.Nonblockingness_branching_restricted M\"\n      in subst)\n   apply(rename_tac M)(*strict*)\n   apply(rule_tac\n      G=\"M\"\n      in epdaH.Nonblockingness_branching_SB_DB_restricted)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(subgoal_tac \"BF_BraSBRest_DetHDB_LaOp_axioms valid_epda epdaH_configurations\n     epdaH_initial_configurations epda_step_labels epdaH_step_relation\n     epdaH_marking_condition epdaH_marked_effect epdaH_unmarked_effect\n     epda_effects (@) (@) epdaH_conf_history\n     epda_fixed_scheduler_extendable epdaH_get_fixed_scheduler_DB\n     epdaH_get_fixed_scheduler\")\n   apply(rename_tac M)(*strict*)\n   apply(simp add: BF_BraSBRest_DetHDB_LaOp_axioms_def)\n   apply(erule_tac\n      x=\"M\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac M)(*strict*)\n    apply(force)\n   apply(rename_tac M)(*strict*)\n   apply(erule impE)\n    apply(rename_tac M)(*strict*)\n    apply(rule_tac\n      t=\"epdaH.is_forward_deterministicHist_DB M\"\n      and s=\"epdaH.is_forward_deterministicHist_SB M\"\n      in subst)\n     apply(rename_tac M)(*strict*)\n     apply(rule epdaH.is_forward_deterministic_correspond_DB_SB)\n     apply(force)\n    apply(rename_tac M)(*strict*)\n    apply(force)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(rule epdaH_inst_BF_BraSBRest_DetHDB_LaOp_axioms)\n  done\n\nlemma epdaH_inst_BF_BraDBRest_DetHDB_LaOp_axioms: \"\n  BF_BraDBRest_DetHDB_LaOp_axioms valid_epda epdaH_configurations\n     epdaH_initial_configurations epda_step_labels epdaH_step_relation\n     epdaH_marking_condition epdaH_marked_effect epdaH_unmarked_effect\n     epda_effects (@) (@) epdaH_conf_history\n     epda_fixed_scheduler_extendable epdaH_get_fixed_scheduler_DB\"\n  apply(simp add: BF_BraDBRest_DetHDB_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(subgoal_tac \"BF_BraDBRest_DetHSB_LaOp_axioms valid_epda epdaH_configurations\n     epdaH_initial_configurations epda_step_labels epdaH_step_relation\n     epdaH_marking_condition epdaH_marked_effect epdaH_unmarked_effect\n     epda_effects (@) (@) epdaH_conf_history\n     epda_fixed_scheduler_extendable epdaH_get_fixed_scheduler\n     epdaH_get_fixed_scheduler_DB\")\n   apply(rename_tac M)(*strict*)\n   apply(simp add: BF_BraDBRest_DetHSB_LaOp_axioms_def)\n   apply(erule_tac\n      x=\"M\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac M)(*strict*)\n    apply(force)\n   apply(rename_tac M)(*strict*)\n   apply(erule impE)\n    apply(rename_tac M)(*strict*)\n    prefer 2\n    apply(erule impE)\n     apply(rename_tac M)(*strict*)\n     apply(force)\n    apply(rename_tac M)(*strict*)\n    apply(force)\n   apply(rename_tac M)(*strict*)\n   apply (metis epdaH.is_forward_deterministic_correspond_DB_SB)\n  apply(rename_tac M)(*strict*)\n  apply(rule epdaH_inst_BF_BraDBRest_DetHSB_LaOp_axioms)\n  done\n\nlemma epdaH_inst_BF_Bra_OpLa_axioms: \"\n  BF_Bra_OpLa_axioms valid_epda epdaH_configurations\n     epdaH_initial_configurations epda_step_labels epdaH_step_relation\n     epdaH_marking_condition epdaH_marked_effect epdaH_unmarked_effect\"\n  apply(simp add: BF_Bra_OpLa_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: nonblockingness_language_def)\n  apply(clarsimp)\n  apply(rename_tac M xa)(*strict*)\n  apply(simp add: prefix_closure_def prefix_def)\n  apply(simp add: epdaH.unmarked_language_def)\n  apply(clarsimp)\n  apply(rename_tac M xa d)(*strict*)\n  apply(simp add: epdaH.Nonblockingness_branching_def)\n  apply(simp add: epdaH_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M d i e c)(*strict*)\n  apply(erule_tac\n      x=\"derivation_take d i\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M d i e c)(*strict*)\n   apply(rule epdaH.derivation_take_preserves_derivation_initial)\n   apply(force)\n  apply(rename_tac M d i e c)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M d i e c)(*strict*)\n   apply(rule maximum_of_domain_derivation_take)\n   apply(force)\n  apply(rename_tac M d i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M d i e c dc x)(*strict*)\n  apply(simp add: epdaH_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n  apply(rule_tac\n      x=\"epdaH_conf_history ca\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n   apply(simp add: epdaH.marked_language_def)\n   apply(rule_tac\n      x=\"derivation_append (derivation_take d i) dc i\"\n      in exI)\n   apply(rule context_conjI)\n    apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n    apply(rule epdaH.derivation_append_preserves_derivation_initial)\n      apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n      apply(force)\n     apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n     apply(rule epdaH.derivation_take_preserves_derivation_initial)\n     apply(force)\n    apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n    apply(rule epdaH.derivation_append_preserves_derivation)\n      apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n      apply(rule epdaH.derivation_take_preserves_derivation)\n      apply(force)\n     apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n    apply(simp add: derivation_take_def)\n    apply(simp add: derivation_append_fit_def)\n    apply(case_tac \"dc 0\")\n     apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac M d i e c dc x ia ea ca a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac M d i e c dc x ia ea ca a option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac M d i e c dc x ia ea ca option b)(*strict*)\n    apply(case_tac option)\n     apply(rename_tac M d i e c dc x ia ea ca option b)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac M d i e c dc x ia ea ca option b a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n    apply(simp add: epdaH_marked_effect_def)\n    apply(rule_tac\n      x=\"ia\"\n      in exI)\n    apply(rule_tac\n      x=\"ea\"\n      in exI)\n    apply(rule_tac\n      x=\"ca\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n   apply(simp add: epdaH.derivation_initial_def)\n   apply(simp add: epdaH_marking_condition_def)\n   apply(rule_tac\n      x=\"ia\"\n      in exI)\n   apply(rule_tac\n      x=\"ea\"\n      in exI)\n   apply(rule_tac\n      x=\"ca\"\n      in exI)\n   apply(clarsimp)\n  apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n  apply(case_tac \"ia<i\")\n   apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n   apply(rule_tac\n      x=\"[]\"\n      in exI)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(erule_tac\n      x=\"e\"\n      in allE)\n   apply(erule_tac\n      x=\"c\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def derivation_take_def)\n   apply(simp add: epdaH_string_state_def)\n  apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n  apply(subgoal_tac \"\\<exists>h\\<in> epda_effects M. epdaH_conf_history SSc' = epdaH_conf_history SSc @ h\" for SSc' SSc)\n   apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"derivation_append (derivation_take d i) dc i\"\n      and n=\"i\"\n      and m=\"ia-i\"\n      in epdaH.steps_extend_history_derivation)\n       apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n       apply(force)\n      apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n      apply(simp add: epdaH.derivation_initial_def)\n      apply(rule epdaH.derivation_append_preserves_derivation)\n        apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n        apply(rule epdaH.derivation_take_preserves_derivation)\n        apply(force)\n       apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n       apply(force)\n      apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n      apply(simp add: derivation_take_def derivation_append_fit_def)\n      apply(case_tac \"dc 0\")\n       apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n       apply(force)\n      apply(rename_tac M d i e c dc x ia ea ca a)(*strict*)\n      apply(clarsimp)\n      apply(case_tac a)\n      apply(rename_tac M d i e c dc x ia ea ca a option b)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac M d i e c dc x ia ea ca option b)(*strict*)\n      apply(case_tac option)\n       apply(rename_tac M d i e c dc x ia ea ca option b)(*strict*)\n       apply(clarsimp)\n      apply(rename_tac M d i e c dc x ia ea ca option b a)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n     prefer 2\n     apply(simp add: get_configuration_def derivation_append_def derivation_take_def)\n    apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n    apply(rule epdaH.belongs_configurations)\n     apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n     apply(rule epdaH.derivation_initial_belongs)\n      apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n      apply(force)\n     apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n   apply(simp add: get_configuration_def derivation_append_def derivation_take_def)\n  apply(rename_tac M d i e c dc x ia ea ca)(*strict*)\n  apply(simp add: epdaH_string_state_def)\n  apply(force)\n  done\n\nprint_locale loc_autHF_10\n\ninterpretation \"epdaH\" : loc_autHF_10\n  (* TSstructure *)\n  \"valid_epda\"\n  (* configurations *)\n  \"epdaH_configurations\"\n  (* initial_configurations *)\n  \"epdaH_initial_configurations\"\n  (* step_labels *)\n  \"epda_step_labels\"\n  (* step_relation *)\n  \"epdaH_step_relation\"\n  (* effects *)\n  \"epda_effects\"\n  (* marking_condition *)\n  \"epdaH_marking_condition\"\n  (* marked_effect *)\n  \"epdaH_marked_effect\"\n  (* unmarked_effect *)\n  \"epdaH_unmarked_effect\"\n  (* destinations *)\n  \"epda_destinations\"\n  (* get_destinations *)\n  \"epdaH_get_destinations\"\n  (* histories *)\n  \"epda_effects\"\n  (* history_fragments *)\n  \"epda_effects\"\n  (* empty_history *)\n  epda_empty_history\n  (* empty_history_fragment *)\n  epda_empty_history_fragment\n  (* set_history *)\n  \"epdaH_set_history\"\n  (* extend_history *)\n  \"append\"\n  (* join_history_fragments *)\n  \"append\"\n  (* get_history *)\n  \"epdaH_conf_history\"\n  (* fixed_schedulers *)\n  epda_fixed_schedulers\n  (* empty_fixed_scheduler *)\n  epda_empty_fixed_scheduler\n  (* fixed_scheduler_extendable *)\n  epda_fixed_scheduler_extendable\n  (* get_fixed_scheduler *)\n  epdaH_get_fixed_scheduler\n  (* get_fixed_scheduler_DB *)\n  epdaH_get_fixed_scheduler_DB\n  apply(simp add: LOCALE_DEFS)\n  apply(simp add: epdaH_inst_AX_initial_configuration_belongs epdaH_inst_AX_step_relation_preserves_belongs epdaH_inst_ATS_axioms epdaH_inst_ATS_History_axioms epdaH_inst_ATS_SchedF_Basic_axioms epdaH_inst_ATS_SchedF_SB_axioms epdaH_inst_ATS_SchedF_DB_axioms epdaH_inst_ATS_SchedF_SDB_axioms epdaH_inst_ATS_determHIST_SB_axioms epdaH_inst_ATS_Language_by_Finite_Derivations_axioms epdaH_inst_ATS_HistoryCT_SB_axioms epdaH_inst_ATS_HistoryCT_DB_axioms\n      epdaH_inst_BF_BraSBRest_DetHDB_LaOp_axioms epdaH_inst_BF_BraSBRest_DetHSB_LaOp_axioms epdaH_inst_BF_Bra_OpLa_axioms epdaH_inst_BF_BraDBRest_DetHSB_LaOp_axioms epdaH_inst_BF_BraDBRest_DetHDB_LaOp_axioms )\n  done\n\nlemma epdaH_history_prefix_makes_prefix: \"\n  w1 \\<in> epda_effects G\n  \\<Longrightarrow> ATS_History.history_fragment_prefixes epda_effects (@) G w1 \\<subseteq> ATS_History.history_fragment_prefixes epda_effects (@) G w2\n  \\<Longrightarrow> w1 \\<sqsubseteq> w2\"\n  apply(simp add: epdaH.history_fragment_prefixes_def)\n  apply(simp add: prefix_def)\n  apply(subgoal_tac \"w1 \\<in> {hf' \\<in> epda_effects G. \\<exists>hf''\\<in> epda_effects G. hf' @ hf'' = w1}\")\n   prefer 2\n   apply(clarsimp)\n   apply(simp add: epda_effects_def)\n  apply(subgoal_tac \"w1 \\<in> {hf' \\<in> epda_effects G. \\<exists>hf''\\<in> epda_effects G. hf' @ hf'' = w2}\")\n   prefer 2\n   apply(force)\n  apply(thin_tac \"{hf' \\<in> epda_effects G. \\<exists>hf''\\<in> epda_effects G. hf' @ hf'' = w1} \\<subseteq> {hf' \\<in> epda_effects G. \\<exists>hf''\\<in> epda_effects G. hf' @ hf'' = w2}\")\n  apply(thin_tac \"w1 \\<in> {hf' \\<in> epda_effects G. \\<exists>hf''\\<in> epda_effects G. hf' @ hf'' = w1}\")\n  apply(force)\n  done\n\nlemma epdaH_history_prefix_makes_prefix_mutual: \"\n  w1 \\<in> epda_effects G\n  \\<Longrightarrow> w2 \\<in> epda_effects G\n  \\<Longrightarrow> ATS_History.history_fragment_prefixes epda_effects (@) G w1 \\<subseteq> ATS_History.history_fragment_prefixes epda_effects (@) G w2 \\<or> ATS_History.history_fragment_prefixes epda_effects (@) G w2 \\<subseteq> ATS_History.history_fragment_prefixes epda_effects (@) G w1\n  \\<Longrightarrow> prefix w1 w2 \\<or> prefix w2 w1\"\n  apply(erule disjE)\n   apply(rule disjI1)\n   apply(rule epdaH_history_prefix_makes_prefix)\n    apply(force)\n   apply(force)\n  apply(rule disjI2)\n  apply(rule epdaH_history_prefix_makes_prefix)\n   apply(force)\n  apply(force)\n  done\n\nlemma epdaH_is_forward_target_deterministicHist_DB_long: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH.is_forward_target_deterministicHist_DB_long G\"\n  apply(simp add: epdaH.is_forward_target_deterministicHist_DB_long_def)\n  apply(clarsimp)\n  apply(rename_tac c d c1 c2 n e w1 w2)(*strict*)\n  apply(simp add: epdaH_step_relation_def)\n  apply(clarsimp)\n  done\n\ndefinition epdaH_accessible_edges :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stack) epda_step_label set\"\n  where\n    \"epdaH_accessible_edges G \\<equiv>\n  {e \\<in> epda_delta G.\n    \\<exists>d n c.\n    epdaH.derivation_initial G d\n    \\<and> d n = Some (pair (Some e) c)}\"\n\ndefinition epdaH_required_edges :: \"\n  ('state, 'event, 'stack)epda\n  \\<Rightarrow> ('state, 'event, 'stack) epda_step_label set\"\n  where\n    \"epdaH_required_edges G \\<equiv>\n  {e \\<in> epda_delta G.\n    \\<exists>d n c.\n    epdaH.derivation_initial G d\n    \\<and> d n = Some (pair (Some e) c)\n    \\<and> (\\<exists>k\\<ge>n. \\<exists>e c. d k = Some (pair e c) \\<and> c \\<in> epdaH_marking_configurations G)}\"\n\ndefinition epdaH_non_ambiguous :: \"\n  ('state, 'event, 'stack)epda\n  \\<Rightarrow> bool\"\n  where\n    \"epdaH_non_ambiguous G \\<equiv>\n  \\<forall>d1 d2 n1 n2 q1 q2 h s1 s2.\n  epdaH.derivation_initial G d1\n  \\<longrightarrow> epdaH.derivation_initial G d2\n  \\<longrightarrow> get_configuration (d1 n1)\n        = Some \\<lparr>epdaH_conf_state=q1, epdaH_conf_history=h, epdaH_conf_stack=s1\\<rparr>\n  \\<longrightarrow> get_configuration (d2 n2)\n        = Some \\<lparr>epdaH_conf_state=q2, epdaH_conf_history=h, epdaH_conf_stack=s2\\<rparr>\n  \\<longrightarrow> q1 \\<in> epda_marking G\n  \\<longrightarrow> q2 \\<in> epda_marking G\n  \\<longrightarrow> (n1=n2 \\<and> (\\<forall>i\\<le>n1. d1 i = d2 i))\"\n\nlemma epda_at_most_one_symbol_per_step: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> length(epdaH_conf_history c)\\<le>n\"\n  apply(induct n arbitrary: e c)\n   apply(rename_tac e c)(*strict*)\n   apply(clarsimp)\n   apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n  apply(rename_tac n e c)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac n e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      and d=\"d\"\n      and n=\"n\"\n      and m=\"Suc n\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac n e c)(*strict*)\n     apply(rule epdaH.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac n e c)(*strict*)\n    apply(force)\n   apply(rename_tac n e c)(*strict*)\n   apply(force)\n  apply(rename_tac n e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n c e1 e2 c1)(*strict*)\n  apply(simp add: epdaH_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac n c e1 e2 c1 w)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"c1\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(case_tac e2)\n  apply(rename_tac n c e1 e2 c1 w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n c e1 c1 w edge_event edge_pop edge_push)(*strict*)\n  apply(case_tac edge_event)\n   apply(rename_tac n c e1 c1 w edge_event edge_pop edge_push)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n c e1 c1 w edge_pop edge_push)(*strict*)\n   apply(simp add: option_to_list_def)\n  apply(rename_tac n c e1 c1 w edge_event edge_pop edge_push a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n c e1 c1 w edge_pop edge_push a)(*strict*)\n  apply(simp add: option_to_list_def)\n  done\n\nlemmas epdaH_interpretations =\n  epdaH_inst_AX_initial_configuration_belongs\n  epdaH_inst_AX_step_relation_preserves_belongs\n  epdaH_inst_ATS_axioms\n  epdaH_inst_ATS_History_axioms\n  epdaH_inst_ATS_SchedF_Basic_axioms\n  epdaH_inst_ATS_SchedF_SB_axioms\n  epdaH_inst_ATS_SchedF_DB_axioms\n  epdaH_inst_ATS_SchedF_SDB_axioms\n  epdaH_inst_ATS_determHIST_SB_axioms\n  epdaH_inst_ATS_Language_by_Finite_Derivations_axioms\n  epdaH_inst_ATS_HistoryCT_SB_axioms\n  epdaH_inst_ATS_HistoryCT_DB_axioms\n  epdaH_inst_BF_BraSBRest_DetHDB_LaOp_axioms\n  epdaH_inst_BF_BraSBRest_DetHSB_LaOp_axioms\n  epdaH_inst_BF_Bra_OpLa_axioms\n  epdaH_inst_BF_BraDBRest_DetHSB_LaOp_axioms\n  epdaH_inst_BF_BraDBRest_DetHDB_LaOp_axioms\n\ntheorem epdaH_is_forward_target_deterministic_accessible: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH.is_forward_target_deterministic_accessible G\"\n  apply(simp add: epdaH.is_forward_target_deterministic_accessible_def)\n  apply(clarsimp)\n  apply(rename_tac c c1 c2 e) (*strict*)\n  apply(simp add: epdaH_step_relation_def)\n  apply(clarsimp)\n  done\n\ndefinition min_stack :: \"\n  (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation\n  \\<Rightarrow> 'stack list\n  \\<Rightarrow> nat\n  \\<Rightarrow> nat\n  \\<Rightarrow> 'state option\"\n  where\n    \"min_stack d s n nX \\<equiv>\n  let\n    S = {i. \\<exists>e c.\n            n \\<le> i\n            \\<and> i \\<le> nX\n            \\<and> d i = Some (pair e c)\n            \\<and> epdaH_conf_stack c = s}\n  in\n    if S = {}\n    then None\n    else Some (epdaH_conf_state (the (get_configuration (d (Min S)))))\"\n\ndefinition epdaH_initial_marking_derivations_at_end :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation set\"\n  where\n    \"epdaH_initial_marking_derivations_at_end G \\<equiv>\n  {d. \\<exists>n e c.\n      epdaH.derivation_initial G d\n      \\<and> maximum_of_domain d n\n      \\<and> d n = Some (pair e c)\n      \\<and> c \\<in> epdaH_marking_configurations G}\"\n\ndefinition epdaH_no_livelocks_from_marking_states :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"epdaH_no_livelocks_from_marking_states G \\<equiv>\n  \\<forall>d n e c.\n  epdaH.derivation_initial G d\n  \\<and> d n = Some (pair (Some e) c)\n  \\<and> edge_src e \\<in> epda_marking G\n  \\<and> edge_event e = None\n  \\<longrightarrow> (\\<exists>m>n.\n        d m = None\n        \\<or> (\\<exists>e' c'.\n            d m = Some (pair (Some e') c')\n            \\<and> edge_event e' \\<noteq> None))\"\n\ndefinition epdaH_livelock :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"epdaH_livelock G \\<equiv>\n  \\<exists>d.\n  epdaH.derivation_initial G d\n  \\<and> (\\<forall>n. d n \\<noteq> None)\n  \\<and> (\\<exists>N. \\<forall>n\\<ge>N.\n      epdaH_conf_history (the(get_configuration(d n)))\n      = epdaH_conf_history (the(get_configuration(d N))))\"\n\nlemma epda_sub_preserves_derivation: \"\n  valid_epda G1\n  \\<Longrightarrow> valid_epda G2\n  \\<Longrightarrow> epda_sub G1 G2\n  \\<Longrightarrow> epdaH.derivation G1 d\n  \\<Longrightarrow> epdaH.derivation G2 d\"\n  apply(simp (no_asm) add: epdaH.derivation_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(simp add: epdaH.derivation_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x = \"0\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(case_tac \"d(Suc nat)\")\n   apply(rename_tac i nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat a)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i nat a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      n = \"nat\"\n      and m = \"Suc nat\"\n      and G = \"G1\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac i nat a)(*strict*)\n     apply(force)\n    apply(rename_tac i nat a)(*strict*)\n    apply(force)\n   apply(rename_tac i nat a)(*strict*)\n   apply(force)\n  apply(rename_tac i nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n  apply(simp add: epdaH_step_relation_def epda_sub_def)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2 w)(*strict*)\n  apply(force)\n  done\n\nlemma epda_sub_preserves_derivation_initial: \"\n  valid_epda G1\n  \\<Longrightarrow> valid_epda G2\n  \\<Longrightarrow> epda_sub G1 G2\n  \\<Longrightarrow> epdaH.derivation_initial G1 d\n  \\<Longrightarrow> epdaH.derivation_initial G2 d\"\n  apply(subgoal_tac \"epdaH.derivation G2 d\")\n   prefer 2\n   apply(rule epda_sub_preserves_derivation)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(simp add: epdaH.derivation_initial_def)\n  apply(simp add: epdaH.derivation_initial_def)\n  apply(clarsimp)\n  apply(case_tac \"d 0\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b)(*strict*)\n  apply(simp add: epdaH_initial_configurations_def epdaH_configurations_def epda_sub_def)\n  apply(clarsimp)\n  apply(force)\n  done\n\nlemma epda_sub_preserves_not_livelock: \"\n  valid_epda G1\n  \\<Longrightarrow> valid_epda G2\n  \\<Longrightarrow> epda_sub G1 G2\n  \\<Longrightarrow> \\<not> epdaH_livelock G2\n  \\<Longrightarrow> \\<not> epdaH_livelock G1\"\n  apply(simp add: epdaH_livelock_def)\n  apply(clarsimp)\n  apply(rename_tac d N)(*strict*)\n  apply(erule_tac\n      x=\"d\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac d N)(*strict*)\n   apply(rule_tac\n      ?G1.0=\"G1\"\n      in epda_sub_preserves_derivation_initial)\n      apply(rename_tac d N)(*strict*)\n      apply(force)\n     apply(rename_tac d N)(*strict*)\n     apply(force)\n    apply(rename_tac d N)(*strict*)\n    apply(force)\n   apply(rename_tac d N)(*strict*)\n   apply(force)\n  apply(rename_tac d N)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac d N)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d N n)(*strict*)\n   apply(erule_tac\n      x=\"n\"\n      in allE)\n   apply(force)\n  apply(rename_tac d N)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma valid_epda__no_livelock__implies__epdaH_no_livelocks_from_marking_states: \"\n   valid_epda G\n   \\<Longrightarrow> \\<not> epdaH_livelock G\n   \\<Longrightarrow> epdaH_no_livelocks_from_marking_states G\"\n  apply(simp add: epdaH_no_livelocks_from_marking_states_def epdaH_livelock_def)\n  apply(clarsimp)\n  apply(erule_tac x=\"d\" in allE)\n  apply(clarsimp)\n  apply(erule disjE)\n   apply(clarsimp)\n   apply(subgoal_tac \"n<na\")\n    apply(force)\n   apply (metis epdaH.derivationNoFromNone2_prime epdaH.derivation_initial_is_derivation is_none_code(1) is_none_code(2) nat_neq_iff)\n  apply(erule_tac x=\"n\" in allE)\n  apply(clarsimp)\n  apply(case_tac \"n=na\")\n   apply(force)\n  apply(subgoal_tac \"n<na\")\n   prefer 2\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac P=\"%na. n<na \\<and> epdaH_conf_history (the (get_configuration (d na))) \\<noteq>\n       epdaH_conf_history (the (get_configuration (Some (pair (Some e) c))))\" and n=\"na\" in ex_least_nat_le_prime)\n   apply(force)\n  apply(clarsimp)\n  apply(thin_tac \"epdaH_conf_history (the (get_configuration (d na))) \\<noteq>\n       epdaH_conf_history (the (get_configuration (Some (pair (Some e) c))))\")\n  apply(thin_tac \"k \\<le> na\")\n  apply(thin_tac \"edge_src e \\<in> epda_marking G\")\n  apply(thin_tac \"edge_event e = None\")\n  apply(case_tac k)\n   apply(clarsimp)\n  apply(clarsimp)\n  apply(rename_tac k)\n  apply(erule_tac x=\"k\" in allE)\n  apply(clarsimp)\n  apply(rule_tac x=\"Suc k\" in exI)\n  apply(clarsimp)\n  apply(case_tac \"d (Suc k)\")\n   apply(clarsimp)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(clarsimp)\n  apply(rename_tac ex cx)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac n=\"k\" and m=\"Suc k\" in epdaH.step_detail_before_some_position)\n     apply(simp add: epdaH.derivation_initial_def)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(simp add: get_configuration_def)\n  apply(simp add: epdaH_step_relation_def option_to_list_def)\n  apply(clarsimp)\n  apply(case_tac \"n=k\")\n   apply(clarsimp)\n  apply(clarsimp)\n  done\n\nlemma epdaH_epda_box_stays_at_bottom: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> suffix (epdaH_conf_stack c) [epda_box G]\"\n  apply(induct n arbitrary: e c)\n   apply(rename_tac e c)(*strict*)\n   apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def suffix_def)\n  apply(rename_tac n e c)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac n e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d = \"d\"\n      and n = \"n\"\n      and m = \"Suc n\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac n e c)(*strict*)\n     apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def suffix_def)\n     apply(force)\n    apply(rename_tac n e c)(*strict*)\n    apply(force)\n   apply(rename_tac n e c)(*strict*)\n   apply(force)\n  apply(rename_tac n e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n c e1 e2 c1)(*strict*)\n  apply(erule_tac\n      x = \"e1\"\n      in meta_allE)\n  apply(erule_tac\n      x = \"c1\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(simp add: valid_epda_def)\n  apply(clarsimp)\n  apply(erule_tac\n      x = \"e2\"\n      in ballE)\n   apply(rename_tac n c e1 e2 c1)(*strict*)\n   prefer 2\n   apply(simp add: epdaH_step_relation_def)\n  apply(rename_tac n c e1 e2 c1)(*strict*)\n  apply(simp add: valid_epda_step_label_def)\n  apply(clarsimp)\n  apply(case_tac c)\n  apply(rename_tac n c e1 e2 c1 epdaH_conf_state epdaH_conf_history epdaH_conf_stacka)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac n c e1 e2 c1 epdaH_conf_state epdaH_conf_history epdaH_conf_stacka epdaH_conf_statea epdaH_conf_historya epdaH_conf_stackaa)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac n c e1 e2 c1 epdaH_conf_state epdaH_conf_history epdaH_conf_stacka epdaH_conf_statea epdaH_conf_historya epdaH_conf_stackaa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n e1 epdaH_conf_state epdaH_conf_history epdaH_conf_stack epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n  apply(simp add: epdaH_step_relation_def may_terminated_by_def must_terminated_by_def append_language_def kleene_star_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg c a aa w)(*strict*)\n  apply(erule disjE)+\n    apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg c a aa w)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w)(*strict*)\n    apply(rule_tac\n      xs = \"w\"\n      in rev_cases)\n     apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w ys y)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg c a aa w)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg c a aa w)(*strict*)\n  apply(erule disjE)+\n   apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg c a aa w)(*strict*)\n   apply(clarsimp)+\n  apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w)(*strict*)\n  apply(rule_tac\n      xs = \"w\"\n      in rev_cases)\n   apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w ys y)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma epdaH_epda_box_stays_at_bottom2: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> \\<exists>w. epdaH_conf_stack c = w @ [epda_box G] \\<and> set w \\<subseteq> epda_gamma G - {epda_box G}\"\n  apply(induct n arbitrary: e c)\n   apply(rename_tac e c)(*strict*)\n   apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def suffix_def)\n  apply(rename_tac n e c)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac n e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d = \"d\"\n      and n = \"n\"\n      and m = \"Suc n\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac n e c)(*strict*)\n     apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def suffix_def)\n     apply(force)\n    apply(rename_tac n e c)(*strict*)\n    apply(force)\n   apply(rename_tac n e c)(*strict*)\n   apply(force)\n  apply(rename_tac n e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n c e1 e2 c1)(*strict*)\n  apply(erule_tac\n      x = \"e1\"\n      in meta_allE)\n  apply(erule_tac\n      x = \"c1\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(simp add: valid_epda_def)\n  apply(clarsimp)\n  apply(erule_tac\n      x = \"e2\"\n      in ballE)\n   apply(rename_tac n c e1 e2 c1 w)(*strict*)\n   prefer 2\n   apply(simp add: epdaH_step_relation_def)\n  apply(rename_tac n c e1 e2 c1 w)(*strict*)\n  apply(simp add: valid_epda_step_label_def)\n  apply(clarsimp)\n  apply(case_tac c)\n  apply(rename_tac n c e1 e2 c1 w epdaH_conf_state epdaH_conf_history epdaH_conf_stacka)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac n c e1 e2 c1 w epdaH_conf_state epdaH_conf_history epdaH_conf_stacka epdaH_conf_statea epdaH_conf_historya epdaH_conf_stackaa)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac n c e1 e2 c1 w epdaH_conf_state epdaH_conf_history epdaH_conf_stacka epdaH_conf_statea epdaH_conf_historya epdaH_conf_stackaa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n e1 epdaH_conf_state epdaH_conf_history epdaH_conf_stack epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n  apply(simp add: epdaH_step_relation_def may_terminated_by_def must_terminated_by_def append_language_def kleene_star_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg c a aa w)(*strict*)\n  apply(erule disjE)+\n    apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg c a aa w)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w)(*strict*)\n    apply(rule_tac\n      xs = \"w\"\n      in rev_cases)\n     apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w ys y)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg c a aa w)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg c a aa w)(*strict*)\n  apply(erule disjE)+\n   apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_pop edge_push edge_trg c a aa w)(*strict*)\n   apply(clarsimp)+\n  apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w)(*strict*)\n  apply(rule_tac\n      xs = \"w\"\n      in rev_cases)\n   apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n e1 epdaH_conf_historya edge_src edge_event edge_trg c a aa w ys y)(*strict*)\n  apply(clarsimp)\n  done\n\ndefinition epdaH_step_relation_explicit1 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> ('state, 'event, 'stack) epda_step_label\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> bool\"\n  where\n    \"epdaH_step_relation_explicit1 G c1 e c2 \\<equiv>\n  \\<exists>q1 q2 h s1 s2 s.\n     c1 = \\<lparr>epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = s1 @ s @ [epda_box G]\\<rparr>\n    \\<and> e = \\<lparr>edge_src = q1, edge_event = None, edge_pop = s1, edge_push = s2, edge_trg = q2\\<rparr>\n    \\<and> c2 = \\<lparr>epdaH_conf_state = q2, epdaH_conf_history = h, epdaH_conf_stack = s2 @ s @ [epda_box G]\\<rparr>\n    \\<and> set (s1 @ s2 @ s) \\<subseteq> epda_gamma G - {epda_box G}\"\n\ndefinition epdaH_step_relation_explicit2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> ('state, 'event, 'stack) epda_step_label\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> bool\"\n  where\n    \"epdaH_step_relation_explicit2 G c1 e c2 \\<equiv>\n  \\<exists>q1 q2 h s1 s2 s.\n     c1 = \\<lparr>epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = s1 @ [epda_box G]\\<rparr>\n    \\<and> e = \\<lparr>edge_src = q1, edge_event = None, edge_pop = s1 @ [epda_box G], edge_push = s2 @ [epda_box G], edge_trg = q2\\<rparr>\n    \\<and> c2 = \\<lparr>epdaH_conf_state = q2, epdaH_conf_history = h, epdaH_conf_stack = s2 @ [epda_box G]\\<rparr>\n    \\<and> set (s1 @ s2 @ s) \\<subseteq> epda_gamma G - {epda_box G}\"\n\ndefinition epdaH_step_relation_explicit3 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> ('state, 'event, 'stack) epda_step_label\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> bool\"\n  where\n    \"epdaH_step_relation_explicit3 G c1 e c2 \\<equiv>\n  \\<exists>q1 q2 h s1 s2 s a.\n     c1 = \\<lparr>epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = s1 @ s @ [epda_box G]\\<rparr>\n    \\<and> e = \\<lparr>edge_src = q1, edge_event = Some a, edge_pop = s1, edge_push = s2, edge_trg = q2\\<rparr>\n    \\<and> c2 = \\<lparr>epdaH_conf_state = q2, epdaH_conf_history = h @ [a], epdaH_conf_stack = s2 @ s @ [epda_box G]\\<rparr>\n    \\<and> set (s1 @ s2 @ s) \\<subseteq> epda_gamma G - {epda_box G}\"\n\ndefinition epdaH_step_relation_explicit4 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> ('state, 'event, 'stack) epda_step_label\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> bool\"\n  where\n    \"epdaH_step_relation_explicit4 G c1 e c2 \\<equiv>\n  \\<exists>q1 q2 h s1 s2 s a.\n     c1 = \\<lparr>epdaH_conf_state = q1, epdaH_conf_history = h, epdaH_conf_stack = s1 @ [epda_box G]\\<rparr>\n    \\<and> e = \\<lparr>edge_src = q1, edge_event = Some a, edge_pop = s1 @ [epda_box G], edge_push = s2 @ [epda_box G], edge_trg = q2\\<rparr>\n    \\<and> c2 = \\<lparr>epdaH_conf_state = q2, epdaH_conf_history = h @ [a], epdaH_conf_stack = s2 @ [epda_box G]\\<rparr>\n    \\<and> set (s1 @ s2 @ s) \\<subseteq> epda_gamma G - {epda_box G}\"\n\ndefinition epdaH_step_relation_explicit :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> ('state, 'event, 'stack) epda_step_label\n  \\<Rightarrow> ('state, 'event, 'stack) epdaH_conf\n  \\<Rightarrow> bool\"\n  where\n    \"epdaH_step_relation_explicit G c1 e c2 \\<equiv>\n  e \\<in> epda_delta G\n  \\<and> (\n      epdaH_step_relation_explicit1 G c1 e c2\n    \\<or> epdaH_step_relation_explicit2 G c1 e c2\n    \\<or> epdaH_step_relation_explicit3 G c1 e c2\n    \\<or> epdaH_step_relation_explicit4 G c1 e c2\n  )\"\n\nlemma epdaH_step_relation_explicit1__intro: \"\n  epdaH_step_relation_explicit1 G c1 e c2\n  \\<Longrightarrow> e \\<in> epda_delta G\n  \\<Longrightarrow> epdaH_step_relation_explicit G c1 e c2\"\n  apply(simp add: epdaH_step_relation_explicit_def)\n  done\n\nlemma epdaH_step_relation_explicit2__intro: \"\n  epdaH_step_relation_explicit2 G c1 e c2\n  \\<Longrightarrow> e \\<in> epda_delta G\n  \\<Longrightarrow> epdaH_step_relation_explicit G c1 e c2\"\n  apply(simp add: epdaH_step_relation_explicit_def)\n  done\n\nlemma epdaH_step_relation_explicit3__intro: \"\n  epdaH_step_relation_explicit3 G c1 e c2\n  \\<Longrightarrow> e \\<in> epda_delta G\n  \\<Longrightarrow> epdaH_step_relation_explicit G c1 e c2\"\n  apply(simp add: epdaH_step_relation_explicit_def)\n  done\n\nlemma epdaH_step_relation_explicit4__intro: \"\n  epdaH_step_relation_explicit4 G c1 e c2\n  \\<Longrightarrow> e \\<in> epda_delta G\n  \\<Longrightarrow> epdaH_step_relation_explicit G c1 e c2\"\n  apply(simp add: epdaH_step_relation_explicit_def)\n  done\n\nlemma epdaH_step_relation__vs__epdaH_step_relation_explicit: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d n = Some (pair ex c1)\n  \\<Longrightarrow> epdaH_step_relation G c1 e c2 = epdaH_step_relation_explicit G c1 e c2\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule epdaH_epda_box_stays_at_bottom2)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"c1 \\<in> epdaH_configurations G\")\n   prefer 2\n   apply (metis (full_types) epdaH.derivation_initial_configurations) \n  apply(rule antisym)\n   apply(simp add: epdaH_step_relation_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"valid_epda_step_label G e\")\n    prefer 2\n    apply(simp add: valid_epda_def)\n   apply(subgoal_tac \"c2 \\<in> epdaH_configurations G\")\n    prefer 2\n    apply (metis (erased, hide_lams) epdaH_inst_AX_step_relation_preserves_belongs epdaH_step_relation_def)  \n   apply(case_tac c1)\n   apply(case_tac c2)\n   apply(clarsimp)\n   apply(rename_tac h)\n   apply(case_tac e)\n   apply(rename_tac q1 x w1 w2 q2)\n   apply(clarsimp)\n   apply(case_tac x)\n    apply(clarsimp)\n    apply(simp add: option_to_list_def)\n    apply(case_tac \"\\<exists>w. w1=w@[epda_box G]\")\n     prefer 2\n     apply(rule epdaH_step_relation_explicit1__intro)\n      apply(simp add: epdaH_step_relation_explicit1_def)\n      apply(rule_tac xs=\"wa\" in rev_cases)\n       apply(clarsimp)\n      apply(clarsimp)\n      apply(simp add: valid_epda_step_label_def epdaH_configurations_def)\n      apply(clarsimp)\n      apply(simp add: may_terminated_by_def must_terminated_by_def append_language_def kleene_star_def)\n      apply(clarsimp)        \n      apply(force)\n     apply(force)\n    apply(rule epdaH_step_relation_explicit2__intro)\n     apply(simp add: epdaH_step_relation_explicit2_def)\n     apply(rule_tac xs=\"wa\" in rev_cases)\n      prefer 2\n      apply(clarsimp)\n     apply(clarsimp)\n     apply(simp add: valid_epda_step_label_def epdaH_configurations_def)\n     apply(clarsimp)\n     apply(simp add: may_terminated_by_def must_terminated_by_def append_language_def kleene_star_def)\n     apply(clarsimp)        \n     apply(force)\n    apply(force)\n   apply(clarsimp)\n   apply(simp add: option_to_list_def)\n   apply(case_tac \"\\<exists>w. w1=w@[epda_box G]\")\n    prefer 2\n    apply(rule epdaH_step_relation_explicit3__intro)\n     apply(simp add: epdaH_step_relation_explicit3_def)\n     apply(rule_tac xs=\"wa\" in rev_cases)\n      apply(clarsimp)\n     apply(clarsimp)\n     apply(simp add: valid_epda_step_label_def epdaH_configurations_def)\n     apply(clarsimp)\n     apply(simp add: may_terminated_by_def must_terminated_by_def append_language_def kleene_star_def)\n     apply(clarsimp)        \n     apply(force)\n    apply(force)\n   apply(rule epdaH_step_relation_explicit4__intro)\n    apply(simp add: epdaH_step_relation_explicit4_def)\n    apply(rule_tac xs=\"wa\" in rev_cases)\n     prefer 2\n     apply(clarsimp)\n    apply(clarsimp)\n    apply(simp add: valid_epda_step_label_def epdaH_configurations_def)\n    apply(clarsimp)\n    apply(simp add: may_terminated_by_def must_terminated_by_def append_language_def kleene_star_def)\n    apply(clarsimp)        \n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(simp add: epdaH_step_relation_explicit_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"valid_epda_step_label G e\")\n   prefer 2\n   apply(simp add: valid_epda_def)\n  apply(case_tac c1)\n  apply(rename_tac q1 h1 s1)\n  apply(case_tac c2)\n  apply(rename_tac q2 h2 s2)\n  apply(clarsimp)\n  apply(case_tac e)\n  apply(rename_tac qS x w1 w2 qT)\n  apply(clarsimp)\n  apply(erule disjE)\n   apply(simp add: epdaH_step_relation_explicit1_def epdaH_step_relation_def option_to_list_def)\n   apply(clarsimp)\n  apply(erule disjE)\n   apply(simp add: epdaH_step_relation_explicit2_def epdaH_step_relation_def option_to_list_def)\n   apply(clarsimp)\n  apply(erule disjE)\n   apply(simp add: epdaH_step_relation_explicit3_def epdaH_step_relation_def option_to_list_def)\n   apply(clarsimp)\n  apply(simp add: epdaH_step_relation_explicit4_def epdaH_step_relation_def option_to_list_def)\n  apply(clarsimp)\n  done \n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_07/I_epda_H.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6757646010190477, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.34579996721273204}}
{"text": "section \\<open>Operational Semantics\\<close>\n\ntheory OG_Tran imports OG_Com begin\n\ntype_synonym 'a ann_com_op = \"('a ann_com) option\"\ntype_synonym 'a ann_triple_op = \"('a ann_com_op \\<times> 'a assn)\"\n\nprimrec com :: \"'a ann_triple_op \\<Rightarrow> 'a ann_com_op\" where\n  \"com (c, q) = c\"\n\nprimrec post :: \"'a ann_triple_op \\<Rightarrow> 'a assn\" where\n  \"post (c, q) = q\"\n\ndefinition All_None :: \"'a ann_triple_op list \\<Rightarrow> bool\" where\n  \"All_None Ts \\<equiv> \\<forall>(c, q) \\<in> set Ts. c = None\"\n\nsubsection \\<open>The Transition Relation\\<close>\n\ninductive_set\n  ann_transition :: \"(('a ann_com_op \\<times> 'a) \\<times> ('a ann_com_op \\<times> 'a)) set\"\n  and transition :: \"(('a com \\<times> 'a) \\<times> ('a com \\<times> 'a)) set\"\n  and ann_transition' :: \"('a ann_com_op \\<times> 'a) \\<Rightarrow> ('a ann_com_op \\<times> 'a) \\<Rightarrow> bool\"\n    (\"_ -1\\<rightarrow> _\"[81,81] 100)\n  and transition' :: \"('a com \\<times> 'a) \\<Rightarrow> ('a com \\<times> 'a) \\<Rightarrow> bool\"\n    (\"_ -P1\\<rightarrow> _\"[81,81] 100)\n  and transitions :: \"('a com \\<times> 'a) \\<Rightarrow> ('a com \\<times> 'a) \\<Rightarrow> bool\"\n    (\"_ -P*\\<rightarrow> _\"[81,81] 100)\nwhere\n  \"con_0 -1\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> ann_transition\"\n| \"con_0 -P1\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> transition\"\n| \"con_0 -P*\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> transition\\<^sup>*\"\n\n| AnnBasic:  \"(Some (AnnBasic r f), s) -1\\<rightarrow> (None, f s)\"\n\n| AnnSeq1: \"(Some c0, s) -1\\<rightarrow> (None, t) \\<Longrightarrow>\n               (Some (AnnSeq c0 c1), s) -1\\<rightarrow> (Some c1, t)\"\n| AnnSeq2: \"(Some c0, s) -1\\<rightarrow> (Some c2, t) \\<Longrightarrow>\n               (Some (AnnSeq c0 c1), s) -1\\<rightarrow> (Some (AnnSeq c2 c1), t)\"\n\n| AnnCond1T: \"s \\<in> b  \\<Longrightarrow> (Some (AnnCond1 r b c1 c2), s) -1\\<rightarrow> (Some c1, s)\"\n| AnnCond1F: \"s \\<notin> b \\<Longrightarrow> (Some (AnnCond1 r b c1 c2), s) -1\\<rightarrow> (Some c2, s)\"\n\n| AnnCond2T: \"s \\<in> b  \\<Longrightarrow> (Some (AnnCond2 r b c), s) -1\\<rightarrow> (Some c, s)\"\n| AnnCond2F: \"s \\<notin> b \\<Longrightarrow> (Some (AnnCond2 r b c), s) -1\\<rightarrow> (None, s)\"\n\n| AnnWhileF: \"s \\<notin> b \\<Longrightarrow> (Some (AnnWhile r b i c), s) -1\\<rightarrow> (None, s)\"\n| AnnWhileT: \"s \\<in> b  \\<Longrightarrow> (Some (AnnWhile r b i c), s) -1\\<rightarrow>\n                         (Some (AnnSeq c (AnnWhile i b i c)), s)\"\n\n| AnnAwait: \"\\<lbrakk> s \\<in> b; atom_com c; (c, s) -P*\\<rightarrow> (Parallel [], t) \\<rbrakk> \\<Longrightarrow>\n                   (Some (AnnAwait r b c), s) -1\\<rightarrow> (None, t)\"\n\n| Parallel: \"\\<lbrakk> i<length Ts; Ts!i = (Some c, q); (Some c, s) -1\\<rightarrow> (r, t) \\<rbrakk>\n              \\<Longrightarrow> (Parallel Ts, s) -P1\\<rightarrow> (Parallel (Ts [i:=(r, q)]), t)\"\n\n| Basic:  \"(Basic f, s) -P1\\<rightarrow> (Parallel [], f s)\"\n\n| Seq1:   \"All_None Ts \\<Longrightarrow> (Seq (Parallel Ts) c, s) -P1\\<rightarrow> (c, s)\"\n| Seq2:   \"(c0, s) -P1\\<rightarrow> (c2, t) \\<Longrightarrow> (Seq c0 c1, s) -P1\\<rightarrow> (Seq c2 c1, t)\"\n\n| CondT: \"s \\<in> b \\<Longrightarrow> (Cond b c1 c2, s) -P1\\<rightarrow> (c1, s)\"\n| CondF: \"s \\<notin> b \\<Longrightarrow> (Cond b c1 c2, s) -P1\\<rightarrow> (c2, s)\"\n\n| WhileF: \"s \\<notin> b \\<Longrightarrow> (While b i c, s) -P1\\<rightarrow> (Parallel [], s)\"\n| WhileT: \"s \\<in> b \\<Longrightarrow> (While b i c, s) -P1\\<rightarrow> (Seq c (While b i c), s)\"\n\nmonos \"rtrancl_mono\"\n\ntext \\<open>The corresponding abbreviations are:\\<close>\n\nabbreviation\n  ann_transition_n :: \"('a ann_com_op \\<times> 'a) \\<Rightarrow> nat \\<Rightarrow> ('a ann_com_op \\<times> 'a)\n                           \\<Rightarrow> bool\"  (\"_ -_\\<rightarrow> _\"[81,81] 100)  where\n  \"con_0 -n\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> ann_transition ^^ n\"\n\nabbreviation\n  ann_transitions :: \"('a ann_com_op \\<times> 'a) \\<Rightarrow> ('a ann_com_op \\<times> 'a) \\<Rightarrow> bool\"\n                           (\"_ -*\\<rightarrow> _\"[81,81] 100)  where\n  \"con_0 -*\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> ann_transition\\<^sup>*\"\n\nabbreviation\n  transition_n :: \"('a com \\<times> 'a) \\<Rightarrow> nat \\<Rightarrow> ('a com \\<times> 'a) \\<Rightarrow> bool\"\n                          (\"_ -P_\\<rightarrow> _\"[81,81,81] 100)  where\n  \"con_0 -Pn\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> transition ^^ n\"\n\nsubsection \\<open>Definition of Semantics\\<close>\n\ndefinition ann_sem :: \"'a ann_com \\<Rightarrow> 'a \\<Rightarrow> 'a set\" where\n  \"ann_sem c \\<equiv> \\<lambda>s. {t. (Some c, s) -*\\<rightarrow> (None, t)}\"\n\ndefinition ann_SEM :: \"'a ann_com \\<Rightarrow> 'a set \\<Rightarrow> 'a set\" where\n  \"ann_SEM c S \\<equiv> \\<Union>(ann_sem c ` S)\"\n\ndefinition sem :: \"'a com \\<Rightarrow> 'a \\<Rightarrow> 'a set\" where\n  \"sem c \\<equiv> \\<lambda>s. {t. \\<exists>Ts. (c, s) -P*\\<rightarrow> (Parallel Ts, t) \\<and> All_None Ts}\"\n\ndefinition SEM :: \"'a com \\<Rightarrow> 'a set \\<Rightarrow> 'a set\" where\n  \"SEM c S \\<equiv> \\<Union>(sem c ` S)\"\n\nabbreviation Omega :: \"'a com\"    (\"\\<Omega>\" 63)\n  where \"\\<Omega> \\<equiv> While UNIV UNIV (Basic id)\"\n\nprimrec fwhile :: \"'a bexp \\<Rightarrow> 'a com \\<Rightarrow> nat \\<Rightarrow> 'a com\" where\n    \"fwhile b c 0 = \\<Omega>\"\n  | \"fwhile b c (Suc n) = Cond b (Seq c (fwhile b c n)) (Basic id)\"\n\nsubsubsection \\<open>Proofs\\<close>\n\ndeclare ann_transition_transition.intros [intro]\ninductive_cases transition_cases:\n    \"(Parallel T,s) -P1\\<rightarrow> t\"\n    \"(Basic f, s) -P1\\<rightarrow> t\"\n    \"(Seq c1 c2, s) -P1\\<rightarrow> t\"\n    \"(Cond b c1 c2, s) -P1\\<rightarrow> t\"\n    \"(While b i c, s) -P1\\<rightarrow> t\"\n\nlemma Parallel_empty_lemma [rule_format (no_asm)]:\n  \"(Parallel [],s) -Pn\\<rightarrow> (Parallel Ts,t) \\<longrightarrow> Ts=[] \\<and> n=0 \\<and> s=t\"\napply(induct n)\n apply(simp (no_asm))\napply clarify\napply(drule relpow_Suc_D2)\napply(force elim:transition_cases)\ndone\n\nlemma Parallel_AllNone_lemma [rule_format (no_asm)]:\n \"All_None Ss \\<longrightarrow> (Parallel Ss,s) -Pn\\<rightarrow> (Parallel Ts,t) \\<longrightarrow> Ts=Ss \\<and> n=0 \\<and> s=t\"\napply(induct \"n\")\n apply(simp (no_asm))\napply clarify\napply(drule relpow_Suc_D2)\napply clarify\napply(erule transition_cases,simp_all)\napply(force dest:nth_mem simp add:All_None_def)\ndone\n\nlemma Parallel_AllNone: \"All_None Ts \\<Longrightarrow> (SEM (Parallel Ts) X) = X\"\napply (unfold SEM_def sem_def)\napply auto\napply(drule rtrancl_imp_UN_relpow)\napply clarify\napply(drule Parallel_AllNone_lemma)\napply auto\ndone\n\nlemma Parallel_empty: \"Ts=[] \\<Longrightarrow> (SEM (Parallel Ts) X) = X\"\napply(rule Parallel_AllNone)\napply(simp add:All_None_def)\ndone\n\ntext \\<open>Set of lemmas from Apt and Olderog \"Verification of sequential\nand concurrent programs\", page 63.\\<close>\n\nlemma L3_5i: \"X\\<subseteq>Y \\<Longrightarrow> SEM c X \\<subseteq> SEM c Y\"\napply (unfold SEM_def)\napply force\ndone\n\nlemma L3_5ii_lemma1:\n \"\\<lbrakk> (c1, s1) -P*\\<rightarrow> (Parallel Ts, s2); All_None Ts;\n  (c2, s2) -P*\\<rightarrow> (Parallel Ss, s3); All_None Ss \\<rbrakk>\n \\<Longrightarrow> (Seq c1 c2, s1) -P*\\<rightarrow> (Parallel Ss, s3)\"\napply(erule converse_rtrancl_induct2)\napply(force intro:converse_rtrancl_into_rtrancl)+\ndone\n\nlemma L3_5ii_lemma2 [rule_format (no_asm)]:\n \"\\<forall>c1 c2 s t. (Seq c1 c2, s) -Pn\\<rightarrow> (Parallel Ts, t) \\<longrightarrow>\n  (All_None Ts) \\<longrightarrow> (\\<exists>y m Rs. (c1,s) -P*\\<rightarrow> (Parallel Rs, y) \\<and>\n  (All_None Rs) \\<and> (c2, y) -Pm\\<rightarrow> (Parallel Ts, t) \\<and>  m \\<le> n)\"\napply(induct \"n\")\n apply(force)\napply(safe dest!: relpow_Suc_D2)\napply(erule transition_cases,simp_all)\n apply (fast intro!: le_SucI)\napply (fast intro!: le_SucI elim!: relpow_imp_rtrancl converse_rtrancl_into_rtrancl)\ndone\n\nlemma L3_5ii_lemma3:\n \"\\<lbrakk>(Seq c1 c2,s) -P*\\<rightarrow> (Parallel Ts,t); All_None Ts\\<rbrakk> \\<Longrightarrow>\n    (\\<exists>y Rs. (c1,s) -P*\\<rightarrow> (Parallel Rs,y) \\<and> All_None Rs\n   \\<and> (c2,y) -P*\\<rightarrow> (Parallel Ts,t))\"\napply(drule rtrancl_imp_UN_relpow)\napply(fast dest: L3_5ii_lemma2 relpow_imp_rtrancl)\ndone\n\nlemma L3_5ii: \"SEM (Seq c1 c2) X = SEM c2 (SEM c1 X)\"\napply (unfold SEM_def sem_def)\napply auto\n apply(fast dest: L3_5ii_lemma3)\napply(fast elim: L3_5ii_lemma1)\ndone\n\nlemma L3_5iii: \"SEM (Seq (Seq c1 c2) c3) X = SEM (Seq c1 (Seq c2 c3)) X\"\napply (simp (no_asm) add: L3_5ii)\ndone\n\nlemma L3_5iv:\n \"SEM (Cond b c1 c2) X = (SEM c1 (X \\<inter> b)) Un (SEM c2 (X \\<inter> (-b)))\"\napply (unfold SEM_def sem_def)\napply auto\napply(erule converse_rtranclE)\n prefer 2\n apply (erule transition_cases,simp_all)\n  apply(fast intro: converse_rtrancl_into_rtrancl elim: transition_cases)+\ndone\n\n\nlemma  L3_5v_lemma1[rule_format]:\n \"(S,s) -Pn\\<rightarrow> (T,t) \\<longrightarrow> S=\\<Omega> \\<longrightarrow> (\\<not>(\\<exists>Rs. T=(Parallel Rs) \\<and> All_None Rs))\"\napply (unfold UNIV_def)\napply(rule nat_less_induct)\napply safe\napply(erule relpow_E2)\n apply simp_all\napply(erule transition_cases)\n apply simp_all\napply(erule relpow_E2)\n apply(simp add: Id_def)\napply(erule transition_cases,simp_all)\napply clarify\napply(erule transition_cases,simp_all)\napply(erule relpow_E2,simp)\napply clarify\napply(erule transition_cases)\n apply simp+\n    apply clarify\n    apply(erule transition_cases)\napply simp_all\ndone\n\nlemma L3_5v_lemma2: \"\\<lbrakk>(\\<Omega>, s) -P*\\<rightarrow> (Parallel Ts, t); All_None Ts \\<rbrakk> \\<Longrightarrow> False\"\napply(fast dest: rtrancl_imp_UN_relpow L3_5v_lemma1)\ndone\n\nlemma L3_5v_lemma3: \"SEM (\\<Omega>) S = {}\"\napply (unfold SEM_def sem_def)\napply(fast dest: L3_5v_lemma2)\ndone\n\nlemma L3_5v_lemma4 [rule_format]:\n \"\\<forall>s. (While b i c, s) -Pn\\<rightarrow> (Parallel Ts, t) \\<longrightarrow> All_None Ts \\<longrightarrow>\n  (\\<exists>k. (fwhile b c k, s) -P*\\<rightarrow> (Parallel Ts, t))\"\napply(rule nat_less_induct)\napply safe\napply(erule relpow_E2)\n apply safe\napply(erule transition_cases,simp_all)\n apply (rule_tac x = \"1\" in exI)\n apply(force dest: Parallel_empty_lemma intro: converse_rtrancl_into_rtrancl simp add: Id_def)\napply safe\napply(drule L3_5ii_lemma2)\n apply safe\napply(drule le_imp_less_Suc)\napply (erule allE , erule impE,assumption)\napply (erule allE , erule impE, assumption)\napply safe\napply (rule_tac x = \"k+1\" in exI)\napply(simp (no_asm))\napply(rule converse_rtrancl_into_rtrancl)\n apply fast\napply(fast elim: L3_5ii_lemma1)\ndone\n\nlemma L3_5v_lemma5 [rule_format]:\n \"\\<forall>s. (fwhile b c k, s) -P*\\<rightarrow> (Parallel Ts, t) \\<longrightarrow> All_None Ts \\<longrightarrow>\n  (While b i c, s) -P*\\<rightarrow> (Parallel Ts,t)\"\napply(induct \"k\")\n apply(force dest: L3_5v_lemma2)\napply safe\napply(erule converse_rtranclE)\n apply simp_all\napply(erule transition_cases,simp_all)\n apply(rule converse_rtrancl_into_rtrancl)\n  apply(fast)\n apply(fast elim!: L3_5ii_lemma1 dest: L3_5ii_lemma3)\napply(drule rtrancl_imp_UN_relpow)\napply clarify\napply(erule relpow_E2)\n apply simp_all\napply(erule transition_cases,simp_all)\napply(fast dest: Parallel_empty_lemma)\ndone\n\nlemma L3_5v: \"SEM (While b i c) = (\\<lambda>x. (\\<Union>k. SEM (fwhile b c k) x))\"\napply(rule ext)\napply (simp add: SEM_def sem_def)\napply safe\n apply(drule rtrancl_imp_UN_relpow,simp)\n apply clarify\n apply(fast dest:L3_5v_lemma4)\napply(fast intro: L3_5v_lemma5)\ndone\n\nsection \\<open>Validity of Correctness Formulas\\<close>\n\ndefinition com_validity :: \"'a assn \\<Rightarrow> 'a com \\<Rightarrow> 'a assn \\<Rightarrow> bool\" (\"(3\\<parallel>= _// _//_)\" [90,55,90] 50) where\n  \"\\<parallel>= p c q \\<equiv> SEM c p \\<subseteq> q\"\n\ndefinition ann_com_validity :: \"'a ann_com \\<Rightarrow> 'a assn \\<Rightarrow> bool\" (\"\\<Turnstile> _ _\" [60,90] 45) where\n  \"\\<Turnstile> c q \\<equiv> ann_SEM c (pre c) \\<subseteq> q\"\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Hoare_Parallel/OG_Tran.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.34578794628462917}}
{"text": "section \\<open>Deep embedding of Pure terms into term-rewriting logic\\<close>\n\ntheory Embed\nimports\n  Constructor_Funs.Constructor_Funs\n  \"../Utils/Code_Utils\"\n  Eval_Class\nkeywords \"embed\" :: thy_decl\nbegin\n\nfun non_overlapping' :: \"term \\<Rightarrow> term \\<Rightarrow> bool\" where\n\"non_overlapping' (Const x) (Const y) \\<longleftrightarrow> x \\<noteq> y\" |\n\"non_overlapping' (Const _) (_ $ _) \\<longleftrightarrow> True\" |\n\"non_overlapping' (_ $ _) (Const _) \\<longleftrightarrow> True\" |\n\"non_overlapping' (t\\<^sub>1 $ t\\<^sub>2) (u\\<^sub>1 $ u\\<^sub>2) \\<longleftrightarrow> non_overlapping' t\\<^sub>1 u\\<^sub>1 \\<or> non_overlapping' t\\<^sub>2 u\\<^sub>2\" |\n\"non_overlapping' _ _ \\<longleftrightarrow> False\"\n\nlemma non_overlapping_approx:\n  assumes \"non_overlapping' t u\"\n  shows \"non_overlapping t u\"\nusing assms\nby (induct t u rule: non_overlapping'.induct) fastforce+\n\nfun pattern_compatible' :: \"term \\<Rightarrow> term \\<Rightarrow> bool\" where\n\"pattern_compatible' (t\\<^sub>1 $ t\\<^sub>2) (u\\<^sub>1 $ u\\<^sub>2) \\<longleftrightarrow> pattern_compatible' t\\<^sub>1 u\\<^sub>1 \\<and> (t\\<^sub>1 = u\\<^sub>1 \\<longrightarrow> pattern_compatible' t\\<^sub>2 u\\<^sub>2)\" |\n\"pattern_compatible' t u \\<longleftrightarrow> t = u \\<or> non_overlapping' t u\"\n\nlemma pattern_compatible_approx:\n  assumes \"pattern_compatible' t u\"\n  shows \"pattern_compatible t u\"\nusing assms\nproof (induction t u rule: pattern_compatible.induct)\n  case \"2_1\" (* FIXME intro rule setup for non_overlapping is broken *)\n  thus ?case\n    by (force simp: non_overlapping_approx)\nnext\n  case \"2_5\"\n  thus ?case\n    by (force simp: non_overlapping_approx)\nqed auto\n\nabbreviation pattern_compatibles' :: \"(term \\<times> 'a) fset \\<Rightarrow> bool\" where\n\"pattern_compatibles' \\<equiv> fpairwise (\\<lambda>(lhs\\<^sub>1, _) (lhs\\<^sub>2, _). pattern_compatible' lhs\\<^sub>1 lhs\\<^sub>2)\"\n\ndefinition rules' :: \"C_info \\<Rightarrow> rule fset \\<Rightarrow> bool\" where\n\"rules' C_info rs \\<longleftrightarrow>\n  fBall rs rule \\<and>\n  arity_compatibles rs \\<and>\n  is_fmap rs \\<and>\n  pattern_compatibles' rs \\<and>\n  rs \\<noteq> {||} \\<and>\n  fBall rs (\\<lambda>(lhs, _). \\<not> pre_constants.shadows_consts C_info (heads_of rs) lhs) \\<and>\n  fdisjnt (heads_of rs) (constructors.C C_info) \\<and>\n  fBall rs (\\<lambda>(_, rhs). pre_constants.welldefined C_info (heads_of rs) rhs) \\<and>\n  distinct (constructors.all_constructors C_info)\"\n\nlemma rules_approx:\n  assumes \"rules' C_info rs\"\n  shows \"rules C_info rs\"\nproof\n  show \"fBall rs rule\" \"arity_compatibles rs\" \"is_fmap rs\" \"rs \\<noteq> {||}\"\n   and \"fBall rs (\\<lambda>(lhs, _). \\<not> pre_constants.shadows_consts C_info (heads_of rs) lhs)\"\n   and \"fBall rs (\\<lambda>(_, rhs). pre_constants.welldefined C_info (heads_of rs) rhs)\"\n   and \"fdisjnt (heads_of rs) (constructors.C C_info)\"\n   and \"distinct (constructors.all_constructors C_info)\"\n    using assms unfolding rules'_def by simp+\nnext\n  have \"pattern_compatibles' rs\"\n    using assms unfolding rules'_def by simp\n  thus \"pattern_compatibles rs\"\n    by (rule fpairwise_weaken) (blast intro: pattern_compatible_approx)\nqed\n\nlemma embed_ext: \"f \\<equiv> g \\<Longrightarrow> f x \\<equiv> g x\"\nby auto\n\nML_file \"embed.ML\"\n\nconsts \"lift_term\" :: \"'a \\<Rightarrow> term\" (\"\\<langle>_\\<rangle>\")\n\nsetup\\<open>\n  let\n    fun embed ((Const (@{const_name lift_term}, _)) $ t) = HOL_Term.mk_term false t\n      | embed (t $ u) = embed t $ embed u\n      | embed t = t\n  in Context.theory_map (Syntax_Phases.term_check 99 \"lift\" (K (map embed))) end\n\\<close>\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CakeML_Codegen/Preproc/Embed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.34578793835137167}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      ProcParEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Examples for Procedures as Parameters\"\n\ntheory ProcParEx imports \"../Vcg\" begin\n\n\n\n\n\nlemma conseq_exploit_pre':\n             \"\\<lbrakk>\\<forall>s \\<in> S. \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile> (P \\<inter> S)c Q,A\"\n  apply (rule HoarePartialDef.Conseq)\n  apply clarify\n  by (metis IntI insertI1 subset_refl)\n\n\nlemma conseq_exploit_pre'':\n             \"\\<lbrakk>\\<forall>Z. \\<forall>s \\<in> S Z.  \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P Z) c (Q Z),(A Z)\\<rbrakk>\n              \\<Longrightarrow>\n              \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile> (P Z \\<inter> S Z)c (Q Z),(A Z)\"\n  apply (rule allI)\n  apply (rule conseq_exploit_pre')\n  apply blast\n  done\n\nlemma conseq_exploit_pre''':\n             \"\\<lbrakk>\\<forall>s \\<in> S. \\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P Z) c (Q Z),(A Z)\\<rbrakk>\n              \\<Longrightarrow>\n              \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile> (P Z \\<inter> S)c (Q Z),(A Z)\"\n  apply (rule allI)\n  apply (rule conseq_exploit_pre')\n  apply blast\n  done\n\n\n  \nrecord 'g vars = \"'g state\" +\n  compare_' :: string\n  n_'   :: nat\n  m_'   :: nat\n  b_'   :: bool\n  k_'  :: nat\n \n\n\nprocedures compare(n,m|b) = \"NoBody\"\nprint_locale! compare_signature\n\n\ncontext compare_signature\nbegin\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\<acute>b :== CALL compare(\\<acute>n,\\<acute>m)\"\nterm \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m)\"\ndeclare [[hoare_use_call_tr' = true]]\nterm \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m)\"\nend\n\n\nprocedures\n  LEQ (n,m | b) = \"\\<acute>b :== \\<acute>n \\<le> \\<acute>m\"\n  LEQ_spec: \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>}  PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) \\<lbrace>\\<acute>b = (\\<^bsup>\\<sigma>\\<^esup>n \\<le> \\<^bsup>\\<sigma>\\<^esup>m)\\<rbrace>\"\n  LEQ_modifies: \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) {t. t may_only_modify_globals \\<sigma> in []}\"\n\n\n\ndefinition mx:: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  where \"mx leq a b = (if leq a b then a else b)\"\n\nprocedures\n  Max (compare, n, m | k) = \n  \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m);;\n   IF \\<acute>b THEN \\<acute>k :== \\<acute>n ELSE \\<acute>k :== \\<acute>m FI\"\n\n  Max_spec: \"\\<And>leq. \\<forall>\\<sigma>. \\<Gamma>\\<turnstile> \n  ({\\<sigma>} \\<inter> {s. (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n              (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})})\n    PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m,\\<acute>k)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\n\n\nlemma (in Max_impl ) Max_spec1: \nshows\n\"\\<forall>\\<sigma> leq. \\<Gamma>\\<turnstile> \n  ({\\<sigma>} \\<inter> \\<lbrace> (\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n      (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\nproof -\n  fix \\<sigma>:: \"('a,'b) vars_scheme\" and s::\"('a,'b) vars_scheme\" and leq\n   assume compare_spec: \n       \"\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m\\<rbrace>\"\n \n  assume compare_modifies:\n        \"\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \n                {t. t may_only_modify_globals \\<tau> in []}\"\n\n   show \"\\<Gamma>\\<turnstile>({s} \\<inter> {\\<sigma>})\n            \\<acute>b :== DYNCALL \\<acute>compare (\\<acute>n,\\<acute>m);;\n            IF \\<acute>b THEN \\<acute>k :== \\<acute>n ELSE \\<acute>k :== \\<acute>m FI\n            \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\n     apply vcg\n     apply (clarsimp simp add: mx_def)\n     done\n qed\n\n\nlemma (in Max_impl) Max_spec2: \nshows\n\"\\<forall>\\<sigma> leq. \\<Gamma>\\<turnstile> \n  ({\\<sigma>} \\<inter> \\<lbrace>(\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n      (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in Max_impl) Max_spec3: \nshows\n\"\\<forall>n m leq. \\<Gamma>\\<turnstile> \n  (\\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace>  \\<inter> \n   \\<lbrace>(\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n     (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq n m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\n\n\nlocale Max_test = Max_spec + LEQ_spec + LEQ_modifies \nlemma (in Max_test) \n\n  shows\n  \"\\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>k :== CALL Max(LEQ_'proc,\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>k = mx (op \\<le>) \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\nproof -\n  note Max_spec = Max_spec [where leq=\"(op \\<le>)\"]\n  show ?thesis\n    apply vcg\n    apply (clarsimp)\n    apply (rule conjI)\n    apply (rule LEQ_spec [simplified])\n    apply (rule LEQ_modifies [simplified])\n    done\nqed\n\n\nlemma (in Max_impl) Max_spec5:\nshows\n\"\\<forall>n m leq. \\<Gamma>\\<turnstile> \n  (\\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace> \\<inter> \\<lbrace>\\<forall>n' m'. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n' \\<and> \\<acute>m=m'\\<rbrace> \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq n' m')\\<rbrace>\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq n m\\<rbrace>\"\nterm \"\\<lbrace>{s. \\<^bsup>s\\<^esup>n = n' \\<and> \\<^bsup>s\\<^esup>m = m'} = X\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply clarsimp\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in LEQ_impl)\n LEQ_spec: \"\\<forall>n m. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace>  PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) \\<lbrace>\\<acute>b = (n \\<le> m)\\<rbrace>\"\n  apply vcg\n  done\n\n\nlocale Max_test' = Max_impl + LEQ_impl\nlemma (in Max_test') \n  shows\n  \"\\<forall>n m. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace> \\<acute>k :== CALL Max(LEQ_'proc,\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>k = mx (op \\<le>) n m\\<rbrace>\"\nproof -\n  note Max_spec = Max_spec5\n  show ?thesis\n    apply vcg\n    apply (rule_tac x=\"op \\<le>\" in exI)\n    apply clarsimp\n    apply (rule LEQ_spec [rule_format])\n    done\nqed\n\nend\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/ex/ProcParEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.34578793835137156}}
{"text": "section {*L\\_ATS*}\ntheory\n  L_ATS\n\nimports\n  Derivations_Basics\n\nbegin\n\nlocale ATS =\n  fixes TSstructure :: \"'TSstructure \\<Rightarrow> bool\"\n  fixes configurations :: \"'TSstructure \\<Rightarrow> 'conf set\"\n  fixes initial_configurations :: \"'TSstructure \\<Rightarrow> 'conf set\"\n  fixes step_labels :: \"'TSstructure \\<Rightarrow> 'label set\"\n  fixes step_relation :: \"'TSstructure \\<Rightarrow> 'conf \\<Rightarrow> 'label \\<Rightarrow> 'conf \\<Rightarrow> bool\"\n\nassumes AX_initial_configuration_belongs: \"\n  TSstructure G\n  \\<Longrightarrow> initial_configurations G \\<subseteq> configurations G\"\n\nassumes AX_step_relation_preserves_belongs: \"\n  TSstructure G\n  \\<Longrightarrow> step_relation G c1 e c2\n  \\<Longrightarrow> c1 \\<in> configurations G\n  \\<Longrightarrow> e \\<in> step_labels G \\<and> c2 \\<in> configurations G\"\n\ncontext ATS\nbegin\n\ndefinition is_forward_target_deterministic :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"is_forward_target_deterministic G \\<equiv>\n  \\<forall>c c1 c2 e.\n  step_relation G c e c1\n  \\<and> step_relation G c e c2\n  \\<longrightarrow> c1 = c2\"\n\ndefinition is_forward_edge_deterministic :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"is_forward_edge_deterministic G \\<equiv>\n  \\<forall>c c1 c2 e1 e2.\n  step_relation G c e1 c1\n  \\<and> step_relation G c e2 c2\n  \\<longrightarrow> e1 = e2\"\n\ndefinition is_forward_deterministic :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"is_forward_deterministic G \\<equiv>\n  is_forward_target_deterministic G \\<and> is_forward_edge_deterministic G\"\n\ndefinition is_backward_target_deterministic :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"is_backward_target_deterministic G \\<equiv>\n  \\<forall>c c1 c2 e.\n  step_relation G c1 e c\n  \\<and> step_relation G c2 e c\n  \\<longrightarrow> c1 = c2\"\n\ndefinition is_backward_edge_deterministic :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"is_backward_edge_deterministic G \\<equiv>\n  \\<forall>c c1 c2 e1 e2.\n  step_relation G c1 e1 c\n  \\<and> step_relation G c2 e2 c\n  \\<longrightarrow> e1 = e2\"\n\ndefinition is_backward_deterministic :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"is_backward_deterministic G \\<equiv>\n  is_backward_target_deterministic G \\<and> is_backward_edge_deterministic G\"\n\ndefinition is_entirely_deterministic :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"is_entirely_deterministic G \\<equiv>\n  is_forward_deterministic G \\<and> is_backward_deterministic G\"\n\ndefinition derivation :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf)derivation\n  \\<Rightarrow> bool\"\n  where\n    \"derivation G d \\<equiv>\n  \\<forall>i.\n  case i of\n  0 \\<Rightarrow> (\n    case d 0 of\n    None \\<Rightarrow> False\n    | Some (pair None c) \\<Rightarrow> True\n    | Some (pair (Some e) c) \\<Rightarrow> False)\n  | Suc j \\<Rightarrow> (\n    case d i of\n    None \\<Rightarrow> True\n    | Some (pair ei ci) \\<Rightarrow> (\n      case d j of\n      None \\<Rightarrow> False\n      | Some (pair ej cj) \\<Rightarrow> (\n        case ei of\n        None \\<Rightarrow> False\n        | Some eiv \\<Rightarrow> step_relation G cj eiv ci\n  )))\"\n\ndefinition derivation_ALT :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf)derivation\n  \\<Rightarrow> bool\"\n  where\n    \"derivation_ALT G d \\<equiv>\n  (\\<exists>c. d 0 = Some (pair None c))\n  \\<and> (\\<forall>j. \\<forall>i<j. d j \\<noteq> None \\<longrightarrow> d i \\<noteq> None)\n  \\<and> (\\<forall>i>0. d i \\<noteq> None \\<longrightarrow> (get_label (d i) \\<noteq> None))\n  \\<and> (\\<forall>i e1 c1 e2 c2.\n        d i = Some (pair e1 c1)\n        \\<longrightarrow> d (Suc i) = Some (pair (Some e2) c2)\n        \\<longrightarrow> step_relation G c1 e2 c2)\"\n\nlemma derivation_ALT_vs_derivation_hlp: \"\n  derivation G d\n  \\<Longrightarrow> i < j\n  \\<Longrightarrow> d i = None\n  \\<Longrightarrow> d j = None\"\n  apply(induct \"j-i\" arbitrary: i j)\n   apply(rename_tac i j)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x i j)(*strict*)\n  apply(clarsimp)\n  apply(case_tac j)\n   apply(rename_tac x i j)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x i j nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x i nat)(*strict*)\n  apply(erule_tac x=\"i\" in meta_allE)\n  apply(erule_tac x=\"nat\" in meta_allE)\n  apply(clarsimp)\n  apply(erule meta_impE)\n   apply(rename_tac x i nat)(*strict*)\n   apply(force)\n  apply(rename_tac x i nat)(*strict*)\n  apply(case_tac \"i=nat\")\n   apply(rename_tac x i nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat)(*strict*)\n   apply(simp add: derivation_def)\n   apply(erule_tac x=\"Suc nat\" in allE)\n   apply(clarsimp)\n   apply(case_tac \"d(Suc nat)\")\n    apply(rename_tac nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac nat a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac nat a option conf)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x i nat)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_def)\n  apply(erule_tac x=\"Suc nat\" in allE)\n  apply(clarsimp)\n  apply(case_tac \"d(Suc nat)\")\n   apply(rename_tac x i nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x i nat a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac x i nat a option conf)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma derivation_ALT_vs_derivation_hlp2: \"\n  derivation G d\n  \\<Longrightarrow> i < j\n  \\<Longrightarrow> d j \\<noteq> None\n  \\<Longrightarrow> d i \\<noteq> None\"\n  apply(induct \"j-i\" arbitrary: i j)\n   apply(rename_tac i j)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x i j)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x i j y)(*strict*)\n  apply(case_tac j)\n   apply(rename_tac x i j y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x i j y nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x i y nat)(*strict*)\n  apply(erule_tac x=\"i\" in meta_allE)\n  apply(erule_tac x=\"nat\" in meta_allE)\n  apply(erule meta_impE)\n   apply(rename_tac x i y nat)(*strict*)\n   apply(force)\n  apply(rename_tac x i y nat)(*strict*)\n  apply(case_tac \"i=nat\")\n   apply(rename_tac x i y nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y nat)(*strict*)\n   apply(simp add: derivation_def)\n   apply(erule_tac x=\"Suc nat\" in allE)\n   apply(clarsimp)\n   apply(case_tac \"d nat\")\n    apply(rename_tac y nat)(*strict*)\n    apply(clarsimp)\n    apply(case_tac y)\n    apply(rename_tac y nat option conf)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y nat a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x i y nat)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_def)\n  apply(erule_tac x=\"Suc nat\" in allE)\n  apply(clarsimp)\n  apply(case_tac \"d nat\")\n   apply(rename_tac x i y nat)(*strict*)\n   apply(clarsimp)\n   apply(case_tac y)\n   apply(rename_tac x i y nat option conf)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x i y nat a)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma derivation_ALT_vs_derivation: \"\n  derivation_ALT G d = derivation G d\"\n  apply(rule antisym)\n   apply(simp add: derivation_ALT_def derivation_def)\n   apply(clarsimp)\n   apply(rename_tac i c)(*strict*)\n   apply(case_tac i)\n    apply(rename_tac i c)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i c nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c nat)(*strict*)\n   apply(case_tac \"d(Suc nat)\")\n    apply(rename_tac c nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac c nat a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac c nat a option conf)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c nat option conf)(*strict*)\n   apply(case_tac \"d nat\")\n    apply(rename_tac c nat option conf)(*strict*)\n    apply(clarsimp)\n    apply(erule_tac x=\"Suc nat\" and P=\"\\<lambda>j. \\<forall>i. i < j \\<longrightarrow> (\\<exists>y. d j = Some y) \\<longrightarrow> (\\<exists>y. d i = Some y)\" in allE)\n    apply(force)\n   apply(rename_tac c nat option conf a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac c nat option conf a optiona confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c nat option conf optiona confa)(*strict*)\n   apply(case_tac option)\n    apply(rename_tac c nat option conf optiona confa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac c nat conf optiona confa)(*strict*)\n    apply(erule_tac x=\"Suc nat\" in allE)+\n    apply(simp add: get_label_def)\n   apply(rename_tac c nat option conf optiona confa a)(*strict*)\n   apply(clarsimp)\n  apply(simp add: derivation_ALT_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(simp add: derivation_def)\n   apply(erule_tac x=\"0\" in allE)\n   apply(clarsimp)\n   apply(case_tac \"d 0\")\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac a option conf)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option conf)(*strict*)\n   apply(case_tac option)\n    apply(rename_tac option conf)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac option conf a)(*strict*)\n   apply(clarsimp)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac j i y)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac j i y)(*strict*)\n    prefer 2\n    apply(rule derivation_ALT_vs_derivation_hlp2)\n      apply(rename_tac j i y)(*strict*)\n      apply(force)\n     apply(rename_tac j i y)(*strict*)\n     apply(force)\n    apply(rename_tac j i y)(*strict*)\n    apply(force)\n   apply(rename_tac j i y)(*strict*)\n   apply(force)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac i y)(*strict*)\n   apply(case_tac i)\n    apply(rename_tac i y)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i y nat)(*strict*)\n   apply(simp add: derivation_def)\n   apply(clarsimp)\n   apply(rename_tac y nat)(*strict*)\n   apply(erule_tac x=\"Suc nat\" in allE)\n   apply(clarsimp)\n   apply(case_tac y)\n   apply(rename_tac y nat option conf)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat option conf)(*strict*)\n   apply(case_tac \"d nat\")\n    apply(rename_tac nat option conf)(*strict*)\n    apply(force)\n   apply(rename_tac nat option conf a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac nat option conf a optiona confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat option conf optiona confa)(*strict*)\n   apply(case_tac option)\n    apply(rename_tac nat option conf optiona confa)(*strict*)\n    apply(force)\n   apply(rename_tac nat option conf optiona confa a)(*strict*)\n   apply(simp add: get_label_def)\n  apply(clarsimp)\n  apply(rename_tac i e1 c1 e2 c2)(*strict*)\n  apply(simp add: derivation_def)\n  apply(erule_tac x=\"Suc i\" in allE)\n  apply(clarsimp)\n  done\n\nlemma derivation_append_fit_ALT_vs_derivation_append_fit: \"\n  derivation G g\n  \\<Longrightarrow>derivation_append_fit_ALT f g n = derivation_append_fit f g n\"\n  apply(simp add: derivation_append_fit_ALT_def derivation_append_fit_def)\n  apply(simp add: get_configuration_def)\n  apply(case_tac \"f n\")\n   apply(clarsimp)\n   apply(case_tac \"g 0\")\n    apply(clarsimp)\n    apply(simp add: derivation_def)\n    apply(erule_tac x=\"0\" in allE)\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac a option conf)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option conf)(*strict*)\n  apply(case_tac \"g 0\")\n   apply(rename_tac option conf)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac option conf a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac option conf a optiona confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option conf optiona confa)(*strict*)\n  apply(case_tac optiona)\n   apply(rename_tac option conf optiona confa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac option conf optiona confa a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option confa a)(*strict*)\n  apply(simp add: derivation_def)\n  apply(erule_tac x=\"0\" in allE)\n  apply(clarsimp)\n  done\n\ncorollary derivation_introduction: \"\n  (d 0 \\<noteq> None)\n  \\<Longrightarrow> (\\<And>e c. d 0 \\<noteq> Some (pair (Some e) c))\n  \\<Longrightarrow> (\\<And>i c. d (Suc i) \\<noteq> Some (pair None c))\n  \\<Longrightarrow> (\\<And>i. d (Suc i) \\<noteq> None \\<longrightarrow> d i \\<noteq> None)\n  \\<Longrightarrow> (\\<And>i e1 c1 e2 c2.\n        d i = Some (pair e1 c1)\n        \\<Longrightarrow> d (Suc i) = Some (pair (Some e2) c2)\n        \\<Longrightarrow> step_relation G c1 e2 c2)\n  \\<Longrightarrow> derivation G d\"\n  apply(simp add: derivation_def)\n  apply(clarsimp)\n  apply(rename_tac y i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac y i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac y option conf)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option conf)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac e c)(*strict*)\n   apply(case_tac e)\n    apply(rename_tac e c)(*strict*)\n    apply(force)\n   apply(rename_tac e c a)(*strict*)\n   apply(force)\n  apply(rename_tac y i nat)(*strict*)\n  apply(rename_tac y i j)\n  apply(rename_tac y i j)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y j)(*strict*)\n  apply(case_tac \"d(Suc j)\")\n   apply(rename_tac y j)(*strict*)\n   apply(force)\n  apply(rename_tac y j a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac y j a option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y j option conf)(*strict*)\n  apply(rename_tac e c)\n  apply(rename_tac y j e c)(*strict*)\n  apply(erule_tac\n      x=\"j\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"j\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"j\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac y j e c ya)(*strict*)\n  apply(rename_tac ya)\n  apply(case_tac \"ya\")\n  apply(rename_tac y j e c ya option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y j e c option conf)(*strict*)\n  apply(rename_tac e1 c1)\n  apply(rename_tac y j e c e1 c1)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(thin_tac \"(\\<And>e c. y \\<noteq> pair (Some e) c)\")\n  apply(case_tac e)\n   apply(rename_tac y j e c e1 c1)(*strict*)\n   apply(force)\n  apply(rename_tac y j e c e1 c1 a)(*strict*)\n  apply(clarsimp)\n  done\n\ndefinition derivation_to :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf)derivation\n  \\<Rightarrow> (('label,'conf)derivation_configuration set)\n  \\<Rightarrow> bool\"\n  where\n    \"derivation_to M f S \\<equiv>\n  derivation M f\n  \\<and> (\\<exists>n. f (Suc n) = None \\<and> (\\<exists>y\\<in> S. f n = Some y))\"\n\ndefinition derivation_from :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf)derivation\n  \\<Rightarrow> (('label,'conf)derivation_configuration set)\n  \\<Rightarrow> bool\"\n  where\n    \"derivation_from M f S \\<equiv>\n  derivation M f\n  \\<and> (case f 0 of\n     None \\<Rightarrow> False\n     | Some x \\<Rightarrow> x \\<in> S\n  )\"\n\ndefinition derivation_from_to :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf)derivation\n  \\<Rightarrow> (('label,'conf)derivation_configuration set)\n  \\<Rightarrow> (('label,'conf)derivation_configuration set)\n  \\<Rightarrow> bool\"\n  where\n    \"derivation_from_to M f S E \\<equiv>\n  derivation_from M f S\n  \\<and> derivation_to M f E\"\n\ndefinition derivation_initial :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf)derivation\n  \\<Rightarrow> bool\" where\n  \"derivation_initial G d \\<equiv>\n  derivation G d\n  \\<and> (case d 0 of\n     None \\<Rightarrow> False\n     | Some (pair e c) \\<Rightarrow>\n       c \\<in> initial_configurations G\n       \\<and> e = None\n  )\"\n\ndefinition derivation_initial_ALT :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf)derivation\n  \\<Rightarrow> bool\" where\n  \"derivation_initial_ALT G d \\<equiv>\n  derivation G d\n  \\<and> the (get_configuration (d 0)) \\<in> initial_configurations G\"\n\nlemma derivation_initial_ALT_vs_derivation_initial: \"\n  derivation_initial_ALT G d = derivation_initial G d\"\n  apply(rule antisym)\n   apply(simp add: derivation_initial_ALT_def derivation_initial_def)\n   apply(clarsimp)\n   apply(case_tac \"d 0\")\n    apply(clarsimp)\n    apply(simp add: derivation_def)\n    apply(erule_tac x=\"0\" in allE)\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac a option conf)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option conf)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(simp add: derivation_def)\n   apply(erule_tac x=\"0\" in allE)\n   apply(clarsimp)\n   apply(case_tac option)\n    apply(rename_tac option conf)(*strict*)\n    apply(force)\n   apply(rename_tac option conf a)(*strict*)\n   apply(force)\n  apply(simp add: derivation_initial_ALT_def derivation_initial_def)\n  apply(clarsimp)\n  apply(case_tac \"d 0\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(simp add: derivation_def)\n  apply(erule_tac x=\"0\" in allE)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac conf)(*strict*)\n  apply(simp add: get_configuration_def)\n  done\n\ndefinition maximal :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf)derivation\n  \\<Rightarrow> bool\"\n  where\n    \"maximal M d \\<equiv>\n  (\\<not>(\\<exists>n. maximum_of_domain d n))\n  \\<or> (\\<exists>n e c.\n      maximum_of_domain d n\n      \\<and> d n = Some (pair e c)\n      \\<and> (\\<forall>e' c'. \\<not>(step_relation M c e' c')))\"\n\ndefinition belongs :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf)derivation\n  \\<Rightarrow> bool\"\n  where\n    \"belongs M f \\<equiv>\n  \\<forall>i. case f i of\n    None \\<Rightarrow> True\n    | Some (pair e c) \\<Rightarrow>\n        (case e of\n         None \\<Rightarrow> True\n         | Some e' \\<Rightarrow>\n           e' \\<in> step_labels M)\n        \\<and> c \\<in> configurations M\"\n\ndefinition belongs_ALT :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf)derivation\n  \\<Rightarrow> bool\"\n  where\n    \"belongs_ALT G d \\<equiv>\n  (\\<forall>i e c. d i = Some (pair (Some e) c) \\<longrightarrow> e \\<in> step_labels G)\n  \\<and> (\\<forall>i e c. d i = Some (pair e c) \\<longrightarrow> c \\<in> configurations G)\"\n\nlemma belongs_ALT_vs_belongs: \"\n  belongs_ALT G d = belongs G d\"\n  apply(rule antisym)\n   apply(simp add: belongs_ALT_def belongs_def)\n   apply(clarsimp)\n   apply(rename_tac i)(*strict*)\n   apply(case_tac \"d i\")\n    apply(rename_tac i)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac i a option conf)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i option conf)(*strict*)\n   apply(erule_tac x=\"i\" in allE)+\n   apply(clarsimp)\n   apply(case_tac option)\n    apply(rename_tac i option conf)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i option conf a)(*strict*)\n   apply(clarsimp)\n  apply(simp add: belongs_ALT_def belongs_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac i e c)(*strict*)\n   apply(erule_tac x=\"i\" in allE)+\n   apply(clarsimp)\n  apply(clarsimp)\n  apply(rename_tac i e c)(*strict*)\n  apply(erule_tac x=\"i\" in allE)+\n  apply(clarsimp)\n  done\n\ndefinition some_step_from_every_configuration :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"some_step_from_every_configuration M \\<equiv>\n  \\<forall>c\\<in> configurations M.\n  \\<exists>e\\<in> step_labels M.\n  \\<exists>c'\\<in> configurations M.\n  step_relation M c e c'\"\n\nlemma initialNotNone: \"\n  derivation M f\n  \\<Longrightarrow> f 0\\<noteq>None\"\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"0\"\n      in allE)\n  apply(auto)\n  apply(case_tac \"f 0\")\n   apply(auto)\n  done\n\nlemma initialNotNone_prime: \"\n  derivation M f\n  \\<Longrightarrow> f 0=None\n  \\<Longrightarrow>P\"\n  apply(subgoal_tac \"f 0\\<noteq>None\")\n   apply(blast)\n  apply(rule initialNotNone)\n  apply(blast)\n  done\n\nlemma initialNotEdgeSome: \"\n  derivation M f\n  \\<Longrightarrow> f 0\\<noteq>Some (pair (Some e) c)\"\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"0\"\n      in allE)\n  apply(auto)\n  done\n\nlemma initialNotEdgeSome_prime: \"\n  derivation M f\n  \\<Longrightarrow> f 0=Some (pair (Some e) c)\n  \\<Longrightarrow>P\"\n  apply(subgoal_tac \"f 0\\<noteq>Some (pair (Some e) c)\")\n   apply(blast)\n  apply(rule initialNotEdgeSome)\n  apply(blast)\n  done\n\nlemma some_position_has_details_at_0: \"\n  derivation M g\n  \\<Longrightarrow> \\<exists>c. g 0 = Some (pair None c)\"\n  apply(case_tac \"g 0\")\n   apply(rule initialNotNone_prime)\n    apply(blast)+\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac option b a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b a)(*strict*)\n  apply(rule initialNotEdgeSome_prime)\n   apply(rename_tac b a)(*strict*)\n   apply(blast)+\n  done\n\nlemma AX_step_relation_preserves_belongsC: \"\n  TSstructure G\n  \\<Longrightarrow> step_relation G c1 e c2\n  \\<Longrightarrow> c1 \\<in> configurations G\n  \\<Longrightarrow> c2 \\<in> configurations G\"\n  apply(simp add: AX_step_relation_preserves_belongs)\n  done\n\nlemma AX_step_relation_preserves_belongsE: \"\n  TSstructure G\n  \\<Longrightarrow> step_relation G c1 e c2\n  \\<Longrightarrow> c1 \\<in> configurations G\n  \\<Longrightarrow> e \\<in> step_labels G\"\n  apply(simp add: AX_step_relation_preserves_belongs)\n  done\n\ndefinition get_accessible_configurations :: \"\n  'TSstructure\n  \\<Rightarrow> 'conf set\"\n  where\n    \"get_accessible_configurations M \\<equiv>\n  {c. \\<exists>d i.\n    derivation_initial M d\n    \\<and> get_configuration (d i) = Some c}\"\n\ndefinition is_forward_target_deterministic_accessible :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"is_forward_target_deterministic_accessible G \\<equiv>\n  \\<forall>c\\<in> get_accessible_configurations G.\n  \\<forall>c1 c2 e.\n  step_relation G c e c1\n  \\<and> step_relation G c e c2\n  \\<longrightarrow> c1 = c2\"\n\ndefinition is_forward_edge_deterministic_accessible :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"is_forward_edge_deterministic_accessible G \\<equiv>\n  \\<forall>c\\<in> get_accessible_configurations G.\n  \\<forall>c1 c2 e1 e2.\n  step_relation G c e1 c1\n  \\<and> step_relation G c e2 c2\n  \\<longrightarrow> e1 = e2\"\n\ndefinition is_forward_deterministic_accessible :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"is_forward_deterministic_accessible G \\<equiv>\n  is_forward_target_deterministic_accessible G \\<and> is_forward_edge_deterministic_accessible G\"\n\nlemma is_forward_edge_deterministic_implies_is_forward_edge_deterministic_accessible: \"\n  TSstructure G\n  \\<Longrightarrow> is_forward_edge_deterministic G\n  \\<Longrightarrow> is_forward_edge_deterministic_accessible G\"\n  apply(simp add: is_forward_edge_deterministic_accessible_def is_forward_edge_deterministic_def)\n  done\n\nlemma is_forward_target_deterministic_implies_is_forward_target_deterministic_accessible: \"\n  TSstructure G\n  \\<Longrightarrow> is_forward_target_deterministic G\n  \\<Longrightarrow> is_forward_target_deterministic_accessible G\"\n  apply(simp add: is_forward_target_deterministic_accessible_def is_forward_target_deterministic_def)\n  done\n\nlemma is_forward_deterministic_implies_is_forward_deterministic_accessible: \"\n  TSstructure G\n  \\<Longrightarrow> is_forward_deterministic G\n  \\<Longrightarrow> is_forward_deterministic_accessible G\"\n  apply (metis is_forward_edge_deterministic_implies_is_forward_edge_deterministic_accessible is_forward_target_deterministic_implies_is_forward_target_deterministic_accessible is_forward_deterministic_accessible_def is_forward_deterministic_def)\n  done\n\nlemma derivationNoFromNone_prime: \"\n  derivation M d\n  \\<Longrightarrow> d (Suc n)=Some a \\<longrightarrow> d n\\<noteq>None\"\n  apply(induct n)\n   apply(rule impI)\n   apply(rule initialNotNone)\n   apply(blast)\n  apply(rename_tac n)(*strict*)\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc(Suc n)\"\n      in allE)\n  apply(case_tac \"d (Suc n)\")\n   apply(rename_tac n)(*strict*)\n   apply(auto)\n  apply(rename_tac n)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac n option b)(*strict*)\n  apply(auto)\n  done\n\nlemma derivationNoFromNone: \"\n  derivation M d\n  \\<Longrightarrow> d (Suc n)=Some a\n  \\<Longrightarrow> d n=None\n  \\<Longrightarrow> P\"\n  apply(subgoal_tac \"d (Suc n)=Some a \\<longrightarrow> d n\\<noteq>None\")\n   apply(blast)\n  apply(rule derivationNoFromNone_prime)\n  apply(auto)\n  done\n\nlemma noSomeAfterMaxDom: \"\n  derivation G d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> \\<forall>m>n. d m = None\"\n  apply(rule allI)\n  apply(rename_tac m)(*strict*)\n  apply(induct_tac m)\n   apply(rename_tac m)(*strict*)\n   apply(auto)\n   apply(rename_tac na)(*strict*)\n   apply(subgoal_tac \"n=na\")\n    apply(rename_tac na)(*strict*)\n    apply(auto)\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac na)(*strict*)\n  apply(case_tac \"d (Suc na)\")\n   apply(rename_tac na)(*strict*)\n   apply(auto)\n  apply(rename_tac na a)(*strict*)\n  apply(rule derivationNoFromNone)\n    apply(rename_tac na a)(*strict*)\n    apply(simp add: derivation_to_def)\n   apply(rename_tac na a)(*strict*)\n   apply(blast)\n  apply(rename_tac na a)(*strict*)\n  apply(blast)\n  done\n\nlemma none_position_after_max_dom: \"\n  derivation G d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> n<m\n  \\<Longrightarrow> d m = None\"\n  apply(subgoal_tac \"\\<forall>m>n. d m=None\")\n   apply(clarsimp)\n  apply(rule noSomeAfterMaxDom)\n   apply(force)\n  apply(force)\n  done\n\nlemma derivationNoFromNone2_prime: \"\n  derivation M d\n  \\<Longrightarrow> d n\\<noteq>None\n  \\<Longrightarrow> i<n\n  \\<Longrightarrow> d i\\<noteq>None\"\n  apply(subgoal_tac \"\\<forall>i. i\\<le>n \\<longrightarrow> d (n-i) \\<noteq> None\")\n   apply(subgoal_tac \"\\<exists>x. i+x=n\")\n    apply(clarsimp)\n    apply(rename_tac y x)(*strict*)\n    apply(erule_tac\n      x=\"x\"\n      in allE)\n    apply(clarsimp)\n   apply (metis add_diff_inverse order_less_asym)\n  apply(rule allI)\n  apply(rename_tac ia)(*strict*)\n  apply(induct_tac ia)\n   apply(rename_tac ia)(*strict*)\n   apply(force)\n  apply(rename_tac ia na)(*strict*)\n  apply(auto)\n  apply(rename_tac na y ya)(*strict*)\n  apply(case_tac \"d (n-Suc na)\")\n   apply(rename_tac na y ya)(*strict*)\n   apply(rule_tac\n      a=\"ya\"\n      and n=\"n-Suc na\"\n      in derivationNoFromNone)\n     apply(rename_tac na y ya)(*strict*)\n     apply(blast)\n    apply(rename_tac na y ya)(*strict*)\n    apply(rule_tac\n      s=\"n-na\"\n      and t=\"Suc (n - Suc na)\"\n      in ssubst)\n     apply(rename_tac na y ya)(*strict*)\n     apply(arith)\n    apply(rename_tac na y ya)(*strict*)\n    apply(blast)\n   apply(rename_tac na y ya)(*strict*)\n   apply(blast)\n  apply(rename_tac na y ya a)(*strict*)\n  apply(blast)\n  done\n\nlemma derivationNoFromNone2: \"\n  derivation M d\n  \\<Longrightarrow> d n\\<noteq>None\n  \\<Longrightarrow> i<n\n  \\<Longrightarrow> d i=None\n  \\<Longrightarrow> P\"\n  apply(subgoal_tac \"d i \\<noteq> None\")\n   apply(force)\n  apply(rule derivationNoFromNone2_prime)\n    apply(force)+\n  done\n\nlemma maximum_of_domainSmaller: \"\n  maximum_of_domain d m\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> n\\<le>m\n  \\<Longrightarrow> d n=None\n  \\<Longrightarrow> P\"\n  apply(case_tac \"n=m\")\n   apply(clarsimp)\n   apply(simp add: maximum_of_domain_def)\n  apply(simp add: maximum_of_domain_def)\n  apply(rule_tac\n      i=\"n\"\n      in derivationNoFromNone2)\n     apply(blast)+\n   apply(arith)\n  apply(blast)\n  done\n\nlemma allPreMaxDomSome: \"\n  derivation M d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> \\<forall>i\\<le>n. d i \\<noteq> None\"\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac \"d i\")\n   apply(rename_tac i)(*strict*)\n   apply(rule maximum_of_domainSmaller)\n      apply(rename_tac i)(*strict*)\n      apply(blast)+\n  done\n\nlemma allPreMaxDomSome_prime: \"\n  derivation M d\n  \\<Longrightarrow> d i \\<noteq> None\n  \\<Longrightarrow> maximum_of_domain d (n::nat)\n  \\<Longrightarrow> i\\<le>n\"\n  apply(subgoal_tac \"\\<forall>i>n. d i = None\")\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(case_tac \"n<i\")\n    apply(clarsimp)\n   apply(clarsimp)\n  apply(rule noSomeAfterMaxDom)\n   apply(blast)+\n  done\n\nlemma derivation_Always_PreEdge: \"\n  derivation M d\n  \\<Longrightarrow> \\<forall>c. d(Suc n)\\<noteq>Some (pair None c)\"\n  apply(induct_tac n)\n   apply(auto)\n   apply(rename_tac c)(*strict*)\n   apply(simp add: derivation_def)\n   apply(erule_tac\n      x=\"Suc 0\"\n      in allE)\n   apply(auto)\n   apply(case_tac \"d 0\")\n    apply(rename_tac c)(*strict*)\n    apply(auto)\n   apply(rename_tac c a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac c a option b)(*strict*)\n   apply(auto)\n  apply(rename_tac n c)(*strict*)\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc (Suc n)\"\n      in allE)\n  apply(auto)\n  apply(case_tac \"d (Suc n)\")\n   apply(rename_tac n c)(*strict*)\n   apply(auto)\n  apply(rename_tac n c a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac n c a option b)(*strict*)\n  apply(auto)\n  done\n\nlemma derivation_Always_PreEdge_prime: \"\n  derivation M d\n  \\<Longrightarrow> d (Suc n)=Some (pair None c)\n  \\<Longrightarrow> P\"\n  apply(subgoal_tac \"\\<forall>c. d(Suc n)\\<noteq>Some (pair None c)\")\n   apply(blast)\n  apply(rule derivation_Always_PreEdge)\n  apply(auto)\n  done\n\nlemma pre_some_position_is_some_position: \"\n  derivation M g\n  \\<Longrightarrow> g m = Some c\n  \\<Longrightarrow> n\\<le>m\n  \\<Longrightarrow> \\<exists>e c. g n = Some (pair e c)\"\n  apply(case_tac \"n=m\")\n   apply(auto)\n   apply(case_tac m)\n    apply(clarsimp)\n    apply(case_tac c)\n    apply(clarsimp)\n   apply(rename_tac nat)(*strict*)\n   apply(case_tac c)\n   apply(auto)\n  apply(subgoal_tac \"g n\\<noteq>None\")\n   defer\n   apply(rule derivationNoFromNone2_prime)\n     apply(blast)+\n   apply(arith)\n  apply(auto)\n  apply(rename_tac y)(*strict*)\n  apply(case_tac y)\n  apply(clarsimp)\n  done\n\nlemma pre_some_position_is_some_position_prime: \"\n  derivation M g\n  \\<Longrightarrow> g m = Some c\n  \\<Longrightarrow> n\\<le>m\n  \\<Longrightarrow> 0<n\n  \\<Longrightarrow> \\<exists>e c. g n = Some (pair (Some e) c)\"\n  apply(subgoal_tac \"\\<exists>e c. g n = Some (pair e c)\")\n   prefer 2\n   apply(rule pre_some_position_is_some_position)\n     apply(blast)+\n  apply(auto)\n  apply(rename_tac e ca)(*strict*)\n  apply(case_tac e)\n   apply(rename_tac e ca)(*strict*)\n   apply(auto)\n  apply(rename_tac ca)(*strict*)\n  apply(case_tac n)\n   apply(rename_tac ca)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac ca nat)(*strict*)\n  apply(rule derivation_Always_PreEdge_prime)\n   apply(rename_tac ca nat)(*strict*)\n   apply(force)\n  apply(rename_tac ca nat)(*strict*)\n  apply(force)\n  done\n\nlemma some_position_has_details_after_0: \"\n  derivation M g\n  \\<Longrightarrow> g (Suc n) = Some a\n  \\<Longrightarrow> \\<exists>e c. a = pair (Some e) c\"\n  apply(case_tac a)\n  apply(rename_tac option b)(*strict*)\n  apply(auto)\n  apply(case_tac option)\n   apply(rename_tac option b)(*strict*)\n   apply(auto)\n  apply(rename_tac b)(*strict*)\n  apply(rule derivation_Always_PreEdge_prime)\n   apply(rename_tac b)(*strict*)\n   apply(blast)+\n  done\n\nlemma some_position_has_details_anywhere: \"\n  derivation M g\n  \\<Longrightarrow> g n = Some a\n  \\<Longrightarrow> \\<exists>e c. a = pair e c\"\n  apply(case_tac a)\n  apply(rename_tac option b)(*strict*)\n  apply(auto)\n  done\n\nlemma some_position_at_max_dom: \"\n  derivation M g\n  \\<Longrightarrow> maximum_of_domain g n\n  \\<Longrightarrow> \\<exists>e c. g n = Some (pair e c)\"\n  apply(case_tac \"g n\")\n   apply(rule_tac\n      n=\"n\"\n      in maximum_of_domainSmaller)\n      apply(blast)+\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(rule some_position_has_details_anywhere)\n   apply(rename_tac a)(*strict*)\n   apply(blast)+\n  done\n\nlemma some_position_has_details_before_max_dom: \"\n  derivation M g\n  \\<Longrightarrow> maximum_of_domain g n\n  \\<Longrightarrow> m\\<le>n\n  \\<Longrightarrow> \\<exists>e c. g m = Some (pair e c)\"\n  apply(subgoal_tac \"\\<exists>e c. g n = Some (pair e c)\")\n   apply(clarsimp)\n   apply(rename_tac e c)(*strict*)\n   apply(rule_tac\n      m=\"n\"\n      in pre_some_position_is_some_position)\n     apply(rename_tac e c)(*strict*)\n     apply(blast)+\n  apply(rule some_position_at_max_dom)\n   apply(blast)+\n  done\n\nlemma some_position_has_details_before_max_dom_after_0: \"\n  derivation M g\n  \\<Longrightarrow> maximum_of_domain g n\n  \\<Longrightarrow> Suc m\\<le>n\n  \\<Longrightarrow> \\<exists>e c. g (Suc m) = Some (pair (Some e) c)\"\n  apply(subgoal_tac \"\\<exists>e c. g n=Some (pair e c)\")\n   apply(subgoal_tac \"\\<exists>e c. g (Suc m) = Some (pair e c)\")\n    apply(clarsimp)\n    apply(rename_tac e ea c ca)(*strict*)\n    apply(case_tac ea)\n     apply(rename_tac e ea c ca)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac e c ca)(*strict*)\n     apply(rule derivation_Always_PreEdge_prime)\n      apply(rename_tac e c ca)(*strict*)\n      apply(blast)+\n   apply(clarsimp)\n   apply(rename_tac e c)(*strict*)\n   apply(rule_tac\n      m=\"n\"\n      in pre_some_position_is_some_position)\n     apply(rename_tac e c)(*strict*)\n     apply(blast)+\n  apply(rule some_position_at_max_dom)\n   apply(blast)+\n  done\n\nlemma hasPreciseElem: \"\n  derivation G d\n  \\<Longrightarrow> maximum_of_domain d (Suc n)\n  \\<Longrightarrow> Suc k\\<le>n\n  \\<Longrightarrow> \\<exists>e1 c1. d (Suc k)=Some (pair (Some e1) c1)\"\n  apply(rule some_position_has_details_before_max_dom_after_0)\n    apply(blast)+\n  apply(arith)\n  done\n\nlemma sameget_configurationigSame: \"\n  d i = Some (pair e1 x)\n  \\<Longrightarrow> d i = Some (pair e2 y)\n  \\<Longrightarrow> x=y\"\n  apply(force)\n  done\n\nlemma existence_of_earliest_satisfaction_point: \"\n  derivation M d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> P c\n  \\<Longrightarrow> \\<exists>k\\<le>n. (\\<forall>i<k. \\<not>(\\<lambda>n. (case d n of None \\<Rightarrow> False| Some (pair e c) \\<Rightarrow> P c)) i) & ((\\<lambda>n. (case d n of None \\<Rightarrow> False| Some (pair e c) \\<Rightarrow> P c)))k\"\n  apply(case_tac \"d 0\")\n   apply(rule initialNotNone_prime)\n    apply(force)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac \"P b\")\n   apply(rename_tac option b)(*strict*)\n   apply(force)\n  apply(rename_tac option b)(*strict*)\n  apply(rule ex_least_nat_le)\n   apply(rename_tac option b)(*strict*)\n   apply(force)\n  apply(rename_tac option b)(*strict*)\n  apply(force)\n  done\n\nlemma position_change_due_to_step_relation: \"\n  derivation M d\n  \\<Longrightarrow> d n = Some (pair e1 c1)\n  \\<Longrightarrow> d (Suc n) = Some (pair (Some e2) c2)\n  \\<Longrightarrow> step_relation M c1 e2 c2\"\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc n\"\n      in allE)\n  apply(auto)\n  done\n\nlemma step_detail_before_some_position: \"\n  derivation G d\n  \\<Longrightarrow> d m \\<noteq> None\n  \\<Longrightarrow> Suc n \\<le> m\n  \\<Longrightarrow> \\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> d (Suc n) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\"\n  apply(case_tac \"d m\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d n = Some (pair e c)\")\n   apply(rename_tac a)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d (Suc n) = Some (pair (Some e) c)\")\n    apply(rename_tac a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac a e ea c ca)(*strict*)\n    apply(rule position_change_due_to_step_relation)\n      apply(rename_tac a e ea c ca)(*strict*)\n      apply(force)+\n   apply(rename_tac a)(*strict*)\n   apply(rule_tac\n      m=\"m\"\n      in pre_some_position_is_some_position_prime)\n      apply(rename_tac a)(*strict*)\n      apply(force)+\n  apply(rename_tac a)(*strict*)\n  apply(rule_tac\n      m=\"m\"\n      in pre_some_position_is_some_position)\n    apply(rename_tac a)(*strict*)\n    apply(force)+\n  done\n\nlemma noDeadEndBeforeMaxDom: \"\n  derivation M d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> d m=Some (pair e1 c1)\n  \\<Longrightarrow> m<n\n  \\<Longrightarrow> \\<forall>e2 c2. \\<not>(step_relation M c1 e2 c2)\n  \\<Longrightarrow> P\"\n  apply(case_tac \"d (Suc m)\")\n   apply(rule_tac\n      n=\"Suc m\"\n      in maximum_of_domainSmaller)\n      apply(blast)\n     apply(blast)\n    apply(arith)\n   apply(blast)\n  apply(rename_tac a)(*strict*)\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc m\"\n      in allE)\n  apply(auto)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(auto)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac option b)(*strict*)\n   apply(auto)\n  done\n\nlemma stepOnlyDueToStepRelation: \"\n  maximum_of_domain d n\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> d i = Some (pair e1 c1)\n  \\<Longrightarrow> d (Suc i) = Some (pair (Some e2) c2)\n  \\<Longrightarrow> step_relation G c1 e2 c2\"\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc i\"\n      in allE)\n  apply(auto)\n  done\n\nlemma use_is_forward_deterministic_E: \"\n  is_forward_deterministic M\n  \\<Longrightarrow> step_relation M c1 e1 c2\n  \\<Longrightarrow> step_relation M c1 e2 c3\n  \\<Longrightarrow> e1=e2\"\n  apply(simp add: is_forward_deterministic_def is_forward_edge_deterministic_def)\n  done\n\nlemma use_is_forward_deterministic_T: \"\n  is_forward_deterministic M\n  \\<Longrightarrow> step_relation M c1 e1 c2\n  \\<Longrightarrow> step_relation M c1 e2 c3\n  \\<Longrightarrow> c2=c3\"\n  apply(subgoal_tac \"e1=e2\")\n   prefer 2\n   apply(rule use_is_forward_deterministic_E)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(simp add: is_forward_deterministic_def is_forward_target_deterministic_def)\n  apply(auto)\n  done\n\nlemma supCFGhasAllFromToDerisOfsub: \"\n  \\<forall>c1 e c2. step_relation M1 c1 e c2 \\<longrightarrow> step_relation M2 c1 e c2\n  \\<Longrightarrow> derivation M1 d\n  \\<Longrightarrow> derivation M2 d\"\n  apply(simp add: derivation_def)\n  apply(auto)\n  apply(rename_tac i)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(auto)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a)(*strict*)\n  apply(case_tac \"a\")\n  apply(rename_tac nat a option b)(*strict*)\n  apply(auto)\n  apply(rename_tac nat option b)(*strict*)\n  apply(case_tac \"d nat\")\n   apply(rename_tac nat option b)(*strict*)\n   apply(auto)\n  apply(rename_tac nat option b a)(*strict*)\n  apply(case_tac \"a\")\n  apply(rename_tac nat option b a optiona ba)(*strict*)\n  apply(auto)\n  apply(rename_tac nat option b optiona ba)(*strict*)\n  apply(case_tac \"option\")\n   apply(rename_tac nat option b optiona ba)(*strict*)\n   apply(auto)\n  done\n\nlemma derivationsCoincide: \"\n  is_forward_deterministic M\n  \\<Longrightarrow> derivation M d1\n  \\<Longrightarrow> maximum_of_domain d1 n\n  \\<Longrightarrow> d1 0=Some (pair None c)\n  \\<Longrightarrow> d1 n=Some (pair e1 c1)\n  \\<Longrightarrow> derivation M d2\n  \\<Longrightarrow> maximum_of_domain d2 n\n  \\<Longrightarrow> d2 0=Some (pair None c)\n  \\<Longrightarrow> d2 n=Some (pair e2 c2)\n  \\<Longrightarrow> d1=d2\"\n  apply(rule HOL.ext)\n  apply(rename_tac x)(*strict*)\n  apply(induct_tac x)\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x na)(*strict*)\n  apply(subgoal_tac \"\\<forall>m>n. d1 m = None\")\n   apply(rename_tac x na)(*strict*)\n   prefer 2\n   apply(rule noSomeAfterMaxDom)\n    apply(rename_tac x na)(*strict*)\n    apply(blast)\n   apply(rename_tac x na)(*strict*)\n   apply(blast)\n  apply(rename_tac x na)(*strict*)\n  apply(subgoal_tac \"\\<forall>m>n. d2 m = None\")\n   apply(rename_tac x na)(*strict*)\n   prefer 2\n   apply(rule noSomeAfterMaxDom)\n    apply(rename_tac x na)(*strict*)\n    apply(blast)\n   apply(rename_tac x na)(*strict*)\n   apply(blast)\n  apply(rename_tac x na)(*strict*)\n  apply(case_tac \"Suc na\\<le>n\")\n   apply(rename_tac x na)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d1 na = Some (pair e c)\")\n    apply(rename_tac x na)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom)\n      apply(rename_tac x na)(*strict*)\n      apply(blast)\n     apply(rename_tac x na)(*strict*)\n     apply(blast)\n    apply(rename_tac x na)(*strict*)\n    apply(force)\n   apply(rename_tac x na)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1'' c1''. d1 (Suc na) = Some (pair (Some e1'') c1'')\")\n    apply(rename_tac x na)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac x na)(*strict*)\n      apply(blast)\n     apply(rename_tac x na)(*strict*)\n     apply(blast)\n    apply(rename_tac x na)(*strict*)\n    apply(blast)\n   apply(rename_tac x na)(*strict*)\n   apply(subgoal_tac \"\\<exists>e2'' c2''. d2 (Suc na) = Some (pair (Some e2'') c2'')\")\n    apply(rename_tac x na)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac x na)(*strict*)\n      apply(blast)\n     apply(rename_tac x na)(*strict*)\n     apply(blast)\n    apply(rename_tac x na)(*strict*)\n    apply(blast)\n   apply(rename_tac x na)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n   apply(subgoal_tac \"step_relation M ca e1'' c1''\")\n    apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n    prefer 2\n    apply(rule_tac\n      n=\"na\"\n      in position_change_due_to_step_relation)\n      apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n      apply(blast)\n     apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n     apply(blast)\n    apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n    apply(force)\n   apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n   apply(subgoal_tac \"step_relation M ca e2'' c2''\")\n    apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"d2\"\n      and n=\"na\"\n      and ?e1.0=\"e\"\n      in position_change_due_to_step_relation)\n      apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n      apply(blast)\n     apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n     apply(force)\n    apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n    apply(blast)\n   apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n   apply(simp add: is_forward_deterministic_def)\n   apply(rename_tac na e e1'' e2'' ca c1'' c2'')(*strict*)\n   apply(simp add: is_forward_edge_deterministic_def)\n   apply(erule conjE)\n   apply(erule_tac\n      x=\"ca\"\n      in allE)\n   apply(erule_tac\n      x=\"c1''\"\n      in allE)\n   apply(erule_tac\n      x=\"c2''\"\n      in allE)\n   apply(erule_tac\n      x=\"e1''\"\n      in allE)\n   apply(erule_tac\n      x=\"e2''\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac na e e1'' e2'' ca c1'' c2'')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac na e e1'' e2'' ca c1'' c2'')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac na e e2'' ca c1'' c2'')(*strict*)\n   apply(simp add: is_forward_target_deterministic_def)\n   apply(erule_tac\n      x=\"ca\"\n      in allE)\n   apply(erule_tac\n      x=\"c1''\"\n      in allE)\n   apply(erule_tac\n      x=\"c2''\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac na e e2'' ca c1'' c2'')(*strict*)\n    apply(rule_tac\n      x=\"e2''\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac na e e2'' ca c1'' c2'')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x na)(*strict*)\n  apply(erule_tac\n      x=\"Suc na\"\n      in allE)+\n  apply(force)\n  done\n\nlemma derivation_initial_is_derivation: \"\n  derivation_initial G d\n  \\<Longrightarrow> derivation G d\"\n  apply(simp add: derivation_initial_def)\n  done\n\nlemma derivationsCoincideR: \"\n  is_forward_deterministic_accessible M\n  \\<Longrightarrow> derivation M d1\n  \\<Longrightarrow> maximum_of_domain d1 n\n  \\<Longrightarrow> d1 0=Some (pair None c)\n  \\<Longrightarrow> d1 n=Some (pair e1 c1)\n  \\<Longrightarrow> derivation_initial M d2\n  \\<Longrightarrow> maximum_of_domain d2 n\n  \\<Longrightarrow> d2 0=Some (pair None c)\n  \\<Longrightarrow> d2 n=Some (pair e2 c2)\n  \\<Longrightarrow> d1=d2\"\n  apply(rule HOL.ext)\n  apply(rename_tac x)(*strict*)\n  apply(induct_tac x)\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x na)(*strict*)\n  apply(subgoal_tac \"\\<forall>m>n. d1 m = None\")\n   apply(rename_tac x na)(*strict*)\n   prefer 2\n   apply(rule noSomeAfterMaxDom)\n    apply(rename_tac x na)(*strict*)\n    apply(blast)\n   apply(rename_tac x na)(*strict*)\n   apply(blast)\n  apply(rename_tac x na)(*strict*)\n  apply(subgoal_tac \"\\<forall>m>n. d2 m = None\")\n   apply(rename_tac x na)(*strict*)\n   prefer 2\n   apply(rule noSomeAfterMaxDom)\n    apply(rename_tac x na)(*strict*)\n    apply(rule derivation_initial_is_derivation)\n    apply(blast)\n   apply(rename_tac x na)(*strict*)\n   apply(blast)\n  apply(rename_tac x na)(*strict*)\n  apply(case_tac \"Suc na\\<le>n\")\n   apply(rename_tac x na)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d1 na = Some (pair e c)\")\n    apply(rename_tac x na)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom)\n      apply(rename_tac x na)(*strict*)\n      apply(blast)\n     apply(rename_tac x na)(*strict*)\n     apply(blast)\n    apply(rename_tac x na)(*strict*)\n    apply(force)\n   apply(rename_tac x na)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1'' c1''. d1 (Suc na) = Some (pair (Some e1'') c1'')\")\n    apply(rename_tac x na)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac x na)(*strict*)\n      apply(blast)\n     apply(rename_tac x na)(*strict*)\n     apply(blast)\n    apply(rename_tac x na)(*strict*)\n    apply(blast)\n   apply(rename_tac x na)(*strict*)\n   apply(subgoal_tac \"\\<exists>e2'' c2''. d2 (Suc na) = Some (pair (Some e2'') c2'')\")\n    apply(rename_tac x na)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac x na)(*strict*)\n      apply(rule derivation_initial_is_derivation)\n      apply(blast)\n     apply(rename_tac x na)(*strict*)\n     apply(blast)\n    apply(rename_tac x na)(*strict*)\n    apply(blast)\n   apply(rename_tac x na)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n   apply(subgoal_tac \"step_relation M ca e1'' c1''\")\n    apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n    prefer 2\n    apply(rule_tac\n      n=\"na\"\n      in position_change_due_to_step_relation)\n      apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n      apply(blast)\n     apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n     apply(blast)\n    apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n    apply(force)\n   apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n   apply(subgoal_tac \"step_relation M ca e2'' c2''\")\n    apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"d2\"\n      and n=\"na\"\n      and ?e1.0=\"e\"\n      in position_change_due_to_step_relation)\n      apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n      apply(rule derivation_initial_is_derivation)\n      apply(blast)\n     apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n     apply(force)\n    apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n    apply(blast)\n   apply(rename_tac x na e e1'' e2'' ca c1'' c2'')(*strict*)\n   apply(simp add: is_forward_deterministic_accessible_def)\n   apply(rename_tac na e e1'' e2'' ca c1'' c2'')(*strict*)\n   apply(simp add: is_forward_edge_deterministic_accessible_def)\n   apply(erule conjE)\n   apply(erule_tac\n      x=\"ca\"\n      in ballE)\n    apply(rename_tac na e e1'' e2'' ca c1'' c2'')(*strict*)\n    apply(erule_tac\n      x=\"c1''\"\n      in allE)\n    apply(erule_tac\n      x=\"c2''\"\n      in allE)\n    apply(erule_tac\n      x=\"e1''\"\n      in allE)\n    apply(erule_tac\n      x=\"e2''\"\n      in allE)\n    apply(erule impE)\n     apply(rename_tac na e e1'' e2'' ca c1'' c2'')(*strict*)\n     apply(clarsimp)\n    apply(rename_tac na e e1'' e2'' ca c1'' c2'')(*strict*)\n    apply(clarsimp)\n    apply(rename_tac na e e2'' ca c1'' c2'')(*strict*)\n    apply(simp add: is_forward_target_deterministic_accessible_def)\n    apply(erule_tac\n      x=\"ca\"\n      in ballE)\n     apply(rename_tac na e e2'' ca c1'' c2'')(*strict*)\n     apply(erule_tac\n      x=\"c1''\"\n      in allE)\n     apply(erule_tac\n      x=\"c2''\"\n      in allE)\n     apply(erule impE)\n      apply(rename_tac na e e2'' ca c1'' c2'')(*strict*)\n      apply(rule_tac\n      x=\"e2''\"\n      in exI)\n      apply(clarsimp)\n     apply(rename_tac na e e2'' ca c1'' c2'')(*strict*)\n     apply(clarsimp)\n    apply(rename_tac na e e2'' ca c1'' c2'')(*strict*)\n    apply(simp add: get_accessible_configurations_def)\n    apply(erule_tac\n      x=\"d2\"\n      in allE)\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"na\"\n      and P=\"\\<lambda>i. get_configuration (d2 i) \\<noteq> Some ca\"\n      in allE)\n    apply(simp add: get_configuration_def)\n    apply(case_tac \"d2 na\")\n     apply(rename_tac na e e2'' ca c1'' c2'')(*strict*)\n     apply(force)\n    apply(rename_tac na e e2'' ca c1'' c2'' a)(*strict*)\n    apply(force)\n   apply(rename_tac na e e1'' e2'' ca c1'' c2'')(*strict*)\n   apply(simp add: get_accessible_configurations_def)\n   apply(erule_tac\n      x=\"d2\"\n      in allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"na\"\n      and P=\"\\<lambda>i. get_configuration (d2 i) \\<noteq> Some ca\"\n      in allE)\n   apply(simp add: get_configuration_def)\n   apply(case_tac \"d2 na\")\n    apply(rename_tac na e e1'' e2'' ca c1'' c2'')(*strict*)\n    apply(force)\n   apply(rename_tac na e e1'' e2'' ca c1'' c2'' a)(*strict*)\n   apply(force)\n  apply(rename_tac x na)(*strict*)\n  apply(force)\n  done\n\nlemma property_preseved_under_steps_is_invariant2: \"\n  derivation G d\n  \\<Longrightarrow> P (d m)\n  \\<Longrightarrow> m \\<le> x\n  \\<Longrightarrow> x \\<le> m + n\n  \\<Longrightarrow> \\<forall>i. m\\<le>i \\<and> i<m + n \\<and> P (d i) \\<longrightarrow> P (d (Suc i))\n  \\<Longrightarrow> P (d x)\"\n  apply(subgoal_tac \"\\<forall>k. (k\\<ge>m \\<and> k \\<le> m+n \\<longrightarrow> P (d k))\")\n   apply(blast)\n  apply(rule allI)\n  apply(rename_tac k)(*strict*)\n  apply(induct_tac k)\n   apply(rename_tac k)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac k na)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na)(*strict*)\n  apply(case_tac \"m \\<le> na\")\n   apply(rename_tac na)(*strict*)\n   apply(auto)\n  apply(rename_tac na)(*strict*)\n  apply(subgoal_tac \"m=Suc na\")\n   apply(rename_tac na)(*strict*)\n   defer\n   apply(auto)\n  done\n\nlemma later_in_configuration_label: \"\n  TSstructure M\n  \\<Longrightarrow> derivation M d\n  \\<Longrightarrow> d m = Some (pair me mc)\n  \\<Longrightarrow> mc \\<in> configurations M\n  \\<Longrightarrow> m<n\n  \\<Longrightarrow> d n = Some (pair (Some ne) nc)\n  \\<Longrightarrow> ne \\<in> step_labels M \\<and> nc \\<in> configurations M\"\n  apply(subgoal_tac \"\\<forall>nc ne. d n = Some (pair (Some ne) nc) \\<longrightarrow> (ne \\<in> step_labels M \\<and> nc\\<in> configurations M)\")\n   apply(force)\n  apply(rule_tac\n      m=\"Suc m\"\n      and x=\"n\"\n      and n=\"n\"\n      in property_preseved_under_steps_is_invariant2)\n      apply(force)\n     apply(clarsimp)\n     apply(rename_tac nca nea)(*strict*)\n     apply(subgoal_tac \"step_relation M mc nea nca\")\n      apply(rename_tac nca nea)(*strict*)\n      prefer 2\n      apply(rule position_change_due_to_step_relation)\n        apply(rename_tac nca nea)(*strict*)\n        apply(blast)+\n     apply(rename_tac nca nea)(*strict*)\n     apply(rule AX_step_relation_preserves_belongs)\n       apply(rename_tac nca nea)(*strict*)\n       apply(force)\n      apply(rename_tac nca nea)(*strict*)\n      apply(force)\n     apply(rename_tac nca nea)(*strict*)\n     apply(force)\n    apply(arith)\n   apply(clarsimp)\n  apply(rule allI)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i nca nea)(*strict*)\n  apply(case_tac \"d i\")\n   apply(rename_tac i nca nea)(*strict*)\n   apply(rule_tac\n      i=\"i\"\n      and n=\"Suc i\"\n      in derivationNoFromNone2)\n      apply(rename_tac i nca nea)(*strict*)\n      apply(force)\n     apply(rename_tac i nca nea)(*strict*)\n     apply(force)\n    apply(rename_tac i nca nea)(*strict*)\n    apply(force)\n   apply(rename_tac i nca nea)(*strict*)\n   apply(force)\n  apply(rename_tac i nca nea a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac i nca nea a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i nca nea option b)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i nca nea option b)(*strict*)\n   apply(force)\n  apply(rename_tac i nca nea option b nat)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac i nca nea option b nat)(*strict*)\n   apply(rule_tac derivation_Always_PreEdge_prime)\n    apply(rename_tac i nca nea option b nat)(*strict*)\n    apply(force)\n   apply(rename_tac i nca nea option b nat)(*strict*)\n   apply(force)\n  apply(rename_tac i nca nea option b nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nca nea b nat a)(*strict*)\n  apply(subgoal_tac \"step_relation M b nea nca\")\n   apply(rename_tac nca nea b nat a)(*strict*)\n   prefer 2\n   apply(rule position_change_due_to_step_relation)\n     apply(rename_tac nca nea b nat a)(*strict*)\n     apply(blast)+\n  apply(rename_tac nca nea b nat a)(*strict*)\n  apply(rule AX_step_relation_preserves_belongs)\n    apply(rename_tac nca nea b nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nca nea b nat a)(*strict*)\n   apply(force)\n  apply(rename_tac nca nea b nat a)(*strict*)\n  apply(force)\n  done\n\nlemma stays_in_configuration: \"\n  TSstructure M\n  \\<Longrightarrow> derivation M d\n  \\<Longrightarrow> d m = Some (pair me mc)\n  \\<Longrightarrow> mc \\<in> configurations M\n  \\<Longrightarrow> m\\<le>n\n  \\<Longrightarrow> d n = Some (pair ne nc)\n  \\<Longrightarrow> nc \\<in> configurations M\"\n  apply(subgoal_tac \"\\<forall>nc ne. d n = Some (pair ne nc) \\<longrightarrow> nc \\<in> configurations M\")\n   apply(force)\n  apply(rule_tac\n      m=\"m\"\n      and x=\"n\"\n      and n=\"n\"\n      in property_preseved_under_steps_is_invariant2)\n      apply(force)\n     apply(clarsimp)\n    apply(blast)\n   apply(arith)\n  apply(clarsimp)\n  apply(rename_tac i nca nea)(*strict*)\n  apply(case_tac \"d i\")\n   apply(rename_tac i nca nea)(*strict*)\n   apply(rule_tac\n      i=\"i\"\n      and n=\"Suc i\"\n      in derivationNoFromNone2)\n      apply(rename_tac i nca nea)(*strict*)\n      apply(force)\n     apply(rename_tac i nca nea)(*strict*)\n     apply(force)\n    apply(rename_tac i nca nea)(*strict*)\n    apply(force)\n   apply(rename_tac i nca nea)(*strict*)\n   apply(force)\n  apply(rename_tac i nca nea a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac i nca nea a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i nca nea option b)(*strict*)\n  apply(case_tac nea)\n   apply(rename_tac i nca nea option b)(*strict*)\n   apply(rule derivation_Always_PreEdge_prime)\n    apply(rename_tac i nca nea option b)(*strict*)\n    apply(force)\n   apply(rename_tac i nca nea option b)(*strict*)\n   apply(force)\n  apply(rename_tac i nca nea option b a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i nca option b a)(*strict*)\n  apply(subgoal_tac \"step_relation M b a nca\")\n   apply(rename_tac i nca option b a)(*strict*)\n   prefer 2\n   apply(rule position_change_due_to_step_relation)\n     apply(rename_tac i nca option b a)(*strict*)\n     apply(blast)+\n  apply(rename_tac i nca option b a)(*strict*)\n  apply(subgoal_tac \"a \\<in> step_labels M \\<and> nca \\<in> configurations M\")\n   apply(rename_tac i nca option b a)(*strict*)\n   apply(force)\n  apply(rename_tac i nca option b a)(*strict*)\n  apply(rule AX_step_relation_preserves_belongs)\n    apply(rename_tac i nca option b a)(*strict*)\n    apply(force)\n   apply(rename_tac i nca option b a)(*strict*)\n   apply(force)\n  apply(rename_tac i nca option b a)(*strict*)\n  apply(force)\n  done\n\nlemma property_preseved_under_steps_is_invariant2_rev: \"\n  derivation G d\n  \\<Longrightarrow> P (d m)\n  \\<Longrightarrow> m \\<le> x\n  \\<Longrightarrow> x \\<le> m + n\n  \\<Longrightarrow> \\<forall>i. m\\<le>i \\<and> i<m + n \\<and> P (d i) \\<longrightarrow> P (d (Suc i))\n  \\<Longrightarrow> P (d x)\"\n  apply(subgoal_tac \"\\<forall>k. (k\\<ge>m \\<and> k \\<le> m+n \\<longrightarrow> P (d k))\")\n   apply(blast)\n  apply(rule allI)\n  apply(rename_tac k)(*strict*)\n  apply(induct_tac k)\n   apply(rename_tac k)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac k na)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na)(*strict*)\n  apply(case_tac \"m \\<le> na\")\n   apply(rename_tac na)(*strict*)\n   apply(auto)\n  apply(rename_tac na)(*strict*)\n  apply(subgoal_tac \"m=Suc na\")\n   apply(rename_tac na)(*strict*)\n   defer\n   apply(auto)\n  done\n\nlemma derivation_injective: \"\n  is_backward_target_deterministic M\n  \\<Longrightarrow> derivation M d1\n  \\<Longrightarrow> derivation M d2\n  \\<Longrightarrow> maximum_of_domain d1 n1\n  \\<Longrightarrow> maximum_of_domain d2 n2\n  \\<Longrightarrow> d1 0 = Some (pair None c1)\n  \\<Longrightarrow> d2 0 = Some (pair None c2)\n  \\<Longrightarrow> c1 \\<in> configurations M\n  \\<Longrightarrow> c2 \\<in> configurations M\n  \\<Longrightarrow> d1 n1 = Some (pair e1 cfin)\n  \\<Longrightarrow> d2 n2 = Some (pair e2 cfin)\n  \\<Longrightarrow> \\<forall>c c1 c2 e1 e2. (Some c \\<in> set(get_configurations d1 n1)) \\<and> (step_relation M c1 e1 c) \\<and> (step_relation M c2 e2 c) \\<longrightarrow> e1=e2\n  \\<Longrightarrow> \\<forall>c' e. \\<not> (step_relation M c' e c1)\n  \\<Longrightarrow> \\<forall>c' e. \\<not> (step_relation M c' e c2)\n  \\<Longrightarrow> c1=c2\"\n  apply(subgoal_tac \"\\<forall>i. i\\<le>n1 \\<and> i\\<le>n2 \\<longrightarrow> get_configuration (d1 (n1-i)) = get_configuration (d2 (n2-i))\")\n   apply(case_tac \"n1=n2\")\n    apply(erule_tac\n      x=\"n1\"\n      in allE)\n    apply(simp add: get_configuration_def)\n   apply(subgoal_tac \"n1<n2 \\<or> n2<n1\")\n    prefer 2\n    apply(clarsimp)\n   apply(erule disjE)\n    apply(erule_tac\n      x=\"n1\"\n      in allE)\n    apply(erule impE)\n     apply(force)\n    apply(clarsimp)\n    apply(subgoal_tac \"\\<exists>npre. Suc npre=n2-n1\")\n     prefer 2\n     apply (metis gr0_conv_Suc zero_less_diff)\n    apply(erule exE)+\n    apply(rename_tac npre)(*strict*)\n    apply(subgoal_tac \"\\<exists>e c. d2 (Suc npre) = Some (pair (Some e) c)\")\n     apply(rename_tac npre)(*strict*)\n     prefer 2\n     apply(rule_tac some_position_has_details_before_max_dom_after_0)\n       apply(rename_tac npre)(*strict*)\n       apply(force)\n      apply(rename_tac npre)(*strict*)\n      apply(force)\n     apply(rename_tac npre)(*strict*)\n     apply(force)\n    apply(rename_tac npre)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac npre e c)(*strict*)\n    apply(subgoal_tac \"\\<exists>e c. d2 npre = Some (pair e c)\")\n     apply(rename_tac npre e c)(*strict*)\n     prefer 2\n     apply(rule_tac some_position_has_details_before_max_dom)\n       apply(rename_tac npre e c)(*strict*)\n       apply(force)\n      apply(rename_tac npre e c)(*strict*)\n      apply(force)\n     apply(rename_tac npre e c)(*strict*)\n     apply(force)\n    apply(rename_tac npre e c)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac npre e c ea ca)(*strict*)\n    apply(subgoal_tac \"step_relation M ca e c\")\n     apply(rename_tac npre e c ea ca)(*strict*)\n     prefer 2\n     apply(rule_tac\n      d=\"d2\"\n      in position_change_due_to_step_relation)\n       apply(rename_tac npre e c ea ca)(*strict*)\n       apply(force)\n      apply(rename_tac npre e c ea ca)(*strict*)\n      apply(force)\n     apply(rename_tac npre e c ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac npre e c ea ca)(*strict*)\n    apply(erule_tac\n      x=\"ca\"\n      and P=\"\\<lambda>ca. \\<forall>e. \\<not> step_relation M ca e c1\"\n      in allE)\n    apply(erule_tac\n      x=\"e\"\n      in allE)\n    apply(simp add: get_configuration_def)\n   apply(erule_tac\n      x=\"n2\"\n      in allE)\n   apply(erule impE)\n    apply(force)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>npre. Suc npre=n1-n2\")\n    prefer 2\n    apply (metis gr0_conv_Suc zero_less_diff)\n   apply(erule exE)+\n   apply(rename_tac npre)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d1 (Suc npre) = Some (pair (Some e) c)\")\n    apply(rename_tac npre)(*strict*)\n    prefer 2\n    apply(rule_tac some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac npre)(*strict*)\n      apply(force)\n     apply(rename_tac npre)(*strict*)\n     apply(force)\n    apply(rename_tac npre)(*strict*)\n    apply(force)\n   apply(rename_tac npre)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac npre e c)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d1 npre = Some (pair e c)\")\n    apply(rename_tac npre e c)(*strict*)\n    prefer 2\n    apply(rule_tac some_position_has_details_before_max_dom)\n      apply(rename_tac npre e c)(*strict*)\n      apply(force)\n     apply(rename_tac npre e c)(*strict*)\n     apply(force)\n    apply(rename_tac npre e c)(*strict*)\n    apply(force)\n   apply(rename_tac npre e c)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac npre e c ea ca)(*strict*)\n   apply(subgoal_tac \"step_relation M ca e c\")\n    apply(rename_tac npre e c ea ca)(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"d1\"\n      in position_change_due_to_step_relation)\n      apply(rename_tac npre e c ea ca)(*strict*)\n      apply(force)\n     apply(rename_tac npre e c ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac npre e c ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac npre e c ea ca)(*strict*)\n   apply(erule_tac\n      x=\"ca\"\n      and P=\"\\<lambda>ca. \\<forall>e. \\<not> step_relation M ca e c1\"\n      in allE)\n   apply(erule_tac\n      x=\"e\"\n      in allE)\n   apply(simp add: get_configuration_def)\n  apply(rule allI)\n  apply(rename_tac i)(*strict*)\n  apply(induct_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac i n)(*strict*)\n  apply(rule impI)\n  apply(erule conjE)\n  apply(erule impE)\n   apply(rename_tac i n)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i n)(*strict*)\n  apply(subgoal_tac \"\\<exists>n1p. Suc n1p=n1-n\")\n   apply(rename_tac i n)(*strict*)\n   prefer 2\n   apply (metis Suc_le_lessD gr0_conv_Suc zero_less_diff)\n  apply(rename_tac i n)(*strict*)\n  apply(subgoal_tac \"\\<exists>n2p. Suc n2p=n2-n\")\n   apply(rename_tac i n)(*strict*)\n   prefer 2\n   apply(case_tac \"n2-n\")\n    apply(rename_tac i n)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i n nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i n)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac i n n1p n2p)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d1 (Suc n1p) = Some (pair (Some e) c)\")\n   apply(rename_tac i n n1p n2p)(*strict*)\n   prefer 2\n   apply(rule_tac some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac i n n1p n2p)(*strict*)\n     apply(force)\n    apply(rename_tac i n n1p n2p)(*strict*)\n    apply(force)\n   apply(rename_tac i n n1p n2p)(*strict*)\n   apply(force)\n  apply(rename_tac i n n1p n2p)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac i n n1p n2p e c)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d1 n1p = Some (pair e c)\")\n   apply(rename_tac i n n1p n2p e c)(*strict*)\n   prefer 2\n   apply(rule_tac some_position_has_details_before_max_dom)\n     apply(rename_tac i n n1p n2p e c)(*strict*)\n     apply(force)\n    apply(rename_tac i n n1p n2p e c)(*strict*)\n    apply(force)\n   apply(rename_tac i n n1p n2p e c)(*strict*)\n   apply(force)\n  apply(rename_tac i n n1p n2p e c)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac i n n1p n2p e c ea ca)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d2 (Suc n2p) = Some (pair (Some e) c)\")\n   apply(rename_tac i n n1p n2p e c ea ca)(*strict*)\n   prefer 2\n   apply(rule_tac some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac i n n1p n2p e c ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac i n n1p n2p e c ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac i n n1p n2p e c ea ca)(*strict*)\n   apply(force)\n  apply(rename_tac i n n1p n2p e c ea ca)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac i n n1p n2p e c ea ca eb cb)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d2 n2p = Some (pair e c)\")\n   apply(rename_tac i n n1p n2p e c ea ca eb cb)(*strict*)\n   prefer 2\n   apply(rule_tac some_position_has_details_before_max_dom)\n     apply(rename_tac i n n1p n2p e c ea ca eb cb)(*strict*)\n     apply(force)\n    apply(rename_tac i n n1p n2p e c ea ca eb cb)(*strict*)\n    apply(force)\n   apply(rename_tac i n n1p n2p e c ea ca eb cb)(*strict*)\n   apply(force)\n  apply(rename_tac i n n1p n2p e c ea ca eb cb)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n  apply(erule_tac\n      x=\"c\"\n      and P=\"\\<lambda>c. \\<forall>c1 c2 e1 e2. Some c \\<in> set (get_configurations d1 n1) \\<and> step_relation M c1 e1 c \\<and> step_relation M c2 e2 c \\<longrightarrow> e1 = e2\"\n      in allE)\n  apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n  apply(erule_tac\n      x=\"ca\"\n      and P=\"\\<lambda>ca. \\<forall>c2 e1 e2. Some c \\<in> set (get_configurations d1 n1) \\<and> step_relation M ca e1 c \\<and> step_relation M c2 e2 c \\<longrightarrow> e1 = e2\"\n      in allE)\n  apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n  apply(erule_tac\n      x=\"cc\"\n      and P=\"\\<lambda>cc. \\<forall>e1 e2. Some c \\<in> set (get_configurations d1 n1) \\<and> step_relation M ca e1 c \\<and> step_relation M cc e2 c \\<longrightarrow> e1 = e2\"\n      in allE)\n  apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n  apply(erule_tac\n      x=\"e\"\n      in allE)\n  apply(erule_tac\n      x=\"eb\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n    apply(simp add: get_configurations_def)\n    apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n    apply(rule inMap)\n    apply(rule_tac\n      x=\"Suc n1p\"\n      in bexI)\n     apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n     apply(simp add: get_configuration_def)\n    apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n    apply(rule_tac\n      t=\"Suc n1p \\<in> set (nat_seq 0 n1)\"\n      and s=\"(\\<exists>i<length (nat_seq 0 n1). (nat_seq 0 n1) ! i = Suc n1p)\"\n      in ssubst)\n     apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n     apply(rule in_set_conv_nth)\n    apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n    apply(rule_tac\n      x=\"Suc n1p\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n     apply(rule_tac\n      t=\"length (nat_seq 0 n1)\"\n      and s=\"n1 - 0 + 1\"\n      in ssubst)\n      apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n      apply(rule nat_seq_length)\n      apply(force)\n     apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n     apply(force)\n    apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n    apply(rule_tac\n      t=\"nat_seq 0 n1 ! (Suc n1p)\"\n      and s=\"0 + (Suc n1p)\"\n      in ssubst)\n     apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n      apply(force)\n     apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n     apply(force)\n    apply(rename_tac n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n    apply(force)\n   apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n    apply(rule_tac\n      d=\"d1\"\n      in position_change_due_to_step_relation)\n      apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n      apply(force)\n     apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n     apply(force)\n    apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n    apply(force)\n   apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n   apply(rule_tac\n      d=\"d2\"\n      in position_change_due_to_step_relation)\n     apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n     apply(force)\n    apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n    apply(force)\n   apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac i n n1p n2p e c ea ca eb cb ec cc)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n n1p n2p c ea ca eb cb ec cc)(*strict*)\n  apply(subgoal_tac \"n1p=n1 - (Suc n)\")\n   apply(rename_tac n n1p n2p c ea ca eb cb ec cc)(*strict*)\n   prefer 2\n   apply(arith)\n  apply(rename_tac n n1p n2p c ea ca eb cb ec cc)(*strict*)\n  apply(subgoal_tac \"n2p=n2 - (Suc n)\")\n   apply(rename_tac n n1p n2p c ea ca eb cb ec cc)(*strict*)\n   prefer 2\n   apply(arith)\n  apply(rename_tac n n1p n2p c ea ca eb cb ec cc)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(simp add: is_backward_target_deterministic_def)\n  apply(erule_tac\n      x=\"cb\"\n      and P=\"\\<lambda>cb. \\<forall>c1 c2. (\\<exists>e. step_relation M c1 e cb \\<and> step_relation M c2 e cb) \\<longrightarrow> c1 = c2\"\n      in allE)\n  apply(erule_tac\n      x=\"ca\"\n      and P=\"\\<lambda>ca. \\<forall>c2. (\\<exists>e. step_relation M ca e cb \\<and> step_relation M c2 e cb) \\<longrightarrow> ca = c2\"\n      in allE)\n  apply(erule_tac\n      x=\"cc\"\n      and P=\"\\<lambda>cc. (\\<exists>e. step_relation M ca e cb \\<and> step_relation M cc e cb) \\<longrightarrow> ca = cc\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n   apply(rule_tac\n      x=\"eb\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n    apply(rule_tac\n      d=\"d1\"\n      in position_change_due_to_step_relation)\n      apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n      apply(force)\n     apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n     apply(force)\n    apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n    apply(force)\n   apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n   apply(rule_tac\n      d=\"d2\"\n      in position_change_due_to_step_relation)\n     apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n     apply(force)\n    apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n    apply(force)\n   apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac n c ea ca eb cb ec cc)(*strict*)\n  apply(force)\n  done\n\nlemma deterministic_concat: \"\n  \\<forall>a e b. step_relation M a e b \\<longrightarrow> step_relation M (C a) e (C b)\n  \\<Longrightarrow> is_forward_deterministic M\n  \\<Longrightarrow> derivation M d1\n  \\<Longrightarrow> derivation M d2\n  \\<Longrightarrow> derivation M d3\n  \\<Longrightarrow> derivation M d4\n  \\<Longrightarrow> maximum_of_domain d1 n1\n  \\<Longrightarrow> maximum_of_domain d2 n2\n  \\<Longrightarrow> maximum_of_domain d3 (n1+n2)\n  \\<Longrightarrow> maximum_of_domain d4 (n1+n2)\n  \\<Longrightarrow> d3 = derivation_append (derivation_map d1 C) d2 n1\n  \\<Longrightarrow> d1 0 = Some (pair None c)\n  \\<Longrightarrow> d4 0 = Some (pair None (C c))\n  \\<Longrightarrow> n2 > 0\n  \\<Longrightarrow> d4 (n1+n2) = d2 n2\n  \\<Longrightarrow> d3=d4\"\n  apply(rule ext)\n  apply(rename_tac x)(*strict*)\n  apply(induct_tac x)\n   apply(rename_tac x)(*strict*)\n   apply(simp add: derivation_append_def derivation_map_def)\n  apply(rename_tac x n)(*strict*)\n  apply(case_tac \"d1 0\")\n   apply(rename_tac x n)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x n a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n)(*strict*)\n  apply(simp add: derivation_append_def derivation_map_def)\n  apply(rule conjI)\n   apply(rename_tac n)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e c. d1 (Suc n) = Some (pair (Some e) c)\")\n    apply(rename_tac n)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac n)(*strict*)\n      apply(blast)+\n   apply(rename_tac n)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n e ca)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d1 n = Some (pair e c)\")\n    apply(rename_tac n e ca)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc n\"\n      in pre_some_position_is_some_position)\n      apply(rename_tac n e ca)(*strict*)\n      apply(force)\n     apply(rename_tac n e ca)(*strict*)\n     apply(force)\n    apply(rename_tac n e ca)(*strict*)\n    apply(force)\n   apply(rename_tac n e ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n e ca ea caa)(*strict*)\n   apply(subgoal_tac \"step_relation M caa e ca\")\n    apply(rename_tac n e ca ea caa)(*strict*)\n    prefer 2\n    apply(simp add: derivation_def)\n    apply(erule_tac\n      x=\"Suc n\"\n      and P=\"\\<lambda>x. case x of 0 \\<Rightarrow> (case d1 0 of None \\<Rightarrow> False | Some (pair None c) \\<Rightarrow> True | Some (pair (Some e) c) \\<Rightarrow> False) | Suc i' \\<Rightarrow> (case d1 x of None \\<Rightarrow> True | Some (pair i1 i2) \\<Rightarrow> (case d1 i' of None \\<Rightarrow> False | Some (pair i'1 i'2) \\<Rightarrow> (case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation M i'2 i1v i2)))\"\n      in allE)\n    apply(rename_tac n e ca ea caa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n e ca ea caa)(*strict*)\n   apply(subgoal_tac \"step_relation M (C caa) e (C ca)\")\n    apply(rename_tac n e ca ea caa)(*strict*)\n    apply(subgoal_tac \"\\<exists>e c. d4 (Suc n) = Some (pair (Some e) c)\")\n     apply(rename_tac n e ca ea caa)(*strict*)\n     prefer 2\n     apply(rule_tac\n      M=\"M\"\n      in some_position_has_details_before_max_dom_after_0)\n       apply(rename_tac n e ca ea caa)(*strict*)\n       apply(force)\n      apply(rename_tac n e ca ea caa)(*strict*)\n      apply(force)\n     apply(rename_tac n e ca ea caa)(*strict*)\n     apply(force)\n    apply(rename_tac n e ca ea caa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    apply(subgoal_tac \"step_relation M (C caa) eb cb\")\n     apply(rename_tac n e ca ea caa eb cb)(*strict*)\n     prefer 2\n     apply(simp add: derivation_def)\n     apply(erule_tac\n      x=\"Suc n\"\n      and P=\"\\<lambda>i. case i of 0 \\<Rightarrow> (case d4 0 of None \\<Rightarrow> False | Some (pair None c) \\<Rightarrow> True | Some (pair (Some e) c) \\<Rightarrow> False) | Suc i' \\<Rightarrow> (case d4 i of None \\<Rightarrow> True | Some (pair i1 i2) \\<Rightarrow> (case d4 i' of None \\<Rightarrow> False | Some (pair i'1 i'2) \\<Rightarrow> (case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation M i'2 i1v i2)))\"\n      in allE)\n     apply(rename_tac n e ca ea caa eb cb)(*strict*)\n     apply(clarsimp)\n     apply(case_tac \"d4 n\")\n      apply(rename_tac n e ca ea caa eb cb)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac n e ca ea caa eb cb a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    apply(rule context_conjI)\n     apply(rename_tac n e ca ea caa eb cb)(*strict*)\n     apply(rule_tac\n      ?c1.0=\"C caa\"\n      in use_is_forward_deterministic_E)\n       apply(rename_tac n e ca ea caa eb cb)(*strict*)\n       apply(force)\n      apply(rename_tac n e ca ea caa eb cb)(*strict*)\n      apply(force)\n     apply(rename_tac n e ca ea caa eb cb)(*strict*)\n     apply(force)\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    apply(rule_tac\n      ?c1.0=\"C caa\"\n      in use_is_forward_deterministic_T)\n      apply(rename_tac n e ca ea caa eb cb)(*strict*)\n      apply(force)\n     apply(rename_tac n e ca ea caa eb cb)(*strict*)\n     apply(force)\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    apply(force)\n   apply(rename_tac n e ca ea caa)(*strict*)\n   apply(erule_tac\n      x=\"caa\"\n      in allE)\n   apply(erule_tac\n      x=\"e\"\n      in allE)\n   apply(erule_tac\n      x=\"ca\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac n)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"n\\<le>n1\")\n   apply(rename_tac n)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"n=n1\")\n    apply(rename_tac n)(*strict*)\n    prefer 2\n    apply(clarsimp)\n   apply(rename_tac n)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e c. d1 n1 = Some (pair e c)\")\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom)\n      apply(blast)\n     apply(blast)\n    apply(arith)\n   apply(clarsimp)\n   apply(rename_tac e ca)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d4 (Suc n1) = Some (pair (Some e) c)\")\n    apply(rename_tac e ca)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"M\"\n      in some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac e ca)(*strict*)\n      apply(force)\n     apply(rename_tac e ca)(*strict*)\n     apply(force)\n    apply(rename_tac e ca)(*strict*)\n    apply(force)\n   apply(rename_tac e ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e ca ea caa)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d2 (Suc 0) = Some (pair (Some e) c)\")\n    apply(rename_tac e ca ea caa)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"M\"\n      in some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac e ca ea caa)(*strict*)\n      apply(force)\n     apply(rename_tac e ca ea caa)(*strict*)\n     apply(force)\n    apply(rename_tac e ca ea caa)(*strict*)\n    apply(arith)\n   apply(rename_tac e ca ea caa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e ca ea caa eb cb)(*strict*)\n   apply(subgoal_tac \"step_relation M (C ca) ea caa\")\n    apply(rename_tac e ca ea caa eb cb)(*strict*)\n    prefer 2\n    apply(simp add: derivation_def)\n    apply(erule_tac\n      x=\"Suc n1\"\n      and P=\"\\<lambda>i. case i of 0 \\<Rightarrow> (case d4 0 of None \\<Rightarrow> False | Some (pair None c) \\<Rightarrow> True | Some (pair (Some e) c) \\<Rightarrow> False) | Suc i' \\<Rightarrow> (case d4 i of None \\<Rightarrow> True | Some (pair i1 i2) \\<Rightarrow> (case d4 i' of None \\<Rightarrow> False | Some (pair i'1 i'2) \\<Rightarrow> (case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation M i'2 i1v i2)))\"\n      in allE)\n    apply(rename_tac e ca ea caa eb cb)(*strict*)\n    apply(clarsimp)\n    apply(case_tac \"d4 n1\")\n     apply(rename_tac e ca ea caa eb cb)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac e ca ea caa eb cb a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac e ca ea caa eb cb)(*strict*)\n   apply(subgoal_tac \"step_relation M (C ca) eb cb\")\n    apply(rename_tac e ca ea caa eb cb)(*strict*)\n    apply(rule context_conjI)\n     apply(rename_tac e ca ea caa eb cb)(*strict*)\n     apply(rule_tac\n      ?c1.0=\"C ca\"\n      in use_is_forward_deterministic_E)\n       apply(rename_tac e ca ea caa eb cb)(*strict*)\n       apply(force)\n      apply(rename_tac e ca ea caa eb cb)(*strict*)\n      apply(force)\n     apply(rename_tac e ca ea caa eb cb)(*strict*)\n     apply(force)\n    apply(rename_tac e ca ea caa eb cb)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac e ca ea caa cb)(*strict*)\n    apply(rule_tac\n      ?c1.0=\"C ca\"\n      in use_is_forward_deterministic_T)\n      apply(rename_tac e ca ea caa cb)(*strict*)\n      apply(force)\n     apply(rename_tac e ca ea caa cb)(*strict*)\n     apply(force)\n    apply(rename_tac e ca ea caa cb)(*strict*)\n    apply(force)\n   apply(rename_tac e ca ea caa eb cb)(*strict*)\n   apply(simp add: derivation_def)\n   apply(erule_tac\n      x=\"Suc n1\"\n      and P=\"\\<lambda>i. case i of 0 \\<Rightarrow> (case if 0 \\<le> n1 then case d1 0 of None \\<Rightarrow> None | Some (pair e c) \\<Rightarrow> Some (pair e (C c)) else d2 (0 - n1) of None \\<Rightarrow> False | Some (pair None c) \\<Rightarrow> True | Some (pair (Some e) c) \\<Rightarrow> False) | Suc i' \\<Rightarrow> (case if i \\<le> n1 then case d1 i of None \\<Rightarrow> None | Some (pair e c) \\<Rightarrow> Some (pair e (C c)) else d2 (i - n1) of None \\<Rightarrow> True | Some (pair i1 i2) \\<Rightarrow> (case if i' \\<le> n1 then case d1 i' of None \\<Rightarrow> None | Some (pair e c) \\<Rightarrow> Some (pair e (C c)) else d2 (i' - n1) of None \\<Rightarrow> False | Some (pair i'1 i'2) \\<Rightarrow> (case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation M i'2 i1v i2)))\"\n      in allE)\n   apply(rename_tac e ca ea caa eb cb)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"d4 n1\")\n    apply(rename_tac e ca ea caa eb cb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac e ca ea caa eb cb a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"Suc n\\<le>(n1+n2)\")\n   apply(rename_tac n)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d2 (n-n1) = Some (pair e c)\")\n    apply(rename_tac n)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom)\n      apply(rename_tac n)(*strict*)\n      apply(blast)+\n    apply(rename_tac n)(*strict*)\n    apply(arith)\n   apply(rename_tac n)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n e ca)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d2 (Suc(n-n1)) = Some (pair (Some e) c)\")\n    apply(rename_tac n e ca)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac n e ca)(*strict*)\n      apply(blast)+\n    apply(rename_tac n e ca)(*strict*)\n    apply(arith)\n   apply(rename_tac n e ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n e ca ea caa)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d4 (Suc n) = Some (pair (Some e) c)\")\n    apply(rename_tac n e ca ea caa)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac n e ca ea caa)(*strict*)\n      apply(blast)+\n   apply(rename_tac n e ca ea caa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n e ca ea caa eb cb)(*strict*)\n   apply(rule_tac\n      t=\"Suc n - n1\"\n      and s=\"Suc(n-n1)\"\n      in ssubst)\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    apply(arith)\n   apply(rename_tac n e ca ea caa eb cb)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"step_relation M ca ea caa\")\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    prefer 2\n    apply(simp add: derivation_def)\n    apply(erule_tac\n      x=\"Suc (n-n1)\"\n      and P=\"\\<lambda>i. case i of 0 \\<Rightarrow> (case d2 0 of None \\<Rightarrow> False | Some (pair None c) \\<Rightarrow> True | Some (pair (Some e) c) \\<Rightarrow> False) | Suc i' \\<Rightarrow> (case d2 i of None \\<Rightarrow> True | Some (pair i1 i2) \\<Rightarrow> (case d2 i' of None \\<Rightarrow> False | Some (pair i'1 i'2) \\<Rightarrow> (case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation M i'2 i1v i2)))\"\n      in allE)\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n e ca ea caa eb cb)(*strict*)\n   apply(subgoal_tac \"step_relation M ca eb cb\")\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    prefer 2\n    apply(simp add: derivation_def)\n    apply(erule_tac\n      x=\"Suc n\"\n      and P=\"\\<lambda>i. case i of 0 \\<Rightarrow> (case d4 0 of None \\<Rightarrow> False | Some (pair None c) \\<Rightarrow> True | Some (pair (Some e) c) \\<Rightarrow> False) | Suc i' \\<Rightarrow> (case d4 i of None \\<Rightarrow> True | Some (pair i1 i2) \\<Rightarrow> (case d4 i' of None \\<Rightarrow> False | Some (pair i'1 i'2) \\<Rightarrow> (case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation M i'2 i1v i2)))\"\n      in allE)\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n e ca ea caa eb cb)(*strict*)\n   apply(rule context_conjI)\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    apply(rule_tac\n      ?c1.0=\"ca\"\n      in use_is_forward_deterministic_E)\n      apply(rename_tac n e ca ea caa eb cb)(*strict*)\n      apply(force)\n     apply(rename_tac n e ca ea caa eb cb)(*strict*)\n     apply(force)\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    apply(force)\n   apply(rename_tac n e ca ea caa eb cb)(*strict*)\n   apply(rule_tac\n      ?c1.0=\"ca\"\n      in use_is_forward_deterministic_T)\n     apply(rename_tac n e ca ea caa eb cb)(*strict*)\n     apply(force)\n    apply(rename_tac n e ca ea caa eb cb)(*strict*)\n    apply(force)\n   apply(rename_tac n e ca ea caa eb cb)(*strict*)\n   apply(force)\n  apply(rename_tac n)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"d4 (Suc n)\"\n      and s=\"None\"\n      in ssubst)\n   apply(rename_tac n)(*strict*)\n   apply(rule none_position_after_max_dom)\n     apply(rename_tac n)(*strict*)\n     apply(force)\n    apply(rename_tac n)(*strict*)\n    apply(force)\n   apply(rename_tac n)(*strict*)\n   apply(force)\n  apply(rename_tac n)(*strict*)\n  apply(rule none_position_after_max_dom)\n    apply(rename_tac n)(*strict*)\n    apply(force)\n   apply(rename_tac n)(*strict*)\n   apply(force)\n  apply(rename_tac n)(*strict*)\n  apply(force)\n  done\n\nlemma final_position_after_every_some_position: \"\n  derivation M d\n  \\<Longrightarrow> d n \\<noteq> None\n  \\<Longrightarrow> d m = Some (pair e c)\n  \\<Longrightarrow> (\\<forall>e' c'. \\<not> step_relation M c e' c')\n  \\<Longrightarrow> n\\<le>m\"\n  apply(case_tac \"n>m\")\n   prefer 2\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac y)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc m) = Some (pair (Some e) c)\")\n   apply(rename_tac y)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n\"\n      in pre_some_position_is_some_position_prime)\n      apply(rename_tac y)(*strict*)\n      apply(force)\n     apply(rename_tac y)(*strict*)\n     apply(force)\n    apply(rename_tac y)(*strict*)\n    apply(force)\n   apply(rename_tac y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y ea ca)(*strict*)\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc m\"\n      in allE)\n  apply(clarsimp)\n  done\n\nlemma None_not_in_get_labels: \"\n  derivation M dP\n  \\<Longrightarrow> maximum_of_domain dP (Suc n)\n  \\<Longrightarrow> r#r' = get_labels dP (Suc n)\n  \\<Longrightarrow> r=None\n  \\<Longrightarrow> P\"\n  apply(simp add: get_labels_def)\n  apply(auto)\n  apply(rename_tac z zs)(*strict*)\n  apply(subgoal_tac \"z=Suc 0\")\n   apply(rename_tac z zs)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac zs)(*strict*)\n   apply(simp add: get_label_def)\n   apply(subgoal_tac \"\\<exists>e c. dP (Suc 0) = Some (pair (Some e) c)\")\n    apply(rename_tac zs)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac zs)(*strict*)\n      apply(blast)+\n   apply(rename_tac zs)(*strict*)\n   apply(auto)\n  apply(rename_tac z zs)(*strict*)\n  apply(rule_tac\n      t=\"Suc 0\"\n      and s=\"(nat_seq (Suc 0) (Suc n))!0\"\n      in ssubst)\n   apply(rename_tac z zs)(*strict*)\n   apply(rule_tac\n      t=\"nat_seq (Suc 0) (Suc n)\"\n      and s=\"(if (Suc 0) \\<le> (Suc n) then [Suc 0] @ nat_seq (Suc (Suc 0)) (Suc n) else [])\"\n      in ssubst)\n    apply(rename_tac z zs)(*strict*)\n    apply(rule nat_seq.psimps)\n    apply(rule nat_seq_termination)\n   apply(rename_tac z zs)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac z zs)(*strict*)\n  apply(auto)\n  done\n\nlemma get_labels_nth_notNone: \"\n  derivation M dP\n  \\<Longrightarrow> maximum_of_domain dP n\n  \\<Longrightarrow> i<n\n  \\<Longrightarrow> r = get_labels dP n\n  \\<Longrightarrow> r!i=None\n  \\<Longrightarrow> P\"\n  apply(simp add: get_labels_def)\n  apply(auto)\n  apply(subgoal_tac \"map (\\<lambda>i. get_label (dP i)) (nat_seq (Suc 0) n) ! i \\<noteq> None\")\n   apply(force)\n  apply(rule_tac\n      t=\"map (\\<lambda>i. get_label (dP i)) (nat_seq (Suc 0) n) ! i\"\n      and s=\"(\\<lambda>i. get_label (dP i)) ((nat_seq (Suc 0) n) ! i)\"\n      in ssubst)\n   apply(rule List.nth_map)\n   apply(rule_tac\n      t=\"length (nat_seq (Suc 0) n)\"\n      and s=\"n - (Suc 0) + 1\"\n      in ssubst)\n    apply(rule nat_seq_length)\n    apply(arith)\n   apply(arith)\n  apply(rule_tac\n      t=\"(nat_seq (Suc 0) n) ! i\"\n      and s=\"(Suc 0)+i\"\n      in ssubst)\n   apply(rule nat_seq_nth_compute)\n    apply(arith)\n   apply(arith)\n  apply(subgoal_tac \"\\<exists>e c. dP (Suc i) = Some (pair (Some e) c)\")\n   prefer 2\n   apply(rule some_position_has_details_before_max_dom_after_0)\n     apply(blast)+\n   apply(arith)\n  apply(simp add: get_label_def)\n  apply(force)\n  done\n\nlemma identify_getLabel_with_derivation_get_label: \"\n  derivation P d\n  \\<Longrightarrow> maximum_of_domain d (Suc n)\n  \\<Longrightarrow> \\<pi>' = get_labels d (Suc n)\n  \\<Longrightarrow> Suc k\\<le>Suc n\n  \\<Longrightarrow> d (Suc k) = Some (pair (Some e) c)\n  \\<Longrightarrow> Some e=\\<pi>'!k\"\n  apply(auto)\n  apply(simp add: get_labels_def)\n  apply(rule_tac\n      t=\"map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (Suc n)) ! k\"\n      and s=\"(\\<lambda>i. get_label (d i)) ((nat_seq (Suc 0) (Suc n)) ! k)\"\n      in ssubst)\n   apply(rule List.nth_map)\n   apply(rule_tac\n      t=\"length (nat_seq (Suc 0) (Suc n))\"\n      and s=\"(Suc n) - (Suc 0) + 1\"\n      in ssubst)\n    apply(rule nat_seq_length)\n    apply(arith)\n   apply(arith)\n  apply(rule_tac\n      t=\"(nat_seq (Suc 0) (Suc n)) ! k\"\n      and s=\"(Suc 0)+k\"\n      in ssubst)\n   apply(rule nat_seq_nth_compute)\n    apply(arith)\n   apply(arith)\n  apply(simp add: get_label_def)\n  done\n\nlemma get_configurations_not_none: \"\n  derivation M d\n  \\<Longrightarrow> d n \\<noteq> None\n  \\<Longrightarrow> m\\<le>n\n  \\<Longrightarrow> i\\<le>m\n  \\<Longrightarrow> (get_configurations d m)!i = None\n  \\<Longrightarrow> P\"\n  apply(subgoal_tac \"get_configurations d m ! i \\<noteq> None\")\n   apply(blast)\n  apply(thin_tac \"get_configurations d m ! i = None\")\n  apply(simp add: get_configurations_def)\n  apply(simp add: get_configuration_def)\n  apply(clarsimp)\n  apply(rename_tac y)(*strict*)\n  apply(rule_tac\n      t=\"map (\\<lambda>i. case d i of None \\<Rightarrow> None | Some (pair e c) \\<Rightarrow> Some c) (nat_seq 0 m) ! i\"\n      and s = \"(\\<lambda>i. case d i of None \\<Rightarrow> None | Some (pair e c) \\<Rightarrow> Some c) ((nat_seq 0 m) ! i) \"\n      in ssubst)\n   apply(rename_tac y)(*strict*)\n   apply(rule nth_map)\n   apply(subgoal_tac \"length (nat_seq 0 m) = m - 0 + 1\")\n    apply(rename_tac y)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length)\n    apply(blast)\n   apply(rename_tac y)(*strict*)\n   apply(arith)\n  apply(rename_tac y)(*strict*)\n  apply(rule_tac\n      t=\"nat_seq 0 m ! i\"\n      and s = \"0 + i\"\n      in ssubst)\n   apply(rename_tac y)(*strict*)\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac y)(*strict*)\n    apply(blast)\n   apply(rename_tac y)(*strict*)\n   apply(arith)\n  apply(rename_tac y)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e c. d i = Some (pair e c)\")\n   apply(rename_tac y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y)(*strict*)\n  apply(rule pre_some_position_is_some_position)\n    apply(rename_tac y)(*strict*)\n    apply(blast)+\n  apply(rename_tac y)(*strict*)\n  apply(arith)\n  done\n\nlemma get_labels_prefixes: \"\n  derivation M d\n  \\<Longrightarrow> k\\<le>n\n  \\<Longrightarrow> take k (get_labels d n) = take k (get_labels d (n+m))\"\n  apply(subgoal_tac \"length (get_labels d n)=n\")\n   prefer 2\n   apply(rule get_labels_length)\n   apply(force)\n  apply(subgoal_tac \"length (get_labels d (n+m))=n+m\")\n   prefer 2\n   apply(rule get_labels_length)\n   apply(force)\n  apply(rule listEqI)\n   apply(clarsimp)\n   apply(force)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"d (Suc i)\")\n   apply(rename_tac i)(*strict*)\n   apply(rule_tac\n      t=\"get_labels d n ! i\"\n      and s=\"None\"\n      in ssubst)\n    apply(rename_tac i)(*strict*)\n    apply(rule get_labels_None)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(rule_tac\n      t=\"get_labels d (n + m) ! i\"\n      and s= \"None\"\n      in ssubst)\n    apply(rename_tac i)(*strict*)\n    apply(rule get_labels_None)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(force)\n  apply(rename_tac i a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac i a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i option b)(*strict*)\n  apply(rename_tac i x b)\n  apply(rename_tac i x b)(*strict*)\n  apply(rule_tac\n      t=\"get_labels d n ! i\"\n      and s=\"x\"\n      in ssubst)\n   apply(rename_tac i x b)(*strict*)\n   apply(rule get_labels_Not_None)\n    apply(rename_tac i x b)(*strict*)\n    apply(force)\n   apply(rename_tac i x b)(*strict*)\n   apply(force)\n  apply(rename_tac i x b)(*strict*)\n  apply(rule_tac\n      t=\"get_labels d (n + m) ! i\"\n      and s= \"x\"\n      in ssubst)\n   apply(rename_tac i x b)(*strict*)\n   apply(rule get_labels_Not_None)\n    apply(rename_tac i x b)(*strict*)\n    apply(force)\n   apply(rename_tac i x b)(*strict*)\n   apply(force)\n  apply(rename_tac i x b)(*strict*)\n  apply(force)\n  done\n\nlemma derivation_preserves_step_labels: \"\n  TSstructure M\n  \\<Longrightarrow> derivation M d\n  \\<Longrightarrow> d 0 = Some (pair None c)\n  \\<Longrightarrow> c \\<in> configurations M\n  \\<Longrightarrow> Some x\\<in> set(get_labels d n)\n  \\<Longrightarrow> x \\<in> step_labels M\"\n  apply(simp add: get_labels_def)\n  apply(simp add: get_label_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac \"d i\")\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac i a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i b)(*strict*)\n  apply(subgoal_tac \"i>0\")\n   apply(rename_tac i b)(*strict*)\n   apply(subgoal_tac \"\\<exists>j. Suc j=i\")\n    apply(rename_tac i b)(*strict*)\n    prefer 2\n    apply(case_tac i)\n     apply(rename_tac i b)(*strict*)\n     apply(force)\n    apply(rename_tac i b nat)(*strict*)\n    apply(force)\n   apply(rename_tac i b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac b j)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d j = Some (pair e c)\")\n    apply(rename_tac b j)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc j\"\n      in pre_some_position_is_some_position)\n      apply(rename_tac b j)(*strict*)\n      apply(force)\n     apply(rename_tac b j)(*strict*)\n     apply(force)\n    apply(rename_tac b j)(*strict*)\n    apply(force)\n   apply(rename_tac b j)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac b j e ca)(*strict*)\n   apply(subgoal_tac \"x \\<in> step_labels M \\<and> b \\<in> configurations M\")\n    apply(rename_tac b j e ca)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"0\"\n      in later_in_configuration_label)\n         apply(rename_tac b j e ca)(*strict*)\n         apply(force)\n        apply(rename_tac b j e ca)(*strict*)\n        apply(force)\n       apply(rename_tac b j e ca)(*strict*)\n       apply(force)\n      apply(rename_tac b j e ca)(*strict*)\n      apply(force)\n     apply(rename_tac b j e ca)(*strict*)\n     apply(force)\n    apply(rename_tac b j e ca)(*strict*)\n    apply(force)\n   apply(rename_tac b j e ca)(*strict*)\n   apply(force)\n  apply(rename_tac i b)(*strict*)\n  apply(subgoal_tac \"Suc 0 \\<le> i \\<and> i \\<le> n\")\n   apply(rename_tac i b)(*strict*)\n   apply(force)\n  apply(rename_tac i b)(*strict*)\n  apply(rule nat_seq_in_interval)\n  apply(force)\n  done\n\nlemma derivation_initialI: \"\n  derivation G d\n  \\<Longrightarrow> (\\<exists>c. d 0 = Some (pair None c) \\<Longrightarrow> the(get_configuration(d 0)) \\<in> initial_configurations G)\n  \\<Longrightarrow> derivation_initial G d\"\n  apply(simp add: derivation_initial_def)\n  apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n   apply(clarsimp)\n   apply(rename_tac c)(*strict*)\n   apply(simp add: get_configuration_def)\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"0\"\n      in allE)\n  apply(clarsimp)\n  apply(case_tac \"d 0\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac option b)(*strict*)\n   apply(force)\n  apply(rename_tac option b a)(*strict*)\n  apply(force)\n  done\n\nlemma get_labels_only_Some: \"\n  derivation M d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> None \\<notin> set (get_labels d n)\"\n  apply(simp add: get_labels_def)\n  apply(simp add: get_label_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(subgoal_tac \"Suc 0 \\<le> i \\<and> i \\<le> n\")\n   apply(rename_tac i)(*strict*)\n   prefer 2\n   apply(rule nat_seq_in_interval)\n   apply(force)\n  apply(rename_tac i)(*strict*)\n  apply(thin_tac \"i \\<in> set (nat_seq (Suc 0) n)\")\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc nat) = Some (pair (Some e) c)\")\n   apply(rename_tac i nat)(*strict*)\n   prefer 2\n   apply(rule some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac i nat)(*strict*)\n     apply(blast)\n    apply(rename_tac i nat)(*strict*)\n    apply(blast)\n   apply(rename_tac i nat)(*strict*)\n   apply(arith)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma belongs_getLabel_are_in_step_labels: \"\n  derivation M d\n  \\<Longrightarrow> belongs M d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> None \\<notin> set (get_labels d n)\n  \\<Longrightarrow> set (get_labels d n) \\<subseteq> Some ` step_labels M\"\n  apply(auto)\n  apply(rename_tac x)(*strict*)\n  apply(subgoal_tac \"\\<exists>i<length (get_labels d n). get_labels d n ! i = x\")\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(rule set_elem_nth)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(auto)\n  apply(rename_tac i)(*strict*)\n  apply(subgoal_tac \"length (get_labels d n) = n\")\n   apply(rename_tac i)(*strict*)\n   prefer 2\n   apply(rule get_labels_length)\n   apply(force)\n  apply(rename_tac i)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n   apply(rename_tac i)(*strict*)\n   prefer 2\n   apply(rule some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac i)(*strict*)\n     apply(blast)\n    apply(rename_tac i)(*strict*)\n    apply(blast)\n   apply(rename_tac i)(*strict*)\n   apply(arith)\n  apply(rename_tac i)(*strict*)\n  apply(auto)\n  apply(rename_tac i e c)(*strict*)\n  apply(rule_tac\n      t=\"get_labels d n ! i\"\n      and s=\"Some e\"\n      in ssubst)\n   apply(rename_tac i e c)(*strict*)\n   apply(rule get_labels_Not_None)\n    apply(rename_tac i e c)(*strict*)\n    apply(force)\n   apply(rename_tac i e c)(*strict*)\n   apply(force)\n  apply(rename_tac i e c)(*strict*)\n  apply(rule inMap)\n  apply(rule_tac\n      x=\"e\"\n      in bexI)\n   apply(rename_tac i e c)(*strict*)\n   apply(auto)\n  apply(rename_tac i e c)(*strict*)\n  apply(simp add: belongs_def)\n  apply(erule_tac\n      x=\"Suc i\"\n      in allE)\n  apply(auto)\n  done\n\nlemma derivation_drop_preserves_belongs: \"\n  derivation M d\n  \\<Longrightarrow> belongs M d\n  \\<Longrightarrow> d n\\<noteq>None\n  \\<Longrightarrow> belongs M (derivation_drop d n)\"\n  apply(simp add: belongs_def)\n  apply(clarsimp)\n  apply(rename_tac y i)(*strict*)\n  apply(erule_tac\n      x=\"i+n\"\n      in allE)\n  apply(simp add: derivation_drop_def)\n  apply(clarsimp)\n  apply(rename_tac y)(*strict*)\n  apply(case_tac y)\n  apply(rename_tac y option b)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma belongs_step_labels: \"\n  belongs P d\n  \\<Longrightarrow> d i = Some (pair (Some e) c)\n  \\<Longrightarrow> e \\<in> step_labels P\"\n  apply(simp add: belongs_def)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(auto)\n  done\n\nlemma derivation_belongs: \"\n  TSstructure P\n  \\<Longrightarrow> d 0 = Some (pair None ca)\n  \\<Longrightarrow> ca \\<in> configurations P\n  \\<Longrightarrow> derivation P d\n  \\<Longrightarrow> belongs P d\"\n  apply(simp only: belongs_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(case_tac \"d i\")\n   apply(rename_tac i nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac nat a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat option b)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac nat option b)(*strict*)\n   apply(rule derivation_Always_PreEdge_prime)\n    apply(rename_tac nat option b)(*strict*)\n    apply(force)\n   apply(rename_tac nat option b)(*strict*)\n   apply(force)\n  apply(rename_tac nat option b a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat b a)(*strict*)\n  apply(rule later_in_configuration_label)\n       apply(rename_tac nat b a)(*strict*)\n       apply(force)\n      apply(rename_tac nat b a)(*strict*)\n      apply(force)\n     apply(rename_tac nat b a)(*strict*)\n     apply(force)\n    apply(rename_tac nat b a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac nat b a)(*strict*)\n   apply(force)\n  apply(rename_tac nat b a)(*strict*)\n  apply(force)\n  done\n\nlemma derivation_initial_belongs: \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G d\n  \\<Longrightarrow> belongs G d\"\n  apply(simp add: derivation_initial_def)\n  apply(clarsimp)\n  apply(case_tac \"d 0\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b)(*strict*)\n  apply(rule derivation_belongs)\n     apply(rename_tac b)(*strict*)\n     apply(force)\n    apply(rename_tac b)(*strict*)\n    apply(force)\n   apply(rename_tac b)(*strict*)\n   apply(rule_tac\n      A=\"initial_configurations G\"\n      in set_mp)\n    apply(rename_tac b)(*strict*)\n    apply(rule AX_initial_configuration_belongs)\n    apply(force)\n   apply(rename_tac b)(*strict*)\n   apply(force)\n  apply(rename_tac b)(*strict*)\n  apply(force)\n  done\n\nlemma belongs_configurations: \"\n  belongs M d\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> c \\<in> configurations M\"\n  apply(simp add: belongs_def)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(clarsimp)\n  done\n\nlemma get_accessible_configurations_are_configurations: \"\n  TSstructure M\n  \\<Longrightarrow> get_accessible_configurations M \\<subseteq> configurations M\"\n  apply(simp add: get_accessible_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac x d i)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(case_tac \"d i\")\n   apply(rename_tac x d i)(*strict*)\n   apply(force)\n  apply(rename_tac x d i a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac x d i a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d i option)(*strict*)\n  apply(rule belongs_configurations)\n   apply(rename_tac x d i option)(*strict*)\n   apply(rule derivation_initial_belongs)\n    apply(rename_tac x d i option)(*strict*)\n    apply(force)\n   apply(rename_tac x d i option)(*strict*)\n   apply(force)\n  apply(rename_tac x d i option)(*strict*)\n  apply(force)\n  done\n\nlemma maximum_of_domain_not_0_position_at_Suc0: \"\n  derivation M d\n  \\<Longrightarrow> \\<not> maximum_of_domain d 0\n  \\<Longrightarrow> \\<exists>e c. d (Suc 0) = Some (pair (Some e) c)\"\n  apply(subgoal_tac \"\\<exists>c0. d 0 = Some (pair None c0)\")\n   apply(simp add: maximum_of_domain_def)\n   apply(clarsimp)\n   apply(rename_tac c0 y)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d (Suc 0) = Some (pair (Some e) c)\")\n    apply(rename_tac c0 y)(*strict*)\n    apply(force)\n   apply(rename_tac c0 y)(*strict*)\n   apply(rule_tac\n      m=\"Suc 0\"\n      in pre_some_position_is_some_position_prime)\n      apply(rename_tac c0 y)(*strict*)\n      apply(force)\n     apply(rename_tac c0 y)(*strict*)\n     apply(force)\n    apply(rename_tac c0 y)(*strict*)\n    apply(force)\n   apply(rename_tac c0 y)(*strict*)\n   apply(force)\n  apply(rule some_position_has_details_at_0)\n  apply(force)\n  done\n\nlemma no_some_beyond_maximum_of_domain: \"\n  derivation M d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> d m \\<noteq> None\n  \\<Longrightarrow> m>n\n  \\<Longrightarrow> P\"\n  apply(subgoal_tac \"\\<forall>m>n. d m = None\")\n   apply(force)\n  apply(rule noSomeAfterMaxDom)\n   apply(force)\n  apply(force)\n  done\n\nlemma dead_end_at_some_is_max_dom2: \"\n  derivation M d\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> \\<forall>e c'. \\<not>(step_relation M c e c')\n  \\<Longrightarrow> maximum_of_domain d i\"\n  apply(simp add: maximum_of_domain_def)\n  apply(case_tac \"d (Suc i)\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc i\"\n      in pre_some_position_is_some_position_prime)\n      apply(rename_tac a)(*strict*)\n      apply(blast)\n     apply(rename_tac a)(*strict*)\n     apply(blast)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ea ca)(*strict*)\n  apply(subgoal_tac \"step_relation M c ea ca\")\n   apply(rename_tac ea ca)(*strict*)\n   prefer 2\n   apply(rule position_change_due_to_step_relation)\n     apply(rename_tac ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac ea ca)(*strict*)\n   apply(force)\n  apply(rename_tac ea ca)(*strict*)\n  apply(force)\n  done\n\nlemma maximum_of_domainUnique: \"\n  derivation G d\n  \\<Longrightarrow> maximum_of_domain d m\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> n=m\"\n  apply(subgoal_tac \"m\\<le>n \\<and> n\\<le>m\")\n   apply(clarsimp)\n  apply(rule conjI)\n   apply(rule allPreMaxDomSome_prime)\n     apply(blast)+\n    apply(simp add: maximum_of_domain_def)\n   apply(blast)\n  apply(rule allPreMaxDomSome_prime)\n    apply(blast)+\n   apply(simp add: maximum_of_domain_def)\n  apply(blast)\n  done\n\nlemma noStepsOnlyZeroLength: \"\n  \\<forall>x e y. \\<not>(step_relation M x e y)\n  \\<Longrightarrow> derivation M d\n  \\<Longrightarrow> maximum_of_domain d 0\"\n  apply(subgoal_tac \"d 0\\<noteq>None\")\n   prefer 2\n   apply(rule initialNotNone)\n   apply(blast)\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc 0\"\n      in allE)\n  apply(auto)\n  apply(rename_tac y)(*strict*)\n  apply(case_tac \"d (Suc 0)\")\n   apply(rename_tac y)(*strict*)\n   apply(auto)\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac y a)(*strict*)\n  apply(simp add: maximum_of_domain_def)\n  apply(case_tac a)\n  apply(rename_tac y a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y option b)(*strict*)\n  apply(case_tac y)\n  apply(rename_tac y option b optiona ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b optiona ba)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac option b optiona ba)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac option b optiona ba a)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma dead_end_at_some_is_max_dom: \"\n  derivation M d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> \\<forall>e c'. \\<not>(step_relation M c e c')\n  \\<Longrightarrow> i=n\"\n  apply(subgoal_tac \"i\\<le>n\")\n   prefer 2\n   apply(rule allPreMaxDomSome_prime)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(case_tac \"i<n\")\n   prefer 2\n   apply(force)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n   prefer 2\n   apply(rule some_position_has_details_before_max_dom_after_0)\n     apply(blast)\n    apply(blast)\n   apply(arith)\n  apply(clarsimp)\n  apply(rename_tac ea ca)(*strict*)\n  apply(rule noDeadEndBeforeMaxDom)\n      apply(rename_tac ea ca)(*strict*)\n      apply(force)\n     apply(rename_tac ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac ea ca)(*strict*)\n   apply(force)\n  apply(rename_tac ea ca)(*strict*)\n  apply(force)\n  done\n\nlemma dead_end_at_some_is_max_dom_prime: \"\n  derivation M d\n  \\<Longrightarrow> d i = Some (pair ei ci)\n  \\<Longrightarrow> d j = Some (pair ej cj)\n  \\<Longrightarrow> \\<forall>e c. \\<not>(step_relation M ci e c)\n  \\<Longrightarrow> \\<forall>e c. \\<not>(step_relation M cj e c)\n  \\<Longrightarrow> i\\<le>j\"\n  apply(case_tac \"i\\<le>j\")\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"j<i\")\n   prefer 2\n   apply(force)\n  apply(case_tac \"Suc j<i\")\n   prefer 2\n   apply(clarsimp)\n   apply(subgoal_tac \"Suc j=i\")\n    prefer 2\n    apply(force)\n   apply(clarsimp)\n   apply(case_tac ei)\n    apply(rule derivation_Always_PreEdge_prime)\n     apply(force)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"step_relation M cj a ci\")\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(rule_tac\n      n=\"j\"\n      in position_change_due_to_step_relation)\n      apply(rename_tac a)(*strict*)\n      apply(blast)\n     apply(rename_tac a)(*strict*)\n     apply(blast)\n    apply(rename_tac a)(*strict*)\n    apply(blast)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"d (Suc j) \\<noteq> None \")\n   prefer 2\n   apply(rule derivationNoFromNone2_prime)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(case_tac \"d (Suc j)\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac option b)(*strict*)\n   apply(rule derivation_Always_PreEdge_prime)\n    apply(rename_tac option b)(*strict*)\n    apply(force)\n   apply(rename_tac option b)(*strict*)\n   apply(force)\n  apply(rename_tac option b a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b a)(*strict*)\n  apply(subgoal_tac \"step_relation M cj a b\")\n   apply(rename_tac b a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      n=\"j\"\n      in position_change_due_to_step_relation)\n     apply(rename_tac b a)(*strict*)\n     apply(blast)\n    apply(rename_tac b a)(*strict*)\n    apply(blast)\n   apply(rename_tac b a)(*strict*)\n   apply(blast)\n  apply(rename_tac b a)(*strict*)\n  apply(force)\n  done\n\nlemma somewhere_none_maximum_of_domain: \"\n  derivation M d\n  \\<Longrightarrow> d i = None\n  \\<Longrightarrow> \\<exists>x<i. maximum_of_domain d x\"\n  apply(induct i)\n   apply(clarsimp)\n   apply(simp add: derivation_def)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"d i\")\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i x)(*strict*)\n   apply(rule_tac\n      x=\"x\"\n      in exI)\n   apply(force)\n  apply(rename_tac i a)(*strict*)\n  apply(clarsimp)\n  apply(simp add: maximum_of_domain_def)\n  apply(force)\n  done\n\nlemma certain_measure_decreasement: \"\n  derivation M d\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> P c = n\n  \\<Longrightarrow> (\\<And>c e c' n. P c = n \\<Longrightarrow> step_relation M c e c' \\<Longrightarrow> \\<exists>m. P c' = m \\<and> m < n)\n  \\<Longrightarrow> \\<forall>e c. d (i + k) = Some (pair e c) \\<longrightarrow> (\\<exists>m. P c = m \\<and> m \\<le> n - k)\"\n  apply(induct k)\n   apply(clarsimp)\n  apply(rename_tac k)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ea ca)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (i+k) = Some (pair e c)\")\n   apply(rename_tac k ea ca)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc (i+k)\"\n      in pre_some_position_is_some_position)\n     apply(rename_tac k ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac k ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac k ea ca)(*strict*)\n   apply(force)\n  apply(rename_tac k ea ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ea ca eaa caa)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc (i+k)) = Some (pair (Some e) c)\")\n   apply(rename_tac k ea ca eaa caa)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc (i+k)\"\n      in pre_some_position_is_some_position_prime)\n      apply(rename_tac k ea ca eaa caa)(*strict*)\n      apply(force)\n     apply(rename_tac k ea ca eaa caa)(*strict*)\n     apply(force)\n    apply(rename_tac k ea ca eaa caa)(*strict*)\n    apply(force)\n   apply(rename_tac k ea ca eaa caa)(*strict*)\n   apply(force)\n  apply(rename_tac k ea ca eaa caa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ca ea caa eb)(*strict*)\n  apply(subgoal_tac \"step_relation M caa eb ca\")\n   apply(rename_tac k ca ea caa eb)(*strict*)\n   prefer 2\n   apply(rule position_change_due_to_step_relation)\n     apply(rename_tac k ca ea caa eb)(*strict*)\n     apply(force)\n    apply(rename_tac k ca ea caa eb)(*strict*)\n    apply(force)\n   apply(rename_tac k ca ea caa eb)(*strict*)\n   apply(force)\n  apply(rename_tac k ca ea caa eb)(*strict*)\n  apply(erule_tac\n      x=\"caa\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"eb\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"ca\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac k ca ea caa eb)(*strict*)\n  apply(erule_tac\n      x=\"P caa\"\n      in meta_allE)\n  apply(force)\n  done\n\nlemma termination_using_measure: \"\n  derivation M d\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> P c = (n::nat)\n  \\<Longrightarrow> (\\<And>c e c' n. P c = n \\<Longrightarrow> step_relation M c e c' \\<Longrightarrow> \\<exists>m. P c' = m \\<and> m<n)\n  \\<Longrightarrow> (\\<And>c e c'. P c = 0 \\<Longrightarrow> step_relation M c e c' \\<Longrightarrow> False)\n  \\<Longrightarrow> \\<exists>x\\<le>n+i. maximum_of_domain d x\"\n  apply(subgoal_tac \"d (i+n+1)=None\")\n   apply(subgoal_tac \"\\<exists>x<(i+n+1). maximum_of_domain d x\")\n    prefer 2\n    apply(rule somewhere_none_maximum_of_domain)\n     apply(force)\n    apply(force)\n   apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(rule_tac\n      x=\"x\"\n      in exI)\n   apply(force)\n  apply(case_tac \"d (i+n)\")\n   apply(case_tac \"d (i+n+1)\")\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(rule_tac\n      n=\"i+n\"\n      in derivationNoFromNone)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(case_tac \"d (i+n+1)\")\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a aa)(*strict*)\n  apply(subgoal_tac \"False\")\n   apply(rename_tac a aa)(*strict*)\n   apply(force)\n  apply(rename_tac a aa)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<forall>(k::nat) e c'. d (i+k) = Some (pair e c') \\<longrightarrow> (\\<exists>m. P c' = m \\<and> m\\<le>P c-k)\")\n   apply(rename_tac a aa)(*strict*)\n   prefer 2\n   apply(rule allI)\n   apply(rename_tac a aa k)(*strict*)\n   apply(rule certain_measure_decreasement)\n      apply(rename_tac a aa k)(*strict*)\n      apply(force)\n     apply(rename_tac a aa k)(*strict*)\n     apply(force)\n    apply(rename_tac a aa k)(*strict*)\n    apply(force)\n   apply(rename_tac a aa k c' ea c'a n)(*strict*)\n   apply(force)\n  apply(rename_tac a aa)(*strict*)\n  apply(erule_tac\n      x=\"P c\"\n      in allE)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a aa option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac aa option b)(*strict*)\n  apply(case_tac aa)\n  apply(rename_tac aa option b optiona ba)(*strict*)\n  apply(case_tac optiona)\n   apply(rename_tac aa option b optiona ba)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option b ba)(*strict*)\n   apply(rule derivation_Always_PreEdge_prime)\n    apply(rename_tac option b ba)(*strict*)\n    apply(force)\n   apply(rename_tac option b ba)(*strict*)\n   apply(force)\n  apply(rename_tac aa option b optiona ba a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b ba a)(*strict*)\n  apply(subgoal_tac \"step_relation M b a ba\")\n   apply(rename_tac option b ba a)(*strict*)\n   prefer 2\n   apply(rule position_change_due_to_step_relation)\n     apply(rename_tac option b ba a)(*strict*)\n     apply(force)\n    apply(rename_tac option b ba a)(*strict*)\n    apply(force)\n   apply(rename_tac option b ba a)(*strict*)\n   apply(force)\n  apply(rename_tac option b ba a)(*strict*)\n  apply(force)\n  done\n\nlemma certain_measure_decreasement2: \"\n  derivation M d\n  \\<Longrightarrow> belongs M d\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> P c = (n::nat)\n  \\<Longrightarrow> (\\<And>c e c' n. P c = n \\<Longrightarrow> step_relation M c e c' \\<Longrightarrow> \\<exists>m. P c' = m \\<and> m\\<ge>n - 1)\n  \\<Longrightarrow> maximal M d\n  \\<Longrightarrow> (\\<And>c. c \\<in> configurations M \\<Longrightarrow> P c >0 \\<Longrightarrow> \\<exists>e c'. step_relation M c e c')\n  \\<Longrightarrow> k\\<le>P c\n  \\<Longrightarrow> \\<exists>e c'. d (i+k) = Some (pair e c') \\<and> (P c-k\\<le>P c')\"\n  apply(induct k)\n   apply(clarsimp)\n  apply(rename_tac k)(*strict*)\n  apply(erule meta_impE)\n   apply(force)\n  apply(rename_tac k)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c'. d (i + k) = Some (pair e c') \\<and> P c - k \\<le> P c'\")\n   apply(rename_tac k)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac k)(*strict*)\n  apply(erule meta_impE)\n   apply(force)\n  apply(rename_tac k)(*strict*)\n  apply(thin_tac \"\\<exists>e c'. d (i + k) = Some (pair e c') \\<and> P c - k \\<le> P c'\")\n  apply(clarsimp)\n  apply(rename_tac k ea c')(*strict*)\n  apply(case_tac \"d (Suc (i+k))\")\n   apply(rename_tac k ea c')(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e. Ex (step_relation M c' e)\")\n    apply(rename_tac k ea c')(*strict*)\n    prefer 2\n    apply(erule_tac\n      x=\"c'\"\n      and P=\"\\<lambda>c'. (c' \\<in> configurations M \\<Longrightarrow> 0 < P c' \\<Longrightarrow> \\<exists>e. Ex (step_relation M c' e))\"\n      in meta_allE)\n    apply(erule meta_impE)\n     apply(rename_tac k ea c')(*strict*)\n     apply(rule belongs_configurations)\n      apply(rename_tac k ea c')(*strict*)\n      apply(force)\n     apply(rename_tac k ea c')(*strict*)\n     apply(force)\n    apply(rename_tac k ea c')(*strict*)\n    apply(force)\n   apply(rename_tac k ea c')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac k ea c' eaa x)(*strict*)\n   apply(simp add: maximal_def)\n   apply(subgoal_tac \"maximum_of_domain d (i+k)\")\n    apply(rename_tac k ea c' eaa x)(*strict*)\n    prefer 2\n    apply(simp add: maximum_of_domain_def)\n   apply(rename_tac k ea c' eaa x)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac k ea c' eaa x)(*strict*)\n    apply(force)\n   apply(rename_tac k ea c' eaa x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac k ea c' eaa x n eb ca)(*strict*)\n   apply(subgoal_tac \"i+k=n\")\n    apply(rename_tac k ea c' eaa x n eb ca)(*strict*)\n    prefer 2\n    apply(rule maximum_of_domainUnique)\n      apply(rename_tac k ea c' eaa x n eb ca)(*strict*)\n      apply(force)\n     apply(rename_tac k ea c' eaa x n eb ca)(*strict*)\n     apply(force)\n    apply(rename_tac k ea c' eaa x n eb ca)(*strict*)\n    apply(force)\n   apply(rename_tac k ea c' eaa x n eb ca)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac k ea c' a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. a = pair (Some e) c\")\n   apply(rename_tac k ea c' a)(*strict*)\n   prefer 2\n   apply(rule some_position_has_details_after_0)\n    apply(rename_tac k ea c' a)(*strict*)\n    apply(force)\n   apply(rename_tac k ea c' a)(*strict*)\n   apply(force)\n  apply(rename_tac k ea c' a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ea c' eaa ca)(*strict*)\n  apply(erule_tac\n      x=\"c'\"\n      and P=\"\\<lambda>c'. (\\<And>e c'a n. P c' = n \\<Longrightarrow> step_relation M c' e c'a \\<Longrightarrow> n - Suc 0 \\<le> P c'a)\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"eaa\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"ca\"\n      and P=\"\\<lambda>ca. (\\<And>n. P c' = n \\<Longrightarrow> step_relation M c' eaa ca \\<Longrightarrow> n - Suc 0 \\<le> P ca)\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"P c'\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule_tac meta_impE)\n   apply(rename_tac k ea c' eaa ca)(*strict*)\n   apply(rule position_change_due_to_step_relation)\n     apply(rename_tac k ea c' eaa ca)(*strict*)\n     apply(force)\n    apply(rename_tac k ea c' eaa ca)(*strict*)\n    apply(force)\n   apply(rename_tac k ea c' eaa ca)(*strict*)\n   apply(force)\n  apply(rename_tac k ea c' eaa ca)(*strict*)\n  apply(arith)\n  done\n\nlemma minimum_runtime_using_measure: \"\n  derivation M d\n  \\<Longrightarrow> belongs M d\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> P c = (n::nat)\n  \\<Longrightarrow> (\\<And>c e c' n. P c = n \\<Longrightarrow> step_relation M c e c' \\<Longrightarrow> \\<exists>m. P c' = m \\<and> m\\<ge>n - 1)\n  \\<Longrightarrow> (\\<And>c. c\\<in> configurations M \\<Longrightarrow> P c >0 \\<Longrightarrow> \\<exists>e c'. step_relation M c e c')\n  \\<Longrightarrow> maximum_of_domain d z\n  \\<Longrightarrow> maximal M d\n  \\<Longrightarrow> z\\<ge>i+n\"\n  apply(subgoal_tac \"d (i+n)\\<noteq>None\")\n   apply(subgoal_tac \"\\<forall>m>z. d m = None\")\n    prefer 2\n    apply(rule noSomeAfterMaxDom)\n     apply(force)\n    apply(force)\n   apply(case_tac \"i+n>z\")\n    apply(erule_tac\n      x=\"i+n\"\n      in allE)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<forall>k\\<le>P c. \\<exists>e c'. d (i+k) = Some (pair e c') \\<and> (P c-k\\<le>P c')\")\n   prefer 2\n   apply(rule allI)\n   apply(rename_tac k)(*strict*)\n   apply(rule impI)\n   apply(rule certain_measure_decreasement2)\n          apply(rename_tac k)(*strict*)\n          apply(force)\n         apply(rename_tac k)(*strict*)\n         apply(force)\n        apply(rename_tac k)(*strict*)\n        apply(force)\n       apply(rename_tac k)(*strict*)\n       apply(force)\n      apply(rename_tac k ca ea c' n)(*strict*)\n      apply(force)\n     apply(rename_tac k)(*strict*)\n     apply(force)\n    apply(rename_tac k ca)(*strict*)\n    apply(force)\n   apply(rename_tac k)(*strict*)\n   apply(force)\n  apply(erule_tac\n      x=\"P c\"\n      in allE)\n  apply(clarsimp)\n  done\n\nlemma derivation_map_preserves_derivation2: \"\n  derivation M f\n  \\<Longrightarrow> \\<forall>a e b. step_relation M a e b \\<longrightarrow> step_relation M (C a) e (C b)\n  \\<Longrightarrow> derivation M (derivation_map f C)\"\n  apply(unfold derivation_map_def)\n  apply(simp add: derivation_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(auto)\n   apply(case_tac \"f 0\")\n    apply(auto)\n   apply(rename_tac a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(auto)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"f (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a)(*strict*)\n  apply(case_tac \"f nat\")\n   apply(rename_tac nat a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac nat a option b)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a aa)(*strict*)\n  apply(case_tac \"f nat\")\n   apply(rename_tac nat a aa)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a aa)(*strict*)\n  apply(case_tac \"a\")\n  apply(rename_tac nat a aa option b)(*strict*)\n  apply(auto)\n  apply(rename_tac nat aa option b)(*strict*)\n  apply(case_tac \"aa\")\n  apply(rename_tac nat aa option b optiona ba)(*strict*)\n  apply(auto)\n  apply(rename_tac nat option b optiona ba)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac nat option b optiona ba)(*strict*)\n   apply(auto)\n  done\n\nlemma derivation_map_preserves_derivation: \"\n  derivation G d\n  \\<Longrightarrow> (\\<And>i e c. d i=Some (pair e c) \\<Longrightarrow> P c)\n  \\<Longrightarrow> (\\<And>c1 e c2.\n    P c1\n    \\<Longrightarrow> P c2\n    \\<Longrightarrow> step_relation G c1 e c2\n    \\<Longrightarrow> step_relation G (f c1) e (f c2))\n  \\<Longrightarrow> derivation G (derivation_map d f)\"\n  apply(unfold derivation_map_def)\n  apply(simp add: derivation_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(auto)\n   apply(case_tac \"d 0\")\n    apply(auto)\n   apply(rename_tac a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(auto)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a)(*strict*)\n  apply(case_tac \"d nat\")\n   apply(rename_tac nat a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac nat a option b)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a aa)(*strict*)\n  apply(case_tac \"d nat\")\n   apply(rename_tac nat a aa)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a aa)(*strict*)\n  apply(case_tac \"a\")\n  apply(rename_tac nat a aa option b)(*strict*)\n  apply(auto)\n  apply(rename_tac nat aa option b)(*strict*)\n  apply(case_tac \"aa\")\n  apply(rename_tac nat aa option b optiona ba)(*strict*)\n  apply(auto)\n  apply(rename_tac nat option b optiona ba)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac nat option b optiona ba)(*strict*)\n   apply(auto)\n  done\n\nlemma derivation_take_preserves_derivation: \"\n  derivation M d\n  \\<Longrightarrow> derivation M (derivation_take d n)\"\n  apply(simp add: derivation_take_def)\n  apply(simp add: derivation_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(case_tac i)\n    apply(rename_tac i)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma derivation_take_preserves_generates_maximum_of_domain: \"\n  derivation G d\n  \\<Longrightarrow> maximum_of_domain d (n+m)\n  \\<Longrightarrow> maximum_of_domain (derivation_take d n) n\"\n  apply(simp add: derivation_take_def)\n  apply(simp (no_asm) add: maximum_of_domain_def)\n  apply(subgoal_tac \"\\<exists>e c. d n = Some (pair e c)\")\n   apply(clarsimp)\n  apply(rule_tac\n      n=\"n+m\"\n      in some_position_has_details_before_max_dom)\n    apply(blast)+\n  apply(arith)\n  done\n\nlemma derivation_take_preserves_belongs: \"\n  belongs G d\n  \\<Longrightarrow> belongs G (derivation_take d i)\"\n  apply(simp add: belongs_def derivation_take_def)\n  done\n\nlemma derivation_drop_preserves_derivation: \"\n  derivation M d\n  \\<Longrightarrow> maximum_of_domain d (n+m)\n  \\<Longrightarrow> derivation M (derivation_drop d n)\"\n  apply(simp (no_asm) add: derivation_def derivation_drop_def)\n  apply(auto)\n   apply(case_tac \"d n\")\n    apply(auto)\n    apply(simp add: maximum_of_domain_def)\n    apply(auto)\n    apply(rename_tac y)(*strict*)\n    apply(case_tac m)\n     apply(rename_tac y)(*strict*)\n     apply(auto)\n    apply(rename_tac y nat)(*strict*)\n    apply(rule_tac\n      n=\"Suc (n+nat)\"\n      and i=\"n\"\n      in derivationNoFromNone2)\n       apply(rename_tac y nat)(*strict*)\n       apply(blast)\n      apply(rename_tac y nat)(*strict*)\n      apply(simp add: maximum_of_domain_def)\n     apply(rename_tac y nat)(*strict*)\n     apply(arith)\n    apply(rename_tac y nat)(*strict*)\n    apply(blast)\n   apply(rename_tac a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(auto)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(auto)\n   apply(case_tac \"d (Suc n)\")\n    apply(auto)\n   apply(rename_tac a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(auto)\n   apply(rename_tac option b)(*strict*)\n   defer\n   apply(rename_tac nat)(*strict*)\n   apply(case_tac \"d (Suc (nat+n))\")\n    apply(rename_tac nat)(*strict*)\n    apply(auto)\n   apply(rename_tac nat a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac nat a option b)(*strict*)\n   apply(auto)\n   apply(rename_tac nat option b)(*strict*)\n   apply(case_tac \"d (nat+n)\")\n    apply(rename_tac nat option b)(*strict*)\n    apply(auto)\n    apply(rule_tac\n      n=\"Suc (nat+n)\"\n      and i=\"nat+n\"\n      in derivationNoFromNone2)\n       apply(rename_tac nat option b)(*strict*)\n       apply(blast)+\n   apply(rename_tac nat option b a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac nat option b a optiona ba)(*strict*)\n   apply(auto)\n   apply(rename_tac nat option b optiona ba)(*strict*)\n   apply(case_tac option)\n    apply(rename_tac nat option b optiona ba)(*strict*)\n    apply(auto)\n    apply(rename_tac nat b optiona ba)(*strict*)\n    apply(rule derivation_Always_PreEdge_prime)\n     apply(rename_tac nat b optiona ba)(*strict*)\n     apply(blast)\n    apply(rename_tac nat b optiona ba)(*strict*)\n    apply(blast)\n   apply(rename_tac nat b optiona ba a)(*strict*)\n   apply(simp add: derivation_def)\n   apply(erule_tac\n      x=\"Suc(nat+n)\"\n      in allE)\n   apply(auto)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac \"d n\")\n   apply(rename_tac option b)(*strict*)\n   apply(rule_tac\n      n=\"Suc n\"\n      and i=\"n\"\n      in derivationNoFromNone2)\n      apply(rename_tac option b)(*strict*)\n      apply(blast)+\n  apply(rename_tac option b a)(*strict*)\n  apply(auto)\n  apply(case_tac a)\n  apply(rename_tac option b a optiona ba)(*strict*)\n  apply(auto)\n  apply(rename_tac option b optiona ba)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac option b optiona ba)(*strict*)\n   apply(auto)\n   apply(rename_tac b optiona ba)(*strict*)\n   apply(rule derivation_Always_PreEdge_prime)\n    apply(rename_tac b optiona ba)(*strict*)\n    apply(blast)\n   apply(rename_tac b optiona ba)(*strict*)\n   apply(blast)\n  apply(rename_tac b optiona ba a)(*strict*)\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc n\"\n      in allE)\n  apply(auto)\n  done\n\nlemma derivation_drop_preserves_derivation_prime: \"\n  derivation M d\n  \\<Longrightarrow> d (n+m) \\<noteq> None\n  \\<Longrightarrow> derivation M (derivation_drop d n)\"\n  apply(simp (no_asm) add: derivation_def derivation_drop_def)\n  apply(auto)\n   apply(rename_tac y)(*strict*)\n   apply(case_tac \"d n\")\n    apply(rename_tac y)(*strict*)\n    apply(auto)\n    apply(case_tac m)\n     apply(rename_tac y)(*strict*)\n     apply(auto)\n    apply(rename_tac y nat)(*strict*)\n    apply(rule_tac\n      n=\"Suc (n+nat)\"\n      and i=\"n\"\n      in derivationNoFromNone2)\n       apply(rename_tac y nat)(*strict*)\n       apply(blast)\n      apply(rename_tac y nat)(*strict*)\n      apply(simp add: maximum_of_domain_def)\n     apply(rename_tac y nat)(*strict*)\n     apply(arith)\n    apply(rename_tac y nat)(*strict*)\n    apply(blast)\n   apply(rename_tac y a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac y a option b)(*strict*)\n   apply(auto)\n  apply(rename_tac y i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac y i)(*strict*)\n   apply(auto)\n   apply(rename_tac y)(*strict*)\n   apply(case_tac \"d (Suc n)\")\n    apply(rename_tac y)(*strict*)\n    apply(auto)\n   apply(rename_tac y a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac y a option b)(*strict*)\n   apply(auto)\n   apply(rename_tac y option b)(*strict*)\n   defer\n   apply(rename_tac y nat)(*strict*)\n   apply(case_tac \"d (Suc (nat+n))\")\n    apply(rename_tac y nat)(*strict*)\n    apply(auto)\n   apply(rename_tac y nat a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac y nat a option b)(*strict*)\n   apply(auto)\n   apply(rename_tac y nat option b)(*strict*)\n   apply(case_tac \"d (nat+n)\")\n    apply(rename_tac y nat option b)(*strict*)\n    apply(auto)\n    apply(rule_tac\n      n=\"Suc (nat+n)\"\n      and i=\"nat+n\"\n      in derivationNoFromNone2)\n       apply(rename_tac y nat option b)(*strict*)\n       apply(blast)+\n   apply(rename_tac y nat option b a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac y nat option b a optiona ba)(*strict*)\n   apply(auto)\n   apply(rename_tac y nat option b optiona ba)(*strict*)\n   apply(case_tac option)\n    apply(rename_tac y nat option b optiona ba)(*strict*)\n    apply(auto)\n    apply(rename_tac y nat b optiona ba)(*strict*)\n    apply(rule derivation_Always_PreEdge_prime)\n     apply(rename_tac y nat b optiona ba)(*strict*)\n     apply(blast)\n    apply(rename_tac y nat b optiona ba)(*strict*)\n    apply(blast)\n   apply(rename_tac y nat b optiona ba a)(*strict*)\n   apply(simp add: derivation_def)\n   apply(erule_tac\n      x=\"Suc(nat+n)\"\n      in allE)\n   apply(auto)\n  apply(rename_tac y option b)(*strict*)\n  apply(case_tac \"d n\")\n   apply(rename_tac y option b)(*strict*)\n   apply(rule_tac\n      n=\"Suc n\"\n      and i=\"n\"\n      in derivationNoFromNone2)\n      apply(rename_tac y option b)(*strict*)\n      apply(blast)+\n  apply(rename_tac y option b a)(*strict*)\n  apply(auto)\n  apply(case_tac a)\n  apply(rename_tac y option b a optiona ba)(*strict*)\n  apply(auto)\n  apply(rename_tac y option b optiona ba)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac y option b optiona ba)(*strict*)\n   apply(auto)\n   apply(rename_tac y b optiona ba)(*strict*)\n   apply(rule derivation_Always_PreEdge_prime)\n    apply(rename_tac y b optiona ba)(*strict*)\n    apply(blast)\n   apply(rename_tac y b optiona ba)(*strict*)\n   apply(blast)\n  apply(rename_tac y b optiona ba a)(*strict*)\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc n\"\n      in allE)\n  apply(auto)\n  done\n\nlemma derivation_concat2: \"\n  derivation M f\n  \\<Longrightarrow> maximum_of_domain f fn\n  \\<Longrightarrow> derivation M g\n  \\<Longrightarrow> (case (f fn) of Some (pair e1 c1) \\<Rightarrow> (case (g 0) of Some (pair None c2) \\<Rightarrow> (c1=c2)))\n  \\<Longrightarrow> derivation M (derivation_append f g fn)\"\n  apply(subgoal_tac \"\\<exists>cg0. g 0=Some (pair None cg0)\")\n   apply(subgoal_tac \"\\<exists>cf0. f 0=Some (pair None cf0)\")\n    apply(subgoal_tac \"\\<exists>e cfn. f fn=Some (pair e cfn)\")\n     apply(simp add: derivation_append_def)\n     apply(simp (no_asm) add: derivation_def)\n     apply(auto)\n      apply(rename_tac cg0 cf0 e i)(*strict*)\n      apply(case_tac i)\n       apply(rename_tac cg0 cf0 e i)(*strict*)\n       apply(auto)\n      apply(rename_tac cg0 cf0 e nat)(*strict*)\n      apply(subgoal_tac \"\\<exists>e1 cf1. f nat=Some (pair e1 cf1)\")\n       apply(rename_tac cg0 cf0 e nat)(*strict*)\n       apply(subgoal_tac \"\\<exists>e2 cf2. f (Suc nat)=Some (pair (Some e2) cf2)\")\n        apply(rename_tac cg0 cf0 e nat)(*strict*)\n        apply(auto)\n        apply(rename_tac cg0 cf0 e nat e1 e2 cf1 cf2)(*strict*)\n        apply(simp add: derivation_def)\n        apply(erule_tac\n      x=\"Suc nat\"\n      and P=\"\\<lambda>x. case x of 0 \\<Rightarrow> (case f 0 of None \\<Rightarrow> False | Some (pair None c) \\<Rightarrow> True | Some (pair (Some e) c) \\<Rightarrow> False) | Suc i' \\<Rightarrow> (case f x of None \\<Rightarrow> True | Some (pair i1 i2) \\<Rightarrow> (case f i' of None \\<Rightarrow> False | Some (pair i'1 i'2) \\<Rightarrow> (case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation M i'2 i1v i2)))\"\n      in allE)\n        apply(rename_tac cg0 cf0 e nat e1 e2 cf1 cf2)(*strict*)\n        apply(clarsimp)\n       apply(rename_tac cg0 cf0 e nat e1 cf1)(*strict*)\n       defer\n       apply(rename_tac cg0 cf0 e nat)(*strict*)\n       defer\n       apply(rename_tac cg0 cf0 e i)(*strict*)\n       apply(case_tac i)\n        apply(rename_tac cg0 cf0 e i)(*strict*)\n        apply(auto)\n        apply(rename_tac cg0 cf0 e nat)(*strict*)\n        apply(subgoal_tac \"nat=fn\")\n         apply(rename_tac cg0 cf0 e nat)(*strict*)\n         apply(clarsimp)\n         apply(rename_tac cg0 cf0 e)(*strict*)\n         apply(case_tac \"g (Suc 0)\")\n          apply(rename_tac cg0 cf0 e)(*strict*)\n          apply(clarsimp)\n         apply(rename_tac cg0 cf0 e a)(*strict*)\n         apply(subgoal_tac \"\\<exists>e c. g (Suc 0)=Some (pair (Some e) c)\")\n          apply(rename_tac cg0 cf0 e a)(*strict*)\n          apply(clarsimp)\n          apply(rename_tac cg0 cf0 e ea c)(*strict*)\n          apply(simp add: derivation_def)\n          apply(erule_tac\n      x=\"Suc 0\"\n      and P=\"\\<lambda>i. case i of 0 \\<Rightarrow> case_option False (case_derivation_configuration (\\<lambda>a c. case a of None \\<Rightarrow> True | Some e \\<Rightarrow> False)) (g 0) | Suc i' \\<Rightarrow> case_option True (case_derivation_configuration (\\<lambda>i1 i2. case_option False (case_derivation_configuration (\\<lambda>i'1 i'2. case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation M i'2 i1v i2)) (g i'))) (g i)\"\n      in allE)\n          apply(rename_tac cg0 cf0 e ea c)(*strict*)\n          apply(clarsimp)\n         apply(rename_tac cg0 cf0 e a)(*strict*)\n         defer\n         apply(rename_tac cg0 cf0 e nat)(*strict*)\n         defer\n         apply(case_tac \"g (Suc nat - fn)\")\n          apply(rename_tac cg0 cf0 e nat)(*strict*)\n          apply(clarsimp)\n         apply(rename_tac cg0 cf0 e nat a)(*strict*)\n         apply(subgoal_tac \"\\<exists>e c. g (Suc nat - fn)=Some (pair (Some e) c)\")\n          apply(rename_tac cg0 cf0 e nat a)(*strict*)\n          apply(subgoal_tac \"\\<exists>e c. g (nat - fn)=Some (pair e c)\")\n           apply(rename_tac cg0 cf0 e nat a)(*strict*)\n           apply(auto)\n          apply(rename_tac cg0 cf0 e nat ea eb c ca)(*strict*)\n          apply(simp add: derivation_def)\n          apply(erule_tac\n      x=\"Suc nat - fn\"\n      and P=\"\\<lambda>i. case i of 0 \\<Rightarrow> case_option False (case_derivation_configuration (\\<lambda>a c. case a of None \\<Rightarrow> True | Some e \\<Rightarrow> False)) (g 0) | Suc i' \\<Rightarrow> case_option True (case_derivation_configuration (\\<lambda>i1 i2. case_option False (case_derivation_configuration (\\<lambda>i'1 i'2. case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation M i'2 i1v i2)) (g i'))) (g i)\"\n      in allE)\n          apply(rename_tac cg0 cf0 e nat ea eb c ca)(*strict*)\n          apply(case_tac \"Suc nat - fn\")\n           apply(rename_tac cg0 cf0 e nat ea eb c ca)(*strict*)\n           apply(clarsimp)\n          apply(rename_tac cg0 cf0 e nat ea eb c ca nata)(*strict*)\n          apply(clarsimp)\n          apply(subgoal_tac \"nata=nat-fn\")\n           apply(rename_tac cg0 cf0 e nat ea eb c ca nata)(*strict*)\n           apply(auto)\n         apply(rename_tac cg0 cf0 e nat ea c)(*strict*)\n         apply(rule_tac\n      m=\"Suc nat - fn\"\n      in pre_some_position_is_some_position)\n           apply(rename_tac cg0 cf0 e nat ea c)(*strict*)\n           apply(blast)+\n         apply(rename_tac cg0 cf0 e nat ea c)(*strict*)\n         apply(arith)\n        apply(rename_tac cg0 cf0 e nat a)(*strict*)\n        apply(rule_tac\n      g=\"g\"\n      and n=\"nat - fn\"\n      in some_position_has_details_after_0)\n         apply(rename_tac cg0 cf0 e nat a)(*strict*)\n         apply(blast)+\n        apply(rename_tac cg0 cf0 e nat a)(*strict*)\n        apply(rule_tac\n      s=\"Suc nat - fn\"\n      in ssubst)\n         apply(rename_tac cg0 cf0 e nat a)(*strict*)\n         apply(arith)\n        apply(rename_tac cg0 cf0 e nat a)(*strict*)\n        apply(blast)\n       apply(rename_tac cg0 cf0)(*strict*)\n       apply(rule some_position_has_details_before_max_dom)\n         apply(rename_tac cg0 cf0)(*strict*)\n         apply(blast)+\n      apply(rename_tac cg0)(*strict*)\n      apply(rule some_position_has_details_at_0)\n      apply(blast)+\n     apply(rule some_position_has_details_at_0)\n     apply(blast)+\n    apply(rename_tac cg0 cf0 e nat e1 cf1)(*strict*)\n    apply(rule some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac cg0 cf0 e nat e1 cf1)(*strict*)\n      apply(blast)+\n   apply(rename_tac cg0 cf0 e nat)(*strict*)\n   apply(rule_tac\n      m=\"fn\"\n      in pre_some_position_is_some_position)\n     apply(rename_tac cg0 cf0 e nat)(*strict*)\n     apply(blast)+\n   apply(rename_tac cg0 cf0 e nat)(*strict*)\n   apply(arith)\n  apply(rename_tac cg0 cf0 e a)(*strict*)\n  apply(rule_tac\n      g=\"g\"\n      and n=\"0\"\n      in some_position_has_details_after_0)\n   apply(rename_tac cg0 cf0 e a)(*strict*)\n   apply(blast)+\n  done\n\ncorollary derivation_append_generates_derivation: \"\n  derivation G d1\n  \\<Longrightarrow> derivation G d2\n  \\<Longrightarrow> d1 n = Some (pair e1 c1)\n  \\<Longrightarrow> (\\<And>e2 c2. d2 (Suc 0) = Some (pair (Some e2) c2)\n    \\<Longrightarrow> step_relation G c1 e2 c2)\n  \\<Longrightarrow> derivation G (derivation_append d1 d2 n)\"\n  apply(subgoal_tac \"\\<exists>c. d1 0 = Some (pair None c)\")\n   prefer 2\n   apply(rule some_position_has_details_at_0)\n   apply(force)\n  apply(simp (no_asm) add: derivation_def)\n  apply(clarsimp)\n  apply(rename_tac c i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac c i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c)(*strict*)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac c i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c nat)(*strict*)\n  apply(simp add: derivation_append_def)\n  apply(rule conjI)\n   apply(rename_tac c nat)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 nat = Some (pair e1 c1) \\<and> d1 (Suc nat) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\")\n    apply(rename_tac c nat)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"n\"\n      in step_detail_before_some_position)\n      apply(rename_tac c nat)(*strict*)\n      apply(force)\n     apply(rename_tac c nat)(*strict*)\n     apply(force)\n    apply(rename_tac c nat)(*strict*)\n    apply(force)\n   apply(rename_tac c nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c nat e1a e2 c1a c2)(*strict*)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac c nat)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"d2 (Suc nat - n)\")\n   apply(rename_tac c nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c nat a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac c nat a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c nat option b)(*strict*)\n  apply(simp add: derivation_append_def)\n  apply(rule conjI)\n   apply(rename_tac c nat option b)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"nat=n\")\n    apply(rename_tac c nat option b)(*strict*)\n    prefer 2\n    apply(arith)\n   apply(rename_tac c nat option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c option b)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d2 (Suc 0) = Some (pair (Some e) c)\")\n    apply(rename_tac c option b)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc 0\"\n      in pre_some_position_is_some_position_prime)\n       apply(rename_tac c option b)(*strict*)\n       apply(force)\n      apply(rename_tac c option b)(*strict*)\n      apply(force)\n     apply(rename_tac c option b)(*strict*)\n     apply(force)\n    apply(rename_tac c option b)(*strict*)\n    apply(force)\n   apply(rename_tac c option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c nat option b)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e c. d2 (nat-n) = Some (pair (Some e) c)\")\n   apply(rename_tac c nat option b)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat-n\"\n      in pre_some_position_is_some_position_prime)\n      apply(rename_tac c nat option b)(*strict*)\n      apply(force)\n     apply(rename_tac c nat option b)(*strict*)\n     apply(force)\n    apply(rename_tac c nat option b)(*strict*)\n    apply(force)\n   apply(rename_tac c nat option b)(*strict*)\n   apply(force)\n  apply(rename_tac c nat option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c nat option b e ca)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d2 (Suc nat-n) = Some (pair (Some e) c)\")\n   apply(rename_tac c nat option b e ca)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat-n\"\n      in pre_some_position_is_some_position_prime)\n      apply(rename_tac c nat option b e ca)(*strict*)\n      apply(force)\n     apply(rename_tac c nat option b e ca)(*strict*)\n     apply(force)\n    apply(rename_tac c nat option b e ca)(*strict*)\n    apply(force)\n   apply(rename_tac c nat option b e ca)(*strict*)\n   apply(force)\n  apply(rename_tac c nat option b e ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c nat b e ca ea)(*strict*)\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc nat - n\"\n      and P=\"\\<lambda>i. case i of 0 \\<Rightarrow> (case d2 0 of None \\<Rightarrow> False | Some (pair None c) \\<Rightarrow> True | Some (pair (Some e) c) \\<Rightarrow> False) | Suc i' \\<Rightarrow> (case d2 i of None \\<Rightarrow> True | Some (pair i1 i2) \\<Rightarrow> (case d2 i' of None \\<Rightarrow> False | Some (pair i'1 i'2) \\<Rightarrow> (case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation G i'2 i1v i2)))\"\n      in allE)\n  apply(rename_tac c nat b e ca ea)(*strict*)\n  apply(case_tac \"Suc nat - n\")\n   apply(rename_tac c nat b e ca ea)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c nat b e ca ea nata)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"nata = nat-n\")\n   apply(rename_tac c nat b e ca ea nata)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac c nat b e ca ea nata)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma from_to_is_to: \"\n  derivation_from_to M f S E\n  \\<Longrightarrow> derivation_to M f E\"\n  apply(simp add: derivation_from_to_def derivation_to_def)\n  done\n\nlemma from_to_is_from: \"\n  derivation_from_to M f S E\n  \\<Longrightarrow> derivation_from M f S\"\n  apply(simp add: derivation_from_to_def derivation_from_def)\n  done\n\nlemma from_to_is_der: \"\n  derivation_from_to M f S E\n  \\<Longrightarrow> derivation M f\"\n  apply(simp add: derivation_from_to_def derivation_to_def)\n  done\n\nlemma to_has_maximum_of_domain: \"\n  derivation_to M f E\n  \\<Longrightarrow> \\<exists>n. maximum_of_domain f n\"\n  apply(simp add: derivation_to_def maximum_of_domain_def)\n  apply(auto)\n  done\n\nlemma reachesToAtMaxDom: \"\n  derivation_to G d {y. \\<exists>x. y = pair x c}\n  \\<Longrightarrow> maximum_of_domain d m\n  \\<Longrightarrow> \\<exists>e. d m = Some (pair e c)\"\n  apply(simp add: derivation_to_def)\n  apply(auto)\n  apply(rename_tac n x)(*strict*)\n  apply(subgoal_tac \"maximum_of_domain d n\")\n   apply(rename_tac n x)(*strict*)\n   apply(subgoal_tac \"n=m\")\n    apply(rename_tac n x)(*strict*)\n    apply(auto)\n   apply(rename_tac n x)(*strict*)\n   apply(rule maximum_of_domainUnique)\n     apply(rename_tac n x)(*strict*)\n     apply(auto)\n  apply(rename_tac n x)(*strict*)\n  apply(simp add: maximum_of_domain_def)\n  done\n\nlemma reachesToAtMaxDom2: \"\n  derivation_to G d T\n  \\<Longrightarrow> maximum_of_domain d m\n  \\<Longrightarrow> \\<exists>x\\<in> T. d m = Some x\"\n  apply(simp add: derivation_to_def)\n  apply(auto)\n  apply(rename_tac n y)(*strict*)\n  apply(subgoal_tac \"maximum_of_domain d n\")\n   apply(rename_tac n y)(*strict*)\n   apply(subgoal_tac \"n=m\")\n    apply(rename_tac n y)(*strict*)\n    apply(auto)\n   apply(rename_tac n y)(*strict*)\n   apply(rule maximum_of_domainUnique)\n     apply(rename_tac n y)(*strict*)\n     apply(auto)\n  apply(rename_tac n y)(*strict*)\n  apply(simp add: maximum_of_domain_def)\n  done\n\nlemma exEmptyDeri: \"\n  \\<exists>d. derivation_from_to G d {pair None c} {y. \\<exists>x. y = pair x c}\"\n  apply(rule_tac\n      x=\"\\<lambda>x. if x=0 then Some (pair None c) else None\"\n      in exI)\n  apply(simp add: derivation_from_to_def)\n  apply(auto)\n   apply(simp add: derivation_from_def)\n   apply(simp add: derivation_def)\n   apply(auto)\n   apply(rename_tac i)(*strict*)\n   apply(case_tac i)\n    apply(rename_tac i)(*strict*)\n    apply(auto)\n  apply(simp add: derivation_to_def)\n  apply(simp add: derivation_def)\n  apply(auto)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(auto)\n  done\n\nlemma derivation_from_starts_from: \"\n  derivation_from M d F\n  \\<Longrightarrow> \\<exists>x\\<in> F. d 0 = Some x\"\n  apply(simp add: derivation_from_def)\n  apply(auto)\n  apply(case_tac \"d 0\")\n   apply(auto)\n  done\n\nlemma derivation_from_starts_from2: \"\n  derivation_from M d {pair None c}\n  \\<Longrightarrow> d 0 = Some (pair None c)\"\n  apply(simp add: derivation_from_def)\n  apply(auto)\n  apply(case_tac \"d 0\")\n   apply(auto)\n  done\n\nlemma noStepsFromInterTo: \"\n  \\<forall>x e y. \\<not>(step_relation M x e y)\n  \\<Longrightarrow> derivation_from_to M d S E\n  \\<Longrightarrow> E\\<inter>S={}\n  \\<Longrightarrow> P\"\n  apply(subgoal_tac \"maximum_of_domain d 0\")\n   prefer 2\n   apply(rule noStepsOnlyZeroLength)\n    apply(force)\n   apply(rule from_to_is_der)\n   apply(blast)\n  apply(subgoal_tac \"\\<exists>c\\<in> E. d 0 = Some c\")\n   apply(subgoal_tac \"\\<exists>x\\<in> S. d 0 = Some x\")\n    apply(clarsimp)\n    apply(rename_tac c)(*strict*)\n    apply(force)\n   apply(rule derivation_from_starts_from)\n   apply(rule from_to_is_from)\n   apply(blast)\n  apply(rule reachesToAtMaxDom2)\n   apply(rule from_to_is_to)\n   apply(blast)\n  apply(blast)\n  done\n\nlemma derivation_drop_preserves_derivation_from_to: \"\n  derivation_from_to M d F T\n  \\<Longrightarrow> maximum_of_domain d (n+m)\n  \\<Longrightarrow> d n=Some (pair e X)\n  \\<Longrightarrow> derivation_from_to M (derivation_drop d n) {pair None X} (if m=0 then {pair None X} else T)\"\n  apply(subgoal_tac \"derivation M (derivation_drop d n)\")\n   prefer 2\n   apply(rule_tac\n      n=\"n\"\n      and m=\"m\"\n      in derivation_drop_preserves_derivation)\n    apply(rule from_to_is_der)\n    apply(blast)\n   apply(blast)\n  apply(simp add: derivation_from_to_def derivation_from_def derivation_to_def)\n  apply(auto)\n     apply(rename_tac na y)(*strict*)\n     apply(case_tac \"derivation_drop d n 0\")\n      apply(rename_tac na y)(*strict*)\n      apply(clarsimp)\n      apply(simp add: derivation_drop_def)\n     apply(rename_tac na y a)(*strict*)\n     apply(clarsimp)\n     apply(case_tac a)\n     apply(rename_tac na y a option b)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac na y option b)(*strict*)\n     apply(simp add: derivation_drop_def)\n    apply(rename_tac na y)(*strict*)\n    apply(case_tac \"d 0\")\n     apply(rename_tac na y)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac na y a)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(simp (no_asm) add: derivation_drop_def)\n    apply(clarsimp)\n    apply(simp add: maximum_of_domain_def)\n   apply(rename_tac na y)(*strict*)\n   apply(case_tac \"derivation_drop d n 0\")\n    apply(rename_tac na y)(*strict*)\n    apply(clarsimp)\n    apply(simp add: derivation_drop_def)\n   apply(rename_tac na y a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac na y a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac na y option b)(*strict*)\n   apply(simp add: derivation_drop_def)\n  apply(rename_tac na y)(*strict*)\n  apply(subgoal_tac \"maximum_of_domain d na\")\n   apply(rename_tac na y)(*strict*)\n   apply(subgoal_tac \"na=n+m\")\n    apply(rename_tac na y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac y)(*strict*)\n    apply(rule_tac\n      x=\"m\"\n      in exI)\n    apply(simp add: derivation_drop_def)\n    apply(simp add: maximum_of_domain_def)\n    apply(rule conjI)\n     apply(rename_tac y)(*strict*)\n     apply(rule_tac\n      s=\"Suc (n+m)\"\n      in ssubst)\n      apply(rename_tac y)(*strict*)\n      apply(auto)\n    apply(rename_tac y)(*strict*)\n    apply(rule_tac\n      x=\"y\"\n      in bexI)\n     apply(rename_tac y)(*strict*)\n     apply(rule_tac\n      s=\"n+m\"\n      in ssubst)\n      apply(rename_tac y)(*strict*)\n      apply(auto)\n   apply(rename_tac na y)(*strict*)\n   apply(rule_tac\n      ?d.0=\"d\"\n      in maximum_of_domainUnique)\n     apply(rename_tac na y)(*strict*)\n     apply(blast)\n    apply(rename_tac na y)(*strict*)\n    apply(blast)\n   apply(rename_tac na y)(*strict*)\n   apply(simp add: maximum_of_domain_def)+\n  done\n\nlemma derivation_drop_preserves_derivation_from_to2: \"\n  derivation_from_to M d F T\n  \\<Longrightarrow> maximum_of_domain d (n+m)\n  \\<Longrightarrow> d n=Some (pair e X)\n  \\<Longrightarrow> m=0 \\<longrightarrow> (pair None X)\\<in> T\n  \\<Longrightarrow> derivation_from_to M (derivation_drop d n) {pair None X} T\"\n  apply(subgoal_tac \"derivation M (derivation_drop d n)\")\n   prefer 2\n   apply(rule_tac\n      n=\"n\"\n      and m=\"m\"\n      in derivation_drop_preserves_derivation)\n    apply(simp add: derivation_from_to_def derivation_from_def derivation_to_def)\n   apply(blast)\n  apply(simp add: derivation_from_to_def derivation_from_def derivation_to_def)\n  apply(rule conjI)\n   apply(simp add: derivation_drop_def)\n  apply(clarsimp)\n  apply(rename_tac na y)(*strict*)\n  apply(subgoal_tac \"maximum_of_domain d na\")\n   apply(rename_tac na y)(*strict*)\n   apply(subgoal_tac \"na=n+m\")\n    apply(rename_tac na y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac y)(*strict*)\n    apply(rule_tac\n      x=\"m\"\n      in exI)\n    apply(simp add: derivation_drop_def)\n    apply(simp add: maximum_of_domain_def)\n    apply(rule conjI)\n     apply(rename_tac y)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac y)(*strict*)\n    apply(clarsimp)\n    apply(rule conjI)\n     apply(rename_tac y)(*strict*)\n     apply(rule_tac\n      s=\"Suc (n+m)\"\n      in ssubst)\n      apply(rename_tac y)(*strict*)\n      apply(auto)\n      apply(rule_tac\n      x=\"y\"\n      in bexI)\n       apply(rename_tac y)(*strict*)\n       apply(rule_tac\n      s=\"n+m\"\n      in ssubst)\n        apply(rename_tac y)(*strict*)\n        apply(auto)\n     apply(rename_tac na y)(*strict*)\n     apply(rule_tac\n      ?d.0=\"d\"\n      in maximum_of_domainUnique)\n       apply(rename_tac na y)(*strict*)\n       apply(blast)\n      apply(rename_tac na y)(*strict*)\n      apply(blast)\n     apply(rename_tac na y)(*strict*)\n     apply(simp add: maximum_of_domain_def)+\n    apply(rename_tac na y)(*strict*)\n    apply(rule_tac\n      ?d.0=\"d\"\n      in maximum_of_domainUnique)\n      apply(rename_tac na y)(*strict*)\n      apply(blast)\n     apply(rename_tac na y)(*strict*)\n     apply(simp add: maximum_of_domain_def)+\n  done\n\nlemma noNonEmptyDeriFromEmpty: \"\n  \\<forall>e c2. \\<not> (step_relation M c1 e c2)\n  \\<Longrightarrow> maximum_of_domain d (Suc n)\n  \\<Longrightarrow> derivation_from M d {pair None c1}\n  \\<Longrightarrow> P\"\n  apply(subgoal_tac \"d 0\\<noteq>None\")\n   prefer 2\n   apply(rule initialNotNone)\n   apply(simp add: derivation_from_def)\n   apply(blast)\n  apply(subgoal_tac \"0=Suc n\")\n   apply(blast)\n  apply(rule_tac\n      d=\"d\"\n      in maximum_of_domainUnique)\n    apply(simp add: derivation_from_def)\n    apply(blast)\n   apply(blast)\n  apply(simp add: derivation_from_def derivation_def)\n  apply(auto)\n  apply(erule_tac\n      x=\"Suc 0\"\n      in allE)\n  apply(auto)\n  apply(case_tac \"d (Suc 0)\")\n   apply(clarsimp)\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(auto)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac option b)(*strict*)\n   apply(auto)\n  done\n\nlemma modifying_derivation_is_not_empty: \"\n  derivation_from_to G d {pair None c1} {y. \\<exists>xa. y = pair xa c2}\n  \\<Longrightarrow> c1\\<noteq>c2\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> n\\<noteq>0\"\n  apply(case_tac n)\n   apply(auto)\n  apply(subgoal_tac \"d 0=Some (pair None c1)\")\n   apply(subgoal_tac \"\\<exists>e. d 0=Some (pair e c2)\")\n    apply(clarsimp)\n   apply(rule reachesToAtMaxDom)\n    apply(rule from_to_is_to)\n    apply(blast)\n   apply(clarsimp)\n  apply(rule derivation_from_starts_from2)\n  apply(rule from_to_is_from)\n  apply(blast)\n  done\n\nlemma derivation_take_preserves_derivation_from_to: \"\n  derivation_from_to M d F T\n  \\<Longrightarrow> maximum_of_domain d (n+m)\n  \\<Longrightarrow> d n=Some (pair e X)\n  \\<Longrightarrow> derivation_from_to M (derivation_take d n) F {pair e X}\"\n  apply(simp (no_asm) add: derivation_from_to_def derivation_from_def derivation_to_def)\n  apply(rule conjI)\n   apply(rule derivation_take_preserves_derivation)\n   apply(rule from_to_is_der)\n   apply(blast)+\n  apply(rule conjI)\n   defer\n   apply(rule conjI)\n    apply(rule derivation_take_preserves_derivation)\n    apply(rule from_to_is_der)\n    apply(blast)+\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(simp add: derivation_take_def)+\n  apply(simp add: derivation_from_to_def derivation_from_def)\n  done\n\nlemma toAtMaxDom: \"\n  derivation_from_to G d2 {pair None F} {y. \\<exists>xa. y = pair xa C}\n  \\<Longrightarrow> maximum_of_domain d2 m2\n  \\<Longrightarrow> \\<exists>e2. d2 m2 = Some (pair e2 C)\"\n  apply(simp add: derivation_from_to_def)\n  apply(simp add: derivation_to_def)\n  apply(auto)\n  apply(rename_tac n xa)(*strict*)\n  apply(subgoal_tac \"maximum_of_domain d2 n\")\n   apply(rename_tac n xa)(*strict*)\n   apply(subgoal_tac \"m2 = n\")\n    apply(rename_tac n xa)(*strict*)\n    apply(auto)\n   apply(rename_tac n xa)(*strict*)\n   apply(rule maximum_of_domainUnique)\n     apply(rename_tac n xa)(*strict*)\n     apply(auto)\n  apply(rename_tac n xa)(*strict*)\n  apply(simp add: maximum_of_domain_def)\n  done\n\nlemma fromAtZero: \"\n  derivation_from_to G d2 {pair None F} {y. \\<exists>xa. y = pair xa C}\n  \\<Longrightarrow> maximum_of_domain d2 m2\n  \\<Longrightarrow> d2 0 = Some (pair None F)\"\n  apply(simp add: derivation_from_to_def)\n  apply(simp add: derivation_from_def)\n  apply(auto)\n  apply(case_tac \"d2 0\")\n   apply(auto)\n  done\n\nlemma concatIsFromTo: \"\n  derivation_from_to G d1 {pair None d1F} {y. \\<exists>xa. y = pair xa dJ}\n  \\<Longrightarrow> derivation_from_to G d2 {pair None dJ} {y. \\<exists>xa. y = pair xa d2T}\n  \\<Longrightarrow> maximum_of_domain d1 m1\n  \\<Longrightarrow> maximum_of_domain d2 m2\n  \\<Longrightarrow> derivation_from_to G (derivation_append d1 d2 m1) {pair None d1F} {y. \\<exists>xa. y = pair xa d2T}\"\n  apply(subgoal_tac \"d1 0 = Some(pair None d1F)\")\n   apply(subgoal_tac \"d2 0 = Some(pair None dJ)\")\n    apply(subgoal_tac \"\\<exists>e1. d1 m1 = Some(pair e1 dJ)\")\n     apply(subgoal_tac \"\\<exists>e2. d2 m2 = Some(pair e2 d2T)\")\n      apply(erule_tac exE)+\n      apply(rename_tac e1 e2)(*strict*)\n      defer\n      apply(rule toAtMaxDom)\n       apply(blast)+\n     apply(rule toAtMaxDom)\n      apply(blast)+\n    apply(rule fromAtZero)\n     apply(blast)+\n   apply(rule fromAtZero)\n    apply(blast)+\n  apply(rename_tac e1 e2)(*strict*)\n  apply(simp add: derivation_from_to_def derivation_to_def derivation_from_def)\n  apply(auto)\n     apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n     apply(rule derivation_concat2)\n        apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n        apply(blast)\n       apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n       apply(blast)\n      apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n      apply(blast)\n     apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n     apply(auto)\n    apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n    apply(simp add: derivation_append_def)\n   apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n   apply(rule derivation_concat2)\n      apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n      apply(blast)\n     apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n     apply(blast)\n    apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n    apply(blast)\n   apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n   apply(auto)\n  apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n  apply(rule_tac\n      x = \"m1+m2\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n   apply(simp add: derivation_append_def)\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n  apply(case_tac \"m2\")\n   apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n   apply(rule_tac\n      x = \"pair e1 d2T\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n    apply(rule_tac\n      x = \"e1\"\n      in exI)\n    apply(blast)\n   apply(rename_tac e1 e2 n na xa xaa)(*strict*)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac e1 e2 n na xa xaa nat)(*strict*)\n  apply(rule_tac\n      x = \"pair e2 d2T\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac e1 e2 n na xa xaa nat)(*strict*)\n   apply(rule_tac\n      x = \"e2\"\n      in exI)\n   apply(blast)\n  apply(rename_tac e1 e2 n na xa xaa nat)(*strict*)\n  apply(simp add: derivation_append_def)\n  done\n\nlemma consDerivation_From_To: \"\n  derivation G d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> d 0 = Some (pair None c1)\n  \\<Longrightarrow> d n = Some (pair e c2)\n  \\<Longrightarrow> derivation_from_to G d {pair None c1} {y. \\<exists>xa. y = pair xa c2}\"\n  apply(simp add: derivation_from_to_def derivation_from_def derivation_to_def)\n  apply(rule_tac\n      x=\"n\"\n      in exI)\n  apply(auto)\n  apply(simp add: maximum_of_domain_def)\n  done\n\nlemma derivation_from_to_from_derivation: \"\n  derivation M d\n  \\<Longrightarrow> d 0 = Some (pair None c1)\n  \\<Longrightarrow> d n = Some (pair e c2)\n  \\<Longrightarrow> d (Suc n) = None\n  \\<Longrightarrow> derivation_from_to M d {pair None c1} {y. \\<exists>xa. y = pair xa c2}\"\n  apply(simp add: derivation_from_to_def derivation_from_def derivation_to_def)\n  apply(rule_tac\n      x=\"n\"\n      in exI)\n  apply(auto)\n  done\n\nlemma get_labelElim1: \"\n  derivation M d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> get_label (d n) = e\"\n  apply(simp add: get_label_def)\n  done\n\nlemma get_labelElim2: \"\n  derivation M d\n  \\<Longrightarrow> get_label (d n) = (Some e)\n  \\<Longrightarrow> \\<exists>c. d n = Some (pair (Some e) c)\"\n  apply(simp add: get_label_def)\n  apply(case_tac \"d n\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(auto)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma derivation_take_preserves_derivation_initial: \"\n  derivation_initial M d\n  \\<Longrightarrow> derivation_initial M (derivation_take d n)\"\n  apply(simp add: derivation_initial_def)\n  apply(rule conjI)\n   apply(rule derivation_take_preserves_derivation)\n   apply(force)\n  apply(simp add: derivation_take_def)\n  done\n\nlemma derivation_take_id_prime_prime: \"\n  maximum_of_domain d m\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> n\\<ge>m\n  \\<Longrightarrow> derivation_take d n = d\"\n  apply(rule ext)\n  apply(rename_tac x)(*strict*)\n  apply(subgoal_tac \"\\<forall>m'>m. d m' = None\")\n   apply(rename_tac x)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac x)(*strict*)\n  apply(rule noSomeAfterMaxDom)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(force)\n  done\n\nlemma derivation_take_id_prime: \"\n  d n=None\n  \\<Longrightarrow> derivation M d\n  \\<Longrightarrow> derivation_take d n = d\"\n  apply(simp add: derivation_take_def)\n  apply(rule ext)\n  apply(rename_tac na)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"d na\")\n   apply(rename_tac na)(*strict*)\n   apply(force)\n  apply(rename_tac na a)(*strict*)\n  apply(subgoal_tac \"False\")\n   apply(rename_tac na a)(*strict*)\n   apply(force)\n  apply(rename_tac na a)(*strict*)\n  apply(rule_tac\n      i=\"n\"\n      in derivationNoFromNone2)\n     apply(rename_tac na a)(*strict*)\n     apply(force)\n    apply(rename_tac na a)(*strict*)\n    apply(force)\n   apply(rename_tac na a)(*strict*)\n   apply(force)\n  apply(rename_tac na a)(*strict*)\n  apply(force)\n  done\n\nlemma derivation_drop_makes_maximum_of_domain: \"\n  derivation M d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> n\\<ge>m\n  \\<Longrightarrow> maximum_of_domain (derivation_drop d m) (n-m)\"\n  apply(simp add: maximum_of_domain_def derivation_drop_def)\n  apply(clarsimp)\n  apply(rename_tac y)(*strict*)\n  apply(case_tac y)\n  apply(rename_tac y option b)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma derivation_append_preserves_belongs: \"\n  TSstructure G\n  \\<Longrightarrow> belongs G d1\n  \\<Longrightarrow> derivation G (derivation_append d1 d2 n)\n  \\<Longrightarrow> belongs G (derivation_append d1 d2 n)\"\n  apply(subgoal_tac \"\\<exists>c. (derivation_append d1 d2 n) 0 = Some (pair None c)\")\n   prefer 2\n   apply(rule some_position_has_details_at_0)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(rule derivation_belongs)\n     apply(rename_tac c)(*strict*)\n     apply(force)\n    apply(rename_tac c)(*strict*)\n    apply(force)\n   apply(rename_tac c)(*strict*)\n   apply(simp add: belongs_def)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac c)(*strict*)\n  apply(force)\n  done\n\nlemma derivation_append_preserves_derivation_initial: \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G d1\n  \\<Longrightarrow> derivation G (derivation_append d1 d2 n)\n  \\<Longrightarrow> derivation_initial G (derivation_append d1 d2 n)\"\n  apply(subgoal_tac \"\\<exists>c. (derivation_append d1 d2 n) 0 = Some (pair None c)\")\n   prefer 2\n   apply(rule some_position_has_details_at_0)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: derivation_initial_def)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def)\n  done\n\nlemma derivation_append_preserves_derivation_initial_prime: \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G d1\n  \\<Longrightarrow> maximum_of_domain d1 n\n  \\<Longrightarrow> derivation G d2\n  \\<Longrightarrow> derivation_append_fit d1 d2 n\n  \\<Longrightarrow> derivation_initial G (derivation_append d1 d2 n)\"\n  apply(subgoal_tac \"derivation G (derivation_append d1 d2 n)\")\n   prefer 2\n   apply(rule derivation_concat2)\n      apply(simp add: derivation_initial_def)\n     apply(force)\n    apply(force)\n   apply(simp add: derivation_append_fit_def)\n   apply(case_tac \"d1 n\")\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option b)(*strict*)\n   apply(case_tac \"d2 0\")\n    apply(rename_tac option b)(*strict*)\n    apply(force)\n   apply(rename_tac option b a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac option b a optiona ba)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option b optiona ba)(*strict*)\n   apply(case_tac optiona)\n    apply(rename_tac option b optiona ba)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac option b optiona ba a)(*strict*)\n   apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>c. (derivation_append d1 d2 n) 0 = Some (pair None c)\")\n   prefer 2\n   apply(rule some_position_has_details_at_0)\n   apply(force)\n  apply(simp add: derivation_initial_def derivation_append_fit_def derivation_append_def)\n  done\n\nlemma derivation_map_preserves_belongs: \"\n  TSstructure G\n  \\<Longrightarrow> belongs G d\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> derivation G (derivation_map d C)\n  \\<Longrightarrow> (\\<And>c. c \\<in> configurations G \\<Longrightarrow> C c \\<in> configurations G)\n  \\<Longrightarrow> belongs G (derivation_map d C)\"\n  apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n   prefer 2\n   apply(rule some_position_has_details_at_0)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(rule derivation_belongs)\n     apply(rename_tac c)(*strict*)\n     apply(force)\n    apply(rename_tac c)(*strict*)\n    apply(simp add: derivation_map_def)\n   apply(rename_tac c)(*strict*)\n   apply(erule_tac\n      x=\"c\"\n      in meta_allE)\n   apply(simp add: belongs_def)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(force)\n  done\n\nlemma derivation_map_preserves_derivation_initial: \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G d\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> derivation G (derivation_map d C)\n  \\<Longrightarrow> (\\<And>c. c \\<in> initial_configurations G \\<Longrightarrow> C c \\<in> initial_configurations G)\n  \\<Longrightarrow> derivation_initial G (derivation_map d C)\"\n  apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n   prefer 2\n   apply(rule some_position_has_details_at_0)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: derivation_initial_def)\n  apply(simp add: derivation_map_def)\n  done\n\nlemma dead_end_diff: \"\n  derivation M d\n  \\<Longrightarrow> d i = Some (pair ei ci)\n  \\<Longrightarrow> d j = Some (pair ej cj)\n  \\<Longrightarrow> \\<forall>e c. \\<not>(step_relation M ci e c)\n  \\<Longrightarrow> i<j\n  \\<Longrightarrow> P\"\n  apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n   prefer 2\n   apply(rule_tac\n      m=\"j\"\n      in pre_some_position_is_some_position_prime)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> d (Suc i) = Some (pair (Some e2) c2) \\<and> step_relation M c1 e2 c2\")\n   prefer 2\n   apply(rule_tac\n      m=\"Suc i\"\n      in step_detail_before_some_position)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  done\n\nlemma derivation_append_preserves_derivation: \"\n  derivation M f\n  \\<Longrightarrow> derivation M g\n  \\<Longrightarrow> (case (f fn) of None \\<Rightarrow> False | Some (pair e1 c1) \\<Rightarrow> (case (g 0) of Some (pair None c2) \\<Rightarrow> (c1=c2)))\n  \\<Longrightarrow> derivation M (derivation_append f g fn)\"\n  apply(simp (no_asm) add: derivation_def derivation_append_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_def)\n   apply(erule_tac\n      x=\"0\"\n      and P=\"\\<lambda>x. case x of 0 \\<Rightarrow> (case f 0 of None \\<Rightarrow> False | Some (pair None c) \\<Rightarrow> True | Some (pair (Some e) c) \\<Rightarrow> False) | Suc i' \\<Rightarrow> (case f x of None \\<Rightarrow> True | Some (pair i1 i2) \\<Rightarrow> (case f i' of None \\<Rightarrow> False | Some (pair i'1 i'2) \\<Rightarrow> (case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation M i'2 i1v i2)))\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"f (Suc nat)\")\n    apply(rename_tac nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac nat a)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. f nat = Some (pair e1 c1) \\<and> f (Suc nat) = Some (pair (Some e2) c2) \\<and> step_relation M c1 e2 c2\")\n    apply(rename_tac nat a)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc nat\"\n      in step_detail_before_some_position)\n      apply(rename_tac nat a)(*strict*)\n      apply(force)\n     apply(rename_tac nat a)(*strict*)\n     apply(force)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"nat=fn\")\n    apply(rename_tac nat)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"g (Suc 0)\")\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. g 0 = Some (pair e1 c1) \\<and> g (Suc 0) = Some (pair (Some e2) c2) \\<and> step_relation M c1 e2 c2\")\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc 0\"\n      in step_detail_before_some_position)\n      apply(rename_tac a)(*strict*)\n      apply(force)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2)(*strict*)\n   apply(case_tac \"f fn\")\n    apply(rename_tac e1 e2 c1 c2)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac e1 e2 c1 c2 a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 option b)(*strict*)\n   apply(subgoal_tac \"\\<exists>c. g 0 = Some (pair None c)\")\n    apply(rename_tac e1 e2 c1 c2 option b)(*strict*)\n    prefer 2\n    apply(rule some_position_has_details_at_0)\n    apply(force)\n   apply(rename_tac e1 e2 c1 c2 option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"g (Suc nat - fn)\")\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. g (nat - fn) = Some (pair e1 c1) \\<and> g (Suc (nat - fn)) = Some (pair (Some e2) c2) \\<and> step_relation M c1 e2 c2\")\n   apply(rename_tac nat a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat - fn\"\n      in step_detail_before_some_position)\n     apply(rename_tac nat a)(*strict*)\n     apply(force)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(force)\n  apply(rename_tac nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat a e1 e2 c1 c2)(*strict*)\n  apply(subgoal_tac \"Suc nat -fn = Suc(nat- fn)\")\n   apply(rename_tac nat a e1 e2 c1 c2)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac nat a e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma derivation_take_derivation_append_distrib: \"\n  maximum_of_domain dRa nR\n  \\<Longrightarrow> derivation G dRa\n  \\<Longrightarrow> dR nL = Some (pair eR cR)\n  \\<Longrightarrow> derivation_take (derivation_append dR dRa nL) (nL + nR) =\n          derivation_append (derivation_take dR nL) dRa nL\"\n  apply(simp add: derivation_take_def derivation_append_def)\n  apply(rule ext)\n  apply(rename_tac n)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<forall>m>nR. dRa m = None\")\n   apply(rename_tac n)(*strict*)\n   prefer 2\n   apply(rule noSomeAfterMaxDom)\n    apply(rename_tac n)(*strict*)\n    apply(force)\n   apply(rename_tac n)(*strict*)\n   apply(force)\n  apply(rename_tac n)(*strict*)\n  apply(force)\n  done\n\nlemma der3_is_derivation: \"\n  TSstructure G\n  \\<Longrightarrow> step_relation G c1 e1 c2\n  \\<Longrightarrow> step_relation G c2 e2 c3\n  \\<Longrightarrow> derivation G (der3 c1 e1 c2 e2 c3)\"\n  apply(simp add: derivation_def der3_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(case_tac nat)\n   apply(rename_tac i nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat nata)(*strict*)\n  apply(case_tac nata)\n   apply(rename_tac i nat nata)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat nata natb)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma derivation_append_id_on_der1: \"\n  derivation G d\n  \\<Longrightarrow> d (Suc n) = None\n  \\<Longrightarrow> derivation_append d (der1 c) n = d\"\n  apply(rule ext)\n  apply(rename_tac x)(*strict*)\n  apply(simp add: der1_def)\n  apply(simp add: derivation_append_def)\n  apply(clarsimp)\n  apply(case_tac \"d x\")\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x a)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc n) = Some (pair e c)\")\n   apply(rename_tac x a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"x\"\n      in pre_some_position_is_some_position)\n     apply(rename_tac x a)(*strict*)\n     apply(force)\n    apply(rename_tac x a)(*strict*)\n    apply(force)\n   apply(rename_tac x a)(*strict*)\n   apply(force)\n  apply(rename_tac x a)(*strict*)\n  apply(force)\n  done\n\nlemma der2_is_derivation: \"\n  step_relation G c1 e c2\n  \\<Longrightarrow> derivation G (der2 c1 e c2)\"\n  apply(simp add: derivation_def der2_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma der1_is_derivation: \"\n  derivation G (der1 c)\"\n  apply(simp add: derivation_def der1_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma der1_belongs: \"\n  c \\<in> configurations G\n  \\<Longrightarrow> belongs G (der1 c)\"\n  apply(simp add: belongs_def der1_def)\n  done\n\nlemma der2_belongs: \"\n  c1 \\<in> configurations G\n  \\<Longrightarrow> e \\<in> step_labels G\n  \\<Longrightarrow> c2 \\<in> configurations G\n  \\<Longrightarrow> belongs G (der2 c1 e c2)\"\n  apply(simp add: belongs_def der2_def)\n  done\n\nlemma derivation_append_extend_crop_with_last_step: \"\n  derivation M dL\n  \\<Longrightarrow> dL (Suc nL) = Some (pair (Some e2) cL)\n  \\<Longrightarrow> maximum_of_domain dL (Suc nL)\n  \\<Longrightarrow> step_relation GL c1 e2 cL\n  \\<Longrightarrow> dR =\n          derivation_append (derivation_take dL nL)\n           (der2 c1 e2 cL)\n           nL\n  \\<Longrightarrow> dL = dR\"\n  apply(simp add: derivation_append_def)\n  apply(rule ext)\n  apply(rename_tac x)(*strict*)\n  apply(case_tac \"x \\<le> nL\")\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac x)(*strict*)\n  apply(case_tac \"x - nL = 0\")\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(case_tac \"x - nL\")\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x nat)(*strict*)\n  apply(case_tac nat)\n   apply(rename_tac x nat)(*strict*)\n   apply(simp add: derivation_take_def)\n   apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(rule_tac\n      t=\"x\"\n      and s=\"Suc nL\"\n      in ssubst)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(simp add: der2_def)\n  apply(rename_tac x nat nata)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x nata)(*strict*)\n  apply(case_tac \"dL x\")\n   apply(rename_tac x nata)(*strict*)\n   apply(simp add: der2_def)\n  apply(rename_tac x nata a)(*strict*)\n  apply(rule_tac\n      m=\"x\"\n      and d=\"dL\"\n      in no_some_beyond_maximum_of_domain)\n     apply(rename_tac x nata a)(*strict*)\n     apply(force)\n    apply(rename_tac x nata a)(*strict*)\n    apply(force)\n   apply(rename_tac x nata a)(*strict*)\n   apply(force)\n  apply(rename_tac x nata a)(*strict*)\n  apply(force)\n  done\n\nlemma is_forward_deterministic_derivations_coincide: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d1\n  \\<Longrightarrow> derivation G d2\n  \\<Longrightarrow> is_forward_deterministic G\n  \\<Longrightarrow> d1 x = d2 y\n  \\<Longrightarrow> d1 (x+n) \\<noteq> None\n  \\<Longrightarrow> d2 (y+m) \\<noteq> None\n  \\<Longrightarrow> n\\<le>m\n  \\<Longrightarrow> d1 (x+n) = l\n  \\<Longrightarrow> d2 (y+n) = r\n  \\<Longrightarrow> l=r\"\n  apply(rule_tac\n      t=\"l\"\n      and s=\"d1 (x+n)\"\n      in ssubst)\n   apply(force)\n  apply(rule_tac\n      t=\"r\"\n      and s=\"d2 (y+n)\"\n      in ssubst)\n   apply(force)\n  apply(thin_tac \"d1 (x+n) = l\")\n  apply(thin_tac \"d2 (y+n) = r\")\n  apply(induct n)\n   apply(clarsimp)\n  apply(rename_tac n)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n ya yaa)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 (x+n) = Some (pair e1 c1) \\<and> d1 (Suc (x+n)) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\")\n   apply(rename_tac n ya yaa)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc (x+n)\"\n      in step_detail_before_some_position)\n     apply(rename_tac n ya yaa)(*strict*)\n     apply(force)\n    apply(rename_tac n ya yaa)(*strict*)\n    apply(force)\n   apply(rename_tac n ya yaa)(*strict*)\n   apply(force)\n  apply(rename_tac n ya yaa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 (y+n) = Some (pair e1 c1) \\<and> d2 (Suc (y+n)) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\")\n   apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"(y+m)\"\n      in step_detail_before_some_position)\n     apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n     apply(force)\n    apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n    apply(force)\n   apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n ya e2 c2 e1a e2a c1a c2a)(*strict*)\n  apply(simp add: use_is_forward_deterministic_E)\n  apply(simp add: use_is_forward_deterministic_T)\n  done\n\nlemma is_forward_deterministic_accessible_derivations_coincide: \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G d1\n  \\<Longrightarrow> derivation_initial G d2\n  \\<Longrightarrow> is_forward_deterministic_accessible G\n  \\<Longrightarrow> d1 x = d2 y\n  \\<Longrightarrow> d1 (x+n) \\<noteq> None\n  \\<Longrightarrow> d2 (y+m) \\<noteq> None\n  \\<Longrightarrow> n\\<le>m\n  \\<Longrightarrow> d1 (x+n) = l\n  \\<Longrightarrow> d2 (y+n) = r\n  \\<Longrightarrow> l=r\"\n  apply(rule_tac\n      t=\"l\"\n      and s=\"d1 (x+n)\"\n      in ssubst)\n   apply(force)\n  apply(rule_tac\n      t=\"r\"\n      and s=\"d2 (y+n)\"\n      in ssubst)\n   apply(force)\n  apply(thin_tac \"d1 (x+n) = l\")\n  apply(thin_tac \"d2 (y+n) = r\")\n  apply(induct n)\n   apply(clarsimp)\n  apply(rename_tac n)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n ya yaa)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 (x+n) = Some (pair e1 c1) \\<and> d1 (Suc (x+n)) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\")\n   apply(rename_tac n ya yaa)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc (x+n)\"\n      in step_detail_before_some_position)\n     apply(rename_tac n ya yaa)(*strict*)\n     apply(rule derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac n ya yaa)(*strict*)\n    apply(force)\n   apply(rename_tac n ya yaa)(*strict*)\n   apply(force)\n  apply(rename_tac n ya yaa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 (y+n) = Some (pair e1 c1) \\<and> d2 (Suc (y+n)) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\")\n   apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"(y+m)\"\n      in step_detail_before_some_position)\n     apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n     apply(rule derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n    apply(force)\n   apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac n ya e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n ya e2 c2 e1a e2a c1a c2a)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac n ya e2 c2 e1a e2a c1a c2a)(*strict*)\n   apply(simp add: is_forward_deterministic_accessible_def)\n   apply(simp add: is_forward_edge_deterministic_accessible_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"c1a\"\n      in ballE)\n    apply(rename_tac n ya e2 c2 e1a e2a c1a c2a)(*strict*)\n    apply(erule_tac\n      x=\"c2\"\n      in allE)\n    apply(erule_tac\n      x=\"c2a\"\n      in allE)\n    apply(erule_tac\n      x=\"e2\"\n      in allE)\n    apply(erule_tac\n      x=\"e2a\"\n      in allE)\n    apply(clarsimp)\n   apply(rename_tac n ya e2 c2 e1a e2a c1a c2a)(*strict*)\n   apply(simp add: get_accessible_configurations_def)\n   apply(erule_tac\n      x=\"d1\"\n      in allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"(x+n)\"\n      in allE)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac n ya e2 c2 e1a e2a c1a c2a)(*strict*)\n  apply(simp add: is_forward_deterministic_accessible_def)\n  apply(simp add: is_forward_target_deterministic_accessible_def)\n  apply(clarsimp)\n  apply(rename_tac n ya c2 e1a e2a c1a c2a)(*strict*)\n  apply(erule_tac\n      x=\"c1a\"\n      in ballE)\n   apply(rename_tac n ya c2 e1a e2a c1a c2a)(*strict*)\n   apply(erule_tac\n      x=\"c2\"\n      in allE)\n   apply(erule_tac\n      x=\"c2a\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac n ya c2 e1a e2a c1a c2a)(*strict*)\n    apply(rule_tac\n      x=\"e2a\"\n      in exI)\n    apply(force)\n   apply(rename_tac n ya c2 e1a e2a c1a c2a)(*strict*)\n   apply(force)\n  apply(rename_tac n ya c2 e1a e2a c1a c2a)(*strict*)\n  apply(simp add: get_accessible_configurations_def)\n  apply(erule_tac\n      x=\"d1\"\n      in allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"(x+n)\"\n      in allE)\n  apply(simp add: get_configuration_def)\n  done\n\nlemma derivation_append_derivation_take: \"\n  maximum_of_domain d n\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> derivation_take (derivation_append d d' n) n = d\"\n  apply(rule ext)\n  apply(rename_tac x)(*strict*)\n  apply(simp add: derivation_take_def derivation_append_def)\n  apply(clarsimp)\n  apply(case_tac \"d x\")\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x a)(*strict*)\n  apply(rule no_some_beyond_maximum_of_domain)\n     apply(rename_tac x a)(*strict*)\n     apply(force)\n    apply(rename_tac x a)(*strict*)\n    apply(force)\n   apply(rename_tac x a)(*strict*)\n   apply(force)\n  apply(rename_tac x a)(*strict*)\n  apply(force)\n  done\n\nlemma derivation_drop_derivation_append: \"\n  derivation G d2\n  \\<Longrightarrow> derivation_append_fit d1 d2 n\n  \\<Longrightarrow> derivation_drop (derivation_append d1 d2 n) n = d2\"\n  apply(rule ext)\n  apply(rename_tac x)(*strict*)\n  apply(simp add: derivation_drop_def derivation_append_def derivation_append_fit_def)\n  apply(clarsimp)\n  apply(case_tac \"d1 n\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac \"d2 0\")\n   apply(rename_tac option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac option b a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac option b a optiona ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b optiona ba)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. d2 0 = Some (pair None c)\")\n   apply(rename_tac option b optiona ba)(*strict*)\n   prefer 2\n   apply(rule some_position_has_details_at_0)\n   apply(force)\n  apply(rename_tac option b optiona ba)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma not_none_before_maximum_of_domain: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> x \\<le> n\n  \\<Longrightarrow> d x \\<noteq> None\"\n  apply(subgoal_tac \"\\<exists>e c. d x = Some (pair e c)\")\n   apply(force)\n  apply (metis some_position_has_details_before_max_dom)\n  done\n\nlemma derivation_append_minimal_maximum_of_domain: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> maximum_of_domain d x\n  \\<Longrightarrow> maximum_of_domain d1 n\n  \\<Longrightarrow> d = derivation_append d1 d2 n\n  \\<Longrightarrow> n\\<le>x\"\n  apply(case_tac \"n\\<le>x\")\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"n>x\")\n   prefer 2\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"derivation_append d1 d2 n n = None\")\n   prefer 2\n   apply (metis allPreMaxDomSome_prime less_le_not_le)\n  apply(simp add: derivation_append_def maximum_of_domain_def)\n  done\n\nlemma der3_belongs: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G (der3 c1 e1 c2 e2 c3)\n  \\<Longrightarrow> c1 \\<in> configurations G\n  \\<Longrightarrow> belongs G (der3 c1 e1 c2 e2 c3)\"\n  apply(rule derivation_belongs)\n     apply(force)\n    apply(simp add: der3_def)\n   apply(force)\n  apply(force)\n  done\n\nlemma der3_preserves_get_accessible_configurations: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G (der3 c1 e1 c2 e2 c3)\n  \\<Longrightarrow> c1 \\<in> get_accessible_configurations G\n  \\<Longrightarrow> c3 \\<in> get_accessible_configurations G\"\n  apply(simp add: get_accessible_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac d i)(*strict*)\n  apply(rule_tac\n      x=\"derivation_append d (der3 c1 e1 c2 e2 c3) i\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d i)(*strict*)\n   apply(rule derivation_append_preserves_derivation_initial)\n     apply(rename_tac d i)(*strict*)\n     apply(force)\n    apply(rename_tac d i)(*strict*)\n    apply(force)\n   apply(rename_tac d i)(*strict*)\n   apply(rule derivation_append_preserves_derivation)\n     apply(rename_tac d i)(*strict*)\n     apply(simp add: derivation_initial_def)\n    apply(rename_tac d i)(*strict*)\n    apply(force)\n   apply(rename_tac d i)(*strict*)\n   apply(case_tac \"d i\")\n    apply(rename_tac d i)(*strict*)\n    apply(simp add: get_configuration_def)\n   apply(rename_tac d i a)(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(case_tac a)\n   apply(rename_tac d i a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d i option)(*strict*)\n   apply(simp add: der3_def)\n  apply(rename_tac d i)(*strict*)\n  apply(rule_tac\n      x=\"Suc(Suc i)\"\n      in exI)\n  apply(simp add: derivation_append_def der3_def)\n  apply(simp add: get_configuration_def)\n  done\n\nlemma der2_preserves_get_accessible_configurations: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G (der2 c1 e1 c2)\n  \\<Longrightarrow> c1 \\<in> get_accessible_configurations G\n  \\<Longrightarrow> c2 \\<in> get_accessible_configurations G\"\n  apply(simp add: get_accessible_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac d i)(*strict*)\n  apply(rule_tac\n      x=\"derivation_append d (der2 c1 e1 c2) i\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d i)(*strict*)\n   apply(rule derivation_append_preserves_derivation_initial)\n     apply(rename_tac d i)(*strict*)\n     apply(force)\n    apply(rename_tac d i)(*strict*)\n    apply(force)\n   apply(rename_tac d i)(*strict*)\n   apply(rule derivation_append_preserves_derivation)\n     apply(rename_tac d i)(*strict*)\n     apply(simp add: derivation_initial_def)\n    apply(rename_tac d i)(*strict*)\n    apply(force)\n   apply(rename_tac d i)(*strict*)\n   apply(case_tac \"d i\")\n    apply(rename_tac d i)(*strict*)\n    apply(simp add: get_configuration_def)\n   apply(rename_tac d i a)(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(case_tac a)\n   apply(rename_tac d i a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d i option)(*strict*)\n   apply(simp add: der2_def)\n  apply(rename_tac d i)(*strict*)\n  apply(rule_tac\n      x=\"Suc i\"\n      in exI)\n  apply(simp add: derivation_append_def der2_def)\n  apply(simp add: get_configuration_def)\n  done\n\nlemma der2_belongs_prime: \"\n  TSstructure G\n  \\<Longrightarrow> c1 \\<in> configurations G\n  \\<Longrightarrow> derivation G (der2 c1 e c2)\n  \\<Longrightarrow> belongs G (der2 c1 e c2)\"\n  apply(simp (no_asm) add: der2_def belongs_def)\n  apply(clarsimp)\n  apply(rule AX_step_relation_preserves_belongs)\n    apply(force)\n   apply(rule position_change_due_to_step_relation)\n     apply(force)\n    apply(simp add: der2_def)\n    apply(force)\n   apply(simp add: der2_def)\n  apply(force)\n  done\n\nlemma initial_configurations_are_get_accessible_configurations: \"\n  TSstructure G\n  \\<Longrightarrow> c \\<in> initial_configurations G\n  \\<Longrightarrow> c \\<in> get_accessible_configurations G\"\n  apply(simp add: get_accessible_configurations_def)\n  apply(rule_tac\n      x=\"der1 c\"\n      in exI)\n  apply(rule conjI)\n   apply(simp add: derivation_initial_def)\n   apply(rule conjI)\n    apply(rule der1_is_derivation)\n   apply(simp add: der1_def)\n  apply(simp add: der1_def get_configuration_def)\n  done\n\nlemma der2_derivation_implies_step_relation: \"\n  derivation G (der2 c1 e c2)\n  \\<Longrightarrow> step_relation G c1 e c2\"\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc 0\"\n      in allE)\n  apply(clarsimp)\n  apply(simp add: der2_def)\n  done\n\nlemma derivation_initial_configurations: \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> c \\<in> configurations G\"\n  apply(rule belongs_configurations)\n   apply(rule derivation_initial_belongs)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma pre_notnone_position_is_some_position: \"\n  derivation M g\n  \\<Longrightarrow> g m \\<noteq> None\n  \\<Longrightarrow> n\\<le>m\n  \\<Longrightarrow> \\<exists>e c. g n = Some (pair e c)\"\n  apply(case_tac \"g m\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac \"n=m\")\n   apply(rename_tac option b)(*strict*)\n   apply(auto)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac m)\n   apply(clarsimp)\n  apply(rename_tac option b nat)(*strict*)\n  apply(subgoal_tac \"g n\\<noteq>None\")\n   apply(rename_tac option b nat)(*strict*)\n   defer\n   apply(rule derivationNoFromNone2_prime)\n     apply(rename_tac option b nat)(*strict*)\n     apply(blast)+\n   apply(rename_tac option b nat)(*strict*)\n   apply(arith)\n  apply(rename_tac option b nat)(*strict*)\n  apply(auto)\n  apply(rename_tac option b nat y)(*strict*)\n  apply(case_tac y)\n  apply(clarsimp)\n  done\n\nlemma pre_notnone_position_is_some_position_prime: \"\n  derivation M g\n  \\<Longrightarrow> g m \\<noteq> None\n  \\<Longrightarrow> Suc n\\<le>m\n  \\<Longrightarrow> \\<exists>e c. g (Suc n) = Some (pair (Some e) c)\"\n  apply(case_tac \"g m\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(rule pre_some_position_is_some_position_prime)\n     apply(rename_tac option b)(*strict*)\n     apply(force)+\n  done\n\nlemma get_labels_derivation_append: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d1\n  \\<Longrightarrow> derivation G d2\n  \\<Longrightarrow> d1 n1 \\<noteq> None\n  \\<Longrightarrow> d2 n2 \\<noteq> None\n  \\<Longrightarrow> get_labels (derivation_append d1 d2 n1) (n1+n2)\n  = get_labels d1 n1 @ (get_labels d2 n2)\"\n  apply(simp add: get_labels_def)\n  apply(clarsimp)\n  apply(rename_tac y ya)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n1) = SSm + 1 - SSn\" for SSm SSn)\n   apply(rename_tac y ya)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac y ya)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n2) = SSm + 1 - SSn\" for SSm SSn)\n   apply(rename_tac y ya)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac y ya)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (n1+n2)) = SSm + 1 - SSn\" for SSm SSn)\n   apply(rename_tac y ya)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac y ya)(*strict*)\n  apply(clarsimp)\n  apply(rule listEqI)\n   apply(rename_tac y ya)(*strict*)\n   apply(force)\n  apply(rename_tac y ya i)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t = \"nat_seq (Suc 0) (n1+n2) ! i\"\n      and s = \"SSn + SSi\" for SSn SSi\n      in ssubst)\n   apply(rename_tac y ya i)(*strict*)\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac y ya i)(*strict*)\n    apply(force)\n   apply(rename_tac y ya i)(*strict*)\n   apply(force)\n  apply(rename_tac y ya i)(*strict*)\n  apply(case_tac \"i<n1\")\n   apply(rename_tac y ya i)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t = \"(map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) n1) @ map (\\<lambda>i. get_label (d2 i)) (nat_seq (Suc 0) n2)) ! i\"\n      and s = \"(map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) n1)) ! i\"\n      in ssubst)\n    apply(rename_tac y ya i)(*strict*)\n    apply (metis nth_append get_labels_def get_labels_length)\n   apply(rename_tac y ya i)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t = \"nat_seq (Suc 0) n1 ! i\"\n      and s = \"SSn + SSi\" for SSn SSi\n      in ssubst)\n    apply(rename_tac y ya i)(*strict*)\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac y ya i)(*strict*)\n     apply(force)\n    apply(rename_tac y ya i)(*strict*)\n    apply(force)\n   apply(rename_tac y ya i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac y ya i)(*strict*)\n  apply(rule_tac\n      t = \"(map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) n1) @ map (\\<lambda>i. get_label (d2 i)) (nat_seq (Suc 0) n2)) ! i\"\n      and s = \"(map (\\<lambda>i. get_label (d2 i)) (nat_seq (Suc 0) n2)) ! (i-length(map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) n1)))\"\n      in ssubst)\n   apply(rename_tac y ya i)(*strict*)\n   apply(rule nth_append_2)\n   apply(force)\n  apply(rename_tac y ya i)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t = \"nat_seq (Suc 0) n2 ! (i-n1)\"\n      and s = \"SSn + SSi\" for SSn SSi\n      in ssubst)\n   apply(rename_tac y ya i)(*strict*)\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac y ya i)(*strict*)\n    apply(force)\n   apply(rename_tac y ya i)(*strict*)\n   apply(force)\n  apply(rename_tac y ya i)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def)\n  apply(rule_tac\n      t = \"Suc i - n1 \"\n      and s = \"Suc (i-n1)\"\n      in ssubst)\n   apply(rename_tac y ya i)(*strict*)\n   apply(force)\n  apply(rename_tac y ya i)(*strict*)\n  apply(force)\n  done\n\nlemma get_labels_derivation_take: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> d n \\<noteq> None\n  \\<Longrightarrow> get_labels d n = get_labels (derivation_take d n) n\"\n  apply(simp add: get_labels_def)\n  apply(clarsimp)\n  apply(rename_tac x y)(*strict*)\n  apply(simp add: derivation_take_def get_label_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"x\\<le>n\")\n   apply(rename_tac x y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x y)(*strict*)\n  apply (metis nat_seq_in_interval)\n  done\n\nlemma get_labels_the_Some_on_defined_positions: \"\n  derivation G d\n  \\<Longrightarrow> d n \\<noteq> None\n  \\<Longrightarrow> get_labels d n = map (Some \\<circ> the) (get_labels d n)\"\n  apply(simp add: get_labels_def)\n  apply(clarsimp)\n  apply(rename_tac x y)(*strict*)\n  apply(subgoal_tac \"Suc 0\\<le>x \\<and> x \\<le> n\")\n   apply(rename_tac x y)(*strict*)\n   apply(clarsimp)\n   apply(case_tac x)\n    apply(rename_tac x y)(*strict*)\n    apply(force)\n   apply(rename_tac x y nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y nat)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d (Suc nat) = Some (pair (Some e) c)\")\n    apply(rename_tac y nat)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m = \"n\"\n      in pre_some_position_is_some_position_prime)\n       apply(rename_tac y nat)(*strict*)\n       apply(force)\n      apply(rename_tac y nat)(*strict*)\n      apply(force)\n     apply(rename_tac y nat)(*strict*)\n     apply(force)\n    apply(rename_tac y nat)(*strict*)\n    apply(force)\n   apply(rename_tac y nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y nat e c)(*strict*)\n   apply(simp add: get_label_def)\n  apply(rename_tac x y)(*strict*)\n  apply (metis nat_seq_in_interval)\n  done\n\nlemma derivation_append_preserves_label_set: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d1\n  \\<Longrightarrow> d1 n \\<noteq> None\n  \\<Longrightarrow> derivation G d2\n  \\<Longrightarrow> d2 m \\<noteq> None\n  \\<Longrightarrow> set (get_labels\n                (derivation_append d1 d2 n) (n+m)) =\n          set (get_labels d1 n) \\<union> set (get_labels d2 m)\"\n  apply(simp add: derivation_append_def)\n  apply(clarsimp)\n  apply(rename_tac y ya)(*strict*)\n  apply(rule order_antisym)\n   apply(rename_tac y ya)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y ya x)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(clarsimp)\n   apply(rename_tac y ya i)(*strict*)\n   apply(case_tac \"i\\<le>n\")\n    apply(rename_tac y ya i)(*strict*)\n    apply(clarsimp)\n    apply(rule inMap)\n    apply(rule_tac\n      x=\"i\"\n      in bexI)\n     apply(rename_tac y ya i)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac y ya i)(*strict*)\n    apply(subgoal_tac \"Suc 0 \\<le> i \\<and> i \\<le> (n+m)\")\n     apply(rename_tac y ya i)(*strict*)\n     prefer 2\n     apply(rule nat_seq_in_interval)\n     apply(force)\n    apply(rename_tac y ya i)(*strict*)\n    apply(clarsimp)\n    apply(rule nat_seq_interval)\n     apply(rename_tac y ya i)(*strict*)\n     apply(force)\n    apply(rename_tac y ya i)(*strict*)\n    apply(force)\n   apply(rename_tac y ya i)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"get_label (d2 (i - n)) \\<in> (\\<lambda>i. get_label (d2 i)) ` set (nat_seq (Suc 0) m)\")\n    apply(rename_tac y ya i)(*strict*)\n    apply(force)\n   apply(rename_tac y ya i)(*strict*)\n   apply(rule inMap)\n   apply(rule_tac\n      x=\"i-n\"\n      in bexI)\n    apply(rename_tac y ya i)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y ya i)(*strict*)\n   apply(subgoal_tac \"Suc 0 \\<le> i \\<and> i \\<le> (n+m)\")\n    apply(rename_tac y ya i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_in_interval)\n    apply(force)\n   apply(rename_tac y ya i)(*strict*)\n   apply(clarsimp)\n   apply(rule nat_seq_interval)\n    apply(rename_tac y ya i)(*strict*)\n    apply(force)\n   apply(rename_tac y ya i)(*strict*)\n   apply(force)\n  apply(rename_tac y ya)(*strict*)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac y ya)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(clarsimp)\n   apply(rename_tac y ya i)(*strict*)\n   apply(rule inMap)\n   apply(subgoal_tac \"Suc 0 \\<le> i \\<and> i \\<le> n\")\n    apply(rename_tac y ya i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_in_interval)\n    apply(force)\n   apply(rename_tac y ya i)(*strict*)\n   apply(rule_tac\n      x=\"i\"\n      in bexI)\n    apply(rename_tac y ya i)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y ya i)(*strict*)\n   apply(rule nat_seq_interval)\n    apply(rename_tac y ya i)(*strict*)\n    apply(force)\n   apply(rename_tac y ya i)(*strict*)\n   apply(force)\n  apply(rename_tac y ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y ya x)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(clarsimp)\n  apply(rename_tac y ya i)(*strict*)\n  apply(rule inMap)\n  apply(subgoal_tac \"Suc 0 \\<le> i \\<and> i \\<le> m\")\n   apply(rename_tac y ya i)(*strict*)\n   prefer 2\n   apply(rule nat_seq_in_interval)\n   apply(force)\n  apply(rename_tac y ya i)(*strict*)\n  apply(rule_tac\n      x=\"i+n\"\n      in bexI)\n   apply(rename_tac y ya i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y ya i)(*strict*)\n  apply(rule nat_seq_interval)\n   apply(rename_tac y ya i)(*strict*)\n   apply(force)\n  apply(rename_tac y ya i)(*strict*)\n  apply(force)\n  done\n\nlemma derivation_map_preserves_label_set: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d1\n  \\<Longrightarrow> d1 n \\<noteq> None\n  \\<Longrightarrow> set (get_labels\n                (derivation_map d1 C) n) =\n          set (get_labels d1 n)\"\n  apply(simp add: derivation_map_def)\n  apply(clarsimp)\n  apply(rename_tac y)(*strict*)\n  apply(rule order_antisym)\n   apply(rename_tac y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y x)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(clarsimp)\n   apply(rename_tac y i)(*strict*)\n   apply(rule inMap)\n   apply(rule_tac\n      x=\"i\"\n      in bexI)\n    apply(rename_tac y i)(*strict*)\n    apply(simp add: get_label_def)\n    apply(case_tac \"d1 i\")\n     apply(rename_tac y i)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac y i a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac y i a option b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y i)(*strict*)\n   apply(subgoal_tac \"Suc 0 \\<le> i \\<and> i \\<le> n\")\n    apply(rename_tac y i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_in_interval)\n    apply(force)\n   apply(rename_tac y i)(*strict*)\n   apply(rule nat_seq_interval)\n    apply(rename_tac y i)(*strict*)\n    apply(force)\n   apply(rename_tac y i)(*strict*)\n   apply(force)\n  apply(rename_tac y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y x)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(clarsimp)\n  apply(rename_tac y i)(*strict*)\n  apply(rule inMap)\n  apply(rule_tac\n      x=\"i\"\n      in bexI)\n   apply(rename_tac y i)(*strict*)\n   apply(simp add: get_label_def)\n   apply(case_tac \"d1 i\")\n    apply(rename_tac y i)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y i a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac y i a option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y i)(*strict*)\n  apply(force)\n  done\n\nlemma decompose_derivation_append_2: \"\n  TSstructure G\n  \\<Longrightarrow> d1 n \\<noteq> None\n  \\<Longrightarrow> derivation_append_fit d1 d2 n\n  \\<Longrightarrow> derivation G (derivation_append d1 d2 n)\n  \\<Longrightarrow> derivation G d2\"\n  apply(simp add: derivation_def)\n  apply(clarsimp)\n  apply(rename_tac y i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac y i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y)(*strict*)\n   apply(case_tac \"d2 0\")\n    apply(rename_tac y)(*strict*)\n    apply(clarsimp)\n    apply(simp add: derivation_append_fit_def)\n    apply(case_tac y)\n    apply(rename_tac y option b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac y a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y option b)(*strict*)\n   apply(simp add: derivation_append_fit_def)\n   apply(case_tac y)\n   apply(rename_tac y option b optiona ba)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option b optiona ba)(*strict*)\n   apply(case_tac option)\n    apply(rename_tac option b optiona ba)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac option b optiona ba a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y nat)(*strict*)\n  apply(erule_tac\n      x=\"Suc nat+n\"\n      in allE)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def)\n  apply(case_tac \"d2 (Suc nat)\")\n   apply(rename_tac y nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y nat a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac y nat a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y nat option b)(*strict*)\n  apply(simp add: derivation_append_def derivation_append_fit_def)\n  apply(case_tac \"d2 nat\")\n   apply(rename_tac y nat option b)(*strict*)\n   apply(clarsimp)\n   apply(case_tac nat)\n    apply(rename_tac y nat option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac y option b)(*strict*)\n    apply(case_tac y)\n    apply(rename_tac y option b optiona ba)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y nat option b nata)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y nat option b a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac y nat option b a optiona ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y nat option b optiona ba)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac y nat option b optiona ba)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y nat b optiona ba)(*strict*)\n   apply(case_tac nat)\n    apply(rename_tac y nat b optiona ba)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac y b optiona ba)(*strict*)\n    apply(case_tac y)\n    apply(rename_tac y b optiona ba option bb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y nat b optiona ba nata)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y nat option b optiona ba a)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac y nat option b optiona ba a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y nat option b optiona ba a aa)(*strict*)\n  apply(case_tac y)\n  apply(rename_tac y nat option b optiona ba a aa optionb bb)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat b optiona ba a optionb bb)(*strict*)\n  apply(case_tac \"d2 0\")\n   apply(rename_tac nat b optiona ba a optionb bb)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat b optiona ba a optionb bb aa)(*strict*)\n  apply(clarsimp)\n  apply(case_tac aa)\n  apply(rename_tac nat b optiona ba a optionb bb aa option bc)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat b optiona ba a optionb bb option bc)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac nat b optiona ba a optionb bb option bc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat b optiona ba a optionb bc)(*strict*)\n   apply(case_tac nat)\n    apply(rename_tac nat b optiona ba a optionb bc)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac nat b optiona ba a optionb bc nata)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat b optiona ba a optionb bb option bc aa)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma in_get_labels_implies_realizable: \"\n  x \\<in> set (get_labels d n)\n  \\<Longrightarrow> TSstructure G\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> d n \\<noteq> None\n  \\<Longrightarrow> \\<exists>i c. Suc 0\\<le>i \\<and> i\\<le>n \\<and> d i = Some (pair x c)\"\n  apply(simp add: get_labels_def)\n  apply(clarsimp)\n  apply(rename_tac i y)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(subgoal_tac \"Suc 0 \\<le> i \\<and> i \\<le> n\")\n   apply(rename_tac i y)(*strict*)\n   prefer 2\n   apply(rule nat_seq_in_interval)\n   apply(force)\n  apply(rename_tac i y)(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_label_def)\n  apply(case_tac \"d i\")\n   apply(rename_tac i y)(*strict*)\n   apply(clarsimp)\n   apply (metis allPreMaxDomSome derivation_take_id_prime derivation_take_twice_prime derivationNoFromNone derivationNoFromNone2 lessI maximum_of_domain_derivation_take)\n  apply(rename_tac i y a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac i y a option b)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma get_accessible_configurations_are_configurations2: \"\n  TSstructure G\n  \\<Longrightarrow> c \\<in> get_accessible_configurations G\n  \\<Longrightarrow> c \\<in> configurations G\"\n  apply(simp add: get_accessible_configurations_def get_configuration_def)\n  apply(clarsimp)\n  apply(rename_tac d i)(*strict*)\n  apply(case_tac \"d i\")\n   apply(rename_tac d i)(*strict*)\n   apply(force)\n  apply(rename_tac d i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac d i a option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d i option)(*strict*)\n  apply (metis derivation_initial_configurations)\n  done\n\nlemma no_some_beyond_none: \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G d\n  \\<Longrightarrow> d n = None\n  \\<Longrightarrow> d m \\<noteq> None\n  \\<Longrightarrow> n\\<le>m\n  \\<Longrightarrow> Q\"\n  apply (metis Suc_leI Suc_n_not_le_n derivationNoFromNone2_prime derivation_initial_is_derivation le_trans nat_neq_iff)\n  done\n\nlemma get_labels_concat2: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d1\n  \\<Longrightarrow> derivation G d2\n  \\<Longrightarrow> d1 n1 \\<noteq> None\n  \\<Longrightarrow> d2 n2 \\<noteq> None\n  \\<Longrightarrow> get_labels (derivation_append d1 d2 n1) (n1 + n2) = (get_labels d1 n1) @ (get_labels d2 n2)\"\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n1) = SSn + 1 - SSi\" for SSn SSi)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n2) = SSn + 1 - SSi\" for SSn SSi)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (n1+n2)) = SSn + 1 - SSi\" for SSn SSi)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rule listEqI)\n   apply(force)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya)(*strict*)\n  apply(subgoal_tac \"nat_seq (Suc 0) (n1+n2) ! i = SSn+SSi\" for SSn SSi)\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac i y ya)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(case_tac \"Suc i\\<le>n1\")\n   apply(rename_tac i y ya)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"(map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) n1) @ map (\\<lambda>i. get_label (d2 i)) (nat_seq (Suc 0) n2)) ! i\"\n      and s=\"(map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) n1) ) ! i\"\n      in ssubst)\n    apply(rename_tac i y ya)(*strict*)\n    apply(rule nth_append_1)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(simp add: get_label_def derivation_append_def)\n   apply(subgoal_tac \"nat_seq (Suc 0) n1 ! i = SSn+SSi\" for SSn SSi)\n    apply(rename_tac i y ya)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac i y ya)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"(map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) n1) @ map (\\<lambda>i. get_label (d2 i)) (nat_seq (Suc 0) n2)) ! i\"\n      and s=\"(map (\\<lambda>i. get_label (d2 i)) (nat_seq (Suc 0) n2)) ! (i-length(map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) n1)))\"\n      in ssubst)\n   apply(rename_tac i y ya)(*strict*)\n   apply(rule nth_append_2)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(simp add: get_label_def derivation_append_def)\n  apply(subgoal_tac \"nat_seq (Suc 0) n2 ! (i-n1) = SSn+SSi\" for SSn SSi)\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac i y ya)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"Suc (i-n1)\"\n      and s=\"Suc i - n1\"\n      in ssubst)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(force)\n  done\n\nlemma get_labels_eq_from_equal_derivation: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d1\n  \\<Longrightarrow> derivation G d2\n  \\<Longrightarrow> d1 n \\<noteq> None\n  \\<Longrightarrow> d2 n \\<noteq> None\n  \\<Longrightarrow> \\<forall>i\\<le>n. d1 i = d2 i\n  \\<Longrightarrow> get_labels d1 n = get_labels d2 n\"\n  apply(simp add: get_labels_def)\n  apply(clarsimp)\n  apply(rename_tac x y)(*strict*)\n  apply(simp add: get_label_def)\n  apply(case_tac \"d1 x\")\n   apply(rename_tac x y)(*strict*)\n   apply(clarsimp)\n   apply (metis derivationNoFromNone_prime derivationNoFromNone2 derivationNoFromNone2_prime diff_is_0_eq less_Suc_eq linorder_neqE_nat nat_seq_in_interval neq0_conv zero_less_diff)\n  apply(rename_tac x y a)(*strict*)\n  apply(case_tac \"d2 x\")\n   apply(rename_tac x y a)(*strict*)\n   apply(clarsimp)\n   apply (metis derivationNoFromNone_prime derivationNoFromNone2 derivationNoFromNone2_prime diff_is_0_eq less_Suc_eq nat_seq_in_interval neq0_conv zero_less_diff)\n  apply(rename_tac x y a aa)(*strict*)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"x\"\n      in allE)\n  apply(clarsimp)\n  apply(erule impE)\n   apply(rename_tac x y a aa)(*strict*)\n   apply (metis nat_seq_in_interval)\n  apply(rename_tac x y a aa)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma derivation_from_derivation_append_first: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G' (derivation_append d1 d2 n)\n  \\<Longrightarrow> derivation G' (derivation_take d1 n)\"\n  apply(simp (no_asm) add: derivation_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_take_def)\n   apply(case_tac \"d1 0\")\n    apply(clarsimp)\n    apply(simp add: derivation_def)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n    apply(simp add: derivation_append_def)\n   apply(rename_tac a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option b)(*strict*)\n   apply(case_tac option)\n    apply(rename_tac option b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac option b a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac b a)(*strict*)\n   apply(simp add: derivation_def)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d1 (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac nat a)(*strict*)\n  apply(simp add: derivation_take_def)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac nat a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat option b)(*strict*)\n  apply(case_tac \"d1 nat\")\n   apply(rename_tac nat option b)(*strict*)\n   apply(simp add: derivation_take_def)\n   apply(simp add: derivation_def)\n   apply(erule_tac\n      x=\"Suc nat\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac nat option b a)(*strict*)\n  apply(simp add: derivation_take_def)\n  apply(case_tac a)\n  apply(rename_tac nat option b a optiona ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat option b optiona ba)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac nat option b optiona ba)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat b optiona ba)(*strict*)\n   apply(simp add: derivation_def)\n   apply(erule_tac\n      x=\"Suc nat\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac nat option b optiona ba a)(*strict*)\n  apply(simp add: derivation_take_def)\n  apply(simp add: derivation_def)\n  apply(erule_tac\n      x=\"Suc nat\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac nat b optiona ba a)(*strict*)\n  apply(simp add: derivation_append_def)\n  done\n\nlemma get_labels_drop_last: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> d (Suc n) = Some (pair (Some e) c)\n  \\<Longrightarrow> m=(Suc n)\n  \\<Longrightarrow> get_labels d m = get_labels d n @ [Some e]\"\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"nat_seq (Suc 0) (Suc n) = nat_seq (Suc 0) n @ [Suc n]\")\n   apply(clarsimp)\n   apply(simp add: get_label_def)\n  apply (metis nat_seq_drop_last_simp append_Nil lessI less_Suc0 nat_seqEmpty natUptTo_n_n trivNat)\n  done\n\ndefinition trans_der :: \"'TSstructure \\<Rightarrow> (nat \\<Rightarrow> ('label, 'conf) derivation_configuration option) \\<Rightarrow> 'conf \\<Rightarrow> 'label list \\<Rightarrow> 'conf \\<Rightarrow> bool\" where\n  \"trans_der G d l f\\<pi> fw = (\\<exists>e.\n  derivation G d\n  \\<and> belongs G d\n  \\<and> get_labels d (length f\\<pi>) = map Some f\\<pi>\n  \\<and> d 0 = Some (pair None l)\n  \\<and> d (length f\\<pi>) = Some (pair e fw)\n  )\"\n\ndefinition trans_der_list :: \"'TSstructure \\<Rightarrow> (nat \\<Rightarrow> ('label, 'conf) derivation_configuration option) list \\<Rightarrow> 'conf list \\<Rightarrow> 'label list list \\<Rightarrow> 'conf list \\<Rightarrow> bool\" where\n  \"trans_der_list G d l f\\<pi> fw = (length d=length l \\<and> length l=length f\\<pi>\\<and>length f\\<pi>=length fw\\<and> (\\<forall>i<length d. trans_der G (d!i) (l!i) (f\\<pi>!i) (fw!i)))\"\n\nlemma trans_der_belongs_configurations1: \"\n  trans_der G d c1 \\<pi> c2\n  \\<Longrightarrow> c1 \\<in> configurations G\"\n  apply(simp add: trans_der_def)\n  apply(rule belongs_configurations)\n   apply(force)\n  apply(force)\n  done\n\nlemma trans_der_belongs_configurations2: \"\n  trans_der G d c1 \\<pi> c2\n  \\<Longrightarrow> c2 \\<in> configurations G\"\n  apply(simp add: trans_der_def)\n  apply(clarsimp)\n  apply(rename_tac e)(*strict*)\n  apply(rule belongs_configurations)\n   apply(rename_tac e)(*strict*)\n   apply(force)\n  apply(rename_tac e)(*strict*)\n  apply(force)\n  done\n\nlemma trans_der_skip: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c \\<pi> cF\n  \\<Longrightarrow> d n = Some (pair e1 cI)\n  \\<Longrightarrow> n \\<le> length \\<pi>\n  \\<Longrightarrow> trans_der G (derivation_drop d n) cI (drop n \\<pi>) cF\"\n  apply(simp add: trans_der_def)\n  apply(clarsimp)\n  apply(rename_tac e)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac e)(*strict*)\n   apply(rule_tac\n      m=\"length \\<pi>-n\"\n      in derivation_drop_preserves_derivation_prime)\n    apply(rename_tac e)(*strict*)\n    apply(force)\n   apply(rename_tac e)(*strict*)\n   apply(force)\n  apply(rename_tac e)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac e)(*strict*)\n   apply(rule derivation_drop_preserves_belongs)\n     apply(rename_tac e)(*strict*)\n     apply(force)\n    apply(rename_tac e)(*strict*)\n    apply(force)\n   apply(rename_tac e)(*strict*)\n   apply(force)\n  apply(rename_tac e)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (length \\<pi>-n)) = SSn + 1 - Suc 0\" for SSn)\n   apply(rename_tac e)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac e)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (length \\<pi>)) = SSn + 1 - Suc 0\" for SSn)\n   apply(rename_tac e)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac e)(*strict*)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac e)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(rule listEqI)\n    apply(rename_tac e)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac e i)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"Some (\\<pi> ! (n + i))\"\n      and s=\"(map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (length \\<pi>)))!(n+i)\"\n      in ssubst)\n    apply(rename_tac e i)(*strict*)\n    apply(force)\n   apply(rename_tac e i)(*strict*)\n   apply(thin_tac \"map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (length \\<pi>)) = map Some \\<pi>\")\n   apply(subgoal_tac \"nat_seq (Suc 0) (length \\<pi>-n) ! i = SSn+SSi\" for SSn SSi)\n    apply(rename_tac e i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac e i)(*strict*)\n     apply(force)\n    apply(rename_tac e i)(*strict*)\n    apply(force)\n   apply(rename_tac e i)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"nat_seq (Suc 0) (length \\<pi>) ! (n+i) = SSn+SSi\" for SSn SSi)\n    apply(rename_tac e i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac e i)(*strict*)\n     apply(force)\n    apply(rename_tac e i)(*strict*)\n    apply(force)\n   apply(rename_tac e i)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (length \\<pi>)) ! (n + i)\"\n      and s=\"(\\<lambda>i. get_label (d i)) ((nat_seq (Suc 0) (length \\<pi>)) ! (n + i))\"\n      in ssubst)\n    apply(rename_tac e i)(*strict*)\n    apply(rule nth_map)\n    apply(force)\n   apply(rename_tac e i)(*strict*)\n   apply(simp add: derivation_drop_def get_label_def)\n   apply(rule_tac\n      t=\"n+i\"\n      and s=\"i+n\"\n      in ssubst)\n    apply(rename_tac e i)(*strict*)\n    apply(force)\n   apply(rename_tac e i)(*strict*)\n   apply(force)\n  apply(rename_tac e)(*strict*)\n  apply(simp add: derivation_drop_def)\n  apply(clarsimp)\n  done\n\nlemma trans_der_skip_prime: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c \\<pi> cF\n  \\<Longrightarrow> d n = Some (pair e1 cI)\n  \\<Longrightarrow> n \\<le> length \\<pi>\n  \\<Longrightarrow> \\<pi>X=drop n \\<pi>\n  \\<Longrightarrow> \\<exists>d. trans_der G d cI \\<pi>X cF\"\n  apply(rule_tac\n      x=\"derivation_drop d n\"\n      in exI)\n  apply(rule_tac\n      t=\"\\<pi>X\"\n      and s=\"drop n \\<pi>\"\n      in ssubst)\n   apply(force)\n  apply(rule trans_der_skip)\n     apply(force)+\n  done\n\nlemma trans_der_der2: \"\n  TSstructure G\n  \\<Longrightarrow> c \\<in> configurations G\n  \\<Longrightarrow> step_relation G c e c'\n  \\<Longrightarrow> trans_der G (der2 c e c') c [e] c'\"\n  apply(simp add: trans_der_def)\n  apply(rule conjI)\n   apply(rule der2_is_derivation)\n   apply(force)\n  apply(rule conjI)\n   apply(rule der2_belongs)\n     apply(force)\n    apply (metis AX_step_relation_preserves_belongs)\n   apply (metis AX_step_relation_preserves_belongs)\n  apply(rule conjI)\n   apply (metis der2_get_labels insert_Nil)\n  apply(rule conjI)\n   apply(simp add: der2_def)\n  apply(simp add: der2_def)\n  done\n\nlemma get_labels_subset_step_labels: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> belongs G d\n  \\<Longrightarrow> d n \\<noteq> None\n  \\<Longrightarrow> set (map the (get_labels d n)) \\<subseteq> step_labels G\"\n  apply(case_tac \"0<n\")\n   apply(simp add: get_labels_def)\n   apply(clarsimp)\n   apply(rename_tac xa y)(*strict*)\n   apply(subgoal_tac \"\\<exists>i<length (nat_seq (Suc 0) n). (nat_seq (Suc 0) n) ! i = xa\")\n    apply(rename_tac xa y)(*strict*)\n    prefer 2\n    apply(rule set_elem_nth)\n    apply(force)\n   apply(rename_tac xa y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y i)(*strict*)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSn + 1 - SSi\" for SSn SSi)\n    apply(rename_tac y i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac y i)(*strict*)\n   apply(subgoal_tac \"nat_seq (Suc 0) n ! i = SSn+SSi\" for SSn SSi)\n    apply(rename_tac y i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac y i)(*strict*)\n     apply(force)\n    apply(rename_tac y i)(*strict*)\n    apply(force)\n   apply(rename_tac y i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: belongs_def)\n   apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n    apply(rename_tac y i)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"n\"\n      in pre_some_position_is_some_position_prime)\n       apply(rename_tac y i)(*strict*)\n       apply(force)\n      apply(rename_tac y i)(*strict*)\n      apply(force)\n     apply(rename_tac y i)(*strict*)\n     apply(force)\n    apply(rename_tac y i)(*strict*)\n    apply(force)\n   apply(rename_tac y i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y i e c)(*strict*)\n   apply(erule_tac\n      x=\"Suc i\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: get_label_def)\n  apply(clarsimp)\n  apply(rename_tac xa y)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(clarsimp)\n  apply(rename_tac y i)(*strict*)\n  apply (metis Suc_n_not_le_n le_0_eq nat_seq_in_interval)\n  done\n\nlemma derivation_initial_has_configuration_at_position_0: \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G d\n  \\<Longrightarrow> \\<exists>c. d 0 = Some (pair None c) \\<and> c \\<in> configurations G\"\n  apply(subgoal_tac \"belongs G d\")\n   prefer 2\n   apply(rule derivation_initial_belongs)\n    apply(force)\n   apply(force)\n  apply(simp add: derivation_initial_def)\n  apply(clarsimp)\n  apply(case_tac \"d 0\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac conf)(*strict*)\n  apply(simp add: belongs_def derivation_initial_def)\n  apply(erule_tac\n      x=\"0\"\n      in allE)+\n  apply(clarsimp)\n  done\n\nlemma trans_der_getLabel_at_pos: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c \\<pi> c'\n  \\<Longrightarrow> d (Suc n) = Some (pair (Some e) c'')\n  \\<Longrightarrow> n<length \\<pi>\n  \\<Longrightarrow> \\<pi>!n = \\<pi>1\n  \\<Longrightarrow> e = \\<pi>1\"\n  apply(simp add: trans_der_def)\n  apply(rule_tac\n      t=\"\\<pi>1\"\n      and s=\"\\<pi>!n\"\n      in ssubst)\n   apply(force)\n  apply(rule Some_inj)\n  apply(rule_tac\n      t=\"Some (\\<pi>!n)\"\n      and s=\"(map Some \\<pi>)!n\"\n      in subst)\n   apply(rule nth_map)\n   apply(force)\n  apply(rule sym)\n  apply(rule getLabel_at_pos)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma trans_der_crop_via_take: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c \\<pi> c'\n  \\<Longrightarrow> n\\<le>length \\<pi>\n  \\<Longrightarrow> get_configuration (d n) = Some cn\n  \\<Longrightarrow> \\<pi>' = take n \\<pi>\n  \\<Longrightarrow> trans_der G (derivation_take d n) c \\<pi>' cn\"\n  apply(clarsimp)\n  apply(simp add: get_configuration_def)\n  apply(case_tac \"d n\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option)(*strict*)\n  apply(simp add: trans_der_def)\n  apply(clarsimp)\n  apply(rename_tac option e)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac option e)(*strict*)\n   apply(rule derivation_take_preserves_derivation)\n   apply(force)\n  apply(rename_tac option e)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac option e)(*strict*)\n   apply(rule derivation_take_preserves_belongs)\n   apply(force)\n  apply(rename_tac option e)(*strict*)\n  apply(rule_tac\n      t=\"min (length \\<pi>) n\"\n      and s=\"n\"\n      in ssubst)\n   apply(rename_tac option e)(*strict*)\n   apply(force)\n  apply(rename_tac option e)(*strict*)\n  apply(rule_tac\n      t=\"get_labels (derivation_take d n) n\"\n      and s=\"get_labels d n\"\n      in ssubst)\n   apply(rename_tac option e)(*strict*)\n   apply (metis derivation_take_id_prime get_labels_derivation_take)\n  apply(rename_tac option e)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac option e)(*strict*)\n   prefer 2\n   apply(simp add: derivation_take_def)\n  apply(rename_tac option e)(*strict*)\n  apply(rule listEqI)\n   apply(rename_tac option e)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(rule_tac\n      t=\"min (length \\<pi>) n\"\n      and s=\"n\"\n      in ssubst)\n    apply(rename_tac option e)(*strict*)\n    apply(force)\n   apply(rename_tac option e)(*strict*)\n   apply (metis list.size(3) nat_seqEmpty nat_seq_length_Suc0 neq0_conv zero_less_Suc)\n  apply(rename_tac option e i)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"length (get_labels d n)=n\")\n   apply(rename_tac option e i)(*strict*)\n   prefer 2\n   apply (metis get_labels_length)\n  apply(rename_tac option e i)(*strict*)\n  apply(rule_tac\n      t=\"get_labels d n ! i\"\n      and s=\"get_labels d (length \\<pi>) ! i\"\n      in ssubst)\n   apply(rename_tac option e i)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac option e i)(*strict*)\n  apply(thin_tac \"get_labels d (length \\<pi>) = map Some \\<pi>\")\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"nat_seq (Suc 0) n ! i = SSn+SSi\" for SSn SSi)\n   apply(rename_tac option e i)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac option e i)(*strict*)\n    apply(force)\n   apply(rename_tac option e i)(*strict*)\n   apply(force)\n  apply(rename_tac option e i)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"length (get_labels d (length \\<pi>))=(length \\<pi>)\")\n   apply(rename_tac option e i)(*strict*)\n   prefer 2\n   apply (metis get_labels_length)\n  apply(rename_tac option e i)(*strict*)\n  apply(subgoal_tac \"nat_seq (Suc 0) (length \\<pi>) ! i = SSn+SSi\" for SSn SSi)\n   apply(rename_tac option e i)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac option e i)(*strict*)\n    apply(force)\n   apply(rename_tac option e i)(*strict*)\n   apply(force)\n  apply(rename_tac option e i)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (length \\<pi>)) ! i\"\n      and s=\"(\\<lambda>i. get_label (d i)) ((nat_seq (Suc 0) (length \\<pi>)) ! i)\"\n      in ssubst)\n   apply(rename_tac option e i)(*strict*)\n   apply(rule nth_map)\n   apply(simp add: get_labels_def)\n  apply(rename_tac option e i)(*strict*)\n  apply(force)\n  done\n\nlemma trans_der_crop_prime: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c \\<pi> c'\n  \\<Longrightarrow> n\\<le>length \\<pi>\n  \\<Longrightarrow> get_configuration (d n) = Some cn\n  \\<Longrightarrow> \\<pi>' = take n \\<pi>\n  \\<Longrightarrow> \\<exists>d. trans_der G d c \\<pi>' cn\"\n  apply(rule_tac\n      x=\"(derivation_take d n)\"\n      in exI)\n  apply(rule trans_der_crop_via_take)\n      apply(blast)+\n  done\n\nlemma trans_der_slice: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c \\<pi> c'\n  \\<Longrightarrow> d i = Some (pair ei ci)\n  \\<Longrightarrow> d j = Some (pair ej cj)\n  \\<Longrightarrow> i\\<le>j\n  \\<Longrightarrow> j\\<le>length \\<pi>\n  \\<Longrightarrow> \\<pi>'=(take (j-i) (drop i \\<pi>))\n  \\<Longrightarrow> \\<exists>d. trans_der G d ci \\<pi>' cj\"\n  apply(subgoal_tac \"trans_der G (derivation_drop d i) ci (drop i \\<pi>) c'\")\n   prefer 2\n   apply(rule trans_der_skip)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"\\<exists>d. trans_der G d ci (take (j-i) (drop i \\<pi>)) cj\")\n   prefer 2\n   apply(rule trans_der_crop_prime)\n       apply(force)\n      prefer 4\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(simp add: derivation_drop_def get_configuration_def)\n   apply(clarsimp)\n  apply(force)\n  done\n\nlemma equal_labels_is_forward_target_deterministic_coinciding_positions: \"\n  TSstructure G\n  \\<Longrightarrow> is_forward_target_deterministic G\n  \\<Longrightarrow> derivation G d1\n  \\<Longrightarrow> derivation G d2\n  \\<Longrightarrow> d1 0 = d2 0\n  \\<Longrightarrow> get_labels d1 n = get_labels d2 n\n  \\<Longrightarrow> d1 (n+x) \\<noteq> None\n  \\<Longrightarrow> d2 (n+y) \\<noteq> None\n  \\<Longrightarrow> k\\<le>n\n  \\<Longrightarrow> (\\<forall>i\\<le>k. d1 i = d2 i)\"\n  apply(induct k)\n   apply(clarsimp)\n  apply(rename_tac k)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ya yaa i)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 k = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac k ya yaa i)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+x\"\n      in step_detail_before_some_position)\n     apply(rename_tac k ya yaa i)(*strict*)\n     apply(force)\n    apply(rename_tac k ya yaa i)(*strict*)\n    apply(force)\n   apply(rename_tac k ya yaa i)(*strict*)\n   apply(force)\n  apply(rename_tac k ya yaa i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ya yaa i e1 e2 c1 c2)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 k = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac k ya yaa i e1 e2 c1 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+y\"\n      in step_detail_before_some_position)\n     apply(rename_tac k ya yaa i e1 e2 c1 c2)(*strict*)\n     apply(force)\n    apply(rename_tac k ya yaa i e1 e2 c1 c2)(*strict*)\n    apply(force)\n   apply(rename_tac k ya yaa i e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac k ya yaa i e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ya yaa i e1 e2 c1 c2 e2a c2a)(*strict*)\n  apply(case_tac \"i\\<le>k\")\n   apply(rename_tac k ya yaa i e1 e2 c1 c2 e2a c2a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac k ya yaa i e1 e2 c1 c2 e2a c2a)(*strict*)\n  apply(subgoal_tac \"i=Suc k\")\n   apply(rename_tac k ya yaa i e1 e2 c1 c2 e2a c2a)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac k ya yaa i e1 e2 c1 c2 e2a c2a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n  apply(erule_tac\n      x=\"k\"\n      in allE)\n  apply(clarsimp)\n  apply(subgoal_tac \"e2=e2a\")\n   apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac k ya yaa e1 c1 c2 e2a c2a)(*strict*)\n   apply(simp add: is_forward_target_deterministic_def)\n   apply(force)\n  apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n  apply(subgoal_tac \"Some e2=Some e2a\")\n   apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n   apply(force)\n  apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n  apply(rule_tac\n      t=\"Some e2\"\n      and s=\"(get_labels d1 n)!k\"\n      in ssubst)\n   apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n   apply(rule sym)\n   apply(rule_tac\n      d=\"d1\"\n      and n=\"n\"\n      in getLabel_at_pos)\n     apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n     apply(force)\n    apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n    apply(force)\n   apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n   apply(force)\n  apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n  apply(rule_tac\n      t=\"Some e2a\"\n      and s=\"(get_labels d2 n)!k\"\n      in ssubst)\n   apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n   apply(rule sym)\n   apply(rule_tac\n      d=\"d2\"\n      and n=\"n\"\n      in getLabel_at_pos)\n     apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n     apply(force)\n    apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n    apply(force)\n   apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n   apply(force)\n  apply(rename_tac k ya yaa e1 e2 c1 c2 e2a c2a)(*strict*)\n  apply(force)\n  done\n\nlemma trans_der_concat: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d1 c1 \\<pi>1 c1'\n  \\<Longrightarrow> trans_der G d2 c2 \\<pi>2 c2'\n  \\<Longrightarrow> c1'=c2\n  \\<Longrightarrow> trans_der G (derivation_append d1 d2 (length \\<pi>1)) c1 (\\<pi>1@\\<pi>2) c2'\"\n  apply(simp add: trans_der_def)\n  apply(clarsimp)\n  apply(rename_tac e ea)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac e ea)(*strict*)\n   apply(rule derivation_append_preserves_derivation)\n     apply(rename_tac e ea)(*strict*)\n     apply(force)\n    apply(rename_tac e ea)(*strict*)\n    apply(force)\n   apply(rename_tac e ea)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac e ea)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac e ea)(*strict*)\n   apply(rule derivation_append_preserves_belongs)\n     apply(rename_tac e ea)(*strict*)\n     apply(force)\n    apply(rename_tac e ea)(*strict*)\n    apply(force)\n   apply(rename_tac e ea)(*strict*)\n   apply(force)\n  apply(rename_tac e ea)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac e ea)(*strict*)\n   apply (metis derivation_append_preserves_get_labels map_append)\n  apply(rename_tac e ea)(*strict*)\n  apply(simp add: derivation_append_def)\n  apply(clarsimp)\n  done\n\nlemma trans_der_concat_prime: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d1 c1 \\<pi>1 c1'\n  \\<Longrightarrow> trans_der G d2 c2 \\<pi>2 c2'\n  \\<Longrightarrow> c1'=c2\n  \\<Longrightarrow> \\<exists>d. trans_der G d c1 (\\<pi>1@\\<pi>2) c2'\"\n  apply(rule_tac\n      x=\"(derivation_append d1 d2 (length \\<pi>1))\"\n      in exI)\n  apply(rule trans_der_concat)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma trans_der_context: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c \\<pi> c'\n  \\<Longrightarrow> (\\<forall>a e b. step_relation G a e b \\<longrightarrow> step_relation G (C a) e (C b))\n  \\<Longrightarrow> (\\<forall>ca. ca \\<in> configurations G \\<longrightarrow> C ca \\<in> configurations G)\n  \\<Longrightarrow> C c = c0\n  \\<Longrightarrow> C c' = c0'\n  \\<Longrightarrow> trans_der G (derivation_map d C) c0 \\<pi> c0'\"\n  apply(simp add: trans_der_def)\n  apply(clarsimp)\n  apply(rename_tac e)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac e)(*strict*)\n   apply(rule derivation_map_preserves_derivation2)\n    apply(rename_tac e)(*strict*)\n    apply(force)\n   apply(rename_tac e)(*strict*)\n   apply(force)\n  apply(rename_tac e)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac e)(*strict*)\n   apply(rule derivation_map_preserves_belongs)\n       apply(rename_tac e)(*strict*)\n       apply(force)\n      apply(rename_tac e)(*strict*)\n      apply(force)\n     apply(rename_tac e)(*strict*)\n     apply(force)\n    apply(rename_tac e)(*strict*)\n    apply(force)\n   apply(rename_tac e ca)(*strict*)\n   apply(force)\n  apply(rename_tac e)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac e)(*strict*)\n   apply(simp add: get_labels_derivation_map)\n  apply(rename_tac e)(*strict*)\n  apply(simp add: derivation_map_def)\n  done\n\nlemma derivation_map_preserves_derivation23_VAR2: \"\n  derivation G d\n  \\<Longrightarrow> \\<forall>i<n. \\<forall>e c. d i=Some (pair e c) \\<longrightarrow> P c\n  \\<Longrightarrow> \\<forall>a e b. P a \\<and> step_relation G a e b \\<longrightarrow> step_relation G (C a) e (C b)\n  \\<Longrightarrow> derivation G (derivation_map (derivation_take d n) C)\"\n  apply(unfold derivation_map_def)\n  apply(simp add: derivation_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      and P=\"\\<lambda>i. case i of 0 \\<Rightarrow> case d 0 of None \\<Rightarrow> False | Some (pair None c) \\<Rightarrow> True | Some (pair (Some e) c) \\<Rightarrow> False | Suc i' \\<Rightarrow> case d i of None \\<Rightarrow> True | Some (pair i1 i2) \\<Rightarrow> case d i' of None \\<Rightarrow> False | Some (pair i'1 i'2) \\<Rightarrow> case i1 of None \\<Rightarrow> False | Some i1v \\<Rightarrow> step_relation G i'2 i1v i2\"\n      in allE)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(auto)\n   apply(case_tac \"d 0\")\n    apply(auto)\n   apply(rename_tac a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(auto)\n   apply(rename_tac option b)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(auto)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac nat a)(*strict*)\n  apply(case_tac \"d nat\")\n   apply(rename_tac nat a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac nat a option b)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a aa)(*strict*)\n  apply(case_tac \"d nat\")\n   apply(rename_tac nat a aa)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a aa)(*strict*)\n  apply(case_tac \"a\")\n  apply(rename_tac nat a aa option b)(*strict*)\n  apply(auto)\n  apply(rename_tac nat aa option b)(*strict*)\n  apply(case_tac \"aa\")\n  apply(rename_tac nat aa option b optiona ba)(*strict*)\n  apply(auto)\n  apply(rename_tac nat option b optiona ba)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac nat option b optiona ba)(*strict*)\n   apply(auto)\n  apply(rename_tac nat b optiona ba a)(*strict*)\n  apply(erule_tac\n      x=\"ba\"\n      in allE)\n  apply(erule_tac\n      x=\"a\"\n      in allE)\n  apply(erule_tac\n      x=\"b\"\n      in allE)\n  apply(simp add: derivation_take_def)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"nat\"\n      in allE)\n  apply(clarsimp)\n  done\n\nlemma existence_of_earliest_satisfaction_point_prime_prime: \"\n  derivation M d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> x\\<le>n\n  \\<Longrightarrow> P c\n  \\<Longrightarrow> \\<exists>k. x\\<le>k \\<and> k\\<le>n \\<and> (\\<lambda>n. (case d n of None \\<Rightarrow> False| Some (pair e c) \\<Rightarrow> P c)) k \\<and> (\\<forall>i. x\\<le>i \\<and> i<k \\<longrightarrow> (\\<not>((\\<lambda>n. (case d n of None \\<Rightarrow> False| Some (pair e c) \\<Rightarrow> P c)) i)))\"\n  apply(rule ex_least_nat_le_prime_prime)\n   apply(force)\n  apply(force)\n  done\n\nlemma trans_der_step_labels: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c1 \\<pi> c2\n  \\<Longrightarrow> x\\<in> set \\<pi>\n  \\<Longrightarrow> x \\<in> step_labels G\"\n  apply(simp add: trans_der_def)\n  apply(clarsimp)\n  apply(rename_tac e)(*strict*)\n  apply(subgoal_tac \"\\<exists>i<length SSw. SSw ! i = SSx\" for SSw SSx)\n   apply(rename_tac e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      w=\"\\<pi>\"\n      and x=\"x\"\n      in set_elem_nth)\n   apply(force)\n  apply(rename_tac e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac e i)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n   apply(rename_tac e i)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"(length \\<pi>)\"\n      in pre_some_position_is_some_position_prime)\n      apply(rename_tac e i)(*strict*)\n      apply(force)\n     apply(rename_tac e i)(*strict*)\n     apply(force)\n    apply(rename_tac e i)(*strict*)\n    apply(force)\n   apply(rename_tac e i)(*strict*)\n   apply(force)\n  apply(rename_tac e i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac e i ea c)(*strict*)\n  apply(subgoal_tac \"ea=\\<pi>!i\")\n   apply(rename_tac e i ea c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      and \\<pi>=\"\\<pi>\"\n      in trans_der_getLabel_at_pos)\n       apply(rename_tac e i ea c)(*strict*)\n       apply(force)\n      apply(rename_tac e i ea c)(*strict*)\n      apply(simp add: trans_der_def)\n     apply(rename_tac e i ea c)(*strict*)\n     apply(force)\n    apply(rename_tac e i ea c)(*strict*)\n    apply(force)\n   apply(rename_tac e i ea c)(*strict*)\n   apply(force)\n  apply(rename_tac e i ea c)(*strict*)\n  apply(simp add: belongs_def)\n  apply(erule_tac\n      x=\"Suc i\"\n      in allE)\n  apply(clarsimp)\n  done\n\nlemma trans_der_empty_list: \"\n  trans_der G d c1 \\<pi> c2\n  \\<Longrightarrow> (\\<And>p c2. p\\<in> step_labels G \\<Longrightarrow> \\<not> step_relation G c1 p c2)\n  \\<Longrightarrow> \\<pi>=[] \\<and> c2=c1\"\n  apply(simp add: trans_der_def)\n  apply(case_tac \\<pi>)\n   apply(clarsimp)\n  apply(rename_tac a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a list e)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac a list e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc(length list)\"\n      in step_detail_before_some_position)\n     apply(rename_tac a list e)(*strict*)\n     apply(force)\n    apply(rename_tac a list e)(*strict*)\n    apply(force)\n   apply(rename_tac a list e)(*strict*)\n   apply(force)\n  apply(rename_tac a list e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a list e e2 c2a)(*strict*)\n  apply(erule_tac\n      x=\"e2\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"c2a\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(metis belongs_step_labels)\n  done\n\nlemma trans_der_step_detail: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c1 \\<pi> c2\n  \\<Longrightarrow> i<length \\<pi>\n  \\<Longrightarrow> \\<exists>e ci ci'. d i = Some (pair e ci) \\<and> d (Suc i) = Some (pair (Some (\\<pi>!i)) ci') \\<and> step_relation G ci (\\<pi>!i) ci' \\<and> (kleene_starT \\<and> i=0 \\<longrightarrow> c1=ci) \\<and> (END \\<and> Suc i=length \\<pi> \\<longrightarrow> c2=ci')\"\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\" for SSd SSn)\n   prefer 2\n   apply(unfold trans_der_def)\n   apply(erule exE)+\n   apply(rename_tac e)(*strict*)\n   apply(fold trans_der_def)\n   apply(rule_tac\n      m=\"length \\<pi>\"\n      in step_detail_before_some_position)\n     apply(rename_tac e)(*strict*)\n     apply(force)\n    apply(rename_tac e)(*strict*)\n    apply(force)\n   apply(rename_tac e)(*strict*)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac e1 e2 c1a c2a)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac e1 e2 c1a c2a)(*strict*)\n   prefer 2\n   apply(clarsimp)\n   apply(rename_tac e1 c1a c2a)(*strict*)\n   apply(simp add: trans_der_def)\n   apply(clarsimp)\n   apply(rename_tac e1 c1a c2a e)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac e1 c1a c2a e)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac e1 c1a c2a e)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac e1 e2 c1a c2a)(*strict*)\n  apply(rule_tac\n      d=\"d\"\n      in trans_der_getLabel_at_pos)\n      apply(rename_tac e1 e2 c1a c2a)(*strict*)\n      apply(force)\n     apply(rename_tac e1 e2 c1a c2a)(*strict*)\n     apply(force)\n    apply(rename_tac e1 e2 c1a c2a)(*strict*)\n    apply(force)\n   apply(rename_tac e1 e2 c1a c2a)(*strict*)\n   apply(force)\n  apply(rename_tac e1 e2 c1a c2a)(*strict*)\n  apply(force)\n  done\n\nlemma trans_der_position_detail: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c1 \\<pi> c2\n  \\<Longrightarrow> i\\<le>length \\<pi>\n  \\<Longrightarrow> \\<exists>e ci. d i = Some (pair e ci)\n  \\<and> (i=0 \\<longleftrightarrow> e=None)\n  \\<and> (i>0 \\<longleftrightarrow> e=Some (\\<pi>!(i - Suc 0)))\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(unfold trans_der_def)\n   apply(erule exE)+\n   apply(rename_tac e)(*strict*)\n   apply(fold trans_der_def)\n   apply(rule_tac\n      g=\"d\"\n      and n=\"i\"\n      and m=\"length(\\<pi>)\"\n      in pre_some_position_is_some_position)\n     apply(rename_tac e)(*strict*)\n     apply(force)\n    apply(rename_tac e)(*strict*)\n    apply(force)\n   apply(rename_tac e)(*strict*)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac e c)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac e c)(*strict*)\n   apply(clarsimp)\n   apply(case_tac e)\n    apply(rename_tac e c)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac e c a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c a)(*strict*)\n   apply(simp add: trans_der_def)\n  apply(rename_tac e c nat)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac e c nat)(*strict*)\n   prefer 2\n   apply(unfold trans_der_def)\n   apply(erule exE)+\n   apply(rename_tac e c nat ea)(*strict*)\n   apply(fold trans_der_def)\n   apply(rule_tac\n      g=\"d\"\n      and n=\"Suc nat\"\n      and m=\"length(\\<pi>)\"\n      in pre_some_position_is_some_position_prime)\n      apply(rename_tac e c nat ea)(*strict*)\n      apply(force)\n     apply(rename_tac e c nat ea)(*strict*)\n     apply(force)\n    apply(rename_tac e c nat ea)(*strict*)\n    apply(force)\n   apply(rename_tac e c nat ea)(*strict*)\n   apply(force)\n  apply(rename_tac e c nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c nat ea)(*strict*)\n  apply(rule_tac\n      d=\"d\"\n      in trans_der_getLabel_at_pos)\n      apply(rename_tac c nat ea)(*strict*)\n      apply(force)\n     apply(rename_tac c nat ea)(*strict*)\n     apply(force)\n    apply(rename_tac c nat ea)(*strict*)\n    apply(force)\n   apply(rename_tac c nat ea)(*strict*)\n   apply(force)\n  apply(rename_tac c nat ea)(*strict*)\n  apply(force)\n  done\n\nlemma trans_der_all_step_labels: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c1 \\<pi> c2\n  \\<Longrightarrow> set \\<pi> \\<subseteq> step_labels G\"\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(subgoal_tac \"\\<exists>k<length \\<pi>. \\<pi>!k=x\")\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac k)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac k)(*strict*)\n    prefer 2\n    apply(rule_tac\n      i=\"Suc k\"\n      and d=\"d\"\n      in trans_der_position_detail)\n      apply(rename_tac k)(*strict*)\n      apply(force)\n     apply(rename_tac k)(*strict*)\n     apply(force)\n    apply(rename_tac k)(*strict*)\n    apply(force)\n   apply(rename_tac k)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac k ci)(*strict*)\n   apply(simp add: trans_der_def)\n   apply(clarsimp)\n   apply(rename_tac k ci e)(*strict*)\n   apply(rule belongs_step_labels)\n    apply(rename_tac k ci e)(*strict*)\n    apply(force)\n   apply(rename_tac k ci e)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply (metis in_set_conv_nth)\n  done\n\nlemma trans_der_in_step_labels: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c1 \\<pi> c2\n  \\<Longrightarrow> d n = Some (pair (Some e) c)\n  \\<Longrightarrow> e \\<in> step_labels G\"\n  apply(simp add: trans_der_def)\n  apply(clarsimp)\n  apply(rename_tac ea)(*strict*)\n  apply(rule belongs_step_labels)\n   apply(rename_tac ea)(*strict*)\n   apply(force)\n  apply(rename_tac ea)(*strict*)\n  apply(force)\n  done\n\nlemma trans_der_equal_conf_if_empty_prods: \"\n  trans_der G d c1 [] c2\n  \\<Longrightarrow> c1=c2\"\n  apply(simp add: trans_der_def)\n  apply(force)\n  done\n\nlemma derivation_map_preserves_derivation23: \"\n  derivation M f\n  \\<Longrightarrow> \\<forall>c i e. f i=Some (pair e c) \\<longrightarrow> P c\n  \\<Longrightarrow> \\<forall>a e b i e1 e2. f i = Some (pair e1 a) \\<longrightarrow> f (Suc i) = Some (pair e2 b) \\<longrightarrow> P a \\<longrightarrow> P b \\<longrightarrow> step_relation M a e b \\<longrightarrow> step_relation M (C a) e (C b)\n  \\<Longrightarrow> derivation M (derivation_map f C)\"\n  apply(unfold derivation_map_def)\n  apply(simp add: derivation_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(auto)\n   apply(case_tac \"f 0\")\n    apply(auto)\n   apply(rename_tac a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(auto)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"f (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a)(*strict*)\n  apply(case_tac \"f nat\")\n   apply(rename_tac nat a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac nat a option b)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a aa)(*strict*)\n  apply(case_tac \"f nat\")\n   apply(rename_tac nat a aa)(*strict*)\n   apply(auto)\n  apply(rename_tac nat a aa)(*strict*)\n  apply(case_tac \"a\")\n  apply(rename_tac nat a aa option b)(*strict*)\n  apply(auto)\n  apply(rename_tac nat aa option b)(*strict*)\n  apply(case_tac \"aa\")\n  apply(rename_tac nat aa option b optiona ba)(*strict*)\n  apply(auto)\n  apply(rename_tac nat option b optiona ba)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac nat option b optiona ba)(*strict*)\n   apply(auto)\n  apply(rename_tac nat b optiona ba a)(*strict*)\n  apply(subgoal_tac \"P b\")\n   apply(rename_tac nat b optiona ba a)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac nat b optiona ba a)(*strict*)\n  apply(subgoal_tac \"P ba\")\n   apply(rename_tac nat b optiona ba a)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac nat b optiona ba a)(*strict*)\n  apply(thin_tac \"\\<forall>c. (\\<exists>i e. f i = Some (pair e c)) \\<longrightarrow> P c\")\n  apply(erule_tac\n      x=\"ba\"\n      in allE)\n  apply(erule_tac\n      x=\"a\"\n      in allE)\n  apply(erule_tac\n      x=\"b\"\n      in allE)\n  apply(erule_tac\n      x=\"nat\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac nat b optiona ba a)(*strict*)\n   apply(force)\n  apply(rename_tac nat b optiona ba a)(*strict*)\n  apply(erule impE)\n   apply(rename_tac nat b optiona ba a)(*strict*)\n   apply(force)\n  apply(rename_tac nat b optiona ba a)(*strict*)\n  apply(erule impE)\n   apply(rename_tac nat b optiona ba a)(*strict*)\n   apply(force)\n  apply(rename_tac nat b optiona ba a)(*strict*)\n  apply(erule impE)\n   apply(rename_tac nat b optiona ba a)(*strict*)\n   apply(force)\n  apply(rename_tac nat b optiona ba a)(*strict*)\n  apply(erule impE)\n   apply(rename_tac nat b optiona ba a)(*strict*)\n   apply(force)\n  apply(rename_tac nat b optiona ba a)(*strict*)\n  apply(force)\n  done\n\nlemma trans_der_is_forward_target_deterministic_coincide: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d1 c \\<pi> c1\n  \\<Longrightarrow> trans_der G d2 c \\<pi> c2\n  \\<Longrightarrow> is_forward_target_deterministic G\n  \\<Longrightarrow> i \\<le> length \\<pi>\n  \\<Longrightarrow> d1 i = d2 i\"\n  apply(induct i)\n   apply(clarsimp)\n   apply(simp add: trans_der_def)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      and d=\"d1\"\n      and i=\"i\"\n      and kleene_starT=\"False\"\n      and END=\"False\"\n      in trans_der_step_detail)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      and d=\"d2\"\n      and i=\"i\"\n      and kleene_starT=\"False\"\n      and END=\"False\"\n      in trans_der_step_detail)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i e ci ci' ci'a)(*strict*)\n  apply(simp add: is_forward_target_deterministic_def)\n  apply(erule_tac\n      x=\"ci\"\n      in allE)\n  apply(erule_tac\n      x=\"ci'\"\n      in allE)\n  apply(erule_tac\n      x=\"ci'a\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac i e ci ci' ci'a)(*strict*)\n   apply(rule_tac\n      x=\"\\<pi>!i\"\n      in exI)\n   apply(force)\n  apply(rename_tac i e ci ci' ci'a)(*strict*)\n  apply(force)\n  done\n\nlemma trans_der_coincide_with_pseudo_concat_back: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d1 c1 \\<pi>1 cI\n  \\<Longrightarrow> trans_der G d2 cI \\<pi>2 c2\n  \\<Longrightarrow> trans_der G d3 c1 (\\<pi>1@\\<pi>2) c2\n  \\<Longrightarrow> n = m + length \\<pi>1\n  \\<Longrightarrow> n\\<le>length (\\<pi>1@\\<pi>2)\n  \\<Longrightarrow> is_forward_target_deterministic G\n  \\<Longrightarrow> m>0\n  \\<Longrightarrow> d3 n = d2 m\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      ?d1.0=\"d1\"\n      and ?d2.0=\"d2\"\n      in trans_der_concat)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"\\<forall>i\\<le>length(\\<pi>1@\\<pi>2). d3 i = (derivation_append d1 d2 (length \\<pi>1)) i\")\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"m+length \\<pi>1\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(rule trans_der_is_forward_target_deterministic_coincide)\n      apply(rename_tac i)(*strict*)\n      apply(force)+\n  done\n\nlemma derivationsCoincide_CropProper: \"\n  is_forward_deterministic P\n  \\<Longrightarrow> derivation P d\n  \\<Longrightarrow> belongs P d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> d 0 = Some (pair None c0)\n  \\<Longrightarrow> d n = Some (pair e cn)\n  \\<Longrightarrow> derivation P d'\n  \\<Longrightarrow> belongs P d'\n  \\<Longrightarrow> maximum_of_domain d' n'\n  \\<Longrightarrow> d' 0 = Some (pair None c0)\n  \\<Longrightarrow> d' n' = Some (pair e' cn')\n  \\<Longrightarrow> k\\<le>n\n  \\<Longrightarrow> k\\<le>n'\n  \\<Longrightarrow> derivation_take d' k = derivation_take d k\"\n  apply(subgoal_tac \"\\<exists>e c. d' k = Some (pair e c)\")\n   prefer 2\n   apply(rule some_position_has_details_before_max_dom)\n     apply(blast)\n    apply(blast)\n   apply(force)\n  apply(subgoal_tac \"\\<exists>e c. d k = Some (pair e c)\")\n   prefer 2\n   apply(rule some_position_has_details_before_max_dom)\n     apply(blast)\n    apply(blast)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac ea eaa c ca)(*strict*)\n  apply(rule derivationsCoincide)\n          apply(rename_tac ea eaa c ca)(*strict*)\n          apply(force)+\n         apply(rename_tac ea eaa c ca)(*strict*)\n         apply(rule derivation_take_preserves_derivation)\n         apply(force)+\n        apply(rename_tac ea eaa c ca)(*strict*)\n        apply(rule maximum_of_domain_derivation_take)\n        apply(force)+\n       apply(rename_tac ea eaa c ca)(*strict*)\n       apply(simp add: derivation_take_def)\n      apply(rename_tac ea eaa c ca)(*strict*)\n      apply(simp add: derivation_take_def)\n     apply(rename_tac ea eaa c ca)(*strict*)\n     apply(rule derivation_take_preserves_derivation)\n     apply(force)+\n    apply(rename_tac ea eaa c ca)(*strict*)\n    apply(rule maximum_of_domain_derivation_take)\n    apply(force)+\n   apply(rename_tac ea eaa c ca)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac ea eaa c ca)(*strict*)\n  apply(simp add: derivation_take_def)\n  done\n\nlemma derivationsCoincide_CropProperR: \"\n  is_forward_deterministic_accessible P\n  \\<Longrightarrow> derivation_initial P d\n  \\<Longrightarrow> belongs P d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> d 0 = Some (pair None c0)\n  \\<Longrightarrow> d n = Some (pair e cn)\n  \\<Longrightarrow> derivation P d'\n  \\<Longrightarrow> belongs P d'\n  \\<Longrightarrow> maximum_of_domain d' n'\n  \\<Longrightarrow> d' 0 = Some (pair None c0)\n  \\<Longrightarrow> d' n' = Some (pair e' cn')\n  \\<Longrightarrow> k\\<le>n\n  \\<Longrightarrow> k\\<le>n'\n  \\<Longrightarrow> derivation_take d' k = derivation_take d k\"\n  apply(subgoal_tac \"\\<exists>e c. d' k = Some (pair e c)\")\n   prefer 2\n   apply(rule some_position_has_details_before_max_dom)\n     apply(blast)\n    apply(blast)\n   apply(force)\n  apply(subgoal_tac \"\\<exists>e c. d k = Some (pair e c)\")\n   prefer 2\n   apply(rule some_position_has_details_before_max_dom)\n     apply(rule derivation_initial_is_derivation)\n     apply(blast)\n    apply(blast)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac ea eaa c ca)(*strict*)\n  apply(rule_tac\n      n=\"k\"\n      in derivationsCoincideR)\n          apply(rename_tac ea eaa c ca)(*strict*)\n          apply(force)\n         apply(rename_tac ea eaa c ca)(*strict*)\n         apply(rule derivation_take_preserves_derivation)\n         apply(force)\n        apply(rename_tac ea eaa c ca)(*strict*)\n        apply(rule maximum_of_domain_derivation_take)\n        apply(force)\n       apply(rename_tac ea eaa c ca)(*strict*)\n       apply(simp add: derivation_take_def)\n      apply(rename_tac ea eaa c ca)(*strict*)\n      apply(simp add: derivation_take_def)\n     apply(rename_tac ea eaa c ca)(*strict*)\n     apply(rule derivation_take_preserves_derivation_initial)\n     apply(force)+\n    apply(rename_tac ea eaa c ca)(*strict*)\n    apply(rule maximum_of_domain_derivation_take)\n    apply(force)+\n   apply(rename_tac ea eaa c ca)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac ea eaa c ca)(*strict*)\n  apply(simp add: derivation_take_def)\n  done\n\nlemma existence_of_earliest_satisfaction_point_prime: \"\n  derivation M d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> P e c\n  \\<Longrightarrow> \\<exists>k\\<le>n. (\\<forall>i<k. \\<not>(\\<lambda>n. (case d n of None \\<Rightarrow> False| Some (pair e c) \\<Rightarrow> P e c)) i) & ((\\<lambda>n. (case d n of None \\<Rightarrow> False| Some (pair e c) \\<Rightarrow> P e c)))k\"\n  apply(case_tac \"d 0\")\n   apply(rule initialNotNone_prime)\n    apply(force)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac \"P option b\")\n   apply(rename_tac option b)(*strict*)\n   apply(force)\n  apply(rename_tac option b)(*strict*)\n  apply(rule ex_least_nat_le)\n   apply(rename_tac option b)(*strict*)\n   apply(force)\n  apply(rename_tac option b)(*strict*)\n  apply(force)\n  done\n\nlemma get_accessible_configurations_closed_under_steps: \"\n  TSstructure G\n  \\<Longrightarrow> c \\<in> get_accessible_configurations G\n  \\<Longrightarrow> step_relation G c e c'\n  \\<Longrightarrow> c' \\<in> get_accessible_configurations G\"\n  apply(simp add: get_accessible_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac d i)(*strict*)\n  apply(rule_tac\n      x=\"derivation_append d (der2 c e c') i\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d i)(*strict*)\n   apply(rule derivation_append_preserves_derivation_initial)\n     apply(rename_tac d i)(*strict*)\n     apply(force)\n    apply(rename_tac d i)(*strict*)\n    apply(force)\n   apply(rename_tac d i)(*strict*)\n   apply(rule derivation_append_preserves_derivation)\n     apply(rename_tac d i)(*strict*)\n     apply(simp add: derivation_initial_def)\n    apply(rename_tac d i)(*strict*)\n    apply(rule der2_is_derivation)\n    apply(force)\n   apply(rename_tac d i)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(case_tac \"d i\")\n    apply(rename_tac d i)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d i a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac d i a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d i option)(*strict*)\n   apply(simp add: der2_def)\n  apply(rename_tac d i)(*strict*)\n  apply(rule_tac\n      x=\"Suc i\"\n      in exI)\n  apply(simp add: get_configuration_def derivation_append_def der2_def)\n  done\n\nlemma derivation_append_from_derivation_append_fit: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d1\n  \\<Longrightarrow> derivation G d2\n  \\<Longrightarrow> maximum_of_domain d1 n\n  \\<Longrightarrow> derivation_append_fit d1 d2 n\n  \\<Longrightarrow> derivation G (derivation_append d1 d2 n)\"\n  apply(rule derivation_concat2)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(simp add: derivation_append_fit_def)\n  apply(case_tac \"d1 n\")\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(case_tac \"d2 0\")\n   apply(rename_tac option b)(*strict*)\n   apply(simp add: derivation_def)\n  apply(rename_tac option b a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac option b a optiona ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b optiona ba)(*strict*)\n  apply(case_tac optiona)\n   apply(rename_tac option b optiona ba)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac option b optiona ba a)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma apply_is_forward_edge_deterministic_accessible: \"\n  TSstructure G\n  \\<Longrightarrow> is_forward_edge_deterministic_accessible G\n  \\<Longrightarrow> c \\<in> get_accessible_configurations G\n  \\<Longrightarrow> \\<exists>c1. step_relation G c e1 c1\n  \\<Longrightarrow> \\<exists>c2. step_relation G c e2 c2\n  \\<Longrightarrow> e1=e2\"\n  apply(simp add: is_forward_edge_deterministic_accessible_def)\n  apply(erule_tac\n      x=\"c\"\n      in ballE)\n   prefer 2\n   apply(force)\n  apply(clarsimp)\n  done\n\nlemma Deterministic_pre_get_accessible_configurations: \"\n  TSstructure G\n  \\<Longrightarrow> c' \\<in> get_accessible_configurations G\n  \\<Longrightarrow> step_relation G c e c'\n  \\<Longrightarrow> c' \\<notin> initial_configurations G\n  \\<Longrightarrow> (\\<forall>e' cx. step_relation G cx e' c' \\<longrightarrow> c=cx)\n  \\<Longrightarrow> c \\<in> get_accessible_configurations G\"\n  apply(unfold get_accessible_configurations_def)\n  apply(clarify)\n  apply(rename_tac d i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac d i)(*strict*)\n   apply(thin_tac \"\\<forall>e' cx. step_relation G cx e' c' \\<longrightarrow> c = cx\")\n   apply(clarsimp)\n   apply(rename_tac d)(*strict*)\n   apply(simp add: derivation_initial_def)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(case_tac \"d 0\")\n    apply(rename_tac d)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac d a option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d i nat)(*strict*)\n  apply(clarify)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(rule_tac\n      x=\"nat\"\n      in exI)\n  apply(clarify)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> d (Suc nat) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\")\n   apply(rename_tac d i nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in step_detail_before_some_position)\n     apply(rename_tac d i nat)(*strict*)\n     apply(simp add: derivation_initial_def)\n    apply(rename_tac d i nat)(*strict*)\n    apply(simp add: get_configuration_def)\n    apply(rename_tac d nat)(*strict*)\n    apply(case_tac \"d(Suc nat)\")\n     apply(rename_tac d nat)(*strict*)\n     apply(force)\n    apply(rename_tac d nat a)(*strict*)\n    apply(force)\n   apply(rename_tac d i nat)(*strict*)\n   apply(force)\n  apply(rename_tac d i nat)(*strict*)\n  apply(clarify)\n  apply(rename_tac d i nat e1 e2 c1 c2)(*strict*)\n  apply(simp add: get_configuration_def)\n  done\n\nlemma trans_der_crop: \"\n  TSstructure G\n  \\<Longrightarrow> trans_der G d c0 \\<pi> c1\n  \\<Longrightarrow> n\\<le>length \\<pi>\n  \\<Longrightarrow> d n = Some (pair e c2)\n  \\<Longrightarrow> \\<pi>' = take n \\<pi>\n  \\<Longrightarrow> trans_der G d c0 \\<pi>' c2\"\n  apply(simp add: trans_der_def)\n  apply(clarsimp)\n  apply(rename_tac ea)(*strict*)\n  apply(rule_tac\n      t=\"min (length \\<pi>) n\"\n      and s=\"n\"\n      in ssubst)\n   apply(rename_tac ea)(*strict*)\n   apply(force)\n  apply(rename_tac ea)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      m=\"length \\<pi>-n\"\n      and v=\"map Some (drop n \\<pi>)\"\n      in get_labels_drop_tail)\n   apply(rename_tac ea)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"map Some (take n \\<pi>) @ map Some (drop n \\<pi>)\"\n      and s=\"map Some (take n \\<pi> @ drop n \\<pi>)\"\n      in ssubst)\n    apply(rename_tac ea)(*strict*)\n    apply (metis List.map_append append_take_drop_id)\n   apply(rename_tac ea)(*strict*)\n   apply(rule_tac\n      t=\"take n \\<pi> @ drop n \\<pi>\"\n      and s=\"\\<pi>\"\n      in ssubst)\n    apply(rename_tac ea)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac ea)(*strict*)\n   apply (metis append_take_drop_id)\n  apply(rename_tac ea)(*strict*)\n  apply(force)\n  done\n\ndefinition single_initial_configuration :: \"'TSstructure \\<Rightarrow> bool\" where\n  \"single_initial_configuration G \\<equiv> \\<exists>c. initial_configurations G = {c}\"\n\nlemma is_forward_edge_deterministic_accessible__derivation__conincide: \"\n  is_forward_deterministic_accessible G\n  \\<Longrightarrow> derivation_initial G d1\n  \\<Longrightarrow> derivation_initial G d2\n  \\<Longrightarrow> d1 0  = d2 0\n  \\<Longrightarrow> d1 n1 \\<noteq> None\n  \\<Longrightarrow> d2 n2 \\<noteq> None\n  \\<Longrightarrow> n\\<le>n1\n  \\<Longrightarrow> n\\<le>n2\n  \\<Longrightarrow> d1 n = d2 n\"\n  apply(induct n)\n   apply(clarsimp)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      n=\"n\" and\n      d=\"d1\" and\n      m=\"n1\"\n      in step_detail_before_some_position)\n     apply(simp add: derivation_initial_def)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      n=\"n\" and\n      d=\"d2\" and\n      m=\"n2\"\n      in step_detail_before_some_position)\n     apply(simp add: derivation_initial_def)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(simp add: is_forward_edge_deterministic_accessible_def is_forward_target_deterministic_accessible_def is_forward_deterministic_accessible_def)\n  apply(clarsimp)\n  apply(erule_tac x=\"c1\" in ballE)\n   prefer 2\n   apply(simp add: get_accessible_configurations_def)\n   apply(erule_tac x=\"d1\" in allE)\n   apply(clarsimp)\n   apply(erule_tac x=\"n\" in allE)\n   apply(simp add: get_configuration_def)\n  apply(erule_tac x=\"c1\" in ballE)\n   prefer 2\n   apply(simp add: get_accessible_configurations_def)\n   apply(erule_tac x=\"d1\" in allE)\n   apply(clarsimp)\n   apply(erule_tac x=\"n\" in allE)\n   apply(simp add: get_configuration_def)\n  apply(clarsimp)\n  apply(force)\n  done\n\nend\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_06_01/L_ATS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.34578793835137156}}
{"text": "(*  Title:       BinaryFunctor\n    Author:      Eugene W. Stark <stark@cs.stonybrook.edu>, 2016\n    Maintainer:  Eugene W. Stark <stark@cs.stonybrook.edu>\n*)\n\nchapter BinaryFunctor\n\ntheory BinaryFunctor\nimports ProductCategory NaturalTransformation\nbegin\n\n  text\\<open>\n    This theory develops various properties of binary functors, which are functors\n    defined on product categories.\n\\<close>\n\n  locale binary_functor =\n    A1: category A1 +\n    A2: category A2 +\n    B: category B +\n    A1xA2: product_category A1 A2 +\n    \"functor\" A1xA2.comp B F\n  for A1 :: \"'a1 comp\"     (infixr \"\\<cdot>\\<^sub>A\\<^sub>1\" 55)\n  and A2 :: \"'a2 comp\"     (infixr \"\\<cdot>\\<^sub>A\\<^sub>2\" 55)\n  and B :: \"'b comp\"       (infixr \"\\<cdot>\\<^sub>B\" 55)\n  and F :: \"'a1 * 'a2 \\<Rightarrow> 'b\"\n  begin\n\n    notation A1.in_hom     (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>A\\<^sub>1 _\\<guillemotright>\")\n    notation A2.in_hom     (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>A\\<^sub>2 _\\<guillemotright>\")\n\n  end\n\n  text\\<open>\n    A product functor is a binary functor obtained by placing two functors in parallel.\n\\<close>\n\n  locale product_functor =\n    A1: category A1 +\n    A2: category A2 +\n    B1: category B1 +\n    B2: category B2 +\n    F1: \"functor\" A1 B1 F1 +\n    F2: \"functor\" A2 B2 F2 +\n    A1xA2: product_category A1 A2 +\n    B1xB2: product_category B1 B2\n  for A1 :: \"'a1 comp\"     (infixr \"\\<cdot>\\<^sub>A\\<^sub>1\" 55)\n  and A2 :: \"'a2 comp\"     (infixr \"\\<cdot>\\<^sub>A\\<^sub>2\" 55)\n  and B1 :: \"'b1 comp\"     (infixr \"\\<cdot>\\<^sub>B\\<^sub>1\" 55)\n  and B2 :: \"'b2 comp\"     (infixr \"\\<cdot>\\<^sub>B\\<^sub>2\" 55)\n  and F1 :: \"'a1 \\<Rightarrow> 'b1\"\n  and F2 :: \"'a2 \\<Rightarrow> 'b2\"\n  begin\n\n    notation A1xA2.comp    (infixr \"\\<cdot>\\<^sub>A\\<^sub>1\\<^sub>x\\<^sub>A\\<^sub>2\" 55)\n    notation B1xB2.comp    (infixr \"\\<cdot>\\<^sub>B\\<^sub>1\\<^sub>x\\<^sub>B\\<^sub>2\" 55)\n    notation A1.in_hom     (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>A\\<^sub>1 _\\<guillemotright>\")\n    notation A2.in_hom     (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>A\\<^sub>2 _\\<guillemotright>\")\n    notation B1.in_hom     (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>B\\<^sub>1 _\\<guillemotright>\")\n    notation B2.in_hom     (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>B\\<^sub>2 _\\<guillemotright>\")\n    notation A1xA2.in_hom  (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>A\\<^sub>1\\<^sub>x\\<^sub>A\\<^sub>2 _\\<guillemotright>\")\n    notation B1xB2.in_hom  (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>B\\<^sub>1\\<^sub>x\\<^sub>B\\<^sub>2 _\\<guillemotright>\")\n\n    definition map\n    where \"map f = (if A1.arr (fst f) \\<and> A2.arr (snd f)\n                    then (F1 (fst f), F2 (snd f)) else B1xB2.null)\"\n\n    lemma map_simp [simp]:\n    assumes \"A1xA2.arr f\"\n    shows \"map f = (F1 (fst f), F2 (snd f))\"\n      using assms map_def by simp\n\n    lemma is_functor:\n    shows \"functor A1xA2.comp B1xB2.comp map\"\n      using B1xB2.dom_char B1xB2.cod_char\n      apply (unfold_locales)\n      using map_def A1.arr_dom_iff_arr A1.arr_cod_iff_arr A2.arr_dom_iff_arr A2.arr_cod_iff_arr\n          apply auto[4]\n      using A1xA2.seqE map_simp by fastforce\n\n  end\n\n  sublocale product_functor \\<subseteq> \"functor\" A1xA2.comp B1xB2.comp map\n    using is_functor by auto\n  sublocale product_functor \\<subseteq> binary_functor A1 A2 B1xB2.comp map ..\n\n  text\\<open>\n    A symmetry functor is a binary functor that exchanges its two arguments.\n\\<close>\n\n  locale symmetry_functor =\n  A1: category A1 +\n  A2: category A2 +\n  A1xA2: product_category A1 A2 +\n  A2xA1: product_category A2 A1\n  for A1 :: \"'a1 comp\"     (infixr \"\\<cdot>\\<^sub>A\\<^sub>1\" 55)\n  and A2 :: \"'a2 comp\"     (infixr \"\\<cdot>\\<^sub>A\\<^sub>2\" 55)\n  begin\n\n    notation A1xA2.comp    (infixr \"\\<cdot>\\<^sub>A\\<^sub>1\\<^sub>x\\<^sub>A\\<^sub>2\" 55)\n    notation A2xA1.comp    (infixr \"\\<cdot>\\<^sub>A\\<^sub>2\\<^sub>x\\<^sub>A\\<^sub>1\" 55)\n    notation A1xA2.in_hom  (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>A\\<^sub>1\\<^sub>x\\<^sub>A\\<^sub>2 _\\<guillemotright>\")\n    notation A2xA1.in_hom  (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>A\\<^sub>2\\<^sub>x\\<^sub>A\\<^sub>1 _\\<guillemotright>\")\n\n    definition map :: \"'a1 * 'a2 \\<Rightarrow> 'a2 * 'a1\"\n    where \"map f = (if A1xA2.arr f then (snd f, fst f) else A2xA1.null)\"\n\n    lemma map_simp [simp]:\n    assumes \"A1xA2.arr f\"\n    shows \"map f = (snd f, fst f)\"\n      using assms map_def by meson\n\n    lemma is_functor:\n    shows \"functor A1xA2.comp A2xA1.comp map\"\n      using map_def A1.arr_dom_iff_arr A1.arr_cod_iff_arr A2.arr_dom_iff_arr A2.arr_cod_iff_arr\n      apply (unfold_locales)\n          apply auto[4]\n      by force\n\n  end\n\n  sublocale symmetry_functor \\<subseteq> \"functor\" A1xA2.comp A2xA1.comp map\n    using is_functor by auto\n  sublocale symmetry_functor \\<subseteq> binary_functor A1 A2 A2xA1.comp map ..\n\n  context binary_functor\n  begin\n\n    abbreviation sym\n    where \"sym \\<equiv> (\\<lambda>f. F (snd f, fst f))\"\n\n    lemma sym_is_binary_functor:\n    shows \"binary_functor A2 A1 B sym\"\n    proof -\n      interpret A2xA1: product_category A2 A1 ..\n      interpret S: symmetry_functor A2 A1 ..\n      interpret SF: composite_functor A2xA1.comp A1xA2.comp B S.map F ..\n      have \"binary_functor A2 A1 B (F o S.map)\" ..\n      moreover have \"F o S.map = (\\<lambda>f. F (snd f, fst f))\"\n        using is_extensional SF.is_extensional S.map_def by fastforce\n      ultimately show ?thesis using sym_def by auto\n    qed\n\n    text\\<open>\n      Fixing one or the other argument of a binary functor to be an identity\n      yields a functor of the other argument.\n\\<close>\n\n    lemma fixing_ide_gives_functor_1:\n    assumes \"A1.ide a1\"\n    shows \"functor A2 B (\\<lambda>f2. F (a1, f2))\"\n      using assms\n      apply unfold_locales\n      using is_extensional\n          apply auto[4]\n      by (metis A1.ideD(1) A1.comp_ide_self A1xA2.comp_simp A1xA2.seq_char fst_conv\n          preserves_comp_2 snd_conv)\n\n    lemma fixing_ide_gives_functor_2:\n    assumes \"A2.ide a2\"\n    shows \"functor A1 B (\\<lambda>f1. F (f1, a2))\"\n      using assms\n      apply (unfold_locales)\n      using is_extensional\n          apply auto[4]\n      by (metis A1xA2.comp_simp A1xA2.seq_char A2.ideD(1) A2.comp_ide_self fst_conv\n          preserves_comp_2 snd_conv)\n\n    text\\<open>\n      Fixing one or the other argument of a binary functor to be an arrow\n      yields a natural transformation.\n\\<close>\n\n    lemma fixing_arr_gives_natural_transformation_1:\n    assumes \"A1.arr f1\"\n    shows \"natural_transformation A2 B (\\<lambda>f2. F (A1.dom f1, f2)) (\\<lambda>f2. F (A1.cod f1, f2))\n                                       (\\<lambda>f2. F (f1, f2))\"\n    proof -\n      let ?Fdom = \"\\<lambda>f2. F (A1.dom f1, f2)\"\n      interpret Fdom: \"functor\" A2 B ?Fdom using assms fixing_ide_gives_functor_1 by auto\n      let ?Fcod = \"\\<lambda>f2. F (A1.cod f1, f2)\"\n      interpret Fcod: \"functor\" A2 B ?Fcod using assms fixing_ide_gives_functor_1 by auto\n      let ?\\<tau> = \"\\<lambda>f2. F (f1, f2)\"\n      show \"natural_transformation A2 B ?Fdom ?Fcod ?\\<tau>\"\n        using assms\n        apply unfold_locales\n        using is_extensional\n            apply auto[3]\n        using A1xA2.arr_char preserves_comp A1.comp_cod_arr A1xA2.comp_char A2.comp_arr_dom\n         apply (metis fst_conv snd_conv)\n        using A1xA2.arr_char preserves_comp A2.comp_cod_arr A1xA2.comp_char A1.comp_arr_dom\n        by (metis fst_conv snd_conv)\n    qed\n\n    lemma fixing_arr_gives_natural_transformation_2:\n    assumes \"A2.arr f2\"\n    shows \"natural_transformation A1 B (\\<lambda>f1. F (f1, A2.dom f2)) (\\<lambda>f1. F (f1, A2.cod f2))\n                                       (\\<lambda>f1. F (f1, f2))\"\n    proof -\n      interpret F': binary_functor A2 A1 B sym\n        using assms(1) sym_is_binary_functor by auto\n      have \"natural_transformation A1 B (\\<lambda>f1. sym (A2.dom f2, f1)) (\\<lambda>f1. sym (A2.cod f2, f1))\n                                        (\\<lambda>f1. sym (f2, f1))\"\n        using assms F'.fixing_arr_gives_natural_transformation_1 by fast\n      thus ?thesis by simp\n    qed\n\n    text\\<open>\n      Fixing one or the other argument of a binary functor to be a composite arrow\n      yields a natural transformation that is a vertical composite.\n\\<close>\n\n    lemma preserves_comp_1:\n    assumes \"A1.seq f1' f1\"\n    shows \"(\\<lambda>f2. F (f1' \\<cdot>\\<^sub>A\\<^sub>1 f1, f2)) =\n                 vertical_composite.map A2 B (\\<lambda>f2. F (f1, f2)) (\\<lambda>f2. F (f1', f2))\"\n    proof -\n      interpret \\<tau>: natural_transformation A2 B \\<open>\\<lambda>f2. F (A1.dom f1, f2)\\<close> \\<open>\\<lambda>f2. F (A1.cod f1, f2)\\<close>\n                                               \\<open>\\<lambda>f2. F (f1, f2)\\<close>\n        using assms fixing_arr_gives_natural_transformation_1 by blast\n      interpret \\<tau>': natural_transformation A2 B \\<open>\\<lambda>f2. F (A1.cod f1, f2)\\<close> \\<open>\\<lambda>f2. F (A1.cod f1', f2)\\<close>\n                                                \\<open>\\<lambda>f2. F (f1', f2)\\<close>\n        using assms fixing_arr_gives_natural_transformation_1 A1.seqE by metis\n      interpret \\<tau>'o\\<tau>: vertical_composite A2 B\n                        \\<open>\\<lambda>f2. F (A1.dom f1, f2)\\<close> \\<open>\\<lambda>f2. F (A1.cod f1, f2)\\<close> \\<open>\\<lambda>f2. F (A1.cod f1', f2)\\<close>\n                        \\<open>\\<lambda>f2. F (f1, f2)\\<close> \\<open>\\<lambda>f2. F (f1', f2)\\<close> ..\n      show \"(\\<lambda>f2. F (f1' \\<cdot>\\<^sub>A\\<^sub>1 f1, f2)) = \\<tau>'o\\<tau>.map\"\n      proof\n        fix f2\n        have \"\\<not>A2.arr f2 \\<Longrightarrow> F (f1' \\<cdot>\\<^sub>A\\<^sub>1 f1, f2) = \\<tau>'o\\<tau>.map f2\"\n          using \\<tau>'o\\<tau>.is_extensional is_extensional by simp\n        moreover have \"A2.arr f2 \\<Longrightarrow> F (f1' \\<cdot>\\<^sub>A\\<^sub>1 f1, f2) = \\<tau>'o\\<tau>.map f2\"\n        proof -\n          assume f2: \"A2.arr f2\"\n          have \"F (f1' \\<cdot>\\<^sub>A\\<^sub>1 f1, f2) = B (F (f1', f2)) (F (f1, A2.dom f2))\"\n            using assms f2 preserves_comp A1xA2.arr_char A1xA2.comp_char A2.comp_arr_dom\n            by (metis fst_conv snd_conv)\n          also have \"... = \\<tau>'o\\<tau>.map f2\"\n            using f2 \\<tau>'o\\<tau>.map_simp_2 by simp\n          finally show \"F (f1' \\<cdot>\\<^sub>A\\<^sub>1 f1, f2) = \\<tau>'o\\<tau>.map f2\" by auto\n        qed\n        ultimately show \"F (f1' \\<cdot>\\<^sub>A\\<^sub>1 f1, f2) = \\<tau>'o\\<tau>.map f2\" by blast\n      qed\n    qed\n\n    lemma preserves_comp_2:\n    assumes \"A2.seq f2' f2\"\n    shows \"(\\<lambda>f1. F (f1, f2' \\<cdot>\\<^sub>A\\<^sub>2 f2)) =\n                 vertical_composite.map A1 B (\\<lambda>f1. F (f1, f2)) (\\<lambda>f1. F (f1, f2'))\"\n    proof -\n      interpret F': binary_functor A2 A1 B sym\n        using assms(1) sym_is_binary_functor by auto\n      have \"(\\<lambda>f1. sym (f2' \\<cdot>\\<^sub>A\\<^sub>2 f2, f1)) =\n                 vertical_composite.map A1 B (\\<lambda>f1. sym (f2, f1)) (\\<lambda>f1. sym (f2', f1))\"\n        using assms F'.preserves_comp_1 by fastforce\n      thus ?thesis by simp\n    qed\n\n  end\n\n  text\\<open>\n    A binary functor transformation is a natural transformation between binary functors.\n    We need a certain property of such transformations; namely, that if one or the\n    other argument is fixed to be an identity, the result is a natural transformation.\n\\<close>\n\n  locale binary_functor_transformation =\n    A1: category A1 +\n    A2: category A2 +\n    B: category B +\n    A1xA2: product_category A1 A2 +\n    F: binary_functor A1 A2 B F +\n    G: binary_functor A1 A2 B G +\n    natural_transformation A1xA2.comp B F G \\<tau>\n  for A1 :: \"'a1 comp\"     (infixr \"\\<cdot>\\<^sub>A\\<^sub>1\" 55)\n  and A2 :: \"'a2 comp\"     (infixr \"\\<cdot>\\<^sub>A\\<^sub>2\" 55)\n  and B :: \"'b comp\"       (infixr \"\\<cdot>\\<^sub>B\" 55)\n  and F :: \"'a1 * 'a2 \\<Rightarrow> 'b\"\n  and G :: \"'a1 * 'a2 \\<Rightarrow> 'b\"\n  and \\<tau> :: \"'a1 * 'a2 \\<Rightarrow> 'b\"\n  begin\n\n    notation A1xA2.comp    (infixr \"\\<cdot>\\<^sub>A\\<^sub>1\\<^sub>x\\<^sub>A\\<^sub>2\" 55)\n    notation A1xA2.in_hom  (\"\\<guillemotleft>_ : _ \\<rightarrow>\\<^sub>A\\<^sub>1\\<^sub>x\\<^sub>A\\<^sub>2 _\\<guillemotright>\")\n\n    lemma fixing_ide_gives_natural_transformation_1:\n    assumes \"A1.ide a1\"\n    shows \"natural_transformation A2 B (\\<lambda>f2. F (a1, f2)) (\\<lambda>f2. G (a1, f2)) (\\<lambda>f2. \\<tau> (a1, f2))\"\n    proof -\n      interpret Fa1: \"functor\" A2 B \\<open>\\<lambda>f2. F (a1, f2)\\<close>\n        using assms F.fixing_ide_gives_functor_1 by simp\n      interpret Ga1: \"functor\" A2 B \\<open>\\<lambda>f2. G (a1, f2)\\<close>\n        using assms \"G.fixing_ide_gives_functor_1\" by simp\n      show ?thesis\n        using assms is_extensional is_natural_1 is_natural_2\n        apply (unfold_locales, auto)\n         apply (metis A1.ide_char)\n        by (metis A1.ide_char)\n    qed\n\n    lemma fixing_ide_gives_natural_transformation_2:\n    assumes \"A2.ide a2\"\n    shows \"natural_transformation A1 B (\\<lambda>f1. F (f1, a2)) (\\<lambda>f1. G (f1, a2)) (\\<lambda>f1. \\<tau> (f1, a2))\"\n    proof -\n      interpret Fa2: \"functor\" A1 B \\<open>\\<lambda>f1. F (f1, a2)\\<close>\n        using assms F.fixing_ide_gives_functor_2 by simp\n      interpret Ga2: \"functor\" A1 B \\<open>\\<lambda>f1. G (f1, a2)\\<close>\n        using assms \"G.fixing_ide_gives_functor_2\" by simp\n      show ?thesis\n        using assms is_extensional is_natural_1 is_natural_2\n        apply (unfold_locales, auto)\n         apply (metis A2.ide_char)\n        by (metis A2.ide_char)\n    qed\n\n  end\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Category3/BinaryFunctor.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.34578793835137156}}
{"text": "(*  Title:       ONode_Lifting.thy\n    License:     BSD 2-Clause. See LICENSE.\n    Author:      Timothy Bourke\n*)\n\nheader \"Lifting rules for (open) nodes\"\n\ntheory ONode_Lifting\nimports AWN OAWN_SOS OInvariants\nbegin\n\nlemma node_net_state':\n  assumes \"s \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n    shows \"\\<exists>\\<sigma> \\<zeta> R. s = (\\<sigma>, NodeS i \\<zeta> R)\"\n  using assms proof induction\n    fix s\n    assume \"s \\<in> init (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n    then obtain \\<sigma> \\<zeta> where \"s = (\\<sigma>, NodeS i \\<zeta> R\\<^sub>i)\"\n      by (auto simp: onode_comps)\n    thus \"\\<exists>\\<sigma> \\<zeta> R. s = (\\<sigma>, NodeS i \\<zeta> R)\" by auto\n  next\n    fix s a \\<sigma>'\n    assume rt: \"s \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and ih: \"\\<exists>\\<sigma> \\<zeta> R. s = (\\<sigma>, NodeS i \\<zeta> R)\"\n       and \"U (fst s) \\<sigma>'\"\n    then obtain \\<sigma> \\<zeta> R\n      where \"(\\<sigma>, NodeS i \\<zeta> R)  \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n        and \"U \\<sigma> \\<sigma>'\" and \"snd s = NodeS i \\<zeta> R\" by auto\n    from this(1-2)\n      have \"(\\<sigma>', NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n        by - (erule(1) oreachable_other')\n    with \\<open>snd s = NodeS i \\<zeta> R\\<close> show \"\\<exists>\\<sigma> \\<zeta> R. (\\<sigma>', snd s) = (\\<sigma>, NodeS i \\<zeta> R)\" by simp\n  next\n    fix s a s'\n    assume rt: \"s \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and ih: \"\\<exists>\\<sigma> \\<zeta> R. s = (\\<sigma>, NodeS i \\<zeta> R)\"\n       and tr: \"(s, a, s') \\<in> trans (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"S (fst s) (fst s') a\"\n     from ih obtain \\<sigma> \\<zeta> R where \"s = (\\<sigma>, NodeS i \\<zeta> R)\" by auto\n     with tr have \"((\\<sigma>, NodeS i \\<zeta> R), a, s') \\<in> onode_sos (trans T)\"\n       by (simp add: onode_comps)\n     then obtain \\<sigma>' \\<zeta>' R' where \"s' = (\\<sigma>', NodeS i \\<zeta>' R')\"\n       using onode_sos_dest_is_net_state' by metis\n     with tr \\<open>s = (\\<sigma>, NodeS i \\<zeta> R)\\<close> show \"\\<exists>\\<sigma> \\<zeta> R. s' = (\\<sigma>, NodeS i \\<zeta> R)\"\n       by simp\n  qed\n\nlemma node_net_state:\n  assumes \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n    shows \"\\<exists>\\<zeta> R. s = NodeS i \\<zeta> R\"\n  using assms\n  by (metis Pair_inject node_net_state')\n\nlemma node_net_state_trans [elim]:\n  assumes sor: \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      and str: \"((\\<sigma>, s), a, (\\<sigma>', s')) \\<in> trans (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n  obtains \\<zeta> R \\<zeta>' R'\n    where \"s = NodeS i \\<zeta> R\"\n      and \"s' = NodeS i \\<zeta>' R'\"\n  proof -\n    assume *: \"\\<And>\\<zeta> R \\<zeta>' R'. s = NodeS i \\<zeta> R \\<Longrightarrow> s' = NodeS i \\<zeta>' R' \\<Longrightarrow> thesis\"\n    from sor obtain \\<zeta> R where \"s = NodeS i \\<zeta> R\"\n      by (metis node_net_state)\n    moreover with str obtain \\<zeta>' R' where \"s' = NodeS i \\<zeta>' R'\"\n      by (simp only: onode_comps)\n         (metis onode_sos_dest_is_net_state'')\n    ultimately show thesis by (rule *)\n  qed\n\nlemma nodemap_induct' [consumes, case_names init other local]:\n  assumes \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      and init: \"\\<And>\\<sigma> \\<zeta>. (\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i) \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) \\<Longrightarrow> P (\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i)\"\n      and other: \"\\<And>\\<sigma> \\<zeta> R \\<sigma>' a.\n                  \\<lbrakk> (\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U;\n                    U \\<sigma> \\<sigma>'; P (\\<sigma>, NodeS ii \\<zeta> R) \\<rbrakk> \\<Longrightarrow> P (\\<sigma>', NodeS ii \\<zeta> R)\"\n      and local: \"\\<And>\\<sigma> \\<zeta> R \\<sigma>' \\<zeta>' R' a.\n                  \\<lbrakk> (\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U;\n                    ((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o);\n                    S \\<sigma> \\<sigma>' a; P (\\<sigma>, NodeS ii \\<zeta> R) \\<rbrakk> \\<Longrightarrow> P (\\<sigma>', NodeS ii \\<zeta>' R')\"\n    shows \"P (\\<sigma>, NodeS ii \\<zeta> R)\"\n  using assms(1) proof induction\n    fix s\n    assume \"s \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n    hence \"s \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      by (rule oreachable_init)\n    with \\<open>s \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\\<close> obtain \\<sigma> \\<zeta> where \"s = (\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i)\"\n      using node_net_state by (simp add: onode_comps) metis\n    with \\<open>s \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\\<close> and init show \"P s\" by simp\n  next\n    fix s a \\<sigma>'\n    assume sr: \"s \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and \"U (fst s) \\<sigma>'\"\n       and \"P s\"\n    from sr obtain \\<sigma> \\<zeta> R where \"s = (\\<sigma>, NodeS ii \\<zeta> R)\"\n      using node_net_state' by metis\n    with sr \\<open>U (fst s) \\<sigma>'\\<close> \\<open>P s\\<close> show \"P (\\<sigma>', snd s)\"\n    by simp (metis other)\n  next\n    fix s a s'\n    assume sr: \"s \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and tr: \"(s, a, s') \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"S (fst s) (fst s') a\"\n       and \"P s\"\n    from this(1-3) have \"s' \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      by - (erule(2) oreachable_local)\n    then obtain \\<sigma>' \\<zeta>' R' where [simp]: \"s' = (\\<sigma>', NodeS ii \\<zeta>' R')\"\n      using node_net_state' by metis\n    from sr and \\<open>P s\\<close> obtain \\<sigma> \\<zeta> R\n      where [simp]: \"s = (\\<sigma>, NodeS ii \\<zeta> R)\"\n        and A1: \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n        and A4: \"P (\\<sigma>, NodeS ii \\<zeta> R)\"\n      using node_net_state' by metis\n    with tr and \\<open>S (fst s) (fst s') a\\<close>\n      have A2: \"((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and A3: \"S \\<sigma> \\<sigma>' a\" by simp_all\n    from A1 A2 A3 A4 have \"P (\\<sigma>', NodeS ii \\<zeta>' R')\" by (rule local)\n    thus \"P s'\" by simp\n  qed\n\nlemma nodemap_induct [consumes, case_names init step]:\n  assumes \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      and init: \"\\<And>\\<sigma> \\<zeta>. (\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i) \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) \\<Longrightarrow> P \\<sigma> \\<zeta> R\\<^sub>i\"\n      and other: \"\\<And>\\<sigma> \\<zeta> R \\<sigma>' a.\n                  \\<lbrakk> (\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U;\n                    U \\<sigma> \\<sigma>'; P \\<sigma> \\<zeta> R \\<rbrakk> \\<Longrightarrow> P \\<sigma>' \\<zeta> R\"\n      and local: \"\\<And>\\<sigma> \\<zeta> R \\<sigma>' \\<zeta>' R' a.\n                  \\<lbrakk> (\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U;\n                    ((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o);\n                    S \\<sigma> \\<sigma>' a; P \\<sigma> \\<zeta> R \\<rbrakk> \\<Longrightarrow> P \\<sigma>' \\<zeta>' R'\"\n    shows \"P \\<sigma> \\<zeta> R\"\n  using assms(1) proof (induction \"(\\<sigma>, NodeS ii \\<zeta> R)\" arbitrary: \\<sigma> \\<zeta> R)\n    fix \\<sigma> \\<zeta> R\n    assume a1: \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n    hence \"R = R\\<^sub>i\" by (simp add: init_onode_comp)\n    with a1 have \"(\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i) \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\" by simp\n    with init and \\<open>R = R\\<^sub>i\\<close> show \"P \\<sigma> \\<zeta> R\" by simp\n  next\n    fix st a \\<sigma>' \\<zeta>' R'\n    assume \"st \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and tr: \"(st, a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"S (fst st) (fst (\\<sigma>', NodeS ii \\<zeta>' R')) a\"\n       and IH: \"\\<And>\\<sigma> \\<zeta> R. st = (\\<sigma>, NodeS ii \\<zeta> R) \\<Longrightarrow> P \\<sigma> \\<zeta> R\"\n    from this(1) obtain \\<sigma> \\<zeta> R where \"st = (\\<sigma>, NodeS ii \\<zeta> R)\"\n                                and \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      by (metis node_net_state')\n    note this(2)\n    moreover from tr and \\<open>st = (\\<sigma>, NodeS ii \\<zeta> R)\\<close>\n      have \"((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\" by simp\n    moreover from \\<open>S (fst st) (fst (\\<sigma>', NodeS ii \\<zeta>' R')) a\\<close> and \\<open>st = (\\<sigma>, NodeS ii \\<zeta> R)\\<close>\n      have \"S \\<sigma> \\<sigma>' a\" by simp\n    moreover from IH and \\<open>st = (\\<sigma>, NodeS ii \\<zeta> R)\\<close> have \"P \\<sigma> \\<zeta> R\" .\n    ultimately show \"P \\<sigma>' \\<zeta>' R'\" by (rule local)\n  next\n    fix st \\<sigma>' \\<zeta> R\n    assume \"st \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and \"U (fst st) \\<sigma>'\"\n       and \"snd st = NodeS ii \\<zeta> R\"\n       and IH: \"\\<And>\\<sigma> \\<zeta> R. st = (\\<sigma>, NodeS ii \\<zeta> R) \\<Longrightarrow> P \\<sigma> \\<zeta> R\"\n    from this(1,3) obtain \\<sigma> where \"st = (\\<sigma>, NodeS ii \\<zeta> R)\"\n                              and \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      by (metis surjective_pairing)\n    note this(2)\n    moreover from \\<open>U (fst st) \\<sigma>'\\<close> and \\<open>st = (\\<sigma>, NodeS ii \\<zeta> R)\\<close> have \"U \\<sigma> \\<sigma>'\" by simp\n    moreover from IH and \\<open>st = (\\<sigma>, NodeS ii \\<zeta> R)\\<close> have \"P \\<sigma> \\<zeta> R\" .\n    ultimately show \"P \\<sigma>' \\<zeta> R\" by (rule other)\n  qed\n\nlemma node_addressD [dest, simp]:\n  assumes \"(\\<sigma>, NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n    shows \"i = ii\"\n  using assms by (clarsimp dest!: node_net_state')\n\nlemma node_proc_reachable [dest]:\n  assumes \"(\\<sigma>, NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\n                                         (otherwith S {ii} (oarrivemsg I)) (other U {ii})\"\n      and sgivesu: \"\\<And>\\<xi> \\<xi>'. S \\<xi> \\<xi>' \\<Longrightarrow> U \\<xi> \\<xi>'\"\n    shows \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n  proof -\n    from assms(1) have \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\n                                             (otherwith S {ii} (oarrivemsg I)) (other U {ii})\"\n      by - (frule node_addressD, simp)\n    thus ?thesis\n    proof (induction rule: nodemap_induct)\n      fix \\<sigma> \\<zeta>\n      assume \"(\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i) \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n      hence \"(\\<sigma>, \\<zeta>) \\<in> init T\" by (auto simp: onode_comps)\n      thus \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n        by (rule oreachable_init)\n    next\n      fix \\<sigma> \\<zeta> R \\<sigma>' \\<zeta>' R' a\n      assume \"other U {ii} \\<sigma> \\<sigma>'\"\n         and \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n      thus \"(\\<sigma>', \\<zeta>) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n        by - (rule oreachable_other')\n    next\n      fix \\<sigma> \\<zeta> R \\<sigma>' \\<zeta>' R' a\n      assume rs: \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\n                                         (otherwith S {ii} (oarrivemsg I)) (other U {ii})\"\n         and tr: \"((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n         and ow: \"otherwith S {ii} (oarrivemsg I) \\<sigma> \\<sigma>' a\"\n         and ih: \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n\n      from ow have *: \"\\<sigma>' ii = \\<sigma> ii \\<Longrightarrow> other U {ii} \\<sigma> \\<sigma>'\"\n        by (clarsimp elim!: otherwithE) (rule otherI, simp_all, metis sgivesu)\n      from tr have \"((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> onode_sos (trans T)\"\n        by (simp add: onode_comps)\n      thus \"(\\<sigma>', \\<zeta>') \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n      proof cases\n        case onode_bcast\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_gcast\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_ucast\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_notucast\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_deliver\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_tau\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_receive\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case (onode_arrive m)\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_connect1\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_connect2\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_connect_other\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_disconnect1\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_disconnect2\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_disconnect_other\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      qed\n    qed\n  qed\n\nlemma node_proc_reachable_statelessassm [dest]:\n  assumes \"(\\<sigma>, NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\n                                         (otherwith (\\<lambda>_ _. True) {ii} (oarrivemsg I))\n                                         (other (\\<lambda>_ _. True) {ii})\"\n    shows \"(\\<sigma>, \\<zeta>) \\<in> oreachable T\n                               (otherwith (\\<lambda>_ _. True) {ii} (orecvmsg I)) (other (\\<lambda>_ _. True) {ii})\"\n  using assms\n  by (rule node_proc_reachable) simp_all\n\nlemma node_lift:\n  assumes \"T \\<Turnstile> (otherwith S {ii} (orecvmsg I), other U {ii} \\<rightarrow>) global P\"\n      and \"\\<And>\\<xi> \\<xi>'. S \\<xi> \\<xi>' \\<Longrightarrow> U \\<xi> \\<xi>'\"\n    shows \"\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile> (otherwith S {ii} (oarrivemsg I), other U {ii} \\<rightarrow>) global P\"\n  proof (rule oinvariant_oreachableI)\n    fix \\<sigma> \\<zeta>\n    assume \"(\\<sigma>, \\<zeta>) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) (otherwith S {ii} (oarrivemsg I)) (other U {ii})\"\n    moreover then obtain i s R where \"\\<zeta> = NodeS i s R\"\n      by (metis node_net_state)\n    ultimately have \"(\\<sigma>, NodeS i s R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\n                                                   (otherwith S {ii} (oarrivemsg I)) (other U {ii})\"\n      by simp\n    hence \"(\\<sigma>, s) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n      by - (erule node_proc_reachable, erule assms(2))\n    with assms(1) show \"global P (\\<sigma>, \\<zeta>)\"\n      by (metis fst_conv globalsimp oinvariantD)\n  qed\n\nlemma node_lift_step [intro]:\n  assumes pinv: \"T \\<Turnstile>\\<^sub>A (otherwith S {i} (orecvmsg I), other U {i} \\<rightarrow>) globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q \\<sigma> \\<sigma>')\"\n      and other: \"\\<And>\\<sigma> \\<sigma>'. other U {i} \\<sigma> \\<sigma>' \\<Longrightarrow> Q \\<sigma> \\<sigma>'\"\n      and sgivesu: \"\\<And>\\<xi> \\<xi>'. S \\<xi> \\<xi>' \\<Longrightarrow> U \\<xi> \\<xi>'\"\n    shows \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (otherwith S {i} (oarrivemsg I), other U {i} \\<rightarrow>)\n                            globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q \\<sigma> \\<sigma>')\"\n    (is \"_ \\<Turnstile>\\<^sub>A (?S, ?U \\<rightarrow>) _\")\n  proof (rule ostep_invariantI, simp)\n    fix \\<sigma> s a \\<sigma>' s'\n    assume rs: \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) ?S ?U\"\n       and tr: \"((\\<sigma>, s), a, (\\<sigma>', s')) \\<in> trans (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and ow: \"?S \\<sigma> \\<sigma>' a\"\n    from ow have *: \"\\<sigma>' i = \\<sigma> i \\<Longrightarrow> other U {i} \\<sigma> \\<sigma>'\"\n      by (clarsimp elim!: otherwithE) (rule otherI, simp_all, metis sgivesu)\n    from rs tr obtain \\<zeta> R\n      where [simp]: \"s = NodeS i \\<zeta> R\"\n        and \"(\\<sigma>, NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) ?S ?U\"\n      by (metis node_net_state)\n    from this(2) have or: \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {i} (orecvmsg I)) ?U\"\n      by (rule node_proc_reachable [OF _ assms(3)])\n    from tr have \"((\\<sigma>, NodeS i \\<zeta> R), a, (\\<sigma>', s')) \\<in> onode_sos (trans T)\"\n      by (simp add: onode_comps)\n    thus \"Q \\<sigma> \\<sigma>'\"\n    proof cases\n      fix m \\<zeta>'\n      assume \"a = R:*cast(m)\"\n         and tr': \"((\\<sigma>, \\<zeta>), broadcast m, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (broadcast m)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix D m \\<zeta>'\n      assume \"a = (R \\<inter> D):*cast(m)\"\n         and tr': \"((\\<sigma>, \\<zeta>), groupcast D m, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (groupcast D m)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix d m \\<zeta>'\n      assume \"a = {d}:*cast(m)\"\n         and tr': \"((\\<sigma>, \\<zeta>), unicast d m, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (unicast d m)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix d \\<zeta>'\n      assume \"a = \\<tau>\"\n         and tr': \"((\\<sigma>, \\<zeta>), \\<not>unicast d, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (\\<not>unicast d)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix d \\<zeta>'\n      assume \"a = i:deliver(d)\"\n         and tr': \"((\\<sigma>, \\<zeta>), deliver d, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (deliver d)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix \\<zeta>'\n      assume \"a = \\<tau>\"\n         and tr': \"((\\<sigma>, \\<zeta>), \\<tau>, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' \\<tau>\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix m \\<zeta>'\n      assume \"a = {i}\\<not>{}:arrive(m)\"\n         and tr': \"((\\<sigma>, \\<zeta>), receive m, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (receive m)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix m\n      assume \"a = {}\\<not>{i}:arrive(m)\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i'\n      assume \"a = connect(i, i')\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i'\n      assume \"a = connect(i', i)\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i' i''\n      assume \"a = connect(i', i'')\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i'\n      assume \"a = disconnect(i, i')\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i'\n      assume \"a = disconnect(i', i)\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i' i''\n      assume \"a = disconnect(i', i'')\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    qed\n  qed\n\nlemma node_lift_step_statelessassm [intro]:\n  assumes \"T \\<Turnstile>\\<^sub>A (\\<lambda>\\<sigma> _. orecvmsg I \\<sigma>, other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                       globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q (\\<sigma> i) (\\<sigma>' i))\"\n      and \"\\<And>\\<xi>. Q \\<xi> \\<xi>\"\n    shows \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (\\<lambda>\\<sigma> _. oarrivemsg I \\<sigma>, other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                            globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q (\\<sigma> i) (\\<sigma>' i))\"\n  proof -\n    from assms(1)\n      have \"T \\<Turnstile>\\<^sub>A (otherwith (\\<lambda>_ _. True) {i} (orecvmsg I), other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                  globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q (\\<sigma> i) (\\<sigma>' i))\"\n        by rule auto\n    with assms(2) have \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (otherwith (\\<lambda>_ _. True) {i} (oarrivemsg I),\n                                          other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                                         globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q (\\<sigma> i) (\\<sigma>' i))\"\n      by - (rule node_lift_step, auto)\n    thus ?thesis by rule auto\n  qed\n\nlemma node_lift_anycast [intro]:\n  assumes pinv: \"T \\<Turnstile>\\<^sub>A (otherwith S {i} (orecvmsg I), other U {i} \\<rightarrow>)\n                       globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). anycast (Q \\<sigma> \\<sigma>') a)\"\n      and \"\\<And>\\<xi> \\<xi>'. S \\<xi> \\<xi>' \\<Longrightarrow> U \\<xi> \\<xi>'\"\n    shows \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (otherwith S {i} (oarrivemsg I), other U {i} \\<rightarrow>)\n                            globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). castmsg (Q \\<sigma> \\<sigma>') a)\"\n    (is \"_ \\<Turnstile>\\<^sub>A (?S, ?U \\<rightarrow>) _\")\n  proof (rule ostep_invariantI, simp)\n    fix \\<sigma> s a \\<sigma>' s'\n    assume rs: \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) ?S ?U\"\n       and tr: \"((\\<sigma>, s), a, (\\<sigma>', s')) \\<in> trans (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"?S \\<sigma> \\<sigma>' a\"\n    from this(1-2) obtain \\<zeta> R\n      where [simp]: \"s = NodeS i \\<zeta> R\"\n        and \"(\\<sigma>, NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) ?S ?U\"\n      by (metis node_net_state)\n    from this(2) have \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {i} (orecvmsg I)) ?U\"\n      by (rule node_proc_reachable [OF _ assms(2)])\n    moreover from tr have \"((\\<sigma>, NodeS i \\<zeta> R), a, (\\<sigma>', s')) \\<in> onode_sos (trans T)\"\n      by (simp add: onode_comps)\n    ultimately show \"castmsg (Q \\<sigma> \\<sigma>') a\" using \\<open>?S \\<sigma> \\<sigma>' a\\<close>\n      by - (erule onode_sos.cases, auto elim!: otherwithE dest!: ostep_invariantD [OF pinv])\n  qed\n\nlemma node_lift_anycast_statelessassm [intro]:\n  assumes pinv: \"T \\<Turnstile>\\<^sub>A (\\<lambda>\\<sigma> _. orecvmsg I \\<sigma>, other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                       globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). anycast (Q \\<sigma> \\<sigma>') a)\"\n    shows \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (\\<lambda>\\<sigma> _. oarrivemsg I \\<sigma>, other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                            globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). castmsg (Q \\<sigma> \\<sigma>') a)\"\n    (is \"_ \\<Turnstile>\\<^sub>A (?S, _ \\<rightarrow>) _\")\n  proof -\n    from assms(1)\n      have \"T \\<Turnstile>\\<^sub>A (otherwith (\\<lambda>_ _. True) {i} (orecvmsg I), other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                  globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). anycast (Q \\<sigma> \\<sigma>') a)\"\n        by rule auto\n    hence \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (otherwith (\\<lambda>_ _. True) {i} (oarrivemsg I), other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                            globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). castmsg (Q \\<sigma> \\<sigma>') a)\"\n      by (rule node_lift_anycast) simp_all\n    thus ?thesis\n      by rule auto\n  qed\n\nlemma node_local_deliver:\n  \"\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (S, U \\<rightarrow>) globala (\\<lambda>(_, a, _). \\<forall>j. j\\<noteq>i \\<longrightarrow> (\\<forall>d. a \\<noteq> j:deliver(d)))\"\n  proof (rule ostep_invariantI, simp)\n    fix \\<sigma> s a \\<sigma>' s'\n    assume \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and \"((\\<sigma>, s), a, (\\<sigma>', s')) \\<in> trans (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"S \\<sigma> \\<sigma>' a\"\n    moreover from this(1-2) obtain \\<zeta> R \\<zeta>' R' where \"s = NodeS i \\<zeta> R\" and \"s' = NodeS i \\<zeta>' R'\" ..\n    ultimately show \"\\<forall>j. j\\<noteq>i \\<longrightarrow> (\\<forall>d. a \\<noteq> j:deliver(d))\"\n      by (cases a) (auto simp add: onode_comps)\n  qed\n\nlemma node_tau_deliver_unchanged:\n  \"\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (S, U \\<rightarrow>) globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). a = \\<tau> \\<or> (\\<exists>i d. a = i:deliver(d))\n                                                     \\<longrightarrow> (\\<forall>j. j\\<noteq>i \\<longrightarrow> \\<sigma>' j = \\<sigma> j))\"\n  proof (rule ostep_invariantI, clarsimp simp only: globalasimp snd_conv fst_conv)\n    fix \\<sigma> s a \\<sigma>' s' j\n    assume \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and \"((\\<sigma>, s), a, (\\<sigma>', s')) \\<in> trans (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"S \\<sigma> \\<sigma>' a\"\n       and \"a = \\<tau> \\<or> (\\<exists>i d. a = i:deliver(d))\"\n       and \"j \\<noteq> i\"\n    moreover from this(1-2) obtain \\<zeta> R \\<zeta>' R' where \"s = NodeS i \\<zeta> R\" and \"s' = NodeS i \\<zeta>' R'\" ..\n    ultimately show \"\\<sigma>' j = \\<sigma> j\"\n      by (cases a) (auto simp del: step_node_tau simp add: onode_comps)\n  qed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/AWN/ONode_Lifting.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.34578793835137156}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Peter Lammich <peter dot lammich at uni-muenster.de>\n    Maintainer:  Peter Lammich <peter dot lammich at uni-muenster.de>\n*)\nsection \\<open>\\isaheader{Specification of Maps}\\<close>\ntheory MapSpec\nimports ICF_Spec_Base\nbegin\ntext_raw\\<open>\\label{thy:MapSpec}\\<close>\n\n(*@intf Map\n  @abstype 'k\\<rightharpoonup>'v\n  This interface specifies maps from keys to values.\n*)\n\ntext \\<open>\n  This theory specifies map operations by means of mapping to\n  HOL's map type, i.e. @{typ \"'k \\<rightharpoonup> 'v\"}.\n\\<close>\n\ntype_synonym ('k,'v,'s) map_\\<alpha> = \"'s \\<Rightarrow> 'k \\<rightharpoonup> 'v\"\ntype_synonym ('k,'v,'s) map_invar = \"'s \\<Rightarrow> bool\"\nlocale map = \n  fixes \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"                 \\<comment> \\<open>Abstraction to map datatype\\<close>\n  fixes invar :: \"'s \\<Rightarrow> bool\"                 \\<comment> \\<open>Invariant\\<close>\n\nlocale map_no_invar = map +\n  assumes invar[simp, intro!]: \"\\<And>s. invar s\"\n\nsubsection \"Basic Map Functions\"\n\nsubsubsection \"Empty Map\"\ntype_synonym ('k,'v,'s) map_empty = \"unit \\<Rightarrow> 's\"\nlocale map_empty = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes empty :: \"unit \\<Rightarrow> 's\"\n  assumes empty_correct:\n    \"\\<alpha> (empty ()) = Map.empty\"\n    \"invar (empty ())\"\n\nsubsubsection \"Lookup\"\ntype_synonym ('k,'v,'s) map_lookup = \"'k \\<Rightarrow> 's \\<Rightarrow> 'v option\"\nlocale map_lookup = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes lookup :: \"'u \\<Rightarrow> 's \\<Rightarrow> 'v option\"\n  assumes lookup_correct:\n    \"invar m \\<Longrightarrow> lookup k m = \\<alpha> m k\"\n\nsubsubsection \"Update\"\ntype_synonym ('k,'v,'s) map_update = \"'k \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_update = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes update :: \"'u \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes update_correct:\n    \"invar m \\<Longrightarrow> \\<alpha> (update k v m) = (\\<alpha> m)(k \\<mapsto> v)\"\n    \"invar m \\<Longrightarrow> invar (update k v m)\"\n\nsubsubsection \"Disjoint Update\"\ntype_synonym ('k,'v,'s) map_update_dj = \"'k \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_update_dj = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes update_dj :: \"'u \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes update_dj_correct: \n    \"\\<lbrakk>invar m; k\\<notin>dom (\\<alpha> m)\\<rbrakk> \\<Longrightarrow> \\<alpha> (update_dj k v m) = (\\<alpha> m)(k \\<mapsto> v)\"\n    \"\\<lbrakk>invar m; k\\<notin>dom (\\<alpha> m)\\<rbrakk> \\<Longrightarrow> invar (update_dj k v m)\"\n\n \nsubsubsection \"Delete\"\ntype_synonym ('k,'v,'s) map_delete = \"'k \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_delete = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes delete :: \"'u \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes delete_correct: \n    \"invar m \\<Longrightarrow> \\<alpha> (delete k m) = (\\<alpha> m) |` (-{k})\"\n    \"invar m \\<Longrightarrow> invar (delete k m)\"\n\nsubsubsection \"Add\"\ntype_synonym ('k,'v,'s) map_add = \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_add = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes add :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes add_correct:\n    \"invar m1 \\<Longrightarrow> invar m2 \\<Longrightarrow> \\<alpha> (add m1 m2) = \\<alpha> m1 ++ \\<alpha> m2\"\n    \"invar m1 \\<Longrightarrow> invar m2 \\<Longrightarrow> invar (add m1 m2)\"\n\ntype_synonym ('k,'v,'s) map_add_dj = \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_add_dj = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes add_dj :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes add_dj_correct:\n    \"\\<lbrakk>invar m1; invar m2; dom (\\<alpha> m1) \\<inter> dom (\\<alpha> m2) = {}\\<rbrakk> \\<Longrightarrow> \\<alpha> (add_dj m1 m2) = \\<alpha> m1 ++ \\<alpha> m2\"\n    \"\\<lbrakk>invar m1; invar m2; dom (\\<alpha> m1) \\<inter> dom (\\<alpha> m2) = {} \\<rbrakk> \\<Longrightarrow> invar (add_dj m1 m2)\"\n\nsubsubsection \"Emptiness Check\"\ntype_synonym ('k,'v,'s) map_isEmpty = \"'s \\<Rightarrow> bool\"\nlocale map_isEmpty = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes isEmpty :: \"'s \\<Rightarrow> bool\"\n  assumes isEmpty_correct : \"invar m \\<Longrightarrow> isEmpty m \\<longleftrightarrow> \\<alpha> m = Map.empty\"\n\nsubsubsection \"Singleton Maps\"\ntype_synonym ('k,'v,'s) map_sng = \"'k \\<Rightarrow> 'v \\<Rightarrow> 's\"\nlocale map_sng = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes sng :: \"'u \\<Rightarrow> 'v \\<Rightarrow> 's\"\n  assumes sng_correct : \n    \"\\<alpha> (sng k v) = [k \\<mapsto> v]\"\n    \"invar (sng k v)\"\n\ntype_synonym ('k,'v,'s) map_isSng = \"'s \\<Rightarrow> bool\"\nlocale map_isSng = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'k \\<rightharpoonup> 'v\"\n  fixes isSng :: \"'s \\<Rightarrow> bool\"\n  assumes isSng_correct:\n    \"invar s \\<Longrightarrow> isSng s \\<longleftrightarrow> (\\<exists>k v. \\<alpha> s = [k \\<mapsto> v])\"\nbegin\n  lemma isSng_correct_exists1 :\n    \"invar s \\<Longrightarrow> (isSng s \\<longleftrightarrow> (\\<exists>!k. \\<exists>v. (\\<alpha> s k = Some v)))\"\n    apply (auto simp add: isSng_correct split: if_split_asm)\n    apply (rule_tac x=k in exI)\n    apply (rule_tac x=v in exI)\n    apply (rule ext)\n    apply (case_tac \"\\<alpha> s x\")\n    apply auto\n    apply force\n    done\n\n  lemma isSng_correct_card :\n    \"invar s \\<Longrightarrow> (isSng s \\<longleftrightarrow> (card (dom (\\<alpha> s)) = 1))\"\n    by (auto simp add: isSng_correct card_Suc_eq dom_eq_singleton_conv)\n\nend\n\nsubsubsection \"Finite Maps\"\nlocale finite_map = map +\n  assumes finite[simp, intro!]: \"invar m \\<Longrightarrow> finite (dom (\\<alpha> m))\"\n\nsubsubsection \"Size\"\ntype_synonym ('k,'v,'s) map_size = \"'s \\<Rightarrow> nat\"\nlocale map_size = finite_map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes size :: \"'s \\<Rightarrow> nat\"\n  assumes size_correct: \"invar s \\<Longrightarrow> size s = card (dom (\\<alpha> s))\"\n  \ntype_synonym ('k,'v,'s) map_size_abort = \"nat \\<Rightarrow> 's \\<Rightarrow> nat\"\nlocale map_size_abort = finite_map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes size_abort :: \"nat \\<Rightarrow> 's \\<Rightarrow> nat\"\n  assumes size_abort_correct: \"invar s \\<Longrightarrow> size_abort m s = min m (card (dom (\\<alpha> s)))\"\n\nsubsubsection \"Iterators\"\ntext \\<open>\n  An iteration combinator over a map applies a function to a state for each \n  map entry, in arbitrary order.\n  Proving of properties is done by invariant reasoning.\n  An iterator can also contain a continuation condition. Iteration is\n  interrupted if the condition becomes false.\n\\<close>\n\n(* Deprecated *)\n(*locale map_iteratei = finite_map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes iteratei :: \"'s \\<Rightarrow> ('u \\<times> 'v,'\\<sigma>) set_iterator\"\n\n  assumes iteratei_rule: \"invar m \\<Longrightarrow> map_iterator (iteratei m) (\\<alpha> m)\"\nbegin\n  lemma iteratei_rule_P:\n    assumes \"invar m\"\n        and I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n        and IP: \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                    \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n        and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n        and II: \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> {}; \\<not> c \\<sigma>; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using map_iterator_rule_P [OF iteratei_rule, of m I \\<sigma>0 c f P]\n    by (simp_all add: assms)\n\n  lemma iteratei_rule_insert_P:\n    assumes  \n      \"invar m\" \n      \"I {} \\<sigma>0\"\n      \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n          \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>)\"\n      \"!!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> dom (\\<alpha> m); \n               \\<not> (c \\<sigma>); \n               I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using map_iterator_rule_insert_P [OF iteratei_rule, of m I \\<sigma>0 c f P]\n    by (simp_all add: assms)\n\n  lemma iterate_rule_P:\n    \"\\<lbrakk>\n      invar m;\n      I (dom (\\<alpha> m)) \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iteratei m (\\<lambda>_. True) f \\<sigma>0)\"\n    using iteratei_rule_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by fast\n\n  lemma iterate_rule_insert_P:\n    \"\\<lbrakk>\n      invar m;\n      I {} \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iteratei m (\\<lambda>_. True) f \\<sigma>0)\"\n    using iteratei_rule_insert_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by fast\nend\n\nlemma map_iteratei_I :\n  assumes \"\\<And>m. invar m \\<Longrightarrow> map_iterator (iti m) (\\<alpha> m)\"\n  shows \"map_iteratei \\<alpha> invar iti\"\nproof\n  fix m \n  assume invar_m: \"invar m\"\n  from assms(1)[OF invar_m] show it_OK: \"map_iterator (iti m) (\\<alpha> m)\" .\n  \n  from set_iterator_genord.finite_S0 [OF it_OK[unfolded set_iterator_def]]\n  show \"finite (dom (\\<alpha> m))\" by (simp add: finite_map_to_set) \nqed\n*)\n\ntype_synonym ('k,'v,'s) map_list_it\n  = \"'s \\<Rightarrow> ('k\\<times>'v,('k\\<times>'v) list) set_iterator\"\nlocale poly_map_iteratei_defs =\n  fixes list_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\"\nbegin\n  definition iteratei :: \"'s \\<Rightarrow> ('u\\<times>'v,'\\<sigma>) set_iterator\"\n    where \"iteratei S \\<equiv> it_to_it (list_it S)\"\n\n  abbreviation \"iterate m \\<equiv> iteratei m (\\<lambda>_. True)\"\nend\n\nlocale poly_map_iteratei =\n  finite_map + poly_map_iteratei_defs list_it\n  for list_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\" +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  assumes list_it_correct: \"invar m \\<Longrightarrow> map_iterator (list_it m) (\\<alpha> m)\"\nbegin\n  lemma iteratei_correct: \"invar S \\<Longrightarrow> map_iterator (iteratei S) (\\<alpha> S)\"\n    unfolding iteratei_def\n    apply (rule it_to_it_correct)\n    by (rule list_it_correct)\n\n  lemma pi_iteratei[icf_proper_iteratorI]: \n    \"proper_it (iteratei S) (iteratei S)\"\n    unfolding iteratei_def \n    by (intro icf_proper_iteratorI)\n\n  lemma iteratei_rule_P:\n    assumes \"invar m\"\n    and I0: \"I (map_to_set (\\<alpha> m)) \\<sigma>0\"\n    and IP: \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; (k,v) \\<in> it; it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (it - {(k,v)}) (f (k, v) \\<sigma>)\"\n    and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and II: \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> map_to_set (\\<alpha> m); it \\<noteq> {}; \\<not> c \\<sigma>; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    apply (rule set_iterator_rule_P[OF iteratei_correct])\n    apply fact\n    apply fact\n    apply (case_tac x, simp add: IP)\n    apply fact\n    apply fact\n    done\n\n  lemma iteratei_rule_insert_P:\n    assumes \"invar m\" \n    and \"I {} \\<sigma>0\"\n    and \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; (k,v) \\<in> (map_to_set (\\<alpha> m) - it); \n                       it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (insert (k,v) it) (f (k, v) \\<sigma>)\"\n    and \"!!\\<sigma>. I (map_to_set (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> map_to_set (\\<alpha> m); it \\<noteq> map_to_set (\\<alpha> m); \n                  \\<not> (c \\<sigma>); \n                  I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    apply (rule set_iterator_rule_insert_P[OF iteratei_correct])\n    apply fact\n    apply fact\n    apply (case_tac x, simp add: assms)\n    apply fact\n    apply fact\n    done\n\n  lemma iterate_rule_P:\n    assumes \"invar m\"\n    and I0: \"I (map_to_set (\\<alpha> m)) \\<sigma>0\"\n    and IP: \"!!k v it \\<sigma>. \\<lbrakk> (k,v) \\<in> it; it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (it - {(k,v)}) (f (k, v) \\<sigma>)\"\n    and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterate m f \\<sigma>0)\"\n    apply (rule iteratei_rule_P)\n    apply fact\n    apply (rule I0)\n    apply (rule IP, assumption+) []\n    apply (rule IF, assumption)\n    apply simp\n    done\n\n  lemma iterate_rule_insert_P:\n    assumes \"invar m\" \n    and I0: \"I {} \\<sigma>0\"\n    and \"!!k v it \\<sigma>. \\<lbrakk> (k,v) \\<in> (map_to_set (\\<alpha> m) - it); \n                       it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (insert (k,v) it) (f (k, v) \\<sigma>)\"\n    and \"!!\\<sigma>. I (map_to_set (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterate m f \\<sigma>0)\"\n    apply (rule iteratei_rule_insert_P)\n    apply fact\n    apply (rule I0)\n    apply (rule assms, assumption+) []\n    apply (rule assms, assumption)\n    apply simp\n    done\n    \n  lemma old_iteratei_rule_P:\n    assumes \"invar m\"\n    and I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    and IP: \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and II: \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> {}; \\<not> c \\<sigma>; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using assms\n    by (rule map_iterator_rule_P[OF iteratei_correct])\n\n  lemma old_iteratei_rule_insert_P:\n    assumes \"invar m\" \n    and \"I {} \\<sigma>0\"\n    and \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; \n                       it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>)\"\n    and \"!!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> dom (\\<alpha> m); \n                  \\<not> (c \\<sigma>); \n                  I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using assms by (rule map_iterator_rule_insert_P[OF iteratei_correct])\n\n  lemma old_iterate_rule_P:\n    \"\\<lbrakk>\n      invar m;\n      I (dom (\\<alpha> m)) \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iterate m f \\<sigma>0)\"\n    using old_iteratei_rule_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\n  lemma old_iterate_rule_insert_P:\n    \"\\<lbrakk>\n      invar m;\n      I {} \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; \n                    it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iteratei m (\\<lambda>_. True) f \\<sigma>0)\"\n    using old_iteratei_rule_insert_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\n  end\n\n\nsubsubsection \"Bounded Quantification\"\ntype_synonym ('k,'v,'s) map_ball = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\nlocale map_ball = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes ball :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  assumes ball_correct: \"invar m \\<Longrightarrow> ball m P \\<longleftrightarrow> (\\<forall>u v. \\<alpha> m u = Some v \\<longrightarrow> P (u, v))\"\n\ntype_synonym ('k,'v,'s) map_bex = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\nlocale map_bex = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes bex :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  assumes bex_correct: \n    \"invar m \\<Longrightarrow> bex m P \\<longleftrightarrow> (\\<exists>u v. \\<alpha> m u = Some v \\<and> P (u, v))\"\n\n\nsubsubsection \"Selection of Entry\"\ntype_synonym ('k,'v,'s,'r) map_sel = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> 'r option) \\<Rightarrow> 'r option\"\nlocale map_sel = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes sel :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> 'r option) \\<Rightarrow> 'r option\"\n  assumes selE: \n  \"\\<lbrakk> invar m; \\<alpha> m u = Some v; f (u, v) = Some r; \n     !!u v r. \\<lbrakk> sel m f = Some r; \\<alpha> m u = Some v; f (u, v) = Some r \\<rbrakk> \\<Longrightarrow> Q \n   \\<rbrakk> \\<Longrightarrow> Q\"\n  assumes selI: \n    \"\\<lbrakk> invar m; \\<forall>u v. \\<alpha> m u = Some v \\<longrightarrow> f (u, v) = None \\<rbrakk> \\<Longrightarrow> sel m f = None\"\n\nbegin\n  lemma sel_someE: \n    \"\\<lbrakk> invar m; sel m f = Some r; \n       !!u v. \\<lbrakk> \\<alpha> m u = Some v; f (u, v) = Some r \\<rbrakk> \\<Longrightarrow> P\n     \\<rbrakk> \\<Longrightarrow> P\"\n    apply (cases \"\\<exists>u v r. \\<alpha> m u = Some v \\<and> f (u, v) = Some r\")\n    apply safe\n    apply (erule_tac u=u and v=v and r=ra in selE)\n    apply assumption\n    apply assumption\n    apply simp\n    apply (auto)\n    apply (drule (1) selI)\n    apply simp\n    done\n\n  lemma sel_noneD: \"\\<lbrakk>invar m; sel m f = None; \\<alpha> m u = Some v\\<rbrakk> \\<Longrightarrow> f (u, v) = None\"\n    apply (rule ccontr)\n    apply simp\n    apply (erule exE)\n    apply (erule_tac f=f and u=u and v=v and r=y in selE)\n    apply auto\n    done\n\nend\n\n  \\<comment> \\<open>Equivalent description of sel-map properties\\<close>\nlemma map_sel_altI:\n  assumes S1: \n    \"!!s f r P. \\<lbrakk> invar s; sel s f = Some r; \n                  !!u v. \\<lbrakk>\\<alpha> s u = Some v; f (u, v) = Some r\\<rbrakk> \\<Longrightarrow> P\n                \\<rbrakk> \\<Longrightarrow> P\"\n  assumes S2: \n    \"!!s f u v. \\<lbrakk>invar s; sel s f = None; \\<alpha> s u = Some v\\<rbrakk> \\<Longrightarrow> f (u, v) = None\"\n  shows \"map_sel \\<alpha> invar sel\"\nproof -\n  show ?thesis\n    apply (unfold_locales)\n    apply (case_tac \"sel m f\")\n    apply (force dest: S2)\n    apply (force elim: S1)\n    apply (case_tac \"sel m f\")\n    apply assumption\n    apply (force elim: S1)\n    done\nqed\n\n\nsubsubsection \"Selection of Entry (without mapping)\"\ntype_synonym ('k,'v,'s) map_sel' = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k\\<times>'v) option\"\nlocale map_sel' = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes sel' :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('u\\<times>'v) option\"\n  assumes sel'E: \n  \"\\<lbrakk> invar m; \\<alpha> m u = Some v; P (u, v); \n     !!u v. \\<lbrakk> sel' m P = Some (u,v); \\<alpha> m u = Some v; P (u, v)\\<rbrakk> \\<Longrightarrow> Q \n   \\<rbrakk> \\<Longrightarrow> Q\"\n  assumes sel'I: \n    \"\\<lbrakk> invar m; \\<forall>u v. \\<alpha> m u = Some v \\<longrightarrow> \\<not> P (u, v) \\<rbrakk> \\<Longrightarrow> sel' m P = None\"\n\nbegin\n  lemma sel'_someE: \n    \"\\<lbrakk> invar m; sel' m P = Some (u,v); \n       !!u v. \\<lbrakk> \\<alpha> m u = Some v; P (u, v) \\<rbrakk> \\<Longrightarrow> thesis\n     \\<rbrakk> \\<Longrightarrow> thesis\"\n    apply (cases \"\\<exists>u v. \\<alpha> m u = Some v \\<and> P (u, v)\")\n    apply safe\n    apply (erule_tac u=ua and v=va in sel'E)\n    apply assumption\n    apply assumption\n    apply simp\n    apply (auto)\n    apply (drule (1) sel'I)\n    apply simp\n    done\n\n  lemma sel'_noneD: \"\\<lbrakk>invar m; sel' m P = None; \\<alpha> m u = Some v\\<rbrakk> \\<Longrightarrow> \\<not> P (u, v)\"\n    apply (rule ccontr)\n    apply simp\n    apply (erule (2) sel'E[where P=P])\n    apply auto\n    done\n\n  lemma sel'_SomeD:\n    \"\\<lbrakk> sel' m P = Some (u, v); invar m \\<rbrakk> \\<Longrightarrow> \\<alpha> m u = Some v \\<and> P (u, v)\"\n    apply(cases \"\\<exists>u' v'. \\<alpha> m u' = Some v' \\<and> P (u', v')\")\n     apply clarsimp\n     apply(erule (2) sel'E[where P=P])\n     apply simp\n    apply(clarsimp)\n    apply(drule (1) sel'I)\n    apply simp\n    done\nend\n\nsubsubsection \"Map to List Conversion\"\ntype_synonym ('k,'v,'s) map_to_list = \"'s \\<Rightarrow> ('k\\<times>'v) list\"\nlocale map_to_list = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes to_list :: \"'s \\<Rightarrow> ('u\\<times>'v) list\"\n  assumes to_list_correct: \n    \"invar m \\<Longrightarrow> map_of (to_list m) = \\<alpha> m\"\n    \"invar m \\<Longrightarrow> distinct (map fst (to_list m))\"\n\n\nsubsubsection \"List to Map Conversion\"\ntype_synonym ('k,'v,'s) list_to_map = \"('k\\<times>'v) list \\<Rightarrow> 's\"\nlocale list_to_map = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes to_map :: \"('u\\<times>'v) list \\<Rightarrow> 's\"\n  assumes to_map_correct:\n    \"\\<alpha> (to_map l) = map_of l\"\n    \"invar (to_map l)\"\n\nsubsubsection \"Image of a Map\"\n\ntext \\<open>This locale allows to apply a function to both the keys and\n the values of a map while at the same time filtering entries.\\<close>\n\ndefinition transforms_to_unique_keys ::\n  \"('u1 \\<rightharpoonup> 'v1) \\<Rightarrow> ('u1 \\<times> 'v1 \\<rightharpoonup> ('u2 \\<times> 'v2)) \\<Rightarrow> bool\"\n  where\n  \"transforms_to_unique_keys m f \\<equiv> (\\<forall>k1 k2 v1 v2 k' v1' v2'. ( \n         m k1 = Some v1 \\<and>\n         m k2 = Some v2 \\<and>\n         f (k1, v1) = Some (k', v1') \\<and>\n         f (k2, v2) = Some (k', v2')) -->\n       (k1 = k2))\"\n\ntype_synonym ('k1,'v1,'m1,'k2,'v2,'m2) map_image_filter  \n  = \"('k1 \\<times> 'v1 \\<Rightarrow> ('k2 \\<times> 'v2) option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n\nlocale map_image_filter = m1: map \\<alpha>1 invar1 + m2: map \\<alpha>2 invar2\n  for \\<alpha>1 :: \"'m1 \\<Rightarrow> 'u1 \\<rightharpoonup> 'v1\" and invar1\n  and \\<alpha>2 :: \"'m2 \\<Rightarrow> 'u2 \\<rightharpoonup> 'v2\" and invar2\n  +\n  fixes map_image_filter :: \"('u1 \\<times> 'v1 \\<Rightarrow> ('u2 \\<times> 'v2) option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n  assumes map_image_filter_correct_aux1:\n    \"\\<And>k' v'. \n     \\<lbrakk>invar1 m; transforms_to_unique_keys (\\<alpha>1 m) f\\<rbrakk> \\<Longrightarrow> \n     (invar2 (map_image_filter f m) \\<and>\n      ((\\<alpha>2 (map_image_filter f m) k' = Some v') \\<longleftrightarrow>\n       (\\<exists>k v. (\\<alpha>1 m k = Some v) \\<and> f (k, v) = Some (k', v'))))\"\nbegin\n\n  (*Let's use a definition for the precondition *)\n\n  lemma map_image_filter_correct_aux2 :\n    assumes \"invar1 m\" \n      and \"transforms_to_unique_keys (\\<alpha>1 m) f\"\n    shows \"(\\<alpha>2 (map_image_filter f m) k' = None) \\<longleftrightarrow>\n      (\\<forall>k v v'. \\<alpha>1 m k = Some v \\<longrightarrow> f (k, v) \\<noteq> Some (k', v'))\"\n  proof -\n    note map_image_filter_correct_aux1 [OF assms]\n    have Some_eq: \"\\<And>v'. (\\<alpha>2 (map_image_filter f m) k' = Some v') =\n          (\\<exists>k v. \\<alpha>1 m k = Some v \\<and> f (k, v) = Some (k', v'))\"\n      by (simp add: map_image_filter_correct_aux1 [OF assms])\n    \n    have intro_some: \"(\\<alpha>2 (map_image_filter f m) k' = None) \\<longleftrightarrow>\n                      (\\<forall>v'. \\<alpha>2 (map_image_filter f m) k' \\<noteq> Some v')\" by auto\n    \n    from intro_some Some_eq show ?thesis by auto\n  qed\n\n  lemmas map_image_filter_correct = \n     conjunct1 [OF map_image_filter_correct_aux1] \n     conjunct2 [OF map_image_filter_correct_aux1] \n     map_image_filter_correct_aux2\nend\n    \n\ntext \\<open>Most of the time the mapping function is only applied to values. Then,\n  the precondition disapears.\\<close>\ntype_synonym ('k,'v1,'m1,'k2,'v2,'m2) map_value_image_filter  \n  = \"('k \\<Rightarrow> 'v1 \\<Rightarrow> 'v2 option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n\nlocale map_value_image_filter = m1: map \\<alpha>1 invar1 + m2: map \\<alpha>2 invar2\n  for \\<alpha>1 :: \"'m1 \\<Rightarrow> 'u \\<rightharpoonup> 'v1\" and invar1\n  and \\<alpha>2 :: \"'m2 \\<Rightarrow> 'u \\<rightharpoonup> 'v2\" and invar2\n  +\n  fixes map_value_image_filter :: \"('u \\<Rightarrow> 'v1 \\<Rightarrow> 'v2 option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n  assumes map_value_image_filter_correct_aux:\n    \"invar1 m \\<Longrightarrow> \n     invar2 (map_value_image_filter f m) \\<and>\n     (\\<alpha>2 (map_value_image_filter f m) = \n      (\\<lambda>k. Option.bind (\\<alpha>1 m k) (f k)))\"\nbegin\n\n  lemmas map_value_image_filter_correct =\n    conjunct1[OF map_value_image_filter_correct_aux]\n    conjunct2[OF map_value_image_filter_correct_aux]\n\n\n  lemma map_value_image_filter_correct_alt :\n    \"invar1 m \\<Longrightarrow> \n     invar2 (map_value_image_filter f m)\"\n    \"invar1 m \\<Longrightarrow>\n     (\\<alpha>2 (map_value_image_filter f m) k = Some v') \\<longleftrightarrow>\n     (\\<exists>v. (\\<alpha>1 m k = Some v) \\<and> f k v = Some v')\"\n    \"invar1 m \\<Longrightarrow>\n     (\\<alpha>2 (map_value_image_filter f m) k = None) \\<longleftrightarrow>\n     (\\<forall>v. (\\<alpha>1 m k = Some v) --> f k v = None)\"\n  proof -\n    assume invar_m : \"invar1 m\"\n    note aux = map_value_image_filter_correct_aux [OF invar_m]\n\n    from aux show \"invar2 (map_value_image_filter f m)\" by simp\n    from aux show \"(\\<alpha>2 (map_value_image_filter f m) k = Some v') \\<longleftrightarrow>\n     (\\<exists>v. (\\<alpha>1 m k = Some v) \\<and> f k v = Some v')\" \n      by (cases \"\\<alpha>1 m k\", simp_all)\n    from aux show \"(\\<alpha>2 (map_value_image_filter f m) k = None) \\<longleftrightarrow>\n     (\\<forall>v. (\\<alpha>1 m k = Some v) --> f k v = None)\" \n      by (cases \"\\<alpha>1 m k\", simp_all)\n  qed\nend\n\ntype_synonym ('k,'v,'m1,'m2) map_restrict = \"('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\nlocale map_restrict = m1: map \\<alpha>1 invar1 + m2: map \\<alpha>2 invar2 \n  for \\<alpha>1 :: \"'m1 \\<Rightarrow> 'u \\<rightharpoonup> 'v\" and invar1\n  and \\<alpha>2 :: \"'m2 \\<Rightarrow> 'u \\<rightharpoonup> 'v\" and invar2\n  +\n  fixes restrict :: \"('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n  assumes restrict_correct_aux1 :\n    \"invar1 m \\<Longrightarrow> \\<alpha>2 (restrict P m) = \\<alpha>1 m |` {k. \\<exists>v. \\<alpha>1 m k = Some v \\<and> P (k, v)}\"\n    \"invar1 m \\<Longrightarrow> invar2 (restrict P m)\"\nbegin\n  lemma restrict_correct_aux2 :\n    \"invar1 m \\<Longrightarrow> \\<alpha>2 (restrict (\\<lambda>(k,_). P k) m) = \\<alpha>1 m |` {k. P k}\"\n  proof -\n    assume invar_m : \"invar1 m\"\n    have \"\\<alpha>1 m |` {k. (\\<exists>v. \\<alpha>1 m k = Some v) \\<and> P k} = \\<alpha>1 m |` {k. P k}\"\n      (is \"\\<alpha>1 m |` ?A1 = \\<alpha>1 m |` ?A2\")\n    proof\n      fix k\n      show \"(\\<alpha>1 m |` ?A1) k = (\\<alpha>1 m |` ?A2) k\"\n      proof (cases \"k \\<in> ?A2\")\n        case False thus ?thesis by simp\n      next\n        case True\n        hence P_k : \"P k\" by simp\n\n        show ?thesis\n          by (cases \"\\<alpha>1 m k\", simp_all add: P_k)\n      qed\n    qed\n    with invar_m show \"\\<alpha>2 (restrict (\\<lambda>(k, _). P k) m) = \\<alpha>1 m |` {k. P k}\"\n      by (simp add: restrict_correct_aux1)\n  qed\n\n  lemmas restrict_correct = \n     restrict_correct_aux1\n     restrict_correct_aux2\nend\n\n\nsubsection \"Ordered Maps\"\n  locale ordered_map = map \\<alpha> invar \n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n\n  locale ordered_finite_map = finite_map \\<alpha> invar + ordered_map \\<alpha> invar\n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n\nsubsubsection \\<open>Ordered Iteration\\<close>\n  (* Deprecated *)\n(*\n  locale map_iterateoi = ordered_finite_map \\<alpha> invar\n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n    +\n    fixes iterateoi :: \"'s \\<Rightarrow> ('u \\<times> 'v,'\\<sigma>) set_iterator\"\n    assumes iterateoi_rule: \"\n      invar m \\<Longrightarrow> map_iterator_linord (iterateoi m) (\\<alpha> m)\"\n  begin\n    lemma iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n        c \\<sigma>; \n        k \\<in> it; \n        \\<forall>j\\<in>it. k\\<le>j; \n        \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<le>k; \n        \\<alpha> m k = Some v; \n        it \\<subseteq> dom (\\<alpha> m); \n        I it \\<sigma> \n      \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      assumes II: \"!!\\<sigma> it. \\<lbrakk> \n        it \\<subseteq> dom (\\<alpha> m); \n        it \\<noteq> {}; \n        \\<not> c \\<sigma>; \n        I it \\<sigma>; \n        \\<forall>k\\<in>it. \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<le>k \n      \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (iterateoi m c f \\<sigma>0)\"\n    using map_iterator_linord_rule_P [OF iterateoi_rule, of m I \\<sigma>0 c f P] assms\n    by simp\n\n    lemma iterateo_rule_P[case_names minv inv0 inv_pres i_complete]: \n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> k \\<in> it; \\<forall>j\\<in>it. k\\<le>j; \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<le>k; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (iterateoi m (\\<lambda>_. True) f \\<sigma>0)\"\n    using map_iterator_linord_rule_P [OF iterateoi_rule, of m I \\<sigma>0 \"\\<lambda>_. True\" f P] assms\n    by simp\n  end\n\n  lemma map_iterateoi_I :\n  assumes \"\\<And>m. invar m \\<Longrightarrow> map_iterator_linord (itoi m) (\\<alpha> m)\"\n  shows \"map_iterateoi \\<alpha> invar itoi\"\n  proof\n    fix m \n    assume invar_m: \"invar m\"\n    from assms(1)[OF invar_m] show it_OK: \"map_iterator_linord (itoi m) (\\<alpha> m)\" .\n  \n    from set_iterator_genord.finite_S0 [OF it_OK[unfolded set_iterator_map_linord_def]]\n    show \"finite (dom (\\<alpha> m))\" by (simp add: finite_map_to_set) \n  qed\n\n  locale map_reverse_iterateoi = ordered_finite_map \\<alpha> invar \n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n    +\n    fixes reverse_iterateoi :: \"'s \\<Rightarrow> ('u \\<times> 'v,'\\<sigma>) set_iterator\"\n    assumes reverse_iterateoi_rule: \"\n      invar m \\<Longrightarrow> map_iterator_rev_linord (reverse_iterateoi m) (\\<alpha> m)\"\n  begin\n    lemma reverse_iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n        c \\<sigma>; \n        k \\<in> it; \n        \\<forall>j\\<in>it. k\\<ge>j; \n        \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<ge>k; \n        \\<alpha> m k = Some v; \n        it \\<subseteq> dom (\\<alpha> m); \n        I it \\<sigma> \n      \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      assumes II: \"!!\\<sigma> it. \\<lbrakk> \n        it \\<subseteq> dom (\\<alpha> m); \n        it \\<noteq> {}; \n        \\<not> c \\<sigma>; \n        I it \\<sigma>; \n        \\<forall>k\\<in>it. \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<ge>k \n      \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (reverse_iterateoi m c f \\<sigma>0)\"\n    using map_iterator_rev_linord_rule_P [OF reverse_iterateoi_rule, of m I \\<sigma>0 c f P] assms\n    by simp\n\n    lemma reverse_iterateo_rule_P[case_names minv inv0 inv_pres i_complete]:\n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n        k \\<in> it; \n        \\<forall>j\\<in>it. k\\<ge>j; \n        \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<ge>k; \n        \\<alpha> m k = Some v; \n        it \\<subseteq> dom (\\<alpha> m); \n        I it \\<sigma> \n      \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (reverse_iterateoi m (\\<lambda>_. True) f \\<sigma>0)\"\n    using map_iterator_rev_linord_rule_P[OF reverse_iterateoi_rule, of m I \\<sigma>0 \"\\<lambda>_. True\" f P] assms\n    by simp\n  end\n\n  lemma map_reverse_iterateoi_I :\n  assumes \"\\<And>m. invar m \\<Longrightarrow> map_iterator_rev_linord (ritoi m) (\\<alpha> m)\"\n  shows \"map_reverse_iterateoi \\<alpha> invar ritoi\"\n  proof\n    fix m \n    assume invar_m: \"invar m\"\n    from assms(1)[OF invar_m] show it_OK: \"map_iterator_rev_linord (ritoi m) (\\<alpha> m)\" .\n  \n    from set_iterator_genord.finite_S0 [OF it_OK[unfolded set_iterator_map_rev_linord_def]]\n    show \"finite (dom (\\<alpha> m))\" by (simp add: finite_map_to_set) \n  qed\n*)\n\nlocale poly_map_iterateoi_defs =\n  fixes olist_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\"\nbegin\n  definition iterateoi :: \"'s \\<Rightarrow> ('u\\<times>'v,'\\<sigma>) set_iterator\"\n    where \"iterateoi S \\<equiv> it_to_it (olist_it S)\"\n\n  abbreviation \"iterateo m \\<equiv> iterateoi m (\\<lambda>_. True)\"\nend\n\nlocale poly_map_iterateoi =\n  finite_map \\<alpha> invar + poly_map_iterateoi_defs list_ordered_it\n  for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" \n  and invar \n  and list_ordered_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\" +\n  assumes list_ordered_it_correct: \"invar m \n    \\<Longrightarrow> map_iterator_linord (list_ordered_it m) (\\<alpha> m)\"\nbegin\n  lemma iterateoi_correct: \"invar S \\<Longrightarrow> map_iterator_linord (iterateoi S) (\\<alpha> S)\"\n    unfolding iterateoi_def\n    apply (rule it_to_it_map_linord_correct)\n    by (rule list_ordered_it_correct)\n\n  lemma pi_iterateoi[icf_proper_iteratorI]: \n    \"proper_it (iterateoi S) (iterateoi S)\"\n    unfolding iterateoi_def \n    by (intro icf_proper_iteratorI)\n\n\n  lemma iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      c \\<sigma>; \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<le>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<le>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    assumes II: \"!!\\<sigma> it. \\<lbrakk> \n      it \\<subseteq> dom (\\<alpha> m); \n      it \\<noteq> {}; \n      \\<not> c \\<sigma>; \n      I it \\<sigma>; \n      \\<And>k j. \\<lbrakk>k\\<in>it; j\\<in>dom (\\<alpha> m) - it\\<rbrakk> \\<Longrightarrow> j\\<le>k \n    \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterateoi m c f \\<sigma>0)\"\n    using assms by (rule map_iterator_linord_rule_P[OF iterateoi_correct])\n\n  lemma iterateo_rule_P[case_names minv inv0 inv_pres i_complete]: \n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<le>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<le>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterateo m f \\<sigma>0)\"\n    using assms \n      map_iterator_linord_rule_P[OF iterateoi_correct, of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\nend\n  \ntype_synonym ('k,'v,'s) map_list_rev_it\n  = \"'s \\<Rightarrow> ('k\\<times>'v,('k\\<times>'v) list) set_iterator\"\n\nlocale poly_map_rev_iterateoi_defs =\n  fixes list_rev_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\"\nbegin\n  definition rev_iterateoi :: \"'s \\<Rightarrow> ('u\\<times>'v,'\\<sigma>) set_iterator\"\n    where \"rev_iterateoi S \\<equiv> it_to_it (list_rev_it S)\"\n\n  abbreviation \"rev_iterateo m \\<equiv> rev_iterateoi m (\\<lambda>_. True)\"\n  abbreviation \"reverse_iterateoi \\<equiv> rev_iterateoi\"\n  abbreviation \"reverse_iterateo \\<equiv> rev_iterateo\"\nend\n\nlocale poly_map_rev_iterateoi =\n  finite_map \\<alpha> invar + poly_map_rev_iterateoi_defs list_rev_it\n  for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" \n  and invar\n  and list_rev_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\" +\n  assumes list_rev_it_correct: \n    \"invar m \\<Longrightarrow> map_iterator_rev_linord (list_rev_it m) (\\<alpha> m)\"\nbegin\n  lemma rev_iterateoi_correct: \n    \"invar S \\<Longrightarrow> map_iterator_rev_linord (rev_iterateoi S) (\\<alpha> S)\"\n    unfolding rev_iterateoi_def\n    apply (rule it_to_it_map_rev_linord_correct)\n    by (rule list_rev_it_correct)\n\n  lemma pi_rev_iterateoi[icf_proper_iteratorI]: \n    \"proper_it (rev_iterateoi S) (rev_iterateoi S)\"\n    unfolding rev_iterateoi_def \n    by (intro icf_proper_iteratorI)\n\n\n  lemma rev_iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      c \\<sigma>; \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<ge>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<ge>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    assumes II: \"!!\\<sigma> it. \\<lbrakk> \n      it \\<subseteq> dom (\\<alpha> m); \n      it \\<noteq> {}; \n      \\<not> c \\<sigma>; \n      I it \\<sigma>; \n      \\<And>k j. \\<lbrakk>k\\<in>it; j\\<in>dom (\\<alpha> m) - it\\<rbrakk> \\<Longrightarrow> j\\<ge>k \n    \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (rev_iterateoi m c f \\<sigma>0)\"\n    using assms by (rule map_iterator_rev_linord_rule_P[OF rev_iterateoi_correct])\n\n  lemma rev_iterateo_rule_P[case_names minv inv0 inv_pres i_complete]: \n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<ge>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<ge>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (rev_iterateo m f \\<sigma>0)\"\n    using assms \n      map_iterator_rev_linord_rule_P[OF rev_iterateoi_correct, \n        of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\nend\n\nsubsubsection \\<open>Minimal and Maximal Elements\\<close>\n\n  type_synonym ('k,'v,'s) map_min \n    = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n  locale map_min = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes min :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('u \\<times> 'v) option\"\n    assumes min_correct:\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P \\<noteq> {} \\<rbrakk> \\<Longrightarrow> min s P \\<in> Some ` rel_of (\\<alpha> s) P\"\n      \"\\<lbrakk> invar s; (k,v) \\<in> rel_of (\\<alpha> s) P \\<rbrakk> \\<Longrightarrow> fst (the (min s P)) \\<le> k\"\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P = {} \\<rbrakk> \\<Longrightarrow> min s P = None\"\n  begin\n   lemma minE: \n     assumes A: \"invar s\" \"rel_of (\\<alpha> s) P \\<noteq> {}\"\n     obtains k v where\n     \"min s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\" \"\\<forall>(k',v')\\<in>rel_of (\\<alpha> s) P. k \\<le> k'\"\n   proof -\n     from min_correct(1)[OF A] have MIS: \"min s P \\<in> Some ` rel_of (\\<alpha> s) P\" .\n     then obtain k v where KV: \"min s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\"\n       by auto\n     show thesis \n       apply (rule that[OF KV])\n       apply (clarify)\n       apply (drule min_correct(2)[OF \\<open>invar s\\<close>])\n       apply (simp add: KV(1))\n       done\n   qed\n\n   lemmas minI = min_correct(3)\n\n   lemma min_Some:\n     \"\\<lbrakk> invar s; min s P = Some (k,v) \\<rbrakk> \\<Longrightarrow> (k,v)\\<in>rel_of (\\<alpha> s) P\"\n     \"\\<lbrakk> invar s; min s P = Some (k,v); (k',v')\\<in>rel_of (\\<alpha> s) P \\<rbrakk> \\<Longrightarrow> k\\<le>k'\"\n     apply -\n     apply (cases \"rel_of (\\<alpha> s) P = {}\")\n     apply (drule (1) min_correct(3))\n     apply simp\n     apply (erule (1) minE)\n     apply auto [1]\n     apply (drule (1) min_correct(2))\n     apply auto\n     done\n     \n   lemma min_None:\n     \"\\<lbrakk> invar s; min s P = None \\<rbrakk> \\<Longrightarrow> rel_of (\\<alpha> s) P = {}\"\n     apply (cases \"rel_of (\\<alpha> s) P = {}\")\n     apply simp\n     apply (drule (1) min_correct(1))\n     apply auto\n     done\n\n  end\n\n  type_synonym ('k,'v,'s) map_max\n    = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n  locale map_max = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes max :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('u \\<times> 'v) option\"\n    assumes max_correct:\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P \\<noteq> {} \\<rbrakk> \\<Longrightarrow> max s P \\<in> Some ` rel_of (\\<alpha> s) P\"\n      \"\\<lbrakk> invar s; (k,v) \\<in> rel_of (\\<alpha> s) P \\<rbrakk> \\<Longrightarrow> fst (the (max s P)) \\<ge> k\"\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P = {} \\<rbrakk> \\<Longrightarrow> max s P = None\"\n  begin\n   lemma maxE: \n     assumes A: \"invar s\" \"rel_of (\\<alpha> s) P \\<noteq> {}\"\n     obtains k v where\n     \"max s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\" \"\\<forall>(k',v')\\<in>rel_of (\\<alpha> s) P. k \\<ge> k'\"\n   proof -\n     from max_correct(1)[OF A] have MIS: \"max s P \\<in> Some ` rel_of (\\<alpha> s) P\" .\n     then obtain k v where KV: \"max s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\"\n       by auto\n     show thesis \n       apply (rule that[OF KV])\n       apply (clarify)\n       apply (drule max_correct(2)[OF \\<open>invar s\\<close>])\n       apply (simp add: KV(1))\n       done\n   qed\n\n   lemmas maxI = max_correct(3)\n\n   \n\n  end\n\n\nsubsubsection \"Conversion to List\"\n  type_synonym ('k,'v,'s) map_to_sorted_list \n    = \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n  locale map_to_sorted_list = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes to_sorted_list :: \"'s \\<Rightarrow> ('u\\<times>'v) list\"\n    assumes to_sorted_list_correct: \n    \"invar m \\<Longrightarrow> map_of (to_sorted_list m) = \\<alpha> m\"\n    \"invar m \\<Longrightarrow> distinct (map fst (to_sorted_list m))\"\n    \"invar m \\<Longrightarrow> sorted (map fst (to_sorted_list m))\"\n\n  type_synonym ('k,'v,'s) map_to_rev_list \n    = \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n  locale map_to_rev_list = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes to_rev_list :: \"'s \\<Rightarrow> ('u\\<times>'v) list\"\n    assumes to_rev_list_correct: \n    \"invar m \\<Longrightarrow> map_of (to_rev_list m) = \\<alpha> m\"\n    \"invar m \\<Longrightarrow> distinct (map fst (to_rev_list m))\"\n    \"invar m \\<Longrightarrow> sorted (rev (map fst (to_rev_list m)))\"\n\nsubsection \"Record Based Interface\"\n\n  record ('k,'v,'s) map_ops = \n    map_op_\\<alpha> :: \"('k,'v,'s) map_\\<alpha>\"\n    map_op_invar :: \"('k,'v,'s) map_invar\"\n    map_op_empty :: \"('k,'v,'s) map_empty\"\n    map_op_lookup :: \"('k,'v,'s) map_lookup\"\n    map_op_update :: \"('k,'v,'s) map_update\"\n    map_op_update_dj :: \"('k,'v,'s) map_update_dj\"\n    map_op_delete :: \"('k,'v,'s) map_delete\"\n    map_op_list_it :: \"('k,'v,'s) map_list_it\"\n    map_op_sng :: \"('k,'v,'s) map_sng\"\n    map_op_restrict :: \"('k,'v,'s,'s) map_restrict\"\n    map_op_add :: \"('k,'v,'s) map_add\"\n    map_op_add_dj :: \"('k,'v,'s) map_add_dj\"\n    map_op_isEmpty :: \"('k,'v,'s) map_isEmpty\"\n    map_op_isSng :: \"('k,'v,'s) map_isSng\"\n    map_op_ball :: \"('k,'v,'s) map_ball\"\n    map_op_bex :: \"('k,'v,'s) map_bex\"\n    map_op_size :: \"('k,'v,'s) map_size\"\n    map_op_size_abort :: \"('k,'v,'s) map_size_abort\"\n    map_op_sel :: \"('k,'v,'s) map_sel'\"\n    map_op_to_list :: \"('k,'v,'s) map_to_list\"\n    map_op_to_map :: \"('k,'v,'s) list_to_map\"\n\n  locale StdMapDefs = poly_map_iteratei_defs \"map_op_list_it ops\" \n    for ops :: \"('k,'v,'s,'more) map_ops_scheme\"\n  begin\n    abbreviation \\<alpha> where \"\\<alpha> == map_op_\\<alpha> ops\" \n    abbreviation invar where \"invar == map_op_invar ops\" \n    abbreviation empty where \"empty == map_op_empty ops\" \n    abbreviation lookup where \"lookup == map_op_lookup ops\" \n    abbreviation update where \"update == map_op_update ops\" \n    abbreviation update_dj where \"update_dj == map_op_update_dj ops\" \n    abbreviation delete where \"delete == map_op_delete ops\" \n    abbreviation list_it where \"list_it == map_op_list_it ops\" \n    abbreviation sng where \"sng == map_op_sng ops\" \n    abbreviation restrict where \"restrict == map_op_restrict ops\" \n    abbreviation add where \"add == map_op_add ops\" \n    abbreviation add_dj where \"add_dj == map_op_add_dj ops\" \n    abbreviation isEmpty where \"isEmpty == map_op_isEmpty ops\" \n    abbreviation isSng where \"isSng == map_op_isSng ops\" \n    abbreviation ball where \"ball == map_op_ball ops\" \n    abbreviation bex where \"bex == map_op_bex ops\" \n    abbreviation size where \"size == map_op_size ops\" \n    abbreviation size_abort where \"size_abort == map_op_size_abort ops\" \n    abbreviation sel where \"sel == map_op_sel ops\" \n    abbreviation to_list where \"to_list == map_op_to_list ops\" \n    abbreviation to_map where \"to_map == map_op_to_map ops\"\n  end\n\n  locale StdMap = StdMapDefs ops +\n    map \\<alpha> invar +\n    map_empty \\<alpha> invar empty +\n    map_lookup \\<alpha> invar lookup  +\n    map_update \\<alpha> invar update  +\n    map_update_dj \\<alpha> invar update_dj +\n    map_delete \\<alpha> invar delete  +\n    poly_map_iteratei \\<alpha> invar list_it +\n    map_sng \\<alpha> invar sng  +\n    map_restrict \\<alpha> invar \\<alpha> invar restrict +\n    map_add \\<alpha> invar add  +\n    map_add_dj \\<alpha> invar add_dj +\n    map_isEmpty \\<alpha> invar isEmpty  +\n    map_isSng \\<alpha> invar isSng  +\n    map_ball \\<alpha> invar ball  +\n    map_bex \\<alpha> invar bex  +\n    map_size \\<alpha> invar size +\n    map_size_abort \\<alpha> invar size_abort +\n    map_sel' \\<alpha> invar sel  +\n    map_to_list \\<alpha> invar to_list  +\n    list_to_map \\<alpha> invar to_map \n    for ops :: \"('k,'v,'s,'more) map_ops_scheme\"\n  begin\n    lemmas correct =\n      empty_correct\n      sng_correct\n      lookup_correct\n      update_correct\n      update_dj_correct\n      delete_correct\n      restrict_correct\n      add_correct\n      add_dj_correct\n      isEmpty_correct\n      isSng_correct\n      ball_correct\n      bex_correct\n      size_correct\n      size_abort_correct\n      to_list_correct\n      to_map_correct\n  end\n\n  lemmas StdMap_intro = StdMap.intro[rem_dup_prems]\n\n  locale StdMap_no_invar = StdMap + map_no_invar \\<alpha> invar\n\n  record ('k,'v,'s) omap_ops = \"('k,'v,'s) map_ops\" + \n    map_op_ordered_list_it :: \"'s \\<Rightarrow> ('k,'v,('k\\<times>'v) list) map_iterator\"\n    map_op_rev_list_it :: \"'s \\<Rightarrow> ('k,'v,('k\\<times>'v) list) map_iterator\"\n    map_op_min :: \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n    map_op_max :: \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n    map_op_to_sorted_list :: \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n    map_op_to_rev_list :: \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n\n  locale StdOMapDefs = StdMapDefs ops\n    + poly_map_iterateoi_defs \"map_op_ordered_list_it ops\"\n    + poly_map_rev_iterateoi_defs \"map_op_rev_list_it ops\"\n    for ops :: \"('k::linorder,'v,'s,'more) omap_ops_scheme\"\n  begin\n    abbreviation ordered_list_it where \"ordered_list_it \n      \\<equiv> map_op_ordered_list_it ops\"\n    abbreviation rev_list_it where \"rev_list_it \n      \\<equiv> map_op_rev_list_it ops\"\n    abbreviation min where \"min == map_op_min ops\"\n    abbreviation max where \"max == map_op_max ops\"\n    abbreviation to_sorted_list where \n      \"to_sorted_list \\<equiv> map_op_to_sorted_list ops\"\n    abbreviation to_rev_list where \"to_rev_list \\<equiv> map_op_to_rev_list ops\"\n  end\n\n  locale StdOMap = \n    StdOMapDefs ops +\n    StdMap ops +\n    poly_map_iterateoi \\<alpha> invar ordered_list_it +\n    poly_map_rev_iterateoi \\<alpha> invar rev_list_it +\n    map_min \\<alpha> invar min +\n    map_max \\<alpha> invar max +\n    map_to_sorted_list \\<alpha> invar to_sorted_list +\n    map_to_rev_list \\<alpha> invar to_rev_list\n    for ops :: \"('k::linorder,'v,'s,'more) omap_ops_scheme\"\n  begin\n  end\n\n  lemmas StdOMap_intro = \n    StdOMap.intro[OF StdMap_intro, rem_dup_prems]\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/ICF/spec/MapSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878414043814, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.34578793041811384}}
{"text": "theory SINVAR_ACLcommunicateWith\nimports \"../TopoS_Helper\"\nbegin\nsubsection {* SecurityInvariant ACLcommunicateWith *}\ntext{*An access control list strategy that says that hosts must only transitively access each other if allowed*}\n\n\ntext{*Warning: this transitive model has exponential computational complexity*}\n\n\ndatatype 'v access_list = AccessList \"'v list\"\n\ndefinition default_node_properties :: \"'v access_list\"\n  where  \"default_node_properties \\<equiv> AccessList []\"\n\nfun accesses_okay :: \"'v access_list \\<Rightarrow> 'v set \\<Rightarrow> bool\" where\n  \"accesses_okay (AccessList ACL) accesses = (\\<forall> a \\<in> accesses. a \\<in> set ACL)\"\n\nfun sinvar :: \"'v graph \\<Rightarrow> ('v \\<Rightarrow> 'v access_list) \\<Rightarrow> bool\" where\n  \"sinvar G nP = (\\<forall> v \\<in> nodes G. accesses_okay (nP v) (succ_tran G v))\"\n\nfun verify_globals :: \"'v graph \\<Rightarrow> ('v \\<Rightarrow> 'v access_list) \\<Rightarrow> 'b \\<Rightarrow> bool\" where\n  \"verify_globals _ _ _ = True\"\n\ndefinition receiver_violation :: \"bool\" where \n  \"receiver_violation \\<equiv> False\"\n\n\n\n\n    from a3 have \"\\<And>v ACL. v \\<in> N \\<Longrightarrow> nP v = AccessList ACL \\<Longrightarrow> accesses_okay (nP v) (succ_tran \\<lparr>nodes = N, edges = E\\<rparr> v)\" by fastforce\n    hence \"\\<And>v ACL. v \\<in> N \\<Longrightarrow> nP v = AccessList ACL \\<Longrightarrow> (\\<forall> a \\<in> (succ_tran \\<lparr>nodes = N, edges = E\\<rparr> v). a \\<in> set ACL)\" by simp\n    from this a2 have g2: \"\\<And>v ACL. v \\<in> N \\<Longrightarrow> nP v = AccessList ACL \\<Longrightarrow> (\\<forall> a \\<in> (succ_tran \\<lparr>nodes = N, edges = E'\\<rparr> v). a \\<in> set ACL)\"\n      using succ_tran_mono[OF a1] by blast\n\n    thus \"sinvar \\<lparr>nodes = N, edges = E'\\<rparr> nP\"\n      apply(clarsimp)\n      apply(rename_tac v)\n      apply(case_tac \"(nP v)\")\n      apply(simp)\n      done\nqed\n  \n\n\nlemma accesses_okay_empty: \"accesses_okay (nP v) {}\"\n  by(case_tac \"nP v\", simp_all)\n\n\ninterpretation SecurityInvariant_preliminaries\nwhere sinvar = sinvar\nand verify_globals = verify_globals\n  apply unfold_locales\n    apply(frule_tac finite_distinct_list[OF valid_graph.finiteE])\n    apply(erule_tac exE)\n    apply(rename_tac list_edges)\n    apply(rule_tac ff=\"list_edges\" in SecurityInvariant_withOffendingFlows.mono_imp_set_offending_flows_not_empty[OF sinvar_mono])\n        apply(auto)[4]\n    apply(auto simp add: SecurityInvariant_withOffendingFlows.is_offending_flows_def graph_ops False_set succ_tran_empty accesses_okay_empty)[1]\n   apply(fact SecurityInvariant_withOffendingFlows.sinvar_mono_imp_sinvar_mono[OF sinvar_mono])\n  apply(fact SecurityInvariant_withOffendingFlows.sinvar_mono_imp_is_offending_flows_mono[OF sinvar_mono])\n done\n\n\nlemma unique_default_example: \"succ_tran \\<lparr>nodes = {vertex_1, vertex_2}, edges = {(vertex_1, vertex_2)}\\<rparr> vertex_2 = {}\"\napply (simp add: succ_tran_def)\nby (metis Domain.DomainI Domain_empty Domain_insert distinct_vertices12 singleton_iff trancl_domain)\n\ninterpretation ACLcommunicateWith: SecurityInvariant_ACS\nwhere default_node_properties = SINVAR_ACLcommunicateWith.default_node_properties\nand sinvar = SINVAR_ACLcommunicateWith.sinvar\nand verify_globals = verify_globals\n  unfolding SINVAR_ACLcommunicateWith.default_node_properties_def\n  apply unfold_locales\n  \n   apply simp\n   apply(subst(asm) SecurityInvariant_withOffendingFlows.set_offending_flows_simp, simp)\n   apply(clarsimp)\n   apply (metis accesses_okay_empty)\n\n\n  apply(erule default_uniqueness_by_counterexample_ACS)\n  apply(case_tac \"otherbot\")\n  apply(simp)\n  apply (simp add: SecurityInvariant_withOffendingFlows.set_offending_flows_def\n      SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n      SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n  apply (simp add:graph_ops)\n  apply (simp split: split_split_asm split_split)\n  apply(simp add: List.neq_Nil_conv)\n  apply(erule exE)\n  apply(rename_tac canAccessThis)\n  apply(case_tac \"canAccessThis = vertex_1\")\n   apply(rule_tac x=\"\\<lparr> nodes={canAccessThis,vertex_2}, edges = {(vertex_2,canAccessThis)} \\<rparr>\" in exI, simp)\n   apply(rule conjI)\n    apply(simp add: valid_graph_def)\n   apply(rule_tac x=\"(\\<lambda> x. AccessList [])(vertex_1 := AccessList [], vertex_2 := AccessList [])\" in exI, simp)\n   apply(simp add: example_simps)\n   apply(rule_tac x=\"{(vertex_2,vertex_1)}\" in exI, simp)\n   apply(simp add: example_simps)\n   apply(fastforce)\n\n  apply(rule_tac x=\"\\<lparr> nodes={vertex_1,canAccessThis}, edges = {(vertex_1,canAccessThis)} \\<rparr>\" in exI, simp)\n  apply(rule conjI)\n   apply(simp add: valid_graph_def)\n  apply(rule_tac x=\"(\\<lambda> x. AccessList [])(vertex_1 := AccessList [], canAccessThis := AccessList [])\" in exI, simp)\n  apply(simp add: example_simps)\n  apply(rule_tac x=\"{(vertex_1,canAccessThis)}\" in exI, simp)\n  apply(simp add: example_simps)\n  apply(fastforce)\n done\n\n\n  lemma TopoS_ACLcommunicateWith: \"SecurityInvariant sinvar default_node_properties receiver_violation\"\n  unfolding receiver_violation_def by unfold_locales  \n\nhide_const (open) sinvar verify_globals receiver_violation default_node_properties\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Network_Security_Policy_Verification/Security_Invariants/SINVAR_ACLcommunicateWith.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300698514778, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3457769653679991}}
{"text": "(*  Title:      Uint.thy\n    Author:     Peter Lammich, TU Munich\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nchapter {* Unsigned words of default size *}\n\ntheory Uint imports\n  Word_Misc\n  Bits_Integer\nbegin\n\ntext {*\n  This theory provides access to words in the target languages of the code generator\n  whose bit width is the default of the target language. To that end, the type @{text uint}\n  models words of width @{text dflt_size}, but @{text dflt_size} is known only to be positive.\n\n  Usage restrictions:\n  Default-size words (type @{text uint}) cannot be used for evaluation, because \n  the results depend on the particular choice of word size in the target language\n  and implementation. Symbolic evaluation has not yet been set up for @{text \"uint\"}.\n*}\n\ntext {* The default size type *}\ntypedecl dflt_size\n\ninstantiation dflt_size :: typerep begin\ndefinition \"typerep_class.typerep \\<equiv>  \\<lambda>_ :: dflt_size itself. Typerep.Typerep (STR ''Uint.dflt_size'') []\"\ninstance ..\nend\n\nconsts dflt_size_aux :: \"nat\"\nspecification (dflt_size_aux) dflt_size_aux_g0: \"dflt_size_aux > 0\"\n  by auto\n\ninstantiation dflt_size :: len begin\ndefinition \"len_of_dflt_size (_ :: dflt_size itself) \\<equiv> dflt_size_aux\"\ninstance by(intro_classes)(simp add: len_of_dflt_size_def dflt_size_aux_g0)\nend\n\nabbreviation \"dflt_size \\<equiv> len_of (TYPE (dflt_size))\"\n\ncontext includes integer.lifting begin\nlift_definition dflt_size_integer :: integer is \"int dflt_size\" .\ndeclare dflt_size_integer_def[code del]\n  -- \"The code generator will substitute a machine-dependent value for this constant\"\n\nlemma dflt_size_by_int[code]: \"dflt_size = nat_of_integer dflt_size_integer\"\nby transfer simp\n\nlemma dflt_size[simp]: \n  \"dflt_size > 0\"\n  \"dflt_size \\<ge> Suc 0\"\n  \"\\<not> dflt_size < Suc 0\"\n  using len_gt_0[where 'a=dflt_size]\n  by (simp_all del: len_gt_0)\nend\n\ndeclare prod.Quotient[transfer_rule]\n\nsection {* Type definition and primitive operations *}\n\ntypedef uint = \"UNIV :: dflt_size word set\" .. \n\nsetup_lifting type_definition_uint\n\ntext {* Use an abstract type for code generation to disable pattern matching on @{term Abs_uint}. *}\ndeclare Rep_uint_inverse[code abstype]\n\ndeclare Quotient_uint[transfer_rule]\n\ninstantiation uint :: \"{neg_numeral, modulo, comm_monoid_mult, comm_ring}\" begin\nlift_definition zero_uint :: uint is \"0 :: dflt_size word\" .\nlift_definition one_uint :: uint is \"1\" .\nlift_definition plus_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\" is \"op + :: dflt_size word \\<Rightarrow> _\" .\nlift_definition minus_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\" is \"op -\" .\nlift_definition uminus_uint :: \"uint \\<Rightarrow> uint\" is uminus .\nlift_definition times_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\" is \"op *\" .\nlift_definition divide_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\" is \"op div\" .\nlift_definition modulo_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\" is \"op mod\" .\ninstance by standard (transfer, simp add: algebra_simps)+\nend\n\ninstantiation uint :: linorder begin\nlift_definition less_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> bool\" is \"op <\" .\nlift_definition less_eq_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> bool\" is \"op \\<le>\" .\ninstance by standard (transfer, simp add: less_le_not_le linear)+\nend\n\nlemmas [code] = less_uint.rep_eq less_eq_uint.rep_eq\n\ninstantiation uint :: bitss begin\nlift_definition bitNOT_uint :: \"uint \\<Rightarrow> uint\" is bitNOT .\nlift_definition bitAND_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\" is bitAND .\nlift_definition bitOR_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\" is bitOR .\nlift_definition bitXOR_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\" is bitXOR .\nlift_definition test_bit_uint :: \"uint \\<Rightarrow> nat \\<Rightarrow> bool\" is test_bit .\nlift_definition set_bit_uint :: \"uint \\<Rightarrow> nat \\<Rightarrow> bool \\<Rightarrow> uint\" is set_bit .\nlift_definition set_bits_uint :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> uint\" is \"set_bits\" .\nlift_definition lsb_uint :: \"uint \\<Rightarrow> bool\" is lsb .\nlift_definition shiftl_uint :: \"uint \\<Rightarrow> nat \\<Rightarrow> uint\" is shiftl .\nlift_definition shiftr_uint :: \"uint \\<Rightarrow> nat \\<Rightarrow> uint\" is shiftr .\nlift_definition msb_uint :: \"uint \\<Rightarrow> bool\" is msb .\ninstance ..\nend\n\nlemmas [code] = test_bit_uint.rep_eq lsb_uint.rep_eq msb_uint.rep_eq\n\ninstantiation uint :: equal begin\nlift_definition equal_uint :: \"uint \\<Rightarrow> uint \\<Rightarrow> bool\" is \"equal_class.equal\" .\ninstance by standard (transfer, simp add: equal_eq)\nend\n\nlemmas [code] = equal_uint.rep_eq\n\ninstantiation uint :: size begin\nlift_definition size_uint :: \"uint \\<Rightarrow> nat\" is \"size\" .\ninstance ..\nend\n\nlemmas [code] = size_uint.rep_eq\n\nlift_definition sshiftr_uint :: \"uint \\<Rightarrow> nat \\<Rightarrow> uint\" (infixl \">>>\" 55) is sshiftr .\n\nlift_definition uint_of_int :: \"int \\<Rightarrow> uint\" is \"word_of_int\" .\n\nlemma of_bool_integer_transfer [transfer_rule]:\n  \"(rel_fun op = pcr_integer) of_bool of_bool\"\nby(auto simp add: integer.pcr_cr_eq cr_integer_def split: bit.split)\n\ntext {* Use pretty numerals from integer for pretty printing *}\n\ncontext includes integer.lifting begin\n\nlift_definition Uint :: \"integer \\<Rightarrow> uint\" is \"word_of_int\" .\n\nlemma Rep_uint_numeral [simp]: \"Rep_uint (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint_def Abs_uint_inverse numeral.simps plus_uint_def)\n\n\n\nlemma numeral_uint [code_unfold]: \"numeral n = Uint (numeral n)\"\nby transfer simp\n\nlemma Rep_uint_neg_numeral [simp]: \"Rep_uint (- numeral n) = - numeral n\"\nby(simp only: uminus_uint_def)(simp add: Abs_uint_inverse)\n\nlemma neg_numeral_uint [code_unfold]: \"- numeral n = Uint (- numeral n)\"\nby transfer(simp add: cr_uint_def)\n\nend\n\nlemma Abs_uint_numeral [code_post]: \"Abs_uint (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint_def numeral.simps plus_uint_def Abs_uint_inverse)\n\nlemma Abs_uint_0 [code_post]: \"Abs_uint 0 = 0\"\nby(simp add: zero_uint_def)\n\nlemma Abs_uint_1 [code_post]: \"Abs_uint 1 = 1\"\nby(simp add: one_uint_def)\n\nsection {* Code setup *}\n\ncode_printing code_module Uint \\<rightharpoonup> (SML)\n{*\nstructure Uint : sig\n  val set_bit : Word.word -> IntInf.int -> bool -> Word.word\n  val shiftl : Word.word -> IntInf.int -> Word.word\n  val shiftr : Word.word -> IntInf.int -> Word.word\n  val shiftr_signed : Word.word -> IntInf.int -> Word.word\n  val test_bit : Word.word -> IntInf.int -> bool\nend = struct\n\nfun set_bit x n b =\n  let val mask = Word.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))\n  in if b then Word.orb (x, mask)\n     else Word.andb (x, Word.notb mask)\n  end\n\nfun shiftl x n =\n  Word.<< (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr x n =\n  Word.>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr_signed x n =\n  Word.~>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun test_bit x n =\n  Word.andb (x, Word.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))) <> Word.fromInt 0\n\nend; (* struct Uint *)*}\ncode_reserved SML Uint\n\ncode_printing code_module Uint \\<rightharpoonup> (Haskell)\n{*\nimport qualified Prelude;\nimport qualified Data.Word;\nimport qualified Data.Int;\nimport qualified Data.Bits;\n\ntype Int = Data.Int.Int;\n\ntype Word = Data.Word.Word;\n\ndflt_size :: Prelude.Integer;\ndflt_size = Prelude.toInteger (bitSize_aux (0::Word))\n  where {\n    bitSize_aux :: (Data.Bits.Bits a, Prelude.Bounded a) => a -> Uint.Int;\n    bitSize_aux = Data.Bits.bitSize\n  };\n*}\n  and (Haskell_Quickcheck)\n{*\nimport qualified Prelude;\nimport qualified Data.Word;\nimport qualified Data.Int;\nimport qualified Data.Bits;\n\ntype Int = Data.Int.Int;\n\ntype Word = Data.Word.Word;\n\ndflt_size :: Prelude.Int;\ndflt_size = bitSize_aux (0::Word)\n  where {\n    bitSize_aux :: (Data.Bits.Bits a, Prelude.Bounded a) => a -> Uint.Int;\n    bitSize_aux = Data.Bits.bitSize\n  };\n*}\ncode_reserved Haskell Uint dflt_size\n\ntext {*\n  OCaml and Scala provide only signed bit numbers, so we use these and \n  implement sign-sensitive operations like comparisons manually.\n*}\n\ncode_printing code_module \"Uint\" \\<rightharpoonup> (OCaml)\n{*module Uint : sig\n  type t = int\n  val dflt_size : Big_int.big_int\n  val less : t -> t -> bool\n  val less_eq : t -> t -> bool\n  val set_bit : t -> Big_int.big_int -> bool -> t\n  val shiftl : t -> Big_int.big_int -> t\n  val shiftr : t -> Big_int.big_int -> t\n  val shiftr_signed : t -> Big_int.big_int -> t\n  val test_bit : t -> Big_int.big_int -> bool\nend = struct\n\ntype t = int\n\nlet dflt_size = Big_int.big_int_of_int (\n  let rec f n = if n=0 then 0 else f (n / 2) + 1 in f min_int);;\n\n(* negative numbers have their highest bit set, \n   so they are greater than positive ones *)\nlet less x y =\n  if x<0 then\n    y<0 && x<y\n  else y < 0 || x < y;;\n\nlet less_eq x y =\n  if x < 0 then\n    y < 0 &&  x <= y\n  else y < 0 || x <= y;;\n\nlet set_bit x n b =\n  let mask = 1 lsl (Big_int.int_of_big_int n)\n  in if b then x lor mask\n     else x land (lnot mask);;\n\nlet shiftl x n = x lsl (Big_int.int_of_big_int n);;\n\nlet shiftr x n = x lsr (Big_int.int_of_big_int n);;\n\nlet shiftr_signed x n = x asr (Big_int.int_of_big_int n);;\n\nlet test_bit x n = x land (1 lsl (Big_int.int_of_big_int n)) <> 0;;\n\nend;; (*struct Uint*)*}\ncode_reserved OCaml Uint\n\ncode_printing code_module Uint \\<rightharpoonup> (Scala)\n{*object Uint {\ndef dflt_size : BigInt = BigInt(32)\n\ndef less(x: Int, y: Int) : Boolean =\n  if (x < 0) y < 0 && x < y\n  else y < 0 || x < y\n\ndef less_eq(x: Int, y: Int) : Boolean =\n  if (x < 0) y < 0 && x <= y\n  else y < 0 || x <= y\n\ndef set_bit(x: Int, n: BigInt, b: Boolean) : Int =\n  if (b)\n    x | (1 << n.intValue)\n  else\n    x & (1 << n.intValue).unary_~\n\ndef shiftl(x: Int, n: BigInt) : Int = x << n.intValue\n\ndef shiftr(x: Int, n: BigInt) : Int = x >>> n.intValue\n\ndef shiftr_signed(x: Int, n: BigInt) : Int = x >> n.intValue\n\ndef test_bit(x: Int, n: BigInt) : Boolean =\n  (x & (1 << n.intValue)) != 0\n\n} /* object Uint */*}\ncode_reserved Scala Uint\n\n\ntext {*\n  OCaml's conversion from Big\\_int to int demands that the value fits int a signed integer.\n  The following justifies the implementation.\n*}\n\ncontext includes integer.lifting begin\ndefinition wivs_mask :: int where \"wivs_mask == (2^(dflt_size) - 1)\"\nlift_definition wivs_mask_integer :: integer is wivs_mask .\n\n\ndefinition wivs_shift :: int where \"wivs_shift == (2^(dflt_size))\"\nlift_definition wivs_shift_integer :: integer is wivs_shift .\nlemma [code]: \"wivs_shift_integer = (2^dflt_size)\"\n  by transfer (simp add: wivs_shift_def)\n\ndefinition wivs_index :: nat where \"wivs_index == dflt_size - 1\"\nlift_definition wivs_index_integer :: integer is \"int wivs_index\".\nlemma wivs_index_integer_code[code]: \"wivs_index_integer = dflt_size_integer - 1\"\n  apply transfer apply (simp add: wivs_index_def)\n  by (metis One_nat_def add_diff_cancel2 dflt_size(1) diff_Suc_1 \n    less_nat_zero_code nat.exhaust of_nat_Suc)\n\ndefinition wivs_overflow :: int where \"wivs_overflow == (2^(dflt_size - 1))\"\nlift_definition wivs_overflow_integer :: integer is wivs_overflow .\nlemma [code]: \"wivs_overflow_integer = (2^(dflt_size - 1))\"\n  by transfer (simp add: wivs_overflow_def)\n\ndefinition wivs_least :: int where \"wivs_least == - wivs_overflow\"\nlift_definition wivs_least_integer :: integer is wivs_least .\nlemma [code]: \"wivs_least_integer = - (2^(dflt_size - 1))\"\n  by transfer (simp add: wivs_overflow_def wivs_least_def)\n\ndefinition Uint_signed :: \"integer \\<Rightarrow> uint\" \nwhere \"Uint_signed i = (if i < wivs_least_integer \n  \\<or> wivs_overflow_integer \\<le> i then undefined Uint i else Uint i)\"\n\nlemma Uint_code [code]:\n  \"Uint i = \n  (let i' = i AND wivs_mask_integer\n   in \n     if i' !! wivs_index then \n       Uint_signed (i' - wivs_shift_integer) \n     else Uint_signed i')\"\n  including undefined_transfer \n  unfolding Uint_signed_def\n  apply transfer\n  apply (rule word_of_int_via_signed)\n  by (simp_all add: wivs_mask_def wivs_shift_def wivs_index_def wivs_overflow_def \n    wivs_least_def bin_mask_conv_pow2 shiftl_int_def)\n\nlemma Uint_signed_code [code abstract]:\n  \"Rep_uint (Uint_signed i) = \n  (if i < wivs_least_integer \\<or> i \\<ge> wivs_overflow_integer then Rep_uint (undefined Uint i) else word_of_int (int_of_integer_symbolic i))\"\n  unfolding Uint_signed_def Uint_def int_of_integer_symbolic_def word_of_integer_def\n  by(simp add: Abs_uint_inverse)\nend\n\ntext {* \n  Avoid @{term Abs_uint} in generated code, use @{term Rep_uint'} instead. \n  The symbolic implementations for code\\_simp use @{term Rep_uint}.\n\n  The new destructor @{term Rep_uint'} is executable.\n  As the simplifier is given the [code abstract] equations literally, \n  we cannot implement @{term Rep_uint} directly, because that makes code\\_simp loop.\n\n  If code generation raises Match, some equation probably contains @{term Rep_uint} \n  ([code abstract] equations for @{typ uint} may use @{term Rep_uint} because\n  these instances will be folded away.)\n*}\n\ndefinition Rep_uint' where [simp]: \"Rep_uint' = Rep_uint\"\n\nlemma Rep_uint'_code [code]: \"Rep_uint' x = (BITS n. x !! n)\"\nunfolding Rep_uint'_def by transfer simp\n\ndeclare [[code drop: \"term_of_class.term_of :: uint \\<Rightarrow> _\"]]\n\nlemma term_of_uint_code [code]:\n  defines \"TR \\<equiv> typerep.Typerep\" and \"bit0 \\<equiv> STR ''Numeral_Type.bit0''\" \n  shows\n  \"term_of_class.term_of x = \n   Code_Evaluation.App (Code_Evaluation.Const (STR ''Uint.uint.Abs_uint'') (TR (STR ''fun'') [TR (STR ''Word.word'')  [TR (STR ''Uint.dflt_size'') []], TR (STR ''Uint.uint'') []]))\n       (term_of_class.term_of (Rep_uint' x))\"\n  by(simp add: term_of_anything)\n\ntext {* Important:\n  We must prevent the reflection oracle (eval-tac) to \n  use our machine-dependent type.\n *}\n\ncode_printing\n  type_constructor uint \\<rightharpoonup>\n  (SML) \"Word.word\" and\n  (Haskell) \"Uint.Word\" and\n  (OCaml) \"Uint.t\" and\n  (Scala) \"Int\" and\n  (Eval) \"*** \\\"Error: Machine dependent type\\\" ***\" and\n  (Quickcheck) \"Word.word\" \n| constant dflt_size_integer \\<rightharpoonup>\n  (SML) \"(IntInf.fromLarge (Int.toLarge Word.wordSize))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.wordSize\" and\n  (Haskell) \"Uint.dflt'_size\" and\n  (OCaml) \"Uint.dflt'_size\" and\n  (Scala) \"Uint.dflt'_size\"\n| constant Uint \\<rightharpoonup>\n  (SML) \"Word.fromLargeInt (IntInf.toLarge _)\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.fromInt\" and\n  (Haskell) \"(Prelude.fromInteger _ :: Uint.Word)\" and\n  (Haskell_Quickcheck) \"(Prelude.fromInteger (Prelude.toInteger _) :: Uint.Word)\" and\n  (Scala) \"_.intValue\"\n| constant Uint_signed \\<rightharpoonup>\n  (OCaml) \"Big'_int.int'_of'_big'_int\"\n| constant \"0 :: uint\" \\<rightharpoonup>\n  (SML) \"(Word.fromInt 0)\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"(Word.fromInt 0)\" and\n  (Haskell) \"(0 :: Uint.Word)\" and\n  (OCaml) \"0\" and\n  (Scala) \"0\"\n| constant \"1 :: uint\" \\<rightharpoonup>\n  (SML) \"(Word.fromInt 1)\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"(Word.fromInt 1)\" and\n  (Haskell) \"(1 :: Uint.Word)\" and\n  (OCaml) \"1\" and\n  (Scala) \"1\"\n| constant \"plus :: uint \\<Rightarrow> _ \" \\<rightharpoonup>\n  (SML) \"Word.+ ((_), (_))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.+ ((_), (_))\" and\n  (Haskell) infixl 6 \"+\" and\n  (OCaml) \"Pervasives.(+)\" and\n  (Scala) infixl 7 \"+\"\n| constant \"uminus :: uint \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML) \"Word.~\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.~\" and\n  (Haskell) \"negate\" and\n  (OCaml) \"Pervasives.(~-)\" and\n  (Scala) \"!(- _)\"\n| constant \"minus :: uint \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML) \"Word.- ((_), (_))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.- ((_), (_))\" and\n  (Haskell) infixl 6 \"-\" and\n  (OCaml) \"Pervasives.(-)\" and\n  (Scala) infixl 7 \"-\"\n| constant \"times :: uint \\<Rightarrow> _ \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML) \"Word.* ((_), (_))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.* ((_), (_))\" and\n  (Haskell) infixl 7 \"*\" and\n  (OCaml) \"Pervasives.( * )\" and\n  (Scala) infixl 8 \"*\"\n| constant \"HOL.equal :: uint \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML) \"!((_ : Word.word) = _)\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"!((_ : Word.word) = _)\" and\n  (Haskell) infix 4 \"==\" and\n  (OCaml) \"(Pervasives.(=):Uint.t -> Uint.t -> bool)\" and\n  (Scala) infixl 5 \"==\"\n| class_instance uint :: equal \\<rightharpoonup>\n  (Haskell) -\n| constant \"less_eq :: uint \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML) \"Word.<= ((_), (_))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.<= ((_), (_))\" and\n  (Haskell) infix 4 \"<=\" and\n  (OCaml) \"Uint.less'_eq\" and\n  (Scala) \"Uint.less'_eq\"\n| constant \"less :: uint \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML) \"Word.< ((_), (_))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.< ((_), (_))\" and\n  (Haskell) infix 4 \"<\" and\n  (OCaml) \"Uint.less\" and\n  (Scala) \"Uint.less\"\n| constant \"bitNOT :: uint \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML) \"Word.notb\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.notb\" and\n  (Haskell) \"Data'_Bits.complement\" and\n  (OCaml) \"Pervasives.lnot\" and\n  (Scala) \"_.unary'_~\"\n| constant \"bitAND :: uint \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML) \"Word.andb ((_),/ (_))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.andb ((_),/ (_))\" and\n  (Haskell) infixl 7 \"Data_Bits..&.\" and\n  (OCaml) \"Pervasives.(land)\" and\n  (Scala) infixl 3 \"&\"\n| constant \"bitOR :: uint \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML) \"Word.orb ((_),/ (_))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.orb ((_),/ (_))\" and\n  (Haskell) infixl 5 \"Data_Bits..|.\" and\n  (OCaml) \"Pervasives.(lor)\" and\n  (Scala) infixl 1 \"|\"\n| constant \"bitXOR :: uint \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML) \"Word.xorb ((_),/ (_))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.xorb ((_),/ (_))\" and\n  (Haskell) \"Data'_Bits.xor\" and\n  (OCaml) \"Pervasives.(lxor)\" and\n  (Scala) infixl 2 \"^\"\n\ndefinition uint_divmod :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint \\<times> uint\" where\n  \"uint_divmod x y = \n  (if y = 0 then (undefined (op div :: uint \\<Rightarrow> _) x (0 :: uint), undefined (op mod :: uint \\<Rightarrow> _) x (0 :: uint)) \n  else (x div y, x mod y))\"\n\ndefinition uint_div :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\" \nwhere \"uint_div x y = fst (uint_divmod x y)\"\n\ndefinition uint_mod :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\" \nwhere \"uint_mod x y = snd (uint_divmod x y)\"\n\nlemma div_uint_code [code]: \"x div y = (if y = 0 then 0 else uint_div x y)\"\nincluding undefined_transfer unfolding uint_divmod_def uint_div_def\nby transfer(simp add: word_div_def)\n\nlemma mod_uint_code [code]: \"x mod y = (if y = 0 then x else uint_mod x y)\"\nincluding undefined_transfer unfolding uint_mod_def uint_divmod_def\nby transfer(simp add: word_mod_def)\n\ndefinition uint_sdiv :: \"uint \\<Rightarrow> uint \\<Rightarrow> uint\"\nwhere [code del]:\n  \"uint_sdiv x y =\n   (if y = 0 then undefined (op div :: uint \\<Rightarrow> _) x (0 :: uint)\n    else Abs_uint (Rep_uint x sdiv Rep_uint y))\"\n\ndefinition div0_uint :: \"uint \\<Rightarrow> uint\"\nwhere [code del]: \"div0_uint x = undefined (op div :: uint \\<Rightarrow> _) x (0 :: uint)\"\ndeclare [[code abort: div0_uint]]\n\ndefinition mod0_uint :: \"uint \\<Rightarrow> uint\"\nwhere [code del]: \"mod0_uint x = undefined (op mod :: uint \\<Rightarrow> _) x (0 :: uint)\"\ndeclare [[code abort: mod0_uint]]\n\ndefinition wivs_overflow_uint :: uint \n  where \"wivs_overflow_uint \\<equiv> 1 << (dflt_size - 1)\"\n\n(* TODO: Move to Word *)\nlemma dflt_size_word_pow_ne_zero [simp]:\n  \"(2 :: 'a word) ^ (len_of TYPE('a::len) - Suc 0) \\<noteq> 0\"\nproof\n  assume \"(2 :: 'a word) ^ (len_of TYPE('a::len) - Suc 0) = 0\"\n  then have \"unat ((2 :: 'a word) ^ (len_of TYPE('a::len) - Suc 0)) = unat 0\"\n    by simp\n  then show False by (simp add: unat_p2)\nqed\n\nlemma uint_divmod_code [code]:\n  \"uint_divmod x y =\n  (if wivs_overflow_uint \\<le> y then if x < y then (0, x) else (1, x - y)\n   else if y = 0 then (div0_uint x, mod0_uint x)\n   else let q = (uint_sdiv (x >> 1) y) << 1;\n            r = x - q * y\n        in if r \\<ge> y then (q + 1, r - y) else (q, r))\"\n  including undefined_transfer \n  unfolding uint_divmod_def uint_sdiv_def div0_uint_def mod0_uint_def\n    wivs_overflow_uint_def\n  by transfer (simp add: divmod_via_sdivmod)\n\nlemma uint_sdiv_code [code abstract]:\n  \"Rep_uint (uint_sdiv x y) =\n   (if y = 0 then Rep_uint (undefined (op div :: uint \\<Rightarrow> _) x (0 :: uint))\n    else Rep_uint x sdiv Rep_uint y)\"\nunfolding uint_sdiv_def by(simp add: Abs_uint_inverse)\n\ntext {* \n  Note that we only need a translation for signed division, but not for the remainder\n  because @{thm uint_divmod_code} computes both with division only.\n*}\n\ncode_printing\n  constant uint_div \\<rightharpoonup>\n  (SML) \"Word.div ((_), (_))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.div ((_), (_))\" and\n  (Haskell) \"Prelude.div\"\n| constant uint_mod \\<rightharpoonup>\n  (SML) \"Word.mod ((_), (_))\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Word.mod ((_), (_))\" and\n  (Haskell) \"Prelude.mod\"\n| constant uint_divmod \\<rightharpoonup>\n  (Haskell) \"divmod\"\n| constant uint_sdiv \\<rightharpoonup>\n  (OCaml) \"Pervasives.('/)\" and\n  (Scala) \"_ '/ _\"\n\ndefinition uint_test_bit :: \"uint \\<Rightarrow> integer \\<Rightarrow> bool\"\nwhere [code del]:\n  \"uint_test_bit x n =\n  (if n < 0 \\<or> dflt_size_integer \\<le> n then undefined (test_bit :: uint \\<Rightarrow> _) x n\n   else x !! (nat_of_integer n))\"\n\nlemma test_bit_uint_code [code]:\n  \"test_bit x n \\<longleftrightarrow> n < dflt_size \\<and> uint_test_bit x (integer_of_nat n)\"\n  including undefined_transfer integer.lifting unfolding uint_test_bit_def\n  by transfer (auto cong: conj_cong dest: test_bit_size simp add: word_size)\n\nlemma uint_test_bit_code [code]:\n  \"uint_test_bit w n =\n  (if n < 0 \\<or> dflt_size_integer \\<le> n then undefined (test_bit :: uint \\<Rightarrow> _) w n else Rep_uint w !! nat_of_integer n)\"\nunfolding uint_test_bit_def\nby(simp add: test_bit_uint.rep_eq)\n\ncode_printing constant uint_test_bit \\<rightharpoonup>\n  (SML) \"Uint.test'_bit\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Uint.test'_bit\" and\n  (Haskell) \"Data'_Bits.testBitBounded\" and\n  (OCaml) \"Uint.test'_bit\" and\n  (Scala) \"Uint.test'_bit\"\n\ndefinition uint_set_bit :: \"uint \\<Rightarrow> integer \\<Rightarrow> bool \\<Rightarrow> uint\"\nwhere [code del]:\n  \"uint_set_bit x n b =\n  (if n < 0 \\<or> dflt_size_integer \\<le> n then undefined (set_bit :: uint \\<Rightarrow> _) x n b\n   else set_bit x (nat_of_integer n) b)\"\n\nlemma set_bit_uint_code [code]:\n  \"set_bit x n b = (if n < dflt_size then uint_set_bit x (integer_of_nat n) b else x)\"\n  including undefined_transfer integer.lifting unfolding uint_set_bit_def\n  by (transfer) (auto cong: conj_cong simp add: not_less set_bit_beyond word_size)\n\nlemma uint_set_bit_code [code abstract]:\n  \"Rep_uint (uint_set_bit w n b) = \n  (if n < 0 \\<or> dflt_size_integer \\<le> n then Rep_uint (undefined (set_bit :: uint \\<Rightarrow> _) w n b)\n   else set_bit (Rep_uint w) (nat_of_integer n) b)\"\nincluding undefined_transfer integer.lifting unfolding uint_set_bit_def by transfer simp\n\ncode_printing constant uint_set_bit \\<rightharpoonup>\n  (SML) \"Uint.set'_bit\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Uint.set'_bit\" and\n  (Haskell) \"Data'_Bits.setBitBounded\" and\n  (OCaml) \"Uint.set'_bit\" and\n  (Scala) \"Uint.set'_bit\"\n\nlift_definition uint_set_bits :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> uint \\<Rightarrow> nat \\<Rightarrow> uint\" is set_bits_aux .\n\nlemma uint_set_bits_code [code]:\n  \"uint_set_bits f w n =\n  (if n = 0 then w \n   else let n' = n - 1 in uint_set_bits f ((w << 1) OR (if f n' then 1 else 0)) n')\"\nby(transfer fixing: n)(cases n, simp_all)\n\nlemma set_bits_uint [code]:\n  \"(BITS n. f n) = uint_set_bits f 0 dflt_size\"\n  by transfer (simp add: set_bits_conv_set_bits_aux)\n\nlemma lsb_code [code]: fixes x :: uint shows \"lsb x = x !! 0\"\nby transfer(simp add: word_lsb_def word_test_bit_def)\n\ndefinition uint_shiftl :: \"uint \\<Rightarrow> integer \\<Rightarrow> uint\"\nwhere [code del]:\n  \"uint_shiftl x n = (if n < 0 \\<or> dflt_size_integer \\<le> n then undefined (shiftl :: uint \\<Rightarrow> _) x n else x << (nat_of_integer n))\"\n\nlemma shiftl_uint_code [code]: \"x << n = (if n < dflt_size then uint_shiftl x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint_shiftl_def\nby transfer(simp add: not_less shiftl_zero_size word_size)\n\nlemma uint_shiftl_code [code abstract]:\n  \"Rep_uint (uint_shiftl w n) =\n  (if n < 0 \\<or> dflt_size_integer \\<le> n then Rep_uint (undefined (shiftl :: uint \\<Rightarrow> _) w n) else Rep_uint w << (nat_of_integer n))\"\nincluding undefined_transfer integer.lifting unfolding uint_shiftl_def by transfer simp\n\ncode_printing constant uint_shiftl \\<rightharpoonup>\n  (SML) \"Uint.shiftl\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Uint.shiftl\" and\n  (Haskell) \"Data'_Bits.shiftlBounded\" and\n  (OCaml) \"Uint.shiftl\" and\n  (Scala) \"Uint.shiftl\"\n\ndefinition uint_shiftr :: \"uint \\<Rightarrow> integer \\<Rightarrow> uint\"\nwhere [code del]:\n  \"uint_shiftr x n = (if n < 0 \\<or> dflt_size_integer \\<le> n then undefined (shiftr :: uint \\<Rightarrow> _) x n else x >> (nat_of_integer n))\"\n\nlemma shiftr_uint_code [code]: \"x >> n = (if n < dflt_size then uint_shiftr x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint_shiftr_def\nby transfer(simp add: not_less shiftr_zero_size word_size)\n\nlemma uint_shiftr_code [code abstract]:\n  \"Rep_uint (uint_shiftr w n) =\n  (if n < 0 \\<or> dflt_size_integer \\<le> n then Rep_uint (undefined (shiftr :: uint \\<Rightarrow> _) w n) else Rep_uint w >> nat_of_integer n)\"\nincluding undefined_transfer unfolding uint_shiftr_def by transfer simp\n\ncode_printing constant uint_shiftr \\<rightharpoonup>\n  (SML) \"Uint.shiftr\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Uint.shiftr\" and\n  (Haskell) \"Data'_Bits.shiftrBounded\" and\n  (OCaml) \"Uint.shiftr\" and\n  (Scala) \"Uint.shiftr\"\n\ndefinition uint_sshiftr :: \"uint \\<Rightarrow> integer \\<Rightarrow> uint\"\nwhere [code del]:\n  \"uint_sshiftr x n =\n  (if n < 0 \\<or> dflt_size_integer \\<le> n then undefined sshiftr_uint x n else sshiftr_uint x (nat_of_integer n))\"\n\nlemma sshiftr_beyond: fixes x :: \"'a :: len word\" shows\n  \"size x \\<le> n \\<Longrightarrow> x >>> n = (if x !! (size x - 1) then -1 else 0)\"\nby(rule word_eqI)(simp add: nth_sshiftr word_size)\n\nlemma sshiftr_uint_code [code]:\n  \"x >>> n = \n  (if n < dflt_size then uint_sshiftr x (integer_of_nat n) else \n    if x !! wivs_index then -1 else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint_sshiftr_def\nby transfer(simp add: not_less sshiftr_beyond word_size wivs_index_def)\n\nlemma uint_sshiftr_code [code abstract]:\n  \"Rep_uint (uint_sshiftr w n) =\n  (if n < 0 \\<or> dflt_size_integer \\<le> n then Rep_uint (undefined sshiftr_uint w n) else Rep_uint w >>> (nat_of_integer n))\"\nincluding undefined_transfer unfolding uint_sshiftr_def by transfer simp\n\ncode_printing constant uint_sshiftr \\<rightharpoonup>\n  (SML) \"Uint.shiftr'_signed\" and\n  (Eval) \"(raise (Fail \\\"Machine dependent code\\\"))\" and\n  (Quickcheck) \"Uint.shiftr'_signed\" and\n  (Haskell) \n    \"(Prelude.fromInteger (Prelude.toInteger (Data'_Bits.shiftrBounded (Prelude.fromInteger (Prelude.toInteger _) :: Uint.Int) _)) :: Uint.Word)\" and\n  (OCaml) \"Uint.shiftr'_signed\" and\n  (Scala) \"Uint.shiftr'_signed\"\n\nlemma uint_msb_test_bit: \"msb x \\<longleftrightarrow> (x :: uint) !! wivs_index\"\nby transfer(simp add: msb_nth wivs_index_def)\n\nlemma msb_uint_code [code]: \"msb x \\<longleftrightarrow> uint_test_bit x wivs_index_integer\"\n  apply(simp add: uint_test_bit_def uint_msb_test_bit \n  wivs_index_integer_code dflt_size_integer_def wivs_index_def)\n  by (metis (full_types) One_nat_def dflt_size(2) less_iff_diff_less_0 \n    nat_of_integer_of_nat of_nat_1 of_nat_diff of_nat_less_0_iff wivs_index_def)\n\nlemma uint_of_int_code [code]: \"uint_of_int i = (BITS n. i !! n)\"\nby transfer(simp add: word_of_int_conv_set_bits test_bit_int_def[abs_def])\n\nsection {* Quickcheck setup *}\n\ndefinition uint_of_natural :: \"natural \\<Rightarrow> uint\"\nwhere \"uint_of_natural x \\<equiv> Uint (integer_of_natural x)\"\n\ninstantiation uint :: \"{random, exhaustive, full_exhaustive}\" begin\ndefinition \"random_uint \\<equiv> qc_random_cnv uint_of_natural\"\ndefinition \"exhaustive_uint \\<equiv> qc_exhaustive_cnv uint_of_natural\"\ndefinition \"full_exhaustive_uint \\<equiv> qc_full_exhaustive_cnv uint_of_natural\"\ninstance ..\nend\n\ninstantiation uint :: narrowing begin\n\ninterpretation quickcheck_narrowing_samples\n  \"\\<lambda>i. (Uint i, Uint (- i))\" \"0\"\n  \"Typerep.Typerep (STR ''Uint.uint'') []\" .\n\ndefinition \"narrowing_uint d = qc_narrowing_drawn_from (narrowing_samples d) d\"\ndeclare [[code drop: \"partial_term_of :: uint itself \\<Rightarrow> _\"]]\nlemmas partial_term_of_uint [code] = partial_term_of_code\n\ninstance ..\nend\n\nno_notation sshiftr_uint (infixl \">>>\" 55)\n\nend\n", "meta": {"author": "PLSysSec", "repo": "ct-wasm-proofs", "sha": "3fa5c38ecda3d05c351096ba5e6d7ba1df793c21", "save_path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs", "path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs/ct-wasm-proofs-3fa5c38ecda3d05c351096ba5e6d7ba1df793c21/CT-WASM_model/AFP/Native_Word/Uint.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.34569497312102565}}
{"text": "(*  Title:      HOL/MicroJava/BV/JVM.thy\n    Author:     Tobias Nipkow, Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nsection \\<open>LBV for the JVM \\label{sec:JVM}\\<close>\n\ntheory LBVJVM\nimports\n  \"../DFA/Abstract_BV\"\n  TF_JVM\nbegin\n\ntype_synonym prog_cert = \"cname \\<Rightarrow> mname \\<Rightarrow> ty\\<^sub>i' err list\"\n\ndefinition check_cert :: \"'addr jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> bool\"\nwhere\n  \"check_cert P mxs mxl n cert \\<equiv> check_types P mxs mxl cert \\<and> size cert = n+1 \\<and>\n                                 (\\<forall>i<n. cert!i \\<noteq> Err) \\<and> cert!n = OK None\"\n\ndefinition lbvjvm :: \"'addr jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> \n             ty\\<^sub>i' err list \\<Rightarrow> 'addr instr list \\<Rightarrow> ty\\<^sub>i' err \\<Rightarrow> ty\\<^sub>i' err\"\nwhere\n  \"lbvjvm P mxs maxr T\\<^sub>r et cert bs \\<equiv>\n  wtl_inst_list bs cert (JVM_SemiType.sup P mxs maxr) (JVM_SemiType.le P mxs maxr) Err (OK None) (exec P mxs T\\<^sub>r et bs) 0\"\n\ndefinition wt_lbv :: \"'addr jvm_prog \\<Rightarrow> cname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n             ex_table \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> 'addr instr list \\<Rightarrow> bool\"\nwhere\n  \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 et cert ins \\<equiv>\n   check_cert P mxs (1+size Ts+mxl\\<^sub>0) (size ins) cert \\<and>\n   0 < size ins \\<and> \n   (let start  = Some ([],(OK (Class C))#((map OK Ts))@(replicate mxl\\<^sub>0 Err));\n        result = lbvjvm P mxs (1+size Ts+mxl\\<^sub>0) T\\<^sub>r et cert ins (OK start)\n    in result \\<noteq> Err)\"\n\ndefinition wt_jvm_prog_lbv :: \"'addr jvm_prog \\<Rightarrow> prog_cert \\<Rightarrow> bool\"\nwhere\n  \"wt_jvm_prog_lbv P cert \\<equiv>\n  wf_prog (\\<lambda>P C (mn,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,b,et)). wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 et (cert C mn) b) P\"\n\ndefinition mk_cert :: \"'addr jvm_prog \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> 'addr instr list \n              \\<Rightarrow> ty\\<^sub>m \\<Rightarrow> ty\\<^sub>i' err list\"\nwhere\n  \"mk_cert P mxs T\\<^sub>r et bs phi \\<equiv> make_cert (exec P mxs T\\<^sub>r et bs) (map OK phi) (OK None)\"\n\ndefinition prg_cert :: \"'addr jvm_prog \\<Rightarrow> ty\\<^sub>P \\<Rightarrow> prog_cert\"\nwhere\n  \"prg_cert P phi C mn \\<equiv> let (C,Ts,T\\<^sub>r,meth) = method P C mn; (mxs,mxl\\<^sub>0,ins,et) = the meth\n                         in  mk_cert P mxs T\\<^sub>r et ins (phi C mn)\"\n   \nlemma check_certD [intro?]:\n  \"check_cert P mxs mxl n cert \\<Longrightarrow> cert_ok cert n Err (OK None) (states P mxs mxl)\"\n  by (unfold cert_ok_def check_cert_def check_types_def) auto\n\n\nlemma (in start_context) wt_lbv_wt_step:\n  assumes lbv: \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"\n  shows \"\\<exists>\\<tau>s \\<in> list (size is) A. wt_step r Err step \\<tau>s \\<and> OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\"\n(*<*)\nproof -\n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover note bounded_step\n  moreover from lbv have \"cert_ok cert (size is) Err (OK None) A\"\n    by (unfold wt_lbv_def) (auto dest: check_certD)\n  moreover note exec_pres_type\n  moreover\n  from lbv \n  have \"wtl_inst_list is cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (simp add: wt_lbv_def lbvjvm_def step_def_exec [symmetric])    \n  moreover note first_in_A\n  moreover from lbv have \"0 < size is\" by (simp add: wt_lbv_def)\n  ultimately show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])\nqed\n(*>*)\n\n\nlemma (in start_context) wt_lbv_wt_method:\n  assumes lbv: \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"  \n  shows \"\\<exists>\\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n(*<*)\nproof -\n  from lbv have l: \"is \\<noteq> []\" by (simp add: wt_lbv_def)\n  moreover\n  from wf lbv C Ts obtain \\<tau>s where \n    list:  \"\\<tau>s \\<in> list (size is) A\" and\n    step:  \"wt_step r Err step \\<tau>s\" and    \n    start: \"OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\" \n    by (blast dest: wt_lbv_wt_step)\n  from list have [simp]: \"size \\<tau>s = size is\" by simp\n  have \"size (map ok_val \\<tau>s) = size is\" by simp  \n  moreover from l have 0: \"0 < size \\<tau>s\" by simp\n  with step obtain \\<tau>s0 where \"\\<tau>s!0 = OK \\<tau>s0\"\n    by (unfold wt_step_def) blast\n  with start 0 have \"wt_start P C Ts mxl\\<^sub>0 (map ok_val \\<tau>s)\"\n    by (simp add: wt_start_def JVM_le_Err_conv lesub_def Err.le_def)    \n  moreover {\n    from list have \"check_types P mxs mxl \\<tau>s\" by (simp add: check_types_def)\n    also from step  have \"\\<forall>x \\<in> set \\<tau>s. x \\<noteq> Err\" \n      by (auto simp add: all_set_conv_all_nth wt_step_def)    \n    hence [symmetric]: \"map OK (map ok_val \\<tau>s) = \\<tau>s\"\n      by (auto intro!: map_idI)\n    finally have \"check_types P mxs mxl (map OK (map ok_val \\<tau>s))\" .\n  }\n  moreover {  \n    note bounded_step\n    moreover from list have \"set \\<tau>s \\<subseteq> A\" by simp\n    moreover from step have \"wt_err_step (sup_state_opt P) step \\<tau>s\"\n      by (simp add: wt_err_step_def JVM_le_Err_conv)\n    ultimately have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\<tau>s)\"\n      by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def states_def)\n  }    \n  ultimately have \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\<tau>s)\"\n    by (simp add: wt_method_def2 check_types_def del: map_map)\n  thus ?thesis ..\nqed\n(*>*)\n\n  \nlemma (in start_context) wt_method_wt_lbv:\n  assumes wt: \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\" \n  defines [simp]: \"cert \\<equiv> mk_cert P mxs T\\<^sub>r xt is \\<tau>s\"\n  \n  shows \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\" \n(*<*)\nproof -\n  let ?\\<tau>s  = \"map OK \\<tau>s\"\n  let ?cert = \"make_cert step ?\\<tau>s (OK None)\"\n\n  from wt obtain \n    0:        \"0 < size is\" and\n    size:     \"size is = size ?\\<tau>s\" and\n    ck_types: \"check_types P mxs mxl ?\\<tau>s\" and\n    wt_start: \"wt_start P C Ts mxl\\<^sub>0 \\<tau>s\" and\n    app_eff:  \"wt_app_eff (sup_state_opt P) app eff \\<tau>s\"\n    by (force simp add: wt_method_def2 check_types_def) \n  \n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover from wf have \"mono r step (size is) A\" by (rule step_mono)\n  hence \"mono r step (size ?\\<tau>s) A\" by (simp add: size)\n  moreover from exec_pres_type \n  have \"pres_type step (size ?\\<tau>s) A\" by (simp add: size) \n  moreover\n  from ck_types have \\<tau>s_in_A: \"set ?\\<tau>s \\<subseteq> A\" by (simp add: check_types_def)\n  hence \"\\<forall>pc. pc < size ?\\<tau>s \\<longrightarrow> ?\\<tau>s!pc \\<in> A \\<and> ?\\<tau>s!pc \\<noteq> Err\" by auto\n  moreover from bounded_step \n  have \"bounded step (size ?\\<tau>s)\" by (simp add: size)\n  moreover have \"OK None \\<noteq> Err\" by simp\n  moreover from bounded_step size \\<tau>s_in_A app_eff\n  have \"wt_err_step (sup_state_opt P) step ?\\<tau>s\"\n    by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def states_def)    \n  hence \"wt_step r Err step ?\\<tau>s\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  moreover\n  from 0 size have \"0 < size \\<tau>s\" by auto\n  hence \"?\\<tau>s!0 = OK (\\<tau>s!0)\" by simp\n  with wt_start have \"OK first \\<sqsubseteq>\\<^sub>r ?\\<tau>s!0\"\n    by (clarsimp simp add: wt_start_def lesub_def Err.le_def JVM_le_Err_conv)\n  moreover note first_in_A\n  moreover have \"OK first \\<noteq> Err\" by simp\n  moreover note size \n  ultimately\n  have \"wtl_inst_list is ?cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])\n  moreover from 0 size have \"\\<tau>s \\<noteq> []\" by auto\n  moreover from ck_types have \"check_types P mxs mxl ?cert\"\n    by (auto simp add: make_cert_def check_types_def JVM_states_unfold cong del: image_cong_simp)\n  moreover note 0 size\n  ultimately show ?thesis \n    by (simp add: wt_lbv_def lbvjvm_def mk_cert_def step_def_exec [symmetric]\n                  check_cert_def make_cert_def nth_append)\nqed  \n(*>*)\n\n\ntheorem jvm_lbv_correct:\n  \"wt_jvm_prog_lbv P Cert \\<Longrightarrow> wf_jvm_prog P\"\n(*<*)\nproof -  \n  let ?\\<Phi> = \"\\<lambda>C mn. let (C,Ts,T\\<^sub>r,meth) = method P C mn; (mxs,mxl\\<^sub>0,is,xt) = the meth in \n              SOME \\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n    \n  assume wt: \"wt_jvm_prog_lbv P Cert\"\n  hence \"wf_jvm_prog\\<^bsub>?\\<Phi>\\<^esub> P\"\n    apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def) \n    apply (erule wf_prog_lift)\n    apply(auto intro: someI_ex[OF start_context.wt_lbv_wt_method [OF start_context.intro]])\n    done\n  thus ?thesis by (unfold wf_jvm_prog_def) blast\nqed\n(*>*)\n\ntheorem jvm_lbv_complete:\n  assumes wt: \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\" \n  shows \"wt_jvm_prog_lbv P (prg_cert P \\<Phi>)\"\n(*<*)\n  using wt\n  apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def)\n  apply (erule wf_prog_lift)\n  apply (auto simp add: prg_cert_def \n              intro!: start_context.wt_method_wt_lbv start_context.intro)\n  done\n(*>*)\n\nend  \n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/BV/LBVJVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.34569497312102565}}
{"text": "theory BigStepDeterminism\nimports BigStepEvaluate\nbegin\n\ntheorem determinism [elim]: \"e \\<Down> v \\<Longrightarrow> e \\<Down> v' \\<Longrightarrow> v = v'\"\n  proof (induction e v arbitrary: v' rule: reduce.induct)\n  case (red_var x)\n    thus ?case by (induction \"Var x\" v' rule: reduce.induct) blast+\n  next case (red_abs t e)\n    thus ?case by (induction \"Abs t e\" v' rule: reduce.induct) blast+\n  next case (red_app e\\<^sub>1 _ _ e\\<^sub>2)\n    with red_app(5) show ?case by (induction \"App e\\<^sub>1 e\\<^sub>2\" v' rule: reduce.induct) blast+\n  next case (red_app_let e\\<^sub>1 _ _ e\\<^sub>2)\n    with red_app_let(5) show ?case by (induction \"App e\\<^sub>1 e\\<^sub>2\" v' rule: reduce.induct) blast+\n  next case (red_let_0 _ e\\<^sub>2 e\\<^sub>1)\n    with red_let_0(8) show ?case by (induction \"Let e\\<^sub>1 e\\<^sub>2\" v' rule: reduce.induct) blast+\n  next case (red_let_S _ e\\<^sub>2 e\\<^sub>1)\n    with red_let_S(4) show ?case by (induction \"Let e\\<^sub>1 e\\<^sub>2\" v' rule: reduce.induct) metis+\n  next case (red_rec xs)\n    thus ?case by (induction \"Rec xs\" v' rule: reduce.induct) blast+\n  next case (red_proj _ l _ e)\n    with red_proj(4) show ?case by (induction \"Proj e l\" v' rule: reduce.induct) fastforce+\n  next case (red_proj_let e _ _ l)\n    with red_proj_let(5) show ?case by (induction \"Proj e l\" v' rule: reduce.induct) blast+\n  next case (red_inj l ts x)\n    thus ?case by (induction \"Inj l ts x\" v' rule: reduce.induct) blast+\n  next case (red_case cs l e' e ts x v t)\n    with red_case(6) show ?case \n      proof (induction \"Case e t cs\" v' rule: reduce.induct)\n      case (red_case l\\<^sub>2 e'\\<^sub>2 ts\\<^sub>2 x\\<^sub>2 v\\<^sub>2)\n        from red_case(2, 8) have \"l\\<^sub>2 = l \\<and> ts\\<^sub>2 = ts \\<and> x\\<^sub>2 = x\" by blast\n        with red_case(1, 4, 5, 9) show ?case by simp\n      qed blast+\n  next case (red_case_let e e\\<^sub>1 e\\<^sub>2 t cs v)\n    with red_case_let(5) show ?case\n      proof (induction \"Case e t cs\" v' rule: reduce.induct)\n      case (red_case_let e\\<^sub>1' e\\<^sub>2' v')\n        from red_case_let(1, 6) have \"e\\<^sub>1' = e\\<^sub>1 \\<and> e\\<^sub>2' = e\\<^sub>2\" by blast\n        with red_case_let(3, 7) show ?case by simp\n      qed blast+\n  next case (red_fold t x)\n    thus ?case by (induction \"Fold t x\" v' rule: reduce.induct) blast+\n  next case (red_unfold e t)\n    with red_unfold(3) show ?case by (induction \"Unfold t e\" v' rule: reduce.induct) blast+\n  next case (red_unfold_let e _ _ t)\n    with red_unfold_let(5) show ?case by (induction \"Unfold t e\" v' rule: reduce.induct) blast+\n  next case (red_tyabs k e)\n    thus ?case by (induction \"TyAbs k e\" v' rule: reduce.induct) blast+\n  next case (red_tyapp e _ _ t)\n    with red_tyapp(5) show ?case by (induction \"TyApp e t\" v' rule: reduce.induct) blast+\n  next case (red_tyapp_let e _ _ t)\n    with red_tyapp_let(5) show ?case by (induction \"TyApp e t\" v' rule: reduce.induct) blast+\n  next case (red_tylet t e)\n    with red_tylet(3) show ?case by (induction \"TyLet t e\" v' rule: reduce.induct) blast+\n  qed\n\nend", "meta": {"author": "xtreme-james-cooper", "repo": "LazyCompiler", "sha": "3b95c3550e0cce4966aaf45c7eb38f2cbc2bfbfa", "save_path": "github-repos/isabelle/xtreme-james-cooper-LazyCompiler", "path": "github-repos/isabelle/xtreme-james-cooper-LazyCompiler/LazyCompiler-3b95c3550e0cce4966aaf45c7eb38f2cbc2bfbfa/01Expression/01BigStep/BigStepDeterminism.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.34569497312102565}}
{"text": "theory PTSO\n  imports Main\nbegin\n\ntype_synonym ('a,'b) m = \"'a \\<Rightarrow> 'b\"\n\nlemma rtrancl_summ:\n  assumes \"A\\<^sup>*\\<^sup>* m m'\"\n  assumes sub: \"\\<forall>m m'. A m m' \\<longrightarrow> B m m'\"\n  assumes refl: \"\\<forall>m. B m m\"\n  assumes trans: \"\\<forall>m m' m''. B m m' \\<longrightarrow> B m' m'' \\<longrightarrow> B m m''\"\n  shows \"B m m'\"\n  using assms(1)\nproof (induct)\n  case base\n  then show ?case using refl by auto\nnext\n  case (step m' m'')\n  then show ?case using sub trans by auto\nqed\n\nsection \\<open>List Utilities\\<close>\n\nlemma post_preE:\n  assumes \"A @ [e] = s # B\"\n  obtains (empty) \"A = []\" \"B = []\" \"e = s\" |\n          (mid) l where \"A = s # l\" \"B = l @ [e]\"\n  using assms by (cases A) auto\n\nlemma pre_postE:\n  assumes \"s # B = A @ [e]\"\n  obtains (empty) \"A = []\" \"B = []\" \"e = s\" |\n          (mid) l where \"A = s # l\" \"B = l @ [e]\"\n  using assms by (cases A) auto\n\nsubsection \\<open>lastf\\<close>\n\nfun lastf\n  where \n    \"lastf f [] = None\" |\n    \"lastf f (e#l) = (case lastf f l of Some v \\<Rightarrow> Some v | None \\<Rightarrow> (if f e then Some e else None))\"\n\nlemma lastf_none [simp]:\n  assumes \"\\<forall>x \\<in> set l. \\<not> f x\"\n  shows \"lastf f l = None\"\n  using assms by (induct l) (auto)\n\nlemma lastf_append [simp]:\n  assumes \"f a\"\n  shows \"lastf f (p @ [a]) = Some a\"\n  using assms by (induct p) (auto)\n\nlemma lastf_concat [simp]:\n  \"lastf f (p@l) = (case lastf f l of Some v \\<Rightarrow> Some v  | None \\<Rightarrow> lastf f p)\"\n  by (induct p) (auto split: option.splits)\n\nlemma lastf_some [intro]:\n  \"lastf f l = Some a \\<Longrightarrow> f a\"\n  by (induct l) (auto split: option.splits if_splits)\n\nsection \\<open>Events\\<close>\n\ndatatype ('a,'b) event =\n  W \"'a\" \"'b\" |\n  R \"'a\" \"'b\" |\n  MF |\n  SF |\n  FL \"'a\" |\n  FO \"'a\" \n(*\n  RMW \"'a\" \"'b\" \"'b\" |\n  RMF \"'a\" \"'b\" *)\n\nfun vars\n  where\n    \"vars (W x _) = {x}\" |\n    \"vars (R x _) = {x}\" |\n    \"vars (FL x) = {x}\" |\n    \"vars (FO x) = {x}\" |\n    \"vars _ = {}\"\n\nsection \\<open>Persistent Buffer Events\\<close>\n\ndatatype ('t,'b) pevent =\n  PFO \"'t\" |\n  PW \"'b\"\n\nfun isPW :: \"('t,'b) pevent \\<Rightarrow> bool\"\n  where \n    \"isPW (PW _) = True\" |\n    \"isPW _ = False\"\n\nfun isPFO :: \"('t,'b) pevent \\<Rightarrow> bool\"\n  where \n    \"isPFO (PFO _) = True\" | \n    \"isPFO _ = False\"\n\nsection \\<open>State\\<close>\n\nrecord ('a,'t,'b) state =\n  persistent :: \"('a,'b) m\"\n  buffers :: \"'a \\<Rightarrow> ('t,'b) pevent list\"\n  tbuffers :: \"'t \\<Rightarrow> ('a,'b) event list\"\n\nfun isWX\n  where \"isWX x (W y v) = (x = y)\" | \"isWX _ _ = False\"\n\ndefinition get :: \"'t \\<Rightarrow> ('a,'t,'b) state \\<Rightarrow> 'a \\<Rightarrow> 'b\"\n  where \"get t m a \\<equiv> \n    (case lastf (isWX a) (tbuffers m t) of Some (W _ v) \\<Rightarrow> v | _ \\<Rightarrow>\n    (case lastf isPW (buffers m a) of Some (PW v) \\<Rightarrow> v | _ \\<Rightarrow> \n      persistent m a))\"\n\n\nabbreviation persistent_set :: \"('a,'t,'b) state \\<Rightarrow> 'a \\<Rightarrow> 'b \\<Rightarrow> ('a,'t,'b) state\" \n  (\"_\\<lbrakk>_ \\<^sub>p= _\\<rbrakk>\" [900,0,0] 900)\n  where \"persistent_set m x v \\<equiv> persistent_update (\\<lambda>b. b(x := v)) m\"\n\nabbreviation buffer_set :: \"('a,'t,'b) state \\<Rightarrow> 'a \\<Rightarrow> ('t,'b) pevent list \\<Rightarrow> ('a,'t,'b) state\" \n  (\"_\\<lbrakk>_ \\<^sub>b= _\\<rbrakk>\" [900,0,0] 900)\n  where \"buffer_set m x p \\<equiv> buffers_update (\\<lambda>b. b(x := p)) m\"\n\nabbreviation tbuffer_set :: \"('a,'t,'b) state \\<Rightarrow> 't \\<Rightarrow> ('a,'b) event list \\<Rightarrow> ('a,'t,'b) state\" \n  (\"_\\<lbrakk>_ \\<^sub>t= _\\<rbrakk>\" [900,0,0] 900)\n  where \"tbuffer_set m x p \\<equiv> tbuffers_update (\\<lambda>b. b(x := p)) m\"\n\nabbreviation buffer_app :: \"('a,'t,'b) state \\<Rightarrow> 'a \\<Rightarrow> ('t,'b) pevent \\<Rightarrow> ('a,'t,'b) state\" \n  (\"_\\<lbrakk>_ \\<^sub>@= _\\<rbrakk>\" [900,0,0] 900)\n  where \"buffer_app m x e \\<equiv> m\\<lbrakk>x \\<^sub>b= (buffers m x)@[e] \\<rbrakk>\"\n\nabbreviation tbuffer_app :: \"('a,'t,'b) state \\<Rightarrow> 't \\<Rightarrow> ('a,'b) event \\<Rightarrow> ('a,'t,'b) state\" \n  (\"_\\<lbrakk>_ \\<^sub>q= _\\<rbrakk>\" [900,0,0] 900)\n  where \"tbuffer_app m x e \\<equiv> m\\<lbrakk>x \\<^sub>t= (tbuffers m x)@[e] \\<rbrakk>\"\n\n\n\nlemma [simp]:\n  \"(\\<lambda>b. b(y := c)) \\<circ> (\\<lambda>b. b(x := g b)) = (\\<lambda>b. b(x := g b, y := c))\"\n  by auto\n\nlemma redundant_buffer_set [simp]:\n  assumes \"buffers m y = p\"\n  shows \"m\\<lbrakk>y \\<^sub>b= p\\<rbrakk> = m\"\n  using assms by auto\n\nlemma pers_buf_twist:\n  \"buffers_update g (persistent_update f m) = persistent_update f (buffers_update g m)\"\n  by (metis surjective update_convs(1,2))\n\nsection \\<open>Semantics\\<close>\n\ninductive step :: \"('a,'t,'b) state \\<Rightarrow> 't \\<Rightarrow> ('a,'b) event \\<Rightarrow> ('a,'t,'b) state \\<Rightarrow> bool\"\n  (\"\\<langle>_\\<rangle> -_,_\\<rightarrow> \\<langle>_\\<rangle>\")\n  where\n  wr: \"\\<langle>m\\<rangle> -t,W x v\\<rightarrow> \\<langle>m\\<lbrakk>t \\<^sub>q= W x v\\<rbrakk>\\<rangle>\" |\n  rd: \"get t m x = v \\<Longrightarrow> \\<langle>m\\<rangle> -t,R x v\\<rightarrow> \\<langle>m\\<rangle>\" |\n  mf: \"tbuffers m t = [] \\<Longrightarrow> \\<forall>y. PFO t \\<notin> set (buffers m y) \\<Longrightarrow> \\<langle>m\\<rangle> -t,MF\\<rightarrow> \\<langle>m\\<rangle>\" |\n  fl: \"\\<langle>m\\<rangle> -t,FL x\\<rightarrow> \\<langle>m\\<lbrakk>t \\<^sub>q= FL x\\<rbrakk>\\<rangle>\" |\n  fo: \"\\<langle>m\\<rangle> -t,FO x\\<rightarrow> \\<langle>m\\<lbrakk>t \\<^sub>q= FO x\\<rbrakk>\\<rangle>\" |\n  sf: \"\\<langle>m\\<rangle> -t,SF\\<rightarrow> \\<langle>m\\<lbrakk>t \\<^sub>q= SF\\<rbrakk>\\<rangle>\" \n\ndefinition eval :: \"'t \\<times> ('a,'b) event \\<Rightarrow> ('a,'t,'b) state rel\"\n  where \"eval a = {(m,m'). \\<langle>m\\<rangle> -fst a,snd a\\<rightarrow> \\<langle>m'\\<rangle>}\"\n\nlemma step_det:\n  assumes \"\\<langle>m\\<rangle> -t,\\<alpha>\\<rightarrow> \\<langle>m'\\<rangle>\"\n  assumes \"\\<langle>m\\<rangle> -t,\\<alpha>\\<rightarrow> \\<langle>m''\\<rangle>\"\n  shows \"m' = m''\"\n  using assms by (induct) (auto elim: step.cases)\n\nlemma eval_det:\n  assumes \"(m,m') \\<in> eval \\<alpha>\"\n  assumes \"(m,m'') \\<in> eval \\<alpha>\"\n  shows \"m' = m''\"\n  using assms by (auto simp: eval_def intro: step_det)\n\nsubsection \\<open>pre_fo\\<close>\n\ntext \\<open>Find a write before a PFO event in a buffer, returning None if there aren't any\\<close>\nfun pre_fo :: \"'t \\<Rightarrow> ('t,'b) pevent list \\<Rightarrow> 'b option\"\n  where \n    \"pre_fo t [] = None\" |\n    \"pre_fo t (PFO _#xs) = (if PFO t \\<in> set xs then pre_fo t xs else None)\" |\n    \"pre_fo t (PW x#PFO s#xs) = (if s = t \\<and> PFO t \\<notin> set xs then Some x else pre_fo t (PW x#xs))\" |\n    \"pre_fo t (PW x#xs) = pre_fo t xs\"\n\nlemma pre_fo_no_pfo [simp]:\n  assumes \"PFO t \\<notin> set l\" \n  shows \"pre_fo t l = None\"\n  using assms by (induct l rule: pre_fo.induct) auto\n\nlemma pre_fo_no_pw [simp]:\n  assumes \"\\<forall>e \\<in> set l. \\<not> isPW e\"\n  shows \"pre_fo t l = None\"\n  using assms by (induct l rule: pre_fo.induct) auto\n\nlemma pre_fo_pfo [simp]:\n  \"pre_fo t (l @ [PFO t]) = (case lastf isPW l of Some (PW v) \\<Rightarrow> Some v | _ \\<Rightarrow> None)\"\n  by (induct \"l@[PFO t]\" arbitrary: l rule: pre_fo.induct)\n      (auto elim!: pre_postE split: option.splits pevent.splits)\n\nlemma pre_fo_pw [simp]:\n  \"pre_fo t (l @ [PW v]) = pre_fo t l\"\n  by (induct \"l@[PW v]\" arbitrary: l rule: pre_fo.induct)\n      (auto elim!: pre_postE split: option.splits)\n\nlemma pre_fo_other [simp]:\n  \"s \\<noteq> t \\<Longrightarrow> pre_fo t (l @ [PFO s]) = pre_fo t l\"\n  by (induct \"l@[PFO t]\" arbitrary: l rule: pre_fo.induct)\n      (auto elim!: pre_postE split: option.splits pevent.splits)\n\nsubsection \\<open>get for @{term PFO} effects\\<close>\n\ntext \\<open>Persistent memory after an @{term MF} is evaluated\\<close>\ndefinition get\\<^sub>f :: \"'t \\<Rightarrow> ('a,'t,'b) state \\<Rightarrow> ('a,'b) m\"\n  where \"get\\<^sub>f t m a \\<equiv> case pre_fo t (buffers m a) of Some v \\<Rightarrow> v | None \\<Rightarrow> persistent m a\"\n\nlemma get\\<^sub>f_no_pfo[simp]:\n  assumes \"\\<forall>y. PFO t \\<notin> set (buffers m y)\"\n  shows \"get\\<^sub>f t m = persistent m\"\n  using assms by (auto simp: get\\<^sub>f_def fun_eq_iff split: option.splits)\n\nlemma get\\<^sub>f_no_pw[simp]:\n  assumes \"\\<forall>e \\<in> set (buffers m x). \\<not> isPW e\"\n  shows \"get\\<^sub>f t m x = persistent m x\"\n  using assms by (auto simp: get\\<^sub>f_def fun_eq_iff split: option.splits pevent.splits)\n\n\nlemma [simp]:\n  assumes \"\\<forall>e \\<in> set (buffers m x). \\<not> isPW e\"\n  shows \"get\\<^sub>f t (m\\<lbrakk>x \\<^sub>p= v\\<rbrakk>) = (get\\<^sub>f t m)(x := v)\"\n  using assms by (auto simp: get\\<^sub>f_def fun_eq_iff split: option.splits pevent.splits)\n\nlemma get\\<^sub>f_app_simps [simp]:\n  \"get\\<^sub>f t (m\\<lbrakk>x \\<^sub>@= PW v\\<rbrakk>) = (get\\<^sub>f t m)\"\n  by (auto simp: get_def get\\<^sub>f_def fun_eq_iff split: option.splits pevent.splits)\n\nlemma [simp]:\n  \"get\\<^sub>f t m x = c \\<Longrightarrow> (get\\<^sub>f t m)(x := c) = get\\<^sub>f t m\"\n  by auto\n\nlemma [simp]:\n  \"get\\<^sub>f t (m\\<lbrakk>x \\<^sub>p= v\\<rbrakk>\\<lbrakk>x \\<^sub>b= []\\<rbrakk>) = (get\\<^sub>f t m)(x := v)\"\n  unfolding get\\<^sub>f_def fun_eq_iff by (auto split: option.splits)\n\nlemma [simp]: \n  \"get\\<^sub>f t (m'\\<lbrakk>s \\<^sub>t= p\\<rbrakk>) = get\\<^sub>f t m'\"\n  by (auto simp: get\\<^sub>f_def fun_eq_iff option.splits)\n\nsubsection \\<open>get for shared memory\\<close>\n\ntext \\<open>Persistent memory after an @{term MF} is evaluated\\<close>\ndefinition get\\<^sub>s :: \"('a,'t,'b) state \\<Rightarrow> ('a,'b) m\"\n  where \"get\\<^sub>s m a \\<equiv> (case lastf isPW (buffers m a) of Some (PW v) \\<Rightarrow> v | _ \\<Rightarrow> persistent m a)\"\n\nlemma get\\<^sub>s_no_pw[simp]:\n  assumes \"\\<forall>e \\<in> set (buffers m x). \\<not> isPW e\"\n  shows \"get\\<^sub>s m x = persistent m x\"\n  using assms by (auto simp: get\\<^sub>s_def fun_eq_iff split: option.splits pevent.splits)\n\nlemma get\\<^sub>f_app_pfo [simp]:\n  \"get\\<^sub>f t (m\\<lbrakk>x \\<^sub>@= PFO t\\<rbrakk>) = (get\\<^sub>f t m)(x := get\\<^sub>s m x)\"\n  by (auto simp: get_def fun_eq_iff get\\<^sub>f_def get\\<^sub>s_def split: option.splits pevent.splits)\n\nlemma [simp]:\n  assumes \"\\<forall>e \\<in> set (buffers m x). \\<not> isPW e\"\n  shows \"get\\<^sub>s (m\\<lbrakk>x \\<^sub>p= v\\<rbrakk>) = (get\\<^sub>s m)(x := v)\"\n  using assms by (auto simp: get\\<^sub>s_def fun_eq_iff split: option.splits pevent.splits)\n\nlemma get\\<^sub>s_app_simps [simp]:\n  \"get\\<^sub>s (m\\<lbrakk>x \\<^sub>@= PW v\\<rbrakk>) = (get\\<^sub>s m)(x := v)\"\n  \"get\\<^sub>s (m\\<lbrakk>x \\<^sub>@= PFO t\\<rbrakk>) = (get\\<^sub>s m)\"\n  by (auto simp: get_def get\\<^sub>s_def fun_eq_iff split: option.splits pevent.splits)\n\nlemma [simp]:\n  \"get\\<^sub>s (m\\<lbrakk>x \\<^sub>p= v\\<rbrakk>\\<lbrakk>x \\<^sub>b= []\\<rbrakk>) = (get\\<^sub>s m)(x := v)\"\n  unfolding get\\<^sub>s_def fun_eq_iff by (auto split: option.splits pevent.splits)\n\nsection \\<open>Persistent Environment Steps\\<close>\n\ninductive prp :: \"('a,'t,'b) state \\<Rightarrow> 't \\<Rightarrow> ('a,'b) event \\<Rightarrow> ('a,'t,'b) state \\<Rightarrow> bool\"\n  (\"\\<langle>_\\<rangle> -_,_\\<leadsto> \\<langle>_\\<rangle>\")\n  where\n  prpw:  \"tbuffers m t = (W x v)#p \\<Longrightarrow> \\<langle>m\\<rangle> -t,W x v\\<leadsto> \\<langle>m\\<lbrakk>t \\<^sub>t= p\\<rbrakk>\\<lbrakk>x \\<^sub>@= PW v\\<rbrakk>\\<rangle>\" |\n  prpfl: \"tbuffers m t = (FL x)#p \\<Longrightarrow> buffers m x = [] \\<Longrightarrow> \\<langle>m\\<rangle> -t,FL x\\<leadsto> \\<langle>m\\<lbrakk>t \\<^sub>t= p\\<rbrakk>\\<rangle>\" |\n  prpfo: \"tbuffers m t = b\\<^sub>1@(FO x)#b\\<^sub>2 \\<Longrightarrow> set b\\<^sub>1 \\<inter> ({SF,FL x,FO x} \\<union> {W x v|v. True}) = {} \\<Longrightarrow> \n            \\<langle>m\\<rangle> -t,FO x\\<leadsto> \\<langle>m\\<lbrakk>t \\<^sub>t= b\\<^sub>1@b\\<^sub>2\\<rbrakk>\\<lbrakk>x \\<^sub>@= PFO t\\<rbrakk>\\<rangle>\" |\n  prpsf: \"tbuffers m t = SF#b \\<Longrightarrow> \\<forall>y. PFO t \\<notin> set (buffers m y) \\<Longrightarrow> \\<langle>m\\<rangle> -t,SF\\<leadsto> \\<langle>m\\<lbrakk>t \\<^sub>t= b\\<rbrakk>\\<rangle>\"\n\nfunction prpall where\n  \"prpall t m = (case tbuffers m t of [] \\<Rightarrow> m\n                                    | (W x v)#p \\<Rightarrow> prpall t (m\\<lbrakk>t \\<^sub>t= p\\<rbrakk>\\<lbrakk>x \\<^sub>@= PW v\\<rbrakk>)\n                                    | (FL x)#p \\<Rightarrow> prpall t (m\\<lbrakk>x \\<^sub>b= []\\<rbrakk>\\<lbrakk>x \\<^sub>p= get\\<^sub>s m x\\<rbrakk>\\<lbrakk>t \\<^sub>t= p\\<rbrakk>)\n                                    | (FO x)#p \\<Rightarrow> prpall t (m\\<lbrakk>t \\<^sub>t= p\\<rbrakk>\\<lbrakk>x \\<^sub>@= PFO t\\<rbrakk>)\n                                    | SF#p \\<Rightarrow> prpall t (m\\<lparr> persistent := get\\<^sub>f t m\\<rparr>\\<lbrakk>t \\<^sub>t= p\\<rbrakk>))\"\n  by pat_completeness auto\n  termination by (relation \"measure (\\<lambda>(m,t). length (tbuffers t m))\") auto\n\ndeclare prpall.simps[simp del]\n\nlemma prpwI:\n  assumes \"tbuffers m t = (W x v)#p\"\n  assumes \"m' = m\\<lbrakk>t \\<^sub>t= p\\<rbrakk>\\<lbrakk>x \\<^sub>@= PW v\\<rbrakk>\"\n  shows \"\\<langle>m\\<rangle> -t,W x v\\<leadsto> \\<langle>m'\\<rangle>\"\n  using prp.prpw assms by metis\n\nlemma prpflI:\n  assumes \"tbuffers m t = (FL x)#p\" \"buffers m x = []\"\n  assumes \"m' = m\\<lbrakk>t \\<^sub>t= p\\<rbrakk>\"\n  shows \"\\<langle>m\\<rangle> -t,FL x\\<leadsto> \\<langle>m'\\<rangle>\"\n  using prp.prpfl assms by metis\n\nlemma prpfoI:\n  assumes \"tbuffers m t =  b\\<^sub>1@(FO x)#b\\<^sub>2\" \"set b\\<^sub>1 \\<inter> ({SF,FL x,FO x} \\<union> {W x v|v. True}) = {}\"\n  assumes \"m' = m\\<lbrakk>t \\<^sub>t= b\\<^sub>1@b\\<^sub>2\\<rbrakk>\\<lbrakk>x \\<^sub>@= PFO t\\<rbrakk>\"\n  shows \"\\<langle>m\\<rangle> -t,FO x\\<leadsto> \\<langle>m'\\<rangle>\"\n  using prp.prpfo[OF assms(1,2)] assms(3) by auto\n\nlemma prpsfI:\n  assumes \"tbuffers m t = SF#b\" \"\\<forall>y. PFO t \\<notin> set (buffers m y)\"\n  assumes \"m' = m\\<lbrakk>t \\<^sub>t= b\\<rbrakk>\"\n  shows \"\\<langle>m\\<rangle> -t,SF\\<leadsto> \\<langle>m'\\<rangle>\"\n  using prp.prpsf assms by metis\n\ninductive env :: \"('a,'t,'b) state \\<Rightarrow> ('a,'t,'b) state \\<Rightarrow> bool\"\n  (\"\\<langle>_\\<rangle> -e\\<rightarrow> \\<langle>_\\<rangle>\")\n  where\n  pwr:   \"buffers m x = (PW v)#p \\<Longrightarrow> \\<langle>m\\<rangle> -e\\<rightarrow> \\<langle>m\\<lbrakk>x \\<^sub>p= v\\<rbrakk>\\<lbrakk>x \\<^sub>b= p\\<rbrakk>\\<rangle>\" |\n  pfo:   \"buffers m x = (PFO t)#p \\<Longrightarrow> \\<langle>m\\<rangle> -e\\<rightarrow> \\<langle>m\\<lbrakk>x \\<^sub>b= p\\<rbrakk>\\<rangle>\"\n\nlemma pwrI [intro]:\n  assumes \"buffers m x = (PW v)#p\"\n  assumes \"m' = m\\<lbrakk>x \\<^sub>p= v\\<rbrakk>\\<lbrakk>x \\<^sub>b= p\\<rbrakk>\"\n  shows \"\\<langle>m\\<rangle> -e\\<rightarrow> \\<langle>m'\\<rangle>\"\n  using env.pwr assms by metis\n\nlemma pfoI [intro]:\n  assumes \"buffers m x = (PFO t)#p\"\n  assumes \"m' = m\\<lbrakk>x \\<^sub>b= p\\<rbrakk>\"\n  shows \"\\<langle>m\\<rangle> -e\\<rightarrow> \\<langle>m'\\<rangle>\"\n  using env.pfo assms by metis\n\nsubsection \\<open>Persistent Properties\\<close>\n\nlemma env_get [simp]:\n  assumes \"env m m'\"\n  shows \"get t m x = get t m' x\"\n  using assms \n  by cases (auto simp: get_def fun_eq_iff split: option.splits pevent.splits event.splits)\n\nlemma env_get\\<^sub>s [simp]:\n  assumes \"env m m'\"\n  shows \"get\\<^sub>s m x = get\\<^sub>s m' x\"\n  using assms \n  by cases (auto simp: get\\<^sub>s_def fun_eq_iff split: option.splits pevent.splits event.splits)\n\nlemma envt_get [simp]:\n  assumes \"env\\<^sup>*\\<^sup>* m m'\"\n  shows \"get t m x = get t m' x\"\n  using assms\nproof (induct)\n  case base\n  then show ?case by auto\nnext\n  case (step y z)\n  then show ?case using env_get by metis\nqed\n\nlemma envt_get\\<^sub>s [simp]:\n  assumes \"env\\<^sup>*\\<^sup>* m m'\"\n  shows \"get\\<^sub>s m = get\\<^sub>s m'\"\n  using assms\nproof (induct)\n  case base\n  then show ?case by auto\nnext\n  case (step y z)\n  then show ?case using env_get\\<^sub>s by metis\nqed\n\nlemma env_pers_setE:\n  assumes \"env (m\\<^sub>1\\<lbrakk>x \\<^sub>p= v\\<rbrakk>) m\\<^sub>2\"\n  obtains (orth) m\\<^sub>3 where \"env m\\<^sub>1 m\\<^sub>3\" \"m\\<^sub>2 = m\\<^sub>3\\<lbrakk>x \\<^sub>p= v\\<rbrakk>\" |\n          (wr) v' l where \"m\\<^sub>2 = m\\<^sub>1\\<lbrakk>x \\<^sub>p= v'\\<rbrakk>\\<lbrakk>x \\<^sub>b= l\\<rbrakk>\" \"buffers m\\<^sub>1 x = (PW v')#l\"\n  using assms\nproof cases\n  case (pwr y v' p)\n  have e: \"\\<langle>m\\<^sub>1\\<rangle> -e\\<rightarrow> \\<langle>m\\<^sub>1\\<lbrakk>y \\<^sub>p= v'\\<rbrakk>\\<lbrakk>y \\<^sub>b= p\\<rbrakk>\\<rangle>\" using pwr by (auto intro: env.pwr)\n  then show ?thesis\n  proof (cases \"x = y\")\n    case True\n    then show ?thesis using pwr wr by auto\n  next\n    case False\n    then show ?thesis using pwr orth[OF e] by (simp add: fun_upd_twist)\n  qed\nnext\n  case (pfo y t p)\n  then show ?thesis using orth[of \"m\\<^sub>1\\<lbrakk>y \\<^sub>b= p\\<rbrakk>\"] by (auto intro: env.pfo)\nqed\n\nsubsection \\<open>Buffer Properties\\<close>\n\nlemma env_buffers:\n  assumes \"env m m'\"\n  obtains pre where \"buffers m x = pre @ buffers m' x\"\n  using assms \nproof cases\n  case (pwr y v p)\n  then show ?thesis using that by (cases \"x = y\") auto\nnext\n  case (pfo y t p)\n  then show ?thesis using that by (cases \"x = y\") auto\nqed\n\nlemma env_buffer_empty:\n  assumes \"env m m'\"\n  assumes \"buffers m x = []\"\n  shows \"buffers m' x = []\"\n  using assms env_buffers\n  by (metis Nil_is_append_conv)\n\nlemma envt_buffers:\n  assumes \"env\\<^sup>*\\<^sup>* m m'\"\n  obtains pre where \"buffers m x = pre @ buffers m' x\"\n  using assms\nproof (induct)\n  case base\n  then show ?case by auto\nnext\n  case (step y z)\n  then show ?case using env_buffers by (metis append.assoc)\nqed\n\nlemma envt_buffer_empty:\n  assumes \"env\\<^sup>*\\<^sup>* m m'\"\n  assumes \"buffers m x = []\"\n  shows \"buffers m' x = []\"\n  using assms by (auto elim!: envt_buffers[where x = x])\n\nlemma envt_buffer_subset:\n  assumes \"env\\<^sup>*\\<^sup>* m m'\"\n  shows \"set (buffers m' x) \\<subseteq> set (buffers m x)\"\n  using assms by (auto elim!: envt_buffers[where x = x])\n\nlemma env_tbuffer [simp]:\n  assumes \"env m m'\"\n  shows \"tbuffers m = tbuffers m'\"\n  using assms by cases auto\n\nsubsubsection \\<open>Introduction\\<close>\n\nlemma env_buffer_appI:\n  assumes \"env m m'\"\n  shows \"env (m\\<lbrakk>x \\<^sub>@= b\\<rbrakk>) (m'\\<lbrakk>x \\<^sub>@= b\\<rbrakk>)\"\n  using assms\nproof cases\n  case (pwr y v p)\n  thus ?thesis by (cases \"x = y\") (auto intro!: pwrI[where x=y] simp add: fun_upd_twist)\nnext\n  case (pfo y t p)\n  thus ?thesis by (cases \"x = y\") (auto intro!: pfoI[where x=y] simp add: fun_upd_twist)\nqed \n\nlemma envt_buffer_appI:\n  assumes \"env\\<^sup>*\\<^sup>* m m'\"\n  shows \"env\\<^sup>*\\<^sup>* (m\\<lbrakk>x \\<^sub>@= b\\<rbrakk>) (m'\\<lbrakk>x \\<^sub>@= b\\<rbrakk>)\"\n  using assms\nproof induct\n  case base\n  thus ?case by auto\nnext\n  case (step y z)\n  thus ?case by (blast intro: env_buffer_appI rtranclp.rtrancl_into_rtrancl)\nqed \n\nlemma envt_full_evalI:\n  shows \"env\\<^sup>*\\<^sup>* (m\\<lbrakk>x \\<^sub>@= PW v\\<rbrakk>) (m\\<lbrakk>x \\<^sub>p= v\\<rbrakk>\\<lbrakk>x \\<^sub>b= []\\<rbrakk>)\"\nproof (induct \"buffers m x\" arbitrary: m)\n  case Nil\n  hence \"env (m\\<lbrakk>x \\<^sub>@= PW v\\<rbrakk>) (m\\<lbrakk>x \\<^sub>p= v\\<rbrakk>\\<lbrakk>x \\<^sub>b= []\\<rbrakk>)\" by auto\n  then show ?case by blast\nnext\n  case (Cons pe p)\n  then show ?case  \n  proof (cases pe)\n    case (PFO t)\n    hence \"env (m\\<lbrakk>x \\<^sub>@= PW v\\<rbrakk>) (m\\<lbrakk>x \\<^sub>b= p @ [PW v]\\<rbrakk>)\" using Cons(2) by (intro pfoI[where t=t]) auto\n    then show ?thesis using Cons(1)[of \"m\\<lbrakk>x \\<^sub>b= p\\<rbrakk>\"] by auto\n  next\n    case (PW v')\n    hence \"env (m\\<lbrakk>x \\<^sub>@= PW v\\<rbrakk>) (m\\<lbrakk>x \\<^sub>p= v'\\<rbrakk>\\<lbrakk>x \\<^sub>b= p @ [PW v]\\<rbrakk>)\" using Cons(2) by (intro pwrI) auto\n    then show ?thesis using Cons(1)[of \"m\\<lbrakk>x \\<^sub>p= v'\\<rbrakk>\\<lbrakk>x \\<^sub>b= p\\<rbrakk>\"] by auto\n  qed\nqed\n\nlemma envt_buffer_app_evalI:\n  assumes \"env\\<^sup>*\\<^sup>* m m'\"\n  shows \"env\\<^sup>*\\<^sup>* (m\\<lbrakk>x \\<^sub>@= PW v\\<rbrakk>) (m'\\<lbrakk>x \\<^sub>p= v\\<rbrakk>\\<lbrakk>x \\<^sub>b= []\\<rbrakk>)\"\n  using envt_buffer_appI[OF assms] envt_full_evalI by (metis (mono_tags) rtranclp_trans)\n\nsubsubsection \\<open>Elimination\\<close>\n\nlemma env_buffer_appE:\n  assumes \"env (m\\<^sub>1\\<lbrakk>x \\<^sub>@= e\\<rbrakk>) m\\<^sub>2\"\n  obtains (orth) m\\<^sub>3 where \"env m\\<^sub>1 m\\<^sub>3\" \"m\\<^sub>2 = m\\<^sub>3\\<lbrakk>x \\<^sub>@= e\\<rbrakk>\" |\n          (wr) v where \"e = PW v\" \"m\\<^sub>2 = m\\<^sub>1\\<lbrakk>x \\<^sub>p= v\\<rbrakk>\" \"buffers m\\<^sub>1 x = []\" |\n          (fo) v where \"e = PFO v\" \"m\\<^sub>2 = m\\<^sub>1\" \"buffers m\\<^sub>1 x = []\"\n  using assms\nproof cases\n  case (pwr y v p)\n  then show ?thesis\n  proof (cases \"x = y\")\n    case True\n    hence \"buffers m\\<^sub>1 y @ [e] = PW v # p\" using pwr by auto\n    then show ?thesis \n    proof (cases rule: post_preE)\n      case empty\n      then show ?thesis using wr pwr True by auto\n    next\n      case (mid l)\n      then show ?thesis using orth[of \"m\\<^sub>1\\<lbrakk>y \\<^sub>p= v\\<rbrakk>\\<lbrakk>y \\<^sub>b= l\\<rbrakk>\"] pwr True by auto\n    qed\n  next\n    case False\n    then show ?thesis using pwr\n      by (intro orth[of \"m\\<^sub>1\\<lbrakk>y \\<^sub>p= v\\<rbrakk>\\<lbrakk>y \\<^sub>b= p\\<rbrakk>\"] pwrI) (auto simp: fun_upd_twist)\n  qed\nnext\n  case (pfo y t p)\n  then show ?thesis\n  proof (cases \"x = y\")\n    case True\n    hence \"buffers m\\<^sub>1 y @ [e] = PFO t # p\" using pfo by auto\n    then show ?thesis \n    proof (cases rule: post_preE)\n      case empty\n      then show ?thesis using fo pfo True by auto\n    next\n      case (mid l)\n      then show ?thesis using orth[of \"m\\<^sub>1\\<lbrakk>y \\<^sub>b= l\\<rbrakk>\"] pfo True by auto\n    qed\n  next\n    case False\n    then show ?thesis using pfo\n      by (intro orth[of \"m\\<^sub>1\\<lbrakk>y \\<^sub>b= p\\<rbrakk>\"] pfoI) (auto simp: fun_upd_twist)\n  qed\nqed\n\nlemma envt_buffer_appE:\n  assumes \"env\\<^sup>*\\<^sup>* (m\\<^sub>1\\<lbrakk>x \\<^sub>@= e\\<rbrakk>) m\\<^sub>2\"\n  obtains (orth) m\\<^sub>3 where \"env\\<^sup>*\\<^sup>* m\\<^sub>1 m\\<^sub>3\" \"m\\<^sub>2 = m\\<^sub>3\\<lbrakk>x \\<^sub>@= e\\<rbrakk>\" |\n          (pwr) m\\<^sub>3 v where \"e = PW v\" \"env\\<^sup>*\\<^sup>* m\\<^sub>1 m\\<^sub>3\" \"m\\<^sub>2 = m\\<^sub>3\\<lbrakk>x \\<^sub>p= v\\<rbrakk>\" \"buffers m\\<^sub>2 x = []\" |\n          (pfo) v where \"e = PFO v\" \"env\\<^sup>*\\<^sup>* m\\<^sub>1 m\\<^sub>2\" \"buffers m\\<^sub>2 x = []\" \n  using assms\nproof (induct \"m\\<^sub>1\\<lbrakk>x \\<^sub>@= e\\<rbrakk>\" m\\<^sub>2)\n  case rtrancl_refl\n  then show ?case by blast\nnext\n  case (rtrancl_into_rtrancl m\\<^sub>3 m\\<^sub>4)\n  show ?case\n  proof (rule rtrancl_into_rtrancl(2), goal_cases)\n    case (1 m\\<^sub>5)\n    hence \"env (m\\<^sub>5\\<lbrakk>x \\<^sub>@= e\\<rbrakk>) m\\<^sub>4\" using rtrancl_into_rtrancl(3) by simp\n    then show ?case\n    proof (cases rule: env_buffer_appE)\n      case (orth m\\<^sub>3')\n      then show ?thesis using rtrancl_into_rtrancl(4) 1(1) \n        by (blast intro: rtranclp.rtrancl_into_rtrancl)\n    next\n      case (wr v)\n      then show ?thesis using 1 rtrancl_into_rtrancl(5) by simp\n    next\n      case (fo v)\n      then show ?thesis using 1 rtrancl_into_rtrancl(6) by simp\n    qed\n  next\n    case (2 v m\\<^sub>5)\n    show ?case using rtrancl_into_rtrancl(3) unfolding 2\n    proof (cases rule: env_pers_setE)\n      case (orth m\\<^sub>6)\n      then show ?thesis using 2 rtrancl_into_rtrancl(3,5)\n        by (blast intro: env_buffer_empty rtranclp.rtrancl_into_rtrancl)\n    next\n      case (wr v' l)\n      then show ?thesis using 2 by auto\n    qed\n  next\n    case (3 v)\n    then show ?case using rtrancl_into_rtrancl(3,6) \n      by (metis env_buffer_empty rtranclp.rtrancl_into_rtrancl)\n  qed\nqed \n\nlemma prp_self_tbuffer:\n  assumes \"prp m t a m'\"\n  shows \"set (tbuffers m' t) \\<subseteq> set (tbuffers m t)\"\n  using assms by cases auto\n\nlemma prp_get\\<^sub>s_nevent [simp]:\n  assumes \"prp m t a m'\" \"tbuffers m t = []\"\n  shows \"get\\<^sub>s m x = get\\<^sub>s m' x\"\n  using assms by cases auto\n\nlemma [simp]:\n  assumes \"tbuffers m t = []\"\n  shows \"prp m t a m' = False\"\n  apply auto\n  using assms\n  apply (cases \"prp m t a m'\")\n   apply (cases rule: prp.cases, blast; clarsimp)\n  by auto\n\nsection \\<open>Predicate Language\\<close>\n\ntext \\<open>Predicate abstraction to simplify specification, consisting of: \n      (volatile memory, persistent memory, memory after an mfence)\\<close>\ntype_synonym ('a,'b) pred = \"(('a,'b option) m \\<times> ('a,'b) m \\<times> ('a,'b) m \\<times> ('a,'b) m) set\"\ntype_synonym ('a,'b) prel = \"(('a,'b) m \\<times> ('a,'b) m \\<times> ('a,'b) m) rel\"\n\n\nsubsection \\<open>sat\\<close>\n\ndefinition buf :: \"'t \\<Rightarrow> ('a,'t,'b) state \\<Rightarrow> 'a \\<Rightarrow> 'b option\"\n  where \"buf t m a \\<equiv> \n    (case lastf (isWX a) (tbuffers m t) of Some (W _ v) \\<Rightarrow> Some v | _ \\<Rightarrow> None)\"\n\ndefinition sat :: \"'t \\<Rightarrow> ('a,'b) pred \\<Rightarrow> ('a,'t,'b) state \\<Rightarrow> bool\"\n  where \"sat t Q m \\<equiv> \\<forall>m'. env\\<^sup>*\\<^sup>* m m' \\<longrightarrow> (buf t m', persistent m', get\\<^sub>f t m', get\\<^sub>s m') \\<in> Q\"\n\nlemma sat_env_stable:\n  assumes \"sat t Q m\" \"\\<langle>m\\<rangle> -e\\<rightarrow> \\<langle>m'\\<rangle>\"\n  shows \"sat t Q m'\"\nproof (clarsimp simp: sat_def)\n  fix n assume a: \"env\\<^sup>*\\<^sup>* m' n\"\n  hence \"env\\<^sup>*\\<^sup>* m n\" using assms by (metis (no_types, lifting) converse_rtranclp_into_rtranclp) \n  moreover have \"get\\<^sub>s m = get\\<^sub>s m'\" using assms by auto\n  ultimately show \"(buf t n, persistent n, get\\<^sub>f t n, get\\<^sub>s n) \\<in> Q\" using assms by (auto simp: sat_def)\nqed\n\nsubsection \\<open>wp\\<close>\n\nfun wp :: \"('a,'b) event \\<Rightarrow> ('a,'b) pred \\<Rightarrow> ('a,'b) pred\"\n  where\n    \"wp (W x v) Q = {(m,p,f,s). (m(x:= Some v),p,f,s(x:=v)) \\<in> Q \\<and> (m(x:=Some v),p(x:=v),f(x:=v),s(x:=v)) \\<in> Q}\" |\n    \"wp (R x v) Q = {(m,p,f,s). (m x = Some v \\<or> s x = v) \\<longrightarrow> (m,p,f,s) \\<in> Q}\" |\n    \"wp (FL x) Q = {(m,p,f,s). (m,p(x := s x),f(x := s x),s) \\<in> Q}\" |\n    \"wp MF Q = {(m,p,f,s). (m,f,f,s) \\<in> Q}\" |\n    \"wp SF Q = {(m,p,f,s). (m,f,f,s) \\<in> Q}\" |\n    \"wp (FO x) Q = {(m,p,f,s). (m,p,f(x := s x),s) \\<in> Q}\"\n\nlemma [simp]:\n  \"tbuffers m t = [] \\<Longrightarrow> get t m = get\\<^sub>s m\"\n  by (auto simp: fun_eq_iff get_def get\\<^sub>s_def)\n\nlemma [elim!]:\n  assumes \"[E] = b\\<^sub>1 @ A # b\\<^sub>2\"\n  obtains \"b\\<^sub>1 = []\" \"b\\<^sub>2 = []\" \"A = E\"\n  using assms by (cases b\\<^sub>1; cases b\\<^sub>2; auto)\nlemma [simp]:\n  \"(\\<lambda>b a. if a = t then c else b a) \\<circ> (\\<lambda>b. b(t := q)) = (\\<lambda>b a. if a = t then c else b a)\"\n  by (auto simp: fun_eq_iff)\n\nlemma [simp]:\n  \"tbuffers_update (\\<lambda>b a. if a = t then tbuffers m\\<^sub>3 t else b a) m\\<^sub>3 = m\\<^sub>3\"\n  by (auto simp: fun_eq_iff)\n\nlemma [simp]:\n  assumes \"tbuffers m t = a\"\n  shows \"m\\<lbrakk>t \\<^sub>t= a\\<rbrakk> = m\"\n  using assms \n  by force\n\nlemma env_tbuffer_orth:\n  assumes \"env m\\<^sub>1 m\\<^sub>2\"\n  shows \"env (m\\<^sub>1\\<lbrakk>s \\<^sub>t= p\\<rbrakk>) (m\\<^sub>2\\<lbrakk>s \\<^sub>t= p\\<rbrakk>)\"\n  using assms by cases auto\n\nlemma envt_tbuffer_orth:\n  assumes \"env\\<^sup>*\\<^sup>* m\\<^sub>1 m\\<^sub>2\"\n  shows \"env\\<^sup>*\\<^sup>* (m\\<^sub>1\\<lbrakk>s \\<^sub>t= p\\<rbrakk>) (m\\<^sub>2\\<lbrakk>s \\<^sub>t= p\\<rbrakk>)\"\n  using assms \n  apply (rule rtrancl_summ)\n  apply (metis env_tbuffer_orth r_into_rtranclp)\n  by auto\n\nlemma envt_tupdE:\n  assumes \"env\\<^sup>*\\<^sup>* (m\\<^sub>3\\<lbrakk>t \\<^sub>t= q\\<rbrakk>) n\"\n  obtains \"env\\<^sup>*\\<^sup>* m\\<^sub>3 (n\\<lbrakk>t \\<^sub>t= tbuffers m\\<^sub>3 t\\<rbrakk>)\"\n  using envt_tbuffer_orth[OF assms, where s=t and p=\"tbuffers m\\<^sub>3 t\"] by simp\n\nlemma [simp]:\n  \"get\\<^sub>s (n\\<lbrakk>t \\<^sub>t= a\\<rbrakk>) = get\\<^sub>s n\"\n  \"get\\<^sub>s (m\\<lbrakk>x \\<^sub>@= PFO t\\<rbrakk>) = get\\<^sub>s m\"\n  by (auto simp: get\\<^sub>s_def fun_eq_iff split: option.splits pevent.splits)  \n\nlemma [simp]:\n  \"get\\<^sub>f t (n\\<lbrakk>t \\<^sub>t= tbuffers m\\<^sub>3 t\\<rbrakk>) = get\\<^sub>f t n\"\n  by (auto simp: get\\<^sub>f_def fun_eq_iff split: option.splits pevent.splits)  \n\nlemma [simp]:\n  \"get t (m\\<lbrakk>t \\<^sub>q= W x v\\<rbrakk>) = (get t m)(x := v)\"\n  \"get t (m\\<lbrakk>t \\<^sub>q= FL x\\<rbrakk>) = (get t m)\"\n  \"get t (m\\<lbrakk>t \\<^sub>q= FO x\\<rbrakk>) = (get t m)\"\n  \"get t (m\\<lbrakk>t \\<^sub>q= SF\\<rbrakk>) = (get t m)\"\n  by (auto simp: get_def fun_eq_iff split: option.splits pevent.splits event.splits)\n\nlemma env_:\n  assumes \"env m\\<^sub>1 m\\<^sub>2\"\n  shows \"env (m\\<^sub>1\\<lbrakk>s \\<^sub>q= E\\<rbrakk>) (m\\<^sub>2\\<lbrakk>s \\<^sub>q= E\\<rbrakk>)\"\n  using assms by cases auto\n\nlemma env_append:\n  assumes \"env m\\<^sub>1 m\\<^sub>2\"\n  shows \"env (m\\<^sub>1\\<lbrakk>s \\<^sub>q= E\\<rbrakk>) (m\\<^sub>2\\<lbrakk>s \\<^sub>q= E\\<rbrakk>)\"\n  using assms by cases auto\n\nlemma envt_append:\n  assumes \"env\\<^sup>*\\<^sup>* m\\<^sub>1 m\\<^sub>2\"\n  shows \"env\\<^sup>*\\<^sup>* (m\\<^sub>1\\<lbrakk>s \\<^sub>q= E\\<rbrakk>) (m\\<^sub>2\\<lbrakk>s \\<^sub>q= E\\<rbrakk>)\"\n  using assms\n  apply (rule rtrancl_summ)\n  using env_append apply (metis r_into_rtranclp) \n  by auto\n\nlemma prp_append:\n  assumes \"prp m\\<^sub>1 t a m\\<^sub>2\"\n  shows \"prp (m\\<^sub>1\\<lbrakk>s \\<^sub>q= E\\<rbrakk>) t a (m\\<^sub>2\\<lbrakk>s \\<^sub>q= E\\<rbrakk>)\"\n  using assms \nproof cases\n  case (prpw x v p)\n  then show ?thesis by (cases \"s = t\") (auto intro!: prpwI simp: fun_upd_twist)\nnext\n  case (prpfl x p)\n  then show ?thesis by (cases \"s = t\") (auto intro!: prpflI simp: fun_upd_twist)\nnext\n  case (prpfo b\\<^sub>1 x b\\<^sub>2)\n  then show ?thesis by (cases \"s = t\") (auto intro!: prpfoI simp: fun_upd_twist)\nnext\n  case (prpsf b)\n  then show ?thesis by (cases \"s = t\") (auto intro!: prpsfI simp: fun_upd_twist)\nqed\n\nlemma [simp]:\n  \"get\\<^sub>s (n\\<lbrakk>x \\<^sub>b= []\\<rbrakk>) = (get\\<^sub>s n)(x := persistent n x)\"\n  by (auto simp: fun_eq_iff get\\<^sub>s_def split: option.splits pevent.splits)\n\nlemma [simp]:\n  \"get\\<^sub>f t (n\\<lbrakk>x \\<^sub>b= []\\<rbrakk>) = (get\\<^sub>f t n)(x := persistent n x)\"\n  by (auto simp: fun_eq_iff get\\<^sub>f_def split: option.splits pevent.splits)\n\nlemma [simp]:\n  \"get\\<^sub>f t (n\\<lbrakk>t \\<^sub>t= a\\<rbrakk>) = get\\<^sub>f t n\"\n  by (auto simp: fun_eq_iff get\\<^sub>f_def split: option.splits pevent.splits)\n\nsubsection \\<open>Concurrency\\<close>\n\ndefinition wpr\n  where \"wpr r Q \\<equiv> {(m,p,f,b). \\<forall>b' p' f'. ((b,p,f),(b',p',f')) \\<in> r \\<longrightarrow>  (m,p',f',b') \\<in> Q}\"\n\nfun guar\n  where\n    \"guar (W x v) r = {(m,p,f,s). \\<forall>f. ((s,p,f),(s(x := v),p,f)) \\<in> r \\<and> ((s,p,f),(s(x := v),p(x := v),f(x := v))) \\<in> r}\" |\n    \"guar _ r = UNIV\"\n\nlemma [simp]:\n  \"s \\<noteq> t \\<Longrightarrow> get\\<^sub>f s (m\\<lbrakk>x \\<^sub>@= PFO t\\<rbrakk>) = get\\<^sub>f s m\"\n  by (auto simp: get\\<^sub>f_def fun_eq_iff split: option.splits)\n\nlemma get\\<^sub>s_app_simps' [simp]:\n  \"get\\<^sub>s (m\\<lbrakk>x \\<^sub>b= p @ [PW v]\\<rbrakk>) = (get\\<^sub>s m)(x := v)\"\n  by (auto simp: get_def get\\<^sub>s_def fun_eq_iff split: option.splits pevent.splits)\n\n\nlemma get\\<^sub>s_app_simps'' [simp]:\n  \"get\\<^sub>s (m\\<lbrakk>x \\<^sub>t= p\\<rbrakk>) = (get\\<^sub>s m)\"\n  by (auto simp: get_def get\\<^sub>s_def fun_eq_iff split: option.splits pevent.splits)\n\nlemma [simp]:\n  \"s \\<noteq> t \\<Longrightarrow> get s (m'a\\<lbrakk>t \\<^sub>t= p\\<rbrakk>) = get s (m'a)\"\n  unfolding get_def fun_eq_iff\n  by (clarsimp split: option.splits pevent.splits event.splits)\n\n\nlemma [simp]:\n  \"buf s (m\\<lbrakk>x \\<^sub>p= v\\<rbrakk>) = buf s m\"\n  \"buf s (m\\<lbrakk>x \\<^sub>@= a\\<rbrakk>) = buf s m\"\n  \"s \\<noteq> t \\<Longrightarrow> buf s (m'a\\<lbrakk>t \\<^sub>t= p\\<rbrakk>) = buf s (m'a)\"\n  unfolding buf_def fun_eq_iff\n  by (clarsimp split: option.splits pevent.splits event.splits)+\n\nlemma [simp]:\n  \"get s (m\\<lbrakk>x \\<^sub>@= PFO t\\<rbrakk>) = get s m\"\n  unfolding get_def fun_eq_iff\n  by (clarsimp split: option.splits pevent.splits event.splits)\n\nlemma wpr_sound:\n  assumes \"\\<langle>m\\<rangle> -t,a\\<leadsto> \\<langle>m'\\<rangle>\" \"sat t (guar a r) m\" \"s \\<noteq> t\"\n  assumes \"sat s (wpr (r) Q) m\" \"trans (r)\"\n  shows \"sat s (wpr (r) Q) m'\"\n  using assms\nproof (cases)\n  case (prpw x v p)\n  show ?thesis using assms\n    unfolding sat_def prpw wpr_def\n    apply (intro allI impI)\n    apply (elim envt_buffer_appE envt_tupdE)\n\n\n    prefer 3\n      apply (auto)[1]\n     prefer 2\n    apply auto\n     apply (subgoal_tac \"((get\\<^sub>s (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>), persistent (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>), (get\\<^sub>f s m\\<^sub>3)), (get\\<^sub>s (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>))(x := v), (persistent (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>))(x := v), (get\\<^sub>f s m\\<^sub>3)(x := v)) \\<in> r\")\n    prefer 2\n      apply blast\n     apply simp\n     apply (subgoal_tac \"((get\\<^sub>s m\\<^sub>3, persistent m\\<^sub>3, get\\<^sub>f s m\\<^sub>3), b', p', f') \\<in> r\")\n    prefer 2\n      apply (meson transE)\n     apply (subgoal_tac \"((get\\<^sub>s (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>), persistent (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>), get\\<^sub>f s (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>)), b', p', f') \\<in> r\")\n    prefer 2\n      apply simp\n    apply (subgoal_tac \"(buf s (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>), p', f', b') \\<in> Q\")\n    prefer 2\n      apply blast\n     apply simp\n    \n     \n     apply (subgoal_tac \"((get\\<^sub>s (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>), persistent (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>), (get\\<^sub>f s m\\<^sub>3)), (get\\<^sub>s (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>))(x := v), (persistent (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>)), (get\\<^sub>f s m\\<^sub>3)) \\<in> r\")\n    prefer 2\n    apply blast\n    apply simp\n     apply (subgoal_tac \"((get\\<^sub>s (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>), persistent (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>), get\\<^sub>f s (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>)), b', p', f') \\<in> r\")\n    prefer 2\n      apply simp\n      apply (meson transE)\n    apply (subgoal_tac \"(buf s (m\\<^sub>3\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>), p', f', b') \\<in> Q\")\n    prefer 2\n      apply blast\n    apply simp \n    done\nnext\n  case (prpfl x p)\n  then show ?thesis using assms by (auto elim!: envt_tupdE simp: sat_def)\nnext\n  case (prpfo b\\<^sub>1 x b\\<^sub>2)\n  show ?thesis using assms\n    unfolding sat_def prpfo \n    apply (intro allI impI)\n    apply (elim envt_buffer_appE envt_tupdE)\n    unfolding get\\<^sub>s_app_simps\n    by (auto)\nnext\n  case (prpsf b)\n  then show ?thesis using assms by (auto elim!: envt_tupdE simp: sat_def)\nqed\n\nsubsection \\<open>wpl\\<close>\n\nfun wpl :: \" ('a,'b) prel \\<Rightarrow> ('a,'b) prel \\<Rightarrow> ('a,'b) event list \\<Rightarrow> ('a,'b) pred \\<Rightarrow> ('a,'b) pred\"\n  where\n    \"wpl r g [] A = wpr r A\" |\n    \"wpl r g (x#xs) A = wpr r (wp x (wpl r g xs A) \\<inter> guar x g)\"\n\ndefinition compat\n  where \"compat r g \\<equiv> \\<forall>i j. i \\<noteq> j \\<longrightarrow> g i \\<subseteq> r j\"\n\ninductive trace :: \"('a,'t,'b) state \\<Rightarrow> ('t \\<times> ('a,'b) event) list \\<Rightarrow> ('a,'t,'b) state \\<Rightarrow> bool\"\n  where\n  nil:  \"trace a [] a\" |\n  step: \"\\<langle>m\\<rangle> -thr,a\\<rightarrow> \\<langle>m'\\<rangle> \\<Longrightarrow> trace m' t m'' \\<Longrightarrow> trace m ((thr,a)#t) m''\" |\n  env:  \"\\<langle>m\\<rangle> -e\\<rightarrow> \\<langle>m'\\<rangle> \\<Longrightarrow> trace m' t m'' \\<Longrightarrow> trace m t m''\" |\n  prp:  \"\\<langle>m\\<rangle> -thr,a\\<leadsto> \\<langle>m'\\<rangle> \\<Longrightarrow> trace m' t m'' \\<Longrightarrow> trace m t m''\"\n\nfun id_filter\n  where \n    \"id_filter t [] = []\" |\n    \"id_filter t ((s,e)#p) = (if t = s then e#(id_filter t p) else id_filter t p)\"\n\nlemma [simp]:\n  \"(\\<lambda>b. b(s := tbuffers m s)) \\<circ> (\\<lambda>b. b(s := tbuffers m s @ [A], t := p)) = (\\<lambda>b. b(s := tbuffers m s @ [A], t := p, s := tbuffers m s))\"\n  by (auto simp: fun_eq_iff)\n\nlemma sat_tbuffer [simp]:\n  \"t \\<noteq> s \\<Longrightarrow> sat t Q (m\\<lbrakk>s \\<^sub>t= p\\<rbrakk>) = sat t Q m\"\n  unfolding sat_def\n  apply rule\n   apply clarsimp\n   apply (drule envt_tbuffer_orth[where s=s and p=p])\n   apply (subgoal_tac \"(buf t (m'\\<lbrakk>s \\<^sub>t= p\\<rbrakk>), persistent (m'\\<lbrakk>s \\<^sub>t= p\\<rbrakk>), get\\<^sub>f t (m'\\<lbrakk>s \\<^sub>t= p\\<rbrakk>), get\\<^sub>s (m'\\<lbrakk>s \\<^sub>t= p\\<rbrakk>)) \\<in> Q\")\n  prefer 2\n    apply blast\n  by (auto intro: envt_tbuffer_orth elim!: envt_tupdE)\n\nlemma wpr_pres:\n  assumes \"sat s (wpr r Q) m\" \"refl r\"\n  shows \"sat s Q m\"\n  using assms unfolding sat_def wpr_def\n  apply clarsimp\n  by (metis UNIV_I refl_on_def)\n\nlemma [simp]:\n  \"get\\<^sub>s (m\\<lbrakk>s \\<^sub>t= p\\<rbrakk>\\<lbrakk>x \\<^sub>b= buffers m x @ [PW v]\\<rbrakk>) = (get\\<^sub>s m)(x := v)\"\n  by (auto simp: fun_eq_iff get\\<^sub>s_def split: option.splits pevent.splits)\n\nlemma [simp]:\n  \"get\\<^sub>s (m\\<lbrakk>s \\<^sub>t= p\\<rbrakk>\\<lbrakk>x \\<^sub>b= buffers m x @ [PFO t]\\<rbrakk>) = (get\\<^sub>s m)\"\n  by (auto simp: fun_eq_iff get\\<^sub>s_def split: option.splits pevent.splits)\n\nlemma wpl_concat:\n  \"trans r \\<Longrightarrow> refl r \\<Longrightarrow> wpl r g (pre@post) Q = wpl r g pre (wpl r g post Q)\"\nproof (induct pre)\n  case Nil\n  then show ?case \n    apply auto\n     apply (cases post)\n      apply auto\n      apply (unfold wpr_def)\n      apply simp\n      apply (meson transE)\n     apply simp\n      apply (meson transE)\n    apply simp\n    by (simp add: refl_onD)\nnext\n  case (Cons a pre)\n  then show ?case by auto\nqed\n\nlemma wpr_mono:\n  assumes \"P \\<subseteq> Q\"\n  shows \"wpr r P \\<subseteq> wpr r Q\"\n  using assms unfolding wpr_def\n  by auto\n\nlemma wp_mono:\n  assumes \"P \\<subseteq> Q\"\n  shows \"wp a P \\<subseteq> wp a Q\"\n  using assms by (cases a) auto\n\nlemma wpl_mono:\n  assumes \"P \\<subseteq> Q\"\n  shows \"wpl r g p P \\<subseteq> wpl r g p Q\"\n  using assms\nproof (induct p)\n  case Nil\n  then show ?case by (auto intro!: wpr_mono wp_mono)\nnext\n  case (Cons a p)\n  then show ?case using wpr_mono wp_mono\n    by (metis Int_mono dual_order.refl wpl.simps(2))\nqed\n\nlemma [simp]:\n  \"x \\<in> C \\<Longrightarrow> override_on (m(x := f)) m' C = override_on m m' C\"\n  by (auto simp: override_on_def)\n\nlemma [simp]:\n  \"x \\<in> C \\<Longrightarrow> (override_on m m' C)(x := m' x) = override_on m m' C\"\n  by (auto simp: override_on_def)\n\nlemma [simp]:\n  \"x \\<notin> C \\<Longrightarrow> override_on (m(x := f)) m' C = (override_on m m' C)(x := f)\"\n  by (auto simp: override_on_def)\n\nlemma imp_sound:\n  assumes \"sat t P m\" \"P \\<subseteq> Q\" \n  shows \"sat t Q m\"\n  using assms by (auto simp: sat_def)\n\nlemma simple:\n  \"(a # b) @ c = a # (b @ c)\"\n  by auto\n\nlemma wp_MF_sound:\n  assumes \"\\<langle>m\\<rangle> -t,MF\\<rightarrow> \\<langle>m'\\<rangle>\"\n  assumes sat: \"sat t (wp MF Q) m\"\n  shows \"sat t Q m'\"\n  using assms\nproof (cases)\n  case mf\n  hence \"\\<forall>y m'. env\\<^sup>*\\<^sup>* m m' \\<longrightarrow> PFO t \\<notin> set (buffers m' y)\" by (meson envt_buffer_subset in_mono)\n  thus ?thesis using mf sat by (auto simp: sat_def)\nqed\n\nlemma wp_MF:\n  assumes \"tbuffers m t = []\" \"\\<forall>y. PFO t \\<notin> set (buffers m y)\"\n  shows \"sat t (wp MF Q) m = sat t Q m\"\nproof -\n  have \"\\<forall>y m'. env\\<^sup>*\\<^sup>* m m' \\<longrightarrow> PFO t \\<notin> set (buffers m' y)\" \n    using assms by (meson envt_buffer_subset in_mono)\n  thus ?thesis using assms by (auto simp: sat_def)\nqed\n\nlemma merge_r:\n  assumes \"(a, m') \\<in> r\\<^sup>* \" \"(m', m'') \\<in> r\\<^sup>* \"\n  shows \"(a,m'') \\<in> r\\<^sup>*\"\n  using assms \n  by auto\n\nlemma guar_mono:\n  assumes \"r \\<subseteq> g\"\n  shows \"guar a r \\<subseteq> guar a g\"\n  using assms by (cases a; clarsimp) blast+\n\n(*\n  all pending operations from a thread satisfy their guarantees, given the wpl structure.\n*)\n\nlemma squash[simp]:\n  \"(m\\<lbrakk>s \\<^sub>t= p\\<rbrakk>\\<lbrakk>x \\<^sub>@= a\\<rbrakk>\\<lbrakk>s \\<^sub>t= q\\<rbrakk>) = (m\\<lbrakk>s \\<^sub>t= q\\<rbrakk>\\<lbrakk>x \\<^sub>@= a\\<rbrakk>)\"\n  by (rule equality) auto\n\nlemma envt_tbuffer:\n  assumes \"env\\<^sup>*\\<^sup>* m m'\"\n  shows \"tbuffers m = tbuffers m'\"\n  using assms by (rule rtrancl_summ) auto\n\nlemma get_split:\n  assumes \"get s m x = v\"\n  obtains \"get\\<^sub>s m x = v\"  \"buf s m x = None\" | \"buf s m x = Some v\"\n  using assms unfolding get_def buf_def get\\<^sub>s_def\n  by (auto split: event.splits option.splits)  \n\n(*\ndefinition atom\n  where \"atom r \\<equiv> \\<forall>x y m p f m' p' f'. ((m,p,f),(m',p',f')) \\<in> r \\<longrightarrow> x \\<noteq> y \\<longrightarrow> m x \\<noteq> m' x \\<longrightarrow> m y \\<noteq> m' y \\<longrightarrow> (\\<exists>m'' p'' f''. ((m,p,f),(m'',p'',f'')) \\<in> r \\<and> ((m'',p'',f''),(m',p',f')) \\<in> r \\<and> ((m x = m'' x \\<and> m'' y = m' y) \\<or> (m y = m'' y \\<and> m'' x = m' x)))\"\n\nlemma atom_univ:\n  \"atom UNIV\"\n  unfolding atom_def\n  apply clarsimp\n  apply (subgoal_tac \"m x = (m(y := m' y)) x \\<and> (m(y := m' y)) y = m' y\")\n   apply blast\n  apply auto\n  done\n\nlemma\n  assumes \"refl r\" \"trans r\" \"atom r\"\n  shows \"x \\<noteq> y \\<Longrightarrow> wpr r (wp (W y w) (wpr r (wp (R x v) Q))) \\<subseteq> wpr r (wp (R x v) (wpr r (wp (W y w) Q)))\"\n  apply (clarsimp simp: wpr_def, intro conjI impI allI)\n  apply (meson UNIV_I assms(1) assms(2) refl_onD transD)\n    apply (meson UNIV_I assms(1) assms(2) refl_onD transD)\n  \n\nlemma\n  assumes \"refl r\" \"trans r\" \"atom r\"\n  shows \"wpr r (wp (FO y) (wpr r (wp (R x v) Q))) \\<subseteq> wpr r (wp (R x v) (wpr r (wp (FO y) Q)))\"\n  apply (clarsimp simp: wpr_def, intro conjI impI allI)\n   apply (meson UNIV_I assms(1) assms(2) refl_onD transD)\n   *)\n\nlemma write_read_same:\n  assumes \"refl r\" \"trans r\" \n  shows \"wpr r (wp (W x v) (wpr r (wp (R x v) Q)) \\<inter> guar (W x v) g) \\<subseteq>  wpr r (wp (W x v) Q \\<inter> guar (W x v) g)\"\n  apply (clarsimp simp: wpr_def, intro conjI impI allI)\n  apply (meson UNIV_I assms(1) assms(2) refl_onD transD)\n    apply (meson UNIV_I assms(1) assms(2) refl_onD transD)\n  done\n\nlemma reorder_rd_no_write:\n  assumes \"lastf (isWX x) l = None\"\n  shows \"wpl r g (l @ [R x v]) Q \\<subseteq> wpl (r) (g) (R x v # l) Q\"  \n  using assms(1)\nproof (induct l)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons a l)\n  hence a: \"\\<forall>v. a \\<noteq> W x v\" by (auto split: if_splits option.splits)\n  have \"wpl r g (l @ [R x v]) Q \\<subseteq> wpl r g (R x v # l) Q\" (is \"?P \\<subseteq> ?Q\")\n    using Cons by (auto split: if_splits option.splits)\n  hence \"wpr r (wp a ?P \\<inter> guar a g) \\<subseteq> wpr r (wp a ?Q \\<inter> guar a g)\"\n    by (meson Int_mono dual_order.refl wp_mono wpr_mono)\n  also have \"... \\<subseteq> wpr r (wp (R x v) (wpr r (wp a (wpl r g l Q) \\<inter> guar a g)))\"\n    using a\n    apply (simp del: wp.simps)\n    sorry (* reordering! *)\n  finally show ?case by simp\nqed\n\nlemma reorder_fo:\n  shows \"wpl r g (l @ [FO x]) Q \\<subseteq> wpl (r) (g) (FO x # l) Q\"  \nproof (induct l)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons a l)\n  have \"wpl r g (l @ [FO x]) Q \\<subseteq> wpl r g (FO x # l) Q\" (is \"?P \\<subseteq> ?Q\")\n    using Cons by (auto split: if_splits option.splits)\n  hence \"wpr r (wp a ?P \\<inter> guar a g) \\<subseteq> wpr r (wp a ?Q \\<inter> guar a g)\"\n    by (meson Int_mono dual_order.refl wp_mono wpr_mono)\n  also have \"... \\<subseteq> wpr r (wp (FO x) (wpr r (wp a (wpl r g l Q) \\<inter> guar a g)))\"\n    apply (simp del: wp.simps)\n    sorry (* reordering! *)\n  finally show ?case by simp\nqed\n\nlemma reorder_rd_write:\n  assumes \"lastf (isWX x) l = Some (W x v)\"\n  assumes \"trans r\" \"refl r\" \n  shows \"wpl r g (l @ [R x v]) Q \\<subseteq> wpl r g l Q\"\n  using assms(1)\nproof (induct l)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons a l)\n  show ?case using Cons(2)\n  proof (simp split: option.splits, goal_cases)\n    case 1\n    hence a: \"a = W x v\" \"lastf (isWX x) l = None\" \n      by (auto split: if_splits)\n    hence \"wpl r g (l @ [R x v]) Q \\<subseteq> wpl (r) (g) (R x v # l) Q\" (is \"?P \\<subseteq> ?Q\")\n      using reorder_rd_no_write by metis\n    hence \"wpr r (wp a ?P \\<inter> guar a g) \\<subseteq> wpr r (wp a ?Q \\<inter> guar a g)\"\n      by (meson Int_mono dual_order.refl wp_mono wpr_mono)\n    also have \"... \\<subseteq> wpr r (wp a (wpl r g l Q) \\<inter> guar a g)\"\n      using write_read_same[OF assms(3,2)] a(1)\n      apply (simp del: wp.simps guar.simps)\n      by auto\n    finally show ?case by simp\n  next\n    case (2 z)\n    hence \"wpl r g (l @ [R x v]) Q \\<subseteq> wpl r g l Q\" \n      using Cons by auto\n    then show ?case\n      by (meson Int_mono dual_order.refl wp_mono wpr_mono)\n  qed\nqed\n\nlemma wpr_wpl:\n  \"trans r \\<Longrightarrow> refl r \\<Longrightarrow> wpr r (wpl r g l Q) = wpl r g l Q\"\n  apply (cases l)\n   apply (auto simp: wpr_def)\n  apply (simp add: refl_onD)\n  apply (meson transE)\n     apply (simp add: refl_onD)\n  apply (simp add: refl_onD)\n   apply (meson transE)\n   apply (meson transE)\n  done\n\nlemma flip:\n  assumes \"env\\<^sup>*\\<^sup>* (m\\<lbrakk>x \\<^sub>@= PFO s\\<rbrakk>\\<lbrakk>s \\<^sub>t= []\\<rbrakk>) m'\"\n  shows \"env\\<^sup>*\\<^sup>* (m\\<lbrakk>s \\<^sub>t= []\\<rbrakk>\\<lbrakk>x \\<^sub>@= PFO s\\<rbrakk>) m'\"\n  using assms\n  apply (subgoal_tac \"m\\<lbrakk>x \\<^sub>@= PFO s\\<rbrakk>\\<lbrakk>s \\<^sub>t= []\\<rbrakk> = m\\<lbrakk>s \\<^sub>t= []\\<rbrakk>\\<lbrakk>x \\<^sub>@= PFO s\\<rbrakk>\")\n   apply simp\n  apply (rule equality)\n     apply auto\n  done\n\n\nlemma wpl_sound:\n  assumes \"trace m ts m'\" \"\\<forall>t. sat t (wpl (r t) (g t) (tbuffers m t @ id_filter t ts) Q) (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>)\" \n  assumes compat: \"compat r g\" \n  assumes refl: \"\\<forall>t. refl (r t) \\<and> trans (r t)\"\n  shows \"\\<forall>t. sat t (wpl (r t) (g t) (tbuffers m' t) Q) (m'\\<lbrakk>t \\<^sub>t= []\\<rbrakk>)\"\n  using assms(1,2)\nproof (induct arbitrary: Q)\n  case (nil a)\n  then show ?case by auto\nnext\n  case (step m s a m' ts m'')\n  show ?case \n  proof (rule step(3), intro allI)\n    fix t\n    have a: \"sat t (wpl (r t) (g t) (tbuffers m t @ id_filter t ((s, a) # ts)) Q) (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>)\" \n      using step(4) by blast\n    have t: \"trans (r t)\" \"refl (r t)\" using refl by auto\n\n    show \"sat t (wpl (r t) (g t) (tbuffers m' t @ id_filter t ts) Q) (m'\\<lbrakk>t \\<^sub>t= []\\<rbrakk>)\"\n    proof (cases \"t = s\")\n      case True\n      show ?thesis using step(1)\n      proof (cases)\n        case (rd x v)\n        show ?thesis using rd(3)\n        proof (cases rule: get_split)\n          case 1\n          let ?Q=\"wpl (r s) (g s) (id_filter t ts) Q\"\n          have last: \"lastf (isWX x) (tbuffers m s) = None\" (is \"lastf _ ?l = None\")\n            using 1 by (auto simp: buf_def split: option.splits event.splits)\n                       (drule lastf_some; auto)+\n          hence \"wpl (r s) (g s) (?l @ [R x v]) ?Q \\<subseteq> wpl (r s) (g s) (R x v # ?l) ?Q\" (is \"_ \\<subseteq> ?P\")\n            by (rule reorder_rd_no_write)\n\n          with a have \"sat t ?P (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>)\"\n            apply (simp add: wpl_concat[OF t, simplified True] wpr_wpl[OF t, simplified True] True rd del: wp.simps)\n            apply (rule imp_sound)\n             apply blast+\n            done\n\n          then show ?thesis using 1(1) t\n            unfolding True rd\n            apply simp\n            unfolding sat_def wpr_def wpl_concat[OF t, simplified True]\n            apply clarsimp\n            apply (subgoal_tac \"get\\<^sub>s m x = get\\<^sub>s m' x\")\n             apply (metis UNIV_I refl_on_def)\n            apply (subgoal_tac \"get\\<^sub>s m x = get\\<^sub>s (m\\<lbrakk>s \\<^sub>t= []\\<rbrakk>) x\")\n             apply (metis envt_get\\<^sub>s)\n            unfolding get\\<^sub>s_def\n            by (auto split: option.splits event.splits pevent.splits)\n        next\n          case 2\n          let ?Q=\"wpl (r s) (g s) (id_filter t ts) Q\"\n          have last: \"lastf (isWX x) (tbuffers m s) = Some (W x v)\" (is \"lastf _ ?l = _\")\n            using 2 by (auto simp: buf_def split: option.splits event.splits)\n                       (drule lastf_some; auto)+\n          hence \"wpl (r s) (g s) (?l @ [R x v]) ?Q \\<subseteq> wpl (r s) (g s) ?l ?Q\" (is \"_ \\<subseteq> ?P\")\n            using t[simplified True] by (rule reorder_rd_write)\n          with a have \"sat t ?P (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>)\"\n            apply (simp add: wpl_concat[OF t, simplified True] wpr_wpl[OF t, simplified True] True rd del: wp.simps)\n            apply (rule imp_sound)\n            by blast+\n          then show ?thesis unfolding True rd wpl_concat[OF t, simplified True] .\n        qed\n      next\n        case mf\n        then show ?thesis\n          using a True \n          apply (simp del: wp.simps)\n          apply (drule wpr_pres, insert refl, blast)\n          by (simp add: wp_MF del: wp.simps)\n      qed (insert a True, auto)\n    next\n      case False\n      show ?thesis using step(1) a False\n        apply cases\n        apply (subgoal_tac \"sat t (wpl (r t) (g t) (tbuffers (m\\<lbrakk>s \\<^sub>q= W x v\\<rbrakk>) t @ id_filter t ts) Q) (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>\\<lbrakk>s \\<^sub>q= W x v\\<rbrakk>)\")\n              prefer 2\n        using sat_tbuffer[OF False, where m=\"m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>\" and Q=\"(wpl (r t) (g t) (tbuffers (m\\<lbrakk>s \\<^sub>q= W x v\\<rbrakk>) t @ id_filter t ts) Q)\" and p=\"tbuffers m s@[W x v]\" for x v]\n              apply simp\n             apply (simp add: fun_upd_twist)\n            apply auto[2]\n        apply (subgoal_tac \"sat t (wpl (r t) (g t) (tbuffers (m\\<lbrakk>s \\<^sub>q= FL x\\<rbrakk>) t @ id_filter t ts) Q) (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>\\<lbrakk>s \\<^sub>q= FL x\\<rbrakk>)\")\n              prefer 2\n        using sat_tbuffer[OF False, where m=\"m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>\" and Q=\"(wpl (r t) (g t) (tbuffers (m\\<lbrakk>s \\<^sub>q= FL x\\<rbrakk>) t @ id_filter t ts) Q)\" and p=\"tbuffers m s@[FL x]\" for x v]\n        apply simp\n             apply (simp add: fun_upd_twist)\n\n        apply (subgoal_tac \"sat t (wpl (r t) (g t) (tbuffers (m\\<lbrakk>s \\<^sub>q= FO x\\<rbrakk>) t @ id_filter t ts) Q) (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>\\<lbrakk>s \\<^sub>q= FO x\\<rbrakk>)\")\n              prefer 2\n        using sat_tbuffer[OF False, where m=\"m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>\" and Q=\"(wpl (r t) (g t) (tbuffers (m\\<lbrakk>s \\<^sub>q= FO x\\<rbrakk>) t @ id_filter t ts) Q)\" and p=\"tbuffers m s@[FO x]\" for x v]\n        apply simp\n             apply (simp add: fun_upd_twist)\n        apply (subgoal_tac \"sat t (wpl (r t) (g t) (tbuffers (m\\<lbrakk>s \\<^sub>q= SF\\<rbrakk>) t @ id_filter t ts) Q) (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>\\<lbrakk>s \\<^sub>q= SF\\<rbrakk>)\")\n              prefer 2\n        using sat_tbuffer[OF False, where m=\"m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>\" and Q=\"(wpl (r t) (g t) (tbuffers (m\\<lbrakk>s \\<^sub>q= SF\\<rbrakk>) t @ id_filter t ts) Q)\" and p=\"tbuffers m s@[SF]\" for x v]\n        apply simp\n        apply (simp add: fun_upd_twist)\n        done\n    qed\n  qed\nnext\n  case (env m m' t m'')\n  then show ?case using sat_env_stable \n    by (metis (no_types, lifting) env_tbuffer env_tbuffer_orth fold_congs(3)) \nnext\n  case (prp m s a m' ts m'')\n  have s: \"sat s (wpl (r s) (g s) (tbuffers m s @ id_filter s ts) Q) (m\\<lbrakk>s \\<^sub>t= []\\<rbrakk>)\" using prp(4) by blast\n  with prp(1) have g: \"sat s (guar a (g s)) (m\\<lbrakk>s \\<^sub>t= []\\<rbrakk>)\" \n    apply cases\n       apply clarsimp\n       apply (drule wpr_pres, insert refl, blast)\n    apply (auto simp: sat_def)\n    done\n\n  show ?case\n  proof (rule prp(3), intro allI)\n    fix t\n    have a: \"sat t (wpl (r t) (g t) (tbuffers m t @ id_filter t ts) Q) (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>)\" using prp(4) by blast\n    have t: \"trans (r t)\" \"refl (r t)\" using refl by auto\n\n    show \"sat t (wpl (r t) (g t) (tbuffers m' t @ id_filter t ts) Q) (m'\\<lbrakk>t \\<^sub>t= []\\<rbrakk>)\"\n    proof (cases \"t = s\")\n      case True\n      show ?thesis using prp(1)\n      proof (cases)\n        case (prpw x v p)\n        show ?thesis using a unfolding prpw True simple wpl.simps\n          apply -\n          apply (drule wpr_pres, insert refl, blast)\n          unfolding sat_def squash apply (intro allI impI)\n          apply (elim envt_buffer_appE)\n            apply simp\n            prefer 3\n            apply simp\n           prefer 2\n          apply simp\n          sorry (* Need to show that Q |- Q[None/x_b] *)\n      next\n        case (prpfl x p)\n        hence \"buffers (m\\<lbrakk>s \\<^sub>t= []\\<rbrakk>) x = []\" by auto\n        hence \"\\<forall>m'. env\\<^sup>*\\<^sup>* (m\\<lbrakk>s \\<^sub>t= []\\<rbrakk>) m' \\<longrightarrow> buffers m' x = []\" \n          using envt_buffer_empty by metis\n        then show ?thesis using a True prpfl\n          apply (simp)\n          apply (drule wpr_pres, insert refl, blast)\n          by (auto simp: sat_def)\n      next\n        case (prpfo b\\<^sub>1 x b\\<^sub>2)\n\n        let ?Q=\"wpl (r t) (g t) (b\\<^sub>2 @ id_filter t ts) Q\"\n        have \"wpl (r t) (g t) (b\\<^sub>1 @ [FO x]) ?Q \\<subseteq> wpl (r t) (g t) (FO x # b\\<^sub>1) ?Q\" (is \"_ \\<subseteq> ?P\")\n          by (rule reorder_fo)\n        \n        with a have \"sat t ?P (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>)\"\n          apply (simp add: wpl_concat[OF t, simplified True] wpr_wpl[OF t, simplified True] True prpfo del: wp.simps)\n          apply (rule imp_sound)\n           apply blast+\n          done\n        then show ?thesis unfolding prpfo True wpl.simps\n          apply (simp del: wp.simps)\n          apply (drule wpr_pres, insert refl, blast)\n          unfolding wpl_concat[OF t, simplified True]\n          unfolding sat_def apply (intro allI impI)\n          apply (drule flip)\n          apply (elim envt_buffer_appE)\n            apply auto[2]\n          apply simp\n          by (metis (no_types, lifting) fun_upd_triv get\\<^sub>f_no_pw get\\<^sub>s_no_pw list.set_cases list.simps(3))\n      next\n        case (prpsf p)\n        hence \"\\<forall>y. PFO s \\<notin> set (buffers (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>) y)\" by auto\n        hence \"\\<forall>y m'. env\\<^sup>*\\<^sup>* (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>) m' \\<longrightarrow> PFO s \\<notin> set (buffers m' y)\" \n          by (meson envt_buffer_subset in_mono)\n        then show ?thesis using a True prpsf\n          apply (simp)\n          apply (drule wpr_pres, insert refl, blast)\n          by (auto simp: sat_def)\n      qed\n    next\n      case False\n      hence \"g s \\<subseteq> r t\" using assms by (auto simp: compat_def)\n      hence \"guar a (g s) \\<subseteq> guar a (r t)\" by (rule guar_mono)\n      hence g: \"sat s (guar a (r t)) (m\\<lbrakk>s \\<^sub>t= []\\<rbrakk>)\" \n        using g imp_sound by metis\n      hence g: \"sat s (guar a (r t)) (m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>)\" \n        unfolding sat_def  apply (cases a; clarsimp)\n        apply (elim envt_tupdE)\n        apply (drule envt_tbuffer_orth[where s=s and p=\"[]\"])\n        apply (subgoal_tac \"((get\\<^sub>s (m'\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>\\<lbrakk>s \\<^sub>t= []\\<rbrakk>), persistent (m'\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>\\<lbrakk>s \\<^sub>t= []\\<rbrakk>), f), (get\\<^sub>s (m'\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>\\<lbrakk>s \\<^sub>t= []\\<rbrakk>))(x11 := x12), persistent (m'\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>\\<lbrakk>s \\<^sub>t= []\\<rbrakk>), f) \\<in> r t \\<and> ((get\\<^sub>s (m'\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>\\<lbrakk>s \\<^sub>t= []\\<rbrakk>), persistent (m'\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>\\<lbrakk>s \\<^sub>t= []\\<rbrakk>), f), (get\\<^sub>s (m'\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>\\<lbrakk>s \\<^sub>t= []\\<rbrakk>))(x11 := x12), (persistent (m'\\<lbrakk>t \\<^sub>t= tbuffers m t\\<rbrakk>\\<lbrakk>s \\<^sub>t= []\\<rbrakk>))(x11 := x12), f(x11 := x12)) \\<in> r t\")\n        prefer 2\n        apply blast\n        unfolding get\\<^sub>s_app_simps''\n         apply simp\n        done\n      have s: \"\\<langle>m\\<lbrakk>t \\<^sub>t= []\\<rbrakk>\\<rangle> -s,a\\<leadsto> \\<langle>m'\\<lbrakk>t \\<^sub>t= []\\<rbrakk>\\<rangle>\" \n        using prp(1) False \n        apply (cases; clarsimp)\n        apply (rule prpwI)\n        apply auto[1]\n           apply (rule equality; auto)\n        apply (rule prpflI)\n        apply auto[2]\n           apply (rule equality; auto)\n        apply (rule prpfoI)\n        apply auto[2]\n           apply (rule equality; auto)\n        apply (rule prpsfI)\n        apply auto[2]\n           apply (rule equality; auto)\n        done\n      have [simp]: \"tbuffers m t = tbuffers m' t\"\n        using prp(1) False by cases auto\n      show ?thesis using refl a wpr_sound[OF s g False]\n        by (cases \"tbuffers m' t @ id_filter t ts\") auto\n    qed\n  qed\nqed\n\nend", "meta": {"author": "UQ-PAC", "repo": "wpif_CSF21", "sha": "e2fd527115dcd01c5a8e0664480bb982eb696d7e", "save_path": "github-repos/isabelle/UQ-PAC-wpif_CSF21", "path": "github-repos/isabelle/UQ-PAC-wpif_CSF21/wpif_CSF21-e2fd527115dcd01c5a8e0664480bb982eb696d7e/Isabelle/PTSO.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6654105454764747, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.34569496622680146}}
{"text": "theory CorrectnessResourced\n  imports \"ResourcedDenotational\" Launchbury\nbegin\n\ntheorem correctness:\n  assumes \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : z\"\n  and     \"fv (\\<Gamma>, e) - domA \\<Gamma> \\<subseteq> set L\"\n  shows   \"\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk>z\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>\" and \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` (domA \\<Gamma>) \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` (domA \\<Gamma>)\"\n  using assms\nproof(nominal_induct arbitrary: \\<rho> rule:reds.strong_induct)\ncase Lambda\n  case 1 show ?case..\n  case 2 show ?case..\nnext\ncase (Application y \\<Gamma> e x L \\<Delta> \\<Theta> z e')\n  hence \"y \\<noteq> x\" by (simp_all add: fresh_at_base)\n\n  have Gamma_subset: \"domA \\<Gamma> \\<subseteq> domA \\<Delta>\"\n    by (rule reds_doesnt_forget[OF Application.hyps(8)])\n\n  case 1\n  hence prem1: \"fv (\\<Gamma>, e) - domA \\<Gamma> \\<subseteq> set (x#L)\" by auto\n\n  from 1 Gamma_subset have *: \"x \\<in> set L \\<or> x \\<in> domA \\<Delta>\" by auto\n\n  have \"fv (\\<Delta>, e'[y::=x]) - domA \\<Delta> \\<subseteq> (fv (\\<Delta>, Lam [y]. e') - domA \\<Delta>) \\<union> {x}\"\n    by (auto dest!: set_mp[OF fv_subst_subset])\n  also have \"\\<dots> \\<subseteq> (fv (\\<Gamma>, e) - domA \\<Gamma>) \\<union> {x}\"\n    using new_free_vars_on_heap[OF Application.hyps(8)] by auto\n  also have \"\\<dots> \\<subseteq> set L \\<union> {x}\" using prem1 by auto\n  finally have \"fv (\\<Delta>, e'[y::=x]) - domA \\<Delta> \\<subseteq> set L \\<union> {x}\". \n  with *\n  have prem2: \"fv (\\<Delta>, e'[y::=x]) - domA \\<Delta> \\<subseteq> set L\" by auto\n  \n  have *: \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x\"\n  proof(cases \"x \\<in> domA \\<Gamma>\")\n    case True\n    thus ?thesis\n      using fun_belowD[OF Application.hyps(10)[OF prem1], where \\<rho>1 = \\<rho> and x = x]\n      by simp\n  next\n    case False \n    from False reds_avoids_live[OF Application.hyps(8)]\n    show ?thesis by (simp add: lookup_HSem_other)\n  qed\n\n  {\n  fix r\n  have \"(\\<N>\\<lbrakk> App e x \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r \\<sqsubseteq> ((\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r \\<down>CFn (\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x)\\<cdot>r\"\n    by (rule CEApp_no_restr)\n  also have \"((\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)) \\<sqsubseteq> ((\\<N>\\<lbrakk> Lam [y]. e' \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>))\"\n    using Application.hyps(9)[OF prem1].\n  also note `((\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x) \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x`\n  also have \"(\\<N>\\<lbrakk> Lam [y]. e' \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r \\<sqsubseteq> (CFn\\<cdot>(\\<Lambda> v. (\\<N>\\<lbrakk> e' \\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>)(y := v)\\<^esub>)))\"\n    by (rule CELam_no_restr)\n  also have \"CFn\\<cdot>(\\<Lambda> v. (\\<N>\\<lbrakk> e' \\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>)(y := v)\\<^esub>)) \\<down>CFn ((\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x) = (\\<N>\\<lbrakk> e' \\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>)(y := (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x)\\<^esub>)\"\n    by simp\n  also have \"\\<dots> = (\\<N>\\<lbrakk> e'[y ::= x] \\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>)\\<^esub>)\"\n    unfolding ESem_subst[OF `y \\<noteq> x`]..\n  also have \"\\<dots> \\<sqsubseteq> \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>\\<^esub>\"\n    using Application.hyps(12)[OF prem2].\n  finally\n  have \"(\\<N>\\<lbrakk> App e x \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r \\<sqsubseteq> (\\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r\" by this (intro cont2cont)+\n  }\n  thus ?case by (rule cfun_belowI)\n  \n  show \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` (domA \\<Gamma>) \\<sqsubseteq> (\\<N>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>)  f|` (domA \\<Gamma>)\"\n    using Application.hyps(10)[OF prem1]\n          env_restr_below_subset[OF Gamma_subset Application.hyps(13)[OF prem2]]\n    by (rule below_trans)\nnext\ncase (Variable \\<Gamma> x e L \\<Delta> z)\n  hence [simp]:\"x \\<in> domA \\<Gamma>\"\n    by (metis domA_from_set map_of_is_SomeD)\n\n  case 2\n\n  have \"x \\<notin> domA \\<Delta>\"\n    by (rule reds_avoids_live[OF Variable.hyps(2)], simp_all)\n\n  have subset: \"domA (delete x \\<Gamma>) \\<subseteq> domA \\<Delta>\"\n    by (rule reds_doesnt_forget[OF Variable.hyps(2)])\n\n  have \"fv (delete x \\<Gamma>, e) \\<union> {x} \\<subseteq> fv (\\<Gamma>, Var x)\"\n    by (rule fv_delete_heap[OF `map_of \\<Gamma> x = Some e`])\n  hence prem: \"fv (delete x \\<Gamma>, e) - domA (delete x \\<Gamma>) \\<subseteq> set (x # L)\" using 2 by auto\n\n  have fv_subset: \"fv (delete x \\<Gamma>, e) - domA (delete x \\<Gamma>) \\<subseteq> - (domA \\<Delta> - domA \\<Gamma>)\"\n    apply (rule subset_trans[OF prem])\n    apply (rule subset_trans[OF reds_avoids_live'[OF Variable.hyps(2)]])\n    by auto\n\n  let \"?new\" = \"domA \\<Delta> - domA \\<Gamma>\"\n  have \"domA \\<Gamma> \\<subseteq> (-?new)\" by auto\n\n  have \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho> = \\<N>\\<lbrace>(x,e) # delete x \\<Gamma>\\<rbrace>\\<rho>\"\n    by (rule HSem_reorder[OF map_of_delete_insert[symmetric, OF Variable(1)]])\n  also have \"\\<dots> = (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>(domA (delete x \\<Gamma>))\\<^esub> (\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<rho>'))( x := \\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>))\"\n    by (rule iterative_HSem, simp)\n  also have \"\\<dots> = (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>(domA (delete x \\<Gamma>))\\<^esub> (\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<rho>'))( x := \\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<rho>'\\<^esub>))\"\n    by (rule iterative_HSem', simp)\n  finally\n  have \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>)f|` (- ?new) \\<sqsubseteq> (...) f|` (- ?new)\" by (rule ssubst) (rule below_refl)\n  also have \"\\<dots> \\<sqsubseteq> (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>domA \\<Delta>\\<^esub> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>'))( x := \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>'\\<^esub>)) f|` (- ?new)\"\n  proof (induction rule: parallel_fix_ind[where P =\"\\<lambda> x y. x f|` (- ?new) \\<sqsubseteq> y f|` (- ?new)\"])\n    case 1 show ?case by simp\n  next\n    case 2 show ?case ..\n  next\n    case (3 \\<sigma> \\<sigma>')\n    hence \"\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>'\\<^esub>\"\n      and \"(\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>) f|` domA (delete x \\<Gamma>) \\<sqsubseteq> (\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>') f|` domA (delete x \\<Gamma>)\"\n      using fv_subset by (auto intro: ESem_fresh_cong_below HSem_fresh_cong_below  env_restr_below_subset[OF _ 3])\n    from below_trans[OF this(1) Variable(3)[OF prem]] below_trans[OF this(2) Variable(4)[OF prem]]\n    have  \"\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<sigma>'\\<^esub>\"\n       and \"(\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>) f|` domA (delete x \\<Gamma>) \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<sigma>') f|` domA (delete x \\<Gamma>)\".\n    thus ?case\n      using subset\n      by (auto intro!: fun_belowI simp add: lookup_override_on_eq  lookup_env_restr_eq elim: env_restr_belowD)\n  qed\n  also have \"\\<dots> = (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>domA \\<Delta>\\<^esub> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>'))( x := \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>)) f|` (-?new)\"\n    by (rule arg_cong[OF iterative_HSem'[symmetric], OF `x \\<notin> domA \\<Delta>`])\n  also have \"\\<dots> = (\\<N>\\<lbrace>(x,z) # \\<Delta>\\<rbrace>\\<rho>)  f|` (-?new)\"\n    by (rule arg_cong[OF iterative_HSem[symmetric], OF `x \\<notin> domA \\<Delta>`])\n  finally\n  show le: ?case by (rule env_restr_below_subset[OF `domA \\<Gamma> \\<subseteq> (-?new)`]) (intro cont2cont)+\n\n  have \"\\<N>\\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> (\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x\" by (rule CESem_simps_no_tick)\n  also have \"\\<dots> \\<sqsubseteq> (\\<N>\\<lbrace>(x, z) # \\<Delta>\\<rbrace>\\<rho>) x\"\n    using fun_belowD[OF le, where x = x] by simp\n  also have \"\\<dots> = \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>(x, z) # \\<Delta>\\<rbrace>\\<rho>\\<^esub>\"\n    by (simp add: lookup_HSem_heap)\n  finally\n  show \"\\<N>\\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>(x, z) # \\<Delta>\\<rbrace>\\<rho>\\<^esub>\"  by this (intro cont2cont)+\nnext\ncase (Let as \\<Gamma> L body \\<Delta> z)\n  case 1\n  have *: \"domA as \\<inter> domA \\<Gamma> = {}\" by (metis Let.hyps(1) fresh_distinct)\n  \n  have \"fv (as @ \\<Gamma>, body) - domA (as @ \\<Gamma>) \\<subseteq> fv (\\<Gamma>, Let as body) - domA \\<Gamma>\"\n    by auto\n  with 1 have prem: \"fv (as @ \\<Gamma>, body) - domA (as @ \\<Gamma>) \\<subseteq> set L\" by auto\n  \n  have f1: \"atom ` domA as \\<sharp>* \\<Gamma>\"\n    using Let(1) by (simp add: set_bn_to_atom_domA)\n\n  have \"\\<N>\\<lbrakk> Let as body \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk> body \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>as\\<rbrace>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>\"\n     by (rule CESem_simps_no_tick)\n  also have \"\\<dots> =  \\<N>\\<lbrakk> body \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>as @ \\<Gamma>\\<rbrace>\\<rho>\\<^esub>\"\n    by (rule arg_cong[OF HSem_merge[OF f1]])\n  also have \"\\<dots> \\<sqsubseteq>  \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>\"\n    by (rule Let.hyps(4)[OF prem])\n  finally\n  show ?case  by this (intro cont2cont)+\n\n  have \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` (domA \\<Gamma>) = (\\<N>\\<lbrace>as\\<rbrace>(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>)) f|` (domA \\<Gamma>)\"\n    unfolding env_restr_HSem[OF *]..\n  also have \"\\<N>\\<lbrace>as\\<rbrace>(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) = (\\<N>\\<lbrace>as @ \\<Gamma>\\<rbrace>\\<rho>)\"\n    by (rule HSem_merge[OF f1])\n  also have \"\\<dots> f|` domA \\<Gamma> \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>\"\n    by (rule env_restr_below_subset[OF _ Let.hyps(5)[OF prem]]) simp\n  finally\n  show \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` domA \\<Gamma> \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>\".\nqed\n\n\ncorollary correctness_empty_env:\n  assumes \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : z\"\n  and     \"fv (\\<Gamma>, e) \\<subseteq> set L\"\n  shows   \"\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk>z\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<^esub>\" and \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace> \\<sqsubseteq> \\<N>\\<lbrace>\\<Delta>\\<rbrace>\"\nproof-\n  from assms(2) have \"fv (\\<Gamma>, e) - domA \\<Gamma> \\<subseteq> set L\" by auto\n  note corr = correctness[OF assms(1) this, where \\<rho> = \"\\<bottom>\"]\n\n  show \"\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<^esub>\" using corr(1).\n\n  have \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace> = (\\<N>\\<lbrace>\\<Gamma>\\<rbrace>) f|` domA \\<Gamma> \"\n    using env_restr_useless[OF HSem_edom_subset, where \\<rho>1 = \"\\<bottom>\"] by simp\n  also have \"\\<dots> \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>) f|` domA \\<Gamma>\" using corr(2).\n  also have \"\\<dots> \\<sqsubseteq> \\<N>\\<lbrace>\\<Delta>\\<rbrace>\" by (rule env_restr_below_itself)\n  finally show \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace> \\<sqsubseteq> \\<N>\\<lbrace>\\<Delta>\\<rbrace>\" by this (intro cont2cont)+\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Launchbury/CorrectnessResourced.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6654105454764746, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.3456949662268013}}
{"text": "theory flash101Bra  imports flash101Rev\n \n  begin\nlemma onInv101:\n\n   assumes  a1:\"iInv1 \\<le> N\" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv101  iInv1 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX1VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_GetXVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_ReplaceVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis NI_ShWbVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX7VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_Get_Nak2VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Remote_PutVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX5VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis NI_WbVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_Get_GetVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_ReplaceShrVldVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX8VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_InvAck_2VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Remote_Get_Nak2VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis PI_Remote_ReplaceVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis NI_Nak_HomeVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_Get_Put2VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_InvAck_1VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX11VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX6VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Remote_Get_Put2VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_InvAck_1_HomeVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Remote_Get_Nak1VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_Get_Nak1VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_Nak2VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis PI_Remote_GetVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_Nak3VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX10VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX2VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Remote_Get_Put1VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Remote_PutXVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis StoreVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis NI_FAckVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX3VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Remote_GetX_PutXVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_Get_Put1VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis StoreHomeVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Remote_GetX_NakVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_InvVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis PI_Remote_PutXVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX4VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_NakVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis NI_Local_PutVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_Nak1VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis NI_Nak_ClearVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis PI_Local_PutXVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_Get_Nak3VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_GetX_PutX9VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis PI_Remote_GetXVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv101  iInv1 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1 )\n            by (metis NI_Local_Get_Put3VsInv101 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash101Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7431680199891789, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.345499980287419}}
{"text": "theory TreeCodeConversion\n  imports TreeCode \"../05Closure/Closure\"\nbegin\n\nprimrec encode :: \"dexpr \\<Rightarrow> tree_code list\" where\n  \"encode (DVar x) = [TLookup x]\"\n| \"encode (DConst k) = [TPushCon k]\"\n| \"encode (DLam t e) = [TPushLam (encode e)]\"\n| \"encode (DApp e\\<^sub>1 e\\<^sub>2) = encode e\\<^sub>1 @ encode e\\<^sub>2 @ [TApply]\"\n\nprimrec encode_closure :: \"closure \\<Rightarrow> tclosure\" where\n  \"encode_closure (CConst k) = TConst k\"\n| \"encode_closure (CLam t cs e) = TLam (map encode_closure cs) (encode e)\"\n\nfun vals_from_stack :: \"cframe list \\<Rightarrow> tclosure list\" where\n  \"vals_from_stack [] = []\"\n| \"vals_from_stack (CApp1 cs e # s) = vals_from_stack s\"\n| \"vals_from_stack (CApp2 c # s) = encode_closure c # vals_from_stack s\"\n| \"vals_from_stack (CReturn cs # s) = vals_from_stack s\"\n\nfun stack_from_stack :: \"cframe list \\<Rightarrow> tree_stack_frame list\" where\n  \"stack_from_stack [] = []\"\n| \"stack_from_stack (CApp1 cs e # s) = (case stack_from_stack s of\n      [] \\<Rightarrow> []\n    | ((env, cd) # sfs) \\<Rightarrow> (env, encode e @ TApply # cd) # sfs)\"\n| \"stack_from_stack (CApp2 c # s) = (case stack_from_stack s of\n      [] \\<Rightarrow> []\n    | ((env, cd) # sfs) \\<Rightarrow> (env, TApply # cd) # sfs)\"\n| \"stack_from_stack (CReturn cs # s) = (map encode_closure cs, []) # stack_from_stack s\"\n\nprimrec encode_state :: \"closure_state \\<Rightarrow> tree_code_state\" where\n  \"encode_state (CSE s cs e) = \n    TS (vals_from_stack s) (case stack_from_stack s of \n        [] \\<Rightarrow> []\n      | ((env, cd) # sfs) \\<Rightarrow> ((env, encode e @ cd) # sfs))\"\n| \"encode_state (CSC s c) = \n    TS (encode_closure c # vals_from_stack s) (stack_from_stack s)\"\n\nprimrec unzip :: \"dexpr \\<Rightarrow> dexpr \\<times> dexpr list\" where\n  \"unzip (DVar x) = (DVar x, [])\"\n| \"unzip (DConst k) = (DConst k, [])\"\n| \"unzip (DLam t e) = (DLam t e, [])\"\n| \"unzip (DApp e\\<^sub>1 e\\<^sub>2) = (case unzip e\\<^sub>1 of (e, es) \\<Rightarrow> (e, e\\<^sub>2 # es))\"\n\nprimrec zip_encode :: \"dexpr list \\<Rightarrow> tree_code list\" where \n  \"zip_encode [] = []\"\n| \"zip_encode (e # es) = zip_encode es @ encode e @ [TApply]\"\n\n\n\nlemma [simp]: \"list_all full_code_closure (encode e)\"\n  by (induction e) simp_all\n\nlemma [simp]: \"full_closure (encode_closure c)\"\nproof (induction c)\n  case (CLam t cs e)\n  thus ?case using list_all_iff by fastforce\nqed simp_all\n\nlemma [simp]: \"list_all full_closure (vals_from_stack s)\"\n  by (induction s rule: vals_from_stack.induct) simp_all\n\nlemma full_frame_from_stack [simp]: \"list_all full_frame (stack_from_stack s)\"\nproof (induction s rule: vals_from_stack.induct)\n  case (2 cs e s)\n  thus ?case\n  proof (cases \"stack_from_stack s\")\n    case (Cons envcd sfs)\n    with 2 show ?thesis by (cases envcd) simp_all\n  qed simp_all\nnext\n  case (3 c s)\n  thus ?case\n  proof (cases \"stack_from_stack s\")\n    case (Cons envcd sfs)\n    with 3 show ?thesis by (cases envcd) simp_all\n  qed simp_all\nnext\n  case (4 cs s)\n  thus ?case by (induction cs) simp_all\nqed simp_all\n\nlemma [simp]: \"stack_from_stack s = (env, cd) # sfs \\<Longrightarrow>\n  list_all full_closure env \\<and> list_all full_code_closure cd \\<and> list_all full_frame sfs\"\nproof -\n  assume \"stack_from_stack s = (env, cd) # sfs\"\n  hence \"list_all full_frame ((env, cd) # sfs)\" by (metis full_frame_from_stack)\n  thus ?thesis by simp\nqed\n\nlemma [simp]: \"full_state (encode_state \\<Sigma>)\"\n  by (induction \\<Sigma>) (simp_all split: list.splits)\n\nlemma [simp]: \"encode e \\<noteq> []\"\n  by (induction e) simp_all\n\nlemma [simp]: \"unzip e = (e', es) \\<Longrightarrow> encode e' @ zip_encode es = encode e\"\n  by (induction e arbitrary: e' es) (auto split: prod.splits)\n\nlemma [simp]: \"vals_from_stack (map (CApp1 cs) (rev es) @ s) = vals_from_stack s\"\n  by (induction es arbitrary: s) simp_all\n\nlemma [simp]: \"stack_from_stack s = (env, cd) # sfs \\<Longrightarrow> \n    stack_from_stack (map (CApp1 cs) (rev es) @ s) = (env, zip_encode es @ cd) # sfs\"\n  by (induction es arbitrary: s cd) simp_all\n\nlemma [dest]: \"encode e @ cd' = TLookup x # cd \\<Longrightarrow> \n    (\\<And>es. unzip e = (DVar x, es) \\<Longrightarrow> cd = zip_encode es @ cd' \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (induction e arbitrary: cd') fastforce+\n\nlemma [dest]: \"encode e @ cd' = TPushCon k # cd \\<Longrightarrow> \n    (\\<And>es. unzip e = (DConst k, es) \\<Longrightarrow> cd = zip_encode es @ cd' \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (induction e arbitrary: cd') fastforce+\n\nlemma encode_to_pushlam' [dest]: \"encode e @ cd' = TPushLam cd'' # cd \\<Longrightarrow> \n  (\\<And>es t e'. unzip e = (DLam t e', es) \\<Longrightarrow> cd'' = encode e' \\<Longrightarrow> cd = zip_encode es @ cd' \\<Longrightarrow> \n    P) \\<Longrightarrow> P\"\n  by (induction e arbitrary: cd') fastforce+\n\nlemma [dest]: \"encode e @ cd' = TApply # cd \\<Longrightarrow> P\"\n  by (induction e arbitrary: cd') simp_all\n\nlemma [dest]: \"encode_closure c = TConst k \\<Longrightarrow> c = CConst k\"\n  by (induction c) simp_all\n\nlemma encode_lam_closure [dest]: \"encode_closure c = TLam env cd \\<Longrightarrow> (\\<And>t cs e. \n    c = CLam t cs e \\<Longrightarrow> env = map encode_closure cs \\<Longrightarrow> cd = encode e \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (induction c) simp_all\n\nlemma tc_latest_environment [simp]: \"s @ CApp1 cs e # s' :\\<^sub>c t \\<rightarrow> t' \\<Longrightarrow> \n  latest_environment s' = Some cs\"\nproof (induction s arbitrary: t)\n  case (Cons f s)\n  moreover from Cons(2) obtain tt where \"s @ CApp1 cs e # s' :\\<^sub>c tt \\<rightarrow> t'\" \n    by (induction \"(f # s) @ CApp1 cs e # s'\" t t' rule: typecheck_cstack.induct) simp_all\n  ultimately show ?case by simp\nqed fastforce+\n\nlemma encode_stack_to_lookup [dest]: \"stack_from_stack s = (env, TLookup x # cd) # sfs \\<Longrightarrow> \n  \\<exists>cs e es s' cd'. s = CApp1 cs e # s' \\<and> stack_from_stack s' = (env, cd') # sfs \\<and> \n    unzip e = (DVar x, es) \\<and> cd = zip_encode es @ TApply # cd'\"\nproof (induction s rule: stack_from_stack.induct)\n  case (2 cs e s)\n  then obtain cd' where \"stack_from_stack s = (env, cd') # sfs \\<and> \n    encode e @ TApply # cd' = TLookup x # cd\" \n      by (cases \"stack_from_stack s\") (auto split: prod.splits)\n  thus ?case by auto\nqed (auto split: list.splits)\n\nlemma encode_stack_to_pushcon [dest]: \"stack_from_stack s = (env, TPushCon k # cd) # sfs \\<Longrightarrow> \n  \\<exists>cs e es s' cd'. s = CApp1 cs e # s' \\<and> stack_from_stack s' = (env, cd') # sfs \\<and> \n    unzip e = (DConst k, es) \\<and> cd = zip_encode es @ TApply # cd'\"\nproof (induction s rule: stack_from_stack.induct)\n  case (2 cs e s)\n  then obtain cd' where \"stack_from_stack s = (env, cd') # sfs \\<and> \n    encode e @ TApply # cd' = TPushCon k # cd\" \n      by (cases \"stack_from_stack s\") (auto split: prod.splits)\n  thus ?case by auto\nqed (auto split: list.splits)\n\nlemma encode_stack_to_pushlam [dest]: \"stack_from_stack s = (env, TPushLam cd' # cd) # sfs \\<Longrightarrow> \n  \\<exists>cs e es s' t e' cd''. s = CApp1 cs e # s' \\<and> stack_from_stack s' = (env, cd'') # sfs \\<and> \n    unzip e = (DLam t e', es) \\<and> cd = zip_encode es @ TApply # cd'' \\<and> cd' = encode e'\"\nproof (induction s rule: stack_from_stack.induct)\n  case (2 cs e s)\n  then obtain cd'' where \"stack_from_stack s = (env, cd'') # sfs \\<and> \n    encode e @ TApply # cd'' = TPushLam cd' # cd\" \n      by (cases \"stack_from_stack s\") (auto split: prod.splits)\n  moreover then obtain t e' es where \"unzip e = (DLam t e', es) \\<and> cd' = encode e' \\<and> \n    cd = zip_encode es @ TApply # cd''\" by (metis encode_to_pushlam')\n  ultimately show ?case by fastforce\nqed (auto split: list.splits)\n\nlemma encode_stack_to_apply [dest]: \"stack_from_stack s = (env, TApply # cd) # sfs \\<Longrightarrow> \n    \\<exists>s' c. s = CApp2 c # s' \\<and> stack_from_stack s' = (env, cd) # sfs\"\n  by (induction s rule: stack_from_stack.induct) (auto split: list.splits)\n\nlemma encode_stack_to_return [dest]: \"stack_from_stack s = (env, []) # sfs \\<Longrightarrow> \n  (s = [] \\<and> env = [] \\<and>  sfs = []) \\<or> (\\<exists>cs s'. s = CReturn cs # s' \\<and> env = map encode_closure cs \\<and> \n    sfs = stack_from_stack s')\"\n  by (induction s rule: stack_from_stack.induct) (auto split: list.splits)\n\nlemma encode_to_lookup [simp]: \"encode_state \\<Sigma> = TS vs ((env, TLookup x # cd) # sfs) \\<Longrightarrow> \n  (\\<exists>s cs e es cd'. \\<Sigma> = CSE s cs e \\<and> unzip e = (DVar x, es) \\<and> \n    cd = zip_encode es @ cd' \\<and> stack_from_stack s = ((env, cd') # sfs) \\<and> \n      vs = vals_from_stack s) \\<or> (\\<exists>s c cs e es cd'. \\<Sigma> = CSC (CApp1 cs e # s) c \\<and> \n        unzip e = (DVar x, es) \\<and> cd = zip_encode es @ TApply # cd' \\<and> \n          stack_from_stack s = ((env, cd') # sfs) \\<and> vs = encode_closure c # vals_from_stack s)\"\nproof (induction \\<Sigma>)\n  case (CSE s cs e)\n  moreover then obtain cd' where \"stack_from_stack s = (env, cd') # sfs \\<and> \n    encode e @ cd' = TLookup x # cd\" by (auto split: list.splits)\n  ultimately show ?case by auto\nqed auto\n\nlemma encode_to_pushcon [simp]: \"encode_state \\<Sigma> = TS vs ((env, TPushCon k # cd) # sfs) \\<Longrightarrow> \n  (\\<exists>s cs e es cd'. \\<Sigma> = CSE s cs e \\<and> unzip e = (DConst k, es) \\<and> \n    cd = zip_encode es @ cd' \\<and> stack_from_stack s = ((env, cd') # sfs) \\<and> \n      vs = vals_from_stack s) \\<or> (\\<exists>s c cs e es cd'. \\<Sigma> = CSC (CApp1 cs e # s) c \\<and> \n        unzip e = (DConst k, es) \\<and> cd = zip_encode es @ TApply # cd' \\<and> \n          stack_from_stack s = ((env, cd') # sfs) \\<and> vs = encode_closure c # vals_from_stack s)\"\nproof (induction \\<Sigma>)\n  case (CSE s cs e)\n  moreover then obtain cd' where \"stack_from_stack s = (env, cd') # sfs \\<and> \n    encode e @ cd' = TPushCon k # cd\" by (auto split: list.splits)\n  ultimately show ?case by auto\nqed auto\n\nlemma encode_to_pushlam [simp]: \"encode_state \\<Sigma> = TS vs ((env, TPushLam cd' # cd) # sfs) \\<Longrightarrow> \n  (\\<exists>s cs e es tt e' cd''. \\<Sigma> = CSE s cs e \\<and> unzip e = (DLam tt e', es) \\<and> \n    cd = zip_encode es @ cd'' \\<and> cd' = encode e' \\<and> vs = vals_from_stack s \\<and> \n      stack_from_stack s = ((env, cd'') # sfs)) \\<or> (\\<exists>s c cs e es tt e' cd''. \n        \\<Sigma> = CSC (CApp1 cs e # s) c \\<and> unzip e = (DLam tt e', es) \\<and> \n          cd = zip_encode es @ TApply # cd'' \\<and> cd' = encode e' \\<and> \n            vs = encode_closure c # vals_from_stack s \\<and> stack_from_stack s = ((env, cd'') # sfs))\"\nproof (induction \\<Sigma>)\n  case (CSE s cs e)\n  moreover then obtain cd'' where \"stack_from_stack s = (env, cd'') # sfs \\<and> \n    encode e @ cd'' = TPushLam cd' # cd\" by (auto split: list.splits)\n  moreover then obtain es tt e' where \"unzip e = (DLam tt e', es) \\<and> cd' = encode e' \\<and> \n    cd = zip_encode es @ cd''\" by (metis encode_to_pushlam')\n  ultimately show ?case by auto\nqed auto\n\nlemma encode_to_apply [simp]: \"encode_state \\<Sigma> = TS vs ((env, TApply # cd) # sfs) \\<Longrightarrow> \n  \\<exists>s c c'. \\<Sigma> = CSC (CApp2 c' # s) c \\<and> stack_from_stack s = ((env, cd) # sfs) \\<and> \n    vs = encode_closure c # encode_closure c' # vals_from_stack s\"\n  by (induction \\<Sigma>) (auto split: list.splits)\n\nlemma encode_to_return [simp]: \"encode_state \\<Sigma> = TS vs ((env, []) # sfs) \\<Longrightarrow> \n  (\\<exists>c. \\<Sigma> = CSC [] c \\<and> env = [] \\<and> sfs = [] \\<and> vs = [encode_closure c]) \\<or> \n    (\\<exists>cs s c. \\<Sigma> = CSC (CReturn cs # s) c \\<and> sfs = stack_from_stack s \\<and>\n      env = map encode_closure cs \\<and> vs = encode_closure c # vals_from_stack s)\"\n  by (induction \\<Sigma>) (auto split: list.splits)\n\nlemma [simp]: \"unzip e = (e', es) \\<Longrightarrow> \n  iter (\\<leadsto>\\<^sub>c) (CSE s cs e) (CSE (map (CApp1 cs) (rev es) @ s) cs e')\"\nproof (induction e arbitrary: s es)\n  case (DApp e1 e2)\n  then obtain es' where \"unzip e1 = (e', es') \\<and> es = e2 # es'\" by (auto split: prod.splits)\n  moreover with DApp have \"iter (\\<leadsto>\\<^sub>c) (CSE (CApp1 cs e2 # s) cs e1) \n    (CSE (map (CApp1 cs) (rev (e2 # es')) @ s) cs e')\" by simp\n  moreover have \"CSE s cs (DApp e1 e2) \\<leadsto>\\<^sub>c CSE (CApp1 cs e2 # s) cs e1\" by simp\n  ultimately show ?case by (metis iter_step)\nqed simp_all \n\nlemma [simp]: \"stack_from_stack s = (env, cd) # sfs \\<Longrightarrow> latest_environment s = Some cs \\<Longrightarrow> \n    env = map encode_closure cs\"\n  by (induction s arbitrary: cd rule: latest_environment.induct) \n     (simp_all split: list.splits prod.splits)\n\ntheorem correctt [simp]: \"encode_state \\<Sigma>\\<^sub>c \\<leadsto>\\<^sub>t \\<Sigma>\\<^sub>t' \\<Longrightarrow> \\<Sigma>\\<^sub>c :\\<^sub>c t \\<Longrightarrow>\n  \\<exists>\\<Sigma>\\<^sub>c'. iter (\\<leadsto>\\<^sub>c) \\<Sigma>\\<^sub>c \\<Sigma>\\<^sub>c' \\<and> \\<Sigma>\\<^sub>t' = encode_state \\<Sigma>\\<^sub>c'\"\nproof (induction \"encode_state \\<Sigma>\\<^sub>c\" \\<Sigma>\\<^sub>t' rule: evalt.induct)\n  case (evt_lookup env x v vs cd sfs)\n  moreover hence \"(\\<exists>s cs e es cd'. \\<Sigma>\\<^sub>c = CSE s cs e \\<and> unzip e = (DVar x, es) \\<and> \n    cd = zip_encode es @ cd' \\<and> stack_from_stack s = ((env, cd') # sfs) \\<and> \n      vs = vals_from_stack s) \\<or> (\\<exists>s c cs e es cd'. \\<Sigma>\\<^sub>c = CSC (CApp1 cs e # s) c \\<and> \n        unzip e = (DVar x, es) \\<and> cd = zip_encode es @ TApply # cd' \\<and> \n          stack_from_stack s = ((env, cd') # sfs) \\<and> vs = encode_closure c # vals_from_stack s)\" \n    using encode_to_lookup by simp\n  ultimately show ?case\n  proof (induction \\<Sigma>\\<^sub>c)\n    case (CSE s cs e)\n    then obtain es cd' where E: \"unzip e = (DVar x, es) \\<and> cd = zip_encode es @ cd' \\<and>\n      stack_from_stack s = ((env, cd') # sfs) \\<and> vs = vals_from_stack s\" by auto \n    hence X: \"iter (\\<leadsto>\\<^sub>c) (CSE s cs e) (CSE (map (CApp1 cs) (rev es) @ s) cs (DVar x))\" by simp\n    from CSE obtain t' ts where \"(s :\\<^sub>c t' \\<rightarrow> t) \\<and> (cs :\\<^sub>c\\<^sub>l\\<^sub>s ts) \\<and>\n      latest_environment s = Some cs \\<and> (ts \\<turnstile>\\<^sub>d e : t')\" by fastforce\n    with E have \"env = map encode_closure cs\" by fastforce\n    with CSE obtain c where C: \"lookup cs x = Some c \\<and> encode_closure c = v\" by fastforce\n    with X have \"iter (\\<leadsto>\\<^sub>c) (CSE s cs e) (CSC (map (CApp1 cs) (rev es) @ s) c)\" by simp\n    with E C show ?case by fastforce\n  next\n    case (CSC s c)\n    then obtain s' cs e es cd' where S: \"s = CApp1 cs e # s' \\<and> unzip e = (DVar x, es) \\<and>\n        cd = zip_encode es @ TApply # cd' \\<and> stack_from_stack s' = ((env, cd') # sfs) \\<and>\n          vs = encode_closure c # vals_from_stack s'\" by auto\n    hence \"iter (\\<leadsto>\\<^sub>c) (CSE (CApp2 c # s') cs e) \n      (CSE (map (CApp1 cs) (rev es) @ CApp2 c # s') cs (DVar x))\" by simp\n    moreover have \"CSC (CApp1 cs e # s') c \\<leadsto>\\<^sub>c CSE (CApp2 c # s') cs e\" by simp\n    ultimately have X: \"iter (\\<leadsto>\\<^sub>c) (CSC (CApp1 cs e # s') c) \n      (CSE (map (CApp1 cs) (rev es) @ CApp2 c # s') cs (DVar x))\" by (metis iter_step)\n    from CSC obtain t' where \"(s :\\<^sub>c t' \\<rightarrow> t) \\<and> (c :\\<^sub>c\\<^sub>l t')\" by fastforce\n    with S obtain ts t\\<^sub>1 t\\<^sub>2 where \"t' = Arrow t\\<^sub>1 t\\<^sub>2 \\<and> (cs :\\<^sub>c\\<^sub>l\\<^sub>s ts) \\<and> (ts \\<turnstile>\\<^sub>d e : t\\<^sub>1) \\<and> (s' :\\<^sub>c t\\<^sub>2 \\<rightarrow> t) \\<and> \n      latest_environment s' = Some cs\" by fastforce\n    with S have \"env = map encode_closure cs\" by fastforce\n    with CSC obtain c' where C: \"lookup cs x = Some c' \\<and> encode_closure c' = v\" by fastforce\n    with X have \"iter (\\<leadsto>\\<^sub>c) (CSC (CApp1 cs e # s') c) \n      (CSC (map (CApp1 cs) (rev es) @ CApp2 c # s') c')\" by simp\n    with S C show ?case by fastforce\n  qed\nnext\n  case (evt_pushcon vs env k cd sfs)\n  hence \"(\\<exists>s cs e es cd'. \\<Sigma>\\<^sub>c = CSE s cs e \\<and> unzip e = (DConst k, es) \\<and> \n    cd = zip_encode es @ cd' \\<and>stack_from_stack s = ((env, cd') # sfs) \\<and> \n      vs = vals_from_stack s) \\<or> (\\<exists>s c cs e es cd'. \\<Sigma>\\<^sub>c = CSC (CApp1 cs e # s) c \\<and> \n        unzip e = (DConst k, es) \\<and> cd = zip_encode es @ TApply # cd' \\<and>\n          stack_from_stack s = ((env, cd') # sfs) \\<and> vs = encode_closure c # vals_from_stack s)\" \n    using encode_to_pushcon by simp\n  thus ?case\n  proof (induction \\<Sigma>\\<^sub>c)\n    case (CSE s cs e)\n    then obtain es cd' where E: \"unzip e = (DConst k, es) \\<and> cd = zip_encode es @ cd' \\<and> \n      stack_from_stack s = ((env, cd') # sfs) \\<and> vs = vals_from_stack s\" by auto\n    hence \"iter (\\<leadsto>\\<^sub>c) (CSE s cs e) (CSE (map (CApp1 cs) (rev es) @ s) cs (DConst k))\" by simp\n    moreover have \"CSE (map (CApp1 cs) (rev es) @ s) cs (DConst k) \\<leadsto>\\<^sub>c \n      CSC (map (CApp1 cs) (rev es) @ s) (CConst k)\" by simp\n    ultimately have \"iter (\\<leadsto>\\<^sub>c) (CSE s cs e) (CSC (map (CApp1 cs) (rev es) @ s) (CConst k))\" by simp\n    with E show ?case by fastforce\n  next\n    case (CSC s c)\n    then obtain s' cs e es cd' where S: \"s = CApp1 cs e # s' \\<and> unzip e = (DConst k, es) \\<and> \n        cd = zip_encode es @ TApply # cd' \\<and> stack_from_stack s' = ((env, cd') # sfs) \\<and>\n          vs = encode_closure c # vals_from_stack s'\" by auto\n    hence \"iter (\\<leadsto>\\<^sub>c) (CSE (CApp2 c # s') cs e) \n      (CSE (map (CApp1 cs) (rev es) @ CApp2 c # s') cs (DConst k))\" by simp\n    moreover have \"CSC (CApp1 cs e # s') c \\<leadsto>\\<^sub>c CSE (CApp2 c # s') cs e\" by simp\n    moreover have \"CSE (map (CApp1 cs) (rev es) @ CApp2 c # s') cs (DConst k) \\<leadsto>\\<^sub>c \n      CSC (map (CApp1 cs) (rev es) @ CApp2 c # s') (CConst k)\" by simp\n    ultimately have \"iter (\\<leadsto>\\<^sub>c) (CSC (CApp1 cs e # s') c)\n      (CSC (map (CApp1 cs) (rev es) @ CApp2 c # s') (CConst k))\" \n        by (metis iter_step iter_step_after)\n    with S show ?case by fastforce\n  qed\nnext\n  case (evt_pushlam vs env cd' cd sfs)\n  thus ?case\n  proof (induction \\<Sigma>\\<^sub>c)\n    case (CSE s cs e)\n    hence \"encode_state (CSE s cs e) = TS vs ((env, TPushLam cd' # cd) # sfs)\" by simp\n    then obtain es tt e' cd'' where E: \"unzip e = (DLam tt e', es) \\<and> \n      cd = zip_encode es @ cd'' \\<and> cd' = encode e' \\<and> vs = vals_from_stack s \\<and> \n        stack_from_stack s = ((env, cd'') # sfs)\" \n      using encode_to_pushlam by blast\n    hence \"iter (\\<leadsto>\\<^sub>c) (CSE s cs e) (CSE (map (CApp1 cs) (rev es) @ s) cs (DLam tt e'))\" by simp\n    moreover have \"CSE (map (CApp1 cs) (rev es) @ s) cs (DLam tt e') \\<leadsto>\\<^sub>c \n      CSC (map (CApp1 cs) (rev es) @ s) (CLam tt cs e')\" by simp\n    ultimately have X: \"iter (\\<leadsto>\\<^sub>c) (CSE s cs e) (CSC (map (CApp1 cs) (rev es) @ s) (CLam tt cs e'))\"\n      by (metis iter_step_after)\n    from CSE E have \"env = map encode_closure cs\" by fastforce\n    with CSE E X show ?case by fastforce\n  next\n    case (CSC s c)\n    hence \"encode_state (CSC s c) = TS vs ((env, TPushLam cd' # cd) # sfs)\" by simp\n    then obtain s' cs e es tt e' cd'' where S: \"s = CApp1 cs e # s' \\<and> \n      unzip e = (DLam tt e', es) \\<and> cd = zip_encode es @ TApply # cd'' \\<and> \n        cd' = encode e' \\<and> vs = encode_closure c # vals_from_stack s' \\<and> \n          stack_from_stack s' = ((env, cd'') # sfs)\" \n      using encode_to_pushlam by fastforce\n    hence \"iter (\\<leadsto>\\<^sub>c) (CSE (CApp2 c # s') cs e) \n      (CSE (map (CApp1 cs) (rev es) @ CApp2 c # s') cs (DLam tt e'))\" by simp\n    moreover have \"CSC (CApp1 cs e # s') c \\<leadsto>\\<^sub>c CSE (CApp2 c # s') cs e\" by simp\n    moreover have \"CSE (map (CApp1 cs) (rev es) @ CApp2 c # s') cs (DLam tt e') \\<leadsto>\\<^sub>c \n      CSC (map (CApp1 cs) (rev es) @ CApp2 c # s') (CLam tt cs e')\" by simp\n    ultimately have X: \"iter (\\<leadsto>\\<^sub>c) (CSC (CApp1 cs e # s') c) \n      (CSC (map (CApp1 cs) (rev es) @ CApp2 c # s') (CLam tt cs e'))\" \n        by (metis iter_step iter_step_after)\n    from CSC S have \"env = map encode_closure cs\" by fastforce\n    with CSC S X show ?case by fastforce\n  qed\nnext\n  case (evt_apply v env' cd' vs env cd sfs)\n  hence \"encode_state \\<Sigma>\\<^sub>c = TS (v # TLam env' cd' # vs) ((env, TApply # cd) # sfs)\" by simp\n  then obtain s c c' where \"\\<Sigma>\\<^sub>c = CSC (CApp2 c' # s) c \\<and> \n    stack_from_stack s = ((env, cd) # sfs) \\<and> v = encode_closure c \\<and> \n      TLam env' cd' = encode_closure c' \\<and> vs = vals_from_stack s\" using encode_to_apply by blast\n  moreover then obtain t cs e where \"c' = CLam t cs e \\<and> env' = map encode_closure cs \\<and> \n    cd' = encode e\" by (metis encode_lam_closure)\n  moreover have \"CSC (CApp2 (CLam t cs e) # s) c \\<leadsto>\\<^sub>c CSE (CReturn (c # cs) # s) (c # cs) e\" by simp\n  moreover hence \"iter (\\<leadsto>\\<^sub>c) (CSC (CApp2 (CLam t cs e) # s) c) \n    (CSE (CReturn (c # cs) # s) (c # cs) e)\" by (metis iter_one)\n  ultimately show ?case using encode_def by fastforce\nnext\n  case (evt_return vs env sfs)\n  hence R: \"(\\<exists>c. \\<Sigma>\\<^sub>c = CSC [] c \\<and> env = [] \\<and> sfs = [] \\<and> vs = [encode_closure c]) \\<or> \n    (\\<exists>cs s c. \\<Sigma>\\<^sub>c = CSC (CReturn cs # s) c \\<and> sfs = stack_from_stack s \\<and>\n      env = map encode_closure cs \\<and> vs = encode_closure c # vals_from_stack s)\" by simp\n  thus ?case\n  proof (cases \"\\<exists>c. \\<Sigma>\\<^sub>c = CSC [] c \\<and> env = [] \\<and> sfs = [] \\<and> vs = [encode_closure c]\")\n    case True\n    then obtain c where \"\\<Sigma>\\<^sub>c = CSC [] c \\<and> env = [] \\<and> sfs = [] \\<and> vs = [encode_closure c]\" \n      by fastforce\n    moreover have \"iter (\\<leadsto>\\<^sub>c) (CSC [] c) (CSC [] c)\" by simp\n    ultimately show ?thesis by fastforce\n  next\n    case False\n    with R obtain cs s c where S: \"\\<Sigma>\\<^sub>c = CSC (CReturn cs # s) c \\<and> sfs = stack_from_stack s \\<and>\n      env = map encode_closure cs \\<and> vs = encode_closure c # vals_from_stack s\" by fastforce\n    have \"CSC (CReturn cs # s) c \\<leadsto>\\<^sub>c CSC s c\" by simp\n    hence \"iter (\\<leadsto>\\<^sub>c) (CSC (CReturn cs # s) c) (CSC s c)\" by (metis iter_one)\n    with S show ?thesis by fastforce\n  qed\nqed\n\nlemma lookup_latest [simp]: \"latest_environment s = Some cs \\<Longrightarrow> \n    \\<exists>cd sfs. stack_from_stack s = (map encode_closure cs, cd) # sfs\"\n  by (induction s rule: stack_from_stack.induct) (auto split: list.splits)\n\ntheorem completet [simp]: \"\\<Sigma> \\<leadsto>\\<^sub>c \\<Sigma>' \\<Longrightarrow> \\<Sigma> :\\<^sub>c t \\<Longrightarrow> iter (\\<leadsto>\\<^sub>t) (encode_state \\<Sigma>) (encode_state \\<Sigma>')\"\nproof (induction \\<Sigma> \\<Sigma>' rule: evalc.induct)\n  case (evc_var cs x c s)\n  then obtain t' ts where \"(s :\\<^sub>c t' \\<rightarrow> t) \\<and> (cs :\\<^sub>c\\<^sub>l\\<^sub>s ts) \\<and> latest_environment s = Some cs \\<and> \n    lookup ts x = Some t'\" by fastforce\n  then obtain cd sfs where S: \"stack_from_stack s = (map encode_closure cs, cd) # sfs\" \n    by (metis lookup_latest)\n  with evc_var have \"TS (vals_from_stack s) ((map encode_closure cs, TLookup x # cd) # sfs) \\<leadsto>\\<^sub>t \n    TS (encode_closure c # vals_from_stack s) ((map encode_closure cs, cd) # sfs)\" by simp\n  hence \"iter (\\<leadsto>\\<^sub>t) (TS (vals_from_stack s) ((map encode_closure cs, TLookup x # cd) # sfs))\n    (TS (encode_closure c # vals_from_stack s) ((map encode_closure cs, cd) # sfs))\" \n      by (metis iter_one)\n    with S show ?case by simp\nnext\n  case (evc_con s cs k)\n  then obtain ts where \"(s :\\<^sub>c Base \\<rightarrow> t) \\<and> (cs :\\<^sub>c\\<^sub>l\\<^sub>s ts) \\<and> latest_environment s = Some cs\" \n    by fastforce\n  then obtain cd sfs where S: \"stack_from_stack s = (map encode_closure cs, cd) # sfs\" \n    by (metis lookup_latest)\n  have \"TS (vals_from_stack s) ((map encode_closure cs, TPushCon k # cd) # sfs) \\<leadsto>\\<^sub>t \n    TS (TConst k # vals_from_stack s) ((map encode_closure cs, cd) # sfs)\" by simp\n  hence \"iter (\\<leadsto>\\<^sub>t) (TS (vals_from_stack s) ((map encode_closure cs, TPushCon k # cd) # sfs)) \n    (TS (TConst k # vals_from_stack s) ((map encode_closure cs, cd) # sfs))\" by (metis iter_one)\n  with S show ?case by simp\nnext\n  case (evc_lam s cs tt e)\n  then obtain t' ts where \"(s :\\<^sub>c t' \\<rightarrow> t) \\<and> (cs :\\<^sub>c\\<^sub>l\\<^sub>s ts) \\<and> latest_environment s = Some cs \\<and>\n    (ts \\<turnstile>\\<^sub>d DLam tt e : t')\" by fastforce\n  then obtain cd sfs where S: \"stack_from_stack s = (map encode_closure cs, cd) # sfs\" \n    by (metis lookup_latest)\n  hence \"TS (vals_from_stack s) ((map encode_closure cs, TPushLam (encode e) # cd) # sfs) \\<leadsto>\\<^sub>t \n    TS (TLam (map encode_closure cs) (encode e) # vals_from_stack s) \n      ((map encode_closure cs, cd) # sfs)\" by (metis evt_pushlam)\n  hence \"iter (\\<leadsto>\\<^sub>t) (TS (vals_from_stack s) \n    ((map encode_closure cs, TPushLam (encode e) # cd) # sfs)) \n      (TS (TLam (map encode_closure cs) (encode e) # vals_from_stack s)\n        ((map encode_closure cs, cd) # sfs))\" by (metis iter_one)\n  with S show ?case by (simp add: encode_def)\nnext\n  case (evc_app s cs e\\<^sub>1 e\\<^sub>2)\n  then obtain t' ts where \"(s :\\<^sub>c t' \\<rightarrow> t) \\<and> (cs :\\<^sub>c\\<^sub>l\\<^sub>s ts) \\<and> latest_environment s = Some cs \\<and>\n    (ts \\<turnstile>\\<^sub>d DApp e\\<^sub>1 e\\<^sub>2 : t')\" by fastforce\n  then obtain cd sfs where S: \"stack_from_stack s = (map encode_closure cs, cd) # sfs\" \n    by (metis lookup_latest)\n  then show ?case by simp\nnext\n  case (retc_app1 cs e\\<^sub>2 s c\\<^sub>1)\n  then obtain ts t\\<^sub>1 t\\<^sub>2 where \"(cs :\\<^sub>c\\<^sub>l\\<^sub>s ts) \\<and> (ts \\<turnstile>\\<^sub>d e\\<^sub>2 : t\\<^sub>1) \\<and> (s :\\<^sub>c t\\<^sub>2 \\<rightarrow> t) \\<and>\n    latest_environment s = Some cs \\<and> (c\\<^sub>1 :\\<^sub>c\\<^sub>l Arrow t\\<^sub>1 t\\<^sub>2)\" by blast\n  then obtain cd sfs where \"stack_from_stack s = (map encode_closure cs, cd) # sfs\" \n    by (metis lookup_latest)\n  thus ?case by simp\nnext\n  case (retc_app2 t\\<^sub>1 cs e\\<^sub>1 s c\\<^sub>2)\n  then obtain ts t\\<^sub>2 cs' where \"(cs :\\<^sub>c\\<^sub>l\\<^sub>s ts) \\<and> (insert_at 0 t\\<^sub>1 ts \\<turnstile>\\<^sub>d e\\<^sub>1 : t\\<^sub>2) \\<and> (s :\\<^sub>c t\\<^sub>2 \\<rightarrow> t) \\<and> \n    latest_environment s = Some cs' \\<and> (c\\<^sub>2 :\\<^sub>c\\<^sub>l t\\<^sub>1)\" by blast\n  then obtain cd sfs where S: \"stack_from_stack s = (map encode_closure cs', cd) # sfs\" \n    by (metis lookup_latest)\n  hence \"TS (encode_closure c\\<^sub>2 # TLam (map encode_closure cs) (encode e\\<^sub>1) # \n    vals_from_stack s) ((map encode_closure cs', TApply # cd) # sfs) \\<leadsto>\\<^sub>t\n      TS (vals_from_stack s) ((encode_closure c\\<^sub>2 # map encode_closure cs, \n        encode e\\<^sub>1) # stack_from_stack s)\" by (metis evt_apply)\n  hence \"iter (\\<leadsto>\\<^sub>t)\n    (TS (encode_closure c\\<^sub>2 # TLam (map encode_closure cs) (encode e\\<^sub>1) # \n      vals_from_stack s) ((map encode_closure cs', TApply # cd) # sfs))\n        (TS (vals_from_stack s) ((encode_closure c\\<^sub>2 # map encode_closure cs, \n          encode e\\<^sub>1) # stack_from_stack s))\"\n    by (metis iter_one)\n  with S show ?case by (simp add: encode_def)\nnext\n  case (retc_ret cs s c)\n  have \"TS (encode_closure c # vals_from_stack s) \n    ((map encode_closure cs, []) # stack_from_stack s) \\<leadsto>\\<^sub>t\n      TS (encode_closure c # vals_from_stack s) (stack_from_stack s)\" by simp\n  hence \"iter (\\<leadsto>\\<^sub>t) \n    (TS (encode_closure c # vals_from_stack s) ((map encode_closure cs, []) # stack_from_stack s))\n      (TS (encode_closure c # vals_from_stack s) (stack_from_stack s))\" by (metis iter_one)\n  thus ?case by simp\nqed\n\nlemma iter_completet [simp]: \"iter (\\<leadsto>\\<^sub>c) \\<Sigma> \\<Sigma>' \\<Longrightarrow> \\<Sigma> :\\<^sub>c t \\<Longrightarrow>\n  iter (\\<leadsto>\\<^sub>t) (encode_state \\<Sigma>) (encode_state \\<Sigma>')\"\nproof (induction \\<Sigma> \\<Sigma>' rule: iter.induct)\n  case (iter_step \\<Sigma> \\<Sigma>' \\<Sigma>'')\n  hence \"iter (\\<leadsto>\\<^sub>t) (encode_state \\<Sigma>) (encode_state \\<Sigma>')\" by simp\n  moreover from iter_step have \"iter (\\<leadsto>\\<^sub>t) (encode_state \\<Sigma>') (encode_state \\<Sigma>'')\" by simp\n  ultimately show ?case by (metis iter_append)\nqed simp_all\n\nend", "meta": {"author": "xtreme-james-cooper", "repo": "Lambda-RAM-Compiler", "sha": "24125435949fa71dfc5faafdb236d28a098beefc", "save_path": "github-repos/isabelle/xtreme-james-cooper-Lambda-RAM-Compiler", "path": "github-repos/isabelle/xtreme-james-cooper-Lambda-RAM-Compiler/Lambda-RAM-Compiler-24125435949fa71dfc5faafdb236d28a098beefc/06TreeCode/TreeCodeConversion.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269796369904, "lm_q2_score": 0.6187804337438501, "lm_q1q2_score": 0.3454818106306707}}
{"text": "theory flash3Bra  imports flash3Rev\n \n  begin\nlemma onInv3:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv3  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv3  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv3 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash3Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702761768248, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.34545842328678156}}
{"text": "(*  Title: HS verification with lenses *)\n\nsection \\<open> HS verification with lenses \\<close>\n\ntext \\<open> We use shallow expressions to rephrase hybrid systems properties. Each operator below \nincludes lemmas for verification condition generation. \\<close>\n\ntheory Regular_Programs\n  imports \"Framed_ODEs.HS_Preliminaries\" Correctness_Specs\nbegin\n\nno_notation Transitive_Closure.rtrancl (\"(_\\<^sup>*)\" [1000] 999)\n\n\nsubsection \\<open> Skip \\<close>\n\ndefinition [prog_defs]: \"skip = (\\<lambda>s. {s})\"\n\nlemma fbox_skip [wlp]: \"|skip] P = P\"\n  unfolding fbox_def skip_def by simp\n\nlemma fdia_skip: \"|skip\\<rangle> P = P\"\n  unfolding fdia_def skip_def by simp\n\nlemma hoare_skip: \"\\<^bold>{P\\<^bold>} skip \\<^bold>{P\\<^bold>}\"\n  by (auto simp: fbox_skip)\n\n\nsubsection \\<open> Abort \\<close>\n\ndefinition [prog_defs]: \"abort = (\\<lambda>s. {})\"\n\nlemma fbox_abort [wlp]: \"|abort] P = (True)\\<^sub>e\"\n  unfolding fbox_def abort_def by auto\n\nlemma fdia_abort: \"|abort\\<rangle> P = (False)\\<^sub>e\"\n  unfolding fdia_def abort_def by expr_simp\n\nlemma hoare_abort: \"\\<^bold>{P\\<^bold>} abort \\<^bold>{Q\\<^bold>}\"\n  by (auto simp: fbox_abort)\n\n\nsubsection \\<open> Tests \\<close>\n\ndefinition test :: \"'a pred \\<Rightarrow> 'a \\<Rightarrow> 'a set\"\n  where [prog_defs]: \"test P = (\\<lambda>s. {x. x = s \\<and> P x})\"\n\nsyntax \n  \"_test\" :: \"logic \\<Rightarrow> logic\" (\"(1\\<questiondown>_?)\")\n\ntranslations\n  \"_test P\" == \"CONST test (P)\\<^sub>e\"\n\nlemma fbox_test [wlp]: \"|\\<questiondown>P?] Q = (P \\<longrightarrow> Q)\\<^sub>e\"\n  unfolding fbox_def test_def by (simp add: expr_defs)\n\nlemma fdia_test: \"|\\<questiondown>P?\\<rangle> Q = (P \\<and> Q)\\<^sub>e\"\n  unfolding fdia_def test_def by expr_simp\n\nlemma hoare_test: \"\\<^bold>{P\\<^bold>} \\<questiondown>T? \\<^bold>{P \\<and> T\\<^bold>}\"\n  by (auto simp: fbox_test)\n\n\nsubsection \\<open> Assignments \\<close>\n\nthm subst_nil_def subst_bop\nthm subst_basic_ops\nthm subst_lookup_def subst_app_def lens_update_def\n\ndefinition assigns :: \"'s subst \\<Rightarrow> 's \\<Rightarrow> 's set\" (\"\\<langle>_\\<rangle>\") \n  where [prog_defs]: \"\\<langle>\\<sigma>\\<rangle> = (\\<lambda> s. {\\<sigma> s})\"\n\nsyntax\n  \"_assign\" :: \"svid \\<Rightarrow> logic \\<Rightarrow> logic\" (\"(2_ ::= _)\" [65, 64] 64)\n\ntranslations\n  \"_assign x e\" == \"\\<langle>CONST subst_upd [\\<leadsto>] x (e)\\<^sub>e\\<rangle>\" (* \"\\<langle>[x \\<leadsto>\\<^sub>s e]\\<rangle>\" *)\n\nlemma fbox_assign: \"|x ::= e] Q = (Q\\<lbrakk>e/x\\<rbrakk>)\\<^sub>e\"\n  by (simp add: assigns_def subst_app_def fbox_def fun_eq_iff)\n\nlemma hoare_assign: \"\\<^bold>{Q\\<lbrakk>e/x\\<rbrakk>\\<^bold>} (x ::= e) \\<^bold>{Q\\<^bold>}\"\n  by (auto simp: fbox_assign)\n\nlemma fbox_assigns [wlp]: \"|\\<langle>\\<sigma>\\<rangle>] Q = \\<sigma> \\<dagger> (Q)\\<^sub>e\"\n  by (simp add: assigns_def expr_defs fbox_def)\n\nlemma H_assign_floyd_hoare:\n  assumes \"vwb_lens x\"\n  shows \"\\<^bold>{p\\<^bold>} x ::= e \\<^bold>{\\<exists> v . p\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/x\\<rbrakk> \\<and> $x = e\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/x\\<rbrakk>\\<^bold>}\"\n  using assms apply (simp add: wlp, expr_auto)\n  by (metis vwb_lens_def wb_lens.source_stability)\n\nlemma fdia_assign: \"|x ::= e\\<rangle> P = (P\\<lbrakk>e/x\\<rbrakk>)\\<^sub>e\"\n  by (simp add: assigns_def expr_defs fdia_def)\n\n\nsubsection \\<open> Nondeterministic assignments \\<close>\n\ndefinition nondet_assign :: \"('a \\<Longrightarrow> 's) \\<Rightarrow> 's prog\" (\"(2_ ::= ?)\" [64] 65)\n  where [prog_defs]: \"(x ::= ?) = (\\<lambda>s. {(put\\<^bsub>x\\<^esub> s k)|k. True})\"\n\nlemma fbox_nondet_assign [wlp]: \"|x ::= ?] P = (\\<forall>k. P\\<lbrakk>k/x\\<rbrakk>)\\<^sub>e\"\n  unfolding fbox_def nondet_assign_def \n  by (auto simp add: fun_eq_iff expr_defs)\n\nlemma hoare_nondet_assign: \"\\<^bold>{\\<forall>k. Q\\<lbrakk>k/x\\<rbrakk>\\<^bold>} (x ::= ?) \\<^bold>{Q\\<^bold>}\"\n  by (simp add: fbox_nondet_assign)\n\nlemma fdia_nondet_assign: \"|x ::= ?\\<rangle> P = (\\<exists>k. P\\<lbrakk>k/x\\<rbrakk>)\\<^sub>e\"\n  unfolding fdia_def nondet_assign_def \n  by (auto simp add: fun_eq_iff expr_defs)\n\n\nsubsection \\<open> Nondeterministic choice \\<close>\n\ndefinition nondet_choice :: \"'s prog \\<Rightarrow> 's prog \\<Rightarrow> 's prog\" (infixr \"\\<sqinter>\" 60) \n  where [prog_defs]: \"nondet_choice F G = (\\<lambda> s. F s \\<union> G s)\"\n\nlemma fbox_choice [wlp]: \"|F \\<sqinter> G] P = ( |F] P \\<and> |G] P)\\<^sub>e\"\n  unfolding fbox_def nondet_choice_def by auto\n\nlemma le_fbox_choice_iff: \"P \\<le> |F \\<sqinter> G] Q \\<longleftrightarrow> P \\<le> |F] Q \\<and> P \\<le> |G] Q\"\n  unfolding fbox_def nondet_choice_def by auto\n\nlemma le_fbox_choice_iff': \"P \\<le> ( |F \\<sqinter> G] Q)\\<^sub>e \\<longleftrightarrow> P \\<le> |F] Q \\<and> P \\<le> |G] Q\"\n  unfolding fbox_def nondet_choice_def by expr_auto\n\nlemma hoare_choice: \n  \"\\<^bold>{P\\<^bold>} F \\<^bold>{Q\\<^bold>} \\<Longrightarrow> \\<^bold>{P\\<^bold>} G \\<^bold>{Q\\<^bold>} \\<Longrightarrow> \\<^bold>{P\\<^bold>} (F \\<sqinter> G) \\<^bold>{Q\\<^bold>}\"\n  by (subst le_fbox_choice_iff, simp)\n\nlemma fdia_choice: \"|F \\<sqinter> G\\<rangle> P = ( |F\\<rangle> P \\<or> |G\\<rangle> P)\\<^sub>e\"\n  unfolding fdia_def nondet_choice_def by expr_auto\n\ndefinition Nondet_choice :: \"('i \\<Rightarrow> 's prog) \\<Rightarrow> 'i set \\<Rightarrow> 's prog\"\n  where \"Nondet_choice F I = (\\<lambda>s. \\<Union> i\\<in>I. F i s)\"\n\nsyntax\n  \"_Nondet_choice\" :: \"idt \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"\\<Sqinter> _ \\<in> _./ _\" [0, 0, 10] 10)\n\ntranslations \"_Nondet_choice i I P\" == \"CONST Nondet_choice (\\<lambda> i. P) I\"\n\nlemma fbox_Choice [wlp]: \"|\\<Sqinter> i\\<in>I. F(i)] P = (\\<forall> i\\<in>\\<guillemotleft>I\\<guillemotright>. |F(i)] P)\\<^sub>e\"\n  by (auto simp add: fbox_def Nondet_choice_def fun_eq_iff)\n\n\nsubsection \\<open> Sequential composition \\<close>\n\ndefinition kcomp :: \"('a \\<Rightarrow> 'b set) \\<Rightarrow> ('b \\<Rightarrow> 'c set) \\<Rightarrow> ('a  \\<Rightarrow> 'c set)\" (infixl \";\" 62) \n  where [prog_defs]: \"F ; G = \\<mu> \\<circ> (`) G \\<circ> F\"\n\nlemma kcomp_eq: \"(f ; g) x = \\<Union> {g y |y. y \\<in> f x}\"\n  unfolding kcomp_def image_def by auto\n\nlemma kcomp_id: \n  shows \"f ; (\\<lambda>s. {s}) = f\"\n    and \"(\\<lambda>s. {s}) ; f = f\"\n  unfolding kcomp_eq \n  by auto\n\nlemmas kcomp_skip = kcomp_id[unfolded skip_def[symmetric]]\n\nlemma kcomp_assoc: \"f ; g ; h = f ; (g ; h)\"\n  unfolding kcomp_eq \n  by (auto simp: fun_eq_iff)\n\nlemma fbox_kcomp[wlp]: \"|G ; F] P = |G] |F] P\"\n  unfolding fbox_def kcomp_def by auto\n\nlemma hoare_kcomp:\n  assumes \"\\<^bold>{P\\<^bold>} G \\<^bold>{R\\<^bold>}\" and \"\\<^bold>{R\\<^bold>} F \\<^bold>{Q\\<^bold>}\"\n  shows \"\\<^bold>{P\\<^bold>} G ; F \\<^bold>{Q\\<^bold>}\"\n  apply(subst fbox_kcomp)\n  using assms fbox_iso\n  by (metis (mono_tags, lifting) SEXP_def predicate1D predicate1I) \n\nlemma hoare_kcomp_inv:\n  assumes \"\\<^bold>{I\\<^bold>} G \\<^bold>{I\\<^bold>}\" and \"\\<^bold>{I\\<^bold>} F \\<^bold>{I\\<^bold>}\"\n  shows \"\\<^bold>{I\\<^bold>} G ; F \\<^bold>{I\\<^bold>}\"\n  using assms hoare_kcomp by fastforce\n\nlemma fdia_kcomp: \"|G ; F\\<rangle> P = |G\\<rangle> |F\\<rangle> P\"\n  unfolding fdia_def kcomp_def by auto\n\nlemma hoare_fwd_assign:\n  assumes \"vwb_lens x\" \"\\<And> x\\<^sub>0. \\<^bold>{$x = e\\<lbrakk>\\<guillemotleft>x\\<^sub>0\\<guillemotright>/x\\<rbrakk> \\<and> P\\<lbrakk>\\<guillemotleft>x\\<^sub>0\\<guillemotright>/x\\<rbrakk>\\<^bold>} S \\<^bold>{Q\\<^bold>}\"\n  shows \"\\<^bold>{P\\<^bold>} x ::= e ; S \\<^bold>{Q\\<^bold>}\"\n  using assms\n  unfolding kcomp_def assigns_def fbox_def le_fun_def\n  by (expr_simp) (metis vwb_lens.put_eq vwb_lens_wb wb_lens_def weak_lens.put_get)\n\nlemma fbox_invI_break: \n  \"P \\<le> |Y] I \\<Longrightarrow> I \\<le> |X] I \\<Longrightarrow> I \\<le> Q \\<Longrightarrow> P \\<le> |Y ; X INV I] Q\"\n  apply(subst fbox_to_hoare, rule hoare_kcomp, force)\n  by (rule fbox_invI) auto\n\nlemma hoare_invI_break: \n  \"\\<^bold>{P\\<^bold>} Y \\<^bold>{I\\<^bold>} \\<Longrightarrow> \\<^bold>{I\\<^bold>} X \\<^bold>{I\\<^bold>} \\<Longrightarrow> I \\<le> Q \\<Longrightarrow> \\<^bold>{P\\<^bold>} Y ; X INV I\\<^bold>{Q\\<^bold>}\"\n  by (rule fbox_invI_break; expr_auto)\n\nlemma fdia_invI_break: \n  \"P \\<le> |Y\\<rangle> I \\<Longrightarrow> I \\<le> |X\\<rangle> I \\<Longrightarrow> I \\<le> Q \\<Longrightarrow> P \\<le> |Y ; X INV I\\<rangle> Q\"\n  apply(subst fdia_kcomp)\n  apply (rule_tac Q\\<^sub>2=I in fdia_conseq, force, expr_auto)\n  by (unfold impl_eq_leq invar_def, rule_tac P\\<^sub>2=I in fdia_conseq, force)\n    (auto simp: taut_def)\n\n\nsubsection \\<open> Conditional statement \\<close>\n\ndefinition ifthenelse :: \"'a pred \\<Rightarrow> ('a \\<Rightarrow> 'b set) \\<Rightarrow> ('a \\<Rightarrow> 'b set) \\<Rightarrow> ('a \\<Rightarrow> 'b set)\" where\n  [prog_defs]: \"ifthenelse P X Y \\<equiv> (\\<lambda>s. if P s then X s else Y s)\"\n\nsyntax \"_ifthenelse\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"IF _ THEN _ ELSE _\" [0,0,63] 64)\ntranslations \"IF P THEN X ELSE Y\" == \"CONST ifthenelse (P)\\<^sub>e X Y\"\n\nlemma if_then_else_eq: \"IF T THEN X ELSE Y = \\<questiondown>T? ; X \\<sqinter> \\<questiondown>\\<not> T? ; Y\"\n  by (auto simp: fun_eq_iff test_def kcomp_def ifthenelse_def nondet_choice_def)\n\nlemma fbox_if_then_else [simp]:\n  \"|IF T THEN X ELSE Y] Q = ((T \\<longrightarrow> |X] Q) \\<and> (\\<not> T \\<longrightarrow> |Y] Q))\\<^sub>e\"\n  unfolding fbox_def ifthenelse_def by auto\n\nlemma hoare_if_then_else:\n  assumes \"\\<^bold>{P \\<and> T\\<^bold>} X \\<^bold>{Q\\<^bold>}\"\n    and \"\\<^bold>{P \\<and> \\<not> T\\<^bold>} Y \\<^bold>{Q\\<^bold>}\"\n  shows \"\\<^bold>{P\\<^bold>} (IF T THEN X ELSE Y) \\<^bold>{Q\\<^bold>}\"\n  using assms unfolding fbox_def ifthenelse_def by auto\n\nlemma hoare_if_then_else_inv:\n  assumes \"\\<^bold>{b \\<and> I\\<^bold>}P\\<^bold>{b \\<and> I\\<^bold>}\" \"\\<^bold>{\\<not>b \\<and> I\\<^bold>}Q\\<^bold>{\\<not>b \\<and> I\\<^bold>}\" \n  shows \"\\<^bold>{I\\<^bold>}IF b THEN P ELSE Q\\<^bold>{I\\<^bold>}\"\n  using assms\n  by (auto simp add: fbox_def expr_defs ifthenelse_def)\n\nlemma fdia_if_then_else:\n  \"|IF T THEN X ELSE Y\\<rangle> Q = ((T \\<and> |X\\<rangle> Q) \\<or> (\\<not> T \\<and> |Y\\<rangle> Q))\\<^sub>e\"\n  unfolding fdia_def ifthenelse_def by expr_auto\n\n\nsubsection \\<open> N iterations \\<close>\n\ndefinition kpower :: \"('a \\<Rightarrow> 'a set) \\<Rightarrow> nat \\<Rightarrow> ('a \\<Rightarrow> 'a set)\" \n  where [prog_defs]: \"kpower f n = (\\<lambda>s. (((;) f ^^ n) skip) s)\"\n\nlemma kpower_base:\n  shows kpower_0: \"kpower f 0 = (\\<lambda>s. {s})\" \n    and kpower_Suc_0: \"kpower f (Suc 0) = (\\<lambda>s. f s)\"\n  unfolding kpower_def \n  by (auto simp: kcomp_eq skip_def fun_eq_iff)\n\nlemmas kpower_0' = kpower_0[unfolded skip_def[symmetric]]\n\nlemma kpower_Suc: \"kpower f (Suc n) = (f ; kpower f n)\"\n  apply (induct n)\n  unfolding kcomp_eq kpower_base\n   apply(force simp: subset_antisym)\n  unfolding kpower_def kcomp_eq by simp\n\nlemma kpower_Suc': \"kpower f (Suc n) = (kpower f n; f)\"\n  apply (induct n)\n  by (simp add: kpower_base kcomp_def)\n    (simp add: kpower_Suc kcomp_assoc[symmetric])\n\nlemma \"kpower f 2 s = (\\<Union> {f s' |s'. s' \\<in> f s})\"\n  by (subgoal_tac \"2 = Suc (Suc 0)\", erule ssubst)\n    (auto simp: kpower_Suc kpower_base kcomp_id kcomp_eq)\n\nlemma kpower_empty: \"kpower (\\<lambda>s. {}) (Suc n) = (\\<lambda>s. {})\"\n  by (induct n) \n    (simp_all add: kpower_base kpower_Suc kcomp_eq)\n\nlemmas kpower_abort = kpower_empty[unfolded abort_def[symmetric]]\n\nlemma kpower_id: \"kpower (\\<lambda>s. {s}) n = (\\<lambda>s. {s})\"\n  by (induct n) \n    (simp_all add: kpower_base kpower_Suc kcomp_eq)\n\nlemmas kpower_skip = kpower_id[unfolded skip_def[symmetric]]\n\nlemma kcomp_kpower: \"(f ; kpower f n) = (kpower f n; f)\"\n  by (induct n, simp_all add: kpower_base kcomp_id \n      kpower_Suc kpower_Suc' kcomp_assoc[symmetric])\n\nlemma kpower_inv: \n  fixes F :: \"'a \\<Rightarrow> 'a set\"\n  assumes \"\\<forall>s. I s \\<longrightarrow> (\\<forall>s'. s' \\<in> F s \\<longrightarrow> I s')\" \n  shows \"\\<forall>s. I s \\<longrightarrow> (\\<forall>s'. s' \\<in> (kpower F n s) \\<longrightarrow> I s')\"\n  apply(clarsimp, induct n)\n  unfolding kpower_base kpower_Suc\n   apply(simp_all add: kcomp_eq, clarsimp) \n  apply(subgoal_tac \"I y\", simp)\n  using assms by blast\n\nlemma fbox_kpower_0: \"|kpower F 0] Q = Q\"\n  by (simp only: kpower_0 skip_def[symmetric] fbox_skip)\n\nlemma fbox_kpower_Suc: \"|kpower F (Suc n)] Q = ( |F] |kpower F n] Q)\"\n  by (simp only: kpower_Suc fbox_kcomp)\n\nlemma fdia_kpower_0: \"|kpower F 0\\<rangle> Q = Q\"\n  by (simp only: kpower_0 skip_def[symmetric] fdia_skip)\n\nlemma fdia_kpower_Suc: \"|kpower F (Suc n)\\<rangle> Q = ( |F\\<rangle> |kpower F n\\<rangle> Q)\"\n  by (simp only: kpower_Suc fdia_kcomp)\n\n\nsubsection \\<open> Finite iteration \\<close>\n\ndefinition kstar :: \"('a \\<Rightarrow> 'a set) \\<Rightarrow> ('a \\<Rightarrow> 'a set)\" (\"(_\\<^sup>*)\" [1000] 999)\n  where [prog_defs]: \"(f\\<^sup>*) s = \\<Union> {kpower f n s |n. n \\<in> UNIV}\"\n\nlemma kstar_alt: \"f\\<^sup>* = (\\<Sqinter>i\\<in>UNIV. kpower f i)\"\n  by (auto simp add: fun_eq_iff kstar_def Nondet_choice_def)\n\nlemma in_kstar_self: \"s \\<in> (f\\<^sup>*) s\"\n  unfolding kstar_def apply clarsimp\n  by (rule_tac x=\"{s}\" in exI, clarsimp)\n    (rule_tac x=0 in exI, clarsimp simp: kpower_base)\n\nlemma kstar_empty: \"(\\<lambda>s. {})\\<^sup>* = (\\<lambda>s. {s})\"\n  unfolding kstar_def apply (intro ext set_eqI iffI; clarsimp)\n  subgoal for s' s n by (induct n, simp_all add: kpower_id kpower_empty kpower_base)\n  by (rule_tac x=\"{s}\" in exI, clarsimp)\n    (rule_tac x=0 in exI, clarsimp simp: kpower_base)\n\nlemmas kstar_abort = kstar_empty[unfolded abort_def[symmetric] skip_def[symmetric]]\n\nlemma kstar_id: \"(\\<lambda>s. {s})\\<^sup>* = (\\<lambda>s. {s})\"\n  unfolding kstar_def \n  by (auto simp: fun_eq_iff kpower_base kpower_id)\n\nlemmas kstar_skip = kstar_id[unfolded skip_def[symmetric]]\n\nlemma kcomp_kstar: \"f ; f\\<^sup>* = f\\<^sup>* ; f\"\nproof(intro ext set_eqI iffI conjI impI, goal_cases \"\\<subseteq>\" \"\\<supseteq>\")\n  case (\"\\<subseteq>\" s s')\n  then obtain n where \"s' \\<in> (f ; kpower f n) s\"\n    unfolding kcomp_eq kstar_def \n    by auto\n  hence \"s' \\<in> (kpower f n; f) s\"\n    unfolding kcomp_kpower by simp\n  then show \"s' \\<in> (f\\<^sup>*; f) s\" \n    unfolding kcomp_eq kstar_def \n    by auto\nnext\n  case (\"\\<supseteq>\" s s')\n  then obtain n where \"s' \\<in> (kpower f n; f) s\"\n    unfolding kcomp_eq kstar_def \n    by auto\n  hence \"s' \\<in> (f; kpower f n) s\"\n    unfolding kcomp_kpower by simp\n  then show \"s' \\<in> (f; f\\<^sup>*) s\" \n    unfolding kcomp_eq kstar_def \n    by auto\nqed\n\nlemma fbox_kstar: \"|F\\<^sup>*] Q = (\\<lambda>s. \\<forall>n. ( |kpower F n] Q) s)\"\n  unfolding kstar_def fbox_def\n  by expr_auto\n\nlemma fdia_kstar: \"|F\\<^sup>*\\<rangle> Q = (\\<lambda>s. \\<exists>n. ( |kpower F n\\<rangle> Q) s)\"\n  unfolding kstar_def fdia_def\n  by expr_auto\n\nlemma fdia_kstarI: \"( |kpower F n\\<rangle> Q) s \\<Longrightarrow> ( |F\\<^sup>*\\<rangle> Q) s\"\n  unfolding fdia_kstar \n  by auto\n\nlemma fbox_kstar_inv: \"I \\<le> |F] I \\<Longrightarrow> I \\<le> |F\\<^sup>*] I\"\n  unfolding kstar_def fbox_def \n  apply clarsimp\n  apply(unfold le_fun_def, subgoal_tac \"\\<forall>x. I x \\<longrightarrow> (\\<forall>s'. s' \\<in> F x \\<longrightarrow> I s')\")\n  using kpower_inv[of I F] by blast simp\n\nlemma hoare_kstar_inv: \"\\<^bold>{I\\<^bold>} F \\<^bold>{I\\<^bold>} \\<Longrightarrow> \\<^bold>{I\\<^bold>} F\\<^sup>* \\<^bold>{I\\<^bold>}\"\n  by (metis SEXP_def fbox_kstar_inv)\n\nlemma fdia_kstar_inv: \"I \\<le> |F\\<rangle> I \\<Longrightarrow> I \\<le> |F\\<^sup>*\\<rangle> I\"\n  unfolding kstar_def fdia_def apply(clarsimp simp: le_fun_def)\n  apply(erule_tac x=x in allE, clarsimp, rule_tac x=s' in exI, simp)\n  apply(rule_tac x=\"kpower F 1 x\" in exI, simp add: kpower_base)\n  by (rule_tac x=1 in exI, simp add: kpower_base)\n\nlemma le_fbox_kstarI:\n  assumes \"P \\<le> I\" and \"I \\<le> Q\" and \"I \\<le> |F] I\" \n  shows \"P \\<le> |F\\<^sup>*] Q\"\nproof-\n  have \"I \\<le> |F\\<^sup>*] I\"\n    using assms(3) fbox_kstar_inv by blast\n  hence \"P \\<le> |F\\<^sup>*] I\"\n    using assms(1) by auto\n  also have \"|F\\<^sup>*] I \\<le> |F\\<^sup>*] Q\"\n    by (rule fbox_iso[OF assms(2)])\n  finally show ?thesis .\nqed\n\nlemma hoare_kstarI: \"`P \\<longrightarrow> I` \\<Longrightarrow> `I \\<longrightarrow> Q` \\<Longrightarrow> \\<^bold>{I\\<^bold>} F \\<^bold>{I\\<^bold>} \\<Longrightarrow> \\<^bold>{P\\<^bold>} F\\<^sup>* \\<^bold>{Q\\<^bold>}\"\n  by (rule le_fbox_kstarI) (auto simp: SEXP_def taut_def)\n\nlemma le_fdia_kstarI:\n  assumes \"P \\<le> I\" and \"I \\<le> Q\" and \"I \\<le> |F\\<rangle> I\" \n  shows \"P \\<le> |F\\<^sup>*\\<rangle> Q\"\nproof-\n  have \"I \\<le> |F\\<^sup>*\\<rangle> I\"\n    using assms(3) fdia_kstar_inv by blast\n  hence \"P \\<le> |F\\<^sup>*\\<rangle> I\"\n    using assms(1) by auto\n  also have \"|F\\<^sup>*\\<rangle> I \\<le> |F\\<^sup>*\\<rangle> Q\"\n    by (rule fdia_iso[OF assms(2)])\n  finally show ?thesis .\nqed\n\nlemma fdia_kstar_fixpoint: \n  \"`|F\\<^sup>*\\<rangle> Q \\<longleftrightarrow> ( |F\\<rangle> |F\\<^sup>*\\<rangle> Q \\<or> Q)`\"\n  apply (intro pred_iffI)\n  subgoal\n    unfolding fdia_kstar\n    unfolding fdia_def\n    unfolding taut_def SEXP_def\n    apply (intro allI impI conjI)\n    unfolding fdia_def apply clarsimp\n    apply (rename_tac s n s')\n     apply (subgoal_tac \"n \\<noteq> 0\")\n    prefer 2 using kpower_0[of F, simplified fun_eq_iff]\n      apply (metis singletonD)\n     apply (subgoal_tac \"\\<exists>m. n = Suc m\"; clarsimp)\n      prefer 2 using not0_implies_Suc apply blast\n    unfolding kpower_Suc kcomp_def apply clarsimp\n    apply (rule_tac x=x in exI, simp)\n    by (rule_tac x=m in exI, force) (* first conjunct done *)\n  subgoal\n    unfolding fdia_kstar\n    unfolding fdia_def\n    unfolding taut_def SEXP_def\n    apply (intro allI impI conjI)\n    apply (erule disjE; clarsimp?)\n    apply (rename_tac s s' n s'')\n    apply (rule_tac x=\"Suc n\" in exI, clarsimp simp: kpower_Suc kcomp_def, force)\n    by (rule_tac x=0 in exI, clarsimp simp: kpower_0)\n  done\n\nlemma fdia_kstar_fixpoint': \n  \"( |F\\<^sup>*\\<rangle> Q) = (\\<lambda>s. ( |F\\<rangle> |F\\<^sup>*\\<rangle> Q) s \\<or> Q s)\"\n  \"( |F\\<^sup>*\\<rangle> Q) s = (( |F\\<rangle> |F\\<^sup>*\\<rangle> Q) s \\<or> Q s)\"\n  using fdia_kstar_fixpoint[of F Q]\n  unfolding taut_def SEXP_def by blast+\n\nlemma fdia_kstar_strongest: \n  \"`@P \\<longleftrightarrow> ( |F\\<rangle> P) \\<or> Q` \\<Longrightarrow> `|F\\<^sup>*\\<rangle> Q \\<longrightarrow> @P`\"\n  unfolding fdia_kstar\n  unfolding taut_def SEXP_def\n  apply (intro conjI impI allI)\n  apply (clarsimp simp: )\n  subgoal for s n\n    apply (induct n arbitrary: s)\n    apply (thin_tac \"\\<forall>\\<s>. P \\<s> = (fdia F P \\<s> \\<or> Q \\<s>)\")\n     apply (clarsimp simp: kpower_0 fdia_def)\n    apply (subst fdia_def, clarsimp simp: kpower_Suc)\n    apply (subst (asm) fdia_kcomp[unfolded SEXP_def])\n    apply (subst (asm) fdia_def[of F \"fdia _ _\"], clarsimp)\n    by blast\n  done\n\n(* TODO: revise proofs, names and usage of these |F\\<^sup>*\\<rangle> Q *)\n\nlemma fdia_unfoldI: \"( |F\\<rangle> Q) s \\<or> ( |F\\<rangle> |F\\<^sup>*\\<rangle> Q) s \\<Longrightarrow> ( |F\\<^sup>*\\<rangle> Q) s\"\nproof-\n  assume \"( |F\\<rangle> Q) s \\<or> ( |F\\<rangle> |F\\<^sup>*\\<rangle> Q) s\"\n  moreover\n  {assume \"( |F\\<rangle> Q) s\"\n    hence \"( |kpower F (Suc 0)\\<rangle> Q) s\"\n      unfolding fdia_def kpower_base .\n    hence \"( |F\\<^sup>*\\<rangle> Q) s\"\n      using fdia_kstarI[of F \"Suc 0\"] \n      by blast}\n  moreover\n  {assume hyp: \"( |F\\<rangle> |F\\<^sup>*\\<rangle> Q) s\"\n    then obtain n s' \\<sigma> where fst_step: \"\\<sigma> \\<in> F s\" \n      and end_step: \"Q s'\" and nth_step: \"s' \\<in> kpower F n \\<sigma>\"\n      by (clarsimp simp: kstar_def fdia_def)\n    hence \"( |F\\<^sup>*\\<rangle> Q) s\"\n    proof (clarsimp simp: kstar_def fdia_def, cases \"n=0\")\n      case True\n      then show \"\\<exists>s'. (\\<exists>x. (\\<exists>m. x = kpower F m s) \\<and> s' \\<in> x) \\<and> Q s'\"\n        using nth_step fst_step end_step\n        apply (rule_tac x=s' in exI, clarsimp)\n        by (rule_tac x=\"kpower F 1 s\" in exI, simp add: kpower_base)\n          (rule_tac x=1 in exI, simp add: kpower_base)\n    next\n      case False\n      hence \"\\<exists>m. \\<mu> {kpower F n y |y. y \\<in> F s} = kpower F m s\"\n        apply (rule_tac x=\"Suc n\" in exI, subst kcomp_eq[of F \"kpower F n\", symmetric])\n        by (auto simp: kpower_Suc)\n      then show \"\\<exists>s'. (\\<exists>x. (\\<exists>m. x = kpower F m s) \\<and> s' \\<in> x) \\<and> Q s'\" \n        using nth_step fst_step end_step\n        apply (rule_tac x=s' in exI, clarsimp)\n        by (rule_tac x=\"kpower F (Suc n) s\" in exI)\n          (auto simp add: kpower_Suc kcomp_eq)\n    qed\n  }\n  ultimately show ?thesis\n    by blast\nqed\n\nlemma nat_strong_induct[case_names zero induct]:\n  assumes \"P 0\"\n    and \"(\\<And>n. (\\<And>m. m \\<le> n \\<Longrightarrow> P m) \\<Longrightarrow> P (Suc n))\"\n  shows \"P n\"\n  using assms\n  apply (induct n rule: full_nat_induct)\n  by simp (metis Suc_le_mono not0_implies_Suc)\n\nlemma fdia_kstar_variant':\n  assumes init: \"I (n::nat) s\"\n    and iter: \"`\\<forall>m>0. \\<exists>n. @(I m) \\<le> |F\\<rangle> @(I n) \\<and> n < m`\"\n  shows \"( |F\\<^sup>*\\<rangle> @(I 0)) s\"\nproof(simp add: fdia_kstar)\n  have \"n = 0 \\<Longrightarrow> ( |F\\<^sup>*\\<rangle> @(I 0)) s\"\n    using init \n    by (simp add: fdia_kstar)\n      (metis fdia_kpower_0)\n  have \"\\<forall>ms. fst ms > 0 \\<and> I (fst ms) (snd ms) \n    \\<longrightarrow> (\\<exists>ns. snd ns \\<in> F (snd ms) \\<and> I (fst ns) (snd ns) \\<and> fst ns < fst ms)\"\n    using iter apply (clarsimp simp: taut_def fdia_def)\n    by (erule_tac x=b in allE, erule_tac x=a in allE, force)\n  then obtain f where f_hyp: \"\\<forall>ms. fst ms > 0 \\<and> I (fst ms) (snd ms)\n    \\<longrightarrow> (snd (f ms) \\<in> F (snd ms) \\<and> I (fst (f ms)) (snd (f ms)) \\<and> fst (f ms) < fst ms)\"\n    using iter\n    apply (atomize_elim)\n    by (rule choice_iff'[of \"\\<lambda>x. fst x > 0 \\<and> I (fst x) (snd x)\"\n          \"\\<lambda>ms ns. (snd ns) \\<in> F (snd ms) \\<and> I (fst ns) (snd ns) \\<and> fst ns < fst ms\", THEN iffD1])\n      (auto simp: taut_def SEXP_def)\n(* I n s \\<Longrightarrow> f (n, s) = (n\\<^sub>1, s\\<^sub>1) \\<and> I n\\<^sub>1 s\\<^sub>1 \\<and> n\\<^sub>1 < n \\<and> s\\<^sub>1 \\<in> F s\n         \\<Longrightarrow> f (n\\<^sub>1, s\\<^sub>1) = (n\\<^sub>2, s\\<^sub>2) \\<and> I n\\<^sub>2 s\\<^sub>2 \\<and> n\\<^sub>2 < n\\<^sub>1 \\<and> s\\<^sub>2 \\<in> F s\\<^sub>1\n         \\<Longrightarrow> ...\n         \\<Longrightarrow> f (n\\<^sub>m\\<^sub>-\\<^sub>1, s\\<^sub>m\\<^sub>-\\<^sub>1) = (n\\<^sub>m, s\\<^sub>m) \\<and> I n\\<^sub>m s\\<^sub>m \\<and> 0 = n\\<^sub>m < n\\<^sub>m\\<^sub>-\\<^sub>1 \\<and> s\\<^sub>m \\<in> F s\\<^sub>m\\<^sub>-\\<^sub>1 *)\n  have \"\\<exists>m\\<le>n. fst ((f^^m) (n, s)) = 0 \\<and> (\\<forall>l\\<le>m. \\<forall>ms. (f ^^ l) (n, s) = ms \n    \\<longrightarrow> (snd ms) \\<in> kpower F l s \\<and> I (fst ms) (snd ms))\"\n    using init\n  proof (induct n arbitrary: s rule: nat_strong_induct)\n    case zero\n    then show ?case\n      by (rule_tac x=0 in exI, simp add: kpower_0)\n  next\n    case (induct n)\n    then obtain m and s' where \"s' \\<in> F s\" \"I m s'\" \"m \\<le> n\"\n      and f_Suc: \"(m, s') = f (Suc n, s)\"\n      using f_hyp[rule_format, of \"(Suc n, s)\"] \n      by auto\n    then obtain k and s'' where \"((f ^^ k) (m, s')) = (0, s'')\" and \"k \\<le> m\"\n      and \"\\<forall>l\\<le>k. snd ((f ^^ l) (m, s')) \\<in> kpower F l s' \n        \\<and> I (fst ((f ^^ l) (m, s'))) (snd ((f ^^ l) (m, s')))\"\n      using induct.hyps[OF \\<open>m \\<le> n\\<close> \\<open>I m s'\\<close>, simplified]\n      by auto (metis prod.collapse)\n    thus ?case \n      using \\<open>m \\<le> n\\<close>\n      apply (rule_tac x=\"Suc k\" in exI)\n      apply (clarsimp simp add: funpow_Suc_right f_Suc simp del: funpow.simps(2))\n      subgoal for l\n        apply (cases l; simp add: kpower_0 kpower_Suc kcomp_def \n            funpow_Suc_right del: funpow.simps(2))\n        using induct.prems apply blast\n        using \\<open>s' \\<in> F s\\<close> by blast\n      done\n  qed\n  then obtain m where \"fst ((f^^m) (n, s)) = 0\" \n    and \"\\<forall>l\\<le>m. \\<forall>ms. (f ^^ l) (n, s) = ms \\<longrightarrow> (snd ms) \\<in> kpower F l s \\<and> I (fst ms) (snd ms)\"\n    and \"m \\<le> n\"\n    by blast\n  then show \"\\<exists>n. ( |kpower F n\\<rangle> @(I 0)) s\"\n    by (rule_tac x=m in exI)\n      (metis SEXP_def dual_order.refl fdia_def)\nqed\n\nlemma fdia_kstar_convergence:\n  fixes P::\"real \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  defines \"Q \\<equiv> (\\<lambda>s. \\<exists>r::real\\<le>0. P r s)\"\n  assumes init: \"P r s\"\n    and iter: \"`\\<forall>r>0. @(P r) \\<longrightarrow> ( |F\\<rangle> @(P (r - 1)))`\"\n  shows \"( |F\\<^sup>*\\<rangle> Q) s\"\nproof-\n  have iter': \"\\<And>s. \\<forall>r>0. P r s \\<longrightarrow> ( |F\\<rangle> @(P (r - 1))) s\"\n    using iter by (auto simp: taut_def)\n  have init': \"P r s\"\n    using init by expr_simp\n  then obtain r where \"P r s\"\n    by blast\n  hence \"r \\<le> 0 \\<Longrightarrow> Q s\"\n    using assms by blast\n  hence case1: \"r \\<le> 0 \\<Longrightarrow> ( |F\\<^sup>*\\<rangle> Q) s\"\n    by (clarsimp simp: fdia_def)\n      (rule_tac x=s in exI, simp add: in_kstar_self)\n  have obs_induct: \n    \"`\\<forall>t::real. t - \\<guillemotleft>n\\<guillemotright> > 0 \\<longrightarrow> @(P t) \\<longrightarrow> ( |kpower F n\\<rangle> @(P (t - n)))`\" for n::nat\n  proof (induct n )\n    case 0\n    then show ?case \n      using iter'[rule_format]\n      by (simp add: kpower_base fdia_def taut_def)\n  next\n    case (Suc n)\n    show ?case\n    proof(clarsimp simp only: taut_def, clarsimp)\n      fix s t\n      assume hyps: \"1 + real n < t\" \"P t s\"\n      hence \"t > 0\" \"0 < t - real n\"\n        by auto\n      hence induct': \"\\<And>m s t. 0 < t - real n \\<Longrightarrow> P t s \n        \\<Longrightarrow> ( |kpower F n\\<rangle> @(P (t - real n))) s\"\n        using Suc\n        by expr_simp\n      hence case_eq0: \"n = 0 \\<Longrightarrow> ( |kpower F (Suc n)\\<rangle> @(P (t - (1 + real n)))) s\"\n        using iter'[rule_format, OF \\<open>t > 0\\<close> \\<open>P t s\\<close>]\n        by (subst kpower_Suc, subst fdia_kcomp)\n          (simp add: kpower_base skip_def[symmetric] fdia_skip)\n      have \"( |kpower F n\\<rangle> @(P (t - real n))) s\"\n        using hyps induct'[OF \\<open>0 < t - real n\\<close>]\n        by force\n      moreover note iter'[rule_format, OF \\<open>0 < t - real n\\<close>]\n      ultimately have \"n \\<noteq> 0 \\<Longrightarrow> ( |kpower F (Suc n)\\<rangle> @(P (t - (1 + real n)))) s\"\n        apply -\n        apply (frule not0_implies_Suc, clarsimp)\n        apply (subst kpower_Suc, subst fdia_kcomp)\n        apply (subst (asm) kpower_Suc, subst (asm) fdia_kcomp)\n        apply (rule fdia_mono, force)\n        apply (subst kpower_Suc, subst kcomp_kpower, subst fdia_kcomp)\n        by (rule fdia_mono) (auto simp: taut_def diff_add_eq_diff_diff_swap)\n      thus \"( |kpower F (Suc n)\\<rangle> @(P (t - (1 + real n)))) s\"\n        using case_eq0 by blast\n    qed\n  qed\n  moreover\n  {assume \"r > 0\"\n    then obtain n::nat where r_hyps: \"Suc n \\<ge> r\" \"r - n > 0\"\n      using pos_real_within_Suc \n      by auto\n    hence \"( |kpower F n\\<rangle> @(P (r - n))) s\"\n      using obs_induct[unfolded taut_def, rule_format, \n          simplified, rule_format, OF _ \\<open>P r s\\<close>]\n      by simp\n    hence \"( |F\\<^sup>*\\<rangle> @(P (r - n))) s\"\n      using fdia_kstarI[of F \"n\"] \n      by force\n    hence \"( |F\\<^sup>*\\<rangle> @(P (r - (Suc n)))) s\"\n      apply (intro fdia_unfoldI disjI2)\n      apply (subst fdia_kcomp[symmetric])\n      apply (subst kcomp_kstar, subst fdia_kcomp)\n      apply (rule fdia_mono, force)\n      using iter'[rule_format, OF \\<open>r - n > 0\\<close>]\n      by (auto simp: taut_def diff_add_eq_diff_diff_swap)\n    hence \"( |F\\<^sup>*\\<rangle> @Q) s\"\n      unfolding assms \n      apply (rule fdia_mono)\n      using r_hyps\n      by (clarsimp simp: taut_def)\n        (rule_tac x=\"r - Suc n\" in exI, force)}\n  ultimately show \"( |F\\<^sup>*\\<rangle> @Q) s\"\n    using case1 by linarith\nqed\n\nlemma fdia_kstar_real_variantI:\n  fixes P::\"real \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  assumes init: \"P r s\"\n    and iter: \"`\\<forall>r>0. @(P r) \\<longrightarrow> ( |F\\<rangle> @(P (r - 1)))`\"\n    and \"`(\\<exists>r\\<le>0. @(P r)) \\<longrightarrow> Q`\"\n  shows \"( |F\\<^sup>*\\<rangle> Q) s\"\n  by (rule fdia_mono(1)[OF fdia_kstar_convergence[OF assms(1,2)] assms(3)])\n\nlemma fdia_kstar_variantI: \"`P \\<longrightarrow> @(V k)` \\<Longrightarrow> `\\<forall>k. @(V k) \\<le> |F\\<rangle> (@(V (k-1)))` \n  \\<Longrightarrow> `(\\<exists>k\\<le>0. @(V k)) \\<longrightarrow> Q` \\<Longrightarrow> P \\<le> |F\\<^sup>*\\<rangle> Q\" for k::int\n  apply (subst impl_eq_leq[symmetric])\n  apply (subst taut_def, subst SEXP_def)\n  apply (clarify)\n  apply (rule_tac P=\"\\<lambda>r s. V \\<lfloor>r\\<rfloor> s\" and r=\"real_of_int k\" in fdia_kstar_real_variantI)\n    apply (clarsimp simp: taut_def)\n   apply (clarsimp simp: taut_def)\n  apply (thin_tac \"`P \\<longrightarrow> @(V k)`\", thin_tac \"`\\<forall>k. @(V k) \\<le> |F\\<rangle> (@(V (k-1)))`\")\n  apply (clarsimp simp: taut_def)\n  apply (erule_tac x=s in allE)\n  by (erule impE, rule_tac x=\"\\<lfloor>r\\<rfloor>\" in exI, simp_all)\n\n\nsubsection \\<open> Loops with annotated invariants \\<close>\n\ndefinition loopi :: \"('a \\<Rightarrow> 'a set) \\<Rightarrow> 'a pred \\<Rightarrow> ('a \\<Rightarrow> 'a set)\" \n  where [prog_defs]: \"loopi F I \\<equiv> (F\\<^sup>*)\"\n\nsyntax \"_loopi\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"LOOP _ INV _\" [0, 63] 64)\ntranslations \"_loopi F I\" == \"CONST loopi F (I)\\<^sub>e\"\n\nlemma change_loopI: \"LOOP X INV G = LOOP X INV I\"\n  unfolding loopi_def by simp\n\nlemma fbox_loopI: \"P \\<le> I \\<Longrightarrow> I \\<le> Q \\<Longrightarrow> I \\<le> |F] I \\<Longrightarrow> P \\<le> |LOOP F INV I] Q\"\n  unfolding loopi_def using le_fbox_kstarI[of \"P\"] by (auto simp: SEXP_def)\n\nlemma in_fbox_loopI: \"I s \\<Longrightarrow> I \\<le> Q \\<Longrightarrow> I \\<le> ( |R] @(I)) \\<Longrightarrow> ( |LOOP R INV @I] (@Q)) s\"\n  using fbox_loopI[of I I Q R]\n  by (clarsimp simp: le_fun_def)\n\nlemma fbox_loopI': \"P \\<le> I \\<Longrightarrow> I \\<le> Q \\<Longrightarrow> I \\<le> fbox F I \\<Longrightarrow> P \\<le> fbox (loopi F I) Q\"\n  by (metis clarify_fbox le_fbox_kstarI loopi_def)\n\nlemma hoare_loopI: \"\\<^bold>{I\\<^bold>} F \\<^bold>{I\\<^bold>} \\<Longrightarrow> `P \\<longrightarrow> I` \\<Longrightarrow> `I \\<longrightarrow> Q` \\<Longrightarrow> \\<^bold>{P\\<^bold>} LOOP F INV I \\<^bold>{Q\\<^bold>}\"\n  by (rule fbox_loopI) (auto simp: SEXP_def taut_def)\n\nlemma fdia_loopI: \"P \\<le> I \\<Longrightarrow> I \\<le> Q \\<Longrightarrow> I \\<le> |F\\<rangle> I \\<Longrightarrow> P \\<le> |LOOP F INV I\\<rangle> Q\"\n  unfolding loopi_def using le_fdia_kstarI[of \"P\"] by (auto simp: SEXP_def)\n\nlemma hoare_loop_seqI: \"\\<^bold>{I\\<^bold>} F \\<^bold>{I\\<^bold>} \\<Longrightarrow> \\<^bold>{I\\<^bold>} G \\<^bold>{I\\<^bold>} \\<Longrightarrow> `P \\<longrightarrow> I` \\<Longrightarrow> `I \\<longrightarrow> Q` \n  \\<Longrightarrow> \\<^bold>{P\\<^bold>} LOOP (F ; G) INV I \\<^bold>{Q\\<^bold>}\"\n  by (rule fbox_loopI, simp_all add: wlp refine_iff_implies)\n     (metis (full_types) fbox_iso order.trans refine_iff_implies)\n\nlemma fbox_loopI_break: \n  \"P \\<le> |Y] I \\<Longrightarrow> I \\<le> |X] I \\<Longrightarrow> I \\<le> Q \\<Longrightarrow> P \\<le> |Y ; (LOOP X INV I)] Q\"\n  apply(subst fbox_to_hoare, rule hoare_kcomp, force)\n  by (rule hoare_loopI, auto simp: SEXP_def taut_def)\n\nlemma hoare_loopI_break: \n  \"\\<^bold>{I\\<^bold>} X \\<^bold>{I\\<^bold>} \\<Longrightarrow> \\<^bold>{P\\<^bold>} Y \\<^bold>{I\\<^bold>} \\<Longrightarrow> `I \\<longrightarrow> Q` \\<Longrightarrow> \\<^bold>{P\\<^bold>} (Y ; (LOOP X INV I)) \\<^bold>{Q\\<^bold>}\"\n  by (rule hoare_kcomp, force) (rule hoare_loopI, simp_all)\n\n\nsubsection \\<open> While loop \\<close>\n\ndefinition while :: \"'a pred \\<Rightarrow> ('a \\<Rightarrow> 'a set) \\<Rightarrow> ('a \\<Rightarrow> 'a set)\" \n  where [prog_defs]: \"while T X \\<equiv> (\\<questiondown>T? ; X)\\<^sup>* ; \\<questiondown>\\<not>T?\"\n\nsyntax \"_while\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"WHILE _ DO _\" [0,64] 64)\ntranslations \"WHILE T DO X\" == \"CONST while (T)\\<^sub>e X\"\n\nlemma hoare_while:\n  \"\\<^bold>{I \\<and> T\\<^bold>} X \\<^bold>{I\\<^bold>} \\<Longrightarrow> \\<^bold>{I\\<^bold>} (WHILE T DO X) \\<^bold>{\\<not> T \\<and> I\\<^bold>}\"\n  unfolding while_def \n  apply (simp add: fbox_test fbox_kcomp)\n  apply (rule_tac p\\<^sub>2=I and q\\<^sub>2=I in hoare_conseq)\n    prefer 3 apply expr_simp\n  prefer 2 apply expr_simp\n  apply (rule_tac I=\"I\" in hoare_kstarI)\n      apply expr_simp\n   apply expr_simp\n  apply (rule_tac R=\"(I \\<and> T)\\<^sup>e\" in hoare_kcomp)\n  by (auto simp: fbox_test fbox_kcomp)\n\nlemma hoare_whileI: \"\\<^bold>{I \\<and> T\\<^bold>} X \\<^bold>{I\\<^bold>} \\<Longrightarrow> `P \\<longrightarrow> I` \\<Longrightarrow> `I \\<and> \\<not> T \\<longrightarrow> Q`\n  \\<Longrightarrow> \\<^bold>{P\\<^bold>} WHILE T DO X INV I \\<^bold>{Q\\<^bold>}\"\n  by (rule hoare_conseq, subst invar_def)\n    (rule hoare_while, assumption, auto simp: taut_def)\n\nlemma fbox_whileI: \"P \\<le> I \\<Longrightarrow> (I \\<and> T)\\<^sub>e \\<le> |X] I \\<Longrightarrow> (I \\<and> \\<not> T)\\<^sub>e \\<le> Q \n  \\<Longrightarrow> P \\<le> |WHILE T DO X INV I] Q\"\n  using hoare_whileI[unfolded fbox_to_hoare[symmetric], of I T X P Q] \n  by expr_auto\n\nlemma hoare_whileI_break: \n  \"\\<^bold>{I \\<and> T\\<^bold>} X \\<^bold>{I\\<^bold>} \\<Longrightarrow> \\<^bold>{P\\<^bold>} Y \\<^bold>{I\\<^bold>} \\<Longrightarrow> `I \\<and> \\<not> T \\<longrightarrow> Q` \\<Longrightarrow> \\<^bold>{P\\<^bold>} Y ; WHILE T DO X INV I \\<^bold>{Q\\<^bold>}\"\n  by (rule hoare_kcomp, force)\n    (rule hoare_whileI; expr_auto)\n\nlemma fdia_while_variantI:\n  fixes V :: \"int \\<Rightarrow> 's \\<Rightarrow> bool\" and T :: \"'s \\<Rightarrow> bool\"\n  shows \"`P \\<longrightarrow> @(V k)` \n  \\<Longrightarrow> `\\<forall>k>0. @(V k) \\<longrightarrow> T`\n  \\<Longrightarrow> `\\<forall>k::int. @(V k) \\<le> |X\\<rangle> @(V (k-1))` \n  \\<Longrightarrow> `(\\<exists>k\\<le>0. @(V k)) \\<longrightarrow> \\<not> T \\<and> Q` \\<Longrightarrow> P \\<le> |WHILE T DO X\\<rangle> Q\"\n  apply (simp add: while_def fdia_kcomp fdia_test)\n  apply (cases \"k \\<le> 0\", clarsimp simp: taut_def fdia_kstar)\n  apply (erule_tac P=\"\\<lambda>s. (\\<exists>k\\<le>0. V k s) \\<longrightarrow> \\<not> T s \\<and> Q s\" and x=x in allE)\n  apply (erule impE, force, rule_tac x=0 in exI, simp add: fdia_kpower_0)\n  apply (rule_tac P\\<^sub>2=\"V k\" and Q\\<^sub>2=\"V 0\" in fdia_conseq)\n    prefer 3 apply (fastforce simp: taut_def)\n   prefer 2 apply simp\n  apply (clarsimp simp: impl_eq_leq[symmetric] taut_def)\n  apply (rule fdia_kstar_variant'[of V _ _ \"\\<questiondown>T? ; X\", simplified, of \"nat k\"])\n   apply simp\n  apply (clarsimp simp add: taut_def)\n  apply (rule_tac x=\"m - 1\" in exI, clarsimp)\n  apply (rename_tac s s' m)\n  apply (erule_tac P=\"\\<lambda>s. \\<forall>k. V k s \\<longrightarrow> ( |X\\<rangle> @(V (k - 1))) s\" and x=s' in allE)\n  apply (erule_tac x=\"int m\" in allE, simp add: fdia_kcomp fdia_test)\n  apply (rule conjI)\n  by force \n    (metis One_nat_def Suc_leI of_nat_1 of_nat_diff)\n\n\nsubsection \\<open> Framing \\<close>\n\nnamed_theorems closure\n\ndefinition frame :: \"'s scene \\<Rightarrow> 's prog \\<Rightarrow> 's prog\"\n  where [prog_defs]: \"frame a P = (\\<lambda> s. {s'. s = cp\\<^bsub>a\\<^esub> s s' \\<and> s' \\<in> P s})\"\n\nsyntax \"_frame\" :: \"salpha \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_:[_]\" [65] 65)\ntranslations \"_frame a P\" == \"CONST frame a P\"\n\nlemma frame_UNIV: \"\\<Sigma>:[P] = P\"\n  by (simp add: frame_def lens_defs)\n\nlemma frame_skip: \"idem_scene a \\<Longrightarrow> a:[skip] = skip\"\n  by (auto simp add: skip_def frame_def fun_eq_iff)\n  \nlemma frame_assign_in:\n  assumes \"vwb_lens x\" \"idem_scene a\" \"\\<lbrakk>x\\<rbrakk>\\<^sub>\\<sim> \\<le> a\"\n  shows \"a:[x ::= v] = x ::= v\"\n  using assms\n  by (auto simp add: prog_defs expr_defs fun_eq_iff put_scene_override_le)\n  \ndefinition not_modifies :: \"'s prog \\<Rightarrow> ('a, 's) expr \\<Rightarrow> bool\" where\n  \"not_modifies P e = (\\<forall> s s'. s' \\<in> P s \\<longrightarrow> e s' = e s)\" \n\nsyntax \"_not_modifies\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic\" (infix \"nmods\" 30)\ntranslations \"_not_modifies P e\" == \"CONST not_modifies P (e)\\<^sub>e\"\n\n(* FIXME: The following rule is an inefficient way to calculate modification; \n  replace with scene membership laws. *)\n\nlemma nmods_union [closure]:\n  assumes \"P nmods e\" \"P nmods f\"\n  shows \"P nmods (e, f)\"\n  using assms\n  by (auto simp add: not_modifies_def prog_defs)\n\nlemma nmods_skip [closure]: \"skip nmods e\"\n  by (simp add: not_modifies_def prog_defs scene_equiv_def)\n\nlemma nmods_seq [closure]:\n  assumes \"P nmods e\" \"Q nmods e\"\n  shows \"(P ; Q) nmods e\"\n  using assms \n  by (auto simp add: not_modifies_def prog_defs scene_equiv_def)\n\nlemma nmods_if [closure]:\n  assumes \"P nmods e\" \"Q nmods e\"\n  shows \"IF b THEN P ELSE Q nmods e\"\n  using assms by (auto simp add: not_modifies_def prog_defs)\n\nlemma nmods_choice [closure]:\n  assumes \"P nmods e\" \"Q nmods e\"\n  shows \"P \\<sqinter> Q nmods e\"  \n  using assms by (auto simp add: not_modifies_def prog_defs)\n\nlemma nmods_Choice [closure]:\n  assumes \"\\<And> i. i \\<in> I \\<Longrightarrow> P(i) nmods e\"\n  shows \"(\\<Sqinter> i\\<in>I. P(i)) nmods e\"\n  using assms\n  by (auto simp add: Nondet_choice_def not_modifies_def)\n\nlemma nmods_kpower [closure]:\n  assumes \"P nmods e\"\n  shows \"(kpower P n) nmods e\"\nproof (induct n)\n  case 0\n  then show ?case\n    by (metis kpower_0' nmods_skip) \nnext\n  case (Suc n)\n  then show ?case\n    by (metis assms kpower_Suc' nmods_seq)\nqed\n\nlemma nmods_star [closure]:\n  assumes \"P nmods e\"\n  shows \"P\\<^sup>* nmods e\"\n  by (simp add: assms kstar_alt nmods_Choice nmods_kpower)\n\nlemma nmods_loop [closure]:\n  assumes \"P nmods e\"\n  shows \"LOOP P INV B nmods e\"\n  by (simp add: assms loopi_def nmods_star)\n\nlemma nmods_test [closure]:\n  \"\\<questiondown>b? nmods e\"\n  by (auto simp add: not_modifies_def prog_defs scene_equiv_def)\n\nlemma nmods_assigns [closure]:\n  assumes \"\\<sigma> \\<dagger> (e)\\<^sub>e = (e)\\<^sub>e\" \n  shows \"\\<langle>\\<sigma>\\<rangle> nmods e\"\n  using assms\n  by (expr_simp add: not_modifies_def assigns_def put_scene_override_indep)\n\nlemma nmods_assign:\n  assumes \"(a)\\<^sub>e\\<lbrakk>e/x\\<rbrakk> = (a)\\<^sub>e\"\n  shows \"x ::= e nmods a\"\n  by (metis SEXP_def assms nmods_assigns)\n\nlemma nmods_via_fbox:\n  \"\\<lbrakk> vwb_lens x; \\<And> v. |P] (e = \\<guillemotleft>v\\<guillemotright>) = (e = \\<guillemotleft>v\\<guillemotright>)\\<^sub>e \\<rbrakk> \\<Longrightarrow> P nmods e\"\n  by (expr_simp add: fbox_def not_modifies_def)\n\ntext \\<open> Important principle: If @{term P} does not modify @{term a}, and predicate @{term b} does\n  not refers only variables outside of @{term a} then @{term b} is an invariant of @{term P}. \\<close>\n\nlemma nmods_frame_law:\n  assumes \"S nmods I\" \"\\<^bold>{P\\<^bold>}S\\<^bold>{Q\\<^bold>}\"\n  shows \"\\<^bold>{P \\<and> I\\<^bold>}S\\<^bold>{Q \\<and> I\\<^bold>}\"\n  using assms\n  by (auto simp add: prog_defs fbox_def expr_defs not_modifies_def)\n\nlemma nmods_invariant:\n  assumes \"P nmods b\"\n  shows \"\\<^bold>{b\\<^bold>}P\\<^bold>{b\\<^bold>}\"\n  using assms\n  by (auto simp add: prog_defs fbox_def expr_defs not_modifies_def)\n\nend", "meta": {"author": "isabelle-utp", "repo": "Hybrid-Verification", "sha": "ccc5876d270a436a3c4be8c44932256e5d291cf3", "save_path": "github-repos/isabelle/isabelle-utp-Hybrid-Verification", "path": "github-repos/isabelle/isabelle-utp-Hybrid-Verification/Hybrid-Verification-ccc5876d270a436a3c4be8c44932256e5d291cf3/Hybrid_Programs/Regular_Programs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6548947155710233, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.34533680459456245}}
{"text": "header {* Soundness for graphical diagrams *}\n\ntheory Ribbons_Graphical_Soundness imports \n  Ribbons_Graphical \n  Finite_Map\nbegin\n\ntext {* We prove that the proof rules for graphical ribbon proofs are sound \n  with respect to the rules of separation logic.\n\n  We impose an additional assumption to achieve soundness: that the \n  Frame rule has no side-condition. This assumption is reasonable because there\n  are several separation logics that lack such a side-condition, such as\n  ``variables-as-resource''. \n\n  We first describe how to extract proofchains from a diagram. This process is \n  similar to the process of extracting commands from a diagram, which was\n  described in @{theory Ribbons_Graphical}. When we extract a proofchain, we\n  don't just include the commands, but the assertions in between them. Our\n  main lemma for proving soundness says that each of these proofchains \n  corresponds to a valid separation logic proof.\n*}\n\nsubsection {* Proofstate chains *}\n\ntext {* When extracting a proofchain from a diagram, we need to keep track \n  of which nodes we have processed and which ones we haven't. A \n  proofstate, defined below, maps a node to ``Top'' if it hasn't been\n  processed and ``Bot'' if it has. *}\n\ndatatype topbot = Top | Bot\n\ntype_synonym proofstate = \"node \\<rightharpoonup>\\<^sub>f topbot\"\n\ntext {* A proofstate chain contains all the nodes and edges of a graphical\n  diagram, interspersed with proofstates that track which nodes have been\n  processed at each point. *}\n \ntype_synonym ps_chain = \"(proofstate, node + edge) chain\"\n\ntext {* The @{term \"next_ps \\<sigma>\"} function processes one node or one edge in a\n  diagram, given the current proofstate @{term \\<sigma>}. It processes a node\n  @{term v} by replacing the mapping from @{term v} to @{term Top} with a \n  mapping from @{term v} to @{term Bot}. It processes an edge @{term e} \n  (whose source and target nodes are @{term vs} and @{term ws} respectively) \n  by removing all the mappings from @{term vs} to @{term Bot}, and adding\n  mappings from @{term ws} to @{term Top}. *}\n\nfun next_ps :: \"proofstate \\<Rightarrow> node + edge \\<Rightarrow> proofstate\"\nwhere\n  \"next_ps \\<sigma> (Inl v) = \\<sigma> \\<ominus> {|v|} \\<oplus> [{|v|} |=> Bot]\"\n| \"next_ps \\<sigma> (Inr e) = \\<sigma> \\<ominus> fst3 e \\<oplus> [thd3 e |=> Top]\"\n\ntext {* The function @{term \"mk_ps_chain \\<Pi> \\<pi>\"} generates from @{term \\<pi>}, which \n  is a list of nodes and edges, a proofstate chain, by interspersing the \n  elements of @{term \\<pi>} with the appropriate proofstates. The first argument\n  @{term \\<Pi>} is the part of the chain that has already been converted. *}\n\ndefinition\n  mk_ps_chain :: \"[ps_chain, (node + edge) list] \\<Rightarrow> ps_chain\"\nwhere\n  \"mk_ps_chain \\<equiv> foldl (\\<lambda>\\<Pi> x. cSnoc \\<Pi> x (next_ps (post \\<Pi>) x))\"\n\nlemma mk_ps_chain_preserves_length:\n  fixes \\<pi> \\<Pi>\n  shows \"chainlen (mk_ps_chain \\<Pi> \\<pi>) = chainlen \\<Pi> + length \\<pi>\"\nproof (induct \\<pi> arbitrary: \\<Pi>)\n  case Nil\n  show ?case by (unfold mk_ps_chain_def, auto)\nnext\n  case (Cons x \\<pi>)\n  show ?case\n  apply (unfold mk_ps_chain_def list.size foldl.simps)\n  apply (fold mk_ps_chain_def)\n  apply (auto simp add: Cons len_snoc)\n  done\nqed\n\ntext {* Distributing @{term mk_ps_chain} over @{term Cons}. *}\nlemma mk_ps_chain_cons:\n  \"mk_ps_chain \\<Pi> (x # \\<pi>) = mk_ps_chain (cSnoc \\<Pi> x (next_ps (post \\<Pi>) x)) \\<pi>\" \nby (auto simp add: mk_ps_chain_def)\n\ntext {* Distributing @{term mk_ps_chain} over @{term snoc}. *}\nlemma mk_ps_chain_snoc:\n  \"mk_ps_chain \\<Pi> (\\<pi> @ [x]) \n    = cSnoc (mk_ps_chain \\<Pi> \\<pi>) x (next_ps (post (mk_ps_chain \\<Pi> \\<pi>)) x)\"\nby (unfold mk_ps_chain_def, auto)\n \ntext {* Distributing @{term mk_ps_chain} over @{term cCons}. *}\nlemma mk_ps_chain_ccons:\n  fixes \\<pi> \\<Pi>\n  shows \"mk_ps_chain (\\<lbrace> \\<sigma> \\<rbrace> \\<cdot> x \\<cdot> \\<Pi>) \\<pi> = \\<lbrace> \\<sigma> \\<rbrace> \\<cdot> x \\<cdot> mk_ps_chain \\<Pi> \\<pi> \"\nby (induct \\<pi> arbitrary: \\<Pi>, auto simp add: mk_ps_chain_cons mk_ps_chain_def)\n\nlemma pre_mk_ps_chain:\n  fixes \\<Pi> \\<pi>\n  shows \"pre (mk_ps_chain \\<Pi> \\<pi>) = pre \\<Pi>\"\napply (induct \\<pi> arbitrary: \\<Pi>)\napply (auto simp add: mk_ps_chain_def mk_ps_chain_cons pre_snoc)\ndone \n\ntext {* A chain which is obtained from the list @{term \\<pi>}, has @{term \\<pi>}\n  as its list of commands. The following lemma states this in a slightly\n  more general form, that allows for part of the chain to have already\n  been processed. *}\n \nlemma comlist_mk_ps_chain:\n  \"comlist (mk_ps_chain \\<Pi> \\<pi>) = comlist \\<Pi> @ \\<pi>\"\nproof (induct \\<pi> arbitrary: \\<Pi>)\n  case Nil\n  thus ?case by (auto simp add: mk_ps_chain_def)\nnext\n  case (Cons x \\<pi>')\n  show ?case \n  apply (unfold mk_ps_chain_def foldl.simps, fold mk_ps_chain_def)\n  apply (auto simp add: Cons comlist_snoc)\n  done\nqed\n\ntext {* In order to perform induction over our diagrams, we shall wish\n  to obtain ``smaller'' diagrams, by removing nodes or edges. However, the\n  syntax and well-formedness constraints for diagrams are such that although\n  we can always remove an edge from a diagram, we cannot (in general) remove\n  a node -- the resultant diagram would not be a well-formed if an edge\n  connected to that node.\n\n  Hence, we consider ``partially-processed diagrams'' @{term \"(G,S)\"}, which\n  comprise a diagram @{term G} and a set @{term S} of nodes. @{term S} denotes \n  the subset of @{term G}'s initial nodes that have already been processed, \n  and can be thought of as having been removed from @{term G}.\n\n  We now give an updated version of the @{term \"lins G\"} function. This was\n  originally defined in @{theory Ribbons_Graphical}. We provide an extra\n  parameter, @{term S}, which denotes the subset of @{term G}'s initial nodes \n  that shouldn't be included in the linear extensions. *}\n\ndefinition lins2 :: \"[node fset, diagram] \\<Rightarrow> lin set\"\nwhere\n  \"lins2 S G \\<equiv> {\\<pi> :: lin .\n    (distinct \\<pi>) \n  \\<and> (set \\<pi> = (fset G^V - fset S) <+> set G^E) \n  \\<and> (\\<forall>i j v e. i < length \\<pi> \\<and> j < length \\<pi> \n    \\<and> \\<pi>!i = Inl v \\<and> \\<pi>!j = Inr e \\<and> v |\\<in>| fst3 e \\<longrightarrow> i<j) \n  \\<and> (\\<forall>j k w e. j < length \\<pi> \\<and> k < length \\<pi> \n    \\<and> \\<pi>!j = Inr e \\<and> \\<pi>!k = Inl w \\<and> w |\\<in>| thd3 e \\<longrightarrow> j<k) }\"\n\nlemma lins2D:\n  assumes \"\\<pi> \\<in> lins2 S G\"\n  shows \"distinct \\<pi>\"\n    and \"set \\<pi> = (fset G^V - fset S) <+> set G^E\"\n    and \"\\<And>i j v e. \\<lbrakk> i < length \\<pi> ; j < length \\<pi> ; \n      \\<pi>!i = Inl v ; \\<pi>!j = Inr e ; v |\\<in>| fst3 e \\<rbrakk> \\<Longrightarrow> i<j\"\n    and \"\\<And>i k w e. \\<lbrakk> j < length \\<pi> ; k < length \\<pi> ;\n      \\<pi>!j = Inr e ; \\<pi>!k = Inl w ; w |\\<in>| thd3 e \\<rbrakk> \\<Longrightarrow> j<k\"\nusing assms \napply (unfold lins2_def Collect_iff) \napply (elim conjE, assumption)+\napply blast+\ndone\n\nlemma lins2I:\n  assumes \"distinct \\<pi>\"\n    and \"set \\<pi> = (fset G^V - fset S) <+> set G^E\"\n    and \"\\<And>i j v e. \\<lbrakk> i < length \\<pi> ; j < length \\<pi> ; \n      \\<pi>!i = Inl v ; \\<pi>!j = Inr e ; v |\\<in>| fst3 e \\<rbrakk> \\<Longrightarrow> i<j\"\n    and \"\\<And>j k w e. \\<lbrakk> j < length \\<pi> ; k < length \\<pi> ;\n      \\<pi>!j = Inr e ; \\<pi>!k = Inl w ; w |\\<in>| thd3 e \\<rbrakk> \\<Longrightarrow> j<k\"\n  shows \"\\<pi> \\<in> lins2 S G\"\nusing assms \napply (unfold lins2_def Collect_iff, intro conjI)\napply assumption+\napply blast+\ndone\n\ntext {* When @{term S} is empty, the two definitions coincide. *}\nlemma lins_is_lins2_with_empty_S:\n  \"lins G = lins2 {||} G\"\nby (unfold lins_def lins2_def, auto)\n\ntext {* The first proofstate for a diagram @{term G} is obtained by\n  mapping each of its initial nodes to @{term Top}. *}\ndefinition \n  initial_ps :: \"diagram \\<Rightarrow> proofstate\"\nwhere\n  \"initial_ps G \\<equiv> [ initials G |=> Top ]\"\n\ntext {* The first proofstate for the partially-processed diagram @{term G} is \n  obtained by mapping each of its initial nodes to @{term Top}, except those\n  in @{term S}, which are mapped to @{term Bot}. *}\ndefinition \n  initial_ps2 :: \"[node fset, diagram] \\<Rightarrow> proofstate\"\nwhere\n  \"initial_ps2 S G \\<equiv> [ initials G - S |=> Top ] \\<oplus> [ S |=> Bot ]\"\n\ntext {* When @{term S} is empty, the above two definitions coincide. *}\nlemma initial_ps_is_initial_ps2_with_empty_S:\n  \"initial_ps = initial_ps2 {||}\"\napply (unfold fun_eq_iff, intro allI)\napply (unfold initial_ps_def initial_ps2_def)\napply (transfer, simp add: make_map_def)\ndone\n\ntext {* The following function extracts the set of proofstate chains from\n   a diagram. *}\ndefinition \n  ps_chains :: \"diagram \\<Rightarrow> ps_chain set\"\nwhere \n  \"ps_chains G \\<equiv> mk_ps_chain (cNil (initial_ps G)) ` lins G\"\n\ntext {* The following function extracts the set of proofstate chains from\n   a partially-processed diagram. Nodes in @{term S} are excluded from\n   the resulting chains. *}\ndefinition \n  ps_chains2 :: \"[node fset, diagram] \\<Rightarrow> ps_chain set\"\nwhere \n  \"ps_chains2 S G \\<equiv> mk_ps_chain (cNil (initial_ps2 S G)) ` lins2 S G\"\n\ntext {* When @{term S} is empty, the above two definitions coincide. *}\nlemma ps_chains_is_ps_chains2_with_empty_S:\n  \"ps_chains = ps_chains2 {||}\"\napply (unfold fun_eq_iff, intro allI)\napply (unfold ps_chains_def ps_chains2_def)\napply (fold initial_ps_is_initial_ps2_with_empty_S)\napply (fold lins_is_lins2_with_empty_S)\napply auto\ndone\n\ntext {* We now wish to describe proofstates chain that are well-formed. First,\n  let us say that @{term \"f \\<oplus>disjoint g\"} is defined, when @{term f} and\n  @{term g} have disjoint domains, as @{term \"f \\<oplus> g\"}. Then, a well-formed \n  proofstate chain consists of triples of the form @{term \"(\\<sigma> \\<oplus>disjoint \n  [{| v |} |=> Top], Inl v, \\<sigma> \\<oplus>disjoint [{| v |} |=> Bot])\"}, where @{term v} \n  is a node, or of the form @{term \"(\\<sigma> \\<oplus>disjoint [{| vs |} |=> Bot], Inr e, \n  \\<sigma> \\<oplus>disjoint [{| ws |} |=> Top])\"}, where @{term e} is an edge with source\n  and target nodes @{term vs} and @{term ws} respectively. \n\n  The definition below describes a well-formed triple; we then lift this\n  to complete chains shortly. *}\n\ndefinition\n  wf_ps_triple :: \"proofstate \\<times> (node + edge) \\<times> proofstate \\<Rightarrow> bool\"\nwhere\n  \"wf_ps_triple T = (case snd3 T of\n    Inl v \\<Rightarrow> (\\<exists>\\<sigma>. v |\\<notin>| fdom \\<sigma> \n      \\<and> fst3 T = [ {|v|} |=> Top ] \\<oplus> \\<sigma> \n      \\<and> thd3 T = [ {|v|} |=> Bot ] \\<oplus> \\<sigma>)\n  | Inr e \\<Rightarrow> (\\<exists>\\<sigma>. (fst3 e |\\<union>| thd3 e) |\\<inter>| fdom \\<sigma> = {||} \n      \\<and> fst3 T = [ fst3 e |=> Bot ] \\<oplus> \\<sigma> \n      \\<and> thd3 T = [ thd3 e |=> Top ] \\<oplus> \\<sigma>))\"\n\nlemma wf_ps_triple_nodeI:\n  assumes \"\\<exists>\\<sigma>. v |\\<notin>| fdom \\<sigma>  \\<and> \n    \\<sigma>1 = [ {|v|} |=> Top ] \\<oplus> \\<sigma> \\<and> \n    \\<sigma>2 = [ {|v|} |=> Bot ] \\<oplus> \\<sigma>\"\n  shows \"wf_ps_triple (\\<sigma>1, Inl v, \\<sigma>2)\"\nusing assms unfolding wf_ps_triple_def\nby (auto simp add: fst3_simp snd3_simp thd3_simp)\n\nlemma wf_ps_triple_edgeI:\n  assumes \"\\<exists>\\<sigma>. (fst3 e |\\<union>| thd3 e) |\\<inter>| fdom \\<sigma> = {||} \n      \\<and> \\<sigma>1 = [ fst3 e |=> Bot ] \\<oplus> \\<sigma> \n      \\<and> \\<sigma>2 = [ thd3 e |=> Top ] \\<oplus> \\<sigma>\"\n  shows \"wf_ps_triple (\\<sigma>1, Inr e, \\<sigma>2)\"\nusing assms unfolding wf_ps_triple_def\nby (auto simp add: fst3_simp snd3_simp thd3_simp)\n\ndefinition\n  wf_ps_chain :: \"ps_chain \\<Rightarrow> bool\"\nwhere\n  \"wf_ps_chain \\<equiv> chain_all wf_ps_triple\"\n\nlemma next_initial_ps2_vertex:\n  \"initial_ps2 ({|v|} |\\<union>| S) G \n  = initial_ps2 S G \\<ominus> {|v|} \\<oplus> [ {|v|} |=> Bot ]\"\napply (unfold initial_ps2_def)\napply transfer\napply (auto simp add: make_map_def map_diff_def map_add_def restrict_map_def)\ndone\n\nlemma next_initial_ps2_edge:\n  assumes \"G = Graph V \\<Lambda> E\" and \"G' = Graph V' \\<Lambda> E'\" and \n    \"V' = V - fst3 e\" and \"E' = removeAll e E\" and \"e \\<in> set E\" and \n    \"fst3 e |\\<subseteq>| S\" and \"S |\\<subseteq>| initials G\" and \"wf_dia G\"\n  shows \"initial_ps2 (S - fst3 e) G' = \n  initial_ps2 S G \\<ominus> fst3 e \\<oplus> [ thd3 e |=> Top ]\"\nproof (insert assms, unfold initial_ps2_def, transfer)\n  fix G V \\<Lambda> E G' V' E' e S\n  assume G_def: \"G = Graph V \\<Lambda> E\" and G'_def: \"G' = Graph V' \\<Lambda> E'\" and \n    V'_def: \"V' = V - fst3 e\" and E'_def: \"E' = removeAll e E\" and \n    e_in_E: \"e \\<in> set E\" and fst_e_in_S: \"fst3 e |\\<subseteq>| S\" and \n    S_initials: \"S |\\<subseteq>| initials G\" and wf_G: \"wf_dia G\"\n  show \"make_map (initials G' - (S - fst3 e)) Top ++ make_map (S - fst3 e) Bot \n    = map_diff (make_map (initials G - S) Top ++ make_map S Bot) (fst3 e) \n        ++ make_map (thd3 e) Top\" \n  apply (unfold make_map_def map_diff_def)\n  apply (unfold map_add_def restrict_map_def)\n  apply (unfold minus_fset)\n  apply (unfold fun_eq_iff initials_def, intro allI)\n  apply (unfold G_def G'_def V'_def E'_def)\n  apply (unfold edges.simps vertices.simps)\n  apply (simp add: less_eq_fset.rep_eq fmember.rep_eq e_in_E)\n  apply (intro conjI impI)\n  apply (elim bexE conjE)\n  apply (rename_tac \"f\")\n  apply (subgoal_tac \"thd3 e |\\<inter>| initials G = {||}\")\n  apply (insert S_initials, fold fset_cong)\n  apply (unfold less_eq_fset.rep_eq initials_def filter_fset)\n  apply (auto simp add: fmember.rep_eq G_def e_in_E)[1]\n  apply (auto simp add: fmember.rep_eq G_def e_in_E)[1]\n  apply (auto simp add: fmember.rep_eq G_def e_in_E)[1]\n  apply (auto simp add: fmember.rep_eq G_def e_in_E)[1]\n  apply (elim conjE bexE)\n  apply (insert wf_G)[1] \n  apply (unfold G_def vertices.simps edges.simps)\n  apply (drule wf_dia_inv) back back \n  apply (unfold acyclicity_def)\n  apply (metis fst_e_in_S inter_fset le_iff_inf set_mp)\n  apply (elim bexE DiffE)\n  apply (unfold singleton_iff)\n  apply (insert wf_G)[1] \n  apply (unfold G_def vertices.simps edges.simps)\n  apply (drule wf_dia_inv) back back back\n  apply (drule linearityD2)\n  apply (fold fset_cong, unfold inter_fset fset_simps)\n  apply (insert e_in_E, blast)\n  apply (insert wf_G)[1] \n  apply (unfold G_def vertices.simps edges.simps)\n  apply (drule wf_dia_inv) back back \n  apply (metis (lifting) e_in_E Diff_iff G_def empty_iff fset_simps(1) \n    finter_iff insertCI linearityD(2) notin_fset wf_G wf_dia_inv(4))\n  apply (elim bexE DiffE)\n  apply (unfold singleton_iff)\n  apply (insert wf_G)[1] \n  apply (unfold G_def vertices.simps edges.simps)\n  apply (drule wf_dia_inv) back back back\n  apply (drule linearityD2)\n  apply (fold fset_cong, unfold inter_fset fset_simps)\n  apply blast\n  apply (insert wf_G)[1] \n  apply (unfold G_def vertices.simps edges.simps)\n  apply (drule wf_dia_inv) back back \n  apply (metis (lifting) e_in_E Diff_iff G_def empty_iff fset_simps(1) \n    finter_iff insertCI linearityD(2) notin_fset wf_G wf_dia_inv(4))\n  apply (elim bexE)\n  apply (insert wf_G) \n  apply (unfold G_def vertices.simps edges.simps)\n  apply (drule wf_dia_inv) back back back back\n  apply (unfold less_eq_fset.rep_eq union_fset)\n  apply auto[1]\n  apply (drule wf_dia_inv) back back back back\n  apply (unfold less_eq_fset.rep_eq union_fset)\n  apply auto[1]\n  apply (drule wf_dia_inv) back back back back\n  apply (unfold less_eq_fset.rep_eq union_fset)\n  apply (auto simp add: e_in_E)[1]\n  apply (drule wf_dia_inv) back back back back\n  apply (unfold less_eq_fset.rep_eq union_fset)\n  apply (auto simp add: e_in_E)[1]\n  done\nqed\n\nlemma next_lins2_vertex:\n  assumes \"Inl v # \\<pi> \\<in> lins2 S G\"\n  assumes \"v |\\<notin>| S\"\n  shows \"\\<pi> \\<in> lins2 ({|v|} |\\<union>| S) G\"\nproof -\n  note lins2D = lins2D[OF assms(1)]\n  show ?thesis\n  proof (intro lins2I)\n    show \"distinct \\<pi>\" using lins2D(1) by auto\n  next  \n    have \"set \\<pi> = set (Inl v # \\<pi>) - {Inl v}\" using lins2D(1) by auto \n    also have \"... = (fset G^V - fset ({|v|} |\\<union>| S)) <+> set G^E\"\n      using lins2D(2) by auto\n    finally show \"set \\<pi> = (fset G^V - fset ({|v|} |\\<union>| S)) <+> set G^E\"\n      by auto\n  next\n    fix i j v e\n    assume \"i < length \\<pi>\" \"j < length \\<pi>\" \"\\<pi> ! i = Inl v\" \n      \"\\<pi> ! j = Inr e\" \"v |\\<in>| fst3 e\"\n    thus \"i < j\" using lins2D(3)[of \"i+1\" \"j+1\"] by auto\n  next\n    fix j k w e\n    assume \"j < length \\<pi>\" \"k < length \\<pi>\" \"\\<pi> ! j = Inr e\"\n      \"\\<pi> ! k = Inl w\" \"w |\\<in>| thd3 e\"\n    thus \"j < k\" using lins2D(4)[of \"j+1\" \"k+1\"] by auto\n  qed\nqed\n\nlemma next_lins2_edge:\n  assumes \"Inr e # \\<pi> \\<in> lins2 S (Graph V \\<Lambda> E)\"\n      and \"vs |\\<subseteq>| S\"\n      and \"e = (vs,c,ws)\"\n  shows \"\\<pi> \\<in> lins2 (S - vs) (Graph (V - vs) \\<Lambda> (removeAll e E))\"\nproof - \n  note lins2D = lins2D[OF assms(1)]\n  show ?thesis\n  proof (intro lins2I, unfold vertices.simps edges.simps)\n    show \"distinct \\<pi>\"\n    using lins2D(1) by auto\n  next\n    show \"set \\<pi> = (fset (V - vs) - fset (S - vs)) \n      <+> set (removeAll e E)\"\n    apply (insert lins2D(1) lins2D(2) assms(2))\n    apply (unfold assms(3) vertices.simps edges.simps less_eq_fset.rep_eq, simp)\n    apply (unfold diff_diff_eq)\n    proof -\n      have \"\\<forall>a aa b.\n       insert (Inr (vs, c, ws)) (set \\<pi>) = (fset V - fset S) <+> set E \\<longrightarrow>\n       fset vs \\<subseteq> fset S \\<longrightarrow>\n       Inr (vs, c, ws) \\<notin> set \\<pi> \\<longrightarrow>\n       distinct \\<pi> \\<longrightarrow> (a, aa, b) \\<in> set E \\<longrightarrow> Inr (a, aa, b) \\<notin> set \\<pi> \\<longrightarrow> b = ws\"\n     by (metis (lifting) InrI List.set_simps(2) \n      Pair_eq set_ConsD sum.simps(2))\n     \n     moreover have \"\\<forall>a aa b.\n       insert (Inr (vs, c, ws)) (set \\<pi>) = (fset V - fset S) <+> set E \\<longrightarrow>\n       fset vs \\<subseteq> fset S \\<longrightarrow>\n       Inr (vs, c, ws) \\<notin> set \\<pi> \\<longrightarrow>\n       distinct \\<pi> \\<longrightarrow> (a, aa, b) \\<in> set E \\<longrightarrow> Inr (a, aa, b) \\<notin> set \\<pi> \\<longrightarrow> aa = c\"\n     by (metis (lifting) InrI List.set_simps(2) \n      Pair_eq set_ConsD sum.simps(2))\n\n     moreover have \"\\<forall>x. insert (Inr (vs, c, ws)) (set \\<pi>) = (fset V - fset S) <+> set E \\<longrightarrow>\n         fset vs \\<subseteq> fset S \\<longrightarrow>\n         Inr (vs, c, ws) \\<notin> set \\<pi> \\<longrightarrow>\n         distinct \\<pi> \\<longrightarrow> x \\<in> set \\<pi> \\<longrightarrow> x \\<in> (fset V - fset S) <+> set E - {(vs, c, ws)}\"\n      apply (unfold insert_is_Un[of _ \"set \\<pi>\"])\n      apply (fold assms(3))\n      apply clarify\n      apply (subgoal_tac \"set \\<pi> = ((fset V - fset S) <+> set E) - {Inr e}\")\n      by auto\n    ultimately show \"Inr (vs, c, ws) \\<notin> set \\<pi> \\<and> distinct \\<pi> \\<Longrightarrow>\n      insert (Inr (vs, c, ws)) (set \\<pi>) = (fset V - fset S) <+> set E \\<Longrightarrow>\n      fset vs \\<subseteq> fset S \\<Longrightarrow> set \\<pi> = (fset V - fset S) <+> set E - {(vs, c, ws)}\"\n    by blast\n    qed\n  next\n    fix i j v e\n    assume \"i < length \\<pi>\" \"j < length \\<pi>\" \"\\<pi> ! i = Inl v\" \n      \"\\<pi> ! j = Inr e\" \"v |\\<in>| fst3 e\"\n    thus \"i < j\" using lins2D(3)[of \"i+1\" \"j+1\"] by auto\n  next\n    fix j k w e\n    assume \"j < length \\<pi>\" \"k < length \\<pi>\" \"\\<pi> ! j = Inr e\"\n      \"\\<pi> ! k = Inl w\" \"w |\\<in>| thd3 e\"\n    thus \"j < k\" using lins2D(4)[of \"j+1\" \"k+1\"] by auto\n  qed\nqed\n\n\ntext {* We wish to prove that every proofstate chain that can be obtained from\n  a linear extension of @{term G} is well-formed and has as its final \n  proofstate that state in which every terminal node in @{term G} is mapped\n  to @{term Bot}. \n  \n  We first prove this for partially-processed diagrams, for\n  then the result for ordinary diagrams follows as an easy corollary. \n\n  We use induction on the size of the partially-processed diagram. The size of \n  a partially-processed diagram @{term \"(G,S)\"} is defined as the number of\n  nodes in @{term G}, plus the number of edges, minus the number of nodes in\n  @{term S}. *}\n\nlemmas [simp] = fmember.rep_eq\n\nlemma wf_chains2:\n  fixes k \n  assumes \"S |\\<subseteq>| initials G\"\n      and \"wf_dia G\"\n      and \"\\<Pi> \\<in> ps_chains2 S G\"\n      and \"fcard G^V + length G^E = k + fcard S\"\n  shows \"wf_ps_chain \\<Pi> \\<and> (post \\<Pi> = [ terminals G |=> Bot ])\"\nusing assms \nproof (induct k arbitrary: S G \\<Pi>)\n  case 0\n  obtain V \\<Lambda> E where G_def: \"G = Graph V \\<Lambda> E\" by (metis diagram.exhaust)\n  have \"S |\\<subseteq>| V\" \n    using \"0.prems\"(1) initials_in_vertices[of \"G\"] \n    by (auto simp add: G_def)\n  have \"fcard V \\<le> fcard S\"\n    using \"0.prems\"(4) \n    by (unfold G_def, auto)\n  from fcard_seteq[OF `S |\\<subseteq>| V` this] have \"S = V\" by auto\n  hence \"E = []\" using \"0.prems\"(4) by (unfold G_def, auto)\n  have \"initials G = V\"\n    by (unfold G_def `E=[]`, rule no_edges_imp_all_nodes_initial)\n  have \"terminals G = V\"\n    by (unfold G_def `E=[]`, rule no_edges_imp_all_nodes_terminal)  \n  have \"{} <+> {} = {}\" by auto\n  have \"lins2 S G = { [] }\" \n  apply (unfold G_def `S=V` `E=[]`)\n  apply (unfold lins2_def, auto simp add: `{} <+> {} = {}`)\n  done\n  hence \\<Pi>_def: \"\\<Pi> = \\<lbrace> initial_ps2 S G \\<rbrace>\" \n    using \"0.prems\"(3) \n    by (auto simp add: ps_chains2_def mk_ps_chain_def)\n  show ?case\n  apply (intro conjI)\n  apply (unfold \\<Pi>_def wf_ps_chain_def, auto)\n  apply (unfold post.simps initial_ps2_def `initials G = V` `terminals G = V`)\n  apply (unfold `S=V`)\n  apply (subgoal_tac \"V - V = {||}\", simp)\n  apply (transfer, simp add: make_map_def)\n  by auto\nnext\n  case (Suc k)\n  obtain V \\<Lambda> E where G_def: \"G = Graph V \\<Lambda> E\" by (metis diagram.exhaust)\n  from Suc.prems(3) obtain \\<pi> where\n    \\<Pi>_def: \"\\<Pi> = mk_ps_chain \\<lbrace> initial_ps2 S G \\<rbrace> \\<pi>\" and \n    \\<pi>_in: \"\\<pi> \\<in> lins2 S G\" \n    by (auto simp add: ps_chains2_def)\n  note lins2 = lins2D[OF \\<pi>_in]\n  have \"S |\\<subseteq>| V\" \n    using Suc.prems(1) initials_in_vertices[of \"G\"] \n    by (auto simp add: G_def)\n  show ?case\n  proof (cases \\<pi>)\n    case Nil\n    from \\<pi>_in have \"V = S\" \"E = []\"\n    apply (-, unfold `\\<pi> = []` lins2_def, simp_all)\n    apply (unfold empty_eq_Plus_conv)\n    apply (unfold G_def vertices.simps edges.simps, auto)\n    by (metis `S |\\<subseteq>| V` less_eq_fset.rep_eq subset_antisym)\n    \n    with Suc.prems(4) have False by (simp add: G_def)\n    thus ?thesis by auto\n  next\n    case (Cons x \\<pi>')\n    note \\<pi>_def = this\n    show ?thesis\n    proof (cases x)\n      case (Inl v)\n      note x_def = this\n\n      have \"v |\\<notin>| S \\<and> v |\\<in>| V\"\n      apply (subgoal_tac \"v \\<in> fset V - fset S\")\n      apply (simp)\n      apply (subgoal_tac \"Inl v \\<in> (fset V - fset S) <+> set E\")\n      apply (metis Inl_inject Inr_not_Inl PlusE)\n      apply (metis lins2(1) lins2(2) Cons G_def Inl distinct.simps(2) \n        distinct_length_2_or_more edges.simps vertices.simps)\n      done  \n      hence v_notin_S: \"v |\\<notin>| S\" and v_in_V: \"v |\\<in>| V\" by auto\n      \n      have v_initial_not_S: \"v |\\<in>| initials G - S\"\n      apply (unfold G_def initials_def vertices.simps edges.simps)\n      apply (unfold fminus_iff)\n      apply (unfold conj_commute, intro conjI, rule v_notin_S)\n      apply (subgoal_tac \n        \"v \\<in> fset (ffilter (\\<lambda>v. \\<forall>e\\<in>set E. v |\\<notin>| thd3 e) V)\")\n      apply simp\n      apply (unfold filter_fset, simp, unfold conj_commute)\n      apply (intro conjI ballI notI)\n      apply (insert v_in_V, simp)\n      proof -\n        fix e :: edge\n        assume \"v \\<in> fset (thd3 e)\"\n        then have \"v |\\<in>| (thd3 e)\" by auto\n        assume \"e \\<in> set E\"\n        hence \"Inr e \\<in> set \\<pi>\" using lins2(2) by (auto simp add: G_def)\n        then obtain j where \n          \"j < length \\<pi>\" \"0 < length \\<pi>\" \"\\<pi>!j = Inr e\" \"\\<pi>!0 = Inl v\"\n        by (metis \\<pi>_def x_def in_set_conv_nth length_pos_if_in_set nth_Cons_0)\n        with lins2(4)[OF this `v |\\<in>| (thd3 e)`] show False by auto\n      qed\n      \n      def S' \\<equiv> \"{|v|} |\\<union>| S\"\n\n      def \\<Pi>' \\<equiv> \"mk_ps_chain \\<lbrace> initial_ps2 S' G \\<rbrace> \\<pi>'\"\n      hence pre_\\<Pi>': \"pre \\<Pi>' = initial_ps2 S' G\" \n      by (metis pre.simps(1) pre_mk_ps_chain)\n\n      def \\<sigma> \\<equiv> \"[ initials G - ({|v|} |\\<union>| S) |=> Top ] \\<oplus> [ S |=> Bot ]\" \n\n      have \"wf_ps_chain \\<Pi>' \\<and> (post \\<Pi>' = [terminals G |=> Bot])\" \n      proof (intro Suc.hyps[of \"S'\"])\n        show \"S' |\\<subseteq>| initials G\" \n        apply (unfold S'_def, auto)\n        apply (metis fmember.rep_eq fminus_iff v_initial_not_S)\n        by (metis Suc.prems(1) fmember.rep_eq fset_rev_mp)\n     next\n        show \"wf_dia G\" by (rule Suc.prems(2))\n      next\n        show \"\\<Pi>' \\<in> ps_chains2 S' G\"\n        apply (unfold ps_chains2_def \\<Pi>'_def)\n        apply (intro imageI)\n        apply (unfold S'_def)\n        apply (intro next_lins2_vertex)\n        apply (fold x_def, fold \\<pi>_def)\n        apply (rule \\<pi>_in)\n        by (metis v_notin_S)\n      next\n        show \"fcard G^V + length G^E = k + fcard S'\"\n         apply (unfold S'_def) \n         by (auto simp add: Suc.prems(4) fcard_finsert_disjoint[OF v_notin_S])\n      qed      \n      hence\n        wf_\\<Pi>': \"wf_ps_chain \\<Pi>'\" and\n        post_\\<Pi>': \"post \\<Pi>' = [terminals G |=> Bot]\"\n      by auto\n\n      show ?thesis\n      proof (intro conjI)\n        have 1: \"fdom [ {|v|} |=> Bot ] \n        |\\<inter>| fdom ([ initials G - ({|v|} |\\<union>| S) |=> Top ] \\<oplus>\n     [ S |=> Bot ]) = {||}\" \n        by (metis (no_types) fdom_make_fmap fdom_union \n          bot_least funion_iff finter_finsert_left le_iff_inf \n          fminus_iff finsert_fsubset sup_ge1 v_initial_not_S)\n        show \"wf_ps_chain \\<Pi>\"\n        apply (unfold \\<Pi>_def \\<pi>_def x_def mk_ps_chain_cons)\n        apply simp\n        apply (unfold mk_ps_chain_ccons)\n        apply (fold next_initial_ps2_vertex S'_def)\n        apply (fold \\<Pi>'_def)\n        apply (unfold wf_ps_chain_def chain_all.simps conj_commute)\n        apply (intro conjI)\n        apply (fold wf_ps_chain_def, rule wf_\\<Pi>')\n        apply (intro wf_ps_triple_nodeI exI[of _ \"\\<sigma>\"] conjI)\n        apply (unfold \\<sigma>_def fdom_union fdom_make_fmap)\n        apply (metis finsertI1 fminus_iff funion_iff v_notin_S)\n        apply (unfold pre_\\<Pi>' initial_ps2_def S'_def)\n        apply (unfold fmap_add_commute[OF 1])\n        apply (unfold fmap_add_assoc)\n        apply (fold fmap_add_assoc[of _ \"[ S |=> Bot ]\"])\n        apply (unfold make_fmap_union sup.commute[of \"{|v|}\"])\n        apply (unfold fminus_funion)\n        using v_initial_not_S apply auto\n        by (metis (hide_lams, no_types) finsert_absorb finsert_fminus_single finter_fminus \n            inf_commute inf_idem v_initial_not_S)\n      next\n        show \"post \\<Pi> = [ terminals G |=> Bot ]\"  \n        apply (unfold \\<Pi>_def \\<pi>_def x_def mk_ps_chain_cons, simp)\n        apply (unfold mk_ps_chain_ccons post.simps)\n        apply (fold next_initial_ps2_vertex S'_def) \n        apply (fold \\<Pi>'_def, rule post_\\<Pi>')\n        done\n      qed\n    next\n      case (Inr e)\n      note x_def = this\n      def vs \\<equiv> \"fst3 e\"\n      def ws \\<equiv> \"thd3 e\"\n\n      obtain c where e_def: \"e = (vs, c, ws)\"\n      by (metis vs_def ws_def fst3_simp thd3_simp prod_cases3)\n\n      have \"linearity E\" and \"acyclicity E\" and\n        e_in_V: \"\\<And>e. e \\<in> set E \\<Longrightarrow> fst3 e |\\<union>| thd3 e |\\<subseteq>| V\" \n      by (insert Suc.prems(2) wf_dia_inv, unfold G_def, blast)+\n      note lin = linearityD[OF this(1)]\n      \n      have acy: \"\\<And>e. e \\<in> set E \\<Longrightarrow> fst3 e |\\<inter>| thd3 e = {||}\"\n      apply (fold fset_cong, insert `acyclicity E`)\n      apply (unfold acyclicity_def acyclic_def, auto)\n      done\n      \n      note lins = lins2D[OF \\<pi>_in]\n\n      have e_in_E: \"e \\<in> set E\"\n      apply (subgoal_tac \"set \\<pi> = (fset G^V - fset S) <+> set G^E\")\n      apply (unfold \\<pi>_def x_def G_def edges.simps, auto)[1]\n      apply (simp add: lins(2))\n      done\n      \n      have vs_in_S: \"vs |\\<subseteq>| S\"\n      apply (insert e_in_V[OF e_in_E])\n      apply (unfold less_eq_fset.rep_eq) \n      apply (intro subsetI)\n      apply (unfold vs_def)\n      apply (rule ccontr)\n      apply (subgoal_tac \"x \\<in> fset V\")\n      prefer 2\n      apply (auto)\n      proof -\n        fix v\n        assume a: \"v \\<in> fset (fst3 e)\"\n        assume \"v \\<notin> fset S\" and \"v \\<in> fset V\"\n        hence \"Inl v \\<in> set \\<pi>\"\n        by (metis (lifting) DiffI G_def InlI lins(2) vertices.simps)\n        then obtain i where \n          \"i < length \\<pi>\" \"0 < length \\<pi>\" \"\\<pi>!i = Inl v\"  \"\\<pi>!0 = Inr e\"\n        by (metis Cons Inr in_set_conv_nth length_pos_if_in_set nth_Cons_0)\n        from lins(3)[OF this] show \"False\" by (auto simp add: a)\n      qed\n\n      have \"ws |\\<inter>| (initials G) = {||}\"\n      apply (insert e_in_V[OF e_in_E])\n      apply (unfold initials_def less_eq_fset.rep_eq fmember.rep_eq, fold fset_cong) \n      apply (unfold ws_def G_def, auto simp add: e_in_E)\n      done\n      \n      def S' \\<equiv> \"S - vs\"\n      def V' \\<equiv> \"V - vs\"\n      def E' \\<equiv> \"removeAll e E\"\n      def G' \\<equiv> \"Graph V' \\<Lambda> E'\"\n\n      def \\<Pi>' \\<equiv> \"mk_ps_chain \\<lbrace> initial_ps2 S' G' \\<rbrace> \\<pi>'\"\n      hence pre_\\<Pi>': \"pre \\<Pi>' = initial_ps2 S' G'\" \n      by (metis pre.simps(1) pre_mk_ps_chain)\n      \n      def \\<sigma> \\<equiv> \"[ initials G - S |=> Top ] \\<oplus> [ S - vs |=> Bot ]\" \n\n      have next_initial_ps2: \"initial_ps2 S' G' \n        = initial_ps2 S G \\<ominus> vs \\<oplus> [ws |=> Top]\"\n      using next_initial_ps2_edge[OF G_def _ _ _ e_in_E _ Suc.prems(1) \n        Suc.prems(2)] G'_def E'_def vs_def ws_def V'_def vs_in_S S'_def\n      by auto\n\n      have \"wf_ps_chain \\<Pi>' \\<and> post \\<Pi>' = [ terminals G' |=> Bot ]\" \n      proof (intro Suc.hyps[of \"S'\"])\n        show \"S' |\\<subseteq>| initials G'\" \n        apply (insert Suc.prems(1))\n        apply (unfold G'_def G_def initials_def)\n        apply (unfold less_eq_fset.rep_eq S'_def E'_def V'_def)\n        apply auto\n        done\n      next\n        from Suc.prems(2) have \"wf_dia (Graph V \\<Lambda> E)\" \n          by (unfold G_def)\n        note wf_G = wf_dia_inv[OF this]\n        show \"wf_dia G'\"\n        apply (unfold G'_def V'_def E'_def)\n        apply (insert wf_G e_in_E vs_in_S Suc.prems(1))\n        apply (unfold vs_def)\n        apply (intro wf_dia)\n        apply (unfold linearity_def initials_def G_def)\n        apply (fold fset_cong, unfold less_eq_fset.rep_eq fmember.rep_eq)\n        apply (simp, simp)\n        apply (unfold acyclicity_def, rule acyclic_subset)\n        apply (auto simp add: distinct_removeAll)\n        apply (metis (lifting) IntI empty_iff)\n        done\n      next\n        show \"\\<Pi>' \\<in> ps_chains2 S' G'\"\n        apply (unfold \\<Pi>_def \\<Pi>'_def ps_chains2_def)\n        apply (intro imageI)\n        apply (unfold S'_def G'_def V'_def E'_def)\n        apply (intro next_lins2_edge)\n        apply (metis \\<pi>_def G_def x_def \\<pi>_in)\n        by (simp only: vs_in_S e_def)+\n      next\n        have \"vs |\\<subseteq>| V\" by (metis (lifting) `S |\\<subseteq>| V` order_trans vs_in_S)\n        have \"distinct E\" using `linearity E` linearity_def by auto\n        show \"fcard G'^V + length G'^E = k + fcard S'\"\n        apply (insert Suc.prems(4))\n        apply (unfold G_def G'_def vertices.simps edges.simps)\n        apply (unfold V'_def E'_def S'_def)\n        apply (unfold fcard_funion_fsubset[OF `vs |\\<subseteq>| V`])\n        apply (unfold fcard_funion_fsubset[OF `vs |\\<subseteq>| S`])\n        apply (fold distinct_remove1_removeAll[OF `distinct E`])  \n        apply (unfold length_remove1)\n        apply (simp add: e_in_E)\n        apply (drule arg_cong[of _ _ \"\\<lambda>x. x - fcard vs - 1\"])\n        apply (subst (asm) add_diff_assoc2[symmetric]) \n        apply (simp add: fcard_mono[OF `vs |\\<subseteq>| V`])\n        apply (subst add_diff_assoc, insert length_pos_if_in_set[OF e_in_E], arith, auto)\n        apply (subst add_diff_assoc, auto simp add: fcard_mono[OF `vs |\\<subseteq>| S`])\n        done\n      qed      \n      hence\n        wf_\\<Pi>': \"wf_ps_chain \\<Pi>'\" and\n        post_\\<Pi>': \"post \\<Pi>' = [ terminals G' |=> Bot ]\"\n      by auto\n\n      have terms_same: \"terminals G = terminals G'\"\n      apply (unfold G'_def G_def terminals_def edges.simps vertices.simps)\n      apply (unfold E'_def V'_def)\n      apply (fold fset_cong, auto simp add: e_in_E vs_def)\n      done\n\n      have 1: \"fdom [ fst3 e |=> Bot ] |\\<inter>| \n        fdom([ ffilter (\\<lambda>v. \\<forall>e\\<in>set E. v |\\<notin>| thd3 e) V - S |=> Top ] \n        \\<oplus> [ S - fst3 e |=> Bot ]) = {||}\"\n      apply (unfold fdom_union fdom_make_fmap)\n      apply (fold fset_cong)\n      apply auto\n      apply (metis in_mono less_eq_fset.rep_eq vs_def vs_in_S)\n      done\n\n      show ?thesis\n      proof (intro conjI)\n        show \"wf_ps_chain \\<Pi>\"\n        apply (unfold \\<Pi>_def \\<pi>_def x_def mk_ps_chain_cons)\n        apply simp\n        apply (unfold mk_ps_chain_ccons)\n        apply (fold vs_def ws_def)\n        apply (fold next_initial_ps2)\n        apply (fold \\<Pi>'_def)\n        apply (unfold wf_ps_chain_def chain_all.simps conj_commute)\n        apply (intro conjI)\n        apply (fold wf_ps_chain_def)\n        apply (rule wf_\\<Pi>')\n        apply (intro wf_ps_triple_edgeI exI[of _ \"\\<sigma>\"]) \n        apply (unfold e_def fst3_simp thd3_simp \\<sigma>_def, intro conjI)\n        apply (insert Suc.prems(1))\n        apply (unfold pre_\\<Pi>' initial_ps2_def initials_def)\n        apply (insert vs_in_S acy[OF e_in_E])\n        apply (fold fset_cong)\n        apply (unfold less_eq_fset.rep_eq)[1] \n        apply (unfold G_def G'_def vs_def ws_def V'_def E'_def S'_def)\n        apply (unfold vertices.simps edges.simps)\n        apply (unfold fmap_add_commute[OF 1])\n        apply (fold fmap_add_assoc)\n        apply (unfold make_fmap_union)\n        apply (auto simp add: fdom_union fdom_make_fmap e_in_E)[1]\n        apply simp\n        apply (unfold fmap_add_assoc)\n        apply (unfold make_fmap_union)  \n        apply (metis (lifting) funion_absorb2 vs_def vs_in_S)\n        apply (intro arg_cong2[of _ _ \"[ S - fst3 e |=> Bot ]\" \n            \"[ S - fst3 e |=> Bot ]\" \"op \\<oplus>\"])\n        apply (intro arg_cong2[of _ _ \"Top\" \"Top\" \"make_fmap\"])\n        defer 1\n        apply (simp, simp)       \n        apply (fold fset_cong)\n        apply (unfold less_eq_fset.rep_eq fmember.rep_eq, simp)\n        apply (elim conjE)\n        apply (intro set_eqI iffI, simp_all) \n        apply (elim conjE, intro disjI conjI ballI, simp)\n        apply (case_tac \"ea=e\", simp_all)\n        apply (elim disjE conjE, intro conjI ballI impI, simp_all)\n        apply (insert e_in_E lin(2))[1]\n        apply (subst (asm) (2) fset_cong[symmetric])\n        apply (elim conjE)\n        apply (subst (asm) inter_fset)\n        apply (subst (asm) fset_simps)\n        apply (insert disjoint_iff_not_equal)[1]\n        apply blast\n        apply (metis G_def Suc(3) e_in_E set_mp less_eq_fset.rep_eq wf_dia_inv')\n        prefer 2\n        apply (metis (lifting) IntI Suc(2) `ws |\\<inter>| initials G = {||}` \n            empty_iff fset_simps(1) in_mono inter_fset less_eq_fset.rep_eq ws_def)\n        apply auto\n        done\n      next\n        show \"post \\<Pi> = [terminals G |=> Bot]\"\n        apply (unfold \\<Pi>_def \\<pi>_def x_def mk_ps_chain_cons)\n        apply simp\n        apply (unfold mk_ps_chain_ccons post.simps)\n        apply (fold vs_def ws_def)\n        apply (fold next_initial_ps2)\n        apply (fold \\<Pi>'_def)\n        apply (unfold terms_same)\n        apply (rule post_\\<Pi>')\n        done\n      qed\n    qed\n  qed\nqed\n\ncorollary wf_chains:  \n  assumes \"wf_dia G\"\n  assumes \"\\<Pi> \\<in> ps_chains G\"\n  shows \"wf_ps_chain \\<Pi> \\<and> post \\<Pi> = [ terminals G |=> Bot ]\"\napply (intro wf_chains2[of \"{||}\"], insert assms(2)) \nby (auto simp add: assms(1) ps_chains_is_ps_chains2_with_empty_S fcard_fempty)\n\n\nsubsection {* Interface chains *}\n\ntype_synonym int_chain = \"(interface, assertion_gadget + command_gadget) chain\"\n\ntext {* An interface chain is similar to a proofstate chain. However, where a\n  proofstate chain talks about nodes and edges, an interface chain talks about\n  the assertion-gadgets and command-gadgets that label those nodes and edges\n  in a diagram. And where a proofstate chain talks about proofstates, an \n  interface chain talks about the interfaces obtained from those proofstates. \n\n  The following functions convert a proofstate chain into an \n  interface chain. *}\n\ndefinition\n  ps_to_int :: \"[diagram, proofstate] \\<Rightarrow> interface\"\nwhere\n  \"ps_to_int G \\<sigma> \\<equiv> \n    \\<Otimes>v |\\<in>| fdom \\<sigma>. case_topbot top_ass bot_ass (lookup \\<sigma> v) (G^\\<Lambda> v)\"\n\ndefinition\n  ps_chain_to_int_chain :: \"[diagram, ps_chain] \\<Rightarrow> int_chain\"\nwhere \n  \"ps_chain_to_int_chain G \\<Pi> \\<equiv>\n    chainmap (ps_to_int G) ((case_sum (Inl \\<circ> G^\\<Lambda>) (Inr \\<circ> snd3))) \\<Pi>\"\n\nlemma ps_chain_to_int_chain_simp:\n  \"ps_chain_to_int_chain (Graph V \\<Lambda> E) \\<Pi> =\n    chainmap (ps_to_int (Graph V \\<Lambda> E)) ((case_sum (Inl \\<circ> \\<Lambda>) (Inr \\<circ> snd3))) \\<Pi>\"\nby (simp add: ps_chain_to_int_chain_def)\n\nsubsection {* Soundness proof *}\n\ntext {*  We assume that @{term wr_com} always returns @{term \"{}\"}. This is \n  equivalent to changing our axiomatization of separation logic such that the \n  frame rule has no side-condition. One way to obtain a separation logic\n  lacking a side-condition on its frame rule is to use variables-as-\n  resource.\n\n  We proceed by induction on the proof rules for graphical diagrams. We\n  show that: (1) if a diagram @{term G} is provable w.r.t. interfaces \n  @{term P} and @{term Q}, then @{term P} and @{term Q} are the top and bottom \n  interfaces of @{term G}, and that the Hoare triple @{term \"(asn P,\n  c, asn Q)\"} is provable for each command @{term c} that can be extracted\n  from @{term G}; (2) if a command-gadget @{term C} is provable w.r.t. \n  interfaces @{term P} and @{term Q}, then the Hoare triple @{term \"(asn P,\n  c, asn Q)\"} is provable for each command @{term c} that can be extracted\n  from @{term C}; and (3) if an assertion-gadget @{term A} is provable, and if\n  the top and bottom interfaces of @{term A} are @{term P} and @{term Q} \n  respectively, then the Hoare triple @{term \"(asn P, c, asn Q)\"} is provable \n  for each command @{term c} that can be extracted from @{term A}. *}\n\n\n\nlemma soundness_graphical_helper:\n  assumes no_var_interference: \"\\<And>c. wr_com c = {}\"\n  shows \n    \"(prov_dia G P Q \\<longrightarrow> \n      (P = top_dia G \\<and> Q = bot_dia G \\<and> \n      (\\<forall>c. coms_dia G c \\<longrightarrow> prov_triple (asn P, c, asn Q)))) \n   \\<and> (prov_com C P Q \\<longrightarrow> \n      (\\<forall>c. coms_com C c \\<longrightarrow> prov_triple (asn P, c, asn Q)))\n   \\<and> (prov_ass A \\<longrightarrow> \n      (\\<forall>c. coms_ass A c \\<longrightarrow> prov_triple (asn (top_ass A), c, asn (bot_ass A))))\"\nproof (induct rule: prov_dia_prov_com_prov_ass.induct)\n  case (Skip p)\n  thus ?case \n  apply (intro allI impI, elim conjE coms_skip_inv)\n  apply (auto simp add: prov_triple.skip)\n  done\nnext\n  case (Exists G P Q x)\n  thus ?case\n  apply (intro allI impI, elim conjE coms_exists_inv)\n  apply (auto simp add: prov_triple.exists)\n  done\nnext\n  case (Basic P c Q)\n  thus ?case\n  by (intro allI impI, elim conjE coms_basic_inv, auto)\nnext\n  case (Choice G P Q H)\n  thus ?case\n  apply (intro allI impI, elim conjE coms_choice_inv)\n  apply (auto simp add: prov_triple.choose)\n  done\nnext\n  case (Loop G P)\n  thus ?case\n  apply (intro allI impI, elim conjE coms_loop_inv)\n  apply (auto simp add: prov_triple.loop)\n  done\nnext\n  case (Main G)\n  thus ?case\n  apply (intro conjI) \n  apply (simp, simp)\n  apply (intro allI impI)\n  apply (elim coms_main_inv, simp)\n  proof -\n    fix c V \\<Lambda> E \n    fix \\<pi>::\"lin\"\n    fix cs::\"command list\"\n    assume wf_G: \"wf_dia (Graph V \\<Lambda> E)\"\n    assume \"\\<And>v. v \\<in> fset V \\<Longrightarrow> \\<forall>c. coms_ass (\\<Lambda> v) c \\<longrightarrow> \n      prov_triple (asn (top_ass (\\<Lambda> v)), c, asn (bot_ass (\\<Lambda> v)))\"\n    hence prov_vertex: \"\\<And>v c P Q F. \\<lbrakk> coms_ass (\\<Lambda> v) c; v \\<in> fset V; \n      P = (top_ass (\\<Lambda> v) \\<otimes> F) ; Q = (bot_ass (\\<Lambda> v) \\<otimes> F) \\<rbrakk> \n      \\<Longrightarrow> prov_triple (asn P, c, asn Q)\" \n    by (auto simp add: prov_triple.frame no_var_interference)\n    assume \"\\<And>e. e \\<in> set E \\<Longrightarrow> \\<forall>c. coms_com (snd3 e) c \\<longrightarrow> prov_triple \n      (asn (\\<Otimes>v|\\<in>|fst3 e. bot_ass (\\<Lambda> v)),c,asn (\\<Otimes>v|\\<in>|thd3 e. top_ass (\\<Lambda> v)))\"\n    hence prov_edge: \"\\<And>e c P Q F. \\<lbrakk> e \\<in> set E ; coms_com (snd3 e) c ; \n      P = ((\\<Otimes>v|\\<in>|fst3 e. bot_ass (\\<Lambda> v)) \\<otimes> F) ;\n      Q = ((\\<Otimes>v|\\<in>|thd3 e. top_ass (\\<Lambda> v)) \\<otimes> F) \\<rbrakk> \n      \\<Longrightarrow> prov_triple (asn P, c, asn Q)\"\n    by (auto simp add: prov_triple.frame no_var_interference)\n    assume len_cs: \"length cs = length \\<pi>\"\n    assume \"\\<forall>i<length \\<pi>. \n      case_sum (coms_ass \\<circ> \\<Lambda>) (coms_com \\<circ> snd3) (\\<pi> ! i) (cs ! i)\"\n    hence \\<pi>_cs: \"\\<And>i. i < length \\<pi> \\<Longrightarrow>\n      case_sum (coms_ass \\<circ> \\<Lambda>) (coms_com \\<circ> snd3) (\\<pi> ! i) (cs ! i)\" by auto\n    assume G_def: \"G = Graph V \\<Lambda> E\"\n    assume c_def: \"c = foldr op ;; cs Skip\"\n    assume \\<pi>_lin: \"\\<pi> \\<in> lins (Graph V \\<Lambda> E)\"\n\n    note lins = linsD[OF \\<pi>_lin]\n    \n    def \\<Pi> \\<equiv> \"mk_ps_chain \\<lbrace> initial_ps G \\<rbrace> \\<pi>\"\n    \n    have \"\\<Pi> \\<in> ps_chains G\" by (simp add: \\<pi>_lin \\<Pi>_def ps_chains_def G_def)\n    hence 1: \"post \\<Pi> = [ terminals G |=> Bot ]\"\n      and 2: \"chain_all wf_ps_triple \\<Pi>\"\n    by (insert wf_chains G_def wf_G, auto simp add: wf_ps_chain_def)\n    \n    show \"prov_triple (asn (\\<Otimes>v|\\<in>|initials (Graph V \\<Lambda> E). top_ass (\\<Lambda> v)), \n      foldr op ;; cs Skip, asn (\\<Otimes>v|\\<in>|terminals (Graph V \\<Lambda> E). bot_ass (\\<Lambda> v)))\"\n    apply (intro seq_fold[of _ \"ps_chain_to_int_chain G \\<Pi>\"])\n    apply (unfold len_cs)\n    apply (unfold ps_chain_to_int_chain_def chainmap_preserves_length \\<Pi>_def)\n    apply (unfold mk_ps_chain_preserves_length, simp)\n    apply (unfold pre_chainmap post_chainmap)\n    apply (unfold pre_mk_ps_chain pre.simps)\n    apply (fold \\<Pi>_def, unfold 1)\n    apply (unfold initial_ps_def)\n    apply (unfold ps_to_int_def)\n    apply (unfold fdom_make_fmap)\n    apply (unfold G_def labelling.simps, fold G_def)\n    apply (subgoal_tac \"\\<forall>v \\<in> fset (initials G). top_ass (\\<Lambda> v) = \n      case_topbot top_ass bot_ass (lookup [ initials G |=> Top ] v) (\\<Lambda> v)\")\n    apply (unfold iter_hcomp_cong, simp)\n    apply (metis lookup_make_fmap topbot.simps(3))\n    apply (subgoal_tac \"\\<forall>v \\<in> fset (terminals G). bot_ass (\\<Lambda> v) = \n      case_topbot top_ass bot_ass (lookup [ terminals G |=> Bot ] v) (\\<Lambda> v)\")\n    apply (unfold iter_hcomp_cong, simp)\n    apply (metis lookup_make_fmap topbot.simps(4), simp)\n    apply (unfold G_def, fold ps_chain_to_int_chain_simp G_def)\n    proof -\n      fix i\n      assume \"i < length \\<pi>\"\n      hence \"i < chainlen \\<Pi>\"\n      by (metis \\<Pi>_def add_0_left chainlen.simps(1) \n        mk_ps_chain_preserves_length)\n      hence wf_\\<Pi>i: \"wf_ps_triple (nthtriple \\<Pi> i)\" \n        by (insert 2, simp add: chain_all_nthtriple)\n      show \"prov_triple (asn (fst3 (nthtriple (ps_chain_to_int_chain G \\<Pi>) i)), \n                 cs ! i, asn (thd3 (nthtriple (ps_chain_to_int_chain G \\<Pi>) i)))\"\n      apply (unfold ps_chain_to_int_chain_def)\n      apply (unfold nthtriple_chainmap[OF `i < chainlen \\<Pi>`])\n      apply (unfold fst3_simp thd3_simp)\n      proof (cases \"\\<pi>!i\")\n        case (Inl v)\n\n        have \"snd3 (nthtriple \\<Pi> i) = Inl v\"\n        apply (unfold snds_of_triples_form_comlist[OF `i < chainlen \\<Pi>`])\n        apply (auto simp add: \\<Pi>_def comlist_mk_ps_chain Inl)\n        done\n\n        with wf_\\<Pi>i wf_ps_triple_def obtain \\<sigma> where \n          v_notin_\\<sigma>: \"v |\\<notin>| fdom \\<sigma>\" and\n          fst_\\<Pi>i: \"fst3 (nthtriple \\<Pi> i) = [ {|v|} |=> Top ] \\<oplus> \\<sigma>\" and\n          thd_\\<Pi>i: \"thd3 (nthtriple \\<Pi> i) = [ {|v|} |=> Bot ] \\<oplus> \\<sigma>\" by auto\n\n        show \"prov_triple (asn (ps_to_int G (fst3 (nthtriple \\<Pi> i))), \n                   cs ! i, asn (ps_to_int G (thd3 (nthtriple \\<Pi> i))))\"\n        apply (intro prov_vertex[where v=v])\n        apply (metis (no_types) Inl `i < length \\<pi>` \\<pi>_cs o_def sum.simps(5))\n        apply (metis (lifting) Inl lins(2) Inl_not_Inr PlusE `i < length \\<pi>` \n          nth_mem sum.simps(1) vertices.simps)\n        apply (unfold fst_\\<Pi>i thd_\\<Pi>i)\n        apply (unfold ps_to_int_def)\n        apply (unfold fdom_union fdom_make_fmap)\n        apply (unfold finsert_is_funion[symmetric])\n        apply (insert v_notin_\\<sigma>)\n        apply (unfold iter_hcomp_insert)\n        apply (unfold lookup_union2 lookup_make_fmap1)\n        apply (unfold G_def labelling.simps)\n        apply (subgoal_tac \"\\<forall>va \\<in> fset (fdom \\<sigma>). case_topbot top_ass bot_ass \n          (lookup ([ {|v|} |=> Top ] \\<oplus> \\<sigma>) va) (\\<Lambda> va) = \n          case_topbot top_ass bot_ass (lookup ([{|v|} |=> Bot] \\<oplus> \\<sigma>) va)(\\<Lambda> va)\")\n        apply (unfold iter_hcomp_cong, simp)\n        apply (metis fmember.rep_eq lookup_union1, simp)\n        done\n      next\n        case (Inr e)\n        have \"snd3 (nthtriple \\<Pi> i) = Inr e\"\n        apply (unfold snds_of_triples_form_comlist[OF `i < chainlen \\<Pi>`])\n        apply (auto simp add: \\<Pi>_def comlist_mk_ps_chain Inr)\n        done\n\n        with wf_\\<Pi>i wf_ps_triple_def obtain \\<sigma> where\n          fst_e_disjoint_\\<sigma>: \"fst3 e |\\<inter>| fdom \\<sigma> = {||}\" and\n          thd_e_disjoint_\\<sigma>: \"thd3 e |\\<inter>| fdom \\<sigma> = {||}\" and\n          fst_\\<Pi>i: \"fst3 (nthtriple \\<Pi> i) = [ fst3 e |=> Bot ] \\<oplus> \\<sigma>\" and\n          thd_\\<Pi>i: \"thd3 (nthtriple \\<Pi> i) = [ thd3 e |=> Top ] \\<oplus> \\<sigma>\" \n        by (auto simp add: inf_sup_distrib2)\n\n        show \"prov_triple (asn (ps_to_int G (fst3 (nthtriple \\<Pi> i))), \n                   cs ! i, asn (ps_to_int G (thd3 (nthtriple \\<Pi> i))))\"\n        apply (intro prov_edge[where e=e])\n        apply (subgoal_tac \"Inr e \\<in> set \\<pi>\")\n        apply (metis Inr_not_Inl PlusE edges.simps lins(2) sum.simps(2))\n        apply (metis Inr `i < length \\<pi>` nth_mem)\n        apply (metis (no_types) Inr `i < length \\<pi>` \\<pi>_cs o_def sum.simps(6))\n        apply (unfold fst_\\<Pi>i thd_\\<Pi>i)\n        apply (unfold ps_to_int_def)\n        apply (unfold G_def labelling.simps)\n        apply (unfold fdom_union fdom_make_fmap)\n        apply (insert fst_e_disjoint_\\<sigma>)\n        apply (unfold iter_hcomp_union)\n        apply (subgoal_tac \"\\<forall>v \\<in> fset (fst3 e). case_topbot top_ass bot_ass \n          (lookup ([ fst3 e |=> Bot ] \\<oplus> \\<sigma>) v) (\\<Lambda> v) = bot_ass (\\<Lambda> v)\")\n        apply (unfold iter_hcomp_cong)\n        apply (simp)\n        apply (intro ballI)\n        apply (subgoal_tac \"v |\\<notin>| fdom \\<sigma>\")\n        apply (unfold lookup_union2)\n        apply (metis lookup_make_fmap topbot.simps(4))\n        apply (metis fempty_iff finterI fmember.rep_eq)\n        apply (insert thd_e_disjoint_\\<sigma>)\n        apply (unfold iter_hcomp_union)\n        apply (subgoal_tac \"\\<forall>v \\<in> fset (thd3 e). case_topbot top_ass bot_ass \n          (lookup ([ thd3 e |=> Top ] \\<oplus> \\<sigma>) v) (\\<Lambda> v) = top_ass (\\<Lambda> v)\")\n        apply (unfold iter_hcomp_cong)\n        apply (subgoal_tac \"\\<forall>v \\<in> fset (fdom \\<sigma>). case_topbot top_ass bot_ass \n          (lookup ([ thd3 e |=> Top ] \\<oplus> \\<sigma>) v) (\\<Lambda> v) = \n          case_topbot top_ass bot_ass (lookup ([fst3 e |=> Bot] \\<oplus> \\<sigma>) v) (\\<Lambda> v)\")\n        apply (unfold iter_hcomp_cong)\n        apply simp\n        apply (intro ballI)\n        apply (subgoal_tac \"v |\\<in>| fdom \\<sigma>\")\n        apply (unfold lookup_union1, auto)\n        apply (subgoal_tac \"v |\\<notin>| fdom \\<sigma>\")\n        apply (unfold lookup_union2)\n        apply (metis lookup_make_fmap topbot.simps(3))\n        by (metis fempty_iff finterI fmember.rep_eq)\n      qed\n    qed\n  qed\nqed\n\ntext {* The soundness theorem states that any diagram provable using the\n  proof rules for ribbons can be recreated as a valid proof in separation\n  logic. *}\n\ncorollary soundness_graphical:\n  assumes \"\\<And>c. wr_com c = {}\"\n  assumes \"prov_dia G P Q\"\n  shows \"\\<forall>c. coms_dia G c \\<longrightarrow> prov_triple (asn P, c, asn Q)\"\nusing soundness_graphical_helper[OF assms(1)] and assms(2) by auto\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Ribbon_Proofs/Ribbons_Graphical_Soundness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.34529198372569136}}
{"text": "theory v1_isar_new\n  imports Main \"../../QML_S5\"\nbegin\n\nconsts makeTable ::  \"\\<mu> \\<Rightarrow> \\<mu> \\<Rightarrow> \\<sigma>\"  (\"T\") (* (T x y) \\<equiv> x made from y *)\nlemma necessity_of_distinctness: \"\\<lfloor>(\\<^bold>\\<forall>x. \\<^bold>\\<forall>y. \\<^bold>\\<box>((\\<^bold>\\<not>(x\\<^bold>=\\<^sup>Ly)) \\<^bold>\\<rightarrow> \\<^bold>\\<box>(\\<^bold>\\<not>(x\\<^bold>=\\<^sup>Ly))))\\<rfloor>\" by auto \n\nlemma \n  assumes compossibilty1: \"\\<lfloor>(\\<^bold>\\<forall>x1. \\<^bold>\\<forall>y1. \\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>(((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\<and> T x2 y2) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>(T x1 y1 \\<^bold>\\<and> T x2 y2)))\\<rfloor>\"\n  assumes origin_uniqueness1: \"\\<lfloor>(\\<^bold>\\<forall>x1. \\<^bold>\\<forall>y1. \\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. ((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x1 y1) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> (\\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2))))\\<rfloor>\" \n  shows origin_essentialism1: \"\\<lfloor>(\\<^bold>\\<forall>x1. \\<^bold>\\<forall>y1. \\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2)))\\<rfloor>\"\n\nproof(rule allI)\n  fix w\n  show \"(\\<^bold>\\<forall>x1. \\<^bold>\\<forall>y1. \\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2))) w\" \n  proof(rule allI)\n    fix x1\n    show \"(\\<^bold>\\<forall>y1. \\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2))) w\" \n    proof(rule allI)\n      fix y1\n      show  \"(\\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2))) w\" \n      proof(rule allI)\n        fix x2\n        show  \"(\\<^bold>\\<forall>y2. T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2))) w\" \n        proof(rule allI)\n          fix y2\n          show  \"(T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2))) w\"\n          proof(rule impI)\n            assume table_x1_from_y1: \"T x1 y1 w\"\n            show  \"(\\<^bold>\\<box>((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2))) w\"\n            proof(rule allI)\n              fix v\n              show \"(((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2))) v\"\n              proof(rule impI)\n                assume antecedent: \"((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\<and> T x2 y2) v\"\n                show \"(\\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2)) v\"\n                proof(rule notI)\n                  assume \"(x1\\<^bold>=\\<^sup>Lx2) v\"\n\n                  from antecedent have table_x2_from_y2: \"T x2 y2 v\" by (rule conjE)\n                  from antecedent have non_overlapping: \"(\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) v\" by (rule conjE)\n\n                  from compossibilty1 have \"(\\<^bold>\\<forall>x1. \\<^bold>\\<forall>y1. \\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>(((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\<and> T x2 y2) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>(T x1 y1 \\<^bold>\\<and> T x2 y2))) w\"..\n                  then have \"(\\<^bold>\\<forall>y1. \\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>(((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\<and> T x2 y2) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>(T x1 y1 \\<^bold>\\<and> T x2 y2))) w\" by (rule allE)\n                  then have \"(\\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>(((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\<and> T x2 y2) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>(T x1 y1 \\<^bold>\\<and> T x2 y2))) w\" by (rule allE)\n                  then have \"(\\<^bold>\\<forall>y2. T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>(((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\<and> T x2 y2) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>(T x1 y1 \\<^bold>\\<and> T x2 y2))) w\" by (rule allE)\n                  then have \"(T x1 y1 \\<^bold>\\<rightarrow> \\<^bold>\\<box>(((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\<and> T x2 y2) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>(T x1 y1 \\<^bold>\\<and> T x2 y2))) w\" by (rule allE)\n                  then have \"(\\<^bold>\\<box>(((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\<and> T x2 y2) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>(T x1 y1 \\<^bold>\\<and> T x2 y2))) w\" \n                    using table_x1_from_y1 by (rule mp)\n                  then have \"((((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) \\<^bold>\\<and> T x2 y2) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>(T x1 y1 \\<^bold>\\<and> T x2 y2))) v\" by (rule allE)\n                  then have \"(\\<^bold>\\<diamond>(T x1 y1 \\<^bold>\\<and> T x2 y2)) w\" using antecedent by (rule mp)\n                  then obtain u where u: \"(T x1 y1 \\<^bold>\\<and> T x2 y2) u\" by (rule exE)\n                  have \"(\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2)) u\" using non_overlapping by auto\n                  then have origin_uniqueness1_ante: \"((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x1 y1) \\<^bold>\\<and> (T x2 y2))) u\" \n                    using `(T x1 y1 \\<^bold>\\<and> T x2 y2) u` by (rule conjI)\n\n                  from origin_uniqueness1 have \"(\\<^bold>\\<forall>x1. \\<^bold>\\<forall>y1. \\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. ((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x1 y1) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> (\\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2)))) u\"..\n                  then have \"(\\<^bold>\\<forall>y1. \\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. ((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x1 y1) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> (\\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2)))) u\" by (rule allE)\n                  then have \"(\\<^bold>\\<forall>x2. \\<^bold>\\<forall>y2. ((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x1 y1) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> (\\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2)))) u\" by (rule allE)\n                  then have \"(\\<^bold>\\<forall>y2. ((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x1 y1) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> (\\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2)))) u\" by (rule allE)\n                  then have \"(((\\<^bold>\\<not>(y1\\<^bold>=\\<^sup>Ly2) \\<^bold>\\<and> (T x1 y1) \\<^bold>\\<and> (T x2 y2)) \\<^bold>\\<rightarrow> (\\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2)))) u\" by (rule allE) \n                  then have \"(\\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2)) u\" using origin_uniqueness1_ante by (rule mp)\n                  then have \"(\\<^bold>\\<not>(x1\\<^bold>=\\<^sup>Lx2)) v\" using necessity_of_distinctness by auto\n                  then show \"False\" using `(x1\\<^bold>=\\<^sup>Lx2) v` by (rule notE)\n                qed\n              qed\n            qed\n          qed\n        qed\n      qed\n    qed\n  qed\nqed\n\n\nend\n", "meta": {"author": "hotessy", "repo": "origin_essen_public", "sha": "c91f54abfade669c30db34d2bbfcccbe1b97d23a", "save_path": "github-repos/isabelle/hotessy-origin_essen_public", "path": "github-repos/isabelle/hotessy-origin_essen_public/origin_essen_public-c91f54abfade669c30db34d2bbfcccbe1b97d23a/experiments/v1_isar_new.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.34529197632961595}}
{"text": "theory Utilitarismus\nimports Handlung \"HOL-Library.Extended_Real\" Maxime\nbegin\n\nsection\\<open>Utilitarismus\\<close>\ntext\\<open>\nWir betrachten hier primär einen einfachen Handlungsutilitarismus.\nFrei nach Jeremy Bentham. Sehr frei. Also sehr viel persönliche Auslegung.\n\nEine Handlung ist genau dann moralisch richtig,\nwenn sie den aggregierten Gesamtnutzen,\nd.h. die Summe des Wohlergehens aller Betroffenen, maximiert wird.\\<close>\n\ntype_synonym 'welt glueck_messen = \\<open>'welt handlung \\<Rightarrow> ereal\\<close>\n\ntext\\<open>Wir messen Glück im Typen \\<^typ>\\<open>ereal\\<close>, also reelle Zahlen mit \\<^term>\\<open>\\<infinity>::ereal\\<close>\nund \\<^term>\\<open>-\\<infinity>::ereal\\<close>, so dass auch \"den höchsten Preis zahlen\" modelliert werden kann.\\<close>\n\nlemma \\<open>(\\<lambda>h::ereal handlung. case h of Handlung vor nach \\<Rightarrow> nach - vor) (Handlung 3 5) = 2\\<close>\n  by simp\nlemma \\<open>(\\<lambda>h::ereal handlung. case h of Handlung vor nach \\<Rightarrow> nach - vor) (Handlung 3 \\<infinity>) = \\<infinity>\\<close>\n  by simp\nlemma \\<open>(\\<lambda>h::ereal handlung. case h of Handlung vor nach \\<Rightarrow> nach - vor) (Handlung 3 (-\\<infinity>)) = -\\<infinity>\\<close>\n  by simp\n\n\ntext\\<open>Eine Handlung ist genau dann moralisch richtig,\nwenn die Gesamtbilanz einen positiven Nutzen aufweist.\\<close>\ndefinition moralisch_richtig :: \\<open>'welt glueck_messen \\<Rightarrow> 'welt handlung \\<Rightarrow> bool\\<close> where\n  \\<open>moralisch_richtig glueck_messen handlung \\<equiv> (glueck_messen handlung) \\<ge> 0\\<close>\n\nsubsection\\<open>Goldene Regel und Utilitarismus im Einklang \\label{sec:golregelutilkonsistent}\\<close>\ntext\\<open>\nIn \\S\\ref{sec:gesinnungsverantwortungsethik} haben wir\nGesinnungsethik und Verantwortungsethik definiert.\n\nIn diesem kleinen Intermezzo werden wir zeigen, wie sich die Gesinnungsethik der goldenen Regel\nin die Verantwortungsethik des Utilitarismus übersetzen lässt.\n\\<close>\n\n\ntext\\<open>Wir modellieren die goldene Regel als Gesinnungsethik.\\<close>\ndefinition goldene_regel_als_gesinnungsethik\n  :: \\<open>('person, 'welt) maxime \\<Rightarrow> ('person, 'welt) handlungsabsicht \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>goldene_regel_als_gesinnungsethik maxime handlungsabsicht \\<equiv>\n    \\<forall>welt. moralisch welt maxime handlungsabsicht\\<close>\n\ndefinition utilitarismus_als_verantwortungsethik\n  :: \\<open>'welt glueck_messen \\<Rightarrow> 'welt handlung \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>utilitarismus_als_verantwortungsethik glueck_messen handlung \\<equiv>\n    moralisch_richtig glueck_messen handlung\\<close>\n\n\n\ntext\\<open>\nEine Maxime ist immer aus Sicht einer bestimmten Person definiert.\nWir \"neutralisieren\" eine Maxime indem wir diese bestimmte Person entfernen\nund die Maxime so allgemeingültiger machen.\nAlle Personen müssen gleich behandelt werden.\nUm die Maxime unabhängig von einer bestimmten Person zu machen,\nfordern wir einfach, dass die Maxime für aller Personen erfüllt sein muss.\\<close>\n(*TODO: gegen moralisch beweisen?\nund erklaeren! Warum \\<forall>\nMacht eine maxime unabhängig von der person*)\n(*TODO: upstream nach Maxime und katImp beweis!*)\nfun maximeNeutralisieren :: \\<open>('person, 'welt) maxime \\<Rightarrow> ('welt handlung \\<Rightarrow> bool)\\<close> where\n  \\<open>maximeNeutralisieren (Maxime m) = (\\<lambda>welt. \\<forall>p::'person. m p welt)\\<close>\n\n\ntext\\<open>\nNun übersetzen wir eine Maxime in die \\<^typ>\\<open>'welt glueck_messen\\<close> Funktion des Utilitarismus.\nDer Trick: eine verletzte Maxime wird als unendliches Leid übersetzt.\\<close>\ndefinition maxime_als_nutzenkalkuel\n  :: \\<open>('person, 'welt) maxime \\<Rightarrow> 'welt glueck_messen\\<close>\nwhere\n  \\<open>maxime_als_nutzenkalkuel maxime \\<equiv>\n    (\\<lambda>welt. case (maximeNeutralisieren maxime) welt\n              of True \\<Rightarrow> 1     \n               | False \\<Rightarrow> - \\<infinity>)\\<close>\n\n(*<*)\nlemma ereal_zero_geq_case:\n  \\<open>((0::ereal) \\<le> (case (\\<forall>p. f p) of True \\<Rightarrow> 1 | False \\<Rightarrow> - \\<infinity>)) \\<longleftrightarrow> (\\<forall>p. f p)\\<close>\n  by (simp add: bool.split_sel)\n(*>*)\n\ntext\\<open>Für diese Übersetzung können wir beweisen,\ndass die Gesinnungsethik der goldenen Regel und die utilitaristische Verantwortungsethik\nkonsistent sind:\\<close>\ntheorem \\<open>gesinnungsethik_verantwortungsethik_konsistent\n        (goldene_regel_als_gesinnungsethik maxime)\n        (utilitarismus_als_verantwortungsethik (maxime_als_nutzenkalkuel maxime))\\<close>\n  apply(cases \\<open>maxime\\<close>, rename_tac m, simp)\n  apply(simp add: gesinnungsethik_verantwortungsethik_konsistent_def\n                  goldene_regel_als_gesinnungsethik_def utilitarismus_als_verantwortungsethik_def\n                  moralisch_richtig_def maxime_als_nutzenkalkuel_def)\n  apply(intro allI)\n  apply(case_tac \\<open>handlungsabsicht\\<close>, rename_tac h, simp)\n  apply(simp add: moralisch_simp)\n  apply(simp add: ereal_zero_geq_case)\n  by blast\n\ntext\\<open>Diese Konsistenz gilt nicht im allgemeinen,\nsondern nur wenn Glück gemessen wird mit Hilfe der \\<^const>\\<open>maxime_als_nutzenkalkuel\\<close> Funktion.\nDer Trick dabei ist nicht, dass wir einer verletzten Maxime \\<^term>\\<open>-\\<infinity>::ereal\\<close> Nutzen zuordnen,\nsondern der Trick besteht in \\<^const>\\<open>maximeNeutralisieren\\<close>, welche nicht erlaubt Glück\naufzuaddieren und mit Leid zu verrechnen, sondern dank des Allquantors dafür sorgt,\ndass auch nur das kleinste Leid dazu führt, dass sofort \\<^const>\\<open>False\\<close> zurückgegebn wird.\n\nAber auch wenn wir ordentlich aufsummieren, jedoch einer verletzten Maxime \\<^term>\\<open>-\\<infinity>::ereal\\<close>\nNutzen zuordnen und zusätzlich annehmen, dass die Bevölkerung endlich ist,\ndann funktioniert das auch:\n\\<close>\n\n\nfun maxime_als_summe_wohlergehen\n  :: \\<open>('person, 'welt) maxime \\<Rightarrow> 'welt glueck_messen\\<close>\nwhere\n  \\<open>maxime_als_summe_wohlergehen (Maxime m) =\n    (\\<lambda>welt. \\<Sum>p\\<in>bevoelkerung. (case m p welt\n                                 of True \\<Rightarrow> 1     \n                                  | False \\<Rightarrow> - \\<infinity>))\\<close>\n\n(*<*)\n\nlemma sum_wohlergehen_simp:\n  \\<open>(\\<Sum>p\\<in>B. case f p of True \\<Rightarrow> 1 | False \\<Rightarrow> - \\<infinity>) = (\\<Sum>p\\<in>B. if f p then 1 else - \\<infinity>)\\<close>\n  by (simp add: case_bool_if)\nlemma \\<open>(\\<Sum>p\\<in>B. if f p then 1 else - \\<infinity>) < (\\<infinity>::ereal)\\<close>\n  by (simp add: sum_Pinfty)\n\n\nlemma helper_finite_wohlergehen_sum_cases:\n  \\<open>finite B \\<Longrightarrow>\n    (\\<Sum>p\\<in>B. if f p then 1 else - \\<infinity>) = (- \\<infinity>::ereal)\n    \\<or>\n    ((0::ereal) \\<le> (\\<Sum>p\\<in>B. if f p then 1 else - \\<infinity>))\\<close>\n  apply(induction rule: finite.induct)\n   apply(simp; fail)\n  apply(simp add: sum.insert_if)\n  apply(intro allI impI conjI)\n  apply(elim disjE)\n   apply(simp)\n  apply(simp)\n  done\n    \nlemma helper_wohlergehen_sum_IH:\n  \\<open>finite B \\<Longrightarrow> (0::ereal) \\<le> (\\<Sum>p\\<in>insert b B. if f p then 1 else - \\<infinity>)\n    \\<Longrightarrow>  (0::ereal) \\<le> (\\<Sum>p\\<in>B. if f p then 1 else - \\<infinity>)\\<close>\n  apply(frule helper_finite_wohlergehen_sum_cases[of _ \\<open>f\\<close>])\n  apply(elim disjE)\n   apply(simp add: sum.insert_if)\n   apply(case_tac \\<open>b \\<in> B\\<close>)\n    apply(simp; fail)\n   apply(simp)\n   apply (metis (full_types) ereal_plus_1(3) not_MInfty_nonneg plus_ereal.simps(6))\n  apply (simp)\n  done\n\nlemma helper_wohlergehen_sum_minfty:\n  \\<open>(\\<Sum>p\\<in>B. if f p then 1 else - \\<infinity>) = (-\\<infinity>::ereal) \\<Longrightarrow> \\<exists>x\\<in>B. \\<not> f x\\<close>\n  by (metis (mono_tags, lifting) not_MInfty_nonneg sum_nonneg zero_less_one_ereal)\n\nlemma helper_wohlergehen_sum_pos:\n  \\<open>finite B \\<Longrightarrow> (0::ereal) \\<le> (\\<Sum>p\\<in>B. if f p then 1 else - \\<infinity>) \\<Longrightarrow> \\<forall>p\\<in>B. f p\\<close>\n  apply(induction \\<open>B\\<close> rule: finite.induct)\n   apply(simp; fail)\n  apply(frule(1) helper_wohlergehen_sum_IH)\n  apply(simp)\n  apply(simp add: sum.insert_if)\n  apply(case_tac \\<open>a \\<in> A\\<close>)\n   apply(simp; fail)\n  apply(simp)\n  apply(case_tac \\<open>f a\\<close>)\n   apply(simp; fail)\n  apply(simp)\n  by (metis MInfty_neq_PInfty(2) ereal_plus_eq_MInfty ereal_times(1) not_MInfty_nonneg sum_Pinfty)\n\nlemma helper_wohlergehen_sum_iff:\n  \\<open>finite B \\<Longrightarrow> (0::ereal) \\<le> (\\<Sum>p\\<in>B. if f p then 1 else - \\<infinity>) \\<longleftrightarrow> (\\<forall>p\\<in>B. f p)\\<close>\n  apply(frule helper_finite_wohlergehen_sum_cases[of _ \\<open>f\\<close>])\n  apply(elim disjE)\n   apply(simp add: helper_wohlergehen_sum_minfty; fail)\n  apply(simp)\n  using helper_wohlergehen_sum_pos by blast\n  \n  \n\nlemma helper_wohlergehen_sum_cases_iff:\n  \\<open>finite (bevoelkerung::'person set) \\<Longrightarrow>\n          (0::ereal) \\<le> (\\<Sum>p\\<in>(bevoelkerung::'person set). case f p of True \\<Rightarrow> 1 | False \\<Rightarrow> - \\<infinity>)\n        \\<longleftrightarrow> (\\<forall>p\\<in>bevoelkerung. f p)\\<close>\n  using helper_wohlergehen_sum_iff sum_wohlergehen_simp by metis\n \n\n(*>*)\n\ntheorem\n  fixes maxime :: \\<open>('person, 'welt) maxime\\<close>\n  assumes \\<open>finite (bevoelkerung:: 'person set)\\<close>\n  shows \n    \\<open>gesinnungsethik_verantwortungsethik_konsistent\n      (goldene_regel_als_gesinnungsethik maxime)\n      (utilitarismus_als_verantwortungsethik (maxime_als_summe_wohlergehen maxime))\\<close>\n  apply(cases \\<open>maxime\\<close>, rename_tac m, simp)\n  apply(simp add: gesinnungsethik_verantwortungsethik_konsistent_def\n                  goldene_regel_als_gesinnungsethik_def utilitarismus_als_verantwortungsethik_def\n                  moralisch_richtig_def)\n  apply(intro allI)\n  apply(case_tac \\<open>handlungsabsicht\\<close>, rename_tac h, simp)\n  apply(simp add: moralisch_simp)\n  apply(subst helper_wohlergehen_sum_cases_iff[OF \\<open>finite bevoelkerung\\<close>])\n  apply(auto simp add: bevoelkerung_def)\n  done\n\n\ntext\\<open>\n\"Wie zu erwarten, will Kant nichts vom Utilitarismus oder sonstigen Lehren wissen,\ndie der Moral einen außerhalb ihrer selbst liegenden Zweck zuschreiben\" @{cite russellphi}.\nDie eben bewiesene Konsitenz von Gesinnungsethik und Verantwortungsethik zeigt,\ndas unsere Grunddefinitionen bereits eine Formalisierung des Kategorischen Imperativs\nkomplett im strengen Sinne Kants ausschließen.\nDennoch finde ich unsere Interpretation bis jetzt nicht abwegig.\nDer große Trick besteht darin, dass wir eine \\<^typ>\\<open>('person, 'welt) handlungsabsicht\\<close>\nsehr einfach in eine \\<^typ>\\<open>'welt handlung\\<close> in unserem theoretischen Modell überführen können.\nDie widerspricht Kants Grundannahme, dass die Folgen einer Handlungsabsicht unvorhersehbar sind.\n\\<close>\n\nend", "meta": {"author": "diekmann", "repo": "kant", "sha": "fd8cd77b199114d0a8f6b5ad5e0c63a2c4a88902", "save_path": "github-repos/isabelle/diekmann-kant", "path": "github-repos/isabelle/diekmann-kant/kant-fd8cd77b199114d0a8f6b5ad5e0c63a2c4a88902/Formal/Utilitarismus.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.34529197632961595}}
{"text": "(*  Title:      HOL/TLA/Memory/MemoryImplementation.thy\n    Author:     Stephan Merz, University of Munich\n*)\n\nsection \\<open>RPC-Memory example: Memory implementation\\<close>\n\ntheory MemoryImplementation\nimports Memory RPC MemClerk\nbegin\n\ndatatype histState = histA | histB\n\ntype_synonym histType = \"(PrIds \\<Rightarrow> histState) stfun\"  (* the type of the history variable *)\n\nconsts\n  (* the specification *)\n     (* channel (external) *)\n  memCh         :: \"memChType\"\n     (* internal variables *)\n  mm            :: \"memType\"\n\n  (* the state variables of the implementation *)\n     (* channels *)\n  (* same interface channel memCh *)\n  crCh          :: \"rpcSndChType\"\n  rmCh          :: \"rpcRcvChType\"\n     (* internal variables *)\n  (* identity refinement mapping for mm -- simply reused *)\n  rst           :: \"rpcStType\"\n  cst           :: \"mClkStType\"\n  ires          :: \"resType\"\n\ndefinition\n  (* auxiliary predicates *)\n  MVOKBARF      :: \"Vals \\<Rightarrow> bool\"\n  where \"MVOKBARF v \\<longleftrightarrow> (v \\<in> MemVal) \\<or> (v = OK) \\<or> (v = BadArg) \\<or> (v = RPCFailure)\"\n\ndefinition\n  MVOKBA        :: \"Vals \\<Rightarrow> bool\"\n  where \"MVOKBA v \\<longleftrightarrow> (v \\<in> MemVal) \\<or> (v = OK) \\<or> (v = BadArg)\"\n\ndefinition\n  MVNROKBA      :: \"Vals \\<Rightarrow> bool\"\n  where \"MVNROKBA v \\<longleftrightarrow> (v \\<in> MemVal) \\<or> (v = NotAResult) \\<or> (v = OK) \\<or> (v = BadArg)\"\n\ndefinition\n  (* tuples of state functions changed by the various components *)\n  e             :: \"PrIds => (bit * memOp) stfun\"\n  where \"e p = PRED (caller memCh!p)\"\n\ndefinition\n  c             :: \"PrIds \\<Rightarrow> (mClkState * (bit * Vals) * (bit * rpcOp)) stfun\"\n  where \"c p = PRED (cst!p, rtrner memCh!p, caller crCh!p)\"\n\ndefinition\n  r             :: \"PrIds \\<Rightarrow> (rpcState * (bit * Vals) * (bit * memOp)) stfun\"\n  where \"r p = PRED (rst!p, rtrner crCh!p, caller rmCh!p)\"\n\ndefinition\n  m             :: \"PrIds \\<Rightarrow> ((bit * Vals) * Vals) stfun\"\n  where \"m p = PRED (rtrner rmCh!p, ires!p)\"\n\ndefinition\n  (* the environment action *)\n  ENext         :: \"PrIds \\<Rightarrow> action\"\n  where \"ENext p = ACT (\\<exists>l. #l \\<in> #MemLoc \\<and> Call memCh p #(read l))\"\n\n\ndefinition\n  (* specification of the history variable *)\n  HInit         :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"HInit rmhist p = PRED rmhist!p = #histA\"\n\ndefinition\n  HNext         :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> action\"\n  where \"HNext rmhist p = ACT (rmhist!p)$ =\n                     (if (MemReturn rmCh ires p \\<or> RPCFail crCh rmCh rst p)\n                      then #histB\n                      else if (MClkReply memCh crCh cst p)\n                           then #histA\n                           else $(rmhist!p))\"\n\ndefinition\n  HistP         :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> temporal\"\n  where \"HistP rmhist p = (TEMP Init HInit rmhist p\n                           \\<and> \\<box>[HNext rmhist p]_(c p,r p,m p, rmhist!p))\"\n\ndefinition\n  Hist          :: \"histType \\<Rightarrow> temporal\"\n  where \"Hist rmhist = TEMP (\\<forall>p. HistP rmhist p)\"\n\ndefinition\n  (* the implementation *)\n  IPImp          :: \"PrIds \\<Rightarrow> temporal\"\n  where \"IPImp p = (TEMP (  Init \\<not>Calling memCh p \\<and> \\<box>[ENext p]_(e p)\n                       \\<and> MClkIPSpec memCh crCh cst p\n                       \\<and> RPCIPSpec crCh rmCh rst p\n                       \\<and> RPSpec rmCh mm ires p\n                       \\<and> (\\<forall>l. #l \\<in> #MemLoc \\<longrightarrow> MSpec rmCh mm ires l)))\"\n\ndefinition\n  ImpInit        :: \"PrIds \\<Rightarrow> stpred\"\n  where \"ImpInit p = PRED (  \\<not>Calling memCh p\n                          \\<and> MClkInit crCh cst p\n                          \\<and> RPCInit rmCh rst p\n                          \\<and> PInit ires p)\"\n\ndefinition\n  ImpNext        :: \"PrIds \\<Rightarrow> action\"\n  where \"ImpNext p = (ACT  [ENext p]_(e p)\n                       \\<and> [MClkNext memCh crCh cst p]_(c p)\n                       \\<and> [RPCNext crCh rmCh rst p]_(r p)\n                       \\<and> [RNext rmCh mm ires p]_(m p))\"\n\ndefinition\n  ImpLive        :: \"PrIds \\<Rightarrow> temporal\"\n  where \"ImpLive p = (TEMP  WF(MClkFwd memCh crCh cst p)_(c p)\n                        \\<and> SF(MClkReply memCh crCh cst p)_(c p)\n                        \\<and> WF(RPCNext crCh rmCh rst p)_(r p)\n                        \\<and> WF(RNext rmCh mm ires p)_(m p)\n                        \\<and> WF(MemReturn rmCh ires p)_(m p))\"\n\ndefinition\n  Implementation :: \"temporal\"\n  where \"Implementation = (TEMP ( (\\<forall>p. Init (\\<not>Calling memCh p) \\<and> \\<box>[ENext p]_(e p))\n                               \\<and> MClkISpec memCh crCh cst\n                               \\<and> RPCISpec crCh rmCh rst\n                               \\<and> IRSpec rmCh mm ires))\"\n\ndefinition\n  (* the predicate S describes the states of the implementation.\n     slight simplification: two \"histState\" parameters instead of a\n     (one- or two-element) set.\n     NB: The second conjunct of the definition in the paper is taken care of by\n     the type definitions. The last conjunct is asserted separately as the memory\n     invariant MemInv, proved in Memory.thy. *)\n  S :: \"histType \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> mClkState \\<Rightarrow> rpcState \\<Rightarrow> histState \\<Rightarrow> histState \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S rmhist ecalling ccalling rcalling cs rs hs1 hs2 p = (PRED\n                Calling memCh p = #ecalling\n              \\<and> Calling crCh p  = #ccalling\n              \\<and> (#ccalling \\<longrightarrow> arg<crCh!p> = MClkRelayArg<arg<memCh!p>>)\n              \\<and> (\\<not> #ccalling \\<and> cst!p = #clkB \\<longrightarrow> MVOKBARF<res<crCh!p>>)\n              \\<and> Calling rmCh p  = #rcalling\n              \\<and> (#rcalling \\<longrightarrow> arg<rmCh!p> = RPCRelayArg<arg<crCh!p>>)\n              \\<and> (\\<not> #rcalling \\<longrightarrow> ires!p = #NotAResult)\n              \\<and> (\\<not> #rcalling \\<and> rst!p = #rpcB \\<longrightarrow> MVOKBA<res<rmCh!p>>)\n              \\<and> cst!p = #cs\n              \\<and> rst!p = #rs\n              \\<and> (rmhist!p = #hs1 \\<or> rmhist!p = #hs2)\n              \\<and> MVNROKBA<ires!p>)\"\n\ndefinition\n  (* predicates S1 -- S6 define special instances of S *)\n  S1            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S1 rmhist p = S rmhist False False False clkA rpcA histA histA p\"\n\ndefinition\n  S2            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S2 rmhist p = S rmhist True False False clkA rpcA histA histA p\"\n\ndefinition\n  S3            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S3 rmhist p = S rmhist True True False clkB rpcA histA histB p\"\n\ndefinition\n  S4            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S4 rmhist p = S rmhist True True True clkB rpcB histA histB p\"\n\ndefinition\n  S5            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S5 rmhist p = S rmhist True True False clkB rpcB histB histB p\"\n\ndefinition\n  S6            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S6 rmhist p = S rmhist True False False clkB rpcA histB histB p\"\n\ndefinition\n  (* The invariant asserts that the system is always in one of S1 - S6, for every p *)\n  ImpInv         :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"ImpInv rmhist p = (PRED (S1 rmhist p \\<or> S2 rmhist p \\<or> S3 rmhist p\n                                \\<or> S4 rmhist p \\<or> S5 rmhist p \\<or> S6 rmhist p))\"\n\ndefinition\n  resbar        :: \"histType \\<Rightarrow> resType\"        (* refinement mapping *)\n  where\"resbar rmhist s p =\n                  (if (S1 rmhist p s | S2 rmhist p s)\n                   then ires s p\n                   else if S3 rmhist p s\n                   then if rmhist s p = histA\n                        then ires s p else MemFailure\n                   else if S4 rmhist p s\n                   then if (rmhist s p = histB & ires s p = NotAResult)\n                        then MemFailure else ires s p\n                   else if S5 rmhist p s\n                   then res (rmCh s p)\n                   else if S6 rmhist p s\n                   then if res (crCh s p) = RPCFailure\n                        then MemFailure else res (crCh s p)\n                   else NotAResult)\" (* dummy value *)\n\naxiomatization where\n  (* the \"base\" variables: everything except resbar and hist (for any index) *)\n  MI_base:       \"basevars (caller memCh!p,\n                           (rtrner memCh!p, caller crCh!p, cst!p),\n                           (rtrner crCh!p, caller rmCh!p, rst!p),\n                           (mm!l, rtrner rmCh!p, ires!p))\"\n\n(*\n    The main theorem is theorem \"Implementation\" at the end of this file,\n    which shows that the composition of a reliable memory, an RPC component, and\n    a memory clerk implements an unreliable memory. The files \"MIsafe.thy\" and\n    \"MIlive.thy\" contain lower-level lemmas for the safety and liveness parts.\n\n    Steps are (roughly) numbered as in the hand proof.\n*)\n\n(* --------------------------- automatic prover --------------------------- *)\n\ndeclare if_weak_cong [cong del]\n\n(* A more aggressive variant that tries to solve subgoals by assumption\n   or contradiction during the simplification.\n   THIS IS UNSAFE, BECAUSE IT DOESN'T RECORD THE CHOICES!!\n   (but it can be a lot faster than the default setup)\n*)\nML \\<open>\n  val config_fast_solver = Attrib.setup_config_bool \\<^binding>\\<open>fast_solver\\<close> (K false);\n  val fast_solver = mk_solver \"fast_solver\" (fn ctxt =>\n    if Config.get ctxt config_fast_solver\n    then assume_tac ctxt ORELSE' (eresolve_tac ctxt [notE])\n    else K no_tac);\n\\<close>\n\nsetup \\<open>map_theory_simpset (fn ctxt => ctxt addSSolver fast_solver)\\<close>\n\nML \\<open>val temp_elim = make_elim oo temp_use\\<close>\n\n\n\n(****************************** The history variable ******************************)\n\nsection \"History variable\"\n\nlemma HistoryLemma: \"\\<turnstile> Init(\\<forall>p. ImpInit p) \\<and> \\<box>(\\<forall>p. ImpNext p)\n         \\<longrightarrow> (\\<exists>\\<exists>rmhist. Init(\\<forall>p. HInit rmhist p)\n                          \\<and> \\<box>(\\<forall>p. [HNext rmhist p]_(c p, r p, m p, rmhist!p)))\"\n  apply clarsimp\n  apply (rule historyI)\n      apply assumption+\n  apply (rule MI_base)\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm HInit_def}]) [] [] 1\\<close>)\n   apply (erule fun_cong)\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm HNext_def}])\n    [@{thm busy_squareI}] [] 1\\<close>)\n  apply (erule fun_cong)\n  done\n\nlemma History: \"\\<turnstile> Implementation \\<longrightarrow> (\\<exists>\\<exists>rmhist. Hist rmhist)\"\n  apply clarsimp\n  apply (rule HistoryLemma [temp_use, THEN eex_mono])\n    prefer 3\n    apply (force simp: Hist_def HistP_def Init_def all_box [try_rewrite]\n      split_box_conj [try_rewrite])\n   apply (auto simp: Implementation_def MClkISpec_def RPCISpec_def\n     IRSpec_def MClkIPSpec_def RPCIPSpec_def RPSpec_def ImpInit_def\n     Init_def ImpNext_def c_def r_def m_def all_box [temp_use] split_box_conj [temp_use])\n  done\n\n(******************************** The safety part *********************************)\n\nsection \"The safety part\"\n\n(* ------------------------- Include lower-level lemmas ------------------------- *)\n\n(* RPCFailure notin MemVals U {OK,BadArg} *)\n\nlemma MVOKBAnotRF: \"MVOKBA x \\<Longrightarrow> x \\<noteq> RPCFailure\"\n  apply (unfold MVOKBA_def)\n  apply auto\n  done\n\n(* NotAResult notin MemVals U {OK,BadArg,RPCFailure} *)\n\nlemma MVOKBARFnotNR: \"MVOKBARF x \\<Longrightarrow> x \\<noteq> NotAResult\"\n  apply (unfold MVOKBARF_def)\n  apply auto\n  done\n\n(* ================ Si's are mutually exclusive ================================ *)\n(* Si and Sj are mutually exclusive for i # j. This helps to simplify the big\n   conditional in the definition of resbar when doing the step-simulation proof.\n   We prove a weaker result, which suffices for our purposes:\n   Si implies (not Sj), for j<i.\n*)\n\n(* --- not used ---\nlemma S1_excl: \"\\<turnstile> S1 rmhist p \\<longrightarrow> S1 rmhist p & \\<not>S2 rmhist p & \\<not>S3 rmhist p &\n    \\<not>S4 rmhist p & \\<not>S5 rmhist p & \\<not>S6 rmhist p\"\n  by (auto simp: S_def S1_def S2_def S3_def S4_def S5_def S6_def)\n*)\n\nlemma S2_excl: \"\\<turnstile> S2 rmhist p \\<longrightarrow> S2 rmhist p \\<and> \\<not>S1 rmhist p\"\n  by (auto simp: S_def S1_def S2_def)\n\nlemma S3_excl: \"\\<turnstile> S3 rmhist p \\<longrightarrow> S3 rmhist p \\<and> \\<not>S1 rmhist p \\<and> \\<not>S2 rmhist p\"\n  by (auto simp: S_def S1_def S2_def S3_def)\n\nlemma S4_excl: \"\\<turnstile> S4 rmhist p \\<longrightarrow> S4 rmhist p \\<and> \\<not>S1 rmhist p \\<and> \\<not>S2 rmhist p \\<and> \\<not>S3 rmhist p\"\n  by (auto simp: S_def S1_def S2_def S3_def S4_def)\n\nlemma S5_excl: \"\\<turnstile> S5 rmhist p \\<longrightarrow> S5 rmhist p \\<and> \\<not>S1 rmhist p \\<and> \\<not>S2 rmhist p\n                         \\<and> \\<not>S3 rmhist p \\<and> \\<not>S4 rmhist p\"\n  by (auto simp: S_def S1_def S2_def S3_def S4_def S5_def)\n\nlemma S6_excl: \"\\<turnstile> S6 rmhist p \\<longrightarrow> S6 rmhist p \\<and> \\<not>S1 rmhist p \\<and> \\<not>S2 rmhist p\n                         \\<and> \\<not>S3 rmhist p \\<and> \\<not>S4 rmhist p \\<and> \\<not>S5 rmhist p\"\n  by (auto simp: S_def S1_def S2_def S3_def S4_def S5_def S6_def)\n\n\n(* ==================== Lemmas about the environment ============================== *)\n\nlemma Envbusy: \"\\<turnstile> $(Calling memCh p) \\<longrightarrow> \\<not>ENext p\"\n  by (auto simp: ENext_def ACall_def)\n\n(* ==================== Lemmas about the implementation's states ==================== *)\n\n(* The following series of lemmas are used in establishing the implementation's\n   next-state relation (Step 1.2 of the proof in the paper). For each state Si, we\n   determine which component actions are possible and what state they result in.\n*)\n\n(* ------------------------------ State S1 ---------------------------------------- *)\n\nlemma S1Env: \"\\<turnstile> ENext p \\<and> $(S1 rmhist p) \\<and> unchanged (c p, r p, m p, rmhist!p)\n         \\<longrightarrow> (S2 rmhist p)$\"\n  by (force simp: ENext_def ACall_def c_def r_def m_def\n    caller_def rtrner_def MVNROKBA_def S_def S1_def S2_def Calling_def)\n\nlemma S1ClerkUnch: \"\\<turnstile> [MClkNext memCh crCh cst p]_(c p) \\<and> $(S1 rmhist p) \\<longrightarrow> unchanged (c p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] dest!: MClkidle [temp_use] simp: S_def S1_def)\n\nlemma S1RPCUnch: \"\\<turnstile> [RPCNext crCh rmCh rst p]_(r p) \\<and> $(S1 rmhist p) \\<longrightarrow> unchanged (r p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] dest!: RPCidle [temp_use] simp: S_def S1_def)\n\nlemma S1MemUnch: \"\\<turnstile> [RNext rmCh mm ires p]_(m p) \\<and> $(S1 rmhist p) \\<longrightarrow> unchanged (m p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] dest!: Memoryidle [temp_use] simp: S_def S1_def)\n\nlemma S1Hist: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p,rmhist!p) \\<and> $(S1 rmhist p)\n         \\<longrightarrow> unchanged (rmhist!p)\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm HNext_def}, @{thm S_def},\n    @{thm S1_def}, @{thm MemReturn_def}, @{thm RPCFail_def}, @{thm MClkReply_def},\n    @{thm AReturn_def}]) [] [temp_use \\<^context> @{thm squareE}] 1\\<close>)\n\n\n(* ------------------------------ State S2 ---------------------------------------- *)\n\nlemma S2EnvUnch: \"\\<turnstile> [ENext p]_(e p) \\<and> $(S2 rmhist p) \\<longrightarrow> unchanged (e p)\"\n  by (auto dest!: Envbusy [temp_use] simp: S_def S2_def)\n\nlemma S2Clerk: \"\\<turnstile> MClkNext memCh crCh cst p \\<and> $(S2 rmhist p) \\<longrightarrow> MClkFwd memCh crCh cst p\"\n  by (auto simp: MClkNext_def MClkRetry_def MClkReply_def S_def S2_def)\n\nlemma S2Forward: \"\\<turnstile> $(S2 rmhist p) \\<and> MClkFwd memCh crCh cst p\n         \\<and> unchanged (e p, r p, m p, rmhist!p)\n         \\<longrightarrow> (S3 rmhist p)$\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm MClkFwd_def},\n    @{thm ACall_def}, @{thm e_def}, @{thm r_def}, @{thm m_def}, @{thm caller_def},\n    @{thm rtrner_def}, @{thm S_def}, @{thm S2_def}, @{thm S3_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S2RPCUnch: \"\\<turnstile> [RPCNext crCh rmCh rst p]_(r p) \\<and> $(S2 rmhist p) \\<longrightarrow> unchanged (r p)\"\n  by (auto simp: S_def S2_def dest!: RPCidle [temp_use])\n\nlemma S2MemUnch: \"\\<turnstile> [RNext rmCh mm ires p]_(m p) \\<and> $(S2 rmhist p) \\<longrightarrow> unchanged (m p)\"\n  by (auto simp: S_def S2_def dest!: Memoryidle [temp_use])\n\nlemma S2Hist: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p,rmhist!p) \\<and> $(S2 rmhist p)\n         \\<longrightarrow> unchanged (rmhist!p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] simp: HNext_def MemReturn_def RPCFail_def\n    MClkReply_def AReturn_def S_def S2_def)\n\n(* ------------------------------ State S3 ---------------------------------------- *)\n\nlemma S3EnvUnch: \"\\<turnstile> [ENext p]_(e p) \\<and> $(S3 rmhist p) \\<longrightarrow> unchanged (e p)\"\n  by (auto dest!: Envbusy [temp_use] simp: S_def S3_def)\n\nlemma S3ClerkUnch: \"\\<turnstile> [MClkNext memCh crCh cst p]_(c p) \\<and> $(S3 rmhist p) \\<longrightarrow> unchanged (c p)\"\n  by (auto dest!: MClkbusy [temp_use] simp: square_def S_def S3_def)\n\nlemma S3LegalRcvArg: \"\\<turnstile> S3 rmhist p \\<longrightarrow> IsLegalRcvArg<arg<crCh!p>>\"\n  by (auto simp: IsLegalRcvArg_def MClkRelayArg_def S_def S3_def)\n\nlemma S3RPC: \"\\<turnstile> RPCNext crCh rmCh rst p \\<and> $(S3 rmhist p)\n         \\<longrightarrow> RPCFwd crCh rmCh rst p \\<or> RPCFail crCh rmCh rst p\"\n  apply clarsimp\n  apply (frule S3LegalRcvArg [action_use])\n  apply (auto simp: RPCNext_def RPCReject_def RPCReply_def S_def S3_def)\n  done\n\nlemma S3Forward: \"\\<turnstile> RPCFwd crCh rmCh rst p \\<and> HNext rmhist p \\<and> $(S3 rmhist p)\n         \\<and> unchanged (e p, c p, m p)\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm RPCFwd_def},\n    @{thm HNext_def}, @{thm MemReturn_def}, @{thm RPCFail_def},\n    @{thm MClkReply_def}, @{thm AReturn_def}, @{thm ACall_def}, @{thm e_def},\n    @{thm c_def}, @{thm m_def}, @{thm caller_def}, @{thm rtrner_def}, @{thm S_def},\n    @{thm S3_def}, @{thm S4_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S3Fail: \"\\<turnstile> RPCFail crCh rmCh rst p \\<and> $(S3 rmhist p) \\<and> HNext rmhist p\n         \\<and> unchanged (e p, c p, m p)\n         \\<longrightarrow> (S6 rmhist p)$\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm HNext_def},\n    @{thm RPCFail_def}, @{thm AReturn_def}, @{thm e_def}, @{thm c_def},\n    @{thm m_def}, @{thm caller_def}, @{thm rtrner_def}, @{thm MVOKBARF_def},\n    @{thm S_def}, @{thm S3_def}, @{thm S6_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S3MemUnch: \"\\<turnstile> [RNext rmCh mm ires p]_(m p) \\<and> $(S3 rmhist p) \\<longrightarrow> unchanged (m p)\"\n  by (auto simp: S_def S3_def dest!: Memoryidle [temp_use])\n\nlemma S3Hist: \"\\<turnstile> HNext rmhist p \\<and> $(S3 rmhist p) \\<and> unchanged (r p) \\<longrightarrow> unchanged (rmhist!p)\"\n  by (auto simp: HNext_def MemReturn_def RPCFail_def MClkReply_def\n    AReturn_def r_def rtrner_def S_def S3_def Calling_def)\n\n(* ------------------------------ State S4 ---------------------------------------- *)\n\nlemma S4EnvUnch: \"\\<turnstile> [ENext p]_(e p) \\<and> $(S4 rmhist p) \\<longrightarrow> unchanged (e p)\"\n  by (auto simp: S_def S4_def dest!: Envbusy [temp_use])\n\nlemma S4ClerkUnch: \"\\<turnstile> [MClkNext memCh crCh cst p]_(c p) \\<and> $(S4 rmhist p) \\<longrightarrow> unchanged (c p)\"\n  by (auto simp: S_def S4_def dest!: MClkbusy [temp_use])\n\nlemma S4RPCUnch: \"\\<turnstile> [RPCNext crCh rmCh rst p]_(r p) \\<and> $(S4 rmhist p) \\<longrightarrow> unchanged (r p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] dest!: RPCbusy [temp_use] simp: S_def S4_def)\n\nlemma S4ReadInner: \"\\<turnstile> ReadInner rmCh mm ires p l \\<and> $(S4 rmhist p) \\<and> unchanged (e p, c p, r p)\n         \\<and> HNext rmhist p \\<and> $(MemInv mm l)\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm ReadInner_def},\n    @{thm GoodRead_def}, @{thm BadRead_def}, @{thm HNext_def}, @{thm MemReturn_def},\n    @{thm RPCFail_def}, @{thm MClkReply_def}, @{thm AReturn_def}, @{thm e_def},\n    @{thm c_def}, @{thm r_def}, @{thm rtrner_def}, @{thm caller_def},\n    @{thm MVNROKBA_def}, @{thm S_def}, @{thm S4_def}, @{thm RdRequest_def},\n    @{thm Calling_def}, @{thm MemInv_def}]) [] [] 1\\<close>)\n\nlemma S4Read: \"\\<turnstile> Read rmCh mm ires p \\<and> $(S4 rmhist p) \\<and> unchanged (e p, c p, r p)\n         \\<and> HNext rmhist p \\<and> (\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (auto simp: Read_def dest!: S4ReadInner [temp_use])\n\nlemma S4WriteInner: \"\\<turnstile> WriteInner rmCh mm ires p l v \\<and> $(S4 rmhist p) \\<and> unchanged (e p, c p, r p) \\<and> HNext rmhist p\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm WriteInner_def},\n    @{thm GoodWrite_def}, @{thm BadWrite_def}, @{thm HNext_def}, @{thm MemReturn_def},\n    @{thm RPCFail_def}, @{thm MClkReply_def}, @{thm AReturn_def}, @{thm e_def},\n    @{thm c_def}, @{thm r_def}, @{thm rtrner_def}, @{thm caller_def}, @{thm MVNROKBA_def},\n    @{thm S_def}, @{thm S4_def}, @{thm WrRequest_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S4Write: \"\\<turnstile> Write rmCh mm ires p l \\<and> $(S4 rmhist p) \\<and> unchanged (e p, c p, r p)\n         \\<and> (HNext rmhist p)\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (auto simp: Write_def dest!: S4WriteInner [temp_use])\n\nlemma WriteS4: \"\\<turnstile> $ImpInv rmhist p \\<and> Write rmCh mm ires p l \\<longrightarrow> $S4 rmhist p\"\n  by (auto simp: Write_def WriteInner_def ImpInv_def\n    WrRequest_def S_def S1_def S2_def S3_def S4_def S5_def S6_def)\n\nlemma S4Return: \"\\<turnstile> MemReturn rmCh ires p \\<and> $S4 rmhist p \\<and> unchanged (e p, c p, r p)\n         \\<and> HNext rmhist p\n         \\<longrightarrow> (S5 rmhist p)$\"\n  by (auto simp: HNext_def MemReturn_def AReturn_def e_def c_def r_def\n    rtrner_def caller_def MVNROKBA_def MVOKBA_def S_def S4_def S5_def Calling_def)\n\nlemma S4Hist: \"\\<turnstile> HNext rmhist p \\<and> $S4 rmhist p \\<and> (m p)$ = $(m p) \\<longrightarrow> (rmhist!p)$ = $(rmhist!p)\"\n  by (auto simp: HNext_def MemReturn_def RPCFail_def MClkReply_def\n    AReturn_def m_def rtrner_def S_def S4_def Calling_def)\n\n(* ------------------------------ State S5 ---------------------------------------- *)\n\nlemma S5EnvUnch: \"\\<turnstile> [ENext p]_(e p) \\<and> $(S5 rmhist p) \\<longrightarrow> unchanged (e p)\"\n  by (auto simp: S_def S5_def dest!: Envbusy [temp_use])\n\nlemma S5ClerkUnch: \"\\<turnstile> [MClkNext memCh crCh cst p]_(c p) \\<and> $(S5 rmhist p) \\<longrightarrow> unchanged (c p)\"\n  by (auto simp: S_def S5_def dest!: MClkbusy [temp_use])\n\nlemma S5RPC: \"\\<turnstile> RPCNext crCh rmCh rst p \\<and> $(S5 rmhist p)\n         \\<longrightarrow> RPCReply crCh rmCh rst p \\<or> RPCFail crCh rmCh rst p\"\n  by (auto simp: RPCNext_def RPCReject_def RPCFwd_def S_def S5_def)\n\nlemma S5Reply: \"\\<turnstile> RPCReply crCh rmCh rst p \\<and> $(S5 rmhist p) \\<and> unchanged (e p, c p, m p,rmhist!p)\n       \\<longrightarrow> (S6 rmhist p)$\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm RPCReply_def},\n    @{thm AReturn_def}, @{thm e_def}, @{thm c_def}, @{thm m_def}, @{thm MVOKBA_def},\n    @{thm MVOKBARF_def}, @{thm caller_def}, @{thm rtrner_def}, @{thm S_def},\n    @{thm S5_def}, @{thm S6_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S5Fail: \"\\<turnstile> RPCFail crCh rmCh rst p \\<and> $(S5 rmhist p) \\<and> unchanged (e p, c p, m p,rmhist!p)\n         \\<longrightarrow> (S6 rmhist p)$\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm RPCFail_def},\n    @{thm AReturn_def}, @{thm e_def}, @{thm c_def}, @{thm m_def},\n    @{thm MVOKBARF_def}, @{thm caller_def}, @{thm rtrner_def},\n    @{thm S_def}, @{thm S5_def}, @{thm S6_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S5MemUnch: \"\\<turnstile> [RNext rmCh mm ires p]_(m p) \\<and> $(S5 rmhist p) \\<longrightarrow> unchanged (m p)\"\n  by (auto simp: S_def S5_def dest!: Memoryidle [temp_use])\n\nlemma S5Hist: \"\\<turnstile> [HNext rmhist p]_(c p, r p, m p, rmhist!p) \\<and> $(S5 rmhist p)\n         \\<longrightarrow> (rmhist!p)$ = $(rmhist!p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] simp: HNext_def MemReturn_def RPCFail_def\n    MClkReply_def AReturn_def S_def S5_def)\n\n(* ------------------------------ State S6 ---------------------------------------- *)\n\nlemma S6EnvUnch: \"\\<turnstile> [ENext p]_(e p) \\<and> $(S6 rmhist p) \\<longrightarrow> unchanged (e p)\"\n  by (auto simp: S_def S6_def dest!: Envbusy [temp_use])\n\nlemma S6Clerk: \"\\<turnstile> MClkNext memCh crCh cst p \\<and> $(S6 rmhist p)\n         \\<longrightarrow> MClkRetry memCh crCh cst p \\<or> MClkReply memCh crCh cst p\"\n  by (auto simp: MClkNext_def MClkFwd_def S_def S6_def)\n\nlemma S6Retry: \"\\<turnstile> MClkRetry memCh crCh cst p \\<and> HNext rmhist p \\<and> $S6 rmhist p\n         \\<and> unchanged (e p,r p,m p)\n         \\<longrightarrow> (S3 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm HNext_def},\n    @{thm MClkReply_def}, @{thm MClkRetry_def}, @{thm ACall_def}, @{thm AReturn_def},\n    @{thm e_def}, @{thm r_def}, @{thm m_def}, @{thm caller_def}, @{thm rtrner_def},\n    @{thm S_def}, @{thm S6_def}, @{thm S3_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S6Reply: \"\\<turnstile> MClkReply memCh crCh cst p \\<and> HNext rmhist p \\<and> $S6 rmhist p\n         \\<and> unchanged (e p,r p,m p)\n         \\<longrightarrow> (S1 rmhist p)$\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm HNext_def},\n    @{thm MemReturn_def}, @{thm RPCFail_def}, @{thm AReturn_def}, @{thm MClkReply_def},\n    @{thm e_def}, @{thm r_def}, @{thm m_def}, @{thm caller_def}, @{thm rtrner_def},\n    @{thm S_def}, @{thm S6_def}, @{thm S1_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S6RPCUnch: \"\\<turnstile> [RPCNext crCh rmCh rst p]_(r p) \\<and> $S6 rmhist p \\<longrightarrow> unchanged (r p)\"\n  by (auto simp: S_def S6_def dest!: RPCidle [temp_use])\n\nlemma S6MemUnch: \"\\<turnstile> [RNext rmCh mm ires p]_(m p) \\<and> $(S6 rmhist p) \\<longrightarrow> unchanged (m p)\"\n  by (auto simp: S_def S6_def dest!: Memoryidle [temp_use])\n\nlemma S6Hist: \"\\<turnstile> HNext rmhist p \\<and> $S6 rmhist p \\<and> (c p)$ = $(c p) \\<longrightarrow> (rmhist!p)$ = $(rmhist!p)\"\n  by (auto simp: HNext_def MClkReply_def AReturn_def c_def rtrner_def S_def S6_def Calling_def)\n\n\nsection \"Correctness of predicate-action diagram\"\n\n\n(* ========== Step 1.1 ================================================= *)\n(* The implementation's initial condition implies the state predicate S1 *)\n\nlemma Step1_1: \"\\<turnstile> ImpInit p \\<and> HInit rmhist p \\<longrightarrow> S1 rmhist p\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] simp: MVNROKBA_def\n    MClkInit_def RPCInit_def PInit_def HInit_def ImpInit_def S_def S1_def)\n\n(* ========== Step 1.2 ================================================== *)\n(* Figure 16 is a predicate-action diagram for the implementation. *)\n\nlemma Step1_2_1: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n         \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p)  \\<and> $S1 rmhist p\n         \\<longrightarrow> (S2 rmhist p)$ \\<and> ENext p \\<and> unchanged (c p, r p, m p)\"\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm ImpNext_def}]) []\n      (map (temp_elim \\<^context>)\n        [@{thm S1ClerkUnch}, @{thm S1RPCUnch}, @{thm S1MemUnch}, @{thm S1Hist}]) 1\\<close>)\n   using [[fast_solver]]\n   apply (auto elim!: squareE [temp_use] intro!: S1Env [temp_use])\n  done\n\nlemma Step1_2_2: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n         \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p) \\<and> $S2 rmhist p\n         \\<longrightarrow> (S3 rmhist p)$ \\<and> MClkFwd memCh crCh cst p\n             \\<and> unchanged (e p, r p, m p, rmhist!p)\"\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm ImpNext_def}]) []\n    (map (temp_elim \\<^context>)\n      [@{thm S2EnvUnch}, @{thm S2RPCUnch}, @{thm S2MemUnch}, @{thm S2Hist}]) 1\\<close>)\n   using [[fast_solver]]\n   apply (auto elim!: squareE [temp_use] intro!: S2Clerk [temp_use] S2Forward [temp_use])\n  done\n\nlemma Step1_2_3: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n         \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p) \\<and> $S3 rmhist p\n         \\<longrightarrow> ((S4 rmhist p)$ \\<and> RPCFwd crCh rmCh rst p \\<and> unchanged (e p, c p, m p, rmhist!p))\n             \\<or> ((S6 rmhist p)$ \\<and> RPCFail crCh rmCh rst p \\<and> unchanged (e p, c p, m p))\"\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm ImpNext_def}]) []\n    (map (temp_elim \\<^context>) [@{thm S3EnvUnch}, @{thm S3ClerkUnch}, @{thm S3MemUnch}]) 1\\<close>)\n  apply (tactic \\<open>action_simp_tac \\<^context> []\n    (@{thm squareE} ::\n      map (temp_elim \\<^context>) [@{thm S3RPC}, @{thm S3Forward}, @{thm S3Fail}]) 1\\<close>)\n   apply (auto dest!: S3Hist [temp_use])\n  done\n\nlemma Step1_2_4: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n              \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p)\n              \\<and> $S4 rmhist p \\<and> (\\<forall>l. $(MemInv mm l))\n         \\<longrightarrow> ((S4 rmhist p)$ \\<and> Read rmCh mm ires p \\<and> unchanged (e p, c p, r p, rmhist!p))\n             \\<or> ((S4 rmhist p)$ \\<and> (\\<exists>l. Write rmCh mm ires p l) \\<and> unchanged (e p, c p, r p, rmhist!p))\n             \\<or> ((S5 rmhist p)$ \\<and> MemReturn rmCh ires p \\<and> unchanged (e p, c p, r p))\"\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm ImpNext_def}]) []\n    (map (temp_elim \\<^context>) [@{thm S4EnvUnch}, @{thm S4ClerkUnch}, @{thm S4RPCUnch}]) 1\\<close>)\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm RNext_def}]) []\n    (@{thm squareE} ::\n      map (temp_elim \\<^context>) [@{thm S4Read}, @{thm S4Write}, @{thm S4Return}]) 1\\<close>)\n  apply (auto dest!: S4Hist [temp_use])\n  done\n\nlemma Step1_2_5: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n              \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p) \\<and> $S5 rmhist p\n         \\<longrightarrow> ((S6 rmhist p)$ \\<and> RPCReply crCh rmCh rst p \\<and> unchanged (e p, c p, m p))\n             \\<or> ((S6 rmhist p)$ \\<and> RPCFail crCh rmCh rst p \\<and> unchanged (e p, c p, m p))\"\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm ImpNext_def}]) []\n    (map (temp_elim \\<^context>) [@{thm S5EnvUnch}, @{thm S5ClerkUnch}, @{thm S5MemUnch}, @{thm S5Hist}]) 1\\<close>)\n  apply (tactic \\<open>action_simp_tac \\<^context> [] [@{thm squareE}, temp_elim \\<^context> @{thm S5RPC}] 1\\<close>)\n   using [[fast_solver]]\n   apply (auto elim!: squareE [temp_use] dest!: S5Reply [temp_use] S5Fail [temp_use])\n  done\n\nlemma Step1_2_6: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n              \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p) \\<and> $S6 rmhist p\n         \\<longrightarrow> ((S1 rmhist p)$ \\<and> MClkReply memCh crCh cst p \\<and> unchanged (e p, r p, m p))\n             \\<or> ((S3 rmhist p)$ \\<and> MClkRetry memCh crCh cst p \\<and> unchanged (e p,r p,m p,rmhist!p))\"\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm ImpNext_def}]) []\n    (map (temp_elim \\<^context>) [@{thm S6EnvUnch}, @{thm S6RPCUnch}, @{thm S6MemUnch}]) 1\\<close>)\n  apply (tactic \\<open>action_simp_tac \\<^context> []\n    (@{thm squareE} :: map (temp_elim \\<^context>) [@{thm S6Clerk}, @{thm S6Retry}, @{thm S6Reply}]) 1\\<close>)\n     apply (auto dest: S6Hist [temp_use])\n  done\n\n(* --------------------------------------------------------------------------\n   Step 1.3: S1 implies the barred initial condition.\n*)\n\nsection \"Initialization (Step 1.3)\"\n\nlemma Step1_3: \"\\<turnstile> S1 rmhist p \\<longrightarrow> PInit (resbar rmhist) p\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm resbar_def},\n    @{thm PInit_def}, @{thm S_def}, @{thm S1_def}]) [] [] 1\\<close>)\n\n(* ----------------------------------------------------------------------\n   Step 1.4: Implementation's next-state relation simulates specification's\n             next-state relation (with appropriate substitutions)\n*)\n\nsection \"Step simulation (Step 1.4)\"\n\nlemma Step1_4_1: \"\\<turnstile> ENext p \\<and> $S1 rmhist p \\<and> (S2 rmhist p)$ \\<and> unchanged (c p, r p, m p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] simp: c_def r_def m_def resbar_def)\n\nlemma Step1_4_2: \"\\<turnstile> MClkFwd memCh crCh cst p \\<and> $S2 rmhist p \\<and> (S3 rmhist p)$\n         \\<and> unchanged (e p, r p, m p, rmhist!p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n  by (tactic \\<open>action_simp_tac\n    (\\<^context> addsimps [@{thm MClkFwd_def}, @{thm e_def}, @{thm r_def}, @{thm m_def},\n    @{thm resbar_def}, @{thm S_def}, @{thm S2_def}, @{thm S3_def}]) [] [] 1\\<close>)\n\nlemma Step1_4_3a: \"\\<turnstile> RPCFwd crCh rmCh rst p \\<and> $S3 rmhist p \\<and> (S4 rmhist p)$\n         \\<and> unchanged (e p, c p, m p, rmhist!p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (drule S3_excl [temp_use] S4_excl [temp_use])+\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm e_def},\n    @{thm c_def}, @{thm m_def}, @{thm resbar_def}, @{thm S_def}, @{thm S3_def}]) [] [] 1\\<close>)\n  done\n\nlemma Step1_4_3b: \"\\<turnstile> RPCFail crCh rmCh rst p \\<and> $S3 rmhist p \\<and> (S6 rmhist p)$\n         \\<and> unchanged (e p, c p, m p)\n         \\<longrightarrow> MemFail memCh (resbar rmhist) p\"\n  apply clarsimp\n  apply (drule S6_excl [temp_use])\n  apply (auto simp: RPCFail_def MemFail_def e_def c_def m_def resbar_def)\n    apply (force simp: S3_def S_def)\n   apply (auto simp: AReturn_def)\n  done\n\nlemma Step1_4_4a1: \"\\<turnstile> $S4 rmhist p \\<and> (S4 rmhist p)$ \\<and> ReadInner rmCh mm ires p l\n         \\<and> unchanged (e p, c p, r p, rmhist!p) \\<and> $MemInv mm l\n         \\<longrightarrow> ReadInner memCh mm (resbar rmhist) p l\"\n  apply clarsimp\n  apply (drule S4_excl [temp_use])+\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm ReadInner_def},\n    @{thm GoodRead_def}, @{thm BadRead_def}, @{thm e_def}, @{thm c_def}, @{thm m_def}]) [] [] 1\\<close>)\n     apply (auto simp: resbar_def)\n       apply (tactic \\<open>ALLGOALS (action_simp_tac\n                (\\<^context> addsimps [@{thm RPCRelayArg_def}, @{thm MClkRelayArg_def},\n                  @{thm S_def}, @{thm S4_def}, @{thm RdRequest_def}, @{thm MemInv_def}])\n                [] [@{thm impE}, @{thm MemValNotAResultE}])\\<close>)\n  done\n\nlemma Step1_4_4a: \"\\<turnstile> Read rmCh mm ires p \\<and> $S4 rmhist p \\<and> (S4 rmhist p)$\n         \\<and> unchanged (e p, c p, r p, rmhist!p) \\<and> (\\<forall>l. $(MemInv mm l))\n         \\<longrightarrow> Read memCh mm (resbar rmhist) p\"\n  by (force simp: Read_def elim!: Step1_4_4a1 [temp_use])\n\nlemma Step1_4_4b1: \"\\<turnstile> $S4 rmhist p \\<and> (S4 rmhist p)$ \\<and> WriteInner rmCh mm ires p l v\n         \\<and> unchanged (e p, c p, r p, rmhist!p)\n         \\<longrightarrow> WriteInner memCh mm (resbar rmhist) p l v\"\n  apply clarsimp\n  apply (drule S4_excl [temp_use])+\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps\n    [@{thm WriteInner_def}, @{thm GoodWrite_def}, @{thm BadWrite_def}, @{thm e_def},\n    @{thm c_def}, @{thm m_def}]) [] [] 1\\<close>)\n     apply (auto simp: resbar_def)\n    apply (tactic \\<open>ALLGOALS (action_simp_tac (\\<^context> addsimps\n      [@{thm RPCRelayArg_def}, @{thm MClkRelayArg_def}, @{thm S_def},\n      @{thm S4_def}, @{thm WrRequest_def}]) [] [])\\<close>)\n  done\n\nlemma Step1_4_4b: \"\\<turnstile> Write rmCh mm ires p l \\<and> $S4 rmhist p \\<and> (S4 rmhist p)$\n         \\<and> unchanged (e p, c p, r p, rmhist!p)\n         \\<longrightarrow> Write memCh mm (resbar rmhist) p l\"\n  by (force simp: Write_def elim!: Step1_4_4b1 [temp_use])\n\nlemma Step1_4_4c: \"\\<turnstile> MemReturn rmCh ires p \\<and> $S4 rmhist p \\<and> (S5 rmhist p)$\n         \\<and> unchanged (e p, c p, r p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm e_def},\n    @{thm c_def}, @{thm r_def}, @{thm resbar_def}]) [] [] 1\\<close>)\n  apply (drule S4_excl [temp_use] S5_excl [temp_use])+\n  using [[fast_solver]]\n  apply (auto elim!: squareE [temp_use] simp: MemReturn_def AReturn_def)\n  done\n\nlemma Step1_4_5a: \"\\<turnstile> RPCReply crCh rmCh rst p \\<and> $S5 rmhist p \\<and> (S6 rmhist p)$\n         \\<and> unchanged (e p, c p, m p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (drule S5_excl [temp_use] S6_excl [temp_use])+\n  apply (auto simp: e_def c_def m_def resbar_def)\n   apply (auto simp: RPCReply_def AReturn_def S5_def S_def dest!: MVOKBAnotRF [temp_use])\n  done\n\nlemma Step1_4_5b: \"\\<turnstile> RPCFail crCh rmCh rst p \\<and> $S5 rmhist p \\<and> (S6 rmhist p)$\n         \\<and> unchanged (e p, c p, m p)\n         \\<longrightarrow> MemFail memCh (resbar rmhist) p\"\n  apply clarsimp\n  apply (drule S6_excl [temp_use])\n  apply (auto simp: e_def c_def m_def RPCFail_def AReturn_def MemFail_def resbar_def)\n   apply (auto simp: S5_def S_def)\n  done\n\nlemma Step1_4_6a: \"\\<turnstile> MClkReply memCh crCh cst p \\<and> $S6 rmhist p \\<and> (S1 rmhist p)$\n         \\<and> unchanged (e p, r p, m p)\n         \\<longrightarrow> MemReturn memCh (resbar rmhist) p\"\n  apply clarsimp\n  apply (drule S6_excl [temp_use])+\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm e_def},\n    @{thm r_def}, @{thm m_def}, @{thm MClkReply_def}, @{thm MemReturn_def},\n    @{thm AReturn_def}, @{thm resbar_def}]) [] [] 1\\<close>)\n    apply simp_all (* simplify if-then-else *)\n    apply (tactic \\<open>ALLGOALS (action_simp_tac (\\<^context> addsimps\n      [@{thm MClkReplyVal_def}, @{thm S6_def}, @{thm S_def}]) [] [@{thm MVOKBARFnotNR}])\\<close>)\n  done\n\nlemma Step1_4_6b: \"\\<turnstile> MClkRetry memCh crCh cst p \\<and> $S6 rmhist p \\<and> (S3 rmhist p)$\n         \\<and> unchanged (e p, r p, m p, rmhist!p)\n         \\<longrightarrow> MemFail memCh (resbar rmhist) p\"\n  apply clarsimp\n  apply (drule S3_excl [temp_use])+\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm e_def}, @{thm r_def},\n    @{thm m_def}, @{thm MClkRetry_def}, @{thm MemFail_def}, @{thm resbar_def}]) [] [] 1\\<close>)\n   apply (auto simp: S6_def S_def)\n  done\n\nlemma S_lemma: \"\\<turnstile> unchanged (e p, c p, r p, m p, rmhist!p)\n         \\<longrightarrow> unchanged (S rmhist ec cc rc cs rs hs1 hs2 p)\"\n  by (auto simp: e_def c_def r_def m_def caller_def rtrner_def S_def Calling_def)\n\nlemma Step1_4_7H: \"\\<turnstile> unchanged (e p, c p, r p, m p, rmhist!p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, S1 rmhist p, S2 rmhist p, S3 rmhist p,\n                        S4 rmhist p, S5 rmhist p, S6 rmhist p)\"\n  apply clarsimp\n  apply (rule conjI)\n   apply (force simp: c_def)\n  apply (force simp: S1_def S2_def S3_def S4_def S5_def S6_def intro!: S_lemma [temp_use])\n  done\n\nlemma Step1_4_7: \"\\<turnstile> unchanged (e p, c p, r p, m p, rmhist!p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p, S1 rmhist p, S2 rmhist p,\n                        S3 rmhist p, S4 rmhist p, S5 rmhist p, S6 rmhist p)\"\n  apply (rule actionI)\n  apply (unfold action_rews)\n  apply (rule impI)\n  apply (frule Step1_4_7H [temp_use])\n  apply (auto simp: e_def c_def r_def m_def rtrner_def resbar_def)\n  done\n\n(* Frequently needed abbreviation: distinguish between idling and non-idling\n   steps of the implementation, and try to solve the idling case by simplification\n*)\nML \\<open>\nfun split_idle_tac ctxt =\n  SELECT_GOAL\n   (TRY (resolve_tac ctxt @{thms actionI} 1) THEN\n    Induct_Tacs.case_tac ctxt \"(s,t) \\<Turnstile> unchanged (e p, c p, r p, m p, rmhist!p)\" [] NONE 1 THEN\n    rewrite_goals_tac ctxt @{thms action_rews} THEN\n    forward_tac ctxt [temp_use ctxt @{thm Step1_4_7}] 1 THEN\n    asm_full_simp_tac ctxt 1);\n\\<close>\n\nmethod_setup split_idle = \\<open>\n  Method.sections (Simplifier.simp_modifiers @ Splitter.split_modifiers)\n    >> (K (SIMPLE_METHOD' o split_idle_tac))\n\\<close>\n\n(* ----------------------------------------------------------------------\n   Combine steps 1.2 and 1.4 to prove that the implementation satisfies\n   the specification's next-state relation.\n*)\n\n(* Steps that leave all variables unchanged are safe, so I may assume\n   that some variable changes in the proof that a step is safe. *)\nlemma unchanged_safe: \"\\<turnstile> (\\<not>unchanged (e p, c p, r p, m p, rmhist!p)\n             \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p))\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply (split_idle simp: square_def)\n  apply force\n  done\n(* turn into (unsafe, looping!) introduction rule *)\nlemmas unchanged_safeI = impI [THEN unchanged_safe [action_use]]\n\nlemma S1safe: \"\\<turnstile> $S1 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (rule idle_squareI)\n  apply (auto dest!: Step1_2_1 [temp_use] Step1_4_1 [temp_use])\n  done\n\nlemma S2safe: \"\\<turnstile> $S2 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (rule idle_squareI)\n  apply (auto dest!: Step1_2_2 [temp_use] Step1_4_2 [temp_use])\n  done\n\nlemma S3safe: \"\\<turnstile> $S3 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (auto dest!: Step1_2_3 [temp_use])\n  apply (auto simp: square_def UNext_def dest!: Step1_4_3a [temp_use] Step1_4_3b [temp_use])\n  done\n\nlemma S4safe: \"\\<turnstile> $S4 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<and> (\\<forall>l. $(MemInv mm l))\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (auto dest!: Step1_2_4 [temp_use])\n     apply (auto simp: square_def UNext_def RNext_def\n       dest!: Step1_4_4a [temp_use] Step1_4_4b [temp_use] Step1_4_4c [temp_use])\n  done\n\nlemma S5safe: \"\\<turnstile> $S5 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (auto dest!: Step1_2_5 [temp_use])\n  apply (auto simp: square_def UNext_def dest!: Step1_4_5a [temp_use] Step1_4_5b [temp_use])\n  done\n\nlemma S6safe: \"\\<turnstile> $S6 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (auto dest!: Step1_2_6 [temp_use])\n    apply (auto simp: square_def UNext_def RNext_def\n      dest!: Step1_4_6a [temp_use] Step1_4_6b [temp_use])\n  done\n\n(* ----------------------------------------------------------------------\n   Step 1.5: Temporal refinement proof, based on previous steps.\n*)\n\nsection \"The liveness part\"\n\n(* Liveness assertions for the different implementation states, based on the\n   fairness conditions. Prove subgoals of WF1 / SF1 rules as separate lemmas\n   for readability. Reuse action proofs from safety part.\n*)\n\n(* ------------------------------ State S1 ------------------------------ *)\n\nlemma S1_successors: \"\\<turnstile> $S1 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> (S1 rmhist p)$ \\<or> (S2 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_1 [temp_use])\n  done\n\n(* Show that the implementation can satisfy the high-level fairness requirements\n   by entering the state S1 infinitely often.\n*)\n\nlemma S1_RNextdisabled: \"\\<turnstile> S1 rmhist p \\<longrightarrow>\n         \\<not>Enabled (<RNext memCh mm (resbar rmhist) p>_(rtrner memCh!p, resbar rmhist!p))\"\n  apply (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm angle_def},\n    @{thm S_def}, @{thm S1_def}]) [notI] [@{thm enabledE}, temp_elim \\<^context> @{thm Memoryidle}] 1\\<close>)\n  apply force\n  done\n\nlemma S1_Returndisabled: \"\\<turnstile> S1 rmhist p \\<longrightarrow>\n         \\<not>Enabled (<MemReturn memCh (resbar rmhist) p>_(rtrner memCh!p, resbar rmhist!p))\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm angle_def}, @{thm MemReturn_def},\n    @{thm AReturn_def}, @{thm S_def}, @{thm S1_def}]) [notI] [@{thm enabledE}] 1\\<close>)\n\nlemma RNext_fair: \"\\<turnstile> \\<box>\\<diamond>S1 rmhist p\n         \\<longrightarrow> WF(RNext memCh mm (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n  by (auto simp: WF_alt [try_rewrite] intro!: S1_RNextdisabled [temp_use]\n    elim!: STL4E [temp_use] DmdImplE [temp_use])\n\nlemma Return_fair: \"\\<turnstile> \\<box>\\<diamond>S1 rmhist p\n         \\<longrightarrow> WF(MemReturn memCh (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n  by (auto simp: WF_alt [try_rewrite]\n    intro!: S1_Returndisabled [temp_use] elim!: STL4E [temp_use] DmdImplE [temp_use])\n\n(* ------------------------------ State S2 ------------------------------ *)\n\nlemma S2_successors: \"\\<turnstile> $S2 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> (S2 rmhist p)$ \\<or> (S3 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_2 [temp_use])\n  done\n\nlemma S2MClkFwd_successors: \"\\<turnstile> ($S2 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> <MClkFwd memCh crCh cst p>_(c p)\n         \\<longrightarrow> (S3 rmhist p)$\"\n  by (auto simp: angle_def dest!: Step1_2_2 [temp_use])\n\nlemma S2MClkFwd_enabled: \"\\<turnstile> $S2 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> $Enabled (<MClkFwd memCh crCh cst p>_(c p))\"\n  apply (auto simp: c_def intro!: MClkFwd_ch_enabled [temp_use] MClkFwd_enabled [temp_use])\n     apply (cut_tac MI_base)\n     apply (blast dest: base_pair)\n    apply (simp_all add: S_def S2_def)\n  done\n\nlemma S2_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> WF(MClkFwd memCh crCh cst p)_(c p)\n         \\<longrightarrow> (S2 rmhist p \\<leadsto> S3 rmhist p)\"\n  by (rule WF1 S2_successors S2MClkFwd_successors S2MClkFwd_enabled)+\n\n(* ------------------------------ State S3 ------------------------------ *)\n\nlemma S3_successors: \"\\<turnstile> $S3 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> (S3 rmhist p)$ \\<or> (S4 rmhist p \\<or> S6 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_3 [temp_use])\n  done\n\nlemma S3RPC_successors: \"\\<turnstile> ($S3 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> <RPCNext crCh rmCh rst p>_(r p)\n         \\<longrightarrow> (S4 rmhist p \\<or> S6 rmhist p)$\"\n  apply (auto simp: angle_def dest!: Step1_2_3 [temp_use])\n  done\n\nlemma S3RPC_enabled: \"\\<turnstile> $S3 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> $Enabled (<RPCNext crCh rmCh rst p>_(r p))\"\n  apply (auto simp: r_def intro!: RPCFail_Next_enabled [temp_use] RPCFail_enabled [temp_use])\n    apply (cut_tac MI_base)\n    apply (blast dest: base_pair)\n   apply (simp_all add: S_def S3_def)\n  done\n\nlemma S3_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> WF(RPCNext crCh rmCh rst p)_(r p)\n         \\<longrightarrow> (S3 rmhist p \\<leadsto> S4 rmhist p \\<or> S6 rmhist p)\"\n  by (rule WF1 S3_successors S3RPC_successors S3RPC_enabled)+\n\n(* ------------- State S4 -------------------------------------------------- *)\n\nlemma S4_successors: \"\\<turnstile> $S4 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n        \\<and> (\\<forall>l. $MemInv mm l)\n        \\<longrightarrow> (S4 rmhist p)$ \\<or> (S5 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_4 [temp_use])\n  done\n\n(* --------- State S4a: S4 /\\ (ires p = NotAResult) ------------------------ *)\n\nlemma S4a_successors: \"\\<turnstile> $(S4 rmhist p \\<and> ires!p = #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p,rmhist!p) \\<and> (\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> (S4 rmhist p \\<and> ires!p = #NotAResult)$\n             \\<or> ((S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_4 [temp_use])\n  done\n\nlemma S4aRNext_successors: \"\\<turnstile> ($(S4 rmhist p \\<and> ires!p = #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p,rmhist!p) \\<and> (\\<forall>l. $MemInv mm l))\n         \\<and> <RNext rmCh mm ires p>_(m p)\n         \\<longrightarrow> ((S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p)$\"\n  by (auto simp: angle_def\n    dest!: Step1_2_4 [temp_use] ReadResult [temp_use] WriteResult [temp_use])\n\nlemma S4aRNext_enabled: \"\\<turnstile> $(S4 rmhist p \\<and> ires!p = #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> (\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> $Enabled (<RNext rmCh mm ires p>_(m p))\"\n  apply (auto simp: m_def intro!: RNext_enabled [temp_use])\n   apply (cut_tac MI_base)\n   apply (blast dest: base_pair)\n  apply (simp add: S_def S4_def)\n  done\n\nlemma S4a_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<and> (\\<forall>l. $MemInv mm l)) \\<and> WF(RNext rmCh mm ires p)_(m p)\n         \\<longrightarrow> (S4 rmhist p \\<and> ires!p = #NotAResult\n              \\<leadsto> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p)\"\n  by (rule WF1 S4a_successors S4aRNext_successors S4aRNext_enabled)+\n\n(* ---------- State S4b: S4 /\\ (ires p # NotAResult) --------------------------- *)\n\nlemma S4b_successors: \"\\<turnstile> $(S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> (\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult)$ \\<or> (S5 rmhist p)$\"\n  apply (split_idle simp: m_def)\n  apply (auto dest!: WriteResult [temp_use] Step1_2_4 [temp_use] ReadResult [temp_use])\n  done\n\nlemma S4bReturn_successors: \"\\<turnstile> ($(S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<and> (\\<forall>l. $MemInv mm l)) \\<and> <MemReturn rmCh ires p>_(m p)\n         \\<longrightarrow> (S5 rmhist p)$\"\n  by (force simp: angle_def dest!: Step1_2_4 [temp_use] dest: ReturnNotReadWrite [temp_use])\n\nlemma S4bReturn_enabled: \"\\<turnstile> $(S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<and> (\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> $Enabled (<MemReturn rmCh ires p>_(m p))\"\n  apply (auto simp: m_def intro!: MemReturn_enabled [temp_use])\n   apply (cut_tac MI_base)\n   apply (blast dest: base_pair)\n  apply (simp add: S_def S4_def)\n  done\n\nlemma S4b_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> (\\<forall>l. $MemInv mm l))\n         \\<and> WF(MemReturn rmCh ires p)_(m p)\n         \\<longrightarrow> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p)\"\n  by (rule WF1 S4b_successors S4bReturn_successors S4bReturn_enabled)+\n\n(* ------------------------------ State S5 ------------------------------ *)\n\nlemma S5_successors: \"\\<turnstile> $S5 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> (S5 rmhist p)$ \\<or> (S6 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_5 [temp_use])\n  done\n\nlemma S5RPC_successors: \"\\<turnstile> ($S5 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> <RPCNext crCh rmCh rst p>_(r p)\n         \\<longrightarrow> (S6 rmhist p)$\"\n  by (auto simp: angle_def dest!: Step1_2_5 [temp_use])\n\nlemma S5RPC_enabled: \"\\<turnstile> $S5 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> $Enabled (<RPCNext crCh rmCh rst p>_(r p))\"\n  apply (auto simp: r_def intro!: RPCFail_Next_enabled [temp_use] RPCFail_enabled [temp_use])\n    apply (cut_tac MI_base)\n    apply (blast dest: base_pair)\n   apply (simp_all add: S_def S5_def)\n  done\n\nlemma S5_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> WF(RPCNext crCh rmCh rst p)_(r p)\n         \\<longrightarrow> (S5 rmhist p \\<leadsto> S6 rmhist p)\"\n  by (rule WF1 S5_successors S5RPC_successors S5RPC_enabled)+\n\n(* ------------------------------ State S6 ------------------------------ *)\n\nlemma S6_successors: \"\\<turnstile> $S6 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> (S1 rmhist p)$ \\<or> (S3 rmhist p)$ \\<or> (S6 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_6 [temp_use])\n  done\n\nlemma S6MClkReply_successors:\n  \"\\<turnstile> ($S6 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> <MClkReply memCh crCh cst p>_(c p)\n         \\<longrightarrow> (S1 rmhist p)$\"\n  by (auto simp: angle_def dest!: Step1_2_6 [temp_use] MClkReplyNotRetry [temp_use])\n\nlemma MClkReplyS6:\n  \"\\<turnstile> $ImpInv rmhist p \\<and> <MClkReply memCh crCh cst p>_(c p) \\<longrightarrow> $S6 rmhist p\"\n  by (tactic \\<open>action_simp_tac (\\<^context> addsimps [@{thm angle_def},\n    @{thm MClkReply_def}, @{thm AReturn_def}, @{thm ImpInv_def}, @{thm S_def},\n    @{thm S1_def}, @{thm S2_def}, @{thm S3_def}, @{thm S4_def}, @{thm S5_def}]) [] [] 1\\<close>)\n\nlemma S6MClkReply_enabled: \"\\<turnstile> S6 rmhist p \\<longrightarrow> Enabled (<MClkReply memCh crCh cst p>_(c p))\"\n  apply (auto simp: c_def intro!: MClkReply_enabled [temp_use])\n     apply (cut_tac MI_base)\n     apply (blast dest: base_pair)\n    apply (tactic \\<open>ALLGOALS (action_simp_tac (\\<^context>\n      addsimps [@{thm S_def}, @{thm S6_def}]) [] [])\\<close>)\n  done\n\nlemma S6_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> $(ImpInv rmhist p))\n         \\<and> SF(MClkReply memCh crCh cst p)_(c p) \\<and> \\<box>\\<diamond>(S6 rmhist p)\n         \\<longrightarrow> \\<box>\\<diamond>(S1 rmhist p)\"\n  apply clarsimp\n  apply (subgoal_tac \"sigma \\<Turnstile> \\<box>\\<diamond> (<MClkReply memCh crCh cst p>_ (c p))\")\n   apply (erule InfiniteEnsures)\n    apply assumption\n   apply (tactic \\<open>action_simp_tac \\<^context> []\n     (map (temp_elim \\<^context>) [@{thm MClkReplyS6}, @{thm S6MClkReply_successors}]) 1\\<close>)\n  apply (auto simp: SF_def)\n  apply (erule contrapos_np)\n  apply (auto intro!: S6MClkReply_enabled [temp_use] elim!: STL4E [temp_use] DmdImplE [temp_use])\n  done\n\n(* --------------- aggregate leadsto properties----------------------------- *)\n\nlemma S5S6LeadstoS6: \"sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p\n      \\<Longrightarrow> sigma \\<Turnstile> (S5 rmhist p \\<or> S6 rmhist p) \\<leadsto> S6 rmhist p\"\n  by (auto intro!: LatticeDisjunctionIntro [temp_use] LatticeReflexivity [temp_use])\n\nlemma S4bS5S6LeadstoS6: \"\\<lbrakk> sigma \\<Turnstile> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p;\n         sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p \\<or> S6 rmhist p\n                    \\<leadsto> S6 rmhist p\"\n  by (auto intro!: LatticeDisjunctionIntro [temp_use]\n    S5S6LeadstoS6 [temp_use] intro: LatticeTransitivity [temp_use])\n\nlemma S4S5S6LeadstoS6: \"\\<lbrakk> sigma \\<Turnstile> S4 rmhist p \\<and> ires!p = #NotAResult\n                  \\<leadsto> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p;\n         sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> S4 rmhist p \\<or> S5 rmhist p \\<or> S6 rmhist p \\<leadsto> S6 rmhist p\"\n  apply (subgoal_tac \"sigma \\<Turnstile> (S4 rmhist p \\<and> ires!p = #NotAResult) \\<or>\n    (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p \\<or> S6 rmhist p \\<leadsto> S6 rmhist p\")\n   apply (erule_tac G = \"PRED ((S4 rmhist p \\<and> ires!p = #NotAResult) \\<or>\n     (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p \\<or> S6 rmhist p)\" in\n     LatticeTransitivity [temp_use])\n   apply (force simp: Init_defs intro!: ImplLeadsto_gen [temp_use] necT [temp_use])\n  apply (rule LatticeDisjunctionIntro [temp_use])\n   apply (erule LatticeTransitivity [temp_use])\n   apply (erule LatticeTriangle2 [temp_use])\n   apply assumption\n  apply (auto intro!: S4bS5S6LeadstoS6 [temp_use])\n  done\n\nlemma S3S4S5S6LeadstoS6: \"\\<lbrakk> sigma \\<Turnstile> S3 rmhist p \\<leadsto> S4 rmhist p \\<or> S6 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p = #NotAResult\n                  \\<leadsto> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p;\n         sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> S3 rmhist p \\<or> S4 rmhist p \\<or> S5 rmhist p \\<or> S6 rmhist p \\<leadsto> S6 rmhist p\"\n  apply (rule LatticeDisjunctionIntro [temp_use])\n   apply (erule LatticeTriangle2 [temp_use])\n   apply (rule S4S5S6LeadstoS6 [THEN LatticeTransitivity [temp_use]])\n      apply (auto intro!: S4S5S6LeadstoS6 [temp_use] necT [temp_use]\n        intro: ImplLeadsto_gen [temp_use] simp: Init_defs)\n  done\n\nlemma S2S3S4S5S6LeadstoS6: \"\\<lbrakk> sigma \\<Turnstile> S2 rmhist p \\<leadsto> S3 rmhist p;\n         sigma \\<Turnstile> S3 rmhist p \\<leadsto> S4 rmhist p \\<or> S6 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p = #NotAResult\n                  \\<leadsto> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<or> S5 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p;\n         sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> S2 rmhist p \\<or> S3 rmhist p \\<or> S4 rmhist p \\<or> S5 rmhist p \\<or> S6 rmhist p\n                   \\<leadsto> S6 rmhist p\"\n  apply (rule LatticeDisjunctionIntro [temp_use])\n   apply (rule LatticeTransitivity [temp_use])\n    prefer 2 apply assumption\n   apply (rule S3S4S5S6LeadstoS6 [THEN LatticeTransitivity [temp_use]])\n       apply (auto intro!: S3S4S5S6LeadstoS6 [temp_use] necT [temp_use]\n         intro: ImplLeadsto_gen [temp_use] simp: Init_defs)\n  done\n\nlemma NotS1LeadstoS6: \"\\<lbrakk> sigma \\<Turnstile> \\<box>ImpInv rmhist p;\n         sigma \\<Turnstile> S2 rmhist p \\<leadsto> S3 rmhist p;\n         sigma \\<Turnstile> S3 rmhist p \\<leadsto> S4 rmhist p \\<or> S6 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p = #NotAResult\n                  \\<leadsto> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<or> S5 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p;\n         sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> \\<not>S1 rmhist p \\<leadsto> S6 rmhist p\"\n  apply (rule S2S3S4S5S6LeadstoS6 [THEN LatticeTransitivity [temp_use]])\n       apply assumption+\n  apply (erule INV_leadsto [temp_use])\n  apply (rule ImplLeadsto_gen [temp_use])\n  apply (rule necT [temp_use])\n  apply (auto simp: ImpInv_def Init_defs intro!: necT [temp_use])\n  done\n\nlemma S1Infinite: \"\\<lbrakk> sigma \\<Turnstile> \\<not>S1 rmhist p \\<leadsto> S6 rmhist p;\n         sigma \\<Turnstile> \\<box>\\<diamond>S6 rmhist p \\<longrightarrow> \\<box>\\<diamond>S1 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> \\<box>\\<diamond>S1 rmhist p\"\n  apply (rule classical)\n  apply (tactic \\<open>asm_lr_simp_tac (\\<^context> addsimps\n    [temp_use \\<^context> @{thm NotBox}, temp_rewrite \\<^context> @{thm NotDmd}]) 1\\<close>)\n  apply (auto elim!: leadsto_infinite [temp_use] mp dest!: DBImplBD [temp_use])\n  done\n\nsection \"Refinement proof (step 1.5)\"\n\n(* Prove invariants of the implementation:\n   a. memory invariant\n   b. \"implementation invariant\": always in states S1,...,S6\n*)\nlemma Step1_5_1a: \"\\<turnstile> IPImp p \\<longrightarrow> (\\<forall>l. \\<box>$MemInv mm l)\"\n  by (auto simp: IPImp_def box_stp_act [temp_use] intro!: MemoryInvariantAll [temp_use])\n\nlemma Step1_5_1b: \"\\<turnstile> Init(ImpInit p \\<and> HInit rmhist p) \\<and> \\<box>(ImpNext p)\n         \\<and> \\<box>[HNext rmhist p]_(c p, r p, m p, rmhist!p) \\<and> \\<box>(\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> \\<box>ImpInv rmhist p\"\n  apply invariant\n   apply (auto simp: Init_def ImpInv_def box_stp_act [temp_use]\n     dest!: Step1_1 [temp_use] dest: S1_successors [temp_use] S2_successors [temp_use]\n     S3_successors [temp_use] S4_successors [temp_use] S5_successors [temp_use]\n     S6_successors [temp_use])\n  done\n\n(*** Initialization ***)\nlemma Step1_5_2a: \"\\<turnstile> Init(ImpInit p \\<and> HInit rmhist p) \\<longrightarrow> Init(PInit (resbar rmhist) p)\"\n  by (auto simp: Init_def intro!: Step1_1 [temp_use] Step1_3  [temp_use])\n\n(*** step simulation ***)\nlemma Step1_5_2b: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p)\n         \\<and> $ImpInv rmhist p \\<and> (\\<forall>l. $MemInv mm l))\n         \\<longrightarrow> \\<box>[UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  by (auto simp: ImpInv_def elim!: STL4E [temp_use]\n    dest!: S1safe [temp_use] S2safe [temp_use] S3safe [temp_use] S4safe [temp_use]\n    S5safe [temp_use] S6safe [temp_use])\n\n(*** Liveness ***)\nlemma GoodImpl: \"\\<turnstile> IPImp p \\<and> HistP rmhist p\n         \\<longrightarrow>   Init(ImpInit p \\<and> HInit rmhist p)\n             \\<and> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n             \\<and> \\<box>(\\<forall>l. $MemInv mm l) \\<and> \\<box>($ImpInv rmhist p)\n             \\<and> ImpLive p\"\n  apply clarsimp\n    apply (subgoal_tac \"sigma \\<Turnstile> Init (ImpInit p \\<and> HInit rmhist p) \\<and> \\<box> (ImpNext p) \\<and>\n      \\<box>[HNext rmhist p]_ (c p, r p, m p, rmhist!p) \\<and> \\<box> (\\<forall>l. $MemInv mm l)\")\n   apply (auto simp: split_box_conj [try_rewrite] box_stp_act [try_rewrite]\n       dest!: Step1_5_1b [temp_use])\n      apply (force simp: IPImp_def MClkIPSpec_def RPCIPSpec_def RPSpec_def\n        ImpLive_def c_def r_def m_def)\n      apply (force simp: IPImp_def MClkIPSpec_def RPCIPSpec_def RPSpec_def\n        HistP_def Init_def ImpInit_def)\n    apply (force simp: IPImp_def MClkIPSpec_def RPCIPSpec_def RPSpec_def\n      ImpNext_def c_def r_def m_def split_box_conj [temp_use])\n   apply (force simp: HistP_def)\n  apply (force simp: allT [temp_use] dest!: Step1_5_1a [temp_use])\n  done\n\n(* The implementation is infinitely often in state S1... *)\nlemma Step1_5_3a: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n         \\<and> \\<box>(\\<forall>l. $MemInv mm l)\n         \\<and> \\<box>($ImpInv rmhist p) \\<and> ImpLive p\n         \\<longrightarrow> \\<box>\\<diamond>S1 rmhist p\"\n  apply (clarsimp simp: ImpLive_def)\n  apply (rule S1Infinite)\n   apply (force simp: split_box_conj [try_rewrite] box_stp_act [try_rewrite]\n     intro!: NotS1LeadstoS6 [temp_use] S2_live [temp_use] S3_live [temp_use]\n     S4a_live [temp_use] S4b_live [temp_use] S5_live [temp_use])\n  apply (auto simp: split_box_conj [temp_use] intro!: S6_live [temp_use])\n  done\n\n(* ... and therefore satisfies the fairness requirements of the specification *)\nlemma Step1_5_3b: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n         \\<and> \\<box>(\\<forall>l. $MemInv mm l) \\<and> \\<box>($ImpInv rmhist p) \\<and> ImpLive p\n         \\<longrightarrow> WF(RNext memCh mm (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n  by (auto intro!: RNext_fair [temp_use] Step1_5_3a [temp_use])\n\nlemma Step1_5_3c: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n         \\<and> \\<box>(\\<forall>l. $MemInv mm l) \\<and> \\<box>($ImpInv rmhist p) \\<and> ImpLive p\n         \\<longrightarrow> WF(MemReturn memCh (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n  by (auto intro!: Return_fair [temp_use] Step1_5_3a [temp_use])\n\n(* QED step of step 1 *)\nlemma Step1: \"\\<turnstile> IPImp p \\<and> HistP rmhist p \\<longrightarrow> UPSpec memCh mm (resbar rmhist) p\"\n  by (auto simp: UPSpec_def split_box_conj [temp_use]\n    dest!: GoodImpl [temp_use] intro!: Step1_5_2a [temp_use] Step1_5_2b [temp_use]\n    Step1_5_3b [temp_use] Step1_5_3c [temp_use])\n\n(* ------------------------------ Step 2 ------------------------------ *)\nsection \"Step 2\"\n\nlemma Step2_2a: \"\\<turnstile> Write rmCh mm ires p l \\<and> ImpNext p\n         \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p)\n         \\<and> $ImpInv rmhist p\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (e p, c p, r p, rmhist!p)\"\n  apply clarsimp\n  apply (drule WriteS4 [action_use])\n   apply assumption\n  apply split_idle\n  apply (auto simp: ImpNext_def dest!: S4EnvUnch [temp_use] S4ClerkUnch [temp_use]\n    S4RPCUnch [temp_use])\n     apply (auto simp: square_def dest: S4Write [temp_use])\n  done\n\nlemma Step2_2: \"\\<turnstile>   (\\<forall>p. ImpNext p)\n         \\<and> (\\<forall>p. [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n         \\<and> (\\<forall>p. $ImpInv rmhist p)\n         \\<and> [\\<exists>q. Write rmCh mm ires q l]_(mm!l)\n         \\<longrightarrow> [\\<exists>q. Write memCh mm (resbar rmhist) q l]_(mm!l)\"\n  apply (auto intro!: squareCI elim!: squareE)\n  apply (assumption | rule exI Step1_4_4b [action_use])+\n    apply (force intro!: WriteS4 [temp_use])\n   apply (auto dest!: Step2_2a [temp_use])\n  done\n\nlemma Step2_lemma: \"\\<turnstile> \\<box>(  (\\<forall>p. ImpNext p)\n            \\<and> (\\<forall>p. [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n            \\<and> (\\<forall>p. $ImpInv rmhist p)\n            \\<and> [\\<exists>q. Write rmCh mm ires q l]_(mm!l))\n         \\<longrightarrow> \\<box>[\\<exists>q. Write memCh mm (resbar rmhist) q l]_(mm!l)\"\n  by (force elim!: STL4E [temp_use] dest!: Step2_2 [temp_use])\n\nlemma Step2: \"\\<turnstile> #l \\<in> #MemLoc \\<and> (\\<forall>p. IPImp p \\<and> HistP rmhist p)\n         \\<longrightarrow> MSpec memCh mm (resbar rmhist) l\"\n  apply (auto simp: MSpec_def)\n   apply (force simp: IPImp_def MSpec_def)\n  apply (auto intro!: Step2_lemma [temp_use] simp: split_box_conj [temp_use] all_box [temp_use])\n     prefer 4\n     apply (force simp: IPImp_def MSpec_def)\n    apply (auto simp: split_box_conj [temp_use] elim!: allE dest!: GoodImpl [temp_use])\n  done\n\n(* ----------------------------- Main theorem --------------------------------- *)\nsection \"Memory implementation\"\n\n(* The combination of a legal caller, the memory clerk, the RPC component,\n   and a reliable memory implement the unreliable memory.\n*)\n\n(* Implementation of internal specification by combination of implementation\n   and history variable with explicit refinement mapping\n*)\nlemma Impl_IUSpec: \"\\<turnstile> Implementation \\<and> Hist rmhist \\<longrightarrow> IUSpec memCh mm (resbar rmhist)\"\n  by (auto simp: IUSpec_def Implementation_def IPImp_def MClkISpec_def\n    RPCISpec_def IRSpec_def Hist_def intro!: Step1 [temp_use] Step2 [temp_use])\n\n(* The main theorem: introduce hiding and eliminate history variable. *)\nlemma Implementation: \"\\<turnstile> Implementation \\<longrightarrow> USpec memCh\"\n  apply clarsimp\n  apply (frule History [temp_use])\n  apply (auto simp: USpec_def intro: eexI [temp_use] Impl_IUSpec [temp_use]\n    MI_base [temp_use] elim!: eexE)\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/TLA/Memory/MemoryImplementation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6959583250334526, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3452606306180124}}
{"text": "(*  Title:      HOL/Auth/n_mutualExSimp.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExSimp Protocol Case Study*} \n\ntheory n_mutualExSimp imports n_mutualExSimp_lemma_invs_on_rules n_mutualExSimp_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExSimp/n_mutualExSimp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.34513532255709006}}
{"text": "section \\<open>Nested List Assertion\\<close>\ntheory LLVM_DS_List_Assn\nimports \"../vcg/LLVM_VCG_Main\"\nbegin\n  (* TODO: Improve handling of pure assertions. \n    Dirty hacks like for pure list-assn shouldn't be necessary!\n  *)\n\n  (* TODO: Move *)  \n  lemma gen_drule:\n    assumes \"P\\<turnstile>Q\"\n    assumes \"FRAME A P F\"\n    assumes \"Q**F\\<turnstile>B\"\n    shows \"A\\<turnstile>B\"\n    using assms unfolding FRAME_def\n    using sep_rule(1) sep_rule(2) by blast\n  \n\n\n  (* TODO: Move *)\n  lemma pure_part_set_imgD[vcg_prep_ext_rules]:\n    shows \"pure_part (sep_set_img S P) \\<longrightarrow> (\\<forall>x\\<in>S. pure_part (P x))\"\n  proof (cases \"finite S\")\n    case True thus ?thesis\n      by (induction S) (auto dest: pure_part_split_conj)\n  next\n    case False then show ?thesis by simp\n  qed    \n\n\n  \n  \n  \n  \n  subsection \\<open>Tags\\<close>  \n  text \\<open>Ghost instructions to guide the VCG and Frame Inference\\<close>\n  lemma entails_is_noop_htriple: \"(A \\<turnstile> B) \\<Longrightarrow> llvm_htriple A (return x) (\\<lambda>_. B)\"\n    apply (auto simp: htriple_def wp_return)\n    by (metis (mono_tags, hide_lams) conj_entails_mono empty_ent_GC entails_def entails_lift_extract_simps(2) sep_conj_empty)\n\n  lemma tag_op_ruleI: \n    assumes \"tag_op = return x\"  \n    assumes \"A\\<turnstile>B\"\n    shows \"llvm_htriple A tag_op (\\<lambda>_. B)\"\n    using entails_is_noop_htriple assms by metis\n\n  text \\<open>Assertion to be matched with anything. \n    To obtain abstract from concrete variable.\\<close>  \n  definition \"tag_assn \\<equiv> mk_pure_assn (\\<lambda>_ _. True)\"\n  lemma tag_assn_pure[is_pure_rule]: \"is_pure (tag_assn)\" unfolding tag_assn_def by auto\n  \n  lemma tag_assnI[fri_rules]: \"PRECOND (SOLVE_ASM (\\<flat>\\<^sub>pA a c)) \\<Longrightarrow> \\<box> \\<turnstile> \\<upharpoonleft>\\<^sub>ptag_assn a c\"\n    by (auto simp: tag_assn_def sep_algebra_simps)\n    \n  (* TODO: Move *)  \n  lemma split_pure_assn: \"is_pure A \\<Longrightarrow> \\<upharpoonleft>A a c \\<turnstile> \\<upharpoonleft>A a c ** \\<upharpoonleft>A a c\"\n    by (smt entails_eq_iff entails_pureI extract_pure_assn pure_part_pureD pure_true_conv sep.add.right_neutral)  \n    \n  definition tag_split_pure :: \"'b::llvm_rep \\<Rightarrow> unit llM\" \n    where \"tag_split_pure x = return ()\"  \n\n  lemma tag_split_pure_rl[vcg_rules]:\n    shows \"llvm_htriple \n      (\\<up>(is_pure A) ** \\<upharpoonleft>A a c)\n      (tag_split_pure c)\n      (\\<lambda>_. \\<upharpoonleft>A a c ** \\<upharpoonleft>A a c)\"\n    supply [vcg_rules] = tag_op_ruleI[OF tag_split_pure_def[where x=c] split_pure_assn[of A a c]]\n    by vcg  \n    \n    \n  lemma bury_pure_assn: \"is_pure A \\<Longrightarrow> \\<upharpoonleft>A a c \\<turnstile> \\<box>\"\n    by (smt entails_eq_iff entails_pureI extract_pure_assn pure_part_pureD pure_true_conv)\n\n  lemma bury_pure_assn': \"\\<upharpoonleft>\\<^sub>pA a c \\<turnstile> \\<box>\"\n    by (simp add: dr_assn_pure_prefix_def entails_lift_extract_simps(1))\n    \n        \n  definition tag_bury_pure :: \"'b::llvm_rep \\<Rightarrow> unit llM\" \n    where \"tag_bury_pure x = return ()\"  \n\n  lemma tag_bury_pure_rl[vcg_rules]:\n    shows \"llvm_htriple \n      (\\<up>(is_pure A) ** \\<upharpoonleft>A a c)\n      (tag_bury_pure c)\n      (\\<lambda>_. \\<box>)\"\n    supply [vcg_rules] = tag_op_ruleI[OF tag_bury_pure_def[where x=c] bury_pure_assn[of A a c]]\n    by vcg  \n    \n    \n      \n  \n  \n  subsection \\<open>Map of Valid Indexes in List\\<close>\n  (* TODO: DUP in Array_of_Array_List. *)\n  definition \"idxe_map l i \\<equiv> if i<length l then Some (l!i) else None\"\n\n  lemma idxe_map_empty[simp]: \"idxe_map [] = Map.empty\" unfolding idxe_map_def by auto\n  \n  lemma idxe_map_dom[simp]: \"dom (idxe_map l) = {0..<length l}\" unfolding idxe_map_def by (auto split: if_splits)\n  \n  lemma le_idxe_map_updI: \"i<length l \\<Longrightarrow> m \\<subseteq>\\<^sub>m idxe_map l \\<Longrightarrow> m(i\\<mapsto>l!i) \\<subseteq>\\<^sub>m idxe_map l\"\n    unfolding idxe_map_def map_le_def by (auto split: if_splits)\n    \n  lemma le_idxe_map_delD: \"m \\<subseteq>\\<^sub>m idxe_map l \\<Longrightarrow> m(i:=None) \\<subseteq>\\<^sub>m idxe_map (l[i:=x])\"\n    unfolding idxe_map_def map_le_def by (auto split: if_splits)\n    \n  lemma le_idxe_map_delD': \"m \\<subseteq>\\<^sub>m idxe_map l \\<Longrightarrow> m(i:=None) \\<subseteq>\\<^sub>m idxe_map l\"\n    unfolding idxe_map_def map_le_def by (auto split: if_splits)\n    \n  lemma le_idxe_mapD: \"m \\<subseteq>\\<^sub>m idxe_map l \\<Longrightarrow> m i = Some xi \\<Longrightarrow> l!i = xi\"  \n    unfolding idxe_map_def map_le_def \n    apply (clarsimp split: if_splits) \n    by (metis domI domIff option.inject)\n\n  lemma le_idxe_map_lenD: \"m \\<subseteq>\\<^sub>m idxe_map l \\<Longrightarrow> m i = Some xi \\<Longrightarrow> i < length l\"  \n    unfolding idxe_map_def map_le_def \n    apply (clarsimp split: if_splits) \n    by (metis domI domIff)\n\n  lemma le_idxe_map_append1I: \"A\\<subseteq>\\<^sub>midxe_map (xs@[y]) \\<Longrightarrow> A(length xs := None)\\<subseteq>\\<^sub>midxe_map (xs)\"  \n    by (auto simp: map_le_def idxe_map_def split: if_splits)\n\n  lemma le_idxe_map_append2I: \"A\\<subseteq>\\<^sub>midxe_map xs \\<Longrightarrow> A\\<subseteq>\\<^sub>midxe_map (xs@ys)\"  \n    by (auto simp: map_le_def idxe_map_def split: if_splits)\n    \n  subsection \\<open>Nested List Assertion\\<close>\n\n  definition \"list_assn A R \\<equiv> mk_assn (\\<lambda>xs ys. \n     \\<up>(length xs=length ys) \n  ** \\<up>(R \\<subseteq>\\<^sub>m idxe_map ys)\n  ** (\\<Union>*i\\<in>{0..<length ys} - dom R. \\<upharpoonleft>A (xs!i) (ys!i)))\"\n\n    \n  lemma list_assn_pure_partD[vcg_prep_ext_rules]:\n    \"pure_part (\\<upharpoonleft>(list_assn A R) xs ys) \n      \\<Longrightarrow> length xs = length ys \\<and> R \\<subseteq>\\<^sub>m idxe_map ys \\<and> (\\<forall>x\\<in>{0..<length ys} - dom R. pure_part (\\<upharpoonleft>A (xs ! x) (ys ! x)))\"\n    unfolding list_assn_def\n    apply vcg_prepare_external by blast\n    \n\n  subsection \\<open>Transformations\\<close>  \n  \n  subsubsection \\<open>Initialization and Destruction\\<close>\n    text \\<open>Initialization if there is a pure initial element\\<close>    \n  lemma list_assn_init_pure: \n    assumes \"\\<box> \\<turnstile> \\<upharpoonleft>A x xi\"\n    shows \"\\<box> \\<turnstile> \\<upharpoonleft>(list_assn A Map.empty) (replicate n x) (replicate n xi)\"\n  proof -\n    have \"\\<box> \\<turnstile> (\\<Union>*xa\\<in>{0..<n}. \\<upharpoonleft>A x xi)\" \n      apply (induction n)\n      subgoal by simp\n      subgoal for n\n        apply (simp add: atLeast0_lessThan_Suc)\n        using conj_entails_mono[OF assms] by simp\n      done    \n    \n    thus ?thesis\n      unfolding list_assn_def \n      by (simp add: sep_algebra_simps)\n  qed\n    \n  text \\<open>Arbitrary initialization, no elements owned. Can be used to justify init-algorithm\\<close>\n  lemma list_assn_init_none:\n    assumes \"length xs = length ys\"\n    shows \"\\<box> \\<turnstile> \\<upharpoonleft>(list_assn A (idxe_map ys)) xs ys\"\n    using assms unfolding list_assn_def \n    by (simp add: sep_algebra_simps)\n  \n  lemma list_assn_empty: \"\\<box> \\<turnstile> \\<upharpoonleft>(list_assn A Map.empty) [] []\"  \n    unfolding list_assn_def\n    by (auto simp: sep_algebra_simps)\n    \n  text \\<open>Destruction if all elements have been extracted\\<close>\n  lemma list_assn_free_none:\n    assumes \"dom R \\<supseteq> {0..<length ys}\"\n    shows \"\\<upharpoonleft>(list_assn A R) xs ys \\<turnstile> \\<box>\"\n    using assms unfolding list_assn_def \n    by (auto simp: sep_algebra_simps entails_lift_extract_simps dest: map_le_implies_dom_le)\n\n  subsubsection \\<open>Extracting and Joining Elements\\<close>  \n  \n  lemma list_assn_extract_aux: \n    assumes \"i<length xs\" \"i\\<notin>R\"  \n    shows \"sep_set_img ({0..<length xs} - R) P \n        = (P i ** sep_set_img ({0..<length xs} - insert i R) P)\"\n  proof -\n    from assms have 1: \"{0..<length xs} - R = insert i ({0..<length xs} - insert i R)\" by auto\n    show ?thesis\n      by (subst 1) auto\n  qed    \n  \n  \n  lemma list_assn_extract:\n    assumes \"i<length xs\" \"R i = None\"\n    shows \"\\<upharpoonleft>(list_assn A R) xs ys \\<turnstile> \\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys ** \\<upharpoonleft>A (xs!i) (ys!i)\"\n    using assms unfolding list_assn_def\n    supply [simp] = le_idxe_map_updI list_assn_extract_aux ndomIff\n    supply fri_red_img[fri_red_rules]\n    apply (clarsimp simp: sep_algebra_simps entails_lift_extract_simps)\n    apply (rule ENTAILSD)\n    apply vcg\n    done\n    \n  lemma list_assn_upd_aux: \n    fixes I xs xsi\n    defines \"I \\<equiv> {0..<length xsi}\"\n    assumes \"i\\<in>I\" \"i\\<in>R\" and [simp]: \"length xsi = length xs\"\n    shows \"(\\<Union>*j\\<in>I - (R - {i}). \\<upharpoonleft>A (xs[i := x] ! j) (xsi[i := xi] ! j)) = (\\<upharpoonleft>A x xi ** (\\<Union>*j\\<in>I - R. \\<upharpoonleft>A (xs ! j) (xsi ! j)))\"\n  proof -\n    from assms have 1: \"I - (R - {i}) = insert i (I-R)\" by auto\n    from assms have [simplified,simp]: \"i\\<notin>I-R\" by auto\n    have [simp]: \"i<length xs\" using \\<open>i\\<in>I\\<close> unfolding I_def by auto\n    have [simp]: \"j\\<in>I-R \\<Longrightarrow> i\\<noteq>j\" for j using \\<open>i\\<in>R\\<close> by auto\n    show ?thesis apply (subst 1) by simp\n  qed  \n    \n  lemma list_assn_update:\n    assumes \"R i \\<noteq> None\"\n    shows \"\\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y \\<turnstile> \\<upharpoonleft>(list_assn A (R(i:=None))) (xs[i:=x]) (ys[i:=y])\"\n    using assms unfolding list_assn_def\n    apply -\n    apply (rule entails_pureI)\n    \n    supply [simp] = le_idxe_map_updI le_idxe_map_delD\n    supply fri_red_img[fri_red_rules]\n    apply (clarsimp simp: sep_algebra_simps entails_lift_extract_simps)\n    apply (subst list_assn_upd_aux)\n    subgoal by (metis domI idxe_map_dom map_leD)\n    apply auto [2]\n    apply (rule ENTAILSD)\n    apply vcg\n    done\n    \n  lemma list_assn_join:\n    assumes \"R i = Some y\"\n    assumes \"x = xs!i\"\n    shows \"\\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y \\<turnstile> \\<upharpoonleft>(list_assn A (R(i:=None))) xs ys\"\n    apply (rule entails_pureI)\n    apply (subst (asm) list_assn_def)\n    apply (clarsimp simp: sep_algebra_simps dest!: pure_part_split_conj)\n    apply (rule entails_trans[OF list_assn_update[where i=i]])\n    using assms by (auto dest: le_idxe_mapD)\n    \n  lemma list_assn_join':\n    assumes \"R i = None\"\n    assumes \"x = xs!i\" \"y=ys!i\"\n    shows \"\\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys ** \\<upharpoonleft>A x y \\<turnstile> \\<upharpoonleft>(list_assn A R) xs ys\"\n    apply (sep_drule list_assn_join[where i=i])\n    using assms by (auto simp: fun_upd_idem)\n\n  subsubsection \\<open>Push and Pop\\<close>    \n  lemma list_assn_push_back:\n    shows \"(\\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y) \\<turnstile> (\\<upharpoonleft>(list_assn A R) (xs@[x]) (ys@[y]))\"\n    unfolding list_assn_def\n    apply (clarsimp simp: sep_algebra_simps atLeast0_lessThan_Suc entails_lift_extract_simps \n      insert_Diff_if le_idxe_map_append2I; safe)\n    apply (auto dest: le_idxe_map_lenD; fail)\n    apply (rule ENTAILSD)\n    supply [simp] = nth_append\n    by vcg\n\n    \n    \n  lemma list_assn_pop_back1:\n    assumes \"R (length xs - 1) \\<noteq> None\"\n    shows \"\\<upharpoonleft>(list_assn A R) xs ys \\<turnstile> \\<upharpoonleft>(list_assn A (R(length xs-1 := None))) (butlast xs) (butlast ys)\"  \n    using assms unfolding list_assn_def\n    apply (rule_tac entails_pureI)\n    apply (cases xs rule: rev_cases; cases ys rule: rev_cases)\n    apply (clarsimp_all \n      dest!: pure_part_split_conj \n      simp: sep_algebra_simps atLeast0_lessThan_Suc domI set_minus_minus_disj_conv)\n    apply (rule ENTAILSD)\n    supply [simp] = le_idxe_map_append1I\n    by vcg\n    \n    \n  lemma list_assn_pop_back2:\n    assumes \"xs\\<noteq>[]\" \"R (length xs - 1) = None\"\n    shows \"(\\<upharpoonleft>(list_assn A R) xs ys) \\<turnstile> (\\<upharpoonleft>(list_assn A R) (butlast xs) (butlast ys) ** \\<upharpoonleft>A (last xs) (last ys))\"  \n    apply (rule entails_pureI) using assms\n    apply vcg_prepare_external\n    apply (sep_drule list_assn_extract[where i=\"length xs - 1\"])\n    subgoal by (cases ys; simp)\n    subgoal by simp\n    apply (sep_drule list_assn_pop_back1)\n    subgoal by auto\n    by (cases ys rule: rev_cases; simp add: last_conv_nth fun_upd_idem)\n    \n    \n  subsection \\<open>Fri-Reduce Rules for List-Assertion\\<close>  \n  lemma la_red_extract:\n    \"PRECOND (SOLVE_AUTO (R i = None \\<and> i<length xs)) \n      \\<Longrightarrow> is_sep_red (\\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys) \\<box> (\\<upharpoonleft>(list_assn A R) xs ys) (\\<upharpoonleft>A (xs!i) (ys!i))\"\n    apply (clarsimp simp: vcg_tag_defs)\n    apply (rule is_sep_redI)\n    apply (sep_drule list_assn_extract, assumption+)\n    apply (erule gen_drule, fri)\n    apply (rule ENTAILSD, fri)\n    done\n  \n  lemma la_red_join:\n    \"PRECOND (SOLVE_AUTO (R i = None \\<and> i<length xs \\<and> x=xs!i \\<and> y=ys!i)) \n      \\<Longrightarrow> is_sep_red \\<box> (\\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys) (\\<upharpoonleft>A x y) (\\<upharpoonleft>(list_assn A R) xs ys)\"\n    apply (clarsimp simp: vcg_tag_defs)\n    apply (rule is_sep_redI)\n    apply (sep_rule list_assn_join')\n    apply assumption+\n    apply (erule gen_drule, fri)\n    apply (rule ENTAILSD, fri)\n    done\n    \n\n  subsection \\<open>Tags for List-Assertion\\<close>\n  \n  definition tag_la_upd :: \"'b::llvm_rep \\<Rightarrow> 'a word \\<Rightarrow> 'd::llvm_rep \\<Rightarrow> unit llM\" \n    where \"tag_la_upd p i y = return ()\"  \n\n  lemma tag_la_upd_rl[vcg_rules]:\n    shows \"llvm_htriple \n      (\\<upharpoonleft>tag_assn i ii ** \\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y ** \\<up>(R i \\<noteq> None))\n      (tag_la_upd p ii y)\n      (\\<lambda>_. \\<upharpoonleft>(list_assn A (R(i:=None))) (xs[i:=x]) (ys[i:=y]) ** \\<upharpoonleft>AA ys p)\"\n    supply [vcg_rules] = tag_op_ruleI[OF tag_la_upd_def[where i=ii] list_assn_update[where i=i]]\n    by vcg  \n    \n\n  definition tag_la_join :: \"'b::llvm_rep \\<Rightarrow> 'a word \\<Rightarrow> 'd::llvm_rep \\<Rightarrow> unit llM\" \n    where \"tag_la_join p i y = return ()\"\n    \n  lemma tag_la_join_rl[vcg_rules]:\n    shows \"llvm_htriple \n      (\\<upharpoonleft>tag_assn i ii ** \\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y ** \\<up>(R i = Some y \\<and> x=xs!i))\n      (tag_la_join p ii y)\n      (\\<lambda>_. \\<upharpoonleft>(list_assn A (R(i:=None))) xs ys ** \\<upharpoonleft>AA ys p)\"\n    supply [vcg_rules] = tag_op_ruleI[OF tag_la_join_def[where i=ii] list_assn_join[where i=i]]\n    by vcg  \n    \n  definition \"tag_la_extract p i = return ()\"  \n\n      \n  (*\n    TODO: We have to use tag-assn for pure (i), and variables (AA) for impure assertions: \n      Otherwise, current frame-inference's pure extraction will not unify \n      variable assertion with pure assertion! FIX THAT! \n  *)  \n    \n  lemma tag_la_extract_rl[vcg_rules]: \n    \"llvm_htriple\n      (\\<upharpoonleft>tag_assn i ii ** \\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<up>(R i = None \\<and> i<length xs))\n      (tag_la_extract p ii)\n      (\\<lambda>_. \\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys ** \\<upharpoonleft>A (xs!i) (ys!i) ** \\<upharpoonleft>AA ys p ** \\<up>(length xs = length ys))\" \n    supply [vcg_rules] = tag_op_ruleI[OF tag_la_extract_def[where i=ii] list_assn_extract[where i=i]]\n    apply vcg\n    done\n\n        \n  definition \"tag_la_push_back p x = return ()\"    \n  \n  lemma tag_la_push_back_rl[vcg_rules]:\n    \"llvm_htriple \n      (\\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y)\n      (tag_la_push_back p y)\n      (\\<lambda>_. \\<upharpoonleft>(list_assn A R) (xs@[x]) (ys@[y]) ** \\<upharpoonleft>AA ys p)\"\n    supply [vcg_rules] = tag_op_ruleI[OF tag_la_push_back_def[where p=p] list_assn_push_back]\n    by vcg\n\n  definition \"tag_la_pop_back p = return ()\"\n  lemma tag_la_pop_back_rl[vcg_rules]:\n    \"llvm_htriple\n      (\\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<up>(xs\\<noteq>[] \\<and> R (length xs-1) = None))\n      (tag_la_pop_back p)\n      (\\<lambda>_. \\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) (butlast xs) (butlast ys) ** \\<upharpoonleft>A (last xs) (last ys) ** \\<up>(xs\\<noteq>[] \\<and> ys\\<noteq>[]))\"  \n    supply [vcg_rules] = tag_op_ruleI[OF tag_la_pop_back_def[where p=p] list_assn_pop_back2]\n    apply (rule htriple_pure_preI)\n    by vcg\n  \n  subsection \\<open>Pure List Assertion\\<close>  \n  (* TODO: is_pure list_assn rule *)\n  \n  definition \"tag_la_exfree_pure p i = return ()\"  \n\n  lemma bury_pure_red: \"PRECOND (SOLVE_ASM (is_pure A)) \\<Longrightarrow> is_sep_red \\<box> \\<box> (\\<upharpoonleft>A a c) \\<box>\"\n    unfolding vcg_tag_defs\n    apply (rule is_sep_redI)\n    apply (sep_drule bury_pure_assn)\n    by simp\n  \n  lemma tag_la_exfree_pure_rl[vcg_rules]: \n    \"llvm_htriple\n      (\\<upharpoonleft>tag_assn i ii ** \\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<up>(is_pure A \\<and> R i = None \\<and> i<length xs))\n      (tag_la_exfree_pure p ii)\n      (\\<lambda>_. \\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys ** \\<upharpoonleft>AA ys p ** \\<up>(length xs = length ys))\" \n    supply R[vcg_rules] = \n      tag_op_ruleI[OF tag_la_exfree_pure_def[where i=ii] list_assn_extract[where i=i], of xs R A ys]\n    thm R\n    apply vcg\n    apply vcg_try_solve\n    subgoal (* TODO: Dirty hack! *)\n      unfolding FRAME_INFER_def FRI_END_def\n      apply (sep_drule bury_pure_assn')\n      by simp\n    done\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm_time", "sha": "42dd7f59998d76047bb4b6bce76d8f67b53a08b6", "save_path": "github-repos/isabelle/lammich-isabelle_llvm_time", "path": "github-repos/isabelle/lammich-isabelle_llvm_time/isabelle_llvm_time-42dd7f59998d76047bb4b6bce76d8f67b53a08b6/thys/ds/LLVM_DS_List_Assn.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.34513532255709006}}
{"text": "(*  Title:      JinjaDCI/BV/EffMono.thy\n\n    Author:     Gerwin Klein, Susannah Mansky\n    Copyright   2000 Technische Universitaet Muenchen, 2019-20 UIUC\n\n    Based on the Jinja theory BV/EffectMono.thy by Gerwin Klein\n*)\n\nsection \\<open> Monotonicity of eff and app \\<close>\n\ntheory EffectMono imports Effect begin\n\ndeclare not_Err_eq [iff]\n\nlemma app\\<^sub>i_mono: \n  assumes wf: \"wf_prog p P\"\n  assumes less: \"P \\<turnstile> \\<tau> \\<le>\\<^sub>i \\<tau>'\"\n  shows \"app\\<^sub>i (i,P,mxs,mpc,rT,\\<tau>') \\<Longrightarrow> app\\<^sub>i (i,P,mxs,mpc,rT,\\<tau>)\"\n(*<*)\nproof -\n  assume app: \"app\\<^sub>i (i,P,mxs,mpc,rT,\\<tau>')\"\n  \n  obtain ST LT ST' LT' where\n    [simp]: \"\\<tau> = (ST,LT)\" and\n    [simp]: \"\\<tau>' = (ST',LT')\" \n    by (cases \\<tau>, cases \\<tau>')\n\n  from less have [simp]: \"size ST = size ST'\" and [simp]: \"size LT = size LT'\"\n    by (auto dest: list_all2_lengthD)\n\n  note [iff] = list_all2_Cons2 widen_Class  \n  note [simp] = fun_of_def \n\n  from app less show \"app\\<^sub>i (i,P,mxs,mpc,rT,\\<tau>)\"\n  proof (cases i)\n    case Load\n    with app less show ?thesis by (auto dest!: list_all2_nthD)\n  next\n    case (Invoke M n)\n    with app have n: \"n < size ST'\" by simp\n    \n    { assume \"ST!n = NT\" hence ?thesis using n app Invoke by simp }\n    moreover {\n      assume \"ST'!n = NT\"\n      moreover with n less have \"ST!n = NT\" \n        by (auto dest: list_all2_nthD)\n      ultimately have ?thesis using n app Invoke by simp\n    }\n    moreover {\n      assume ST: \"ST!n \\<noteq> NT\" and ST': \"ST'!n \\<noteq> NT\" \n\n      from ST' app Invoke obtain D Ts T m C' where\n        D:   \"ST' ! n = Class D\" and\n        Ts:  \"P \\<turnstile> rev (take n ST') [\\<le>] Ts\" and\n        D_M: \"P \\<turnstile> D sees M,NonStatic: Ts\\<rightarrow>T = m in C'\"\n        by auto\n\n      from n D less have \"P \\<turnstile> ST!n \\<le> ST'!n\" \n        by (fastforce dest: list_all2_nthD2)\n      with D ST obtain D' where\n        D': \"ST!n = Class D'\" and DsubC: \"P \\<turnstile> D' \\<preceq>\\<^sup>* D\" by auto\n\n      from wf D_M DsubC obtain Ts' T' m' C'' where\n        D'_M: \"P \\<turnstile> D' sees M,NonStatic: Ts'\\<rightarrow>T' = m' in C''\" and\n        Ts': \"P \\<turnstile> Ts [\\<le>] Ts'\"\n        by (blast dest: sees_method_mono) \n\n      from less have \"P \\<turnstile> rev (take n ST) [\\<le>] rev (take n ST')\" by simp\n      also note Ts also note Ts' \n      finally have \"P \\<turnstile> rev (take n ST) [\\<le>] Ts'\" .\n      with D'_M D' app less Invoke have ?thesis by fastforce\n    }\n    ultimately show ?thesis by blast\n  next\n    case (Invokestatic D M n)\n    moreover {\n      from app Invokestatic obtain Ts T m C' where\n        Ts:  \"P \\<turnstile> rev (take n ST') [\\<le>] Ts\" and\n        D_M: \"P \\<turnstile> D sees M,Static: Ts\\<rightarrow>T = m in C'\"\n        by auto\n      from wf D_M obtain Ts' T' m' C'' where\n        D'_M: \"P \\<turnstile> D sees M,Static: Ts'\\<rightarrow>T' = m' in C''\" and\n        Ts': \"P \\<turnstile> Ts [\\<le>] Ts'\"\n        by (blast dest: sees_method_mono) \n      from less have \"P \\<turnstile> rev (take n ST) [\\<le>] rev (take n ST')\" by simp\n      also note Ts also note Ts' \n      finally have \"P \\<turnstile> rev (take n ST) [\\<le>] Ts'\" .\n      with D'_M app less Invokestatic have ?thesis by fastforce\n    }\n    ultimately show ?thesis by blast\n  next \n    case Getfield\n    with app less show ?thesis by (fastforce intro: rtrancl_trans)\n  next\n    case (Putfield F C)\n    with app less show ?thesis by (fastforce intro: widen_trans rtrancl_trans)\n  next\n    case (Putstatic C F D)\n    with app less show ?thesis by (fastforce intro: widen_trans rtrancl_trans)\n  next\n    case Return\n    with app less show ?thesis by (fastforce intro: widen_trans)\n  qed (auto elim!: refTE not_refTE)\nqed\n(*>*)\n\nlemma succs_mono:\n  assumes wf: \"wf_prog p P\" and app\\<^sub>i: \"app\\<^sub>i (i,P,mxs,mpc,rT,\\<tau>')\"\n  shows \"P \\<turnstile> \\<tau> \\<le>\\<^sub>i \\<tau>' \\<Longrightarrow> set (succs i \\<tau> pc) \\<subseteq> set (succs i \\<tau>' pc)\"\n(*<*)\nproof (cases i)\n  case (Invoke M n)\n  obtain ST LT ST' LT' where \n    [simp]: \"\\<tau> = (ST,LT)\" and [simp]: \"\\<tau>' = (ST',LT')\" by (cases \\<tau>, cases \\<tau>') \n  assume \"P \\<turnstile> \\<tau> \\<le>\\<^sub>i \\<tau>'\"\n  moreover\n  with app\\<^sub>i Invoke have \"n < size ST\" by (auto dest: list_all2_lengthD)\n  ultimately\n  have \"P \\<turnstile> ST!n \\<le> ST'!n\" by (auto simp add: fun_of_def dest: list_all2_nthD)\n  with Invoke show ?thesis by auto \nqed auto\n(*>*)\n  \n\nlemma app_mono: \n  assumes wf: \"wf_prog p P\"\n  assumes less': \"P \\<turnstile> \\<tau> \\<le>' \\<tau>'\"\n  shows \"app i P m rT pc mpc xt \\<tau>' \\<Longrightarrow> app i P m rT pc mpc xt \\<tau>\"\n(*<*)\nproof (cases \\<tau>)\n  case None thus ?thesis by simp\nnext\n  case (Some \\<tau>\\<^sub>1) \n  moreover\n  with less' obtain \\<tau>\\<^sub>2 where \\<tau>\\<^sub>2: \"\\<tau>' = Some \\<tau>\\<^sub>2\" by (cases \\<tau>') auto\n  ultimately have less: \"P \\<turnstile> \\<tau>\\<^sub>1 \\<le>\\<^sub>i \\<tau>\\<^sub>2\" using less' by simp\n  \n  assume \"app i P m rT pc mpc xt \\<tau>'\"\n  with Some \\<tau>\\<^sub>2 obtain\n    app\\<^sub>i: \"app\\<^sub>i (i, P, pc, m, rT, \\<tau>\\<^sub>2)\" and\n    xcpt: \"xcpt_app i P pc m xt \\<tau>\\<^sub>2\" and\n    succs: \"\\<forall>(pc',s')\\<in>set (eff i P pc xt (Some \\<tau>\\<^sub>2)). pc' < mpc\"\n    by (auto simp add: app_def)\n  \n  from wf less app\\<^sub>i have \"app\\<^sub>i (i, P, pc, m, rT, \\<tau>\\<^sub>1)\" by (rule app\\<^sub>i_mono)\n  moreover\n  from less have \"size (fst \\<tau>\\<^sub>1) = size (fst \\<tau>\\<^sub>2)\" \n    by (cases \\<tau>\\<^sub>1, cases \\<tau>\\<^sub>2) (auto dest: list_all2_lengthD)\n  with xcpt have \"xcpt_app i P pc m xt \\<tau>\\<^sub>1\" by (simp add: xcpt_app_def)\n  moreover\n  from wf app\\<^sub>i less have \"\\<forall>pc. set (succs i \\<tau>\\<^sub>1 pc) \\<subseteq> set (succs i \\<tau>\\<^sub>2 pc)\"\n    by (blast dest: succs_mono)\n  with succs\n  have \"\\<forall>(pc',s')\\<in>set (eff i P pc xt (Some \\<tau>\\<^sub>1)). pc' < mpc\"\n    by (cases \\<tau>\\<^sub>1, cases \\<tau>\\<^sub>2)\n       (auto simp add: eff_def norm_eff_def xcpt_eff_def dest: bspec)\n  ultimately\n  show ?thesis using Some by (simp add: app_def)\nqed\n(*>*)\n\n\nlemma eff\\<^sub>i_mono:\n  assumes wf: \"wf_prog p P\"\n  assumes less: \"P \\<turnstile> \\<tau> \\<le>\\<^sub>i \\<tau>'\"\n  assumes app\\<^sub>i: \"app i P m rT pc mpc xt (Some \\<tau>')\"\n  assumes succs: \"succs i \\<tau> pc \\<noteq> []\"  \"succs i \\<tau>' pc \\<noteq> []\"\n  shows \"P \\<turnstile> eff\\<^sub>i (i,P,\\<tau>) \\<le>\\<^sub>i eff\\<^sub>i (i,P,\\<tau>')\"\n(*<*)\nproof -\n  obtain ST LT ST' LT' where\n    [simp]: \"\\<tau> = (ST,LT)\" and\n    [simp]: \"\\<tau>' = (ST',LT')\" \n    by (cases \\<tau>, cases \\<tau>')\n  \n  note [simp] = eff_def app_def fun_of_def \n\n  from less have \"P \\<turnstile> (Some \\<tau>) \\<le>' (Some \\<tau>')\" by simp\n  from wf this app\\<^sub>i \n  have app: \"app i P m rT pc mpc xt (Some \\<tau>)\" by (rule app_mono)\n\n  from less app app\\<^sub>i show ?thesis\n  proof (cases i)\n    case Throw with succs have False by simp\n    thus ?thesis ..\n  next\n    case Return with succs have False by simp\n    thus ?thesis ..\n  next\n    case (Load i)\n    from Load app obtain y where\n       y:  \"i < size LT\" \"LT!i = OK y\" by clarsimp\n    from Load app\\<^sub>i obtain y' where\n       y': \"i < size LT'\" \"LT'!i = OK y'\" by clarsimp\n\n    from less have \"P \\<turnstile> LT [\\<le>\\<^sub>\\<top>] LT'\" by simp\n    with y y' have \"P \\<turnstile> y \\<le> y'\" by (auto dest: list_all2_nthD)    \n    with Load less y y' app app\\<^sub>i\n    show ?thesis by auto\n  next\n    case Store with less app app\\<^sub>i\n    show ?thesis by (auto simp add: list_all2_update_cong) \n  next\n    case (Invoke M n) \n    with app\\<^sub>i have n: \"n < size ST'\" by simp\n    from less have [simp]: \"size ST = size ST'\" \n      by (auto dest: list_all2_lengthD)\n\n    from Invoke succs have ST: \"ST!n \\<noteq> NT\" and ST': \"ST'!n \\<noteq> NT\"\n      by (auto split: if_split_asm)\n    \n    from ST' app\\<^sub>i Invoke obtain D Ts T m C' where\n      D:   \"ST' ! n = Class D\" and\n      D_M: \"P \\<turnstile> D sees M,NonStatic: Ts\\<rightarrow>T = m in C'\"\n      by auto\n\n    from n D less have \"P \\<turnstile> ST!n \\<le> ST'!n\" \n      by (fastforce dest: list_all2_nthD2)\n    with D ST obtain D' where\n      D': \"ST ! n = Class D'\" and DsubC: \"P \\<turnstile> D' \\<preceq>\\<^sup>* D\"\n      by (auto simp: widen_Class)\n      \n    from wf D_M DsubC obtain Ts' T' m' C'' where\n      D'_M: \"P \\<turnstile> D' sees M,NonStatic: Ts'\\<rightarrow>T' = m' in C''\" and\n      Ts': \"P \\<turnstile> T' \\<le> T\"\n      by (blast dest: sees_method_mono) \n\n    with Invoke n D D' D_M less \n    show ?thesis by (auto intro: list_all2_dropI)\n  qed auto\nqed\n(*>*)\n\nend\n\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/BV/EffectMono.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018545, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.34513531479044884}}
{"text": "(*  Title:      HOL/Auth/n_mutualExFsm.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExFsm Protocol Case Study*} \n\ntheory n_mutualExFsm imports n_mutualExFsm_lemma_invs_on_rules n_mutualExFsm_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExFsm/n_mutualExFsm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593171945417, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3451353070238076}}
{"text": "theory Simp_Lemmas_PDC\n\nimports TLB_PDC\n         TLB_ASID_REFJ.Simp_Lemmas_ASIDs\n        \nbegin\n\n\n\n\n\nlemma [simp]:\n  \"snd (pairunion t(a, b)) = snd t \\<union> b\" \n  apply (cases t)\n  by clarsimp\n\n\nlemma [simp]:\n \"fst (pairunion (pairunion t ({}, {a})) ({b}, {})) = insert b (fst t)\"\n apply (cases t)\n  by clarsimp\n\nlemma [simp]:\n \"snd (pairunion (pairunion t ({}, {a})) (b, {})) = insert a (snd t)\"\n apply (cases t)\n  by clarsimp\n\nlemma [simp]:\n  \"fst (pairunion t (a, {})) = fst t \\<union> a\"\n  apply (cases t)\n  by (clarsimp)\n\nlemma [simp]:\n  \"snd (pairunion t (a, {})) = snd t \"\n  apply (cases t)\n  by (clarsimp)\n\nlemma subset_pairunion [simp]:\n   \"\\<lbrakk>a \\<subseteq> fst s; b \\<subseteq> snd s\\<rbrakk>  \\<Longrightarrow> s = pairunion s (a, b)\"\n  by (metis (no_types, hide_lams)  le_sup_iff  pairunion.simps prod.exhaust_sel subset_antisym subset_refl)\n\n\nlemma [simp]:\n  \"\\<lbrakk>a \\<preceq> b; a \\<noteq> Fault\\<rbrakk> \\<Longrightarrow> b \\<noteq> Fault\"\n  by (force simp: entry_leq_def)\n\n(* lookup_pdc Lemmas *)\n\nabbreviation \"lookup_pdc p a \\<equiv> lookup (tagged_pdc_entry_set p a)\" \n\n\n\nlemma asid_pdc_mono_entry_set:\n  \"t \\<subseteq> t' \\<Longrightarrow> tagged_pdc_entry_set t a v \\<subseteq> tagged_pdc_entry_set t' a v\"\n  apply (clarsimp simp: tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def)\n  by (meson subset_eq tlb_mono_entry_set) \n\nlemma asid_pdc_mono:\n  \"t \\<subseteq> t' \\<Longrightarrow> lookup_pdc t a v \\<le> lookup_pdc t' a v\"\n  by (drule asid_pdc_mono_entry_set) (fastforce simp: lookup_def)\n\nlemma lookup_in_asid_pdc:\n  \"lookup_pdc t a v = Hit e \\<Longrightarrow> e \\<in> t\"\n  by (auto simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def   split: if_split_asm)\n\n\nlemma lookup_asid_pdc_incon_subset [simp]:\n  \"\\<lbrakk> s \\<subseteq> t ; lookup_pdc s a v = Incon \\<rbrakk> \\<Longrightarrow>  lookup_pdc t a v = Incon\"\n  by (metis less_eq_lookup_type lookup_type.simps(3) asid_pdc_mono)\n\n\nlemma tagged_pdc_entry_set_insert:\n  \"\\<lbrakk> tagged_pdc_entry_set t a v = {}; asid_of_pdc e = Some a \\<or> asid_of_pdc e = None; v \\<in> range_of e \\<rbrakk> \\<Longrightarrow> \n               tagged_pdc_entry_set (insert e t) a v = {e}\"\n  apply (clarsimp simp: tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def )\n  by force    \n\n\n\nlemma pdc_subset_lookup_un_eq:\n  \"t \\<subseteq> t' \\<Longrightarrow> lookup_pdc(t' \\<union> t) a v =  lookup_pdc t' a v\"\n  apply (subgoal_tac \"t' = t \\<union> t'\")\n   apply (simp add: sup.commute)\n  by blast\n\n\nlemma lookup_minus_union_incon:\n  \"lookup'' (t - t' \\<union> t'') a v = Incon \\<Longrightarrow> lookup'' (t \\<union> t'') a v = Incon\"\n  apply (subgoal_tac \"t - t' \\<union> t'' \\<subseteq> t \\<union> t''\")\n  using lookup_asid_tlb_incon_subset apply blast\n  by blast\n\nlemma lookup_minus_union_incon_pdc:\n  \"lookup_pdc (t - t' \\<union> t'') a v = Incon \\<Longrightarrow> lookup_pdc (t \\<union> t'') a v = Incon\"\n  apply (subgoal_tac \"t - t' \\<union> t'' \\<subseteq> t \\<union> t''\")\n  using lookup_asid_pdc_incon_subset apply blast\n  by blast\n \n\nlemma addr_set_minus_lookup_miss:\n  \"v \\<in> vset \\<Longrightarrow> lookup'' (t - (\\<Union>v\\<in>vset. {e \\<in> t. v \\<in> range_of e})) a v = Miss\"\n  apply (subgoal_tac \"tagged_entry_set (t - (\\<Union>v\\<in>vset. {e \\<in> t. v \\<in> range_of e})) a v = {}\")\n   apply (clarsimp simp: lookup_def)\n  apply (clarsimp simp: tagged_entry_set_def entry_set_def) by force\n\nlemma addr_set_minus_lookup_miss_pdc:\n  \"v \\<in> vset \\<Longrightarrow> lookup_pdc (t - (\\<Union>v\\<in>vset. {e \\<in> t. v \\<in> range_of e})) a v = Miss\"\n  apply (subgoal_tac \"tagged_pdc_entry_set (t - (\\<Union>v\\<in>vset. {e \\<in> t. v \\<in> range_of e})) a v = {}\")\n   apply (clarsimp simp: lookup_def)\n  apply (clarsimp simp: tagged_pdc_entry_set_def entry_set_def) by force\n\n\nlemma lookup_asid_pdc_miss_union:\n  \" lookup_pdc (t \\<union> t') a v = Miss  \\<Longrightarrow>\n      (lookup_pdc t a v = Miss \\<and> lookup_pdc t' a v = Miss)\"\n  apply rule\n   apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def   split: if_split_asm)\n   apply safe\n      apply blast+\n  apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def   split: if_split_asm)\n  apply safe\n  by blast+\n\n\nlemma lookup_asid_pdc_hit_miss_or_hit' :\n  \" lookup_pdc (t \\<union> t') a v = Hit e  \\<Longrightarrow> \n              lookup_pdc t' a v = Miss \\<or> (lookup_pdc t' a v = Hit e)\"\n  by (metis Un_upper2 asid_pdc_mono less_eq_lookup_type lookup_type.simps(7))\n \nlemma  lookup_asid_pdc_hit_entry_range:\n  \"lookup_pdc t a v = Hit e \\<Longrightarrow> v \\<in> range_of e\"\n  apply (clarsimp simp: lookup_def  tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def  split:if_split_asm)\n  by force\n\nlemma lookup_asid_pdc_union_hit_miss_hit :\n  \"\\<lbrakk>lookup_pdc (t \\<union> t') a v = Hit e ; lookup_pdc t' a v \\<noteq> Miss \\<rbrakk> \\<Longrightarrow> lookup_pdc t' a v = Hit e\"\n  using lookup_asid_pdc_hit_miss_or_hit' by blast\n \nlemma  lookup_asid_pdc_not_hit_miss:\n  \"\\<lbrakk>lookup_pdc (t \\<union> t') a v = Hit e;   lookup_pdc t a v \\<noteq> Hit e\\<rbrakk> \\<Longrightarrow> lookup_pdc t a v = Miss\"\n  by (metis lookup_asid_pdc_union_hit_miss_hit sup_commute)\n  \n\nlemma lookup_asid_pdc_union_hit_miss_hit' :\n  \"\\<lbrakk>lookup_pdc (t \\<union> t') a v = Hit e; lookup_pdc t a v \\<noteq> Miss \\<rbrakk> \\<Longrightarrow> lookup_pdc t a v = Hit e\"\n  using lookup_asid_pdc_not_hit_miss by blast\n  \nlemma  lookup_asid_pdc_not_hit_false:\n  \"\\<lbrakk>lookup_pdc (t \\<union> t') a v = Hit e; lookup_pdc t a v \\<noteq> Hit e; lookup_pdc t' a v \\<noteq> Hit e\\<rbrakk> \\<Longrightarrow> False\"\n  apply (cases \"lookup_pdc t a v\"; clarsimp)\n    defer\n    apply (metis Un_upper1 lookup_asid_pdc_incon_subset lookup_type.simps(7))\n   apply (metis Hits_le asid_pdc_mono inf_sup_ord(3))\n  apply (simp only: lookup_def  tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def   split:if_split_asm cong: Collect_cong)\n     by blast+ \n\n  \n\nlemma lookup_asid_pdc_not_hit_hit:\n  \"\\<lbrakk>lookup_pdc (t \\<union> t') a v = Hit e; lookup_pdc t a v \\<noteq> Hit e\\<rbrakk> \\<Longrightarrow> lookup_pdc t' a v = Hit e\"\n  using lookup_asid_pdc_not_hit_false by blast\n\n\nlemma lookup_asid_pdc_hit_union_cases':\n  \" lookup_pdc (t \\<union> t') a v = Hit e  \\<Longrightarrow>\n      (lookup_pdc t a v  = Hit e \\<and> lookup_pdc t' a v = Miss)  \\<or>\n      (lookup_pdc t' a v = Hit e \\<and> lookup_pdc t a v  = Miss)  \\<or>\n      (lookup_pdc t a v  = Hit e \\<and> lookup_pdc t' a v = Hit e)\"\n  apply (safe , clarsimp)\n         apply (drule lookup_asid_pdc_not_hit_hit; clarsimp)\n        apply (drule lookup_asid_pdc_not_hit_miss; clarsimp)\n       apply (drule lookup_asid_pdc_not_hit_false ; clarsimp) \n      apply (drule lookup_asid_pdc_not_hit_false ; clarsimp)\n     apply (drule lookup_asid_pdc_union_hit_miss_hit ; clarsimp)\n    apply (drule lookup_asid_pdc_not_hit_miss ; clarsimp)\n   apply (drule lookup_asid_pdc_union_hit_miss_hit ; clarsimp)\n  by (drule lookup_asid_pdc_hit_miss_or_hit' ; clarsimp)\n\nlemma lookup_asid_pdc_miss_implies_union_miss:\n  \"\\<lbrakk>lookup_pdc t a v = Miss ; lookup_pdc t' a v = Miss \\<rbrakk> \\<Longrightarrow> lookup_pdc (t \\<union> t') a v = Miss \"\n  apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def   split: if_split_asm)\n  apply safe\n  by blast+\n\nlemma lookup_asid_pdc_miss_hit_implies_union_hit:\n  \"\\<lbrakk>lookup_pdc t a v = Miss; lookup_pdc t' a v = Hit e\\<rbrakk> \\<Longrightarrow> lookup_pdc (t \\<union> t') a v = Hit e\"\n  apply (case_tac \"lookup_pdc (t \\<union> t') a v\"; clarsimp)\n    apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def   split: if_split_asm)\n    apply (safe; force) [1] \n   apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def   split: if_split_asm)\n   apply (safe; force) [1]\n  apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def   split: if_split_asm)\n  by (safe; force) [1]\n\n \n\nlemma  union_asid_pdc_incon_cases:\n  \"lookup_pdc (t \\<union> t') a v = Incon \\<Longrightarrow> \n      (lookup_pdc t a v = Incon \\<and> lookup_pdc t' a v = Incon)  \\<or>\n      ((\\<exists>x\\<in>t. lookup_pdc t a v = Hit x)  \\<and> (\\<exists>x\\<in>t'. lookup_pdc t' a v = Hit x) \\<and>  lookup_pdc t a v \\<noteq>  lookup_pdc t' a v)  \\<or>\n      (lookup_pdc t' a v = Incon \\<and> (\\<exists>x\\<in>t. lookup_pdc t a v = Hit x) ) \\<or>\n      ((\\<exists>x\\<in>t'. lookup_pdc t' a v = Hit x)  \\<and> lookup_pdc t a v = Incon)\\<or>\n      (lookup_pdc t a v = Miss \\<and> lookup_pdc t' a v = Incon)  \\<or>\n      (lookup_pdc t a v = Incon \\<and> lookup_pdc t' a v = Miss)\"\n  apply (cases \"lookup_pdc t a v\"; cases \"lookup_pdc t' a v\"; clarsimp)\n       apply (drule_tac t' = t' in lookup_asid_pdc_miss_implies_union_miss; simp)\n      apply (drule_tac t' = t' in lookup_asid_pdc_miss_hit_implies_union_hit; simp)\n  using lookup_in_asid_pdc apply blast\n    apply (drule_tac t' = t and e = x3 in lookup_asid_pdc_miss_hit_implies_union_hit, simp)\n    apply (simp add: sup_commute)\n  using lookup_in_asid_pdc apply blast\n  apply (rule)\n  using lookup_in_asid_pdc apply blast\n  apply (rule)\n  using lookup_in_asid_pdc apply blast\n  apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split:if_split_asm)\n  by (safe; force)\n\n\nlemma tagged_pdc_entry_set_hit_entry_range:\n  \"tagged_pdc_entry_set t a v = {e} \\<Longrightarrow> (Some a, v) \\<in> asid_range_of_pdc e \\<or> (None, v) \\<in> asid_range_of_pdc e\"\n  apply (clarsimp simp: tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def asid_range_of_pdc_def   split:if_split_asm)\n by force  \n\n\n\nlemma lookup_asid_pdc_hit_mis_hit:\n  \"\\<lbrakk>lookup_pdc (t \\<union> t') a v = Hit e ; lookup_pdc t' a v = Miss \\<rbrakk> \\<Longrightarrow> lookup_pdc t a v = Hit e\"\n  using lookup_asid_pdc_hit_union_cases' by force\n \n\nlemma   lookup_asid_pdc_union_hit_hit_miss :\n  \"\\<lbrakk>lookup_pdc (t \\<union> t') a v = Hit e ;  \\<forall>x\\<in>t. lookup_pdc t a v \\<noteq> Hit x\\<rbrakk> \\<Longrightarrow> lookup_pdc t a v = Miss\"\n  using lookup_asid_pdc_not_hit_miss lookup_in_asid_pdc by blast\n\nlemma lookup_asid_pdc_hit_miss_or_hit :\n  \" lookup_pdc (t \\<union> t') a v = Hit e \\<and> e \\<in> t  \\<Longrightarrow> \n              lookup_pdc t' a v = Miss \\<or> (lookup_pdc t' a v = Hit e)\"\n  using lookup_asid_pdc_union_hit_miss_hit by blast\n\nlemma not_miss_incon_hit_asid_pdc:\n  \"lookup_pdc t a v \\<noteq> Miss \\<Longrightarrow> lookup_pdc t a v = Incon \\<or> (\\<exists>x\\<in>t. lookup_pdc t a v = Hit x)\"\n  by (meson lookup_in_asid_pdc lookup_type.exhaust)\n  \n\n\nlemma  lookup_asid_pdc_hit_union_cases:\n  \"(\\<exists>x\\<in>(t \\<union> t'). lookup_pdc (t \\<union> t') a va = Hit x)  \\<Longrightarrow>\n      ((\\<exists>x\\<in>t. lookup_pdc t a va = Hit x) \\<and> lookup_pdc t' a va = Miss)       \\<or>\n      ((\\<exists>x\\<in>t'. lookup_pdc t' a va = Hit x)  \\<and> lookup_pdc t a va = Miss)      \\<or>\n      ((\\<exists>x\\<in>t. \\<exists>x'\\<in>t'.  lookup_pdc t a va = Hit x  \\<and> lookup_pdc t' a va = Hit x' \\<and>  x = x')) \"\n  by (metis lookup_asid_pdc_hit_union_cases' lookup_asid_pdc_not_hit_hit lookup_asid_pdc_union_hit_hit_miss lookup_in_asid_pdc lookup_type.distinct(3))\n\n\nlemma lookup_asid_pdc_miss_union_equal:\n  \"lookup_pdc t' a v = Miss \\<Longrightarrow> lookup_pdc (t \\<union> t') a v = lookup_pdc t a v\"\n  apply (cases \"lookup_pdc (t \\<union> t') a v\"; clarsimp)\n    apply (drule lookup_asid_pdc_miss_union, simp)\n   apply (drule union_asid_pdc_incon_cases, clarsimp)\n  by (drule lookup_asid_pdc_hit_union_cases', clarsimp)\n\n \n\nlemma lookup_asid_pdc_miss_union_miss_miss:\n  \"\\<lbrakk>lookup_pdc t a v = Miss;  lookup_pdc t' a v = Miss\\<rbrakk> \\<Longrightarrow> \n           lookup_pdc (t \\<union> t') a v = Miss\"\n  by (simp add: lookup_asid_pdc_miss_union_equal)\n\n\nlemma  lookup_asid_pdc_incon_not_miss:\n   \"\\<lbrakk> lookup_pdc (t \\<union> t') a v = Incon ; lookup_pdc t' a v = Miss\\<rbrakk> \\<Longrightarrow> lookup_pdc t a v = Incon\"\n  by (simp add: lookup_asid_pdc_miss_union_equal)\n  \n\nlemma lookup_asid_pdc_hit_diff_union_incon:\n  \"\\<lbrakk>lookup_pdc t a v = Hit e ; lookup_pdc t' a v = Hit e' ; e \\<noteq> e'\\<rbrakk> \\<Longrightarrow> lookup_pdc (t \\<union> t') a v = Incon\"\n  apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def asid_range_of_pdc_def  split: if_split_asm)\n by (metis (no_types, lifting) mem_Collect_eq singletonD singletonI)\n \n\nlemma lookup_asid_pdc_miss_union_hit_intro:\n  \"\\<lbrakk>lookup_pdc t a v = Miss;  lookup_pdc t' a v = Hit e\\<rbrakk> \\<Longrightarrow> \n           lookup_pdc (t \\<union> t') a v = Hit e\"\n  by (metis lookup_asid_pdc_miss_union_equal sup.commute)\n\nlemma lookup_asid_pdc_miss_union_hit_intro':\n  \"\\<lbrakk> lookup_pdc t a v = Hit e ; lookup_pdc t' a v = Miss\\<rbrakk> \\<Longrightarrow> \n           lookup_pdc (t \\<union> t') a v = Hit e\"\n  by (metis inf_sup_aci(5) lookup_asid_pdc_miss_union_hit_intro)\n \n\nlemma lookup_asid_pdc_union_hit_hit:\n  \"\\<lbrakk> lookup_pdc t a v = Hit e ; lookup_pdc t' a v = Hit e\\<rbrakk> \\<Longrightarrow> \n           lookup_pdc (t \\<union> t') a v = Hit e\"\n  apply (cases \"lookup_pdc (t \\<union> t') a v\"; clarsimp)\n  apply (drule lookup_asid_pdc_miss_union, simp)\n   apply (drule union_asid_pdc_incon_cases, clarsimp)\n  by (drule lookup_asid_pdc_hit_union_cases', clarsimp)\n  \n\n\nlemma asid_pdc_not_miss_incon_hit':\n  \"lookup_pdc t a v = Incon \\<or> (\\<exists>e\\<in>t. lookup_pdc t a v = Hit e) \\<Longrightarrow> lookup_pdc t a v \\<noteq> Miss \"\n  by (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n\n\nlemma lookup_asid_pdc_incon_minus:\n  \"lookup_pdc (t - t') a v  = Incon  \\<Longrightarrow> lookup_pdc t a v = Incon\"\n  apply (subgoal_tac \"t - t' \\<subseteq> t\")\n   apply (frule_tac a = a and v = v in asid_pdc_mono)\n   apply clarsimp\n  by blast\n\n\n\nlemma  lookup_asid_pdc_hit_entry_range_asid_tags:\n  \"lookup_pdc t a v = Hit e \\<Longrightarrow> (Some a, v) \\<in> asid_range_of_pdc e \\<or> (None, v) \\<in> asid_range_of_pdc e\"\n  apply (clarsimp simp: lookup_def  tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def  asid_range_of_pdc_def  split:if_split_asm)\n  by force\n\n\n\nlemma  lookup_asid_pdc_hit_asid:\n  \"lookup_pdc t a v = Hit e \\<Longrightarrow> Some a = asid_of_pdc e \\<or> None =  asid_of_pdc e\"\n  apply (clarsimp simp: lookup_def  tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def asid_range_of_pdc_def  split:if_split_asm)\n  by force\n\n\nlemma  lookup_asid_pdc_hit_incon_minus:\n  \"\\<lbrakk>lookup_pdc (t - t') a v = Hit e\\<rbrakk>\n                \\<Longrightarrow> lookup_pdc t a v = Hit e \\<or> lookup_pdc t a v = Incon\"\n  apply (clarsimp simp: lookup_def  tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def asid_range_of_pdc_def  split:if_split_asm)\n  by force\n\n\nlemma  lookup_asid_pdc_not_miss_varange:\n  \"lookup_pdc (t - (\\<Union>v\\<in>vset. {e \\<in> t. v \\<in> range_of e})) a v \\<noteq> Miss \\<Longrightarrow>\n      v \\<notin> vset\"\n  by (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def asid_range_of_pdc_def split:if_split_asm)\n\n\nlemma  lookup_asid_pdc_minus_union:\n  \"\\<lbrakk>lookup_pdc t' a v = Miss; lookup_pdc  t'' a v = Miss \\<rbrakk> \\<Longrightarrow>\n      lookup_pdc (t - t' \\<union> t'') a v = lookup_pdc t a v\"\n  by (metis Un_Diff_cancel2 lookup_asid_pdc_miss_union_equal sup_commute)\n \n\n\nlemma  lookup_asid_pdc_minus_same:\n  \"\\<lbrakk>lookup_pdc t' a v = Miss \\<rbrakk> \\<Longrightarrow> lookup_pdc (t - t') a v = lookup_pdc t a v\"\n  by (metis Un_Diff_cancel2 lookup_asid_pdc_miss_union_equal)\n\nlemma  lookup_asid_pdc_minus_hit':\n  \"\\<lbrakk>lookup_pdc (t - t') a v = Hit e ; lookup_pdc t' a v = Miss \\<rbrakk> \\<Longrightarrow> lookup_pdc t a v = Hit e\"\n  by (metis Un_Diff_cancel2 lookup_asid_pdc_hit_mis_hit lookup_asid_pdc_miss_union_hit_intro')\n\n\n \nlemma  lookup_pdc_minus_union':\n  \"\\<lbrakk>lookup_pdc t' a v = Miss \\<rbrakk> \\<Longrightarrow>\n      lookup_pdc (t - t' \\<union> t'') a v = lookup_pdc (t \\<union> t'') a v\"\nproof -\n  assume \"lookup_pdc t' a v = Miss\"\n  then have \"\\<forall>T Ta. lookup_pdc (Ta \\<union> T) a v = lookup_pdc (Ta \\<union> (T \\<union> t')) a v\"\n    by (metis Un_assoc lookup_asid_pdc_miss_union_equal)\n  then show ?thesis\n    by (metis (no_types) Un_Diff_cancel2 Un_commute)\nqed\n  \n\n\nlemma lookup_asid_pdc_asid_entry_miss:\n  \"a \\<noteq> a' \\<Longrightarrow> lookup_pdc {e \\<in> t. asid_of_pdc e = Some a} a' v = Miss\"\n  by (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def asid_range_of_pdc_def split: if_split_asm)\n \n\nlemma lookup_pdc_minus_smaller_order:\n  \"lookup_pdc (t - t') a v \\<le> lk \\<Longrightarrow> lookup_pdc (t - t'' - t') a v \\<le> lk\"\n  apply (cases lk; clarsimp)\n  apply (metis Diff_mono asid_pdc_mono inf_sup_ord(3) leq_Miss set_double_minus subset_refl)\n  by (metis (no_types, hide_lams) Diff_mono asid_pdc_mono order.trans set_double_minus subset_refl sup_ge1)\n\n\nlemma lookup_pdc_union_minus_equal:\n  \"lookup_pdc b a v = Miss \\<Longrightarrow>\n     lookup_pdc (a' \\<union> b \\<union> c - d) a v = lookup_pdc (a' \\<union> c - d) a v\"\n  apply (case_tac \"lookup_pdc (a' \\<union> b \\<union> c - d) a v\"; clarsimp)\n  subgoal\n  proof -\n    assume \"lookup_pdc (a' \\<union> b \\<union> c - d) a v = Miss\"\n    then have \"\\<exists>T. lookup_pdc (a' \\<union> (c \\<union> T) - d) a v = Miss\"\n      by (metis (no_types) Un_left_commute sup_commute)\n    then show \"Miss = lookup_pdc (a' \\<union> c - d) a v\"\n      by (metis (no_types) Un_Diff lookup_asid_pdc_miss_union sup_assoc)\n  qed\n  subgoal\nproof -\n  assume a1: \"lookup_pdc b a v = Miss\"\n  assume a2: \"lookup_pdc (a' \\<union> b \\<union> c - d) a v = Incon\"\n  have f3: \"\\<forall>P Pa Pb. (P::pdc_entry set) \\<union> Pa - Pb = P \\<union> (Pa - Pb) - Pb\"\n    by (simp add: Un_Diff)\n  have \"lookup_pdc (b \\<union> (a' \\<union> c) - d) a v = Incon\"\n    using a2 by (metis Un_commute sup_assoc)\n  then show \"Incon = lookup_pdc (a' \\<union> c - d) a v\"\n    using f3 a1 by (metis (no_types) Un_commute lookup_asid_pdc_incon_minus lookup_asid_pdc_incon_not_miss)\nqed\n  apply (case_tac \" lookup_pdc d a v\")\n  subgoal\nproof -\n  fix x3 :: pdc_entry\n  assume a1: \"lookup_pdc b a v = Miss\"\n  assume a2: \"lookup_pdc (a' \\<union> b \\<union> c - d) a v = Hit x3\"\n  assume a3: \"lookup_pdc d a v = Miss\"\n  then have \"lookup_pdc (a' \\<union> (b \\<union> c) - d \\<union> d) a v = Hit x3\"\n    using a2 by (metis lookup_asid_pdc_miss_union_hit_intro' sup_commute sup_left_commute)\n  then have \"lookup_pdc (b \\<union> (a' \\<union> (c \\<union> d))) a v = Hit x3\"\n    by (simp add: sup_commute sup_left_commute)\n  then have \"lookup_pdc (a' \\<union> (c \\<union> d)) a v = Hit x3\"\n    using a1 by (metis (no_types) lookup_asid_pdc_hit_mis_hit sup_commute)\n  then have \"lookup_pdc (d \\<union> (a' \\<union> c)) a v = Hit x3\"\n    by (simp add: sup_commute sup_left_commute)\n  then show \"Hit x3 = lookup_pdc (a' \\<union> c - d) a v\"\n    using a3 by (metis (no_types) Un_Diff_cancel lookup_asid_pdc_hit_mis_hit sup_commute)\nqed\n   apply (case_tac \"lookup_pdc (a' \\<union> c - d) a v\"; clarsimp)\n   apply (case_tac \"lookup_pdc (a' \\<union> c) a v\")\n     apply (metis less_eq_lookup_type lookup_asid_pdc_hit_incon_minus \n   lookup_asid_pdc_miss_implies_union_miss lookup_type.distinct(5) lookup_type.simps(3) lookup_type.simps(5) sup.commute sup.left_commute)\n      apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def  split:if_split_asm)\n      apply (safe ; force) [1]                                    \n     apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def  split:if_split_asm)\n  apply (safe ; force) [1]\n  apply (metis Un_Diff Un_upper2 lookup_asid_pdc_incon_subset lookup_type.distinct(5) sup_commute sup_left_commute)\n  apply (metis Hits_le Un_Diff Un_upper2 asid_pdc_mono sup_commute sup_left_commute)\n\n  apply (case_tac \"lookup_pdc (a' \\<union> c) a v\")\n    apply (cases \"lookup_pdc (a' \\<union> c - d) a v\"; clarsimp)\n      apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def  split:if_split_asm)\n      apply (safe ; force) [1]         \n     apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def  split:if_split_asm)\n     apply (safe ; force) [1]         \n    apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def  split:if_split_asm)\n    apply (safe ; force) [1]     \n   apply (cases \"lookup_pdc (a' \\<union> c - d) a v\"; clarsimp)\n     apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def  split:if_split_asm)\n     apply (safe ; force) [1]\n  apply (metis (no_types) Un_Diff lookup_asid_pdc_incon_subset lookup_type.distinct(5) sup_assoc sup_commute sup_ge1)\n  apply (metis Hits_le Un_Diff Un_upper2 asid_pdc_mono sup_commute sup_left_commute)\nproof -\n  fix x3 :: pdc_entry and x3a :: pdc_entry and x3b :: pdc_entry\n  assume a1: \"lookup_pdc (a' \\<union> b \\<union> c - d) a v = Hit x3\"\n  assume a2: \"lookup_pdc b a v = Miss\"\n  have f3: \"\\<forall>P w Pa a Pb. lookup_pdc (P \\<union> Pb - Pa) w a = lookup_pdc (P - Pa) w a \\<or> lookup_pdc (Pb - Pa) w a \\<noteq> Miss\"\n    by (metis (full_types) Un_Diff lookup_asid_pdc_miss_union_equal)\n  have f4: \"\\<forall>P. lookup_pdc (b - P) a v \\<le> Miss\"\n    using a2 by (metis (full_types) Diff_subset asid_pdc_mono)\n  have \"lookup_pdc (a' \\<union> (c \\<union> b) - d) a v = Hit x3\"\n    using a1 by (metis sup_assoc sup_commute)\n  then show \"Hit x3 = lookup_pdc (a' \\<union> c - d) a v\"\n    using f4 f3 by (metis (no_types) less_eq_lookup_type lookup_type.simps(3) sup_assoc)\nqed\n\n\n(* lookup_pdc_union_minus_equal' is being used with these variables later *)\nlemma lookup_pdc_union_minus_equal':\n  \" lookup_pdc t' a v = Miss \\<Longrightarrow>\n     lookup_pdc (t \\<union> t' \\<union> t''' - t'') a v = lookup_pdc (t \\<union> t''' - t'') a v\"\n  by (clarsimp simp: lookup_pdc_union_minus_equal)\n\n\n\n\ntheorem asid_pdc_entry_range_single_element':\n  \" {E \\<in> the ` {e \\<in> t. \\<not> is_fault e}. (a, v) \\<in> asid_range_of_pdc E} = {x} \\<Longrightarrow> \n       (a, v) \\<in> asid_range_of_pdc x \\<and> \\<not> is_fault (Some x) \n         \\<and> (\\<forall>y\\<in>the ` {e \\<in> t. \\<not> is_fault e}. y\\<noteq>x \\<and> \n               \\<not> is_fault (Some y) \\<longrightarrow> (a, v) \\<notin> asid_range_of_pdc y)\" \n  apply safe\n    apply force\n   apply (clarsimp simp: is_fault_def)\n  by force\n\n\nlemma asid_pdc_entry_range_asid_entry:\n  \"(Some a, v) \\<in> asid_range_of_pdc e \\<Longrightarrow> asid_of_pdc e = Some a\"\n  by (clarsimp simp: asid_range_of_pdc_def)\n\n\n\ntheorem  entry_pdc_set_va_set:\n  \"(tagged_pdc_entry_set t a v = {}) = ((Some a, v) \\<notin> tag_vadr_pdc t \\<and> (None, v) \\<notin> tag_vadr_pdc t)\"\n  apply (clarsimp simp: tag_vadr_pdc_def tagged_pdc_entry_set_def asid_range_of_pdc_def entry_set_def asid_of_pdc_def)\n  apply safe\n  by force+\n\n\n\nlemma lookup_asid_pdc_hit_mis_hit':\n  \"\\<lbrakk>lookup_pdc (t \\<union> t') a v = Hit e ; lookup_pdc t a v = Miss \\<rbrakk> \\<Longrightarrow> lookup_pdc t' a v = Hit e\"\n  using lookup_asid_pdc_hit_union_cases' by force\n\n\n\n\n(* global and non_global entries *)\n\n\ndefinition\n  non_global_entries_pdc :: \"pdc \\<Rightarrow> pdc\"\nwhere\n  \"non_global_entries_pdc t =  {e\\<in>t. \\<exists>a. asid_of_pdc e = Some a}\"\n\n\ndefinition\n  global_entries_pdc :: \"pdc \\<Rightarrow> pdc\"\nwhere\n  \"global_entries_pdc t =  {e\\<in>t. asid_of_pdc e = None}\"\n\n\n\n\n\nlemma pdc_global_non_global_union:\n  \"t = non_global_entries_pdc t \\<union> global_entries_pdc t\"\n  apply (clarsimp simp:  non_global_entries_pdc_def global_entries_pdc_def)\n  using UnI1 by auto\n\n\nlemma glb_pdc_subset:\n  \"global_entries_pdc t \\<subseteq> t\"\n  by (clarsimp simp: global_entries_pdc_def)  \n\nlemma non_glb_pdc_subset:\n  \"non_global_entries_pdc t \\<subseteq> t\"\n  by (clarsimp simp: non_global_entries_pdc_def)\n\n\nlemma global_entries_union_pdc:\n  \"global_entries_pdc (tlb \\<union> tlb') = global_entries_pdc tlb \\<union> global_entries_pdc tlb'\"\n  apply (clarsimp simp: global_entries_pdc_def)\n  by blast\n\n\nlemma non_global_to_global_pdc:\n  \"non_global_entries_pdc t = t - global_entries_pdc t\"\n  apply (clarsimp simp: non_global_entries_pdc_def global_entries_pdc_def)\n  apply safe\n  by simp\n\nlemma lookup_global_incon_for_asids_pdc:\n  \"lookup_pdc (global_entries_pdc t) a v = Incon \\<Longrightarrow> lookup_pdc (global_entries_pdc t) a' v = Incon\"\n  apply (case_tac \"a = a'\"; clarsimp?)\n  apply (case_tac \"lookup_pdc (global_entries_pdc t) a' v\"; clarsimp?)\n   apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n   apply force\n apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  by force\n\n\nlemma lookup_global_same_for_asids_pdc:\n  \"lookup_pdc (global_entries_pdc t) a v = lookup_pdc (global_entries_pdc t) a' v\"\n  apply (case_tac \"a = a'\"; clarsimp?)\n  apply (case_tac \"lookup_pdc (global_entries_pdc t) a' v\"; clarsimp?)\n   apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n   apply force\n apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n   apply (safe; force) [1]\n apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  by (safe; force) [1]\n\n\nlemma lookup_global_incon_incon_pdc:\n  \" lookup_pdc (global_entries_pdc t) a v = Incon \\<Longrightarrow> lookup_pdc t a v = Incon\"\n  using glb_pdc_subset lookup_asid_pdc_incon_subset by blast\n\n\nlemma lookup_global_incon_incon_pdc':\n  \"lookup_pdc (global_entries_pdc t) a v = Incon \\<Longrightarrow>  lookup_pdc t a' v = Incon\"\n  apply (case_tac \"a = a'\"; (clarsimp simp: lookup_global_incon_incon_pdc)?)\n  apply (subgoal_tac \"lookup_pdc (global_entries_pdc t) a' v = Incon\")\n   prefer 2\n   apply (clarsimp simp: lookup_global_incon_for_asids_pdc)\n  by (clarsimp simp: lookup_global_incon_incon_pdc)\n  \n\n\n\nlemma  lookup_incon_global_vset_elem:\n   \"\\<lbrakk> {v. lookup_pdc t a v = Incon} \\<subseteq> vset;\n               lookup_pdc (global_entries_pdc t) a' v = Incon  \\<rbrakk> \\<Longrightarrow>  v \\<in> vset\"\n  apply (subgoal_tac \" lookup_pdc t a v = Incon \")\n   apply blast\n  using lookup_global_incon_incon_pdc' by blast\n\n\nlemma lookup_global_hit_asid_of_none_pdc:\n  \"lookup_pdc (global_entries_pdc t) a v = Hit e \\<Longrightarrow> asid_of_pdc e = None\"\n  apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  by force\n\n\n\nlemma lookup_eq_union_global_non_global_pdc:\n  \"lookup_pdc t a v = lookup_pdc (global_entries_pdc t \\<union> non_global_entries_pdc t) a v\"\n  apply (case_tac \"lookup_pdc (global_entries_pdc t \\<union> non_global_entries_pdc t) a v\"; clarsimp)\n    apply (clarsimp simp: global_entries_pdc_def non_global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n    apply  (safe; force) [1]\n   apply (clarsimp simp: global_entries_pdc_def non_global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n   apply  (safe; force) [1]\n  apply (clarsimp simp: global_entries_pdc_def non_global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  by  (safe; force) [1]      \n\nlemma lookup_global_hit_lookup'_pdc:\n  \"lookup_pdc (global_entries_pdc t) a v = Hit e\n       \\<Longrightarrow> lookup' (global_entries_pdc t) v = Hit e\"\n  apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  apply safe\n  by force+\n\nlemma lookup''_global_incon_lookup'_pdc:\n  \"lookup_pdc (global_entries_pdc t) a v = Incon\n       \\<Longrightarrow> lookup' (global_entries_pdc t) v = Incon\"\n  apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  apply safe\n  by force+\n\nlemma interesting_lemma_pdc:\n  \"\\<lbrakk>lookup_pdc (non_global_entries_pdc t) a v = Hit x; lookup' (global_entries_pdc t')  v = Hit x' \\<rbrakk> \\<Longrightarrow>\n    x' \\<noteq> x\"\n  apply (subgoal_tac \"asid_of_pdc x' \\<noteq> asid_of_pdc x\")\n  apply clarsimp\n  apply (clarsimp simp: global_entries_pdc_def non_global_entries_pdc_def \n                   lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  by (metis (mono_tags, lifting) asid_of_pdc_def emptyE insert_iff mem_Collect_eq option.distinct(1))\n\n\nlemma lookup_global_asid_of_none_pdc:\n  \"lookup' (global_entries_pdc t) v = Hit e \\<Longrightarrow> asid_of_pdc e = None\"\n  apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  by force\n  \nlemma lookup_non_global_hit_asid_of_not_none_pdc:\n  \"lookup_pdc (non_global_entries_pdc t) a v = Hit e \\<Longrightarrow> asid_of_pdc e \\<noteq> None\"\n  apply (clarsimp simp: non_global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  by force\n\n\n                                                          \nlemma lookup_miss_minus_miss_pdc:\n  \"lookup_pdc t a v = Miss \\<Longrightarrow> lookup_pdc (t - t') a v = Miss\"\n  by (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  \n\nlemma lookup_miss_minus_miss_hit_pdc:\n  \"lookup_pdc t a v = Hit e \\<Longrightarrow> lookup_pdc (t - t') a v = Miss \\<or> lookup_pdc (t - t') a v = Hit e\"\n  by (metis Diff_subset asid_pdc_mono less_eq_lookup_type lookup_type.simps(7))\n\nlemma pdc_non_global_non_global:\n  \" a \\<union> b = non_global_entries_pdc a \\<union> non_global_entries_pdc b \\<union> (global_entries_pdc a \\<union> global_entries_pdc b)\"\n  apply (clarsimp simp: non_global_entries_pdc_def global_entries_pdc_def)\n  apply safe [1]\n  by force+\n\nlemma tagged_entry_set_to_entry_set_pdc:\n  \"tagged_pdc_entry_set (global_entries_pdc t) a v = entry_set (global_entries_pdc t) v\"\n  apply (clarsimp simp: global_entries_pdc_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def)\n  by blast\n\nlemma lookup_global_miss_entry_set_empty_pdc:\n  \"lookup_pdc (global_entries_pdc t) a v = Miss \\<Longrightarrow>\n    entry_set (global_entries_pdc t) v = {}\"\n  apply (subgoal_tac \"lookup' (global_entries_pdc t)  v = Miss\")\n   apply (clarsimp simp: lookup_def split: if_split_asm)\n  apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def split: if_split_asm)\n  apply safe\n  by force+\n\n\n\nlemma addr_set_minus_non_global_lookup_miss:\n  \"v \\<in> vset \\<Longrightarrow> lookup'' (non_global_entries (t - (\\<Union>v\\<in>vset. {e \\<in> t. v \\<in> range_of e}))) a v = Miss\"\n  apply (subgoal_tac \"tagged_entry_set (non_global_entries (t - (\\<Union>v\\<in>vset. {e \\<in> t. v \\<in> range_of e}))) a v = {}\")\n   apply (clarsimp simp: lookup_def)\n  by (clarsimp simp: non_global_entries_def tagged_entry_set_def entry_set_def) \n\n\n\nlemma non_global_entries_union:\n  \"non_global_entries (tlb \\<union> tlb') = non_global_entries tlb \\<union> non_global_entries tlb'\"\n  apply (clarsimp simp: non_global_entries_def)\n  by blast\n\nlemma non_global_entries_sub:\n  \"non_global_entries (tlb - tlb') = non_global_entries tlb - non_global_entries tlb'\"\n  apply (clarsimp simp: non_global_entries_def)\n  by blast\n\nlemma non_global_entries_union_pdc:\n  \"non_global_entries_pdc (tlb \\<union> tlb') = non_global_entries_pdc tlb \\<union> non_global_entries_pdc tlb'\"\n  apply (clarsimp simp: non_global_entries_pdc_def)\n  by blast\n\nlemma non_global_entries_sub_pdc:\n  \"non_global_entries_pdc (tlb - tlb') = non_global_entries_pdc tlb - non_global_entries_pdc tlb'\"\n  apply (clarsimp simp: non_global_entries_pdc_def)\n  by blast\n\nlemma addr_set_minus_non_global_lookup_miss_pdc:\n  \"v \\<in> vset \\<Longrightarrow> lookup_pdc (non_global_entries_pdc (t - (\\<Union>v\\<in>vset. {e \\<in> t. v \\<in> range_of e}))) a v = Miss\"\n  apply (subgoal_tac \"tagged_pdc_entry_set (non_global_entries_pdc (t - (\\<Union>v\\<in>vset. {e \\<in> t. v \\<in> range_of e}))) a v = {}\")\n   apply (clarsimp simp: lookup_def)\n  by (clarsimp simp: non_global_entries_pdc_def tagged_pdc_entry_set_def entry_set_def) \n\n\n\n\nlemma lookup_sub_asid_of_hit_global:\n  \"lookup'' (t - {e \\<in> t. asid_of e = Some a}) a v = Hit e \\<Longrightarrow>\n        lookup'' (global_entries t) a v = Hit e\"\n  apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def \n                  split: if_split_asm option.splits)\n  by (safe; force)\n\nlemma lookup_sub_asid_of_incon_global:\n  \"lookup'' (t - {e \\<in> t. asid_of e = Some a}) a v = Incon \\<Longrightarrow>\n        lookup'' (global_entries t) a v = Incon\"\n  apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def \n                  split: if_split_asm option.splits)\n  by (safe; force)\n\n                                                        \nlemma lookup_minus_miss_sncd_miss:\n  \"\\<lbrakk> lookup'' (t - t') a v = Miss; lookup'' t' a v = Miss \\<rbrakk> \\<Longrightarrow> lookup'' t  a v = Miss\"\n  apply (clarsimp simp: lookup_def tagged_entry_set_def entry_set_def split: if_split_asm)\n  by (safe; force)\n\n\nlemma lookup_union_miss_sncd_miss:\n  \"\\<lbrakk> lookup'' (t \\<union> t') a v = Miss; lookup'' t' a v = Miss \\<rbrakk> \\<Longrightarrow> lookup'' t  a v = Miss\"\n  apply (clarsimp simp: lookup_def tagged_entry_set_def entry_set_def split: if_split_asm)\n  by (safe; force)\n\n\nlemma asid_unequal_lookup_non_global_asid_flush_pt_walk:\n  \"a' \\<noteq> a \\<Longrightarrow>\n       lookup'' (non_global_entries (t - {e \\<in> t. asid_of e = Some a} \\<union> the ` {e \\<in> range (pt_walk a m r). \\<not> is_fault e})) a' v =\n           lookup'' (non_global_entries t) a' v\"\n  apply (clarsimp simp: non_global_entries_union)\n  apply (subgoal_tac \"lookup'' (non_global_entries (the ` {e \\<in> range (pt_walk a m r). \\<not> is_fault e})) a' v = Miss\")\n   prefer 2\n   apply (rule asid_unequal_lookup_pt_walk_miss, simp)\n  apply (cases \"lookup'' (non_global_entries (t - {e \\<in> t. asid_of e = Some a}) \\<union> non_global_entries (the ` {e \\<in> range (pt_walk a m r). \\<not> is_fault e})) a' v\"; clarsimp?)\n    apply (subgoal_tac \"lookup'' (non_global_entries (t - {e \\<in> t. asid_of e = Some a})) a' v = Miss\")\n     apply (clarsimp simp: non_global_entries_sub)\n     apply (subgoal_tac \"lookup'' (non_global_entries {e \\<in> t. asid_of e = Some a}) a' v = Miss\")\n      apply (drule lookup_minus_miss_sncd_miss, simp, simp)\n     apply (clarsimp simp: non_global_entries_def lookup_def tagged_entry_set_def entry_set_def split: if_split_asm)\n    apply (drule lookup_union_miss_sncd_miss, simp, simp)\n   apply (drule lookup_asid_tlb_incon_not_miss, simp)\n   apply (clarsimp simp: non_global_entries_sub)\n  using lookup_asid_tlb_incon_minus apply force\n  apply (drule lookup_asid_tlb_hit_mis_hit, simp)\n  apply (clarsimp simp: non_global_entries_sub)\n  apply (subgoal_tac \"lookup'' (non_global_entries {e \\<in> t. asid_of e = Some a}) a' v = Miss\")\n   apply (frule lookup_asid_tlb_minus_hit', simp, simp)\n  by (clarsimp simp: non_global_entries_def lookup_def tagged_entry_set_def entry_set_def split: if_split_asm)\n\nlemma asid_unequal_lookup_minus_non_global_hit_hit:\n  \"\\<lbrakk>a \\<noteq> a'; lookup'' (t - {e \\<in> t. asid_of e = Some a}) a' v = Hit e\\<rbrakk>\n       \\<Longrightarrow> lookup'' t a' v = Hit e\"\n  apply (subgoal_tac \"lookup'' ({e \\<in> t. asid_of e = Some a}) a' v = Miss\")\n   prefer 2\n   apply (subgoal_tac \"tagged_entry_set ({e \\<in> t. asid_of e = Some a}) a' v = {}\")\n    apply (clarsimp simp: lookup_def split: if_split_asm)  \n   apply (clarsimp simp:  tagged_entry_set_def entry_set_def split: if_split_asm)\n  by (drule lookup_asid_tlb_minus_hit', simp, simp)\n\n\nlemma lookup_non_global_entries_sub_miss :\n  \"lookup'' (non_global_entries (fst(sat_tlb s) - {e \\<in> fst(sat_tlb s). asid_of e = Some a})) a v = Miss\"\n  apply (subgoal_tac \"tagged_entry_set (non_global_entries (fst(sat_tlb s) - {e \\<in> fst(sat_tlb s). asid_of e = Some a})) a v  = {}\")\n   apply (clarsimp simp: lookup_def )\n  by (clarsimp simp: non_global_entries_def lookup_def tagged_entry_set_def entry_set_def split: if_split_asm)\n\n\n\nlemma lookup_sub_asid_of_hit_global_pdc:\n  \"lookup_pdc (t - {e \\<in> t. asid_of_pdc e = Some a}) a v = Hit e \\<Longrightarrow>\n        lookup_pdc (global_entries_pdc t) a v = Hit e\"\n  apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def \n                  split: if_split_asm option.splits)\n  by (safe; force)\n\n\nlemma lookup_sub_asid_of_incon_global_pdc:\n  \"lookup_pdc (t - {e \\<in> t. asid_of_pdc e = Some a}) a v = Incon \\<Longrightarrow>\n        lookup_pdc (global_entries_pdc t) a v = Incon\"\n  apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def \n                  split: if_split_asm option.splits)\n  by (safe; force)\n\n\nlemma lookup_minus_miss_sncd_miss_pdc:\n  \"\\<lbrakk> lookup_pdc (t - t') a v = Miss; lookup_pdc t' a v = Miss \\<rbrakk> \\<Longrightarrow> lookup_pdc t  a v = Miss\"\n  apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def split: if_split_asm)\n  by (safe; force)\n\n\nlemma lookup_union_miss_sncd_miss_pdc:\n  \"\\<lbrakk> lookup_pdc (t \\<union> t') a v = Miss; lookup_pdc t' a v = Miss \\<rbrakk> \\<Longrightarrow> lookup_pdc t  a v = Miss\"\n  apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def split: if_split_asm)\n  by (safe; force)\n\n\n\n\nlemma asid_unequal_lookup_minus_non_global_hit_hit_pdc:\n  \"\\<lbrakk>a \\<noteq> a'; lookup_pdc (t - {e \\<in> t. asid_of_pdc e = Some a}) a' v = Hit e\\<rbrakk>\n       \\<Longrightarrow> lookup_pdc t a' v = Hit e\"\n  apply (subgoal_tac \"lookup_pdc ({e \\<in> t. asid_of_pdc e = Some a}) a' v = Miss\")\n   prefer 2\n   apply (subgoal_tac \"tagged_pdc_entry_set ({e \\<in> t. asid_of_pdc e = Some a}) a' v = {}\")\n    apply (clarsimp simp: lookup_def split: if_split_asm)  \n   apply (clarsimp simp:  tagged_pdc_entry_set_def entry_set_def split: if_split_asm)\n  by (drule lookup_asid_pdc_minus_hit', simp, simp)\n\n\n\nlemma lookup_non_global_entries_sub_miss_pdc:\n  \"lookup_pdc (non_global_entries_pdc (snd(sat_tlb s) - {e \\<in> snd(sat_tlb s). asid_of_pdc e = Some a})) a v = Miss\"\n  apply (subgoal_tac \"tagged_pdc_entry_set (non_global_entries_pdc (snd(sat_tlb s) - {e \\<in> snd(sat_tlb s). asid_of_pdc e = Some a})) a v  = {}\")\n   apply (clarsimp simp: lookup_def )\n  by (clarsimp simp: non_global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def split: if_split_asm)\n\n\n\nlemma vaddr_elem_lookup_hit_global_entries_hit:\n  \"\\<lbrakk> v \\<in> vset ;  lookup'' (t - (\\<Union>x\\<in>vset. {e \\<in> t. x \\<in> range_of e \\<and> asid_of e = Some a})) a v = Hit e\\<rbrakk>  \\<Longrightarrow>\n     lookup' (global_entries t) v = Hit e\"\n  apply (case_tac \" lookup' (global_entries t) v\"; clarsimp?)\n    apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def split: if_split_asm option.splits)\n    apply (safe ; force) [1]\n   defer\n   apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def split: if_split_asm option.splits)\n   apply (safe ; force) [1]\n  apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def split: if_split_asm option.splits)\n  apply safe \n    apply force\n   apply force\nproof -\n  fix x :: \"tlb_entry\" and xa :: \"tlb_entry\"\n  assume a1: \"v \\<in> vset\"\n  assume a2: \"\\<forall>x. {e \\<in> t. asid_of e = None \\<and> v \\<in> range_of e} \\<noteq> {x}\"\n  assume a3: \"{e \\<in> t. (e \\<in> t \\<longrightarrow> (\\<forall>x\\<in>vset. x \\<notin> range_of e) \\<or> asid_of e \\<noteq> Some a) \\<and> v \\<in> range_of e \\<and> (asid_of e = None \\<or> asid_of e = Some a)} = {e}\"\n  assume \"asid_of x \\<noteq> Some a\"\n  assume \"asid_of x = None\"\n  have \"{ta \\<in> t. (ta \\<in> t \\<longrightarrow> (\\<forall>a. a \\<in> vset \\<longrightarrow> a \\<notin> range_of ta) \\<or> asid_of ta \\<noteq> Some a) \\<and> v \\<in> range_of ta \\<and> (asid_of ta = None \\<or> asid_of ta = Some a)} \\<noteq> {ta \\<in> t. asid_of ta = None \\<and> v \\<in> range_of ta}\"\n    using a3 a2 by (metis (no_types))\n  then show False\n    using a1 by force\nqed\n\n  \n  \n\nlemma vaddr_elem_lookup_incon_global_entries_incon:\n  \"\\<lbrakk> v \\<in> vset ;  lookup'' (t - (\\<Union>x\\<in>vset. {e \\<in> t. x \\<in> range_of e \\<and> asid_of e = Some a})) a v = Incon\\<rbrakk>  \\<Longrightarrow>\n     lookup' (global_entries t) v = Incon\"\n  apply (case_tac \" lookup' (global_entries t) v\"; clarsimp?)\n    apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def split: if_split_asm option.splits)\n    apply (safe ; force) [1]\n   defer\n   apply (clarsimp simp: global_entries_def lookup_def tagged_entry_set_def entry_set_def split: if_split_asm option.splits)\n  by (safe ; force) [1]\n \n\nlemma vaddr_elem_lookup_hit_global_entries_hit_pdc:\n  \"\\<lbrakk> v \\<in> vset ;  lookup_pdc (t - (\\<Union>x\\<in>vset. {e \\<in> t. x \\<in> range_of e \\<and> asid_of_pdc e = Some a})) a v = Hit e\\<rbrakk>  \\<Longrightarrow>\n     lookup' (global_entries_pdc t) v = Hit e\"\n  apply (case_tac \" lookup' (global_entries_pdc t) v\"; clarsimp?)\n    apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def split: if_split_asm option.splits)\n    apply (safe ; force) [1]\n   defer\n   apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def split: if_split_asm option.splits)\n   apply (safe ; force) [1]\n  apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def split: if_split_asm option.splits)\n  apply safe \n    apply force\n   apply force\nproof -\n  fix x :: \"pdc_entry\" and xa :: \"pdc_entry\"\n  assume a1: \"v \\<in> vset\"\n  assume a2: \"\\<forall>x. {e \\<in> t. asid_of_pdc e = None \\<and> v \\<in> range_of e} \\<noteq> {x}\"\n  assume a3: \"{e \\<in> t. (e \\<in> t \\<longrightarrow> (\\<forall>x\\<in>vset. x \\<notin> range_of e) \\<or> asid_of_pdc e \\<noteq> Some a) \\<and> v \\<in> range_of e \\<and> (asid_of_pdc e = None \\<or> asid_of_pdc e = Some a)} = {e}\"\n  assume \"asid_of_pdc x \\<noteq> Some a\"\n  assume \"asid_of_pdc x = None\"\n  have \"{ta \\<in> t. (ta \\<in> t \\<longrightarrow> (\\<forall>a. a \\<in> vset \\<longrightarrow> a \\<notin> range_of ta) \\<or> asid_of_pdc ta \\<noteq> Some a) \\<and> v \\<in> range_of ta \\<and> (asid_of_pdc ta = None \\<or> asid_of_pdc ta = Some a)} \\<noteq> {ta \\<in> t. asid_of_pdc ta = None \\<and> v \\<in> range_of ta}\"\n    using a3 a2 by (metis (no_types))\n  then show False\n    using a1 by force\nqed\n\nlemma vaddr_elem_lookup_incon_global_entries_incon_pdc:\n  \"\\<lbrakk> v \\<in> vset ;  lookup_pdc (t - (\\<Union>x\\<in>vset. {e \\<in> t. x \\<in> range_of e \\<and> asid_of_pdc e = Some a})) a v = Incon\\<rbrakk>  \\<Longrightarrow>\n     lookup' (global_entries_pdc t) v = Incon\"\n  apply (case_tac \" lookup' (global_entries_pdc t) v\"; clarsimp?)\n    apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def split: if_split_asm option.splits)\n    apply (safe ; force) [1]\n   defer\n   apply (clarsimp simp: global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def split: if_split_asm option.splits)\n  by (safe ; force) [1]\n\n\n\n\n\n\n\n(* page table walk simplification lemmas *)\n\nlemma asid_entry_pdc_walk [simp]:\n  \"pdc_walk a m r v \\<noteq> None \\<Longrightarrow> asid_of_pdc (the (pdc_walk a m r v)) = Some a \\<or> asid_of_pdc (the (pdc_walk a m r v)) = None\"\n  by (clarsimp simp: pdc_walk_def Let_def asid_of_pdc_def tag_conv_def split: option.splits pde.splits)\n\n\nlemma asid_entry_pdc_walk_tlb_entry [simp]:\n  \"\\<lbrakk>pdc_walk a m r v = Some pe; pde_tlb_entry pe m v = Some te\\<rbrakk> \\<Longrightarrow> asid_of te = Some a \\<or> asid_of te = None\"\n  by (clarsimp simp: pdc_walk_def pte_tlb_entry_def asid_of_pdc_def tag_conv_def\n                 split: option.splits pde.splits pte.splits if_split_asm)\n\n\n\nlemma pdc_walk_asid [simp, intro!]:\n  \"pdc_walk a m r v = Some e \\<Longrightarrow> asid_of_pdc (the (pdc_walk a m r v)) = Some a \\<or> asid_of_pdc (the (pdc_walk a m r v)) = None\"\n  by (clarsimp simp: pdc_walk_def is_fault_def asid_of_pdc_def tag_conv_def split: option.splits pde.splits if_split_asm)\n\n\nlemma pdc_asid_entry_range [simp, intro!]:\n  \"pdc_walk a m r v \\<noteq> None \\<Longrightarrow> v \\<in> range_of (the (pdc_walk a m r v))\"\n  apply (clarsimp simp: pdc_walk_def Let_def range_of_pdc_entry_def split: option.splits pde.splits ) \n   apply (metis (no_types, hide_lams) Addr_addr_val atLeastAtMost_iff image_iff va_20_left va_20_right)\n  by (metis (no_types, hide_lams) Addr_addr_val atLeastAtMost_iff image_iff va_20_left va_20_right)\n\n\n\nlemma lookup_pdc_miss_inser_no_fault:\n  \"\\<lbrakk>lookup_pdc p a v = Miss ;  pdc_walk a m r v \\<noteq> None \\<rbrakk> \\<Longrightarrow>\n    lookup_pdc (insert (the(pdc_walk a m r v)) p) a v = Hit (the (pdc_walk a m r v)) \"\n  apply (clarsimp simp: lookup_def  split: if_split_asm) \n  by (metis (no_types, hide_lams) asid_entry_pdc_walk insert_not_empty is_singleton_def is_singleton_the_elem \n            not_Some_eq option.sel pdc_asid_entry_range pdc_walk_def tagged_pdc_entry_set_insert the_elem_eq)\n \n\nlemma pt_walk'_pt_walk:\n  \"pt_walk asid heap ttbr0 v = pt_walk' asid heap ttbr0 v\"\n  apply (clarsimp simp: pt_walk'_def pt_walk_def pdc_walk_def pte_tlb_entry_def  map_opt_def\n                        word_extract_def word_bits_def  mask_def split:option.splits pde.splits pte.splits )\n  by word_bitwise\n\n\nlemma pdc_walk_pt_walk_is_fault:\n  \"\\<lbrakk> pdc_walk a m r v = Some pde; is_fault (pde_tlb_entry pde m v) \\<rbrakk> \\<Longrightarrow>\n      is_fault (pt_walk a m r v)\"\n  apply (simp only: pt_walk'_pt_walk)\n  by (clarsimp simp: is_fault_def pt_walk'_def map_opt_def split: option.splits)\n\nlemma pdc_walk_pt_walk_not_is_fault:\n  \"\\<lbrakk> pdc_walk a m r v = Some pde; \\<not>is_fault (pde_tlb_entry pde m v) \\<rbrakk> \\<Longrightarrow>\n      \\<not>is_fault (pt_walk a m r v)\"\n  apply (simp only: pt_walk'_pt_walk)\n  by (clarsimp simp: is_fault_def pt_walk'_def map_opt_def split: option.splits)\n\nlemma pdc_entry_pt_walk:\n   \"pdc_walk a m r v = Some pde \\<Longrightarrow>\n    pde_tlb_entry pde m v = pt_walk a m r v\"\n  apply (simp only: pt_walk'_pt_walk)\n  by (clarsimp simp:  pt_walk'_def map_opt_def split: option.splits)\n\n\nlemma pdc_entry_pt_walk'':\n   \"\\<not>is_fault (pdc_walk a m r v) \\<Longrightarrow>\n    pde_tlb_entry (the (pdc_walk a m r v)) m v = pt_walk a m r v\"\n  apply (simp only: pt_walk'_pt_walk)\n  by (clarsimp simp: is_fault_def pt_walk'_def map_opt_def split: option.splits)\n\n\nlemma asid_va_entry_range_pt_entry_pde:\n  \"\\<not>is_fault(pdc_walk a m r v) \\<Longrightarrow> \n      (Some a, v) \\<in> asid_range_of_pdc (the(pdc_walk a m r v)) \\<or> (None, v) \\<in> asid_range_of_pdc (the(pdc_walk a m r v))\"\n  apply (clarsimp simp: asid_range_of_pdc_def is_fault_def)\n  by (metis asid_entry_pdc_walk domIff dom_iff handy_if_lemma is_some_simps(2) option.sel option.simps(3))\n\n\nlemma no_fault_pt_no_fault_pde:\n  \"\\<not>is_fault (pt_walk a m r va) \\<Longrightarrow> \\<not>is_fault (pdc_walk a m r va)\"\n  apply (simp only: pt_walk'_pt_walk)\n  by (clarsimp simp: is_fault_def pt_walk'_def map_opt_def split: option.splits)\n\nlemma is_fault_pde_is_fault_pt :\n  \"is_fault (pdc_walk a m r va) \\<Longrightarrow> is_fault (pt_walk a m r va)\"\n  apply (simp only: pt_walk'_pt_walk)\n  by (clarsimp simp: is_fault_def pt_walk'_def map_opt_def split: option.splits)\n\n\nlemma  va_pdc_entry_set_pt_palk_same:\n  \"\\<lbrakk>\\<not>is_fault (pdc_walk a m r x) ;  (Some a, va) \\<in> asid_range_of_pdc (the (pdc_walk a m r x)) \\<or> (None , va) \\<in> asid_range_of_pdc (the (pdc_walk a m r x))\\<rbrakk> \\<Longrightarrow>\n              the(pdc_walk a m r x) = the(pdc_walk a m r va)\"\n  apply (subgoal_tac \"(Some a, x) \\<in> asid_range_of_pdc (the(pdc_walk a m r x)) \\<or> (None , x) \\<in> asid_range_of_pdc (the (pdc_walk a m r x))\")\n   prefer 2\n   apply (clarsimp simp: asid_va_entry_range_pt_entry_pde split: pdc_entry.splits)\n  apply (subgoal_tac \"get_pde m r x = get_pde m r va\" )\n   apply (clarsimp simp: range_of_pdc_entry_def asid_range_of_pdc_def asid_of_pdc_def pdc_walk_def is_fault_def tag_conv_def va_offset_higher_bits_1 split: option.splits pde.splits if_split_asm)\n  apply (clarsimp simp: range_of_pdc_entry_def asid_range_of_pdc_def asid_of_pdc_def pdc_walk_def is_fault_def tag_conv_def  split: option.splits pde.splits if_split_asm)\n    apply (clarsimp simp: get_pde_def vaddr_pd_index_def)\n    apply (subgoal_tac \"((addr_val x >> 20) && mask 12 << 2) =  ((addr_val va >> 20) && mask 12 << 2) \")\n     prefer 2 \n  using shfit_mask_eq apply force\n    apply force\n   apply (clarsimp simp: get_pde_def vaddr_pd_index_def)\n   apply (subgoal_tac \"((addr_val x >> 20) && mask 12 << 2) =  ((addr_val va >> 20) && mask 12 << 2) \")\n    prefer 2 \n  using shfit_mask_eq apply force\n   apply force\n  apply (clarsimp simp: get_pde_def vaddr_pd_index_def)\n  apply (subgoal_tac \"((addr_val x >> 20) && mask 12 << 2) =  ((addr_val va >> 20) && mask 12 << 2) \")\n   prefer 2 \n  using shfit_mask_eq apply force\n  by force\n \n\nlemma  va_pdc_entry_set_pt_palk_same':\n  \"\\<lbrakk>\\<not>is_fault (pdc_walk a m r x) ;  (Some a, va) \\<in> asid_range_of_pdc (the (pdc_walk a m r x))  \\<or> (None , va) \\<in> asid_range_of_pdc (the (pdc_walk a m r x))\\<rbrakk> \\<Longrightarrow>\n              pdc_walk a m r x = pdc_walk a m r va\"\n  apply (subgoal_tac \"(Some a, x) \\<in> asid_range_of_pdc (the(pdc_walk a m r x)) \\<or> (None , x) \\<in> asid_range_of_pdc (the (pdc_walk a m r x))\")\n   prefer 2\n   apply (clarsimp simp:  asid_va_entry_range_pt_entry_pde split: pdc_entry.splits)\n  apply (subgoal_tac \"get_pde m r x = get_pde m r va\" )\n   apply (clarsimp simp: range_of_pdc_entry_def asid_range_of_pdc_def asid_of_pdc_def pdc_walk_def is_fault_def tag_conv_def va_offset_higher_bits_1 split: option.splits pde.splits if_split_asm)\n  apply (clarsimp simp: range_of_pdc_entry_def asid_range_of_pdc_def asid_of_pdc_def pdc_walk_def is_fault_def tag_conv_def  split: option.splits pde.splits if_split_asm)\n    apply (clarsimp simp: get_pde_def vaddr_pd_index_def)\n    apply (subgoal_tac \"((addr_val x >> 20) && mask 12 << 2) =  ((addr_val va >> 20) && mask 12 << 2) \")\n     prefer 2 \n  using shfit_mask_eq apply force\n    apply force\n   apply (clarsimp simp: get_pde_def vaddr_pd_index_def)\n   apply (subgoal_tac \"((addr_val x >> 20) && mask 12 << 2) =  ((addr_val va >> 20) && mask 12 << 2) \")\n    prefer 2 \n  using shfit_mask_eq apply force\n   apply force\n  apply (clarsimp simp: get_pde_def vaddr_pd_index_def)\n  apply (subgoal_tac \"((addr_val x >> 20) && mask 12 << 2) =  ((addr_val va >> 20) && mask 12 << 2) \")\n   prefer 2 \n  using shfit_mask_eq apply force\n  by force\n\n\ntheorem entry_range_single_element':\n  \" {E \\<in> the ` {e \\<in> t. \\<not> is_fault e}. (a, v) \\<in> asid_range_of E} = {x} \\<Longrightarrow> \n       (a, v) \\<in> asid_range_of x \\<and> \\<not> is_fault (Some x) \n         \\<and> (\\<forall>y\\<in>the ` {e \\<in> t. \\<not> is_fault e}. y\\<noteq>x \\<and> \n               \\<not> is_fault (Some y) \\<longrightarrow> (a, v) \\<notin> asid_range_of y)\" \n  apply safe\n    apply force\n   apply (clarsimp simp: is_fault_def)\n  by force\n\n\n\n\nlemma lookup_pdc_range_fault_pt_walk:\n  \"\\<lbrakk>lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v = Hit x\\<rbrakk>  \\<Longrightarrow> \n          \\<forall>va\\<in> range_of x. x = the (pdc_walk a m r va)\"\n  apply (subgoal_tac \"x \\<in> the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}\")\n   prefer 2\n  using lookup_in_asid_pdc apply blast\n  apply clarsimp\n  apply (rule va_pdc_entry_set_pt_palk_same, simp)\n  apply (clarsimp simp: asid_range_of_pdc_def is_fault_def)\n  using pdc_walk_asid by force\n\n\ntheorem pdc_entry_range_single_elementI':\n  \"\\<lbrakk>x\\<in> the ` {e \\<in> range (pdc_walk asid mem ttbr0). \\<not> is_fault e} ; \\<not> is_fault (Some x) ; (a, v) \\<in> asid_range_of_pdc x ; \n    (\\<forall>y\\<in>the ` {e \\<in> range (pdc_walk asid mem ttbr0). \\<not> is_fault e}. y\\<noteq>x \\<longrightarrow> (a, v) \\<notin> asid_range_of_pdc y) \\<rbrakk> \\<Longrightarrow> \n           {E \\<in> the ` {e \\<in> range (pdc_walk asid mem ttbr0). \\<not> is_fault e}. (a, v) \\<in> asid_range_of_pdc E} = {x}\" \n  by force\n\n\ntheorem asid_entry_range_single_element_pdc:\n  \" {E \\<in> the ` {e \\<in> t. \\<not> is_fault e}. v \\<in> range_of E \\<and> (asid_of_pdc E = None \\<or> asid_of_pdc E = Some a)} = {x} \\<Longrightarrow> \n       v \\<in> range_of x \\<and> (asid_of_pdc x = None \\<or> asid_of_pdc x = Some a) \\<and> \\<not> is_fault (Some x) \n         \\<and> (\\<forall>y\\<in>the ` {e \\<in> t. \\<not> is_fault e}. y\\<noteq>x \\<and> \n               \\<not> is_fault (Some y) \\<longrightarrow> ((Some a, v) \\<notin> asid_range_of_pdc y \\<and> (None, v) \\<notin> asid_range_of_pdc y))\" \n  apply safe\n     apply force\n    apply (clarsimp simp: is_fault_def)\n    apply force\n   apply (simp add: is_fault_def)\n  apply (clarsimp simp: asid_range_of_pdc_def)\n   apply force\n apply (clarsimp simp: asid_range_of_pdc_def)\n  by force\n\n\ntheorem asid_pdc_range_single_elementI':\n  \"\\<lbrakk>x\\<in> t ; (Some a, v) \\<in> asid_range_of_pdc x \\<or> (None, v) \\<in> asid_range_of_pdc x ;\n     (\\<forall>y\\<in>t. y\\<noteq>x \\<longrightarrow> (Some a, v) \\<notin> asid_range_of_pdc y \\<and> (None, v) \\<notin> asid_range_of_pdc y) \\<rbrakk> \\<Longrightarrow> \n         {E \\<in> t.  v \\<in> range_of E \\<and> (asid_of_pdc E = None \\<or> asid_of_pdc E = Some a)} = {x}\" \n   apply (clarsimp simp: asid_range_of_pdc_def) by force\n\n\n lemma  va_entry_set_pdc_walk_same':\n  \"\\<lbrakk>\\<not>is_fault (pdc_walk asid m r x) ;\n           va \\<in> range_of (the (pdc_walk asid m r x))\\<rbrakk> \\<Longrightarrow>\n              pdc_walk asid m r x = pdc_walk asid m r va\"\n   apply (subgoal_tac \"x \\<in> range_of (the(pdc_walk asid m r x))\")\n    prefer 2\n    apply (clarsimp simp:  is_fault_def)\n   apply (cases \"the (pdc_walk asid m r x)\")\n    apply (simp only: )\n    apply (clarsimp simp:   range_of_pdc_entry_def  is_fault_def)\n    apply (cases \"get_pde m r x\" ; clarsimp simp: pdc_walk_def)\n    apply (case_tac a ; clarsimp)\n    apply (subgoal_tac \"get_pde m r (Addr xaa) = get_pde m r (Addr xa)\" ; clarsimp)\n     apply (cases \"get_pde m r x\" ; clarsimp)\n     apply (subgoal_tac \"get_pde m r (Addr xaa) = get_pde m r (Addr xa)\" ; clarsimp)\n   using va_offset_higher_bits_1 apply blast\n    apply (clarsimp simp: get_pde_def vaddr_pd_index_def)\n    apply (subgoal_tac \"((xaa >> 20) && mask 12 << 2) = ((xa >> 20) && mask 12 << 2)\")\n     apply force\n   using shfit_mask_eq apply force\n   apply (simp only: )\n   apply (clarsimp simp:   range_of_pdc_entry_def  is_fault_def)\n   apply (cases \"get_pde m r x\" ; clarsimp simp: pdc_walk_def)\n   apply (case_tac a ; clarsimp)\n   apply (subgoal_tac \"get_pde m r (Addr xaa) = get_pde m r (Addr xa)\" ; clarsimp)\n    apply (cases \"get_pde m r x\" ; clarsimp)\n    apply (subgoal_tac \"get_pde m r (Addr xaa) = get_pde m r (Addr xa)\" ; clarsimp)\n   using va_offset_higher_bits_1 apply blast\n   apply (clarsimp simp: get_pde_def vaddr_pd_index_def)\n   apply (subgoal_tac \"((xaa >> 20) && mask 12 << 2) = ((xa >> 20) && mask 12 << 2)\")\n    apply force\n   using shfit_mask_eq by force\n\n\n\nlemma lookup_pdc_range_pt_walk_hit:\n  \"\\<not> is_fault (pdc_walk asid mem ttbr0  va) \\<Longrightarrow> \n        lookup_pdc (the ` {e \\<in> range (pdc_walk asid mem ttbr0). \\<not> is_fault e}) asid va = Hit (the (pdc_walk asid mem ttbr0  va))\"\n apply (clarsimp simp: lookup_def)\n  apply safe\n    apply simp apply clarsimp\n   apply (subgoal_tac \"x = the (pdc_walk asid mem ttbr0 va)\" , force)\n   apply (clarsimp simp: tagged_pdc_entry_set_def entry_set_def)\n   apply (drule asid_entry_range_single_element_pdc)\n   apply safe\n    apply (unfold Ball_def) [1]\n    apply (erule_tac x = \"the (pdc_walk asid mem ttbr0  va)\" in allE)\n    apply (clarsimp simp:  is_fault_def asid_range_of_pdc_def)\n    apply (metis  asid_entry_pdc_walk option.distinct(1) option.sel)\n   apply (unfold Ball_def) [1]\n   apply (erule_tac x = \"the (pdc_walk asid mem ttbr0  va)\" in allE)\n   apply (clarsimp simp:  is_fault_def asid_range_of_pdc_def)\n  apply (metis asid_entry_pdc_walk  handy_if_lemma  option.sel option.simps(3))\n  apply (rule_tac x = \"the (pdc_walk asid mem ttbr0 va)\" in exI)\n  apply (clarsimp simp: tagged_pdc_entry_set_def entry_set_def)\n  apply (rule asid_pdc_range_single_elementI')\n    apply force\n   apply (clarsimp simp:  is_fault_def asid_range_of_pdc_def) \n  apply (metis asid_entry_pdc_walk domIff dom_iff handy_if_lemma is_some_simps(2) option.distinct(1) option.sel)\n  apply (clarsimp simp:  is_fault_def asid_range_of_pdc_def)\n  by (metis is_fault_def option.discI  option.sel  va_entry_set_pdc_walk_same')\n  \n\nlemma  lookup_pdc_walk_not_incon:\n  \"lookup_pdc (the ` {e \\<in> range (pdc_walk asid mem ttbr0). \\<not> is_fault e}) asid va \\<noteq> Incon\"\n apply (case_tac \"\\<not>is_fault (pdc_walk asid mem ttbr0 va)\")\n   apply (clarsimp simp: lookup_pdc_range_pt_walk_hit)\n  apply clarsimp\n  apply (subgoal_tac \" lookup_pdc (the ` {e \\<in> pdc_walk asid mem ttbr0 ` top. \\<not> is_fault e}) asid va = Miss\")\n   apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def  split: if_split_asm)\n  apply (thin_tac \"lookup_pdc (the ` {e \\<in> range (pdc_walk asid mem ttbr0). \\<not> is_fault e}) asid va = Incon\")\n  apply (subgoal_tac \"tagged_pdc_entry_set (the ` {e \\<in> range (pdc_walk asid mem ttbr0). \\<not> is_fault e}) asid va = {}\")\n   apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def  split: if_split_asm)\n  apply (clarsimp simp: entry_pdc_set_va_set tag_vadr_pdc_def)\n  apply safe \n   apply (subgoal_tac \"pdc_walk asid mem ttbr0 xa = pdc_walk asid mem ttbr0 va\", simp)\n   apply (thin_tac \"is_fault (pdc_walk asid mem ttbr0 va)\") \n   apply (frule_tac va = va in va_pdc_entry_set_pt_palk_same'; clarsimp)\n  apply (subgoal_tac \"pdc_walk asid mem ttbr0  xa = pdc_walk asid mem ttbr0 va\", simp)\n  apply (thin_tac \"is_fault (pdc_walk asid mem ttbr0 va)\") \n  by (frule_tac va = va in va_pdc_entry_set_pt_palk_same'; clarsimp)\n \n\nlemma lookup_pdc_hit_range_pdes:\n  \"lookup_pdc (the ` {e \\<in> range (pdc_walk a mem ttbr0). \\<not> is_fault e}) a va = Hit pde \\<Longrightarrow>\n     pde = the (pdc_walk a mem ttbr0 va) \"\n  apply (frule lookup_pdc_range_fault_pt_walk)\n  apply (drule_tac x = va in bspec)\n  using lookup_asid_pdc_hit_entry_range apply blast\n  by blast\n  \n\nlemma pdc_walk_set_simp:\n  \"{e. (\\<exists>x. e = pdc_walk a mem ttbr0 x) \\<and> \\<not> is_fault e} =\n   {e \\<in> range (pdc_walk a mem ttbr0). \\<not> is_fault e}\"\n  by blast\n \n\n\nlemma pdc_entry_set_empty_lookup_pdc:\n  \"tagged_pdc_entry_set (the ` {e \\<in> range (pdc_walk a mem ttbr0). \\<not> is_fault e}) a xa = {} \\<Longrightarrow>\n         lookup_pdc (the ` {e \\<in> range (pdc_walk a mem ttbr0). \\<not> is_fault e}) a xa = Miss\"\n  by (clarsimp simp: lookup_def)\n\n\nlemma lookup_pdc_miss_is_fault_intro:\n  \"is_fault (pdc_walk a m r v) \\<Longrightarrow>\n     lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v = Miss\"\n apply (rule pdc_entry_set_empty_lookup_pdc)\n  apply (clarsimp simp: entry_pdc_set_va_set)\n  apply (clarsimp simp: tag_vadr_pdc_def)\n  apply safe\n  apply (subgoal_tac \"pdc_walk a m r xa = pdc_walk a m r v\", simp)\n  apply (thin_tac \"is_fault (pdc_walk a m r v)\") \n   apply (frule_tac va = v in va_pdc_entry_set_pt_palk_same'; clarsimp)\n apply (subgoal_tac \"pdc_walk a m r xa = pdc_walk a m r v\", simp)\n  apply (thin_tac \"is_fault (pdc_walk a m r v)\") \n  by (frule_tac va = v in va_pdc_entry_set_pt_palk_same'; clarsimp)\n \n  \n\nlemma  tlb_pde_union_walk [simp]:\n  \"{e. (\\<exists>x. e \\<in> tlb_pdc_walk a (the ` {e \\<in> range (pdc_walk a mem ttbr0). \\<not> is_fault e}) mem ttbr0 x) \\<and> \\<not> is_fault e} = \n         {e\\<in>pt_walk a mem ttbr0 ` UNIV. \\<not>is_fault e}\"\n  apply safe\n   apply (clarsimp simp: tlb_pdc_walk_def lookup_pdc_walk_not_incon split: lookup_type.splits)\n   apply (subgoal_tac \"x3 = the (pdc_walk a mem ttbr0 xa)\")\n    prefer 2\n    apply (rule lookup_pdc_hit_range_pdes, simp add: pdc_walk_set_simp)\n   apply clarsimp\n   apply (case_tac \"\\<not> is_fault (pdc_walk a mem ttbr0 xa)\")\n    prefer 2 \n    apply (clarsimp simp: lookup_pdc_miss_is_fault_intro)\n   apply (clarsimp simp: image_iff)\n   apply (case_tac \"the (pdc_walk a mem ttbr0 xa)\"; clarsimp)\n    apply (rule_tac x = xa in exI)\n    apply (simp only: pt_walk'_pt_walk)\n    apply (clarsimp simp: pt_walk'_def map_opt_def is_fault_def split: option.splits)\n   apply (rule_tac x = xa in exI)\n   apply (simp only: pt_walk'_pt_walk)\n   apply (clarsimp simp: pdc_walk_def pt_walk'_def map_opt_def is_fault_def split:option.splits)\n  apply (rename_tac va)\n  apply (rule_tac x = va in exI)\n  apply (clarsimp simp:  tlb_pdc_walk_def split: lookup_type.splits)\n  apply (rule conjI)\n   apply (clarsimp simp: lookup_pdc_walk_not_incon)\n  apply (clarsimp)\n  apply (subgoal_tac \"x3 = the (pdc_walk a mem ttbr0 va)\")\n   prefer 2\n   apply (clarsimp simp: lookup_pdc_hit_range_pdes)\n  apply (simp only: pt_walk'_pt_walk)\n  by (case_tac x3; clarsimp simp:  pt_walk'_def pdc_walk_def map_opt_def  is_fault_def split:option.splits pde.splits)\n   \n\n\nlemma lookup_pdc_miss_is_fault:\n  \"lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v = Miss \\<Longrightarrow>\n       is_fault (pdc_walk a m r v)\"\n   apply (clarsimp simp: lookup_def tagged_pdc_entry_set_def entry_set_def asid_of_pdc_def  split: if_split_asm)\n  apply (drule_tac x = \"the (pdc_walk a m r v)\" in spec)\n  by (metis (no_types, lifting) UNIV_I asid_entry_pdc_walk asid_of_pdc_def \n     image_eqI is_fault_def mem_Collect_eq option.simps(3) pdc_asid_entry_range)\n\n\n\n\n\n(* asid_unequal_miss' *)\n\n\n\n\nlemma pt_walk_new_fault_pt_walk_fault:\n  \"pt_walk_pair a m r v = Fault \\<Longrightarrow> is_fault (pt_walk a m r v)\"\n  apply (simp only: pt_walk'_pt_walk)\n  by (clarsimp simp: pt_walk_pair_def is_fault_def pt_walk'_def map_opt_def split: option.splits pde.splits) \n  \n\nlemma pt_walk_new_fault_pde_walk_fault:\n  \"pt_walk_pair a m r v = Fault \\<Longrightarrow> is_fault (pdc_walk a m r v)\"\n  by (clarsimp simp: pt_walk_pair_def is_fault_def pdc_walk_def split: option.splits pde.splits pte.splits)\n\nlemma  pt_walk_new_fault_pt_walk_fault':\n  \"\\<lbrakk>pt_walk_pair a m rt v = Fault\\<rbrakk> \\<Longrightarrow> pt_walk a m rt v = None\"\n  apply (simp only: pt_walk'_pt_walk)\n  by (clarsimp simp: pt_walk_pair_def is_fault_def pt_walk'_def map_opt_def split: option.splits pde.splits)\n\n\nlemma  pt_walk_new_fault_pdc_walk_fault':\n  \"\\<lbrakk>pt_walk_pair a m rt v = Fault\\<rbrakk> \\<Longrightarrow> pdc_walk a m rt v = None\"\n  by (clarsimp simp: pt_walk_pair_def pdc_walk_def split: option.splits pde.splits pte.splits)\n\n\nlemma pt_walk_new_par_fault_pt_walk_fault:\n  \"\\<lbrakk>pt_walk_pair a m r v = Partial_Walk y\\<rbrakk> \\<Longrightarrow> is_fault (pt_walk a m r v)\"\n  apply (simp only: pt_walk'_pt_walk)\n   by (clarsimp simp: pt_walk_pair_def is_fault_def pt_walk'_def map_opt_def split: option.splits pde.splits)\n\n\nlemma pt_walk_new_par_fault_pt_walk_fault':\n  \"\\<lbrakk>pt_walk_pair a m r v = Partial_Walk y\\<rbrakk> \\<Longrightarrow> pt_walk a m r v = None\"\n  apply (simp only: pt_walk'_pt_walk)\n   by (clarsimp simp: pt_walk_pair_def is_fault_def pt_walk'_def map_opt_def split: option.splits pde.splits)\n\n\nlemma pt_walk_new_par_fault_pdc_walk:\n  \"\\<lbrakk>pt_walk_pair a m r v = Partial_Walk y\\<rbrakk> \\<Longrightarrow> pdc_walk a m r v = Some y\"\n  by (clarsimp simp: pt_walk_pair_def is_fault_def pdc_walk_def split: option.splits pde.splits pte.splits)\n\n\nlemma pt_walk_new_no_fault_pt_walk':\n  \"\\<lbrakk>pt_walk_pair a m rt v = Full_Walk entry entry'\\<rbrakk> \\<Longrightarrow> pt_walk a m rt v = Some entry\"\n  apply (simp only: pt_walk'_pt_walk)\n  by (clarsimp simp: pt_walk_pair_def pt_walk'_def map_opt_def split: option.splits pde.splits pte.splits)\n \n\nlemma pt_walk_new_no_fault_pdc_walk:\n  \"\\<lbrakk>pt_walk_pair a m rt v = Full_Walk entry entry'\\<rbrakk> \\<Longrightarrow> pdc_walk a m rt v = Some entry'\"\n  by (clarsimp simp: pt_walk_pair_def pdc_walk_def split: option.splits pde.splits pte.splits)\n \n\n \nlemma pt_walk_new_equal_pt_walk:\n  \"pt_walk_pair a m rt v = pt_walk_pair a' m' rt' v \\<Longrightarrow> pt_walk a m rt v = pt_walk a' m' rt' v\"\n  by (cases \"pt_walk_pair a m rt v\"; cases \"pt_walk_pair a' m' rt' v\";\n               clarsimp simp: pt_walk_new_fault_pt_walk_fault' pt_walk_new_par_fault_pt_walk_fault'\n                              pt_walk_new_no_fault_pt_walk')\n\n\nlemma pt_walk_new_equal_pdc_walk:\n  \"pt_walk_pair a m rt v = pt_walk_pair a' m' rt' v \\<Longrightarrow> pdc_walk a m rt v = pdc_walk a' m' rt' v\"\n  by (cases \"pt_walk_pair a m rt v\"; cases \"pt_walk_pair a' m' rt' v\";\n               clarsimp simp: pt_walk_new_fault_pdc_walk_fault' pt_walk_new_par_fault_pdc_walk\n                              pt_walk_new_no_fault_pdc_walk)\n\nlemma pt_walk_partial_full_pdc_walk_eq:\n  \"\\<lbrakk>pt_walk_pair a m r v = Partial_Walk y; pt_walk_pair a' m' r' v = Full_Walk x y \\<rbrakk> \\<Longrightarrow>\n                     pdc_walk a m r v = pdc_walk a' m' r' v\"\n  by (cases \"pt_walk_pair a m r v\"; cases \"pt_walk_pair a' m' r' v\"; clarsimp simp: pt_walk_new_par_fault_pdc_walk\n                      pt_walk_new_no_fault_pdc_walk)\n\n\nlemma pdc_entry_range_asid_entry:\n  \"(a, v) \\<in> asid_range_of_pdc (e::pdc_entry) \\<Longrightarrow> asid_of_pdc e = a\"\n  by (clarsimp simp: asid_range_of_pdc_def)\n\n\n\ndefinition\n  \"consistent0' m asid ttbr0 tlb pdc va \\<equiv>\n     ((lookup'' tlb asid va = Hit (the (pt_walk asid m ttbr0 va)) \\<and> \\<not>is_fault (pt_walk asid m ttbr0 va)) \\<or> \n       lookup'' tlb asid va = Miss) \\<and>\n     ((lookup_pdc pdc asid va = Hit (the (pdc_walk asid m ttbr0 va)) \\<and> \\<not>is_fault (pdc_walk asid m ttbr0 va)) \\<or>\n        lookup_pdc pdc asid va = Miss )\"\n\nlemma consistent_not_Incon_imp':\n  \"consistent0' m asid ttbr0 tlb pde_set va \\<Longrightarrow>\n  (lookup'' tlb asid va \\<noteq> Incon \\<and> (\\<forall>e. lookup'' tlb asid va = Hit e \\<longrightarrow> e = the (pt_walk asid m ttbr0 va) \\<and> pt_walk asid m ttbr0 va \\<noteq> None) \\<and>\n  lookup_pdc pde_set asid va \\<noteq> Incon \\<and> (\\<forall>e. lookup_pdc pde_set asid va = Hit e \\<longrightarrow> e = the (pdc_walk asid m ttbr0 va) \\<and> pdc_walk asid m ttbr0 va \\<noteq> None))\"\n  apply (clarsimp simp: consistent0'_def is_fault_def) \n  by force\n\nlemma consistent_not_Incon'':\n  \"consistent0' m asid ttbr0 tlb pde_set va =\n  (lookup'' tlb asid va \\<noteq> Incon \\<and> (\\<forall>e. lookup'' tlb asid va = Hit e \\<longrightarrow> e = the (pt_walk asid m ttbr0 va) \\<and> pt_walk asid m ttbr0 va \\<noteq> None) \\<and>\n  lookup_pdc pde_set asid va \\<noteq> Incon \\<and> (\\<forall>e. lookup_pdc pde_set asid va = Hit e \\<longrightarrow> e = the (pdc_walk asid m ttbr0 va) \\<and> pdc_walk asid m ttbr0 va \\<noteq> None))\"\n  apply ((cases \"lookup'' tlb asid va\", cases \"lookup_pdc pde_set asid va\"); simp add: consistent0'_def is_fault_def)\n  by (metis lookup_type.distinct(1) lookup_type.distinct(3) lookup_type.distinct(5) lookup_type.exhaust lookup_type.inject option.distinct(1) option.expand option.sel)\n\n\n\nlemma non_fault_pt_walk_pair_disjI:\n  \"\\<not> is_fault (pdc_walk a m r v) \\<Longrightarrow>\n          pt_walk_pair a m r v = Partial_Walk (the (pdc_walk a m r v)) \\<or>\n          pt_walk_pair a m r v = Full_Walk (the (pt_walk a m r v)) (the (pdc_walk a m r v))\"\n  apply (simp only: pt_walk'_pt_walk)\n  apply (case_tac \"is_fault (pt_walk' a m r v) \")\n   apply (rule disjI1)\n   apply (clarsimp simp: is_fault_def pt_walk_pair_def split: option.split)\n   apply (case_tac y; clarsimp simp: pt_walk'_def map_opt_def)\n  apply (rule disjI2)\n  apply (clarsimp simp: is_fault_def pt_walk_pair_def split: option.split)\n  apply (case_tac x2, clarsimp simp: pt_walk'_def map_opt_def)\n  apply (clarsimp simp: pte_tlb_entry_def pdc_walk_def pt_walk'_def map_opt_def \n                  split: option.splits pde.splits pte.splits)\n  by force\n \n\nlemma non_fault_pt_walk_full_walk:\n  \"\\<not> is_fault (pt_walk a m r v) \\<Longrightarrow> \n       pt_walk_pair a m r v = Full_Walk (the (pt_walk a m r v)) (the (pdc_walk a m r v)) \"\n  apply (subgoal_tac \"\\<not> is_fault (pdc_walk a m r v)\")\n  using non_fault_pt_walk_pair_disjI pt_walk_new_par_fault_pt_walk_fault apply blast\n  using is_fault_pde_is_fault_pt by blast\n\n\nlemma pt_walk_new_no_fault_pt_walk_new:\n  \"pt_walk_pair a m r v = Full_Walk te pe \\<Longrightarrow> \\<not>is_fault (pt_walk a m r v)\"\n  by (simp add: is_fault_def pt_walk_new_no_fault_pt_walk')\n\n\nlemma pt_walk_full_no_pdc_fault:\n  \"pt_walk_pair a m r v = Full_Walk te pe \\<Longrightarrow> \\<not>is_fault (pdc_walk a m r v)\"\n  using no_fault_pt_no_fault_pde pt_walk_new_no_fault_pt_walk_new by auto\n\nlemma pt_walk_partial_no_pdc_fault:\n  \"pt_walk_pair a m r v = Partial_Walk pe \\<Longrightarrow> \\<not>is_fault (pdc_walk a m r v)\"\n  by (simp add: is_fault_def pt_walk_new_par_fault_pdc_walk)\n\n\nlemma  global_entries_pdc_ptable_same:\n  \"global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) = \n        global_entries_pdc (the ` {e \\<in> range (pdc_walk a' m r). \\<not> is_fault e})\"\n  apply rule\n   apply (clarsimp simp: global_entries_pdc_def is_fault_def)\n   apply (clarsimp simp: image_iff)\n   apply (rule_tac x = \"pdc_walk a m r xb\" in exI)\n   apply (rule conjI)\n    apply (rule_tac x = xb in exI)\n    apply (clarsimp simp: is_fault_def pdc_walk_def Let_def  asid_of_pdc_def\n      tag_conv_def split: option.splits pde.splits pte.splits if_split_asm)\n   apply force\n  apply (clarsimp simp: global_entries_pdc_def is_fault_def)\n  apply (clarsimp simp: image_iff)\n  apply (rule_tac x = \"pdc_walk a' m r xb\" in exI)\n  apply (rule conjI)\n   apply (rule_tac x = xb in exI)\n   apply (clarsimp simp: is_fault_def pdc_walk_def Let_def  asid_of_pdc_def\n      tag_conv_def split: option.splits pde.splits pte.splits if_split_asm)\n  by force\n\n\n\nlemma is_fault_non_global_entries_pdc_miss:\n \"is_fault (pdc_walk a m r v) \\<Longrightarrow> lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Miss\"\n  apply (subgoal_tac \"lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v = Miss\")\n  apply (subgoal_tac \"lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) \\<union>\n                  non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Miss\")\n  prefer 2\n  using lookup_eq_union_global_non_global_pdc apply auto[1]\n   apply (drule lookup_asid_pdc_miss_union, simp)\n  using lookup_pdc_miss_is_fault_intro by auto\n\n\nlemma lookup_pdc_global_hit_order:\n  \"lookup_pdc (global_entries_pdc t) a v = Hit e  \\<Longrightarrow>\n        lookup_pdc t a v = Hit e \\<or> lookup_pdc t a v = Incon\"\n  apply safe\n  by (metis asid_pdc_mono glb_pdc_subset global_entries_pdc_def less_eq_lookup_type lookup_type.simps(5))\n\n\nlemma no_fault_pdc_walk_unequal_asid':\n   \"\\<not>is_fault (pdc_walk (a::8 word) m r v) \\<Longrightarrow> \\<not>is_fault (pdc_walk a' m r v)\"\n  apply (clarsimp simp: is_fault_def)\n  by (clarsimp simp: pdc_walk_def Let_def tag_conv_def split: option.splits pde.splits pte.splits if_split_asm)\n\n\nlemma lookup_pdc_non_global_miss_non_fault:\n  \"\\<lbrakk> lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) ) a v = Miss;  \n        \\<not> is_fault (pdc_walk a m r v)\\<rbrakk> \\<Longrightarrow> \n    lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = \n           Hit (the (pdc_walk a m r v))\"\n  apply (frule lookup_pdc_range_pt_walk_hit)\n  apply (subgoal_tac \"lookup_pdc  (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v =\n                lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) \\<union>\n                 non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v\")\n   apply (simp only:)\n   apply (drule lookup_asid_pdc_hit_mis_hit; simp)\n  by (rule lookup_eq_union_global_non_global_pdc)\n\n\n\nlemma non_global_lookup_range_fault_pt_walk_pdc:\n  \"\\<lbrakk>lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Hit x\\<rbrakk>  \\<Longrightarrow> \n          \\<forall>va\\<in> range_of x. x = the (pdc_walk a m r va)\"\n  apply (subgoal_tac \"lookup_pdc  (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v = Hit x\")\n   apply (rule lookup_pdc_range_fault_pt_walk, simp)\n  apply (subgoal_tac \"lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v \\<noteq> Incon\")\n   apply (subgoal_tac \"non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) \\<subseteq>\n                      the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e} \")\n    apply (drule_tac a = a and v = v in asid_pdc_mono)\n    apply (simp add: less_eq_lookup_type)\n   apply (clarsimp simp: non_global_entries_pdc_def)\n  by (rule lookup_pdc_walk_not_incon)\n\n  \n\nlemma non_global_global_disjoint_pdc:\n  \"lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Hit x \\<Longrightarrow>\n   lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Miss\"\n  apply (cases \"lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v\")\n  apply (metis (full_types) lookup_asid_pdc_miss_union lookup_eq_union_global_non_global_pdc)\n   apply (clarsimp simp: lookup_pdc_walk_not_incon)\n  apply (case_tac \"lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v\")\n    apply simp\n   apply (simp add: lookup_global_incon_incon_pdc)\n  apply clarsimp\nproof -\nfix x3 :: pdc_entry and x3a :: pdc_entry\n  assume a1: \"lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Hit x\"\nassume a2: \"lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v = Hit x3\"\nassume a3: \"lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Hit x3a\"\n  have f4: \"Hit x = lookup_pdc {p \\<in> the ` {z \\<in> range (pdc_walk a m r). \\<not> is_fault z}. \\<exists>w. asid_of_pdc p = Some w} a v\"\n    using a1 by (simp add: non_global_entries_pdc_def)\n  have f5: \"\\<forall>a P p w. Hit p \\<noteq> lookup_pdc {p \\<in> P. asid_of_pdc p = None} w a \\<or> Hit p = lookup' {p \\<in> P. asid_of_pdc p = None} a\"\n    by (metis global_entries_pdc_def lookup_global_hit_lookup'_pdc)\n  have f6: \"\\<forall>P. lookup_pdc P a v \\<le> Hit x3 \\<or> \\<not> P \\<subseteq> the ` {z \\<in> range (pdc_walk a m r). \\<not> is_fault z}\"\n  using a2 by (metis (no_types) asid_pdc_mono)\n  have f7: \"\\<forall>p P. Hit p \\<noteq> lookup' {p \\<in> P. asid_of_pdc p = None} v \\<or> Hit x \\<noteq> Hit p\"\n    using f4 by (metis (no_types) global_entries_pdc_def interesting_lemma_pdc non_global_entries_pdc_def)\n  have f8: \"Hit x3a \\<le> Hit x3\"\n    using f6 a3 by (metis (no_types) glb_pdc_subset)\n  have f9: \"Hit x \\<le> Hit x3\"\n    using f6 f4 by auto\n  have f10: \"x3 = x3a\"\n  using f8 by auto\nhave \"x = x3\"\nusing f9 by auto\n  then show False\n    using f10 f7 f5 a3 by (metis (no_types) global_entries_pdc_def)\nqed\n\n\n\nlemma lookup_global_miss_non_fault_pdc:\n  \"\\<lbrakk> lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) ) a v = Miss;  \n        \\<not> is_fault (pdc_walk a m r v)\\<rbrakk> \\<Longrightarrow> \n    lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = \n           Hit (the (pdc_walk a m r v))\"\n  apply (frule lookup_pdc_range_pt_walk_hit)\n  apply (subgoal_tac \"lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v =\n                lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) \\<union>\n                 non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v\")\n   apply (simp only:)\n   apply (drule lookup_asid_pdc_hit_mis_hit'; simp)\n  by (rule lookup_eq_union_global_non_global_pdc)\n\n\n\nlemma non_global_lookup_range_pdc_walk_not_incon:\n  \"lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk (asid :: 8 word) mem ttbr0). \\<not> is_fault e})) asid va \\<noteq> Incon\"\n  apply (subgoal_tac \"lookup_pdc  (the ` {e \\<in> range (pdc_walk asid mem ttbr0). \\<not> is_fault e}) asid va \\<noteq> Incon\")\n   prefer 2\n   apply (rule lookup_pdc_walk_not_incon)\n  apply (subgoal_tac \"non_global_entries_pdc (the ` {e \\<in> range (pdc_walk asid mem ttbr0). \\<not> is_fault e}) \\<subseteq> \n                          the ` {e \\<in> range (pdc_walk asid mem ttbr0). \\<not> is_fault e}\")\n  using lookup_asid_pdc_incon_subset apply blast\n  by (rule non_glb_pdc_subset)\n\n\n\n\nlemma lookup_global_miss_asid_unequal_pdc:\n  \"\\<lbrakk>lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Miss\\<rbrakk>\n    \\<Longrightarrow> lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a' m r). \\<not> is_fault e})) a' v = Miss\"  \n  apply (subgoal_tac \"tagged_pdc_entry_set (global_entries_pdc (the ` {e \\<in> range (pdc_walk a' m r). \\<not> is_fault e})) a' v = {}\")\n  apply (clarsimp simp:  lookup_def)\n  apply (clarsimp simp: tagged_entry_set_to_entry_set_pdc)\n  apply (rule_tac a = a in lookup_global_miss_entry_set_empty_pdc)\n  apply (insert global_entries_pdc_ptable_same [of a m r a'])\n  by force\n\n\n\n\nlemma asid_pdc_lookup_range_fault_pt_walk':\n  \"\\<lbrakk>lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v = Hit x\\<rbrakk>  \\<Longrightarrow> \n          \\<forall>va\\<in> range_of x. x = the (pdc_walk a m r va) \\<and> \\<not>is_fault (pdc_walk a m r va)\"\n  apply (subgoal_tac \"x \\<in> the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}\")\n   prefer 2\n  using lookup_in_asid_pdc apply blast\n   apply clarsimp\n   apply (rule conjI)\n  using lookup_pdc_range_fault_pt_walk apply blast\n  apply (clarsimp simp: asid_range_of_def)\n  apply (frule_tac va = v in  va_pdc_entry_set_pt_palk_same')\n   apply (drule lookup_asid_pdc_hit_entry_range_asid_tags, simp)\n  by (metis (no_types, hide_lams)  va_entry_set_pdc_walk_same') \n\nlemma non_global_hit_no_fault_pdc:\n  \"lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Hit x \\<Longrightarrow>\n             \\<not> is_fault (pdc_walk a m r v)\"\n  apply (subgoal_tac \"lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v = Hit x\")\n   defer\n  apply (subgoal_tac \"non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) \\<subseteq>\n                       the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}\")\n   prefer 2 apply (rule non_glb_pdc_subset)\n  apply (case_tac \"lookup_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) a v\"; clarsimp)\n    apply (drule_tac a = a and v= v in asid_pdc_mono, simp)\n   apply (clarsimp simp: lookup_pdc_walk_not_incon)\n  apply (drule_tac a = a and v= v in asid_pdc_mono, simp)\n  by (simp add: asid_pdc_lookup_range_fault_pt_walk' lookup_asid_pdc_hit_entry_range) \n\n\nlemma non_global_lookup_pdc_hit_asid:\n  \"lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Hit e \\<Longrightarrow>\n   lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a' m r). \\<not> is_fault e})) a' v =  \n            Hit (the (pdc_walk a' m r v))\"\n  apply (case_tac \" lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a' m r). \\<not> is_fault e})) a' v\"; clarsimp)\n    defer \n    apply (clarsimp simp: non_global_lookup_range_pdc_walk_not_incon)\n   apply (frule_tac a = a' in non_global_lookup_range_fault_pt_walk_pdc, \n               drule_tac x = v in bspec, clarsimp simp: lookup_asid_pdc_hit_entry_range, simp) \n  apply (subgoal_tac \"lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a v = Miss\")\n  prefer 2\n  using non_global_global_disjoint_pdc apply auto[1]\n apply (subgoal_tac \"lookup_pdc (global_entries_pdc (the ` {e \\<in> range (pdc_walk a' m r). \\<not> is_fault e})) a' v = Miss\")\n   apply (subgoal_tac \"\\<not>is_fault (pdc_walk a' m r v)\")\n  using lookup_global_miss_non_fault_pdc apply auto [1]\n  apply (subgoal_tac \"\\<not> is_fault (pdc_walk a m r v)\")\n    apply (rule_tac a = a in no_fault_pdc_walk_unequal_asid', simp)\n   apply (clarsimp simp: non_global_hit_no_fault_pdc)\n  by (rule_tac a = a in lookup_global_miss_asid_unequal_pdc, simp)\n\n\nlemma global_entr_pdc_subset_global_entries:\n  \"(\\<Union>x\\<in>global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}). range_of x)\n           \\<subseteq>  (\\<Union>x\\<in>global_entries (the ` {e \\<in> range (pt_walk a m r). \\<not> is_fault e}). range_of x)\"\n  apply safe\n  apply (clarsimp simp: global_entries_pdc_def is_fault_def pdc_walk_def asid_of_pdc_def split: option.splits pde.splits)\n  apply (rename_tac v vba pba fl)\n  apply (rule_tac x = \"EntrySection None (UCAST(32 \\<rightarrow> 12) (addr_val vba >> 20)) (UCAST(32 \\<rightarrow> 12) (addr_val pba >> 20)) (to_tlb_flags fl)\" in bexI)\n   apply (clarsimp simp: range_of_tlb_entry_def range_of_pdc_entry_def)\n  apply (clarsimp simp: global_entries_def)\n  apply (rule_tac x = \"Some (EntrySection None (UCAST(32 \\<rightarrow> 12) (addr_val vba >> 20)) (UCAST(32 \\<rightarrow> 12) (addr_val pba >> 20)) (to_tlb_flags fl))\" in image_eqI)\n   apply force\n  apply safe\n   prefer 2\n   apply force\n  apply (rule_tac x = vba in range_eqI)\n  apply (clarsimp simp:  pt_walk'_pt_walk)\n  by (clarsimp simp: pt_walk'_def map_opt_def pdc_walk_def)\n\n\nlemma asid_unequal_lookup_pdc_walk_miss:\n  \"a \\<noteq> a' \\<Longrightarrow> lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a' m r). \\<not> is_fault e})) a v = Miss\"\n  apply (subgoal_tac \"tagged_pdc_entry_set (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a' m r). \\<not> is_fault e})) a v = {}\")\n   apply (clarsimp simp:  lookup_def) \n  apply (clarsimp simp: entry_pdc_set_va_set tag_vadr_pdc_def asid_range_of_pdc_def is_fault_def non_global_entries_pdc_def asid_of_pdc_def) \n  apply safe\n  by (clarsimp simp: pdc_walk_def Let_def tag_conv_def split: option.splits pde.splits pte.splits if_split_asm)\n\n\nlemma lookup_non_global_union_asid_unequal_pdc:\n \"a \\<noteq> a' \\<Longrightarrow> lookup_pdc (non_global_entries_pdc (t \\<union> the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}))  a' v =\n                 lookup_pdc (non_global_entries_pdc t) a' v\"\n  apply (subgoal_tac \"non_global_entries_pdc (t \\<union> the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) =\n       non_global_entries_pdc t \\<union> non_global_entries_pdc (the ` {e \\<in> range (pdc_walk  a m r). \\<not> is_fault e})\")\n   prefer 2\n   apply (clarsimp simp: non_global_entries_pdc_def) apply blast\n  apply clarsimp\n  apply (subgoal_tac \" lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk  a m r). \\<not> is_fault e}))  a' v  = Miss\")\n  using lookup_asid_pdc_miss_union_equal apply blast\n  using asid_unequal_lookup_pdc_walk_miss by auto\n\n\n\nlemma lookup_non_global_union_asid_unequal_pdc':\n \"\\<lbrakk>a \\<noteq> a''; a' \\<noteq> a''; a' \\<noteq> a \\<rbrakk> \\<Longrightarrow>\n     lookup_pdc (non_global_entries_pdc (t \\<union> the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}))\n              a' v =\n             lookup_pdc (non_global_entries_pdc t) a' v\"\n  apply (subgoal_tac \"non_global_entries_pdc (t \\<union> the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e}) =\n       non_global_entries_pdc t \\<union> non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})\")\n   prefer 2\n   apply (clarsimp simp: non_global_entries_pdc_def) apply blast\n  apply clarsimp\n  apply (subgoal_tac \" lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a' v  = Miss\")\n  using lookup_asid_pdc_miss_union_equal apply blast\n  using asid_unequal_lookup_pdc_walk_miss by auto \n\n\n\nlemma asid_unequal_lookup_non_global_asid_flush_pt_walk_pdc:\n  \"a' \\<noteq> a \\<Longrightarrow>\n       lookup_pdc (non_global_entries_pdc (t - {e \\<in> t. asid_of_pdc e = Some a} \\<union> the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a' v =\n           lookup_pdc (non_global_entries_pdc t) a' v\"\n  apply (clarsimp simp: non_global_entries_union_pdc)\n  apply (subgoal_tac \"lookup_pdc (non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a' v = Miss\")\n   prefer 2\n   apply (rule asid_unequal_lookup_pdc_walk_miss, simp)\n  apply (cases \"lookup_pdc (non_global_entries_pdc (t - {e \\<in> t. asid_of_pdc e = Some a}) \\<union> non_global_entries_pdc (the ` {e \\<in> range (pdc_walk a m r). \\<not> is_fault e})) a' v\"; clarsimp?)\n    apply (subgoal_tac \"lookup_pdc (non_global_entries_pdc (t - {e \\<in> t. asid_of_pdc e = Some a})) a' v = Miss\")\n     apply (clarsimp simp: non_global_entries_sub_pdc)\n     apply (subgoal_tac \"lookup_pdc (non_global_entries_pdc {e \\<in> t. asid_of_pdc e = Some a}) a' v = Miss\")\n      apply (drule lookup_minus_miss_sncd_miss_pdc, simp, simp)\n     apply (clarsimp simp: non_global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def split: if_split_asm)\n    apply (drule lookup_union_miss_sncd_miss_pdc, simp, simp)\n   apply (drule lookup_asid_pdc_incon_not_miss, simp)\n   apply (clarsimp simp: non_global_entries_sub_pdc)\n  using lookup_asid_pdc_incon_minus apply force\n  apply (drule lookup_asid_pdc_hit_mis_hit, simp)\n  apply (clarsimp simp: non_global_entries_sub_pdc)\n  apply (subgoal_tac \"lookup_pdc (non_global_entries_pdc {e \\<in> t. asid_of_pdc e = Some a}) a' v = Miss\")\n   apply (frule lookup_asid_pdc_minus_hit', simp, simp)\n  by (clarsimp simp: non_global_entries_pdc_def lookup_def tagged_pdc_entry_set_def entry_set_def split: if_split_asm)\n\n\n\n\nend", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/TLB_PDC/Simp_Lemmas_PDC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6791787121629465, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.344895008002215}}
{"text": "theory NoDet_Monad_HL\n  imports \n    Main\n    \"UTP_Monad\"\nbegin       \n\ndefinition TT:: \"'a \\<Rightarrow> bool\" where \"TT x = True\"\ndefinition TTT:: \"'b \\<Rightarrow> 'a \\<Rightarrow> bool\" where \"TTT x y = True\"\ndefinition FF:: \"'a \\<Rightarrow> bool\" where \"FF x = False\"\ndefinition GG:: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('b => 'a \\<Rightarrow> bool)\" where \"GG p x = p\"\ndefinition UU:: \"('a \\<Rightarrow> bool) \\<Rightarrow> (unit => 'a \\<Rightarrow> bool)\" where \"UU p x = p\"\n\nrecord status =\n    ok:: bool \n\ndefinition var:: \"(('a \\<Rightarrow> 'b) \\<times> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a)) \\<Rightarrow> bool\" where\n  \"var x \\<equiv> let (xa,xu) = x in (\\<forall>v x. (xa o (xu v)) x = v) \\<and> (\\<forall>v. xu (xa v) v = v)\"\n\ndefinition ind:: \"(('a \\<Rightarrow> 'b) \\<times> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a)) \\<Rightarrow> (('a \\<Rightarrow> 'b) \\<times> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a)) \\<Rightarrow> bool\" where\n  \"ind x y \\<equiv> let (xa,xu) = x in let (ya,yu) = y in \n    var x \\<and> var y \\<longrightarrow> (\\<forall>v x. (xa o (yu v)) x = xa x) \\<and> (\\<forall>v x. (ya o (xu v)) x = ya x)\"\n\nfun indl:: \"(('a \\<Rightarrow> 'b) \\<times> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a)) \\<Rightarrow> (('a \\<Rightarrow> 'b) \\<times> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a)) list \\<Rightarrow> bool\" where\n  \"indl x [] = True\"\n| \"indl x (y#ys) = (ind x y \\<and> indl x ys)\"\n\nfun dcl:: \"(('a \\<Rightarrow> 'b) \\<times> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a)) list \\<Rightarrow> bool\" where\n  \"dcl [] = True\"\n| \"dcl (x#xs) = (var x \\<and> dcl xs \\<and> indl x xs)\"\n\ntext\\<open>The axioms of variables described in the book Refinement calculus \\<close>\ntext\\<open>This axiom states that if we set variable x to v the value of x will be equal to b\\<close>\ntheorem var_assign_ax1: \"\\<lbrakk>dcl [(xa, xu), (ya,yu)]\\<rbrakk> \\<Longrightarrow> (xa o (xu (ya v))) w = ya v\"\n  by (simp add: var_def)\n\ntext\\<open>Attributes can be set independently of each other\\<close>\ntheorem var_assign_ax2: \"\\<lbrakk>dcl [(xa, xu), (ya,yu)]\\<rbrakk> \\<Longrightarrow> v \\<noteq> ya x \\<longrightarrow> (xa o (xu v)) x \\<noteq> ya x\"\n  by (smt case_prodE case_prod_conv dcl.simps(2) var_def)\n\ntext\\<open>Two assignments to the same record following each other will ignore the first assignment\\<close>\ntheorem var_assign_ax3: \"\\<lbrakk>dcl [(xa, xu)]\\<rbrakk> \\<Longrightarrow> (xa o (xu v) o (xu y)) x = v\"\n  using var_def\n  by (simp add: var_def)\n\ntext\\<open>An assignment with the current value of the variable doesn't change the state\\<close>\ntheorem var_assign_ax4: \"\\<lbrakk>dcl [(xa, xu)]\\<rbrakk> \\<Longrightarrow> xa x = v \\<longrightarrow> (xa o (xu v)) x = v\"\n  using var_def\n  by (simp add: var_def)\n\ntext\\<open>An assignment of a variable to itself doesn't change the state - it is equivalent to a skip\\<close>\ntheorem var_assign_ax5: \"\\<lbrakk>dcl [(xa, xu)]\\<rbrakk> \\<Longrightarrow> (xa o (xu (xa x))) x = (xa x)\"\n  using var_assign_ax4 by fastforce  \n\n\ndefinition return:: \"'a \\<Rightarrow> ('b, 'a) state\" where \"return = UTP_Monad.return\"\ndefinition get_state:: \"('a, 'a) state\" where \"get_state = State (\\<lambda>x. {(x,x)})\"\ndefinition put_state:: \"'a \\<Rightarrow> ('a, unit) state\" where \"put_state x = State (\\<lambda>_. {((),x)})\"\ndefinition skip:: \"('a, unit) state\" where \"skip = State (\\<lambda>x. {((),x)})\"\n\ntype_synonym ('a, 'b) vr = \"('a \\<Rightarrow> 'b) \\<times> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a)\"\ndefinition get:: \"('a, 'b) vr \\<Rightarrow> ('a, 'b) state\" where \n  \"get v = do { x \\<leftarrow> get_state; return ((fst v) x) }\"\n\ndefinition put:: \"('a, 'b) vr \\<Rightarrow> 'b \\<Rightarrow> ('a, unit) state\" where \n  \"put v a = do { x \\<leftarrow> get_state; put_state ((snd v) a x)}\"\n\ndefinition assign:: \"('a, 'b) vr \\<Rightarrow> ('a, 'b) vr \\<Rightarrow> ('a, unit) state\" (\"(2_ :=/ _)\" [70, 65] 61) where\n  \"assign v w = do { a \\<leftarrow> get w; put v a}\"\n\ntext\\<open>Make pre- and post-condition to a set of predicates\\<close>\ndefinition spec:: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a, 'b) state \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> bool\" (\"(3\\<turnstile> _/ (2_)/ _)\" [100, 55, 100] 50) where  \n  \"spec p S q = (\\<forall>x y z. p x  \\<longrightarrow> ((z, y) \\<in> run_state S x \\<longrightarrow> q y))\"\n\ntheorem var_assign_skip: \"\\<lbrakk>dcl [x]\\<rbrakk> \\<Longrightarrow> \\<turnstile> p (x := x) p\"\n  apply(simp add: spec_def var_def assign_def get_def put_def put_state_def get_state_def return_def; clarify)\n  by(simp add: fst_def snd_def)\n\ntext\\<open>Hoare's assignment axiom\\<close>\ntheorem assign_rule: \"\\<lbrakk>dcl [x, y]; x=(xa,xu); y=(ya,yu)\\<rbrakk> \\<Longrightarrow> spec (\\<lambda>v. p v \\<and> xa v = ya v) (x := y) p\"\n  apply(simp add: spec_def var_def assign_def get_def put_def put_state_def get_state_def return_def; clarify)\n  apply(simp add: fst_def snd_def ind_def var_def; clarify)  \n  by metis\n\nsubsection\\<open>Hoare logic\\<close>\ntext\\<open>Rules based on section 3 in Verification of Sequential and Concurrent Programs\\<close>\ntheorem get_state_rule: \"spec (\\<lambda>x. p x) (get_state) p\"\n  by (simp add: get_state_def spec_def)\n\n\ntext\\<open>The sequential rule describes all intermediate states that can be both a post-condition of statement @{text S} \n  with the pre-condition @{text p} which after execution of statement @{text T} will result in a final-state of @{text r}\\<close>\ntheorem seq_rule: \"\\<lbrakk>spec p S q; spec q T r\\<rbrakk> \\<Longrightarrow> spec p (do { S; T }) r\"\n  apply (simp add: spec_def)\n  by fastforce\n\ntext\\<open>Rule to capture scope of local variables\\<close>\ntheorem let_rule: \"let v = E in spec p (do { T }) r \\<Longrightarrow> spec p (do { let v = E; T }) r\"\n  by (simp add: spec_def snd_def)\n\n\ntext\\<open>Pre- and post-conditions can be conjoined\\<close>\ntheorem conj_rule: \"\\<lbrakk>spec p S q; spec r S s\\<rbrakk> \\<Longrightarrow> spec (\\<lambda>x. p x \\<and> r x) S (\\<lambda>x. q x \\<and> s x)\"\n  apply (simp add: spec_def)\n  by blast\n\ntext\\<open>A conjunction of the post-condition can be split up and be proved separately\\<close>\ntheorem conj_rule_right: \"\\<lbrakk>spec p S q; spec p S s\\<rbrakk> \\<Longrightarrow> spec p S (\\<lambda>x. q x \\<and> s x)\"\n  by (simp add: spec_def)\n\ntext\\<open>A pre-condition be weaken if it still preserves the post-condition (Weakest pre-condition)\\<close>\ntheorem weaken_rule: \"\\<lbrakk>\\<forall>x. (p x \\<longrightarrow> p0 x); spec p0 S q\\<rbrakk> \\<Longrightarrow> spec p S q\"\n  apply (simp add: spec_def)\n  by blast\n\ntext\\<open>A post-condition can be strengthen if it gets preserved by the pre-condition\\<close>\ntheorem strengthen_rule: \"\\<lbrakk>\\<forall>x. (q0 x \\<longrightarrow> q x); spec p S q0\\<rbrakk> \\<Longrightarrow> spec p S q\"\n  by (simp add: spec_def)\n\n(*\nlemma CondRule:\n \"p (\\<lambda>s. (b s \\<longrightarrow> w s) \\<and> (\\<not>b s \\<longrightarrow> w' s))\n  \\<Longrightarrow> spec w c1 q \\<Longrightarrow> spec w' c2 q \\<Longrightarrow> spec p (Cond b c1 c2) q\"\nby (auto simp:Valid_def)\n*)\ntext\\<open>A conditional statement can be split up into multiple proofs with difference assumptions (based on the queteria)\\<close>\ntheorem cond_rule: \"\\<lbrakk>spec (\\<lambda>x. p x \\<and> b) S q; spec (\\<lambda>x. p x \\<and> \\<not>b) T q\\<rbrakk> \\<Longrightarrow> spec p (COND b S T) q\"\n  by (simp add: spec_def)\n\n(*\ndefinition\n  \"whileLoop C B \\<equiv> (\\<lambda>r s.\n     ({(r',s'). (Some (r, s), Some (r', s')) \\<in> whileLoop_results C B},\n        (Some (r, s), None) \\<in> whileLoop_results C B \\<or> (\\<not> whileLoop_terminates C B r s)))\"\n*)\ntype_synonym 'a bexp = \"('a, unit) state \\<Rightarrow> bool\"\n\ndatatype  ('a) com =\n  Basic \"('a, unit) state \\<Rightarrow> ('a, unit)state\"\n| Seq \"'a com\" \"'a com\"               (\"(_;/ _)\"      [61,60] 60)\n| Cond \"'a bexp\" \"'a com\" \"'a com\"    (\"(1IF _/ THEN _ / ELSE _/ FI)\"  [0,0,0] 61)\n| While \"'a bexp\" \"'a bexp\" \"'a com\"  (\"(1WHILE _/ INV {_} //DO _ /OD)\"  [0,0,0] 61)\n\nabbreviation annskip (\"SKIP\") where \"SKIP == Basic id\"\n\ntype_synonym 'a sem = \"('a, unit) state  => ('a, unit) state  => bool\"\n\nprimrec iter :: \"nat \\<Rightarrow> 'a bexp \\<Rightarrow> 'a sem \\<Rightarrow> 'a sem\"\n  where\n    \"iter 0 b S s s' \\<longleftrightarrow> \\<not>b s \\<and> s = s'\"\n  | \"iter (Suc n) b S s s' \\<longleftrightarrow> b s \\<and> (\\<exists>s''. S s s'' \\<and> iter n b S s'' s')\"\n\ninductive Sem :: \"'a com \\<Rightarrow> 'a sem\"\nwhere\n  \"Sem (Basic f) s (f s)\"\n| \"Sem c1 s s'' \\<Longrightarrow> Sem c2 s'' s' \\<Longrightarrow> Sem (c1;c2) s s'\"\n| \"b s \\<Longrightarrow> Sem c1 s s' \\<Longrightarrow> Sem (IF b THEN c1 ELSE c2 FI) s s'\"\n| \"\\<not>b s \\<Longrightarrow> Sem c2 s s' \\<Longrightarrow> Sem (IF b THEN c1 ELSE c2 FI) s s'\"\n| \"\\<not>b s \\<Longrightarrow> Sem (While b x c) s s\"\n| \"b s \\<Longrightarrow> Sem c s s'' \\<Longrightarrow> Sem (While b x c) s'' s' \\<Longrightarrow>\n   Sem (While b x c) s s'\"\n\n\nprimrec Sem1 :: \"'a com \\<Rightarrow> 'a sem\"\n  where\n    \"Sem1 (Basic f) s s' \\<longleftrightarrow> s' = f s\"\n  | \"Sem1 (c1; c2) s s' \\<longleftrightarrow> (\\<exists>s''. Sem c1 s s'' \\<and> Sem c2 s'' s')\"\n  | \"Sem1 (Cond b c1 c2) s s' \\<longleftrightarrow> (if b s then Sem c1 s s' else Sem c2 s s')\"\n  | \"Sem1 (While b x c) s s' \\<longleftrightarrow> (\\<exists>n. iter n b (Sem c) s s')\"\n    \ninductive_cases [elim!]:\n  \"Sem (Basic f) s s'\" \n  \"Sem (c1;c2) s s'\"\n  \"Sem (IF b THEN c1 ELSE c2 FI) s s'\"\n\ndefinition Valid :: \"'a bexp \\<Rightarrow> 'a com \\<Rightarrow> 'a bexp \\<Rightarrow> bool\"\n  where \"Valid p c q \\<longleftrightarrow> (\\<forall>s s'. Sem c s s' \\<longrightarrow> p s \\<longrightarrow> q s')\"\n\nlemma SkipRule: \"Valid p (Basic id) p\"\nby (auto simp:Valid_def)\n\n(*\nlemma BasicRule: \"(\\<lambda>s. p (f s)) = q \\<Longrightarrow> Valid p (Basic f) q\"\n  apply (auto simp:Valid_def)\n  sledgehammer\n*)\n\nlemma SeqRule: \"\\<lbrakk>Valid P c1 Q; Valid Q c2 R\\<rbrakk> \\<Longrightarrow> Valid P (c1;c2) R\"\nby (auto simp:Valid_def)\n\ntheorem cond_rule1: \"\\<lbrakk>Valid (\\<lambda>x. p x \\<and> b x) S q; Valid (\\<lambda>x. p x \\<and> \\<not>b x) T q\\<rbrakk> \\<Longrightarrow> Valid p (Cond b S T) q\"\n  by (auto simp:Valid_def)\n\nlemma While_aux:\n  assumes \"Sem (WHILE b INV {i} DO c OD) s s'\"\n  shows \"\\<forall>s s'. Sem c s s' \\<longrightarrow> I s \\<and> b s \\<longrightarrow> I s' \\<Longrightarrow>\n    I s \\<Longrightarrow> I s'\\<and> \\<not>b s'\"\n  using assms\n  by (induct \"WHILE b INV {i} DO c OD\" s s') auto\n\nlemma while_rule: \"Valid (\\<lambda>s. P s \\<and> b s) c P \\<Longrightarrow> Valid (\\<lambda>s. P s) (WHILE b INV {X} DO c OD) (\\<lambda>s. P s \\<and> \\<not>b s)\"\n  by (smt Valid_def While_aux)\n\ntext\\<open>Rule to capture scope of local variables\\<close>\ntheorem let_rule1: \"let v = E in Valid p (do { T }) r \\<Longrightarrow> Valid p (do { let v = E; T }) r\"\n  by (simp add: spec_def snd_def)\n\ntext\\<open>Pre- and post-conditions can be conjoined\\<close>\ntheorem conj_rule1: \"\\<lbrakk>Valid p S q; Valid r S s\\<rbrakk> \\<Longrightarrow> Valid (\\<lambda>x. p x \\<and> r x) S (\\<lambda>x. q x \\<and> s x)\"\n  by (simp add: Valid_def)\n\ntext\\<open>A conjunction of the post-condition can be split up and be proved separately\\<close>\ntheorem conj_rule_right1: \"\\<lbrakk>Valid p S q; Valid p S s\\<rbrakk> \\<Longrightarrow> Valid p S (\\<lambda>x. q x \\<and> s x)\"\n  by (simp add: Valid_def)\n\ntext\\<open>A pre-condition be weaken if it still preserves the post-condition (Weakest pre-condition)\\<close>\ntheorem weaken_rule1: \"\\<lbrakk>\\<forall>x. (p x \\<longrightarrow> p0 x); Valid p0 S q\\<rbrakk> \\<Longrightarrow> Valid p S q\"\n  by (simp add: Valid_def)\n\ntext\\<open>A post-condition can be strengthen if it gets preserved by the pre-condition\\<close>\ntheorem strengthen_rule1: \"\\<lbrakk>\\<forall>x. (q0 x \\<longrightarrow> q x); Valid p S q0\\<rbrakk> \\<Longrightarrow> Valid p S q\"\n  by (simp add: Valid_def)\n\n\n\n\n\n\n(*While loop and extensive records of state. Read chapters 0-4.*)\n\n\nend", "meta": {"author": "SimplisticCode", "repo": "Tarjan-Isabelle", "sha": "ecd72ef5fc352075e6037965cc30844b7db4bacc", "save_path": "github-repos/isabelle/SimplisticCode-Tarjan-Isabelle", "path": "github-repos/isabelle/SimplisticCode-Tarjan-Isabelle/Tarjan-Isabelle-ecd72ef5fc352075e6037965cc30844b7db4bacc/NoDet_Monad_HL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.34489500140698126}}
{"text": "(* This file includes proofs for the multivariate \n  matrix equation construction from Hybrid_Multiv_Matrix.thy.\n*)\n\n\ntheory Hybrid_Multiv_Matrix_Proofs\n  imports\n    \"BenOr_Kozen_Reif.Matrix_Equation_Construction\"\n    Multiv_Tarski_Query\n    \"BenOr_Kozen_Reif.Renegar_Proofs\"\n    Hybrid_Multiv_Matrix\n    Hybrid_Multiv_Algorithm\n    Renegar_Modified\n\nbegin\n\nhide_const \"BKR_Decision.And\"\nhide_const \"BKR_Decision.Or\"\n\nhide_const \"UnivPoly.eval\"\n\nsubsection \"Connect multivariate Tarski queries to univariate\"\nlemma pull_out_pairs_length:\n  shows \"length (pull_out_pairs qs Is) = length Is\"\n  using pull_out_pairs.simps by force\n\nlemma construct_NofI_M_subset_prop:\n  assumes \"(assumps, tq) \\<in> set (construct_NofI_M p init_assumps qs1 qs2)\"\n  shows \"set init_assumps \\<subseteq> set assumps\"\nproof -\n  have \"(assumps, tq) \\<in> set (map construct_NofI_single_M (construct_NofI_R_spmods p init_assumps qs1 qs2))\"\n    using assms\n    by auto \n  then obtain mid_assumps tq_list where tuple_prop2: \"(assumps, tq) = construct_NofI_single_M (mid_assumps, tq_list)\"\n    \"(mid_assumps, tq_list) \\<in> set (construct_NofI_R_spmods p init_assumps qs1 qs2)\"\n    by force\n  have s1: \"mid_assumps = assumps\"\n    using tuple_prop2(1)\n    by simp \n  have s2: \"set init_assumps \\<subseteq> set mid_assumps\"\n    using tuple_prop2(2) spmods_multiv_assum_acc\n    by (metis construct_NofI_R_spmods_def)\n  then show \"set init_assumps \\<subseteq> set assumps\"\n    using s1 s2\n    by blast \nqed\n\nsubsection \"Connect multivariate RHS vector to univariate\"\n\nlemma construct_rhs_vector_rec_M_subset_prop_len1:\n  assumes \"(assumps, rhs_list) \\<in> set (construct_rhs_vector_rec_M p init_assumps [a])\"\n  shows \"set init_assumps \\<subseteq> set assumps\"\nproof -\n  obtain qs1 qs2 where a_prop: \"a = (qs1, qs2)\"\n    using prod.exhaust by blast \n  have tuple_prop: \"(assumps, rhs_list) \\<in> set (map (\\<lambda>(new_assumps, tq). (new_assumps, [tq])) (construct_NofI_M p init_assumps qs1 qs2))\"\n    using a_prop assms by auto\n  then obtain tq where tq_prop: \"rhs_list = [tq]\"\n    by auto\n  let ?ell = \"( map (\\<lambda>(new_assumps, tq). (new_assumps, [tq])) (construct_NofI_M p init_assumps qs1 qs2))\"\n  have tuple_in_list: \"(assumps, rhs_list) \\<in> set ?ell\"\n    using tuple_prop \n    by auto\n  then have \"(assumps, tq) \\<in> set (construct_NofI_M p init_assumps qs1 qs2)\"  \n    using tq_prop\n    by (smt (verit, best) imageE list.inject list.set_map old.prod.case old.prod.simps(1) prod.collapse) \n  then have \"(assumps, tq) \\<in> set (construct_NofI_M p init_assumps qs1 qs2)\"\n    using tq_prop\n    by metis \n  then have \"(assumps, tq) \\<in> set(map construct_NofI_single_M \n      (construct_NofI_R_spmods p init_assumps qs1 qs2))\"\n    by force\n  then have \"(assumps, tq) \\<in> set (construct_NofI_M p init_assumps qs1 qs2)\"\n    using \\<open>(assumps, tq) \\<in> set (construct_NofI_M p init_assumps qs1 qs2)\\<close> by force\n  then show ?thesis using construct_NofI_M_subset_prop\n    by blast\nqed\n\nlemma construct_rhs_vector_rec_M_subset_prop:\n  assumes \"(assumps, rhs_list) \\<in> set (construct_rhs_vector_rec_M p init_assumps qs_list)\"\n  shows \"set init_assumps \\<subseteq> set assumps\"\n  using assms\nproof (induct qs_list  arbitrary: assumps rhs_list init_assumps)\n  case Nil\n  then show ?case\n    using construct_rhs_vector_rec_M.simps by auto\nnext\n  case (Cons a qs_list)\n  obtain qs1 qs2 where a_prop: \"a = (qs1, qs2)\"\n    using Cons.prems Cons.hyps prod.exhaust\n    by fastforce \n  { assume *: \"qs_list = []\"\n    then have \"set init_assumps \\<subseteq> set assumps\" using construct_rhs_vector_rec_M_subset_prop_len1 \n        Cons.prems\n      by blast \n  }\n  moreover   { assume *: \"length qs_list \\<ge> 1\"\n    then obtain v va where qs_list_prop: \"qs_list = v # va\"\n      by (metis One_nat_def Suc_le_length_iff)\n    let ?TQ_list = \"construct_NofI_M p init_assumps qs1 qs2\"\n    have \"(assumps, rhs_list) \\<in> set (construct_rhs_vector_rec_M p init_assumps ((qs1, qs2)#qs_list))\"\n      using Cons.prems(1) * a_prop by auto\n    then have \"(assumps, rhs_list) \\<in> set (concat ((map (\\<lambda>(new_assumps, tq). \n    (let rec = construct_rhs_vector_rec_M p new_assumps qs_list in\n     map (\\<lambda>r. (fst r,  tq#snd r)) rec)) ?TQ_list)))\"\n      using * a_prop qs_list_prop\n      by (simp add: split_def) \n    then obtain new_assumps tq where tq_prop: \"(new_assumps,tq) \\<in> set (?TQ_list)\"\n      \"(assumps, rhs_list) \\<in> set (let rec = construct_rhs_vector_rec_M p new_assumps qs_list in\n     map (\\<lambda>r. (fst r,  tq#snd r)) rec)\"\n      by auto\n    then obtain rhs_rest where rhs_list_prop: \"rhs_list = tq#rhs_rest\"\n      \"(assumps, rhs_rest) \\<in> set (construct_rhs_vector_rec_M p new_assumps qs_list)\"\n      by auto\n    then have s1: \"set new_assumps \\<subseteq> set assumps\"\n      using Cons.hyps\n      by auto \n    have s2: \"set init_assumps \\<subseteq> set new_assumps\"\n      using construct_NofI_M_subset_prop tq_prop(1) \n      by auto\n    have \"set init_assumps \\<subseteq> set assumps\"\n      using s1 s2 \n      by auto\n  }\n  ultimately  show ?case\n    using Cons.prems\n    by (metis length_0_conv less_one linorder_neqE_nat nat_less_le rel_simps(47)) \nqed\n\nlemma construct_rhs_vector_rec_M_univariate:\n  (* Intuitively, assumps really contains all of the assumptions that we care about *)\n  assumes rhs_list_is: \"(assumps, rhs_list) \\<in> set(construct_rhs_vector_rec_M p init_assumps qs_list)\"\n  assumes val: \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  shows \"rhs_list = map (\\<lambda>(qs1,qs2).\n    (construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val qs1) (eval_mpoly_poly_list val qs2))) qs_list\"\n  using assms\nproof (induct qs_list arbitrary: assumps rhs_list init_assumps)\n  case Nil\n  then show ?case \n    using construct_rhs_vector_rec_M.simps\n    by auto\nnext\n  case (Cons a qs_list)\n  obtain qs1 qs2 where a_prop: \"a = (qs1, qs2)\"\n    using Cons.prems Cons.hyps\n    using prod.exhaust by blast \n  { assume *: \"qs_list = []\"\n    let ?tq = \"construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val qs1) (eval_mpoly_poly_list val qs2)\"\n    have \" (assumps, rhs_list) \\<in> set (construct_rhs_vector_rec_M p init_assumps [(qs1, qs2)])\"\n      using Cons.prems(1) * a_prop by auto\n    then have \n      \"(assumps, rhs_list) \\<in> set (let TQ_list = construct_NofI_M p init_assumps qs1 qs2 in\n    map (\\<lambda>(new_assumps, tq). (new_assumps, [tq])) TQ_list)\"\n      by (metis construct_rhs_vector_rec_M.simps(2))\n    then have tuple_prop:\n      \"(assumps, rhs_list) \\<in> set ( map (\\<lambda>(new_assumps, tq). (new_assumps, [tq])) (construct_NofI_M p init_assumps qs1 qs2))\"\n      by auto\n    then obtain tq where tq_prop: \"rhs_list = [tq]\"\n      by auto\n    let ?ell = \"( map (\\<lambda>(new_assumps, tq). (new_assumps, [tq])) (construct_NofI_M p init_assumps qs1 qs2))\"\n    have tuple_in_list: \"(assumps, rhs_list) \\<in> set ?ell\"\n      using tuple_prop\n      by auto\n    then have \"(assumps, tq) \\<in> set (construct_NofI_M p init_assumps qs1 qs2)\"  \n      using tq_prop\n      by (smt (verit, best) imageE list.inject list.set_map old.prod.case old.prod.simps(1) prod.collapse) \n    then have \"(assumps, tq) \\<in> set (construct_NofI_M p init_assumps qs1 qs2)\"\n      using tq_prop\n      by metis \n    then have \"rhs_list = [construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val qs1) (eval_mpoly_poly_list val qs2)]\"\n      using construct_NofI_M_univariate_tarski_query[of assumps tq p init_assumps qs1 qs2 val]\n        Cons.prems(2) tq_prop\n      by auto\n    then have \"rhs_list =\n       map (\\<lambda>(qs1, qs2).\n               construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val qs1)\n                (eval_mpoly_poly_list val qs2))\n        [(qs1, qs2)]\"\n      by auto\n    then have \"rhs_list =\n       map (\\<lambda>(qs1, qs2).\n               construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val qs1)\n                (eval_mpoly_poly_list val qs2))\n        (a # qs_list)\"\n      using * a_prop by auto\n  }\n  moreover {\n    assume *: \"qs_list \\<noteq> []\"\n    then obtain v va where qs_list_prop: \"qs_list = v # va\"\n      by (meson neq_Nil_conv)\n    let ?tq = \"construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val qs1) (eval_mpoly_poly_list val qs2)\"\n    let ?TQ_list = \"construct_NofI_M p init_assumps qs1 qs2\"\n    have \"(assumps, rhs_list) \\<in> set (construct_rhs_vector_rec_M p init_assumps ((qs1, qs2)#qs_list))\"\n      using Cons.prems(1) * a_prop by auto\n    then have \"(assumps, rhs_list) \\<in> set (concat ((map (\\<lambda>(new_assumps, tq). \n    (let rec = construct_rhs_vector_rec_M p new_assumps qs_list in\n     map (\\<lambda>r. (fst r,  tq#snd r)) rec)) ?TQ_list)))\"\n      using * a_prop qs_list_prop\n      by (simp add: split_def) \n    then obtain new_assumps tq where tq_prop: \"(new_assumps,tq) \\<in> set (?TQ_list)\"\n      \"(assumps, rhs_list) \\<in> set (let rec = construct_rhs_vector_rec_M p new_assumps qs_list in\n     map (\\<lambda>r. (fst r,  tq#snd r)) rec)\"\n      by auto\n    then obtain rhs_rest where rhs_list_prop: \"rhs_list = tq#rhs_rest\"\n      \"(assumps, rhs_rest) \\<in> set (construct_rhs_vector_rec_M p new_assumps qs_list)\"\n      by auto\n    then have subset: \"set new_assumps \\<subseteq> set assumps\" using\n        construct_rhs_vector_rec_M_subset_prop[of assumps rhs_rest p new_assumps qs_list]\n      by auto \n    then have val_2: \"\\<And> p n. (p, n) \\<in> set new_assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n      using val\n      by (meson Set.basic_monos(7) local.Cons(3)) \n    have tq_is: \"tq = ?tq\"\n      using construct_NofI_M_univariate_tarski_query[of new_assumps tq p init_assumps qs1 qs2 val]\n        tq_prop(1) Cons.prems(2) subset\n      by blast\n    have ih: \"rhs_rest =\n           map (\\<lambda>(qs1, qs2).\n                   construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val qs1)\n                    (eval_mpoly_poly_list val qs2))\n            qs_list\"\n      using rhs_list_prop Cons.prems(2) val_2\n      by (simp add: local.Cons(1))  \n    then have \"rhs_list =\n       map (\\<lambda>(qs1, qs2).\n               construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val qs1)\n                (eval_mpoly_poly_list val qs2))\n        (a # qs_list)\"\n      using a_prop tq_is ih rhs_list_prop\n      by simp \n  }\n  ultimately have \"rhs_list =\n       map (\\<lambda>(qs1, qs2).\n               construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val qs1)\n                (eval_mpoly_poly_list val qs2))\n        (a # qs_list)\"\n    by blast\n  then show ?case\n    by blast \nqed\n\nlemma retrieve_polys_prop:\n  assumes \"\\<And>x. x \\<in> set ns \\<Longrightarrow> x < length qs\"\n  shows \"(eval_mpoly_poly_list val (retrieve_polys qs ns)) = (retrieve_polys (map (eval_mpoly_poly val) qs) ns)\"\n  using assms unfolding eval_mpoly_poly_list_def retrieve_polys_def by auto\n\n(* Intuitively, with the assumptions we have, we'll get a unique RHS vector\n i.e. the output of construct_NofI_M gives uniqueness (and matches the univariate\n case) *)\nlemma construct_rhs_vector_M_univariate:\n  (* Intuitively, assumps really contains all of the assumptions that we care about *)\n  assumes rhs_vec_is: \"(assumps, rhs_vec) \\<in> set(construct_rhs_vector_M p init_assumps qs Is)\"\n  assumes \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  assumes well_def_subsets:  \"\\<And> Is1 Is2 n. (Is1, Is2) \\<in> set Is \\<Longrightarrow> \n    (n \\<in> set Is1 \\<or> n \\<in> set Is2) \\<Longrightarrow> n < length qs\"\n  shows \"rhs_vec = construct_rhs_vector_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) Is\"\nproof  - \n  have \"(assumps, rhs_vec) \\<in> set (map (\\<lambda>res. (fst res, vec_of_list (snd res))) (construct_rhs_vector_rec_M p init_assumps (pull_out_pairs qs Is)))\"\n    using rhs_vec_is unfolding construct_rhs_vector_M_def by auto \n  then have \"\\<exists>rhs_list. rhs_vec = vec_of_list rhs_list \\<and> (assumps, rhs_list) \\<in> set (map (\\<lambda>res. (fst res, snd res)) (construct_rhs_vector_rec_M p init_assumps (pull_out_pairs qs Is)))\"\n    by auto\n  then obtain rhs_list where rhs_list_prop: \"rhs_vec = vec_of_list rhs_list \\<and> (assumps, rhs_list) \\<in> set (map (\\<lambda>res. (fst res, snd res)) (construct_rhs_vector_rec_M p init_assumps (pull_out_pairs qs Is)))\"\n    by auto\n  then have rhs_list_char: \"rhs_list = map (\\<lambda>(qs1,qs2).\n    (construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val qs1) (eval_mpoly_poly_list val qs2))) (pull_out_pairs qs Is)\"\n    using assms construct_rhs_vector_rec_M_univariate\n      (* Takes a couple seconds to load*)\n    by (smt (verit, del_insts) case_prod_beta map_eq_conv map_idI prod.exhaust_sel)\n  have lov_1: \"list_of_vec (map_vec\n     (\\<lambda>(I1, I2).\n         construct_NofI_R (eval_mpoly_poly val p) (retrieve_polys (map (eval_mpoly_poly val) qs) I1)\n          (retrieve_polys (map (eval_mpoly_poly val) qs) I2))\n     (vec_of_list Is)) = map (\\<lambda>(I1, I2).\n         construct_NofI_R (eval_mpoly_poly val p) (retrieve_polys (map (eval_mpoly_poly val) qs) I1)\n          (retrieve_polys (map (eval_mpoly_poly val) qs) I2)) Is\"\n    by (metis list_vec vec_of_list_map)\n  have lov_2: \"list_of_vec rhs_vec = rhs_list\"\n    using rhs_list_prop\n    using list_vec by blast \n  let ?rhs_list_var = \"map (\\<lambda>(I1, I2).\n         construct_NofI_R (eval_mpoly_poly val p) (retrieve_polys (map (eval_mpoly_poly val) qs) I1)\n          (retrieve_polys (map (eval_mpoly_poly val) qs) I2)) Is\"\n  have rhs_list_is: \"rhs_list = ?rhs_list_var\"\n  proof - \n    have len_is1: \"length (pull_out_pairs qs Is) = length Is\"\n      by simp\n    then have \"length rhs_list = length Is\"\n      using rhs_list_char\n      by auto\n    have len_is2: \"length ?rhs_list_var = length Is\"\n      by auto\n    have \"\\<And>n. n  < length Is \\<Longrightarrow> rhs_list ! n = ?rhs_list_var ! n\"\n    proof - \n      fix n\n      assume *: \"n  < length Is\"\n      then obtain Is1 Is2 where Is_prop: \"Is ! n = (Is1, Is2)\"\n        by fastforce\n      then have \"(pull_out_pairs qs Is) ! n = ((retrieve_polys qs Is1), (retrieve_polys qs Is2))\"\n        using \"*\" by force\n      then have nth_1: \"rhs_list ! n =  construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val (retrieve_polys qs Is1)) (eval_mpoly_poly_list val (retrieve_polys qs Is2))\"     \n        using rhs_list_char\n        by (simp add: \"*\" len_is1) \n      have nth_2: \"map (\\<lambda>(I1, I2).\n            construct_NofI_R (eval_mpoly_poly val p) (retrieve_polys (map (eval_mpoly_poly val) qs) I1)\n             (retrieve_polys (map (eval_mpoly_poly val) qs) I2)) Is ! n\n      = construct_NofI_R (eval_mpoly_poly val p) (retrieve_polys (map (eval_mpoly_poly val) qs) Is1)\n             (retrieve_polys (map (eval_mpoly_poly val) qs) Is2)\"\n        using Is_prop\n        by (simp add: \"*\")\n      have ret_poly1: \"(eval_mpoly_poly_list val (retrieve_polys qs Is1)) = (retrieve_polys (map (eval_mpoly_poly val) qs) Is1)\"\n        unfolding retrieve_polys_def eval_mpoly_poly_list_def \n        using well_def_subsets retrieve_polys_prop Is_prop       \n        by (metis \"*\" eval_mpoly_poly_list_def in_set_conv_nth retrieve_polys_def)\n      have ret_poly2: \"(eval_mpoly_poly_list val (retrieve_polys qs Is2)) = (retrieve_polys (map (eval_mpoly_poly val) qs) Is2)\"\n        unfolding retrieve_polys_def eval_mpoly_poly_list_def \n        using well_def_subsets retrieve_polys_prop Is_prop\n        by (metis \"*\" eval_mpoly_poly_list_def in_set_conv_nth retrieve_polys_def)\n      have \"construct_NofI_R (eval_mpoly_poly val p) (eval_mpoly_poly_list val (retrieve_polys qs Is1)) (eval_mpoly_poly_list val (retrieve_polys qs Is2))\n        = construct_NofI_R (eval_mpoly_poly val p) (retrieve_polys (map (eval_mpoly_poly val) qs) Is1)\n             (retrieve_polys (map (eval_mpoly_poly val) qs) Is2)\"\n        using ret_poly1 ret_poly2 \n        by auto\n      then show \"rhs_list ! n = ?rhs_list_var ! n\"\n        using nth_1 nth_2 by auto \n    qed\n    then show ?thesis\n      using len_is1 len_is2\n      by (metis \\<open>length rhs_list = length Is\\<close> nth_equalityI)\n  qed\n  then show ?thesis\n    using rhs_list_is lov_2 lov_1\n    unfolding construct_rhs_vector_R_def\n    using rhs_list_prop by force \nqed\n\nsubsection \"Connect multivariate LHS vector to univariate\"\n\nlemma solve_for_lhs_vector_M_univariate:\n  assumes lhs_in: \"(assumps, lhs_vec) \\<in> set (solve_for_lhs_M p init_assumps qs subsets matr)\"\n  assumes val: \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  assumes well_def_subsets:  \"\\<And> Is1 Is2 n. (Is1, Is2) \\<in> set subsets \\<Longrightarrow> \n    (n \\<in> set Is1 \\<or> n \\<in> set Is2) \\<Longrightarrow> n < length qs\"\n  shows \"lhs_vec = solve_for_lhs_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) subsets matr\"\nproof - \n  let ?lhs_univ = \"solve_for_lhs_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) subsets matr\"\n  have \"(assumps, lhs_vec) \\<in> set(map (\\<lambda>rhs. (fst rhs, solve_for_lhs_single_M p qs subsets matr (snd rhs))) (construct_rhs_vector_M p init_assumps qs subsets))\"\n    using lhs_in\n    using solve_for_lhs_M_def by auto \n  then obtain rhs where rhs_prop: \"rhs \\<in> set(construct_rhs_vector_M p init_assumps qs subsets)\"\n    \"(assumps, lhs_vec) = (fst rhs, solve_for_lhs_single_M p qs subsets matr (snd rhs))\"\n    by auto\n  then have snd_is: \"snd rhs = construct_rhs_vector_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) subsets\"\n    using construct_rhs_vector_M_univariate\n    by (metis assms(2) fst_conv prod.collapse well_def_subsets)  \n  have \"fst rhs = assumps\" using rhs_prop\n    by force \n  have \"?lhs_univ = mult_mat_vec (matr_option (dim_row matr) (mat_inverse_var matr)) (snd rhs)\"\n    using snd_is\n    by (simp add: solve_for_lhs_R_def) \n  then show ?thesis\n    using rhs_prop(2) unfolding solve_for_lhs_single_M_def \n    by auto\nqed\n\nsubsection \"Connect multivariate reduction step to univariate\"\n\nlemma reduce_system_single_M_univariate:\n  assumes inset: \"(assumps, mat_eq) \\<in> set(reduce_system_single_M p qs (init_assumps, init_mat_eq))\"\n  assumes val: \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  assumes init: \"init_mat_eq = (m, (subs, signs))\"\n  assumes well_def_subsets:  \"\\<And> Is1 Is2 n. (Is1, Is2) \\<in> set subs \\<Longrightarrow> \n    (n \\<in> set Is1 \\<or> n \\<in> set Is2) \\<Longrightarrow> n < length qs\"\n  shows \"mat_eq = reduce_system_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) qs), init_mat_eq)\"\nproof - \n  have \"(assumps, mat_eq) \\<in> set (map (\\<lambda>lhs. (fst lhs, reduction_step_R m signs subs (snd lhs))) (solve_for_lhs_M p init_assumps qs subs m))\"\n    using inset\n    using assms(3)\n    by force\n  then obtain lhs where lhs_prop: \"lhs \\<in> set (solve_for_lhs_M p init_assumps qs subs m)\"\n    \"(assumps, mat_eq) = (fst lhs, reduction_step_R m signs subs (snd lhs))\"\n    by auto\n  then have \"snd lhs = solve_for_lhs_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) subs m\"\n    using solve_for_lhs_vector_M_univariate assms\n    by (smt (verit, best) prod.exhaust_sel prod.simps(1))\n  then have \"mat_eq = reduction_step_R m signs subs (solve_for_lhs_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) subs m)\"\n    using lhs_prop\n    by force \n  then show ?thesis \n    using init\n    using reduce_system_R.simps by presburger \nqed\n\nlemma reduce_system_M_univariate:\n  assumes \"(assumps, mat_eq) \\<in> set(reduce_system_M p qs input_list)\"\n  assumes val: \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  assumes val_qs: \"val_qs = (map (eval_mpoly_poly val) qs)\"\n  assumes all_subsets_well_def:  \"\\<And> init_assumps init_mat_eq Is1 Is2 n subs m signs. \n   (init_assumps, (m, (subs, signs))) \\<in> set input_list \\<Longrightarrow>\n   (Is1, Is2) \\<in> set subs \\<Longrightarrow> (n \\<in> set Is1 \\<or> n \\<in> set Is2) \\<Longrightarrow> n < length qs\"\n  obtains acc mss where\n    \"(acc,mss) \\<in> set (input_list)\" \n    \"mat_eq = reduce_system_R (eval_mpoly_poly val p) (val_qs,mss)\"\nproof -\n  have \"(assumps, mat_eq) \\<in> set(concat (map (reduce_system_single_M p qs) input_list))\"\n    by (metis assms(1) reduce_system_M.simps)\n  then obtain init_assumps init_m init_subs init_signs where\n    mat_eq_prop: \n    \"(init_assumps, (init_m, (init_subs, init_signs))) \\<in> set input_list\"\n    \"(assumps, mat_eq) \\<in> set (reduce_system_single_M p qs (init_assumps, (init_m, (init_subs, init_signs))))\"\n    by auto\n  then have well_def_subsets:  \"\\<And> Is1 Is2 n. (Is1, Is2) \\<in> set init_subs \\<Longrightarrow> \n    (n \\<in> set Is1 \\<or> n \\<in> set Is2) \\<Longrightarrow> n < length qs\"\n    using all_subsets_well_def\n    by blast\n  then have mat_eq_is: \"mat_eq = reduce_system_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) qs), (init_m, (init_subs, init_signs)))\"\n    using reduce_system_single_M_univariate mat_eq_prop assms(2) by blast \n  then show ?thesis using mat_eq_prop\n    using assms(3) that by blast\nqed\n\nlemma base_case_info_M_well_def:\n  assumes \"(init_assumps, (m, (subs, signs))) \\<in> set base_case_info_M\"\n  assumes \"(Is1, Is2) \\<in> set subs\"\n  assumes \"n \\<in> set Is1 \\<or> n \\<in> set Is2\"\n  shows \"n < 1\"\nproof -\n  have \"(m, (subs, signs)) = base_case_info_R\" using assms(1)\n    unfolding base_case_info_M_def using Renegar_Algorithm.base_case_info_R_def Renegar_Algorithm.base_case_info_R_def\n    by simp\n  then have s: \"subs = [([], []),([0], []),([], [0])]\" unfolding base_case_info_R_def\n    by auto\n  have \"(n \\<in> set Is1 \\<or> n \\<in> set Is2)\" using assms(3)\n    by (simp add: in_set_member)\n  thus ?thesis using assms(2) unfolding s by auto\nqed\n\nsubsection \"Connect multivariate combining systems to univariate\"\n\n(* Well-definedness property to satisfy induction hypothesis *)\nlemma base_case_with_assumps_info_M_well_def:\n  assumes \"(init_assumps, (m, (subs, signs))) \\<in> set (base_case_info_M_assumps a)\"\n  assumes \"(Is1, Is2) \\<in> set subs\"\n  assumes \"n \\<in> set Is1 \\<or> n \\<in> set Is2\"\n  shows \"n < 1\"\nproof -\n  have \"(m, (subs, signs)) = base_case_info_R\" using assms(1)\n    unfolding base_case_info_M_assumps_def \n    using Renegar_Algorithm.base_case_info_R_def Renegar_Algorithm.base_case_info_R_def\n    by auto\n  then have s: \"subs = [([], []),([0], []),([], [0])]\" unfolding base_case_info_R_def\n    by auto\n  have \"(n \\<in> set Is1 \\<or> n \\<in> set Is2)\" using assms(3)\n    by (simp add: in_set_member)\n  thus ?thesis using assms(2) unfolding s by auto\nqed\n\nlemma concat_map_in_set:\n  assumes \"x \\<in> set (concat (map f ls))\"\n  shows \"\\<exists>i < length ls. x \\<in> set (f (ls ! i))\"\n  using assms\n  by (smt (verit, best) in_set_conv_nth length_map map_nth_eq_conv nth_concat_split) \n\nlemma combine_systems_R_snd:\n  assumes \"length qs1 = length new_qs1\"\n  shows \"snd (combine_systems_R p (qs1, sys1) (qs2, sys2)) = \n    snd (combine_systems_R new_p (new_qs1, sys1) (new_qs2, sys2))\"\nproof - \n  obtain  m1 sub1 sgn1 where sys1: \"sys1 = (m1, sub1, sgn1)\"\n    using prod_cases3 by blast\n  obtain  m2 sub2 sgn2 where sys2: \"sys2 = (m2, sub2, sgn2)\"\n    using prod_cases3 by blast \n  have h1: \"snd (combine_systems_R p (qs1, sys1) (qs2, sys2)) = \n    snd (smash_systems_R p qs1 qs2 sub1 sub2 sgn1 sgn2 m1 m2)\"\n    using sys1 sys2 by auto \n  have h2: \"snd (combine_systems_R new_p (new_qs1, sys1) (new_qs2, sys2)) = \n    snd (smash_systems_R new_p new_qs1 new_qs2 sub1 sub2 sgn1 sgn2 m1 m2)\"\n    using sys1 sys2 by auto \n  show ?thesis\n    using h1 h2 assms unfolding smash_systems_R_def by auto\nqed\n\nsubsection \"Subset Properties\"\n\nlemma construct_rhs_vector_M_subset_prop:\n  assumes \"(assumps, rhs_vec) \\<in> set (construct_rhs_vector_M p init_assumps qs subsets)\"\n  shows \"set init_assumps \\<subseteq> set assumps\"\nproof - \n  obtain rhs_list where \"(assumps, rhs_list) \\<in> set  (construct_rhs_vector_rec_M p init_assumps (pull_out_pairs qs subsets))\" \n    \"rhs_vec = vec_of_list rhs_list\"\n    using assms unfolding construct_rhs_vector_M_def by auto\n  then show ?thesis\n    using construct_rhs_vector_rec_M_subset_prop by auto\nqed\n\nlemma construct_lhs_vector_rec_M_subset_prop:\n  assumes \"(assumps, lhs_list) \\<in> set (solve_for_lhs_M p init_assumps qs subsets matr)\"\n  shows \"set init_assumps \\<subseteq> set assumps\"\nproof - \n  obtain rhs_vec where \"(assumps, rhs_vec) \\<in> set (construct_rhs_vector_M p init_assumps qs subsets)\" \n    \"lhs_list = matr_option (dim_row matr) (mat_inverse_var matr) *\\<^sub>v rhs_vec \"\n    using assms unfolding solve_for_lhs_M_def solve_for_lhs_single_M_def \n    by auto \n  then show ?thesis\n    using construct_rhs_vector_M_subset_prop[of assumps] by auto\nqed\n\nlemma reduce_system_single_M_subset_prop:\n  assumes \"(assumps, mat_eq) \\<in> set (reduce_system_single_M p qs (init_assumps, (m,subs,signs)))\"\n  shows \"set init_assumps \\<subseteq> set assumps\"\nproof - \n  obtain lhs_vec where \"(assumps, lhs_vec) \\<in> set (solve_for_lhs_M p init_assumps qs subs m)\" \n    \"mat_eq = reduction_step_R m signs subs lhs_vec\"\n    using assms \n    by (auto) \n  then show ?thesis\n    using construct_lhs_vector_rec_M_subset_prop[of assumps] \n    by auto\nqed\n\n\nlemma calculate_data_assumps_M_subset:\n  assumes \"(assumps, mat_eq) \\<in> set (calculate_data_assumps_M p qs init_assumps)\"\n  shows \"set init_assumps \\<subseteq> set assumps\"\n  using assms\nproof (induction \"length qs\" arbitrary: qs assumps mat_eq rule: less_induct)\n  case less\n  {assume *: \"length qs = 0\"\n    then have \"(assumps, mat_eq) \\<in> set (map (\\<lambda>(assumps,(a,(b,c))). (assumps, (a,b,map (drop 1) c))) (reduce_system_M p [1] (base_case_info_M_assumps init_assumps)))\"\n      using less.prems by auto \n    then obtain a b c where \"(assumps, (a, (b, c))) \\<in> set (reduce_system_M p [1] (base_case_info_M_assumps init_assumps))\"\n      by auto \n    then have \"(assumps, (a, (b, c))) \\<in> set (concat (map (reduce_system_single_M p [1]) [(init_assumps, base_case_info_R)]))\"\n      unfolding base_case_info_M_assumps_def\n      using Renegar_Algorithm.base_case_info_R_def Renegar_Algorithm.base_case_info_R_def \n      by (auto) \n    then have \"(assumps, (a, (b, c))) \\<in> set( reduce_system_single_M p [1] (init_assumps, base_case_info_R))\"\n      by auto\n    then have \"set init_assumps \\<subseteq> set assumps\"\n      unfolding base_case_info_R_def\n      using reduce_system_single_M_subset_prop[of assumps \"(a, (b, c))\" p \"[1]\" init_assumps]\n      by auto\n  }\n  moreover {assume *: \"length qs = 1\"\n    then have \"(assumps, mat_eq) \\<in> set (reduce_system_M p qs (base_case_info_M_assumps init_assumps))\"\n      using less.prems by auto \n    then obtain a b c where \"(assumps, (a, (b, c))) \\<in> set (reduce_system_M p qs (base_case_info_M_assumps init_assumps))\"\n      by (smt (verit) prod.sel(2) prod_cases4)\n    then have \"(assumps, (a, (b, c))) \\<in> set (concat (map (reduce_system_single_M p qs) [(init_assumps, base_case_info_R)]))\"\n      unfolding base_case_info_M_assumps_def \n      using Renegar_Algorithm.base_case_info_R_def Renegar_Algorithm.base_case_info_R_def \n      by (auto)\n    then have \"(assumps, (a, (b, c))) \\<in> set( reduce_system_single_M p qs (init_assumps, base_case_info_R))\"\n      by auto\n    then have \"set init_assumps \\<subseteq> set assumps\"\n      unfolding base_case_info_R_def\n      using reduce_system_single_M_subset_prop[of assumps \"(a, (b, c))\" p qs init_assumps]\n      by auto\n  }\n  moreover {assume *: \"length qs > 1\"\n    let ?len = \"length qs\"\n    let ?q1 = \"take (?len div 2) qs\"\n    let ?left = \"calculate_data_assumps_M p ?q1 init_assumps\"\n    let ?q2 = \"drop (?len div 2) qs\"\n    let ?right = \"calculate_data_assumps_M p ?q2 init_assumps\"\n    let ?comb = \"combine_systems_M p ?q1 ?left ?q2 ?right\"\n    have len_q1_less: \"length ?q1 < length qs\"\n      using * by auto\n    have inset_red: \"(assumps, mat_eq) \\<in> set(reduce_system_M p (fst ?comb) (snd ?comb))\"\n      using * less.prems\n      by (smt (verit, best) calculate_data_assumps_M.simps less_one nat_less_le not_one_less_zero)\n    have \"fst ?comb = qs\"\n      by auto\n    then have \"(assumps, mat_eq) \\<in> set(reduce_system_M p qs (snd ?comb))\"\n      using inset_red \n      by auto\n    then obtain assm_pre m_pre subs_pre signs_pre where assumps_reduce:\n      \"(assm_pre, (m_pre, subs_pre, signs_pre)) \\<in> set (snd ?comb)\"\n      \"(assumps, mat_eq) \\<in> set(reduce_system_single_M p qs (assm_pre, (m_pre, subs_pre, signs_pre)))\"\n      by (metis concat_map_in_set find_consistent_signs_at_roots_single_M.cases nth_mem reduce_system_M.simps)\n    then obtain meq1 meq2 assm1 assm2 where subsystems:\n      \"(assm1, meq1) \\<in> set (calculate_data_assumps_M p ?q1 init_assumps)\"\n      \"(assm2, meq2) \\<in> set (calculate_data_assumps_M p ?q2 init_assumps)\"\n      \"(assm_pre, (m_pre, subs_pre, signs_pre)) = combine_systems_single_M p ?q1 (assm1, meq1) ?q2 (assm2, meq2)\"\n      by auto (* Takes a second to load *)\n    then have assm_pre: \"assm_pre = assm1@assm2\" \n      by auto\n    have \"set init_assumps \\<subseteq> set assm1\"\n      using less.hyps[of ?q1] less.prems subsystems(1) len_q1_less\n      by auto (* Takes a second to load *)\n    then have \"set init_assumps \\<subseteq> set assm_pre\" \n      using assm_pre by auto \n    then have \"set init_assumps \\<subseteq> set assumps\"\n      using assumps_reduce(2) reduce_system_single_M_subset_prop[of assumps mat_eq p qs assm_pre m_pre subs_pre signs_pre]\n      by auto\n  }\n  ultimately show ?case\n    by (meson less_one linorder_neqE_nat)\nqed\n\nlemma extract_signs_M_subset:\n  assumes \"(assumps, signs) \\<in> set (extract_signs (calculate_data_assumps_M p qs init_assumps))\"\n  shows \"set init_assumps \\<subseteq> set assumps\"\nproof - \n  obtain mat_eq where \n    \"(assumps, mat_eq) \\<in> set (calculate_data_assumps_M p qs init_assumps)\"\n    \"signs = snd (snd mat_eq)\"\n    using assms by auto\n  then show ?thesis \n    using calculate_data_assumps_M_subset[of assumps mat_eq p qs init_assumps]\n    by auto\nqed\n\nsubsection \"Top-level Results: Connect calculate data methods to univariate\"\n\n(* Well-definedness property to satisfy induction hypothesis *)\nlemma all_list_constr_R_matches_well_def:\n  assumes welldef: \"all_list_constr_R subs (length q)\"\n  shows \"(Is1, Is2) \\<in> set (subs) \\<Longrightarrow> n \\<in> set Is1 \\<or> n \\<in> set Is2 \\<Longrightarrow> n < length q\"\nproof -\n  assume inset: \"(Is1, Is2) \\<in> set (subs)\"\n  assume inlist: \"n \\<in> set Is1 \\<or> n \\<in> set Is2\"\n  have welldef_var: \"\\<forall>x. x \\<in> set subs \\<longrightarrow>\n        list_constr (fst x) (length q) \\<and> list_constr (snd x) (length q)\"\n    using welldef  unfolding all_list_constr_R_def\n    by (simp add: in_set_member)\n  have \"(Is1, Is2) \\<in> set subs\"\n    using inset by auto \n  then have \"(\\<forall>x\\<in>set Is1. x < length q) \\<and> (\\<forall>x\\<in>set Is2. x < length q)\"\n    using welldef_var\n    by (simp add: Ball_set list_constr_def)\n  then show \"n < length q\"\n    using inlist\n    by metis\nqed\n\nlemma calculate_data_M_univariate:\n  assumes mat_eq: \"(assumps, mat_eq) \\<in> set (calculate_data_M p qs)\"\n  assumes \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  assumes p_nonzero: \"eval_mpoly_poly val p \\<noteq> 0\"\n  shows \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) = mat_eq\"\n  using assms\nproof (induct \"length qs\" arbitrary: val p mat_eq assumps qs rule: less_induct)\n  case (less qs val p mat_eq assumps) \n  have \"length qs = 0 \\<or> length qs = 1 \\<or> length qs > 1\"\n    by (meson less_one nat_neq_iff)\n  moreover {assume *: \"length qs = 0\"\n    let ?m = \"(mat_of_rows_list 3 [[1,1,1], [0,1,0], [1,0,-1]])\"\n    let ?subs = \"[([], []),([0], []),([], [0])]\"\n    let ?signs = \"[[1],[0],[-1]]\"\n    let ?eval_p = \"eval_mpoly_poly val p\"\n    have mat_eq_in: \"(assumps, mat_eq) \\<in> set (calculate_data_M p [])\"\n      using * less.prems(1) by auto \n    let ?map_base = \"map (\\<lambda>(assumps,(a,(b,c))). (assumps, (a,b,map (drop 1) c))) (reduce_system_M p [1] base_case_info_M)\"\n    have \"(assumps, mat_eq) \\<in> set ?map_base\"\n      using mat_eq_in \n      by auto\n    then obtain a1 b1 c1 where a1b1c1_prop:\n      \"(assumps, (a1, (b1, c1))) \\<in> set (reduce_system_M p [1] base_case_info_M)\"\n      \"mat_eq = (a1, (b1, map (drop 1) c1))\"\n      by auto\n    have base_case_well_def: \"\\<And>init_assumps init_mat_eq Is1 Is2 n subs m signs.\n        (init_assumps, m, subs, signs) \\<in> set base_case_info_M \\<Longrightarrow>\n        (Is1, Is2) \\<in> set subs \\<Longrightarrow> n \\<in> set Is1 \\<or> n \\<in> set Is2 \\<Longrightarrow> n < length [1]\"\n      using base_case_info_M_well_def by auto\n    have map_is: \"[1] = map (eval_mpoly_poly val) [1] \"\n      unfolding eval_mpoly_poly_def eval_mpoly_def \n      by auto\n   then have \"\\<exists>acc mss. (acc,mss) \\<in> set (base_case_info_M) \\<and> (a1, (b1, c1)) = reduce_system_R (eval_mpoly_poly val p) ([1],mss)\"\n      using reduce_system_M_univariate[of \"assumps\" \"(a1, b1, c1)\" p \"[1]\" base_case_info_M val \"[1]\"]\n        a1b1c1_prop less(3) base_case_well_def\n      apply (auto) \n      by metis\n    then obtain acc mss where a1b1c1_connect:\n      \"(acc,mss) \\<in> set (base_case_info_M)\" \n      \"(a1, (b1, c1)) = reduce_system_R (eval_mpoly_poly val p) ([1],mss)\"\n      by auto\n    then have mss_is: \"mss = base_case_info_R\"\n      unfolding base_case_info_M_def \n      by auto\n    obtain a b c where abc_prop: \"(a, b, c) = reduction_step_R ?m ?signs ?subs (solve_for_lhs_R ?eval_p [1] ?subs ?m)\"\n      by (metis reduction_step_R.simps)\n    then have \"(a, b, c) = (a1, b1, c1)\"\n      using abc_prop a1b1c1_prop\n      by (metis a1b1c1_connect(2) base_case_info_R_def mss_is reduce_system_R.simps) \n    then have mat_eq_is: \"(a, b, map (drop (Suc 0)) c) = mat_eq\"\n      using a1b1c1_prop(2) by (auto) \n    have \"qs = [] \\<Longrightarrow> mat_eq = (a, b, map (drop (Suc 0)) c) \\<Longrightarrow>\n      (case reduce_system_R (eval_mpoly_poly val p) ([1], base_case_info_R) of\n      (a, b, c) \\<Rightarrow> (a, b, map (drop (Suc 0)) c)) = (a, b, map (drop (Suc 0)) c) \"\n      using abc_prop unfolding base_case_info_R_def\n      using  old.prod.case reduce_system_R.simps\n      by (smt (verit, ccfv_SIG))\n    then have \"calculate_data_R ?eval_p (map (eval_mpoly_poly val) qs)= mat_eq\"\n      using * mat_eq_is\n      by simp \n  }\n  moreover {assume *: \"length qs = 1\"\n    have meq: \"(assumps, mat_eq) \\<in> set (reduce_system_M p qs base_case_info_M)\"\n      using \"*\" le_eq_less_or_eq less(2) one_neq_zero by auto\n    have **: \"\\<And>init_assumps init_mat_eq Is1 Is2 n subs m signs.\n      (init_assumps, m, subs, signs) \\<in> set base_case_info_M \\<Longrightarrow>\n      (Is1, Is2) \\<in> set subs \\<Longrightarrow>\n      n \\<in> set Is1 \\<or> n \\<in> set Is2 \\<Longrightarrow>\n      n < length qs\" unfolding *\n      using base_case_info_M_well_def\n      by meson\n    from reduce_system_M_univariate[OF meq less(3), of \" map (eval_mpoly_poly val)\n   qs\"]\n    obtain acc mss where ams: \"(acc,mss) \\<in> set base_case_info_M\" \n      \"mat_eq = reduce_system_R (eval_mpoly_poly val p)\n      (map (eval_mpoly_poly val) qs, mss)\"\n      using \"**\" by blast\n    then have \"mss = base_case_info_R\" unfolding base_case_info_M_def \n      by auto\n    then have \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) = mat_eq\"\n      using ams * by simp\n  }\n    (* Inductive case: progress by breaking down, using IH, then piecing back together.\n      It's the reduction of a combination of two smaller matrix equation pieces. *)\n  moreover {assume *: \"length qs  > 1\"\n    have inset: \"(assumps, mat_eq) \\<in> set (calculate_data_M p qs)\"\n      using less.prems(1) by auto \n    let ?len = \"length qs\"\n    let ?q1 = \"take (?len div 2) qs\"\n    let ?q2 = \"drop (?len div 2) qs\"\n    let ?left = \"calculate_data_M p ?q1\"\n    let ?right = \"calculate_data_M p ?q2\"\n    let ?comb = \"combine_systems_M p ?q1 ?left ?q2 ?right\"\n    let ?eval_p = \"(eval_mpoly_poly val p)\"\n    let ?eval_q1 = \"(map (eval_mpoly_poly val) ?q1)\"\n    let ?eval_q2 = \"(map (eval_mpoly_poly val) ?q2)\"\n    have map_q1: \"map (eval_mpoly_poly val) ?q1 = \n      (take (length (map (eval_mpoly_poly val) qs) div 2) (map (eval_mpoly_poly val) qs))\"\n      by (auto simp add: take_map) \n    have map_q2: \"map (eval_mpoly_poly val) ?q2 = \n      (drop (length (map (eval_mpoly_poly val) qs) div 2) (map (eval_mpoly_poly val) qs))\"\n      by (auto simp add: drop_map) \n    have \"fst ?comb = qs\" \n      by auto\n    then have \"(assumps, mat_eq) \\<in> set (reduce_system_M p qs (snd ?comb))\"\n      using inset *\n      by (smt (verit) calculate_data_M.simps less_numeral_extra(2) less_one nat_less_le)\n    then have \"(assumps, mat_eq) \\<in> set (concat (map (reduce_system_single_M p qs) (snd ?comb)))\"\n      by (metis reduce_system_M.simps)\n    then have \"\\<exists>sys. sys \\<in> set (snd ?comb) \\<and> (assumps, mat_eq) \\<in> set(reduce_system_single_M p qs sys)\"\n      using concat_map_in_set in_set_member\n      by (metis nth_mem) \n    then obtain a_pre me_pre  where reduce_prop: \"(a_pre, me_pre) \\<in> set (snd ?comb)\"\n      \"(assumps, mat_eq) \\<in> set(reduce_system_single_M p qs (a_pre, me_pre))\"\n      by fastforce \n    then obtain a1 me1 a2 me2 where mes_prop: \"(a1, me1) \\<in> set ?left\"\n      \"(a2, me2) \\<in> set ?right\"\n      \"(a_pre, me_pre) = combine_systems_single_M p ?q1 (a1, me1) ?q2 (a2, me2)\"\n      by auto\n    then have a_pre: \"a_pre = a1@a2\" \n      by auto \n    have lengt: \"length qs div 2 \\<ge> 1\"\n      using * by auto\n    then have len_q1: \"length ?q1 < length qs\"\n      by auto\n    have len_q2: \"length ?q2 < length qs\"\n      using lengt by auto\n    obtain mat_pre subs_pre signs_pre where me_decomp:\n      \"me_pre = (mat_pre,subs_pre,signs_pre)\"\n      using mes_prop\n      using prod_cases3 by blast \n    then have \"assumps \\<in> set (map fst (solve_for_lhs_M p a_pre qs subs_pre mat_pre))\"\n      using reduce_prop(2) by auto\n    then have \"assumps \\<in> set (map fst (construct_rhs_vector_M p a_pre qs subs_pre))\"\n      unfolding solve_for_lhs_M_def by auto\n    then obtain a_rhs_list where \"(assumps, a_rhs_list)\n    \\<in> set (construct_rhs_vector_rec_M p a_pre (pull_out_pairs qs subs_pre))\"\n      unfolding construct_rhs_vector_M_def by auto\n    then have a_pre_subset: \"set a_pre \\<subseteq> set assumps\"\n      using construct_rhs_vector_rec_M_subset_prop[of assumps _ p a_pre \"(pull_out_pairs qs subs_pre)\"]\n      by auto\n    have set_a1: \"set a1 \\<subseteq> set assumps\"\n      using a_pre_subset a_pre by auto \n    then have a1_satisfies: \"(\\<And>p n. (p, n) \\<in> set a1 \\<Longrightarrow> satisfies_evaluation val p n)\"\n      using less(3) by blast\n    from less.hyps[of ?q1 a1 me1, OF len_q1 mes_prop(1) a1_satisfies]\n    have me1_ind: \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) ?q1) = me1\"\n      using less(4) by blast\n    have set_a2: \"set a2 \\<subseteq> set assumps\"\n      using a_pre_subset a_pre by auto \n    then have a2_satisfies: \"(\\<And>p n. (p, n) \\<in> set a2 \\<Longrightarrow> satisfies_evaluation val p n)\"\n      using less(3) by blast\n    from less.hyps[of ?q2 a2 me2, OF len_q2 mes_prop(2) a2_satisfies]\n    have me2_ind: \"calculate_data_R ?eval_p (map (eval_mpoly_poly val) ?q2) = me2\"\n      using less(4) by blast\n    have \"a_pre = a1 @ a2 \\<Longrightarrow> me_pre =\n      snd (combine_systems_R p (take (length qs div 2) qs, me1)\n            (drop (length qs div 2) qs, me2)) \\<Longrightarrow>\n      snd (combine_systems_R p (take (length qs div 2) qs, me1)\n            (drop (length qs div 2) qs, me2)) =\n      snd (combine_systems_R (eval_mpoly_poly val p)\n            (map (eval_mpoly_poly val) (take (length qs div 2) qs), me1)\n            (map (eval_mpoly_poly val) (drop (length qs div 2) qs), me2))\"\n      using combine_systems_R_snd\n      by (metis length_map)\n    then have me_pre: \"me_pre = snd (combine_systems_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) ?q1), me1) ((map (eval_mpoly_poly val) ?q2), me2))\"\n      using mes_prop(3)\n      by (auto)\n    obtain mat_pre1 subs_pre1 signs_pre1 where me1_decomp:\n      \"me1 = (mat_pre1,subs_pre1,signs_pre1)\"\n      using prod_cases3 by blast\n    obtain mat_pre2 subs_pre2 signs_pre2 where me2_decomp:\n      \"me2 = (mat_pre2,subs_pre2,signs_pre2)\"\n      using prod_cases3 by blast\n    have fst_comb: \"fst (combine_systems_R ?eval_p ((map (eval_mpoly_poly val) ?q1), me1) ((map (eval_mpoly_poly val) ?q2), me2)) = (map (eval_mpoly_poly val) ?q1) @ (map (eval_mpoly_poly val) ?q2)\"\n    proof -   \n      have \"fst (combine_systems_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) ?q1), me1) ((map (eval_mpoly_poly val) ?q2), me2)) =\n        fst (smash_systems_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) ?q1) (map (eval_mpoly_poly val) ?q2) subs_pre1 subs_pre2 signs_pre1 signs_pre2 mat_pre1 mat_pre2)\"\n        using combining_to_smash_R me1_decomp me2_decomp by force\n      then show ?thesis\n        unfolding smash_systems_R_def by auto \n    qed\n    then have \"map (eval_mpoly_poly val) qs = fst (combine_systems_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) ?q1), me1) ((map (eval_mpoly_poly val) ?q2), me2))\"\n      by (metis append_take_drop_id map_append)\n    then have me_pre_var:  \"(map (eval_mpoly_poly val) qs, me_pre) = (combine_systems_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) ?q1), me1) ((map (eval_mpoly_poly val) ?q2), me2))\"\n      using me_pre by auto \n    have len_hyp: \"length (map (eval_mpoly_poly val) qs) > 1\"\n      using * by auto\n    have len_eq: \"length (map (eval_mpoly_poly val) qs) = length qs\"\n      by simp \n    have len_q1_gt0: \"length (map (eval_mpoly_poly val) ?q1) > 0\"\n      using len_hyp len_eq by auto\n    have len_q2_gt0: \"length (map (eval_mpoly_poly val) ?q2) > 0\"\n      using len_hyp len_eq by auto\n    let ?uni_sys_q1 = \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) ?q1)\"\n    have sat_props_q1_univ: \"satisfies_properties_R ?eval_p (map (eval_mpoly_poly val) ?q1) (get_subsets_R ?uni_sys_q1) (get_signs_R ?uni_sys_q1) (get_matrix_R ?uni_sys_q1)\"\n      using calculate_data_satisfies_properties_R[of \"?eval_p\" \"(map (eval_mpoly_poly val) (take (length qs div 2) qs))\"]\n        len_q1_gt0  using less.prems(3) by auto\n    let ?uni_sys_q2 = \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) ?q2)\"\n    have sat_props_q2_univ: \"satisfies_properties_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) ?q2) (get_subsets_R ?uni_sys_q2) (get_signs_R ?uni_sys_q2) (get_matrix_R ?uni_sys_q2)\"\n      using calculate_data_satisfies_properties_R[of \"(eval_mpoly_poly val p)\" \"(map (eval_mpoly_poly val) (drop (length qs div 2) qs))\"]\n        len_q2_gt0  using less.prems(3)  by auto\n    have comb_satisfies: \"satisfies_properties_R ?eval_p (?eval_q1@(map (eval_mpoly_poly val) ?q2)) \n  (get_subsets_R (snd ((combine_systems_R ?eval_p (?eval_q1,?uni_sys_q1) (?eval_q2,?uni_sys_q2))))) \n  (get_signs_R (snd ((combine_systems_R ?eval_p (?eval_q1,?uni_sys_q1) (?eval_q2,?uni_sys_q2))))) \n  (get_matrix_R (snd ((combine_systems_R ?eval_p (?eval_q1,?uni_sys_q1) (?eval_q2,?uni_sys_q2)))))\"\n      using combining_sys_satisfies_properties_R[of ?eval_p ?eval_q1 ?eval_q2] len_q1_gt0 len_q2_gt0 less.prems(3)\n        sat_props_q2_univ sat_props_q1_univ\n      by auto (* takes a second to load *)\n    then have well_def_subs_pre: \"all_list_constr_R (get_subsets_R (snd ((combine_systems_R ?eval_p (?eval_q1,?uni_sys_q1) (?eval_q2,?uni_sys_q2))))) (length (?eval_q1@?eval_q2))\"\n      unfolding satisfies_properties_R_def by auto\n    have get_subs_pre: \"(get_subsets_R (snd ((combine_systems_R ?eval_p (?eval_q1,?uni_sys_q1) (?eval_q2,?uni_sys_q2))))) = subs_pre\"\n      using me_decomp unfolding get_subsets_R_def\n      by (metis fst_conv me1_ind me2_ind me_pre_var snd_conv) \n    have well_def: \"(\\<And>Is1 Is2 n. (Is1, Is2) \\<in> set (fst (snd me_pre)) \\<Longrightarrow> n \\<in> set Is1 \\<or> n \\<in> set Is2 \\<Longrightarrow> n < length qs)\"\n      using well_def_subs_pre get_subs_pre \n        all_list_constr_R_matches_well_def[of subs_pre]\n      by (smt (verit, ccfv_SIG) fst_comb fst_conv get_subsets_R_def length_map me1_ind me2_ind me_pre_var snd_conv) \n    then have reduce_mat_eq: \"mat_eq = reduce_system_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) qs), me_pre)\"\n      using reduce_system_single_M_univariate[OF reduce_prop(2) less.prems(2)]\n      by (metis prod.exhaust_sel) \n    let ?eval_qs = \"(map (eval_mpoly_poly val) qs)\"\n    have \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) = \n     (let q1 = take ((length ?eval_qs) div 2) ?eval_qs; left = calculate_data_R ?eval_p q1;\n         q2 = drop ((length ?eval_qs) div 2) ?eval_qs; right = calculate_data_R ?eval_p q2;\n         comb = combine_systems_R ?eval_p (q1,left) (q2,right) in\n         reduce_system_R ?eval_p comb)\"\n      using len_hyp\n      by (smt (z3) calculate_data_R.simps less_one nat_less_le semiring_norm(136)) \n    moreover have \"... = (let q1 =(map (eval_mpoly_poly val) ?q1);\n         left = calculate_data_R (eval_mpoly_poly val p) q1;\n         q2 = (map (eval_mpoly_poly val) ?q2);\n         right = calculate_data_R (eval_mpoly_poly val p) q2\n     in Let (combine_systems_R (eval_mpoly_poly val p) (q1, left) (q2, right))\n         (reduce_system_R (eval_mpoly_poly val p))) \"\n      using map_q1 map_q2 by auto \n    moreover have \"... = (let q1 =(map (eval_mpoly_poly val) ?q1); left = me1; \n      q2 = (map (eval_mpoly_poly val) ?q2); right = me2 in\n      Let (combine_systems_R (eval_mpoly_poly val p) (q1, left) (q2, right))\n         (reduce_system_R (eval_mpoly_poly val p)))\"\n      unfolding Let_def me1_ind me2_ind by auto\n    moreover have \"... = mat_eq\"\n      unfolding Let_def reduce_mat_eq me_pre_var by auto  \n    ultimately have \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) = mat_eq\"\n      by auto (* Can take a second to load *)\n  }\n  ultimately show ?case by blast\nqed\n\nlemma calculate_data_M_assumps_univariate:\n  assumes mat_eq: \"(assumps, mat_eq) \\<in> set (calculate_data_assumps_M p qs init_assumps)\"\n  assumes \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  assumes p_nonzero: \"eval_mpoly_poly val p \\<noteq> 0\"\n  shows \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) = mat_eq\"\n  using assms\nproof (induct \"length qs\" arbitrary: val p mat_eq assumps qs rule: less_induct)\n  case (less qs val p mat_eq assumps) \n  have \"length qs = 0 \\<or> length qs = 1 \\<or> length qs > 1\"\n    by (meson less_one nat_neq_iff)\n  moreover {assume *: \"length qs = 0\"\n    let ?m = \"(mat_of_rows_list 3 [[1,1,1], [0,1,0], [1,0,-1]])\"\n    let ?subs = \"[([], []),([0], []),([], [0])]\"\n    let ?signs = \"[[1],[0],[-1]]\"\n    let ?eval_p = \"eval_mpoly_poly val p\"\n    have mat_eq_in: \"(assumps, mat_eq) \\<in> set (calculate_data_assumps_M p [] init_assumps)\"\n      using * less.prems(1) by auto \n    let ?map_base = \"map (\\<lambda>(assumps,(a,(b,c))). (assumps, (a,b,map (drop 1) c))) (reduce_system_M p [1] (base_case_info_M_assumps init_assumps))\"\n    have \"(assumps, mat_eq) \\<in> set ?map_base\"\n      using mat_eq_in \n      by auto\n    then obtain a1 b1 c1 where a1b1c1_prop:\n      \"(assumps, (a1, (b1, c1))) \\<in> set (reduce_system_M p [1] (base_case_info_M_assumps init_assumps))\"\n      \"mat_eq = (a1, (b1, map (drop 1) c1))\"\n      by auto\n    have base_case_well_def: \"\\<And>in_a init_mat_eq Is1 Is2 n subs m signs.\n        (in_a, m, subs, signs) \\<in> set (base_case_info_M_assumps init_assumps) \\<Longrightarrow>\n        (Is1, Is2) \\<in> set subs \\<Longrightarrow> n \\<in> set Is1 \\<or> n \\<in> set Is2 \\<Longrightarrow> n < length [1]\"\n      using base_case_with_assumps_info_M_well_def  \n      by auto\n    have \" [1] = map (eval_mpoly_poly val) [1] \"\n      unfolding eval_mpoly_poly_def eval_mpoly_def \n      by auto\n    then have \"\\<exists>acc mss. (acc,mss) \\<in> set ((base_case_info_M_assumps init_assumps)) \\<and> (a1, (b1, c1)) = reduce_system_R (eval_mpoly_poly val p) ([1],mss)\"\n      using reduce_system_M_univariate[of \"assumps\" \"(a1, b1, c1)\" p \"[1]\" \"(base_case_info_M_assumps init_assumps)\" val \"[1]\"]\n        a1b1c1_prop less(3) base_case_well_def apply (auto)\n      by metis\n    then obtain acc mss where a1b1c1_connect:\n      \"(acc,mss) \\<in>  set ((base_case_info_M_assumps init_assumps))\" \n      \"(a1, (b1, c1)) = reduce_system_R (eval_mpoly_poly val p) ([1],mss)\"\n      by auto\n    then have mss_is: \"mss = base_case_info_R\"\n      unfolding base_case_info_M_assumps_def \n      using Renegar_Algorithm.base_case_info_R_def Renegar_Algorithm.base_case_info_R_def\n      by auto\n    obtain a b c where abc_prop: \"(a, b, c) = reduction_step_R ?m ?signs ?subs (solve_for_lhs_R ?eval_p [1] ?subs ?m)\"\n      by (metis reduction_step_R.simps)\n    then have \"(a, b, c) = (a1, b1, c1)\"\n      using abc_prop a1b1c1_prop\n      by (metis a1b1c1_connect(2) base_case_info_R_def mss_is reduce_system_R.simps) \n    then have mat_eq_is: \"(a, b, map (drop (Suc 0)) c) = mat_eq\"\n      using a1b1c1_prop(2) by (auto) \n    have \"(a, b, c) =\n  reduction_step_R (mat_of_rows_list 3 [[1, 1, 1], [0, 1, 0], [1, 0, - 1]])\n   [[1], [0], [- 1]] [([], []), ([0], []), ([], [0])]\n   (solve_for_lhs_R (eval_mpoly_poly val p) [1]\n     [([], []), ([0], []), ([], [0])]\n     (mat_of_rows_list 3 [[1, 1, 1], [0, 1, 0], [1, 0, - 1]]))\"\n      using abc_prop\n      unfolding base_case_info_R_def\n      by (smt (verit) old.prod.case reduce_system_R.simps)\n    then have \"calculate_data_R ?eval_p (map (eval_mpoly_poly val) qs)= mat_eq\"\n      using mat_eq_is *\n      by (smt (z3) a1b1c1_connect(2) a1b1c1_prop(2) calculate_data_R.simps length_map mss_is split_conv) \n  }\n  moreover {assume *: \"length qs = 1\"\n    have meq: \"(assumps, mat_eq) \\<in> set (reduce_system_M p qs (base_case_info_M_assumps init_assumps))\"\n      using \"*\" le_eq_less_or_eq less(2) one_neq_zero by auto\n    have **: \"\\<And>init_assumps init_mat_eq Is1 Is2 n subs m signs.\n      (init_assumps, m, subs, signs) \\<in> set (base_case_info_M_assumps init_assumps) \\<Longrightarrow>\n      (Is1, Is2) \\<in> set subs \\<Longrightarrow>\n      n \\<in> set Is1 \\<or> n \\<in> set Is2 \\<Longrightarrow>\n      n < length qs\" unfolding *\n      using base_case_with_assumps_info_M_well_def\n      by meson\n    from reduce_system_M_univariate[OF meq less(3), of \" map (eval_mpoly_poly val)\n   qs\"]\n    obtain acc mss where ams: \"(acc,mss) \\<in> set (base_case_info_M_assumps init_assumps)\" \n      \"mat_eq = reduce_system_R (eval_mpoly_poly val p)\n      (map (eval_mpoly_poly val) qs, mss)\"\n      using \"**\"\n      apply (auto) \n      by (smt (z3) \"*\" base_case_with_assumps_info_M_well_def) \n    then have \"mss = base_case_info_R\" unfolding base_case_info_M_assumps_def \n      using Renegar_Algorithm.base_case_info_R_def Renegar_Algorithm.base_case_info_R_def\n      by auto\n    then have \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) = mat_eq\"\n      using ams * by simp\n  }\n    (* Inductive case: progress by breaking down, using IH, then piecing back together.\n      It's the reduction of a combination of two smaller matrix equation pieces. *)\n  moreover {assume *: \"length qs  > 1\"\n    have inset: \"(assumps, mat_eq) \\<in> set (calculate_data_assumps_M p qs init_assumps)\"\n      using less.prems(1) \n      by auto \n    let ?len = \"length qs\"\n    let ?q1 = \"take (?len div 2) qs\"\n    let ?q2 = \"drop (?len div 2) qs\"\n    let ?left = \"calculate_data_assumps_M p ?q1 init_assumps\"\n    let ?right = \"calculate_data_assumps_M p ?q2 init_assumps\"\n    let ?comb = \"combine_systems_M p ?q1 ?left ?q2 ?right\"\n    let ?eval_p = \"(eval_mpoly_poly val p)\"\n    let ?eval_q1 = \"(map (eval_mpoly_poly val) ?q1)\"\n    let ?eval_q2 = \"(map (eval_mpoly_poly val) ?q2)\"\n    have map_q1: \"map (eval_mpoly_poly val) ?q1 = \n      (take (length (map (eval_mpoly_poly val) qs) div 2) (map (eval_mpoly_poly val) qs))\"\n      by (auto simp add: take_map) \n    have map_q2: \"map (eval_mpoly_poly val) ?q2 = \n      (drop (length (map (eval_mpoly_poly val) qs) div 2) (map (eval_mpoly_poly val) qs))\"\n      by (auto simp add: drop_map) \n    have \"fst ?comb = qs\" \n      by auto\n    then have \"(assumps, mat_eq) \\<in> set (reduce_system_M p qs (snd ?comb))\"\n      using inset *\n      by (smt (z3) calculate_data_assumps_M.simps gr_implies_not0 less_one nat_less_le) \n    then have \"(assumps, mat_eq) \\<in> set (concat (map (reduce_system_single_M p qs) (snd ?comb)))\"\n      by (metis reduce_system_M.simps)\n    then have \"\\<exists>sys. sys \\<in> set (snd ?comb) \\<and> (assumps, mat_eq) \\<in> set(reduce_system_single_M p qs sys)\"\n      using concat_map_in_set in_set_member\n      by (metis nth_mem) \n    then obtain a_pre me_pre  where reduce_prop: \"(a_pre, me_pre) \\<in> set (snd ?comb)\"\n      \"(assumps, mat_eq) \\<in> set(reduce_system_single_M p qs (a_pre, me_pre))\"\n      by fastforce \n    then obtain a1 me1 a2 me2 where mes_prop: \"(a1, me1) \\<in> set ?left\"\n      \"(a2, me2) \\<in> set ?right\"\n      \"(a_pre, me_pre) = combine_systems_single_M p ?q1 (a1, me1) ?q2 (a2, me2)\"\n      by auto\n    then have a_pre: \"a_pre = a1@a2\" \n      by auto \n    have lengt: \"length qs div 2 \\<ge> 1\"\n      using * by auto\n    then have len_q1: \"length ?q1 < length qs\"\n      by auto\n    have len_q2: \"length ?q2 < length qs\"\n      using lengt by auto\n    obtain mat_pre subs_pre signs_pre where me_decomp:\n      \"me_pre = (mat_pre,subs_pre,signs_pre)\"\n      using mes_prop\n      using prod_cases3 by blast \n    then have \"assumps \\<in> set (map fst (solve_for_lhs_M p a_pre qs subs_pre mat_pre))\"\n      using reduce_prop(2) by auto\n    then have \"assumps \\<in> set (map fst (construct_rhs_vector_M p a_pre qs subs_pre))\"\n      unfolding solve_for_lhs_M_def by auto\n    then obtain a_rhs_list where \"(assumps, a_rhs_list)\n    \\<in> set (construct_rhs_vector_rec_M p a_pre (pull_out_pairs qs subs_pre))\"\n      unfolding construct_rhs_vector_M_def by auto\n    then have a_pre_subset: \"set a_pre \\<subseteq> set assumps\"\n      using construct_rhs_vector_rec_M_subset_prop[of assumps _ p a_pre \"(pull_out_pairs qs subs_pre)\"]\n      by auto\n    have set_a1: \"set a1 \\<subseteq> set assumps\"\n      using a_pre_subset a_pre by auto \n    then have a1_satisfies: \"(\\<And>p n. (p, n) \\<in> set a1 \\<Longrightarrow> satisfies_evaluation val p n)\"\n      using less(3) by blast\n    from less.hyps[of ?q1 a1 me1, OF len_q1 mes_prop(1) a1_satisfies]\n    have me1_ind: \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) ?q1) = me1\"\n      using less(4) by blast\n    have set_a2: \"set a2 \\<subseteq> set assumps\"\n      using a_pre_subset a_pre by auto \n    then have a2_satisfies: \"(\\<And>p n. (p, n) \\<in> set a2 \\<Longrightarrow> satisfies_evaluation val p n)\"\n      using less(3) by blast\n    from less.hyps[of ?q2 a2 me2, OF len_q2 mes_prop(2) a2_satisfies]\n    have me2_ind: \"calculate_data_R ?eval_p (map (eval_mpoly_poly val) ?q2) = me2\"\n      using less(4) by blast\n    have me_pre: \"me_pre = snd (combine_systems_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) ?q1), me1) ((map (eval_mpoly_poly val) ?q2), me2))\"\n      using mes_prop(3) combine_systems_R_snd length_map\n      by (metis combine_systems_single_M.simps snd_conv) \n    obtain mat_pre1 subs_pre1 signs_pre1 where me1_decomp:\n      \"me1 = (mat_pre1,subs_pre1,signs_pre1)\"\n      using prod_cases3 by blast\n    obtain mat_pre2 subs_pre2 signs_pre2 where me2_decomp:\n      \"me2 = (mat_pre2,subs_pre2,signs_pre2)\"\n      using prod_cases3 by blast\n    have fst_comb: \"fst (combine_systems_R ?eval_p ((map (eval_mpoly_poly val) ?q1), me1) ((map (eval_mpoly_poly val) ?q2), me2)) = (map (eval_mpoly_poly val) ?q1) @ (map (eval_mpoly_poly val) ?q2)\"\n    proof -   \n      have \"fst (combine_systems_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) ?q1), me1) ((map (eval_mpoly_poly val) ?q2), me2)) =\n        fst (smash_systems_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) ?q1) (map (eval_mpoly_poly val) ?q2) subs_pre1 subs_pre2 signs_pre1 signs_pre2 mat_pre1 mat_pre2)\"\n        using combining_to_smash_R me1_decomp me2_decomp by force\n      then show ?thesis\n        unfolding smash_systems_R_def by auto \n    qed\n    then have \"map (eval_mpoly_poly val) qs = fst (combine_systems_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) ?q1), me1) ((map (eval_mpoly_poly val) ?q2), me2))\"\n      by (metis append_take_drop_id map_append)\n    then have me_pre_var:  \"(map (eval_mpoly_poly val) qs, me_pre) = (combine_systems_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) ?q1), me1) ((map (eval_mpoly_poly val) ?q2), me2))\"\n      using me_pre by auto \n    have len_hyp: \"length (map (eval_mpoly_poly val) qs) > 1\"\n      using * by auto\n    have len_eq: \"length (map (eval_mpoly_poly val) qs) = length qs\"\n      by simp \n    have len_q1_gt0: \"length (map (eval_mpoly_poly val) ?q1) > 0\"\n      using len_hyp len_eq by auto\n    have len_q2_gt0: \"length (map (eval_mpoly_poly val) ?q2) > 0\"\n      using len_hyp len_eq by auto\n    let ?uni_sys_q1 = \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) ?q1)\"\n    have sat_props_q1_univ: \"satisfies_properties_R ?eval_p (map (eval_mpoly_poly val) ?q1) (get_subsets_R ?uni_sys_q1) (get_signs_R ?uni_sys_q1) (get_matrix_R ?uni_sys_q1)\"\n      using calculate_data_satisfies_properties_R[of \"?eval_p\" \"(map (eval_mpoly_poly val) (take (length qs div 2) qs))\"]\n        len_q1_gt0  using less.prems(3) by auto\n    let ?uni_sys_q2 = \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) ?q2)\"\n    have sat_props_q2_univ: \"satisfies_properties_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) ?q2) (get_subsets_R ?uni_sys_q2) (get_signs_R ?uni_sys_q2) (get_matrix_R ?uni_sys_q2)\"\n      using calculate_data_satisfies_properties_R[of \"(eval_mpoly_poly val p)\" \"(map (eval_mpoly_poly val) (drop (length qs div 2) qs))\"]\n        len_q2_gt0  using less.prems(3)  by auto\n    have comb_satisfies: \"satisfies_properties_R ?eval_p (?eval_q1@(map (eval_mpoly_poly val) ?q2)) \n  (get_subsets_R (snd ((combine_systems_R ?eval_p (?eval_q1,?uni_sys_q1) (?eval_q2,?uni_sys_q2))))) \n  (get_signs_R (snd ((combine_systems_R ?eval_p (?eval_q1,?uni_sys_q1) (?eval_q2,?uni_sys_q2))))) \n  (get_matrix_R (snd ((combine_systems_R ?eval_p (?eval_q1,?uni_sys_q1) (?eval_q2,?uni_sys_q2)))))\"\n      using combining_sys_satisfies_properties_R[of ?eval_p ?eval_q1 ?eval_q2] len_q1_gt0 len_q2_gt0 less.prems(3)\n        sat_props_q2_univ sat_props_q1_univ \n      by auto  (* takes a second to load *)\n    then have well_def_subs_pre: \"all_list_constr_R (get_subsets_R (snd ((combine_systems_R ?eval_p (?eval_q1,?uni_sys_q1) (?eval_q2,?uni_sys_q2))))) (length (?eval_q1@?eval_q2))\"\n      unfolding satisfies_properties_R_def by auto\n    have get_subs_pre: \"(get_subsets_R (snd ((combine_systems_R ?eval_p (?eval_q1,?uni_sys_q1) (?eval_q2,?uni_sys_q2))))) = subs_pre\"\n      using me_decomp unfolding get_subsets_R_def\n      by (metis fst_conv me1_ind me2_ind me_pre_var snd_conv) \n    have well_def: \"(\\<And>Is1 Is2 n. (Is1, Is2) \\<in> set (fst (snd me_pre)) \\<Longrightarrow> n \\<in> set Is1 \\<or> n \\<in> set Is2 \\<Longrightarrow> n < length qs)\"\n      using well_def_subs_pre get_subs_pre \n        all_list_constr_R_matches_well_def[of subs_pre]\n      by (smt (verit, ccfv_SIG) fst_comb fst_conv get_subsets_R_def length_map me1_ind me2_ind me_pre_var snd_conv) \n    then have reduce_mat_eq: \"mat_eq =  reduce_system_R (eval_mpoly_poly val p) ((map (eval_mpoly_poly val) qs), me_pre)\"\n      using reduce_system_single_M_univariate[OF reduce_prop(2) less.prems(2)]\n      by (metis prod.exhaust_sel) \n    let ?eval_qs = \"(map (eval_mpoly_poly val) qs)\"\n    have \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) = \n     (let q1 = take ((length ?eval_qs) div 2) ?eval_qs; left = calculate_data_R ?eval_p q1;\n         q2 = drop ((length ?eval_qs) div 2) ?eval_qs; right = calculate_data_R ?eval_p q2;\n         comb = combine_systems_R ?eval_p (q1,left) (q2,right) in\n         reduce_system_R ?eval_p comb)\"\n      using len_hyp\n      by (smt (z3) calculate_data_R.simps less_one nat_less_le semiring_norm(136)) \n    moreover have \"... = (let q1 =(map (eval_mpoly_poly val) ?q1);\n         left = calculate_data_R (eval_mpoly_poly val p) q1;\n         q2 = (map (eval_mpoly_poly val) ?q2);\n         right = calculate_data_R (eval_mpoly_poly val p) q2\n     in Let (combine_systems_R (eval_mpoly_poly val p) (q1, left) (q2, right))\n         (reduce_system_R (eval_mpoly_poly val p))) \"\n      using map_q1 map_q2 by auto \n    moreover have \"... = (let q1 =(map (eval_mpoly_poly val) ?q1); left = me1; \n      q2 = (map (eval_mpoly_poly val) ?q2); right = me2 in\n      Let (combine_systems_R (eval_mpoly_poly val p) (q1, left) (q2, right))\n         (reduce_system_R (eval_mpoly_poly val p)))\"\n      unfolding Let_def me1_ind me2_ind by auto\n    moreover have \"... = mat_eq\"\n      unfolding Let_def reduce_mat_eq me_pre_var by auto  \n    ultimately have \"calculate_data_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs) = mat_eq\"\n      by auto\n  }\n  ultimately show ?case by blast\nqed\n\nlemma calculate_data_gives_signs_at_roots:\n  assumes \"(assumps, signs) \\<in> set (calculate_data_to_signs (calculate_data_M p qs))\"\n  assumes \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  assumes \"eval_mpoly_poly val p \\<noteq> 0\"\n  shows \"signs = find_consistent_signs_at_roots_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs)\"\n  using assms calculate_data_M_univariate \n  unfolding find_consistent_signs_at_roots_R_def by auto\n\nlemma calculate_data_gives_noncomp_signs_at_roots:\n  assumes \"(assumps, signs) \\<in> set (calculate_data_to_signs (calculate_data_M p qs))\"\n  assumes \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  assumes \"eval_mpoly_poly val p \\<noteq> 0\"\n  shows \"set signs = set (characterize_consistent_signs_at_roots (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs))\"\n  using assms find_consistent_signs_at_roots_R calculate_data_gives_signs_at_roots\n  by metis\n\nlemma calculate_data_assumps_gives_signs_at_roots:\n  assumes \"(assumps, signs) \\<in> set (calculate_data_to_signs (calculate_data_assumps_M p qs init_assumps))\"\n  assumes \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  assumes \"eval_mpoly_poly val p \\<noteq> 0\"\n  shows \"signs = find_consistent_signs_at_roots_R (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs)\"\n  using assms calculate_data_M_assumps_univariate \n  unfolding find_consistent_signs_at_roots_R_def \n  by auto\n\nlemma calculate_data_assumps_gives_noncomp_signs_at_roots:\n  assumes \"(assumps, signs) \\<in> set (calculate_data_to_signs (calculate_data_assumps_M p qs init_assumps))\"\n  assumes \"\\<And>p n. (p,n) \\<in> set assumps \\<Longrightarrow> satisfies_evaluation val p n\"\n  assumes \"eval_mpoly_poly val p \\<noteq> 0\"\n  shows \"set signs = set (characterize_consistent_signs_at_roots (eval_mpoly_poly val p) (map (eval_mpoly_poly val) qs))\"\n  using assms find_consistent_signs_at_roots_R calculate_data_assumps_gives_signs_at_roots\n  by metis \n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Quantifier_Elimination_Hybrid/Hybrid_Multiv_Matrix_Proofs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.679178692681616, "lm_q1q2_score": 0.3448949981093643}}
{"text": "(*  Title:      JinjaThreads/Common/TypeRel.thy\n    Author:     Tobias Nipkow, Andreas Lochbihler\n\n    Based on the Jinja theory Common/Type.thy by Tobias Nipkow\n\n*)\n\nheader {* \\isaheader{Relations between Jinja Types} *}\n\ntheory TypeRel\nimports\n  Decl\nbegin\n\nsubsection{* The subclass relations *}\n\ninductive subcls1 :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<prec>\\<^sup>1 _\" [71, 71, 71] 70)\n  for P :: \"'m prog\"\nwhere subcls1I: \"\\<lbrakk> class P C = Some (D, rest); C \\<noteq> Object \\<rbrakk> \\<Longrightarrow> P \\<turnstile> C \\<prec>\\<^sup>1 D\"\n\nabbreviation subcls :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<preceq>\\<^sup>* _\"  [71,71,71] 70)\nwhere \"P \\<turnstile> C \\<preceq>\\<^sup>* D \\<equiv> (subcls1 P)\\<^sup>*\\<^sup>* C D\"\n\nlemma subcls1D:\n  \"P \\<turnstile> C \\<prec>\\<^sup>1 D \\<Longrightarrow> C \\<noteq> Object \\<and> (\\<exists>fs ms. class P C = Some (D,fs,ms))\"\nby(auto elim: subcls1.cases)\n\nlemma Object_subcls1 [iff]: \"\\<not> P \\<turnstile> Object \\<prec>\\<^sup>1 C\"\nby(simp add: subcls1.simps)\n\nlemma Object_subcls_conv [iff]: \"(P \\<turnstile> Object \\<preceq>\\<^sup>* C) = (C = Object)\"\nby(auto elim: converse_rtranclpE)\n\nlemma finite_subcls1: \"finite {(C, D). P \\<turnstile> C \\<prec>\\<^sup>1 D}\"\nproof -\n  let ?A = \"SIGMA C:{C. is_class P C}. {D. C\\<noteq>Object \\<and> fst (the (class P C))=D}\"\n  have \"finite ?A\" by(rule finite_SigmaI [OF finite_is_class]) auto\n  also have \"?A = {(C, D). P \\<turnstile> C \\<prec>\\<^sup>1 D}\"\n    by(fastforce simp:is_class_def dest: subcls1D elim: subcls1I)\n  finally show ?thesis .\nqed\n\nlemma finite_subcls1':\n  \"finite ({(D, C). P \\<turnstile> C \\<prec>\\<^sup>1 D})\"\nby(subst finite_converse[symmetric])\n  (simp add: converse_unfold finite_subcls1 del: finite_converse)\n\nlemma subcls_is_class: \"(subcls1 P)\\<^sup>+\\<^sup>+ C D \\<Longrightarrow> is_class P C\"\nby(auto elim: converse_tranclpE dest!: subcls1D simp add: is_class_def)\n\nlemma subcls_is_class1: \"\\<lbrakk> P \\<turnstile> C \\<preceq>\\<^sup>* D; is_class P D \\<rbrakk> \\<Longrightarrow> is_class P C\"\nby(auto elim: converse_rtranclpE dest!: subcls1D simp add: is_class_def)\n\nsubsection{* The subtype relations *}\n\ninductive widen :: \"'m prog \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<le> _\"   [71,71,71] 70)\n  for P :: \"'m prog\"\nwhere \n  widen_refl[iff]: \"P \\<turnstile> T \\<le> T\"\n| widen_subcls: \"P \\<turnstile> C \\<preceq>\\<^sup>* D  \\<Longrightarrow>  P \\<turnstile> Class C \\<le> Class D\"\n| widen_null[iff]: \"P \\<turnstile> NT \\<le> Class C\"\n| widen_null_array[iff]: \"P \\<turnstile> NT \\<le> Array A\"\n| widen_array_object: \"P \\<turnstile> Array A \\<le> Class Object\"\n| widen_array_array: \"P \\<turnstile> A \\<le> B \\<Longrightarrow> P \\<turnstile> Array A \\<le> Array B\"\n\nabbreviation\n  widens :: \"'m prog \\<Rightarrow> ty list \\<Rightarrow> ty list \\<Rightarrow> bool\" (\"_ \\<turnstile> _ [\\<le>] _\" [71,71,71] 70)\nwhere\n  \"P \\<turnstile> Ts [\\<le>] Ts' == list_all2 (widen P) Ts Ts'\"\n\n\n\nlemma [iff]: \"(P \\<turnstile> T \\<le> Boolean) = (T = Boolean)\"\n(*<*)by (auto elim: widen.cases)(*>*)\n\nlemma [iff]: \"(P \\<turnstile> T \\<le> Integer) = (T = Integer)\"\n(*<*)by (auto elim: widen.cases)(*>*)\n\nlemma [iff]: \"(P \\<turnstile> Void \\<le> T) = (T = Void)\"\n(*<*)by (auto elim: widen.cases)(*>*)\n\nlemma [iff]: \"(P \\<turnstile> Boolean \\<le> T) = (T = Boolean)\"\n(*<*)by (auto elim: widen.cases)(*>*)\n\nlemma [iff]: \"(P \\<turnstile> Integer \\<le> T) = (T = Integer)\"\n(*<*)by (auto elim: widen.cases)(*>*)\n\nlemma Class_widen: \"P \\<turnstile> Class C \\<le> T  \\<Longrightarrow>  \\<exists>D. T = Class D\"\nby(erule widen.cases, auto)\n\nlemma Array_Array_widen:\n  \"P \\<turnstile> Array T \\<le> Array U \\<Longrightarrow> P \\<turnstile> T \\<le> U\"\nby(auto elim: widen.cases)\n\nlemma widen_Array: \"(P \\<turnstile> T \\<le> U\\<lfloor>\\<rceil>) \\<longleftrightarrow> (T = NT \\<or> (\\<exists>V. T = V\\<lfloor>\\<rceil> \\<and> P \\<turnstile> V \\<le> U))\"\nby(induct T)(auto dest: Array_Array_widen elim: widen.cases intro: widen_array_array)\n\nlemma Array_widen: \"P \\<turnstile> Array A \\<le> T \\<Longrightarrow> (\\<exists>B. T = Array B \\<and> P \\<turnstile> A \\<le> B) \\<or> T = Class Object\"\nby(auto elim: widen.cases)\n\nlemma [iff]: \"(P \\<turnstile> T \\<le> NT) = (T = NT)\"\nby(induct T)(auto dest:Class_widen Array_widen)\n\nlemma Class_widen_Class [iff]: \"(P \\<turnstile> Class C \\<le> Class D) = (P \\<turnstile> C \\<preceq>\\<^sup>* D)\"\nby (auto elim: widen_subcls widen.cases)\n\nlemma widen_Class: \"(P \\<turnstile> T \\<le> Class C) = (T = NT \\<or> (\\<exists>D. T = Class D \\<and> P \\<turnstile> D \\<preceq>\\<^sup>* C) \\<or> (C = Object \\<and> (\\<exists>A. T = Array A)))\"\nby(induct T)(auto dest: Array_widen intro: widen_array_object)\n\nlemma NT_widen:\n  \"P \\<turnstile> NT \\<le> T = (T = NT \\<or> (\\<exists>C. T = Class C) \\<or> (\\<exists>U. T = U\\<lfloor>\\<rceil>))\"\nby(cases T) auto\n\nlemma Class_widen2: \"P \\<turnstile> Class C \\<le> T = (\\<exists>D. T = Class D \\<and> P \\<turnstile> C \\<preceq>\\<^sup>* D)\"\nby (cases T, auto elim: widen.cases)\n\nlemma Object_widen: \"P \\<turnstile> Class Object \\<le> T \\<Longrightarrow> T = Class Object\"\nby(cases T, auto elim: widen.cases)\n\nlemma NT_Array_widen_Object:\n  \"is_NT_Array T \\<Longrightarrow>  P \\<turnstile> T \\<le> Class Object\"\nby(induct T, auto intro: widen_array_object)\n\nlemma widen_trans[trans]: \n  assumes \"P \\<turnstile> S \\<le> U\" \"P \\<turnstile> U \\<le> T\"\n  shows \"P \\<turnstile> S \\<le> T\"\nusing assms\nproof(induct arbitrary: T)\n  case (widen_refl T T') thus \"P \\<turnstile> T \\<le> T'\" .\nnext\n  case (widen_subcls C D T)\n  then obtain E where \"T = Class E\" by (blast dest: Class_widen)\n  with widen_subcls show \"P \\<turnstile> Class C \\<le> T\" by (auto elim: rtrancl_trans)\nnext\n  case (widen_null C RT)\n  then obtain D where \"RT = Class D\" by (blast dest: Class_widen)\n  thus \"P \\<turnstile> NT \\<le> RT\" by auto\nnext\n  case widen_null_array thus ?case by(auto dest: Array_widen)\nnext\n  case (widen_array_object A T)\n  hence \"T = Class Object\" by(rule Object_widen)\n  with widen_array_object show \"P \\<turnstile> A\\<lfloor>\\<rceil> \\<le> T\"\n    by(auto intro: widen.widen_array_object)\nnext\n  case widen_array_array thus ?case\n    by(auto dest!: Array_widen intro: widen.widen_array_array widen_array_object)\nqed\n\nlemma widens_trans: \"\\<lbrakk>P \\<turnstile> Ss [\\<le>] Ts; P \\<turnstile> Ts [\\<le>] Us\\<rbrakk> \\<Longrightarrow> P \\<turnstile> Ss [\\<le>] Us\"\nby (rule list_all2_trans)(rule widen_trans)\n\nlemma class_type_of'_widenD:\n  \"class_type_of' T = \\<lfloor>C\\<rfloor> \\<Longrightarrow> P \\<turnstile> T \\<le> Class C\"\nby(cases T)(auto intro: widen_array_object)\n\nlemma widen_is_class_type_of:\n  assumes \"class_type_of' T = \\<lfloor>C\\<rfloor>\" \"P \\<turnstile> T' \\<le> T\" \"T' \\<noteq> NT\"\n  obtains C' where \"class_type_of' T' = \\<lfloor>C'\\<rfloor>\" \"P \\<turnstile> C' \\<preceq>\\<^sup>* C\"\nusing assms by(cases T)(auto simp add: widen_Class widen_Array)\n\nlemma widens_refl: \"P \\<turnstile> Ts [\\<le>] Ts\"\nby(rule list_all2_refl[OF widen_refl])\n\nlemma widen_append1:\n  \"P \\<turnstile> (xs @ ys) [\\<le>] Ts = (\\<exists>Ts1 Ts2. Ts = Ts1 @ Ts2 \\<and> length xs = length Ts1 \\<and> length ys = length Ts2 \\<and> P \\<turnstile> xs [\\<le>] Ts1 \\<and> P \\<turnstile> ys [\\<le>] Ts2)\"\nunfolding list_all2_append1 by fastforce\n\nlemmas widens_Cons [iff] = list_all2_Cons1 [of \"widen P\"] for P\n\nlemma widens_lengthD:\n  \"P \\<turnstile> xs [\\<le>] ys \\<Longrightarrow> length xs = length ys\"\nby(rule list_all2_lengthD)\n\nlemma widen_refT: \"\\<lbrakk> is_refT T; P \\<turnstile> U \\<le> T \\<rbrakk> \\<Longrightarrow> is_refT U\"\nby(erule refTE)(auto simp add: widen_Class widen_Array)\n\nlemma refT_widen: \"\\<lbrakk> is_refT T; P \\<turnstile> T \\<le> U \\<rbrakk> \\<Longrightarrow> is_refT U\"\nby(erule widen.cases) auto\n\ninductive is_lub :: \"'m prog \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> bool\" (\"_ \\<turnstile> lub'((_,/ _)') = _\" [51,51,51,51] 50)\nfor P :: \"'m prog\" and U :: ty and V :: ty and T ::  ty\nwhere \n  \"\\<lbrakk> P \\<turnstile> U \\<le> T; P \\<turnstile> V \\<le> T;\n     \\<And>T'. \\<lbrakk> P \\<turnstile> U \\<le> T'; P \\<turnstile> V \\<le> T' \\<rbrakk> \\<Longrightarrow> P \\<turnstile> T \\<le> T' \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> lub(U, V) = T\"\n\nlemma is_lub_upper:\n  \"P \\<turnstile> lub(U, V) = T \\<Longrightarrow> P \\<turnstile> U \\<le> T \\<and> P \\<turnstile> V \\<le> T\"\nby(auto elim: is_lub.cases)\n\nlemma is_lub_least:\n  \"\\<lbrakk> P \\<turnstile> lub(U, V) = T; P \\<turnstile> U \\<le> T'; P \\<turnstile> V \\<le> T' \\<rbrakk> \\<Longrightarrow> P \\<turnstile> T \\<le> T'\"\nby(auto elim: is_lub.cases)\n\nlemma is_lub_Void [iff]:\n  \"P \\<turnstile> lub(Void, Void) = T \\<longleftrightarrow> T = Void\"\nby(auto intro: is_lub.intros elim: is_lub.cases)\n\nlemma is_lubI [code_pred_intro]:\n  \"\\<lbrakk>P \\<turnstile> U \\<le> T; P \\<turnstile> V \\<le> T; \\<forall>T'. P \\<turnstile> U \\<le> T' \\<longrightarrow> P \\<turnstile> V \\<le> T' \\<longrightarrow> P \\<turnstile> T \\<le> T'\\<rbrakk> \\<Longrightarrow> P \\<turnstile> lub(U, V) = T\"\nby(blast intro: is_lub.intros)\n\nsubsection{* Method lookup *}\n\ninductive Methods :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> (mname \\<rightharpoonup> (ty list \\<times> ty \\<times> 'm option) \\<times> cname) \\<Rightarrow> bool\" \n  (\"_ \\<turnstile> _ sees'_methods _\" [51,51,51] 50)\n  for P :: \"'m prog\"\nwhere \nsees_methods_Object:\n \"\\<lbrakk> class P Object = Some(D,fs,ms); Mm = map_option (\\<lambda>m. (m,Object)) \\<circ> map_of ms \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> Object sees_methods Mm\"\n| sees_methods_rec:\n \"\\<lbrakk> class P C = Some(D,fs,ms); C \\<noteq> Object; P \\<turnstile> D sees_methods Mm;\n    Mm' = Mm ++ (map_option (\\<lambda>m. (m,C)) \\<circ> map_of ms) \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> C sees_methods Mm'\"\n\nlemma sees_methods_fun:\n  assumes \"P \\<turnstile> C sees_methods Mm\"\n  shows \"P \\<turnstile> C sees_methods Mm' \\<Longrightarrow> Mm' = Mm\"\nusing assms\nproof(induction arbitrary: Mm')\n  case sees_methods_Object thus ?case by(auto elim: Methods.cases)\nnext\n  case (sees_methods_rec C D fs ms Dres Cres Cres')\n  from `P \\<turnstile> C sees_methods Cres'` `C \\<noteq> Object` `class P C = \\<lfloor>(D, fs, ms)\\<rfloor>`\n  obtain Dres' where Dmethods': \"P \\<turnstile> D sees_methods Dres'\"\n    and Cres': \"Cres' = Dres' ++ (map_option (\\<lambda>m. (m,C)) \\<circ> map_of ms)\"\n    by cases auto\n  from sees_methods_rec.IH[OF Dmethods'] `Cres = Dres ++ (map_option (\\<lambda>m. (m,C)) \\<circ> map_of ms)` Cres'\n  show ?case by simp\nqed\n\nlemma visible_methods_exist:\n  \"P \\<turnstile> C sees_methods Mm \\<Longrightarrow> Mm M = Some(m,D) \\<Longrightarrow>\n   (\\<exists>D' fs ms. class P D = Some(D',fs,ms) \\<and> map_of ms M = Some m)\"\nby(induct rule:Methods.induct) auto\n\nlemma sees_methods_decl_above:\n  assumes \"P \\<turnstile> C sees_methods Mm\"\n  shows \"Mm M = Some(m,D) \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* D\"\nusing assms\nby induct(auto elim: converse_rtranclp_into_rtranclp[where r = \"subcls1 P\", OF subcls1I])\n\nlemma sees_methods_idemp:\n  assumes \"P \\<turnstile> C sees_methods Mm\" and \"Mm M = Some(m,D)\"\n  shows \"\\<exists>Mm'. (P \\<turnstile> D sees_methods Mm') \\<and> Mm' M = Some(m,D)\"\nusing assms\nby(induct arbitrary: m D)(fastforce dest: Methods.intros)+\n\nlemma sees_methods_decl_mono:\n  assumes sub: \"P \\<turnstile> C' \\<preceq>\\<^sup>* C\" and \"P \\<turnstile> C sees_methods Mm\"\n  shows \"\\<exists>Mm' Mm\\<^sub>2. P \\<turnstile> C' sees_methods Mm' \\<and> Mm' = Mm ++ Mm\\<^sub>2 \\<and> (\\<forall>M m D. Mm\\<^sub>2 M = Some(m,D) \\<longrightarrow> P \\<turnstile> D \\<preceq>\\<^sup>* C)\"\n      (is \"\\<exists>Mm' Mm2. ?Q C' C Mm' Mm2\")\nusing assms\nproof (induction rule: converse_rtranclp_induct)\n  case base\n  hence \"?Q C C Mm empty\" by simp\n  thus \"\\<exists>Mm' Mm2. ?Q C C Mm' Mm2\" by blast\nnext\n  case (step C'' C')\n  note sub1 = `P \\<turnstile> C'' \\<prec>\\<^sup>1 C'` and sub = `P \\<turnstile> C' \\<preceq>\\<^sup>* C`\n    and Csees = `P \\<turnstile> C sees_methods Mm`\n  from step.IH[OF Csees] obtain Mm' Mm2 where C'sees: \"P \\<turnstile> C' sees_methods Mm'\"\n    and Mm': \"Mm' = Mm ++ Mm2\"\n    and subC: \"\\<forall>M m D. Mm2 M = Some(m,D) \\<longrightarrow> P \\<turnstile> D \\<preceq>\\<^sup>* C\" by blast\n  obtain fs ms where \"class\": \"class P C'' = Some(C',fs,ms)\" \"C'' \\<noteq> Object\"\n    using subcls1D[OF sub1] by blast\n  let ?Mm3 = \"map_option (\\<lambda>m. (m,C'')) \\<circ> map_of ms\"\n  have \"P \\<turnstile> C'' sees_methods (Mm ++ Mm2) ++ ?Mm3\"\n    using sees_methods_rec[OF \"class\" C'sees refl] Mm' by simp\n  hence \"?Q C'' C ((Mm ++ Mm2) ++ ?Mm3) (Mm2++?Mm3)\"\n    using converse_rtranclp_into_rtranclp[OF sub1 sub]\n    by simp (simp add:map_add_def subC split:option.split)\n  thus \"\\<exists>Mm' Mm2. ?Q C'' C Mm' Mm2\" by blast\nqed\n\ndefinition Method :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> 'm option \\<Rightarrow> cname \\<Rightarrow> bool\"\n            (\"_ \\<turnstile> _ sees _: _\\<rightarrow>_ = _ in _\" [51,51,51,51,51,51,51] 50)\nwhere\n  \"P \\<turnstile> C sees M: Ts\\<rightarrow>T = m in D  \\<equiv>\n  \\<exists>Mm. P \\<turnstile> C sees_methods Mm \\<and> Mm M = Some((Ts,T,m),D)\"\n\ntext {*\n  Output translation to replace @{term \"None\"} with its notation @{text \"Native\"}\n  when used as method body in @{term \"Method\"}.\n*}\nabbreviation (output)\n  Method_native :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> cname \\<Rightarrow> bool\"\n  (\"_ \\<turnstile> _ sees _: _\\<rightarrow>_ = Native in _\" [51,51,51,51,51,51] 50)\nwhere \"Method_native P C M Ts T D \\<equiv> Method P C M Ts T Native D\"\n\ndefinition has_method :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> bool\" (\"_ \\<turnstile> _ has _\" [51,0,51] 50)\nwhere\n  \"P \\<turnstile> C has M \\<equiv> \\<exists>Ts T m D. P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D\"\n\nlemma has_methodI:\n  \"P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D \\<Longrightarrow> P \\<turnstile> C has M\"\n  by (unfold has_method_def) blast\n\nlemma sees_method_fun:\n  \"\\<lbrakk>P \\<turnstile> C sees M:TS\\<rightarrow>T = m in D; P \\<turnstile> C sees M:TS'\\<rightarrow>T' = m' in D' \\<rbrakk>\n   \\<Longrightarrow> TS' = TS \\<and> T' = T \\<and> m' = m \\<and> D' = D\"\n (*<*)by(fastforce dest: sees_methods_fun simp:Method_def)(*>*)\n\nlemma sees_method_decl_above:\n  \"P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* D\"\n (*<*)by(clarsimp simp:Method_def sees_methods_decl_above)(*>*)\n\nlemma visible_method_exists:\n  \"P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D \\<Longrightarrow>\n  \\<exists>D' fs ms. class P D = Some(D',fs,ms) \\<and> map_of ms M = Some(Ts,T,m)\"\n(*<*)by(fastforce simp:Method_def dest!: visible_methods_exist)(*>*)\n\n\nlemma sees_method_idemp:\n  \"P \\<turnstile> C sees M:Ts\\<rightarrow>T=m in D \\<Longrightarrow> P \\<turnstile> D sees M:Ts\\<rightarrow>T=m in D\"\n (*<*)by(fastforce simp: Method_def intro:sees_methods_idemp)(*>*)\n\nlemma sees_method_decl_mono:\n  \"\\<lbrakk> P \\<turnstile> C' \\<preceq>\\<^sup>* C; P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D;\n     P \\<turnstile> C' sees M:Ts'\\<rightarrow>T' = m' in D' \\<rbrakk> \\<Longrightarrow> P \\<turnstile> D' \\<preceq>\\<^sup>* D\"\napply(frule sees_method_decl_above)\napply(unfold Method_def)\napply clarsimp\napply(drule (1) sees_methods_decl_mono)\napply clarsimp\napply(drule (1) sees_methods_fun)\napply clarsimp\napply(blast intro:rtranclp_trans)\ndone\n\nlemma sees_method_is_class:\n  \"P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D \\<Longrightarrow> is_class P C\"\nby (auto simp add: is_class_def Method_def elim: Methods.cases)\n\nsubsection{* Field lookup *}\n\ninductive Fields :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> ((vname \\<times> cname) \\<times> (ty \\<times> fmod)) list \\<Rightarrow> bool\"\n  (\"_ \\<turnstile> _ has'_fields _\" [51,51,51] 50)\n  for P :: \"'m prog\"\nwhere \n  has_fields_rec:\n  \"\\<lbrakk> class P C = Some(D,fs,ms); C \\<noteq> Object; P \\<turnstile> D has_fields FDTs;\n     FDTs' = map (\\<lambda>(F,Tm). ((F,C),Tm)) fs @ FDTs \\<rbrakk>\n   \\<Longrightarrow> P \\<turnstile> C has_fields FDTs'\"\n\n| has_fields_Object:\n  \"\\<lbrakk> class P Object = Some(D,fs,ms); FDTs = map (\\<lambda>(F,T). ((F,Object),T)) fs \\<rbrakk>\n   \\<Longrightarrow> P \\<turnstile> Object has_fields FDTs\"\n\nlemma has_fields_fun:\n  assumes \"P \\<turnstile> C has_fields FDTs\" and \"P \\<turnstile> C has_fields FDTs'\"\n  shows \"FDTs' = FDTs\"\nusing assms\nproof(induction arbitrary: FDTs')\n  case has_fields_Object thus ?case by(auto elim: Fields.cases)\nnext\n  case (has_fields_rec C D fs ms Dres Cres Cres')\n  from `P \\<turnstile> C has_fields Cres'` `C \\<noteq> Object` `class P C = Some (D, fs, ms)`\n  obtain Dres' where DFields': \"P \\<turnstile> D has_fields Dres'\"\n    and Cres': \"Cres' = map (\\<lambda>(F,Tm). ((F,C),Tm)) fs @ Dres'\"\n    by cases auto\n  from has_fields_rec.IH[OF DFields'] `Cres = map (\\<lambda>(F,Tm). ((F,C),Tm)) fs @ Dres` Cres'\n  show ?case by simp\nqed\n\nlemma all_fields_in_has_fields:\n  assumes \"P \\<turnstile> C has_fields FDTs\"\n  and \"P \\<turnstile> C \\<preceq>\\<^sup>* D\" \"class P D = Some(D',fs,ms)\" \"(F,Tm) \\<in> set fs\"\n  shows \"((F,D),Tm) \\<in> set FDTs\"\nusing assms\nby induct (auto 4 3 elim: converse_rtranclpE dest: subcls1D)\n\nlemma has_fields_decl_above:\n  assumes \"P \\<turnstile> C has_fields FDTs\" \"((F,D),Tm) \\<in> set FDTs\"\n  shows \"P \\<turnstile> C \\<preceq>\\<^sup>* D\"\nusing assms\nby induct (auto intro: converse_rtranclp_into_rtranclp subcls1I)\n\nlemma subcls_notin_has_fields:\n  assumes \"P \\<turnstile> C has_fields FDTs\" \"((F,D),Tm) \\<in> set FDTs\"\n  shows \"\\<not> (subcls1 P)\\<^sup>+\\<^sup>+ D C\"\nusing assms apply(induct)\n prefer 2 apply(fastforce dest: tranclpD)\napply clarsimp\napply(erule disjE)\n apply(clarsimp simp add:image_def)\n apply(drule tranclpD)\n apply clarify\n apply(frule subcls1D)\n apply(fastforce dest:tranclpD all_fields_in_has_fields)\napply(blast dest:subcls1I tranclp.trancl_into_trancl)\ndone\n\nlemma has_fields_mono_lem:\n  assumes \"P \\<turnstile> D \\<preceq>\\<^sup>* C\" \"P \\<turnstile> C has_fields FDTs\"\n  shows \"\\<exists>pre. P \\<turnstile> D has_fields pre@FDTs \\<and> dom(map_of pre) \\<inter> dom(map_of FDTs) = {}\"\nusing assms\napply(induct rule:converse_rtranclp_induct)\n apply(rule_tac x = \"[]\" in exI)\n apply simp\napply clarsimp\napply(rename_tac D' D pre)\napply(subgoal_tac \"(subcls1 P)^++ D' C\")\n prefer 2 apply(erule (1) rtranclp_into_tranclp2)\napply(drule subcls1D)\napply clarsimp\napply(rename_tac fs ms)\napply(drule (2) has_fields_rec)\n apply(rule refl)\napply(rule_tac x = \"map (\\<lambda>(F,Tm). ((F,D'),Tm)) fs @ pre\" in exI)\napply simp\napply(simp add:Int_Un_distrib2)\napply(rule equals0I)\napply(auto dest: subcls_notin_has_fields simp:dom_map_of_conv_image_fst image_def)\ndone\n\nlemma has_fields_is_class:\n  \"P \\<turnstile> C has_fields FDTs \\<Longrightarrow> is_class P C\"\nby (auto simp add: is_class_def elim: Fields.cases)\n\nlemma Object_has_fields_Object:\n  assumes \"P \\<turnstile> Object has_fields FDTs\"\n  shows \"snd ` fst ` set FDTs \\<subseteq> {Object}\"\nusing assms by cases auto\n\ndefinition\n  has_field :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> vname \\<Rightarrow> ty \\<Rightarrow> fmod \\<Rightarrow> cname \\<Rightarrow> bool\"\n                   (\"_ \\<turnstile> _ has _:_ '(_') in _\" [51,51,51,51,51,51] 50)\nwhere\n  \"P \\<turnstile> C has F:T (fm) in D  \\<equiv>\n  \\<exists>FDTs. P \\<turnstile> C has_fields FDTs \\<and> map_of FDTs (F,D) = Some (T, fm)\"\n\nlemma has_field_mono:\n  \"\\<lbrakk> P \\<turnstile> C has F:T (fm) in D; P \\<turnstile> C' \\<preceq>\\<^sup>* C \\<rbrakk> \\<Longrightarrow> P \\<turnstile> C' has F:T (fm) in D\"\nby(fastforce simp:has_field_def map_add_def dest: has_fields_mono_lem)\n\nlemma has_field_is_class:\n  \"P \\<turnstile> C has M:T (fm) in D \\<Longrightarrow> is_class P C\"\nby (auto simp add: is_class_def has_field_def elim: Fields.cases)\n\nlemma has_field_decl_above:\n  \"P \\<turnstile> C has F:T (fm) in D \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* D\"\nunfolding has_field_def\nby(auto dest: map_of_SomeD has_fields_decl_above)\n\nlemma has_field_fun:\n  \"\\<lbrakk>P \\<turnstile> C has F:T (fm) in D; P \\<turnstile> C has F:T' (fm') in D\\<rbrakk> \\<Longrightarrow> T' = T \\<and> fm = fm'\"\nby(auto simp:has_field_def dest:has_fields_fun)\n\ndefinition\n  sees_field :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> vname \\<Rightarrow> ty \\<Rightarrow> fmod \\<Rightarrow> cname \\<Rightarrow> bool\"\n                  (\"_ \\<turnstile> _ sees _:_ '(_') in _\" [51,51,51,51,51,51] 50)\nwhere\n  \"P \\<turnstile> C sees F:T (fm) in D  \\<equiv>\n  \\<exists>FDTs. P \\<turnstile> C has_fields FDTs \\<and>\n            map_of (map (\\<lambda>((F,D),Tm). (F,(D,Tm))) FDTs) F = Some(D,T,fm)\"\n\nlemma map_of_remap_SomeD:\n  \"map_of (map (\\<lambda>((k,k'),x). (k,(k',x))) t) k = Some (k',x) \\<Longrightarrow> map_of t (k, k') = Some x\"\nby (induct t) (auto simp:fun_upd_apply split: split_if_asm)\n\nlemma has_visible_field:\n  \"P \\<turnstile> C sees F:T (fm) in D \\<Longrightarrow> P \\<turnstile> C has F:T (fm) in D\"\nby(auto simp add:has_field_def sees_field_def map_of_remap_SomeD)\n\nlemma sees_field_fun:\n  \"\\<lbrakk>P \\<turnstile> C sees F:T (fm) in D; P \\<turnstile> C sees F:T' (fm') in D'\\<rbrakk> \\<Longrightarrow> T' = T \\<and> D' = D \\<and> fm = fm'\"\nby(fastforce simp:sees_field_def dest:has_fields_fun)\n\n\nlemma sees_field_decl_above:\n  \"P \\<turnstile> C sees F:T (fm) in D \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* D\"\nby(clarsimp simp add: sees_field_def)\n  (blast intro: has_fields_decl_above map_of_SomeD map_of_remap_SomeD)\n\nlemma sees_field_idemp:\n  assumes \"P \\<turnstile> C sees F:T (fm) in D\"\n  shows \"P \\<turnstile> D sees F:T (fm) in D\"\nproof -\n  from assms obtain FDTs where has: \"P \\<turnstile> C has_fields FDTs\"\n    and F: \"map_of (map (\\<lambda>((F, D), Tm). (F, D, Tm)) FDTs) F = \\<lfloor>(D, T, fm)\\<rfloor>\"\n    unfolding sees_field_def by blast\n  thus ?thesis\n  proof induct\n    case has_fields_rec thus ?case unfolding sees_field_def\n      by(auto)(fastforce dest: map_of_SomeD intro!: exI intro: Fields.has_fields_rec)\n  next\n    case has_fields_Object thus ?case unfolding sees_field_def\n      by(fastforce dest: map_of_SomeD intro: Fields.has_fields_Object intro!: exI)\n  qed\nqed\n\nsubsection \"Functional lookup\"\n\ndefinition method :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> cname \\<times> ty list \\<times> ty \\<times> 'm option\"\nwhere \"method P C M  \\<equiv>  THE (D,Ts,T,m). P \\<turnstile> C sees M:Ts \\<rightarrow> T = m in D\"\n\ndefinition field  :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> vname \\<Rightarrow> cname \\<times> ty \\<times> fmod\"\nwhere \"field P C F  \\<equiv>  THE (D,T,fm). P \\<turnstile> C sees F:T (fm) in D\"\n                                                        \ndefinition fields :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> ((vname \\<times> cname) \\<times> (ty \\<times> fmod)) list\" \nwhere \"fields P C  \\<equiv>  THE FDTs. P \\<turnstile> C has_fields FDTs\"                \n\n\n\nlemma field_def2 [simp]: \"P \\<turnstile> C sees F:T (fm) in D \\<Longrightarrow> field P C F = (D,T,fm)\"\n(*<*)by (unfold field_def) (auto dest: sees_field_fun)(*>*)\n\nlemma method_def2 [simp]: \"P \\<turnstile> C sees M: Ts\\<rightarrow>T = m in D \\<Longrightarrow> method P C M = (D,Ts,T,m)\"\n(*<*)by (unfold method_def) (auto dest: sees_method_fun)(*>*)\n\nlemma has_fields_b_fields: \n  \"P \\<turnstile> C has_fields FDTs \\<Longrightarrow> fields P C = FDTs\"\nunfolding fields_def\nby (blast intro: the_equality has_fields_fun)\n\nlemma has_field_map_of_fields [simp]:\n  \"P \\<turnstile> C has F:T (fm) in D \\<Longrightarrow> map_of (fields P C) (F, D) = \\<lfloor>(T, fm)\\<rfloor>\"\nby(auto simp add: has_field_def)\n\nsubsection {* Code generation *}\n\ntext {* New introduction rules for subcls1 *}\n\ncode_pred\n  -- {* Disallow mode @{text \"i_o_o\"} to force @{text code_pred} in subsequent predicates not to use this inefficient mode *}\n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) \n  subcls1\n.\n\ntext {*\n  Introduce proper constant @{text \"subcls'\"} for @{term \"subcls\"}\n  and generate executable equation for @{text \"subcls'\"} \n*}\n\ndefinition subcls' where \"subcls' = subcls\"\n\ncode_pred\n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool)\n  [inductify]\n  subcls'\n.\n\nlemma subcls_conv_subcls' [code_unfold]:\n  \"(subcls1 P)^** = subcls' P\"\nby(simp add: subcls'_def)\n\ntext {* \n  Change rule @{thm widen_array_object} such that predicate compiler\n  tests on class @{term Object} first. Otherwise @{text \"widen_i_o_i\"} never terminates.\n*}\n\n\n\nlemmas [code_pred_intro] =\n  widen_refl widen_subcls widen_null widen_null_array widen_array_object_code widen_array_array\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool)\n  widen \nby(erule widen.cases) auto\n\ntext {* \n  Readjust the code equations for @{term widen} such that @{term widen_i_i_i} is guaranteed to\n  contain @{term \"()\"} at most once (even in the code representation!). This is important\n  for the scheduler and the small-step semantics because of the weaker code equations\n  for @{term \"the\"}.\n\n  A similar problem cannot hit the subclass relation because, for acyclic subclass hierarchies, \n  the paths in the hieararchy are unique and cycle-free.\n*}\n\ndefinition widen_i_i_i' where \"widen_i_i_i' = widen_i_i_i\"\n\ndeclare widen.equation [code del]\nlemmas widen_i_i_i'_equation [code] = widen.equation[folded widen_i_i_i'_def]\n\nlemma widen_i_i_i_code [code]:\n  \"widen_i_i_i P T T' = (if P \\<turnstile> T \\<le> T' then Predicate.single () else bot)\"\nby(auto intro!: pred_eqI intro: widen_i_i_iI elim: widen_i_i_iE)\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool)\n  Methods \n.\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> i \\<Rightarrow> bool)\n  [inductify]\n  Method\n.\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool)\n  [inductify]\n  has_method \n.\n\n(* FIXME: Necessary only because of bug in code_pred *)\ndeclare fun_upd_def [code_pred_inline]\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool)\n  Fields \n.\n\ncode_pred\n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> i \\<Rightarrow> bool)\n  [inductify, skip_proof]\n  has_field\n.\n\ncode_pred\n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> i \\<Rightarrow> bool)\n  [inductify, skip_proof]\n  sees_field\n.\n\nlemma eval_Method_i_i_i_o_o_o_o_conv:\n  \"Predicate.eval (Method_i_i_i_o_o_o_o P C M) = (\\<lambda>(Ts, T, m, D). P \\<turnstile> C sees M:Ts\\<rightarrow>T=m in D)\"\nby(auto intro: Method_i_i_i_o_o_o_oI elim: Method_i_i_i_o_o_o_oE intro!: ext)\n\nlemma method_code [code]:\n  \"method P C M = \n  Predicate.the (Predicate.bind (Method_i_i_i_o_o_o_o P C M) (\\<lambda>(Ts, T, m, D). Predicate.single (D, Ts, T, m)))\"\napply (rule sym, rule the_eqI)\napply (simp add: method_def eval_Method_i_i_i_o_o_o_o_conv)\napply (rule arg_cong [where f=The])\napply (auto simp add: SUP_def Sup_fun_def Sup_bool_def fun_eq_iff)\ndone\n\nlemma eval_sees_field_i_i_i_o_o_o_conv:\n  \"Predicate.eval (sees_field_i_i_i_o_o_o P C F) = (\\<lambda>(T, fm, D). P \\<turnstile> C sees F:T (fm) in D)\"\nby(auto intro!: ext intro: sees_field_i_i_i_o_o_oI elim: sees_field_i_i_i_o_o_oE)\n\nlemma eval_sees_field_i_i_i_o_i_conv:\n  \"Predicate.eval (sees_field_i_i_i_o_o_i P C F D) = (\\<lambda>(T, fm). P \\<turnstile> C sees F:T (fm) in D)\"\nby(auto intro!: ext intro: sees_field_i_i_i_o_o_iI elim: sees_field_i_i_i_o_o_iE)\n\nlemma field_code [code]:\n  \"field P C F = Predicate.the (Predicate.bind (sees_field_i_i_i_o_o_o P C F) (\\<lambda>(T, fm, D). Predicate.single (D, T, fm)))\"\napply (rule sym, rule the_eqI)\napply (simp add: field_def eval_sees_field_i_i_i_o_o_o_conv)\napply (rule arg_cong [where f=The])\napply (auto simp add: SUP_def Sup_fun_def Sup_bool_def fun_eq_iff)\ndone\n\nlemma eval_Fields_conv:\n  \"Predicate.eval (Fields_i_i_o P C) = (\\<lambda>FDTs. P \\<turnstile> C has_fields FDTs)\"\nby(auto intro: Fields_i_i_oI elim: Fields_i_i_oE intro!: ext)\n\nlemma fields_code [code]:\n  \"fields P C = Predicate.the (Fields_i_i_o P C)\"\nby(simp add: fields_def Predicate.the_def eval_Fields_conv)\n\ncode_identifier\n  code_module TypeRel \\<rightharpoonup>\n    (SML) TypeRel and (Haskell) TypeRel and (OCaml) TypeRel\n| code_module Decl \\<rightharpoonup>\n    (SML) TypeRel and (Haskell) TypeRel and (OCaml) TypeRel\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Common/TypeRel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6688802603710085, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.3448879834812881}}
{"text": "theory DerefVars\n  imports SafeSubRename\nbegin\n\nfun deref_pairs where\n  \"deref_pairs (ConstExp c) = {}\"\n| \"deref_pairs (OpExp xop) = {}\"\n| \"deref_pairs (VarExp x a) = (case a of\n    OtherRef y \\<Rightarrow> {(x, y)}\n    | r \\<Rightarrow> {}\n  )\"  \n| \"deref_pairs (PairExp e1 e2) = (deref_pairs e1 \\<union> deref_pairs e2)\"\n| \"deref_pairs (IfExp e1 e2 e3) = (deref_pairs e1 \\<union> deref_pairs e2 \\<union> deref_pairs e3)\"\n| \"deref_pairs (LamExp x e) = deref_pairs e\"  \n| \"deref_pairs (AppExp e1 e2) = (deref_pairs e1 \\<union> deref_pairs e2)\"  \n  \n    (* ##### given a perm set, we derive its \"resource completion\" by taking all of the resources that are reachable from it.\n        in other words, for each permission z in s, we lookup its resource map, and take all of the resources in it, as well\n        as recursing on each resource. #####\n     *)  \n  \nfun path_lookup where\n  \"path_lookup rs_map z Nil x = (z = x)\"\n| \"path_lookup rs_map z (y # t) x = (case rs_map z of\n    None \\<Rightarrow> False\n    | Some r_s \\<Rightarrow> r_s y \\<noteq> NoPerm \\<and> path_lookup rs_map y t x\n  )\"    \n\nfun complete_vars where\n  \"complete_vars rs_map s = { x | x. \\<exists> l z. z \\<in> s \\<and> path_lookup rs_map z l x}\"\n\nlemma path_lookup_parent: \"\\<lbrakk> l \\<noteq> Nil; path_lookup rs_map z l x; valid_nres_map s rs_map \\<rbrakk> \\<Longrightarrow>\n  (\\<exists> l' y r_s. path_lookup rs_map z l' y \\<and> rs_map y = Some r_s \\<and> r_s x \\<noteq> NoPerm )\"\n  apply (induct l arbitrary: z)\n   apply (auto)\n  apply (case_tac \"rs_map z\")\n   apply (auto)\n    (* case where we have reached x *)\n  apply (case_tac \"a = x\")\n   apply (rule_tac x=\"Nil\" in exI)\n   apply (auto)\n    (* otherwise, induct *)\n  apply (case_tac \"l = []\")\n   apply (auto)\n  apply (case_tac \"\\<exists>l' y. path_lookup rs_map a l' y \\<and> (\\<exists>r_s. rs_map y = Some r_s \\<and> r_s x \\<noteq> NoPerm)\")\n   apply (erule_tac exE)\n   apply (auto)\n  apply (rule_tac x=\"a # l'\" in exI)\n  apply (auto)\n  done\n    \n    (* ##### proper expressions ##### *)\n  \ndefinition proper_exp where\n  \"proper_exp rs_map e = (\\<forall> x y. (x, y) \\<in> deref_pairs e \\<longrightarrow> (\\<exists> l. path_lookup rs_map x l y))\"\n\nlemma proper_pair: \"\\<lbrakk> proper_exp rs_map (PairExp e1 e2) \\<rbrakk> \\<Longrightarrow> proper_exp rs_map e1 \\<and> proper_exp rs_map e2\"  \n  apply (simp add: proper_exp_def)\n  done\n\nlemma proper_if: \"\\<lbrakk> proper_exp rs_map (IfExp e1 e2 e3) \\<rbrakk> \\<Longrightarrow> proper_exp rs_map e1 \\<and> proper_exp rs_map e2 \\<and> proper_exp rs_map e3\"  \n  apply (simp add: proper_exp_def)\n  done    \n\nlemma proper_app: \"\\<lbrakk> proper_exp rs_map (AppExp e1 e2) \\<rbrakk> \\<Longrightarrow> proper_exp rs_map e1 \\<and> proper_exp rs_map e2\"  \n  apply (simp add: proper_exp_def)\n  done\n    \nlemma proper_subst_exp: \"\\<lbrakk> proper_exp rs_map e; proper_exp rs_map e'; x \\<notin> ref_vars e \\<rbrakk> \\<Longrightarrow> proper_exp rs_map (subst_exp e x e')\"\n  apply (induct e)\n        apply (auto)\n     apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_pair)\n      apply (auto)\n     apply (simp add: proper_exp_def)\n    apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\" in proper_if)\n     apply (auto)\n    apply (simp add: proper_exp_def)\n   apply (simp add: proper_exp_def)\n  apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_app)\n   apply (auto)\n  apply (simp add: proper_exp_def)\n  done\n \nlemma proper_alpha_rename: \"\\<lbrakk> proper_exp rs_map e; a \\<notin> ref_vars e \\<rbrakk> \\<Longrightarrow> proper_exp rs_map (deep_alpha_rename e a b)\"    \n  apply (induct e)\n        apply (auto)\n       apply (simp add: proper_exp_def)\n       apply (auto)\n       apply (case_tac x2a)\n         apply (auto)\n      apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_pair)\n       apply (auto)\n      apply (simp add: proper_exp_def)\n     apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\" in proper_if)\n      apply (auto)\n     apply (simp add: proper_exp_def)\n    apply (simp add: proper_exp_def)\n   apply (simp add: proper_exp_def)\n  apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_app)\n   apply (auto)\n  apply (simp add: proper_exp_def)\n  done\n    \nlemma proper_lam_var_remove_ex: \"\\<lbrakk> proper_exp rs_map e; well_typed env r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> proper_exp rs_map (lam_var_remove e a b)\"      \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n      apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_pair)\n       apply (auto)\n      apply (simp add: proper_exp_def)\n     apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\" in proper_if)\n      apply (auto)\n     apply (simp add: proper_exp_def)\n    apply (cut_tac rs_map=\"rs_map\" and e=\"e\" and a=\"a\" and b=\"b\" in proper_alpha_rename)\n      apply (simp add: proper_exp_def)\n     apply (simp)\n    apply (simp add: proper_exp_def)\n   apply (simp add: proper_exp_def)\n  apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_app)\n   apply (auto)\n  apply (simp add: proper_exp_def)\n  done\n    \n  \nlemma proper_lam_var_remove: \"\\<lbrakk> proper_exp rs_map e; a \\<notin> ref_vars e \\<rbrakk> \\<Longrightarrow> proper_exp rs_map (lam_var_remove e a b)\"   \n  apply (induct e)\n        apply (auto)\n      apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_pair)\n       apply (auto)\n      apply (simp add: proper_exp_def)\n     apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\" in proper_if)\n      apply (auto)\n     apply (simp add: proper_exp_def)\n    apply (cut_tac rs_map=\"rs_map\" and e=\"e\" and a=\"a\" and b=\"b\" in proper_alpha_rename)\n      apply (simp add: proper_exp_def)\n     apply (simp)\n    apply (simp add: proper_exp_def)\n   apply (simp add: proper_exp_def)\n  apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_app)\n   apply (auto)\n  apply (simp add: proper_exp_def)\n  done\n      \nlemma lam_var_remove_eq: \"\\<lbrakk> a \\<notin> lam_vars e \\<rbrakk> \\<Longrightarrow> lam_var_remove e a b = e\"    \n  apply (induct e)\n        apply (auto)\n  done\n  \nlemma proper_lvlr_ex: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; proper_exp rs_map e; unique_post_vars vl;\n  post_vars vl \\<inter> (free_vars e \\<union> lam_vars e \\<union> ref_vars e) = {} \\<rbrakk> \\<Longrightarrow> proper_exp rs_map (lam_var_list_remove e vl)\"   \n  apply (induct vl arbitrary: e)\n   apply (auto)\n  (*apply (case_tac \"a \\<notin> lam_vars e\")\n   apply (simp add: lam_var_remove_eq)*)\n  apply (cut_tac rs_map=\"rs_map\" and e=\"e\" and a=\"a\" and b=\"b\" in proper_lam_var_remove_ex)\n    apply (auto)\n    (* we have to prove that the post vars are still disjoint from the lam_vars / ref_vars, which is true since\n        the only new lam_var is b, which must be disjoint from the rest of the post_var list *)\n  apply (case_tac \"post_vars vl \\<inter> (free_vars (lam_var_remove e a b) \\<union> lam_vars (lam_var_remove e a b) \\<union> ref_vars (lam_var_remove e a b)) \\<noteq> {}\")\n   apply (auto)\n     apply (cut_tac x=\"x\" and e=\"e\" and a=\"a\" and b=\"b\" in lam_var_remove_free_var_none)\n      apply (auto)\n    apply (case_tac \"x = b\")\n     apply (auto)\n    apply (cut_tac x=\"x\" and e=\"e\" and a=\"a\" and b=\"b\" in lam_var_remove_lam_var_none)\n      apply (auto)\n   apply (case_tac \"x = b\")\n    apply (auto)\n   apply (cut_tac z=\"x\" and e=\"e\" and x=\"a\" and y=\"b\" in lam_var_remove_ref_vars)\n     apply (auto)\n    (* the last part of the induction is to prove that e is still well-typed *)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" and x=\"a\" and y=\"b\" in lam_var_remove_type_preserve)\n      apply (auto)\n  done\n    \n    (* this lemma is predicated on the idea that after a lam_var_list removal, no new deref_pairs will be introduced.\n        the intuition is that lvlr only changes lam_vars, and lam_vars don't overlap with ref_vars or free_vars,\n        meaning they will not affect any deref_pairs.\n    *)(*\nlemma proper_lvlr: \"\\<lbrakk> proper_exp rs_map e; unique_post_vars vl; post_vars vl \\<inter> (lam_vars e \\<union> ref_vars e) = {};\n  lam_vars e \\<inter> ref_vars e = {} \\<rbrakk> \\<Longrightarrow> proper_exp rs_map (lam_var_list_remove e vl)\"    \n  apply (induct vl arbitrary: e)\n   apply (auto)\n  apply (case_tac \"a \\<notin> lam_vars e\")\n   apply (simp add: lam_var_remove_eq)\n  apply (cut_tac rs_map=\"rs_map\" and e=\"e\" and a=\"a\" and b=\"b\" in proper_lam_var_remove)\n    apply (auto)\n    (* we have to prove that the post vars are still disjoint from the lam_vars / ref_vars, which is true since\n        the only new lam_var is b, which must be disjoint from the rest of the post_var list *)\n  apply (case_tac \"post_vars vl \\<inter> (lam_vars (lam_var_remove e a b) \\<union> ref_vars (lam_var_remove e a b)) \\<noteq> {}\")\n   apply (auto)\n    apply (case_tac \"x = b\")\n     apply (auto)\n    apply (cut_tac x=\"x\" and e=\"e\" and a=\"a\" and b=\"b\" in lam_var_remove_lam_var_none)\n      apply (auto)\n   apply (case_tac \"x = b\")\n    apply (auto)\n   apply (cut_tac z=\"x\" and e=\"e\" and x=\"a\" and y=\"b\" in lam_var_remove_ref_vars)\n     apply (auto)\n  apply (case_tac \"lam_vars (lam_var_remove e a b) \\<inter> ref_vars (lam_var_remove e a b) = {}\")\n   apply (auto)\n    (* the main challenge of this lemma is proving that after each renaming, the lam_vars and ref_vars remain disjoint.\n        - say that such an x was in the lam_vars e, but not in the ref_vars e. *)\n  apply (case_tac \"x \\<in> lam_vars e\")\n    (* - we know that x \\<noteq> b by post_var disjointness.\n      then we can know that x \\<in> ref_vars e, since otherwise x \\<notin> ref_vars (lam_var_remove e a b) *)\n   apply (case_tac \"x \\<noteq> b\")\n    apply (case_tac \"x \\<notin> ref_vars e\")\n     apply (cut_tac z=\"x\" and e=\"e\" and x=\"a\" and y=\"b\" in lam_var_remove_ref_vars)\n       apply (auto)\n    (* otherwise, x \\<notin> lam_vars e. say that x \\<noteq> b. then x \\<notin> lam_vars (lam_var_remove e a b) either *)\n  apply (case_tac \"x \\<noteq> b\")\n   apply (cut_tac e=\"e\" and x=\"x\" and a=\"a\" and b=\"b\" in lam_var_remove_lam_var_none)\n     apply (auto)\n  apply (case_tac \"a \\<notin> ref_vars e\")\n   apply (cut_tac y=\"b\" and e=\"e\" and x=\"a\" in lam_var_remove_ref_vars2)\n     apply (auto)\n  done*)\n  \nlemma proper_safe_subst_exp: \"\\<lbrakk> proper_exp rs_map e; well_typed env r_s1 e tau r_s2 rx;\n  proper_exp rs_map e'; safe_subst_exp e x e' e_f \\<rbrakk> \\<Longrightarrow> proper_exp rs_map e_f\"    \n  apply (simp add: safe_subst_exp_def)\n  apply (auto)\n  apply (rule_tac proper_subst_exp)\n    apply (rule_tac proper_lvlr_ex)\n       apply (auto)\n    (* we have to prove that x is not a ref var of the final result *)\n  apply (cut_tac x=\"x\" and e=\"e\" and vl=\"vl\" in lam_var_list_remove_ref_var)\n      apply (auto)\n  apply (simp add: disj_vars_def)\n  apply (auto)\n  done\n\nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/DerefVars.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6688802603710085, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.3448879834812881}}
{"text": "theory SINVAR_SecGwExt\nimports \"../TopoS_Helper\"\nbegin\n\nsubsection {* SecurityInvariant PolEnforcePointExtended*}\ntext {* A PolEnforcePoint is an application-level central policy enforcement point.\nLegacy note: The old verions called it a SecurityGateway.\n\nHosts may belong to a certain domain. \nSometimes, a pattern where intra-domain communication between domain members must be approved by a central instance is required. \n\nWe call such a central instance PolEnforcePoint and present a template for this architecture. \nFive host roles are distinguished:. \nA PolEnforcePoint, aPolEnforcePointIN which accessible from the outside, a DomainMember,\na less-restricted AccessibleMember which is accessible from the outside world, \nand a default value Unassigned that reflects none of these roles. *}\n\ndatatype secgw_member = PolEnforcePoint | PolEnforcePointIN | DomainMember  | AccessibleMember | Unassigned\n\ndefinition default_node_properties :: \"secgw_member\"\n  where  \"default_node_properties \\<equiv> Unassigned\"\n\n\nfun allowed_secgw_flow :: \"secgw_member \\<Rightarrow> secgw_member \\<Rightarrow> bool\" where\n  \"allowed_secgw_flow PolEnforcePoint _ = True\" |\n  \"allowed_secgw_flow PolEnforcePointIN _ = True\" |\n  \"allowed_secgw_flow DomainMember DomainMember = False\" |\n  \"allowed_secgw_flow DomainMember _ = True\" |\n  \"allowed_secgw_flow AccessibleMember DomainMember = False\" |\n  \"allowed_secgw_flow AccessibleMember _ = True\" |\n  \"allowed_secgw_flow Unassigned Unassigned = True\" |\n  \"allowed_secgw_flow Unassigned PolEnforcePointIN = True\" |\n  \"allowed_secgw_flow Unassigned AccessibleMember = True\" |\n  \"allowed_secgw_flow Unassigned _ = False\" \n\n\nfun sinvar :: \"'v graph \\<Rightarrow> ('v \\<Rightarrow> secgw_member) \\<Rightarrow> bool\" where\n  \"sinvar G nP = (\\<forall> (e1,e2) \\<in> edges G. e1 \\<noteq> e2 \\<longrightarrow> allowed_secgw_flow (nP e1) (nP e2))\"\n\ndefinition receiver_violation :: \"bool\" where \"receiver_violation = False\"\n\nsubsubsection {*Preliminaries*}\n  \n\nsubsubsection{*ENF*}\n  lemma PolEnforcePoint_ENFnr: \"SecurityInvariant_withOffendingFlows.sinvar_all_edges_normal_form_not_refl sinvar allowed_secgw_flow\"\n    by(simp add: SecurityInvariant_withOffendingFlows.sinvar_all_edges_normal_form_not_refl_def)\n  lemma Unassigned_botdefault: \"\\<forall> e1 e2. e2 \\<noteq> Unassigned \\<longrightarrow> \\<not> allowed_secgw_flow e1 e2 \\<longrightarrow> \\<not> allowed_secgw_flow Unassigned e2\"\n    apply(rule allI)+\n    apply(case_tac e2)\n        apply(simp_all)\n     apply(case_tac e1)\n          apply(simp_all)\n    apply(case_tac e1)\n        apply(simp_all)\n    done\n  lemma Unassigned_not_to_Member: \"\\<not> allowed_secgw_flow Unassigned DomainMember\"\n    by(simp)\n  lemma All_to_Unassigned: \"\\<forall> e1. allowed_secgw_flow e1 Unassigned\"\n    by (rule allI, case_tac e1, simp_all)\n\n  definition PolEnforcePointExtended_offending_set:: \"'v graph \\<Rightarrow> ('v \\<Rightarrow> secgw_member) \\<Rightarrow> ('v \\<times> 'v) set set\" where\n  \"PolEnforcePointExtended_offending_set G nP = (if sinvar G nP then\n      {}\n     else \n      { {e \\<in> edges G. case e of (e1,e2) \\<Rightarrow> e1 \\<noteq> e2 \\<and> \\<not> allowed_secgw_flow (nP e1) (nP e2)} })\"\n  lemma PolEnforcePointExtended_offending_set: \"SecurityInvariant_withOffendingFlows.set_offending_flows sinvar = PolEnforcePointExtended_offending_set\"\n    apply(simp only: fun_eq_iff ENFnr_offending_set[OF PolEnforcePoint_ENFnr] PolEnforcePointExtended_offending_set_def)\n    apply(rule allI)+\n    apply(rename_tac G nP)\n    apply(auto)\n  done\n\ninterpretation PolEnforcePointExtended: SecurityInvariant_ACS\nwhere default_node_properties = default_node_properties\nand sinvar = sinvar\nrewrites \"SecurityInvariant_withOffendingFlows.set_offending_flows sinvar = PolEnforcePointExtended_offending_set\"\n  unfolding default_node_properties_def\n  apply unfold_locales\n    apply(rule ballI)\n    apply (rule SecurityInvariant_withOffendingFlows.ENFnr_fsts_weakrefl_instance[OF PolEnforcePoint_ENFnr Unassigned_botdefault All_to_Unassigned])[1]\n     apply(simp)\n    apply(simp)\n   apply(erule default_uniqueness_by_counterexample_ACS)\n   apply (simp add: SecurityInvariant_withOffendingFlows.set_offending_flows_def\n      SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n      SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n   apply (simp add:graph_ops)\n   apply (simp split: prod.split_asm prod.split)\n   apply(rule_tac x=\"\\<lparr> nodes={vertex_1,vertex_2}, edges = {(vertex_1,vertex_2)} \\<rparr>\" in exI, simp)\n   apply(rule conjI)\n    apply(simp add: wf_graph_def)\n   apply(case_tac otherbot, simp_all)\n      apply(rename_tac secgwcase)\n      apply(rule_tac x=\"(\\<lambda> x. Unassigned)(vertex_1 := Unassigned, vertex_2 := DomainMember)\" in exI, simp)\n      apply(rule_tac x=\"{(vertex_1,vertex_2)}\" in exI, simp)\n     apply(rename_tac secgwINcase)\n     apply(rule_tac x=\"(\\<lambda> x. Unassigned)(vertex_1 := Unassigned, vertex_2 := DomainMember)\" in exI, simp)\n     apply(rule_tac x=\"vertex_1\" in exI, simp)\n     apply(rule_tac x=\"{(vertex_1,vertex_2)}\" in exI, simp)\n    apply(rename_tac membercase)\n    apply(rule_tac x=\"(\\<lambda> x. Unassigned)(vertex_1 := Unassigned, vertex_2 := PolEnforcePoint)\" in exI, simp)\n    apply(rule_tac x=\"vertex_1\" in exI, simp)\n    apply(rule_tac x=\"{(vertex_1,vertex_2)}\" in exI, simp)\n   apply(rule_tac x=\"(\\<lambda> x. Unassigned)(vertex_1 := Unassigned, vertex_2 := PolEnforcePoint)\" in exI, simp)\n   apply(rule_tac x=\"vertex_1\" in exI, simp)\n   apply(rule_tac x=\"{(vertex_1,vertex_2)}\" in exI, simp)\n\n  apply(fact PolEnforcePointExtended_offending_set)\n done\n\n\n\n  lemma TopoS_PolEnforcePointExtended: \"SecurityInvariant sinvar default_node_properties receiver_violation\"\n  unfolding receiver_violation_def by unfold_locales  \n\nhide_const (open) sinvar receiver_violation\n\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/Security_Invariants/SINVAR_SecGwExt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283035, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3447485837215961}}
{"text": "(*  Title:       CoreC++\n    Author:      Daniel Wasserrab\n    Maintainer:  Daniel Wasserrab <wasserra at fmi.uni-passau.de>\n\n    Based on the Jinja theory Common/Decl.thy by David von Oheimb and Tobias Nipkow \n*)\n\nsection \\<open>CoreC++ types\\<close>\n\ntheory Type imports Auxiliary begin\n\n\ntype_synonym cname = string \\<comment> \\<open>class names\\<close>\ntype_synonym mname = string \\<comment> \\<open>method name\\<close>\ntype_synonym vname = string \\<comment> \\<open>names for local/field variables\\<close>\n \ndefinition this :: vname where\n  \"this \\<equiv> ''this''\"\n\n\\<comment> \\<open>types\\<close>\ndatatype ty\n  = Void          \\<comment> \\<open>type of statements\\<close>\n  | Boolean\n  | Integer\n  | NT            \\<comment> \\<open>null type\\<close>\n  | Class cname   \\<comment> \\<open>class type\\<close>\n\ndatatype base  \\<comment> \\<open>superclass\\<close>\n  = Repeats cname  \\<comment> \\<open>repeated (nonvirtual) inheritance\\<close>\n  | Shares cname   \\<comment> \\<open>shared (virtual) inheritance\\<close>\n\nprimrec getbase :: \"base \\<Rightarrow> cname\" where\n  \"getbase (Repeats C) = C\"\n| \"getbase (Shares C)  = C\"\n\nprimrec isRepBase :: \"base \\<Rightarrow> bool\" where\n  \"isRepBase (Repeats C) = True\"\n| \"isRepBase (Shares C) = False\"\n\nprimrec isShBase :: \"base \\<Rightarrow> bool\" where\n  \"isShBase(Repeats C) = False\"\n| \"isShBase(Shares C) = True\"\n\ndefinition is_refT :: \"ty \\<Rightarrow> bool\" where\n  \"is_refT T  \\<equiv>  T = NT \\<or> (\\<exists>C. T = Class C)\"\n\n\n\nlemma [iff]: \"is_refT(Class C)\"\nby(simp add:is_refT_def)\n\nlemma refTE:\n  \"\\<lbrakk>is_refT T; T = NT \\<Longrightarrow> Q; \\<And>C. T = Class C \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\nby (auto simp add: is_refT_def)\n\nlemma not_refTE:\n  \"\\<lbrakk> \\<not>is_refT T; T = Void \\<or> T = Boolean \\<or> T = Integer \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\nby (cases T, auto simp add: is_refT_def)\n\ntype_synonym \n  env  = \"vname \\<rightharpoonup> ty\"\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/CoreC++/Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.34474858372159606}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2005         |\n            |               December 2005               |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_T_law_SKIP_DIV\nimports CSP_T_law_SKIP CSP_T_law_DIV\nbegin\n\n(*********************************************************\n                   (SKIP [+] DIV)\n *********************************************************)\n\nlemma cspT_SKIP_DIV_Ext_choice1: \"(SKIP [+] DIV) =T[M1,M2] SKIP\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_traces)\ndone\n\nlemma cspT_SKIP_DIV_Ext_choice2: \"(DIV [+] SKIP) =T[M1,M2] SKIP\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces)+\ndone\n\nlemmas cspT_SKIP_DIV_Ext_choice =\n       cspT_SKIP_DIV_Ext_choice1\n       cspT_SKIP_DIV_Ext_choice2\n\n(*********************************************************\n                    SKIP |[X]| DIV\n *********************************************************)\n\nlemma cspT_SKIP_DIV_Parallel1:\n   \"SKIP |[X]| DIV =T[M1,M2] DIV\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\ndone\n\nlemma cspT_SKIP_DIV_Parallel2:\n   \"DIV |[X]| SKIP =T[M1,M2] DIV\"\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (rule cspT_rw_left)\napply (rule cspT_SKIP_DIV_Parallel1)\napply (rule cspT_reflex)\ndone\n\nlemmas cspT_SKIP_DIV_Parallel =\n       cspT_SKIP_DIV_Parallel1\n       cspT_SKIP_DIV_Parallel2\n       cspT_Parallel_term\n       cspT_DIV_Parallel\n\n(*********************************************************\n                 DIV and Parallel-SKIP\n *********************************************************)\n\n(*** SKIP and DIV ***)\n\nlemma cspT_DIV_Parallel_Ext_choice_SKIP_l:\n  \"(P [+] SKIP) |[X]| DIV =T[M,M] (P |[X]| DIV)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n  apply (simp add: par_tr_nil_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n\n(* <= *)\n apply (rule, simp add: in_traces)\n apply (elim conjE exE disjE)\n  apply (simp add: par_tr_nil_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\ndone\n\nlemma cspT_DIV_Parallel_Ext_choice_SKIP_r:\n  \"DIV |[X]| (P [+] SKIP) =T[M,M] (DIV |[X]| P)\"\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (rule cspT_rw_left)\napply (rule cspT_DIV_Parallel_Ext_choice_SKIP_l)\napply (rule cspT_commut)\ndone\n\nlemmas cspT_DIV_Parallel_Ext_choice_SKIP =\n       cspT_DIV_Parallel_Ext_choice_SKIP_l\n       cspT_DIV_Parallel_Ext_choice_SKIP_r\n\nlemmas cspT_DIV_Parallel_Ext_choice =\n       cspT_DIV_Parallel_Ext_choice_SKIP\n       cspT_DIV_Parallel_Ext_choice_DIV\n\n(*********************************************************\n                 SKIP and Parallel-DIV\n *********************************************************)\n\n(*** DIV and SKIP ***)\n\nlemma cspT_SKIP_Parallel_Ext_choice_DIV_l:\n  \"((? :Y -> Pf) [+] DIV) |[X]| SKIP =T[M,M] \n   (? x:(Y - X) -> (Pf x |[X]| SKIP)) [+] DIV\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (rule disjI2)\n  apply (simp add: par_tr_nil_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n\n  apply (rule disjI2)\n  apply (simp add: par_tr_Tick_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n\n(* <= *)\n apply (rule, simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (simp add: par_tr_nil_right)\n  apply (elim conjE)\n  apply (rule_tac x=\"<Ev a> ^^^ sa\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n  apply (simp add: image_iff)\n\n  apply (simp add: par_tr_Tick_right)\n  apply (elim conjE)\n  apply (rule_tac x=\"<Ev a> ^^^ sa\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n  apply (simp add: image_iff)\ndone\n\nlemma cspT_SKIP_Parallel_Ext_choice_DIV_r:\n  \"SKIP |[X]| ((? :Y -> Pf) [+] DIV) =T[M,M]\n   (? x:(Y - X) -> (SKIP |[X]| Pf x)) [+] DIV\"\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (rule cspT_rw_left)\napply (rule cspT_SKIP_Parallel_Ext_choice_DIV_l)\napply (rule cspT_rw_left)\napply (rule cspT_decompo)\napply (rule cspT_decompo)\napply (simp)\napply (rule cspT_commut)\napply (rule cspT_reflex)\napply (rule cspT_reflex)\ndone\n\nlemmas cspT_SKIP_Parallel_Ext_choice_DIV =\n       cspT_SKIP_Parallel_Ext_choice_DIV_l\n       cspT_SKIP_Parallel_Ext_choice_DIV_r\n\nlemmas cspT_SKIP_Parallel_Ext_choice =\n       cspT_SKIP_Parallel_Ext_choice_SKIP\n       cspT_SKIP_Parallel_Ext_choice_DIV\n\n(*---------------------------------------------*\n |                 SKIP , DIV                  |\n *---------------------------------------------*)\n\nlemmas cspT_SKIP_DIV_Parallel_step =\n       cspT_Parallel_preterm\n       cspT_DIV_Parallel_step\n\nlemmas cspT_SKIP_DIV_Parallel_Ext_choice =\n       cspT_SKIP_Parallel_Ext_choice\n       cspT_DIV_Parallel_Ext_choice\n\nlemmas cspT_SKIP_DIV_Hiding_Id =\n       cspT_SKIP_Hiding_Id\n       cspT_DIV_Hiding_Id\n\nlemmas cspT_SKIP_DIV_Hiding_step =\n       cspT_DIV_Hiding_step\n       cspT_SKIP_Hiding_step\n\nlemmas cspT_SKIP_DIV_Renaming_Id =\n       cspT_SKIP_Renaming_Id\n       cspT_DIV_Renaming_Id\n\nlemmas cspT_SKIP_DIV_Seq_compo =\n       cspT_Seq_compo_unit\n       cspT_DIV_Seq_compo\n\nlemmas cspT_SKIP_DIV_Seq_compo_step =\n       cspT_SKIP_Seq_compo_step\n       cspT_DIV_Seq_compo_step\n\nlemmas cspT_SKIP_DIV_Depth_rest =\n       cspT_SKIP_Depth_rest\n       cspT_DIV_Depth_rest\n\nlemmas cspT_SKIP_DIV =\n       cspT_SKIP_DIV_Parallel_step\n       cspT_SKIP_DIV_Ext_choice\n       cspT_SKIP_DIV_Parallel\n       cspT_SKIP_DIV_Parallel_Ext_choice\n       cspT_SKIP_DIV_Hiding_Id\n       cspT_SKIP_DIV_Hiding_step\n       cspT_SKIP_DIV_Renaming_Id\n       cspT_SKIP_DIV_Seq_compo\n       cspT_SKIP_DIV_Seq_compo_step\n       cspT_SKIP_DIV_Depth_rest\n\n(*** resolve ***)\n\nlemmas cspT_Ext_choice_SKIP_DIV_resolve =\n       cspT_Ext_choice_SKIP_resolve\n       cspT_Ext_choice_DIV_resolve\n\n(*----------------------------------------------*\n |                                              |\n |        for convenienve  (SKIP or DIV)        |\n |                                              |\n *----------------------------------------------*)\n\n(*********************************************************\n            (SKIP or DIV [+] SKIP or DIV)\n *********************************************************)\n\nlemma cspT_SKIP_or_DIV_Ext_choice:\n  \"[| P = SKIP | P = DIV ; Q = SKIP | Q = DIV |] ==>\n   (P [+] Q) =T[M1,M2] (if (P = SKIP | Q = SKIP) then SKIP else DIV)\"\napply (elim disjE)\napply (simp_all)\napply (rule cspT_rw_left)\napply (rule cspT_Ext_choice_idem)\napply (simp)\napply (simp add: cspT_SKIP_DIV)\napply (simp add: cspT_SKIP_DIV)\napply (rule cspT_rw_left)\napply (rule cspT_Ext_choice_idem)\napply (simp)\ndone\n\n(*********************************************************\n            (SKIP or DIV |[X]| SKIP or DIV)\n *********************************************************)\n\nlemma cspT_SKIP_or_DIV_Parallel:\n  \"[| P = SKIP | P = DIV ; Q = SKIP | Q = DIV |] ==>\n   (P |[X]| Q) =T[M1,M2] (if (P = SKIP & Q = SKIP) then SKIP else DIV)\"\napply (elim disjE)\napply (simp_all add: cspT_SKIP_DIV)\ndone\n\n(*********************************************************\n                  (SKIP or DIV) and Hiding\n *********************************************************)\n\nlemma cspT_SKIP_or_DIV_Hiding_step:\n  \"Q = SKIP | Q = DIV ==>\n   ((? :Y -> Pf) [+] Q) -- X =T[M,M] \n   (((? x:(Y-X) -> (Pf x -- X)) [+] Q) |~| (! x:(Y Int X) .. (Pf x -- X)))\"\napply (erule disjE)\napply (simp_all add: cspT_SKIP_DIV)\ndone\n\n(*********************************************************\n                  SKIP or DIV |. Suc n\n *********************************************************)\n\nlemma cspT_SKIP_or_DIV_Depth_rest: \n   \"Q = SKIP | Q = DIV ==> Q |. (Suc n) =T[M1,M2] Q\"\napply (erule disjE)\napply (simp_all add: cspT_SKIP_DIV)\ndone\n\n(*********************************************************\n                    P [+] (SKIP or DIV)\n *********************************************************)\n\nlemma cspT_Ext_choice_SKIP_or_DIV_resolve:\n  \"Q = SKIP | Q = DIV ==> P [+] Q =T[M,M] P [> Q\"\napply (erule disjE)\napply (simp_all add: cspT_Ext_choice_SKIP_DIV_resolve)\ndone\n\nlemmas cspT_SKIP_or_DIV =\n       cspT_SKIP_or_DIV_Ext_choice\n       cspT_SKIP_or_DIV_Parallel\n       cspT_SKIP_or_DIV_Hiding_step\n       cspT_SKIP_or_DIV_Depth_rest\n\n       (* no resolve *)\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/CSP_T_law_SKIP_DIV.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3447238421626679}}
{"text": "(* Author: Joshua Schneider, ETH Zurich *)\n\nsection \\<open>Regression tests for applicative lifting\\<close>\n\ntheory Applicative_Test imports\n  Stream_Algebra\n  Applicative_Environment\n  Applicative_List\n  Applicative_Option\n  Applicative_Set\n  Applicative_Sum\n  Abstract_AF\nbegin\n\ninterpretation applicative_syntax .\n\nsubsection {* Normal form conversion *}\n\nnotepad\nbegin\n  have \"\\<forall>x. x = af_pure (\\<lambda>x. x) \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>x. af_pure x = af_pure x\" by applicative_nf rule\n  have \"\\<forall>f x. af_pure f \\<diamondop> x = af_pure f \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x y. af_pure f \\<diamondop> x \\<diamondop> y = af_pure f \\<diamondop> x \\<diamondop> y\" by applicative_nf rule\n  have \"\\<forall>g f x. af_pure g \\<diamondop> (f \\<diamondop> x) = af_pure (\\<lambda>f x. g (f x)) \\<diamondop> f \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x y. f \\<diamondop> x \\<diamondop> y = af_pure (\\<lambda>f x y. f x y) \\<diamondop> f \\<diamondop> x \\<diamondop> y\" by applicative_nf rule\n  have \"\\<forall>g f x. g \\<diamondop> (f \\<diamondop> x) = af_pure (\\<lambda>g f x. g (f x)) \\<diamondop> g \\<diamondop> f \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x. f \\<diamondop> af_pure x = af_pure (\\<lambda>f. f x) \\<diamondop> f\" by applicative_nf rule\n  have \"\\<forall>x y. af_pure x \\<diamondop> af_pure y = af_pure (x y)\" by applicative_nf rule\n  have \"\\<forall>f x y. f \\<diamondop> x \\<diamondop> af_pure y = af_pure (\\<lambda>f x. f x y) \\<diamondop> f \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x y. af_pure f \\<diamondop> x \\<diamondop> af_pure y = af_pure (\\<lambda>x. f x y) \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x y z. af_pure f \\<diamondop> x \\<diamondop> af_pure y \\<diamondop> z = af_pure (\\<lambda>x z. f x y z) \\<diamondop> x \\<diamondop> z\" by applicative_nf rule\n  have \"\\<forall>f x g y. af_pure f \\<diamondop> x \\<diamondop> (af_pure g \\<diamondop> y) = af_pure (\\<lambda>x y. f x (g y)) \\<diamondop> x \\<diamondop> y\" by applicative_nf rule\n  have \"\\<forall>f g x y. f \\<diamondop> (g \\<diamondop> x) \\<diamondop> y = af_pure (\\<lambda>f g x y. f (g x) y) \\<diamondop> f \\<diamondop> g \\<diamondop> x \\<diamondop> y\" by applicative_nf rule\n  have \"\\<forall>f g x y z. f \\<diamondop> (g \\<diamondop> x \\<diamondop> y) \\<diamondop> z = af_pure (\\<lambda>f g x y z. f (g x y) z) \\<diamondop> f \\<diamondop> g \\<diamondop> x \\<diamondop> y \\<diamondop> z\" by applicative_nf rule\n  have \"\\<forall>f g x y z. f \\<diamondop> (g \\<diamondop> (x \\<diamondop> af_pure y)) \\<diamondop> z = af_pure (\\<lambda>f g x z. f (g (x y)) z) \\<diamondop> f \\<diamondop> g \\<diamondop> x \\<diamondop> z\" by applicative_nf rule\n  have \"\\<forall>f g x. f \\<diamondop> (g \\<diamondop> x \\<diamondop> x) = af_pure (\\<lambda>f g x x'. f (g x x')) \\<diamondop> f \\<diamondop> g \\<diamondop> x \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x y. f x \\<diamondop> y = af_pure (\\<lambda>f x. f x) \\<diamondop> f x \\<diamondop> y\" by applicative_nf rule\nnext\n  fix f :: \"('a \\<Rightarrow> 'b) af\" and g :: \"('b \\<Rightarrow> 'c) af\" and x\n  have \"g \\<diamondop> (f \\<diamondop> x) = af_pure (\\<lambda>g f x. g (f x)) \\<diamondop> g \\<diamondop> f \\<diamondop> x\" by applicative_nf rule\nend\n(* TODO automatic test for names of new variables *)\n\nlemma \"\\<And>f x::'a af. f \\<diamondop> x = x\"\napply applicative_nf\noops\n\nsubsection {* Sets *}\n\ninstantiation set :: (plus) plus\nbegin\n  definition set_plus_def[applicative_unfold]: \"(X::('a::plus)set) + Y = {plus} \\<diamondop> X \\<diamondop> Y\"\n  instance ..\nend\n\nlemma \"(X :: _ :: semigroup_add set) + Y + Z = X + (Y + Z)\"\nby (fact add.assoc[applicative_lifted set])\n\ninstantiation set :: (semigroup_add) semigroup_add begin\ninstance proof\n  fix X Y Z :: \"'a set\"\n  from add.assoc\n  show \"X + Y + Z = X + (Y + Z)\" by applicative_lifting\nqed\nend\n\ninstantiation set :: (ab_semigroup_add) ab_semigroup_add begin\ninstance proof\n  fix X Y :: \"'a set\"\n  from add.commute\n  show \"X + Y = Y + X\" by applicative_lifting\nqed\nend\n\nsubsection {* Sum type (a.k.a. either) *}\n\nlemma \"Inl plus \\<diamondop> (x :: nat + 'e list) \\<diamondop> x = Inl (\\<lambda>x. 2 * x) \\<diamondop> x\"\nby applicative_lifting simp\n\nlemma \"rel_sum (op \\<le>) (op \\<le>) (x :: nat + nat) (Inl Suc \\<diamondop> x)\"\nproof -\n  interpret either_af \"op \\<le> :: nat \\<Rightarrow> _\" by unfold_locales (rule reflpI, simp)\n  show ?thesis by applicative_lifting simp\nqed\n\n\nsubsection {* Streams *}\n\nlemma \"(x::int stream) * sconst 0 = sconst 0\"\nby applicative_lifting simp\n\nlemma \"(x::int stream) * (y + z) = x * y + x * z\"\nby applicative_lifting algebra\n\n\ndefinition \"lift_streams xs = foldr (smap2 Cons) xs (sconst [])\"\n\nlemma lift_streams_Nil[applicative_unfold]: \"lift_streams [] = sconst []\"\nunfolding lift_streams_def\nby simp\n\nlemma lift_streams_Cons[applicative_unfold]:\n  \"lift_streams (x # xs) = smap2 Cons x (lift_streams xs)\"\nunfolding lift_streams_def\nby applicative_unfold\n\nlemma stream_append_Cons: \"smap2 append (smap2 Cons x ys) zs = smap2 Cons x (smap2 append ys zs)\"\nby applicative_lifting simp\n\nlemma lift_streams_append[applicative_unfold]:\n  \"lift_streams (xs @ ys) = smap2 append (lift_streams xs) (lift_streams ys)\"\nproof (induction xs)\n  case Nil\n  (*\n    case could be proved directly if \"lift_streams ([] @ ys) = lift_streams ys\" is solved\n    in head_cong_tac (invoke simplifier?) -- but only with applicative_nf\n  *)\n  have \"lift_streams ys = sconst append \\<diamondop> lift_streams [] \\<diamondop> lift_streams ys\"\n    by applicative_lifting simp\n  thus ?case by applicative_unfold\nnext\n  case (Cons x xs)\n  with stream_append_Cons  (* the actual lifted fact *)\n  show ?case by applicative_unfold (rule sym)\nqed\n\nlemma \"lift_streams (rev x) = smap rev (lift_streams x)\"\nproof (induction x)\n  case Nil\n  have \"lift_streams [] = smap rev (lift_streams [])\"\n    by applicative_lifting simp\n  thus ?case by simp\nnext\n  case (Cons x xs)\n  have \"\\<forall>y ys. rev ys @ [y] = rev (y # ys)\" by simp\n  hence \"\\<forall>y ys. smap2 append (smap rev ys) (smap2 Cons y (sconst [])) = smap rev (smap2 Cons y ys)\"\n    by applicative_lifting simp\n  with Cons.IH show ?case by applicative_unfold blast\nqed\n\ndefinition [applicative_unfold]: \"sconcat xs = smap concat xs\"\n\nlemma \"sconcat (lift_streams [sconst ''Hello '', sconst ''world!'']) = sconst ''Hello world!''\"\nby applicative_lifting simp\n\n\nsubsection {* Relators *}\n\nlemma \"rel_fun (op =) (op \\<le>) (const (0::nat)) x\"\nby applicative_lifting simp\n\nlemma \"list_all2 (op \\<subseteq>) (map (\\<lambda>_. {}) x) (map set x)\"\nby applicative_nf simp\n\nlemma \"x = Some a \\<Longrightarrow> rel_option (op \\<le>) (map_option (\\<lambda>_. a) x) (map_option Suc x)\"\nby applicative_lifting simp\n\nschematic_goal \"\\<forall>g f x. rel_sum ?R (op =) (ap_either f x) (ap_either (ap_either (Inl g) f) x)\"\napply applicative_lifting\noops\n\nschematic_goal \"stream_all2 ?R (?f \\<diamondop> (pure ?g \\<diamondop> ?x + ?y)) (?x + ?z)\"\napply applicative_lifting\noops\n\n\nprint_applicative\n\nend\n", "meta": {"author": "jshs", "repo": "applicative-lifting", "sha": "b58742496635799300e3400b56e83b6b5e0a3b7d", "save_path": "github-repos/isabelle/jshs-applicative-lifting", "path": "github-repos/isabelle/jshs-applicative-lifting/applicative-lifting-b58742496635799300e3400b56e83b6b5e0a3b7d/src/Applicative_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.6442251064863697, "lm_q1q2_score": 0.3447238421626679}}
{"text": "(*  Title:    HOL/IMPP/Com.thy\n    Author:   David von Oheimb (based on a theory by Tobias Nipkow et al), TUM\n*)\n\nsection \\<open>Semantics of arithmetic and boolean expressions, Syntax of commands\\<close>\n\ntheory Com\nimports MainRLT\nbegin\n\ntype_synonym val = nat\n  (* for the meta theory, this may be anything, but types cannot be refined later *)\n\ntypedecl glb\ntypedecl loc\n\naxiomatization\n  Arg :: loc and\n  Res :: loc\n\ndatatype vname  = Glb glb | Loc loc\ntype_synonym globs = \"glb => val\"\ntype_synonym locals = \"loc => val\"\ndatatype state  = st globs locals\n(* for the meta theory, the following would be sufficient:\ntypedecl state\nconsts   st :: \"[globs , locals] => state\"\n*)\ntype_synonym aexp = \"state => val\"\ntype_synonym bexp = \"state => bool\"\n\ntypedecl pname\n\ndatatype com\n      = SKIP\n      | Ass   vname aexp        (\"_:==_\"                [65, 65    ] 60)\n      | Local loc aexp com      (\"LOCAL _:=_ IN _\"      [65,  0, 61] 60)\n      | Semi  com  com          (\"_;; _\"                [59, 60    ] 59)\n      | Cond  bexp com com      (\"IF _ THEN _ ELSE _\"   [65, 60, 61] 60)\n      | While bexp com          (\"WHILE _ DO _\"         [65,     61] 60)\n      | BODY  pname\n      | Call  vname pname aexp  (\"_:=CALL _'(_')\"       [65, 65,  0] 60)\n\nconsts bodies :: \"(pname  *  com) list\"(* finitely many procedure definitions *)\ndefinition\n  body :: \" pname \\<rightharpoonup> com\" where\n  \"body = map_of bodies\"\n\n\n(* Well-typedness: all procedures called must exist *)\n\ninductive WT  :: \"com => bool\" where\n\n    Skip:    \"WT SKIP\"\n\n  | Assign:  \"WT (X :== a)\"\n\n  | Local:   \"WT c ==>\n              WT (LOCAL Y := a IN c)\"\n\n  | Semi:    \"[| WT c0; WT c1 |] ==>\n              WT (c0;; c1)\"\n\n  | If:      \"[| WT c0; WT c1 |] ==>\n              WT (IF b THEN c0 ELSE c1)\"\n\n  | While:   \"WT c ==>\n              WT (WHILE b DO c)\"\n\n  | Body:    \"body pn ~= None ==>\n              WT (BODY pn)\"\n\n  | Call:    \"WT (BODY pn) ==>\n              WT (X:=CALL pn(a))\"\n\ninductive_cases WTs_elim_cases:\n  \"WT SKIP\"  \"WT (X:==a)\"  \"WT (LOCAL Y:=a IN c)\"\n  \"WT (c1;;c2)\"  \"WT (IF b THEN c1 ELSE c2)\"  \"WT (WHILE b DO c)\"\n  \"WT (BODY P)\"  \"WT (X:=CALL P(a))\"\n\ndefinition\n  WT_bodies :: bool where\n  \"WT_bodies = (\\<forall>(pn,b) \\<in> set bodies. WT b)\"\n\n\nML \\<open>\n  fun make_imp_tac ctxt =\n    EVERY' [resolve_tac ctxt [mp], fn i => assume_tac ctxt (i + 1), eresolve_tac ctxt [thin_rl]]\n\\<close>\n\nlemma finite_dom_body: \"finite (dom body)\"\napply (unfold body_def)\napply (rule finite_dom_map_of)\ndone\n\nlemma WT_bodiesD: \"[| WT_bodies; body pn = Some b |] ==> WT b\"\napply (unfold WT_bodies_def body_def)\napply (drule map_of_SomeD)\napply fast\ndone\n\ndeclare WTs_elim_cases [elim!]\n\nend\n", "meta": {"author": "dtraytel", "repo": "HOLRLT", "sha": "e9029da59bb3af0c835604a65308498f9696a364", "save_path": "github-repos/isabelle/dtraytel-HOLRLT", "path": "github-repos/isabelle/dtraytel-HOLRLT/HOLRLT-e9029da59bb3af0c835604a65308498f9696a364/HOLRLT/IMPP/Com.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442250928250375, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.34472383485251057}}
{"text": "(*  Title:       Lifting Definition Option\n    Author:      René Thiemann       <rene.thiemann@uibk.ac.at>\n    Maintainer:  René Thiemann\n    License:     LGPL\n*)\n\n(*\nCopyright 2014 René Thiemann\n\nThis file is part of IsaFoR/CeTA.\n\nIsaFoR/CeTA is free software: you can redistribute it and/or modify it under the\nterms of the GNU Lesser General Public License as published by the Free Software\nFoundation, either version 3 of the License, or (at your option) any later\nversion.\n\nIsaFoR/CeTA is distributed in the hope that it will be useful, but WITHOUT ANY\nWARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A\nPARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public License along\nwith IsaFoR/CeTA. If not, see <http://www.gnu.org/licenses/>.\n*)\ntheory Lifting_Definition_Option_Explanation\nimports \n  Lifting_Definition_Option\n  Rat\nbegin\n\nsection \\<open>Introduction\\<close>\n\ntext \\<open>Often algorithms expect that their input satisfies some specific property @{term P}.\nFor example, some algorithms require lists as input which have to be sorted, \nor numbers which have to be positive,\nor programs which have to be well-typed, etc. \nHere, there are at least two approaches how one can reason\nabout these algorithms. \n\nThe first approach is to guard all soundness properties of the algorithm\nby the additional precondition @{term \"P input\"}. \nSo, as an example, a binary search algorithm might take arbitrary lists as input, but only\nif the input list is sorted, then the result of the search is meaningful.\nWhereas for binary search, this approach is reasonable, there might be problems that the\nrestriction on the input is even crucial for actually defining the algorithm, since without\nthe restriction the algorithm might be non-terminating, and thus, cannot be easily defined\nusing Isabelle's function-package \\cite{DBLP:journals/jar/Krauss10}. \nAs an example, consider an approximation algorithm for\n$\\sqrt{x}$, where the algorithm should stop once the current approximation $y$ satisfies\n@{term \"abs(x^2 - y^2) < \\<delta>\"}. Imagine now, that @{term \\<delta>} is a negative number.\n\n\nTo this end, in the second approach the idea is to declare restricted types, \nso that the algorithms are only invoked with inputs which satisfy the property @{term P}. \nFor example, using Isabelle's lifting- and transfer-package \n\\cite{DBLP:conf/cpp/HuffmanK13},\none can easily define a dedicated type for positive numbers, \nand a function which accesses the internal number,\nwhich is then guaranteed to be positive.\n\\<close>\n\ntypedef 'a pos_num = \"{ x :: 'a :: linordered_field. x > 0}\" morphisms num pos\n  by (rule exI[of _ 1], auto)\n\nsetup_lifting type_definition_pos_num\n\nlemma num_positive: \"num x > 0\"\n  by (transfer, simp)\n\ntext \\<open>Using these restricted types, it is often possible to define the desired algorithms\nwhere non-termination because of invalid inputs is no longer possible, \nand where soundness properties\ncan be stated without additional preconditions. E.g., for the approximation algorithm, one\ntakes @{term \"\\<delta> :: rat pos_num\"} as input, and the approximation stops, once \n@{term \"abs(x^2 - y^2) < num \\<delta>\"} is satisfied.\n\nOne question in the second approach is how to actually generate elements of the restricted type.\nAlthough one can perform the following definition,\n\\<close>\n\nlift_definition create_pos_1 :: \"'a :: linordered_field \\<Rightarrow> 'a pos_num option\" is\n  \"\\<lambda> x. if x > 0 then Some x else None\" \n  by auto\n\ntext \\<open>\\noindent the problem is that corresponding defining equation \n@{thm create_pos_1.abs_eq} is not amenable for code-generation,\nas it uses the abstraction function @{term pos} in a way which\nis not admitted for code-equations \n\\cite{DBLP:conf/itp/HaftmannKKN13, DBLP:conf/flops/HaftmannN10}.\n\nTo overcome this problem, Joachim Breitner proposed the following \nworkaround\\footnote{\\url{http://stackoverflow.com/questions/16273812/working-with-isabelles-code-generator-data-refinement-and-higher-order-functio}},\nwhich requires an additional type definition, and some auxiliary definitions,\nto in the end define @{term create_pos} in a way that is amenable for code-generation.\n\\<close>\n\ntypedef 'a num_bit = \"{ (x :: 'a :: linordered_field, b). b \\<longrightarrow> x > 0}\" by auto\n\nsetup_lifting type_definition_num_bit\n\nlift_definition num_bit_bit :: \"('a :: linordered_field) num_bit \\<Rightarrow> bool\" is snd .\nlift_definition num_bit_num :: \"('a :: linordered_field) num_bit \\<Rightarrow> 'a pos_num\" is\n  \"\\<lambda> (x,b). if b then x else 42\" by auto\n\nlift_definition num_bit :: \"'a :: linordered_field \\<Rightarrow> 'a num_bit\" is\n  \"\\<lambda> x. if x > 0 then (x, True) else (42, False)\" by auto\n\ndefinition create_pos_2 :: \"'a :: linordered_field \\<Rightarrow> 'a pos_num option\" where\n  \"create_pos_2 x \\<equiv> let nb = num_bit x\n    in if num_bit_bit nb then Some (num_bit_num nb) else None\"\n\nlemma create_pos_2: \"create_pos_2 x = Some p \\<Longrightarrow> num p = x\"\n  unfolding create_pos_2_def Let_def by (transfer, simp split: if_splits)\n\nexport_code create_pos_2 in Haskell\n\ntext \\<open>Breitner's construction has the advantage that the invariant @{term \"x > 0\"} only\n  has to be evaluated once (when invoking @{term num_bit}). \n  Hence, the construction allows to create data for types with\n  invariants in an efficient, executable, and canonical way.\n\nIn this AFP entry we now turned this canonical way into a dedicated method \n(\\ldo) which automatically\ngenerates the types and auxiliary functions of Breitner's construction. As a result it suffices\nto write:\\<close>\n\nlift_definition_option create_pos :: \"'a :: linordered_field \\<Rightarrow> 'a pos_num option\" is\n  \"\\<lambda> x :: 'a. if x > 0 then Some x else None\" \n  by auto\n\ntext \\<open>Afterwards, we can directly generate code.\\<close>\n\nexport_code create_pos in Haskell\n\ntext \\<open>Moreover, we automatically generate two soundness theorems, \nthat the generated number is the intended one:\n@{thm create_pos} and @{thm create_pos_Some}. Here, the morphisms from the type-definitions \nreappear, i.e., @{term num} and @{term pos} in the example.\\<close>\n\nsection \\<open>Usage and limitations\\<close>\n\ntext \\<open>The command \\ldo{} \nis useful to generate elements of\nsome restricted type (say @{typ 'restricted}) which has been defined as\n@{term \"{x. P x}\"} for some property @{term P} of type @{typ \"'base \\<Rightarrow> bool\"}. \nIt expects three arguments, namely\n\\begin{itemize}\n\\item The name of the definition, e.g., @{term create_pos}.\n\\item The type of the definition, which must be of the form \n  @{typ \"'a1 \\<Rightarrow> 'a2 \\<Rightarrow> 'a_dots \\<Rightarrow> 'a_n \\<Rightarrow> 'restricted option\"}\n\\item The right-hand side of the definition which must be of the shape\n  @{term \"\\<lambda> x1 x2 x_dots x_n. if check x1 x2 x_dots x_n then Some (generate x1 x2 x_dots x_n) else None\"} \n  where @{term generate} is of type @{typ \"'a1 \\<Rightarrow> 'a2 \\<Rightarrow> 'a_dots \\<Rightarrow> 'a_n \\<Rightarrow> 'base option\"}\n\\end{itemize}\n\nAfter providing the three arguments, a proof of \n  @{term \"check x1 x2 x_dots x_n \\<Longrightarrow> P (generate x1 x2 x_dots x_n)\"} has to be provided.\nThen, code-equations will be derived and registered, and in addition two\nsoundness theorems are generated. These are accessible under the names @{term \"def_name\"} \nand @{term \"def_name_Some\"},\nprovided that the lifting definition uses @{term \"def_name\"} as first argument.\n\nNote, that @{term P} is automatically extracted from the type-definition \nof @{typ 'restricted}. Similarly, the default value (42 in the @{typ \"'a pos_num\"}-example)\nis generated automatically.\n\nTo mention a further limitation besides the strict syntactic structure for the right-hand side, \nit is sometimes required, \nto add explicit type-annotations in the right-hand-side and the selector, e.g., \nthe @{typ \"'a\"} in @{term   \"\\<lambda> x :: 'a :: linordered_field. if x > 0 then Some x else None\"}.\n\\<close>\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Lifting_Definition_Option/Lifting_Definition_Option_Explanation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442250928250374, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.3447238348525105}}
{"text": "theory Tagged_Packet\nimports \"../../Simple_Firewall/Simple_Packet\" Conntrack_State\nbegin\n\nsection\\<open>Tagged Simple Packet\\<close>\n  text\\<open>Packet constants are prefixed with @{text p}\\<close>\n\n  text\\<open>A packet tagged with the following phantom fields:\n             conntrack connection state\\<close>\n\n  text\\<open>The idea to tag the connection state into the packet is sound.\n       See @{file \"../Semantics_Stateful.thy\"}\\<close>\n\n  record (overloaded) 'i tagged_packet = \"'i::len simple_packet\" +\n                         p_tag_ctstate :: ctstate\n\n\n  value \"\\<lparr> \n          p_iiface = ''eth1'', p_oiface = '''', \n          p_src = 0, p_dst = 0, \n          p_proto = TCP, p_sport = 0, p_dport = 0, \n          p_tcp_flags = {TCP_SYN},\n          p_payload = ''arbitrary payload'',\n          p_tag_ctstate = CT_New\n         \\<rparr>:: 32 tagged_packet\"\n\n  definition simple_packet_tag\n    :: \"ctstate \\<Rightarrow> ('i::len, 'a) simple_packet_scheme \\<Rightarrow> ('i::len, 'a) tagged_packet_scheme\" where\n    \"simple_packet_tag ct_state p \\<equiv>\n      \\<lparr>p_iiface = p_iiface p, p_oiface = p_oiface p, p_src = p_src p, p_dst = p_dst p, p_proto = p_proto p, \n       p_sport = p_sport p, p_dport = p_dport p, p_tcp_flags = p_tcp_flags p, \n       p_payload = p_payload p,\n       p_tag_ctstate = ct_state,\n       \\<dots> = simple_packet.more p\\<rparr>\"\n\n  definition tagged_packet_untag\n    :: \"('i::len, 'a) tagged_packet_scheme \\<Rightarrow> ('i::len, 'a) simple_packet_scheme\" where\n    \"tagged_packet_untag p \\<equiv>\n      \\<lparr>p_iiface = p_iiface p, p_oiface = p_oiface p, p_src = p_src p, p_dst = p_dst p, p_proto = p_proto p, \n       p_sport = p_sport p, p_dport = p_dport p, p_tcp_flags = p_tcp_flags p, \n       p_payload = p_payload p,\n       \\<dots> = tagged_packet.more p\\<rparr>\"\n\n  lemma \"tagged_packet_untag (simple_packet_tag ct_state p) = p\"\n        \"simple_packet_tag ct_state (tagged_packet_untag p) = p\\<lparr>p_tag_ctstate := ct_state\\<rparr>\"\n    apply(case_tac [!] p)\n     by(simp add: tagged_packet_untag_def simple_packet_tag_def)+\n    \n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Primitive_Matchers/Tagged_Packet.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6584175139669998, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.344629124906394}}
{"text": "section \\<open>\\<open>Extra_General\\<close> -- General missing things\\<close>\n\ntheory Extra_General\n  imports\n    \"HOL-Library.Cardinality\"\n    \"HOL-Analysis.Elementary_Topology\"\n    \"HOL-Analysis.Uniform_Limit\"\n    \"HOL-Library.Set_Algebras\"\n    \"HOL-Types_To_Sets.Types_To_Sets\"\n    \"HOL-Library.Complex_Order\"\n    \"HOL-Analysis.Infinite_Sum\"\n    \"HOL-Cardinals.Cardinals\"\n    \"HOL-Library.Complemented_Lattices\"\nbegin\n\nsubsection \\<open>Misc\\<close>\n\nlemma reals_zero_comparable:\n  fixes x::complex\n  assumes \"x\\<in>\\<real>\"\n  shows \"x \\<le> 0 \\<or> x \\<ge> 0\"\n  using assms unfolding complex_is_real_iff_compare0 by assumption\n\nlemma unique_choice: \"\\<forall>x. \\<exists>!y. Q x y \\<Longrightarrow> \\<exists>!f. \\<forall>x. Q x (f x)\"\n  apply (auto intro!: choice ext) by metis\n\nlemma image_set_plus: \n  assumes \\<open>linear U\\<close>\n  shows \\<open>U ` (A + B) = U ` A + U ` B\\<close>\n  unfolding image_def set_plus_def\n  using assms by (force simp: linear_add)\n\nconsts heterogenous_identity :: \\<open>'a \\<Rightarrow> 'b\\<close>\noverloading heterogenous_identity_id \\<equiv> \"heterogenous_identity :: 'a \\<Rightarrow> 'a\" begin\ndefinition heterogenous_identity_def[simp]: \\<open>heterogenous_identity_id = id\\<close>\nend\n\nlemma L2_set_mono2:\n  assumes a1: \"finite L\" and a2: \"K \\<le> L\"\n  shows \"L2_set f K \\<le> L2_set f L\"\nproof-\n  have \"(\\<Sum>i\\<in>K. (f i)\\<^sup>2) \\<le> (\\<Sum>i\\<in>L. (f i)\\<^sup>2)\"\n    apply (rule sum_mono2) \n    using assms by auto\n  hence \"sqrt (\\<Sum>i\\<in>K. (f i)\\<^sup>2) \\<le> sqrt (\\<Sum>i\\<in>L. (f i)\\<^sup>2)\"\n    by (rule real_sqrt_le_mono)\n  thus ?thesis\n    unfolding L2_set_def.\nqed\n\nlemma Sup_real_close:\n  fixes e :: real\n  assumes \"0 < e\"\n    and S: \"bdd_above S\" \"S \\<noteq> {}\"\n  shows \"\\<exists>x\\<in>S. Sup S - e < x\"\nproof -\n  have \\<open>Sup (ereal ` S) \\<noteq> \\<infinity>\\<close>\n    by (metis assms(2) bdd_above_def ereal_less_eq(3) less_SUP_iff less_ereal.simps(4) not_le)\n  moreover have \\<open>Sup (ereal ` S) \\<noteq> -\\<infinity>\\<close>\n    by (simp add: SUP_eq_iff assms(3))\n  ultimately have Sup_bdd: \\<open>\\<bar>Sup (ereal ` S)\\<bar> \\<noteq> \\<infinity>\\<close>\n    by auto\n  then have \\<open>\\<exists>x'\\<in>ereal ` S. Sup (ereal ` S) - ereal e < x'\\<close>\n    apply (rule_tac Sup_ereal_close)\n    using assms by auto\n  then obtain x where \\<open>x \\<in> S\\<close> and Sup_x: \\<open>Sup (ereal ` S) - ereal e < ereal x\\<close>\n    by auto\n  have \\<open>Sup (ereal ` S) = ereal (Sup S)\\<close>\n    using Sup_bdd by (rule ereal_Sup[symmetric])\n  with Sup_x have \\<open>ereal (Sup S - e) < ereal x\\<close>\n    by auto\n  then have \\<open>Sup S - e < x\\<close>\n    by auto\n  with \\<open>x \\<in> S\\<close> show ?thesis\n    by auto\nqed\n\ntext \\<open>Improved version of @{attribute internalize_sort}: It is not necessary to specify the sort of the type variable.\\<close>\nattribute_setup internalize_sort' = \\<open>let\nfun find_tvar thm v = let\n  val tvars = Term.add_tvars (Thm.prop_of thm) []\n  val tv = case find_first (fn (n,sort) => n=v) tvars of\n              SOME tv => tv | NONE => raise THM (\"Type variable \" ^ string_of_indexname v ^ \" not found\", 0, [thm])\nin \nTVar tv\nend\n\nfun internalize_sort_attr (tvar:indexname) =\n  Thm.rule_attribute [] (fn context => fn thm =>\n    (snd (Internalize_Sort.internalize_sort (Thm.ctyp_of (Context.proof_of context) (find_tvar thm tvar)) thm)));\nin\n  Scan.lift Args.var >> internalize_sort_attr\nend\\<close>\n  \"internalize a sort\"\n\nlemma card_prod_omega: \\<open>X *c natLeq =o X\\<close> if \\<open>Cinfinite X\\<close>\n  by (simp add: Cinfinite_Cnotzero cprod_infinite1' natLeq_Card_order natLeq_cinfinite natLeq_ordLeq_cinfinite that)\n\nlemma countable_leq_natLeq: \\<open>|X| \\<le>o natLeq\\<close> if \\<open>countable X\\<close>\n  using subset_range_from_nat_into[OF that]\n  by (meson card_of_nat ordIso_iff_ordLeq ordLeq_transitive surj_imp_ordLeq)\n\nlemma set_Times_plus_distrib: \\<open>(A \\<times> B) + (C \\<times> D) = (A + C) \\<times> (B + D)\\<close>\n  by (auto simp: Sigma_def set_plus_def)\n\nsubsection \\<open>Not singleton\\<close>\n\nclass not_singleton =\n  assumes not_singleton_card: \"\\<exists>x y. x \\<noteq> y\"\n\nlemma not_singleton_existence[simp]:\n  \\<open>\\<exists> x::('a::not_singleton). x \\<noteq> t\\<close>\n  using not_singleton_card[where ?'a = 'a] by (metis (full_types))\n\nlemma UNIV_not_singleton[simp]: \"(UNIV::_::not_singleton set) \\<noteq> {x}\"\n  using not_singleton_existence[of x] by blast\n\nlemma UNIV_not_singleton_converse: \n  assumes\"\\<And>x::'a. UNIV \\<noteq> {x}\"\n  shows \"\\<exists>x::'a. \\<exists>y. x \\<noteq> y\"\n  using assms\n  by fastforce \n\nsubclass (in card2) not_singleton\n  apply standard using two_le_card\n  by (meson card_2_iff' obtain_subset_with_card_n)\n\nsubclass (in perfect_space) not_singleton\n  apply intro_classes\n  by (metis (mono_tags) Collect_cong Collect_mem_eq UNIV_I local.UNIV_not_singleton local.not_open_singleton local.open_subopen)\n\nlemma class_not_singletonI_monoid_add:\n  assumes \"(UNIV::'a set) \\<noteq> {0}\"\n  shows \"class.not_singleton TYPE('a::monoid_add)\"\nproof intro_classes\n  let ?univ = \"UNIV :: 'a set\"\n  from assms obtain x::'a where \"x \\<noteq> 0\"\n    by auto\n  thus \"\\<exists>x y :: 'a. x \\<noteq> y\"\n    by auto\nqed\n\nlemma not_singleton_vs_CARD_1:\n  assumes \\<open>\\<not> class.not_singleton TYPE('a)\\<close>\n  shows \\<open>class.CARD_1 TYPE('a)\\<close>\n  using assms unfolding class.not_singleton_def class.CARD_1_def\n  by (metis (full_types) One_nat_def UNIV_I card.empty card.insert empty_iff equalityI finite.intros(1) insert_iff subsetI)\n\nsubsection \\<open>\\<^class>\\<open>CARD_1\\<close>\\<close>\n\ncontext CARD_1 begin\n\nlemma everything_the_same[simp]: \"(x::'a)=y\"\n  by (metis (full_types) UNIV_I card_1_singletonE empty_iff insert_iff local.CARD_1)\n\nlemma CARD_1_UNIV: \"UNIV = {x::'a}\"\n  by (metis (full_types) UNIV_I card_1_singletonE local.CARD_1 singletonD)\n\nlemma CARD_1_ext: \"x (a::'a) = y b \\<Longrightarrow> x = y\"\nproof (rule ext)\n  show \"x t = y t\"\n    if \"x a = y b\"\n    for t :: 'a\n    using that  apply (subst (asm) everything_the_same[where x=a])\n    apply (subst (asm) everything_the_same[where x=b])\n    by simp\nqed \n\nend\n\ninstance unit :: CARD_1\n  apply standard by auto\n\ninstance prod :: (CARD_1, CARD_1) CARD_1\n  apply intro_classes\n  by (simp add: CARD_1)\n\ninstance \"fun\" :: (CARD_1, CARD_1) CARD_1\n  apply intro_classes\n  by (auto simp add: card_fun CARD_1)\n\n\nlemma enum_CARD_1: \"(Enum.enum :: 'a::{CARD_1,enum} list) = [a]\"\nproof -\n  let ?enum = \"Enum.enum :: 'a::{CARD_1,enum} list\"\n  have \"length ?enum = 1\"\n    apply (subst card_UNIV_length_enum[symmetric])\n    by (rule CARD_1)\n  then obtain b where \"?enum = [b]\"\n    apply atomize_elim\n    apply (cases ?enum, auto)\n    by (metis length_0_conv length_Cons nat.inject)\n  thus \"?enum = [a]\"\n    by (subst everything_the_same[of _ b], simp)\nqed\n\nlemma card_not_singleton: \\<open>CARD('a::not_singleton) \\<noteq> 1\\<close>\n  by (simp add: card_1_singleton_iff)\n\n\nsubsection \\<open>Topology\\<close>\n\nlemma cauchy_filter_metricI:\n  fixes F :: \"'a::metric_space filter\"\n  assumes \"\\<And>e. e>0 \\<Longrightarrow> \\<exists>P. eventually P F \\<and> (\\<forall>x y. P x \\<and> P y \\<longrightarrow> dist x y < e)\"\n  shows \"cauchy_filter F\"\nproof (unfold cauchy_filter_def le_filter_def, auto)\n  fix P :: \"'a \\<times> 'a \\<Rightarrow> bool\"\n  assume \"eventually P uniformity\"\n  then obtain e where e: \"e > 0\" and P: \"dist x y < e \\<Longrightarrow> P (x, y)\" for x y\n    unfolding eventually_uniformity_metric by auto\n\n  obtain P' where evP': \"eventually P' F\" and P'_dist: \"P' x \\<and> P' y \\<Longrightarrow> dist x y < e\" for x y\n    apply atomize_elim using assms e by auto\n\n  from evP' P'_dist P\n  show \"eventually P (F \\<times>\\<^sub>F F)\"\n    unfolding eventually_uniformity_metric eventually_prod_filter eventually_filtermap by metis\nqed\n\nlemma cauchy_filter_metric_filtermapI:\n  fixes F :: \"'a filter\" and f :: \"'a\\<Rightarrow>'b::metric_space\"\n  assumes \"\\<And>e. e>0 \\<Longrightarrow> \\<exists>P. eventually P F \\<and> (\\<forall>x y. P x \\<and> P y \\<longrightarrow> dist (f x) (f y) < e)\"\n  shows \"cauchy_filter (filtermap f F)\"\nproof (rule cauchy_filter_metricI)\n  fix e :: real assume e: \"e > 0\"\n  with assms obtain P where evP: \"eventually P F\" and dist: \"P x \\<and> P y \\<Longrightarrow> dist (f x) (f y) < e\" for x y\n    by atomize_elim auto\n  define P' where \"P' y = (\\<exists>x. P x \\<and> y = f x)\" for y\n  have \"eventually P' (filtermap f F)\"\n    unfolding eventually_filtermap P'_def \n    using evP\n    by (smt eventually_mono) \n  moreover have \"P' x \\<and> P' y \\<longrightarrow> dist x y < e\" for x y\n    unfolding P'_def using dist by metis\n  ultimately show \"\\<exists>P. eventually P (filtermap f F) \\<and> (\\<forall>x y. P x \\<and> P y \\<longrightarrow> dist x y < e)\"\n    by auto\nqed\n\n\nlemma tendsto_add_const_iff:\n  \\<comment> \\<open>This is a generalization of \\<open>Limits.tendsto_add_const_iff\\<close>, \n      the only difference is that the sort here is more general.\\<close>\n  \"((\\<lambda>x. c + f x :: 'a::topological_group_add) \\<longlongrightarrow> c + d) F \\<longleftrightarrow> (f \\<longlongrightarrow> d) F\"\n  using tendsto_add[OF tendsto_const[of c], of f d]\n    and tendsto_add[OF tendsto_const[of \"-c\"], of \"\\<lambda>x. c + f x\" \"c + d\"] by auto\n\nlemma finite_subsets_at_top_minus: \n  assumes \"A\\<subseteq>B\"\n  shows \"finite_subsets_at_top (B - A) \\<le> filtermap (\\<lambda>F. F - A) (finite_subsets_at_top B)\"\nproof (rule filter_leI)\n  fix P assume \"eventually P (filtermap (\\<lambda>F. F - A) (finite_subsets_at_top B))\"\n  then obtain X where \"finite X\" and \"X \\<subseteq> B\" \n    and P: \"finite Y \\<and> X \\<subseteq> Y \\<and> Y \\<subseteq> B \\<longrightarrow> P (Y - A)\" for Y\n    unfolding eventually_filtermap eventually_finite_subsets_at_top by auto\n\n  hence \"finite (X-A)\" and \"X-A \\<subseteq> B - A\"\n    by auto\n  moreover have \"finite Y \\<and> X-A \\<subseteq> Y \\<and> Y \\<subseteq> B - A \\<longrightarrow> P Y\" for Y\n    using P[where Y=\"Y\\<union>X\"] \\<open>finite X\\<close> \\<open>X \\<subseteq> B\\<close>\n    by (metis Diff_subset Int_Diff Un_Diff finite_Un inf.orderE le_sup_iff sup.orderE sup_ge2)\n  ultimately show \"eventually P (finite_subsets_at_top (B - A))\"\n    unfolding eventually_finite_subsets_at_top by meson\nqed\n\nlemma finite_subsets_at_top_inter: \n  assumes \"A\\<subseteq>B\"\n  shows \"filtermap (\\<lambda>F. F \\<inter> A) (finite_subsets_at_top B) = finite_subsets_at_top A\"\nproof (subst filter_eq_iff, intro allI iffI)\n  fix P :: \"'a set \\<Rightarrow> bool\"\n  assume \"eventually P (finite_subsets_at_top A)\"\n  then show \"eventually P (filtermap (\\<lambda>F. F \\<inter> A) (finite_subsets_at_top B))\"\n    unfolding eventually_filtermap\n    unfolding eventually_finite_subsets_at_top\n    by (metis Int_subset_iff assms finite_Int inf_le2 subset_trans)\nnext\n  fix P :: \"'a set \\<Rightarrow> bool\"\n  assume \"eventually P (filtermap (\\<lambda>F. F \\<inter> A) (finite_subsets_at_top B))\"\n  then obtain X where \\<open>finite X\\<close> \\<open>X \\<subseteq> B\\<close> and P: \\<open>finite Y \\<Longrightarrow> X \\<subseteq> Y \\<Longrightarrow> Y \\<subseteq> B \\<Longrightarrow> P (Y \\<inter> A)\\<close> for Y\n    unfolding eventually_filtermap eventually_finite_subsets_at_top by metis\n  have *: \\<open>finite Y \\<Longrightarrow> X \\<inter> A \\<subseteq> Y \\<Longrightarrow> Y \\<subseteq> A \\<Longrightarrow> P Y\\<close> for Y\n    using P[where Y=\\<open>Y \\<union> (B-A)\\<close>]\n    apply (subgoal_tac \\<open>(Y \\<union> (B - A)) \\<inter> A = Y\\<close>)\n    apply (smt (verit, best) Int_Un_distrib2 Int_Un_eq(4) P Un_subset_iff \\<open>X \\<subseteq> B\\<close> \\<open>finite X\\<close> assms finite_UnI inf.orderE sup_ge2)\n    by auto\n  show \"eventually P (finite_subsets_at_top A)\"\n    unfolding eventually_finite_subsets_at_top\n    apply (rule exI[of _ \\<open>X\\<inter>A\\<close>])\n    by (auto simp: \\<open>finite X\\<close> intro!: *)\nqed\n\nlemma tendsto_principal_singleton:\n  shows \"(f \\<longlongrightarrow> f x) (principal {x})\"\n  unfolding tendsto_def eventually_principal by simp\n\nlemma complete_singleton: \n  \"complete {s::'a::uniform_space}\"\nproof-\n  have \"F \\<le> principal {s} \\<Longrightarrow>\n         F \\<noteq> bot \\<Longrightarrow> cauchy_filter F \\<Longrightarrow> F \\<le> nhds s\" for F\n    by (metis eventually_nhds eventually_principal le_filter_def singletonD)\n  thus ?thesis\n    unfolding complete_uniform\n    by simp\nqed\n\nlemma on_closure_eqI:\n  fixes f g :: \\<open>'a::topological_space \\<Rightarrow> 'b::t2_space\\<close>\n  assumes eq: \\<open>\\<And>x. x \\<in> S \\<Longrightarrow> f x = g x\\<close>\n  assumes xS: \\<open>x \\<in> closure S\\<close>\n  assumes cont: \\<open>continuous_on UNIV f\\<close> \\<open>continuous_on UNIV g\\<close>\n  shows \\<open>f x = g x\\<close>\nproof -\n  define X where \\<open>X = {x. f x = g x}\\<close>\n  have \\<open>closed X\\<close>\n    using cont by (simp add: X_def closed_Collect_eq)\n  moreover have \\<open>S \\<subseteq> X\\<close>\n    by (simp add: X_def eq subsetI)\n  ultimately have \\<open>closure S \\<subseteq> X\\<close>\n    using closure_minimal by blast\n  with xS have \\<open>x \\<in> X\\<close>\n    by auto\n  then show ?thesis\n    using X_def by blast\nqed\n\nlemma on_closure_leI:\n  fixes f g :: \\<open>'a::topological_space \\<Rightarrow> 'b::linorder_topology\\<close>\n  assumes eq: \\<open>\\<And>x. x \\<in> S \\<Longrightarrow> f x \\<le> g x\\<close>\n  assumes xS: \\<open>x \\<in> closure S\\<close>\n  assumes cont: \\<open>continuous_on UNIV f\\<close> \\<open>continuous_on UNIV g\\<close> (* Is \"isCont f x\" \"isCont g x\" sufficient? *)\n  shows \\<open>f x \\<le> g x\\<close>\nproof -\n  define X where \\<open>X = {x. f x \\<le> g x}\\<close>\n  have \\<open>closed X\\<close>\n    using cont by (simp add: X_def closed_Collect_le)\n  moreover have \\<open>S \\<subseteq> X\\<close>\n    by (simp add: X_def eq subsetI)\n  ultimately have \\<open>closure S \\<subseteq> X\\<close>\n    using closure_minimal by blast\n  with xS have \\<open>x \\<in> X\\<close>\n    by auto\n  then show ?thesis\n    using X_def by blast\nqed\n\n\nlemma tendsto_compose_at_within:\n  assumes f: \"(f \\<longlongrightarrow> y) F\" and g: \"(g \\<longlongrightarrow> z) (at y within S)\" \n    and fg: \"eventually (\\<lambda>w. f w = y \\<longrightarrow> g y = z) F\"\n    and fS: \\<open>\\<forall>\\<^sub>F w in F. f w \\<in> S\\<close>\n  shows \"((g \\<circ> f) \\<longlongrightarrow> z) F\"\nproof (cases \\<open>g y = z\\<close>)\n  case False\n  then have 1: \"(\\<forall>\\<^sub>F a in F. f a \\<noteq> y)\"\n    using fg by force\n  have 2: \"(g \\<longlongrightarrow> z) (filtermap f F) \\<or> \\<not> (\\<forall>\\<^sub>F a in F. f a \\<noteq> y)\"\n    by (smt (verit, best) eventually_elim2 f fS filterlim_at filterlim_def g tendsto_mono)\n  show ?thesis\n    using \"1\" \"2\" tendsto_compose_filtermap by blast\nnext\n  case True\n  have *: ?thesis if \\<open>(g \\<longlongrightarrow> z) (filtermap f F)\\<close>\n    using that by (simp add: tendsto_compose_filtermap)\n  from g\n  have \\<open>(g \\<longlongrightarrow> g y) (inf (nhds y) (principal (S-{y})))\\<close>\n    by (simp add: True at_within_def)\n  then have g': \\<open>(g \\<longlongrightarrow> g y) (inf (nhds y) (principal S))\\<close>\n    using True g tendsto_at_iff_tendsto_nhds_within by blast\n  from f have \\<open>filterlim f (nhds y) F\\<close>\n    by -\n  then have f': \\<open>filterlim f (inf (nhds y) (principal S)) F\\<close>\n    using fS\n    by (simp add: filterlim_inf filterlim_principal)\n  from f' g' show ?thesis\n    by (simp add: * True filterlim_compose filterlim_filtermap)\nqed\n\nsubsection \\<open>Sums\\<close>\n\nlemma sum_single: \n  assumes \"finite A\"\n  assumes \"\\<And>j. j \\<noteq> i \\<Longrightarrow> j\\<in>A \\<Longrightarrow> f j = 0\"\n  shows \"sum f A = (if i\\<in>A then f i else 0)\"\n  apply (subst sum.mono_neutral_cong_right[where S=\\<open>A \\<inter> {i}\\<close> and h=f])\n  using assms by auto\n\nlemma has_sum_comm_additive_general: \n  \\<comment> \\<open>This is a strengthening of @{thm [source] has_sum_comm_additive_general}.\\<close>\n  fixes f :: \\<open>'b :: {comm_monoid_add,topological_space} \\<Rightarrow> 'c :: {comm_monoid_add,topological_space}\\<close>\n  assumes f_sum: \\<open>\\<And>F. finite F \\<Longrightarrow> F \\<subseteq> S \\<Longrightarrow> sum (f o g) F = f (sum g F)\\<close>\n      \\<comment> \\<open>Not using \\<^const>\\<open>additive\\<close> because it would add sort constraint \\<^class>\\<open>ab_group_add\\<close>\\<close>\n  assumes inS: \\<open>\\<And>F. finite F \\<Longrightarrow> sum g F \\<in> T\\<close>\n  assumes cont: \\<open>(f \\<longlongrightarrow> f x) (at x within T)\\<close>\n    \\<comment> \\<open>For \\<^class>\\<open>t2_space\\<close> and \\<^term>\\<open>T=UNIV\\<close>, this is equivalent to \\<open>isCont f x\\<close> by @{thm [source] isCont_def}.\\<close>\n  assumes infsum: \\<open>(g has_sum x) S\\<close>\n  shows \\<open>((f o g) has_sum (f x)) S\\<close> \nproof -\n  have \\<open>(sum g \\<longlongrightarrow> x) (finite_subsets_at_top S)\\<close>\n    using infsum has_sum_def by blast\n  then have \\<open>((f o sum g) \\<longlongrightarrow> f x) (finite_subsets_at_top S)\\<close>\n    apply (rule tendsto_compose_at_within[where S=T])\n    using assms by auto\n  then have \\<open>(sum (f o g) \\<longlongrightarrow> f x) (finite_subsets_at_top S)\\<close>\n    apply (rule tendsto_cong[THEN iffD1, rotated])\n    using f_sum by fastforce\n  then show \\<open>((f o g) has_sum (f x)) S\\<close>\n    using has_sum_def by blast \nqed\n\nlemma summable_on_comm_additive_general:\n  \\<comment> \\<open>This is a strengthening of @{thm [source] summable_on_comm_additive_general}.\\<close>\n  fixes g :: \\<open>'a \\<Rightarrow> 'b :: {comm_monoid_add,topological_space}\\<close> and f :: \\<open>'b \\<Rightarrow> 'c :: {comm_monoid_add,topological_space}\\<close>\n  assumes \\<open>\\<And>F. finite F \\<Longrightarrow> F \\<subseteq> S \\<Longrightarrow> sum (f o g) F = f (sum g F)\\<close>\n    \\<comment> \\<open>Not using \\<^const>\\<open>additive\\<close> because it would add sort constraint \\<^class>\\<open>ab_group_add\\<close>\\<close>\n  assumes inS: \\<open>\\<And>F. finite F \\<Longrightarrow> sum g F \\<in> T\\<close>\n  assumes cont: \\<open>\\<And>x. (g has_sum x) S \\<Longrightarrow> (f \\<longlongrightarrow> f x) (at x within T)\\<close>\n    \\<comment> \\<open>For \\<^class>\\<open>t2_space\\<close> and \\<^term>\\<open>T=UNIV\\<close>, this is equivalent to \\<open>isCont f x\\<close> by @{thm [source] isCont_def}.\\<close>\n  assumes \\<open>g summable_on S\\<close>\n  shows \\<open>(f o g) summable_on S\\<close>\n  by (meson assms summable_on_def has_sum_comm_additive_general has_sum_def infsum_tendsto)\n\nlemma has_sum_metric:\n  fixes l :: \\<open>'a :: {metric_space, comm_monoid_add}\\<close>\n  shows \\<open>(f has_sum l) A \\<longleftrightarrow> (\\<forall>e. e > 0 \\<longrightarrow> (\\<exists>X. finite X \\<and> X \\<subseteq> A \\<and> (\\<forall>Y. finite Y \\<and> X \\<subseteq> Y \\<and> Y \\<subseteq> A \\<longrightarrow> dist (sum f Y) l < e)))\\<close>\n  unfolding has_sum_def\n  apply (subst tendsto_iff)\n  unfolding eventually_finite_subsets_at_top\n  by simp\n\nlemma summable_on_product_finite_left:\n  fixes f :: \\<open>'a\\<times>'b \\<Rightarrow> 'c::{topological_comm_monoid_add}\\<close>\n  assumes sum: \\<open>\\<And>x. x\\<in>X \\<Longrightarrow> (\\<lambda>y. f(x,y)) summable_on Y\\<close>\n  assumes \\<open>finite X\\<close>\n  shows \\<open>f summable_on (X\\<times>Y)\\<close>\n  using \\<open>finite X\\<close> subset_refl[of X]\nproof (induction rule: finite_subset_induct')\n  case empty\n  then show ?case\n    by simp\nnext\n  case (insert x F)\n  have *: \\<open>bij_betw (Pair x) Y ({x} \\<times> Y)\\<close>\n    apply (rule bij_betwI')\n    by auto\n  from sum[of x]\n  have \\<open>f summable_on {x} \\<times> Y\\<close>\n    apply (rule summable_on_reindex_bij_betw[THEN iffD1, rotated])\n    by (simp_all add: * insert.hyps(2))\n  then have \\<open>f summable_on {x} \\<times> Y \\<union> F \\<times> Y\\<close>\n    apply (rule summable_on_Un_disjoint)\n    using insert by auto\n  then show ?case\n    by (metis Sigma_Un_distrib1 insert_is_Un)\nqed\n\nlemma summable_on_product_finite_right:\n  fixes f :: \\<open>'a\\<times>'b \\<Rightarrow> 'c::{topological_comm_monoid_add}\\<close>\n  assumes sum: \\<open>\\<And>y. y\\<in>Y \\<Longrightarrow> (\\<lambda>x. f(x,y)) summable_on X\\<close>\n  assumes \\<open>finite Y\\<close>\n  shows \\<open>f summable_on (X\\<times>Y)\\<close>\nproof -\n  have \\<open>(\\<lambda>(y,x). f(x,y)) summable_on (Y\\<times>X)\\<close>\n    apply (rule summable_on_product_finite_left)\n    using assms by auto\n  then show ?thesis\n    apply (subst summable_on_reindex_bij_betw[where g=prod.swap and A=\\<open>Y\\<times>X\\<close>, symmetric])\n    apply (simp add: bij_betw_def product_swap)\n    by (metis (mono_tags, lifting) case_prod_unfold prod.swap_def summable_on_cong)\nqed\n\nsubsection \\<open>Complex numbers\\<close>\n\nlemma cmod_Re:\n  assumes \"x \\<ge> 0\"\n  shows \"cmod x = Re x\"\n  using assms unfolding less_eq_complex_def cmod_def\n  by auto\n\nlemma abs_complex_real[simp]: \"abs x \\<in> \\<real>\" for x :: complex\n  by (simp add: abs_complex_def)\n\nlemma Im_abs[simp]: \"Im (abs x) = 0\"\n  using abs_complex_real complex_is_Real_iff by blast\n\n\nlemma cnj_x_x: \"cnj x * x = (abs x)\\<^sup>2\"\nproof (cases x)\n  show \"cnj x * x = \\<bar>x\\<bar>\\<^sup>2\"\n    if \"x = Complex x1 x2\"\n    for x1 :: real\n      and x2 :: real\n    using that\n    by (auto simp: complex_cnj complex_mult abs_complex_def\n        complex_norm power2_eq_square complex_of_real_def)\nqed\n\nlemma cnj_x_x_geq0[simp]: \\<open>cnj x * x \\<ge> 0\\<close>\n  by (simp add: less_eq_complex_def)\n\nlemma complex_of_real_leq_1_iff[iff]: \\<open>complex_of_real x \\<le> 1 \\<longleftrightarrow> x \\<le> 1\\<close>\n  by (simp add: less_eq_complex_def)\n\nlemma x_cnj_x: \\<open>x * cnj x = (abs x)\\<^sup>2\\<close>\n  by (metis cnj_x_x mult.commute)\n\nsubsection \\<open>List indices and enum\\<close>\n\nfun index_of where\n  \"index_of x [] = (0::nat)\"\n| \"index_of x (y#ys) = (if x=y then 0 else (index_of x ys + 1))\"\n\ndefinition \"enum_idx (x::'a::enum) = index_of x (enum_class.enum :: 'a list)\"\n\nlemma index_of_length: \"index_of x y \\<le> length y\"\n  apply (induction y) by auto\n\nlemma index_of_correct:\n  assumes \"x \\<in> set y\"\n  shows \"y ! index_of x y = x\"\n  using assms apply (induction y arbitrary: x)\n  by auto\n\nlemma enum_idx_correct: \n  \"Enum.enum ! enum_idx i = i\"\nproof-\n  have \"i \\<in> set enum_class.enum\"\n    using UNIV_enum by blast \n  thus ?thesis\n    unfolding enum_idx_def\n    using index_of_correct by metis\nqed\n\nlemma index_of_bound: \n  assumes \"y \\<noteq> []\" and \"x \\<in> set y\"\n  shows \"index_of x y < length y\"\n  using assms proof(induction y arbitrary: x)\n  case Nil\n  thus ?case by auto\nnext\n  case (Cons a y)\n  show ?case \n  proof(cases \"a = x\")\n    case True\n    thus ?thesis by auto\n  next\n    case False\n    moreover have \"a \\<noteq> x \\<Longrightarrow> index_of x y < length y\"\n      using Cons.IH Cons.prems(2) by fastforce      \n    ultimately show ?thesis by auto\n  qed\nqed\n\nlemma enum_idx_bound: \"enum_idx x < length (Enum.enum :: 'a list)\" for x :: \"'a::enum\"\nproof-\n  have p1: \"False\"\n    if \"(Enum.enum :: 'a list) = []\"\n  proof-\n    have \"(UNIV::'a set) = set ([]::'a list)\"\n      using that UNIV_enum by metis\n    also have \"\\<dots> = {}\"\n      by blast\n    finally have \"(UNIV::'a set) = {}\".\n    thus ?thesis by simp\n  qed    \n  have p2: \"x \\<in> set (Enum.enum :: 'a list)\"\n    using UNIV_enum by auto\n  moreover have \"(enum_class.enum::'a list) \\<noteq> []\"\n    using p2 by auto\n  ultimately show ?thesis\n    unfolding enum_idx_def     \n    using index_of_bound [where x = x and y = \"(Enum.enum :: 'a list)\"]\n    by auto   \nqed\n\nlemma index_of_nth:\n  assumes \"distinct xs\"\n  assumes \"i < length xs\"\n  shows \"index_of (xs ! i) xs = i\"\n  using assms\n  by (metis gr_implies_not_zero index_of_bound index_of_correct length_0_conv nth_eq_iff_index_eq nth_mem)\n\nlemma enum_idx_enum: \n  assumes \\<open>i < CARD('a::enum)\\<close>\n  shows \\<open>enum_idx (enum_class.enum ! i :: 'a) = i\\<close>\n  unfolding enum_idx_def apply (rule index_of_nth)\n  using assms by (simp_all add: card_UNIV_length_enum enum_distinct)\n\nsubsection \\<open>Filtering lists/sets\\<close>\n\nlemma map_filter_map: \"List.map_filter f (map g l) = List.map_filter (f o g) l\"\nproof (induction l)\n  show \"List.map_filter f (map g []) = List.map_filter (f \\<circ> g) []\"\n    by (simp add: map_filter_simps)\n  show \"List.map_filter f (map g (a # l)) = List.map_filter (f \\<circ> g) (a # l)\"\n    if \"List.map_filter f (map g l) = List.map_filter (f \\<circ> g) l\"\n    for a :: 'c\n      and l :: \"'c list\"\n    using that  map_filter_simps(1)\n    by (metis comp_eq_dest_lhs list.simps(9))\nqed\n\nlemma map_filter_Some[simp]: \"List.map_filter (\\<lambda>x. Some (f x)) l = map f l\"\nproof (induction l)\n  show \"List.map_filter (\\<lambda>x. Some (f x)) [] = map f []\"\n    by (simp add: map_filter_simps)\n  show \"List.map_filter (\\<lambda>x. Some (f x)) (a # l) = map f (a # l)\"\n    if \"List.map_filter (\\<lambda>x. Some (f x)) l = map f l\"\n    for a :: 'b\n      and l :: \"'b list\"\n    using that by (simp add: map_filter_simps(1))\nqed\n\nlemma filter_Un: \"Set.filter f (x \\<union> y) = Set.filter f x \\<union> Set.filter f y\"\n  unfolding Set.filter_def by auto  \n\nlemma Set_filter_unchanged: \"Set.filter P X = X\" if \"\\<And>x. x\\<in>X \\<Longrightarrow> P x\" for P and X :: \"'z set\"\n  using that unfolding Set.filter_def by auto\n\nsubsection \\<open>Maps\\<close>\n\ndefinition \"inj_map \\<pi> = (\\<forall>x y. \\<pi> x = \\<pi> y \\<and> \\<pi> x \\<noteq> None \\<longrightarrow> x = y)\"\n\ndefinition \"inv_map \\<pi> = (\\<lambda>y. if Some y \\<in> range \\<pi> then Some (inv \\<pi> (Some y)) else None)\"\n\nlemma inj_map_total[simp]: \"inj_map (Some o \\<pi>) = inj \\<pi>\"\n  unfolding inj_map_def inj_def by simp\n\nlemma inj_map_Some[simp]: \"inj_map Some\"\n  by (simp add: inj_map_def)\n\nlemma inv_map_total: \n  assumes \"surj \\<pi>\"\n  shows \"inv_map (Some o \\<pi>) = Some o inv \\<pi>\"\nproof-\n  have \"(if Some y \\<in> range (\\<lambda>x. Some (\\<pi> x))\n          then Some (SOME x. Some (\\<pi> x) = Some y)\n          else None) =\n         Some (SOME b. \\<pi> b = y)\"\n    if \"surj \\<pi>\"\n    for y\n    using that by auto\n  hence  \"surj \\<pi> \\<Longrightarrow>\n    (\\<lambda>y. if Some y \\<in> range (\\<lambda>x. Some (\\<pi> x))\n         then Some (SOME x. Some (\\<pi> x) = Some y) else None) =\n    (\\<lambda>x. Some (SOME xa. \\<pi> xa = x))\"\n    by (rule ext) \n  thus ?thesis \n    unfolding inv_map_def o_def inv_def\n    using assms by linarith\nqed\n\nlemma inj_map_map_comp[simp]: \n  assumes a1: \"inj_map f\" and a2: \"inj_map g\" \n  shows \"inj_map (f \\<circ>\\<^sub>m g)\"\n  using a1 a2\n  unfolding inj_map_def\n  by (metis (mono_tags, lifting) map_comp_def option.case_eq_if option.expand)\n\nlemma inj_map_inv_map[simp]: \"inj_map (inv_map \\<pi>)\"\nproof (unfold inj_map_def, rule allI, rule allI, rule impI, erule conjE)\n  fix x y\n  assume same: \"inv_map \\<pi> x = inv_map \\<pi> y\"\n    and pix_not_None: \"inv_map \\<pi> x \\<noteq> None\"\n  have x_pi: \"Some x \\<in> range \\<pi>\" \n    using pix_not_None unfolding inv_map_def apply auto\n    by (meson option.distinct(1))\n  have y_pi: \"Some y \\<in> range \\<pi>\" \n    using pix_not_None unfolding same unfolding inv_map_def apply auto\n    by (meson option.distinct(1))\n  have \"inv_map \\<pi> x = Some (Hilbert_Choice.inv \\<pi> (Some x))\"\n    unfolding inv_map_def using x_pi by simp\n  moreover have \"inv_map \\<pi> y = Some (Hilbert_Choice.inv \\<pi> (Some y))\"\n    unfolding inv_map_def using y_pi by simp\n  ultimately have \"Hilbert_Choice.inv \\<pi> (Some x) = Hilbert_Choice.inv \\<pi> (Some y)\"\n    using same by simp\n  thus \"x = y\"\n    by (meson inv_into_injective option.inject x_pi y_pi)\nqed\n\nsubsection \\<open>Lattices\\<close>\n\nunbundle lattice_syntax\n\ntext \\<open>The following lemma is identical to @{thm [source] Complete_Lattices.uminus_Inf} \n  except for the more general sort.\\<close>\nlemma uminus_Inf: \"- (\\<Sqinter>A) = \\<Squnion>(uminus ` A)\" for A :: \\<open>'a::complete_orthocomplemented_lattice set\\<close>\nproof (rule order.antisym)\n  show \"- \\<Sqinter>A \\<le> \\<Squnion>(uminus ` A)\"\n    by (rule compl_le_swap2, rule Inf_greatest, rule compl_le_swap2, rule Sup_upper) simp\n  show \"\\<Squnion>(uminus ` A) \\<le> - \\<Sqinter>A\"\n    by (rule Sup_least, rule compl_le_swap1, rule Inf_lower) auto\nqed\n\ntext \\<open>The following lemma is identical to @{thm [source] Complete_Lattices.uminus_INF}\n  except for the more general sort.\\<close>\nlemma uminus_INF: \"- (INF x\\<in>A. B x) = (SUP x\\<in>A. - B x)\" for B :: \\<open>'a \\<Rightarrow> 'b::complete_orthocomplemented_lattice\\<close>\n  by (simp add: uminus_Inf image_image)\n\ntext \\<open>The following lemma is identical to @{thm [source] Complete_Lattices.uminus_Sup}\n  except for the more general sort.\\<close>\nlemma uminus_Sup: \"- (\\<Squnion>A) = \\<Sqinter>(uminus ` A)\" for A :: \\<open>'a::complete_orthocomplemented_lattice set\\<close>\n  by (metis (no_types, lifting) uminus_INF image_cong image_ident ortho_involution)\n\ntext \\<open>The following lemma is identical to @{thm [source] Complete_Lattices.uminus_SUP}\n  except for the more general sort.\\<close>\nlemma uminus_SUP: \"- (SUP x\\<in>A. B x) = (INF x\\<in>A. - B x)\" for B :: \\<open>'a \\<Rightarrow> 'b::complete_orthocomplemented_lattice\\<close>\n  by (simp add: uminus_Sup image_image)\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Complex_Bounded_Operators/extra/Extra_General.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.658417500561683, "lm_q1q2_score": 0.34462911788977846}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory HaskellLemmaBucket\nimports\n  HaskellLib_H\n  NonDetMonadLemmaBucket\nbegin\n\nlemma map_bits_to_bl:\n  \"map ((!!) x) [0..<size x] = reverse (to_bl x)\"\n  by (simp add: map_bits_rev_to_bl)\n\nlemma not_orList_is_replicate:\n  \"\\<not> orList ls \\<Longrightarrow> ls = replicate (length ls) False\"\nproof (induct ls rule: rev_induct)\n  case Nil thus ?case unfolding orList_def by simp\nnext\n  case (snoc l ls)\n\n  from snoc.prems have ol: \"\\<not> orList ls\" and nl: \"\\<not> l\" unfolding orList_def by auto\n  have \"ls = replicate (length ls) False\" by (rule snoc.hyps [OF ol])\n  thus ?case\n    by (rule ssubst) (simp add: nl replicate_app_Cons_same [where xs = \"[]\", simplified])\nqed\n\nlemma andList_Cons:\n  assumes al: \"andList $ map P (y # ys)\"\n  shows   \"P y\"\n  using al unfolding andList_def\n  by simp (induct rule: rev_induct, simp+)\n\nlemma andList_mapE:\n  assumes al: \"andList $ map P xs\"\n  and     xv: \"x \\<in> set xs\"\n  shows   \"P x\"\n  using al xv\nproof (induct xs arbitrary: x rule: rev_induct)\n  case Nil thus ?case by simp\nnext\n  case (snoc y ys)\n\n  show ?case\n  proof (cases \"x = y\")\n    case True\n    with snoc.prems show ?thesis by (simp add: andList_def)\n  next\n    case False\n    with snoc.prems show ?thesis\n      by (auto simp: andList_def intro!: snoc.hyps)\n  qed\nqed\n\nlemma andList_to_aligned:\n  assumes al: \"andList $ map (\\<lambda>x. x && mask pageBits = 0) xs\"\n  and     xv: \"x \\<in> set xs\"\n  shows   \"is_aligned x pageBits\"\nproof (subst is_aligned_mask)\n  from al show \"x && mask pageBits = 0\" by (rule andList_mapE) fact\nqed\n\n(* minimum/maximum *)\n\nlemma maximum_ge: \"x \\<in> set b \\<Longrightarrow> x \\<le> maximum b\"\n  unfolding maximum_def by (auto intro: Max_ge)\n\nlemma less_minimum_not_in:\n  \"\\<lbrakk> ls \\<noteq> []; x < minimum ls \\<rbrakk> \\<Longrightarrow> x \\<notin> set ls\"\n  unfolding minimum_def by auto\n\nlemma minimum_le_member:\n  \"\\<lbrakk> x \\<in> set ls; ls \\<noteq> []\\<rbrakk> \\<Longrightarrow> minimum ls \\<le> x\"\n  unfolding minimum_def\n  apply (rule Min_le)\n    apply simp\n   apply simp\n  done\n\nlemma minimum_map_distrib:\n  fixes f :: \"('a :: linorder) \\<Rightarrow> 'a\" and ls :: \"'a list\"\n  assumes minf: \"\\<And>x y. \\<lbrakk>x \\<in> set ls; y \\<in> set ls\\<rbrakk> \\<Longrightarrow> min (f x) (f y) = f (min x y)\"\n  and      lsn: \"ls \\<noteq> []\"\n  shows \"minimum (map f ls) = f (minimum ls)\"\n  unfolding minimum_def\n  apply simp\n  apply (rule Min_image_distrib)\n    apply (erule (1) minf)\n   apply simp\n  apply (simp add: lsn)\n  done\n\nlemma minimum_enum_upto:\n  fixes x :: \"'a::len word\"\n  assumes le: \"x \\<le> y\"\n  shows   \"minimum [x .e. y] = x\"\n  unfolding minimum_def using le by (auto intro!: MinI)\n\nlemma break_subsetsD:\n  \"break f xs = (ys, zs) \\<Longrightarrow> set ys \\<subseteq> set xs \\<and> set zs \\<subseteq> set xs\"\n  apply (induct xs arbitrary: ys zs)\n   apply simp\n  apply (case_tac \"break f xs\")\n  apply (elim meta_allE, drule(1) meta_mp)\n  apply (fastforce simp: split_def split: if_split_asm)\n  done\n\nlemma distinct_prop_breakD:\n  \"\\<lbrakk> distinct_prop P xs; break f xs = (ys, zs) \\<rbrakk>\n    \\<Longrightarrow> \\<forall>y \\<in> set ys. \\<forall>z \\<in> set zs. P y z\"\n  apply (induct xs arbitrary: ys zs)\n   apply simp\n  apply (simp add: split_def split: if_split_asm)\n  apply (case_tac \"break f xs\")\n  apply (elim meta_allE, drule(1) meta_mp)\n  apply (frule break_subsetsD)\n  apply fastforce\n  done\n\nlemma stateAssert_wp:\n  \"\\<lbrace>\\<lambda>s. P s \\<longrightarrow> Q () s\\<rbrace> stateAssert P e \\<lbrace>Q\\<rbrace>\"\n  by (clarsimp simp: stateAssert_def) wp\n\nlemma empty_fail_stateAssert[intro!, simp]:\n  \"empty_fail (stateAssert P l)\"\n  unfolding stateAssert_def by simp\n\nlemma haskell_assert_wp:\n  \"\\<lbrace>\\<lambda>s. Q \\<longrightarrow> P s\\<rbrace> haskell_assert Q xs \\<lbrace>\\<lambda>_. P\\<rbrace>\"\n  by simp wp\n\nlemma init_append_last:\n  \"xs \\<noteq> [] \\<Longrightarrow> init xs @ [last xs] = xs\"\n  apply (induct xs rule: rev_induct)\n   apply simp\n  apply (simp add: init_def)\n  done\n\nlemma init_Snoc[simp]:\n  \"init (xs @ [x]) = xs\"\n  by (induct xs) (auto simp: init_def)\n\nlemma init_upto_enum_upt[simp]:\n  \"init [0.e.n] = [0..<n]\"\n  by (induct n) (auto simp: init_def)\n\nlemma no_fail_stateAssert:\n  \"no_fail P (stateAssert P xs)\"\n  apply (simp add: stateAssert_def)\n  apply (rule no_fail_pre, wp no_fail_bind)\n  apply simp\n  done\n\nlemma haskell_fail_wp:\n  \"\\<lbrace>\\<top>\\<rbrace> haskell_fail x \\<lbrace>P\\<rbrace>\"\n  by simp\n\nlemma no_fail_haskell_fail [simp, wp]:\n  \"no_fail \\<bottom> (haskell_fail xs)\"\n  by simp\n\nlemma in_assocs_is_fun:\n  \"(x \\<in> set (assocs f)) = (f (fst x) = snd x)\"\n  by (cases x) (auto simp add: assocs_def)\n\nlemma fun_is_in_assocs:\n  \"(f x = y) = ((x,y) \\<in> set (assocs f))\"\n  by (simp add: in_assocs_is_fun)\n\nlemma empty_set_is_null:\n  \"(set xs = {}) = null xs\"\n  by (clarsimp simp: null_def)\n\nlemma assert_into_when:\n  \"(assert P) = (when (\\<not> P) (haskell_fail []))\"\n  by (simp add: assert_def when_def)\n\nlemma const_apply:\n  \"const x y = x\"\n  by (simp add: const_def)\n\nlemma const_None_empty:\n  \"const None = Map.empty\"\n  by (rule ext, simp add: const_apply)\n\nlemma headM_tailM_Cons:\n  \"headM (x # xs) = return x\"\n  \"tailM (x # xs) = return xs\"\n  by (simp add: headM_def tailM_def)+\n\nlemma replicateM_mapM:\n  \"replicateM n f = mapM (\\<lambda>x. f) (replicate n ())\"\n  by (simp add: replicateM_def mapM_def)\n\nlemma orList_False:\n  \"(\\<not> orList bs) = (set bs \\<subseteq> {False})\"\n  apply (induct bs)\n  apply (simp_all add: orList_def foldl_True)\n  apply (case_tac a)\n  apply (simp_all add: orList_def foldl_True)\n  done\n\nlemma Cons_eq_tails:\n  \"((xs # xxs) = tails ys) = (ys = xs \\<and> xxs = tl (tails ys))\"\n  by (case_tac ys, auto)\n\nlemma findM_on_outcome':\n  assumes x: \"\\<And>x xs. \\<lbrace>\\<lambda>s. Q None s \\<and> x \\<in> fn s \\<and> set xs \\<subseteq> fn s\\<rbrace> f x\n                     \\<lbrace>\\<lambda>rv s. (rv \\<longrightarrow> Q (Some x) s) \\<and> (\\<not> rv \\<longrightarrow> Q None s \\<and> set xs \\<subseteq> fn s)\\<rbrace>\"\n  shows      \"\\<lbrace>\\<lambda>s. Q None s \\<and> set xs \\<subseteq> fn s\\<rbrace> findM f xs \\<lbrace>Q\\<rbrace>\"\n  apply (induct xs)\n   apply (simp, wp)\n  apply (simp, wp)\n   apply (rule x)\n  apply simp\n  done\n\n\nlemma findM_on_outcome:\n  assumes x: \"\\<And>x ys. x \\<in> set xs \\<Longrightarrow> \\<lbrace>Q None and I\\<rbrace> f x \\<lbrace>\\<lambda>rv s. (rv \\<longrightarrow> Q (Some x) s) \\<and> (\\<not> rv \\<longrightarrow> Q None s \\<and> I s)\\<rbrace>\"\n  shows      \"\\<lbrace>Q None and I\\<rbrace> findM f xs \\<lbrace>Q\\<rbrace>\"\n  apply (rule hoare_vcg_precond_imp)\n   apply (rule findM_on_outcome' [where fn=\"\\<lambda>s. if I s then set xs else {}\"])\n   apply (case_tac \"x \\<notin> set xs\")\n    apply simp\n   apply (simp cong: rev_conj_cong)\n   apply (case_tac \"\\<not> set xsa \\<subseteq> set xs\")\n    apply simp\n   apply simp\n   apply (rule hoare_vcg_precond_imp)\n    apply (rule hoare_post_imp [OF _ x])\n     apply clarsimp\n    apply assumption\n   apply simp\n  apply simp\n  done\n\nlemma in_set_tailsD: \"xs \\<in> set (tails ys) \\<Longrightarrow> set xs \\<subseteq> set ys\"\n  apply (induct ys)\n   apply simp\n  apply simp\n  apply (erule disjE)\n   apply simp\n  apply simp\n  apply blast\n  done\n\nlemma notin_set_tails_set:\n  \"x \\<notin> set xs \\<Longrightarrow> \\<forall>xs' \\<in> set (tails xs). \\<forall>x' \\<in> set xs'. x \\<noteq> x'\"\n  by (fastforce dest!: in_set_tailsD)\n\nlemma set_tails_set: \"(set (tails v) \\<subseteq> {x. set x \\<subseteq> S}) = (set v \\<subseteq> S)\"\n  apply (induct v, simp_all)\n  done\n\nlemma filter_assocs_Cons:\n  fixes v :: \"('a :: len) word\" shows\n  \"\\<lbrakk> f (v, g v); \\<forall>x < v. \\<not> f (x, g x) \\<rbrakk> \\<Longrightarrow>\n     filter f (assocs g) = (v, g v) # tl (filter f (assocs g))\"\n  apply (simp add: assocs_def)\n  apply (cut_tac v=v in enum_word_div)\n  apply clarsimp\n  apply (subst map_cong [OF _ refl], assumption)+\n  apply (simp(no_asm))\n  apply simp\n  done\n\nlemmas stateAssert_def = stateAssert_def[unfolded state_assert_def]\n\nlemma snd_stateAssert_after:\n  \"\\<not> snd ((do _ \\<leftarrow> f; stateAssert R vs od) s) \\<Longrightarrow>\n  \\<not>snd (f s) \\<and> (\\<forall>(rv, s') \\<in> fst (f s). R s')\"\n  apply (clarsimp simp: bind_def stateAssert_def get_def assert_def\n      return_def fail_def split_def split: if_split_asm)\n  done\n\nlemma oblivious_stateAssert [simp]:\n  \"oblivious f (stateAssert g xs) = (\\<forall>s. g (f s) = g s)\"\n  apply (simp add: oblivious_def stateAssert_def exec_get\n                   assert_def return_def fail_def split: if_split)\n  apply auto\n  done\n\nlemma stateAssert_def2:\n  \"stateAssert f xs = do v \\<leftarrow> gets f; if v then return () else fail od\"\n  by (simp add: stateAssert_def gets_def assert_def)\n\nlemma findM_is_mapME:\n  \"(findM f xs >>= g)\n   = liftM (\\<lambda>_. ())\n      (doE ys \\<leftarrow> mapME_x (\\<lambda>x. do v \\<leftarrow> f x;\n                             if v then do g (Some x); throwError () od\n                             else returnOk () od) xs;\n              liftE (g None) odE)\"\n  apply (induct xs)\n   apply (simp add: mapME_x_def sequenceE_x_def liftM_def returnOk_bind)\n   apply (simp add: liftE_def)\n  apply (simp add: mapME_x_Cons bindE_assoc liftE_bindE[symmetric]\n                   liftM_def cong: if_cong)\n  apply (simp add: liftE_bindE bind_assoc)\n  apply (rule bind_cong[OF refl])\n  apply (simp add: bindE_assoc split: if_split)\n  apply (simp add: liftE_bindE bind_assoc throwError_bind)\n  done\n\n\n(* FIXME word_eqI: move up *)\nadd_try_method word_eqI_solve\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/HaskellLemmaBucket.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.34455971010999603}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * Verifying quicksort implementation using AutoCorres!\n *)\ntheory Quicksort\nimports\n  \"../../AutoCorres\"\n  \"~~/src/HOL/Library/Multiset\"\nbegin\n\ndeclare validNF_whileLoop_inv_measure_twosteps [wp]\ndeclare validNF_whileLoopE_inv_measure_twosteps [wp]\n\ndeclare creturn_def [vcg_simp]\n\ninstall_C_file \"quicksort.c\"\nautocorres \"quicksort.c\"\n\ncontext quicksort begin\n\nthm partition_body_def\nthm quicksort_body_def\n\nthm partition'_def\nthm quicksort'.simps\n\n\n(* Some rules for pointer addition *)\n\n(* FIXME: move *)\nlemma ptr_add_assoc [simp]:\n  \"p +\\<^sub>p (i + j) = p +\\<^sub>p i +\\<^sub>p j\"\n  by (simp add: CTypesDefs.ptr_add_def distrib_right)\n\n(* FIXME: move *)\nlemma ptr_add_commute [simp]:\n  \"p +\\<^sub>p i +\\<^sub>p j = p +\\<^sub>p j +\\<^sub>p i\"\n  by (metis ptr_add_assoc add.commute)\n\n\n(*\n * Array validity definitions\n *)\n\ndefinition\n  array_loc_valid :: \"word32 ptr \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"array_loc_valid a n \\<equiv>\n   (unat (ptr_val a) + size_of TYPE(word32) * n \\<le> 2 ^ len_of TYPE(32))\"\n\nfun\n  array_elems_valid :: \"lifted_globals \\<Rightarrow> word32 ptr \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"array_elems_valid s a 0 = True\" |\n  \"array_elems_valid s a (Suc n) = (is_valid_w32 s a \\<and> array_elems_valid s (a +\\<^sub>p 1) n)\"\n\nlemma array_all_elems_valid:\n  (* equivalent characterisation of array validity *)\n  \"array_elems_valid s a n = (\\<forall>m. m < n \\<longrightarrow> is_valid_w32 s (a +\\<^sub>p int m))\"\n  apply (induct n arbitrary: a)\n   apply simp\n  apply (case_tac \"n = 0\")\n   apply simp\n  apply (rule iffI)\n   apply clarsimp\n   apply (case_tac \"m = 0\")\n    apply simp\n   apply (case_tac \"m = n\")\n    apply clarsimp\n    apply (drule_tac x = \"n - 1\" in spec)\n    apply (simp add: CTypesDefs.ptr_add_def)\n   apply (drule_tac x = \"m - 1\" in spec)\n   apply (simp add: CTypesDefs.ptr_add_def)\n  apply simp\n  apply (frule_tac x = \"0\" in spec)\n  apply clarsimp\n  apply (frule_tac x = \"m + 1\" in spec)\n  apply simp\n  done\n\ndefinition\n  is_array :: \"lifted_globals \\<Rightarrow> word32 ptr \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"is_array s a n \\<equiv> (array_loc_valid a n \\<and> array_elems_valid s a n)\"\n\n(* Necessary condition for many pointer comparison lemmas *)\ndefinition array_not_at_mem_end :: \"word32 ptr \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"array_not_at_mem_end a n \\<equiv>\n   (unat (ptr_val a) + size_of TYPE(word32) * n < 2 ^ len_of TYPE(32))\"\n  (* same as \"array_loc_valid a n\" but excluding equality *)\n\n\n(* Some obvious but useful corollaries *)\n\nlemma array_valid_elem:\n  \"\\<lbrakk> is_array s a n; m < n \\<rbrakk> \\<Longrightarrow> is_valid_w32 s (a +\\<^sub>p int m)\"\n  by (metis is_array_def array_all_elems_valid)\n\nlemma array_valid_elem2:\n  \"\\<lbrakk> is_array s a (unat n); m < n \\<rbrakk> \\<Longrightarrow> is_valid_w32 s (a +\\<^sub>p uint m)\"\n  by (metis array_valid_elem uint_nat word_less_nat_alt)\n\nlemma empty_array_is_array:\n  \"is_array s a 0\"\n  apply (insert unat_lt2p[of \"ptr_val a\"])\n  apply (simp add: is_array_def array_loc_valid_def)\n  done\n\nlemma empty_array_not_at_mem_end:\n  \"array_not_at_mem_end a 0\"\n  apply (insert unat_lt2p[of \"ptr_val a\"])\n  apply (simp add: array_not_at_mem_end_def)\n  done\n\nlemma subarray_not_at_mem_end1:\n  \"\\<lbrakk> array_loc_valid a n; m < n \\<rbrakk> \\<Longrightarrow> array_not_at_mem_end a m\"\n  by (simp add: array_loc_valid_def array_not_at_mem_end_def)\n\nlemma subarray_not_at_mem_end2:\n  \"\\<lbrakk> is_array s a n; m < n \\<rbrakk> \\<Longrightarrow> array_not_at_mem_end a m\"\n  by (clarsimp simp: is_array_def subarray_not_at_mem_end1)\n\nlemma updated_array_elems_valid [simp]:\n  \"array_elems_valid (heap_w32_update f s) a n = array_elems_valid s a n\"\n  by (induct n arbitrary: a, auto)\n\nlemma updated_array_is_array [simp]:\n  \"is_array (heap_w32_update f s) a n = is_array s a n\"\n  by (simp add: is_array_def)\n\n\n(* Some word arithmetic *)\n\n(* FIXME: move *)\nlemma unat_plus_weak:\n  \"(x::word32) \\<le> x + y \\<Longrightarrow> unat (x + y) = unat x + unat y\"\n  by (simp add: unat_plus_simple)\n\n(* FIXME: move *)\nlemma unat_mult_weak:\n  \"unat (x::word32) * unat y < 2 ^ len_of TYPE(32) \\<Longrightarrow>\n   unat (x * y) = unat x * unat y\"\n  by (simp add: unat_mult_lem[symmetric])\n\nlemma unat_linear_over_array_loc:\n  \"array_not_at_mem_end a n \\<Longrightarrow>\n   unat (ptr_val a + of_nat (size_of TYPE(word32)) * (of_nat n)) =\n   unat (ptr_val a) + size_of TYPE(word32) * n\"\n  apply (simp add: array_not_at_mem_end_def)\n  apply (subgoal_tac \"unat (4 * (of_nat n)) = 4 * n\")\n   apply (subst unat_plus_weak)\n    apply (subst no_olen_add_nat)\n    apply (rule_tac s = \"4 * n\" and t = \"unat (4 * of_nat n)\" in subst)\n     apply (erule sym)\n    apply simp+\n  apply (simp add: unat_mult_weak unat_of_nat_eq)\n  done\n\nlemma unat_linear_over_array_loc2:\n  \"array_not_at_mem_end a n \\<Longrightarrow>\n   unat (ptr_val a + 4 * (of_nat n)) = unat (ptr_val a) + 4 * n\"\n  by (frule unat_linear_over_array_loc, simp)\n\n\n(* Pointer inequalities *)\n\nlemma array_no_wrap:\n  \"\\<lbrakk> array_loc_valid a n; m < n \\<rbrakk> \\<Longrightarrow> a \\<le> a +\\<^sub>p int m\"\n  apply (clarsimp simp: array_loc_valid_def CTypesDefs.ptr_add_def\n                        ptr_le_def' ptr_le_def)\n  apply (subst no_olen_add_nat)\n  apply (subst unat_mult_weak)\n   apply (subst unat_of_nat_eq, simp+)+\n  done\n\nlemma array_no_wrap2:\n  \"\\<lbrakk> array_loc_valid a (unat n); m < n \\<rbrakk> \\<Longrightarrow> a \\<le> a +\\<^sub>p uint m\"\n  by (metis array_no_wrap uint_nat word_less_nat_alt)\n\nlemma array_loc_mono:\n  \"\\<lbrakk> array_not_at_mem_end a n; m \\<le> n \\<rbrakk> \\<Longrightarrow> a +\\<^sub>p int m \\<le> a +\\<^sub>p int n\"\n  apply (clarsimp simp: array_not_at_mem_end_def CTypesDefs.ptr_add_def\n                        ptr_le_def' ptr_le_def)\n  apply (rule word_plus_mono_right)\n   apply (rule word_mult_le_mono1)\n     apply (rule PackedTypes.of_nat_mono_maybe_le, simp+)\n   apply (subst unat_of_nat_eq, simp+)\n  apply (subst no_olen_add_nat)\n  apply (subst unat_mult_weak)\n   apply (subst unat_of_nat_eq, simp+)+\n  done\n\nlemma array_loc_mono2:\n  \"\\<lbrakk> array_not_at_mem_end a (unat n); m \\<le> n \\<rbrakk> \\<Longrightarrow> a +\\<^sub>p uint m \\<le> a +\\<^sub>p uint n\"\n  by (metis array_loc_mono uint_nat word_le_nat_alt)\n\nlemma array_loc_strict_mono:\n  \"\\<lbrakk> array_not_at_mem_end a n; m < n \\<rbrakk> \\<Longrightarrow> a +\\<^sub>p int m < a +\\<^sub>p int n\"\n  apply (clarsimp simp: array_not_at_mem_end_def CTypesDefs.ptr_add_def\n                        ptr_less_def' ptr_less_def)\n  apply (rule word_plus_strict_mono_right)\n   apply (rule word_mult_less_mono1)\n     apply (subst of_nat_mono_maybe, simp+)\n   apply (subst unat_of_nat_eq, simp+)\n  apply (subst no_olen_add_nat)\n  apply (subst unat_mult_weak)\n   apply (subst unat_of_nat_eq, simp+)+\n  done\n\nlemma array_loc_strict_mono2:\n  \"\\<lbrakk> array_not_at_mem_end a (unat n); m < n \\<rbrakk> \\<Longrightarrow> a +\\<^sub>p uint m < a +\\<^sub>p uint n\"\n  by (metis array_loc_strict_mono uint_nat word_less_nat_alt)\n\n\n(* Concatenation lemmas *)\n\nlemma array_concat_elems_valid:\n  \"array_elems_valid s a (n + m) =\n   (array_elems_valid s a n \\<and> array_elems_valid s (a +\\<^sub>p int n) m)\"\n  apply (subst array_all_elems_valid)+\n  apply (rule iffI)\n   apply clarsimp\n   apply (frule_tac x = \"n + ma\" in spec)\n   apply simp\n  apply clarsimp\n  apply (case_tac \"ma < n\")\n   apply simp\n  apply (frule_tac x = \"ma - n\" and\n                   P = \"\\<lambda>ma. (ma < m \\<longrightarrow> is_valid_w32 s (a +\\<^sub>p int ma +\\<^sub>p int n))\"\n                   in spec)\n  apply (subgoal_tac \"ma - n < m\")\n   apply (simp add: CTypesDefs.ptr_add_def)\n  apply simp\n  done\n\nlemma is_array_concat:\n  \"\\<lbrakk> m = 0 \\<or> array_not_at_mem_end a n \\<rbrakk> \\<Longrightarrow>\n   is_array s a (n + m) = (is_array s a n \\<and> is_array s (a +\\<^sub>p int n) m)\"\n  apply (erule disjE)\n   apply (simp add: empty_array_is_array)\n  apply (frule unat_linear_over_array_loc)\n  apply (subgoal_tac \"array_loc_valid a n\")\n   apply (simp add: is_array_def array_loc_valid_def\n                    array_concat_elems_valid add.assoc conj_commute)\n  apply (simp add: array_loc_valid_def array_not_at_mem_end_def)\n  done\n\nlemma is_array_concat2:\n  \"\\<lbrakk> m \\<le> n; array_not_at_mem_end a m \\<or> m = n \\<rbrakk> \\<Longrightarrow>\n   is_array s a n = (is_array s a m \\<and> is_array s (a +\\<^sub>p int m) (n - m))\"\n  apply (subst diff_add_inverse[symmetric, where n = \"m\"])\n  apply (subst diff_add_assoc, assumption)\n  apply (rule is_array_concat, force)\n  done\n\nlemma subarray1_is_array:\n  \"\\<lbrakk> is_array s a n; m \\<le> n \\<rbrakk> \\<Longrightarrow> is_array s a m\"\n  apply (case_tac \"m = n\", simp)\n  apply (frule_tac m = \"m\" in subarray_not_at_mem_end2, simp)\n  apply (simp add: is_array_concat2)\n  done\n\nlemma subarray2_is_array:\n  \"\\<lbrakk> is_array s a n; m \\<le> n; array_not_at_mem_end a m \\<or> m = n \\<rbrakk> \\<Longrightarrow>\n   is_array s (a +\\<^sub>p int m) (n - m)\"\n  by (simp add: is_array_concat2)\n\nlemma concat_is_array:\n  \"\\<lbrakk> is_array s a m; is_array s (a +\\<^sub>p int m) (n - m);\n     m \\<le> n; array_not_at_mem_end a m \\<or> m = n \\<rbrakk> \\<Longrightarrow>\n   is_array s a n\"\n  by (subst is_array_concat2[where m = \"m\"], simp_all)\n\n\n(* Array contents, definitions and lemmas *)\n\nprimrec\n  the_array :: \"lifted_globals \\<Rightarrow> word32 ptr \\<Rightarrow> nat \\<Rightarrow> word32 list\"\nwhere\n  \"the_array s a 0 = []\" |\n  \"the_array s a (Suc n) = (heap_w32 s a) # (the_array s (a +\\<^sub>p 1) n)\"\n\nlemma the_array_length [simp]:\n  \"length (the_array s a n) = n\"\n  by (induct n arbitrary: a, auto)\n\nlemma the_array_elem:\n  \"m < n \\<Longrightarrow> the_array s a n ! m = heap_w32 s (a +\\<^sub>p int m)\"\n  apply (induct n arbitrary: a m)\n   apply simp\n  apply (case_tac \"m = 0\")\n   apply (auto simp: CTypesDefs.ptr_add_def)\n  done\n\nlemma the_arrays_equal:\n  \"(the_array s a n = the_array s' a' n) =\n   (\\<forall>m < n. heap_w32 s (a +\\<^sub>p int m) = heap_w32 s' (a' +\\<^sub>p int m))\"\n  by (simp add: list_eq_iff_nth_eq the_array_elem)\n\nlemma the_array_concat:\n  \"the_array s a (n + m) = the_array s a n @ the_array s (a +\\<^sub>p int n) m\"\n  by (induct n arbitrary: a m, auto)\n\nlemma the_array_concat2:\n  \"m \\<le> n \\<Longrightarrow>\n   the_array s a n = the_array s a m @ the_array s (a +\\<^sub>p int m) (n - m)\"\n  apply (subst diff_add_inverse[symmetric, where n = \"m\"])\n  apply (subst diff_add_assoc)\n  apply (simp_all only: the_array_concat)\n  done\n\n\n(* Pointer simplification rules *)\n\n(* FIXME: move *)\nlemma word32_mult_cancel_right:\n  fixes a :: \"word32\" and b :: \"word32\" and c :: \"word32\"\n  shows\n  \"\\<lbrakk> unat a * unat c < 2 ^ len_of TYPE(32);\n     unat b * unat c < 2 ^ len_of TYPE(32); c \\<noteq> 0 \\<rbrakk> \\<Longrightarrow>\n   (a * c = b * c) = (a = b)\"\n  apply (rule iffI)\n   apply simp_all\n  apply (subgoal_tac \"a = a * c div c\")\n   apply simp\n   apply (rule sym)\n   apply (rule Word.word_div_mult[symmetric, where 'a = 32],\n          unat_arith, simp)+\n  done\n\nlemma ptr_offsets_eq [simp]:\n  fixes i :: \"nat\" and j :: \"nat\" and a :: \"word32 ptr\"\n  shows\n  \"\\<lbrakk> i * size_of TYPE(word32) < 2 ^ len_of TYPE(32);\n     j * size_of TYPE(word32) < 2 ^ len_of TYPE(32) \\<rbrakk> \\<Longrightarrow>\n   (a +\\<^sub>p int i = a +\\<^sub>p int j) = (i = j)\"\n  by (simp add: CTypesDefs.ptr_add_def word32_mult_cancel_right\n                unat_of_nat_eq of_nat_inj)\n\nlemma ptr_offsets_eq2 [simp]:\n  fixes i :: \"word32\" and j :: \"word32\" and a :: \"word32 ptr\"\n  shows\n  \"\\<lbrakk> unat i * size_of TYPE(word32) < 2 ^ len_of TYPE(32);\n     unat j * size_of TYPE(word32) < 2 ^ len_of TYPE(32) \\<rbrakk> \\<Longrightarrow>\n   (a +\\<^sub>p uint i = a +\\<^sub>p uint j) = (i = j)\"\n  by (simp add: uint_nat)\n\n\n(* Array update simplification *)\n\n(* FIXME: move? *)\nlemma trivial_heap_update [simp]:\n  \"heap_w32_update (\\<lambda>x. x) s = s\"\n  by simp\n\nlemma the_updated_array:\n  \"\\<lbrakk> is_array s p n; m < n \\<rbrakk> \\<Longrightarrow>\n   the_array (heap_w32_update (\\<lambda>h q. if q = p +\\<^sub>p int m then x else f h q) s) p n =\n   (the_array (heap_w32_update f s) p n)[m := x]\"\n  by (auto simp: is_array_def array_loc_valid_def the_array_elem\n           intro: nth_equalityI)\n\n\nlemma multiset_of_cycle:\n  (* Courtesy of Dave G *)\n  \"\\<lbrakk> i < length ls; j < length ls; k < length ls; i = k \\<Longrightarrow> ls ! i = ls ! j \\<rbrakk> \\<Longrightarrow>\n   multiset_of (ls[i := (ls ! j), j := ls ! k, k := ls ! i]) = multiset_of ls\"\n  apply (subst (2) multiset_of_swap[symmetric, where i = j and j = i], assumption+)\n  apply (subst (2) multiset_of_swap[symmetric, where i = j and j = k], simp+)\n  apply (clarsimp simp: nth_list_update)\n  apply (metis list_update_overwrite list_update_swap)\n  done\n\n\n(* Defining sanity of program, i.e. that only the array can change,\n   and some related lemmas *)\n\ndefinition unmodified_outside_range ::\n             \"lifted_globals \\<Rightarrow> lifted_globals \\<Rightarrow> word32 ptr \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"unmodified_outside_range s s' a n \\<equiv>\n   (\\<forall>p. (p < a \\<or> (array_not_at_mem_end a n \\<and> p \\<ge> a +\\<^sub>p int n)) \\<longrightarrow>\n        (is_valid_w32 s' p = is_valid_w32 s p \\<and> heap_w32 s' p = heap_w32 s p))\"\n\nlemma unmodified_outside_range_refl [simp]:\n  \"unmodified_outside_range s s a n\"\n  by (simp add: unmodified_outside_range_def)\n\nlemma unmodified_outside_range_trans:\n  \"\\<lbrakk> unmodified_outside_range s1 s2 a n; unmodified_outside_range s2 s3 a n \\<rbrakk>\n   \\<Longrightarrow> unmodified_outside_range s1 s3 a n\"\n  by (simp add: unmodified_outside_range_def)\n\nlemma unmodified_outside_empty_range:\n  \"unmodified_outside_range s s' p 0\n   \\<Longrightarrow> \\<forall>p. (is_valid_w32 s' p = is_valid_w32 s p \\<and>\n            heap_w32 s' p = heap_w32 s p)\"\n  apply (clarsimp simp: unmodified_outside_range_def empty_array_not_at_mem_end)\n  apply (case_tac \"pa < p\", simp+)\n  done\n\nlemma unmodified_outside_empty_range2:\n  \"\\<lbrakk> unmodified_outside_range s s' p 0; array_loc_valid a n \\<rbrakk>\n   \\<Longrightarrow> unmodified_outside_range s s' a n\"\n  apply (clarsimp simp: unmodified_outside_range_def empty_array_not_at_mem_end)\n  apply (case_tac \"pa < p\", simp+)\n  done\n\nlemma unmodified_outside_subrange1:\n  \"\\<lbrakk> array_loc_valid a n; unmodified_outside_range s s' a m; m \\<le> n \\<rbrakk>\n   \\<Longrightarrow> unmodified_outside_range s s' a n\"\n  apply (unfold unmodified_outside_range_def)\n  apply clarsimp\n  apply (subgoal_tac \"array_not_at_mem_end a m \\<and> a +\\<^sub>p int m \\<le> p\", simp)\n  apply (simp add: array_not_at_mem_end_def)\n  apply (rule_tac y = \"a +\\<^sub>p int n\" in order_trans)\n   apply (simp add: array_loc_mono array_not_at_mem_end_def)\n  apply assumption\n  done\n\nlemma unmodified_outside_subrange2:\n  \"\\<lbrakk> array_loc_valid a n;\n     unmodified_outside_range s s' (a +\\<^sub>p int m) (n - m); m \\<le> n \\<rbrakk>\n   \\<Longrightarrow> unmodified_outside_range s s' a n\"\n  apply (case_tac \"m = n\", simp)\n   apply (rule_tac p = \"a +\\<^sub>p int n\" in unmodified_outside_empty_range2, assumption+)\n  apply (unfold unmodified_outside_range_def)\n  apply clarsimp\n  apply (simp add: ptr_add_assoc[symmetric])\n  apply (rule conjI)\n   apply clarsimp\n   apply (frule_tac z = \"a +\\<^sub>p int m\" in order_less_le_trans)\n    apply (simp add: array_no_wrap)\n   apply simp\n  apply (auto simp: array_not_at_mem_end_def unat_linear_over_array_loc2)\n  done\n\n\n(* Sanity in terms of arrays not changing *)\n\nlemma is_still_array:\n  \"\\<lbrakk> unmodified_outside_range s s' a n;\n     (array_not_at_mem_end a' n' \\<and> a' +\\<^sub>p int n' \\<le> a) \\<or>\n     (array_not_at_mem_end a n \\<and> a +\\<^sub>p int n \\<le> a') \\<or> n = 0;\n     is_array s a' n' \\<rbrakk> \\<Longrightarrow> is_array s' a' n'\"\n  apply (clarsimp simp: unmodified_outside_range_def is_array_def\n                        array_all_elems_valid)\n  apply (drule_tac x = \"m\" in spec, clarsimp)\n  apply (drule_tac R = \"is_valid_w32 s' (a' +\\<^sub>p int m)\" in disjE, simp_all)\n   apply clarsimp\n   apply (subgoal_tac \"a' +\\<^sub>p int m < a\", simp)\n   apply (rule_tac y = \"a' +\\<^sub>p int n'\" in less_le_trans)\n    apply (rule array_loc_strict_mono, assumption+)\n  apply (drule_tac R = \"is_valid_w32 s' (a' +\\<^sub>p int m)\" in disjE, simp_all)\n   apply clarsimp\n   apply (subgoal_tac \"a +\\<^sub>p int n \\<le> a' +\\<^sub>p int m\", simp)\n   apply (erule_tac y = \"a'\" in order_trans)\n   apply (rule_tac n = \"n'\" in array_no_wrap, assumption+)\n  apply (case_tac \"a' +\\<^sub>p int m < a\", simp)\n  apply (simp add: empty_array_not_at_mem_end)\n  done\n\nlemma the_same_array:\n  \"\\<lbrakk> unmodified_outside_range s s' a n; array_loc_valid a' n';\n     (array_not_at_mem_end a' n' \\<and> a' +\\<^sub>p int n' \\<le> a) \\<or>\n     (array_not_at_mem_end a n \\<and> a' \\<ge> a +\\<^sub>p int n) \\<or> n = 0 \\<rbrakk> \\<Longrightarrow>\n   the_array s' a' n' = the_array s a' n'\"\n  apply (clarsimp simp: unmodified_outside_range_def the_arrays_equal)\n  apply (drule_tac R = \"heap_w32 s' (a' +\\<^sub>p int m) = heap_w32 s (a' +\\<^sub>p int m)\"\n                in disjE)\n    apply simp_all\n   apply clarsimp\n   apply (subgoal_tac \"a' +\\<^sub>p int m < a\", simp)\n   apply (rule_tac y = \"a' +\\<^sub>p int n'\" in less_le_trans)\n    apply (rule array_loc_strict_mono, assumption+)\n  apply (drule_tac R = \"heap_w32 s' (a' +\\<^sub>p int m) = heap_w32 s (a' +\\<^sub>p int m)\"\n                in disjE)\n    apply simp_all\n   apply (subgoal_tac \"a +\\<^sub>p int n \\<le> a' +\\<^sub>p int m\", simp)\n   apply clarsimp\n   apply (erule_tac y = \"a'\" in order_trans)\n   apply (rule_tac n = \"n'\" in array_no_wrap, assumption+)\n  apply (case_tac \"a' +\\<^sub>p int m < a\", simp)\n  apply (simp add: empty_array_not_at_mem_end)\n  done\n\n\n(*\n * Proof of partition function!\n *)\n\ndefinition partitioned\nwhere\n  \"partitioned s a n pivot_idx \\<equiv>\n   (\\<forall>i. i < n \\<longrightarrow> (i < pivot_idx \\<longleftrightarrow> heap_w32 s (a +\\<^sub>p int i) < heap_w32 s (a +\\<^sub>p int pivot_idx)))\"\n\nlemma partition_correct:\n  \"\\<forall>s0. \\<lbrace> \\<lambda>s. is_array s a (unat n) \\<and> n > 0 \\<and> s = s0 \\<rbrace>\n   partition' a n\n   \\<lbrace> \\<lambda>r s. is_array s a (unat n) \\<and>\n           multiset_of (the_array s a (unat n)) = multiset_of (the_array s0 a (unat n)) \\<and>\n           r < n \\<and> partitioned s a (unat n) (unat r) \\<and>\n           unmodified_outside_range s0 s a (unat n) \\<rbrace>!\"\n  apply clarsimp\n  apply (unfold partition'_def)\n  apply (subst whileLoop_add_inv [where\n         I = \"\\<lambda>(i, pivot_idx) s. is_array s a (unat n) \\<and>\n                                 multiset_of (the_array s a (unat n)) = \n                                 multiset_of (the_array s0 a (unat n)) \\<and>\n                                 i \\<le> n \\<and> pivot_idx < i \\<and>\n                                 partitioned s a (unat i) (unat pivot_idx) \\<and>\n                                 unmodified_outside_range s0 s a (unat n)\" and\n         M = \"\\<lambda>((i, pivot_idx), s). n - i\"])\n\n  apply wp\n     apply clarsimp\n     apply (intro conjI impI)\n                 defer\n                apply unat_arith\n                apply unat_arith\n               defer defer\n              apply (erule_tac n = \"n\" in array_valid_elem2, unat_arith)\n              apply (rule_tac n = \"n\" in array_valid_elem2, assumption+)\n             apply (erule_tac n = \"n\" in array_valid_elem2, unat_arith)\n            apply unat_arith\n           apply unat_arith\n          apply (unfold partitioned_def)\n          apply clarsimp\n          apply (case_tac \"i = unat aa\")\n           apply (simp add: uint_nat, unat_arith)\n          apply (subgoal_tac \"i < unat aa\", simp)\n          apply unat_arith\n         apply (rule_tac n = \"n\" in array_valid_elem2, assumption+)\n        apply (erule_tac n = \"n\" in array_valid_elem2, unat_arith)\n       apply wp\n       apply clarsimp\n       apply (intro conjI impI)\n        apply unat_arith\n       apply unat_arith\n      apply clarsimp\n     apply clarsimp\n     apply unat_arith\n    defer\n    apply (clarsimp simp: is_array_def array_loc_valid_def uint_nat)\n    apply (intro conjI impI allI)\n              apply simp\n             apply (simp add: CTypesDefs.ptr_add_def)\n            apply (simp add: CTypesDefs.ptr_add_def)\n           apply (simp add: CTypesDefs.ptr_add_def)\n          apply unat_arith\n         apply (simp add: CTypesDefs.ptr_add_def)\n        apply (subst (asm) (2) ptr_offsets_eq)\n          apply (simp, unat_arith)\n         apply (simp, unat_arith)\n        apply (simp, unat_arith)\n       apply (subst (asm) ptr_offsets_eq, simp, unat_arith, simp, unat_arith)+\n       apply simp\n      apply (subst (asm) (3) ptr_offsets_eq)\n        apply (simp, unat_arith)\n       apply (simp, unat_arith)\n      apply (subst (asm) ptr_offsets_eq, simp, unat_arith, simp, unat_arith)+\n      apply clarsimp\n      apply (drule_tac x = \"unat (b + 1)\" in spec)\n      apply (subgoal_tac \"unat (b + 1) < unat aa\")\n       apply clarsimp\n       apply (subgoal_tac \"\\<not> unat (b + 1) < unat b\")\n        apply (subgoal_tac \"\\<not> unat aa < unat (b + 1)\", simp)\n        apply simp\n       apply unat_arith\n      apply unat_arith\n     apply (subst (asm) (4) ptr_offsets_eq)\n       apply (simp, unat_arith)\n      apply (simp, unat_arith)\n     apply simp\n    apply (subst (asm) ptr_offsets_eq, simp, unat_arith, simp, unat_arith)+\n    apply clarsimp\n    apply (drule_tac x = \"i\" in spec)\n (* apply (metis (hide_lams, mono_tags) Suc_eq_plus1_left Suc_le_D inc_i le_iff_add\n                 le_step less_eq_Suc_le less_le_trans olen_add_eqv unat_1 unat_mono\n                 word_le_nat_alt) *)\n    apply (subgoal_tac \"i < unat aa\")\n     apply clarsimp\n     apply (subgoal_tac \"(i < unat b) = (i < unat (b + 1))\", simp)\n     apply unat_arith\n    apply unat_arith\n   defer\n   apply (simp add: o_def)\n   apply (subst uint_nat, subst the_updated_array, assumption, unat_arith)+\n   apply (clarsimp simp: is_array_def array_loc_valid_def)\n   apply (intro conjI impI)\n    apply (subst (asm) ptr_offsets_eq2, simp, unat_arith, simp, unat_arith)\n    apply simp\n   apply (simp only: uint_nat)\n   apply (subst the_array_elem[symmetric, where n = \"unat n\"], unat_arith)+\n   apply (subst multiset_of_cycle)\n       apply (simp, unat_arith)\n      apply (simp, unat_arith)\n     apply (simp, unat_arith)\n    apply simp+\n  apply (clarsimp simp: is_array_def unmodified_outside_range_def)\n  apply (intro conjI impI)\n           apply (subst (asm) ptr_offsets_eq2)\n             apply simp+\n         apply (subgoal_tac \"a \\<le> a +\\<^sub>p uint b\", simp)\n         apply (rule_tac n = \"n\" in array_no_wrap2, simp, unat_arith)\n        apply clarsimp\n        apply (subgoal_tac \"a +\\<^sub>p uint b < a +\\<^sub>p uint n\", simp add: uint_nat)\n        apply (erule_tac n = \"n\" in array_loc_strict_mono2, unat_arith)\n       apply (subgoal_tac \"a \\<le> a +\\<^sub>p uint (b + 1)\", simp)\n       apply (erule_tac n = \"n\" in array_no_wrap2, unat_arith)\n      apply clarsimp\n      apply (subgoal_tac \"a +\\<^sub>p uint aa < a +\\<^sub>p uint n\", simp add: uint_nat)\n      apply (rule_tac n = \"n\" in array_loc_strict_mono2, assumption+)\n     apply (subgoal_tac \"a \\<le> a +\\<^sub>p uint aa\", simp)\n     apply (rule_tac n = \"n\" in array_no_wrap2, assumption+)\n    apply clarsimp\n    apply (subgoal_tac \"a +\\<^sub>p uint aa < a +\\<^sub>p uint n\", simp add: uint_nat)\n    apply (rule_tac n = \"n\" in array_loc_strict_mono2, assumption+)\n   apply (subgoal_tac \"a \\<le> a +\\<^sub>p uint (b + 1)\", simp)\n   apply (erule_tac n = \"n\" in array_no_wrap2, unat_arith)\n  apply clarsimp\n  apply (subgoal_tac \"a +\\<^sub>p uint (b + 1) < a +\\<^sub>p uint n\", simp add: uint_nat)\n  apply (erule_tac n = \"n\" in array_loc_strict_mono2, unat_arith)\n  done\n\n\n(* Induction rule used for quicksort proof *)\nlemma word_strong_induct[case_names Ind]:\n  \"(\\<And>n. (\\<forall>k < n. P k) \\<Longrightarrow> P n) \\<Longrightarrow> P (m::word32)\"\n  by (rule less_induct, blast)\n\n\n(* Some extra Hoare logic rules *)\n\nlemma when_True:\n  \"P \\<Longrightarrow> when P A = A\"\n  by monad_eq\n\nlemma when_False:\n  \"\\<not> P \\<Longrightarrow> when P A = return ()\"\n  by monad_eq\n\nlemma hoare_save_pre_state:\n  \"(\\<And>s'. P s' \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> s = s' \\<rbrace> f \\<lbrace>Q\\<rbrace>) \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  by (clarsimp simp: valid_def)\n\nlemma validNF_save_pre_state:\n  \"(\\<And>s'. P s' \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> s = s' \\<rbrace> f \\<lbrace>Q\\<rbrace>!) \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>!\"\n  by (auto simp: validNF_def valid_def no_fail_def)\n\n\nlemma is_array_after_changing_left:\n  \"\\<lbrakk> m \\<le> n; is_array s1 a n; is_array s2 a m;\n     unmodified_outside_range s1 s2 a m \\<rbrakk>\n   \\<Longrightarrow> is_array s2 a n\"\n  apply (case_tac \"m = n\", simp)\n  apply (frule_tac m = \"m\" in subarray_not_at_mem_end2, simp)\n  apply (erule_tac m = \"m\" in concat_is_array)\n    apply (auto simp: is_still_array subarray2_is_array)\n  done\n\nlemma is_array_after_changing_right:\n  \"\\<lbrakk> m \\<le> n; is_array s1 a n; is_array s2 (a +\\<^sub>p int m) (n - m);\n     unmodified_outside_range s1 s2 (a +\\<^sub>p int m) (n - m) \\<rbrakk>\n   \\<Longrightarrow> is_array s2 a n\"\n  apply (case_tac \"m = n\")\n   apply (simp add: is_array_def array_all_elems_valid unmodified_outside_empty_range)\n  apply (frule_tac m = \"m\" in subarray_not_at_mem_end2, simp)\n  apply (rule_tac m = \"m\" in concat_is_array)\n     apply (rule_tac s = \"s1\" and a = \"a +\\<^sub>p int m\" and n = \"n - m\" in is_still_array)\n       apply simp+\n     apply (rule_tac n = \"n\" in subarray1_is_array)\n      apply simp+\n  done\n\n\n(*\n * There is an issue later on with using \"subst\" substitutions on expressions\n * involving certain variables, so we have to use \"rule_tac\" with rules like\n * the following.\n *)\nlemma multiset_of_concat_array:\n  \"\\<lbrakk> m \\<le> n; multiset_of (the_array s a m) = multiset_of (the_array s' a m);\n     multiset_of (the_array s (a +\\<^sub>p int m) (n - m)) = multiset_of (the_array s' (a +\\<^sub>p int m) (n - m)) \\<rbrakk>\n   \\<Longrightarrow> multiset_of (the_array s a n) = multiset_of (the_array s' a n)\"\n  by (simp add: the_array_concat2)\n\nlemma multiset_same_after_shuffling_left:\n  \"\\<lbrakk> m \\<le> n; array_loc_valid a n;\n     multiset_of (the_array s1 a m) = multiset_of (the_array s2 a m);\n     unmodified_outside_range s1 s2 a m \\<rbrakk>\n   \\<Longrightarrow> multiset_of (the_array s1 a n) = multiset_of (the_array s2 a n)\"\n  apply (case_tac \"m = n\", simp)\n  apply (frule_tac m = \"m\" in subarray_not_at_mem_end1, simp)\n  apply (rule_tac m = \"m\" in multiset_of_concat_array, assumption+)\n  apply (subgoal_tac \"the_array s2 (a +\\<^sub>p int m) (n - m) =\n                      the_array s1 (a +\\<^sub>p int m) (n - m)\", simp)\n  apply (erule_tac a = \"a\" and n = \"m\" in the_same_array)\n   apply (clarsimp simp: is_array_def array_loc_valid_def\n                         unat_linear_over_array_loc2, unat_arith)\n  apply simp\n  done\n\nlemma multiset_same_after_shuffling_right:\n  \"\\<lbrakk> m \\<le> n; array_loc_valid a n;\n     multiset_of (the_array s1 (a +\\<^sub>p int m) (n - m)) =\n     multiset_of (the_array s2 (a +\\<^sub>p int m) (n - m));\n     unmodified_outside_range s1 s2 (a +\\<^sub>p int m) (n - m) \\<rbrakk>\n   \\<Longrightarrow> multiset_of (the_array s1 a n) = multiset_of (the_array s2 a n)\"\n  apply (rule_tac m = \"m\" in multiset_of_concat_array)\n    apply assumption\n   apply (subgoal_tac \"the_array s2 a m = the_array s1 a m\", simp)\n   apply (case_tac \"m = n\")\n    apply (simp add: unmodified_outside_empty_range the_arrays_equal)\n   apply (frule_tac m = \"m\" in subarray_not_at_mem_end1, simp)\n   apply (rule_tac a = \"a +\\<^sub>p int m\" and n = \"n - m\" in the_same_array)\n    apply (auto simp: array_not_at_mem_end_def array_loc_valid_def)\n  done\n\n\n(* Preparing for lemmas about partitioned-ness being preserved *)\n\nlemma old_array_elem:\n  \"\\<lbrakk> multiset_of (the_array s a n) =\n     multiset_of (the_array s0 a n); i < n \\<rbrakk>\n   \\<Longrightarrow> \\<exists>j < n. heap_w32 s (a +\\<^sub>p int i) = heap_w32 s0 (a +\\<^sub>p int j)\"\n  apply (drule multiset_of_eq_setD)\n  apply (subgoal_tac \"heap_w32 s (a +\\<^sub>p int i) \\<in> set (the_array s a n)\")\n   apply simp\n   apply (frule nth_the_index)\n   apply (rule_tac x = \"the_index (the_array s0 a n) (heap_w32 s (a +\\<^sub>p int i))\"\n          in exI)\n   apply (rule conjI)\n    apply (subst (4) the_array_length[symmetric, where s = \"s0\" and a = \"a\"])\n    apply (erule the_index_bounded)\n   apply (subst (asm) the_array_elem)\n    apply (subst (4) the_array_length[symmetric, where s = \"s0\" and a = \"a\"])\n    apply (erule the_index_bounded)\n   apply simp\n  apply (subst the_array_elem[symmetric, where n = \"n\"], assumption)\n  apply (rule nth_mem, simp)\n  done\n\nlemma old_array_elem2:\n  \"\\<lbrakk> multiset_of (the_array s (a +\\<^sub>p int k) (n - k)) =\n     multiset_of (the_array s0 (a +\\<^sub>p int k) (n - k)); k + i < n \\<rbrakk>\n   \\<Longrightarrow> \\<exists>j < n. j \\<ge> k \\<and> heap_w32 s (a +\\<^sub>p int (k + i)) = heap_w32 s0 (a +\\<^sub>p int j)\"\n  apply (drule_tac i = \"i\" in old_array_elem, simp)\n  apply clarsimp\n  apply (rule_tac x = \"k + j\" in exI)\n  apply simp\n  done\n\nlemma partitioned_after_shuffling_left:\n  \"\\<lbrakk> is_array s0 a (unat n); pivot_idx < n;\n     partitioned s0 a (unat n) (unat pivot_idx);\n     multiset_of (the_array s a (unat pivot_idx)) =\n     multiset_of (the_array s0 a (unat pivot_idx));\n     unmodified_outside_range s0 s a (unat pivot_idx) \\<rbrakk>\n   \\<Longrightarrow> partitioned s a (unat n) (unat pivot_idx)\"\n  apply (clarsimp simp: partitioned_def unmodified_outside_range_def)\n  apply (subgoal_tac \"heap_w32 s (a +\\<^sub>p uint pivot_idx) =\n                      heap_w32 s0 (a +\\<^sub>p uint pivot_idx)\", simp add: uint_nat)\n   apply (subgoal_tac \"array_not_at_mem_end a (unat pivot_idx)\")\n    apply (case_tac \"i < unat pivot_idx\", clarsimp)\n     apply (subgoal_tac \"\\<exists>j. (j < unat pivot_idx \\<and>\n                              heap_w32 s (a +\\<^sub>p int i) = heap_w32 s0 (a +\\<^sub>p int j))\")\n      apply clarsimp\n      apply (drule_tac x = \"j\" in spec)\n      apply (subgoal_tac \"j < unat n\")\n       apply (clarsimp simp: uint_nat)\n      apply unat_arith\n     apply (erule old_array_elem, simp)\n    apply (drule_tac x = \"a +\\<^sub>p int i\" in spec)\n    apply (subgoal_tac \"a +\\<^sub>p int (unat pivot_idx) \\<le> a +\\<^sub>p int i\")\n     apply simp\n    apply (rule array_loc_mono)\n     apply (rule_tac s = \"s0\" and n = \"unat n\" in subarray_not_at_mem_end2,\n            assumption+)\n    apply unat_arith\n   apply (erule_tac s = \"s0\" and n = \"unat n\" in subarray_not_at_mem_end2,\n          unat_arith)\n  apply (drule_tac x = \"a +\\<^sub>p uint pivot_idx\" in spec)\n  apply (subgoal_tac \"array_not_at_mem_end a (unat pivot_idx)\")\n   apply (simp add: uint_nat)\n  apply (erule_tac s = \"s0\" and n = \"unat n\" in subarray_not_at_mem_end2,\n         unat_arith)\n  done\n\nlemma partitioned_after_shuffling_right:\n  \"\\<lbrakk> is_array s0 a (unat n); pivot_idx < n;\n     partitioned s0 a (unat n) (unat pivot_idx);\n     multiset_of (the_array s (a +\\<^sub>p int (Suc (unat pivot_idx)))\n                              (unat n - Suc (unat pivot_idx))) =\n     multiset_of (the_array s0 (a +\\<^sub>p int (Suc (unat pivot_idx)))\n                               (unat n - Suc (unat pivot_idx)));\n     unmodified_outside_range s0 s (a +\\<^sub>p int (Suc (unat pivot_idx)))\n                                   (unat n - unat pivot_idx - 1) \\<rbrakk>\n   \\<Longrightarrow> partitioned s a (unat n) (unat pivot_idx)\"\n  apply (unfold partitioned_def)\n  apply (case_tac \"unat n = Suc (unat pivot_idx)\")\n   apply (simp add: unmodified_outside_empty_range)\n  apply (subgoal_tac \"Suc (unat pivot_idx) < unat n\")\n   prefer 2\n   apply unat_arith\n  apply (subgoal_tac \"array_not_at_mem_end a (Suc (unat pivot_idx))\")\n   prefer 2\n   apply (rule_tac s = \"s0\" and n = \"unat n\" in subarray_not_at_mem_end2)\n    apply assumption+\n  apply (unfold unmodified_outside_range_def, clarify)\n  apply (frule_tac x = \"a +\\<^sub>p int (unat pivot_idx)\" in spec)\n  apply (subgoal_tac \"a +\\<^sub>p int (unat pivot_idx) < a +\\<^sub>p int (Suc (unat pivot_idx))\")\n   prefer 2\n   apply (erule array_loc_strict_mono, simp)\n  apply (case_tac \"i \\<le> unat pivot_idx\")\n   apply (frule_tac x = \"a +\\<^sub>p int i\" in spec)\n   apply (subgoal_tac \"a +\\<^sub>p int i < a +\\<^sub>p int (Suc (unat pivot_idx))\")\n     apply (simp add: uint_nat)\n    apply (erule array_loc_strict_mono, simp)\n  apply (subgoal_tac \"\\<not> i < unat pivot_idx\")\n   prefer 2\n   apply unat_arith\n  apply (drule_tac i = \"i - Suc (unat pivot_idx)\" in old_array_elem2)\n   apply unat_arith\n  apply clarify\n  apply (frule_tac x = \"j\" in spec)\n  apply (subgoal_tac \"\\<not> j < unat pivot_idx\")\n   apply (subgoal_tac \"a +\\<^sub>p 1 +\\<^sub>p int (unat pivot_idx) +\\<^sub>p\n                       int (i - Suc (unat pivot_idx)) = a +\\<^sub>p int i\")\n    apply simp\n   apply (subst zdiff_int[symmetric], unat_arith)\n   apply (subst ptr_add_assoc[symmetric])+\n   apply simp\n  apply unat_arith\n  done\n\n\n(*\n * The basic idea of quicksort: if the array is partitioned and\n * both halves are sorted then the array is sorted.\n *)\n\nlemma partitioned_array_sorted:\n  \"\\<lbrakk> m < n; sorted (the_array s a m);\n     sorted (the_array s (a +\\<^sub>p int (Suc m)) (n - Suc m));\n     partitioned s a n m \\<rbrakk> \\<Longrightarrow>\n   sorted (the_array s a n)\"\n  apply (subst the_array_concat2[where m = \"m\"], simp)\n  apply (subst sorted_append, simp)\n  apply (rule conjI)\n   apply (subst the_array_concat2[where m = \"1\"], simp+)\n   apply (subst sorted_Cons)\n   apply (simp add: partitioned_def)\n   apply (subst all_set_conv_all_nth)\n   apply (clarsimp simp: the_array_elem)\n   apply (drule_tac x = \"m + i + 1\" in spec)\n   apply (subgoal_tac \"m + i + 1 < n\")\n    apply clarsimp\n    apply unat_arith\n   apply unat_arith\n  apply (subst all_set_conv_all_nth)\n  apply (clarsimp simp: the_array_elem partitioned_def)\n  apply (frule_tac x = \"i\" in spec)\n  apply simp\n  apply (subgoal_tac \"x \\<ge> heap_w32 s (a +\\<^sub>p int m)\")\n   apply simp\n  apply (frule nth_the_index)\n  apply (subst (asm) the_array_elem)\n  apply (frule the_index_bounded, simp)\n  apply (subgoal_tac \"m + the_index (the_array s (a +\\<^sub>p int m) (n - m)) x < n\")\n   apply (frule_tac x = \"m + the_index (the_array s (a +\\<^sub>p int m) (n - m)) x\"\n          in spec)\n   apply simp\n  apply (subgoal_tac \"the_index (the_array s (a +\\<^sub>p int m) (n - m)) x < n - m\")\n   apply simp\n  apply (frule the_index_bounded, simp)\n  done\n\n\n(* Some more trivial lemmas *)\n\nlemma array_index_Suc:\n  \"a +\\<^sub>p uint m +\\<^sub>p 1 = a +\\<^sub>p int (Suc (unat m))\"\n  by (simp add: uint_nat)\n\nlemma array_loc_le_Suc:\n  \"array_not_at_mem_end a (Suc (unat m)) \\<Longrightarrow> a +\\<^sub>p int (unat m) \\<le> a +\\<^sub>p 1 +\\<^sub>p uint m\"\n  apply (subst ptr_add_commute)\n  apply (subst array_index_Suc)\n  apply (rule array_loc_mono, simp+)\n  done\n\nlemma unat_sub_sub1 [simp]:\n  \"(m::word32) < n \\<Longrightarrow> unat (n - m - 1) = unat n - unat m - 1\"\n  by unat_arith\n\nlemma unat_inc:\n  \"(m::word32) < n \\<Longrightarrow> unat (m + 1) = Suc (unat m)\"\n  by unat_arith\n\n\n(*\nlemma old_quicksort_correct:\n  shows \"\\<lbrace> \\<lambda>s. is_array s a (unat n) \\<and> s = s0 \\<and> unat n < m \\<rbrace>\n         quicksort' m a n\n         \\<lbrace> \\<lambda>r s. is_array s a (unat n) \\<and>\n                 multiset_of (the_array s a (unat n)) =\n                 multiset_of (the_array s0 a (unat n)) \\<and>\n                 sorted (the_array s a (unat n)) \\<and>\n                 unmodified_outside_range s0 s a (unat n) \\<rbrace>!\"\n   ( is \"\\<lbrace> ?pre a n s0 m \\<rbrace> quicksort' m a n \\<lbrace> ?post a n s0 \\<rbrace>!\" )\n*)\n\n\n(* FIXME: move *)\n(* This puts our {partition,quicksort}_correct lemmas into a form that\n   wp can use. *)\nlemma make_schematic_post:\n  \"(\\<forall>s0. \\<lbrace> \\<lambda>s. P s0 s \\<rbrace> f \\<lbrace> \\<lambda>rv s. Q s0 rv s \\<rbrace>!) \\<Longrightarrow>\n   \\<lbrace> \\<lambda>s. \\<exists>s0. P s0 s \\<and> (\\<forall>rv s'. Q s0 rv s' \\<longrightarrow> Q' rv s') \\<rbrace> f \\<lbrace> Q' \\<rbrace>!\"\n  by (auto simp add: valid_def validNF_def no_fail_def split: prod.splits)\n\n\n(*\n * Proof of recursive quicksort function!\n *)\n\nlemma quicksort_correct:\n  shows \"\\<forall>a m s0. \\<lbrace> \\<lambda>s. is_array s a (unat n) \\<and> s = s0 \\<and> unat n < m \\<rbrace>\n         quicksort' m a n\n         \\<lbrace> \\<lambda>r s. is_array s a (unat n) \\<and>\n                 multiset_of (the_array s a (unat n)) =\n                 multiset_of (the_array s0 a (unat n)) \\<and>\n                 sorted (the_array s a (unat n)) \\<and>\n                 unmodified_outside_range s0 s a (unat n) \\<rbrace>!\"\n   ( is \"\\<forall>a m s0. \\<lbrace> ?pre a n s0 m \\<rbrace> quicksort' m a n \\<lbrace> ?post a n s0 \\<rbrace>!\" )\n\nproof (induct n rule: word_strong_induct)\n  fix a m s0\n\nnext\n  fix a n m s0\n  assume quicksort_ind_hyp:\n    \"\\<forall>k < n. \\<forall>a m s0. \\<lbrace> ?pre a k s0 m \\<rbrace> quicksort' m a k \\<lbrace> ?post a k s0 \\<rbrace>!\"\n\n  have quicksort_ind_hyp':\n    \"\\<And>k a m. \\<forall>s0. \\<lbrace> \\<lambda>s. ?pre a k s0 m s \\<and> k < n \\<rbrace> quicksort' m a k \\<lbrace> ?post a k s0 \\<rbrace>!\"\n    apply clarsimp\n    apply (rule validNF_assume_pre)\n    apply (rule validNF_chain)\n      apply (rule quicksort_ind_hyp [rule_format])\n      apply auto\n    done\n\n  show \"\\<forall>a m s0. \\<lbrace> ?pre a n s0 m \\<rbrace> quicksort' m a n \\<lbrace> ?post a n s0 \\<rbrace>!\"\n    apply clarsimp\n    apply (subst quicksort'.simps)\n    apply (unfold when_def)\n    apply (wp quicksort_ind_hyp' [THEN make_schematic_post]\n              partition_correct  [THEN make_schematic_post])\n    apply clarsimp\n    apply safe\n              apply unat_arith\n             apply (erule subarray1_is_array, unat_arith)\n            apply unat_arith\n           apply (case_tac \"unat n = Suc (unat rv)\", simp add: empty_array_is_array)\n           (* Add a few useful facts into the assumption set *)\n           apply (frule_tac s = \"s'\" and m = \"unat rv\" in subarray_not_at_mem_end2, unat_arith)\n           apply (frule_tac s = \"s'\" and m = \"Suc (unat rv)\" in subarray_not_at_mem_end2, unat_arith)\n           apply (frule_tac s = \"s'\" and m = \"unat rv\" in subarray1_is_array, unat_arith)\n           apply (frule_tac s = \"s'\" and m = \"unat rv\" in subarray2_is_array, unat_arith, simp)\n           apply (frule_tac s = \"s'\" and m = \"Suc (unat rv)\" in subarray1_is_array, unat_arith)\n           apply (frule_tac s = \"s'\" and m = \"Suc (unat rv)\" in subarray2_is_array,\n                  unat_arith, simp)\n           (* ...and back to the proof *)\n           apply (erule is_still_array)\n            apply (rule disjI2, rule disjI1)\n            apply (simp add: array_loc_le_Suc)\n           apply (simp add: uint_nat)\n          apply unat_arith\n         apply unat_arith\n        apply (rule_tac ?s1.0 = \"s'a\" and m = \"Suc (unat rv)\"\n                     in is_array_after_changing_right)\n           apply unat_arith\n          apply (rule_tac ?s1.0 = \"s'\" and m = \"unat rv\"\n                       in is_array_after_changing_left)\n             apply unat_arith\n            apply assumption+\n         apply (simp add: uint_nat)+\n       apply (subgoal_tac \"multiset_of (the_array s'b a (unat n)) =\n                           multiset_of (the_array s'a a (unat n))\")\n        apply (subgoal_tac \"multiset_of (the_array s'a a (unat n)) =\n                           multiset_of (the_array s' a (unat n))\", simp)\n        apply (rule_tac m = \"unat rv\" in multiset_same_after_shuffling_left)\n           apply unat_arith\n          apply (simp add: is_array_def)\n         apply assumption\n        apply (simp add: unmodified_outside_range_def)\n       apply (rule_tac m = \"Suc (unat rv)\" in multiset_same_after_shuffling_right)\n          apply unat_arith\n         apply (simp add: is_array_def)\n        apply simp\n       apply (simp add: unmodified_outside_range_def) \n      apply (rule_tac m = \"unat rv\" in partitioned_array_sorted)\n         apply unat_arith\n        apply (subgoal_tac \"the_array s'b a (unat rv) = the_array s'a a (unat rv)\", simp)\n        apply (case_tac \"Suc (unat rv) = unat n\")\n         apply (simp add: unmodified_outside_empty_range the_arrays_equal)\n        apply (erule_tac a = \"a +\\<^sub>p 1 +\\<^sub>p uint rv\" and n = \"unat n - Suc (unat rv)\"\n                     in the_same_array)\n         apply (simp add: is_array_def)\n        apply (rule disjI1, rule conjI)\n         apply (erule subarray_not_at_mem_end2, unat_arith)\n        apply (rule array_loc_le_Suc)\n        apply (erule subarray_not_at_mem_end2, unat_arith)\n       apply (simp add: uint_nat)\n      apply (rule_tac ?s0.0 = \"s'a\" in partitioned_after_shuffling_right)\n          apply (rule_tac ?s1.0 = \"s'\" and m = \"unat rv\" in is_array_after_changing_left)\n             apply unat_arith\n            apply assumption+\n        apply (rule_tac ?s0.0 = \"s'\" in partitioned_after_shuffling_left, assumption+)\n       apply (simp add: uint_nat)+\n     apply (erule unmodified_outside_range_trans)\n     apply (rule_tac ?s2.0 = \"s'a\" in unmodified_outside_range_trans)\n      apply (rule_tac m = \"unat rv\" in unmodified_outside_subrange1)\n        apply (simp add: is_array_def)\n       apply assumption\n      apply unat_arith\n     apply (rule_tac m = \"Suc (unat rv)\" in unmodified_outside_subrange2)\n       apply (simp add: is_array_def)\n      apply (simp add: uint_nat)\n     apply unat_arith\n    apply (case_tac \"n = 1\", simp)\n    apply (subgoal_tac \"n = 0\", simp, unat_arith)\n    done\n\nqed\n\nend\n\nend\n\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/autocorres/tests/examples/Quicksort.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.34455971010999603}}
{"text": "(* TODO: Move to lib/ *)\ntheory Monadify\nimports Main \"Automatic_Refinement.Refine_Util\"\nbegin\n  (* TODO: Move *)\n  ML \\<open>\n    (* Simplified output of rough term structure, for debugging purposes *)\n    structure Simplified_Term_Struct : sig\n      val tstruct: term -> string\n    end = struct\n      fun par b s = if b then \"(\"^s^\")\" else s\n    \n      fun psi_aux p env = let\n        fun r (Const (n,_)) = Long_Name.base_name n\n          | r (Var (n,_)) = Term.string_of_vname n\n          | r (Free (n,_)) = n\n          | r (Bound i) = nth env i\n          | r (Abs (x,_,t)) = par p (let val x = singleton (Name.variant_list env) x in \"\\<lambda>\"^x^\". \"^psi_aux false (x::env) t end)\n          | r (t as _$_) = let\n              val (f,args) = strip_comb t\n              val f = psi_aux true env f\n              val args = map (psi_aux true env) args |> space_implode \" \"\n              val s = f^\" \"^args\n            in par p s end    \n      in\n        r\n      end\n      \n      val tstruct = psi_aux false []\n    end\n  \\<close>\n\n  lemma eta_expand: \"f \\<equiv> \\<lambda>x. f x\" by (rule reflexive)\n    \n  ML \\<open>\n    functor Gen_Monadify (\n      (*\n        Assumes that the monad combinators have the form return$x and bind$m$f\n      *)\n    \n      val mk_return: term -> term\n      val mk_bind: term -> term -> term\n      val dest_return: term -> term option\n      val dest_bind: term -> (term * term) option\n      val dest_monadT: typ -> typ option\n      val strip_op: Proof.context -> term -> term * term list\n\n      (* TODO: Probably can derive mk and dest functions from these theorems! *)\n      val bind_return_thm : thm  (* bind m return = m *)\n      val return_bind_thm : thm  (* bind (return x) f = f x  *)\n      val bind_bind_thm : thm    (* bind (bind m f) g = bind m (\\<lambda>x. bind (f x) g) *)\n          \n    ) = struct\n\n      \n    \n      val monad_laws = [bind_return_thm, return_bind_thm, bind_bind_thm]\n      \n      \n      val is_return = is_some o dest_return\n      val is_bind = is_some o dest_bind\n    \n      val dest_monadT' = the o dest_monadT\n      val is_monadT = is_some o dest_monadT\n      val is_monadic = is_monadT o fastype_of\n      \n      \n      local open Conv in\n\n        (* TODO: Move, generally useful *)\n        (* Apply conversion to direct subterms, fail if conversion fails for a subterm *)\n        fun sub_conv' conv ctxt ct = (case Thm.term_of ct of\n          Abs _ => abs_conv (conv o snd) ctxt\n        | _$_ => comb_conv (conv ctxt)  \n        | _ => all_conv\n        ) ct\n\n      end          \n              \n      local \n        open Conv \n        \n        fun ensure_eta_conv ct = \n          (case Thm.term_of ct of \n            Abs _ => all_conv\n          | _ => rewr_conv @{thm eta_expand}\n          ) ct\n          \n        fun expand_return_thm ctxt =\n          Local_Defs.meta_rewrite_rule ctxt bind_return_thm\n          RS @{thm Pure.symmetric}\n          \n      in  \n        \n        fun eta_ret_conv ctxt ct = (let \n          val t = Thm.term_of ct \n          val bnd_conv = \n            arg_conv ensure_eta_conv \n            then_conv arg1_conv (sub_conv' eta_ret_conv ctxt)\n            then_conv arg_conv (abs_conv (eta_ret_conv o snd) ctxt)\n            \n        in\n          if is_monadic t then\n            if is_bind t then bnd_conv\n            else if is_return t then arg_conv (eta_ret_conv ctxt)\n            else rewr_conv (expand_return_thm ctxt) then_conv bnd_conv\n          else\n            sub_conv' eta_ret_conv ctxt\n        end) ct\n        \n      end  \n      \n      \n      (* Generate a bind, the second term is created by F x, where x is the bound variable *)\n      fun BIND M F ctxt = let\n        val m = M ctxt\n        val T = fastype_of m |> dest_monadT'\n        val (n,ctxt) = yield_singleton Variable.variant_fixes \"tmp\" ctxt\n        val x = Free (n,T)\n        \n        val f = Term.lambda x (F x ctxt)\n      in \n        mk_bind m f\n      end\n\n      fun ABS_CNV (x,T,t) cnv ctxt = let\n        val (n,ctxt) = yield_singleton Variable.variant_fixes x ctxt\n        val t = subst_bound (Free (n,T), t)\n        val t = cnv t ctxt\n        val t = Term.absfree (n,T) t\n      in t end  \n          \n      fun mk_return' t _ = mk_return t\n      \n      fun is_operand (Free _) = true\n        | is_operand (Var _) = true\n        | is_operand (Bound _) = true\n        | is_operand _ = false\n\n      val is_ho_operand = fastype_of #> body_type #> is_monadT\n             \n      fun process_ho_operand t = let\n        val (argTs,T) = fastype_of t |> strip_type\n      in\n        is_monadT T andalso length (strip_abs_vars t) = length argTs\n      end  \n      \n       \n      fun mk_operand t F = \n        if is_operand t then F t \n        else if is_ho_operand t then fn ctxt => F (mk_monadify_all t ctxt) ctxt\n        else BIND (mk_operation t mk_return') F\n      and mk_operation t F ctxt = let\n            val (f,xs) = strip_op ctxt t\n            fun R t [] = F t | R t (x::xs) = mk_operand x (fn x => R (t$x) xs)\n          in\n            R f xs ctxt\n          end\n      and mk_monadify (Abs xTt) = ABS_CNV xTt mk_monadify\n        | mk_monadify t = case dest_return t of\n            SOME x => mk_operation x mk_return'\n          | NONE => mk_operation t (fn t => K t)\n      and mk_monadify_all (Abs xTt) = ABS_CNV xTt mk_monadify_all\n        | mk_monadify_all t = \n            if is_monadT (fastype_of t) then mk_monadify t \n            else fn ctxt =>\n              strip_comb t |> apsnd (map (fn t => mk_monadify_all t ctxt)) |> list_comb\n            \n      \n      fun monadify ctxt t = mk_monadify t (Variable.declare_term t ctxt |> Variable.set_body false)\n          \n      fun monadify_conv ctxt ct = let\n          val _ = is_monadT (Thm.typ_of_cterm ct |> body_type) \n            orelse raise TYPE(\"No monad type\",[Thm.typ_of_cterm ct],[Thm.term_of ct])\n      \n          val ctxt = put_simpset HOL_basic_ss ctxt addsimps monad_laws\n          val tac = ALLGOALS (simp_tac ctxt)\n        in \n          (* TODO: f_tac_conv will choke on beta-redexes! *)\n          Thm.beta_conversion true then_conv Refine_Util.f_tac_conv ctxt (monadify ctxt) tac then_conv eta_ret_conv ctxt \n        end ct\n        \n      val monadify_all_conv = Conv.top_sweep_conv monadify_conv\n        \n      val monadify_all_tac = CONVERSION o monadify_all_conv\n        \n    end\n  \\<close>\n\n  ML \\<open>\n    functor Gen_Monadify_Cong (\n      val mk_return: term -> term\n      val mk_bind: term -> term -> term\n      val dest_return: term -> term option\n      val dest_bind: term -> (term * term) option\n      val dest_monadT: typ -> typ option\n      \n      val bind_return_thm : thm  (* bind m return = m *)\n      val return_bind_thm : thm  (* bind (return x) f = f x  *)\n      val bind_bind_thm : thm    (* bind (bind m f) g = bind m (\\<lambda>x. bind (f x) g) *)\n    \n    ) = struct\n          \n      structure Consts = Generic_Data (\n        type T = term Item_Net.T\n        val empty = Item_Net.init (op aconv) single\n        val merge = Item_Net.merge\n        val extend = I\n      )    \n  \n      val add_const_decl = Consts.map o Item_Net.update\n      val remove_const_decl = Consts.map o Item_Net.remove\n      val get_const_decls = Context.Proof #> Consts.get #> Item_Net.content\n      \n      fun prepare_const_decl t ctxt = let\n        val t = singleton (Variable.export_terms (Proof_Context.augment t ctxt) ctxt) t\n        \n        val _ = is_Var (head_of t) andalso \n          (Pretty.block [\n            Pretty.str \"Head of const is variable: \", \n            Syntax.pretty_term ctxt t\n           ]) |> Pretty.string_of |> error\n        \n      in\n        t\n      end\n      \n      fun prepare_add_const_decl t context = add_const_decl (prepare_const_decl t (Context.proof_of context)) context\n      \n      \n      fun is_const ctxt t = \n        Item_Net.retrieve_matching (Consts.get (Context.Proof ctxt)) t \n        |> exists (K true)\n            \n      fun strip_op ctxt t = let\n        fun stripc (t as f$x, xs) = if is_const ctxt t then (t,xs) else stripc (f,x::xs) \n          | stripc tt = tt\n      in stripc (t,[]) end\n\n      structure T = Gen_Monadify (\n        val mk_return = mk_return\n        val mk_bind = mk_bind\n        val dest_return = dest_return\n        val dest_bind = dest_bind\n        val dest_monadT = dest_monadT\n        val strip_op = strip_op\n        val bind_return_thm = bind_return_thm\n        val return_bind_thm = return_bind_thm\n        val bind_bind_thm = bind_bind_thm\n      )\n      open T\n  \n    end\n  \\<close>\n  \n  (*\n  (* Test Monad *)\n  \n  datatype 'a M = return 'a\n  definition \"bind \\<equiv> \\<lambda>return x \\<Rightarrow> \\<lambda>f. f x\"\n  \n  lemma monad_laws: \n    \"bind m return = m\"\n    \"bind (return x) f = f x\"\n    \"bind (bind m (\\<lambda>x. f x)) g = bind m (\\<lambda>x. bind (f x) g)\"\n    unfolding bind_def by (auto split: M.split)\n  \n  ML \\<open>\n  \n    structure Monadify = Gen_Monadify_Cong (\n    \n      fun mk_return x = @{mk_term \"return ?x\"}\n      fun mk_bind m f = @{mk_term \"bind ?m ?f\"}\n    \n      fun dest_return @{mpat \"return ?x\"} = SOME x | dest_return _ = NONE\n      fun dest_monadT (Type (@{type_name M},[T])) = SOME T | dest_monadT _ = NONE\n      \n      val monad_laws = @{thms monad_laws}\n    )\n  \\<close>\n    \n  \n  ML_val \\<open>\n    val t1 = @{term \"let (x,y) = p in (return (x+y+y))\"} |> Simplified_Term_Struct.tstruct\n    val t2 = @{term \"case p of (x,y) \\<Rightarrow> (return (x+y+y))\"} |> Simplified_Term_Struct.tstruct\n  \\<close> \n  \n  \n  ML_val \\<open>\n    val ctxt = @{context}\n    val ts = [\n      @{term \"case p of (x,y) \\<Rightarrow> return (x+y+y)\"},\n      @{term \"let (x,y) = p in return (x+y+y)\"}\n    ]\n    \n    val ts = map (Monadify.monadify ctxt #> Simplified_Term_Struct.tstruct) ts\n  \\<close>  \n  \n  lemma \"P (let (x,y) = p in return (x+y+y))\"\n    apply (tactic \\<open>CONVERSION (HOLogic.Trueprop_conv (Conv.arg_conv (Monadify.monadify_conv @{context}))) 1\\<close>)\n    oops\n  \n  \n  \n  context\n    fixes a :: \"'a list\"\n   begin\n  \n  ML_val \\<open>\n    val ctxt = @{context}\n    val t = @{term \"a @ b\"}\n    val ctxt' = Variable.auto_fixes t ctxt\n    \n    \n    val t = singleton (Variable.export_terms ctxt' ctxt) t\n    \n    \n  \\<close>\n  end\n  \n  ML_val \\<open>\n    let\n      open Monadify\n      val ctxt = @{context}\n      \n      val ctxt = add_const_decl (prepare_const_decl ctxt @{term \"hd f\"}) ctxt\n      \n      val t = @{cterm \\<open>return (hd ([a,b,c]) (g x y))\\<close>}\n      val t = monadify_conv ctxt t\n    \n    in \n      t\n    end  \n  \n  \\<close>\n  *)\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/basic/preproc/Monadify.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.585101139733739, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.3445597015890694}}
{"text": "section \\<open>Data\\<close>\n\ntext \\<open>This theory defines the data types and notations, and some preliminary results about them.\\<close>\n\ntheory Data\n  imports Main\nbegin\n\nsubsection \\<open>Function notations\\<close>\n\nabbreviation \\<epsilon> :: \"'a \\<rightharpoonup> 'b\" where\n  \"\\<epsilon> \\<equiv> \\<lambda>x. None\"\n\nfun combine :: \"('a \\<rightharpoonup> 'b) \\<Rightarrow> ('a  \\<rightharpoonup> 'b) \\<Rightarrow> ('a \\<rightharpoonup> 'b)\" (\"_;;_\" 20) where\n  \"(f ;; g) x = (if g x = None then f x else g x)\"\n\nlemma dom_combination_dom_union: \"dom (\\<tau>;;\\<tau>') = dom \\<tau> \\<union> dom \\<tau>'\"\n  by auto\n\nsubsection \\<open>Values, expressions and execution contexts\\<close>\n\ndatatype const = Unit | F | T\n\ndatatype (RID\\<^sub>V: 'r, LID\\<^sub>V: 'l,'v) val = \n  CV const\n| Var 'v\n| Loc 'l\n| Rid 'r\n| Lambda 'v \"('r,'l,'v) expr\"\nand (RID\\<^sub>E: 'r, LID\\<^sub>E: 'l,'v) expr =\n  VE \"('r,'l,'v) val\"\n| Apply \"('r,'l,'v) expr\" \"('r,'l,'v) expr\"\n| Ite \"('r,'l,'v) expr\" \"('r,'l,'v) expr\" \"('r,'l,'v) expr\"\n| Ref \"('r,'l,'v) expr\"\n| Read \"('r,'l,'v) expr\"\n| Assign \"('r,'l,'v) expr\" \"('r,'l,'v) expr\"\n| Rfork \"('r,'l,'v) expr\"\n| Rjoin \"('r,'l,'v) expr\"\n\ndatatype (RID\\<^sub>C: 'r, LID\\<^sub>C: 'l,'v) cntxt = \n  Hole (\"\\<box>\")\n| ApplyL\\<^sub>\\<E> \"('r,'l,'v) cntxt\" \"('r,'l,'v) expr\" \n| ApplyR\\<^sub>\\<E> \"('r,'l,'v) val\" \"('r,'l,'v) cntxt\"\n| Ite\\<^sub>\\<E> \"('r,'l,'v) cntxt\" \"('r,'l,'v) expr\" \"('r,'l,'v) expr\"\n| Ref\\<^sub>\\<E> \"('r,'l,'v) cntxt\"\n| Read\\<^sub>\\<E> \"('r,'l,'v) cntxt\"\n| AssignL\\<^sub>\\<E> \"('r,'l,'v) cntxt\" \"('r,'l,'v) expr\"\n| AssignR\\<^sub>\\<E> 'l \"('r,'l,'v) cntxt\"\n| Rjoin\\<^sub>\\<E> \"('r,'l,'v) cntxt\"\n\nsubsection \\<open>Plugging and decomposing\\<close>\n\nfun plug :: \"('r,'l,'v) cntxt \\<Rightarrow> ('r,'l,'v) expr \\<Rightarrow> ('r,'l,'v) expr\" (infix \"\\<lhd>\" 60) where\n  \"\\<box> \\<lhd> e = e\"\n| \"ApplyL\\<^sub>\\<E> \\<E> e1 \\<lhd> e = Apply (\\<E> \\<lhd> e) e1\"\n| \"ApplyR\\<^sub>\\<E> val \\<E> \\<lhd> e = Apply (VE val) (\\<E> \\<lhd> e)\"\n| \"Ite\\<^sub>\\<E> \\<E> e1 e2 \\<lhd> e = Ite (\\<E> \\<lhd> e) e1 e2\"\n| \"Ref\\<^sub>\\<E> \\<E> \\<lhd> e = Ref (\\<E> \\<lhd> e)\"\n| \"Read\\<^sub>\\<E> \\<E> \\<lhd> e = Read (\\<E> \\<lhd> e)\"\n| \"AssignL\\<^sub>\\<E> \\<E> e1 \\<lhd> e = Assign (\\<E> \\<lhd> e) e1\"\n| \"AssignR\\<^sub>\\<E> l \\<E> \\<lhd> e = Assign (VE (Loc l)) (\\<E> \\<lhd> e)\"\n| \"Rjoin\\<^sub>\\<E> \\<E> \\<lhd> e = Rjoin (\\<E> \\<lhd> e)\"\n\ntranslations\n  \"\\<E>[x]\" \\<rightleftharpoons> \"\\<E> \\<lhd> x\"\n\nlemma injective_cntxt [simp]: \"(\\<E>[e1] = \\<E>[e2]) = (e1 = e2)\" by (induction \\<E>) auto\n\nlemma VE_empty_cntxt [simp]: \"(VE v = \\<E>[e]) = (\\<E> = \\<box> \\<and> VE v = e)\" by (cases \\<E>, auto) \n\ninductive redex :: \"('r,'l,'v) expr \\<Rightarrow> bool\" where\n  app: \"redex (Apply (VE (Lambda x e)) (VE v))\"\n| iteTrue: \"redex (Ite (VE (CV T)) e1 e2)\"\n| iteFalse: \"redex (Ite (VE (CV F)) e1 e2)\"\n| ref: \"redex (Ref (VE v))\"\n| read: \"redex (Read (VE (Loc l)))\"\n| assign: \"redex (Assign (VE (Loc l)) (VE v))\"\n| rfork: \"redex (Rfork e)\"\n| rjoin: \"redex (Rjoin (VE (Rid r)))\"\n\ninductive_simps redex_simps [simp]: \"redex e\"\ninductive_cases redexE [elim]: \"redex e\"\n\nlemma plugged_redex_not_val [simp]: \"redex r \\<Longrightarrow> (\\<E> \\<lhd> r) \\<noteq> (VE t)\" by (cases \\<E>) auto\n\ninductive decompose :: \"('r,'l,'v) expr \\<Rightarrow> ('r,'l,'v) cntxt \\<Rightarrow> ('r,'l,'v) expr \\<Rightarrow> bool\" where\n  top_redex: \"redex e \\<Longrightarrow> decompose e \\<box> e\"\n| lapply: \"\\<lbrakk> \\<not>redex (Apply e\\<^sub>1 e\\<^sub>2); decompose e\\<^sub>1 \\<E> r \\<rbrakk> \\<Longrightarrow> decompose (Apply e\\<^sub>1 e\\<^sub>2) (ApplyL\\<^sub>\\<E> \\<E> e\\<^sub>2) r\"\n| rapply: \"\\<lbrakk> \\<not>redex (Apply (VE v) e); decompose e \\<E> r \\<rbrakk> \\<Longrightarrow> decompose (Apply (VE v) e) (ApplyR\\<^sub>\\<E> v \\<E>) r\"\n| ite: \"\\<lbrakk> \\<not>redex (Ite e\\<^sub>1 e\\<^sub>2 e\\<^sub>3); decompose e\\<^sub>1 \\<E> r \\<rbrakk> \\<Longrightarrow> decompose (Ite e\\<^sub>1 e\\<^sub>2 e\\<^sub>3) (Ite\\<^sub>\\<E> \\<E> e\\<^sub>2 e\\<^sub>3) r\"\n| ref: \"\\<lbrakk> \\<not>redex (Ref e); decompose e \\<E> r \\<rbrakk> \\<Longrightarrow> decompose (Ref e) (Ref\\<^sub>\\<E> \\<E>) r\"\n| read: \"\\<lbrakk> \\<not>redex (Read e); decompose e \\<E> r \\<rbrakk> \\<Longrightarrow> decompose (Read e) (Read\\<^sub>\\<E> \\<E>) r\"\n| lassign: \"\\<lbrakk> \\<not>redex (Assign e\\<^sub>1 e\\<^sub>2); decompose e\\<^sub>1 \\<E> r \\<rbrakk> \\<Longrightarrow> decompose (Assign e\\<^sub>1 e\\<^sub>2) (AssignL\\<^sub>\\<E> \\<E> e\\<^sub>2) r\"\n| rassign: \"\\<lbrakk> \\<not>redex (Assign (VE (Loc l)) e\\<^sub>2); decompose e\\<^sub>2 \\<E> r \\<rbrakk> \\<Longrightarrow> decompose (Assign (VE (Loc l)) e\\<^sub>2) (AssignR\\<^sub>\\<E> l \\<E>) r\"\n| rjoin:  \"\\<lbrakk> \\<not>redex (Rjoin e); decompose e \\<E> r \\<rbrakk> \\<Longrightarrow> decompose (Rjoin e) (Rjoin\\<^sub>\\<E> \\<E>) r\"\n\ninductive_cases decomposeE [elim]: \"decompose e \\<E> r\"\n\nlemma plug_decomposition_equivalence: \"redex r \\<Longrightarrow> decompose e \\<E> r = (\\<E>[r] = e)\"\nproof (rule iffI)\n  assume x: \"decompose e \\<E> r\"\n  show \"\\<E>[r] = e\" \n  proof (use x in \\<open>induct rule: decompose.induct\\<close>)\n    case (top_redex e)\n    thus \"\\<box>[e] = e\" by simp\n  next\n    case (lapply e\\<^sub>1 e\\<^sub>2 \\<E> r)\n    have \"(ApplyL\\<^sub>\\<E> \\<E> e\\<^sub>2) [r] = Apply (\\<E>[r]) e\\<^sub>2\" by simp\n    also have \"... = Apply e\\<^sub>1 e\\<^sub>2\" using \\<open>\\<E>[r] = e\\<^sub>1\\<close> by simp\n    then show ?case by simp\n  qed simp+\nnext\n  assume red: \"redex r\" and  eq: \"\\<E>[r] = e\"\n  have \"decompose (\\<E>[r]) \\<E> r\" by (induct \\<E>) (use red in \\<open>auto intro: decompose.intros\\<close>)\n  thus \"decompose e \\<E> r\" by (simp add: eq)\nqed\n\nlemma unique_decomposition: \"decompose e \\<E>\\<^sub>1 r\\<^sub>1 \\<Longrightarrow> decompose e \\<E>\\<^sub>2 r\\<^sub>2 \\<Longrightarrow> \\<E>\\<^sub>1 = \\<E>\\<^sub>2 \\<and> r\\<^sub>1 = r\\<^sub>2\"\n  by (induct arbitrary: \\<E>\\<^sub>2 rule: decompose.induct) auto\n\nlemma completion_eq [simp]:\n  assumes\n    red_e: \"redex r\" and\n    red_e': \"redex r'\"\n  shows \"(\\<E>[r] = \\<E>'[r']) = (\\<E> = \\<E>' \\<and> r = r')\"\nproof (rule iffI)\n  show \"\\<E>[r] = \\<E>'[r'] \\<Longrightarrow> \\<E> = \\<E>' \\<and> r = r'\"\n  proof (rule conjI)\n    assume eq: \"\\<E>[r] = \\<E>'[r']\"\n    have \"decompose (\\<E>[r]) \\<E> r\" using plug_decomposition_equivalence red_e by blast\n    hence fst_decomp:\"decompose (\\<E>'[r']) \\<E> r\" by (simp add: eq)\n    have snd_decomp: \"decompose (\\<E>'[r']) \\<E>' r'\" using plug_decomposition_equivalence red_e' by blast\n    show cntxts_eq: \"\\<E> = \\<E>'\" using fst_decomp snd_decomp unique_decomposition by blast\n    show \"r = r'\" using cntxts_eq eq by simp\n  qed\nqed simp\n\nsubsection \\<open>Stores and states\\<close>\n\ntype_synonym ('r,'l,'v) store = \"'l \\<rightharpoonup> ('r,'l,'v) val\"\ntype_synonym ('r,'l,'v) local_state = \"('r,'l,'v) store \\<times> ('r,'l,'v) store \\<times> ('r,'l,'v) expr\"\ntype_synonym ('r,'l,'v) global_state = \"'r \\<rightharpoonup> ('r,'l,'v) local_state\"\n\nfun doms :: \"('r,'l,'v) local_state \\<Rightarrow> 'l set\" where\n  \"doms (\\<sigma>,\\<tau>,e) = dom \\<sigma> \\<union> dom \\<tau>\"\n\nfun LID_snapshot :: \"('r,'l,'v) local_state \\<Rightarrow> ('r,'l,'v) store\" (\"_\\<^sub>\\<sigma>\" 200) where\n  \"LID_snapshot (\\<sigma>,\\<tau>,e) = \\<sigma>\"\n\nfun LID_local_store :: \"('r,'l,'v) local_state \\<Rightarrow> ('r,'l,'v) store\" (\"_\\<^sub>\\<tau>\" 200) where\n  \"LID_local_store (\\<sigma>,\\<tau>,e) = \\<tau>\"\n\nfun LID_expression :: \"('r,'l,'v) local_state \\<Rightarrow> ('r,'l,'v) expr\" (\"_\\<^sub>e\" 200) where\n  \"LID_expression (\\<sigma>,\\<tau>,e) = e\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Concurrent_Revisions/Data.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926666143434, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.3445189346395197}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Cong_Pres\n  imports Weak_Early_Cong Weak_Early_Step_Sim_Pres Weak_Early_Bisim_Pres\nbegin\n\nlemma tauPres:\n  fixes P :: pi\n  and   Q :: pi\n  \n  assumes \"P \\<simeq> Q\"\n\n  shows \"\\<tau>.(P) \\<simeq> \\<tau>.(Q)\"\nproof -\n  from assms have \"P \\<approx> Q\" by(rule congruenceWeakBisim)\n  thus ?thesis by(force intro: Weak_Early_Step_Sim_Pres.tauPres simp add: weakCongruence_def dest: weakBisimE(2))\nqed\n\nlemma outputPres:\n  fixes P :: pi\n  and   Q :: pi\n  \n  assumes \"P \\<simeq> Q\"\n\n  shows \"a{b}.P \\<simeq> a{b}.Q\"\nproof -\n  from assms have \"P \\<approx> Q\" by(rule congruenceWeakBisim)\n  thus ?thesis by(force intro: Weak_Early_Step_Sim_Pres.outputPres simp add: weakCongruence_def dest: weakBisimE(2))\nqed\n\n\n\n  assumes \"P \\<simeq> Q\"\n\n  shows \"[a\\<frown>b]P \\<simeq> [a\\<frown>b]Q\"\nusing assms\nby(auto simp add: weakCongruence_def intro: Weak_Early_Step_Sim_Pres.matchPres)\n\nlemma mismatchPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<simeq> Q\"\n\n  shows \"[a\\<noteq>b]P \\<simeq> [a\\<noteq>b]Q\"\nusing assms\nby(auto simp add: weakCongruence_def intro: Weak_Early_Step_Sim_Pres.mismatchPres)\n\nlemma sumPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes \"P \\<simeq> Q\"\n\n  shows \"P \\<oplus> R \\<simeq> Q \\<oplus> R\"\nusing assms\nby(auto simp add: weakCongruence_def intro: Weak_Early_Step_Sim_Pres.sumPres Weak_Early_Bisim.reflexive)\n\nlemma parPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes \"P \\<simeq> Q\"\n\n  shows \"P \\<parallel> R \\<simeq> Q \\<parallel> R\"\nproof -\n  have \"\\<And>P Q R. \\<lbrakk>P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q; P \\<approx> Q\\<rbrakk> \\<Longrightarrow> P \\<parallel> R \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q \\<parallel> R\"\n  proof -\n    fix P Q R\n    assume \"P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q\" and \"P \\<approx> Q\"\n    thus \"P \\<parallel> R \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q \\<parallel> R\"\n      using Weak_Early_Bisim_Pres.parPres Weak_Early_Bisim_Pres.resPres Weak_Early_Bisim.reflexive Weak_Early_Bisim.eqvt\n      by(blast intro: Weak_Early_Step_Sim_Pres.parPres)\n  qed\n  moreover from assms have \"P \\<approx> Q\" by(rule congruenceWeakBisim)\n  ultimately show ?thesis using assms\n    by(auto simp add: weakCongruence_def dest: weakBisimE)\nqed\n\n\n\n  assumes PeqQ: \"P \\<simeq> Q\"\n  \n  shows \"<\\<nu>x>P \\<simeq> <\\<nu>x>Q\"\nproof -\n  have \"\\<And>P Q x. P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q \\<Longrightarrow> <\\<nu>x>P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> <\\<nu>x>Q\"\n  proof -\n    fix P Q x\n    assume \"P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q\"\n    with Weak_Early_Bisim.eqvt Weak_Early_Bisim_Pres.resPres show \"<\\<nu>x>P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> <\\<nu>x>Q\"\n      by(blast intro: Weak_Early_Step_Sim_Pres.resPres)\n  qed\n  with assms show ?thesis by(simp add: weakCongruence_def)\nqed\n\n\n\n  shows \"!P \\<simeq> !Q\"\nusing assms\nproof(induct rule: weakCongISym2)\n  case(cSim P Q)\n  let ?X = \"{(P, Q) | P Q. P \\<simeq> Q}\"\n  from \\<open>P \\<simeq> Q\\<close>  have \"(P, Q) \\<in> ?X\"  by auto\n  moreover have \"\\<And>P Q. (P, Q) \\<in> ?X \\<Longrightarrow> P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q\" by(auto simp add: weakCongruence_def)\n  moreover from congruenceWeakBisim have \"?X \\<subseteq> weakBisim\" by auto\n  ultimately have \"!P \\<leadsto>\\<guillemotleft>bangRel weakBisim\\<guillemotright> !Q\" using Weak_Early_Bisim.eqvt \n    by(rule Weak_Early_Step_Sim_Pres.bangPres)\n  moreover have \"bangRel weakBisim \\<subseteq> weakBisim\" by(rule bangRelSubWeakBisim)\n  ultimately show \"!P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> !Q\"\n    by(rule Weak_Early_Step_Sim.monotonic)\nqed\n  \nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Early_Cong_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5813030906443134, "lm_q1q2_score": 0.34451892627495767}}
{"text": "(*  Title:      HOL/HOLCF/Library/Bool_Discrete.thy\n    Author:     Brian Huffman\n*)\n\nsection {* Discrete cpo instance for booleans *}\n\ntheory Bool_Discrete\nimports HOLCF\nbegin\n\ntext {* Discrete cpo instance for @{typ bool}. *}\n\ninstantiation bool :: discrete_cpo\nbegin\n\ndefinition below_bool_def:\n  \"(x::bool) \\<sqsubseteq> y \\<longleftrightarrow> x = y\"\n\ninstance proof\nqed (rule below_bool_def)\n\nend\n\ntext {*\n  TODO: implement a command to automate discrete predomain instances.\n*}\n\ninstantiation bool :: predomain\nbegin\n\ndefinition\n  \"(liftemb :: bool u \\<rightarrow> udom u) \\<equiv> liftemb oo u_map\\<cdot>(\\<Lambda> x. Discr x)\"\n\ndefinition\n  \"(liftprj :: udom u \\<rightarrow> bool u) \\<equiv> u_map\\<cdot>(\\<Lambda> y. undiscr y) oo liftprj\"\n\ndefinition\n  \"liftdefl \\<equiv> (\\<lambda>(t::bool itself). LIFTDEFL(bool discr))\"\n\ninstance proof\n  show \"ep_pair liftemb (liftprj :: udom u \\<rightarrow> bool u)\"\n    unfolding liftemb_bool_def liftprj_bool_def\n    apply (rule ep_pair_comp)\n    apply (rule ep_pair_u_map)\n    apply (simp add: ep_pair.intro)\n    apply (rule predomain_ep)\n    done\n  show \"cast\\<cdot>LIFTDEFL(bool) = liftemb oo (liftprj :: udom u \\<rightarrow> bool u)\"\n    unfolding liftemb_bool_def liftprj_bool_def liftdefl_bool_def\n    apply (simp add: cast_liftdefl cfcomp1 u_map_map)\n    apply (simp add: ID_def [symmetric] u_map_ID)\n    done\nqed\n\nend\n\nlemma cont2cont_if [simp, cont2cont]:\n  assumes b: \"cont b\" and f: \"cont f\" and g: \"cont g\"\n  shows \"cont (\\<lambda>x. if b x then f x else g x)\"\nby (rule cont_apply [OF b cont_discrete_cpo], simp add: f g)\n\nlemma cont2cont_eq [simp, cont2cont]:\n  fixes f g :: \"'a::cpo \\<Rightarrow> 'b::discrete_cpo\"\n  assumes f: \"cont f\" and g: \"cont g\"\n  shows \"cont (\\<lambda>x. f x = g x)\"\napply (rule cont_apply [OF f cont_discrete_cpo])\napply (rule cont_apply [OF g cont_discrete_cpo])\napply (rule cont_const)\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/Library/Bool_Discrete.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.34443738589626727}}
{"text": "header {* Set by Characteristic Function *}\ntheory Impl_Cfun_Set\nimports \"../Intf/Intf_Set\"\nbegin\n\ndefinition fun_set_rel where\n  fun_set_rel_internal_def: \n  \"fun_set_rel R \\<equiv> (R\\<rightarrow>bool_rel) O br Collect (\\<lambda>_. True)\"\n\nlemma fun_set_rel_def: \"\\<langle>R\\<rangle>fun_set_rel = (R\\<rightarrow>bool_rel) O br Collect (\\<lambda>_. True)\"\n  by (simp add: relAPP_def fun_set_rel_internal_def)\n\nlemma fun_set_rel_sv[relator_props]: \n  \"\\<lbrakk>single_valued R; Range R = UNIV\\<rbrakk> \\<Longrightarrow> single_valued (\\<langle>R\\<rangle>fun_set_rel)\"\n  unfolding fun_set_rel_def\n  by (tagged_solver (keep))\n\nlemma fun_set_rel_RUNIV[relator_props]:\n  assumes SV: \"single_valued R\" \n  shows \"Range (\\<langle>R\\<rangle>fun_set_rel) = UNIV\"\nproof -\n  {\n    fix b\n    have \"\\<exists>a. (a,b)\\<in>\\<langle>R\\<rangle>fun_set_rel\" unfolding fun_set_rel_def\n      apply (rule exI)\n      apply (rule relcompI)\n    proof -\n      show \"((\\<lambda>x. x\\<in>b),b)\\<in>br Collect (\\<lambda>_. True)\" by (auto simp: br_def)\n      show \"(\\<lambda>x'. \\<exists>x. (x',x)\\<in>R \\<and> x\\<in>b,\\<lambda>x. x \\<in> b)\\<in>R \\<rightarrow> bool_rel\"\n        by (auto dest: single_valuedD[OF SV])\n    qed\n  } thus ?thesis by blast\nqed\n\nlemmas [autoref_rel_intf] = REL_INTFI[of fun_set_rel i_set]\n\nlemma fs_mem_refine[autoref_rules]: \"(\\<lambda>x f. f x,op \\<in>) \\<in> R \\<rightarrow> \\<langle>R\\<rangle>fun_set_rel \\<rightarrow> bool_rel\"\n  apply (intro fun_relI)\n  apply (auto simp add: fun_set_rel_def br_def dest: fun_relD)\n  done\n\nlemma fun_set_Collect_refine[autoref_rules]: \n  \"(\\<lambda>x. x, Collect)\\<in>(R\\<rightarrow>bool_rel) \\<rightarrow> \\<langle>R\\<rangle>fun_set_rel\"\n  unfolding fun_set_rel_def\n  by (auto simp: br_def)\n\nlemma fun_set_empty_refine[autoref_rules]: \n  \"(\\<lambda>_. False,{})\\<in>\\<langle>R\\<rangle>fun_set_rel\"\n  by (force simp add: fun_set_rel_def br_def)\n\nlemma fun_set_UNIV_refine[autoref_rules]: \n  \"(\\<lambda>_. True,UNIV)\\<in>\\<langle>R\\<rangle>fun_set_rel\"\n  by (force simp add: fun_set_rel_def br_def)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/GenCF/Impl/Impl_Cfun_Set.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.3444373776110126}}
{"text": "theory flash86Bra  imports flash86Rev\n \n  begin\nlemma onInv86:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv86 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv86 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv86 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash86Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7662936430859598, "lm_q2_score": 0.4493926344647597, "lm_q1q2_score": 0.34436671903999777}}
{"text": "(*\nCopyright 2018\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*)\ntheory Word_Additions\n  imports Main SymbolicRewriting\n      \"HOL-Word.WordBitwise\"\nbegin\n\nsection \"Extensions to the Word library\"\n\ntext {*\n  The word library models two's complement representation of ints.\n  Some of the available operations:\n*}\nfind_consts \"_ word \\<Rightarrow> _ word \\<Rightarrow> _ word\"\nfind_consts \"_ word \\<Rightarrow> _ word\"\nfind_consts \"_ word \\<Rightarrow> bool list\"\nfind_consts \"nat \\<Rightarrow> _ word\"\nfind_consts \"_ word \\<Rightarrow> nat\"\nfind_consts \"int \\<Rightarrow> _ word\"\nfind_consts \"_ word \\<Rightarrow> int\"\nfind_consts \"bool list \\<Rightarrow> _ word\"\n\n\n\ntext {*\n  Take the bits from $l$ to $h$ (both including) of the word.\n*}\ndefinition take_bits :: \"nat \\<Rightarrow> nat \\<Rightarrow> 'a::len0 word \\<Rightarrow> 'b::len0 word\" (\"\\<langle>_,_\\<rangle>_\" [51,51,72] 72)\n  where \"take_bits h l w \\<equiv> of_bl (take (h + 1 - l) (drop (LENGTH('a) - h - 1) (to_bl w)))\"\n\n\nfun bv_cat :: \"'a::len0 word \\<times> nat \\<Rightarrow> 'a::len0 word \\<times> nat \\<Rightarrow> 'a::len0 word \\<times> nat\"\n  where \"bv_cat (w0,s0) (w1,s1) = (if s1 = 0 then (w0,s0) else ((w0 << s1) OR \\<langle>s1-1,0\\<rangle> w1, s0 + s1))\"\ndeclare bv_cat.simps[simp del]\n\nfun sextend :: \"'a::len word \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> 'a::len word\"\n  where \"sextend w s s' = (if w!!(s - 1) then ((\\<langle>s-1,0\\<rangle>w) OR NOT mask s) AND mask s' else \\<langle>s-1,0\\<rangle>w)\"\n\n\n\nsubsection \"Words to bytes\"\n\nfun word_to_bytes :: \"'a::len0 word \\<Rightarrow> nat \\<Rightarrow> 8 word list\"\n  where  \"word_to_bytes w s = (if s \\<le> 0 then [] else (\\<langle>s*8-1,s*8-8\\<rangle>w)#(word_to_bytes w (s-1)))\"\ndeclare word_to_bytes.simps[simp del]\nlemmas word_to_bytes_simps[simp] =\n  word_to_bytes.simps[of 0 s]\n  word_to_bytes.simps[of 1 s]\n  word_to_bytes.simps[of \"(numeral n)::'a::len0 word\" s]\n  word_to_bytes.simps[of \"- ((numeral n)::'a::len0 word)\" s]\n  for s n\n\ndefinition sublist :: \"nat \\<Rightarrow> nat \\<Rightarrow> 'a list \\<Rightarrow> 'a list\"\n  where \"sublist l h \\<equiv> take (h + 1 - l) \\<circ> (drop l)\"\n\ndefinition bytes_of :: \"nat \\<Rightarrow> nat \\<Rightarrow> 'a::len0 word \\<Rightarrow> 8 word list\"   (\"\\<lbrace>_,_\\<rbrace>_\" [51,51,72] 72)\n  where \"bytes_of h l w = (if h < l \\<or> LENGTH('a) div 8 \\<le> h then [] else sublist (LENGTH('a) div 8 - 1 - h) (LENGTH('a) div 8 - 1 - l) (word_to_bytes w (LENGTH('a) div 8)))\"\n\nabbreviation byte_of :: \"nat \\<Rightarrow> 'a::len0 word \\<Rightarrow> 8 word\" (\"\\<lbrace>_\\<rbrace> _\" [51,72] 72)\n  where \"byte_of n w \\<equiv> hd (\\<lbrace>n,n\\<rbrace> w)\"\n\nprimrec cat_bytes :: \"8 word list \\<Rightarrow> 'a::len0 word\"\n  where \"cat_bytes [] = 0\"\n  | \"cat_bytes (b#bs) = ((ucast b) << (length bs * 8)) OR cat_bytes bs\"\n\ntext {*\n  Function @{term cat_bytes} takes a list of bytes (8 words) and converts them to a 64 word.\n  This does essentially them same of @{term word_rcat}, but this version is tailored to bytes and\n  makes proves/rewriting easier.\n*}\n\nvalue \"(cat_bytes [1,2::8 word])::64 word\"\nvalue \"(cat_bytes [0,0,0,21::8 word]) :: 64 word\"\nvalue \"(word_rcat [1,2::8 word])::16 word\"\n\n\n\n  \n\n\n\nsubsection \"Additional rewrite rules for words\"\n\ntext {*\n  Additional word rewriting.\n*}\nlemma le_numeral_zero[simp]:\n  \"((numeral bin0::'a::len word) \\<le> (0::'a::len word)) = (uint (numeral bin0::'a::len word) = 0)\"\n  apply (simp add: word_le_def)\n  by (smt bintr_ge0)\nlemma le_numeral_one[simp]:\n  \"((numeral bin0::'a::len word) \\<le> (1::'a::len word)) = (uint (numeral bin0::'a::len word) \\<le> 1)\"\n  unfolding word_le_def word_le_def\n  by simp\n\nlemma le_minus_numeral[simp]:\n  \"(\n    (word_sless::('a::len word \\<Rightarrow> 'a::len word \\<Rightarrow> bool))\n     ((- (numeral bin0::'a::len word)))\n      (numeral bin1::'a::len word)\n   ) = (sint (- numeral bin0::'a::len word) < sint (numeral bin1::'a::len word))\"\n  unfolding word_sless_def word_sle_def\n  by (smt word_sint.Rep_inject)\n\nlemma le_zero_numeral[simp]:\n  \"(\n    (word_sless::('a::len word \\<Rightarrow> 'a::len word \\<Rightarrow> bool))\n     0 (numeral bin1::'a::len word)\n   ) = (0 < sint (numeral bin1::'a::len word))\"\n  unfolding word_sless_def word_sle_def\n  using word_sint.Rep_inject by fastforce\n\nlemma rewrite_le_minus[simp]:\n  shows \"((a::'a::len word) - n \\<le> a - m)  = (if a \\<ge> m then m \\<le> n \\<and> a \\<ge> n else (a-n \\<le> (max_word::'a::len word) - m + a + 1))\"\nproof(cases \"a\\<ge>m\")\n  case True\n  thus ?thesis\n  apply (auto simp add: uint_minus_simple_alt)\n    by (smt uint_sub_ge)+\nnext\n  case False\n  have 1: \"(max_word::'a::len word) - m + a + 1 = (a - m)\"\n    apply auto\n    by (metis add.left_inverse max_word_wrap)\n  show ?thesis\n    using False\n    apply (auto)\n    apply (subst 1,simp)\n    by (simp add: \"1\")\nqed\n\nlemma rewrite_le_minus_0[simp]:\n  shows \"((a::'a::len word) \\<le> a - m)  = (a \\<ge> m \\<longrightarrow> m = 0)\" \n  using rewrite_le_minus[of a 0 m]\n  apply auto\n  by (meson less_imp_le not_le word_sub_le_iff)\n\nlemma plus_less_left_cancel_nowrap: \"x \\<le> x + y' \\<Longrightarrow> x \\<le> x + y \\<Longrightarrow> x + y' \\<le> x + y \\<longleftrightarrow> y' \\<le> y\"\n  for x y y' :: \"'a::len0 word\"\n  by uint_arith\n\nlemma word_not_gr_zero[simp]:\n  fixes w :: \"'a::len0 word\"\n  shows \"\\<not> 0 < w \\<longleftrightarrow> w = 0\"\n  apply unat_arith\n  by (simp add: unat_eq_zero)\n\n\nlemma mask_numeral[simp]:\n  shows \"mask (numeral n) = (1 << (numeral n)) - 1\"\n  by (auto simp add: mask_def)\n\nlemma unfold_test_bit:\nfixes w :: \"'a::len word\"\nshows \"w !! n = (if n < LENGTH('a) then to_bl w ! (LENGTH('a) - 1 - n) else False)\"\n  using to_bl_nth[of \"LENGTH('a) - 1 - n\" w,symmetric] test_bit_bin\n  by (auto simp add: word_size)\n\nlemma is_zero_bitOR[simp]:\n  fixes a b :: \"'a::len0 word\"\n  shows \"((a OR b) = 0) = (a = 0 \\<and> b = 0)\"\n  by (metis word_bw_lcs(2) word_bw_same(2) word_log_esimps(3))\n\nlemma is_zero_all_bits:\n  fixes a :: \"'a::len0 word\"\n  shows \"(a = 0) = (\\<forall> n < LENGTH ('a) . \\<not>a !! n)\"\n  by (auto simp add: word_eq_iff)\n\nlemma is_zero_shiftl:\n  fixes a :: \"'a::len0 word\"\n  shows \"((a << n) = 0) = (n \\<ge> LENGTH('a) \\<or> (\\<forall> i < LENGTH('a) - n . \\<not>a!!i))\"\n  using less_diff_conv \n  by (auto simp add: is_zero_all_bits nth_shiftl)\n\nlemma twos_complement_subtraction[simp]:\n  fixes a b :: \"'a::len0 word\"\n  shows \"1 + (a + NOT b) = a - b\"\n  by (auto simp add: word_succ_p1 twos_complement)\n\nprimrec enum_le :: \"nat \\<Rightarrow> nat list\"\n  where \"enum_le 0 = []\"\n  | \"enum_le (Suc n) = n#(enum_le n)\"\n\nlemma spec_of_enum_le:\n  shows \"x \\<in> List.set (enum_le n) = (x < n)\"\n  by(induct n,auto)\n\nend", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/safecomp2019_artifact/old_work/isabelle/Word_Additions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381372136564, "lm_q2_score": 0.6297746074044134, "lm_q1q2_score": 0.34432179571675076}}
{"text": "section \\<open>Entry-Point to Word Library and additional lemmas for Isabelle-LLVM\\<close>\ntheory LLVM_More_Word\nimports \"HOL-Word.Word\" Bits_Natural \"Word_Lib.Word_Lemmas\"\nbegin\n(* TODO: Fix in Word.thy! \n  Introducing proper infix-syntax for signed comparisons. So, also (<s) and (<=s) get available.\n*)\nno_notation word_sle (\"(_/ <=s _)\" [50, 51] 50)\nno_notation word_sless  (\"(_/ <s _)\" [50, 51] 50)\nnotation word_sle (infix \"<=s\" 50)\nnotation word_sless (infix \"<s\" 50)\n\n(* Try to remove some useless stuff that Word_Lemmas imported via Complex_Main. *)\n\ndeclare [[coercion_enabled = false]]\n\nsubsection \\<open>Additional Lemmas\\<close>\n\nclass len2 = len +\n  assumes len2_not_1 [simp]: \"LENGTH('a) \\<noteq> Suc 0\"\n\nlemma len2_simps[simp]:\n  \"LENGTH('a::len2) > Suc 0\"\n  \"LENGTH('a::len2) \\<ge> 2\"\n  subgoal by (metis Suc_lessI len2_not_1 len_gt_0)\n  subgoal using \\<open>Suc 0 < LENGTH('a)\\<close> by linarith\n  done\n  \nlemma len2E: obtains n where \"LENGTH('a::len2) = 2+n\"\n  apply (cases \"LENGTH('a)\"; simp)\n  subgoal for k by (cases k; simp)\n  done\n  \ninstance bit0 :: (len) len2 \n  by standard simp\n  \ninstance bit1 :: (len) len2 \n  by standard simp\n  \ndefinition \"len2 (TYPE('a::len2)) \\<equiv> True\"  \n\n\n(* Original theorem is in simpset, but useless due to non-normalized LHS *)\nlemmas [simp] = word_sbin.norm_Rep[simplified]\n\n\nlemma to_bl_scast_down: \"is_down SCAST('a::len \\<rightarrow> 'b::len) \\<Longrightarrow> to_bl (SCAST('a \\<rightarrow> 'b) w) = drop (LENGTH('a)-LENGTH('b)) (to_bl w)\"  \n  by (simp add: is_down scast_down_drop source_size target_size)\n  \n\n\ndeclare word_unat.Rep_inject[simp del]\ndeclare word_uint.Rep_inject[simp del]\n\nlemma msb_uint_big: \"msb (w::'a::len word) \\<longleftrightarrow> uint w \\<ge> 2^(LENGTH('a)-1)\"      \n  apply (simp add: msb_big) \n  by (metis One_nat_def Suc_pred' diff_le_self le_antisym len_gt_0 n_not_Suc_n p2_eq_0 uint_2p word_le_def word_neq_0_conv)\n\nlemma msb_unat_big: \"msb (w::'a::len word) \\<longleftrightarrow> unat w \\<ge> 2^(LENGTH('a)-1)\"      \n  by (simp add: msb_big word_le_nat_alt)\n\n(* TODO: Move *)  \nlemma word1_neqZ_is_one: \"(a::1 word) \\<noteq> 0 \\<longleftrightarrow> a=1\"  \n  apply transfer\n  subgoal for a\n    apply (cases \"bin_last a\")\n    by auto\n  done\n  \nlemma word1_cases[cases type]: \n  fixes a :: \"1 word\" obtains (zero) \"a=0\" | (one) \"a=1\"\n  apply (cases \"a=0\")\n  by (auto simp: word1_neqZ_is_one)\n  \n(* TODO: Move *)  \nlemma word1_NOT_eq: \"~~(x::1 word) = x+1\"\n  by (auto simp: NOT_eq)\n\nlemma upcast_no_msb[simp]: \"LENGTH('small::len) < LENGTH('big::len) \\<Longrightarrow> \\<not>msb (UCAST('small \\<rightarrow> 'big) x)\" \n  apply (clarsimp simp: ucast_def msb_word_of_int)\n  apply transfer\n  using nth_bintr by auto\n  \n\nsubsection \\<open>Integer Division with Rounding Towards Zero\\<close>\n\ntext \\<open>Division with rounding towards zero\\<close>\n\nlemma int_sgn_cases: fixes a::int obtains (negative) \"a<0\" | (zero) \"a=0\" | (positive) \"a>0\"\n  by (rule linorder_cases)\n\ntext \\<open>Lemmas to match original definitions from this development to \n  definitions from Word-Library, to which we switched at some point.\\<close>\nlemma sdiv_int_original_def: \"(a::int) sdiv b = (if a\\<ge>0 \\<longleftrightarrow> b\\<ge>0 then \\<bar>a\\<bar> div \\<bar>b\\<bar> else - ( \\<bar>a\\<bar> div \\<bar>b\\<bar>))\"\n  apply (cases a rule: int_sgn_cases; cases b rule: int_sgn_cases)\n  apply (auto simp: sdiv_int_def sgn_mult)\n  done\n  \nlemma srem_int_original_def: \"(a::int) smod b = (if a\\<ge>0 then \\<bar>a\\<bar> mod \\<bar>b\\<bar> else - (\\<bar>a\\<bar> mod \\<bar>b\\<bar>))\"\n  apply (cases a rule: int_sgn_cases; cases b rule: int_sgn_cases)\n  apply (auto \n    simp: smod_int_def sdiv_int_def sgn_mult algebra_simps \n    simp flip: minus_mod_eq_mult_div mult_minus_left)\n  done  \n  \n  \ntext \\<open>Standard properties of remainders\\<close>\nlemma div_rem_rtz_id: \"(a::int) sdiv b * b + a smod b = a\"\n  by (simp add: smod_int_def)\n\nlemma abs_rem_rtz_lt: \"b\\<noteq>0 \\<Longrightarrow> \\<bar>a smod b\\<bar> < \\<bar>b::int\\<bar>\"\n  using srem_int_original_def by auto\n  \ntext \\<open>LLVM documentation: The remainder is either zero, or has the same sign as the dividend\\<close>\nlemma rem_rtz_sign: \"(a::int) smod b = 0 \\<or> sgn ((a::int) smod b) = sgn a\"\n  apply (clarsimp simp: srem_int_original_def)\n  by (smt Euclidean_Division.pos_mod_sign sgn_pos zmod_trival_iff)\n  \n\nlemma sdiv_positive[simp]: \"(a::int)\\<ge>0 \\<Longrightarrow> b\\<ge>0 \\<Longrightarrow> a sdiv b = a div b\"\n  by (simp add: sdiv_int_original_def)\n\nlemma smod_positive[simp]: \"(a::int)\\<ge>0 \\<Longrightarrow> b\\<ge>0 \\<Longrightarrow> a smod b = a mod b\"\n  by (auto simp: srem_int_original_def)\n\n\nsubsection \\<open>Additions to @{theory \"HOL-Word.Bits_Int\"}\\<close>\ndeclare bin_to_bl_def[simp del]\n\n(* TODO: Move *)\nlemma map2_eq_Nil_conv[simp]: \"map2 f a b = [] \\<longleftrightarrow> a=[] \\<or> b=[]\"\n  by (cases a; cases b; auto)\n  \nlemma bin_to_bl_eq_Nil_conv[simp]: \"bin_to_bl w i = [] \\<longleftrightarrow> w=0\"\n  by (metis bin_to_bl_aux.Z bin_to_bl_def size_bin_to_bl)\n\nlemma bin_to_bl_aux_eq_Nil_conv[simp]: \"bin_to_bl_aux w i acc = [] \\<longleftrightarrow> w=0 \\<and> acc=[]\"\n  by (metis bin_to_bl_aux.Z bin_to_bl_eq_Nil_conv take.simps(1) take_bin2bl_lem1)\n\nlemma bl_to_bin_True [simp]: \"bl_to_bin (True # bl) = bl_to_bin bl + 2^length bl\"\n  by (metis Bit_B1 add.commute add.right_neutral bin_bl_bin bin_cat_num bl_bin_bl bl_to_bin_aux.simps(2) bl_to_bin_aux_alt mult_1s(1) mult_zero_left numeral_code(1))\n\nlemma bl_to_bin_append_num: \"bl_to_bin (a@b) = 2^length b * bl_to_bin a + bl_to_bin b\"\n  by (simp add: bin_cat_num bl_to_bin_app_cat)\n\nlemma bl_to_bin_rep_True: \"bl_to_bin (replicate n True) = 2 ^ n - 1\"\n  by (metis bin_bl_bin bin_to_bl_minus1 bintr_Min)\n\nlemma bl_to_bin_rep_T: \"bl_to_bin (replicate n True @ bl) = 2 ^ length bl * (2 ^ n - 1) + bl_to_bin bl\"\n  by (simp add: bl_to_bin_append_num bl_to_bin_rep_True algebra_simps)\n\nlemma bin_to_bl_strunc[simp]: \n  \"w\\<^sub>1 \\<le> w\\<^sub>2 + 1 \\<Longrightarrow> bin_to_bl w\\<^sub>1 (sbintrunc w\\<^sub>2 i) = bin_to_bl w\\<^sub>1 i\"\n  by (simp add: bintrunc_sbintrunc_le bl_to_bin_inj)\n\nlemma bin_last_x2[simp]: \"bin_last (2*n) = False\" by (auto simp: bin_last_def)\nlemma bin_rest_x2[simp]: \"bin_rest (2*n) = n\" by (auto simp: bin_rest_def)\n\nlemma bin_to_bl_x2[simp]: \"w\\<noteq>0 \\<Longrightarrow> bin_to_bl w (2*n) = bin_to_bl (w-1) n @ [False]\"\n  by (cases w) (auto simp: bin_to_bl_def bin_to_bl_aux_append)\n\nlemma bin_to_bl_xp2[simp]:\n  assumes \"n\\<le>w\" \n  shows \"bin_to_bl w (x * 2^n) = bin_to_bl (w-n) x @ replicate n False\"\nproof -\n  have [simp]: \"x * (2 * 2 ^ n) = 2 * (x*2^n)\" for n by auto\n\n  show ?thesis using assms\n    by (induction n) (auto simp: drop_bin2bl[symmetric] replicate_append_same)\nqed\n\nlemma bintrunc_eq_if_in_range: \"bintrunc w i = i \\<longleftrightarrow> i\\<in>uints w\"\n  by (simp add: bintrunc_mod2p int_mod_lem uints_num)\n\nlemma sbintrunc_eq_if_in_range: \"sbintrunc (w-Suc 0) i = i \\<longleftrightarrow> i\\<in>sints w\"\n  by (clarsimp simp: sints_def sbintrunc_eq_in_range)\n\nlemma bl_to_bin_in_uints: \"bl_to_bin x \\<in> uints (length x)\"\n  using bl_to_bin_def bintrunc_eq_if_in_range by fastforce\n\n\n(* TODO: This is probably a special case of a more general scheme! *)\n\nmethod_setup pull_mods = \\<open>Scan.succeed (fn ctxt =>  SIMPLE_METHOD' (\n  CONVERSION (Conv.top_conv (K (Conv.try_conv (Conv.rewrs_conv @{thms pull_mods}))) ctxt)\n))\\<close>\n\nmethod_setup pull_push_mods = \\<open>Scan.succeed (fn ctxt => SIMPLE_METHOD' (\n  CONVERSION (Conv.top_conv (K (Conv.try_conv (Conv.rewrs_conv @{thms pull_mods}))) ctxt)\n  THEN' (full_simp_tac (put_simpset HOL_basic_ss ctxt addsimps @{thms mod_mod_trivial push_mods}))\n))\\<close> \\<open>Pull in, then push out modulos\\<close>\n\n\nsubsection \\<open>Signed integers in Two's Complement Representation\\<close>\n\ndefinition bl_to_sbin :: \"bool list \\<Rightarrow> int\" \n  where \"bl_to_sbin bl = sbintrunc (length bl - 1) (bl_to_bin bl)\"\n\nlemma bl_to_sbin_alt:\n  \"bl_to_sbin bl = (case bl of [] \\<Rightarrow> 0 | b#bl \\<Rightarrow> (if b then -(2^length bl) else 0) + bl_to_bin bl)\"\n  apply (auto simp: bl_to_sbin_def sbintrunc_mod2p bl_to_bin_ge0 bl_to_bin_lt2p split: list.splits)\n  by (smt bl_to_bin_ge0 bl_to_bin_lt2p int_mod_eq')\n\nlemma bl_sbin_bl[simp]: \"bin_to_bl (length bs) (bl_to_sbin bs) = bs\"\n  unfolding bl_to_sbin_def by auto\n\nlemma sbin_bl_bin[simp]:\n  \"0<w \\<Longrightarrow> bl_to_sbin (bin_to_bl w i) = sbintrunc (w-1) i\"\n  unfolding bl_to_sbin_def by auto\n\nlemma bl_to_sbin_in_sints: \"bl_to_sbin x \\<in> sints (length x)\"\n  using bl_to_sbin_def sbintrunc_eq_if_in_range by fastforce\n\n\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2020/lib/LLVM_More_Word.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.34431511086123306}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      ProcParEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader \"Examples for Procedures as Parameters\"\n\ntheory ProcParEx imports \"../Vcg\" begin\n\n\n\n\n\nlemma conseq_exploit_pre':\n             \"\\<lbrakk>\\<forall>s \\<in> S. \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile> (P \\<inter> S)c Q,A\"\n  apply (rule HoarePartialDef.Conseq)\n  apply clarify\n  by (metis IntI insertI1 subset_refl)\n\n\nlemma conseq_exploit_pre'':\n             \"\\<lbrakk>\\<forall>Z. \\<forall>s \\<in> S Z.  \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P Z) c (Q Z),(A Z)\\<rbrakk>\n              \\<Longrightarrow>\n              \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile> (P Z \\<inter> S Z)c (Q Z),(A Z)\"\n  apply (rule allI)\n  apply (rule conseq_exploit_pre')\n  apply blast\n  done\n\nlemma conseq_exploit_pre''':\n             \"\\<lbrakk>\\<forall>s \\<in> S. \\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P Z) c (Q Z),(A Z)\\<rbrakk>\n              \\<Longrightarrow>\n              \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile> (P Z \\<inter> S)c (Q Z),(A Z)\"\n  apply (rule allI)\n  apply (rule conseq_exploit_pre')\n  apply blast\n  done\n\n\n  \nrecord 'g vars = \"'g state\" +\n  compare_' :: string\n  n_'   :: nat\n  m_'   :: nat\n  b_'   :: bool\n  k_'  :: nat\n \n\n\nprocedures compare(n,m|b) = \"NoBody\"\nprint_locale! compare_signature\n\n\ncontext compare_signature\nbegin\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\<acute>b :== CALL compare(\\<acute>n,\\<acute>m)\"\nterm \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m)\"\ndeclare [[hoare_use_call_tr' = true]]\nterm \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m)\"\nend\n\n\nprocedures\n  LEQ (n,m | b) = \"\\<acute>b :== \\<acute>n \\<le> \\<acute>m\"\n  LEQ_spec: \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>}  PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) \\<lbrace>\\<acute>b = (\\<^bsup>\\<sigma>\\<^esup>n \\<le> \\<^bsup>\\<sigma>\\<^esup>m)\\<rbrace>\"\n  LEQ_modifies: \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) {t. t may_only_modify_globals \\<sigma> in []}\"\n\n\n\ndefinition mx:: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  where \"mx leq a b = (if leq a b then a else b)\"\n\nprocedures\n  Max (compare, n, m | k) = \n  \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m);;\n   IF \\<acute>b THEN \\<acute>k :== \\<acute>n ELSE \\<acute>k :== \\<acute>m FI\"\n\n  Max_spec: \"\\<And>leq. \\<forall>\\<sigma>. \\<Gamma>\\<turnstile> \n  ({\\<sigma>} \\<inter> {s. (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n              (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})})\n    PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m,\\<acute>k)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\n\n\nlemma (in Max_impl ) Max_spec1: \nshows\n\"\\<forall>\\<sigma> leq. \\<Gamma>\\<turnstile> \n  ({\\<sigma>} \\<inter> \\<lbrace> (\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n      (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\nproof -\n  fix \\<sigma>:: \"('a,'b) vars_scheme\" and s::\"('a,'b) vars_scheme\" and leq\n   assume compare_spec: \n       \"\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m\\<rbrace>\"\n \n  assume compare_modifies:\n        \"\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \n                {t. t may_only_modify_globals \\<tau> in []}\"\n\n   show \"\\<Gamma>\\<turnstile>({s} \\<inter> {\\<sigma>})\n            \\<acute>b :== DYNCALL \\<acute>compare (\\<acute>n,\\<acute>m);;\n            IF \\<acute>b THEN \\<acute>k :== \\<acute>n ELSE \\<acute>k :== \\<acute>m FI\n            \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\n     apply vcg\n     apply (clarsimp simp add: mx_def)\n     done\n qed\n\n\nlemma (in Max_impl) Max_spec2: \nshows\n\"\\<forall>\\<sigma> leq. \\<Gamma>\\<turnstile> \n  ({\\<sigma>} \\<inter> \\<lbrace>(\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n      (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in Max_impl) Max_spec3: \nshows\n\"\\<forall>n m leq. \\<Gamma>\\<turnstile> \n  (\\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace>  \\<inter> \n   \\<lbrace>(\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n     (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq n m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\n\n\nlocale Max_test = Max_spec + LEQ_spec + LEQ_modifies \nlemma (in Max_test) \n\n  shows\n  \"\\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>k :== CALL Max(LEQ_'proc,\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>k = mx (op \\<le>) \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\nproof -\n  note Max_spec = Max_spec [where leq=\"(op \\<le>)\"]\n  show ?thesis\n    apply vcg\n    apply (clarsimp)\n    apply (rule conjI)\n    apply (rule LEQ_spec [simplified])\n    apply (rule LEQ_modifies [simplified])\n    done\nqed\n\n\nlemma (in Max_impl) Max_spec5:\nshows\n\"\\<forall>n m leq. \\<Gamma>\\<turnstile> \n  (\\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace> \\<inter> \\<lbrace>\\<forall>n' m'. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n' \\<and> \\<acute>m=m'\\<rbrace> \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq n' m')\\<rbrace>\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq n m\\<rbrace>\"\nterm \"\\<lbrace>{s. \\<^bsup>s\\<^esup>n = n' \\<and> \\<^bsup>s\\<^esup>m = m'} = X\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply clarsimp\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in LEQ_impl)\n LEQ_spec: \"\\<forall>n m. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace>  PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) \\<lbrace>\\<acute>b = (n \\<le> m)\\<rbrace>\"\n  apply vcg\n  done\n\n\nlocale Max_test' = Max_impl + LEQ_impl\nlemma (in Max_test') \n  shows\n  \"\\<forall>n m. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace> \\<acute>k :== CALL Max(LEQ_'proc,\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>k = mx (op \\<le>) n m\\<rbrace>\"\nproof -\n  note Max_spec = Max_spec5\n  show ?thesis\n    apply vcg\n    apply (rule_tac x=\"op \\<le>\" in exI)\n    apply clarsimp\n    apply (rule LEQ_spec [rule_format])\n    done\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Simpl/ex/ProcParEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3443151021119291}}
{"text": "subsection \\<open>1-out-of-2 OT to 1-out-of-4 OT\\<close>\n\ntext \\<open>Here we construct a protocol that achieves 1-out-of-4 OT from 1-out-of-2 OT. We follow the protocol\nfor constructing 1-out-of-n OT from 1-out-of-2 OT from \\<^cite>\\<open>\"DBLP:books/cu/Goldreich2004\"\\<close>. We assume the security\nproperties on 1-out-of-2 OT.\\<close>\n\ntheory OT14 imports\n  Semi_Honest_Def\n  OT_Functionalities\n  Uniform_Sampling\nbegin\n\ntype_synonym input1 = \"bool \\<times> bool \\<times> bool \\<times> bool\"\ntype_synonym input2 = \"bool \\<times> bool\"\ntype_synonym 'v_OT121' view1 = \"(input1 \\<times> (bool \\<times> bool \\<times> bool \\<times> bool \\<times> bool \\<times> bool) \\<times> 'v_OT121' \\<times> 'v_OT121' \\<times> 'v_OT121')\"\ntype_synonym 'v_OT122' view2 = \"(input2 \\<times> (bool \\<times> bool \\<times> bool \\<times> bool) \\<times> 'v_OT122' \\<times> 'v_OT122' \\<times> 'v_OT122')\"\n\nlocale ot14_base = \n  fixes S1_OT12 :: \"(bool \\<times> bool) \\<Rightarrow> unit \\<Rightarrow> 'v_OT121 spmf\" \\<comment> \\<open>simulator for party 1 in OT12\\<close>\n    and R1_OT12 :: \"(bool \\<times> bool) \\<Rightarrow> bool \\<Rightarrow> 'v_OT121 spmf\" \\<comment> \\<open>real view for party 1 in OT12\\<close>\n    and adv_OT12 :: real\n    and S2_OT12 :: \"bool \\<Rightarrow> bool \\<Rightarrow> 'v_OT122 spmf\" \n    and R2_OT12 :: \"(bool \\<times> bool) \\<Rightarrow> bool \\<Rightarrow> 'v_OT122 spmf\"\n    and protocol_OT12 :: \"(bool \\<times> bool) \\<Rightarrow> bool \\<Rightarrow> (unit \\<times> bool) spmf\"\n  assumes ass_adv_OT12: \"sim_det_def.adv_P1 R1_OT12 S1_OT12 funct_OT12 (m0,m1) c D \\<le> adv_OT12\" \\<comment> \\<open>bound the advantage of OT12 for party 1\\<close> \n    and inf_th_OT12_P2:  \"sim_det_def.perfect_sec_P2 R2_OT12 S2_OT12 funct_OT12 (m0,m1) \\<sigma>\" \\<comment> \\<open>information theoretic security for party 2\\<close>\n    and correct: \"protocol_OT12 msgs b = funct_OT_12 msgs b\"\n    and lossless_R1_12: \"lossless_spmf (R1_OT12 m c)\"\n    and lossless_S1_12: \"lossless_spmf (S1_OT12 m out1)\"\n    and lossless_S2_12: \"lossless_spmf (S2_OT12 c out2)\"\n    and lossless_R2_12: \"lossless_spmf (R2_OT12 M c)\"\n    and lossless_funct_OT12: \"lossless_spmf (funct_OT12 (m0,m1) c)\"\n    and lossless_protocol_OT12: \"lossless_spmf (protocol_OT12 M C)\"\nbegin\n\nsublocale OT_12_sim: sim_det_def R1_OT12 S1_OT12 R2_OT12 S2_OT12 funct_OT_12 protocol_OT12\n  unfolding sim_det_def_def \n  by(simp add: lossless_R1_12 lossless_S1_12 lossless_funct_OT12 lossless_R2_12 lossless_S2_12)\n\nlemma OT_12_P1_assms_bound': \"\\<bar>spmf (bind_spmf (R1_OT12 (m0,m1) c) (\\<lambda> view. ((D::'v_OT121 \\<Rightarrow> bool spmf) view ))) True \n                - spmf (bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (D view ))) True\\<bar> \\<le> adv_OT12\"\nproof-\n  have \"sim_det_def.adv_P1 R1_OT12 S1_OT12 funct_OT_12 (m0,m1) c D =\n                      \\<bar>spmf (bind_spmf (R1_OT12 (m0,m1) c) (\\<lambda> view. (D view ))) True \n                                    - spmf (funct_OT_12 (m0,m1) c \\<bind> (\\<lambda> ((out1::unit), (out2::bool)). \n                                              S1_OT12 (m0,m1) out1 \\<bind> (\\<lambda> view. D view))) True\\<bar>\"\n    using sim_det_def.adv_P1_def \n    using  OT_12_sim.adv_P1_def by auto\n  also have \"... = \\<bar>spmf (bind_spmf (R1_OT12 (m0,m1) c) (\\<lambda> view. ((D::'v_OT121 \\<Rightarrow> bool spmf) view ))) True \n                - spmf (bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (D view ))) True\\<bar>\" \n    by(simp add: funct_OT_12_def)\n  ultimately show ?thesis \n    by(metis ass_adv_OT12)\nqed\n\nlemma OT_12_P2_assm: \"R2_OT12 (m0,m1) \\<sigma> = funct_OT_12 (m0,m1) \\<sigma> \\<bind> (\\<lambda> (out1, out2). S2_OT12 \\<sigma> out2)\"\n  using inf_th_OT12_P2 OT_12_sim.perfect_sec_P2_def by blast\n\ndefinition protocol_14_OT :: \"input1 \\<Rightarrow> input2 \\<Rightarrow> (unit \\<times> bool) spmf\"\n  where \"protocol_14_OT M C = do {\n    let (c0,c1) = C;\n    let (m00, m01, m10, m11) = M;\n    S0 \\<leftarrow> coin_spmf;\n    S1 \\<leftarrow> coin_spmf;\n    S2 \\<leftarrow> coin_spmf;\n    S3 \\<leftarrow> coin_spmf;\n    S4 \\<leftarrow> coin_spmf;\n    S5 \\<leftarrow> coin_spmf;\n    let a0 = S0 \\<oplus> S2 \\<oplus> m00;\n    let a1 = S0 \\<oplus> S3 \\<oplus> m01;\n    let a2 = S1 \\<oplus> S4 \\<oplus> m10;\n    let a3 = S1 \\<oplus> S5 \\<oplus> m11;\n    (_,Si) \\<leftarrow> protocol_OT12 (S0, S1) c0;\n    (_,Sj) \\<leftarrow> protocol_OT12 (S2, S3) c1;\n    (_,Sk) \\<leftarrow> protocol_OT12 (S4, S5) c1;\n    let s2 = Si \\<oplus> (if c0 then Sk else Sj) \\<oplus> (if c0 then (if c1 then a3 else a2) else (if c1 then a1 else a0));\n    return_spmf ((), s2)}\"\n\nlemma lossless_protocol_14_OT: \"lossless_spmf (protocol_14_OT M C)\" \n  by(simp add: protocol_14_OT_def lossless_protocol_OT12 split_def)\n\ndefinition R1_14 :: \"input1 \\<Rightarrow> input2 \\<Rightarrow> 'v_OT121 view1 spmf\"\n  where \"R1_14 msgs choice = do {\n    let (m00, m01, m10, m11) = msgs;\n    let (c0, c1) = choice;\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a :: 'v_OT121 \\<leftarrow> R1_OT12 (S0, S1) c0; \n    b :: 'v_OT121 \\<leftarrow> R1_OT12 (S2, S3) c1;\n    c :: 'v_OT121 \\<leftarrow> R1_OT12 (S4, S5) c1;\n    return_spmf (msgs, (S0, S1, S2, S3, S4, S5), a, b, c)}\"\n\nlemma lossless_R1_14: \"lossless_spmf (R1_14 msgs C)\"\n  by(simp add: R1_14_def split_def lossless_R1_12)\n\ndefinition R1_14_interm1 :: \"input1 \\<Rightarrow> input2 \\<Rightarrow> 'v_OT121 view1 spmf\"\n  where \"R1_14_interm1 msgs choice = do {\n    let (m00, m01, m10, m11) = msgs;\n    let (c0, c1) = choice;\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a :: 'v_OT121 \\<leftarrow> S1_OT12 (S0, S1) (); \n    b :: 'v_OT121 \\<leftarrow> R1_OT12 (S2, S3) c1;\n    c :: 'v_OT121 \\<leftarrow> R1_OT12 (S4, S5) c1;\n    return_spmf (msgs, (S0, S1, S2, S3, S4, S5), a, b, c)}\"\n\nlemma lossless_R1_14_interm1: \"lossless_spmf (R1_14_interm1 msgs C)\"\n  by(simp add: R1_14_interm1_def split_def lossless_R1_12 lossless_S1_12)\n\ndefinition R1_14_interm2 :: \"input1 \\<Rightarrow> input2 \\<Rightarrow> 'v_OT121 view1 spmf\"\n  where \"R1_14_interm2 msgs choice = do {\n    let (m00, m01, m10, m11) = msgs;\n    let (c0, c1) = choice;\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a :: 'v_OT121 \\<leftarrow> S1_OT12 (S0, S1) (); \n    b :: 'v_OT121 \\<leftarrow> S1_OT12 (S2, S3) ();\n    c :: 'v_OT121 \\<leftarrow> R1_OT12 (S4, S5) c1;\n    return_spmf (msgs, (S0, S1, S2, S3, S4, S5), a, b, c)}\"\n\nlemma lossless_R1_14_interm2: \"lossless_spmf (R1_14_interm2 msgs C)\"\n  by(simp add: R1_14_interm2_def split_def lossless_R1_12 lossless_S1_12)\n\ndefinition S1_14 :: \"input1 \\<Rightarrow> unit \\<Rightarrow> 'v_OT121 view1 spmf\"\n  where \"S1_14 msgs _ = do {   \n    let (m00, m01, m10, m11) = msgs;    \n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a :: 'v_OT121 \\<leftarrow> S1_OT12 (S0, S1) (); \n    b :: 'v_OT121 \\<leftarrow> S1_OT12 (S2, S3) ();\n    c :: 'v_OT121 \\<leftarrow> S1_OT12 (S4, S5) ();\n    return_spmf (msgs, (S0, S1, S2, S3, S4, S5), a, b, c)}\"\n\nlemma lossless_S1_14: \"lossless_spmf (S1_14 m out)\"\n  by(simp add: S1_14_def lossless_S1_12)\n\nlemma reduction_step1: \n  shows \"\\<exists> A1. \\<bar>spmf (bind_spmf (R1_14 M (c0, c1)) D) True - spmf (bind_spmf (R1_14_interm1 M (c0, c1)) D) True\\<bar> =\n              \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c0) (\\<lambda> view. (A1 view (m0,m1))))) True -\n                  spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1 view (m0,m1))))) True\\<bar>\"\n  including monad_normalisation\nproof-\n  define A1' where \"A1' == \\<lambda> (view :: 'v_OT121) (m0,m1). do {\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    b :: 'v_OT121 \\<leftarrow> R1_OT12 (S2, S3) c1;\n    c :: 'v_OT121 \\<leftarrow> R1_OT12 (S4, S5) c1;\n    let R = (M, (m0,m1, S2, S3, S4, S5), view, b, c);\n    D R}\"\n  have \"\\<bar>spmf (bind_spmf (R1_14 M (c0, c1)) D) True - spmf (bind_spmf (R1_14_interm1 M (c0, c1)) D) True\\<bar> =\n       \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c0) (\\<lambda> view. (A1' view (m0,m1))))) True -\n        spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1' view (m0,m1))))) True\\<bar>\"\n    apply(simp add: pair_spmf_alt_def R1_14_def R1_14_interm1_def A1'_def Let_def split_def) \n    apply(subst bind_commute_spmf[of \"S1_OT12 _ _\"])\n    apply(subst bind_commute_spmf[of \"S1_OT12 _ _\"])\n    apply(subst bind_commute_spmf[of \"S1_OT12 _ _\"])\n    apply(subst bind_commute_spmf[of \"S1_OT12 _ _\"])\n    apply(subst bind_commute_spmf[of \"S1_OT12 _ _\"])\n    by auto\n  then show ?thesis by auto\nqed\n\nlemma reduction_step1':\n  shows \"\\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c0) (\\<lambda> view. (A1 view (m0,m1))))) True -\n                  spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1 view (m0,m1))))) True\\<bar> \n                        \\<le> adv_OT12\"\n  (is \"?lhs \\<le> adv_OT12\")\nproof-\n  have int1: \"integrable (measure_spmf (pair_spmf coin_spmf coin_spmf)) (\\<lambda>x. spmf (case x of (m0, m1) \\<Rightarrow> R1_OT12 (m0, m1) c0 \\<bind> (\\<lambda>view. A1 view (m0, m1))) True)\" \n    and int2: \"integrable (measure_spmf (pair_spmf coin_spmf coin_spmf)) (\\<lambda>x. spmf (case x of (m0, m1) \\<Rightarrow> S1_OT12 (m0, m1) () \\<bind> (\\<lambda>view. A1 view (m0, m1))) True)\" \n    by(rule measure_spmf.integrable_const_bound[where B=1]; simp add: pmf_le_1)+\n  have \"?lhs = \n            \\<bar>LINT x|measure_spmf (pair_spmf coin_spmf coin_spmf). spmf (case x of (m0, m1) \\<Rightarrow> R1_OT12 (m0, m1) c0 \\<bind> (\\<lambda>view. A1 view (m0, m1))) True \n              - spmf (case x of (m0, m1) \\<Rightarrow> S1_OT12 (m0, m1) () \\<bind> (\\<lambda>view. A1 view (m0, m1))) True\\<bar>\"\n    apply(subst (1 2) spmf_bind) using int1 int2 by simp\n  also have \"... \\<le> LINT x|measure_spmf (pair_spmf coin_spmf coin_spmf). \n               \\<bar>spmf (R1_OT12 x c0 \\<bind> (\\<lambda>view. A1 view x)) True - spmf (S1_OT12 x () \\<bind> (\\<lambda>view. A1 view x)) True\\<bar>\"\n    by(rule integral_abs_bound[THEN order_trans]; simp add: split_beta)\n  ultimately have \"?lhs \\<le> LINT x|measure_spmf (pair_spmf coin_spmf coin_spmf). \n                      \\<bar>spmf (R1_OT12 x c0 \\<bind> (\\<lambda>view. A1 view x)) True - spmf (S1_OT12 x () \\<bind> (\\<lambda>view. A1 view x)) True\\<bar>\"\n    by simp\n  also have \"LINT x|measure_spmf (pair_spmf coin_spmf coin_spmf). \n                \\<bar>spmf (R1_OT12 x c0 \\<bind> (\\<lambda>view::'v_OT121. A1 view x)) True \n                    - spmf (S1_OT12 x () \\<bind> (\\<lambda>view::'v_OT121. A1 view x)) True\\<bar> \\<le> adv_OT12\"\n    apply(rule integral_mono[THEN order_trans])\n       apply(rule measure_spmf.integrable_const_bound[where B=2])\n        apply clarsimp\n        apply(rule abs_triangle_ineq4[THEN order_trans])\n    subgoal for m0 m1\n      using pmf_le_1[of \"R1_OT12 (m0, m1) c0 \\<bind> (\\<lambda>view. A1 view (m0, m1))\" \"Some True\"]\n        pmf_le_1[of \"S1_OT12 (m0, m1) () \\<bind> (\\<lambda>view. A1 view (m0, m1))\" \"Some True\"]\n      by simp\n       apply simp\n      apply(rule measure_spmf.integrable_const)\n     apply clarify\n     apply(rule OT_12_P1_assms_bound'[rule_format]) \n    by simp\n  ultimately show ?thesis by simp\nqed\n\nlemma reduction_step2: \n  shows \"\\<exists> A1. \\<bar>spmf (bind_spmf (R1_14_interm1 M (c0, c1)) D) True - spmf (bind_spmf (R1_14_interm2 M (c0, c1)) D) True\\<bar> =\n          \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A1 view (m0,m1))))) True -\n            spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1 view (m0,m1))))) True\\<bar>\"\nproof-\n  define A1' where \"A1' == \\<lambda> (view :: 'v_OT121) (m0,m1). do {\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a :: 'v_OT121 \\<leftarrow> S1_OT12 (S2,S3) ();\n    c :: 'v_OT121 \\<leftarrow> R1_OT12 (S4, S5) c1;\n    let R = (M, (S2,S3, m0, m1, S4, S5), a, view, c);\n    D R}\"\n  have \"\\<bar>spmf (bind_spmf (R1_14_interm1 M (c0, c1)) D) True - spmf (bind_spmf (R1_14_interm2 M (c0, c1)) D) True\\<bar> =\n       \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A1' view (m0,m1))))) True -\n        spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1' view (m0,m1))))) True\\<bar>\"\n  proof-\n    have \"(bind_spmf (R1_14_interm1 M (c0, c1)) D) = (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A1' view (m0,m1)))))\"\n      unfolding R1_14_interm1_def R1_14_interm2_def A1'_def Let_def split_def\n      apply(simp add: pair_spmf_alt_def) \n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      including monad_normalisation by(simp)\n    also have \"(bind_spmf (R1_14_interm2 M (c0, c1)) D) =  (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1' view (m0,m1)))))\"\n      unfolding R1_14_interm1_def R1_14_interm2_def A1'_def Let_def split_def\n      apply(simp add: pair_spmf_alt_def) \n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\"  in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\"  in \"_ = \\<hole>\" bind_commute_spmf)\n      by(simp)  \n    ultimately show ?thesis by simp\n  qed\n  then show ?thesis by auto\nqed\n\nlemma reduction_step3: \n  shows \"\\<exists> A1. \\<bar>spmf (bind_spmf (R1_14_interm2 M (c0, c1)) D) True - spmf (bind_spmf (S1_14 M out) D) True\\<bar> =\n          \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A1 view (m0,m1))))) True -\n            spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1 view (m0,m1))))) True\\<bar>\"\nproof-\n  define A1' where \"A1' == \\<lambda> (view :: 'v_OT121) (m0,m1). do {\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a :: 'v_OT121 \\<leftarrow> S1_OT12 (S2,S3) ();\n    b :: 'v_OT121 \\<leftarrow> S1_OT12 (S4, S5) ();\n    let R = (M, (S2,S3, S4, S5,m0, m1), a, b, view);\n    D R}\"\n  have \"\\<bar>spmf (bind_spmf (R1_14_interm2 M (c0, c1)) D) True - spmf (bind_spmf (S1_14 M out) D) True\\<bar> =\n       \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A1' view (m0,m1))))) True -\n        spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1' view (m0,m1))))) True\\<bar>\"\n  proof-\n    have \"(bind_spmf (R1_14_interm2 M (c0, c1)) D) = (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A1' view (m0,m1)))))\"\n      unfolding  R1_14_interm2_def A1'_def Let_def split_def\n      apply(simp add: pair_spmf_alt_def) \n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      including monad_normalisation by(simp)\n    also have \"(bind_spmf (S1_14 M out) D) = (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1' view (m0,m1)))))\"\n      unfolding S1_14_def Let_def A1'_def split_def\n      apply(simp add: pair_spmf_alt_def) \n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n      apply(rewrite in \"\\<hole> = _\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n      apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n      including monad_normalisation by(simp)\n    ultimately show ?thesis by simp\n  qed\n  then show ?thesis by auto\nqed\n\nlemma reduction_P1_interm: \n  shows \"\\<bar>spmf (bind_spmf (R1_14 M (c0,c1)) (D)) True - spmf (bind_spmf (S1_14 M out) (D)) True\\<bar> \\<le> 3 * adv_OT12\"\n    (is \"?lhs \\<le> ?rhs\")\nproof-\n  have lhs: \"?lhs \\<le> \\<bar>spmf (bind_spmf (R1_14 M (c0, c1)) D) True - spmf (bind_spmf (R1_14_interm1 M (c0, c1)) D) True\\<bar> + \n                     \\<bar>spmf (bind_spmf (R1_14_interm1 M (c0, c1)) D) True - spmf (bind_spmf (R1_14_interm2 M (c0, c1)) D) True\\<bar> +\n                      \\<bar>spmf (bind_spmf (R1_14_interm2 M (c0, c1)) D) True - spmf (bind_spmf (S1_14 M out) D) True\\<bar>\"\n    by simp\n  obtain A1 where A1: \"\\<bar>spmf (bind_spmf (R1_14 M (c0, c1)) D) True - spmf (bind_spmf (R1_14_interm1 M (c0, c1)) D) True\\<bar> =\n                        \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c0) (\\<lambda> view. (A1 view (m0,m1))))) True -\n                          spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1 view (m0,m1))))) True\\<bar>\"\n    using reduction_step1 by blast\n  obtain A2 where A2: \"\\<bar>spmf (bind_spmf (R1_14_interm1 M (c0, c1)) D) True - spmf (bind_spmf (R1_14_interm2 M (c0, c1)) D) True\\<bar> = \n                        \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A2 view (m0,m1))))) True -\n                          spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A2 view (m0,m1))))) True\\<bar>\"\n    using reduction_step2 by blast\n  obtain A3 where A3: \"\\<bar>spmf (bind_spmf (R1_14_interm2 M (c0, c1)) D) True - spmf (bind_spmf (S1_14 M out) D) True\\<bar> =\n                        \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A3 view (m0,m1))))) True -\n                          spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A3 view (m0,m1))))) True\\<bar>\"\n    using reduction_step3 by blast\n  have lhs_bound: \"?lhs \\<le> \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c0) (\\<lambda> view. (A1 view (m0,m1))))) True -\n                  spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1 view (m0,m1))))) True\\<bar> + \n                   \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A2 view (m0,m1))))) True -\n                    spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A2 view (m0,m1))))) True\\<bar> +\n                     \\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A3 view (m0,m1))))) True -\n                      spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A3 view (m0,m1))))) True\\<bar>\"\n    using A1 A2 A3 lhs by simp\n  have bound1: \"\\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c0) (\\<lambda> view. (A1 view (m0,m1))))) True -\n                  spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A1 view (m0,m1))))) True\\<bar> \n                      \\<le> adv_OT12\" \n    and bound2: \"\\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A2 view (m0,m1))))) True -\n                  spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A2 view (m0,m1))))) True\\<bar> \n                      \\<le> adv_OT12\" \n    and bound3: \"\\<bar>spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (R1_OT12 (m0,m1) c1) (\\<lambda> view. (A3 view (m0,m1))))) True -\n        spmf (bind_spmf (pair_spmf coin_spmf coin_spmf) (\\<lambda>(m0, m1). bind_spmf (S1_OT12 (m0,m1) ()) (\\<lambda> view. (A3 view (m0,m1))))) True\\<bar> \\<le> adv_OT12\"\n    using reduction_step1' by auto\n  thus ?thesis\n    using reduction_step1' lhs_bound by argo  \nqed\n\nlemma reduction_P1: \"\\<bar>spmf (bind_spmf (R1_14 M (c0,c1)) (D)) True \n                        - spmf (funct_OT_14 M (c0,c1) \\<bind> (\\<lambda> (out1,out2). S1_14 M out1 \\<bind> (\\<lambda> view. D view))) True\\<bar> \n                              \\<le> 3 * adv_OT12\"\n  by(simp add: funct_OT_14_def split_def Let_def reduction_P1_interm )\n\ntext\\<open>Party 2 security.\\<close>\n\nlemma coin_coin: \"map_spmf (\\<lambda> S0. S0 \\<oplus> S3 \\<oplus> m1) coin_spmf = coin_spmf\"\n  (is \"?lhs = ?rhs\")\nproof-\n  have lhs: \"?lhs = map_spmf (\\<lambda> S0. S0 \\<oplus> (S3 \\<oplus> m1)) coin_spmf\" by blast\n  also have op_eq: \"... = map_spmf ((\\<oplus>) (S3 \\<oplus> m1)) coin_spmf\" \n    by (metis xor_bool_def)\n  also have \"... = ?rhs\" \n    using xor_uni_samp by fastforce\n  ultimately show ?thesis \n    using op_eq by auto\nqed\n\nlemma coin_coin': \"map_spmf (\\<lambda> S3. S0 \\<oplus> S3 \\<oplus> m1) coin_spmf = coin_spmf\"\nproof-\n  have \"map_spmf (\\<lambda> S3. S0 \\<oplus> S3 \\<oplus> m1) coin_spmf = map_spmf (\\<lambda> S3. S3 \\<oplus> S0 \\<oplus> m1) coin_spmf\" \n    by (metis xor_left_commute)\n  thus ?thesis using coin_coin by simp\nqed\n\ndefinition R2_14:: \"input1 \\<Rightarrow> input2 \\<Rightarrow> 'v_OT122 view2 spmf\"\n  where \"R2_14 M C = do {\n    let (m0,m1,m2,m3) = M;\n    let (c0,c1) = C;\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    let a0 = S0 \\<oplus> S2 \\<oplus> m0;\n    let a1 = S0 \\<oplus> S3 \\<oplus> m1;\n    let a2 = S1 \\<oplus> S4 \\<oplus> m2;\n    let a3 = S1 \\<oplus> S5 \\<oplus> m3; \n    a :: 'v_OT122 \\<leftarrow> R2_OT12 (S0,S1) c0;\n    b :: 'v_OT122 \\<leftarrow> R2_OT12 (S2,S3) c1;\n    c :: 'v_OT122 \\<leftarrow> R2_OT12 (S4,S5) c1;\n    return_spmf (C, (a0,a1,a2,a3), a,b,c)}\"\n\nlemma lossless_R2_14: \"lossless_spmf (R2_14 M C)\"\n  by(simp add: R2_14_def split_def lossless_R2_12)\n\ndefinition S2_14 :: \"input2 \\<Rightarrow> bool \\<Rightarrow> 'v_OT122 view2 spmf\"\n  where \"S2_14 C out = do {\n    let ((c0::bool),(c1::bool)) = C;\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> coin_spmf;\n    a1 :: bool \\<leftarrow> coin_spmf;\n    a2 :: bool \\<leftarrow> coin_spmf;\n    a3 :: bool \\<leftarrow> coin_spmf;\n    let a0' = (if ((\\<not> c0) \\<and> (\\<not> c1)) then (S0 \\<oplus> S2 \\<oplus> out) else a0);\n    let a1' = (if ((\\<not> c0) \\<and> c1) then (S0 \\<oplus> S3 \\<oplus> out) else a1);\n    let a2' = (if (c0 \\<and> (\\<not> c1)) then (S1 \\<oplus> S4 \\<oplus> out) else a2);\n    let a3' = (if (c0 \\<and> c1) then (S1 \\<oplus> S5 \\<oplus> out) else a3);\n    a :: 'v_OT122 \\<leftarrow> S2_OT12 (c0::bool) (if c0 then S1 else S0);\n    b :: 'v_OT122 \\<leftarrow> S2_OT12 (c1::bool) (if c1 then S3 else S2);\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 (c1::bool) (if c1 then S5 else S4);\n    return_spmf ((c0,c1), (a0',a1',a2',a3'), a,b,c)}\"\n\nlemma lossless_S2_14: \"lossless_spmf (S2_14 c out)\" \n  by(simp add: S2_14_def lossless_S2_12 split_def)\n\nlemma P2_OT_14_FT: \"R2_14 (m0,m1,m2,m3) (False,True) = funct_OT_14 (m0,m1,m2,m3) (False,True) \\<bind> (\\<lambda> (out1, out2). S2_14 (False,True) out2)\"\n  including monad_normalisation\nproof-\n  have \"R2_14 (m0,m1,m2,m3) (False,True) =  do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> map_spmf (\\<lambda> S2. S0 \\<oplus> S2 \\<oplus> m0) coin_spmf;\n    let a1 = S0 \\<oplus> S3 \\<oplus> m1;\n    a2 \\<leftarrow> map_spmf (\\<lambda> S4. S1 \\<oplus> S4 \\<oplus> m2) coin_spmf;\n    let a3 = S1 \\<oplus> S5 \\<oplus> m3; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 False S0; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 True S3;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 True S5;\n    return_spmf ((False,True), (a0,a1,a2,a3), a,b,c)}\"\n    by(simp add: bind_map_spmf o_def Let_def R2_14_def inf_th_OT12_P2 funct_OT_12_def OT_12_P2_assm)\n  also have \"... =  do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> coin_spmf;\n    let a1 = S0 \\<oplus> S3 \\<oplus> m1;\n    a2 \\<leftarrow> coin_spmf;\n    let a3 = S1 \\<oplus> S5 \\<oplus> m3; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 False S0; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 True S3;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 True S5;\n    return_spmf ((False,True), (a0,a1,a2,a3), a,b,c)}\"\n    using coin_coin' by simp\n  also have \"... =  do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> coin_spmf;\n    let a1 = S0 \\<oplus> S3 \\<oplus> m1;\n    a2 :: bool \\<leftarrow> coin_spmf;\n    a3 \\<leftarrow> map_spmf (\\<lambda> S1. S1 \\<oplus> S5 \\<oplus> m3) coin_spmf; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 False S0; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 True S3;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 True S5;\n    return_spmf ((False,True), (a0,a1,a2,a3), a,b,c)}\"\n    by(simp add: bind_map_spmf o_def Let_def)\n  also have \"... =  do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> coin_spmf;\n    let a1 = S0 \\<oplus> S3 \\<oplus> m1;\n    a2 :: bool \\<leftarrow> coin_spmf;\n    a3 \\<leftarrow> coin_spmf; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 False S0; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 True S3;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 True S5;\n    return_spmf ((False,True), (a0,a1,a2,a3), a,b,c)}\"\n    using coin_coin by simp\n  ultimately show ?thesis \n    by(simp add: funct_OT_14_def S2_14_def bind_spmf_const)\nqed\n\nlemma P2_OT_14_TT: \"R2_14 (m0,m1,m2,m3) (True,True) = funct_OT_14 (m0,m1,m2,m3) (True,True) \\<bind> (\\<lambda> (out1, out2). S2_14 (True,True) out2)\"\n  including monad_normalisation\nproof-\n  have \"R2_14 (m0,m1,m2,m3) (True,True) =  do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> map_spmf (\\<lambda> S2. S0 \\<oplus> S2 \\<oplus> m0) coin_spmf;\n    let a1 = S0 \\<oplus> S3 \\<oplus> m1;\n    a2 \\<leftarrow> map_spmf (\\<lambda> S4. S1 \\<oplus> S4 \\<oplus> m2) coin_spmf;\n    let a3 = S1 \\<oplus> S5 \\<oplus> m3;\n    a :: 'v_OT122 \\<leftarrow> S2_OT12 True S1; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 True S3;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 True S5;\n    return_spmf ((True,True), (a0,a1,a2,a3), a,b,c)}\"\n    by(simp add: bind_map_spmf o_def R2_14_def inf_th_OT12_P2 funct_OT_12_def OT_12_P2_assm Let_def)\n  also have \"... = do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> coin_spmf;\n    let a1 = S0 \\<oplus> S3 \\<oplus> m1;\n    a2 \\<leftarrow> coin_spmf;\n    let a3 = S1 \\<oplus> S5 \\<oplus> m3;\n    a :: 'v_OT122 \\<leftarrow> S2_OT12 True S1; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 True S3;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 True S5;\n    return_spmf ((True,True), (a0,a1,a2,a3), a,b,c)}\"\n    using coin_coin' by simp\n  also have \"... = do {\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> coin_spmf;\n    a1 :: bool \\<leftarrow> map_spmf (\\<lambda> S0. S0 \\<oplus> S3 \\<oplus> m1) coin_spmf;\n    a2 \\<leftarrow> coin_spmf;\n    let a3 = S1 \\<oplus> S5 \\<oplus> m3;\n    a :: 'v_OT122 \\<leftarrow> S2_OT12 True S1; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 True S3;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 True S5;\n    return_spmf ((True,True), (a0,a1,a2,a3), a,b,c)}\"\n    by(simp add: bind_map_spmf o_def Let_def)    \n  also have \"... = do {\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S3 :: bool \\<leftarrow> coin_spmf;\n    S5 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> coin_spmf;\n    a1 :: bool \\<leftarrow> coin_spmf;\n    a2 \\<leftarrow> coin_spmf;\n    let a3 = S1 \\<oplus> S5 \\<oplus> m3;\n    a :: 'v_OT122 \\<leftarrow> S2_OT12 True S1; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 True S3;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 True S5;\n    return_spmf ((True,True), (a0,a1,a2,a3), a,b,c)}\"\n    using coin_coin by simp\n  ultimately show ?thesis\n    by(simp add: funct_OT_14_def S2_14_def bind_spmf_const)\nqed\n\nlemma P2_OT_14_FF: \"R2_14 (m0,m1,m2,m3) (False, False) = funct_OT_14 (m0,m1,m2,m3) (False, False) \\<bind> (\\<lambda> (out1, out2). S2_14 (False, False) out2)\"\n  including monad_normalisation\nproof-\n  have \"R2_14 (m0,m1,m2,m3) (False,False) =  do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    let a0 = S0 \\<oplus> S2 \\<oplus> m0;\n    a1 :: bool \\<leftarrow> map_spmf (\\<lambda> S3. S0 \\<oplus> S3 \\<oplus> m1) coin_spmf;\n    let a2 = S1 \\<oplus> S4 \\<oplus> m2;\n    a3 \\<leftarrow> map_spmf (\\<lambda> S5. S1 \\<oplus> S5 \\<oplus> m3) coin_spmf; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 False S0; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 False S2;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 False S4;\n    return_spmf ((False,False), (a0,a1,a2,a3), a,b,c)}\"\n    by(simp add: bind_map_spmf o_def R2_14_def inf_th_OT12_P2 funct_OT_12_def OT_12_P2_assm Let_def)\n  also have \"... = do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    let a0 = S0 \\<oplus> S2 \\<oplus> m0;\n    a1 :: bool \\<leftarrow> coin_spmf;\n    let a2 = S1 \\<oplus> S4 \\<oplus> m2;\n    a3 \\<leftarrow> coin_spmf; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 False S0; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 False S2;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 False S4;\n    return_spmf ((False,False), (a0,a1,a2,a3), a,b,c)}\"\n    using coin_coin' by simp\n  also have \"... = do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    let a0 = S0 \\<oplus> S2 \\<oplus> m0;\n    a1 :: bool \\<leftarrow> coin_spmf;\n    a2 :: bool \\<leftarrow> map_spmf (\\<lambda> S1. S1 \\<oplus> S4 \\<oplus> m2) coin_spmf;\n    a3 \\<leftarrow> coin_spmf; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 False S0; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 False S2;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 False S4;\n    return_spmf ((False,False), (a0,a1,a2,a3), a,b,c)}\"\n    by(simp add: bind_map_spmf o_def Let_def)\n  also have \"... = do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    let a0 = S0 \\<oplus> S2 \\<oplus> m0;\n    a1 :: bool \\<leftarrow> coin_spmf;\n    a2 :: bool \\<leftarrow> coin_spmf;\n    a3 \\<leftarrow> coin_spmf; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 False S0; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 False S2;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 False S4;\n    return_spmf ((False,False), (a0,a1,a2,a3), a,b,c)}\"\n    using coin_coin by simp\n  ultimately show ?thesis \n    by(simp add: funct_OT_14_def S2_14_def bind_spmf_const)\nqed\n\nlemma P2_OT_14_TF: \"R2_14 (m0,m1,m2,m3) (True,False) = funct_OT_14 (m0,m1,m2,m3) (True,False) \\<bind> (\\<lambda> (out1, out2). S2_14 (True,False) out2)\"\n  including monad_normalisation\nproof-\n  have \"R2_14 (m0,m1,m2,m3) (True,False) = do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    let a0 = S0 \\<oplus> S2 \\<oplus> m0;\n    a1 :: bool \\<leftarrow> map_spmf (\\<lambda> S3. S0 \\<oplus> S3 \\<oplus> m1) coin_spmf;\n    let a2 = S1 \\<oplus> S4 \\<oplus> m2;\n    a3 \\<leftarrow> map_spmf (\\<lambda> S5. S1 \\<oplus> S5 \\<oplus> m3) coin_spmf; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 True S1; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 False S2;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 False S4;\n    return_spmf ((True,False), (a0,a1,a2,a3), a,b,c)}\"\n    apply(simp add: R2_14_def inf_th_OT12_P2 OT_12_P2_assm funct_OT_12_def Let_def)\n    apply(rewrite in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n    apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n    apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\"  in \"bind_spmf _ \\<hole>\" in \"\\<hole> = _\" bind_commute_spmf)\n    by(simp add: bind_map_spmf o_def Let_def)\n  also have \"... = do {\n    S0 :: bool \\<leftarrow> coin_spmf;\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    let a0 = S0 \\<oplus> S2 \\<oplus> m0;\n    a1 :: bool \\<leftarrow> coin_spmf;\n    let a2 = S1 \\<oplus> S4 \\<oplus> m2;\n    a3 \\<leftarrow> coin_spmf; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 True S1; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 False S2;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 False S4;\n    return_spmf ((True,False), (a0,a1,a2,a3), a,b,c)}\"\n    using coin_coin' by simp\n  also have \"... = do {\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> map_spmf (\\<lambda> S0. S0 \\<oplus> S2 \\<oplus> m0) coin_spmf;\n    a1 :: bool \\<leftarrow> coin_spmf;\n    let a2 = S1 \\<oplus> S4 \\<oplus> m2;\n    a3 \\<leftarrow> coin_spmf; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 True S1; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 False S2;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 False S4;\n    return_spmf ((True,False), (a0,a1,a2,a3), a,b,c)}\"\n    by(simp add: bind_map_spmf o_def Let_def)\n  also have \"... = do {\n    S1 :: bool \\<leftarrow> coin_spmf;\n    S2 :: bool \\<leftarrow> coin_spmf;\n    S4 :: bool \\<leftarrow> coin_spmf;\n    a0 :: bool \\<leftarrow> coin_spmf;\n    a1 :: bool \\<leftarrow> coin_spmf;\n    let a2 = S1 \\<oplus> S4 \\<oplus> m2;\n    a3 \\<leftarrow> coin_spmf; \n    a :: 'v_OT122 \\<leftarrow> S2_OT12 True S1; \n    b :: 'v_OT122 \\<leftarrow> S2_OT12 False S2;\n    c :: 'v_OT122 \\<leftarrow> S2_OT12 False S4;\n    return_spmf ((True,False), (a0,a1,a2,a3), a,b,c)}\"\n    using coin_coin by simp\n  ultimately show ?thesis\n    apply(simp add: funct_OT_14_def S2_14_def bind_spmf_const)\n    apply(rewrite in \"bind_spmf _ \\<hole>\"  in \"_ = \\<hole>\" bind_commute_spmf)\n    apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n    apply(rewrite in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"bind_spmf _ \\<hole>\" in \"_ = \\<hole>\" bind_commute_spmf)\n    by simp\nqed\n\nlemma P2_sec_OT_14_split: \"R2_14 (m0,m1,m2,m3) (c0,c1) = funct_OT_14 (m0,m1,m2,m3) (c0,c1) \\<bind> (\\<lambda> (out1, out2). S2_14 (c0,c1) out2)\"\n  by(cases c0; cases c1; auto simp add: P2_OT_14_FF P2_OT_14_TF P2_OT_14_FT P2_OT_14_TT)\n\nlemma P2_sec_OT_14: \"R2_14 M C = funct_OT_14 M C \\<bind> (\\<lambda> (out1, out2). S2_14 C out2)\"\n  by(metis P2_sec_OT_14_split surj_pair) \n\nsublocale OT_14: sim_det_def R1_14 S1_14 R2_14 S2_14 funct_OT_14 protocol_14_OT\n  unfolding sim_det_def_def \n  by(simp add: lossless_R1_14 lossless_S1_14 lossless_funct_14_OT lossless_R2_14 lossless_S2_14 )\n\nlemma correctness_OT_14: \n  shows \"funct_OT_14 M C = protocol_14_OT M C\"\nproof-\n  have \"S1 = (S5 = (S1 = (S5 = d))) = d\" for S1 S5 d by auto\n  thus ?thesis\n    by(cases \"fst C\"; cases \"snd C\"; simp add: funct_OT_14_def protocol_14_OT_def correct funct_OT_12_def lossless_funct_OT_12 bind_spmf_const split_def)\nqed\n\nlemma OT_14_correct: \"OT_14.correctness M C\"\n  unfolding OT_14.correctness_def \n  using correctness_OT_14 by auto\n\nlemma OT_14_P2_sec: \"OT_14.perfect_sec_P2 m1 m2\"\n  unfolding OT_14.perfect_sec_P2_def\n  using P2_sec_OT_14 by blast\n\nlemma OT_14_P1_sec: \"OT_14.adv_P1 m1 m2 D \\<le> 3 * adv_OT12\"\n  unfolding OT_14.adv_P1_def  \n  by (metis reduction_P1 surj_pair) \n\nend\n\nlocale OT_14_asymp = sim_det_def +\n  fixes S1_OT12 :: \"nat \\<Rightarrow> (bool \\<times> bool) \\<Rightarrow> unit \\<Rightarrow> 'v_OT121 spmf\"\n    and R1_OT12 :: \"nat \\<Rightarrow> (bool \\<times> bool) \\<Rightarrow> bool \\<Rightarrow> 'v_OT121 spmf\" \n    and adv_OT12 :: \"nat \\<Rightarrow> real\"\n    and S2_OT12 :: \"nat \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> 'v_OT122 spmf\" \n    and R2_OT12 :: \"nat \\<Rightarrow> (bool \\<times> bool) \\<Rightarrow> bool \\<Rightarrow> 'v_OT122 spmf\"\n    and protocol_OT12 :: \"(bool \\<times> bool) \\<Rightarrow> bool \\<Rightarrow> (unit \\<times> bool) spmf\"\n  assumes ot14_base: \"\\<And> (n::nat). ot14_base (S1_OT12 n) (R1_12_0T n) (adv_OT12 n) (S2_OT12 n) (R2_12OT n) (protocol_OT12)\"\nbegin \n\nsublocale ot14_base \"(S1_OT12 n)\" \"(R1_12_0T n)\" \"(adv_OT12 n)\" \"(S2_OT12 n)\" \"(R2_12OT n)\" using local.ot14_base by simp\n\nlemma OT_14_P1_sec: \"OT_14.adv_P1 (R1_12_0T n) n m1 m2 D \\<le> 3 * (adv_OT12 n)\"\n  unfolding OT_14.adv_P1_def using reduction_P1 surj_pair by metis\n\ntheorem OT_14_P1_asym_sec: \"negligible (\\<lambda> n. OT_14.adv_P1 (R1_12_0T n) n m1 m2 D)\" if \"negligible (\\<lambda> n. adv_OT12 n)\"\nproof-\n  have adv_neg: \"negligible (\\<lambda>n. 3 * adv_OT12 n)\" using that negligible_cmultI by simp\n  have \"\\<bar>OT_14.adv_P1 (R1_12_0T n) n m1 m2 D\\<bar> \\<le> \\<bar>3 * (adv_OT12 n)\\<bar>\" for n \n  proof -\n    have \"\\<bar>OT_14.adv_P1 (R1_12_0T n) n m1 m2 D\\<bar> \\<le> 3 * adv_OT12 n\"\n      using OT_14.adv_P1_def OT_14_P1_sec by auto\n    then show ?thesis\n      by (meson abs_ge_self order_trans)\n  qed\n  thus ?thesis using OT_14_P1_sec negligible_le adv_neg \n    by (metis (no_types, lifting) negligible_absI)\nqed\n\ntheorem OT_14_P2_asym_sec: \"OT_14.perfect_sec_P2 R2_OT12 n m1 m2\"\n  using OT_14_P2_sec by simp\n\nend\n\nend\n\n\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Multi_Party_Computation/OT14.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.34431509390668297}}
{"text": "theory CR\nimports Lam_Funs\nbegin\n\ntext \\<open>The Church-Rosser proof from Barendregt's book\\<close>\n\nlemma forget: \n  assumes asm: \"x\\<sharp>L\"\n  shows \"L[x::=P] = L\"\nusing asm\nproof (nominal_induct L avoiding: x P rule: lam.strong_induct)\n  case (Var z)\n  have \"x\\<sharp>Var z\" by fact\n  thus \"(Var z)[x::=P] = (Var z)\" by (simp add: fresh_atm)\nnext \n  case (App M1 M2)\n  have \"x\\<sharp>App M1 M2\" by fact\n  moreover\n  have ih1: \"x\\<sharp>M1 \\<Longrightarrow> M1[x::=P] = M1\" by fact\n  moreover\n  have ih1: \"x\\<sharp>M2 \\<Longrightarrow> M2[x::=P] = M2\" by fact\n  ultimately show \"(App M1 M2)[x::=P] = (App M1 M2)\" by simp\nnext\n  case (Lam z M)\n  have vc: \"z\\<sharp>x\" \"z\\<sharp>P\" by fact+\n  have ih: \"x\\<sharp>M \\<Longrightarrow>  M[x::=P] = M\" by fact\n  have asm: \"x\\<sharp>Lam [z].M\" by fact\n  then have \"x\\<sharp>M\" using vc by (simp add: fresh_atm abs_fresh)\n  then have \"M[x::=P] = M\" using ih by simp\n  then show \"(Lam [z].M)[x::=P] = Lam [z].M\" using vc by simp\nqed\n\nlemma forget_automatic: \n  assumes asm: \"x\\<sharp>L\"\n  shows \"L[x::=P] = L\"\n  using asm \nby (nominal_induct L avoiding: x P rule: lam.strong_induct)\n   (auto simp add: abs_fresh fresh_atm)\n\nlemma fresh_fact: \n  fixes z::\"name\"\n  assumes asms: \"z\\<sharp>N\" \"z\\<sharp>L\"\n  shows \"z\\<sharp>(N[y::=L])\"\nusing asms\nproof (nominal_induct N avoiding: z y L rule: lam.strong_induct)\n  case (Var u)\n  have \"z\\<sharp>(Var u)\" \"z\\<sharp>L\" by fact+\n  thus \"z\\<sharp>((Var u)[y::=L])\" by simp\nnext\n  case (App N1 N2)\n  have ih1: \"\\<lbrakk>z\\<sharp>N1; z\\<sharp>L\\<rbrakk> \\<Longrightarrow> z\\<sharp>N1[y::=L]\" by fact\n  moreover\n  have ih2: \"\\<lbrakk>z\\<sharp>N2; z\\<sharp>L\\<rbrakk> \\<Longrightarrow> z\\<sharp>N2[y::=L]\" by fact\n  moreover \n  have \"z\\<sharp>App N1 N2\" \"z\\<sharp>L\" by fact+\n  ultimately show \"z\\<sharp>((App N1 N2)[y::=L])\" by simp \nnext\n  case (Lam u N1)\n  have vc: \"u\\<sharp>z\" \"u\\<sharp>y\" \"u\\<sharp>L\" by fact+\n  have \"z\\<sharp>Lam [u].N1\" by fact\n  hence \"z\\<sharp>N1\" using vc by (simp add: abs_fresh fresh_atm)\n  moreover\n  have ih: \"\\<lbrakk>z\\<sharp>N1; z\\<sharp>L\\<rbrakk> \\<Longrightarrow> z\\<sharp>(N1[y::=L])\" by fact\n  moreover\n  have  \"z\\<sharp>L\" by fact\n  ultimately show \"z\\<sharp>(Lam [u].N1)[y::=L]\" using vc by (simp add: abs_fresh)\nqed\n\nlemma fresh_fact_automatic: \n  fixes z::\"name\"\n  assumes asms: \"z\\<sharp>N\" \"z\\<sharp>L\"\n  shows \"z\\<sharp>(N[y::=L])\"\n  using asms \nby (nominal_induct N avoiding: z y L rule: lam.strong_induct)\n   (auto simp add: abs_fresh fresh_atm)\n\nlemma fresh_fact': \n  fixes a::\"name\"\n  assumes a: \"a\\<sharp>t2\"\n  shows \"a\\<sharp>t1[a::=t2]\"\nusing a \nby (nominal_induct t1 avoiding: a t2 rule: lam.strong_induct)\n   (auto simp add: abs_fresh fresh_atm)\n\nlemma substitution_lemma:  \n  assumes a: \"x\\<noteq>y\"\n  and     b: \"x\\<sharp>L\"\n  shows \"M[x::=N][y::=L] = M[y::=L][x::=N[y::=L]]\"\nusing a b\nproof (nominal_induct M avoiding: x y N L rule: lam.strong_induct)\n  case (Var z) (* case 1: Variables*)\n  have \"x\\<noteq>y\" by fact\n  have \"x\\<sharp>L\" by fact\n  show \"Var z[x::=N][y::=L] = Var z[y::=L][x::=N[y::=L]]\" (is \"?LHS = ?RHS\")\n  proof -\n    { (*Case 1.1*)\n      assume  \"z=x\"\n      have \"(1)\": \"?LHS = N[y::=L]\" using \\<open>z=x\\<close> by simp\n      have \"(2)\": \"?RHS = N[y::=L]\" using \\<open>z=x\\<close> \\<open>x\\<noteq>y\\<close> by simp\n      from \"(1)\" \"(2)\" have \"?LHS = ?RHS\"  by simp\n    }\n    moreover \n    { (*Case 1.2*)\n      assume \"z=y\" and \"z\\<noteq>x\" \n      have \"(1)\": \"?LHS = L\"               using \\<open>z\\<noteq>x\\<close> \\<open>z=y\\<close> by simp\n      have \"(2)\": \"?RHS = L[x::=N[y::=L]]\" using \\<open>z=y\\<close> by simp\n      have \"(3)\": \"L[x::=N[y::=L]] = L\"    using \\<open>x\\<sharp>L\\<close> by (simp add: forget)\n      from \"(1)\" \"(2)\" \"(3)\" have \"?LHS = ?RHS\" by simp\n    }\n    moreover \n    { (*Case 1.3*)\n      assume \"z\\<noteq>x\" and \"z\\<noteq>y\"\n      have \"(1)\": \"?LHS = Var z\" using \\<open>z\\<noteq>x\\<close> \\<open>z\\<noteq>y\\<close> by simp\n      have \"(2)\": \"?RHS = Var z\" using \\<open>z\\<noteq>x\\<close> \\<open>z\\<noteq>y\\<close> by simp\n      from \"(1)\" \"(2)\" have \"?LHS = ?RHS\" by simp\n    }\n    ultimately show \"?LHS = ?RHS\" by blast\n  qed\nnext\n  case (Lam z M1) (* case 2: lambdas *)\n  have ih: \"\\<lbrakk>x\\<noteq>y; x\\<sharp>L\\<rbrakk> \\<Longrightarrow> M1[x::=N][y::=L] = M1[y::=L][x::=N[y::=L]]\" by fact\n  have \"x\\<noteq>y\" by fact\n  have \"x\\<sharp>L\" by fact\n  have fs: \"z\\<sharp>x\" \"z\\<sharp>y\" \"z\\<sharp>N\" \"z\\<sharp>L\" by fact+\n  hence \"z\\<sharp>N[y::=L]\" by (simp add: fresh_fact)\n  show \"(Lam [z].M1)[x::=N][y::=L] = (Lam [z].M1)[y::=L][x::=N[y::=L]]\" (is \"?LHS=?RHS\") \n  proof - \n    have \"?LHS = Lam [z].(M1[x::=N][y::=L])\" using \\<open>z\\<sharp>x\\<close> \\<open>z\\<sharp>y\\<close> \\<open>z\\<sharp>N\\<close> \\<open>z\\<sharp>L\\<close> by simp\n    also from ih have \"\\<dots> = Lam [z].(M1[y::=L][x::=N[y::=L]])\" using \\<open>x\\<noteq>y\\<close> \\<open>x\\<sharp>L\\<close> by simp\n    also have \"\\<dots> = (Lam [z].(M1[y::=L]))[x::=N[y::=L]]\" using \\<open>z\\<sharp>x\\<close> \\<open>z\\<sharp>N[y::=L]\\<close> by simp\n    also have \"\\<dots> = ?RHS\" using  \\<open>z\\<sharp>y\\<close> \\<open>z\\<sharp>L\\<close> by simp\n    finally show \"?LHS = ?RHS\" .\n  qed\nnext\n  case (App M1 M2) (* case 3: applications *)\n  thus \"(App M1 M2)[x::=N][y::=L] = (App M1 M2)[y::=L][x::=N[y::=L]]\" by simp\nqed\n\nlemma substitution_lemma_automatic:  \n  assumes asm: \"x\\<noteq>y\" \"x\\<sharp>L\"\n  shows \"M[x::=N][y::=L] = M[y::=L][x::=N[y::=L]]\"\n  using asm \nby (nominal_induct M avoiding: x y N L rule: lam.strong_induct)\n   (auto simp add: fresh_fact forget)\n\nsection \\<open>Beta Reduction\\<close>\n\ninductive\n  \"Beta\" :: \"lam\\<Rightarrow>lam\\<Rightarrow>bool\" (\" _ \\<longrightarrow>\\<^sub>\\<beta> _\" [80,80] 80)\nwhere\n    b1[intro]: \"s1\\<longrightarrow>\\<^sub>\\<beta>s2 \\<Longrightarrow> (App s1 t)\\<longrightarrow>\\<^sub>\\<beta>(App s2 t)\"\n  | b2[intro]: \"s1\\<longrightarrow>\\<^sub>\\<beta>s2 \\<Longrightarrow> (App t s1)\\<longrightarrow>\\<^sub>\\<beta>(App t s2)\"\n  | b3[intro]: \"s1\\<longrightarrow>\\<^sub>\\<beta>s2 \\<Longrightarrow> (Lam [a].s1)\\<longrightarrow>\\<^sub>\\<beta> (Lam [a].s2)\"\n  | b4[intro]: \"a\\<sharp>s2 \\<Longrightarrow> (App (Lam [a].s1) s2)\\<longrightarrow>\\<^sub>\\<beta>(s1[a::=s2])\"\n\nequivariance Beta\n\nnominal_inductive Beta\n  by (simp_all add: abs_fresh fresh_fact')\n\ninductive\n  \"Beta_star\"  :: \"lam\\<Rightarrow>lam\\<Rightarrow>bool\" (\" _ \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* _\" [80,80] 80)\nwhere\n    bs1[intro, simp]: \"M \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M\"\n  | bs2[intro]: \"\\<lbrakk>M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M2; M2 \\<longrightarrow>\\<^sub>\\<beta> M3\\<rbrakk> \\<Longrightarrow> M1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M3\"\n\nequivariance Beta_star\n\nlemma beta_star_trans:\n  assumes a1: \"M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M2\"\n  and     a2: \"M2\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M3\"\n  shows \"M1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M3\"\nusing a2 a1\nby (induct) (auto)\n\nsection \\<open>One-Reduction\\<close>\n\ninductive\n  One :: \"lam\\<Rightarrow>lam\\<Rightarrow>bool\" (\" _ \\<longrightarrow>\\<^sub>1 _\" [80,80] 80)\nwhere\n    o1[intro!]:      \"M\\<longrightarrow>\\<^sub>1M\"\n  | o2[simp,intro!]: \"\\<lbrakk>t1\\<longrightarrow>\\<^sub>1t2;s1\\<longrightarrow>\\<^sub>1s2\\<rbrakk> \\<Longrightarrow> (App t1 s1)\\<longrightarrow>\\<^sub>1(App t2 s2)\"\n  | o3[simp,intro!]: \"s1\\<longrightarrow>\\<^sub>1s2 \\<Longrightarrow> (Lam [a].s1)\\<longrightarrow>\\<^sub>1(Lam [a].s2)\"\n  | o4[simp,intro!]: \"\\<lbrakk>a\\<sharp>(s1,s2); s1\\<longrightarrow>\\<^sub>1s2;t1\\<longrightarrow>\\<^sub>1t2\\<rbrakk> \\<Longrightarrow> (App (Lam [a].t1) s1)\\<longrightarrow>\\<^sub>1(t2[a::=s2])\"\n\nequivariance One\n\nnominal_inductive One\n  by (simp_all add: abs_fresh fresh_fact')\n\ninductive\n  \"One_star\"  :: \"lam\\<Rightarrow>lam\\<Rightarrow>bool\" (\" _ \\<longrightarrow>\\<^sub>1\\<^sup>* _\" [80,80] 80)\nwhere\n    os1[intro, simp]: \"M \\<longrightarrow>\\<^sub>1\\<^sup>* M\"\n  | os2[intro]: \"\\<lbrakk>M1\\<longrightarrow>\\<^sub>1\\<^sup>* M2; M2 \\<longrightarrow>\\<^sub>1 M3\\<rbrakk> \\<Longrightarrow> M1 \\<longrightarrow>\\<^sub>1\\<^sup>* M3\"\n\nequivariance One_star \n\nlemma one_star_trans:\n  assumes a1: \"M1\\<longrightarrow>\\<^sub>1\\<^sup>* M2\" \n  and     a2: \"M2\\<longrightarrow>\\<^sub>1\\<^sup>* M3\"\n  shows \"M1\\<longrightarrow>\\<^sub>1\\<^sup>* M3\"\nusing a2 a1\nby (induct) (auto)\n\nlemma one_fresh_preserv:\n  fixes a :: \"name\"\n  assumes a: \"t\\<longrightarrow>\\<^sub>1s\"\n  and     b: \"a\\<sharp>t\"\n  shows \"a\\<sharp>s\"\nusing a b\nproof (induct)\n  case o1 thus ?case by simp\nnext\n  case o2 thus ?case by simp\nnext\n  case (o3 s1 s2 c)\n  have ih: \"a\\<sharp>s1 \\<Longrightarrow>  a\\<sharp>s2\" by fact\n  have c: \"a\\<sharp>Lam [c].s1\" by fact\n  show ?case\n  proof (cases \"a=c\")\n    assume \"a=c\" thus \"a\\<sharp>Lam [c].s2\" by (simp add: abs_fresh)\n  next\n    assume d: \"a\\<noteq>c\" \n    with c have \"a\\<sharp>s1\" by (simp add: abs_fresh)\n    hence \"a\\<sharp>s2\" using ih by simp\n    thus \"a\\<sharp>Lam [c].s2\" using d by (simp add: abs_fresh) \n  qed\nnext \n  case (o4 c t1 t2 s1 s2)\n  have i1: \"a\\<sharp>t1 \\<Longrightarrow> a\\<sharp>t2\" by fact\n  have i2: \"a\\<sharp>s1 \\<Longrightarrow> a\\<sharp>s2\" by fact\n  have as: \"a\\<sharp>App (Lam [c].s1) t1\" by fact\n  hence c1: \"a\\<sharp>Lam [c].s1\" and c2: \"a\\<sharp>t1\" by (simp add: fresh_prod)+\n  from c2 i1 have c3: \"a\\<sharp>t2\" by simp\n  show \"a\\<sharp>s2[c::=t2]\"\n  proof (cases \"a=c\")\n    assume \"a=c\"\n    thus \"a\\<sharp>s2[c::=t2]\" using c3 by (simp add: fresh_fact')\n  next\n    assume d1: \"a\\<noteq>c\"\n    from c1 d1 have \"a\\<sharp>s1\" by (simp add: abs_fresh)\n    hence \"a\\<sharp>s2\" using i2 by simp\n    thus \"a\\<sharp>s2[c::=t2]\" using c3 by (simp add: fresh_fact)\n  qed\nqed\n\nlemma one_fresh_preserv_automatic:\n  fixes a :: \"name\"\n  assumes a: \"t\\<longrightarrow>\\<^sub>1s\"\n  and     b: \"a\\<sharp>t\"\n  shows \"a\\<sharp>s\"\nusing a b\napply(nominal_induct avoiding: a rule: One.strong_induct)\napply(auto simp add: abs_fresh fresh_atm fresh_fact)\ndone\n\nlemma subst_rename: \n  assumes a: \"c\\<sharp>t1\"\n  shows \"t1[a::=t2] = ([(c,a)]\\<bullet>t1)[c::=t2]\"\nusing a\nby (nominal_induct t1 avoiding: a c t2 rule: lam.strong_induct)\n   (auto simp add: calc_atm fresh_atm abs_fresh)\n\nlemma one_abs: \n  assumes a: \"Lam [a].t\\<longrightarrow>\\<^sub>1t'\"\n  shows \"\\<exists>t''. t'=Lam [a].t'' \\<and> t\\<longrightarrow>\\<^sub>1t''\"\nproof -\n  have \"a\\<sharp>Lam [a].t\" by (simp add: abs_fresh)\n  with a have \"a\\<sharp>t'\" by (simp add: one_fresh_preserv)\n  with a show ?thesis\n    by (cases rule: One.strong_cases[where a=\"a\" and aa=\"a\"])\n       (auto simp add: lam.inject abs_fresh alpha)\nqed\n\nlemma one_app: \n  assumes a: \"App t1 t2 \\<longrightarrow>\\<^sub>1 t'\"\n  shows \"(\\<exists>s1 s2. t' = App s1 s2 \\<and> t1 \\<longrightarrow>\\<^sub>1 s1 \\<and> t2 \\<longrightarrow>\\<^sub>1 s2) \\<or> \n         (\\<exists>a s s1 s2. t1 = Lam [a].s \\<and> t' = s1[a::=s2] \\<and> s \\<longrightarrow>\\<^sub>1 s1 \\<and> t2 \\<longrightarrow>\\<^sub>1 s2 \\<and> a\\<sharp>(t2,s2))\"\nusing a by (erule_tac One.cases) (auto simp add: lam.inject)\n\nlemma one_red: \n  assumes a: \"App (Lam [a].t1) t2 \\<longrightarrow>\\<^sub>1 M\" \"a\\<sharp>(t2,M)\"\n  shows \"(\\<exists>s1 s2. M = App (Lam [a].s1) s2 \\<and> t1 \\<longrightarrow>\\<^sub>1 s1 \\<and> t2 \\<longrightarrow>\\<^sub>1 s2) \\<or> \n         (\\<exists>s1 s2. M = s1[a::=s2] \\<and> t1 \\<longrightarrow>\\<^sub>1 s1 \\<and> t2 \\<longrightarrow>\\<^sub>1 s2)\" \nusing a\nby (cases rule: One.strong_cases [where a=\"a\" and aa=\"a\"])\n   (auto dest: one_abs simp add: lam.inject abs_fresh alpha fresh_prod)\n\ntext \\<open>first case in Lemma 3.2.4\\<close>\n\nlemma one_subst_aux:\n  assumes a: \"N\\<longrightarrow>\\<^sub>1N'\"\n  shows \"M[x::=N] \\<longrightarrow>\\<^sub>1 M[x::=N']\"\nusing a\nproof (nominal_induct M avoiding: x N N' rule: lam.strong_induct)\n  case (Var y) \n  thus \"Var y[x::=N] \\<longrightarrow>\\<^sub>1 Var y[x::=N']\" by (cases \"x=y\") auto\nnext\n  case (App P Q) (* application case - third line *)\n  thus \"(App P Q)[x::=N] \\<longrightarrow>\\<^sub>1  (App P Q)[x::=N']\" using o2 by simp\nnext \n  case (Lam y P) (* abstraction case - fourth line *)\n  thus \"(Lam [y].P)[x::=N] \\<longrightarrow>\\<^sub>1 (Lam [y].P)[x::=N']\" using o3 by simp\nqed\n\nlemma one_subst_aux_automatic:\n  assumes a: \"N\\<longrightarrow>\\<^sub>1N'\"\n  shows \"M[x::=N] \\<longrightarrow>\\<^sub>1 M[x::=N']\"\nusing a\nby (nominal_induct M avoiding: x N N' rule: lam.strong_induct)\n   (auto simp add: fresh_prod fresh_atm)\n\nlemma one_subst: \n  assumes a: \"M\\<longrightarrow>\\<^sub>1M'\"\n  and     b: \"N\\<longrightarrow>\\<^sub>1N'\"\n  shows \"M[x::=N]\\<longrightarrow>\\<^sub>1M'[x::=N']\" \nusing a b\nproof (nominal_induct M M' avoiding: N N' x rule: One.strong_induct)\n  case (o1 M)\n  thus ?case by (simp add: one_subst_aux)\nnext\n  case (o2 M1 M2 N1 N2)\n  thus ?case by simp\nnext\n  case (o3 a M1 M2)\n  thus ?case by simp\nnext\n  case (o4 a N1 N2 M1 M2 N N' x)\n  have vc: \"a\\<sharp>N\" \"a\\<sharp>N'\" \"a\\<sharp>x\" \"a\\<sharp>N1\" \"a\\<sharp>N2\" by fact+\n  have asm: \"N\\<longrightarrow>\\<^sub>1N'\" by fact\n  show ?case\n  proof -\n    have \"(App (Lam [a].M1) N1)[x::=N] = App (Lam [a].(M1[x::=N])) (N1[x::=N])\" using vc by simp\n    moreover have \"App (Lam [a].(M1[x::=N])) (N1[x::=N]) \\<longrightarrow>\\<^sub>1 M2[x::=N'][a::=N2[x::=N']]\" \n      using o4 asm by (simp add: fresh_fact)\n    moreover have \"M2[x::=N'][a::=N2[x::=N']] = M2[a::=N2][x::=N']\" \n      using vc by (simp add: substitution_lemma fresh_atm)\n    ultimately show \"(App (Lam [a].M1) N1)[x::=N] \\<longrightarrow>\\<^sub>1 M2[a::=N2][x::=N']\" by simp\n  qed\nqed\n\nlemma one_subst_automatic: \n  assumes a: \"M\\<longrightarrow>\\<^sub>1M'\" \n  and     b: \"N\\<longrightarrow>\\<^sub>1N'\"\n  shows \"M[x::=N]\\<longrightarrow>\\<^sub>1M'[x::=N']\" \nusing a b\nby (nominal_induct M M' avoiding: N N' x rule: One.strong_induct)\n   (auto simp add: one_subst_aux substitution_lemma fresh_atm fresh_fact)\n\nlemma diamond[rule_format]:\n  fixes    M :: \"lam\"\n  and      M1:: \"lam\"\n  assumes a: \"M\\<longrightarrow>\\<^sub>1M1\" \n  and     b: \"M\\<longrightarrow>\\<^sub>1M2\"\n  shows \"\\<exists>M3. M1\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\"\n  using a b\nproof (nominal_induct avoiding: M1 M2 rule: One.strong_induct)\n  case (o1 M) (* case 1 --- M1 = M *)\n  thus \"\\<exists>M3. M\\<longrightarrow>\\<^sub>1M3 \\<and>  M2\\<longrightarrow>\\<^sub>1M3\" by blast\nnext\n  case (o4 x Q Q' P P') (* case 2 --- a beta-reduction occurs*)\n  have vc: \"x\\<sharp>Q\" \"x\\<sharp>Q'\" \"x\\<sharp>M2\" by fact+\n  have i1: \"\\<And>M2. Q \\<longrightarrow>\\<^sub>1M2 \\<Longrightarrow> (\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3)\" by fact\n  have i2: \"\\<And>M2. P \\<longrightarrow>\\<^sub>1M2 \\<Longrightarrow> (\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3)\" by fact\n  have \"App (Lam [x].P) Q \\<longrightarrow>\\<^sub>1 M2\" by fact\n  hence \"(\\<exists>P' Q'. M2 = App (Lam [x].P') Q' \\<and> P\\<longrightarrow>\\<^sub>1P' \\<and> Q\\<longrightarrow>\\<^sub>1Q') \\<or> \n         (\\<exists>P' Q'. M2 = P'[x::=Q'] \\<and> P\\<longrightarrow>\\<^sub>1P' \\<and> Q\\<longrightarrow>\\<^sub>1Q')\" using vc by (simp add: one_red)\n  moreover (* subcase 2.1 *)\n  { assume \"\\<exists>P' Q'. M2 = App (Lam [x].P') Q' \\<and> P\\<longrightarrow>\\<^sub>1P' \\<and> Q\\<longrightarrow>\\<^sub>1Q'\"\n    then obtain P'' and Q'' where \n      b1: \"M2=App (Lam [x].P'') Q''\" and b2: \"P\\<longrightarrow>\\<^sub>1P''\" and b3: \"Q\\<longrightarrow>\\<^sub>1Q''\" by blast\n    from b2 i2 have \"(\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> P''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain P''' where\n      c1: \"P'\\<longrightarrow>\\<^sub>1P'''\" and c2: \"P''\\<longrightarrow>\\<^sub>1P'''\" by force\n    from b3 i1 have \"(\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> Q''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain Q''' where\n      d1: \"Q'\\<longrightarrow>\\<^sub>1Q'''\" and d2: \"Q''\\<longrightarrow>\\<^sub>1Q'''\" by force\n    from c1 c2 d1 d2 \n    have \"P'[x::=Q']\\<longrightarrow>\\<^sub>1P'''[x::=Q'''] \\<and> App (Lam [x].P'') Q'' \\<longrightarrow>\\<^sub>1 P'''[x::=Q''']\" \n      using vc b3 by (auto simp add: one_subst one_fresh_preserv)\n    hence \"\\<exists>M3. P'[x::=Q']\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" using b1 by blast\n  }\n  moreover (* subcase 2.2 *)\n  { assume \"\\<exists>P' Q'. M2 = P'[x::=Q'] \\<and> P\\<longrightarrow>\\<^sub>1P' \\<and> Q\\<longrightarrow>\\<^sub>1Q'\"\n    then obtain P'' Q'' where\n      b1: \"M2=P''[x::=Q'']\" and b2: \"P\\<longrightarrow>\\<^sub>1P''\" and  b3: \"Q\\<longrightarrow>\\<^sub>1Q''\" by blast\n    from b2 i2 have \"(\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> P''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain P''' where\n      c1: \"P'\\<longrightarrow>\\<^sub>1P'''\" and c2: \"P''\\<longrightarrow>\\<^sub>1P'''\" by blast\n    from b3 i1 have \"(\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> Q''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain Q''' where\n      d1: \"Q'\\<longrightarrow>\\<^sub>1Q'''\" and d2: \"Q''\\<longrightarrow>\\<^sub>1Q'''\" by blast\n    from c1 c2 d1 d2 \n    have \"P'[x::=Q']\\<longrightarrow>\\<^sub>1P'''[x::=Q'''] \\<and> P''[x::=Q'']\\<longrightarrow>\\<^sub>1P'''[x::=Q''']\" \n      by (force simp add: one_subst)\n    hence \"\\<exists>M3. P'[x::=Q']\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" using b1 by blast\n  }\n  ultimately show \"\\<exists>M3. P'[x::=Q']\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" by blast\nnext\n  case (o2 P P' Q Q') (* case 3 *)\n  have i0: \"P\\<longrightarrow>\\<^sub>1P'\" by fact\n  have i0': \"Q\\<longrightarrow>\\<^sub>1Q'\" by fact\n  have i1: \"\\<And>M2. Q \\<longrightarrow>\\<^sub>1M2 \\<Longrightarrow> (\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3)\" by fact\n  have i2: \"\\<And>M2. P \\<longrightarrow>\\<^sub>1M2 \\<Longrightarrow> (\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3)\" by fact\n  assume \"App P Q \\<longrightarrow>\\<^sub>1 M2\"\n  hence \"(\\<exists>P'' Q''. M2 = App P'' Q'' \\<and> P\\<longrightarrow>\\<^sub>1P'' \\<and> Q\\<longrightarrow>\\<^sub>1Q'') \\<or> \n         (\\<exists>x P' P'' Q'. P = Lam [x].P' \\<and> M2 = P''[x::=Q'] \\<and> P'\\<longrightarrow>\\<^sub>1 P'' \\<and> Q\\<longrightarrow>\\<^sub>1Q' \\<and> x\\<sharp>(Q,Q'))\" \n    by (simp add: one_app[simplified])\n  moreover (* subcase 3.1 *)\n  { assume \"\\<exists>P'' Q''. M2 = App P'' Q'' \\<and> P\\<longrightarrow>\\<^sub>1P'' \\<and> Q\\<longrightarrow>\\<^sub>1Q''\"\n    then obtain P'' and Q'' where \n      b1: \"M2=App P'' Q''\" and b2: \"P\\<longrightarrow>\\<^sub>1P''\" and b3: \"Q\\<longrightarrow>\\<^sub>1Q''\" by blast\n    from b2 i2 have \"(\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> P''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain P''' where\n      c1: \"P'\\<longrightarrow>\\<^sub>1P'''\" and c2: \"P''\\<longrightarrow>\\<^sub>1P'''\" by blast\n    from b3 i1 have \"\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> Q''\\<longrightarrow>\\<^sub>1M3\" by simp\n    then obtain Q''' where\n      d1: \"Q'\\<longrightarrow>\\<^sub>1Q'''\" and d2: \"Q''\\<longrightarrow>\\<^sub>1Q'''\" by blast\n    from c1 c2 d1 d2 \n    have \"App P' Q'\\<longrightarrow>\\<^sub>1App P''' Q''' \\<and> App P'' Q'' \\<longrightarrow>\\<^sub>1 App P''' Q'''\" by blast\n    hence \"\\<exists>M3. App P' Q'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" using b1 by blast\n  }\n  moreover (* subcase 3.2 *)\n  { assume \"\\<exists>x P1 P'' Q''. P = Lam [x].P1 \\<and> M2 = P''[x::=Q''] \\<and> P1\\<longrightarrow>\\<^sub>1 P'' \\<and> Q\\<longrightarrow>\\<^sub>1Q'' \\<and> x\\<sharp>(Q,Q'')\"\n    then obtain x P1 P1'' Q'' where\n      b0: \"P = Lam [x].P1\" and b1: \"M2 = P1''[x::=Q'']\" and \n      b2: \"P1\\<longrightarrow>\\<^sub>1P1''\" and  b3: \"Q\\<longrightarrow>\\<^sub>1Q''\" and vc: \"x\\<sharp>(Q,Q'')\" by blast\n    from b0 i0 have \"\\<exists>P1'. P'=Lam [x].P1' \\<and> P1\\<longrightarrow>\\<^sub>1P1'\" by (simp add: one_abs)      \n    then obtain P1' where g1: \"P'=Lam [x].P1'\" and g2: \"P1\\<longrightarrow>\\<^sub>1P1'\" by blast \n    from g1 b0 b2 i2 have \"(\\<exists>M3. (Lam [x].P1')\\<longrightarrow>\\<^sub>1M3 \\<and> (Lam [x].P1'')\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain P1''' where\n      c1: \"(Lam [x].P1')\\<longrightarrow>\\<^sub>1P1'''\" and c2: \"(Lam [x].P1'')\\<longrightarrow>\\<^sub>1P1'''\" by blast\n    from c1 have \"\\<exists>R1. P1'''=Lam [x].R1 \\<and> P1'\\<longrightarrow>\\<^sub>1R1\" by (simp add: one_abs)\n    then obtain R1 where r1: \"P1'''=Lam [x].R1\" and r2: \"P1'\\<longrightarrow>\\<^sub>1R1\" by blast\n    from c2 have \"\\<exists>R2. P1'''=Lam [x].R2 \\<and> P1''\\<longrightarrow>\\<^sub>1R2\" by (simp add: one_abs)\n    then obtain R2 where r3: \"P1'''=Lam [x].R2\" and r4: \"P1''\\<longrightarrow>\\<^sub>1R2\" by blast\n    from r1 r3 have r5: \"R1=R2\" by (simp add: lam.inject alpha)\n    from b3 i1 have \"(\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> Q''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain Q''' where\n      d1: \"Q'\\<longrightarrow>\\<^sub>1Q'''\" and d2: \"Q''\\<longrightarrow>\\<^sub>1Q'''\" by blast\n    from g1 r2 d1 r4 r5 d2 \n    have \"App P' Q'\\<longrightarrow>\\<^sub>1R1[x::=Q'''] \\<and> P1''[x::=Q'']\\<longrightarrow>\\<^sub>1R1[x::=Q''']\" \n      using vc i0' by (simp add: one_subst one_fresh_preserv)\n    hence \"\\<exists>M3. App P' Q'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" using b1 by blast\n  }\n  ultimately show \"\\<exists>M3. App P' Q'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" by blast\nnext\n  case (o3 P P' x) (* case 4 *)\n  have i1: \"P\\<longrightarrow>\\<^sub>1P'\" by fact\n  have i2: \"\\<And>M2. P \\<longrightarrow>\\<^sub>1M2 \\<Longrightarrow> (\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3)\" by fact\n  have \"(Lam [x].P)\\<longrightarrow>\\<^sub>1 M2\" by fact\n  hence \"\\<exists>P''. M2=Lam [x].P'' \\<and> P\\<longrightarrow>\\<^sub>1P''\" by (simp add: one_abs)\n  then obtain P'' where b1: \"M2=Lam [x].P''\" and b2: \"P\\<longrightarrow>\\<^sub>1P''\" by blast\n  from i2 b1 b2 have \"\\<exists>M3. (Lam [x].P')\\<longrightarrow>\\<^sub>1M3 \\<and> (Lam [x].P'')\\<longrightarrow>\\<^sub>1M3\" by blast\n  then obtain M3 where c1: \"(Lam [x].P')\\<longrightarrow>\\<^sub>1M3\" and c2: \"(Lam [x].P'')\\<longrightarrow>\\<^sub>1M3\" by blast\n  from c1 have \"\\<exists>R1. M3=Lam [x].R1 \\<and> P'\\<longrightarrow>\\<^sub>1R1\" by (simp add: one_abs)\n  then obtain R1 where r1: \"M3=Lam [x].R1\" and r2: \"P'\\<longrightarrow>\\<^sub>1R1\" by blast\n  from c2 have \"\\<exists>R2. M3=Lam [x].R2 \\<and> P''\\<longrightarrow>\\<^sub>1R2\" by (simp add: one_abs)\n  then obtain R2 where r3: \"M3=Lam [x].R2\" and r4: \"P''\\<longrightarrow>\\<^sub>1R2\" by blast\n  from r1 r3 have r5: \"R1=R2\" by (simp add: lam.inject alpha)\n  from r2 r4 have \"(Lam [x].P')\\<longrightarrow>\\<^sub>1(Lam [x].R1) \\<and> (Lam [x].P'')\\<longrightarrow>\\<^sub>1(Lam [x].R2)\" \n    by (simp add: one_subst)\n  thus \"\\<exists>M3. (Lam [x].P')\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" using b1 r5 by blast\nqed\n\nlemma one_lam_cong: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" \n  shows \"(Lam [a].t1)\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*(Lam [a].t2)\"\n  using a\nproof induct\n  case bs1 thus ?case by simp\nnext\n  case (bs2 y z) \n  thus ?case by (blast dest: b3)\nqed\n\nlemma one_app_congL: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" \n  shows \"App t1 s\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App t2 s\"\n  using a\nproof induct\n  case bs1 thus ?case by simp\nnext\n  case bs2 thus ?case by (blast dest: b1)\nqed\n  \nlemma one_app_congR: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" \n  shows \"App s t1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App s t2\"\nusing a\nproof induct\n  case bs1 thus ?case by simp\nnext \n  case bs2 thus ?case by (blast dest: b2)\nqed\n\nlemma one_app_cong: \n  assumes a1: \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" \n  and     a2: \"s1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*s2\" \n  shows \"App t1 s1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App t2 s2\"\nproof -\n  have \"App t1 s1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App t2 s1\" using a1 by (rule one_app_congL)\n  moreover\n  have \"App t2 s1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App t2 s2\" using a2 by (rule one_app_congR)\n  ultimately show ?thesis by (rule beta_star_trans)\nqed\n\nlemma one_beta_star: \n  assumes a: \"(t1\\<longrightarrow>\\<^sub>1t2)\" \n  shows \"(t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2)\"\n  using a\nproof(nominal_induct rule: One.strong_induct)\n  case o1 thus ?case by simp\nnext\n  case o2 thus ?case by (blast intro!: one_app_cong)\nnext\n  case o3 thus ?case by (blast intro!: one_lam_cong)\nnext \n  case (o4 a s1 s2 t1 t2)\n  have vc: \"a\\<sharp>s1\" \"a\\<sharp>s2\" by fact+\n  have a1: \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" and a2: \"s1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*s2\" by fact+\n  have c1: \"(App (Lam [a].t2) s2) \\<longrightarrow>\\<^sub>\\<beta> (t2 [a::= s2])\" using vc by (simp add: b4)\n  from a1 a2 have c2: \"App (Lam [a].t1 ) s1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App (Lam [a].t2 ) s2\" \n    by (blast intro!: one_app_cong one_lam_cong)\n  show ?case using c2 c1 by (blast intro: beta_star_trans)\nqed\n \nlemma one_star_lam_cong: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t2\" \n  shows \"(Lam  [a].t1)\\<longrightarrow>\\<^sub>1\\<^sup>* (Lam [a].t2)\"\n  using a\nproof induct\n  case os1 thus ?case by simp\nnext\n  case os2 thus ?case by (blast intro: one_star_trans)\nqed\n\nlemma one_star_app_congL: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t2\" \n  shows \"App t1 s\\<longrightarrow>\\<^sub>1\\<^sup>* App t2 s\"\n  using a\nproof induct\n  case os1 thus ?case by simp\nnext\n  case os2 thus ?case by (blast intro: one_star_trans)\nqed\n\nlemma one_star_app_congR: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t2\" \n  shows \"App s t1 \\<longrightarrow>\\<^sub>1\\<^sup>* App s t2\"\n  using a\nproof induct\n  case os1 thus ?case by simp\nnext\n  case os2 thus ?case by (blast intro: one_star_trans)\nqed\n\nlemma beta_one_star: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>\\<beta>t2\" \n  shows \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t2\"\n  using a\nproof(induct)\n  case b1 thus ?case by (blast intro!: one_star_app_congL)\nnext\n  case b2 thus ?case by (blast intro!: one_star_app_congR)\nnext\n  case b3 thus ?case by (blast intro!: one_star_lam_cong)\nnext\n  case b4 thus ?case by auto \nqed\n\nlemma trans_closure: \n  shows \"(M1\\<longrightarrow>\\<^sub>1\\<^sup>*M2) = (M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M2)\"\nproof\n  assume \"M1 \\<longrightarrow>\\<^sub>1\\<^sup>* M2\"\n  then show \"M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M2\"\n  proof induct\n    case (os1 M1) thus \"M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M1\" by simp\n  next\n    case (os2 M1 M2 M3)\n    have \"M2\\<longrightarrow>\\<^sub>1M3\" by fact\n    then have \"M2\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M3\" by (rule one_beta_star)\n    moreover have \"M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M2\" by fact\n    ultimately show \"M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M3\" by (auto intro: beta_star_trans)\n  qed\nnext\n  assume \"M1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M2\" \n  then show \"M1\\<longrightarrow>\\<^sub>1\\<^sup>*M2\"\n  proof induct\n    case (bs1 M1) thus  \"M1\\<longrightarrow>\\<^sub>1\\<^sup>*M1\" by simp\n  next\n    case (bs2 M1 M2 M3) \n    have \"M2\\<longrightarrow>\\<^sub>\\<beta>M3\" by fact\n    then have \"M2\\<longrightarrow>\\<^sub>1\\<^sup>*M3\" by (rule beta_one_star)\n    moreover have \"M1\\<longrightarrow>\\<^sub>1\\<^sup>*M2\" by fact\n    ultimately show \"M1\\<longrightarrow>\\<^sub>1\\<^sup>*M3\" by (auto intro: one_star_trans)\n  qed\nqed\n\nlemma cr_one:\n  assumes a: \"t\\<longrightarrow>\\<^sub>1\\<^sup>*t1\" \n  and     b: \"t\\<longrightarrow>\\<^sub>1t2\"\n  shows \"\\<exists>t3. t1\\<longrightarrow>\\<^sub>1t3 \\<and> t2\\<longrightarrow>\\<^sub>1\\<^sup>*t3\"\n  using a b\nproof (induct arbitrary: t2)\n  case os1 thus ?case by force\nnext\n  case (os2 t s1 s2 t2)  \n  have b: \"s1 \\<longrightarrow>\\<^sub>1 s2\" by fact\n  have h: \"\\<And>t2. t \\<longrightarrow>\\<^sub>1 t2 \\<Longrightarrow> (\\<exists>t3. s1 \\<longrightarrow>\\<^sub>1 t3 \\<and> t2 \\<longrightarrow>\\<^sub>1\\<^sup>* t3)\" by fact\n  have c: \"t \\<longrightarrow>\\<^sub>1 t2\" by fact\n  show \"\\<exists>t3. s2 \\<longrightarrow>\\<^sub>1 t3 \\<and>  t2 \\<longrightarrow>\\<^sub>1\\<^sup>* t3\" \n  proof -\n    from c h have \"\\<exists>t3. s1 \\<longrightarrow>\\<^sub>1 t3 \\<and> t2 \\<longrightarrow>\\<^sub>1\\<^sup>* t3\" by blast\n    then obtain t3 where c1: \"s1 \\<longrightarrow>\\<^sub>1 t3\" and c2: \"t2 \\<longrightarrow>\\<^sub>1\\<^sup>* t3\" by blast\n    have \"\\<exists>t4. s2 \\<longrightarrow>\\<^sub>1 t4 \\<and> t3 \\<longrightarrow>\\<^sub>1 t4\" using b c1 by (blast intro: diamond)\n    thus ?thesis using c2 by (blast intro: one_star_trans)\n  qed\nqed\n\nlemma cr_one_star: \n  assumes a: \"t\\<longrightarrow>\\<^sub>1\\<^sup>*t2\"\n      and b: \"t\\<longrightarrow>\\<^sub>1\\<^sup>*t1\"\n    shows \"\\<exists>t3. t1\\<longrightarrow>\\<^sub>1\\<^sup>*t3\\<and>t2\\<longrightarrow>\\<^sub>1\\<^sup>*t3\"\nusing a b\nproof (induct arbitrary: t1)\n  case (os1 t) then show ?case by force\nnext \n  case (os2 t s1 s2 t1)\n  have c: \"t \\<longrightarrow>\\<^sub>1\\<^sup>* s1\" by fact\n  have c': \"t \\<longrightarrow>\\<^sub>1\\<^sup>* t1\" by fact\n  have d: \"s1 \\<longrightarrow>\\<^sub>1 s2\" by fact\n  have \"t \\<longrightarrow>\\<^sub>1\\<^sup>* t1 \\<Longrightarrow> (\\<exists>t3.  t1 \\<longrightarrow>\\<^sub>1\\<^sup>* t3 \\<and> s1 \\<longrightarrow>\\<^sub>1\\<^sup>* t3)\" by fact\n  then obtain t3 where f1: \"t1 \\<longrightarrow>\\<^sub>1\\<^sup>* t3\"\n                   and f2: \"s1 \\<longrightarrow>\\<^sub>1\\<^sup>* t3\" using c' by blast\n  from cr_one d f2 have \"\\<exists>t4. t3\\<longrightarrow>\\<^sub>1t4 \\<and> s2\\<longrightarrow>\\<^sub>1\\<^sup>*t4\" by blast\n  then obtain t4 where g1: \"t3\\<longrightarrow>\\<^sub>1t4\"\n                   and g2: \"s2\\<longrightarrow>\\<^sub>1\\<^sup>*t4\" by blast\n  have \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t4\" using f1 g1 by (blast intro: one_star_trans)\n  thus ?case using g2 by blast\nqed\n  \nlemma cr_beta_star: \n  assumes a1: \"t\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t1\" \n  and     a2: \"t\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" \n  shows \"\\<exists>t3. t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\\<and>t2\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\"\nproof -\n  from a1 have \"t\\<longrightarrow>\\<^sub>1\\<^sup>*t1\" by (simp only: trans_closure)\n  moreover\n  from a2 have \"t\\<longrightarrow>\\<^sub>1\\<^sup>*t2\" by (simp only: trans_closure)\n  ultimately have \"\\<exists>t3. t1\\<longrightarrow>\\<^sub>1\\<^sup>*t3 \\<and> t2\\<longrightarrow>\\<^sub>1\\<^sup>*t3\" by (blast intro: cr_one_star) \n  then obtain t3 where \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t3\" and \"t2\\<longrightarrow>\\<^sub>1\\<^sup>*t3\" by blast\n  hence \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\" and \"t2\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\" by (simp_all only: trans_closure)\n  then show \"\\<exists>t3. t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\\<and>t2\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\" by blast\nqed\n\nend\n\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Nominal/Examples/CR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.6039318337259584, "lm_q1q2_score": 0.3441521567221512}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * Tactic for solving monadic equalities, such as:\n *\n * (liftE (return 3) = returnOk 3\n *\n * Theorems of the form:\n *\n *   ((a, s') \\<in> fst (A s)) = P a s s'\n *\n * and\n *\n *   snd (A s) = P s\n *\n * are added to the \"monad_eq\" set.\n *)\ntheory MonadEq\nimports \"Monad_WP/NonDetMonadVCG\"\nbegin\n\n(* Setup \"monad_eq\" attributes. *)\nML \\<open>\nstructure MonadEqThms = Named_Thms (\n    val name = Binding.name \"monad_eq\"\n    val description = \"monad equality-prover theorems\"\n    )\n\\<close>\nattribute_setup monad_eq = \\<open>\n  Attrib.add_del\n    (Thm.declaration_attribute MonadEqThms.add_thm)\n    (Thm.declaration_attribute MonadEqThms.del_thm)\\<close>\n  \"Monad equality-prover theorems\"\n\n(* Setup tactic. *)\n\nML \\<open>\nfun monad_eq_tac ctxt =\nlet\n  (* Set a simpset as being hidden, so warnings are not printed from it. *)\n  val ctxt' = Context_Position.set_visible false ctxt\nin\n  CHANGED (clarsimp_tac (ctxt' addsimps (MonadEqThms.get ctxt')) 1)\nend\n\\<close>\n\nmethod_setup monad_eq = \\<open>\n    Method.sections Clasimp.clasimp_modifiers >> (K (SIMPLE_METHOD o monad_eq_tac))\\<close>\n  \"prove equality on monads\"\n\nlemma monad_eq_simp_state [monad_eq]:\n  \"((A :: ('s, 'a) nondet_monad) s = B s') =\n      ((\\<forall>r t. (r, t) \\<in> fst (A s) \\<longrightarrow> (r, t) \\<in> fst (B s'))\n         \\<and> (\\<forall>r t. (r, t) \\<in> fst (B s') \\<longrightarrow> (r, t) \\<in> fst (A s))\n         \\<and> (snd (A s) = snd (B s')))\"\n  apply (auto intro!: set_eqI prod_eqI)\n  done\n\nlemma monad_eq_simp [monad_eq]:\n  \"((A :: ('s, 'a) nondet_monad) = B) =\n      ((\\<forall>r t s. (r, t) \\<in> fst (A s) \\<longrightarrow> (r, t) \\<in> fst (B s))\n         \\<and> (\\<forall>r t s. (r, t) \\<in> fst (B s) \\<longrightarrow> (r, t) \\<in> fst (A s))\n         \\<and> (\\<forall>x. snd (A x) = snd (B x)))\"\n  apply (auto intro!: set_eqI prod_eqI)\n  done\n\ndeclare in_monad [monad_eq]\ndeclare in_bindE [monad_eq]\n\n(* Test *)\nlemma \"returnOk 3 = liftE (return 3)\"\n  apply monad_eq\n  oops\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/MonadEq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3441521485975783}}
{"text": "header \"Invariants for Promela data structures\"\ntheory PromelaInvariants\nimports PromelaDatastructures\nbegin\n\ntext {* \n  The different data structures used in the Promela implementation require different invariants,\n  which are specified in this file. As there is no (useful) way of specifying \\emph{correctness} of the implementation,\nthose invariants are tailored towards proving the finitness of the generated state-space. \n*}\n\n(*<*)\n(*subsection {* Auxiliary lemmas *}*)\nlemma foldli_set:\n  \"set (foldli list (\\<lambda>_. True) op # xs) = set xs \\<union> set list\"\n  by (induct list arbitrary: xs) simp_all\n\nlemma foldli_conj:\n  \"foldli list id (\\<lambda>kv \\<sigma>. P kv) b \\<longleftrightarrow> b \\<and> (\\<forall>x \\<in> set list. P x)\"\n  by (induct list arbitrary: b) simp_all\n\n(* Destroy the evil border of abstraction... *)\nlemma lm_ball_Assoc_List_set:\n  \"lm.ball m P \\<longleftrightarrow> (\\<forall>x \\<in> Assoc_List.set m. P x)\"\n  unfolding Assoc_List.set_def\n  by (simp add: icf_rec_unf lm_basic.g_ball_def \n    poly_map_iteratei_defs.iteratei_def it_to_it_def Assoc_List.iteratei_def\n    foldli_conj)\n\nlemma lm_to_list_Assoc_List_set:\n  \"set (lm.to_list l) = Assoc_List.set l\"\n  unfolding Assoc_List.set_def\n  by (simp add: icf_rec_unf lm_basic.g_to_list_def \n    poly_map_iteratei_defs.iteratei_def it_to_it_def Assoc_List.iteratei_def \n    foldli_set)\n\nlemma dom_lm_\\<alpha>_Assoc_List_set:\n  \"dom (lm.\\<alpha> v) = fst ` (Assoc_List.set v)\"\n  by (simp add: icf_rec_unf Assoc_List.lookup_def Assoc_List.set_def\n    dom_map_of_conv_image_fst)\n\nlemma ran_lm_\\<alpha>_Assoc_List_set:\n  \"ran (lm.\\<alpha> v) = snd ` (Assoc_List.set v)\"\n  by (simp add: icf_rec_unf Assoc_List.lookup_def Assoc_List.set_def \n    ran_distinct)\n\nlemma lm_ball_eq_ran:\n  \"lm.ball v (\\<lambda>(k,v). P v) \\<longleftrightarrow> ran (lm.\\<alpha> v) \\<subseteq> Collect P\"\n  by (auto simp add: ran_lm_\\<alpha>_Assoc_List_set lm_ball_Assoc_List_set)\n\nlemma lm_ball_lm_to_map_map_weaken:\n  \"\\<forall>x \\<in> f ` set xs. P x \\<Longrightarrow> lm.ball (lm.to_map (map f xs)) P\"\n  by (induct xs) (simp_all add: lm.correct)\n\nlemma Assoc_List_set_eq_lookup:\n  \"(k,v) \\<in> Assoc_List.set vs \\<longleftrightarrow> Assoc_List.lookup vs k = Some v\"\n  by (simp add: Assoc_List.lookup_def Assoc_List.set_def) \n\n(*>*)\n\nsubsection {* Bounds *}\n\ntext {* \n  Finiteness requires that possible variable ranges are finite, as is the maximium number of processes.\n  Currently, they are supplied here as constants. In a perfect world, they should be able to be set dynamically. \n*}\n\n(* NB! Make sure those values coincide with the bounds definied in @{const ppVarType} *)\ndefinition min_var_value :: \"integer\" where\n  \"min_var_value = -(2^31)\"\ndefinition max_var_value :: \"integer\" where\n  \"max_var_value = (2^31) - 1\"\n\nlemma min_max_var_value_simps [simp, intro!]:\n  \"min_var_value < max_var_value\"\n  \"min_var_value < 0\"\n  \"min_var_value \\<le> 0\"\n  \"max_var_value > 0\"\n  \"max_var_value \\<ge> 0\"\nby (simp_all add: min_var_value_def max_var_value_def)\n\ndefinition \"max_procs \\<equiv> 255\"\ndefinition \"max_channels \\<equiv> 65535\"\ndefinition \"max_array_size = 65535\"\n\n\nsubsection {* Variables and similar *}\n\nfun varType_inv :: \"varType \\<Rightarrow> bool\" where\n  \"varType_inv (VTBounded l h) \n  \\<longleftrightarrow> l \\<ge> min_var_value \\<and> h \\<le> max_var_value \\<and> l < h\"\n| \"varType_inv VTChan \\<longleftrightarrow> True\"\n\nfun variable_inv :: \"variable \\<Rightarrow> bool\" where\n  \"variable_inv (Var t val) \n  \\<longleftrightarrow> varType_inv t \\<and> val \\<in> {min_var_value..max_var_value}\"\n| \"variable_inv (VArray t sz ar) \n  \\<longleftrightarrow> varType_inv t \n    \\<and> sz \\<le> max_array_size \n    \\<and> IArray.length ar = sz \n    \\<and> set (IArray.list_of ar) \\<subseteq> {min_var_value..max_var_value}\"\n\nfun channel_inv :: \"channel \\<Rightarrow> bool\" where\n  \"channel_inv (Channel cap ts q) \n  \\<longleftrightarrow> cap \\<le> max_array_size \n    \\<and> cap \\<ge> 0 \n    \\<and> set ts \\<subseteq> Collect varType_inv \n    \\<and> length ts \\<le> max_array_size \n    \\<and> length q \\<le> max_array_size \n    \\<and> (\\<forall>x \\<in> set q. length x = length ts \n    \\<and> set x \\<subseteq> {min_var_value..max_var_value})\"\n| \"channel_inv (HSChannel ts) \n  \\<longleftrightarrow> set ts \\<subseteq> Collect varType_inv \\<and> length ts \\<le> max_array_size\"\n| \"channel_inv InvChannel \\<longleftrightarrow> True\"\n\nlemma varTypes_finite:\n  \"finite (Collect varType_inv)\"\nproof (rule finite_subset)\n  show \"Collect (varType_inv) \\<subseteq> \n      {VTChan} \n    \\<union> (\\<lambda>(l,h). VTBounded l h) \n      ` ({min_var_value..max_var_value} \\<times> {min_var_value..max_var_value})\"\n    apply (rule subsetI)\n    apply (case_tac x)\n      apply auto\n    done\n\n  show \"finite ...\" by auto\nqed\n\nlemma variables_finite:\n  \"finite (Collect variable_inv)\"\nproof (rule finite_subset)\n  let ?mm = \"{min_var_value..max_var_value}\"\n  let ?V1 = \"(\\<lambda>(t,val). Var t val) ` ({vt. varType_inv vt} \\<times> ?mm)\"\n  let ?V2 = \"(\\<lambda>(t,sz,ar). VArray t sz ar) \n    ` ({vt. varType_inv vt} \n      \\<times> {0..max_array_size} \n      \\<times> {ar. IArray.length ar \\<le> max_array_size \n           \\<and> set (IArray.list_of ar) \\<subseteq> ?mm})\"\n\n  {\n    fix A :: \"'a set\"\n    let ?LS = \"{xs. set xs \\<subseteq> A \\<and> length xs \\<le> max_array_size }\"\n    let ?AS = \"{ar. IArray.length ar \\<le> max_array_size \n      \\<and> set (IArray.list_of ar) \\<subseteq> A}\"\n\n    assume \"finite A\"\n    hence \"finite ?LS\" by (simp add: finite_lists_length_le)\n    moreover have \"?AS \\<subseteq> IArray ` ?LS\"\n      apply (auto simp: image_def)\n      apply (rule_tac x = \"IArray.list_of x\" in exI)\n      apply auto\n      apply (metis iarray.exhaust list_of.simps)\n      done\n    ultimately have \"finite ?AS\" by (auto simp add: finite_subset)\n  } note finite_arr = this\n\n  show \"Collect variable_inv \\<subseteq> (?V1 \\<union> ?V2)\"\n    apply (rule subsetI)\n    apply (case_tac x)\n      apply (auto simp add: image_def)\n    done\n\n  show \"finite ...\" by (blast intro: varTypes_finite finite_arr)\nqed\n\nlemma channels_finite:\n  \"finite (Collect channel_inv)\"\nproof (rule finite_subset)\n  let ?C1 = \n    \"(\\<lambda>(cap,ts,q). Channel cap ts q) \n     ` ({0..max_array_size} \n      \\<times> {ts. set ts \\<subseteq> Collect varType_inv \\<and> length ts \\<le> max_array_size} \n      \\<times> {q. set q \\<subseteq> {x. set x \\<subseteq> {min_var_value..max_var_value} \n                        \\<and> length x \\<le> max_array_size} \n            \\<and> length q \\<le> max_array_size})\"\n  let ?C2 = \n    \"HSChannel ` {ts. set ts \\<subseteq> Collect varType_inv \\<and> length ts \\<le> max_array_size}\"\n  let ?C3 = \"{InvChannel}\"\n\n  show \"(Collect channel_inv) \\<subseteq> ?C1 \\<union> ?C2 \\<union> ?C3\"\n    apply (rule subsetI)\n    apply (case_tac x)\n      apply (auto simp add: image_def)\n    done\n\n  show \"finite ...\" by (blast intro: finite_lists_length_le varTypes_finite)+\nqed\n\ntext {* To give an upper bound of variable names, we need a way to calculate it. *}\n\nprimrec procArgName :: \"procArg \\<Rightarrow> String.literal\" where\n  \"procArgName (ProcArg _ name) = name\"\n\nprimrec varDeclName :: \"varDecl \\<Rightarrow> String.literal\" where\n  \"varDeclName (VarDeclNum _ _ name _ _) = name\"\n| \"varDeclName (VarDeclChan name _ _) = name\"\n\nprimrec procVarDeclName :: \"procVarDecl \\<Rightarrow> String.literal\" where\n  \"procVarDeclName (ProcVarDeclNum _ _ name _ _) = name\"\n| \"procVarDeclName (ProcVarDeclChan name _) = name\"\n\ndefinition edgeDecls :: \"edge \\<Rightarrow> procVarDecl set\" where\n  \"edgeDecls e = (\n     case effect e of\n      EEDecl p \\<Rightarrow> {p}\n    |  _ \\<Rightarrow> {})\" \n\nlemma edgeDecls_finite:\n  \"finite (edgeDecls e)\"\nby (simp add: edgeDecls_def split: edgeEffect.split)\n\ndefinition edgeSet :: \"states \\<Rightarrow> edge set\" where\n  \"edgeSet s = set (concat (map snd (IArray.list_of s)))\"\n\nlemma edgeSet_finite:\n  \"finite (edgeSet s)\"\nby (simp add: edgeSet_def)\n\ndefinition statesDecls :: \"states \\<Rightarrow> procVarDecl set\" where\n  \"statesDecls s = UNION (edgeSet s) edgeDecls\"\n\ndefinition statesNames :: \"states \\<Rightarrow> String.literal set\" where\n  \"statesNames s = procVarDeclName ` statesDecls s\"\n\nlemma statesNames_finite:\n  \"finite (statesNames s)\"\nby (simp add: edgeSet_finite edgeDecls_finite statesNames_def statesDecls_def)\n\n\nfun process_names :: \"states \\<Rightarrow> process \\<Rightarrow> String.literal set\" where\n  \"process_names ss (_, _, args, decls) = \n      statesNames ss \n    \\<union> procArgName ` set args \n    \\<union> varDeclName ` set decls\n    \\<union> {STR ''_'', STR ''__assert__'', STR ''_pid''}\" (* dunno if this is ok as a fixed set ... *)\n\nlemma process_names_finite:\n  \"finite (process_names ss p)\"\nby (cases p) (simp add: statesNames_finite)\n\ndefinition vardict_inv :: \"states \\<Rightarrow> process \\<Rightarrow> var_dict \\<Rightarrow> bool\" where\n  \"vardict_inv ss p vs \n   \\<longleftrightarrow> lm.ball vs (\\<lambda>(k,v). k \\<in> process_names ss p \\<and> variable_inv v)\"\n\nlemma vardicts_finite:\n  \"finite (Collect (vardict_inv ss p))\"\nproof -\n  have \"Assoc_List.set ` Collect (vardict_inv ss p) \\<subseteq> \n           Pow (process_names ss p \\<times> {v. variable_inv v})\"\n    by (auto simp add: lm_ball_Assoc_List_set vardict_inv_def)\n\n  moreover have \"finite ...\"\n    using process_names_finite variables_finite\n    by simp\n  ultimately show ?thesis by (metis finite_Assoc_List_set_image finite_subset)\nqed\n\nlemma lm_to_map_vardict_inv:\n  assumes \"\\<forall>(k,v) \\<in> set xs. k \\<in> process_names ss proc \\<and> variable_inv v\"\n  shows \"vardict_inv ss proc (lm.to_map xs)\"\nusing assms\nunfolding vardict_inv_def\nby (auto simp add: lm.correct dest: map_of_is_SomeD)\n\nsubsection {* Invariants of a process *}\n\n(* The definition of a channel to be between -1 and max_channels definitly lacks the necessary abstraction ... *)\ndefinition pState_inv :: \"program \\<Rightarrow> pState \\<Rightarrow> bool\" where\n  \"pState_inv prog p \n  \\<longleftrightarrow> pid p \\<le> max_procs\n    \\<and> pState.idx p < IArray.length (states prog) \n    \\<and> IArray.length (states prog) = IArray.length (processes prog)\n    \\<and> pc p < IArray.length ((states prog) !! pState.idx p)\n    \\<and> set (pState.channels p) \\<subseteq> {-1..<integer_of_nat max_channels} \n    \\<and> length (pState.channels p) \\<le> max_channels\n    \\<and> vardict_inv ((states prog) !! pState.idx p) \n                  ((processes prog) !! pState.idx p) \n                  (pState.vars p)\"\n\nlemma pStates_finite:\n  \"finite (Collect (pState_inv prog))\"\nproof -\n  let ?P1 = \"{..max_procs::nat}\"\n  let ?P2 = \"{..IArray.length (states prog)}\"\n  let ?P3 = \"{..Max (IArray.length ` (set (IArray.list_of (states prog))))}\"\n  let ?P4 = \"{cs. set cs \\<subseteq> {-1..<integer_of_nat max_channels} \n                  \\<and> length cs \\<le> max_channels}\"\n  let ?P5 = \"\\<Union>x\\<in>{..IArray.length (states prog)}. \n                Collect (vardict_inv (states prog !! x) (processes prog !! x))\"\n  let ?P = \"?P1 \\<times> ?P2 \\<times> ?P3 \\<times> ?P4 \\<times> ?P5\"\n\n  have \"{p. pState_inv prog p} \\<subseteq> \n    (\\<lambda>(pid,idx,pc,channels,vars). pState.make pid vars pc channels idx) ` ?P\"\n    unfolding pState_inv_def image_def\n    apply (clarsimp simp add: pState.defs)\n    apply (tactic {* Record.split_simp_tac @{context} [] (K ~1) 1*})\n    apply (auto)\n    apply (rule order_trans[OF less_imp_le])\n      apply (auto intro!: Max_ge)\n      done\n\n  moreover\n  have \"finite ?P4\" by (fastforce intro: finite_lists_length_le)\n  hence \"finite ?P\" by (auto intro: finite_cartesian_product simp: vardicts_finite)\n\n  ultimately show ?thesis by (elim finite_subset) (rule finite_imageI)\nqed\n\ntext {* \n  Throughout the calculation of the semantic engine, a modified process is not necessarily part of @{term \"procs g\"}.\n  Hence we need to establish an additional constraint for the relation between a global and a process state.  *}\n\ndefinition cl_inv :: \"('a gState_scheme * pState) \\<Rightarrow> bool\" where\n  \"cl_inv gp = (case gp of (g,p) \\<Rightarrow> \n      length (pState.channels p) \\<le> length (gState.channels g))\"\n\nlemma cl_inv_lengthD:\n  \"cl_inv (g,p) \\<Longrightarrow> length (pState.channels p) \\<le> length (gState.channels g)\"\nunfolding cl_inv_def\nby auto\n\nlemma cl_invI:\n  \"length (pState.channels p) \\<le> length (gState.channels g) \\<Longrightarrow> cl_inv (g,p)\"\nunfolding cl_inv_def by auto\n\nlemma cl_inv_trans:\n  \"length (channels g) \\<le> length (channels g') \\<Longrightarrow> cl_inv (g,p) \\<Longrightarrow> cl_inv (g',p)\"\nby (simp add: cl_inv_def)\n\nlemma cl_inv_vars_update[intro!]:\n  \"cl_inv (g,p) \\<Longrightarrow> cl_inv (g, pState.vars_update vs p)\"\n  \"cl_inv (g,p) \\<Longrightarrow> cl_inv (gState.vars_update vs g, p)\"\nby (simp_all add: cl_inv_def)\n\nlemma cl_inv_handshake_update[intro!]:\n  \"cl_inv (g,p) \\<Longrightarrow> cl_inv (g\\<lparr>handshake := h\\<rparr>,p)\"\nby (simp add: cl_inv_def)\n\n\n\nlemma cl_inv_procs_update[intro!]:\n  \"cl_inv (g,p) \\<Longrightarrow> cl_inv (g\\<lparr>procs := ps\\<rparr>,p)\"\nby (simp add: cl_inv_def)\n\nlemma cl_inv_channels_update:\n  assumes \"cl_inv (g,p)\"\n  shows \"cl_inv (gState.channels_update (\\<lambda>cs. cs[i:=c]) g, p)\"\nusing assms unfolding cl_inv_def \nby simp\n\nsubsection {* Invariants of the global state *}\n\ntext {* Note that @{term gState_inv} must be defined in a way to be applicable to both @{typ gState} and @{typ gState\\<^sub>I}. *}\n\ndefinition gState_inv :: \"program \\<Rightarrow> 'a gState_scheme \\<Rightarrow> bool\" where\n  \"gState_inv prog g \n  \\<longleftrightarrow> length (procs g) \\<le> max_procs \n    \\<and> (\\<forall>p \\<in> set (procs g). pState_inv prog p \\<and> cl_inv (g,p))\n    \\<and> length (channels g) \\<le> max_channels\n    \\<and> set (channels g) \\<subseteq> Collect channel_inv\n    \\<and> lm.ball (vars g) (\\<lambda>(k,v). variable_inv v)\" \n\ntext {* The set of global states adhering to the terms of @{const gState_inv} is not finite.\nBut the set of all global states that can be constructed by the semantic engine from one starting state is. \nThus we establish a progress relation, \\ie all successors of a state @{term g} relate to @{term g} under this specification. *}\n\ndefinition gState_progress_rel :: \"program \\<Rightarrow> ('a gState_scheme) rel\" where\n  \"gState_progress_rel p = {(g,g'). gState_inv p g \\<and> gState_inv p g'\n                                  \\<and> length (channels g) \\<le> length (channels g')\n                                  \\<and> dom (lm.\\<alpha> (vars g)) = dom (lm.\\<alpha> (vars g'))}\"\n\nlemma gState_progress_rel_gState_invI1[intro]:\n  \"(g,g') \\<in> gState_progress_rel prog \\<Longrightarrow> gState_inv prog g\"\nby (simp add: gState_progress_rel_def)\n\nlemma gState_progress_rel_gState_invI2[intro]:\n  \"(g,g') \\<in> gState_progress_rel prog \\<Longrightarrow> gState_inv prog g'\"\nby (simp add: gState_progress_rel_def)\n\nlemma gState_progress_relI:\n  assumes \"gState_inv prog g\"\n  and \"gState_inv prog g'\"\n  and \"length (channels g) \\<le> length (channels g')\"\n  and \"dom (lm.\\<alpha> (vars g)) = dom (lm.\\<alpha> (vars g'))\"\n  shows \"(g,g') \\<in> gState_progress_rel prog\"\nunfolding gState_progress_rel_def\nusing assms\nby auto\n\nlemma gState_progress_refl[simp,intro!]:\n  \"gState_inv prog g \\<Longrightarrow> (g,g) \\<in> (gState_progress_rel prog)\"\nunfolding gState_progress_rel_def\nby auto\n\nlemma refl_on_gState_progress_rel:\n  \"refl_on (Collect (gState_inv prog)) (gState_progress_rel prog)\"\nby (auto intro!: refl_onI)\n\nlemma trans_gState_progress_rel[simp]:\n  \"trans (gState_progress_rel prog)\"\nby (intro transI) (simp add: gState_progress_rel_def)\n\nlemmas gState_progress_rel_trans [trans] = trans_gState_progress_rel[THEN transD]\n\nlemma gState_progress_rel_trancl_id[simp]:\n  \"(gState_progress_rel prog)\\<^sup>+ = gState_progress_rel prog\"\nby simp\n\nlemma gState_progress_rel_rtrancl_absorb:\n  assumes \"gState_inv prog g\"\n  shows \"(gState_progress_rel prog)\\<^sup>* `` {g} = gState_progress_rel prog `` {g}\"\nusing assms refl_on_gState_progress_rel\nby (intro Image_absorb_rtrancl) auto\n\ntext {* \n  The main theorem: The set of all global states reachable from an initial state, is finite.\n*}\nlemma gStates_finite:\n  fixes g :: \"gState\"\n  shows \"finite ((gState_progress_rel prog)\\<^sup>* `` {g})\"\nproof (cases \"gState_inv prog g\")\n  case False hence \"(gState_progress_rel prog)\\<^sup>* `` {g} = {g}\" \n    by (intro Image_empty_rtrancl_Image_id) \n       (auto simp add: gState_progress_rel_def)\n  thus ?thesis by simp\nnext\n  case True\n  let ?G1 = \"{m. dom (lm.\\<alpha> m) = dom (lm.\\<alpha> (vars g)) \n                 \\<and> ran (lm.\\<alpha> m) \\<subseteq> Collect variable_inv }\"\n  let ?G2 = \"{cs. set cs \\<subseteq> Collect channel_inv \n                  \\<and> length cs \\<le> max_channels}\"\n  let ?G3 = \"{True, False}\"\n  let ?G4 = \"{ps. set ps \\<subseteq> Collect (pState_inv prog) \n                  \\<and> length ps \\<le> max_procs}\"\n  \n  let ?G = \"?G1 \\<times> ?G2 \\<times> ?G3 \\<times> ?G4\"\n  let ?G' = \"(\\<lambda>(vars,chans,t,ps). gState.make vars chans t ps) ` ?G\"\n\n  have G1: \"finite ?G1\"\n  proof (rule finite_subset)\n    show \"?G1 \\<subseteq> {v'. fst ` Assoc_List.set v' = fst ` Assoc_List.set (vars g) \n                     \\<and> snd ` Assoc_List.set v' \\<subseteq> Collect variable_inv}\"\n      by (simp add: dom_lm_\\<alpha>_Assoc_List_set ran_lm_\\<alpha>_Assoc_List_set)\n    show \"finite ...\" (is \"finite ?X\")\n    proof (rule finite_Assoc_List_set_image, rule finite_subset)\n      show \"Assoc_List.set ` ?X \\<subseteq> \n             Pow (fst ` Assoc_List.set (vars g) \\<times> Collect variable_inv)\"\n        by auto\n      show \"finite ...\" by (auto simp add: variables_finite dom_lm_\\<alpha>_Assoc_List_set[symmetric])\n    qed\n  qed\n\n  have \"finite ((gState_progress_rel prog) `` {g})\"\n  proof (rule finite_subset)\n    show \"(gState_progress_rel prog) `` {g} \\<subseteq> \n           (\\<lambda>(vars,chans,t,ps). gState.make vars chans t ps) ` ?G\"\n      apply (clarsimp simp add: image_def gState_inv_def gState.defs gState_progress_rel_def)\n      apply (rule_tac x = \"vars x\" in exI)\n      apply (simp add: lm_ball_eq_ran)\n      apply (rule_tac x = \"channels x\" in exI)\n      apply (case_tac \"timeout x\")\n        apply clarsimp\n        apply (rule_tac x=\"procs x\" in exI)\n        apply auto\n      done\n    show \"finite ...\" using G1 \n      by (blast intro: finite_lists_length_le channels_finite pStates_finite)\n  qed\n  with gState_progress_rel_rtrancl_absorb[OF True] show ?thesis by simp\nqed\n\nlemma gState_progress_rel_channels_update:\n  assumes \"gState_inv prog g\"\n  and \"channel_inv c\"\n  and \"i < length (channels g)\"\n  shows \"(g,gState.channels_update (\\<lambda>cs. cs[i:=c]) g) \\<in> gState_progress_rel prog\"\nusing assms\nby (auto intro!: gState_progress_relI \n         simp add: gState_inv_def cl_inv_def \n         dest!: subsetD[OF set_update_subset_insert])\n\nlemma gState_progress_rel_channels_update_step:\n  assumes \"gState_inv prog g\"\n  and step: \"(g,g') \\<in> gState_progress_rel prog\"\n  and \"channel_inv c\"\n  and \"i < length (channels g')\"\n  shows \"(g,gState.channels_update (\\<lambda>cs. cs[i:=c]) g') \\<in> gState_progress_rel prog\"\nproof -\n  note step\n  also hence \"gState_inv prog g'\" by blast\n  note gState_progress_rel_channels_update[OF this assms(3,4)]\n  finally show ?thesis .\nqed\n\nsubsection {* Invariants of the program *}\n\ntext {* \n  Naturally, we need our program to also adhere to certain invariants. Else we can't show, that\n  the generated states are correct according to the invariants above.\n*}\n\ndefinition program_inv where\n  \"program_inv prog \n  \\<longleftrightarrow> IArray.length (states prog) > 0\n    \\<and> IArray.length (states prog) = IArray.length (processes prog)\n    \\<and> (\\<forall>s \\<in> set (IArray.list_of (states prog)). IArray.length s > 0)\n    \\<and> lm.ball (proc_data prog) \n              (\\<lambda>(_,sidx). \n                    sidx < IArray.length (processes prog) \n                  \\<and> fst (processes prog !! sidx) = sidx)\n    \\<and> (\\<forall>(sidx,start,procArgs,args) \\<in> set (IArray.list_of (processes prog)). \n        (\\<exists>s. start = Index s \\<and> s < IArray.length (states prog !! sidx)))\"\n\nlemma program_inv_length_states:\n  assumes \"program_inv prog\"\n  and \"n < IArray.length (states prog)\"\n  shows \"IArray.length (states prog !! n) > 0\"\nusing assms by (simp add: program_inv_def)\n\nlemma program_invI:\n  assumes \"0 < IArray.length (states prog)\"\n  and \"IArray.length (states prog) = IArray.length (processes prog)\"\n  and \"\\<And>s. s \\<in> set (IArray.list_of (states prog)) \n           \\<Longrightarrow> 0 < IArray.length s\"\n  and \"\\<And>sidx. sidx \\<in> ran (lm.\\<alpha> (proc_data prog)) \n               \\<Longrightarrow> sidx < IArray.length (processes prog) \n                  \\<and> fst (processes prog !! sidx) = sidx\"\n  and \"\\<And>sidx start procArgs args. \n         (sidx,start,procArgs,args) \\<in> set (IArray.list_of (processes prog)) \n         \\<Longrightarrow> \\<exists>s. start = Index s \\<and> s < IArray.length (states prog !! sidx)\"\n  shows \"program_inv prog\"\nunfolding program_inv_def\nusing assms\nby (auto simp add: lm_ball_eq_ran)\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Promela/PromelaInvariants.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.734119526900183, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.34414835303409835}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Word_Lemmas_32_Internal\nimports Word_Lemmas_32\nbegin\n\nlemmas sint_eq_uint_32 = sint_eq_uint_2pl[where 'a=32, simplified]\n\nlemmas sle_positive_32 = sle_le_2pl[where 'a=32, simplified]\n\nlemmas sless_positive_32 = sless_less_2pl[where 'a=32, simplified]\n\nlemma zero_le_sint_32:\n  \"\\<lbrakk> 0 \\<le> (a :: word32); a < 0x80000000 \\<rbrakk>\n   \\<Longrightarrow> 0 \\<le> sint a\"\n  by (clarsimp simp: sint_eq_uint_32 unat_less_helper)\n\nlemmas unat_add_simple = iffD1[OF unat_add_lem[where 'a = 32, folded word_bits_def]]\n\nlemma upto_enum_inc_1:\n  \"a < 2 ^ word_bits - 1\n   \\<Longrightarrow> [(0:: 'a :: len word) .e. 1 + a] = [0.e.a] @ [(1+a)]\"\n  using upper_trivial upto_enum_inc_1_len by force\n\nlemmas upt_enum_offset_trivial =\n  upt_enum_offset_trivial[where 'a=32, folded word_bits_def]\n\nlemmas unat32_eq_of_nat = unat_eq_of_nat[where 'a=32, folded word_bits_def]\n\ndeclare mask_32_max_word[simp]\n\nlemma le_32_mask_eq:\n  \"(bits :: word32) \\<le> 32 \\<Longrightarrow> bits && mask 6 = bits\"\n  by (fastforce elim: le_less_trans intro: less_mask_eq)\n\nlemmas scast_1_32[simp] = scast_1[where 'a=32]\n\nlemmas mask_32_id[simp] = mask_len_id[where 'a=32, folded word_bits_def]\n\nlemmas t2p_shiftr_32 = t2p_shiftr[where 'a=32, folded word_bits_def]\n\nlemma mask_eq1_nochoice:\n  \"(x :: word32) && 1 = x\n   \\<Longrightarrow> x = 0 \\<or> x = 1\"\n  using mask_eq1_nochoice len32 by force\n\nlemmas const_le_unat_word_32 = const_le_unat[where 'a=32, folded word_bits_def]\n\nlemmas createNewCaps_guard_helper =\n  createNewCaps_guard[where 'a=32, folded word_bits_def]\n\nlemma word_log2_max_word32[simp]:\n  \"word_log2 (w :: 32 word) < 32\"\n  using word_log2_max[where w=w]\n  by (simp add: word_size)\n\n(* FIXME: specialize using pow_sub_less_word *)\nlemma mapping_two_power_16_64_inequality:\n  assumes sz: \"sz \\<le> 4\" and len: \"unat (len :: word32) = 2 ^ sz\"\n  shows \"unat (len * 8 - 1) \\<le> 127\"\n  using pow_sub_less[where 'a=32 and b=3, simplified]\nproof -\n  have len2: \"len = 2 ^ sz\"\n    apply (rule word_unat.Rep_eqD, simp only: len)\n    using sz\n    apply simp\n    done\n\n  show ?thesis using two_power_increasing_less_1[where 'a=32 and n=\"sz + 3\" and m=7]\n    by (simp add: word_le_nat_alt sz power_add len2 field_simps)\nqed\n\nlemmas pre_helper2_32 = pre_helper2[where 'a=32, folded word_bits_def]\n\nlemmas of_nat_shift_distinct_helper_machine =\n  of_nat_shift_distinct_helper[where 'a=32, folded word_bits_def]\n\nlemmas ptr_add_distinct_helper_32 =\n  ptr_add_distinct_helper[where 'a=32, folded word_bits_def]\n\nlemmas mask_out_eq_0_32 = mask_out_eq_0[where 'a=32, folded word_bits_def]\n\nlemmas neg_mask_mask_unat_32 = neg_mask_mask_unat[where 'a=32, folded word_bits_def]\n\nlemmas unat_less_iff_32 = unat_less_iff[where 'a=32, folded word_bits_def]\n\nlemmas is_aligned_no_overflow3_32 = is_aligned_no_overflow3[where 'a=32, folded word_bits_def]\n\nlemmas unat_ucast_16_32 = unat_signed_ucast_less_ucast[where 'a=16 and 'b=32, simplified]\n\n(* FIXME: generalize? *)\nlemma scast_mask_8:\n  \"scast (mask 8 :: sword32) = (mask 8 :: word32)\"\n  by (clarsimp simp: mask_def)\n\nlemmas ucast_le_8_32_equiv = ucast_le_up_down_iff[where 'a=8 and 'b=32, simplified]\n\nlemma signed_unat_minus_one_32:\n  \"unat (-1 :: 32 signed word) = 4294967295\"\n  by (simp del: word_pow_0 diff_0 add: unat_sub_if' minus_one_word)\n\nlemmas two_bits_cases_32 = two_bits_cases[where 'a=32, simplified]\n\nlemmas word_ctz_not_minus_1_32 = word_ctz_not_minus_1[where 'a=32, simplified]\n\nlemmas sint_ctz_32 = sint_ctz[where 'a=32, simplified]\n\n(* FIXME: inline these? *)\nlemmas scast_specific_plus32 =\n  scast_of_nat_signed_to_unsigned_add[where 'a=32 and x=\"word_ctz x\" and y=\"0x20\" for x,\n                                      simplified]\nlemmas scast_specific_plus32_signed =\n  scast_of_nat_unsigned_to_signed_add[where 'a=32 and x=\"word_ctz x\" and y=\"0x20\" for x,\n                                      simplified]\n\nend", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/Word_Lib/Word_Lemmas_32_Internal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.34411648543097656}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"32-Bit Machine Word Setup\"\n\ntheory Word_Setup_32\nimports Word_Enum\nbegin\n\ntext \\<open>This theory defines standard platform-specific word size and alignment.\\<close>\n\ntype_synonym machine_word_len = 32\ntype_synonym machine_word = \"machine_word_len word\"\n\ndefinition word_bits :: nat\nwhere\n  \"word_bits = len_of TYPE(machine_word_len)\"\n\ntext \\<open>The following two are numerals so they can be used as nats and words.\\<close>\ndefinition word_size_bits :: \"'a :: numeral\"\nwhere\n  \"word_size_bits = 2\"\n\ndefinition word_size :: \"'a :: numeral\"\nwhere\n  \"word_size = 4\"\n\nlemma word_bits_conv[code]:\n  \"word_bits = 32\"\n  unfolding word_bits_def by simp\n\nlemma word_size_word_size_bits:\n  \"(word_size::nat) = 2 ^ word_size_bits\"\n  unfolding word_size_def word_size_bits_def by simp\n\nlemma word_bits_word_size_conv:\n  \"word_bits = word_size * 8\"\n  unfolding word_bits_def word_size_def by simp\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/Word_Lib/Word_Setup_32.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6477982043529716, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3441164782069866}}
{"text": "section \\<open>Shared Utilities for all Generator\\<close>\n\ntext \\<open>In this theory we mainly provide some Isabelle/ML infrastructure\n  that is used by several generators. It consists of a uniform interface\n  to access all the theorems, terms, etc.\\ from the BNF package, and \n  some auxiliary functions which provide recursors on datatypes, common tactics, etc.\\<close>\n\ntheory Generator_Aux\nimports \n  Main\nbegin\n\nML_file \\<open>bnf_access.ML\\<close>\nML_file \\<open>generator_aux.ML\\<close>\n\nlemma in_set_simps: \n  \"x \\<in> set (y # z # ys) = (x = y \\<or> x \\<in> set (z # ys))\"\n  \"x \\<in> set ([y]) = (x = y)\"\n  \"x \\<in> set [] = False\" \n  \"Ball (set []) P = True\" \n  \"Ball (set [x]) P = P x\" \n  \"Ball (set (x # y # zs)) P = (P x \\<and> Ball (set (y # zs)) P)\" \n  by auto\n  \nlemma conj_weak_cong: \"a = b \\<Longrightarrow> c = d \\<Longrightarrow> (a \\<and> c) = (b \\<and> d)\" by auto\n\nlemma refl_True: \"(x = x) = True\" by simp\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Deriving/Generator_Aux.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6723317123102955, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3440433010583621}}
{"text": "theory ReduceSetOwn\n  imports SubstDropEnv ReduceProper\nbegin\n  \n    (* ##### defines a properly formed memory *)\n  \nfun mem_ty where\n  \"mem_ty (ArrayTy tau) = unlim tau\"\n| \"mem_ty (ChanTy tau c_end) = True\"\n| \"mem_ty tau = False\"\n    \ndefinition mem_val_env where\n  \"mem_val_env env = (\\<forall> x. case x of\n    Var x \\<Rightarrow> True\n    | Loc b \\<Rightarrow> (case env x of\n      None \\<Rightarrow> True\n      | Some tau \\<Rightarrow> mem_ty tau\n    )\n  )\"      \n  \nlemma add_mem_val_env: \"\\<lbrakk> mem_val_env env \\<rbrakk> \\<Longrightarrow> mem_val_env (add_env env (Var x) tau)\"  \n  apply (simp add: mem_val_env_def)\n  apply (auto)\n  apply (case_tac \"xa = Var x\")\n   apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (case_tac xa)\n   apply (auto)\n  apply (simp add: add_env_def)\n  done\n    \n    (*\n      ##### preliminary definitions for defining how permission environments change after ownership rewriting\n     *)\n  \n    (* defines the set of ownership annotation vars in an expression *)\n  (*\nfun ann_vars where\n  \"ann_vars (ConstExp c) = {}\"\n| \"ann_vars (OpExp xop) = {}\"\n| \"ann_vars (VarExp (VarType x)) = {}\"\n| \"ann_vars (VarExp (LocType x y)) = {y}\"\n| \"ann_vars (PairExp e1 e2) = (ann_vars e1 \\<union> ann_vars e2)\"    \n| \"ann_vars (IfExp e1 e2 e3) = (ann_vars e1 \\<union> ann_vars e2 \\<union> ann_vars e3)\"  \n| \"ann_vars (LamExp x e) = (ann_vars e)\"  \n| \"ann_vars (AppExp e1 e2) = (ann_vars e1 \\<union> ann_vars e2)\"   \n  \ndefinition not_ann_var where\n  \"not_ann_var x e = (x \\<notin> ann_vars e)\"  \n  \nlemma ann_res_vars: \"\\<lbrakk> Loc x \\<in> res_vars e \\<rbrakk> \\<Longrightarrow> x \\<in> ann_vars e\"  \n  apply (induct e)\n        apply (auto)\n  apply (case_tac xa)\n   apply (auto)\n  done\n  *)\n    (* semi-weakness: defines weakness over a set of variables *)\n  (*\ndefinition semi_weak_use_env where\n  \"semi_weak_use_env r_s r_set = (\\<forall> x. x \\<in> r_set \\<longrightarrow> r_s (Loc x) \\<noteq> OwnPerm)\"\n\nlemma sw_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s; semi_weak_use_env r_s r_set \\<rbrakk> \\<Longrightarrow> semi_weak_use_env r_x r_set\"  \n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_s (Loc x)\")\n    apply (auto)\n  done      \n\nlemma sw_add_use_env: \"\\<lbrakk> semi_weak_use_env r_s r_set; x \\<notin> r_set \\<rbrakk> \\<Longrightarrow> semi_weak_use_env (add_use_env r_s (Loc x) r) r_set\"    \n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: add_use_env_def)\n  done\n  \nlemma sw_add_use_env2: \"\\<lbrakk> semi_weak_use_env r_s r_set \\<rbrakk> \\<Longrightarrow> semi_weak_use_env (add_use_env r_s (Var x) r) r_set\"    \n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: add_use_env_def)\n  done\n    \nlemma rhs_sw_leq_use_none: \"\\<lbrakk> leq_use_env (diff_use_env r_x r_ex) r_s; r_s (Loc x) = NoPerm; semi_weak_use_env r_ex r_set; x \\<in> r_set  \\<rbrakk> \\<Longrightarrow> r_x (Loc x) = NoPerm\"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_ex (Loc x)\")\n    apply (auto)\n   apply (case_tac \"r_x (Loc x)\")\n     apply (auto)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  done \n    \nlemma semi_weak_drop_use_env: \"semi_weak_use_env (drop_use_env r_s) r_set\"    \n  apply (simp add: semi_weak_use_env_def)\n  apply (auto)\n  apply (simp add: drop_use_env_def)\n  apply (case_tac \"r_s (Loc x)\")\n    apply (auto)\n  done    \n    \n    (* pwrite_use_env: pwrite(P, S, x) =\n        if (exists z \\<in> S and z \\<in> P) P + {x: use}\n        else P\n      (x is only written if one of the vars from S is in P)\n    *)\n    \ndefinition set_use_none :: \"perm_use_env \\<Rightarrow> string set \\<Rightarrow> bool\" where\n  \"set_use_none r_s r_set = (\\<forall> x. x \\<in> r_set \\<longrightarrow> r_s (Loc x) = NoPerm)\"\n    \n\n    \nlemma leq_set_use_none: \"\\<lbrakk> leq_use_env r_x r_s; set_use_none r_s s \\<rbrakk> \\<Longrightarrow> set_use_none r_x s\"  \n  apply (simp add: set_use_none_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  done    \n    \n    \nlemma disj_add_use_env_sw: \"\\<lbrakk> disj_use_env r_x r_s; semi_weak_use_env r_s r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow> disj_use_env (add_use_env r_x (Loc x) UsePerm) r_s\"    \n  apply (simp add: disj_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (auto)\n  apply (simp add: semi_weak_use_env_def)\n  done    \n    \nlemma disj_pwrite_use_env: \"\\<lbrakk> semi_weak_use_env r_x r_set; semi_weak_use_env r_s r_set; x \\<in> r_set; disj_use_env r_x r_s \\<rbrakk> \\<Longrightarrow>\n  disj_use_env (pwrite_use_env r_x r_set x) (pwrite_use_env r_s r_set x)\"   \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n    apply (rule_tac comm_disj_use_env)\n    apply (rule_tac disj_add_use_env_sw)\n    apply (rule_tac comm_disj_use_env)\n     apply (auto)\n   apply (rule_tac disj_add_use_env_sw)\n    apply (auto)\n  apply (rule_tac disj_add_use_env_sw)\n   apply (rule_tac comm_disj_use_env)\n   apply (rule_tac disj_add_use_env_sw)\n    apply (rule_tac comm_disj_use_env)\n    apply (auto)\n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: add_use_env_def)\n  done\n  \nlemma disj_lift_pwrite_use_env: \"\\<lbrakk> disj_use_env (lift_use_env r_x r) (lift_use_env r_s r);\n  leq_use_env (lift_use_env r_x r) r_c; leq_use_env (lift_use_env r_s r) r_c; semi_weak_use_env r_c r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow>\n  disj_use_env (lift_use_env (pwrite_use_env r_x r_set x) r) (lift_use_env (pwrite_use_env r_s r_set x) r)\"    \n  apply (case_tac \"\\<not> is_own r\")\n   apply (simp add: is_own_def)\n    apply (case_tac r)\n      apply (auto)\n    apply (rule_tac disj_pwrite_use_env)\n       apply (auto)\n     apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n      apply (auto)\n    apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n     apply (auto)\n   apply (rule_tac disj_pwrite_use_env)\n     apply (auto)\n    apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n     apply (auto)\n   apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n    apply (auto)\n  apply (case_tac \"\\<not> set_use_none r_x r_set\")\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (simp add: leq_use_env_def)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (simp add: is_own_def)\n   apply (simp add: semi_weak_use_env_def)\n   apply (case_tac \"r_c (Loc xa)\")\n     apply (auto)\n    (* if r_s uses x in r_set, r_c x = Own, a contradiction by semi-weakness *)\n  apply (case_tac \"\\<not> set_use_none r_s r_set\")\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (simp add: leq_use_env_def)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (simp add: semi_weak_use_env_def)\n   apply (simp add: is_own_def)\n   apply (case_tac \"r_c (Loc xa)\")\n     apply (auto)\n  apply (simp add: pwrite_use_env_def)\n  done    \n\n    (* - pwrite equality lemmas *)\n    \nlemma lift_pwrite_use_env: \"\\<lbrakk> semi_weak_use_env (lift_use_env r_s r) r_set \\<rbrakk> \\<Longrightarrow>\n  pwrite_use_env (lift_use_env r_s r) r_set x = lift_use_env (pwrite_use_env r_s r_set x) r\"\n  apply (case_tac \"is_own r\")\n   apply (case_tac \"\\<not> set_use_none r_s r_set\")\n    apply (simp add: set_use_none_def)\n    apply (auto)\n    apply (simp add: semi_weak_use_env_def)\n    apply (simp add: is_own_def)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (auto)\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (simp add: is_own_def)\n  apply (simp add: is_own_def)\n  apply (case_tac r)\n    apply (auto)\n  done\n    \nlemma pwc_add_use_env1: \"\\<lbrakk> semi_weak_use_env r_x r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow> comp_use_env r_x (add_use_env r_s (Loc x) UsePerm) = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm\"    \n  apply (case_tac \"\\<forall> y. comp_use_env r_x (add_use_env r_s (Loc x) UsePerm) y = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm y\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (case_tac \"Loc x = y\")\n   apply (auto)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  done\n\nlemma pwc_add_use_env2: \"\\<lbrakk> semi_weak_use_env r_s r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow> comp_use_env (add_use_env r_x (Loc x) UsePerm) r_s = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm\"    \n  apply (case_tac \"\\<forall> y. comp_use_env (add_use_env r_x (Loc x) UsePerm) r_s y = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm y\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (case_tac \"Loc x = y\")\n   apply (auto)\n  apply (case_tac \"r_s (Loc x)\")\n    apply (auto)\n  done    \n  \nlemma pwrite_comp_use_env: \"\\<lbrakk> semi_weak_use_env r_x r_set; semi_weak_use_env r_s r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow>\n  comp_use_env (pwrite_use_env r_x r_set x) (pwrite_use_env r_s r_set x) = pwrite_use_env (comp_use_env r_x r_s) r_set x\"\n  apply (case_tac \"set_use_none r_x r_set\")\n   apply (case_tac \"set_use_none r_s r_set\")\n    apply (simp add: pwrite_use_env_def)\n    apply (auto)\n    apply (simp add: set_use_none_def)\n    apply (simp add: comp_use_env_def)\n    apply (auto)\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n    apply (simp add: set_use_none_def)\n    apply (simp add: comp_use_env_def)\n    apply (auto)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (auto)\n    apply (case_tac \"r_s (Loc xa)\")\n      apply (auto)\n   apply (rule_tac pwc_add_use_env1)\n   apply (auto)\n  apply (case_tac \"set_use_none r_s r_set\")\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n    apply (simp add: set_use_none_def)\n    apply (simp add: comp_use_env_def)\n    apply (auto)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (auto)\n    apply (case_tac \"r_x (Loc xa)\")\n      apply (auto)\n   apply (rule_tac pwc_add_use_env2)\n   apply (auto)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (simp add: set_use_none_def)\n   apply (simp add: comp_use_env_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (auto) \n   apply (case_tac \"r_x (Loc xa)\")\n     apply (auto)\n   apply (case_tac \"r_s (Loc xa)\")\n     apply (auto)\n  apply (rule_tac dist_add_comp_use_env)\n  done    \n  \nlemma diff_pwrite_rem_use_env: \"\\<lbrakk> semi_weak_use_env r_x r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow>\n  diff_use_env (pwrite_use_env r_s r_set x) (rem_use_env r_x (Loc x)) = pwrite_use_env (diff_use_env r_s r_x) r_set x\"    \n  apply (case_tac \"set_use_none r_s r_set\")\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (simp add: set_use_none_def)\n    apply (case_tac \"\\<forall> y. diff_use_env r_s (rem_use_env r_x (Loc x)) y = diff_use_env r_s r_x y\")\n     apply (auto)\n    apply (simp add: diff_use_env_def)\n    apply (simp add: rem_use_env_def)\n    apply (case_tac \"Loc x = y\")\n     apply (auto)\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (auto)\n   apply (cut_tac r_x=\"diff_use_env r_s r_x\" and r_s=\"r_s\" and x=\"Loc xa\" in leq_use_none)\n     apply (auto)\n   apply (rule_tac self_diff_leq_use_env)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (auto)\n   apply (case_tac \"r_x (Loc xa) \\<noteq> OwnPerm\")\n    apply (simp add: diff_use_env_def)\n    apply (case_tac \"r_x (Loc xa)\")\n      apply (auto)\n   apply (simp add: semi_weak_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: diff_add_rem_use_env)\n  done    \n    \n    (* #### actual ownership rewriting algorithm *)\n  \nfun set_own where\n  \"set_own (ConstExp c) b = ConstExp c\"\n| \"set_own (OpExp xop) b = OpExp xop\"\n| \"set_own (VarExp v) b = (case v of\n    VarType x \\<Rightarrow> VarExp v\n    | LocType x y \\<Rightarrow> VarExp (LocType x b))\"\n| \"set_own (PairExp e1 e2) b = (PairExp (set_own e1 b) (set_own e2 b))\"\n| \"set_own (IfExp e1 e2 e3) b = (IfExp (set_own e1 b) (set_own e2 b) (set_own e3 b))\"\n| \"set_own (LamExp x e) b = (LamExp x (set_own e b))\"  \n| \"set_own (AppExp e1 e2) b = (AppExp (set_own e1 b) (set_own e2 b))\"\n  \nlemma well_typed_set_own_ann_vars: \"\\<lbrakk> well_typed env r_s1 (set_own e b) tau r_s2 rx; x \\<noteq> b \\<rbrakk> \\<Longrightarrow> x \\<notin> ann_vars (set_own e b)\"  \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n          apply (case_tac xa)\n           apply (auto)\n    (* other cases *)\n         apply (iprover)\n        apply (iprover)\n       apply (iprover)\n      apply (iprover)\n     apply (iprover)\n    apply (iprover)\n   apply (iprover)\n  apply (iprover)\n  done\n    \nlemma well_typed_set_own_none: \"\\<lbrakk> ann_vars e = {}; well_typed env r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow>\n   well_typed env r_s1 (set_own e b) tau r_s2 rx\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)  \n        apply (auto)\n    (* var case *)\n      apply (case_tac x)\n       apply (auto)\n    (* pair case *)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx1\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx2\" in exI)\n    apply (auto)\n    (* lam case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_end\" in exI)\n   apply (rule_tac x=\"r_s'\" in exI)\n   apply (auto)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  done  \n \nlemma well_typed_no_av_use: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; r_s1 (Loc x) = NoPerm \\<rbrakk> \\<Longrightarrow> not_ann_var x e\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const + op cases *)\n        apply (simp add: not_ann_var_def)\n       apply (simp add: not_ann_var_def)\n    (* var case *)\n      apply (simp add: not_ann_var_def)\n      apply (auto)\n      apply (simp add: leq_use_env_def)\n      apply (simp add: ereq_use_env_def)\n      apply (simp add: one_use_env_def)\n      apply (erule_tac x=\"Loc x\" in allE)\n      apply (case_tac xa)\n       apply (auto)\n      apply (simp add: end_req_perm_def)\n    (* pair case *)\n     apply (simp add: not_ann_var_def)\n     apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"Loc x\" in leq_use_none)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    (* if case *)\n    apply (simp add: not_ann_var_def)\n    apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"Loc x\" in leq_use_none)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* lam case *)\n   apply (simp add: not_ann_var_def)\n   apply (cut_tac r_x=\"rxa\" and r_s=\"r_s1\" and x=\"Loc x\" in leq_use_none)\n     apply (auto)\n   apply (case_tac \"\\<not> add_use_env rxa (Var x1a) r (Loc x) = NoPerm\")\n    apply (simp add: add_use_env_def)\n   apply (auto)\n   apply (iprover)\n    (* app case *)\n  apply (simp add: not_ann_var_def)\n  apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"Loc x\" in leq_use_none)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  done    \n    \nlemma water_var_case: \"\\<lbrakk>ann_vars (VarExp x) \\<subseteq> r_set; semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t; env (res_name x) = Some tau;\n        env (owner_name x) = Some tau_x; value_req x tau tau_x; leq_use_env (ereq_use_env (owner_name x) tau_x) r_s1;\n        leq_use_env r_s2 (diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name x) tau_x) r_ex)); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n        leq_use_env (diff_use_env (ereq_use_env (owner_name x) tau_x) (comp_use_env (ereq_use_env (owner_name x) tau_x) r_ex)) rx\\<rbrakk>\n       \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (case x of VarType xa \\<Rightarrow> VarExp x | LocType x y \\<Rightarrow> VarExp (LocType x b)) tau\n            (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b)\"\n    (* var case. non-value *)\n       (*apply (simp add: not_free_var_def)*)\n  apply (case_tac x)\n   apply (auto)\n      apply (rule_tac rhs_add_leq_use_env)\n       apply (auto)\n      apply (simp add: ereq_use_env_def)\n      apply (simp add: one_use_env_def)\n     apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n     apply (auto)\n        apply (rule_tac r_sb=\"diff_use_env (add_use_env r_s1 (Loc b) UsePerm) (rem_use_env (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex) (Loc b))\" in trans_leq_use_env)\n         apply (simp add: dist_rem_comp_use_env)\n         apply (rule_tac unroll_dcl_use_env)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (rule_tac rhs_diff_rem_leq_use_env2)\n          apply (simp add: ereq_use_env_def)\n          apply (simp add: one_use_env_def)\n         apply (rule_tac id_leq_use_env)\n        apply (rule_tac t=\"diff_use_env (add_use_env r_s1 (Loc b) UsePerm) (rem_use_env (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex) (Loc b))\"\n           and s=\"add_use_env (diff_use_env r_s1 (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)) (Loc b) UsePerm\" in subst)\n         apply (rule_tac diff_add_rem_use_env)\n        apply (rule_tac dist_add_leq_use_env)\n        apply (simp)\n       apply (rule_tac add_pwrite_leq_use_env)\n         apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n          apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)\" in trans_leq_use_env)\n           apply (rule_tac self_diff_leq_use_env)\n          apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n           apply (auto)\n       apply (rule_tac dist_add_leq_use_env)\n       apply (simp)\n      apply (rule_tac rhs_add_leq_use_env)\n       apply (rule_tac rem_leq_use_env)\n       apply (simp)\n      apply (simp add: rem_use_env_def)\n     apply (rule_tac r_sb=\"diff_use_env (ereq_use_env (Var x1) tau_x) (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac pwrite_leq_use_env)\n        apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n         apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)\" in trans_leq_use_env)\n          apply (rule_tac self_diff_leq_use_env)\n         apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n          apply (auto)\n     apply (rule_tac unroll_dcl_use_env)\n     apply (rule_tac rhs_diff_rem_leq_use_env2)\n      apply (cut_tac r_x=\"r_ex\" and r_s=\"r_s1\" in sw_leq_use_env)\n        apply (simp)\n       apply (auto)\n      apply (simp add: semi_weak_use_env_def)\n     apply (rule_tac id_leq_use_env)\n    apply (case_tac t)\n          apply (auto)\n   apply (rule_tac ereq_leq_use_envx)\n   apply (simp add: end_req_perm_def)\n   apply (simp add: add_use_env_def)\n   apply (case_tac t)\n         apply (auto)\n    (* var case. value cases *)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n     apply (rule_tac rhs_flip_use_env)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (rule_tac rhs_weak_leq_use_env)\n      apply (rule_tac weak_ereq_use_env)\n      apply (simp add: unlim_def)\n      apply (case_tac t)\n            apply (auto)\n     apply (rule_tac t=\"diff_use_env (add_use_env r_s1 (Loc b) UsePerm) (rem_use_env r_ex (Loc b))\" and s=\"add_use_env (diff_use_env r_s1 r_ex) (Loc b) UsePerm\" in subst)\n      apply (rule_tac diff_add_rem_use_env)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Loc x22) tau_x) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env_gen)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env2)\n     apply (simp)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Loc x22) tau_x) r_ex)\" in trans_leq_use_env)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (simp)\n   apply (simp add: rem_use_env_def)\n    (* - req bound manipulation *)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n    (* - say that we do not add a perm to rx. this means x1a is not in rx, which is impossible since r_s1 is weak *)\n   apply (case_tac \"rx (Loc x22) \\<noteq> NoPerm\")\n    apply (simp add: set_use_none_def)\n   apply (case_tac \"ereq_use_env (Loc x22) tau_x (Loc x22) \\<noteq> UsePerm\")\n    apply (simp add: ereq_use_env_def)\n    apply (simp add: one_use_env_def)\n    apply (simp add: end_req_perm_def)\n   apply (case_tac \"comp_use_env (ereq_use_env (Loc x22) tau_x) r_ex (Loc x22) \\<noteq> OwnPerm\")\n    apply (cut_tac r_x=\"ereq_use_env (Loc x22) tau_x\" and r_s=\"rx\" and r_ex=\"comp_use_env (ereq_use_env (Loc x22) tau_x) r_ex\" and x=\"Loc x22\" in diff_use_leq)\n      apply (auto)\n   apply (cut_tac r_x=\"comp_use_env (ereq_use_env (Loc x22) tau_x) r_ex\" and r_s=\"r_s1\" and x=\"Loc x22\" in leq_use_own)\n     apply (simp)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (auto)\n   apply (simp add: semi_weak_use_env_def)\n    (* - otherwise we know what x is *)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac ereq_leq_use_envx)\n  apply (simp add: add_use_env_def)\n  apply (simp add: end_req_perm_def)\n  apply (case_tac t)\n        apply (auto)\n  done  \n  \nlemma water_pair_case: \"\\<lbrakk>\\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e1 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e2 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e2 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t; ann_vars e1 \\<subseteq> r_set; ann_vars e2 \\<subseteq> r_set; well_typed env r_s1 e1 t1 r_s2a rx1;\n        well_typed env r_s2a e2 t2 r_s3 rx2; leq_use_env (lift_use_env rx1 r) r_s3; leq_use_env (lift_use_env rx2 r) r_s3;\n        aff_leq (max_aff (req_type t1) (req_type t2)) r; disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r); leq_use_env r_s2 (diff_use_env r_s3 r_ex);\n        leq_use_env rx r_s2; leq_use_env r_ex r_s1; leq_use_env (pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex (PairTy t1 t2 r)) rx\\<rbrakk>\n       \\<Longrightarrow> \\<exists>r_s2a r_s3 rx1.\n              well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) t1 r_s2a rx1 \\<and>\n              (\\<exists>rx2. well_typed env r_s2a (set_own e2 b) t2 r_s3 rx2 \\<and>\n                     leq_use_env (lift_use_env rx1 r) r_s3 \\<and>\n                     leq_use_env (lift_use_env rx2 r) r_s3 \\<and>\n                     disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r) \\<and>\n                     (\\<exists>r_ex. leq_use_env (add_use_env r_s2 (Loc b) UsePerm) (diff_use_env r_s3 r_ex) \\<and>\n                             leq_use_env (pwrite_use_env rx r_set b) (add_use_env r_s2 (Loc b) UsePerm) \\<and>\n                             leq_use_env r_ex (add_use_env r_s1 (Loc b) UsePerm) \\<and>\n                             leq_use_env (pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex (PairTy t1 t2 r)) (pwrite_use_env rx r_set b)))\"    \n  apply (rule_tac x=\"add_use_env r_s2a (Loc b) UsePerm\" in exI)\n  apply (rule_tac x=\"add_use_env r_s3 (Loc b) UsePerm\" in exI)\n  apply (rule_tac x=\"pwrite_use_env rx1 r_set b\" in exI)\n  apply (auto)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (cut_tac r_x=\"lift_use_env rx1 r\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx2 r_set b\" in exI)\n  apply (auto)\n      apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in sw_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n     apply (rule_tac lift_pwrite_leq_use_env)\n       apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n        apply (auto)\n    apply (rule_tac lift_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (auto)\n   apply (rule_tac r_c=\"r_s1\" in disj_lift_pwrite_use_env)\n       apply (auto)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n   apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n    apply (auto)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n     apply (rule_tac t=\"diff_use_env (add_use_env r_s3 (Loc b) UsePerm) (rem_use_env r_ex (Loc b))\"\n          and s=\"add_use_env (diff_use_env r_s3 r_ex) (Loc b) UsePerm\" in subst)\n      apply (rule_tac diff_add_rem_use_env)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac diff_leq_use_env)\n        apply (simp)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (auto)\n   apply (simp add: rem_use_env_def)\n  apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n   apply (simp add: pair_req_def)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: pair_req_def)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx1 r_set b) r\" and s=\"pwrite_use_env (lift_use_env rx1 r) r_set b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx2 r_set b) r\" and s=\"pwrite_use_env (lift_use_env rx2 r) r_set b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (simp add: pwrite_comp_use_env)\n  apply (cut_tac r_x=\"r_ex\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (auto)\n  apply (simp add: diff_pwrite_rem_use_env)\n  apply (rule_tac dist_pwrite_leq_use_env)\n    apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac diff_leq_use_env)\n      apply (simp)\n     apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n      apply (auto)\n  done\n\nlemma water_if_case: \"\\<lbrakk>\\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e1 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e2 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e2 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e3 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e3 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t; ann_vars e1 \\<subseteq> r_set; well_typed env r_s1 e1 BoolTy r_s2a rx';\n        ann_vars e2 \\<subseteq> r_set; ann_vars e3 \\<subseteq> r_set; well_typed env r_s2a e2 tau r_s2 rx1; well_typed env r_s2a e3 tau r_s2 rx2\\<rbrakk>\n       \\<Longrightarrow> \\<exists>rx' r_s2a.\n              well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) BoolTy r_s2a rx' \\<and>\n              (\\<exists>rx1a. well_typed env r_s2a (set_own e2 b) tau (add_use_env r_s2 (Loc b) UsePerm) rx1a \\<and>\n                      (\\<exists>rx2a. well_typed env r_s2a (set_own e3 b) tau (add_use_env r_s2 (Loc b) UsePerm) rx2a \\<and>\n                              pwrite_use_env (comp_use_env rx1 rx2) r_set b = comp_use_env rx1a rx2a))\"    \n  apply (rule_tac x=\"pwrite_use_env rx' r_set b\" in exI)\n  apply (rule_tac x=\"add_use_env r_s2a (Loc b) UsePerm\" in exI)\n  apply (auto)\n  apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and r_set=\"r_set\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx1 r_set b\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx2 r_set b\" in exI)\n  apply (auto)\n  apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s2a\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (cut_tac r_x=\"rx1\" and r_s=\"r_s2\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leqx)\n    apply (auto)\n  apply (cut_tac r_x=\"rx2\" and r_s=\"r_s2\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leqx)\n    apply (auto)\n  apply (simp add: pwrite_comp_use_env)\n  done    \n    \nlemma wtae_end_leq_use_env2: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_ex) \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (add_use_env r_x x UsePerm) (diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_ex x))\"  \n  apply (rule_tac t=\"diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_ex x)\"\n      and s=\"add_use_env (diff_use_env r_s r_ex) x UsePerm\" in subst)\n   apply (rule_tac diff_add_rem_use_env)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)  \n  done    \n    \nlemma water_lam_case: \"\\<lbrakk>\\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        ann_vars e \\<subseteq> r_set; semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t;\n        well_typed (add_env env (Var x1a) t1) (add_use_env rxa (Var x1a) r) e t2 r_s' r_end; aff_use_env rxa a; leq_use_env rxa r_s1;\n        leq_use_env r_s2 (diff_use_env r_s1 r_ex); leq_use_env rx r_s2; leq_use_env r_ex r_s1; leq_use_env (diff_use_env rxa r_ex) rx\\<rbrakk>\n       \\<Longrightarrow> \\<exists>rxa. (\\<exists>r_end r_s'. well_typed (add_env env (Var x1a) t1) (add_use_env rxa (Var x1a) r) (set_own e b) t2 r_s' r_end) \\<and>\n                 aff_use_env rxa a \\<and>\n                 leq_use_env rxa (add_use_env r_s1 (Loc b) UsePerm) \\<and>\n                 (\\<exists>r_ex. leq_use_env (add_use_env r_s2 (Loc b) UsePerm) (diff_use_env (add_use_env r_s1 (Loc b) UsePerm) r_ex) \\<and>\n                         leq_use_env (pwrite_use_env rx r_set b) (add_use_env r_s2 (Loc b) UsePerm) \\<and>\n                         leq_use_env r_ex (add_use_env r_s1 (Loc b) UsePerm) \\<and> leq_use_env (diff_use_env rxa r_ex) (pwrite_use_env rx r_set b))\"\n    (* lam case. rxa does not contain any members of r_set *)\n  apply (case_tac \"set_use_none rxa r_set\")\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n     apply (rule_tac x=\"r_end\" in exI)\n     apply (rule_tac x=\"r_s'\" in exI)\n     apply (rule_tac well_typed_set_own_none)\n      apply (auto)\n     apply (cut_tac env=\"add_env env (Var x1a) t1\" and ?r_s1.0=\"add_use_env rxa (Var x1a) r\" and x=\"x\" and e=\"e\" in well_typed_no_av_use)\n       apply (auto)\n      apply (simp add: add_use_env_def)\n      apply (simp add: set_use_none_def)\n      apply (auto)\n     apply (simp add: not_ann_var_def)\n    apply (rule_tac rhs_add_leq_use_env)\n     apply (simp)\n    apply (simp add: set_use_none_def)\n   apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n   apply (auto)\n      apply (rule_tac wtae_end_leq_use_env2)\n      apply (simp)\n     apply (rule_tac add_pwrite_leq_use_env)\n       apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n        apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n         apply (rule_tac self_diff_leq_use_env)\n        apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n         apply (auto)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    apply (rule_tac rhs_add_leq_use_env)\n     apply (rule_tac rem_leq_use_env)\n     apply (simp)\n    apply (simp add: rem_use_env_def)\n   apply (rule_tac pwrite_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (auto)\n   apply (rule_tac r_sb=\"diff_use_env rxa r_ex\" in trans_leq_use_env)\n    apply (simp)\n    apply (rule_tac rhs_diff_rem_leq_use_env)\n    apply (simp add: set_use_none_def)\n   apply (rule_tac id_leq_use_env)  \n    (* lam case. rxa contains at least one member of r_set *)\n    (* - prelim: rxa is not primitive *)\n  apply (case_tac \"a = Prim\")\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (simp add: aff_use_env_def)\n  apply (simp add: null_use_env_def)\n    (* - prelim: rx has at least one value as well *)\n  apply (case_tac \"set_use_none rx r_set\")\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (cut_tac r_ex=\"r_ex\" and r_x=\"rxa\" and r_s=\"rx\" and x=\"x\" in rhs_sw_leq_use_none)\n       apply (auto)\n   apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n    apply (auto)\n    (* - prelim: x \\<noteq> x1a *)\n  apply (rule_tac x=\"add_use_env rxa (Loc b) UsePerm\" in exI)\n  apply (auto)\n     apply (rule_tac x=\"pwrite_use_env r_end r_set b\" in exI)\n     apply (rule_tac x=\"add_use_env r_s' (Loc b) UsePerm\" in exI)\n     apply (rule_tac t=\"add_use_env (add_use_env rxa (Loc b) UsePerm) (Var x1a) r\" and s=\"add_use_env (add_use_env rxa (Var x1a) r) (Loc b) UsePerm\" in subst)\n      apply (simp add: almost_comm_add_use_env)\n     apply (cut_tac r_s=\"rxa\" and x=\"x1a\" and r=\"r\" and r_set=\"r_set\" in sw_add_use_env2)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (auto)\n     apply (case_tac \"\\<not> add_env env (Var x1a) t1 (Loc b) = Some t\")\n      apply (simp add: add_env_def)\n     apply (auto)\n    apply (simp add: aff_use_env_def)\n    apply (case_tac a)\n      apply (auto)\n    apply (simp add: weak_use_env_def)\n    apply (simp add: add_use_env_def)\n   apply (rule_tac dist_add_leq_use_env)\n   apply (simp)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n     apply (rule_tac t=\"diff_use_env (add_use_env r_s1(Loc b) UsePerm) (rem_use_env r_ex (Loc b))\" and\n        s=\"add_use_env (diff_use_env r_s1 r_ex) (Loc b) UsePerm\" in subst)\n      apply (rule_tac diff_add_rem_use_env)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (simp)\n   apply (simp add: rem_use_env_def)\n  apply (simp add: pwrite_use_env_def)\n  apply (rule_tac t=\"diff_use_env (add_use_env rxa (Loc b) UsePerm) (rem_use_env r_ex (Loc b))\" and\n      s=\"add_use_env (diff_use_env rxa r_ex) (Loc b) UsePerm\" in subst)\n   apply (rule_tac diff_add_rem_use_env)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)\n  done\n    \nlemma wtae_end_leq_use_env1: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s (comp_use_env r_exa r_exb)); r_exa x \\<noteq> OwnPerm \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (add_use_env r_x x UsePerm) (diff_use_env (add_use_env r_s x UsePerm) (comp_use_env r_exa (rem_use_env r_exb x)))\"    \n  apply (rule_tac r_sb=\"diff_use_env (add_use_env r_s x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\" in trans_leq_use_env)\n   apply (simp add: dist_rem_comp_use_env)\n   apply (rule_tac unroll_dcl_use_env)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (rule_tac rhs_diff_rem_leq_use_env2)\n    apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac t=\"diff_use_env (add_use_env r_s x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\"\n      and s=\"add_use_env (diff_use_env r_s (comp_use_env r_exa r_exb)) x UsePerm\" in subst)\n   apply (rule_tac diff_add_rem_use_env)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)\n  done\n    \nlemma wtae_req_leq_use_env1: \"\\<lbrakk> leq_use_env (diff_use_env r_x (comp_use_env r_exa r_exb)) r_s \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (diff_use_env (add_use_env r_x x UsePerm) (comp_use_env r_exa (rem_use_env r_exb x))) (add_use_env r_s x UsePerm)\"\n  apply (rule_tac r_sb=\"diff_use_env (add_use_env r_x x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\" in trans_leq_use_env)\n   apply (rule_tac t=\"diff_use_env (add_use_env r_x x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\"\n      and s=\"add_use_env (diff_use_env r_x (comp_use_env r_exa r_exb)) x UsePerm\" in subst)\n    apply (rule_tac diff_add_rem_use_env)\n   apply (rule_tac dist_add_leq_use_env)\n   apply (simp)\n  apply (rule_tac dist_diff_leq_use_env_gen)\n   apply (rule_tac id_leq_use_env)\n  apply (simp add: dist_rem_comp_use_env)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (rule_tac comp_leq_use_env1)\n   apply (rule_tac self_rem_leq_use_env)\n  apply (rule_tac self_comp_leq_use_env2)\n  done\n    \nlemma water_app_case: \"\\<lbrakk>\\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e1 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e2 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e2 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t; ann_vars e1 \\<subseteq> r_set; ann_vars e2 \\<subseteq> r_set;\n        well_typed env r_s1 e1 (FunTy t1 tau r a) r_s2a rx1; well_typed env r_s2a e2 t1 r_s3 rx2;\n        leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex));\n        leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n        leq_use_env (app_req rx1 rx2 r tau r_ex) rx\\<rbrakk>\n       \\<Longrightarrow> \\<exists>t1 r a r_s2a rx1.\n              well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) (FunTy t1 tau r a) r_s2a rx1 \\<and>\n              (\\<exists>rx2 r_s3. well_typed env r_s2a (set_own e2 b) t1 r_s3 rx2 \\<and>\n                          (\\<exists>r_ex. leq_use_env (add_use_env r_s2 (Loc b) UsePerm) (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) \\<and>\n                                  leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3 \\<and>\n                                  disj_use_env rx1 (lift_use_env rx2 r) \\<and>\n                                  leq_use_env (pwrite_use_env rx r_set b) (add_use_env r_s2 (Loc b) UsePerm) \\<and>\n                                  leq_use_env r_ex (add_use_env r_s1 (Loc b) UsePerm) \\<and> leq_use_env (app_req rx1 rx2 r tau r_ex) (pwrite_use_env rx r_set b)))\"    \n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"add_use_env r_s2a (Loc b) UsePerm\" in exI)\n  apply (rule_tac x=\"pwrite_use_env rx1 r_set b\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx2 r_set b\" in exI)\n  apply (rule_tac x=\"add_use_env r_s3 (Loc b) UsePerm\" in exI)\n  apply (auto)\n   apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (cut_tac r_sc=\"r_s2\" and r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (auto)\n  apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n    apply (rule_tac self_comp_leq_use_env2)\n  apply (cut_tac r_x=\"rx1\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n    apply (rule_tac self_comp_leq_use_env1)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx2 r_set b) r\" and s=\"pwrite_use_env (lift_use_env rx2 r) r_set b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (simp)\n  apply (simp add: pwrite_comp_use_env)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n       apply (rule_tac wtae_end_leq_use_env1)\n        apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n         apply (rule_tac unroll_dcl_use_env)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (rule_tac rhs_pwrite_diff_leq_use_env)\n         apply (rule_tac id_leq_use_env)\n        apply (simp)\n       apply (simp add: pwrite_use_env_def)\n       apply (auto)\n        apply (cut_tac r_x=\"comp_use_env rx1 (lift_use_env rx2 r)\" and r_s=\"r_s1\" and x=\"Loc b\" in leq_use_no_own)\n          apply (simp add: semi_weak_use_env_def)\n         apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n          apply (auto)\n       apply (simp add: add_use_env_def)\n      apply (rule_tac add_pwrite_leq_use_env)\n        apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n         apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n          apply (auto)\n      apply (rule_tac dist_add_leq_use_env)\n      apply (simp)\n     apply (rule_tac disj_pwrite_use_env)\n        apply (auto)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (simp)\n   apply (simp add: rem_use_env_def)\n  apply (simp add: app_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx2 r_set b) r\" and s=\"pwrite_use_env (lift_use_env rx2 r) r_set b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (simp)\n  apply (cut_tac r_x=\"rx2\" and r_s=\"lift_use_env rx2 r\" in sw_leq_use_env)\n    apply (rule_tac self_lift_leq_use_env)\n   apply (simp)\n  apply (simp add: pwrite_comp_use_env)\n  apply (case_tac \"\\<not> set_use_none (comp_use_env rx1 rx2) r_set\")\n   apply (case_tac \"pwrite_use_env (comp_use_env rx1 rx2) r_set b \\<noteq> add_use_env (comp_use_env rx1 rx2) (Loc b) UsePerm\")\n    apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (case_tac \"set_use_none rx r_set\")\n    apply (simp add: set_use_none_def)\n    apply (auto)\n    apply (cut_tac r_x=\"comp_use_env rx1 rx2\" and r_s=\"rx\" and r_ex=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" and x=\"x\" in rhs_sw_leq_use_none)\n        apply (auto)\n    apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (auto)\n   apply (case_tac \"pwrite_use_env rx r_set b \\<noteq> add_use_env rx (Loc b) UsePerm\")\n    apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (rule_tac wtae_req_leq_use_env1)\n   apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n    apply (simp)\n   apply (rule_tac unroll_dcl_use_env)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (rule_tac dist_diff_leq_use_env_gen)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac pwrite_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (case_tac \"pwrite_use_env (comp_use_env rx1 rx2) r_set b \\<noteq> comp_use_env rx1 rx2\")\n   apply (simp add: pwrite_use_env_def)\n  apply (auto)\n  apply (rule_tac pwrite_leq_use_env)\n    apply (rule_tac sw_leq_use_env)\n     apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n      apply (auto)\n  apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac unroll_dcl_use_env)\n  apply (rule_tac rhs_diff_rem_leq_use_env2)\n   apply (rule_tac r_s=\"r_s1\" in leq_use_no_own)\n    apply (simp add: semi_weak_use_env_def)\n   apply (simp)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac dist_diff_leq_use_env_gen)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac pwrite_leq_use_env)\n    apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n  apply (rule_tac id_leq_use_env) \n  done\n    \nlemma well_typed_set_own_rep: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx;\n  ann_vars e \\<subseteq> r_set; semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t \\<rbrakk> \\<Longrightarrow>\n  well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b)\"      \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const + op cases *)\n           apply (rule_tac dist_add_leq_use_env)\n            apply (auto)\n          apply (rule_tac add_pwrite_leq_use_env)\n           apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n           apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n            apply (auto)\n          apply (rule_tac dist_add_leq_use_env)\n          apply (auto)\n         apply (rule_tac dist_add_leq_use_env)\n         apply (auto)\n        apply (rule_tac add_pwrite_leq_use_env)\n         apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n           apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n            apply (auto)\n        apply (rule_tac dist_add_leq_use_env)\n        apply (auto)\n    (* var case. *)\n      apply (rule_tac water_var_case)\n                  apply (auto)\n    (* pair case. *)\n     apply (rule_tac water_pair_case)\n                      apply (auto)\n    (* if case *)\n    apply (rule_tac water_if_case)\n                apply (auto)\n    (* lam case *)\n   apply (rule_tac water_lam_case)\n               apply (auto)\n    (* app case *)\n  apply (rule_tac water_app_case)\n                 apply (auto)\n  done  \n  \nlemma wtae_diff_use_env: \"\\<lbrakk> strong_use_env r_s \\<rbrakk> \\<Longrightarrow> diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_s x) = one_use_env x UsePerm\"    \n  apply (case_tac \"\\<forall> y. diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_s x) y = one_use_env x UsePerm y\")\n   apply (auto)\n  apply (simp add: one_use_env_def)\n  apply (simp add: rem_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: strong_use_env_def)\n  apply (case_tac \"x = y\")\n   apply (auto)\n  apply (erule_tac x=\"y\" in allE)\n  apply (case_tac \"r_s y\")\n    apply (auto)\n  done    \n  \nlemma well_typed_set_own: \"\\<lbrakk> well_typed env r_x e tau r_x r_x; is_value e;\n  env (Loc b) = Some t; mem_ty t; unlim tau; r_s (Loc b) \\<noteq> NoPerm; mem_val_env env; sub_env s env \\<rbrakk> \\<Longrightarrow>\n  well_typed env r_s (set_own e b) tau r_s (one_use_env (Loc b) UsePerm)\"    \n    (* to prove that ack_exp works with arbitrary permissions, we want to prove that it works with just x. *)\n  apply (rule_tac r_s=\"one_use_env (Loc b) UsePerm\" in well_typed_incr_simul_perm)\n   apply (simp add: leq_use_env_def)\n   apply (simp add: one_use_env_def)\n   apply (case_tac \"r_s (Loc b)\")\n     apply (auto)\n    (* call the induction hypothesis *)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"drop_use_env r_x\" and e=\"e\" and tau=\"tau\" and\n        ?r_s2.0=\"drop_use_env r_x\" and rx=\"drop_use_env r_x\" and b=\"b\" and r_set=\"{b} \\<union> ann_vars e\" and\n        t=\"t\" in well_typed_set_own_rep)    \n        apply (rule_tac wt_sexp_drop_all)\n          apply (auto)\n     apply (simp add: unlim_def)\n    apply (rule_tac value_is_sexp)\n    apply (simp)\n   apply (rule_tac semi_weak_drop_use_env)\n    (* to reduce r_x to just b, we must invoke the diff lemma *)\n  apply (cut_tac eq_own)\n  apply (auto)\n  apply (rule_tac t=\"one_use_env (Loc b) UsePerm\" and s=\"diff_use_env (add_use_env (lift_use_env r_x r) (Loc b) UsePerm)\n    (rem_use_env (lift_use_env r_x r) (Loc b))\" in subst)\n   apply (rule_tac wtae_diff_use_env)\n   apply (rule_tac strong_lift_use_env)\n   apply (simp)\n    (* permission manipulation *)\n  apply (rule_tac well_typed_diff_perms)\n   apply (rule_tac rx=\"pwrite_use_env (drop_use_env r_x) (insert b (ann_vars e)) b\" in well_typed_incr_req)\n     apply (rule_tac r_s=\"add_use_env (drop_use_env r_x) (Loc b) UsePerm\" in well_typed_incr_simul_perm)\n      apply (rule_tac dist_add_leq_use_env)\n      apply (rule_tac drop_leq_use_env)\n      apply (rule_tac self_lift_leq_use_env)\n     apply (simp)\n    (* proving requirements change was valid *)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac semi_weak_drop_use_env)\n     apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (rule_tac drop_leq_use_env)\n    apply (rule_tac self_lift_leq_use_env)\n   apply (rule_tac id_leq_use_env)\n    (* proving that the diff was valid, which should be true since b is the only non-prim var. say that x \\<noteq> b *)\n  apply (case_tac \"x \\<noteq> Loc b\")\n   apply (auto)\n   apply (case_tac x)\n    apply (auto)\n    (* - say that x is a var. then it must be in the env, which is impossible since env is under some s *)\n    apply (simp add: non_prim_vars_def)\n    apply (simp add: non_prim_entry_def)\n    apply (simp add: sub_env_def)\n    apply (erule_tac x=\"Var x1\" in allE)\n    apply (auto)\n    (* - otherwise, x is a res var in set_own, which means it must be an ann var, which is impossible *)\n   apply (simp add: non_prim_vars_def)\n   apply (auto)\n   apply (cut_tac x=\"x2\" and e=\"set_own e b\" in ann_res_vars)\n    apply (auto)\n   apply (cut_tac x=\"x2\" and e=\"e\" and b=\"b\" in well_typed_set_own_ann_vars)\n     apply (auto)\n    (* - then x = b, which is fine *)\n  apply (simp add: own_env_vars_def)\n  apply (simp add: rem_use_env_def)\n  done\n    \n    (* ##### other set_own lemmas *)\n    \nlemma set_own_value: \"\\<lbrakk> is_value v \\<rbrakk> \\<Longrightarrow> is_value (set_own v b)\"    \n  apply (induct v)\n        apply (auto)\n   apply (case_tac x)\n    apply (auto)\n  apply (case_tac v1)\n        apply (auto)\n  done\n    \n    (* a permission env is \"proper\" relative to x if every location used cen be found from x. *)\n    \ndefinition proper_use_env where\n  \"proper_use_env rs_map x e r_s = (\\<forall> y. (y \\<in> ref_vars e \\<and> r_s (Loc y) \\<noteq> NoPerm) \\<longrightarrow> (\\<exists> l. path_lookup rs_map x l y))\"\n  \nlemma leq_proper_use_env: \"\\<lbrakk> proper_use_env rs_map x e r_s; leq_use_env r_x r_s; ref_vars e' \\<subseteq> ref_vars e \\<rbrakk> \\<Longrightarrow> proper_use_env rs_map x e' r_x\"\n  apply (simp add: proper_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"y\" in allE)\n  apply (erule_tac x=\"Loc y\" in allE)\n  apply (auto)\n  apply (case_tac \"r_x (Loc y)\")\n    apply (auto)\n  done\n  \nlemma add_proper_use_env: \"\\<lbrakk> proper_use_env rs_map x e r_s \\<rbrakk> \\<Longrightarrow>\n  proper_use_env rs_map x e (add_use_env r_s (Var y) r)\"    \n  apply (simp add: proper_use_env_def)\n  apply (simp add: add_use_env_def)\n  done    \n    \nlemma proper_set_own_ih: \"\\<lbrakk> proper_use_env rs_map b e r_s; proper_exp rs_map e;\n   well_typed env r_s e tau r_se r_xe \\<rbrakk> \\<Longrightarrow> proper_exp rs_map (set_own e b)\"    \n  apply (induct e arbitrary: env r_s tau r_se r_xe)\n        apply (auto)\n    (* var case. we first posit that there is a path between b \\<leadsto> x22 *)\n      apply (case_tac \"x\")\n       apply (auto)\n      apply (simp add: proper_exp_def)\n      apply (case_tac \"\\<not> (\\<exists> l. path_lookup rs_map b l x22)\")\n       apply (simp add: proper_use_env_def)\n       apply (erule_tac x=\"x22\" in allE)\n       apply (auto)\n       apply (cut_tac r_x=\"ereq_use_env (Loc x22) tau_x\" and r_s=\"r_s\" and x=\"Loc x22\" in leq_use_none)\n         apply (simp_all)\n       apply (simp add: ereq_use_env_def)\n       apply (simp add: one_use_env_def)\n       apply (simp add: end_req_perm_def)\n    (* - we merge this with x22 \\<leadsto> x21 *)\n      apply (rule_tac x=\"la @ l\" in exI)\n      apply (rule_tac y=\"x22\" in path_lookup_append)\n       apply (auto)\n    (* pair case *)\n     apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_pair)\n      apply (auto)\n     apply (cut_tac r_x=\"r_s\" and r_s=\"r_s\" and rs_map=\"rs_map\" and e=\"PairExp e1 e2\" and e'=\"e1\" and x=\"b\" in leq_proper_use_env)\n        apply (auto)\n      apply (rule_tac id_leq_use_env)\n     apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s\" and rs_map=\"rs_map\" and e=\"PairExp e1 e2\" and e'=\"e2\" and x=\"b\" in leq_proper_use_env)\n        apply (auto)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (simp add: proper_exp_def)\n    (* if case *)\n    apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\" in proper_if)\n     apply (auto)\n    apply (cut_tac r_x=\"r_s\" and r_s=\"r_s\" and rs_map=\"rs_map\" and x=\"b\" and e=\"IfExp e1 e2 e3\" and e'=\"e1\"  in leq_proper_use_env)\n       apply (auto)\n     apply (rule_tac id_leq_use_env)\n    apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s\" and rs_map=\"rs_map\" and x=\"b\" and e=\"IfExp e1 e2 e3\" and e'=\"e2\" in leq_proper_use_env)\n       apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s\" and rs_map=\"rs_map\" and x=\"b\" and e=\"IfExp e1 e2 e3\" and e'=\"e3\"  in leq_proper_use_env)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (simp add: proper_exp_def)\n    (* lam case *)\n   apply (cut_tac r_s=\"rx\" and rs_map=\"rs_map\" and e=\"e\" and x=\"b\" and y=\"x1a\" and r=\"r\" in add_proper_use_env)\n     apply (rule_tac r_s=\"r_s\" and e=\"e\" in leq_proper_use_env)\n       apply (simp add: proper_use_env_def)\n      apply (auto)\n   apply (simp add: proper_exp_def)\n    (* app case *)\n  apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_app)\n   apply (auto)\n  apply (cut_tac r_x=\"r_s\" and r_s=\"r_s\" and rs_map=\"rs_map\" and e=\"AppExp e1 e2\" and e'=\"e1\" and x=\"b\" in leq_proper_use_env)\n     apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s\" and rs_map=\"rs_map\" and e=\"AppExp e1 e2\" and e'=\"e2\" and x=\"b\" in leq_proper_use_env)\n     apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (simp add: proper_exp_def)\n  done    \n    \nlemma proper_set_own: \"\\<lbrakk> path_lookup rs_map b l a; rs_map a = Some r_s;\n  proper_exp rs_map e; mem_val_env env;\n  well_typed env r_s e tau r_se r_xe \\<rbrakk> \\<Longrightarrow> proper_exp rs_map (set_own e b)\"   \n  apply (rule_tac env=\"env\" and r_s=\"r_s\" and r_se=\"r_se\" and tau=\"tau\" and r_xe=\"r_xe\" in proper_set_own_ih)\n    (* we expect everything from r_s1 to be contained in the completion of rs_map since\n        r_s1 is derived from some resource y, where there is a path from x to y *)\n    apply (simp add: proper_use_env_def)\n    apply (auto)\n  apply (rule_tac x=\"l @ [y]\" in exI)\n  apply (rule_tac y=\"a\" in path_lookup_append)\n   apply (auto)\n  done\n    \n*)\n  \n\ndefinition ref_memory where\n  \"ref_memory env = (\\<forall> x. case env (Loc x) of\n    None \\<Rightarrow> True\n    | Some tau \\<Rightarrow> req_type tau = Ref)\"\n  \n    (* we want to prove that when you read a value from an array, it will fit into the new delta.\n        we believe this to be true in the same sense that set_own is true. that replacing every single\n        permission with {b: *} should be acceptable.\n    *)\n  \n    (*\nlemma well_typed_set_own: \"\\<lbrakk> well_typed env r_x e tau r_x r_x; is_value e;\n  env (Loc b) = Some t; mem_ty t; unlim tau; r_s (Loc b) \\<noteq> NoPerm; mem_val_env env; sub_env s env \\<rbrakk> \\<Longrightarrow>\n  well_typed env r_s (set_own e b) tau r_s (one_use_env (Loc b) UsePerm)\"  \n    *)\n  \n\ndefinition semi_weak_use_env where\n  \"semi_weak_use_env r_s = (\\<forall> x. case x of\n    Var x \\<Rightarrow> True\n    | Loc y \\<Rightarrow> r_s (Loc y) \\<noteq> OwnPerm\n  )\"    \n  \nlemma sw_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s; semi_weak_use_env r_s \\<rbrakk> \\<Longrightarrow> semi_weak_use_env r_x\"  \n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)  \n  apply (case_tac x)\n   apply (auto)\n  apply (case_tac \"r_s (Loc x2)\")\n    apply (auto)    \n  done      \n(*\nlemma sw_add_use_env: \"\\<lbrakk> semi_weak_use_env r_s \\<rbrakk> \\<Longrightarrow> semi_weak_use_env (add_use_env r_s (Loc x) r)\"    \n  apply (simp add: semi_weak_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (case_tac xa)\n   apply (auto)\n  apply (simp add: add_use_env_def)\n  apply (case_tac \"x = x2\")\n   apply (auto)\n    \n  done*)\n  \nlemma sw_add_use_env: \"\\<lbrakk> semi_weak_use_env r_s \\<rbrakk> \\<Longrightarrow> semi_weak_use_env (add_use_env r_s (Var x) r)\"    \n  apply (simp add: semi_weak_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (case_tac xa)\n   apply (auto)\n  apply (simp add: add_use_env_def)\n  done\n    \nlemma rhs_sw_leq_use_none: \"\\<lbrakk> leq_use_env (diff_use_env r_x r_ex) r_s; r_s (Loc x) = NoPerm; semi_weak_use_env r_ex  \\<rbrakk> \\<Longrightarrow> r_x (Loc x) = NoPerm\"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n   apply (case_tac \"r_ex (Loc x)\")\n     apply (auto)\n  apply (case_tac \"r_ex (Loc x)\")\n    apply (auto)\n  done \n    \nlemma semi_weak_drop_use_env: \"semi_weak_use_env (drop_use_env r_s)\"    \n  apply (simp add: semi_weak_use_env_def)\n  apply (auto)\n  apply (case_tac x)\n   apply (auto)\n  apply (simp add: drop_use_env_def)\n  apply (case_tac \"r_s (Loc x2)\")\n    apply (auto)\n  done      \n  \ndefinition any_loc_use where\n  \"any_loc_use r_s = (\\<exists> x. r_s (Loc x) \\<noteq> NoPerm)\"\n  \ndefinition pwrite_use_env :: \"perm_use_env \\<Rightarrow> string \\<Rightarrow> perm_use_env\" where\n  \"pwrite_use_env r_s x = (if \\<not> any_loc_use r_s then r_s else add_use_env r_s (Loc x) UsePerm)\"  \n\nlemma leq_any_loc_use: \"\\<lbrakk> leq_use_env r_x r_s; any_loc_use r_x \\<rbrakk> \\<Longrightarrow> any_loc_use r_s\"  \n  apply (simp add: any_loc_use_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (rule_tac x=\"x\" in exI)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  done     \n  \nlemma dist_pwrite_leq_use_env: \"\\<lbrakk> semi_weak_use_env r_s; leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (pwrite_use_env r_x x) (pwrite_use_env r_s x)\"\n  apply (case_tac \"any_loc_use r_x\")\n   apply (simp add: pwrite_use_env_def)\n    apply (auto)\n    apply (cut_tac r_x=\"r_x\" and r_s=\"r_s\" in leq_any_loc_use)\n      apply (auto)\n   apply (rule_tac dist_add_leq_use_env)\n   apply (simp)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n  apply (rule_tac rhs_add_leq_use_env)\n  apply (simp)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  apply (cut_tac r_x=\"r_x\" and r_s=\"r_s\" and x=\"Loc x\" in leq_use_no_own)\n    apply (auto)\n  apply (simp add: semi_weak_use_env_def)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  done\n \nlemma rem_pwrite_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (rem_use_env r_x (Loc x)) (pwrite_use_env r_s x)\"       \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (rule_tac rem_leq_use_env)\n   apply (simp)\n  apply (rule_tac rhs_add_leq_use_env)\n   apply (rule_tac rem_leq_use_env)\n   apply (simp)\n  apply (simp add: rem_use_env_def)\n  done\n  \nlemma pwrite_leq_use_env: \"\\<lbrakk> semi_weak_use_env r_s; leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env r_x (pwrite_use_env r_s x)\"    \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n  apply (rule_tac rhs_add_leq_use_env)\n   apply (simp)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  apply (cut_tac r_x=\"r_x\" and r_s=\"r_s\" and x=\"Loc x\" in leq_use_no_own)\n    apply (auto)\n  apply (simp add: semi_weak_use_env_def)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  done\n \nlemma add_pwrite_leq_use_env: \"\\<lbrakk> semi_weak_use_env r_x; leq_use_env (add_use_env r_x (Loc x) UsePerm) r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (pwrite_use_env r_x x) r_s\"      \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n  apply (rule_tac r_sb=\"add_use_env r_x (Loc x) UsePerm\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac rhs_add_leq_use_env)\n   apply (rule_tac id_leq_use_env)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  apply (simp add: semi_weak_use_env_def)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  done    \n    \nlemma lift_pwrite_leq_use_env: \"\\<lbrakk> semi_weak_use_env r_s; leq_use_env (lift_use_env r_x r) r_s \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (lift_use_env (pwrite_use_env r_x x) r) (add_use_env r_s (Loc x) UsePerm)\"    \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (simp)\n   apply (cut_tac r_x=\"lift_use_env r_x r\" and r_s=\"r_s\" in sw_leq_use_env)\n     apply (auto)\n   apply (simp add: semi_weak_use_env_def)\n   apply (erule_tac x=\"Loc x\" in allE)\n   apply (erule_tac x=\"Loc x\" in allE)\n   apply (auto)\n   apply (case_tac \"lift_use_env r_x r (Loc x)\")\n     apply (auto)\n  apply (case_tac \"r = OwnPerm\")\n   apply (simp add: any_loc_use_def)\n   apply (auto)\n   apply (case_tac \"r_s (Loc xa) = OwnPerm\")\n    apply (simp add: semi_weak_use_env_def)\n    apply (erule_tac x=\"Loc xa\" in allE)\n    apply (auto)\n   apply (simp add: leq_use_env_def)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (case_tac \"r_s (Loc xa)\")\n     apply (auto)\n  apply (case_tac \"lift_use_env r_x r \\<noteq> r_x\")\n   apply (case_tac r)\n     apply (auto)\n  apply (case_tac \"lift_use_env (add_use_env r_x (Loc x) UsePerm) r \\<noteq> add_use_env r_x (Loc x) UsePerm\")\n   apply (case_tac r)\n     apply (auto)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)\n  done    \n    \nlemma rhs_pwrite_diff_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (diff_use_env r_x r_ex) (diff_use_env r_s (pwrite_use_env r_ex x))\"    \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (simp)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (auto)\n   apply (erule_tac x=\"Loc x\" in allE)\n   apply (simp add: any_loc_use_def)\n   apply (case_tac \"r_ex (Loc x)\")\n     apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (simp add: any_loc_use_def)\n  apply (case_tac \"r_ex xa\")\n    apply (auto)\n  done\n\nlemma disj_add_use_env_sw: \"\\<lbrakk> disj_use_env r_x r_s; semi_weak_use_env r_s \\<rbrakk> \\<Longrightarrow> disj_use_env (add_use_env r_x (Loc x) UsePerm) r_s\"    \n  apply (simp add: disj_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (auto)\n  apply (simp add: semi_weak_use_env_def)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  done      \n    \nlemma disj_pwrite_use_env: \"\\<lbrakk> semi_weak_use_env r_x; semi_weak_use_env r_s; disj_use_env r_x r_s \\<rbrakk> \\<Longrightarrow>\n  disj_use_env (pwrite_use_env r_x x) (pwrite_use_env r_s x)\"   \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n    apply (rule_tac comm_disj_use_env)\n    apply (rule_tac disj_add_use_env_sw)\n    apply (rule_tac comm_disj_use_env)\n     apply (auto)\n   apply (rule_tac disj_add_use_env_sw)\n    apply (auto)\n  apply (rule_tac disj_add_use_env_sw)\n   apply (rule_tac comm_disj_use_env)\n   apply (rule_tac disj_add_use_env_sw)\n    apply (rule_tac comm_disj_use_env)\n    apply (auto)\n  apply (simp add: semi_weak_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (case_tac xa)\n   apply (auto)\n  apply (simp add: add_use_env_def)\n  apply (case_tac \"x = x2\")\n   apply (auto)\n  done    \n    \nlemma disj_lift_pwrite_use_env: \"\\<lbrakk> disj_use_env (lift_use_env r_x r) (lift_use_env r_s r);\n  leq_use_env (lift_use_env r_x r) r_c; leq_use_env (lift_use_env r_s r) r_c; semi_weak_use_env r_c \\<rbrakk> \\<Longrightarrow>\n  disj_use_env (lift_use_env (pwrite_use_env r_x x) r) (lift_use_env (pwrite_use_env r_s x) r)\"\n    (* if r \\<noteq> Own, then normal disjointness applies *)\n  apply (case_tac \"\\<not> is_own r\")\n   apply (simp add: is_own_def)\n   apply (case_tac r)\n     apply (auto)\n    apply (rule_tac disj_pwrite_use_env)\n       apply (auto)\n     apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n      apply (auto)\n    apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n     apply (auto)\n   apply (rule_tac disj_pwrite_use_env)\n     apply (auto)\n    apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n     apply (auto)\n   apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n    apply (auto)\n    (* otherwise, say that r_x uses Loc xa. then r_c (Loc xa) = Own, a contradiction *)\n  apply (case_tac \"any_loc_use r_x\")\n   apply (simp add: any_loc_use_def)\n   apply (auto)\n   apply (simp add: leq_use_env_def)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (simp add: is_own_def)\n   apply (simp add: semi_weak_use_env_def)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (erule_tac x=\"Loc xa\" in allE) \n   apply (case_tac \"r_c (Loc xa)\")\n     apply (auto)\n    (* same for r_s *)\n  apply (case_tac \"any_loc_use r_s\")\n   apply (simp add: any_loc_use_def)\n   apply (auto)\n   apply (simp add: leq_use_env_def)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (simp add: semi_weak_use_env_def)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (simp add: is_own_def)\n   apply (case_tac \"r_c (Loc xa)\")\n     apply (auto)\n  apply (simp add: pwrite_use_env_def)\n  done       \n    \n    (* - pwrite equality lemmas *)\n    \nlemma lift_pwrite_use_env: \"\\<lbrakk> semi_weak_use_env (lift_use_env r_s r) \\<rbrakk> \\<Longrightarrow>\n  pwrite_use_env (lift_use_env r_s r) x = lift_use_env (pwrite_use_env r_s x) r\"\n  apply (case_tac \"is_own r\")\n   apply (case_tac \"any_loc_use r_s\")\n    apply (simp add: any_loc_use_def)\n    apply (auto)\n    apply (simp add: semi_weak_use_env_def)\n    apply (simp add: is_own_def)\n    apply (erule_tac x=\"Loc xa\" in allE)\n    apply (auto)\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (simp add: any_loc_use_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (simp add: is_own_def)\n  apply (simp add: is_own_def)\n  apply (case_tac r)\n    apply (auto)\n  done\n    \nlemma pwc_add_use_env1: \"\\<lbrakk> semi_weak_use_env r_x \\<rbrakk> \\<Longrightarrow> comp_use_env r_x (add_use_env r_s (Loc x) UsePerm) = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm\"    \n  apply (case_tac \"\\<forall> y. comp_use_env r_x (add_use_env r_s (Loc x) UsePerm) y = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm y\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  apply (case_tac \"Loc x = y\")\n   apply (auto)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  done\n\nlemma pwc_add_use_env2: \"\\<lbrakk> semi_weak_use_env r_s \\<rbrakk> \\<Longrightarrow> comp_use_env (add_use_env r_x (Loc x) UsePerm) r_s = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm\"    \n  apply (case_tac \"\\<forall> y. comp_use_env (add_use_env r_x (Loc x) UsePerm) r_s y = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm y\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  apply (case_tac \"Loc x = y\")\n   apply (auto)\n  apply (case_tac \"r_s (Loc x)\")\n    apply (auto)\n  done    \n\nlemma pwrite_comp_use_env: \"\\<lbrakk> semi_weak_use_env r_x; semi_weak_use_env r_s \\<rbrakk> \\<Longrightarrow>\n  comp_use_env (pwrite_use_env r_x x) (pwrite_use_env r_s x) = pwrite_use_env (comp_use_env r_x r_s) x\"\n  apply (case_tac \"\\<not> any_loc_use r_x\")\n   apply (case_tac \"\\<not> any_loc_use r_s\")\n    apply (simp add: pwrite_use_env_def)\n    apply (auto)\n    apply (simp add: any_loc_use_def)\n    apply (simp add: comp_use_env_def)\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n    apply (simp add: any_loc_use_def)\n    apply (simp add: comp_use_env_def)\n    apply (auto)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (case_tac \"r_s (Loc xa)\")\n      apply (auto)\n   apply (rule_tac pwc_add_use_env1)\n   apply (auto)\n  apply (case_tac \"\\<not> any_loc_use r_s\")\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n    apply (simp add: any_loc_use_def)\n    apply (simp add: comp_use_env_def)\n    apply (auto)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (case_tac \"r_x (Loc xa)\")\n      apply (auto)\n   apply (rule_tac pwc_add_use_env2)\n   apply (auto)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (simp add: any_loc_use_def)\n   apply (simp add: comp_use_env_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (case_tac \"r_x (Loc xa)\")\n     apply (auto)\n   apply (case_tac \"r_s (Loc xa)\")\n     apply (auto)\n  apply (rule_tac dist_add_comp_use_env)\n  done    \n\nlemma diff_pwrite_rem_use_env: \"\\<lbrakk> semi_weak_use_env r_x \\<rbrakk> \\<Longrightarrow>\n  diff_use_env (pwrite_use_env r_s x) (rem_use_env r_x (Loc x)) = pwrite_use_env (diff_use_env r_s r_x) x\"    \n  apply (case_tac \"\\<not> any_loc_use r_s\")\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (simp add: any_loc_use_def)\n    apply (case_tac \"\\<forall> y. diff_use_env r_s (rem_use_env r_x (Loc x)) y = diff_use_env r_s r_x y\")\n     apply (auto)\n    apply (simp add: diff_use_env_def)\n    apply (simp add: rem_use_env_def)\n    apply (case_tac \"Loc x = y\")\n     apply (auto)\n   apply (simp add: any_loc_use_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (cut_tac r_x=\"diff_use_env r_s r_x\" and r_s=\"r_s\" and x=\"Loc xa\" in leq_use_none)\n     apply (auto)\n   apply (rule_tac self_diff_leq_use_env)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (simp add: any_loc_use_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (case_tac \"r_x (Loc xa) \\<noteq> OwnPerm\")\n    apply (simp add: diff_use_env_def)\n    apply (case_tac \"r_x (Loc xa)\")\n      apply (auto)\n   apply (simp add: semi_weak_use_env_def)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (auto)\n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: diff_add_rem_use_env)\n  done \n  \ndefinition rv_delta where\n  \"rv_delta delta e b = (\\<forall> x. x \\<in> ref_vars e \\<longrightarrow> delta x = b)\"  \n  \nlemma water_var_case: \"\\<lbrakk> semi_weak_use_env r_s1; env (Loc b) = Some t; mem_ty t; rv_delta delta' (VarExp x) b; mem_val_env env;\n       env (res_name x) = Some tau;  env (owner_name delta x) = Some tau_x; leq_use_env (ereq_use_env (owner_name delta x) tau_x) r_s1;\n       leq_use_env r_s2 (diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name delta x) tau_x) r_ex));\n       leq_use_env rx r_s2;  leq_use_env r_ex r_s1;\n       leq_use_env (diff_use_env (ereq_use_env (owner_name delta x) tau_x) (comp_use_env (ereq_use_env (owner_name delta x) tau_x) r_ex)) rx \\<rbrakk> \\<Longrightarrow>\n       \\<exists>r_ex tau_x.\n          env (owner_name delta' x) = Some tau_x \\<and>\n          leq_use_env (ereq_use_env (owner_name delta' x) tau_x) (add_use_env r_s1 (Loc b) UsePerm) \\<and>\n          leq_use_env (add_use_env r_s2 (Loc b) UsePerm) (diff_use_env (add_use_env r_s1 (Loc b) UsePerm) (comp_use_env (ereq_use_env (owner_name delta' x) tau_x) r_ex)) \\<and>\n          leq_use_env (pwrite_use_env rx b) (add_use_env r_s2 (Loc b) UsePerm) \\<and>\n          leq_use_env r_ex (add_use_env r_s1 (Loc b) UsePerm) \\<and>\n          leq_use_env (diff_use_env (ereq_use_env (owner_name delta' x) tau_x) (comp_use_env (ereq_use_env (owner_name delta' x) tau_x) r_ex)) (pwrite_use_env rx b)\"  \n    (* var case. non-value *)\n  apply (case_tac x)\n   apply (auto)\n    apply (rule_tac rhs_add_leq_use_env)\n     apply (auto)\n    apply (simp add: ereq_use_env_def)\n    apply (simp add: one_use_env_def)\n   apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n   apply (auto)\n      apply (rule_tac r_sb=\"diff_use_env (add_use_env r_s1 (Loc b) UsePerm) (rem_use_env (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex) (Loc b))\" in trans_leq_use_env)\n       apply (simp add: dist_rem_comp_use_env)\n       apply (rule_tac unroll_dcl_use_env)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (rule_tac rhs_diff_rem_leq_use_env2)\n        apply (simp add: ereq_use_env_def)\n        apply (simp add: one_use_env_def)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac t=\"diff_use_env (add_use_env r_s1 (Loc b) UsePerm) (rem_use_env (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex) (Loc b))\"\n           and s=\"add_use_env (diff_use_env r_s1 (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)) (Loc b) UsePerm\" in subst)\n       apply (rule_tac diff_add_rem_use_env)\n      apply (rule_tac dist_add_leq_use_env)\n      apply (simp)\n     apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)\" in trans_leq_use_env)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    apply (rule_tac rhs_add_leq_use_env)\n     apply (rule_tac rem_leq_use_env)\n     apply (simp)\n    apply (simp add: rem_use_env_def)\n   apply (rule_tac r_sb=\"diff_use_env (ereq_use_env (Var x1) tau_x) (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)\" in trans_leq_use_env)\n    apply (rule_tac pwrite_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (auto)\n   apply (rule_tac unroll_dcl_use_env)\n   apply (rule_tac rhs_diff_rem_leq_use_env2)\n    apply (cut_tac r_x=\"r_ex\" and r_s=\"r_s1\" in sw_leq_use_env)\n      apply (simp)\n     apply (auto)\n    apply (simp add: semi_weak_use_env_def)\n    apply (erule_tac x=\"Loc b\" in allE)\n    apply (erule_tac x=\"Loc b\" in allE)\n    apply (auto)\n   apply (rule_tac id_leq_use_env)\n    (* var case. value cases *)\n  apply (case_tac \"delta' x2 \\<noteq> b\")\n   apply (simp add: rv_delta_def)\n   apply (auto)\n   apply (rule_tac ereq_leq_use_envx)\n   apply (simp add: add_use_env_def)\n   apply (simp add: end_req_perm_def)\n   apply (case_tac t)\n         apply (auto)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n     apply (rule_tac rhs_flip_use_env)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (rule_tac rhs_weak_leq_use_env)\n      apply (rule_tac weak_ereq_use_env)\n      apply (simp add: unlim_def)\n      apply (case_tac t)\n            apply (auto)\n     apply (rule_tac t=\"diff_use_env (add_use_env r_s1 (Loc (delta' x2)) UsePerm) (rem_use_env r_ex (Loc (delta' x2)))\" and s=\"add_use_env (diff_use_env r_s1 r_ex) (Loc (delta' x2)) UsePerm\" in subst)\n      apply (rule_tac diff_add_rem_use_env)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Loc (delta x2)) tau_x) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env_gen)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env2)\n     apply (simp)\n    apply (rule_tac add_pwrite_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Loc (delta x2)) tau_x) r_ex)\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (simp)\n   apply (simp add: rem_use_env_def)\n    (* - req bound manipulation *)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n    (* - say that we do not add a perm to rx. this means (delta x2) is not in rx, which is impossible since it is in r_s1 (and r_s1 is weak) *)\n   apply (case_tac \"rx (Loc (delta x2)) \\<noteq> NoPerm\")\n    apply (simp add: any_loc_use_def)\n   apply (case_tac \"comp_use_env (ereq_use_env (Loc (delta x2)) tau_x) r_ex (Loc (delta x2)) = OwnPerm\")\n    apply (cut_tac r_x=\"comp_use_env (ereq_use_env (Loc (delta x2)) tau_x) r_ex\" and r_s=\"r_s1\" and x=\"Loc (delta x2)\" in leq_use_own)\n      apply (simp)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (simp_all)\n    apply (simp add: semi_weak_use_env_def)\n    apply (erule_tac x=\"Loc (delta x2)\" in allE)\n    apply (auto)\n   apply (cut_tac r_x=\"ereq_use_env (Loc (delta x2)) tau_x\" and r_ex=\"comp_use_env (ereq_use_env (Loc (delta x2)) tau_x) r_ex\" and r_s=\"rx\" and x=\"Loc (delta x2)\" in diff_use_leq)\n     apply (auto)\n   apply (simp add: ereq_use_env_def)\n   apply (simp add: one_use_env_def)\n   apply (simp add: end_req_perm_def)\n   apply (simp add: mem_val_env_def)\n   apply (erule_tac x=\"Loc (delta x2)\" in allE)\n   apply (auto)\n   apply (case_tac tau_x)\n         apply (auto)\n    (* - otherwise we know what x is *)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac ereq_leq_use_envx)\n  apply (simp add: add_use_env_def)\n  apply (simp add: end_req_perm_def)\n  apply (case_tac t)\n        apply (auto)  \n  done\n  \nlemma water_pair_case: \"\\<lbrakk> \\<And>env r_s1 tau r_s2 rx. \\<lbrakk>\n           well_typed env delta r_s1 e1 tau r_s2 rx;\n           semi_weak_use_env r_s1; env (Loc b) = Some t; mem_val_env env; rv_delta delta' e1 b \\<rbrakk> \\<Longrightarrow>\n              well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e1 tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx b);\n       \\<And>env r_s1 tau r_s2 rx. \\<lbrakk>\n           well_typed env delta r_s1 e2 tau r_s2 rx; semi_weak_use_env r_s1; env (Loc b) = Some t; mem_val_env env; rv_delta delta' e2 b \\<rbrakk> \\<Longrightarrow>\n              well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e2 tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx b);\n       semi_weak_use_env r_s1; env (Loc b) = Some t; mem_ty t; mem_val_env env; rv_delta delta' (PairExp e1 e2) b;\n       well_typed env delta r_s1 e1 t1 r_s2a rx1; well_typed env delta r_s2a e2 t2 r_s3 rx2; leq_use_env (lift_use_env rx1 r) r_s3;\n       leq_use_env (lift_use_env rx2 r) r_s3; aff_leq (max_aff (req_type t1) (req_type t2)) r; disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r);\n       leq_use_env r_s2 (diff_use_env r_s3 r_ex); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n       leq_use_env (pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex (PairTy t1 t2 r)) rx \\<rbrakk> \\<Longrightarrow>\n       \\<exists>r_s2a r_s3 rx1.\n          well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e1 t1 r_s2a rx1 \\<and>\n          (\\<exists>rx2. well_typed env delta' r_s2a e2 t2 r_s3 rx2 \\<and>\n                 leq_use_env (lift_use_env rx1 r) r_s3 \\<and>\n                 leq_use_env (lift_use_env rx2 r) r_s3 \\<and>\n                 disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r) \\<and>\n                 (\\<exists>r_ex. leq_use_env (add_use_env r_s2 (Loc b) UsePerm) (diff_use_env r_s3 r_ex) \\<and>\n                         leq_use_env (pwrite_use_env rx b) (add_use_env r_s2 (Loc b) UsePerm) \\<and>\n                         leq_use_env r_ex (add_use_env r_s1 (Loc b) UsePerm) \\<and> leq_use_env (pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex (PairTy t1 t2 r)) (pwrite_use_env rx b)))\"    \n  apply (rule_tac x=\"add_use_env r_s2a (Loc b) UsePerm\" in exI)\n  apply (rule_tac x=\"add_use_env r_s3 (Loc b) UsePerm\" in exI)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (cut_tac r_x=\"lift_use_env rx1 r\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx1 b\" in exI)\n  apply (auto)\n   apply (case_tac \"\\<not> rv_delta delta' e1 b\")\n    apply (simp add: rv_delta_def)\n   apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx2 b\" in exI)\n  apply (auto)\n      apply (case_tac \"\\<not> rv_delta delta' e2 b\")\n       apply (simp add: rv_delta_def)\n      apply (auto)\n      apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in sw_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n     apply (rule_tac lift_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (auto)\n    apply (rule_tac lift_pwrite_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n      apply (auto)\n   apply (rule_tac r_c=\"r_s1\" in disj_lift_pwrite_use_env)\n       apply (auto)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n   apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n    apply (auto)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n     apply (rule_tac t=\"diff_use_env (add_use_env r_s3 (Loc b) UsePerm) (rem_use_env r_ex (Loc b))\"\n          and s=\"add_use_env (diff_use_env r_s3 r_ex) (Loc b) UsePerm\" in subst)\n      apply (rule_tac diff_add_rem_use_env)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    apply (rule_tac add_pwrite_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n       apply (rule_tac diff_leq_use_env)\n       apply (simp)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (auto)\n   apply (simp add: rem_use_env_def)\n  apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n   apply (simp add: pair_req_def)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: pair_req_def)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx1 b) r\" and s=\"pwrite_use_env (lift_use_env rx1 r) b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx2 b) r\" and s=\"pwrite_use_env (lift_use_env rx2 r) b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (simp add: pwrite_comp_use_env)\n  apply (cut_tac r_x=\"r_ex\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (auto)\n  apply (simp add: diff_pwrite_rem_use_env)\n  apply (rule_tac dist_pwrite_leq_use_env)\n   apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (simp)\n    apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n     apply (auto)\n  done\n    \nlemma water_if_case: \"\\<lbrakk> \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk> well_typed env delta r_s1 e1 tau r_s2 rx; semi_weak_use_env r_s1; env (Loc b) = Some t; mem_val_env env; rv_delta delta' e1 b \\<rbrakk> \\<Longrightarrow>\n            well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e1 tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx b);\n       \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk> well_typed env delta r_s1 e2 tau r_s2 rx; semi_weak_use_env r_s1; env (Loc b) = Some t; mem_val_env env; rv_delta delta' e2 b \\<rbrakk> \\<Longrightarrow>\n            well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e2 tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx b);\n       \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk> well_typed env delta r_s1 e3 tau r_s2 rx; semi_weak_use_env r_s1; env (Loc b) = Some t; mem_val_env env; rv_delta delta' e3 b \\<rbrakk> \\<Longrightarrow>\n            well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e3 tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx b);\n       semi_weak_use_env r_s1; env (Loc b) = Some t; mem_ty t; mem_val_env env; rv_delta delta' (IfExp e1 e2 e3) b;\n       well_typed env delta r_s1 e1 BoolTy r_s2a rx'; well_typed env delta r_s2a e2 tau r_s2 rx1; well_typed env delta r_s2a e3 tau r_s2 rx2 \\<rbrakk> \\<Longrightarrow>\n       \\<exists>rx' r_s2a. well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e1 BoolTy r_s2a rx' \\<and>\n                   (\\<exists>rx1a. well_typed env delta' r_s2a e2 tau (add_use_env r_s2 (Loc b) UsePerm) rx1a \\<and>\n                           (\\<exists>rx2a. well_typed env delta' r_s2a e3 tau (add_use_env r_s2 (Loc b) UsePerm) rx2a \\<and> pwrite_use_env (comp_use_env rx1 rx2) b = comp_use_env rx1a rx2a))\"    \n  apply (rule_tac x=\"pwrite_use_env rx' b\" in exI)\n  apply (case_tac \"\\<not> (rv_delta delta' e1 b \\<and> rv_delta delta' e2 b \\<and> rv_delta delta' e3 b)\")\n   apply (simp add: rv_delta_def)\n  apply (auto)\n  apply (rule_tac x=\"add_use_env r_s2a (Loc b) UsePerm\" in exI)\n  apply (auto)\n  apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx1 b\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx2 b\" in exI)\n  apply (auto)\n  apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s2a\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (cut_tac r_x=\"rx1\" and r_s=\"r_s2\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leqx)\n    apply (auto)\n  apply (cut_tac r_x=\"rx2\" and r_s=\"r_s2\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leqx)\n    apply (auto)\n  apply (simp add: pwrite_comp_use_env)\n  done\n    \nlemma wt_read_value_none: \"\\<lbrakk> ref_vars e = {}; well_typed env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow>\n   well_typed env delta' r_s1 e tau r_s2 rx\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)  \n        apply (auto)\n    (* var case *)\n      apply (case_tac x)\n       apply (auto)\n    (* pair case *)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx1\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx2\" in exI)\n    apply (auto)\n    (* lam case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_end\" in exI)\n   apply (rule_tac x=\"r_s'\" in exI)\n   apply (auto)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  done      \n\nlemma wtae_end_leq_use_env2: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_ex) \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (add_use_env r_x x UsePerm) (diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_ex x))\"  \n  apply (rule_tac t=\"diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_ex x)\"\n      and s=\"add_use_env (diff_use_env r_s r_ex) x UsePerm\" in subst)\n   apply (rule_tac diff_add_rem_use_env)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)  \n  done    \n    \ndefinition not_ref_var where\n  \"not_ref_var x e = (x \\<notin> ref_vars e)\"\n    \nlemma well_typed_no_rv_use: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; mem_val_env env; r_s1 (Loc (delta x)) = NoPerm \\<rbrakk> \\<Longrightarrow> not_ref_var x e\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const + op cases *)\n        apply (simp add: not_ref_var_def)\n       apply (simp add: not_ref_var_def)\n    (* var case *)\n      apply (simp add: not_ref_var_def)\n      apply (auto)\n      apply (simp add: leq_use_env_def)\n      apply (simp add: ereq_use_env_def)\n      apply (simp add: one_use_env_def)\n      apply (erule_tac x=\"Loc (delta x)\" in allE)\n      apply (case_tac xa)\n       apply (auto)\n      apply (simp add: mem_val_env_def)\n      apply (erule_tac x=\"Loc (delta x)\" in allE)\n      apply (auto)\n      apply (simp add: end_req_perm_def)\n      apply (case_tac tau_x)\n            apply (auto)\n    (* pair case *)\n     apply (simp add: not_ref_var_def)\n     apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"Loc (delta x)\" in leq_use_none)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    (* if case *)\n    apply (simp add: not_ref_var_def)\n    apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"Loc (delta x)\" in leq_use_none)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* lam case *)\n   apply (simp add: not_ref_var_def)\n   apply (cut_tac r_x=\"rxa\" and r_s=\"r_s1\" and x=\"Loc (delta x)\" in leq_use_none)\n     apply (auto)\n   apply (case_tac \"\\<not> add_use_env rxa (Var x1a) r (Loc (delta x)) = NoPerm\")\n    apply (simp add: add_use_env_def)\n   apply (case_tac \"\\<not> mem_val_env (add_env env (Var x1a) t1)\")\n    apply (cut_tac env=\"env\" and x=\"x1a\" and tau=\"t1\" in add_mem_val_env)\n     apply (auto)\n   apply (iprover)\n    (* app case *)\n  apply (simp add: not_ref_var_def)\n  apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"Loc (delta x)\" in leq_use_none)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  done        \n    \nlemma water_lam_case: \"\\<lbrakk> \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; semi_weak_use_env r_s1; env (Loc b) = Some t; mem_val_env env; rv_delta delta' e b \\<rbrakk> \\<Longrightarrow>\n            well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx b);\n       semi_weak_use_env r_s1; env (Loc b) = Some t; mem_ty t; mem_val_env env; rv_delta delta' (LamExp x1a e) b;\n       well_typed (add_env env (Var x1a) t1) delta (add_use_env rxa (Var x1a) r) e t2 r_s' r_end;\n       aff_use_env rxa a; leq_use_env rxa r_s1; leq_use_env r_s2 (diff_use_env r_s1 r_ex);\n       leq_use_env rx r_s2; leq_use_env r_ex r_s1; leq_use_env (diff_use_env rxa r_ex) rx \\<rbrakk> \\<Longrightarrow>\n       \\<exists>rxa. (\\<exists>r_end r_s'. well_typed (add_env env (Var x1a) t1) delta' (add_use_env rxa (Var x1a) r) e t2 r_s' r_end) \\<and>\n             aff_use_env rxa a \\<and>\n             leq_use_env rxa (add_use_env r_s1 (Loc b) UsePerm) \\<and>\n             (\\<exists>r_ex. leq_use_env (add_use_env r_s2 (Loc b) UsePerm) (diff_use_env (add_use_env r_s1 (Loc b) UsePerm) r_ex) \\<and>\n                     leq_use_env (pwrite_use_env rx b) (add_use_env r_s2 (Loc b) UsePerm) \\<and>\n                     leq_use_env r_ex (add_use_env r_s1 (Loc b) UsePerm) \\<and> leq_use_env (diff_use_env rxa r_ex) (pwrite_use_env rx b))\"    \n    (* lam case. rxa does not contain any members of r_set *)\n  apply (case_tac \"\\<not> rv_delta delta' e b\")\n   apply (simp add: rv_delta_def)\n  apply (auto)\n  apply (case_tac \"\\<not> any_loc_use rxa\")\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n     apply (rule_tac x=\"r_end\" in exI)\n     apply (rule_tac x=\"r_s'\" in exI)\n     apply (rule_tac wt_read_value_none)\n      apply (auto)\n     apply (cut_tac env=\"add_env env (Var x1a) t1\" and ?r_s1.0=\"add_use_env rxa (Var x1a) r\" and x=\"x\" and e=\"e\" in well_typed_no_rv_use)\n        apply (auto)\n       apply (rule_tac add_mem_val_env)\n       apply (auto)\n      apply (simp add: add_use_env_def)\n      apply (simp add: any_loc_use_def)\n     apply (simp add: not_ref_var_def)\n    apply (rule_tac rhs_add_leq_use_env)\n     apply (simp)\n    apply (simp add: any_loc_use_def)\n   apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n   apply (auto)\n      apply (rule_tac wtae_end_leq_use_env2)\n      apply (simp)\n     apply (rule_tac add_pwrite_leq_use_env)\n       apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n        apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n         apply (rule_tac self_diff_leq_use_env)\n        apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n         apply (auto)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    apply (rule_tac rhs_add_leq_use_env)\n     apply (rule_tac rem_leq_use_env)\n     apply (simp)\n    apply (simp add: rem_use_env_def)\n   apply (rule_tac pwrite_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (auto)\n   apply (rule_tac r_sb=\"diff_use_env rxa r_ex\" in trans_leq_use_env)\n    apply (simp)\n    apply (rule_tac rhs_diff_rem_leq_use_env)\n    apply (simp add: any_loc_use_def)\n   apply (rule_tac id_leq_use_env)  \n    (* lam case. rxa contains at least one member of r_set *)\n    (* - prelim: rxa is not primitive *)\n  apply (case_tac \"a = Prim\")\n   apply (simp add: any_loc_use_def)\n   apply (auto)\n   apply (simp add: aff_use_env_def)\n  apply (simp add: null_use_env_def)\n    (* - prelim: rx has at least one value as well *)\n  apply (case_tac \"\\<not> any_loc_use rx\")\n   apply (simp add: any_loc_use_def)\n   apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (cut_tac r_ex=\"r_ex\" and r_x=\"rxa\" and r_s=\"rx\" and x=\"x\" in rhs_sw_leq_use_none)\n       apply (auto)\n   apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n    apply (auto)\n    (* - prelim: x \\<noteq> x1a *)\n  apply (rule_tac x=\"add_use_env rxa (Loc b) UsePerm\" in exI)\n  apply (auto)\n     apply (rule_tac x=\"pwrite_use_env r_end b\" in exI)\n     apply (rule_tac x=\"add_use_env r_s' (Loc b) UsePerm\" in exI)\n     apply (rule_tac t=\"add_use_env (add_use_env rxa (Loc b) UsePerm) (Var x1a) r\" and s=\"add_use_env (add_use_env rxa (Var x1a) r) (Loc b) UsePerm\" in subst)\n      apply (simp add: almost_comm_add_use_env)\n     apply (cut_tac r_s=\"rxa\" and x=\"x1a\" and r=\"r\" in sw_add_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (auto)\n     apply (case_tac \"\\<not> add_env env (Var x1a) t1 (Loc b) = Some t\")\n      apply (simp add: add_env_def)\n     apply (auto)\n     apply (case_tac \"\\<not> mem_val_env (add_env env (Var x1a) t1)\")\n      apply (cut_tac env=\"env\" and x=\"x1a\" and tau=\"t1\" in add_mem_val_env)\n       apply (auto)\n    apply (simp add: aff_use_env_def)\n    apply (case_tac a)\n      apply (auto)\n    apply (simp add: weak_use_env_def)\n    apply (simp add: add_use_env_def)\n   apply (rule_tac dist_add_leq_use_env)\n   apply (simp)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n     apply (rule_tac t=\"diff_use_env (add_use_env r_s1(Loc b) UsePerm) (rem_use_env r_ex (Loc b))\" and\n        s=\"add_use_env (diff_use_env r_s1 r_ex) (Loc b) UsePerm\" in subst)\n      apply (rule_tac diff_add_rem_use_env)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (simp)\n   apply (simp add: rem_use_env_def)\n  apply (simp add: pwrite_use_env_def)\n  apply (rule_tac t=\"diff_use_env (add_use_env rxa (Loc b) UsePerm) (rem_use_env r_ex (Loc b))\" and\n      s=\"add_use_env (diff_use_env rxa r_ex) (Loc b) UsePerm\" in subst)\n   apply (rule_tac diff_add_rem_use_env)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)\n  done\n\nlemma wtae_end_leq_use_env1: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s (comp_use_env r_exa r_exb)); r_exa x \\<noteq> OwnPerm \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (add_use_env r_x x UsePerm) (diff_use_env (add_use_env r_s x UsePerm) (comp_use_env r_exa (rem_use_env r_exb x)))\"    \n  apply (rule_tac r_sb=\"diff_use_env (add_use_env r_s x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\" in trans_leq_use_env)\n   apply (simp add: dist_rem_comp_use_env)\n   apply (rule_tac unroll_dcl_use_env)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (rule_tac rhs_diff_rem_leq_use_env2)\n    apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac t=\"diff_use_env (add_use_env r_s x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\"\n      and s=\"add_use_env (diff_use_env r_s (comp_use_env r_exa r_exb)) x UsePerm\" in subst)\n   apply (rule_tac diff_add_rem_use_env)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)\n  done    \n    \nlemma wtae_req_leq_use_env1: \"\\<lbrakk> leq_use_env (diff_use_env r_x (comp_use_env r_exa r_exb)) r_s \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (diff_use_env (add_use_env r_x x UsePerm) (comp_use_env r_exa (rem_use_env r_exb x))) (add_use_env r_s x UsePerm)\"\n  apply (rule_tac r_sb=\"diff_use_env (add_use_env r_x x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\" in trans_leq_use_env)\n   apply (rule_tac t=\"diff_use_env (add_use_env r_x x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\"\n      and s=\"add_use_env (diff_use_env r_x (comp_use_env r_exa r_exb)) x UsePerm\" in subst)\n    apply (rule_tac diff_add_rem_use_env)\n   apply (rule_tac dist_add_leq_use_env)\n   apply (simp)\n  apply (rule_tac dist_diff_leq_use_env_gen)\n   apply (rule_tac id_leq_use_env)\n  apply (simp add: dist_rem_comp_use_env)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (rule_tac comp_leq_use_env1)\n   apply (rule_tac self_rem_leq_use_env)\n  apply (rule_tac self_comp_leq_use_env2)\n  done\n    \nlemma water_app_case: \"\\<lbrakk> \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk> well_typed env delta r_s1 e1 tau r_s2 rx; semi_weak_use_env r_s1;  env (Loc b) = Some t; mem_val_env env; rv_delta delta' e1 b \\<rbrakk> \\<Longrightarrow>\n            well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e1 tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx b);\n       \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk> well_typed env delta r_s1 e2 tau r_s2 rx; semi_weak_use_env r_s1; env (Loc b) = Some t; mem_val_env env; rv_delta delta' e2 b \\<rbrakk> \\<Longrightarrow>\n            well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e2 tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx b);\n       semi_weak_use_env r_s1; env (Loc b) = Some t; mem_ty t; mem_val_env env; rv_delta delta' (AppExp e1 e2) b;\n       well_typed env delta r_s1 e1 (FunTy t1 tau r a) r_s2a rx1; well_typed env delta r_s2a e2 t1 r_s3 rx2;\n       leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex));\n       leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r);\n       leq_use_env rx r_s2; leq_use_env r_ex r_s1; leq_use_env (app_req rx1 rx2 r tau r_ex) rx \\<rbrakk> \\<Longrightarrow>\n       \\<exists>t1 r a r_s2a rx1.\n          well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e1 (FunTy t1 tau r a) r_s2a rx1 \\<and>\n          (\\<exists>rx2 r_s3. well_typed env delta' r_s2a e2 t1 r_s3 rx2 \\<and>\n                      (\\<exists>r_ex. leq_use_env (add_use_env r_s2 (Loc b) UsePerm) (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) \\<and>\n                              leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3 \\<and>\n                              disj_use_env rx1 (lift_use_env rx2 r) \\<and>\n                              leq_use_env (pwrite_use_env rx b) (add_use_env r_s2 (Loc b) UsePerm) \\<and>\n                              leq_use_env r_ex (add_use_env r_s1 (Loc b) UsePerm) \\<and> leq_use_env (app_req rx1 rx2 r tau r_ex) (pwrite_use_env rx b)))\"    \n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"add_use_env r_s2a (Loc b) UsePerm\" in exI)\n  apply (rule_tac x=\"pwrite_use_env rx1 b\" in exI)\n  apply (auto)\n   apply (case_tac \"\\<not> rv_delta delta' e1 b\")\n    apply (simp add: rv_delta_def)\n   apply (auto) \n  apply (rule_tac x=\"pwrite_use_env rx2 b\" in exI)\n  apply (rule_tac x=\"add_use_env r_s3 (Loc b) UsePerm\" in exI)\n  apply (auto)\n   apply (case_tac \"\\<not> rv_delta delta' e2 b\")\n    apply (simp add: rv_delta_def)\n   apply (auto)\n   apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (cut_tac r_sc=\"r_s2\" and r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (auto)\n  apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n    apply (rule_tac self_comp_leq_use_env2)\n  apply (cut_tac r_x=\"rx1\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n    apply (rule_tac self_comp_leq_use_env1)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx2 b) r\" and s=\"pwrite_use_env (lift_use_env rx2 r) b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (simp)\n  apply (simp add: pwrite_comp_use_env)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n       apply (rule_tac wtae_end_leq_use_env1)\n        apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n         apply (rule_tac unroll_dcl_use_env)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (rule_tac rhs_pwrite_diff_leq_use_env)\n         apply (rule_tac id_leq_use_env)\n        apply (simp)\n       apply (simp add: pwrite_use_env_def)\n       apply (auto)\n        apply (simp add: any_loc_use_def)\n       apply (simp add: add_use_env_def)\n      apply (rule_tac add_pwrite_leq_use_env)\n        apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n         apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n          apply (auto)\n      apply (rule_tac dist_add_leq_use_env)\n      apply (simp)\n     apply (rule_tac disj_pwrite_use_env)\n        apply (auto)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (simp)\n   apply (simp add: rem_use_env_def)\n  apply (simp add: app_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx2 b) r\" and s=\"pwrite_use_env (lift_use_env rx2 r) b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (simp)\n  apply (cut_tac r_x=\"rx2\" and r_s=\"lift_use_env rx2 r\" in sw_leq_use_env)\n    apply (rule_tac self_lift_leq_use_env)\n   apply (simp)\n  apply (simp add: pwrite_comp_use_env)\n  apply (case_tac \"any_loc_use (comp_use_env rx1 rx2)\")\n   apply (case_tac \"pwrite_use_env (comp_use_env rx1 rx2) b \\<noteq> add_use_env (comp_use_env rx1 rx2) (Loc b) UsePerm\")\n    apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (case_tac \"\\<not> any_loc_use rx\")\n    apply (simp add: any_loc_use_def)\n    apply (auto)\n    apply (cut_tac r_x=\"comp_use_env rx1 rx2\" and r_s=\"rx\" and r_ex=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" and x=\"x\" in rhs_sw_leq_use_none)\n        apply (auto)\n    apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (auto)\n   apply (case_tac \"pwrite_use_env rx b \\<noteq> add_use_env rx (Loc b) UsePerm\")\n    apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (rule_tac wtae_req_leq_use_env1)\n   apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n    apply (simp)\n   apply (rule_tac unroll_dcl_use_env)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (rule_tac dist_diff_leq_use_env_gen)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac pwrite_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (case_tac \"pwrite_use_env (comp_use_env rx1 rx2) b \\<noteq> comp_use_env rx1 rx2\")\n   apply (simp add: pwrite_use_env_def)\n  apply (auto)\n  apply (rule_tac pwrite_leq_use_env)\n    apply (rule_tac sw_leq_use_env)\n     apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n      apply (auto)\n  apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac unroll_dcl_use_env)\n  apply (rule_tac rhs_diff_rem_leq_use_env2)\n   apply (rule_tac r_s=\"r_s1\" in leq_use_no_own)\n    apply (simp add: semi_weak_use_env_def)\n    apply (erule_tac x=\"Loc b\" in allE)\n    apply (simp_all)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac dist_diff_leq_use_env_gen)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac pwrite_leq_use_env)\n    apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n  apply (rule_tac id_leq_use_env)\n  done\n \nlemma wt_read_value_ih: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; semi_weak_use_env r_s1; env (Loc b) = Some t; mem_ty t; mem_val_env env; rv_delta delta' e b \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta' (add_use_env r_s1 (Loc b) UsePerm) e tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx b)\"      \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const + op cases *)\n          apply (rule_tac dist_add_leq_use_env)\n          apply (auto)\n         apply (rule_tac add_pwrite_leq_use_env)\n          apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n           apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n            apply (auto)\n         apply (rule_tac dist_add_leq_use_env)\n         apply (auto)\n        apply (rule_tac dist_add_leq_use_env)\n        apply (auto)\n       apply (rule_tac add_pwrite_leq_use_env)\n        apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n         apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n          apply (auto)\n       apply (rule_tac dist_add_leq_use_env)\n       apply (auto)\n    (* var case. *)\n      apply (rule_tac water_var_case)\n                 apply (auto)\n    (* pair case. *)\n     apply (rule_tac water_pair_case)\n                      apply (auto)\n    (* if case *)\n    apply (rule_tac water_if_case)\n                apply (auto)\n    (* lam case *)\n   apply (rule_tac water_lam_case)\n               apply (auto)\n    (* app case *)\n  apply (rule_tac water_app_case)\n                 apply (auto)\n  done    \n  \nlemma wtae_diff_use_env: \"\\<lbrakk> strong_use_env r_s \\<rbrakk> \\<Longrightarrow> diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_s x) = one_use_env x UsePerm\"    \n  apply (case_tac \"\\<forall> y. diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_s x) y = one_use_env x UsePerm y\")\n   apply (auto)\n  apply (simp add: one_use_env_def)\n  apply (simp add: rem_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: strong_use_env_def)\n  apply (case_tac \"x = y\")\n   apply (auto)\n  apply (erule_tac x=\"y\" in allE)\n  apply (case_tac \"r_s y\")\n    apply (auto)\n  done    \n   \n    (* if x is an owner var, then there is some delta mapping to it *)\nlemma delta_res_vars: \"\\<lbrakk> Loc x \\<in> res_vars delta e \\<rbrakk> \\<Longrightarrow> (\\<exists> x'. delta x' = x \\<and> x' \\<in> ref_vars e)\"  \n  apply (induct e)\n        apply (auto)\n  apply (case_tac xa)\n   apply (auto)\n  done    \n    \nlemma wt_read_value: \"\\<lbrakk> well_typed env delta r_x v tau r_x r_x; is_value v; well_formed_delta env delta;\n  env (Loc b) = Some t; mem_ty t; unlim tau; r_s (Loc b) \\<noteq> NoPerm; mem_val_env env; sub_env s env; rv_delta delta' v b \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta' r_s v tau r_s (one_use_env (Loc b) UsePerm)\"\n    (* it suffices to prove for starting permissions of just x. *)\n  apply (rule_tac r_s=\"one_use_env (Loc b) UsePerm\" in well_typed_incr_simul_perm)\n   apply (simp add: leq_use_env_def)\n   apply (simp add: one_use_env_def)\n   apply (case_tac \"r_s (Loc b)\")\n     apply (auto)\n    (* call the induction hypothesis *)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"drop_use_env r_x\" and e=\"v\" and tau=\"tau\" and\n        ?r_s2.0=\"drop_use_env r_x\" and rx=\"drop_use_env r_x\" and b=\"b\" and\n        t=\"t\" in wt_read_value_ih)    \n        apply (rule_tac wt_sexp_drop_all)\n           apply (auto)\n     apply (simp add: unlim_def)\n    apply (rule_tac value_is_sexp)\n    apply (simp)\n   apply (rule_tac semi_weak_drop_use_env)\n    (* to reduce r_x to just b, we must invoke the diff lemma *)\n  apply (cut_tac eq_own)\n  apply (auto)\n  apply (rule_tac t=\"one_use_env (Loc b) UsePerm\" and s=\"diff_use_env (add_use_env (lift_use_env r_x r) (Loc b) UsePerm)\n    (rem_use_env (lift_use_env r_x r) (Loc b))\" in subst)\n   apply (rule_tac wtae_diff_use_env)\n   apply (rule_tac strong_lift_use_env)\n   apply (simp)\n    (* permission manipulation *)\n  apply (rule_tac well_typed_diff_perms)\n   apply (rule_tac rx=\"pwrite_use_env (drop_use_env r_x) b\" in well_typed_incr_req)\n     apply (rule_tac r_s=\"add_use_env (drop_use_env r_x) (Loc b) UsePerm\" in well_typed_incr_simul_perm)\n      apply (rule_tac dist_add_leq_use_env)\n      apply (rule_tac drop_leq_use_env)\n      apply (rule_tac self_lift_leq_use_env)\n     apply (simp)\n    (* proving requirements change was valid *)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac semi_weak_drop_use_env)\n     apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (rule_tac drop_leq_use_env)\n    apply (rule_tac self_lift_leq_use_env)\n   apply (rule_tac id_leq_use_env)\n    (* proving that the diff was valid, which should be true since b is the only non-prim var. say that x \\<noteq> b *)\n  apply (case_tac \"x \\<noteq> Loc b\")\n   apply (auto)\n   apply (case_tac x)\n    apply (auto)\n    (* - say that x is a var. then it must be in the env, which is impossible since env is under some s *)\n    apply (simp add: non_prim_vars_def)\n    apply (simp add: non_prim_entry_def)\n    apply (simp add: sub_env_def)\n    apply (erule_tac x=\"Var x1\" in allE)\n    apply (auto)\n    (* - otherwise, x is a res var, which means it must be a delta, which is impossible by rv_delta *)\n   apply (simp add: non_prim_vars_def)\n   apply (auto)\n   apply (cut_tac x=\"x2\" and e=\"v\" in delta_res_vars)\n    apply (auto)\n   apply (simp add: rv_delta_def)\n    (* - then x = b, which is fine *)\n  apply (simp add: own_env_vars_def)\n  apply (simp add: rem_use_env_def)\n  done\n    \nend", "meta": {"author": "dcco", "repo": "perm_lang_thesis", "sha": "81661c97a0c43701c9ec0a75074d9553b2dd0263", "save_path": "github-repos/isabelle/dcco-perm_lang_thesis", "path": "github-repos/isabelle/dcco-perm_lang_thesis/perm_lang_thesis-81661c97a0c43701c9ec0a75074d9553b2dd0263/isa_code/ReduceSetOwn.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.34404329433900654}}
{"text": "theory Compiler\n  imports Printing \"04Stack/StackConversion\" \"12UnstructuredMemory/Unstructuring\" \nbegin\n\nabbreviation code_compile :: \"texpr \\<Rightarrow> mach list\" where\n  \"code_compile \\<equiv> disassemble \\<circ> assemble_code \\<circ> flatten_code \\<circ> tco \\<circ> encode \\<circ> convert\"\n\nabbreviation compile :: \"nexpr \\<rightharpoonup> mach list\" where \n  \"compile \\<equiv> map_option (code_compile \\<circ> fst) \\<circ> typecheck\"\n\nprimrec quick_convert :: \"var set \\<Rightarrow> nexpr \\<Rightarrow> hexpr \\<times> var set\" where\n  \"quick_convert vs (NVar x) = (HVar x, vs)\"\n| \"quick_convert vs (NConst k) = (hexpr.HConst k, vs)\"\n| \"quick_convert vs (NLam x e) = (\n    let v = fresh vs\n    in let (e', vs') = quick_convert (insert v vs) e\n    in (hexpr.HLam x (Var v) e', vs'))\"\n| \"quick_convert vs (NApp e\\<^sub>1 e\\<^sub>2) = (\n    let v = fresh vs\n    in let (e\\<^sub>1', vs') = quick_convert (insert v vs) e\\<^sub>1 \n    in let (e\\<^sub>2', vs'') = quick_convert vs' e\\<^sub>2 \n    in (HApp e\\<^sub>1' e\\<^sub>2', vs''))\"\n\nprimrec collect_constraints :: \"subst \\<Rightarrow> var set \\<Rightarrow> nexpr \\<Rightarrow> uexpr \\<times> var set \\<times> (uexpr \\<times> uexpr) list\" \n    where\n  \"collect_constraints \\<Gamma> vs (NVar x) = (case \\<Gamma> x of \n      Some t \\<Rightarrow> (t, vs, []) \n    | None \\<Rightarrow> (Ctor ''Base'' [], vs, fail))\"\n| \"collect_constraints \\<Gamma> vs (NConst k) = (Ctor ''Base'' [], vs, [])\"\n| \"collect_constraints \\<Gamma> vs (NLam x e) = (\n    let v = fresh vs\n    in let (t, vs', con) = collect_constraints (\\<Gamma>(x \\<mapsto> Var v)) (insert v vs) e\n    in (Ctor ''Arrow'' [Var v, t], vs', con))\"\n| \"collect_constraints \\<Gamma> vs (NApp e\\<^sub>1 e\\<^sub>2) = (\n    let v = fresh vs\n    in let (t\\<^sub>1, vs', con\\<^sub>1) = collect_constraints \\<Gamma> (insert v vs) e\\<^sub>1 \n    in let (t\\<^sub>2, vs'', con\\<^sub>2) = collect_constraints \\<Gamma> vs' e\\<^sub>2 \n    in (Var v, vs'', con\\<^sub>1 @ con\\<^sub>2 @ [(t\\<^sub>1, Ctor ''Arrow'' [t\\<^sub>2, Var v])]))\"\n\nprimrec tree_code_size :: \"tree_code \\<Rightarrow> nat\"\n    and tree_code_size_list :: \"tree_code list \\<Rightarrow> nat\" where\n  \"tree_code_size (TLookup x) = 0\"\n| \"tree_code_size (TPushCon k) = 0\"\n| \"tree_code_size (TPushLam cd) = tree_code_size_list cd\"\n| \"tree_code_size TApply = 0\"\n| \"tree_code_size_list [] = 1\"\n| \"tree_code_size_list (op # cd) = \n      Suc (if op = TApply \\<and> cd = [] then 0 else tree_code_size op + tree_code_size_list cd)\"\n\nprimrec alg_compile1 :: \"var list \\<Rightarrow> nexpr \\<Rightarrow> tree_code list \\<Rightarrow> tree_code list\" where\n  \"alg_compile1 \\<Phi> (NVar x) acc = TLookup (the (idx_of \\<Phi> x)) # acc\"\n| \"alg_compile1 \\<Phi> (NConst k) acc = TPushCon k # acc\"\n| \"alg_compile1 \\<Phi> (NLam x e) acc = TPushLam (alg_compile1 (insert_at 0 x \\<Phi>) e []) # acc\"\n| \"alg_compile1 \\<Phi> (NApp e\\<^sub>1 e\\<^sub>2) acc = alg_compile1 \\<Phi> e\\<^sub>1 (alg_compile1 \\<Phi> e\\<^sub>2 (TApply # acc))\"\n\nfunction alg_compile2 :: \"nat \\<Rightarrow> tree_code list \\<Rightarrow> byte_code list \\<Rightarrow> byte_code list\" where\n  \"alg_compile2 lib [] acc = BReturn # acc\"\n| \"alg_compile2 lib (TLookup x # cd) acc = alg_compile2 lib cd (BLookup x # acc)\"\n| \"alg_compile2 lib (TPushCon k # cd) acc = alg_compile2 lib cd (BPushCon k # acc)\"\n| \"alg_compile2 lib (TPushLam cd' # cd) acc =\n    alg_compile2 lib cd' \n      (alg_compile2 (lib + tree_code_size_list cd') cd \n        (BPushLam (lib + tree_code_size_list cd') # acc))\"\n| \"alg_compile2 lib (TApply # []) acc = BJump # acc\"\n| \"alg_compile2 lib (TApply # op # cd) acc = alg_compile2 lib (op # cd) (BApply # acc)\"\n  by pat_completeness auto\ntermination\n  by (relation \"measure (tree_code_size_list \\<circ> fst \\<circ> snd)\") simp_all\n\nfun assembly_mapb :: \"byte_code list \\<Rightarrow> nat \\<Rightarrow> nat\" where\n  \"assembly_mapb [] x = 0\"\n| \"assembly_mapb (op # cd) 0 = 0\"\n| \"assembly_mapb (BLookup k # cd) (Suc x) = 8 + 2 * k + assembly_mapb cd x\"\n| \"assembly_mapb (BPushCon k # cd) (Suc x) = 8 + assembly_mapb cd x\"\n| \"assembly_mapb (BPushLam pc # cd) (Suc x) = 12 + assembly_mapb cd x\"\n| \"assembly_mapb (BApply # cd) (Suc x) = 24 + assembly_mapb cd x\"\n| \"assembly_mapb (BReturn # cd) (Suc x) = 6 + assembly_mapb cd x\"\n| \"assembly_mapb (BJump # cd) (Suc x) = 21 + assembly_mapb cd x\"\n\nfun alg_assemble :: \"(nat \\<Rightarrow> nat) \\<Rightarrow> byte_code list \\<Rightarrow> mach list\" where\n  \"alg_assemble mp [] = []\"\n| \"alg_assemble mp (BLookup x # cd) = \n    [LDI R5 0, ADD R3 4, STO R3 R5, LOD R5 R5, SUB R5 8] @ \n      concat (replicate x [LOD R5 R5, SUB R5 4]) @ \n      [LOD R5 R5, SUB R5 4, MOV R5 R4] @ \n      alg_assemble mp cd\"\n| \"alg_assemble mp (BPushCon k # cd) = \n    [ADD R1 4, STO R1 R5, ADD R1 4, STI R1 k, ADD R1 4, STI R1 1, ADD R3 4, STO R3 R1] @ \n      alg_assemble mp cd\"\n| \"alg_assemble mp (BPushLam pc # cd) = \n    [ADD R1 4, STI R1 (mp pc), LDI R5 0, ADD R1 4, \n      STO R1 R5, ADD R1 4, STI R1 0, LOD R5 R5, SUB R5 4, MOV R5 R4, ADD R3 4, STO R3 R1] @ \n      alg_assemble mp cd\"\n| \"alg_assemble mp (BApply # cd) = \n    [JMP R5, LOD R5 R5, ADD R5 8, STI R3 0, LOD R5 R3, ADD R2 4, STO R2 R5, LOD R5 R5, ADD R5 4, \n      LOD R5 R3, SUB R3 4, ADD R4 4, STO R4 R5, ADD R5 4, MOV R5 R2, ADD R4 4, STO R4 R5, SUB R5 18, \n      MVP R5, ADD R2 4, STO R2 R5, STI R3 0, LOD R5 R3, SUB R3 4] @ \n      alg_assemble mp cd\"\n| \"alg_assemble mp (BReturn # cd) = \n    [JMP R5, STI R4 0, LOD R5 R4, SUB R4 4, STI R4 0, SUB R4 4] @ \n      alg_assemble mp cd\"\n| \"alg_assemble mp (BJump # cd) = \n    [JMP R5, LOD R5 R5, ADD R5 8, STI R3 0, LOD R5 R3, ADD R2 4, STO R2 R5, LOD R5 R5, ADD R5 4, \n      LOD R5 R3, SUB R3 4, ADD R4 4, STO R4 R5, SUB R4 4, ADD R5 4, MOV R5 R2, ADD R2 4, STO R2 R5, \n      STI R3 0, LOD R5 R3, SUB R3 4] @ \n      alg_assemble mp cd\"\n\ndefinition alg_compile3 :: \"byte_code list \\<Rightarrow> mach list\" where\n  \"alg_compile3 cd = alg_assemble (assembly_mapb cd) cd\"\n\ndefinition alg_compile :: \"nexpr \\<rightharpoonup> mach list \\<times> ty\" where\n  \"alg_compile e = (\n    let (t, vs, con) = collect_constraints Map.empty {} e\n    in case unify' con of\n        None \\<Rightarrow> None\n      | Some s \\<Rightarrow> \n          Some (alg_compile3 (alg_compile2 0 (alg_compile1 [] e []) []), tsubsts s (typeify t)))\"\n\n\n\nlemma [simp]: \"encode \\<circ> convert \\<circ> tsubstt sub = encode \\<circ> convert\"\n  by (auto simp add: convert_def)\n\nlemma [simp]: \"typecheck' \\<Gamma> vs e = (e', t, vs', con) \\<Longrightarrow> quick_convert vs e = (e', vs')\"\n  by (induction e arbitrary: \\<Gamma> vs e' t vs' con) \n     (simp_all add: Let_def split: option.splits prod.splits)\n\nlemma [simp]: \"quick_convert vs e = (e', vs') \\<Longrightarrow> \n    alg_compile1 \\<Phi> e acc = encode (convert' \\<Phi> (solidify e')) @ acc\"\n  by (induction e arbitrary: \\<Phi> acc vs e' vs') (auto simp add: Let_def split: prod.splits)\n\nlemma [simp]: \"typecheck' \\<Gamma> vs e = (e', t, vs', con) \\<Longrightarrow> \n  alg_compile1 \\<Phi> e acc = encode (convert' \\<Phi> (solidify e')) @ acc\"\nproof -\n  assume \"typecheck' \\<Gamma> vs e = (e', t, vs', con)\"\n  hence \"quick_convert vs e = (e', vs')\" by simp\n  thus ?thesis by simp\nqed\n\nlemma [simp]: \"tree_code_size_list cd = code_list_size (tco_cd cd)\"\n  by (induction cd rule: tco_cd.induct) (simp_all split: list.splits)\n\nlemma [simp]: \"alg_compile2 lib cd acc = flatten_code' lib (tco_cd cd) (tco_r cd) @ acc\"\n  by (induction lib cd acc rule: alg_compile2.induct) simp_all\n\nlemma [simp]: \"alg_assemble mp cd = disassemble (concat (map (assemble_op mp) cd))\"\n  by (induction mp cd rule: alg_assemble.induct) (simp_all add: disassemble_def)\n\nlemma [simp]: \"assembly_mapb cd x = assembly_map cd x\"\n  by (induction cd x rule: assembly_mapb.induct) simp_all\n\nlemma [simp]: \"assembly_mapb cd = assembly_map cd\"\n  by rule simp\n\nlemma [simp]: \"alg_compile3 cd = disassemble (assemble_code cd)\"\n  by (simp_all add: alg_compile3_def assemble_code_def)\n\nlemma [simp]: \"collect_constraints \\<Gamma> vs e = snd (typecheck' \\<Gamma> vs e)\"\n  by (induction e arbitrary: \\<Gamma> vs) (simp_all add: Let_def split: option.splits prod.splits)\n\nlemma [simp]: \"alg_compile = opt_pair compile (map_option snd \\<circ> typecheck)\"\n  by (auto simp add: alg_compile_def Let_def tco_def convert_def split: prod.splits option.splits)\n\nend", "meta": {"author": "xtreme-james-cooper", "repo": "Lambda-RAM-Compiler", "sha": "24125435949fa71dfc5faafdb236d28a098beefc", "save_path": "github-repos/isabelle/xtreme-james-cooper-Lambda-RAM-Compiler", "path": "github-repos/isabelle/xtreme-james-cooper-Lambda-RAM-Compiler/Lambda-RAM-Compiler-24125435949fa71dfc5faafdb236d28a098beefc/Compiler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.34404329433900643}}
{"text": "theory Sim_Rules\nimports CRef \"CSimpl.SmallStepCon\"\nbegin\nsection \\<open>Operational rules for CSimpRGSim\\<close>\n\nlemma conjId: \"\\<lbrakk>Q; P\\<rbrakk> \\<Longrightarrow> P \\<and> Q\" by (rule conjI)\n    \n\ninductive_cases stepc_normal_elim_cases:\n  \"\\<Gamma>\\<turnstile>\\<^sub>c\\<^sub>v(c,Normal s) \\<rightarrow> u\"\n\ndefinition eq_rel:: \"'a set \\<Rightarrow> 'b set  \\<Rightarrow>('a \\<times>'b) set\" \n  (\"_ \\<rightleftharpoons> / _\" [81,81] 100) \n  where\n\"eq_rel s1 s2   \\<equiv> {(a,b).  (a\\<in>s1) = (b\\<in>s2)}\"\n\ndefinition and_rel:: \"'a set \\<Rightarrow> 'b set  \\<Rightarrow>('a \\<times> 'b) set\" \n  (\"_ \\<odot> / _\" [81,81] 100) \n  where\n\"and_rel s1 s2   \\<equiv> {(a,b). (a\\<in>s1) \\<and> (b\\<in>s2)}\"\n\nlemma same_set: \n  \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi> \\<Longrightarrow>\n   \\<xi> \\<subseteq> (b\\<^sub>c \\<rightleftharpoons>  b\\<^sub>s) \\<Longrightarrow> \n   (\\<sigma> \\<in> b\\<^sub>c) = (\\<Sigma> \\<in> b\\<^sub>s)\" \n  unfolding eq_rel_def ToNorm_def by auto\n \ndefinition Sta\\<^sub>s :: \"('s,'s1) invs \\<Rightarrow> \n                   ((('s,'f) xstate\\<times>('s,'f) xstate)\\<times>(('s1,'f) xstate\\<times>('s1,'f) xstate)) set \\<Rightarrow> bool\" where\n  \"Sta\\<^sub>s f R \\<equiv>  (\\<forall>x x1 y y1. (x,y) \\<in> f \\<and>  ((Normal x, x1),Normal y, y1)\\<in> R \\<longrightarrow> \n                           (\\<forall>xn. x1=Normal xn \\<longrightarrow> (\\<exists>yn. y1 = Normal yn \\<and>  (xn,yn)\\<in> f)) \\<and> (x1,y1)\\<in>\\<alpha>\\<^sub>x)\"\n\n\nlemma skip_sim_fault:assumes \n a1:\"(\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x\" and\n a2:\"\\<forall>ns. \\<sigma> \\<noteq> Normal ns\" and \n a4:\"c\\<^sub>c = LanguageCon.com.Skip \\<and> (\\<exists>f. \\<sigma> = Fault f)\"\n shows\"(\\<exists>s''. eq_f \\<sigma> s'' \\<and>\n              \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, s'') \\<and> (\\<sigma>,s'')\\<in>\\<alpha>\\<^sub>x)\"\nproof-\n  have \"eq_f \\<sigma> \\<Sigma>\" using  a1 a4 Fault_alpha\n    by fastforce\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, \\<Sigma>)\"\n    using a4 step_tau_skip  a1 a2 calculation\n    by (metis  eq_f.simps(1) xstate.simps(7))\n  ultimately show ?thesis  using a1 by blast\nqed\n\n\n\nlemma alpha_id_G:assumes \n  a0:\"(\\<sigma>,\\<Sigma>) \\<in> \\<alpha>\" and  \n  a1:\"CRef.Id \\<subseteq> G\\<^sub>c\"\nshows \"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>) \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\"\n using a0 a1 unfolding  related_transitions_def Id_def alpha_xstate_def by fastforce\n\n\nlemma simulation_env_not_normal:\n  assumes \n       a1:\"\\<forall>ns. \\<sigma> \\<noteq> Normal ns\" and\n       a2:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and\n       a4:\"(((\\<sigma>, \\<sigma>'), \\<Sigma>, \\<Sigma>') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x\" \n       shows \"(\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>ns. \\<sigma>' \\<noteq> Normal ns)\"\nproof-   \n  have \"\\<forall>ns. \\<sigma>' \\<noteq> Normal ns\" using a4 alpha_not_normal1 unfolding related_transitions_def\n    using a1 a2  by blast   \n  then show ?thesis using a4 by auto\nqed\n\nlemma sim_not_normal: \n  assumes\n     a1:\"(\\<sigma>,\\<Sigma>) \\<in> \\<alpha>\\<^sub>x\" and\n     a2:\"\\<forall>ns. \\<sigma> \\<noteq> Normal ns\" and    \n     a6:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a7:\"\\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\"\n   shows  \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s,\\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"  \nusing  a1 a2   a6\n  apply(coinduction arbitrary: \\<sigma> \\<Sigma> c\\<^sub>c c\\<^sub>s)\n  apply(clarsimp)\n  apply (rule conjId)+  \n  using  step_tau_skip apply (metis Normal_alpha2)      \n     apply (metis a7 rtranclp.rtrancl_refl step_NotNormal) \n  using simulation_env_not_normal apply blast                \n   apply (rule, rule, rule, rule , metis not_normal_not_event) \n  apply (rule, rule, rule)\n  by (metis step_not_normal_s_eq_t stepce_stepc)\n\n\nlemma SIM_not_normal_end_state:\n  assumes \n   a1:\"(\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x\" and\n   a2:\"\\<forall>ns. \\<sigma> \\<noteq> Normal ns\" and   \n   a4:\"length c\\<^sub>c = length c\\<^sub>s\" and\n   a5:\"(\\<forall>i<length c\\<^sub>s. c\\<^sub>c ! i = LanguageCon.com.Skip) \\<and>\n        c\\<^sub>c \\<noteq> []\" \nshows \"\\<exists>\\<Sigma>' c\\<^sub>s'.\n      \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (c\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s',\\<Sigma>') \\<and>\n      (\\<sigma>, \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n      (\\<forall>i<length c\\<^sub>s'. c\\<^sub>s' ! i = LanguageCon.com.Skip) \\<and> c\\<^sub>s' \\<noteq> []\"\nproof- \n  have \"\\<forall>sn. \\<Sigma>\\<noteq> Normal sn \"\n     using  a1 a2\n     using alpha_not_normal by auto\n   thus ?thesis\n     using par_step_tau_skip_s a4 a5 a1\n     by (metis  length_greater_0_conv )    \n qed    \n\nlemma SIM_not_normal2:\n  assumes \n         a1:\"(\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x\" and\n   a2:\"\\<forall>ns. \\<sigma> \\<noteq> Normal ns\" and\n   a4:\"length c\\<^sub>c = length c\\<^sub>s\" and\n   a5:\"(\\<forall>i<length c\\<^sub>s. c\\<^sub>c ! i = LanguageCon.com.Skip) \\<and>\n       \\<sigma> = Stuck \\<and> c\\<^sub>c \\<noteq> []\" \n   shows \" \\<exists>c''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (c\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c'', Stuck) \\<and>\n             (Stuck, Stuck) \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<forall>i<length c''. c'' ! i = LanguageCon.com.Skip) \\<and> c'' \\<noteq> []\" \nproof- \n   have \"\\<Sigma>=Stuck \"\n     using   Stuck_alpha  a1 a5 by fastforce\n   moreover have \"c\\<^sub>s\\<noteq>[]\" using a5  a4 by auto\n   then obtain c'' where \" \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (c\\<^sub>s, Stuck) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c'', Stuck) \\<and>\n                  (\\<forall>i<length c''. c'' ! i = LanguageCon.com.Skip) \\<and> c'' \\<noteq> []\"\n   using calculation par_step_tau_skip_s[of \\<Sigma> c\\<^sub>s] a4 a5 a1 \n   by blast\n  ultimately show ?thesis using par_step_tau_skip_s[of \\<Sigma> c\\<^sub>s] a4 a5 a1   \n    unfolding alpha_xstate_def by auto\n qed       \n\n lemma SIM_not_normal3:\n  assumes \n         a1:\"(\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x\" and\n   a2:\"\\<forall>ns. \\<sigma> \\<noteq> Normal ns\" and\n   a4:\"length c\\<^sub>c = length c\\<^sub>s\" and\n   a5:\"(\\<forall>i<length c\\<^sub>s. c\\<^sub>c ! i = LanguageCon.com.Skip) \\<and>\n       (\\<exists>f. \\<sigma> = Fault f) \\<and> c\\<^sub>c \\<noteq> []\" \n   shows \"\\<exists>c'' s''. (\\<sigma>, s'') \\<in> \\<alpha>\\<^sub>x \\<and>\n           eq_f \\<sigma> s'' \\<and>\n           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (c\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c'', s'') \\<and>\n           (\\<forall>i<length c''. c'' ! i = LanguageCon.com.Skip) \\<and> c'' \\<noteq> []\" \nproof- \n   have eq:\"eq_f \\<sigma> \\<Sigma>\"\n     using   Fault_alpha  xstate.simps(5)  a1 a5 by fastforce\n   then obtain f where \"\\<Sigma> = Fault f\"\n     using a5 by auto \n   thus ?thesis \n    using par_step_tau_skip_s a4 a5 a1 eq a1\n    by (metis length_0_conv less_not_refl xstate.distinct(3))\n qed  \n\n lemma SIM_not_normal4:\n  assumes\n         a1:\"(\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x\" and\n   a2:\"\\<forall>ns. \\<sigma> \\<noteq> Normal ns\" and\n   a4:\"length c\\<^sub>c = length c\\<^sub>s\" and \n   a5:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>p\\<^sub>\\<tau> (c\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and\n   a6:\"\\<sigma> = \\<sigma>'\" \n   shows \"\\<exists>c\\<^sub>s' \\<Sigma>'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (c\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<and>\n          (\\<sigma>',\\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>          \n          ((\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>ns. \\<sigma>' \\<noteq> Normal ns) \\<and> length c\\<^sub>c' = length c\\<^sub>s' \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\" \nproof- \n   have eq:\"\\<forall>ns. \\<Sigma> \\<noteq> Normal ns\"\n     using   alpha_not_normal a1 a2 by auto  \n   also have \"length c\\<^sub>c = length c\\<^sub>c'\" using a5\n     by (metis length_list_update step_p_pair_elim_cases steppe_stepp)\n   ultimately show ?thesis using  \n     rtranclp.rtrancl_refl a1 a2 a5 a6 a4\n     by fastforce      \n qed     \n  \nlemma SIM_not_normal: \n  assumes     \n     a1:\"(\\<sigma>,\\<Sigma>) \\<in> \\<alpha>\\<^sub>x\" and\n     a2:\"\\<forall>ns. \\<sigma> \\<noteq> Normal ns\" and  a3:\"\\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\" and  \n     a6:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a7:\"length c\\<^sub>c = length c\\<^sub>s\"\n   shows  \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s,\\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"  \nusing  a1 a2   a6  a7\n  apply(coinduction arbitrary: \\<sigma> \\<Sigma> c\\<^sub>c c\\<^sub>s)\n  apply(clarsimp)\n  apply (rule conjId)+  \n    apply (rule, rule SIM_not_normal_end_state,assumption+)   \n  apply (metis a3 length_list_update rtranclp.rtrancl_refl step_p_tau_not_normal step_pev_pair_elim_cases)\n  using simulation_env_not_normal apply blast \n  by (blast intro: step_p_tau_not_normal )+\n\n\nlemma skip3:\n  assumes a0:\"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and                    \n          a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<forall>sn. (Normal sn, Normal sn)\\<in>G\\<^sub>c\" and\n          a3:\"\\<sigma> = Normal \\<sigma>n\" \n        shows \n           \"(\\<exists>ns1'. ((\\<sigma>, \\<sigma>), Normal \\<Sigma>n, Normal ns1') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n            (\\<sigma>n, ns1') \\<in> \\<xi> \\<and>           \n            \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Skip, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                    (LanguageCon.com.Skip, Normal ns1'))\"  \n  using a0 a1  a2 a3 unfolding related_transitions_def Id_def \n  by fast\n\n            \nlemma Skip_sim_normal_not_normal:\n  assumes a1: \"(\\<sigma>,\\<Sigma>)\\<in>\\<alpha>\\<^sub>x\" and \n          a2:\"\\<not>(\\<exists>\\<sigma>\\<^sub>n. \\<sigma>=Normal \\<sigma>\\<^sub>n)\" and a3:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a4:\"\\<forall>\\<sigma>.(\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\"\n  shows\n   \"(\\<Gamma>\\<^sub>c,(Skip, \\<sigma>),R\\<^sub>c,G\\<^sub>c)\n           \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Skip, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" using a2\n   sim_not_normal[OF a1 _ a3 a4] by blast\n\nlemma sim_env:\n  assumes \n a2:\"(\\<sigma>\\<^sub>n, \\<Sigma>\\<^sub>n) \\<in> \\<xi>\" and\n a3:\"Sta\\<^sub>s \\<xi> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and\n a4:\"\\<forall>sn. (sn, sn) \\<in> G\\<^sub>c\" and\n a5:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x \" and\n a7:\" (((Normal \\<sigma>\\<^sub>n, \\<sigma>'), Normal \\<Sigma>\\<^sub>n, \\<Sigma>') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>',\\<Sigma>')\\<in>\\<alpha>\\<^sub>x\" \nshows\" (\\<exists>\\<sigma>\\<^sub>n \\<Sigma>\\<^sub>n. \\<Sigma>' = Normal \\<Sigma>\\<^sub>n \\<and> (\\<sigma>\\<^sub>n, \\<Sigma>\\<^sub>n) \\<in> \\<xi> \\<and> \\<sigma>' = Normal \\<sigma>\\<^sub>n) \\<or> \n       (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s,\\<Sigma>'),R\\<^sub>s,G\\<^sub>s) \"\nusing a3 a7 a2  sim_not_normal[OF _ _ a5 a4] unfolding Sta\\<^sub>s_def \n  by metis\n\nlemma sim_env_normal:\n  assumes \n a2:\"(\\<sigma>\\<^sub>n, \\<Sigma>\\<^sub>n) \\<in> \\<xi>\" and\n a3:\"Sta\\<^sub>s \\<xi> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and\n a4:\"\\<forall>sn. (sn, sn) \\<in> G\\<^sub>c\" and\n a5:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x \" and \n a7:\" (((Normal \\<sigma>\\<^sub>n, Normal \\<sigma>n'), Normal \\<Sigma>\\<^sub>n, Normal \\<Sigma>n') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (Normal \\<sigma>n',Normal \\<Sigma>n')\\<in>\\<alpha>\\<^sub>x\" \nshows\" (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi>\"\nusing a3 a7 a2   unfolding Sta\\<^sub>s_def  by fastforce\n  \n\n\n lemma Skip_sim_normal:\n  assumes a1:\"\\<xi> \\<subseteq> \\<alpha>\" and\n          a2: \"(\\<sigma>\\<^sub>n,\\<Sigma>\\<^sub>n)\\<in>\\<xi>\" and\n          a3: \"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"\\<sigma>=Normal \\<sigma>\\<^sub>n\" and\n          a5: \"\\<forall>sn. (sn,  sn)\\<in>G\\<^sub>c\" and a6:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" \n  shows\n   \"(\\<Gamma>\\<^sub>c,(Skip, \\<sigma>),R\\<^sub>c,G\\<^sub>c)\n           \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Skip, Normal \\<Sigma>\\<^sub>n),R\\<^sub>s,G\\<^sub>s)\" using  a1 a2 a3 a4 a5  a6\n  apply (coinduction arbitrary: \\<sigma> \\<sigma>\\<^sub>n \\<Sigma>\\<^sub>n)\n   apply (clarsimp)\n   apply (rule conjI, simp add: alpha_xstate_def)\n   apply (rule conjI,blast intro: skip1)+\n   apply (rule conjI, simp add:  sim_env)\n   apply (rule conjI)\n    apply(simp add: skip3)\n   by (blast intro: skip1)\n     \n\n  \n lemma Skip_sim:\n  assumes a1:\"\\<xi> \\<subseteq> \\<alpha>\" and\n          a2: \"(\\<sigma>,\\<Sigma>) \\<in> (r\\<^sub>i \\<xi>)\" and\n          a3: \"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n          a4: \"\\<forall>sn. (sn, sn)\\<in>G\\<^sub>c\" and  a6:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" \n  shows\n   \"(\\<Gamma>\\<^sub>c,(Skip, \\<sigma>),R\\<^sub>c,G\\<^sub>c)\n           \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Skip, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"  \n   apply (cases \\<sigma>) \n   using Skip_sim_normal[OF a1 _ a3 _ a4 a6 ] \n         Skip_sim_normal_not_normal[OF ri_dest[OF a2] _ a6 a4] ri_normal_dest[OF a2]\n   by fast+\n\nlemma Skip_sound: \n  \"\\<xi> \\<subseteq> \\<alpha> \\<Longrightarrow> Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow> \\<forall>sn. (sn,  sn)\\<in>G\\<^sub>c \\<Longrightarrow> R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow> \n    (\\<Gamma>\\<^sub>c,Skip,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,Skip,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def \n  by (simp add: Skip_sim_normal) \n        \n \nlemma throw3:\n  assumes a0:\"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and          \n          a2:\"\\<xi> \\<subseteq> \\<alpha>\" and a3:\"\\<forall>sn.  (sn, sn)\\<in>G\\<^sub>c\" and\n          a4:\"\\<sigma> = Normal \\<sigma>n\" \n        shows \n           \"(\\<exists>ns1'. ((\\<sigma>, \\<sigma>), Normal \\<Sigma>n, Normal ns1') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n            (\\<sigma>n, ns1') \\<in> \\<xi> \\<and>           \n            \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Throw, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                    (LanguageCon.com.Throw, Normal ns1'))\"  \nusing a0 a2 a3 a4 unfolding related_transitions_def Id_def by fast   \n\nlemma Throw_sim_not_normal:\n  assumes \n          a1: \"(\\<sigma>,\\<Sigma>)\\<in>\\<alpha>\\<^sub>x\" and                     \n          a2:\"\\<not>(\\<exists>\\<sigma>\\<^sub>n. \\<sigma>=Normal \\<sigma>\\<^sub>n)\" and a3: \"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a4:\"\\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\"\n  shows\n   \"(\\<Gamma>\\<^sub>c,(Throw, \\<sigma>),R\\<^sub>c,G\\<^sub>c)\n           \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Throw, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" using  a2 \n    sim_not_normal[OF a1 _ a3 a4] by blast  \n  \nlemma Throw_sim_normal:\n  assumes  a0:\"\\<xi> \\<subseteq> \\<alpha>\" and\n          a1: \"(\\<sigma>\\<^sub>n,\\<Sigma>\\<^sub>n)\\<in>\\<xi>\" and \n          a2: \"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a3:\"\\<sigma>=Normal \\<sigma>\\<^sub>n\" and\n          a4: \"\\<forall>sn. (sn, sn)\\<in>G\\<^sub>c\"  and a5:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" \n  shows\n   \"(\\<Gamma>\\<^sub>c,(Throw, \\<sigma>),R\\<^sub>c,G\\<^sub>c)\n           \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>) (\\<Gamma>\\<^sub>s,(Throw, Normal \\<Sigma>\\<^sub>n),R\\<^sub>s,G\\<^sub>s)\" using  a0 a1 a2 a3 a4 a5 \n  apply (coinduction arbitrary: \\<sigma> \\<sigma>\\<^sub>n \\<Sigma>\\<^sub>n)\n  apply (clarsimp)\n   apply (rule conjI, simp add: alpha_xstate_def)\n   apply (rule conjI,blast)\n   apply (rule conjI, fastforce intro: throw1)        \n  apply (rule conjI, metis (no_types, lifting) CRef.stepc_elim_cases(21) CRef.stepc_elim_cases(22) CRef.stepc_elim_cases(23) SmallStepCon.stepc_elim_cases(11) option.distinct(1) stepce_stepc)   \napply (rule conjI, simp add:  sim_env)  \n  apply (rule conjI, blast intro: throw3)\n  by (blast intro: throw1)\n\n\n\n lemma Throw_sim:\n  assumes a1:\"\\<xi> \\<subseteq> \\<alpha>\" and\n          a2: \"(\\<sigma>,\\<Sigma>) \\<in> (r\\<^sub>i \\<xi>)\" and\n          a3: \"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n          a4: \"\\<forall>sn. (sn, sn)\\<in>G\\<^sub>c\" and  a6:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\"  \n  shows\n   \"(\\<Gamma>\\<^sub>c,(Throw, \\<sigma>),R\\<^sub>c,G\\<^sub>c)\n           \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>;\\<^sub>\\<xi>\\<^sub>) (\\<Gamma>\\<^sub>s,(Throw, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"    \n   apply (cases \\<sigma>) \n   using Throw_sim_normal[OF  a1 _ a3 _ a4 a6 ] \n         Throw_sim_not_normal[OF ri_dest[OF a2] _ a6 a4] ri_normal_dest[OF a2] \n   by fast+\n\n\n        \nlemma Throw_sound: \n  \"\\<xi> \\<subseteq> \\<alpha> \\<Longrightarrow> Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow>  \\<forall>sn. (sn,  sn)\\<in>G\\<^sub>c \\<Longrightarrow> R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow>\n   (\\<Gamma>\\<^sub>c,Throw,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>) (\\<Gamma>\\<^sub>s,Throw,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def by (simp add: Throw_sim_normal )    \n  \n lemma env_sim:\n   assumes\n     a0:\" (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s,\\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and\n     a1:\"((\\<sigma>, s1), \\<Sigma>, s1') \\<in> ((R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>  (s1,s1')\\<in>\\<alpha>\\<^sub>x\" \n     shows\"\n          (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, s1),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n          (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, s1'),R\\<^sub>s,G\\<^sub>s)  \\<or> P\"   \nusing  dest_sim_env_step[OF a0 a1 ] by fastforce\n\n\n    \nlemma seq_ev_comp_step:\n assumes           \n      a1:\"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and      \n      a7:  \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n  shows\n      \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba.\n                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          (((\\<sigma>, Normal \\<sigma>n'), \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n          ((\\<exists>\\<Sigma> c1\\<^sub>c.\n               c\\<^sub>c' = LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c \\<and>\n               (\\<exists>c1\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s \\<and>\n                       Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c)\n                       \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n           (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof-\n  have \"c1\\<^sub>c\\<noteq>Skip \\<and> c1\\<^sub>c\\<noteq>Throw\" \n    using not_seq_skip_throw_ev  a7  by fastforce\n  then obtain c1'\n    where stepc1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', Normal \\<sigma>n')\" and \n          seq:    \"(c\\<^sub>c',Normal \\<sigma>n')= (Seq c1' c2\\<^sub>c,Normal \\<sigma>n')\" \n    using stepc_elim_cases1(5)[OF a7, of \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', Normal \\<sigma>n') \\<and> (c\\<^sub>c',Normal \\<sigma>n')= (Seq c1' c2\\<^sub>c,Normal \\<sigma>n')\"]\n    by fast\n  thus ?thesis \n    using  seq_ev_plus stepc1 seq  \n    dest_sim_ev_step[OF a1 stepc1]\n    by fast\nqed           \n\n (*if c1\\<^sub>c = Skip and \\<sigma> is not normal we cannot get  (\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \n   since we don't get (\\<sigma>,\\<Sigma>)\\<in>\\<gamma>\\<^sub>r in that case we need to prove that (c2\\<^sub>c,\\<sigma>) *)\n\nlemma seq_no_ev_comp_step:\n  assumes \n  a0:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and \n  a2:\"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and\n  a3:\"(\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\" and\n  a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>a (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and\n  a5:\"\\<forall>sn. (sn, sn) \\<in> G\\<^sub>c\" and  \n  a7:\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n  a8:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\nshows\"(\\<exists>c\\<^sub>s' \\<Sigma>n'.\n              \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n              (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n              (((\\<sigma>, Normal \\<sigma>n'), \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n              ((\\<exists>\\<Sigma> c1\\<^sub>c.\n                   c\\<^sub>c' = LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c \\<and>\n                   (\\<exists>c1\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s \\<and>\n                           Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c)\n                           \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n               (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n               (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\n unfolding RGSim_pre_def \nproof(cases \"c1\\<^sub>c = Skip \\<or> (c1\\<^sub>c = Throw \\<and> (\\<exists>\\<sigma>\\<^sub>n. \\<sigma> = Normal \\<sigma>\\<^sub>n))\")\n  case True \n  {assume a00:\"c1\\<^sub>c = Skip\"         \n   then have step_seq:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c2\\<^sub>c,\\<sigma>)\"\n     using SeqSkipc by auto     \n   then have alpha:\"c\\<^sub>c'=c2\\<^sub>c \\<and> Normal \\<sigma>n' = \\<sigma>\" using a00\n     by (metis SmallStepCon.stepc_elim_cases(1) a8 prod.inject stepc_elim_cases_Seq_skip(1) stepce_stepc)   \n   have ?thesis  \n   proof (cases \"\\<exists>\\<sigma>\\<^sub>n. \\<sigma> = Normal \\<sigma>\\<^sub>n\")\n     case True\n     then obtain \\<sigma>\\<^sub>n where Normal:\"\\<sigma>=Normal \\<sigma>\\<^sub>n\" by auto\n     then obtain s1' where \n     in_alpha:\"((Normal \\<sigma>\\<^sub>n, Normal \\<sigma>\\<^sub>n), \\<Sigma>,Normal s1') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n       \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c1\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal s1') \\<and> (\\<sigma>\\<^sub>n,  s1') \\<in> \\<gamma>\\<^sub>r\"       \n         using a00 a2 sim_elim_cases_c(1)[of \\<Gamma>\\<^sub>c \\<sigma> R\\<^sub>c G\\<^sub>c \\<alpha> \\<gamma>\\<^sub>r \\<gamma>\\<^sub>a \\<Gamma>\\<^sub>s c1\\<^sub>s \\<Sigma> R\\<^sub>s G\\<^sub>s ] by blast\n     then have sim: \"(\\<Gamma>\\<^sub>c,(c2\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c2\\<^sub>s,  Normal s1'),R\\<^sub>s,G\\<^sub>s)\"\n       using a3 Normal in_alpha unfolding RGSim_pre_def by auto\n     then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c2\\<^sub>s, Normal s1')\"    \n       using seq_ev_s SeqSkipc in_alpha\n       by (metis (no_types, hide_lams) rtranclp.simps) \n     then show ?thesis using in_alpha sim alpha Normal sim_alpha by fastforce\n   next     \n     case False \n     thus ?thesis using a8\n       using alpha by auto           \n   qed      \n  } note l1=this\n  {assume a00:\"c1\\<^sub>c = Throw \\<and> (\\<exists>\\<sigma>\\<^sub>n. \\<sigma> = Normal \\<sigma>\\<^sub>n)\" \n   then obtain \\<sigma>\\<^sub>n where a00:\"c1\\<^sub>c = Throw \\<and> (\\<sigma> = Normal \\<sigma>\\<^sub>n)\" by auto\n   then have step_seq:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (Throw,\\<sigma>)\"\n     using SeqThrowc by auto\n   then have alpha:\"c\\<^sub>c'=Throw \\<and> Normal \\<sigma>\\<^sub>n = Normal \\<sigma>n'\" using a00      \n      LanguageCon.com.simps(28) Pair_inject a8 stepc_Normal_elim_cases(11) \n               stepc_Normal_elim_cases(5) stepce_stepc\n     by (metis xstate.inject(1))\n   obtain s1' where in_alpha:\"((Normal \\<sigma>\\<^sub>n, Normal \\<sigma>\\<^sub>n), \\<Sigma>,Normal s1') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c1\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw, Normal s1')\" and r:\"(\\<sigma>\\<^sub>n,  s1') \\<in> \\<gamma>\\<^sub>a\"       \n     using a00 a2 sim_elim_cases_c(2)[of \\<Gamma>\\<^sub>c  \\<sigma>\\<^sub>n R\\<^sub>c G\\<^sub>c \\<alpha> \\<gamma>\\<^sub>r \\<gamma>\\<^sub>a \\<Gamma>\\<^sub>s c1\\<^sub>s \\<Sigma> R\\<^sub>s G\\<^sub>s]        \n     by metis\n   then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw, Normal s1')\" \n     using seq_ev_s SeqThrowc  \n     by (metis (no_types, hide_lams) rtranclp.simps) \n   then have ?thesis using  a7 r step_seq alpha \n     in_alpha Throw_sim_normal[OF a7 r a4 _ a5 a0 ] a00\n     by fastforce\n  }       \n  then show ?thesis using l1 True by auto       \nnext\n  case False \n  then obtain c1'\n    where stepc1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', Normal \\<sigma>n')\" and \n          seq:    \"(c\\<^sub>c',Normal \\<sigma>n')= (Seq c1' c2\\<^sub>c,Normal \\<sigma>n')\"\n    using  SmallStepCon.redex_not_Seq \n           stepc_elim_cases1(5)[OF a8, of \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', Normal \\<sigma>n') \\<and> (c\\<^sub>c',Normal \\<sigma>n')= (Seq c1' c2\\<^sub>c,Normal \\<sigma>n')\"]\n    by fast\n  thus ?thesis \n    using  seq_ev_s stepc1 seq  \n    dest_sim_tau_step[of \\<Gamma>\\<^sub>c c1\\<^sub>c \\<sigma> R\\<^sub>c G\\<^sub>c \\<alpha> \\<gamma>\\<^sub>r \\<gamma>\\<^sub>a \\<Gamma>\\<^sub>s c1\\<^sub>s \\<Sigma> R\\<^sub>s G\\<^sub>s  _ \\<sigma>n', OF a2 stepc1] \n    unfolding RGSim_pre_def by fast    \nqed\n         \n\nlemma Seq_not_normal1:\n  assumes a0:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and\n       a2:\"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and a7:\"\\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\" and\n      a8:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and a8':\" (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\"\n    shows \n  \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n     (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')) \\<and>\n           ( \\<sigma>, \\<sigma>') \\<in> G\\<^sub>c \\<and>\n             ((\\<exists>\\<Sigma> c1\\<^sub>c.\n                  c\\<^sub>c' = LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c \\<and>                  \n                  (\\<exists>c1\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s \\<and>\n                          \\<Sigma>' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                          (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n              (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\"\n   unfolding RGSim_pre_def \nproof(cases \"c1\\<^sub>c = Skip \\<or> (c1\\<^sub>c = Throw \\<and> (\\<exists>\\<sigma>\\<^sub>n. \\<sigma> = Normal \\<sigma>\\<^sub>n))\")\n  case True \n  {assume a00:\"c1\\<^sub>c = Skip\"         \n   then have step_seq:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c2\\<^sub>c,\\<sigma>)\"\n     using SeqSkipc by auto     \n   then have alpha:\"c\\<^sub>c'=c2\\<^sub>c \\<and> \\<sigma>' = \\<sigma>\" using a00\n     by (metis SmallStepCon.stepc_elim_cases(1) a8 prod.inject stepc_elim_cases_Seq_skip(1) stepce_stepc)   \n   then have ?thesis using  a8'   \n     by (metis a0  a2  rtranclp.rtrancl_refl dest_sim_alpha_x sim_not_normal a7)          \n  } note l1=this\n  {assume a00:\"c1\\<^sub>c = Throw \\<and> (\\<exists>\\<sigma>\\<^sub>n. \\<sigma> = Normal \\<sigma>\\<^sub>n)\" \n   then obtain \\<sigma>\\<^sub>n where a00:\"c1\\<^sub>c = Throw \\<and> (\\<sigma> = Normal \\<sigma>\\<^sub>n)\" by auto\n   then have step_seq:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (Throw,\\<sigma>)\"\n     using SeqThrowc by auto\n   then have ?thesis using a8' a8\n     by (metis a00 prod.inject stepc_Normal_elim_cases(11) stepc_Normal_elim_cases(5) stepce_stepc)        \n  }       \n  then show ?thesis using l1 True by auto       \nnext\n  case False   \n  then obtain c1'\n    where stepc1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and \n          seq:    \"(c\\<^sub>c', \\<sigma>')= (Seq c1' c2\\<^sub>c,\\<sigma>')\"\n    using  SmallStepCon.redex_not_Seq a8'\n           stepc_elim_cases1(5)[OF a8, of \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', \\<sigma>') \\<and> (c\\<^sub>c', \\<sigma>')= (Seq c1' c2\\<^sub>c,\\<sigma>')\"]\n    by fast\n  thus ?thesis       \n   using  seq_ev_plus seq_ev_s dest_sim_ev_step_not_normal[OF a2 stepc1] by fast    \nqed\n\nlemma Seq_not_normal2:\n  assumes a0:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and\n       a1:\"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and                           \n       a7:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and a8: \"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and\n       a9:\"e = Some a\"\n     shows \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n               (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                        (\\<exists>aa b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (aa, b) \\<and>\n                                (\\<exists>aaa ba.\n                                    \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some a) (aa, b) \\<rightarrow> (aaa, ba) \\<and>\n                                    \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aaa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')))) \\<and>\n                       (\\<sigma>, \\<sigma>') \\<in> G\\<^sub>c \\<and>\n                       ((\\<exists>\\<Sigma> c1\\<^sub>c.\n                            c\\<^sub>c' = LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c \\<and>\n                            (\\<exists>c1\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s \\<and>\n                                    \\<Sigma>' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                    (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                        (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\"\nproof-\nhave \"c1\\<^sub>c\\<noteq>Skip \\<and> c1\\<^sub>c\\<noteq>Throw\" \n  using not_seq_skip_throw_ev a7 a9 by fastforce  \n  then obtain c1'\n    where stepc1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some a) (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and \n          seq:    \"(c\\<^sub>c',\\<sigma>')= (Seq c1' c2\\<^sub>c,\\<sigma>')\" \n    using a9 a8 stepc_elim_cases1(5)[OF a7, of \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some a) (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', \\<sigma>') \\<and> (c\\<^sub>c',\\<sigma>')= (Seq c1' c2\\<^sub>c,\\<sigma>')\"]\n    by fast    \n then show ?thesis  \n   using  seq_ev_plus seq_ev_s sim_not_normal[OF _ a8 a0 ]  \n          dest_sim_ev_step_not_normal[OF a1 stepc1] by fastforce\nqed\n\nlemma Seq_not_normal:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x \\<Longrightarrow> \\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c  \\<Longrightarrow>\n       (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>                     \n          \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<Longrightarrow>\n          (\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n                 (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                          (\\<exists>v. e = Some v \\<and>\n                               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> \n                         (\\<sigma>, \\<sigma>') \\<in> G\\<^sub>c \\<and>\n                         ((\\<exists>\\<Sigma> c1\\<^sub>c.\n                              c\\<^sub>c' = LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c \\<and>\n                              (\\<exists>c1\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s \\<and>\n                                      \\<Sigma>' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                      (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))))\"\n  apply (cases e, simp)\n   apply (rule Seq_not_normal1, assumption+, blast+) \n  by (drule Seq_not_normal2, assumption+, blast+)\n\n\n lemma Seq_sim:  \n  \"\\<gamma>\\<^sub>a\\<subseteq>\\<alpha> \\<Longrightarrow> R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow> \n   (\\<Gamma>\\<^sub>c,(c1\\<^sub>c,\\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s,\\<Sigma>),R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>\n   (\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow> Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow>\n   \\<forall>sn. (sn, sn)\\<in>G\\<^sub>c \\<Longrightarrow>\n   (\\<Gamma>\\<^sub>c,(LanguageCon.com.Seq c1\\<^sub>c c2\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n   (\\<Gamma>\\<^sub>s,(LanguageCon.com.Seq c1\\<^sub>s c2\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\napply(coinduction arbitrary: \\<sigma> \\<Sigma> c1\\<^sub>c c1\\<^sub>s)\n  apply clarsimp\n   apply (rule conjId)+    \n   apply (rule, rule, rule, rule, rule Seq_not_normal, assumption+)\n    apply (rule, rule, rule, rule env_sim,assumption+)             \n    apply (rule, rule, rule, rule,  rule seq_ev_comp_step,  assumption+)\n      apply (rule, rule, rule, rule seq_no_ev_comp_step, assumption+)       \n    apply (rule dest_sim_alpha,assumption)\n   by (simp add: dest_sim_alpha_x)\n   \n    \n    \n lemma Seq_sound:\n  \"\\<gamma>\\<^sub>a\\<subseteq>\\<alpha> \\<Longrightarrow> Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow>  Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow>   \\<forall>sn. (sn, sn)\\<in>G\\<^sub>c \\<Longrightarrow> R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow>  \n  (\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>r\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c1\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>\n  (\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>\n  (\\<Gamma>\\<^sub>c,Seq c1\\<^sub>c c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,Seq c1\\<^sub>s c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (auto, rule Seq_sim, auto)\n  unfolding RGSim_pre_def by assumption+\n\n  \nlemma catch_no_ev_comp_step:\n  assumes \n   a1:\"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c,\\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s,\\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and\n   a2:\"(\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\" and   \n   a4:\"\\<forall>sn. (sn, sn)\\<in>G\\<^sub>c\" and\n   a5:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Catch c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" and\n   a6:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a7:\"\\<gamma>\\<^sub>n\\<subseteq>\\<alpha>\" and a8:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" \n   shows\n       \"\\<exists>c\\<^sub>s' \\<Sigma>n'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Catch c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                  (\\<sigma>n',\\<Sigma>n') \\<in> \\<alpha> \\<and> (((\\<sigma>,Normal \\<sigma>n'),(\\<Sigma>, Normal \\<Sigma>n')) \\<in> (G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>               \n               ((\\<exists>\\<Sigma> c1\\<^sub>c.\n                    c\\<^sub>c' = LanguageCon.com.Catch c1\\<^sub>c c2\\<^sub>c \\<and>\n                    (\\<exists>c1\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Catch c1\\<^sub>s c2\\<^sub>s \\<and>\n                            Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>)\n                            (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n unfolding RGSim_pre_def \nproof(cases \"c1\\<^sub>c = Skip \\<or> (c1\\<^sub>c = Throw \\<and> (\\<exists>\\<sigma>\\<^sub>n. \\<sigma> = Normal \\<sigma>\\<^sub>n))\")\n  case True \n  {assume a00:\"c1\\<^sub>c = Skip\"         \n   then have step_catch:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Catch c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (Skip,\\<sigma>)\"\n     using CatchSkipc by auto     \n   then have alpha:\"c\\<^sub>c'=Skip \\<and> Normal \\<sigma>n' = \\<sigma>\" using a00\n     by (metis SmallStepCon.stepc_elim_cases(1) a5 prod.inject stepc_elim_cases_Catch_skip(1) stepce_stepc)   \n   have ?thesis\n   proof (cases \"\\<exists>\\<sigma>\\<^sub>n. \\<sigma> = Normal \\<sigma>\\<^sub>n\")\n     case True\n     then obtain \\<sigma>\\<^sub>n where Normal:\"\\<sigma>=Normal \\<sigma>\\<^sub>n\" by auto\n     then obtain s1' where in_alpha:\"((Normal \\<sigma>\\<^sub>n, Normal \\<sigma>\\<^sub>n), \\<Sigma>,Normal s1') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n       \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c1\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal s1')\" and  r:\"(\\<sigma>\\<^sub>n, s1') \\<in> \\<gamma>\\<^sub>n\"       \n         using a00 a1 sim_elim_cases_c(1)[of \\<Gamma>\\<^sub>c \\<sigma> R\\<^sub>c G\\<^sub>c \\<alpha> \\<gamma>\\<^sub>n \\<gamma>\\<^sub>r \\<Gamma>\\<^sub>s c1\\<^sub>s \\<Sigma> R\\<^sub>s G\\<^sub>s ] by blast     \n     then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Catch c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip, Normal s1')\"    \n       using catch_ev_s CatchSkipc in_alpha\n       by (metis (no_types, hide_lams) rtranclp.simps) \n     then show ?thesis using \n       step_catch alpha  Normal in_alpha  Skip_sim_normal[OF a7 r a6 _ a4  a8 ] a00\n       using a7 r by blast             \n   next     \n     case False thus ?thesis using a8 alpha by auto      \n   qed      \n  } note l1=this\n  {assume a00:\"c1\\<^sub>c = Throw \\<and> (\\<exists>\\<sigma>\\<^sub>n. \\<sigma> = Normal \\<sigma>\\<^sub>n)\" \n   then obtain \\<sigma>\\<^sub>n where a00:\"c1\\<^sub>c = Throw \\<and> (\\<sigma> = Normal \\<sigma>\\<^sub>n)\" by auto\n   then have step_seq:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Catch c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c2\\<^sub>c,\\<sigma>)\"\n     using CatchThrowc by auto \n   then have alpha:\"c\\<^sub>c'=c2\\<^sub>c \\<and> Normal \\<sigma>n' = \\<sigma>\" using a00\n              LanguageCon.com.distinct(17) a5 fst_conv \n               stepc_Normal_elim_cases(11) stepc_Normal_elim_cases(12) stepce_stepc\n     by (metis prod.inject)  \n   obtain s1' where in_alpha:\"((Normal \\<sigma>\\<^sub>n, Normal \\<sigma>\\<^sub>n), \\<Sigma>,Normal s1') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c1\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw, Normal s1')\" and r:\"(\\<sigma>\\<^sub>n, s1') \\<in> \\<gamma>\\<^sub>r\"       \n     using a00 a1 sim_elim_cases_c(2)[of \\<Gamma>\\<^sub>c  \\<sigma>\\<^sub>n R\\<^sub>c G\\<^sub>c \\<alpha> \\<gamma>\\<^sub>n \\<gamma>\\<^sub>r \\<Gamma>\\<^sub>s c1\\<^sub>s \\<Sigma> R\\<^sub>s G\\<^sub>s]        \n     by metis \n   then have sim: \"(\\<Gamma>\\<^sub>c,(c2\\<^sub>c, Normal \\<sigma>\\<^sub>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c2\\<^sub>s,  Normal s1'),R\\<^sub>s,G\\<^sub>s)\"\n       using a2 in_alpha a00 unfolding RGSim_pre_def by blast\n   then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Catch c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c2\\<^sub>s, Normal s1')\"       \n     by (meson catch_ev_s in_alpha rtranclp.rtrancl_into_rtrancl stepce.CatchThrowc)\n   then have ?thesis using a00 alpha in_alpha sim_alpha[OF sim] sim by blast \n  }       \n  then show ?thesis using l1 True by auto       \nnext\n  case False \n  then obtain c1'\n    where stepc1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', Normal \\<sigma>n')\" and \n          catch:    \"(c\\<^sub>c',Normal \\<sigma>n')= (Catch c1' c2\\<^sub>c,Normal \\<sigma>n')\"\n    using  SmallStepCon.redex_not_Catch \n           stepc_elim_cases1(12)[OF a5, of \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', Normal \\<sigma>n') \\<and> (c\\<^sub>c',Normal \\<sigma>n')= (Catch c1' c2\\<^sub>c,Normal \\<sigma>n')\"]\n    by fast    \n  thus ?thesis \n    using  catch_ev_s stepc1 catch  \n    dest_sim_tau_step[of \\<Gamma>\\<^sub>c c1\\<^sub>c \\<sigma> R\\<^sub>c G\\<^sub>c \\<alpha> \\<gamma>\\<^sub>n \\<gamma>\\<^sub>r \\<Gamma>\\<^sub>s c1\\<^sub>s \\<Sigma> R\\<^sub>s G\\<^sub>s  _ \\<sigma>n', OF a1 stepc1] \n    unfolding RGSim_pre_def by blast\nqed  \n    \nlemma catch_ev_comp_step:\n  assumes  \n        a0:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and \n       a1:\"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and              \n       a2:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (Catch c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n     shows \"(\\<exists>c\\<^sub>s' \\<Sigma>n'.\n              (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Catch c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                     (\\<exists>aa ba.\n                         \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                         \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n              (\\<sigma>n',\\<Sigma>n') \\<in> \\<alpha> \\<and>\n              (((\\<sigma>, Normal \\<sigma>n'), \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n              ((\\<exists>\\<Sigma> c1\\<^sub>c.\n                   c\\<^sub>c' = Catch c1\\<^sub>c c2\\<^sub>c \\<and>\n                   (\\<exists>c1\\<^sub>s. c\\<^sub>s' = Catch c1\\<^sub>s c2\\<^sub>s \\<and>\n                           Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n               (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\nproof-\n  have \"c1\\<^sub>c\\<noteq>Skip \\<and> c1\\<^sub>c\\<noteq>Throw\" \n    using not_catch_skip_throw_ev a2 by fastforce\n  then obtain c1'\n    where stepc1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', Normal \\<sigma>n')\" and \n          catch:    \"(c\\<^sub>c',Normal \\<sigma>n')= (Catch c1' c2\\<^sub>c,Normal \\<sigma>n')\" \n    using stepc_elim_cases1(12)[OF a2, of \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', Normal \\<sigma>n') \\<and> (c\\<^sub>c',Normal \\<sigma>n')= (Catch c1' c2\\<^sub>c,Normal \\<sigma>n')\"]\n    by fast\n  thus ?thesis \n    using  catch_ev_plus stepc1 catch a0\n    dest_sim_ev_step[OF a1 stepc1] \n    by fast\nqed     \n\nlemma Catch_not_normal1:\n  assumes a0:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and\n       a2:\"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and a7:\"\\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\"  and                      \n      a8:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Catch c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and a8':\" (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\"\n    shows \n  \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n     (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Catch c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')) \\<and> (\\<sigma>, \\<sigma>') \\<in> G\\<^sub>c \\<and>\n             ((\\<exists>\\<Sigma> c1\\<^sub>c.\n                  c\\<^sub>c' = Catch c1\\<^sub>c c2\\<^sub>c \\<and>\n                  (\\<exists>c1\\<^sub>s. c\\<^sub>s' = Catch c1\\<^sub>s c2\\<^sub>s \\<and>\n                          \\<Sigma>' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>)\n                          (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n              (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\"\n   unfolding RGSim_pre_def \nproof(cases \"c1\\<^sub>c = Skip \\<or> (c1\\<^sub>c = Throw \\<and> (\\<exists>\\<sigma>\\<^sub>n. \\<sigma> = Normal \\<sigma>\\<^sub>n))\")\n  case True \n  {assume a00:\"c1\\<^sub>c = Skip\"         \n   then have step_seq:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Catch c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (Skip,\\<sigma>)\"\n     using CatchSkipc by auto     \n   then have alpha:\"c\\<^sub>c'=Skip \\<and> \\<sigma>' = \\<sigma>\" using a00 \n     by (metis SmallStepCon.stepc_elim_cases(1) a8 prod.inject stepc_elim_cases_Catch_skip(1) stepce_stepc)   \n   then have ?thesis using  a8'   \n     by (metis a0  a2  rtranclp.rtrancl_refl dest_sim_alpha_x sim_not_normal a7)          \n  } note l1=this\n  {assume a00:\"c1\\<^sub>c = Throw \\<and> (\\<exists>\\<sigma>\\<^sub>n. \\<sigma> = Normal \\<sigma>\\<^sub>n)\" \n   then obtain \\<sigma>\\<^sub>n where a00:\"c1\\<^sub>c = Throw \\<and> (\\<sigma> = Normal \\<sigma>\\<^sub>n)\" by auto\n   then have step_seq:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Catch c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c2\\<^sub>c,\\<sigma>)\"\n     using CatchThrowc by auto\n   then have ?thesis using a8' a8\n     by (metis a00 prod.inject stepc_Normal_elim_cases(11) stepc_Normal_elim_cases(12) stepce_stepc)            \n  }       \n  then show ?thesis using l1 True by auto       \nnext\n  case False   \n  then obtain c1'\n    where stepc1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and \n          seq:    \"(c\\<^sub>c', \\<sigma>')= (Catch c1' c2\\<^sub>c,\\<sigma>')\"\n    using  SmallStepCon.redex_not_Catch a8'\n           stepc_elim_cases1(12)[OF a8, of \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', \\<sigma>') \\<and> (c\\<^sub>c', \\<sigma>')= (Catch c1' c2\\<^sub>c,\\<sigma>')\"]\n    by fast\n  thus ?thesis       \n   using  catch_ev_plus catch_ev_s  \n          dest_sim_ev_step_not_normal[OF a2 stepc1] by fast    \nqed\n\nlemma Catch_not_normal2:\n  assumes a0:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and\n       a1:\"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and              \n       a7:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Catch c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and a8: \"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and\n       a9:\"e = Some a\"\n     shows \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n               (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Catch c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                        (\\<exists>aa b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Catch c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (aa, b) \\<and>\n                                (\\<exists>aaa ba.\n                                    \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some a) (aa, b) \\<rightarrow> (aaa, ba) \\<and>\n                                    \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aaa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')))) \\<and> (\\<sigma>, \\<sigma>') \\<in> G\\<^sub>c \\<and>\n                       ((\\<exists>\\<Sigma> c1\\<^sub>c.\n                            c\\<^sub>c' = LanguageCon.com.Catch c1\\<^sub>c c2\\<^sub>c \\<and>\n                            (\\<exists>c1\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Catch c1\\<^sub>s c2\\<^sub>s \\<and>\n                                    \\<Sigma>' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>)\n                                    (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                        (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\"\nproof-\nhave \"c1\\<^sub>c\\<noteq>Skip \\<and> c1\\<^sub>c\\<noteq>Throw\" \n  using not_catch_skip_throw_ev a7 a9 by fastforce  \n  then obtain c1'\n    where stepc1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some a) (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and \n          seq:    \"(c\\<^sub>c',\\<sigma>')= (Catch c1' c2\\<^sub>c,\\<sigma>')\" \n    using a9 a8 stepc_elim_cases1(12)[OF a7, of \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some a) (c1\\<^sub>c, \\<sigma>) \\<rightarrow> (c1', \\<sigma>') \\<and> (c\\<^sub>c',\\<sigma>')= (Catch c1' c2\\<^sub>c,\\<sigma>')\"]\n    by fast    \n then show ?thesis  \n   using  catch_ev_plus catch_ev_s   \n          dest_sim_ev_step_not_normal[OF a1 stepc1] by fastforce\nqed\n\nlemma Catch_not_normal:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x \\<Longrightarrow> \\<forall>\\<sigma>.(\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c \\<Longrightarrow>\n       (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>              \n          \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (Catch c1\\<^sub>c c2\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<Longrightarrow>\n          (\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n                 (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Catch c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                          (\\<exists>v. e = Some v \\<and>\n                               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Catch c1\\<^sub>s c2\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (\\<sigma>, \\<sigma>') \\<in> G\\<^sub>c \\<and>\n                         ((\\<exists>\\<Sigma> c1\\<^sub>c.\n                              c\\<^sub>c' = Catch c1\\<^sub>c c2\\<^sub>c \\<and>\n                              (\\<exists>c1\\<^sub>s. c\\<^sub>s' = Catch c1\\<^sub>s c2\\<^sub>s \\<and>\n                                      \\<Sigma>' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c1\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>)\n                                      (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))))\"\n  apply (cases e, simp)\n   apply (rule Catch_not_normal1, assumption+, blast+) \n  by (drule Catch_not_normal2, assumption+, blast+)\n\n\n  \n lemma Catch_sim:  \n  \"\\<gamma>\\<^sub>n\\<subseteq>\\<alpha> \\<Longrightarrow> R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow> \n   (\\<Gamma>\\<^sub>c,(c1\\<^sub>c,\\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s,\\<Sigma>),R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>\n   (\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow> Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow>   \n   \\<forall>sn. (sn,  sn)\\<in>G\\<^sub>c \\<Longrightarrow>\n   (\\<Gamma>\\<^sub>c,(Catch c1\\<^sub>c c2\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n   (\\<Gamma>\\<^sub>s,(Catch c1\\<^sub>s c2\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\napply(coinduction arbitrary: \\<sigma> \\<Sigma> c1\\<^sub>c c1\\<^sub>s)\n  apply clarsimp\n   apply (rule conjId)+    \n   apply (rule, rule, rule, rule, rule Catch_not_normal, assumption+)\n    apply (rule, rule, rule, rule env_sim,assumption+)             \n    apply (rule, rule, rule, rule, rule catch_ev_comp_step,  assumption+)\n   apply (rule, rule, rule, rule catch_no_ev_comp_step , assumption+)    \n    apply (rule dest_sim_alpha,assumption)\n by (simp add: dest_sim_alpha_x)\n    \nlemma Catch_sound:\n  \"\\<xi> \\<subseteq> \\<alpha> \\<and> \\<gamma>\\<^sub>n\\<subseteq>\\<alpha> \\<Longrightarrow> Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow>  \\<forall>sn. (sn, sn)\\<in>G\\<^sub>c \\<Longrightarrow> R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow> \n  (\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>) (\\<Gamma>\\<^sub>s,c1\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>\n  (\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>r\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow> Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow> \n  (\\<Gamma>\\<^sub>c,Catch c1\\<^sub>c c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,Catch c1\\<^sub>s c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (auto, rule Catch_sim, auto)\n  unfolding RGSim_pre_def by assumption+\n    \nlemma env:\n  assumes \n    a1: \"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and\n    a2: \"Sta\\<^sub>s \\<xi> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and \n    a4:\"\\<forall>sn. (sn, sn) \\<in> G\\<^sub>c\" and\n   a5:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x \" and\n    a3:\"(((Normal \\<sigma>n, \\<sigma>'), Normal \\<Sigma>n, \\<Sigma>') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>',\\<Sigma>')\\<in>\\<alpha>\\<^sub>x\"\n  shows\"(\\<exists>\\<sigma>n' \\<Sigma>n'. \\<sigma>' = Normal \\<sigma>n' \\<and> \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi>)\\<or>\n        (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s,\\<Sigma>'),R\\<^sub>s,G\\<^sub>s) \"\n  using sim_env[OF a1 a2 a4 a5 a3] by fastforce\n \n \nlemma If_sim:\n  assumes \n  a1:\"\\<xi> \\<subseteq> \\<alpha>\" and \n  a2:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and \n  a3:\"(\\<forall>s. (s, s)\\<in>G\\<^sub>c)\" and  a3':\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and\n  a5:\"\\<xi> \\<subseteq> (b\\<^sub>c \\<rightleftharpoons> b\\<^sub>s)\" and a6:\"\\<xi>\\<^sub>1 = \\<xi> \\<inter> (b\\<^sub>c \\<odot> b\\<^sub>s)\" and \n  a7:\"\\<xi>\\<^sub>2 = \\<xi> \\<inter> ((-b\\<^sub>c) \\<odot> (-b\\<^sub>s) )\" and  \n  a8:\"(\\<sigma>,\\<Sigma>)\\<in>\\<xi>\" and\n  a9:\"(\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c1\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\" and \n  a10:\"(\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>2\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\nshows  \n  \"(\\<Gamma>\\<^sub>c,(Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s,Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\nusing  a1 a2 a3  a5 a6 a7  a8 a9 a10\n  apply(coinduction arbitrary: \\<sigma> \\<Sigma>)   \nproof(clarsimp)\n    fix \\<sigma>n \\<Sigma>n\n    assume \n       a0:\"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and              \n       a3:\"Sta\\<^sub>s \\<xi> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and                            \n       a8:\"\\<xi> \\<subseteq> \\<alpha>\" and                     \n       a13:\"(\\<forall>s. (s, s)\\<in>G\\<^sub>c)\"     \n    have \"(\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>\" using a0 a8 by fastforce\n    moreover have \"(Normal \\<sigma>n, Normal \\<Sigma>n) \\<in> \\<alpha>\\<^sub>x\" unfolding alpha_xstate_def by auto \n    moreover have \"\\<forall>\\<sigma>' \\<Sigma>'.\n           (((Normal \\<sigma>n, \\<sigma>'), Normal \\<Sigma>n, \\<Sigma>') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>  (\\<sigma>',\\<Sigma>')\\<in>\\<alpha>\\<^sub>x  \\<longrightarrow>\n           (\\<exists>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n' \\<and> (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi>)) \\<or>\n           (\\<Gamma>\\<^sub>c,(Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n           (\\<Gamma>\\<^sub>s,(Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\" \n      using env[OF a0 a3 a13 a3'] by blast\n    moreover have \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c \\<and>\n                c\\<^sub>s' = LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\n      by (metis CRef.stepc_elim_cases(10) CRef.stepc_elim_cases(9) \n               option.distinct(1) stepc_Normal_elim_cases(6) stepce_stepc) \n    moreover have \"\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c \\<and>\n                c\\<^sub>s' = LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\n    proof -\n      {fix c\\<^sub>c' \\<sigma>n'\n        assume  a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n        then have eqs:\"\\<sigma>n = \\<sigma>n'\"\n          using stepc_elim_cases2(1) by fastforce \n        have guar:\"((Normal \\<sigma>n, Normal \\<sigma>n), Normal \\<Sigma>n, Normal \\<Sigma>n) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\"\n        using  a13 a0 a8  unfolding related_transitions_def Id_def by auto\n       have h:\"(c\\<^sub>c'=c1\\<^sub>c \\<and> \\<sigma>n'\\<in>b\\<^sub>c) \\<or> (c\\<^sub>c'=c2\\<^sub>c \\<and> \\<sigma>n'\\<in> -b\\<^sub>c)\"  \n        using stepc_elim_cases2(1)[OF a00] by auto\n        {\n          assume c:\"c\\<^sub>c' = c1\\<^sub>c \\<and> \\<sigma>n' \\<in> b\\<^sub>c\"\n          then have sig1:\"(\\<sigma>n',  \\<Sigma>n) \\<in> \\<xi>\\<^sub>1\"\n            using a0 a5 a6 a7 eqs unfolding eq_rel_def ToNorm_def and_rel_def by auto\n          then have sn_inb:\"\\<Sigma>n\\<in>b\\<^sub>s\" using a6 unfolding and_rel_def by auto\n          then have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c1\\<^sub>s, Normal \\<Sigma>n)\"          \n            by (simp add: sn_inb r_into_rtranclp stepce.CondTruec)        \n          have x:\"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c, Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, Normal \\<Sigma>n),R\\<^sub>s,G\\<^sub>s)\" \n            using a9  sig1\n            unfolding RGSim_pre_def by auto\n          note l = conjI[OF x steps]\n        } note l=this        \n        {\n          assume c:\"c\\<^sub>c' = c2\\<^sub>c \\<and> \\<sigma>n' \\<in> -b\\<^sub>c\"\n          then have sig1:\"(\\<sigma>n', \\<Sigma>n) \\<in> \\<xi>\\<^sub>2\"\n            using a0 a5 a6 a7 eqs unfolding eq_rel_def ToNorm_def and_rel_def by auto\n          then have sn_inb:\"\\<Sigma>n\\<in>-b\\<^sub>s\" using a7 unfolding and_rel_def by auto\n          then have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c2\\<^sub>s, Normal \\<Sigma>n)\"          \n            by (simp add: sn_inb r_into_rtranclp stepce.CondFalsec)        \n          have x:\"(\\<Gamma>\\<^sub>c,(c2\\<^sub>c, Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c2\\<^sub>s, Normal \\<Sigma>n),R\\<^sub>s,G\\<^sub>s)\" \n            using a10  sig1\n            unfolding RGSim_pre_def by auto\n          note l = conjI[OF x steps]\n        } \n        then have \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c \\<and>\n                c\\<^sub>s' = LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\" \n          using guar l h  eqs calculation(1) by auto  \n       } thus ?thesis by auto\n     qed\n     moreover have\"\\<forall>\\<sigma>'' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and> \n                   (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                            (\\<exists>v. e = Some v \\<and>\n                                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'')))))  \\<and> \n                   (Normal \\<sigma>n, \\<sigma>'')\\<in> G\\<^sub>c \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))\"\n      by (meson prod.inject stepc_elim_cases2(1))\n    ultimately show \"(Normal \\<sigma>n, Normal \\<Sigma>n) \\<in> \\<alpha>\\<^sub>x \\<and>\n       (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha> \\<and>\n       (\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c \\<and>\n                c\\<^sub>s' = LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c \\<and>\n                c\\<^sub>s' = LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>\\<sigma>'' \\<Sigma>''.\n           (((Normal \\<sigma>n, \\<sigma>''), Normal \\<Sigma>n, \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)  \\<and>  (\\<sigma>'',\\<Sigma>'')\\<in>\\<alpha>\\<^sub>x \\<longrightarrow>\n           (\\<exists>\\<sigma>. \\<sigma>'' = Normal \\<sigma> \\<and> (\\<exists>\\<Sigma>. \\<Sigma>'' = Normal \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<xi>)) \\<or>\n           (\\<Gamma>\\<^sub>c,(LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n           (\\<Gamma>\\<^sub>s,(LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)) \\<and>\n       (\\<forall>\\<sigma>'' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                   (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                            (\\<exists>v. e = Some v \\<and>\n                                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and>\n                    (Normal \\<sigma>n, \\<sigma>'')\\<in> G\\<^sub>c \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s))))\" \n      by auto\n  qed    \n\n\n \nlemma If_sound:\n  \"\\<xi> \\<subseteq> \\<alpha>  \\<Longrightarrow> Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow> \\<forall>s. (s, s)\\<in>G\\<^sub>c  \\<Longrightarrow> R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x \\<Longrightarrow>\n   \\<xi> \\<subseteq> (b\\<^sub>c \\<rightleftharpoons> b\\<^sub>s) \\<Longrightarrow> \\<xi>\\<^sub>1= \\<xi> \\<inter> (b\\<^sub>c \\<odot> b\\<^sub>s) \\<Longrightarrow> \\<xi>\\<^sub>2= \\<xi> \\<inter> ((-b\\<^sub>c) \\<odot> (-b\\<^sub>s) ) \\<Longrightarrow>\n  (\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c1\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow> \n  (\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>2\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow> \n  (\\<Gamma>\\<^sub>c,Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,Cond b\\<^sub>s c1\\<^sub>s c2\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (auto,rule If_sim, auto)\n  unfolding RGSim_pre_def by blast+\n\ndefinition coPre ::\"('b \\<times> 'e) set \\<Rightarrow>  \n 'b set \\<Rightarrow> 'e set \\<Rightarrow> ('a \\<Rightarrow> ('b, 'a, 'c, 'd) LanguageCon.com option) \\<Rightarrow>  \n  ('b, 'a, 'c, 'd) LanguageCon.com\n     \\<Rightarrow> (('b, 'c) xstate \\<times> ('b, 'c) xstate) set\n        \\<Rightarrow> (('b, 'c) xstate \\<times> ('b, 'c) xstate) set\n           \\<Rightarrow> ('b \\<times> 'e) set\n              \\<Rightarrow> ('b \\<times> 'e) set\n                 \\<Rightarrow> ('b \\<times> 'e) set\n                    \\<Rightarrow> ('a \\<Rightarrow> ('e, 'a, 'c, 'd) LanguageCon.com option)\n                       \\<Rightarrow> ('e, 'a, 'c, 'd) LanguageCon.com \\<Rightarrow> \n                           (('e, 'c) xstate \\<times> ('e, 'c) xstate) set\n                             \\<Rightarrow> (('e, 'c) xstate \\<times> ('e, 'c) xstate) set \\<Rightarrow> ('a \\<Rightarrow> ('b, 'a, 'c, 'd) LanguageCon.com option)\n  \\<Rightarrow> ('b, 'a, 'c, 'd) LanguageCon.com \\<times> ('b, 'c) xstate\n     \\<Rightarrow> (('b, 'c) xstate \\<times> ('b, 'c) xstate) set\n        \\<Rightarrow> (('b, 'c) xstate \\<times> ('b, 'c) xstate) set\n           \\<Rightarrow> ('b \\<times> 'e) set\n              \\<Rightarrow> ('b \\<times> 'e) set\n                 \\<Rightarrow> ('b \\<times> 'e) set\n                    \\<Rightarrow> ('a \\<Rightarrow> ('e, 'a, 'c, 'd) LanguageCon.com option)\n                       \\<Rightarrow> ('e, 'a, 'c, 'd) LanguageCon.com \\<times>\n                          ('e, 'c) xstate\n                          \\<Rightarrow> (('e, 'c) xstate \\<times> ('e, 'c) xstate) set\n                             \\<Rightarrow> (('e, 'c) xstate \\<times> ('e, 'c) xstate) set \\<Rightarrow> bool\"\nwhere \n\"coPre \\<xi> b\\<^sub>c b\\<^sub>s \\<Gamma>\\<^sub>c c1\\<^sub>c R\\<^sub>c G\\<^sub>c \\<alpha> \\<gamma>\\<^sub>n \\<gamma>\\<^sub>a \\<Gamma>\\<^sub>s c1\\<^sub>s R\\<^sub>s G\\<^sub>s \\<Gamma>\\<^sub>c' csc R\\<^sub>c' G\\<^sub>c' \\<alpha>' \\<gamma>\\<^sub>n' \\<gamma>\\<^sub>a' \\<Gamma>\\<^sub>s' css R\\<^sub>s' G\\<^sub>s' \\<equiv>\n \\<exists>\\<sigma> \\<Sigma> c\\<^sub>c c\\<^sub>s.\n   \\<Gamma>\\<^sub>c' = \\<Gamma>\\<^sub>c \\<and>\n   ( (csc = (LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c),  \\<sigma>) \\<and> \n      css = (LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s),  \\<Sigma>) \\<and>      \n     (\\<Gamma>\\<^sub>c,(c\\<^sub>c,  \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s,  \\<Sigma>),R\\<^sub>s,G\\<^sub>s)) \\<or>     \n    (\\<exists>\\<sigma>n \\<Sigma>n. (csc = (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c,Normal \\<sigma>n) \\<and> \n     css = (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s, Normal \\<Sigma>n) \\<and> (\\<sigma>n,\\<Sigma>n) \\<in>\\<xi> \\<and> \\<sigma> = Normal \\<sigma>n \\<and> \\<Sigma> = Normal \\<Sigma>n)) \\<or>\n    (\\<exists>\\<sigma>n \\<Sigma>n. csc = (Skip, Normal \\<sigma>n) \\<and> \n     css = (Skip, Normal \\<Sigma>n) \\<and> (\\<sigma>n,\\<Sigma>n) \\<in>\\<xi> \\<and> \\<sigma>n\\<in> (- b\\<^sub>c)  \\<and> \\<sigma> = Normal \\<sigma>n \\<and> \\<Sigma> = Normal \\<Sigma>n)  \\<or>\n    (\\<exists>\\<sigma>n \\<Sigma>n. csc = (Throw,Normal \\<sigma>n) \\<and> \n     css = (Throw,Normal \\<Sigma>n) \\<and> (\\<sigma>n,\\<Sigma>n) \\<in>\\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n \\<and> \\<Sigma> = Normal \\<Sigma>n ) \\<or> \n     (csc = (Skip, \\<sigma>) \\<and> css=(Skip, \\<Sigma>) \\<and> (\\<sigma>,\\<Sigma>)\\<in>\\<alpha>\\<^sub>x) \\<and> (\\<forall>\\<sigma>n. \\<sigma>\\<noteq>Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n) ) \\<and>\n   R\\<^sub>c' = R\\<^sub>c \\<and> G\\<^sub>c' = G\\<^sub>c \\<and> \\<alpha>' = \\<alpha> \\<and> \\<gamma>\\<^sub>n' = \\<gamma>\\<^sub>n \\<and> \\<gamma>\\<^sub>a' = \\<gamma>\\<^sub>a \\<and> \\<Gamma>\\<^sub>s' = \\<Gamma>\\<^sub>s \\<and> R\\<^sub>s' = R\\<^sub>s \\<and> G\\<^sub>s' = G\\<^sub>s \"\n\nlemma while_seq_alpha_x:\n  \"  \\<xi> \\<subseteq> \\<alpha> \\<Longrightarrow> \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<Longrightarrow> \n     (\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Skip \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Throw \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Throw \\<and> (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       b = \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and> ba = \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma>' \\<noteq> Normal \\<Sigma>n)  \\<Longrightarrow> \n (b, ba) \\<in> \\<alpha>\\<^sub>x \" \n   apply auto  using dest_sim_alpha_x apply fast unfolding alpha_xstate_def by auto\n  \n\nlemma while_seq_alpha:\n  \"  \\<xi> \\<subseteq> \\<alpha> \\<Longrightarrow> \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<Longrightarrow> \n      (\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Skip \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Throw \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Throw \\<and> (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       b = \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and> ba = \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma>' \\<noteq> Normal \\<Sigma>n)  \\<Longrightarrow> \n \\<forall>\\<sigma>n. b = Normal \\<sigma>n \\<longrightarrow> (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>)\"\n  using dest_sim_alpha\n  by blast\n\nlemma while_seq_no_ev1':\nassumes              \n       a14:\"(\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              Normal \\<sigma>n = b \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                    Normal \\<Sigma>n = ba \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, b),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, ba),R\\<^sub>s,G\\<^sub>s)))\" and\n       a15:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (a, b) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" \n   shows \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n         \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n         (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n         (((b, Normal \\<sigma>n'), ba, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n         ((\\<exists>\\<sigma>n1' \\<Sigma>n1'. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                         \\<sigma>n' = \\<sigma>n1' \\<and>\n                         (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                \\<Sigma>n' = \\<Sigma>n1' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, Normal \\<sigma>n1'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>n1'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                  c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                  \\<sigma>n' = \\<sigma>n1' \\<and> c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> \\<Sigma>n' = \\<Sigma>n1' \\<and> (\\<sigma>n1', \\<Sigma>n1') \\<in> \\<xi> \\<or>\n                  c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                  \\<sigma>n' = \\<sigma>n1' \\<and> c\\<^sub>s' = LanguageCon.com.Skip \\<and> \\<Sigma>n' = \\<Sigma>n1' \\<and> (\\<sigma>n1', \\<Sigma>n1') \\<in> \\<xi> \\<and> \\<sigma>n1' \\<notin> b\\<^sub>c \\<or>\n                  c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                  \\<sigma>n' = \\<sigma>n1' \\<and> c\\<^sub>s' = LanguageCon.com.Throw \\<and> \\<Sigma>n' = \\<Sigma>n1' \\<and> (\\<sigma>n1', \\<Sigma>n1') \\<in> \\<gamma>\\<^sub>a) \\<or>\n          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n     using a14 \nproof -\n  obtain c\\<^sub>c c\\<^sub>s where \n    a14:\"a = Seq c\\<^sub>c (While b\\<^sub>c c1\\<^sub>c) \\<and> b = Normal \\<sigma>n \\<and> \n         aa = Seq c\\<^sub>s (While b\\<^sub>s c1\\<^sub>s) \\<and>\n         ba = Normal \\<Sigma>n \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, Normal \\<sigma>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>n),R\\<^sub>s,G\\<^sub>s)\" \n    using a14 by auto\n  then have a14a:\"Seq c\\<^sub>c (While b\\<^sub>c c1\\<^sub>c) = a\" and a14b:\"Normal \\<sigma>n = b\" and \n            a14c:\"aa=Seq c\\<^sub>s (While b\\<^sub>s c1\\<^sub>s)\" and a14d:\"ba=Normal \\<Sigma>n\" and \n            a14e:\"(\\<Gamma>\\<^sub>c,(c\\<^sub>c, Normal \\<sigma>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>n),R\\<^sub>s,G\\<^sub>s)\" and \n            a15:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq c\\<^sub>c (While b\\<^sub>c c1\\<^sub>c), Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" using a15 by auto\n  thus ?thesis \n  proof (cases \"c\\<^sub>c = Skip \\<or> c\\<^sub>c = Throw\")\n    case True\n    {assume a00:\"c\\<^sub>c = Skip\"\n      then have step_seq:\n        \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq c\\<^sub>c (While b\\<^sub>c c1\\<^sub>c), Normal \\<sigma>n) \\<rightarrow> ((While b\\<^sub>c c1\\<^sub>c),Normal \\<sigma>n)\"\n        using SeqSkipc by auto\n      then have alpha:\"c\\<^sub>c'= (While b\\<^sub>c c1\\<^sub>c) \\<and> \\<sigma>n' = \\<sigma>n\" using a00 a14  a15\n        by (meson SmallStepCon.stepc_elim_cases(1) prod.inject stepc_elim_cases_Seq_skip(1) stepce_stepc xstate.inject(1))         \n      have ?thesis \n      proof -        \n       obtain s1' where \n           in_alpha:\"((Normal \\<sigma>n, Normal \\<sigma>n), Normal \\<Sigma>n,Normal s1') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip, Normal s1') \\<and> \n                     (\\<sigma>n, s1') \\<in> \\<xi>\"       \n          using a00 a14 sim_elim_cases_c(1)[of \\<Gamma>\\<^sub>c \"Normal \\<sigma>n\" R\\<^sub>c G\\<^sub>c \\<alpha> \\<xi> \\<gamma>\\<^sub>a \\<Gamma>\\<^sub>s c\\<^sub>s \"Normal \\<Sigma>n\" R\\<^sub>s G\\<^sub>s ] by auto\n         then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq c\\<^sub>s (While b\\<^sub>s c1\\<^sub>s), Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* ((While b\\<^sub>s c1\\<^sub>s), Normal s1')\"    \n           using seq_ev_s SeqSkipc in_alpha\n           by (metis (no_types, hide_lams) rtranclp.simps)          \n         then show ?thesis using in_alpha  alpha  a14  \n           unfolding related_transitions_def by blast        \n      qed        \n    } note l1=this  \n    {\n      assume a00:\"c\\<^sub>c = Throw\"      \n      then have step_seq:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq c\\<^sub>c (While b\\<^sub>c c1\\<^sub>c),Normal \\<sigma>n) \\<rightarrow> (Throw,Normal \\<sigma>n)\"\n        using SeqThrowc by auto          \n      then have alpha:\"c\\<^sub>c'=Throw \\<and> \\<sigma>n' = \\<sigma>n\" using a00 a14 a15\n        by (metis LanguageCon.com.distinct(17) prod.inject stepc_Normal_elim_cases(11) stepc_Normal_elim_cases(5) stepce_stepc xstate.inject(1))          \n      then obtain s1' where in_alpha:\"((Normal \\<sigma>n, Normal \\<sigma>n), Normal \\<Sigma>n,Normal s1') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw, Normal s1')\" and r:\"(\\<sigma>n, s1') \\<in> \\<gamma>\\<^sub>a\"               \n        using a00 a14 sim_elim_cases_c(2)[of \\<Gamma>\\<^sub>c  \\<sigma>n R\\<^sub>c G\\<^sub>c \\<alpha> \\<xi> \\<gamma>\\<^sub>a \\<Gamma>\\<^sub>s c\\<^sub>s \"Normal \\<Sigma>n\" R\\<^sub>s G\\<^sub>s]                  \n        by blast           \n      then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq c\\<^sub>s (While b\\<^sub>s c1\\<^sub>s), Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw, Normal s1')\"         \n        using seq_ev_s SeqThrowc            \n        by (metis (no_types, hide_lams) rtranclp.simps)           \n      then have ?thesis\n        using a14 alpha in_alpha r unfolding related_transitions_def  by blast           \n    }  \n    thus ?thesis using l1 True by auto\n  next\n    case False       \n    then obtain c\\<^sub>c1' \n    where stepc1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c1', Normal \\<sigma>n')\" and \n          seq:    \"(c\\<^sub>c', Normal \\<sigma>n')= (Seq c\\<^sub>c1' (While b\\<^sub>c c1\\<^sub>c),Normal \\<sigma>n')\"\n    using  SmallStepCon.redex_not_Seq \n           stepc_elim_cases1(5)[OF a15, \n             of \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c1', Normal \\<sigma>n') \\<and> (c\\<^sub>c', Normal \\<sigma>n')= (Seq c\\<^sub>c1' (While b\\<^sub>c c1\\<^sub>c),Normal \\<sigma>n')\"]\n    by fastforce\n  thus ?thesis \n    using  seq_ev_s stepc1 seq a14 \n    dest_sim_tau_step[of \\<Gamma>\\<^sub>c c\\<^sub>c \"Normal \\<sigma>n\" R\\<^sub>c G\\<^sub>c \\<alpha> \\<xi> \\<gamma>\\<^sub>a \\<Gamma>\\<^sub>s c\\<^sub>s \"Normal \\<Sigma>n\" R\\<^sub>s G\\<^sub>s  _ \" \\<sigma>n'\", OF a14e stepc1] \n    unfolding RGSim_pre_def by blast      \n  qed        \nqed    \n\nlemma while_seq_no_ev1: \n  assumes a0:\"(\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\" and\n a1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (a, b) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" and\n a2:\"b= Normal \\<sigma> \\<and> ba=Normal \\<Sigma>\"\nshows\"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((b, Normal \\<sigma>n'), ba, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                          Normal \\<sigma>n' = \\<sigma> \\<and>\n                          (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                 Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                   c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                   c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   Normal \\<sigma>n' = \\<sigma> \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nusing a0  while_seq_no_ev1'[OF a0[simplified a2]] a1 by fastforce\n\n\nlemma while_seq_no_ev2':\n  assumes \n  a0:\"(\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c1\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\" and    \n  a3:\"\\<xi> \\<subseteq> \\<alpha>\" and      \n  a9:\"\\<xi> \\<subseteq> b\\<^sub>c \\<rightleftharpoons>  b\\<^sub>s\" and\n  a10:\"\\<xi>\\<^sub>1 = \\<xi> \\<inter> b\\<^sub>c \\<odot>  b\\<^sub>s\" and\n  a13:\"\\<forall>sn. (sn, sn)\\<in>G\\<^sub>c\" and\n  a14:\"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and\n  a15:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (While b\\<^sub>c c1\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n  shows \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n         \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (While b\\<^sub>s c1\\<^sub>s,  Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n         (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n         (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n         ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                         \\<sigma>n' = \\<sigma> \\<and>\n                         (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                  c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                  \\<sigma>n' = \\<sigma> \\<and> c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<xi> \\<or>\n                  c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                  \\<sigma>n' = \\<sigma> \\<and> c\\<^sub>s' = LanguageCon.com.Skip \\<and> \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<xi> \\<and> \\<sigma> \\<notin> b\\<^sub>c \\<or>\n                  c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                  \\<sigma>n' = \\<sigma> \\<and> c\\<^sub>s' = LanguageCon.com.Throw \\<and> \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<gamma>\\<^sub>a) \\<or>\n          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof-        \n  {\n    assume sigb:\"\\<sigma>n \\<in> b\\<^sub>c\" \n    then have s1c1:\"\\<sigma>n' =  \\<sigma>n \\<and> c\\<^sub>c' = Seq c1\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c)\"\n      using dest_while a15  by fastforce\n    moreover have Sigb:\"\\<Sigma>n \\<in> b\\<^sub>s\" using calculation sigb same_set a14 a9  by fastforce\n    ultimately have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Seq c1\\<^sub>s (While b\\<^sub>s c1\\<^sub>s), Normal \\<Sigma>n)\"  \n      by (simp add: r_into_rtranclp stepce.WhileTruec) \n    moreover have \"((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n      using a14 a13 s1c1 a3  unfolding related_transitions_def by auto\n    moreover have \"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c, Normal \\<sigma>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1\\<^sub>s, Normal \\<Sigma>n),R\\<^sub>s,G\\<^sub>s)\"\n      using sigb Sigb a14 a0 a10   unfolding RGSim_pre_def and_rel_def by blast\n    ultimately have ?thesis using s1c1  unfolding related_transitions_def by blast  \n  } \n  moreover {    \n    assume a00: \"\\<sigma>n \\<in> -b\\<^sub>c\" \n    then have ?thesis    \n    proof -      \n      have f5:\"(\\<sigma>n,\\<Sigma>n)\\<in>\\<alpha>\" \n        using a14  a3 by force      \n      then have f4: \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow> (LanguageCon.com.Skip, Normal \\<Sigma>n)\"\n        by (meson Compl_iff \\<open>\\<sigma>n \\<in> - b\\<^sub>c\\<close> stepce.WhileFalsec a14 a9 same_set)\n      have f6: \"Normal \\<sigma>n' = Normal \\<sigma>n \\<and> \n               (\\<sigma>n \\<in> - b\\<^sub>c \\<and> c\\<^sub>c' = LanguageCon.com.Skip \\<or> \n                \\<sigma>n \\<in> b\\<^sub>c \\<and> c\\<^sub>c' = LanguageCon.com.Seq c1\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c))\"\n        using a15 dest_while\n        by fastforce\n      then have \"((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\"\n        using f5  by (simp add:  a13 related_transitions_def)\n      then show ?thesis\n        using a14 f6 f4 a00 unfolding related_transitions_def\n        by auto \n    qed      \n  }\n  ultimately show ?thesis by auto\nqed\n\nlemma while_seq_no_ev2:\n  assumes \n  a0:\"(\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c1\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\" and    \n  a3:\"\\<xi> \\<subseteq> \\<alpha>\" and      \n  a9:\"\\<xi> \\<subseteq> b\\<^sub>c \\<rightleftharpoons>  b\\<^sub>s\" and\n  a10:\"\\<xi>\\<^sub>1 = \\<xi> \\<inter> b\\<^sub>c \\<odot>  b\\<^sub>s\" and\n  a13:\"\\<forall>sn. (sn, sn)\\<in>G\\<^sub>c\" and\n  a14:\"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and\n  a15:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (While b\\<^sub>c c1\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n  shows \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n         \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (While b\\<^sub>s c1\\<^sub>s,  Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n         (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n         (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n         ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                         \\<sigma>n' = \\<sigma> \\<and>\n                         (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                  c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                  \\<sigma>n' = \\<sigma> \\<and> c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<xi> \\<or>\n                  c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                  \\<sigma>n' = \\<sigma> \\<and> c\\<^sub>s' = LanguageCon.com.Skip \\<and> \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<xi> \\<and> \\<sigma> \\<notin> b\\<^sub>c \\<or>\n                  c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                  \\<sigma>n' = \\<sigma> \\<and> c\\<^sub>s' = LanguageCon.com.Throw \\<and> \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<gamma>\\<^sub>a) \\<or>\n          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n  using while_seq_no_ev2'[OF a0 a3 a9 a10 a13 a14 a15] by auto\n\n  lemma while_seq_no_ev3:\n\"a = LanguageCon.com.Skip \\<and>\n b = Normal \\<sigma>n \\<and>\n aa = LanguageCon.com.Skip \\<and>\n ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>  \\<and> (\\<sigma>n \\<notin> b\\<^sub>c) \\<Longrightarrow>\n \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (a, b) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<Longrightarrow>\n     \\<exists>c\\<^sub>s' \\<Sigma>n'.\n         \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n         (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n         (((b, Normal \\<sigma>n'), ba, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n         ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                          Normal \\<sigma>n' = \\<sigma> \\<and>\n                          (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                 Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                   c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                   c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   Normal \\<sigma>n' = \\<sigma> \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n    using skip1[of \\<Gamma>\\<^sub>c \\<tau> \"Normal \\<sigma>n\" c\\<^sub>c' \"Normal \\<sigma>n'\"] by simp\n            \nlemma while_seq_no_ev4:\nassumes   \n  a4':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and  \n  a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and\n  a7:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and   \n  a12:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and       \n  a13:\"a = LanguageCon.com.Throw \\<and>\n       b = Normal \\<sigma>n \\<and>\n       aa = LanguageCon.com.Throw \\<and>\n       ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<gamma>\\<^sub>a\" and  \n  a14:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (a, b) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" \n  shows \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n         \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n         (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n         (((b, Normal \\<sigma>n'), ba, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n        ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                          Normal \\<sigma>n' = \\<sigma> \\<and>\n                          (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                 Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                   c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                   c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   Normal \\<sigma>n' = \\<sigma> \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"    \nproof -\n  show ?thesis using a4' a13 Throw_sim_normal a12 a14  a5 a7  dest_sim_tau_step\n    by (metis (no_types)) \nqed\n\nlemma while_seq_no_ev5:\n  assumes a0:\"a = LanguageCon.com.Skip \\<and>\n       b = \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and> ba = \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma>' \\<noteq> Normal \\<Sigma>n)\" and\n  a1:\"b = Normal \\<sigma> \\<and> ba = Normal \\<Sigma>\"\nshows \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((b, Normal \\<sigma>n'), ba, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                          Normal \\<sigma>n' = \\<sigma> \\<and>\n                          (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                 Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                   c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                   c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   Normal \\<sigma>n' = \\<sigma> \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n  using a0 a1 by auto\n\n\nlemma while_seq_no_ev:\n  assumes \n  a0:\"(\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c1\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\" and    \n  a3:\"\\<xi> \\<subseteq> \\<alpha>\" and a4':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and  \n  a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and  \n  a7:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and \n  a8:\"\\<xi> \\<subseteq> b\\<^sub>c \\<rightleftharpoons>  b\\<^sub>s\" and\n  a9:\"\\<xi>\\<^sub>1 = \\<xi> \\<inter> b\\<^sub>c \\<odot>  b\\<^sub>s\" and    \n  a12:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n  a13:\"(\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Skip \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Throw \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Throw \\<and> (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       b = \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and> ba = \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma>' \\<noteq> Normal \\<Sigma>n)\" and\n  a14:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (a, b) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n  shows \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((b, Normal \\<sigma>n'), ba, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                          Normal \\<sigma>n' = \\<sigma> \\<and>\n                          (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                 Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                   c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                   c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   Normal \\<sigma>n' = \\<sigma> \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"  \n  \nproof-\n  have \"(\\<exists>\\<sigma>. b = Normal \\<sigma>)\" using a14 \n    by (meson compe_normal_s'_normal_s)\n  moreover have  ban:\"\\<exists>\\<Sigma>. ba = Normal \\<Sigma>\" using a13 calculation\n    by (auto simp: alpha_xstate_def dest: dest_sim_alpha_x)\n  ultimately obtain \\<sigma> \\<Sigma> where bn:\"b = Normal \\<sigma> \\<and> ba = Normal \\<Sigma>\" by auto  \n\n  show ?thesis using while_seq_no_ev1[OF _  a14 bn, of b\\<^sub>c c1\\<^sub>c _ aa b\\<^sub>s c1\\<^sub>s ba _]\n        while_seq_no_ev2[OF a0 a3   a8 a9 a12 _, of \\<sigma> \\<Sigma> c\\<^sub>c' \\<sigma>n']  \n        while_seq_no_ev3[OF  _ a14, of \\<sigma> aa ba \\<Sigma> \\<xi> b\\<^sub>c \\<Gamma>\\<^sub>s \\<alpha> G\\<^sub>c G\\<^sub>s  c1\\<^sub>c b\\<^sub>s c1\\<^sub>s R\\<^sub>c \\<gamma>\\<^sub>a R\\<^sub>s]\n        while_seq_no_ev4[OF a4' a5 a7  a12 _ a14,of \\<sigma> aa ba \\<Sigma> \\<Gamma>\\<^sub>s G\\<^sub>s b\\<^sub>c c1\\<^sub>c b\\<^sub>s c1\\<^sub>s \\<xi> \\<gamma>\\<^sub>n]\n        while_seq_no_ev5[OF _ bn] a13 a14 bn\n by (auto; fastforce)\nqed\n\nlemma while_seq_ev:\n   assumes\n a12:\"(\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Skip \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Throw \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Throw \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       b = \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and>\n       ba = \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma>' \\<noteq> Normal \\<Sigma>n)\"\n shows \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n          \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n          (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n              (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                     (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n              (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n              ((b, Normal \\<sigma>n'), ba, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n              ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                              Normal \\<sigma>n' = \\<sigma> \\<and>\n                              (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                     Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                     (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                       c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                       c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and>\n                       (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                       c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                       c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                       (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                       c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                       c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                       c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                       Normal \\<sigma>n' = \\<sigma> \\<and>\n                       c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                       Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n))  \\<or>\n          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))) \" (is ?goal)     \n   using a12 \n proof auto\n   fix v c\\<^sub>c' \\<sigma>n' c\\<^sub>c c\\<^sub>s\n     assume a0:\"(\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\" and\n            a1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c), \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n     then obtain \\<sigma>n where \\<sigma>n: \"\\<sigma>' = Normal \\<sigma>n\"\n       by (meson step_NotNormal)\n     have \"c\\<^sub>c \\<noteq> Throw \\<and> c\\<^sub>c \\<noteq> Skip\" \n    using a1 not_seq_skip_throw_ev by fastforce\n  then obtain c1'\n    where stepc1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) ( c\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c1', Normal \\<sigma>n')\" and \n          seq:    \"(c\\<^sub>c',Normal \\<sigma>n')= (Seq c1' (While b\\<^sub>c c1\\<^sub>c),Normal \\<sigma>n')\" \n    using stepc_elim_cases1(5)[OF a1[simplified \\<sigma>n], of \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) ( c\\<^sub>c,  Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<and> \n                                          (c\\<^sub>c',Normal \\<sigma>n')= (Seq c\\<^sub>c' (While b\\<^sub>c c1\\<^sub>c),Normal \\<sigma>n')\"]\n    by fast    \n    then show \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s), \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                          Normal \\<sigma>n' = \\<sigma> \\<and>\n                          (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                 Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                 (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                   c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                   c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and>\n     \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   Normal \\<sigma>n' = \\<sigma> \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n      using  \\<sigma>n seq_ev_plus stepc1 seq a0[simplified \\<sigma>n] dest_sim_ev_step[OF a0[simplified \\<sigma>n] stepc1] apply auto\n      by fast\n  next \n    fix   v c\\<^sub>c' \\<sigma>n' \\<sigma>n \\<Sigma>n\n    assume a1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c, Normal \\<sigma>n) \\<rightarrow>\n                      (c\\<^sub>c', Normal \\<sigma>n')\" \n    then show \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                          Normal \\<sigma>n' = \\<sigma> \\<and>\n                          (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                 Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                 (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                   c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                   c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and>\n     \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   Normal \\<sigma>n' = \\<sigma> \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n      using stepc_elim_cases1(7)  by fastforce\n  next\n    fix v c\\<^sub>c' \\<sigma>n' \\<sigma>n \\<Sigma>n\n    assume       \n         a1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Skip, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"          \n    then show \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Skip, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                          Normal \\<sigma>n' = \\<sigma> \\<and>\n                          (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                 Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                 (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                   c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                   c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and>\n     \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   Normal \\<sigma>n' = \\<sigma> \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n      using skip1 by fastforce  \n  next\n    fix v c\\<^sub>c' \\<sigma>n' \\<sigma>n \\<Sigma>n\n    assume a0:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Throw, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \"\n    then show \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Throw, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                          Normal \\<sigma>n' = \\<sigma> \\<and>\n                          (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                 Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                 (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                   c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                   c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and>\n     \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   Normal \\<sigma>n' = \\<sigma> \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n      using catch_ev by fastforce\n  next\n    fix v c\\<^sub>c' \\<sigma>n'\n    assume \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Skip, \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" and\n           \" \\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n\"\n    then show \"  \\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Skip, \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          ((\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                          Normal \\<sigma>n' = \\<sigma> \\<and>\n                          (\\<exists>c\\<^sub>s. c\\<^sub>s' = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                                 Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                                 (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n                   c\\<^sub>c' = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n                   c\\<^sub>s' = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and>\n     \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<sigma>n' \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Throw \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n' \\<and> \\<Sigma> = Normal \\<Sigma>n' \\<or>\n                   c\\<^sub>c' = LanguageCon.com.Skip \\<and>\n                   Normal \\<sigma>n' = \\<sigma> \\<and>\n                   c\\<^sub>s' = LanguageCon.com.Skip \\<and>\n                   Normal \\<Sigma>n' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n      by (meson step_NotNormal)\n  qed\n\n(*lemma while_seq_not_normal_1:\n  assumes      \n  a7:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and \n  a13:\"(\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = Normal \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = Normal \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                     (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\" and\n  a14:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (a, b) \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n)\"\nshows\" \\<exists>\\<Sigma>'. (\\<sigma>'', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n            (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                     (\\<exists>v. e = Some v \\<and>\n                          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                 (\\<exists>aa ba.\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and>\n                          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"\nproof -\n  obtain c\\<^sub>c c\\<^sub>s where \n    a:\"a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c)\" and\n    aa:\"aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s)\" and \n    bim:\"(\\<Gamma>\\<^sub>c,(c\\<^sub>c, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\" using a13 by auto\n   \n  then have step:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c), Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> \n    (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n)\" using a13 a14 by auto\n  obtain \\<Sigma>' c\\<^sub>s' where \"(\\<sigma>'', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n            (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                     (\\<exists>v. e = Some v \\<and>\n                          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                 (\\<exists>aa ba.\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')))))\"\n    using Seq_not_normal[OF a7  bim step] a aa a13 by fastforce\n  moreover have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using a14 calculation sim_not_normal[OF _ _ a7 ] by auto\n  ultimately show ?thesis by fastforce\nqed\n\n\n\nlemma while_seq_not_normal:\n  assumes         \n  a7:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and     \n  a13:\"(\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = Normal \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = Normal \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                     (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n       b = Normal \\<sigma>' \\<and> aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> ba = Normal \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<xi> \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       b = Normal \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and>\n       ba = Normal \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<xi>  \\<and> \\<sigma>' \\<notin> b\\<^sub>c \\<or>\n       a = LanguageCon.com.Throw \\<and>\n       b = Normal \\<sigma>' \\<and>\n       aa = LanguageCon.com.Throw \\<and>\n       ba = Normal \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<gamma>\\<^sub>a\" and\n  a14:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (a, b) \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n)\"\nshows\" \\<exists>\\<Sigma>'. (\\<sigma>'', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n            (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                     (\\<exists>v. e = Some v \\<and>\n                          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                 (\\<exists>aa ba.\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and>\n                          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"  \n  using a13 a14\n  by (fastforce intro:while_seq_not_normal_1[OF a7  _ a14]  \n                elim:stepc_elim_cases1(11) stepc_elim_cases1(1) stepc_elim_cases1(7))+ *)\n\nlemma while_seq_not_normal_1:\n  assumes      \n  a7:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and a1:\"\\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\" and\n  a13:\"\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\" and\n  a14:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (a, b) \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n)\"\nshows\" \\<exists>\\<Sigma>'. (\\<sigma>'', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n            (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                     (\\<exists>v. e = Some v \\<and>\n                          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                 (\\<exists>aa ba.\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> ((b, \\<sigma>'')\\<in>G\\<^sub>c) \\<and>\n                          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"\nproof -\n  obtain c\\<^sub>c c\\<^sub>s where \n    a:\"a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c)\" and\n    aa:\"aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s)\" and \n    bim:\"(\\<Gamma>\\<^sub>c,(c\\<^sub>c,  \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s,  \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\" using a13 by auto\n   \n  then have step:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c),  \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> \n    (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n)\" using a13 a14 by auto\n  obtain \\<Sigma>' c\\<^sub>s' where \"(\\<sigma>'', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n            (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                     (\\<exists>v. e = Some v \\<and>\n                          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                 (\\<exists>aa ba.\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')))))  \\<and> (b, \\<sigma>'') \\<in> G\\<^sub>c\"\n    using Seq_not_normal[OF a7  a1 bim step] a aa a13 by fastforce\n  moreover have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using a14 calculation sim_not_normal[OF _ _ a7 a1] by auto\n  ultimately show ?thesis by fastforce\nqed\n\nlemma while_seq_not_normal:\n  assumes               \n  a7:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and a1:\"\\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\" and\n  a13:\"(\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Skip \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Throw \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Throw \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       b = \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and>\n       ba = \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma>' \\<noteq> Normal \\<Sigma>n)\" and\n  a14:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (a, b) \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n)\"\nshows\" \\<exists>\\<Sigma>'. (\\<sigma>'', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n            (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                     (\\<exists>v. e = Some v \\<and>\n                          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                 (\\<exists>aa ba.\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> ((b, \\<sigma>'')\\<in>G\\<^sub>c) \\<and>\n                          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"  \n  using a13 a14 a7 a1\n  apply auto\n  apply (frule while_seq_not_normal_1, assumption+, fast+)\n  by (fastforce elim:stepc_elim_cases1(11) stepc_elim_cases1(1) stepc_elim_cases1(7))+\n\nlemma while_seq_env1:\n  assumes a0:\"\\<xi> \\<subseteq> \\<alpha>\" and          \n        a2:\"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and \n        a3:\" \\<sigma>n \\<notin> b\\<^sub>c\" and\n        a5:\"((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and\n        a6:\"\\<xi> \\<subseteq> b\\<^sub>c \\<rightleftharpoons>  b\\<^sub>s\" and a7:\"Sta\\<^sub>s (\\<xi> \\<inter> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s)) (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and\n        a8:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" shows \"\\<sigma>n' \\<in> (-b\\<^sub>c)\"  \nproof-\n  have \"\\<sigma>n \\<in> -b\\<^sub>c\" \n    using a3  Normal_alpha2 a5 a8 unfolding related_transitions_def\n    by fast  \n  moreover have \"\\<Sigma>n \\<in> -b\\<^sub>s\" using calculation a6 a2 same_set\n    by fastforce      \n  ultimately show ?thesis using a5 a2 a7  \n    unfolding Sta\\<^sub>s_def  and_rel_def\n    by blast        \nqed \n\nlemma next_step_normal:\"R\\<^sub>c \\<subseteq> \\<alpha>\\<^sub>x \\<Longrightarrow> R\\<^sub>s \\<subseteq> \\<alpha>\\<^sub>x \\<Longrightarrow>\n      (\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = Normal \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = Normal \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                     (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n       b = Normal \\<sigma>' \\<and> aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and> ba = Normal \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<xi> \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       b = Normal \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and>\n       ba = Normal \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<xi>  \\<and> \\<sigma>' \\<notin> b\\<^sub>c \\<or>\n       a = LanguageCon.com.Throw \\<and>\n       b = Normal \\<sigma>' \\<and>\n       aa = LanguageCon.com.Throw \\<and>\n       ba = Normal \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<gamma>\\<^sub>a \\<Longrightarrow>\n      ((b, \\<sigma>''), ba, \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<sigma>'',\\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<Longrightarrow>  \\<exists>\\<sigma>. \\<sigma>'' = Normal \\<sigma> \\<and>\n           (\\<exists>\\<Sigma>. \\<Sigma>'' = Normal \\<Sigma>)\n    \"\n  unfolding related_transitions_def apply auto\n  by (meson Normal_alpha subsetCE | meson Normal_alpha alpha_x_tran_clos set_rev_mp)+\n\nlemma while_env2:\n  assumes a0:\"\\<xi> \\<subseteq> \\<alpha> \" and\n          a1: \"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and\n          a2:\"\\<forall>sn. (sn, sn) \\<in> G\\<^sub>c\" and\n          a3:\"Sta\\<^sub>s \\<xi> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \" and\n          a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>a (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and\n          a5:\"Sta\\<^sub>s (\\<xi> \\<inter> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s)) (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and\n          a7:\"\\<xi>\\<^sub>1 = \\<xi> \\<inter> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s)\" and\n          a8:\" \\<xi> \\<subseteq> b\\<^sub>c \\<rightleftharpoons>  b\\<^sub>s\" and\n          a9:\"((Normal \\<sigma>n, \\<sigma>''), Normal \\<Sigma>n, \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and\n          a10:\"(\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x\" and\n          a11:\" \\<not> (\\<Gamma>\\<^sub>c,(LanguageCon.com.Skip, \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n             (\\<Gamma>\\<^sub>s,(LanguageCon.com.Skip, \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\" and\n          a12:\"a = LanguageCon.com.Skip\" and\n          a13:\"b = Normal \\<sigma>n\" and\n          a14:\"aa = LanguageCon.com.Skip\" and\n          a15:\"ba = Normal \\<Sigma>n \" and\n          a16:\"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and\n          a17:\"\\<sigma>n \\<notin> b\\<^sub>c\" and\n          a18:\"\\<sigma>' = Normal \\<sigma>n\" and\n          a19:\"\\<Sigma>' = Normal \\<Sigma>n\" \n        shows\" \\<exists>\\<sigma> \\<Sigma>. (\\<exists>\\<sigma>n. \\<sigma>'' = Normal \\<sigma>n \\<and>\n                          (\\<exists>\\<Sigma>n. \\<Sigma>'' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n \\<and> \\<Sigma> = Normal \\<Sigma>n)) \\<or>\n                    \\<sigma>'' = \\<sigma> \\<and> \\<Sigma>'' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)\"\n  using env[OF a16 a3 a2 a1  conjI[OF a9 a10]]  while_seq_env1[OF a0 a16 a17 _ a8 a5 a1] a9 a11\n  by fastforce\n  \n  \n\n\nlemma while_seq_env:\"\n       \\<xi> \\<subseteq> \\<alpha> \\<Longrightarrow> R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x \\<Longrightarrow> \\<forall>sn. (sn, sn) \\<in> G\\<^sub>c \\<Longrightarrow>\n       Sta\\<^sub>s \\<xi> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow>\n       Sta\\<^sub>s \\<gamma>\\<^sub>a (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow>\n       Sta\\<^sub>s (\\<xi> \\<inter> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s)) (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow> \n       \\<xi>1 = (\\<xi> \\<inter> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s)) \\<Longrightarrow>     \n       \\<xi> \\<subseteq> b\\<^sub>c \\<rightleftharpoons>  b\\<^sub>s \\<Longrightarrow>             \n       (\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Skip \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Throw \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Throw \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       b = \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and>\n       ba = \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma>' \\<noteq> Normal \\<Sigma>n) \\<Longrightarrow>\n       (((b, \\<sigma>''), ba, \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<Longrightarrow> \n   (\\<exists>\\<sigma> \\<Sigma>. (\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n                      \\<sigma>'' = \\<sigma> \\<and>\n                      (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                             \\<Sigma>'' = \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n               a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n               (\\<exists>\\<sigma>n. \\<sigma>'' = Normal \\<sigma>n \\<and>\n                     aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and>\n                     (\\<exists>\\<Sigma>n. \\<Sigma>'' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma> = Normal \\<sigma>n \\<and> \\<Sigma> = Normal \\<Sigma>n)) \\<or>\n               a = LanguageCon.com.Skip \\<and>\n               (\\<exists>\\<sigma>n. \\<sigma>'' = Normal \\<sigma>n \\<and>\n                     aa = LanguageCon.com.Skip \\<and>\n                     (\\<exists>\\<Sigma>n. \\<Sigma>'' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma> = Normal \\<sigma>n \\<and> \\<Sigma> = Normal \\<Sigma>n)) \\<or>\n               a = LanguageCon.com.Throw \\<and>\n               (\\<exists>\\<sigma>n. \\<sigma>'' = Normal \\<sigma>n \\<and>\n                     aa = LanguageCon.com.Throw \\<and>\n                     (\\<exists>\\<Sigma>n. \\<Sigma>'' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma> = Normal \\<sigma>n \\<and> \\<Sigma> = Normal \\<Sigma>n)) \\<or>\n               a = LanguageCon.com.Skip \\<and>\n               \\<sigma>'' = \\<sigma> \\<and>\n               aa = LanguageCon.com.Skip \\<and> \\<Sigma>'' = \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma> \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma> \\<noteq> Normal \\<Sigma>n)) \\<or>\n       (\\<Gamma>\\<^sub>c,(a, \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>1\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(aa, \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\"\n  \n  apply auto\n      apply (metis dest_sim_env_step) \n     apply (auto dest:sim_env[of _ _ \\<xi> R\\<^sub>c R\\<^sub>s \\<alpha> G\\<^sub>c \\<sigma>'' \\<Sigma>'' \\<Gamma>\\<^sub>c \"LanguageCon.com.While b\\<^sub>c c1\\<^sub>c\" \\<xi>1 \\<gamma>\\<^sub>a \\<Gamma>\\<^sub>s \"LanguageCon.com.While b\\<^sub>s c1\\<^sub>s\" G\\<^sub>s])        \n\n  apply (rule while_env2[of \\<xi> \\<alpha> R\\<^sub>c G\\<^sub>c R\\<^sub>s \\<gamma>\\<^sub>a b\\<^sub>c b\\<^sub>s _ _ \\<sigma>'' _ \\<Sigma>'' \\<Gamma>\\<^sub>c  \\<Gamma>\\<^sub>s G\\<^sub>s a b aa ba], simp+)   \n  apply (meson env)\n  by (metis Normal_alpha2 simulation_env_not_normal)\n\nlemma while_seq_skip_normal: \nassumes        \n       a3:\"\\<xi> \\<subseteq> \\<alpha>\" and                            \n       a8:\"\\<xi> \\<subseteq> b\\<^sub>c \\<rightleftharpoons>  b\\<^sub>s \" and       \n       a12:\"\\<forall>s. (s, s)\\<in>G\\<^sub>c\" and\n       a13:\"(\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Skip \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Throw \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Throw \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       b = \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and>\n       ba = \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma>' \\<noteq> Normal \\<Sigma>n)\" and\n      a14:\"a = LanguageCon.com.Skip \\<and> b = Normal \\<sigma>n\"\n       shows\n        \"(\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), ba, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<xi> \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s) \\<and>\n                     \\<xi> \\<inter> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s) \\<subseteq> \\<alpha> \\<and>\n                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n'))\"        \nproof -       \n  have \"a = LanguageCon.com.Skip \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Skip \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n))\"\n    using a14 a13 by auto\n  obtain \\<Sigma>n where ba:\"ba = Normal \\<Sigma>n\" using a14 a13 by auto\n  have \"((Normal \\<sigma>n, Normal \\<sigma>n), Normal \\<Sigma>n, Normal \\<Sigma>n) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n  proof -\n    have \"(\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>\"\n      using a3 a14 a13 ba by auto    \n    then show ?thesis\n      by (simp add:a12 alpha_id_G  related_transitions_def)\n  qed  \n  moreover have \"(\\<sigma>n, \\<Sigma>n) \\<in> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s)\"\n     using a8 calculation a13 a14  ba unfolding and_rel_def ToNorm_def eq_rel_def \n     by fastforce   \n  ultimately show \"\\<exists>\\<Sigma>n'. ((Normal \\<sigma>n, Normal \\<sigma>n), ba, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                 (\\<sigma>n, \\<Sigma>n') \\<in> \\<xi> \\<and>\n                 (\\<sigma>n, \\<Sigma>n') \\<in> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s) \\<and>\n                 \\<xi> \\<inter> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s) \\<subseteq> \\<alpha> \\<and>\n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa,ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\" \n     using a3 a13 a14 ba by auto\n qed        \n\nlemma while_seq_throw_normal: \nassumes        \n       a3:\"\\<xi> \\<subseteq> \\<alpha>\" and a3':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and                            \n       a12:\"\\<forall>s. (s, s)\\<in>G\\<^sub>c\" and\n       a13:\"(\\<exists>c\\<^sub>c. a = LanguageCon.com.Seq c\\<^sub>c (LanguageCon.com.While b\\<^sub>c c1\\<^sub>c) \\<and>\n              b = \\<sigma>' \\<and>\n              (\\<exists>c\\<^sub>s. aa = LanguageCon.com.Seq c\\<^sub>s (LanguageCon.com.While b\\<^sub>s c1\\<^sub>s) \\<and>\n                     ba = \\<Sigma>' \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       a = LanguageCon.com.While b\\<^sub>c c1\\<^sub>c \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.While b\\<^sub>s c1\\<^sub>s \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Skip \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<xi> \\<and> \\<sigma>n \\<notin> b\\<^sub>c \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Throw \\<and>\n       (\\<exists>\\<sigma>n. b = Normal \\<sigma>n \\<and>\n             aa = LanguageCon.com.Throw \\<and>\n             (\\<exists>\\<Sigma>n. ba = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<gamma>\\<^sub>a \\<and> \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n)) \\<or>\n       a = LanguageCon.com.Skip \\<and>\n       b = \\<sigma>' \\<and>\n       aa = LanguageCon.com.Skip \\<and>\n       ba = \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>\\<Sigma>n. \\<Sigma>' \\<noteq> Normal \\<Sigma>n)\" and\n     a14:\"a = LanguageCon.com.Throw \\<and> b = Normal \\<sigma>n\"\n       shows\n        \"\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), ba, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\"\n        \nproof -  \n  obtain \\<Sigma>n where ba:\"ba = Normal \\<Sigma>n\" using a14 a13 by auto\n  have \"((Normal \\<sigma>n, Normal \\<sigma>n), Normal \\<Sigma>n, Normal \\<Sigma>n) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n  proof -\n    have \"(\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>\"\n      using a3' a14 a13 ba by auto    \n    then show ?thesis\n      by (simp add:a12 alpha_id_G  related_transitions_def)\n   qed    \n   then show \"\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), ba, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\" \n     using a3 a3' a14 a13 ba  by fastforce \n qed        \n\n\nlemma while_sim:\n  \"(\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c1\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>\n   (\\<sigma>,\\<Sigma>)\\<in>\\<xi> \\<Longrightarrow>   \n   \\<xi> \\<subseteq> \\<alpha> \\<Longrightarrow> \\<gamma>\\<^sub>a\\<subseteq>\\<alpha> \\<Longrightarrow>\n  Sta\\<^sub>s \\<xi> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow>\n  Sta\\<^sub>s \\<gamma>\\<^sub>a (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow> \n  Sta\\<^sub>s \\<gamma>\\<^sub>n (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow> R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x \\<Longrightarrow>  \n  \\<xi> \\<subseteq> b\\<^sub>c \\<rightleftharpoons>  b\\<^sub>s \\<Longrightarrow>\n   \\<xi>\\<^sub>1 = \\<xi> \\<inter> b\\<^sub>c \\<odot>  b\\<^sub>s \\<Longrightarrow>\n   \\<gamma>\\<^sub>n = \\<xi> \\<inter> (- b\\<^sub>c) \\<odot>  (- b\\<^sub>s) \\<Longrightarrow>   \n   \\<forall>s. (s, s)\\<in>G\\<^sub>c \\<Longrightarrow> (\\<Gamma>\\<^sub>c,(While b\\<^sub>c c1\\<^sub>c,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(While b\\<^sub>s c1\\<^sub>s,Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\napply (coinduct taking:\"coPre \\<xi> b\\<^sub>c b\\<^sub>s \\<Gamma>\\<^sub>c c1\\<^sub>c R\\<^sub>c G\\<^sub>c \\<alpha> \\<gamma>\\<^sub>n \\<gamma>\\<^sub>a \\<Gamma>\\<^sub>s c1\\<^sub>s R\\<^sub>s G\\<^sub>s\"  rule:RGSim.coinduct) \n   apply (simp add:coPre_def, clarsimp simp add:coPre_def)   \n  apply (rule conjI, rule while_seq_alpha_x[of \\<xi> \\<alpha> \\<gamma>\\<^sub>a], assumption+)\n  apply (rule conjI, rule while_seq_alpha[of \\<xi> \\<alpha> \\<gamma>\\<^sub>a], assumption+)  \n  apply (rule conjI, rule, rule, rule, rule while_seq_no_ev, assumption+, simp, assumption+)    \n  apply (rule conjI, rule while_seq_ev, assumption+)   \n  apply (rule conjI, rule, rule,rule, rule while_seq_env, assumption+, simp+)      \n  apply (rule conjI, rule, rule,rule while_seq_skip_normal, assumption+)   \n  apply (rule conjI, rule, rule, rule while_seq_throw_normal, assumption+) \n  by  (rule conjI, rule, rule, rule,rule, drule while_seq_not_normal, assumption+, blast+)\n        \n    \nlemma While_sound:    \n    \"\\<xi> \\<subseteq> \\<alpha> \\<Longrightarrow> Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow> \\<forall>s. (s, s)\\<in>G\\<^sub>c \\<Longrightarrow> \n   R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow>  \\<xi> \\<subseteq> (b\\<^sub>c \\<rightleftharpoons> b\\<^sub>s) \\<Longrightarrow> \\<xi>\\<^sub>1= \\<xi> \\<inter> (b\\<^sub>c \\<odot> b\\<^sub>s) \\<Longrightarrow> \\<gamma>\\<^sub>n= \\<xi> \\<inter> ((-b\\<^sub>c) \\<odot> (-b\\<^sub>s) ) \\<Longrightarrow>\n  (\\<Gamma>\\<^sub>c,c\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<xi>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow> Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow> Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow> \\<gamma>\\<^sub>a\\<subseteq>\\<alpha> \\<Longrightarrow>\n  (\\<Gamma>\\<^sub>c,While b\\<^sub>c c\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,While b\\<^sub>s c\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (simp, rule, rule,rule)\n  apply (rule while_sim[of \\<Gamma>\\<^sub>c c\\<^sub>c R\\<^sub>c G\\<^sub>c \\<alpha> \\<xi>\\<^sub>1 \\<xi> \\<gamma>\\<^sub>a \\<Gamma>\\<^sub>s c\\<^sub>s R\\<^sub>s G\\<^sub>s])\n  unfolding RGSim_pre_def by blast+\n\nlemma next_step_normal1:\"R\\<^sub>c \\<subseteq> \\<alpha>\\<^sub>x \\<Longrightarrow> R\\<^sub>s \\<subseteq> \\<alpha>\\<^sub>x \\<Longrightarrow>      \n      ((Normal \\<sigma>, \\<sigma>''), Normal \\<Sigma>, \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow>  \n       \\<exists>\\<sigma>. \\<sigma>'' = Normal \\<sigma> \\<and>\n           (\\<exists>\\<Sigma>. \\<Sigma>'' = Normal \\<Sigma>)\n    \"\n  unfolding related_transitions_def apply auto\n  by (meson Normal_alpha subsetCE | meson Normal_alpha alpha_x_tran_clos set_rev_mp)+\n\nlemma DynCom_sim:    \n  assumes\n     a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x\" and\n   a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and \n   a6:\"\\<forall>s. (s, s)\\<in>G\\<^sub>c\" and\n   a7:\"\\<forall>\\<sigma>n \\<Sigma>n. (\\<sigma>n,\\<Sigma>n)\\<in> \\<xi> \\<longrightarrow> (\\<Gamma>\\<^sub>c,(f\\<^sub>c \\<sigma>n,Normal \\<sigma>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(f\\<^sub>s \\<Sigma>n, Normal \\<Sigma>n),R\\<^sub>s,G\\<^sub>s)\" and\n   a8:\"(\\<sigma>,\\<Sigma>)\\<in> \\<xi>\" \n shows \"(\\<Gamma>\\<^sub>c,(DynCom f\\<^sub>c, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(DynCom f\\<^sub>s, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" \n   using  a1  a2 a3  a6 a7 a8        \n    apply(coinduction arbitrary: \\<sigma> \\<Sigma>)\n      apply(clarsimp)\n   apply (rule conjId)+\n(* not Normal transition*)\n     apply(rule, rule,  rule, rule, rule) \n   apply (fastforce elim:stepc_elim_cases1(10))\n     (* Enviroment transition *)\n       apply rule apply rule apply rule  apply (frule sim_env, simp+, blast)                \n(* Event Component transition *)\n      apply (rule, rule, rule, rule)     \n      apply (auto elim: ev_stepc_normal_elim_cases)     \n      (* silent component transition *)\n    apply (erule stepc_elim_cases1(10))     \n       apply auto         \n    apply (frule set_rev_mp[of _ \\<xi> \\<alpha>], assumption)      \n    apply (subgoal_tac \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (DynCom f\\<^sub>s, Normal \\<Sigma>) \\<rightarrow> (f\\<^sub>s \\<Sigma>, Normal \\<Sigma>)\")\n     apply (subgoal_tac\"((Normal s, Normal s), Normal \\<Sigma>, Normal \\<Sigma>) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\")\n       apply (erule allE)+ \n      apply (auto simp add:related_transitions_def Id_def )\n    apply (auto simp add:DynComc)        \n   by (auto simp add:alpha_xstate_def)\n                   \nlemma DynCom_sound:    \n    \"\\<xi> \\<subseteq> \\<alpha>  \\<Longrightarrow>\n   Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow>   R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x  \\<Longrightarrow>\n    \\<forall>s. (s, s)\\<in>G\\<^sub>c \\<Longrightarrow> \n   \\<forall>\\<sigma> \\<Sigma>. (\\<sigma>,\\<Sigma>)\\<in>\\<xi> \\<longrightarrow> (\\<Gamma>\\<^sub>c,(f\\<^sub>c \\<sigma>,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(f\\<^sub>s \\<Sigma>, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>  \n  (\\<Gamma>\\<^sub>c,DynCom f\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,DynCom f\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (rule, rule, rule)\n  apply (rule DynCom_sim)\n  unfolding RGSim_pre_def by blast+\n    \nlemma Guard_sim:\n  assumes \n  a1:\"\\<xi> \\<subseteq> \\<alpha> \" and \n  a2:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and \n  a3:\"\\<forall>s. (s, s)\\<in>G\\<^sub>c\" and \n  a4:\"R\\<^sub>c \\<subseteq> 1\\<alpha>\\<^sub>x \" and \n  a5:\"\\<xi> \\<subseteq> (b\\<^sub>c \\<rightleftharpoons> b\\<^sub>s)\" and a6:\"\\<xi>\\<^sub>1 = \\<xi> \\<inter> (b\\<^sub>c \\<odot> b\\<^sub>s)\" and\n  a8:\"(\\<sigma>,\\<Sigma>)\\<in>\\<xi>\" and a8':\"\\<forall>\\<sigma>\\<in>(Domain \\<xi> \\<inter> (-b\\<^sub>c)). (Normal \\<sigma>,Fault f)\\<in>G\\<^sub>c\" and\n  a9:\"(\\<Gamma>\\<^sub>c,c\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\nshows  \n  \"(\\<Gamma>\\<^sub>c,(Guard f b\\<^sub>c c\\<^sub>c,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Guard f b\\<^sub>s c\\<^sub>s,Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n  using a1 a2 a3 a4 a6  a8 a9 \n  proof(coinduction arbitrary: \\<sigma>  \\<Sigma>,clarsimp)     \n    fix \\<sigma>' \\<Sigma>'\n    assume \n       a0:\"(\\<sigma>', \\<Sigma>') \\<in> \\<xi>\" and              \n       a3:\"Sta\\<^sub>s \\<xi> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and                           \n       a8:\"\\<xi> \\<subseteq> \\<alpha>\" and              \n       a12:\"\\<forall>s. (s, s)\\<in>G\\<^sub>c\"    \n    have \"(\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\" and \"(Normal \\<sigma>', Normal \\<Sigma>') \\<in> \\<alpha>\\<^sub>x\" \n      using a0 a8 unfolding alpha_xstate_def by auto\n    moreover have \"\\<forall>\\<sigma>'' \\<Sigma>''.\n           (((Normal \\<sigma>', \\<sigma>''), Normal \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<longrightarrow>\n           (\\<exists>\\<sigma>n'. \\<sigma>'' = Normal \\<sigma>n' \\<and> (\\<exists>\\<Sigma>n'. \\<Sigma>'' = Normal \\<Sigma>n' \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi>)) \\<or>\n           (\\<Gamma>\\<^sub>c,(LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c, \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n           (\\<Gamma>\\<^sub>s,(LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\" \n      using env[OF a0 a3 a12 a4] by blast\n    moreover have \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba.\n                          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n                (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>', Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>               \n               (c\\<^sub>c' = LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c \\<and>\n                c\\<^sub>s' = LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s \\<and>\n                (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"       \n      by (metis CRef.stepc_elim_cases(4) CRef.stepc_elim_cases(5) \n               option.distinct(1) stepc_Normal_elim_cases(2) stepce_stepc) \n    moreover have \"\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>', Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c \\<and>\n                c\\<^sub>s' = LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\n    proof -\n    {\n      fix c\\<^sub>c' \\<sigma>n'\n      assume  a00:\" \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n      have guar1:\"((Normal \\<sigma>', Normal \\<sigma>'), Normal \\<Sigma>', Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\"\n        using a12  a0 a8  unfolding related_transitions_def Id_def by auto             \n      have h:\"(c\\<^sub>c'=c\\<^sub>c \\<and> \\<sigma>'\\<in>b\\<^sub>c \\<and> \\<sigma>n'= \\<sigma>')\"\n        using stepc_elim_cases2(2)[OF a00] by auto        \n      then have sig1:\"(\\<sigma>', \\<Sigma>') \\<in> \\<xi>\\<^sub>1\"\n        using a0 a5 a6   unfolding eq_rel_def ToNorm_def and_rel_def by auto\n      then have sn_inb:\"\\<Sigma>'\\<in>b\\<^sub>s\" using a6 unfolding and_rel_def by auto\n      then have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s, Normal \\<Sigma>')\"          \n        by (simp add: sn_inb r_into_rtranclp stepce.Guardc)                 \n      have \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n         \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n         (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n         (((Normal \\<sigma>', Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n         (c\\<^sub>c' = LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c \\<and>\n          c\\<^sub>s' = LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\" \n      using  h steps guar1  a9  sig1 unfolding related_transitions_def RGSim_pre_def  \n      by auto \n     } thus ?thesis by auto\n     qed\n     moreover have \"\\<forall>\\<sigma>'' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                   (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                            (\\<exists>v. e = Some v \\<and>\n                                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \n                                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (Normal \\<sigma>', \\<sigma>'')\\<in> G\\<^sub>c \\<and>\n                           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))\" (is ?x)\n     proof-\n     { fix \\<sigma>'' c\\<^sub>c' e\n       assume \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n)\"\n       then have \"\\<sigma>'' = Fault f \" and \" c\\<^sub>c' = Skip\" and \"\\<sigma>' \\<notin> b\\<^sub>c \" and \"e=\\<tau>\" \n         by (auto elim: stepc_elim_cases2(2))\n       moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow> (Skip, Fault f)\" \n         using GuardFaultc a0 a5 same_set calculation by metis\n       then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip, Fault f)\"\n         by (simp add: calculation(4))\n\n       moreover have \" (Fault f, Fault f) \\<in> \\<alpha>\\<^sub>x\" unfolding alpha_xstate_def by auto\n       moreover have \"(\\<Gamma>\\<^sub>c,(Skip, Fault f),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Skip, Fault f),R\\<^sub>s,G\\<^sub>s)\" \n         using sim_not_normal[OF _ _ a4 a12] unfolding alpha_xstate_def by blast    \n       moreover have \"(Normal \\<sigma>', \\<sigma>'')\\<in>G\\<^sub>c\" using a8'\n         using a0 calculation(1) calculation(3) by blast \n       ultimately have \"(\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                 (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                          (\\<exists>v. e = Some v \\<and>\n                               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (Normal \\<sigma>', \\<sigma>'')\\<in>G\\<^sub>c\\<and>\n                         (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))\"\n         by auto\n     } thus ?thesis by blast\n   qed\n    ultimately show \"(Normal \\<sigma>', Normal \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n       (\\<sigma>', \\<Sigma>') \\<in> \\<alpha> \\<and>\n       (\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               ((Normal \\<sigma>', Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c \\<and>\n                c\\<^sub>s' = LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba.\n                          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>', Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c \\<and>\n                c\\<^sub>s' = LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>\\<sigma>'' \\<Sigma>''.\n           (((Normal \\<sigma>', \\<sigma>''), Normal \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)  \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<longrightarrow>\n           (\\<exists>\\<sigma>. \\<sigma>'' = Normal \\<sigma> \\<and> (\\<exists>\\<Sigma>. \\<Sigma>'' = Normal \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<xi>)) \\<or>\n           (\\<Gamma>\\<^sub>c,(LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c, \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n           (\\<Gamma>\\<^sub>s,(LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)) \\<and>\n       (\\<forall>\\<sigma>'' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Guard f b\\<^sub>c c\\<^sub>c, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and>\n           (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n             (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                     (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                        (\\<exists>v. e = Some v \\<and>\n                             (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Guard f b\\<^sub>s c\\<^sub>s, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*(a, b) \\<and>\n                                    (\\<exists>aa ba.\n                                        \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                        \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (Normal \\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c \\<and>\n                     (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s))))\" \n      by auto\n  qed    \n   \n                       \nlemma Guard_sound:    \n \" \\<xi> \\<subseteq> \\<alpha> \\<Longrightarrow> Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow> \\<forall>s. (s,s)\\<in>G\\<^sub>c \\<Longrightarrow> \n   \\<xi> \\<subseteq> (b\\<^sub>c \\<rightleftharpoons> b\\<^sub>s) \\<Longrightarrow> \\<xi>\\<^sub>1= \\<xi> \\<inter> (b\\<^sub>c \\<odot> b\\<^sub>s) \\<Longrightarrow>  R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow> \n  (\\<Gamma>\\<^sub>c,c\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>  \\<forall>\\<sigma>\\<in>(Domain \\<xi> \\<inter> (-b\\<^sub>c)). (Normal \\<sigma>,Fault f)\\<in>G\\<^sub>c \\<Longrightarrow> \n  (\\<Gamma>\\<^sub>c,Guard f b\\<^sub>c c\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,Guard f b\\<^sub>s c\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (rule, rule, rule)\n  apply (rule Guard_sim)\n  unfolding RGSim_pre_def by blast+\n    \ndefinition f_equiv  (\"_ \\<rightleftharpoons>\\<^sub>f / _\" [81,81] 100) \nwhere\n\"\nf_equiv \\<Gamma>\\<^sub>c \\<Gamma>\\<^sub>s \\<equiv>  (\\<Gamma>\\<^sub>c =None \\<and> \\<Gamma>\\<^sub>s = None) \\<or> ((\\<exists>pc. \\<Gamma>\\<^sub>c = Some pc) \\<and> (\\<exists>ps. \\<Gamma>\\<^sub>s = Some ps))\n\"\n\n\nlemma Call_sim:\n  assumes \n  a1:\"\\<xi> \\<subseteq> \\<alpha> \" and \n  a2:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and \n  a3:\"\\<forall>s. (s, s)\\<in>G\\<^sub>c\" and \n  a4:\" R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n  a5:\"(\\<Gamma>\\<^sub>c pc) \\<rightleftharpoons>\\<^sub>f (\\<Gamma>\\<^sub>s ps)\" and a5':\"\\<Gamma>\\<^sub>c pc = \\<tau> \\<longrightarrow> (\\<forall>\\<sigma>\\<in>Domain \\<xi>. (Normal \\<sigma>, Stuck) \\<in> G\\<^sub>c)\" and  \n  a6:\"(\\<forall>c\\<^sub>c c\\<^sub>s. \\<Gamma>\\<^sub>c pc = Some c\\<^sub>c \\<and> \\<Gamma>\\<^sub>s ps = Some c\\<^sub>s \\<longrightarrow> (\\<Gamma>\\<^sub>c,c\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c\\<^sub>s,R\\<^sub>s,G\\<^sub>s))\" and\n  a8:\"(\\<sigma>,\\<Sigma>)\\<in>\\<xi>\" \nshows  \n  \"(\\<Gamma>\\<^sub>c,(Call pc,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Call ps,Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" \nusing a1 a2  a4  a5 a6  a8 \nproof(coinduction arbitrary: \\<sigma> \\<Sigma>,clarsimp)          \n  {fix \\<sigma>' \\<Sigma>'\n    assume \n       a0:\"(\\<sigma>', \\<Sigma>') \\<in> \\<xi>\" and              \n       a2:\"Sta\\<^sub>s \\<xi> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and          \n       a8:\"\\<xi> \\<subseteq> \\<alpha>\"                              \n    have \"(\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\" and \"(Normal \\<sigma>', Normal \\<Sigma>')\\<in>\\<alpha>\\<^sub>x\"(is \"?x\") \n      using  a0 a8 unfolding alpha_xstate_def by auto    \n    moreover have \"(\\<forall>\\<sigma>'' \\<Sigma>''.\n           (((Normal \\<sigma>', \\<sigma>''), Normal \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>  (\\<sigma>'',\\<Sigma>'')\\<in>\\<alpha>\\<^sub>x  \\<longrightarrow>\n           (\\<exists>\\<sigma>. \\<sigma>'' = Normal \\<sigma> \\<and> (\\<exists>\\<Sigma>. \\<Sigma>'' = Normal \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<xi>)) \\<or> (\\<Gamma>\\<^sub>c,(LanguageCon.com.Call pc, \\<sigma>''),R\\<^sub>c,G\\<^sub>c)\n                 \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(LanguageCon.com.Call ps, \\<Sigma>''),R\\<^sub>s,G\\<^sub>s))\" \n      using env[OF a0 a2 a3 a4] by blast    \n    moreover have \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Call pc, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n                     (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                            (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n                     (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n                     ((Normal \\<sigma>', Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                     (c\\<^sub>c' = LanguageCon.com.Call pc \\<and> c\\<^sub>s' = LanguageCon.com.Call ps \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                      (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"             \n      by (metis CRef.stepc_elim_cases(15) CRef.stepc_elim_cases(16) \n               option.distinct(1) stepc_Normal_elim_cases(9) stepce_stepc) \n    moreover have \"\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Call pc, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                     (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n                     ((Normal \\<sigma>', Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                     (c\\<^sub>c' = LanguageCon.com.Call pc \\<and> c\\<^sub>s' = LanguageCon.com.Call ps \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                      (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\n    proof -\n      {fix c\\<^sub>c' \\<sigma>n'\n        assume  a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Call pc, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n        have guar1:\"((Normal \\<sigma>', Normal \\<sigma>'), Normal \\<Sigma>', Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\"\n          using a3 a0 a8 unfolding related_transitions_def by auto        \n       have h:\"( (\\<exists>c\\<^sub>c. \\<Gamma>\\<^sub>c pc = Some c\\<^sub>c) \\<and> c\\<^sub>c'=the (\\<Gamma>\\<^sub>c pc) \\<and> \\<sigma>n'= \\<sigma>')\" \n         using stepc_elim_cases1(9)[OF a00, \n             of \"(\\<exists>c\\<^sub>c. \\<Gamma>\\<^sub>c pc = Some c\\<^sub>c) \\<and> c\\<^sub>c' = the (\\<Gamma>\\<^sub>c pc) \\<and> \\<sigma>n' = \\<sigma>'\"] \n           by fastforce \n        then obtain c\\<^sub>s where someps:\"\\<Gamma>\\<^sub>s ps = Some c\\<^sub>s\"\n            using a5 unfolding f_equiv_def by auto                       \n        then have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (the (\\<Gamma>\\<^sub>s ps), Normal \\<Sigma>')\" \n          using a5 someps\n          by (metis  option.distinct(1) option.exhaust_sel \n                    r_into_rtranclp rtranclp.rtrancl_refl stepce.Callc)               \n        then have \"(\\<Gamma>\\<^sub>c,c\\<^sub>c',R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n          using someps a6 h by auto\n        then have \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>', Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Call pc \\<and>\n                c\\<^sub>s' = LanguageCon.com.Call ps \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\" \n          using  steps guar1 a6 h  unfolding related_transitions_def RGSim_pre_def  \n          using someps a0 by fastforce\n      } thus ?thesis by auto\n    qed\n    moreover have \n    \"\\<forall>\\<sigma>'' c\\<^sub>c' e.\n       \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Call pc, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n         (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                         (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                                  (\\<exists>v. e = Some v \\<and>\n                                       (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                              (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and>\n                                 (Normal \\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))\" (is ?x)\n    proof-\n      {fix \\<sigma>'' c\\<^sub>c' e\n        assume \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Call pc, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n)\"\n        then have c\\<^sub>c':\"c\\<^sub>c' = Skip\" and \\<sigma>'':\"\\<sigma>'' = Stuck\" and  none:\"\\<Gamma>\\<^sub>c pc = None\" and \"e = None\"\n          by (auto elim: stepc_elim_cases1(9))\n        moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow> (Skip, Stuck)\"\n          using a5 CallUndefinedc calculation unfolding f_equiv_def by auto\n        then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip, Stuck)\" by auto\n        moreover have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Skip, Stuck),R\\<^sub>s,G\\<^sub>s)\"\n          using \\<sigma>'' using sim_not_normal[OF _ _ a4 a3] unfolding alpha_xstate_def by blast\n        moreover have \"(Stuck, Stuck)\\<in>\\<alpha>\\<^sub>x\" unfolding alpha_xstate_def by auto\n        moreover have \"(Normal \\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c\" using a5' none a0 \\<sigma>'' by blast\n        ultimately have \"(\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                        (\\<exists>v. e = Some v \\<and>\n                         (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                    (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                             \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (Normal \\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c \\<and>\n                       (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))\"  by auto\n      } thus ?thesis by auto\n    qed\n    ultimately show \"(Normal \\<sigma>', Normal \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<sigma>', \\<Sigma>') \\<in> \\<alpha> \\<and>\n             (\\<forall>c\\<^sub>c' \\<sigma>n'.\n                 \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Call pc, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n                 (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                     (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n                     (((Normal \\<sigma>', Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (c\\<^sub>c' = LanguageCon.com.Call pc \\<and> c\\<^sub>s' = LanguageCon.com.Call ps \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                      (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n             (\\<forall>v c\\<^sub>c' \\<sigma>n'.\n                 \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Call pc, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n                 (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n                     (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                            (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n                     (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n                     (((Normal \\<sigma>', Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (c\\<^sub>c' = LanguageCon.com.Call pc \\<and> c\\<^sub>s' = LanguageCon.com.Call ps \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                      (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n             (\\<forall>\\<sigma>'' \\<Sigma>''.\n                 (((Normal \\<sigma>', \\<sigma>''), Normal \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<longrightarrow>\n                 (\\<exists>\\<sigma>. \\<sigma>'' = Normal \\<sigma> \\<and> (\\<exists>\\<Sigma>. \\<Sigma>'' = Normal \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<xi>)) \\<or> (\\<Gamma>\\<^sub>c,(LanguageCon.com.Call pc, \\<sigma>''),R\\<^sub>c,G\\<^sub>c)\n                 \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(LanguageCon.com.Call ps, \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)) \\<and>\n             (\\<forall>\\<sigma>'' c\\<^sub>c' e.\n                 \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Call pc, Normal \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n                 (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                         (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                                  (\\<exists>v. e = Some v \\<and>\n                                       (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Call ps, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                              (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and>\n                                 (Normal \\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))) \" \n      by auto\n  }\nqed   \n\n lemma Call_sound:    \n \" \\<xi> \\<subseteq> \\<alpha>  \\<Longrightarrow> Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow>  \\<forall>s. (s, s)\\<in>G\\<^sub>c \\<Longrightarrow> R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow>\n   (\\<Gamma>\\<^sub>c pc) \\<rightleftharpoons>\\<^sub>f (\\<Gamma>\\<^sub>s ps) \\<Longrightarrow> \\<Gamma>\\<^sub>c pc = \\<tau> \\<longrightarrow> (\\<forall>\\<sigma>\\<in>Domain \\<xi>. (Normal \\<sigma>, Stuck) \\<in> G\\<^sub>c) \\<Longrightarrow>\n  (\\<forall>c\\<^sub>c c\\<^sub>s. \\<Gamma>\\<^sub>c pc = Some c\\<^sub>c \\<and> \\<Gamma>\\<^sub>s ps = Some c\\<^sub>s \\<longrightarrow> (\\<Gamma>\\<^sub>c,c\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c\\<^sub>s,R\\<^sub>s,G\\<^sub>s)) \\<Longrightarrow>   \n  (\\<Gamma>\\<^sub>c,Call pc,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,Call ps,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (rule, rule, rule)\n  apply (rule Call_sim)\n  unfolding RGSim_pre_def by auto \n   \ntype_synonym ('sc,'ss,'p,'f,'e) parallel_sim_formula =  \n   \"(('sc,'p,'f,'e) com \\<times>     \n     ('sc,'f) rel \\<times> \n     ('sc,'f) rel \\<times> \n     ('ss,'p,'f,'e) com \\<times> \n     ('ss,'f) rel \\<times>\n     ('ss,'f) rel \\<times>\n     ('sc,'ss) invs \\<times>\n     ('sc,'ss) invs \\<times>\n     ('sc,'ss) invs\n    )\" \n   \n definition Com\\<^sub>c:: \" ('sc,'ss,'p,'f,'e) parallel_sim_formula \\<Rightarrow> ('sc,'p,'f,'e) com\" where\n  \"Com\\<^sub>c f \\<equiv> fst f\"\n\n  definition Rel\\<^sub>c :: \" ('sc,'ss,'p,'f,'e) parallel_sim_formula \\<Rightarrow> (('sc,'f) tran) set\" where\n  \"Rel\\<^sub>c f \\<equiv> fst (snd f)\" \n\n definition Gua\\<^sub>c :: \" ('sc,'ss,'p,'f,'e) parallel_sim_formula \\<Rightarrow> (('sc,'f) tran) set\" where\n  \"Gua\\<^sub>c f \\<equiv> fst (snd (snd f))\" \n  \n definition Com\\<^sub>s:: \" ('sc,'ss,'p,'f,'e) parallel_sim_formula \\<Rightarrow> ('ss,'p,'f,'e) com\" where\n  \"Com\\<^sub>s f \\<equiv> fst (snd (snd (snd f)))\"\n  \n definition Rel\\<^sub>s :: \" ('sc,'ss,'p,'f,'e) parallel_sim_formula \\<Rightarrow> (('ss,'f) tran) set\" where\n  \"Rel\\<^sub>s f \\<equiv>  fst (snd (snd (snd (snd f))))\" \n\n definition Gua\\<^sub>s :: \" ('sc,'ss,'p,'f,'e) parallel_sim_formula \\<Rightarrow> (('ss,'f) tran) set\" where\n  \"Gua\\<^sub>s f \\<equiv>  fst (snd (snd (snd (snd (snd f)))))\"\n \n definition Pre :: \" ('sc,'ss,'p,'f,'e) parallel_sim_formula \\<Rightarrow> ('sc,'ss) invs \" where\n   \"Pre f \\<equiv>  fst (snd (snd (snd (snd (snd (snd f))))))\" \n\n definition PostQ :: \" ('sc,'ss,'p,'f,'e) parallel_sim_formula \\<Rightarrow> ('sc,'ss) invs \" where\n   \"PostQ f \\<equiv>  fst (snd (snd (snd (snd (snd (snd (snd f)))))))\" \n \n definition PostA :: \" ('sc,'ss,'p,'f,'e) parallel_sim_formula \\<Rightarrow> ('sc,'ss) invs \" where\n   \"PostA f \\<equiv>  snd (snd (snd (snd (snd (snd (snd (snd f)))))))\" \n\n    \ndefinition PCom\\<^sub>c :: \"('sc,'ss,'p,'f,'e) parallel_sim_formula list \\<Rightarrow> ('sc,'p,'f,'e) par_com\"\nwhere\n\"PCom\\<^sub>c Ps \\<equiv> map Com\\<^sub>c Ps\"\n\ndefinition PCom\\<^sub>s :: \"('sc,'ss,'p,'f,'e) parallel_sim_formula list \\<Rightarrow> ('ss,'p,'f,'e) par_com\"\nwhere\n\"PCom\\<^sub>s Ps \\<equiv> map Com\\<^sub>s Ps\"\n\ndefinition par_sim_list :: \"(('sc,'ss,'p,'f,'e) parallel_sim_formula  \\<Rightarrow>'b) \\<Rightarrow> \n                           ('sc,'ss,'p,'f,'e) parallel_sim_formula list \\<Rightarrow> 'b list\"\nwhere\n\"par_sim_list f Ps \\<equiv> map f Ps\"\n\n\nlemma ParallelCom_Com:\"i<length xs \\<Longrightarrow> (par_sim_list Com\\<^sub>s xs)!i = Com\\<^sub>s (xs!i)\"\nunfolding par_sim_list_def Com\\<^sub>s_def by fastforce    \n\n\n  \nlemma G_comp_aux': \n\"g\\<subseteq>G \\<and> (s2, s2') \\<in>g\\<^sup>* \\<Longrightarrow> (s2, s2') \\<in> G\\<^sup>*\"\n  by (metis rtrancl_eq_or_trancl trancl_mono)\n\nlemma G_comp_aux: \nassumes a1:\"(\\<Union>j<length g. g ! j) \\<subseteq> G\" and\n        a2:\"(s2, s2') \\<in> (g ! i)\\<^sup>* \" and\n        a3:\"i < length g\"\n      shows \"(s2, s2') \\<in> G\\<^sup>*\"\nusing a1 a2 a3 G_comp_aux'\n  by (metis UN_subset_iff lessThan_iff)\n    \nlemma G_comp_aux1: \nassumes a1:\"g \\<subseteq> G\" and\n        a2:\"(s2, s2') \\<in> g\\<^sup>* \"\n      shows \"(s2, s2') \\<in> G\\<^sup>*\"\nusing a1 a2  G_comp_aux' by metis\n    \nlemma G_comp:\n  assumes a1:\"(\\<Union>j<length G1. (G1 !j)) \\<subseteq> G\\<^sub>1\" and\n          a2:\" (\\<Union>j<length G2. (G2 ! j)) \\<subseteq> G\\<^sub>2\"  and\n          a3:\"((s1, s1'), s2, s2') \\<in> (G1 ! i, (G2 ! i)\\<^sup>*)\\<^sub>\\<alpha>\" and\n          a4:\"i<length G1 \\<and> i< length G2\"\n  shows \"((s1, s1'), s2, s2') \\<in> (G\\<^sub>1, G\\<^sub>2\\<^sup>*)\\<^sub>\\<alpha>\"  \nproof-\n  have \"(s1, s1') \\<in> G\\<^sub>1\" using a1 a3 a4 unfolding related_transitions_def by auto\n  moreover have \"(s2, s2') \\<in> G\\<^sub>2\\<^sup>*\" \n    using a2 a3 a4 G_comp_aux \n    unfolding related_transitions_def by auto\n  ultimately show ?thesis using a3 unfolding related_transitions_def by auto\nqed\n  \nlemma G_comp1:\n  assumes a1:\"G1 \\<subseteq> G\\<^sub>1\" and\n          a2:\" G2 \\<subseteq> G\\<^sub>2\"  and\n          a3:\"((s1, s1'), s2, s2') \\<in> (G1, G2\\<^sup>*)\\<^sub>\\<alpha>\" \n  shows \"((s1, s1'), s2, s2') \\<in> (G\\<^sub>1, G\\<^sub>2\\<^sup>*)\\<^sub>\\<alpha>\"  \nproof-\n  have \"(s1, s1') \\<in> G\\<^sub>1\" using a1 a3  unfolding related_transitions_def by auto\n  moreover have \"(s2, s2') \\<in> G\\<^sub>2\\<^sup>*\" \n    using a2 a3 G_comp_aux1 \n    unfolding related_transitions_def by auto\n  ultimately show ?thesis using a3 unfolding related_transitions_def by auto\nqed  \n    \nlemma sim_comp_not_mod:\n  assumes a0:\"(\\<Gamma>\\<^sub>c, (c\\<^sub>c,s\\<^sub>c),R\\<^sub>c, G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s,s\\<^sub>s),R\\<^sub>s, G\\<^sub>s)\" and\n          a1:\"(((s\\<^sub>c,s\\<^sub>c'),s\\<^sub>s,s\\<^sub>s') \\<in> (R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>  (s\\<^sub>c',s\\<^sub>s')\\<in>\\<alpha>\\<^sub>x\" \n  shows \"(\\<Gamma>\\<^sub>c, (c\\<^sub>c,s\\<^sub>c'),R\\<^sub>c, G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s,s\\<^sub>s'),R\\<^sub>s, G\\<^sub>s)\"\n  using a0 a1 env_sim by blast\n    \n\n \n \nlemma rest_sim: assumes    \n  a0:\"\\<forall>i<length Rels\\<^sub>c.\n       R\\<^sub>c \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. (Guas\\<^sub>c ! j))\n       \\<subseteq> (Rels\\<^sub>c ! i) \\<and>\n       R\\<^sub>s \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. (Guas\\<^sub>s ! j))\n       \\<subseteq> (Rels\\<^sub>s!i)\" and\n    a0':\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and> length Rels\\<^sub>c = length PostsQ \\<and> length Rels\\<^sub>c = length PostsA \\<and>\n         length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s \" and\n    a0''':\"length Rels\\<^sub>c >0\" and\n    a5:\"\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, s\\<^sub>c'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i)\n          \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>) (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, s\\<^sub>s'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" and\n   a0'': \"length Coms\\<^sub>c' = length Coms\\<^sub>s'\" and\n   a01'':\"length Rels\\<^sub>c = length Coms\\<^sub>s'\" and      \n   i_len:\"i<length PostsQ\" and\n   alpha_rel_guar:\"(s1, s1') \\<in> \\<alpha> \\<and>\n                    (((s\\<^sub>c', Normal s1), s\\<^sub>s', Normal s1') \\<in> (Guas\\<^sub>c ! i, (Guas\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                    (\\<Gamma>\\<^sub>c,(c', Normal s1),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                        (\\<Gamma>\\<^sub>s,(c1', Normal s1'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" and\n   step:\"i< length Coms\\<^sub>c'\\<and>\n        (\\<forall>j. j\\<noteq>i \\<longrightarrow> c1!j = (Coms\\<^sub>c'!j)) \\<and> c1!i=c' \"\n   shows \"(\\<forall>i'<length PostsQ. (\\<Gamma>\\<^sub>c,(c1 ! i', Normal s1),Rels\\<^sub>c ! i',Guas\\<^sub>c ! i') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i'\\<^sub>;\\<^sub>PostsA ! i'\\<^sub>)\n                         (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s'[i:=c1'] ! i', Normal s1'),Rels\\<^sub>s ! i',Guas\\<^sub>s ! i'))\"\n     proof-\n       { fix i'\n         assume i'_len:\"i'<length PostsQ\"\n         { assume \"i' = i\" \n           then have \"(\\<Gamma>\\<^sub>c,(c1 ! i', Normal s1),Rels\\<^sub>c ! i',Guas\\<^sub>c ! i') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i'\\<^sub>;\\<^sub>PostsA ! i'\\<^sub>)\n                         (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s'[i:=c1'] ! i', Normal s1'),Rels\\<^sub>s ! i',Guas\\<^sub>s ! i')\"\n           using i'_len alpha_rel_guar step a0' a01'' by auto\n         }\n         moreover { assume i_i':\"i\\<noteq>i'\"                  \n           then have sim:\"(\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i', s\\<^sub>c'),Rels\\<^sub>c ! i',Guas\\<^sub>c ! i') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i'\\<^sub>;\\<^sub>PostsA ! i'\\<^sub>)\n                              (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i', s\\<^sub>s'),Rels\\<^sub>s ! i',Guas\\<^sub>s ! i')\" \n             using step a5 a0' a0'' a01'' i'_len by blast             \n           have rel_alpha:\"(((s\\<^sub>c', Normal s1), s\\<^sub>s',Normal s1') \\<in> (Rels\\<^sub>c ! i', (Rels\\<^sub>s ! i')\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (Normal s1,Normal s1')\\<in>\\<alpha>\\<^sub>x\" \n           proof-\n             {have x:\"((s\\<^sub>c', Normal s1), s\\<^sub>s', Normal s1') \\<in> (Guas\\<^sub>c ! i, (Guas\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>\" \n                using alpha_rel_guar by auto\n              have \"i' < length Rels\\<^sub>c\" using a0' i'_len by auto\n              moreover have \"i < length Guas\\<^sub>c \\<and> i < length Guas\\<^sub>s\" using a0' i_len by auto\n              ultimately have \"Guas\\<^sub>c ! i \\<subseteq> Rels\\<^sub>c ! i' \\<and> Guas\\<^sub>s ! i \\<subseteq> Rels\\<^sub>s ! i'\" \n                using a0 a01'' i_i' by blast \n              then have ?thesis using G_comp1[OF _ _ x, of \"Rels\\<^sub>c ! i'\" \"Rels\\<^sub>s ! i'\"] \n                unfolding alpha_xstate_def by auto\n             } thus ?thesis by auto\n           qed      \n           have \"(\\<Gamma>\\<^sub>c,(c1 ! i', Normal s1),Rels\\<^sub>c ! i',Guas\\<^sub>c ! i') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i'\\<^sub>;\\<^sub>PostsA ! i'\\<^sub>)\n                         (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s'[i:=c1'] ! i', Normal s1'),Rels\\<^sub>s ! i',Guas\\<^sub>s ! i')\"            \n             using i_i' alpha_rel_guar step  \n                  sim_comp_not_mod[OF sim rel_alpha] by auto\n         }\n         ultimately have \"(\\<Gamma>\\<^sub>c,(c1 ! i', Normal s1),Rels\\<^sub>c ! i',Guas\\<^sub>c ! i') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i'\\<^sub>;\\<^sub>PostsA ! i'\\<^sub>)\n                         (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s'[i:=c1'] ! i', Normal s1'),Rels\\<^sub>s ! i',Guas\\<^sub>s ! i')\"\n         using i_len i'_len by fastforce        \n       } thus  ?thesis by auto\n     qed \n\n\nlemma rest_sim_not_normal: assumes      \n    a0':\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and> length Rels\\<^sub>c = length PostsQ \\<and> length Rels\\<^sub>c = length PostsA \\<and>\n         length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s \" and\n   a7:\"\\<forall>i<length Rels\\<^sub>c. Rels\\<^sub>c!i\\<subseteq> 1\\<alpha>\\<^sub>x\" and\n   alpha_rel_guar:\"(s1, s1') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>sn. s1\\<noteq>Normal sn)\" and a6:\"\\<forall>i<length PostsQ. \\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in> (Guas\\<^sub>c ! i)\"\n   shows \"(\\<forall>i'<length PostsQ. (\\<Gamma>\\<^sub>c,(c1 ! i', s1),Rels\\<^sub>c ! i',Guas\\<^sub>c ! i') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i'\\<^sub>;\\<^sub>PostsA ! i'\\<^sub>)\n                         (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s'[i:=c1'] ! i', s1'),Rels\\<^sub>s ! i',Guas\\<^sub>s ! i'))\"\n  by (metis a0' a7  alpha_rel_guar sim_not_normal a6)\n\n    \nlemma par_all_skip_rtran:\n    \"\\<forall>i<length C. \\<Gamma>\\<turnstile>\\<^sub>c (C!i, s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip, s) \\<Longrightarrow> length C > 0 \\<Longrightarrow>\n       \\<exists>C'. \\<Gamma>\\<turnstile>\\<^sub>p (C,s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C', s) \\<and> (\\<forall>i<length C'. C' ! i = Skip) \\<and> C' \\<noteq> []\"\nproof (induction C )\n  case (Nil) thus ?case by auto\nnext\n  case (Cons a as)   \n  {assume a0:\"as=Nil\"    \n   then have \"\\<Gamma>\\<turnstile>\\<^sub>p (a#as, s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a#as[0:=Skip],s)\" \n     using  Cons(2) mult_step_in_par by auto\n   then have ?case using a0\n     by (metis Cons.prems(1) length_Cons length_list_update less_Suc0 list.discI list.size(3) \n               list_update.simps(1) mult_step_in_par nth_list_update_eq) \n  }\n  moreover { fix a1 as1\n    assume a0:\"as=a1#as1\"\n    then have \"\\<forall>i<length (as). \\<Gamma>\\<turnstile>\\<^sub>c (as ! i, s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, s)\" \n      using Cons by auto\n    moreover have \"0 < length as\" using a0 by auto\n    ultimately obtain c'' where \n     x:\"\\<Gamma>\\<turnstile>\\<^sub>p (as, s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c'',s) \\<and> (\\<forall>i<length c''. c'' ! i = LanguageCon.com.Skip) \\<and> c'' \\<noteq> []\"\n      using Cons(1) by auto\n    then have \"\\<Gamma>\\<turnstile>\\<^sub>p (a#as, s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a#c'', s)\" using par_tran_comp_rtran by auto\n    moreover have step_c:\"\\<Gamma>\\<turnstile>\\<^sub>c ((a # c'') ! 0, s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, s)\" using Cons by auto\n    ultimately have \"\\<Gamma>\\<turnstile>\\<^sub>p (a # as, s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip#c'', s)\" \n      using ParComp[of 0 \"a#c''\"] rtranclp.simps\n    proof -\n      have \"\\<Gamma>\\<turnstile>\\<^sub>p (a # c'',s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* ((a # c'')[0 := LanguageCon.com.Skip], s)\"\n        using step_c mult_step_in_par by blast\n      then show ?thesis\n        using \\<open>\\<Gamma>\\<turnstile>\\<^sub>p (a # as, s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a # c'',s)\\<close> by fastforce\n    qed \n    then have ?case using x\n      by (metis (no_types, lifting) length_Cons less_Suc_eq_0_disj list.discI nth_Cons_0 nth_Cons_Suc)  \n  }      \n  ultimately show ?case\n    using list.exhaust by blast\n      \nqed\n\n  \nlemma aaa:\"Suc i< length a \\<Longrightarrow> Suc i< length b \\<Longrightarrow> Suc i< length c \\<Longrightarrow> Suc i<length d \\<Longrightarrow> \nSuc i< length e \\<Longrightarrow> Suc i< length f \\<Longrightarrow> Suc i< length g \\<Longrightarrow> Suc i<length h \\<Longrightarrow> \nP (a!(Suc i)) (b!(Suc i)) (c!(Suc i)) (d!(Suc i)) (e!(Suc i)) (f!(Suc i)) (g!(Suc i)) (h!(Suc i)) \\<Longrightarrow> \nP ((drop 1 a) !i) ((drop 1 b) !i) ((drop 1 c) !i) ((drop 1 d) !i) ((drop 1 e) !i) ((drop 1 f) !i) ((drop 1 g) !i) ((drop 1 h) !i)\"  \n  by fastforce  \n\nlemma bbb:\"length a = length b \\<and> length a = length c \\<and> length a = length d \\<and>\n           length a = length e \\<and> length a = length f \\<and> length a = length g \\<and>\n           length a = length h \\<Longrightarrow>\n          Suc i<length a \\<Longrightarrow> P (a!(Suc i)) (b!(Suc i)) (c!(Suc i)) (d!(Suc i)) (e!(Suc i)) (f!(Suc i)) (g!(Suc i)) (h!(Suc i)) \\<Longrightarrow> \n          P ((drop 1 a) !i) ((drop 1 b) !i) ((drop 1 c) !i) ((drop 1 d) !i) ((drop 1 e) !i) ((drop 1 f) !i) ((drop 1 g) !i) ((drop 1 h) !i)\"\n  using aaa by auto\n  \nlemma ccc:\nassumes a0:\"length a = length b \\<and> length a = length c \\<and> length a = length d \\<and>\n           length a = length e \\<and> length a = length f \\<and> length a = length g \\<and>\n           length a = length h\" and\n        a1:\"\\<forall>i<length a.   P (a!i) (b!i) (c!i) (d!i) (e!i) (f!i) (g!i) (h!i)\"\n      shows  \"\\<forall>i<length (drop 1 a). P ((drop 1 a) !i) ((drop 1 b) !i) ((drop 1 c) !i) ((drop 1 d) !i) ((drop 1 e) !i) ((drop 1 f) !i) ((drop 1 g) !i) ((drop 1 h) !i)\"\nproof -\n  {fix i\n  assume a3:\"i<length (drop 1 a)\"\n  then have a4:\"Suc i < length a\" by auto\n  then have a5:\" P (a!Suc i) (b!Suc i) (c!Suc i) (d!Suc i) (e!Suc i) (f!Suc i) (g!Suc i) (h!Suc i)\" \n    using a1 by auto\n  then have \"P ((drop 1 a) !i) ((drop 1 b) !i) ((drop 1 c) !i) ((drop 1 d) !i) ((drop 1 e) !i) ((drop 1 f) !i) ((drop 1 g) !i) ((drop 1 h) !i)\"   \n    using bbb[OF a0 a4] by auto\n }thus ?thesis by auto\nqed\n \n  \n(* lemma x1:\"\\<forall>i<length C\\<^sub>s'. C\\<^sub>s'!i = Skip \\<Longrightarrow> i< length ((Ca # C\\<^sub>s')[0 := LanguageCon.com.Skip] ) \\<Longrightarrow>\n           (Ca # C\\<^sub>s')[0 := LanguageCon.com.Skip] ! i = LanguageCon.com.Skip\"\n  sorry *)\n  \nlemma  G_in_R_drop:\n  assumes a0:\"\\<forall>i<length R. A \\<union> (\\<Union>a\\<in>{j. j < length G \\<and> j \\<noteq> i}. G ! a) \\<subseteq> R ! i\" and\n          a1:\"length R>0\" and a2:\"length G=length R\"\n  shows\"\\<forall>i<length (drop 1 R). \n        A \\<union> (\\<Union>a\\<in>{j. j < length (drop 1 G) \\<and> j \\<noteq> i}. \n                   (drop 1 G) ! a) \\<subseteq> (drop 1 R) ! i\"        \n  proof-\n  {fix i\n    assume len:\"i<length (drop 1 R)\"             \n    then have r1:       \n    \"A \\<union> (\\<Union>a\\<in>{j. j < length G \\<and> j \\<noteq> (Suc i)}. G ! a) \\<subseteq> R ! (Suc i)\"\n      using a0 by auto\n    have \"(\\<Union>a\\<in>{j. j < length (drop 1 G) \\<and> j \\<noteq> i}. (drop 1 G) ! a) \\<union> G ! 0 = \n         (\\<Union>a\\<in>{j. j < length G \\<and> j \\<noteq> (Suc i)}. G ! a) \"          \n    proof- \n      { fix x\n        assume a0:\"x \\<in> ((\\<Union>a\\<in>{j. j < length (drop 1 G) \\<and> j \\<noteq> i}. (drop 1 G) ! a) \\<union> G ! 0)\"                       \n        then have \"x\\<in>(\\<Union>a\\<in>{j. j < length G \\<and> j \\<noteq> (Suc i)}. G ! a)\"\n          using a0 a1 a2\n          apply auto \n          apply (subgoal_tac \"Suc xa<length G\") \n            by auto               \n      }\n      moreover \n      {fix x\n        fix j\n        assume a00: \"j < length G\" and\n               a01:\"j \\<noteq> Suc i\" and\n               a02:\"x\\<in>G !j\"\n        then have \"(\\<exists>j. j<length (drop 1 G) \\<and> j\\<noteq>i \\<and> x\\<in>(drop 1 G) ! j) \\<or> x \\<in>G ! 0\"             \n        proof-\n          { assume a03:\"j=0\"\n            then have ?thesis using a00 a01 a02 by auto\n          }\n          moreover {\n            assume a03:\"j\\<noteq>0\"            \n            then obtain j' where suc: \"j = Suc j'\" \n              using not_gr_zero gr0_implies_Suc by auto\n            then have \"j'<length G - Suc 0 \\<and> j' \\<noteq> i \\<and> x \\<in> drop (Suc 0) G ! j'\"\n              using a00 a01 a02  by auto                      \n            then have ?thesis using a00 a01 a02  by auto\n          }\n          ultimately show ?thesis by auto\n        qed\n        then have \"x \\<in> ((\\<Union>a\\<in>{j. j < length (drop 1 G) \\<and> j \\<noteq> i}. (drop 1 G)!a) \\<union> G ! 0)\"\n          by auto             \n      }              \n      ultimately show ?thesis by fast qed\n    then have \"(\\<Union>a\\<in>{j. j < length (drop 1 G) \\<and> j \\<noteq> i}. (drop 1 G) ! a) \\<subseteq> \n               (\\<Union>a\\<in>{j. j < length G \\<and> j \\<noteq> (Suc i)}. G ! a)\"\n      by auto\n    then have \"A \\<union> (\\<Union>a\\<in>{j. j < length (drop 1 G) \\<and> j \\<noteq> i}. (drop 1 G) ! a) \\<subseteq> (drop 1 R) ! i\"\n      using r1 len by auto          \n  } thus ?thesis by fastforce\n  qed   \n\nlemma tran_Guar:\n  assumes \n          a1:\"0 < length (Ca # Cs)\" and\n          a2:\" s\\<^sub>s = Normal ns\\<^sub>s\" and\n          a3:\"length (Ca # Cs) = length C\\<^sub>c \\<and> length (Ca # Cs) = length Rels\\<^sub>c\" and\n          a4:\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and>\n              length Rels\\<^sub>c = length PostsQ \\<and>\n              length Rels\\<^sub>c = length PostsA \\<and> length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s\" and\n           a5:\"(((s\\<^sub>c, s\\<^sub>c),(Normal ns1, Normal ns2)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>)\" and\n           a6:\"Guasc = drop 1 Guas\\<^sub>c \\<and> Guass = drop 1 Guas\\<^sub>s \\<and> Postsq = drop 1 PostsQ \\<and> \n             Postsa = drop 1 PostsA \\<and> Csc = drop 1 C\\<^sub>c\" and\n           a7:\"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and>                   \n                    \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns1)\"\n    shows \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n            (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>)\"\nproof-\n  have len:\"0<length Guas\\<^sub>s\" using a7 a1 a3 a4 by auto\n  then have f1:\"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n          (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), ((\\<Union>j<length Guass. (Guass !j))\\<union>(Guas\\<^sub>s!0) )\\<^sup>*)\\<^sub>\\<alpha>)\"\n  using a4 a7 a6 a5 a3 a2 unfolding related_transitions_def\n  apply auto   by (meson in_rtrancl_UnI rtrancl_trans)\n  then have \"(\\<Union>j<length Guass. (Guass !j))\\<union>(Guas\\<^sub>s!0) \\<subseteq>(\\<Union>j<length Guas\\<^sub>s. Guas\\<^sub>s ! j)\"\n  using a6 len by fastforce\n    thus ?thesis using  G_comp1[OF _ _ f1] by auto  \n  qed\n    \nlemma guar_i_rely_j:\n  assumes \n       a0:\"0<length PostsQ\" and\n       a1:\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and>\n          length Rels\\<^sub>c = length PostsQ \\<and>\n          length Rels\\<^sub>c = length PostsA \\<and> length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s\" and\n       a2:\"\\<forall>i<length Rels\\<^sub>c. R\\<^sub>c \\<union> (\\<Union>a\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. Guas\\<^sub>c ! a) \\<subseteq> Rels\\<^sub>c ! i\" and\n       a3:\"\\<forall>i<length Rels\\<^sub>s. R\\<^sub>s \\<union> (\\<Union>a\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. Guas\\<^sub>s ! a) \\<subseteq> Rels\\<^sub>s ! i\" and\n       a4:\"(((s\\<^sub>c, s\\<^sub>c),(Normal ns1, Normal ns2)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (s\\<^sub>c, Normal ns2)\\<in> \\<alpha>\\<^sub>x\"             \n    shows \"\\<forall>i<length Guas\\<^sub>c. i\\<noteq>0 \\<longrightarrow> (((s\\<^sub>c, s\\<^sub>c), Normal ns1, Normal ns2) \\<in> (Rels\\<^sub>c ! i, (Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (s\\<^sub>c, Normal ns2)\\<in> \\<alpha>\\<^sub>x\"\n      \nproof-\n  have inguars:\"\\<forall>i<length Rels\\<^sub>c. i\\<noteq>0 \\<longrightarrow> Guas\\<^sub>c!0 \\<subseteq> Rels\\<^sub>c!i \\<and> Guas\\<^sub>s!0 \\<subseteq> Rels\\<^sub>s!i\"\n  proof-\n    {fix i\n      assume a00:\"i<length Rels\\<^sub>c\"  and a01:\"i\\<noteq>0\"        \n      have lens:\"i<length Rels\\<^sub>s\" using a00 a1 by auto\n      also have \"0<length Guas\\<^sub>c \\<and> 0<length Guas\\<^sub>s\" using a0 a1 by auto\n      ultimately have \"Guas\\<^sub>c!0 \\<subseteq> Rels\\<^sub>c!i \\<and> Guas\\<^sub>s!0 \\<subseteq> Rels\\<^sub>s!i\" using a00 a01 a2 a3 a0 a1 \n      by blast        \n    }thus ?thesis by auto    \n  qed\n  then show ?thesis\n  proof-\n    {fix i\n    assume a00:\"i<length Guas\\<^sub>c\" and a01:\"i\\<noteq>0\"\n    then have \"i<length Rels\\<^sub>c\" using a00 a1 by auto\n    then have \"Guas\\<^sub>c!0 \\<subseteq> Rels\\<^sub>c!i \\<and> Guas\\<^sub>s!0 \\<subseteq> Rels\\<^sub>s!i\" using a01 inguars by fastforce\n    then have \"(((s\\<^sub>c, s\\<^sub>c), Normal ns1, Normal ns2) \\<in> (Rels\\<^sub>c ! i, (Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>)  \\<and> (s\\<^sub>c, Normal ns2)\\<in> \\<alpha>\\<^sub>x\"\n      using G_comp1 a4 by auto }\n    thus ?thesis by auto\n  qed    \nqed\n  \n    \n    \nlemma all_skip_tran:\n  assumes a0:\"\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(C\\<^sub>c ! i, s\\<^sub>c),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>) \n              (\\<Gamma>\\<^sub>s,((Ca # Cs) ! i, s\\<^sub>s),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" and       \n       a1:\"0 < length (Ca # Cs)\" and\n       a2:\"\\<forall>i<length C\\<^sub>c. C\\<^sub>c ! i = LanguageCon.com.Skip\" and\n       a3:\" s\\<^sub>c = Normal ns\\<^sub>c\" and\n       a4:\" s\\<^sub>s = Normal ns\\<^sub>s\" and\n       a5:\"length (Ca # Cs) = length C\\<^sub>c \\<and> length (Ca # Cs) = length Rels\\<^sub>c\" and\n       a6:\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and>\n          length Rels\\<^sub>c = length PostsQ \\<and>\n          length Rels\\<^sub>c = length PostsA \\<and> length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s\" and                     \n       a11:\"\\<forall>i<length PostsQ. Sta\\<^sub>s (PostsQ ! i) (Rels\\<^sub>c ! i, (Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>\" and\n       a12:\"\\<forall>i<length Rels\\<^sub>c. R\\<^sub>c \\<union> (\\<Union>a\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. Guas\\<^sub>c ! a) \\<subseteq> Rels\\<^sub>c ! i\" and\n       a13:\"\\<forall>i<length Rels\\<^sub>s. R\\<^sub>s \\<union> (\\<Union>a\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. Guas\\<^sub>s ! a) \\<subseteq> Rels\\<^sub>s ! i\" and\n       a14:\"(((s\\<^sub>c, s\\<^sub>c),(Normal ns1, Normal ns2)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>)  \\<and>\n            (ns\\<^sub>c, ns2)\\<in>PostsQ!0 \\<and> PostsQ!0\\<subseteq>\\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Ca, Normal ns1) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip,Normal ns2)\" and\n       a15':\"Guasc = drop 1 Guas\\<^sub>c \\<and> Guass = drop 1 Guas\\<^sub>s \\<and> Postsq = drop 1 PostsQ \\<and> \n             Postsa = drop 1 PostsA \\<and> Csc = drop 1 C\\<^sub>c\" and\n       a15:\"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n            (ns\\<^sub>c, ns1)\\<in> (\\<Inter>i<length Postsq.  (Postsq ! i)) \\<and> \n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns1) \\<and> (\\<forall>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Skip) \\<and> C\\<^sub>s' \\<noteq> []\" and\n       a16:\"Cs=Ca1#Cs1\"\n     shows \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n                 (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n            (ns\\<^sub>c, ns2)\\<in> (\\<Inter>i<length PostsQ.  (PostsQ ! i)) \\<and> \n                 (\\<exists>C\\<^sub>s''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s'', Normal ns2) \\<and> (\\<forall>i<length C\\<^sub>s''. C\\<^sub>s'' ! i = Skip) \\<and> C\\<^sub>s'' \\<noteq> [])\"\nproof-  \n  have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n            (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>)\"\n  using tran_Guar[OF a1 a4 a5 a6 _ a15' ] a15 a14 by auto\n  moreover have \"(ns\\<^sub>c, ns2)\\<in> (\\<Inter>i<length PostsQ.  (PostsQ ! i))\"\n  proof-\n    {fix i\n     assume a00: \"i<length PostsQ\" \n     have len:\"0<length PostsQ\"  using a15' a1 a6 a5 by auto         \n    have guars:\"\\<forall>i<length Guas\\<^sub>c. i\\<noteq>0 \\<longrightarrow> ((s\\<^sub>c, s\\<^sub>c), Normal ns1, Normal ns2) \\<in> (Rels\\<^sub>c ! i, (Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha> \\<and> (s\\<^sub>c, Normal ns2)\\<in> \\<alpha>\\<^sub>x\"\n      using guar_i_rely_j[OF len a6 a12 a13 ] a14  a3 unfolding alpha_xstate_def by auto\n    have \"(ns\\<^sub>c, ns2) \\<in> (\\<Inter>i<length Postsq. Postsq ! i)\"\n    proof-\n      {fix i\n        assume a00:\"i<length Postsq\"\n        then have suc:\"Suc i<length PostsQ \\<and> Suc i\\<noteq>0\" using a15' by auto\n        then have \"((s\\<^sub>c, s\\<^sub>c), Normal ns1, Normal ns2) \\<in> (Rels\\<^sub>c ! Suc i, (Rels\\<^sub>s ! Suc i)\\<^sup>*)\\<^sub>\\<alpha>\"\n          using guars a6 by auto\n        also have \"(ns\\<^sub>c, ns1)\\<in> (PostsQ ! Suc i)\" using a15 a15' suc by auto\n        ultimately have \"(ns\\<^sub>c, ns2) \\<in> PostsQ ! (Suc i)\"\n          using a3 a11 suc guars unfolding Sta\\<^sub>s_def by fast    \n        then have \"(ns\\<^sub>c, ns2) \\<in> Postsq ! i\"  using suc a00 a15' by auto           \n      }thus ?thesis by auto\n    qed      \n    then have \"(ns\\<^sub>c, ns2)\\<in>(PostsQ ! i)\" using a14 a15' a00              \n      by (cases i, auto)\n    } thus ?thesis by auto\n  qed\n  moreover have \"\\<exists>C\\<^sub>s'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns2) \\<and> (\\<forall>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Skip) \\<and> C\\<^sub>s' \\<noteq> []\"\n  proof-\n    have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca#Cs, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Ca#C\\<^sub>s', Normal ns1)\"\n      using a15 by (simp add: par_tran_comp_rtran)    \n    then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* ((Ca#C\\<^sub>s')[0:=Skip], Normal ns2)\"\n      using a14 par_tran_comp_rtran a15 mult_step_in_par[of \\<Gamma>\\<^sub>s \"Ca#C\\<^sub>s'\" 0 \"Normal ns1\" \"Skip\" \"Normal ns2\"]\n      by auto        \n    moreover have \"(\\<forall>i<length ((Ca # C\\<^sub>s')[0 := LanguageCon.com.Skip]). \n        ((Ca # C\\<^sub>s')[0 := LanguageCon.com.Skip]) ! i = Skip)\"      \n    proof -\n      {fix i\n        assume a00:\"i<length  ((Ca # C\\<^sub>s')[0 := LanguageCon.com.Skip])\"\n        then have \"(Ca # C\\<^sub>s')[0 := LanguageCon.com.Skip] ! i = LanguageCon.com.Skip\"\n          using a15  apply (cases i) by auto\n      }  thus ?thesis by auto      \n    qed\n    moreover have \"((Ca # C\\<^sub>s')[0 := LanguageCon.com.Skip]) \\<noteq> []\" by auto      \n    ultimately show ?thesis by auto\n  qed    \n  ultimately show ?thesis by auto\nqed\n\nlemma all_throw_tran:\n  assumes    \n       a1:\"0 < length (Ca # Cs)\" and  a3:\" s\\<^sub>c = Normal ns\\<^sub>c\" and               \n       a4:\" s\\<^sub>s = Normal ns\\<^sub>s\" and\n       a5:\"length (Ca # Cs) = length C\\<^sub>c \\<and> length (Ca # Cs) = length Rels\\<^sub>c\" and\n       a6:\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and>\n          length Rels\\<^sub>c = length PostsQ \\<and>\n          length Rels\\<^sub>c = length PostsA \\<and> length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s\" and                    \n       a14:\"(((s\\<^sub>c, s\\<^sub>c),(Normal ns1, Normal ns2)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n            (ns\\<^sub>c,  ns2)\\<in>PostsA!0 \\<and> PostsA!0\\<subseteq>\\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Ca, Normal ns1) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw,Normal ns2)\" and\n       a15':\"Guasc = drop 1 Guas\\<^sub>c \\<and> Guass = drop 1 Guas\\<^sub>s \\<and> Postsq = drop 1 PostsQ \\<and> \n             Postsa = drop 1 PostsA \\<and> Csc = drop 1 C\\<^sub>c\" and\n       a15:\"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n            (ns\\<^sub>c, ns1)\\<in> (\\<Inter>i<length Postsq.  (Postsq ! i)) \\<and> \n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns1) \\<and> (\\<forall>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Skip) \\<and> C\\<^sub>s' \\<noteq> []\"\n     shows \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n                 (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n            (ns\\<^sub>c, ns2)\\<in>  (\\<Union>i<length PostsA.  (PostsA ! i)) \\<and> \n                 (\\<exists>C\\<^sub>s''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s'', Normal ns2)  \\<and> \n                    final_c (C\\<^sub>s'', Normal ns2) \\<and> (\\<exists>i<length C\\<^sub>s''. C\\<^sub>s'' ! i = LanguageCon.com.Throw))\"\nproof-  \n  have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n            (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>)\"\n  using tran_Guar[OF a1 a4 a5 a6 _ a15' ] a15 a14 by auto\n  moreover have \"(ns\\<^sub>c,  ns2)\\<in> (\\<Union>i<length PostsA.  (PostsA ! i))\"\n    using a14 a1 a6 a5 by auto  \n  moreover have \"\\<exists>C\\<^sub>s'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns2) \\<and> \n                      final_c (C\\<^sub>s', Normal ns2) \\<and> \n                      (\\<exists>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Throw)\"\n  proof-\n    have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca#Cs, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Ca#C\\<^sub>s', Normal ns1)\"\n      using a15 by (simp add: par_tran_comp_rtran)    \n    then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* ((Ca#C\\<^sub>s')[0:=Throw], Normal ns2)\"\n      using a14 par_tran_comp_rtran a15 mult_step_in_par[of \\<Gamma>\\<^sub>s \"Ca#C\\<^sub>s'\" 0 \"Normal ns1\" \"Throw\" \"Normal ns2\"]\n      by auto        \n    moreover have \"final_c ((Ca # C\\<^sub>s')[0 := Throw], Normal ns2) \\<and> \n                    (\\<exists>i<length ((Ca # C\\<^sub>s')[0 := Throw]). ((Ca # C\\<^sub>s')[0 := Throw]) ! i = Throw)\"      \n    proof -\n      have \"final_c ((Ca # C\\<^sub>s')[0 := LanguageCon.com.Throw], Normal ns2)\"\n        unfolding final_c_def final_def \n        proof (auto)          \n        {fix i\n          assume a00:\"i < Suc (length C\\<^sub>s')\" and\n                 a01:\"(LanguageCon.com.Throw # C\\<^sub>s') ! i \\<noteq> LanguageCon.com.Throw\"\n          then have \"(LanguageCon.com.Throw # C\\<^sub>s') ! i = LanguageCon.com.Skip\"\n            using a15  apply (cases i) by auto\n        } \n        then show \"\\<And>i. i < Suc (length C\\<^sub>s') \\<Longrightarrow>\n           (LanguageCon.com.Throw # C\\<^sub>s') ! i \\<noteq> LanguageCon.com.Throw \\<Longrightarrow>\n           (LanguageCon.com.Throw # C\\<^sub>s') ! i = LanguageCon.com.Skip\" by auto     \n        qed then show ?thesis by fastforce\n    qed    \n     ultimately show ?thesis by fastforce\n  qed\n  ultimately show ?thesis by auto\nqed\n\nlemma all_throw_tran':\n  assumes    \n       a1:\"0 < length (Ca # Cs)\" and  a3:\" s\\<^sub>c = Normal ns\\<^sub>c\" and        \n       a4:\" s\\<^sub>s = Normal ns\\<^sub>s\" and\n       a5:\"length (Ca # Cs) = length C\\<^sub>c \\<and> length (Ca # Cs) = length Rels\\<^sub>c\" and\n       a6:\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and>\n          length Rels\\<^sub>c = length PostsQ \\<and>\n          length Rels\\<^sub>c = length PostsA \\<and> length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s\" and                    \n       a14:\"(((s\\<^sub>c, s\\<^sub>c),(Normal ns1, Normal ns2)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n            (ns\\<^sub>c, ns2)\\<in>PostsA!0 \\<and> PostsA!0\\<subseteq>\\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Ca, Normal ns1) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw,Normal ns2)\" and\n       a15':\"Guasc = drop 1 Guas\\<^sub>c \\<and> Guass = drop 1 Guas\\<^sub>s \\<and> Postsq = drop 1 PostsQ \\<and> \n             Postsa = drop 1 PostsA \\<and> Csc = drop 1 C\\<^sub>c\" and\n       a15:\"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n             (ns\\<^sub>c, ns1) \\<in> (\\<Union>i<length Postsa. Postsa ! i) \\<and> \n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns1) \\<and> final_c (C\\<^sub>s', Normal ns1) \\<and>\n                    (\\<exists>i<length C\\<^sub>s'. C\\<^sub>s' ! i = LanguageCon.com.Throw)\"\n     shows \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n                 (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n            (ns\\<^sub>c, ns2)\\<in>  (\\<Union>i<length PostsA.  (PostsA ! i)) \\<and> \n                 (\\<exists>C\\<^sub>s''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s'', Normal ns2)  \\<and> \n                    final_c (C\\<^sub>s'', Normal ns2) \\<and> (\\<exists>i<length C\\<^sub>s''. C\\<^sub>s'' ! i = LanguageCon.com.Throw))\"\nproof-  \n  have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n            (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>)\"\n  using tran_Guar[OF a1 a4 a5 a6 _  ] a15 a14 a15' by auto\n  moreover have \"(ns\\<^sub>c, ns2)\\<in> (\\<Union>i<length PostsA.  (PostsA ! i))\"\n    using a14 a1 a6 a5 by auto  \n  moreover have \"\\<exists>C\\<^sub>s'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns2) \\<and> \n                      final_c (C\\<^sub>s', Normal ns2) \\<and> \n                      (\\<exists>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Throw)\"\n  proof-\n    have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca#Cs, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Ca#C\\<^sub>s', Normal ns1)\"\n      using a15 by (simp add: par_tran_comp_rtran)    \n    then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* ((Ca#C\\<^sub>s')[0:=Throw], Normal ns2)\"\n      using a14 par_tran_comp_rtran a15 mult_step_in_par[of \\<Gamma>\\<^sub>s \"Ca#C\\<^sub>s'\" 0 \"Normal ns1\" \"Throw\" \"Normal ns2\"]\n      by auto        \n    moreover have \"final_c ((Ca # C\\<^sub>s')[0 := Throw], Normal ns2) \\<and> \n                    (\\<exists>i<length ((Ca # C\\<^sub>s')[0 := Throw]). ((Ca # C\\<^sub>s')[0 := Throw]) ! i = Throw)\"      \n    proof -\n      have \"final_c ((Ca # C\\<^sub>s')[0 := LanguageCon.com.Throw], Normal ns2)\"  \n        unfolding final_c_def\n        proof (auto)          \n        {fix i\n          assume a00:\"i < Suc (length C\\<^sub>s')\"                \n          then have \"final ((LanguageCon.com.Throw # C\\<^sub>s') ! i, Normal ns2)\"\n            using a15 unfolding final_c_def final_def apply (cases i) by auto\n        } \n        then show \"\\<And>i. i < Suc (length C\\<^sub>s') \\<Longrightarrow>\n         SmallStepCon.final ((LanguageCon.com.Throw # C\\<^sub>s') ! i, Normal ns2)\" by auto     \n        qed then show ?thesis by fastforce\n    qed    \n     ultimately show ?thesis by fastforce\n  qed\n  ultimately show ?thesis by auto\nqed\n  \nlemma all_throw_tran'':\n  assumes    \n       a1:\"0 < length (Ca # Cs)\" and  a3:\" s\\<^sub>c = Normal ns\\<^sub>c\" and               \n       a4:\" s\\<^sub>s = Normal ns\\<^sub>s\" and\n       a5:\"length (Ca # Cs) = length C\\<^sub>c \\<and> length (Ca # Cs) = length Rels\\<^sub>c\" and\n       a6:\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and>\n          length Rels\\<^sub>c = length PostsQ \\<and>\n          length Rels\\<^sub>c = length PostsA \\<and> length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s\" and                    \n       a10:\"\\<forall>i<length PostsA. Sta\\<^sub>s (PostsA ! i) (Rels\\<^sub>c ! i, (Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>\" and\n       a12:\"\\<forall>i<length Rels\\<^sub>c. R\\<^sub>c \\<union> (\\<Union>a\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. Guas\\<^sub>c ! a) \\<subseteq> Rels\\<^sub>c ! i\" and\n       a13:\"\\<forall>i<length Rels\\<^sub>s. R\\<^sub>s \\<union> (\\<Union>a\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. Guas\\<^sub>s ! a) \\<subseteq> Rels\\<^sub>s ! i\" and\n       a14:\"(((s\\<^sub>c, s\\<^sub>c),(Normal ns1, Normal ns2)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n            (ns\\<^sub>c, ns2)\\<in>PostsQ!0 \\<and> PostsQ!0\\<subseteq>\\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Ca, Normal ns1) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip,Normal ns2)\" and\n       a15':\"Guasc = drop 1 Guas\\<^sub>c \\<and> Guass = drop 1 Guas\\<^sub>s \\<and> Postsq = drop 1 PostsQ \\<and> \n             Postsa = drop 1 PostsA \\<and> Csc = drop 1 C\\<^sub>c\" and\n       a15:\"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n             (ns\\<^sub>c, ns1) \\<in> (\\<Union>i<length Postsa. Postsa ! i) \\<and> \n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns1) \\<and> final_c (C\\<^sub>s', Normal ns1) \\<and>\n                    (\\<exists>i<length C\\<^sub>s'. C\\<^sub>s' ! i = LanguageCon.com.Throw)\"\n     shows \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n                 (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n            (ns\\<^sub>c, ns2)\\<in>  (\\<Union>i<length PostsA.  (PostsA ! i)) \\<and> \n                 (\\<exists>C\\<^sub>s''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s'', Normal ns2)  \\<and> \n                    final_c (C\\<^sub>s'', Normal ns2) \\<and> (\\<exists>i<length C\\<^sub>s''. C\\<^sub>s'' ! i = LanguageCon.com.Throw))\"\nproof-    \n  have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n            (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>)\"\n  using tran_Guar[OF a1 a4 a5 a6 _  ] a15 a14 a15' by auto\n  moreover have \"(ns\\<^sub>c,  ns2)\\<in> (\\<Union>i<length PostsA.  (PostsA ! i))\"    \n  proof-    \n     have len:\"0<length PostsQ\"  using a15' a1 a6 a5 by auto    \n    have guars:\"\\<forall>i<length Guas\\<^sub>c. i\\<noteq>0 \\<longrightarrow> ((s\\<^sub>c, s\\<^sub>c), Normal ns1, Normal ns2) \\<in> (Rels\\<^sub>c ! i, (Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha> \\<and> (s\\<^sub>c, Normal ns2)\\<in> \\<alpha>\\<^sub>x\"\n      using guar_i_rely_j[OF len a6 a12 a13 ] a14 a3 unfolding alpha_xstate_def by auto\n            \n    have \"(ns\\<^sub>c,  ns2) \\<in> (\\<Union>i<length Postsa. Postsa ! i)\"          \n    proof-\n      obtain i where i_post:\"i<length Postsa \\<and> (ns\\<^sub>c,  ns1) \\<in> Postsa ! i\"    \n        using a15 by auto\n      then have suc:\"Suc i<length PostsA \\<and> Suc i\\<noteq>0\" using a15' by auto\n      then have \"((s\\<^sub>c, s\\<^sub>c), Normal ns1, Normal ns2) \\<in> (Rels\\<^sub>c ! Suc i, (Rels\\<^sub>s ! Suc i)\\<^sup>*)\\<^sub>\\<alpha>\"\n        using guars a6 by auto\n      also have \"(ns\\<^sub>c,  ns1)\\<in> (PostsA ! Suc i)\" \n        using a15 a15' suc i_post by force\n      ultimately have \"(ns\\<^sub>c,  ns2) \\<in> PostsA ! (Suc i)\"\n        using a10 suc guars a3 unfolding Sta\\<^sub>s_def by fast    \n      then have \"i<length Postsa \\<and>(ns\\<^sub>c,  ns2) \\<in> Postsa ! i\"  using i_post suc a15' by auto           \n      thus ?thesis by auto\n    qed        \n    thus ?thesis using a15' by auto\n  qed  \n  moreover have \"\\<exists>C\\<^sub>s'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns2) \\<and> \n                      final_c (C\\<^sub>s', Normal ns2) \\<and> \n                      (\\<exists>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Throw)\"\n  proof-\n    have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca#Cs, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Ca#C\\<^sub>s', Normal ns1)\"\n      using a15 by (simp add: par_tran_comp_rtran)    \n    then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* ((Ca#C\\<^sub>s')[0:=Skip], Normal ns2)\"\n      using a14 par_tran_comp_rtran a15 mult_step_in_par[of \\<Gamma>\\<^sub>s \"Ca#C\\<^sub>s'\" 0 \"Normal ns1\" \"Skip\" \"Normal ns2\"]\n      by auto        \n    moreover have \"final_c ((Ca # C\\<^sub>s')[0 := Skip], Normal ns2) \\<and> \n                    (\\<exists>i<length ((Ca # C\\<^sub>s')[0 := Skip]). ((Ca # C\\<^sub>s')[0 := Skip]) ! i = Throw)\"      \n    proof -\n      have \"final_c ((Ca # C\\<^sub>s')[0 := Skip], Normal ns2)\"  \n        unfolding final_c_def\n        proof (auto)          \n        {fix i\n          assume a00:\"i < Suc (length C\\<^sub>s')\"                \n          then have \"final ((LanguageCon.com.Skip # C\\<^sub>s') ! i, Normal ns2)\"\n            using a15 unfolding final_c_def final_def apply (cases i) by auto\n        } \n        then show \"\\<And>i. i < Suc (length C\\<^sub>s') \\<Longrightarrow>\n         SmallStepCon.final ((LanguageCon.com.Skip # C\\<^sub>s') ! i, Normal ns2)\" by auto     \n      qed\n      moreover have \"(\\<exists>i<length ((Ca # C\\<^sub>s')[0 := Skip]). ((Ca # C\\<^sub>s')[0 := Skip]) ! i = Throw)\"\n      using a15 by auto        \n      ultimately show ?thesis by fastforce qed      \n     ultimately show ?thesis by fastforce\n  qed\n  ultimately show ?thesis  by  auto\nqed\n    \n  \nlemma \"(n,n1)  \\<in> a\\<^sup>* \\<Longrightarrow>\n       (n1,n2) \\<in> b\\<^sup>* \\<Longrightarrow>\n       (n,n2)\\<in>(a \\<union> b)\\<^sup>*\"\n  by (meson in_rtrancl_UnI rtrancl_trans)\n  \nlemma guars_i_rels_0:\n  assumes a0:\"Cs=Ca1#Cs1\" and       \n          a1:\"0 < length (Ca # Cs)\" and \n          a2:\"length (Ca # Cs) = length C\\<^sub>c \\<and> length (Ca # Cs) = length Rels\\<^sub>c\" and\n          a3:\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and>\n              length Rels\\<^sub>c = length PostsQ \\<and>\n              length Rels\\<^sub>c = length PostsA \\<and>\n              length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s\" and\n          a4:\"\\<forall>i<length Rels\\<^sub>c.\n       R\\<^sub>c \\<union> (\\<Union>a\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. Guas\\<^sub>c ! a) \\<subseteq> Rels\\<^sub>c ! i\" and\n          a5:\"\\<forall>i<length Rels\\<^sub>s.\n       R\\<^sub>s \\<union> (\\<Union>a\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. Guas\\<^sub>s ! a) \\<subseteq> Rels\\<^sub>s ! i\" and\n          a6:\"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (((\\<Union>j<length (drop 1 Guas\\<^sub>c). ((drop 1 Guas\\<^sub>c) !j)), (\\<Union>j<length (drop 1 Guas\\<^sub>s). ((drop 1 Guas\\<^sub>s) !j))\\<^sup>*)\\<^sub>\\<alpha>)\"\n  shows \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> (Rels\\<^sub>c!0, (Rels\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>\"  \nproof-\n    let ?Guasc = \"(drop 1 Guas\\<^sub>c)\"\n    let ?Guass = \"(drop 1 Guas\\<^sub>s)\"\n    have \"length Guas\\<^sub>c > Suc 0\" using a0 a1 a2 a3 by auto\n    then have guasc_sub:\"(\\<Union>j<length ?Guasc. (?Guasc !j)) \\<subseteq> (\\<Union>x\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> 0}. Guas\\<^sub>c ! x)\"\n      using Suc_less_eq2 by fastforce\n    have \"length Rels\\<^sub>c > 0\" using a1 a2 by auto\n    then have \"R\\<^sub>c \\<union> (\\<Union>x\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> 0}. Guas\\<^sub>c ! x) \\<subseteq> Rels\\<^sub>c ! 0\" \n      using  a4 by auto\n    then have a00:\"(\\<Union>j<length ?Guasc. (?Guasc !j)) \\<subseteq> Rels\\<^sub>c!0\"\n      using guasc_sub by blast\n    have \"length Guas\\<^sub>s > Suc 0\" using a0 a1 a2 a3 by auto\n    then have guass_sub:\"(\\<Union>j<length ?Guass. (?Guass !j)) \\<subseteq> (\\<Union>x\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> 0}. Guas\\<^sub>s ! x)\"\n      using Suc_less_eq2 by fastforce\n    have \"length Rels\\<^sub>s > 0\" using a0 a1 a2 a3 by auto\n    then have \"R\\<^sub>s \\<union> (\\<Union>x\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> 0}. Guas\\<^sub>s ! x) \\<subseteq> Rels\\<^sub>s ! 0\" \n      using  a5 by auto\n    then have a1:\"(\\<Union>j<length ?Guass. (?Guass !j)) \\<subseteq> Rels\\<^sub>s!0\"\n      using guass_sub by blast \n    show ?thesis using a6 G_comp1[OF a00 a1] by auto\n  qed        \n  \nlemma par_all_skip_rtran_gen1:\n    \"\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(C\\<^sub>c ! i, s\\<^sub>c),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>) \n                  (\\<Gamma>\\<^sub>s,(C\\<^sub>s ! i, s\\<^sub>s),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i) \\<Longrightarrow> \n      length C\\<^sub>s > 0 \\<Longrightarrow>\n     (\\<forall>i<length C\\<^sub>c. C\\<^sub>c ! i = LanguageCon.com.Skip) \\<Longrightarrow>\n      s\\<^sub>c = Normal ns\\<^sub>c \\<Longrightarrow>\n      s\\<^sub>s = Normal ns\\<^sub>s \\<Longrightarrow>\n      length C\\<^sub>s = length C\\<^sub>c \\<and> length C\\<^sub>s = length Rels\\<^sub>c \\<Longrightarrow> \n      length Rels\\<^sub>c = length Guas\\<^sub>c \\<and> length Rels\\<^sub>c = length PostsQ \\<and> \n      length Rels\\<^sub>c = length PostsA \\<and> length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s \\<Longrightarrow>\n      (\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)) \\<subseteq> G\\<^sub>c \\<Longrightarrow>\n      (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j)) \\<subseteq> G\\<^sub>s \\<Longrightarrow>      \n       \\<forall>i<length PostsA. Sta\\<^sub>s (PostsA!i) (Rels\\<^sub>c!i, (Rels\\<^sub>s!i)\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow> \n       \\<forall>i<length PostsQ. Sta\\<^sub>s (PostsQ!i) (Rels\\<^sub>c!i, (Rels\\<^sub>s!i)\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow>\n       \\<forall>i<length Rels\\<^sub>c.\n          R\\<^sub>c \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. (Guas\\<^sub>c ! j))\n            \\<subseteq> (Rels\\<^sub>c ! i) \\<Longrightarrow>\n       \\<forall>i<length Rels\\<^sub>s.   \n          R\\<^sub>s \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. (Guas\\<^sub>s ! j))\n            \\<subseteq> (Rels\\<^sub>s!i) \\<Longrightarrow>\n     \\<exists>C\\<^sub>s' ns1. ((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n               (ns\\<^sub>c,  ns1)\\<in> (\\<Inter>i<length PostsQ.  (PostsQ ! i)) \\<and> \n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (C\\<^sub>s,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns1) \\<and> (\\<forall>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Skip) \\<and> C\\<^sub>s' \\<noteq> []\"\nproof (induction C\\<^sub>s arbitrary: C\\<^sub>c Rels\\<^sub>c Guas\\<^sub>c Rels\\<^sub>s Guas\\<^sub>s PostsQ PostsA s\\<^sub>s)\n  case (Nil) thus ?case by auto\nnext\n  case (Cons Ca Cs)   \n  {assume a0:\"Cs=Nil\"  \n    then have sim:\"(\\<Gamma>\\<^sub>c,(Skip, s\\<^sub>c),Rels\\<^sub>c ! 0,Guas\\<^sub>c ! 0) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! 0\\<^sub>;\\<^sub>PostsA ! 0\\<^sub>) \n                  (\\<Gamma>\\<^sub>s,(Ca, s\\<^sub>s),Rels\\<^sub>s ! 0,Guas\\<^sub>s ! 0)\" using Cons(4,3,7,2,8) by fastforce        \n    obtain ns1 where sim_res:\"(((s\\<^sub>c, s\\<^sub>c),(s\\<^sub>s, Normal ns1)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n              (ns\\<^sub>c,  ns1)\\<in>PostsQ!0 \\<and> PostsQ!0\\<subseteq>\\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Ca, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip,Normal ns1)\"\n      using  Cons(5) sim_elim_cases_c(1)[OF sim] by auto\n    then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* ((Ca # Cs)[0:=Skip], Normal ns1) \\<and> \n               (\\<forall>i<length ((Ca # Cs)[0:=Skip]). ((Ca # Cs)[0:=Skip])! i = LanguageCon.com.Skip) \\<and> \n               (Ca # Cs)[0:=Skip] \\<noteq> []\" using ParComp[OF Cons(3), of \\<Gamma>\\<^sub>s  ]\n      by (metis (no_types, lifting) a0 length_Cons length_list_update linorder_neqE_nat list.size(3) \n                                   mult_step_in_par not_less_eq not_less_zero nth_Cons_0 nth_list_update) \n    moreover have \"(((s\\<^sub>c, s\\<^sub>c),(s\\<^sub>s, Normal ns1)) \\<in> \n       (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>))\" \n      using sim_res Cons(9,10,3,7,8)\n      by (metis G_comp1 SUP_upper lessThan_iff)        \n    moreover have \"(ns\\<^sub>c,  ns1)\\<in> (\\<Inter>i<length PostsQ.  (PostsQ ! i))\"  \n    proof-\n      have \"length PostsQ = 1\" using a0 Cons(7,8) by auto      \n      then show ?thesis using sim_res by auto\n    qed         \n   ultimately have ?case using Cons(13) a0 by fastforce \n  }\n  moreover {     \n    fix Ca1 Cs1\n    assume a0:\"Cs=Ca1#Cs1\"\n    define Guasc where \"Guasc = drop 1 Guas\\<^sub>c\"\n    define Guass where \"Guass = drop 1 Guas\\<^sub>s\"\n    define Relsc where \"Relsc = drop 1 Rels\\<^sub>c\"\n    define Relss where \"Relss = drop 1 Rels\\<^sub>s\"\n    define Postsq where \"Postsq = drop 1 PostsQ\" \n    define Postsa where \"Postsa = drop 1 PostsA\"\n    define Csc where \"Csc = drop 1 C\\<^sub>c\"    \n    have a00:\"length PostsQ = length C\\<^sub>c \\<and>\n    length PostsQ = length Rels\\<^sub>c \\<and>\n    length PostsQ = length Rels\\<^sub>s \\<and>\n    length PostsQ = length Guas\\<^sub>c \\<and>\n    length PostsQ = length Guas\\<^sub>s \\<and>\n    length PostsQ = length (Ca # Cs) \\<and> length PostsQ = length PostsA\" \n      using Cons(3,7,8) a0 by auto    \n    then have len_g0: \"length Rels\\<^sub>c > 0 \\<and> length Guas\\<^sub>c > 0 \\<and> length Rels\\<^sub>s > 0 \\<and> length Guas\\<^sub>s > 0\"\n      using Cons(3) by auto\n    have lens:\"length Cs = length Guasc \\<and> length Cs = length Guass \\<and>  length Cs = length Relsc \\<and>\n               length Cs = length Relss \\<and> length Cs = length Postsq \\<and> length Cs = length Postsa \\<and>\n               length Cs = length Csc\"               \n      using Cons(3,7,8) a0 unfolding Guasc_def Guass_def Relsc_def Relss_def Postsq_def Postsa_def Csc_def \n      by (metis One_nat_def Suc_pred length_Cons length_drop old.nat.inject)    \n    have len_ga:\"(\\<forall>i<length Guasc. Guasc!i = Guas\\<^sub>c ! (i+1)) \\<and> \n                    (\\<forall>i<length Guass. Guass!i = Guas\\<^sub>s ! (i+1)) \\<and> \n                    (\\<forall>i<length Relsc. Relsc!i = Rels\\<^sub>c ! (i+1)) \\<and>\n                    (\\<forall>i<length Relss. Relss!i = Rels\\<^sub>s ! (i+1)) \\<and> \n                    (\\<forall>i<length Postsq. Postsq!i = PostsQ ! (i+1)) \\<and>\n                    (\\<forall>i<length Postsa. Postsa!i = PostsA ! (i+1)) \\<and>\n                    (\\<forall>i<length Csc. Csc!i = C\\<^sub>c ! (i+1))\"\n      unfolding Guasc_def Guass_def Relsc_def Relss_def Postsq_def Postsa_def Csc_def by auto\n    have \"\\<exists>C\\<^sub>s' ns1. ((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n               (ns\\<^sub>c,  ns1)\\<in> (\\<Inter>i<length Postsq.  (Postsq ! i)) \\<and> \n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns1) \\<and> (\\<forall>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Skip) \\<and> C\\<^sub>s' \\<noteq> []\"        \n    proof-   \n      let ?p =\"\\<lambda> a b c d e f g h. (\\<Gamma>\\<^sub>c,(b, s\\<^sub>c),c,e)\n       \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>a\\<^sub>;\\<^sub>h\\<^sub>)\n       (\\<Gamma>\\<^sub>s,(g, s\\<^sub>s),d,f)\"\n      have s0:\"\\<forall>i<length Postsq. (\\<Gamma>\\<^sub>c,(Csc ! i, s\\<^sub>c),Relsc ! i,Guasc ! i) \n             \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>Postsq ! i\\<^sub>;\\<^sub>Postsa ! i\\<^sub>) (\\<Gamma>\\<^sub>s,(Cs ! i, s\\<^sub>s),Relss ! i,Guass ! i)\"  \n        using ccc[OF a00,of ?p] Cons(2)\n        unfolding Guasc_def Guass_def Relsc_def Relss_def Postsq_def Postsa_def Csc_def\n        by auto            \n      have s1:\"0 < length Cs\" using a0 by auto\n      have s2:\"\\<forall>i<length Csc. Csc ! i = LanguageCon.com.Skip\" \n        using Cons(4) unfolding Csc_def by auto\n      have s3:\"length Cs = length Csc \\<and> length Cs = length Relsc\"    \n        using lens by auto\n      have s4:\"length Relsc = length Guasc \\<and>\n            length Relsc = length Postsq \\<and>\n            length Relsc = length Postsa \\<and>\n            length Relsc = length Guass \\<and> length Relsc = length Relss\"    \n        using lens by fastforce\n      have s5:\"(\\<Union>a<length Guasc. Guasc ! a) \\<subseteq> G\\<^sub>c\" \n        using Cons(9)  unfolding Guasc_def by fastforce\n      \n      have s7:\"(\\<Union>a<length Guass. Guass ! a) \\<subseteq> G\\<^sub>s\"\n        using Cons(10) unfolding Guass_def by fastforce\n      have s8:\"\\<forall>i<length Postsa. Sta\\<^sub>s (Postsa ! i) (Relsc ! i, (Relss ! i)\\<^sup>*)\\<^sub>\\<alpha> \" \n        using Cons(11) len_ga lens unfolding Postsa_def by force\n      have s9:\"\\<forall>i<length Postsq. Sta\\<^sub>s (Postsq ! i) (Relsc ! i, (Relss ! i)\\<^sup>*)\\<^sub>\\<alpha>\"\n        using Cons(12) len_ga lens unfolding Postsq_def by force\n      have s10:\"\\<forall>i<length Relsc.\n         R\\<^sub>c \\<union> (\\<Union>a\\<in>{j. j < length Guasc \\<and> j \\<noteq> i}. Guasc ! a) \\<subseteq> Relsc ! i\"\n        using G_in_R_drop[OF Cons(13)] len_g0 a00 unfolding Guasc_def Relsc_def\n        by auto      \n      have s11:\"\\<forall>i<length Relss.\n             R\\<^sub>s \\<union> (\\<Union>a\\<in>{j. j < length Guass \\<and> j \\<noteq> i}. Guass ! a) \\<subseteq> Relss ! i\"\n      using G_in_R_drop[OF Cons(14)] len_g0 a00 unfolding Guass_def Relss_def\n        by auto        \n    show ?thesis \n      using Cons(1)[OF s0 s1 s2 Cons(5)  Cons(6) s3 s4 s5 s7 s8 s9 s10 s11] \n      by auto\n  qed \n  then obtain C\\<^sub>s' ns1 \n    where hyp_step:\"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n            (ns\\<^sub>c, ns1)\\<in> (\\<Inter>i<length Postsq.  (Postsq ! i)) \\<and> \n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns1) \\<and> (\\<forall>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Skip) \\<and> C\\<^sub>s' \\<noteq> [] \"\n    by auto   \n  moreover have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (Rels\\<^sub>c!0, (Rels\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha> \\<and> (s\\<^sub>c, Normal ns1) \\<in> \\<alpha>\\<^sub>x\"\n    using guars_i_rels_0[OF a0 Cons(3,7,8,13,14)] Cons(5) hyp_step \n    unfolding Guass_def Guasc_def alpha_xstate_def by auto\n  then have sim:\"(\\<Gamma>\\<^sub>c,(Skip, s\\<^sub>c),Rels\\<^sub>c ! 0,Guas\\<^sub>c ! 0) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! 0\\<^sub>;\\<^sub>PostsA ! 0\\<^sub>) \n             (\\<Gamma>\\<^sub>s,((Ca # Cs) ! 0,  Normal ns1),Rels\\<^sub>s ! 0,Guas\\<^sub>s ! 0)\"  \n    using Cons(2) Cons(4,7)  dest_sim_env_step a00 by fastforce \n  obtain ns2 where sim_res:\n      \"(((s\\<^sub>c, s\\<^sub>c),(Normal ns1, Normal ns2)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n       (ns\\<^sub>c, ns2)\\<in>PostsQ!0 \\<and> PostsQ!0\\<subseteq>\\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Ca, Normal ns1) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip,Normal ns2)\"\n    using  Cons(5) sim_elim_cases_c(1)[OF sim] by auto    \n  have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n                 (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n            (ns\\<^sub>c,  ns2)\\<in> (\\<Inter>i<length PostsQ.  (PostsQ ! i)) \\<and> \n                 (\\<exists>C\\<^sub>s''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p ((Ca # Cs),s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s'', Normal ns2) \\<and> (\\<forall>i<length C\\<^sub>s''. C\\<^sub>s'' ! i = Skip) \\<and> C\\<^sub>s'' \\<noteq> [])\"\n    using all_skip_tran[OF Cons(2-8) Cons(12-14) sim_res _  hyp_step a0] \n    unfolding Guasc_def Guass_def Postsq_def Postsa_def by auto\n    then have ?case by auto\n  }      \n  ultimately show ?case using list.exhaust by blast      \nqed\n  \nlemma cs_skip_tran:\n assumes a0:\"\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(C\\<^sub>c ! i, s\\<^sub>c),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n            (\\<Gamma>\\<^sub>s,((Ca # Cs) ! i, s\\<^sub>s),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" and\n         a1:\"0 < length (Ca # Cs)\" and a1':\"Cs=Ca1#Cs1\" and         \n         a2:\"C\\<^sub>c = cca#ccs\" and a2':\"cca = Throw \\<and> (\\<forall>i<length ccs. ccs!i = Skip)\" and\n         a3:\"s\\<^sub>c = Normal ns\\<^sub>c\" and\n         a4:\"s\\<^sub>s = Normal ns\\<^sub>s\" and\n         a5:\"length (Ca # Cs) = length C\\<^sub>c \\<and> length (Ca # Cs) = length Rels\\<^sub>c\" and\n         a6:\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and>\n             length Rels\\<^sub>c = length PostsQ \\<and>\n             length Rels\\<^sub>c = length PostsA \\<and> length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s\" and\n         a7:\"(\\<Union>a<length Guas\\<^sub>c. Guas\\<^sub>c ! a) \\<subseteq> G\\<^sub>c\" and\n         a9:\"(\\<Union>a<length Guas\\<^sub>s. Guas\\<^sub>s ! a) \\<subseteq> G\\<^sub>s \" and\n         a10:\"\\<forall>i<length PostsA. Sta\\<^sub>s (PostsA ! i) (Rels\\<^sub>c ! i, (Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>\" and\n         a11:\"\\<forall>i<length PostsQ. Sta\\<^sub>s (PostsQ ! i) (Rels\\<^sub>c ! i, (Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>\" and\n         a12:\"\\<forall>i<length Rels\\<^sub>c. R\\<^sub>c \\<union> (\\<Union>a\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. Guas\\<^sub>c ! a) \\<subseteq> Rels\\<^sub>c ! i\" and\n         a13:\"\\<forall>i<length Rels\\<^sub>s. R\\<^sub>s \\<union> (\\<Union>a\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. Guas\\<^sub>s ! a) \\<subseteq> Rels\\<^sub>s ! i\"          \n       shows \"\\<exists>ns1'. \n            (((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1') \\<in> (\\<Union>a<length Guas\\<^sub>c. Guas\\<^sub>c ! a, (\\<Union>a<length Guas\\<^sub>s. Guas\\<^sub>s ! a)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n           (ns\\<^sub>c,  ns1') \\<in> (\\<Union>a<length PostsA. PostsA ! a) \\<and>\n           (\\<exists>c''. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c'', Normal ns1')) \\<and>\n                  (final_c (c'', Normal ns1')) \\<and> (\\<exists>i<length c''. c'' ! i = LanguageCon.com.Throw))\"\nproof-\n  define Guasc where \"Guasc = drop 1 Guas\\<^sub>c\"\n  define Guass where \"Guass = drop 1 Guas\\<^sub>s\"\n  define Relsc where \"Relsc = drop 1 Rels\\<^sub>c\"\n  define Relss where \"Relss = drop 1 Rels\\<^sub>s\"\n  define Postsq where \"Postsq = drop 1 PostsQ\" \n  define Postsa where \"Postsa = drop 1 PostsA\"\n  define Csc where \"Csc = drop 1 C\\<^sub>c\"\n  then have a00:\"length PostsQ = length C\\<^sub>c \\<and>\n                 length PostsQ = length Rels\\<^sub>c \\<and>\n                 length PostsQ = length Rels\\<^sub>s \\<and>\n                 length PostsQ = length Guas\\<^sub>c \\<and>\n                 length PostsQ = length Guas\\<^sub>s \\<and>\n                 length PostsQ = length (Ca # Cs) \\<and> \n                 length PostsQ = length PostsA\" \n    using a6 a5 by auto\n  then have len_g0: \"length Rels\\<^sub>c > 0 \\<and> length Guas\\<^sub>c > 0 \\<and> length Rels\\<^sub>s > 0 \\<and> length Guas\\<^sub>s > 0\"\n      using a1 by auto\n  have lens:\"length Cs = length Guasc \\<and> length Cs = length Guass \\<and>  length Cs = length Relsc \\<and>\n             length Cs = length Relss \\<and> length Cs = length Postsq \\<and> length Cs = length Postsa \\<and>\n             length Cs = length Csc\"               \n    using a00 a1 a6  unfolding Guasc_def Guass_def Relsc_def Relss_def Postsq_def Postsa_def Csc_def \n    by (metis One_nat_def Suc_pred length_Cons length_drop old.nat.inject)\n  have len_ga:\"(\\<forall>i<length Guasc. Guasc!i = Guas\\<^sub>c ! (i+1)) \\<and> \n                  (\\<forall>i<length Guass. Guass!i = Guas\\<^sub>s ! (i+1)) \\<and> \n                  (\\<forall>i<length Relsc. Relsc!i = Rels\\<^sub>c ! (i+1)) \\<and>\n                  (\\<forall>i<length Relss. Relss!i = Rels\\<^sub>s ! (i+1)) \\<and> \n                  (\\<forall>i<length Postsq. Postsq!i = PostsQ ! (i+1)) \\<and>\n                  (\\<forall>i<length Postsa. Postsa!i = PostsA ! (i+1)) \\<and>\n                  (\\<forall>i<length Csc. Csc!i = C\\<^sub>c ! (i+1))\"\n    unfolding Guasc_def Guass_def Relsc_def Relss_def Postsq_def Postsa_def Csc_def by auto      \n  have hyp_step:\"\\<exists>C\\<^sub>s' ns1. ((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n               (ns\\<^sub>c, ns1)\\<in> (\\<Inter>i<length Postsq.  (Postsq ! i)) \\<and> \n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns1) \\<and> (\\<forall>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Skip) \\<and> C\\<^sub>s' \\<noteq> []\"        \n    proof-   \n      let ?p =\"\\<lambda> a b c d e f g h. (\\<Gamma>\\<^sub>c,(b, s\\<^sub>c),c,e)\n       \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>a\\<^sub>;\\<^sub>h\\<^sub>)\n       (\\<Gamma>\\<^sub>s,(g, s\\<^sub>s),d,f)\"\n      have s0:\"\\<forall>i<length Postsq. (\\<Gamma>\\<^sub>c,(Csc ! i, s\\<^sub>c),Relsc ! i,Guasc ! i) \n             \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>Postsq ! i\\<^sub>;\\<^sub>Postsa ! i\\<^sub>) (\\<Gamma>\\<^sub>s,(Cs ! i, s\\<^sub>s),Relss ! i,Guass ! i)\"  \n        using ccc[OF a00,of ?p] a0\n        unfolding Guasc_def Guass_def Relsc_def Relss_def Postsq_def Postsa_def Csc_def\n        by auto            \n      have s1:\"0 < length Cs\" using a1' by auto\n      have s2:\"\\<forall>i<length Csc. Csc ! i = LanguageCon.com.Skip\" \n        using a2' a2 unfolding Csc_def by auto\n      have s3:\"length Cs = length Csc \\<and> length Cs = length Relsc\"    \n        using lens by auto\n      have s4:\"length Relsc = length Guasc \\<and>\n            length Relsc = length Postsq \\<and>\n            length Relsc = length Postsa \\<and>\n            length Relsc = length Guass \\<and> length Relsc = length Relss\"    \n        using lens by auto\n      have s5:\"(\\<Union>a<length Guasc. Guasc ! a) \\<subseteq> G\\<^sub>c\" \n        using a7 unfolding Guasc_def by fastforce     \n      have s7:\"(\\<Union>a<length Guass. Guass ! a) \\<subseteq> G\\<^sub>s\"\n        using a9 unfolding Guass_def by fastforce\n      have s8:\"\\<forall>i<length Postsa. Sta\\<^sub>s (Postsa ! i) (Relsc ! i, (Relss ! i)\\<^sup>*)\\<^sub>\\<alpha> \" \n        using a10 len_ga lens unfolding Postsa_def by auto\n      have s9:\"\\<forall>i<length Postsq. Sta\\<^sub>s (Postsq ! i) (Relsc ! i, (Relss ! i)\\<^sup>*)\\<^sub>\\<alpha>\"\n        using a11 len_ga lens unfolding Postsq_def by auto\n      have s10:\"\\<forall>i<length Relsc.\n         R\\<^sub>c \\<union> (\\<Union>a\\<in>{j. j < length Guasc \\<and> j \\<noteq> i}. Guasc ! a) \\<subseteq> Relsc ! i\"\n         using G_in_R_drop[OF a12] len_g0 a00 unfolding Guasc_def Relsc_def\n        by auto          \n      have s11:\"\\<forall>i<length Relss.\n             R\\<^sub>s \\<union> (\\<Union>a\\<in>{j. j < length Guass \\<and> j \\<noteq> i}. Guass ! a) \\<subseteq> Relss ! i\"\n       using G_in_R_drop[OF a13] len_g0 a00 unfolding Guass_def Relss_def\n        by auto\n    show ?thesis \n      using par_all_skip_rtran_gen1 [OF s0 s1 s2 a3  a4 s3 s4 s5  s7 s8 s9 s10 s11] \n      by auto\n  qed\n  then obtain C\\<^sub>s' ns1 \n    where hyp_step:\"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n            (ns\\<^sub>c,  ns1)\\<in> (\\<Inter>i<length Postsq.  (Postsq ! i)) \\<and> \n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s', Normal ns1) \\<and> (\\<forall>i<length C\\<^sub>s'. C\\<^sub>s' ! i = Skip) \\<and> C\\<^sub>s' \\<noteq> [] \"\n    by auto       \n  moreover have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (Rels\\<^sub>c!0, (Rels\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha> \\<and> (s\\<^sub>c, Normal ns1)\\<in>\\<alpha>\\<^sub>x\" \n    using guars_i_rels_0[OF a1' a1 a5 a6 a12 a13] hyp_step using a3\n    unfolding Guass_def Guasc_def alpha_xstate_def by auto    \n  moreover then have sim:\"(\\<Gamma>\\<^sub>c,(Throw, Normal ns\\<^sub>c),Rels\\<^sub>c ! 0,Guas\\<^sub>c ! 0) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! 0\\<^sub>;\\<^sub>PostsA ! 0\\<^sub>) \n             (\\<Gamma>\\<^sub>s,((Ca # Cs) ! 0,  Normal ns1),Rels\\<^sub>s ! 0,Guas\\<^sub>s ! 0)\"  \n    using a0 a2 a2' a5  a3 dest_sim_env_step a00 by fastforce \n  obtain ns2 where sim_res:\n      \"(((s\\<^sub>c, s\\<^sub>c),(Normal ns1, Normal ns2)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n       (ns\\<^sub>c,  ns2)\\<in>PostsA!0 \\<and> PostsA!0\\<subseteq>\\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Ca, Normal ns1) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw,Normal ns2)\"\n    using  a3 sim_elim_cases_c(2)[OF sim] by auto\n   have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2) \\<in> \n                 (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n            (ns\\<^sub>c,  ns2)\\<in> (\\<Union>i<length PostsA.  (PostsA ! i)) \\<and> \n                 (\\<exists>C\\<^sub>s''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p ((Ca # Cs),s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (C\\<^sub>s'', Normal ns2) \\<and> \n                    final_c (C\\<^sub>s'', Normal ns2) \\<and> (\\<exists>i<length C\\<^sub>s''. C\\<^sub>s'' ! i = LanguageCon.com.Throw))\"\n    using all_throw_tran[OF a1 a3 a4 a5 a6 sim_res _] hyp_step\n    unfolding Guasc_def Guass_def Postsq_def Postsa_def by auto\n  thus ?thesis by auto\nqed\n    \nlemma par_throw_rtran_gen1:\n    \"\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(C\\<^sub>c ! i, s\\<^sub>c),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>) \n                  (\\<Gamma>\\<^sub>s,(C\\<^sub>s ! i, s\\<^sub>s),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i) \\<Longrightarrow> \n      length C\\<^sub>s > 0 \\<Longrightarrow>\n      final_c (C\\<^sub>c, s\\<^sub>c) \\<and>  (\\<exists>i<length C\\<^sub>c. C\\<^sub>c ! i = LanguageCon.com.Throw) \\<Longrightarrow>\n      s\\<^sub>c = Normal ns\\<^sub>c \\<Longrightarrow>\n      s\\<^sub>s = Normal ns\\<^sub>s \\<Longrightarrow>\n      length C\\<^sub>s = length C\\<^sub>c \\<and> length C\\<^sub>s = length Rels\\<^sub>c \\<Longrightarrow> \n      length Rels\\<^sub>c = length Guas\\<^sub>c \\<and> length Rels\\<^sub>c = length PostsQ \\<and> \n      length Rels\\<^sub>c = length PostsA \\<and> length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s \\<Longrightarrow>\n      (\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)) \\<subseteq> G\\<^sub>c \\<Longrightarrow>      \n      (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j)) \\<subseteq> G\\<^sub>s \\<Longrightarrow>      \n       \\<forall>i<length PostsA. Sta\\<^sub>s (PostsA!i) (Rels\\<^sub>c!i, (Rels\\<^sub>s!i)\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow> \n       \\<forall>i<length PostsQ. Sta\\<^sub>s (PostsQ!i) (Rels\\<^sub>c!i, (Rels\\<^sub>s!i)\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow>\n       \\<forall>i<length Rels\\<^sub>c.\n          R\\<^sub>c \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. (Guas\\<^sub>c ! j))\n            \\<subseteq> (Rels\\<^sub>c ! i) \\<Longrightarrow>\n       \\<forall>i<length Rels\\<^sub>s.   \n          R\\<^sub>s \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. (Guas\\<^sub>s ! j))\n            \\<subseteq> (Rels\\<^sub>s!i) \\<Longrightarrow>\n     \\<exists>ns1'. ((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1') \\<in> (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                (ns\\<^sub>c,  ns1') \\<in> (\\<Union>i<length PostsA.  (PostsA ! i)) \\<and>                \n                (\\<exists>c''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (C\\<^sub>s, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c'', Normal ns1') \\<and>\n                       final_c (c'', Normal ns1') \\<and> (\\<exists>i<length c''. c'' ! i = LanguageCon.com.Throw))\"\nproof (induction C\\<^sub>s arbitrary: C\\<^sub>c Rels\\<^sub>c Guas\\<^sub>c Rels\\<^sub>s Guas\\<^sub>s PostsQ PostsA s\\<^sub>s)\n  case (Nil) thus ?case by auto\nnext\n  case (Cons Ca Cs)   \n  {assume a0:\"Cs=Nil\"   \n   then have \"C\\<^sub>c!0 = Throw\" using Cons(4,7) unfolding final_c_def final_def\n      using a0 less_Suc0 by auto   \n    then have sim:\"(\\<Gamma>\\<^sub>c,(Throw, Normal ns\\<^sub>c),Rels\\<^sub>c ! 0,Guas\\<^sub>c ! 0) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! 0\\<^sub>;\\<^sub>PostsA ! 0\\<^sub>) \n                  (\\<Gamma>\\<^sub>s,(Ca, s\\<^sub>s),Rels\\<^sub>s ! 0,Guas\\<^sub>s ! 0)\" using Cons(4,5,3,7,2,8) a0  by fastforce\n    obtain ns1 where sim_res:\"(((s\\<^sub>c, s\\<^sub>c),(s\\<^sub>s, Normal ns1)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n              (ns\\<^sub>c,  ns1)\\<in>PostsA!0 \\<and> PostsA!0\\<subseteq>\\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Ca, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw,Normal ns1)\"\n      using  Cons(5) sim_elim_cases_c(2)[OF sim] by auto\n    then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* ((Ca # Cs)[0:=Throw], Normal ns1) \\<and> \n               (\\<forall>i<length ((Ca # Cs)[0:=Throw]). ((Ca # Cs)[0:=Throw])! i = LanguageCon.com.Throw) \\<and> \n               (Ca # Cs)[0:=Throw] \\<noteq> []\" using ParComp[OF Cons(3), of \\<Gamma>\\<^sub>s  ]\n      by (metis (no_types, lifting) a0 length_Cons length_list_update linorder_neqE_nat list.size(3) \n                                   mult_step_in_par not_less_eq not_less_zero nth_Cons_0 nth_list_update) \n    moreover have \"(((s\\<^sub>c, s\\<^sub>c),(s\\<^sub>s, Normal ns1)) \\<in> \n       (((\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)), (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s !j))\\<^sup>*)\\<^sub>\\<alpha>))\" \n      using sim_res Cons(9,10,3,7,8)\n      by (metis G_comp1 SUP_upper lessThan_iff)        \n    moreover have \"(ns\\<^sub>c,  ns1)\\<in> (\\<Union>i<length PostsA.  (PostsA ! i))\"  \n    proof-\n      have \"length PostsA = 1\" using a0 Cons(7,8) by auto      \n      then show ?thesis using sim_res by auto\n    qed         \n   ultimately have ?case using Cons(13) a0 unfolding final_c_def final_def by fastforce \n  } note x = this\n  {     \n    fix Ca1 Cs1\n    assume a0:\"Cs=Ca1#Cs1\"\n    define Guasc where \"Guasc = drop 1 Guas\\<^sub>c\"\n    define Guass where \"Guass = drop 1 Guas\\<^sub>s\"\n    define Relsc where \"Relsc = drop 1 Rels\\<^sub>c\"\n    define Relss where \"Relss = drop 1 Rels\\<^sub>s\"\n    define Postsq where \"Postsq = drop 1 PostsQ\" \n    define Postsa where \"Postsa = drop 1 PostsA\"\n    define Csc where \"Csc = drop 1 C\\<^sub>c\"\n    then have a00:\"length PostsQ = length C\\<^sub>c \\<and>\n    length PostsQ = length Rels\\<^sub>c \\<and>\n    length PostsQ = length Rels\\<^sub>s \\<and>\n    length PostsQ = length Guas\\<^sub>c \\<and>\n    length PostsQ = length Guas\\<^sub>s \\<and>\n    length PostsQ = length (Ca # Cs) \\<and> length PostsQ = length PostsA\" \n      using Cons(3,7,8) by auto\n    then have len_g0: \"length Rels\\<^sub>c > 0 \\<and> length Guas\\<^sub>c > 0 \\<and> length Rels\\<^sub>s > 0 \\<and> length Guas\\<^sub>s > 0\"\n       by auto\n    then have lens:\"length Cs = length Guasc \\<and> length Cs = length Guass \\<and>  length Cs = length Relsc \\<and>\n               length Cs = length Relss \\<and> length Cs = length Postsq \\<and> length Cs = length Postsa \\<and>\n               length Cs = length Csc\"               \n      using Cons(3,7,8) a0 unfolding Guasc_def Guass_def Relsc_def Relss_def Postsq_def Postsa_def Csc_def \n      by (metis One_nat_def Suc_pred length_Cons length_drop old.nat.inject)\n    have len_ga:\"(\\<forall>i<length Guasc. Guasc!i = Guas\\<^sub>c ! (i+1)) \\<and> \n                    (\\<forall>i<length Guass. Guass!i = Guas\\<^sub>s ! (i+1)) \\<and> \n                    (\\<forall>i<length Relsc. Relsc!i = Rels\\<^sub>c ! (i+1)) \\<and>\n                    (\\<forall>i<length Relss. Relss!i = Rels\\<^sub>s ! (i+1)) \\<and> \n                    (\\<forall>i<length Postsq. Postsq!i = PostsQ ! (i+1)) \\<and>\n                    (\\<forall>i<length Postsa. Postsa!i = PostsA ! (i+1)) \\<and>\n                    (\\<forall>i<length Csc. Csc!i = C\\<^sub>c ! (i+1))\"\n      unfolding Guasc_def Guass_def Relsc_def Relss_def Postsq_def Postsa_def Csc_def by auto\n    obtain cca ccs where cc:\"C\\<^sub>c=cca#ccs\" using a0 Cons(7)\n      by (metis Cons.prems(3) Cons_nth_drop_Suc drop_0 gr_implies_not_zero neq0_conv) \n    {\n      assume css_skip:\"\\<forall>i<length ccs. ccs!i = Skip\" \n      then have cca:\"cca = Throw \\<and> (\\<forall>i<length ccs. ccs!i = Skip)\" \n        using css_skip Cons(4) cc less_Suc_eq_0_disj \n        unfolding final_c_def final_def  by fastforce\n      have ?case using cs_skip_tran[OF Cons(2-3) a0 cc cca Cons(5-14)] by auto\n    }\n    moreover{\n      assume  css_throw: \"\\<not>(\\<forall>i<length ccs. ccs!i = Skip)\"\n      then have ccs_throw:\"\\<exists>i<length ccs. ccs!i = Throw\" \n        using Cons(4) unfolding final_c_def cc final_def by fastforce\n      have hyp_step:\n           \"\\<exists>ns1. ((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                  (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n                  (ns\\<^sub>c,  ns1)\\<in> (\\<Union>i<length Postsa.  (Postsa ! i)) \\<and> \n                  (\\<exists>c''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c'', Normal ns1) \\<and>\n                    final_c (c'', Normal ns1) \\<and>\n                    (\\<exists>i<length c''. c'' ! i = LanguageCon.com.Throw))\"\n       proof-\n         let ?p =\"\\<lambda> a b c d e f g h. (\\<Gamma>\\<^sub>c,(b, s\\<^sub>c),c,e) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>a\\<^sub>;\\<^sub>h\\<^sub>) (\\<Gamma>\\<^sub>s,(g, s\\<^sub>s),d,f)\"\n         have s0:\"\\<forall>i<length Postsq. (\\<Gamma>\\<^sub>c,(Csc ! i, s\\<^sub>c),Relsc ! i,Guasc ! i) \n             \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>Postsq ! i\\<^sub>;\\<^sub>Postsa ! i\\<^sub>) (\\<Gamma>\\<^sub>s,(Cs ! i, s\\<^sub>s),Relss ! i,Guass ! i)\"  \n          using ccc[OF a00,of ?p] Cons(2)\n          unfolding Guasc_def Guass_def Relsc_def Relss_def Postsq_def Postsa_def Csc_def\n          by auto        \n        have s1:\"0 < length Cs\" using a0 by auto\n        have s2:\"final_c (Csc,s\\<^sub>c) \\<and> (\\<exists>i<length Csc. Csc!i = Throw)\" \n          using Cons(4) ccs_throw cc\n          unfolding Csc_def final_c_def final_def by auto\n        have s3:\"length Cs = length Csc \\<and> length Cs = length Relsc\"    \n          using lens by auto\n        have s4:\"length Relsc = length Guasc \\<and>\n              length Relsc = length Postsq \\<and>\n              length Relsc = length Postsa \\<and>\n              length Relsc = length Guass \\<and> length Relsc = length Relss\"    \n          using lens by auto\n        have s5:\"(\\<Union>a<length Guasc. Guasc ! a) \\<subseteq> G\\<^sub>c\" \n          using Cons(9)  unfolding Guasc_def by fastforce        \n        have s7:\"(\\<Union>a<length Guass. Guass ! a) \\<subseteq> G\\<^sub>s\"\n          using Cons(10) unfolding Guass_def by fastforce\n        have s8:\"\\<forall>i<length Postsa. Sta\\<^sub>s (Postsa ! i) (Relsc ! i, (Relss ! i)\\<^sup>*)\\<^sub>\\<alpha> \" \n          using Cons(11) len_ga lens unfolding Postsa_def by force\n        have s9:\"\\<forall>i<length Postsq. Sta\\<^sub>s (Postsq ! i) (Relsc ! i, (Relss ! i)\\<^sup>*)\\<^sub>\\<alpha>\"\n          using Cons(12) len_ga lens unfolding Postsq_def by force\n        have s10:\"\\<forall>i<length Relsc.\n          R\\<^sub>c \\<union> (\\<Union>a\\<in>{j. j < length Guasc \\<and> j \\<noteq> i}. Guasc ! a) \\<subseteq> Relsc ! i\"\n          using G_in_R_drop[OF Cons(13)] len_g0 a00 unfolding Guasc_def Relsc_def\n          by auto\n        have s11:\"\\<forall>i<length Relss.\n             R\\<^sub>s \\<union> (\\<Union>a\\<in>{j. j < length Guass \\<and> j \\<noteq> i}. Guass ! a) \\<subseteq> Relss ! i\"\n          using G_in_R_drop[OF Cons(14)] len_g0 a00 unfolding Guass_def Relss_def\n          by auto\n        show ?thesis using Cons(1)[OF s0 s1 s2 Cons(5)  Cons(6) s3 s4 s5 s7 s8 s9 s10 s11] \n          by auto\n      qed\n      then obtain c'' ns1 where hyp_step:\"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                  (((\\<Union>j<length Guasc. (Guasc !j)), (\\<Union>j<length Guass. (Guass !j))\\<^sup>*)\\<^sub>\\<alpha>) \\<and> \n                  (ns\\<^sub>c,  ns1)\\<in> (\\<Union>i<length Postsa.  (Postsa ! i)) \\<and> \n                   \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Cs,s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c'', Normal ns1) \\<and>\n                    final_c (c'', Normal ns1) \\<and>\n                    (\\<exists>i<length c''. c'' ! i = LanguageCon.com.Throw)\" by auto\n      moreover have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns1) \\<in> \n                 (Rels\\<^sub>c!0, (Rels\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha> \\<and> (s\\<^sub>c,Normal ns1)\\<in>\\<alpha>\\<^sub>x\"\n      using guars_i_rels_0[OF a0 Cons(3,7,8,13,14)] hyp_step Cons(5)\n      unfolding Guass_def Guasc_def unfolding alpha_xstate_def by auto\n      then have sim:\"(\\<Gamma>\\<^sub>c,(C\\<^sub>c!0, s\\<^sub>c),Rels\\<^sub>c ! 0,Guas\\<^sub>c ! 0) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! 0\\<^sub>;\\<^sub>PostsA ! 0\\<^sub>) \n             (\\<Gamma>\\<^sub>s,((Ca # Cs) ! 0,  Normal ns1),Rels\\<^sub>s ! 0,Guas\\<^sub>s ! 0)\"  \n        using Cons(2) Cons(4,7)  \n          dest_sim_env_step[of \\<Gamma>\\<^sub>c \"C\\<^sub>c!0\" s\\<^sub>c \"Rels\\<^sub>c ! 0\" \"Guas\\<^sub>c ! 0\" _ _ _ \\<Gamma>\\<^sub>s \"(Ca # Cs) ! 0\" s\\<^sub>s] \n         a00 by fastforce\n      then have \"C\\<^sub>c!0 = Skip \\<or> C\\<^sub>c!0 = Throw\"\n        using Cons(4) unfolding final_c_def cc final_def by fastforce         \n      moreover{\n        assume \"C\\<^sub>c!0 = Skip\" \n        then have sim:\"(\\<Gamma>\\<^sub>c,(Skip, s\\<^sub>c),Rels\\<^sub>c ! 0,Guas\\<^sub>c ! 0) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! 0\\<^sub>;\\<^sub>PostsA ! 0\\<^sub>) \n                        (\\<Gamma>\\<^sub>s,((Ca # Cs) ! 0,  Normal ns1),Rels\\<^sub>s ! 0,Guas\\<^sub>s ! 0)\" \n          using sim by auto\n        then obtain ns2 where sim_res:\"(((s\\<^sub>c, s\\<^sub>c),(Normal ns1, Normal ns2)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                 (ns\\<^sub>c,  ns2)\\<in>PostsQ!0 \\<and> PostsQ!0\\<subseteq>\\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Ca, Normal ns1) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip,Normal ns2)\"\n          using  Cons(5)  sim_elim_cases_c(1)[OF sim] by auto\n         have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2)\n           \\<in> ((\\<Union>a<length Guas\\<^sub>c.\n                  Guas\\<^sub>c ! a, (\\<Union>a<length Guas\\<^sub>s. Guas\\<^sub>s ! a)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n           (ns\\<^sub>c,  ns2) \\<in> (\\<Union>a<length PostsA. PostsA ! a) \\<and>\n           (\\<exists>c''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c'', Normal ns2) \\<and>\n                  final_c (c'', Normal ns2) \\<and>\n                  (\\<exists>i<length c''. c'' ! i = LanguageCon.com.Throw))\" \n        using all_throw_tran''[OF Cons(3) Cons(5)  Cons(6) Cons(7-8) Cons(11,13,14)  sim_res]   hyp_step \n          unfolding Guasc_def Guass_def Postsq_def Postsa_def by fast           \n        then have ?case by auto\n      }\n      moreover{\n        assume \"C\\<^sub>c!0 = Throw\"\n        then have sim:\"(\\<Gamma>\\<^sub>c,(Throw, Normal ns\\<^sub>c),Rels\\<^sub>c ! 0,Guas\\<^sub>c ! 0) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! 0\\<^sub>;\\<^sub>PostsA ! 0\\<^sub>) \n                        (\\<Gamma>\\<^sub>s,((Ca # Cs) ! 0,  Normal ns1),Rels\\<^sub>s ! 0,Guas\\<^sub>s ! 0)\" \n          using Cons(5) sim by auto\n        obtain ns2 where sim_res:\n         \"(((s\\<^sub>c, s\\<^sub>c),(Normal ns1, Normal ns2)) \\<in> (Guas\\<^sub>c!0,(Guas\\<^sub>s!0)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n          (ns\\<^sub>c, ns2)\\<in>PostsA!0 \\<and> PostsA!0\\<subseteq>\\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Ca, Normal ns1) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw,Normal ns2)\"\n          using  Cons(5) sim_elim_cases_c(2)[OF sim] by auto    \n        have \"((s\\<^sub>c, s\\<^sub>c), s\\<^sub>s, Normal ns2)\n           \\<in> ((\\<Union>a<length Guas\\<^sub>c.\n                  Guas\\<^sub>c ! a, (\\<Union>a<length Guas\\<^sub>s. Guas\\<^sub>s ! a)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n           (ns\\<^sub>c, ns2) \\<in> (\\<Union>a<length PostsA. PostsA ! a) \\<and>\n           (\\<exists>c''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Ca # Cs, s\\<^sub>s) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c'', Normal ns2) \\<and>\n                  final_c (c'', Normal ns2) \\<and>\n                  (\\<exists>i<length c''. c'' ! i = LanguageCon.com.Throw))\"\n       using all_throw_tran'[OF Cons(3) Cons(5) Cons(6) Cons(7,8) sim_res _] hyp_step \n          unfolding Guasc_def Guass_def Postsq_def Postsa_def by fast\n        then have ?case by auto\n      }\n      ultimately have ?case by auto \n    }\n    ultimately have ?case by auto\n  }  note y = this    \n  show ?case using list.exhaust[OF x y] by auto      \nqed  \n          \nlemma sim_comp_sound1:\n  assumes    \n    a0':\"length Rels\\<^sub>c = length Guas\\<^sub>c \\<and> length Rels\\<^sub>c = length PostsQ \\<and> length Rels\\<^sub>c = length PostsA \\<and>\n         length Rels\\<^sub>c = length Guas\\<^sub>s \\<and> length Rels\\<^sub>c = length Rels\\<^sub>s \" and\n    a0'':\"length Rels\\<^sub>c = length Coms\\<^sub>s \\<and> length Rels\\<^sub>c = length Coms\\<^sub>c\" and\n    a0''':\"length Rels\\<^sub>c >0\" and\n    a0:\"\\<forall>i<length Rels\\<^sub>c.\n       R\\<^sub>c \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. (Guas\\<^sub>c ! j))\n       \\<subseteq> (Rels\\<^sub>c ! i) \\<and>\n       R\\<^sub>s \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. (Guas\\<^sub>s ! j))\n       \\<subseteq> (Rels\\<^sub>s!i)\" and\n a1:\" (\\<Union>j<length Guas\\<^sub>c. (Guas\\<^sub>c !j)) \\<subseteq> G\\<^sub>c\" and\n a2:\" (\\<Union>j<length Guas\\<^sub>s. (Guas\\<^sub>s ! j)) \\<subseteq> G\\<^sub>s\" and             \n a3:\" (\\<Inter>i<length PostsQ.  (PostsQ ! i)) \\<subseteq> \\<gamma>\\<^sub>n\" and\n a4:\" (\\<Union>i<length PostsA.  (PostsA ! i)) \\<subseteq> \\<gamma>\\<^sub>a \" and\n a5:\" \\<forall>i<length PostsQ.                                                    \n      \\<forall>\\<gamma>\\<^sub>n \\<gamma>\\<^sub>a. \\<gamma>\\<^sub>n = PostsQ !i \\<and> \\<gamma>\\<^sub>a = PostsA!i \\<longrightarrow>\n     (\\<Gamma>\\<^sub>c, (Coms\\<^sub>c ! i,s\\<^sub>c),Rels\\<^sub>c !i, Guas\\<^sub>c!i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s! i,s\\<^sub>s),Rels\\<^sub>s!i, Guas\\<^sub>s !i)\" and\n a7:\"\\<forall>i<length Rels\\<^sub>c. Rels\\<^sub>c!i\\<subseteq> 1\\<alpha>\\<^sub>x\" and  \n a8:\"\\<forall>i<length PostsA. Sta\\<^sub>s (PostsA!i) (Rels\\<^sub>c!i, (Rels\\<^sub>s!i)\\<^sup>*)\\<^sub>\\<alpha>\" and\n a9:\"\\<forall>i<length PostsQ. Sta\\<^sub>s (PostsQ!i) (Rels\\<^sub>c!i, (Rels\\<^sub>s!i)\\<^sup>*)\\<^sub>\\<alpha>\" and a10:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a11:\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and \n a12:\"\\<forall>i<length PostsQ. \\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in> (Guas\\<^sub>c ! i)\"\nshows \"(\\<Gamma>\\<^sub>c,(Coms\\<^sub>c,s\\<^sub>c),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s,s\\<^sub>s),R\\<^sub>s,G\\<^sub>s)\"\n  using a5 a0''\nproof (coinduction arbitrary:s\\<^sub>c s\\<^sub>s Coms\\<^sub>c Coms\\<^sub>s,clarsimp)  \n  fix s\\<^sub>c' s\\<^sub>s' Coms\\<^sub>c' Coms\\<^sub>s'\n  assume a5:\"\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, s\\<^sub>c'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i)\n          \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>) (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, s\\<^sub>s'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" and\n   a0'': \"length Coms\\<^sub>c' = length Coms\\<^sub>s'\" and\n   a01'':\"length Rels\\<^sub>c = length Coms\\<^sub>s'\"\n  have a5':\"\\<forall>i<length Coms\\<^sub>s'. (\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, s\\<^sub>c'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i)\n          \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>) (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, s\\<^sub>s'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\"\n    using a5 a0'' a01'' a0' by auto\n  then have alpha:\"(s\\<^sub>c', s\\<^sub>s') \\<in> \\<alpha>\\<^sub>x\" using a0''' a0' a01''\n    by (metis dest_sim_alpha_x)\n  moreover have \"\\<forall>\\<sigma>n. s\\<^sub>c' = Normal \\<sigma>n \\<longrightarrow> (\\<exists>\\<Sigma>n. s\\<^sub>s' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>)\" \n    using a5' a0' a0''' a01'' dest_sim_alpha by fastforce\n  moreover \n  {fix c\\<^sub>c' \\<sigma>n'\n    assume b01:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>p\\<^sub>\\<tau> (Coms\\<^sub>c', s\\<^sub>c') \\<rightarrow> (c\\<^sub>c',  Normal \\<sigma>n')\"\n    then obtain i c' where step:\"i< length Coms\\<^sub>c' \\<and>  \n                            \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> ((Coms\\<^sub>c'!i), s\\<^sub>c') \\<rightarrow> (c', Normal \\<sigma>n') \\<and>\n                            (\\<forall>j. j\\<noteq>i \\<longrightarrow> c\\<^sub>c'!j = (Coms\\<^sub>c'!j)) \\<and> c\\<^sub>c'!i=c' \\<and> (\\<exists>\\<sigma>n. s\\<^sub>c' = Normal \\<sigma>n)\"\n      using step_pev_pair_elim_cases[OF b01] nth_list_update_neq\n      by (metis nth_list_update_eq step_NotNormal) \n    then have sim:\"(\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, s\\<^sub>c'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n    (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, s\\<^sub>s'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" using a5 a0' a0''\n      using a01'' by auto \n    have i_len:\"i<length PostsQ\" using a5 a0' a0'' a01'' step by auto \n    \n   obtain c\\<^sub>s' \\<Sigma>n' where alpha_rel_guar:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                    (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n                    (((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (Guas\\<^sub>c ! i, (Guas\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<Gamma>\\<^sub>c,(c', Normal \\<sigma>n'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                        (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" \n     using  step sim_elim_cases[OF sim, of \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                    (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n                    (((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (Guas\\<^sub>c ! i, (Guas\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<Gamma>\\<^sub>c,(c', Normal \\<sigma>n'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                        (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\"] by metis       \n   moreover have step_par_s:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Coms\\<^sub>s'[i:=c\\<^sub>s'], Normal \\<Sigma>n')\" \n     using mult_step_in_par calculation\n       by (metis a0'' local.step) \n     moreover have gcs:\"((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n       using alpha_rel_guar a1 a2 G_comp by (metis a0' a0'' a01'' local.step)\n     moreover have \"(\\<forall>i'<length PostsQ. (\\<Gamma>\\<^sub>c,(c\\<^sub>c' ! i', Normal \\<sigma>n'),Rels\\<^sub>c ! i',Guas\\<^sub>c ! i') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i'\\<^sub>;\\<^sub>PostsA ! i'\\<^sub>)\n                         (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s'[i:=c\\<^sub>s'] ! i', Normal \\<Sigma>n'),Rels\\<^sub>s ! i',Guas\\<^sub>s ! i'))\"\n     using rest_sim[OF a0 a0' a0''' a5 a0'' a01''   i_len ] alpha_rel_guar step by blast       \n     ultimately have \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               ((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n               ((\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(c\\<^sub>c' ! i, Normal \\<sigma>n'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i)\n                    \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                    (\\<Gamma>\\<^sub>s,(c\\<^sub>s' ! i, Normal \\<Sigma>n'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)) \\<and>\n                length Coms\\<^sub>s' = length c\\<^sub>s' \\<and> length Coms\\<^sub>s' = length c\\<^sub>c' \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n       using a0'' b01\n       by (metis length_list_update step_pev_pair_elim_cases)\n  } \n  moreover \n  { fix v c\\<^sub>c' \\<sigma>n'\n   assume b01: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>p\\<^sub>(Some v) (Coms\\<^sub>c', s\\<^sub>c') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \"\n      then obtain i c' where step:\"i< length Coms\\<^sub>c' \\<and>  \n                            \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) ((Coms\\<^sub>c'!i), s\\<^sub>c') \\<rightarrow> (c', Normal \\<sigma>n') \\<and>\n                            (\\<forall>j. j\\<noteq>i \\<longrightarrow> c\\<^sub>c'!j = (Coms\\<^sub>c'!j)) \\<and> c\\<^sub>c'!i=c' \"\n      using step_pev_pair_elim_cases[OF b01] nth_list_update_neq\n      by (metis nth_list_update_eq)      \n    then have sim:\"(\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, s\\<^sub>c'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n    (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, s\\<^sub>s'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" using a5 a0' a0''\n      using a01'' by auto \n    have i_len:\"i<length PostsQ\" using a5 a0' a0'' a01'' step by auto     \n    have \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n        \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>Some v (Coms\\<^sub>c' ! i, s\\<^sub>c') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n        (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n            (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                   (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n            (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n            ((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (Guas\\<^sub>c ! i, (Guas\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n            (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n            (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i))\" \n      using sim_elim_cases[OF sim, of \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n        \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>Some v (Coms\\<^sub>c' ! i, s\\<^sub>c') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n        (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n            (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                   (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n            (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n            ((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (Guas\\<^sub>c ! i, (Guas\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n            (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n            (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i))\"] by blast    \n    then obtain c\\<^sub>s' \\<Sigma>n' where alpha_rel_guar:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sup>+ (c\\<^sub>s', Normal \\<Sigma>n')  \\<and>\n                    (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n                    (((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (Guas\\<^sub>c ! i, (Guas\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<Gamma>\\<^sub>c,(c', Normal \\<sigma>n'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                        (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" \n      using step by (fastforce elim:sim_elim_cases[OF sim])\n    moreover have step_par_s:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p\\<^sub>v (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sup>+ (Coms\\<^sub>s'[i:=c\\<^sub>s'], Normal \\<Sigma>n')\" \n      using mult_step_in_par_ev calculation\n      by (metis a0'' local.step) \n    then have  \"(\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Coms\\<^sub>s'[i:=c\\<^sub>s'], Normal \\<Sigma>n')))\"\n      by auto\n     moreover have gcs:\"((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n       using alpha_rel_guar a1 a2 G_comp by (metis a0' a0'' a01'' local.step) \n     moreover have \"(\\<forall>i'<length PostsQ. (\\<Gamma>\\<^sub>c,(c\\<^sub>c' ! i', Normal \\<sigma>n'),Rels\\<^sub>c ! i',Guas\\<^sub>c ! i') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i'\\<^sub>;\\<^sub>PostsA ! i'\\<^sub>)\n                         (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s'[i:=c\\<^sub>s'] ! i', Normal \\<Sigma>n'),Rels\\<^sub>s ! i',Guas\\<^sub>s ! i'))\"\n       using rest_sim[OF a0 a0' a0''' a5 a0'' a01''  i_len ] alpha_rel_guar step by blast      \n    ultimately have \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               ((\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(c\\<^sub>c' ! i, Normal \\<sigma>n'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                    (\\<Gamma>\\<^sub>s,(c\\<^sub>s' ! i, Normal \\<Sigma>n'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)) \\<and>\n                length Coms\\<^sub>s' = length c\\<^sub>s' \\<and> length Coms\\<^sub>s' = length c\\<^sub>c' \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"        \n     using a0'' b01\n     by (metis length_list_update step_pev_pair_elim_cases)     \n  }\n  moreover \n  { \n   fix \\<sigma>' c\\<^sub>c' e\n   assume b01:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>p\\<^sub>e (Coms\\<^sub>c', s\\<^sub>c') \\<rightarrow> (c\\<^sub>c', \\<sigma>') \" and b02:\"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\"           \n   then obtain i c' where step:\"i< length Coms\\<^sub>c' \\<and>  \n                            \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e ((Coms\\<^sub>c'!i), s\\<^sub>c') \\<rightarrow> (c', \\<sigma>') \\<and>  (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and>\n                            (\\<forall>j. j\\<noteq>i \\<longrightarrow> c\\<^sub>c'!j = (Coms\\<^sub>c'!j)) \\<and> c\\<^sub>c'!i=c' \"\n      using step_pev_pair_elim_cases[OF b01] nth_list_update_neq\n      by (metis nth_list_update_eq)      \n    then have sim:\"(\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, s\\<^sub>c'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n    (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, s\\<^sub>s'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" using a5 a0' a0''\n      using a01'' by auto \n    have i_len:\"i<length PostsQ\" using a5 a0' a0'' a01'' step by auto     \n    have \"\\<forall>v c\\<^sub>c' \\<sigma>'.\n        \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (Coms\\<^sub>c' ! i, s\\<^sub>c') \\<rightarrow> (c\\<^sub>c', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n        (\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (s\\<^sub>c', \\<sigma>') \\<in> Guas\\<^sub>c ! i \\<and>\n                     (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                     (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)))\" \n      using sim_elim_cases[OF sim] by blast    \n    then obtain c\\<^sub>s' \\<Sigma>' where alpha_rel_guar:\n           \"(\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n            ((\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')))))) \\<and> \n                     (s\\<^sub>c', \\<sigma>') \\<in> Guas\\<^sub>c ! i \\<and>\n                     (\\<Gamma>\\<^sub>c,(c', \\<sigma>'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                     (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" \n      using step by (fastforce elim:sim_elim_cases[OF sim])\n    moreover have  \"(\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Coms\\<^sub>s'[i:=c\\<^sub>s'], \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Coms\\<^sub>s'[i:=c\\<^sub>s'], \\<Sigma>')))))\"\n    proof-\n      {assume \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')\" then have ?thesis \n          using   mult_step_in_par a0'' step by auto\n      }\n      moreover {assume \"\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')))\"       \n        then obtain v where \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (Coms\\<^sub>s' ! i, s\\<^sub>s') \\<rightarrow>\\<^sup>+ (c\\<^sub>s', \\<Sigma>') \\<and> e = Some v\" by fastforce\n        then have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Coms\\<^sub>s'[i := c\\<^sub>s'], \\<Sigma>') \\<or> \n                   \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p\\<^sub>v (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sup>+ (Coms\\<^sub>s'[i := c\\<^sub>s'], \\<Sigma>') \\<and> e = Some v\"\n           using mult_step_in_par_ev  a0'' step by metis\n        then have ?thesis by auto\n      } ultimately show ?thesis using alpha_rel_guar by fast\n    qed\n    moreover have \"(\\<forall>i'<length PostsQ. (\\<Gamma>\\<^sub>c,(c\\<^sub>c' ! i', \\<sigma>'),Rels\\<^sub>c ! i',Guas\\<^sub>c ! i') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i'\\<^sub>;\\<^sub>PostsA ! i'\\<^sub>)\n                         (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s'[i:=c\\<^sub>s'] ! i', \\<Sigma>'),Rels\\<^sub>s ! i',Guas\\<^sub>s ! i'))\"\n      using rest_sim_not_normal[OF  a0' a7  ] a12 alpha_rel_guar step by blast      \n    moreover have \"(s\\<^sub>c', \\<sigma>') \\<in> G\\<^sub>c\" using alpha_rel_guar step a1 a0' a0'' a01'' by fastforce\n    ultimately have \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n                  (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                           (\\<exists>v. e = Some v \\<and>\n                                (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                       (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and>\n                          (s\\<^sub>c', \\<sigma>') \\<in> G\\<^sub>c \\<and>\n                          ((\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(c\\<^sub>c' ! i, \\<sigma>'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i)\n                               \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                               (\\<Gamma>\\<^sub>s,(c\\<^sub>s' ! i, \\<Sigma>'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)) \\<and>\n                           length Coms\\<^sub>s' = length c\\<^sub>s' \\<and> length Coms\\<^sub>s' = length c\\<^sub>c' \\<or>\n                           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\"        \n     using a0'' b01\n     by (metis length_list_update step_pev_pair_elim_cases)     \n  }\n  moreover \n  { fix s1 s1'\n    assume b01:\"((s\\<^sub>c', s1), s\\<^sub>s', s1') \\<in> ((R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (s1,s1')\\<in>\\<alpha>\\<^sub>x\"\n    have \"\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, s1),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                     (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, s1'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\"\n    proof -\n    { fix i\n      assume i:\"i<length PostsQ\"      \n      then have rels:\"R\\<^sub>c \\<subseteq> Rels\\<^sub>c ! i \\<and> R\\<^sub>s \\<subseteq> Rels\\<^sub>s ! i\" using a0' a0 by auto\n      then have sim:\"(\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, s\\<^sub>c'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i)\n          \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>) (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, s\\<^sub>s'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" using a5 i by auto\n      have \"((s\\<^sub>c', s1), s\\<^sub>s', s1') \\<in> (Rels\\<^sub>c ! i, (Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha> \\<and> (s1,s1')\\<in>\\<alpha>\\<^sub>x\" \n        using G_comp1[OF _ _ _] b01 rels by auto      \n      then have \"(\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, s1),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                   (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, s1'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)\" \n        by (blast intro:sim_elim_cases[OF sim])\n    } then show ?thesis by auto qed    \n    then have \"(\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, s1),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                     (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, s1'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)) \\<or>\n                 (\\<Gamma>\\<^sub>c,(Coms\\<^sub>c', s1),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s', s1'),R\\<^sub>s,G\\<^sub>s)\" by auto    \n  }\n  moreover \n  { fix \\<sigma>n\n    assume b01:\"s\\<^sub>c' = Normal \\<sigma>n \\<and> (\\<forall>i<length Coms\\<^sub>s'. Coms\\<^sub>c' ! i = LanguageCon.com.Skip) \\<and> Coms\\<^sub>c' \\<noteq> []\"\n    then obtain ns\\<^sub>c where nsc:\"s\\<^sub>c' = Normal ns\\<^sub>c\" and eq_\\<alpha>:\"\\<sigma>n = ns\\<^sub>c\" by auto\n    then obtain ns\\<^sub>s where nss:\"s\\<^sub>s' =Normal ns\\<^sub>s\" using alpha  Normal_alpha by fastforce\n    have len_com:\"0 < length Coms\\<^sub>s'\" using a0''' a01'' by auto\n    have skips:\\<open>\\<forall>i<length Coms\\<^sub>c'. Coms\\<^sub>c' ! i = LanguageCon.com.Skip\\<close>\n      by (simp add: a0'' b01)\n    have len_coms:\"length Coms\\<^sub>s' = length Coms\\<^sub>c' \\<and> length Coms\\<^sub>s' = length Rels\\<^sub>c\"\n      by (simp add: a0'' a01'')\n    have relc:\"\\<forall>i<length Rels\\<^sub>c.\n       R\\<^sub>c \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. (Guas\\<^sub>c ! j))\n       \\<subseteq> (Rels\\<^sub>c ! i)\" using a0 by auto\n    have rels:\"\\<forall>i<length Rels\\<^sub>s.\n       R\\<^sub>s \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. (Guas\\<^sub>s ! j))\n       \\<subseteq> (Rels\\<^sub>s ! i)\" using a0 a0' by auto\n     have \"\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n                     \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and>\n                     (\\<exists>c\\<^sub>s'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                             (\\<forall>i<length c\\<^sub>s'. c\\<^sub>s' ! i = LanguageCon.com.Skip) \\<and> c\\<^sub>s' \\<noteq> [])\"\n       using par_all_skip_rtran_gen1[OF a5 len_com skips nsc nss len_coms a0' a1  a2 a8 a9 relc rels] a3 a4 a10 a11\n       nsc eq_\\<alpha>\n      by (meson G_comp1 a1 a2 subsetCE) \n  }\n moreover \n {fix \\<sigma>n\n   assume b01:\"s\\<^sub>c' = Normal \\<sigma>n \\<and> final_c (Coms\\<^sub>c', s\\<^sub>c') \\<and> (\\<exists>i<length Coms\\<^sub>s'. Coms\\<^sub>c' ! i = LanguageCon.com.Throw) \"      \n   then obtain ns\\<^sub>s where nss:\"s\\<^sub>s' =Normal ns\\<^sub>s\" using alpha  Normal_alpha by fastforce\n   have final_throw:\"final_c (Coms\\<^sub>c', s\\<^sub>c') \\<and> (\\<exists>i<length Coms\\<^sub>c'. Coms\\<^sub>c' ! i = LanguageCon.com.Throw)\" \n     using b01 a0'' by auto\n  have len_com:\"0 < length Coms\\<^sub>s'\" using a0''' a01'' by auto      \n  have len_coms:\"length Coms\\<^sub>s' = length Coms\\<^sub>c' \\<and> length Coms\\<^sub>s' = length Rels\\<^sub>c\"\n    by (simp add: a0'' a01'')\n  have relc:\"\\<forall>i<length Rels\\<^sub>c.\n         R\\<^sub>c \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>c \\<and> j \\<noteq> i}. (Guas\\<^sub>c ! j)) \\<subseteq> (Rels\\<^sub>c ! i)\" using a0 by auto\n  have rels:\"\\<forall>i<length Rels\\<^sub>s.\n             R\\<^sub>s \\<union> (\\<Union>j\\<in>{j. j < length Guas\\<^sub>s \\<and> j \\<noteq> i}. (Guas\\<^sub>s ! j)) \\<subseteq> (Rels\\<^sub>s ! i)\" using a0 a0' by auto\n  have\"\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                     \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and>\n                     (\\<exists>c\\<^sub>s'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                             final_c (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                             (\\<exists>i<length c\\<^sub>s'. c\\<^sub>s' ! i = LanguageCon.com.Throw))\" \n    using par_throw_rtran_gen1[OF a5 len_com final_throw _ nss len_coms a0' a1 a2 a8 a9 relc rels, of \\<sigma>n] a3 a4 a10 a11\n      b01 by (meson G_comp1 a1 a2 subsetCE) \n   }  \n moreover \n {\n  assume b01:\"(\\<forall>\\<sigma>n. s\\<^sub>c' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>i<length Coms\\<^sub>s'. Coms\\<^sub>c' ! i = LanguageCon.com.Skip) \\<and> Coms\\<^sub>c' \\<noteq> [] \"      \n  then have nss:\"\\<forall>\\<Sigma>n. s\\<^sub>s' \\<noteq> Normal \\<Sigma>n\" using alpha  Normal_alpha\n    using Normal_alpha2 by fastforce\n  have \"Coms\\<^sub>s' \\<noteq> []\" using a0'' b01 by auto\n  then have\"\\<exists>\\<Sigma>' c\\<^sub>s'.\n        \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<and>\n        (s\\<^sub>c', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>i<length c\\<^sub>s'. c\\<^sub>s' ! i = LanguageCon.com.Skip) \\<and> c\\<^sub>s' \\<noteq> []\" \n    using par_step_tau_skip_s[OF nss] alpha  by blast\n   }      \n  ultimately show \"(s\\<^sub>c', s\\<^sub>s') \\<in> \\<alpha>\\<^sub>x \\<and>\n       (\\<forall>\\<sigma>n. s\\<^sub>c' = Normal \\<sigma>n \\<longrightarrow> (\\<exists>\\<Sigma>n. s\\<^sub>s' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>)) \\<and>\n       (\\<forall>c\\<^sub>c' \\<sigma>n'.\n           (\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>p\\<^sub>\\<tau> (Coms\\<^sub>c', s\\<^sub>c') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')) \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               ((\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(c\\<^sub>c' ! i, Normal \\<sigma>n'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i)\n                    \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s' ! i, Normal \\<Sigma>n'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)) \\<and>\n                length Coms\\<^sub>s' = length c\\<^sub>s' \\<and> length Coms\\<^sub>s' = length c\\<^sub>c' \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           (\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>p\\<^sub>(Some v) (Coms\\<^sub>c', s\\<^sub>c') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')) \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((s\\<^sub>c', Normal \\<sigma>n'), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               ((\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(c\\<^sub>c' ! i, Normal \\<sigma>n'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i)\n                    \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s' ! i, Normal \\<Sigma>n'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)) \\<and>\n                length Coms\\<^sub>s' = length c\\<^sub>s' \\<and> length Coms\\<^sub>s' = length c\\<^sub>c' \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>\\<sigma>' \\<Sigma>'. (((s\\<^sub>c', \\<sigma>'), s\\<^sub>s', \\<Sigma>') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>',\\<Sigma>')\\<in>\\<alpha>\\<^sub>x \\<longrightarrow>\n                 (\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(Coms\\<^sub>c' ! i, \\<sigma>'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i)\n                     \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>) (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s' ! i, \\<Sigma>'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)) \\<or>\n                 (\\<Gamma>\\<^sub>c,(Coms\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Coms\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)) \\<and>\n       (\\<forall>\\<sigma>n. s\\<^sub>c' = Normal \\<sigma>n \\<and> (\\<forall>i<length Coms\\<^sub>s'. Coms\\<^sub>c' ! i = LanguageCon.com.Skip) \\<and> Coms\\<^sub>c' \\<noteq> [] \\<longrightarrow>\n             (\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n                     \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and>\n                     (\\<exists>c\\<^sub>s'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                             (\\<forall>i<length c\\<^sub>s'. c\\<^sub>s' ! i = LanguageCon.com.Skip) \\<and> c\\<^sub>s' \\<noteq> []))) \\<and>\n       (\\<forall>\\<sigma>n. s\\<^sub>c' = Normal \\<sigma>n \\<and>\n             final_c (Coms\\<^sub>c', s\\<^sub>c') \\<and> (\\<exists>i<length Coms\\<^sub>s'. Coms\\<^sub>c' ! i = LanguageCon.com.Throw) \\<longrightarrow>\n             (\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), s\\<^sub>s', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                     \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and>\n                     (\\<exists>c\\<^sub>s'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                             final_c (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                             (\\<exists>i<length c\\<^sub>s'. c\\<^sub>s' ! i = LanguageCon.com.Throw)))) \\<and>\n       (\\<forall>\\<sigma>' c\\<^sub>c' e.\n           (\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>p\\<^sub>e (Coms\\<^sub>c', s\\<^sub>c') \\<rightarrow> (c\\<^sub>c', \\<sigma>')) \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n                  (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                           (\\<exists>v. e = Some v \\<and>\n                                (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                       (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (s\\<^sub>c', \\<sigma>') \\<in> G\\<^sub>c \\<and>\n                          ((\\<forall>i<length PostsQ. (\\<Gamma>\\<^sub>c,(c\\<^sub>c' ! i, \\<sigma>'),Rels\\<^sub>c ! i,Guas\\<^sub>c ! i)\n                               \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>PostsQ ! i\\<^sub>;\\<^sub>PostsA ! i\\<^sub>)\n                               (\\<Gamma>\\<^sub>s,(c\\<^sub>s' ! i, \\<Sigma>'),Rels\\<^sub>s ! i,Guas\\<^sub>s ! i)) \\<and>\n                           length Coms\\<^sub>s' = length c\\<^sub>s' \\<and> length Coms\\<^sub>s' = length c\\<^sub>c' \\<or>\n                           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))))) \\<and>\n       ((\\<forall>\\<sigma>n. s\\<^sub>c' \\<noteq> Normal \\<sigma>n) \\<and> (\\<forall>i<length Coms\\<^sub>s'. Coms\\<^sub>c' ! i = LanguageCon.com.Skip) \\<and> Coms\\<^sub>c' \\<noteq> [] \\<longrightarrow>\n        (\\<exists>\\<Sigma>' c\\<^sub>s'.\n            \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>p (Coms\\<^sub>s', s\\<^sub>s') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<and>\n            (s\\<^sub>c', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> (\\<forall>i<length c\\<^sub>s'. c\\<^sub>s' ! i = LanguageCon.com.Skip) \\<and> c\\<^sub>s' \\<noteq> [])) \" \n    by force\nqed\n  \nlemma sim_comp_sound:\n  assumes a0':\"length C>0\" and\n a0:\"\\<forall>i<length C.\n       R\\<^sub>c \\<union> (\\<Union>j\\<in>{j. j < length C \\<and> j \\<noteq> i}. (Gua\\<^sub>c (C ! j)))\n       \\<subseteq> (Rel\\<^sub>c (C ! i)) \\<and>\n       R\\<^sub>s \\<union> (\\<Union>j\\<in>{j. j < length C \\<and> j \\<noteq> i}. (Gua\\<^sub>s (C ! j)))\n       \\<subseteq> (Rel\\<^sub>s (C ! i))\" and\n a1:\" (\\<Union>j<length C. (Gua\\<^sub>c (C ! j))) \\<subseteq> G\\<^sub>c\" and \n a2:\" (\\<Union>j<length C. (Gua\\<^sub>s (C ! j))) \\<subseteq> G\\<^sub>s\" and             \n a3:\" (\\<Inter>i<length C.  (PostQ (C ! i))) \\<subseteq> \\<gamma>\\<^sub>n\" and \n a4:\" (\\<Union>i<length C.  (PostA (C ! i))) \\<subseteq> \\<gamma>\\<^sub>a \" and\n a5:\" \\<forall>i<length C.                                                    \n      \\<forall>\\<gamma>\\<^sub>n \\<gamma>\\<^sub>a. \\<gamma>\\<^sub>n = PostQ (C !i) \\<and> \\<gamma>\\<^sub>a = PostA (C!i) \\<longrightarrow>\n     (\\<Gamma>\\<^sub>c, (Com\\<^sub>c (C! i),s\\<^sub>c),Rel\\<^sub>c (C!i), Gua\\<^sub>c (C!i)) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Com\\<^sub>s (C! i),s\\<^sub>s),Rel\\<^sub>s (C!i), Gua\\<^sub>s (C!i))\" and \n a7:\"\\<forall>i<length C. Rel\\<^sub>c (C!i)\\<subseteq> 1\\<alpha>\\<^sub>x\"  and \n a8:\"\\<forall>i<length C.\n       Sta\\<^sub>s (PostA (C ! i)) (Rel\\<^sub>c (C ! i), (Rel\\<^sub>s (C ! i))\\<^sup>*)\\<^sub>\\<alpha>\" and\n a9:\"   \\<forall>i<length C.\n     Sta\\<^sub>s (PostQ (C ! i)) (Rel\\<^sub>c (C ! i), (Rel\\<^sub>s (C ! i))\\<^sup>*)\\<^sub>\\<alpha>\" and\n a10:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a11:\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\"  and a12:\"\\<forall>i<length C. \\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in> ((Gua\\<^sub>c (C ! i)))\"\nshows \"(\\<Gamma>\\<^sub>c,(PCom\\<^sub>c C,s\\<^sub>c),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(PCom\\<^sub>s C,s\\<^sub>s),R\\<^sub>s,G\\<^sub>s)\"\nproof-\n  let ?Rels\\<^sub>c = \"par_sim_list Rel\\<^sub>c C\" and\n      ?Rels\\<^sub>s = \"par_sim_list Rel\\<^sub>s C\" and\n      ?Guas\\<^sub>c = \"par_sim_list Gua\\<^sub>c C\" and\n      ?Guas\\<^sub>s = \"par_sim_list Gua\\<^sub>s C\" and\n      ?PostsQ = \"par_sim_list PostQ C\" and\n      ?PostsA = \"par_sim_list PostA C\" and\n      ?Coms\\<^sub>c = \"par_sim_list Com\\<^sub>c C\" and\n      ?Coms\\<^sub>s = \"par_sim_list Com\\<^sub>s C\"\n      \n  have a0'': \"length ?Rels\\<^sub>c = length ?Guas\\<^sub>c \\<and> length ?Rels\\<^sub>c = length ?PostsQ \\<and> length ?Rels\\<^sub>c = length ?PostsA \\<and>\n         length ?Rels\\<^sub>c = length ?Guas\\<^sub>s \\<and> length ?Rels\\<^sub>c = length ?Rels\\<^sub>s\" unfolding par_sim_list_def by auto\n  have a01'':\"length ?Rels\\<^sub>c = length ?Coms\\<^sub>s \\<and> length ?Rels\\<^sub>c = length ?Coms\\<^sub>c\"  unfolding par_sim_list_def by auto\n  have a0''':\"length ?Rels\\<^sub>c>0\" using a0' unfolding par_sim_list_def by auto\n  have a0':\"\\<forall>i<length ?Rels\\<^sub>c.\n       R\\<^sub>c \\<union> (\\<Union>j\\<in>{j. j < length ?Guas\\<^sub>c \\<and> j \\<noteq> i}. (?Guas\\<^sub>c ! j))\n       \\<subseteq> (?Rels\\<^sub>c ! i) \\<and>\n       R\\<^sub>s \\<union> (\\<Union>j\\<in>{j. j < length ?Guas\\<^sub>s \\<and> j \\<noteq> i}. (?Guas\\<^sub>s ! j))\n       \\<subseteq> (?Rels\\<^sub>s!i)\" using a0 unfolding par_sim_list_def Gua\\<^sub>c_def Rel\\<^sub>c_def by auto  \n  have a1':\"(\\<Union>j<length ?Guas\\<^sub>c. (?Guas\\<^sub>c !j)) \\<subseteq> G\\<^sub>c\" \n    using a1 unfolding par_sim_list_def Gua\\<^sub>c_def  by auto\n  have a2':\" (\\<Union>j<length ?Guas\\<^sub>s. (?Guas\\<^sub>s ! j)) \\<subseteq> G\\<^sub>s\"      \n     using a2 unfolding par_sim_list_def Gua\\<^sub>s_def  by auto\n  have a3':\" (\\<Inter>i<length ?PostsQ.  (?PostsQ ! i)) \\<subseteq> \\<gamma>\\<^sub>n\" \n     using a3 unfolding par_sim_list_def PostQ_def by auto\n  have a4':\" (\\<Union>i<length ?PostsA.  (?PostsA ! i)) \\<subseteq> \\<gamma>\\<^sub>a \" \n     using a4 unfolding par_sim_list_def PostA_def by auto\n  have a5':\" \\<forall>i<length ?PostsQ.                                                    \n      \\<forall>\\<gamma>\\<^sub>n \\<gamma>\\<^sub>a. \\<gamma>\\<^sub>n = ?PostsQ !i \\<and> \\<gamma>\\<^sub>a = ?PostsA!i \\<longrightarrow>\n     (\\<Gamma>\\<^sub>c, (?Coms\\<^sub>c ! i,s\\<^sub>c),?Rels\\<^sub>c !i, ?Guas\\<^sub>c!i) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(?Coms\\<^sub>s! i,s\\<^sub>s),?Rels\\<^sub>s!i, ?Guas\\<^sub>s !i)\"\n    using a5 unfolding par_sim_list_def by auto\n  have a7:\"\\<forall>i<length ?Rels\\<^sub>c. ?Rels\\<^sub>c!i\\<subseteq> 1\\<alpha>\\<^sub>x\" using a7 unfolding par_sim_list_def by auto\n  have a8':\"\\<forall>i<length ?PostsA.\n     Sta\\<^sub>s (?PostsA ! i) (?Rels\\<^sub>c ! i, (?Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>\" \n    using a8  unfolding par_sim_list_def by auto\n  have a9':\"\\<forall>i<length (?PostsQ).\n     Sta\\<^sub>s (?PostsQ ! i) (?Rels\\<^sub>c ! i, (?Rels\\<^sub>s ! i)\\<^sup>*)\\<^sub>\\<alpha>\"\n    using a9  unfolding par_sim_list_def by auto\n  have a12': \"\\<forall>i<length ?PostsQ. \\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in> ((?Guas\\<^sub>c ! i))\" using a12 unfolding par_sim_list_def by auto\nhave \"(\\<Gamma>\\<^sub>c,(?Coms\\<^sub>c,s\\<^sub>c),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(?Coms\\<^sub>s,s\\<^sub>s),R\\<^sub>s,G\\<^sub>s)\" \n  using sim_comp_sound1[OF a0'' a01'' a0''' a0' a1' a2' a3' a4' a5'  a7  a8' a9' a10 a11 a12']  \n  by auto\nthus ?thesis unfolding PCom\\<^sub>c_def PCom\\<^sub>s_def par_sim_list_def by auto\nqed\n  \n  \n  \n  \nlemma sim_comp:\n  \"length C > 0 \\<Longrightarrow> \n   \\<forall>i<length C.\n       R\\<^sub>c \\<union> (\\<Union>j\\<in>{j. j < length C \\<and> j \\<noteq> i}. (Gua\\<^sub>c (C ! j)))\n       \\<subseteq> (Rel\\<^sub>c (C ! i)) \\<and>\n       R\\<^sub>s \\<union> (\\<Union>j\\<in>{j. j < length C \\<and> j \\<noteq> i}. (Gua\\<^sub>s (C ! j)))\n       \\<subseteq> (Rel\\<^sub>s (C ! i)) \\<Longrightarrow>\n    (\\<Union>j<length C. (Gua\\<^sub>c (C ! j))) \\<subseteq> G\\<^sub>c \\<Longrightarrow>  \n    (\\<Union>j<length C. (Gua\\<^sub>s (C ! j))) \\<subseteq> G\\<^sub>s \\<Longrightarrow>   \n     \\<xi> \\<subseteq> (\\<Inter>i<length C.  (Pre (C ! i))) \\<Longrightarrow>     \n     (\\<Inter>i<length C.  (PostQ (C ! i))) \\<subseteq> \\<gamma>\\<^sub>n \\<Longrightarrow>\n     (\\<Union>i<length C.  (PostA (C ! i))) \\<subseteq> \\<gamma>\\<^sub>a \\<Longrightarrow>\n    \\<forall>i<length C.\n      \\<forall>\\<xi> \\<gamma>\\<^sub>n \\<gamma>\\<^sub>a. \\<xi> = Pre (C !i) \\<and> \\<gamma>\\<^sub>n = PostQ (C !i) \\<and> \\<gamma>\\<^sub>a = PostA (C!i) \\<longrightarrow>\n     (\\<Gamma>\\<^sub>c, Com\\<^sub>c (C! i),Rel\\<^sub>c (C!i), Gua\\<^sub>c (C!i)) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,Com\\<^sub>s (C! i),Rel\\<^sub>s (C!i), Gua\\<^sub>s (C!i)) \\<Longrightarrow>\n    \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<Longrightarrow> \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<Longrightarrow> \\<forall>i<length C. Rel\\<^sub>c (C!i)\\<subseteq> 1\\<alpha>\\<^sub>x \\<Longrightarrow>    \n   \\<forall>i<length C.\n     Sta\\<^sub>s (PostA (C ! i)) (Rel\\<^sub>c (C ! i), (Rel\\<^sub>s (C ! i))\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow>\n   \\<forall>i<length C.\n     Sta\\<^sub>s (PostQ (C ! i)) (Rel\\<^sub>c (C ! i), (Rel\\<^sub>s (C ! i))\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow> \\<forall>i<length C. \\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in> ((Gua\\<^sub>c (C ! i))) \\<Longrightarrow>\n   (\\<Gamma>\\<^sub>c,PCom\\<^sub>c C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>p\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,PCom\\<^sub>s C,R\\<^sub>s,G\\<^sub>s)\"  \n unfolding RGSIM_p_pre_def RGSim_pre_def Pre_def\n  apply (rule, rule,rule) apply (rule sim_comp_sound) \n  by fast+\n\nlemma \"\\<alpha>' \\<subseteq> \\<alpha> \\<Longrightarrow> \\<alpha>\\<subseteq> \\<alpha>\\<^sub>x \\<Longrightarrow> \\<alpha>' \\<subseteq> \\<alpha>\\<^sub>x\" by auto\n\n\nlemma RGSim_Conseq_sound:\nassumes  a0:\"(\\<Gamma>\\<^sub>c,(C\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and   \n    a1:\"\\<gamma>\\<^sub>n \\<subseteq> \\<gamma>\\<^sub>n\\<^sub>' \\<and> \\<gamma>\\<^sub>n\\<^sub>' \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>a \\<subseteq> \\<gamma>\\<^sub>a\\<^sub>' \\<and> \\<gamma>\\<^sub>a\\<^sub>' \\<subseteq> \\<alpha>\" and \n   a3:\"R\\<^sub>s' \\<subseteq> R\\<^sub>s\" and a4:\"R\\<^sub>c' \\<subseteq> R\\<^sub>c\" and a5:\"G\\<^sub>s \\<subseteq> G\\<^sub>s'\" and a6: \"G\\<^sub>c\\<subseteq>G\\<^sub>c'\"   and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a8:\"\\<forall>\\<sigma>.(\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\"\n shows \"(\\<Gamma>\\<^sub>c,(C\\<^sub>c, \\<sigma>),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s, \\<Sigma>),R\\<^sub>s',G\\<^sub>s')\"\n  using a0\nproof(coinduction arbitrary: C\\<^sub>c C\\<^sub>s \\<sigma> \\<Sigma>,clarsimp) \nfix C\\<^sub>c' C\\<^sub>s' \\<sigma>' \\<Sigma>'  \n  assume a0:\"(\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n  have rg:\"\\<forall>\\<sigma>.(\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c'\" using a6 a8 by auto\n  then have \"(\\<forall>\\<sigma>n. \\<sigma>' = Normal \\<sigma>n \\<longrightarrow> (\\<exists>\\<Sigma>n. \\<Sigma>' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>))\"\n    using  a0 dest_sim_alpha by blast\n  moreover have \"(\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \" using dest_sim_alpha_x[OF a0] by auto\n  moreover {\n    fix c\\<^sub>c' \\<sigma>n'\n    assume a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n    then obtain c\\<^sub>s' \\<Sigma>n' where \"\n       \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n       (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n       (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n       (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\" \n    using dest_sim_tau_step[OF a0 a00] by auto\n    then have \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n')) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c', G\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s',G\\<^sub>s'))\" using a5 a6\n      by (meson G_comp1)\n  }\n  moreover {\n    fix  v c\\<^sub>c' \\<sigma>n'\n    assume a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n      then have \"\\<exists>c\\<^sub>s' \\<Sigma>n'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sup>+ (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'),  \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\" \n        using dest_sim_ev_step[OF a0 a00] by auto\n    then have  \"(\\<exists>c\\<^sub>s' \\<Sigma>n'.\n              \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sup>+ (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'),  \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c', G\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s',Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s',G\\<^sub>s')))\" using a5 a6\n      by (meson G_comp1)\n    then have  \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c', G\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s',G\\<^sub>s'))\" by auto\n  }\n  moreover{\n    fix \\<sigma>'' \\<Sigma>''\n    assume a00:\"(((\\<sigma>', \\<sigma>''), \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c', R\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x\"   \n    then have a00:\"((\\<sigma>', \\<sigma>''), \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<sigma>'',\\<Sigma>'')\\<in>\\<alpha>\\<^sub>x\" \n      using a3 a4  by (meson G_comp1)    \n    have \"(\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                 (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s',G\\<^sub>s')\" \n      using dest_sim_env_step[OF a0 a00] by auto    \n    then have \"(\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n           (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s',G\\<^sub>s')\"  by auto\n  }\n  moreover{   \n    fix \\<sigma>n\n    assume \"C\\<^sub>c' = LanguageCon.com.Skip \\<and> \\<sigma>' = Normal \\<sigma>n\"\n    then have a0:\"(\\<Gamma>\\<^sub>c,(Skip,Normal \\<sigma>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"         \n      using a0 by auto\n    then have \"\\<exists>\\<Sigma>n'. ((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n             \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\" \n      using sim_elim_cases_c(1)[OF a0] by fastforce\n    then have   \"\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c', G\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n\\<^sub>' \\<and>\n                     \\<gamma>\\<^sub>n\\<^sub>' \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\"\n      using  G_comp1  a1 a5 a6 by blast \n  }\n  moreover{\n    fix \\<sigma>n\n    assume \"C\\<^sub>c' = LanguageCon.com.Throw \\<and> \\<sigma>' = Normal \\<sigma>n\"\n    then have a0:\"(\\<Gamma>\\<^sub>c,(Throw,Normal \\<sigma>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\" \n        using a0 by fastforce\n    then have \"\\<exists>\\<Sigma>n'. ((Normal \\<sigma>n, Normal \\<sigma>n),  \\<Sigma>', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n             \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw, Normal \\<Sigma>n')\"  \n      using  sim_elim_cases_c(2)[OF a0] by fastforce\n    then have \"\\<exists>\\<Sigma>n'. ((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c', G\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a\\<^sub>' \\<and>\n                     \\<gamma>\\<^sub>a\\<^sub>' \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\"\n     using  G_comp1  a2 a5 a6 by blast \n  }\n  moreover{\n    fix c\\<^sub>c' \\<sigma>'' e\n    assume sigma:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \"        \n    then have \"\\<exists>\\<Sigma>'' c\\<^sub>s'. (\\<sigma>'',\\<Sigma>'')\\<in>\\<alpha>\\<^sub>x \\<and> (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'')  \\<or> \n               (\\<exists>v. e = Some v \\<and>  \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sup>+ (c\\<^sub>s',\\<Sigma>'') )) \\<and> (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c \"\n      using dest_sim_ev_step_not_normal[OF a0,of e c\\<^sub>c' \\<sigma>''] by fast\n    then obtain \\<Sigma>'' c\\<^sub>s' where alpha:\"(\\<sigma>'',\\<Sigma>'')\\<in>\\<alpha>\\<^sub>x \" and  \n           \"(\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n            (\\<exists>v. e = Some v \\<and>\n                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c' \" using a6\n      by fastforce+\n    moreover have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s',G\\<^sub>s')\"          \n      by (meson a3 a4 a7 rg alpha sigma sim_not_normal subset_trans)\n    ultimately have \"\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                   (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                            (\\<exists>v. e = Some v \\<and>\n                                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> \n                           (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c' \\<and>\n                           ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                            (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>)\n                            (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s',G\\<^sub>s')))\" \n      by fast\n  }\n  moreover {\n    assume a00:\"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> C\\<^sub>c' = LanguageCon.com.Skip\"\n    then have \"(\\<exists>\\<Sigma>''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, \\<Sigma>'') \\<and> (\\<sigma>', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x)\"\n       by (fastforce intro:sim_elim_cases[OF a0 ])      \n  }\n  ultimately show \"(\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n       (\\<forall>\\<sigma>n. \\<sigma>' = Normal \\<sigma>n \\<longrightarrow> (\\<exists>\\<Sigma>n. \\<Sigma>' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>)) \\<and>\n       (\\<forall>c\\<^sub>c' \\<sigma>n'.\n           (\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')) \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n')) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c', G\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s',G\\<^sub>s')))) \\<and>\n       (\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           (\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')) \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c', G\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s',G\\<^sub>s')))) \\<and>\n       (\\<forall>\\<sigma>'' \\<Sigma>''.\n           (((\\<sigma>', \\<sigma>''), \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c', R\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<longrightarrow>\n           (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n           (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s',G\\<^sub>s')) \\<and>\n       (\\<forall>\\<sigma>n. C\\<^sub>c' = LanguageCon.com.Skip \\<and> \\<sigma>' = Normal \\<sigma>n \\<longrightarrow>\n             (\\<exists>\\<Sigma>n'. ((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c', G\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n\\<^sub>' \\<and>\n                     \\<gamma>\\<^sub>n\\<^sub>' \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n'))) \\<and>\n       (\\<forall>\\<sigma>n. C\\<^sub>c' = LanguageCon.com.Throw \\<and> \\<sigma>' = Normal \\<sigma>n \\<longrightarrow>\n             (\\<exists>\\<Sigma>n'. ((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c', G\\<^sub>s'\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a\\<^sub>' \\<and>\n                     \\<gamma>\\<^sub>a\\<^sub>' \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n'))) \\<and>\n       (\\<forall>\\<sigma>'' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                   (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                            (\\<exists>v. e = Some v \\<and>\n                                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c' \\<and>\n                           ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                            (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>)\n                            (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s',G\\<^sub>s'))))) \\<and>\n       ((\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> C\\<^sub>c' = LanguageCon.com.Skip \\<longrightarrow>\n        (\\<exists>\\<Sigma>''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, \\<Sigma>'') \\<and> (\\<sigma>', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x))\" \n    by auto\nqed\n  \nlemma RGSim_Conseq:\n  \"\\<xi>\\<^sub>'\\<subseteq>\\<xi> \\<Longrightarrow>  \\<gamma>\\<^sub>n \\<subseteq> \\<gamma>\\<^sub>n\\<^sub>' \\<and> \\<gamma>\\<^sub>n\\<^sub>' \\<subseteq> \\<alpha> \\<Longrightarrow> \\<gamma>\\<^sub>a \\<subseteq> \\<gamma>\\<^sub>a\\<^sub>' \\<and> \\<gamma>\\<^sub>a\\<^sub>' \\<subseteq> \\<alpha> \\<Longrightarrow> \n   R\\<^sub>s' \\<subseteq> R\\<^sub>s \\<Longrightarrow> R\\<^sub>c' \\<subseteq> R\\<^sub>c \\<Longrightarrow> G\\<^sub>s \\<subseteq> G\\<^sub>s' \\<Longrightarrow> G\\<^sub>c\\<subseteq>G\\<^sub>c' \\<Longrightarrow> R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow> \\<forall>\\<sigma>.(\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c \\<Longrightarrow>\n  (\\<Gamma>\\<^sub>c,C\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>\n  (\\<Gamma>\\<^sub>c,C\\<^sub>c,R\\<^sub>c',G\\<^sub>c') \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>'\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>'\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s',G\\<^sub>s')\"\n  unfolding RGSim_pre_def apply (rule,rule,rule)  apply (rule RGSim_Conseq_sound[of \\<Gamma>\\<^sub>c C\\<^sub>c _ R\\<^sub>c G\\<^sub>c \\<alpha> \\<gamma>\\<^sub>n \\<gamma>\\<^sub>a])\n    by auto    \n    \n\nlemma strenrel_sound:\nassumes \n   a0:\"(\\<Gamma>\\<^sub>c,(C\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and\n   a1:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<sigma>=Normal \\<sigma>n \\<and> \\<Sigma> = Normal \\<Sigma>n \\<longrightarrow> (\\<sigma>n,\\<Sigma>n)\\<in>\\<alpha>\\<^sub>'\" and\n   a2:\"(\\<gamma>\\<^sub>n \\<union> \\<gamma>\\<^sub>a) \\<subseteq> \\<alpha>\\<^sub>' \\<and> \\<alpha>\\<^sub>' \\<subseteq> \\<alpha>\" and  a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a8:\"\\<forall>\\<sigma>.(\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\" and\n   a3:\"Sta\\<^sub>s \\<alpha>\\<^sub>' (G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n shows \"(\\<Gamma>\\<^sub>c,(C\\<^sub>c, \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s, \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"   \n   using a0 a1  \n proof (coinduction arbitrary:\\<sigma> \\<Sigma>  C\\<^sub>c C\\<^sub>s,clarsimp) \n   fix \\<sigma>' \\<Sigma>' C\\<^sub>c' C\\<^sub>s' \n   assume a0:\"(\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\" and\n          a1:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n \\<longrightarrow> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>\\<^sub>'\"\n   have \\<alpha>\\<^sub>x:\"(\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x\" using a0\n     using dest_sim_alpha_x by blast  \n   moreover have \" (\\<forall>\\<sigma>n. \\<sigma>' = Normal \\<sigma>n \\<longrightarrow> (\\<exists>\\<Sigma>n. \\<Sigma>' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>\\<^sub>'))\" \n     using a1 \\<alpha>\\<^sub>x Normal_alpha by fastforce\n   moreover {\n     fix c\\<^sub>c' \\<sigma>n'\n     assume a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n     then obtain \\<sigma>n \\<Sigma>n where \\<sigma>n:\"\\<sigma>' = Normal \\<sigma>n\" and \\<Sigma>n:\"\\<Sigma>' = Normal \\<Sigma>n\" using \\<alpha>\\<^sub>x\n       by (metis a0 compe_normal_s'_normal_s dest_sim_alpha)        \n     from a00 obtain c\\<^sub>s' \\<Sigma>n' where step_alpha:\"\n       \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n       (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n       (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n       (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\" \n    using dest_sim_tau_step[OF a0 a00] \\<sigma>n \\<Sigma>n by auto     \n     have \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n            \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<and>\n                (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n       using a1 a3 step_alpha \\<sigma>n \\<Sigma>n unfolding Sta\\<^sub>s_def related_transitions_def by fast\n   }\n   moreover{\n     fix  v c\\<^sub>c' \\<sigma>n'\n     assume a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n     then obtain \\<sigma>n \\<Sigma>n where \\<sigma>n:\"\\<sigma>' = Normal \\<sigma>n\" and \\<Sigma>n:\"\\<Sigma>' = Normal \\<Sigma>n\" using \\<alpha>\\<^sub>x\n       by (metis a0 compe_normal_s'_normal_s dest_sim_alpha)\n     then obtain c\\<^sub>s' \\<Sigma>n' where step_alpha:\" \n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sup>+ (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n              (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\n       \" \n       using dest_sim_ev_step[OF a0 a00] by fast\n     have \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sup>+ (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n       using a1 a3 step_alpha \\<sigma>n \\<Sigma>n unfolding Sta\\<^sub>s_def related_transitions_def by fast\n     then have \"(\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<and>\n                (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\" by auto\n   }\n   moreover{\n     fix  \\<Sigma>'' \\<sigma>''  \n     assume a00:\"(((\\<sigma>', \\<sigma>''), \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x\"     \n     then have a00':\"((\\<sigma>', \\<sigma>''), \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<sigma>'',\\<Sigma>'')\\<in>\\<alpha>\\<^sub>x\" \n       unfolding related_transitions_def using a2 by auto\n      have \"(\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \" \n        using dest_sim_env_step[OF a0 a00' ] by auto         \n      then have \"(\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<and>\n           (\\<forall>\\<sigma>n \\<Sigma>n. \\<sigma>'' = Normal \\<sigma>n \\<and> \\<Sigma>'' = Normal \\<Sigma>n \\<longrightarrow> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>\\<^sub>') \\<or>\n           (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\"\n       using a00 unfolding related_transitions_def by auto     \n    }\n    \n    moreover{\n      fix \\<sigma>n\n      assume a00:\"C\\<^sub>c' = LanguageCon.com.Skip \\<and> \\<sigma>' = Normal \\<sigma>n\"\n      then obtain \\<Sigma>n where \\<Sigma>':\"\\<Sigma>' = Normal \\<Sigma>n\" using \\<alpha>\\<^sub>x\n        by (meson Normal_alpha)\n    then have a0:\"(\\<Gamma>\\<^sub>c,(Skip,Normal \\<sigma>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', Normal \\<Sigma>n),R\\<^sub>s,G\\<^sub>s)\" \n      using a0 a00 by auto\n    then obtain \\<Sigma>n' where step_alpha:\n      \"((Normal \\<sigma>n, Normal \\<sigma>n), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n             \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\" \n       by (force elim: sim_elim_cases_c(1))\n    then have \"(\\<sigma>n, \\<Sigma>n')\\<in> \\<alpha>\\<^sub>'\" using  a1 a3 step_alpha \\<Sigma>' a00\n      unfolding Sta\\<^sub>s_def  by blast   \n    then have   \"((Normal \\<sigma>n, Normal \\<sigma>n), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>')\" \n      using   a00 \\<Sigma>' a1 step_alpha unfolding related_transitions_def by auto\n    then have \"\\<exists>\\<Sigma>n'. ((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>' \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n                     \\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\\<^sub>' \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\"\n      using step_alpha  a2 \\<Sigma>' by auto\n  }\n  moreover{\n    fix \\<sigma>n\n    assume a00:\"C\\<^sub>c' = LanguageCon.com.Throw \\<and> \\<sigma>' = Normal \\<sigma>n\"\n   then obtain \\<Sigma>n where \\<Sigma>':\"\\<Sigma>' = Normal \\<Sigma>n\" using \\<alpha>\\<^sub>x\n     by (meson Normal_alpha)\n    then have a0:\"(\\<Gamma>\\<^sub>c,(Throw,Normal \\<sigma>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', Normal \\<Sigma>n),R\\<^sub>s,G\\<^sub>s)\" \n      using a0 a00 by auto\n    then obtain \\<Sigma>n' where step_alpha:\n      \"((Normal \\<sigma>n, Normal \\<sigma>n), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n             \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\" \n       by (force elim: sim_elim_cases_c(2))\n    then have \"(\\<sigma>n, \\<Sigma>n')\\<in> \\<alpha>\\<^sub>'\" using a1 a3 step_alpha \\<Sigma>' a00 \n      unfolding Sta\\<^sub>s_def  by blast   \n    then have   \"((Normal \\<sigma>n, Normal \\<sigma>n), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>')\" \n      using  a00 \\<Sigma>' a1 step_alpha unfolding related_transitions_def by auto\n    then have \"\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                     \\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\\<^sub>' \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\"\n      using step_alpha  a2 \\<Sigma>' by auto\n  }  \n  moreover{\n   fix \\<sigma>'' c\\<^sub>c' e\n   assume sigma:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n)\"\n   then have \"\\<exists>\\<Sigma>'' c\\<^sub>s'. (\\<sigma>'',\\<Sigma>'')\\<in>\\<alpha>\\<^sub>x \\<and> (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'')  \\<or> \n               (\\<exists>v. e = Some v \\<and>  \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sup>+ (c\\<^sub>s',\\<Sigma>'') )) \\<and> (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c \"\n     using dest_sim_ev_step_not_normal[OF a0,of e c\\<^sub>c' \\<sigma>''] by fast\n   then obtain \\<Sigma>'' c\\<^sub>s' where alpha:\"(\\<sigma>'',\\<Sigma>'')\\<in>\\<alpha>\\<^sub>x \" and  \n           \"(\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n            (\\<exists>v. e = Some v \\<and>\n                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and>  (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c\" \n      by fastforce+\n    moreover have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\"        \n      by (meson a3 a7 a8 alpha sigma sim_not_normal subset_trans)\n   ultimately have  \"\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                   (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                            (\\<exists>v. e = Some v \\<and>\n                                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c \\<and> \n                           ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                            (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))\" by fast   \n }\n  moreover{\n    assume \"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> C\\<^sub>c' = LanguageCon.com.Skip\"\n    then have \"\\<exists>\\<Sigma>''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, \\<Sigma>'') \\<and> (\\<sigma>', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x\"\n     by (fastforce intro:sim_elim_cases[OF a0 ])    \n  }\n  ultimately show \n     \"(\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n       (\\<forall>\\<sigma>n. \\<sigma>' = Normal \\<sigma>n \\<longrightarrow> (\\<exists>\\<Sigma>n. \\<Sigma>' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>\\<^sub>')) \\<and>\n       (\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<and>\n                (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<and>\n                (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>\\<sigma>'' \\<Sigma>''.\n           (((\\<sigma>', \\<sigma>''), \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<longrightarrow>\n           (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<and>\n           (\\<forall>\\<sigma>n \\<Sigma>n. \\<sigma>'' = Normal \\<sigma>n \\<and> \\<Sigma>'' = Normal \\<Sigma>n \\<longrightarrow> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>\\<^sub>') \\<or>\n           (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)) \\<and>\n       (\\<forall>\\<sigma>n. C\\<^sub>c' = LanguageCon.com.Skip \\<and> \\<sigma>' = Normal \\<sigma>n \\<longrightarrow>\n             (\\<exists>\\<Sigma>n'. ((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>' \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n                     \\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\\<^sub>' \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n'))) \\<and>\n       (\\<forall>\\<sigma>n. C\\<^sub>c' = LanguageCon.com.Throw \\<and> \\<sigma>' = Normal \\<sigma>n \\<longrightarrow>\n             (\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                     \\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\\<^sub>' \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n'))) \\<and>\n       (\\<forall>\\<sigma>'' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                   (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                            (\\<exists>v. e = Some v \\<and>\n                                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c \\<and> \n                           ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                            (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s))))) \\<and>\n       ((\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> C\\<^sub>c' = LanguageCon.com.Skip \\<longrightarrow>\n        (\\<exists>\\<Sigma>''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, \\<Sigma>'') \\<and> (\\<sigma>', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x)) \" by auto\n     \nqed\n  \n \nlemma strenrel:\n  \"(\\<Gamma>\\<^sub>c,C\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>\n  (\\<xi> \\<union> \\<gamma>\\<^sub>n \\<union> \\<gamma>\\<^sub>a) \\<subseteq> \\<alpha>\\<^sub>' \\<and> \\<alpha>\\<^sub>' \\<subseteq> \\<alpha> \\<Longrightarrow>\n  Sta\\<^sub>s \\<alpha>\\<^sub>' (G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<Longrightarrow>   R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow> \\<forall>\\<sigma>.(\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c \\<Longrightarrow>\n   (\\<Gamma>\\<^sub>c,C\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (rule, rule, rule) apply (rule strenrel_sound)   \n  by auto\n    \n lemma weakenrel_sound:\nassumes \n   a0:\"(\\<Gamma>\\<^sub>c,(C\\<^sub>c, \\<sigma>na),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s, \\<Sigma>na),R\\<^sub>s,G\\<^sub>s)\" and\n   a1:\"\\<alpha> \\<subseteq> \\<alpha>\\<^sub>'\" and\n   a2:\" Sta\\<^sub>s \\<alpha> (R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>'\" and a4:\" R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \" and a8:\"\\<forall>\\<sigma>.(\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\"\n shows \"(\\<Gamma>\\<^sub>c,(C\\<^sub>c, \\<sigma>na),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s, \\<Sigma>na),R\\<^sub>s,G\\<^sub>s)\"   \n   using a0 \n proof (coinduction arbitrary:\\<sigma>na \\<Sigma>na  C\\<^sub>c C\\<^sub>s,clarsimp) \n   fix \\<sigma>' \\<Sigma>' C\\<^sub>c' C\\<^sub>s' \n   assume a0:\"(\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n   have alpha_rel:\"\\<forall>\\<sigma>n. \\<sigma>' = Normal \\<sigma>n  \\<longrightarrow> (\\<exists>\\<Sigma>n. \\<Sigma>' = Normal \\<Sigma>n \\<and> (\\<sigma>n,\\<Sigma>n) \\<in> \\<alpha>\\<^sub>')\" \n     using dest_sim_alpha[OF a0] using a1 by fastforce\n   moreover have \\<alpha>\\<^sub>x:\"(\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x\" using a0\n     using dest_sim_alpha_x by blast \n   moreover{\n     fix c\\<^sub>c' \\<sigma>n'\n     assume a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n     then obtain \\<sigma>n \\<Sigma>n where \\<sigma>n:\"\\<sigma>' = Normal \\<sigma>n\" and \\<Sigma>n:\"\\<Sigma>' = Normal \\<Sigma>n\" using \\<alpha>\\<^sub>x\n       by (metis a0 compe_normal_s'_normal_s dest_sim_alpha)        \n     then obtain cs' \\<Sigma>n' where step_alpha:\"\n       \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (cs', Normal \\<Sigma>n') \\<and>\n       (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n       (((Normal \\<sigma>n, Normal \\<sigma>n'),Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n       (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(cs', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\" \n       using dest_sim_tau_step[OF a0 a00] by auto \n     moreover have \"(\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>'\" using a1 calculation by auto\n     moreover have \"(((Normal \\<sigma>n, Normal \\<sigma>n'),Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>')\"\n       using step_alpha  a1   unfolding related_transitions_def  by auto\n     ultimately have \"(\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\n       using \\<sigma>n \\<Sigma>n\n       by auto\n   }\n   moreover{\n     fix  v c\\<^sub>c' \\<sigma>n'\n     assume a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n     then obtain \\<sigma>n \\<Sigma>n where \\<sigma>n:\"\\<sigma>' = Normal \\<sigma>n\" and \\<Sigma>n:\"\\<Sigma>' = Normal \\<Sigma>n\" using \\<alpha>\\<^sub>x\n       by (metis a0 compe_normal_s'_normal_s dest_sim_alpha)\n     then obtain c\\<^sub>s' \\<Sigma>n' where step_alpha:\" \n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sup>+ (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\" \n       using dest_sim_ev_step[OF a0 a00]  by fast\n     moreover have \"(\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>'\" using a1 calculation by auto\n     moreover have \"((Normal \\<sigma>n, Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>'\"\n       using step_alpha  a1 \\<sigma>n  \\<Sigma>n unfolding related_transitions_def  by auto\n     ultimately have \" \n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sup>+ (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<and>\n               (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<or> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c)\n                \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\" using \\<sigma>n \\<Sigma>n by auto\n     then have \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\" using \\<sigma>n \\<Sigma>n by fast\n   }\n   moreover{\n    fix \\<sigma>'' \\<Sigma>''  \n    assume a00:\"(((\\<sigma>', \\<sigma>''), \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x\"\n    {assume \"\\<exists>\\<sigma>n. \\<sigma>' = Normal \\<sigma>n\"\n      then obtain \\<sigma>n \\<Sigma>n where \\<sigma>:\"\\<sigma>' = Normal \\<sigma>n \\<and> \\<Sigma>' = Normal \\<Sigma>n\"\n        using \\<alpha>\\<^sub>x by (metis Normal_alpha) \n       moreover have \"(\\<sigma>n,\\<Sigma>n)\\<in>\\<alpha>\" using dest_sim_alpha[OF a0] calculation by auto\n     ultimately have a00':\"((Normal \\<sigma>n, \\<sigma>''), Normal \\<Sigma>n, \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x\" \n       using a00 a2  unfolding Sta\\<^sub>s_def related_transitions_def by fast\n     then have \"(\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                 (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\"\n       using dest_sim_env_step[OF a0] \\<sigma>  unfolding related_transitions_def by auto        \n    }\n    moreover{\n      assume a000:\"\\<nexists>\\<sigma>n. \\<sigma>' = Normal \\<sigma>n\"\n      then have \"\\<nexists>\\<Sigma>n. \\<Sigma>' = Normal \\<Sigma>n\" using \\<alpha>\\<^sub>x\n        using alpha_not_normal by auto\n      then have \"(\\<nexists>\\<sigma>n. \\<sigma>'' = Normal \\<sigma>n) \\<and> (\\<nexists>\\<Sigma>n. \\<Sigma>' = Normal \\<Sigma>n)\" \n        using a4 a00 a000 unfolding related_transitions_def\n        by (metis (no_types, lifting) a00 simulation_env_not_normal)\n      then have \"(\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                 (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\"\n        using  sim_not_normal a00 a4 a8 by auto\n   }\n   ultimately have \"(\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                 (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\" by auto\n  }\n  moreover{\n    fix \\<sigma>n\n    assume \"C\\<^sub>c' = LanguageCon.com.Skip \\<and> \\<sigma>' = Normal \\<sigma>n\"    \n    then have a0:\"(\\<Gamma>\\<^sub>c,(Skip,Normal \\<sigma>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n      using a0 by auto\n    then obtain \\<Sigma>n' where step_alpha:\n      \"((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n             \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\" \n      by (force elim: sim_elim_cases_c(1))    \n    then have \"(\\<sigma>n,\\<Sigma>n')\\<in> \\<alpha>\\<^sub>'\" using a1  \n      unfolding Sta\\<^sub>s_def  by blast   \n    moreover have   \"((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>')\" \n      using  a1 step_alpha unfolding related_transitions_def by auto    \n    ultimately have \"\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n                     \\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\\<^sub>' \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\" \n      using step_alpha a1 by auto\n  }\n  moreover{\n     fix \\<sigma>n\n     assume \"C\\<^sub>c' = LanguageCon.com.Throw \\<and> \\<sigma>' = Normal \\<sigma>n\"      \n    then have a0:\"(\\<Gamma>\\<^sub>c,(Throw,Normal \\<sigma>n),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"         \n      using a0 by auto\n    then obtain \\<Sigma>n' where step_alpha:\n      \"((Normal \\<sigma>n, Normal \\<sigma>n),\\<Sigma>', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<sigma>n,\\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n             \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s',  \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw, Normal \\<Sigma>n')\" \n      by (force elim: sim_elim_cases_c(2))\n    then have \"(\\<sigma>n,\\<Sigma>n')\\<in> \\<alpha>\\<^sub>'\" using a1 by auto   \n    moreover have \"((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>')\" \n      using a1 step_alpha unfolding related_transitions_def by auto    \n    then have \"\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                     \\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\\<^sub>' \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\"\n     using step_alpha a1 by auto\n  }  \n  moreover{\n    fix \\<sigma>'' c\\<^sub>c' e\n    assume a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n)\"\n    then have \"\\<exists>\\<Sigma>'' c\\<^sub>s'. (\\<sigma>'',\\<Sigma>'')\\<in>\\<alpha>\\<^sub>x \\<and> (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'')  \\<or> \n               (\\<exists>v. e = Some v \\<and>  \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sup>+ (c\\<^sub>s',\\<Sigma>'') ))  \\<and> (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c\"\n     using dest_sim_ev_step_not_normal[OF a0,of e c\\<^sub>c' \\<sigma>''] by fast\n   then obtain \\<Sigma>'' c\\<^sub>s' where alpha:\"(\\<sigma>'',\\<Sigma>'')\\<in>\\<alpha>\\<^sub>x \" and  \n           \"((\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s',  \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n            (\\<exists>v. e = Some v \\<and>\n                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s',  \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'')))))) \\<and> (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c\" \n      by fastforce+\n    moreover have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\"\n      by (simp add: a00 a4 a8 alpha sim_not_normal)              \n    ultimately have \"\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                  (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                           (\\<exists>v. e = Some v \\<and>\n                                (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                       (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c \\<and> \n                          ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))\"  by fastforce\n  }\n  moreover {\n    assume \"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> C\\<^sub>c' = LanguageCon.com.Skip\"\n    then have \"(\\<exists>\\<Sigma>''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, \\<Sigma>'') \\<and> (\\<sigma>', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x)\"\n      by (fastforce intro:sim_elim_cases[OF a0 ])    \n  }\n  ultimately show \n     \"(\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n       (\\<forall>\\<sigma>n. \\<sigma>' = Normal \\<sigma>n \\<longrightarrow> (\\<exists>\\<Sigma>n. \\<Sigma>' = Normal \\<Sigma>n \\<and> (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>\\<^sub>')) \\<and>\n       (\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha>\\<^sub>' \\<and>\n               (((\\<sigma>', Normal \\<sigma>n'), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n               ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s) \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>\\<sigma>'' \\<Sigma>''. (((\\<sigma>', \\<sigma>''), \\<Sigma>', \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<longrightarrow>\n                 (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                 (\\<Gamma>\\<^sub>c,(C\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(C\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)) \\<and>\n       (\\<forall>\\<sigma>n. C\\<^sub>c' = LanguageCon.com.Skip \\<and> \\<sigma>' = Normal \\<sigma>n \\<longrightarrow>\n             (\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n                     \\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\\<^sub>' \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n'))) \\<and>\n       (\\<forall>\\<sigma>n. C\\<^sub>c' = LanguageCon.com.Throw \\<and> \\<sigma>' = Normal \\<sigma>n \\<longrightarrow>\n             (\\<exists>\\<Sigma>n'. (((Normal \\<sigma>n, Normal \\<sigma>n), \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>') \\<and>\n                     (\\<sigma>n, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                     \\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\\<^sub>' \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n'))) \\<and>\n       (\\<forall>\\<sigma>'' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C\\<^sub>c', \\<sigma>') \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and> (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                  (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                           (\\<exists>v. e = Some v \\<and>\n                                (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                       (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (\\<sigma>', \\<sigma>'') \\<in> G\\<^sub>c \\<and>\n                          ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s) \\<or>\n                           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s))))) \\<and>\n       ((\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<and> C\\<^sub>c' = LanguageCon.com.Skip \\<longrightarrow>\n        (\\<exists>\\<Sigma>''. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (C\\<^sub>s', \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, \\<Sigma>'') \\<and> (\\<sigma>', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x)) \"\n    by force \n     \nqed   \n    \n lemma weakenrel:\n  \"(\\<Gamma>\\<^sub>c,C\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>\n  \\<alpha> \\<subseteq> \\<alpha>\\<^sub>' \\<Longrightarrow>\n  Sta\\<^sub>s \\<alpha> (R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\\<^sub>' \\<Longrightarrow>   R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow> \\<forall>\\<sigma>.(\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c \\<Longrightarrow>\n   (\\<Gamma>\\<^sub>c,C\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>'\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (rule, rule, rule) apply (rule weakenrel_sound)     \n  by auto\n \n\nprimrec state_mod :: \"('s,'p,'f,'e) com \\<Rightarrow> bool\"\n  where \n\"state_mod (Basic _ _)  = True\"\n|\"state_mod (Spec _ _)  = True\"\n|\"state_mod (Await _ _ _)  = True\"\n|\"state_mod Skip = False\"\n  |\"state_mod (Seq _ _) = False\"    \n  |\"state_mod (Cond _ _ _) = False\"\n  | \"state_mod (While _ _) = False\"\n  | \"state_mod (Call _) = False\"\n  | \"state_mod (DynCom _) = False\" \n  | \"state_mod (Guard _ _ _) =False\" \n  | \"state_mod Throw = False\"\n  | \"state_mod (Catch _ _) = False\"\n\nprimrec label :: \"('s,'p,'f,'e) com \\<Rightarrow> 'e option\"\n  where\n\"label (Basic _ l)  = l\"\n|\"label (Spec _ l)  = l\"\n|\"label (Await _ _ l)  = l\"\n|\"label Skip = None\"\n  |\"label (Seq c1 c2) = (if (c1\\<noteq>Skip \\<and> c1\\<noteq>Throw) then label c1 else None)\"    \n  |\"label (Cond _ _ _) = None\"\n  | \"label (While _ _) = None\"\n  | \"label (Call _) = None\"\n  | \"label (DynCom _) = None\" \n  | \"label (Guard _ _ _) =None\" \n  | \"label Throw = None\"\n  | \"label (Catch c1 c2) = (if (c1\\<noteq>Skip \\<and> c1\\<noteq>Throw) then label c1 else None)\"\n\nlemma \n  assumes a0:\"(\\<And>C'. \\<Gamma>\\<turnstile>\\<^sub>c\\<^sub>e (C1, Normal s) \\<rightarrow> (C', s') \\<Longrightarrow> label C1 = e)\" and          \n        a2:\"\\<Gamma>\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq C1 C2, Normal s) \\<rightarrow> (C', s')\" and\n       a3:\"l = label C1\" and a4:\"C1 \\<noteq> LanguageCon.com.Skip\" and a5:\"C1 \\<noteq> LanguageCon.com.Throw\" \n     shows \"label C1 = e\"\nproof (cases C1)\n  case Skip then show ?thesis using a4 by metis\nnext\n  case (Basic x21 x22)   \n  then show ?thesis using evstepc_elim_seq(3)[OF a2] a0 \n    by fastforce  \nnext\n  case (Spec x31 x32)    \n  then show ?thesis using evstepc_elim_seq(3)[OF a2] a0 \n    by fastforce     \nnext\n  case (Seq x41 x42)      \n  then show ?thesis using evstepc_elim_seq(3)[OF a2] a0 \n    by fastforce\n    \nnext\ncase (Cond x51 x52 x53)\n  then show ?thesis using evstepc_elim_seq(3)[OF a2] a0 \n    by fastforce\nnext\n  case (While x61 x62)\n  then show ?thesis  using evstepc_elim_seq(3)[OF a2] a0  \n    by fastforce\nnext\n  case (Call x7) then show ?thesis  using evstepc_elim_seq(3)[OF a2] a0  \n    by fastforce\nnext\n  case (DynCom x8) then show ?thesis  using evstepc_elim_seq(3)[OF a2] a0  \n    by fastforce\nnext\n  case (Guard x91 x92 x93)\n    then show ?thesis  using evstepc_elim_seq(3)[OF a2] a0  \n    by fastforce\nnext\n  case Throw\n  then show ?thesis  using evstepc_elim_seq(3)[OF a2] a0  \n    by fastforce\nnext\n  case (Catch x111 x112)\n  then show ?thesis  using evstepc_elim_seq(3)[OF a2] a0  \n    by fastforce\nnext\n  case (Await x121 x122 x123)\n  then show ?thesis  using evstepc_elim_seq(3)[OF a2] a0  \n    by fastforce\nqed\n\n\nlemma label_step:\"label C = l \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c\\<^sub>e (C, Normal s) \\<rightarrow> (C',s') \\<Longrightarrow>\n      l = e\"\n  apply (induction C arbitrary: C')  apply auto  \n  by (fastforce elim: stepc_elim_cases1)+\n                              \n\nprimrec com_step_n ::\"('s,'p,'f,'e) com \\<Rightarrow> 's \\<Rightarrow> ('s,'p,'f,'e) body \\<Rightarrow> (('s,'f) xstate) set\"\n  where\n\"com_step_n  (Basic f l) s \\<Gamma> = {s'. (\\<exists>sn. (sn = f s) \\<and> s' = Normal sn)}\"\n|\"com_step_n (Spec r l) s \\<Gamma> = {s'. (\\<exists>sn. ((s,sn)\\<in> r) \\<and> s' = Normal sn) \\<or> ((\\<nexists>sn.(s, sn)\\<in>r) \\<and> s' = Stuck)}\"\n|\"com_step_n (Await b c l) s \\<Gamma> = {t. (s \\<in> b \\<and> \\<Gamma>\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t)}\"\n(* |\"com_step Skip s \\<Gamma> = {Normal s} \"\n|\"com_step (Seq _ _) s \\<Gamma> = {Normal s}\"    \n|\"com_step (Cond _ _ _) s \\<Gamma> = {Normal s}\"\n| \"com_step (While _ _) s \\<Gamma> = {Normal s}\"\n| \"com_step (Call _) s \\<Gamma> = {Normal s}\" \n| \"com_step (DynCom _) s \\<Gamma> = {Normal s}\" \n| \"com_step (Guard _ _ _) s \\<Gamma> = {Normal s}\" \n| \"com_step Throw s \\<Gamma> = {Normal s}\"\n| \"com_step (Catch _ _) s \\<Gamma> = {Normal s}\"  *)\n\nprimrec com_step::\"('s,'p,'f,'e) com \\<Rightarrow> ('s,'f) xstate \\<Rightarrow> ('s,'p,'f,'e) body \\<Rightarrow> (('s,'f) xstate) set\"\n  where                         \n\"com_step C (Normal s) \\<Gamma> = com_step_n C s \\<Gamma>\"\n|\"com_step C (Abrupt s) \\<Gamma> = {Abrupt s}\"\n|\"com_step C Stuck \\<Gamma> = {Stuck}\"\n|\"com_step C (Fault f) \\<Gamma> = {Fault f}\"\n\nlemma com_step_BS:\n  assumes a0:\"s' \\<in> com_step P (Normal s1) \\<Gamma>\" and\n        a1:\"(\\<exists> f. P = Basic f l) \\<or> (\\<exists>r. P = Spec r l) \\<or> (\\<exists>b c. P = Await b c l)\" and\n        a2:\"(\\<forall>sn'. s' \\<noteq> Abrupt sn')\"\n  shows  \"\\<Gamma>\\<turnstile>\\<^sub>c\\<^sub>l (P, (Normal s1)) \\<rightarrow> (Skip, s')\"  \nproof-\n  show ?thesis using a0 a1 a2\n    apply auto \n       apply (force intro: stepc_stepce_unique stepce.Basicc)    \n      apply (force intro: stepc_stepce_unique stepce.Specc)           \n      apply (meson stepce.SpecStuckc  stepc_stepce_unique)+\n    by (meson a2 stepce.Awaitc stepc_stepce_unique)+\nqed\n\nlemma com_step_BS1:\n  assumes a0:\"s' \\<in> com_step P s \\<Gamma>\" and\n        a1:\"(\\<exists> f. P = Basic f l) \\<or> (\\<exists>r. P = Spec r l) \\<or> (\\<exists>b c. P = Await b c l)\" and\n        a2:\"s' = Abrupt sn'\" and\n        a3:\"s= Normal s1\"\n  shows  \"\\<Gamma>\\<turnstile>\\<^sub>c\\<^sub>l (P, s) \\<rightarrow> (Throw, Normal sn')\"  \nproof-\n  show ?thesis using a0 a1 a2 a3\n    apply auto \n    using AwaitAbruptc by fastforce \nqed\n\nlemma com_step_BSNotNormal:\n  assumes a0:\"s' \\<in> com_step P s \\<Gamma>\" and\n        a1:\"(\\<exists> f l. P = Basic f l) \\<or> (\\<exists>r l. P = Spec r l) \\<or> (\\<exists>b c l. P = Await b c l)\" and\n        a2:\"(\\<forall>sn'. s \\<noteq> Normal sn')\"\n  shows  \"\\<exists>l. \\<Gamma>\\<turnstile>\\<^sub>c\\<^sub>l (P, s) \\<rightarrow> (Skip, s')\"\nproof (cases s)\n  case Normal thus ?thesis using a2 by auto\nnext\ncase (Abrupt x2)\n  then show ?thesis using a0 a1   \n    by(fastforce intro: stepce.AbruptPropc )+\nnext\n  case (Fault x3)\n  then show ?thesis using a0 a1 by(fastforce intro: stepce.FaultPropc)+\nnext\n  case Stuck\n  then show ?thesis using a0 a1 by(fastforce intro: stepce.StuckPropc)+ \nqed\n\n(* \nlemma com_step_n:\"s' \\<in> com_step P s \\<Gamma> \\<Longrightarrow> \\<not>(\\<exists>t'. s' = Abrupt t') \\<Longrightarrow> \n                 (\\<exists>b c l. P = Await b c l \\<and> s\\<in>b) \\<Longrightarrow> \\<exists>P' l. \\<Gamma>\\<turnstile>\\<^sub>c\\<^sub>l (P, s) \\<rightarrow> (P', s')\"  \n  apply auto\n   by (meson stepc.Awaitc stepc_stepce_unique)\n  \nlemma com_step_b:\"s' \\<in> com_step P s \\<Gamma> \\<Longrightarrow>  s' = Abrupt t' \\<Longrightarrow> (\\<exists>b c l. P = Await b c l \\<and> s\\<in>b) \\<Longrightarrow> \\<exists>P' l. \\<Gamma>\\<turnstile>\\<^sub>c\\<^sub>l (P, Normal s) \\<rightarrow> (P', Normal t')\"  \n  apply auto\n   by (meson stepc.AwaitAbruptc stepc_stepce_unique)\n\n\nlemma \"\\<forall>\\<sigma> \\<sigma>' \\<Sigma> . (Normal \\<sigma>, Normal \\<Sigma>)\\<in>\\<xi> \\<and> \\<sigma>' \\<in> com_step  C \\<sigma>  \\<Gamma>\\<^sub>c  \\<longrightarrow> \n                (\\<exists>\\<Sigma>'. \\<Sigma>' \\<in> com_step  S \\<Sigma> \\<Gamma>\\<^sub>s \\<and> \n                     (Normal \\<sigma>',Normal \\<Sigma>')\\<in>\\<gamma>\\<^sub>n \\<and> \n                     (Normal \\<sigma>, Normal \\<sigma>') \\<in> G\\<^sub>c \\<and>\n                     (Normal \\<Sigma>, Normal \\<Sigma>') \\<in> G\\<^sub>s)\"\n  sorry *)\n\nlemma mod_sound:\n  assumes  \n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. (sn, sn)\\<in>G\\<^sub>c\" and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and  \n a9:\"C = Basic fc l \\<or> C = Spec rc l \\<or> C = Await bc Cc l\" and \n a9': \"S = Basic fs l \\<or> S = Spec rs l \\<or> S = Await bs Cs l\" and  \n a10:\"\\<forall>\\<sigma> \\<sigma>' \\<Sigma> . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<sigma>' \\<in> com_step  C (Normal \\<sigma>)  \\<Gamma>\\<^sub>c  \\<longrightarrow> \n                (\\<exists>\\<Sigma>'. \\<Sigma>' \\<in> com_step  S (Normal \\<Sigma>) \\<Gamma>\\<^sub>s \\<and>  (\\<sigma>', \\<Sigma>')\\<in>\\<alpha>\\<^sub>x \\<and> \n                       ((\\<forall>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n'   \\<longrightarrow> \n                           (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>n',\\<Sigma>n')\\<in>\\<gamma>\\<^sub>n \\<and> \n                           (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)))  \\<and> \n                       (\\<forall>\\<sigma>n'. \\<sigma>' = Abrupt \\<sigma>n'  \\<longrightarrow> \n                           (\\<exists>\\<Sigma>n'. \\<Sigma>' = Abrupt \\<Sigma>n' \\<and> (\\<sigma>n', \\<Sigma>n')\\<in>\\<gamma>\\<^sub>a \\<and> \n                                (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)) \\<and> \n                       ((\\<forall>\\<sigma>n'. \\<sigma>' \\<noteq> Normal \\<sigma>n') \\<and> (\\<forall>\\<sigma>n'. \\<sigma>' \\<noteq> Abrupt \\<sigma>n') \\<longrightarrow> (Normal \\<sigma>, \\<sigma>')\\<in> G\\<^sub>c ))                      \n                 \" and\n a11:\"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and\n a12:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v (C, Normal \\<sigma>n) \\<rightarrow> (C', \\<sigma>')\"\nshows \"\\<exists>S' \\<Sigma>'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S', \\<Sigma>'))) \\<and>\n          (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x  \\<and> ((\\<forall>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n'   \\<longrightarrow> \n                           (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>n',\\<Sigma>n')\\<in>\\<alpha> \\<and> \n                             (Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> G\\<^sub>s))) \\<and> (Normal \\<sigma>n, \\<sigma>') \\<in> G\\<^sub>c  \\<and>                         \n          (\\<Gamma>\\<^sub>c,(C', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\nproof-  \n  have v_l:\"v = l\" using a12 a9 label_step by fastforce   \n  have c1:\"C' = Skip \\<or> C' = Throw\" using a9 stepc_elim_cases1(3,4,8)\n  proof -\n    have \"\\<forall>f z c x ca xa. \\<not> f\\<turnstile>\\<^sub>c\\<^sub>z (c::('a, 'd, 'b, 'e) LanguageCon.com, x) \\<rightarrow> (ca, xa) \\<or> f\\<turnstile>\\<^sub>c (c, x) \\<rightarrow> (ca, xa)\"\n      by (metis stepce_stepc)\n    then show ?thesis\n      using a12 a9 basic_skip spec_skip await_skip\n      by (metis stepce_stepc)\n  qed\n  moreover {\n    assume c1:\"C' = Skip\"\n    then have  s1:\"\\<sigma>' \\<in> com_step  C (Normal \\<sigma>n) \\<Gamma>\\<^sub>c\" using a9 a12       \n      by  (fastforce elim: stepc_elim_cases1(4) stepc_elim_cases1(3)  stepc_elim_cases1(8))+             \n    {assume \"\\<exists>sn1. \\<sigma>' = Normal sn1\"\n      then obtain \\<sigma>n' where \\<sigma>n':\"\\<sigma>' = Normal \\<sigma>n'\" by auto\n      then obtain \\<Sigma>'  where cond: \"\\<Sigma>' \\<in> com_step  S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>s \\<and>   (\\<sigma>', \\<Sigma>')\\<in>\\<alpha>\\<^sub>x \\<and>\n                           (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>n',\\<Sigma>n')\\<in>\\<gamma>\\<^sub>n \\<and> \n                           (Normal \\<sigma>n, \\<sigma>') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>n, \\<Sigma>') \\<in> G\\<^sub>s)\"\n       using a10 a11 c1 s1 by fast\n      have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (S, Normal \\<Sigma>n) \\<rightarrow> (Skip, \\<Sigma>')\" \n        using com_step_BS cond a9'   v_l by fast           \n      then have ?thesis using \n        a11 cond  a1 a2 Skip_sim_normal[OF  a2 _ a4  _ a6 a7 ] c1 cond  \\<sigma>n' \n        unfolding related_transitions_def by blast\n    }\n    moreover { \n      assume ass0:\"\\<sigma>' = Stuck \\<or> (\\<exists>f. \\<sigma>' = Fault f)\"      \n      then obtain \\<Sigma>'  where cond: \"\\<Sigma>' \\<in> com_step  S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>s \\<and>  (\\<sigma>', \\<Sigma>')\\<in>\\<alpha>\\<^sub>x \\<and> (Normal \\<sigma>n, \\<sigma>') \\<in> G\\<^sub>c\"\n        using a10 a11 c1 s1 by fast     \n      then have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (S, Normal \\<Sigma>n) \\<rightarrow> (Skip, \\<Sigma>')\" \n        using com_step_BS cond a9' v_l\n        by (metis Fault_alpha Stuck_alpha ass0 xstate.distinct(7) xstate.distinct(9))                \n      have ?thesis using steps cond  \n           Skip_sim_normal_not_normal[OF  _ _ a7 a6 ]  c1 ass0 by fast\n    }\n    moreover { \n      assume ass0: \"\\<exists>sn. \\<sigma>' = Abrupt sn\"\n      then have False using a12 c1 step_Abrupt_end        \n        using stepce_stepc by fastforce\n      then have ?thesis by auto\n    }\n    ultimately have ?thesis by (cases \\<sigma>', auto)     \n  }\n  moreover \n  { assume c1:\"C' = Throw\"\n    then obtain bc Cc where c:\"C = Await bc Cc l\"\n      using a9 a12 \n      by  (fastforce elim: stepc_elim_cases1(4) stepc_elim_cases1(3)  stepc_elim_cases1(8))\n    then obtain \\<sigma>n' where sn1: \"\\<sigma>' = Normal \\<sigma>n' \\<and> \\<sigma>n \\<in> bc \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>n\\<rangle> \\<Rightarrow> Abrupt \\<sigma>n'\"\n      using c1 a12 by (fastforce elim: stepc_elim_cases1(8))\n    moreover have  s1:\"Abrupt \\<sigma>n' \\<in> com_step  C (Normal \\<sigma>n) \\<Gamma>\\<^sub>c\" using c calculation by auto          \n    ultimately obtain \\<Sigma>' \\<Sigma>n' where cond: \"\\<Sigma>' \\<in> com_step  S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>s \\<and>                             \n                                (\\<Sigma>' = Abrupt \\<Sigma>n' \\<and> (\\<sigma>n', \\<Sigma>n')\\<in>\\<gamma>\\<^sub>a \\<and> \n                                (Normal \\<sigma>n, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> G\\<^sub>s)\"\n       using a10 a11 c1 s1  by fastforce         \n    then have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (S, Normal \\<Sigma>n) \\<rightarrow> (Throw, Normal \\<Sigma>n')\" \n      using   a9' sn1 com_step_BS1 v_l by metis      \n    then have sim:\"(\\<Gamma>\\<^sub>c,(C', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Throw, Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\"\n      using cond Throw_sim_normal[OF  a2' _ a5 _ a6 a7 ] sn1 c1 by fast\n    then have ?thesis using a2' steps   a11  cond  a1 sn1\n      unfolding related_transitions_def\n      using dest_sim_alpha_x by fastforce\n  }\n  ultimately show ?thesis by auto \nqed\n\nlemma intro_tau_step:\"(\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c1', s1'))) \\<Longrightarrow>          \n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c1', s1') \"  \n  by auto           \n  \n\nlemma state_mod_sim_not_normal: assumes a0:\"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and\n     a1:\"(\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                       (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>e (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S', \\<Sigma>'))) \\<and>\n                (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n                (\\<forall>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n' \\<longrightarrow>\n                       (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and>\n                               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n                                (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)) \\<and> \n                 (Normal \\<sigma>, \\<sigma>') \\<in> G\\<^sub>c \\<and>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n   shows\" \\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (Normal \\<sigma>, \\<sigma>') \\<in> G\\<^sub>c \\<and>\n                     (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"\nproof-  \n  have \"(\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S', \\<Sigma>')))))\"\n    using a1 by (cases e, fastforce+) \n  then show ?thesis using a1 by metis\nqed\n\n\n\nlemma mod_state_tau_sound: \n  assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. (sn, sn)\\<in>G\\<^sub>c\" and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n a9:\"C = Basic fc v \\<or> C = Spec rc v \\<or>  C = Await bc Cc v\" and \n a9': \"S = Basic fs v \\<or> S = Spec rs v \\<or> S = Await bs Cs v\" and  \n a10:\"\\<forall>\\<sigma> \\<sigma>' \\<Sigma> . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<sigma>' \\<in> com_step  C (Normal \\<sigma>)  \\<Gamma>\\<^sub>c  \\<longrightarrow> \n                (\\<exists>\\<Sigma>'. \\<Sigma>' \\<in> com_step  S (Normal \\<Sigma>) \\<Gamma>\\<^sub>s \\<and>  (\\<sigma>', \\<Sigma>')\\<in>\\<alpha>\\<^sub>x \\<and> \n                       ((\\<forall>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n'   \\<longrightarrow> \n                           (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>n',\\<Sigma>n')\\<in>\\<gamma>\\<^sub>n \\<and> \n                           (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)))  \\<and> \n                       (\\<forall>\\<sigma>n'. \\<sigma>' = Abrupt \\<sigma>n'  \\<longrightarrow> \n                           (\\<exists>\\<Sigma>n'. \\<Sigma>' = Abrupt \\<Sigma>n' \\<and> (\\<sigma>n', \\<Sigma>n')\\<in>\\<gamma>\\<^sub>a \\<and> \n                                (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)) \\<and> \n                       ((\\<forall>\\<sigma>n'. \\<sigma>' \\<noteq> Normal \\<sigma>n') \\<and> (\\<forall>\\<sigma>n'. \\<sigma>' \\<noteq> Abrupt \\<sigma>n') \\<longrightarrow> (Normal \\<sigma>, \\<sigma>')\\<in> G\\<^sub>c ))                      \n                 \" \nshows \"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\"  \n  \nproof-\n  {fix \\<sigma> \\<Sigma> \n    assume a11: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"    \n    then have \"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n  apply (coinduction arbitrary: \\<sigma> \\<Sigma>)\n      apply clarsimp\n      apply (rule conjId)+\n      apply (rule, rule, rule, rule) \n             apply (frule mod_sound[OF a1 a2 a2' a3 a4 a5 a6 a7   a9 a9' a10], fast)\n      apply (fast intro: state_mod_sim_not_normal)      \n      using a9 apply auto[2] \n      apply (rule, rule, rule)   apply (blast dest: sim_env[OF _ a3 a6 a7])          \n         apply (clarify, frule mod_sound[OF  a1 a2 a2' a3 a4 a5 a6 a7   a9 a9' a10], auto)\n      apply (fastforce dest: related_transition_intro[OF subsetD[OF a1]])                               \n        apply(frule mod_sound[OF  a1 a2 a2' a3 a4 a5 a6 a7  a9 a9' a10], auto)      \n        apply (frule related_transition_intro[OF subsetD[OF a1]], assumption+) \n        apply(meson rtranclp.rtrancl_into_rtrancl rtranclp_trans)  \n      using  a1 unfolding alpha_xstate_def by auto   \n  } then show ?thesis unfolding RGSim_pre_def by auto\nqed\n\n(* |\"com_step Skip s \\<Gamma> = {Normal s} \"\n|\"com_step (Seq _ _) s \\<Gamma> = {Normal s}\"    \n|\"com_step (Cond _ _ _) s \\<Gamma> = {Normal s}\"\n| \"com_step (While _ _) s \\<Gamma> = {Normal s}\"\n| \"com_step (Call _) s \\<Gamma> = {Normal s}\" \n| \"com_step (DynCom _) s \\<Gamma> = {Normal s}\" \n| \"com_step (Guard _ _ _) s \\<Gamma> = {Normal s}\" \n| \"com_step Throw s \\<Gamma> = {Normal s}\"\n| \"com_step (Catch _ _) s \\<Gamma> = {Normal s}\"  *)\n\n(* primrec com_step1::\"('s,'p,'f,'e) com \\<Rightarrow> ('s,'p,'f,'e) body \\<Rightarrow> 's set \\<Rightarrow> 's set \\<Rightarrow> ('s,'f) xstate\"\n  where                         \n\"com_step1 C (Normal s) \\<Gamma> = com_step_n1 C s \\<Gamma>\"\n|\"com_step1 C (Abrupt s) \\<Gamma> = {Abrupt s}\"\n|\"com_step1 C Stuck \\<Gamma> = {Stuck}\"\n|\"com_step1 C (Fault f) \\<Gamma> = {Fault f}\" *)\n\n\nlemma step_imp_normal_rel_:\n  assumes \n a0:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (P \\<sigma>n) Cc \n        (Q \\<sigma>n), s\" and\n a1:\"\\<sigma> \\<in> P \\<sigma>\" and\n a2:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>'\"\nshows\n \"\\<sigma>' \\<in> Q \\<sigma>\"\nproof-\n obtain n where \" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow> Normal \\<sigma>'\"\n    using a2 Semantic.exec_to_execn by fastforce \n  moreover have \"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub>  \n        (P \\<sigma>) Cc \n        (Q \\<sigma>), s\"\n   using a0 a2   hoare_cnvalid by fastforce\n  ultimately show ?thesis  unfolding cnvalid_def nvalid_def  \n    using a2 a1  by blast\nqed\n\nlemma in_normal_not_abrupt:\n  assumes \n a0:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> P1 Cc Q, {}\" and\n  a1: \"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Abrupt \\<sigma>'\" and\n   a3:\"\\<sigma> \\<in> P1\"\nshows \"P\"\nproof-\n  obtain n where \" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow> Abrupt \\<sigma>'\"\n    using a1 Semantic.exec_to_execn by fastforce \n  moreover have \"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub> P1 Cc Q, {}\"\n    using a0  hoare_cnvalid by fastforce\n  ultimately show ?thesis unfolding cnvalid_def nvalid_def using  a3 by fastforce\nqed\n\nlemma not_normal_false:\n  assumes \n a0:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> P1 Cc Q, {}\" and\n  a1: \"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow>  \\<sigma>'\" and a2:\"\\<forall>\\<sigma>''. \\<sigma>' \\<noteq> Normal \\<sigma>''\" and\n   a3:\"\\<sigma> \\<in> P1\" and a4:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\"\nshows \"P\"\nproof-\n  obtain n where \" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow>  \\<sigma>'\"\n    using a1 Semantic.exec_to_execn by fastforce \n  moreover have \"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub> P1 Cc Q, {}\"\n    using a0  hoare_cnvalid by fastforce\n  ultimately obtain \\<sigma>'' where \"\\<sigma>' = Normal \\<sigma>''\" unfolding cnvalid_def nvalid_def using  a3 a4\n    using a1 by blast \n  then show ?thesis unfolding cnvalid_def nvalid_def using  a2 by auto\nqed\n\nlemma not_normal_false1:\n  assumes \n a0:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> P1 Cc Q, {}\" and\n  a1: \"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow>  \\<sigma>'\" and a2:\"\\<forall>\\<sigma>''. \\<sigma>' \\<noteq> Normal \\<sigma>''\" and\n   a3:\"\\<sigma> \\<in> P1\" and a4:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\"\nshows \"P\"\nproof-\n  obtain n where \" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow>  \\<sigma>'\"\n    using a1 Semantic.exec_to_execn by fastforce \n  moreover have \"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub> P1 Cc Q, {}\"\n    using a0  hoare_cnvalid by fastforce\n  ultimately obtain \\<sigma>'' where \"\\<sigma>' = Normal \\<sigma>''\" unfolding cnvalid_def nvalid_def using  a3 a4\n    using a1 by blast \n  then show ?thesis unfolding cnvalid_def nvalid_def using  a2 by auto\nqed\n\n\nlemma step_spec_normal_rel:\n  assumes \n a0:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> \\<sigma>n\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\" and\n a1:\"\\<forall>\\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         ({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}),{}\" and\n a2:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a3:\"\\<sigma> \\<in> bc\" and a4:\"\\<Sigma>\\<in>bs\" and\n a5:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>'\" and a6:\"\\<forall>\\<Sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Fault f\"\nshows \"\\<exists>\\<Sigma>'. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Normal \\<Sigma>' \\<and> (\\<sigma>',\\<Sigma>')\\<in>\\<gamma>\\<^sub>n \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s\"\nproof-\n  obtain n where \" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow> Normal \\<sigma>'\"\n    using a5 Semantic.exec_to_execn by fastforce \n  moreover have \"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub>  \n        (bc \\<inter> {s. \\<sigma> = s \\<and> \\<sigma>\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\"\n   using a0 a2 a3 hoare_cnvalid by fastforce\n  ultimately have \"\\<sigma>' \\<in> Domain \\<gamma>\\<^sub>n\"  unfolding cnvalid_def nvalid_def  \n    using a2 a3  by blast\n  have \" \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>}) Cs \n         ({s. (Normal  \\<Sigma>, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}),{}\"\n    using a2 a1 by blast\n  then have \"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>}) Cs \n         ({s. (Normal  \\<Sigma>, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}),{}\"\n    using hoaret_sound' by blast  \n  thus ?thesis  \n    using a4 a2 a6 Termination.terminates_implies_exec   unfolding validt_def valid_def\n    by blast\nqed\n\nlemma step_spec_abrupt_rel:\n  assumes \n a0:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> \\<sigma>n\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\" and\n a1:\"\\<forall>\\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         {},({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>a})\" and\n a2:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a3:\"\\<sigma> \\<in> bc\" and a4:\"\\<Sigma>\\<in>bs\" and\n a5:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Abrupt \\<sigma>'\" and a6:\"\\<forall>\\<Sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Fault f\"\nshows \"\\<exists>\\<Sigma>'. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Abrupt \\<Sigma>' \\<and> (\\<sigma>',\\<Sigma>')\\<in>\\<gamma>\\<^sub>a \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s\"\nproof-\n  obtain n where \" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow> Abrupt \\<sigma>'\"\n    using a5 Semantic.exec_to_execn by fastforce \n  moreover have \"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub>  \n        (bc \\<inter> {s. \\<sigma> = s \\<and> \\<sigma>\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\"\n   using a0 a2 a3 hoare_cnvalid by fastforce\n  ultimately have \"\\<sigma>' \\<in> Domain \\<gamma>\\<^sub>a\"  unfolding cnvalid_def nvalid_def  \n    using a2 a3 a5 by blast\n  have \" \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>}) Cs \n         {},({s. (Normal  \\<Sigma>, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>a})\"\n    using a2 a1 by blast\n  then have \"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>}) Cs \n         {},({s. (Normal  \\<Sigma>, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>a})\"\n    using hoaret_sound' by blast  \n  thus ?thesis  \n    using a4 a2 a6 Termination.terminates_implies_exec  unfolding validt_def valid_def\n    by fastforce\nqed\n\nlemma step_imp_normal_rel:\n  assumes \n a0:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> \\<sigma>n\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\" and\n a1:\"\\<sigma> \\<in>bc \\<and> \\<sigma>\\<in>Domain \\<xi>\" and\n a2:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>'\"\nshows\n \"\\<sigma>'\\<in> Domain \\<gamma>\\<^sub>n \\<and> (Normal \\<sigma>, Normal \\<sigma>')\\<in> G\\<^sub>c\"\nproof-\n obtain n where \" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow> Normal \\<sigma>'\"\n    using a2 Semantic.exec_to_execn by fastforce \n  moreover have \"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub>  \n        (bc \\<inter> {s. \\<sigma> = s \\<and> \\<sigma>\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\"\n   using a0 a2   hoare_cnvalid by fastforce\n  ultimately show ?thesis  unfolding cnvalid_def nvalid_def  \n    using a2 a1  by blast\nqed\n\nlemma step_imp_normal_rel1:\n  assumes \n a0:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> \\<sigma>n\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> p), s\" and\n a1:\"\\<sigma> \\<in>bc \\<and> \\<sigma>\\<in>Domain \\<xi>\" and\n a2:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>'\"\nshows\n \"\\<sigma>'\\<in> p \\<and> (Normal \\<sigma>, Normal \\<sigma>')\\<in> G\\<^sub>c\"\nproof-\n obtain n where \" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow> Normal \\<sigma>'\"\n    using a2 Semantic.exec_to_execn by fastforce \n  moreover have \"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub>  \n        (bc \\<inter> {s. \\<sigma> = s \\<and> \\<sigma>\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> p), s\"\n   using a0 a2   hoare_cnvalid by fastforce\n  ultimately show ?thesis  unfolding cnvalid_def nvalid_def  \n    using a2 a1  by blast\nqed\n\nlemma step_imp_normal_rel2:\n  assumes \n a0:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> p), s\" and\n a1:\"\\<sigma> \\<in>bc \\<and> (\\<sigma>,\\<Sigma>)\\<in>\\<xi>\" and\n a2:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>'\"\nshows\n \"\\<sigma>'\\<in> p \\<and> (Normal \\<sigma>, Normal \\<sigma>')\\<in> G\\<^sub>c\"\nproof-\n obtain n where \" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow> Normal \\<sigma>'\"\n    using a2 Semantic.exec_to_execn by fastforce \n  moreover have \"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub>  \n        (bc \\<inter> {s. \\<sigma> = s \\<and> (\\<sigma>,\\<Sigma>)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> p), s\"\n   using a0 a2   hoare_cnvalid by fastforce\n  ultimately show ?thesis  unfolding cnvalid_def nvalid_def  \n    using a2 a1  by blast\nqed\n\nlemma step_imp_abrupt_rel:\n  assumes \n a0:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> \\<sigma>n\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\" and\n a1:\"\\<sigma> \\<in>bc \\<and> \\<sigma>\\<in>Domain \\<xi>\" and\n a2:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Abrupt \\<sigma>'\"\nshows\n \"\\<sigma>'\\<in> Domain \\<gamma>\\<^sub>a \\<and> (Normal \\<sigma>, Normal \\<sigma>')\\<in> G\\<^sub>c\"\nproof-\n obtain n where \" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow> Abrupt \\<sigma>'\"\n    using a2 Semantic.exec_to_execn by fastforce \n  moreover have \"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub>  \n        (bc \\<inter> {s. \\<sigma> = s \\<and> \\<sigma>\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\"\n   using a0 a2   hoare_cnvalid by fastforce\n  ultimately show ?thesis  unfolding cnvalid_def nvalid_def  \n    using a2 a1  by blast\nqed\n\n\nlemma await_sim:assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and  \n a9:\"C = Await bc Cc v\" and \n a9': \"S = Await bs Cs v\" and  \na10:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> \\<sigma>n\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\" and\n a11a:\"\\<forall>\\<sigma>n \\<sigma>n'. \\<sigma>n \\<in>(Domain \\<xi> \\<inter> bc) \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a \\<turnstile>\\<langle>Cc,Normal \\<sigma>n\\<rangle> \\<Rightarrow> Normal \\<sigma>n' \\<longrightarrow>  \n       (\\<forall>\\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>n,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         ({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>n',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}),{} )\" and \na11b:\"\\<forall>\\<sigma>n \\<sigma>n'. \\<sigma>n \\<in>(Domain \\<xi> \\<inter> bc) \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a \\<turnstile>\\<langle>Cc,Normal \\<sigma>n\\<rangle> \\<Rightarrow> Abrupt \\<sigma>n' \\<longrightarrow>  \n       (\\<forall>\\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>n,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         {},({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>n',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>a}) )\" and \n a12: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi> \" and\n a13: \"\\<xi> \\<subseteq> (bc \\<rightleftharpoons> bs)\" and\n a14:\"\\<forall>\\<Sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Fault f\" and \na15: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (C, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\"\nshows \"\\<exists>c1' \\<Sigma>'. \n         (\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n         (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c1', Normal \\<Sigma>'))) \\<and>\n         (\\<sigma>', \\<Sigma>') \\<in> \\<alpha> \\<and>\n         (((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n        (\\<Gamma>\\<^sub>c,(c1, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1', Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\nproof-\n  have v_eq:\"v1 = v\" using a15 a9\n    using label_step by fastforce\n  have a12': \"\\<sigma>\\<in>Domain \\<xi>\" using a12 by auto\n  \n    then have a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (Await bc Cc v1, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\" using a15 a9  v_eq by auto\n    then have \"c1 = Skip \\<or> c1 = Throw\" by (fastforce elim: stepc_normal_elim_cases)   \n    then show ?thesis \n    proof\n      assume a001:\"c1 = Skip\"\n      then have \\<sigma>b:\"\\<sigma>\\<in>bc\" and step:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>'\" \n        using stepc_normal_elim_cases[OF a00]\n        by (fast+)\n      then have \"(\\<forall>\\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         ({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}),{} )\"\n        using a11a a12' by auto\n      have \\<Sigma>b:\"\\<Sigma>\\<in>bs\"  using \\<sigma>b a12 a13 same_set by fastforce\n      then obtain \\<Sigma>' where step_cs:\"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Normal \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<gamma>\\<^sub>n \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s\"\n        using step_spec_normal_rel[OF a10 _ a12 \\<sigma>b _ step a14, of bs G\\<^sub>s] a11a a12' step \\<sigma>b\n        by auto\n      moreover have \" (Normal \\<sigma>, Normal \\<sigma>')\\<in> G\\<^sub>c\" using step_imp_normal_rel[OF a10 conjI[OF \\<sigma>b a12'] step]\n        by auto\n      then have \"((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n        using calculation(1) a1 a12 a2 unfolding related_transitions_def by fastforce\n      moreover have \"\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n                          (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip, Normal \\<Sigma>'))\"\n        using calculation(1) \\<Sigma>b a9' Awaitc[OF \\<Sigma>b _] v_eq by fastforce   \n      moreover have \"(\\<Gamma>\\<^sub>c,(Skip, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Skip, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n        using Skip_sim_normal[OF a2 _ a4 _ a6 a7 ] step_cs by blast\n      ultimately show ?thesis using a1 a12 a2 a9 a9' a001 by blast\n    next\n      assume a001:\"c1 = Throw\"\n      then have \\<sigma>b:\"\\<sigma>\\<in>bc\" and step:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Abrupt \\<sigma>'\"\n        using stepc_normal_elim_cases[OF a00]\n        by (fast+)            \n      then have \"(\\<forall>\\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         {},({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>a}) )\"\n        using a11b a12' by auto\n      have \\<Sigma>b:\"\\<Sigma>\\<in>bs\"  using \\<sigma>b a12 a13 same_set by fastforce\n      then obtain \\<Sigma>' where step_cs:\"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Abrupt \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<gamma>\\<^sub>a \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s\"\n        using step_spec_abrupt_rel[OF a10 _ a12 \\<sigma>b _ step a14, of bs G\\<^sub>s] a11b a12' step \\<sigma>b\n        by auto\n      moreover have \" (Normal \\<sigma>, Normal \\<sigma>')\\<in> G\\<^sub>c\" using step_imp_abrupt_rel[OF a10 conjI[OF \\<sigma>b a12'] step]\n        by auto\n      then have \"((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n        using calculation(1) a1 a12 a2' unfolding related_transitions_def by fastforce\n      moreover have \"\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n                          (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Throw, Normal \\<Sigma>'))\"\n        using calculation(1) \\<Sigma>b a9' AwaitAbruptc[OF \\<Sigma>b _] v_eq by fastforce      \n      moreover have \"(\\<Gamma>\\<^sub>c,(Throw, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Throw, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n        using Throw_sim_normal[OF a2' _ a5 _ a6 a7 ] step_cs by blast \n      ultimately show ?thesis using a1 a12 a2' a9 a9' a001 by blast    \n    qed \n  qed\n\nlemma Step_Await_not_normal: assumes a0:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\n          \\<turnstile>\\<^bsub>/F \\<^esub>(bc \\<inter> {s. \\<sigma>n = s \\<and> \\<sigma>n \\<in> Domain \\<xi>}) Cc ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n),\n                 ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\" and \n      a1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (Await bc Cc v, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and\n      a2:\"\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n\" and a3:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and  a03:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\"\n    shows \"P\"\nproof-\n  \n  have bc:\"\\<sigma>\\<in>bc \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> \\<sigma>' \\<and> (\\<forall>t'. \\<sigma>' \\<noteq> Abrupt t') \" \n    using  stepc_elim_cases1(8)[OF a1] a2  by fastforce\n  moreover have a0:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\n          \\<turnstile>\\<^bsub>/F \\<^esub>(bc \\<inter> {s. \\<sigma> = s \\<and> \\<sigma> \\<in> Domain \\<xi>}) Cc ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n),\n                 ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\"\n    using a3 a0 by auto  \n  obtain n where  step:\" \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>Cc,Normal \\<sigma>\\<rangle> =n\\<Rightarrow>  \\<sigma>'\"\n    using a0 bc Semantic.exec_to_execn by fastforce \n  moreover have val:\"\\<And>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>n:\\<^bsub>/F\\<^esub>  \n        (bc \\<inter> {s. \\<sigma> = s \\<and> \\<sigma>\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\"\n    using a0 a2 a3 hoare_cnvalid by fastforce\n  have   \n   \"\\<exists>\\<sigma>n'. \\<sigma>' = Abrupt \\<sigma>n' \\<and> \\<sigma>n'\\<in> Domain \\<gamma>\\<^sub>a \\<and> (Normal \\<sigma>, Normal \\<sigma>n')\\<in> G\\<^sub>c\" \n    using a2 val bc a3 step a03 unfolding cnvalid_def nvalid_def \n    by (cases \\<sigma>', fast+) \n  thus ?thesis  using bc   by auto \nqed\n\n\nlemma mod_state_Await_sound: \n  assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\"   and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\"  and\n a9:\"C = Await bc Cc v\" and \n a9': \"S = Await bs Cs v\" and  \na10:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> \\<sigma>n\\<in>Domain \\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>n), ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> Domain \\<gamma>\\<^sub>a)\" and\n a11a:\"\\<forall>\\<sigma>n \\<sigma>n'. \\<sigma>n \\<in>(Domain \\<xi> \\<inter> bc) \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a \\<turnstile>\\<langle>Cc,Normal \\<sigma>n\\<rangle> \\<Rightarrow> Normal \\<sigma>n' \\<longrightarrow>  \n       (\\<forall>\\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>n,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         ({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>n',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}),{} )\" and \na11b:\"\\<forall>\\<sigma>n \\<sigma>n'. \\<sigma>n \\<in>(Domain \\<xi> \\<inter> bc) \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a \\<turnstile>\\<langle>Cc,Normal \\<sigma>n\\<rangle> \\<Rightarrow> Abrupt \\<sigma>n' \\<longrightarrow>  \n       (\\<forall>\\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>n,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         {},({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>n',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>a}) )\"  and a13: \"\\<xi> \\<subseteq> (bc \\<rightleftharpoons> bs)\" and\na14:\"\\<forall>\\<Sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Fault f\" and a15:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\"\nshows \"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\"    \nproof-\n  {fix \\<sigma> \\<Sigma> \n    assume a11: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"   \n    then have \"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" \n     apply (coinduction arbitrary: \\<sigma> \\<Sigma>)\n      \n      apply clarsimp\n      apply (rule conjId)+ \n             apply (auto simp add: a9)\n           apply (auto intro: Step_Await_not_normal[OF a10 _ _ _ a15, where v=v])  \n          apply (blast dest: sim_env[OF _ a3 a6 a7])\n         apply (frule await_sim[OF a1 a2 a2' a3 a4 a5 a6 a7  a9 a9' a10 a11a a11b _ a13 a14, simplified a9], fast+)\n        apply (frule await_sim[OF a1 a2 a2' a3 a4 a5 a6 a7  a9 a9' a10 a11a a11b _ a13 a14, simplified a9], auto)\n      using intro_tau_step apply fast\n      using a1 unfolding alpha_xstate_def by auto\n  }  then show ?thesis unfolding RGSim_pre_def  by auto\nqed \n\nlemma basic_await_sim:assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n  a9:\"C = Basic fc v\" and \n a9': \"S = Await bs Cs v\" and  \n a11:\"\\<forall>\\<sigma>n \\<sigma>n' \\<Sigma>n. (\\<sigma>n, \\<Sigma>n)\\<in>\\<xi> \\<and> Normal \\<sigma>n' \\<in> com_step  C (Normal \\<sigma>n)  \\<Gamma>\\<^sub>c \\<longrightarrow>  \n       (\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>n,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         ({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>n',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}),{} )\" and \n a12: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi> \" and  a13:\"Range \\<xi> \\<subseteq> bs\" and \na14:\"\\<forall>\\<Sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Fault f\" and \na15: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (C, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\" and\na16:\"(Normal \\<sigma>, Normal (fc \\<sigma>))\\<in>G\\<^sub>c\" \nshows \"\\<exists>c1' \\<Sigma>'. \n         (\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n         (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c1', Normal \\<Sigma>'))) \\<and>\n         (\\<sigma>', \\<Sigma>') \\<in> \\<alpha> \\<and>\n         (((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n        (\\<Gamma>\\<^sub>c,(c1, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1', Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\nproof-\n  have v_eq:\"v1 = v\" using a15 a9\n    using label_step by fastforce\n  have a12': \"\\<sigma>\\<in>Domain \\<xi>\" using a12 by auto\n  have \\<Sigma>inbs: \"\\<Sigma>\\<in>bs\" using a13 a12 by auto\n  then have a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (Basic fc v, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\" using a15 a9  v_eq by auto\n  then have c1:\"c1 = Skip\" and \\<sigma>:\"\\<sigma>' = fc \\<sigma>\"\n    apply  (fastforce elim: stepc_normal_elim_cases)\n    by (meson a00 old.prod.inject stepc_Normal_elim_cases(3) stepce_stepc xstate.inject(1))   \n  then have \" Normal \\<sigma>' \\<in> com_step  C (Normal \\<sigma>)  \\<Gamma>\\<^sub>c\" using a9 by auto\n  then have \" \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>}) Cs \n         ({s. (Normal  \\<Sigma>, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}), {}\"\n    using a12 a11 by blast\n  then have \"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>}) Cs \n        ({s. (Normal  \\<Sigma>, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}), {}\"\n    using hoaret_sound' by blast  \n  moreover have \\<Sigma>b:\"\\<Sigma>\\<in>bs\"  using  a12 a13 by fastforce\n  ultimately obtain \\<Sigma>' where step_cs:\"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Normal \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<gamma>\\<^sub>n \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s\"\n    using a12 a14 Termination.terminates_implies_exec  unfolding validt_def valid_def\n    by blast    \n  moreover have \" (Normal \\<sigma>, Normal \\<sigma>')\\<in> G\\<^sub>c\" using a16 \\<sigma>\n      by auto\n  then have \"((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n      using calculation(1) a1 a12 a2 unfolding related_transitions_def by fastforce\n    moreover have \"\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip, Normal \\<Sigma>'))\"\n      using calculation(1) \\<Sigma>b a9' Awaitc[OF \\<Sigma>b _] v_eq by fastforce   \n    moreover have \"(\\<Gamma>\\<^sub>c,(Skip, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Skip, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n      using Skip_sim_normal[OF a2 _ a4 _ a6 a7 ] step_cs by blast\n    ultimately show ?thesis using a1 a12 a2 a9 a9' c1  by fast\nqed \n\nlemma spec_await_sim:assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and  \n a9: \"C = Spec f v\" and  a9': \"S = Await bs Cs v\" and \n a11:\"\\<forall>\\<sigma>n \\<sigma>n' \\<Sigma>n. (\\<sigma>n, \\<Sigma>n)\\<in>\\<xi> \\<and> Normal \\<sigma>n' \\<in> com_step  C (Normal \\<sigma>n)  \\<Gamma>\\<^sub>c \\<longrightarrow>  \n       (\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>n,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         ({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>n',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}),{} )\" and \n a12: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi> \" and  a13:\"Range \\<xi> \\<subseteq> bs\" and \na14:\"\\<forall>\\<Sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Fault f\" and \na15: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (C, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\" and\na16:\"\\<forall>\\<sigma>'. (\\<sigma>,\\<sigma>')\\<in>f \\<longrightarrow> (Normal \\<sigma>, Normal \\<sigma>')\\<in>G\\<^sub>c\" \nshows \"\\<exists>c1' \\<Sigma>'. \n         (\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n         (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c1', Normal \\<Sigma>'))) \\<and>\n         (\\<sigma>', \\<Sigma>') \\<in> \\<alpha> \\<and>\n         (((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n        (\\<Gamma>\\<^sub>c,(c1, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1', Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\nproof-\n  have v_eq:\"v1 = v\" using a15 a9\n    using label_step by fastforce\n  have a12': \"\\<sigma>\\<in>Domain \\<xi>\" using a12 by auto\n  have \\<Sigma>inbs: \"\\<Sigma>\\<in>bs\" using a13 a12 by auto\n  then have a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (Spec f v, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\" using a15 a9  v_eq by auto\n  then have c1:\"c1 = Skip\" and \\<sigma>:\"(\\<sigma>,\\<sigma>')\\<in>f\"\n    apply  (fastforce elim: stepc_normal_elim_cases)\n    using CRef.stepc_elim_cases(2) a00 spec_skip stepce_stepc by fastforce    \n  then have \" Normal \\<sigma>' \\<in> com_step  C (Normal \\<sigma>)  \\<Gamma>\\<^sub>c\" using a9 by auto\n  then have \" \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>}) Cs \n         ({s. (Normal  \\<Sigma>, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}), {}\"\n    using a12 a11 by blast\n  then have \"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>}) Cs \n        ({s. (Normal  \\<Sigma>, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}), {}\"\n    using hoaret_sound' by blast  \n  moreover have \\<Sigma>b:\"\\<Sigma>\\<in>bs\"  using  a12 a13 by fastforce\n  ultimately obtain \\<Sigma>' where step_cs:\"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Normal \\<Sigma>' \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<gamma>\\<^sub>n \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s\"\n    using a12 a14 Termination.terminates_implies_exec  unfolding validt_def valid_def\n    by blast    \n  moreover have \" (Normal \\<sigma>, Normal \\<sigma>')\\<in> G\\<^sub>c\" using a16 \\<sigma>\n      by auto\n  then have \"((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n      using calculation(1) a1 a12 a2 unfolding related_transitions_def by fastforce\n    moreover have \"\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip, Normal \\<Sigma>'))\"\n      using calculation(1) \\<Sigma>b a9' Awaitc[OF \\<Sigma>b _] v_eq by fastforce   \n    moreover have \"(\\<Gamma>\\<^sub>c,(Skip, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Skip, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n      using Skip_sim_normal[OF a2 _ a4 _ a6 a7] step_cs by blast\n    ultimately show ?thesis using a1 a12 a2 a9 a9' c1  by fast\nqed \n\nlemma basic_spec_await_sim:assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n  a9:\"C = Basic fc v \\<or> C = Spec rc v\" and \n a9': \"S = Await bs Cs v\" and  \n a10:\"\\<forall>\\<sigma>n\\<in>Domain \\<xi>. \\<forall>\\<sigma>n'. (Normal \\<sigma>n') \\<in> com_step C (Normal \\<sigma>n) \\<Gamma>\\<^sub>c \\<longrightarrow> (Normal \\<sigma>n, Normal \\<sigma>n')\\<in>G\\<^sub>c\" and\n a11:\"\\<forall>\\<sigma>n \\<sigma>n' \\<Sigma>n. (\\<sigma>n, \\<Sigma>n)\\<in>\\<xi> \\<and> Normal \\<sigma>n' \\<in> com_step  C (Normal \\<sigma>n)  \\<Gamma>\\<^sub>c \\<longrightarrow>  \n       (\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>n,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         ({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>n',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}),{} )\" and \na12:\"\\<forall>\\<Sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Fault f\" and\n a13: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi> \" and  a14:\"Range \\<xi> \\<subseteq> bs\" and\na15: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (C, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\"\nshows \"\\<exists>c1' \\<Sigma>'. \n         (\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n         (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c1', Normal \\<Sigma>'))) \\<and>\n         (\\<sigma>', \\<Sigma>') \\<in> \\<alpha> \\<and>\n         (((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n        (\\<Gamma>\\<^sub>c,(c1, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1', Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\nproof-\n  have a12': \"\\<sigma>\\<in>Domain \\<xi>\" using a13 by auto  \n  then show ?thesis \n    using a9 a10  basic_await_sim[OF a1 a2 a2' a3 a4 a5 a6 a7  _ a9' a11 a13 a14 a12 a15] \n              spec_await_sim[OF a1 a2 a2' a3 a4 a5 a6 a7  _ a9' a11 a13 a14 a12 a15]\n    by auto\nqed\n\nlemma Step_Basic_Spec_not_normal: \n  assumes a0:\"C = Basic fc v \\<or> C = Spec rc v\" and \n      a1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and\n      a2:\"\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n\" and a3:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and\n      a4:\"\\<forall>\\<sigma>\\<in>Domain \\<xi>. \\<exists>\\<sigma>'. (\\<sigma>,\\<sigma>')\\<in>rc\"\n    shows \"P\"\nproof-\n  {assume a00: \"C = Basic fc v\"\n    then have ?thesis using a1 a2\n      by (meson Pair_inject stepc_Normal_elim_cases(3) stepce_stepc)\n  }\n  moreover { \n    assume a00: \"C = Spec rc v\"\n    then have ?thesis using a4 a3 a1 a2\n      by (meson Domain.DomainI Pair_inject stepc_Normal_elim_cases(4) stepce_stepc)\n  }\n  ultimately show ?thesis using a0 by auto \nqed\n\nlemma mod_state_Await_Spec_Sim: \n  assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\"   and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n a9:\"C = Basic fc v \\<or> C = Spec rc v\" and \n a9': \"S = Await bs Cs v\" and  \n a10:\"\\<forall>\\<sigma>n\\<in>Domain \\<xi>. \\<forall>\\<sigma>n'. Normal \\<sigma>n' \\<in> com_step C (Normal \\<sigma>n) \\<Gamma>\\<^sub>c \\<longrightarrow> (Normal \\<sigma>n, Normal \\<sigma>n') \\<in> G\\<^sub>c\" and\n a11:\"\\<forall>\\<sigma>n \\<sigma>n' \\<Sigma>n. (\\<sigma>n, \\<Sigma>n)\\<in>\\<xi> \\<and> Normal \\<sigma>n' \\<in> com_step  C (Normal \\<sigma>n)  \\<Gamma>\\<^sub>c \\<longrightarrow>  \n       (\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n         ({s. (\\<sigma>n,  s) \\<in> \\<xi> } \\<inter> bs \\<inter> {\\<Sigma>n}) Cs \n         ({s. (Normal  \\<Sigma>n, Normal s) \\<in> G\\<^sub>s} \\<inter> {\\<Sigma>n'. (\\<sigma>n',\\<Sigma>n')\\<in> \\<gamma>\\<^sub>n}),{} )\" and \na12:\"\\<forall>\\<Sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cs,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Fault f\" and a13:\"Range \\<xi> \\<subseteq> bs\" and\n a14:\"\\<forall>\\<sigma>\\<in>Domain \\<xi>. \\<exists>\\<sigma>'. (\\<sigma>,\\<sigma>')\\<in>rc\"\nshows \"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\"    \nproof-\n  {fix \\<sigma> \\<Sigma> \n    assume a15: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"   \n    then have \"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" \n     apply (coinduction arbitrary: \\<sigma> \\<Sigma>)\n      \n      apply clarsimp\n      apply (rule conjId)+ \n      \n             apply (auto intro: Step_Basic_Spec_not_normal[OF a9 _ _ _ a14])      \n      using a9 apply simp using a9 apply simp  \n          apply (blast dest: sim_env[OF _ a3 a6 a7])\n         apply (frule basic_spec_await_sim[OF a1 a2 a2' a3 a4 a5 a6 a7  a9 a9' a10 a11 a12 _ a13], fast+)\n      apply (frule basic_spec_await_sim[OF a1 a2 a2' a3 a4 a5 a6 a7  a9 a9' a10 a11 a12 _ a13], fast+)        \n      using intro_tau_step apply fast\n      using a1 unfolding alpha_xstate_def by auto\n  }  then show ?thesis unfolding RGSim_pre_def  by auto\nqed \n\nlemma await_basic_sim:assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and   \n a9:\"C = Await bc Cc v\" and  \na9': \"S = Basic fc v\" and\na10:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> {s1. \\<exists>\\<Sigma>n'. Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>c \\<and> \n                                                 (s1, \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                                                (Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> G\\<^sub>s}), {}\"  and\na12: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi> \" and  a13:\"Domain \\<xi> \\<subseteq> bc\" and \na15: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (C, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\" \nshows \"\\<exists>c1' \\<Sigma>'. \n         (\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n         (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c1', Normal \\<Sigma>'))) \\<and>\n         (\\<sigma>', \\<Sigma>') \\<in> \\<alpha> \\<and>\n         (((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n        (\\<Gamma>\\<^sub>c,(c1, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1', Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\nproof-\n  have v_eq:\"v1 = v\" using a15 a9\n    using label_step by fastforce\n  have a12': \"\\<sigma>\\<in>Domain \\<xi>\" using a12 by auto\n  have \\<sigma>inbs: \"\\<sigma>\\<in>bc\" using a13 a12 by auto\n  then have a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (Await bc Cc v, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\" using a15 a9  v_eq by auto\n  then have c1:\"c1 = Skip \\<or> c1=Throw\" \n    by  (fastforce elim: stepc_elim_cases1(8))\n  {assume cSkip:\"c1 = Skip\"\n   then have  \\<sigma>:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>'\"\n     using a00 CRef.stepc_elim_cases1(8) a00 spec_skip stepce_stepc by fastforce\n   then have a10:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> {s1. \\<exists>\\<Sigma>n'. Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>) \\<Gamma>\\<^sub>c \\<and> \n                                                 (s1, \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                                                (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s}), {}\"\n     using a10 by auto\n   then obtain \\<Sigma>n' where step_cs:\"Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>) \\<Gamma>\\<^sub>c \\<and> \n                           (\\<sigma>', \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                          (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s \\<and> (Normal \\<sigma>, Normal \\<sigma>')\\<in> G\\<^sub>c\"     \n     using step_imp_normal_rel2[OF _ _ \\<sigma>, of F bc \\<Sigma> \\<xi> G\\<^sub>c \"{s1. \\<exists>\\<Sigma>n'. Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>) \\<Gamma>\\<^sub>c \\<and> \n                                                 (s1, \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                                                (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s}\" \"{}\"] a12 \\<sigma>inbs \n     by auto   \n   then have \"((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n      using  a1 a12 a2 unfolding related_transitions_def by fastforce\n   moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (Basic fc v, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>n')\" \n     using Basicc v_eq a9' step_cs by auto\n   then have \"\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip, Normal \\<Sigma>n'))\"\n     using a9' by fastforce\n   moreover have \"(\\<Gamma>\\<^sub>c,(c1, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Skip, Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\"\n      using Skip_sim_normal[OF a2 _ a4 _ a6 a7 ] step_cs cSkip by blast\n    ultimately have ?thesis using a2 step_cs by blast\n  }\n  moreover {\n    assume cSkip:\"c1 = Throw\"\n    then have  \\<sigma>:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Abrupt \\<sigma>'\"\n      using a00 CRef.stepc_elim_cases1(8) a00 spec_skip stepce_stepc by fastforce\n    then have ?thesis using in_normal_not_abrupt [OF _ \\<sigma>] \\<sigma>inbs a12 a10 by blast\n  } \n  ultimately show ?thesis using c1 by auto\nqed \n\nlemma await_spec_sim:assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and    \na9:\"C = Await bc Cc v\" and  \na9': \"S = Spec rc v\" and\na10:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> {s1. \\<exists>\\<Sigma>n'. Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>c \\<and> \n                                                 (s1, \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                                                (Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> G\\<^sub>s}), {}\"  and\na12: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi> \" and  a13:\"Domain \\<xi> \\<subseteq> bc\" and \na15: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (C, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\" \nshows \"\\<exists>c1' \\<Sigma>'. \n         (\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n         (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c1', Normal \\<Sigma>'))) \\<and>\n         (\\<sigma>', \\<Sigma>') \\<in> \\<alpha> \\<and>\n         (((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n        (\\<Gamma>\\<^sub>c,(c1, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1', Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\nproof-\n  have v_eq:\"v1 = v\" using a15 a9\n    using label_step by fastforce\n  have a12': \"\\<sigma>\\<in>Domain \\<xi>\" using a12 by auto\n  have \\<sigma>inbs: \"\\<sigma>\\<in>bc\" using a13 a12 by auto\n  then have a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (Await bc Cc v, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\" using a15 a9  v_eq by auto\n  then have c1:\"c1 = Skip \\<or> c1=Throw\" \n    by  (fastforce elim: stepc_elim_cases1(8))\n  {assume cSkip:\"c1 = Skip\"\n   then have  \\<sigma>:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>'\"\n     using a00 CRef.stepc_elim_cases1(8) a00 spec_skip stepce_stepc by fastforce\n   then have a10:\"\\<forall>\\<sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> {s1. \\<exists>\\<Sigma>n'. Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>) \\<Gamma>\\<^sub>c \\<and> \n                                                 (s1, \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                                                (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s}), {}\"\n     using a10 by auto\n   then obtain \\<Sigma>n' where step_cs:\"Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>) \\<Gamma>\\<^sub>c \\<and> \n                           (\\<sigma>', \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                          (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s \\<and> (Normal \\<sigma>, Normal \\<sigma>')\\<in> G\\<^sub>c\"     \n     using step_imp_normal_rel2[OF _ _ \\<sigma>, of F bc \\<Sigma> \\<xi> G\\<^sub>c \"{s1. \\<exists>\\<Sigma>n'. Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>) \\<Gamma>\\<^sub>c \\<and> \n                                                 (s1, \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                                                (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s}\" \"{}\"] a12 \\<sigma>inbs \n     by auto   \n   then have \"((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" \n      using  a1 a12 a2 unfolding related_transitions_def by fastforce\n   moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (Spec rc v, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>n')\" \n     using Specc v_eq a9' step_cs by auto\n   then have \"\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (Skip, Normal \\<Sigma>n'))\"\n     using a9' by fastforce\n   moreover have \"(\\<Gamma>\\<^sub>c,(c1, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Skip, Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\"\n      using Skip_sim_normal[OF a2 _ a4 _ a6 a7] step_cs cSkip by blast\n    ultimately have ?thesis using a2 step_cs by blast\n  }\n  moreover {\n    assume cSkip:\"c1 = Throw\"\n    then have  \\<sigma>:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Abrupt \\<sigma>'\"\n      using a00 CRef.stepc_elim_cases1(8) a00 spec_skip stepce_stepc by fastforce\n    then have ?thesis using in_normal_not_abrupt [OF _ \\<sigma>] \\<sigma>inbs a12 a10 by blast\n  } \n  ultimately show ?thesis using c1 by auto\nqed \n\nlemma await_basic_spec_sim:assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \na9:\"C = Await bc Cc v\" and    \na9':\"S = Basic fc v \\<or> S = Spec rc v\" and  \na10:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> {s1. \\<exists>\\<Sigma>n'. Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>c \\<and> \n                                                 (s1, \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                                                (Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> G\\<^sub>s}), {}\"  and\na12: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi> \" and  a13:\"Domain \\<xi> \\<subseteq> bc\" and \na15: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v1 (C, Normal \\<sigma>) \\<rightarrow> (c1, Normal \\<sigma>')\" \nshows \"\\<exists>c1' \\<Sigma>'. \n         (\\<exists>a b. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b)) \\<and>\n         (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v1 (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c1', Normal \\<Sigma>'))) \\<and>\n         (\\<sigma>', \\<Sigma>') \\<in> \\<alpha> \\<and>\n         (((Normal \\<sigma>, Normal \\<sigma>'), Normal \\<Sigma>, Normal \\<Sigma>') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n        (\\<Gamma>\\<^sub>c,(c1, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c1', Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\nproof-\n  have a12': \"\\<sigma>\\<in>Domain \\<xi>\" using a12 by auto  \n  then show ?thesis \n    using a9'  await_basic_sim[OF a1 a2 a2' a3 a4 a5 a6 a7  a9 _ a10 a12 a13 a15] \n              await_spec_sim[OF a1 a2 a2' a3 a4 a5 a6 a7  a9 _ a10 a12 a13 a15]\n    by auto\nqed\n\nlemma Step_Await_not_normal1: \n  assumes  \n      a1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (Await bc Cc v, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and\n      a2:\"\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n\" and a3:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and\n      a4:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> {s1. \\<exists>\\<Sigma>n'. Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>c \\<and> \n                                                 (s1, \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                                                (Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> G\\<^sub>s}), {}\" and a5:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\"\n    shows \"P\"\nproof-\n  have step: \"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow>  \\<sigma>' \\<and> \\<sigma>\\<in>bc\" \n    using a1 a2\n    by (metis Pair_inject stepc_Normal_elim_cases(8) stepce_stepc)   \n  thus ?thesis using not_normal_false[OF spec[OF spec[OF a4]] _ a2, of \\<sigma>] a3 a5 by auto\nqed\n\nlemma mod_state_Await_Impl_Sim: \n  assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\"   and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n a9:\"C = Await bc Cc v\" and    \na9':\"S = Basic fc v \\<or> S = Spec rc v\" and  \na10:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (bc \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c} \\<inter> {s1. \\<exists>\\<Sigma>n'. Normal \\<Sigma>n' \\<in> com_step S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>c \\<and> \n                                                 (s1, \\<Sigma>n')\\<in> \\<gamma>\\<^sub>n \\<and> \n                                                (Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> G\\<^sub>s}), {}\"  and\na13:\"Domain \\<xi> \\<subseteq> bc\" and  \na12:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\" \nshows \"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\"    \nproof-\n  {fix \\<sigma> \\<Sigma> \n    assume a15: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"   \n    then have \"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" \n     apply (coinduction arbitrary: \\<sigma> \\<Sigma>)\n      \n      apply clarsimp\n      apply (rule conjId)+       \n      using a9 apply (auto intro: Step_Await_not_normal1[OF _ _  _ a10 a12])    \n      using a9 apply simp using a9 apply simp  \n          apply (blast dest: sim_env[OF _ a3 a6 a7])\n         apply (frule await_basic_spec_sim[OF a1 a2 a2' a3 a4 a5 a6 a7  a9 a9' a10 _ a13], fast+)\n       apply (frule await_basic_spec_sim[OF a1 a2 a2' a3 a4 a5 a6 a7 a9 a9' a10 _ a13], fast+)        \n      using intro_tau_step apply fast\n      using a1 unfolding alpha_xstate_def by auto\n  }  then show ?thesis unfolding RGSim_pre_def  by auto\nqed\n\nlemma Impl_Skip_sim1:\n  assumes a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and\n       a2:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq LanguageCon.com.Skip C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and\n       a3:\"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" \n   shows\n         \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (Normal \\<sigma>,\\<sigma>')\\<in>G\\<^sub>c \\<and>\n                     (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"\n  using a2 a3\n  by (meson SmallStepCon.stepc_elim_cases(1) prod.inject stepc_Normal_elim_cases(5) stepce_stepc)\n\nlemma Impl_Skip_sim2: \n  assumes  \n a0:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n a3: \"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" and\n a4:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and\n a5:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq LanguageCon.com.Skip C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\nshows \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          (((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n          (c\\<^sub>c' = LanguageCon.com.Seq LanguageCon.com.Skip C \\<and> c\\<^sub>s' = S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof -\n  have \"c\\<^sub>c' = C\" and \"\\<sigma>n' = \\<sigma>\"using a5\n     apply (metis SmallStepCon.stepc_elim_cases(1) prod.sel(1) stepc_elim_cases_Seq_skip(1) stepce_stepc)\n    by (metis (no_types) SmallStepCon.stepc_elim_cases(1) a5 prod.inject stepc_elim_cases_Seq_skip(1) stepce_stepc xstate.inject(1))   \n  have rfgs:\"(Normal \\<Sigma>, Normal \\<Sigma>)\\<in> G\\<^sub>s\\<^sup>*\" by auto\n  have f1: \"\\<forall>a c. (a, c) \\<notin> \\<xi> \\<or> (\\<Gamma>\\<^sub>c,(C, Normal a),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal c),R\\<^sub>s,G\\<^sub>s)\"\n    by (meson RGSim_pre_def a3)\n  then have f2: \"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\"\n    using a0 rfgs a4 related_transition_intro sim_alpha\n    by (metis rtrancl_idemp)\n  have \"(\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\"\n    using f1 by (meson a4 sim_alpha)\n  then show ?thesis\n    using f2 f1 \\<open>\\<sigma>n' = \\<sigma>\\<close> \\<open>c\\<^sub>c' = C\\<close> a4 by auto\nqed      \n   \n\n\nlemma Impl_Seq_Skip_sim: assumes a0:\"\\<xi> \\<subseteq> \\<alpha>\" and \n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a8: \"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" \nshows \"(\\<Gamma>\\<^sub>c,Seq Skip C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\"\nproof-\n{fix \\<sigma> \\<Sigma> \n assume a11: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"    \n then have \"(\\<Gamma>\\<^sub>c,(Seq Skip C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n   apply (coinduction arbitrary: \\<sigma> \\<Sigma>)\n   apply simp\n   apply (rule conjId)+\n        apply (rule, rule, rule, rule)       \n        apply (frule Impl_Skip_sim1, fast+)\n       apply (blast dest: sim_env[OF _ a3 a6 a7])\n      apply (meson stepc_elim_cases1(1) stepc_elim_cases_Seq_skip_ev(1))\n     apply (rule, rule, rule)\n     apply (frule Impl_Skip_sim2[OF a6  a8], fast+)\n   using a0 apply auto[1] \n   unfolding alpha_xstate_def by auto\n} thus ?thesis unfolding RGSim_pre_def by auto\nqed\n\nlemma Impl_Skip_sim1':\n  assumes a0:\"\\<xi> \\<subseteq> \\<alpha>\" and \n a1:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n a3:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a4: \"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and\n       a5:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq C Skip, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and\n       a6:\"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" \n   shows\n         \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and>\n                     (Normal \\<sigma>, \\<sigma>') \\<in> G\\<^sub>c \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"\nproof-    \n  {assume a00:\"C = Skip\"\n    then have \"c\\<^sub>c' = Skip \\<and> \\<sigma>' = Normal \\<sigma>\" using a5\n      by (metis SmallStepCon.stepc_elim_cases(1) a6 snd_conv stepc_Normal_elim_cases(5) stepce_stepc)\n    then have ?thesis  using a4 a0 a00 \n      using a6 by blast\n  } \n  moreover {assume a00:\"C=Throw\" \n    then have ?thesis using stepc_elim_seq_skip(2)[OF a5[simplified a00]] a6  \n      apply auto\n      by (metis (no_types) throw1)  \n  }\n  moreover { assume \"C\\<noteq>Skip \\<and> C\\<noteq>Throw\"  \n    then obtain C' where \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C, Normal \\<sigma>) \\<rightarrow> (C', \\<sigma>')\"\n      using stepc_elim_cases1(5)[OF a5] by fastforce\n    moreover obtain \\<Sigma>' c\\<^sub>s' where \"(\\<sigma>',\\<Sigma>')\\<in>\\<alpha>\\<^sub>x \\<and> (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S,Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')  \\<or> \n                                           (\\<exists>v. e = Some v \\<and>  \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (S, Normal \\<Sigma>) \\<rightarrow>\\<^sup>+ (c\\<^sub>s',\\<Sigma>') )) \\<and>\n                   (Normal \\<sigma>, \\<sigma>')\\<in>G\\<^sub>c\" using dest_sim_ev_step_not_normal[OF a4] calculation a6 by fastforce        \n    moreover have \"\\<forall>\\<Sigma>n'. \\<Sigma>'\\<noteq>Normal \\<Sigma>n'\" using a6 calculation\n      by (meson Normal_alpha2)\n    then  have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\" using sim_not_normal[OF _ a6 a3 a2] calculation \n      by auto\n    ultimately have ?thesis by fastforce\n  } ultimately show ?thesis by auto\nqed\n\nlemma Impl_Skip_sim2':\n  assumes a0:\"\\<xi> \\<subseteq> \\<alpha>\" and \n    a1:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n    a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n    a3:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a4: \"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and          \n          a6:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Seq C LanguageCon.com.Skip, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\nshows  \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          ((\\<exists>C. c\\<^sub>c' = LanguageCon.com.Seq C LanguageCon.com.Skip \\<and> (\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)) \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof-    \n  have in_alpha:\"( \\<sigma>, \\<Sigma>)\\<in> \\<alpha>\" using a4\n    by (meson sim_alpha)\n\n  {assume a00:\"C = Skip\"    \n    then have ?thesis  using not_seq_skip_throw_ev a6[simplified a00]\n      by metis\n  } \n  moreover {assume a00:\"C=Throw\" \n    then have ?thesis  using not_seq_skip_throw_ev a6[simplified a00]\n      by metis  \n  }\n  moreover { assume \"C\\<noteq>Skip \\<and> C\\<noteq>Throw\"  \n    then obtain C' where step:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C, Normal \\<sigma>) \\<rightarrow> (C', Normal \\<sigma>n') \\<and> \n                               c\\<^sub>c' = LanguageCon.com.Seq C' LanguageCon.com.Skip\" \n      using stepc_elim_cases1(5)[OF a6] by auto\n    moreover obtain \\<Sigma>n' c\\<^sub>s' where \n     \" \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (S, Normal \\<Sigma>) \\<rightarrow>\\<^sup>+ (c\\<^sub>s', Normal \\<Sigma>n') \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n        ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> \n       (\\<Gamma>\\<^sub>c,(C', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\" \n      using dest_sim_ev_step[OF a4] step a6 by fastforce      \n    ultimately have ?thesis  by fastforce\n  } ultimately show ?thesis by fastforce\nqed  \n\nlemma Impl_Seq_Skip_sim3':\n  assumes \n     a0:\"\\<xi> \\<subseteq> \\<alpha>\" and \n    a1:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n    a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n    a3:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a4: \"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and     \n    a5:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq C LanguageCon.com.Skip, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" \n     shows\n       \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          ((\\<exists>C. c\\<^sub>c' = LanguageCon.com.Seq C LanguageCon.com.Skip \\<and> (\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)) \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof-\n  have in_alpha:\"( \\<sigma>, \\<Sigma>)\\<in> \\<alpha>\" using a4\n    by (meson sim_alpha)\n\n  {assume a00:\"C = Skip\"    \n    then have  eq:\"c\\<^sub>c' = Skip \\<and> \\<sigma>n' = \\<sigma>\"       \n     proof -\n       have \"\\<forall>f z x c xa. \\<not> f\\<turnstile>\\<^sub>c\\<^sub>z (LanguageCon.com.Skip::('a, 'd, 'c, 'e) LanguageCon.com, x) \\<rightarrow> (c, xa)\"\n         by (metis (no_types) skip1)\n       then have \"(c\\<^sub>c', Normal \\<sigma>n'::('a, 'c) xstate) = (LanguageCon.com.Skip, Normal \\<sigma>)\"\n         using stepc_elim_cases1(5)[OF a5[simplified a00]] by fastforce\n       then have \"c\\<^sub>c' = LanguageCon.com.Skip \\<and> (Normal \\<sigma>n'::('a, 'c) xstate) = Normal \\<sigma>\"\n         by fastforce\n       then have \"(c\\<^sub>c' = LanguageCon.com.Skip \\<and> (Normal \\<sigma>n'::('a, 'c) xstate) = Normal \\<sigma>) \\<and> \\<sigma>n' = \\<sigma>\"\n         by (meson xstate.inject(1))\n       then show ?thesis\n         by presburger\n     qed \n     moreover have  \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S, Normal \\<Sigma>)\" by auto\n     moreover have  \"((\\<exists>C. LanguageCon.com.Skip = LanguageCon.com.Seq C LanguageCon.com.Skip \\<and> (\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c)\n             \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)) \\<or>\n        (\\<Gamma>\\<^sub>c,(LanguageCon.com.Skip, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s))\"\n       using a4 a00 by fastforce \n     moreover have \"((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\"        \n       unfolding related_transitions_def using a2 eq in_alpha by fastforce\n     ultimately have ?thesis using a4 eq in_alpha by auto\n  } \n  moreover {assume a00:\"C=Throw\" \n    then have  eq:\"c\\<^sub>c' = Throw \\<and> \\<sigma>n' = \\<sigma>\"\n       using stepc_elim_cases1(5)[OF a5[simplified a00]] throw1\n     proof -\n       have \"\\<forall>f z x c xa. \\<not> f\\<turnstile>\\<^sub>c\\<^sub>z (Throw::('a, 'd, 'c, 'e) LanguageCon.com, Normal x) \\<rightarrow> (c, xa)\"\n         using throw1 by auto\n       then have \"(c\\<^sub>c', Normal \\<sigma>n'::('a, 'c) xstate) = (LanguageCon.com.Throw, Normal \\<sigma>)\"\n         using throw1  stepc_elim_cases1(5)[OF a5[simplified a00]] by fastforce\n       then have \"c\\<^sub>c' = LanguageCon.com.Throw \\<and> (Normal \\<sigma>n'::('a, 'c) xstate) = Normal \\<sigma>\"\n         by fastforce\n       then have \"(c\\<^sub>c' = Throw \\<and> (Normal \\<sigma>n'::('a, 'c) xstate) = Normal \\<sigma>) \\<and> \\<sigma>n' = \\<sigma>\"\n         by (meson xstate.inject(1))\n       then show ?thesis\n         by presburger\n     qed \n     moreover have  \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S, Normal \\<Sigma>)\" by auto\n     moreover have  \"((\\<exists>C. LanguageCon.com.Throw = LanguageCon.com.Seq C LanguageCon.com.Throw \\<and> (\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c)\n             \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)) \\<or>\n        (\\<Gamma>\\<^sub>c,(LanguageCon.com.Throw, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s))\"\n       using a4 a00 by fastforce \n     moreover have \"((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\"        \n       unfolding related_transitions_def using a2 eq in_alpha by fastforce\n     ultimately have ?thesis using a4 eq in_alpha by auto\n  }\n  moreover { assume \"C\\<noteq>Skip \\<and> C\\<noteq>Throw\"  \n    then obtain C' where step:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C, Normal \\<sigma>) \\<rightarrow> (C', Normal \\<sigma>n') \\<and> \n                               c\\<^sub>c' = LanguageCon.com.Seq C' LanguageCon.com.Skip\" \n      using stepc_elim_cases1(5)[OF a5] by auto \n    moreover obtain \\<Sigma>n' c\\<^sub>s' where \n     \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n   (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n   ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<Gamma>\\<^sub>c,(C', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c)\n      \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\" \n      using dest_sim_tau_step[OF a4] step a5 by fastforce      \n    ultimately have ?thesis  by fastforce\n  } ultimately show ?thesis by fastforce\nqed\n\nlemma Impl_Seq_Skip_sim'4:\n  assumes a0:\"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" and\n       a1:\"((Normal \\<sigma>, \\<sigma>'), Normal \\<Sigma>, \\<Sigma>') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x\" and\n        a6:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a7:\"\\<forall>\\<sigma>. (\\<sigma>,\\<sigma>)\\<in>G\\<^sub>c\" \n     shows \"(\\<exists>\\<sigma>. \\<sigma>' = Normal \\<sigma> \\<and>\n            (\\<exists>\\<Sigma>. \\<Sigma>' = Normal \\<Sigma> \\<and> (\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s))) \\<or>\n       (\\<Gamma>\\<^sub>c,(LanguageCon.com.Seq C LanguageCon.com.Skip, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\nproof-\n  have  sim:\"(\\<Gamma>\\<^sub>c,(C,\\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S,\\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\" using dest_sim_env_step[OF a0 a1] by auto\n  {assume a00:\"\\<exists>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n'\"\n    then have  \"\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n'\" using a1\n      by (meson Normal_alpha)\n    then have ?thesis using a00 sim by fastforce     \n  }\n  moreover{assume a00:\"\\<forall>\\<sigma>n'. \\<sigma>' \\<noteq> Normal \\<sigma>n'\"\n    moreover have  \"(\\<sigma>',\\<Sigma>')\\<in>\\<alpha>\\<^sub>x\" using a1\n      by (meson alpha_not_normal)    \n    ultimately have ?thesis using sim_not_normal[OF _ _ a6 a7]   by auto\n  } ultimately show ?thesis by fastforce\nqed\n\nlemma Impl_Seq_Skip_sim': assumes a0:\"\\<xi> \\<subseteq> \\<alpha>\" and \n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a8: \"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" \nshows \"(\\<Gamma>\\<^sub>c,Seq C Skip,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\"\nproof-\n{fix \\<sigma> \\<Sigma> \n  assume a11: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"    \n  then have  \"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S,Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\" \n    using a8 unfolding RGSim_pre_def by auto\n then have \"(\\<Gamma>\\<^sub>c,(Seq C Skip, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n   apply (coinduction arbitrary: \\<sigma> \\<Sigma> C S)\n   apply simp\n   apply (rule conjId)+\n        apply (rule, rule, rule, rule)    \n        apply (rule Impl_Skip_sim1'[OF a0 a3 a6 a7], fast+)\n   apply (rule, rule,rule)\n       apply (blast dest: Impl_Seq_Skip_sim'4[OF _ _ a7 a6])   \n      apply (rule, rule, rule,rule)   \n   apply (rule Impl_Skip_sim2'[OF a0 a3 a6 a7 ], fast+)\n     apply (rule, rule, rule)\n     apply (rule Impl_Seq_Skip_sim3'[OF  a0 a3 a6 a7 ], fast+)\n   apply (meson sim_alpha)   \n   unfolding alpha_xstate_def by auto\n} thus ?thesis unfolding RGSim_pre_def by auto\nqed\n\n\nlemma Impl_Seq_Throw_sim1:\n  assumes \n    a1:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq LanguageCon.com.Throw C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and\n    a2:\"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\"     \n  shows\"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba.\n                                      \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                      \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and>\n                     (Normal \\<sigma>, \\<sigma>') \\<in> G\\<^sub>c \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                     (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"\n using a1 a2\n    stepc_elim_seq_skip(2)[OF a1] prod.inject throw1 apply simp\nproof -\n  assume \"\\<And>P. \\<lbrakk>\\<And>c\\<^sub>1' s'. \\<lbrakk>c\\<^sub>c' = LanguageCon.com.Seq c\\<^sub>1' C \\<and> \\<sigma>' = s'; \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Throw, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>1', s')\\<rbrakk> \\<Longrightarrow> P; \\<And>s. \\<lbrakk>e = \\<tau>; False; \\<sigma> = s\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  then show ?thesis\n    by (metis (no_types) throw1)\nqed \n\nlemma Impl_Seq_Throw_sim2: \n  assumes  \n a0:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n a3: \"(\\<Gamma>\\<^sub>c,Throw,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" and\n a4:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and\n a5:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq Throw C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\nshows \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          (((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n          (c\\<^sub>c' = LanguageCon.com.Seq LanguageCon.com.Throw C \\<and> c\\<^sub>s' = S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"  \nproof -\n  have a00:\"c\\<^sub>c' = Throw \\<and> Normal \\<sigma>n' = Normal \\<sigma>\" \n    using  stepc_elim_seq_skip(2)[OF a5]  apply simp\n    using throw1  by metis \n      \n  have rfgs:\"(Normal \\<Sigma>, Normal \\<Sigma>)\\<in> G\\<^sub>s\\<^sup>*\" by auto\n  have f1: \"\\<forall>a c. (a, c) \\<notin> \\<xi> \\<or> (\\<Gamma>\\<^sub>c,(Throw, Normal a),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal c),R\\<^sub>s,G\\<^sub>s)\"\n    by (meson RGSim_pre_def a3)\n  then have f2: \"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\"\n    using a0 rfgs a4 related_transition_intro sim_alpha\n    by (metis rtrancl_idemp)\n  have \"(\\<sigma>, \\<Sigma>) \\<in> \\<alpha>\"\n    using f1 by (meson a4 sim_alpha)\n  then show ?thesis\n    using f2 f1 a00 a4 by auto\nqed      \n\nlemma Impl_Seq_Throw_sim: assumes a0:\"\\<xi> \\<subseteq> \\<alpha>\" and \n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a8: \"(\\<Gamma>\\<^sub>c,Throw,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" \nshows \"(\\<Gamma>\\<^sub>c,Seq Throw C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\"\nproof-\n{fix \\<sigma> \\<Sigma> \n assume a11: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"    \n then have \"(\\<Gamma>\\<^sub>c,(Seq Throw C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n   apply (coinduction arbitrary: \\<sigma> \\<Sigma>)\n   apply simp\n   apply (rule conjId)+\n        apply (rule, rule, rule, rule) \n        apply (rule Impl_Seq_Throw_sim1, fast+)\n       apply (blast dest: sim_env[OF _ a3 a6 a7])   \n      apply (rule, rule, rule, rule)\n      apply (metis not_seq_skip_throw_ev)   \n     apply (rule, rule, rule, frule Impl_Seq_Throw_sim2[OF a6  a8], fast+)\n   using a0 apply auto[1] \n   unfolding alpha_xstate_def by auto\n} thus ?thesis unfolding RGSim_pre_def by auto\nqed\n\nlemma mod_state_tran_v: \"label C1 = \\<tau> \\<Longrightarrow>        \n       \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>Some v (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<Longrightarrow>\n       \\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          (c\\<^sub>c' = LanguageCon.com.Seq C1 C2 \\<and> c\\<^sub>s' = S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c)\n           \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof -\nassume a1: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>Some v (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n  assume a2: \"label C1 = \\<tau>\"\n  obtain c1' where s:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C1, Normal \\<sigma>) \\<rightarrow> (c1', Normal \\<sigma>n')\" \n    using stepc_elim_cases1(5)[OF a1] by fastforce    \n  thus ?thesis using label_step[OF _ s] a2 by force \nqed\n\nlemma mod_state_only_spec_basic_tau_sound1:\n  assumes a0:\"C1 = Basic fc \\<tau> \\<or> C1 = Spec rc \\<tau>\" and   \n a1:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and \n a2: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and \n a3:\"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and \n a4:\"\\<forall>\\<sigma> \\<sigma>' \\<Sigma> . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<sigma>' \\<in> com_step  C1 (Normal \\<sigma>)  \\<Gamma>\\<^sub>c  \\<longrightarrow> \n                (\\<exists>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n' \\<and> (\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c)\"\nshows \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (Normal \\<sigma>,\\<sigma>')\\<in> G\\<^sub>c \\<and>\n                     (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"\nproof-\n  {\n    assume a00:\"C1 = Basic fc \\<tau>\"    \n    then have \"\\<sigma>' = Normal (fc \\<sigma>)\" using a2 \n      by (metis LanguageCon.com.simps(12) LanguageCon.com.simps(48) Pair_inject stepc_Normal_elim_cases(3) stepc_Normal_elim_cases(5) stepce_stepc)     \n    then have ?thesis using a3 by auto\n  }\n  moreover {\n    assume a00:\"C1 = Spec rc \\<tau>\"   \n    then have e:\"e=\\<tau>\"  using a2 label_step by fastforce\n    have c\\<^sub>c':\"c\\<^sub>c' = Seq Skip C2\" using stepc_elim_cases1(5)[OF a2[simplified a00]]\n    proof -\n      obtain cc xx where\n        f1: \"(c\\<^sub>c', \\<sigma>') = (LanguageCon.com.Seq cc C2, xx) \\<and> \n            \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Spec rc \\<tau>, Normal \\<sigma>) \\<rightarrow> (cc, xx)\"\n        using stepc_elim_cases1(5)[OF a2[simplified a00]]  by force\n      thus ?thesis\n        using stepc_elim_cases1(4) by fastforce\n    qed       \n    moreover have step:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Spec rc \\<tau>, Normal \\<sigma>) \\<rightarrow> (Skip, \\<sigma>')\"\n     using  stepc_elim_cases(6)[OF a2[simplified a00 c\\<^sub>c'], simplified e] by auto    \n    moreover have \\<sigma>:\"\\<sigma>' = Stuck\" using stepc_elim_cases1(4)[OF step] a3     \n      by fastforce\n    moreover  have \"(\\<nexists>sn.(\\<sigma>, sn)\\<in>rc)\" using stepc_elim_cases(3)[OF step[simplified \\<sigma>]] by auto\n    moreover have \"\\<sigma>' \\<in> com_step  C1 (Normal \\<sigma>)  \\<Gamma>\\<^sub>c \" using calculation a00 by auto\n    ultimately have ?thesis using a4 a00 a1 \\<sigma> by fast\n  } ultimately show ?thesis using a0 by auto  \nqed\n\nlemma mod_state_only_spec_basic_tau_sound2:\n  assumes a0:\"\\<xi> \\<subseteq> \\<alpha> \" and a0':\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha> \" and a1:\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and \n          a2:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and \n       a3:\"\\<forall>\\<sigma> \\<sigma>' \\<Sigma> . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<sigma>' \\<in> com_step  C1 (Normal \\<sigma>)  \\<Gamma>\\<^sub>c  \\<longrightarrow> \n                (\\<exists>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n' \\<and> (\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c)\" and\n       a4:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" and\n       a5:\"C1 = Basic fc \\<tau> \\<or> C1 = Spec rc \\<tau>\" and \n      a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and  \n      a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\"  and a8:\"(\\<Gamma>\\<^sub>c,C2,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" \n  shows \"(\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n          (c\\<^sub>c' = LanguageCon.com.Seq C1 C2 \\<and> c\\<^sub>s' = S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\nproof-\n  have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S, Normal \\<Sigma>)\" by auto\n  moreover have \"(Normal \\<Sigma>, Normal \\<Sigma>) \\<in> G\\<^sub>s\\<^sup>*\"  by auto\n  moreover have \"c\\<^sub>c' = Seq Skip C2 \\<and> (\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c\" \n                 using a5\n  proof\n    assume a00:\"C1 = LanguageCon.com.Basic fc \\<tau> \"    \n    then have \"c\\<^sub>c' = Seq Skip C2\" using a4\n      by (metis LanguageCon.com.distinct(1) LanguageCon.com.distinct(37) prod.sel(1) \n          stepc_Normal_elim_cases(3) stepc_Normal_elim_cases(5) stepce_stepc)\n    moreover have \"(\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c\"  \n    proof -\n      have \"\\<sigma>n' = fc \\<sigma>\" using a4[simplified calculation a00]\n        by (meson CRef.stepc_elim_cases(6) Pair_inject stepc_Normal_elim_cases(3) stepce_stepc xstate.inject(1))\n      then show ?thesis using a3[simplified a00] a2 by auto\n    qed\n    ultimately show ?thesis by auto    \n  next\n    assume a00:\"C1 = LanguageCon.com.Spec rc \\<tau>\"\n    have c\\<^sub>c':\"c\\<^sub>c' = Seq Skip C2\" using stepc_elim_cases1(5)[OF a4[simplified a00]]\n    proof -\n      obtain cc xx where\n        f1: \"(c\\<^sub>c', Normal \\<sigma>n') = (LanguageCon.com.Seq cc C2, xx) \\<and> \n            \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Spec rc \\<tau>, Normal \\<sigma>) \\<rightarrow> (cc, xx)\"\n        using stepc_elim_cases1(5)[OF a4[simplified a00]]  by force\n      thus ?thesis\n        using stepc_elim_cases1(4) by fastforce\n    qed\n    moreover have \"(\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c\"  \n    proof-\n      have \"(\\<sigma>,\\<sigma>n')\\<in>rc\" using a4[simplified calculation a00]\n        by (meson CRef.stepc_elim_cases(2) CRef.stepc_elim_cases(6)) \n      then show ?thesis  using a3[simplified a00] a2 by auto\n    qed\n    ultimately show ?thesis  by auto          \nqed \n  moreover have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n    using Impl_Seq_Skip_sim[OF a0' a1 a6  a7  a8] calculation \n    unfolding RGSim_pre_def by auto\n  ultimately show ?thesis using a0' a0 a2 unfolding related_transitions_def by fast\nqed\n\nlemma imp_seq_Basic_Spec_sim: \n  assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a5:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and  \n a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and  \n a9:\"C1 = Basic fc \\<tau> \\<or> C1 = Spec rc \\<tau>\" and   \n a10:\"\\<forall>\\<sigma> \\<sigma>' \\<Sigma> . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<sigma>' \\<in> com_step  C1 (Normal \\<sigma>)  \\<Gamma>\\<^sub>c  \\<longrightarrow> \n                (\\<exists>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n' \\<and> (\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c)\" and\n a11:\"(\\<Gamma>\\<^sub>c,C2,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\"\nshows \"(\\<Gamma>\\<^sub>c,Seq C1 C2 ,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\"  \n  \nproof-\n  {fix \\<sigma> \\<Sigma> \n    assume a12: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"    \n    then have \"(\\<Gamma>\\<^sub>c,(Seq C1 C2, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n      apply (coinduction arbitrary: \\<sigma> \\<Sigma>)\n      apply clarsimp\n      apply (rule conjId)+ \n           apply (rule, rule, rule, rule, frule mod_state_only_spec_basic_tau_sound1[OF a9 _ _ _ a10], fast+)      \n                    apply (blast dest: sim_env[OF _ a3 a5 a7])\n           apply (rule, rule, rule, rule)\n          using a9 apply (fastforce intro: mod_state_tran_v) \n        apply (rule, rule, rule, frule mod_state_only_spec_basic_tau_sound2[OF a1 a2 a4 _ a10 _ a9 a5  a7 a11] , auto)\n      using  a1 unfolding alpha_xstate_def by auto   \n  } then show ?thesis unfolding RGSim_pre_def by auto\nqed\n\nlemma mod_state_only_atomic_tau_sound1:\n  assumes   \n a1:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and\n a3: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and \n a4:\"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and \n a5:\"C1 = Await b Cc \\<tau>\" and    \n a6:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (b \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c \\<and> (s, \\<Sigma>n)\\<in> \\<xi>\\<^sub>1}), {}\" and\n a7:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\"\nshows \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (Normal \\<sigma>,\\<sigma>')\\<in>G\\<^sub>c \\<and>\n                     (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"\nproof-\n  obtain cc' where step_Cc:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (Await b Cc \\<tau>, Normal \\<sigma>) \\<rightarrow> (cc', \\<sigma>')\" and \n                   \"c\\<^sub>c' = LanguageCon.com.Seq cc' C2\" \n    using stepc_elim_cases1(5)[OF a3, simplified a5] by auto\n  have step: \"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow>  \\<sigma>' \\<and> \\<sigma>\\<in>b\"\n    using step_Cc a4\n    by (metis Pair_inject stepc_Normal_elim_cases(8) stepce_stepc)   \n  thus ?thesis using not_normal_false[OF spec[OF spec[OF a6]] _ a4, of \\<sigma>] a1 a7 by blast \nqed\n\nlemma mod_state_only_atomic_sound2:\n  assumes a0:\"\\<xi> \\<subseteq> \\<alpha> \" and a0':\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha> \" and a1:\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and \n          a2:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a3:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" and        \n      a9:\"C1 = Await b Cc \\<tau>\" and   \n      a6:\"\\<forall>sn. ( sn, sn)\\<in>G\\<^sub>c\" and  \n      a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a8:\"(\\<Gamma>\\<^sub>c,C2,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" and      \n      a10:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n           (b \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Cc \n           ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c \\<and> (s, \\<Sigma>n)\\<in> \\<xi>\\<^sub>1}), {}\"       \n  shows \"(\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n          (c\\<^sub>c' = LanguageCon.com.Seq C1 C2 \\<and> c\\<^sub>s' = S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\nproof-  \n  have hoare:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n           (b \\<inter> {s. \\<sigma> = s \\<and> (\\<sigma>,\\<Sigma>)\\<in>\\<xi>}) Cc \n           ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c \\<and> (s, \\<Sigma>)\\<in> \\<xi>\\<^sub>1}), {}\" using a10 by auto\n  have step_s:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S, Normal \\<Sigma>)\" by auto\n  moreover have g_s:\"(Normal \\<Sigma>, Normal \\<Sigma>) \\<in> G\\<^sub>s\\<^sup>*\"  by auto  \n  obtain cc' where step_Cc:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Await b Cc \\<tau>, Normal \\<sigma>) \\<rightarrow> (cc', Normal \\<sigma>n')\" and \n                   cc':\"c\\<^sub>c' = LanguageCon.com.Seq cc' C2\" \n    using stepc_elim_cases1(5)[OF a3, simplified a9] by auto \n  then have step: \"(cc' = Skip \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>n') \\<or>\n                   (cc' = Throw \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Abrupt \\<sigma>n')\"  and \\<sigma>b:\"\\<sigma>\\<in>b\"\n    by (auto intro:stepc_elim_casese[OF step_Cc])\n  moreover {\n    assume a00:\"cc' = Skip\"\n    then have \"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>n'\" using step by auto  \n    then have \"(Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (\\<sigma>n', \\<Sigma>)\\<in> \\<xi>\\<^sub>1\"\n      using step_imp_normal_rel_ hoare a2 \\<sigma>b by fast\n    moreover have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c',Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n      using Impl_Seq_Skip_sim[OF a0' a1 a6  a7  a8] calculation a00 cc' \n      unfolding RGSim_pre_def by auto\n    ultimately have ?thesis using step_s g_s a0' a0 a2\n      unfolding related_transitions_def by auto\n  }\n  moreover {\n    assume \"cc' = Throw\" \n    then have \"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Abrupt \\<sigma>n'\" using step by auto    \n    then have ?thesis using in_normal_not_abrupt[OF hoare] a2 \\<sigma>b by blast\n  }\n  ultimately show ?thesis  by auto        \nqed\n\n\nlemma imp_seq_await_sim: \n  assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and  a2:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and \n a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n a9:\"C1 = Await b Cc \\<tau>\" and   \n a10:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (b \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c \\<and> (s, \\<Sigma>n)\\<in> \\<xi>\\<^sub>1}), {}\" and\n a11:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\" and\n a12:\"(\\<Gamma>\\<^sub>c,C2,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" \nshows \"(\\<Gamma>\\<^sub>c,Seq C1 C2 ,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\"  \n  \nproof-\n  {fix \\<sigma> \\<Sigma> \n    assume \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"    \n    then have \"(\\<Gamma>\\<^sub>c,(Seq C1 C2, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n      apply (coinduction arbitrary: \\<sigma> \\<Sigma>)\n      apply clarsimp\n      apply (rule conjId)+                                \n           apply (rule, rule, rule, rule, frule mod_state_only_atomic_tau_sound1[OF  _ _ _ a9 a10 a11], fast+)      \n          apply (blast dest: sim_env[OF _ a3 a6 a7])\n          apply (rule, rule, rule, rule)\n      using a9 apply (fastforce intro: mod_state_tran_v)\n        apply (rule, rule, rule, frule mod_state_only_atomic_sound2[OF a1 a2 a4 _ _ a9  a6  a7 a12 a10] , auto)\n      using  a1 unfolding alpha_xstate_def by auto   \n  } then show ?thesis unfolding RGSim_pre_def by auto\nqed\n\n\nlemma spec_only_mod_sound:\n  assumes  \n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and a2':\"\\<gamma>\\<^sub>a \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<gamma>\\<^sub>n ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a5:\"Sta\\<^sub>s \\<gamma>\\<^sub>a ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\"  and \n a9:\"C = Basic fc l \\<or> C = Spec rc l \\<or> C = Await bc Cc l\" and \n a9': \"S = Basic fs l \\<or> S = Spec rs l \\<or> S = Await bs Cs l\" and  \n a10:\"\\<forall>\\<sigma> \\<sigma>' \\<Sigma> . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<sigma>' \\<in> com_step  C (Normal \\<sigma>)  \\<Gamma>\\<^sub>c  \\<longrightarrow> \n                (\\<exists>\\<Sigma>'. \\<Sigma>' \\<in> com_step  S (Normal \\<Sigma>) \\<Gamma>\\<^sub>s \\<and>  (\\<sigma>', \\<Sigma>')\\<in>\\<alpha>\\<^sub>x \\<and> \n                       ((\\<forall>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n'   \\<longrightarrow> \n                           (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>n',\\<Sigma>n')\\<in>\\<gamma>\\<^sub>n \\<and> \n                           (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)))  \\<and> \n                       (\\<forall>\\<sigma>n'. \\<sigma>' = Abrupt \\<sigma>n'  \\<longrightarrow> \n                           (\\<exists>\\<Sigma>n'. \\<Sigma>' = Abrupt \\<Sigma>n' \\<and> (\\<sigma>n', \\<Sigma>n')\\<in>\\<gamma>\\<^sub>a \\<and> \n                                (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s))                      \n                 )\" and\n a11:\"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and\n a12:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>v (C, Normal \\<sigma>n) \\<rightarrow> (C', \\<sigma>')\"\nshows \"\\<exists>S' \\<Sigma>'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S', \\<Sigma>'))) \\<and>\n          (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and> ((\\<forall>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n'   \\<longrightarrow> \n                           (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>n',\\<Sigma>n')\\<in>\\<alpha> \\<and> \n                           (Normal \\<sigma>n, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> G\\<^sub>s)))  \\<and>                         \n          (\\<Gamma>\\<^sub>c,(C', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\nproof-  \n  have v_l:\"v = l\" using a12 a9 label_step by fastforce   \n  have c1:\"C' = Skip \\<or> C' = Throw\" using a9 stepc_elim_cases1(3,4,8)\n  proof -\n    have \"\\<forall>f z c x ca xa. \\<not> f\\<turnstile>\\<^sub>c\\<^sub>z (c::('a, 'd, 'b, 'e) LanguageCon.com, x) \\<rightarrow> (ca, xa) \\<or> f\\<turnstile>\\<^sub>c (c, x) \\<rightarrow> (ca, xa)\"\n      by (metis stepce_stepc)\n    then show ?thesis\n      using a12 a9 basic_skip spec_skip await_skip\n      by (metis stepce_stepc)\n  qed\n  moreover {\n    assume c1:\"C' = Skip\"\n    then have  s1:\"\\<sigma>' \\<in> com_step  C (Normal \\<sigma>n) \\<Gamma>\\<^sub>c\" using a9 a12       \n      by  (fastforce elim: stepc_elim_cases1(4) stepc_elim_cases1(3)  stepc_elim_cases1(8))+             \n    {assume \"\\<exists>sn1. \\<sigma>' = Normal sn1\"\n      then obtain \\<sigma>n' where \\<sigma>n':\"\\<sigma>' = Normal \\<sigma>n'\" by auto\n      then obtain \\<Sigma>'  where cond: \"\\<Sigma>' \\<in> com_step  S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>s \\<and>   (\\<sigma>', \\<Sigma>')\\<in>\\<alpha>\\<^sub>x \\<and>\n                           (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>n',\\<Sigma>n')\\<in>\\<gamma>\\<^sub>n \\<and> \n                           (Normal \\<sigma>n, \\<sigma>') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>n, \\<Sigma>') \\<in> G\\<^sub>s)\"\n       using a10 a11 c1 s1 by fast\n      have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (S, Normal \\<Sigma>n) \\<rightarrow> (Skip, \\<Sigma>')\" \n        using com_step_BS cond a9'   v_l by fast           \n      then have ?thesis using \n        a11 cond  a1 a2 Skip_sim_normal[OF  a2 _ a4  _ a6 a7 ] c1 cond  \\<sigma>n' \n        unfolding related_transitions_def by blast\n    }\n    moreover { \n      assume ass0:\"\\<sigma>' = Stuck \\<or> (\\<exists>f. \\<sigma>' = Fault f)\"      \n      then obtain \\<Sigma>'  where cond: \"\\<Sigma>' \\<in> com_step  S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>s \\<and>  (\\<sigma>', \\<Sigma>')\\<in>\\<alpha>\\<^sub>x\"\n        using a10 a11 c1 s1 by fast      \n      then have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (S, Normal \\<Sigma>n) \\<rightarrow> (Skip, \\<Sigma>')\" \n        using com_step_BS cond a9' v_l\n        by (metis Fault_alpha Stuck_alpha ass0 xstate.distinct(7) xstate.distinct(9))                \n      have ?thesis using steps cond  \n           Skip_sim_normal_not_normal[OF  _ _ a7 a6] c1 ass0 by fast\n    }\n    moreover { \n      assume ass0: \"\\<exists>sn. \\<sigma>' = Abrupt sn\"\n      then have False using a12 c1 step_Abrupt_end        \n        using stepce_stepc by fastforce\n      then have ?thesis by auto\n    }\n    ultimately have ?thesis by (cases \\<sigma>', auto)     \n  }\n  moreover \n  { assume c1:\"C' = Throw\"\n    then obtain bc Cc where c:\"C = Await bc Cc l\"\n      using a9 a12 \n      by  (fastforce elim: stepc_elim_cases1(4) stepc_elim_cases1(3)  stepc_elim_cases1(8))\n    then obtain \\<sigma>n' where sn1: \"\\<sigma>' = Normal \\<sigma>n' \\<and> \\<sigma>n \\<in> bc \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>n\\<rangle> \\<Rightarrow> Abrupt \\<sigma>n'\"\n      using c1 a12 by (fastforce elim: stepc_elim_cases1(8))\n    moreover have  s1:\"Abrupt \\<sigma>n' \\<in> com_step  C (Normal \\<sigma>n) \\<Gamma>\\<^sub>c\" using c calculation by auto          \n    ultimately obtain \\<Sigma>' \\<Sigma>n' where cond: \"\\<Sigma>' \\<in> com_step  S (Normal \\<Sigma>n) \\<Gamma>\\<^sub>s \\<and>                             \n                                (\\<Sigma>' = Abrupt \\<Sigma>n' \\<and> (\\<sigma>n', \\<Sigma>n')\\<in>\\<gamma>\\<^sub>a \\<and> \n                                (Normal \\<sigma>n, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> G\\<^sub>s)\"\n       using a10 a11 c1 s1  by force         \n    then have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (S, Normal \\<Sigma>n) \\<rightarrow> (Throw, Normal \\<Sigma>n')\" \n      using   a9' sn1 com_step_BS1 v_l by metis      \n    then have sim:\"(\\<Gamma>\\<^sub>c,(C', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Throw, Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\"\n      using cond Throw_sim_normal[OF  a2' _ a5 _ a6 a7 ] sn1 c1 by fast\n    then have ?thesis using a2' steps   a11  cond  a1 sn1\n      unfolding related_transitions_def\n      using dest_sim_alpha_x by fastforce\n  }\n  ultimately show ?thesis by auto \nqed\n\nlemma dest_sim_tau_step1:\n  \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c,\\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s,\\<Sigma>),R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>\n    (\\<forall>c\\<^sub>c' \\<sigma>n'. \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (c\\<^sub>c, \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n    (\\<exists>c\\<^sub>s' \\<Sigma>n'.  \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n              (\\<sigma>n', \\<Sigma>n')\\<in>\\<alpha> \\<and> \n              (((\\<sigma>,Normal \\<sigma>n'),(\\<Sigma>, Normal \\<Sigma>n')) \\<in> (G\\<^sub>c,G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<Gamma>\\<^sub>c,(c\\<^sub>c',Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s',Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\n  by (erule sim_elim_cases,auto)\n\n\nlemma Spec_Seq_Skip_sim: assumes a0:\"\\<xi> \\<subseteq> \\<alpha>\" and \n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and  \n a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and  a8: \"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" \nshows \"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,Seq Skip S,R\\<^sub>s,G\\<^sub>s)\"\nproof-\n{fix \\<sigma>' \\<Sigma>' \n  assume a11: \"(\\<sigma>', \\<Sigma>') \\<in> \\<xi>\"   \n  then have \"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n  proof (coinduction arbitrary: \\<sigma>' \\<Sigma>',simp)\n    {fix \\<sigma>'' \\<Sigma>''\n    assume a11:\"(\\<sigma>'', \\<Sigma>'') \\<in> \\<xi>\"\n    have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\"\n      using a8 a11 unfolding RGSim_pre_def by auto  \n    have step_s:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq Skip S, Normal \\<Sigma>'') \\<rightarrow> (S, Normal \\<Sigma>'')\"\n      using SeqSkipc by auto\n    have \"(Normal \\<sigma>'', Normal \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x\" unfolding alpha_xstate_def by auto\n    moreover have \"(\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha> \" using a11 a0 by auto\n    moreover have \"\\<forall>c\\<^sub>c' \\<sigma>n'.\n      \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n      (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>'', Normal \\<sigma>n'), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c)\n          \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"  using sim_elim_cases[OF x] step_s \n    by (meson  converse_rtranclp_into_rtranclp) \n  moreover have \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n        \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>Some v (C, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n        (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n             (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (S, Normal \\<Sigma>'') \\<rightarrow>\\<^sup>+  (c\\<^sub>s', Normal \\<Sigma>n')) \\<and>\n            (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n            ((Normal \\<sigma>'', Normal \\<sigma>n'), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c)\n            \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\" \n    by (fastforce intro: sim_elim_cases[OF x])\n  then have \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n        \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>Some v (C, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n        (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n             (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>v (Seq Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sup>+  (c\\<^sub>s', Normal \\<Sigma>n')) \\<and>\n            (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n            ((Normal \\<sigma>'', Normal \\<sigma>n'), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c)\n            \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\n    using event_tran_closure_tau_tran[OF step_s]  by meson \n  then have \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               ((Normal \\<sigma>'', Normal \\<sigma>n'), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = C \\<and> c\\<^sub>s' = LanguageCon.com.Seq LanguageCon.com.Skip S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\" by fastforce\n  moreover {\n    fix \\<sigma>' \\<Sigma>' \n    assume a00:\"((Normal \\<sigma>'', \\<sigma>'), Normal \\<Sigma>'', \\<Sigma>') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<sigma>',\\<Sigma>')\\<in>\\<alpha>\\<^sub>x\"\n    then have \"(\\<exists>\\<sigma>''. \\<sigma>' = Normal \\<sigma>'' \\<and> (\\<exists>\\<Sigma>''. \\<Sigma>' = Normal \\<Sigma>'' \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<xi>)) \\<or> (\\<Gamma>\\<^sub>c,(C, \\<sigma>'),R\\<^sub>c,G\\<^sub>c)\n                 \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n      using sim_env[OF  a11 a3 a6 a7 a00] by blast\n  }\n  moreover have \"(C = LanguageCon.com.Skip \\<longrightarrow>\n        (\\<exists>\\<Sigma>n'. ((Normal \\<sigma>'', Normal \\<sigma>''), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                (\\<sigma>'', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n                \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and>\n                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                        (LanguageCon.com.Skip, Normal \\<Sigma>n')))\"\n    using sim_elim_cases[OF x] step_s converse_rtranclp_into_rtranclp\n    by smt\n  moreover have \"(C = LanguageCon.com.Throw \\<longrightarrow>\n        (\\<exists>\\<Sigma>n'. ((Normal \\<sigma>'', Normal \\<sigma>''), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                (\\<sigma>'', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and>\n                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                        (LanguageCon.com.Throw, Normal \\<Sigma>n')))\"\n    using sim_elim_cases[OF x] step_s converse_rtranclp_into_rtranclp\n    by smt\n  moreover have\"\\<forall>\\<sigma>' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n                  (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                           (\\<exists>v. e = Some v \\<and>\n                                (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                                               (a, b) \\<and>\n                                       (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (Normal \\<sigma>'',\\<sigma>')\\<in>G\\<^sub>c \\<and>\n                          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\" \n     using sim_elim_cases[OF x] step_s converse_rtranclp_into_rtranclp\n     by smt \n   ultimately show \n      \"(Normal \\<sigma>'', Normal \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n       (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha> \\<and>\n       (\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               ((Normal \\<sigma>'', Normal \\<sigma>n'), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = C \\<and> c\\<^sub>s' = LanguageCon.com.Seq LanguageCon.com.Skip S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               ((Normal \\<sigma>'', Normal \\<sigma>n'), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = C \\<and> c\\<^sub>s' = LanguageCon.com.Seq LanguageCon.com.Skip S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>\\<sigma>' \\<Sigma>'. ((Normal \\<sigma>'', \\<sigma>'), Normal \\<Sigma>'', \\<Sigma>') \\<in> ((R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>',\\<Sigma>')\\<in>\\<alpha>\\<^sub>x \\<longrightarrow>\n                 (\\<exists>\\<sigma>''. \\<sigma>' = Normal \\<sigma>'' \\<and> (\\<exists>\\<Sigma>''. \\<Sigma>' = Normal \\<Sigma>'' \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<xi>)) \\<or> (\\<Gamma>\\<^sub>c,(C, \\<sigma>'),R\\<^sub>c,G\\<^sub>c)\n                 \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(LanguageCon.com.Seq LanguageCon.com.Skip S, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)) \\<and>\n       (C = LanguageCon.com.Skip \\<longrightarrow>\n        (\\<exists>\\<Sigma>n'. ((Normal \\<sigma>'', Normal \\<sigma>''), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                (\\<sigma>'', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n                \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and>\n                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                        (LanguageCon.com.Skip, Normal \\<Sigma>n'))) \\<and>\n       (C = LanguageCon.com.Throw \\<longrightarrow>\n        (\\<exists>\\<Sigma>n'. ((Normal \\<sigma>'', Normal \\<sigma>''), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                (\\<sigma>'', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and>\n                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                        (LanguageCon.com.Throw, Normal \\<Sigma>n'))) \\<and>\n       (\\<forall>\\<sigma>' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n                  (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                           (\\<exists>v. e = Some v \\<and>\n                                (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                                               (a, b) \\<and>\n                                       (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>')))))  \\<and> (Normal \\<sigma>'',\\<sigma>')\\<in>G\\<^sub>c \\<and>\n                          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))))\"\n     by blast\n } qed\n} thus ?thesis unfolding RGSim_pre_def by auto\nqed\n\n  \nlemma Spec_Seq_Throw_sim: assumes a0:\"\\<xi> \\<subseteq> \\<alpha>\" and \n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and  \n a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" \nshows \"(\\<Gamma>\\<^sub>c,Throw,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>) (\\<Gamma>\\<^sub>s,Seq Throw S,R\\<^sub>s,G\\<^sub>s)\"\nproof-\n{fix \\<sigma>' \\<Sigma>' \n  assume a11: \"(\\<sigma>', \\<Sigma>') \\<in> \\<xi>\"     \n  then have \"(\\<Gamma>\\<^sub>c,(Throw, Normal \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Throw S, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\" \n  proof (coinduction arbitrary: \\<sigma>' \\<Sigma>',simp)\n    {fix \\<sigma>'' \\<Sigma>''\n    assume a11:\"(\\<sigma>'', \\<Sigma>'') \\<in> \\<xi>\"\n    have x:\"(\\<Gamma>\\<^sub>c,(Throw,Normal \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>) (\\<Gamma>\\<^sub>s,(Throw, Normal \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)\"\n      using Throw_sound[OF a0 a3 a6 a7] a11 unfolding RGSim_pre_def by fastforce  \n    have step_s:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq Throw S, Normal \\<Sigma>'') \\<rightarrow> (Throw, Normal \\<Sigma>'')\"\n      using SeqThrowc by fastforce\n    have \"(Normal \\<sigma>'', Normal \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x\" unfolding alpha_xstate_def by auto\n    moreover have \"(\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha> \" using a11 a0 by auto\n    moreover have \"\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Throw, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>'', Normal \\<sigma>n'), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                c\\<^sub>s' = LanguageCon.com.Seq LanguageCon.com.Throw S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"  \n      using sim_elim_cases[OF x] step_s by (meson  converse_rtranclp_into_rtranclp) \n  moreover have \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (Throw, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               ((Normal \\<sigma>'', Normal \\<sigma>n'), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = Throw \\<and> c\\<^sub>s' = LanguageCon.com.Seq LanguageCon.com.Throw S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\" \n    using throw1 by fast\n  moreover {\n    fix \\<sigma>' \\<Sigma>' \n    assume a00:\"((Normal \\<sigma>'', \\<sigma>'), Normal \\<Sigma>'', \\<Sigma>') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<sigma>',\\<Sigma>')\\<in>\\<alpha>\\<^sub>x\"\n    then have \"(\\<exists>\\<sigma>''. \\<sigma>' = Normal \\<sigma>'' \\<and> (\\<exists>\\<Sigma>''. \\<Sigma>' = Normal \\<Sigma>'' \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<xi>)) \\<or> (\\<Gamma>\\<^sub>c,(Throw, \\<sigma>'),R\\<^sub>c,G\\<^sub>c)\n                 \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Throw S, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n      using sim_env[OF  a11 a3 a6 a7 a00] by blast\n  }\n  moreover have \"(Throw = LanguageCon.com.Skip \\<longrightarrow>\n        (\\<exists>\\<Sigma>n'. ((Normal \\<sigma>'', Normal \\<sigma>''), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                (\\<sigma>'', \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and>\n                \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and>\n                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                        (LanguageCon.com.Skip, Normal \\<Sigma>n')))\"\n    by auto\n  moreover have \"(Throw = LanguageCon.com.Throw \\<longrightarrow>\n        (\\<exists>\\<Sigma>n'. ((Normal \\<sigma>'', Normal \\<sigma>''), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                (\\<sigma>'', \\<Sigma>n') \\<in> \\<xi> \\<and>\n                \\<xi> \\<subseteq> \\<alpha> \\<and>\n                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                        (LanguageCon.com.Throw, Normal \\<Sigma>n')))\"\n    using sim_elim_cases[OF x] step_s converse_rtranclp_into_rtranclp\n    by smt\n  moreover have\"\\<forall>\\<sigma>' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (Throw, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n                  (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                           (\\<exists>v. e = Some v \\<and>\n                                (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                                               (a, b) \\<and>\n                                       (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (Normal \\<sigma>'',\\<sigma>')\\<in>G\\<^sub>c \\<and>\n                          (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\" \n      using throw1 by fast\n   ultimately show \n      \"(Normal \\<sigma>'', Normal \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n       (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha> \\<and>\n       (\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Throw, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>'', Normal \\<sigma>n'), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                c\\<^sub>s' = LanguageCon.com.Seq LanguageCon.com.Throw S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (Throw, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (Seq Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba.\n                          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>'', Normal \\<sigma>n'), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Throw \\<and>\n                c\\<^sub>s' = LanguageCon.com.Seq LanguageCon.com.Throw S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>)\n                (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>\\<sigma>' \\<Sigma>'.\n           (((Normal \\<sigma>'', \\<sigma>'), Normal \\<Sigma>'', \\<Sigma>') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<longrightarrow>\n           (\\<exists>\\<sigma>''. \\<sigma>' = Normal \\<sigma>'' \\<and> (\\<exists>\\<Sigma>''. \\<Sigma>' = Normal \\<Sigma>'' \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<xi>)) \\<or>\n           (\\<Gamma>\\<^sub>c,(LanguageCon.com.Throw, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>)\n           (\\<Gamma>\\<^sub>s,(LanguageCon.com.Seq LanguageCon.com.Throw S, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)) \\<and>\n       (\\<exists>\\<Sigma>n'. (((Normal \\<sigma>'', Normal \\<sigma>''), Normal \\<Sigma>'', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (\\<sigma>'', \\<Sigma>n') \\<in> \\<xi> \\<and> \\<xi> \\<subseteq> \\<alpha> \\<and>\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>*\n                       (LanguageCon.com.Throw, Normal \\<Sigma>n')) \\<and>\n       (\\<forall>\\<sigma>' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Throw, Normal \\<sigma>'') \\<rightarrow> (c\\<^sub>c', \\<sigma>') \\<and>\n           (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n                  (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                         (\\<exists>v. e = Some v \\<and>\n                            (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Throw S, Normal \\<Sigma>'') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and> (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                     \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and>\n                     (Normal \\<sigma>'', \\<sigma>') \\<in> G\\<^sub>c \\<and> \n                       (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c)\\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<xi>\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))) \"\n     by blast\n } qed\n} thus ?thesis unfolding RGSim_pre_def by auto\nqed\n\n\n\nlemma spec_mod_state_only_atomic_tau_sound1:\n  assumes   \n a1:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and\n a3: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and \n a4:\"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and \n a5:\"C1 = Await b Cc \\<tau>\" and    \n a6:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n        (b \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Cc \n        ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c \\<and> (s, \\<Sigma>n)\\<in> \\<xi>\\<^sub>1}), {}\" and\n a7:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\"\nshows \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and>\n                     (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"\nproof-\n  obtain cc' where step_Cc:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (Await b Cc \\<tau>, Normal \\<sigma>) \\<rightarrow> (cc', \\<sigma>')\" and \n                   \"c\\<^sub>c' = LanguageCon.com.Seq cc' C2\" \n    using stepc_elim_cases1(5)[OF a3, simplified a5] by auto\n  have step: \"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow>  \\<sigma>' \\<and> \\<sigma>\\<in>b\"\n    using step_Cc a4\n    by (metis Pair_inject stepc_Normal_elim_cases(8) stepce_stepc)   \n  thus ?thesis using not_normal_false[OF spec[OF spec[OF a6]] _ a4, of \\<sigma>] a1 a7 by blast \nqed\n\nlemma spec_mod_state_only_atomic_sound2:\n  assumes a0:\"\\<xi> \\<subseteq> \\<alpha> \" and a0':\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha> \" and a1:\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and \n          a2:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a3:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" and        \n      a9:\"C1 = Await b Cc \\<tau>\" and   \n      a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and  \n      a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\"  and a8:\"(\\<Gamma>\\<^sub>c,C2,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" and      \n      a10:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n           (b \\<inter> {s. \\<sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Cc \n           ({s. (Normal \\<sigma>n, Normal s) \\<in> G\\<^sub>c \\<and> (s, \\<Sigma>n)\\<in> \\<xi>\\<^sub>1}), {}\"       \n  shows \"(\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n          (c\\<^sub>c' = LanguageCon.com.Seq C1 C2 \\<and> c\\<^sub>s' = S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\nproof-  \n  have hoare:\"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n           (b \\<inter> {s. \\<sigma> = s \\<and> (\\<sigma>,\\<Sigma>)\\<in>\\<xi>}) Cc \n           ({s. (Normal \\<sigma>, Normal s) \\<in> G\\<^sub>c \\<and> (s, \\<Sigma>)\\<in> \\<xi>\\<^sub>1}), {}\" using a10 by auto\n  have step_s:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S, Normal \\<Sigma>)\" by auto\n  moreover have g_s:\"(Normal \\<Sigma>, Normal \\<Sigma>) \\<in> G\\<^sub>s\\<^sup>*\"  by auto  \n  obtain cc' where step_Cc:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Await b Cc \\<tau>, Normal \\<sigma>) \\<rightarrow> (cc', Normal \\<sigma>n')\" and \n                   cc':\"c\\<^sub>c' = LanguageCon.com.Seq cc' C2\" \n    using stepc_elim_cases1(5)[OF a3, simplified a9] by auto \n  then have step: \"(cc' = Skip \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>n') \\<or>\n                   (cc' = Throw \\<and> \\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Abrupt \\<sigma>n')\"  and \\<sigma>b:\"\\<sigma>\\<in>b\"\n    by (auto intro:stepc_elim_casese[OF step_Cc])\n  moreover {\n    assume a00:\"cc' = Skip\"\n    then have \"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Normal \\<sigma>n'\" using step by auto  \n    then have \"(Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c \\<and> (\\<sigma>n', \\<Sigma>)\\<in> \\<xi>\\<^sub>1\"\n      using step_imp_normal_rel_ hoare a2 \\<sigma>b by fast\n    moreover have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c',Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n      using Impl_Seq_Skip_sim[OF a0' a1 a6  a7 a8] calculation a00 cc' \n      unfolding RGSim_pre_def by auto\n    ultimately have ?thesis using step_s g_s a0' a0 a2\n      unfolding related_transitions_def by auto\n  }\n  moreover {\n    assume \"cc' = Throw\" \n    then have \"\\<Gamma>\\<^sub>c\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Cc,Normal \\<sigma>\\<rangle> \\<Rightarrow> Abrupt \\<sigma>n'\" using step by auto    \n    then have ?thesis using in_normal_not_abrupt[OF hoare] a2 \\<sigma>b by blast\n  }\n  ultimately show ?thesis  by auto        \nqed\n\nlemma await_step_sim_cond:\n  assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a2:\"Range \\<xi> \\<subseteq> b\" and\n  a3:\"S1 = Await b Ss \\<tau>\"  and\n  a4:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub>\n        (b \\<inter> {s. \\<Sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Ss \n        ({s. (Normal \\<Sigma>n, Normal s) \\<in> G\\<^sub>s \\<and> (\\<sigma>n, s)\\<in> \\<xi>\\<^sub>1}), {}\" and\n  a5:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Ss,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\" \nobtains \\<Sigma>' where \"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\"  \nproof-\n  have \"\\<Sigma> \\<in> b\" using a0 a2 by auto\n  moreover have \"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub>\n        (b \\<inter> {s. \\<Sigma> = s \\<and> (\\<sigma>,\\<Sigma>)\\<in>\\<xi>}) Ss \n        ({s. (Normal \\<Sigma>, Normal s) \\<in> G\\<^sub>s \\<and> (\\<sigma>, s)\\<in> \\<xi>\\<^sub>1}), {}\" using a4 by auto\n  then have \"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n             (b \\<inter> {s. \\<Sigma> = s \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<xi>}) Ss \n            ({s. (Normal \\<Sigma>, Normal s) \\<in> G\\<^sub>s \\<and> (\\<sigma>, s) \\<in> \\<xi>\\<^sub>1}),{}\"\n    using hoaret_sound' by blast  \n  moreover obtain \\<Sigma>' where \"\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Ss,Normal \\<Sigma>\\<rangle> \\<Rightarrow> Normal \\<Sigma>' \\<and> (\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> \n                                      (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s\"\n    using calculation a0 a5 Termination.terminates_implies_exec  unfolding validt_def valid_def\n    by blast   \n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using a3 calculation Awaitc  by fastforce\n  ultimately show ?thesis\n    using that by blast\nqed\n \nlemma spec_mod_state_only_Await_sound1: assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a1:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and a1':\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n  a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and  \n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and  \n  a6:\"S1 = Await b Ss \\<tau>\" and a7:\"Range \\<xi> \\<subseteq> b\" and\n  a8:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n        (b \\<inter> {s. \\<Sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Ss \n        ({s. (Normal \\<Sigma>n, Normal s) \\<in> G\\<^sub>s \\<and> (\\<sigma>n, s)\\<in> \\<xi>\\<^sub>1}), {}\" and\n  a9:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Ss,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\" and\n  a10:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" and \n  a11:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\"\n  shows  \"(\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n               (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                        (\\<exists>v. e = Some v \\<and>\n                             (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                    (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                             \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (Normal \\<sigma>,\\<sigma>')\\<in>G\\<^sub>c \\<and>\n                       (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\"\nproof-\n  obtain \\<Sigma>' where \n   \"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using await_step_sim_cond[OF a0 a7 a6 a8 a9] by auto\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq S1 S2, Normal \\<Sigma>) \\<rightarrow> (Seq Skip S2, Normal \\<Sigma>')\"\n    using Seqc calculation by fastforce\n  moreover have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S2, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using  calculation Spec_Seq_Skip_sim[OF a1 a1' a2  a4 a10] \n    unfolding RGSim_pre_def by auto  \n  moreover have \"(\\<exists>\\<Sigma>''. (\\<sigma>', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n               (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                        (\\<exists>v. e = Some v \\<and>\n                             (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                    (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                             \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (Normal \\<sigma>,\\<sigma>')\\<in>G\\<^sub>c \\<and>\n                       (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))\" \n    using a11 sim_elim_cases[OF x] by fast  \n  ultimately show ?thesis\n    by (metis (no_types, lifting) converse_rtranclp_into_rtranclp)  \nqed\n\nlemma spec_mod_state_only_Await_sound2:\n  assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a0':\"\\<xi>\\<subseteq>\\<alpha>\" and a1:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and a1':\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n  a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and \n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n  a6:\"S1 = Await b Ss \\<tau>\" and a7:\"Range \\<xi> \\<subseteq> b\" and\n  a8:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n        (b \\<inter> {s. \\<Sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Ss \n        ({s. (Normal \\<Sigma>n, Normal s) \\<in> G\\<^sub>s \\<and> (\\<sigma>n, s)\\<in> \\<xi>\\<^sub>1}), {}\" and\n  a9:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Ss,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\" and\n  a10:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" and   \n  a11:\"C = LanguageCon.com.Throw\" shows\n      \"\\<exists>\\<Sigma>n'. ((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n              (\\<sigma>, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n              \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and>\n              \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\"\nproof-\n\nobtain \\<Sigma>' where \n   sim_cond:\"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using await_step_sim_cond[OF a0 a7 a6 a8 a9] by auto\n  moreover have step:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq S1 S2, Normal \\<Sigma>) \\<rightarrow> (Seq Skip S2, Normal \\<Sigma>')\"\n    using Seqc calculation by fastforce\n  moreover have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S2, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using  calculation Spec_Seq_Skip_sim[OF a1 a1' a2  a4  a10] \n    unfolding RGSim_pre_def by auto  \n  ultimately obtain \\<Sigma>n' where sim:\"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                 (\\<sigma>, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                 \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and>\n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\"   \n    using sim_elim_cases_c(2)[OF x[simplified a11]] by auto   \n  moreover have \"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\"\n    using related_transition_tran[OF subsetD[OF a0' a0]] calculation sim_cond by auto\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\"\n    using step calculation by auto\n  ultimately show ?thesis by auto    \nqed\n\nlemma spec_mod_state_only_Await_sound3:\n  assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a0':\"\\<xi>\\<subseteq>\\<alpha>\" and a1:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and a1':\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n  a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and  \n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and   \n  a6:\"S1 = Await b Ss \\<tau>\" and a7:\"Range \\<xi> \\<subseteq> b\" and\n  a8:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n        (b \\<inter> {s. \\<Sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Ss \n        ({s. (Normal \\<Sigma>n, Normal s) \\<in> G\\<^sub>s \\<and> (\\<sigma>n, s)\\<in> \\<xi>\\<^sub>1}), {}\" and\n  a9:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Ss,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\" and\n  a10:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" and   \n  a11:\"C = Skip\" shows\n      \"\\<exists>\\<Sigma>n'. ((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<sigma>, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and> \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\"\nproof-\n\nobtain \\<Sigma>' where \n   sim_cond:\"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using await_step_sim_cond[OF a0 a7 a6 a8 a9] by auto\n  moreover have step:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq S1 S2, Normal \\<Sigma>) \\<rightarrow> (Seq Skip S2, Normal \\<Sigma>')\"\n    using Seqc calculation by fastforce\n  moreover have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S2, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using  calculation Spec_Seq_Skip_sim[OF a1 a1' a2  a4 a10] \n    unfolding RGSim_pre_def by auto  \n  ultimately obtain \\<Sigma>n' where sim:\"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<sigma>, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and> \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\"   \n    using sim_elim_cases_c(1)[OF x[simplified a11]] by auto   \n  moreover have \"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\"\n    using related_transition_tran[OF subsetD[OF a0' a0]] calculation sim_cond by auto\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\"\n    using step calculation by auto\n  ultimately show ?thesis by auto    \nqed\n\nlemma spec_mod_state_only_Await_sound4: assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and  a0':\"\\<xi>\\<subseteq>\\<alpha>\" and a1:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and a1':\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n  a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and \n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n  a6:\"S1 = Await b Ss \\<tau>\" and a7:\"Range \\<xi> \\<subseteq> b\" and\n  a8:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n        (b \\<inter> {s. \\<Sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Ss \n        ({s. (Normal \\<Sigma>n, Normal s) \\<in> G\\<^sub>s \\<and> (\\<sigma>n, s)\\<in> \\<xi>\\<^sub>1}), {}\" and\n  a9:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Ss,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\" and\n  a10:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" and \n  a11:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n  shows  \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          (c\\<^sub>c' = C \\<and> c\\<^sub>s' = LanguageCon.com.Seq S1 S2 \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n           (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof-\n obtain \\<Sigma>' where \n   sim_cond:\"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using await_step_sim_cond[OF a0 a7 a6 a8 a9] by auto\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq S1 S2, Normal \\<Sigma>) \\<rightarrow> (Seq Skip S2, Normal \\<Sigma>')\"\n    using Seqc calculation by fastforce\n  moreover have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S2, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using  calculation Spec_Seq_Skip_sim[OF a1 a1' a2  a4  a10] \n    unfolding RGSim_pre_def by auto  \n  moreover obtain c\\<^sub>s' \\<Sigma>n' where \n        \"(\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                   (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n            (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n            ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n            (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\" \n    using a11 sim_elim_cases[OF x] by metis \n  moreover have \"((Normal \\<sigma>, Normal  \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\"\n    using related_transition_tran[OF subsetD[OF a0' a0]] calculation sim_cond \n    by auto\n  ultimately show ?thesis\n    by (metis (no_types, lifting) converse_rtranclp_into_rtranclp)\nqed\n\nlemma spec_mod_state_only_Await_sound5: assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and  a0':\"\\<xi>\\<subseteq>\\<alpha>\" and a1:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and a1':\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n  a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and \n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and   \n  a6:\"S1 = Await b Ss \\<tau>\" and a7:\"Range \\<xi> \\<subseteq> b\" and\n  a8:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n        (b \\<inter> {s. \\<Sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Ss \n        ({s. (Normal \\<Sigma>n, Normal s) \\<in> G\\<^sub>s \\<and> (\\<sigma>n, s)\\<in> \\<xi>\\<^sub>1}), {}\" and\n  a9:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Ss,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\" and\n  a10:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" and \n  a11:\" \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n  shows  \"\\<exists>c\\<^sub>s' \\<Sigma>n'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                  (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and> ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                  (c\\<^sub>c' = C \\<and> c\\<^sub>s' = LanguageCon.com.Seq S1 S2 \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                   (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof-\n obtain \\<Sigma>' where \n   sim_cond:\"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using await_step_sim_cond[OF a0 a7 a6 a8 a9] by auto\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq S1 S2, Normal \\<Sigma>) \\<rightarrow> (Seq Skip S2, Normal \\<Sigma>')\"\n    using Seqc calculation by fastforce\n  moreover have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S2, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using  calculation Spec_Seq_Skip_sim[OF a1 a1' a2 a4 a10] \n    unfolding RGSim_pre_def by auto  \n  moreover obtain c\\<^sub>s' \\<Sigma>n' where \n        \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                  (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and> ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                  ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\" \n    using a11 sim_elim_cases[OF x] by metis \n  moreover have \"((Normal \\<sigma>, Normal  \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\"\n    using related_transition_tran[OF subsetD[OF a0' a0]] calculation sim_cond \n    by auto\n  ultimately show ?thesis \n    by (metis (no_types, lifting) converse_rtranclp_into_rtranclp)\nqed\n\nlemma seq_await_spec_sim: \n  assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and  a2:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and \n a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n a9:\"S1 = Await b Ss \\<tau>\" and a9':\"Range \\<xi> \\<subseteq> b\" and \n a10:\"\\<forall>\\<sigma>n \\<Sigma>n. \\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> \n        (b \\<inter> {s. \\<Sigma>n = s \\<and> (\\<sigma>n,\\<Sigma>n)\\<in>\\<xi>}) Ss \n        ({s. (Normal \\<Sigma>n, Normal s) \\<in> G\\<^sub>s \\<and> (\\<sigma>n, s)\\<in> \\<xi>\\<^sub>1}), {}\" and\n a11:\"\\<forall>\\<sigma>. \\<forall>f \\<in> F. \\<not>\\<Gamma>\\<^sub>s\\<^sub>\\<not>\\<^sub>a\\<turnstile>\\<langle>Ss,Normal \\<sigma>\\<rangle> \\<Rightarrow> Fault f\" and\n a12:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" \nshows \"(\\<Gamma>\\<^sub>c,C ,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,Seq S1 S2,R\\<^sub>s,G\\<^sub>s)\"    \nproof-\n  {fix \\<sigma> \\<Sigma> \n    assume \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"    \n    then have \"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq S1 S2, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n      apply (coinduction arbitrary: \\<sigma> \\<Sigma>)\n      apply clarsimp\n      apply (rule conjId)+       \n             apply (rule, rule, rule, rule, frule  spec_mod_state_only_Await_sound1[OF  _ a2 a4 a6  a7  a9 a9' a10 a11 a12], fast+)\n            apply (rule, frule spec_mod_state_only_Await_sound2[OF _ a1 a2 a4 a6  a7  a9 a9' a10 a11 a12], fast+)\n          apply (rule, frule spec_mod_state_only_Await_sound3[OF _ a1 a2 a4 a6  a7  a9 a9' a10 a11 a12], fast+)\n          apply (blast dest: sim_env[OF _ a3 a6 a7])\n         apply (rule, rule, rule, rule,frule spec_mod_state_only_Await_sound4[OF _ a1 a2 a4 a6  a7  a9 a9' a10 a11 a12], fast+)      \n      apply (rule, rule, rule, frule spec_mod_state_only_Await_sound5[OF _ a1 a2 a4 a6  a7  a9 a9' a10 a11 a12], fast+)\n      using  a1 unfolding alpha_xstate_def by auto   \n  } then show ?thesis unfolding RGSim_pre_def by auto\nqed\n\nlemma mod_state_tran_v_spec: \"label C1 = \\<tau> \\<Longrightarrow>        \n       \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>Some v (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<Longrightarrow>\n       \\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          (c\\<^sub>c' = LanguageCon.com.Seq C1 C2 \\<and> c\\<^sub>s' = S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c)\n           \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof -\nassume a1: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>Some v (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n  assume a2: \"label C1 = \\<tau>\"\n  obtain c1' where s:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C1, Normal \\<sigma>) \\<rightarrow> (c1', Normal \\<sigma>n')\" \n    using stepc_elim_cases1(5)[OF a1] by fastforce    \n  thus ?thesis using label_step[OF _ s] a2 by force \nqed\n\nlemma mod_state_only_impl_basic_tau_sound1:\n  assumes a0:\"C1 = Basic fc \\<tau> \\<or> C1 = Spec rc \\<tau>\" and   \n a1:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and \n a2: \"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>')\" and \n a3:\"(\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\" and \n a4:\"\\<forall>\\<sigma> \\<sigma>' \\<Sigma> . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<sigma>' \\<in> com_step  C1 (Normal \\<sigma>)  \\<Gamma>\\<^sub>c  \\<longrightarrow> \n                (\\<exists>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n' \\<and> (\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c)\"\nshows \"\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n             (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                      (\\<exists>v. e = Some v \\<and>\n                           (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                  (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                           \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (Normal \\<sigma>,\\<sigma>')\\<in>G\\<^sub>c \\<and>\n                     (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s))\"\nproof-\n  {\n    assume a00:\"C1 = Basic fc \\<tau>\"    \n    then have \"\\<sigma>' = Normal (fc \\<sigma>)\" using a2 \n      by (metis LanguageCon.com.simps(12) LanguageCon.com.simps(48) Pair_inject stepc_Normal_elim_cases(3) stepc_Normal_elim_cases(5) stepce_stepc)     \n    then have ?thesis using a3 by auto\n  }\n  moreover {\n    assume a00:\"C1 = Spec rc \\<tau>\"   \n    then have e:\"e=\\<tau>\"  using a2 label_step by fastforce\n    have c\\<^sub>c':\"c\\<^sub>c' = Seq Skip C2\" using stepc_elim_cases1(5)[OF a2[simplified a00]]\n    proof -\n      obtain cc xx where\n        f1: \"(c\\<^sub>c', \\<sigma>') = (LanguageCon.com.Seq cc C2, xx) \\<and> \n            \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Spec rc \\<tau>, Normal \\<sigma>) \\<rightarrow> (cc, xx)\"\n        using stepc_elim_cases1(5)[OF a2[simplified a00]]  by force\n      thus ?thesis\n        using stepc_elim_cases1(4) by fastforce\n    qed       \n    moreover have step:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Spec rc \\<tau>, Normal \\<sigma>) \\<rightarrow> (Skip, \\<sigma>')\"\n     using  stepc_elim_cases(6)[OF a2[simplified a00 c\\<^sub>c'], simplified e] by auto    \n    moreover have \\<sigma>:\"\\<sigma>' = Stuck\" using stepc_elim_cases1(4)[OF step] a3     \n      by fastforce\n    moreover  have \"(\\<nexists>sn.(\\<sigma>, sn)\\<in>rc)\" using stepc_elim_cases(3)[OF step[simplified \\<sigma>]] by auto\n    moreover have \"\\<sigma>' \\<in> com_step  C1 (Normal \\<sigma>)  \\<Gamma>\\<^sub>c \" using calculation a00 by auto\n    ultimately have ?thesis using a4 a00 a1 \\<sigma> by fast\n  } ultimately show ?thesis using a0 by auto  \nqed\n\nlemma mod_state_only_impl_basic_tau_sound2:\n  assumes a0:\"\\<xi> \\<subseteq> \\<alpha> \" and a0':\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha> \" and a1:\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and \n          a2:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and \n       a3:\"\\<forall>\\<sigma> \\<sigma>' \\<Sigma> . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<sigma>' \\<in> com_step  C1 (Normal \\<sigma>)  \\<Gamma>\\<^sub>c  \\<longrightarrow> \n                (\\<exists>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n' \\<and> (\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c)\" and\n       a4:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Seq C1 C2, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\" and\n       a5:\"C1 = Basic fc \\<tau> \\<or> C1 = Spec rc \\<tau>\" and \n      a6:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and \n      a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and a8:\"(\\<Gamma>\\<^sub>c,C2,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S,R\\<^sub>s,G\\<^sub>s)\" \n  shows \"(\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n          (c\\<^sub>c' = LanguageCon.com.Seq C1 C2 \\<and> c\\<^sub>s' = S \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n           (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\nproof-\n  have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (S, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (S, Normal \\<Sigma>)\" by auto\n  moreover have \"(Normal \\<Sigma>, Normal \\<Sigma>) \\<in> G\\<^sub>s\\<^sup>*\"  by auto\n  moreover have \"c\\<^sub>c' = Seq Skip C2 \\<and> (\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c\" \n                 using a5\n  proof\n    assume a00:\"C1 = LanguageCon.com.Basic fc \\<tau> \"    \n    then have \"c\\<^sub>c' = Seq Skip C2\" using a4\n      by (metis LanguageCon.com.distinct(1) LanguageCon.com.distinct(37) prod.sel(1) \n          stepc_Normal_elim_cases(3) stepc_Normal_elim_cases(5) stepce_stepc)\n    moreover have \"(\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c\"  \n    proof -\n      have \"\\<sigma>n' = fc \\<sigma>\" using a4[simplified calculation a00]\n        by (meson CRef.stepc_elim_cases(6) Pair_inject stepc_Normal_elim_cases(3) stepce_stepc xstate.inject(1))\n      then show ?thesis using a3[simplified a00] a2 by auto\n    qed\n    ultimately show ?thesis by auto    \n  next\n    assume a00:\"C1 = LanguageCon.com.Spec rc \\<tau>\"\n    have c\\<^sub>c':\"c\\<^sub>c' = Seq Skip C2\" using stepc_elim_cases1(5)[OF a4[simplified a00]]\n    proof -\n      obtain cc xx where\n        f1: \"(c\\<^sub>c', Normal \\<sigma>n') = (LanguageCon.com.Seq cc C2, xx) \\<and> \n            \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Spec rc \\<tau>, Normal \\<sigma>) \\<rightarrow> (cc, xx)\"\n        using stepc_elim_cases1(5)[OF a4[simplified a00]]  by force\n      thus ?thesis\n        using stepc_elim_cases1(4) by fastforce\n    qed\n    moreover have \"(\\<sigma>n',\\<Sigma>)\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<sigma>, Normal \\<sigma>n') \\<in> G\\<^sub>c\"  \n    proof-\n      have \"(\\<sigma>,\\<sigma>n')\\<in>rc\" using a4[simplified calculation a00]\n        by (meson CRef.stepc_elim_cases(2) CRef.stepc_elim_cases(6)) \n      then show ?thesis  using a3[simplified a00] a2 by auto\n    qed\n    ultimately show ?thesis  by auto          \nqed \n  moreover have \"(\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(S, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n    using Impl_Seq_Skip_sim[OF a0' a1 a6  a7  a8] calculation \n    unfolding RGSim_pre_def by auto\n  ultimately show ?thesis using a0' a0 a2 unfolding related_transitions_def by fast\nqed\n\nlemma spec_tran_basic_sim_cond:assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and\n  a1:\"\\<forall>\\<sigma> \\<Sigma> \\<Sigma>'.\n       (\\<sigma>, \\<Sigma>) \\<in> \\<xi> \\<and> \\<Sigma>' \\<in> com_step S1 (Normal \\<Sigma>) \\<Gamma>\\<^sub>s \\<longrightarrow>\n       (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>, \\<Sigma>n') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)\" and\n  a2:    \"S1 = LanguageCon.com.Basic fc \\<tau> \"\nobtains \\<Sigma>n' where \"(\\<sigma>, \\<Sigma>n') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>n')\"\nproof-\n  have \"Normal (fc \\<Sigma>) \\<in> com_step S1 (Normal \\<Sigma>) \\<Gamma>\\<^sub>s\" using a2 by auto\n  then have \"(\\<exists>\\<Sigma>n'. Normal (fc \\<Sigma>) = Normal \\<Sigma>n' \\<and> (\\<sigma>, (fc \\<Sigma>)) \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal (fc \\<Sigma>)) \\<in> G\\<^sub>s)\"\n    using a1 a0 by auto\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal (fc \\<Sigma>))\"\n    using Basicc a2 by auto\n  ultimately show ?thesis using that by auto\nqed\n\nlemma spec_tran_spec_sim_cond:assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and\n  a1:\"\\<forall>\\<sigma> \\<Sigma> \\<Sigma>'.\n       (\\<sigma>, \\<Sigma>) \\<in> \\<xi> \\<and> \\<Sigma>' \\<in> com_step S1 (Normal \\<Sigma>) \\<Gamma>\\<^sub>s \\<longrightarrow>\n       (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>, \\<Sigma>n') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)\" and\n  a2:    \"S1 = Spec r \\<tau> \"\nobtains \\<Sigma>n' where \"(\\<sigma>, \\<Sigma>n') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>n')\"\nproof-\n  {assume a00: \"\\<exists>\\<Sigma>'. (\\<Sigma>,\\<Sigma>') \\<in> r\"\n    then obtain \\<Sigma>' where a00:\"(\\<Sigma>,\\<Sigma>') \\<in> r\" by auto\n    then have \"Normal \\<Sigma>' \\<in> com_step S1 (Normal \\<Sigma>) \\<Gamma>\\<^sub>s\" using a2 by auto\n    then have \"(\\<exists>\\<Sigma>n'. Normal \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>') \\<in> G\\<^sub>s)\"\n      using a1 a0 by auto\n    moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\"\n      using Specc a2 a00 by auto\n    ultimately have ?thesis using that by auto  \n  }\n  moreover\n  {assume a00: \"\\<not>(\\<exists>\\<Sigma>'. (\\<Sigma>,\\<Sigma>') \\<in> r)\"    \n    then have \"Stuck \\<in> com_step S1 (Normal \\<Sigma>) \\<Gamma>\\<^sub>s\" using a2 by auto    \n    then have ?thesis using that a1  a0 by auto  \n  }\n  ultimately show ?thesis  by auto\nqed\n\nlemma spec_mod_non_await_sound1: assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a1:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and a1':\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n  a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and  \n  a6:\"S1 = Basic fc \\<tau> \\<or> S1 = Spec rc \\<tau>\" and \n  a7:\"\\<forall>\\<sigma> \\<Sigma> \\<Sigma>' . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<Sigma>' \\<in> com_step  S1 (Normal \\<Sigma>)  \\<Gamma>\\<^sub>s  \\<longrightarrow> \n                (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>,\\<Sigma>n')\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)\" and\n  a8:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" and \n  a9:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', \\<sigma>') \\<and> (\\<forall>\\<sigma>n. \\<sigma>' \\<noteq> Normal \\<sigma>n)\"\n  shows  \"(\\<exists>\\<Sigma>'. (\\<sigma>', \\<Sigma>') \\<in> \\<alpha>\\<^sub>x \\<and>\n               (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>') \\<or>\n                        (\\<exists>v. e = Some v \\<and>\n                             (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                    (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                             \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'))))) \\<and> (Normal \\<sigma>,\\<sigma>')\\<in>G\\<^sub>c \\<and>\n                       (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)))\"\nproof-\n  obtain \\<Sigma>' where \n   \"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using a6 spec_tran_basic_sim_cond[OF a0 a7] spec_tran_spec_sim_cond[OF a0 a7] by blast     \n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq S1 S2, Normal \\<Sigma>) \\<rightarrow> (Seq Skip S2, Normal \\<Sigma>')\"\n    using Seqc calculation by fastforce\n  moreover have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S2, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using  calculation Spec_Seq_Skip_sim[OF a1 a1' a2  a4  a8] \n    unfolding RGSim_pre_def by auto  \n  moreover have \"(\\<exists>\\<Sigma>''. (\\<sigma>', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n               (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                        (\\<exists>v. e = Some v \\<and>\n                             (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                    (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                             \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and> (Normal \\<sigma>,\\<sigma>')\\<in>G\\<^sub>c \\<and>\n                       (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))\" \n    using a9 sim_elim_cases[OF x] by fast  \n  ultimately show ?thesis\n    by (metis (no_types, lifting) converse_rtranclp_into_rtranclp)  \nqed\n\nlemma spec_mod_non_await2:\n  assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a0':\"\\<xi>\\<subseteq>\\<alpha>\" and a1:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and a1':\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n  a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n  a6:\"S1 = Basic fc \\<tau> \\<or> S1 = Spec rc \\<tau>\" and \n  a7:\"\\<forall>\\<sigma> \\<Sigma> \\<Sigma>' . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<Sigma>' \\<in> com_step  S1 (Normal \\<Sigma>)  \\<Gamma>\\<^sub>s  \\<longrightarrow> \n                (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>,\\<Sigma>n')\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)\" and\n  a8:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" and   \n  a11:\"C = LanguageCon.com.Throw\" shows\n      \"\\<exists>\\<Sigma>n'. ((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n              (\\<sigma>, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n              \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and>\n              \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\"\nproof-\n\n  obtain \\<Sigma>' where \n    sim_cond:\"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using a6 spec_tran_basic_sim_cond[OF a0 a7] spec_tran_spec_sim_cond[OF a0 a7] by blast\n  moreover have step:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq S1 S2, Normal \\<Sigma>) \\<rightarrow> (Seq Skip S2, Normal \\<Sigma>')\"\n    using Seqc calculation by fastforce\n  moreover have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S2, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using  calculation Spec_Seq_Skip_sim[OF a1 a1' a2  a4 a8] \n    unfolding RGSim_pre_def by auto  \n  ultimately obtain \\<Sigma>n' where sim:\"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n                 (\\<sigma>, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>a \\<and>\n                 \\<gamma>\\<^sub>a \\<subseteq> \\<alpha> \\<and>\n                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\"   \n    using sim_elim_cases_c(2)[OF x[simplified a11]] by auto   \n  moreover have \"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\"\n    using related_transition_tran[OF subsetD[OF a0' a0]] calculation sim_cond by auto\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Throw, Normal \\<Sigma>n')\"\n    using step calculation by auto\n  ultimately show ?thesis by auto    \nqed\n\nlemma spec_mod_non_await3:\n  assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a0':\"\\<xi>\\<subseteq>\\<alpha>\" and a1:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and a1':\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n  a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and \n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and  \n  a6:\"S1 = Basic fc \\<tau> \\<or> S1 = Spec rc \\<tau>\" and \n  a7:\"\\<forall>\\<sigma> \\<Sigma> \\<Sigma>' . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<Sigma>' \\<in> com_step  S1 (Normal \\<Sigma>)  \\<Gamma>\\<^sub>s  \\<longrightarrow> \n                (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>,\\<Sigma>n')\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)\" and\n  a8:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" and \n  a11:\"C = Skip\" shows\n      \"\\<exists>\\<Sigma>n'. ((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<sigma>, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and> \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\"\nproof-\n\nobtain \\<Sigma>' where \n   sim_cond:\"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using a6 spec_tran_basic_sim_cond[OF a0 a7] spec_tran_spec_sim_cond[OF a0 a7] by blast\n  moreover have step:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq S1 S2, Normal \\<Sigma>) \\<rightarrow> (Seq Skip S2, Normal \\<Sigma>')\"\n    using Seqc calculation by fastforce\n  moreover have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S2, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using  calculation Spec_Seq_Skip_sim[OF a1 a1' a2  a4  a8] \n    unfolding RGSim_pre_def by auto  \n  ultimately obtain \\<Sigma>n' where sim:\"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n             (\\<sigma>, \\<Sigma>n') \\<in> \\<gamma>\\<^sub>n \\<and> \\<gamma>\\<^sub>n \\<subseteq> \\<alpha> \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\"   \n    using sim_elim_cases_c(1)[OF x[simplified a11]] by auto   \n  moreover have \"((Normal \\<sigma>, Normal \\<sigma>), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\"\n    using related_transition_tran[OF subsetD[OF a0' a0]] calculation sim_cond by auto\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (LanguageCon.com.Skip, Normal \\<Sigma>n')\"\n    using step calculation by auto\n  ultimately show ?thesis by auto    \nqed\n\nlemma spec_mod_non_await4: assumes \n  a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a0':\"\\<xi>\\<subseteq>\\<alpha>\" and a1:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and a1':\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n  a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n  a6:\"S1 = Basic fc \\<tau> \\<or> S1 = Spec rc \\<tau>\" and \n  a7:\"\\<forall>\\<sigma> \\<Sigma> \\<Sigma>' . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<Sigma>' \\<in> com_step  S1 (Normal \\<Sigma>)  \\<Gamma>\\<^sub>s  \\<longrightarrow> \n                (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>,\\<Sigma>n')\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)\" and\n  a8:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" and \n  a9:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n  shows  \"\\<exists>c\\<^sub>s' \\<Sigma>n'.\n          (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                 (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n          (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n          ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n          (c\\<^sub>c' = C \\<and> c\\<^sub>s' = LanguageCon.com.Seq S1 S2 \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n           (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof-\n obtain \\<Sigma>' where \n   sim_cond:\"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using a6 spec_tran_basic_sim_cond[OF a0 a7] spec_tran_spec_sim_cond[OF a0 a7] by blast\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq S1 S2, Normal \\<Sigma>) \\<rightarrow> (Seq Skip S2, Normal \\<Sigma>')\"\n    using Seqc calculation by fastforce\n  moreover have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S2, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using  calculation Spec_Seq_Skip_sim[OF a1 a1' a2  a4 a8] \n    unfolding RGSim_pre_def by auto  \n  moreover obtain c\\<^sub>s' \\<Sigma>n' where \n        \"(\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq LanguageCon.com.Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                   (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n            (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n            ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n            (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)\" \n    using a9 sim_elim_cases[OF x] by metis \n  moreover have \"((Normal \\<sigma>, Normal  \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\"\n    using related_transition_tran[OF subsetD[OF a0' a0]] calculation sim_cond \n    by auto\n  ultimately show ?thesis\n    by (metis (no_types, lifting) converse_rtranclp_into_rtranclp)\nqed\n\nlemma spec_mod_non_await5: assumes \n   a0:\"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\" and a0':\"\\<xi>\\<subseteq>\\<alpha>\" and a1:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and a1':\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n  a2:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and  \n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and   \n  a6:\"S1 = Basic fc \\<tau> \\<or> S1 = Spec rc \\<tau>\" and \n  a7:\"\\<forall>\\<sigma> \\<Sigma> \\<Sigma>' . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<Sigma>' \\<in> com_step  S1 (Normal \\<Sigma>)  \\<Gamma>\\<^sub>s  \\<longrightarrow> \n                (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>,\\<Sigma>n')\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)\" and\n  a8:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\" and \n  a11:\" \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (C, Normal \\<sigma>) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n  shows  \"\\<exists>c\\<^sub>s' \\<Sigma>n'. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq S1 S2, Normal \\<Sigma>) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                  (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and> ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                  (c\\<^sub>c' = C \\<and> c\\<^sub>s' = LanguageCon.com.Seq S1 S2 \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                   (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\"\nproof-\n obtain \\<Sigma>' where \n   sim_cond:\"(\\<sigma>, \\<Sigma>') \\<in> \\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>')\\<in>G\\<^sub>s \\<and> \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (S1, Normal \\<Sigma>) \\<rightarrow> (Skip, Normal \\<Sigma>')\" \n    using a6 spec_tran_basic_sim_cond[OF a0 a7] spec_tran_spec_sim_cond[OF a0 a7] by blast\n  moreover have \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (Seq S1 S2, Normal \\<Sigma>) \\<rightarrow> (Seq Skip S2, Normal \\<Sigma>')\"\n    using Seqc calculation by fastforce\n  moreover have x:\"(\\<Gamma>\\<^sub>c,(C,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq Skip S2, Normal \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\"\n    using  calculation Spec_Seq_Skip_sim[OF a1 a1' a2  a4  a8] \n    unfolding RGSim_pre_def by auto  \n  moreover obtain c\\<^sub>s' \\<Sigma>n' where \n        \"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (LanguageCon.com.Seq Skip S2, Normal \\<Sigma>') \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n                  (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and> ((Normal \\<sigma>, Normal \\<sigma>n'), Normal \\<Sigma>', Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n                  ((\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s))\" \n    using a11 sim_elim_cases[OF x] by metis \n  moreover have \"((Normal \\<sigma>, Normal  \\<sigma>n'), Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> ((G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\"\n    using related_transition_tran[OF subsetD[OF a0' a0]] calculation sim_cond \n    by auto\n  ultimately show ?thesis \n    by (metis (no_types, lifting) converse_rtranclp_into_rtranclp)\nqed\n\n\nlemma seq_non_await_spec_sim: \n  assumes\n a1:\"\\<xi> \\<subseteq> \\<alpha>\" and a2:\"\\<xi>\\<^sub>1 \\<subseteq> \\<alpha>\" and\n a3:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and a4:\"Sta\\<^sub>s \\<xi>\\<^sub>1 ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and\n a5:\"\\<forall>sn. ( sn,  sn)\\<in>G\\<^sub>c\" and\n a7:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and \n a9:\"S1 = Basic fc \\<tau> \\<or> S1 = Spec rc \\<tau>\" and   \n a10:\"\\<forall>\\<sigma> \\<Sigma> \\<Sigma>' . (\\<sigma>, \\<Sigma>)\\<in>\\<xi> \\<and> \\<Sigma>' \\<in> com_step  S1 (Normal \\<Sigma>)  \\<Gamma>\\<^sub>s  \\<longrightarrow> \n                (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>,\\<Sigma>n')\\<in>\\<xi>\\<^sub>1 \\<and> (Normal \\<Sigma>, Normal \\<Sigma>n') \\<in> G\\<^sub>s)\" and\n a11:\"(\\<Gamma>\\<^sub>c,C,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,S2,R\\<^sub>s,G\\<^sub>s)\"\nshows \"(\\<Gamma>\\<^sub>c,C ,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,Seq S1 S2,R\\<^sub>s,G\\<^sub>s)\"  \n  \nproof-\n  {fix \\<sigma> \\<Sigma> \n    assume a12: \"(\\<sigma>, \\<Sigma>) \\<in> \\<xi>\"    \n    then have \"(\\<Gamma>\\<^sub>c,(C, Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(Seq S1 S2, Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\n      apply (coinduction arbitrary: \\<sigma> \\<Sigma>)\n      apply clarsimp\n      apply (rule conjId)+ \n             apply (rule, rule, rule, rule, frule  spec_mod_non_await_sound1[OF  _ a2 a4 a5  a7  a9 a10 a11], fast+)      \n            apply (rule, frule spec_mod_non_await2[OF _ a1 a2 a4 a5  a7  a9 a10 a11], fast+)\n          apply (rule, frule spec_mod_non_await3[OF _ a1 a2 a4 a5  a7  a9 a10 a11], fast+)\n          apply (blast dest: sim_env[OF _ a3 a5 a7])       \n         apply (rule, rule, rule, rule,frule spec_mod_non_await4[OF _ a1 a2 a4 a5  a7  a9 a10 a11], fast+)      \n      apply (rule, rule, rule, frule spec_mod_non_await5[OF _ a1 a2 a4 a5  a7 a9 a10 a11], fast+)\n      using  a1 unfolding alpha_xstate_def by auto   \n  } then show ?thesis unfolding RGSim_pre_def by auto\nqed\n\nlemma If_branch_sim:\n  assumes \n  a1:\"\\<xi> \\<subseteq> \\<alpha> \\<and> \\<gamma>\\<^sub>n\\<subseteq>\\<alpha>\" and \n  a2:\"Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>)\" and \n  a3:\"(\\<forall>s. ( s, s)\\<in>G\\<^sub>c)\" and \n  a4:\"R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x\" and\n  a5:\"\\<xi>\\<^sub>1= \\<xi> \\<inter> (b\\<^sub>c \\<odot> {s. True})\" and \n  a6:\"\\<xi>\\<^sub>2= \\<xi> \\<inter> (-(b\\<^sub>c) \\<odot> {s. True} )\" and  \n  a7:\"(\\<sigma>,\\<Sigma>)\\<in>\\<xi>\" and\n  a9:\"(\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\" and \n  a10:\"(\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>2\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,c\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\nshows  \n  \"(\\<Gamma>\\<^sub>c,(Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c,Normal \\<sigma>),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s,Normal \\<Sigma>),R\\<^sub>s,G\\<^sub>s)\"\nusing  a1 a2 a3 a4  a5 a6 a7  a9 a10\n  proof(coinduction arbitrary: \\<sigma> \\<Sigma>,clarsimp)    \n    fix \\<sigma>n \\<Sigma>n\n    assume \n       a0:\"(\\<sigma>n, \\<Sigma>n) \\<in> \\<xi>\" and              \n       a3:\"Sta\\<^sub>s \\<xi> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\" and                            \n       a8:\"\\<xi> \\<subseteq> \\<alpha>\" and       \n       a11:\"\\<gamma>\\<^sub>n \\<subseteq> \\<alpha>\" and       \n       a13:\"(\\<forall>s. ( s, s)\\<in>G\\<^sub>c)\"     \n    have \"(\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha>\" using a0 a8 by fastforce\n    moreover have \"(Normal \\<sigma>n, Normal \\<Sigma>n) \\<in> \\<alpha>\\<^sub>x\" unfolding alpha_xstate_def by auto \n    moreover have \"\\<forall>\\<sigma>' \\<Sigma>'.\n           (((Normal \\<sigma>n, \\<sigma>'), Normal \\<Sigma>n, \\<Sigma>') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>', \\<Sigma>')\\<in> \\<alpha>\\<^sub>x \\<longrightarrow>\n           (\\<exists>\\<sigma>n'. \\<sigma>' = Normal \\<sigma>n' \\<and> (\\<exists>\\<Sigma>n'. \\<Sigma>' = Normal \\<Sigma>n' \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi>)) \\<or>\n           (\\<Gamma>\\<^sub>c,(Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, \\<sigma>'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n           (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>'),R\\<^sub>s,G\\<^sub>s)\" \n      using sim_env[OF a0 a3 a13 a4] by blast\n    moreover have \"\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               ((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c \\<and> c\\<^sub>s' = c\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\n      by (metis CRef.stepc_elim_cases(10) CRef.stepc_elim_cases(9) \n               option.distinct(1) stepc_Normal_elim_cases(6) stepce_stepc) \n    moreover have \"\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               ((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c \\<and> c\\<^sub>s' = c\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\"\n    proof -\n      {fix c\\<^sub>c' \\<sigma>n'\n        assume  a00:\"\\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n')\"\n        then have eqs:\"\\<sigma>n = \\<sigma>n'\"\n          using stepc_elim_cases2(1) by fastforce \n        have guar:\"((Normal \\<sigma>n, Normal \\<sigma>n), Normal \\<Sigma>n, Normal \\<Sigma>n) \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>\"\n        using  a13 a0 a8  unfolding related_transitions_def Id_def by auto\n       have h:\"(c\\<^sub>c'=c1\\<^sub>c \\<and> \\<sigma>n'\\<in>b\\<^sub>c) \\<or> (c\\<^sub>c'=c2\\<^sub>c \\<and> \\<sigma>n'\\<in> -b\\<^sub>c)\"  \n        using stepc_elim_cases2(1)[OF a00] by auto\n        {\n          assume c:\"c\\<^sub>c' = c1\\<^sub>c \\<and> \\<sigma>n' \\<in> b\\<^sub>c\"\n          then have sig1:\"(\\<sigma>n',  \\<Sigma>n) \\<in> \\<xi>\\<^sub>1\"\n            using a0 a5 a6 a7 eqs unfolding eq_rel_def ToNorm_def and_rel_def by auto          \n          then have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s, Normal \\<Sigma>n)\"          \n            by (simp add:  r_into_rtranclp )        \n          have x:\"(\\<Gamma>\\<^sub>c,(c1\\<^sub>c, Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>n),R\\<^sub>s,G\\<^sub>s)\" \n            using a9  sig1\n            unfolding RGSim_pre_def by auto\n          note l = conjI[OF x steps]\n        } note l=this        \n        {\n          assume c:\"c\\<^sub>c' = c2\\<^sub>c \\<and> \\<sigma>n' \\<in> -b\\<^sub>c\"\n          then have sig1:\"(\\<sigma>n', \\<Sigma>n) \\<in> \\<xi>\\<^sub>2\"\n            using a0 a5 a6 a7 eqs unfolding eq_rel_def ToNorm_def and_rel_def by auto\n          then have steps:\"\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s, Normal \\<Sigma>n)\"          \n            by (simp add:  r_into_rtranclp)        \n          have x:\"(\\<Gamma>\\<^sub>c,(c2\\<^sub>c, Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s, Normal \\<Sigma>n),R\\<^sub>s,G\\<^sub>s)\" \n            using a10  sig1\n            unfolding RGSim_pre_def by auto\n          note l = conjI[OF x steps]          \n        } \n        then have \"(\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               ((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha> \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c \\<and> c\\<^sub>s' = c\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))\" \n          using guar l h  eqs calculation(1) by fastforce\n       } thus ?thesis by auto\n     qed\n     moreover have\"\\<forall>\\<sigma>'' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and>\n           (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                   (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                            (\\<exists>v. e = Some v \\<and>\n                                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>Some v (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and>\n                           (Normal \\<sigma>n, \\<sigma>'') \\<in> G\\<^sub>c \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                           (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)))\"\n      by (meson prod.inject stepc_elim_cases2(1))\n    ultimately show \"(Normal \\<sigma>n, Normal \\<Sigma>n) \\<in> \\<alpha>\\<^sub>x \\<and>\n       (\\<sigma>n, \\<Sigma>n) \\<in> \\<alpha> \\<and>\n       (\\<forall>c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>\\<tau> (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n') \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c \\<and> c\\<^sub>s' = c\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>v c\\<^sub>c' \\<sigma>n'.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>(Some v) (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', Normal \\<sigma>n') \\<longrightarrow>\n           (\\<exists>c\\<^sub>s' \\<Sigma>n'.\n               (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                      (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v)(a, b) \\<rightarrow> (aa, ba) \\<and>\n                               \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', Normal \\<Sigma>n'))) \\<and>\n               (\\<sigma>n', \\<Sigma>n') \\<in> \\<alpha> \\<and>\n               (((Normal \\<sigma>n, Normal \\<sigma>n'), Normal \\<Sigma>n, Normal \\<Sigma>n') \\<in> (G\\<^sub>c, G\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and>\n               (c\\<^sub>c' = LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c \\<and> c\\<^sub>s' = c\\<^sub>s \\<and> (\\<sigma>n', \\<Sigma>n') \\<in> \\<xi> \\<or>\n                (\\<Gamma>\\<^sub>c,(c\\<^sub>c', Normal \\<sigma>n'),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,(c\\<^sub>s', Normal \\<Sigma>n'),R\\<^sub>s,G\\<^sub>s)))) \\<and>\n       (\\<forall>\\<sigma>'' \\<Sigma>''.\n           (((Normal \\<sigma>n, \\<sigma>''), Normal \\<Sigma>n, \\<Sigma>'') \\<in> (R\\<^sub>c, R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<and> (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<longrightarrow>\n           (\\<exists>\\<sigma>. \\<sigma>'' = Normal \\<sigma> \\<and> (\\<exists>\\<Sigma>. \\<Sigma>'' = Normal \\<Sigma> \\<and> (\\<sigma>, \\<Sigma>) \\<in> \\<xi>)) \\<or>\n           (\\<Gamma>\\<^sub>c,(LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n           (\\<Gamma>\\<^sub>s,(c\\<^sub>s, \\<Sigma>''),R\\<^sub>s,G\\<^sub>s)) \\<and>\n       (\\<forall>\\<sigma>'' c\\<^sub>c' e.\n           \\<Gamma>\\<^sub>c\\<turnstile>\\<^sub>c\\<^sub>e (LanguageCon.com.Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c, Normal \\<sigma>n) \\<rightarrow> (c\\<^sub>c', \\<sigma>'') \\<and>\n           (\\<forall>\\<sigma>n. \\<sigma>'' \\<noteq> Normal \\<sigma>n) \\<longrightarrow>\n           (\\<exists>\\<Sigma>''. (\\<sigma>'', \\<Sigma>'') \\<in> \\<alpha>\\<^sub>x \\<and>\n                   (\\<exists>c\\<^sub>s'. (\\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>'') \\<or>\n                            (\\<exists>v. e = Some v \\<and>\n                                 (\\<exists>a b. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (c\\<^sub>s, Normal \\<Sigma>n) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (a, b) \\<and>\n                                        (\\<exists>aa ba. \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c\\<^sub>(Some v) (a, b) \\<rightarrow> (aa, ba) \\<and>\n                                                 \\<Gamma>\\<^sub>s\\<turnstile>\\<^sub>c (aa, ba) \\<rightarrow>\\<^sub>\\<tau>\\<^sup>* (c\\<^sub>s', \\<Sigma>''))))) \\<and>\n                           (Normal \\<sigma>n, \\<sigma>'') \\<in> G\\<^sub>c \\<and> (\\<Gamma>\\<^sub>c,(c\\<^sub>c', \\<sigma>''),R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>)\n                           (\\<Gamma>\\<^sub>s,(c\\<^sub>s', \\<Sigma>''),R\\<^sub>s,G\\<^sub>s))))\" \n      by auto\n  qed    \n\nlemma If_branch_imp_sound:\n  \"\\<xi> \\<subseteq> \\<alpha> \\<and> \\<gamma>\\<^sub>n\\<subseteq>\\<alpha> \\<Longrightarrow> Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow> \\<forall>s. ( s, s)\\<in>G\\<^sub>c  \\<Longrightarrow> R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow>\n   \\<xi>\\<^sub>1= \\<xi> \\<inter> (b\\<^sub>c \\<odot> {s. True}) \\<Longrightarrow> \\<xi>\\<^sub>2= \\<xi> \\<inter> (-(b\\<^sub>c) \\<odot> {s. True} ) \\<Longrightarrow>\n  (\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>1\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow> \n  (\\<Gamma>\\<^sub>c,c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>2\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow> \n  (\\<Gamma>\\<^sub>c,Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (auto,rule If_branch_sim, auto)\n  unfolding RGSim_pre_def by blast+ \n\nlemma If_branch1_imp_sound:\n  \"\\<xi> \\<subseteq> \\<alpha> \\<and> \\<gamma>\\<^sub>n\\<subseteq>\\<alpha> \\<Longrightarrow> Sta\\<^sub>s \\<xi> ((R\\<^sub>c,R\\<^sub>s\\<^sup>*)\\<^sub>\\<alpha>) \\<Longrightarrow> \\<forall>s. ( s, s)\\<in>G\\<^sub>c  \\<Longrightarrow> R\\<^sub>c\\<subseteq>1\\<alpha>\\<^sub>x \\<Longrightarrow>\n   \\<xi> \\<subseteq> (b\\<^sub>c \\<odot> {s. True}) \\<Longrightarrow>\n  (\\<Gamma>\\<^sub>c,c1\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s,G\\<^sub>s) \\<Longrightarrow>  \n  (\\<Gamma>\\<^sub>c,Cond b\\<^sub>c c1\\<^sub>c c2\\<^sub>c,R\\<^sub>c,G\\<^sub>c) \\<succeq>\\<^sub>(\\<^sub>\\<alpha>\\<^sub>;\\<^sub>\\<xi>\\<^sub>\\<rhd>\\<^sub>\\<gamma>\\<^sub>n\\<^sub>;\\<^sub>\\<gamma>\\<^sub>a\\<^sub>) (\\<Gamma>\\<^sub>s,C\\<^sub>s,R\\<^sub>s,G\\<^sub>s)\"\n  unfolding RGSim_pre_def apply (auto,rule If_branch_sim, auto)\n  unfolding RGSim_pre_def by blast+\n\n\nend\n    \n", "meta": {"author": "CompSoftVer", "repo": "CSim", "sha": "816d36b7523796ace031c429003d82e9244eff9c", "save_path": "github-repos/isabelle/CompSoftVer-CSim", "path": "github-repos/isabelle/CompSoftVer-CSim/CSim-816d36b7523796ace031c429003d82e9244eff9c/CSim/Sim_Rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6723316860482762, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.34404328761965075}}
{"text": "theory Semantics\nimports Main Firewall_Common \"Common/List_Misc\" \"HOL-Library.LaTeXsugar\"\nbegin\n\nsection\\<open>Big Step Semantics\\<close>\n\n\ntext\\<open>\nThe assumption we apply in general is that the firewall does not alter any packets.\n\\<close>\n\ntext\\<open>A firewall ruleset is a map of chain names\n  (e.g., INPUT, OUTPUT, FORWARD, arbitrary-user-defined-chain) to a list of rules.\n  The list of rules is processed sequentially.\\<close>\ntype_synonym 'a ruleset = \"string \\<rightharpoonup> 'a rule list\"\n\ntext\\<open>A matcher (parameterized by the type of primitive @{typ 'a} and packet @{typ 'p})\n     is a function which just tells whether a given primitive and packet matches.\\<close>\ntype_synonym ('a, 'p) matcher = \"'a \\<Rightarrow> 'p \\<Rightarrow> bool\"\n\ntext\\<open>Example: Assume a network packet only has a destination street number\n    (for simplicity, of type @{typ \"nat\"}) and we only support the following match expression:\n    Is the packet's street number within a certain range?\n    The type for the primitive could then be @{typ \"nat \\<times> nat\"} and a possible implementation\n    for @{typ \"(nat \\<times> nat, nat) matcher\"} could be\n    @{term \"match_street_number (a,b) p \\<longleftrightarrow> p \\<in> {a .. b}\"}.\n    Usually, the primitives are a datatype which supports interfaces, IP addresses, protocols,\n    ports, payload, ...\\<close>\n\n\ntext\\<open>Given an @{typ \"('a, 'p) matcher\"} and a match expression, does a packet of type @{typ 'p}\n     match the match expression?\\<close>\nfun matches :: \"('a, 'p) matcher \\<Rightarrow> 'a match_expr \\<Rightarrow> 'p \\<Rightarrow> bool\" where\n\"matches \\<gamma> (MatchAnd e1 e2) p \\<longleftrightarrow> matches \\<gamma> e1 p \\<and> matches \\<gamma> e2 p\" |\n\"matches \\<gamma> (MatchNot me) p \\<longleftrightarrow> \\<not> matches \\<gamma> me p\" |\n\"matches \\<gamma> (Match e) p \\<longleftrightarrow> \\<gamma> e p\" |\n\"matches _ MatchAny _ \\<longleftrightarrow> True\"\n\n\n(*Note: \"matches \\<gamma> (MatchNot me) p \\<longleftrightarrow> \\<not> matches \\<gamma> me p\" does not work for ternary logic.\n  Here, we have Boolean logic and everything is fine.*)\n\n\ninductive iptables_bigstep :: \"'a ruleset \\<Rightarrow> ('a, 'p) matcher \\<Rightarrow> 'p \\<Rightarrow> 'a rule list \\<Rightarrow> state \\<Rightarrow> state \\<Rightarrow> bool\"\n  (\"_,_,_\\<turnstile> \\<langle>_, _\\<rangle> \\<Rightarrow> _\"  [60,60,60,20,98,98] 89)\n  for \\<Gamma> and \\<gamma> and p where\nskip:    \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[], t\\<rangle> \\<Rightarrow> t\" |\naccept:  \"matches \\<gamma> m p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Accept], Undecided\\<rangle> \\<Rightarrow> Decision FinalAllow\" |\ndrop:    \"matches \\<gamma> m p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Drop], Undecided\\<rangle> \\<Rightarrow> Decision FinalDeny\" |\nreject:  \"matches \\<gamma> m p \\<Longrightarrow>  \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Reject], Undecided\\<rangle> \\<Rightarrow> Decision FinalDeny\" |\nlog:     \"matches \\<gamma> m p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Log], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\n(*empty does not do anything to the packet. It could update the internal firewall state, e.g. marking a packet for later-on rate limiting*)\nempty:   \"matches \\<gamma> m p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Empty], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\nnomatch: \"\\<not> matches \\<gamma> m p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\ndecision: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Decision X\\<rangle> \\<Rightarrow> Decision X\" |\nseq:      \"\\<lbrakk>\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> t; \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, t\\<rangle> \\<Rightarrow> t'\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1@rs\\<^sub>2, Undecided\\<rangle> \\<Rightarrow> t'\" |\ncall_return:  \"\\<lbrakk> matches \\<gamma> m p; \\<Gamma> chain = Some (rs\\<^sub>1@[Rule m' Return]@rs\\<^sub>2);\n                 matches \\<gamma> m' p; \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> Undecided \\<rbrakk> \\<Longrightarrow>\n               \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call chain)], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\ncall_result:  \"\\<lbrakk> matches \\<gamma> m p; \\<Gamma> chain = Some rs; \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Undecided\\<rangle> \\<Rightarrow> t \\<rbrakk> \\<Longrightarrow>\n               \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call chain)], Undecided\\<rangle> \\<Rightarrow> t\"\n\ntext\\<open>\nThe semantic rules again in pretty format:\n\\begin{center}\n@{thm[mode=Axiom] skip [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] accept [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] drop [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] reject [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] log [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] empty [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] nomatch [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] decision [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] seq [no_vars]} \\\\[1ex]\n@{thm[mode=Rule] call_return [no_vars]}\\\\[1ex] \n@{thm[mode=Rule] call_result [no_vars]}\n\\end{center}\n\\<close>\n\n\n(*future work:\n  Add abstraction function for unknown actions. At the moment, only the explicitly listed actions are supported.\n  This would also require a @{text \"Decision FinalUnknown\"} state\n  Problem: An unknown action may modify a packet.\n  Assume that we have a firewall which accepts the packets A->B and rewrites the header to A->C.\n  After that firewall, there is another firewall which only accepts packets for A->C.\n  A can send through both firewalls.\n  \n  If our model says that the firewall accepts packets A->B but does not consider packet modification,\n  A might not be able to pass the second firewall with this model.\n  \n  Luckily, our model is correct for the filtering behaviour and explicitly does not support any actions with packet modification.\n  Thus, the described scenario is not a counterexample that our model is wrong but a hint for future features\n  we may want to support. Luckily, we introduced the @{term \"Decision state\"}, which should make adding packet modification states easy.\n*)\n\nlemma deny:\n  \"matches \\<gamma> m p \\<Longrightarrow> a = Drop \\<or> a = Reject \\<Longrightarrow> iptables_bigstep \\<Gamma> \\<gamma> p [Rule m a] Undecided (Decision FinalDeny)\"\nby (auto intro: drop reject)\n\nlemma seq_cons:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r],Undecided\\<rangle> \\<Rightarrow> t\" and \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,t\\<rangle> \\<Rightarrow> t'\"\n  shows \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs, Undecided\\<rangle> \\<Rightarrow> t'\"\nproof -\n  from assms have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r] @ rs, Undecided\\<rangle> \\<Rightarrow> t'\" by (rule seq)\n  thus ?thesis by simp\nqed\n\nlemma iptables_bigstep_induct\n  [case_names Skip Allow Deny Log Nomatch Decision Seq Call_return Call_result,\n   induct pred: iptables_bigstep]:\n  \"\\<lbrakk> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,s\\<rangle> \\<Rightarrow> t;\n     \\<And>t. P [] t t;\n     \\<And>m a. matches \\<gamma> m p \\<Longrightarrow> a = Accept \\<Longrightarrow> P [Rule m a] Undecided (Decision FinalAllow);\n     \\<And>m a. matches \\<gamma> m p \\<Longrightarrow> a = Drop \\<or> a = Reject \\<Longrightarrow> P [Rule m a] Undecided (Decision FinalDeny);\n     \\<And>m a. matches \\<gamma> m p \\<Longrightarrow> a = Log \\<or> a = Empty \\<Longrightarrow> P [Rule m a] Undecided Undecided;\n     \\<And>m a. \\<not> matches \\<gamma> m p \\<Longrightarrow> P [Rule m a] Undecided Undecided;\n     \\<And>rs X. P rs (Decision X) (Decision X);\n     \\<And>rs rs\\<^sub>1 rs\\<^sub>2 t t'. rs = rs\\<^sub>1 @ rs\\<^sub>2 \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> P rs\\<^sub>1 Undecided t \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t\\<rangle> \\<Rightarrow> t' \\<Longrightarrow> P rs\\<^sub>2 t t' \\<Longrightarrow> P rs Undecided t';\n     \\<And>m a chain rs\\<^sub>1 m' rs\\<^sub>2. matches \\<gamma> m p \\<Longrightarrow> a = Call chain \\<Longrightarrow> \\<Gamma> chain = Some (rs\\<^sub>1 @ [Rule m' Return] @ rs\\<^sub>2) \\<Longrightarrow> matches \\<gamma> m' p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,Undecided\\<rangle> \\<Rightarrow> Undecided \\<Longrightarrow> P rs\\<^sub>1 Undecided Undecided \\<Longrightarrow> P [Rule m a] Undecided Undecided;\n     \\<And>m a chain rs t. matches \\<gamma> m p \\<Longrightarrow> a = Call chain \\<Longrightarrow> \\<Gamma> chain = Some rs \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> P rs Undecided t \\<Longrightarrow> P [Rule m a] Undecided t \\<rbrakk> \\<Longrightarrow>\n   P rs s t\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma skipD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [] \\<Longrightarrow> s = t\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma decisionD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> s = Decision X \\<Longrightarrow> t = Decision X\"\nby (induction rule: iptables_bigstep_induct) auto\n\ncontext\n  notes skipD[dest] list_app_singletonE[elim]\nbegin\n\nlemma acceptD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [Rule m Accept] \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> s = Undecided \\<Longrightarrow> t = Decision FinalAllow\"\nby (induction rule: iptables_bigstep.induct) auto\n\n\n\nlemma rejectD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [Rule m Reject] \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> s = Undecided \\<Longrightarrow> t = Decision FinalDeny\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma logD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [Rule m Log] \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> s = Undecided \\<Longrightarrow> t = Undecided\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma emptyD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [Rule m Empty] \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> s = Undecided \\<Longrightarrow> t = Undecided\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma nomatchD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [Rule m a] \\<Longrightarrow> s = Undecided \\<Longrightarrow> \\<not> matches \\<gamma> m p \\<Longrightarrow> t = Undecided\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma callD:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t\" \"r = [Rule m (Call chain)]\" \"s = Undecided\" \"matches \\<gamma> m p\" \"\\<Gamma> chain = Some rs\"\n  obtains \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,s\\<rangle> \\<Rightarrow> t\"\n        | rs\\<^sub>1 rs\\<^sub>2 m' where \"rs = rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2\" \"matches \\<gamma> m' p\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,s\\<rangle> \\<Rightarrow> Undecided\" \"t = Undecided\"\n  using assms\n  proof (induction r s t arbitrary: rs rule: iptables_bigstep.induct)\n    case (seq rs\\<^sub>1)\n    thus ?case by (cases rs\\<^sub>1) auto\n  qed auto\n\nend\n\nlemmas iptables_bigstepD = skipD acceptD dropD rejectD logD emptyD nomatchD decisionD callD\n\nlemma seq':\n  assumes \"rs = rs\\<^sub>1 @ rs\\<^sub>2\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,s\\<rangle> \\<Rightarrow> t\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t\\<rangle> \\<Rightarrow> t'\"\n  shows \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,s\\<rangle> \\<Rightarrow> t'\"\nusing assms by (cases s) (auto intro: seq decision dest: decisionD)\n\nlemma seq'_cons: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r],s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,t\\<rangle> \\<Rightarrow> t' \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs, s\\<rangle> \\<Rightarrow> t'\"\nby (metis decision decisionD state.exhaust seq_cons)\n\nlemma seq_split:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\" \"rs = rs\\<^sub>1@rs\\<^sub>2\"\n  obtains t' where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,s\\<rangle> \\<Rightarrow> t'\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t'\\<rangle> \\<Rightarrow> t\"\n  using assms\n  proof (induction rs s t arbitrary: rs\\<^sub>1 rs\\<^sub>2 thesis rule: iptables_bigstep_induct)\n    case Allow thus ?case by (cases rs\\<^sub>1) (auto intro: iptables_bigstep.intros)\n  next\n    case Deny thus ?case by (cases rs\\<^sub>1) (auto intro: iptables_bigstep.intros)\n  next\n    case Log thus ?case by (cases rs\\<^sub>1) (auto intro: iptables_bigstep.intros)\n  next\n    case Nomatch thus ?case by (cases rs\\<^sub>1) (auto intro: iptables_bigstep.intros)\n  next\n    case (Seq rs rsa rsb t t')\n    hence rs: \"rsa @ rsb = rs\\<^sub>1 @ rs\\<^sub>2\" by simp\n    note List.append_eq_append_conv_if[simp]\n    from rs show ?case\n      proof (cases rule: list_app_eq_cases)\n        case longer\n        with Seq have t1: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>take (length rsa) rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> t\"\n          by simp\n        from Seq longer obtain t2\n          where t2a: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>drop (length rsa) rs\\<^sub>1,t\\<rangle> \\<Rightarrow> t2\"\n            and rs2_t2: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t2\\<rangle> \\<Rightarrow> t'\"\n          by blast\n        with t1 rs2_t2 have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>take (length rsa) rs\\<^sub>1 @ drop (length rsa) rs\\<^sub>1,Undecided\\<rangle> \\<Rightarrow> t2\"\n          by (blast intro: iptables_bigstep.seq)\n        with Seq rs2_t2 show ?thesis\n          by simp\n      next\n        case shorter\n        with rs have rsa': \"rsa = rs\\<^sub>1 @ take (length rsa - length rs\\<^sub>1) rs\\<^sub>2\"\n          by (metis append_eq_conv_conj length_drop)\n        from shorter rs have rsb': \"rsb = drop (length rsa - length rs\\<^sub>1) rs\\<^sub>2\"\n          by (metis append_eq_conv_conj length_drop)\n        from Seq rsa' obtain t1\n          where t1a: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,Undecided\\<rangle> \\<Rightarrow> t1\"\n            and t1b: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>take (length rsa - length rs\\<^sub>1) rs\\<^sub>2,t1\\<rangle> \\<Rightarrow> t\"\n          by blast\n        from rsb' Seq.hyps have t2: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>drop (length rsa - length rs\\<^sub>1) rs\\<^sub>2,t\\<rangle> \\<Rightarrow> t'\"\n          by blast\n        with seq' t1b have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t1\\<rangle> \\<Rightarrow> t'\"\n          by fastforce\n        with Seq t1a show ?thesis\n          by fast\n      qed\n  next\n    case Call_return\n    hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> Undecided\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, Undecided\\<rangle> \\<Rightarrow> Undecided\"\n      by (case_tac [!] rs\\<^sub>1) (auto intro: iptables_bigstep.skip iptables_bigstep.call_return)\n    thus ?case by fact\n  next\n    case (Call_result _ _ _ _ t)\n    show ?case\n      proof (cases rs\\<^sub>1)\n        case Nil\n        with Call_result have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> Undecided\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, Undecided\\<rangle> \\<Rightarrow> t\"\n          by (auto intro: iptables_bigstep.intros)\n        thus ?thesis by fact\n      next\n        case Cons\n        with Call_result have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> t\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, t\\<rangle> \\<Rightarrow> t\"\n          by (auto intro: iptables_bigstep.intros)\n        thus ?thesis by fact\n      qed\n  qed (auto intro: iptables_bigstep.intros)\n\nlemma seqE:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1@rs\\<^sub>2, s\\<rangle> \\<Rightarrow> t\"\n  obtains ti where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,s\\<rangle> \\<Rightarrow> ti\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,ti\\<rangle> \\<Rightarrow> t\"\n  using assms by (force elim: seq_split)\n\nlemma seqE_cons:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs, s\\<rangle> \\<Rightarrow> t\"\n  obtains ti where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r],s\\<rangle> \\<Rightarrow> ti\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,ti\\<rangle> \\<Rightarrow> t\"\n  using assms by (metis append_Cons append_Nil seqE)\n\nlemma nomatch':\n  assumes \"\\<And>r. r \\<in> set rs \\<Longrightarrow> \\<not> matches \\<gamma> (get_match r) p\"\n  shows \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> s\"\n  proof(cases s)\n    case Undecided\n    have \"\\<forall>r\\<in>set rs. \\<not> matches \\<gamma> (get_match r) p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Undecided\\<rangle> \\<Rightarrow> Undecided\"\n      proof(induction rs)\n        case Nil\n        thus ?case by (fast intro: skip)\n      next\n        case (Cons r rs)\n        hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r], Undecided\\<rangle> \\<Rightarrow> Undecided\"\n          by (cases r) (auto intro: nomatch)\n        with Cons show ?case\n          by (fastforce intro: seq_cons)\n      qed\n    with assms Undecided show ?thesis by simp\n  qed (blast intro: decision)\n\n\ntext\\<open>there are only two cases when there can be a Return on top-level:\n\n  \\<^item> the firewall is in a Decision state\n  \\<^item> the return does not match\n\nIn both cases, it is not applied!\n\\<close>\nlemma no_free_return: assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Return], Undecided\\<rangle> \\<Rightarrow> t\" and \"matches \\<gamma> m p\" shows \"False\"\n  proof -\n  { fix a s\n    have no_free_return_hlp: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>a,s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow>  s = Undecided \\<Longrightarrow> a = [Rule m Return] \\<Longrightarrow> False\"\n    proof (induction rule: iptables_bigstep.induct)\n      case (seq rs\\<^sub>1)\n      thus ?case\n        by (cases rs\\<^sub>1) (auto dest: skipD)\n    qed simp_all\n  } with assms show ?thesis by blast\n  qed\n\n\n(* seq_split is elim, seq_progress is dest *)\nlemma seq_progress: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> rs = rs\\<^sub>1@rs\\<^sub>2 \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, s\\<rangle> \\<Rightarrow> t' \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, t'\\<rangle> \\<Rightarrow> t\"\n  proof(induction arbitrary: rs\\<^sub>1 rs\\<^sub>2 t' rule: iptables_bigstep_induct)\n    case Allow\n    thus ?case\n      by (cases \"rs\\<^sub>1\") (auto intro: iptables_bigstep.intros dest: iptables_bigstepD)\n  next\n    case Deny\n    thus ?case\n      by (cases \"rs\\<^sub>1\") (auto intro: iptables_bigstep.intros dest: iptables_bigstepD)\n  next\n    case Log\n    thus ?case\n      by (cases \"rs\\<^sub>1\") (auto intro: iptables_bigstep.intros dest: iptables_bigstepD)\n  next\n    case Nomatch\n    thus ?case\n      by (cases \"rs\\<^sub>1\") (auto intro: iptables_bigstep.intros dest: iptables_bigstepD)\n  next\n    case Decision\n    thus ?case\n      by (cases \"rs\\<^sub>1\") (auto intro: iptables_bigstep.intros dest: iptables_bigstepD)\n  next\n    case(Seq rs rsa rsb t t' rs\\<^sub>1 rs\\<^sub>2 t'')\n    hence rs: \"rsa @ rsb = rs\\<^sub>1 @ rs\\<^sub>2\" by simp\n    note List.append_eq_append_conv_if[simp]\n    (* TODO larsrh custom case distinction rule *)\n\n    from rs show \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t''\\<rangle> \\<Rightarrow> t'\"\n      proof(cases rule: list_app_eq_cases)\n        case longer\n        have \"rs\\<^sub>1 = take (length rsa) rs\\<^sub>1 @ drop (length rsa) rs\\<^sub>1\"\n          by auto\n        with Seq longer show ?thesis\n          by (metis append_Nil2 skipD seq_split)\n      next\n        case shorter\n        with Seq(7) Seq.hyps(3) Seq.IH(1) rs show ?thesis\n          by (metis seq' append_eq_conv_conj)\n      qed\n  next\n    case(Call_return m a chain rsa m' rsb)\n    have xx: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call chain)], Undecided\\<rangle> \\<Rightarrow> t' \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow>\n          \\<Gamma> chain = Some (rsa @ Rule m' Return # rsb) \\<Longrightarrow>\n          matches \\<gamma> m' p \\<Longrightarrow>\n          \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rsa, Undecided\\<rangle> \\<Rightarrow> Undecided \\<Longrightarrow>\n          t' = Undecided\"\n      apply(erule callD)\n           apply(simp_all)\n      apply(erule seqE)\n      apply(erule seqE_cons)\n      by (metis Call_return.IH no_free_return self_append_conv skipD)\n\n    show ?case\n      proof (cases rs\\<^sub>1)\n        case (Cons r rs)\n        thus ?thesis\n          using Call_return\n          apply(case_tac \"[Rule m a] = rs\\<^sub>2\")\n           apply(simp)\n          apply(simp)\n          using xx by blast\n      next\n        case Nil\n        moreover hence \"t' = Undecided\"\n          by (metis Call_return.hyps(1) Call_return.prems(2) append.simps(1) decision no_free_return seq state.exhaust)\n        moreover have \"\\<And>m. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Undecided\"\n          by (metis (no_types) Call_return(2) Call_return.hyps(3) Call_return.hyps(4) Call_return.hyps(5) call_return nomatch)\n        ultimately show ?thesis\n          using Call_return.prems(1) by auto\n      qed\n  next\n    case(Call_result m a chain rs t)\n    thus ?case\n      proof (cases rs\\<^sub>1)\n        case Cons\n        thus ?thesis\n          using Call_result\n          apply(auto simp add: iptables_bigstep.skip iptables_bigstep.call_result dest: skipD)\n          apply(drule callD, simp_all)\n           apply blast\n          by (metis Cons_eq_appendI append_self_conv2 no_free_return seq_split)\n      qed (fastforce intro: iptables_bigstep.intros dest: skipD)\n  qed (auto dest: iptables_bigstepD)\n\n\ntheorem iptables_bigstep_deterministic: assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\" and \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t'\" shows \"t = t'\"\nproof -\n  { fix r1 r2 m t\n    assume a1: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r1 @ Rule m Return # r2, Undecided\\<rangle> \\<Rightarrow> t\" and a2: \"matches \\<gamma> m p\" and a3: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r1,Undecided\\<rangle> \\<Rightarrow> Undecided\"\n    have False\n    proof -\n      from a1 a3 have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m Return # r2, Undecided\\<rangle> \\<Rightarrow> t\"\n        by (blast intro: seq_progress)\n      hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Return] @ r2, Undecided\\<rangle> \\<Rightarrow> t\"\n        by simp\n      from seqE[OF this] obtain ti where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Return], Undecided\\<rangle> \\<Rightarrow> ti\" by blast\n      with no_free_return a2 show False by fast (*by (blast intro: no_free_return elim: seq_split)*)\n    qed\n  } note no_free_return_seq=this\n  \n  from assms show ?thesis\n  proof (induction arbitrary: t' rule: iptables_bigstep_induct)\n    case Seq\n    thus ?case\n      by (metis seq_progress)\n  next\n    case Call_result\n    thus ?case\n      by (metis no_free_return_seq callD)\n  next\n    case Call_return\n    thus ?case\n      by (metis append_Cons callD no_free_return_seq)\n  qed (auto dest: iptables_bigstepD)\nqed\n\nlemma iptables_bigstep_to_undecided: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> Undecided \\<Longrightarrow> s = Undecided\"\n  by (metis decisionD state.exhaust)\n\nlemma iptables_bigstep_to_decision: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Decision Y\\<rangle> \\<Rightarrow> Decision X \\<Longrightarrow> Y = X\"\n  by (metis decisionD state.inject)\n\nlemma Rule_UndecidedE:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Undecided\"\n  obtains (nomatch) \"\\<not> matches \\<gamma> m p\"\n        | (log) \"a = Log \\<or> a = Empty\"\n        | (call) c where \"a = Call c\" \"matches \\<gamma> m p\"\n  using assms\n  proof (induction \"[Rule m a]\" Undecided Undecided rule: iptables_bigstep_induct)\n    case Seq\n    thus ?case\n      by (metis append_eq_Cons_conv append_is_Nil_conv iptables_bigstep_to_undecided)\n  qed simp_all\n\nlemma Rule_DecisionE:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Decision X\"\n  obtains (call) chain where \"matches \\<gamma> m p\" \"a = Call chain\"\n        | (accept_reject) \"matches \\<gamma> m p\" \"X = FinalAllow \\<Longrightarrow> a = Accept\" \"X = FinalDeny \\<Longrightarrow> a = Drop \\<or> a = Reject\"\n  using assms\n  proof (induction \"[Rule m a]\" Undecided \"Decision X\" rule: iptables_bigstep_induct)\n    case (Seq rs\\<^sub>1)\n    thus ?case\n      by (cases rs\\<^sub>1) (auto dest: skipD)\n  qed simp_all\n\n\nlemma log_remove:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1 @ [Rule m Log] @ rs\\<^sub>2, s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1 @ rs\\<^sub>2, s\\<rangle> \\<Rightarrow> t\"\n  proof -\n    from assms obtain t' where t': \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, s\\<rangle> \\<Rightarrow> t'\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Log] @ rs\\<^sub>2, t'\\<rangle> \\<Rightarrow> t\"\n      by (blast elim: seqE)\n    hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m Log # rs\\<^sub>2, t'\\<rangle> \\<Rightarrow> t\"\n      by simp\n    then obtain t'' where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Log], t'\\<rangle> \\<Rightarrow> t''\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, t''\\<rangle> \\<Rightarrow> t\"\n      by (blast elim: seqE_cons)\n    with t' show ?thesis\n      by (metis state.exhaust iptables_bigstep_deterministic decision log nomatch seq)\n  qed\nlemma empty_empty:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1 @ [Rule m Empty] @ rs\\<^sub>2, s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1 @ rs\\<^sub>2, s\\<rangle> \\<Rightarrow> t\"\n  proof -\n    from assms obtain t' where t': \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, s\\<rangle> \\<Rightarrow> t'\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Empty] @ rs\\<^sub>2, t'\\<rangle> \\<Rightarrow> t\"\n      by (blast elim: seqE)\n    hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m Empty # rs\\<^sub>2, t'\\<rangle> \\<Rightarrow> t\"\n      by simp\n    then obtain t'' where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Empty], t'\\<rangle> \\<Rightarrow> t''\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, t''\\<rangle> \\<Rightarrow> t\"\n      by (blast elim: seqE_cons)\n    with t' show ?thesis\n      by (metis state.exhaust iptables_bigstep_deterministic decision empty nomatch seq)\n  qed\n\n\n\nlemma Unknown_actions_False: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r # rs, Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = Rule m a \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> a = Unknown \\<or> (\\<exists>chain. a = Goto chain) \\<Longrightarrow> False\"\nproof -\n  have 1: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Unknown], Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> False\"\n  by (induction \"[Rule m Unknown]\" Undecided t rule: iptables_bigstep.induct)\n     (auto elim: list_app_singletonE dest: skipD)\n  \n  { fix chain\n    have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Goto chain)], Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> False\"\n    by (induction \"[Rule m (Goto chain)]\" Undecided t rule: iptables_bigstep.induct)\n       (auto elim: list_app_singletonE dest: skipD)\n  }note 2=this\n  show \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r # rs, Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = Rule m a \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> a = Unknown \\<or> (\\<exists>chain. a = Goto chain) \\<Longrightarrow> False\"\n  apply(erule seqE_cons)\n  apply(case_tac ti)\n   apply(simp_all)\n   using Rule_UndecidedE apply fastforce\n  by (metis \"1\" \"2\" decision iptables_bigstep_deterministic)\nqed\n\ntext\\<open>\nThe notation we prefer in the paper. The semantics are defined for fixed \\<open>\\<Gamma>\\<close> and \\<open>\\<gamma>\\<close>\n\\<close>\nlocale iptables_bigstep_fixedbackground =\n  fixes \\<Gamma>::\"'a ruleset\"\n  and \\<gamma>::\"('a, 'p) matcher\"\n  begin\n\n  inductive iptables_bigstep' :: \"'p \\<Rightarrow> 'a rule list \\<Rightarrow> state \\<Rightarrow> state \\<Rightarrow> bool\"\n    (\"_\\<turnstile>'' \\<langle>_, _\\<rangle> \\<Rightarrow> _\"  [60,20,98,98] 89)\n    for p where\n  skip:    \"p\\<turnstile>' \\<langle>[], t\\<rangle> \\<Rightarrow> t\" |\n  accept:  \"matches \\<gamma> m p \\<Longrightarrow> p\\<turnstile>' \\<langle>[Rule m Accept], Undecided\\<rangle> \\<Rightarrow> Decision FinalAllow\" |\n  drop:    \"matches \\<gamma> m p \\<Longrightarrow> p\\<turnstile>' \\<langle>[Rule m Drop], Undecided\\<rangle> \\<Rightarrow> Decision FinalDeny\" |\n  reject:  \"matches \\<gamma> m p \\<Longrightarrow>  p\\<turnstile>' \\<langle>[Rule m Reject], Undecided\\<rangle> \\<Rightarrow> Decision FinalDeny\" |\n  log:     \"matches \\<gamma> m p \\<Longrightarrow> p\\<turnstile>' \\<langle>[Rule m Log], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\n  empty:   \"matches \\<gamma> m p \\<Longrightarrow> p\\<turnstile>' \\<langle>[Rule m Empty], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\n  nomatch: \"\\<not> matches \\<gamma> m p \\<Longrightarrow> p\\<turnstile>' \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\n  decision: \"p\\<turnstile>' \\<langle>rs, Decision X\\<rangle> \\<Rightarrow> Decision X\" |\n  seq:      \"\\<lbrakk>p\\<turnstile>' \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> t; p\\<turnstile>' \\<langle>rs\\<^sub>2, t\\<rangle> \\<Rightarrow> t'\\<rbrakk> \\<Longrightarrow> p\\<turnstile>' \\<langle>rs\\<^sub>1@rs\\<^sub>2, Undecided\\<rangle> \\<Rightarrow> t'\" |\n  call_return:  \"\\<lbrakk> matches \\<gamma> m p; \\<Gamma> chain = Some (rs\\<^sub>1@[Rule m' Return]@rs\\<^sub>2);\n                   matches \\<gamma> m' p; p\\<turnstile>' \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> Undecided \\<rbrakk> \\<Longrightarrow>\n                 p\\<turnstile>' \\<langle>[Rule m (Call chain)], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\n  call_result:  \"\\<lbrakk> matches \\<gamma> m p; p\\<turnstile>' \\<langle>the (\\<Gamma> chain), Undecided\\<rangle> \\<Rightarrow> t \\<rbrakk> \\<Longrightarrow>\n                 p\\<turnstile>' \\<langle>[Rule m (Call chain)], Undecided\\<rangle> \\<Rightarrow> t\"\n\n  definition wf_\\<Gamma>:: \"'a rule list \\<Rightarrow> bool\" where\n    \"wf_\\<Gamma> rs \\<equiv> \\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. (\\<forall>r \\<in> set rsg. \\<forall> chain. get_action r = Call chain \\<longrightarrow> \\<Gamma> chain \\<noteq> None)\"\n\n  lemma wf_\\<Gamma>_append: \"wf_\\<Gamma> (rs1@rs2) \\<longleftrightarrow> wf_\\<Gamma> rs1 \\<and> wf_\\<Gamma> rs2\"\n    by(simp add: wf_\\<Gamma>_def, blast)\n  lemma wf_\\<Gamma>_tail: \"wf_\\<Gamma> (r # rs) \\<Longrightarrow> wf_\\<Gamma> rs\" by(simp add: wf_\\<Gamma>_def)\n  lemma wf_\\<Gamma>_Call: \"wf_\\<Gamma> [Rule m (Call chain)] \\<Longrightarrow> wf_\\<Gamma> (the (\\<Gamma> chain)) \\<and> (\\<exists>rs. \\<Gamma> chain = Some rs)\"\n    apply(simp add: wf_\\<Gamma>_def)\n    by (metis option.collapse ranI)\n  \n  lemma \"wf_\\<Gamma> rs \\<Longrightarrow> p\\<turnstile>' \\<langle>rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\n    apply(rule iffI)\n     apply(rotate_tac 1)\n     apply(induction rs s t rule: iptables_bigstep'.induct)\n               apply(auto intro: iptables_bigstep.intros simp: wf_\\<Gamma>_append dest!: wf_\\<Gamma>_Call)[11]\n    apply(rotate_tac 1)\n    apply(induction rs s t rule: iptables_bigstep.induct)\n              apply(auto intro: iptables_bigstep'.intros simp: wf_\\<Gamma>_append dest!: wf_\\<Gamma>_Call)[11]\n    done\n    \n  end\n\n\n\n\ntext\\<open>Showing that semantics are defined.\n  For rulesets which can be loaded by the Linux kernel. The kernel does not allow loops.\\<close>\n\n\n\n\ntext\\<open>\n  We call a ruleset well-formed (wf) iff all @{const Call}s are into actually existing chains.\n\\<close>\ndefinition wf_chain :: \"'a ruleset \\<Rightarrow> 'a rule list \\<Rightarrow> bool\" where\n  \"wf_chain \\<Gamma> rs \\<equiv> (\\<forall>r \\<in> set rs. \\<forall> chain. get_action r = Call chain \\<longrightarrow> \\<Gamma> chain \\<noteq> None)\"\nlemma wf_chain_append: \"wf_chain \\<Gamma> (rs1@rs2) \\<longleftrightarrow> wf_chain \\<Gamma> rs1 \\<and> wf_chain \\<Gamma> rs2\"\n  by(simp add: wf_chain_def, blast)\n\nlemma wf_chain_fst: \"wf_chain \\<Gamma> (r # rs) \\<Longrightarrow>  wf_chain \\<Gamma> (rs)\"\n  by(simp add: wf_chain_def)\n\n\ntext\\<open>This is what our tool will check at runtime\\<close>\ndefinition sanity_wf_ruleset :: \"(string \\<times> 'a rule list) list \\<Rightarrow> bool\" where\n  \"sanity_wf_ruleset \\<Gamma> \\<equiv> distinct (map fst \\<Gamma>) \\<and>\n          (\\<forall> rs \\<in> ran (map_of \\<Gamma>). (\\<forall>r \\<in> set rs. case get_action r of Accept \\<Rightarrow> True\n                                                                    | Drop \\<Rightarrow> True\n                                                                    | Reject \\<Rightarrow> True\n                                                                    | Log \\<Rightarrow> True\n                                                                    | Empty \\<Rightarrow> True\n                                                                    | Call chain \\<Rightarrow> chain \\<in> dom (map_of \\<Gamma>)\n                                                                    | Goto chain \\<Rightarrow> chain \\<in> dom (map_of \\<Gamma>)\n                                                                    | Return \\<Rightarrow> True\n                                                                    | _ \\<Rightarrow> False))\"\n\nlemma sanity_wf_ruleset_wf_chain: \"sanity_wf_ruleset \\<Gamma> \\<Longrightarrow> rs \\<in> ran (map_of \\<Gamma>) \\<Longrightarrow> wf_chain (map_of \\<Gamma>) rs\"\n  apply(simp add: sanity_wf_ruleset_def wf_chain_def)\n  by fastforce\n\nlemma sanity_wf_ruleset_start: \"sanity_wf_ruleset \\<Gamma> \\<Longrightarrow> chain_name \\<in> dom (map_of \\<Gamma>) \\<Longrightarrow>\n  default_action = Accept \\<or> default_action = Drop \\<Longrightarrow> \n  wf_chain (map_of \\<Gamma>) [Rule MatchAny (Call chain_name), Rule MatchAny default_action]\"\n apply(simp add: sanity_wf_ruleset_def wf_chain_def)\n apply(safe)\n  apply(simp_all)\n  apply blast+\n done\n\n\n\n\n\n\n\nlemma semantics_bigstep_defined1: assumes \"\\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. wf_chain \\<Gamma> rsg\"\n  and \"\\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. \\<forall> r \\<in> set rsg. (\\<forall>chain. get_action r \\<noteq> Goto chain) \\<and> get_action r \\<noteq> Unknown\"\n  and \"\\<forall> r \\<in> set rs. get_action r \\<noteq> Return\" (*no toplevel return*)\n  and \"(\\<forall>name \\<in> dom \\<Gamma>. \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>the (\\<Gamma> name), Undecided\\<rangle> \\<Rightarrow> t)\" (*defined for all chains in the background ruleset*)\n  shows \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\nusing assms proof(induction rs)\ncase Nil thus ?case\n apply(rule_tac x=s in exI)\n by(simp add: skip)\nnext\ncase (Cons r rs)\n  from Cons.prems Cons.IH obtain t' where t': \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t'\"\n    apply simp\n    apply(elim conjE)\n    apply(simp add: wf_chain_fst)\n    by blast\n\n  obtain m a where r: \"r = Rule m a\" by(cases r) blast\n\n  show ?case\n  proof(cases \"matches \\<gamma> m p\")\n  case False\n    hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r], s\\<rangle> \\<Rightarrow> s\"\n      apply(cases s)\n       apply(simp add: nomatch r)\n      by(simp add: decision)\n    thus ?thesis\n      apply(rule_tac x=t' in exI)\n      apply(rule_tac t=s in seq'_cons)\n       apply assumption\n      using t' by(simp)\n  next\n  case True\n    show ?thesis\n    proof(cases s)\n    case (Decision X) thus ?thesis\n      apply(rule_tac x=\"Decision X\" in exI)\n      by(simp add: decision)\n    next\n    case Undecided\n      have \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m a # rs, Undecided\\<rangle> \\<Rightarrow> t\"\n      proof(cases a)\n        case Accept with True show ?thesis\n          apply(rule_tac x=\"Decision FinalAllow\" in exI)\n          apply(rule_tac t=\"Decision FinalAllow\" in seq'_cons)\n           by(auto intro: iptables_bigstep.intros)\n        next\n        case Drop with True show ?thesis\n          apply(rule_tac x=\"Decision FinalDeny\" in exI)\n          apply(rule_tac t=\"Decision FinalDeny\" in seq'_cons)\n           by(auto intro: iptables_bigstep.intros)\n        next\n        case Log with True t' Undecided show ?thesis\n          apply(rule_tac x=t' in exI)\n          apply(rule_tac t=Undecided in seq'_cons)\n           by(auto intro: iptables_bigstep.intros)\n        next\n        case Reject with True show ?thesis\n          apply(rule_tac x=\"Decision FinalDeny\" in exI)\n          apply(rule_tac t=\"Decision FinalDeny\" in seq'_cons)\n           by(auto intro: iptables_bigstep.intros)[2]\n        next\n        case Return with Cons.prems(3)[simplified r] show ?thesis by simp\n        next\n        case Goto with Cons.prems(2)[simplified r] show ?thesis by auto\n        next\n        case (Call chain_name)\n          from Call Cons.prems(1) obtain rs' where 1: \"\\<Gamma> chain_name = Some rs'\" by(simp add: r wf_chain_def) blast\n          with Cons.prems(4) obtain t'' where 2: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>the (\\<Gamma> chain_name), Undecided\\<rangle> \\<Rightarrow> t''\" by blast\n          from 1 2 True have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call chain_name)], Undecided\\<rangle> \\<Rightarrow> t''\" by(auto dest: call_result)\n          with Call t' Undecided show ?thesis\n          apply(simp add: r)\n          apply(cases t'')\n           apply simp\n           apply(rule_tac x=t' in exI)\n           apply(rule_tac t=Undecided in seq'_cons)\n            apply(auto intro: iptables_bigstep.intros)[2]\n          apply(simp)\n          apply(rule_tac x=t'' in exI)\n          apply(rule_tac t=t'' in seq'_cons)\n           apply(auto intro: iptables_bigstep.intros)\n         done\n        next\n        case Empty  with True t' Undecided show ?thesis\n         apply(rule_tac x=t' in exI)\n         apply(rule_tac t=Undecided in seq'_cons)\n          by(auto intro: iptables_bigstep.intros)\n        next\n        case Unknown with Cons.prems(2)[simplified r] show ?thesis by(simp)\n      qed\n      thus ?thesis\n      unfolding r Undecided by simp\n    qed\n  qed\nqed\n\ntext\\<open>Showing the main theorem\\<close>\n\ncontext\nbegin\n  private lemma iptables_bigstep_defined_if_singleton_rules:\n  \"\\<forall> r \\<in> set rs. (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r], s\\<rangle> \\<Rightarrow> t) \\<Longrightarrow> \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\n  proof(induction rs arbitrary: s)\n  case Nil hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[], s\\<rangle> \\<Rightarrow> s\" by(simp add: skip)\n     thus ?case by blast\n  next\n  case(Cons r rs s)\n    from Cons.prems obtain t where t: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r], s\\<rangle> \\<Rightarrow> t\" by simp blast\n    with Cons show ?case\n    proof(cases t)\n      case Decision with t show ?thesis by (meson decision seq'_cons)\n      next\n      case Undecided\n      from Cons obtain t' where t': \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t'\" by simp blast\n      with Undecided t show ?thesis\n      apply(rule_tac x=t' in exI)\n      apply(rule seq'_cons)\n       apply(simp)\n      using iptables_bigstep_to_undecided by fastforce\n    qed\n  qed\n  \n  \n  \n  \n  \n  \n  \n  text\\<open>well founded relation.\\<close>\n  definition calls_chain :: \"'a ruleset \\<Rightarrow> (string \\<times> string) set\" where\n    \"calls_chain \\<Gamma> = {(r, s). case \\<Gamma> r of Some rs \\<Rightarrow> \\<exists>m. Rule m (Call s) \\<in> set rs | None \\<Rightarrow> False}\"  \n  \n  lemma calls_chain_def2: \"calls_chain \\<Gamma> = {(caller, callee). \\<exists>rs m. \\<Gamma> caller = Some rs \\<and> Rule m (Call callee) \\<in> set rs}\"\n    unfolding calls_chain_def\n    apply(safe)\n     apply(simp split: option.split_asm)\n    apply(simp)\n    by blast\n  \n  text\\<open>example\\<close>\n  private lemma \"calls_chain [\n      ''FORWARD'' \\<mapsto> [(Rule m1 Log), (Rule m2 (Call ''foo'')), (Rule m3 Accept), (Rule m' (Call ''baz''))],\n      ''foo'' \\<mapsto> [(Rule m4 Log), (Rule m5 Return), (Rule m6 (Call ''bar''))], \n      ''bar'' \\<mapsto> [],\n      ''baz'' \\<mapsto> []] =\n      {(''FORWARD'', ''foo''), (''FORWARD'', ''baz''), (''foo'', ''bar'')}\"\n    unfolding calls_chain_def by(auto split: option.split_asm if_split_asm)\n  \n  private lemma \"wf (calls_chain [\n      ''FORWARD'' \\<mapsto> [(Rule m1 Log), (Rule m2 (Call ''foo'')), (Rule m3 Accept), (Rule m' (Call ''baz''))],\n      ''foo'' \\<mapsto> [(Rule m4 Log), (Rule m5 Return), (Rule m6 (Call ''bar''))], \n      ''bar'' \\<mapsto> [],\n      ''baz'' \\<mapsto> []])\"\n  proof -\n    have g: \"calls_chain [''FORWARD'' \\<mapsto> [(Rule m1 Log), (Rule m2 (Call ''foo'')), (Rule m3 Accept), (Rule m' (Call ''baz''))],\n            ''foo'' \\<mapsto> [(Rule m4 Log), (Rule m5 Return), (Rule m6 (Call ''bar''))], \n            ''bar'' \\<mapsto> [],\n            ''baz'' \\<mapsto> []] = {(''FORWARD'', ''foo''), (''FORWARD'', ''baz''), (''foo'', ''bar'')}\"\n    by(auto simp add: calls_chain_def split: option.split_asm if_split_asm)\n    show ?thesis\n      unfolding g\n      apply(simp)\n      apply safe\n       apply(erule rtranclE, simp_all)\n      apply(erule rtranclE, simp_all)\n      done\n  qed    \n      \n  \n  text\\<open>In our proof, we will need the reverse.\\<close>\n  private definition called_by_chain :: \"'a ruleset \\<Rightarrow> (string \\<times> string) set\" where\n    \"called_by_chain \\<Gamma> = {(callee, caller). case \\<Gamma> caller of Some rs \\<Rightarrow> \\<exists>m. Rule m (Call callee) \\<in> set rs | None \\<Rightarrow> False}\"\n  private lemma called_by_chain_converse: \"calls_chain \\<Gamma> = converse (called_by_chain \\<Gamma>)\"\n    apply(simp add: calls_chain_def called_by_chain_def)\n    by blast\n  private lemma wf_called_by_chain: \"finite (calls_chain \\<Gamma>) \\<Longrightarrow> wf (calls_chain \\<Gamma>) \\<Longrightarrow> wf (called_by_chain \\<Gamma>)\"\n    apply(frule Wellfounded.wf_acyclic)\n    apply(drule(1) Wellfounded.finite_acyclic_wf_converse)\n    apply(simp add: called_by_chain_converse)\n    done\n  \n  \n  private lemma helper_cases_call_subchain_defined_or_return:\n        \"(\\<forall>x\\<in>ran \\<Gamma>. wf_chain \\<Gamma> x) \\<Longrightarrow>\n         \\<forall>rsg\\<in>ran \\<Gamma>. \\<forall>r\\<in>set rsg. (\\<forall>chain. get_action r \\<noteq> Goto chain) \\<and> get_action r \\<noteq> Unknown \\<Longrightarrow>\n         \\<forall>y m. \\<forall>r\\<in>set rs_called. r = Rule m (Call y) \\<longrightarrow> (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call y)], Undecided\\<rangle> \\<Rightarrow> t) \\<Longrightarrow>\n         wf_chain \\<Gamma> rs_called \\<Longrightarrow> \n         \\<forall>r\\<in>set rs_called. (\\<forall>chain. get_action r \\<noteq> Goto chain) \\<and> get_action r \\<noteq> Unknown \\<Longrightarrow>\n         (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called, Undecided\\<rangle> \\<Rightarrow> t) \\<or>\n         (\\<exists>rs_called1 rs_called2 m'.\n             rs_called = (rs_called1 @ [Rule m' Return] @ rs_called2) \\<and>\n             matches \\<gamma> m' p \\<and> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided)\"\n  proof(induction rs_called arbitrary:)\n  case Nil hence \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[], Undecided\\<rangle> \\<Rightarrow> t\"\n     apply(rule_tac x=Undecided in exI)\n     by(simp add: skip)\n   thus ?case by simp\n  next\n  case (Cons r rs)\n    from Cons.prems have \"wf_chain \\<Gamma> [r]\" by(simp add: wf_chain_def)\n    from Cons.prems have IH:\"(\\<exists>t'. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Undecided\\<rangle> \\<Rightarrow> t') \\<or>\n      (\\<exists>rs_called1 rs_called2 m'.\n          rs = (rs_called1 @ [Rule m' Return] @ rs_called2) \\<and>\n          matches \\<gamma> m' p \\<and> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided)\"\n      apply -\n      apply(rule Cons.IH)\n          apply(auto dest: wf_chain_fst)\n      done\n  \n    from Cons.prems have case_call: \"r = Rule m (Call y) \\<Longrightarrow> (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call y)], Undecided\\<rangle> \\<Rightarrow> t)\" for y m\n      by(simp)\n  \n    obtain m a where r: \"r = Rule m a\" by(cases r) simp\n  \n    from Cons.prems have a_not: \"(\\<forall>chain. a \\<noteq> Goto chain) \\<and> a \\<noteq> Unknown\" by(simp add: r)\n  \n    have ex_neq_ret: \"a \\<noteq> Return \\<Longrightarrow> \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> t\"\n    proof(cases \"matches \\<gamma> m p\")\n    case False thus ?thesis by(rule_tac x=Undecided in exI)(simp add: nomatch; fail)\n    next\n    case True\n      assume \"a \\<noteq> Return\"\n      show ?thesis\n      proof(cases a)\n      case Accept with True show ?thesis\n        by(rule_tac x=\"Decision FinalAllow\" in exI) (simp add: accept; fail)\n      next\n      case Drop with True show ?thesis\n        by(rule_tac x=\"Decision FinalDeny\" in exI) (simp add: drop; fail)\n      next\n      case Log with True show ?thesis\n        by(rule_tac x=\"Undecided\" in exI)(simp add: log; fail)\n      next\n      case Reject with True show ?thesis\n        by(rule_tac x=\"Decision FinalDeny\" in exI) (simp add: reject; fail)\n      next\n      case Call with True show ?thesis\n        apply(simp)\n        apply(rule case_call)\n        apply(simp add: r; fail)\n        done\n      next\n      case Empty with True show ?thesis by(rule_tac x=\"Undecided\" in exI) (simp add: empty; fail)\n      next\n      case Return with \\<open>a \\<noteq> Return\\<close> show ?thesis by simp\n      qed(simp_all add: a_not)\n    qed\n  \n    have *: \"?case\"\n      if pre: \"rs = rs_called1 @ Rule m' Return # rs_called2 \\<and> matches \\<gamma> m' p \\<and> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided\"\n      for rs_called1 m' rs_called2\n    proof(cases \"matches \\<gamma> m p\")\n    case False thus ?thesis\n      apply -\n      apply(rule disjI2)\n      apply(rule_tac x=\"r#rs_called1\" in exI)\n      apply(rule_tac x=rs_called2 in exI)\n      apply(rule_tac x=m' in exI)\n      apply(simp add: r pre)\n      apply(rule_tac t=Undecided in seq_cons)\n       apply(simp add: r nomatch; fail)\n      apply(simp add: pre; fail)\n      done\n    next\n    case True\n      from pre have rule_case_dijs1: \"\\<exists>X. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Decision X \\<Longrightarrow> ?thesis\"\n        apply -\n        apply(rule disjI1)\n        apply(elim exE conjE, rename_tac X)\n        apply(simp)\n        apply(rule_tac x=\"Decision X\" in exI)\n        apply(rule_tac t=\"Decision X\" in seq_cons)\n         apply(simp add: r; fail)\n        apply(simp add: decision; fail)\n        done\n\n      from pre have rule_case_dijs2: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Undecided \\<Longrightarrow> ?thesis\"\n        apply -\n        apply(rule disjI2)\n        apply(rule_tac x=\"r#rs_called1\" in exI)\n        apply(rule_tac x=rs_called2 in exI)\n        apply(rule_tac x=m' in exI)\n        apply(simp add: r)\n        apply(rule_tac t=Undecided in seq_cons)\n         apply(simp; fail)\n        apply(simp;fail)\n        done\n\n      show ?thesis\n      proof(cases a)\n      case Accept show ?thesis\n        apply(rule rule_case_dijs1)\n        apply(rule_tac x=\"FinalAllow\" in exI)\n        using True pre Accept by(simp add: accept)\n      next\n      case Drop show ?thesis\n        apply(rule rule_case_dijs1)\n        apply(rule_tac x=\"FinalDeny\" in exI)\n        using True Drop by(simp add: deny)\n      next\n      case Log show ?thesis\n        apply(rule rule_case_dijs2)\n        using Log True by(simp add: log)\n      next\n      case Reject show ?thesis\n        apply(rule rule_case_dijs1)\n        apply(rule_tac x=\"FinalDeny\" in exI)\n        using Reject True by(simp add: reject)\n      next\n      case (Call x5)\n        have \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call x5)], Undecided\\<rangle> \\<Rightarrow> t\" by(rule case_call) (simp add: r Call)\n        with Call pre True show ?thesis\n        apply(simp)\n        apply(elim exE, rename_tac t_called)\n        apply(case_tac t_called)\n         apply(simp)\n         apply(rule disjI2)\n         apply(rule_tac x=\"r#rs_called1\" in exI)\n         apply(rule_tac x=rs_called2 in exI)\n         apply(rule_tac x=m' in exI)\n         apply(simp add: r)\n         apply(rule_tac t=Undecided in seq_cons)\n          apply(simp add: r; fail)\n         apply(simp; fail)\n        apply(rule disjI1)\n        apply(rule_tac x=t_called in exI)\n        apply(rule_tac t=t_called in seq_cons)\n         apply(simp add: r; fail)\n        apply(simp add: decision; fail)\n        done\n      next\n      case Empty show ?thesis\n        apply(rule rule_case_dijs2)\n        using Empty True by(simp add: pre empty)\n      next\n      case Return show ?thesis\n       apply(rule disjI2)\n       apply(rule_tac x=\"[]\" in exI)\n       apply(rule_tac x=\"rs_called1 @ Rule m' Return # rs_called2\" in exI)\n       apply(rule_tac x=m in exI)\n       using Return True pre by(simp add: skip r)\n      qed(simp_all add: a_not)\n    qed\n     \n    from IH have **: \"a \\<noteq> Return \\<longrightarrow> (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> t) \\<Longrightarrow> ?case\"\n    proof(elim disjE, goal_cases)\n    case 2\n      from this obtain rs_called1 m' rs_called2 where \n        a1: \"rs = rs_called1 @ [Rule m' Return] @ rs_called2\" and\n        a2: \"matches \\<gamma> m' p\" and a3: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided\" by blast\n      show ?case\n        apply(rule *)\n        using a1 a2 a3 by simp\n    next\n    case 1 thus ?case \n      proof(cases \"a \\<noteq> Return\")\n      case True\n        with 1 obtain t1 t2 where t1: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> t1\"\n                              and t2: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Undecided\\<rangle> \\<Rightarrow> t2\" by blast\n        from t1 t2 show ?thesis\n        apply -\n        apply(rule disjI1)\n        apply(simp add: r)\n        apply(cases t1)\n         apply(simp_all)\n         apply(rule_tac x=t2 in exI)\n         apply(rule_tac seq'_cons)\n          apply(simp_all)\n        apply (meson decision seq_cons)\n        done\n      next\n      case False show ?thesis\n        proof(cases \"matches \\<gamma> m p\")\n          assume \"\\<not> matches \\<gamma> m p\" with 1 show ?thesis\n            apply -\n            apply(rule disjI1)\n            apply(elim exE)\n            apply(rename_tac t')\n            apply(rule_tac x=t' in exI)\n            apply(rule_tac t=Undecided in seq_cons)\n             apply(simp add: r nomatch; fail)\n            by(simp)\n        next\n          assume \"matches \\<gamma> m p\" with False show ?thesis\n            apply -\n            apply(rule disjI2)\n            apply(rule_tac x=\"[]\" in exI)\n            apply(rule_tac x=rs in exI)\n            apply(rule_tac x=m in exI)\n            apply(simp add: r skip; fail)\n            done\n        qed\n      qed\n    qed\n    thus ?case using ex_neq_ret by blast\n  qed\n  \n  \n  lemma helper_defined_single: \n    assumes \"wf (called_by_chain \\<Gamma>)\" \n    and \"\\<forall>rsg \\<in> ran \\<Gamma> \\<union> {[Rule m a]}. wf_chain \\<Gamma> rsg\"\n    and \"\\<forall>rsg \\<in> ran \\<Gamma> \\<union> {[Rule m a]}. \\<forall> r \\<in> set rsg. (\\<not>(\\<exists>chain. get_action r = Goto chain)) \\<and> get_action r \\<noteq> Unknown\"\n    and \"a \\<noteq> Return\" (*no toplevel Return*)\n    shows \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], s\\<rangle> \\<Rightarrow> t\"\n  proof(cases s)\n  case (Decision decision) thus ?thesis\n    apply(rule_tac x=\"Decision decision\" in exI)\n    apply(simp)\n    using iptables_bigstep.decision by fast\n  next\n  case Undecided\n    have \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> t\"\n    proof(cases \"matches \\<gamma> m p\")\n    case False with assms show ?thesis\n      apply(rule_tac x=Undecided in exI)\n      apply(rule_tac t=Undecided in seq'_cons)\n       apply (metis empty_iff empty_set insert_iff list.simps(15) nomatch' rule.sel(1)) \n      apply(simp add: skip; fail)\n      done\n    next\n    case True\n    show ?thesis\n      proof(cases a)\n      case Unknown with assms(3) show ?thesis by simp\n      next\n      case Goto with assms(3) show ?thesis by auto\n      next\n      case Accept with True show ?thesis by(auto intro: iptables_bigstep.intros)\n      next\n      case Drop with True show ?thesis by(auto intro: iptables_bigstep.intros)\n      next\n      case Reject with True show ?thesis by(auto intro: iptables_bigstep.intros)\n      next\n      case Log with True show ?thesis by(auto intro: iptables_bigstep.intros)\n      next\n      case Empty with True show ?thesis by(auto intro: iptables_bigstep.intros)\n      next\n      case Return with assms show ?thesis by simp\n      next\n      case (Call chain_name)\n        thm wf_induct_rule[where r=\"(calls_chain \\<Gamma>)\" and P=\"\\<lambda>x. \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call x)], Undecided\\<rangle> \\<Rightarrow> t\"]\n        \\<comment> \\<open>Only the assumptions we will need\\<close>\n        from assms have \"wf (called_by_chain \\<Gamma>)\"\n            \"\\<forall>rsg\\<in>ran \\<Gamma>. wf_chain \\<Gamma> rsg\"\n            \"\\<forall>rsg\\<in>ran \\<Gamma>. \\<forall>r\\<in>set rsg. (\\<forall>chain. get_action r \\<noteq> Goto chain) \\<and> get_action r \\<noteq> Unknown\" by auto\n        \\<comment> \\<open>strengthening the IH to do a well-founded induction\\<close>\n        hence \"matches \\<gamma> m p \\<Longrightarrow> wf_chain \\<Gamma> [Rule m (Call chain_name)] \\<Longrightarrow> (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call chain_name)], Undecided\\<rangle> \\<Rightarrow> t)\"\n        proof(induction arbitrary: m rule: wf_induct_rule[where r=\"called_by_chain \\<Gamma>\"])\n        case (less chain_name_neu)\n          from less.prems have \"\\<Gamma> chain_name_neu \\<noteq> None\" by(simp add: wf_chain_def)\n          from this obtain rs_called where rs_called: \"\\<Gamma> chain_name_neu = Some rs_called\" by blast\n  \n          from less rs_called have \"wf_chain \\<Gamma> rs_called\" by (simp add: ranI)\n          from less rs_called have \"rs_called \\<in> ran \\<Gamma>\" by (simp add: ranI)\n  \n          (*get good IH*)\n          from less.prems rs_called have\n            \"\\<forall>y m. \\<forall>r \\<in> set rs_called. r = Rule m (Call y) \\<longrightarrow> (y, chain_name_neu) \\<in> called_by_chain \\<Gamma> \\<and> wf_chain \\<Gamma> [Rule m (Call y)]\"\n             apply(simp)\n             apply(intro impI allI conjI)\n              apply(simp add: called_by_chain_def)\n              apply blast\n             apply(simp add: wf_chain_def)\n             apply (meson ranI rule.sel(2))\n             done\n          with less have \"\\<forall>y m. \\<forall>r\\<in>set rs_called. r = Rule m (Call y) \\<longrightarrow> (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call y)], Undecided\\<rangle> \\<Rightarrow> t)\"\n             apply(intro allI, rename_tac y my)\n             apply(case_tac \"matches \\<gamma> my p\")\n              apply blast\n             apply(intro ballI impI)\n             apply(rule_tac x=Undecided in exI)\n             apply(simp add: nomatch; fail)\n             done\n          from less.prems(4) rs_called \\<open>rs_called \\<in> ran \\<Gamma>\\<close>\n            helper_cases_call_subchain_defined_or_return[OF less.prems(3) less.prems(4) this \\<open>wf_chain \\<Gamma> rs_called\\<close>] have\n            \"(\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called, Undecided\\<rangle> \\<Rightarrow> t) \\<or>\n             (\\<exists>rs_called1 rs_called2 m'.\n                  \\<Gamma> chain_name_neu = Some (rs_called1@[Rule m' Return]@rs_called2) \\<and>\n                  matches \\<gamma> m' p \\<and> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided)\" by simp\n          thus ?case\n          proof(elim disjE exE conjE)\n            fix t\n            assume a: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called, Undecided\\<rangle> \\<Rightarrow> t\" show ?case\n            using call_result[OF less.prems(1) rs_called a] by(blast)\n          next\n            fix m' rs_called1 rs_called2\n            assume a1: \"\\<Gamma> chain_name_neu = Some (rs_called1 @ [Rule m' Return] @ rs_called2)\"\n            and a2: \"matches \\<gamma> m' p\" and a3: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided\"\n            show ?case using call_return[OF less.prems(1) a1 a2 a3 ] by(blast)\n          qed\n        qed\n        with True assms Call show ?thesis by simp\n      qed\n    qed\n  with Undecided show ?thesis by simp\n  qed\n  \n  \n  private lemma helper_defined_ruleset_calledby: \"wf (called_by_chain \\<Gamma>) \\<Longrightarrow> \n    \\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. wf_chain \\<Gamma> rsg \\<Longrightarrow>\n    \\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. \\<forall> r \\<in> set rsg. (\\<not>(\\<exists>chain. get_action r = Goto chain)) \\<and> get_action r \\<noteq> Unknown \\<Longrightarrow>\n    \\<forall> r \\<in> set rs. get_action r \\<noteq> Return \\<Longrightarrow>\n    \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\n  apply(rule iptables_bigstep_defined_if_singleton_rules)\n  apply(intro ballI, rename_tac r, case_tac r, rename_tac m a, simp)\n  apply(rule helper_defined_single)\n     apply(simp; fail)\n    apply(simp add: wf_chain_def; fail)\n   apply fastforce\n  apply fastforce\n  done\n  \n  corollary semantics_bigstep_defined: \"finite (calls_chain \\<Gamma>) \\<Longrightarrow> wf (calls_chain \\<Gamma>) \\<Longrightarrow> \\<comment> \\<open>call relation finite and terminating\\<close>\n    \\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. wf_chain \\<Gamma> rsg \\<Longrightarrow> \\<comment> \\<open>All calls to defined chains\\<close>\n    \\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. \\<forall> r \\<in> set rsg. (\\<forall>x. get_action r \\<noteq> Goto x) \\<and> get_action r \\<noteq> Unknown \\<Longrightarrow> \\<comment> \\<open>no bad actions\\<close>\n    \\<forall> r \\<in> set rs. get_action r \\<noteq> Return \\<comment> \\<open>no toplevel return\\<close> \\<Longrightarrow>\n    \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\n  apply(drule(1) wf_called_by_chain)\n  apply(thin_tac \"wf (calls_chain \\<Gamma>)\")\n  apply(rule helper_defined_ruleset_calledby)\n     apply(simp_all)\n  done\nend\n\n\n\n\n\n\n\n\n\ntext\\<open>Common Algorithms\\<close>\n\nlemma iptables_bigstep_rm_LogEmpty: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rm_LogEmpty rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\nproof(induction rs arbitrary: s)\ncase Nil thus ?case by(simp)\nnext\ncase (Cons r rs)\n  have step_IH: \"(\\<And>s. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs1, s\\<rangle> \\<Rightarrow> t = \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs2, s\\<rangle> \\<Rightarrow> t) \\<Longrightarrow>\n         \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs1, s\\<rangle> \\<Rightarrow> t = \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs2, s\\<rangle> \\<Rightarrow> t\" for rs1 rs2 r\n  by (meson seq'_cons seqE_cons)\n  have case_log: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m Log # rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\" for m\n    apply(rule iffI)\n     apply(erule seqE_cons)\n     apply (metis append_Nil log_remove seq')\n    apply(rule_tac t=s in seq'_cons)\n     apply(cases s)\n      apply(cases \"matches \\<gamma> m p\")\n       apply(simp add: log; fail)\n      apply(simp add: nomatch; fail)\n     apply(simp add: decision; fail)\n    apply simp\n   done\n  have case_empty: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m Empty # rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\" for m\n    apply(rule iffI)\n     apply(erule seqE_cons)\n     apply (metis append_Nil empty_empty seq')\n    apply(rule_tac t=s in seq'_cons)\n     apply(cases s)\n      apply(cases \"matches \\<gamma> m p\")\n       apply(simp add: empty; fail)\n      apply(simp add: nomatch; fail)\n     apply(simp add: decision; fail)\n    apply simp\n   done\n\n  from Cons show ?case  \n  apply(cases r, rename_tac m a)\n  apply(case_tac a)\n          apply(simp_all)\n          apply(simp_all cong: step_IH)\n   apply(simp_all add: case_log case_empty)\n  done\nqed\n\nlemma iptables_bigstep_rw_Reject: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rw_Reject rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\nproof(induction rs arbitrary: s)\ncase Nil thus ?case by(simp)\nnext\ncase (Cons r rs)\n  have step_IH: \"(\\<And>s. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs1, s\\<rangle> \\<Rightarrow> t = \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs2, s\\<rangle> \\<Rightarrow> t) \\<Longrightarrow>\n         \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs1, s\\<rangle> \\<Rightarrow> t = \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs2, s\\<rangle> \\<Rightarrow> t\" for rs1 rs2 r\n  by (meson seq'_cons seqE_cons)\n  have fst_rule: \"(\\<And>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r1], s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r2], s\\<rangle> \\<Rightarrow> t) \\<Longrightarrow> \n    \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r1 # rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r2 # rs, s\\<rangle> \\<Rightarrow> t\" for r1 r2 rs s t\n  by (meson seq'_cons seqE_cons)\n  have dropreject: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Drop], s\\<rangle> \\<Rightarrow> t = \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Reject], s\\<rangle> \\<Rightarrow> t\" for m t\n    apply(cases s)\n     apply(cases \"matches \\<gamma> m p\")\n      using drop reject dropD rejectD apply fast\n     using nomatch nomatchD apply fast\n    using decision decisionD apply fast\n    done\n\n  from Cons show ?case\n  apply(cases r, rename_tac m a)\n  apply simp\n  apply(case_tac a)\n          apply(simp_all)\n          apply(simp_all cong: step_IH)\n   apply(rule fst_rule)\n   apply(simp add: dropreject)\n  done\nqed\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Iptables_Semantics/Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7461389930307512, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.34398259548637145}}
{"text": "(*  Title:      HOL/MicroJava/BV/JVM.thy\n\n    Author:     Tobias Nipkow, Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nsection \\<open>Kildall for the JVM \\label{sec:JVM}\\<close>\n\ntheory BVExec\nimports \"../DFA/Abstract_BV\" TF_JVM\nbegin\n\ndefinition kiljvm :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> \n             instr list \\<Rightarrow> ex_table \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> ty\\<^sub>i' err list\"\nwhere\n  \"kiljvm P mxs mxl T\\<^sub>r is xt \\<equiv>\n  kildall (JVM_SemiType.le P mxs mxl) (JVM_SemiType.sup P mxs mxl) \n          (exec P mxs T\\<^sub>r xt is)\"\n\ndefinition wt_kildall :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n                 instr list \\<Rightarrow> ex_table \\<Rightarrow> bool\"\nwhere\n  \"wt_kildall P C' Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<equiv>\n   0 < size is \\<and> \n   (let first  = Some ([],[OK (Class C')]@(map OK Ts)@(replicate mxl\\<^sub>0 Err));\n        start  = OK first#(replicate (size is - 1) (OK None));\n        result = kiljvm P mxs (1+size Ts+mxl\\<^sub>0) T\\<^sub>r is xt  start\n    in \\<forall>n < size is. result!n \\<noteq> Err)\"\n\ndefinition wf_jvm_prog\\<^sub>k :: \"jvm_prog \\<Rightarrow> bool\"\nwhere\n  \"wf_jvm_prog\\<^sub>k P \\<equiv>\n  wf_prog (\\<lambda>P C' (M,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). wt_kildall P C' Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt) P\"\n\n\ntheorem (in start_context) is_bcv_kiljvm:\n  \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n(*<*)\n  apply (insert wf)\n  apply (unfold kiljvm_def)\n  apply (fold r_def f_def step_def_exec)\n  apply (rule is_bcv_kildall)\n       apply simp apply (rule Semilat.intro)\n       apply (fold sl_def2)\n       apply (erule semilat_JVM)\n      apply simp\n      apply blast\n     apply (simp add: JVM_le_unfold)\n    apply (rule exec_pres_type)\n   apply (rule bounded_step)\n  apply (erule step_mono)\n  done\n(*>*)\n\n(* FIXME: move? *)\nlemma subset_replicate [intro?]: \"set (replicate n x) \\<subseteq> {x}\"\n  by (induct n) auto\n\nlemma in_set_replicate:\n  assumes \"x \\<in> set (replicate n y)\"\n  shows \"x = y\"\n(*<*)\nproof -\n  note assms\n  also have \"set (replicate n y) \\<subseteq> {y}\" ..\n  finally show ?thesis by simp\nqed\n(*>*)\n\nlemma (in start_context) start_in_A [intro?]:\n  \"0 < size is \\<Longrightarrow> start \\<in> list (size is) A\"\n  using Ts C\n(*<*)\n  apply (simp add: JVM_states_unfold) \n  apply (force intro!: listI list_appendI dest!: in_set_replicate)\n  done   \n(*>*)\n\n\ntheorem (in start_context) wt_kil_correct:\n  assumes wtk: \"wt_kildall P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n  shows \"\\<exists>\\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n(*<*)\nproof -\n  from wtk obtain res where    \n    result:   \"res = kiljvm P mxs mxl T\\<^sub>r is xt start\" and\n    success:  \"\\<forall>n < size is. res!n \\<noteq> Err\" and\n    instrs:   \"0 < size is\" \n    by (unfold wt_kildall_def) simp\n      \n  have bcv: \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n    by (rule is_bcv_kiljvm)\n    \n  from instrs have \"start \\<in> list (size is) A\" ..\n  with bcv success result have \n    \"\\<exists>ts\\<in>list (size is) A. start [\\<sqsubseteq>\\<^sub>r] ts \\<and> wt_step r Err step ts\"\n    by (unfold is_bcv_def) blast\n  then obtain \\<tau>s' where\n    in_A: \"\\<tau>s' \\<in> list (size is) A\" and\n    s:    \"start [\\<sqsubseteq>\\<^sub>r] \\<tau>s'\" and\n    w:    \"wt_step r Err step \\<tau>s'\"\n    by blast\n  hence wt_err_step: \"wt_err_step (sup_state_opt P) step \\<tau>s'\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n\n  from in_A have l: \"size \\<tau>s' = size is\" by simp  \n  moreover {\n    from in_A  have \"check_types P mxs mxl \\<tau>s'\" by (simp add: check_types_def)\n    also from w have \"\\<forall>x \\<in> set \\<tau>s'. x \\<noteq> Err\" \n      by (auto simp add: wt_step_def all_set_conv_all_nth)\n    hence [symmetric]: \"map OK (map ok_val \\<tau>s') = \\<tau>s'\" \n      by (auto intro!: map_idI simp add: wt_step_def)\n    finally  have \"check_types P mxs mxl (map OK (map ok_val \\<tau>s'))\" .\n  } \n  moreover {  \n    from s have \"start!0 \\<sqsubseteq>\\<^sub>r \\<tau>s'!0\" by (rule le_listD) simp\n    moreover\n    from instrs w l \n    have \"\\<tau>s'!0 \\<noteq> Err\" by (unfold wt_step_def) simp\n    then obtain \\<tau>s0 where \"\\<tau>s'!0 = OK \\<tau>s0\" by auto\n    ultimately\n    have \"wt_start P C Ts mxl\\<^sub>0 (map ok_val \\<tau>s')\" using l instrs\n      by (unfold wt_start_def) \n         (simp add: lesub_def JVM_le_Err_conv Err.le_def)\n  }\n  moreover \n  from in_A have \"set \\<tau>s' \\<subseteq> A\" by simp  \n  with wt_err_step bounded_step\n  have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\<tau>s')\"\n    by (auto intro: wt_err_imp_wt_app_eff simp add: l)\n  ultimately\n  have \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\<tau>s')\"\n    using instrs by (simp add: wt_method_def2 check_types_def del: map_map)\n  thus ?thesis by blast\nqed\n(*>*)\n\n\ntheorem (in start_context) wt_kil_complete:\n  assumes wtm: \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n  shows \"wt_kildall P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n(*<*)\nproof -\n  from wtm obtain\n    instrs:   \"0 < size is\" and\n    length:   \"length \\<tau>s = length is\" and \n    ck_type:  \"check_types P mxs mxl (map OK \\<tau>s)\" and\n    wt_start: \"wt_start P C Ts mxl\\<^sub>0 \\<tau>s\" and\n    app_eff:  \"wt_app_eff (sup_state_opt P) app eff \\<tau>s\"\n    by (simp add: wt_method_def2 check_types_def)\n\n  from ck_type\n  have in_A: \"set (map OK \\<tau>s) \\<subseteq> A\" \n    by (simp add: check_types_def)  \n  with app_eff in_A bounded_step\n  have \"wt_err_step (sup_state_opt P) (err_step (size \\<tau>s) app eff) (map OK \\<tau>s)\"\n    by - (erule wt_app_eff_imp_wt_err,\n          auto simp add: exec_def length states_def)\n  hence wt_err: \"wt_err_step (sup_state_opt P) step (map OK \\<tau>s)\" \n    by (simp add: length)\n  have is_bcv: \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n    by (rule is_bcv_kiljvm)\n  moreover from instrs have \"start \\<in> list (size is) A\" ..\n  moreover\n  let ?\\<tau>s = \"map OK \\<tau>s\"  \n  have less_\\<tau>s: \"start [\\<sqsubseteq>\\<^sub>r] ?\\<tau>s\"\n  proof (rule le_listI)\n    from length instrs\n    show \"length start = length (map OK \\<tau>s)\" by simp\n  next\n    fix n\n    from wt_start have \"P \\<turnstile> ok_val (start!0) \\<le>' \\<tau>s!0\" \n      by (simp add: wt_start_def)\n    moreover from instrs length have \"0 < length \\<tau>s\" by simp\n    ultimately have \"start!0 \\<sqsubseteq>\\<^sub>r ?\\<tau>s!0\" \n      by (simp add: JVM_le_Err_conv lesub_def)\n    moreover {\n      fix n'\n      have \"OK None \\<sqsubseteq>\\<^sub>r ?\\<tau>s!n\"\n        by (auto simp add: JVM_le_Err_conv Err.le_def lesub_def \n                 split: err.splits)\n      hence \"\\<lbrakk>n = Suc n'; n < size start\\<rbrakk> \\<Longrightarrow> start!n \\<sqsubseteq>\\<^sub>r ?\\<tau>s!n\" by simp\n    }\n    ultimately\n    show \"n < size start \\<Longrightarrow> start!n \\<sqsubseteq>\\<^sub>r ?\\<tau>s!n\" by (cases n, blast+)   \n  qed\n  moreover\n  from ck_type length\n  have \"?\\<tau>s \\<in> list (size is) A\"\n    by (auto intro!: listI simp add: check_types_def)\n  moreover\n  from wt_err have \"wt_step r Err step ?\\<tau>s\" \n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  ultimately\n  have \"\\<forall>p. p < size is \\<longrightarrow> kiljvm P  mxs mxl T\\<^sub>r is xt start ! p \\<noteq> Err\" \n    by (unfold is_bcv_def) blast\n  with instrs \n  show \"wt_kildall P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\" by (unfold wt_kildall_def) simp\nqed\n(*>*)\n\n\ntheorem jvm_kildall_correct:\n  \"wf_jvm_prog\\<^sub>k P = wf_jvm_prog P\"\n(*<*)\nproof \n  let ?\\<Phi> = \"\\<lambda>C M. let (C,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)) = method P C M in \n              SOME \\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n\n  \\<comment> \\<open>soundness\\<close>\n  assume wt: \"wf_jvm_prog\\<^sub>k P\"\n  hence \"wf_jvm_prog\\<^bsub>?\\<Phi>\\<^esub> P\"\n    apply (unfold wf_jvm_prog_phi_def wf_jvm_prog\\<^sub>k_def)    \n    apply (erule wf_prog_lift)\n    apply (auto dest!: start_context.wt_kil_correct [OF start_context.intro] \n                intro: someI)\n    apply (erule sees_method_is_class)\n    done\n  thus \"wf_jvm_prog P\" by (unfold wf_jvm_prog_def) fast\nnext\n  \\<comment> \\<open>completeness\\<close>\n  assume wt: \"wf_jvm_prog P\"\n  thus \"wf_jvm_prog\\<^sub>k P\"\n    apply (unfold wf_jvm_prog_def wf_jvm_prog_phi_def wf_jvm_prog\\<^sub>k_def)\n    apply (clarify)\n    apply (erule wf_prog_lift)\n    apply (auto intro!: start_context.wt_kil_complete start_context.intro)\n    apply (erule sees_method_is_class)\n    done\nqed\n(*>*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/BV/BVExec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7217431943271999, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.3439681197100398}}
{"text": "theory flash59Bra  imports flash59Rev\n \n  begin\nlemma onInv59:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv59  iInv1  iInv2  iInv3 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX1VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_GetXVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ShWbVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX7VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak2VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX5VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_WbVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_GetVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceShrVldVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_2VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak2VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_ReplaceVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_HomeVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put2VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX11VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX6VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put2VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1_HomeVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak1VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak1VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak2VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak3VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX2VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put1VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutXVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis StoreVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_FAckVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX3VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutXVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put1VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis StoreHomeVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_NakVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_PutXVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX4VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_NakVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak1VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_ClearVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_PutXVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak3VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX9VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetXVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv59  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put3VsInv59 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash59Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6825737473266735, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3439531231190682}}
{"text": "theory OpInl\n  imports Op\nbegin\n\nsection \\<open>n-ary operations\\<close>\n\nlocale nary_operations_inl =\n  nary_operations \\<OO>\\<pp> \\<AA>\\<rr>\\<ii>\\<tt>\\<yy>\n  for\n    \\<OO>\\<pp> :: \"'op \\<Rightarrow> 'a list \\<Rightarrow> 'a\" and \\<AA>\\<rr>\\<ii>\\<tt>\\<yy> +\n  fixes\n    \\<II>\\<nn>\\<ll>\\<OO>\\<pp> :: \"'opinl \\<Rightarrow> 'a list \\<Rightarrow> 'a\" and\n    \\<II>\\<nn>\\<ll> :: \"'op \\<Rightarrow> 'a list \\<Rightarrow> 'opinl option\" and\n    \\<II>\\<ss>\\<II>\\<nn>\\<ll> :: \"'opinl \\<Rightarrow> 'a list \\<Rightarrow> bool\" and\n    \\<DD>\\<ee>\\<II>\\<nn>\\<ll> :: \"'opinl \\<Rightarrow> 'op\"\n  assumes\n    \\<II>\\<nn>\\<ll>_invertible: \"\\<II>\\<nn>\\<ll> op xs = Some opinl \\<Longrightarrow> \\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl = op\" and\n    \\<II>\\<nn>\\<ll>\\<OO>\\<pp>_correct: \"length xs = \\<AA>\\<rr>\\<ii>\\<tt>\\<yy> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl) \\<Longrightarrow> \\<II>\\<nn>\\<ll>\\<OO>\\<pp> opinl xs = \\<OO>\\<pp> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl) xs\" and\n    \\<II>\\<nn>\\<ll>_\\<II>\\<ss>\\<II>\\<nn>\\<ll>: \"\\<II>\\<nn>\\<ll> op xs = Some opinl \\<Longrightarrow> \\<II>\\<ss>\\<II>\\<nn>\\<ll> opinl xs\"\n\nbegin\n\nlemma \\<II>\\<nn>\\<ll>_inj_on: \"inj_on \\<II>\\<nn>\\<ll> { op | op args. \\<II>\\<nn>\\<ll> op args \\<noteq> None }\"\n  apply (simp add: inj_on_def)\nproof (intro allI impI, elim exE)\n  fix op\\<^sub>1 op\\<^sub>2 args\\<^sub>1 args\\<^sub>2 opinl\\<^sub>1 opinl\\<^sub>2\n  assume assms: \"\\<II>\\<nn>\\<ll> op\\<^sub>1 = \\<II>\\<nn>\\<ll> op\\<^sub>2\" \"\\<II>\\<nn>\\<ll> op\\<^sub>1 args\\<^sub>1 = Some opinl\\<^sub>1\" \"\\<II>\\<nn>\\<ll> op\\<^sub>2 args\\<^sub>2 = Some opinl\\<^sub>2\"\n  hence \"\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl\\<^sub>1 = op\\<^sub>1\" \"\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl\\<^sub>1 = op\\<^sub>2\"\n    by (auto intro: \\<II>\\<nn>\\<ll>_invertible)\n  thus \"op\\<^sub>1 = op\\<^sub>2\"\n    by simp\nqed\n\nabbreviation \\<II>\\<nn>\\<ll>_dom where\n  \"\\<II>\\<nn>\\<ll>_dom \\<equiv> {op | op args. \\<II>\\<nn>\\<ll> op args \\<noteq> None }\"\n\nlemma \"bij_betw \\<II>\\<nn>\\<ll> \\<II>\\<nn>\\<ll>_dom { \\<II>\\<nn>\\<ll> op | op. op \\<in> \\<II>\\<nn>\\<ll>_dom}\"\n  using bij_betw_def\n  unfolding image_def\n  using \\<II>\\<nn>\\<ll>_inj_on\n  by (auto simp add: bij_betw_def)\n\nend\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Interpreter_Optimizations/OpInl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6825737344123242, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3439531166114479}}
{"text": "section {*I\\_cfgRM*}\ntheory\n  I_cfgRM\n\nimports\n  I_cfg_base\n\nbegin\n\ndefinition cfgRM_step_relation :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('nonterminal, 'event) cfg_configuration\n  \\<Rightarrow> ('nonterminal, 'event) cfg_step_label\n  \\<Rightarrow> ('nonterminal, 'event) cfg_configuration\n  \\<Rightarrow> bool\"\n  where\n    \"cfgRM_step_relation M c1 p c2 \\<equiv>\n  p \\<in> cfg_productions M\n  \\<and> (\\<exists>l r.\n\t cfg_conf c1 = l @ teA (prod_lhs p) # r\n\t \\<and> cfg_conf c2 = l @ prod_rhs p @ r\n\t \\<and> setA r = {})\"\n\nlemma cfgRM_inst_AX_step_relation_preserves_belongs: \"\n  (\\<forall>M. valid_cfg M \\<longrightarrow> (\\<forall>c1 e c2. cfgRM_step_relation M c1 e c2 \\<longrightarrow> c1 \\<in> cfg_configurations M \\<longrightarrow> e \\<in> cfg_step_labels M \\<and> c2 \\<in> cfg_configurations M))\"\n  apply(rule allI)\n  apply(rename_tac M)(*strict*)\n  apply(rule impI)+\n  apply(rule allI)+\n  apply(rename_tac M c1 e c2)(*strict*)\n  apply(rule impI)+\n  apply(simp add: cfg_configurations_def cfgRM_step_relation_def cfg_step_labels_def)\n  apply(case_tac c2)\n  apply(rename_tac M c1 e c2 cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M e l r)(*strict*)\n  apply(simp only: setAConcat concat_asso setBConcat)\n  apply(clarsimp)\n  apply(simp add: valid_cfg_def)\n  done\n\nlemma cfgRM_step_relation_both_sides_context: \"\n  setA right = {}\n  \\<Longrightarrow> \\<forall>a e b. cfgRM_step_relation G a e b \\<longrightarrow> cfgRM_step_relation G \\<lparr>cfg_conf = left @ cfg_conf a @ right\\<rparr> e \\<lparr>cfg_conf = left @ cfg_conf b @ right\\<rparr>\"\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac a e b l r)(*strict*)\n  apply(rule_tac\n      x=\"left@l\"\n      in exI)\n  apply(rule_tac\n      x=\"r@right\"\n      in exI)\n  apply(clarsimp)\n  apply(simp (no_asm) only: setAConcat concat_asso)\n  apply(force)\n  done\n\nlemma CFGRM_alt_case: \"\n  cfgRM_step_relation G \\<lparr>cfg_conf = w1 @ w2\\<rparr> e \\<lparr>cfg_conf = c\\<rparr>\n  \\<Longrightarrow> \\<not> (\\<exists>c'. cfgRM_step_relation G \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> c' @ w2 = c)\n  \\<Longrightarrow> \\<exists>c'. cfgRM_step_relation G \\<lparr>cfg_conf = w2\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> w1 @ c' = c\"\n  apply(clarsimp)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac l r)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac l r prod_lhsa prod_rhsa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac l r prod_lhs prod_rhs)(*strict*)\n  apply(rename_tac A w)\n  apply(rename_tac l r A w)(*strict*)\n  apply(thin_tac \"\\<lparr>prod_lhs = A, prod_rhs = w\\<rparr> \\<in> cfg_productions G\")\n  apply(subgoal_tac \"prefix w1 l \\<or> prefix l w1\")\n   apply(rename_tac l r A w)(*strict*)\n   prefer 2\n   apply(rule mutual_prefix_prefix)\n   apply(blast)\n  apply(rename_tac l r A w)(*strict*)\n  apply(simp add: prefix_def)\n  apply(auto)\n   apply(rename_tac r A w c)(*strict*)\n   apply(rule_tac\n      x = \"c\"\n      in exI)\n   apply(rule_tac\n      x = \"r\"\n      in exI)\n   apply(force)\n  apply(rename_tac l r A w c)(*strict*)\n  apply(case_tac c)\n   apply(rename_tac l r A w c)(*strict*)\n   apply(force)\n  apply(rename_tac l r A w c a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac l A w list)(*strict*)\n  apply(subgoal_tac \"False\")\n   apply(rename_tac l A w list)(*strict*)\n   apply(force)\n  apply(rename_tac l A w list)(*strict*)\n  apply(erule_tac\n      x=\"l @ w @ list\"\n      in allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x = \"l\"\n      in allE)\n  apply(erule_tac\n      x = \"list\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac list)(*strict*)\n  apply(simp only: setAConcat concat_asso)\n  apply(force)\n  done\n\nlemma CFGRM_no_step_without_nonterms: \"\n  setA (cfg_conf ca) = {}\n  \\<Longrightarrow> \\<forall>e c'. \\<not> cfgRM_step_relation G' ca e c'\"\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac e c' l r)(*strict*)\n  apply(simp only: setAConcat concat_asso)\n  apply(force)\n  done\n\nlemma cfgRM_step_relation_contextOK1: \"\n  valid_cfg G\n  \\<Longrightarrow> \\<forall>a e b. cfgRM_step_relation G a e b \\<longrightarrow> cfgRM_step_relation G \\<lparr>cfg_conf = w1 @ cfg_conf a\\<rparr> e \\<lparr>cfg_conf = w1 @ cfg_conf b\\<rparr>\"\n  apply(simp add: cfgRM_step_relation_def)\n  apply(auto)\n  apply(rename_tac a e b l r)(*strict*)\n  apply(rule_tac\n      x=\"w1@l\"\n      in exI)\n  apply(rule_tac\n      x=\"r\"\n      in exI)\n  apply(auto)\n  done\n\ninterpretation \"cfgRM\" : loc_cfg_0\n  (* TSstructure *)\n  \"valid_cfg\"\n  (* configurations *)\n  \"cfg_configurations\"\n  (* initial_configurations *)\n  \"cfg_initial_configurations\"\n  (* step_labels *)\n  \"cfg_step_labels\"\n  (* step_relation *)\n  \"cfgRM_step_relation\"\n  (* effects *)\n  \"cfg_effects\"\n  (* marking_condition *)\n  \"cfg_marking_condition\"\n  (* marked_effect *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect *)\n  \"cfg_unmarked_effect\"\n  (* destinations *)\n  \"cfg_destination\"\n  (* get_destinations *)\n  \"cfg_get_destinations\"\n  apply(simp add: LOCALE_DEFS_ALL LOCALE_DEFS_cfg)\n  apply(simp add: cfgBASE_inst_AX_initial_configuration_belongs cfgRM_inst_AX_step_relation_preserves_belongs )\n  done\n\nlemma CFGRM_derivation_initial_pos0: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation_initial G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G)]\\<rparr>)\"\n  apply(simp add: cfgRM.derivation_initial_def)\n  apply(case_tac \"d 0\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b)(*strict*)\n  apply(simp add: cfg_initial_configurations_def)\n  done\n\nlemma CFGRM_derivationCanBeDecomposed2: \"\n  cfgRM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1@w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w'\\<rparr>}\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> \\<exists>d1 d2 w1' w2' n1 n2. cfgRM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgRM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1'@w2'=w' \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=n\"\n  apply(subgoal_tac \" \\<forall>n. \\<forall>d w1 w2 w'. cfgRM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w'\\<rparr>} \\<and> maximum_of_domain d n \\<longrightarrow> (\\<exists>d1 d2 w1' w2' n1 n2. cfgRM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgRM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1' @ w2' = w' \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=n)\")\n   apply(blast)\n  apply(thin_tac \"cfgRM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w'\\<rparr>}\")\n  apply(thin_tac \"maximum_of_domain d n\")\n  apply(rule allI)\n  apply(rename_tac n)(*strict*)\n  apply(induct_tac n)\n   apply(rename_tac n)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2 w')(*strict*)\n   apply(case_tac \"w1@w2\\<noteq>w'\")\n    apply(rename_tac d w1 w2 w')(*strict*)\n    apply(subgoal_tac \"0\\<noteq>(0::nat)\")\n     apply(rename_tac d w1 w2 w')(*strict*)\n     apply(force)\n    apply(rename_tac d w1 w2 w')(*strict*)\n    apply(rule cfgRM.modifying_derivation_is_not_empty)\n      apply(rename_tac d w1 w2 w')(*strict*)\n      apply(blast)\n     apply(rename_tac d w1 w2 w')(*strict*)\n     apply(force)\n    apply(rename_tac d w1 w2 w')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d w1 w2 w')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2)(*strict*)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = w1\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = w2\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x=\"w1\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2)(*strict*)\n    apply(simp add: cfgRM.derivation_from_to_def cfgRM.derivation_from_def cfgRM.derivation_to_def)\n    apply(clarsimp)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 n xa)(*strict*)\n     apply(rule cfgRM.der1_is_derivation)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 n xa)(*strict*)\n     apply(simp add: der1_def)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 n xa)(*strict*)\n     apply(rule cfgRM.der1_is_derivation)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(simp add: der1_def)\n   apply(rename_tac d w1 w2)(*strict*)\n   apply(rule_tac\n      x=\"w2\"\n      in exI)\n   apply(simp add: cfgRM.derivation_from_to_def cfgRM.derivation_from_def cfgRM.derivation_to_def)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule cfgRM.der1_is_derivation)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule cfgRM.der1_is_derivation)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(simp add: der1_def)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule der1_maximum_of_domain)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule der1_maximum_of_domain)\n  apply(rename_tac n na)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(subgoal_tac \"\\<exists>x \\<in> {pair None \\<lparr>cfg_conf = w1@w2\\<rparr>}. d 0 = Some x\")\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   prefer 2\n   apply(rule cfgRM.derivation_from_starts_from)\n   apply(rule cfgRM.from_to_is_from)\n   apply(blast)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc 0) = Some (pair (Some e) c)\")\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   prefer 2\n   apply(rule cfgRM.some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac na d w1 w2 w')(*strict*)\n     apply(rule cfgRM.from_to_is_der)\n     apply(blast)\n    apply(rename_tac na d w1 w2 w')(*strict*)\n    apply(blast)\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   apply(arith)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(subgoal_tac \"\\<exists>e. d (Suc na) = Some (pair e \\<lparr>cfg_conf=w'\\<rparr>)\")\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   prefer 2\n   apply(rule cfgRM.reachesToAtMaxDom)\n    apply(rename_tac na d w1 w2 w')(*strict*)\n    apply(rule cfgRM.from_to_is_to)\n    apply(blast)\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 w' e ea c)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac na d w1 w2 w' e ea c cfg_conf)(*strict*)\n  apply(rename_tac cv)\n  apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n  apply(erule_tac\n      x=\"derivation_drop d (Suc 0)\"\n      in allE)\n  apply(case_tac \"\\<exists>c'. cfgRM_step_relation G \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> c' @ w2 = cv\")\n   apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"\\<exists>c'. cfgRM_step_relation G \\<lparr>cfg_conf = w2\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> w1 @ c' = cv\")\n    apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n    prefer 2\n    apply(rule CFGRM_alt_case)\n     apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n     apply(simp add: cfgRM.derivation_from_to_def cfgRM.derivation_from_def cfgRM.derivation_def)\n     apply(clarsimp)\n     apply(rename_tac na d w1 w2 w' e ea cv)(*strict*)\n     apply(erule_tac\n      x=\"Suc 0\"\n      in allE)\n     apply(clarsimp)\n    apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n    apply(force)\n   apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n   apply(thin_tac \"\\<not> (\\<exists>c'. cfgRM_step_relation G \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> c' @ w2 = cv)\")\n   apply(clarsimp)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(erule_tac\n      x=\"w1\"\n      in allE)\n   apply(erule_tac\n      x=\"c'\"\n      in allE)\n   apply(erule_tac\n      x=\"w'\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(rule conjI)\n     apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n     apply(rule_tac\n      m = \"na\"\n      in cfgRM.derivation_drop_preserves_derivation_from_to2)\n        apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n        apply(blast)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(rule_tac\n      s = \"Suc na\"\n      in ssubst)\n        apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n        apply(arith)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(blast)\n      apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n      apply(blast)\n     apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n     apply(clarsimp)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(rule derivation_drop_preserves_generates_maximum_of_domain)\n    apply(blast)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac\n      x=\"d1\"\n      in exI)\n   apply(rule_tac\n      x = \"derivation_append (der2 \\<lparr>cfg_conf = w2\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr>) d2 (Suc 0)\"\n      in exI)\n   apply(rule_tac\n      x=\"w1'\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac\n      x=\"w2'\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(simp add: cfgRM.derivation_from_to_def cfgRM.derivation_from_def cfgRM.derivation_to_def)\n    apply(clarsimp)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(rule cfgRM.derivation_append_preserves_derivation)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgRM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(force)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(simp add: der2_def)\n     apply(case_tac \"d2 0\")\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(simp add: derivation_append_def der2_def)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(rule cfgRM.derivation_append_preserves_derivation)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgRM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(force)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(simp add: der2_def)\n     apply(case_tac \"d2 0\")\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule_tac\n      x=\"Suc nb\"\n      in exI)\n    apply(simp add: derivation_append_def der2_def)\n    apply(clarsimp)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n1\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"Suc n2\"\n      and s=\"Suc 0+n2\"\n      in ssubst)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac concat_has_max_dom)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(rule der2_maximum_of_domain)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(force)\n  apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n  apply(erule_tac\n      x=\"c'\"\n      in allE)\n  apply(erule_tac\n      x=\"w2\"\n      in allE)\n  apply(erule_tac\n      x=\"w'\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(rule_tac\n      m = \"na\"\n      in cfgRM.derivation_drop_preserves_derivation_from_to2)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(blast)\n      apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n      apply(rule_tac\n      s = \"Suc na\"\n      in ssubst)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(arith)\n      apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n      apply(blast)\n     apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n     apply(blast)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(rule derivation_drop_preserves_generates_maximum_of_domain)\n   apply(blast)\n  apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      x = \"derivation_append (der2 \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> ) d1 (Suc 0)\"\n      in exI)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      x=\"d2\"\n      in exI)\n  apply(rule_tac\n      x=\"w1'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac\n      dJ = \"\\<lparr>cfg_conf=c'\\<rparr>\"\n      in cfgRM.concatIsFromTo)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n      apply(simp add: cfgRM.derivation_from_to_def cfgRM.derivation_from_def cfgRM.derivation_to_def)\n      apply(clarsimp)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgRM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(simp add: der2_def)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgRM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule_tac\n      x=\"Suc 0\"\n      in exI)\n      apply(simp add: der2_def)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n     apply(simp add: cfgRM.derivation_from_to_def cfgRM.derivation_from_def cfgRM.derivation_to_def)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(rule der2_maximum_of_domain)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(force)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      x=\"w2'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(force)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"Suc n1\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"Suc n1\"\n      and s=\"Suc 0+n1\"\n      in ssubst)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac concat_has_max_dom)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule der2_maximum_of_domain)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(force)\n  done\n\nlemma CFGRM_Nonblockingness_to_elimination: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> cfgRM.belongs G d\n  \\<Longrightarrow> cfgRM.derivation_initial G d\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf=w1@w2@w3\\<rparr>)\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> cfgRM.Nonblockingness_branching G\n  \\<Longrightarrow> \\<exists>d' n' w e. maximum_of_domain d' n' \\<and> cfgRM.derivation G d' \\<and> cfgRM.belongs G d' \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=w2\\<rparr>) \\<and> d' n' = Some (pair e \\<lparr>cfg_conf=w\\<rparr>) \\<and> setA w = {}\"\n  apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n   prefer 2\n   apply(rule cfgRM.some_position_has_details_at_0)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: cfgRM.Nonblockingness_branching_def)\n  apply(erule_tac\n      x=\"d\"\n      in allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"n\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac c dc x)(*strict*)\n  apply(simp add: derivation_append_fit_def)\n  apply(subgoal_tac \"\\<exists>c. dc 0 = Some (pair None c)\")\n   apply(rename_tac c dc x)(*strict*)\n   prefer 2\n   apply(rule cfgRM.some_position_has_details_at_0)\n   apply(force)\n  apply(rename_tac c dc x)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<lparr>cfg_conf = w1 @ w2 @ w3\\<rparr> \\<in> cfg_configurations G\")\n   apply(rename_tac c dc x)(*strict*)\n   prefer 2\n   apply(simp add: cfgRM.belongs_def)\n   apply(erule_tac\n      x=\"n\"\n      and P=\"\\<lambda>i. case d i of None \\<Rightarrow> True | Some (pair e c) \\<Rightarrow> (case e of None \\<Rightarrow> True | Some e' \\<Rightarrow> e' \\<in> cfg_step_labels G) \\<and> c \\<in> cfg_configurations G\"\n      in allE)\n   apply(rename_tac c dc x)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c dc x)(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea ca)(*strict*)\n  apply(case_tac \"i<n\")\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d i = Some (pair e c)\")\n    apply(rename_tac c dc x i ea ca)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"G\"\n      in cfgRM.some_position_has_details_before_max_dom)\n      apply(rename_tac c dc x i ea ca)(*strict*)\n      apply(blast)\n     apply(rename_tac c dc x i ea ca)(*strict*)\n     apply(blast)\n    apply(rename_tac c dc x i ea ca)(*strict*)\n    apply(arith)\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n   apply(simp add: cfg_marking_configuration_def)\n   apply(clarsimp)\n   apply(rule_tac\n      m=\"i\"\n      in cfgRM.noDeadEndBeforeMaxDom)\n       apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n       apply(force)\n      apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n      apply(force)\n     apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n     apply(force)\n    apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n    apply(force)\n   apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n   apply(simp add: derivation_append_def)\n   apply(clarsimp)\n   apply(rename_tac c dc x i ea ca e2 c2)(*strict*)\n   apply(simp add: cfgRM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac c dc x i ea ca e2 c2 l r)(*strict*)\n   apply(subgoal_tac \"prod_lhs e2 \\<in> setA (l @ teA (prod_lhs e2) # r)\")\n    apply(rename_tac c dc x i ea ca e2 c2 l r)(*strict*)\n    apply(force)\n   apply(rename_tac c dc x i ea ca e2 c2 l r)(*strict*)\n   apply(rule elemInsetA)\n  apply(rename_tac c dc x i ea ca)(*strict*)\n  apply(case_tac \"i=n\")\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(rule_tac\n      x = \"der1 \\<lparr>cfg_conf = w2\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x = \"0\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac c dc x i ea ca)(*strict*)\n    apply(simp add: der1_maximum_of_domain)\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac c dc x i ea ca)(*strict*)\n    apply(rule cfgRM.der1_is_derivation)\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac c dc x i ea ca)(*strict*)\n    apply(rule cfgRM.der1_belongs)\n    apply(simp add: cfg_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac c dc x ea ca)(*strict*)\n    apply(simp only: setAConcat setBConcat concat_asso)\n    apply(force)\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c dc x ea ca)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac c dc x ea ca)(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac c dc x ea ca)(*strict*)\n   apply(simp add: der1_def)\n   apply(simp add: cfg_marking_configuration_def derivation_append_def)\n   apply(clarsimp)\n   apply(rename_tac c dc x)(*strict*)\n   apply(simp only: setAConcat concat_asso)\n   apply(force)\n  apply(rename_tac c dc x i ea ca)(*strict*)\n  apply(subgoal_tac \"i>n\")\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac c dc x i ea ca)(*strict*)\n  apply(thin_tac \"i\\<noteq>n\")\n  apply(thin_tac \"\\<not>i<n\")\n  apply(case_tac ca)\n  apply(rename_tac c dc x i ea ca cfg_conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea cfg_conf)(*strict*)\n  apply(rename_tac w')\n  apply(rename_tac c dc x i ea w')(*strict*)\n  apply(subgoal_tac \"maximum_of_domain dc (i-n)\")\n   apply(rename_tac c dc x i ea w')(*strict*)\n   prefer 2\n   apply(simp add: maximum_of_domain_def)\n   apply(simp add: derivation_append_def)\n   apply(simp add: cfg_marking_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac c dc x i ea w' y)(*strict*)\n   apply(case_tac \"dc (Suc (i-n))\")\n    apply(rename_tac c dc x i ea w' y)(*strict*)\n    apply(force)\n   apply(rename_tac c dc x i ea w' y a)(*strict*)\n   apply(subgoal_tac \"\\<forall>e c'. \\<not> cfgRM_step_relation G \\<lparr>cfg_conf = w'\\<rparr> e c'\")\n    apply(rename_tac c dc x i ea w' y a)(*strict*)\n    prefer 2\n    apply(rule CFGRM_no_step_without_nonterms)\n    apply(force)\n   apply(rename_tac c dc x i ea w' y a)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. dc (Suc (i - n)) = Some (pair (Some e) c)\")\n    apply(rename_tac c dc x i ea w' y a)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc(i-n)\"\n      in cfgRM.pre_some_position_is_some_position_prime)\n       apply(rename_tac c dc x i ea w' y a)(*strict*)\n       apply(force)\n      apply(rename_tac c dc x i ea w' y a)(*strict*)\n      apply(force)\n     apply(rename_tac c dc x i ea w' y a)(*strict*)\n     apply(force)\n    apply(rename_tac c dc x i ea w' y a)(*strict*)\n    apply(force)\n   apply(rename_tac c dc x i ea w' y a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n   apply(subgoal_tac \"cfgRM_step_relation G \\<lparr>cfg_conf = w'\\<rparr> eaa ca\")\n    apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"dc\"\n      and n=\"(i-n)\"\n      in cfgRM.position_change_due_to_step_relation)\n      apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n      apply(blast)\n     apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n     apply(blast)\n    apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n    apply(blast)\n   apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n   apply(erule_tac\n      x=\"eaa\"\n      in allE)\n   apply(erule_tac\n      x=\"ca\"\n      in allE)\n   apply(force)\n  apply(rename_tac c dc x i ea w')(*strict*)\n  apply(subgoal_tac \"\\<exists>d1 d2 w1' w2' n1 n2. cfgRM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgRM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2@w3\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1'@w2'=w' \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=(i-n)\")\n   apply(rename_tac c dc x i ea w')(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"dc\"\n      in CFGRM_derivationCanBeDecomposed2)\n    apply(rename_tac c dc x i ea w')(*strict*)\n    apply(simp add: cfgRM.derivation_from_to_def cfgRM.derivation_from_def cfgRM.derivation_to_def)\n    apply(rule_tac\n      x=\"i-n\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac c dc x i ea w')(*strict*)\n     apply(simp add: maximum_of_domain_def)\n    apply(rename_tac c dc x i ea w')(*strict*)\n    apply(rule_tac\n      x=\"pair ea \\<lparr>cfg_conf=w'\\<rparr>\"\n      in exI)\n    apply(clarsimp)\n    apply(simp add: derivation_append_def)\n   apply(rename_tac c dc x i ea w')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c dc x i ea w')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(thin_tac \"cfgRM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>}\")\n  apply(rename_tac c dc x i ea d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rename_tac w' n1 n')\n  apply(rename_tac c dc x i ea d1 d2 w1' w' n1 n')(*strict*)\n  apply(subgoal_tac \"\\<exists>d1 d2 w1' w2' n1 n2. cfgRM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgRM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w3\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1'@w2'=w' \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=n'\")\n   apply(rename_tac c dc x i ea d1 d2 w1' w' n1 n')(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d2\"\n      in CFGRM_derivationCanBeDecomposed2)\n    apply(rename_tac c dc x i ea d1 d2 w1' w' n1 n')(*strict*)\n    apply(simp add: cfgRM.derivation_from_to_def cfgRM.derivation_from_def cfgRM.derivation_to_def)\n   apply(rename_tac c dc x i ea d1 d2 w1' w' n1 n')(*strict*)\n   apply(force)\n  apply(rename_tac c dc x i ea d1 d2 w1' w' n1 n')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2)(*strict*)\n  apply(thin_tac \"cfgRM.derivation_from_to G d2a {pair None \\<lparr>cfg_conf = w3\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>}\")\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2)(*strict*)\n  apply(thin_tac \"cfgRM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2 @ w3\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'nonterminal @ w2'\\<rparr>}\")\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2)(*strict*)\n  apply(rule_tac\n      x=\"d1a\"\n      in exI)\n  apply(rule_tac\n      x=\"n1a\"\n      in exI)\n  apply(clarsimp)\n  apply(simp add: cfgRM.derivation_from_to_def cfgRM.derivation_from_def cfgRM.derivation_to_def)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n  apply(case_tac \"d1a 0\")\n   apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n   apply(rule cfgRM.derivation_belongs)\n      apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n      apply(force)\n     apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n     apply(force)\n    apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n    apply(simp add: cfg_configurations_def)\n    apply(simp only: setAConcat setBConcat concat_asso)\n    apply(force)\n   apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n   apply(force)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n  apply(rule_tac\n      x=\"w1'nonterminal\"\n      in exI)\n  apply(simp add: cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(simp only: setAConcat setBConcat concat_asso)\n  apply(clarsimp)\n  apply(subgoal_tac \"na=n1a\")\n   apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n   apply(force)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n  apply(rule_tac\n      d=\"d1a\"\n      in cfgRM.maximum_of_domainUnique)\n    apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n    apply(force)\n   apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n   apply(force)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n  apply(simp add: maximum_of_domain_def)\n  done\n\nlemma cfgRM_step_relation_contextOK2: \"\n  valid_cfg G\n  \\<Longrightarrow> setA w2 = {}\n  \\<Longrightarrow> \\<forall>a e b. cfgRM_step_relation G a e b \\<longrightarrow> cfgRM_step_relation G \\<lparr>cfg_conf = cfg_conf a @ w2\\<rparr> e \\<lparr>cfg_conf = cfg_conf b @ w2\\<rparr>\"\n  apply(simp add: cfgRM_step_relation_def)\n  apply(auto)\n  apply(rename_tac a e b l r)(*strict*)\n  apply(rule_tac\n      x=\"l\"\n      in exI)\n  apply(rule_tac\n      x=\"r@w2\"\n      in exI)\n  apply(auto)\n  apply(rename_tac a e b l r x)(*strict*)\n  apply(simp only: setAConcat concat_asso)\n  apply(clarsimp)\n  done\n\nlemma cfgRM_concatExtendIsFromToBoth: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>}\n  \\<Longrightarrow> cfgRM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>}\n  \\<Longrightarrow> setA w2' = {}\n  \\<Longrightarrow> maximum_of_domain d1 m1\n  \\<Longrightarrow> maximum_of_domain d2 m2\n  \\<Longrightarrow> cfgRM.derivation_from_to G (derivation_append (derivation_map d2 (\\<lambda>v. \\<lparr>cfg_conf = w1 @ (cfg_conf v)\\<rparr>)) (derivation_map d1 (\\<lambda>v. \\<lparr>cfg_conf = (cfg_conf v) @ w2'\\<rparr>)) m2) {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1' @ w2'\\<rparr>}\"\n  apply(subgoal_tac \"\\<exists>e1 e2. d1 0 =Some (pair None \\<lparr>cfg_conf=w1\\<rparr>) \\<and> d1 m1 =Some (pair e1 \\<lparr>cfg_conf=w1'\\<rparr>) \\<and> d2 0 =Some (pair None \\<lparr>cfg_conf=w2\\<rparr>) \\<and> d2 m2 =Some (pair e2 \\<lparr>cfg_conf=w2'\\<rparr>)\")\n   prefer 2\n   apply(simp add: cfgRM.derivation_from_to_def cfgRM.derivation_to_def cfgRM.derivation_from_def)\n   apply(clarsimp)\n   apply(rename_tac n na xa xaa)(*strict*)\n   apply(case_tac \"d1 0\")\n    apply(rename_tac n na xa xaa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n na xa xaa a)(*strict*)\n   apply(case_tac \"d2 0\")\n    apply(rename_tac n na xa xaa a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n na xa xaa a aa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n na xa xaa)(*strict*)\n   apply(subgoal_tac \"n=m1\")\n    apply(rename_tac n na xa xaa)(*strict*)\n    apply(subgoal_tac \"na=m2\")\n     apply(rename_tac n na xa xaa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac n na xa xaa)(*strict*)\n    apply(rule_tac\n      d=\"d2\"\n      in cfgRM.maximum_of_domainUnique)\n      apply(rename_tac n na xa xaa)(*strict*)\n      apply(force)\n     apply(rename_tac n na xa xaa)(*strict*)\n     apply(force)\n    apply(rename_tac n na xa xaa)(*strict*)\n    apply(simp add: maximum_of_domain_def)\n   apply(rename_tac n na xa xaa)(*strict*)\n   apply(rule_tac\n      d=\"d1\"\n      in cfgRM.maximum_of_domainUnique)\n     apply(rename_tac n na xa xaa)(*strict*)\n     apply(force)\n    apply(rename_tac n na xa xaa)(*strict*)\n    apply(force)\n   apply(rename_tac n na xa xaa)(*strict*)\n   apply(simp add: maximum_of_domain_def)\n  apply(subgoal_tac \"cfgRM.derivation G (derivation_map d1 (\\<lambda>v. \\<lparr>cfg_conf = cfg_conf v @ w2'\\<rparr>))\")\n   prefer 2\n   apply(rule cfgRM.derivation_map_preserves_derivation2)\n    apply(rule cfgRM.from_to_is_der)\n    apply(force)\n   apply(rule cfgRM_step_relation_contextOK2)\n    apply(clarsimp)\n   apply(clarsimp)\n  apply(subgoal_tac \"cfgRM.derivation G (derivation_map d2 (\\<lambda>v. \\<lparr>cfg_conf = w1 @ cfg_conf v\\<rparr>))\")\n   prefer 2\n   apply(rule cfgRM.derivation_map_preserves_derivation2)\n    apply(rule cfgRM.from_to_is_der)\n    apply(force)\n   apply(rule cfgRM_step_relation_contextOK1)\n   apply(clarsimp)\n  apply(rule_tac\n      dJ=\"\\<lparr>cfg_conf=w1@w2'\\<rparr>\"\n      in cfgRM.concatIsFromTo)\n     apply(simp add: cfgRM.derivation_from_to_def)\n     apply(simp add: cfgRM.derivation_from_def)\n     apply(simp add: cfgRM.derivation_to_def)\n     apply(simp add: derivation_map_def)\n     apply(rule_tac\n      x=\"m2\"\n      in exI)\n     apply(clarsimp)\n     apply(rename_tac n na e1 xa xaa e2)(*strict*)\n     apply(simp add: maximum_of_domain_def)\n    apply(simp add: cfgRM.derivation_from_to_def)\n    apply(simp add: cfgRM.derivation_from_def)\n    apply(simp add: cfgRM.derivation_to_def)\n    apply(simp add: derivation_map_def)\n    apply(rule_tac\n      x=\"m1\"\n      in exI)\n    apply(clarsimp)\n    apply(rename_tac n na e1 xa xaa e2)(*strict*)\n    apply(simp add: maximum_of_domain_def)\n   apply(rule derivation_map_preserves_maximum_of_domain)\n   apply(blast)\n  apply(rule derivation_map_preserves_maximum_of_domain)\n  apply(blast)\n  done\n\nlemma StepPreciseRM: \"\n  valid_cfg G\n  \\<Longrightarrow> setA w2={}\n  \\<Longrightarrow> cfgRM_step_relation G \\<lparr>cfg_conf = w1 @ [teA A] @ w2 \\<rparr> e \\<lparr>cfg_conf = w1 @ w @ w2\\<rparr>\n  \\<Longrightarrow> e=\\<lparr>prod_lhs=A, prod_rhs=w\\<rparr>\"\n  apply(simp add: cfgRM_step_relation_def)\n  apply(auto)\n  apply(rename_tac l r)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac l r prod_lhsa prod_rhsa)(*strict*)\n  apply(subgoal_tac \"w2=r\")\n   apply(rename_tac l r prod_lhsa prod_rhsa)(*strict*)\n   apply(auto)\n  apply(rename_tac l r prod_lhs prod_rhs)(*strict*)\n  apply(rule terminalTailEquals1)\n    apply(rename_tac l r prod_lhs prod_rhs)(*strict*)\n    apply(blast)\n   apply(rename_tac l r prod_lhs prod_rhs)(*strict*)\n   apply(blast)\n  apply(rename_tac l r prod_lhs prod_rhs)(*strict*)\n  apply(clarsimp)\n  apply(blast)\n  done\n\ndefinition Lemma6__2_Goal :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> (nat \\<Rightarrow> (('nonterminal, 'event) cfg_step_label, ('nonterminal, 'event) cfg_configuration) derivation_configuration option)\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('nonterminal, 'event) cfg_step_label\n  \\<Rightarrow> ('nonterminal, 'event) DT_two_elements list\n  \\<Rightarrow> ('nonterminal, 'event) DT_two_elements list\n  \\<Rightarrow> ('nonterminal, 'event) DT_two_elements list\n  \\<Rightarrow> ('nonterminal, 'event) DT_two_elements list\n  \\<Rightarrow> 'nonterminal\n  \\<Rightarrow> bool\"\n  where\n    \"Lemma6__2_Goal G d n e \\<gamma> \\<eta> y \\<delta> A \\<equiv>\n  \\<exists>d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' d'' m A'.\n  cfgRM.derivation G d'\n  \\<and> maximum_of_domain d' (Suc n')\n  \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G)]\\<rparr>)\n  \\<and> d' n' = Some (pair e1 \\<lparr>cfg_conf=\\<delta>' @ [teA A'] @ y'\\<rparr> )\n  \\<and> d' (Suc n') = Some (pair (Some e2) \\<lparr>cfg_conf = \\<delta>' @ \\<alpha>' @ \\<beta>' @ y'\\<rparr>)\n  \\<and> \\<delta>' @ \\<alpha>' = \\<gamma>\n  \\<and> setA y'={}\n  \\<and> take (Suc 0) (List.rev \\<alpha>') = take (Suc 0) (List.rev \\<gamma>)\n  \\<and> cfgRM.derivation G d''\n  \\<and> maximum_of_domain d'' m\n  \\<and> d'' 0 = Some (pair None \\<lparr>cfg_conf = \\<beta>' @ y'\\<rparr>)\n  \\<and> d'' m = Some (pair e3 \\<lparr>cfg_conf = \\<eta> @ y\\<rparr> )\n  \\<and> (Suc n') + m = Suc n\n  \\<and> (\\<forall>i. ((i \\<le> Suc n') \\<longrightarrow> get_label (d i) = get_label (d' i))\n  \\<and> ((i > Suc n') \\<longrightarrow> get_label (d i) = get_label (d'' (i - Suc n'))))\"\n\nlemma Lemma6__2: \"\n  valid_cfg G\n  \\<Longrightarrow> setA y={}\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> maximum_of_domain d (Suc n)\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G)]\\<rparr>)\n  \\<Longrightarrow> d (Suc n) = Some (pair (Some e) \\<lparr>cfg_conf=\\<gamma>@\\<eta>@y\\<rparr> )\n  \\<Longrightarrow> \\<gamma>@\\<eta>=\\<delta>@[teA A]\n  \\<Longrightarrow> Lemma6__2_Goal G d n e \\<gamma> \\<eta> y \\<delta> A\"\n  apply(unfold Lemma6__2_Goal_def)\n  apply(subgoal_tac \"\\<forall>n d y e \\<gamma> \\<eta> \\<delta> A. setA y={} \\<and> cfgRM.derivation G d \\<and> maximum_of_domain d (Suc n) \\<and> d 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G)]\\<rparr>) \\<and> d (Suc n) = Some (pair (Some e) \\<lparr>cfg_conf=\\<gamma>@\\<eta>@y\\<rparr> ) \\<and> \\<gamma>@\\<eta>=\\<delta>@[teA A] \\<longrightarrow> (\\<exists>d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' d'' m A'. cfgRM.derivation G d' \\<and> maximum_of_domain d' (Suc n') \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G)]\\<rparr>) \\<and> d' n' = Some (pair e1 \\<lparr>cfg_conf=\\<delta>'@[teA A']@y'\\<rparr> ) \\<and> d' (Suc n') = Some (pair (Some e2) \\<lparr>cfg_conf=\\<delta>'@\\<alpha>'@\\<beta>'@y'\\<rparr>) \\<and> \\<delta>'@\\<alpha>'=\\<gamma> \\<and> setA y'={} \\<and> take (Suc 0) (List.rev \\<alpha>') = take (Suc 0) (List.rev \\<gamma>) \\<and> cfgRM.derivation G d'' \\<and> maximum_of_domain d'' m \\<and> d'' 0 = Some (pair None \\<lparr>cfg_conf=\\<beta>'@y'\\<rparr>) \\<and> d'' m = Some (pair e3 \\<lparr>cfg_conf=\\<eta>@y\\<rparr> ) \\<and> (Suc n')+m=Suc n \\<and> (\\<forall>i. ((i\\<le>Suc n') \\<longrightarrow> get_label (d i) = get_label (d' i)) \\<and> ((i>Suc n') \\<longrightarrow> get_label (d i) = get_label (d'' (i-Suc n')))))\")\n   apply(erule_tac\n      x=\"n\"\n      in allE)\n   apply(erule_tac\n      x=\"d\"\n      in allE)\n   apply(erule_tac\n      x=\"y\"\n      in allE)\n   apply(erule_tac\n      x=\"e\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<gamma>\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<eta>\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<delta>\"\n      in allE)\n   apply(erule_tac\n      x=\"A\"\n      in allE)\n   apply(force)\n  apply(thin_tac \"setA y={}\")\n  apply(thin_tac \"cfgRM.derivation G d\")\n  apply(thin_tac \"maximum_of_domain d (Suc n)\")\n  apply(thin_tac \"d 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G)]\\<rparr>)\")\n  apply(thin_tac \"d (Suc n) = Some (pair (Some e) \\<lparr>cfg_conf=\\<gamma>@\\<eta>@y\\<rparr> )\")\n  apply(thin_tac \"\\<gamma>@\\<eta>=\\<delta>@[teA A]\")\n  apply(rule allI)\n  apply(rename_tac n)(*strict*)\n  apply(rule_tac\n      n=\"n\"\n      in nat_less_induct)\n  apply(rename_tac n na)(*strict*)\n  apply(case_tac na)\n   apply(rename_tac n na)(*strict*)\n   apply(thin_tac \"\\<forall>m<na. \\<forall>d y e \\<gamma> \\<eta> \\<delta> A. setA y = {} \\<and> cfgRM.derivation G d \\<and> maximum_of_domain d (Suc m) \\<and> d 0 = Some (pair None \\<lparr>cfg_conf = [teA (cfg_initial G)]\\<rparr>) \\<and> d (Suc m) = Some (pair (Some e) \\<lparr>cfg_conf = \\<gamma> @ \\<eta> @ y\\<rparr>) \\<and> \\<gamma> @ \\<eta> = \\<delta> @ [teA A] \\<longrightarrow> (\\<exists>d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' d'' ma A'. cfgRM.derivation G d' \\<and> maximum_of_domain d' (Suc n') \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf = [teA (cfg_initial G)]\\<rparr>) \\<and> d' n' = Some (pair e1 \\<lparr>cfg_conf = \\<delta>' @ [teA A'] @ y'\\<rparr>) \\<and> d' (Suc n') = Some (pair (Some e2) \\<lparr>cfg_conf = \\<delta>' @ \\<alpha>' @ \\<beta>' @ y'\\<rparr>) \\<and> \\<delta>' @ \\<alpha>' = \\<gamma> \\<and> setA y' = {} \\<and> take (Suc 0) (List.rev \\<alpha>') = take (Suc 0) (List.rev \\<gamma>) \\<and> cfgRM.derivation G d'' \\<and> maximum_of_domain d'' ma \\<and> d'' 0 = Some (pair None \\<lparr>cfg_conf = \\<beta>' @ y'\\<rparr>) \\<and> d'' ma = Some (pair e3 \\<lparr>cfg_conf = \\<eta> @ y\\<rparr>) \\<and> Suc n' + ma = Suc m \\<and> (\\<forall>i. (i \\<le> Suc n' \\<longrightarrow> get_label (d i) = get_label (d' i)) \\<and> (Suc n' < i \\<longrightarrow> get_label (d i) = get_label (d'' (i - Suc n')))))\")\n   apply(rename_tac n na)(*strict*)\n   apply(rule allI)+\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule impI)\n   apply(erule conjE)+\n   apply(rule_tac\n      x=\"der2 \\<lparr>cfg_conf = [teA (cfg_initial G)] \\<rparr> e \\<lparr>cfg_conf = \\<gamma> @ \\<eta> @ y\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule_tac\n      x=\"None\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"None\"\n      in exI)\n   apply(rule_tac\n      x=\"[]\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<gamma>\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<eta>@y\"\n      in exI)\n   apply(rule_tac\n      x=\"[]\"\n      in exI)\n   apply(rule_tac\n      x = \"der1 \\<lparr>cfg_conf = \\<eta>@y\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule_tac\n      x=\"cfg_initial G\"\n      in exI)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(rule cfgRM.der2_is_derivation)\n    apply(clarsimp)\n    apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(rule cfgRM.position_change_due_to_step_relation)\n      apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n      apply(blast)\n     apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n     apply(blast)\n    apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(blast)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(rule der2_maximum_of_domain)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(simp add: der2_def)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(simp add: der2_def)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(simp add: der2_def)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(simp add: cfgRM.der1_is_derivation)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(rule der1_maximum_of_domain)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(rule allI)\n   apply(rename_tac n na d y e \\<gamma> \\<eta> \\<delta> A i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A i)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A i)(*strict*)\n    apply(clarsimp)\n    apply(simp add: get_label_def)\n    apply(case_tac i)\n     apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A i)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n     apply(simp add: der2_def)\n    apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A i nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(simp add: der2_def)\n   apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_label_def)\n   apply(subgoal_tac \"\\<forall>m>Suc 0. d m = None\")\n    apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A i)(*strict*)\n    apply(clarsimp)\n    apply(simp add: der1_def)\n   apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A i)(*strict*)\n   apply(rule cfgRM.noSomeAfterMaxDom)\n    apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A i)(*strict*)\n    apply(blast)\n   apply(rename_tac d y e \\<gamma> \\<eta> \\<delta> A i)(*strict*)\n   apply(blast)\n  apply(rename_tac n na nat)(*strict*)\n  apply(rule allI)+\n  apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n  apply(rule impI)\n  apply(erule conjE)+\n  apply(erule_tac\n      x=\"nat\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(arith)\n  apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n  apply(erule_tac\n      x=\"derivation_take d (Suc nat)\"\n      in allE)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc nat) = Some (pair (Some e) c)\")\n   apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   prefer 2\n   apply(rule cfgRM.some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n     apply(blast)\n    apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n    apply(blast)\n   apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n   apply(arith)\n  apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A ea c)(*strict*)\n  apply(subgoal_tac \"cfgRM_step_relation G c e \\<lparr>cfg_conf = \\<gamma> @ \\<eta> @ y\\<rparr>\")\n   apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A ea c)(*strict*)\n   prefer 2\n   apply(rule cfgRM.position_change_due_to_step_relation)\n     apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A ea c)(*strict*)\n     apply(blast)\n    apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A ea c)(*strict*)\n    apply(blast)\n   apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A ea c)(*strict*)\n   apply(blast)\n  apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A ea c)(*strict*)\n  apply(subgoal_tac \"\\<exists>\\<delta>1 A1 y1. c=\\<lparr>cfg_conf=\\<delta>1@[teA A1]@y1\\<rparr> \\<and> setA y1={}\")\n   apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A ea c)(*strict*)\n   prefer 2\n   apply(simp add: cfgRM_step_relation_def)\n   apply(rename_tac na nat d y e \\<gamma> \\<eta> \\<delta> A ea c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat d y e \\<gamma> \\<eta> \\<delta> A ea c l r)(*strict*)\n   apply(case_tac c)\n   apply(rename_tac nat d y e \\<gamma> \\<eta> \\<delta> A ea c l r cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat d y e \\<gamma> \\<eta> \\<delta> A ea l r)(*strict*)\n   apply(case_tac e)\n   apply(rename_tac nat d y e \\<gamma> \\<eta> \\<delta> A ea l r prod_lhsa prod_rhsa)(*strict*)\n   apply(rename_tac A1 w1)\n   apply(rename_tac nat d y e \\<gamma> \\<eta> \\<delta> A ea l r A1 w1)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea l r A1 w1)(*strict*)\n   apply(rule_tac\n      x=\"l\"\n      in exI)\n   apply(rule_tac\n      x=\"A1\"\n      in exI)\n   apply(rule_tac\n      x=\"r\"\n      in exI)\n   apply(force)\n  apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A ea c)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac n na nat d y e \\<gamma> \\<eta> \\<delta> A ea c \\<delta>1 A1 y1)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(rename_tac na nat d y e \\<gamma> \\<eta> \\<delta> A ea c \\<delta>1 A1 y1)(*strict*)\n  apply(fold cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac nat d y e \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 A1 y1 l r)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac nat d y e \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 A1 y1 l r prod_lhsa prod_rhsa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 A1 y1 l r prod_lhs prod_rhs)(*strict*)\n  apply(rename_tac \\<delta>1 y1 A1 w1)\n  apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1a A1a y1a \\<delta>1 y1 A1 w1)(*strict*)\n  apply(subgoal_tac \"y1a=y1\")\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1a A1a y1a \\<delta>1 y1 A1 w1)(*strict*)\n   prefer 2\n   apply(rule_tac\n      ?w1.0=\"y1a\"\n      and ?w2.0=\"y1\"\n      and A=\"A1a\"\n      and B=\"A1\"\n      and ?v1.0=\"\\<delta>1a\"\n      and ?v2.0=\"\\<delta>1\"\n      in terminalTailEquals1)\n     apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1a A1a y1a \\<delta>1 y1 A1 w1)(*strict*)\n     apply(force)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1a A1a y1a \\<delta>1 y1 A1 w1)(*strict*)\n    apply(force)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1a A1a y1a \\<delta>1 y1 A1 w1)(*strict*)\n   apply(force)\n  apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1a A1a y1a \\<delta>1 y1 A1 w1)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1)(*strict*)\n  apply(subgoal_tac \"\\<exists>x. y=x@y1 \\<and> ((\\<exists>\\<alpha>'. \\<alpha>'\\<noteq>[] \\<and> \\<gamma>=\\<delta>1@\\<alpha>' \\<and> w1=\\<alpha>'@\\<eta>@x)\\<or>(\\<exists>\\<alpha>. \\<delta>1=\\<gamma>@\\<alpha>))\")\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1)(*strict*)\n   prefer 2\n   apply(thin_tac \"\\<forall>y e \\<gamma> \\<eta>. setA y = {} \\<and> cfgRM.derivation G (derivation_take d (Suc nat)) \\<and> maximum_of_domain (derivation_take d (Suc nat)) (Suc nat) \\<and> derivation_take d (Suc nat) 0 = Some (pair None \\<lparr>cfg_conf = [teA (cfg_initial G)]\\<rparr>) \\<and> derivation_take d (Suc nat) (Suc nat) = Some (pair (Some e) \\<lparr>cfg_conf = \\<gamma> @ \\<eta> @ y\\<rparr>) \\<and> (\\<exists>\\<delta> A. \\<gamma> @ \\<eta> = \\<delta> @ [teA A]) \\<longrightarrow> (\\<exists>d'. cfgRM.derivation G d' \\<and> (\\<exists>n'. maximum_of_domain d' (Suc n') \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf = [teA (cfg_initial G)]\\<rparr>) \\<and> (\\<exists>e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y'. (\\<exists>A'. d' n' = Some (pair e1 \\<lparr>cfg_conf = \\<delta>' @ teA A' # y'\\<rparr>)) \\<and> d' (Suc n') = Some (pair (Some e2) \\<lparr>cfg_conf = \\<delta>' @ \\<alpha>' @ \\<beta>' @ y'\\<rparr>) \\<and> \\<delta>' @ \\<alpha>' = \\<gamma> \\<and> setA y' = {} \\<and> take (Suc 0) (List.rev \\<alpha>') = take (Suc 0) (List.rev \\<gamma>) \\<and> (\\<exists>d''. cfgRM.derivation G d'' \\<and> (\\<exists>m. maximum_of_domain d'' m \\<and> d'' 0 = Some (pair None \\<lparr>cfg_conf = \\<beta>' @ y'\\<rparr>) \\<and> d'' m = Some (pair e3 \\<lparr>cfg_conf = \\<eta> @ y\\<rparr>) \\<and> n' + m = nat \\<and> (\\<forall>i. (i \\<le> Suc n' \\<longrightarrow> get_label (derivation_take d (Suc nat) i) = get_label (d' i)) \\<and> (Suc n' < i \\<longrightarrow> get_label (derivation_take d (Suc nat) i) = get_label (d'' (i - Suc n')))))))))\")\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1)(*strict*)\n   apply(subgoal_tac \"\\<exists>x. y=x@y1\")\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1)(*strict*)\n    prefer 2\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1)(*strict*)\n    apply(rule_tac\n      ?w1.0=\"y1\"\n      and ?w2.0=\"y\"\n      and A=\"A\"\n      and ?v1.0=\"\\<delta>\"\n      and ?v2.0=\"\\<delta>1\"\n      and u=\"w1\"\n      in terminalTailEquals2)\n      apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1)(*strict*)\n      apply(blast)\n     apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1)(*strict*)\n     apply(blast)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1)(*strict*)\n    apply(simp only: concat_asso)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n   apply(rule_tac\n      x=\"x\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n   apply(subgoal_tac \"\\<gamma> \\<sqsubseteq> \\<delta>1 \\<or> \\<delta>1 \\<sqsubseteq> \\<gamma>\")\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n    prefer 2\n    apply(rule mutual_prefix_prefix)\n    apply(blast)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n    prefer 2\n    apply(case_tac \"\\<gamma>=\\<delta>1\")\n     apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n     apply(rule disjI2)\n     apply(rule_tac\n      x=\"[]\"\n      in exI)\n     apply(blast)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n    apply(rule disjI1)\n    apply(simp add: prefix_def)\n    apply(erule exE)+\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x c)(*strict*)\n    apply(rule_tac\n      x=\"c\"\n      in exI)\n    apply(force)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n   apply(rule disjI2)\n   apply(simp add: prefix_def)\n   apply(erule exE)+\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x c)(*strict*)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(force)\n  apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n  apply(erule conjE)+\n  apply(erule disjE)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(erule conjE)+\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(blast)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule_tac\n      x=\"Suc nat\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(blast)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(blast)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule_tac\n      x=\"Some ea\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>prod_lhs = A1, prod_rhs = w1\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x=\"None\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<delta>1\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<alpha>'\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<eta>@x\"\n      in exI)\n   apply(rule_tac\n      x=\"y1\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(rule_tac\n      x=\"A1\"\n      in exI)\n    apply(blast)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(simp only: concat_asso)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(blast)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(blast)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(clarsimp)\n    apply(rename_tac nat d \\<eta> \\<delta> A ea \\<delta>1 y1 A1 x \\<alpha>')(*strict*)\n    apply(case_tac \\<alpha>')\n     apply(rename_tac nat d \\<eta> \\<delta> A ea \\<delta>1 y1 A1 x \\<alpha>')(*strict*)\n     apply(clarsimp)\n    apply(rename_tac nat d \\<eta> \\<delta> A ea \\<delta>1 y1 A1 x \\<alpha>' a list)(*strict*)\n    apply(force)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule_tac\n      x = \"der1 \\<lparr>cfg_conf = \\<eta>@y\\<rparr>\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(rule cfgRM.der1_is_derivation)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(simp add: maximum_of_domain_def)\n    apply(rule conjI)\n     apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n     apply(simp only: concat_asso)\n     apply(clarsimp)\n     apply(rename_tac nat d \\<eta> \\<delta> A ea \\<delta>1 y1 A1 x \\<alpha>')(*strict*)\n     apply(simp add: der1_def)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x \\<alpha>')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat d \\<eta> \\<delta> A ea \\<delta>1 y1 A1 x \\<alpha>' i)(*strict*)\n   apply(subgoal_tac \"\\<forall>m>Suc(Suc nat). d m = None\")\n    apply(rename_tac nat d \\<eta> \\<delta> A ea \\<delta>1 y1 A1 x \\<alpha>' i)(*strict*)\n    apply(clarsimp)\n    apply(simp add: get_label_def der1_def)\n   apply(rename_tac nat d \\<eta> \\<delta> A ea \\<delta>1 y1 A1 x \\<alpha>' i)(*strict*)\n   apply(rule cfgRM.noSomeAfterMaxDom)\n    apply(rename_tac nat d \\<eta> \\<delta> A ea \\<delta>1 y1 A1 x \\<alpha>' i)(*strict*)\n    apply(blast)\n   apply(rename_tac nat d \\<eta> \\<delta> A ea \\<delta>1 y1 A1 x \\<alpha>' i)(*strict*)\n   apply(blast)\n  apply(rename_tac nat d y \\<gamma> \\<eta> \\<delta> A ea \\<delta>1 y1 A1 w1 x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n  apply(erule_tac\n      x=\"y1\"\n      in allE)\n  apply(erule_tac\n      x=\"ea\"\n      in allE)\n  apply(erule_tac\n      x=\"\\<gamma>\"\n      in allE)\n  apply(erule_tac\n      x=\"\\<alpha>@[teA A1]\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n    apply(force)\n   apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n    apply(rule_tac cfgRM.derivation_take_preserves_derivation)\n    apply(blast)\n   apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n    apply(rule_tac\n      m=\"Suc 0\"\n      in cfgRM.derivation_take_preserves_generates_maximum_of_domain)\n     apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n     apply(blast)\n    apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n    apply(simp add: derivation_take_def)\n   apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n    apply(simp add: derivation_take_def)\n   apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n   apply(rule_tac\n      x=\"\\<gamma>@\\<alpha>\"\n      in exI)\n   apply(rule_tac\n      x=\"A1\"\n      in exI)\n   apply(clarsimp)\n  apply(rename_tac nat d \\<gamma> \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha>)(*strict*)\n  apply(clarsimp)\n    (*\n  setA (x @ y1 @ y') = {}\n  G:d:(nat+2)\n    d 0 = \\<Rightarrow> S\n    d (nat+1) = ea \\<Rightarrow> \\<delta>' @ \\<alpha>' @ \\<alpha> @ teA A1 # y1\n    d (nat+2) = A1\\<rightarrow>w1 \\<Rightarrow> \\<delta>' @ \\<alpha>' @ \\<alpha> @ w1 @ y1\n  \\<delta>' @ \\<alpha>' @ \\<eta> = \\<delta> @ [teA A]\n  \\<eta> @ x = \\<alpha> @ w1\n  G:d':(n'+1)\n    d' 0 = \\<Rightarrow> S\n    d' n' = e1 \\<Rightarrow> \\<delta>' @ teA A' # y'\n    d' (n'+1) = A'\\<rightarrow>\\<alpha>'\\<beta>' \\<Rightarrow> \\<delta>' @ \\<alpha>' @ \\<beta>' @ y'\n  Suc 0 \\<le> length \\<alpha>' \\<or> \\<delta>' = []\n  G:d'':m\n    d'' 0 = \\<Rightarrow> \\<beta>' @ y'\n    d'' m = e3 \\<Rightarrow> \\<alpha> @ teA A1 # y1\n*)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule_tac\n      x=\"d'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule_tac\n      x=\"n'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule_tac\n      x=\"e1\"\n      in exI)\n  apply(rule_tac\n      x=\"e2\"\n      in exI)\n  apply(rule_tac\n      x=\"Some \\<lparr>prod_lhs = A1, prod_rhs = w1\\<rparr>\"\n      in exI)\n  apply(rule_tac\n      x=\"\\<delta>'\"\n      in exI)\n  apply(rule_tac\n      x=\"\\<alpha>'\"\n      in exI)\n  apply(rule_tac\n      x=\"\\<beta>'\"\n      in exI)\n  apply(rule_tac\n      x=\"y'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(rule_tac\n      x=\"A'\"\n      in exI)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule_tac\n      x=\"derivation_append d'' (der2 \\<lparr>cfg_conf = \\<alpha> @ teA A1 # y1\\<rparr> \\<lparr>prod_lhs = A1, prod_rhs = w1\\<rparr> \\<lparr>cfg_conf = \\<alpha> @ w1 @ y1\\<rparr>) m\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(rule cfgRM.derivation_concat2)\n      apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n      apply(blast)\n     apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n     apply(blast)\n    apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n    apply(rule cfgRM.der2_is_derivation)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(blast)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(clarsimp)\n   apply(simp add: der2_def)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule_tac\n      x=\"m+Suc 0\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(rule_tac concat_has_max_dom)\n    apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n    apply(blast)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(rule der2_maximum_of_domain)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(clarsimp)\n  apply(simp add: derivation_take_def)\n  apply(simp add: get_label_def derivation_append_def)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"i\\<le>Suc(n'+m)\")\n    apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"i>Suc(n'+m)\")\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"m<i-Suc n'\")\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n  apply(clarsimp)\n  apply(simp add: der2_def)\n  apply(rule conjI)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n   apply(clarsimp)\n   apply(case_tac i)\n    apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m nat)(*strict*)\n   apply(case_tac nat)\n    apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m nat nata)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m nata)(*strict*)\n   apply(subgoal_tac \"nata=n'+m\")\n    apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m nata)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m nata)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"d i\")\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i option b)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m i option b nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m option b nat)(*strict*)\n  apply(subgoal_tac \"Suc nat>Suc (Suc (n'+m))\")\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m option b nat)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m option b nat)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"False\")\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m option b nat)(*strict*)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m option b nat)(*strict*)\n  apply(rule_tac\n      m=\"Suc nat\"\n      and d=\"d\"\n      in cfgRM.no_some_beyond_maximum_of_domain)\n     apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m option b nat)(*strict*)\n     apply(force)\n    apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m option b nat)(*strict*)\n    apply(force)\n   apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m option b nat)(*strict*)\n   apply(force)\n  apply(rename_tac d \\<eta> \\<delta> A ea y1 A1 w1 x \\<alpha> d' n' e1 e2 e3 \\<delta>' \\<alpha>' \\<beta>' y' A' d'' m option b nat)(*strict*)\n  apply(force)\n  done\n\nlemma cfgRM_earliest_word_generated_position: \"\n  cfgRM.derivation G d\n  \\<Longrightarrow> d 0 = Some (pair None c)\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf=w@v\\<rparr>)\n  \\<Longrightarrow> P = (\\<lambda>c. \\<exists>z. w@z=cfg_conf c)\n  \\<Longrightarrow> \\<exists>k\\<le>n. (\\<forall>i<k. \\<not> (case d i of None \\<Rightarrow> False | Some (pair e c) \\<Rightarrow> P c)) \\<and>\n                  (case d k of None \\<Rightarrow> False | Some (pair e c) \\<Rightarrow> P c)\"\n  apply(rule cfgRM.existence_of_earliest_satisfaction_point)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma CFGRM_Nonblockingness2: \"\n  valid_cfg G\n  \\<Longrightarrow> Nonblockingness2 (cfgRM.unmarked_language G) (cfgRM.marked_language G)\"\n  apply(simp add: Nonblockingness2_def)\n  apply(simp add: cfgRM.marked_language_def cfgRM.unmarked_language_def prefix_closure_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x d c)(*strict*)\n  apply(simp add: cfg_marked_effect_def cfg_marking_condition_def cfg_initial_configurations_def cfg_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac x d c e i ca ea cb ia)(*strict*)\n  apply(case_tac cb)\n  apply(rename_tac x d c e i ca ea cb ia cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d c e i ca ea ia cfg_confa)(*strict*)\n  apply(simp add: cfgRM.derivation_initial_def)\n  apply(case_tac \"d 0\")\n   apply(rename_tac x d c e i ca ea ia cfg_confa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x d c e i ca ea ia cfg_confa a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac x d c e i ca ea ia cfg_confa a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n  apply(subgoal_tac \"\\<exists>k\\<le>ia. (\\<forall>i<k. \\<not> (case d i of None \\<Rightarrow> False | Some (pair e c) \\<Rightarrow> (\\<lambda>c. \\<exists>z. (liftB x)@z=cfg_conf c) c)) \\<and> (case d k of None \\<Rightarrow> False | Some (pair e c) \\<Rightarrow> (\\<lambda>c. \\<exists>z. (liftB x)@z=cfg_conf c) c)\")\n   apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n   prefer 2\n   apply(rule_tac\n      e=\"e\"\n      and w=\"liftB x\"\n      and v=\"liftB c\"\n      in cfgRM_earliest_word_generated_position)\n      apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n      apply(force)\n     apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n     apply(force)\n    apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n    apply(clarsimp)\n    apply(case_tac ca)\n    apply(rename_tac x d c e i ca ea ia cfg_confa b cfg_confaa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x d c e i ea ia cfg_conf b)(*strict*)\n    apply(rule liftB_commutes_over_concat)\n   apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n   apply(force)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b k)(*strict*)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(clarsimp)\n  apply(case_tac \"d k\")\n   apply(rename_tac x d c e i ca ea ia cfg_confa b k)(*strict*)\n   apply(force)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b k a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b k a option ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b k option ba z)(*strict*)\n  apply(rule_tac\n      x=\"option\"\n      in exI)\n  apply(rule_tac\n      x=\"ba\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac x d c e i ca ea ia cfg_confa b k option ba z)(*strict*)\n   apply(rule_tac\n      x=\"k\"\n      in exI)\n   apply(force)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b k option ba z)(*strict*)\n  apply(force)\n  done\n\nlemma cfgRM_staysInSigma: \"\n  valid_cfg G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> cfgRM_step_relation G \\<lparr>cfg_conf=w\\<rparr> e \\<lparr>cfg_conf=w'\\<rparr>\n  \\<Longrightarrow> e \\<in> cfg_productions G\n  \\<Longrightarrow> setB w' \\<subseteq> cfg_events G\"\n  apply(simp add: cfgRM_step_relation_def)\n  apply(auto)\n  apply(rename_tac x l r)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac x l r prod_lhsa prod_rhsa)(*strict*)\n  apply(auto)\n  apply(rename_tac x l r prod_lhs prod_rhs)(*strict*)\n  apply(simp add: valid_cfg_def)\n  apply(rename_tac x l r prod_lhsa prod_rhsa)(*strict*)\n  apply(auto)\n  apply(erule_tac\n      x=\"\\<lparr>prod_lhs = prod_lhsa, prod_rhs = prod_rhsa\\<rparr>\"\n      in ballE)\n   apply(rename_tac x l r prod_lhsa prod_rhsa)(*strict*)\n   apply(auto)\n  apply(rename_tac x l r prod_lhs prod_rhs)(*strict*)\n  apply(rename_tac A w)\n  apply(rename_tac x l r A w)(*strict*)\n  apply(rule_tac\n      A=\"setB (l @ w @ r)\"\n      in set_mp)\n   apply(rename_tac x l r A w)(*strict*)\n   apply(rule_tac\n      s=\"setB l \\<union> setB w \\<union> setB r\"\n      and t=\"setB (l @ w @ r)\"\n      in ssubst)\n    apply(rename_tac x l r A w)(*strict*)\n    apply(simp (no_asm) only: setBConcat concat_asso)\n   apply(rename_tac x l r A w)(*strict*)\n   apply(clarsimp)\n   defer\n   apply(clarsimp)\n  apply(rename_tac x l r A w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x l r A w)(*strict*)\n   apply(simp only: setBConcat concat_asso)\n   apply(rule_tac\n      B=\"setB l \\<union> setB (teA A # r)\"\n      in subset_trans)\n    apply(rename_tac x l r A w)(*strict*)\n    apply(blast)\n   apply(rename_tac x l r A w)(*strict*)\n   apply(blast)\n  apply(rename_tac x l r A w)(*strict*)\n  apply(subgoal_tac \"setB (l @ [teA A] @ r) \\<subseteq> cfg_events G\")\n   apply(rename_tac x l r A w)(*strict*)\n   apply(simp only: setBConcat concat_asso)\n   apply(rule_tac\n      B=\"setB l \\<union> setB [teA A] \\<union> setB r\"\n      in subset_trans)\n    apply(rename_tac x l r A w)(*strict*)\n    apply(blast)\n   apply(rename_tac x l r A w)(*strict*)\n   apply(blast)\n  apply(rename_tac x l r A w)(*strict*)\n  apply(auto)\n  done\n\nlemma cfgRM_CFGStepNonTermBehaviour: \"\n  cfgRM_step_relation G \\<lparr>cfg_conf = w1\\<rparr> \\<lparr>prod_lhs=A, prod_rhs=w\\<rparr> \\<lparr>cfg_conf = w2\\<rparr>\n  \\<Longrightarrow> setA w2 \\<subseteq> setA w1 \\<union> setA w\"\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp del: subsetI)\n  apply(rename_tac l r)(*strict*)\n  apply(rule_tac\n      t=\"teA A#r\"\n      and s=\"[teA A]@r\"\n      in ssubst)\n   apply(rename_tac l r)(*strict*)\n   apply(force)\n  apply(rename_tac l r)(*strict*)\n  apply(simp only: setAConcat concat_asso)\n  apply(force)\n  done\n\nlemma cfgRM_staysInAlpha2: \"\n  valid_cfg G\n  \\<Longrightarrow> setA w \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> d i = Some (pair e1 \\<lparr>cfg_conf=w\\<rparr>)\n  \\<Longrightarrow> d (i+j) = Some (pair e2 \\<lparr>cfg_conf=w'\\<rparr>)\n  \\<Longrightarrow> setB w' \\<subseteq> cfg_events G \\<and> setA w' \\<subseteq> cfg_nonterminals G\"\n  apply(subgoal_tac \" \\<forall>e2 w'. d (i+j)=Some (pair e2 \\<lparr>cfg_conf=w'\\<rparr>) \\<longrightarrow> (setA w' \\<subseteq> cfg_nonterminals G \\<and> setB w' \\<subseteq> cfg_events G) \")\n   apply(clarsimp)\n  apply(rule_tac\n      m=\"i\"\n      and n=\"j\"\n      in cfgRM.property_preseved_under_steps_is_invariant2)\n      apply(blast)+\n     apply(clarsimp)\n    apply(arith)\n   apply(arith)\n  apply(rule allI)\n  apply(rename_tac ia)(*strict*)\n  apply(rule impI)\n  apply(erule conjE)+\n  apply(rule allI)+\n  apply(rename_tac ia e2a w'nonterminal)(*strict*)\n  apply(rule impI)\n  apply(subgoal_tac \"\\<exists>e. Some e=e2a\")\n   apply(rename_tac ia e2a w'nonterminal)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d ia = Some (pair e c)\")\n    apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc ia\"\n      in cfgRM.pre_some_position_is_some_position)\n      apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n      apply(blast)\n     apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n     apply(blast)\n    apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n    apply(force)\n   apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac ia e2a w'nonterminal e ea c)(*strict*)\n   apply(case_tac c)\n   apply(rename_tac ia e2a w'nonterminal e ea c cfg_conf)(*strict*)\n   apply(rename_tac cw)\n   apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n   apply(erule_tac\n      x=\"ea\"\n      in allE)\n   apply(erule_tac\n      x=\"cw\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n    apply(blast)\n   apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n   apply(erule conjE)+\n   apply(subgoal_tac \"cfgRM_step_relation G \\<lparr>cfg_conf = cw\\<rparr> e \\<lparr>cfg_conf = w'nonterminal\\<rparr>\")\n    apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n     prefer 2\n     apply(rule_tac\n      w=\"cw\"\n      and e=\"e\"\n      in cfgRM_staysInSigma)\n        apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n        apply(blast)\n       apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n       apply(blast)\n      apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n      apply(blast)\n     apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n     apply(simp add: cfgRM_step_relation_def)\n    apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n    prefer 2\n    apply(rule cfgRM.position_change_due_to_step_relation)\n      apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n      apply(blast)+\n   apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n   apply(case_tac e)\n   apply(rename_tac ia e2a w'nonterminal e ea c cw prod_lhs prod_rhs)(*strict*)\n   apply(clarsimp del: subsetI)\n   apply(rename_tac ia w'nonterminal ea cw prod_lhs prod_rhs)(*strict*)\n   apply(rename_tac Ax wx)\n   apply(rename_tac ia w'nonterminal ea cw Ax wx)(*strict*)\n   apply(rule_tac\n      B=\"setA cw \\<union> setA wx\"\n      in subset_trans)\n    apply(rename_tac ia w'nonterminal ea cw Ax wx)(*strict*)\n    apply(rule cfgRM_CFGStepNonTermBehaviour)\n    apply(blast)\n   apply(rename_tac ia w'nonterminal ea cw Ax wx)(*strict*)\n   apply(clarsimp del: subsetI)\n   apply(rule_tac\n      a=\"Ax\"\n      in prod_rhs_in_nonterms)\n    apply(rename_tac ia w'nonterminal ea cw Ax wx)(*strict*)\n    apply(blast)+\n   apply(rename_tac ia w'nonterminal ea cw Ax wx)(*strict*)\n   apply(simp add: cfgRM_step_relation_def)\n  apply(rename_tac ia e2a w'nonterminal)(*strict*)\n  apply(case_tac e2a)\n   apply(rename_tac ia e2a w'nonterminal)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ia w'nonterminal)(*strict*)\n   apply(rule cfgRM.derivation_Always_PreEdge_prime)\n    apply(rename_tac ia w'nonterminal)(*strict*)\n    apply(blast)+\n  done\n\nlemma cfgRM_staysInSigma2: \"\n  valid_cfg G\n  \\<Longrightarrow> setA w \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> d i = Some (pair e1 \\<lparr>cfg_conf=w\\<rparr>)\n  \\<Longrightarrow> d (i+j) = Some (pair e2 \\<lparr>cfg_conf=w'\\<rparr>)\n  \\<Longrightarrow> setB w' \\<subseteq> cfg_events G\"\n  apply(subgoal_tac \"setB w' \\<subseteq> cfg_events G \\<and> setA w' \\<subseteq> cfg_nonterminals G\")\n   apply(force)\n  apply(rule cfgRM_staysInAlpha2)\n       apply(force)+\n  done\n\nlemma cfgRM_inst_lang_sound: \"\n  (\\<forall>M. valid_cfg M \\<longrightarrow> cfgRM.unmarked_language M \\<subseteq> cfg_effects M)\"\n  apply(simp add: cfg_effects_def cfgRM.unmarked_language_def cfg_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M x xa d e c i z)(*strict*)\n  apply(simp add: cfgRM.derivation_initial_def)\n  apply(case_tac \"d 0\")\n   apply(rename_tac M x xa d e c i z)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac M x xa d e c i z a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac M x xa d e c i z a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M x xa d e c i z b)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac M x xa d e c i z b cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M x xa d e i z b)(*strict*)\n  apply(rule_tac\n      A=\"setB (liftB x @ z)\"\n      in set_mp)\n   apply(rename_tac M x xa d e i z b)(*strict*)\n   prefer 2\n   apply(simp only: concat_asso setBConcat)\n   apply(rule_tac\n      t=\"setB (liftB x)\"\n      and s=\"set x\"\n      in subst)\n    apply(rename_tac M x xa d e i z b)(*strict*)\n    apply(rule liftB_BiElem)\n   apply(rename_tac M x xa d e i z b)(*strict*)\n   apply(force)\n  apply(rename_tac M x xa d e i z b)(*strict*)\n  apply(simp add: cfg_initial_configurations_def)\n  apply(rule_tac\n      j=\"i\"\n      and w=\"[teA (cfg_initial M)]\"\n      in cfgRM_staysInSigma2)\n       apply(rename_tac M x xa d e i z b)(*strict*)\n       apply(force)\n      apply(rename_tac M x xa d e i z b)(*strict*)\n      apply(simp add: valid_cfg_def)\n     apply(rename_tac M x xa d e i z b)(*strict*)\n     apply(force)\n    apply(rename_tac M x xa d e i z b)(*strict*)\n    apply(force)\n   apply(rename_tac M x xa d e i z b)(*strict*)\n   apply(force)\n  apply(rename_tac M x xa d e i z b)(*strict*)\n  apply(force)\n  done\n\nlemma cfgRM_inst_AX_marking_condition_implies_existence_of_effect: \"\n  \\<forall>M. valid_cfg M \\<longrightarrow> (\\<forall>f. cfgRM.derivation_initial M f \\<longrightarrow> cfg_marking_condition M f \\<longrightarrow> cfg_marked_effect M f \\<noteq> {})\"\n  apply(simp add: cfg_marking_condition_def cfg_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M f i e c)(*strict*)\n  apply(simp add: cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"filterB (cfg_conf c)\"\n      in exI)\n  apply(rule_tac\n      x=\"e\"\n      in exI)\n  apply(rule_tac\n      x=\"c\"\n      in exI)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac M f i e c)(*strict*)\n   apply(force)\n  apply(rename_tac M f i e c)(*strict*)\n  apply(rule liftBDeConv2)\n  apply(force)\n  done\n\nlemma cfgRM_inst_AX_string_state_increases: \"\n   \\<forall>G. valid_cfg G \\<longrightarrow>\n        (\\<forall>c1. c1 \\<in> cfg_configurations G \\<longrightarrow>\n              (\\<forall>e c2. cfgRM_step_relation G c1 e c2 \\<longrightarrow>\n                      (\\<exists>w. cfg_get_history c1 @ w = cfg_get_history c2)))\"\n  apply(simp add: cfg_get_history_def maxTermPrefix_def cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac M c1 e c2 l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac M c1 e c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M c1 e l r)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac M c1 e l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M e l r)(*strict*)\n  apply(subgoal_tac \"\\<exists>w1 w2. liftB w1 @ w2 = l \\<and> (case w2 of teB b#list \\<Rightarrow> False | _ \\<Rightarrow> True)\")\n   apply(rename_tac M e l r)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M e r w1 w2)(*strict*)\n   apply(subgoal_tac \"\\<exists>w1 w2. liftB w1 @ w2 = (prod_rhs e@r) \\<and> (case w2 of teB b#list \\<Rightarrow> False | _ \\<Rightarrow> True)\")\n    apply(rename_tac M e r w1 w2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac M e r w1 w2 w1a w2a)(*strict*)\n    apply(rule_tac\n      t=\"(THE y. (\\<exists>w. liftB y @ w = liftB w1 @ w2 @ teA (prod_lhs e) # r) \\<and> (\\<forall>w. liftB y @ w = liftB w1 @ w2 @ teA (prod_lhs e) # r \\<longrightarrow> (case w of [] \\<Rightarrow> True | teA A # y \\<Rightarrow> True | teB X # y \\<Rightarrow> False)))\"\n      and s=\"w1\"\n      in ssubst)\n     apply(rename_tac M e r w1 w2 w1a w2a)(*strict*)\n     apply(case_tac w2)\n      apply(rename_tac M e r w1 w2 w1a w2a)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac M e r w1 w1a w2a)(*strict*)\n      apply(rule maximal_terminal_prefix_THE)\n       apply(rename_tac M e r w1 w1a w2a)(*strict*)\n       apply(rule setA_liftB)\n      apply(rename_tac M e r w1 w1a w2a)(*strict*)\n      apply(rule sym)\n      apply(rule liftBDeConv1)\n     apply(rename_tac M e r w1 w2 w1a w2a a list)(*strict*)\n     apply(case_tac a)\n      apply(rename_tac M e r w1 w2 w1a w2a a list aa)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n      apply(rule maximal_terminal_prefix_THE)\n       apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n       apply(rule setA_liftB)\n      apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n      apply(rule sym)\n      apply(rule liftBDeConv1)\n     apply(rename_tac M e r w1 w2 w1a w2a a list b)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac M e r w1 w2 w1a w2a)(*strict*)\n    apply(case_tac w2)\n     apply(rename_tac M e r w1 w2 w1a w2a)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac M e r w1 w1a w2a)(*strict*)\n     apply(rule_tac\n      t=\"(THE y. (\\<exists>w. liftB y @ w = liftB w1 @ prod_rhs e @ r) \\<and> (\\<forall>w. liftB y @ w = liftB w1 @ prod_rhs e @ r \\<longrightarrow> (case w of [] \\<Rightarrow> True | teA A # y \\<Rightarrow> True | teB X # y \\<Rightarrow> False)))\"\n      and s=\"w1@w1a\"\n      in ssubst)\n      apply(rename_tac M e r w1 w1a w2a)(*strict*)\n      apply(case_tac w2a)\n       apply(rename_tac M e r w1 w1a w2a)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac M e r w1 w1a)(*strict*)\n       apply(rule_tac\n      t=\"prod_rhs e @ r\"\n      and s=\"liftB w1a\"\n      in ssubst)\n        apply(rename_tac M e r w1 w1a)(*strict*)\n        apply(force)\n       apply(rename_tac M e r w1 w1a)(*strict*)\n       apply(rule maximal_terminal_prefix_THE_prime)\n        apply(rename_tac M e r w1 w1a)(*strict*)\n        apply(thin_tac \"liftB w1a = prod_rhs e @ r\")\n        apply(simp only: setAConcat concat_asso setBConcat)\n        apply(clarsimp)\n        apply(rule conjI)\n         apply(rename_tac M e r w1 w1a)(*strict*)\n         apply(rule setA_liftB)\n        apply(rename_tac M e r w1 w1a)(*strict*)\n        apply(rule setA_liftB)\n       apply(rename_tac M e r w1 w1a)(*strict*)\n       apply(rule_tac\n      t=\"filterB (liftB w1 @ liftB w1a)\"\n      and s=\"filterB (liftB w1) @ (filterB (liftB w1a))\"\n      in ssubst)\n        apply(rename_tac M e r w1 w1a)(*strict*)\n        apply(rule filterB_commutes_over_concat)\n       apply(rename_tac M e r w1 w1a)(*strict*)\n       apply(rule_tac\n      t=\"filterB (liftB w1)\"\n      and s=\"w1\"\n      in ssubst)\n        apply(rename_tac M e r w1 w1a)(*strict*)\n        apply(rule liftBDeConv1)\n       apply(rename_tac M e r w1 w1a)(*strict*)\n       apply(rule_tac\n      t=\"filterB (liftB w1a)\"\n      and s=\"w1a\"\n      in ssubst)\n        apply(rename_tac M e r w1 w1a)(*strict*)\n        apply(rule liftBDeConv1)\n       apply(rename_tac M e r w1 w1a)(*strict*)\n       apply(clarsimp)\n      apply(rename_tac M e r w1 w1a w2a a list)(*strict*)\n      apply(case_tac a)\n       apply(rename_tac M e r w1 w1a w2a a list aa)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac M e r w1 w1a list aa)(*strict*)\n       apply(rule_tac\n      t=\"prod_rhs e @ r\"\n      and s=\"liftB w1a @ teA aa # list\"\n      in ssubst)\n        apply(rename_tac M e r w1 w1a list aa)(*strict*)\n        apply(force)\n       apply(rename_tac M e r w1 w1a list aa)(*strict*)\n       apply(thin_tac \"liftB w1a @ teA aa # list=prod_rhs e@r\")\n       apply(rule_tac\n      t=\"liftB w1 @ liftB w1a @ teA aa # list\"\n      and s=\"(liftB w1 @ liftB w1a) @ teA aa # list\"\n      in ssubst)\n        apply(rename_tac M e r w1 w1a list aa)(*strict*)\n        apply(force)\n       apply(rename_tac M e r w1 w1a list aa)(*strict*)\n       apply(rule_tac\n      t=\"liftB w1 @ liftB w1a\"\n      and s=\"liftB (w1@w1a)\"\n      in ssubst)\n        apply(rename_tac M e r w1 w1a list aa)(*strict*)\n        apply(rule sym)\n        apply(rule liftB_commutes_over_concat)\n       apply(rename_tac M e r w1 w1a list aa)(*strict*)\n       apply(rule maximal_terminal_prefix_THE)\n        apply(rename_tac M e r w1 w1a list aa)(*strict*)\n        apply(rule setA_liftB)\n       apply(rename_tac M e r w1 w1a list aa)(*strict*)\n       apply(rule sym)\n       apply(rule liftBDeConv1)\n      apply(rename_tac M e r w1 w1a w2a a list b)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac M e r w1 w1a w2a)(*strict*)\n     apply(force)\n    apply(rename_tac M e r w1 w2 w1a w2a a list)(*strict*)\n    apply(case_tac a)\n     apply(rename_tac M e r w1 w2 w1a w2a a list aa)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n     apply(rule_tac\n      t=\"(THE y. (\\<exists>w. liftB y @ w = liftB w1 @ teA aa # list @ prod_rhs e @ r) \\<and> (\\<forall>w. liftB y @ w = liftB w1 @ teA aa # list @ prod_rhs e @ r \\<longrightarrow> (case w of [] \\<Rightarrow> True | teA A # y \\<Rightarrow> True | teB X # y \\<Rightarrow> False)))\"\n      and s=\"w1\"\n      in ssubst)\n      apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n      apply(rule maximal_terminal_prefix_THE)\n       apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n       apply(rule setA_liftB)\n      apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n      apply(rule sym)\n      apply(rule liftBDeConv1)\n     apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac M e r w1 w2 w1a w2a a list b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac M e r w1 w2)(*strict*)\n   apply(rule maxSplit)\n  apply(rename_tac M e l r)(*strict*)\n  apply(rule maxSplit)\n  done\n\nlemma cfgRM_inst_ATS_axioms: \"\n  ATS_Language_axioms valid_cfg cfg_initial_configurations\n     cfgRM_step_relation cfg_effects cfg_marking_condition cfg_marked_effect\n     cfg_unmarked_effect\"\n  apply(simp add: ATS_Language_axioms_def)\n  apply(simp add: cfgBASE_inst_AX_effect_inclusion1 cfgRM_inst_AX_unmarked_effect_persists cfgRM_inst_lang_sound cfgRM_inst_AX_marking_condition_implies_existence_of_effect )\n  done\n\nlemma cfgRM_inst_ATS_String_State_Modification_axioms: \"\n  ATS_String_State_Modification_axioms valid_cfg cfg_configurations cfgRM_step_relation False cfg_get_history\"\n  apply(simp add: ATS_String_State_Modification_axioms_def)\n  apply(rule cfgRM_inst_AX_string_state_increases)\n  done\n\ninterpretation \"cfgRM\" : loc_cfg_1\n  (* TSstructure *)\n  \"valid_cfg\"\n  (* configurations *)\n  \"cfg_configurations\"\n  (* initial_configurations *)\n  \"cfg_initial_configurations\"\n  (* step_labels *)\n  \"cfg_step_labels\"\n  (* step_relation *)\n  \"cfgRM_step_relation\"\n  (* effects *)\n  \"cfg_effects\"\n  (* marking_condition *)\n  \"cfg_marking_condition\"\n  (* marked_effect *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect *)\n  \"cfg_unmarked_effect\"\n  (* destinations *)\n  \"cfg_destination\"\n  (* get_destinations *)\n  \"cfg_get_destinations\"\n  (* decreasing *)\n  \"False\"\n  (* string_state *)\n  \"cfg_get_history\"\n  apply(simp add: LOCALE_DEFS_ALL LOCALE_DEFS_cfg)\n  apply(simp add: cfgBASE_inst_AX_initial_configuration_belongs cfgRM_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: cfgRM_inst_ATS_String_State_Modification_axioms cfgRM_inst_ATS_axioms )\n  done\n\nlemma cfgRM_inst_Nonblockingness2: \"\n  \\<forall>M. valid_cfg M \\<longrightarrow> Nonblockingness2 (cfgRM.unmarked_language M) (cfgRM.marked_language M)\"\n  apply(rule allI)\n  apply(rename_tac M)(*strict*)\n  apply(clarsimp)\n  apply(rule CFGRM_Nonblockingness2)\n  apply(force)\n  done\n\nlemma cfgRM_terminals_at_beginning_are_never_modified: \"\n  cfgRM.derivation G d\n  \\<Longrightarrow> maximum_of_domain d (m + n)\n  \\<Longrightarrow> d m = Some (pair e1 \\<lparr>cfg_conf = (liftB b) @ w\\<rparr>)\n  \\<Longrightarrow> m \\<le> x\n  \\<Longrightarrow> x \\<le> m + n\n  \\<Longrightarrow> \\<exists>e w. d x = Some (pair e \\<lparr>cfg_conf = (liftB b) @ w\\<rparr>)\"\n  apply(rule cfgRM.property_preseved_under_steps_is_invariant2)\n      apply(blast)+\n  apply(auto)\n  apply(rename_tac i e wa)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n   apply(rename_tac i e wa)(*strict*)\n   apply(clarsimp, case_tac c)\n   apply(rename_tac i e wa ea c cfg_conf)(*strict*)\n   apply(subgoal_tac \"cfgRM_step_relation G \\<lparr>cfg_conf = (liftB b) @ wa\\<rparr> ea c\")\n    apply(rename_tac i e wa ea c cfg_conf)(*strict*)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(auto)\n    apply(rename_tac i e wa ea l r)(*strict*)\n    apply(case_tac l)\n     apply(rename_tac i e wa ea l r)(*strict*)\n     apply(auto)\n     apply(rename_tac i e wa ea r)(*strict*)\n     apply(case_tac b)\n      apply(rename_tac i e wa ea r)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac i e wa ea r a list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac i e wa ea r a list)(*strict*)\n    defer\n    apply(rename_tac i e wa ea cfg_conf)(*strict*)\n    apply(rule cfgRM.position_change_due_to_step_relation)\n      apply(rename_tac i e wa ea cfg_conf)(*strict*)\n      apply(blast)+\n   apply(rename_tac i e wa)(*strict*)\n   apply(rule cfgRM.some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac i e wa)(*strict*)\n     apply(blast)+\n   apply(rename_tac i e wa)(*strict*)\n   apply(arith)\n  apply(rename_tac i e wa ea r a list)(*strict*)\n  apply(subgoal_tac \"prefix (liftB b) (a#list) \\<or> prefix (a#list) (liftB b)\")\n   apply(rename_tac i e wa ea r a list)(*strict*)\n   prefer 2\n   apply(rule_tac\n      b=\"wa\"\n      and d=\"teA (prod_lhs ea) # r\"\n      in mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac i e wa ea r a list)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac i e wa ea r a list)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   apply(rule_tac\n      t=\"a # list @ prod_rhs ea @ r\"\n      and s=\"(a # list) @ prod_rhs ea @ r\"\n      in ssubst)\n    apply(rename_tac i e wa ea r a list c)(*strict*)\n    apply(force)\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   apply(rule_tac\n      t=\"a#list\"\n      and s=\"liftB b @ c\"\n      in ssubst)\n    apply(rename_tac i e wa ea r a list c)(*strict*)\n    apply(force)\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   apply(simp (no_asm_use))\n  apply(rename_tac i e wa ea r a list)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac i e wa ea r a list c)(*strict*)\n  apply(subgoal_tac \"(a # list @ c) @ wa = a # list @ teA (prod_lhs ea) # r\")\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   prefer 2\n   apply(simp (no_asm_simp))\n  apply(rename_tac i e wa ea r a list c)(*strict*)\n  apply(subgoal_tac \"c @ wa = teA (prod_lhs ea) # r\")\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   prefer 2\n   apply(simp (no_asm_use))\n  apply(rename_tac i e wa ea r a list c)(*strict*)\n  apply(case_tac c)\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i e ea r a list)(*strict*)\n   apply(rule_tac\n      x=\"prod_rhs ea @ r\"\n      in exI)\n   apply(simp (no_asm_simp))\n  apply(rename_tac i e wa ea r a list c aa lista)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i e wa ea a list lista)(*strict*)\n  apply(rule_tac\n      w=\"a # list @ teA (prod_lhs ea) # lista\"\n      and v=\"liftB b\"\n      in unequal_setA)\n   apply(rename_tac i e wa ea a list lista)(*strict*)\n   apply(force)\n  apply(rename_tac i e wa ea a list lista)(*strict*)\n  apply(rule_tac\n      t=\"setA (liftB b)\"\n      and s=\"{}\"\n      in ssubst)\n   apply(rename_tac i e wa ea a list lista)(*strict*)\n   apply(rule setA_liftB)\n  apply(rename_tac i e wa ea a list lista)(*strict*)\n  apply(rule_tac\n      t=\"a # list @ teA (prod_lhs ea) # lista\"\n      and s=\"[a] @ list @ [teA (prod_lhs ea)] @ lista\"\n      in ssubst)\n   apply(rename_tac i e wa ea a list lista)(*strict*)\n   apply(force)\n  apply(rename_tac i e wa ea a list lista)(*strict*)\n  apply(simp (no_asm) only: setAConcat concat_asso)\n  apply(force)\n  done\n\nlemma cfgRM_inst_Nonblockingness_branching_correspond1: \"\n  (\\<forall>M. valid_cfg M \\<longrightarrow> cfgRM.Nonblockingness_branching M \\<longrightarrow> nonblockingness_language (cfgRM.unmarked_language M) (cfgRM.marked_language M))\"\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: cfgRM.Nonblockingness_branching_def)\n  apply(simp add: nonblockingness_language_def cfgRM.unmarked_language_def prefix_closure_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac M xa d)(*strict*)\n  apply(subgoal_tac \"cfgRM.belongs M d\")\n   apply(rename_tac M xa d)(*strict*)\n   prefer 2\n   apply(rule cfgRM.derivation_initial_belongs)\n    apply(rename_tac M xa d)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d)(*strict*)\n   apply(force)\n  apply(rename_tac M xa d)(*strict*)\n  apply(subgoal_tac \"\\<exists>v. v \\<in> cfgRM.marked_language M \\<and> (\\<exists>c. xa @ c = v)\")\n   apply(rename_tac M xa d)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac M xa d)(*strict*)\n  apply(simp add: cfg_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z)(*strict*)\n  apply(erule_tac\n      x=\"derivation_take d i\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M xa d e c i z)(*strict*)\n   apply(rename_tac M xa d e c i z)(*strict*)\n   apply(simp add: cfgRM.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac M xa d e c i z)(*strict*)\n    apply(rule cfgRM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac M xa d e c i z)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac M xa d e c i z)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M xa d e c i z)(*strict*)\n   apply(rule maximum_of_domain_derivation_take)\n   apply(force)\n  apply(rename_tac M xa d e c i z)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. dc 0 = Some (pair None c)\")\n   apply(rename_tac M xa d e c i z dc x)(*strict*)\n   prefer 2\n   apply(rule cfgRM.some_position_has_details_at_0)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x ca)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n   apply(rename_tac M xa d e c i z dc x ca)(*strict*)\n   prefer 2\n   apply(rule cfgRM.some_position_has_details_at_0)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n  apply(subgoal_tac \"cfgRM.derivation M (derivation_append (derivation_take d i) dc i)\")\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   prefer 2\n   apply(simp add: cfgRM.derivation_initial_def)\n   apply(rule cfgRM.derivation_append_preserves_derivation)\n     apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n     apply(rule cfgRM.derivation_take_preserves_derivation)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   apply(simp add: derivation_take_def)\n   apply(simp add: derivation_append_fit_def)\n  apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n  apply(subgoal_tac \"maximum_of_domain (derivation_append (derivation_take d i) dc i) (i + x)\")\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   prefer 2\n   apply(rule concat_has_max_dom)\n    apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n    apply(rule maximum_of_domain_derivation_take)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. (derivation_append (derivation_take d i) dc i) (i+x) = Some (pair e c)\")\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   prefer 2\n   apply(rule_tac\n      n=\"i+x\"\n      in cfgRM.some_position_has_details_before_max_dom)\n     apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x ca cb ea cc)(*strict*)\n  apply(case_tac cc)\n  apply(rename_tac M xa d e c i z dc x ca cb ea cc cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x ca cb ea cfg_confa)(*strict*)\n  apply(rename_tac w)\n  apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n  apply(rule_tac\n      x=\"filterB w\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n   apply(simp add: cfgRM.marked_language_def)\n   apply(rule_tac\n      x=\"derivation_append (derivation_take d i) dc i\"\n      in exI)\n   apply(clarsimp)\n   apply(rule context_conjI)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n    apply(rule cfgRM.derivation_append_preserves_derivation_initial)\n      apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n      apply(force)\n     apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n     apply(rule cfgRM.derivation_take_preserves_derivation_initial)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n   apply(simp add: cfg_marked_effect_def)\n   apply(rule_tac\n      x=\"ea\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>cfg_conf = w\\<rparr>\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: cfg_marking_condition_def)\n   apply(clarsimp)\n   apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n   apply(simp add: cfg_marking_configuration_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"ia=i+x\")\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"derivation_append (derivation_take d i) dc i\"\n      in cfgRM.maximum_of_domainUnique)\n      apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n      apply(force)\n     apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n    apply(simp add: maximum_of_domain_def)\n    apply(case_tac \"derivation_append (derivation_take d i) dc i (Suc ia) = None\")\n     apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. (derivation_append (derivation_take d i) dc i) ia = Some (pair e1 c1) \\<and> (derivation_append (derivation_take d i) dc i) (Suc ia) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation M c1 e2 c2\")\n     apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc ia\"\n      in cfgRM.step_detail_before_some_position)\n       apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n       apply(simp add: cfgRM.derivation_initial_def)\n      apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n      apply(force)\n     apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc ya e2 c2)(*strict*)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc ya e2 c2 l r)(*strict*)\n    apply(subgoal_tac \"prod_lhs e2 \\<in> setA (l @ teA (prod_lhs e2) # r)\")\n     apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc ya e2 c2 l r)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc ya e2 c2 l r)(*strict*)\n    apply(simp only: setAConcat concat_asso setBConcat)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M xa d e c i z dc x ca cb w eb)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac M xa d e c i z dc x ca cb w eb)(*strict*)\n    apply(rule_tac\n      x=\"i+x\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac M xa d e c i z dc x ca cb w eb)(*strict*)\n   apply(rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n  apply(subgoal_tac \"\\<exists>e w. (derivation_append (derivation_take d i) dc i) (i+x) = Some (pair e \\<lparr>cfg_conf = (liftB xa) @ w\\<rparr>)\")\n   apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n   prefer 2\n   apply(rule cfgRM_terminals_at_beginning_are_never_modified)\n       apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n       apply(force)\n      apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n      apply(force)\n     apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n     apply(simp add: derivation_append_def derivation_take_def derivation_append_fit_def)\n     apply(clarsimp)\n     apply(rename_tac M xa d e i z dc x ca cb ea w)(*strict*)\n     apply(case_tac ca)\n     apply(rename_tac M xa d e i z dc x ca cb ea w cfg_confa)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac M xa d e i z dc x cb ea w)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x ca cb ea wa)(*strict*)\n  apply(rule_tac\n      x=\"filterB wa\"\n      in exI)\n  apply(rule_tac\n      t=\"filterB (liftB xa @ wa)\"\n      and s=\"filterB (liftB xa) @ filterB wa\"\n      in ssubst)\n   apply(rename_tac M xa d e c i z dc x ca cb ea wa)(*strict*)\n   apply(rule filterB_commutes_over_concat)\n  apply(rename_tac M xa d e c i z dc x ca cb ea wa)(*strict*)\n  apply(clarsimp)\n  apply(rule sym)\n  apply(rule liftBDeConv1)\n  done\n\nlemma cfgRM_inst_lang_finite: \"\n  (\\<forall>G. valid_cfg G \\<longrightarrow> cfgRM.finite_marked_language G = cfgRM.marked_language G)\"\n  apply(clarsimp)\n  apply(rename_tac G)(*strict*)\n  apply(rule order_antisym)\n   apply(rename_tac G)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G x)(*strict*)\n   apply(simp add: cfgRM.marked_language_def cfgRM.finite_marked_language_def)\n   apply(clarsimp)\n   apply(rename_tac G x d xa)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: cfgRM.derivation_initial_def)\n  apply(rename_tac G)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G x)(*strict*)\n  apply(simp add: cfgRM.marked_language_def cfgRM.finite_marked_language_def)\n  apply(clarsimp)\n  apply(rename_tac G x d)(*strict*)\n  apply(simp add: cfg_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G x d e c i)(*strict*)\n  apply(rule_tac\n      x=\"derivation_take d i\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac G x d e c i)(*strict*)\n   apply(simp add: cfgRM.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac G x d e c i)(*strict*)\n    apply(rule cfgRM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac G x d e c i)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac G x d e c i)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac G x d e c i)(*strict*)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac G x d e c i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G x d e c i ea ca ia)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G x d e c i ea ca ia)(*strict*)\n   apply(simp add: cfg_marking_condition_def)\n   apply(clarsimp)\n   apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(simp add: derivation_take_def)\n   apply(simp add: cfg_marking_configuration_def)\n   apply(clarsimp)\n   apply(case_tac \"ia \\<le> i\")\n    apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n    prefer 2\n    apply(clarsimp)\n   apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n   apply(clarsimp)\n   apply(rule cfgRM.belongs_configurations)\n    apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n    apply(rule cfgRM.derivation_initial_belongs)\n     apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n     apply(force)\n    apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n    apply(force)\n   apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n   apply(force)\n  apply(rename_tac G x d e c i ea ca ia)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(rule maximum_of_domain_derivation_take)\n  apply(force)\n  done\n\nlemma cfgRM_inst_AX_unmarked_language_finite: \"\n  (\\<forall>G. valid_cfg G \\<longrightarrow> cfgRM.finite_unmarked_language G = cfgRM.unmarked_language G)\"\n  apply(clarsimp)\n  apply(rename_tac G)(*strict*)\n  apply(rule order_antisym)\n   apply(rename_tac G)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G x)(*strict*)\n   apply(simp add: cfgRM.unmarked_language_def cfgRM.finite_unmarked_language_def)\n   apply(clarsimp)\n   apply(rename_tac G x d xa)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: cfgRM.derivation_initial_def)\n  apply(rename_tac G)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G x)(*strict*)\n  apply(simp add: cfgRM.unmarked_language_def cfgRM.finite_unmarked_language_def)\n  apply(clarsimp)\n  apply(rename_tac G x d)(*strict*)\n  apply(simp add: cfg_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G x d e c i z)(*strict*)\n  apply(rule_tac\n      x=\"derivation_take d i\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac G x d e c i z)(*strict*)\n   apply(simp add: cfgRM.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac G x d e c i z)(*strict*)\n    apply(rule cfgRM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac G x d e c i z)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac G x d e c i z)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac G x d e c i z)(*strict*)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac G x d e c i z)(*strict*)\n    apply(rule_tac\n      x=\"i\"\n      in exI)\n    apply(simp add: derivation_take_def)\n   apply(rename_tac G x d e c i z)(*strict*)\n   apply(force)\n  apply(rename_tac G x d e c i z)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(rule maximum_of_domain_derivation_take)\n  apply(force)\n  done\n\nlemma cfgRM_inst_accept: \"\n  (\\<forall>G d. cfgRM.derivation_initial G d \\<longrightarrow> cfg_marking_condition G d = (\\<exists>i e c. d i = Some (pair e c) \\<and> c \\<in> cfg_marking_configuration G))\"\n  apply(clarsimp)\n  apply(rename_tac G d)(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  done\n\nlemma cfgRM_inst_ATS_Language_by_Finite_Derivations_axioms: \"\n  ATS_Language_by_Finite_Derivations_axioms valid_cfg\n     cfg_initial_configurations cfgRM_step_relation cfg_marking_condition\n     cfg_marked_effect cfg_unmarked_effect\"\n  apply(simp add: ATS_Language_by_Finite_Derivations_axioms_def)\n  apply(rule conjI)\n   apply (metis cfgRM_inst_lang_finite)\n  apply (metis cfgRM_inst_AX_unmarked_language_finite)\n  done\n\nlemma cfgRM_inst_BF_Bra_OpLa_axioms: \"\n  BF_Bra_OpLa_axioms valid_cfg cfg_configurations\n     cfg_initial_configurations cfg_step_labels cfgRM_step_relation\n     cfg_marking_condition cfg_marked_effect cfg_unmarked_effect\"\n  apply(simp add: BF_Bra_OpLa_axioms_def)\n  apply (metis cfgRM_inst_Nonblockingness_branching_correspond1)\n  done\n\nlemma cfgRM_inst_AX_marked_configuration_effect_coincides_with_marked_effect: \"\n(\\<forall>G. valid_cfg G \\<longrightarrow>\n         (\\<forall>d. ATS.derivation_initial cfg_initial_configurations\n               cfgRM_step_relation G d \\<longrightarrow>\n              cfg_marked_effect G d =\n              \\<Union>{cfg_marked_configuration_effect G c |c.\n                 (\\<exists>i e. d i = Some (pair e c)) \\<and>\n                 c \\<in> cfg_marking_configuration G}))\"\n  apply(clarsimp)\n  apply(rename_tac G d)(*strict*)\n  apply(simp add: cfg_marked_effect_def cfg_marking_configuration_def cfg_marked_configuration_effect_def)\n  apply(rule antisym)\n   apply(rename_tac G d)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G d x e c i)(*strict*)\n   apply(rule_tac\n      x=\"{x}\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac G d x e c i)(*strict*)\n    apply(rule antisym)\n     apply(rename_tac G d x e c i)(*strict*)\n     apply(force)\n    apply(rename_tac G d x e c i)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G d x e c i xa)(*strict*)\n    apply (metis liftB_inj)\n   apply(rename_tac G d x e c i)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac G d x e c i)(*strict*)\n    apply(force)\n   apply(rename_tac G d x e c i)(*strict*)\n   apply(rule cfgRM.belongs_configurations)\n    apply(rename_tac G d x e c i)(*strict*)\n    apply(rule cfgRM.derivation_initial_belongs)\n     apply(rename_tac G d x e c i)(*strict*)\n     apply(force)\n    apply(rename_tac G d x e c i)(*strict*)\n    apply(force)\n   apply(rename_tac G d x e c i)(*strict*)\n   apply(force)\n  apply(rename_tac G d)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G d x c i e)(*strict*)\n  apply(rule_tac\n      x=\"e\"\n      in exI)\n  apply(rule_tac\n      x=\"c\"\n      in exI)\n  apply(force)\n  done\n\nlemma cfgRM_inst_AX_unmarked_configuration_effect_coincides_with_unmarked_effect: \"\n (\\<forall>G. valid_cfg G \\<longrightarrow>\n         (\\<forall>d. ATS.derivation_initial cfg_initial_configurations\n               cfgRM_step_relation G d \\<longrightarrow>\n              cfg_unmarked_effect G d =\n              \\<Union>{cfg_unmarked_configuration_effect G c |c.\n                 \\<exists>i e. d i = Some (pair e c)}))\"\n  apply(clarsimp)\n  apply(rename_tac G d)(*strict*)\n  apply(simp add: cfg_unmarked_effect_def)\n  apply(rule antisym)\n   apply(rename_tac G d)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G d x e c i z)(*strict*)\n   apply(rule_tac\n      x=\"cfg_unmarked_configuration_effect G c\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac G d x e c i z)(*strict*)\n    apply(rule_tac\n      x=\"c\"\n      in exI)\n    apply(force)\n   apply(rename_tac G d x e c i z)(*strict*)\n   apply(simp add: cfg_unmarked_configuration_effect_def)\n   apply(rule_tac\n      x=\"z\"\n      in exI)\n   apply(force)\n  apply(rename_tac G d)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G d x c i e)(*strict*)\n  apply(rule_tac\n      x=\"e\"\n      in exI)\n  apply(rule_tac\n      x=\"c\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G d x c i e)(*strict*)\n   apply(force)\n  apply(rename_tac G d x c i e)(*strict*)\n  apply(simp add: cfg_unmarked_configuration_effect_def)\n  apply(force)\n  done\n\ninterpretation \"cfgRM\" : loc_cfg_2\n  (* TSstructure *)\n  \"valid_cfg\"\n  (* configurations *)\n  \"cfg_configurations\"\n  (* initial_configurations *)\n  \"cfg_initial_configurations\"\n  (* step_labels *)\n  \"cfg_step_labels\"\n  (* step_relation *)\n  \"cfgRM_step_relation\"\n  (* effects *)\n  \"cfg_effects\"\n  (* marking_condition *)\n  \"cfg_marking_condition\"\n  (* marked_effect *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect *)\n  \"cfg_unmarked_effect\"\n  (* destinations *)\n  \"cfg_destination\"\n  (* get_destinations *)\n  \"cfg_get_destinations\"\n  (* decreasing *)\n  \"False\"\n  (* string_state *)\n  \"cfg_get_history\"\n  apply(simp add: LOCALE_DEFS_ALL LOCALE_DEFS_cfg)\n  apply(simp add: cfgBASE_inst_AX_initial_configuration_belongs cfgRM_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: cfgRM_inst_ATS_String_State_Modification_axioms cfgRM_inst_ATS_axioms )\n  apply(simp add: cfgRM_inst_ATS_Language_by_Finite_Derivations_axioms cfgRM_inst_BF_Bra_OpLa_axioms )\n  done\n\nlemma cfgRM_inst_Nonblockingness_branching_correspond2d: \"\n  valid_cfg M\n  \\<Longrightarrow> cfgRM.is_forward_deterministic M\n  \\<Longrightarrow> nonblockingness_language (cfgRM.unmarked_language M) (cfgRM.marked_language M)\n  \\<Longrightarrow> cfgRM.Nonblockingness_branching M\"\n  apply(simp add: nonblockingness_language_def)\n  apply(simp add: cfgRM.Nonblockingness_branching_def)\n  apply(clarsimp)\n  apply(rename_tac dh n)(*strict*)\n  apply(case_tac \"dh n\")\n   apply(rename_tac dh n)(*strict*)\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac dh n a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac dh n a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n option b)(*strict*)\n  apply(case_tac b)\n  apply(rename_tac dh n option b cfg_conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n option cfg_conf)(*strict*)\n  apply(rename_tac e w)\n  apply(rename_tac dh n e w)(*strict*)\n  apply(subgoal_tac \"\\<exists>v. (maxTermPrefix w)@v \\<in> cfgRM.marked_language M\")\n   apply(rename_tac dh n e w)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"(maxTermPrefix w) \\<in> (prefix_closure (cfgRM.marked_language M))\")\n    apply(rename_tac dh n e w)(*strict*)\n    apply(simp add: prefix_closure_def prefix_def)\n    apply(force)\n   apply(rename_tac dh n e w)(*strict*)\n   apply(subgoal_tac \"(maxTermPrefix w) \\<in> cfgRM.unmarked_language M\")\n    apply(rename_tac dh n e w)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w)(*strict*)\n   apply(simp add: cfgRM.unmarked_language_def)\n   apply(rule_tac\n      x=\"dh\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac dh n e w)(*strict*)\n    prefer 2\n    apply(simp add: cfgRM.derivation_initial_def)\n   apply(rename_tac dh n e w)(*strict*)\n   apply(simp add: cfg_unmarked_effect_def)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>cfg_conf=w\\<rparr>\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac dh n e w)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w)(*strict*)\n   apply(rule maxTermPrefix_prefix)\n  apply(rename_tac dh n e w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v)(*strict*)\n  apply(thin_tac \"cfgRM.unmarked_language M \\<subseteq> (prefix_closure (cfgRM.marked_language M))\")\n  apply(simp add: cfgRM.marked_language_def)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d)(*strict*)\n  apply(simp add: cfg_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i)(*strict*)\n  apply(simp add: cfgRM.derivation_initial_def)\n  apply(clarsimp)\n  apply(case_tac \"d 0\")\n   apply(rename_tac dh n e w v d ea c i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"dh 0\")\n   apply(rename_tac dh n e w v d ea c i a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i a aa)(*strict*)\n  apply(clarsimp)\n  apply(case_tac aa)\n  apply(rename_tac dh n e w v d ea c i a aa option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i a b)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac dh n e w v d ea c i a b option ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i b ba)(*strict*)\n  apply(simp add: cfg_initial_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac dh n e w v d ea c i cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"n\\<le>i\")\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(case_tac \"n>i\")\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"dh i = d i\")\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. dh i = Some (pair e1 c1) \\<and> dh (Suc i) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation M c1 e2 c2\")\n      apply(rename_tac dh n e w v d ea i)(*strict*)\n      prefer 2\n      apply(rule_tac\n      m=\"n\"\n      in cfgRM.step_detail_before_some_position)\n        apply(rename_tac dh n e w v d ea i)(*strict*)\n        apply(simp add: cfgRM.derivation_initial_def)\n       apply(rename_tac dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac dh n e w v d ea i e2 c2)(*strict*)\n     apply(simp add: cfgRM_step_relation_def)\n     apply(clarsimp)\n     apply(rename_tac dh n e w v d ea i e2 c2 l r)(*strict*)\n     apply(simp only: setAConcat concat_asso setBConcat)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(rule sym)\n    apply(rule_tac\n      n=\"i\"\n      and m=\"n\"\n      and ?d1.0=\"d\"\n      and ?d2.0=\"dh\"\n      and x=\"0\"\n      and y=\"0\"\n      in cfgRM.is_forward_deterministic_derivations_coincide)\n             apply(rename_tac dh n e w v d ea i)(*strict*)\n             apply(force)\n            apply(rename_tac dh n e w v d ea i)(*strict*)\n            apply(force)\n           apply(rename_tac dh n e w v d ea i)(*strict*)\n           apply(force)\n          apply(rename_tac dh n e w v d ea i)(*strict*)\n          apply(force)\n         apply(rename_tac dh n e w v d ea i)(*strict*)\n         apply(force)\n        apply(rename_tac dh n e w v d ea i)(*strict*)\n        apply(force)\n       apply(rename_tac dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(rule_tac\n      x=\"derivation_drop (derivation_take d i) n\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(rule_tac\n      m=\"i-n\"\n      in cfgRM.derivation_drop_preserves_derivation_prime)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(rule cfgRM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d n = Some (pair e c)\")\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"i\"\n      in cfgRM.pre_some_position_is_some_position)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(blast)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(blast)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(rule_tac cfgRM.derivation_drop_preserves_belongs)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(rule cfgRM.derivation_take_preserves_derivation)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(rule_tac cfgRM.derivation_take_preserves_belongs)\n    apply(rule cfgRM.derivation_initial_belongs)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def)\n    apply(simp add: cfg_initial_configurations_def)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(simp add: derivation_take_def)\n   apply(force)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(rule_tac\n      x=\"i-n\"\n      in exI)\n   apply(simp add: maximum_of_domain_def derivation_drop_def derivation_take_def)\n   apply(clarsimp)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"dh n = d n\")\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(rule sym)\n   apply(rule_tac\n      n=\"n\"\n      and m=\"n\"\n      and ?d1.0=\"d\"\n      and ?d2.0=\"dh\"\n      and x=\"0\"\n      and y=\"0\"\n      in cfgRM.is_forward_deterministic_derivations_coincide)\n            apply(rename_tac dh n e w v d ea i)(*strict*)\n            apply(force)\n           apply(rename_tac dh n e w v d ea i)(*strict*)\n           apply(force)\n          apply(rename_tac dh n e w v d ea i)(*strict*)\n          apply(force)\n         apply(rename_tac dh n e w v d ea i)(*strict*)\n         apply(force)\n        apply(rename_tac dh n e w v d ea i)(*strict*)\n        apply(force)\n       apply(rename_tac dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(simp add: derivation_append_fit_def derivation_drop_def derivation_take_def)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n  apply(simp add: cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"i=ia\")\n   apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n   prefer 2\n   apply(case_tac \"i=ia\")\n    apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n   apply(case_tac \"i<ia\")\n    apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> d (Suc i) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation M c1 e2 c2\")\n     apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"ia\"\n      in cfgRM.step_detail_before_some_position)\n       apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n       apply(simp add: cfgRM.derivation_initial_def)\n      apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n      apply(force)\n     apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac dh n e w v d ea i ia eb c e2 c2)(*strict*)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac dh n e w v d ea i ia eb c e2 c2 l r)(*strict*)\n    apply(simp only: setAConcat concat_asso setBConcat)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d ia = Some (pair e1 c1) \\<and> d (Suc ia) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation M c1 e2 c2\")\n    apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"i\"\n      in cfgRM.step_detail_before_some_position)\n      apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n      apply(simp add: cfgRM.derivation_initial_def)\n     apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac dh n e w v d ea i ia eb c e2 c2)(*strict*)\n   apply(simp add: cfgRM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac dh n e w v d ea i ia eb c e2 c2 l r)(*strict*)\n   apply(simp only: setAConcat concat_asso setBConcat)\n   apply(force)\n  apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea ia)(*strict*)\n  apply(rule_tac\n      x=\"ia\"\n      in exI)\n  apply(simp add: derivation_append_def derivation_drop_def derivation_take_def)\n  apply(clarsimp)\n  done\n\nlemma cfgRM_inst_BF_Bra_DetR_LaOp_axioms: \"\n  BF_Bra_DetR_LaOp_axioms valid_cfg cfg_configurations\n     cfg_initial_configurations cfg_step_labels cfgRM_step_relation\n     cfg_marking_condition cfg_marked_effect cfg_unmarked_effect\"\n  apply(simp add: BF_Bra_DetR_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: nonblockingness_language_def)\n  apply(simp add: cfgRM.Nonblockingness_branching_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n)(*strict*)\n  apply(case_tac \"dh n\")\n   apply(rename_tac M dh n)(*strict*)\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac M dh n a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac M dh n a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n option b)(*strict*)\n  apply(case_tac b)\n  apply(rename_tac M dh n option b cfg_conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n option cfg_conf)(*strict*)\n  apply(rename_tac e w)\n  apply(rename_tac M dh n e w)(*strict*)\n  apply(subgoal_tac \"\\<exists>v. (maxTermPrefix w)@v \\<in> cfgRM.marked_language M\")\n   apply(rename_tac M dh n e w)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"(maxTermPrefix w) \\<in> (prefix_closure (cfgRM.marked_language M))\")\n    apply(rename_tac M dh n e w)(*strict*)\n    apply(simp add: prefix_closure_def prefix_def)\n    apply(clarsimp)\n    apply(rename_tac M dh n e w c)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w)(*strict*)\n   apply(subgoal_tac \"(maxTermPrefix w) \\<in> cfgRM.unmarked_language M\")\n    apply(rename_tac M dh n e w)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w)(*strict*)\n   apply(simp add: cfgRM.unmarked_language_def)\n   apply(rule_tac\n      x=\"dh\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac M dh n e w)(*strict*)\n    prefer 2\n    apply(simp add: cfgRM.derivation_initial_def)\n   apply(rename_tac M dh n e w)(*strict*)\n   apply(simp add: cfg_unmarked_effect_def)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>cfg_conf=w\\<rparr>\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac M dh n e w)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w)(*strict*)\n   apply(rule maxTermPrefix_prefix)\n  apply(rename_tac M dh n e w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v)(*strict*)\n  apply(thin_tac \" cfgRM.unmarked_language M \\<subseteq> (prefix_closure (cfgRM.marked_language M))\")\n  apply(simp add: cfgRM.marked_language_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d)(*strict*)\n  apply(simp add: cfg_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i)(*strict*)\n  apply(subgoal_tac \"case dh 0 of None \\<Rightarrow> False | Some (pair a b) \\<Rightarrow> b \\<in> cfg_initial_configurations M \\<and> a = None\")\n   apply(rename_tac M dh n e w v d ea c i)(*strict*)\n   prefer 2\n   apply(simp add: cfgRM.derivation_initial_def)\n  apply(rename_tac M dh n e w v d ea c i)(*strict*)\n  apply(subgoal_tac \"case_option False (case_derivation_configuration (\\<lambda>a b. b \\<in> cfg_initial_configurations M \\<and> a = None)) (d 0)\")\n   apply(rename_tac M dh n e w v d ea c i)(*strict*)\n   prefer 2\n   apply(simp add: cfgRM.derivation_initial_def)\n  apply(rename_tac M dh n e w v d ea c i)(*strict*)\n  apply(case_tac \"d 0\")\n   apply(rename_tac M dh n e w v d ea c i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"dh 0\")\n   apply(rename_tac M dh n e w v d ea c i a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i a aa)(*strict*)\n  apply(clarsimp)\n  apply(case_tac aa)\n  apply(rename_tac M dh n e w v d ea c i a aa option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i a b)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac M dh n e w v d ea c i a b option ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i b ba)(*strict*)\n  apply(simp add: cfg_initial_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac M dh n e w v d ea c i cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"n\\<le>i\")\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(case_tac \"n>i\")\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"dh i = d i\")\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. dh i = Some (pair e1 c1) \\<and> dh (Suc i) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation M c1 e2 c2\")\n      apply(rename_tac M dh n e w v d ea i)(*strict*)\n      prefer 2\n      apply(rule_tac\n      m=\"n\"\n      in cfgRM.step_detail_before_some_position)\n        apply(rename_tac M dh n e w v d ea i)(*strict*)\n        apply(simp add: cfgRM.derivation_initial_def)\n       apply(rename_tac M dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac M dh n e w v d ea i e2 c2)(*strict*)\n     apply(simp add: cfgRM_step_relation_def)\n     apply(clarsimp)\n     apply(rename_tac M dh n e w v d ea i e2 c2 l r)(*strict*)\n     apply(simp only: setAConcat concat_asso setBConcat)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(rule sym)\n    apply(rule_tac\n      n=\"i\"\n      and m=\"n\"\n      and ?d1.0=\"d\"\n      and ?d2.0=\"dh\"\n      and x=\"0\"\n      and y=\"0\"\n      in cfgRM.is_forward_deterministic_accessible_derivations_coincide)\n             apply(rename_tac M dh n e w v d ea i)(*strict*)\n             apply(force)\n            apply(rename_tac M dh n e w v d ea i)(*strict*)\n            apply(force)\n           apply(rename_tac M dh n e w v d ea i)(*strict*)\n           apply(force)\n          apply(rename_tac M dh n e w v d ea i)(*strict*)\n          apply(force)\n         apply(rename_tac M dh n e w v d ea i)(*strict*)\n         apply(force)\n        apply(rename_tac M dh n e w v d ea i)(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(rule_tac\n      x=\"derivation_drop (derivation_take d i) n\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(rule_tac\n      m=\"i-n\"\n      in cfgRM.derivation_drop_preserves_derivation_prime)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(rule cfgRM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d n = Some (pair e c)\")\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"i\"\n      in cfgRM.pre_some_position_is_some_position)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(blast)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(blast)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(rule_tac cfgRM.derivation_drop_preserves_belongs)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(rule cfgRM.derivation_take_preserves_derivation)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(rule_tac cfgRM.derivation_take_preserves_belongs)\n    apply(rule cfgRM.derivation_initial_belongs)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(simp add: cfg_initial_configurations_def)\n   apply(simp add: derivation_take_def)\n   apply(force)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(rule_tac\n      x=\"i-n\"\n      in exI)\n   apply(simp add: maximum_of_domain_def derivation_drop_def derivation_take_def)\n   apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"dh n = d n\")\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(rule sym)\n   apply(rule_tac\n      n=\"n\"\n      and m=\"n\"\n      and ?d1.0=\"d\"\n      and ?d2.0=\"dh\"\n      and x=\"0\"\n      and y=\"0\"\n      in cfgRM.is_forward_deterministic_accessible_derivations_coincide)\n            apply(rename_tac M dh n e w v d ea i)(*strict*)\n            apply(force)\n           apply(rename_tac M dh n e w v d ea i)(*strict*)\n           apply(force)\n          apply(rename_tac M dh n e w v d ea i)(*strict*)\n          apply(force)\n         apply(rename_tac M dh n e w v d ea i)(*strict*)\n         apply(force)\n        apply(rename_tac M dh n e w v d ea i)(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(simp add: derivation_append_fit_def derivation_drop_def derivation_take_def)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n  apply(simp add: cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"i=ia\")\n   apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n   prefer 2\n   apply(case_tac \"i=ia\")\n    apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n   apply(case_tac \"i<ia\")\n    apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> d (Suc i) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation M c1 e2 c2\")\n     apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"ia\"\n      in cfgRM.step_detail_before_some_position)\n       apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n       apply(simp add: cfgRM.derivation_initial_def)\n      apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac M dh n e w v d ea i ia eb c e2 c2)(*strict*)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac M dh n e w v d ea i ia eb c e2 c2 l r)(*strict*)\n    apply(simp only: setAConcat concat_asso setBConcat)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d ia = Some (pair e1 c1) \\<and> d (Suc ia) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation M c1 e2 c2\")\n    apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"i\"\n      in cfgRM.step_detail_before_some_position)\n      apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n      apply(simp add: cfgRM.derivation_initial_def)\n     apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M dh n e w v d ea i ia eb c e2 c2)(*strict*)\n   apply(simp add: cfgRM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac M dh n e w v d ea i ia eb c e2 c2 l r)(*strict*)\n   apply(simp only: setAConcat concat_asso setBConcat)\n   apply(force)\n  apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea ia)(*strict*)\n  apply(rule_tac\n      x=\"ia\"\n      in exI)\n  apply(simp add: derivation_append_def derivation_drop_def derivation_take_def)\n  apply(clarsimp)\n  done\n\ninterpretation \"cfgRM\" : loc_cfg_3\n  (* TSstructure *)\n  \"valid_cfg\"\n  (* configurations *)\n  \"cfg_configurations\"\n  (* initial_configurations *)\n  \"cfg_initial_configurations\"\n  (* step_labels *)\n  \"cfg_step_labels\"\n  (* step_relation *)\n  \"cfgRM_step_relation\"\n  (* effects *)\n  \"cfg_effects\"\n  (* marking_condition *)\n  \"cfg_marking_condition\"\n  (* marked_effect *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect *)\n  \"cfg_unmarked_effect\"\n  (* destinations *)\n  \"cfg_destination\"\n  (* get_destinations *)\n  \"cfg_get_destinations\"\n  (* decreasing *)\n  \"False\"\n  (* string_state *)\n  \"cfg_get_history\"\n  apply(simp add: LOCALE_DEFS_ALL LOCALE_DEFS_cfg)\n  apply(simp add: cfgBASE_inst_AX_initial_configuration_belongs cfgRM_inst_AX_step_relation_preserves_belongs cfgRM_inst_ATS_String_State_Modification_axioms cfgRM_inst_ATS_axioms cfgRM_inst_ATS_Language_by_Finite_Derivations_axioms cfgRM_inst_BF_Bra_OpLa_axioms cfgRM_inst_BF_Bra_DetR_LaOp_axioms )\n  done\n\nlemma CFGRM0_is_forward_target_deterministic: \"\n  valid_cfg M\n  \\<Longrightarrow> cfgRM.is_forward_target_deterministic M\"\n  apply(simp add: cfgRM.is_forward_target_deterministic_def)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac c c1 c2 e l r la ra)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac c c1 c2 e l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c1 c2 e l r la ra)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac c1 c2 e l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c2 e l r la ra)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac c2 e l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac e l r la ra)(*strict*)\n  apply(subgoal_tac \"r=ra\")\n   apply(rename_tac e l r la ra)(*strict*)\n   apply(force)\n  apply(rename_tac e l r la ra)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac e l r la ra prod_lhsa prod_rhs)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac l r la ra prod_lhs prod_rhs)(*strict*)\n  apply(rename_tac w v)\n  apply(rename_tac l r la ra w v)(*strict*)\n  apply(thin_tac \"valid_cfg M\")\n  apply(thin_tac \"\\<lparr>prod_lhs = w, prod_rhs = v\\<rparr> \\<in> cfg_productions M\")\n  apply(rule sym)\n  apply(rule terminalTailEquals1)\n    apply(rename_tac l r la ra w v)(*strict*)\n    apply(force)\n   apply(rename_tac l r la ra w v)(*strict*)\n   apply(force)\n  apply(rename_tac l r la ra w v)(*strict*)\n  apply(force)\n  done\n\nlemma CFGRM_Nonblockingness_is_lang_notempty: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.Nonblockingness_branching G\n  \\<Longrightarrow> cfgRM.marked_language G \\<noteq> {}\"\n  apply(simp add: cfgRM.marked_language_def cfgRM.Nonblockingness_branching_def)\n  apply(erule_tac\n      x=\"der1 \\<lparr>cfg_conf = [teA (cfg_initial G)]\\<rparr>\"\n      in allE)\n  apply(erule impE)\n   apply(simp add: cfgRM.derivation_initial_def)\n   apply(rule conjI)\n    apply(simp add: cfgRM.der1_is_derivation)\n   apply(simp add: der1_def)\n   apply(simp add: cfg_initial_configurations_def)\n   apply(simp add: cfg_configurations_def)\n   apply(rule cfg_initial_in_nonterms)\n   apply(force)\n  apply(erule_tac\n      x=\"0\"\n      in allE)\n  apply(erule impE)\n   apply(rule der1_maximum_of_domain)\n  apply(clarsimp)\n  apply(rename_tac dc n')(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac dc n' i e c)(*strict*)\n  apply(simp add: cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(simp add: cfg_marked_effect_def)\n  apply(case_tac c)\n  apply(rename_tac dc n' i e c cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dc n' i e cfg_confa)(*strict*)\n  apply(rename_tac x)\n  apply(rename_tac dc n' i e x)(*strict*)\n  apply(rule_tac\n      x=\"filterB x\"\n      in exI)\n  apply(rule_tac\n      x=\"derivation_append (der1 \\<lparr>cfg_conf = [teA (cfg_initial G)]\\<rparr>) dc 0\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac dc n' i e x)(*strict*)\n   apply(rule cfgRM.derivation_append_preserves_derivation)\n     apply(rename_tac dc n' i e x)(*strict*)\n     apply(rule cfgRM.der1_is_derivation)\n    apply(rename_tac dc n' i e x)(*strict*)\n    apply(force)\n   apply(rename_tac dc n' i e x)(*strict*)\n   apply(simp add: der1_def)\n   apply(case_tac \"dc 0\")\n    apply(rename_tac dc n' i e x)(*strict*)\n    apply(clarsimp)\n    apply(simp add: cfgRM.derivation_def)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n   apply(rename_tac dc n' i e x a)(*strict*)\n   apply(case_tac \"dc 0\")\n    apply(rename_tac dc n' i e x a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac dc n' i e x a aa)(*strict*)\n   apply(simp add: cfgRM.derivation_def)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac dc n' i e x a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac dc n' i e x a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac dc n' i e x option b)(*strict*)\n   apply(case_tac option)\n    apply(rename_tac dc n' i e x option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac dc n' i e x b)(*strict*)\n    apply(simp add: derivation_append_fit_def)\n   apply(rename_tac dc n' i e x option b a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac dc n' i e x)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac dc n' i e x)(*strict*)\n   apply(simp add: derivation_append_def)\n   apply(case_tac i)\n    apply(rename_tac dc n' i e x)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac dc n' e x)(*strict*)\n    apply(rule_tac\n      x=\"e\"\n      in exI)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"\\<lparr>cfg_conf=x\\<rparr>\"\n      in exI)\n    apply(clarsimp)\n    apply(rule conjI)\n     apply(rename_tac dc n' e x)(*strict*)\n     apply(rule_tac\n      x=\"0\"\n      in exI)\n     apply(clarsimp)\n    apply(rename_tac dc n' e x)(*strict*)\n    apply(rule liftBDeConv2)\n    apply(force)\n   apply(rename_tac dc n' i e x nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac dc n' e x nat)(*strict*)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>cfg_conf=x\\<rparr>\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac dc n' e x nat)(*strict*)\n    apply(rule_tac\n      x=\"Suc nat\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac dc n' e x nat)(*strict*)\n   apply(rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac dc n' i e x)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac dc n' i e x)(*strict*)\n   apply(simp add: cfgRM.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac dc n' i e x)(*strict*)\n    apply(rule cfgRM.derivation_append_preserves_derivation)\n      apply(rename_tac dc n' i e x)(*strict*)\n      apply(rule cfgRM.der1_is_derivation)\n     apply(rename_tac dc n' i e x)(*strict*)\n     apply(force)\n    apply(rename_tac dc n' i e x)(*strict*)\n    apply(simp add: der1_def)\n    apply(case_tac \"dc 0\")\n     apply(rename_tac dc n' i e x)(*strict*)\n     apply(clarsimp)\n     apply(simp add: cfgRM.derivation_def)\n     apply(erule_tac\n      x=\"0\"\n      in allE)\n     apply(clarsimp)\n    apply(rename_tac dc n' i e x a)(*strict*)\n    apply(case_tac \"dc 0\")\n     apply(rename_tac dc n' i e x a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac dc n' i e x a aa)(*strict*)\n    apply(simp add: cfgRM.derivation_def)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n    apply(rename_tac dc n' i e x a)(*strict*)\n    apply(case_tac a)\n    apply(rename_tac dc n' i e x a option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac dc n' i e x option b)(*strict*)\n    apply(case_tac option)\n     apply(rename_tac dc n' i e x option b)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac dc n' i e x b)(*strict*)\n     apply(simp add: derivation_append_fit_def)\n    apply(rename_tac dc n' i e x option b a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac dc n' i e x)(*strict*)\n   apply(simp add: derivation_append_def der1_def)\n   apply(simp add: cfg_initial_configurations_def)\n   apply(simp add: cfg_configurations_def)\n   apply(rule cfg_initial_in_nonterms)\n   apply(force)\n  apply(rename_tac dc n' i e x)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(clarsimp)\n  done\n\nlemma cfgRM_no_step_without_nonterms: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> setA (cfg_conf c) = {}\n  \\<Longrightarrow> d (Suc n) = None\"\n  apply(case_tac \"d (Suc n)\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> d (Suc n) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\")\n   apply(rename_tac option b)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc n\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac option b)(*strict*)\n     apply(force)\n    apply(rename_tac option b)(*strict*)\n    apply(force)\n   apply(rename_tac option b)(*strict*)\n   apply(force)\n  apply(rename_tac option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b e2)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac b e2 l r)(*strict*)\n  apply(simp only: setAConcat concat_asso)\n  apply(force)\n  done\n\ninterpretation \"cfgRM_cfgRM_ATS_Bisimulation_Configuration_Weak\" : ATS_Bisimulation_Configuration_Weak\n  (* TSstructure1 *)\n  \"valid_cfg\"\n  (* configurations1 *)\n  \"cfg_configurations\"\n  (* initial_configurations1 *)\n  \"cfg_initial_configurations\"\n  (* step_labels1 *)\n  \"cfg_step_labels\"\n  (* step_relation1 *)\n  \"cfgRM_step_relation\"\n  (* effects1 *)\n  \"cfg_effects\"\n  (* marking_condition1 *)\n  \"cfg_marking_condition\"\n  (* marked_effect1 *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect1 *)\n  \"cfg_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_cfg\"\n  (* configurations2 *)\n  \"cfg_configurations\"\n  (* initial_configurations2 *)\n  \"cfg_initial_configurations\"\n  (* step_labels2 *)\n  \"cfg_step_labels\"\n  (* step_relation2 *)\n  \"cfgRM_step_relation\"\n  (* effects2 *)\n  \"cfg_effects\"\n  (* marking_condition2 *)\n  \"cfg_marking_condition\"\n  (* marked_effect2 *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect2 *)\n  \"cfg_unmarked_effect\"\n  apply(simp add: LOCALE_DEFS_ALL LOCALE_DEFS_cfg ATS_Bisimulation_Configuration_Weak_def)\n  apply(simp add: cfgBASE_inst_AX_initial_configuration_belongs cfgRM_inst_AX_step_relation_preserves_belongs cfgRM_inst_ATS_String_State_Modification_axioms cfgRM_inst_ATS_axioms )\n  done\n\nlemma CFGRM_terminals_stay_at_end: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> setA w = {}\n  \\<Longrightarrow> d i = Some (pair e1 \\<lparr>cfg_conf=v@w\\<rparr>)\n  \\<Longrightarrow> d j = Some (pair e2 \\<lparr>cfg_conf=x\\<rparr>)\n  \\<Longrightarrow> i\\<le>j\n  \\<Longrightarrow> suffix x w\"\n  apply(induct \"j-i\" arbitrary: j e2 x)\n   apply(rename_tac j e2 x)(*strict*)\n   apply(clarsimp)\n   apply(simp add: suffix_def)\n  apply(rename_tac xa j e2 x)(*strict*)\n  apply(clarsimp)\n  apply(case_tac j)\n   apply(rename_tac xa j e2 x)(*strict*)\n   apply(force)\n  apply(rename_tac xa j e2 x nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa e2 x nat)(*strict*)\n  apply(erule_tac\n      x=\"nat\"\n      in meta_allE)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> d (Suc nat) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\")\n   apply(rename_tac xa e2 x nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac xa e2 x nat)(*strict*)\n     apply(force)\n    apply(rename_tac xa e2 x nat)(*strict*)\n    apply(force)\n   apply(rename_tac xa e2 x nat)(*strict*)\n   apply(force)\n  apply(rename_tac xa e2 x nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n  apply(erule_tac\n      x=\"e1a\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"cfg_conf c1\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule meta_impE)\n   apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n   apply(force)\n  apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n   apply(force)\n  apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n  apply(simp add: suffix_def)\n  apply(clarsimp)\n  apply(rename_tac xa x nat e1a e2a c1 c)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a e2a c1 c l r)(*strict*)\n  apply(case_tac \"e2a\")\n  apply(rename_tac xa nat e1a e2a c1 c l r prod_lhsa prod_rhsa)(*strict*)\n  apply(rename_tac A w1)\n  apply(rename_tac xa nat e1a e2a c1 c l r A w1)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a c1 c l r A w1)(*strict*)\n  apply(subgoal_tac \"suffix r w\")\n   apply(rename_tac xa nat e1a c1 c l r A w1)(*strict*)\n   prefer 2\n   apply(rule_tac\n      l=\"[]\"\n      and v=\"c\"\n      and A=\"A\"\n      and w=\"l\"\n      in suffix_tails_terminal)\n     apply(rename_tac xa nat e1a c1 c l r A w1)(*strict*)\n     apply(force)\n    apply(rename_tac xa nat e1a c1 c l r A w1)(*strict*)\n    apply(force)\n   apply(rename_tac xa nat e1a c1 c l r A w1)(*strict*)\n   apply(force)\n  apply(rename_tac xa nat e1a c1 c l r A w1)(*strict*)\n  apply(simp add: suffix_def)\n  apply(clarsimp)\n  done\n\nlemma cfgRM_derivation_map_preserves_derivation: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> cfgRM.derivation G (derivation_map d (\\<lambda>v. \\<lparr>cfg_conf = w1 @ (cfg_conf v)\\<rparr>))\"\n  apply(simp (no_asm) add: cfgRM.derivation_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_map_def)\n   apply(simp add: cfgRM.derivation_def)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n   apply(case_tac \"d 0\")\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac i nat)(*strict*)\n   apply(simp add: derivation_map_def)\n  apply(rename_tac i nat a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> d (Suc nat) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\")\n   apply(rename_tac i nat a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac i nat a)(*strict*)\n     apply(force)\n    apply(rename_tac i nat a)(*strict*)\n    apply(force)\n   apply(rename_tac i nat a)(*strict*)\n   apply(force)\n  apply(rename_tac i nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n  apply(simp add: derivation_map_def)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n  apply(rule_tac\n      x=\"w1@l\"\n      in exI)\n  apply(rule_tac\n      x=\"r\"\n      in exI)\n  apply(clarsimp)\n  done\n\nlemma cfgRM_derivation_map_preserves_belongs: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> cfgRM.belongs G d\n  \\<Longrightarrow> setA w1 \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB w1 \\<subseteq> cfg_events G\n  \\<Longrightarrow> cfgRM.belongs G (derivation_map d (\\<lambda>v. \\<lparr>cfg_conf = w1 @ cfg_conf v\\<rparr>))\"\n  apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n   apply(clarsimp)\n   apply(rename_tac c)(*strict*)\n   apply(rule_tac\n      ca=\"\\<lparr>cfg_conf = w1 @ cfg_conf c\\<rparr>\"\n      in cfgRM.derivation_belongs)\n      apply(rename_tac c)(*strict*)\n      prefer 4\n      apply(rule cfgRM_derivation_map_preserves_derivation)\n       apply(rename_tac c)(*strict*)\n       apply(force)+\n    apply(rename_tac c)(*strict*)\n    apply(simp add: derivation_map_def)\n   apply(rename_tac c)(*strict*)\n   apply(subgoal_tac \"c \\<in> cfg_configurations G\")\n    apply(rename_tac c)(*strict*)\n    apply(simp add: cfg_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac ca)(*strict*)\n    apply (metis setA_app setB_app)\n   apply(rename_tac c)(*strict*)\n   apply (metis cfgRM.belongs_configurations)\n  apply (metis cfgRM.some_position_has_details_at_0)\n  done\n\nlemma CFGRM_drop_head_terminals_preserves_derivation: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> maximum_of_domain d m\n  \\<Longrightarrow> \\<forall>k \\<le> m. (\\<forall>e c. d k = Some (pair e c) \\<longrightarrow> (\\<exists>w. cfg_conf c = liftB v @ w))\n  \\<Longrightarrow> cfgRM.derivation G (derivation_map d (\\<lambda>c. \\<lparr>cfg_conf = drop (length v) (cfg_conf c)\\<rparr>))\"\n  apply(simp (no_asm) add: cfgRM.derivation_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n    apply(simp add: derivation_map_def)\n    apply(clarsimp)\n   apply (metis cfgRM.some_position_has_details_at_0)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(simp add: derivation_map_def)\n  apply(rename_tac nat a)(*strict*)\n  apply(subgoal_tac \"Suc nat \\<le> m\")\n   apply(rename_tac nat a)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> d (Suc nat) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\")\n    apply(rename_tac nat a)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc nat\"\n      in cfgRM.step_detail_before_some_position)\n      apply(rename_tac nat a)(*strict*)\n      apply(force)\n     apply(rename_tac nat a)(*strict*)\n     apply(force)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n   apply(simp add: derivation_map_def)\n   apply(simp add: cfgRM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n   apply(subgoal_tac \"\\<forall>e c. d nat = Some (pair e c) \\<longrightarrow> (\\<exists>w. cfg_conf c = liftB v @ w)\")\n    apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n    apply(subgoal_tac \"\\<forall>e c. d (Suc nat) = Some (pair e c) \\<longrightarrow> (\\<exists>w. cfg_conf c = liftB v @ w)\")\n     apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac nat e1 e2 c1 c2 l r w)(*strict*)\n     apply(subgoal_tac \"prefix l (liftB v) \\<or> prefix (liftB v) l\")\n      apply(rename_tac nat e1 e2 c1 c2 l r w)(*strict*)\n      prefer 2\n      apply(rule mutual_prefix_prefix)\n      apply(force)\n     apply(rename_tac nat e1 e2 c1 c2 l r w)(*strict*)\n     apply(case_tac \"liftB v \\<sqsubseteq> l\")\n      apply(rename_tac nat e1 e2 c1 c2 l r w)(*strict*)\n      apply(clarsimp)\n      apply(simp add: prefix_def)\n      apply(clarsimp)\n      apply(rename_tac nat e1 e2 c1 c2 r c)(*strict*)\n      apply(rule_tac\n      t=\"length (liftB v)\"\n      and s=\"length v\"\n      in ssubst)\n       apply(rename_tac nat e1 e2 c1 c2 r c)(*strict*)\n       apply (metis liftB_reflects_length)\n      apply(rename_tac nat e1 e2 c1 c2 r c)(*strict*)\n      apply(clarsimp)\n      apply(rule_tac\n      s=\"length (liftB v)\"\n      and t=\"length v\"\n      in ssubst)\n       apply(rename_tac nat e1 e2 c1 c2 r c)(*strict*)\n       apply (simp add: liftB_reflects_length)\n      apply(rename_tac nat e1 e2 c1 c2 r c)(*strict*)\n      apply(rule_tac\n      t=\"drop (length (liftB v)) (liftB v)\"\n      and s=\"[]\"\n      in ssubst)\n       apply(rename_tac nat e1 e2 c1 c2 r c)(*strict*)\n       apply(force)\n      apply(rename_tac nat e1 e2 c1 c2 r c)(*strict*)\n      apply(clarsimp)\n      apply(rule_tac\n      x=\"c\"\n      in exI)\n      apply(rule_tac\n      x=\"r\"\n      in exI)\n      apply(clarsimp)\n     apply(rename_tac nat e1 e2 c1 c2 l r w)(*strict*)\n     apply(clarsimp)\n     apply(simp add: prefix_def)\n     apply(clarsimp)\n     apply(rename_tac nat e1 e2 c1 c2 l r w c)(*strict*)\n     apply(erule_tac\n      x=\"[]\"\n      in allE)\n     apply(clarsimp)\n     apply(subgoal_tac \"\\<exists>l'. liftB l'=l\")\n      apply(rename_tac nat e1 e2 c1 c2 l r w c)(*strict*)\n      apply(subgoal_tac \"\\<exists>c'. liftB c'=c\")\n       apply(rename_tac nat e1 e2 c1 c2 l r w c)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac nat e1 e2 c1 c2 r w l' c')(*strict*)\n       apply(subgoal_tac \"l'@c'=v\")\n        apply(rename_tac nat e1 e2 c1 c2 r w l' c')(*strict*)\n        apply(clarsimp)\n        apply(case_tac c')\n         apply(rename_tac nat e1 e2 c1 c2 r w l' c')(*strict*)\n         apply(force)\n        apply(rename_tac nat e1 e2 c1 c2 r w l' c' a list)(*strict*)\n        apply(subgoal_tac \"False\")\n         apply(rename_tac nat e1 e2 c1 c2 r w l' c' a list)(*strict*)\n         apply(force)\n        apply(rename_tac nat e1 e2 c1 c2 r w l' c' a list)(*strict*)\n        apply(clarsimp)\n        apply(rename_tac nat e1 e2 c1 c2 r w l' a list)(*strict*)\n        apply(subgoal_tac \"teA (prod_lhs e2) # r = liftB (a # list) @ w\")\n         apply(rename_tac nat e1 e2 c1 c2 r w l' a list)(*strict*)\n         apply(clarsimp)\n        apply(rename_tac nat e1 e2 c1 c2 r w l' a list)(*strict*)\n        apply (metis append_Cons concat_asso list.simps(3) maxTermPrefix_drop_tail maxTermPrefix_shift maxTermPrefix_term_string self_append_conv)\n       apply(rename_tac nat e1 e2 c1 c2 r w l' c')(*strict*)\n       apply (metis liftB_commutes_over_concat liftB_inj)\n      apply(rename_tac nat e1 e2 c1 c2 l r w c)(*strict*)\n      apply (metis liftB_commutes_over_concat append_injective2 maxTermPrefix_shift maxTermPrefix_term_string)\n     apply(rename_tac nat e1 e2 c1 c2 l r w c)(*strict*)\n     apply (metis setA_liftB setA_setmp_concat_1 liftBDeConv2 all_not_in_conv bot_apply empty_subsetI ex_in_conv)\n    apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n    apply(erule_tac\n      x=\"Suc nat\"\n      in allE)\n    apply(clarsimp)\n   apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n   apply(erule_tac\n      x=\"nat\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac nat a)(*strict*)\n  apply (metis cfgRM.allPreMaxDomSome_prime not_Some_eq)\n  done\n\ndefinition cfgRM_produce_and_eliminate_from :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> 'nonterminal\n  \\<Rightarrow> 'event list set\"\n  where\n    \"cfgRM_produce_and_eliminate_from G A \\<equiv>\n  {w. \\<exists>d.\n    cfgRM.derivation G d\n    \\<and> cfgRM.belongs G d\n    \\<and> d 0 = Some (pair None \\<lparr>cfg_conf = [teA A]\\<rparr>)\n    \\<and> (\\<exists>i e. d i = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>))}\"\n\nlemma cfgRM_produce_and_eliminate_from_concatenate: \"\n  valid_cfg G\n  \\<Longrightarrow> w1 \\<in> cfgRM_produce_and_eliminate_from G B\n  \\<Longrightarrow> w2 \\<in> cfgRM_produce_and_eliminate_from G A\n  \\<Longrightarrow> \\<lparr>prod_lhs = C, prod_rhs = [teA B, teA A]\\<rparr> \\<in> cfg_productions G\n  \\<Longrightarrow> w1 @ w2 \\<in> cfgRM_produce_and_eliminate_from G C\"\n  apply(simp add: cfgRM_produce_and_eliminate_from_def)\n  apply(clarsimp)\n  apply(rename_tac d da i e ia ea)(*strict*)\n  apply(subgoal_tac \"\\<exists>dA nA eA. cfgRM.derivation G dA \\<and> cfgRM.belongs G dA \\<and> maximum_of_domain dA nA \\<and> dA 0 = Some (pair None \\<lparr>cfg_conf = [teA A]\\<rparr>) \\<and> dA nA = Some (pair eA \\<lparr>cfg_conf = liftB w2\\<rparr>) \")\n   apply(rename_tac d da i e ia ea)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"derivation_take da ia\"\n      in exI)\n   apply(rule_tac\n      x=\"ia\"\n      in exI)\n   apply(rule_tac\n      x=\"ea\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d da i e ia ea)(*strict*)\n    apply(rule cfgRM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac d da i e ia ea)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d da i e ia ea)(*strict*)\n    apply(rule cfgRM.derivation_take_preserves_belongs)\n    apply(force)\n   apply(rename_tac d da i e ia ea)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d da i e ia ea)(*strict*)\n    apply(rule maximum_of_domain_derivation_take)\n    apply(force)\n   apply(rename_tac d da i e ia ea)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d da i e ia ea)(*strict*)\n    apply(simp add: derivation_take_def)\n   apply(rename_tac d da i e ia ea)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac d da i e ia ea)(*strict*)\n  apply(subgoal_tac \"\\<exists>dB nB eB. cfgRM.derivation G dB \\<and> cfgRM.belongs G dB \\<and> maximum_of_domain dB nB \\<and> dB 0 = Some (pair None \\<lparr>cfg_conf = [teA B]\\<rparr>) \\<and> dB nB = Some (pair eB \\<lparr>cfg_conf = liftB w1\\<rparr>) \")\n   apply(rename_tac d da i e ia ea)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"derivation_take d i\"\n      in exI)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d da i e ia ea)(*strict*)\n    apply(rule cfgRM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac d da i e ia ea)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d da i e ia ea)(*strict*)\n    apply(rule cfgRM.derivation_take_preserves_belongs)\n    apply(force)\n   apply(rename_tac d da i e ia ea)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d da i e ia ea)(*strict*)\n    apply(rule maximum_of_domain_derivation_take)\n    apply(force)\n   apply(rename_tac d da i e ia ea)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d da i e ia ea)(*strict*)\n    apply(simp add: derivation_take_def)\n   apply(rename_tac d da i e ia ea)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac d da i e ia ea)(*strict*)\n  apply(thin_tac \"cfgRM.derivation G d\")\n  apply(thin_tac \"cfgRM.derivation G da\")\n  apply(thin_tac \"cfgRM.belongs G d\")\n  apply(thin_tac \"cfgRM.belongs G da\")\n  apply(thin_tac \"d 0 = Some (pair None \\<lparr>cfg_conf = [teA B]\\<rparr>)\")\n  apply(thin_tac \"d i = Some (pair e \\<lparr>cfg_conf = liftB w1\\<rparr>)\")\n  apply(thin_tac \"da 0 = Some (pair None \\<lparr>cfg_conf = [teA A]\\<rparr>)\")\n  apply(thin_tac \"da ia = Some (pair ea \\<lparr>cfg_conf = liftB w2\\<rparr>)\")\n  apply(erule exE)+\n  apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n  apply(erule conjE)+\n  apply(rule_tac\n      x=\"derivation_append (der2 \\<lparr>cfg_conf=[teA C]\\<rparr> \\<lparr>prod_lhs = C, prod_rhs = [teA B, teA A]\\<rparr> \\<lparr>cfg_conf=[teA B, teA A]\\<rparr>) (derivation_append (derivation_map dA (\\<lambda>v. \\<lparr>cfg_conf = [teA B] @ (cfg_conf v)\\<rparr>)) (derivation_map dB (\\<lambda>v. \\<lparr>cfg_conf = (cfg_conf v) @ (liftB w2)\\<rparr>)) nA) (Suc 0)\"\n      in exI)\n  apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n   apply(rule cfgRM.derivation_append_preserves_derivation)\n     apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n     apply(rule cfgRM.der2_is_derivation)\n     apply(simp add: cfgRM_step_relation_def)\n     apply(rename_tac dA dB nA nB eA eB)(*strict*)\n     apply(force)\n    apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n    apply(subgoal_tac \"cfgRM.derivation_from_to G (derivation_append (derivation_map dA (\\<lambda>v. \\<lparr>cfg_conf = [teA B] @ cfg_conf v\\<rparr>)) (derivation_map dB (\\<lambda>v. \\<lparr>cfg_conf = cfg_conf v @ liftB w2\\<rparr>)) nA) {pair None \\<lparr>cfg_conf = SSw1 @ SSw2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = SSw1' @ SSw2'\\<rparr>}\" for SSw1 SSw2 SSw1' SSw2')\n     apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n     prefer 2\n     apply(rule cfgRM_concatExtendIsFromToBoth)\n          apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n          apply(force)\n         apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n         apply(simp add: cfgRM.derivation_to_def cfgRM.derivation_from_def cfgRM.derivation_from_to_def)\n         apply(rule_tac\n      x=\"nB\"\n      in exI)\n         apply(clarsimp)\n         apply(simp add: maximum_of_domain_def)\n        apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n        apply(simp add: cfgRM.derivation_to_def cfgRM.derivation_from_def cfgRM.derivation_from_to_def)\n        apply(rule conjI)\n         apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n         apply(force)\n        apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n        apply(rule_tac\n      x=\"nA\"\n      in exI)\n        apply(clarsimp)\n        apply(rename_tac dA dB nA nB eA eB)(*strict*)\n        apply(simp add: maximum_of_domain_def)\n       apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n       apply (metis setA_liftB)\n      apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n      apply(force)\n     apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n     apply(force)\n    apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n    apply(simp add: cfgRM.derivation_to_def cfgRM.derivation_from_def cfgRM.derivation_from_to_def)\n   apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n   apply(simp add: der2_def derivation_append_def derivation_map_def)\n  apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n   apply(rule cfgRM.derivation_append_preserves_belongs)\n     apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n     apply(force)\n    apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n    apply(rule cfgRM.der2_belongs_prime)\n      apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n      apply(force)\n     apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n     apply(simp add: cfg_configurations_def)\n     apply(rename_tac dA dB nA nB eA eB)(*strict*)\n     apply (metis prod_lhs_in_nonterms)\n    apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n    apply(rule cfgRM.der2_is_derivation)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(rename_tac dA dB nA nB eA eB)(*strict*)\n    apply(force)\n   apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n   apply(force)\n  apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n   apply(simp add: der2_def derivation_append_def derivation_map_def)\n  apply(rename_tac d da i e ia ea dA dB nA nB eA eB)(*strict*)\n  apply(rule_tac\n      x=\"Suc (nA+nB)\"\n      in exI)\n  apply(simp add: der2_def derivation_append_def derivation_map_def)\n  apply(rename_tac dA dB nA nB eA eB)(*strict*)\n  apply(case_tac nB)\n   apply(rename_tac dA dB nA nB eA eB)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac dA dB nA eA)(*strict*)\n   apply(case_tac w1)\n    apply(rename_tac dA dB nA eA)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac dA dB nA eA a list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac dA dB nA nB eA eB nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dA dB nA eA eB nat)(*strict*)\n  apply(case_tac nA)\n   apply(rename_tac dA dB nA eA eB nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac dA dB eB nat)(*strict*)\n   apply(case_tac w2)\n    apply(rename_tac dA dB eB nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac dA dB eB nat a list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac dA dB nA eA eB nat nata)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dA dB eA eB nat nata)(*strict*)\n  apply (metis liftB_commutes_over_concat)\n  done\n\ndefinition cfg_LRk :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> nat\n  \\<Rightarrow> bool\"\n  where\n    \"cfg_LRk G k \\<equiv>\n  \\<forall>d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v.\n  cfgRM.derivation_initial G d1\n  \\<and> d1 n1 = Some (pair e1 \\<lparr>cfg_conf = \\<delta>1 @ [teA A1] @ liftB y1\\<rparr>)\n  \\<and> d1 (Suc n1) = Some (pair (Some e1') \\<lparr>cfg_conf = \\<delta>1 @ \\<omega>1 @ liftB y1\\<rparr>)\n  \\<and> cfgRM.derivation_initial G d2\n  \\<and> d2 n2 = Some (pair e2 \\<lparr>cfg_conf = \\<delta>2 @ [teA A2] @ liftB y2\\<rparr>)\n  \\<and> d2 (Suc n2) = Some (pair (Some e2') \\<lparr>cfg_conf = \\<delta>2 @ \\<omega>2 @ liftB y2\\<rparr>)\n  \\<and> \\<delta>1 @ \\<omega>1 @ liftB v = \\<delta>2 @ \\<omega>2\n  \\<and> kPrefix k y1 = kPrefix k (v @ y2)\n  \\<longrightarrow> (\\<delta>1 = \\<delta>2 \\<and> A1 = A2 \\<and> \\<omega>1 = \\<omega>2)\"\n\ndefinition cfg_LRkDo :: \"('a,'b) cfg \\<Rightarrow> 'b \\<Rightarrow> 'a \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"cfg_LRkDo G' Do S' k =\n  (\\<forall>d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v.\n  cfgRM.derivation_initial G' d1\n  \\<and> d1 (Suc n1) = Some (pair e1 \\<lparr>cfg_conf=\\<delta>1@[teA A1]@(liftB y1)\\<rparr>)\n  \\<and> d1 (Suc (Suc n1)) = Some (pair (Some e1') \\<lparr>cfg_conf=\\<delta>1@\\<omega>1@(liftB y1)\\<rparr>)\n  \\<and> cfgRM.derivation_initial G' d2\n  \\<and> d2 (Suc n2) = Some (pair e2 \\<lparr>cfg_conf=\\<delta>2@[teA A2]@(liftB y2)\\<rparr>)\n  \\<and> d2 (Suc (Suc n2)) = Some (pair (Some e2') \\<lparr>cfg_conf=\\<delta>2@\\<omega>2@(liftB y2)\\<rparr>)\n  \\<and> \\<delta>1@\\<omega>1@(liftB v)=\\<delta>2@\\<omega>2\n  \\<and> kPrefix k y1 = kPrefix k (v@y2)\n  \\<longrightarrow> (\\<delta>1=\\<delta>2 \\<and> A1=A2 \\<and> \\<omega>1=\\<omega>2))\"\n\nlemma supCFGRMhasAllStepsOfsub: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfg_sub G1 G2\n  \\<Longrightarrow> cfgRM_step_relation G1 c1 e c2\n  \\<Longrightarrow> cfgRM_step_relation G2 c1 e c2\"\n  apply(simp add: cfgRM_step_relation_def)\n  apply(auto)\n  apply(rename_tac l r)(*strict*)\n  apply(simp add: cfg_sub_def)\n  apply(auto)\n  done\n\ndefinition cfgRM_accessible_nonterminals :: \"\n  ('nonterminal,'event) cfg\n  \\<Rightarrow> 'nonterminal set\"\n  where\n    \"cfgRM_accessible_nonterminals G \\<equiv>\n  {A \\<in> cfg_nonterminals G.\n    \\<exists>d n c.\n      cfgRM.derivation_initial G d\n      \\<and> get_configuration (d n) = Some c\n      \\<and> (\\<exists>w1 w2. cfg_conf c = w1 @ teA A # liftB w2)}\"\n\ndefinition cfgRM_accessible_nonterminals_ALT :: \"\n  ('nonterminal,'event) cfg\n  \\<Rightarrow> 'nonterminal set\"\n  where\n    \"cfgRM_accessible_nonterminals_ALT G \\<equiv>\n  {A. \\<exists>d n e w1 w2.\n      cfgRM.derivation_initial G d\n      \\<and> d n = Some (pair e \\<lparr>cfg_conf = w1 @ teA A # liftB w2 \\<rparr>)}\"\n\nlemma cfgRM_accessible_nonterminals_ALT_vs_cfgRM_accessible_nonterminals: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM_accessible_nonterminals_ALT G = cfgRM_accessible_nonterminals G\"\n  apply(simp add: cfgRM_accessible_nonterminals_ALT_def cfgRM_accessible_nonterminals_def)\n  apply(rule antisym)\n   apply(clarsimp)\n   apply(rename_tac x d n e w1 w2)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac x d n e w1 w2)(*strict*)\n    prefer 2\n    apply(rule cfgRM.belongs_configurations)\n     apply(rename_tac x d n e w1 w2)(*strict*)\n     apply(rule cfgRM.derivation_initial_belongs)\n      apply(rename_tac x d n e w1 w2)(*strict*)\n      apply(force)\n     apply(rename_tac x d n e w1 w2)(*strict*)\n     apply(force)\n    apply(rename_tac x d n e w1 w2)(*strict*)\n    apply(force)\n   apply(rename_tac x d n e w1 w2)(*strict*)\n   apply(simp add: cfg_configurations_def setAConcat)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(force)\n  apply(simp add: get_configuration_def)\n  apply(clarsimp)\n  apply(rename_tac x d n c w1 w2)(*strict*)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"n\"\n      in exI)\n  apply(case_tac \"d n\")\n   apply(rename_tac x d n c w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac x d n c w1 w2 a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac x d n c w1 w2 a option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d n c w1 w2 option)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac x d n c w1 w2 option cfg_confa)(*strict*)\n  apply(force)\n  done\n\ndefinition cfgRM_Nonblockingness_nonterminals :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> 'nonterminal set\"\n  where\n    \"cfgRM_Nonblockingness_nonterminals G \\<equiv>\n  {A \\<in> cfg_nonterminals G.\n    \\<exists>d n e w'.\n      cfgRM.derivation G d\n      \\<and> d 0 = Some (pair None \\<lparr>cfg_conf = [teA A]\\<rparr>)\n      \\<and> d n = Some (pair e \\<lparr>cfg_conf = w'\\<rparr>)\n      \\<and> setA w' = {}}\"\n\ndefinition cfgRM_Nonblockingness_nonterminals_ALT :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> 'nonterminal set\"\n  where\n    \"cfgRM_Nonblockingness_nonterminals_ALT G \\<equiv>\n  {A \\<in> cfg_nonterminals G.\n    \\<exists>d n e w.\n      cfgRM.derivation G d\n      \\<and> d 0 = Some (pair None \\<lparr>cfg_conf = [teA A]\\<rparr>)\n      \\<and> d n = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>)}\"\n\nlemma cfgRM_Nonblockingness_branching_implies_cfgRM_accessible_nonterminals_contained_in_cfgRM_Nonblockingness_nonterminals: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.Nonblockingness_branching G\n  \\<Longrightarrow> cfgRM_accessible_nonterminals G \\<subseteq> cfgRM_Nonblockingness_nonterminals G\"\n  apply(simp add: cfgRM_accessible_nonterminals_def)\n  apply(clarsimp)\n  apply(rename_tac x d n c w1 w2)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac x d n c w1 w2 cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d n w1 w2)(*strict*)\n  apply(thin_tac \"x \\<in> cfg_nonterminals G\")\n  apply(case_tac \"d n\")\n   apply(rename_tac x d n w1 w2)(*strict*)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac x d n w1 w2 a)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(case_tac a)\n  apply(rename_tac x d n w1 w2 a option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d n w1 w2 option)(*strict*)\n  apply(rename_tac e)\n  apply(rename_tac x d n w1 w2 e)(*strict*)\n  apply(subgoal_tac \"\\<exists>d. cfgRM.derivation_initial G d \\<and> maximum_of_domain d n \\<and> d n = Some (pair e \\<lparr>cfg_conf = w1 @ teA x # liftB w2\\<rparr>)\")\n   apply(rename_tac x d n w1 w2 e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"derivation_take d n\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac x d n w1 w2 e)(*strict*)\n    apply (metis cfgRM.derivation_take_preserves_derivation_initial)\n   apply(rename_tac x d n w1 w2 e)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac x d n w1 w2 e)(*strict*)\n    apply (metis maximum_of_domain_derivation_take not_None_eq)\n   apply(rename_tac x d n w1 w2 e)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac x d n w1 w2 e)(*strict*)\n  apply(thin_tac \"cfgRM.derivation_initial G d\")\n  apply(thin_tac \"d n = Some (pair e \\<lparr>cfg_conf = w1 @ teA x # liftB w2\\<rparr>)\")\n  apply(clarsimp)\n  apply(rename_tac x n w1 w2 e d)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac x n w1 w2 e d)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      and ?w1.0=\"w1\"\n      and ?w2.0=\"[teA x]\"\n      and ?w3.0=\"liftB w2\"\n      in CFGRM_Nonblockingness_to_elimination)\n         apply(rename_tac x n w1 w2 e d)(*strict*)\n         apply(force)\n        apply(rename_tac x n w1 w2 e d)(*strict*)\n        apply(simp add: cfgRM.derivation_initial_def)\n       apply(rename_tac x n w1 w2 e d)(*strict*)\n       apply(rule cfgRM.derivation_initial_belongs)\n        apply(rename_tac x n w1 w2 e d)(*strict*)\n        apply(force)\n       apply(rename_tac x n w1 w2 e d)(*strict*)\n       apply(force)\n      apply(rename_tac x n w1 w2 e d)(*strict*)\n      apply(force)\n     apply(rename_tac x n w1 w2 e d)(*strict*)\n     apply(force)\n    apply(rename_tac x n w1 w2 e d)(*strict*)\n    apply(force)\n   apply(rename_tac x n w1 w2 e d)(*strict*)\n   apply(force)\n  apply(rename_tac x n w1 w2 e d)(*strict*)\n  apply(thin_tac \"cfgRM.Nonblockingness_branching G\")\n  apply(thin_tac \"maximum_of_domain d n\")\n  apply(thin_tac \"cfgRM.derivation_initial G d\")\n  apply(thin_tac \"d n = Some (pair e \\<lparr>cfg_conf = w1 @ teA x # liftB w2\\<rparr>)\")\n  apply(clarsimp)\n  apply(rename_tac x d' n' w e)(*strict*)\n  apply(simp add: cfgRM_Nonblockingness_nonterminals_def)\n  apply(rule conjI)\n   apply(rename_tac x d' n' w e)(*strict*)\n   apply(subgoal_tac \"\\<lparr>cfg_conf = [teA x]\\<rparr> \\<in> cfg_configurations G\")\n    apply(rename_tac x d' n' w e)(*strict*)\n    apply(simp add: cfg_configurations_def)\n   apply(rename_tac x d' n' w e)(*strict*)\n   apply (metis cfgRM.belongs_configurations)\n  apply(rename_tac x d' n' w e)(*strict*)\n  apply(rule_tac\n      x=\"d'\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"n'\"\n      in exI)\n  apply(clarsimp)\n  done\n\nlemma cfgRM_Nonblockingness_branching_implies_FB_iterated_elimination: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.Nonblockingness_branching G\n  \\<Longrightarrow> cfgRM.derivation_initial G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> cfg_conf c = w1 @ teA x # w2\n  \\<Longrightarrow> \\<exists>d. cfgRM.derivation_initial G d \\<and>\n  (\\<exists>n c. get_configuration (d n) = Some c \\<and>\n  (\\<exists>w1 w2. cfg_conf c = w1 @ teA x # liftB w2))\"\n  apply(induct \"length (filterA w2)\" arbitrary: w2 d n e c)\n   apply(rename_tac w2 d n e c)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac w2 d n e c)(*strict*)\n    apply(force)\n   apply(rename_tac w2 d n e c)(*strict*)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(rule_tac\n      x=\"w1\"\n      in exI)\n   apply(subgoal_tac \"\\<exists>w. liftB w = w2\")\n    apply(rename_tac w2 d n e c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB w2\"\n      in exI)\n    apply(rule liftBDeConv2)\n    apply(rule filterA_setA)\n    apply(force)\n   apply(rename_tac w2 d n e c)(*strict*)\n   apply(force)\n  apply(rename_tac xa w2 d n e c)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac xa w2 d n e c cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa w2 d n e)(*strict*)\n  apply(subgoal_tac \"\\<exists>wx1 A wx2. w2 = wx1 @[teA A]@liftB wx2\")\n   apply(rename_tac xa w2 d n e)(*strict*)\n   prefer 2\n   apply(rule filterA_gt_0_then_rm_nonterminal)\n   apply(force)\n  apply(rename_tac xa w2 d n e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n  apply(subgoal_tac \"A \\<in> cfgRM_Nonblockingness_nonterminals G\")\n   apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      A=\"cfgRM_accessible_nonterminals G\"\n      in set_mp)\n    apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n    apply(rule cfgRM_Nonblockingness_branching_implies_cfgRM_accessible_nonterminals_contained_in_cfgRM_Nonblockingness_nonterminals)\n     apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n     apply(force)\n    apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n    apply(force)\n   apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n   apply(simp add: cfgRM_accessible_nonterminals_def)\n   apply(subgoal_tac \"\\<lparr>cfg_conf = w1 @ teA x # wx1 @ teA A # liftB wx2\\<rparr> \\<in> cfg_configurations G\")\n    apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n    prefer 2\n    apply (rule cfgRM.belongs_configurations)\n     apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n     apply(rule cfgRM.derivation_initial_belongs)\n      apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n      apply(force)\n     apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n     apply(force)\n    apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n    apply(force)\n   apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n    apply(simp add: cfg_configurations_def)\n    apply(simp add: setAConcat)\n   apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(rule_tac\n      x=\"w1@teA x#wx1\"\n      in exI)\n   apply(force)\n  apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n  apply(simp add: cfgRM_Nonblockingness_nonterminals_def)\n  apply(clarsimp)\n  apply(rename_tac xa d n e wx1 A wx2 da na ea w')(*strict*)\n  apply(subgoal_tac \"\\<exists>w. liftB w = w'\")\n   apply(rename_tac xa d n e wx1 A wx2 da na ea w')(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB w'\"\n      in exI)\n   apply(rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac xa d n e wx1 A wx2 da na ea w')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa d n e wx1 A wx2 da na ea w)(*strict*)\n  apply(thin_tac \"setA (liftB w) = {}\")\n  apply(case_tac na)\n   apply(rename_tac xa d n e wx1 A wx2 da na ea w)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac xa d n e wx1 A wx2 da w)(*strict*)\n   apply(case_tac w)\n    apply(rename_tac xa d n e wx1 A wx2 da w)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac xa d n e wx1 A wx2 da w a list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac xa d n e wx1 A wx2 da na ea w nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa d n e wx1 A wx2 da ea w nat)(*strict*)\n  apply(rename_tac na)\n  apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n  apply(subgoal_tac \"\\<exists>d n e c. cfgRM.derivation_initial G d \\<and> d n = Some (pair e c) \\<and> cfg_conf c = w1 @ teA x # wx1 @ liftB w @ liftB wx2\")\n   apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"derivation_append d (derivation_map da (\\<lambda>c. \\<lparr>cfg_conf=w1@teA x#wx1@(cfg_conf c)@liftB wx2\\<rparr>)) n\"\n      in exI)\n   apply(rule_tac\n      x=\"n+Suc na\"\n      in exI)\n   apply(rule_tac\n      x=\"ea\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>cfg_conf=w1 @ teA x # wx1 @ liftB w @ liftB wx2\\<rparr>\"\n      in exI)\n   apply(clarsimp)\n   apply(rule context_conjI)\n    apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n    apply(rule cfgRM.derivation_append_preserves_derivation_initial)\n      apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n      apply(force)\n     apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n     apply(force)\n    apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n    apply(rule cfgRM.derivation_append_preserves_derivation)\n      apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n      apply(simp add: cfgRM.derivation_initial_def)\n     apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n     apply(rule cfgRM.derivation_map_preserves_derivation)\n       apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n       apply(force)\n      apply(rename_tac xa d n e wx1 A wx2 da ea w na i eb c)(*strict*)\n      apply(force)\n     apply(rename_tac xa d n e wx1 A wx2 da ea w na c1 eb c2)(*strict*)\n     apply(simp add: cfgRM_step_relation_def)\n     apply(clarsimp)\n     apply(rename_tac xa d n e wx1 A wx2 da ea w na c1 eb c2 l r)(*strict*)\n     apply(rule_tac\n      x=\"w1 @ teA x # wx1 @ l\"\n      in exI)\n     apply(clarsimp)\n     apply(simp add: setAConcat)\n     apply(rule setA_liftB)\n    apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n    apply(clarsimp)\n    apply(simp add: derivation_map_def)\n   apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n   apply(simp add: derivation_append_def derivation_map_def)\n  apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n  apply(thin_tac \"da 0 = Some (pair None \\<lparr>cfg_conf = [teA A]\\<rparr>)\")\n  apply(thin_tac \"A \\<in> cfg_nonterminals G\")\n  apply(thin_tac \"cfgRM.derivation_initial G d\")\n  apply(thin_tac \"cfgRM.Nonblockingness_branching G \")\n  apply(thin_tac \"d n = Some (pair e \\<lparr>cfg_conf = w1 @ teA x # wx1 @ teA A # liftB wx2\\<rparr>)\")\n  apply(thin_tac \"cfgRM.derivation G da\")\n  apply(thin_tac \"da (Suc na) = Some (pair ea \\<lparr>cfg_conf = liftB w\\<rparr>)\")\n  apply(clarsimp)\n  apply(rename_tac xa wx1 A wx2 w d n e c)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac xa wx1 A wx2 w d n e c cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa wx1 A wx2 w d n e)(*strict*)\n  apply(simp add: filterA_commutes_over_concat filterA_liftB)\n  apply(rename_tac xa wx1 wx2 w d n e)(*strict*)\n  apply(erule_tac\n      x=\"wx1 @ liftB w @ liftB wx2\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac wx1 wx2 w d n e)(*strict*)\n  apply(erule_tac\n      x=\"d\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"n\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"e\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"\\<lparr>cfg_conf = w1 @ teA x # wx1 @ liftB w @ liftB wx2\\<rparr>\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(simp add: filterA_commutes_over_concat filterA_liftB)\n  done\n\ncorollary cfg_dependency_between_Nonblockingnessness_properties1RM: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.Nonblockingness_branching G\n  \\<Longrightarrow> nonblockingness_language (cfgRM.unmarked_language G) (cfgRM.marked_language G)\"\n  apply(simp add: nonblockingness_language_def)\n  apply (metis nonblockingness_language_def cfgRM.AX_BF_Bra_OpLa)\n  done\n\nlemma cfgRM_no_nonterminal_at_end_in_marking_condition: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> cfg_marking_condition G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> cfg_conf c=w\n  \\<Longrightarrow> setA w={}\"\n  apply(simp add: cfg_marking_condition_def cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(rename_tac i ea ca)(*strict*)\n  apply(case_tac \"i=n\")\n   apply(rename_tac i ea ca)(*strict*)\n   apply(force)\n  apply(rename_tac i ea ca)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i ea ca)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      and n=\"i\"\n      and m=\"n\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac i ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac i ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac i ea ca)(*strict*)\n   apply (metis (mono_tags) cfgRM.allPreMaxDomSome_prime le_antisym not_less_eq_eq option.distinct(1))\n  apply(rename_tac i ea ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i ea ca e2 c2)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i ea ca e2 c2 l r)(*strict*)\n  apply(case_tac ca)\n  apply(rename_tac i ea ca e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i ea e2 c2 l r)(*strict*)\n  apply (metis elemInsetA empty_iff)\n  done\n\nlemma cfgRM_Nonblockingness_nonterminals_ALT_vs_cfgRM_Nonblockingness_nonterminals: \"\n  cfgRM_Nonblockingness_nonterminals_ALT G = cfgRM_Nonblockingness_nonterminals G\"\n  apply(rule antisym)\n   apply(simp add: cfgRM_Nonblockingness_nonterminals_ALT_def cfgRM_Nonblockingness_nonterminals_def)\n   apply(clarsimp)\n   apply(rename_tac x d n e w)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n   apply(rule setA_liftB)\n  apply(simp add: cfgRM_Nonblockingness_nonterminals_ALT_def cfgRM_Nonblockingness_nonterminals_def)\n  apply(clarsimp)\n  apply(rename_tac x d n e w')(*strict*)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"n\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"filterB w'\"\n      in exI)\n  apply (metis liftBDeConv2)\n  done\n\nlemma cfg_sub_preserves_derivationRM: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G' d\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgRM.derivation G d\"\n  apply(simp (no_asm) add: cfgRM.derivation_def cfgRM.derivation_initial_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: cfgRM.derivation_def cfgRM.derivation_initial_def)\n   apply(case_tac \"d 0\")\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n   apply(rename_tac nat a)(*strict*)\n   prefer 2\n   apply(rule cfgRM.step_detail_before_some_position)\n     apply(rename_tac nat a)(*strict*)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(force)\n  apply(rename_tac nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(simp add: cfg_sub_def)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n  apply(force)\n  done\n\nlemma cfg_sub_preserves_derivation_initialRM: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation_initial G' d\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgRM.derivation_initial G d\"\n  apply(rule cfgRM.derivation_initialI)\n   apply(simp (no_asm) add: cfgRM.derivation_def cfgRM.derivation_initial_def)\n   apply(clarsimp)\n   apply(rename_tac i)(*strict*)\n   apply(case_tac i)\n    apply(rename_tac i)(*strict*)\n    apply(clarsimp)\n    apply(simp add: cfgRM.derivation_def cfgRM.derivation_initial_def)\n    apply(clarsimp)\n    apply(case_tac \"d 0\")\n     apply(clarsimp)\n    apply(rename_tac a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac a option b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat)(*strict*)\n   apply(case_tac \"d (Suc nat)\")\n    apply(rename_tac nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac nat a)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n    apply(rename_tac nat a)(*strict*)\n    prefer 2\n    apply(rule cfgRM.step_detail_before_some_position)\n      apply(rename_tac nat a)(*strict*)\n      apply(simp add: cfgRM.derivation_initial_def)\n      apply(force)\n     apply(rename_tac nat a)(*strict*)\n     apply(force)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n   apply(simp add: cfgRM_step_relation_def)\n   apply(simp add: cfg_sub_def)\n   apply(clarsimp)\n   apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n   apply(force)\n  apply(simp add: cfgRM.derivation_def cfgRM.derivation_initial_def)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def cfg_sub_def)\n  apply(force)\n  done\n\nlemma empty_start_then_cfgRM_deri_is_empty: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = []\\<rparr>)\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> n=0\"\n  apply(case_tac n)\n   apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> d (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\")\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac nat)(*strict*)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(force)\n   apply(rename_tac nat)(*strict*)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e2 c2)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  done\n\nlemma cfgRM_no_step_without_nontermsX: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> setA (cfg_conf c)={}\n  \\<Longrightarrow> d (n+m) \\<noteq> None\n  \\<Longrightarrow> m=0\"\n  apply(case_tac m)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> d (Suc n) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\")\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+m\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac nat)(*strict*)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(force)\n   apply(rename_tac nat)(*strict*)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat y e2 c2)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac nat y e2 c2 l r)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac nat y e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat y e2 c2 l r)(*strict*)\n  apply (metis elemInsetA emptyE)\n  done\n\ndefinition SententialRM :: \"('a,'b) cfg \\<Rightarrow> ('a,'b)DT_two_elements list \\<Rightarrow> bool\" where\n  \"SententialRM G w = (\\<exists>d e n v. cfgRM.derivation G d \\<and> cfgRM.belongs G d \\<and> cfgRM.derivation_initial G d \\<and> d n = Some (pair e \\<lparr>cfg_conf=w@v\\<rparr>))\"\n\nlemma Nonterminal_free_SententialRM_in_unmarked_language: \"\n  valid_cfg G\n  \\<Longrightarrow> SententialRM G (liftB w)\n  \\<Longrightarrow> w \\<in> cfgRM.unmarked_language G\"\n  apply(simp add: cfgRM.unmarked_language_def SententialRM_def)\n  apply(clarsimp)\n  apply(rename_tac d e n v)(*strict*)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(clarsimp)\n  apply(simp add: cfg_unmarked_effect_def)\n  apply(rule_tac\n      x=\"e\"\n      in exI)\n  apply(rule_tac\n      x=\"\\<lparr>cfg_conf = liftB w @ v\\<rparr>\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"n\"\n      in exI)\n  apply(clarsimp)\n  done\n\nlemma CFGRM_noStep: \"\n  setA (cfg_conf c)={}\n  \\<Longrightarrow> \\<not> cfgRM_step_relation G c e c'\"\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac l r)(*strict*)\n  apply(subgoal_tac \"prod_lhs e \\<in> setA (l @ teA (prod_lhs e) # r)\")\n   apply(rename_tac l r)(*strict*)\n   apply(force)\n  apply(rename_tac l r)(*strict*)\n  apply(rule elemInsetA)\n  done\n\nlemma CFGRM_terminals_stays_context: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> setA w1 = {}\n  \\<Longrightarrow> setA w2 = {}\n  \\<Longrightarrow> d i = Some (pair e1 \\<lparr>cfg_conf=w1@v@w2\\<rparr>)\n  \\<Longrightarrow> d j = Some (pair e2 \\<lparr>cfg_conf=x\\<rparr>)\n  \\<Longrightarrow> i\\<le>j\n  \\<Longrightarrow> \\<exists>y. w1@y@w2=x\"\n  apply(induct \"j-i\" arbitrary: j e2 x)\n   apply(rename_tac j e2 x)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac xa j e2 x)(*strict*)\n  apply(case_tac j)\n   apply(rename_tac xa j e2 x)(*strict*)\n   apply(force)\n  apply(rename_tac xa j e2 x nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa e2 x nat)(*strict*)\n  apply(erule_tac\n      x=\"nat\"\n      in meta_allE)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> d (Suc nat) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\")\n   apply(rename_tac xa e2 x nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac xa e2 x nat)(*strict*)\n     apply(force)\n    apply(rename_tac xa e2 x nat)(*strict*)\n    apply(force)\n   apply(rename_tac xa e2 x nat)(*strict*)\n   apply(force)\n  apply(rename_tac xa e2 x nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n  apply(erule_tac\n      x=\"e1a\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"cfg_conf c1\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule meta_impE)\n   apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n   apply(force)\n  apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n   apply(force)\n  apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa x nat e1a e2a c1 y)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a e2a c1 y l r)(*strict*)\n  apply(case_tac \"e2a\")\n  apply(rename_tac xa nat e1a e2a c1 y l r prod_lhsa prod_rhsa)(*strict*)\n  apply(rename_tac A w)\n  apply(rename_tac xa nat e1a e2a c1 y l r A w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a c1 y l r A w)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac xa nat e1a c1 y l r A w cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a y l r A w)(*strict*)\n  apply(subgoal_tac \"prefix w1 l \\<or> prefix l w1\")\n   apply(rename_tac xa nat e1a y l r A w)(*strict*)\n   prefer 2\n   apply(rule mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac xa nat e1a y l r A w)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac xa nat e1a y l r A w)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac xa nat e1a y l r A w c)(*strict*)\n   apply(case_tac c)\n    apply(rename_tac xa nat e1a y l r A w c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xa nat e1a y l r A w)(*strict*)\n    apply(case_tac y)\n     apply(rename_tac xa nat e1a y l r A w)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac xa nat e1a y l r A w a list)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac xa nat e1a y l r A w c a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac xa nat e1a y l A w list)(*strict*)\n   apply (metis elemInsetA emptyE)\n  apply(rename_tac xa nat e1a y l r A w)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a y r A w c)(*strict*)\n  apply(subgoal_tac \"prefix y c \\<or> prefix c y\")\n   apply(rename_tac xa nat e1a y r A w c)(*strict*)\n   prefer 2\n   apply(rule mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac xa nat e1a y r A w c)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac xa nat e1a y r A w c)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac xa nat e1a r A w c ca)(*strict*)\n   apply(case_tac ca)\n    apply(rename_tac xa nat e1a r A w c ca)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac xa nat e1a r A w c ca a list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac xa nat e1a y r A w c)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a y r A w ca)(*strict*)\n  apply (metis elemInsetA emptyE)\n  done\n\nlemma cfgRM_no_step_from_no_nonterminal: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> cfgRM.belongs G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> setA (cfg_conf c) = {}\n  \\<Longrightarrow> x>n\n  \\<Longrightarrow> d x = None\"\n  apply(case_tac \"d x\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"d (Suc n) \\<noteq> None\")\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule_tac n=\"x\" in cfgRM.derivationNoFromNone2_prime)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(case_tac \"Suc n=x\")\n    apply(rename_tac a)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> SSd (Suc SSi) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\" for SSd SSi)\n     apply(rename_tac a)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc n\"\n      in cfgRM.step_detail_before_some_position)\n       apply(rename_tac a)(*strict*)\n       apply(force)\n      apply(rename_tac a)(*strict*)\n      apply(force)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac e2 c2)(*strict*)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(case_tac c)\n    apply(rename_tac e2 c2 cfg_confa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac e2 c2 l r)(*strict*)\n    apply(case_tac c2)\n    apply(rename_tac e2 c2 l r cfg_confa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac e2 l r)(*strict*)\n    apply (metis cfg_configuration.simps(1) cfgRM_no_step_without_nonterms not_None_eq)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> SSd (Suc SSi) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\" for SSd SSi)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc n\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a e2 c2)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(case_tac c)\n  apply(rename_tac a e2 c2 cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a e2 c2 l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac a e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a e2 l r)(*strict*)\n  apply (metis cfg_configuration.simps(1) cfgRM_no_step_without_nonterms not_None_eq)\n  done\n\nlemma cfgRM_equal_terminating_derivations_smae_length: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d1\n  \\<Longrightarrow> cfgRM.derivation G d2\n  \\<Longrightarrow> cfgRM.belongs G d1\n  \\<Longrightarrow> cfgRM.belongs G d2\n  \\<Longrightarrow> d1 n1 = Some (pair e1 c1)\n  \\<Longrightarrow> d2 n2 = Some (pair e2 c2)\n  \\<Longrightarrow> setA (cfg_conf c1) = {}\n  \\<Longrightarrow> setA (cfg_conf c2) = {}\n  \\<Longrightarrow> d1 = d2\n  \\<Longrightarrow> n1 = n2\"\n  apply(clarsimp)\n  apply(case_tac \"n1<n2\")\n   apply(subgoal_tac \"d2 n2 = None\")\n    apply(force)\n   apply(rule_tac\n      n=\"n1\"\n      in cfgRM_no_step_from_no_nonterminal)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(case_tac \"n2<n1\")\n   apply(subgoal_tac \"d2 n1 = None\")\n    apply(force)\n   apply(rule_tac\n      n=\"n2\"\n      in cfgRM_no_step_from_no_nonterminal)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\ndefinition CFGrm_unambiguous :: \"('a,'b) cfg \\<Rightarrow> bool\" where\n  \"CFGrm_unambiguous G \\<equiv> (\\<forall>d1 d2 n1 n2 e1 e2 w.\n  cfgRM.derivation_initial G d1\n  \\<longrightarrow> cfgRM.derivation_initial G d2\n  \\<longrightarrow> d1 n1 = Some (pair e1 \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<longrightarrow> d2 n2 = Some (pair e2 \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<longrightarrow> d1 = d2)\"\n\nlemma lemma_4_7_existence: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> cfgRM.belongs G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = foldl (@) [] \\<alpha>\\<rparr>)\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>)\n  \\<Longrightarrow> \\<pi>=map the (get_labels d n)\n  \\<Longrightarrow> \\<exists>\\<pi>s ws.\n  foldl (@) [] (rev \\<pi>s) = \\<pi>\n  \\<and> length \\<pi>s = length \\<alpha>\n  \\<and> foldl (@) [] ws = w\n  \\<and> length ws = length \\<alpha>\n  \\<and> (\\<forall>i<length \\<pi>s. \\<exists>d' n' e'.\n  cfgRM.derivation G d'\n  \\<and> cfgRM.belongs G d'\n  \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=\\<alpha>!i\\<rparr>)\n  \\<and> d' n' = Some (pair e' \\<lparr>cfg_conf=liftB (ws!i)\\<rparr>)\n  \\<and> \\<pi>s!i = map the (get_labels d' n'))\"\n  apply(induct n arbitrary: d \\<pi> \\<alpha> w e)\n   apply(rename_tac d \\<pi> \\<alpha> w e)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d \\<alpha> w)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(subgoal_tac \"nat_seq (Suc 0) 0=[]\")\n    apply(rename_tac d \\<alpha> w)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"map (\\<lambda>x. []) \\<alpha>\"\n      in exI)\n    apply(rule context_conjI)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(rule foldl_empty)\n     apply(rename_tac d \\<alpha> w a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d \\<alpha> w)(*strict*)\n    apply(rule context_conjI)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(simp add: get_label_def)\n    apply(rename_tac d \\<alpha> w)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"map filterB \\<alpha>\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(rule liftB_inj)\n     apply(rule sym)\n     apply(rule_tac\n      t=\"liftB w\"\n      and s=\"foldl (@) [] \\<alpha>\"\n      in ssubst)\n      apply(rename_tac d \\<alpha> w)(*strict*)\n      apply(force)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(rule_tac\n      t=\"liftB (foldl (@) [] (map filterB \\<alpha>))\"\n      and s=\"(foldl (@) [] (map liftB (map filterB \\<alpha>)))\"\n      in ssubst)\n      apply(rename_tac d \\<alpha> w)(*strict*)\n      apply(rule distrib_liftB_foldl)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(clarsimp)\n     apply(rule_tac\n      t=\"(map (liftB \\<circ> filterB) \\<alpha>)\"\n      and s=\"\\<alpha>\"\n      in ssubst)\n      apply(rename_tac d \\<alpha> w)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(rule listEqI)\n      apply(rename_tac d \\<alpha> w)(*strict*)\n      apply (metis length_map)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"setA (\\<alpha>!i)={}\")\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply (metis liftBDeConv2)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule order_antisym)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule_tac\n      B=\"setA (liftB w)\"\n      in subset_trans)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      prefer 2\n      apply(simp (no_asm))\n      apply(rule setA_liftB)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(subgoal_tac \"set(\\<alpha>!i)\\<subseteq> set(liftB w)\")\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(rule set_subset_to_setA_subset)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule_tac\n      t=\"liftB w\"\n      and s=\"foldl (@) [] \\<alpha>\"\n      in ssubst)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule set_nth_foldl)\n     apply(force)\n    apply(rename_tac d \\<alpha> w)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply (metis length_map)\n    apply(rename_tac d \\<alpha> w)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d \\<alpha> w i)(*strict*)\n    apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf=\\<alpha>!i\\<rparr>\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule cfgRM.der1_is_derivation)\n    apply(rename_tac d \\<alpha> w i)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule cfgRM.der1_belongs)\n     apply(subgoal_tac \"\\<lparr>cfg_conf = foldl (@) [] \\<alpha>\\<rparr> \\<in> cfg_configurations G\")\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(simp add: cfg_configurations_def)\n      apply(rule conjI)\n       apply(rename_tac d \\<alpha> w i)(*strict*)\n       apply(rule_tac\n      B=\"setA (foldl (@) [] \\<alpha>)\"\n      in subset_trans)\n        apply(rename_tac d \\<alpha> w i)(*strict*)\n        apply(rule set_subset_to_setA_subset)\n        apply(rule set_nth_foldl)\n        apply(force)\n       apply(rename_tac d \\<alpha> w i)(*strict*)\n       apply(force)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(rule_tac\n      B=\"setB (foldl (@) [] \\<alpha>)\"\n      in subset_trans)\n       apply(rename_tac d \\<alpha> w i)(*strict*)\n       apply(rule set_subset_to_setB_subset)\n       apply(rule set_nth_foldl)\n       apply(force)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule cfgRM.belongs_configurations)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(force)\n    apply(rename_tac d \\<alpha> w i)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(simp add: der1_def)\n    apply(rename_tac d \\<alpha> w i)(*strict*)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule_tac\n      x=\"None\"\n      in exI)\n     apply(simp add: der1_def)\n     apply(subgoal_tac \"setA (\\<alpha>!i) = {}\")\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply (metis liftBDeConv2)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule order_antisym)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule_tac\n      B=\"setA (foldl (@) [] \\<alpha>)\"\n      in subset_trans)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(rule set_subset_to_setA_subset)\n      apply(rule set_nth_foldl)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule_tac\n      t=\"foldl (@) [] \\<alpha>\"\n      and s=\"liftB w\"\n      in ssubst)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply (metis setA_liftB empty_subsetI)\n    apply(rename_tac d \\<alpha> w i)(*strict*)\n    apply (metis)\n   apply(rename_tac d \\<alpha> w)(*strict*)\n   apply (metis nat_seqEmpty zero_less_Suc)\n  apply(rename_tac n d \\<pi> \\<alpha> w e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> d (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\")\n   apply(rename_tac n d \\<alpha> w e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc n\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac n d \\<alpha> w e)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> w e)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> w e)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e e2 c2)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e e2 c2 l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac n d \\<alpha> w e e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e e2 l r)(*strict*)\n  apply(subgoal_tac \"\\<exists>n l1 l2 r1 r2. n<length \\<alpha> \\<and>l1=foldl (@) [] (take n \\<alpha>) \\<and> l1@l2=l \\<and> r1=foldl (@) [] (drop (Suc n) \\<alpha>) \\<and> r=r2@r1 \\<and> \\<alpha>!n=l2@[teA(prod_lhs e2)]@r2\")\n   apply(rename_tac n d \\<alpha> w e e2 l r)(*strict*)\n   prefer 2\n   apply(rule single_element_in_some_slice)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 l r)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(erule_tac\n      x=\"derivation_drop d (Suc 0)\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"map the (get_labels (derivation_drop d (Suc 0)) n)\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"(take na \\<alpha>)@[l2 @ prod_rhs e2 @ r2]@(drop (Suc na) \\<alpha>)\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"w\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"(case n of 0 \\<Rightarrow> None | Suc n \\<Rightarrow> e)\"\n      in meta_allE)\n  apply(erule meta_impE)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(rule cfgRM.derivation_drop_preserves_derivation_prime)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(rule cfgRM.derivation_drop_preserves_belongs)\n     apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(subgoal_tac \"foldl (@) [] (take na \\<alpha> @ [l2 @ prod_rhs e2 @ r2] @ drop (Suc na) \\<alpha>)=foldl (@) [] (take na \\<alpha>) @ l2 @ prod_rhs e2 @ r2 @ foldl (@) [] (drop (Suc na) \\<alpha>)\")\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"foldl (@) [] (take na \\<alpha> @ [l2 @ prod_rhs e2 @ r2] @ drop (Suc na) \\<alpha>)\"\n      and s=\" (foldl (@) [] (take na \\<alpha>))@(foldl (@) [] ([l2 @ prod_rhs e2@ r2] @ drop (Suc na) \\<alpha>))\"\n      in ssubst)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n    apply(rule foldl_distrib_append)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(rule_tac\n      t=\"foldl (@) [] ([l2 @ prod_rhs e2 @ r2] @ drop (Suc na) \\<alpha>)\"\n      and s=\"(foldl (@) [] ([l2 @ prod_rhs e2 @ r2]))@(foldl (@) [] (drop (Suc na) \\<alpha>))\"\n      in ssubst)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n    apply(rule foldl_distrib_append)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(simp add: derivation_drop_def)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(clarsimp)\n  apply(erule meta_impE)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(simp add: derivation_drop_def)\n   apply(case_tac n)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 nat)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2 nat)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(erule exE)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n  apply(subgoal_tac \"min (length \\<alpha>) na = na\")\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(thin_tac \"min (length \\<alpha>) na = na\")\n  apply(subgoal_tac \"Suc (length \\<alpha> - Suc 0) = length \\<alpha>\")\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(clarsimp)\n  apply(thin_tac \"Suc (length \\<alpha> - Suc 0) = length \\<alpha>\")\n  apply(rule_tac\n      t=\"map the (get_labels d (Suc n))\"\n      and s=\"e2#(foldl (@) [] (rev \\<pi>s))\"\n      in ssubst)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   apply(simp (no_asm) add: get_labels_def)\n   apply(rule listEqI)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n    apply(clarsimp)\n    apply(simp add: derivation_drop_def)\n    apply(simp (no_asm) add: get_labels_def)\n    apply (metis gr0I list.size(3) nat_seqEmpty nat_seq_length_Suc0 zero_less_Suc)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n   apply(clarsimp)\n   apply(simp (no_asm) add: get_labels_def)\n   apply(simp add: derivation_drop_def)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc n)) = SSn + 1 - SSi\" for SSn SSi)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSn + 1 - SSi\" for SSn SSi)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc n) ! i = (SSn)+(SSi)\" for SSn SSi)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n   apply(clarsimp)\n   apply(case_tac i)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n    apply(simp add: get_label_def)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n   apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (if i = 0 then case_option undefined (case_derivation_configuration (\\<lambda>e c. Some (pair None c))) (d (Suc 0)) else d (i + Suc 0)))) (nat_seq (Suc 0) n) ! nat\"\n      and s=\"(the \\<circ> (\\<lambda>i. get_label (if i = 0 then case_option undefined (case_derivation_configuration (\\<lambda>e c. Some (pair None c))) (d (Suc 0)) else d (i + Suc 0)))) ((nat_seq (Suc 0) n) ! nat)\"\n      in ssubst)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n    apply(rule nth_map)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n   apply(subgoal_tac \"nat_seq (Suc 0) n ! nat = (SSn)+(SSi)\" for SSn SSi)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n    apply(clarify)\n    apply(subgoal_tac \"False\")\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n    apply(arith)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(subgoal_tac \"foldl (@) [] (drop (Suc na) \\<pi>s) = []\")\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   prefer 2\n   apply(rule foldl_empty)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws a)(*strict*)\n   apply(subgoal_tac \"\\<exists>i<length (drop (Suc na) \\<pi>s). (drop (Suc na) \\<pi>s)!i = a\")\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws a)(*strict*)\n    prefer 2\n    apply (metis in_set_conv_nth)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n   apply(erule_tac\n      x=\"i+Suc na\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(subgoal_tac \"(take na \\<alpha> @ (l2 @ prod_rhs e2 @ r2) # drop (Suc na) \\<alpha>) ! Suc (i + na) = \\<alpha>!(Suc(i+na))\")\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    prefer 2\n    apply(rule select_from_drop)\n    apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(subgoal_tac \"setA (\\<alpha> ! Suc (i + na)) = {}\")\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(case_tac n')\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n     apply(clarsimp)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d')(*strict*)\n     apply(rule_tac\n      t=\"na+i\"\n      and s=\"i+na\"\n      in ssubst)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d')(*strict*)\n      apply(force)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d')(*strict*)\n     apply(clarsimp)\n     apply(simp add: get_labels_def)\n     apply (metis nat_seqEmpty zero_less_Suc)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e' nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' e' nat)(*strict*)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d' 0 = Some (pair e1 c1) \\<and> d' (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\")\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' e' nat)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc nat\"\n      in cfgRM.step_detail_before_some_position)\n       apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' e' nat)(*strict*)\n       apply(force)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' e' nat)(*strict*)\n      apply(force)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' e' nat)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' e' nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' e' nat e2a c2)(*strict*)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' e' nat e2a c2 l r)(*strict*)\n    apply (metis List.set_simps(1) elemInsetA length_pos_if_in_set less_not_refl3 list.size(3))\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(rule_tac\n      v=\"r2 @ foldl (@) [] (drop (Suc na) \\<alpha>)\"\n      in setA_empty_from_greater_set)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(rule_tac\n      B=\"set(foldl (@) [] (drop (Suc na) \\<alpha>))\"\n      in subset_trans)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(rule elements_preserved_under_foldl)\n    apply(rule_tac\n      t=\"Suc (i+na)\"\n      and s=\"Suc na + i\"\n      in ssubst)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(rule nth_drop_elem)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(rule_tac\n      x=\"(take na \\<pi>s @ [e2#(\\<pi>s!na)] @ drop (Suc na) \\<pi>s)\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   apply(rule foldl_rev_take_drop)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(rule_tac\n      x=\"ws\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(rule allI)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n  apply(rule impI)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(clarsimp)\n  apply(subgoal_tac \"min (length \\<alpha>) na=na\")\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"Suc (length \\<alpha> - Suc 0) = length \\<alpha>\")\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n  apply(case_tac \"i=na\")\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"d'\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(case_tac \"i<na\")\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n     apply(rule_tac\n      t=\"(take na \\<alpha> @ (l2 @ prod_rhs e2 @ r2) # drop (Suc na) \\<alpha>) ! i\"\n      in ssubst)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n      apply(rule nth_append_1)\n      apply(force)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n     apply (metis List.length_take List.nth_append length_take_min nth_take)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(subgoal_tac \"length (take na \\<alpha>)=na\")\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n     prefer 2\n     apply (metis List.length_take)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(rule_tac\n      t=\"(take na \\<alpha> @ (l2 @ prod_rhs e2 @ r2) # drop (Suc na) \\<alpha>) ! i\"\n      and s=\"((l2 @ prod_rhs e2 @ r2) # drop (Suc na) \\<alpha>) ! (i-(length(take na \\<alpha>)))\"\n      in ssubst)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n     apply(rule nth_append_2)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(rule_tac\n      x=\"n'\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"map the (get_labels d' n')\"\n      and s=\"\\<pi>s ! i\"\n      in ssubst)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(subgoal_tac \"length (take na \\<pi>s)=na\")\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    prefer 2\n    apply (metis List.length_take)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(case_tac \"i<na\")\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(rule_tac\n      t=\"(take na \\<pi>s @ (e2 # \\<pi>s ! na) # drop (Suc na) \\<pi>s) ! i\"\n      and s=\"(take na \\<pi>s) ! i\"\n      in ssubst)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n     apply(rule nth_append_1)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply (metis nth_take)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(rule_tac\n      t=\"(take na \\<pi>s @ (e2#\\<pi>s!na) # drop (Suc na) \\<pi>s) ! i\"\n      and s=\"((e2#\\<pi>s!na) # drop (Suc na) \\<pi>s) ! (i-(length(take na \\<pi>s)))\"\n      in ssubst)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply(rule nth_append_2)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n  apply(subgoal_tac \"\\<exists>n. na+n=i\")\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"i-na\"\n      in exI)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule_tac\n      x=\"derivation_append (der2 \\<lparr>cfg_conf = l2 @ teA (prod_lhs e2) # r2\\<rparr> e2 \\<lparr>cfg_conf = l2 @ prod_rhs e2 @ r2\\<rparr>) d' (Suc 0)\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(rule cfgRM.derivation_append_preserves_derivation)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(rule cfgRM.der2_is_derivation)\n     apply(simp add: cfgRM_step_relation_def)\n     apply(rule_tac\n      x=\"l2\"\n      in exI)\n     apply(rule_tac\n      x=\"r2\"\n      in exI)\n     apply(clarsimp)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(simp add: setAConcat)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(simp add: der2_def)\n   apply(rule hlp1)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(rule cfgRM.derivation_belongs)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n      apply(force)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(simp add: derivation_append_def der2_def)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(rule_tac\n      s=\"\\<alpha> ! na\"\n      in ssubst)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(subgoal_tac \"\\<lparr>cfg_conf = foldl (@) [] \\<alpha>\\<rparr> \\<in> cfg_configurations G\")\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(subgoal_tac \"set (\\<alpha>!na) \\<subseteq> set (foldl (@) [] \\<alpha>)\")\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n      apply(subgoal_tac \"setA (\\<alpha>!na) \\<subseteq> setA (foldl (@) [] \\<alpha>)\")\n       apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n       apply(subgoal_tac \"setB (\\<alpha>!na) \\<subseteq> setB (foldl (@) [] \\<alpha>)\")\n        apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n        apply(simp add: cfg_configurations_def)\n        apply(force)\n       apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n       apply(rule set_subset_to_setB_subset)\n       apply(force)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n      apply(rule set_subset_to_setA_subset)\n      apply(force)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(rule set_nth_foldl)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(rule cfgRM.belongs_configurations)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule_tac\n      x=\"Suc n'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(rule_tac\n      x=\"if n'=0 then Some e2 else e'\"\n      in exI)\n   apply(simp add: derivation_append_def der2_def)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d')(*strict*)\n   apply(rule hlp1)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule_tac\n      t=\"(take na \\<pi>s @ (e2 # map the (get_labels d' n')) # drop (Suc na) \\<pi>s) ! na\"\n      and s=\"e2 # map the (get_labels d' n')\"\n      in ssubst)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(rule sym)\n   apply(rule hlp1)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule_tac\n      t=\"get_labels (derivation_append (der2 \\<lparr>cfg_conf = l2 @ teA (prod_lhs e2) # r2\\<rparr> e2 \\<lparr>cfg_conf = l2 @ prod_rhs e2 @ r2\\<rparr>) d' (Suc 0)) (Suc n')\"\n      and s=\"Some e2 # (get_labels d' n')\"\n      in ssubst)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule_tac\n      t=\"(Suc n')\"\n      and s=\"Suc 0+ n'\"\n      in ssubst)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule_tac\n      t=\"get_labels (derivation_append (der2 \\<lparr>cfg_conf = l2 @ teA (prod_lhs e2) # r2\\<rparr> e2 \\<lparr>cfg_conf = l2 @ prod_rhs e2 @ r2\\<rparr>) d' (Suc 0)) (Suc 0 + n')\"\n      in ssubst)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(rule cfgRM.get_labels_concat2)\n       apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n       apply(force)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n      apply(rule cfgRM.der2_is_derivation)\n      apply(simp add: cfgRM_step_relation_def)\n      apply(rule_tac\n      x=\"l2\"\n      in exI)\n      apply(clarsimp)\n      apply(simp add: setAConcat)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(simp add: der2_def)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(simp add: der2_def)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_labels_def der2_def get_label_def)\n  apply(subgoal_tac \"nat_seq (Suc 0) (Suc 0) = [Suc 0]\")\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   prefer 2\n   apply (metis natUptTo_n_n)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(clarsimp)\n  done\n\nlemma equal_labels_implies_equal_cfgRMderivation: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d'\n  \\<Longrightarrow> cfgRM.derivation G d'a\n  \\<Longrightarrow> d' 0 = d'a 0\n  \\<Longrightarrow> i\\<le>n\n  \\<Longrightarrow> d' (n+m1) \\<noteq> None\n  \\<Longrightarrow> d'a (n+m2) \\<noteq> None\n  \\<Longrightarrow> map the (get_labels d' (n+m1)) @ c = map the (get_labels d'a (n + m2))\n  \\<Longrightarrow> d' i = d'a i\"\n  apply(induct i)\n   apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d' i = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+m1\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac i y ya)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d'a i = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+m2\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r la ra)(*strict*)\n  apply(case_tac c2a)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a l r la ra)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c2 e2a l r la ra)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac i y ya e1 e2 c2 e2a l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(subgoal_tac \"\\<exists>ra'. liftB ra' = ra\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB ra\"\n      in exI)\n   apply (metis liftBDeConv2)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra')(*strict*)\n  apply(thin_tac \"setA (liftB ra') = {}\")\n  apply(subgoal_tac \"\\<exists>r'. liftB r' = r\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra')(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB r\"\n      in exI)\n   apply (metis liftBDeConv2)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a l la ra' r')(*strict*)\n  apply(thin_tac \"setA (liftB r') = {}\")\n  apply(subgoal_tac \"liftB r' = liftB ra'\")\n   apply(rename_tac i y ya e1 e2 e2a l la ra' r')(*strict*)\n   prefer 2\n   apply(rule terminalTailEquals1_prime)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a l la ra' r')(*strict*)\n  apply(subgoal_tac \"r'=ra'\")\n   apply(rename_tac i y ya e1 e2 e2a l la ra' r')(*strict*)\n   prefer 2\n   apply(rule liftB_inj)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a l la ra' r')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a la ra')(*strict*)\n  apply(subgoal_tac \"prod_rhs e2 = prod_rhs e2a\")\n   apply(rename_tac i y ya e1 e2 e2a la ra')(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a la ra')(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac i y ya e1 e2 e2a la ra' prod_lhsa prod_rhsa)(*strict*)\n  apply(case_tac e2a)\n  apply(rename_tac i y ya e1 e2 e2a la ra' prod_lhsa prod_rhsa prod_lhsaa prod_rhsaa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 la ra' prod_rhs prod_lhsa prod_rhsa)(*strict*)\n  apply(rename_tac w1 A w2)\n  apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n  apply(subgoal_tac \"(map the (get_labels d' (n + m1)) @ c)!i = (map the (get_labels d'a (n + m2)))!i\")\n   apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n  apply(thin_tac \"map the (get_labels d' (n + m1)) @ c = map the (get_labels d'a (n + m2))\")\n  apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (n + m1)) = (n+m1) + 1 - (Suc 0)\")\n   apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (n + m2)) = (n+m2) + 1 - (Suc 0)\")\n   apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"(map (the \\<circ> (\\<lambda>i. get_label (d' i))) (nat_seq (Suc 0) (n + m1)) @ c) ! i = (map (the \\<circ> (\\<lambda>i. get_label (d' i))) (nat_seq (Suc 0) (n + m1))) ! i\")\n   apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n   prefer 2\n   apply(rule sym)\n   apply(rule nth_appendX)\n   apply(force)\n  apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"nat_seq (Suc 0) (n + m1) ! i = (Suc 0)+i\")\n   apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n  apply(subgoal_tac \"nat_seq (Suc 0) (n + m2) ! i = (Suc 0)+i\")\n   apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 la ra' w1 A w2)(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_label_def)\n  done\n\ntheorem cfg_sub_preserves_cfg_LRk: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfg_sub G1 G2\n  \\<Longrightarrow> cfg_LRk G2 k\n  \\<Longrightarrow> cfg_LRk G1 k\"\n  apply(unfold cfg_LRk_def)\n  apply(rule allI)+\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(rule impI)\n  apply(erule_tac x=\"d1\" in allE)\n  apply(erule_tac x=\"n1\" in allE)\n  apply(erule_tac x=\"\\<delta>1\" in allE)\n  apply(erule_tac x=\"A1\" in allE)\n  apply(erule_tac x=\"y1\" in allE)\n  apply(erule_tac x=\"e1\" in allE)\n  apply(erule_tac x=\"e1'\" in allE)\n  apply(erule_tac x=\"\\<omega>1\" in allE)\n  apply(erule_tac x=\"d2\" in allE)\n  apply(erule_tac x=\"n2\" in allE)\n  apply(erule_tac x=\"\\<delta>2\" in allE)\n  apply(erule_tac x=\"A2\" in allE)\n  apply(erule_tac x=\"y2\" in allE)\n  apply(erule_tac x=\"e2\" in allE)\n  apply(erule_tac x=\"e2'\" in allE)\n  apply(erule_tac x=\"\\<omega>2\" in allE)\n  apply(erule_tac x=\"v\" in allE)\n  apply(erule impE)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(rule_tac cfg_sub_preserves_derivation_initialRM)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(force)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(rule_tac cfg_sub_preserves_derivation_initialRM)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(force)\n  done\n\nlemma cfg_sub_preserves_cfgRM_derivation: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G' d\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgRM.derivation G d\"\n  apply(simp (no_asm) add: cfgRM.derivation_def cfgRM.derivation_initial_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: cfgRM.derivation_def cfgRM.derivation_initial_def)\n   apply(case_tac \"d 0\")\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n   apply(rename_tac nat a)(*strict*)\n   prefer 2\n   apply(rule cfgRM.step_detail_before_some_position)\n     apply(rename_tac nat a)(*strict*)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(force)\n  apply(rename_tac nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(simp add: cfg_sub_def)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n  apply(force)\n  done\n\nlemma cfg_sub_preserves_cfgRM_belongs: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G' d\n  \\<Longrightarrow> cfgRM.belongs G' d\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgRM.belongs G d\"\n  apply(simp add: cfgRM.belongs_def cfg_sub_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac \"d i\")\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac i a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i option b)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac i option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i b)(*strict*)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: cfg_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac i c)(*strict*)\n   apply(force)\n  apply(rename_tac i option b a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i b a)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(clarsimp)\n  apply(simp add: cfg_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac i a c)(*strict*)\n  apply(simp add: cfg_step_labels_def)\n  apply(force)\n  done\n\nlemma cfgRM_deri_can_be_decomposed: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> cfgRM.belongs G d\n  \\<Longrightarrow> d i = Some (pair ei \\<lparr>cfg_conf=w1@w2\\<rparr>)\n  \\<Longrightarrow> d (i+j) = Some (pair ej \\<lparr>cfg_conf=liftB v\\<rparr>)\n  \\<Longrightarrow> \\<exists>v1 v2 d1 d2 e1 e2 n1 n2.\n  v=v1@v2\n  \\<and> j=n1+n2\n  \\<and> cfgRM.derivation G d1\n  \\<and> cfgRM.derivation G d2\n  \\<and> cfgRM.belongs G d1\n  \\<and> cfgRM.belongs G d2\n  \\<and> (get_labels d2 n2)@(get_labels d1 n1)=drop i (get_labels d (i+j))\n  \\<and> d1 0 = Some (pair None \\<lparr>cfg_conf=w1\\<rparr>)\n  \\<and> d2 0 = Some (pair None \\<lparr>cfg_conf=w2\\<rparr>)\n  \\<and> d1 n1 = Some (pair e1 \\<lparr>cfg_conf=liftB v1\\<rparr>)\n  \\<and> d2 n2 = Some (pair e2 \\<lparr>cfg_conf=liftB v2\\<rparr>)\"\n  apply(induct j arbitrary: ej w1 w2 v i ei)\n   apply(rename_tac ej w1 w2 v i ei)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej w1 w2 v i)(*strict*)\n   apply(subgoal_tac \"\\<exists>l'. liftB l' = w1\")\n    apply(rename_tac ej w1 w2 v i)(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB w1\"\n      in exI)\n    apply (rule liftBDeConv2)\n    apply (metis setA_liftB_substring liftB_commutes_over_concat)\n   apply(rename_tac ej w1 w2 v i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej w2 v i l')(*strict*)\n   apply(subgoal_tac \"\\<exists>l'. liftB l' = w2\")\n    apply(rename_tac ej w2 v i l')(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB w2\"\n      in exI)\n    apply (rule liftBDeConv2)\n    apply (metis setA_liftB setA_empty_from_greater_set set_append2)\n   apply(rename_tac ej w2 v i l')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej v i l' l'a)(*strict*)\n   apply(subgoal_tac \"l'@l'a=v\")\n    apply(rename_tac ej v i l' l'a)(*strict*)\n    prefer 2\n    apply(rule liftB_inj)\n    apply(simp add: simpY)\n   apply(rename_tac ej v i l' l'a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(thin_tac \"liftB l' @ liftB l'a = liftB (l' @ l'a)\")\n   apply(rule_tac\n      x=\"l'\"\n      in exI)\n   apply(rule_tac\n      x=\"l'a\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = liftB l'\\<rparr>\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgRM.der1_is_derivation)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = liftB l'a\\<rparr>\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgRM.der1_is_derivation)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgRM.der1_belongs)\n    apply(subgoal_tac \"\\<lparr>cfg_conf = liftB (l' @ l'a)\\<rparr>\\<in> cfg_configurations G\")\n     apply(rename_tac ej i l' l'a)(*strict*)\n     apply(simp add: cfg_configurations_def)\n     apply(simp add: simpY)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgRM.belongs_configurations)\n     apply(rename_tac ej i l' l'a)(*strict*)\n     apply(force)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(force)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgRM.der1_belongs)\n    apply(subgoal_tac \"\\<lparr>cfg_conf = liftB (l' @ l'a)\\<rparr>\\<in> cfg_configurations G\")\n     apply(rename_tac ej i l' l'a)(*strict*)\n     apply(simp add: cfg_configurations_def)\n     apply(simp add: simpY)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgRM.belongs_configurations)\n     apply(rename_tac ej i l' l'a)(*strict*)\n     apply(force)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(force)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule_tac\n      t=\"get_labels (der1 \\<lparr>cfg_conf = liftB l'\\<rparr>) 0\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply (metis get_labelsEmpty)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule_tac\n      t=\"get_labels (der1 \\<lparr>cfg_conf = liftB l'a\\<rparr>) 0\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply (metis get_labelsEmpty)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(simp add: get_labels_def)\n    apply(subgoal_tac \"length (nat_seq (Suc 0) i) = SSn + 1 - SSi\" for SSn SSi)\n     apply(rename_tac ej i l' l'a)(*strict*)\n     prefer 2\n     apply(rule nat_seq_length_prime)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(simp add: der1_def)\n  apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc (i+j)\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n     apply(force)\n    apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n    apply(force)\n   apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n   apply(force)\n  apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej w1 w2 v i ei e2 c2)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac j ej w1 w2 v i ei e2 c2 l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac j ej w1 w2 v i ei e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej w1 w2 v i ei e2 l r)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac j ej w1 w2 v i ei e2 l r prod_lhsa prod_rhsa)(*strict*)\n  apply(rename_tac A v)\n  apply(rename_tac j ej w1 w2 va i ei e2 l r A v)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej w1 w2 va i ei l r A v)(*strict*)\n  apply(subgoal_tac \"\\<exists>l'. liftB l' = r\")\n   apply(rename_tac j ej w1 w2 va i ei l r A v)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB r\"\n      in exI)\n   apply (rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac j ej w1 w2 va i ei l r A v)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej w1 w2 va i ei l A v l')(*strict*)\n  apply(thin_tac \"setA (liftB l') = {}\")\n  apply(erule_tac\n      x=\"ej\"\n      in meta_allE)\n  apply(case_tac \"prefix w1 l\")\n   apply(rename_tac j ej w1 w2 va i ei l A v l')(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac j ej w1 va i ei A v l' c)(*strict*)\n   apply(erule_tac\n      x=\"w1\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"c@v@liftB l'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"va\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"Suc i\"\n      in meta_allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr>\"\n      in meta_allE)\n   apply(clarsimp)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule_tac\n      x=\"v1\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"d1\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"derivation_append (der2 \\<lparr>cfg_conf = c @ teA A # liftB l'\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = c @ v @ liftB l'\\<rparr> ) d2 (Suc 0)\"\n      in exI)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule_tac\n      x=\"e1\"\n      in exI)\n   apply(rule_tac\n      x=\"if n2=0 then Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> else e2\"\n      in exI)\n   apply(rule_tac\n      x=\"n1\"\n      in exI)\n   apply(rule_tac\n      x=\"Suc 0+n2\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule context_conjI)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(rule cfgRM.derivation_append_preserves_derivation)\n      apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n      apply(rule cfgRM.der2_is_derivation)\n      apply(simp add: cfgRM_step_relation_def)\n      apply(rule_tac\n      x=\"c\"\n      in exI)\n      apply(clarsimp)\n      apply(rule setA_liftB)\n     apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n     apply(force)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(simp add: der2_def)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule context_conjI)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(rule cfgRM.derivation_belongs)\n       apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n       apply(force)\n      apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n      apply(simp add: derivation_append_def der2_def)\n     apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n     apply(subgoal_tac \"\\<lparr>cfg_conf = w1 @ c @ teA A # liftB l'\\<rparr> \\<in> cfg_configurations G\")\n      apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n      apply(simp add: cfg_configurations_def)\n      apply(simp add: simpY)\n     apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n     apply(rule cfgRM.belongs_configurations)\n      apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n      apply(force)\n     apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n     apply(force)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def der2_def)\n    apply(clarsimp)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule_tac\n      t=\"get_labels (derivation_append (der2 \\<lparr>cfg_conf = c @ teA A # liftB l'\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = c @ v @ liftB l'\\<rparr>) d2 (Suc 0)) (Suc 0 + n2)\"\n      and s=\" (get_labels (der2 \\<lparr>cfg_conf = c @ teA A # liftB l'\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = c @ v @ liftB l'\\<rparr>) (Suc 0)) @(get_labels d2 n2)\"\n      in ssubst)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(rule cfgRM.get_labels_concat2)\n        apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n        apply(force)\n       apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n       apply(rule cfgRM.der2_is_derivation)\n       apply(simp add: cfgRM_step_relation_def)\n       apply(rule_tac\n      x=\"c\"\n      in exI)\n       apply(clarsimp)\n       apply(rule setA_liftB)\n      apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n      apply(force)\n     apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n     apply(simp add: der2_def)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule_tac\n      t=\"get_labels (der2 \\<lparr>cfg_conf = c @ teA A # liftB l'\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = c @ v @ liftB l'\\<rparr>) (Suc 0)\"\n      and s=\"[Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr>]\"\n      in ssubst)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(rule der2_get_labels)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule_tac\n      t=\"drop i (get_labels d (Suc (i + (n1 + n2))))\"\n      and s=\" [Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr>]@(drop (Suc i) (get_labels d (Suc (i + (n1 + n2))))) \"\n      in ssubst)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(thin_tac \"get_labels d2 n2 @ get_labels d1 n1 = drop (Suc i) (get_labels d (Suc (i + (n1 + n2))))\")\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(rule_tac\n      t=\"drop i (map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (Suc (i + (n1 + n2)))))\"\n      and s=\" (map (\\<lambda>i. get_label (d i)) (drop i (nat_seq (Suc 0) (Suc (i + (n1 + n2))))))\"\n      in ssubst)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(rule drop_map)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule_tac\n      t=\" drop (Suc i) (map (\\<lambda>i. get_label (d i)) ((nat_seq (Suc 0) (Suc (i + (n1 + n2)))))) \"\n      and s=\"(map (\\<lambda>i. get_label (d i)) (drop (Suc i) (nat_seq (Suc 0) (Suc (i + (n1 + n2))))))\"\n      in ssubst)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(rule drop_map)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc (i + (n1 + n2)))) = SSn + 1 - SSi\" for SSn SSi)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule listEqI)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2 ia)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc (i + (n1 + n2))) ! (i + ia) = (SSn)+(SSi)\" for SSn SSi)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2 ia)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2 ia)(*strict*)\n     apply(force)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2 ia)(*strict*)\n    apply(force)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2 ia)(*strict*)\n   apply(clarsimp)\n   apply(case_tac ia)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2 ia)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(simp add: get_label_def)\n   apply(rename_tac ej w1 i ei A v l' c v1 v2 d1 d2 e1 e2 n1 n2 ia nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac j ej w1 w2 va i ei l A v l')(*strict*)\n  apply(subgoal_tac \"prefix w1 l \\<or> prefix l w1\")\n   apply(rename_tac j ej w1 w2 va i ei l A v l')(*strict*)\n   prefer 2\n   apply(rule mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac j ej w1 w2 va i ei l A v l')(*strict*)\n  apply(erule disjE)\n   apply(rename_tac j ej w1 w2 va i ei l A v l')(*strict*)\n   apply(force)\n  apply(rename_tac j ej w1 w2 va i ei l A v l')(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac j ej w2 va i ei l A v l' c)(*strict*)\n  apply(case_tac c)\n   apply(rename_tac j ej w2 va i ei l A v l' c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac j ej w2 va i ei l A v l' c a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej w2 va i ei l A v l' list)(*strict*)\n  apply(subgoal_tac \"\\<exists>l'. liftB l' = w2\")\n   apply(rename_tac j ej w2 va i ei l A v l' list)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB w2\"\n      in exI)\n   apply (rule liftBDeConv2)\n   apply (rule_tac\n      a=\"l'\"\n      and b=\"list\"\n      and c=\"[]\"\n      in setA_liftB_substring)\n   apply(force)\n  apply(rename_tac j ej w2 va i ei l A v l' list)(*strict*)\n  apply(erule exE)\n  apply(rename_tac j ej w2 va i ei l A v l' list l'a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej va i ei l A v l' list l'a)(*strict*)\n  apply(subgoal_tac \"\\<exists>l'. liftB l' = list\")\n   apply(rename_tac j ej va i ei l A v l' list l'a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB list\"\n      in exI)\n   apply (rule liftBDeConv2)\n   apply (rule_tac\n      a=\"l'\"\n      and b=\"[]\"\n      and c=\"liftB l'a\"\n      in setA_liftB_substring)\n   apply(force)\n  apply(rename_tac j ej va i ei l A v l' list l'a)(*strict*)\n  apply(erule exE)\n  apply(rename_tac j ej va i ei l A v l' list l'a l'b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej va i ei l A v l' l'a l'b)(*strict*)\n  apply(subgoal_tac \"l'b@l'a=l'\")\n   apply(rename_tac j ej va i ei l A v l' l'a l'b)(*strict*)\n   prefer 2\n   apply(rule liftB_inj)\n   apply(simp add: simpY)\n  apply(rename_tac j ej va i ei l A v l' l'a l'b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej va i ei l A v l'a l'b)(*strict*)\n  apply(thin_tac \"liftB l'b @ liftB l'a = liftB (l'b @ l'a)\")\n  apply(simp add: simpY)\n  apply(erule_tac\n      x=\"l @ v @ liftB l'b\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"liftB l'a\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"va\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"Suc i\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr>\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n  apply(subgoal_tac \"n2=0\")\n   apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(subgoal_tac \"l'a=v2\")\n    apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    prefer 2\n    apply(rule liftB_inj)\n    apply(force)\n   apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(rule_tac\n      x=\"v1\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"derivation_append (der2 \\<lparr>cfg_conf = l @ teA A # liftB l'b\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = l @ v @ liftB l'b\\<rparr> ) d1 (Suc 0)\"\n      in exI)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(rule_tac\n      x=\"d2\"\n      in exI)\n   apply(rule_tac\n      x=\"if n1=0 then Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> else e1\"\n      in exI)\n   apply(rule_tac\n      x=\"None\"\n      in exI)\n   apply(rule_tac\n      x=\"Suc 0+n1\"\n      in exI)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(rule context_conjI)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(rule cfgRM.derivation_append_preserves_derivation)\n      apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n      apply(rule cfgRM.der2_is_derivation)\n      apply(simp add: cfgRM_step_relation_def)\n      apply(rule_tac\n      x=\"l\"\n      in exI)\n      apply(clarsimp)\n      apply(rule setA_liftB)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n     apply(force)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(simp add: der2_def)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(rule context_conjI)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(rule cfgRM.derivation_belongs)\n       apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n       apply(force)\n      apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n      apply(simp add: derivation_append_def der2_def)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n     apply(subgoal_tac \"\\<lparr>cfg_conf = l @ teA A # liftB l'b @ liftB v2\\<rparr> \\<in> cfg_configurations G\")\n      apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n      apply(simp add: cfg_configurations_def)\n      apply(simp add: simpY)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n     apply(rule cfgRM.belongs_configurations)\n      apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n      apply(force)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n     apply(force)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def der2_def)\n    apply(clarsimp)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(rule_tac\n      t=\"get_labels (derivation_append (der2 \\<lparr>cfg_conf = l @ teA A # liftB l'b\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = l @ v @ liftB l'b\\<rparr>) d1 (Suc 0)) (Suc 0 + n1)\"\n      and s=\" (get_labels (der2 \\<lparr>cfg_conf = l @ teA A # liftB l'b\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = l @ v @ liftB l'b\\<rparr>) (Suc 0)) @(get_labels d1 n1)\"\n      in ssubst)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(rule cfgRM.get_labels_concat2)\n        apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n        apply(force)\n       apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n       apply(rule cfgRM.der2_is_derivation)\n       apply(simp add: cfgRM_step_relation_def)\n       apply(rule_tac\n      x=\"l\"\n      in exI)\n       apply(clarsimp)\n       apply(rule setA_liftB)\n      apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n      apply(force)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n     apply(simp add: der2_def)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(rule_tac\n      t=\"get_labels (der2 \\<lparr>cfg_conf = l @ teA A # liftB l'b\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = l @ v @ liftB l'b\\<rparr>) (Suc 0)\"\n      and s=\"[Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr>]\"\n      in ssubst)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(rule der2_get_labels)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply(subgoal_tac \"get_labels d2 0=[]\")\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(clarsimp)\n    apply(simp add: get_labels_def)\n    apply(rule_tac\n      t=\"drop i (map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (Suc (i + n1))))\"\n      and s=\" (map (\\<lambda>i. get_label (d i)) (drop i (nat_seq (Suc 0) (Suc (i + (n1 ))))))\"\n      in ssubst)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n     apply(rule drop_map)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(rule_tac\n      t=\" drop (Suc i) (map (\\<lambda>i. get_label (d i)) ((nat_seq (Suc 0) (Suc (i + n1))))) \"\n      and s=\"(map (\\<lambda>i. get_label (d i)) (drop (Suc i) (nat_seq (Suc 0) (Suc (i + (n1 ))))))\"\n      in ssubst)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n     apply(rule drop_map)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc (i + n1))) = SSn + 1 - SSi\" for SSn SSi)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n     prefer 2\n     apply(rule nat_seq_length_prime)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n    apply(rule listEqI)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n     apply(force)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1 ia)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"nat_seq (Suc 0) (Suc (i + n1)) ! (i + ia) = (SSn)+(SSi)\" for SSn SSi)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1 ia)(*strict*)\n     prefer 2\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1 ia)(*strict*)\n      apply(force)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1 ia)(*strict*)\n     apply(force)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1 ia)(*strict*)\n    apply(clarsimp)\n    apply(case_tac ia)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1 ia)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n     apply(simp add: get_label_def)\n    apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1 ia nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac ej i ei l A v l'b v1 v2 d1 d2 e1 n1)(*strict*)\n   apply (metis get_labelsEmpty)\n  apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n  apply(rule_tac\n      d=\"d2\"\n      and n=\"0\"\n      in cfgRM_no_step_without_nontermsX)\n      apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n      apply(force)\n     apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n     apply(force)\n    apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(clarsimp)\n   apply(rule setA_liftB)\n  apply(rename_tac ej i ei l A v l'a l'b v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n  apply(force)\n  done\n\nlemma CFGRM_terminals_stay_at_front: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgRM.derivation G d\n  \\<Longrightarrow> setA v = {}\n  \\<Longrightarrow> d i = Some (pair e1 \\<lparr>cfg_conf=v@w\\<rparr>)\n  \\<Longrightarrow> d j = Some (pair e2 \\<lparr>cfg_conf=x\\<rparr>)\n  \\<Longrightarrow> i\\<le>j\n  \\<Longrightarrow> prefix v x\"\n  apply(induct \"j-i\" arbitrary: j e2 x)\n   apply(rename_tac j e2 x)(*strict*)\n   apply(clarsimp)\n   apply(simp add: prefix_def)\n  apply(rename_tac xa j e2 x)(*strict*)\n  apply(clarsimp)\n  apply(case_tac j)\n   apply(rename_tac xa j e2 x)(*strict*)\n   apply(force)\n  apply(rename_tac xa j e2 x nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa e2 x nat)(*strict*)\n  apply(erule_tac\n      x=\"nat\"\n      in meta_allE)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> d (Suc nat) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G c1 e2 c2\")\n   apply(rename_tac xa e2 x nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac xa e2 x nat)(*strict*)\n     apply(force)\n    apply(rename_tac xa e2 x nat)(*strict*)\n    apply(force)\n   apply(rename_tac xa e2 x nat)(*strict*)\n   apply(force)\n  apply(rename_tac xa e2 x nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n  apply(erule_tac\n      x=\"e1a\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"cfg_conf c1\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule meta_impE)\n   apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n   apply(force)\n  apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n   apply(force)\n  apply(rename_tac xa x nat e1a e2a c1)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac xa x nat e1a e2a c1 c)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a e2a c1 c l r)(*strict*)\n  apply(case_tac \"e2a\")\n  apply(rename_tac xa nat e1a e2a c1 c l r prod_lhsa prod_rhsa)(*strict*)\n  apply(rename_tac A w1)\n  apply(rename_tac xa nat e1a e2a c1 c l r A w1)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a c1 c l r A w1)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac xa nat e1a c1 c l r A w1 cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a c l r A w1)(*strict*)\n  apply(subgoal_tac \"prefix v l \\<or> prefix l v\")\n   apply(rename_tac xa nat e1a c l r A w1)(*strict*)\n   prefer 2\n   apply(rule mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac xa nat e1a c l r A w1)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac xa nat e1a c l r A w1)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n  apply(rename_tac xa nat e1a c l r A w1)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a c l r A w1 ca)(*strict*)\n  apply(case_tac ca)\n   apply(rename_tac xa nat e1a c l r A w1 ca)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac xa nat e1a c l r A w1 ca a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa nat e1a c l A w1 list)(*strict*)\n  apply(subgoal_tac \"xa+i=nat\")\n   apply(rename_tac xa nat e1a c l A w1 list)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac xa nat e1a c l A w1 list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa e1a c l A w1 list)(*strict*)\n  apply(simp add: simpY)\n  done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_09/I_cfgRM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.34394861728143317}}
{"text": "(*  Title:      HOL/HOLCF/Fixrec.thy\n    Author:     Amber Telfer and Brian Huffman\n*)\n\nsection \"Package for defining recursive functions in HOLCF\"\n\ntheory Fixrec\nimports Plain_HOLCF\nkeywords \"fixrec\" :: thy_decl\nbegin\n\nsubsection {* Pattern-match monad *}\n\ndefault_sort cpo\n\npcpodef 'a match = \"UNIV::(one ++ 'a u) set\"\nby simp_all\n\ndefinition\n  fail :: \"'a match\" where\n  \"fail = Abs_match (sinl\\<cdot>ONE)\"\n\ndefinition\n  succeed :: \"'a \\<rightarrow> 'a match\" where\n  \"succeed = (\\<Lambda> x. Abs_match (sinr\\<cdot>(up\\<cdot>x)))\"\n\nlemma matchE [case_names bottom fail succeed, cases type: match]:\n  \"\\<lbrakk>p = \\<bottom> \\<Longrightarrow> Q; p = fail \\<Longrightarrow> Q; \\<And>x. p = succeed\\<cdot>x \\<Longrightarrow> Q\\<rbrakk> \\<Longrightarrow> Q\"\nunfolding fail_def succeed_def\napply (cases p, rename_tac r)\napply (rule_tac p=r in ssumE, simp add: Abs_match_strict)\napply (rule_tac p=x in oneE, simp, simp)\napply (rule_tac p=y in upE, simp, simp add: cont_Abs_match)\ndone\n\nlemma succeed_defined [simp]: \"succeed\\<cdot>x \\<noteq> \\<bottom>\"\nby (simp add: succeed_def cont_Abs_match Abs_match_bottom_iff)\n\nlemma fail_defined [simp]: \"fail \\<noteq> \\<bottom>\"\nby (simp add: fail_def Abs_match_bottom_iff)\n\nlemma succeed_eq [simp]: \"(succeed\\<cdot>x = succeed\\<cdot>y) = (x = y)\"\nby (simp add: succeed_def cont_Abs_match Abs_match_inject)\n\nlemma succeed_neq_fail [simp]:\n  \"succeed\\<cdot>x \\<noteq> fail\" \"fail \\<noteq> succeed\\<cdot>x\"\nby (simp_all add: succeed_def fail_def cont_Abs_match Abs_match_inject)\n\nsubsubsection {* Run operator *}\n\ndefinition\n  run :: \"'a match \\<rightarrow> 'a::pcpo\" where\n  \"run = (\\<Lambda> m. sscase\\<cdot>\\<bottom>\\<cdot>(fup\\<cdot>ID)\\<cdot>(Rep_match m))\"\n\ntext {* rewrite rules for run *}\n\nlemma run_strict [simp]: \"run\\<cdot>\\<bottom> = \\<bottom>\"\nunfolding run_def\nby (simp add: cont_Rep_match Rep_match_strict)\n\nlemma run_fail [simp]: \"run\\<cdot>fail = \\<bottom>\"\nunfolding run_def fail_def\nby (simp add: cont_Rep_match Abs_match_inverse)\n\nlemma run_succeed [simp]: \"run\\<cdot>(succeed\\<cdot>x) = x\"\nunfolding run_def succeed_def\nby (simp add: cont_Rep_match cont_Abs_match Abs_match_inverse)\n\nsubsubsection {* Monad plus operator *}\n\ndefinition\n  mplus :: \"'a match \\<rightarrow> 'a match \\<rightarrow> 'a match\" where\n  \"mplus = (\\<Lambda> m1 m2. sscase\\<cdot>(\\<Lambda> _. m2)\\<cdot>(\\<Lambda> _. m1)\\<cdot>(Rep_match m1))\"\n\nabbreviation\n  mplus_syn :: \"['a match, 'a match] \\<Rightarrow> 'a match\"  (infixr \"+++\" 65)  where\n  \"m1 +++ m2 == mplus\\<cdot>m1\\<cdot>m2\"\n\ntext {* rewrite rules for mplus *}\n\nlemma mplus_strict [simp]: \"\\<bottom> +++ m = \\<bottom>\"\nunfolding mplus_def\nby (simp add: cont_Rep_match Rep_match_strict)\n\nlemma mplus_fail [simp]: \"fail +++ m = m\"\nunfolding mplus_def fail_def\nby (simp add: cont_Rep_match Abs_match_inverse)\n\nlemma mplus_succeed [simp]: \"succeed\\<cdot>x +++ m = succeed\\<cdot>x\"\nunfolding mplus_def succeed_def\nby (simp add: cont_Rep_match cont_Abs_match Abs_match_inverse)\n\nlemma mplus_fail2 [simp]: \"m +++ fail = m\"\nby (cases m, simp_all)\n\nlemma mplus_assoc: \"(x +++ y) +++ z = x +++ (y +++ z)\"\nby (cases x, simp_all)\n\nsubsection {* Match functions for built-in types *}\n\ndefault_sort pcpo\n\ndefinition\n  match_bottom :: \"'a \\<rightarrow> 'c match \\<rightarrow> 'c match\"\nwhere\n  \"match_bottom = (\\<Lambda> x k. seq\\<cdot>x\\<cdot>fail)\"\n\ndefinition\n  match_Pair :: \"'a::cpo \\<times> 'b::cpo \\<rightarrow> ('a \\<rightarrow> 'b \\<rightarrow> 'c match) \\<rightarrow> 'c match\"\nwhere\n  \"match_Pair = (\\<Lambda> x k. csplit\\<cdot>k\\<cdot>x)\"\n\ndefinition\n  match_spair :: \"'a \\<otimes> 'b \\<rightarrow> ('a \\<rightarrow> 'b \\<rightarrow> 'c match) \\<rightarrow> 'c match\"\nwhere\n  \"match_spair = (\\<Lambda> x k. ssplit\\<cdot>k\\<cdot>x)\"\n\ndefinition\n  match_sinl :: \"'a \\<oplus> 'b \\<rightarrow> ('a \\<rightarrow> 'c match) \\<rightarrow> 'c match\"\nwhere\n  \"match_sinl = (\\<Lambda> x k. sscase\\<cdot>k\\<cdot>(\\<Lambda> b. fail)\\<cdot>x)\"\n\ndefinition\n  match_sinr :: \"'a \\<oplus> 'b \\<rightarrow> ('b \\<rightarrow> 'c match) \\<rightarrow> 'c match\"\nwhere\n  \"match_sinr = (\\<Lambda> x k. sscase\\<cdot>(\\<Lambda> a. fail)\\<cdot>k\\<cdot>x)\"\n\ndefinition\n  match_up :: \"'a::cpo u \\<rightarrow> ('a \\<rightarrow> 'c match) \\<rightarrow> 'c match\"\nwhere\n  \"match_up = (\\<Lambda> x k. fup\\<cdot>k\\<cdot>x)\"\n\ndefinition\n  match_ONE :: \"one \\<rightarrow> 'c match \\<rightarrow> 'c match\"\nwhere\n  \"match_ONE = (\\<Lambda> ONE k. k)\"\n\ndefinition\n  match_TT :: \"tr \\<rightarrow> 'c match \\<rightarrow> 'c match\"\nwhere\n  \"match_TT = (\\<Lambda> x k. If x then k else fail)\"\n \ndefinition\n  match_FF :: \"tr \\<rightarrow> 'c match \\<rightarrow> 'c match\"\nwhere\n  \"match_FF = (\\<Lambda> x k. If x then fail else k)\"\n\nlemma match_bottom_simps [simp]:\n  \"match_bottom\\<cdot>x\\<cdot>k = (if x = \\<bottom> then \\<bottom> else fail)\"\nby (simp add: match_bottom_def)\n\nlemma match_Pair_simps [simp]:\n  \"match_Pair\\<cdot>(x, y)\\<cdot>k = k\\<cdot>x\\<cdot>y\"\nby (simp_all add: match_Pair_def)\n\nlemma match_spair_simps [simp]:\n  \"\\<lbrakk>x \\<noteq> \\<bottom>; y \\<noteq> \\<bottom>\\<rbrakk> \\<Longrightarrow> match_spair\\<cdot>(:x, y:)\\<cdot>k = k\\<cdot>x\\<cdot>y\"\n  \"match_spair\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_spair_def)\n\nlemma match_sinl_simps [simp]:\n  \"x \\<noteq> \\<bottom> \\<Longrightarrow> match_sinl\\<cdot>(sinl\\<cdot>x)\\<cdot>k = k\\<cdot>x\"\n  \"y \\<noteq> \\<bottom> \\<Longrightarrow> match_sinl\\<cdot>(sinr\\<cdot>y)\\<cdot>k = fail\"\n  \"match_sinl\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_sinl_def)\n\nlemma match_sinr_simps [simp]:\n  \"x \\<noteq> \\<bottom> \\<Longrightarrow> match_sinr\\<cdot>(sinl\\<cdot>x)\\<cdot>k = fail\"\n  \"y \\<noteq> \\<bottom> \\<Longrightarrow> match_sinr\\<cdot>(sinr\\<cdot>y)\\<cdot>k = k\\<cdot>y\"\n  \"match_sinr\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_sinr_def)\n\nlemma match_up_simps [simp]:\n  \"match_up\\<cdot>(up\\<cdot>x)\\<cdot>k = k\\<cdot>x\"\n  \"match_up\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_up_def)\n\nlemma match_ONE_simps [simp]:\n  \"match_ONE\\<cdot>ONE\\<cdot>k = k\"\n  \"match_ONE\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_ONE_def)\n\nlemma match_TT_simps [simp]:\n  \"match_TT\\<cdot>TT\\<cdot>k = k\"\n  \"match_TT\\<cdot>FF\\<cdot>k = fail\"\n  \"match_TT\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_TT_def)\n\nlemma match_FF_simps [simp]:\n  \"match_FF\\<cdot>FF\\<cdot>k = k\"\n  \"match_FF\\<cdot>TT\\<cdot>k = fail\"\n  \"match_FF\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_FF_def)\n\nsubsection {* Mutual recursion *}\n\ntext {*\n  The following rules are used to prove unfolding theorems from\n  fixed-point definitions of mutually recursive functions.\n*}\n\nlemma Pair_equalI: \"\\<lbrakk>x \\<equiv> fst p; y \\<equiv> snd p\\<rbrakk> \\<Longrightarrow> (x, y) \\<equiv> p\"\nby simp\n\nlemma Pair_eqD1: \"(x, y) = (x', y') \\<Longrightarrow> x = x'\"\nby simp\n\nlemma Pair_eqD2: \"(x, y) = (x', y') \\<Longrightarrow> y = y'\"\nby simp\n\nlemma def_cont_fix_eq:\n  \"\\<lbrakk>f \\<equiv> fix\\<cdot>(Abs_cfun F); cont F\\<rbrakk> \\<Longrightarrow> f = F f\"\nby (simp, subst fix_eq, simp)\n\nlemma def_cont_fix_ind:\n  \"\\<lbrakk>f \\<equiv> fix\\<cdot>(Abs_cfun F); cont F; adm P; P \\<bottom>; \\<And>x. P x \\<Longrightarrow> P (F x)\\<rbrakk> \\<Longrightarrow> P f\"\nby (simp add: fix_ind)\n\ntext {* lemma for proving rewrite rules *}\n\nlemma ssubst_lhs: \"\\<lbrakk>t = s; P s = Q\\<rbrakk> \\<Longrightarrow> P t = Q\"\nby simp\n\n\nsubsection {* Initializing the fixrec package *}\n\nML_file \"Tools/holcf_library.ML\"\nML_file \"Tools/fixrec.ML\"\n\nmethod_setup fixrec_simp = {*\n  Scan.succeed (SIMPLE_METHOD' o Fixrec.fixrec_simp_tac)\n*} \"pattern prover for fixrec constants\"\n\nsetup {*\n  Fixrec.add_matchers\n    [ (@{const_name up}, @{const_name match_up}),\n      (@{const_name sinl}, @{const_name match_sinl}),\n      (@{const_name sinr}, @{const_name match_sinr}),\n      (@{const_name spair}, @{const_name match_spair}),\n      (@{const_name Pair}, @{const_name match_Pair}),\n      (@{const_name ONE}, @{const_name match_ONE}),\n      (@{const_name TT}, @{const_name match_TT}),\n      (@{const_name FF}, @{const_name match_FF}),\n      (@{const_name bottom}, @{const_name match_bottom}) ]\n*}\n\nhide_const (open) succeed fail run\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/Fixrec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3439486092381612}}
{"text": "(* Author: Andreas Lochbihler, ETH Zurich *)\n\ntheory More_CryptHOL imports\n  CryptHOL.CryptHOL\nbegin\n\n(* Misc *)\n\nlemma is_empty_image [simp]: \"Set.is_empty (f ` A) = Set.is_empty A\"\n  by(auto simp add: Set.is_empty_def)\n\nlemma inj_on_map_sum [simp]:\n  \"\\<lbrakk> inj_on f A; inj_on g B \\<rbrakk> \\<Longrightarrow> inj_on (map_sum f g) (A <+> B)\"\nproof(rule inj_onI, goal_cases)\n  case (1 x y)\n  then show ?case by(cases x; cases y; auto simp add: inj_on_def)\nqed\n\nlemma inv_into_map_sum:\n  \"inv_into (A <+> B) (map_sum f g) x = map_sum (inv_into A f) (inv_into B g) x\"\n  if \"x \\<in> f ` A <+> g ` B\" \"inj_on f A\" \"inj_on g B\"\n  using that by(cases rule: PlusE[consumes 1])(auto simp add: inv_into_f_eq f_inv_into_f)\n\nlemma Pair_fst_Unity: \"(fst x, ()) = x\"\n  by(cases x) simp\n\nfun rsuml :: \"('a + 'b) + 'c \\<Rightarrow> 'a + ('b + 'c)\" where\n  \"rsuml (Inl (Inl a)) = Inl a\"\n| \"rsuml (Inl (Inr b)) = Inr (Inl b)\"\n| \"rsuml (Inr c) = Inr (Inr c)\"\n\nfun lsumr :: \"'a + ('b + 'c) \\<Rightarrow> ('a + 'b) + 'c\" where\n  \"lsumr (Inl a) = Inl (Inl a)\"\n| \"lsumr (Inr (Inl b)) = Inl (Inr b)\"\n| \"lsumr (Inr (Inr c)) = Inr c\"\n\nlemma rsuml_lsumr [simp]: \"rsuml (lsumr x) = x\"\n  by(cases x rule: lsumr.cases) simp_all\n\nlemma lsumr_rsuml [simp]: \"lsumr (rsuml x) = x\"\n  by(cases x rule: rsuml.cases) simp_all\n\ndefinition rprodl :: \"('a \\<times> 'b) \\<times> 'c \\<Rightarrow> 'a \\<times> ('b \\<times> 'c)\" where \"rprodl = (\\<lambda>((a, b), c). (a, (b, c)))\"\n\nlemma rprodl_simps [simp]: \"rprodl ((a, b), c) = (a, (b, c))\"\n  by(simp add: rprodl_def)\n\nlemma rprodl_parametric [transfer_rule]: includes lifting_syntax shows\n  \"(rel_prod (rel_prod A B) C ===> rel_prod A (rel_prod B C)) rprodl rprodl\"\n  unfolding rprodl_def by transfer_prover\n\ndefinition lprodr :: \"'a \\<times> ('b \\<times> 'c) \\<Rightarrow> ('a \\<times> 'b) \\<times> 'c\" where \"lprodr = (\\<lambda>(a, b, c). ((a, b), c))\"\n\nlemma lprodr_simps [simp]: \"lprodr (a, b, c) = ((a, b), c)\"\n  by(simp add: lprodr_def)\n\nlemma lprodr_parametric [transfer_rule]: includes lifting_syntax shows\n  \"(rel_prod A (rel_prod B C) ===> rel_prod (rel_prod A B) C) lprodr lprodr\"\n  unfolding lprodr_def by transfer_prover\n\nlemma lprodr_inverse [simp]: \"rprodl (lprodr x) = x\"\n  by(cases x) auto\n\nlemma rprodl_inverse [simp]: \"lprodr (rprodl x) = x\"\n  by(cases x) auto\n\n\n\n\nlemma rel_fun_map_fun1: \"rel_fun (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> A f g \\<Longrightarrow> rel_fun (=) A (map_fun h id f) g\"\n  by(auto simp add: rel_fun_def Grp_def)\n\nlemma rel_fun_map_fun2: \"rel_fun (eq_on (range h)) A f g \\<Longrightarrow> rel_fun (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> A f (map_fun h id g)\"\n  by(auto simp add: rel_fun_def Grp_def eq_onp_def)\n\nlemma map_fun2_id: \"map_fun f g x = g \\<circ> map_fun f id x\"\n  by(simp add: map_fun_def o_assoc)\n\nlemma rel_fun_refl_eq_onp:\n  \"(\\<And>z. z \\<in> f ` X \\<Longrightarrow> A z z) \\<Longrightarrow> rel_fun (eq_on X) A f f\"\n  by(auto simp add: rel_fun_def eq_onp_def)\n\nlemma map_fun_id2_in: \"map_fun g h f = map_fun g id (h \\<circ> f)\"\n  by(simp add: map_fun_def)\n\nlemma Domainp_rel_fun_le: \"Domainp (rel_fun A B) \\<le> pred_fun (Domainp A) (Domainp B)\"\n  by(auto dest: rel_funD)\n\nlemma eq_onE: \"\\<lbrakk> eq_on X a b; \\<lbrakk> b \\<in> X; a = b \\<rbrakk> \\<Longrightarrow> thesis \\<rbrakk> \\<Longrightarrow> thesis\" by auto\n\nlemma Domainp_eq_on [simp]: \"Domainp (eq_on X) = (\\<lambda>x. x \\<in> X)\"\n  by auto\n\ndeclare eq_on_def [simp del]\n\nlemma pred_prod_mono' [mono]:\n  \"pred_prod A B xy \\<longrightarrow> pred_prod A' B' xy\"\n  if \"\\<And>x. A x \\<longrightarrow> A' x\" \"\\<And>y. B y \\<longrightarrow> B' y\"\n  using that by(cases xy) auto\n\nfun rel_witness_prod :: \"('a \\<times> 'b) \\<times> ('c \\<times> 'd) \\<Rightarrow> (('a \\<times> 'c) \\<times> ('b \\<times> 'd))\" where\n  \"rel_witness_prod ((a, b), (c, d)) = ((a, c), (b, d))\"\n\nconsts relcompp_witness :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('b \\<Rightarrow> 'c \\<Rightarrow> bool) \\<Rightarrow> 'a \\<times> 'c \\<Rightarrow> 'b\"\nspecification (relcompp_witness)\n  relcompp_witness1: \"(A OO B) (fst xy) (snd xy) \\<Longrightarrow> A (fst xy) (relcompp_witness A B xy)\"\n  relcompp_witness2: \"(A OO B) (fst xy) (snd xy) \\<Longrightarrow> B (relcompp_witness A B xy) (snd xy)\"\n  apply(fold all_conj_distrib)\n  apply(rule choice allI)+\n  by(auto intro: choice allI)\n\nlemmas relcompp_witness[of _ _ \"(x, y)\" for x y, simplified] = relcompp_witness1 relcompp_witness2\n\nhide_fact (open) relcompp_witness1 relcompp_witness2\n\nlemma relcompp_witness_eq [simp]: \"relcompp_witness (=) (=) (x, x) = x\"\n  using relcompp_witness(1)[of \"(=)\" \"(=)\" x x] by(simp add: eq_OO)\n\nfun rel_witness_option :: \"'a option \\<times> 'b option \\<Rightarrow> ('a \\<times> 'b) option\" where\n  \"rel_witness_option (Some x, Some y) = Some (x, y)\"\n| \"rel_witness_option (None, None) = None\"\n| \"rel_witness_option _ = None\" \\<comment> \\<open>Just to make the definition complete\\<close>\n\nlemma rel_witness_option:\n  shows set_rel_witness_option: \"\\<lbrakk> rel_option A x y; (a, b) \\<in> set_option (rel_witness_option (x, y)) \\<rbrakk> \\<Longrightarrow> A a b\"\n    and map1_rel_witness_option: \"rel_option A x y \\<Longrightarrow> map_option fst (rel_witness_option (x, y)) = x\"\n    and map2_rel_witness_option: \"rel_option A x y \\<Longrightarrow> map_option snd (rel_witness_option (x, y)) = y\"\n  by(cases \"(x, y)\" rule: rel_witness_option.cases; simp; fail)+\n\nlemma rel_witness_option1:\n  assumes \"rel_option A x y\"\n  shows \"rel_option (\\<lambda>a (a', b). a = a' \\<and> A a' b) x (rel_witness_option (x, y))\"\n  using map1_rel_witness_option[OF assms, symmetric]\n  unfolding option.rel_eq[symmetric] option.rel_map\n  by(rule option.rel_mono_strong)(auto intro: set_rel_witness_option[OF assms])\n\nlemma rel_witness_option2:\n  assumes \"rel_option A x y\"\n  shows \"rel_option (\\<lambda>(a, b') b. b = b' \\<and> A a b') (rel_witness_option (x, y)) y\"\n  using map2_rel_witness_option[OF assms]\n  unfolding option.rel_eq[symmetric] option.rel_map\n  by(rule option.rel_mono_strong)(auto intro: set_rel_witness_option[OF assms])\n\n\ndefinition rel_witness_fun :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('b \\<Rightarrow> 'c \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'd) \\<times> ('c \\<Rightarrow> 'e) \\<Rightarrow> ('b \\<Rightarrow> 'd \\<times> 'e)\" where\n  \"rel_witness_fun A A' = (\\<lambda>(f, g) b. (f (THE a. A a b), g (THE c. A' b c)))\"\n\nlemma\n  assumes fg: \"rel_fun (A OO A') B f g\"\n    and A: \"left_unique A\" \"right_total A\"\n    and A': \"right_unique A'\" \"left_total A'\"\n  shows rel_witness_fun1: \"rel_fun A (\\<lambda>x (x', y). x = x' \\<and> B x' y) f (rel_witness_fun A A' (f, g))\"\n    and rel_witness_fun2: \"rel_fun A' (\\<lambda>(x, y') y. y = y' \\<and> B x y') (rel_witness_fun A A' (f, g)) g\"\nproof (goal_cases)\n  case 1\n  have \"A x y \\<Longrightarrow> f x = f (THE a. A a y) \\<and> B (f (THE a. A a y)) (g (The (A' y)))\" for x y \n    by(rule left_totalE[OF A'(2)]; erule meta_allE[of _ y]; erule exE; frule (1) fg[THEN rel_funD, OF relcomppI])\n      (auto intro!: arg_cong[where f=f] arg_cong[where f=g] rel_funI the_equality the_equality[symmetric] dest: left_uniqueD[OF A(1)] right_uniqueD[OF A'(1)] elim!: arg_cong2[where f=B, THEN iffD2, rotated -1])\n\n  with 1 show ?case by(clarsimp simp add: rel_fun_def rel_witness_fun_def)\nnext\n  case 2\n  have \"A' x y \\<Longrightarrow> g y = g (The (A' x)) \\<and> B (f (THE a. A a x)) (g (The (A' x)))\" for x y\n    by(rule right_totalE[OF A(2), of x]; frule (1) fg[THEN rel_funD, OF relcomppI])\n      (auto intro!: arg_cong[where f=f] arg_cong[where f=g] rel_funI the_equality the_equality[symmetric] dest: left_uniqueD[OF A(1)] right_uniqueD[OF A'(1)] elim!: arg_cong2[where f=B, THEN iffD2, rotated -1])\n\n  with 2 show ?case by(clarsimp simp add: rel_fun_def rel_witness_fun_def)    \nqed\n\nlemma rel_witness_fun_eq [simp]: \"rel_witness_fun (=) (=) (f, g) = (\\<lambda>x. (f x, g x))\"\n  by(simp add: rel_witness_fun_def)\n\n\nconsts rel_witness_pmf :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> 'a pmf \\<times> 'b pmf \\<Rightarrow> ('a \\<times> 'b) pmf\"\nspecification (rel_witness_pmf)\n  set_rel_witness_pmf': \"rel_pmf A (fst xy) (snd xy) \\<Longrightarrow> set_pmf (rel_witness_pmf A xy) \\<subseteq> {(a, b). A a b}\"\n  map1_rel_witness_pmf': \"rel_pmf A (fst xy) (snd xy) \\<Longrightarrow> map_pmf fst (rel_witness_pmf A xy) = fst xy\"\n  map2_rel_witness_pmf': \"rel_pmf A (fst xy) (snd xy) \\<Longrightarrow> map_pmf snd (rel_witness_pmf A xy) = snd xy\"\n  apply(fold all_conj_distrib imp_conjR)\n  apply(rule choice allI)+\n  apply(unfold pmf.in_rel)\n  by blast\n\nlemmas set_rel_witness_pmf = set_rel_witness_pmf'[of _ \"(x, y)\" for x y, simplified]\nlemmas map1_rel_witness_pmf = map1_rel_witness_pmf'[of _ \"(x, y)\" for x y, simplified]\nlemmas map2_rel_witness_pmf = map2_rel_witness_pmf'[of _ \"(x, y)\" for x y, simplified]\nlemmas rel_witness_pmf = set_rel_witness_pmf map1_rel_witness_pmf map2_rel_witness_pmf\n\nlemma rel_witness_pmf1:\n  assumes \"rel_pmf A p q\" \n  shows \"rel_pmf (\\<lambda>a (a', b). a = a' \\<and> A a' b) p (rel_witness_pmf A (p, q))\"\n  using map1_rel_witness_pmf[OF assms, symmetric]\n  unfolding pmf.rel_eq[symmetric] pmf.rel_map\n  by(rule pmf.rel_mono_strong)(auto dest: set_rel_witness_pmf[OF assms, THEN subsetD])\n\nlemma rel_witness_pmf2:\n  assumes \"rel_pmf A p q\" \n  shows \"rel_pmf (\\<lambda>(a, b') b. b = b' \\<and> A a b') (rel_witness_pmf A (p, q)) q\"\n  using map2_rel_witness_pmf[OF assms]\n  unfolding pmf.rel_eq[symmetric] pmf.rel_map\n  by(rule pmf.rel_mono_strong)(auto dest: set_rel_witness_pmf[OF assms, THEN subsetD])\n\ndefinition rel_witness_spmf :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> 'a spmf \\<times> 'b spmf \\<Rightarrow> ('a \\<times> 'b) spmf\" where\n  \"rel_witness_spmf A = map_pmf rel_witness_option \\<circ> rel_witness_pmf (rel_option A)\"\n\nlemma assumes \"rel_spmf A p q\"\n  shows rel_witness_spmf1: \"rel_spmf (\\<lambda>a (a', b). a = a' \\<and> A a' b) p (rel_witness_spmf A (p, q))\"\n    and rel_witness_spmf2: \"rel_spmf (\\<lambda>(a, b') b. b = b' \\<and> A a b') (rel_witness_spmf A (p, q)) q\"\n  by(auto simp add: pmf.rel_map rel_witness_spmf_def intro: pmf.rel_mono_strong[OF rel_witness_pmf1[OF assms]] rel_witness_option1 pmf.rel_mono_strong[OF rel_witness_pmf2[OF assms]] rel_witness_option2)\n\n\nprimrec (transfer) enforce_option :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a option \\<Rightarrow> 'a option\" where\n  \"enforce_option P (Some x) = (if P x then Some x else None)\"\n| \"enforce_option P None = None\"\n\nlemma set_enforce_option [simp]: \"set_option (enforce_option P x) = {a \\<in> set_option x. P a}\"\n  by(cases x) auto\n\nlemma enforce_map_option: \"enforce_option P (map_option f x) = map_option f (enforce_option (P \\<circ> f) x)\"\n  by(cases x) auto\n\nlemma enforce_bind_option [simp]:\n  \"enforce_option P (Option.bind x f) = Option.bind x (enforce_option P \\<circ> f)\"\n  by(cases x) auto\n\nlemma enforce_option_alt_def:\n  \"enforce_option P x = Option.bind x (\\<lambda>a. Option.bind (assert_option (P a)) (\\<lambda>_ :: unit. Some a))\"\n  by(cases x) simp_all\n\nlemma enforce_option_eq_None_iff [simp]:\n  \"enforce_option P x = None \\<longleftrightarrow> (\\<forall>a. x = Some a \\<longrightarrow> \\<not> P a)\"\n  by(cases x) auto\n\nlemma enforce_option_eq_Some_iff [simp]:\n  \"enforce_option P x = Some y \\<longleftrightarrow> x = Some y \\<and> P y\"\n  by(cases x) auto\n\nlemma Some_eq_enforce_option_iff [simp]:\n  \"Some y = enforce_option P x \\<longleftrightarrow> x = Some y \\<and> P y\"\n  by(cases x) auto\n\nlemma enforce_option_top [simp]: \"enforce_option \\<top> = id\"\n  by(rule ext; rename_tac x; case_tac x; simp)\n\nlemma enforce_option_K_True [simp]: \"enforce_option (\\<lambda>_. True) x = x\"\n  by(cases x) simp_all\n\nlemma enforce_option_bot [simp]: \"enforce_option \\<bottom> = (\\<lambda>_. None)\"\n  by(simp add: fun_eq_iff)\n\nlemma enforce_option_K_False [simp]: \"enforce_option (\\<lambda>_. False) x = None\"\n  by simp\n\nlemma enforce_pred_id_option: \"pred_option P x \\<Longrightarrow> enforce_option P x = x\"\n  by(cases x) auto\n\nlemma rel_fun_refl: \"\\<lbrakk> A \\<le> (=); (=) \\<le> B \\<rbrakk> \\<Longrightarrow> (=) \\<le> rel_fun A B\"\n  by(subst fun.rel_eq[symmetric])(rule fun_mono)\n\nlemma rel_fun_mono_strong:\n  \"\\<lbrakk> rel_fun A B f g; A' \\<le> A; \\<And>x y. \\<lbrakk> x \\<in> f ` {x. Domainp A' x}; y \\<in> g ` {x. Rangep A' x}; B x y \\<rbrakk> \\<Longrightarrow> B' x y \\<rbrakk> \\<Longrightarrow> rel_fun A' B' f g\"\n  by(auto simp add: rel_fun_def) fastforce\n\nlemma rel_fun_refl_strong: \n  assumes \"A \\<le> (=)\" \"\\<And>x. x \\<in> f ` {x. Domainp A x} \\<Longrightarrow> B x x\"\n  shows \"rel_fun A B f f\"\nproof -\n  have \"rel_fun (=) (=) f f\" by(simp add: rel_fun_eq)\n  then show ?thesis using assms(1)\n    by(rule rel_fun_mono_strong) (auto intro: assms(2))\nqed\n\nlemma Grp_iff: \"BNF_Def.Grp B g x y \\<longleftrightarrow> y = g x \\<and> x \\<in> B\" by(simp add: Grp_def)\n\nlemma Rangep_Grp: \"Rangep (BNF_Def.Grp A f) = (\\<lambda>x. x \\<in> f ` A)\"\n  by(auto simp add: fun_eq_iff Grp_iff)\n\nlemma Domainp_Grp: \"Domainp (BNF_Def.Grp A f) = (\\<lambda>x. x \\<in> A)\"\n  by(auto simp add: Grp_iff fun_eq_iff)\n\nlemma rel_fun_Grp:\n  \"rel_fun (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> (BNF_Def.Grp A g) = BNF_Def.Grp {f. f ` range h \\<subseteq> A} (map_fun h g)\"\n  by(auto simp add: rel_fun_def fun_eq_iff Grp_iff)\n\nlemma wf_strict_prefix: \"wfP strict_prefix\"\nproof -\n  from wf have \"wf (inv_image {(x, y). x < y} length)\" by(rule wf_inv_image)\n  moreover have \"{(x, y). strict_prefix x y} \\<subseteq> inv_image {(x, y). x < y} length\" by(auto intro: prefix_length_less)\n  ultimately show ?thesis unfolding wfP_def by(rule wf_subset)\nqed\n\nlemma strict_prefix_setD:\n  \"strict_prefix xs ys \\<Longrightarrow> set xs \\<subseteq> set ys\"\n  by(auto simp add: strict_prefix_def prefix_def)\n\n\n(* SPMF *)\n\nlemma weight_assert_spmf [simp]: \"weight_spmf (assert_spmf b) = indicator {True} b\"\n  by(simp split: split_indicator)\n\ndefinition enforce_spmf :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a spmf \\<Rightarrow> 'a spmf\" where\n  \"enforce_spmf P = map_pmf (enforce_option P)\"\n\nlemma enforce_spmf_parametric [transfer_rule]: includes lifting_syntax shows\n  \"((A ===> (=)) ===> rel_spmf A ===> rel_spmf A) enforce_spmf enforce_spmf\"\n  unfolding enforce_spmf_def by transfer_prover\n\nlemma enforce_return_spmf [simp]:\n  \"enforce_spmf P (return_spmf x) = (if P x then return_spmf x else return_pmf None)\"\n  by(simp add: enforce_spmf_def)\n\nlemma enforce_return_pmf_None [simp]:\n  \"enforce_spmf P (return_pmf None) = return_pmf None\"\n  by(simp add: enforce_spmf_def)\n\nlemma enforce_map_spmf:\n  \"enforce_spmf P (map_spmf f p) = map_spmf f (enforce_spmf (P \\<circ> f) p)\"\n  by(simp add: enforce_spmf_def pmf.map_comp o_def enforce_map_option)\n\nlemma enforce_bind_spmf [simp]:\n  \"enforce_spmf P (bind_spmf p f) = bind_spmf p (enforce_spmf P \\<circ> f)\"\n  by(auto simp add: enforce_spmf_def bind_spmf_def map_bind_pmf intro!: bind_pmf_cong split: option.split)\n\nlemma set_enforce_spmf [simp]: \"set_spmf (enforce_spmf P p) = {a \\<in> set_spmf p. P a}\"\n  by(auto simp add: enforce_spmf_def in_set_spmf)\n\nlemma enforce_spmf_alt_def:\n  \"enforce_spmf P p = bind_spmf p (\\<lambda>a. bind_spmf (assert_spmf (P a)) (\\<lambda>_ :: unit. return_spmf a))\"\n  by(auto simp add: enforce_spmf_def assert_spmf_def map_pmf_def bind_spmf_def bind_return_pmf intro!: bind_pmf_cong split: option.split)\n\nlemma bind_enforce_spmf [simp]:\n  \"bind_spmf (enforce_spmf P p) f = bind_spmf p (\\<lambda>x. if P x then f x else return_pmf None)\"\n  by(auto simp add: enforce_spmf_alt_def assert_spmf_def intro!: bind_spmf_cong)\n\nlemma weight_enforce_spmf:\n  \"weight_spmf (enforce_spmf P p) = weight_spmf p - measure (measure_spmf p) {x. \\<not> P x}\" (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs = LINT x|measure_spmf p. indicator {x. P x} x\"\n    by(auto simp add: enforce_spmf_alt_def weight_bind_spmf o_def simp del: Bochner_Integration.integral_indicator intro!: Bochner_Integration.integral_cong split: split_indicator)\n  also have \"\\<dots> = ?rhs\"\n    by(subst measure_spmf.finite_measure_Diff[symmetric])(auto simp add: space_measure_spmf intro!: arg_cong2[where f=measure])\n  finally show ?thesis .\nqed\n\nlemma lossless_enforce_spmf [simp]:\n  \"lossless_spmf (enforce_spmf P p) \\<longleftrightarrow> lossless_spmf p \\<and> set_spmf p \\<subseteq> {x. P x}\"\n  by(auto simp add: enforce_spmf_alt_def)\n\nlemma enforce_spmf_top [simp]: \"enforce_spmf \\<top> = id\"\n  by(simp add: enforce_spmf_def)\n\nlemma enforce_spmf_K_True [simp]: \"enforce_spmf (\\<lambda>_. True) p = p\"\n  using enforce_spmf_top[THEN fun_cong, of p] by(simp add: top_fun_def)\n\nlemma enforce_spmf_bot [simp]: \"enforce_spmf \\<bottom> = (\\<lambda>_. return_pmf None)\"\n  by(simp add: enforce_spmf_def fun_eq_iff)\n\nlemma enforce_spmf_K_False [simp]: \"enforce_spmf (\\<lambda>_. False) p = return_pmf None\"\n  using enforce_spmf_bot[THEN fun_cong, of p] by(simp add: bot_fun_def)\n\nlemma enforce_pred_id_spmf: \"enforce_spmf P p = p\" if \"pred_spmf P p\"\nproof -\n  have \"enforce_spmf P p = map_pmf id p\" using that\n    by(auto simp add: enforce_spmf_def enforce_pred_id_option simp del: map_pmf_id intro!: pmf.map_cong_pred[OF refl] elim!: pmf_pred_mono_strong)\n  then show ?thesis by simp\nqed\n\nlemma map_the_spmf_of_pmf [simp]: \"map_pmf the (spmf_of_pmf p) = p\"\n  by(simp add: spmf_of_pmf_def pmf.map_comp o_def)\n\nlemma bind_bind_conv_pair_spmf:\n  \"bind_spmf p (\\<lambda>x. bind_spmf q (f x)) = bind_spmf (pair_spmf p q) (\\<lambda>(x, y). f x y)\"\n  by(simp add: pair_spmf_alt_def)\n\nlemma cond_pmf_of_set:\n  assumes fin: \"finite A\" and nonempty: \"A \\<inter> B \\<noteq> {}\"\n  shows \"cond_pmf (pmf_of_set A) B = pmf_of_set (A \\<inter> B)\" (is \"?lhs = ?rhs\")\nproof(rule pmf_eqI)\n  from nonempty have A: \"A \\<noteq> {}\" by auto\n  show \"pmf ?lhs x = pmf ?rhs x\" for x\n    by(subst pmf_cond; clarsimp simp add: fin A nonempty measure_pmf_of_set split: split_indicator)\nqed\n\nlemma cond_spmf_spmf_of_set:\n  \"cond_spmf (spmf_of_set A) B = spmf_of_set (A \\<inter> B)\" if \"finite A\"\n  by(rule spmf_eqI)(auto simp add: spmf_of_set measure_spmf_of_set that split: split_indicator)\n\nlemma pair_pmf_of_set:\n  assumes A: \"finite A\" \"A \\<noteq> {}\"\n    and B: \"finite B\" \"B \\<noteq> {}\"\n  shows \"pair_pmf (pmf_of_set A) (pmf_of_set B) = pmf_of_set (A \\<times> B)\"\n  by(rule pmf_eqI)(clarsimp simp add: pmf_pair assms split: split_indicator)\n\nlemma pair_spmf_of_set:\n  \"pair_spmf (spmf_of_set A) (spmf_of_set B) = spmf_of_set (A \\<times> B)\"\n  by(rule spmf_eqI)(clarsimp simp add: spmf_of_set card_cartesian_product split: split_indicator)\n\n(*lemma cond_bind_pmf:\n  assumes *: \"\\<And>x. x \\<in> set_pmf p \\<Longrightarrow> set_pmf (f x) \\<inter> A \\<noteq> {}\"\n  shows \"cond_pmf (bind_pmf p f) A = bind_pmf p (\\<lambda>x. cond_pmf (f x) A)\"\n  apply(rule pmf_eqI)\n  apply(subst pmf_cond)\n  subgoal using * set_pmf_not_empty[of p] by auto\n  apply clarsimp\n  oops*)\n\nlemma emeasure_cond_pmf:\n  fixes p A\n  defines \"q \\<equiv> cond_pmf p A\"\n  assumes \"set_pmf p \\<inter> A \\<noteq> {}\"\n  shows \"emeasure (measure_pmf q) B = emeasure (measure_pmf p) (A \\<inter> B) / emeasure (measure_pmf p) A\"\nproof -\n  note [transfer_rule] = cond_pmf.transfer[OF assms(2), folded q_def]\n  interpret pmf_as_measure .\n  show ?thesis by transfer simp\nqed\n\nlemma measure_cond_pmf:\n  \"measure (measure_pmf (cond_pmf p A)) B = measure (measure_pmf p) (A \\<inter> B) / measure (measure_pmf p) A\"\n  if \"set_pmf p \\<inter> A \\<noteq> {}\"\n  using emeasure_cond_pmf[OF that, of B] that \n  by(auto simp add: measure_pmf.emeasure_eq_measure measure_pmf_posI divide_ennreal)\n\nlemma emeasure_measure_pmf_zero_iff: \"emeasure (measure_pmf p) s = 0 \\<longleftrightarrow> set_pmf p \\<inter> s = {}\" (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs \\<longleftrightarrow> (AE x in measure_pmf p. x \\<notin> s)\"\n    by(subst AE_iff_measurable)(auto)\n  also have \"\\<dots> = ?rhs\" by(auto simp add: AE_measure_pmf_iff)\n  finally show ?thesis .\nqed\n\nlemma emeasure_cond_spmf:\n  \"emeasure (measure_spmf (cond_spmf p A)) B = emeasure (measure_spmf p) (A \\<inter> B) / emeasure (measure_spmf p) A\"\n  apply(clarsimp simp add: cond_spmf_def emeasure_measure_spmf_conv_measure_pmf emeasure_measure_pmf_zero_iff set_pmf_Int_Some split!: if_split)\n   apply blast\n  apply(subst (asm) emeasure_cond_pmf)\n  by(auto simp add: set_pmf_Int_Some image_Int)\n\nlemma measure_cond_spmf:\n  \"measure (measure_spmf (cond_spmf p A)) B = measure (measure_spmf p) (A \\<inter> B) / measure (measure_spmf p) A\"\n  apply(clarsimp simp add: cond_spmf_def measure_measure_spmf_conv_measure_pmf measure_pmf_zero_iff set_pmf_Int_Some split!: if_split)\n  apply(subst (asm) measure_cond_pmf)\n  by(auto simp add: image_Int set_pmf_Int_Some)\n\n\nlemma lossless_cond_spmf [simp]: \"lossless_spmf (cond_spmf p A) \\<longleftrightarrow> set_spmf p \\<inter> A \\<noteq> {}\"\n  by(clarsimp simp add: cond_spmf_def lossless_iff_set_pmf_None set_pmf_Int_Some)\n\nlemma measure_spmf_eq_density: \"measure_spmf p = density (count_space UNIV) (spmf p)\"\n  by(rule measure_eqI)(simp_all add: emeasure_density nn_integral_spmf[symmetric] nn_integral_count_space_indicator)\n\nlemma integral_measure_spmf:\n  fixes f :: \"'a \\<Rightarrow> 'b::{banach, second_countable_topology}\"\n  assumes A: \"finite A\"\n  shows \"(\\<And>a. a \\<in> set_spmf M \\<Longrightarrow> f a \\<noteq> 0 \\<Longrightarrow> a \\<in> A) \\<Longrightarrow> (LINT x|measure_spmf M. f x) = (\\<Sum>a\\<in>A. spmf M a *\\<^sub>R f a)\"\n  unfolding measure_spmf_eq_density\n  apply (simp add: integral_density)\n  apply (subst lebesgue_integral_count_space_finite_support)\n  by (auto intro!: finite_subset[OF _ \\<open>finite A\\<close>] sum.mono_neutral_left simp: spmf_eq_0_set_spmf)\n\n\nlemma image_set_spmf_eq:\n  \"f ` set_spmf p = g ` set_spmf q\" if \"ASSUMPTION (map_spmf f p = map_spmf g q)\"\n  using that[unfolded ASSUMPTION_def, THEN arg_cong[where f=set_spmf]] by simp\n\nlemma map_spmf_const: \"map_spmf (\\<lambda>_. x) p = scale_spmf (weight_spmf p) (return_spmf x)\"\n  by(simp add: map_spmf_conv_bind_spmf bind_spmf_const)\n\nlemma cond_return_pmf [simp]: \"cond_pmf (return_pmf x) A = return_pmf x\" if \"x \\<in> A\"\n  using that by(intro pmf_eqI)(auto simp add: pmf_cond split: split_indicator)\n\nlemma cond_return_spmf [simp]: \"cond_spmf (return_spmf x) A = (if x \\<in> A then return_spmf x else return_pmf None)\"\n  by(simp add: cond_spmf_def)\n\nlemma measure_range_Some_eq_weight:\n  \"measure (measure_pmf p) (range Some) = weight_spmf p\"\n  by (simp add: measure_measure_spmf_conv_measure_pmf space_measure_spmf)\n\nlemma restrict_spmf_eq_return_pmf_None [simp]:\n  \"restrict_spmf p A = return_pmf None \\<longleftrightarrow> set_spmf p \\<inter> A = {}\"\n  by(auto 4 3 simp add: restrict_spmf_def map_pmf_eq_return_pmf_iff bind_UNION in_set_spmf bind_eq_None_conv option.the_def dest: bspec split: if_split_asm option.split_asm)\n\nlemma integrable_scale_measure [simp]:\n  \"\\<lbrakk> integrable M f; r < \\<top> \\<rbrakk> \\<Longrightarrow> integrable (scale_measure r M) f\" \n  for f :: \"'a \\<Rightarrow> 'b::{banach, second_countable_topology}\"\n  by(auto simp add: integrable_iff_bounded nn_integral_scale_measure ennreal_mult_less_top)\n\nlemma integral_scale_measure:\n  assumes \"integrable M f\" \"r < \\<top>\"\n  shows \"integral\\<^sup>L (scale_measure r M) f = enn2real r * integral\\<^sup>L M f\"\n  using assms\n  apply(subst (1 2) real_lebesgue_integral_def)\n    apply(simp_all add: nn_integral_scale_measure ennreal_enn2real_if)\n  by(auto simp add: ennreal_mult_less_top ennreal_less_top_iff ennreal_mult_eq_top_iff enn2real_mult right_diff_distrib elim!: integrableE)\n\ndefinition mk_lossless :: \"'a spmf \\<Rightarrow> 'a spmf\" where\n  \"mk_lossless p = scale_spmf (inverse (weight_spmf p)) p\"\n\nlemma mk_lossless_idem [simp]: \"mk_lossless (mk_lossless p) = mk_lossless p\"\n  by(simp add: mk_lossless_def weight_scale_spmf min_def max_def inverse_eq_divide) \n\nlemma mk_lossless_return [simp]: \"mk_lossless (return_pmf x) = return_pmf x\"\n  by(cases x)(simp_all add: mk_lossless_def)\n\n\n\nlemma spmf_mk_lossless [simp]: \"spmf (mk_lossless p) x = spmf p x / weight_spmf p\"\n  by(simp add: mk_lossless_def spmf_scale_spmf inverse_eq_divide max_def)\n\nlemma set_spmf_mk_lossless [simp]: \"set_spmf (mk_lossless p) = set_spmf p\"\n  by(simp add: mk_lossless_def set_scale_spmf measure_spmf_zero_iff zero_less_measure_iff)\n\n\n\nlemma mk_lossless_eq_return_pmf_None [simp]: \"mk_lossless p = return_pmf None \\<longleftrightarrow> p = return_pmf None\"\nproof -\n  have aux: \"weight_spmf p = 0 \\<Longrightarrow> spmf p i = 0\" for i\n    by(rule antisym, rule order_trans[OF spmf_le_weight]) (auto intro!: order_trans[OF spmf_le_weight])\n\n  have[simp]: \" spmf (scale_spmf (inverse (weight_spmf p)) p) = spmf (return_pmf None) \\<Longrightarrow> spmf p i = 0\" for i\n    by(drule fun_cong[where x=i]) (auto simp add: aux spmf_scale_spmf max_def)\n\n  show ?thesis by(auto simp add: mk_lossless_def intro: spmf_eqI)\nqed\n\nlemma return_pmf_None_eq_mk_lossless [simp]: \"return_pmf None = mk_lossless p \\<longleftrightarrow> p = return_pmf None\"\n  by(metis mk_lossless_eq_return_pmf_None)\n\nlemma mk_lossless_spmf_of_set [simp]: \"mk_lossless (spmf_of_set A) = spmf_of_set A\"\n  by(simp add: spmf_of_set_def del: spmf_of_pmf_pmf_of_set)\n\nlemma weight_mk_lossless: \"weight_spmf (mk_lossless p) = (if p = return_pmf None then 0 else 1)\"\n  by(simp add: mk_lossless_def weight_scale_spmf min_def max_def inverse_eq_divide weight_spmf_eq_0)\n\nlemma mk_lossless_parametric [transfer_rule]: includes lifting_syntax shows\n  \"(rel_spmf A ===> rel_spmf A) mk_lossless mk_lossless\"\n  by(simp add: mk_lossless_def rel_fun_def rel_spmf_weightD rel_spmf_scaleI)\n\nlemma rel_spmf_mk_losslessI:\n  \"rel_spmf A p q \\<Longrightarrow> rel_spmf A (mk_lossless p) (mk_lossless q)\"\n  by(rule mk_lossless_parametric[THEN rel_funD])\n\nlemma rel_spmf_restrict_spmfI:\n  \"rel_spmf (\\<lambda>x y. (x \\<in> A \\<and> y \\<in> B \\<and> R x y) \\<or> x \\<notin> A \\<and> y \\<notin> B) p q\n   \\<Longrightarrow> rel_spmf R (restrict_spmf p A) (restrict_spmf q B)\"\n  by(auto simp add: restrict_spmf_def pmf.rel_map elim!: option.rel_cases pmf.rel_mono_strong)\n\nlemma cond_spmf_alt: \"cond_spmf p A = mk_lossless (restrict_spmf p A)\"\nproof(cases \"set_spmf p \\<inter> A = {}\")\n  case True\n  then show ?thesis by(simp add: cond_spmf_def measure_spmf_zero_iff)\nnext\n  case False\n  show ?thesis\n    by(rule spmf_eqI)(simp add: False cond_spmf_def pmf_cond set_pmf_Int_Some image_iff measure_measure_spmf_conv_measure_pmf[symmetric] spmf_scale_spmf max_def inverse_eq_divide)\nqed\n\nlemma cond_spmf_bind:\n  \"cond_spmf (bind_spmf p f) A = mk_lossless (p \\<bind> (\\<lambda>x. f x \\<upharpoonleft> A))\"\n  by(simp add: cond_spmf_alt restrict_bind_spmf scale_bind_spmf)\n\nlemma cond_spmf_UNIV [simp]: \"cond_spmf p UNIV = mk_lossless p\"\n  by(clarsimp simp add: cond_spmf_alt)\n\nlemma cond_pmf_singleton:\n  \"cond_pmf p A = return_pmf x\" if \"set_pmf p \\<inter> A = {x}\"\nproof -\n  have[simp]: \"set_pmf p \\<inter> A = {x} \\<Longrightarrow> x \\<in> A \\<Longrightarrow> measure_pmf.prob p A = pmf p x\"\n    by(auto simp add: measure_pmf_single[symmetric] AE_measure_pmf_iff intro!: measure_pmf.finite_measure_eq_AE)\n\n  have \"pmf (cond_pmf p A) i = pmf (return_pmf x) i\" for i\n    using that by(auto simp add: pmf_cond measure_pmf_zero_iff pmf_eq_0_set_pmf split: split_indicator)\n\n  then show ?thesis by(rule pmf_eqI)\nqed\n\n\ndefinition cond_spmf_fst :: \"('a \\<times> 'b) spmf \\<Rightarrow> 'a \\<Rightarrow> 'b spmf\" where\n  \"cond_spmf_fst p a = map_spmf snd (cond_spmf p ({a} \\<times> UNIV))\"\n\nlemma cond_spmf_fst_return_spmf [simp]:\n  \"cond_spmf_fst (return_spmf (x, y)) x = return_spmf y\"\n  by(simp add: cond_spmf_fst_def)\n\nlemma cond_spmf_fst_map_Pair [simp]: \"cond_spmf_fst (map_spmf (Pair x) p) x = mk_lossless p\"\n  by(clarsimp simp add: cond_spmf_fst_def spmf.map_comp o_def)\n\nlemma cond_spmf_fst_map_Pair' [simp]: \"cond_spmf_fst (map_spmf (\\<lambda>y. (x, f y)) p) x = map_spmf f (mk_lossless p)\"\n  by(subst spmf.map_comp[where f=\"Pair x\", symmetric, unfolded o_def]) simp\n\nlemma cond_spmf_fst_eq_return_None [simp]: \"cond_spmf_fst p x = return_pmf None \\<longleftrightarrow> x \\<notin> fst ` set_spmf p\"\n  by(auto 4 4 simp add: cond_spmf_fst_def map_pmf_eq_return_pmf_iff in_set_spmf[symmetric] dest: bspec[where x=\"Some _\"] intro: ccontr rev_image_eqI)\n\nlemma cond_spmf_fst_map_Pair1:\n  \"cond_spmf_fst (map_spmf (\\<lambda>x. (f x, g x)) p) (f x) = return_spmf (g (inv_into (set_spmf p) f (f x)))\"\n  if \"x \\<in> set_spmf p\" \"inj_on f (set_spmf p)\"\nproof -\n  let ?foo=\"\\<lambda>y. map_option (\\<lambda>x. (f x, g x)) -` Some ` ({f y} \\<times> UNIV)\"\n  have[simp]: \"y \\<in> set_spmf p \\<Longrightarrow> f x = f y \\<Longrightarrow> set_pmf p \\<inter> (?foo y) \\<noteq> {}\" for y\n    by(auto simp add: vimage_def image_def in_set_spmf)\n\n  have[simp]: \"y \\<in> set_spmf p \\<Longrightarrow> f x = f y \\<Longrightarrow>  map_spmf snd (map_spmf (\\<lambda>x. (f x, g x)) (cond_pmf p (?foo y))) = return_spmf (g x)\" for y\n    using that by(subst cond_pmf_singleton[where x=\"Some x\"]) (auto simp add: in_set_spmf elim: inj_onD)\n\n  show ?thesis\n    using that\n    by(auto simp add: cond_spmf_fst_def cond_spmf_def)\n      (erule notE, subst cond_map_pmf, simp_all)\nqed\n\nlemma lossless_cond_spmf_fst [simp]: \"lossless_spmf (cond_spmf_fst p x) \\<longleftrightarrow> x \\<in> fst ` set_spmf p\"\n  by(auto simp add: cond_spmf_fst_def intro: rev_image_eqI)\n\nlemma cond_spmf_fst_inverse:\n  \"bind_spmf (map_spmf fst p) (\\<lambda>x. map_spmf (Pair x) (cond_spmf_fst p x)) = p\"\n  (is \"?lhs = ?rhs\")\nproof(rule spmf_eqI)\n  fix i :: \"'a \\<times> 'b\"\n  have *: \"({x} \\<times> UNIV \\<inter> (Pair x \\<circ> snd) -` {i}) = (if x = fst i then {i} else {})\" for x by(cases i)auto\n  have \"spmf ?lhs i = LINT x|measure_spmf (map_spmf fst p). spmf (map_spmf (Pair x \\<circ> snd) (cond_spmf p ({x} \\<times> UNIV))) i\"\n    by(auto simp add: spmf_bind spmf.map_comp[symmetric] cond_spmf_fst_def intro!: integral_cong_AE)\n  also have \"\\<dots> = LINT x|measure_spmf (map_spmf fst p). measure (measure_spmf (cond_spmf p ({x} \\<times> UNIV))) ((Pair x \\<circ> snd) -` {i})\"\n    by(rule integral_cong_AE)(auto simp add: spmf_map)\n  also have \"\\<dots> = LINT x|measure_spmf (map_spmf fst p). measure (measure_spmf p) ({x} \\<times> UNIV \\<inter> (Pair x \\<circ> snd) -` {i}) /\n       measure (measure_spmf p) ({x} \\<times> UNIV)\"\n    by(rule integral_cong_AE; clarsimp simp add: measure_cond_spmf)\n  also have \"\\<dots> = spmf (map_spmf fst p) (fst i) * spmf p i / measure (measure_spmf p) ({fst i} \\<times> UNIV)\"\n    by(simp add: * if_distrib[where f=\"measure (measure_spmf _)\"] cong: if_cong)\n      (subst integral_measure_spmf[where A=\"{fst i}\"]; auto split: if_split_asm simp add: spmf_conv_measure_spmf)\n  also have \"\\<dots> = spmf p i\"\n    by(clarsimp simp add: spmf_map vimage_fst)(metis (no_types, lifting) Int_insert_left_if1 in_set_spmf_iff_spmf insertI1 insert_UNIV insert_absorb insert_not_empty measure_spmf_zero_iff mem_Sigma_iff prod.collapse)\n  finally show \"spmf ?lhs i = spmf ?rhs i\" .\nqed\n\n(* Generat *)\n\nfun rel_witness_generat :: \"('a, 'c, 'e) generat \\<times> ('b, 'd, 'f) generat \\<Rightarrow> ('a \\<times> 'b, 'c \\<times> 'd, 'e \\<times> 'f) generat\" where\n  \"rel_witness_generat (Pure x, Pure y) = Pure (x, y)\"\n| \"rel_witness_generat (IO out c, IO out' c') = IO (out, out') (c, c')\"\n\nlemma rel_witness_generat: \n  assumes \"rel_generat A C R x y\"\n  shows pures_rel_witness_generat: \"generat_pures (rel_witness_generat (x, y)) \\<subseteq> {(a, b). A a b}\"\n    and outs_rel_witness_generat: \"generat_outs (rel_witness_generat (x, y)) \\<subseteq> {(c, d). C c d}\"\n    and conts_rel_witness_generat: \"generat_conts (rel_witness_generat (x, y)) \\<subseteq> {(e, f). R e f}\"\n    and map1_rel_witness_generat: \"map_generat fst fst fst (rel_witness_generat (x, y)) = x\"\n    and map2_rel_witness_generat: \"map_generat snd snd snd (rel_witness_generat (x, y)) = y\"\n  using assms by(cases; simp; fail)+\n\nlemmas set_rel_witness_generat = pures_rel_witness_generat outs_rel_witness_generat conts_rel_witness_generat\n\nlemma rel_witness_generat1:\n  assumes \"rel_generat A C R x y\"\n  shows \"rel_generat (\\<lambda>a (a', b). a = a' \\<and> A a' b) (\\<lambda>c (c', d). c = c' \\<and> C c' d) (\\<lambda>r (r', s). r = r' \\<and> R r' s) x (rel_witness_generat (x, y))\"\n  using map1_rel_witness_generat[OF assms, symmetric]\n  unfolding generat.rel_eq[symmetric] generat.rel_map\n  by(rule generat.rel_mono_strong)(auto dest: set_rel_witness_generat[OF assms, THEN subsetD])\n\n\n\n\n(* Generative_Probabilistic_Value *)\n\nlemma rel_gpv''_map_gpv1:\n  \"rel_gpv'' A C R (map_gpv f g gpv) gpv' = rel_gpv'' (\\<lambda>a. A (f a)) (\\<lambda>c. C (g c)) R gpv gpv'\" (is \"?lhs = ?rhs\")\nproof\n  show ?rhs if ?lhs using that\n    apply(coinduction arbitrary: gpv gpv')\n    apply(drule rel_gpv''D)\n    apply(simp add: gpv.map_sel spmf_rel_map)\n    apply(erule rel_spmf_mono)\n    by(auto simp add: generat.rel_map rel_fun_comp elim!: generat.rel_mono_strong rel_fun_mono)\n  show ?lhs if ?rhs using that\n    apply(coinduction arbitrary: gpv gpv')\n    apply(drule rel_gpv''D)\n    apply(simp add: gpv.map_sel spmf_rel_map)\n    apply(erule rel_spmf_mono)\n    by(auto simp add: generat.rel_map rel_fun_comp elim!: generat.rel_mono_strong rel_fun_mono)\nqed\n\nlemma rel_gpv''_map_gpv2:\n  \"rel_gpv'' A C R gpv (map_gpv f g gpv') = rel_gpv'' (\\<lambda>a b. A a (f b)) (\\<lambda>c d. C c (g d)) R gpv gpv'\"\n  using rel_gpv''_map_gpv1[of \"conversep A\" \"conversep C\" \"conversep R\" f g gpv' gpv]\n  apply(rewrite in \"\\<hole> = _\" conversep_iff[symmetric])\n  apply(rewrite in \"_ = \\<hole>\" conversep_iff[symmetric])\n  apply(simp only: rel_gpv''_conversep)\n  apply(simp only: rel_gpv''_conversep[symmetric])\n  apply(simp only: conversep_iff[abs_def])\n  done\n\nlemmas rel_gpv''_map_gpv = rel_gpv''_map_gpv1[abs_def] rel_gpv''_map_gpv2\n\nlemma rel_gpv''_map_gpv' [simp]:\n  shows \"\\<And>f g h gpv. NO_MATCH id f \\<or> NO_MATCH id g \n    \\<Longrightarrow> rel_gpv'' A C R (map_gpv' f g h gpv) = rel_gpv'' (\\<lambda>a. A (f a)) (\\<lambda>c. C (g c)) R (map_gpv' id id h gpv)\"\n    and \"\\<And>f g h gpv gpv'. NO_MATCH id f \\<or> NO_MATCH id g \n    \\<Longrightarrow> rel_gpv'' A C R gpv (map_gpv' f g h gpv') = rel_gpv'' (\\<lambda>a b. A a (f b)) (\\<lambda>c d. C c (g d)) R gpv (map_gpv' id id h gpv')\"\nproof (goal_cases)\n  case (1 f g h gpv)\n  then show ?case using map_gpv'_comp[of f g id id id h gpv, symmetric] by(simp add: rel_gpv''_map_gpv[unfolded map_gpv_conv_map_gpv'])\nnext\n  case (2 f g h gpv gpv')\n  then show ?case using map_gpv'_comp[of f g id id id h gpv', symmetric] by(simp add: rel_gpv''_map_gpv[unfolded map_gpv_conv_map_gpv'])\nqed\n\nlemmas rel_gpv_map_gpv' = rel_gpv''_map_gpv'[where R=\"(=)\", folded rel_gpv_conv_rel_gpv'']\n\ndefinition rel_witness_gpv :: \"('a \\<Rightarrow> 'd \\<Rightarrow> bool) \\<Rightarrow> ('b \\<Rightarrow> 'e \\<Rightarrow> bool) \\<Rightarrow> ('c \\<Rightarrow> 'g \\<Rightarrow> bool) \\<Rightarrow> ('g \\<Rightarrow> 'f \\<Rightarrow> bool) \\<Rightarrow> ('a, 'b, 'c) gpv \\<times> ('d, 'e, 'f) gpv \\<Rightarrow> ('a \\<times> 'd, 'b \\<times> 'e, 'g) gpv\" where\n  \"rel_witness_gpv A C R R' = corec_gpv (\n     map_spmf (map_generat id id (\\<lambda>(rpv, rpv'). (Inr \\<circ> rel_witness_fun R R' (rpv, rpv'))) \\<circ> rel_witness_generat) \\<circ>\n     rel_witness_spmf (rel_generat A C (rel_fun (R OO R') (rel_gpv'' A C (R OO R')))) \\<circ> map_prod the_gpv the_gpv)\"\n\nlemma rel_witness_gpv_sel [simp]:\n  \"the_gpv (rel_witness_gpv A C R R' (gpv, gpv')) = \n    map_spmf (map_generat id id (\\<lambda>(rpv, rpv'). (rel_witness_gpv A C R R' \\<circ> rel_witness_fun R R' (rpv, rpv'))) \\<circ> rel_witness_generat)\n     (rel_witness_spmf (rel_generat A C (rel_fun (R OO R') (rel_gpv'' A C (R OO R')))) (the_gpv gpv, the_gpv gpv'))\"\n  unfolding rel_witness_gpv_def\n  by(auto simp add: spmf.map_comp generat.map_comp o_def intro!: map_spmf_cong generat.map_cong)\n\nlemma assumes \"rel_gpv'' A C (R OO R') gpv gpv'\"\n  and R: \"left_unique R\" \"right_total R\"\n  and R': \"right_unique R'\" \"left_total R'\"\nshows rel_witness_gpv1: \"rel_gpv'' (\\<lambda>a (a', b). a = a' \\<and> A a' b) (\\<lambda>c (c', d). c = c' \\<and> C c' d) R gpv (rel_witness_gpv A C R R' (gpv, gpv'))\" (is \"?thesis1\")\n  and rel_witness_gpv2: \"rel_gpv'' (\\<lambda>(a, b') b. b = b' \\<and> A a b') (\\<lambda>(c, d') d. d = d' \\<and> C c d') R' (rel_witness_gpv A C R R' (gpv, gpv')) gpv'\" (is \"?thesis2\")\nproof -\n  show ?thesis1 using assms(1)\n  proof(coinduction arbitrary: gpv gpv')\n    case rel_gpv''\n    from this[THEN rel_gpv''D] show ?case\n      by(auto simp add: spmf_rel_map generat.rel_map rel_fun_comp elim!: rel_fun_mono[OF rel_witness_fun1[OF _ R R']]\n          rel_spmf_mono[OF rel_witness_spmf1] generat.rel_mono[THEN predicate2D, rotated -1, OF rel_witness_generat1])\n  qed\n  show ?thesis2 using assms(1)\n  proof(coinduction arbitrary: gpv gpv')\n    case rel_gpv''\n    from this[THEN rel_gpv''D] show ?case\n      by(simp add: spmf_rel_map) \n        (erule rel_spmf_mono[OF rel_witness_spmf2]\n          , auto simp add: generat.rel_map rel_fun_comp elim!: rel_fun_mono[OF rel_witness_fun2[OF _ R R']]\n          generat.rel_mono[THEN predicate2D, rotated -1, OF rel_witness_generat2])\n  qed\nqed\n\nlemma rel_gpv''_neg_distr:\n  assumes R: \"left_unique R\" \"right_total R\"\n    and R': \"right_unique R'\" \"left_total R'\"\n  shows \"rel_gpv'' (A OO A') (C OO C') (R OO R') \\<le> rel_gpv'' A C R OO rel_gpv'' A' C' R'\"\nproof(rule predicate2I relcomppI)+\n  fix gpv gpv''\n  assume *: \"rel_gpv'' (A OO A') (C OO C') (R OO R') gpv gpv''\"\n  let ?gpv' = \"map_gpv (relcompp_witness A A') (relcompp_witness C C') (rel_witness_gpv (A OO A') (C OO C') R R' (gpv, gpv''))\"\n  show \"rel_gpv'' A C R gpv ?gpv'\" using rel_witness_gpv1[OF * R R'] unfolding rel_gpv''_map_gpv\n    by(rule rel_gpv''_mono[THEN predicate2D, rotated -1]; clarify del: relcomppE elim!: relcompp_witness)\n  show \"rel_gpv'' A' C' R' ?gpv' gpv''\" using rel_witness_gpv2[OF * R R'] unfolding rel_gpv''_map_gpv\n    by(rule rel_gpv''_mono[THEN predicate2D, rotated -1]; clarify del: relcomppE elim!: relcompp_witness)\nqed\n\n\n\ncontext includes \\<I>.lifting begin\n\nlift_definition \\<I>_uniform :: \"'out set \\<Rightarrow> 'in set \\<Rightarrow> ('out, 'in) \\<I>\" is \"\\<lambda>A B x. if x \\<in> A then B else {}\" .\n\n\n\nlemma responses_\\<I>_uniform [simp]: \"responses_\\<I> (\\<I>_uniform A B) x = (if x \\<in> A then B else {})\"\n  by transfer simp\n\nlemma \\<I>_uniform_UNIV [simp]: \"\\<I>_uniform UNIV UNIV = \\<I>_full\" (* TODO: make \\<I>_full an abbreviation *)\n  by transfer simp\n\nlifting_update \\<I>.lifting\nlifting_forget \\<I>.lifting\n\nend \n\nlemma \\<I>_eqI: \"\\<lbrakk> outs_\\<I> \\<I> = outs_\\<I> \\<I>'; \\<And>x. x \\<in> outs_\\<I> \\<I>' \\<Longrightarrow> responses_\\<I> \\<I> x = responses_\\<I> \\<I>' x \\<rbrakk> \\<Longrightarrow> \\<I> = \\<I>'\"\n  including \\<I>.lifting by transfer auto\n\ninstantiation \\<I> :: (type, type) order begin\n\ndefinition less_eq_\\<I> :: \"('a, 'b) \\<I> \\<Rightarrow> ('a, 'b) \\<I> \\<Rightarrow> bool\"\n  where le_\\<I>_def: \"less_eq_\\<I> \\<I> \\<I>' \\<longleftrightarrow> outs_\\<I> \\<I> \\<subseteq> outs_\\<I> \\<I>' \\<and> (\\<forall>x\\<in>outs_\\<I> \\<I>. responses_\\<I> \\<I>' x \\<subseteq> responses_\\<I> \\<I> x)\"\n\ndefinition less_\\<I> :: \"('a, 'b) \\<I> \\<Rightarrow> ('a, 'b) \\<I> \\<Rightarrow> bool\"\n  where \"less_\\<I> = mk_less (\\<le>)\"\n\ninstance\nproof\n  show \"\\<I> < \\<I>' \\<longleftrightarrow> \\<I> \\<le> \\<I>' \\<and> \\<not> \\<I>' \\<le> \\<I>\" for \\<I> \\<I>' :: \"('a, 'b) \\<I>\" by(simp add: less_\\<I>_def mk_less_def)\n  show \"\\<I> \\<le> \\<I>\" for \\<I> :: \"('a, 'b) \\<I>\" by(simp add: le_\\<I>_def)\n  show \"\\<I> \\<le> \\<I>''\" if \"\\<I> \\<le> \\<I>'\" \"\\<I>' \\<le> \\<I>''\" for \\<I> \\<I>' \\<I>'' :: \"('a, 'b) \\<I>\" using that\n    by(fastforce simp add: le_\\<I>_def)\n  show \"\\<I> = \\<I>'\" if \"\\<I> \\<le> \\<I>'\" \"\\<I>' \\<le> \\<I>\" for \\<I> \\<I>' :: \"('a, 'b) \\<I>\" using that\n    by(auto simp add: le_\\<I>_def intro!: \\<I>_eqI)\nqed\nend\n\ninstantiation \\<I> :: (type, type) order_bot begin\ndefinition bot_\\<I> :: \"('a, 'b) \\<I>\" where \"bot_\\<I> = \\<I>_uniform {} UNIV\"\ninstance by standard(auto simp add: bot_\\<I>_def le_\\<I>_def)\nend\n\nlemma outs_\\<I>_bot [simp]: \"outs_\\<I> bot = {}\"\n  by(simp add: bot_\\<I>_def)\n\nlemma respones_\\<I>_bot [simp]: \"responses_\\<I> bot x = {}\"\n  by(simp add: bot_\\<I>_def)\n\nlemma outs_\\<I>_mono: \"\\<I> \\<le> \\<I>' \\<Longrightarrow> outs_\\<I> \\<I> \\<subseteq> outs_\\<I> \\<I>'\"\n  by(simp add: le_\\<I>_def)\n\nlemma responses_\\<I>_mono: \"\\<lbrakk> \\<I> \\<le> \\<I>'; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> responses_\\<I> \\<I>' x \\<subseteq> responses_\\<I> \\<I> x\"\n  by(simp add: le_\\<I>_def)\n\nlemma \\<I>_uniform_empty [simp]: \"\\<I>_uniform {} A = bot\" \n  unfolding bot_\\<I>_def including \\<I>.lifting by transfer simp\n\nlemma WT_gpv_\\<I>_mono: \"\\<lbrakk> \\<I> \\<turnstile>g gpv \\<surd>; \\<I> \\<le> \\<I>' \\<rbrakk> \\<Longrightarrow> \\<I>' \\<turnstile>g gpv \\<surd>\"\n  by(erule WT_gpv_mono; rule outs_\\<I>_mono responses_\\<I>_mono)\n\nlemma results_gpv_mono:\n  assumes le: \"\\<I>' \\<le> \\<I>\" and WT: \"\\<I>' \\<turnstile>g gpv \\<surd>\"\n  shows \"results_gpv \\<I> gpv \\<subseteq> results_gpv \\<I>' gpv\"\nproof(rule subsetI, goal_cases)\n  case (1 x)\n  show ?case using 1 WT by(induction)(auto 4 3 intro: results_gpv.intros responses_\\<I>_mono[OF le, THEN subsetD] intro: WT_gpvD)\nqed\n\nlemma \\<I>_uniform_mono:\n  \"\\<I>_uniform A B \\<le> \\<I>_uniform C D\" if \"A \\<subseteq> C\" \"D \\<subseteq> B\" \"D = {} \\<longrightarrow> B = {}\"\n  unfolding le_\\<I>_def using that by auto\n\ncontext begin\nqualified inductive outsp_gpv :: \"('out, 'in) \\<I> \\<Rightarrow> 'out \\<Rightarrow> ('a, 'out, 'in) gpv \\<Rightarrow> bool\"\n  for \\<I> x where\n    IO: \"IO x c \\<in> set_spmf (the_gpv gpv) \\<Longrightarrow> outsp_gpv \\<I> x gpv\"\n  | Cont: \"\\<lbrakk> IO out rpv \\<in> set_spmf (the_gpv gpv); input \\<in> responses_\\<I> \\<I> out; outsp_gpv \\<I> x (rpv input) \\<rbrakk>\n  \\<Longrightarrow> outsp_gpv \\<I> x gpv\"\n\ndefinition outs_gpv :: \"('out, 'in) \\<I> \\<Rightarrow> ('a, 'out, 'in) gpv \\<Rightarrow> 'out set\"\n  where \"outs_gpv \\<I> gpv \\<equiv> {x. outsp_gpv \\<I> x gpv}\"\n\nlemma outsp_gpv_outs_gpv_eq [pred_set_conv]: \"outsp_gpv \\<I> x = (\\<lambda>gpv. x \\<in> outs_gpv \\<I> gpv)\"\n  by(simp add: outs_gpv_def)\n\ncontext begin\nlocal_setup \\<open>Local_Theory.map_background_naming (Name_Space.mandatory_path \"outs_gpv\")\\<close>\n\nlemmas intros [intro?] = outsp_gpv.intros[to_set]\n  and IO = IO[to_set]\n  and Cont = Cont[to_set]\n  and induct [consumes 1, case_names IO Cont, induct set: outs_gpv] = outsp_gpv.induct[to_set]\n  and cases [consumes 1, case_names IO Cont, cases set: outs_gpv] = outsp_gpv.cases[to_set]\n  and simps = outsp_gpv.simps[to_set]\nend\n\ninductive_simps outs_gpv_GPV [to_set, simp]: \"outsp_gpv \\<I> x (GPV gpv)\"\n\nend\n\nlemma outs_gpv_Done [iff]: \"outs_gpv \\<I> (Done x) = {}\"\n  by(auto simp add: Done.ctr)\n\nlemma outs_gpv_Fail [iff]: \"outs_gpv \\<I> Fail = {}\"\n  by(auto simp add: Fail_def)\n\nlemma outs_gpv_Pause [simp]:\n  \"outs_gpv \\<I> (Pause out c) = insert out (\\<Union>input\\<in>responses_\\<I> \\<I> out. outs_gpv \\<I> (c input))\"\n  by(auto simp add: Pause.ctr)\n\nlemma outs_gpv_lift_spmf [iff]: \"outs_gpv \\<I> (lift_spmf p) = {}\"\n  by(auto simp add: lift_spmf.ctr)\n\n\n\nlemma outs_gpv_bind_gpv [simp]:\n  \"outs_gpv \\<I> (gpv \\<bind> f) = outs_gpv \\<I> gpv \\<union> (\\<Union>x\\<in>results_gpv \\<I> gpv. outs_gpv \\<I> (f x))\"\n  (is \"?lhs = ?rhs\")\nproof(intro Set.set_eqI iffI)\n  fix x\n  assume \"x \\<in> ?lhs\"\n  then show \"x \\<in> ?rhs\"\n  proof(induction gpv'\\<equiv>\"gpv \\<bind> f\" arbitrary: gpv)\n    case IO thus ?case\n    proof(clarsimp split: if_split_asm elim!: is_PureE not_is_PureE, goal_cases)\n      case (1 generat)\n      then show ?case by(cases generat)(auto intro: results_gpv.Pure outs_gpv.intros)\n    qed\n  next\n    case (Cont out rpv input)\n    thus ?case\n    proof(clarsimp split: if_split_asm, goal_cases)\n      case (1 generat)\n      then show ?case by(cases generat)(auto 4 3 split: if_split_asm intro: results_gpv.intros outs_gpv.intros)\n    qed\n  qed\nnext\n  fix x\n  assume \"x \\<in> ?rhs\"\n  then consider (out) \"x \\<in> outs_gpv \\<I> gpv\" | (result) y where \"y \\<in> results_gpv \\<I> gpv\" \"x \\<in> outs_gpv \\<I> (f y)\" by auto\n  then show \"x \\<in> ?lhs\"\n  proof cases\n    case out then show ?thesis\n      by(induction) (auto 4 4 intro: outs_gpv.IO  outs_gpv.Cont rev_bexI) \n  next\n    case result then show ?thesis\n      by induction ((erule outs_gpv.cases | rule outs_gpv.Cont), \n          auto 4 4 intro: outs_gpv.intros rev_bexI elim: outs_gpv.cases)+\n  qed\nqed\n\nlemma outs_gpv_\\<I>_full: \"outs_gpv \\<I>_full = outs'_gpv\"\nproof(intro ext Set.set_eqI iffI)\n  show \"x \\<in> outs'_gpv gpv\" if \"x \\<in> outs_gpv \\<I>_full gpv\" for x gpv\n    using that by induction(auto intro: outs'_gpvI)\n  show \"x \\<in> outs_gpv \\<I>_full gpv\" if \"x \\<in> outs'_gpv gpv\" for x gpv\n    using that by induction(auto intro: outs_gpv.intros elim!: generat.set_cases)\nqed\n\nlemma outs'_bind_gpv [simp]:\n  \"outs'_gpv (bind_gpv gpv f) = outs'_gpv gpv \\<union> (\\<Union>x\\<in>results'_gpv gpv. outs'_gpv (f x))\"\n  unfolding outs_gpv_\\<I>_full[symmetric] results_gpv_\\<I>_full[symmetric] by simp\n\nlemma outs_gpv_map_gpv_id [simp]: \"outs_gpv \\<I> (map_gpv f id gpv) = outs_gpv \\<I> gpv\"\n  by(auto simp add: map_gpv_conv_bind id_def)\n\nlemma outs_gpv_map_gpv_id' [simp]: \"outs_gpv \\<I> (map_gpv f (\\<lambda>x. x) gpv) = outs_gpv \\<I> gpv\"\n  by(auto simp add: map_gpv_conv_bind id_def)\n\nlemma outs'_gpv_bind_option [simp]:\n  \"outs'_gpv (monad.bind_option Fail x f) = (\\<Union>y\\<in>set_option x. outs'_gpv (f y))\"\n  by(cases x) simp_all\n\nlemma WT_gpv_outs_gpv:\n  assumes \"\\<I> \\<turnstile>g gpv \\<surd>\"\n  shows \"outs_gpv \\<I> gpv \\<subseteq> outs_\\<I> \\<I>\"\nproof\n  show \"x \\<in> outs_\\<I> \\<I>\" if \"x \\<in> outs_gpv \\<I> gpv\" for x using that assms\n    by(induction)(blast intro: WT_gpv_OutD WT_gpv_ContD)+\nqed\n\ncontext includes \\<I>.lifting begin\n\nlift_definition map_\\<I> :: \"('out' \\<Rightarrow> 'out) \\<Rightarrow> ('in \\<Rightarrow> 'in') \\<Rightarrow> ('out, 'in) \\<I> \\<Rightarrow> ('out', 'in') \\<I>\"\n  is \"\\<lambda>f g resp x. g ` resp (f x)\" .\n\nlemma outs_\\<I>_map_\\<I> [simp]:\n  \"outs_\\<I> (map_\\<I> f g \\<I>) = f -` outs_\\<I> \\<I>\"\n  by transfer simp\n\nlemma responses_\\<I>_map_\\<I> [simp]:\n  \"responses_\\<I> (map_\\<I> f g \\<I>) x = g ` responses_\\<I> \\<I> (f x)\"\n  by transfer simp\n\nlemma map_\\<I>_\\<I>_uniform [simp]:\n  \"map_\\<I> f g (\\<I>_uniform A B) = \\<I>_uniform (f -` A) (g ` B)\"\n  by transfer(auto simp add: fun_eq_iff)\n\nlemma map_\\<I>_id [simp]: \"map_\\<I> id id \\<I> = \\<I>\"\n  by transfer simp\n\nlemma map_\\<I>_id0: \"map_\\<I> id id = id\"\n  by(simp add: fun_eq_iff)\n\nlemma map_\\<I>_comp [simp]: \"map_\\<I> f g (map_\\<I> f' g' \\<I>) = map_\\<I> (f' \\<circ> f) (g \\<circ> g') \\<I>\"\n  by transfer auto\n\n\n\nlifting_update \\<I>.lifting\nlifting_forget \\<I>.lifting\nend\n\nfunctor map_\\<I> by(simp_all add: fun_eq_iff)\n\nlemma WT_gpv_map_gpv': \"\\<I> \\<turnstile>g map_gpv' f g h gpv \\<surd>\" if \"map_\\<I> g h \\<I> \\<turnstile>g gpv \\<surd>\"\n  using that by(coinduction arbitrary: gpv)(auto 4 4 dest: WT_gpvD)\n\nlemma WT_gpv_map_gpv: \"\\<I> \\<turnstile>g map_gpv f g gpv \\<surd>\" if \"map_\\<I> g id \\<I> \\<turnstile>g gpv \\<surd>\"\n  unfolding map_gpv_conv_map_gpv' using that by(rule WT_gpv_map_gpv')\n\nlemma results_gpv_map_gpv' [simp]:\n  \"results_gpv \\<I> (map_gpv' f g h gpv) = f ` (results_gpv (map_\\<I> g h \\<I>) gpv)\"\nproof(intro Set.set_eqI iffI; (elim imageE; hypsubst)?)\n  show \"x \\<in> f ` results_gpv (map_\\<I> g h \\<I>) gpv\" if \"x \\<in> results_gpv \\<I> (map_gpv' f g h gpv)\" for x using that\n    by(induction gpv'\\<equiv>\"map_gpv' f g h gpv\" arbitrary: gpv)(fastforce intro: results_gpv.intros rev_image_eqI)+\n  show \"f x \\<in> results_gpv \\<I> (map_gpv' f g h gpv)\" if \"x \\<in> results_gpv (map_\\<I> g h \\<I>) gpv\" for x using that\n    by(induction)(fastforce intro: results_gpv.intros)+\nqed\n\nlemma map_\\<I>_plus_\\<I> [simp]: \n  \"map_\\<I> (map_sum f1 f2) (map_sum g1 g2) (\\<I>1 \\<oplus>\\<^sub>\\<I> \\<I>2) = map_\\<I> f1 g1 \\<I>1 \\<oplus>\\<^sub>\\<I> map_\\<I> f2 g2 \\<I>2\"\nproof(rule \\<I>_eqI[OF Set.set_eqI], goal_cases)\n  case (1 x)\n  then show ?case by(cases x) auto\nqed (auto simp add: image_image)\n\nlemma le_plus_\\<I>_iff [simp]:\n  \"\\<I>1 \\<oplus>\\<^sub>\\<I> \\<I>2 \\<le> \\<I>1' \\<oplus>\\<^sub>\\<I> \\<I>2' \\<longleftrightarrow> \\<I>1 \\<le> \\<I>1' \\<and> \\<I>2 \\<le> \\<I>2'\"\n  by(auto 4 4 simp add: le_\\<I>_def dest: bspec[where x=\"Inl _\"] bspec[where x=\"Inr _\"])\n\n\n\ninductive pred_gpv' :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('out \\<Rightarrow> bool) \\<Rightarrow> 'in set \\<Rightarrow> ('a, 'out, 'in) gpv \\<Rightarrow> bool\" for P Q X gpv where\n  \"pred_gpv' P Q X gpv\" \nif \"\\<And>x. x \\<in> results_gpv (\\<I>_uniform UNIV X) gpv \\<Longrightarrow> P x\" \"\\<And>out. out \\<in> outs_gpv (\\<I>_uniform UNIV X) gpv \\<Longrightarrow> Q out\"\n\nlemma pred_gpv_conv_pred_gpv': \"pred_gpv P Q = pred_gpv' P Q UNIV\"\n  by(auto simp add: fun_eq_iff pred_gpv_def pred_gpv'.simps results_gpv_\\<I>_full outs_gpv_\\<I>_full)\n\nlemma rel_gpv''_Grp: includes lifting_syntax shows\n  \"rel_gpv'' (BNF_Def.Grp A f) (BNF_Def.Grp B g) (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> = \n   BNF_Def.Grp {x. results_gpv (\\<I>_uniform UNIV (range h)) x \\<subseteq> A \\<and> outs_gpv (\\<I>_uniform UNIV (range h)) x \\<subseteq> B} (map_gpv' f g h)\"\n  (is \"?lhs = ?rhs\")\nproof(intro ext GrpI iffI CollectI conjI subsetI)\n  let ?\\<I> = \"\\<I>_uniform UNIV (range h)\"\n  fix gpv gpv'\n  assume *: \"?lhs gpv gpv'\"\n  then show \"map_gpv' f g h gpv = gpv'\"\n    by(coinduction arbitrary: gpv gpv')\n      (drule rel_gpv''D\n        , auto 4 5 simp add: spmf_rel_map generat.rel_map elim!: rel_spmf_mono generat.rel_mono_strong GrpE intro!: GrpI dest: rel_funD)\n  show \"x \\<in> A\" if \"x \\<in> results_gpv ?\\<I> gpv\" for x using that *\n  proof(induction arbitrary: gpv')\n    case (Pure gpv)\n    have \"pred_spmf (Domainp (rel_generat (BNF_Def.Grp A f) (BNF_Def.Grp B g) ((BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> ===> rel_gpv'' (BNF_Def.Grp A f) (BNF_Def.Grp B g) (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse>))) (the_gpv gpv)\"\n      using Pure.prems[THEN rel_gpv''D] unfolding spmf_Domainp_rel[symmetric] by(rule DomainPI)\n    with Pure.hyps show ?case by(simp add: generat.Domainp_rel pred_spmf_def pred_generat_def Domainp_Grp)\n  next\n    case (IO out c gpv input)\n    have \"pred_spmf (Domainp (rel_generat (BNF_Def.Grp A f) (BNF_Def.Grp B g) ((BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> ===> rel_gpv'' (BNF_Def.Grp A f) (BNF_Def.Grp B g) (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse>))) (the_gpv gpv)\"\n      using IO.prems[THEN rel_gpv''D] unfolding spmf_Domainp_rel[symmetric] by(rule DomainPI)\n    with IO.hyps show ?case \n      by(auto simp add: generat.Domainp_rel pred_spmf_def pred_generat_def Grp_iff dest: rel_funD intro: IO.IH dest!: bspec)\n  qed\n  show \"x \\<in> B\" if \"x \\<in> outs_gpv ?\\<I> gpv\" for x using that *\n  proof(induction arbitrary: gpv')\n    case (IO c gpv)\n    have \"pred_spmf (Domainp (rel_generat (BNF_Def.Grp A f) (BNF_Def.Grp B g) ((BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> ===> rel_gpv'' (BNF_Def.Grp A f) (BNF_Def.Grp B g) (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse>))) (the_gpv gpv)\"\n      using IO.prems[THEN rel_gpv''D] unfolding spmf_Domainp_rel[symmetric] by(rule DomainPI)\n    with IO.hyps show ?case by(simp add: generat.Domainp_rel pred_spmf_def pred_generat_def Domainp_Grp)\n  next\n    case (Cont out rpv gpv input)\n    have \"pred_spmf (Domainp (rel_generat (BNF_Def.Grp A f) (BNF_Def.Grp B g) ((BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> ===> rel_gpv'' (BNF_Def.Grp A f) (BNF_Def.Grp B g) (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse>))) (the_gpv gpv)\"\n      using Cont.prems[THEN rel_gpv''D] unfolding spmf_Domainp_rel[symmetric] by(rule DomainPI)\n    with Cont.hyps show ?case \n      by(auto simp add: generat.Domainp_rel pred_spmf_def pred_generat_def Grp_iff dest: rel_funD intro: Cont.IH dest!: bspec)\n  qed\nnext\n  fix gpv gpv'\n  assume \"?rhs gpv gpv'\"\n  then have gpv': \"gpv' = map_gpv' f g h gpv\"\n    and *: \"results_gpv (\\<I>_uniform UNIV (range h)) gpv \\<subseteq> A\" \"outs_gpv (\\<I>_uniform UNIV (range h)) gpv \\<subseteq> B\" by(auto simp add: Grp_iff)\n  show \"?lhs gpv gpv'\" using * unfolding gpv'\n    by(coinduction arbitrary: gpv)\n      (fastforce simp add: spmf_rel_map generat.rel_map Grp_iff intro!: rel_spmf_reflI generat.rel_refl_strong rel_funI elim!: generat.set_cases intro: results_gpv.intros outs_gpv.intros)\nqed\n\nlemma rel_gpv''_map_gpv'1:\n  \"rel_gpv'' A C (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> gpv gpv' \\<Longrightarrow> rel_gpv'' A C (=) (map_gpv' id id h gpv) gpv'\"\n  apply(coinduction arbitrary: gpv gpv')\n  apply(drule rel_gpv''D)\n  apply(simp add: spmf_rel_map)\n  apply(erule rel_spmf_mono)\n  apply(simp add: generat.rel_map)\n  apply(erule generat.rel_mono_strong; simp?)\n  apply(subst map_fun2_id)\n  by(auto simp add: rel_fun_comp intro!: rel_fun_map_fun1 elim: rel_fun_mono)\n\nlemma rel_gpv''_map_gpv'2:\n  \"rel_gpv'' A C (eq_on (range h)) gpv gpv' \\<Longrightarrow> rel_gpv'' A C (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> gpv (map_gpv' id id h gpv')\"\n  apply(coinduction arbitrary: gpv gpv')\n  apply(drule rel_gpv''D)\n  apply(simp add: spmf_rel_map)\n  apply(erule rel_spmf_mono_strong)\n  apply(simp add: generat.rel_map)\n  apply(erule generat.rel_mono_strong; simp?)\n  apply(subst map_fun_id2_in)\n  apply(rule rel_fun_map_fun2)\n  by (auto simp add: rel_fun_comp  elim: rel_fun_mono)\n\ncontext\n  fixes A :: \"'a \\<Rightarrow> 'd \\<Rightarrow> bool\"\n    and C :: \"'c \\<Rightarrow> 'g \\<Rightarrow> bool\"\n    and R :: \"'b \\<Rightarrow> 'e \\<Rightarrow> bool\"\nbegin\n\nprivate lemma f11:\" Pure x \\<in> set_spmf (the_gpv gpv) \\<Longrightarrow>\n   Domainp (rel_generat A C (rel_fun R (rel_gpv'' A C R))) (Pure x) \\<Longrightarrow> Domainp A x\"\n  by (auto simp add: pred_generat_def elim:bspec dest: generat.Domainp_rel[THEN fun_cong, THEN iffD1, OF Domainp_iff[THEN iffD2], OF exI])\n\nprivate lemma f21: \"IO out c \\<in> set_spmf (the_gpv gpv) \\<Longrightarrow> \n  rel_generat A C (rel_fun R (rel_gpv'' A C R)) (IO out c) ba \\<Longrightarrow> Domainp C out\"\n  by (auto simp add: pred_generat_def elim:bspec dest: generat.Domainp_rel[THEN fun_cong, THEN iffD1, OF Domainp_iff[THEN iffD2], OF exI])\n\nprivate lemma f12:\n  assumes \"IO out c \\<in> set_spmf (the_gpv gpv)\"\n    and \"input \\<in> responses_\\<I> (\\<I>_uniform UNIV {x. Domainp R x}) out\"\n    and \"x \\<in> results_gpv (\\<I>_uniform UNIV {x. Domainp R x}) (c input)\"\n    and \"Domainp (rel_gpv'' A C R) gpv\"\n  shows \"Domainp (rel_gpv'' A C R) (c input)\"\nproof -\n  obtain b1 where o1:\"rel_gpv'' A C R gpv b1\" using assms(4) by clarsimp\n  obtain b2 where o2:\"rel_generat A C (rel_fun R (rel_gpv'' A C R)) (IO out c) b2\"\n    using assms(1) o1[THEN rel_gpv''D, THEN spmf_Domainp_rel[THEN fun_cong, THEN iffD1, OF Domainp_iff[THEN iffD2], OF exI]]\n    unfolding pred_spmf_def by - (drule (1) bspec, auto)\n\n  have \"Ball (generat_conts (IO out c)) (Domainp (rel_fun R (rel_gpv'' A C R)))\"\n    using o2[THEN generat.Domainp_rel[THEN fun_cong, THEN iffD1, OF Domainp_iff[THEN iffD2], OF exI]]\n    unfolding pred_generat_def by simp\n\n  with assms(2) show ?thesis \n    apply -\n    apply(drule bspec)\n     apply simp\n    apply clarify\n    apply(drule Domainp_rel_fun_le[THEN predicate1D, OF Domainp_iff[THEN iffD2], OF exI])\n    by simp  \nqed\n\nprivate lemma f22:\n  assumes \"IO out' rpv \\<in> set_spmf (the_gpv gpv)\"\n    and \"input \\<in> responses_\\<I> (\\<I>_uniform UNIV {x. Domainp R x}) out'\"\n    and \"out \\<in> outs_gpv (\\<I>_uniform UNIV {x. Domainp R x}) (rpv input)\"\n    and \"Domainp (rel_gpv'' A C R) gpv\"\n  shows \"Domainp (rel_gpv'' A C R) (rpv input)\"\nproof -\n  obtain b1 where o1:\"rel_gpv'' A C R gpv b1\" using assms(4) by auto\n  obtain b2 where o2:\"rel_generat A C (rel_fun R (rel_gpv'' A C R)) (IO out' rpv) b2\"\n    using assms(1) o1[THEN rel_gpv''D, THEN spmf_Domainp_rel[THEN fun_cong, THEN iffD1, OF Domainp_iff[THEN iffD2], OF exI]]\n    unfolding pred_spmf_def by - (drule (1) bspec, auto)\n\n  have \"Ball (generat_conts (IO out' rpv)) (Domainp (rel_fun R (rel_gpv'' A C R)))\"\n    using o2[THEN generat.Domainp_rel[THEN fun_cong, THEN iffD1, OF Domainp_iff[THEN iffD2], OF exI]]\n    unfolding pred_generat_def by simp\n\n  with assms(2) show ?thesis \n    apply -\n    apply(drule bspec)\n     apply simp\n    apply clarify\n    apply(drule Domainp_rel_fun_le[THEN predicate1D, OF Domainp_iff[THEN iffD2], OF exI])\n    by simp \nqed\n\nlemma Domainp_rel_gpv''_le:\n  \"Domainp (rel_gpv'' A C R) \\<le> pred_gpv' (Domainp A) (Domainp C) {x. Domainp R x}\"\nproof(rule predicate1I pred_gpv'.intros)+\n\n  show \"Domainp A x\" if \"x \\<in> results_gpv (\\<I>_uniform UNIV {x. Domainp R x}) gpv\" \"Domainp (rel_gpv'' A C R) gpv\" for x gpv using that\n  proof(induction)\n    case (Pure gpv)\n    then show ?case \n      by (clarify) (drule rel_gpv''D\n          , auto simp add: f11 pred_spmf_def dest: spmf_Domainp_rel[THEN fun_cong, THEN iffD1, OF Domainp_iff[THEN iffD2], OF exI])\n  qed (simp add: f12) \n  show \"Domainp C out\" if \"out \\<in> outs_gpv (\\<I>_uniform UNIV {x. Domainp R x}) gpv\" \"Domainp (rel_gpv'' A C R) gpv\" for out gpv using that\n  proof( induction)\n    case (IO c gpv)\n    then show ?case\n      by (clarify) (drule rel_gpv''D\n          , auto simp add: f21 pred_spmf_def dest!: bspec spmf_Domainp_rel[THEN fun_cong, THEN iffD1, OF Domainp_iff[THEN iffD2], OF exI])\n  qed (simp add: f22)\nqed\n\nend\n\n\nlemma map_gpv'_id12: \"map_gpv' f g h gpv = map_gpv' id id h (map_gpv f g gpv)\"\n  unfolding map_gpv_conv_map_gpv' map_gpv'_comp by simp\n\nlemma rel_gpv''_refl: \"\\<lbrakk> (=) \\<le> A; (=) \\<le> C; R \\<le> (=) \\<rbrakk> \\<Longrightarrow> (=) \\<le> rel_gpv'' A C R\"\n  by(subst rel_gpv''_eq[symmetric])(rule rel_gpv''_mono)\n\n\ncontext\n  fixes A A' :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\"\n    and C C' :: \"'c \\<Rightarrow> 'd \\<Rightarrow> bool\"\n    and R R' :: \"'e \\<Rightarrow> 'f \\<Rightarrow> bool\"\n   \nbegin\n\nprivate abbreviation foo where \n  \"foo \\<equiv> (\\<lambda> fx fy gpvx gpvy g1 g2. \n            \\<forall>x y. x \\<in> fx (\\<I>_uniform UNIV (Collect (Domainp R'))) gpvx \\<longrightarrow>\n                  y \\<in> fy (\\<I>_uniform UNIV (Collect (Rangep R'))) gpvy \\<longrightarrow> g1 x y \\<longrightarrow> g2 x y)\"\n\nprivate lemma f1: \"foo results_gpv results_gpv gpv gpv' A A' \\<Longrightarrow>\n       x \\<in> set_spmf (the_gpv gpv) \\<Longrightarrow> y \\<in> set_spmf (the_gpv gpv') \\<Longrightarrow>\n       a \\<in> generat_conts x \\<Longrightarrow> b \\<in> generat_conts y \\<Longrightarrow>  R' a' \\<alpha> \\<Longrightarrow> R' \\<beta> b' \\<Longrightarrow> \n    foo results_gpv results_gpv (a a') (b b') A A'\"\n  by (fastforce elim: generat.set_cases intro: results_gpv.IO)\n\nprivate lemma f2: \"foo outs_gpv outs_gpv gpv gpv' C C' \\<Longrightarrow>\n       x \\<in> set_spmf (the_gpv gpv) \\<Longrightarrow> y \\<in> set_spmf (the_gpv gpv') \\<Longrightarrow>\n       a \\<in> generat_conts x \\<Longrightarrow> b \\<in> generat_conts y \\<Longrightarrow> R' a' \\<alpha> \\<Longrightarrow> R' \\<beta> b' \\<Longrightarrow> \n    foo outs_gpv outs_gpv (a a') (b b') C C'\"\n  by (fastforce elim: generat.set_cases intro: outs_gpv.Cont)\n\nlemma rel_gpv''_mono_strong:\n  \"\\<lbrakk> rel_gpv'' A C R gpv gpv'; \n     \\<And>x y. \\<lbrakk> x \\<in> results_gpv (\\<I>_uniform UNIV {x. Domainp R' x}) gpv; y \\<in> results_gpv (\\<I>_uniform UNIV {x. Rangep R' x}) gpv'; A x y \\<rbrakk> \\<Longrightarrow> A' x y;\n     \\<And>x y. \\<lbrakk> x \\<in> outs_gpv (\\<I>_uniform UNIV {x. Domainp R' x}) gpv; y \\<in> outs_gpv (\\<I>_uniform UNIV {x. Rangep R' x}) gpv'; C x y \\<rbrakk> \\<Longrightarrow> C' x y;\n     R' \\<le> R \\<rbrakk>\n  \\<Longrightarrow> rel_gpv'' A' C' R' gpv gpv'\"\n  apply(coinduction arbitrary: gpv gpv')\n  apply(drule rel_gpv''D)\n  apply(erule rel_spmf_mono_strong)\n  apply(erule generat.rel_mono_strong)\n    apply(erule generat.set_cases)+\n    apply(erule allE, rotate_tac -1)\n    apply(erule allE)\n    apply(erule impE)\n     apply(rule results_gpv.Pure)\n     apply simp\n    apply(erule impE)\n     apply(rule results_gpv.Pure)\n     apply simp\n    apply simp\n   apply(erule generat.set_cases)+\n   apply(rotate_tac 1)\n   apply(erule allE, rotate_tac -1)\n   apply(erule allE)\n   apply(erule impE)\n    apply(rule outs_gpv.IO)\n    apply simp\n   apply(erule impE)\n    apply(rule outs_gpv.IO)\n    apply simp\n   apply simp\n  apply(erule (1) rel_fun_mono_strong)\n  by (fastforce simp add: f1[simplified] f2[simplified])\n\nend\n\nlemma rel_gpv''_refl_strong:\n  assumes \"\\<And>x. x \\<in> results_gpv (\\<I>_uniform UNIV {x. Domainp R x}) gpv \\<Longrightarrow> A x x\"\n    and \"\\<And>x. x \\<in> outs_gpv (\\<I>_uniform UNIV {x. Domainp R x}) gpv \\<Longrightarrow> C x x\"\n    and \"R \\<le> (=)\"\n  shows \"rel_gpv'' A C R gpv gpv\"\nproof -\n  have \"rel_gpv'' (=) (=) (=) gpv gpv\" unfolding rel_gpv''_eq by simp\n  then show ?thesis using _ _ assms(3) by(rule rel_gpv''_mono_strong)(auto intro: assms(1-2))\nqed\n\nlemma rel_gpv''_refl_eq_on:\n  \"\\<lbrakk> \\<And>x. x \\<in> results_gpv (\\<I>_uniform UNIV X) gpv \\<Longrightarrow> A x x; \\<And>out. out \\<in> outs_gpv (\\<I>_uniform UNIV X) gpv \\<Longrightarrow> B out out \\<rbrakk>\n  \\<Longrightarrow> rel_gpv'' A B (eq_on X) gpv gpv\"\n  by(rule rel_gpv''_refl_strong) (auto elim: eq_onE)\n\nlemma pred_gpv'_mono' [mono]:\n  \"pred_gpv' A C R gpv \\<longrightarrow> pred_gpv' A' C' R gpv\"\n  if \"\\<And>x. A x \\<longrightarrow> A' x\" \"\\<And>x. C x \\<longrightarrow> C' x\"\n  using that unfolding pred_gpv'.simps\n  by auto\n\n\n\nprimcorec enforce_\\<I>_gpv :: \"('out, 'in) \\<I> \\<Rightarrow> ('a, 'out, 'in) gpv \\<Rightarrow> ('a, 'out, 'in) gpv\" where\n  \"enforce_\\<I>_gpv \\<I> gpv = GPV \n    (map_spmf (map_generat id id ((\\<circ>) (enforce_\\<I>_gpv \\<I>))) \n     (map_spmf (\\<lambda>generat. case generat of Pure x \\<Rightarrow> Pure x | IO out rpv \\<Rightarrow> IO out (\\<lambda>input. if input \\<in> responses_\\<I> \\<I> out then rpv input else Fail))\n        (enforce_spmf (pred_generat \\<top> (\\<lambda>x. x \\<in> outs_\\<I> \\<I>) \\<top>) (the_gpv gpv))))\"\n\nlemma enforce_\\<I>_gpv_Done [simp]: \"enforce_\\<I>_gpv \\<I> (Done x) = Done x\"\n  by(rule gpv.expand) simp\n\nlemma enforce_\\<I>_gpv_Fail [simp]: \"enforce_\\<I>_gpv \\<I> Fail = Fail\"\n  by(rule gpv.expand) simp\n\nlemma enforce_\\<I>_gpv_Pause [simp]:\n  \"enforce_\\<I>_gpv \\<I> (Pause out rpv) =\n   (if out \\<in> outs_\\<I> \\<I> then Pause out (\\<lambda>input. if input \\<in> responses_\\<I> \\<I> out then enforce_\\<I>_gpv \\<I> (rpv input) else Fail) else Fail)\"\n  by(rule gpv.expand)(simp add: fun_eq_iff)\n\nlemma enforce_\\<I>_gpv_lift_spmf [simp]: \"enforce_\\<I>_gpv \\<I> (lift_spmf p) = lift_spmf p\"\n  by(rule gpv.expand)(simp add: enforce_map_spmf spmf.map_comp o_def)\n\nlemma enforce_\\<I>_gpv_bind_gpv [simp]:\n  \"enforce_\\<I>_gpv \\<I> (bind_gpv gpv f) = bind_gpv (enforce_\\<I>_gpv \\<I> gpv) (enforce_\\<I>_gpv \\<I> \\<circ> f)\"\n  by(coinduction arbitrary: gpv rule: gpv.coinduct_strong)\n    (auto 4 3 simp add: bind_gpv.sel spmf_rel_map bind_map_spmf o_def pred_generat_def elim!: generat.set_cases intro!: generat.rel_refl_strong rel_spmf_bind_reflI rel_spmf_reflI rel_funI split!: if_splits generat.split_asm)\n\nlemma enforce_\\<I>_gpv_parametric':\n  includes lifting_syntax \n  notes [transfer_rule] = corec_gpv_parametric' the_gpv_parametric' Fail_parametric'\n  assumes [transfer_rule]: \"bi_unique C\" \"bi_unique R\"\n  shows \"(rel_\\<I> C R ===> rel_gpv'' A C R ===> rel_gpv'' A C R) enforce_\\<I>_gpv enforce_\\<I>_gpv\"\n  unfolding enforce_\\<I>_gpv_def top_fun_def by(transfer_prover)\n\nlemma enforce_\\<I>_gpv_parametric [transfer_rule]: includes lifting_syntax shows\n  \"bi_unique C \\<Longrightarrow> (rel_\\<I> C (=) ===> rel_gpv A C ===> rel_gpv A C) enforce_\\<I>_gpv enforce_\\<I>_gpv\"\n  unfolding rel_gpv_conv_rel_gpv'' by(rule enforce_\\<I>_gpv_parametric'[OF _ bi_unique_eq])\n\nlemma WT_enforce_\\<I>_gpv [simp]: \"\\<I> \\<turnstile>g enforce_\\<I>_gpv \\<I> gpv \\<surd>\"\n  by(coinduction arbitrary: gpv)(auto split: generat.split_asm)\n\nlemma WT_gpv_parametric': includes lifting_syntax shows\n  \"bi_unique C \\<Longrightarrow> (rel_\\<I> C R ===> rel_gpv'' A C R ===> (=)) WT_gpv WT_gpv\"\nproof(rule rel_funI iffI)+\n  note [transfer_rule] = the_gpv_parametric'\n  show *: \"\\<I> \\<turnstile>g gpv \\<surd>\" if [transfer_rule]: \"rel_\\<I> C R \\<I> \\<I>'\" \"bi_unique C\" \n    and *: \"\\<I>' \\<turnstile>g gpv' \\<surd>\" \"rel_gpv'' A C R gpv gpv'\" for \\<I> \\<I>' gpv gpv' A C R\n    using *\n  proof(coinduction arbitrary: gpv gpv')\n    case (WT_gpv out c gpv gpv')\n    note [transfer_rule] = WT_gpv(2)\n    have \"rel_set (rel_generat A C (R ===> rel_gpv'' A C R)) (set_spmf (the_gpv gpv)) (set_spmf (the_gpv gpv'))\" \n      by transfer_prover\n    from rel_setD1[OF this WT_gpv(3)] obtain out' c'\n      where [transfer_rule]: \"C out out'\" \"(R ===> rel_gpv'' A C R) c c'\"\n        and out': \"IO out' c' \\<in> set_spmf (the_gpv gpv')\"\n      by(auto elim: generat.rel_cases)\n    have \"out \\<in> outs_\\<I> \\<I> \\<longleftrightarrow> out' \\<in> outs_\\<I> \\<I>'\" by transfer_prover\n    with WT_gpvD(1)[OF WT_gpv(1) out'] have ?out by simp\n    moreover have ?cont\n    proof(standard; goal_cases cont)\n      case (cont input)\n      have \"rel_set R (responses_\\<I> \\<I> out) (responses_\\<I> \\<I>' out')\" by transfer_prover\n      from rel_setD1[OF this cont] obtain input' where [transfer_rule]: \"R input input'\"\n        and input': \"input' \\<in> responses_\\<I> \\<I>' out'\" by blast\n      have \"rel_gpv'' A C R (c input) (c' input')\" by transfer_prover\n      with WT_gpvD(2)[OF WT_gpv(1) out' input'] show ?case by auto\n    qed\n    ultimately show ?case ..\n  qed\n\n  show \"\\<I>' \\<turnstile>g gpv' \\<surd>\" if \"rel_\\<I> C R \\<I> \\<I>'\" \"bi_unique C\" \"\\<I> \\<turnstile>g gpv \\<surd>\" \"rel_gpv'' A C R gpv gpv'\" \n    for \\<I> \\<I>' gpv gpv'\n    using *[of \"conversep C\" \"conversep R\" \\<I>' \\<I> gpv \"conversep A\" gpv'] that\n    by(simp add: rel_gpv''_conversep)\nqed\n\nlemma WT_gpv_map_gpv_id [simp]: \"\\<I> \\<turnstile>g map_gpv f id gpv \\<surd> \\<longleftrightarrow> \\<I> \\<turnstile>g gpv \\<surd>\"\n  using WT_gpv_parametric'[of \"BNF_Def.Grp UNIV id\" \"(=)\" \"BNF_Def.Grp UNIV f\", folded rel_gpv_conv_rel_gpv'']\n  unfolding gpv.rel_Grp unfolding eq_alt[symmetric] relator_eq\n  by(auto simp add: rel_fun_def Grp_def bi_unique_eq)\n\nlocale raw_converter_invariant =\n  fixes \\<I> :: \"('call, 'ret) \\<I>\"\n    and \\<I>' :: \"('call', 'ret') \\<I>\"\n    and callee :: \"'s \\<Rightarrow> 'call \\<Rightarrow> ('ret \\<times> 's, 'call', 'ret') gpv\"\n    and I :: \"'s \\<Rightarrow> bool\"\n  assumes results_callee: \"\\<And>s x. \\<lbrakk> x \\<in> outs_\\<I> \\<I>; I s \\<rbrakk> \\<Longrightarrow> results_gpv \\<I>' (callee s x) \\<subseteq> responses_\\<I> \\<I> x \\<times> {s. I s}\"\n    and WT_callee: \"\\<And>x s. \\<lbrakk> x \\<in> outs_\\<I> \\<I>; I s \\<rbrakk> \\<Longrightarrow> \\<I>' \\<turnstile>g callee s x \\<surd>\"\nbegin\n\ncontext begin\nprivate lemma aux:\n  \"set_spmf (inline1 callee gpv s) \\<subseteq> {Inr (out, callee', rpv') | out callee' rpv'.\n    \\<exists>call\\<in>outs_\\<I> \\<I>. \\<exists>s. I s \\<and> (\\<forall>x \\<in> responses_\\<I> \\<I>' out. callee' x \\<in> sub_gpvs \\<I>' (callee s call))} \\<union>\n     {Inl (x, s') | x s'. x \\<in> results_gpv \\<I> gpv \\<and> I s'}\"\n  (is \"?concl (inline1 callee) gpv s\" is \"_ \\<subseteq> ?rhs1 \\<union> ?rhs2 gpv\")\n  if \"\\<I> \\<turnstile>g gpv \\<surd>\" \"I s\"\n  using that\nproof(induction arbitrary: gpv s rule: inline1_fixp_induct)\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step inline1')\n  { fix out c\n    assume IO: \"IO out c \\<in> set_spmf (the_gpv gpv)\" \n    from step.prems(1) IO have out: \"out \\<in> outs_\\<I> \\<I>\" by(rule WT_gpvD)\n    { fix x s'\n      assume Pure: \"Pure (x, s') \\<in> set_spmf (the_gpv (callee s out))\"\n      then have \"(x, s') \\<in> results_gpv \\<I>' (callee s out)\" by(rule results_gpv.Pure)\n      with out step.prems(2) have \"x \\<in> responses_\\<I> \\<I> out\" \"I s'\" by(auto dest: results_callee)\n      from step.prems(1) IO this(1) have \"\\<I> \\<turnstile>g c x \\<surd>\" by(rule WT_gpvD)\n      hence \"?concl inline1' (c x) s'\" using \\<open>I s'\\<close> by(rule step.IH)\n      also have \"\\<dots> \\<subseteq> ?rhs1 \\<union> ?rhs2 gpv\" using \\<open>x \\<in> _\\<close> IO by(auto intro: results_gpv.intros)\n      also note calculation\n    } moreover {\n      fix out' c'\n      assume \"IO out' c' \\<in> set_spmf (the_gpv (callee s out))\"\n      hence \"\\<forall>x\\<in>responses_\\<I> \\<I>' out'. c' x \\<in> sub_gpvs \\<I>' (callee s out)\"\n        by(auto intro: sub_gpvs.base)\n      then have \"\\<exists>call\\<in>outs_\\<I> \\<I>. \\<exists>s. I s \\<and> (\\<forall>x\\<in>responses_\\<I> \\<I>' out'. c' x \\<in> sub_gpvs \\<I>' (callee s call))\"\n        using out step.prems(2) by blast\n    } moreover note calculation }\n    then show ?case using step.prems\n      by(auto 4 3 del: subsetI simp add: bind_UNION intro!: UN_least split: generat.split intro: results_gpv.intros)\n  qed\n\nlemma inline1_in_sub_gpvs_callee:\n  assumes \"Inr (out, callee', rpv') \\<in> set_spmf (inline1 callee gpv s)\"\n    and WT: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and s: \"I s\"\n  shows \"\\<exists>call\\<in>outs_\\<I> \\<I>. \\<exists>s. I s \\<and> (\\<forall>x \\<in> responses_\\<I> \\<I>' out. callee' x \\<in> sub_gpvs \\<I>' (callee s call))\"\n  using aux[OF WT s] assms(1) by fastforce\n\nlemma inline1_Inl_results_gpv:\n  assumes \"Inl (x, s') \\<in> set_spmf (inline1 callee gpv s)\"\n    and WT: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and s: \"I s\"\n  shows \"x \\<in> results_gpv \\<I> gpv \\<and> I s'\"\n  using aux[OF WT s] assms(1) by fastforce\nend\n\nlemma inline1_in_sub_gpvs:\n  assumes \"Inr (out, callee', rpv') \\<in> set_spmf (inline1 callee gpv s)\"\n    and \"(x, s') \\<in> results_gpv \\<I>' (callee' input)\"\n    and \"input \\<in> responses_\\<I> \\<I>' out\"\n    and \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and \"I s\"\n  shows \"rpv' x \\<in> sub_gpvs \\<I> gpv \\<and> I s'\"\nproof -\n  from \\<open>\\<I> \\<turnstile>g gpv \\<surd>\\<close> \\<open>I s\\<close>\n  have \"set_spmf (inline1 callee gpv s) \\<subseteq> {Inr (out, callee', rpv') | out callee' rpv'.\n    \\<forall>input \\<in> responses_\\<I> \\<I>' out. \\<forall>(x, s')\\<in>results_gpv \\<I>' (callee' input). I s' \\<and> rpv' x \\<in> sub_gpvs \\<I> gpv}\n    \\<union> {Inl (x, s') | x s'. I s'}\" (is \"?concl (inline1 callee) gpv s\" is \"_ \\<subseteq> ?rhs gpv s\")\n  proof(induction arbitrary: gpv s rule: inline1_fixp_induct)\n    case adm show ?case by(intro cont_intro ccpo_class.admissible_leI)\n    case bottom show ?case by simp\n    case (step inline1')\n    { fix out c\n      assume IO: \"IO out c \\<in> set_spmf (the_gpv gpv)\" \n      from step.prems(1) IO have out: \"out \\<in> outs_\\<I> \\<I>\" by(rule WT_gpvD)\n      { fix x s'\n        assume Pure: \"Pure (x, s') \\<in> set_spmf (the_gpv (callee s out))\"\n        then have \"(x, s') \\<in> results_gpv \\<I>' (callee s out)\" by(rule results_gpv.Pure)\n        with out step.prems(2) have \"x \\<in> responses_\\<I> \\<I> out\" \"I s'\" by(auto dest: results_callee)\n        from step.prems(1) IO this(1) have \"\\<I> \\<turnstile>g c x \\<surd>\" by(rule WT_gpvD)\n        hence \"?concl inline1' (c x) s'\" using \\<open>I s'\\<close> by(rule step.IH)\n        also have \"\\<dots> \\<subseteq> ?rhs gpv s'\" using IO Pure \\<open>I s\\<close>\n          by(fastforce intro: sub_gpvs.cont dest: WT_gpv_OutD[OF step.prems(1)] results_callee[THEN subsetD, OF _ _ results_gpv.Pure])\n        finally have \"set_spmf (inline1' (c x) s') \\<subseteq> \\<dots>\" .\n      } moreover {\n        fix out' c' input x s'\n        assume \"IO out' c' \\<in> set_spmf (the_gpv (callee s out))\"\n          and \"input \\<in> responses_\\<I> \\<I>' out'\" and \"(x, s') \\<in> results_gpv \\<I>' (c' input)\"\n        then have \"c x \\<in> sub_gpvs \\<I> gpv\" \"I s'\" using IO \\<open>I s\\<close>\n          by(auto intro!: sub_gpvs.base dest: WT_gpv_OutD[OF step.prems(1)] results_callee[THEN subsetD, OF _ _ results_gpv.IO])\n      } moreover note calculation }\n      then show ?case using step.prems(2)\n        by(auto simp add: bind_UNION intro!: UN_least split: generat.split del: subsetI)\n    qed\n    with assms show ?thesis by fastforce\n  qed\n\nlemma WT_gpv_inline1:\n  assumes \"Inr (out, rpv, rpv') \\<in> set_spmf (inline1 callee gpv s)\"\n    and \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and \"I s\"\n  shows \"out \\<in> outs_\\<I> \\<I>'\" (is \"?thesis1\")\n    and \"input \\<in> responses_\\<I> \\<I>' out \\<Longrightarrow> \\<I>' \\<turnstile>g rpv input \\<surd>\" (is \"PROP ?thesis2\")\n    and \"\\<lbrakk> input \\<in> responses_\\<I> \\<I>' out; (x, s') \\<in> results_gpv \\<I>' (rpv input) \\<rbrakk> \\<Longrightarrow> \\<I> \\<turnstile>g rpv' x \\<surd> \\<and> I s'\" (is \"PROP ?thesis3\")\nproof -\n  from \\<open>\\<I> \\<turnstile>g gpv \\<surd>\\<close> \\<open>I s\\<close>\n  have \"set_spmf (inline1 callee gpv s) \\<subseteq> {Inr (out, rpv, rpv') | out rpv rpv'. out \\<in> outs_\\<I> \\<I>'} \\<union> {Inl (x, s')| x s'. I s'}\"\n  proof(induction arbitrary: gpv s rule: inline1_fixp_induct)\n    { case adm show ?case by(intro cont_intro ccpo_class.admissible_leI) }\n    { case bottom show ?case by simp }\n    case (step inline1')\n    { fix out c\n      assume IO: \"IO out c \\<in> set_spmf (the_gpv gpv)\" \n      from step.prems(1) IO have out: \"out \\<in> outs_\\<I> \\<I>\" by(rule WT_gpvD)\n      { fix x s'\n        assume Pure: \"Pure (x, s') \\<in> set_spmf (the_gpv (callee s out))\"\n        then have *: \"(x, s') \\<in> results_gpv \\<I>' (callee s out)\" by(rule results_gpv.Pure)\n        with out step.prems(2) have \"x \\<in> responses_\\<I> \\<I> out\" \"I s'\" by(auto dest: results_callee)\n        from step.prems(1) IO this(1) have \"\\<I> \\<turnstile>g c x \\<surd>\" by(rule WT_gpvD)\n        note this \\<open>I s'\\<close>\n      } moreover {\n        fix out' c'\n        from out step.prems(2) have \"\\<I>' \\<turnstile>g callee s out \\<surd>\" by(rule WT_callee)\n        moreover assume \"IO out' c' \\<in> set_spmf (the_gpv (callee s out))\"\n        ultimately have \"out' \\<in> outs_\\<I> \\<I>'\" by(rule WT_gpvD) \n      } moreover note calculation }\n      then show ?case using step.prems(2)\n        by(auto del: subsetI simp add: bind_UNION intro!: UN_least split: generat.split intro!: step.IH[THEN order_trans])\n    qed\n    then show ?thesis1 using assms by auto\n\n    assume \"input \\<in> responses_\\<I> \\<I>' out\"\n    with inline1_in_sub_gpvs_callee[OF \\<open>Inr _ \\<in> _\\<close> \\<open>\\<I> \\<turnstile>g gpv \\<surd>\\<close> \\<open>I s\\<close>]\n    obtain out' s where \"out' \\<in> outs_\\<I> \\<I>\" \n      and *: \"rpv input \\<in> sub_gpvs \\<I>' (callee s out')\" and \"I s\" by blast\n    from \\<open>out' \\<in> _\\<close> \\<open>I s\\<close> have \"\\<I>' \\<turnstile>g callee s out' \\<surd>\" by(rule WT_callee)\n    then show \"\\<I>' \\<turnstile>g rpv input \\<surd>\" using * by(rule WT_sub_gpvsD)\n\n    assume \"(x, s') \\<in> results_gpv \\<I>' (rpv input)\"\n    with \\<open>Inr _ \\<in> _\\<close> have \"rpv' x \\<in> sub_gpvs \\<I> gpv \\<and> I s'\"\n      using \\<open>input \\<in> _\\<close> \\<open>\\<I> \\<turnstile>g gpv \\<surd>\\<close> assms(3) \\<open>I s\\<close> by-(rule inline1_in_sub_gpvs)\n    with \\<open>\\<I> \\<turnstile>g gpv \\<surd>\\<close> show \"\\<I> \\<turnstile>g rpv' x \\<surd> \\<and> I s'\" by(blast intro: WT_sub_gpvsD)\n  qed\n\nlemma WT_gpv_inline_invar:\n  assumes \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and \"I s\"\n  shows \"\\<I>' \\<turnstile>g inline callee gpv s \\<surd>\"\n  using assms\nproof(coinduction arbitrary: gpv s rule: WT_gpv_coinduct_bind)\n  case (WT_gpv out c gpv)\n  from \\<open>IO out c \\<in> _\\<close> obtain callee' rpv'\n    where Inr: \"Inr (out, callee', rpv') \\<in> set_spmf (inline1 callee gpv s)\"\n      and c: \"c = (\\<lambda>input. callee' input \\<bind> (\\<lambda>(x, s). inline callee (rpv' x) s))\"\n    by(clarsimp simp add: inline_sel split: sum.split_asm)\n  from Inr \\<open>\\<I> \\<turnstile>g gpv \\<surd>\\<close> \\<open>I s\\<close> have ?out by(rule WT_gpv_inline1)\n  moreover have \"?cont TYPE('ret \\<times> 's)\" (is \"\\<forall>input\\<in>_. _ \\<or> _ \\<or> ?case' input\")\n  proof(rule ballI disjI2)+\n    fix input\n    assume \"input \\<in> responses_\\<I> \\<I>' out\"\n    with Inr \\<open>\\<I> \\<turnstile>g gpv \\<surd> \\<close> \\<open>I s\\<close> have \"\\<I>' \\<turnstile>g callee' input \\<surd>\"\n      and \"\\<And>x s'. (x, s') \\<in> results_gpv \\<I>' (callee' input) \\<Longrightarrow> \\<I> \\<turnstile>g rpv' x \\<surd> \\<and> I s'\"\n      by(blast dest: WT_gpv_inline1)+\n    then show \"?case' input\" by(subst c)(auto 4 5)\n  qed\n  ultimately show \"?case TYPE('ret \\<times> 's)\" ..\nqed\n\nend\n\nlemma WT_gpv_inline:\n  assumes \"\\<And>s x. x \\<in> outs_\\<I> \\<I> \\<Longrightarrow> results_gpv \\<I>' (callee s x) \\<subseteq> responses_\\<I> \\<I> x \\<times> UNIV\"\n    and \"\\<And>x s. x \\<in> outs_\\<I> \\<I> \\<Longrightarrow> \\<I>' \\<turnstile>g callee s x \\<surd>\"\n    and \"\\<I> \\<turnstile>g gpv \\<surd>\"\n  shows \"\\<I>' \\<turnstile>g inline callee gpv s \\<surd>\"\nproof -\n  interpret raw_converter_invariant \\<I> \\<I>' callee \"\\<lambda>_. True\" \n    using assms by(unfold_locales)auto\n  show ?thesis by(rule WT_gpv_inline_invar)(use assms in auto)\nqed\n\nlemma results_gpv_sub_gvps: \"gpv' \\<in> sub_gpvs \\<I> gpv \\<Longrightarrow> results_gpv \\<I> gpv' \\<subseteq> results_gpv \\<I> gpv\"\n  by(induction rule: sub_gpvs.induct)(auto intro: results_gpv.IO)\n\nlemma in_results_gpv_sub_gvps: \"\\<lbrakk> x \\<in> results_gpv \\<I> gpv'; gpv' \\<in> sub_gpvs \\<I> gpv \\<rbrakk> \\<Longrightarrow> x \\<in> results_gpv \\<I> gpv\"\n  using results_gpv_sub_gvps[of gpv' \\<I> gpv] by blast\n\ncontext raw_converter_invariant begin\nlemma results_gpv_inline_aux:\n  assumes \"(x, s') \\<in> results_gpv \\<I>' (inline_aux callee y)\"\n  shows \"\\<lbrakk> y = Inl (gpv, s); \\<I> \\<turnstile>g gpv \\<surd>; I s \\<rbrakk> \\<Longrightarrow> x \\<in> results_gpv \\<I> gpv \\<and> I s'\"\n    and \"\\<lbrakk> y = Inr (rpv, callee'); \\<forall>(z, s') \\<in> results_gpv \\<I>' callee'. \\<I> \\<turnstile>g rpv z \\<surd> \\<and> I s' \\<rbrakk>\n    \\<Longrightarrow> \\<exists>(z, s'') \\<in> results_gpv \\<I>' callee'. x \\<in> results_gpv \\<I> (rpv z) \\<and> I s'' \\<and> I s'\"\n  using assms\nproof(induction gvp'\\<equiv>\"inline_aux callee y\" arbitrary: y gpv s rpv callee')\n  case Pure case 1\n  with Pure show ?case\n    by(auto simp add: inline_aux.sel split: sum.split_asm dest: inline1_Inl_results_gpv)\nnext\n  case Pure case 2\n  with Pure show ?case\n    by(clarsimp simp add: inline_aux.sel split: sum.split_asm)\n      (fastforce split: generat.split_asm dest: inline1_Inl_results_gpv intro: results_gpv.Pure)+\nnext\n  case (IO out c input) case 1\n  with IO(1) obtain rpv rpv' where inline1: \"Inr (out, rpv, rpv') \\<in> set_spmf (inline1 callee gpv s)\"\n    and c: \"c = (\\<lambda>input. inline_aux callee (Inr (rpv', rpv input)))\"\n    by(auto simp add: inline_aux.sel split: sum.split_asm)\n  from inline1[THEN inline1_in_sub_gpvs, OF _ \\<open>input \\<in> responses_\\<I> \\<I>' out\\<close> _ \\<open>I s\\<close>] \\<open>\\<I> \\<turnstile>g gpv \\<surd>\\<close>\n  have \"\\<forall>(z, s')\\<in>results_gpv \\<I>' (rpv input). \\<I> \\<turnstile>g rpv' z \\<surd> \\<and> I s'\"\n    by(auto intro: WT_sub_gpvsD)\n  from IO(5)[unfolded c, OF refl refl this] obtain input' s'' \n    where input': \"(input', s'') \\<in> results_gpv \\<I>' (rpv input)\" \n      and x: \"x \\<in> results_gpv \\<I> (rpv' input')\" and s'': \"I s''\" \"I s'\"\n    by auto\n  from inline1[THEN inline1_in_sub_gpvs, OF input' \\<open>input \\<in> responses_\\<I> \\<I>' out\\<close> \\<open>\\<I> \\<turnstile>g gpv \\<surd>\\<close> \\<open>I s\\<close>] s'' x\n  show ?case by(auto intro: in_results_gpv_sub_gvps)\nnext\n  case (IO out c input) case 2\n  from IO(1) \"2\"(1) consider (Pure) input' s'' rpv' rpv''\n    where \"Pure (input', s'') \\<in> set_spmf (the_gpv callee')\" \"Inr (out, rpv', rpv'') \\<in> set_spmf (inline1 callee (rpv input') s'')\"\n      \"c = (\\<lambda>input. inline_aux callee (Inr (rpv'', rpv' input)))\"\n    | (Cont) rpv' where \"IO out rpv' \\<in> set_spmf (the_gpv callee')\" \"c = (\\<lambda>input. inline_aux callee (Inr (rpv, rpv' input)))\"\n    by(auto simp add: inline_aux.sel split: sum.split_asm; rename_tac generat; case_tac generat; clarsimp)\n  then show ?case\n  proof cases\n    case Pure\n    have res: \"(input', s'') \\<in> results_gpv \\<I>' callee'\" using Pure(1) by(rule results_gpv.Pure)\n    with 2 have WT: \"\\<I> \\<turnstile>g rpv input' \\<surd>\" \"I s''\" by auto\n    have \"\\<forall>(z, s')\\<in>results_gpv \\<I>' (rpv' input). \\<I> \\<turnstile>g rpv'' z \\<surd> \\<and> I s'\"\n      using inline1_in_sub_gpvs[OF Pure(2) _ \\<open>input \\<in> _\\<close> WT] WT by(auto intro: WT_sub_gpvsD)\n    from IO(5)[unfolded Pure(3), OF refl refl this] obtain z s'''\n      where z: \"(z, s''') \\<in> results_gpv \\<I>' (rpv' input)\"\n        and x: \"x \\<in> results_gpv \\<I> (rpv'' z)\" and s': \"I s'''\" \"I s'\" by auto\n    have \"x \\<in> results_gpv \\<I> (rpv input')\" using x inline1_in_sub_gpvs[OF Pure(2) z \\<open>input \\<in> _\\<close> WT]\n      by(auto intro: in_results_gpv_sub_gvps)\n    then show ?thesis using res WT s' by auto\n  next\n    case Cont\n    have \"\\<forall>(z, s')\\<in>results_gpv \\<I>' (rpv' input). \\<I> \\<turnstile>g rpv z \\<surd> \\<and> I s'\" \n      using Cont 2 \\<open>input \\<in> responses_\\<I> \\<I>' out\\<close> by(auto intro: results_gpv.IO)\n    from IO(5)[unfolded Cont, OF refl refl this] obtain z s'' \n      where \"(z, s'') \\<in> results_gpv \\<I>' (rpv' input)\" \"x \\<in> results_gpv \\<I> (rpv z)\" \"I s''\" \"I s'\" by auto\n    then show ?thesis using Cont(1) \\<open>input \\<in> _\\<close> by(auto intro: results_gpv.IO)\n  qed\nqed\n\nlemma results_gpv_inline: \n  \"\\<lbrakk>(x, s') \\<in> results_gpv \\<I>' (inline callee gpv s); \\<I> \\<turnstile>g gpv \\<surd>; I s\\<rbrakk> \\<Longrightarrow> x \\<in> results_gpv \\<I> gpv \\<and> I s'\"\n  unfolding inline_def by(rule results_gpv_inline_aux(1)[OF _ refl])\n\nend\n\n\nlemma inline_map_gpv:\n  \"inline callee (map_gpv f g gpv) s = map_gpv (apfst f) id (inline (\\<lambda>s x. callee s (g x)) gpv s)\"\n  unfolding apfst_def\n  by(rule inline_parametric\n      [where S=\"BNF_Def.Grp UNIV id\" and C=\"BNF_Def.Grp UNIV g\" and C'=\"BNF_Def.Grp UNIV id\" and A=\"BNF_Def.Grp UNIV f\",\n        THEN rel_funD, THEN rel_funD, THEN rel_funD,\n        unfolded gpv.rel_Grp prod.rel_Grp, simplified, folded eq_alt, unfolded Grp_def, simplified])\n    (auto simp add: rel_fun_def relator_eq)\n\n\n\n(* Computational_Model *)\n\nlemma \\<I>_full_le_plus_\\<I>: \"\\<I>_full \\<le> plus_\\<I> \\<I>1 \\<I>2\" if \"\\<I>_full \\<le> \\<I>1\" \"\\<I>_full \\<le> \\<I>2\"\n  using that by(auto simp add: le_\\<I>_def top_unique)\n\nlemma plus_\\<I>_mono: \"plus_\\<I> \\<I>1 \\<I>2 \\<le> plus_\\<I> \\<I>1' \\<I>2'\" if \"\\<I>1 \\<le> \\<I>1'\" \"\\<I>2 \\<le> \\<I>2'\" \n  using that by(fastforce simp add: le_\\<I>_def)\n\nprimcorec (transfer) left_gpv :: \"('a, 'out, 'in) gpv \\<Rightarrow> ('a, 'out + 'out', 'in + 'in') gpv\" where\n  \"the_gpv (left_gpv gpv) = \n   map_spmf (map_generat id Inl (\\<lambda>rpv input. case input of Inl input' \\<Rightarrow> left_gpv (rpv input') | _ \\<Rightarrow> Fail)) (the_gpv gpv)\"\n\nabbreviation left_rpv :: \"('a, 'out, 'in) rpv \\<Rightarrow> ('a, 'out + 'out', 'in + 'in') rpv\" where\n  \"left_rpv rpv \\<equiv> \\<lambda>input. case input of Inl input' \\<Rightarrow> left_gpv (rpv input') | _ \\<Rightarrow> Fail\"\n\nprimcorec (transfer) right_gpv :: \"('a, 'out, 'in) gpv \\<Rightarrow> ('a, 'out' + 'out, 'in' + 'in) gpv\" where\n  \"the_gpv (right_gpv gpv) =\n   map_spmf (map_generat id Inr (\\<lambda>rpv input. case input of Inr input' \\<Rightarrow> right_gpv (rpv input') | _ \\<Rightarrow> Fail)) (the_gpv gpv)\"\n\nabbreviation right_rpv :: \"('a, 'out, 'in) rpv \\<Rightarrow> ('a, 'out' + 'out, 'in' + 'in) rpv\" where\n  \"right_rpv rpv \\<equiv> \\<lambda>input. case input of Inr input' \\<Rightarrow> right_gpv (rpv input') | _ \\<Rightarrow> Fail\"\n\ncontext \n  includes lifting_syntax\n  notes [transfer_rule] = corec_gpv_parametric' Fail_parametric' the_gpv_parametric'\nbegin\n\nlemmas left_gpv_parametric = left_gpv.transfer\n\nlemma left_gpv_parametric':\n  \"(rel_gpv'' A C R ===> rel_gpv'' A (rel_sum C C') (rel_sum R R')) left_gpv left_gpv\"\n  unfolding left_gpv_def by transfer_prover\n\nlemmas right_gpv_parametric = right_gpv.transfer\n\nlemma right_gpv_parametric':\n  \"(rel_gpv'' A C' R' ===> rel_gpv'' A (rel_sum C C') (rel_sum R R')) right_gpv right_gpv\"\n  unfolding right_gpv_def by transfer_prover\n\nend\n\nlemma left_gpv_Done [simp]: \"left_gpv (Done x) = Done x\"\n  by(rule gpv.expand) simp\n\nlemma right_gpv_Done [simp]: \"right_gpv (Done x) = Done x\"\n  by(rule gpv.expand) simp\n\nlemma left_gpv_Pause [simp]:\n  \"left_gpv (Pause x rpv) = Pause (Inl x) (\\<lambda>input. case input of Inl input' \\<Rightarrow> left_gpv (rpv input') | _ \\<Rightarrow> Fail)\"\n  by(rule gpv.expand) simp\n\nlemma right_gpv_Pause [simp]:\n  \"right_gpv (Pause x rpv) = Pause (Inr x) (\\<lambda>input. case input of Inr input' \\<Rightarrow> right_gpv (rpv input') | _ \\<Rightarrow> Fail)\"\n  by(rule gpv.expand) simp\n\nlemma left_gpv_map: \"left_gpv (map_gpv f g gpv) = map_gpv f (map_sum g h) (left_gpv gpv)\"\n  using left_gpv.transfer[of \"BNF_Def.Grp UNIV f\" \"BNF_Def.Grp UNIV g\" \"BNF_Def.Grp UNIV h\"]\n  unfolding sum.rel_Grp gpv.rel_Grp\n  by(auto simp add: rel_fun_def Grp_def)\n\nlemma right_gpv_map: \"right_gpv (map_gpv f g gpv) = map_gpv f (map_sum h g) (right_gpv gpv)\"\n  using right_gpv.transfer[of \"BNF_Def.Grp UNIV f\" \"BNF_Def.Grp UNIV g\" \"BNF_Def.Grp UNIV h\"]\n  unfolding sum.rel_Grp gpv.rel_Grp\n  by(auto simp add: rel_fun_def Grp_def)\n\nlemma results'_gpv_left_gpv [simp]: \n  \"results'_gpv (left_gpv gpv :: ('a, 'out + 'out', 'in + 'in') gpv) = results'_gpv gpv\" (is \"?lhs = ?rhs\")\nproof(rule Set.set_eqI iffI)+\n  show \"x \\<in> ?rhs\" if \"x \\<in> ?lhs\" for x using that\n    by(induction gpv'\\<equiv>\"left_gpv gpv :: ('a, 'out + 'out', 'in + 'in') gpv\" arbitrary: gpv)\n      (fastforce simp add: elim!: generat.set_cases intro: results'_gpvI split: sum.splits)+\n  show \"x \\<in> ?lhs\" if \"x \\<in> ?rhs\" for x using that\n    by(induction)\n      (auto 4 3 elim!: generat.set_cases intro: results'_gpv_Pure rev_image_eqI results'_gpv_Cont[where input=\"Inl _\"])\nqed\n\nlemma results'_gpv_right_gpv [simp]: \n  \"results'_gpv (right_gpv gpv :: ('a, 'out' + 'out, 'in' + 'in) gpv) = results'_gpv gpv\" (is \"?lhs = ?rhs\")\nproof(rule Set.set_eqI iffI)+\n  show \"x \\<in> ?rhs\" if \"x \\<in> ?lhs\" for x using that\n    by(induction gpv'\\<equiv>\"right_gpv gpv :: ('a, 'out' + 'out, 'in' + 'in) gpv\" arbitrary: gpv)\n      (fastforce simp add: elim!: generat.set_cases intro: results'_gpvI split: sum.splits)+\n  show \"x \\<in> ?lhs\" if \"x \\<in> ?rhs\" for x using that\n    by(induction)\n      (auto 4 3 elim!: generat.set_cases intro: results'_gpv_Pure rev_image_eqI results'_gpv_Cont[where input=\"Inr _\"])\nqed\n\nlemma left_gpv_Inl_transfer: \"rel_gpv'' (=) (\\<lambda>l r. l = Inl r) (\\<lambda>l r. l = Inl r) (left_gpv gpv) gpv\"\n  by(coinduction arbitrary: gpv)\n    (auto simp add: spmf_rel_map generat.rel_map del: rel_funI intro!: rel_spmf_reflI generat.rel_refl_strong rel_funI)\n\nlemma right_gpv_Inr_transfer: \"rel_gpv'' (=) (\\<lambda>l r. l = Inr r) (\\<lambda>l r. l = Inr r) (right_gpv gpv) gpv\"\n  by(coinduction arbitrary: gpv)\n    (auto simp add: spmf_rel_map generat.rel_map del: rel_funI intro!: rel_spmf_reflI generat.rel_refl_strong rel_funI)\n\nlemma exec_gpv_plus_oracle_left: \"exec_gpv (plus_oracle oracle1 oracle2) (left_gpv gpv) s = exec_gpv oracle1 gpv s\"\n  unfolding spmf_rel_eq[symmetric] prod.rel_eq[symmetric]\n  by(rule exec_gpv_parametric'[where A=\"(=)\" and S=\"(=)\" and CALL=\"\\<lambda>l r. l = Inl r\" and R=\"\\<lambda>l r. l = Inl r\", THEN rel_funD, THEN rel_funD, THEN rel_funD])\n    (auto intro!: rel_funI simp add: spmf_rel_map apfst_def map_prod_def rel_prod_conv intro: rel_spmf_reflI left_gpv_Inl_transfer)\n\nlemma exec_gpv_plus_oracle_right: \"exec_gpv (plus_oracle oracle1 oracle2) (right_gpv gpv) s = exec_gpv oracle2 gpv s\"\n  unfolding spmf_rel_eq[symmetric] prod.rel_eq[symmetric]\n  by(rule exec_gpv_parametric'[where A=\"(=)\" and S=\"(=)\" and CALL=\"\\<lambda>l r. l = Inr r\" and R=\"\\<lambda>l r. l = Inr r\", THEN rel_funD, THEN rel_funD, THEN rel_funD])\n    (auto intro!: rel_funI simp add: spmf_rel_map apfst_def map_prod_def rel_prod_conv intro: rel_spmf_reflI right_gpv_Inr_transfer)\n\nlemma left_gpv_bind_gpv: \"left_gpv (bind_gpv gpv f) = bind_gpv (left_gpv gpv) (left_gpv \\<circ> f)\"\n  by(coinduction arbitrary:gpv f rule: gpv.coinduct_strong)\n    (auto 4 4 simp add: bind_map_spmf spmf_rel_map intro!: rel_spmf_reflI rel_spmf_bindI[of \"(=)\"] generat.rel_refl rel_funI split: sum.splits)\n\nlemma inline1_left_gpv:\n  \"inline1 (\\<lambda>s q. left_gpv (callee s q)) gpv s = \n   map_spmf (map_sum id (map_prod Inl (map_prod left_rpv id))) (inline1 callee gpv s)\"\nproof(induction arbitrary: gpv s rule: parallel_fixp_induct_2_2[OF partial_function_definitions_spmf partial_function_definitions_spmf inline1.mono inline1.mono inline1_def inline1_def, unfolded lub_spmf_empty, case_names adm bottom step])\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step inline1' inline1'')\n  then show ?case\n    by(auto simp add: map_spmf_bind_spmf o_def bind_map_spmf intro!: ext bind_spmf_cong split: generat.split)\nqed\n\nlemma left_gpv_inline: \"left_gpv (inline callee gpv s) = inline (\\<lambda>s q. left_gpv (callee s q)) gpv s\"\n  by(coinduction arbitrary: callee gpv s rule: gpv_coinduct_bind)\n    (fastforce simp add: inline_sel spmf_rel_map inline1_left_gpv left_gpv_bind_gpv o_def split_def intro!: rel_spmf_reflI split: sum.split intro!: rel_funI gpv.rel_refl_strong)\n\nlemma right_gpv_bind_gpv: \"right_gpv (bind_gpv gpv f) = bind_gpv (right_gpv gpv) (right_gpv \\<circ> f)\"\n  by(coinduction arbitrary:gpv f rule: gpv.coinduct_strong)\n    (auto 4 4 simp add: bind_map_spmf spmf_rel_map intro!: rel_spmf_reflI rel_spmf_bindI[of \"(=)\"] generat.rel_refl rel_funI split: sum.splits)\n\nlemma inline1_right_gpv:\n  \"inline1 (\\<lambda>s q. right_gpv (callee s q)) gpv s = \n   map_spmf (map_sum id (map_prod Inr (map_prod right_rpv id))) (inline1 callee gpv s)\"\nproof(induction arbitrary: gpv s rule: parallel_fixp_induct_2_2[OF partial_function_definitions_spmf partial_function_definitions_spmf inline1.mono inline1.mono inline1_def inline1_def, unfolded lub_spmf_empty, case_names adm bottom step])\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step inline1' inline1'')\n  then show ?case\n    by(auto simp add: map_spmf_bind_spmf o_def bind_map_spmf intro!: ext bind_spmf_cong split: generat.split)\nqed\n\nlemma right_gpv_inline: \"right_gpv (inline callee gpv s) = inline (\\<lambda>s q. right_gpv (callee s q)) gpv s\"\n  by(coinduction arbitrary: callee gpv s rule: gpv_coinduct_bind)\n    (fastforce simp add: inline_sel spmf_rel_map inline1_right_gpv right_gpv_bind_gpv o_def split_def intro!: rel_spmf_reflI split: sum.split intro!: rel_funI gpv.rel_refl_strong)\n\nlemma WT_gpv_left_gpv: \"\\<I>1 \\<turnstile>g gpv \\<surd> \\<Longrightarrow> \\<I>1 \\<oplus>\\<^sub>\\<I> \\<I>2 \\<turnstile>g left_gpv gpv \\<surd>\"\n  by(coinduction arbitrary: gpv)(auto 4 4 dest: WT_gpvD)\n\nlemma WT_gpv_right_gpv: \"\\<I>2 \\<turnstile>g gpv \\<surd> \\<Longrightarrow> \\<I>1 \\<oplus>\\<^sub>\\<I> \\<I>2 \\<turnstile>g right_gpv gpv \\<surd>\"\n  by(coinduction arbitrary: gpv)(auto 4 4 dest: WT_gpvD)\n\nlemma results_gpv_left_gpv [simp]: \"results_gpv (\\<I>1 \\<oplus>\\<^sub>\\<I> \\<I>2) (left_gpv gpv) = results_gpv \\<I>1 gpv\"\n  (is \"?lhs = ?rhs\")\nproof(rule Set.set_eqI iffI)+\n  show \"x \\<in> ?rhs\" if \"x \\<in> ?lhs\" for x using that\n    by(induction gpv'\\<equiv>\"left_gpv gpv :: ('a, 'b + 'c, 'd + 'e) gpv\" arbitrary: gpv rule: results_gpv.induct)\n      (fastforce intro: results_gpv.intros)+\n  show \"x \\<in> ?lhs\" if \"x \\<in> ?rhs\" for x using that\n    by(induction)(fastforce intro: results_gpv.intros)+\nqed\n\nlemma results_gpv_right_gpv [simp]: \"results_gpv (\\<I>1 \\<oplus>\\<^sub>\\<I> \\<I>2) (right_gpv gpv) = results_gpv \\<I>2 gpv\"\n  (is \"?lhs = ?rhs\")\nproof(rule Set.set_eqI iffI)+\n  show \"x \\<in> ?rhs\" if \"x \\<in> ?lhs\" for x using that\n    by(induction gpv'\\<equiv>\"right_gpv gpv :: ('a, 'b + 'c, 'd + 'e) gpv\" arbitrary: gpv rule: results_gpv.induct)\n      (fastforce intro: results_gpv.intros)+\n  show \"x \\<in> ?lhs\" if \"x \\<in> ?rhs\" for x using that\n    by(induction)(fastforce intro: results_gpv.intros)+\nqed\n\nlemma left_gpv_Fail [simp]: \"left_gpv Fail = Fail\"\n  by(rule gpv.expand) auto\n\nlemma right_gpv_Fail [simp]: \"right_gpv Fail = Fail\"\n  by(rule gpv.expand) auto\n\nlemma rsuml_lsumr_left_gpv_left_gpv:\"map_gpv' id rsuml lsumr (left_gpv (left_gpv gpv)) = left_gpv gpv\"\n  by(coinduction arbitrary: gpv)\n    (auto 4 3 simp add: spmf_rel_map generat.rel_map intro!: rel_spmf_reflI rel_generat_reflI rel_funI split!: sum.split elim!: lsumr.elims intro: exI[where x=Fail])\n\nlemma rsuml_lsumr_left_gpv_right_gpv: \"map_gpv' id rsuml lsumr (left_gpv (right_gpv gpv)) = right_gpv (left_gpv gpv)\"\n  by(coinduction arbitrary: gpv)\n    (auto 4 3 simp add: spmf_rel_map generat.rel_map intro!: rel_spmf_reflI rel_generat_reflI rel_funI split!: sum.split elim!: lsumr.elims intro: exI[where x=Fail])\n\nlemma rsuml_lsumr_right_gpv: \"map_gpv' id rsuml lsumr (right_gpv gpv) = right_gpv (right_gpv gpv)\"\n  by(coinduction arbitrary: gpv)\n    (auto 4 3 simp add: spmf_rel_map generat.rel_map intro!: rel_spmf_reflI rel_generat_reflI rel_funI split!: sum.split elim!: lsumr.elims intro: exI[where x=Fail])\n\nlemma map_gpv'_map_gpv_swap:\n  \"map_gpv' f g h (map_gpv f' id gpv) = map_gpv (f \\<circ> f') id (map_gpv' id g h gpv)\"\n  by(simp add: map_gpv_conv_map_gpv' map_gpv'_comp)\n\nlemma lsumr_rsuml_left_gpv: \"map_gpv' id lsumr rsuml (left_gpv gpv) = left_gpv (left_gpv gpv)\"\n  by(coinduction arbitrary: gpv)\n    (auto 4 3 simp add: spmf_rel_map generat.rel_map intro!: rel_spmf_reflI rel_generat_reflI rel_funI split!: sum.split intro: exI[where x=Fail])\n\nlemma lsumr_rsuml_right_gpv_left_gpv:\n  \"map_gpv' id lsumr rsuml (right_gpv (left_gpv gpv)) = left_gpv (right_gpv gpv)\"\n  by(coinduction arbitrary: gpv)\n    (auto 4 3 simp add: spmf_rel_map generat.rel_map intro!: rel_spmf_reflI rel_generat_reflI rel_funI split!: sum.split intro: exI[where x=Fail])\n\nlemma lsumr_rsuml_right_gpv_right_gpv:\n  \"map_gpv' id lsumr rsuml (right_gpv (right_gpv gpv)) = right_gpv gpv\"\n  by(coinduction arbitrary: gpv)\n    (auto 4 3 simp add: spmf_rel_map generat.rel_map intro!: rel_spmf_reflI rel_generat_reflI rel_funI split!: sum.split elim!: rsuml.elims intro: exI[where x=Fail])\n\n\nlemma in_set_spmf_extend_state_oracle [simp]:\n  \"x \\<in> set_spmf (extend_state_oracle oracle s y) \\<longleftrightarrow>\n   fst (snd x) = fst s \\<and> (fst x, snd (snd x)) \\<in> set_spmf (oracle (snd s) y)\"\n  by(auto 4 4 simp add: extend_state_oracle_def split_beta intro: rev_image_eqI prod.expand)\n\nlemma extend_state_oracle_plus_oracle: \n  \"extend_state_oracle (plus_oracle oracle1 oracle2) = plus_oracle (extend_state_oracle oracle1) (extend_state_oracle oracle2)\"\nproof ((rule ext)+; goal_cases)\n  case (1 s q)\n  then show ?case by (cases s; cases q) (simp_all add: apfst_def spmf.map_comp o_def split_def)\nqed\n\ndefinition stateless_callee :: \"('a \\<Rightarrow> ('b, 'out, 'in) gpv) \\<Rightarrow> ('s \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 's, 'out, 'in) gpv)\" where\n  \"stateless_callee callee s = map_gpv (\\<lambda>b. (b, s)) id \\<circ> callee\"\n\nlemma stateless_callee_parametric': \n  includes lifting_syntax notes [transfer_rule] = map_gpv_parametric' shows\n    \"((A ===> rel_gpv'' B C R) ===> S ===> A ===> (rel_gpv'' (rel_prod B S) C R))\n   stateless_callee stateless_callee\"\n  unfolding stateless_callee_def by transfer_prover\n\nlemma id_oralce_alt_def: \"id_oracle = stateless_callee (\\<lambda>x. Pause x Done)\"\n  by(simp add: id_oracle_def fun_eq_iff stateless_callee_def)\n\ncontext\n  fixes left :: \"'s1 \\<Rightarrow> 'x1 \\<Rightarrow> ('y1 \\<times> 's1, 'call1, 'ret1) gpv\"\n    and right :: \"'s2 \\<Rightarrow> 'x2 \\<Rightarrow> ('y2 \\<times> 's2, 'call2, 'ret2) gpv\"\nbegin\n\nfun parallel_intercept :: \"'s1 \\<times> 's2 \\<Rightarrow> 'x1 + 'x2 \\<Rightarrow> (('y1 + 'y2) \\<times> ('s1 \\<times> 's2), 'call1 + 'call2, 'ret1 + 'ret2) gpv\"\n  where\n    \"parallel_intercept (s1, s2) (Inl a) = left_gpv (map_gpv (map_prod Inl (\\<lambda>s1'. (s1', s2))) id (left s1 a))\"\n  | \"parallel_intercept (s1, s2) (Inr b) = right_gpv (map_gpv (map_prod Inr (Pair s1)) id (right s2 b))\"\n\nend\n\n(* GPV_Expectation *)\n\nlemma expectation_gpv_\\<I>_mono:\n  defines \"expectation_gpv' \\<equiv> expectation_gpv\"\n  assumes le: \"\\<I> \\<le> \\<I>'\"\n    and WT: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n  shows \"expectation_gpv fail \\<I> f gpv \\<le> expectation_gpv' fail \\<I>' f gpv\"\n  using WT\nproof(induction arbitrary: gpv rule: expectation_gpv_fixp_induct)\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case step [unfolded expectation_gpv'_def]: (step expectation_gpv')\n  show ?case unfolding expectation_gpv'_def\n    by(subst expectation_gpv.simps)\n      (clarsimp intro!: add_mono nn_integral_mono_AE INF_mono split: generat.split\n        , auto intro!: bexI step add_mono nn_integral_mono_AE INF_mono split: generat.split dest: WT_gpvD[OF step.prems] intro!: step dest: responses_\\<I>_mono[OF le])\nqed\n\nlemma pgen_lossless_gpv_mono:\n  assumes *: \"pgen_lossless_gpv fail \\<I> gpv\"\n    and le: \"\\<I> \\<le> \\<I>'\"\n    and WT: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and fail: \"fail \\<le> 1\"\n  shows \"pgen_lossless_gpv fail \\<I>' gpv\"\n  unfolding pgen_lossless_gpv_def\nproof(rule antisym)\n  from WT le have \"\\<I>' \\<turnstile>g gpv \\<surd>\" by(rule WT_gpv_\\<I>_mono)\n  from expectation_gpv_const_le[OF this, of fail 1] fail\n  show \"expectation_gpv fail \\<I>' (\\<lambda>_. 1) gpv \\<le> 1\" by(simp add: max_def split: if_split_asm)\n  from expectation_gpv_\\<I>_mono[OF le WT, of fail \"\\<lambda>_. 1\"] *\n  show \"expectation_gpv fail \\<I>' (\\<lambda>_. 1) gpv \\<ge> 1\" by(simp add: pgen_lossless_gpv_def)\nqed\n\nlemma plossless_gpv_mono:\n  \"\\<lbrakk> plossless_gpv \\<I> gpv; \\<I> \\<le> \\<I>'; \\<I> \\<turnstile>g gpv \\<surd> \\<rbrakk> \\<Longrightarrow> plossless_gpv \\<I>' gpv\"\n  by(erule pgen_lossless_gpv_mono; simp)\n\nlemma pfinite_gpv_mono:\n  \"\\<lbrakk> pfinite_gpv \\<I> gpv; \\<I> \\<le> \\<I>'; \\<I> \\<turnstile>g gpv \\<surd> \\<rbrakk> \\<Longrightarrow> pfinite_gpv \\<I>' gpv\"\n  by(erule pgen_lossless_gpv_mono; simp)\n\nlemma pgen_lossless_gpv_parametric': includes lifting_syntax shows\n  \"((=) ===> rel_\\<I> C R ===> rel_gpv'' A C R ===> (=)) pgen_lossless_gpv pgen_lossless_gpv\"\n  unfolding pgen_lossless_gpv_def supply expectation_gpv_parametric'[transfer_rule] by transfer_prover\n\nlemma pgen_lossless_gpv_parametric: includes lifting_syntax shows\n  \"((=) ===> rel_\\<I> C (=) ===> rel_gpv A C ===> (=)) pgen_lossless_gpv pgen_lossless_gpv\"\n  using pgen_lossless_gpv_parametric'[of C \"(=)\" A] by(simp add: rel_gpv_conv_rel_gpv'')\n\nlemma pgen_lossless_gpv_map_gpv_id [simp]:\n  \"pgen_lossless_gpv fail \\<I> (map_gpv f id gpv) = pgen_lossless_gpv fail \\<I> gpv\"\n  using pgen_lossless_gpv_parametric[of \"BNF_Def.Grp UNIV id\" \"BNF_Def.Grp UNIV f\"]\n  unfolding gpv.rel_Grp\n  by(auto simp add: eq_alt[symmetric] rel_\\<I>_eq rel_fun_def Grp_iff)\n\ncontext raw_converter_invariant begin\n\nlemma expectation_gpv_le_inline:\n  defines \"expectation_gpv2 \\<equiv> expectation_gpv 0 \\<I>'\"\n  assumes callee: \"\\<And>s x. \\<lbrakk> x \\<in> outs_\\<I> \\<I>; I s \\<rbrakk> \\<Longrightarrow> plossless_gpv \\<I>' (callee s x)\"\n    and WT_gpv: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and I: \"I s\"\n  shows \"expectation_gpv 0 \\<I> f gpv \\<le> expectation_gpv2 (\\<lambda>(x, s). f x) (inline callee gpv s)\"\n  using WT_gpv I\nproof(induction arbitrary: gpv s rule: expectation_gpv_fixp_induct)\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step expectation_gpv')\n  { fix out c\n    assume IO: \"IO out c \\<in> set_spmf (the_gpv gpv)\"\n    with step.prems (1) have out: \"out \\<in> outs_\\<I> \\<I>\" by(rule WT_gpv_OutD)\n    have \"(INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) = \\<integral>\\<^sup>+ generat. (INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) \\<partial>measure_spmf (the_gpv (callee s out))\"\n      using WT_callee[OF out, of s] callee[OF out, of s] \\<open>I s\\<close>\n      by(clarsimp simp add: measure_spmf.emeasure_eq_measure plossless_iff_colossless_pfinite colossless_gpv_lossless_spmfD lossless_weight_spmfD)\n    also have \"\\<dots> \\<le> \\<integral>\\<^sup>+ generat. (case generat of Pure (x, s') \\<Rightarrow>\n            \\<integral>\\<^sup>+ xx. (case xx of Inl (x, _) \\<Rightarrow> f x \n               | Inr (out', callee', rpv) \\<Rightarrow> INF r'\\<in>responses_\\<I> \\<I>' out'. expectation_gpv 0 \\<I>' (\\<lambda>(r, s'). expectation_gpv 0 \\<I>' (\\<lambda>(x, s). f x) (inline callee (rpv r) s')) (callee' r'))\n            \\<partial>measure_spmf (inline1 callee (c x) s')\n         | IO out' rpv \\<Rightarrow> INF r'\\<in>responses_\\<I> \\<I>' out'. expectation_gpv 0 \\<I>' (\\<lambda>(r', s'). expectation_gpv 0 \\<I>' (\\<lambda>(x, s). f x) (inline callee (c r') s')) (rpv r'))\n       \\<partial>measure_spmf (the_gpv (callee s out))\"\n    proof(rule nn_integral_mono_AE; simp split!: generat.split)\n      fix x s'\n      assume Pure: \"Pure (x, s') \\<in> set_spmf (the_gpv (callee s out))\"\n      hence \"(x, s') \\<in> results_gpv \\<I>' (callee s out)\" by(rule results_gpv.Pure)\n      with results_callee[OF out, of s] \\<open>I s\\<close> have x: \"x \\<in> responses_\\<I> \\<I> out\" and \"I s'\" by blast+\n      from x have \"(INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) \\<le> expectation_gpv' (c x)\" by(rule INF_lower)\n      also have \"\\<dots> \\<le> expectation_gpv2 (\\<lambda>(x, s). f x) (inline callee (c x) s')\"\n        by(rule step.IH)(rule WT_gpv_ContD[OF step.prems(1) IO x] step.prems \\<open>I s'\\<close>|assumption)+\n      also have \"\\<dots> = \\<integral>\\<^sup>+ xx. (case xx of Inl (x, _) \\<Rightarrow> f x \n               | Inr (out', callee', rpv) \\<Rightarrow> INF r'\\<in>responses_\\<I> \\<I>' out'. expectation_gpv 0 \\<I>' (\\<lambda>(r, s'). expectation_gpv 0 \\<I>' (\\<lambda>(x, s). f x) (inline callee (rpv r) s')) (callee' r'))\n            \\<partial>measure_spmf (inline1 callee (c x) s')\"\n        unfolding expectation_gpv2_def\n        by(subst expectation_gpv.simps)(auto simp add: inline_sel split_def o_def intro!: nn_integral_cong split: generat.split sum.split)\n      finally show \"(INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) \\<le> \\<dots>\" .\n    next\n      fix out' rpv\n      assume IO': \"IO out' rpv \\<in> set_spmf (the_gpv (callee s out))\"\n      have \"(INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) \\<le> (INF (r, s')\\<in>(\\<Union>r'\\<in>responses_\\<I> \\<I>' out'. results_gpv \\<I>' (rpv r')). expectation_gpv' (c r))\"\n        using IO' results_callee[OF out, of s] \\<open>I s\\<close> by(intro INF_mono)(auto intro: results_gpv.IO)\n      also have \"\\<dots> = (INF r'\\<in>responses_\\<I> \\<I>' out'. INF (r, s')\\<in>results_gpv \\<I>' (rpv r'). expectation_gpv' (c r))\"\n        by(simp add: INF_UNION)\n      also have \"\\<dots> \\<le> (INF r'\\<in>responses_\\<I> \\<I>' out'. expectation_gpv 0 \\<I>' (\\<lambda>(r', s'). expectation_gpv 0 \\<I>' (\\<lambda>(x, s). f x) (inline callee (c r') s')) (rpv r'))\"\n      proof(rule INF_mono, rule bexI)\n        fix r'\n        assume r': \"r' \\<in> responses_\\<I> \\<I>' out'\"\n        have \"(INF (r, s')\\<in>results_gpv \\<I>' (rpv r'). expectation_gpv' (c r)) \\<le> (INF (r, s')\\<in>results_gpv \\<I>' (rpv r'). expectation_gpv2 (\\<lambda>(x, s). f x) (inline callee (c r) s'))\"\n          using IO IO' step.prems out results_callee[OF out, of s] r'\n          by(auto intro!: INF_mono rev_bexI step.IH dest: WT_gpv_ContD intro: results_gpv.IO)\n        also have \"\\<dots> \\<le>  expectation_gpv 0 \\<I>' (\\<lambda>(r', s'). expectation_gpv 0 \\<I>' (\\<lambda>(x, s). f x) (inline callee (c r') s')) (rpv r')\"\n          unfolding expectation_gpv2_def using plossless_gpv_ContD[OF callee, OF out \\<open>I s\\<close> IO' r'] WT_callee[OF out \\<open>I s\\<close>] IO' r'\n          by(intro plossless_INF_le_expectation_gpv)(auto intro: WT_gpv_ContD)\n        finally show \"(INF (r, s')\\<in>results_gpv \\<I>' (rpv r'). expectation_gpv' (c r)) \\<le> \\<dots>\" .\n      qed\n      finally show \"(INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) \\<le> \\<dots>\" .\n    qed\n    also note calculation }\n  then show ?case unfolding expectation_gpv2_def\n    apply(rewrite expectation_gpv.simps)\n    apply(rewrite inline_sel)\n    apply(simp add: o_def pmf_map_spmf_None)\n    apply(rewrite sum.case_distrib[where h=\"case_generat _ _\"])\n    apply(simp cong del: sum.case_cong_weak)\n    apply(simp add: split_beta o_def cong del: sum.case_cong_weak)\n    apply(rewrite inline1.simps)\n    apply(rewrite measure_spmf_bind)\n    apply(rewrite nn_integral_bind[where B=\"measure_spmf _\"])\n      apply simp\n     apply(simp add: space_subprob_algebra)\n    apply(rule nn_integral_mono_AE)\n    apply(clarsimp split!: generat.split)\n     apply(simp add: measure_spmf_return_spmf nn_integral_return)\n    apply(rewrite measure_spmf_bind)\n    apply(simp add: nn_integral_bind[where B=\"measure_spmf _\"] space_subprob_algebra)\n    apply(subst generat.case_distrib[where h=\"measure_spmf\"])\n    apply(subst generat.case_distrib[where h=\"\\<lambda>x. nn_integral x _\"])\n    apply(simp add: measure_spmf_return_spmf nn_integral_return split_def)\n    done\nqed\n\nlemma plossless_inline:\n  assumes lossless: \"plossless_gpv \\<I> gpv\"\n    and WT: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and callee: \"\\<And>s x. \\<lbrakk> I s; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> plossless_gpv \\<I>' (callee s x)\"\n    and I: \"I s\"\n  shows \"plossless_gpv \\<I>' (inline callee gpv s)\"\n  unfolding pgen_lossless_gpv_def\nproof(rule antisym)\n  have WT': \"\\<I>' \\<turnstile>g inline callee gpv s \\<surd>\" using WT I by(rule WT_gpv_inline_invar)\n  from expectation_gpv_const_le[OF WT', of 0 1]\n  show \"expectation_gpv 0 \\<I>' (\\<lambda>_. 1) (inline callee gpv s) \\<le> 1\" by(simp add: max_def)\n\n  have \"1 = expectation_gpv 0 \\<I> (\\<lambda>_. 1) gpv\" using lossless by(simp add: pgen_lossless_gpv_def)\n  also have \"\\<dots> \\<le> expectation_gpv 0 \\<I>' (\\<lambda>_. 1) (inline callee gpv s)\"\n    by(rule expectation_gpv_le_inline[unfolded split_def]; rule callee I WT)\n  finally show \"1 \\<le> \\<dots>\" .\nqed\n\nend\n\nlemma expectation_left_gpv [simp]:\n  \"expectation_gpv fail (\\<I> \\<oplus>\\<^sub>\\<I> \\<I>') f (left_gpv gpv) = expectation_gpv fail \\<I> f gpv\"\nproof(induction arbitrary: gpv rule: parallel_fixp_induct_1_1[OF complete_lattice_partial_function_definitions complete_lattice_partial_function_definitions expectation_gpv.mono expectation_gpv.mono expectation_gpv_def expectation_gpv_def, case_names adm bottom step])\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step expectation_gpv' expectation_gpv'')\n  show ?case\n    by (auto simp add: pmf_map_spmf_None o_def case_map_generat image_comp\n      split: generat.split intro!: nn_integral_cong_AE INF_cong step.IH)\nqed\n\nlemma expectation_right_gpv [simp]:\n  \"expectation_gpv fail (\\<I> \\<oplus>\\<^sub>\\<I> \\<I>') f (right_gpv gpv) = expectation_gpv fail \\<I>' f gpv\"\nproof(induction arbitrary: gpv rule: parallel_fixp_induct_1_1[OF complete_lattice_partial_function_definitions complete_lattice_partial_function_definitions expectation_gpv.mono expectation_gpv.mono expectation_gpv_def expectation_gpv_def, case_names adm bottom step])\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step expectation_gpv' expectation_gpv'')\n  show ?case\n    by (auto simp add: pmf_map_spmf_None o_def case_map_generat image_comp\n      split: generat.split intro!: nn_integral_cong_AE INF_cong step.IH)\nqed\n\nlemma pgen_lossless_left_gpv [simp]: \"pgen_lossless_gpv fail (\\<I> \\<oplus>\\<^sub>\\<I> \\<I>') (left_gpv gpv) = pgen_lossless_gpv fail \\<I> gpv\"\n  by(simp add: pgen_lossless_gpv_def)\n\nlemma pgen_lossless_right_gpv [simp]: \"pgen_lossless_gpv fail (\\<I> \\<oplus>\\<^sub>\\<I> \\<I>') (right_gpv gpv) = pgen_lossless_gpv fail \\<I>' gpv\"\n  by(simp add: pgen_lossless_gpv_def)\n\nlemma (in raw_converter_invariant) expectation_gpv_le_inline_invariant:\n  defines \"expectation_gpv2 \\<equiv> expectation_gpv 0 \\<I>'\"\n  assumes callee: \"\\<And>s x. \\<lbrakk> x \\<in> outs_\\<I> \\<I>; I s \\<rbrakk> \\<Longrightarrow> plossless_gpv \\<I>' (callee s x)\"\n    and WT_gpv: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and I: \"I s\"\n  shows \"expectation_gpv 0 \\<I> f gpv \\<le> expectation_gpv2 (\\<lambda>(x, s). f x) (inline callee gpv s)\"\n  using WT_gpv I\nproof(induction arbitrary: gpv s rule: expectation_gpv_fixp_induct)\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step expectation_gpv')\n  { fix out c\n    assume IO: \"IO out c \\<in> set_spmf (the_gpv gpv)\"\n    with step.prems(1) have out: \"out \\<in> outs_\\<I> \\<I>\" by(rule WT_gpv_OutD)\n    have \"(INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) = \\<integral>\\<^sup>+ generat. (INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) \\<partial>measure_spmf (the_gpv (callee s out))\"\n      using WT_callee[OF out, of s] callee[OF out, of s] step.prems(2)\n      by(clarsimp simp add: measure_spmf.emeasure_eq_measure plossless_iff_colossless_pfinite colossless_gpv_lossless_spmfD lossless_weight_spmfD)\n    also have \"\\<dots> \\<le> \\<integral>\\<^sup>+ generat. (case generat of Pure (x, s') \\<Rightarrow>\n            \\<integral>\\<^sup>+ xx. (case xx of Inl (x, _) \\<Rightarrow> f x \n               | Inr (out', callee', rpv) \\<Rightarrow> INF r'\\<in>responses_\\<I> \\<I>' out'. expectation_gpv 0 \\<I>' (\\<lambda>(r, s'). expectation_gpv 0 \\<I>' (\\<lambda>(x, s). f x) (inline callee (rpv r) s')) (callee' r'))\n            \\<partial>measure_spmf (inline1 callee (c x) s')\n         | IO out' rpv \\<Rightarrow> INF r'\\<in>responses_\\<I> \\<I>' out'. expectation_gpv 0 \\<I>' (\\<lambda>(r', s'). expectation_gpv 0 \\<I>' (\\<lambda>(x, s). f x) (inline callee (c r') s')) (rpv r'))\n       \\<partial>measure_spmf (the_gpv (callee s out))\"\n    proof(rule nn_integral_mono_AE; simp split!: generat.split)\n      fix x s'\n      assume Pure: \"Pure (x, s') \\<in> set_spmf (the_gpv (callee s out))\"\n      hence \"(x, s') \\<in> results_gpv \\<I>' (callee s out)\" by(rule results_gpv.Pure)\n      with results_callee[OF out step.prems(2)] have x: \"x \\<in> responses_\\<I> \\<I> out\" and s': \"I s'\" by blast+\n      from this(1) have \"(INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) \\<le> expectation_gpv' (c x)\" by(rule INF_lower)\n      also have \"\\<dots> \\<le> expectation_gpv2 (\\<lambda>(x, s). f x) (inline callee (c x) s')\"\n        by(rule step.IH)(rule WT_gpv_ContD[OF step.prems(1) IO x] step.prems s'|assumption)+\n      also have \"\\<dots> = \\<integral>\\<^sup>+ xx. (case xx of Inl (x, _) \\<Rightarrow> f x \n               | Inr (out', callee', rpv) \\<Rightarrow> INF r'\\<in>responses_\\<I> \\<I>' out'. expectation_gpv 0 \\<I>' (\\<lambda>(r, s'). expectation_gpv 0 \\<I>' (\\<lambda>(x, s). f x) (inline callee (rpv r) s')) (callee' r'))\n            \\<partial>measure_spmf (inline1 callee (c x) s')\"\n        unfolding expectation_gpv2_def\n        by(subst expectation_gpv.simps)(auto simp add: inline_sel split_def o_def intro!: nn_integral_cong split: generat.split sum.split)\n      finally show \"(INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) \\<le> \\<dots>\" .\n    next\n      fix out' rpv\n      assume IO': \"IO out' rpv \\<in> set_spmf (the_gpv (callee s out))\"\n      have \"(INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) \\<le> (INF (r, s')\\<in>(\\<Union>r'\\<in>responses_\\<I> \\<I>' out'. results_gpv \\<I>' (rpv r')). expectation_gpv' (c r))\"\n        using IO' results_callee[OF out step.prems(2)] by(intro INF_mono)(auto intro: results_gpv.IO)\n      also have \"\\<dots> = (INF r'\\<in>responses_\\<I> \\<I>' out'. INF (r, s')\\<in>results_gpv \\<I>' (rpv r'). expectation_gpv' (c r))\"\n        by(simp add: INF_UNION)\n      also have \"\\<dots> \\<le> (INF r'\\<in>responses_\\<I> \\<I>' out'. expectation_gpv 0 \\<I>' (\\<lambda>(r', s'). expectation_gpv 0 \\<I>' (\\<lambda>(x, s). f x) (inline callee (c r') s')) (rpv r'))\"\n      proof(rule INF_mono, rule bexI)\n        fix r'\n        assume r': \"r' \\<in> responses_\\<I> \\<I>' out'\"\n        have \"(INF (r, s')\\<in>results_gpv \\<I>' (rpv r'). expectation_gpv' (c r)) \\<le> (INF (r, s')\\<in>results_gpv \\<I>' (rpv r'). expectation_gpv2 (\\<lambda>(x, s). f x) (inline callee (c r) s'))\"\n          using IO IO' step.prems out results_callee[OF out, of s] r'\n          by(auto intro!: INF_mono rev_bexI step.IH dest: WT_gpv_ContD intro: results_gpv.IO)\n        also have \"\\<dots> \\<le>  expectation_gpv 0 \\<I>' (\\<lambda>(r', s'). expectation_gpv 0 \\<I>' (\\<lambda>(x, s). f x) (inline callee (c r') s')) (rpv r')\"\n          unfolding expectation_gpv2_def using plossless_gpv_ContD[OF callee, OF out step.prems(2) IO' r'] WT_callee[OF out step.prems(2)] IO' r'\n          by(intro plossless_INF_le_expectation_gpv)(auto intro: WT_gpv_ContD)\n        finally show \"(INF (r, s')\\<in>results_gpv \\<I>' (rpv r'). expectation_gpv' (c r)) \\<le> \\<dots>\" .\n      qed\n      finally show \"(INF r\\<in>responses_\\<I> \\<I> out. expectation_gpv' (c r)) \\<le> \\<dots>\" .\n    qed\n    also note calculation }\n  then show ?case unfolding expectation_gpv2_def\n    apply(rewrite expectation_gpv.simps)\n    apply(rewrite inline_sel)\n    apply(simp add: o_def pmf_map_spmf_None)\n    apply(rewrite sum.case_distrib[where h=\"case_generat _ _\"])\n    apply(simp cong del: sum.case_cong_weak)\n    apply(simp add: split_beta o_def cong del: sum.case_cong_weak)\n    apply(rewrite inline1.simps)\n    apply(rewrite measure_spmf_bind)\n    apply(rewrite nn_integral_bind[where B=\"measure_spmf _\"])\n      apply simp\n     apply(simp add: space_subprob_algebra)\n    apply(rule nn_integral_mono_AE)\n    apply(clarsimp split!: generat.split)\n     apply(simp add: measure_spmf_return_spmf nn_integral_return)\n    apply(rewrite measure_spmf_bind)\n    apply(simp add: nn_integral_bind[where B=\"measure_spmf _\"] space_subprob_algebra)\n    apply(subst generat.case_distrib[where h=\"measure_spmf\"])\n    apply(subst generat.case_distrib[where h=\"\\<lambda>x. nn_integral x _\"])\n    apply(simp add: measure_spmf_return_spmf nn_integral_return split_def)\n    done\nqed\n\nlemma (in raw_converter_invariant) plossless_inline_invariant:\n  assumes lossless: \"plossless_gpv \\<I> gpv\"\n    and WT: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and callee: \"\\<And>s x. \\<lbrakk> x \\<in> outs_\\<I> \\<I>; I s \\<rbrakk> \\<Longrightarrow> plossless_gpv \\<I>' (callee s x)\"\n    and I: \"I s\"\n  shows \"plossless_gpv \\<I>' (inline callee gpv s)\"\n  unfolding pgen_lossless_gpv_def\nproof(rule antisym)\n  have WT': \"\\<I>' \\<turnstile>g inline callee gpv s \\<surd>\" using WT I by(rule WT_gpv_inline_invar)\n  from expectation_gpv_const_le[OF WT', of 0 1]\n  show \"expectation_gpv 0 \\<I>' (\\<lambda>_. 1) (inline callee gpv s) \\<le> 1\" by(simp add: max_def)\n\n  have \"1 = expectation_gpv 0 \\<I> (\\<lambda>_. 1) gpv\" using lossless by(simp add: pgen_lossless_gpv_def)\n  also have \"\\<dots> \\<le> expectation_gpv 0 \\<I>' (\\<lambda>_. 1) (inline callee gpv s)\"\n    by(rule expectation_gpv_le_inline[unfolded split_def]; rule callee WT WT_callee I)\n  finally show \"1 \\<le> \\<dots>\" .\nqed\n\ncontext callee_invariant_on begin\n\nlemma raw_converter_invariant: \"raw_converter_invariant \\<I> \\<I>' (\\<lambda>s x. lift_spmf (callee s x)) I\"\n  by(unfold_locales)(auto dest: callee_invariant WT_callee WT_calleeD)\n\nlemma (in callee_invariant_on) plossless_exec_gpv:\n  assumes lossless: \"plossless_gpv \\<I> gpv\"\n    and WT: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and callee: \"\\<And>s x. \\<lbrakk> x \\<in> outs_\\<I> \\<I>; I s \\<rbrakk> \\<Longrightarrow> lossless_spmf (callee s x)\"\n    and I: \"I s\"\n  shows \"lossless_spmf (exec_gpv callee gpv s)\"\nproof -\n  interpret raw_converter_invariant \\<I> \\<I>' \"\\<lambda>s x. lift_spmf (callee s x)\" I for \\<I>'\n    by(rule raw_converter_invariant)\n  have \"plossless_gpv \\<I>_full (inline (\\<lambda>s x. lift_spmf (callee s x)) gpv s)\"\n    using lossless WT by(rule plossless_inline)(simp_all add: callee I)\n  from this[THEN plossless_gpv_lossless_spmfD] show ?thesis\n    unfolding exec_gpv_conv_inline1 by(simp add: inline_sel)\nqed\n\nend\n\ndefinition extend_state_oracle2 :: \"('call, 'ret, 's) callee \\<Rightarrow> ('call, 'ret, 's \\<times> 's') callee\" (\"_\\<dagger>\" [1000] 1000)\n  where \"extend_state_oracle2 callee = (\\<lambda>(s, s') x. map_spmf (\\<lambda>(y, s). (y, (s, s'))) (callee s x))\"\n\nlemma extend_state_oracle2_simps [simp]:\n  \"extend_state_oracle2 callee (s, s') x = map_spmf (\\<lambda>(y, s). (y, (s, s'))) (callee s x)\"\n  by(simp add: extend_state_oracle2_def)\n\nlemma extend_state_oracle2_parametric [transfer_rule]: includes lifting_syntax shows\n  \"((S ===> C ===> rel_spmf (rel_prod R S)) ===> rel_prod S S' ===> C ===> rel_spmf (rel_prod R (rel_prod S S')))\n  extend_state_oracle2 extend_state_oracle2\"\n  unfolding extend_state_oracle2_def[abs_def] by transfer_prover\n\nlemma callee_invariant_extend_state_oracle2_const [simp]:\n  \"callee_invariant oracle\\<dagger> (\\<lambda>(s, s'). I s')\"\n  by unfold_locales auto\n\nlemma callee_invariant_extend_state_oracle2_const':\n  \"callee_invariant oracle\\<dagger> (\\<lambda>s. I (snd s))\"\n  by unfold_locales auto\n\nlemma extend_state_oracle2_plus_oracle: \n  \"extend_state_oracle2 (plus_oracle oracle1 oracle2) = plus_oracle (extend_state_oracle2 oracle1) (extend_state_oracle2 oracle2)\"\nproof((rule ext)+; goal_cases)\n  case (1 s q)\n  then show ?case by (cases s; cases q) (simp_all add: apfst_def spmf.map_comp o_def split_def)\nqed\n\nlemma parallel_oracle_conv_plus_oracle:\n  \"parallel_oracle oracle1 oracle2 = plus_oracle (oracle1\\<dagger>) (\\<dagger>oracle2)\"\nproof((rule ext)+; goal_cases)\n  case (1 s q)\n  then show ?case by (cases s; cases q) (auto simp add: spmf.map_comp apfst_def o_def split_def map_prod_def)\nqed\n\nlemma map_sum_parallel_oracle: includes lifting_syntax shows\n  \"(id ---> map_sum f g ---> map_spmf (map_prod (map_sum h k) id)) (parallel_oracle oracle1 oracle2)\n  = parallel_oracle ((id ---> f ---> map_spmf (map_prod h id)) oracle1) ((id ---> g ---> map_spmf (map_prod k id)) oracle2)\"\nproof((rule ext)+; goal_cases)\n  case (1 s q)\n  then show ?case by (cases s; cases q) (simp_all add: spmf.map_comp o_def apfst_def prod.map_comp)\nqed\n\nlemma map_sum_plus_oracle: includes lifting_syntax shows\n  \"(id ---> map_sum f g ---> map_spmf (map_prod (map_sum h k) id)) (plus_oracle oracle1 oracle2)\n  = plus_oracle ((id ---> f ---> map_spmf (map_prod h id)) oracle1) ((id ---> g ---> map_spmf (map_prod k id)) oracle2)\"\nproof((rule ext)+; goal_cases)\n  case (1 s q)\n  then show ?case by (cases q) (simp_all add: spmf.map_comp o_def apfst_def prod.map_comp)\nqed\n\nlemma map_rsuml_plus_oracle: includes lifting_syntax shows\n  \"(id ---> rsuml ---> (map_spmf (map_prod lsumr id))) (oracle1 \\<oplus>\\<^sub>O (oracle2 \\<oplus>\\<^sub>O oracle3)) =\n   ((oracle1 \\<oplus>\\<^sub>O oracle2) \\<oplus>\\<^sub>O oracle3)\"\nproof((rule ext)+; goal_cases)\n  case (1 s q)\n  then show ?case \n  proof(cases q)\n    case (Inl ql)\n    then show ?thesis by(cases ql)(simp_all add: spmf.map_comp o_def apfst_def prod.map_comp)\n  qed (simp add: spmf.map_comp o_def apfst_def prod.map_comp id_def)\nqed\n\nlemma map_lsumr_plus_oracle: includes lifting_syntax shows\n  \"(id ---> lsumr ---> (map_spmf (map_prod rsuml id))) ((oracle1 \\<oplus>\\<^sub>O oracle2) \\<oplus>\\<^sub>O oracle3) =\n   (oracle1 \\<oplus>\\<^sub>O (oracle2 \\<oplus>\\<^sub>O oracle3))\"\nproof((rule ext)+; goal_cases)\n  case (1 s q)\n  then show ?case \n  proof(cases q)\n    case (Inr qr)\n    then show ?thesis by(cases qr)(simp_all add: spmf.map_comp o_def apfst_def prod.map_comp)\n  qed (simp add: spmf.map_comp o_def apfst_def prod.map_comp id_def)\nqed\n\ncontext includes lifting_syntax begin\n\ndefinition lift_state_oracle\n  :: \"(('s \\<Rightarrow> 'a \\<Rightarrow> (('b \\<times> 't) \\<times> 's) spmf) \\<Rightarrow> ('s' \\<Rightarrow> 'a \\<Rightarrow> (('b \\<times> 't) \\<times> 's') spmf)) \n  \\<Rightarrow> ('t \\<times> 's \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 't \\<times> 's) spmf) \\<Rightarrow> ('t \\<times> 's' \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 't \\<times> 's') spmf)\" where\n  \"lift_state_oracle F oracle = \n   (\\<lambda>(t, s') a. map_spmf rprodl (F ((Pair t ---> id ---> map_spmf lprodr) oracle) s' a))\"\n\nlemma lift_state_oracle_simps [simp]:\n  \"lift_state_oracle F oracle (t, s') a = map_spmf rprodl (F ((Pair t ---> id ---> map_spmf lprodr) oracle) s' a)\"\n  by(simp add: lift_state_oracle_def)\n\nlemma lift_state_oracle_parametric [transfer_rule]: includes lifting_syntax shows\n  \"(((S ===> A ===> rel_spmf (rel_prod (rel_prod B T) S)) ===> S' ===> A ===> rel_spmf (rel_prod (rel_prod B T) S'))\n  ===> (rel_prod T S ===> A ===> rel_spmf (rel_prod B (rel_prod T S)))\n  ===> rel_prod T S' ===> A ===> rel_spmf (rel_prod B (rel_prod T S')))\n  lift_state_oracle lift_state_oracle\"\n  unfolding lift_state_oracle_def map_fun_def o_def by transfer_prover\n\nlemma lift_state_oracle_extend_state_oracle:\n  includes lifting_syntax\n  assumes \"\\<And>B. Transfer.Rel (((=) ===> (=) ===> rel_spmf (rel_prod B (=))) ===> (=) ===> (=) ===> rel_spmf (rel_prod B (=))) G F\"\n    (* TODO: implement simproc to discharge parametricity assumptions like this one *)\n  shows \"lift_state_oracle F (extend_state_oracle oracle) = extend_state_oracle (G oracle)\"\n  unfolding lift_state_oracle_def extend_state_oracle_def\n  apply(clarsimp simp add: fun_eq_iff map_fun_def o_def spmf.map_comp split_def rprodl_def)\n  subgoal for t s a\n    apply(rule sym)\n    apply(fold spmf_rel_eq)\n    apply(simp add: spmf_rel_map)\n    apply(rule rel_spmf_mono)\n     apply(rule assms[unfolded Rel_def, where B=\"\\<lambda>x (y, z). x = y \\<and> z = t\", THEN rel_funD, THEN rel_funD, THEN rel_funD])\n       apply(auto simp add: rel_fun_def spmf_rel_map intro!: rel_spmf_reflI)\n    done\n  done\n\nlemma lift_state_oracle_compose: \n  \"lift_state_oracle F (lift_state_oracle G oracle) = lift_state_oracle (F \\<circ> G) oracle\"\n  by(simp add: lift_state_oracle_def map_fun_def o_def split_def spmf.map_comp)\n\nlemma lift_state_oracle_id [simp]: \"lift_state_oracle id = id\"\n  by(simp add: fun_eq_iff spmf.map_comp o_def)\n\nlemma rprodl_extend_state_oracle: includes lifting_syntax shows\n  \"(rprodl ---> id ---> map_spmf (map_prod id lprodr)) (extend_state_oracle (extend_state_oracle oracle)) = \n  extend_state_oracle oracle\"\n  by(simp add: fun_eq_iff spmf.map_comp o_def split_def)\n\nend\n\nlemma interaction_bound_map_gpv':\n  assumes \"surj h\"\n  shows \"interaction_bound consider (map_gpv' f g h gpv) = interaction_bound (consider \\<circ> g) gpv\"\nproof(induction arbitrary: gpv rule: parallel_fixp_induct_1_1[OF lattice_partial_function_definition lattice_partial_function_definition interaction_bound.mono interaction_bound.mono interaction_bound_def interaction_bound_def, case_names adm bottom step])\n  case (step interaction_bound' interaction_bound'' gpv)\n  have *: \"IO out c \\<in> set_spmf (the_gpv gpv) \\<Longrightarrow>  x \\<in> UNIV \\<Longrightarrow> interaction_bound'' (c x) \\<le> (\\<Squnion>x. interaction_bound'' (c (h x)))\" for out c x\n    using assms[THEN surjD, of x] by (clarsimp intro!: SUP_upper)\n\n  show ?case \n    by (auto simp add: * step.IH image_comp split: generat.split\n      intro!: SUP_cong [OF refl] antisym SUP_upper SUP_least)\nqed simp_all\n\nlemma interaction_any_bounded_by_map_gpv':\n  assumes \"interaction_any_bounded_by gpv n\"\n    and \"surj h\"\n  shows \"interaction_any_bounded_by (map_gpv' f g h gpv) n\"\n  using assms by(simp add: interaction_bounded_by.simps interaction_bound_map_gpv' o_def)\n\nlemma results'_gpv_map_gpv':\n  assumes \"surj h\"\n  shows \"results'_gpv (map_gpv' f g h gpv) = f ` results'_gpv gpv\" (is \"?lhs = ?rhs\")\nproof -\n  have *:\"IO z c \\<in> set_spmf (the_gpv gpv) \\<Longrightarrow> x \\<in> results'_gpv (c input) \\<Longrightarrow>\n     f x \\<in> results'_gpv (map_gpv' f g h (c input)) \\<Longrightarrow> f x \\<in> results'_gpv (map_gpv' f g h gpv)\" for x z gpv c input\n    using surjD[OF assms, of input] by(fastforce intro: results'_gpvI elim!: generat.set_cases intro: rev_image_eqI simp add: map_fun_def o_def)\n\n  show ?thesis \n  proof(intro Set.set_eqI iffI; (elim imageE; hypsubst)?)\n    show \"x \\<in> ?rhs\" if \"x \\<in> ?lhs\" for x using that\n      by(induction gpv'\\<equiv>\"map_gpv' f g h gpv\" arbitrary: gpv)(fastforce elim!: generat.set_cases intro: results'_gpvI)+\n    show \"f x \\<in> ?lhs\" if \"x \\<in> results'_gpv gpv\" for x using that\n      by induction (fastforce intro: results'_gpvI elim!: generat.set_cases intro: rev_image_eqI simp add: map_fun_def o_def\n          , clarsimp simp add: *  elim!: generat.set_cases)\n  qed\nqed\n\ncontext fixes B :: \"'b \\<Rightarrow> 'c set\" and x :: 'a begin\n\nprimcorec mk_lossless_gpv :: \"('a, 'b, 'c) gpv \\<Rightarrow> ('a, 'b, 'c) gpv\" where\n  \"the_gpv (mk_lossless_gpv gpv) =\n   map_spmf (\\<lambda>generat. case generat of Pure x \\<Rightarrow> Pure x \n      | IO out c \\<Rightarrow> IO out (\\<lambda>input. if input \\<in> B out then mk_lossless_gpv (c input) else Done x))\n    (the_gpv gpv)\"\n\nend\n\nlemma WT_gpv_outs_gpvI:\n  assumes \"outs_gpv \\<I> gpv \\<subseteq> outs_\\<I> \\<I>\"\n  shows \"\\<I> \\<turnstile>g gpv \\<surd>\"\n  using assms by(coinduction arbitrary: gpv)(auto intro: outs_gpv.intros)\n\nlemma WT_gpv_iff_outs_gpv:\n  \"\\<I> \\<turnstile>g gpv \\<surd> \\<longleftrightarrow> outs_gpv \\<I> gpv \\<subseteq> outs_\\<I> \\<I>\"\n  by(blast intro: WT_gpv_outs_gpvI dest: WT_gpv_outs_gpv)\n\nlemma WT_gpv_mk_lossless_gpv:\n  assumes \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and outs: \"outs_\\<I> \\<I>' = outs_\\<I> \\<I>\"\n  shows \"\\<I>' \\<turnstile>g mk_lossless_gpv (responses_\\<I> \\<I>) x gpv \\<surd>\"\n  using assms(1)\n  by(coinduction arbitrary: gpv)(auto 4 3 split: generat.split_asm simp add: outs dest: WT_gpvD)\n\nlemma expectation_gpv_mk_lossless_gpv:\n  fixes \\<I> y\n  defines \"rhs \\<equiv> expectation_gpv 0 \\<I> (\\<lambda>_. y)\"\n  assumes WT: \"\\<I>' \\<turnstile>g gpv \\<surd>\"\n    and outs: \"outs_\\<I> \\<I> = outs_\\<I> \\<I>'\"\n  shows \"expectation_gpv 0 \\<I>' (\\<lambda>_. y) gpv \\<le> rhs (mk_lossless_gpv (responses_\\<I> \\<I>') x gpv)\"\n  using WT\nproof(induction arbitrary: gpv rule: expectation_gpv_fixp_induct)\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case step [unfolded rhs_def]: (step expectation_gpv')\n  show ?case using step.prems outs unfolding rhs_def\n    apply(subst expectation_gpv.simps)\n    apply(clarsimp intro!: nn_integral_mono_AE INF_mono split!: generat.split if_split)\n    subgoal\n      by(frule (1) WT_gpv_OutD)(auto simp add: in_outs_\\<I>_iff_responses_\\<I> intro!: bexI step.IH[unfolded rhs_def] dest: WT_gpv_ContD)\n    apply(frule (1) WT_gpv_OutD; clarsimp simp add: in_outs_\\<I>_iff_responses_\\<I> ex_in_conv[symmetric])\n    subgoal for out c input input'\n      using step.hyps[of \"c input'\"] expectation_gpv_const_le[of \\<I>' \"c input'\" 0 y]\n      by- (drule (2) WT_gpv_ContD, fastforce intro: rev_bexI simp add: max_def)\n    done\nqed\n\nlemma plossless_gpv_mk_lossless_gpv:\n  assumes \"plossless_gpv \\<I> gpv\"\n    and \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and \"outs_\\<I> \\<I> = outs_\\<I> \\<I>'\"\n  shows \"plossless_gpv \\<I>' (mk_lossless_gpv (responses_\\<I> \\<I>) x gpv)\"\n  using assms expectation_gpv_mk_lossless_gpv[OF assms(2), of \\<I>' 1 x]\n  unfolding pgen_lossless_gpv_def\n  by -(rule antisym[OF expectation_gpv_const_le[THEN order_trans]]; simp add: WT_gpv_mk_lossless_gpv)\n\nlemma (in callee_invariant_on) exec_gpv_mk_lossless_gpv:\n  assumes \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and \"I s\"\n  shows \"exec_gpv callee (mk_lossless_gpv (responses_\\<I> \\<I>) x gpv) s = exec_gpv callee gpv s\"\n  using assms\nproof(induction arbitrary: gpv s rule: exec_gpv_fixp_induct)\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step exec_gpv')\n  show ?case using step.prems WT_gpv_OutD[OF step.prems(1)]\n    by(clarsimp simp add: bind_map_spmf intro!: bind_spmf_cong[OF refl] split!: generat.split if_split)\n      (force intro!: step.IH dest: WT_callee[THEN WT_calleeD] WT_gpv_OutD callee_invariant WT_gpv_ContD)+\nqed\n\nlemma in_results_gpv_restrict_gpvD:\n  assumes \"x \\<in> results_gpv \\<I> (restrict_gpv \\<I>' gpv)\"\n  shows \"x \\<in> results_gpv \\<I> gpv\"\n  using assms\n  apply(induction gpv'\\<equiv>\"restrict_gpv \\<I>' gpv\" arbitrary: gpv)\n   apply(clarsimp split: option.split_asm simp add: in_set_spmf[symmetric])\n  subgoal for \\<dots> y by(cases y)(auto intro: results_gpv.intros split: if_split_asm)\n  apply(clarsimp split: option.split_asm simp add: in_set_spmf[symmetric])\n  subgoal for \\<dots> y by(cases y)(auto intro: results_gpv.intros split: if_split_asm)\n  done\n\nlemma results_gpv_restrict_gpv:\n  \"results_gpv \\<I> (restrict_gpv \\<I>' gpv) \\<subseteq> results_gpv \\<I> gpv\"\n  by(blast intro: in_results_gpv_restrict_gpvD)\n\nlemma in_results'_gpv_restrict_gpvD:\n  \"x \\<in> results'_gpv (restrict_gpv \\<I>' gpv) \\<Longrightarrow> x \\<in> results'_gpv gpv\"\n  by(rule in_results_gpv_restrict_gpvD[where \\<I> = \"\\<I>_full\", unfolded results_gpv_\\<I>_full])\n\nlemma expectation_gpv_map_gpv' [simp]:\n  \"expectation_gpv fail \\<I> f (map_gpv' g h k gpv) =\n   expectation_gpv fail (map_\\<I> h k \\<I>) (f \\<circ> g) gpv\"\nproof(induction arbitrary: gpv rule: parallel_fixp_induct_1_1[OF complete_lattice_partial_function_definitions complete_lattice_partial_function_definitions expectation_gpv.mono expectation_gpv.mono expectation_gpv_def expectation_gpv_def, case_names adm bottom step])\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step exp1 exp2)\n  have \"pmf (the_gpv (map_gpv' g h k gpv)) None = pmf (the_gpv gpv) None\"\n    by(simp add: pmf_map_spmf_None)\n  then show ?case \n    by simp\n      (auto simp add: nn_integral_measure_spmf step.IH image_comp\n        split: generat.split intro!: nn_integral_cong)\nqed\n\nlemma plossless_gpv_map_gpv' [simp]:\n  \"pgen_lossless_gpv b \\<I> (map_gpv' f g h gpv) \\<longleftrightarrow> pgen_lossless_gpv b (map_\\<I> g h \\<I>) gpv\"\n  unfolding pgen_lossless_gpv_def by(simp add: o_def)\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Constructive_Cryptography/More_CryptHOL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.6619228625116081, "lm_q1q2_score": 0.34388304056234414}}
{"text": "\\<^marker>\\<open>creator \"Kevin Kappelmann\"\\<close>\nparagraph \\<open>Order Equivalence\\<close>\ntheory Transport_Compositions_Generic_Order_Equivalence\n  imports\n    HOL_Basics.Galois_Equivalences\n    Transport_Compositions_Generic_Monotone\nbegin\n\ncontext transport_comp\nbegin\n\ncontext\nbegin\n\ninterpretation flip : transport_comp R2 L2 r2 l2 R1 L1 r1 l1  .\n\nsubparagraph \\<open>Unit\\<close>\ntext \\<open>Inflationary\\<close>\n\nlemma inflationary_on_in_dom_unitI:\n  assumes \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and inflationary_unit1: \"inflationary_on (in_dom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and inflationary_counit1: \"inflationary_on (in_codom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>) \\<epsilon>\\<^sub>1\"\n  and refl_R1: \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and inflationary_unit2: \"inflationary_on (in_dom (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and refl_L2: \"reflexive_on (in_dom (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and mono_in_dom_l1: \"([in_dom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_dom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n  and in_codom_rel_comp_le: \"in_codom ((\\<le>\\<^bsub>L2\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>R1\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>L2\\<^esub>)) \\<le> in_codom ((\\<le>\\<^bsub>R1\\<^esub>))\"\n  shows \"inflationary_on (in_dom (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\nproof (rule inflationary_onI)\n  fix x assume \"in_dom (\\<le>\\<^bsub>L\\<^esub>) x\"\n  show \"x \\<le>\\<^bsub>L\\<^esub> \\<eta> x\"\n  proof (rule left_relI)\n    from \\<open>in_dom (\\<le>\\<^bsub>L\\<^esub>) x\\<close> \\<open>((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\\<close> have \"in_dom (\\<le>\\<^bsub>R1\\<^esub>) (l1 x)\" by blast\n    with refl_R1 have \"l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\" by blast\n    moreover from \\<open>in_dom (\\<le>\\<^bsub>L\\<^esub>) x\\<close> have \"in_dom (\\<le>\\<^bsub>L1\\<^esub>) x\" by blast\n    moreover note inflationary_unit1\n    ultimately show \"x \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x\" by (intro t1.GaloisI) auto\n    from \\<open>in_dom (\\<le>\\<^bsub>L\\<^esub>) x\\<close> mono_in_dom_l1 have \"in_dom (\\<le>\\<^bsub>L2\\<^esub>) (l1 x)\" by blast\n    with inflationary_unit2 show \"l1 x \\<le>\\<^bsub>L2\\<^esub> r2 (l x)\" by auto\n    show \"r2 (l x) \\<^bsub>R1\\<^esub>\\<lessapprox> \\<eta> x\"\n    proof (rule flip.t2.GaloisI)\n      from refl_L2 \\<open>in_dom (\\<le>\\<^bsub>L2\\<^esub>) (l1 x)\\<close> have \"l1 x \\<le>\\<^bsub>L2\\<^esub> l1 x\" by blast\n      with in_codom_rel_comp_le \\<open>l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\\<close> \\<open>l1 x \\<le>\\<^bsub>L2\\<^esub> r2 (l x)\\<close>\n        have \"in_codom (\\<le>\\<^bsub>R1\\<^esub>) (r2 (l x))\" by blast\n      with \\<open>((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\\<close> show \"in_codom (\\<le>\\<^bsub>L1\\<^esub>) (\\<eta> x)\"\n        by (auto intro: in_codom_if_rel_if_dep_mono_wrt_rel)\n      from \\<open>in_codom (\\<le>\\<^bsub>R1\\<^esub>) (r2 (l x))\\<close> inflationary_counit1\n        show \"r2 (l x) \\<le>\\<^bsub>R1\\<^esub> l1 (\\<eta> x)\" by auto\n    qed\n  qed\nqed\n\nlemma inflationary_on_in_codom_unitI:\n  assumes \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and inflationary_unit1: \"inflationary_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and inflationary_counit1: \"inflationary_on (in_codom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>) \\<epsilon>\\<^sub>1\"\n  and refl_R1: \"reflexive_on (in_codom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and inflationary_unit2: \"inflationary_on (in_codom (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and refl_L2: \"reflexive_on (in_codom (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and mono_in_codom_l1: \"([in_codom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_codom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n  and in_codom_rel_comp_le: \"in_codom ((\\<le>\\<^bsub>L2\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>R1\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>L2\\<^esub>)) \\<le> in_codom ((\\<le>\\<^bsub>R1\\<^esub>))\"\n  shows \"inflationary_on (in_codom (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\nproof (rule inflationary_onI)\n  fix x assume \"in_codom (\\<le>\\<^bsub>L\\<^esub>) x\"\n  show \"x \\<le>\\<^bsub>L\\<^esub> \\<eta> x\"\n  proof (rule left_relI)\n    from \\<open>in_codom (\\<le>\\<^bsub>L\\<^esub>) x\\<close> have \"in_codom (\\<le>\\<^bsub>L1\\<^esub>) x\" \"in_codom (\\<le>\\<^bsub>R1\\<^esub>) (l1 x)\" by blast+\n    with inflationary_unit1 show \"x \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x\" by (intro t1.GaloisI) auto\n    from mono_in_codom_l1 \\<open>in_codom (\\<le>\\<^bsub>L\\<^esub>) x\\<close> have \"in_codom (\\<le>\\<^bsub>L2\\<^esub>) (l1 x)\" by blast\n    with inflationary_unit2 show \"l1 x \\<le>\\<^bsub>L2\\<^esub> r2 (l x)\" by auto\n    show \"r2 (l x) \\<^bsub>R1\\<^esub>\\<lessapprox> \\<eta> x\"\n    proof (rule flip.t2.GaloisI)\n      from refl_L2 \\<open>in_codom (\\<le>\\<^bsub>L2\\<^esub>) (l1 x)\\<close> have \"l1 x \\<le>\\<^bsub>L2\\<^esub> l1 x\" by blast\n      moreover from refl_R1 \\<open>in_codom (\\<le>\\<^bsub>R1\\<^esub>) (l1 x)\\<close> have \"l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\" by blast\n      moreover note in_codom_rel_comp_le \\<open>l1 x \\<le>\\<^bsub>L2\\<^esub> r2 (l x)\\<close>\n      ultimately have \"in_codom (\\<le>\\<^bsub>R1\\<^esub>) (r2 (l x))\" by blast\n      with \\<open>((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\\<close> show \"in_codom (\\<le>\\<^bsub>L1\\<^esub>) (\\<eta> x)\"\n        by (auto intro: in_codom_if_rel_if_dep_mono_wrt_rel)\n      from \\<open>in_codom (\\<le>\\<^bsub>R1\\<^esub>) (r2 (l x))\\<close> inflationary_counit1\n        show \"r2 (l x) \\<le>\\<^bsub>R1\\<^esub> l1 (\\<eta> x)\" by auto\n    qed\n  qed\nqed\n\ncorollary inflationary_on_in_field_unitI:\n  assumes \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"inflationary_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and \"inflationary_on (in_codom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>) \\<epsilon>\\<^sub>1\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"inflationary_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"([in_dom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_dom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n  and \"([in_codom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_codom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n  and \"in_codom ((\\<le>\\<^bsub>L2\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>R1\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>L2\\<^esub>)) \\<le> in_codom ((\\<le>\\<^bsub>R1\\<^esub>))\"\n  shows \"inflationary_on (in_field (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\nproof -\n  from assms have \"inflationary_on (in_dom (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\n    by (intro inflationary_on_in_dom_unitI)\n    (auto intro: inflationary_on_if_le_pred_if_inflationary_on\n      reflexive_on_if_le_pred_if_reflexive_on in_field_if_in_dom)\n  moreover from assms have \"inflationary_on (in_codom (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\n    by (intro inflationary_on_in_codom_unitI)\n    (auto intro: inflationary_on_if_le_pred_if_inflationary_on\n      reflexive_on_if_le_pred_if_reflexive_on in_field_if_in_codom)\n  ultimately show ?thesis by (auto iff: in_field_iff_in_dom_or_in_codom)\nqed\n\n\ntext \\<open>Deflationary\\<close>\n\nlemma deflationary_on_in_dom_unitI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\" \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and refl_L1: \"reflexive_on (in_dom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and in_dom_R1_le_in_codom_R1: \"in_dom (\\<le>\\<^bsub>R1\\<^esub>) \\<le> in_codom (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and deflationary_L2: \"deflationary_on (in_dom (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and refl_L2: \"reflexive_on (in_dom (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and mono_in_dom_l1: \"([in_dom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_dom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n  and in_dom_rel_comp_le: \"in_dom ((\\<le>\\<^bsub>L2\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>R1\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>L2\\<^esub>)) \\<le> in_dom ((\\<le>\\<^bsub>R1\\<^esub>))\"\n  shows \"deflationary_on (in_dom (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\nproof (rule deflationary_onI)\n  fix x assume \"in_dom (\\<le>\\<^bsub>L\\<^esub>) x\"\n  show \"\\<eta> x \\<le>\\<^bsub>L\\<^esub> x\"\n  proof (rule left_relI)\n    from refl_L1 \\<open>in_dom (\\<le>\\<^bsub>L\\<^esub>) x\\<close> have \"x \\<le>\\<^bsub>L1\\<^esub> x\" by blast\n    moreover with \\<open>((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\\<close> have \"l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\" by blast\n    ultimately show \"l1 x \\<^bsub>R1\\<^esub>\\<lessapprox> x\" by auto\n    from mono_in_dom_l1 \\<open>in_dom (\\<le>\\<^bsub>L\\<^esub>) x\\<close> have \"in_dom (\\<le>\\<^bsub>L2\\<^esub>) (l1 x)\" by blast\n    with deflationary_L2 show \"r2 (l x) \\<le>\\<^bsub>L2\\<^esub> l1 x\" by auto\n    show \"\\<eta> x \\<^bsub>L1\\<^esub>\\<lessapprox> r2 (l x)\"\n    proof (rule t1.GaloisI)\n      from refl_L2 \\<open>in_dom (\\<le>\\<^bsub>L2\\<^esub>) (l1 x)\\<close> have \"l1 x \\<le>\\<^bsub>L2\\<^esub> l1 x\" by blast\n      with in_dom_rel_comp_le \\<open>r2 (l x) \\<le>\\<^bsub>L2\\<^esub> l1 x\\<close> \\<open>l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\\<close>\n        have \"in_dom (\\<le>\\<^bsub>R1\\<^esub>) (r2 (l x))\" by blast\n      with \\<open>((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\\<close> have \"in_dom (\\<le>\\<^bsub>L1\\<^esub>) (\\<eta> x)\"\n        by (auto intro: in_dom_if_rel_if_dep_mono_wrt_rel)\n      with refl_L1 show \"\\<eta> x \\<le>\\<^bsub>L1\\<^esub> r1 (r2 (l x))\"\n        by (auto intro: in_field_if_in_codom)\n      from \\<open>in_dom (\\<le>\\<^bsub>R1\\<^esub>) (r2 (l x))\\<close> in_dom_R1_le_in_codom_R1\n        show \"in_codom (\\<le>\\<^bsub>R1\\<^esub>) (r2 (l x))\" by blast\n    qed\n  qed\nqed\n\nlemma deflationary_on_in_codom_unitI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\" \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and refl_L1: \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and in_dom_R1_le_in_codom_R1: \"in_dom (\\<le>\\<^bsub>R1\\<^esub>) \\<le> in_codom (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and deflationary_L2: \"deflationary_on (in_codom (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and refl_L2: \"reflexive_on (in_codom (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and mono_in_codom_l1: \"([in_codom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_codom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n  and in_dom_rel_comp_le: \"in_dom ((\\<le>\\<^bsub>L2\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>R1\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>L2\\<^esub>)) \\<le> in_dom ((\\<le>\\<^bsub>R1\\<^esub>))\"\n  shows \"deflationary_on (in_codom (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\nproof (rule deflationary_onI)\n  fix x assume \"in_codom (\\<le>\\<^bsub>L\\<^esub>) x\"\n  show \"\\<eta> x \\<le>\\<^bsub>L\\<^esub> x\"\n  proof (rule left_relI)\n    from refl_L1 \\<open>in_codom (\\<le>\\<^bsub>L\\<^esub>) x\\<close> have \"x \\<le>\\<^bsub>L1\\<^esub> x\" by blast\n    moreover with \\<open>((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\\<close> have \"l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\" by blast\n    ultimately show \"l1 x \\<^bsub>R1\\<^esub>\\<lessapprox> x\" by auto\n    from mono_in_codom_l1 \\<open>in_codom (\\<le>\\<^bsub>L\\<^esub>) x\\<close> have \"in_codom (\\<le>\\<^bsub>L2\\<^esub>) (l1 x)\" by blast\n    with deflationary_L2 show \"r2 (l x) \\<le>\\<^bsub>L2\\<^esub> l1 x\" by auto\n    show \"\\<eta> x \\<^bsub>L1\\<^esub>\\<lessapprox> r2 (l x)\"\n    proof (rule t1.GaloisI)\n      from refl_L2 \\<open>in_codom (\\<le>\\<^bsub>L2\\<^esub>) (l1 x)\\<close> have \"l1 x \\<le>\\<^bsub>L2\\<^esub> l1 x\" by blast\n      with in_dom_rel_comp_le \\<open>r2 (l x) \\<le>\\<^bsub>L2\\<^esub> l1 x\\<close> \\<open>l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\\<close>\n        have \"in_dom (\\<le>\\<^bsub>R1\\<^esub>) (r2 (l x))\" by blast\n      with in_dom_R1_le_in_codom_R1 show \"in_codom (\\<le>\\<^bsub>R1\\<^esub>) (r2 (l x))\" by blast\n      with \\<open>((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\\<close> have \"in_codom (\\<le>\\<^bsub>L1\\<^esub>) (\\<eta> x)\"\n        by (auto intro: in_codom_if_rel_if_dep_mono_wrt_rel)\n      with refl_L1 show \"\\<eta> x \\<le>\\<^bsub>L1\\<^esub> r1 (r2 (l x))\" by auto\n    qed\n  qed\nqed\n\ncorollary deflationary_on_in_field_unitI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\" \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"in_dom (\\<le>\\<^bsub>R1\\<^esub>) \\<le> in_codom (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"deflationary_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"([in_dom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_dom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n  and \"([in_codom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_codom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n  and \"in_dom ((\\<le>\\<^bsub>L2\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>R1\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>L2\\<^esub>)) \\<le> in_dom ((\\<le>\\<^bsub>R1\\<^esub>))\"\n  shows \"deflationary_on (in_field (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\nproof -\n  from assms have \"deflationary_on (in_dom (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\n    by (intro deflationary_on_in_dom_unitI)\n    (auto intro: deflationary_on_if_le_pred_if_deflationary_on\n      reflexive_on_if_le_pred_if_reflexive_on in_field_if_in_dom)\n  moreover from assms have \"deflationary_on (in_codom (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\n    by (intro deflationary_on_in_codom_unitI)\n    (auto intro: deflationary_on_if_le_pred_if_deflationary_on\n      reflexive_on_if_le_pred_if_reflexive_on in_field_if_in_codom)\n  ultimately show ?thesis by (auto iff: in_field_iff_in_dom_or_in_codom)\nqed\n\n\ntext \\<open>Relational Equivalence\\<close>\n\ncorollary rel_equivalence_on_in_field_unitI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\" \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"inflationary_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and \"inflationary_on (in_codom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>) \\<epsilon>\\<^sub>1\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"([in_dom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_dom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n  and \"([in_codom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_codom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n  and \"in_dom ((\\<le>\\<^bsub>L2\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>R1\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>L2\\<^esub>)) \\<le> in_dom ((\\<le>\\<^bsub>R1\\<^esub>))\"\n  and \"in_codom ((\\<le>\\<^bsub>L2\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>R1\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>L2\\<^esub>)) \\<le> in_codom ((\\<le>\\<^bsub>R1\\<^esub>))\"\n  shows \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\n  using assms by (intro rel_equivalence_onI\n    inflationary_on_in_field_unitI deflationary_on_in_field_unitI)\n  (auto simp only: in_codom_eq_in_dom_if_reflexive_on_in_field)\n\n\nsubparagraph \\<open>Counit\\<close>\n\ntext \\<open>Corresponding lemmas for the counit can be obtained by flipping the\ninterpretation of the locale, i.e.\n\\<open>\ninterpretation flip : transport_comp R2 L2 r2 l2 R1 L1 r1 l1\n  rewrites \"flip.t2.unit \\<equiv> \\<epsilon>\\<^sub>1\" and \"flip.t2.counit \\<equiv> \\<eta>\\<^sub>1\"\n  and \"flip.t1.unit \\<equiv> \\<epsilon>\\<^sub>2\" and \"flip.t1.counit \\<equiv> \\<eta>\\<^sub>2\"\n  and \"flip.unit \\<equiv> \\<epsilon>\" and \"flip.counit \\<equiv> \\<eta>\"\n  unfolding transport_comp.transport_defs\n  by (auto simp: order_functors.flip_counit_eq_unit)\n\\<close>\n\\<close>\n\nend\n\n\ntext \\<open>Order Equivalence\\<close>\n\ninterpretation flip : transport_comp R2 L2 r2 l2 R1 L1 r1 l1\n  rewrites \"flip.t2.unit \\<equiv> \\<epsilon>\\<^sub>1\" and \"flip.t2.counit \\<equiv> \\<eta>\\<^sub>1\"\n  and \"flip.t1.unit \\<equiv> \\<epsilon>\\<^sub>2\" and \"flip.t1.counit \\<equiv> \\<eta>\\<^sub>2\"\n  and \"flip.counit \\<equiv> \\<eta>\" and \"flip.unit \\<equiv> \\<epsilon>\"\n  by (simp_all only: order_functors.flip_counit_eq_unit)\n\nlemma order_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\" \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"inflationary_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and rel_equiv_counit1: \"rel_equivalence_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>) \\<epsilon>\\<^sub>1\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>R2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2\\<^esub>)) r2\" \"((\\<le>\\<^bsub>L2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2\\<^esub>)) l2\"\n  and \"((\\<le>\\<^bsub>R2\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>L2\\<^esub>)) r2 l2\"\n  and rel_equiv_unit2: \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and \"inflationary_on (in_field (\\<le>\\<^bsub>R2\\<^esub>)) (\\<le>\\<^bsub>R2\\<^esub>) \\<epsilon>\\<^sub>2\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R2\\<^esub>)) (\\<le>\\<^bsub>R2\\<^esub>)\"\n  and middle_compatible: \"middle_compatible_codom\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R\\<^esub>)) l r\"\nproof (rule order_equivalenceI)\n  show \"((\\<le>\\<^bsub>L\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R\\<^esub>)) l\" using rel_equiv_unit2 \\<open>((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\\<close>\n      \\<open>((\\<le>\\<^bsub>L2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2\\<^esub>)) l2\\<close> middle_compatible\n    by (intro mono_wrt_rel_leftI) auto\n  show \"((\\<le>\\<^bsub>R\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L\\<^esub>)) r\" using rel_equiv_counit1 \\<open>((\\<le>\\<^bsub>R2\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>L2\\<^esub>)) r2 l2\\<close>\n      \\<open>((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\\<close> middle_compatible\n    by (intro flip.mono_wrt_rel_leftI)\n    (auto intro: inflationary_on_if_le_pred_if_inflationary_on\n      in_field_if_in_codom)\n  from middle_compatible have in_dom_rel_comp_les:\n    \"in_dom ((\\<le>\\<^bsub>R1\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>L2\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>R1\\<^esub>)) \\<le> in_dom (\\<le>\\<^bsub>L2\\<^esub>)\"\n    \"in_dom ((\\<le>\\<^bsub>L2\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>R1\\<^esub>) \\<circ>\\<circ> (\\<le>\\<^bsub>L2\\<^esub>)) \\<le> in_dom ((\\<le>\\<^bsub>R1\\<^esub>))\"\n    by (auto intro: in_dom_right1_left2_right1_le_if_right1_left2_right1_le\n      flip.in_dom_right1_left2_right1_le_if_right1_left2_right1_le)\n  moreover then have \"([in_dom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_dom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n    and \"([in_codom (\\<le>\\<^bsub>L\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_codom (\\<le>\\<^bsub>L2\\<^esub>)) l1\"\n    using \\<open>((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\\<close> middle_compatible\n    by (auto intro: mono_in_dom_left_rel_left1_if_in_dom_rel_comp_le\n      mono_in_codom_left_rel_left1_if_in_codom_rel_comp_le)\n  ultimately show \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\n    using assms by (intro rel_equivalence_on_in_field_unitI)\n    (auto intro: inflationary_on_if_le_pred_if_inflationary_on\n      intro!: in_field_if_in_codom)\n  note in_dom_rel_comp_les\n  moreover then have \"([in_dom (\\<le>\\<^bsub>R\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_dom (\\<le>\\<^bsub>R1\\<^esub>)) r2\"\n    and \"([in_codom (\\<le>\\<^bsub>R\\<^esub>)] \\<Rrightarrow>\\<^sub>m in_codom (\\<le>\\<^bsub>R1\\<^esub>)) r2\"\n    using \\<open>((\\<le>\\<^bsub>R2\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>L2\\<^esub>)) r2 l2\\<close> middle_compatible\n    by (auto intro!: flip.mono_in_dom_left_rel_left1_if_in_dom_rel_comp_le\n      flip.mono_in_codom_left_rel_left1_if_in_codom_rel_comp_le)\n  ultimately show \"rel_equivalence_on (in_field (\\<le>\\<^bsub>R\\<^esub>)) (\\<le>\\<^bsub>R\\<^esub>) \\<epsilon>\"\n    using assms by (intro flip.rel_equivalence_on_in_field_unitI)\n    (auto intro: inflationary_on_if_le_pred_if_inflationary_on\n      intro!: in_field_if_in_codom)\nqed\n\ncorollary order_equivalence_if_order_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"transitive (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"transitive (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R2\\<^esub>)) (\\<le>\\<^bsub>R2\\<^esub>)\"\n  and \"middle_compatible_codom\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro order_equivalenceI) (auto\n    elim!: t1.order_equivalenceE t2.order_equivalenceE rel_equivalence_onE\n    intro!: reflexive_on_in_field_if_transitive_if_rel_equivalence_on\n      t1.half_galois_prop_left_left_right_if_transitive_if_deflationary_on_if_mono_wrt_rel\n      flip.t1.half_galois_prop_left_left_right_if_transitive_if_deflationary_on_if_mono_wrt_rel\n    intro: deflationary_on_if_le_pred_if_deflationary_on in_field_if_in_codom)\n\ncorollary order_equivalence_if_galois_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^sub>G (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<equiv>\\<^sub>G (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R2\\<^esub>)) (\\<le>\\<^bsub>R2\\<^esub>)\"\n  and \"middle_compatible_codom\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro order_equivalenceI)\n  (auto elim!: t1.galois_equivalenceE t2.galois_equivalenceE\n    intro!: t1.inflationary_on_unit_if_reflexive_on_if_galois_equivalence\n      flip.t1.inflationary_on_unit_if_reflexive_on_if_galois_equivalence\n      t2.rel_equivalence_on_unit_if_reflexive_on_if_galois_equivalence\n      flip.t2.rel_equivalence_on_unit_if_reflexive_on_if_galois_equivalence)\n\nend\n\n\nend", "meta": {"author": "kappelmann", "repo": "transport-isabelle", "sha": "b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff", "save_path": "github-repos/isabelle/kappelmann-transport-isabelle", "path": "github-repos/isabelle/kappelmann-transport-isabelle/transport-isabelle-b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff/Transport/Compositions/Generic/Transport_Compositions_Generic_Order_Equivalence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3438551753353145}}
{"text": "theory flash15Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_InvVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_InvAck_1VsInv15:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_InvAck_1_HomeVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_InvAck_2VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Local_GetX_GetXVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2))    ( eqn ( IVar ( Global ''Dir_Pending'') )  ( Const false ))  )    ( eqn ( IVar ( Para ''CacheState'' iInv3) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv15:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv15:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_GetVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_Get ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak1VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put1VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put2VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put3VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_PutVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Local_PutXAcksDoneVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_NakVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Nak_ClearVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Nak_HomeVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_GetX_NakVsInv15:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_GetX_PutXVsInv15:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_Get_Nak2VsInv15:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv15:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                     have allCases:\"formEval  ( eqn ( IVar ( Para ''InvMarked'' iInv3) )  ( Const true ))  s  \\<or>formEval   (neg ( eqn ( IVar ( Para ''InvMarked'' iInv3) )  ( Const true )) )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv3) )  ( Const true ))  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n\n    moreover\n                       {assume c1:\"formEval  (neg ( eqn ( IVar ( Para ''InvMarked'' iInv3) )  ( Const true )) )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately have \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutXVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv3) )  ( Const UNI_PutX ))  )    ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) )   (Const iInv2))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_ReplaceVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ReplaceHomeVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ReplaceHomeShrVldVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ReplaceShrVldVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ShWbVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_WbVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_GetX1VsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_GetX2VsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX1VsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX2VsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX3VsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX4VsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_Get_GetVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_Get_PutVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_PutXVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_ReplaceVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Remote_GetVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_GetXVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_PutXVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_ReplaceVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma StoreVsInv15:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma StoreHomeVsInv15:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash15Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.3437045784511603}}
{"text": "theory ValueOntologyTestLong (** Benzmüller, Fuenmayor & Lomfeld, 2020 **)  \n  imports ValueOntology\nbegin \nlemma \"True\" nitpick[satisfy,show_all,card i=10] oops\nlemma \"\\<lfloor>INCONS\\<^sup>p\\<rfloor>\" nitpick[satisfy,card i=4] nitpick oops (*contingent*)\n(*ext/int operators satisfy main properties of Galois connections*)\nlemma G:      \"B \\<^bold>\\<sqsubseteq> A\\<up> \\<longleftrightarrow> A \\<^bold>\\<sqsubseteq> B\\<down>\" by blast\nlemma G1:     \"A \\<^bold>\\<sqsubseteq> A\\<up>\\<down>\" by simp\nlemma G2:     \"B \\<^bold>\\<sqsubseteq> B\\<down>\\<up>\" by simp\nlemma G3:     \"A\\<^sub>1 \\<^bold>\\<sqsubseteq> A\\<^sub>2 \\<longrightarrow> A\\<^sub>2\\<up> \\<^bold>\\<sqsubseteq> A\\<^sub>1\\<up>\" by simp\nlemma G4:     \"B\\<^sub>1 \\<^bold>\\<sqsubseteq> B\\<^sub>2 \\<longrightarrow> B\\<^sub>2\\<down> \\<^bold>\\<sqsubseteq> B\\<^sub>1\\<down>\" by simp\nlemma cl1:    \"A\\<up> = A\\<up>\\<down>\\<up>\" by blast\nlemma cl2:    \"B\\<down> = B\\<down>\\<up>\\<down>\" by blast\nlemma dual1a: \"(A\\<^sub>1 \\<^bold>\\<squnion> A\\<^sub>2)\\<up> = (A\\<^sub>1\\<up> \\<^bold>\\<sqinter> A\\<^sub>2\\<up>)\" by blast\nlemma dual1b: \"(B\\<^sub>1 \\<^bold>\\<squnion> B\\<^sub>2)\\<down> = (B\\<^sub>1\\<down> \\<^bold>\\<sqinter> B\\<^sub>2\\<down>)\" by blast\nlemma         \"(A\\<^sub>1 \\<^bold>\\<sqinter> A\\<^sub>2)\\<up> \\<^bold>\\<sqsubseteq> (A\\<^sub>1\\<up> \\<^bold>\\<squnion> A\\<^sub>2\\<up>)\" nitpick oops\nlemma         \"(B\\<^sub>1 \\<^bold>\\<sqinter> B\\<^sub>2)\\<down> \\<^bold>\\<sqsubseteq> (B\\<^sub>1\\<down> \\<^bold>\\<squnion> B\\<^sub>2\\<down>)\" nitpick oops\nlemma dual2a: \"(A\\<^sub>1\\<up> \\<^bold>\\<squnion> A\\<^sub>2\\<up>) \\<^bold>\\<sqsubseteq>  (A\\<^sub>1 \\<^bold>\\<sqinter> A\\<^sub>2)\\<up>\" by blast\nlemma dual2b: \"(B\\<^sub>1\\<down> \\<^bold>\\<squnion> B\\<^sub>2\\<down>) \\<^bold>\\<sqsubseteq>  (B\\<^sub>1 \\<^bold>\\<sqinter> B\\<^sub>2)\\<down>\" by blast\n(*Note: two different but logically equivalent notations*)\nlemma \"[WILL\\<^sup>x] \\<equiv> WILL\\<^sup>x\\<down>\" by simp\nlemma \"[WILL\\<^sup>x\\<oplus>STAB\\<^sup>x] \\<equiv> (WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x)\\<down>\" by simp\n(********* value ontology tests *****************)\nlemma \"\\<lfloor>[RELI\\<^sup>p] \\<^bold>\\<and> [WILL\\<^sup>p] \\<^bold>\\<rightarrow> INCONS\\<^sup>p\\<rfloor>\" by simp \nlemma \"\\<lfloor>INCONS\\<^sup>p \\<^bold>\\<rightarrow> [RELI\\<^sup>p] \\<^bold>\\<and> [WILL\\<^sup>p]\\<rfloor>\" by simp \nlemma \"\\<lfloor>[RELI\\<^sup>p] \\<^bold>\\<and> [WILL\\<^sup>p]\\<rfloor>\" nitpick[satisfy] nitpick oops (*contingent*)\nlemma \"\\<lfloor>[FAIR\\<^sup>d] \\<^bold>\\<and> [EFFI\\<^sup>d]\\<rfloor>\" nitpick[satisfy] nitpick oops (*contingent*)\nlemma \"\\<lfloor>(\\<^bold>\\<not>INCONS\\<^sup>p) \\<^bold>\\<and> [FAIR\\<^sup>d] \\<^bold>\\<and> [EFFI\\<^sup>d]\\<rfloor>\"\n nitpick[satisfy,show_all] nitpick oops (*contingent: p & d independent*)\nlemma \"\\<lfloor>(\\<^bold>\\<not>INCONS\\<^sup>d) \\<^bold>\\<and> (\\<^bold>\\<not>INCONS\\<^sup>p) \\<^bold>\\<and> [RELI\\<^sup>d] \\<^bold>\\<and> [WILL\\<^sup>p]\\<rfloor>\" \n nitpick[satisfy,show_all] nitpick oops (*contingent: p & d independent*)\n(*** more tests ***)\n(*values in two non-opposed quadrants (noq): consistent*)\nlemma \"\\<lfloor>[WILL\\<^sup>x] \\<^bold>\\<and> [STAB\\<^sup>x] \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" nitpick oops (*countermodel found*)\nlemma \"\\<lfloor>[WILL\\<^sup>x] \\<^bold>\\<and> [GAIN\\<^sup>x] \\<^bold>\\<and> [EFFI\\<^sup>x] \\<^bold>\\<and> [STAB\\<^sup>x] \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" nitpick oops\n(*values in two opposed quadrants: inconsistent*)\nlemma \"\\<lfloor>[RESP\\<^sup>x] \\<^bold>\\<and> [STAB\\<^sup>x] \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" by simp\n(*values in three quadrants: inconsistent*)\nlemma \"\\<lfloor>[WILL\\<^sup>x] \\<^bold>\\<and> [EFFI\\<^sup>x] \\<^bold>\\<and> [RELI\\<^sup>x] \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" by simp\n(*values in opposed quadrants for different parties: consistent*)\nlemma \"\\<lfloor>[EQUI\\<^sup>x] \\<^bold>\\<and> [GAIN\\<^sup>y] \\<^bold>\\<rightarrow> (INCONS\\<^sup>x \\<^bold>\\<or> INCONS\\<^sup>y)\\<rfloor>\" nitpick oops (*cntmdl*)\nlemma \"\\<lfloor>[RESP\\<^sup>x] \\<^bold>\\<and> [STAB\\<^sup>y] \\<^bold>\\<rightarrow> (INCONS\\<^sup>x \\<^bold>\\<or> INCONS\\<^sup>y)\\<rfloor>\" nitpick oops (*cntmdl*)\n(*value preferences tests*)\nlemma \"\\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x\\<rfloor>\"\n  nitpick nitpick[satisfy] oops (*contingent*)\nlemma \"\\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v STAB\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x\\<rfloor>\" by blast\nlemma \"\\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v STAB\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v RELI\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x\\<rfloor>\" by blast\nlemma \"\\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v STAB\\<^sup>x\\<rfloor>\"\n  nitpick nitpick[satisfy] oops (*contingent*)\nlemma \"\\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v RELI\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v STAB\\<^sup>x\\<rfloor>\"\n  nitpick nitpick[satisfy] oops (*contingent*)\nlemma \"\\<not>\\<lfloor>WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor>\" using rBR by auto\nlemma \"\\<lfloor>WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor>\" by auto\nlemma \"\\<lfloor>RELI\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor>\" by auto\nlemma \"\\<lfloor>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor>\" \n  nitpick nitpick[satisfy] oops (*contingent*)\nlemma \"\\<lfloor>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>RELI\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor>\" \n  nitpick nitpick[satisfy] oops (*contingent*)\n(*basic properties*)\nlemma \"\\<lfloor>\\<^bold>\\<not>(X \\<^bold>\\<prec>\\<^sub>v X)\\<rfloor>\" using rBR by auto (*irreflexive*)\nlemma \"\\<lfloor>X \\<^bold>\\<prec>\\<^sub>v Y \\<^bold>\\<rightarrow> \\<^bold>\\<not>(Y \\<^bold>\\<prec>\\<^sub>v X)\\<rfloor>\" nitpick oops (*not asymmetric*)\nlemma \"\\<lfloor>(X \\<^bold>\\<prec>\\<^sub>v Y \\<^bold>\\<and> Y \\<^bold>\\<prec>\\<^sub>v Z) \\<^bold>\\<rightarrow> X \\<^bold>\\<prec>\\<^sub>v Z\\<rfloor>\" nitpick oops (*not transitive*)\nend\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/Preference-Logics/vanBenthemEtAl2009/ValueOntologyTestLong.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3437045784511603}}
{"text": "theory Failures_TickTock_BasicOps\n\nimports\n  Failures_TickTock\nbegin\n\nlemma ttproc2F_DivC_eq_DivF:\n  \"ttproc2F div\\<^sub>C = div\\<^sub>F\"\n  unfolding DivTT_def DivF_def ttproc2F_def by auto \n\nlemma ttproc2F_SkipC_SkipUF:\n  \"ttproc2F SKIP\\<^sub>C = Skip\\<^sub>U\\<^sub>F\"\n  unfolding SkipTT_def ttproc2F_def SkipUF_def apply auto\n  by force+\n\nlemma ttproc2F_StopC_eq_StopF:\n  \"ttproc2F STOP\\<^sub>C = Stop\\<^sub>F\"\nproof -\n  text \\<open> Untimed traces \\<close>\n\n  have traces:\"snd Stop\\<^sub>F = snd (ttproc2F STOP\\<^sub>C)\"\n    unfolding StopTT_def ttproc2F_def StopF_def apply auto\n      apply (rule exI[where x=\"[]\"], auto)\n      apply (simp add: tocks.empty_in_tocks)\n    using tocks.cases tt2T.simps(3) tt2T.simps(5) apply blast\n    by (metis append.simps(1) append.simps(2) tocks.simps tt2T.simps(5))\n\n  text \\<open> Untimed failures \\<close>\n  have failures:\"fst Stop\\<^sub>F = fst (ttproc2F STOP\\<^sub>C)\"\n    unfolding StopTT_def ttproc2F_def StopF_def\n  proof (auto)\n    fix b\n    obtain X where X:\"Some ([],b) = tt2F [[X]\\<^sub>R] \\<and> Tock \\<notin> X\"\n      using Some_tt2F_set tt2F_refusal_without_Tock\n      by (metis (no_types, lifting) Diff_iff singletonI tt2F_refusal_without_Tock)\n    then show \"\\<exists>y. Some ([], b) = tt2F y \\<and> (\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. y = s \\<or> (\\<exists>X. y = s @ [[X]\\<^sub>R] \\<and> Tock \\<notin> X))\"\n      using tocks.empty_in_tocks by fastforce\n  next\n    fix a b s\n    assume a1:\"Some (a, b) = tt2F s\"\n      and a2:\"s \\<in> tocks {x. x \\<noteq> Tock}\"\n    show \"a = []\"\n      by (metis a1 a2 option.simps(3) tocks.cases tt2F.simps(3) tt2F.simps(8))\n  next\n    fix a b s X\n    assume a1:\"Some (a, b) = tt2F (s @ [[X]\\<^sub>R])\"\n     and a2:\"s \\<in> tocks {x. x \\<noteq> Tock}\"\n     and a3:\"Tock \\<notin> X\"\n    show \"a = []\"\n      using a1 apply (cases s, auto)\n      by (metis a2 append_Cons list.distinct(1) option.simps(3) tocks.cases tt2F.simps(8))\n  qed\n\n  show ?thesis by (simp add: failures traces prod_eq_iff)\nqed\n\nlemma ttproc2F_PrefixTT_eq_PrefixF:\n  \"ttproc2F (PrefixTT e P) = PrefixF e (ttproc2F P)\"\n  unfolding ttproc2F_def PrefixTT_def PrefixF_def \nproof (auto)\n  fix a b s\n  assume assm1:\"Some (a, b) = tt2F s\"\n    and  assm2:\"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\" \n    and  assm3: \"\\<forall>s. a = evt e # s \\<longrightarrow> (\\<forall>y. Some (s, b) = tt2F y \\<longrightarrow> y \\<notin> P)\"\n  show \"a = []\"\n    using assm1 assm2 by (metis (mono_tags, lifting) option.simps(3) tocks.cases tt2F.simps(3) tt2F.simps(8))\nnext\n  fix a b s\n  assume assm1: \"Some (a, b) = tt2F s\"\n    and  assm2: \"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\" \n    and  assm3: \"\\<forall>s. a = evt e # s \\<longrightarrow> (\\<forall>y. Some (s, b) = tt2F y \\<longrightarrow> y \\<notin> P)\"\n    and  assm4: \"evt e \\<in> b\"\n  show \"False\"\n    using assm1 assm2 assm3 assm4 by (metis (mono_tags, lifting) option.simps(3) tocks.cases tt2F.simps(3) tt2F.simps(8))\nnext\n  fix a b s X\n  assume assm1: \"Some (a, b) = tt2F (s @ [[X]\\<^sub>R])\"\n   and   assm2: \"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\"\n   and   assm3: \"Tock \\<notin> X\" \n   and   assm4: \"Event e \\<notin> X\" \n   and   assm5: \"\\<forall>s. a = evt e # s \\<longrightarrow> (\\<forall>y. Some (s, b) = tt2F y \\<longrightarrow> y \\<notin> P)\"\n  show \"a = []\"\n    using assm1 assm2 by (cases s, auto, metis (mono_tags, lifting) append_Cons list.distinct(1) option.simps(3) tocks.cases tt2F.simps(8))\nnext\n  fix a b s X\n  assume assm1: \"Some (a, b) = tt2F (s @ [[X]\\<^sub>R])\"\n   and   assm2: \"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\"\n   and   assm3: \"Tock \\<notin> X\" \n   and   assm4: \"Event e \\<notin> X\" \n   and   assm5: \"\\<forall>s. a = evt e # s \\<longrightarrow> (\\<forall>y. Some (s, b) = tt2F y \\<longrightarrow> y \\<notin> P)\"\n   and   assm6: \"evt e \\<in> b\"\n  show \"False\"\n    using assm1 assm2 assm3 assm4 assm6 by (cases s, auto, metis (mono_tags, lifting) append_Cons list.distinct(1) option.simps(3) tocks.cases tt2F.simps(8))\nnext\n  fix a b s\n  assume assm1: \"Some (a, b) = tt2F s\"\n   and   assm2: \"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\"\n   and   assm3: \"\\<forall>s. a = evt e # s \\<longrightarrow> (\\<forall>y. Some (s, b) = tt2F y \\<longrightarrow> y \\<notin> P)\"\n  show \"a = []\"\n    using assm1 assm2 by (cases s, auto, metis (mono_tags, lifting) list.distinct(1) option.simps(3) tocks.cases tt2F.simps(8))\nnext\n  fix a b s\n  assume assm1: \"Some (a, b) = tt2F s\"\n   and   assm2: \"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\"\n   and   assm3: \"\\<forall>s. a = evt e # s \\<longrightarrow> (\\<forall>y. Some (s, b) = tt2F y \\<longrightarrow> y \\<notin> P)\"\n   and   assm4: \"evt e \\<in> b\"\n  show \"False\"\n    using assm1 assm2 by (cases s, auto, metis (mono_tags, lifting) list.distinct(1) option.simps(3) tocks.cases tt2F.simps(8))\nnext\n  fix a b s \\<sigma>\n  assume assm1: \"Some (a, b) = tt2F (s @ [Event e]\\<^sub>E # \\<sigma>)\"\n   and   assm2: \"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\"\n   and   assm3: \"\\<sigma> \\<in> P\"\n   and   assm4: \"\\<forall>s. a = evt e # s \\<longrightarrow> (\\<forall>y. Some (s, b) = tt2F y \\<longrightarrow> y \\<notin> P)\"\n  show \"a = []\"\n  proof (cases s)\n    case Nil\n    then have \"Some (a, b) = tt2F ([Event e]\\<^sub>E # \\<sigma>)\"\n      using assm1 by auto\n    then obtain fl where fl:\"Some (fst fl, b) = Some (evt e # fst fl,snd fl)\"\n      apply auto\n      by (smt assm3 assm4 fst_conv not_Some_eq old.prod.exhaust option.inject option.simps(4) option.simps(5) prod.inject snd_conv)\n    then have \"a = evt e # fst fl\"\n      by auto\n    then have \"\\<sigma> \\<notin> P\"\n      using assm4 fl by auto\n    then show ?thesis \n      using assm3 by auto\n  next\n    case (Cons z list)\n    then show ?thesis using assm1 assm2 apply auto\n      by (metis (mono_tags, lifting) append_Cons list.simps(3) option.simps(3) tocks.cases tt2F.simps(8))\n  qed\nnext\n  fix a b s \\<sigma>\n  assume assm1: \"Some (a, b) = tt2F (s @ [Event e]\\<^sub>E # \\<sigma>)\"\n   and   assm2: \"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\"\n   and   assm3: \"\\<sigma> \\<in> P\"\n   and   assm4: \"\\<forall>s. a = evt e # s \\<longrightarrow> (\\<forall>y. Some (s, b) = tt2F y \\<longrightarrow> y \\<notin> P)\"\n   and   assm5: \"evt e \\<in> b\"\n  show \"False\"\n  proof (cases s)\n    case Nil\n    then have \"Some (a, b) = tt2F ([Event e]\\<^sub>E # \\<sigma>)\"\n      using assm1 by auto\n    then obtain fl where fl:\"Some (fst fl, b) = Some (evt e # fst fl,snd fl)\"\n      apply auto\n      by (smt assm3 assm4 fst_conv not_Some_eq old.prod.exhaust option.inject option.simps(4) option.simps(5) prod.inject snd_conv)\n    then have \"a = evt e # fst fl\"\n      by auto\n    then have \"\\<sigma> \\<notin> P\"\n      using assm4 fl by auto\n    then show ?thesis \n      using assm3 by auto\n  next\n    case (Cons z list)\n    then show ?thesis using assm1 assm2 apply auto\n      by (metis (mono_tags, lifting) append_Cons list.simps(3) option.simps(3) tocks.cases tt2F.simps(8))\n  qed\nnext\n  fix b\n  assume assm1:\"evt e \\<notin> b\"\n  obtain X where X:\"Some ([], b) = tt2F [[X]\\<^sub>R]\"\n    using Some_tt2F_set by auto\n  then have \"Event e \\<notin> X\"\n    using assm1 by auto\n  then show \"\\<exists>y. Some ([], b) = tt2F y \\<and>\n             ((\\<exists>s\\<in>tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}. y = s \\<or> (\\<exists>X. Tock \\<notin> X \\<and> Event e \\<notin> X \\<and> y = s @ [[X]\\<^sub>R])) \\<or>\n              (\\<exists>s\\<in>tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}. y = s \\<or> (\\<exists>\\<sigma>\\<in>P. y = s @ [Event e]\\<^sub>E # \\<sigma>)))\"\n    by (metis (no_types) Diff_iff X \\<open>Event e \\<notin> X\\<close> append.left_neutral singletonI tocks.empty_in_tocks tt2F_refusal_without_Tock)\nnext\n  fix b s y\n  assume assm1: \"Some (s, b) = tt2F y\"\n    and  assm2: \"y \\<in> P\"\n  obtain z where z:\"Some (evt e # s, b) = tt2F (z @ [Event e]\\<^sub>E # y) \\<and> z = []\"\n    using assm1\n    by (smt append.left_neutral fst_conv option.simps(5) snd_conv tt2F.simps(2))\n  then have \"\\<exists>y. Some (evt e # s, b) = tt2F y \\<and> (\\<exists>s\\<in>tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}. (\\<exists>\\<sigma>\\<in>P. y = s @ [Event e]\\<^sub>E # \\<sigma>))\"\n    using assm2 tocks.empty_in_tocks by blast\n  then show \"\\<exists>y. Some (evt e # s, b) = tt2F y \\<and>\n           ((\\<exists>s\\<in>tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}. y = s \\<or> (\\<exists>X. Tock \\<notin> X \\<and> Event e \\<notin> X \\<and> y = s @ [[X]\\<^sub>R])) \\<or>\n            (\\<exists>s\\<in>tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}. y = s \\<or> (\\<exists>\\<sigma>\\<in>P. y = s @ [Event e]\\<^sub>E # \\<sigma>)))\"\n    by blast\nnext   \n  fix s\n  assume assm1: \"tt2T s \\<noteq> []\"\n    and  assm2: \"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\"\n  have \"tt2T s = []\"\n    using assm2 tocks.cases tt2T.simps(3) tt2T.simps(5) by blast\n  then have \"False\"   \n    using assm1 by auto\n  then show \"\\<exists>sa. tt2T s = evt e # sa \\<and> (\\<exists>y. sa = tt2T y \\<and> y \\<in> P)\"\n    by auto\nnext\n  fix s X\n  assume assm1:\"tt2T (s @ [[X]\\<^sub>R]) \\<noteq> []\"\n    and  assm2:\"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\"\n    and  assm3:\"Tock \\<notin> X\" \n    and  assm4:\"Event e \\<notin> X\"\n  have \"tt2T s = []\"\n    using assm2 tocks.cases tt2T.simps(3) tt2T.simps(5) by blast\n  then have \"tt2T (s @ [[X]\\<^sub>R]) = []\"\n    by (metis (no_types, lifting) append_Cons append_eq_Cons_conv assm2 tocks.simps tt2T.simps(5))\n  then have \"False\"\n    using assm1 by auto\n  then show \"\\<exists>sa. tt2T (s @ [[X]\\<^sub>R]) = evt e # sa \\<and> (\\<exists>y. sa = tt2T y \\<and> y \\<in> P)\"\n    by auto\nnext\n  fix s\n  assume assm1: \"tt2T s \\<noteq> []\"\n    and  assm2: \"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\"\n  have \"tt2T s = []\"\n    using assm2 tocks.cases tt2T.simps(3) tt2T.simps(5) by blast\n  then have \"False\"   \n    using assm1 by auto\n  then show \"\\<exists>sa. tt2T s = evt e # sa \\<and> (\\<exists>y. sa = tt2T y \\<and> y \\<in> P)\"\n    by auto\nnext\n  fix s \\<sigma>\n  assume assm1:\"tt2T (s @ [Event e]\\<^sub>E # \\<sigma>) \\<noteq> []\"\n   and   assm2:\"s \\<in> tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}\"\n   and   assm3:\"\\<sigma> \\<in> P\"\n  have \"tt2T s = []\"\n    using assm2 tocks.cases tt2T.simps(3) tt2T.simps(5) by blast\n  then have \"tt2T (s @ [Event e]\\<^sub>E # \\<sigma>) = evt e # tt2T \\<sigma>\"\n    by (metis (mono_tags, lifting) append_Cons append_self_conv2 assm1 assm2 mem_Collect_eq tocks_def tocksp.cases tt2T.simps(2) tt2T.simps(5))\n  then show \"\\<exists>sa. tt2T (s @ [Event e]\\<^sub>E # \\<sigma>) = evt e # sa \\<and> (\\<exists>y. sa = tt2T y \\<and> y \\<in> P)\"\n    using assm3 by auto\nnext\n  show \"\\<exists>y. [] = tt2T y \\<and>\n        ((\\<exists>s\\<in>tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}. y = s \\<or> (\\<exists>X. Tock \\<notin> X \\<and> Event e \\<notin> X \\<and> y = s @ [[X]\\<^sub>R])) \\<or>\n         (\\<exists>s\\<in>tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}. y = s \\<or> (\\<exists>\\<sigma>\\<in>P. y = s @ [Event e]\\<^sub>E # \\<sigma>)))\"\n    using tocks.empty_in_tocks by force\nnext\n  fix y\n  assume assm1: \"y \\<in> P\"\n  then show \"\\<exists>ya. evt e # tt2T y = tt2T ya \\<and>\n              ((\\<exists>s\\<in>tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}. ya = s \\<or> (\\<exists>X. Tock \\<notin> X \\<and> Event e \\<notin> X \\<and> ya = s @ [[X]\\<^sub>R])) \\<or>\n               (\\<exists>s\\<in>tocks {x. x \\<noteq> Tock \\<and> x \\<noteq> Event e}. ya = s \\<or> (\\<exists>\\<sigma>\\<in>P. ya = s @ [Event e]\\<^sub>E # \\<sigma>)))\"\n    using tocks.empty_in_tocks by force\nqed\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/Failures/Failures_TickTock_BasicOps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6926419831347362, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.34361541386564337}}
{"text": "(******************************************************************************\n * Orca: A Functional Correctness Verifier for Imperative Programs\n *       Based on Isabelle/UTP\n *\n * Copyright (c) 2016-2018 Virginia Tech, USA\n *               2016-2018 Technische Universität München, Germany\n *               2016-2018 University of York, UK\n *               2016-2018 Université Paris-Saclay, Univ. Paris-Sud, France\n *\n * This software may be distributed and modified according to the terms of\n * the GNU Lesser General Public License version 3.0 or any later version.\n * Note that NO WARRANTY is provided.\n *\n * See CONTRIBUTORS, LICENSE and CITATION files for details.\n ******************************************************************************)\n\nsection \\<open>Verification Condition Testing\\<close>\n\ntheory utp_hoare_rel_total\n  imports \"../PartialCorrectness/utp_hoare\"\nbegin\n  \ndefinition while_invT :: \"'\\<alpha> cond \\<Rightarrow> '\\<alpha> cond \\<Rightarrow> '\\<alpha> hrel \\<Rightarrow> '\\<alpha> hrel\" (\"while\\<^sub>\\<bottom> _ invr _ do _ od\" 71) where\n\"while\\<^sub>\\<bottom> b invr p do S od = while\\<^sub>\\<bottom> b do S od\"  \n\nlemma while_wf_hoare_r:\n  assumes WF: \"wf R\"\n  assumes I0: \"`pre \\<Rightarrow> I`\"\n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> I \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>Q\\<lbrace>I \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>u\"\n  assumes PHI:\"`(\\<not>b \\<and> I) \\<Rightarrow> post`\"  \n  shows \"\\<lbrace>pre\\<rbrace>while\\<^sub>\\<bottom> b invr I do Q od\\<lbrace>post\\<rbrace>\\<^sub>u\"\nunfolding hoare_r_def while_invT_def while_bot_def\nproof (rule pre_weak_rel[of _ \"\\<lceil>I\\<rceil>\\<^sub><\" ])\n  from I0 show \"`\\<lceil>pre\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>I\\<rceil>\\<^sub><`\"\n    by rel_auto\n  show \"(\\<lceil>I\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>post\\<rceil>\\<^sub>>) \\<sqsubseteq> (\\<mu> X \\<bullet> Q ;; X \\<triangleleft> b \\<triangleright>\\<^sub>r II)\"\n  proof (rule rec_total_utp_rule[where E=e, OF WF])\n    show \"mono (\\<lambda>X. Q ;; X \\<triangleleft> b \\<triangleright>\\<^sub>r II)\"\n      by (simp add: cond_mono monoI seqr_mono)\n    have induct_step': \"\\<And> st. (\\<lceil>b \\<and> I \\<and>  e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<rceil>\\<^sub>< \\<Rightarrow> (\\<lceil>I \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright> \\<rceil>\\<^sub>> )) \\<sqsubseteq> Q\"\n      using induct_step by rel_auto  \n    with PHI\n    show \"\\<And>st. (\\<lceil>I\\<rceil>\\<^sub>< \\<and> \\<lceil>e\\<rceil>\\<^sub>< =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> \\<lceil>post\\<rceil>\\<^sub>>) \\<sqsubseteq> Q ;; (\\<lceil>I\\<rceil>\\<^sub>< \\<and> (\\<lceil>e\\<rceil>\\<^sub><, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright> \\<Rightarrow> \\<lceil>post\\<rceil>\\<^sub>>) \\<triangleleft> b \\<triangleright>\\<^sub>r II\" \n      by (rel_auto)\n  qed       \nqed\n\n \nend\n\n", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP-Extended/HoareLogic/TotalCorrectness/utp_hoare_rel_total.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6926419831347361, "lm_q2_score": 0.49609382947091957, "lm_q1q2_score": 0.3436154138656433}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   June 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_T_law\nimports CSP_T_law_SKIP     CSP_T_law_ref\n        CSP_T_law_dist     CSP_T_law_alpha_par\n        CSP_T_law_step     CSP_T_law_rep_par\n        CSP_T_law_fix\n        CSP_T_law_DIV      CSP_T_law_SKIP_DIV\n        CSP_T_law_step_ext CSP_T_law_norm\nbegin\n\n(*-----------------------------------------------------------*\n |                                                           |\n |                 Ext_choice_Int_choice                     |\n |                                                           |\n |  These rules show the difference between models T and F.  |\n |                                                           |\n *-----------------------------------------------------------*)\n\nlemma cspT_Ext_choice_Int_choice:\n  \"P1 [+] P2 =T[M,M] P1 |~| P2\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces)+\ndone\n\nlemma cspT_Ext_pre_choice_Rep_int_choice:\n  \"? :X -> Pf =T[M,M] ! x:X .. x -> Pf x\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\napply (rule, simp add: in_traces)\napply (force)\napply (rule, simp add: in_traces)\napply (force)\ndone\n\nlemmas cspT_Ext_Int = cspT_Ext_choice_Int_choice\n                      cspT_Ext_pre_choice_Rep_int_choice\n\n(*********************************************************\n            SKIP , DIV  and Internal choice\n *********************************************************)\n\n(*** |~| ***)\n\nlemma cspT_SKIP_DIV_Int_choice: \n  \"[| P = SKIP | P = DIV ; Q = SKIP | Q = DIV |] ==>\n   (P |~| Q) =T[M1,M2] (if (P = SKIP | Q = SKIP) then SKIP else DIV)\"\napply (elim disjE)\napply (simp_all)\napply (rule cspT_rw_left)\napply (rule cspT_idem)\napply (rule cspT_reflex)\napply (rule cspT_rw_left)\napply (rule cspT_unit)\napply (rule cspT_reflex)\napply (rule cspT_rw_left)\napply (rule cspT_unit)\napply (rule cspT_reflex)\napply (rule cspT_rw_left)\napply (rule cspT_idem)\napply (rule cspT_reflex)\ndone\n\n(*** !! ***)\n\nlemma cspT_SKIP_DIV_Rep_int_choice_sum: \n  \"[| ALL c: sumset C. (Qf c = SKIP | Qf c = DIV) |] ==>\n   (!! c:C .. Qf c) =T[M1,M2] \n   (if (EX c: sumset C. Qf c = SKIP) then SKIP else DIV)\"\napply (case_tac \" sumset C={}\")\napply (simp add: cspT_Rep_int_choice_empty)\napply (case_tac \"ALL c: sumset C. Qf c = DIV\")\n apply (simp)\n apply (rule cspT_rw_left)\n apply (rule cspT_Rep_int_choice_const)\n apply (simp)\n apply (force)\n apply (simp)\n\n apply (simp)\n apply (elim bexE)\n apply (frule_tac x=\"c\" in bspec)\n apply (simp_all)\n apply (intro conjI impI)\n\n  apply (rule cspT_rw_left)\n  apply (subgoal_tac \n  \"!! :C .. Qf =T[M1,M1]\n   !! :({c:C. Qf c = SKIP}s Uns {c:C. Qf c ~= SKIP}s) .. Qf\")\n  apply (simp (no_asm))\n  apply (rule cspT_decompo)\n   apply (simp)\n   apply (simp)\n\n  apply (rule cspT_rw_left)\n  apply (rule cspT_Rep_int_choice_union_Int)\n  apply (simp)\n\n  apply (rule cspT_rw_left)\n  apply (rule cspT_decompo)\n  apply (rule cspT_Rep_int_choice_const)\n  apply (force)\n  apply (rule ballI)\n  apply (simp)\n  apply (case_tac \" sumset ({c:C. Qf c ~= SKIP}s) ={}\")\n   apply (rule cspT_Rep_int_choice_DIV)\n   apply (simp)\n\n   apply (rule cspT_rw_left)\n   apply (rule cspT_Rep_int_choice_const)\n   apply (simp_all)\n   apply (intro allI impI)\n   apply (subgoal_tac \"Qf ca = DIV\")\n   apply (simp)\n   apply (force)\n   apply (simp)\n\n  apply (rule cspT_rw_left)\n  apply (rule cspT_unit)\n  apply (simp)\ndone\n\nlemma cspT_SKIP_DIV_Rep_int_choice_nat: \n  \"[| ALL n:N. (Qf n = SKIP | Qf n = DIV) |] ==>\n   (!nat n:N .. Qf n) =T[M1,M2] \n   (if (EX n:N. Qf n = SKIP) then SKIP else DIV)\"\napply (unfold Rep_int_choice_ss_def)\napply (rule cspT_rw_left)\napply (rule cspT_SKIP_DIV_Rep_int_choice_sum)\napply (auto)\ndone\n\nlemma cspT_SKIP_DIV_Rep_int_choice_set: \n  \"[| ALL X:Xs. (Qf X = SKIP | Qf X = DIV) |] ==>\n   (!set X:Xs .. Qf X) =T[M1,M2] \n   (if (EX X:Xs. Qf X = SKIP) then SKIP else DIV)\"\napply (unfold Rep_int_choice_ss_def)\napply (rule cspT_rw_left)\napply (rule cspT_SKIP_DIV_Rep_int_choice_sum)\napply (auto)\ndone\n\nlemmas cspT_SKIP_DIV_Rep_int_choice =\n       cspT_SKIP_DIV_Rep_int_choice_sum\n       cspT_SKIP_DIV_Rep_int_choice_nat\n       cspT_SKIP_DIV_Rep_int_choice_set\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/CSP_T_law.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6926419831347361, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.34361541386564326}}
{"text": "(*  Title:      Jinja/Compiler/WellType1.thy\n\n    Author:     Tobias Nipkow\n    Copyright   2003 Technische Universitaet Muenchen\n*)\n\nsection \\<open>Well-Formedness of Intermediate Language\\<close>\n\ntheory J1WellForm\nimports \"../J/JWellForm\" J1\nbegin\n\nsubsection \"Well-Typedness\"\n\ntype_synonym \n  env\\<^sub>1  = \"ty list\"   \\<comment> \\<open>type environment indexed by variable number\\<close>\n\ninductive\n  WT\\<^sub>1 :: \"[J\\<^sub>1_prog,env\\<^sub>1, expr\\<^sub>1     , ty     ] \\<Rightarrow> bool\"\n         (\"(_,_ \\<turnstile>\\<^sub>1/ _ :: _)\"   [51,51,51]50)\n  and WTs\\<^sub>1 :: \"[J\\<^sub>1_prog,env\\<^sub>1, expr\\<^sub>1 list, ty list] \\<Rightarrow> bool\"\n         (\"(_,_ \\<turnstile>\\<^sub>1/ _ [::] _)\" [51,51,51]50)\n  for P :: J\\<^sub>1_prog\nwhere\n  \n  WTNew\\<^sub>1:\n  \"is_class P C  \\<Longrightarrow>\n  P,E \\<turnstile>\\<^sub>1 new C :: Class C\"\n\n| WTCast\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: Class D;  is_class P C;  P \\<turnstile> C \\<preceq>\\<^sup>* D \\<or> P \\<turnstile> D \\<preceq>\\<^sup>* C \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 Cast C e :: Class C\"\n\n| WTVal\\<^sub>1:\n  \"typeof v = Some T \\<Longrightarrow>\n  P,E \\<turnstile>\\<^sub>1 Val v :: T\"\n\n| WTVar\\<^sub>1:\n  \"\\<lbrakk> E!i = T; i < size E \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 Var i :: T\"\n\n| WTBinOp\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 :: T\\<^sub>1;  P,E \\<turnstile>\\<^sub>1 e\\<^sub>2 :: T\\<^sub>2;\n     case bop of Eq \\<Rightarrow> (P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1) \\<and> T = Boolean\n               | Add \\<Rightarrow> T\\<^sub>1 = Integer \\<and> T\\<^sub>2 = Integer \\<and> T = Integer \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2 :: T\"\n\n| WTLAss\\<^sub>1:\n  \"\\<lbrakk> E!i = T;  i < size E; P,E \\<turnstile>\\<^sub>1 e :: T';  P \\<turnstile> T' \\<le> T \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 i:=e :: Void\"\n\n| WTFAcc\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: Class C;  P \\<turnstile> C sees F:T in D \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 e\\<bullet>F{D} :: T\"\n\n| WTFAss\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 :: Class C;  P \\<turnstile> C sees F:T in D;  P,E \\<turnstile>\\<^sub>1 e\\<^sub>2 :: T';  P \\<turnstile> T' \\<le> T \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2 :: Void\"\n\n| WTCall\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: Class C; P \\<turnstile> C sees M:Ts' \\<rightarrow> T = m in D;\n    P,E \\<turnstile>\\<^sub>1 es [::] Ts;  P \\<turnstile> Ts [\\<le>] Ts' \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 e\\<bullet>M(es) :: T\"\n\n| WTBlock\\<^sub>1:\n  \"\\<lbrakk> is_type P T; P,E@[T] \\<turnstile>\\<^sub>1 e::T' \\<rbrakk>\n  \\<Longrightarrow>  P,E \\<turnstile>\\<^sub>1 {i:T; e} :: T'\"\n\n| WTSeq\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1::T\\<^sub>1;  P,E \\<turnstile>\\<^sub>1 e\\<^sub>2::T\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow>  P,E \\<turnstile>\\<^sub>1 e\\<^sub>1;;e\\<^sub>2 :: T\\<^sub>2\"\n\n| WTCond\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: Boolean;  P,E \\<turnstile>\\<^sub>1 e\\<^sub>1::T\\<^sub>1;  P,E \\<turnstile>\\<^sub>1 e\\<^sub>2::T\\<^sub>2;\n    P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1;  P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<longrightarrow> T = T\\<^sub>2; P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1 \\<longrightarrow> T = T\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n\n| WTWhile\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: Boolean;  P,E \\<turnstile>\\<^sub>1 c::T \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 while (e) c :: Void\"\n\n| WTThrow\\<^sub>1:\n  \"P,E \\<turnstile>\\<^sub>1 e :: Class C  \\<Longrightarrow>\n  P,E \\<turnstile>\\<^sub>1 throw e :: Void\"\n\n| WTTry\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 :: T;  P,E@[Class C] \\<turnstile>\\<^sub>1 e\\<^sub>2 :: T; is_class P C \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile>\\<^sub>1 try e\\<^sub>1 catch(C i) e\\<^sub>2 :: T\"\n\n| WTNil\\<^sub>1:\n  \"P,E \\<turnstile>\\<^sub>1 [] [::] []\"\n\n| WTCons\\<^sub>1:\n  \"\\<lbrakk> P,E \\<turnstile>\\<^sub>1 e :: T;  P,E \\<turnstile>\\<^sub>1 es [::] Ts \\<rbrakk>\n  \\<Longrightarrow>  P,E \\<turnstile>\\<^sub>1 e#es [::] T#Ts\"\n\n(*<*)\ndeclare  WT\\<^sub>1_WTs\\<^sub>1.intros[intro!]\ndeclare WTNil\\<^sub>1[iff]\n\nlemmas WT\\<^sub>1_WTs\\<^sub>1_induct = WT\\<^sub>1_WTs\\<^sub>1.induct [split_format (complete)]\n  and WT\\<^sub>1_WTs\\<^sub>1_inducts = WT\\<^sub>1_WTs\\<^sub>1.inducts [split_format (complete)]\n\ninductive_cases eee[elim!]:\n  \"P,E \\<turnstile>\\<^sub>1 Val v :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 Var i :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 Cast D e :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 i:=e :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 {i:U; e} :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1;;e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 while (e) c :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 throw e :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 try e\\<^sub>1 catch(C i) e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 e\\<bullet>F{D} :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1\\<bullet>F{D}:=e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 new C :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 e\\<bullet>M(es) :: T\"\n  \"P,E \\<turnstile>\\<^sub>1 [] [::] Ts\"\n  \"P,E \\<turnstile>\\<^sub>1 e#es [::] Ts\"\n(*>*)\n\nlemma WTs\\<^sub>1_same_size: \"\\<And>Ts. P,E \\<turnstile>\\<^sub>1 es [::] Ts \\<Longrightarrow> size es = size Ts\"\n(*<*)by (induct es type:list) auto(*>*)\n\n\nlemma WT\\<^sub>1_unique:\n  \"P,E \\<turnstile>\\<^sub>1 e :: T\\<^sub>1 \\<Longrightarrow> (\\<And>T\\<^sub>2. P,E \\<turnstile>\\<^sub>1 e :: T\\<^sub>2 \\<Longrightarrow> T\\<^sub>1 = T\\<^sub>2)\" and\n  \"P,E \\<turnstile>\\<^sub>1 es [::] Ts\\<^sub>1 \\<Longrightarrow> (\\<And>Ts\\<^sub>2. P,E \\<turnstile>\\<^sub>1 es [::] Ts\\<^sub>2 \\<Longrightarrow> Ts\\<^sub>1 = Ts\\<^sub>2)\"\n(*<*)\napply(induct rule:WT\\<^sub>1_WTs\\<^sub>1.inducts)\napply blast\napply blast\napply clarsimp\napply blast\napply clarsimp\napply(case_tac bop)\napply clarsimp\napply clarsimp\napply blast\napply (blast dest:sees_field_idemp sees_field_fun)\napply blast\napply (blast dest:sees_method_idemp sees_method_fun)\napply blast\napply blast\napply blast\napply blast\napply clarify\napply blast\napply blast\napply blast\ndone\n(*>*)\n\n\nlemma assumes wf: \"wf_prog p P\"\nshows WT\\<^sub>1_is_type: \"P,E \\<turnstile>\\<^sub>1 e :: T \\<Longrightarrow> set E \\<subseteq> types P \\<Longrightarrow> is_type P T\"\nand \"P,E \\<turnstile>\\<^sub>1 es [::] Ts \\<Longrightarrow> True\"\n(*<*)\napply(induct rule:WT\\<^sub>1_WTs\\<^sub>1.inducts)\napply simp\napply simp\napply (simp add:typeof_lit_is_type)\napply (blast intro:nth_mem)\napply(simp split:bop.splits)\napply simp\napply (simp add:sees_field_is_type[OF _ wf])\napply simp\napply(fastforce dest!: sees_wf_mdecl[OF wf] simp:wf_mdecl_def)\napply simp\napply simp\napply blast\napply simp\napply simp\napply simp\napply simp\napply simp\ndone\n(*>*)\n\n\nsubsection\\<open>Well-formedness\\<close>\n\n\\<comment> \\<open>Indices in blocks increase by 1\\<close>\n\nprimrec \\<B> :: \"expr\\<^sub>1 \\<Rightarrow> nat \\<Rightarrow> bool\"\n  and \\<B>s :: \"expr\\<^sub>1 list \\<Rightarrow> nat \\<Rightarrow> bool\" where\n\"\\<B> (new C) i = True\" |\n\"\\<B> (Cast C e) i = \\<B> e i\" |\n\"\\<B> (Val v) i = True\" |\n\"\\<B> (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2) i = (\\<B> e\\<^sub>1 i \\<and> \\<B> e\\<^sub>2 i)\" |\n\"\\<B> (Var j) i = True\" |\n\"\\<B> (e\\<bullet>F{D}) i = \\<B> e i\" |\n\"\\<B> (j:=e) i = \\<B> e i\" |\n\"\\<B> (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2) i = (\\<B> e\\<^sub>1 i \\<and> \\<B> e\\<^sub>2 i)\" |\n\"\\<B> (e\\<bullet>M(es)) i = (\\<B> e i \\<and> \\<B>s es i)\" |\n\"\\<B> ({j:T ; e}) i = (i = j \\<and> \\<B> e (i+1))\" |\n\"\\<B> (e\\<^sub>1;;e\\<^sub>2) i = (\\<B> e\\<^sub>1 i \\<and> \\<B> e\\<^sub>2 i)\" |\n\"\\<B> (if (e) e\\<^sub>1 else e\\<^sub>2) i = (\\<B> e i \\<and> \\<B> e\\<^sub>1 i \\<and> \\<B> e\\<^sub>2 i)\" |\n\"\\<B> (throw e) i = \\<B> e i\" |\n\"\\<B> (while (e) c) i = (\\<B> e i \\<and> \\<B> c i)\" |\n\"\\<B> (try e\\<^sub>1 catch(C j) e\\<^sub>2) i = (\\<B> e\\<^sub>1 i \\<and> i=j \\<and> \\<B> e\\<^sub>2 (i+1))\" |\n\n\"\\<B>s [] i = True\" |\n\"\\<B>s (e#es) i = (\\<B> e i \\<and> \\<B>s es i)\"\n\n\ndefinition wf_J\\<^sub>1_mdecl :: \"J\\<^sub>1_prog \\<Rightarrow> cname \\<Rightarrow> expr\\<^sub>1 mdecl \\<Rightarrow> bool\"\nwhere\n  \"wf_J\\<^sub>1_mdecl P C  \\<equiv>  \\<lambda>(M,Ts,T,body).\n    (\\<exists>T'. P,Class C#Ts \\<turnstile>\\<^sub>1 body :: T' \\<and> P \\<turnstile> T' \\<le> T) \\<and>\n    \\<D> body \\<lfloor>{..size Ts}\\<rfloor> \\<and> \\<B> body (size Ts + 1)\"\n\nlemma wf_J\\<^sub>1_mdecl[simp]:\n  \"wf_J\\<^sub>1_mdecl P C (M,Ts,T,body) \\<equiv>\n    ((\\<exists>T'. P,Class C#Ts \\<turnstile>\\<^sub>1 body :: T' \\<and> P \\<turnstile> T' \\<le> T) \\<and>\n     \\<D> body \\<lfloor>{..size Ts}\\<rfloor> \\<and> \\<B> body (size Ts + 1))\"\n(*<*)by (simp add:wf_J\\<^sub>1_mdecl_def)(*>*)\n\nabbreviation \"wf_J\\<^sub>1_prog == wf_prog wf_J\\<^sub>1_mdecl\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/Compiler/J1WellForm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548782017745, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.34347018985968114}}
{"text": "(*  Title:      HOL/Auth/Yahalom_Bad.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n*)\n\nsection\\<open>The Yahalom Protocol: A Flawed Version\\<close>\n\ntheory Yahalom_Bad imports Public begin\n\ntext\\<open>\nDemonstrates of why Oops is necessary.  This protocol can be attacked because\nit doesn't keep NB secret, but without Oops it can be \"verified\" anyway.\nThe issues are discussed in lcp's LICS 2000 invited lecture.\n\\<close>\n\ninductive_set yahalom :: \"event list set\"\n  where\n         (*Initial trace is empty*)\n   Nil:  \"[] \\<in> yahalom\"\n\n         (*The spy MAY say anything he CAN say.  We do not expect him to\n           invent new nonces here, but he can also use NS1.  Common to\n           all similar protocols.*)\n | Fake: \"[| evsf \\<in> yahalom;  X \\<in> synth (analz (knows Spy evsf)) |]\n          ==> Says Spy B X  # evsf \\<in> yahalom\"\n\n         (*A message that has been sent can be received by the\n           intended recipient.*)\n | Reception: \"[| evsr \\<in> yahalom;  Says A B X \\<in> set evsr |]\n               ==> Gets B X # evsr \\<in> yahalom\"\n\n         (*Alice initiates a protocol run*)\n | YM1:  \"[| evs1 \\<in> yahalom;  Nonce NA \\<notin> used evs1 |]\n          ==> Says A B \\<lbrace>Agent A, Nonce NA\\<rbrace> # evs1 \\<in> yahalom\"\n\n         (*Bob's response to Alice's message.*)\n | YM2:  \"[| evs2 \\<in> yahalom;  Nonce NB \\<notin> used evs2;\n             Gets B \\<lbrace>Agent A, Nonce NA\\<rbrace> \\<in> set evs2 |]\n          ==> Says B Server\n                  \\<lbrace>Agent B, Nonce NB, Crypt (shrK B) \\<lbrace>Agent A, Nonce NA\\<rbrace>\\<rbrace>\n                # evs2 \\<in> yahalom\"\n\n         (*The Server receives Bob's message.  He responds by sending a\n            new session key to Alice, with a packet for forwarding to Bob.*)\n | YM3:  \"[| evs3 \\<in> yahalom;  Key KAB \\<notin> used evs3;  KAB \\<in> symKeys;\n             Gets Server\n                  \\<lbrace>Agent B, Nonce NB, Crypt (shrK B) \\<lbrace>Agent A, Nonce NA\\<rbrace>\\<rbrace>\n               \\<in> set evs3 |]\n          ==> Says Server A\n                   \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key KAB, Nonce NA, Nonce NB\\<rbrace>,\n                     Crypt (shrK B) \\<lbrace>Agent A, Key KAB\\<rbrace>\\<rbrace>\n                # evs3 \\<in> yahalom\"\n\n         (*Alice receives the Server's (?) message, checks her Nonce, and\n           uses the new session key to send Bob his Nonce.  The premise\n           A \\<noteq> Server is needed to prove Says_Server_not_range.*)\n | YM4:  \"[| evs4 \\<in> yahalom;  A \\<noteq> Server;  K \\<in> symKeys;\n             Gets A \\<lbrace>Crypt(shrK A) \\<lbrace>Agent B, Key K, Nonce NA, Nonce NB\\<rbrace>, X\\<rbrace>\n                \\<in> set evs4;\n             Says A B \\<lbrace>Agent A, Nonce NA\\<rbrace> \\<in> set evs4 |]\n          ==> Says A B \\<lbrace>X, Crypt K (Nonce NB)\\<rbrace> # evs4 \\<in> yahalom\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body  [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\ndeclare analz_into_parts [dest]\n\n\ntext\\<open>A \"possibility property\": there are traces that reach the end\\<close>\nlemma \"[| A \\<noteq> Server; Key K \\<notin> used []; K \\<in> symKeys |] \n       ==> \\<exists>X NB. \\<exists>evs \\<in> yahalom.\n              Says A B \\<lbrace>X, Crypt K (Nonce NB)\\<rbrace> \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] yahalom.Nil\n                    [THEN yahalom.YM1, THEN yahalom.Reception,\n                     THEN yahalom.YM2, THEN yahalom.Reception,\n                     THEN yahalom.YM3, THEN yahalom.Reception,\n                     THEN yahalom.YM4])\napply (possibility, simp add: used_Cons) \ndone\n\nsubsection\\<open>Regularity Lemmas for Yahalom\\<close>\n\nlemma Gets_imp_Says:\n     \"[| Gets B X \\<in> set evs; evs \\<in> yahalom |] ==> \\<exists>A. Says A B X \\<in> set evs\"\nby (erule rev_mp, erule yahalom.induct, auto)\n\n(*Must be proved separately for each protocol*)\nlemma Gets_imp_knows_Spy:\n     \"[| Gets B X \\<in> set evs; evs \\<in> yahalom |]  ==> X \\<in> knows Spy evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\ndeclare Gets_imp_knows_Spy [THEN analz.Inj, dest]\n\n\nsubsection\\<open>For reasoning about the encrypted portion of messages\\<close>\n\ntext\\<open>Lets us treat YM4 using a similar argument as for the Fake case.\\<close>\nlemma YM4_analz_knows_Spy:\n     \"[| Gets A \\<lbrace>Crypt (shrK A) Y, X\\<rbrace> \\<in> set evs;  evs \\<in> yahalom |]\n      ==> X \\<in> analz (knows Spy evs)\"\nby blast\n\nlemmas YM4_parts_knows_Spy =\n       YM4_analz_knows_Spy [THEN analz_into_parts]\n\n\ntext\\<open>Theorems of the form \\<^term>\\<open>X \\<notin> parts (knows Spy evs)\\<close> imply \n            that NOBODY sends messages containing X!\\<close>\n\ntext\\<open>Spy never sees a good agent's shared key!\\<close>\nlemma Spy_see_shrK [simp]:\n     \"evs \\<in> yahalom ==> (Key (shrK A) \\<in> parts (knows Spy evs)) = (A \\<in> bad)\"\napply (erule yahalom.induct, force,\n       drule_tac [6] YM4_parts_knows_Spy, simp_all, blast+)\ndone\n\nlemma Spy_analz_shrK [simp]:\n     \"evs \\<in> yahalom ==> (Key (shrK A) \\<in> analz (knows Spy evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"[|Key (shrK A) \\<in> parts (knows Spy evs);  evs \\<in> yahalom|] ==> A \\<in> bad\"\nby (blast dest: Spy_see_shrK)\n\ntext\\<open>Nobody can have used non-existent keys!\n    Needed to apply \\<open>analz_insert_Key\\<close>\\<close>\nlemma new_keys_not_used [simp]:\n    \"[|Key K \\<notin> used evs; K \\<in> symKeys; evs \\<in> yahalom|]\n     ==> K \\<notin> keysFor (parts (spies evs))\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n       frule_tac [6] YM4_parts_knows_Spy, simp_all)\ntxt\\<open>Fake\\<close>\napply (force dest!: keysFor_parts_insert, auto)\ndone\n\n\nsubsection\\<open>Secrecy Theorems\\<close>\n\n(****\n The following is to prove theorems of the form\n\n  Key K \\<in> analz (insert (Key KAB) (knows Spy evs)) ==>\n  Key K \\<in> analz (knows Spy evs)\n\n A more general formula must be proved inductively.\n****)\n\nsubsection\\<open>Session keys are not used to encrypt other session keys\\<close>\n\nlemma analz_image_freshK [rule_format]:\n \"evs \\<in> yahalom ==>\n   \\<forall>K KK. KK \\<subseteq> - (range shrK) \\<longrightarrow>\n          (Key K \\<in> analz (Key`KK \\<union> (knows Spy evs))) =\n          (K \\<in> KK | Key K \\<in> analz (knows Spy evs))\"\nby (erule yahalom.induct, \n    drule_tac [7] YM4_analz_knows_Spy, analz_freshK, spy_analz, blast) \n\nlemma analz_insert_freshK:\n     \"[| evs \\<in> yahalom;  KAB \\<notin> range shrK |] ==>\n      (Key K \\<in> analz (insert (Key KAB) (knows Spy evs))) =\n      (K = KAB | Key K \\<in> analz (knows Spy evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\n\ntext\\<open>The Key K uniquely identifies the Server's  message.\\<close>\nlemma unique_session_keys:\n     \"[| Says Server A\n          \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace>, X\\<rbrace> \\<in> set evs;\n        Says Server A'\n          \\<lbrace>Crypt (shrK A') \\<lbrace>Agent B', Key K, na', nb'\\<rbrace>, X'\\<rbrace> \\<in> set evs;\n        evs \\<in> yahalom |]\n     ==> A=A' \\<and> B=B' \\<and> na=na' \\<and> nb=nb'\"\napply (erule rev_mp, erule rev_mp)\napply (erule yahalom.induct, simp_all)\ntxt\\<open>YM3, by freshness, and YM4\\<close>\napply blast+\ndone\n\n\ntext\\<open>Crucial secrecy property: Spy does not see the keys sent in msg YM3\\<close>\nlemma secrecy_lemma:\n     \"[| A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom |]\n      ==> Says Server A\n            \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace>,\n              Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n           \\<in> set evs \\<longrightarrow>\n          Key K \\<notin> analz (knows Spy evs)\"\napply (erule yahalom.induct, force, drule_tac [6] YM4_analz_knows_Spy)\napply (simp_all add: pushes analz_insert_eq analz_insert_freshK, spy_analz)  (*Fake*)\napply (blast dest: unique_session_keys)  (*YM3*)\ndone\n\ntext\\<open>Final version\\<close>\nlemma Spy_not_see_encrypted_key:\n     \"[| Says Server A\n            \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace>,\n              Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom |]\n      ==> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest: secrecy_lemma)\n\n\nsubsection\\<open>Security Guarantee for A upon receiving YM3\\<close>\n\ntext\\<open>If the encrypted message appears then it originated with the Server\\<close>\nlemma A_trusts_YM3:\n     \"[| Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace> \\<in> parts (knows Spy evs);\n         A \\<notin> bad;  evs \\<in> yahalom |]\n       ==> Says Server A\n            \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace>,\n              Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n           \\<in> set evs\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n       frule_tac [6] YM4_parts_knows_Spy, simp_all)\ntxt\\<open>Fake, YM3\\<close>\napply blast+\ndone\n\ntext\\<open>The obvious combination of \\<open>A_trusts_YM3\\<close> with\n  \\<open>Spy_not_see_encrypted_key\\<close>\\<close>\nlemma A_gets_good_key:\n     \"[| Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace> \\<in> parts (knows Spy evs);\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom |]\n      ==> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest!: A_trusts_YM3 Spy_not_see_encrypted_key)\n\nsubsection\\<open>Security Guarantees for B upon receiving YM4\\<close>\n\ntext\\<open>B knows, by the first part of A's message, that the Server distributed\n  the key for A and B.  But this part says nothing about nonces.\\<close>\nlemma B_trusts_YM4_shrK:\n     \"[| Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace> \\<in> parts (knows Spy evs);\n         B \\<notin> bad;  evs \\<in> yahalom |]\n      ==> \\<exists>NA NB. Says Server A\n                      \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, Nonce NA, Nonce NB\\<rbrace>,\n                        Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n                     \\<in> set evs\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n       frule_tac [6] YM4_parts_knows_Spy, simp_all)\ntxt\\<open>Fake, YM3\\<close>\napply blast+\ndone\n\nsubsection\\<open>The Flaw in the Model\\<close>\n\ntext\\<open>Up to now, the reasoning is similar to standard Yahalom.  Now the\n    doubtful reasoning occurs.  We should not be assuming that an unknown\n    key is secure, but the model allows us to: there is no Oops rule to\n    let session keys become compromised.\\<close>\n\ntext\\<open>B knows, by the second part of A's message, that the Server distributed\n  the key quoting nonce NB.  This part says nothing about agent names.\n  Secrecy of K is assumed; the valid Yahalom proof uses (and later proves)\n  the secrecy of NB.\\<close>\nlemma B_trusts_YM4_newK [rule_format]:\n     \"[|Key K \\<notin> analz (knows Spy evs);  evs \\<in> yahalom|]\n      ==> Crypt K (Nonce NB) \\<in> parts (knows Spy evs) \\<longrightarrow>\n          (\\<exists>A B NA. Says Server A\n                      \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K,\n                                Nonce NA, Nonce NB\\<rbrace>,\n                        Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n                     \\<in> set evs)\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n       frule_tac [6] YM4_parts_knows_Spy)\napply (analz_mono_contra, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>YM3\\<close>\napply blast\ntxt\\<open>A is uncompromised because NB is secure\n  A's certificate guarantees the existence of the Server message\\<close>\napply (blast dest!: Gets_imp_Says Crypt_Spy_analz_bad\n             dest: Says_imp_spies\n                   parts.Inj [THEN parts.Fst, THEN A_trusts_YM3])\ndone\n\n\ntext\\<open>B's session key guarantee from YM4.  The two certificates contribute to a\n  single conclusion about the Server's message.\\<close>\nlemma B_trusts_YM4:\n     \"[| Gets B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>,\n                  Crypt K (Nonce NB)\\<rbrace> \\<in> set evs;\n         Says B Server\n           \\<lbrace>Agent B, Nonce NB, Crypt (shrK B) \\<lbrace>Agent A, Nonce NA\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom |]\n       ==> \\<exists>na nb. Says Server A\n                   \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace>,\n                     Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n             \\<in> set evs\"\nby (blast dest: B_trusts_YM4_newK B_trusts_YM4_shrK Spy_not_see_encrypted_key\n                unique_session_keys)\n\n\ntext\\<open>The obvious combination of \\<open>B_trusts_YM4\\<close> with \n  \\<open>Spy_not_see_encrypted_key\\<close>\\<close>\nlemma B_gets_good_key:\n     \"[| Gets B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>,\n                  Crypt K (Nonce NB)\\<rbrace> \\<in> set evs;\n         Says B Server\n           \\<lbrace>Agent B, Nonce NB, Crypt (shrK B) \\<lbrace>Agent A, Nonce NA\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom |]\n      ==> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest!: B_trusts_YM4 Spy_not_see_encrypted_key)\n\n\n(*** Authenticating B to A: these proofs are not considered.\n     They are irrelevant to showing the need for Oops. ***)\n\n\n(*** Authenticating A to B using the certificate Crypt K (Nonce NB) ***)\n\ntext\\<open>Assuming the session key is secure, if both certificates are present then\n  A has said NB.  We can't be sure about the rest of A's message, but only\n  NB matters for freshness.\\<close>\nlemma A_Said_YM3_lemma [rule_format]:\n     \"evs \\<in> yahalom\n      ==> Key K \\<notin> analz (knows Spy evs) \\<longrightarrow>\n          Crypt K (Nonce NB) \\<in> parts (knows Spy evs) \\<longrightarrow>\n          Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace> \\<in> parts (knows Spy evs) \\<longrightarrow>\n          B \\<notin> bad \\<longrightarrow>\n          (\\<exists>X. Says A B \\<lbrace>X, Crypt K (Nonce NB)\\<rbrace> \\<in> set evs)\"\napply (erule yahalom.induct, force,\n       frule_tac [6] YM4_parts_knows_Spy)\napply (analz_mono_contra, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>YM3: by \\<open>new_keys_not_used\\<close>, the message\n   \\<^term>\\<open>Crypt K (Nonce NB)\\<close> could not exist\\<close>\napply (force dest!: Crypt_imp_keysFor)\ntxt\\<open>YM4: was \\<^term>\\<open>Crypt K (Nonce NB)\\<close> the very last message?\n    If not, use the induction hypothesis\\<close>\napply (simp add: ex_disj_distrib)\ntxt\\<open>yes: apply unicity of session keys\\<close>\napply (blast dest!: Gets_imp_Says A_trusts_YM3 B_trusts_YM4_shrK\n                    Crypt_Spy_analz_bad\n             dest: Says_imp_knows_Spy [THEN parts.Inj] unique_session_keys)\ndone\n\ntext\\<open>If B receives YM4 then A has used nonce NB (and therefore is alive).\n  Moreover, A associates K with NB (thus is talking about the same run).\n  Other premises guarantee secrecy of K.\\<close>\nlemma YM4_imp_A_Said_YM3 [rule_format]:\n     \"[| Gets B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>,\n                  Crypt K (Nonce NB)\\<rbrace> \\<in> set evs;\n         Says B Server\n           \\<lbrace>Agent B, Nonce NB, Crypt (shrK B) \\<lbrace>Agent A, Nonce NA\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom |]\n      ==> \\<exists>X. Says A B \\<lbrace>X, Crypt K (Nonce NB)\\<rbrace> \\<in> set evs\"\nby (blast intro!: A_Said_YM3_lemma\n          dest: Spy_not_see_encrypted_key B_trusts_YM4 Gets_imp_Says)\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Auth/Yahalom_Bad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.5273165233795672, "lm_q1q2_score": 0.34347018272207225}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory Addr_Type\nimports \"Word_Lib.WordSetup\"\nbegin\n\ntype_synonym addr_bitsize = \"32\"\ntype_synonym addr = \"addr_bitsize word\"\ndefinition addr_bitsize :: nat where \"addr_bitsize \\<equiv> 32\"\ndefinition addr_align :: nat where \"addr_align \\<equiv> 2\"\ndeclare addr_align_def[simp]\n\ndefinition addr_card :: nat where\n  \"addr_card \\<equiv> card (UNIV::addr set)\"\n\n\n\ndeclare addr_bitsize_def[simp]\n\nlemma addr_card:\n  \"addr_card = 2^addr_bitsize\"\n  by (simp add: addr_card_def card_word)\n\nlemma len_of_addr_card:\n  \"2 ^ len_of TYPE(addr_bitsize) = addr_card\"\n  by (simp add: addr_card)\n\nlemma of_nat_addr_card [simp]:\n  \"of_nat addr_card = (0::addr)\"\n  by (simp add: addr_card)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/umm_heap/ARM_HYP/Addr_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3434701827220722}}
{"text": "theory State_Networks\n  imports Networks TA_Impl.Normalized_Zone_Semantics_Impl\n    TA_Library.More_Methods\nbegin\n\nchapter \\<open>Networks of Timed Automata with Discrete State\\<close>\n\nunbundle no_library_syntax\n\nsection \\<open>Networks of Timed Automata with Shared State\\<close>\n\nsubsection \\<open>Syntax and Operational Semantics\\<close>\n\n(* XXX Update text *)\ntext \\<open>\n  We extend Networks of Timed Automata with arbitrary shared (global) state.\n  Syntactically, this extension is very simple.\n  We can just use the free action label slot to annotate edges with a guard\n  and an update function on discrete states.\n  The slightly more clumsy part is adding invariants for discrete states\n  by directly specifying an invariant annotating function.\n\\<close>\n\ntype_synonym\n  ('a, 'c, 'time, 's, 'st) transition =\n  \"'s * ('st \\<Rightarrow> ('c, 'time) cconstraint) * 'a * ('st \\<Rightarrow> 'c list) * 's\"\n\ntype_synonym\n  ('a, 'c, 'time, 's, 'st) sta = \"('a, 'c, 'time, 's, 'st) transition set * ('c, 'time, 's) invassn\"\n\ntype_synonym\n  ('a, 'c, 't, 's, 'st) snta =\n  \"('a act \\<times> ('st \\<Rightarrow> bool) \\<times> ('st \\<Rightarrow> 'st option), 'c, 't, 's, 'st) sta list \\<times> ('s \\<Rightarrow> 'st \\<Rightarrow> bool) list\"\n\n(*\ntype_synonym\n  ('a, 'c, 'time, 's) unta = \"programc \\<times> ('a act, 'c, 'time, 's) uta list\"\n\ntype_synonym\n  ('a, 'c, 't, 's, 'st) snta =\n  \"('a, ('st \\<Rightarrow> bool) \\<times> ('st \\<Rightarrow> 'st), 'c, 't, 's) nta \\<times> ('s \\<Rightarrow> 'st \\<Rightarrow> bool) list\"\n*)\n\ntext \\<open>\n  Semantic states now consist of three things:\n  a list of process locations, the shared state, and a clock valuation.\n  The semantic extension then is also obvious: we can take the same transitions\n  as in the network without shared state, however we have to add state updates\n  and checks for guards on the shared state.\n  The updates on discrete state for synchronizing transitions are in the same order as in UPPAAL\n  (output before input).\n\\<close>\n\ndatatype 'b label = Del | Act 'b | Syn 'b\n\ninductive step_sn ::\n  \"('a, 'c, 't, 's, 'st) snta \\<Rightarrow> 's list \\<Rightarrow> 'st \\<Rightarrow> ('c, ('t::time)) cval \\<Rightarrow> 'a label\n  \\<Rightarrow> 's list \\<Rightarrow> 'st \\<Rightarrow> ('c, 't) cval \\<Rightarrow> bool\"\n  (\"_ \\<turnstile> \\<langle>_, _, _\\<rangle> \\<rightarrow>\\<^bsub>_\\<^esub> \\<langle>_, _, _\\<rangle>\" [61,61,61,61,61] 61)\nwhere\n  step_sn_t:\n    \"(N, I) \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Del\\<^esub> \\<langle>L, s, u \\<oplus> d\\<rangle>\"\n    if \"\\<forall> p \\<in> {..<length N}. u \\<oplus> d \\<turnstile> snd (N ! p) (L ! p)\"\n       \"d \\<ge> 0\" \"length N = length I\" |\n  step_sn_i:\n    \"(N, I) \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Act a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n    if \"(l, g, (Sil a, c, m), f, l') \\<in> fst (N!p)\"\n       \"u \\<turnstile> g s\" \"\\<forall> p \\<in> {..<length N}. u' \\<turnstile> snd (N!p) (L'!p)\"\n       \"r = f s\"\n       \"L!p = l\" \"p < length L\" \"L' = L[p := l']\" \"u' = [r\\<rightarrow>0]u\"\n       \"c s\" \"\\<forall> p < length I. (I ! p) (L' ! p) s'\" \"Some s' = m s\"\n       \"length N = length I\" |\n  step_sn_s:\n    \"(N, I) \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Syn a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n    if \"(l1, g1, (In a, ci, mi), f1, l1') \\<in> fst (N!p)\"\n       \"(l2, g2, (Out a, co, mo), f2, l2') \\<in> fst (N!q)\" \"u \\<turnstile> g1 s\" \"u \\<turnstile> g2 s\"\n       \"\\<forall> p \\<in> {..<length N}. u' \\<turnstile> snd (N!p) (L'!p)\"\n       \"r1 = f1 s\" \"r2 = f2 s\"\n       \"L!p = l1\" \"L!q = l2\" \"p < length L\" \"q < length L\" \"p \\<noteq> q\"\n       \"L' = L[p := l1', q := l2']\" \"u' = [(r1 @ r2)\\<rightarrow>0]u\"\n       \"ci s\" \"co s\" \"\\<forall> p < length I. (I ! p) (L' ! p) s'\"\n       \"Some so = mo s\" \"Some s' = mi so\" \"length N = length I\"\n\ninductive_cases[elim!]: \"N \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Syn a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n\ninductive steps_sn ::\n  \"('a, 'c, 't, 's, 'st) snta \\<Rightarrow> 's list \\<Rightarrow> 'st \\<Rightarrow> ('c, ('t::time)) cval\n  \\<Rightarrow> 's list \\<Rightarrow> 'st \\<Rightarrow> ('c, 't) cval \\<Rightarrow> bool\"\n(\"_ \\<turnstile> \\<langle>_, _, _\\<rangle> \\<rightarrow>* \\<langle>_, _, _\\<rangle>\" [61, 61, 61,61,61] 61)\nwhere\n  refl: \"N \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L, s, u\\<rangle>\" |\n  step: \"N \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle> \\<Longrightarrow> N \\<turnstile> \\<langle>L', s', u'\\<rangle> \\<rightarrow>\\<^bsub>l\\<^esub> \\<langle>L'', s'', u''\\<rangle>\n        \\<Longrightarrow> N \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L'', s'', u''\\<rangle>\"\n\ndeclare steps_sn.intros[intro]\n\nlemma stepI2:\n  \"N \\<turnstile> \\<langle>l, s, u\\<rangle> \\<rightarrow>* \\<langle>l'', s'', u''\\<rangle>\" if\n  \"N \\<turnstile> \\<langle>l', s', u'\\<rangle> \\<rightarrow>* \\<langle>l'', s'', u''\\<rangle>\" \"N \\<turnstile> \\<langle>l, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>l', s', u'\\<rangle>\"\n  using that\n  apply induction\n   apply rule\n    apply (rule refl)\n   apply assumption\n  apply simp\n  by (rule; assumption)\n\nabbreviation state_set :: \"('a, 'c, 't, 's, 'st) transition set \\<Rightarrow> 's set\" where\n  \"state_set T \\<equiv> fst ` T \\<union> (snd o snd o snd o snd) ` T\"\n\nsubsection \\<open>Product Automaton\\<close>\n\nlocale Prod_TA_Defs =\n  fixes A :: \"('a, 'c, 't, 's, 'st) snta\"\nbegin\n\ndefinition\n  \"T_s p s = {(l, g s, a, f s, l') | l g a f l'. (l, g, a, f, l') \\<in> fst (fst A ! p)}\"\n\ndefinition\n  \"N_s s = map (\\<lambda> p. (T_s p s, snd (fst A ! p))) [0..<length (fst A)]\"\n\nabbreviation \"P \\<equiv> snd A\"\n\ndefinition \"p \\<equiv> length (fst A)\"\n\nabbreviation \"product s \\<equiv> Product_TA_Defs.product_ta (N_s s)\"\n\nabbreviation \"T' s \\<equiv> trans_of (product s)\"\nabbreviation \"I' s \\<equiv> inv_of (product s)\"\n\ndefinition\n  \"prod_trans_i =\n    {((L, s), g, a, r, (L', s')) | L s g c a r m L' s'.\n     (\\<forall> q < p. (P ! q) (L ! q) s) \\<and> (\\<forall> q < p. (P ! q) (L' ! q) s')\n     \\<and> (L, g, (a, Networks.label.Act (c, m)), r, L') \\<in> T' s \\<and> c s \\<and> Some s' = m s}\"\n\ndefinition\n  \"prod_trans_s =\n    {((L, s), g, a, r, (L', s')) | L s g ci co a r mi mo L' s' so.\n      ci s \\<and> co s\n      \\<and> (\\<forall> q < p. (P ! q) (L ! q) s) \\<and> (\\<forall> q < p. (P ! q) (L' ! q) s')\n      \\<and> (L, g, (a, Networks.label.Syn (ci, mi) (co, mo)), r, L') \\<in> T' s\n      \\<and> Some so = mo s\n      \\<and> Some s' = mi so\n    }\"\n\n  definition\n    \"prod_trans \\<equiv> prod_trans_i \\<union> prod_trans_s\"\n\n  definition\n    \"prod_invariant \\<equiv> \\<lambda> (L, s). I' s L\"\n\n  definition prod_ta :: \"('a, 'c, 't, 's list \\<times> 'st) ta\" where\n    \"prod_ta \\<equiv> (prod_trans, prod_invariant)\"\n\n  lemma prod_ta_cases:\n    assumes \"prod_ta \\<turnstile> L \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> L'\"\n    shows \"(L, g, a, r, L') \\<in> prod_trans_i \\<or> (L, g, a, r, L') \\<in> prod_trans_s\"\n    using assms unfolding prod_ta_def trans_of_def prod_trans_def by auto\n\n  lemma inv_of_simp:\n    \"inv_of prod_ta (L, s) = I' s L\"\n    unfolding inv_of_def prod_ta_def prod_invariant_def by simp\n\n  lemma I'_simp:\n    \"I' s L = I' s' L\"\n    unfolding Product_TA_Defs.product_ta_def inv_of_def Product_TA_Defs.product_invariant_def N_s_def\n    apply simp\n    apply (rule arg_cong[where f = concat])\n    by simp\n\n  lemma collect_clki_prod_invariant:\n    \"Timed_Automata.collect_clki prod_invariant = Timed_Automata.collect_clki (I' s)\"\n    unfolding prod_invariant_def Timed_Automata.collect_clki_def\n    apply (simp split: prod.split)\n    apply safe\n     apply (subst (asm) I'_simp[where s' = s])\n    by auto\n\n  lemma collect_clki_prod_invariant':\n    \"Timed_Automata.collect_clki prod_invariant\n    \\<subseteq> \\<Union> {Timed_Automata.collect_clki (snd (fst A ! p)) | p. p < length (fst A)}\"\n    unfolding collect_clki_prod_invariant[of s]\n    unfolding inv_of_def Product_TA_Defs.product_ta_def\n    unfolding Product_TA_Defs.product_invariant_def\n    unfolding inv_of_def N_s_def\n    unfolding Timed_Automata.collect_clki_def\n    unfolding collect_clock_pairs_def\n    by auto\n\n  lemma collect_clkt_prod_trans_subs:\n    \"Timed_Automata.collect_clkt prod_trans \\<subseteq> Timed_Automata.collect_clkt (\\<Union> (T' ` UNIV))\"\n    unfolding Timed_Automata.collect_clkt_def prod_trans_def prod_trans_i_def prod_trans_s_def\n    by fastforce\n\n  lemma collect_clkvt_prod_trans_subs:\n    \"collect_clkvt prod_trans \\<subseteq> collect_clkvt (\\<Union> (T' ` UNIV))\"\n    unfolding collect_clkvt_def prod_trans_def prod_trans_i_def prod_trans_s_def by fastforce\n\nlemma T_simp:\n  \"T ! q = trans_of (N ! q)\" if \"q < length N\"\n  using that oops\n\n  (*\nlemma prod_state_set_subs:\n  assumes \"l \\<in> state_set T'\" \"q < p\"\n  shows \"l ! q \\<in> state_set (trans_of (N ! q))\"\n  using assms\n  apply (simp only: T_simp[symmetric] p_def)\n  by (rule product_state_set_subs; simp add: product_ta_def trans_of_def)\n*)\n\nabbreviation \"N \\<equiv> fst A\"\n\ncontext\n  fixes Q\n  assumes finite_state:\n    \"\\<forall> l. \\<forall> q < p. (P ! q) l s \\<longrightarrow> Q s\"\n    \"finite {s. Q s}\"\n      and finite_trans: \"\\<forall> A \\<in> set N. finite (fst A)\"\n      and p_gt_0: \"p > 0\"\nbegin\n\n  lemma finite_state':\n    \"finite {s. \\<forall>q<p. (P ! q) (L ! q) s}\" (is \"finite ?S\")\n  proof -\n    from p_gt_0 obtain q where \"q < p\" by blast\n    then have \"?S \\<subseteq> {s. Q s}\" using finite_state(1) by auto\n    moreover have \"finite \\<dots>\" by (rule finite_state(2))\n    ultimately show ?thesis by (rule finite_subset)\n  qed\n\n  lemma finite_trans':\n    \"\\<forall>A\\<in>set (N_s s). finite (trans_of A)\"\n  unfolding N_s_def apply auto\n    unfolding trans_of_def T_s_def\n    apply simp\n    apply (drule nth_mem)\n    using finite_trans\n    using [[simproc add: finite_Collect]]\n    apply auto\n    apply (rule finite_imageI)\n    apply (rule finite_vimageI)\n     apply simp\n    unfolding inj_on_def by auto\n\n  lemma finite_states:\n    \"finite (Product_TA_Defs.states (N_s s))\"\n    using finite_trans' by (rule Product_TA_Defs.finite_states)\n\n  lemma\n    \"finite (T' s)\"\n    using finite_trans' by (rule Product_TA_Defs.finite_trans_of_product)\n\n  (* XXX Duplicated proof, what is the better way? *)\n  lemma finite_product_1:\n    \"finite (T' s)\"\n    unfolding product_def\n    unfolding trans_of_def Product_TA_Defs.product_ta_def\n    apply simp\n    unfolding Product_TA_Defs.product_trans_def\n  proof safe\n    have \"Product_TA_Defs.product_trans_i (N_s s)\n        \\<subseteq> {(L, g, (a, Networks.label.Act (aa, b)), r, L[p := l']) |L p g a aa b r l'.\n            L \\<in> Product_TA_Defs.states (N_s s) \\<and> p < length (N_s s) \\<and>\n            (L ! p, g, (Sil a, aa, b), r, l') \\<in> \\<Union> (trans_of ` set (N_s s))}\"\n      unfolding Product_TA_Defs.product_trans_i_def\n      by (fastforce simp: Product_TA_Defs.states_length)\n    moreover have \"finite \\<dots>\"\n      apply defer_ex\n      using finite_states[of s] apply clarsimp\n      apply (subst finite_Collect_bounded_ex_6)\n      subgoal premises prems for y y'\n      proof -\n        (* XXX Rewriting could be automated -- consider approach taken in next case *)\n        have \"\n              {(a, b, c, d, e, f). \\<exists>x\\<in>set (N_s s). x \\<turnstile> y ! y' \\<longrightarrow>\\<^bsup>a,(Sil b, c, d),e\\<^esup> f}\n            = {xx. \\<exists> x a b c d e f. x\\<in>set (N_s s) \\<and> x \\<turnstile> y ! y' \\<longrightarrow>\\<^bsup>a,(Sil b, c, d),e\\<^esup> f\n                   \\<and> xx = (a, b, c, d, e, f)}\"\n          by force\n        moreover have \"finite \\<dots>\" (* XXX finite_Collect_bounded_ex is not crucial here *)\n          using finite_trans'[of s]\n          using [[simproc add: finite_Collect]]\n          by (auto simp: inj_on_def intro: finite_vimageI simp del: finite_Collect_bounded_ex)\n        ultimately show ?thesis by simp\n      qed\n      by auto\n    ultimately show \"finite (Product_TA_Defs.product_trans_i (N_s s))\" by (rule finite_subset)\n  next\n    have \"Product_TA_Defs.product_trans_s (N_s s)\n        \\<subseteq> {(L, g1 @ g2, (a, Networks.label.Syn b1 b2), r1 @ r2, L[p := l1', q := l2']) |\n              L p q g1 g2 a b1 b2 r1 r2 l1' l2'.\n              L \\<in> Product_TA_Defs.states (N_s s) \\<and>\n              p < length (N_s s) \\<and> q < length (N_s s) \\<and>\n              (L ! p, g1, (In a, b1), r1, l1') \\<in> map trans_of (N_s s) ! p \\<and>\n              (L ! q, g2, (Out a, b2), r2, l2') \\<in> map trans_of (N_s s) ! q \\<and> p \\<noteq> q}\"\n      unfolding Product_TA_Defs.product_trans_s_def\n      by (fastforce simp: Product_TA_Defs.states_length)\n    moreover have \"finite \\<dots>\"\n      apply defer_ex\n      using finite_states[of s]\n      apply clarsimp\n      subgoal\n        apply (mini_existential, simp)\n        apply (mini_existential, simp)\n        apply (mini_existential, simp)\n        apply (mini_existential, simp)\n        apply (subst finite_Collect_bounded_ex_6)\n        subgoal\n          using [[simproc add: finite_Collect]] finite_trans'[of s]\n          by (auto simp: inj_on_def intro: finite_vimageI)\n        apply safe\n        apply (subst finite_Collect_bounded_ex_5)\n        subgoal\n          using [[simproc add: finite_Collect]] finite_trans'[of s]\n          by (auto 4 3 simp: simp: inj_on_def intro: finite_vimageI)\n        by auto\n      done\n    ultimately show \"finite (Product_TA_Defs.product_trans_s (N_s s))\" by (rule finite_subset)\n  qed\n\n  lemma prod_trans_i_alt_def:\n    \"prod_trans_i =\n      {((L, s), g, a, r, (L', s')) | L s g c a r m L' s'.\n       (L, g, (a, Networks.label.Act (c, m)), r, L') \\<in> T' s \\<and>\n       (\\<forall> q < p. (P ! q) (L ! q) s) \\<and> (\\<forall> q < p. (P ! q) (L' ! q) s')\n       \\<and> c s \\<and> Some s' = m s}\"\n    unfolding prod_trans_i_def by (safe; metis)\n\n  (* XXX Wierd proof, should there be some automation for this? *)\n  lemma Some_finite:\n    \"finite {x. Some x = y}\"\n    using not_finite_existsD by fastforce\n\n  lemma finite_prod_trans:\n    \"finite prod_trans\" if \"p > 0\"\n    unfolding prod_trans_def\n  proof safe\n    have \"prod_trans_i \\<subseteq>\n        {((L, s), g, a, r, (L', s')) | L s g c a r m L' s'.\n         Q s \\<and>\n         (L, g, (a, Networks.label.Act (c, m)), r, L') \\<in> T' s \\<and>\n         (\\<forall> q < p. (P ! q) (L ! q) s) \\<and> (\\<forall> q < p. (P ! q) (L' ! q) s')\n         \\<and> c s \\<and> Some s' = m s}\n      \"\n      unfolding prod_trans_i_alt_def\n      using finite_state(1) p_gt_0 by force\n    moreover have\n      \"finite \\<dots>\"\n      apply defer_ex\n      apply (mini_existential, simp only: ex_simps)\n      using finite_state(2) apply clarsimp\n      apply (subst finite_Collect_bounded_ex_7)\n      using [[simproc add: finite_Collect]] finite_state' finite_product_1\n      by (auto 4 3 simp: inj_on_def intro: finite_vimageI)\n    ultimately show \"finite prod_trans_i\" by (rule finite_subset)\n  next\n    have \"prod_trans_s \\<subseteq>\n        {((L, s), g, a, r, (L', s')) | L s g ci co a r mi mo L' s' so.\n          Q s \\<and>\n          product s \\<turnstile> L \\<longrightarrow>\\<^bsup>g,(a, Networks.label.Syn (ci, mi) (co, mo)),r\\<^esup> L' \\<and>\n          (\\<forall>q<p. (P ! q) (L ! q) s) \\<and> (\\<forall>q<p. (P ! q) (L' ! q) s') \\<and>\n          ci s \\<and> co s \\<and> Some so = mo s \\<and> Some s' = mi so}\n      \"\n      unfolding prod_trans_s_def\n      using finite_state(1) p_gt_0 by fastforce\n    moreover have\n      \"finite \\<dots>\"\n      apply defer_ex\n      apply (mini_existential, simp only: ex_simps)\n      using finite_state(2) apply clarsimp\n      apply (subst finite_Collect_bounded_ex_9)\n\n      subgoal\n        using [[simproc add: finite_Collect]] finite_state' finite_product_1\n        by (auto 4 3 simp: inj_on_def intro: finite_vimageI)[]\n\n      apply safe\n      subgoal for s a b c d e f g h i\n        apply (rule finite_subset[where B =\n              \"(\\<lambda> s'. ((a, s), b, e, f, i, s')) ` { s'. \\<exists> so. Some so = h s \\<and> Some s' = g so}\"\n              ])\n         apply force\n        apply (rule finite_imageI)\n        apply (subst finite_Collect_bounded_ex)\n        by (force intro: Some_finite)+\n      done\n    ultimately show \"finite prod_trans_s\" by (rule finite_subset)\n  qed\n\nend (* End of context for finiteness of automaton *)\n\n  abbreviation \"states' s \\<equiv> Product_TA_Defs.states (N_s s)\"\n\n  lemma N_s_length:\n    \"length (N_s s) = p\"\n    unfolding N_s_def p_def by simp\n\nend (* End locale for product TA definition *)\n\nthm Prod_TA_Defs.N_s_length\n\nlocale Prod_TA_Defs' =\n  Prod_TA_Defs A for A :: \"('a, 'c, 't :: time, 's, 'st) snta\"\nbegin\n\nlemma A_unfold:\n  \"A \\<equiv> (N, P)\"\n  by auto\n\nlemma network_step_delay:\n  assumes step: \"(N, P) \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Del\\<^esub> \\<langle>L', s', u'\\<rangle>\" and len: \"length L = p\"\n  shows \"N_s s \\<turnstile>\\<^sub>N \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>Networks.label.Del\\<^esub> \\<langle>L', u'\\<rangle>\"\n  subgoal\n    using step\n    apply cases\n    subgoal\n      apply simp\n      apply (rule step_n_t)\n      subgoal\n        unfolding N_s_def by (auto simp: inv_of_def)\n      apply assumption\n      done\n    done\n  done\n\nlemma network_step_silent:\n  assumes step: \"(N, P) \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Act a\\<^esub> \\<langle>L', s', u'\\<rangle>\" and len: \"length L = p\"\n  obtains a where \"N_s s \\<turnstile>\\<^sub>N \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>Networks.label.Act a\\<^esub> \\<langle>L', u'\\<rangle>\"\n  subgoal premises prems\n    using step\n    apply cases\n    subgoal\n      apply (rule prems)\n      apply (rule step_n_i)\n      unfolding N_s_def T_s_def by (auto 4 0 simp: trans_of_def inv_of_def len p_def)\n    done\n  done\n\nlemma network_step_sync:\n  assumes step: \"(N, P) \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Syn a\\<^esub> \\<langle>L', s', u'\\<rangle>\" and len: \"length L = p\"\n  obtains a b where \"N_s s \\<turnstile>\\<^sub>N \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>Networks.label.Syn a b\\<^esub> \\<langle>L', u'\\<rangle>\"\n  subgoal premises prems\n    using step\n    apply cases\n    subgoal\n      subgoal premises A\n        apply (rule prems)\n        apply (rule step_n_s)\n                   defer\n                   defer\n                   apply (rule A; fail)\n                  apply (rule A(4); fail)\n        subgoal\n          using A unfolding N_s_def by (auto simp: inv_of_def len)\n                defer\n                defer\n                apply (rule A; fail)\n               apply (rule A(11); fail)\n        using A unfolding N_s_def T_s_def by (auto 4 0 simp: trans_of_def len p_def)\n      done\n    done\n  done\n\nlemma network_step:\n  assumes step: \"(N, P) \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\" and len: \"length L = p\"\n  obtains a where \"N_s s \\<turnstile>\\<^sub>N \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', u'\\<rangle>\"\n  subgoal\n    using step\n    apply (cases a; simp)\n      apply (rule that, erule network_step_delay[OF _ len, simplified])\n     apply (erule network_step_silent[OF _ len, simplified], erule that)\n    apply (erule network_step_sync[OF _ len, simplified], erule that)\n    done\n  done\n\nlemma trans_of_N_s_1:\n  \"(fst ` trans_of (N_s s ! q)) = fst ` fst (N ! q)\" if \"q < p\"\n  using that unfolding trans_of_def N_s_def p_def T_s_def by (auto 0 7 simp: image_iff)\n\nlemma trans_of_N_s_2:\n  \"((snd o snd o snd o snd) ` trans_of (N_s s ! q)) = (snd o snd o snd o snd) ` fst (N ! q)\" if \"q < p\"\n  using that unfolding trans_of_def N_s_def p_def T_s_def by force\n\nlemma\n  \"fst ` trans_of (N_s s ! q) = fst ` trans_of (N_s s' ! q)\" if \"q < p\"\n  using that by (simp add: trans_of_N_s_1)\n\nlemma states'_simp:\n  \"states' s = states' s'\"\n  unfolding Product_TA_Defs.states_def using trans_of_N_s_1 trans_of_N_s_2 by (simp add: N_s_length)\n\n  lemma states_step:\n    \"L' \\<in> states' s\" if \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\" \"L \\<in> states' s\"\n  proof -\n    interpret Product_TA_Defs' \"N_s s\" .\n    from \\<open>L \\<in> _\\<close> have \"L \\<in> states\" .\n    from \\<open>L \\<in> _\\<close> have \"length L = p\" by (simp add: N_s_length states_length)\n    with network_step[folded A_unfold, OF that(1)] obtain a where\n      \"N_s s \\<turnstile>\\<^sub>N \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L',u'\\<rangle>\"\n      by auto\n    then show ?thesis using that(2) by (rule states_step)\n  qed\n\n  lemma states_steps:\n    \"L' \\<in> states' s'\" if \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\" \"L \\<in> states' s\"\n    using that proof (induction A \\<equiv> A _ _ _ _ _ _ rule: steps_sn.induct)\n    case (refl L s u)\n    then show ?case by assumption\n  next\n    case (step L s u L' s' u' L'' s'' u'')\n    with states_step[of L' s' u' L'' s'' u''] states'_simp show ?case by blast\n  qed\n\n  lemma inv_step:\n    \"\\<forall>p<length P. (P ! p) (L' ! p) s'\" if\n    \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\" \"\\<forall>p<length P. (P ! p) (L ! p) s\"\n    using that by (cases) auto\n\n  lemma inv_steps:\n    \"\\<forall>p<length P. (P ! p) (L' ! p) s'\" if\n    \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\" \"\\<forall>p<length P. (P ! p) (L ! p) s\"\n    using that by (induction A \\<equiv> A _ _ _ _ _ _ rule: steps_sn.induct) (auto dest: inv_step)\n\nend\n\n(* Network + valid start state *)\nlocale Prod_TA =\n  Prod_TA_Defs' A for A :: \"('a, 'c, 't :: time, 's, 'st) snta\" +\n  fixes L :: \"'s list\" and s :: 'st\n  assumes states[intro]: \"L \\<in> states' s\"\n  assumes Len: \"length N = length P\"\n      and inv: \"\\<forall>p<length P. (P ! p) (L ! p) s\"\nbegin\n\n  sublocale Product_TA \"N_s s\" L by standard rule\n\n  lemma inv_prod_simp:\n    \"inv_of prod_ta (l, s') = Product_TA_Defs.product_invariant (N_s s') l\" if \"length l = p\"\n    unfolding prod_ta_def prod_invariant_def Product_TA_Defs.product_ta_def N_s_def inv_of_def\n    using that by (simp add: p_def)\n\n  lemma inv_of_N_simp:\n    \"map inv_of (N_s s') ! q = I ! q\" if \"q < p\"\n    using that unfolding inv_of_def N_s_def p_def by simp\n\n  lemma product_inv_prod_simp:\n    \"inv_of prod_ta (l, s') = I' s l\" if \"length l = p\"\n    using that\n    apply (simp add: inv_prod_simp)\n    apply (simp add: N_s_length inv_of_def Product_TA_Defs.product_invariant_def)\n    apply (rule arg_cong[where f = concat])\n    apply (clarsimp cong: map_cong)\n    by (subst inv_of_N_simp; simp)\n\n  lemma product_inv_prod[intro]:\n    \"u \\<turnstile> inv_of prod_ta (l, s')\" if \"u \\<turnstile> inv_of product_ta l\" \"length l = p\"\n    using that by (simp add: product_inv_prod_simp)\n\n  lemma A_simp[simp]:\n    \"N' = N\" \"P' = P\" if \"A = (N', P')\"\n    using that by auto\n\n  lemma length_L[intro]:\n    \"length L = p\"\n    by (simp add: N_s_length)\n\n  lemma prod_complete_delay:\n    assumes step: \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Del\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n    obtains d where \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow>\\<^bsup>d\\<^esup> \\<langle>(L', s'), u'\\<rangle>\"\n  using step proof cases\n    case prems: (step_sn_t N d P)\n    note [simp] = A_simp[OF prems(1)]\n    from prems have \"N_s s \\<turnstile>\\<^sub>N \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>Networks.Del\\<^esub> \\<langle>L', u'\\<rangle>\"\n      unfolding N_s_def by (auto 4 3 simp: inv_of_def intro: step_n_t)\n    with prems show ?thesis\n      by (auto 4 4\n          intro: that\n          simp: product_inv_prod_simp[OF length_L]\n          elim!: product_delay_complete step_t.cases)\n  qed\n\n  lemma prod_complete_silent:\n    assumes step: \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Act a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n    obtains a where \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>(L', s'), u'\\<rangle>\"\n  using step proof cases\n    case prems: (step_sn_i l g c m f l' N q r I)\n    note [simp] = A_simp[OF prems(1)]\n    from prems(13) have [simp]: \"length P = p\" by (simp add: p_def)\n    have \"N_s s \\<turnstile>\\<^sub>N \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>Networks.label.Act (c, m)\\<^esub> \\<langle>L', u'\\<rangle>\"\n      apply (rule step_n_i)\n      using prems unfolding N_s_def T_s_def by (auto 3 0 simp: trans_of_def inv_of_def N_s_length)\n    with \\<open>length P = p\\<close> obtain b where\n      \"product_ta \\<turnstile> \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>(b, Networks.label.Act (c, m))\\<^esub> \\<langle>L', u'\\<rangle>\"\n      by (clarsimp elim!: product_int_complete)\n    with prems inv obtain g r where step:\n      \"((L, s), g, b, r, (L', s')) \\<in> prod_trans_i\"\n      \"u \\<turnstile> g\" \"[r\\<rightarrow>0]u = u'\" \"u' \\<turnstile> inv_of product_ta L'\"\n        apply atomize_elim\n      unfolding prod_trans_i_def by - (erule step_a.cases; auto)\n    then have \"((L, s), g, b, r, (L', s')) \\<in> trans_of prod_ta\"\n      by (simp add: prod_trans_def trans_of_def prod_ta_def)\n    moreover have \"length L' = p\"\n      using length_L prems(8) by auto\n    ultimately show ?thesis\n      apply -\n      apply (rule that)\n      apply rule\n      using step(2-) by force+\n  qed\n\n  lemma prod_complete_sync:\n    assumes step: \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Syn a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n    obtains a where \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>(L', s'), u'\\<rangle>\"\n  using step proof cases\n    case prems: (step_sn_s l1 g1 ci mi f1 l1' N q1 l2 g2 co mo f2 l2' q2 r1 r2 I so)\n    note [simp] = A_simp[OF prems(1)]\n    from prems(21) have [simp]: \"length P = p\" by (simp add: p_def)\n    (* XXX Clean *)\n    have \"N_s s \\<turnstile>\\<^sub>N \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>Networks.label.Syn (ci, mi) (co, mo)\\<^esub> \\<langle>L', u'\\<rangle>\"\n        apply (rule step_n_s)\n                   defer\n                   defer\n                   apply (rule prems; fail)\n                  apply (rule prems(5); fail)\n        subgoal\n          using prems unfolding N_s_def by (auto simp: inv_of_def)\n                defer\n                defer\n                apply (rule prems; fail)\n               apply (rule prems(12); fail)\n        using prems unfolding N_s_def T_s_def by (auto 3 0 simp: trans_of_def p_def N_s_length)\n    with \\<open>length P = p\\<close> obtain a where\n      \"product_ta \\<turnstile> \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>(a, Networks.label.Syn (ci, mi) (co, mo))\\<^esub> \\<langle>L', u'\\<rangle>\"\n      by (auto elim!: product_sync_complete)\n    with prems inv obtain g r where step:\n        \"((L, s), g, a, r, (L', s')) \\<in> prod_trans_s\"\n        \"u \\<turnstile> g\" \"[r\\<rightarrow>0]u = u'\" \"u' \\<turnstile> inv_of product_ta L'\"\n        apply atomize_elim\n      unfolding prod_trans_s_def by - (erule step_a.cases; auto; blast) (* XXX Slow *)\n        (* XXX Simproc for instantiations from equality? *)\n    then have \"((L, s), g, a, r, (L', s')) \\<in> trans_of prod_ta\"\n      by (simp add: prod_trans_def trans_of_def prod_ta_def)\n    moreover have \"length L' = p\"\n      using length_L \\<open>L' = _\\<close> by auto\n    ultimately show ?thesis\n      apply -\n      apply (rule that)\n      apply rule\n      using step(2-) by force+\n  qed\n    \n  lemma prod_complete:\n    assumes step: \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n    shows \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow> \\<langle>(L', s'), u'\\<rangle>\"\n    using step\n    by (cases a; simp; blast elim!: prod_complete_delay prod_complete_silent prod_complete_sync)\n\n  lemma A_unfold:\n    \"A = (N, P)\"\n    by simp\n\n  lemma prod_sound'_delay:\n    assumes step: \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow>\\<^bsup>d\\<^esup> \\<langle>(L', s'), u'\\<rangle>\"\n    shows \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Del\\<^esub> \\<langle>L', s', u'\\<rangle> \\<and> product_ta \\<turnstile> \\<langle>L, u\\<rangle> \\<rightarrow> \\<langle>L', u'\\<rangle>\n           \\<and> (\\<forall>p<length P. (P ! p) (L' ! p) s')\"\n    using assms proof cases\n    case prems: 1\n    then have \"product_ta \\<turnstile> \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsup>d\\<^esup> \\<langle>L', u'\\<rangle>\" unfolding inv_of_simp by fast\n    moreover from product_delay_sound[OF this] prems(1-3) have \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Del\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n      apply simp\n      apply (subst A_unfold)\n      apply (rule step_sn_t)\n      by (auto simp: N_s_def inv_of_def step_t.simps N_s_length p_def Len intro: \\<open>0 \\<le> d\\<close>)\n    ultimately show ?thesis using prems inv by fast\n  qed\n\n  lemma prod_sound'_action:\n    assumes step: \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>(L', s'), u'\\<rangle>\"\n    obtains a where \"(A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle> \\<and> a \\<noteq> Del) \\<and> product_ta \\<turnstile> \\<langle>L, u\\<rangle> \\<rightarrow> \\<langle>L', u'\\<rangle>\n             \\<and> (\\<forall>p<length P. (P ! p) (L' ! p) s')\"\n    using assms\n  proof cases\n    case prems: (1 g r)\n    from Len have [simp]: \"length P = p\" by (simp add: p_def)\n    from prems(1) show ?thesis\n      apply -\n    proof (drule prod_ta_cases, erule disjE, goal_cases)\n      case 1\n      then obtain c m where *:\n        \"Some s' = m s\" \"\\<forall>q<p. (P ! q) (L ! q) s\" \"\\<forall>q<p. (P ! q) (L' ! q) s'\"\n        \"product_ta \\<turnstile> L \\<longrightarrow>\\<^bsup>g,(a, Networks.label.Act (c, m)),r\\<^esup> L'\" \"c s\"\n        unfolding prod_trans_i_def by auto\n      with prems have \"product_ta \\<turnstile> \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>(a, Networks.label.Act (c, m))\\<^esub> \\<langle>L', u'\\<rangle>\"\n        unfolding inv_of_simp by (metis I'_simp step_a.intros)\n      moreover from product_action_sound[OF this] prems(3-4) obtain a where\n        \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Act a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n        apply safe\n        apply (simp add: N_s_def trans_of_def N_s_length T_s_def)\n        apply (simp only: ex_simps[symmetric])\n        apply (erule exE, erule exE)\n        apply (rule that)\n        apply (subst A_unfold)\n        apply (rule step_sn_i)\n                   apply fast\n        using *(3) by (auto simp: N_s_def inv_of_def p_def \\<open>Some s' = m s\\<close> intro: \\<open>c s\\<close>)\n      ultimately show ?thesis using * by (auto intro: that)\n    next\n      case 2\n      then obtain ci co mi mo si where *:\n        \"Some s' = mi si\" \"Some si = mo s\" \"\\<forall>q<p. (P ! q) (L ! q) s\" \"\\<forall>q<p. (P ! q) (L' ! q) s'\"\n        \"product_ta \\<turnstile> L \\<longrightarrow>\\<^bsup>g,(a, Networks.label.Syn (ci, mi) (co, mo)),r\\<^esup> L'\"\n        \"ci s\" \"co s\"\n        unfolding prod_trans_s_def by auto\n      with prems have \"product_ta \\<turnstile> \\<langle>L, u\\<rangle> \\<rightarrow>\\<^bsub>(a, Networks.label.Syn (ci, mi) (co, mo))\\<^esub> \\<langle>L', u'\\<rangle>\"\n        unfolding inv_of_simp by (metis I'_simp step_a.intros)\n      moreover from product_action_sound[OF this] prems(3-4) obtain a where\n        \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Syn a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n        apply safe\n        apply (simp add: N_s_def trans_of_def N_s_length T_s_def)\n        apply (simp only: ex_simps[symmetric])\n        apply (erule exE, erule exE, erule exE, erule exE)\n        apply (rule that)\n        apply (subst A_unfold)\n        apply (rule step_sn_s)\n                           apply fast\n                          apply blast\n        using *(4) by (auto simp: N_s_def inv_of_def p_def \\<open>Some s' = _\\<close> \\<open>Some si = _\\<close> intro: *(6-)) (* Slow *)\n      ultimately show ?thesis using * by (intro that conjI) auto\n    qed\n  qed\n\n  lemma prod_sound':\n    assumes step: \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow> \\<langle>(L', s'), u'\\<rangle>\"\n    obtains a where \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle> \\<and> product_ta \\<turnstile> \\<langle>L, u\\<rangle> \\<rightarrow> \\<langle>L', u'\\<rangle>\n             \\<and> (\\<forall>p<length P. (P ! p) (L' ! p) s')\"\n    using assms apply cases\n     apply (erule prod_sound'_action; blast intro: that)\n    apply (rule that, erule prod_sound'_delay)\n    done\n\n  lemmas prod_sound = prod_sound'[THEN conjunct1]\n  lemmas prod_inv_1 = prod_sound'[THEN conjunct2, THEN conjunct1]\n  lemmas prod_inv_2 = prod_sound'[THEN conjunct2, THEN conjunct2]\n\n  lemma states_prod_step[intro]:\n    \"L' \\<in> states\" if \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow> \\<langle>(L', s'), u'\\<rangle>\"\n    by (blast intro: prod_inv_1[OF that])\n\n  lemma inv_prod_step[intro]:\n    \"\\<forall>p<length P. (P ! p) (L' ! p) s'\" if \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow> \\<langle>(L', s'), u'\\<rangle>\"\n    using that by (blast intro: prod_inv_2)\n\n  lemma prod_steps_sound:\n    assumes step: \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow>* \\<langle>(L', s'), u'\\<rangle>\"\n    shows \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\"\n    using step states inv\n  proof (induction A \\<equiv> prod_ta l \\<equiv> \"(L, s)\" _ l' \\<equiv> \"(L', s')\" _ arbitrary: L s rule: steps.induct)\n    case (refl u)\n    then show ?case by blast\n  next\n    case prems: (step u l' u' u'' L s)\n    obtain L'' s'' where \"l' = (L'', s'')\" by force\n    interpret interp: Prod_TA A L s by (standard; rule prems Len)\n    from prems(3)[OF \\<open>l' = _\\<close>] prems(1,2,4-) have *: \"A \\<turnstile> \\<langle>L'', s'', u'\\<rangle> \\<rightarrow>* \\<langle>L', s', u''\\<rangle>\"\n      unfolding \\<open>l' = _\\<close>\n      by (metis Prod_TA_Defs'.states'_simp interp.states_prod_step interp.inv_prod_step)\n    show ?case\n      using * prems by (auto simp: \\<open>l' = _\\<close> intro: interp.prod_sound stepI2)\n  qed\n\n  lemma prod_steps_complete:\n    \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow>* \\<langle>(L', s'), u'\\<rangle>\" if \"A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\"\n    using that states inv proof (induction A \\<equiv> A L _ _ _ _ _ rule: steps_sn.induct)\n    case (refl L s u)\n    then show ?case by blast\n  next\n    case prems: (step L s u L' s' u' L'' s'' u'')\n    interpret interp: Prod_TA A L' s' apply standard\n      using prems by - (assumption | rule Prod_TA_Defs'.states_steps Len Prod_TA_Defs'.inv_steps)+\n    from prems show ?case by - (rule steps_altI, auto intro!: interp.prod_complete)\n  qed\n\n  lemma prod_correct:\n    \"prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow>* \\<langle>(L', s'), u'\\<rangle> \\<longleftrightarrow> A \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\"\n    by (metis prod_steps_complete prod_steps_sound)\n\n  end (* End context: network + valid start state *)\n\nend (* End of theory *)\n", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Networks/State_Networks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3434701827220722}}
{"text": "theory BPlusTree_ImpSet\n  imports\n    BPlusTree_Set\n    BPlusTree_ImpSplit\n    \"HOL-Real_Asymp.Inst_Existentials\"\nbegin\n\nsection \"Imperative Set operations\"\n\nsubsection \"Auxiliary operations\"\n\n\ntext \"This locale extends the abstract split locale,\nassuming that we are provided with an imperative program\nthat refines the abstract split function.\"\n\n\n(* TODO separate into split_tree and split + split_list  *)\nlocale split\\<^sub>i_set = abs_split_set: split_set split + split\\<^sub>i_tree split split\\<^sub>i\n  for split::\n    \"('a bplustree \\<times> 'a::{heap,default,linorder,order_top}) list \\<Rightarrow> 'a\n       \\<Rightarrow> ('a bplustree \\<times> 'a) list \\<times> ('a bplustree \\<times> 'a) list\" \n  and split\\<^sub>i :: \"('a btnode ref option \\<times> 'a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> 'a \\<Rightarrow> nat Heap\" +\n  fixes isin_list\\<^sub>i:: \"'a \\<Rightarrow> ('a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> bool Heap\"\n    and ins_list\\<^sub>i:: \"'a \\<Rightarrow> ('a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> 'a pfarray Heap\"\n    and del_list\\<^sub>i:: \"'a \\<Rightarrow> ('a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> 'a pfarray Heap\"\n  assumes isin_list_rule [sep_heap_rules]:\"sorted_less ks \\<Longrightarrow>\n   <is_pfa c ks (a',n')> \n    isin_list\\<^sub>i x (a',n') \n  <\\<lambda>b. \n    is_pfa c ks (a',n')\n    * \\<up>(isin_list x ks = b)>\\<^sub>t\"\n  and ins_list_rule [sep_heap_rules]:\"sorted_less ks' \\<Longrightarrow>\n   <is_pfa c ks' (a',n')>\n    ins_list\\<^sub>i x (a',n') \n  <\\<lambda>(a'',n'').  is_pfa (max c (length (insert_list x ks'))) (insert_list x ks') (a'',n'') >\\<^sub>t\"\n  and del_list_rule [sep_heap_rules]:\"sorted_less ks'' \\<Longrightarrow>\n   <is_pfa c ks'' (a',n')> \n    del_list\\<^sub>i x (a',n') \n  <\\<lambda>(a'',n''). is_pfa c (delete_list x ks'') (a'',n'') >\\<^sub>t\"\nbegin\n\nsubsection \"Initialization\"\n\ndefinition empty\\<^sub>i ::\"nat \\<Rightarrow> 'a btnode ref Heap\"\n  where \"empty\\<^sub>i k = do {\n  empty_list \\<leftarrow> pfa_empty (2*k);\n  empty_leaf \\<leftarrow> ref (Btleaf empty_list None);\n  return empty_leaf\n}\"\n\nlemma empty\\<^sub>i_rule:\n  shows \"<emp>\n  empty\\<^sub>i k\n  <\\<lambda>r. bplustree_assn k (abs_split_set.empty_bplustree) r (Some r) None>\"\n  apply(subst empty\\<^sub>i_def)\n  apply(sep_auto simp add: abs_split_set.empty_bplustree_def)\n  done\n\nsubsection \"Membership\"\n\n(* TODO introduce imperative equivalents to searching/inserting/deleting in a list *)\npartial_function (heap) isin\\<^sub>i :: \"'a btnode ref \\<Rightarrow> 'a \\<Rightarrow>  bool Heap\"\n  where\n    \"isin\\<^sub>i p x = do {\n  node \\<leftarrow> !p;\n  (case node of\n     Btleaf xs _ \\<Rightarrow> isin_list\\<^sub>i x xs |\n     Btnode ts t \\<Rightarrow> do {\n       i \\<leftarrow> split\\<^sub>i ts x;\n       tsl \\<leftarrow> pfa_length ts;\n       if i < tsl then do {\n         s \\<leftarrow> pfa_get ts i;\n         let (sub,sep) = s in\n           isin\\<^sub>i (the sub) x\n       } else\n           isin\\<^sub>i t x\n    }\n)}\"\n\nlemma nth_zip_zip:\n  assumes \"length ys = length xs\"\n    and \"length zs = length xs\"\n    and \"zs1 @ ((suba', x), sepa') # zs2 =\n    zip (zip ys xs) zs\"\n  shows \"suba' = ys ! length zs1 \\<and>\n         sepa' = zs ! length zs1 \\<and>\n         x = xs ! length zs1\"\nproof -\n  obtain suba'' x' sepa'' where \"zip (zip ys xs) zs ! length zs1 = ((suba'', x'), sepa'')\"\n    by (metis surj_pair)\n  moreover have \"((suba'', x'), sepa'')  = ((suba', x), sepa')\"\n    by (metis calculation assms(3) nth_append_length)\n  moreover have \"length zs1 < length xs\"\n  proof - \n    have \"length (zip (zip ys xs) zs) = length xs\"\n      by (simp add: assms(1,2))\n    then have \"length zs1 + 1 + length zs2 = length xs\"\n      by (metis assms(1,3) group_cancel.add1 length_Cons length_append plus_1_eq_Suc)\n    then show ?thesis\n    by (simp add: assms(1))\n  qed\n  ultimately show ?thesis\n    using assms(1,2) by auto\nqed\n\n\nlemma  \"k > 0 \\<Longrightarrow> root_order k t \\<Longrightarrow> sorted_less (inorder t) \\<Longrightarrow> sorted_less (leaves t) \\<Longrightarrow>\n   <bplustree_assn k t ti r z>\n     isin\\<^sub>i ti x\n   <\\<lambda>y. bplustree_assn k t ti r z * \\<up>(abs_split_set.isin t x = y)>\\<^sub>t\"\nproof(induction t x arbitrary: ti r z rule: abs_split_set.isin.induct)\n  case (1 x r z)\n  then show ?case\n    apply(subst isin\\<^sub>i.simps)\n    apply sep_auto\n    done\nnext\n  case (2 ts t x ti r z)\n   obtain ls rs where list_split[simp]: \"split ts x = (ls,rs)\"\n     by (cases \"split ts x\")\n  moreover have ts_non_empty: \"length ts > 0\"\n    using \"2.prems\"(2) root_order.simps(2) by blast\n  moreover have \"sorted_less (separators ts)\"\n    using \"2.prems\"(3) sorted_inorder_separators by blast\n  ultimately show ?case\n  proof (cases rs)\n    (* NOTE: induction condition trivial here *)\n    case [simp]: Nil\n    show ?thesis\n      apply(subst isin\\<^sub>i.simps)\n      using ts_non_empty  apply(sep_auto)\n      subgoal  using \\<open>sorted_less (separators ts)\\<close> by blast\n      apply simp\n      apply sep_auto\n        apply(rule hoare_triple_preI)\n      apply (sep_auto)\n      subgoal for a b ti tsi' rs x sub sep\n        apply(auto simp add: split_relation_alt is_pfa_def dest!:  mod_starD list_assn_len)[]\n        done\n      thm \"2.IH\"(1)[of ls \"[]\"]\n      using 2(3) apply(sep_auto heap: \"2.IH\"(1)[of ls \"[]\"] simp add: sorted_wrt_append)\n      subgoal\n        using \"2.prems\"(2) order_impl_root_order\n        by (auto simp add: split_relation_alt is_pfa_def dest!:  mod_starD list_assn_len)[]\n      subgoal \n        using \"2.prems\"(3) sorted_inorder_induct_last\n        by (auto simp add: split_relation_alt is_pfa_def dest!:  mod_starD list_assn_len)[]\n      subgoal using \"2\"(6) sorted_leaves_induct_last\n        by (auto simp add: split_relation_alt is_pfa_def dest!:  mod_starD list_assn_len)[]\n      using 2(3) apply(sep_auto heap: \"2.IH\"(1)[of ls \"[]\"] simp add: sorted_wrt_append)\n      done\n  next\n    case [simp]: (Cons h rrs)\n    obtain sub sep where h_split[simp]: \"h = (sub,sep)\"\n      by (cases h)\n      then show ?thesis\n        apply(simp split: list.splits prod.splits)\n        apply(subst isin\\<^sub>i.simps)\n        using \"2.prems\" sorted_inorder_separators \n        apply(sep_auto)\n          (* simplify towards induction step *)\n         apply(auto simp add: split_relation_alt list_assn_append_Cons_left dest!: mod_starD list_assn_len)[]\n(* NOTE show that z = (suba, sepa)  -- adjusted since we now contain also current pointers and forward pointers *)\n         apply(rule norm_pre_ex_rule)+\n         apply(rule hoare_triple_preI)\n        subgoal for tsi n ti tsi' pointers suba sepa zs1 z zs2\n          apply(cases z)\n          subgoal for subacomb sepa'\n            apply(cases subacomb)\n            subgoal for suba' subp subfwd\n          apply(subgoal_tac \"z = ((suba, subp, subfwd), sepa)\", simp)\n          thm \"2.IH\"(2)[of ls rs h rrs sub sep \"(the suba')\" subp subfwd]\n          using 2(3,4,5,6) apply(sep_auto\n              heap:\"2.IH\"(2)[of ls rs h rrs sub sep \"the suba'\" subp subfwd]\n              simp add: sorted_wrt_append)\n          using list_split Cons h_split apply simp_all\n          subgoal \n            by (meson \"2.prems\"(1) order_impl_root_order)\n          subgoal\n            apply(rule impI)\n            apply(inst_ex_assn \"(tsi,n)\" \"ti\" \"tsi'\" \"(zs1 @ ((suba', subp, subfwd), sepa') # zs2)\" \"pointers\" \"zs1\" \"z\" \"zs2\")\n              (* proof that previous assumptions hold later *)\n             apply sep_auto\n            done\n          subgoal\n            (* prove subgoal_tac assumption *)\n            using nth_zip_zip[of \"subtrees tsi'\" \"zip (r # butlast pointers) pointers\" \"separators tsi'\" zs1 suba' \"(subp, subfwd)\" sepa' zs2]\n             apply(auto simp add: split_relation_alt list_assn_append_Cons_left dest!: mod_starD list_assn_len)[]\n          done\n        done\n      done\n    done\n      (* eliminate last vacuous case *)\n  apply(rule hoare_triple_preI)\n  apply(auto simp add: split_relation_def dest!: mod_starD list_assn_len)[]\n  done\n  qed\nqed\n\nsubsection \"Insertion\"\n\n\ndatatype 'c btupi = \n  T\\<^sub>i \"'c btnode ref\" |\n  Up\\<^sub>i \"'c btnode ref\" \"'c\" \"'c btnode ref\"\n\nfun btupi_assn where\n  \"btupi_assn k (abs_split_set.T\\<^sub>i l) (T\\<^sub>i li) r z =\n   bplustree_assn k l li r z\" |\n(*TODO ai is not necessary not in the heap area of li *)\n  \"btupi_assn k (abs_split_set.Up\\<^sub>i l a r) (Up\\<^sub>i li ai ri) r' z' =\n   (\\<exists>\\<^sub>A newr. bplustree_assn k l li r' newr * bplustree_assn k r ri newr z' * id_assn a ai)\" |\n  \"btupi_assn _ _ _ _ _ = false\"\n\n\n(* TODO take in a pointer ot a btnode instead, only create one new node *)\ndefinition node\\<^sub>i :: \"nat \\<Rightarrow> 'a btnode ref \\<Rightarrow> 'a btupi Heap\" where\n  \"node\\<^sub>i k p \\<equiv> do {\n    pt \\<leftarrow> !p;\n    let a = kvs pt; ti = lst pt in do {\n    n \\<leftarrow> pfa_length a;\n    if n \\<le> 2*k then do {\n      a' \\<leftarrow> pfa_shrink_cap (2*k) a;\n      p := Btnode a' ti;\n      return (T\\<^sub>i p)\n    }\n    else do {\n      b \\<leftarrow> (pfa_empty (2*k) :: ('a btnode ref option \\<times> 'a) pfarray Heap);\n      i \\<leftarrow> split_half a;\n      m \\<leftarrow> pfa_get a (i-1);\n      b' \\<leftarrow> pfa_drop a i b;\n      a' \\<leftarrow> pfa_shrink (i-1) a;\n      a'' \\<leftarrow> pfa_shrink_cap (2*k) a';\n      let (sub,sep) = m in do {\n        p := Btnode a'' (the sub);\n        r \\<leftarrow> ref (Btnode b' ti);\n        return (Up\\<^sub>i p sep r)\n      }\n    }\n  }\n}\"\n\ndefinition Lnode\\<^sub>i :: \"nat \\<Rightarrow> 'a btnode ref  \\<Rightarrow> 'a btupi Heap\" where\n  \"Lnode\\<^sub>i k p \\<equiv> do {\n    pt \\<leftarrow> !p;\n    let a = vals pt; nxt = fwd pt in do {\n    n \\<leftarrow> pfa_length a;\n    if n \\<le> 2*k then do {\n      a' \\<leftarrow> pfa_shrink_cap (2*k) a;\n      p := Btleaf a' nxt;\n      return (T\\<^sub>i p)\n    }\n    else do {\n      b \\<leftarrow> (pfa_empty (2*k) :: 'a pfarray Heap);\n      i \\<leftarrow> split_half a;\n      m \\<leftarrow> pfa_get a (i-1);\n      b' \\<leftarrow> pfa_drop a i b;\n      a' \\<leftarrow> pfa_shrink i a;\n      a'' \\<leftarrow> pfa_shrink_cap (2*k) a';\n      r \\<leftarrow> ref (Btleaf b' nxt);\n      p := Btleaf a'' (Some r);\n      return (Up\\<^sub>i p m r)\n    }\n  }\n}\"\n\n(* TODO Lnode\\<^sub>i allocates a new node when invoked, do not invoke if array didn't grow *)\npartial_function (heap) ins\\<^sub>i :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a btnode ref \\<Rightarrow> 'a btupi Heap\"\n  where\n    \"ins\\<^sub>i k x p = do {\n  node \\<leftarrow> !p;\n  (case node of\n    Btleaf ksi nxt \\<Rightarrow> do {\n      ksi' \\<leftarrow> ins_list\\<^sub>i x ksi; \n      p := Btleaf ksi' nxt;\n      Lnode\\<^sub>i k p\n    } |\n    Btnode tsi ti \\<Rightarrow> do {\n      i \\<leftarrow> split\\<^sub>i tsi x;\n      tsl \\<leftarrow> pfa_length tsi;\n      if i < tsl then do {\n        s \\<leftarrow> pfa_get tsi i;\n        let (sub,sep) = s in do {\n          r \\<leftarrow> ins\\<^sub>i k x (the sub);\n          case r of (T\\<^sub>i lp) \\<Rightarrow> do {\n            pfa_set tsi i (Some lp,sep);\n            return (T\\<^sub>i p)\n          } |\n          (Up\\<^sub>i lp x' rp) \\<Rightarrow> do {\n            pfa_set tsi i (Some rp,sep);\n            tsi' \\<leftarrow> pfa_insert_grow tsi i (Some lp,x');\n            p := Btnode tsi' ti;\n            node\\<^sub>i k p\n          }\n        }\n      }\n      else do {\n        r \\<leftarrow> ins\\<^sub>i k x ti;\n        case r of (T\\<^sub>i lp) \\<Rightarrow> do {\n            p := (Btnode tsi lp);\n            return (T\\<^sub>i p)\n        } | (Up\\<^sub>i lp x' rp) \\<Rightarrow> do { \n            tsi' \\<leftarrow> pfa_append_grow' tsi (Some lp,x');\n            p := Btnode tsi' rp;\n            node\\<^sub>i k p\n        }\n      }\n  }\n)}\"\n\n\n(*fun tree\\<^sub>i::\"'a up\\<^sub>i \\<Rightarrow> 'a bplustree\" where\n  \"tree\\<^sub>i (T\\<^sub>i sub) = sub\" |\n  \"tree\\<^sub>i (Up\\<^sub>i l a r) = (Node [(l,a)] r)\" \n\nfun insert::\"nat \\<Rightarrow> 'a \\<Rightarrow> 'a bplustree \\<Rightarrow> 'a bplustree\" where\n  \"insert k x t = tree\\<^sub>i (ins k x t)\"\n*)\n\ndefinition insert\\<^sub>i :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a btnode ref \\<Rightarrow> 'a btnode ref Heap\" where\n  \"insert\\<^sub>i \\<equiv> \\<lambda>k x ti. do {\n  ti' \\<leftarrow> ins\\<^sub>i k x ti;\n  case ti' of\n     T\\<^sub>i sub \\<Rightarrow> return sub |\n     Up\\<^sub>i l a r \\<Rightarrow> do {\n        kvs \\<leftarrow> pfa_init (2*k) (Some l,a) 1;\n        t' \\<leftarrow> ref (Btnode kvs r);\n        return t'\n      }\n}\"\n\n\nlemma take_butlast_prepend: \"take n (butlast (r # pointers)) =\n       butlast (r # take n pointers)\"\n  apply (cases \"length pointers > n\")\n  by (simp_all add: butlast_take take_Cons' take_butlast)\n\nlemma take_butlast_append: \"take n (butlast (xs @ x # ys)) =\n       take n (xs @ (butlast (x#ys)))\"\n  by (auto simp add: butlast_append)\n\nlemma map_eq_nth_eq_diff:\n  assumes A: \"map f l = map g l'\"\n  and B: \"i < length l\"\n  shows \"f (l!i) = g (l'!i)\"\nproof -\n  from A have \"length l = length l'\"\n    by (metis length_map)\n  thus ?thesis using A B\n    apply (induct l l' arbitrary: i rule: list_induct2)\n      apply (simp)\n    subgoal for x xs y ys i\n      apply(cases i)\n      apply(simp add: nth_def)\n      apply simp\n      done\n    done\nqed\n\nlemma \"BPlusTree_Split.split_half ts = (ls,rs) \\<Longrightarrow> length ls = Suc (length ts) div 2\"\n  by (metis Suc_eq_plus1 split_half_conc)\n\nlemma take_half_less: \"take (Suc (length ts) div 2) ts = ls @ [(sub, sep)] \\<Longrightarrow> length ls < length ts\"\nproof -\n  assume \" take (Suc (length ts) div 2) ts = ls @ [(sub, sep)]\"\n  then have \"ts \\<noteq> []\"\n    by force\n  then have \"Suc (length ts) div 2 \\<le> length ts\"\n    by linarith\n  then have \"length (take (Suc (length ts) div 2) ts) \\<le> length ts\" \n    by simp\n  moreover have \"length ls < length (take (Suc (length ts) div 2) ts)\"\n    by (simp add: \\<open>take (Suc (length ts) div 2) ts = ls @ [(sub, sep)]\\<close>)\n  ultimately show \"length ls < length ts\"\n    by linarith\nqed\n\ndeclare abs_split_set.node\\<^sub>i.simps [simp add]\ndeclare last.simps[simp del] butlast.simps[simp del]\nlemma node\\<^sub>i_rule: assumes c_cap: \"2*k \\<le> c\" \"c \\<le> 4*k+1\"\n    and \"length tsi' = length pointers\"\n    and \"tsi'' = zip (zip (map fst tsi') (zip (butlast (r#pointers)) (butlast (pointers@[z])))) (map snd tsi')\"\n  shows \"<p \\<mapsto>\\<^sub>r Btnode (a,n) ti * is_pfa c tsi' (a,n) * blist_assn k ts tsi'' * bplustree_assn k t ti (last (r#pointers)) z>\n  node\\<^sub>i k p\n  <\\<lambda>u. btupi_assn k (abs_split_set.node\\<^sub>i k ts t) u r z>\\<^sub>t\"\nproof (cases \"length ts \\<le> 2*k\")\n  case [simp]: True\n  then show ?thesis\n    apply(subst node\\<^sub>i_def)\n    apply(rule hoare_triple_preI)\n    apply(sep_auto)\n    subgoal by (sep_auto simp add: is_pfa_def)[]\n    subgoal using c_cap by (sep_auto simp add: is_pfa_def)[]\n    subgoal using assms(3,4) by (sep_auto)\n    subgoal \n      apply(subgoal_tac \"length ts = length tsi'\")\n    subgoal using True by (sep_auto)\n    subgoal using True assms by (sep_auto dest!: mod_starD list_assn_len)\n    done\n  done\nnext\n  case [simp]: False\n  then obtain ls sub sep rs where      \n    split_half_eq: \"BPlusTree_Split.split_half ts = (ls@[(sub,sep)],rs)\"\n    using abs_split_set.node\\<^sub>i_cases by blast\n  then show ?thesis\n    apply(subst node\\<^sub>i_def)\n    apply(rule hoare_triple_preI)\n    apply sep_auto\n    subgoal by (sep_auto simp add:  split_relation_alt split_relation_length is_pfa_def dest!: mod_starD list_assn_len)\n    subgoal using assms by (sep_auto dest!: mod_starD list_assn_len)\n    subgoal\n      apply(subgoal_tac \"length ts = length tsi'\")\n      subgoal using False by (sep_auto dest!: mod_starD list_assn_len)\n      subgoal using assms(3,4) by (sep_auto dest!: mod_starD list_assn_len)\n      done\n    apply sep_auto\n    subgoal using c_cap by (sep_auto simp add: is_pfa_def)[]\n    subgoal using c_cap by (sep_auto simp add: is_pfa_def)[]\n    using c_cap apply sep_auto\n    subgoal using c_cap by (sep_auto simp add: is_pfa_def)[]\n    subgoal using c_cap by (sep_auto simp add: is_pfa_def)[]\n    using c_cap apply simp\n    apply(rule hoare_triple_preI)\n    apply(vcg)\n    apply(simp add: split_relation_alt)\n    apply(rule impI)+\n    subgoal for  _ _ rsia subi' sepi' rsin lsi _\n      supply R = append_take_drop_id[of \"(length ls)\" ts,symmetric]\n      thm R\n      apply(subst R)\n      supply R = Cons_nth_drop_Suc[of \"length ls\" ts, symmetric]\n      thm R\n      apply(subst R)\n      subgoal\n        by (meson take_half_less)\n     supply R=list_assn_append_Cons_left[where xs=\"take (length ls) ts\" and ys=\"drop (Suc (length ls)) ts\" and x=\"ts ! (length ls)\"]\n      thm R\n      apply(subst R)\n      apply(auto)[]\n      apply(rule ent_ex_preI)+\n      apply(subst ent_pure_pre_iff; rule impI)\n      apply (simp add: prod_assn_def split!: prod.splits)\n      subgoal for tsi''l subi'' subir subinext sepi'' tsi''r sub' sep'\n        (* instantiate right hand side *)\n(* newr is the first leaf of the tree directly behind sub\n  and (r#pointers) is the list of all first leafs of the tree in this node\n   \\<rightarrow> the pointer at position of sub in pointers\n      or the pointer at position of sub+1 in (r#pointers)\n*)\n      (* Suc (length tsi') div 2 - Suc 0) = length ls *)\n        apply(inst_ex_assn \"subinext\" \"(rsia,rsin)\" ti\n        \"drop (length ls+1) tsi'\"\n        \"drop (length ls+1) tsi''\"\n        \"drop (length ls+1) pointers\"\n        lsi\n        \"the subi'\"\n        \"take (length ls) tsi'\"\n        \"take (length ls) tsi''\"\n        \"take (length ls) pointers\"\n      )\n      apply (sep_auto)\n      subgoal using assms(3) by linarith\n      subgoal \n        using assms(3,4) by (auto dest!: mod_starD \n          simp add: take_map[symmetric] take_zip[symmetric] take_butlast_prepend[symmetric]\n      )\n         subgoal using assms(3,4) by (auto dest!: mod_starD      \n          simp add: list_assn_prod_map id_assn_list_alt)\n         subgoal \n           apply(subgoal_tac \"length ls < length pointers\")\n           apply(subgoal_tac \"subinext = pointers ! (length ls)\")\n           subgoal\n        using assms(3,4) apply (auto \n          simp add: drop_map[symmetric] drop_zip[symmetric] drop_butlast[symmetric] Cons_nth_drop_Suc\n      )[]\n           supply R = drop_Suc_Cons[where n=\"length ls\" and xs=\"butlast pointers\" and x=r, symmetric]\n           thm R\n           apply(simp only: R drop_zip[symmetric])\n           apply (simp add: last.simps butlast.simps)\n           done\n        subgoal apply(auto dest!: mod_starD list_assn_len)     \n        proof (goal_cases)\n        case 1\n        have \"length ls < length tsi''\"\n          using assms(3,4) \"1\" by auto\n        moreover have \"subinext = snd (snd (fst (tsi'' ! length ls)))\"\n          using 1 calculation by force\n        ultimately have \"subinext = map snd (map snd (map fst tsi'')) ! length ls\"\n          by auto\n        then show ?case\n          using assms(3,4) by auto\n      qed\n          subgoal  apply(auto dest!: mod_starD  list_assn_len)\n        proof (goal_cases)\n          case 1 \n          then have \"length ls  < length ts\"\n            by (simp)\n          moreover have \"length ts = length tsi''\"\n            by (simp add: 1)\n          moreover have \"\\<dots> = length pointers\"\n            using assms(3,4) by auto\n          ultimately show ?case by simp\n        qed\n      done\n    apply(rule entails_preI)\n      (* introduce some simplifying equalities *)\n        apply(subgoal_tac \"Suc (length tsi') div 2 = length ls + 1\")\n     prefer 2 subgoal \n        apply(auto dest!: mod_starD  list_assn_len)     \n        proof (goal_cases)\n          case 1\n          have \"length tsi' = length tsi''\"\n            using assms(3,4) by auto\n          also have \"\\<dots> = length ts\"\n            by (simp add: 1)\n          finally show ?case \n            using 1\n            by (metis Suc_eq_plus1 abs_split_set.length_take_left div2_Suc_Suc length_append length_append_singleton numeral_2_eq_2)\n        qed\n    apply(subgoal_tac \"length ts = length tsi''\")\n        prefer 2 subgoal using assms(3,4) by (auto dest!: mod_starD  list_assn_len)     \n    apply(subgoal_tac \"(sub', sep') = (sub, sep)\")\n        prefer 2 subgoal\n        by (metis One_nat_def Suc_eq_plus1 Suc_length_conv abs_split_set.length_take_left length_0_conv length_append less_add_Suc1 nat_arith.suc1 nth_append_length nth_take)\n      apply(subgoal_tac \"length ls = length tsi''l\")\n        prefer 2 subgoal by (auto dest!: mod_starD list_assn_len)\n    apply(subgoal_tac \"(subi'', sepi'') = (subi', sepi')\")\n      prefer 2 subgoal\n        using assms(3,4) apply (auto dest!: mod_starD list_assn_len)\n      proof (goal_cases)\n        case 1\n        then have \"tsi'' ! length tsi''l =  ((subi'', subir, subinext), sepi'')\"\n          by auto\n        moreover have \"length tsi''l < length tsi''\"\n          by (simp add: 1)\n        moreover have \"length tsi''l < length tsi'\"\n          using \"1\" assms(3) by linarith\n        ultimately have\n            \"fst (fst (tsi'' ! length tsi''l)) = fst (tsi' ! length tsi''l)\"\n            \"snd (tsi'' ! length tsi''l) = snd (tsi' ! length tsi''l)\"\n          using assms(4) by auto\n        then show ?case\n          by (simp add: \"1\" \\<open>tsi'' ! length tsi''l = ((subi'', subir, subinext), sepi'')\\<close>)\n        case 2\n        then show ?case\n          by (metis \\<open>snd (tsi'' ! length tsi''l) = snd (tsi' ! length tsi''l)\\<close> \\<open>tsi'' ! length tsi''l = ((subi'', subir, subinext), sepi'')\\<close> snd_conv)\n      qed\n    apply(subgoal_tac \"(last (r # take (length ls) pointers)) = subir\")\n      prefer 2 subgoal\n        using assms(3) apply (auto dest!: mod_starD list_assn_len)\n      proof (goal_cases)\n        case 1\n        have \"length tsi''l < length tsi''\"\n          by (simp add: 1)\n        then have \"fst (snd (fst (tsi'' ! length tsi''l))) = subir\"\n          using 1 assms(4) by auto\n        moreover have \"map fst (map snd (map fst tsi'')) = butlast (r#pointers)\"\n          using assms(3,4) by auto\n        moreover have \"(last (r#take (length ls) pointers)) = butlast (r#pointers) ! (length tsi''l)\"\n          by (smt (z3) \"1\" One_nat_def Suc_eq_plus1 Suc_to_right abs_split_set.length_take_left append_butlast_last_id div_le_dividend le_add2 length_butlast length_ge_1_conv length_take lessI list.size(4) min_eq_arg(2) nth_append_length nth_take nz_le_conv_less take_Suc_Cons take_butlast_conv)\n        ultimately show ?case\n          using 1 apply auto\n          by (metis (no_types, opaque_lifting) 1 length_map map_map nth_append_length)\n      qed\n    apply(subgoal_tac \"(last (subinext # drop (Suc (length tsi''l)) pointers)) = last (r#pointers)\")\n       prefer 2 subgoal\n        using assms(3) apply (auto dest!: mod_starD list_assn_len)\n      proof (goal_cases)\n        case 1\n        have \"length tsi''l < length tsi''\"\n          using 1 by auto\n        moreover have \"subinext = snd (snd (fst (tsi'' ! length tsi''l)))\"\n          using \"1\" calculation by force\n        ultimately have \"subinext = map snd (map snd (map fst tsi'')) ! length tsi''l\"\n          by auto\n        then have \"subinext = pointers ! length tsi''l\" \n          using assms(3,4) by auto\n        then have \"(subinext # drop (Suc (length tsi''l)) pointers) = drop (length tsi''l) pointers\"\n          by (metis 1 Cons_nth_drop_Suc Suc_eq_plus1 Suc_to_right abs_split_set.length_take_left div_le_dividend le_add1 less_Suc_eq nz_le_conv_less take_all_iff zero_less_Suc)\n        moreover have \"last (drop (length tsi''l) pointers) = last pointers\"\n          using \\<open>length tsi''l < length tsi''\\<close>  1 by force\n        ultimately show ?case\n          by (auto simp add: last.simps butlast.simps)\n      qed\n    apply(subgoal_tac \"take (length tsi''l) ts = ls\")\n      prefer 2 subgoal\n        by (metis append.assoc append_eq_conv_conj append_take_drop_id)\n    apply(subgoal_tac \"drop (Suc (length tsi''l)) ts = rs\")\n      prefer 2 subgoal by (metis One_nat_def Suc_eq_plus1 Suc_length_conv append_eq_conv_conj append_take_drop_id length_0_conv length_append)\n    subgoal by (sep_auto)\n    done\n  done\n  done\nqed\ndeclare last.simps[simp add] butlast.simps[simp add]\ndeclare abs_split_set.node\\<^sub>i.simps [simp del]\n\ndeclare abs_split_set.Lnode\\<^sub>i.simps [simp add]\nlemma Lnode\\<^sub>i_rule:\n  assumes \"k > 0 \" \"r = Some a\" \"2*k \\<le> c\" \"c \\<le> 4*k\"\n  shows \"<a \\<mapsto>\\<^sub>r (Btleaf xsi z) * is_pfa c xs xsi>\n  Lnode\\<^sub>i k a\n  <\\<lambda>a. btupi_assn k (abs_split_set.Lnode\\<^sub>i k xs) a r z>\\<^sub>t\"\nproof (cases \"length xs \\<le> 2*k\")\n  case [simp]: True\n  then show ?thesis\n    apply(subst Lnode\\<^sub>i_def)\n      apply(rule hoare_triple_preI; simp)\n    using assms apply(sep_auto eintros del: exI heap add: pfa_shrink_cap_rule)\n    subgoal for _ _ aaa ba\n      apply(inst_existentials aaa ba z)\n      apply simp_all\n      done\n    subgoal\n      apply(rule hoare_triple_preI)\n      using True apply (auto dest!: mod_starD list_assn_len)+\n      done\n    done\nnext\n  case [simp]: False\n  then obtain ls sep rs where\n    split_half_eq: \"BPlusTree_Split.split_half xs = (ls@[sep],rs)\"\n    using abs_split_set.Lnode\\<^sub>i_cases by blast\n  then show ?thesis\n    apply(subst Lnode\\<^sub>i_def)\n    apply auto\n    using assms apply (vcg heap add: pfa_shrink_cap_rule; simp)\n      apply(rule hoare_triple_preI)\n      apply (sep_auto heap add: pfa_drop_rule simp add: split_relation_alt\n              dest!: mod_starD list_assn_len)\n\n    subgoal by (sep_auto simp add: is_pfa_def split!: prod.splits)\n    subgoal by (sep_auto simp add: is_pfa_def split!: prod.splits)\n    apply(sep_auto)\n    subgoal by (sep_auto simp add: is_pfa_def split!: prod.splits)\n    subgoal by (sep_auto simp add: is_pfa_def split!: prod.splits)\n    apply(sep_auto eintros del: exI)\n    subgoal for  _ _ _ _ rsa rn lsa ln newr\n        (* instantiate right hand side *)\n      apply(inst_existentials \"Some newr\"\n             rsa rn  z\n             lsa ln \"Some newr\"\n            )\n        (* introduce equality between equality of split tsi/ts and original lists *)\n      apply(simp_all add: pure_def)\n      apply(sep_auto dest!: mod_starD)\n      apply(subgoal_tac \"Suc (length xs) div 2 = Suc (length ls)\")\n      apply(subgoal_tac \"xs = take (Suc (length ls)) xs @  drop (Suc (length ls)) xs\")\n      subgoal \n        by (metis nth_append_length)\n      subgoal by auto\n      subgoal by auto\n      subgoal by sep_auto\n      done\n    done\nqed\ndeclare abs_split_set.Lnode\\<^sub>i.simps [simp del]\n\nlemma Lnode\\<^sub>i_rule_tree:\n  assumes \"k > 0\"\n  shows \"<bplustree_assn k (Leaf xs) a r z>\n  Lnode\\<^sub>i k a\n  <\\<lambda>a. btupi_assn k (abs_split_set.Lnode\\<^sub>i k xs) a r z>\\<^sub>t\"\n    using assms by (sep_auto heap add: Lnode\\<^sub>i_rule)\n\nlemma node\\<^sub>i_no_split: \"length ts \\<le> 2*k \\<Longrightarrow> abs_split_set.node\\<^sub>i k ts t = abs_split_set.T\\<^sub>i (Node ts t)\"\n  by (simp add: abs_split_set.node\\<^sub>i.simps)\n\nlemma Lnode\\<^sub>i_no_split: \"length ts \\<le> 2*k \\<Longrightarrow> abs_split_set.Lnode\\<^sub>i k ts = abs_split_set.T\\<^sub>i (Leaf ts)\"\n  by (simp add: abs_split_set.Lnode\\<^sub>i.simps)\n\nlemma id_assn_emp[simp]: \"id_assn a a = emp\"\n  by (simp add: pure_def)\n\nlemma butlast2[simp]: \"butlast (ts@[a,b]) = ts@[a]\"\n  by (induction ts) auto\n\nlemma butlast3[simp]: \"butlast (ts@[a,b,c]) = ts@[a,b]\"\n  by (induction ts) auto\n\nlemma zip_append_last: \"length as = length bs \\<Longrightarrow> zip (as@[a]) (bs@[b]) = zip as bs @ [(a,b)]\"\n  by simp\n\nlemma pointers_append: \"zip (z#as) (as@[a]) = zip (butlast (z#as)) as @ [(last (z#as),a)]\"\n  by (metis (no_types, opaque_lifting) Suc_eq_plus1 append_butlast_last_id butlast_snoc length_Cons length_append_singleton length_butlast list.distinct(1) zip_append_last)\n\nlemma node\\<^sub>i_rule_app: assumes c_cap: \"2*k \\<le> c\" \"c \\<le> 4*k+1\"\n    and \"length tsi' = length pointers\"\n    and \"tsi'' = zip (zip (map fst tsi') (zip (butlast (r'#pointers)) pointers)) (map snd tsi')\"\n  shows \"\n<  p \\<mapsto>\\<^sub>r Btnode (tsia,tsin) ri *\n   is_pfa c (tsi' @ [(Some li, a)]) (tsia, tsin) *\n   blist_assn k ts tsi'' *\n   bplustree_assn k l li (last (r'#pointers)) lz *\n   bplustree_assn k r ri lz rz> node\\<^sub>i k p\n <\\<lambda>u. btupi_assn k (abs_split_set.node\\<^sub>i k (ts @ [(l, a)]) r) u r' rz>\\<^sub>t\"\nproof -\n(*[of k c \"(tsi' @ [(Some li, b)])\" _ _ \"(ls @ [(l, a)])\" r ri]*)\n  note node\\<^sub>i_rule[of k c \"tsi'@[(Some li, a)]\" \"pointers@[lz]\" \"tsi''@[((Some li, last(r'#pointers), lz),a)]\" r' rz p tsia tsin ri \"ts@[(l,a)]\" r, OF assms(1,2)]\n  then show ?thesis\n    using assms\n    apply (auto simp add:\n         list_assn_app_one pointers_append\n         mult.left_assoc\n    )\n    done\nqed\n\nlemma norm_pre_ex_drule: \"<\\<exists>\\<^sub>Ax. P x> c <Q> \\<Longrightarrow> (\\<And>x. <P x> c <Q>)\"\nproof (goal_cases)\n  case 1\n  then show ?case\n    using Hoare_Triple.cons_pre_rule by blast\nqed\n\n(* setting up the simplifier for tsi'' in the other direction *)\nlemma node\\<^sub>i_rule_diff_simp: assumes c_cap: \"2*k \\<le> c\" \"c \\<le> 4*k+1\"\n    and \"length tsi' = length pointers\"\n    and \"zip (zip (map fst tsi') (zip (butlast (r#pointers)) (butlast (pointers@[z])))) (map snd tsi') = tsi''\"\n  shows \"<p \\<mapsto>\\<^sub>r Btnode (a,n) ti * is_pfa c tsi' (a,n) * blist_assn k ts tsi'' * bplustree_assn k t ti (last (r#pointers)) z>\n  node\\<^sub>i k p\n  <\\<lambda>u. btupi_assn k (abs_split_set.node\\<^sub>i k ts t) u r z>\\<^sub>t\"\n  using node\\<^sub>i_rule assms by (auto simp del: butlast.simps last.simps)\n\nlemma list_assn_aux_append_Cons2: \n  shows \"length xs = length zsl \\<Longrightarrow> list_assn R (xs@x#y#ys) (zsl@z1#z2#zsr) = (list_assn R xs zsl * R x z1 * R y z2 * list_assn R ys zsr)\"\n  by (sep_auto simp add: mult.assoc)\n\nlemma pointer_zip_access: \"length tsi' = length pointers \\<Longrightarrow> i < length tsi' \\<Longrightarrow>\n  zip (zip (map fst tsi') (zip (butlast (r'#pointers)) (butlast (pointers@[z])))) (map snd tsi') ! i\n= ((fst (tsi' ! i), (r'#pointers) ! i, pointers ! i), snd (tsi' ! i))\"\n  apply(auto)\n  by (metis append_butlast_last_id butlast.simps(2) len_greater_imp_nonempty length_Cons length_append_singleton nth_butlast)\n\nlemma pointer_zip'_access: \"length tsi' = length pointers \\<Longrightarrow> i < length tsi' \\<Longrightarrow>\n  zip (zip (map fst tsi') (zip (butlast (r'#pointers)) (butlast (pointers@[z])))) (map snd tsi') ! i\n= ((fst (tsi' ! i), (r'#pointers) ! i, pointers ! i), snd (tsi' ! i))\"\n  apply(auto)\n  by (metis One_nat_def nth_take take_Cons' take_butlast_conv)\n\nlemma access_len_last: \"(x#xs@ys) ! (length xs) = last (x#xs)\"\n  by (induction xs) auto\n\n\nlemma node\\<^sub>i_rule_ins2: assumes c_cap: \"2*k \\<le> c\" \"c \\<le> 4*k+1\"\n    and \"pointers = lpointers@lz#rz#rpointers\"\n    and \"length tsi'' = length pointers\"\n    and \"length lpointers = length lsi'\"\n    and \"length rpointers = length rsi'\"\n    and \"length lsi'' = length ls\"\n    and \"length lsi' = length ls\"\n    and \"tsi'' = zip (zip (map fst tsi') (zip (butlast (r'#pointers)) (butlast (pointers@[z])))) (map snd tsi')\"\n    and \"tsi' = (lsi' @ (Some li, a) # (Some ri,a') # rsi')\" \n    and \"lsi'' = take (length lsi') tsi''\"\n    and \"rsi'' = drop (Suc (Suc (length lsi'))) tsi''\"\n    and \"r'' = last (r'#lpointers)\"\n    and \"z'' = last (r'#pointers)\"\n    and \"length tsi' = length pointers\"\n  shows \"\n<  p \\<mapsto>\\<^sub>r Btnode (tsia,tsin) ti *\n   is_pfa c (lsi' @ (Some li, a) # (Some ri,a') # rsi') (tsia, tsin) *\n   blist_assn k ls lsi'' *\n   bplustree_assn k l li r'' lz*\n   bplustree_assn k r ri lz rz*\n   blist_assn k rs rsi'' *\n   bplustree_assn k t ti z'' z> node\\<^sub>i k p \n<\\<lambda>u. btupi_assn k (abs_split_set.node\\<^sub>i k (ls @ (l, a) # (r,a') # rs) t) u r' z>\\<^sub>t\"\nproof -\n  have \"\n     tsi'' =\n     lsi'' @ ((Some li, r'', lz), a) # ((Some ri, lz, rz), a') # rsi''\"\n  proof (goal_cases)\n    case 1\n    have \"tsi'' = take (length lsi') tsi'' @ drop (length lsi') tsi''\"\n      by auto\n    also have \"\\<dots> = take (length lsi') tsi'' @ tsi''!(length lsi') # drop (Suc (length lsi')) tsi''\"\n      by (simp add: Cons_nth_drop_Suc assms(3) assms(4) assms(5))\n    also have \"\\<dots> = take (length lsi') tsi'' @ tsi''!(length lsi') # tsi''!(Suc (length lsi')) #drop (Suc (Suc (length lsi'))) tsi''\"\n      by (metis (no_types, lifting) Cons_nth_drop_Suc One_nat_def Suc_eq_plus1 Suc_le_eq assms(3) assms(4) assms(5) diff_add_inverse2 diff_is_0_eq length_append list.size(4) nat.simps(3) nat_add_left_cancel_le not_less_eq_eq)\n    also have \"\\<dots> = lsi'' @ tsi''!(length lsi') # tsi''!(Suc (length lsi')) # rsi''\"\n      using assms(11) assms(12) by force\n    also have \"\\<dots> = lsi'' @ ((Some li, r'', lz), a) # ((Some ri, lz, rz), a') # rsi''\"\n    proof (auto, goal_cases)\n      case 1\n      have \"pointers ! length lsi' = lz\"\n        by (metis assms(3) assms(5) list.sel(3) nth_append_length)\n      moreover have \"(r'#pointers) ! length lsi' = r''\"\n        using assms access_len_last[of r' lpointers]\n        by (auto simp del: last.simps butlast.simps)\n      moreover have \" tsi'!(length lsi') = (Some li,a)\"\n        using assms(10) by auto\n      moreover have \"length lsi' < length tsi'\"\n        using \\<open>take (length lsi') tsi'' @ tsi'' ! length lsi' # drop (Suc (length lsi')) tsi'' = take (length lsi') tsi'' @ tsi'' ! length lsi' # tsi'' ! Suc (length lsi') # drop (Suc (Suc (length lsi'))) tsi''\\<close> assms(15) assms(4) same_append_eq by fastforce\n      ultimately show ?case \n        using pointer_zip'_access[of tsi' \"pointers\" \"length lsi'\" r'] assms(15) assms(9)\n        by (auto simp del: last.simps butlast.simps)\n    next\n      case 2\n      have \"pointers ! (Suc (length lsi')) = rz\"\n        by (metis Suc_eq_plus1 append_Nil assms(3) assms(5) list.sel(3) nth_Cons_Suc nth_append_length nth_append_length_plus)\n      moreover have \"(r'#pointers) ! (Suc (length lsi')) = lz\"\n        using assms(3,4,5,6,7,8) apply auto\n        by (metis nth_append_length)\n      moreover have \" tsi'!(Suc (length lsi')) = (Some ri,a')\"\n        using assms(10)\n        by (metis (no_types, lifting) Cons_nth_drop_Suc Suc_le_eq append_eq_conv_conj assms(15) assms(4) drop_all drop_eq_ConsD list.inject list.simps(3) not_less_eq_eq)\n      moreover have \"Suc (length lsi') < length tsi'\"\n        by (simp add: assms(10))\n      ultimately show ?case \n        using pointer_zip'_access[of tsi' pointers \"Suc (length lsi')\"] assms(15) assms(9)\n        by (auto simp del: last.simps butlast.simps)\n    qed\n    finally show ?thesis .\n  qed\n  moreover note node\\<^sub>i_rule_diff_simp[of k c \n    \"(lsi' @ (Some li, a) # (Some ri,a') # rsi')\" \n    \"lpointers@lz#rz#rpointers\" r' z\n    \"lsi''@((Some li, r'', lz), a)#((Some ri, lz, rz), a')#rsi''\"\n    p tsia tsin ti \"ls@(l,a)#(r,a')#rs\" t\n]\n  ultimately show ?thesis\n    using assms(1,2,3,4,5,6,7,8,9,10,13,14)\n    apply (auto simp add: mult.left_assoc list_assn_aux_append_Cons2 prod_assn_def\nsimp del: last.simps)\n    done\nqed\n\nlemma upd_drop_prepend: \"i < length xs \\<Longrightarrow> drop i (list_update xs i a) = a#(drop (Suc i) xs)\" \n  by (simp add: upd_conv_take_nth_drop)\n\nlemma zip_update: \"(zip xs ys)!i = (a,b) \\<Longrightarrow> list_update (zip xs ys) i (c,b) = zip (list_update xs i c) ys\"\n  by (metis fst_conv list_update_beyond list_update_id not_le_imp_less nth_zip snd_conv update_zip)\n\nlemma append_Cons_last: \"last (xs@x#ys) = last (x#ys)\"\n  by (induction xs) auto\n                                                                                            \ndeclare last.simps[simp del] butlast.simps[simp del]\nlemma ins\\<^sub>i_rule:\n  \"k > 0 \\<Longrightarrow>\n  sorted_less (inorder t) \\<Longrightarrow>\n  sorted_less (leaves t) \\<Longrightarrow>\n  root_order k t \\<Longrightarrow>\n  <bplustree_assn k t ti r z>\n  ins\\<^sub>i k x ti\n  <\\<lambda>a. btupi_assn k (abs_split_set.ins k x t) a r z>\\<^sub>t\"\nproof (induction k x t arbitrary: ti r z rule: abs_split_set.ins.induct)\n  case (1 k x xs ti r z)\n  then show ?case\n    apply(subst ins\\<^sub>i.simps)\n    apply (sep_auto heap: Lnode\\<^sub>i_rule)\n    done\nnext\n  case (2 k x ts t ti r' z)\n  obtain ls rrs where list_split: \"split ts x = (ls,rrs)\"\n    by (cases \"split ts x\")\n  have [simp]: \"sorted_less (separators ts)\"\n    using \"2.prems\" sorted_inorder_separators by simp\n  have [simp]: \"sorted_less (inorder t)\"\n    using \"2.prems\" sorted_inorder_induct_last by simp\n  show ?case\n  proof (cases rrs)\n    case Nil\n    then have split_rel_i: \"split_relation ts (ls,[]) i \\<Longrightarrow> i = length ts\" for i\n      by (simp add: split_relation_alt)\n    show ?thesis\n    proof (cases \"abs_split_set.ins k x t\")\n      case (T\\<^sub>i a)\n      then show ?thesis\n        apply(subst ins\\<^sub>i.simps)\n        using Nil \n        apply(simp)\n        apply vcg\n        apply(simp)\n        apply vcg\n        thm split\\<^sub>i_rule\n        apply sep_auto\n          apply(rule hoare_triple_preI)\n        using Nil split_rel_i list_split\n        apply (sep_auto dest!: split_rel_i mod_starD)\n        subgoal\n          using Nil list_split\n          by (simp add: list_assn_aux_ineq_len split_relation_alt)\n        subgoal\n          using Nil list_split\n          by (simp add: list_assn_aux_ineq_len split_relation_alt)\n        subgoal for tsil tsin tti tsi'\n          thm \"2.IH\"(1)[of ls rrs tti]\n          using \"2.prems\" sorted_leaves_induct_last\n          using  Nil list_split T\\<^sub>i abs_split_set.split_conc[OF list_split] order_impl_root_order \n          apply(sep_auto split!: list.splits simp add: split_relation_alt\n              heap add: \"2.IH\"(1)[of ls rrs tti])\n          subgoal for ai\n            apply(cases ai)\n            subgoal by sep_auto\n            subgoal by sep_auto\n            done\n          done\n        done\n    next\n      case (Up\\<^sub>i l a r)\n      then show ?thesis\n        apply(subst ins\\<^sub>i.simps)\n        using Nil \n        apply(simp)\n        apply vcg\n        apply simp\n        apply vcg\n        apply sep_auto\n          apply(rule hoare_triple_preI)\n        using Nil list_split\n        apply (sep_auto dest!: split_rel_i mod_starD)\n        subgoal\n          using Nil list_split\n          by (simp add: list_assn_aux_ineq_len split_relation_alt)                 \n        subgoal\n          using Nil list_split \n          by (simp add: list_assn_aux_ineq_len split_relation_alt)\n        subgoal for tsia tsin tti tsi' pointers _ _ _ _ _ _ _ _ _ _  i \n          thm \"2.IH\"(1)[of ls rrs tti \"last (r'#pointers)\" z]\n          using \"2.prems\" sorted_leaves_induct_last\n          using  Nil list_split Up\\<^sub>i abs_split_set.split_conc[OF list_split] order_impl_root_order\n          apply(sep_auto split!: list.splits \n              simp add: split_relation_alt\n              heap add: \"2.IH\"(1)[of ls rrs tti])\n          subgoal for ai\n            apply(cases ai)\n            subgoal by sep_auto\n            apply(rule hoare_triple_preI)\n            thm node\\<^sub>i_rule_app\n            apply(sep_auto heap add: node\\<^sub>i_rule_app)\n            apply(sep_auto simp add: pure_def)\n            done\n          done\n        done\n    qed\n  next\n    case (Cons a rs)\n    obtain sub sep where a_split: \"a = (sub,sep)\"\n      by (cases a)\n    then have [simp]: \"sorted_less (inorder sub)\"\n      by (metis \"2\"(4) abs_split_set.split_set(1) list_split local.Cons some_child_sub(1) sorted_inorder_subtrees)\n    from Cons have split_rel_i: \"ts = ls@a#rs \\<and> i = length ls \\<Longrightarrow> i < length ts\" for i\n      by (simp add: split_relation_alt)\n    then show ?thesis\n      proof (cases \"abs_split_set.ins k x sub\")\n        case (T\\<^sub>i a')\n        then show ?thesis\n          apply(auto simp add: Cons list_split a_split)\n          apply(subst ins\\<^sub>i.simps)\n          apply vcg\n           apply auto\n          apply vcg\n          subgoal by sep_auto\n          apply simp\n          (*this solves a subgoal*) apply simp\n            (* at this point, we want to introduce the split, and after that tease the\n  hoare triple assumptions out of the bracket, s.t. we don't split twice *)\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          using list_split Cons abs_split_set.split_conc[of ts x ls rrs] \n          apply (simp add: list_assn_append_Cons_left)\n          apply(rule norm_pre_ex_rule)+\n          apply(rule hoare_triple_preI)\n          apply(simp add: split_relation_alt prod_assn_def split!: prod.splits)\n              (* actual induction branch *)\n          subgoal for tsia tsin tti tsi' pointers suba' sepa' lsi' suba subleaf subnext sepa rsi' _ _ sub' sep'\n            apply(subgoal_tac \"length ls = length lsi'\")\n          apply(subgoal_tac \"(suba', sepa') = (suba, sepa)\") \n          apply(subgoal_tac \"(sub', sep') = (sub, sep)\") \n          thm \"2.IH\"(2)[of ls rs a rrs sub sep \"the suba\" subleaf subnext]\n             apply (sep_auto heap add: \"2.IH\"(2))\n          subgoal using \"2.prems\" by metis\n            subgoal using \"2.prems\" sorted_leaves_induct_subtree \\<open>sorted_less (inorder sub)\\<close>\n              by (auto split!: btupi.splits) \n            subgoal \n              using \"2.prems\"(3) sorted_leaves_induct_subtree by blast\n            subgoal using \"2.prems\"(1,4) order_impl_root_order[of k sub] by auto\n            subgoal for up\n              apply(cases up)\n              subgoal for ai\n               apply (sep_auto eintros del: exI)\n                apply(inst_existentials tsia tsin tti \"tsi'[length ls := (Some ai, sepa)]\" \"lsi'@((Some ai, subleaf, subnext),sepa)#rsi'\" pointers)\n                  apply (sep_auto simp add: prod_assn_def split!: prod.splits)\n                  subgoal  (* necessary goal due to the difference between implementation and abstract code *)\n                  proof (goal_cases)\n                    case 1\n                    then have *: \"((suba, subleaf, subnext), sepa) = (zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi'))!(length lsi')\"\n                      by (metis nth_append_length)\n                    have **:\"(zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi'))!(length lsi') = (((subtrees tsi')!(length lsi'), (butlast (r'#pointers))!(length lsi'), pointers!(length lsi')), (separators tsi')!(length lsi'))\" \n                      using 1 by simp\n                    have \"lsi' @ ((Some ai, subleaf, subnext), sepa) # rsi' =\n                          list_update (lsi' @ ((suba, subleaf, subnext), sepa) # rsi') (length lsi') ((Some ai, subleaf, subnext), sepa)\"\n                      by simp\n                    also have \"\\<dots> = list_update (zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi')) (length lsi') ((Some ai, subleaf,subnext), sepa)\" \n                      using 1 by simp\n                    also have \"\\<dots> = zip (list_update (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (length lsi') (Some ai, subleaf, subnext)) (separators tsi')\"\n                      by (meson zip_update sym[OF *])\n                    finally show ?case\n                      using ** *\n                      by (simp add: update_zip map_update)\n                  qed\n                  subgoal by sep_auto\n                  done\n              subgoal\n                apply(rule hoare_triple_preI)\n                using T\\<^sub>i\n                subgoal by (auto dest!: mod_starD)\n                done\n              done\n            subgoal\n              using a_split by fastforce\n            subgoal\n                  proof (goal_cases)\n                    case 1\n                    then have *: \"((suba, subleaf, subnext), sepa) = (zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi'))!(length lsi')\"\n                      by (metis nth_append_length)\n                    have **:\"(zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi'))!(length lsi') = (((subtrees tsi')!(length lsi'), (butlast (r'#pointers))!(length lsi'), pointers!(length lsi')), (separators tsi')!(length lsi'))\" \n                      using 1 by simp\n                    then show ?case\n                      using ** * 1\n                      by simp\n                  qed\n                  subgoal by (auto dest!: mod_starD list_assn_len)\n                  done\n                subgoal\n                  apply(rule hoare_triple_preI)\n                    using Cons split_relation_alt[of ts ls \"a#rs\"] list_split\n                    by (auto dest!: list_assn_len mod_starD)\n                  done\n      next\n        case (Up\\<^sub>i l w r)\n        then show ?thesis\n          apply(auto simp add: Cons list_split a_split)\n          apply(subst ins\\<^sub>i.simps)\n          apply vcg\n           apply auto\n          apply vcg\n          subgoal by sep_auto\n          apply simp\n          (*this solves a subgoal*) apply simp\n            (* at this point, we want to introduce the split, and after that tease the\n  hoare triple assumptions out of the bracket, s.t. we don't split twice *)\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          apply (vcg (ss))\n          using list_split Cons abs_split_set.split_conc[of ts x ls rrs] \n          apply (simp add: list_assn_append_Cons_left)\n          apply(rule norm_pre_ex_rule)+\n          apply(rule hoare_triple_preI)\n          apply(simp add: split_relation_alt prod_assn_def split!: prod.splits)\n              (* actual induction branch *)\n          subgoal for tsia tsin tti tsi' pointers suba' sepa' lsi' suba subleaf subnext sepa rsi' _ _ sub' sep'\n          apply(subgoal_tac \"length ls = length lsi'\") \n          apply(subgoal_tac \"(suba', sepa') = (suba, sepa)\") \n          apply(subgoal_tac \"(sub', sep') = (sub, sep)\") \n          thm \"2.IH\"(2)[of ls rs a rrs sub sep \"the suba\" subleaf subnext]\n             apply (sep_auto heap add: \"2.IH\"(2))\n          subgoal using \"2.prems\" by metis\n            subgoal using \"2.prems\" sorted_leaves_induct_subtree \\<open>sorted_less (inorder sub)\\<close>\n              by (auto split!: btupi.splits) \n            subgoal \n              using \"2.prems\"(3) sorted_leaves_induct_subtree by blast\n            subgoal using \"2.prems\"(1,4) order_impl_root_order[of k sub] by auto\n            subgoal for up\n              apply(cases up)\n            subgoal by simp\n            subgoal for li ai ri (* split case *)\n              apply (sep_auto dest!: mod_starD list_assn_len heap: pfa_insert_grow_rule)\n              subgoal by (sep_auto simp add: is_pfa_def)\n              subgoal for aa ba ac bc ae be ak bk al bl newr x xaa\n                apply(simp split!: prod.splits)\n              subgoal for tsia'\n                supply R= node\\<^sub>i_rule_ins2[where k=k and c=\"max (2*k) (Suc tsin)\" and\n                      lsi'=\"take (length lsi') tsi'\" and li=li and ri=ri\n                      and rsi'=\"drop (Suc (length lsi')) tsi'\"\n                      and lpointers=\"take (length lsi') pointers\"\n                      and rpointers=\"drop (Suc (length lsi')) pointers\"\n                      and pointers=\"take (length lsi') pointers @ newr # subnext # drop (Suc (length lsi')) pointers\"\n                      and z''=\"last (r'#pointers)\"\n                      and tsi'=\"take (length lsi') tsi' @ (Some li, ai) # (Some ri, sepa) # drop (Suc (length lsi')) tsi'\"\n                      and r'=\"r'\" and z=\"z\"\nand tsi''=\"zip (zip (subtrees\n           (take (length lsi') tsi' @\n            (Some li, ai) # (Some ri, sepa) # drop (Suc (length lsi')) tsi'))\n      (zip (butlast\n             (r' #\n              take (length lsi') pointers @ newr # subnext # drop (Suc (length lsi')) pointers))\n        (butlast\n          ((take (length lsi') pointers @ newr # subnext # drop (Suc (length lsi')) pointers) @\n           [z]))))\n (separators\n   (take (length lsi') tsi' @\n    (Some li, ai) # (Some ri, sepa) # drop (Suc (length lsi')) tsi'))\"\n                    ]\n                thm R\n              apply (sep_auto simp add: upd_drop_prepend eintros del: exI heap: R split!: prod.splits)\n                subgoal\n                proof (goal_cases)\n                  case 1\n                  from sym[OF 1(8)] have \"lsi' = take (length lsi') (zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi'))\"\n                    by auto\n                  then show ?case using 1\n                    by (auto simp add: take_zip take_map take_butlast_prepend take_butlast_append)\n                qed\n                subgoal \n                proof (goal_cases)\n                  case 1\n                  let ?tsi''=\"zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi')\"\n                  from sym[OF 1(8)] have \"rsi' = drop (Suc (length lsi')) ?tsi''\"\n                    by auto\n                  moreover have \"pointers ! length lsi' = subnext\" \n                  proof -\n                    let ?i = \"length lsi'\"\n                    have \"?tsi'' ! ?i = ((fst (tsi'!?i), (r' # pointers) ! ?i, pointers ! ?i), snd (tsi' ! ?i))\"\n                      using pointer_zip_access 1 by fastforce\n                    moreover have \"?tsi'' ! ?i = ((suba, subleaf, subnext), sepa)\"\n                      by (metis \"1\" nth_append_length)\n                    ultimately show ?thesis by simp\n                  qed\n                  ultimately show ?case using 1\n                    by (auto simp add: drop_zip drop_map drop_butlast Cons_nth_drop_Suc)\n                qed\n              subgoal \n                proof (goal_cases)\n                  case 1\n                  let ?tsi''=\"zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi')\"\n                  let ?i = \"length lsi'\"\n                  show ?thesis\n                  proof -\n                    let ?i = \"length lsi'\"\n                    have \"?tsi'' ! ?i = ((fst (tsi'!?i), (r' # pointers) ! ?i, pointers ! ?i), snd (tsi' ! ?i))\"\n                      using pointer_zip_access 1 by fastforce\n                    moreover have \"?tsi'' ! ?i = ((suba, subleaf, subnext), sepa)\"\n                      by (metis \"1\" nth_append_length)\n                    ultimately have \"(r'#pointers) ! ?i = subleaf\"\n                      by simp\n                    then show ?thesis\n                      using sym[OF append_take_drop_id, of pointers \"length lsi'\"]\n                      using access_len_last[of r' \"take (length lsi') pointers\" \"drop (length lsi') pointers\"]\n                      using 1\n                      by simp\n                  qed\n                qed\n                subgoal\n                proof (goal_cases)\n                  case 1\n                  let ?tsi''=\"zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi')\"\n                  let ?i = \"length lsi'\"\n                  have \"pointers ! ?i = subnext\" \n                  proof -\n                    have \"?tsi'' ! ?i = ((fst (tsi'!?i), (r' # pointers) ! ?i, pointers ! ?i), snd (tsi' ! ?i))\"\n                      using pointer_zip_access 1 by fastforce\n                    moreover have \"?tsi'' ! ?i = ((suba, subleaf, subnext), sepa)\"\n                      by (metis \"1\" nth_append_length)\n                    ultimately show ?thesis by simp\n                  qed\n                  moreover have \"drop (length lsi') pointers \\<noteq> []\"\n                    using \"1\" by auto\n                  moreover have \"pointers \\<noteq> []\"\n                    using \"1\" by auto\n                  ultimately show ?case\n                    apply(auto simp add: Cons_nth_drop_Suc  last.simps)\n                    apply(auto simp add: last_conv_nth)\n                    by (metis Suc_to_right le_SucE)\n                qed\n              subgoal by auto\n              subgoal by (sep_auto simp add: pure_def)\n              done\n            done\n          done\n        done\n            subgoal\n              using a_split by fastforce\n            subgoal\n                  proof (goal_cases)\n                    case 1\n                    then have *: \"((suba, subleaf, subnext), sepa) = (zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi'))!(length lsi')\"\n                      by (metis nth_append_length)\n                    have **:\"(zip (zip (subtrees tsi') (zip (butlast (r' # pointers)) pointers)) (separators tsi'))!(length lsi') = (((subtrees tsi')!(length lsi'), (butlast (r'#pointers))!(length lsi'), pointers!(length lsi')), (separators tsi')!(length lsi'))\" \n                      using 1 by simp\n                    then show ?case\n                      using ** * 1\n                      by simp\n                  qed\n                  subgoal by (auto dest!: mod_starD list_assn_len)\n                  done\n                subgoal\n                  apply(rule hoare_triple_preI)\n                    using Cons split_relation_alt[of ts ls \"a#rs\"] list_split\n                    by (auto dest!: list_assn_len mod_starD)\n                  done\n      qed\n    qed\n  qed\ndeclare last.simps[simp add] butlast.simps[simp add]\n\ntext \"The imperative insert refines the abstract insert.\"\n\nlemma insert\\<^sub>i_rule:\n  assumes \"k > 0\" \"sorted_less (inorder t)\" \"sorted_less (leaves t)\" \"root_order k t\"\n  shows \"<bplustree_assn k t ti r z>\n  insert\\<^sub>i k x ti\n  <\\<lambda>u. bplustree_assn k (abs_split_set.insert k x t) u r z>\\<^sub>t\"\nproof(cases \"abs_split_set.ins k x t\")\n  case (T\\<^sub>i x1)\n  then show ?thesis\n  unfolding insert\\<^sub>i_def\n   using assms\n    by (sep_auto split!: btupi.splits heap: ins\\<^sub>i_rule)\nnext\n  case (Up\\<^sub>i x21 x22 x23)\n  then show ?thesis\n  unfolding insert\\<^sub>i_def\n  using assms\n  apply (sep_auto eintros del: exI split!: btupi.splits heap: ins\\<^sub>i_rule)\n  subgoal for x21a x22a x23a newr a b xa\n  apply(inst_existentials a b x23a \"[(Some x21a, x22a)]\" \"[((Some x21a, r, newr),x22a)]\" \"[newr]\")\n    apply (auto simp add: prod_assn_def)\n    apply (sep_auto)\n    done\n  done\nqed\n\ntext \"The \\\"pure\\\" resulting rule follows automatically.\"\nlemma insert\\<^sub>i_rule':\n  shows \"<bplustree_assn (Suc k) t ti r z * \\<up>(abs_split_set.invar_leaves (Suc k) t \\<and> sorted_less (leaves t))>\n  insert\\<^sub>i (Suc k) x ti\n  <\\<lambda>ri.\\<exists>\\<^sub>Au. bplustree_assn (Suc k) u ri r z * \\<up>(abs_split_set.invar_leaves (Suc k) u \\<and> sorted_less (leaves u) \\<and> leaves u = (ins_list x (leaves t)))>\\<^sub>t\"\n  using Laligned_sorted_inorder[of t top] sorted_wrt_append\n  using abs_split_set.insert_bal[of t] abs_split_set.insert_order[of \"Suc k\" t]\n  using abs_split_set.insert_Linorder_top[of \"Suc k\" t]\n  by (sep_auto heap: insert\\<^sub>i_rule simp add: sorted_ins_list)\n\n\nsubsection \"Deletion\"\n\ntext \"The below definitions work for non-linked-leaf B-Plus-Trees\nbut not yet for linked-leaf trees\"\n\n\n(* rebalance middle tree gets a list of trees, an index pointing to\nthe position of sub/sep and a last tree *)\n\ndefinition rebalance_middle_tree:: \"nat \\<Rightarrow> (('a::{default,heap,linorder,order_top}) btnode ref option \\<times> 'a) pfarray \\<Rightarrow> nat \\<Rightarrow> 'a btnode ref \\<Rightarrow> 'a btnode Heap\"\n  where\n    \"rebalance_middle_tree \\<equiv> \\<lambda> k tsi i p_ti. ( do {\n  ti \\<leftarrow> !p_ti;\n  case ti of\n  Btleaf txsi n_p \\<Rightarrow> do {\n      (r_sub,sep) \\<leftarrow> pfa_get tsi i;\n      subi \\<leftarrow> !(the r_sub);\n      l_sub \\<leftarrow> pfa_length (vals subi);\n      l_txs \\<leftarrow> pfa_length (txsi);\n      if l_sub \\<ge> k \\<and> l_txs \\<ge> k then do {\n        return (Btnode tsi p_ti)\n      } else do {\n        l_tsi \\<leftarrow> pfa_length tsi;\n        if i+1 = l_tsi then do {\n          mts' \\<leftarrow> pfa_extend_grow (vals subi) (txsi);\n          (the r_sub) := Btleaf mts' n_p;\n          res_node\\<^sub>i \\<leftarrow> Lnode\\<^sub>i k (the r_sub);\n          case res_node\\<^sub>i of\n            T\\<^sub>i u \\<Rightarrow> do {\n              tsi' \\<leftarrow> pfa_shrink i tsi;\n              return (Btnode tsi' u)\n            } |\n            Up\\<^sub>i l a r \\<Rightarrow> do {\n              tsi' \\<leftarrow> pfa_set tsi i (Some l,a);\n              return (Btnode tsi' r)\n            }\n        } else do {\n          (r_rsub,rsep) \\<leftarrow> pfa_get tsi (i+1);\n          rsub \\<leftarrow> !(the r_rsub);\n          mts' \\<leftarrow> pfa_extend_grow (vals subi) (vals rsub);\n          (the r_sub) := Btleaf mts' (fwd rsub);\n          res_node\\<^sub>i \\<leftarrow> Lnode\\<^sub>i k (the r_sub);\n          case res_node\\<^sub>i of\n           T\\<^sub>i u \\<Rightarrow> do {\n            tsi' \\<leftarrow> pfa_set tsi i (Some u,rsep);\n            tsi'' \\<leftarrow> pfa_delete tsi' (i+1);\n            return (Btnode tsi'' p_ti)\n          } |\n           Up\\<^sub>i l a r \\<Rightarrow> do {\n            tsi' \\<leftarrow> pfa_set tsi i (Some l,a);\n            tsi'' \\<leftarrow> pfa_set tsi' (i+1) (Some r,rsep);\n            return (Btnode tsi'' p_ti)\n          }\n        }\n  }} |\n  Btnode ttsi tti \\<Rightarrow> do {\n      (r_sub,sep) \\<leftarrow> pfa_get tsi i;\n      subi \\<leftarrow> !(the r_sub);\n      l_sub \\<leftarrow> pfa_length (kvs subi);\n      l_tts \\<leftarrow> pfa_length (ttsi);\n      if l_sub \\<ge> k \\<and> l_tts \\<ge> k then do {\n        return (Btnode tsi p_ti)\n      } else do {\n        l_tsi \\<leftarrow> pfa_length tsi;\n        if i+1 = l_tsi then do {\n          mts' \\<leftarrow> pfa_append_extend_grow (kvs subi) (Some (lst subi),sep) (ttsi);\n          (the r_sub) := Btnode mts' (lst ti);\n          res_node\\<^sub>i \\<leftarrow> node\\<^sub>i k (the r_sub);\n          case res_node\\<^sub>i of\n            T\\<^sub>i u \\<Rightarrow> do {\n              tsi' \\<leftarrow> pfa_shrink i tsi;\n              return (Btnode tsi' u)\n            } |\n            Up\\<^sub>i l a r \\<Rightarrow> do {\n              tsi' \\<leftarrow> pfa_set tsi i (Some l,a);\n              return (Btnode tsi' r)\n            }\n        } else do {\n          (r_rsub,rsep) \\<leftarrow> pfa_get tsi (i+1);\n          rsub \\<leftarrow> !(the r_rsub);\n          mts' \\<leftarrow> pfa_append_extend_grow (kvs subi) (Some (lst subi),sep) (kvs rsub);\n          (the r_sub) := Btnode mts' (lst rsub);\n          res_node\\<^sub>i \\<leftarrow> node\\<^sub>i k (the r_sub);\n          case res_node\\<^sub>i of\n           T\\<^sub>i u \\<Rightarrow> do {\n            tsi' \\<leftarrow> pfa_set tsi i (Some u,rsep);\n            tsi'' \\<leftarrow> pfa_delete tsi' (i+1);\n            return (Btnode tsi'' p_ti)\n          } |\n           Up\\<^sub>i l a r \\<Rightarrow> do {\n            tsi' \\<leftarrow> pfa_set tsi i (Some l,a);\n            tsi'' \\<leftarrow> pfa_set tsi' (i+1) (Some r,rsep);\n            return (Btnode tsi'' p_ti)\n          }\n        }\n  }\n}}\n)\n\"\n\n\ndefinition rebalance_last_tree:: \"nat \\<Rightarrow> (('a::{default,heap,linorder,order_top}) btnode ref option \\<times> 'a) pfarray \\<Rightarrow> 'a btnode ref \\<Rightarrow> 'a btnode Heap\"\n  where\n    \"rebalance_last_tree \\<equiv> \\<lambda>k tsi ti. do {\n   l_tsi \\<leftarrow> pfa_length tsi;\n   rebalance_middle_tree k tsi (l_tsi-1) ti\n}\"\n\n\nsubsection \"Refinement of the abstract B-tree operations\"\n\n\nlemma P_imp_Q_implies_P: \"P \\<Longrightarrow> (Q \\<longrightarrow> P)\"\n  by simp\n\n\n\nlemma btupi_assn_T: \"h \\<Turnstile> btupi_assn k (abs_split_set.node\\<^sub>i k ts t) (T\\<^sub>i x) r z \\<Longrightarrow> abs_split_set.node\\<^sub>i k ts t = abs_split_set.T\\<^sub>i (Node ts t)\"\n  apply(auto simp add: abs_split_set.node\\<^sub>i.simps dest!: mod_starD split!: list.splits prod.splits)\n  done\n\nlemma btupi_assn_Up: \"h \\<Turnstile> btupi_assn k (abs_split_set.node\\<^sub>i k ts t) (Up\\<^sub>i l a r) r' z \\<Longrightarrow>\n  abs_split_set.node\\<^sub>i k ts t = (\n    case BPlusTree_Split.split_half ts of (ls,rs) \\<Rightarrow> (\n      case last ls of (sub,sep) \\<Rightarrow>\n        abs_split_set.Up\\<^sub>i (Node (butlast ls) sub) sep (Node rs t)\n  )\n)\"\n  apply(auto simp add: abs_split_set.node\\<^sub>i.simps split!: list.splits prod.splits)\n  done\n\nlemma Lbtupi_assn_T: \"h \\<Turnstile> btupi_assn k (abs_split_set.Lnode\\<^sub>i k ts) (T\\<^sub>i x) r z \\<Longrightarrow> abs_split_set.Lnode\\<^sub>i k ts = abs_split_set.T\\<^sub>i (Leaf ts)\"\n  apply(cases \"length ts \\<le> 2*k\")\n  apply(auto simp add: abs_split_set.Lnode\\<^sub>i.simps split!: list.splits prod.splits)\n  done\n\nlemma Lbtupi_assn_Up: \"h \\<Turnstile> btupi_assn k (abs_split_set.Lnode\\<^sub>i k ts) (Up\\<^sub>i l a r) r' z \\<Longrightarrow>\n  abs_split_set.Lnode\\<^sub>i k ts = (\n    case BPlusTree_Split.split_half ts of (ls,rs) \\<Rightarrow> (\n      case last ls of sep \\<Rightarrow>\n        abs_split_set.Up\\<^sub>i (Leaf ls) sep (Leaf rs)\n  )\n)\"\n  apply(auto simp add: abs_split_set.Lnode\\<^sub>i.simps split!: list.splits prod.splits)\n  done\n\nlemma second_last_access:\"(xs@a#b#ys) ! Suc(length xs) = b\"\n  by (simp add: nth_via_drop)\n\nlemma second_last_update:\"(xs@a#b#ys)[Suc(length xs) := c] = (xs@a#c#ys)\"\n  by (metis append.assoc append_Cons empty_append_eq_id length_append_singleton list_update_length)\n\nlemma clean_heap:\"\\<lbrakk>(a, b) \\<Turnstile> P \\<Longrightarrow> Q; (a, b) \\<Turnstile> P\\<rbrakk> \\<Longrightarrow> Q\"\n  by auto\n\n\n\npartial_function (heap) del ::\"nat \\<Rightarrow> 'a \\<Rightarrow> ('a::{default,heap,linorder,order_top}) btnode ref \\<Rightarrow> 'a btnode ref Heap\"\n  where\n    \"del k x tp = do {\n  ti \\<leftarrow> !tp;\n  (case ti of Btleaf xs np \\<Rightarrow> do { \n      xs' \\<leftarrow> del_list\\<^sub>i x xs;\n      tp := (Btleaf xs' np);\n      return tp\n} |\n   Btnode tsi tti \\<Rightarrow> do {\n   i \\<leftarrow> split\\<^sub>i tsi x;\n   tsl \\<leftarrow> pfa_length tsi;\n   if i < tsl then do {\n       (sub,sep) \\<leftarrow> pfa_get tsi i;\n       sub' \\<leftarrow> del k x (the sub);\n       kvs' \\<leftarrow> pfa_set tsi i (Some sub',sep);\n       node' \\<leftarrow> rebalance_middle_tree k kvs' i tti;\n       tp := node';\n       return tp\n   } else do {\n       t' \\<leftarrow> del k x tti;\n       node' \\<leftarrow> rebalance_last_tree k tsi t';\n       tp := node';\n       return tp\n    }\n  })\n}\"\n\n\nend\n\ncontext split\\<^sub>i_list\nbegin\n\ndefinition isin_list\\<^sub>i:: \"'a \\<Rightarrow> ('a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> bool Heap\"\n  where \"isin_list\\<^sub>i x ks = do {\n    i \\<leftarrow> split\\<^sub>i_list ks x;\n    xsl \\<leftarrow> pfa_length ks;\n    if i \\<ge> xsl then return False\n    else do {\n      sep \\<leftarrow> pfa_get ks i;\n      return (sep = x)\n  }\n}\"\n\nlemma isin_list\\<^sub>i_rule [sep_heap_rules]:\n  assumes \"sorted_less ks\"\n  shows\n   \"<is_pfa c ks (a',n')> \n    isin_list\\<^sub>i x (a',n') \n  <\\<lambda>b. \n    is_pfa c ks (a',n')\n    * \\<up>(b = abs_split_list.isin_list x ks)>\\<^sub>t\"\nproof -\n  obtain ls rs where list_split: \"split_list ks x = (ls, rs)\"\n    by (cases \"split_list ks x\")\n  then show ?thesis\n  proof (cases rs)\n    case Nil\n    then show ?thesis\n      apply(subst isin_list\\<^sub>i_def)\n      using assms list_split apply(sep_auto simp add: split_relation_alt dest!: mod_starD list_assn_len)\n      done\n  next\n  case (Cons a rrs)\n  then show ?thesis\n      apply(subst isin_list\\<^sub>i_def)\n      using list_split apply simp\n      using assms list_split  apply(sep_auto simp add: split_relation_alt list_assn_append_Cons_left dest!: mod_starD list_assn_len)\n      done\n  qed\nqed\n\ndefinition ins_list\\<^sub>i:: \"'a \\<Rightarrow> ('a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> 'a pfarray Heap\"\n  where \"ins_list\\<^sub>i x ks = do {\n    i \\<leftarrow> split\\<^sub>i_list ks x;\n    xsl \\<leftarrow> pfa_length ks;\n    if i \\<ge> xsl then\n      pfa_append_grow ks x\n    else do {\n      sep \\<leftarrow> pfa_get ks i;\n      if sep = x then\n        return ks\n      else\n        pfa_insert_grow ks i x \n  }\n}\"\n\nlemma ins_list\\<^sub>i_rule [sep_heap_rules]:\n  assumes \"sorted_less ks\"\n  shows\n   \"<is_pfa c ks (a',n')> \n    ins_list\\<^sub>i x (a',n') \n  <\\<lambda>(a'',n''). is_pfa (max c (length (abs_split_list.insert_list x ks))) (abs_split_list.insert_list x ks) (a'',n'')\n    >\\<^sub>t\"\nproof -\n  obtain ls rs where list_split: \"split_list ks x = (ls, rs)\"\n    by (cases \"split_list ks x\")\n  then show ?thesis\n  proof (cases rs)\n    case Nil\n    then show ?thesis\n      apply(subst ins_list\\<^sub>i_def)\n      apply vcg\n      subgoal using assms by auto\n      apply(rule hoare_triple_preI)\n      apply vcg\n      using list_split apply (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n    subgoal\n      apply(simp add: is_pfa_def)\n        apply(rule ent_ex_preI)\n      subgoal for l\n        apply(rule ent_ex_postI[where x=\"l\"])\n      using assms list_split apply(sep_auto simp add: split_relation_alt pure_def dest!: mod_starD list_assn_len)\n      done\n    done\n    subgoal\n      apply(simp add: is_pfa_def)\n        apply(rule ent_ex_preI)\n      subgoal for l\n        apply(rule ent_ex_postI[where x=\"l\"])\n      using assms list_split apply(sep_auto simp add: split_relation_alt pure_def dest!: mod_starD list_assn_len)\n      done\n    done\n  done\n  next\n  case (Cons a rrs)\n  then show ?thesis\n  proof (cases \"a = x\")\n    case True\n    then show ?thesis\n      apply(subst ins_list\\<^sub>i_def)\n      apply vcg\n      subgoal using assms by auto\n      apply(rule hoare_triple_preI)\n      apply vcg\n      subgoal using list_split Cons by (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      apply vcg\n      subgoal using list_split Cons by (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      apply vcg\n      prefer 2\n      subgoal by (metis (no_types, lifting) id_assn_list list_split local.Cons mod_starD split_relation_access)\n      using list_split Cons apply (auto simp add: split_relation_alt list_assn_append_Cons_left split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n        apply(subgoal_tac \"max c (Suc (length ls + length rrs)) = c\")\n      subgoal using assms list_split by (sep_auto simp add: split_relation_alt  dest!: mod_starD id_assn_list)\n          subgoal\n            apply(auto simp add: is_pfa_def)\n            by (metis add_Suc_right length_Cons length_append length_take max.absorb1 min_eq_arg(2))\n      done\n  next\n    case False\n    then show ?thesis\n      apply(subst ins_list\\<^sub>i_def)\n      apply vcg\n      subgoal using assms by auto\n      apply(rule hoare_triple_preI)\n      apply vcg\n      subgoal using list_split Cons by (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      apply vcg\n      subgoal using list_split Cons by (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      apply vcg\n      subgoal by (metis (no_types, lifting) id_assn_list list_split local.Cons mod_starD split_relation_access)\n      apply vcg\n      subgoal by (auto simp add: is_pfa_def)\n      using list_split Cons apply (auto simp add: split_relation_alt list_assn_append_Cons_left split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n    subgoal for _ _ _ _\n        apply(subgoal_tac \"(Suc (Suc (length ls + length rrs))) = Suc n'\")\n        subgoal\n      using assms list_split Cons by (sep_auto simp add: split_relation_alt dest!: mod_starD id_assn_list)\n      subgoal\n        apply(auto simp add: is_pfa_def)\n        by (metis add_Suc_right length_Cons length_append length_take min_eq_arg(2))\n      done\n    done\nqed\nqed\nqed\n\ndefinition del_list\\<^sub>i:: \"'a \\<Rightarrow> ('a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> 'a pfarray Heap\"\n  where \"del_list\\<^sub>i x ks = do {\n    i \\<leftarrow> split\\<^sub>i_list ks x;\n    xsl \\<leftarrow> pfa_length ks;\n    if i \\<ge> xsl then\n      return ks\n    else do {\n      sep \\<leftarrow> pfa_get ks i;\n      if sep = x then\n        pfa_delete ks i\n      else\n        return ks\n  }\n}\"\n\nlemma del_list\\<^sub>i_rule [sep_heap_rules]:\n  assumes \"sorted_less ks\"\n  shows \"<is_pfa c ks (a',n')> \n    del_list\\<^sub>i x (a',n') \n  <\\<lambda>(a'',n''). is_pfa c (abs_split_list.delete_list x ks) (a'',n'')>\\<^sub>t\"\nproof -\n  obtain ls rs where list_split: \"split_list ks x = (ls, rs)\"\n    by (cases \"split_list ks x\")\n  then show ?thesis\n  proof (cases rs)\n    case Nil\n    then show ?thesis\n      apply(subst del_list\\<^sub>i_def)\n      apply vcg\n      subgoal using assms by auto\n      apply(rule hoare_triple_preI)\n      apply vcg\n      using list_split apply (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      done\n  next\n  case (Cons a rrs)\n  then show ?thesis\n  proof (cases \"a = x\")\n    case True\n    then show ?thesis\n      apply(subst del_list\\<^sub>i_def)\n      apply vcg\n      subgoal using assms by auto\n      apply(rule hoare_triple_preI)\n      apply vcg\n      subgoal using list_split Cons by (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      apply vcg\n      subgoal using list_split Cons by (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      apply vcg\n      subgoal using list_split Cons apply (auto simp add: split_relation_alt is_pfa_def split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n        by (metis add_Suc_right length_Cons length_append length_take less_add_Suc1 min_eq_arg(2))\n      prefer 2\n      subgoal  by (simp add: list_split local.Cons split_relation_access)\n      using list_split Cons apply (auto simp add: split_relation_alt list_assn_append_Cons_left split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      done\n  next\n    case False\n    then show ?thesis\n      apply(subst del_list\\<^sub>i_def)\n      apply vcg\n      subgoal using assms by auto\n      apply(rule hoare_triple_preI)\n      apply vcg\n      subgoal using list_split Cons by (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      apply vcg\n      subgoal using list_split Cons by (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      apply vcg\n      subgoal using list_split Cons by (auto simp add: split_relation_alt is_pfa_def split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n      subgoal by (simp add: list_split local.Cons split_relation_access)\n      apply vcg\n      using list_split Cons apply (auto simp add: split_relation_alt split!: prod.splits list.splits dest!: mod_starD list_assn_len)\n    done\n    qed\n  qed\nqed\n\nend\n\ncontext split\\<^sub>i_full\nbegin\n\nsublocale split\\<^sub>i_set split\\<^sub>i_list.abs_split_list.isin_list split\\<^sub>i_list.abs_split_list.insert_list \n  split\\<^sub>i_list.abs_split_list.delete_list split split\\<^sub>i split\\<^sub>i_list.isin_list\\<^sub>i split\\<^sub>i_list.ins_list\\<^sub>i split\\<^sub>i_list.del_list\\<^sub>i\n  using split\\<^sub>i_list.abs_split_list.isin_list_set split\\<^sub>i_list.abs_split_list.insert_list_set split\\<^sub>i_list.abs_split_list.delete_list_set\n  apply unfold_locales \n  apply sep_auto +\n  done\n\nend\n\n\nend\n\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/BTree/BPlusTree_ImpSet.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.34347018272207214}}
{"text": "(*  Title:      ZF/UNITY/UNITY.thy\n    Author:     Sidi O Ehmety, Computer Laboratory\n    Copyright   2001  University of Cambridge\n*)\n\nsection {*The Basic UNITY Theory*}\n\ntheory UNITY imports State begin\n\ntext{*The basic UNITY theory (revised version, based upon the \"co\" operator)\nFrom Misra, \"A Logic for Concurrent Programming\", 1994.\n\nThis ZF theory was ported from its HOL equivalent.*}\n\nconsts\n  \"constrains\" :: \"[i, i] => i\"  (infixl \"co\"     60)\n  op_unless    :: \"[i, i] => i\"  (infixl \"unless\" 60)\n\ndefinition\n  program  :: i  where\n  \"program == {<init, acts, allowed>:\n               Pow(state) * Pow(Pow(state*state)) * Pow(Pow(state*state)).\n               id(state) \\<in> acts & id(state) \\<in> allowed}\"\n\ndefinition\n  mk_program :: \"[i,i,i]=>i\"  where\n  --{* The definition yields a program thanks to the coercions\n       init \\<inter> state, acts \\<inter> Pow(state*state), etc. *}\n  \"mk_program(init, acts, allowed) ==\n    <init \\<inter> state, cons(id(state), acts \\<inter> Pow(state*state)),\n              cons(id(state), allowed \\<inter> Pow(state*state))>\"\n\ndefinition\n  SKIP :: i  where\n  \"SKIP == mk_program(state, 0, Pow(state*state))\"\n\n  (* Coercion from anything to program *)\ndefinition\n  programify :: \"i=>i\"  where\n  \"programify(F) == if F \\<in> program then F else SKIP\"\n\ndefinition\n  RawInit :: \"i=>i\"  where\n  \"RawInit(F) == fst(F)\"\n\ndefinition\n  Init :: \"i=>i\"  where\n  \"Init(F) == RawInit(programify(F))\"\n\ndefinition\n  RawActs :: \"i=>i\"  where\n  \"RawActs(F) == cons(id(state), fst(snd(F)))\"\n\ndefinition\n  Acts :: \"i=>i\"  where\n  \"Acts(F) == RawActs(programify(F))\"\n\ndefinition\n  RawAllowedActs :: \"i=>i\"  where\n  \"RawAllowedActs(F) == cons(id(state), snd(snd(F)))\"\n\ndefinition\n  AllowedActs :: \"i=>i\"  where\n  \"AllowedActs(F) == RawAllowedActs(programify(F))\"\n\n\ndefinition\n  Allowed :: \"i =>i\"  where\n  \"Allowed(F) == {G \\<in> program. Acts(G) \\<subseteq> AllowedActs(F)}\"\n\ndefinition\n  initially :: \"i=>i\"  where\n  \"initially(A) == {F \\<in> program. Init(F)\\<subseteq>A}\"\n\ndefinition\n  stable     :: \"i=>i\"  where\n   \"stable(A) == A co A\"\n\ndefinition\n  strongest_rhs :: \"[i, i] => i\"  where\n  \"strongest_rhs(F, A) == \\<Inter>({B \\<in> Pow(state). F \\<in> A co B})\"\n\ndefinition\n  invariant :: \"i => i\"  where\n  \"invariant(A) == initially(A) \\<inter> stable(A)\"\n\n  (* meta-function composition *)\ndefinition\n  metacomp :: \"[i=>i, i=>i] => (i=>i)\" (infixl \"comp\" 65)  where\n  \"f comp g == %x. f(g(x))\"\n\ndefinition\n  pg_compl :: \"i=>i\"  where\n  \"pg_compl(X)== program - X\"\n\ndefs\n  constrains_def:\n     \"A co B == {F \\<in> program. (\\<forall>act \\<in> Acts(F). act``A\\<subseteq>B) & st_set(A)}\"\n    --{* the condition @{term \"st_set(A)\"} makes the definition slightly\n         stronger than the HOL one *}\n\n  unless_def:    \"A unless B == (A - B) co (A \\<union> B)\"\n\n\ntext{*SKIP*}\nlemma SKIP_in_program [iff,TC]: \"SKIP \\<in> program\"\nby (force simp add: SKIP_def program_def mk_program_def)\n\n\nsubsection{*The function @{term programify}, the coercion from anything to\n program*}\n\nlemma programify_program [simp]: \"F \\<in> program ==> programify(F)=F\"\nby (force simp add: programify_def) \n\nlemma programify_in_program [iff,TC]: \"programify(F) \\<in> program\"\nby (force simp add: programify_def) \n\ntext{*Collapsing rules: to remove programify from expressions*}\nlemma programify_idem [simp]: \"programify(programify(F))=programify(F)\"\nby (force simp add: programify_def) \n\nlemma Init_programify [simp]: \"Init(programify(F)) = Init(F)\"\nby (simp add: Init_def)\n\nlemma Acts_programify [simp]: \"Acts(programify(F)) = Acts(F)\"\nby (simp add: Acts_def)\n\nlemma AllowedActs_programify [simp]:\n     \"AllowedActs(programify(F)) = AllowedActs(F)\"\nby (simp add: AllowedActs_def)\n\nsubsection{*The Inspectors for Programs*}\n\nlemma id_in_RawActs: \"F \\<in> program ==>id(state) \\<in> RawActs(F)\"\nby (auto simp add: program_def RawActs_def)\n\nlemma id_in_Acts [iff,TC]: \"id(state) \\<in> Acts(F)\"\nby (simp add: id_in_RawActs Acts_def)\n\nlemma id_in_RawAllowedActs: \"F \\<in> program ==>id(state) \\<in> RawAllowedActs(F)\"\nby (auto simp add: program_def RawAllowedActs_def)\n\nlemma id_in_AllowedActs [iff,TC]: \"id(state) \\<in> AllowedActs(F)\"\nby (simp add: id_in_RawAllowedActs AllowedActs_def)\n\nlemma cons_id_Acts [simp]: \"cons(id(state), Acts(F)) = Acts(F)\"\nby (simp add: cons_absorb)\n\nlemma cons_id_AllowedActs [simp]:\n     \"cons(id(state), AllowedActs(F)) = AllowedActs(F)\"\nby (simp add: cons_absorb)\n\n\nsubsection{*Types of the Inspectors*}\n\nlemma RawInit_type: \"F \\<in> program ==> RawInit(F)\\<subseteq>state\"\nby (auto simp add: program_def RawInit_def)\n\nlemma RawActs_type: \"F \\<in> program ==> RawActs(F)\\<subseteq>Pow(state*state)\"\nby (auto simp add: program_def RawActs_def)\n\nlemma RawAllowedActs_type:\n     \"F \\<in> program ==> RawAllowedActs(F)\\<subseteq>Pow(state*state)\"\nby (auto simp add: program_def RawAllowedActs_def)\n\nlemma Init_type: \"Init(F)\\<subseteq>state\"\nby (simp add: RawInit_type Init_def)\n\nlemmas InitD = Init_type [THEN subsetD]\n\nlemma st_set_Init [iff]: \"st_set(Init(F))\"\napply (unfold st_set_def)\napply (rule Init_type)\ndone\n\nlemma Acts_type: \"Acts(F)\\<subseteq>Pow(state*state)\"\nby (simp add: RawActs_type Acts_def)\n\nlemma AllowedActs_type: \"AllowedActs(F) \\<subseteq> Pow(state*state)\"\nby (simp add: RawAllowedActs_type AllowedActs_def)\n\ntext{*Needed in Behaviors*}\nlemma ActsD: \"[| act \\<in> Acts(F); <s,s'> \\<in> act |] ==> s \\<in> state & s' \\<in> state\"\nby (blast dest: Acts_type [THEN subsetD])\n\nlemma AllowedActsD:\n     \"[| act \\<in> AllowedActs(F); <s,s'> \\<in> act |] ==> s \\<in> state & s' \\<in> state\"\nby (blast dest: AllowedActs_type [THEN subsetD])\n\nsubsection{*Simplification rules involving @{term state}, @{term Init}, \n  @{term Acts}, and @{term AllowedActs}*}\n\ntext{*But are they really needed?*}\n\nlemma state_subset_is_Init_iff [iff]: \"state \\<subseteq> Init(F) \\<longleftrightarrow> Init(F)=state\"\nby (cut_tac F = F in Init_type, auto)\n\nlemma Pow_state_times_state_is_subset_Acts_iff [iff]:\n     \"Pow(state*state) \\<subseteq> Acts(F) \\<longleftrightarrow> Acts(F)=Pow(state*state)\"\nby (cut_tac F = F in Acts_type, auto)\n\nlemma Pow_state_times_state_is_subset_AllowedActs_iff [iff]:\n     \"Pow(state*state) \\<subseteq> AllowedActs(F) \\<longleftrightarrow> AllowedActs(F)=Pow(state*state)\"\nby (cut_tac F = F in AllowedActs_type, auto)\n\nsubsubsection{*Eliminating @{text \"\\<inter> state\"} from expressions*}\n\nlemma Init_Int_state [simp]: \"Init(F) \\<inter> state = Init(F)\"\nby (cut_tac F = F in Init_type, blast)\n\nlemma state_Int_Init [simp]: \"state \\<inter> Init(F) = Init(F)\"\nby (cut_tac F = F in Init_type, blast)\n\nlemma Acts_Int_Pow_state_times_state [simp]:\n     \"Acts(F) \\<inter> Pow(state*state) = Acts(F)\"\nby (cut_tac F = F in Acts_type, blast)\n\nlemma state_times_state_Int_Acts [simp]:\n     \"Pow(state*state) \\<inter> Acts(F) = Acts(F)\"\nby (cut_tac F = F in Acts_type, blast)\n\nlemma AllowedActs_Int_Pow_state_times_state [simp]:\n     \"AllowedActs(F) \\<inter> Pow(state*state) = AllowedActs(F)\"\nby (cut_tac F = F in AllowedActs_type, blast)\n\nlemma state_times_state_Int_AllowedActs [simp]:\n     \"Pow(state*state) \\<inter> AllowedActs(F) = AllowedActs(F)\"\nby (cut_tac F = F in AllowedActs_type, blast)\n\n\nsubsubsection{*The Operator @{term mk_program}*}\n\nlemma mk_program_in_program [iff,TC]:\n     \"mk_program(init, acts, allowed) \\<in> program\"\nby (auto simp add: mk_program_def program_def)\n\nlemma RawInit_eq [simp]:\n     \"RawInit(mk_program(init, acts, allowed)) = init \\<inter> state\"\nby (auto simp add: mk_program_def RawInit_def)\n\nlemma RawActs_eq [simp]:\n     \"RawActs(mk_program(init, acts, allowed)) = \n      cons(id(state), acts \\<inter> Pow(state*state))\"\nby (auto simp add: mk_program_def RawActs_def)\n\nlemma RawAllowedActs_eq [simp]:\n     \"RawAllowedActs(mk_program(init, acts, allowed)) =\n      cons(id(state), allowed \\<inter> Pow(state*state))\"\nby (auto simp add: mk_program_def RawAllowedActs_def)\n\nlemma Init_eq [simp]: \"Init(mk_program(init, acts, allowed)) = init \\<inter> state\"\nby (simp add: Init_def)\n\nlemma Acts_eq [simp]:\n     \"Acts(mk_program(init, acts, allowed)) = \n      cons(id(state), acts  \\<inter> Pow(state*state))\"\nby (simp add: Acts_def)\n\nlemma AllowedActs_eq [simp]:\n     \"AllowedActs(mk_program(init, acts, allowed))=\n      cons(id(state), allowed \\<inter> Pow(state*state))\"\nby (simp add: AllowedActs_def)\n\ntext{*Init, Acts, and AlowedActs  of SKIP *}\n\nlemma RawInit_SKIP [simp]: \"RawInit(SKIP) = state\"\nby (simp add: SKIP_def)\n\nlemma RawAllowedActs_SKIP [simp]: \"RawAllowedActs(SKIP) = Pow(state*state)\"\nby (force simp add: SKIP_def)\n\nlemma RawActs_SKIP [simp]: \"RawActs(SKIP) = {id(state)}\"\nby (force simp add: SKIP_def)\n\nlemma Init_SKIP [simp]: \"Init(SKIP) = state\"\nby (force simp add: SKIP_def)\n\nlemma Acts_SKIP [simp]: \"Acts(SKIP) = {id(state)}\"\nby (force simp add: SKIP_def)\n\nlemma AllowedActs_SKIP [simp]: \"AllowedActs(SKIP) = Pow(state*state)\"\nby (force simp add: SKIP_def)\n\ntext{*Equality of UNITY programs*}\n\nlemma raw_surjective_mk_program:\n     \"F \\<in> program ==> mk_program(RawInit(F), RawActs(F), RawAllowedActs(F))=F\"\napply (auto simp add: program_def mk_program_def RawInit_def RawActs_def\n            RawAllowedActs_def, blast+)\ndone\n\nlemma surjective_mk_program [simp]:\n  \"mk_program(Init(F), Acts(F), AllowedActs(F)) = programify(F)\"\nby (auto simp add: raw_surjective_mk_program Init_def Acts_def AllowedActs_def)\n\nlemma program_equalityI:                             \n    \"[|Init(F) = Init(G); Acts(F) = Acts(G);\n       AllowedActs(F) = AllowedActs(G); F \\<in> program; G \\<in> program |] ==> F = G\"\napply (subgoal_tac \"programify(F) = programify(G)\") \napply simp \napply (simp only: surjective_mk_program [symmetric]) \ndone\n\nlemma program_equalityE:                             \n \"[|F = G;\n    [|Init(F) = Init(G); Acts(F) = Acts(G); AllowedActs(F) = AllowedActs(G) |]\n    ==> P |] \n  ==> P\"\nby force\n\n\nlemma program_equality_iff:\n    \"[| F \\<in> program; G \\<in> program |] ==>(F=G)  \\<longleftrightarrow>\n     (Init(F) = Init(G) & Acts(F) = Acts(G) & AllowedActs(F) = AllowedActs(G))\"\nby (blast intro: program_equalityI program_equalityE)\n\nsubsection{*These rules allow \"lazy\" definition expansion*}\n\nlemma def_prg_Init:\n     \"F == mk_program (init,acts,allowed) ==> Init(F) = init \\<inter> state\"\nby auto\n\nlemma def_prg_Acts:\n     \"F == mk_program (init,acts,allowed)\n      ==> Acts(F) = cons(id(state), acts \\<inter> Pow(state*state))\"\nby auto\n\nlemma def_prg_AllowedActs:\n     \"F == mk_program (init,acts,allowed)\n      ==> AllowedActs(F) = cons(id(state), allowed \\<inter> Pow(state*state))\"\nby auto\n\nlemma def_prg_simps:\n    \"[| F == mk_program (init,acts,allowed) |]\n     ==> Init(F) = init \\<inter> state & \n         Acts(F) = cons(id(state), acts \\<inter> Pow(state*state)) &\n         AllowedActs(F) = cons(id(state), allowed \\<inter> Pow(state*state))\"\nby auto\n\n\ntext{*An action is expanded only if a pair of states is being tested against it*}\nlemma def_act_simp:\n     \"[| act == {<s,s'> \\<in> A*B. P(s, s')} |]\n      ==> (<s,s'> \\<in> act) \\<longleftrightarrow> (<s,s'> \\<in> A*B & P(s, s'))\"\nby auto\n\ntext{*A set is expanded only if an element is being tested against it*}\nlemma def_set_simp: \"A == B ==> (x \\<in> A) \\<longleftrightarrow> (x \\<in> B)\"\nby auto\n\n\nsubsection{*The Constrains Operator*}\n\nlemma constrains_type: \"A co B \\<subseteq> program\"\nby (force simp add: constrains_def)\n\nlemma constrainsI:\n    \"[|(!!act s s'. [| act: Acts(F);  <s,s'> \\<in> act; s \\<in> A|] ==> s' \\<in> A');\n        F \\<in> program; st_set(A) |]  ==> F \\<in> A co A'\"\nby (force simp add: constrains_def)\n\nlemma constrainsD:\n   \"F \\<in> A co B ==> \\<forall>act \\<in> Acts(F). act``A\\<subseteq>B\"\nby (force simp add: constrains_def)\n\nlemma constrainsD2: \"F \\<in> A co B ==> F \\<in> program & st_set(A)\"\nby (force simp add: constrains_def)\n\nlemma constrains_empty [iff]: \"F \\<in> 0 co B \\<longleftrightarrow> F \\<in> program\"\nby (force simp add: constrains_def st_set_def)\n\nlemma constrains_empty2 [iff]: \"(F \\<in> A co 0) \\<longleftrightarrow> (A=0 & F \\<in> program)\"\nby (force simp add: constrains_def st_set_def)\n\nlemma constrains_state [iff]: \"(F \\<in> state co B) \\<longleftrightarrow> (state\\<subseteq>B & F \\<in> program)\"\napply (cut_tac F = F in Acts_type)\napply (force simp add: constrains_def st_set_def)\ndone\n\nlemma constrains_state2 [iff]: \"F \\<in> A co state \\<longleftrightarrow> (F \\<in> program & st_set(A))\"\napply (cut_tac F = F in Acts_type)\napply (force simp add: constrains_def st_set_def)\ndone\n\ntext{*monotonic in 2nd argument*}\nlemma constrains_weaken_R:\n    \"[| F \\<in> A co A'; A'\\<subseteq>B' |] ==> F \\<in> A co B'\"\napply (unfold constrains_def, blast)\ndone\n\ntext{*anti-monotonic in 1st argument*}\nlemma constrains_weaken_L:\n    \"[| F \\<in> A co A'; B\\<subseteq>A |] ==> F \\<in> B co A'\"\napply (unfold constrains_def st_set_def, blast)\ndone\n\nlemma constrains_weaken:\n   \"[| F \\<in> A co A'; B\\<subseteq>A; A'\\<subseteq>B' |] ==> F \\<in> B co B'\"\napply (drule constrains_weaken_R)\napply (drule_tac [2] constrains_weaken_L, blast+)\ndone\n\n\nsubsection{*Constrains and Union*}\n\nlemma constrains_Un:\n    \"[| F \\<in> A co A'; F \\<in> B co B' |] ==> F \\<in> (A \\<union> B) co (A' \\<union> B')\"\nby (auto simp add: constrains_def st_set_def, force)\n\nlemma constrains_UN:\n     \"[|!!i. i \\<in> I ==> F \\<in> A(i) co A'(i); F \\<in> program |]\n      ==> F \\<in> (\\<Union>i \\<in> I. A(i)) co (\\<Union>i \\<in> I. A'(i))\"\nby (force simp add: constrains_def st_set_def) \n\nlemma constrains_Un_distrib:\n     \"(A \\<union> B) co C = (A co C) \\<inter> (B co C)\"\nby (force simp add: constrains_def st_set_def)\n\nlemma constrains_UN_distrib:\n   \"i \\<in> I ==> (\\<Union>i \\<in> I. A(i)) co B = (\\<Inter>i \\<in> I. A(i) co B)\"\nby (force simp add: constrains_def st_set_def)\n\n\nsubsection{*Constrains and Intersection*}\n\nlemma constrains_Int_distrib: \"C co (A \\<inter> B) = (C co A) \\<inter> (C co B)\"\nby (force simp add: constrains_def st_set_def)\n\nlemma constrains_INT_distrib:\n     \"x \\<in> I ==> A co (\\<Inter>i \\<in> I. B(i)) = (\\<Inter>i \\<in> I. A co B(i))\"\nby (force simp add: constrains_def st_set_def)\n\nlemma constrains_Int:\n    \"[| F \\<in> A co A'; F \\<in> B co B' |] ==> F \\<in> (A \\<inter> B) co (A' \\<inter> B')\"\nby (force simp add: constrains_def st_set_def)\n\nlemma constrains_INT [rule_format]:\n     \"[| \\<forall>i \\<in> I. F \\<in> A(i) co A'(i); F \\<in> program|]\n      ==> F \\<in> (\\<Inter>i \\<in> I. A(i)) co (\\<Inter>i \\<in> I. A'(i))\"\napply (case_tac \"I=0\")\n apply (simp add: Inter_def)\napply (erule not_emptyE)\napply (auto simp add: constrains_def st_set_def, blast) \napply (drule bspec, assumption, force) \ndone\n\n(* The rule below simulates the HOL's one for (\\<Inter>z. A i) co (\\<Inter>z. B i) *)\nlemma constrains_All:\n\"[| \\<forall>z. F:{s \\<in> state. P(s, z)} co {s \\<in> state. Q(s, z)}; F \\<in> program |]==>\n    F:{s \\<in> state. \\<forall>z. P(s, z)} co {s \\<in> state. \\<forall>z. Q(s, z)}\"\nby (unfold constrains_def, blast)\n\nlemma constrains_imp_subset:\n  \"[| F \\<in> A co A' |] ==> A \\<subseteq> A'\"\nby (unfold constrains_def st_set_def, force)\n\ntext{*The reasoning is by subsets since \"co\" refers to single actions\n  only.  So this rule isn't that useful.*}\n\nlemma constrains_trans: \"[| F \\<in> A co B; F \\<in> B co C |] ==> F \\<in> A co C\"\nby (unfold constrains_def st_set_def, auto, blast)\n\nlemma constrains_cancel:\n\"[| F \\<in> A co (A' \\<union> B); F \\<in> B co B' |] ==> F \\<in> A co (A' \\<union> B')\"\napply (drule_tac A = B in constrains_imp_subset)\napply (blast intro: constrains_weaken_R)\ndone\n\n\nsubsection{*The Unless Operator*}\n\nlemma unless_type: \"A unless B \\<subseteq> program\"\nby (force simp add: unless_def constrains_def) \n\nlemma unlessI: \"[| F \\<in> (A-B) co (A \\<union> B) |] ==> F \\<in> A unless B\"\napply (unfold unless_def)\napply (blast dest: constrainsD2)\ndone\n\nlemma unlessD: \"F :A unless B ==> F \\<in> (A-B) co (A \\<union> B)\"\nby (unfold unless_def, auto)\n\n\nsubsection{*The Operator @{term initially}*}\n\nlemma initially_type: \"initially(A) \\<subseteq> program\"\nby (unfold initially_def, blast)\n\nlemma initiallyI: \"[| F \\<in> program; Init(F)\\<subseteq>A |] ==> F \\<in> initially(A)\"\nby (unfold initially_def, blast)\n\nlemma initiallyD: \"F \\<in> initially(A) ==> Init(F)\\<subseteq>A\"\nby (unfold initially_def, blast)\n\n\nsubsection{*The Operator @{term stable}*}\n\nlemma stable_type: \"stable(A)\\<subseteq>program\"\nby (unfold stable_def constrains_def, blast)\n\nlemma stableI: \"F \\<in> A co A ==> F \\<in> stable(A)\"\nby (unfold stable_def, assumption)\n\nlemma stableD: \"F \\<in> stable(A) ==> F \\<in> A co A\"\nby (unfold stable_def, assumption)\n\nlemma stableD2: \"F \\<in> stable(A) ==> F \\<in> program & st_set(A)\"\nby (unfold stable_def constrains_def, auto)\n\nlemma stable_state [simp]: \"stable(state) = program\"\nby (auto simp add: stable_def constrains_def dest: Acts_type [THEN subsetD])\n\n\nlemma stable_unless: \"stable(A)= A unless 0\"\nby (auto simp add: unless_def stable_def)\n\n\nsubsection{*Union and Intersection with @{term stable}*}\n\nlemma stable_Un:\n    \"[| F \\<in> stable(A); F \\<in> stable(A') |] ==> F \\<in> stable(A \\<union> A')\"\napply (unfold stable_def)\napply (blast intro: constrains_Un)\ndone\n\nlemma stable_UN:\n     \"[|!!i. i\\<in>I ==> F \\<in> stable(A(i)); F \\<in> program |] \n      ==> F \\<in> stable (\\<Union>i \\<in> I. A(i))\"\napply (unfold stable_def)\napply (blast intro: constrains_UN)\ndone\n\nlemma stable_Int:\n    \"[| F \\<in> stable(A);  F \\<in> stable(A') |] ==> F \\<in> stable (A \\<inter> A')\"\napply (unfold stable_def)\napply (blast intro: constrains_Int)\ndone\n\nlemma stable_INT:\n     \"[| !!i. i \\<in> I ==> F \\<in> stable(A(i)); F \\<in> program |]\n      ==> F \\<in> stable (\\<Inter>i \\<in> I. A(i))\"\napply (unfold stable_def)\napply (blast intro: constrains_INT)\ndone\n\nlemma stable_All:\n    \"[|\\<forall>z. F \\<in> stable({s \\<in> state. P(s, z)}); F \\<in> program|]\n     ==> F \\<in> stable({s \\<in> state. \\<forall>z. P(s, z)})\"\napply (unfold stable_def)\napply (rule constrains_All, auto)\ndone\n\nlemma stable_constrains_Un:\n     \"[| F \\<in> stable(C); F \\<in> A co (C \\<union> A') |] ==> F \\<in> (C \\<union> A) co (C \\<union> A')\"\napply (unfold stable_def constrains_def st_set_def, auto)\napply (blast dest!: bspec)\ndone\n\nlemma stable_constrains_Int:\n     \"[| F \\<in> stable(C); F \\<in>  (C \\<inter> A) co A' |] ==> F \\<in> (C \\<inter> A) co (C \\<inter> A')\"\nby (unfold stable_def constrains_def st_set_def, blast)\n\n(* [| F \\<in> stable(C); F  \\<in> (C \\<inter> A) co A |] ==> F \\<in> stable(C \\<inter> A) *)\nlemmas stable_constrains_stable = stable_constrains_Int [THEN stableI]\n\nsubsection{*The Operator @{term invariant}*}\n\nlemma invariant_type: \"invariant(A) \\<subseteq> program\"\napply (unfold invariant_def)\napply (blast dest: stable_type [THEN subsetD])\ndone\n\nlemma invariantI: \"[| Init(F)\\<subseteq>A;  F \\<in> stable(A) |] ==> F \\<in> invariant(A)\"\napply (unfold invariant_def initially_def)\napply (frule stable_type [THEN subsetD], auto)\ndone\n\nlemma invariantD: \"F \\<in> invariant(A) ==> Init(F)\\<subseteq>A & F \\<in> stable(A)\"\nby (unfold invariant_def initially_def, auto)\n\nlemma invariantD2: \"F \\<in> invariant(A) ==> F \\<in> program & st_set(A)\"\napply (unfold invariant_def)\napply (blast dest: stableD2)\ndone\n\ntext{*Could also say\n      @{term \"invariant(A) \\<inter> invariant(B) \\<subseteq> invariant (A \\<inter> B)\"}*}\nlemma invariant_Int:\n  \"[| F \\<in> invariant(A);  F \\<in> invariant(B) |] ==> F \\<in> invariant(A \\<inter> B)\"\napply (unfold invariant_def initially_def)\napply (simp add: stable_Int, blast)\ndone\n\n\nsubsection{*The Elimination Theorem*}\n\n(** The \"free\" m has become universally quantified!\n Should the premise be !!m instead of \\<forall>m ? Would make it harder\n to use in forward proof. **)\n\ntext{*The general case is easier to prove than the special case!*}\nlemma \"elimination\":\n    \"[| \\<forall>m \\<in> M. F \\<in> {s \\<in> A. x(s) = m} co B(m); F \\<in> program  |]\n     ==> F \\<in> {s \\<in> A. x(s) \\<in> M} co (\\<Union>m \\<in> M. B(m))\"\nby (auto simp add: constrains_def st_set_def, blast)\n\ntext{*As above, but for the special case of A=state*}\nlemma elimination2:\n     \"[| \\<forall>m \\<in> M. F \\<in> {s \\<in> state. x(s) = m} co B(m); F \\<in> program  |]\n     ==> F:{s \\<in> state. x(s) \\<in> M} co (\\<Union>m \\<in> M. B(m))\"\nby (rule UNITY.elimination, auto)\n\nsubsection{*The Operator @{term strongest_rhs}*}\n\nlemma constrains_strongest_rhs:\n    \"[| F \\<in> program; st_set(A) |] ==> F \\<in> A co (strongest_rhs(F,A))\"\nby (auto simp add: constrains_def strongest_rhs_def st_set_def\n              dest: Acts_type [THEN subsetD])\n\nlemma strongest_rhs_is_strongest:\n     \"[| F \\<in> A co B; st_set(B) |] ==> strongest_rhs(F,A) \\<subseteq> B\"\nby (auto simp add: constrains_def strongest_rhs_def st_set_def)\n\nML {*\nfun simp_of_act def = def RS @{thm def_act_simp};\nfun simp_of_set def = def RS @{thm def_set_simp};\n*}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/ZF/UNITY/UNITY.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.34347018272207214}}
{"text": "(*\nTitle: WHATandWHERE-Security\nAuthors: Sylvia Grewe, Alexander Lux, Heiko Mantel, Jens Sauer\n*)\ntheory Type_System_example\nimports Type_System \"../Strong_Security/Expr\" \"../Strong_Security/Domain_example\"\nbegin\n\n--\"When interpreting, we have to instantiate the type for domains. As an example, we take a type containing 'low' and 'high' as domains.\"\n\nconsts DA :: \"('id,Dom) DomainAssignment\"\nconsts BMap :: \"'val \\<Rightarrow> bool\"\nconsts lH :: \"(Dom,('id,'val) Expr) lHatches\"\n\n--\"redefine all the abbreviations necessary for auxiliary lemmas with the \n  correct parameter instantiation\"\n\nabbreviation MWLsStepsdet' :: \n  \"(('id,'val) Expr, 'id, 'val, (('id,'val) Expr,'id) MWLsCom) TLSteps_curry\"\n(\"(1\\<langle>_,/_\\<rangle>) \\<rightarrow>\\<lhd>_\\<rhd>/ (1\\<langle>_,/_\\<rangle>)\" [0,0,0,0,0] 81)\nwhere\n\"\\<langle>c1,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>c2,m2\\<rangle> \\<equiv> \n  ((c1,m1),\\<alpha>,(c2,m2)) \\<in> MWLs_semantics.MWLsSteps_det ExprEval BMap\"\n\nabbreviation d_equal' :: \"('id, 'val) State \n  \\<Rightarrow> Dom \\<Rightarrow> ('id, 'val) State \\<Rightarrow> bool\" \n( \"(_ =\\<^bsub>_\\<^esub> _)\" )\nwhere\n\"m =\\<^bsub>d\\<^esub> m' \\<equiv> WHATWHERE.d_equal DA d m m'\"\n\nabbreviation dH_equal' :: \"('id, 'val) State \\<Rightarrow> Dom \n  \\<Rightarrow> (Dom,('id,'val) Expr) Hatches\n  \\<Rightarrow> ('id, 'val) State \\<Rightarrow> bool\"\n( \"(_ \\<sim>\\<^bsub>_,_\\<^esub> _)\" )\nwhere\n\"m \\<sim>\\<^bsub>d,H\\<^esub> m' \\<equiv> WHATWHERE.dH_equal ExprEval DA d H m m'\"\n\nabbreviation NextMem' :: \"(('id,'val) Expr, 'id) MWLsCom \n  \\<Rightarrow> ('id,'val) State \\<Rightarrow> ('id,'val) State\"\n(\"\\<lbrakk>_\\<rbrakk>'(_')\")\nwhere\n\"\\<lbrakk>c\\<rbrakk>(m) \n  \\<equiv> WHATWHERE.NextMem (MWLs_semantics.MWLsSteps_det ExprEval BMap) c m\"\n\nabbreviation dH_indistinguishable' :: \"('id,'val) Expr \\<Rightarrow> Dom \n  \\<Rightarrow> (Dom,('id,'val) Expr) Hatches \\<Rightarrow> ('id,'val) Expr \\<Rightarrow> bool\" \n( \"(_ \\<equiv>\\<^bsub>_,_\\<^esub> _)\" )\nwhere\n\"e1 \\<equiv>\\<^bsub>d,H\\<^esub> e2 \n  \\<equiv> WHATWHERE_Secure_Programs.dH_indistinguishable ExprEval DA d H e1 e2\"\n\nabbreviation htchLoc :: \"nat \\<Rightarrow> (Dom, ('id,'val) Expr) Hatches\"\nwhere \n\"htchLoc \\<iota> \\<equiv> WHATWHERE.htchLoc lH \\<iota>\"\n\n\n-- \"Security typing rules for expressions\"\ninductive \nExprSecTyping :: \"(Dom, ('id,'val) Expr) Hatches\n  \\<Rightarrow> ('id, 'val) Expr \\<Rightarrow> Dom \\<Rightarrow> bool\"\n(\"_ \\<turnstile>\\<^bsub>\\<E>\\<^esub> _ : _\")\nfor H :: \"(Dom, ('id, 'val) Expr) Hatches\"\nwhere \nConsts: \"H \\<turnstile>\\<^bsub>\\<E>\\<^esub> (Const v) : d\" |\nVars: \"DA x = d \\<Longrightarrow> H \\<turnstile>\\<^bsub>\\<E>\\<^esub> (Var x) : d\" |\nHatch: \"(d,e) \\<in> H \\<Longrightarrow> H \\<turnstile>\\<^bsub>\\<E>\\<^esub> e : d\" |\nOps: \"\\<lbrakk> \\<forall>i < length arglist. H \\<turnstile>\\<^bsub>\\<E>\\<^esub> (arglist!i) : (dl!i) \\<and> (dl!i) \\<le> d \\<rbrakk>\n  \\<Longrightarrow> H \\<turnstile>\\<^bsub>\\<E>\\<^esub> (Op f arglist) : d\"\n\n--\"function substituting a certain expression with another expression \n  in expressions\"\nprimrec Subst :: \"('id, 'val) Expr \\<Rightarrow> ('id, 'val) Expr \n  \\<Rightarrow> ('id, 'val) Expr \\<Rightarrow> ('id, 'val) Expr\"\n(\"_<_\\\\_>\")\nand SubstL :: \"('id, 'val) Expr list \\<Rightarrow> ('id, 'val) Expr \n  \\<Rightarrow> ('id, 'val) Expr \\<Rightarrow> ('id, 'val) Expr list\"\nwhere\n\"(Const v)<e1\\\\e2> = (if e1=(Const v) then e2 else (Const v))\" |\n\"(Var x)<e1\\\\e2> = (if e1=(Var x) then e2 else (Var x))\" |\n\"(Op f arglist)<e1\\\\e2> = (if e1=(Op f arglist) then e2 else \n  (Op f (SubstL arglist e1 e2)))\" |\n\n\"SubstL [] e1 e2 = []\" |\n\"SubstL (e#V) e1 e2 = (e<e1\\\\e2>)#(SubstL V e1 e2)\"\n\n\ndefinition SubstClosure :: \"'id \\<Rightarrow> ('id, 'val) Expr \\<Rightarrow> bool\"\nwhere\n\"SubstClosure x e \\<equiv> \\<forall>(d',e',\\<iota>') \\<in> lH. (d',e'<(Var x)\\\\e>,\\<iota>') \\<in> lH\"\n\ndefinition synAssignSC :: \"'id \\<Rightarrow> ('id, 'val) Expr \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n\"synAssignSC x e \\<iota> \\<equiv> \\<exists>d. ((htchLoc \\<iota>) \\<turnstile>\\<^bsub>\\<E>\\<^esub> e : d \\<and> d \\<le> DA x)\n  \\<and> (SubstClosure x e)\"\n\ndefinition synWhileSC :: \"('id, 'val) Expr \\<Rightarrow> bool\"\nwhere\n\"synWhileSC e \\<equiv> (\\<exists>d. ({} \\<turnstile>\\<^bsub>\\<E>\\<^esub> e : d) \\<and> (\\<forall>d'. d \\<le> d'))\"\n\ndefinition synIfSC :: \"('id, 'val) Expr\n  \\<Rightarrow> (('id, 'val) Expr, 'id) MWLsCom \n  \\<Rightarrow> (('id, 'val) Expr, 'id) MWLsCom \\<Rightarrow> bool\" \nwhere\n\"synIfSC e c1 c2 \\<equiv> \\<exists>d. ({} \\<turnstile>\\<^bsub>\\<E>\\<^esub> e : d \\<and> (\\<forall>d'. d \\<le> d'))\"\n\n\n--\"auxiliary lemma for locale interpretation (theorem 7 in original paper)\"\nlemma ExprTypable_with_smallerd_implies_dH_indistinguishable:\n  \"\\<lbrakk> H \\<turnstile>\\<^bsub>\\<E>\\<^esub> e : d'; d' \\<le> d \\<rbrakk> \\<Longrightarrow> e \\<equiv>\\<^bsub>d,H\\<^esub> e\"\nproof (induct rule: ExprSecTyping.induct, \n    simp_all add: WHATWHERE_Secure_Programs.dH_indistinguishable_def \n    WHATWHERE.dH_equal_def WHATWHERE.d_equal_def, auto)\n  fix dl arglist f m1 m2 d' d\n  assume main: \"\\<forall>i < length arglist.\n    (H \\<turnstile>\\<^bsub>\\<E>\\<^esub> (arglist!i) : (dl!i)) \\<and> (dl!i \\<le> d \\<longrightarrow>\n    (\\<forall>m1 m2. (\\<forall>x. DA x \\<le> d \\<longrightarrow> m1 x = m2 x) \\<and>\n    (\\<forall>(d',e)\\<in>H. d' \\<le> d \\<longrightarrow> ExprEval e m1 = ExprEval e m2) \\<longrightarrow>\n    ExprEval (arglist!i) m1 = ExprEval (arglist!i) m2)) \\<and> dl!i \\<le> d'\"\n  assume smaller: \"d' \\<le> d\"\n  assume eqeval: \"\\<forall>(d',e) \\<in> H. d' \\<le> d \\<longrightarrow> ExprEval e m1 = ExprEval e m2\"\n  assume eqstate: \"\\<forall>x. DA x \\<le> d \\<longrightarrow> m1 x = m2 x\"\n  \n  from main smaller have irangesubst:\n    \"\\<forall>i < length arglist. dl!i \\<le> d\"\n    by (metis order_trans)\n\n  with eqstate eqeval main have \n    \"\\<forall>i < length arglist. ExprEval (arglist!i) m1 \n       = ExprEval (arglist!i) m2\"\n    by force\n\n  hence substmap: \"(ExprEvalL arglist m1) = (ExprEvalL arglist m2)\" \n    by (induct arglist, auto, force)\n\n  show \"f (ExprEvalL arglist m1) = f (ExprEvalL arglist m2)\"\n    by (subst substmap, auto)\n\nqed\n\n--\"auxiliary lemma about substitutions in expressions and in memories\"\nlemma substexp_substmem:\n\"ExprEval e'<Var x\\\\e> m = ExprEval e' (m(x := ExprEval e m))\n  \\<and> ExprEvalL (SubstL elist (Var x) e) m\n  = ExprEvalL elist (m(x := ExprEval e m))\"\nby (induct_tac e' and elist rule: ExprEval.induct ExprEvalL.induct, simp_all)\n\n\n--\"another auxiliary lemma for locale interpretation (lemma 8 in original paper)\"\nlemma SubstClosure_implications:\n\"\\<lbrakk> SubstClosure x e; m \\<sim>\\<^bsub>d,(htchLoc \\<iota>')\\<^esub> m'; \n  \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m) =\\<^bsub>d\\<^esub> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m') \\<rbrakk>\n  \\<Longrightarrow> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m) \\<sim>\\<^bsub>d,(htchLoc \\<iota>')\\<^esub> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m')\"\nproof -\n  fix m1 m1'\n  assume substclosure: \"SubstClosure x e\"\n  assume dequalm2: \"\\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m1) =\\<^bsub>d\\<^esub> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m1')\"\n  assume dhequalm1: \"m1 \\<sim>\\<^bsub>d,(htchLoc \\<iota>')\\<^esub> m1'\"  \n  \n  from MWLs_semantics.nextmem_exists_and_unique obtain m2 where m1step:\n    \"(\\<exists>p \\<alpha>. \\<langle>x :=\\<^bsub>\\<iota>\\<^esub> e,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m2\\<rangle>) \n    \\<and> (\\<forall>m''. (\\<exists>p \\<alpha>. \\<langle>x :=\\<^bsub>\\<iota>\\<^esub> e,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m''\\<rangle>) \\<longrightarrow> m'' = m2)\"\n    by force\n  hence m2_is_next: \"\\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m1) = m2\"\n    by (simp add: WHATWHERE.NextMem_def, auto)\n  from m1step MWLs_semantics.MWLsSteps_det.assign\n     [of \"ExprEval\" \"e\" \"m1\" _ \"x\" \"\\<iota>\" \"BMap\"]\n  have m2eq: \"m2 = m1(x := (ExprEval e m1))\"\n    by auto\n\n  from MWLs_semantics.nextmem_exists_and_unique obtain m2' where m1'step:\n    \"(\\<exists>p \\<alpha>. \\<langle>x :=\\<^bsub>\\<iota>\\<^esub> e,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m2'\\<rangle>) \n    \\<and> (\\<forall>m''. (\\<exists>p \\<alpha>. \\<langle>x :=\\<^bsub>\\<iota>\\<^esub> e,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m''\\<rangle>) \\<longrightarrow> m'' = m2')\"\n    by force\n  hence m2'_is_next: \"\\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m1') = m2'\"\n    by (simp add: WHATWHERE.NextMem_def, auto)\n  from m1'step MWLs_semantics.MWLsSteps_det.assign\n     [of \"ExprEval\" \"e\" \"m1'\" _ \"x\" \"\\<iota>\" \"BMap\"]\n  have m2'eq: \"m2' = m1'(x := (ExprEval e m1'))\"\n    by auto\n\n  from m2eq substexp_substmem\n  have substeval1: \"\\<forall>e'. ExprEval (e'<Var x\\\\e>) m1 = ExprEval e' m2\"\n    by force\n\n  from m2'eq substexp_substmem\n  have substeval2: \"\\<forall>e'. ExprEval e'<Var x\\\\e> m1' = ExprEval e' m2'\"\n    by force\n   \n  from substclosure have \n    \"\\<forall>(d',e') \\<in> htchLoc \\<iota>'. (d',e'<Var x\\\\e>) \\<in> (htchLoc \\<iota>')\"\n    by (simp add: SubstClosure_def WHATWHERE.htchLoc_def, auto)\n\n  with dhequalm1 have \n    \"\\<forall>(d',e') \\<in> htchLoc \\<iota>'. \n    d' \\<le> d \\<longrightarrow> ExprEval e'<Var x\\\\e> m1 = ExprEval e'<Var x\\\\e> m1'\"\n    by (simp add: WHATWHERE.dH_equal_def, auto)\n\n  with substeval1 substeval2 have \n    \"\\<forall>(d',e') \\<in> htchLoc \\<iota>'.\n    d' \\<le> d \\<longrightarrow> ExprEval e' m2 = ExprEval e' m2'\"\n    by auto\n\n  with dequalm2 m2_is_next m2'_is_next\n  show \"\\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m1) \\<sim>\\<^bsub>d,htchLoc \\<iota>'\\<^esub> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m1')\"\n    by (simp add: WHATWHERE.dH_equal_def)\nqed\n\n--\"interpretation of the abstract type system using the above definitions for the side conditions\"\ninterpretation Type_System_example: Type_System ExprEval BMap DA lH\n  synAssignSC synWhileSC synIfSC\nby (unfold_locales, auto,\n  metis ExprTypable_with_smallerd_implies_dH_indistinguishable \n  synAssignSC_def,\n  metis SubstClosure_implications synAssignSC_def, \n  simp add: synWhileSC_def,\n  metis ExprTypable_with_smallerd_implies_dH_indistinguishable \n  WHATWHERE_Secure_Programs.empH_implies_dHindistinguishable_eq_dindistinguishable, \n  simp add: synIfSC_def,\n  metis ExprTypable_with_smallerd_implies_dH_indistinguishable \n  WHATWHERE_Secure_Programs.empH_implies_dHindistinguishable_eq_dindistinguishable)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/WHATandWHERE_Security/Type_System_example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.34347018272207214}}
{"text": "(*  Title:      HOL/Auth/n_mutualEx_lemma_inv__4_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_inv__4_on_rules imports n_mutualEx_lemma_on_inv__4\nbegin\nsection{*All lemmas on causal relation between inv__4*}\nlemma lemma_inv__4_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__4  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_TryVsinv__4) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_CritVsinv__4) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_ExitVsinv__4) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_IdleVsinv__4) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mutualEx/n_mutualEx_lemma_inv__4_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.7090191337850932, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.34343474777681793}}
{"text": "section {* Operational Semantics *}\n\ntheory OG_Tran imports OG_Com begin\n\ntype_synonym 'a ann_com_op = \"('a ann_com) option\"\ntype_synonym 'a ann_triple_op = \"('a ann_com_op \\<times> 'a assn)\"\n  \nprimrec com :: \"'a ann_triple_op \\<Rightarrow> 'a ann_com_op\" where\n  \"com (c, q) = c\"\n\nprimrec post :: \"'a ann_triple_op \\<Rightarrow> 'a assn\" where\n  \"post (c, q) = q\"\n\ndefinition All_None :: \"'a ann_triple_op list \\<Rightarrow> bool\" where\n  \"All_None Ts \\<equiv> \\<forall>(c, q) \\<in> set Ts. c = None\"\n\nsubsection {* The Transition Relation *}\n\ninductive_set\n  ann_transition :: \"(('a ann_com_op \\<times> 'a) \\<times> ('a ann_com_op \\<times> 'a)) set\"        \n  and transition :: \"(('a com \\<times> 'a) \\<times> ('a com \\<times> 'a)) set\"\n  and ann_transition' :: \"('a ann_com_op \\<times> 'a) \\<Rightarrow> ('a ann_com_op \\<times> 'a) \\<Rightarrow> bool\"\n    (\"_ -1\\<rightarrow> _\"[81,81] 100)\n  and transition' :: \"('a com \\<times> 'a) \\<Rightarrow> ('a com \\<times> 'a) \\<Rightarrow> bool\"\n    (\"_ -P1\\<rightarrow> _\"[81,81] 100)\n  and transitions :: \"('a com \\<times> 'a) \\<Rightarrow> ('a com \\<times> 'a) \\<Rightarrow> bool\"\n    (\"_ -P*\\<rightarrow> _\"[81,81] 100)\nwhere\n  \"con_0 -1\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> ann_transition\"\n| \"con_0 -P1\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> transition\"\n| \"con_0 -P*\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> transition\\<^sup>*\"\n\n| AnnBasic:  \"(Some (AnnBasic r f), s) -1\\<rightarrow> (None, f s)\"\n\n| AnnSeq1: \"(Some c0, s) -1\\<rightarrow> (None, t) \\<Longrightarrow> \n               (Some (AnnSeq c0 c1), s) -1\\<rightarrow> (Some c1, t)\"\n| AnnSeq2: \"(Some c0, s) -1\\<rightarrow> (Some c2, t) \\<Longrightarrow> \n               (Some (AnnSeq c0 c1), s) -1\\<rightarrow> (Some (AnnSeq c2 c1), t)\"\n\n| AnnCond1T: \"s \\<in> b  \\<Longrightarrow> (Some (AnnCond1 r b c1 c2), s) -1\\<rightarrow> (Some c1, s)\"\n| AnnCond1F: \"s \\<notin> b \\<Longrightarrow> (Some (AnnCond1 r b c1 c2), s) -1\\<rightarrow> (Some c2, s)\"\n\n| AnnCond2T: \"s \\<in> b  \\<Longrightarrow> (Some (AnnCond2 r b c), s) -1\\<rightarrow> (Some c, s)\"\n| AnnCond2F: \"s \\<notin> b \\<Longrightarrow> (Some (AnnCond2 r b c), s) -1\\<rightarrow> (None, s)\"\n\n| AnnWhileF: \"s \\<notin> b \\<Longrightarrow> (Some (AnnWhile r b i c), s) -1\\<rightarrow> (None, s)\"\n| AnnWhileT: \"s \\<in> b  \\<Longrightarrow> (Some (AnnWhile r b i c), s) -1\\<rightarrow> \n                         (Some (AnnSeq c (AnnWhile i b i c)), s)\"\n\n| AnnAwait: \"\\<lbrakk> s \\<in> b; atom_com c; (c, s) -P*\\<rightarrow> (Parallel [], t) \\<rbrakk> \\<Longrightarrow>\n                   (Some (AnnAwait r b c), s) -1\\<rightarrow> (None, t)\" \n\n| Parallel: \"\\<lbrakk> i<length Ts; Ts!i = (Some c, q); (Some c, s) -1\\<rightarrow> (r, t) \\<rbrakk>\n              \\<Longrightarrow> (Parallel Ts, s) -P1\\<rightarrow> (Parallel (Ts [i:=(r, q)]), t)\"\n\n| Basic:  \"(Basic f, s) -P1\\<rightarrow> (Parallel [], f s)\"\n\n| Seq1:   \"All_None Ts \\<Longrightarrow> (Seq (Parallel Ts) c, s) -P1\\<rightarrow> (c, s)\"\n| Seq2:   \"(c0, s) -P1\\<rightarrow> (c2, t) \\<Longrightarrow> (Seq c0 c1, s) -P1\\<rightarrow> (Seq c2 c1, t)\"\n\n| CondT: \"s \\<in> b \\<Longrightarrow> (Cond b c1 c2, s) -P1\\<rightarrow> (c1, s)\"\n| CondF: \"s \\<notin> b \\<Longrightarrow> (Cond b c1 c2, s) -P1\\<rightarrow> (c2, s)\"\n\n| WhileF: \"s \\<notin> b \\<Longrightarrow> (While b i c, s) -P1\\<rightarrow> (Parallel [], s)\"\n| WhileT: \"s \\<in> b \\<Longrightarrow> (While b i c, s) -P1\\<rightarrow> (Seq c (While b i c), s)\"\n\nmonos \"rtrancl_mono\"\n\ntext {* The corresponding abbreviations are: *}\n\nabbreviation\n  ann_transition_n :: \"('a ann_com_op \\<times> 'a) \\<Rightarrow> nat \\<Rightarrow> ('a ann_com_op \\<times> 'a) \n                           \\<Rightarrow> bool\"  (\"_ -_\\<rightarrow> _\"[81,81] 100)  where\n  \"con_0 -n\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> ann_transition ^^ n\"\n\nabbreviation\n  ann_transitions :: \"('a ann_com_op \\<times> 'a) \\<Rightarrow> ('a ann_com_op \\<times> 'a) \\<Rightarrow> bool\"\n                           (\"_ -*\\<rightarrow> _\"[81,81] 100)  where\n  \"con_0 -*\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> ann_transition\\<^sup>*\"\n\nabbreviation\n  transition_n :: \"('a com \\<times> 'a) \\<Rightarrow> nat \\<Rightarrow> ('a com \\<times> 'a) \\<Rightarrow> bool\"  \n                          (\"_ -P_\\<rightarrow> _\"[81,81,81] 100)  where\n  \"con_0 -Pn\\<rightarrow> con_1 \\<equiv> (con_0, con_1) \\<in> transition ^^ n\"\n\nsubsection {* Definition of Semantics *}\n\ndefinition ann_sem :: \"'a ann_com \\<Rightarrow> 'a \\<Rightarrow> 'a set\" where\n  \"ann_sem c \\<equiv> \\<lambda>s. {t. (Some c, s) -*\\<rightarrow> (None, t)}\"\n\ndefinition ann_SEM :: \"'a ann_com \\<Rightarrow> 'a set \\<Rightarrow> 'a set\" where\n  \"ann_SEM c S \\<equiv> \\<Union>(ann_sem c ` S)\"\n\ndefinition sem :: \"'a com \\<Rightarrow> 'a \\<Rightarrow> 'a set\" where\n  \"sem c \\<equiv> \\<lambda>s. {t. \\<exists>Ts. (c, s) -P*\\<rightarrow> (Parallel Ts, t) \\<and> All_None Ts}\"\n\ndefinition SEM :: \"'a com \\<Rightarrow> 'a set \\<Rightarrow> 'a set\" where\n  \"SEM c S \\<equiv> \\<Union>(sem c ` S)\"\n\nabbreviation Omega :: \"'a com\"    (\"\\<Omega>\" 63)\n  where \"\\<Omega> \\<equiv> While UNIV UNIV (Basic id)\"\n\nprimrec fwhile :: \"'a bexp \\<Rightarrow> 'a com \\<Rightarrow> nat \\<Rightarrow> 'a com\" where\n    \"fwhile b c 0 = \\<Omega>\"\n  | \"fwhile b c (Suc n) = Cond b (Seq c (fwhile b c n)) (Basic id)\"\n\nsubsubsection {* Proofs *}\n\ndeclare ann_transition_transition.intros [intro]\ninductive_cases transition_cases: \n    \"(Parallel T,s) -P1\\<rightarrow> t\"  \n    \"(Basic f, s) -P1\\<rightarrow> t\"\n    \"(Seq c1 c2, s) -P1\\<rightarrow> t\" \n    \"(Cond b c1 c2, s) -P1\\<rightarrow> t\"\n    \"(While b i c, s) -P1\\<rightarrow> t\"\n\nlemma Parallel_empty_lemma [rule_format (no_asm)]: \n  \"(Parallel [],s) -Pn\\<rightarrow> (Parallel Ts,t) \\<longrightarrow> Ts=[] \\<and> n=0 \\<and> s=t\"\napply(induct n)\n apply(simp (no_asm))\napply clarify\napply(drule relpow_Suc_D2)\napply(force elim:transition_cases)\ndone\n\nlemma Parallel_AllNone_lemma [rule_format (no_asm)]: \n \"All_None Ss \\<longrightarrow> (Parallel Ss,s) -Pn\\<rightarrow> (Parallel Ts,t) \\<longrightarrow> Ts=Ss \\<and> n=0 \\<and> s=t\"\napply(induct \"n\")\n apply(simp (no_asm))\napply clarify\napply(drule relpow_Suc_D2)\napply clarify\napply(erule transition_cases,simp_all)\napply(force dest:nth_mem simp add:All_None_def)\ndone\n\nlemma Parallel_AllNone: \"All_None Ts \\<Longrightarrow> (SEM (Parallel Ts) X) = X\"\napply (unfold SEM_def sem_def)\napply auto\napply(drule rtrancl_imp_UN_relpow)\napply clarify\napply(drule Parallel_AllNone_lemma)\napply auto\ndone\n\nlemma Parallel_empty: \"Ts=[] \\<Longrightarrow> (SEM (Parallel Ts) X) = X\"\napply(rule Parallel_AllNone)\napply(simp add:All_None_def)\ndone\n\ntext {* Set of lemmas from Apt and Olderog \"Verification of sequential\nand concurrent programs\", page 63. *}\n\nlemma L3_5i: \"X\\<subseteq>Y \\<Longrightarrow> SEM c X \\<subseteq> SEM c Y\" \napply (unfold SEM_def)\napply force\ndone\n\nlemma L3_5ii_lemma1: \n \"\\<lbrakk> (c1, s1) -P*\\<rightarrow> (Parallel Ts, s2); All_None Ts;  \n  (c2, s2) -P*\\<rightarrow> (Parallel Ss, s3); All_None Ss \\<rbrakk> \n \\<Longrightarrow> (Seq c1 c2, s1) -P*\\<rightarrow> (Parallel Ss, s3)\"\napply(erule converse_rtrancl_induct2)\napply(force intro:converse_rtrancl_into_rtrancl)+\ndone\n\nlemma L3_5ii_lemma2 [rule_format (no_asm)]: \n \"\\<forall>c1 c2 s t. (Seq c1 c2, s) -Pn\\<rightarrow> (Parallel Ts, t) \\<longrightarrow>  \n  (All_None Ts) \\<longrightarrow> (\\<exists>y m Rs. (c1,s) -P*\\<rightarrow> (Parallel Rs, y) \\<and> \n  (All_None Rs) \\<and> (c2, y) -Pm\\<rightarrow> (Parallel Ts, t) \\<and>  m \\<le> n)\"\napply(induct \"n\")\n apply(force)\napply(safe dest!: relpow_Suc_D2)\napply(erule transition_cases,simp_all)\n apply (fast intro!: le_SucI)\napply (fast intro!: le_SucI elim!: relpow_imp_rtrancl converse_rtrancl_into_rtrancl)\ndone\n\nlemma L3_5ii_lemma3: \n \"\\<lbrakk>(Seq c1 c2,s) -P*\\<rightarrow> (Parallel Ts,t); All_None Ts\\<rbrakk> \\<Longrightarrow> \n    (\\<exists>y Rs. (c1,s) -P*\\<rightarrow> (Parallel Rs,y) \\<and> All_None Rs \n   \\<and> (c2,y) -P*\\<rightarrow> (Parallel Ts,t))\"\napply(drule rtrancl_imp_UN_relpow)\napply(fast dest: L3_5ii_lemma2 relpow_imp_rtrancl)\ndone\n\nlemma L3_5ii: \"SEM (Seq c1 c2) X = SEM c2 (SEM c1 X)\"\napply (unfold SEM_def sem_def)\napply auto\n apply(fast dest: L3_5ii_lemma3)\napply(fast elim: L3_5ii_lemma1)\ndone\n\nlemma L3_5iii: \"SEM (Seq (Seq c1 c2) c3) X = SEM (Seq c1 (Seq c2 c3)) X\"\napply (simp (no_asm) add: L3_5ii)\ndone\n\nlemma L3_5iv:\n \"SEM (Cond b c1 c2) X = (SEM c1 (X \\<inter> b)) Un (SEM c2 (X \\<inter> (-b)))\"\napply (unfold SEM_def sem_def)\napply auto\napply(erule converse_rtranclE)\n prefer 2\n apply (erule transition_cases,simp_all)\n  apply(fast intro: converse_rtrancl_into_rtrancl elim: transition_cases)+\ndone\n\n\nlemma  L3_5v_lemma1[rule_format]: \n \"(S,s) -Pn\\<rightarrow> (T,t) \\<longrightarrow> S=\\<Omega> \\<longrightarrow> (\\<not>(\\<exists>Rs. T=(Parallel Rs) \\<and> All_None Rs))\"\napply (unfold UNIV_def)\napply(rule nat_less_induct)\napply safe\napply(erule relpow_E2)\n apply simp_all\napply(erule transition_cases)\n apply simp_all\napply(erule relpow_E2)\n apply(simp add: Id_def)\napply(erule transition_cases,simp_all)\napply clarify\napply(erule transition_cases,simp_all)\napply(erule relpow_E2,simp)\napply clarify\napply(erule transition_cases)\n apply simp+\n    apply clarify\n    apply(erule transition_cases)\napply simp_all\ndone\n\nlemma L3_5v_lemma2: \"\\<lbrakk>(\\<Omega>, s) -P*\\<rightarrow> (Parallel Ts, t); All_None Ts \\<rbrakk> \\<Longrightarrow> False\"\napply(fast dest: rtrancl_imp_UN_relpow L3_5v_lemma1)\ndone\n\nlemma L3_5v_lemma3: \"SEM (\\<Omega>) S = {}\"\napply (unfold SEM_def sem_def)\napply(fast dest: L3_5v_lemma2)\ndone\n\nlemma L3_5v_lemma4 [rule_format]: \n \"\\<forall>s. (While b i c, s) -Pn\\<rightarrow> (Parallel Ts, t) \\<longrightarrow> All_None Ts \\<longrightarrow>  \n  (\\<exists>k. (fwhile b c k, s) -P*\\<rightarrow> (Parallel Ts, t))\"\napply(rule nat_less_induct)\napply safe\napply(erule relpow_E2)\n apply safe\napply(erule transition_cases,simp_all)\n apply (rule_tac x = \"1\" in exI)\n apply(force dest: Parallel_empty_lemma intro: converse_rtrancl_into_rtrancl simp add: Id_def)\napply safe\napply(drule L3_5ii_lemma2)\n apply safe\napply(drule le_imp_less_Suc)\napply (erule allE , erule impE,assumption)\napply (erule allE , erule impE, assumption)\napply safe\napply (rule_tac x = \"k+1\" in exI)\napply(simp (no_asm))\napply(rule converse_rtrancl_into_rtrancl)\n apply fast\napply(fast elim: L3_5ii_lemma1)\ndone\n\nlemma L3_5v_lemma5 [rule_format]: \n \"\\<forall>s. (fwhile b c k, s) -P*\\<rightarrow> (Parallel Ts, t) \\<longrightarrow> All_None Ts \\<longrightarrow>  \n  (While b i c, s) -P*\\<rightarrow> (Parallel Ts,t)\"\napply(induct \"k\")\n apply(force dest: L3_5v_lemma2)\napply safe\napply(erule converse_rtranclE)\n apply simp_all\napply(erule transition_cases,simp_all)\n apply(rule converse_rtrancl_into_rtrancl)\n  apply(fast)\n apply(fast elim!: L3_5ii_lemma1 dest: L3_5ii_lemma3)\napply(drule rtrancl_imp_UN_relpow)\napply clarify\napply(erule relpow_E2)\n apply simp_all\napply(erule transition_cases,simp_all)\napply(fast dest: Parallel_empty_lemma)\ndone\n\nlemma L3_5v: \"SEM (While b i c) = (\\<lambda>x. (\\<Union>k. SEM (fwhile b c k) x))\"\napply(rule ext)\napply (simp add: SEM_def sem_def)\napply safe\n apply(drule rtrancl_imp_UN_relpow,simp)\n apply clarify\n apply(fast dest:L3_5v_lemma4)\napply(fast intro: L3_5v_lemma5)\ndone\n\nsection {* Validity of Correctness Formulas *}\n\ndefinition com_validity :: \"'a assn \\<Rightarrow> 'a com \\<Rightarrow> 'a assn \\<Rightarrow> bool\" (\"(3\\<parallel>= _// _//_)\" [90,55,90] 50) where\n  \"\\<parallel>= p c q \\<equiv> SEM c p \\<subseteq> q\"\n\ndefinition ann_com_validity :: \"'a ann_com \\<Rightarrow> 'a assn \\<Rightarrow> bool\" (\"\\<Turnstile> _ _\" [60,90] 45) where\n  \"\\<Turnstile> c q \\<equiv> ann_SEM c (pre c) \\<subseteq> q\"\n\nend", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Hoare_Parallel/OG_Tran.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.34342016150141097}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005 (modified)    |\n            |                 August 2005 (modified)    |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_mono\nimports CSP_F_domain CSP_T_mono\nbegin\n\n(*****************************************************************\n\n         1. mono check of failuresfun\n         2. \n         3. \n         4. \n\n *****************************************************************)\n\n(*--------------------------------*\n |        STOP,SKIP,DIV           |\n *--------------------------------*)\n\nlemma mono_failures_STOP: \"mono (failures (STOP))\"\nby (simp add: mono_def failures_iff)\n\nlemma mono_failures_SKIP: \"mono (failures (SKIP))\"\nby (simp add: mono_def failures_iff)\n\nlemma mono_failures_DIV: \"mono (failures (DIV))\"\nby (simp add: mono_def failures_iff)\n\n(*--------------------------------*\n |          Act_prefix            |\n *--------------------------------*)\n\nlemma mono_failures_Act_prefix:\n \"mono (failures P) ==> mono (failures (a -> P))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (simp)\napply (rule)\napply (simp add: in_failures)\napply (auto)\ndone\n\n(*--------------------------------*\n |        Ext_pre_choice          |\n *--------------------------------*)\n\nlemma mono_failures_Ext_pre_choice:\n \"ALL a. mono (failures (Pf a))\n  ==> mono (failures (? a:X -> (Pf a)))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (erule disjE, simp)\napply (rule disjI2)\napply (elim conjE exE)\napply (drule_tac x=\"a\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (auto)\ndone\n\n(*--------------------------------*\n |          Ext_choice            |\n *--------------------------------*)\n\nlemma mono_failures_Ext_choice:\n \"[| mono (traces P) ; mono (traces Q) ;\n     mono (failures P) ; mono (failures Q) |]\n  ==> mono (failures (P [+] Q))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"(fstF o x)\" in spec)\napply (drule_tac x=\"(fstF o x)\" in spec)\napply (drule_tac x=\"(fstF o y)\" in spec)\napply (drule_tac x=\"(fstF o y)\" in spec)\napply (simp add: order_prod_def mono_fstF[simplified mono_def])\napply (elim conjE disjE)\napply (force)+\ndone\n\n(*--------------------------------*\n |          Int_choice            |\n *--------------------------------*)\n\nlemma mono_failures_Int_choice:\n \"[| mono (failures P) ; mono (failures Q) |]\n  ==> mono (failures (P |~| Q))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim disjE)\napply (force)\napply (force)\ndone\n\n(*--------------------------------*\n |        Rep_int_choice          |\n *--------------------------------*)\n\nlemma mono_failures_Rep_int_choice:\n \"ALL c. mono (failures (Pf c))\n  ==> mono (failures (!! c:C .. (Pf c)))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim conjE bexE)\napply (drule_tac x=\"c\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (auto)\ndone\n\n(*--------------------------------*\n |              IF                |\n *--------------------------------*)\n\nlemma mono_failures_IF:\n \"[| mono (failures P) ; mono (failures Q) |]\n  ==> mono (failures (IF b THEN P ELSE Q))\"\napply (simp add: mono_def)\napply (auto simp add: in_failures subsetF_iff)\ndone\n\n(*--------------------------------*\n |           Parallel             |\n *--------------------------------*)\n\nlemma mono_failures_Parallel:\n \"[| mono (failures P) ; mono (failures Q) |]\n  ==> mono (failures (P |[X]| Q))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim conjE exE)\napply (rule_tac x=\"Y\" in exI)\napply (rule_tac x=\"Z\" in exI)\napply (simp)\napply (rule_tac x=\"sa\" in exI)\napply (rule_tac x=\"t\" in exI)\napply (auto simp add: subsetF_iff)\ndone\n\n(*--------------------------------*\n |            Hiding              |\n *--------------------------------*)\n\nlemma mono_failures_Hiding:\n \"mono (failures P)\n  ==> mono (failures (P -- X))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI)\napply (auto simp add: subsetF_iff)\ndone\n\n(*--------------------------------*\n |           Renaming             |\n *--------------------------------*)\n\nlemma mono_failures_Renaming:\n \"mono (failures P)\n  ==> mono (failures (P [[r]]))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI)\napply (auto simp add: subsetF_iff)\ndone\n\n(*--------------------------------*\n |           Seq_compo            |\n *--------------------------------*)\n\nlemma mono_failures_Seq_compo:\n \"[| mono (failures P) ; mono (failures Q) |]\n  ==> mono (failures (P ;; Q))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\n\napply (erule disjE)\napply (simp add: subsetF_iff)\napply (elim conjE exE)\napply (rule disjI2)\napply (rule_tac x=\"sa\" in exI)\napply (rule_tac x=\"t\" in exI)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (simp)\n\napply (subgoal_tac \"traces P (fstF o x) <= traces P (fstF o y)\")\napply (force)\napply (subgoal_tac \"fstF o x <= fstF o y\")\napply (simp add: mono_traces[simplified mono_def])\napply (simp add: order_prod_def)\napply (rule allI)\napply (drule_tac x=\"xa\" in spec)\napply (simp add: mono_fstF[simplified mono_def])\ndone\n\n(*--------------------------------*\n |          Depth_rest            |\n *--------------------------------*)\n\nlemma mono_failures_Depth_rest:\n \"mono (failures P)\n  ==> mono (failures (P |. n))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim conjE exE disjE)\napply (force)\napply (force)\ndone\n\n(*--------------------------------*\n |            variable            |\n *--------------------------------*)\n\nlemma mono_failures_variable: \n   \"mono (failures ($p))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (simp add: order_prod_def)\napply (drule_tac x=\"p\" in spec)\napply (insert mono_sndF)\napply (simp add: mono_def)\napply (drule_tac x=\"x p\" in spec)\napply (drule_tac x=\"y p\" in spec)\napply (simp add: subsetF_iff order_prod_def)\ndone\n\n(*--------------------------------*\n |            Procfun             |\n *--------------------------------*)\n\nlemma mono_failures: \"mono (failures P)\"\napply (induct_tac P)\napply (simp add: mono_failures_STOP)\napply (simp add: mono_failures_SKIP)\napply (simp add: mono_failures_DIV)\napply (simp add: mono_failures_Act_prefix)\napply (simp add: mono_failures_Ext_pre_choice)\napply (simp add: mono_failures_Ext_choice mono_traces)\napply (simp add: mono_failures_Int_choice)\napply (simp add: mono_failures_Rep_int_choice)\napply (simp add: mono_failures_IF)\napply (simp add: mono_failures_Parallel)\napply (simp add: mono_failures_Hiding)\napply (simp add: mono_failures_Renaming)\napply (simp add: mono_failures_Seq_compo mono_traces)\napply (simp add: mono_failures_Depth_rest)\napply (simp add: mono_failures_variable)\ndone\n\n(*=============================================================*\n |                         [[P]]Ff                             |\n *=============================================================*)\n\nlemma mono_semFf: \"mono [[Pf]]Ff\"\napply (simp add: mono_def)\napply (simp add: subdomF_decompo)\napply (intro allI impI)\n\napply (simp add: mono_failures[simplified mono_def])\n\napply (subgoal_tac \"mono (traces Pf)\")\napply (simp add: mono_def)\napply (drule_tac x=\"fstF o x\" in spec)\napply (drule_tac x=\"fstF o y\" in spec)\napply (drule mp)\n\n apply (simp add: order_prod_def)\n apply (simp add: mono_fstF[simplified mono_def])\n apply (simp)\n\napply (simp add: mono_traces)\ndone\n\n(*=============================================================*\n |                         [[P]]Ffun                           |\n *=============================================================*)\n\nlemma mono_semFfun: \"mono [[PF]]Ffun\"\napply (simp add: prod_mono)\napply (simp add: semFfun_def)\napply (simp add: comp_def)\napply (simp add: proj_fun_def)\napply (simp add: mono_semFf)\ndone\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_mono.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878696277512, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.3434201615014109}}
{"text": "\\<^marker>\\<open>creator Florian Keßler\\<close>\n\nsection \"IMP-- to SAS++ Correctness\"\n\ntheory IMP_Minus_Minus_To_SAS_Plus_Plus_Correctness \n  imports IMP_Minus_Minus_To_SAS_Plus_Plus_Reduction \"../SAS_Plus_Plus\"\nbegin \n\ntext \\<open> We show correctness for the IMP-- to SAS++ reduction. \\<close>\n\nlemma sas_plus_state_to_imp_minus_of_effect: \n  assumes \"op \\<in> set (com_to_operators c1)\"\n  shows \"sas_plus_state_to_imp_minus (imp_minus_state_to_sas_plus (c, is) ++ map_of (effect_of op)) \n  = (pc_to_com (effect_of op), \n  snd (sas_plus_state_to_imp_minus (imp_minus_state_to_sas_plus (c, is) ++ map_of (effect_of op))))\"\nproof -\n  have \"fst (sas_plus_state_to_imp_minus \n    (imp_minus_state_to_sas_plus (c, is) ++ map_of (effect_of op))) = pc_to_com (effect_of op)\"\n    using assms by(auto simp: imp_minus_state_to_sas_plus_def sas_plus_state_to_imp_minus_def \n                   com_to_operators_variables_distinct) \n  moreover have \"snd (sas_plus_state_to_imp_minus \n    (imp_minus_state_to_sas_plus (c, is) ++ map_of (effect_of op))) a = (is ++ ((\\<lambda>x. (case x of \n      EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \\<circ>\\<^sub>m (map_of (effect_of op)) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) a\"\n    for a using assms\n    by(auto simp: imp_minus_state_to_sas_plus_def sas_plus_state_to_imp_minus_def \n      option.case_eq_if map_comp_def map_add_def com_to_operators_variables_distinct \n      split: domain_element.splits)\n  moreover then have \"snd (sas_plus_state_to_imp_minus \n    (imp_minus_state_to_sas_plus (c, is) ++ map_of (effect_of op))) = (is \n   ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \\<circ>\\<^sub>m (map_of (effect_of op)) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x))))\"\n    by auto\n  ultimately show ?thesis using assms by (metis prod.collapse)\nqed\n\nlemma imp_minus_state_to_sas_plus_update_PC[simp]: \n  \"(imp_minus_state_to_sas_plus (c1, is1))(PC \\<mapsto> PCV c2) \n  = imp_minus_state_to_sas_plus (c2, is1)\"\n  by(auto simp: imp_minus_state_to_sas_plus_def option.case_eq_if)\n\nlemma sas_plus_state_to_imp_minus_of_lambda_PC[simp]: \"sas_plus_state_to_imp_minus\n  (\\<lambda>a. if a = PC then Some (PCV c1)\n       else ss a)\n  = (c1, snd (sas_plus_state_to_imp_minus ss))\"\n  by (auto simp: imp_minus_state_to_sas_plus_def sas_plus_state_to_imp_minus_def map_comp_def)\n\nlemma sas_plus_state_to_imp_minus_of_PC_updated[simp]: \n  \"sas_plus_state_to_imp_minus (ss(PC \\<mapsto> PCV c)) \n  = (c, snd (sas_plus_state_to_imp_minus ss))\"\n  by (auto simp: sas_plus_state_to_imp_minus_def map_comp_def)\n\nlemma imp_minus_state_to_sas_plus_VN_eq_Some_Iff[simp]: \n  \"(imp_minus_state_to_sas_plus (c, s) (VN x) = Some y) \n  \\<longleftrightarrow> ((map_option EV (s x)) = Some y)\"\n  by (simp add: imp_minus_state_to_sas_plus_def map_comp_Some_iff)\n\nlemma imp_minus_state_to_sas_plus_add_effect: \n  assumes \"op \\<in> set (com_to_operators c)\"\n  shows \"imp_minus_state_to_sas_plus (c1, is) ++ map_of (effect_of op) \n      = imp_minus_state_to_sas_plus (pc_to_com (effect_of op), is) ++ map_of (effect_of op)\"\n  using assms com_to_operators_variables_distinct \n  by(auto simp: map_add_def imp_minus_state_to_sas_plus_def fun_eq_iff split: option.splits)\n  \nlemma imp_minus_state_to_sas_plus_of_effect: \n  assumes \"op \\<in> set (com_to_operators cB)\"\n  shows \"((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))(PC \\<mapsto> PCV c2) =\n    imp_minus_state_to_sas_plus (c2, s')) \\<longleftrightarrow> ((s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) = s')\"\nproof\n  assume *: \"(imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))(PC \\<mapsto> PCV c2) \n    = imp_minus_state_to_sas_plus (c2, s')\"\n  have \"\\<forall>a. (s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) a = s' a\"\n  proof(rule ccontr)\n    assume \"\\<not>(\\<forall>a. (s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n      \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) a = s' a)\"\n    then obtain a where \"(s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n      \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) a \\<noteq> s' a\" by auto\n    then have \"((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))(PC \\<mapsto> PCV c2)) (VN a)\n      \\<noteq> imp_minus_state_to_sas_plus (c2, s') (VN a)\"\n      by(auto simp: imp_minus_state_to_sas_plus_def map_comp_def map_add_def domD domIff \n            split: option.splits)\n    then show \"False\" using * by auto\n  qed\n  then show \"((s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) = s')\" by auto\nnext\n  assume *: \"((s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) = s')\"\n  then have \"((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))(PC \\<mapsto> PCV c2)) a\n      = imp_minus_state_to_sas_plus (c2, s') a\" for a\n    using assms by(cases a) (auto simp: com_to_operators_variables_distinct \n        imp_minus_state_to_sas_plus_def map_comp_def map_add_def option.case_eq_if\n        split: option.splits domain_element.splits)\n  then show \"(imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))(PC \\<mapsto> PCV c2) \n    = imp_minus_state_to_sas_plus (c2, s')\" by auto\nqed\n\nlemma imp_minus_state_to_sas_plus_of_effect': \n  assumes \"op \\<in> set (com_to_operators cB)\"\n  shows \"((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op)) =\n    imp_minus_state_to_sas_plus (c2, s')) \\<longleftrightarrow> ((pc_to_com (effect_of op) = c2) \\<and> \n  (s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) = s')\"\nproof -\n  have \"imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op) = \n    ((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))\n    (PC \\<mapsto> PCV (pc_to_com (effect_of op))))\"\n    using assms com_to_operators_variables_distinct by auto\n  moreover have \"((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))\n  (PC \\<mapsto> PCV (pc_to_com (effect_of op))) =\n    imp_minus_state_to_sas_plus ((pc_to_com (effect_of op)), s')) \n    \\<longleftrightarrow> ((s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) = s')\" \n    using assms imp_minus_state_to_sas_plus_of_effect by blast\n  ultimately show ?thesis using assms imp_minus_state_to_sas_plus_def map_upd_eqD1 \n    by (metis domain_element.inject fst_conv)\nqed\n\nlemma updated_state_is_sane:\n  assumes \"op \\<in> set (com_to_operators c)\" \n    \"sane_sas_plus_state ss1\"\n  shows \"sane_sas_plus_state (ss1 \\<then>\\<^sub>+ op)\"\nproof -\n  have \"\\<exists>x. (VN v, EV x) \\<in> set (effect_of op) \\<or> map_of (effect_of op) (VN v) = None\" for v\n    using assms variables_in_effect by simp\n  then show ?thesis using assms \n    apply(auto simp: sane_sas_plus_state_def com_to_operators_variables_distinct \n        map_add_Some_iff) \n    using in_set_effect by blast\nqed\n\nlemma imp_minus_state_to_sas_plus_update_VN[simp]: \"(\\<lambda>a. if a = PC then Some (PCV c2) \n   else (imp_minus_state_to_sas_plus (c1, is1)(VN x \\<mapsto> EV y)) a) \n    = imp_minus_state_to_sas_plus (c2, is1(x \\<mapsto> y))\"\nproof -\n  have \"(if a = PC then Some (PCV c2) else ((imp_minus_state_to_sas_plus (c1, is1)(VN x \\<mapsto> EV y)) a))\n    = (imp_minus_state_to_sas_plus (c2, is1(x \\<mapsto> y))) a\" for a\n    by (auto simp: imp_minus_state_to_sas_plus_def map_comp_def split: variable.splits)\n  then show ?thesis by auto\nqed\n\nlemma VN_PC_map_le_iff[simp]: \"[VN v \\<mapsto> y, PC \\<mapsto> x] \\<subseteq>\\<^sub>m (imp_minus_state_to_sas_plus (c1, is)) \n  = (x = PCV c1 \\<and> map_option EV (is v) = Some y)\"\n  by (auto simp: map_le_def imp_minus_state_to_sas_plus_def option.case_eq_if map_comp_def)\n\nlemma operator_with_PC_updated_applicable_iff[simp]: \"op \\<in> set (com_to_operators c1) \\<Longrightarrow> \n  map_of (precondition_of op)(PC \\<mapsto> PCV c2) \\<subseteq>\\<^sub>m imp_minus_state_to_sas_plus (c2, s)\n  \\<longleftrightarrow>  map_of (precondition_of op) \\<subseteq>\\<^sub>m imp_minus_state_to_sas_plus (c1, s)\"\n  by(auto simp: imp_minus_state_to_sas_plus_def map_le_def)\n\nlemma applicable_in_imp_minus_then[simp]: \n  \"is_operator_applicable_in (imp_minus_state_to_sas_plus (c1, is)) \n  \\<lparr>precondition_of = [(PC, x), (VN v, y)], effect_of = effect\\<rparr> \n  \\<longleftrightarrow> (x = PCV c1 \\<and> map_option EV (is v) = Some y)\"\n  by (auto simp: map_le_def imp_minus_state_to_sas_plus_def option.case_eq_if map_comp_def)\n\n\n\nlemma PC_map_le_iff[simp]: \"[PC \\<mapsto> x] \\<subseteq>\\<^sub>m (imp_minus_state_to_sas_plus (c1, is)) \n  = (x = PCV c1)\"\n  by (auto simp: map_le_def imp_minus_state_to_sas_plus_def)\n\nlemma map_of_list_update: \"distinct (map fst l) \\<Longrightarrow> length l > 0 \\<Longrightarrow> fst (l ! 0) = x  \\<Longrightarrow> z \\<noteq> x\n  \\<Longrightarrow> map_of (list_update l 0 (x, y)) z = map_of l z\"\n  by (induction l) auto\n\nlemma map_of_update_PC_in_effect_of_op[simp]: assumes \"op \\<in> set (com_to_operators c)\"\n  shows \"map_of (list_update (effect_of op) 0 (PC, y)) = (map_of (effect_of op))(PC \\<mapsto> y)\"\nproof -\n  have \"map_of (list_update (effect_of op) 0 (PC, y)) x = ((map_of (effect_of op))(PC \\<mapsto> y)) x\" for x\n    using assms com_to_operators_variables_distinct effect_nonempty \n      map_of_list_update[where ?l = \"effect_of op\"]\n    by (auto) \n      (metis effect_nonempty fst_of_effect map_of_eq_Some_iff set_update_memI update_preserve_distinct)\n  then show ?thesis by auto\nqed\n\nlemma map_of_update_PC_in_precondition_of_op[simp]: assumes \"op \\<in> set (com_to_operators c)\"\n  shows \"map_of (list_update (precondition_of op) 0 (PC, y)) = (map_of (precondition_of op))(PC \\<mapsto> y)\"\nproof -\n  have \"map_of (list_update (precondition_of op) 0 (PC, y)) x = ((map_of (precondition_of op))(PC \\<mapsto> y)) x\" for x\n    using assms com_to_operators_variables_distinct precondition_nonempty \n      map_of_list_update[where ?l = \"precondition_of op\"]\n    by (auto) \n     (metis precondition_nonempty fst_of_precondition map_of_eq_Some_iff set_update_memI update_preserve_distinct)\n  then show ?thesis by auto\nqed\n\nlemma pc_of_op: \n  assumes \"op \\<in> set (com_to_operators c2)\"\n    \"ss2 = imp_minus_state_to_sas_plus (c1, is)\" \n    \"ss1 \\<then>\\<^sub>+ op = ss2\"\n  shows \"pc_to_com (effect_of op) = c1\" \nproof -\n  have \"(ss1 \\<then>\\<^sub>+ op) PC = Some (PCV c1)\" using assms by simp\n  then show ?thesis using assms com_to_operators_variables_distinct by auto\nqed\n\nlemma effect_in_updated[simp]: \n  assumes \"op' \\<in> set (com_to_operators c)\" \n    \"map_of (precondition_of op') = (map_of (precondition_of op))(PC \\<mapsto> PCV c)\"\n    \"map_of (effect_of op') = (map_of (effect_of op))(PC \\<mapsto> PCV (pc_to_com (effect_of op')))\"\n    \"s \\<then>\\<^sub>+ op = s'\"\n  shows \"s(PC \\<mapsto> PCV c) \\<then>\\<^sub>+ op' = s'(PC \\<mapsto> PCV (pc_to_com (effect_of op')))\" \nproof -\n  have \"(s(PC \\<mapsto> PCV c)  \\<then>\\<^sub>+ op') x = (s'(PC \\<mapsto> PCV (pc_to_com (effect_of op')))) x\" for x\n    using assms PC_in_effect_precondition com_to_operators_variables_distinct apply auto\n    by (metis fun_upd_other map_add_def)\n  then show ?thesis by auto\nqed\n\nlemma applicable_in_PC_updated: \"m \\<subseteq>\\<^sub>m s(PC \\<mapsto> y) \\<Longrightarrow> s PC = Some x \\<Longrightarrow> m(PC \\<mapsto> x) \\<subseteq>\\<^sub>m s\"\n  by (simp add: map_le_def)\n\ntext \\<open> We first show that every operation in SAS++ corresponds to a single step in IMP-- \\<close>\n\nlemma sas_plus_plus_to_imp_minus_minus_single_step:\n  \"op \\<in> set (com_to_operators c1)\n  \\<Longrightarrow> c1 \\<in> set (enumerate_subprograms c) \\<Longrightarrow> t > 0 \n  \\<Longrightarrow> is_operator_applicable_in (imp_minus_state_to_sas_plus (c1, is1)) op\n  \\<Longrightarrow> (c1, is1) \\<rightarrow>\n  sas_plus_state_to_imp_minus ((imp_minus_state_to_sas_plus (c1, is1)) \\<then>\\<^sub>+ op)\"\nproof (induction c1 arbitrary: op is1)\n  case (Seq cA cB)\n  have \"cA = SKIP \\<or> cA \\<noteq> SKIP\" by auto\n  then show ?case using Seq\n  proof (elim disjE)\n    assume \"cA \\<noteq> SKIP\"\n    then obtain op' where op'_def: \"op' \\<in> set (com_to_operators cA)\"\n      \"op = (let c1' = pc_to_com (effect_of op') in \n      \\<lparr> precondition_of = list_update (precondition_of op') 0 (PC, PCV (cA ;; cB)),\n        effect_of = list_update (effect_of op') 0 (PC, PCV (c1' ;; cB))\\<rparr>)\" using Seq by auto\n    let ?c1' = \"pc_to_com (effect_of op')\"\n    let ?ss1' = \"(imp_minus_state_to_sas_plus ((cA ;; cB), is1))(PC \\<mapsto> PCV cA)\"\n    let ?ss2' = \"((imp_minus_state_to_sas_plus ((cA ;; cB), is1)) \\<then>\\<^sub>+ op)(PC \\<mapsto> PCV ?c1')\"\n    have \"cA \\<in> set (enumerate_subprograms c)\" \n      using \\<open>cA;;cB \\<in> set (enumerate_subprograms c)\\<close> c_in_all_subprograms_c\n      by (force intro!: enumerate_subprograms_transitive[where ?c2.0 = \"cA;; cB\"])\n    then have \"(cA, is1) \\<rightarrow> sas_plus_state_to_imp_minus ?ss2'\"\n      using \\<open>0 < t\\<close> op'_def Seq  imp_minus_state_to_sas_plus_add_effect[where ?c1.0=\"cA;; cB\"]\n      imp_minus_state_to_sas_plus_add_effect[where ?c1.0=\"cA\"] \n      by(auto simp: com_to_operators_variables_distinct fun_upd_idem)\n    then show ?thesis using op'_def by auto\n  qed auto\nqed(auto simp: Let_def map_leq_imp_minus_state_to_sas_plus_iff)\n\n\ntext \\<open> Next, we show that a plan in SAS++ corresponds to executing several steps in IMP-- \\<close>\n\nlemma sas_plus_plus_to_imp_minus_minus_aux:\n  \"set ops \\<subseteq> set ((imp_minus_minus_to_sas_plus c I G)\\<^sub>\\<O>\\<^sub>+) \n  \\<Longrightarrow> sane_sas_plus_state ss1\n  \\<Longrightarrow> execute_serial_plan_sas_plus ss1 ops = ss2\n  \\<Longrightarrow> (\\<exists>t'. t' \\<le> length ops \n    \\<and> sas_plus_state_to_imp_minus ss1 \\<rightarrow>\\<^bsup>t'\\<^esup> sas_plus_state_to_imp_minus ss2)\"\nproof (induction ops arbitrary: ss1)\n  case (Cons op ops)\n  let ?c1 = \"fst (sas_plus_state_to_imp_minus ss1)\"\n  let ?is1 = \"snd (sas_plus_state_to_imp_minus ss1)\"\n  let ?ss1' = \"ss1 \\<then>\\<^sub>+ op\" \n  have \"is_operator_applicable_in ss1 op \\<or> \\<not>(is_operator_applicable_in ss1 op)\" by auto\n  then show ?case using Cons\n  proof (elim disjE)\n    assume a: \"is_operator_applicable_in ss1 op\"\n    then have op_in_cto_c1: \"op \\<in> set (com_to_operators ?c1)\" using Cons by auto\n    moreover then have \"?c1 \\<in> set (enumerate_subprograms c)\" using Cons a \n      apply(auto simp: imp_minus_minus_to_sas_plus_def Let_def coms_to_operators_def)\n      by (metis PC_of_precondition domain_element.simps op_in_cto_c1)\n    ultimately have c1_to_c1': \"(?c1, ?is1) \\<rightarrow> sas_plus_state_to_imp_minus \n      (imp_minus_state_to_sas_plus (?c1, ?is1) \\<then>\\<^sub>+ op)\" \n      apply(rule sas_plus_plus_to_imp_minus_minus_single_step)\n      using Cons a op_in_cto_c1 by auto\n    moreover then have \"execute_serial_plan_sas_plus ?ss1' ops = ss2\"\n      and \"sane_sas_plus_state ?ss1'\" \n      using Cons a op_in_cto_c1 updated_state_is_sane by auto \n    ultimately have \"\\<exists>t'. t' \\<le> length ops \\<and> sas_plus_state_to_imp_minus ?ss1' \n      \\<rightarrow>\\<^bsup>t'\\<^esup> sas_plus_state_to_imp_minus ss2\"\n      using Cons by(auto)\n    moreover have \"imp_minus_state_to_sas_plus (?c1, ?is1) \\<then>\\<^sub>+ op = ?ss1'\" using Cons by auto\n    ultimately show ?case using c1_to_c1' by auto\n  qed auto\nqed auto\n\nlemma all_zero_than_zero_map_le: \"\\<forall>b\\<in>set bs. s b = Some Zero \n  \\<Longrightarrow> map_of (map (\\<lambda>v. (v, Zero)) (remdups bs)) \\<subseteq>\\<^sub>m s\" \n  apply(induction bs) \n  by(auto simp: map_le_def)\n\ntext \\<open> For the other direction, we again first show that a single step in IMP-- always \n      corresponds to applying one operation in SAS++ \\<close>\n\nlemma imp_minus_minus_to_sas_plus_plus_single_step:\n   \"(c1, is1) \\<rightarrow> (c2, is2) \n  \\<Longrightarrow> c1 \\<in> set (enumerate_subprograms c)\n  \\<Longrightarrow> dom is1 = set (enumerate_variables c)\n  \\<Longrightarrow> (\\<exists>op \\<in> set (com_to_operators c1).\n      execute_operator_sas_plus (imp_minus_state_to_sas_plus (c1, is1)) op \n        =  imp_minus_state_to_sas_plus (c2, is2)\n    \\<and> is_operator_applicable_in (imp_minus_state_to_sas_plus (c1, is1)) op)\"\nproof (induction c1 is1 c2 is2 rule: small_step_induct)\n  case (Assign x a s)\n  thus ?case by auto\nnext\n  case (Seq2 c\\<^sub>1 s c\\<^sub>1' s' c\\<^sub>2)\n  have \"c\\<^sub>1 \\<in> set (enumerate_subprograms (c\\<^sub>1 ;; c\\<^sub>2))\" using c_in_all_subprograms_c by auto\n  then have \"c\\<^sub>1 \\<in> set (enumerate_subprograms c)\" using Seq2 enumerate_subprograms_transitive by blast\n  then obtain op' where op'_def: \"op' \\<in> set (com_to_operators c\\<^sub>1) \\<and>\n    execute_operator_sas_plus (imp_minus_state_to_sas_plus (c\\<^sub>1, s)) op'\n        =  imp_minus_state_to_sas_plus (c\\<^sub>1', s')\n    \\<and> is_operator_applicable_in (imp_minus_state_to_sas_plus (c\\<^sub>1, s)) op'\" \n    using Seq2 by fastforce\n  let ?op = \"\\<lparr> precondition_of = list_update (precondition_of op') 0 (PC, PCV (c\\<^sub>1 ;; c\\<^sub>2)),\n        effect_of = list_update (effect_of op') 0 (PC, PCV (c\\<^sub>1' ;; c\\<^sub>2))\\<rparr>\"\n  have \"?op \\<in> set (com_to_operators (c\\<^sub>1 ;; c\\<^sub>2))\"\n    and \"execute_operator_sas_plus (imp_minus_state_to_sas_plus ((c\\<^sub>1 ;; c\\<^sub>2), s)) ?op \n        = imp_minus_state_to_sas_plus ((c\\<^sub>1' ;; c\\<^sub>2), s')\"\n    and \"is_operator_applicable_in (imp_minus_state_to_sas_plus ((c\\<^sub>1 ;; c\\<^sub>2), s)) ?op\"\n    using Seq2 op'_def imp_minus_state_to_sas_plus_of_effect imp_minus_state_to_sas_plus_of_effect'\n    by auto\n  then show ?case using Seq2 by blast\nnext\n  case (IfTrue bs s c\\<^sub>1 c\\<^sub>2)\n  have \"set bs \\<subseteq> set (enumerate_variables c)\" \n    using IfTrue enumerate_subprograms_enumerate_variables by fastforce\n  hence \"\\<forall>b \\<in> set bs. \\<exists>y. s b = Some y\" using \\<open>dom s = set (enumerate_variables c)\\<close> by auto\n  then show ?case using IfTrue by (auto simp: Let_def) \nnext\n  case (IfFalse bs s c\\<^sub>1 c\\<^sub>2)\n  hence \"set bs \\<subseteq> set (enumerate_variables c)\" \n    using enumerate_subprograms_enumerate_variables by fastforce\n  thus ?case using IfFalse \n    by(auto simp: Let_def map_leq_imp_minus_state_to_sas_plus_iff all_zero_than_zero_map_le) \nnext\n  case (WhileTrue bs s c1)\n  hence \"set bs \\<subseteq> set (enumerate_variables c)\" \n    using  enumerate_subprograms_enumerate_variables by fastforce\n  then show ?case using WhileTrue\n    by(force simp: Let_def map_leq_imp_minus_state_to_sas_plus_iff all_zero_than_zero_map_le)\nnext\n  case (WhileFalse bs s c1)\n   hence \"set bs \\<subseteq> set (enumerate_variables c)\" \n    using  enumerate_subprograms_enumerate_variables by fastforce\n  then show ?case using WhileFalse\n    by(force simp: Let_def map_leq_imp_minus_state_to_sas_plus_iff all_zero_than_zero_map_le)\nqed auto\n\ntext \\<open> Next, we show that taking multiple steps in IMP-- corresponds to executing multiple\n      operations in SAS++ \\<close>\n\nlemma imp_minus_minus_to_sas_plus_plus_aux:\n   \"(c1, is1) \\<rightarrow>\\<^bsup>t\\<^esup> (c2, is2)\n  \\<Longrightarrow> c1 \\<in> set (enumerate_subprograms c)\n  \\<Longrightarrow> dom is1 = set (enumerate_variables c)\n  \\<Longrightarrow> (\\<exists>ops. set ops \\<subseteq> set ((imp_minus_minus_to_sas_plus c I G)\\<^sub>\\<O>\\<^sub>+)\n     \\<and> length ops = t\n     \\<and> (execute_serial_plan_sas_plus (imp_minus_state_to_sas_plus (c1, is1)) ops)\n        = imp_minus_state_to_sas_plus (c2, is2))\"\nproof (induction t arbitrary: c1 is1)\n  case (Suc t)\n  obtain c1' is1' where c1'_def: \"(c1, is1) \\<rightarrow> (c1', is1')\n    \\<and> (c1', is1') \\<rightarrow>\\<^bsup>t\\<^esup> (c2, is2)\" using Suc by auto\n  then obtain op where op_def: \"op \\<in> set (com_to_operators c1)\n    \\<and> execute_operator_sas_plus (imp_minus_state_to_sas_plus (c1, is1)) op \n        =  imp_minus_state_to_sas_plus (c1', is1')\n    \\<and> is_operator_applicable_in (imp_minus_state_to_sas_plus (c1, is1)) op\" \n    using imp_minus_minus_to_sas_plus_plus_single_step Suc by metis\n  then have \"dom is1' = set (enumerate_variables c)\" \n    using c1'_def Suc step_doesnt_add_variables\n     apply (auto simp: domIff)\n    by (metis domD domIff option.simps(3) step_doesnt_add_variables)+\n  moreover have \"c1' \\<in> set (enumerate_subprograms c)\" using c1'_def enumerate_subprograms_transitive \n    enumerate_subprograms_complete_step\n    using Suc.prems by blast+\n  ultimately obtain ops where ops_def: \"set ops \\<subseteq> set ((imp_minus_minus_to_sas_plus c I G)\\<^sub>\\<O>\\<^sub>+)\n     \\<and> length ops = t\n     \\<and> (execute_serial_plan_sas_plus (imp_minus_state_to_sas_plus (c1', is1')) ops)\n        = imp_minus_state_to_sas_plus (c2, is2)\"\n    using Suc c1'_def Suc_lessD by blast\n  let ?ops' = \"op # ops\"\n  have \"set ?ops' \\<subseteq> set ((imp_minus_minus_to_sas_plus c I G)\\<^sub>\\<O>\\<^sub>+)\n     \\<and> length ?ops' = Suc t\n     \\<and> (execute_serial_plan_sas_plus (imp_minus_state_to_sas_plus (c1, is1)) ?ops')\n        = imp_minus_state_to_sas_plus (c2, is2)\"\n    using Suc c1'_def op_def ops_def\n    by (auto simp: imp_minus_minus_to_sas_plus_def Let_def coms_to_operators_def)\n  then show ?case by blast\nqed auto\n\ntext \\<open> In the previous correctness lemmas, we formulated the statements as to permit arbitrary\n       initial and final states that could occur sometime during the execution. We now proceed \n       to reformulate them in simpler terms, using the initial initial and final states as specified\n       in the SAS++ problem translated from IMP--. \\<close>\n\nlemma imp_minus_minus_to_sas_plus_plus:\n  assumes \"(c, is1) \\<rightarrow>\\<^bsup>t\\<^esup> (SKIP, is2)\"\n   \"dom is1 = set (enumerate_variables c)\"\n   \"I \\<subseteq>\\<^sub>m is1\"\n   \"G \\<subseteq>\\<^sub>m is2\"\n   \"t \\<le> t'\"\n  shows \"(\\<exists>plan.\n     is_serial_solution_for_problem_sas_plus_plus (imp_minus_minus_to_sas_plus c I G) plan\n     \\<and> length plan \\<le> t')\"\nproof -\n  let ?\\<Psi> = \"imp_minus_minus_to_sas_plus c I G\"\n  let ?I' = \"imp_minus_state_to_sas_plus (c, is1)\" \n  obtain plan where plan_def: \"set plan \\<subseteq> set ((?\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\n     \\<and> length plan = t\n     \\<and> (execute_serial_plan_sas_plus ?I' plan)\n        = imp_minus_state_to_sas_plus (SKIP, is2)\"\n    using imp_minus_minus_to_sas_plus_plus_aux[OF assms(1)] assms c_in_all_subprograms_c by blast\n  moreover then have \"(?\\<Psi>)\\<^sub>G\\<^sub>+ \\<subseteq>\\<^sub>m execute_serial_plan_sas_plus ?I' plan\"\n    and \"dom ?I' = set (((?\\<Psi>))\\<^sub>\\<V>\\<^sub>+)\"\n    and \"(\\<forall> v \\<in> set ((?\\<Psi>)\\<^sub>\\<V>\\<^sub>+). the (?I' v) \\<in> range_of' ?\\<Psi> v)\"\n    and \"((?\\<Psi>)\\<^sub>I\\<^sub>+) \\<subseteq>\\<^sub>m ?I'\"\n    using assms plan_def c_in_all_subprograms_c\n    apply(auto simp: imp_minus_minus_to_sas_plus_def Let_def \n        range_of'_def imp_minus_state_to_sas_plus_def map_comp_def map_le_def)\n        apply (auto split: option.splits variable.splits)\n    by (metis domIff option.distinct option.inject)+\n  ultimately have \"is_serial_solution_for_problem_sas_plus_plus ?\\<Psi> plan\" \n    using assms\n    by(auto simp: is_serial_solution_for_problem_sas_plus_plus_def Let_def list_all_def ListMem_iff)\n  then show ?thesis using plan_def \\<open>t \\<le> t'\\<close>\n    by blast\nqed\n\nlemma sas_plus_plus_to_imp_minus_minus:\n  assumes \"is_serial_solution_for_problem_sas_plus_plus (imp_minus_minus_to_sas_plus c I G) plan\"\n    \"EV ` (ran I) \\<subseteq> set domain\"\n    \"EV ` (ran G) \\<subseteq> set domain\"\n  shows \"\\<exists>is1 is2 t. (I|` set (enumerate_variables c)) \\<subseteq>\\<^sub>m is1 \\<and> dom is1 = set (enumerate_variables c)\n    \\<and> (G|` set (enumerate_variables c)) \\<subseteq>\\<^sub>m is2 \\<and> t \\<le> length plan \n    \\<and> (c, is1) \\<rightarrow>\\<^bsup>t\\<^esup> (SKIP, is2)\" \nproof -\n  let ?\\<Psi> = \"imp_minus_minus_to_sas_plus c I G\"\n  obtain I' where I'_def: \"((?\\<Psi>)\\<^sub>I\\<^sub>+) \\<subseteq>\\<^sub>m I' \\<and> dom I' = set ((?\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \n        \\<and> (\\<forall>v \\<in> set ((?\\<Psi>)\\<^sub>\\<V>\\<^sub>+). the (I' v) \\<in> range_of' ?\\<Psi> v)\n        \\<and> ((?\\<Psi>)\\<^sub>G\\<^sub>+) \\<subseteq>\\<^sub>m execute_serial_plan_sas_plus I' plan\" \n    using assms by (auto simp: is_serial_solution_for_problem_sas_plus_plus_def Let_def)\n  let ?ss2 = \"execute_serial_plan_sas_plus I' plan\"\n  let ?is1 = \"snd (sas_plus_state_to_imp_minus I')\"\n  let ?is2 = \"snd (sas_plus_state_to_imp_minus ?ss2)\"\n  have \"\\<forall>v\\<in>set (enumerate_variables c). (\\<exists>y \\<in> set domain. I' (VN v) = Some y)\" using I'_def \n    apply (auto simp: imp_minus_minus_to_sas_plus_def Let_def range_of'_def)\n    by (metis domIff image_insert insertI1 insertI2 mk_disjoint_insert option.collapse)\n  then have \"sane_sas_plus_state I'\" using I'_def assms\n    apply (auto simp: sane_sas_plus_state_def imp_minus_minus_to_sas_plus_def Let_def map_le_def \n         range_of'_def)\n    by (metis domIff insertI1 option.collapse)\n  then obtain t where t_def: \"t \\<le> length plan \\<and> sas_plus_state_to_imp_minus I' \n    \\<rightarrow>\\<^bsup>t\\<^esup> sas_plus_state_to_imp_minus ?ss2\"\n    apply - apply(rule exE[OF sas_plus_plus_to_imp_minus_minus_aux[where ?ops=plan]])\n    using assms I'_def  \n    by(auto simp: is_serial_solution_for_problem_sas_plus_plus_def Let_def list_all_def ListMem_iff)\n    \n  moreover have \"fst (sas_plus_state_to_imp_minus I') = c\"\n    and \"fst (sas_plus_state_to_imp_minus ?ss2) = SKIP\"\n    using assms I'_def apply(auto simp: imp_minus_minus_to_sas_plus_def Let_def \n         sas_plus_state_to_imp_minus_def map_le_def imp_minus_state_to_sas_plus_def\n        sane_sas_plus_state_def)\n    by (metis (no_types, lifting) domain_element.inject domain_element.simps option.sel \n        option.inject variable.simps)+\n  ultimately have \"((c, ?is1) \\<rightarrow>\\<^bsup>t\\<^esup> (SKIP, ?is2))\" \n    using I'_def by (metis prod.collapse)\n  moreover have \"(I|` set (enumerate_variables c)) \\<subseteq>\\<^sub>m ?is1\"\n    \"(G|` set (enumerate_variables c)) \\<subseteq>\\<^sub>m ?is2\"\n    using assms(2) I'_def \n    by (auto simp: imp_minus_minus_to_sas_plus_def imp_minus_state_to_sas_plus_map_le_then Let_def \n        range_of'_def)\n  moreover have \"dom ?is1 = set (enumerate_variables c)\"\n    using \\<open>sane_sas_plus_state I'\\<close> I'_def by(auto simp: imp_minus_minus_to_sas_plus_def \n        dom_snd_sas_plus_state_to_imp_minus Let_def)\n  ultimately show ?thesis using I'_def t_def by auto\nqed\n    \n    \nend", "meta": {"author": "wimmers", "repo": "poly-reductions", "sha": "b2d7c584bcda9913dd5c3785817a5d63b14d1455", "save_path": "github-repos/isabelle/wimmers-poly-reductions", "path": "github-repos/isabelle/wimmers-poly-reductions/poly-reductions-b2d7c584bcda9913dd5c3785817a5d63b14d1455/Cook_Levin/IMP-_To_SAS+/IMP--_To_SAS++/IMP_Minus_Minus_To_SAS_Plus_Plus_Correctness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.34342015362247647}}
{"text": "section \\<open>Set by Characteristic Function\\<close>\ntheory Impl_Cfun_Set\nimports \"../Intf/Intf_Set\"\nbegin\n\ndefinition fun_set_rel where\n  fun_set_rel_internal_def: \n  \"fun_set_rel R \\<equiv> (R\\<rightarrow>bool_rel) O br Collect (\\<lambda>_. True)\"\n\nlemma fun_set_rel_def: \"\\<langle>R\\<rangle>fun_set_rel = (R\\<rightarrow>bool_rel) O br Collect (\\<lambda>_. True)\"\n  by (simp add: relAPP_def fun_set_rel_internal_def)\n\nlemma fun_set_rel_sv[relator_props]: \n  \"\\<lbrakk>single_valued R; Range R = UNIV\\<rbrakk> \\<Longrightarrow> single_valued (\\<langle>R\\<rangle>fun_set_rel)\"\n  unfolding fun_set_rel_def\n  by (tagged_solver (keep))\n\nlemma fun_set_rel_RUNIV[relator_props]:\n  assumes SV: \"single_valued R\" \n  shows \"Range (\\<langle>R\\<rangle>fun_set_rel) = UNIV\"\nproof -\n  {\n    fix b\n    have \"\\<exists>a. (a,b)\\<in>\\<langle>R\\<rangle>fun_set_rel\" unfolding fun_set_rel_def\n      apply (rule exI)\n      apply (rule relcompI)\n    proof -\n      show \"((\\<lambda>x. x\\<in>b),b)\\<in>br Collect (\\<lambda>_. True)\" by (auto simp: br_def)\n      show \"(\\<lambda>x'. \\<exists>x. (x',x)\\<in>R \\<and> x\\<in>b,\\<lambda>x. x \\<in> b)\\<in>R \\<rightarrow> bool_rel\"\n        by (auto dest: single_valuedD[OF SV])\n    qed\n  } thus ?thesis by blast\nqed\n\nlemmas [autoref_rel_intf] = REL_INTFI[of fun_set_rel i_set]\n\nlemma fs_mem_refine[autoref_rules]: \"(\\<lambda>x f. f x,(\\<in>)) \\<in> R \\<rightarrow> \\<langle>R\\<rangle>fun_set_rel \\<rightarrow> bool_rel\"\n  apply (intro fun_relI)\n  apply (auto simp add: fun_set_rel_def br_def dest: fun_relD)\n  done\n\nlemma fun_set_Collect_refine[autoref_rules]: \n  \"(\\<lambda>x. x, Collect)\\<in>(R\\<rightarrow>bool_rel) \\<rightarrow> \\<langle>R\\<rangle>fun_set_rel\"\n  unfolding fun_set_rel_def\n  by (auto simp: br_def)\n\nlemma fun_set_empty_refine[autoref_rules]: \n  \"(\\<lambda>_. False,{})\\<in>\\<langle>R\\<rangle>fun_set_rel\"\n  by (force simp add: fun_set_rel_def br_def)\n\nlemma fun_set_UNIV_refine[autoref_rules]: \n  \"(\\<lambda>_. True,UNIV)\\<in>\\<langle>R\\<rangle>fun_set_rel\"\n  by (force simp add: fun_set_rel_def br_def)\n\nlemma fun_set_union_refine[autoref_rules]: \n  \"(\\<lambda>a b x. a x \\<or> b x,(\\<union>))\\<in>\\<langle>R\\<rangle>fun_set_rel \\<rightarrow> \\<langle>R\\<rangle>fun_set_rel \\<rightarrow> \\<langle>R\\<rangle>fun_set_rel\"\nproof -\n  have A: \"\\<And>a b. (\\<lambda>x. x\\<in>a \\<or> x\\<in>b, a \\<union> b) \\<in> br Collect (\\<lambda>_. True)\"\n    by (auto simp: br_def)\n\n  show ?thesis\n    apply (simp add: fun_set_rel_def)\n    apply (intro fun_relI)\n    apply clarsimp\n    apply rule\n    defer\n    apply (rule A)\n    apply (auto simp: br_def dest: fun_relD)\n    done\nqed\n\nlemma fun_set_inter_refine[autoref_rules]: \n  \"(\\<lambda>a b x. a x \\<and> b x,(\\<inter>))\\<in>\\<langle>R\\<rangle>fun_set_rel \\<rightarrow> \\<langle>R\\<rangle>fun_set_rel \\<rightarrow> \\<langle>R\\<rangle>fun_set_rel\"\nproof -\n  have A: \"\\<And>a b. (\\<lambda>x. x\\<in>a \\<and> x\\<in>b, a \\<inter> b) \\<in> br Collect (\\<lambda>_. True)\"\n    by (auto simp: br_def)\n\n  show ?thesis\n    apply (simp add: fun_set_rel_def)\n    apply (intro fun_relI)\n    apply clarsimp\n    apply rule\n    defer\n    apply (rule A)\n    apply (auto simp: br_def dest: fun_relD)\n    done\nqed\n\n\nlemma fun_set_diff_refine[autoref_rules]: \n  \"(\\<lambda>a b x. a x \\<and> \\<not>b x,(-))\\<in>\\<langle>R\\<rangle>fun_set_rel \\<rightarrow> \\<langle>R\\<rangle>fun_set_rel \\<rightarrow> \\<langle>R\\<rangle>fun_set_rel\"\nproof -\n  have A: \"\\<And>a b. (\\<lambda>x. x\\<in>a \\<and> \\<not>x\\<in>b, a - b) \\<in> br Collect (\\<lambda>_. True)\"\n    by (auto simp: br_def)\n\n  show ?thesis\n    apply (simp add: fun_set_rel_def)\n    apply (intro fun_relI)\n    apply clarsimp\n    apply rule\n    defer\n    apply (rule A)\n    apply (auto simp: br_def dest: fun_relD)\n    done\nqed\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/GenCF/Impl/Impl_Cfun_Set.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160664, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.34342015362247635}}
{"text": "(*  Title:      HOL/MicroJava/BV/Correct.thy\n\n    Author:     Cornelia Pusch, Gerwin Klein\n    Copyright   1999 Technische Universitaet Muenchen\n\nThe invariant for the type safety proof.\n*)\n\nheader {* \\isaheader{BV Type Safety Invariant} *}\n\ntheory BVConform\nimports BVSpec \"../JVM/JVMExec\" \"../Common/Conform\"\nbegin\n\n\ndefinition confT :: \"'c prog \\<Rightarrow> heap \\<Rightarrow> val \\<Rightarrow> ty err \\<Rightarrow> bool\" \n           (\"_,_ |- _ :<=T _\" [51,51,51,51] 50)\nwhere\n  \"P,h |- v :<=T E \\<equiv> case E of Err \\<Rightarrow> True | OK T \\<Rightarrow> P,h \\<turnstile> v :\\<le> T\"\n\nnotation (xsymbols)\n  confT  (\"_,_ \\<turnstile> _ :\\<le>\\<^sub>\\<top> _\" [51,51,51,51] 50)\n\nabbreviation\n  confTs :: \"'c prog \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> ty\\<^sub>l \\<Rightarrow> bool\" \n            (\"_,_ |- _ [:<=T] _\" [51,51,51,51] 50) where\n  \"P,h |- vs [:<=T] Ts \\<equiv> list_all2 (confT P h) vs Ts\"\n\nnotation (xsymbols)\n  confTs  (\"_,_ \\<turnstile> _ [:\\<le>\\<^sub>\\<top>] _\" [51,51,51,51] 50)\n\ndefinition conf_f  :: \"jvm_prog \\<Rightarrow> heap \\<Rightarrow> ty\\<^sub>i \\<Rightarrow> bytecode \\<Rightarrow> frame \\<Rightarrow> bool\"\nwhere\n  \"conf_f P h \\<equiv> \\<lambda>(ST,LT) is (stk,loc,C,M,pc).\n  P,h \\<turnstile> stk [:\\<le>] ST \\<and> P,h \\<turnstile> loc [:\\<le>\\<^sub>\\<top>] LT \\<and> pc < size is\"\n\nlemma conf_f_def2:\n  \"conf_f P h (ST,LT) is (stk,loc,C,M,pc) \\<equiv>\n  P,h \\<turnstile> stk [:\\<le>] ST \\<and> P,h \\<turnstile> loc [:\\<le>\\<^sub>\\<top>] LT \\<and> pc < size is\"\n  by (simp add: conf_f_def)\n\n\nprimrec conf_fs :: \"[jvm_prog,heap,ty\\<^sub>P,mname,nat,ty,frame list] \\<Rightarrow> bool\"\nwhere\n  \"conf_fs P h \\<Phi> M\\<^sub>0 n\\<^sub>0 T\\<^sub>0 [] = True\"\n| \"conf_fs P h \\<Phi> M\\<^sub>0 n\\<^sub>0 T\\<^sub>0 (f#frs) =\n  (let (stk,loc,C,M,pc) = f in\n  (\\<exists>ST LT Ts T mxs mxl\\<^sub>0 is xt.\n    \\<Phi> C M ! pc = Some (ST,LT) \\<and> \n    (P \\<turnstile> C sees M:Ts \\<rightarrow> T = (mxs,mxl\\<^sub>0,is,xt) in C) \\<and>\n    (\\<exists>D Ts' T' m D'.  \n       is!pc = (Invoke M\\<^sub>0 n\\<^sub>0) \\<and> ST!n\\<^sub>0 = Class D \\<and>\n       P \\<turnstile> D sees M\\<^sub>0:Ts' \\<rightarrow> T' = m in D' \\<and> P \\<turnstile> T\\<^sub>0 \\<le> T') \\<and>\n    conf_f P h (ST, LT) is f \\<and> conf_fs P h \\<Phi> M (size Ts) T frs))\"\n\n\ndefinition correct_state :: \"[jvm_prog,ty\\<^sub>P,jvm_state] \\<Rightarrow> bool\"\n                  (\"_,_ |- _ [ok]\"  [61,0,0] 61)\nwhere\n  \"correct_state P \\<Phi> \\<equiv> \\<lambda>(xp,h,frs).\n  case xp of\n     None \\<Rightarrow> (case frs of\n             [] \\<Rightarrow> True\n             | (f#fs) \\<Rightarrow> P\\<turnstile> h\\<surd> \\<and> \n             (let (stk,loc,C,M,pc) = f\n              in \\<exists>Ts T mxs mxl\\<^sub>0 is xt \\<tau>.\n                    (P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs,mxl\\<^sub>0,is,xt) in C) \\<and>\n                    \\<Phi> C M ! pc = Some \\<tau> \\<and>\n                    conf_f P h \\<tau> is f \\<and> conf_fs P h \\<Phi> M (size Ts) T fs))\n  | Some x \\<Rightarrow> frs = []\" \n\nnotation (xsymbols)\n correct_state  (\"_,_ \\<turnstile> _ \\<surd>\"  [61,0,0] 61)\n\n\n\nsection {* Values and @{text \"\\<top>\"} *}\n\nlemma confT_Err [iff]: \"P,h \\<turnstile> x :\\<le>\\<^sub>\\<top> Err\" \n  by (simp add: confT_def)\n\nlemma confT_OK [iff]:  \"P,h \\<turnstile> x :\\<le>\\<^sub>\\<top> OK T = (P,h \\<turnstile> x :\\<le> T)\"\n  by (simp add: confT_def)\n\nlemma confT_cases:\n  \"P,h \\<turnstile> x :\\<le>\\<^sub>\\<top> X = (X = Err \\<or> (\\<exists>T. X = OK T \\<and> P,h \\<turnstile> x :\\<le> T))\"\n  by (cases X) auto\n\nlemma confT_hext [intro?, trans]:\n  \"\\<lbrakk> P,h \\<turnstile> x :\\<le>\\<^sub>\\<top> T; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> x :\\<le>\\<^sub>\\<top> T\"\n  by (cases T) (blast intro: conf_hext)+\n\nlemma confT_widen [intro?, trans]:\n  \"\\<lbrakk> P,h \\<turnstile> x :\\<le>\\<^sub>\\<top> T; P \\<turnstile> T \\<le>\\<^sub>\\<top> T' \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> x :\\<le>\\<^sub>\\<top> T'\"\n  by (cases T', auto intro: conf_widen)\n\n\nsection {* Stack and Registers *}\n\nlemmas confTs_Cons1 [iff] = list_all2_Cons1 [of \"confT P h\"] for P h\n\nlemma confTs_confT_sup:\n  \"\\<lbrakk> P,h \\<turnstile> loc [:\\<le>\\<^sub>\\<top>] LT; n < size LT; LT!n = OK T; P \\<turnstile> T \\<le> T' \\<rbrakk> \n  \\<Longrightarrow> P,h \\<turnstile> (loc!n) :\\<le> T'\"\n(*<*)\n  apply (frule list_all2_lengthD)\n  apply (drule list_all2_nthD, simp)\n  apply simp\n  apply (erule conf_widen, assumption+)\n  done\n(*>*)\n\nlemma confTs_hext [intro?]:\n  \"P,h \\<turnstile> loc [:\\<le>\\<^sub>\\<top>] LT \\<Longrightarrow> h \\<unlhd> h' \\<Longrightarrow> P,h' \\<turnstile> loc [:\\<le>\\<^sub>\\<top>] LT\"\n  by (fast elim: list_all2_mono confT_hext)    \n\nlemma confTs_widen [intro?, trans]:\n  \"P,h \\<turnstile> loc [:\\<le>\\<^sub>\\<top>] LT \\<Longrightarrow> P \\<turnstile> LT [\\<le>\\<^sub>\\<top>] LT' \\<Longrightarrow> P,h \\<turnstile> loc [:\\<le>\\<^sub>\\<top>] LT'\"\n  by (rule list_all2_trans, rule confT_widen)\n\nlemma confTs_map [iff]:\n  \"\\<And>vs. (P,h \\<turnstile> vs [:\\<le>\\<^sub>\\<top>] map OK Ts) = (P,h \\<turnstile> vs [:\\<le>] Ts)\"\n  by (induct Ts) (auto simp add: list_all2_Cons2)\n\nlemma reg_widen_Err [iff]:\n  \"\\<And>LT. (P \\<turnstile> replicate n Err [\\<le>\\<^sub>\\<top>] LT) = (LT = replicate n Err)\"\n  by (induct n) (auto simp add: list_all2_Cons1)\n    \n\n\n  \nsection {* correct-frames *}\n\nlemmas [simp del] = fun_upd_apply\n\nlemma conf_fs_hext:\n  \"\\<And>M n T\\<^sub>r. \n  \\<lbrakk> conf_fs P h \\<Phi> M n T\\<^sub>r frs; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> conf_fs P h' \\<Phi> M n T\\<^sub>r frs\"\n(*<*)\napply (induct frs)\n apply simp\napply clarify\napply (simp (no_asm_use))\napply clarify\napply (unfold conf_f_def)\napply (simp (no_asm_use))\napply clarify\napply (fast elim!: confs_hext confTs_hext)\ndone\n(*>*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/BV/BVConform.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878414043814, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.3434201457435418}}
{"text": "(*  Title:      HOL/Auth/Guard/Guard.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2002  University of Cambridge\n*)\n\nsection\\<open>Protocol-Independent Confidentiality Theorem on Nonces\\<close>\n\ntheory Guard imports Analz Extensions begin\n\n(******************************************************************************\nmessages where all the occurrences of Nonce n are\nin a sub-message of the form Crypt (invKey K) X with K:Ks\n******************************************************************************)\n\ninductive_set\n  guard :: \"nat => key set => msg set\"\n  for n :: nat and Ks :: \"key set\"\nwhere\n  No_Nonce [intro]: \"Nonce n ~:parts {X} ==> X:guard n Ks\"\n| Guard_Nonce [intro]: \"invKey K:Ks ==> Crypt K X:guard n Ks\"\n| Crypt [intro]: \"X:guard n Ks ==> Crypt K X:guard n Ks\"\n| Pair [intro]: \"[| X:guard n Ks; Y:guard n Ks |] ==> \\<lbrace>X,Y\\<rbrace> \\<in> guard n Ks\"\n\nsubsection\\<open>basic facts about @{term guard}\\<close>\n\nlemma Key_is_guard [iff]: \"Key K:guard n Ks\"\nby auto\n\nlemma Agent_is_guard [iff]: \"Agent A:guard n Ks\"\nby auto\n\nlemma Number_is_guard [iff]: \"Number r:guard n Ks\"\nby auto\n\nlemma Nonce_notin_guard: \"X:guard n Ks ==> X ~= Nonce n\"\nby (erule guard.induct, auto)\n\nlemma Nonce_notin_guard_iff [iff]: \"Nonce n ~:guard n Ks\"\nby (auto dest: Nonce_notin_guard)\n\nlemma guard_has_Crypt [rule_format]: \"X:guard n Ks ==> Nonce n:parts {X}\n--> (EX K Y. Crypt K Y:kparts {X} & Nonce n:parts {Y})\"\nby (erule guard.induct, auto)\n\nlemma Nonce_notin_kparts_msg: \"X:guard n Ks ==> Nonce n ~:kparts {X}\"\nby (erule guard.induct, auto)\n\nlemma Nonce_in_kparts_imp_no_guard: \"Nonce n:kparts H\n==> EX X. X:H & X ~:guard n Ks\"\napply (drule in_kparts, clarify)\napply (rule_tac x=X in exI, clarify)\nby (auto dest: Nonce_notin_kparts_msg)\n\nlemma guard_kparts [rule_format]: \"X:guard n Ks ==>\nY:kparts {X} --> Y:guard n Ks\"\nby (erule guard.induct, auto)\n\nlemma guard_Crypt: \"[| Crypt K Y:guard n Ks; K ~:invKey`Ks |] ==> Y:guard n Ks\"\n  by (ind_cases \"Crypt K Y:guard n Ks\") (auto intro!: image_eqI)\n\nlemma guard_MPair [iff]: \"(\\<lbrace>X,Y\\<rbrace> \\<in> guard n Ks) = (X \\<in> guard n Ks \\<and> Y \\<in> guard n Ks)\"\nby (auto, (ind_cases \"\\<lbrace>X,Y\\<rbrace> \\<in> guard n Ks\", auto)+)\n\nlemma guard_not_guard [rule_format]: \"X:guard n Ks ==>\nCrypt K Y:kparts {X} --> Nonce n:kparts {Y} --> Y ~:guard n Ks\"\nby (erule guard.induct, auto dest: guard_kparts)\n\nlemma guard_extand: \"[| X:guard n Ks; Ks <= Ks' |] ==> X:guard n Ks'\"\nby (erule guard.induct, auto)\n\nsubsection\\<open>guarded sets\\<close>\n\ndefinition Guard :: \"nat => key set => msg set => bool\" where\n\"Guard n Ks H == ALL X. X:H --> X:guard n Ks\"\n\nsubsection\\<open>basic facts about @{term Guard}\\<close>\n\nlemma Guard_empty [iff]: \"Guard n Ks {}\"\nby (simp add: Guard_def)\n\nlemma notin_parts_Guard [intro]: \"Nonce n ~:parts G ==> Guard n Ks G\"\napply (unfold Guard_def, clarify)\napply (subgoal_tac \"Nonce n ~:parts {X}\")\nby (auto dest: parts_sub)\n\nlemma Nonce_notin_kparts [simplified]: \"Guard n Ks H ==> Nonce n ~:kparts H\"\nby (auto simp: Guard_def dest: in_kparts Nonce_notin_kparts_msg)\n\nlemma Guard_must_decrypt: \"[| Guard n Ks H; Nonce n:analz H |] ==>\nEX K Y. Crypt K Y:kparts H & Key (invKey K):kparts H\"\napply (drule_tac P=\"%G. Nonce n:G\" in analz_pparts_kparts_substD, simp)\nby (drule must_decrypt, auto dest: Nonce_notin_kparts)\n\nlemma Guard_kparts [intro]: \"Guard n Ks H ==> Guard n Ks (kparts H)\"\nby (auto simp: Guard_def dest: in_kparts guard_kparts)\n\nlemma Guard_mono: \"[| Guard n Ks H; G <= H |] ==> Guard n Ks G\"\nby (auto simp: Guard_def)\n\nlemma Guard_insert [iff]: \"Guard n Ks (insert X H)\n= (Guard n Ks H & X:guard n Ks)\"\nby (auto simp: Guard_def)\n\nlemma Guard_Un [iff]: \"Guard n Ks (G Un H) = (Guard n Ks G & Guard n Ks H)\"\nby (auto simp: Guard_def)\n\nlemma Guard_synth [intro]: \"Guard n Ks G ==> Guard n Ks (synth G)\"\nby (auto simp: Guard_def, erule synth.induct, auto)\n\nlemma Guard_analz [intro]: \"[| Guard n Ks G; ALL K. K:Ks --> Key K ~:analz G |]\n==> Guard n Ks (analz G)\"\napply (auto simp: Guard_def)\napply (erule analz.induct, auto)\nby (ind_cases \"Crypt K Xa:guard n Ks\" for K Xa, auto)\n\nlemma in_Guard [dest]: \"[| X:G; Guard n Ks G |] ==> X:guard n Ks\"\nby (auto simp: Guard_def)\n\nlemma in_synth_Guard: \"[| X:synth G; Guard n Ks G |] ==> X:guard n Ks\"\nby (drule Guard_synth, auto)\n\nlemma in_analz_Guard: \"[| X:analz G; Guard n Ks G;\nALL K. K:Ks --> Key K ~:analz G |] ==> X:guard n Ks\"\nby (drule Guard_analz, auto)\n\nlemma Guard_keyset [simp]: \"keyset G ==> Guard n Ks G\"\nby (auto simp: Guard_def)\n\nlemma Guard_Un_keyset: \"[| Guard n Ks G; keyset H |] ==> Guard n Ks (G Un H)\"\nby auto\n\nlemma in_Guard_kparts: \"[| X:G; Guard n Ks G; Y:kparts {X} |] ==> Y:guard n Ks\"\nby blast\n\nlemma in_Guard_kparts_neq: \"[| X:G; Guard n Ks G; Nonce n':kparts {X} |]\n==> n ~= n'\"\nby (blast dest: in_Guard_kparts)\n\nlemma in_Guard_kparts_Crypt: \"[| X:G; Guard n Ks G; is_MPair X;\nCrypt K Y:kparts {X}; Nonce n:kparts {Y} |] ==> invKey K:Ks\"\napply (drule in_Guard, simp)\napply (frule guard_not_guard, simp+)\napply (drule guard_kparts, simp)\nby (ind_cases \"Crypt K Y:guard n Ks\", auto)\n\nlemma Guard_extand: \"[| Guard n Ks G; Ks <= Ks' |] ==> Guard n Ks' G\"\nby (auto simp: Guard_def dest: guard_extand)\n\nlemma guard_invKey [rule_format]: \"[| X:guard n Ks; Nonce n:kparts {Y} |] ==>\nCrypt K Y:kparts {X} --> invKey K:Ks\"\nby (erule guard.induct, auto)\n\nlemma Crypt_guard_invKey [rule_format]: \"[| Crypt K Y:guard n Ks;\nNonce n:kparts {Y} |] ==> invKey K:Ks\"\nby (auto dest: guard_invKey)\n\nsubsection\\<open>set obtained by decrypting a message\\<close>\n\nabbreviation (input)\n  decrypt :: \"msg set => key => msg => msg set\" where\n  \"decrypt H K Y == insert Y (H - {Crypt K Y})\"\n\nlemma analz_decrypt: \"[| Crypt K Y:H; Key (invKey K):H; Nonce n:analz H |]\n==> Nonce n:analz (decrypt H K Y)\"\napply (drule_tac P=\"%H. Nonce n:analz H\" in ssubst [OF insert_Diff])\napply assumption\napply (simp only: analz_Crypt_if, simp)\ndone\n\nlemma parts_decrypt: \"[| Crypt K Y:H; X:parts (decrypt H K Y) |] ==> X:parts H\"\nby (erule parts.induct, auto intro: parts.Fst parts.Snd parts.Body)\n\nsubsection\\<open>number of Crypt's in a message\\<close>\n\nfun crypt_nb :: \"msg => nat\"\nwhere\n  \"crypt_nb (Crypt K X) = Suc (crypt_nb X)\"\n| \"crypt_nb \\<lbrace>X,Y\\<rbrace> = crypt_nb X + crypt_nb Y\"\n| \"crypt_nb X = 0\" (* otherwise *)\n\nsubsection\\<open>basic facts about @{term crypt_nb}\\<close>\n\nlemma non_empty_crypt_msg: \"Crypt K Y:parts {X} ==> crypt_nb X \\<noteq> 0\"\nby (induct X, simp_all, safe, simp_all)\n\nsubsection\\<open>number of Crypt's in a message list\\<close>\n\nprimrec cnb :: \"msg list => nat\"\nwhere\n  \"cnb [] = 0\"\n| \"cnb (X#l) = crypt_nb X + cnb l\"\n\nsubsection\\<open>basic facts about @{term cnb}\\<close>\n\nlemma cnb_app [simp]: \"cnb (l @ l') = cnb l + cnb l'\"\nby (induct l, auto)\n\nlemma mem_cnb_minus: \"x \\<in> set l ==> cnb l = crypt_nb x + (cnb l - crypt_nb x)\"\n  by (induct l) auto\n\nlemmas mem_cnb_minus_substI = mem_cnb_minus [THEN ssubst]\n\nlemma cnb_minus [simp]: \"x \\<in> set l ==> cnb (remove l x) = cnb l - crypt_nb x\"\napply (induct l, auto)\napply (erule_tac l=l and x=x in mem_cnb_minus_substI)\napply simp\ndone\n\nlemma parts_cnb: \"Z:parts (set l) ==>\ncnb l = (cnb l - crypt_nb Z) + crypt_nb Z\"\nby (erule parts.induct, auto simp: in_set_conv_decomp)\n\nlemma non_empty_crypt: \"Crypt K Y:parts (set l) ==> cnb l \\<noteq> 0\"\nby (induct l, auto dest: non_empty_crypt_msg parts_insert_substD)\n\nsubsection\\<open>list of kparts\\<close>\n\nlemma kparts_msg_set: \"EX l. kparts {X} = set l & cnb l = crypt_nb X\"\napply (induct X, simp_all)\napply (rename_tac agent, rule_tac x=\"[Agent agent]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Number nat]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Nonce nat]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Key nat]\" in exI, simp)\napply (rename_tac X, rule_tac x=\"[Hash X]\" in exI, simp)\napply (clarify, rule_tac x=\"l@la\" in exI, simp)\nby (clarify, rename_tac nat X y, rule_tac x=\"[Crypt nat X]\" in exI, simp)\n\nlemma kparts_set: \"EX l'. kparts (set l) = set l' & cnb l' = cnb l\"\napply (induct l)\napply (rule_tac x=\"[]\" in exI, simp, clarsimp)\napply (rename_tac a b l')\napply (subgoal_tac \"EX l''.  kparts {a} = set l'' & cnb l'' = crypt_nb a\", clarify)\napply (rule_tac x=\"l''@l'\" in exI, simp)\napply (rule kparts_insert_substI, simp)\nby (rule kparts_msg_set)\n\nsubsection\\<open>list corresponding to \"decrypt\"\\<close>\n\ndefinition decrypt' :: \"msg list => key => msg => msg list\" where\n\"decrypt' l K Y == Y # remove l (Crypt K Y)\"\n\ndeclare decrypt'_def [simp]\n\nsubsection\\<open>basic facts about @{term decrypt'}\\<close>\n\nlemma decrypt_minus: \"decrypt (set l) K Y <= set (decrypt' l K Y)\"\nby (induct l, auto)\n\nsubsection\\<open>if the analyse of a finite guarded set gives n then it must also gives\none of the keys of Ks\\<close>\n\nlemma Guard_invKey_by_list [rule_format]: \"ALL l. cnb l = p\n--> Guard n Ks (set l) --> Nonce n:analz (set l)\n--> (EX K. K:Ks & Key K:analz (set l))\"\napply (induct p)\n(* case p=0 *)\napply (clarify, drule Guard_must_decrypt, simp, clarify)\napply (drule kparts_parts, drule non_empty_crypt, simp)\n(* case p>0 *)\napply (clarify, frule Guard_must_decrypt, simp, clarify)\napply (drule_tac P=\"%G. Nonce n:G\" in analz_pparts_kparts_substD, simp)\napply (frule analz_decrypt, simp_all)\napply (subgoal_tac \"EX l'. kparts (set l) = set l' & cnb l' = cnb l\", clarsimp)\napply (drule_tac G=\"insert Y (set l' - {Crypt K Y})\"\nand H=\"set (decrypt' l' K Y)\" in analz_sub, rule decrypt_minus)\napply (rule_tac analz_pparts_kparts_substI, simp)\napply (case_tac \"K:invKey`Ks\")\n(* K:invKey`Ks *)\napply (clarsimp, blast)\n(* K ~:invKey`Ks *)\napply (subgoal_tac \"Guard n Ks (set (decrypt' l' K Y))\")\napply (drule_tac x=\"decrypt' l' K Y\" in spec, simp)\napply (subgoal_tac \"Crypt K Y:parts (set l)\")\napply (drule parts_cnb, rotate_tac -1, simp)\napply (clarify, drule_tac X=\"Key Ka\" and H=\"insert Y (set l')\" in analz_sub)\napply (rule insert_mono, rule set_remove)\napply (simp add: analz_insertD, blast)\n(* Crypt K Y:parts (set l) *)\napply (blast dest: kparts_parts)\n(* Guard n Ks (set (decrypt' l' K Y)) *)\napply (rule_tac H=\"insert Y (set l')\" in Guard_mono)\napply (subgoal_tac \"Guard n Ks (set l')\", simp)\napply (rule_tac K=K in guard_Crypt, simp add: Guard_def, simp)\napply (drule_tac t=\"set l'\" in sym, simp)\napply (rule Guard_kparts, simp, simp)\napply (rule_tac B=\"set l'\" in subset_trans, rule set_remove, blast)\nby (rule kparts_set)\n\nlemma Guard_invKey_finite: \"[| Nonce n:analz G; Guard n Ks G; finite G |]\n==> EX K. K:Ks & Key K:analz G\"\napply (drule finite_list, clarify)\nby (rule Guard_invKey_by_list, auto)\n\nlemma Guard_invKey: \"[| Nonce n:analz G; Guard n Ks G |]\n==> EX K. K:Ks & Key K:analz G\"\nby (auto dest: analz_needs_only_finite Guard_invKey_finite)\n\nsubsection\\<open>if the analyse of a finite guarded set and a (possibly infinite) set of keys\ngives n then it must also gives Ks\\<close>\n\nlemma Guard_invKey_keyset: \"[| Nonce n:analz (G Un H); Guard n Ks G; finite G;\nkeyset H |] ==> EX K. K:Ks & Key K:analz (G Un H)\"\napply (frule_tac P=\"%G. Nonce n:G\" and G=G in analz_keyset_substD, simp_all)\napply (drule_tac G=\"G Un (H Int keysfor G)\" in Guard_invKey_finite)\nby (auto simp: Guard_def intro: analz_sub)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/Guard/Guard.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.34334890928627115}}
{"text": "theory flash77Bra  imports flash77Rev\n \n  begin\nlemma onInv77:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv77  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv77  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv77 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash77Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6757646010190477, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3431612818573754}}
{"text": "(*  Author:     Gerwin Klein\n    Copyright   1999 Technische Universitaet Muenchen\n*)\n\nsection {* Correctness of the LBV *}\n\ntheory LBVCorrect\nimports LBVSpec Typing_Framework\nbegin\n\nlocale lbvs = lbv +\n  fixes s0  :: 'a (\"s\\<^sub>0\")\n  fixes c   :: \"'a list\"\n  fixes ins :: \"'b list\"\n  fixes phi :: \"'a list\" (\"\\<phi>\")\n  defines phi_def:\n  \"\\<phi> \\<equiv> map (\\<lambda>pc. if c!pc = \\<bottom> then wtl (take pc ins) c 0 s0 else c!pc) \n       [0..<length ins]\"\n\n  assumes bounded: \"bounded step (length ins)\"\n  assumes cert: \"cert_ok c (length ins) \\<top> \\<bottom> A\"\n  assumes pres: \"pres_type step (length ins) A\"\n\n\nlemma (in lbvs) phi_None [intro?]:\n  \"\\<lbrakk> pc < length ins; c!pc = \\<bottom> \\<rbrakk> \\<Longrightarrow> \\<phi> ! pc = wtl (take pc ins) c 0 s0\"\n  by (simp add: phi_def)\n\nlemma (in lbvs) phi_Some [intro?]:\n  \"\\<lbrakk> pc < length ins; c!pc \\<noteq> \\<bottom> \\<rbrakk> \\<Longrightarrow> \\<phi> ! pc = c ! pc\"\n  by (simp add: phi_def)\n\nlemma (in lbvs) phi_len [simp]:\n  \"length \\<phi> = length ins\"\n  by (simp add: phi_def)\n\n\nlemma (in lbvs) wtl_suc_pc:\n  assumes all: \"wtl ins c 0 s\\<^sub>0 \\<noteq> \\<top>\" \n  assumes pc:  \"pc+1 < length ins\"\n  shows \"wtl (take (pc+1) ins) c 0 s0 \\<sqsubseteq>\\<^sub>r \\<phi>!(pc+1)\"\nproof -\n  from all pc\n  have \"wtc c (pc+1) (wtl (take (pc+1) ins) c 0 s0) \\<noteq> T\" by (rule wtl_all)\n  with pc show ?thesis by (simp add: phi_def wtc split: split_if_asm)\nqed\n\n\nlemma (in lbvs) wtl_stable:\n  assumes wtl: \"wtl ins c 0 s0 \\<noteq> \\<top>\" \n  assumes s0:  \"s0 \\<in> A\" \n  assumes pc:  \"pc < length ins\" \n  shows \"stable r step \\<phi> pc\"\nproof (unfold stable_def, clarify)\n  fix pc' s' assume step: \"(pc',s') \\<in> set (step pc (\\<phi> ! pc))\" \n                      (is \"(pc',s') \\<in> set (?step pc)\")\n  \n  from bounded pc step have pc': \"pc' < length ins\" by (rule boundedD)\n\n  from wtl have tkpc: \"wtl (take pc ins) c 0 s0 \\<noteq> \\<top>\" (is \"?s1 \\<noteq> _\") by (rule wtl_take)\n  from wtl have s2: \"wtl (take (pc+1) ins) c 0 s0 \\<noteq> \\<top>\" (is \"?s2 \\<noteq> _\") by (rule wtl_take)\n  \n  from wtl pc have wt_s1: \"wtc c pc ?s1 \\<noteq> \\<top>\" by (rule wtl_all)\n\n  have c_Some: \"\\<forall>pc t. pc < length ins \\<longrightarrow> c!pc \\<noteq> \\<bottom> \\<longrightarrow> \\<phi>!pc = c!pc\" \n    by (simp add: phi_def)\n  from pc have c_None: \"c!pc = \\<bottom> \\<Longrightarrow> \\<phi>!pc = ?s1\" ..\n\n  from wt_s1 pc c_None c_Some\n  have inst: \"wtc c pc ?s1  = wti c pc (\\<phi>!pc)\"\n    by (simp add: wtc split: split_if_asm)\n\n  from pres cert s0 wtl pc have \"?s1 \\<in> A\" by (rule wtl_pres)\n  with pc c_Some cert c_None\n  have \"\\<phi>!pc \\<in> A\" by (cases \"c!pc = \\<bottom>\") (auto dest: cert_okD1)\n  with pc pres\n  have step_in_A: \"snd`set (?step pc) \\<subseteq> A\" by (auto dest: pres_typeD2)\n\n  show \"s' <=_r \\<phi>!pc'\" \n  proof (cases \"pc' = pc+1\")\n    case True\n    with pc' cert\n    have cert_in_A: \"c!(pc+1) \\<in> A\" by (auto dest: cert_okD1)\n    from True pc' have pc1: \"pc+1 < length ins\" by simp\n    with tkpc have \"?s2 = wtc c pc ?s1\" by - (rule wtl_Suc)\n    with inst \n    have merge: \"?s2 = merge c pc (?step pc) (c!(pc+1))\" by (simp add: wti)\n    also    \n    from s2 merge have \"\\<dots> \\<noteq> \\<top>\" (is \"?merge \\<noteq> _\") by simp\n    with cert_in_A step_in_A\n    have \"?merge = (map snd [(p',t') \\<leftarrow> ?step pc. p'=pc+1] ++_f (c!(pc+1)))\"\n      by (rule merge_not_top_s) \n    finally\n    have \"s' <=_r ?s2\" using step_in_A cert_in_A True step \n      by (auto intro: pp_ub1')\n    also \n    from wtl pc1 have \"?s2 <=_r \\<phi>!(pc+1)\" by (rule wtl_suc_pc)\n    also note True [symmetric]\n    finally show ?thesis by simp    \n  next\n    case False\n    from wt_s1 inst\n    have \"merge c pc (?step pc) (c!(pc+1)) \\<noteq> \\<top>\" by (simp add: wti)\n    with step_in_A\n    have \"\\<forall>(pc', s')\\<in>set (?step pc). pc'\\<noteq>pc+1 \\<longrightarrow> s' <=_r c!pc'\" \n      by - (rule merge_not_top)\n    with step False \n    have ok: \"s' <=_r c!pc'\" by blast\n    moreover\n    from ok\n    have \"c!pc' = \\<bottom> \\<Longrightarrow> s' = \\<bottom>\" by simp\n    moreover\n    from c_Some pc'\n    have \"c!pc' \\<noteq> \\<bottom> \\<Longrightarrow> \\<phi>!pc' = c!pc'\" by auto\n    ultimately\n    show ?thesis by (cases \"c!pc' = \\<bottom>\") auto \n  qed\nqed\n\n  \nlemma (in lbvs) phi_not_top:\n  assumes wtl: \"wtl ins c 0 s0 \\<noteq> \\<top>\"\n  assumes pc:  \"pc < length ins\"\n  shows \"\\<phi>!pc \\<noteq> \\<top>\"\nproof (cases \"c!pc = \\<bottom>\")\n  case False with pc\n  have \"\\<phi>!pc = c!pc\" ..\n  also from cert pc have \"\\<dots> \\<noteq> \\<top>\" by (rule cert_okD4)\n  finally show ?thesis .\nnext\n  case True with pc\n  have \"\\<phi>!pc = wtl (take pc ins) c 0 s0\" ..\n  also from wtl have \"\\<dots> \\<noteq> \\<top>\" by (rule wtl_take)\n  finally show ?thesis .\nqed\n\nlemma (in lbvs) phi_in_A:\n  assumes wtl: \"wtl ins c 0 s0 \\<noteq> \\<top>\"\n  assumes s0:  \"s0 \\<in> A\"\n  shows \"\\<phi> \\<in> list (length ins) A\"\nproof -\n  { fix x assume \"x \\<in> set \\<phi>\"\n    then obtain xs ys where \"\\<phi> = xs @ x # ys\" \n      by (auto simp add: in_set_conv_decomp)\n    then obtain pc where pc: \"pc < length \\<phi>\" and x: \"\\<phi>!pc = x\"\n      by (simp add: that [of \"length xs\"] nth_append)\n    \n    from pres cert wtl s0 pc\n    have \"wtl (take pc ins) c 0 s0 \\<in> A\" by (auto intro!: wtl_pres)\n    moreover\n    from pc have \"pc < length ins\" by simp\n    with cert have \"c!pc \\<in> A\" ..\n    ultimately\n    have \"\\<phi>!pc \\<in> A\" using pc by (simp add: phi_def)\n    hence \"x \\<in> A\" using x by simp\n  } \n  hence \"set \\<phi> \\<subseteq> A\" ..\n  thus ?thesis by (unfold list_def) simp\nqed\n\n\nlemma (in lbvs) phi0:\n  assumes wtl: \"wtl ins c 0 s0 \\<noteq> \\<top>\"\n  assumes 0:   \"0 < length ins\"\n  shows \"s0 <=_r \\<phi>!0\"\nproof (cases \"c!0 = \\<bottom>\")\n  case True\n  with 0 have \"\\<phi>!0 = wtl (take 0 ins) c 0 s0\" ..\n  moreover have \"wtl (take 0 ins) c 0 s0 = s0\" by simp\n  ultimately have \"\\<phi>!0 = s0\" by simp\n  thus ?thesis by simp\nnext\n  case False\n  with 0 have \"phi!0 = c!0\" ..\n  moreover \n  from wtl have \"wtl (take 1 ins) c 0 s0 \\<noteq> \\<top>\"  by (rule wtl_take)\n  with 0 False \n  have \"s0 <=_r c!0\" by (auto simp add: neq_Nil_conv wtc split: split_if_asm)\n  ultimately\n  show ?thesis by simp\nqed\n\n\n\n\n\ntheorem (in lbvs) wtl_sound_strong:\n  assumes wtl: \"wtl ins c 0 s0 \\<noteq> \\<top>\" \n  assumes s0: \"s0 \\<in> A\" \n  assumes nz: \"0 < length ins\"\n  shows \"\\<exists>ts \\<in> list (length ins) A. wt_step r \\<top> step ts \\<and> s0 <=_r ts!0\"\nproof -\n  from wtl s0 have \"\\<phi> \\<in> list (length ins) A\" by (rule phi_in_A)\n  moreover\n  have \"wt_step r \\<top> step \\<phi>\"\n  proof (unfold wt_step_def, intro strip conjI)\n    fix pc assume \"pc < length \\<phi>\"\n    then have pc: \"pc < length ins\" by simp\n    with wtl show \"\\<phi>!pc \\<noteq> \\<top>\" by (rule phi_not_top)\n    from wtl s0 pc show \"stable r step \\<phi> pc\" by (rule wtl_stable)\n  qed\n  moreover\n  from wtl nz have \"s0 <=_r \\<phi>!0\" by (rule phi0)\n  ultimately\n  show ?thesis by fast\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/MicroJava/DFA/LBVCorrect.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3431612818573753}}
{"text": "theory flash80Bra  imports flash80Rev\n \n  begin\nlemma onInv80:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv80 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv80 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv80 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash80Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7634837527911056, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.34310397503783624}}
{"text": "theory Needham_Schroeder_Unguided_Attacker_Example\nimports Needham_Schroeder_Base\nbegin\n\ninductive_set ns_public :: \"event list set\"\n  where\n         (*Initial trace is empty*)\n   Nil:  \"[] \\<in> ns_public\"\n\n | Fake:  \"\\<lbrakk>evs1 \\<in> ns_public; X \\<in> synth (analz (spies evs1)) \\<rbrakk>\n          \\<Longrightarrow> Says Spy A X # evs1  \\<in> ns_public\"\n\n         (*Alice initiates a protocol run, sending a nonce to Bob*)\n | NS1:  \"\\<lbrakk>evs1 \\<in> ns_public;  Nonce NA \\<notin> used evs1\\<rbrakk>\n          \\<Longrightarrow> Says A B (Crypt (pubEK B) \\<lbrace>Nonce NA, Agent A\\<rbrace>)\n                # evs1  \\<in>  ns_public\"\n         (*Bob responds to Alice's message with a further nonce*)\n | NS2:  \"\\<lbrakk>evs2 \\<in> ns_public;  Nonce NB \\<notin> used evs2;\n           Says A' B (Crypt (pubEK B) \\<lbrace>Nonce NA, Agent A\\<rbrace>) \\<in> set evs2\\<rbrakk>\n          \\<Longrightarrow> Says B A (Crypt (pubEK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>)\n                # evs2  \\<in>  ns_public\"\n\n         (*Alice proves her existence by sending NB back to Bob.*)\n | NS3:  \"\\<lbrakk>evs3 \\<in> ns_public;\n           Says A  B (Crypt (pubEK B) \\<lbrace>Nonce NA, Agent A\\<rbrace>) \\<in> set evs3;\n           Says B' A (Crypt (pubEK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) \\<in> set evs3\\<rbrakk>\n          \\<Longrightarrow> Says A B (Crypt (pubEK B) (Nonce NB)) # evs3 \\<in> ns_public\"\n\ndeclare ListMem_iff[symmetric, code_pred_inline]\n\nlemmas [code_pred_intro] = ns_publicp.intros[folded synth'_def]\n\ncode_pred [skip_proof] ns_publicp unfolding synth'_def by (rule ns_publicp.cases) fastforce+\nthm ns_publicp.equation\n\ncode_pred [generator_cps] ns_publicp .\nthm ns_publicp.generator_cps_equation\n\n\nlemma \"ns_publicp evs ==> \\<not> (Says Alice Bob (Crypt (pubEK Bob) (Nonce NB))) : set evs\"\nquickcheck[smart_exhaustive, depth = 5, timeout = 200, expect = counterexample]\n(*quickcheck[narrowing, size = 6, timeout = 200, verbose, expect = no_counterexample]*)\noops\n\nlemma\n  \"\\<lbrakk>ns_publicp evs\\<rbrakk>            \n       \\<Longrightarrow> Says B A (Crypt (pubEK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) : set evs\n       \\<Longrightarrow> A \\<noteq> Spy \\<Longrightarrow> B \\<noteq> Spy \\<Longrightarrow> A \\<noteq> B \n           \\<Longrightarrow> Nonce NB \\<notin> analz (spies evs)\"\nquickcheck[smart_exhaustive, depth = 6, timeout = 100, expect = no_counterexample]\n(*quickcheck[narrowing, size = 7, timeout = 200, expect = no_counterexample]*)\noops\n\nsection \\<open>Proving the counterexample trace for validation\\<close>\n\nlemma\n  assumes \"A = Alice\" \"B = Bob\" \"C = Spy\" \"NA = 0\" \"NB = 1\"\n  assumes \"evs = \n  [Says Alice Spy (Crypt (pubEK Spy) (Nonce 1)),\n   Says Bob Alice (Crypt (pubEK Alice) \\<lbrace>Nonce 0, Nonce 1\\<rbrace>),\n   Says Spy Bob (Crypt (pubEK Bob) \\<lbrace>Nonce 0, Agent Alice\\<rbrace>),\n   Says Alice Spy (Crypt (pubEK Spy) \\<lbrace>Nonce 0, Agent Alice\\<rbrace>)]\" (is \"_ = [?e3, ?e2, ?e1, ?e0]\")\n  shows \"A \\<noteq> Spy\" \"B \\<noteq> Spy\" \"evs : ns_public\" \"Nonce NB : analz (knows Spy evs)\"\nproof -\n  from assms show \"A \\<noteq> Spy\" by auto\n  from assms show \"B \\<noteq> Spy\" by auto\n  have \"[] : ns_public\" by (rule Nil)\n  then have first_step: \"[?e0] : ns_public\"\n  proof (rule NS1)\n    show \"Nonce 0 ~: used []\" by eval\n  qed\n  then have \"[?e1, ?e0] : ns_public\"\n  proof (rule Fake)\n    show \"Crypt (pubEK Bob) \\<lbrace>Nonce 0, Agent Alice\\<rbrace> : synth (analz (knows Spy [?e0]))\"\n      by (intro synth.intros(2,3,4,1)) eval+\n  qed\n  then have \"[?e2, ?e1, ?e0] : ns_public\"\n  proof (rule NS2)\n    show \"Says Spy Bob (Crypt (pubEK Bob) \\<lbrace>Nonce 0, Agent Alice\\<rbrace>) \\<in> set [?e1, ?e0]\" by simp\n    show \" Nonce 1 ~: used [?e1, ?e0]\" by eval\n  qed\n  then show \"evs : ns_public\"\n  unfolding assms\n  proof (rule NS3)\n    show \"  Says Alice Spy (Crypt (pubEK Spy) \\<lbrace>Nonce 0, Agent Alice\\<rbrace>) \\<in> set [?e2, ?e1, ?e0]\" by simp\n    show \"Says Bob Alice (Crypt (pubEK Alice) \\<lbrace>Nonce 0, Nonce 1\\<rbrace>) : set [?e2, ?e1, ?e0]\" by simp\n  qed\n  from assms show \"Nonce NB : analz (knows Spy evs)\"\n    apply simp\n    apply (rule analz.intros(4))\n    apply (rule analz.intros(1))\n    apply (auto simp add: bad_def)\n    done\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/Benchmarks/Quickcheck_Benchmark/Needham_Schroeder_Unguided_Attacker_Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.665410572017153, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.34309894306468813}}
{"text": "theory Primitive_Normalization\nimports Negation_Type_Matching\nbegin\n\nsection\\<open>Primitive Normalization\\<close>\n\nsubsection\\<open>Normalized Primitives\\<close>\n\ntext\\<open>\n  Test if a @{text disc} is in the match expression.\n  For example, it call tell whether there are some matches for @{text \"Src ip\"}.\n\\<close>\nfun has_disc :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a match_expr \\<Rightarrow> bool\" where\n  \"has_disc _ MatchAny = False\" |\n  \"has_disc disc (Match a) = disc a\" |\n  \"has_disc disc (MatchNot m) = has_disc disc m\" |\n  \"has_disc disc (MatchAnd m1 m2) = (has_disc disc m1 \\<or> has_disc disc m2)\"\n\nfun has_disc_negated :: \"('a \\<Rightarrow> bool) \\<Rightarrow> bool \\<Rightarrow> 'a match_expr \\<Rightarrow> bool\" where\n  \"has_disc_negated _    _   MatchAny = False\" |\n  \"has_disc_negated disc neg (Match a) = (if disc a then neg else False)\" |\n  \"has_disc_negated disc neg (MatchNot m) = has_disc_negated disc (\\<not> neg) m\" |\n  \"has_disc_negated disc neg (MatchAnd m1 m2) = (has_disc_negated disc neg m1 \\<or> has_disc_negated disc neg m2)\"\n\nlemma \"\\<not> has_disc_negated (\\<lambda>x::nat. x = 0) False (MatchAnd (Match 0) (MatchNot (Match 1)))\" by eval\nlemma \"has_disc_negated (\\<lambda>x::nat. x = 0) False (MatchAnd (Match 0) (MatchNot (Match 0)))\" by eval\nlemma \"has_disc_negated (\\<lambda>x::nat. x = 0) True (MatchAnd (Match 0) (MatchNot (Match 1)))\" by eval\nlemma \"\\<not> has_disc_negated (\\<lambda>x::nat. x = 0) True (MatchAnd (Match 1) (MatchNot (Match 0)))\" by eval\nlemma \"has_disc_negated (\\<lambda>x::nat. x = 0) True (MatchAnd (Match 0) (MatchNot (Match 0)))\" by eval\n\n-- \"We want false on the right hand side, because this is how the algorithm should be started\"\nlemma has_disc_negated_MatchNot:\n  \"has_disc_negated disc True (MatchNot m) \\<longleftrightarrow> has_disc_negated disc False m\"\n  \"has_disc_negated disc True m \\<longleftrightarrow> has_disc_negated disc False (MatchNot m)\"\n  by(induction m) (simp_all)\n\nlemma has_disc_negated_has_disc: \"has_disc_negated disc neg m \\<Longrightarrow> has_disc disc m\"\n  apply(induction m arbitrary: neg)\n     apply(simp_all split: if_split_asm)\n  by blast\n\nlemma has_disc_negated_positiv_has_disc: \"has_disc_negated disc neg m \\<or> has_disc_negated disc (\\<not> neg) m \\<longleftrightarrow> has_disc disc m\"\nby(induction disc neg m arbitrary: neg rule:has_disc_negated.induct) auto\n\n\nlemma has_disc_negated_disj_split: \n    \"has_disc_negated (\\<lambda>a. P a \\<or> Q a) neg m \\<longleftrightarrow> has_disc_negated P neg m \\<or> has_disc_negated Q neg m\"\n  apply(induction \"(\\<lambda>a. P a \\<or> Q a)\" neg m rule: has_disc_negated.induct)\n     apply(simp_all)\n  by blast\n\nlemma has_disc_alist_and: \"has_disc disc (alist_and as) \\<longleftrightarrow> (\\<exists> a \\<in> set as. has_disc disc (negation_type_to_match_expr a))\"\n  proof(induction as rule: alist_and.induct)\n  qed(simp_all add: negation_type_to_match_expr_simps)\nlemma has_disc_negated_alist_and: \"has_disc_negated disc neg (alist_and as) \\<longleftrightarrow> (\\<exists> a \\<in> set as. has_disc_negated disc neg (negation_type_to_match_expr a))\"\n  proof(induction as rule: alist_and.induct)\n  qed(simp_all add: negation_type_to_match_expr_simps)\n  \n\nlemma has_disc_alist_and': \"has_disc disc (alist_and' as) \\<longleftrightarrow> (\\<exists> a \\<in> set as. has_disc disc (negation_type_to_match_expr a))\"\n  proof(induction as rule: alist_and'.induct)\n  qed(simp_all add: negation_type_to_match_expr_simps)\nlemma has_disc_negated_alist_and': \"has_disc_negated disc neg (alist_and' as) \\<longleftrightarrow> (\\<exists> a \\<in> set as. has_disc_negated disc neg (negation_type_to_match_expr a))\"\n  proof(induction as rule: alist_and'.induct)\n  qed(simp_all add: negation_type_to_match_expr_simps)\n\n\nlemma has_disc_alist_and'_append:\n  \"has_disc disc' (alist_and' (ls1 @ ls2)) \\<longleftrightarrow>\n      has_disc disc' (alist_and' ls1) \\<or> has_disc disc' (alist_and' ls2)\"\napply(induction ls1 arbitrary: ls2 rule: alist_and'.induct)\n    apply(simp_all)\n apply(case_tac [!] ls2)\n   apply(simp_all)\ndone\nlemma has_disc_negated_alist_and'_append:\n  \"has_disc_negated disc' neg (alist_and' (ls1 @ ls2)) \\<longleftrightarrow>\n      has_disc_negated disc' neg (alist_and' ls1) \\<or> has_disc_negated disc' neg (alist_and' ls2)\"\napply(induction ls1 arbitrary: ls2 rule: alist_and'.induct)\n    apply(simp_all)\n apply(case_tac [!] ls2)\n   apply(simp_all)\ndone\n\nlemma match_list_to_match_expr_not_has_disc: \n    \"\\<forall>a. \\<not> disc (X a) \\<Longrightarrow> \\<not> has_disc disc (match_list_to_match_expr (map (Match \\<circ> X) ls))\"\n  apply(induction ls)\n   apply(simp; fail)\n  by(simp add: MatchOr_def)\n\n\nlemma \"matches ((\\<lambda>x _. bool_to_ternary (disc x)), (\\<lambda>_ _. False)) (Match x) a p \\<longleftrightarrow> has_disc disc (Match x)\"\nby(simp add: match_raw_ternary bool_to_ternary_simps split: ternaryvalue.split )\n\n\nfun normalized_n_primitive :: \"(('a \\<Rightarrow> bool) \\<times> ('a \\<Rightarrow> 'b)) \\<Rightarrow> ('b \\<Rightarrow> bool) \\<Rightarrow> 'a match_expr \\<Rightarrow> bool\" where\n  \"normalized_n_primitive _ _ MatchAny = True\" |\n  \"normalized_n_primitive (disc, sel) n (Match P) = (if disc P then n (sel P) else True)\" |\n  \"normalized_n_primitive (disc, sel) n (MatchNot (Match P)) = (if disc P then False else True)\" |\n  \"normalized_n_primitive (disc, sel) n (MatchAnd m1 m2) = (normalized_n_primitive (disc, sel) n m1 \\<and> normalized_n_primitive (disc, sel) n m2)\" |\n  \"normalized_n_primitive _ _ (MatchNot (MatchAnd _ _)) = False\" |\n  (*\"normalized_n_primitive _ _ (MatchNot _) = True\" *)\n  \"normalized_n_primitive _ _ (MatchNot (MatchNot _)) = False\" | (*not nnf normalized*)\n  \"normalized_n_primitive _ _ (MatchNot MatchAny) = True\"\n\n\nlemma normalized_nnf_match_opt_MatchAny_match_expr:\n  \"normalized_nnf_match m \\<Longrightarrow> normalized_nnf_match (opt_MatchAny_match_expr m)\"\n  proof-\n  have \"normalized_nnf_match m \\<Longrightarrow> normalized_nnf_match (opt_MatchAny_match_expr_once m)\"\n  for m :: \"'a match_expr\"\n  by(induction m rule: opt_MatchAny_match_expr_once.induct) (simp_all)\n  thus \"normalized_nnf_match m \\<Longrightarrow> normalized_nnf_match (opt_MatchAny_match_expr m)\"\n    apply(simp add: opt_MatchAny_match_expr_def)\n    apply(induction rule: repeat_stabilize_induct)\n     by(simp)+\n  qed\n\nlemma normalized_n_primitive_opt_MatchAny_match_expr:\n  \"normalized_n_primitive disc_sel f m \\<Longrightarrow> normalized_n_primitive disc_sel f (opt_MatchAny_match_expr m)\"\n  proof-\n\n  have \"normalized_n_primitive disc_sel f m \\<Longrightarrow> normalized_n_primitive disc_sel f (opt_MatchAny_match_expr_once m)\"\n  for m\n    proof-\n    { fix disc::\"('a \\<Rightarrow> bool)\" and sel::\"('a \\<Rightarrow> 'b)\" and n m1 m2\n      have \"normalized_n_primitive (disc, sel) n (opt_MatchAny_match_expr_once m1) \\<Longrightarrow>\n           normalized_n_primitive (disc, sel) n (opt_MatchAny_match_expr_once m2) \\<Longrightarrow>\n           normalized_n_primitive (disc, sel) n m1 \\<and> normalized_n_primitive (disc, sel) n m2 \\<Longrightarrow>\n           normalized_n_primitive (disc, sel) n (opt_MatchAny_match_expr_once (MatchAnd m1 m2))\"\n    by(induction \"(MatchAnd m1 m2)\" rule: opt_MatchAny_match_expr_once.induct) (auto)\n    }note x=this\n    assume \"normalized_n_primitive disc_sel f m\"\n    thus ?thesis\n      apply(induction disc_sel f m rule: normalized_n_primitive.induct)\n            apply simp_all\n      using x by simp\n    qed\n  from this show\n    \"normalized_n_primitive disc_sel f m \\<Longrightarrow> normalized_n_primitive disc_sel f (opt_MatchAny_match_expr m)\"\n    apply(simp add: opt_MatchAny_match_expr_def)\n    apply(induction rule: repeat_stabilize_induct)\n     by(simp)+ \n  qed\n\n\nlemma normalized_n_primitive_imp_not_disc_negated:\n  \"wf_disc_sel (disc,sel) C \\<Longrightarrow> normalized_n_primitive (disc,sel) f m \\<Longrightarrow> \\<not> has_disc_negated disc False m\"\n  apply(induction \"(disc,sel)\" f m rule: normalized_n_primitive.induct)\n  by(simp add: wf_disc_sel.simps split: if_split_asm)+\n\nlemma normalized_n_primitive_alist_and: \"normalized_n_primitive disc_sel P (alist_and as) \\<longleftrightarrow>\n      (\\<forall> a \\<in> set as. normalized_n_primitive disc_sel P (negation_type_to_match_expr a))\"\n  proof(induction as)\n  case Nil thus ?case by simp\n  next\n  case (Cons a as) thus ?case\n    apply(cases disc_sel, cases a)\n    by(simp_all add: negation_type_to_match_expr_simps)\n  qed\n\nlemma normalized_n_primitive_alist_and': \"normalized_n_primitive disc_sel P (alist_and' as) \\<longleftrightarrow>\n      (\\<forall> a \\<in> set as. normalized_n_primitive disc_sel P (negation_type_to_match_expr a))\"\n  apply(cases disc_sel)\n  apply(induction as rule: alist_and'.induct)\n      by(simp_all add: negation_type_to_match_expr_simps)\n\nlemma not_has_disc_NegPos_map: \"\\<forall>a. \\<not> disc (C a) \\<Longrightarrow> \\<forall>a\\<in>set (NegPos_map C ls).\n        \\<not> has_disc disc (negation_type_to_match_expr a)\"\nby(induction C ls rule: NegPos_map.induct) (simp add: negation_type_to_match_expr_def)+\n\nlemma not_has_disc_negated_NegPos_map: \"\\<forall>a. \\<not> disc (C a) \\<Longrightarrow> \\<forall>a\\<in>set (NegPos_map C ls).\n        \\<not> has_disc_negated disc False (negation_type_to_match_expr a)\"\nby(induction C ls rule: NegPos_map.induct) (simp add: negation_type_to_match_expr_def)+\n\nlemma normalized_n_primitive_impossible_map: \"\\<forall>a. \\<not> disc (C a) \\<Longrightarrow>\n  \\<forall>m\\<in>set (map (Match \\<circ> (C \\<circ> x)) ls).\n     normalized_n_primitive (disc, sel) f m\"\n  apply(intro ballI)\n  apply(induction ls)\n   apply(simp; fail)\n  apply(simp)\n  apply(case_tac m, simp_all) (*3 cases are impossible*)\n   apply(fastforce)\n  by force\n\nlemma normalized_n_primitive_alist_and'_append:\n  \"normalized_n_primitive (disc, sel) f (alist_and' (ls1 @ ls2)) \\<longleftrightarrow>\n      normalized_n_primitive (disc, sel) f (alist_and' ls1) \\<and> normalized_n_primitive (disc, sel) f (alist_and' ls2)\"\napply(induction ls1 arbitrary: ls2 rule: alist_and'.induct)\n    apply(simp_all)\n apply(case_tac [!] ls2)\n   apply(simp_all)\ndone\n\nlemma normalized_n_primitive_if_no_primitive: \"normalized_nnf_match m \\<Longrightarrow> \\<not> has_disc disc m \\<Longrightarrow> \n       normalized_n_primitive (disc, sel) f m\"\n  by(induction \"(disc, sel)\" f m rule: normalized_n_primitive.induct) (simp)+\n\nlemma normalized_n_primitive_false_eq_notdisc: \"normalized_nnf_match m \\<Longrightarrow>\n  normalized_n_primitive (disc, sel) (\\<lambda>_. False) m \\<longleftrightarrow> \\<not> has_disc disc m\"\nproof -\n  have \"normalized_nnf_match m \\<Longrightarrow> false = (\\<lambda>_. False) \\<Longrightarrow>\n  \\<not> has_disc disc m \\<longleftrightarrow> normalized_n_primitive (disc, sel) false m\" for false\n  by(induction \"(disc, sel)\" false m rule: normalized_n_primitive.induct)\n  (simp)+\n  thus \"normalized_nnf_match m \\<Longrightarrow> ?thesis\" by simp\nqed\n\nlemma normalized_n_primitive_MatchAnd_combine_map: \"normalized_n_primitive disc_sel f rst \\<Longrightarrow>\n       \\<forall>m' \\<in> (\\<lambda>spt. Match (C spt)) ` set pts. normalized_n_primitive disc_sel f m' \\<Longrightarrow>\n        m' \\<in> (\\<lambda>spt. MatchAnd (Match (C spt)) rst) ` set pts \\<Longrightarrow> normalized_n_primitive disc_sel f m'\"\n  by(induction disc_sel f m' rule: normalized_n_primitive.induct)\n     fastforce+\n\nsubsection\\<open>Primitive Extractor\\<close>\n\ntext\\<open>\n  The following function takes a tuple of functions (@{typ \"(('a \\<Rightarrow> bool) \\<times> ('a \\<Rightarrow> 'b))\"}) and a @{typ \"'a match_expr\"}.\n  The passed function tuple must be the discriminator and selector of the datatype package.\n  @{text primitive_extractor} filters the @{typ \"'a match_expr\"} and returns a tuple.\n  The first element of the returned tuple is the filtered primitive matches, the second element is the remaining match expression.\n\n  It requires a @{const normalized_nnf_match}.\n\\<close>\nfun primitive_extractor :: \"(('a \\<Rightarrow> bool) \\<times> ('a \\<Rightarrow> 'b)) \\<Rightarrow> 'a match_expr \\<Rightarrow> ('b negation_type list \\<times> 'a match_expr)\" where\n \"primitive_extractor _ MatchAny = ([], MatchAny)\" |\n \"primitive_extractor (disc,sel) (Match a) = (if disc a then ([Pos (sel a)], MatchAny) else ([], Match a))\" |\n \"primitive_extractor (disc,sel) (MatchNot (Match a)) = (if disc a then ([Neg (sel a)], MatchAny) else ([], MatchNot (Match a)))\" |\n \"primitive_extractor C (MatchAnd ms1 ms2) = (\n        let (a1', ms1') = primitive_extractor C ms1; \n            (a2', ms2') = primitive_extractor C ms2\n        in (a1'@a2', MatchAnd ms1' ms2'))\" |\n \"primitive_extractor _ _ = undefined\"\n\ntext\\<open>\n  The first part returned by @{const primitive_extractor}, here @{text as}:\n    A list of primitive match expressions.\n    For example, let @{text \"m = MatchAnd (Src ip1) (Dst ip2)\"} then, using the src @{text \"(disc, sel)\"}, the result is @{text \"[ip1]\"}.\n    Note that @{text Src} is stripped from the result.\n\n    The second part, here @{text ms} is the match expression which was not extracted.\n\n    Together, the first and second part match iff @{text m} matches.\n\\<close>\n\n\n(*unused*)\nlemma primitive_extractor_fst_simp2:\n  fixes m'::\"'a match_expr \\<Rightarrow> 'a match_expr \\<Rightarrow> 'a match_expr\"\n  shows \"fst (case primitive_extractor (disc, sel) m1 of (a1', ms1') \\<Rightarrow> case primitive_extractor (disc, sel) m2 of (a2', ms2') \\<Rightarrow> (a1' @ a2', m' ms1' ms2')) =\n           fst (primitive_extractor (disc, sel) m1) @ fst (primitive_extractor (disc, sel) m2)\"\n      apply(cases \"primitive_extractor (disc, sel) m1\", simp)\n      apply(cases \"primitive_extractor (disc, sel) m2\", simp)\n      done\n\ntheorem primitive_extractor_correct: assumes \n  \"normalized_nnf_match m\" and \"wf_disc_sel (disc, sel) C\" and \"primitive_extractor (disc, sel) m = (as, ms)\" \n  shows \"matches \\<gamma> (alist_and (NegPos_map C as)) a p \\<and> matches \\<gamma> ms a p \\<longleftrightarrow> matches \\<gamma> m a p\"\n  and \"normalized_nnf_match ms\"\n  and \"\\<not> has_disc disc ms\"\n  and \"\\<forall>disc2. \\<not> has_disc disc2 m \\<longrightarrow> \\<not> has_disc disc2 ms\"\n  and \"\\<forall>disc2 sel2. normalized_n_primitive (disc2, sel2) P m \\<longrightarrow> normalized_n_primitive (disc2, sel2) P ms\"\n  and \"\\<forall>disc2. \\<not> has_disc_negated disc2 neg m \\<longrightarrow> \\<not> has_disc_negated disc2 neg ms\"\n  and \"\\<not> has_disc disc m \\<longleftrightarrow> as = [] \\<and> ms = m\"\n  and \"\\<not> has_disc_negated disc False m \\<longleftrightarrow> getNeg as = []\"\n  and \"has_disc disc m \\<Longrightarrow> as \\<noteq> []\"\nproof -\n  --\"better simplification rule\"\n  from assms have assm3': \"(as, ms) = primitive_extractor (disc, sel) m\" by simp\n  with assms(1) assms(2) show \"matches \\<gamma> (alist_and (NegPos_map C as)) a p \\<and> matches \\<gamma> ms a p \\<longleftrightarrow> matches \\<gamma> m a p\"\n    proof(induction \"(disc, sel)\" m  arbitrary: as ms rule: primitive_extractor.induct)\n    case 4 thus ?case\n      apply(simp split: if_split_asm prod.split_asm add: NegPos_map_append)\n      apply(auto simp add: alist_and_append bunch_of_lemmata_about_matches)\n      done\n    qed(simp_all add: bunch_of_lemmata_about_matches wf_disc_sel.simps split: if_split_asm)\n\n  from assms(1) assm3' show \"normalized_nnf_match ms\"\n    proof(induction \"(disc, sel)\" m  arbitrary: as ms rule: primitive_extractor.induct)\n         case 2 thus ?case by(simp split: if_split_asm)\n         next\n         case 3 thus ?case by(simp split: if_split_asm)\n         next\n         case 4 thus ?case \n           apply(clarify) (*if i don't clarify, the simplifier loops*)\n           apply(simp split: prod.split_asm)\n           done\n    qed(simp_all)\n\n  from assms(1) assm3' show \"\\<not> has_disc disc ms\"\n    proof(induction \"(disc, sel)\" m  arbitrary: as ms rule: primitive_extractor.induct)\n    qed(simp_all split: if_split_asm prod.split_asm)\n\n\n  from assms(1) assm3' show \"\\<forall>disc2. \\<not> has_disc disc2 m \\<longrightarrow> \\<not> has_disc disc2 ms\"\n    proof(induction \"(disc, sel)\" m  arbitrary: as ms rule: primitive_extractor.induct)\n         case 2 thus ?case by(simp split: if_split_asm)\n         next\n         case 3 thus ?case by(simp split: if_split_asm)\n         next\n         case 4 thus ?case by(simp split: prod.split_asm)\n    qed(simp_all)\n\n\n  from assms(1) assm3' show \"\\<forall>disc2. \\<not> has_disc_negated disc2 neg m \\<longrightarrow> \\<not> has_disc_negated disc2 neg ms\"\n    proof(induction \"(disc, sel)\" m  arbitrary: as ms rule: primitive_extractor.induct)\n         case 2 thus ?case by(simp split: if_split_asm)\n         next\n         case 3 thus ?case by(simp split: if_split_asm)\n         next\n         case 4 thus ?case by(simp split: prod.split_asm)\n    qed(simp_all)\n\n\n  from assms(1) assm3' show \"\\<forall>disc2 sel2. normalized_n_primitive (disc2, sel2) P m \\<longrightarrow> normalized_n_primitive (disc2, sel2) P ms\"\n    apply(induction \"(disc, sel)\" m  arbitrary: as ms rule: primitive_extractor.induct)\n          apply(simp)\n         apply(simp split: if_split_asm)\n        apply(simp split: if_split_asm)\n       apply(simp split: prod.split_asm)\n      apply(simp_all)\n    done\n\n   from assms(1) assm3' show \"\\<not> has_disc disc m \\<longleftrightarrow> as = [] \\<and> ms = m\"\n    proof(induction \"(disc, sel)\" m  arbitrary: as ms rule: primitive_extractor.induct)\n    case 2 thus ?case by(simp split: if_split_asm)\n    next\n    case 3 thus ?case by(simp split: if_split_asm)\n    next\n    case 4 thus ?case by(auto split: prod.split_asm)\n    qed(simp_all)\n\n   from assms(1) assm3' show \"\\<not> has_disc_negated disc False m \\<longleftrightarrow> getNeg as = []\"\n    proof(induction \"(disc, sel)\" m  arbitrary: as ms rule: primitive_extractor.induct)\n    case 2 thus ?case by(simp split: if_split_asm)\n    next\n    case 3 thus ?case by(simp split: if_split_asm)\n    next\n    case 4 thus ?case by(simp add: getNeg_append split: prod.split_asm)\n    qed(simp_all)\n\n   from assms(1) assm3' show \"has_disc disc m \\<Longrightarrow> as \\<noteq> []\"\n    proof(induction \"(disc, sel)\" m  arbitrary: as ms rule: primitive_extractor.induct)\n    case 4 thus ?case apply(simp split: prod.split_asm)\n      by metis\n    qed(simp_all)\nqed\n\n\nlemma has_disc_negated_primitive_extractor:\n  assumes \"normalized_nnf_match m\"\n  shows \"has_disc_negated disc False m \\<longleftrightarrow> (\\<exists>a. Neg a \\<in> set (fst (primitive_extractor (disc, sel) m)))\"\nproof -\n  obtain as ms where asms: \"primitive_extractor (disc, sel) m = (as, ms)\" by fastforce\n  hence \"has_disc_negated disc False m \\<longleftrightarrow> (\\<exists>a. Neg a \\<in> set as)\"\n    using assms proof(induction m arbitrary: as ms)\n    case Match thus ?case\n       by(simp split: if_split_asm) fastforce\n    next\n    case (MatchNot m)\n      thus ?case\n      proof(induction m)\n      case Match thus ?case by (simp, fastforce)\n      qed(simp_all)\n    next\n    case (MatchAnd m1 m2) thus ?case\n      apply(cases \"primitive_extractor (disc, sel) m1\")\n      apply(cases \"primitive_extractor (disc, sel) m2\")\n      by auto\n  qed(simp_all split: if_split_asm)\n  thus ?thesis using asms by simp\nqed\n\n\n\n(*if i extract something and put it together again unchanged, things do not change*)\nlemma primitive_extractor_reassemble_preserves:\n  \"wf_disc_sel (disc, sel) C \\<Longrightarrow>\n   normalized_nnf_match m \\<Longrightarrow>\n   P m \\<Longrightarrow>\n   P MatchAny \\<Longrightarrow>\n   primitive_extractor (disc, sel) m = (as, ms) \\<Longrightarrow> (*turn eqality around to simplify proof*)\n   (\\<And>m1 m2. P (MatchAnd m1 m2) \\<longleftrightarrow> P m1 \\<and> P m2) \\<Longrightarrow>\n   (\\<And>ls1 ls2. P (alist_and' (ls1 @ ls2)) \\<longleftrightarrow> P (alist_and' ls1) \\<and> P (alist_and' ls2)) \\<Longrightarrow>\n   P (alist_and' (NegPos_map C as))\"\n  proof(induction \"(disc, sel)\" m  arbitrary: as ms rule: primitive_extractor.induct)\n  case 2 thus ?case\n    apply(simp split: if_split_asm)\n    apply(clarify)\n    by(simp add: wf_disc_sel.simps)\n  next\n  case 3 thus ?case\n    apply(simp split: if_split_asm)\n    apply(clarify)\n    by(simp add: wf_disc_sel.simps)\n  next\n  case (4 m1 m2 as ms)\n    from 4 show ?case\n      apply(simp)\n      apply(simp split: prod.split_asm)\n      apply(clarify)\n      apply(simp add: NegPos_map_append)\n    done\nqed(simp_all split: if_split_asm)\n\nlemma primitive_extractor_reassemble_not_has_disc:\n  \"wf_disc_sel (disc, sel) C \\<Longrightarrow>\n   normalized_nnf_match m \\<Longrightarrow> \\<not> has_disc disc' m \\<Longrightarrow>\n   primitive_extractor (disc, sel) m = (as, ms) \\<Longrightarrow>\n     \\<not> has_disc disc' (alist_and' (NegPos_map C as))\"\n  apply(rule primitive_extractor_reassemble_preserves)\n        by(simp_all add: NegPos_map_append has_disc_alist_and'_append)\n\nlemma primitive_extractor_reassemble_not_has_disc_negated:\n  \"wf_disc_sel (disc, sel) C \\<Longrightarrow>\n   normalized_nnf_match m \\<Longrightarrow> \\<not> has_disc_negated disc' neg m \\<Longrightarrow>\n   primitive_extractor (disc, sel) m = (as, ms) \\<Longrightarrow> \n     \\<not> has_disc_negated disc' neg (alist_and' (NegPos_map C as))\"\n  apply(rule primitive_extractor_reassemble_preserves)\n        by(simp_all add: NegPos_map_append has_disc_negated_alist_and'_append)\n\nlemma primitive_extractor_reassemble_normalized_n_primitive:\n  \"wf_disc_sel (disc, sel) C \\<Longrightarrow>\n   normalized_nnf_match m \\<Longrightarrow> normalized_n_primitive (disc1, sel1) f m \\<Longrightarrow>\n   primitive_extractor (disc, sel) m = (as, ms) \\<Longrightarrow>\n     normalized_n_primitive (disc1, sel1) f (alist_and' (NegPos_map C as))\"\n  apply(rule primitive_extractor_reassemble_preserves)\n        by(simp_all add: NegPos_map_append normalized_n_primitive_alist_and'_append)\n\n\n\nlemma primitive_extractor_matchesE: \"wf_disc_sel (disc,sel) C \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> primitive_extractor (disc, sel) m = (as, ms)\n  \\<Longrightarrow>\n  (normalized_nnf_match ms \\<Longrightarrow> \\<not> has_disc disc ms \\<Longrightarrow> (\\<forall>disc2. \\<not> has_disc disc2 m \\<longrightarrow> \\<not> has_disc disc2 ms) \\<Longrightarrow> matches_other \\<longleftrightarrow>  matches \\<gamma> ms a p)\n  \\<Longrightarrow>\n  matches \\<gamma> (alist_and (NegPos_map C as)) a p \\<and> matches_other \\<longleftrightarrow>  matches \\<gamma> m a p\"\nusing primitive_extractor_correct(1,2,3,4) by metis\n\nlemma primitive_extractor_matches_lastE: \"wf_disc_sel (disc,sel) C \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> primitive_extractor (disc, sel) m = (as, ms)\n  \\<Longrightarrow>\n  (normalized_nnf_match ms \\<Longrightarrow> \\<not> has_disc disc ms \\<Longrightarrow> (\\<forall>disc2. \\<not> has_disc disc2 m \\<longrightarrow> \\<not> has_disc disc2 ms) \\<Longrightarrow> matches \\<gamma> ms a p)\n  \\<Longrightarrow>\n  matches \\<gamma> (alist_and (NegPos_map C as)) a p  \\<longleftrightarrow>  matches \\<gamma> m a p\"\nusing primitive_extractor_correct(1,2,3,4) by metis\n\ntext\\<open>The lemmas @{thm primitive_extractor_matchesE} and @{thm primitive_extractor_matches_lastE} can be used as\n  erule to solve goals about consecutive application of @{const primitive_extractor}.\n  They should be used as @{text \"primitive_extractor_matchesE[OF wf_disc_sel_for_first_extracted_thing]\"}.\n\\<close>\n\n\n\nsubsection\\<open>Normalizing and Optimizing Primitives\\<close>\n  text\\<open>\n    Normalize primitives by a function @{text f} with type @{typ \"'b negation_type list \\<Rightarrow> 'b list\"}.\n    @{typ \"'b\"} is a primitive type, e.g. ipt-ipv4range.\n    @{text f} takes a conjunction list of negated primitives and must compress them such that:\n    \\begin{enumerate}\n      \\item no negation occurs in the output\n      \\item the output is a disjunction of the primitives, i.e. multiple primitives in one rule are compressed to at most one primitive (leading to multiple rules)\n    \\end{enumerate}\n    Example with IP addresses:\n    \\begin{verbatim}\n      f [10.8.0.0/16, 10.0.0.0/8] = [10.0.0.0/8]  f compresses to one range\n      f [10.0.0.0, 192.168.0.01] = []    range is empty, rule can be dropped\n      f [Neg 41] = [{0..40}, {42..ipv4max}]   one rule is translated into multiple rules to translate negation\n      f [Neg 41, {20..50}, {30..50}] = [{30..40}, {42..50}]   input: conjunction list, output disjunction list!\n    \\end{verbatim}\n\\<close>\n  definition normalize_primitive_extract :: \"(('a \\<Rightarrow> bool) \\<times> ('a \\<Rightarrow> 'b)) \\<Rightarrow>\n                               ('b \\<Rightarrow> 'a) \\<Rightarrow>\n                               ('b negation_type list \\<Rightarrow> 'b list) \\<Rightarrow>\n                               'a match_expr \\<Rightarrow> \n                               'a match_expr list\" where \n    \"normalize_primitive_extract (disc_sel) C f m \\<equiv> (case primitive_extractor (disc_sel) m \n                of (spts, rst) \\<Rightarrow> map (\\<lambda>spt. (MatchAnd (Match (C spt))) rst) (f spts))\"\n  \n                (*if f spts is empty, we get back an empty list. *)\n  \n  text\\<open>\n    If @{text f} has the properties described above, then @{const normalize_primitive_extract} is a valid transformation of a match expression\\<close>\n  lemma normalize_primitive_extract: assumes \"normalized_nnf_match m\" and \"wf_disc_sel disc_sel C\" and\n        \"\\<forall>ml. (match_list \\<gamma> (map (Match \\<circ> C) (f ml)) a p \\<longleftrightarrow> matches \\<gamma> (alist_and (NegPos_map C ml)) a p)\"\n        shows \"match_list \\<gamma> (normalize_primitive_extract disc_sel C f m) a p \\<longleftrightarrow> matches \\<gamma> m a p\"\n    proof -\n      obtain as ms where pe: \"primitive_extractor disc_sel m = (as, ms)\" by fastforce\n\n      from pe primitive_extractor_correct(1)[OF assms(1), where \\<gamma>=\\<gamma> and  a=a and p=p] assms(2) have \n        \"matches \\<gamma> m a p \\<longleftrightarrow> matches \\<gamma> (alist_and (NegPos_map C as)) a p \\<and> matches \\<gamma> ms a p\" by(cases disc_sel, blast)\n      also have \"\\<dots> \\<longleftrightarrow> match_list \\<gamma> (map (Match \\<circ> C) (f as)) a p \\<and> matches \\<gamma> ms a p\" using assms(3) by simp\n      also have \"\\<dots> \\<longleftrightarrow> match_list \\<gamma> (map (\\<lambda>spt. MatchAnd (Match (C spt)) ms) (f as)) a p\"\n        by(simp add: match_list_matches bunch_of_lemmata_about_matches)\n      also have \"... \\<longleftrightarrow> match_list \\<gamma> (normalize_primitive_extract disc_sel C f m) a p\"\n        by(simp add: normalize_primitive_extract_def pe) \n      finally show ?thesis by simp\n    qed\n\n  thm match_list_semantics[of \\<gamma> \"(map (Match \\<circ> C) (f ml))\" a p \"[(alist_and (NegPos_map C ml))]\"]\n\n  corollary normalize_primitive_extract_semantics:  assumes \"normalized_nnf_match m\" and \"wf_disc_sel disc_sel C\" and\n        \"\\<forall>ml. (match_list \\<gamma> (map (Match \\<circ> C) (f ml)) a p \\<longleftrightarrow> matches \\<gamma> (alist_and (NegPos_map C ml)) a p)\"\n        shows \"approximating_bigstep_fun \\<gamma> p (map (\\<lambda>m. Rule m a) (normalize_primitive_extract disc_sel C f m)) s = \n              approximating_bigstep_fun \\<gamma> p [Rule m a] s\"\n  proof -\n    from normalize_primitive_extract[OF assms(1) assms(2) assms(3)] have\n      \"match_list \\<gamma> (normalize_primitive_extract disc_sel C f m) a p = matches \\<gamma> m a p\" .\n    also have \"\\<dots> \\<longleftrightarrow> match_list \\<gamma> [m] a p\" by simp\n    finally show ?thesis using match_list_semantics[of \\<gamma> \"(normalize_primitive_extract disc_sel C f m)\" a p \"[m]\"] by simp\n  qed\n\n\n  lemma normalize_primitive_extract_preserves_nnf_normalized:\n  assumes \"normalized_nnf_match m\"\n      and \"wf_disc_sel (disc, sel) C\"\n    shows \"\\<forall>mn \\<in> set (normalize_primitive_extract (disc, sel) C f m). normalized_nnf_match mn\"\n    proof\n      fix mn\n      assume assm2: \"mn \\<in> set (normalize_primitive_extract (disc, sel) C f m)\"\n      obtain as ms where as_ms: \"primitive_extractor (disc, sel) m = (as, ms)\" by fastforce\n      from primitive_extractor_correct(2)[OF assms(1) assms(2) as_ms] have \"normalized_nnf_match ms\" by simp\n      from assm2 as_ms have normalize_primitive_extract_unfolded: \"mn \\<in> ((\\<lambda>spt. MatchAnd (Match (C spt)) ms) ` set (f as))\"\n        unfolding normalize_primitive_extract_def by force\n      with \\<open>normalized_nnf_match ms\\<close> show \"normalized_nnf_match mn\" by fastforce\n    qed\n\n  lemma normalize_rules_primitive_extract_preserves_nnf_normalized:\n    \"\\<forall>r \\<in> set rs. normalized_nnf_match (get_match r) \\<Longrightarrow> wf_disc_sel disc_sel C \\<Longrightarrow>\n     \\<forall>r \\<in> set (normalize_rules (normalize_primitive_extract disc_sel C f) rs). normalized_nnf_match (get_match r)\"\n  apply(rule normalize_rules_preserves[where P=\"normalized_nnf_match\" and f=\"(normalize_primitive_extract disc_sel C f)\"])\n   apply(simp; fail)\n  apply(cases disc_sel)\n  using normalize_primitive_extract_preserves_nnf_normalized by fast\n\n  text\\<open>If something is normalized for disc2 and disc2 @{text \\<noteq>} disc1 and we do something on disc1, then disc2 remains normalized\\<close>\n  lemma normalize_primitive_extract_preserves_unrelated_normalized_n_primitive:\n  assumes \"normalized_nnf_match m\"\n      and \"normalized_n_primitive (disc2, sel2) P m\"\n      and \"wf_disc_sel (disc1, sel1) C\"\n      and \"\\<forall>a. \\<not> disc2 (C a)\" --\\<open>disc1 and disc2 match for different stuff. e.g. @{text Src_Ports} and @{text Dst_Ports}\\<close>\n    shows \"\\<forall>mn \\<in> set (normalize_primitive_extract (disc1, sel1) C f m). normalized_n_primitive (disc2, sel2) P mn\"\n    proof\n      fix mn\n      assume assm2: \"mn \\<in> set (normalize_primitive_extract (disc1, sel1) C f m)\"\n      obtain as ms where as_ms: \"primitive_extractor (disc1, sel1) m = (as, ms)\" by fastforce\n      from as_ms primitive_extractor_correct[OF assms(1) assms(3)] have \n                      \"\\<not> has_disc disc1 ms\"\n                  and \"normalized_n_primitive (disc2, sel2) P ms\"\n        apply -\n        apply(fast)\n        using assms(2) by(fast)\n      from assm2 as_ms have normalize_primitive_extract_unfolded: \"mn \\<in> ((\\<lambda>spt. MatchAnd (Match (C spt)) ms) ` set (f as))\"\n        unfolding normalize_primitive_extract_def by force\n      \n      from normalize_primitive_extract_unfolded obtain Casms where Casms: \"mn = (MatchAnd (Match (C Casms)) ms)\" by blast\n\n      from \\<open>normalized_n_primitive (disc2, sel2) P ms\\<close> assms(4) have \"normalized_n_primitive (disc2, sel2) P (MatchAnd (Match (C Casms)) ms)\"\n        by(simp)\n\n      with Casms show \"normalized_n_primitive (disc2, sel2) P mn\" by blast\n    qed\n\n  \n  lemma normalize_primitive_extract_normalizes_n_primitive:\n  fixes disc::\"('a \\<Rightarrow> bool)\" and sel::\"('a \\<Rightarrow> 'b)\" and f::\"('b negation_type list \\<Rightarrow> 'b list)\"\n  assumes \"normalized_nnf_match m\"\n      and \"wf_disc_sel (disc, sel) C\"\n      and np: \"\\<forall>as. (\\<forall> a' \\<in> set (f as). P a')\" (*not quite, sel f   \\<forall>as \\<in> {x. disc (v x)}. *)\n    shows \"\\<forall>m' \\<in> set (normalize_primitive_extract (disc, sel) C f m). normalized_n_primitive (disc, sel) P m'\"\n    proof\n    fix m' assume a: \"m'\\<in>set (normalize_primitive_extract (disc, sel) C f m)\"\n\n    have nnf: \"\\<forall>m' \\<in> set (normalize_primitive_extract (disc, sel) C f m). normalized_nnf_match m'\"\n      using normalize_primitive_extract_preserves_nnf_normalized assms by blast\n    with a have normalized_m': \"normalized_nnf_match m'\" by simp\n\n    from a obtain as ms where as_ms: \"primitive_extractor (disc, sel) m = (as, ms)\"\n      unfolding normalize_primitive_extract_def by fastforce\n    with a have prems: \"m' \\<in> set (map (\\<lambda>spt. MatchAnd (Match (C spt)) ms) (f as))\"\n      unfolding normalize_primitive_extract_def by simp\n\n\n    from primitive_extractor_correct(2)[OF assms(1) assms(2) as_ms] have \"normalized_nnf_match ms\" .\n    \n    show \"normalized_n_primitive (disc, sel) P m'\"\n    proof(cases \"f as = []\")\n    case True thus \"normalized_n_primitive (disc, sel) P m'\" using prems by simp\n    next\n    case False\n      with prems obtain spt where \"m' = MatchAnd (Match (C spt)) ms\" and \"spt \\<in> set (f as)\" by auto\n\n      from primitive_extractor_correct(3)[OF assms(1) assms(2) as_ms] have \"\\<not> has_disc disc ms\" .\n      with \\<open>normalized_nnf_match ms\\<close> have \"normalized_n_primitive (disc, sel) P ms\"\n        by(induction \"(disc, sel)\" P ms rule: normalized_n_primitive.induct) simp_all\n\n      from \\<open>wf_disc_sel (disc, sel) C\\<close> have \"(sel (C spt)) = spt\" by(simp add: wf_disc_sel.simps)\n      with np \\<open>spt \\<in> set (f as)\\<close> have \"P (sel (C spt))\" by simp\n\n      show \"normalized_n_primitive (disc, sel) P m'\"\n      apply(simp add: \\<open>m' = MatchAnd (Match (C spt)) ms\\<close>)\n      apply(rule conjI)\n       apply(simp_all add: \\<open>normalized_n_primitive (disc, sel) P ms\\<close>)\n      apply(simp add: \\<open>P (sel (C spt))\\<close>)\n      done\n    qed\n  qed\n\n lemma primitive_extractor_negation_type_matching1:\n    assumes wf: \"wf_disc_sel (disc, sel) C\"\n        and normalized: \"normalized_nnf_match m\"\n        and a1: \"primitive_extractor (disc, sel) m = (as, rest)\"\n        and a2: \"matches \\<gamma> m a p\"\n    shows \"(\\<forall>m\\<in>set (map C (getPos as)). matches \\<gamma> (Match m) a p) \\<and> \n           (\\<forall>m\\<in>set (map C (getNeg as)). matches \\<gamma> (MatchNot (Match m)) a p)\"\n  proof -\n      from primitive_extractor_correct(1)[OF normalized wf a1] a2 have\n        \"matches \\<gamma> (alist_and (NegPos_map C as)) a p \\<and> matches \\<gamma> rest a p\" by fast\n      hence \"matches \\<gamma> (alist_and (NegPos_map C as)) a p\" by blast\n      with Negation_Type_Matching.matches_alist_and have\n        \"(\\<forall>m\\<in>set (getPos (NegPos_map C as)). matches \\<gamma> (Match m) a p) \\<and> \n         (\\<forall>m\\<in>set (getNeg (NegPos_map C as)). matches \\<gamma> (MatchNot (Match m)) a p)\" by metis\n      with getPos_NegPos_map_simp2 getNeg_NegPos_map_simp2 show ?thesis by metis\n  qed\n\n\ntext\\<open>@{const normalized_n_primitive} does NOT imply @{const normalized_nnf_match}\\<close>\nlemma \"\\<exists>m. normalized_n_primitive disc_sel f m \\<longrightarrow> \\<not> normalized_nnf_match m\"\n  by(rule_tac x=\"MatchNot MatchAny\" in exI) (simp)\n\n\nlemma remove_unknowns_generic_not_has_disc: \"\\<not> has_disc C m \\<Longrightarrow> \\<not> has_disc C (remove_unknowns_generic \\<gamma> a m)\"\n  by(induction \\<gamma> a m rule: remove_unknowns_generic.induct) (simp_all add: remove_unknowns_generic_simps2)\n\nlemma remove_unknowns_generic_not_has_disc_negated: \"\\<not> has_disc_negated C neg m \\<Longrightarrow> \\<not> has_disc_negated C neg (remove_unknowns_generic \\<gamma> a m)\"\n  by(induction \\<gamma> a m rule: remove_unknowns_generic.induct) (simp_all add: remove_unknowns_generic_simps2)\n\nlemma remove_unknowns_generic_normalized_n_primitive: \"normalized_n_primitive disc_sel f m \\<Longrightarrow> \n    normalized_n_primitive disc_sel f (remove_unknowns_generic \\<gamma> a m)\"\n  proof(induction \\<gamma> a m rule: remove_unknowns_generic.induct)\n    case 6 thus ?case by(case_tac disc_sel, simp add: remove_unknowns_generic_simps2)\n  qed(simp_all add: remove_unknowns_generic_simps2)\n\n\n\nlemma normalize_match_preserves_disc_negated: \n    shows \"(\\<exists>m_DNF \\<in> set (normalize_match m). has_disc_negated disc neg m_DNF) \\<Longrightarrow> has_disc_negated disc neg m\"\n  proof(induction m rule: normalize_match.induct)\n  case 3 thus ?case by (simp) blast\n  next\n  case 4\n    from 4 show ?case by(simp) blast\n  qed(simp_all)\ntext\\<open>@{const has_disc_negated} is a structural property and @{const normalize_match} is a semantical property.\n  @{const normalize_match} removes subexpressions which cannot match. Thus, we cannot show (without complicated assumptions)\n  the opposite direction of @{thm normalize_match_preserves_disc_negated}, because a negated primitive\n  might occur in a subexpression which will be optimized away.\\<close>\n\n\ncorollary i_m_giving_this_a_funny_name_so_i_can_thank_my_future_me_when_sledgehammer_will_find_this_one_day:\n  \"\\<not> has_disc_negated disc neg m \\<Longrightarrow> \\<forall> m_DNF \\<in> set (normalize_match m). \\<not> has_disc_negated disc neg m_DNF\"\nusing normalize_match_preserves_disc_negated by blast\n\n\nlemma not_has_disc_opt_MatchAny_match_expr:\n  \"\\<not> has_disc disc m \\<Longrightarrow> \\<not> has_disc disc (opt_MatchAny_match_expr m)\"\n  proof -\n    have \"\\<not> has_disc disc m \\<Longrightarrow> \\<not> has_disc disc (opt_MatchAny_match_expr_once m)\" for m\n    by(induction m rule: opt_MatchAny_match_expr_once.induct) simp_all\n  thus \"\\<not> has_disc disc m \\<Longrightarrow> \\<not> has_disc disc (opt_MatchAny_match_expr m)\"\n    apply(simp add: opt_MatchAny_match_expr_def)\n    apply(rule repeat_stabilize_induct)\n     by(simp)+\n  qed\nlemma not_has_disc_negated_opt_MatchAny_match_expr:\n  \"\\<not> has_disc_negated disc neg m \\<Longrightarrow> \\<not> has_disc_negated disc neg (opt_MatchAny_match_expr m)\"\n  proof -\n    have \"\\<not> has_disc_negated disc neg m \\<Longrightarrow> \\<not> has_disc_negated disc neg (opt_MatchAny_match_expr_once m)\"\n    for m\n    by(induction m arbitrary: neg rule:opt_MatchAny_match_expr_once.induct) (simp_all)\n  thus \"\\<not> has_disc_negated disc neg m \\<Longrightarrow> \\<not> has_disc_negated disc neg (opt_MatchAny_match_expr m)\"\n    apply(simp add: opt_MatchAny_match_expr_def)\n    apply(rule repeat_stabilize_induct)\n     by(simp)+\n  qed\n\nlemma normalize_match_preserves_nodisc:\n  \"\\<not> has_disc disc m \\<Longrightarrow> m' \\<in> set (normalize_match m) \\<Longrightarrow> \\<not> has_disc disc m'\"\n  proof - \n    (*no idea why this statement is necessary*)\n    have \"\\<not> has_disc disc m \\<longrightarrow> (\\<forall>m' \\<in> set (normalize_match m). \\<not> has_disc disc m')\"\n    by(induction m rule: normalize_match.induct) (safe,auto) --\"need safe, otherwise simplifier loops\"\n  thus \"\\<not> has_disc disc m \\<Longrightarrow> m' \\<in> set (normalize_match m) \\<Longrightarrow> \\<not> has_disc disc m'\" by blast\nqed\n\nlemma not_has_disc_normalize_match:\n  \"\\<not> has_disc_negated disc neg  m \\<Longrightarrow> m' \\<in> set (normalize_match m) \\<Longrightarrow> \\<not> has_disc_negated disc neg m'\"\n  using i_m_giving_this_a_funny_name_so_i_can_thank_my_future_me_when_sledgehammer_will_find_this_one_day by blast\n\nlemma normalize_match_preserves_normalized_n_primitive:\n  \"normalized_n_primitive disc_sel f rst \\<Longrightarrow>\n        \\<forall> m \\<in> set (normalize_match rst). normalized_n_primitive disc_sel f m\"\napply(cases disc_sel, simp)\napply(induction rst rule: normalize_match.induct)\n      apply(simp; fail)\n     apply(simp; fail)\n    apply(simp; fail)\n   using normalized_n_primitive.simps(5) apply metis (*simp loops*)\n  by simp+\n\n\n\n\nsubsection\\<open>Optimizing a match expression\\<close>\n\n  text\\<open>Optimizes a match expression with a function that takes @{typ \"'b negation_type list\"}\n  and returns @{typ \"('b list \\<times> 'b list) option\"}.\n  The function should return @{const None} if the match expression cannot match.\n  It returns @{term \"Some (as_pos, as_neg)\"} where @{term as_pos} and @{term as_neg} are lists of\n  primitives. Positive and Negated.\n  The result is one match expression.\n\n  In contrast @{const normalize_primitive_extract} returns a list of match expression, to be read es their disjunction.\\<close>\n\n  definition compress_normalize_primitive :: \"(('a \\<Rightarrow> bool) \\<times> ('a \\<Rightarrow> 'b)) \\<Rightarrow> ('b \\<Rightarrow> 'a) \\<Rightarrow>\n                                              ('b negation_type list \\<Rightarrow> ('b list \\<times> 'b list) option) \\<Rightarrow> \n                                              'a match_expr \\<Rightarrow> 'a match_expr option\" where \n    \"compress_normalize_primitive disc_sel C f m \\<equiv> (case primitive_extractor disc_sel m of (as, rst) \\<Rightarrow>\n      (map_option (\\<lambda>(as_pos, as_neg). MatchAnd\n                                       (alist_and' (NegPos_map C ((map Pos as_pos)@(map Neg as_neg))))\n                                       rst\n                  ) (f as)))\"\n\n\n\n  lemma compress_normalize_primitive_nnf: \"wf_disc_sel disc_sel C \\<Longrightarrow> \n      normalized_nnf_match m \\<Longrightarrow> compress_normalize_primitive disc_sel C f m = Some m' \\<Longrightarrow>\n    normalized_nnf_match m'\"\n    apply(case_tac \"primitive_extractor disc_sel m\")\n    apply(simp add: compress_normalize_primitive_def)\n    apply(clarify)\n    apply (simp add: normalized_nnf_match_alist_and')\n    apply(cases disc_sel, simp)\n    using primitive_extractor_correct(2) by blast\n\n\n  lemma compress_normalize_primitive_not_introduces_C:\n    assumes notdisc: \"\\<not> has_disc disc m\"\n        and wf: \"wf_disc_sel (disc,sel) C'\" (*C is allowed to be different from C'*)\n        and nm: \"normalized_nnf_match m\"\n        and some: \"compress_normalize_primitive (disc,sel) C f m = Some m'\"\n        and f_preserves: \"\\<And>as_pos as_neg. f [] = Some (as_pos, as_neg) \\<Longrightarrow> as_pos = [] \\<and> as_neg = []\"\n     shows \"\\<not> has_disc disc m'\"\n   proof -\n        obtain as ms where asms: \"primitive_extractor (disc, sel) m = (as, ms)\" by fastforce\n        from notdisc primitive_extractor_correct(4)[OF nm wf asms] have 1: \"\\<not> has_disc disc ms\" by simp\n        from notdisc primitive_extractor_correct(7)[OF nm wf asms] have 2: \"as = [] \\<and> ms = m\" by simp\n        from 1 2 some show ?thesis by(auto dest: f_preserves simp add: compress_normalize_primitive_def asms)\n   qed\n\n  lemma compress_normalize_primitive_not_introduces_C_negated:\n    assumes notdisc: \"\\<not> has_disc_negated disc False m\"\n        and wf: \"wf_disc_sel (disc,sel) C\"\n        and nm: \"normalized_nnf_match m\"\n        and some: \"compress_normalize_primitive (disc,sel) C f m = Some m'\"\n        and f_preserves: \"\\<And>as as_pos as_neg. f as = Some (as_pos, as_neg) \\<Longrightarrow> getNeg as = [] \\<Longrightarrow> as_neg = []\"\n     shows \"\\<not> has_disc_negated disc False m'\"\n   proof -\n        obtain as ms where asms: \"primitive_extractor (disc,sel) m = (as, ms)\" by fastforce\n        from notdisc primitive_extractor_correct(6)[OF nm wf asms] have 1: \"\\<not> has_disc_negated disc False ms\" by simp\n        from asms notdisc has_disc_negated_primitive_extractor[OF nm, where disc=disc and sel=sel] have\n          \"\\<forall>a. Neg a \\<notin> set as\" by(simp)\n        hence \"getNeg as = []\" by (meson NegPos_set(5) image_subset_iff last_in_set)\n        with f_preserves have f_preserves': \"\\<And>as_pos as_neg. f as = Some (as_pos, as_neg) \\<Longrightarrow> as_neg = []\" by simp\n        from 1 have \"\\<And> a b.\\<not> has_disc_negated disc False (MatchAnd (alist_and' (NegPos_map C (map Pos a))) ms)\"\n          by(simp add: has_disc_negated_alist_and' NegPos_map_map_Pos negation_type_to_match_expr_simps)\n        with some show ?thesis by(auto dest: f_preserves' simp add: compress_normalize_primitive_def asms)\n   qed\n\n\n\n\n  lemma compress_normalize_primitive_Some:\n  assumes normalized: \"normalized_nnf_match m\"\n      and wf: \"wf_disc_sel (disc,sel) C\"\n      and some: \"compress_normalize_primitive (disc,sel) C f m = Some m'\"\n      and f_correct: \"\\<And>as as_pos as_neg. f as = Some (as_pos, as_neg) \\<Longrightarrow>\n            matches \\<gamma> (alist_and (NegPos_map C ((map Pos as_pos)@(map Neg as_neg)))) a p \\<longleftrightarrow>\n            matches \\<gamma> (alist_and (NegPos_map C as)) a p\"\n    shows \"matches \\<gamma> m' a p \\<longleftrightarrow> matches \\<gamma> m a p\"\n    using some\n    apply(simp add: compress_normalize_primitive_def)\n    apply(case_tac \"primitive_extractor (disc,sel) m\")\n    apply(rename_tac as rst, simp)\n    apply(drule primitive_extractor_correct(1)[OF normalized wf, where \\<gamma>=\\<gamma> and a=a and p=p])\n    apply(elim exE conjE)\n    apply(drule f_correct)\n    by (meson matches_alist_and_alist_and' bunch_of_lemmata_about_matches(1))\n    \n\n  lemma compress_normalize_primitive_None:\n  assumes normalized: \"normalized_nnf_match m\"\n      and wf: \"wf_disc_sel (disc,sel) C\"\n      and none: \"compress_normalize_primitive (disc,sel) C f m = None\"\n      and f_correct: \"\\<And>as. f as = None \\<Longrightarrow> \\<not> matches \\<gamma> (alist_and (NegPos_map C as)) a p\"\n    shows \"\\<not> matches \\<gamma> m a p\"\n    using none\n    apply(simp add: compress_normalize_primitive_def)\n    apply(case_tac \"primitive_extractor (disc, sel) m\")\n    apply(auto dest: primitive_extractor_correct(1)[OF assms(1) wf] f_correct)\n    done\n\n\n\n  (* only for arbitrary discs that do not match C*)\n  lemma compress_normalize_primitive_hasdisc:\n    assumes am: \"\\<not> has_disc disc2 m\"\n        and wf: \"wf_disc_sel (disc,sel) C\"\n        and disc: \"(\\<forall>a. \\<not> disc2 (C a))\"\n        and nm: \"normalized_nnf_match m\"\n        and some: \"compress_normalize_primitive (disc,sel) C f m = Some m'\"\n     shows \"normalized_nnf_match m' \\<and> \\<not> has_disc disc2 m'\"\n   proof -\n        from compress_normalize_primitive_nnf[OF wf nm some] have goal1: \"normalized_nnf_match m'\" .\n        obtain as ms where asms: \"primitive_extractor (disc, sel) m = (as, ms)\" by fastforce\n        from am primitive_extractor_correct(4)[OF nm wf asms] have 1: \"\\<not> has_disc disc2 ms\" by simp\n        { fix is_pos is_neg\n          from disc have x1: \"\\<not> has_disc disc2 (alist_and' (NegPos_map C (map Pos is_pos)))\"\n            by(simp add: has_disc_alist_and' NegPos_map_map_Pos negation_type_to_match_expr_simps)\n          from disc have x2: \"\\<not> has_disc disc2 (alist_and' (NegPos_map C (map Neg is_neg)))\"\n            by(simp add: has_disc_alist_and' NegPos_map_map_Neg negation_type_to_match_expr_simps)\n          from x1 x2 have \"\\<not> has_disc disc2 (alist_and' (NegPos_map C (map Pos is_pos @ map Neg is_neg)))\"\n            apply(simp add: NegPos_map_append has_disc_alist_and') by blast\n        }\n        with some have \"\\<not> has_disc disc2 m'\"\n          apply(simp add: compress_normalize_primitive_def asms)\n          apply(elim exE conjE)\n          using 1 by fastforce\n        with goal1 show ?thesis by simp\n   qed\n  lemma compress_normalize_primitive_hasdisc_negated:\n    assumes am: \"\\<not> has_disc_negated disc2 neg m\"\n        and wf: \"wf_disc_sel (disc,sel) C\"\n        and disc: \"(\\<forall>a. \\<not> disc2 (C a))\"\n        and nm: \"normalized_nnf_match m\"\n        and some: \"compress_normalize_primitive (disc,sel) C f m = Some m'\"\n     shows \"normalized_nnf_match m' \\<and> \\<not> has_disc_negated disc2 neg m'\"\n   proof -\n        from compress_normalize_primitive_nnf[OF wf nm some] have goal1: \"normalized_nnf_match m'\" .\n        obtain as ms where asms: \"primitive_extractor (disc, sel) m = (as, ms)\" by fastforce\n        from am primitive_extractor_correct(6)[OF nm wf asms] have 1: \"\\<not> has_disc_negated disc2 neg ms\" by simp\n        { fix is_pos is_neg\n          from disc have x1: \"\\<not> has_disc_negated disc2 neg (alist_and' (NegPos_map C (map Pos is_pos)))\"\n            by(simp add: has_disc_negated_alist_and' NegPos_map_map_Pos negation_type_to_match_expr_simps)\n          from disc have x2: \"\\<not> has_disc_negated disc2 neg (alist_and' (NegPos_map C (map Neg is_neg)))\"\n            by(simp add: has_disc_negated_alist_and' NegPos_map_map_Neg negation_type_to_match_expr_simps)\n          from x1 x2 have \"\\<not> has_disc_negated disc2 neg (alist_and' (NegPos_map C (map Pos is_pos @ map Neg is_neg)))\"\n            apply(simp add: NegPos_map_append has_disc_negated_alist_and') by blast\n        }\n        with some have \"\\<not> has_disc_negated disc2 neg m'\"\n          apply(simp add: compress_normalize_primitive_def asms)\n          apply(elim exE conjE)\n          using 1 by fastforce\n          \n        with goal1 show ?thesis by simp\n   qed\n\n\n  thm normalize_primitive_extract_preserves_unrelated_normalized_n_primitive (*is similar*)\n  lemma compress_normalize_primitve_preserves_normalized_n_primitive:\n    assumes am: \"normalized_n_primitive (disc2, sel2) P m\"\n        and wf: \"wf_disc_sel (disc,sel) C\"\n        and disc: \"(\\<forall>a. \\<not> disc2 (C a))\"\n        and nm: \"normalized_nnf_match m\"\n        and some: \"compress_normalize_primitive (disc,sel) C f m = Some m'\"\n     shows \"normalized_nnf_match m' \\<and> normalized_n_primitive (disc2, sel2) P m'\"\n   proof -\n        from compress_normalize_primitive_nnf[OF wf nm some] have goal1: \"normalized_nnf_match m'\" .\n        obtain as ms where asms: \"primitive_extractor (disc, sel) m = (as, ms)\" by fastforce\n        from am primitive_extractor_correct[OF nm wf asms] have 1: \"normalized_n_primitive (disc2, sel2) P ms\" by fast\n        { fix iss\n          from disc have \"normalized_n_primitive (disc2, sel2) P (alist_and (NegPos_map C iss))\"\n            apply(induction iss)\n             apply(simp_all)\n            apply(rename_tac i iss, case_tac i)\n             apply(simp_all)\n            done\n        }\n        with some have \"normalized_n_primitive (disc2, sel2) P m'\"\n          apply(simp add: compress_normalize_primitive_def asms)\n          apply(elim exE conjE)\n          using 1 normalized_n_primitive_alist_and' normalized_n_primitive_alist_and\n                 normalized_n_primitive.simps(4) by blast \n        with goal1 show ?thesis by simp\n   qed\n\n\n\nsubsection\\<open>Processing a list of normalization functions\\<close>\n\nfun compress_normalize_primitive_monad :: \"('a match_expr \\<Rightarrow> 'a match_expr option) list \\<Rightarrow> 'a match_expr \\<Rightarrow> 'a match_expr option\" where\n  \"compress_normalize_primitive_monad [] m = Some m\" |\n  \"compress_normalize_primitive_monad (f#fs) m = (case f m of None \\<Rightarrow> None\n                                                           |  Some m' \\<Rightarrow> compress_normalize_primitive_monad fs m')\"\n\nlemma compress_normalize_primitive_monad: \n      assumes \"\\<And>m m' f. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = Some m' \\<Longrightarrow> matches \\<gamma> m' a p \\<longleftrightarrow> matches \\<gamma> m a p\"\n          and \"\\<And>m m' f. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = Some m' \\<Longrightarrow> normalized_nnf_match m'\"\n          and \"normalized_nnf_match m\"\n          and \"(compress_normalize_primitive_monad fs m) = Some m'\"\n      shows \"matches \\<gamma> m' a p \\<longleftrightarrow> matches \\<gamma> m a p\" (is ?goal1)\n        and \"normalized_nnf_match m'\"              (is ?goal2)\n  proof -\n    (*everything in one big induction*)\n    have goals: \"?goal1 \\<and> ?goal2\"\n    using assms proof(induction fs arbitrary: m)\n    case Nil thus ?case by simp\n    next\n    case (Cons f fs)\n      from Cons.prems(1) have IH_prem1:\n        \"(\\<And>f m m'. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = Some m' \\<Longrightarrow> matches \\<gamma> m' a p = matches \\<gamma> m a p)\" by auto\n      from Cons.prems(2) have IH_prem2:\n        \"(\\<And>f m m'. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = Some m' \\<Longrightarrow> normalized_nnf_match m')\" by auto\n      from Cons.IH IH_prem1 IH_prem2 have\n        IH: \"\\<And>m. normalized_nnf_match m \\<Longrightarrow> compress_normalize_primitive_monad fs m = Some m' \\<Longrightarrow>\n                  (matches \\<gamma> m' a p \\<longleftrightarrow> matches \\<gamma> m a p) \\<and> ?goal2\" by fast\n      show ?case\n        proof(cases \"f m\")\n          case None thus ?thesis using Cons.prems by auto\n        next\n          case(Some m'')\n            from Some Cons.prems(1)[of f] Cons.prems(3) have 1: \"matches \\<gamma> m'' a p = matches \\<gamma> m a p\" by simp\n            from Some Cons.prems(2)[of f] Cons.prems(3) have 2: \"normalized_nnf_match m''\" by simp\n            from Some have \"compress_normalize_primitive_monad (f # fs) m = compress_normalize_primitive_monad fs m''\" by simp\n            thus ?thesis using Cons.prems(4) IH 1 2 by auto \n        qed\n    qed\n    from goals show ?goal1 by simp\n    from goals show ?goal2 by simp\n  qed\n\n(*proof is a bit sledgehammered*)\nlemma compress_normalize_primitive_monad_None: \n      assumes \"\\<And>m m' f. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = Some m' \\<Longrightarrow> matches \\<gamma> m' a p \\<longleftrightarrow> matches \\<gamma> m a p\"\n          and \"\\<And>m f. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = None \\<Longrightarrow> \\<not> matches \\<gamma> m a p\"\n          and \"\\<And>m m' f. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = Some m' \\<Longrightarrow> normalized_nnf_match m'\"\n          and \"normalized_nnf_match m\"\n          and \"(compress_normalize_primitive_monad fs m) = None\"\n      shows \"\\<not> matches \\<gamma> m a p\"\n    using assms proof(induction fs arbitrary: m)\n    case Nil thus ?case by simp\n    next\n    case (Cons f fs)\n      from Cons.prems(1) have IH_prem1:\n        \"(\\<And>f m m'. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = Some m' \\<Longrightarrow> matches \\<gamma> m' a p = matches \\<gamma> m a p)\" by auto\n      from Cons.prems(2) have IH_prem2:\n        \"(\\<And>f m m'. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = None \\<Longrightarrow> \\<not> matches \\<gamma> m a p)\" by auto\n      from Cons.prems(3) have IH_prem3:\n        \"(\\<And>f m m'. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = Some m' \\<Longrightarrow> normalized_nnf_match m')\" by auto\n      from Cons.IH IH_prem1 IH_prem2 IH_prem3 have\n        IH: \"\\<And>m. normalized_nnf_match m \\<Longrightarrow> compress_normalize_primitive_monad fs m = None \\<Longrightarrow> \\<not>  matches \\<gamma> m a p\" by blast\n      show ?case\n        proof(cases \"f m\")\n          case None thus ?thesis using Cons.prems(4) Cons.prems(2) Cons.prems(3) by auto\n        next\n          case(Some m'')\n            from Some Cons.prems(3)[of f] Cons.prems(4) have 2: \"normalized_nnf_match m''\" by simp\n            from Some have \"compress_normalize_primitive_monad (f # fs) m = compress_normalize_primitive_monad fs m''\" by simp\n            hence \"\\<not> matches \\<gamma> m'' a p\" using Cons.prems(5) IH 2 by simp\n            thus ?thesis using Cons.prems(1) Cons.prems(4) Some by auto \n        qed\n    qed\n\n\nlemma compress_normalize_primitive_monad_preserves:\n      assumes \"\\<And>m m' f. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> f m = Some m' \\<Longrightarrow> normalized_nnf_match m'\"\n          and \"\\<And>m m' f. f \\<in> set fs \\<Longrightarrow> normalized_nnf_match m \\<Longrightarrow> P m \\<Longrightarrow> f m = Some m' \\<Longrightarrow> P m'\"\n          and \"normalized_nnf_match m\"\n          and \"P m\"\n          and \"(compress_normalize_primitive_monad fs m) = Some m'\"\n      shows \"normalized_nnf_match m' \\<and> P m'\"\n    using assms proof(induction fs arbitrary: m)\n    case Nil thus ?case by simp\n    next\n    case (Cons f fs) thus ?case by(simp split: option.split_asm) blast (*1s*)\n    qed\n\n\n\n\n(*TODO: move to generic place and use? ? ? *)\ndatatype 'a match_compress = CannotMatch | MatchesAll | MatchExpr 'a\n\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Semantics_Ternary/Primitive_Normalization.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.343098936222237}}
{"text": "(*  Title:      HOL/HOLCF/Library/List_Predomain.thy\n    Author:     Brian Huffman\n*)\n\nsection \\<open>Predomain class instance for HOL list type\\<close>\n\ntheory List_Predomain\nimports List_Cpo Sum_Cpo\nbegin\n\nsubsection \\<open>Strict list type\\<close>\n\ndomain 'a slist = SNil | SCons \"'a\" \"'a slist\"\n\ntext \\<open>Polymorphic map function for strict lists.\\<close>\n\ntext \\<open>FIXME: The domain package should generate this!\\<close>\n\nfixrec slist_map' :: \"('a \\<rightarrow> 'b) \\<rightarrow> 'a slist \\<rightarrow> 'b slist\"\n  where \"slist_map'\\<cdot>f\\<cdot>SNil = SNil\"\n  | \"\\<lbrakk>x \\<noteq> \\<bottom>; xs \\<noteq> \\<bottom>\\<rbrakk> \\<Longrightarrow>\n      slist_map'\\<cdot>f\\<cdot>(SCons\\<cdot>x\\<cdot>xs) = SCons\\<cdot>(f\\<cdot>x)\\<cdot>(slist_map'\\<cdot>f\\<cdot>xs)\"\n\nlemma slist_map'_strict [simp]: \"slist_map'\\<cdot>f\\<cdot>\\<bottom> = \\<bottom>\"\nby fixrec_simp\n\nlemma slist_map_conv [simp]: \"slist_map = slist_map'\"\napply (rule cfun_eqI, rule cfun_eqI, rename_tac f xs)\napply (induct_tac xs, simp_all)\napply (subst slist_map_unfold, simp)\napply (subst slist_map_unfold, simp add: SNil_def)\napply (subst slist_map_unfold, simp add: SCons_def)\ndone\n\nlemma slist_map'_slist_map':\n  \"f\\<cdot>\\<bottom> = \\<bottom> \\<Longrightarrow> slist_map'\\<cdot>f\\<cdot>(slist_map'\\<cdot>g\\<cdot>xs) = slist_map'\\<cdot>(\\<Lambda> x. f\\<cdot>(g\\<cdot>x))\\<cdot>xs\"\napply (induct xs, simp, simp)\napply (case_tac \"g\\<cdot>a = \\<bottom>\", simp, simp)\napply (case_tac \"slist_map'\\<cdot>g\\<cdot>xs = \\<bottom>\", simp, simp)\ndone\n\nlemma slist_map'_oo:\n  \"f\\<cdot>\\<bottom> = \\<bottom> \\<Longrightarrow> slist_map'\\<cdot>(f oo g) = slist_map'\\<cdot>f oo slist_map'\\<cdot>g\"\nby (simp add: cfcomp1 slist_map'_slist_map' eta_cfun)\n\nlemma slist_map'_ID: \"slist_map'\\<cdot>ID = ID\"\nby (rule cfun_eqI, induct_tac x, simp_all)\n\nlemma ep_pair_slist_map':\n  \"ep_pair e p \\<Longrightarrow> ep_pair (slist_map'\\<cdot>e) (slist_map'\\<cdot>p)\"\napply (rule ep_pair.intro)\napply (subst slist_map'_slist_map')\napply (erule pcpo_ep_pair.p_strict [unfolded pcpo_ep_pair_def])\napply (simp add: ep_pair.e_inverse ID_def [symmetric] slist_map'_ID)\napply (subst slist_map'_slist_map')\napply (erule pcpo_ep_pair.e_strict [unfolded pcpo_ep_pair_def])\napply (rule below_eq_trans [OF _ ID1])\napply (subst slist_map'_ID [symmetric])\napply (intro monofun_cfun below_refl)\napply (simp add: cfun_below_iff ep_pair.e_p_below)\ndone\n\ntext \\<open>\n  Types \\<^typ>\\<open>'a list u\\<close>. and \\<^typ>\\<open>'a u slist\\<close> are isomorphic.\n\\<close>\n\nfixrec encode_list_u where\n  \"encode_list_u\\<cdot>(up\\<cdot>[]) = SNil\" |\n  \"encode_list_u\\<cdot>(up\\<cdot>(x # xs)) = SCons\\<cdot>(up\\<cdot>x)\\<cdot>(encode_list_u\\<cdot>(up\\<cdot>xs))\"\n\nlemma encode_list_u_strict [simp]: \"encode_list_u\\<cdot>\\<bottom> = \\<bottom>\"\nby fixrec_simp\n\nlemma encode_list_u_bottom_iff [simp]:\n  \"encode_list_u\\<cdot>x = \\<bottom> \\<longleftrightarrow> x = \\<bottom>\"\napply (induct x, simp_all)\napply (rename_tac xs, induct_tac xs, simp_all)\ndone\n\nfixrec decode_list_u where\n  \"decode_list_u\\<cdot>SNil = up\\<cdot>[]\" |\n  \"ys \\<noteq> \\<bottom> \\<Longrightarrow> decode_list_u\\<cdot>(SCons\\<cdot>(up\\<cdot>x)\\<cdot>ys) =\n    (case decode_list_u\\<cdot>ys of up\\<cdot>xs \\<Rightarrow> up\\<cdot>(x # xs))\"\n\nlemma decode_list_u_strict [simp]: \"decode_list_u\\<cdot>\\<bottom> = \\<bottom>\"\nby fixrec_simp\n\nlemma decode_encode_list_u [simp]: \"decode_list_u\\<cdot>(encode_list_u\\<cdot>x) = x\"\nby (induct x, simp, rename_tac xs, induct_tac xs, simp_all)\n\nlemma encode_decode_list_u [simp]: \"encode_list_u\\<cdot>(decode_list_u\\<cdot>y) = y\"\napply (induct y, simp, simp)\napply (case_tac a, simp)\napply (case_tac \"decode_list_u\\<cdot>y\", simp, simp)\ndone\n\nsubsection \\<open>Lists are a predomain\\<close>\n\ndefinition list_liftdefl :: \"udom u defl \\<rightarrow> udom u defl\"\n  where \"list_liftdefl = (\\<Lambda> a. udefl\\<cdot>(slist_defl\\<cdot>(u_liftdefl\\<cdot>a)))\"\n\nlemma cast_slist_defl: \"cast\\<cdot>(slist_defl\\<cdot>a) = emb oo slist_map\\<cdot>(cast\\<cdot>a) oo prj\"\nusing isodefl_slist [where fa=\"cast\\<cdot>a\" and da=\"a\"]\nunfolding isodefl_def by simp\n\ninstantiation list :: (predomain) predomain\nbegin\n\ndefinition\n  \"liftemb = (strictify\\<cdot>up oo emb oo slist_map'\\<cdot>u_emb) oo slist_map'\\<cdot>liftemb oo encode_list_u\"\n\ndefinition\n  \"liftprj = (decode_list_u oo slist_map'\\<cdot>liftprj) oo (slist_map'\\<cdot>u_prj oo prj) oo fup\\<cdot>ID\"\n\ndefinition\n  \"liftdefl (t::('a list) itself) = list_liftdefl\\<cdot>LIFTDEFL('a)\"\n\ninstance proof\n  show \"ep_pair liftemb (liftprj :: udom u \\<rightarrow> ('a list) u)\"\n    unfolding liftemb_list_def liftprj_list_def\n    by (intro ep_pair_comp ep_pair_slist_map' ep_pair_strictify_up\n      ep_pair_emb_prj predomain_ep ep_pair_u, simp add: ep_pair.intro)\n  show \"cast\\<cdot>LIFTDEFL('a list) = liftemb oo (liftprj :: udom u \\<rightarrow> ('a list) u)\"\n    unfolding liftemb_list_def liftprj_list_def liftdefl_list_def\n    apply (simp add: list_liftdefl_def cast_udefl cast_slist_defl cast_u_liftdefl cast_liftdefl)\n    apply (simp add: slist_map'_oo u_emb_bottom cfun_eq_iff)\n    done\nqed\n\nend\n\nsubsection \\<open>Configuring domain package to work with list type\\<close>\n\nlemma liftdefl_list [domain_defl_simps]:\n  \"LIFTDEFL('a::predomain list) = list_liftdefl\\<cdot>LIFTDEFL('a)\"\nby (rule liftdefl_list_def)\n\nabbreviation list_map :: \"('a::cpo \\<rightarrow> 'b::cpo) \\<Rightarrow> 'a list \\<rightarrow> 'b list\"\n  where \"list_map f \\<equiv> Abs_cfun (map (Rep_cfun f))\"\n\nlemma list_map_ID [domain_map_ID]: \"list_map ID = ID\"\nby (simp add: ID_def)\n\nlemma deflation_list_map [domain_deflation]:\n  \"deflation d \\<Longrightarrow> deflation (list_map d)\"\napply standard\napply (induct_tac x, simp_all add: deflation.idem)\napply (induct_tac x, simp_all add: deflation.below)\ndone\n\nlemma encode_list_u_map:\n  \"encode_list_u\\<cdot>(u_map\\<cdot>(list_map f)\\<cdot>(decode_list_u\\<cdot>xs))\n    = slist_map\\<cdot>(u_map\\<cdot>f)\\<cdot>xs\"\napply (induct xs, simp, simp)\napply (case_tac a, simp, rename_tac b)\napply (case_tac \"decode_list_u\\<cdot>xs\")\napply (drule_tac f=\"encode_list_u\" in cfun_arg_cong, simp, simp)\ndone\n\nlemma isodefl_list_u [domain_isodefl]:\n  fixes d :: \"'a::predomain \\<rightarrow> 'a\"\n  assumes \"isodefl' d t\"\n  shows \"isodefl' (list_map d) (list_liftdefl\\<cdot>t)\"\nusing assms unfolding isodefl'_def liftemb_list_def liftprj_list_def\napply (simp add: list_liftdefl_def cast_udefl cast_slist_defl cast_u_liftdefl)\napply (simp add: cfcomp1 encode_list_u_map)\napply (simp add: slist_map'_slist_map' u_emb_bottom)\ndone\n\nsetup \\<open>\n  Domain_Take_Proofs.add_rec_type (\\<^type_name>\\<open>list\\<close>, [true])\n\\<close>\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/Library/List_Predomain.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.6187804337438502, "lm_q1q2_score": 0.3430954748063675}}
{"text": "section {* WebAssembly Core AST *}\n\ntheory Wasm_Ast\n  imports\n    Main\n    \"HOL-Library.Word\"\n    \"Word_Lib.Reversed_Bit_Lists\"\nbegin\n\ntype_synonym \\<comment> \\<open>immediate\\<close>\n  i = nat\ntype_synonym \\<comment> \\<open>static offset\\<close>\n  off = nat\ntype_synonym \\<comment> \\<open>alignment exponent\\<close>\n  a = nat\n\n\\<comment> \\<open>primitive types\\<close>\ntypedef i32 = \"UNIV :: (32 word) set\" ..\ntypedef i64 = \"UNIV :: (64 word) set\" ..\ntypedecl f32\ntypedecl f64\n\nsetup_lifting type_definition_i32\ndeclare Quotient_i32[transfer_rule]\nsetup_lifting type_definition_i64\ndeclare Quotient_i64[transfer_rule]\n\n\\<comment> \\<open>memory\\<close>\n(* type_synonym byte = \"8 word\" *)\ntypedef byte = \"UNIV :: (8 word) set\" ..\nsetup_lifting type_definition_byte\ndeclare Quotient_byte[transfer_rule]\n\n(* For some reason this lemma does get automatically generated *)\nlemmas[code] = Abs_byte_inverse[simplified]\n\nlift_definition msb_byte :: \"byte \\<Rightarrow> bool\" is msb .\nlift_definition zero_byte :: \"byte\" is 0 .\nlift_definition negone_byte :: \"byte\" is \"max_word\" .\n\nlift_definition nat_of_byte :: \"byte \\<Rightarrow> nat\" is \"unat\" .\nlift_definition byte_of_nat :: \"nat \\<Rightarrow> byte\" is \"of_nat\" .\n\ntype_synonym bytes = \"byte list\"\n\ndefinition bytes_takefill :: \"byte \\<Rightarrow> nat \\<Rightarrow> bytes \\<Rightarrow> bytes\" where\n  \"bytes_takefill = (\\<lambda>(a::byte) n as. takefill a n as)\"\n\ndefinition bytes_replicate :: \"nat \\<Rightarrow> byte \\<Rightarrow> bytes\" where\n  \"bytes_replicate = (\\<lambda>n (b::byte). replicate n b)\"\n\ndefinition msbyte :: \"bytes \\<Rightarrow> byte\" where\n  \"msbyte bs = last (bs)\"\n\nrecord limit_t =\n  l_min :: nat\n  l_max :: \"nat option\"\n\nfree_constructors case_limit_t_ext for limit_t_ext\n  using limit_t.cases_scheme\n  by blast+\n\ntype_synonym tab_t = \\<comment> \\<open>table type\\<close>\n  \"limit_t\"\n\ntype_synonym mem_t = \\<comment> \\<open>memory type\\<close>\n  \"limit_t\"\n\ndefinition Ki64 :: \"nat\" where\n  \"Ki64 = 65536\"\n\ntypedef mem_rep = \"UNIV :: (byte list) set\" ..\nsetup_lifting type_definition_mem_rep\ndeclare Quotient_mem_rep[transfer_rule]\n\ntype_synonym mem = \"(mem_rep \\<times> nat option)\"\n\nlift_definition mem_rep_mk :: \"nat \\<Rightarrow> mem_rep\" is \"(\\<lambda>n. (bytes_replicate (n * Ki64) zero_byte))\" .\ndefinition mem_mk :: \"limit_t \\<Rightarrow> mem\" where\n  \"mem_mk lim = (mem_rep_mk (l_min lim), l_max lim)\"\n\nlift_definition mem_rep_byte_at :: \"mem_rep \\<Rightarrow> nat \\<Rightarrow> byte\" is \"(\\<lambda>m n. m!n)::(byte list) \\<Rightarrow> nat \\<Rightarrow> byte\" .\ndefinition byte_at :: \"mem \\<Rightarrow> nat \\<Rightarrow> byte\" where\n  \"byte_at m n = mem_rep_byte_at (fst m) n\"\n\nlift_definition mem_rep_length :: \"mem_rep \\<Rightarrow> nat\" is \"(\\<lambda>m. length m)\" .\ndefinition mem_length :: \"mem \\<Rightarrow> nat\" where\n  \"mem_length m = mem_rep_length (fst m)\"\n\ndefinition mem_max :: \"mem \\<Rightarrow> nat option\" where\n  \"mem_max m = snd m\"\n\nlift_definition mem_rep_read_bytes :: \"mem_rep \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bytes\" is \"(\\<lambda>m n l. (take l (drop n m))::(byte list))\" .\ndefinition read_bytes :: \"mem \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bytes\" where\n  \"read_bytes m n l = mem_rep_read_bytes (fst m) n l\"\n\nlift_definition mem_rep_write_bytes :: \"mem_rep \\<Rightarrow> nat \\<Rightarrow> bytes \\<Rightarrow> mem_rep\" is \"(\\<lambda>m n bs. ((take n m) @ bs @ (drop (n + length bs) m)) :: byte list)\" .\ndefinition write_bytes :: \"mem \\<Rightarrow> nat \\<Rightarrow> bytes \\<Rightarrow> mem\" where\n  \"write_bytes m n bs = (mem_rep_write_bytes (fst m) n bs, snd m)\"\n\nlift_definition mem_rep_append :: \"mem_rep \\<Rightarrow> nat \\<Rightarrow> byte \\<Rightarrow> mem_rep\" is \"(\\<lambda>m n b. (append m (replicate n b))::byte list)\" .\ndefinition mem_append :: \"mem \\<Rightarrow> nat \\<Rightarrow> byte \\<Rightarrow> mem\" where\n  \"mem_append m n b = (mem_rep_append (fst m) n b, snd m)\"\n\nlemma take_drop_map:\n  assumes \"ind+n \\<le> length bs\"\n  shows \"(take n (drop ind bs)) = (map ((!) bs) [ind..<ind + n])\"\nproof -\n  have \"(drop ind bs) = (map ((!) bs) [ind..<length bs])\"\n    using drop_map map_nth\n    by (metis add.commute add.right_neutral drop_upt)\n  thus ?thesis\n    by (simp add: assms(1) take_map)\nqed\n\nlemma read_bytes_map:\n  assumes \"ind+n \\<le> mem_length m\"\n  shows \"read_bytes m ind n = (map (\\<lambda>k. byte_at m k) [ind..<ind+n])\"\n  using assms\n  unfolding read_bytes_def mem_rep_read_bytes_def mem_rep_byte_at_def\n            byte_at_def mem_length_def mem_rep_length_def\n  by (simp add: take_drop_map split: prod.splits)\n\n\\<comment> \\<open>host\\<close>\ntypedecl host\ntypedecl host_state\n\ndatatype \\<comment> \\<open>value types\\<close>\n  t = T_i32 | T_i64 | T_f32 | T_f64\n\ndatatype \\<comment> \\<open>packed types\\<close>\n  tp = Tp_i8 | Tp_i16 | Tp_i32\n\ndatatype \\<comment> \\<open>mutability\\<close>\n  mut = T_immut | T_mut\n\nrecord tg = \\<comment> \\<open>global types\\<close>\n  tg_mut :: mut\n  tg_t :: t\n\nfree_constructors case_tg_ext for tg_ext\n  using tg.cases_scheme\n  by blast+\n\ndatatype \\<comment> \\<open>function types\\<close>\n  tf = Tf \"t list\" \"t list\" (\"_ '_> _\" 60)\n\n(* TYPING *)\nrecord t_context =\n  types_t :: \"tf list\"\n  func_t :: \"tf list\"\n  global :: \"tg list\"\n  table :: \"tab_t list\"\n  memory :: \"mem_t list\"\n  local :: \"t list\"\n  label :: \"(t list) list\"\n  return :: \"(t list) option\"\n\ndatatype\n  sx = S | U\n\ndatatype\n  unop_i = Clz | Ctz | Popcnt\n\ndatatype\n  unop_f = Neg | Abs | Ceil | Floor | Trunc | Nearest | Sqrt\n\ndatatype\n  unop = Unop_i unop_i | Unop_f unop_f\n\ndatatype\n  binop_i = Add | Sub | Mul | Div sx | Rem sx | And | Or | Xor | Shl | Shr sx | Rotl | Rotr\n\ndatatype\n  binop_f = Addf | Subf | Mulf | Divf | Min | Max | Copysign\n\ndatatype\n  binop = Binop_i binop_i | Binop_f binop_f\n  \ndatatype\n  testop = Eqz\n  \ndatatype\n  relop_i = Eq | Ne | Lt sx | Gt sx | Le sx | Ge sx\n  \ndatatype\n  relop_f = Eqf | Nef | Ltf | Gtf | Lef | Gef\n\ndatatype\n  relop = Relop_i relop_i | Relop_f relop_f\n\n  \ndatatype\n  cvtop = Convert | Reinterpret\n\ndatatype \\<comment> \\<open>values\\<close>\n  v =\n    ConstInt32 i32\n    | ConstInt64 i64\n    | ConstFloat32 f32\n    | ConstFloat64 f64\n\ndatatype \\<comment> \\<open>basic instructions\\<close>\n  b_e =\n    Unreachable\n    | Nop\n    | Drop\n    | Select\n    | Block tf \"b_e list\"\n    | Loop tf \"b_e list\"\n    | If tf \"b_e list\" \"b_e list\"\n    | Br i\n    | Br_if i\n    | Br_table \"i list\" i\n    | Return\n    | Call i\n    | Call_indirect i\n    | Get_local i\n    | Set_local i\n    | Tee_local i\n    | Get_global i\n    | Set_global i\n    | Load t \"(tp \\<times> sx) option\" a off\n    | Store t \"tp option\" a off\n    | Current_memory\n    | Grow_memory\n    | EConst v (\"C _\" 60)\n    | Unop t unop\n    | Binop t binop\n    | Testop t testop\n    | Relop t relop\n    | Cvtop t cvtop t \"sx option\"\n\nrecord inst = \\<comment> \\<open>instances\\<close>\n  types :: \"tf list\"\n  funcs :: \"i list\"\n  tabs :: \"i list\"\n  mems :: \"i list\"\n  globs :: \"i list\"\n\ndatatype cl = \\<comment> \\<open>function closures\\<close>\n  Func_native inst tf \"t list\" \"b_e list\"\n| Func_host tf host\n\ntype_synonym tabinst = \"(i option) list \\<times> nat option\"\n\nabbreviation \"tab_size (t::tabinst) \\<equiv> length (fst t)\"\nabbreviation \"tab_max (t::tabinst) \\<equiv> snd t\"\n\nrecord global =\n  g_mut :: mut\n  g_val :: v\n\nrecord s = \\<comment> \\<open>store\\<close>\n  funcs :: \"cl list\"\n  tabs :: \"tabinst list\"\n  mems :: \"mem list\"\n  globs :: \"global list\"\n\nrecord f = \\<comment> \\<open>frame\\<close>\n  f_locs :: \"v list\"\n  f_inst :: inst\n\ndatatype e = \\<comment> \\<open>administrative instruction\\<close>\n  Basic b_e (\"$_\" 60)\n  | Trap\n  | Invoke i\n  | Label nat \"e list\" \"e list\"\n  | Frame nat f \"e list\"\n\ndatatype Lholed =\n    \\<comment> \\<open>L0 = v* [<hole>] e*\\<close>\n    LBase \"v list\" \"e list\"\n    \\<comment> \\<open>L(i+1) = v* (label n {e* } Li) e*\\<close>\n    | LRec \"v list\" nat \"e list\" Lholed \"e list\"\n\nend\n", "meta": {"author": "WasmCert", "repo": "WasmCert-Isabelle", "sha": "f61ec8eab5d551347a268e858e83b7ac7da0d8b5", "save_path": "github-repos/isabelle/WasmCert-WasmCert-Isabelle", "path": "github-repos/isabelle/WasmCert-WasmCert-Isabelle/WasmCert-Isabelle-f61ec8eab5d551347a268e858e83b7ac7da0d8b5/WebAssembly/Wasm_Ast.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804196836383, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3430954670103952}}
{"text": "(*  Title:       Kill\n    Authors:     Jasmin Blanchette, Andrei Popescu, Dmitriy Traytel\n    Maintainer:  Dmitriy Traytel <traytel at inf.ethz.ch>\n*)\n\nsection \\<open>Removing Live Variables\\<close>\n\n(*<*)\ntheory Kill\n  imports \"HOL-Library.BNF_Axiomatization\"\nbegin\n(*>*)\n\nunbundle cardinal_syntax\n\ndeclare [[bnf_internals]]\nbnf_axiomatization (dead 'p, Fset1: 'a1, Fset2: 'a2, Fset3: 'a3) F for map: Fmap rel: Frel\n\nabbreviation F1map :: \"('a2 \\<Rightarrow> 'b2) \\<Rightarrow> ('a3 \\<Rightarrow> 'b3) \\<Rightarrow> ('p, 'a1, 'a2, 'a3) F \\<Rightarrow> ('p, 'a1, 'b2, 'b3) F\" where\n  \"F1map \\<equiv> Fmap id\"\nabbreviation F2map :: \"('a3 \\<Rightarrow> 'b3) \\<Rightarrow> ('p, 'a1, 'a2, 'a3) F \\<Rightarrow> ('p, 'a1, 'a2, 'b3) F\" where\n  \"F2map \\<equiv> Fmap id id\"\n\nabbreviation \"F1set1 \\<equiv> Fset2\"\nabbreviation \"F1set2 \\<equiv> Fset3\"\nabbreviation \"F2set \\<equiv> Fset3\"\n\n\ntheorem F1map_id: \"F1map id id = id\"\n  by (rule F.map_id0)\n\n\n\ntheorem F1map_comp: \"F1map (f1 o g1) (f2 o g2) = F1map f1 f2 o F1map g1 g2\"\n  by (unfold F.map_comp0[symmetric] o_id) (rule refl)\n\ntheorem F2map_comp: \"F2map (f o g) = F2map f o F2map g\"\n  by (unfold F.map_comp0[symmetric] o_id) (rule refl)\n\ntheorem F1map_cong: \"\\<lbrakk>\\<And>z. z \\<in> F1set1 x \\<Longrightarrow> f1 z = g1 z; \\<And>z. z \\<in> F1set2 x \\<Longrightarrow> f2 z = g2 z\\<rbrakk>\n  \\<Longrightarrow> F1map f1 f2 x = F1map g1 g2 x\"\n  apply (rule F.map_cong0)\n    apply (rule refl)\n   apply assumption\n  apply assumption\n  done\n\ntheorem F2map_cong: \"\\<lbrakk>\\<And>z. z \\<in> F2set x \\<Longrightarrow> f z = g z\\<rbrakk> \\<Longrightarrow> F2map f x = F2map g x\"\n  apply (rule F.map_cong0)\n    apply (rule refl)\n   apply (rule refl)\n  apply assumption\n  done\n\ntheorem F1set1_natural: \"F1set1 o F1map f1 f2 = image f1 o F1set1\"\n  by (rule F.set_map0(2))\n\ntheorem F1set2_natural: \"F1set2 o F1map f1 f2 = image f2 o F1set2\"\n  by (rule F.set_map0(3))\n\ntheorem F2set_natural: \"F2set o F2map f = image f o F2set\"\n  by (rule F.set_map0(3))\n\nabbreviation Fin :: \"'a1 set \\<Rightarrow> 'a2 set \\<Rightarrow> 'a3 set \\<Rightarrow> (('p, 'a1, 'a2, 'a3) F) set\" where\n  \"Fin A1 A2 A3 \\<equiv> {x. Fset1 x \\<subseteq> A1 \\<and> Fset2 x \\<subseteq> A2 \\<and> Fset3 x \\<subseteq> A3}\"\n\nabbreviation F1in :: \"'a2 set \\<Rightarrow> 'a3 set \\<Rightarrow> (('p, 'a1, 'a2, 'a3) F) set\" where\n  \"F1in A1 A2 \\<equiv> {x. F1set1 x \\<subseteq> A1 \\<and> F1set2 x \\<subseteq> A2}\"\n\nlemma F1in_alt: \"F1in A2 A3 = Fin UNIV A2 A3\"\n  by (tactic \\<open>BNF_Comp_Tactics.kill_in_alt_tac @{context}\\<close>)\n\nabbreviation F2in :: \"'a3 set \\<Rightarrow> (('p, 'a1, 'a2, 'a3) F) set\" where\n  \"F2in A \\<equiv> {x. F2set x \\<subseteq> A}\"\n\nlemma F2in_alt: \"F2in A3 = Fin UNIV UNIV A3\"\n  by (tactic \\<open>BNF_Comp_Tactics.kill_in_alt_tac @{context}\\<close>)\n\nlemma Frel_cong: \"\\<lbrakk>R1 = S1; R2 = S2; R3 = S3\\<rbrakk> \\<Longrightarrow> Frel R1 R2 R3 = Frel S1 S2 S3\"\n  by hypsubst (rule refl)\n\ndefinition F1rel where\n  \"F1rel R1 R2 = (BNF_Def.Grp (F1in (Collect (case_prod R1)) (Collect (case_prod R2))) (F1map fst fst))^--1 OO\n                 (BNF_Def.Grp (F1in (Collect (case_prod R1)) (Collect (case_prod R2))) (F1map snd snd))\"\n\nlemmas F1rel_unfold = trans[OF F1rel_def trans[OF OO_Grp_cong[OF F1in_alt]\n      trans[OF arg_cong2[of _ _ _ _ relcompp, OF trans[OF arg_cong[of _ _ conversep, OF sym[OF F.rel_Grp]] F.rel_conversep[symmetric]] sym[OF F.rel_Grp]]\n        trans[OF F.rel_compp[symmetric] Frel_cong[OF trans[OF Grp_UNIV_id[OF refl] eq_alt[symmetric]] Grp_fst_snd Grp_fst_snd]]]]]\n\ndefinition F2rel where\n  \"F2rel R1 = (BNF_Def.Grp (F2in (Collect (case_prod R1))) (F2map fst))^--1 OO\n              (BNF_Def.Grp (F2in (Collect (case_prod R1))) (F2map snd))\"\n\nlemmas F2rel_unfold = trans[OF F2rel_def trans[OF OO_Grp_cong[OF F2in_alt]\n      trans[OF arg_cong2[of _ _ _ _ relcompp, OF trans[OF arg_cong[of _ _ conversep, OF sym[OF F.rel_Grp]] F.rel_conversep[symmetric]] sym[OF F.rel_Grp]]\n        trans[OF F.rel_compp[symmetric] Frel_cong[OF trans[OF Grp_UNIV_id[OF refl] eq_alt[symmetric]] trans[OF Grp_UNIV_id[OF refl] eq_alt[symmetric]] Grp_fst_snd]]]]]\n\nbnf F1: \"('p, 'a1, 'a2, 'a3) F\"\n  map: F1map\n  sets: F1set1 F1set2\n  bd: \"bd_F :: ('p bd_type_F) rel\"\n  rel: F1rel\n            apply -\n            apply (rule F1map_id)\n           apply (rule F1map_comp)\n          apply (erule F1map_cong) apply assumption\n         apply (rule F1set1_natural)\n        apply (rule F1set2_natural)\n       apply (rule F.bd_card_order)\n      apply (rule F.bd_cinfinite)\n     apply (rule F.set_bd(2))\n    apply (rule F.set_bd(3))\n   apply (unfold F1rel_unfold F.rel_compp[symmetric] eq_OO) [1] apply (rule order_refl)\n  apply (rule F1rel_def[unfolded OO_Grp_alt mem_Collect_eq])\n  done\n\nbnf F2: \"('p, 'a1, 'a2, 'a3) F\"\n  map: F2map\n  sets: F2set\n  bd: \"bd_F :: ('p bd_type_F) rel\"\n  rel: F2rel\n          apply -\n          apply (rule F2map_id)\n         apply (rule F2map_comp)\n        apply (erule F2map_cong)\n       apply (rule F2set_natural)\n      apply (rule F.bd_card_order)\n     apply (rule F.bd_cinfinite)\n    apply (rule F.set_bd(3))\n   apply (unfold F2rel_unfold F.rel_compp[symmetric] eq_OO) [1] apply (rule order_refl)\n  apply (rule F2rel_def[unfolded OO_Grp_alt mem_Collect_eq])\n  done\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BNF_Operations/Kill.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804196836382, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.34309546701039517}}
{"text": "(*<*)\ntheory Abstract_Monitor\n  imports Formula\nbegin\n(*>*)\n\nsection \\<open>Abstract monitor specification\\<close>\n\nlocale monitorable =\n  fixes monitorable :: \"Formula.formula \\<Rightarrow> bool\"\n\ntext \\<open>The following locale specifies the desired behavior ouf a monitor abstractly.\\<close>\n\nlocale monitor = monitorable +\n  fixes\n    M :: \"Formula.formula \\<Rightarrow> Formula.prefix \\<Rightarrow> (nat \\<times> event_data tuple) set\"\n  assumes\n    mono_monitor: \"monitorable \\<phi> \\<Longrightarrow> \\<pi> \\<le> \\<pi>' \\<Longrightarrow> M \\<phi> \\<pi> \\<subseteq> M \\<phi> \\<pi>'\"\n    and sound_monitor: \"monitorable \\<phi> \\<Longrightarrow> (i, v) \\<in> M \\<phi> \\<pi> \\<Longrightarrow>\n      i < plen \\<pi> \\<and> wf_tuple (Formula.nfv \\<phi>) (Formula.fv \\<phi>) v \\<and> (\\<forall>\\<sigma>. prefix_of \\<pi> \\<sigma> \\<longrightarrow> Formula.sat \\<sigma> Map.empty (map the v) i \\<phi>)\"\n    and complete_monitor: \"monitorable \\<phi> \\<Longrightarrow> prefix_of \\<pi> \\<sigma> \\<Longrightarrow>\n      i < plen \\<pi> \\<Longrightarrow> wf_tuple (Formula.nfv \\<phi>) (Formula.fv \\<phi>) v \\<Longrightarrow>\n      (\\<forall>\\<sigma>. prefix_of \\<pi> \\<sigma> \\<longrightarrow> Formula.sat \\<sigma> Map.empty (map the v) i \\<phi>) \\<Longrightarrow> \\<exists>\\<pi>'. prefix_of \\<pi>' \\<sigma> \\<and> (i, v) \\<in> M \\<phi> \\<pi>'\"\n\nlocale slicable_monitor = monitor +\n  assumes monitor_slice: \"mem_restr S v \\<Longrightarrow> (i, v) \\<in> M \\<phi> (Formula.pslice \\<phi> S \\<pi>) \\<longleftrightarrow> (i, v) \\<in> M \\<phi> \\<pi>\"\n\nlocale monitor_pre_progress = monitorable +\n  fixes progress :: \"Formula.trace \\<Rightarrow> Formula.formula \\<Rightarrow> nat \\<Rightarrow> nat\"\n  assumes\n    progress_mono: \"j \\<le> j' \\<Longrightarrow> progress \\<sigma> \\<phi> j \\<le> progress \\<sigma> \\<phi> j'\"\n    and progress_le: \"progress \\<sigma> \\<phi> j \\<le> j\"\n    and progress_ge: \"monitorable \\<phi> \\<Longrightarrow> \\<exists>j. i \\<le> progress \\<sigma> \\<phi> j\"\n\nlocale monitor_progress = monitor_pre_progress +\n  assumes progress_prefix_conv: \"prefix_of \\<pi> \\<sigma> \\<Longrightarrow> prefix_of \\<pi> \\<sigma>' \\<Longrightarrow>\n    progress \\<sigma> \\<phi> (plen \\<pi>) = progress \\<sigma>' \\<phi> (plen \\<pi>)\"\nbegin\n\ndefinition verdicts :: \"Formula.formula \\<Rightarrow> Formula.prefix \\<Rightarrow> (nat \\<times> event_data tuple) set\" where\n  \"verdicts \\<phi> \\<pi> = {(i, v). wf_tuple (Formula.nfv \\<phi>) (Formula.fv \\<phi>) v \\<and>\n    (\\<forall>\\<sigma>. prefix_of \\<pi> \\<sigma> \\<longrightarrow> i < progress \\<sigma> \\<phi> (plen \\<pi>) \\<and> Formula.sat \\<sigma>  Map.empty (map the v) i \\<phi>)}\"\n\nlemma verdicts_mono: \"\\<pi> \\<le> \\<pi>' \\<Longrightarrow> verdicts \\<phi> \\<pi> \\<subseteq> verdicts \\<phi> \\<pi>'\"\n  unfolding verdicts_def\n  by (auto dest: prefix_of_antimono elim!: order.strict_trans2 intro!: progress_mono plen_mono)\n\nend\n\nlemma stake_eq_mono: \"stake b x = stake b y \\<Longrightarrow> a \\<le> b \\<Longrightarrow> stake a x = stake a y\"\nproof (induction a arbitrary: b x y)\n  case 0\n  then show ?case by simp\nnext\n  case Suca: (Suc a)\n  show ?case proof (cases b)\n    case 0\n    with Suca show ?thesis by (simp del: stake.simps)\n  next\n    case (Suc b')\n    with Suca show ?thesis by (auto simp only: stake.simps list.inject)\n  qed\nqed\n\nsublocale monitor_progress \\<subseteq> monitor monitorable verdicts\nproof (standard, goal_cases)\n  case (1 \\<phi> \\<pi> \\<pi>')\n  from 1(2) show ?case by (rule verdicts_mono)\nnext\n  case (2 \\<phi> i v \\<pi>)\n  from \\<open>(i, v) \\<in> verdicts \\<phi> \\<pi>\\<close> show ?case\n    unfolding verdicts_def\n    using ex_prefix_of[of \\<pi>]\n    by (auto elim!: order.strict_trans2 intro!: progress_le)\nnext\n  case complete: (3 \\<phi> \\<pi> \\<sigma> i v)\n  from \\<open>monitorable \\<phi>\\<close> obtain j where eval: \"i < progress \\<sigma> \\<phi> j\"\n    unfolding less_eq_Suc_le\n    using progress_ge by blast\n  define j' where \"j' = max (plen \\<pi>) j\"\n  then have \"plen \\<pi> \\<le> j'\" by simp\n  from eval have eval': \"i < progress \\<sigma> \\<phi> j'\"\n    unfolding j'_def\n    by (auto elim: order.strict_trans2 intro!: progress_mono)\n  from complete(2) \\<open>plen \\<pi> \\<le> j'\\<close> have \"\\<pi> \\<le> take_prefix j' \\<sigma>\"\n  proof (transfer fixing: j', goal_cases prefix)\n    case (prefix \\<pi> \\<sigma>)\n    then have \"stake j' \\<sigma> = stake (length \\<pi>) \\<sigma> @ stake (j' - length \\<pi>) (sdrop (length \\<pi>) \\<sigma>)\"\n      by (unfold stake_add) auto\n    with \\<open>stake (length \\<pi>) \\<sigma> = \\<pi>\\<close> show ?case \n      by auto\n  qed\n  with complete(4) eval' show ?case using progress_prefix_conv[of \"take_prefix j' \\<sigma>\" \\<sigma> \\<sigma>' \\<phi> for \\<sigma>']\n    unfolding verdicts_def\n    by (auto intro!: exI[where x=\"take_prefix j' \\<sigma>\"] complete(5)[rule_format] elim: prefix_of_antimono)\nqed\n\nlocale monitor_timed_progress = monitor_pre_progress +\n  assumes progress_time_conv: \"\\<forall>i<j. \\<tau> \\<sigma> i = \\<tau> \\<sigma>' i \\<Longrightarrow> progress \\<sigma> \\<phi> j = progress \\<sigma>' \\<phi> j\"\n    and progress_sat_cong: \"prefix_of \\<pi> \\<sigma> \\<Longrightarrow> prefix_of \\<pi> \\<sigma>' \\<Longrightarrow> i < progress \\<sigma> \\<phi> (plen \\<pi>) \\<Longrightarrow>\n      Formula.sat \\<sigma>  Map.empty v i \\<phi> \\<longleftrightarrow> Formula.sat \\<sigma>' Map.empty v i \\<phi>\"\nbegin\n\nlemma progress_map_conv: \"progress (map_\\<Gamma> f \\<sigma>) \\<phi> j = progress (map_\\<Gamma> g \\<sigma>) \\<phi> j\"\n  by (auto intro: progress_time_conv)\n\nlemma progress_slice_conv: \"progress (Formula.slice \\<phi>' R \\<sigma>) \\<phi> j = progress (Formula.slice \\<phi>' R' \\<sigma>) \\<phi> j\"\n  unfolding Formula.slice_def using progress_map_conv .\n\nlemma progress_slice: \"progress (Formula.slice \\<phi> R \\<sigma>) \\<phi> j = progress \\<sigma> \\<phi> j\"\n  using progress_map_conv[where g=id] by (simp add: Formula.slice_def)\n\nend\n\nsublocale monitor_timed_progress \\<subseteq> monitor_progress\n  by (unfold_locales, auto intro: progress_time_conv \\<tau>_prefix_conv)\n\nlemma (in monitor_timed_progress) verdicts_alt:\n  \"verdicts \\<phi> \\<pi> = {(i, v). wf_tuple (Formula.nfv \\<phi>) (Formula.fv \\<phi>) v \\<and>\n    (\\<exists>\\<sigma>. prefix_of \\<pi> \\<sigma> \\<and> i < progress \\<sigma> \\<phi> (plen \\<pi>) \\<and> Formula.sat \\<sigma> Map.empty (map the v) i \\<phi>)}\"\n  unfolding verdicts_def\n  using ex_prefix_of[of \\<pi>]\n  by (auto dest: progress_prefix_conv[of \\<pi> _ _ \\<phi>] elim!: progress_sat_cong[THEN iffD1, rotated -1])\n\nsublocale monitor_timed_progress \\<subseteq> slicable_monitor monitorable verdicts\nproof\n  fix S :: \"event_data list set\" and v i \\<phi> \\<pi>\n  assume *: \"mem_restr S v\"\n  show \"((i, v) \\<in> verdicts \\<phi> (Formula.pslice \\<phi> S \\<pi>)) = ((i, v) \\<in> verdicts \\<phi> \\<pi>)\" (is \"?L = ?R\")\n  proof\n    assume ?L\n    with * show ?R unfolding verdicts_def\n      by (auto simp: progress_slice fvi_less_nfv wf_tuple_def elim!: mem_restrE\n        box_equals[OF sat_slice_iff sat_fv_cong sat_fv_cong, symmetric, THEN iffD1, rotated -1]\n        dest: spec[of _ \"Formula.slice \\<phi> S _\"] prefix_of_pslice_slice)\n  next\n    assume ?R\n    with * show ?L unfolding verdicts_alt\n      by (auto simp: progress_slice fvi_less_nfv wf_tuple_def elim!: mem_restrE\n        box_equals[OF sat_slice_iff sat_fv_cong sat_fv_cong, symmetric, THEN iffD2, rotated -1]\n        intro: exI[of _ \"Formula.slice \\<phi> S _\"] prefix_of_pslice_slice)\n  qed\nqed\n\ntext \\<open>Past-only Formulas.\\<close>\n\nfun past_only :: \"Formula.formula \\<Rightarrow> bool\" where\n  \"past_only (Formula.Pred _ _) = True\"\n| \"past_only (Formula.Eq _ _) = True\"\n| \"past_only (Formula.Less _ _) = True\"\n| \"past_only (Formula.LessEq _ _) = True\"\n| \"past_only (Formula.Let _ _ \\<alpha> \\<beta>) = (past_only \\<alpha> \\<and> past_only \\<beta>)\"\n| \"past_only (Formula.Neg \\<psi>) = past_only \\<psi>\"\n| \"past_only (Formula.Or \\<alpha> \\<beta>) = (past_only \\<alpha> \\<and> past_only \\<beta>)\"\n| \"past_only (Formula.And \\<alpha> \\<beta>) = (past_only \\<alpha> \\<and> past_only \\<beta>)\"\n| \"past_only (Formula.Ands l) = (\\<forall>\\<alpha>\\<in>set l. past_only \\<alpha>)\"\n| \"past_only (Formula.Exists \\<psi>) = past_only \\<psi>\"\n| \"past_only (Formula.Agg _ _ _ _ \\<psi>) = past_only \\<psi>\"\n| \"past_only (Formula.Prev _ \\<psi>) = past_only \\<psi>\"\n| \"past_only (Formula.Next _ _) = False\"\n| \"past_only (Formula.Since \\<alpha> _ \\<beta>) = (past_only \\<alpha> \\<and> past_only \\<beta>)\"\n| \"past_only (Formula.Until \\<alpha> _ \\<beta>) = False\"\n| \"past_only (Formula.MatchP _ r) = Regex.pred_regex past_only r\"\n| \"past_only (Formula.MatchF _ _) = False\"\n\nlemma past_only_sat:\n  assumes \"prefix_of \\<pi> \\<sigma>\" \"prefix_of \\<pi> \\<sigma>'\"\n  shows \"i < plen \\<pi> \\<Longrightarrow> dom V = dom V' \\<Longrightarrow>\n     (\\<And>p i. p \\<in> dom V \\<Longrightarrow> i < plen \\<pi> \\<Longrightarrow> the (V p) i = the (V' p) i) \\<Longrightarrow>\n     past_only \\<phi> \\<Longrightarrow> Formula.sat \\<sigma> V v i \\<phi> = Formula.sat \\<sigma>' V' v i \\<phi>\"\nproof (induction \\<phi> arbitrary: V V' v i)\n  case (Pred e ts)\n  show ?case proof (cases \"V e\")\n    case None\n    then have \"V' e = None\" using \\<open>dom V = dom V'\\<close> by auto\n    with None \\<Gamma>_prefix_conv[OF assms(1,2) Pred(1)] show ?thesis by simp\n  next\n    case (Some a)\n    moreover obtain a' where \"V' e = Some a'\" using Some \\<open>dom V = dom V'\\<close> by auto\n    moreover have \"the (V e) i = the (V' e) i\"\n      using Some Pred(1,3) by (fastforce intro: domI)\n    ultimately show ?thesis by simp\n  qed\nnext\n  case (Let p b \\<phi> \\<psi>)\n  let ?V = \"\\<lambda>V \\<sigma>. (V(p \\<mapsto>\n      \\<lambda>i. {v. length v = Formula.nfv \\<phi> - b \\<and>\n              (\\<exists>zs. length zs = b \\<and>\n                    Formula.sat \\<sigma> V (zs @ v) i \\<phi>)}))\"\n  show ?case unfolding sat.simps proof (rule Let.IH(2))\n    show \"i < plen \\<pi>\" by fact\n    from Let.prems show \"past_only \\<psi>\" by simp\n    from Let.prems show \"dom (?V V \\<sigma>) = dom (?V V' \\<sigma>')\"\n      by (simp del: fun_upd_apply)\n  next\n    fix p' i\n    assume *: \"p' \\<in> dom (?V V \\<sigma>)\" \"i < plen \\<pi>\"\n    show \"the (?V V \\<sigma> p') i = the (?V V' \\<sigma>' p') i\" proof (cases \"p' = p\")\n      case True\n      with Let \\<open>i < plen \\<pi>\\<close> show ?thesis by auto\n    next\n      case False\n      with * show ?thesis by (auto intro!: Let.prems(3))\n    qed\n  qed\nnext\n  case (Ands l)\n  with \\<Gamma>_prefix_conv[OF assms] show ?case by simp\nnext\n  case (Prev I \\<phi>)\n  with \\<tau>_prefix_conv[OF assms] show ?case by (simp split: nat.split)\nnext\n  case (Since \\<phi>1 I \\<phi>2)\n  with \\<tau>_prefix_conv[OF assms] show ?case by auto\nnext\n  case (MatchP I r)\n  then have \"Regex.match (Formula.sat \\<sigma> V v) r a b = Regex.match (Formula.sat \\<sigma>' V' v) r a b\" if \"b < plen \\<pi>\" for a b\n    using that by (intro Regex.match_cong_strong) (auto simp: regex.pred_set)\n  with \\<tau>_prefix_conv[OF assms] MatchP(2) show ?case by auto\nqed auto\n\ninterpretation past_only_monitor: monitor_timed_progress past_only \"\\<lambda>\\<sigma> \\<phi> j. if past_only \\<phi> then j else 0\"\n  by unfold_locales (auto dest: past_only_sat(1) split: if_splits)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/MFODL_Monitor_Optimized/Abstract_Monitor.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300449389326, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.34303375564011734}}
{"text": "theory Lift_Snd\n  imports \"../Lifter\"\nbegin\n(*\n * snd\n *)\n\ndefinition snd_l ::\n  \"('x, 'a, 'b2 :: Pord_Weak) lifting \\<Rightarrow>\n   ('x, 'a, ('b1 :: Pord_Weakb) * 'b2) lifting\" where\n\"snd_l t =\n      LMake (\\<lambda> s a b . (case b of (b1, b2) \\<Rightarrow> (b1, LUpd t s a b2)))\n            (\\<lambda> s x . (LOut t s (snd x)))\n            (\\<lambda> s . (\\<bottom>, LBase t s))\"\n\ndefinition snd_l_S :: \"('x, 'b2 :: Pord_Weak) valid_set \\<Rightarrow> ('x, ('b1 :: Pord_Weakb * 'b2)) valid_set\" where\n\"snd_l_S S s =\n  { b . case b of (_, b2) \\<Rightarrow> (b2 \\<in> S s) }\"\n\n\nlocale snd_l_valid_weak = lifting_valid_weak\n\nsublocale snd_l_valid_weak \\<subseteq> out : lifting_valid_weak \"snd_l l\" \"snd_l_S S\"\nproof\n  fix s a \n  fix b :: \"('e :: Pord_Weakb) * ('c :: Pord_Weak)\"\n  show \"LOut (snd_l l) s (LUpd (snd_l l) s a b) = a\"\n    using put_get\n    by(auto simp add: snd_l_def split:prod.splits)\nnext\n  fix s\n  fix b :: \"('e :: Pord_Weakb) * ('c :: Pord_Weak)\"\n  assume  Hb : \"b \\<in> snd_l_S S s\"\n  thus \"b <[ LUpd (snd_l l) s (LOut (snd_l l) s b) b\"\n    using get_put_weak\n    by(auto simp add: snd_l_def prod_pleq leq_refl snd_l_S_def split:prod.splits)\nnext\n  fix s a \n  fix b :: \"('e :: Pord_Weakb) * ('c :: Pord_Weak)\"\n  show \"LUpd (snd_l l) s a b \\<in> snd_l_S S s\"\n    using put_S\n    by(auto simp add: snd_l_def prod_pleq leq_refl snd_l_S_def split:prod.splits)\nqed\n\nlemma (in snd_l_valid_weak) ax :\n  shows \"lifting_valid_weak (snd_l l) (snd_l_S S)\"\n  using out.lifting_valid_weak_axioms\n  by auto\n\nlemma (in snd_l_valid_weak) ax_g :\n  assumes H : \"\\<And> x . S' x = snd_l_S S x\"\n  shows \"lifting_valid_weak (snd_l l) S'\"\nproof-\n  have \"S' = snd_l_S S\"\n    using assms by auto\n  then show ?thesis\n    using out.lifting_valid_weak_axioms\n    by auto\nqed\n\n\nlocale snd_l_valid_ext = lifting_valid_ext\n\nsublocale snd_l_valid_ext \\<subseteq> out : lifting_valid_ext \"snd_l l\" \"snd_l_S S\"\nproof\n  fix s a \n  fix b :: \"('e :: Pord_Weakb) * ('c :: Pord_Weak)\"\n  (*assume  Hb : \"b \\<in> snd_l_S S s\"*)\n  show \"b <[ LUpd (snd_l l) s a b\"\n    using get_put\n    by(auto simp add: snd_l_def prod_pleq leq_refl snd_l_S_def split:prod.splits)\nqed\n\nlemma (in snd_l_valid_ext) ax :\n  shows \"lifting_valid_ext (snd_l l)\"\n  using out.lifting_valid_ext_axioms\n  by auto\n\nlocale snd_l_valid_base_ext = lifting_valid_base_ext\nsublocale snd_l_valid_base_ext \\<subseteq> out : lifting_valid_base_ext \"snd_l l\" \"snd_l_S S\"\nproof\n  fix s\n  show \"LBase (snd_l l) s = \\<bottom>\" using base\n    by(auto simp add: snd_l_def prod_bot)\nqed\n\nlemma (in snd_l_valid_base_ext) ax :\n  shows \"lifting_valid_base_ext (snd_l l)\"\n  using out.lifting_valid_base_ext_axioms\n  by auto\n\nlocale snd_l_valid_ok_ext = lifting_valid_ok_ext\nsublocale snd_l_valid_ok_ext \\<subseteq> out : lifting_valid_ok_ext \"snd_l l\" \"snd_l_S S\"\nproof\n  fix s\n\n  show \"ok_S \\<subseteq> snd_l_S S s\" using ok_S_valid\n    by(auto simp add: prod_ok_S snd_l_S_def)\nnext\n  fix s a\n  fix b :: \"('d * 'c)\"\n  assume B: \"b \\<in> ok_S\" \n  then show \"LUpd (snd_l l) s a b \\<in> ok_S\" using ok_S_put\n    by(auto simp add: prod_ok_S snd_l_S_def snd_l_def)\nqed\n\nlemma (in snd_l_valid_ok_ext) ax :\n  shows \"lifting_valid_ok_ext (snd_l l) (snd_l_S S)\"\n  using out.lifting_valid_ok_ext_axioms\n  by auto\n\nlemma (in snd_l_valid_ok_ext) ax_g :\n  assumes H: \"\\<And> x . S' x = snd_l_S S x\"\n  shows \"lifting_valid_ok_ext (snd_l l) S'\"\nproof-\n  have \"S' = snd_l_S S\"\n    using assms by auto\n  then show ?thesis\n  using out.lifting_valid_ok_ext_axioms\n  by auto\nqed\n\n\nlocale snd_l_valid_pres_ext = lifting_valid_pres_ext\nsublocale snd_l_valid_pres_ext \\<subseteq> out : lifting_valid_pres_ext \"snd_l l\" \"snd_l_S S\"\nproof\n  fix v supr :: \"('d * 'c)\"\n  fix V f s\n\n  assume HV : \"v \\<in> V\"\n  assume HS : \"V \\<subseteq> snd_l_S S s\"\n  assume Hsupr : \"is_sup V supr\"\n  assume Hsupr_S : \"supr \\<in> snd_l_S S s\"\n  show \"is_sup (LMap (snd_l l) f s ` V) (LMap (snd_l l) f s supr)\"\n  proof(rule is_supI)\n\n    fix x\n\n    assume Xin : \"x \\<in> LMap (snd_l l) f s ` V\"\n\n    obtain x1 x2 where X: \"x = (x1, x2)\" by(cases x; auto)\n\n    obtain xi xi1 xi2 where Xi : \"xi = (xi1, xi2)\" \"xi \\<in> V\" \"LMap (snd_l l) f s xi = x\"\n      using Xin\n      by auto\n\n    obtain supr1 supr2 where Supr : \"supr = (supr1, supr2)\" by(cases supr; auto)\n\n    have \"xi <[ supr\" using is_supD1[OF Hsupr Xi(2)] by simp\n\n    hence \"xi1 <[ supr1\" \"xi2 <[ supr2\"\n      using Xi Supr\n      by(auto simp add: prod_pleq split: prod.splits)\n\n    have \"x1 = xi1\" using Xi X\n      by(auto simp add: snd_l_def)\n\n    have \"x2 = LMap l f s xi2\"\n      using Xi X\n      by(auto simp add: snd_l_def)\n\n    have \"LMap (snd_l l) f s supr = (supr1, LMap l f s supr2)\"\n      using Supr\n      by(auto simp add: snd_l_def)\n\n    have Xi1_in : \"xi2 \\<in> snd ` V\"\n      using imageI[OF `xi \\<in> V`, of snd] Xi\n      by(auto)\n\n    have Fst_V_sub : \"snd ` V \\<subseteq> S s\"\n      using HS\n      by(auto simp add: snd_l_S_def)\n\n    have \"supr2 \\<in> S s\"\n      using Hsupr_S Supr\n      by(auto simp add: snd_l_S_def)\n\n    have Supr1_sup : \"is_sup (snd ` V) supr2\"\n    proof(rule is_supI)\n      fix w2\n      assume \"w2 \\<in> snd ` V\"\n\n      then obtain w1 where \"(w1, w2) \\<in> V\"\n        by auto\n\n      hence \"(w1, w2) <[ supr\" using is_supD1[OF Hsupr, of \"(w1, w2)\"] by auto\n\n      thus \"w2 <[ supr2\" using Supr by(auto simp add: prod_pleq)\n    next\n\n      fix z2\n\n      assume Hub : \"is_ub (snd ` V) z2\"\n\n      have \"is_ub V (supr1, z2)\"\n      proof(rule is_ubI)\n        fix w\n        assume \"w \\<in> V\"\n\n        obtain w1 w2 where W: \"w = (w1, w2)\" by(cases w; auto)\n\n        have \"w2 \\<in> (snd ` V)\"\n          using imageI[OF `w \\<in> V`, of snd] W by auto\n\n        hence \"w2 <[ z2\" using is_ubE[OF Hub] by auto\n\n        have \"w1 <[ supr1\" using is_supD1[OF Hsupr `w \\<in> V`] Supr W\n          by(auto simp add: prod_pleq)\n\n        then show \"w <[ (supr1, z2)\" using W `w2 <[ z2`\n          by(auto simp add: prod_pleq)\n      qed\n\n      show \"supr2 <[ z2\"\n        using is_supD2[OF Hsupr `is_ub V (supr1, z2)`] Supr\n        by(auto simp add: prod_pleq)\n    qed\n\n    have Supr1_map : \"is_sup (LMap l f s ` snd ` V) (LMap l f s supr2)\"\n      using pres using pres[OF Xi1_in Fst_V_sub Supr1_sup `supr2 \\<in> S s` , of f]\n      by simp\n\n    have X1_in : \"x2 \\<in> LMap l f s ` snd ` V\"\n      using X Xi imageI[OF `xi \\<in> V`, of snd]\n      by(auto simp add: snd_l_def)\n\n    have \"x2 <[ LMap l f s supr2\"\n      using is_supD1[OF Supr1_map X1_in]\n      by simp\n\n    have \"x1 <[ supr1\" using `x1 = xi1` `xi1 <[ supr1` by simp\n\n    then show \"x <[ LMap (snd_l l) f s supr\"\n      using X Supr `x2 <[ LMap l f s supr2`\n      by(auto simp add: snd_l_def prod_pleq)\n  next\n    fix x\n\n    assume Xub : \"is_ub (LMap (snd_l l) f s ` V) x\"\n\n    obtain supr1 supr2 where Supr : \"supr = (supr1, supr2)\" by(cases supr; auto)\n\n  (* TODO: copy-pasted from first case *)\n    have \"LMap (snd_l l) f s supr = (supr1, LMap l f s supr2)\"\n      using Supr\n      by(auto simp add: snd_l_def)\n\n    have Snd_V_sub : \"snd ` V \\<subseteq> S s\"\n      using HS\n      by(auto simp add: snd_l_S_def)\n\n    have \"supr2 \\<in> S s\"\n      using Hsupr_S Supr\n      by(auto simp add: snd_l_S_def)\n\n    have Supr2_sup : \"is_sup (snd ` V) supr2\"\n    proof(rule is_supI)\n      fix w2\n      assume \"w2 \\<in> snd ` V\"\n\n      then obtain w1 where \"(w1, w2) \\<in> V\"\n        by auto\n\n      hence \"(w1, w2) <[ supr\" using is_supD1[OF Hsupr, of \"(w1, w2)\"] by auto\n\n      thus \"w2 <[ supr2\" using Supr by(auto simp add: prod_pleq)\n    next\n\n      fix z2\n\n      assume Hub : \"is_ub (snd ` V) z2\"\n\n      have \"is_ub V (supr1, z2)\"\n      proof(rule is_ubI)\n        fix w\n        assume \"w \\<in> V\"\n\n        obtain w1 w2 where W: \"w = (w1, w2)\" by(cases w; auto)\n\n        have \"w2 \\<in> (snd ` V)\"\n          using imageI[OF `w \\<in> V`, of snd] W by auto\n\n        hence \"w2 <[ z2\" using is_ubE[OF Hub] by auto\n\n        have \"w1 <[ supr1\" using is_supD1[OF Hsupr `w \\<in> V`] Supr W\n          by(auto simp add: prod_pleq)\n\n        then show \"w <[ (supr1, z2)\" using W `w2 <[ z2`\n          by(auto simp add: prod_pleq)\n      qed\n\n      show \"supr2 <[ z2\"\n        using is_supD2[OF Hsupr `is_ub V (supr1, z2)`] Supr\n        by(auto simp add: prod_pleq)\n    qed\n\n    obtain v1 v2 where V : \"v = (v1, v2)\" \"v2 \\<in> snd ` V\"\n      using imageI[OF HV, of snd]\n      by(cases v; auto)\n\n    have Supr2_map : \"is_sup (LMap l f s ` snd ` V) (LMap l f s supr2)\"\n      using pres[OF V(2) Snd_V_sub Supr2_sup `supr2 \\<in> S s` ] \n      by simp\n\n    obtain x1 x2 where X: \"x = (x1, x2)\" by(cases x; auto)\n\n    have X2_ub : \"is_ub (LMap l f s ` snd ` V) x2\"\n    proof\n      fix w2\n\n      assume W2: \"w2 \\<in> LMap l f s ` snd ` V\"\n\n      then obtain wi wi1 wi2  where Wi : \"wi \\<in> V\" \"LMap l f s wi2 = w2\" \"wi = (wi1, wi2)\"\n        by(auto)\n\n      have Wi_in : \"LMap (snd_l l) f s wi \\<in> LMap (snd_l l) f s ` V\"\n        using imageI[OF Wi(1), of \"LMap (snd_l l) f s\"] by simp\n\n      have \"LMap (snd_l l) f s wi <[ x\"\n        using is_ubE[OF Xub Wi_in]\n        by simp\n\n      then show \"w2 <[ x2\"\n        using W2 Wi X\n        by(auto simp add: prod_pleq snd_l_def)\n    qed  \n\n    have \"LMap l f s supr2 <[ x2\"\n      using is_supD2[OF Supr2_map X2_ub]\n      by simp\n\n    have \"is_ub V (x1, supr2)\"\n    proof(rule is_ubI)\n      fix w\n\n      assume Win : \"w \\<in> V\"\n\n      obtain w1 w2 where W: \"w = (w1, w2)\" by(cases w; auto)\n\n      have W2_in : \"w2 \\<in> snd ` V\"\n        using imageI[OF Win, of snd] W by simp\n\n      have \"w2 <[ supr2\"\n        using is_supD1[OF Supr2_sup W2_in] by simp\n\n      have \"LMap (snd_l l) f s w <[ x\"\n        using is_ubE[OF Xub imageI[OF Win]] by simp\n\n      hence \"w1 <[ x1\" using W X\n        by(auto simp add: snd_l_def prod_pleq)\n\n      show \"w <[ (x1, supr2)\"\n        using `w2 <[ supr2` `w1 <[ x1` W\n        by(auto simp add: prod_pleq)\n    qed\n\n    have \"supr1 <[ x1\"\n      using is_supD2[OF Hsupr `is_ub V (x1, supr2)`] Supr\n      by(auto simp add: prod_pleq)\n\n\n    show \"LMap (snd_l l) f s supr <[ x\"\n      using `LMap l f s supr2 <[ x2` `supr1 <[ x1` X Supr\n      by(auto simp add: snd_l_def prod_pleq)\n  qed\nqed\n\nlemma (in snd_l_valid_pres_ext) ax :\n  shows \"lifting_valid_pres_ext (snd_l l) (snd_l_S S)\"\n  using out.lifting_valid_pres_ext_axioms\n  by auto\n\nlemma (in snd_l_valid_pres_ext) ax_g :\n  assumes H : \"\\<And> x . S' x = snd_l_S S x\"\n  shows \"lifting_valid_pres_ext (snd_l l) S'\"\nproof-\n  have \"S' = snd_l_S S\"\n    using assms by auto\n  then show ?thesis\n    using out.lifting_valid_pres_ext_axioms\n  by auto\nqed\n\n\nlocale snd_l_valid_base_pres_ext = snd_l_valid_pres_ext + snd_l_valid_base_ext + lifting_valid_base_pres_ext\nsublocale snd_l_valid_base_pres_ext \\<subseteq> out : lifting_valid_base_pres_ext \"snd_l l\" \"snd_l_S S\"\nproof\n  fix s\n  show \"\\<bottom> \\<notin> snd_l_S S s\"\n    using bot_bad[of s]\n    by(auto simp add: snd_l_S_def prod_bot)\nqed\n\nlemma (in snd_l_valid_base_pres_ext) ax :\n  shows \"lifting_valid_base_pres_ext (snd_l l) (snd_l_S S)\"\n  using out.lifting_valid_base_pres_ext_axioms by auto\n\nlemma (in snd_l_valid_base_pres_ext) ax_g :\n  assumes H : \"\\<And> x . S' x = snd_l_S S x\"\n  shows \"lifting_valid_base_pres_ext (snd_l l) S'\"\nproof-\n  have \"S' = snd_l_S S\"\n    using assms by auto\n  then show ?thesis\n    using out.lifting_valid_base_pres_ext_axioms by auto\nqed\n\n(* snd (copy-paste-change from fst) *)\nlocale snd_l_ortho = l_ortho\n\nsublocale snd_l_ortho \\<subseteq> out : l_ortho \"snd_l l1\" \"snd_l_S S1\" \"snd_l l2\" \"snd_l_S S2\"\nproof\n  fix s\n  show \"LBase (snd_l l1) s = LBase (snd_l l2) s\"\n    using eq_base\n    by(auto simp add: snd_l_def)\nnext\n\n  fix b :: \"('e * 'c)\"\n  fix s\n  fix a1 :: 'b\n  fix a2 :: 'd\n\n  obtain b1 b2 where B: \"b = (b1, b2)\"\n    by(cases b; auto)\n\n  have Compat1 : \"LUpd l1 s a1 (LUpd l2 s a2 b2) = LUpd l2 s a2 (LUpd l1 s a1 b2)\"\n    using compat[of s a1 a2 b2]\n    by(auto)\n\n  then show \"LUpd (snd_l l1) s a1 (LUpd (snd_l l2) s a2 b) =\n       LUpd (snd_l l2) s a2 (LUpd (snd_l l1) s a1 b)\"\n    using B\n    by(auto simp add: snd_l_def)\nnext\n\n  fix b :: \"('e * 'c)\"\n  fix a1 \n  fix s\n\n  obtain b1 b2 where B: \"b = (b1, b2)\"\n    by(cases b; auto)\n\n  have Compat1 : \"LOut l2 s (LUpd l1 s a1 b2) = LOut l2 s b2\"\n    using put1_get2\n    by auto\n\n  then show \"LOut (snd_l l2) s (LUpd (snd_l l1) s a1 b) = LOut (snd_l l2) s b\"\n    using B\n    by (auto simp add: snd_l_def)\nnext\n  fix b :: \"('e * 'c)\"\n  fix s a2\n\n  obtain b1 b2 where B: \"b = (b1, b2)\"\n    by(cases b; auto)\n\n  have Compat1 : \"LOut l1 s (LUpd l2 s a2 b2) = LOut l1 s b2\"\n    using put2_get1\n    by auto\n\n  then show \"LOut (snd_l l1) s\n        (LUpd (snd_l l2) s a2 b) =\n       LOut (snd_l l1) s b\"\n    using B\n    by(auto simp add: snd_l_def)\nnext\n  fix b :: \"'e * 'c\"\n  fix s a1\n\n  assume B_in : \"b \\<in> snd_l_S S2 s\"\n\n  then obtain b1 b2 where B : \"b = (b1, b2)\" \"b2 \\<in> S2 s\"\n    by(auto simp add: snd_l_S_def)\n\n  have Compat1 : \"LUpd l1 s a1 b2 \\<in> S2 s\"\n    using put1_S2[OF B(2)] by auto\n\n  then show \"LUpd (snd_l l1) s a1 b \\<in> snd_l_S S2 s\"\n    using B\n    by(auto simp add: snd_l_def snd_l_S_def)\nnext\n  fix b :: \"'e * 'c\"\n  fix s a2\n\n  assume B_in : \"b \\<in> snd_l_S S1 s\"\n  then obtain b1 b2 where B : \"b = (b1, b2)\" \"b2 \\<in> S1 s\"\n    by(auto simp add: snd_l_S_def)\n\n  have Compat2 : \"LUpd l2 s a2 b2 \\<in> S1 s\"\n    using put2_S1[OF B(2)]\n    by auto\n  \n  then show \"LUpd (snd_l l2) s a2 b \\<in> snd_l_S S1 s\"\n    using B\n    by(auto simp add: snd_l_def snd_l_S_def)\nqed\n\nlemma (in snd_l_ortho) ax :\n  shows \"l_ortho (snd_l l1) (snd_l_S S1) (snd_l l2) (snd_l_S S2)\"\n  using out.l_ortho_axioms by auto\n\nlemma (in snd_l_ortho) ax_g :\n  assumes H1 : \"\\<And> x . S'1 x = snd_l_S S1 x\"\n  assumes H2 : \"\\<And> x . S'2 x = snd_l_S S2 x\"\n  shows \"l_ortho (snd_l l1) S'1 (snd_l l2) S'2\"\nproof-\n  have H1' : \"S'1 = snd_l_S S1\"\n    using H1 by auto\n\n  have H2' : \"S'2 = snd_l_S S2\"\n    using H2 by auto\n\n  show ?thesis using ax unfolding H1' H2'\n    by auto\nqed\n\n\nlocale snd_l_ortho_base_ext = l_ortho_base_ext\n\nsublocale snd_l_ortho_base_ext \\<subseteq> out : l_ortho_base_ext \"snd_l l1\" \"snd_l l2\"\nproof\n  fix s\n  show \"LBase (snd_l l1) s = \\<bottom>\"\n    using compat_base1\n    by(auto simp add: snd_l_def prod_bot)\nnext\n  fix s\n  show \"LBase (snd_l l2) s = \\<bottom>\"\n    using compat_base2\n    by(auto simp add: snd_l_def prod_bot)\nqed\n\nlemma (in snd_l_ortho_base_ext) ax : \n  shows \"l_ortho_base_ext (snd_l l1) (snd_l l2)\"\n  using out.l_ortho_base_ext_axioms\n  by auto\n\nlocale snd_l_ortho_ok_ext = l_ortho_ok_ext\n\nsublocale snd_l_ortho_ok_ext \\<subseteq> out : l_ortho_ok_ext \"snd_l l1\" \"snd_l l2\" .\n\n(*\nlocale snd_l_ortho_pres = snd_l_ortho + l_ortho_pres\n\nsublocale snd_l_ortho_pres \\<subseteq> l_ortho_pres \"snd_l l1\" \"snd_l_S S1\" \"snd_l l2\" \"snd_l_S S2\"\nproof\n  fix a1 a2 s\n  fix x :: \"'e * 'c\"\n  obtain x1 x2 where X : \"x = (x1, x2)\"\n    by(cases x; auto)\n\n  have Sup : \n    \"is_sup {LUpd (l1) s a1 x2, LUpd (l2) s a2 x2}\n        (LUpd (l1) s a1 (LUpd (l2) s a2 x2))\"\n    using compat_pres_sup\n    by auto\n\n  have Conc' :\n    \"is_sup ((\\<lambda>w. (x1, w)) ` {LUpd l1 s a1 x2, LUpd l2 s a2 x2}) (x1, LUpd l1 s a1 (LUpd l2 s a2 x2))\"\n    using is_sup_snd[OF _ Sup]\n    by auto\n\n  then show \"is_sup {LUpd (snd_l l1) s a1 x, LUpd (snd_l l2) s a2 x}\n        (LUpd (snd_l l1) s a1 (LUpd (snd_l l2) s a2 x))\"\n    using X\n    by(auto simp add: snd_l_def)\nqed\n*)\n\n\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Lifter/Instances/Lift_Snd.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494421679929, "lm_q2_score": 0.5, "lm_q1q2_score": 0.34297472108399646}}
{"text": "(*  Title:      HOL/HOLCF/IOA/Compositionality.thy\n    Author:     Olaf Müller\n*)\n\nsection \\<open>Compositionality of I/O automata\\<close>\ntheory Compositionality\nimports CompoTraces\nbegin\n\nlemma compatibility_consequence3: \"eA \\<longrightarrow> A \\<Longrightarrow> eB \\<and> \\<not> eA \\<longrightarrow> \\<not> A \\<Longrightarrow> (eA \\<or> eB) \\<longrightarrow> A = eA\"\n  by auto\n\nlemma Filter_actAisFilter_extA:\n  \"compatible A B \\<Longrightarrow> Forall (\\<lambda>a. a \\<in> ext A \\<or> a \\<in> ext B) tr \\<Longrightarrow>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> tr = Filter (\\<lambda>a. a \\<in> ext A) \\<cdot> tr\"\n  apply (rule ForallPFilterQR)\n  text \\<open>i.e.: \\<open>(\\<forall>x. P x \\<longrightarrow> (Q x = R x)) \\<Longrightarrow> Forall P tr \\<Longrightarrow> Filter Q \\<cdot> tr = Filter R \\<cdot> tr\\<close>\\<close>\n  prefer 2 apply assumption\n  apply (rule compatibility_consequence3)\n  apply (simp_all add: ext_is_act ext1_ext2_is_not_act1)\n  done\n\n\ntext \\<open>\n  The next two theorems are only necessary, as there is no theorem\n  \\<open>ext (A \\<parallel> B) = ext (B \\<parallel> A)\\<close>\n\\<close>\n\nlemma compatibility_consequence4: \"eA \\<longrightarrow> A \\<Longrightarrow> eB \\<and> \\<not> eA \\<longrightarrow> \\<not> A \\<Longrightarrow> (eB \\<or> eA) \\<longrightarrow> A = eA\"\n  by auto\n\nlemma Filter_actAisFilter_extA2:\n  \"compatible A B \\<Longrightarrow> Forall (\\<lambda>a. a \\<in> ext B \\<or> a \\<in> ext A) tr \\<Longrightarrow>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> tr = Filter (\\<lambda>a. a \\<in> ext A) \\<cdot> tr\"\n  apply (rule ForallPFilterQR)\n  prefer 2 apply (assumption)\n  apply (rule compatibility_consequence4)\n  apply (simp_all add: ext_is_act ext1_ext2_is_not_act1)\n  done\n\n\nsubsection \\<open>Main Compositionality Theorem\\<close>\n\nlemma compositionality:\n  assumes \"is_trans_of A1\" and \"is_trans_of A2\"\n    and \"is_trans_of B1\" and \"is_trans_of B2\"\n    and \"is_asig_of A1\" and \"is_asig_of A2\"\n    and \"is_asig_of B1\" and \"is_asig_of B2\"\n    and \"compatible A1 B1\" and \"compatible A2 B2\"\n    and \"A1 =<| A2\" and \"B1 =<| B2\"\n  shows \"(A1 \\<parallel> B1) =<| (A2 \\<parallel> B2)\"\n  apply (insert assms)\n  apply (simp add: is_asig_of_def)\n  apply (frule_tac A1 = \"A1\" in compat_commute [THEN iffD1])\n  apply (frule_tac A1 = \"A2\" in compat_commute [THEN iffD1])\n  apply (simp add: ioa_implements_def inputs_of_par outputs_of_par externals_of_par)\n  apply auto\n  apply (simp add: compositionality_tr)\n  apply (subgoal_tac \"ext A1 = ext A2 \\<and> ext B1 = ext B2\")\n  prefer 2\n  apply (simp add: externals_def)\n  apply (erule conjE)+\n  text \\<open>rewrite with proven subgoal\\<close>\n  apply (simp add: externals_of_par)\n  apply auto\n  text \\<open>2 goals, the 3rd has been solved automatically\\<close>\n  text \\<open>1: \\<open>Filter A2 x \\<in> traces A2\\<close>\\<close>\n  apply (drule_tac A = \"traces A1\" in subsetD)\n  apply assumption\n  apply (simp add: Filter_actAisFilter_extA)\n  text \\<open>2: \\<open>Filter B2 x \\<in> traces B2\\<close>\\<close>\n  apply (drule_tac A = \"traces B1\" in subsetD)\n  apply assumption\n  apply (simp add: Filter_actAisFilter_extA2)\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/Compositionality.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6406358548398979, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.3428032392466954}}
{"text": "section \\<open>Static Standard Control Dependence\\<close>\n\ntheory StandardControlDependence imports \n  \"../Basic/Postdomination\" \n  \"../Basic/DynStandardControlDependence\"\nbegin\n\ncontext Postdomination begin\n\nsubsubsection \\<open>Definition and some lemmas\\<close>\n\ndefinition standard_control_dependence :: \"'node \\<Rightarrow> 'node \\<Rightarrow> bool\" \n  (\"_ controls\\<^sub>s _\" [51,0])\nwhere standard_control_dependences_eq:\"n controls\\<^sub>s n' \\<equiv> \\<exists>as. n controls\\<^sub>s n' via as\"\n\nlemma standard_control_dependence_def:\"n controls\\<^sub>s n' =\n    (\\<exists>a a' as. (n' \\<notin> set(sourcenodes (a#as))) \\<and> (n -a#as\\<rightarrow>* n') \\<and>\n                   (n' postdominates (targetnode a)) \\<and>\n                   (valid_edge a') \\<and> (sourcenode a' = n) \\<and> \n                   (\\<not> n' postdominates (targetnode a')))\"\nby(auto simp:standard_control_dependences_eq dyn_standard_control_dependence_def)\n\n\nlemma Exit_not_standard_control_dependent:\n  \"n controls\\<^sub>s (_Exit_) \\<Longrightarrow> False\"\nby(auto simp:standard_control_dependences_eq \n        intro:Exit_not_dyn_standard_control_dependent)\n             \n\nlemma standard_control_dependence_def_variant:\n  \"n controls\\<^sub>s n' = (\\<exists>as. (n -as\\<rightarrow>* n') \\<and> (n \\<noteq> n') \\<and>\n    (\\<not> n' postdominates n) \\<and> (n' \\<notin> set(sourcenodes as)) \\<and>\n  (\\<forall>n'' \\<in> set(targetnodes as). n' postdominates n''))\"\nby(auto simp:standard_control_dependences_eq \n             dyn_standard_control_dependence_def_variant)\n\n\nlemma inner_node_standard_control_dependence_predecessor:\n  assumes \"inner_node n\" \"(_Entry_) -as\\<rightarrow>* n\" \"n -as'\\<rightarrow>* (_Exit_)\"\n  obtains n' where \"n' controls\\<^sub>s n\"\nusing assms\nby(auto elim!:inner_node_dyn_standard_control_dependence_predecessor\n        simp:standard_control_dependences_eq)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Slicing/StaticIntra/StandardControlDependence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6406358411176238, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.34280323190392814}}
{"text": "(*  Title:      JinjaDCI/Common/Decl.thy\n\n    Author:     David von Oheimb, Susannah Mansky\n    Copyright   1999 Technische Universitaet Muenchen, 2019-20 UIUC\n\n    Based on the Jinja theory Common/Decl.thy by David von Oheimb\n*)\n\nsection \\<open> Class Declarations and Programs \\<close>\n\ntheory Decl imports Type begin\n\ntype_synonym \n  fdecl    = \"vname \\<times> staticb \\<times> ty\"        \\<comment> \\<open>field declaration\\<close>\ntype_synonym\n  'm mdecl = \"mname \\<times> staticb \\<times> ty list \\<times> ty \\<times> 'm\"     \\<comment> \\<open>method = name, static flag, arg.\\ types, return type, body\\<close>\ntype_synonym\n  'm \"class\" = \"cname \\<times> fdecl list \\<times> 'm mdecl list\"       \\<comment> \\<open>class = superclass, fields, methods\\<close>\ntype_synonym\n  'm cdecl = \"cname \\<times> 'm class\"  \\<comment> \\<open>class declaration\\<close>\ntype_synonym\n  'm prog  = \"'m cdecl list\"     \\<comment> \\<open>program\\<close>\n\n(* replaced all fname, mname, cname in below with `char list' so that\n pretty printing works   -SM *)\n(*<*)\ntranslations\n  (type) \"fdecl\"   <= (type) \"char list \\<times> staticb \\<times> ty\"\n  (type) \"'c mdecl\" <= (type) \"char list \\<times> staticb \\<times> ty list \\<times> ty \\<times> 'c\"\n  (type) \"'c class\" <= (type) \"char list \\<times> fdecl list \\<times> ('c mdecl) list\"\n  (type) \"'c cdecl\" <= (type) \"char list \\<times> ('c class)\"\n  (type) \"'c prog\" <= (type) \"('c cdecl) list\"\n(*>*)\n\ndefinition \"class\" :: \"'m prog \\<Rightarrow> cname \\<rightharpoonup> 'm class\"\nwhere\n  \"class  \\<equiv>  map_of\"\n\n(* Not difficult to prove, but useful for directing particular sequences of equality -SM *)\nlemma class_cons: \"\\<lbrakk> C \\<noteq> fst x \\<rbrakk> \\<Longrightarrow> class (x # P) C = class P C\"\n by (simp add: class_def)\n\ndefinition is_class :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> bool\"\nwhere\n  \"is_class P C  \\<equiv>  class P C \\<noteq> None\"\n\nlemma finite_is_class: \"finite {C. is_class P C}\"\n(*<*)\nproof -\n  have \"{C. is_class P C} = dom (map_of P)\"\n   by (simp add: is_class_def class_def dom_def)\n  thus ?thesis by (simp add: finite_dom_map_of)\nqed\n(*>*)\n\ndefinition is_type :: \"'m prog \\<Rightarrow> ty \\<Rightarrow> bool\"\nwhere\n  \"is_type P T  \\<equiv>\n  (case T of Void \\<Rightarrow> True | Boolean \\<Rightarrow> True | Integer \\<Rightarrow> True | NT \\<Rightarrow> True\n   | Class C \\<Rightarrow> is_class P C)\"\n\nlemma is_type_simps [simp]:\n  \"is_type P Void \\<and> is_type P Boolean \\<and> is_type P Integer \\<and>\n  is_type P NT \\<and> is_type P (Class C) = is_class P C\"\n(*<*)by(simp add:is_type_def)(*>*)\n\n\nabbreviation\n  \"types P == Collect (is_type P)\"\n\nlemma class_exists_equiv:\n \"(\\<exists>x. fst x = cn \\<and> x \\<in> set P) = (class P cn \\<noteq> None)\"\nproof(rule iffI)\n assume \"\\<exists>x. fst x = cn \\<and> x \\<in> set P\" then show \"class P cn \\<noteq> None\"\n   by (metis class_def image_eqI map_of_eq_None_iff)\nnext\n assume \"class P cn \\<noteq> None\" then show \"\\<exists>x. fst x = cn \\<and> x \\<in> set P\"\n   by (metis class_def fst_conv map_of_SomeD option.exhaust)\nqed\n\nlemma class_exists_equiv2:\n \"(\\<exists>x. fst x = cn \\<and> x \\<in> set (P1 @ P2)) = (class P1 cn \\<noteq> None \\<or> class P2 cn \\<noteq> None)\"\nby (simp only: class_exists_equiv [where P = \"P1@P2\"], simp add: class_def)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/Common/Decl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6548947425132315, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3427852346428398}}
{"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory ValueSemantics\nimports Cogent\nbegin\n\n\ndatatype ('f, 'a) vval = VPrim lit\n                       | VProduct \"('f, 'a) vval\" \"('f, 'a) vval\"\n                       | VSum name \"('f, 'a) vval\"\n                       | VRecord \"('f, 'a) vval list\"\n                       | VAbstract \"'a\"\n                       | VFunction \"'f expr\" \"type list\"\n                       | VAFunction \"'f\" \"type list\" \n                       | VUnit\n\n(* All polymorphic instantiations must have the _same_ value semantics. This means even if the C \nimplementations differ they must all refine the same specification *)\ntype_synonym ('f, 'a) vabsfuns = \"'f \\<Rightarrow> ('f, 'a) vval \\<Rightarrow> ('f,'a) vval \\<Rightarrow> bool\"\n\ndefinition eval_prim :: \"prim_op \\<Rightarrow> ('f, 'a) vval list \\<Rightarrow> ('f, 'a) vval\"\nwhere\n  \"eval_prim pop xs = VPrim (eval_prim_op pop (map (\\<lambda>vv. case vv of VPrim v \\<Rightarrow> v | _ \\<Rightarrow> LBool False) xs))\"\n\n(* NOTE: Termination is currently not provable with this approach. It's possible to show \n   it for v_sem assuming all called functions are terminating, but proving \n   this assumption would in turn require termination of v_sem.\n\n   Fixing this problem is nontrivial, and will likely necessitate changes to the design. \n*)\n\n\ninductive v_sem :: \"('f,'a) vabsfuns \\<Rightarrow> ('f, 'a) vval env \\<Rightarrow> 'f expr \\<Rightarrow> ('f, 'a) vval \\<Rightarrow> bool\" \n          (\"_ , _ \\<turnstile> _ \\<Down> _\" [30,0,0,20] 60)\nand       v_sem_all  :: \"('f,'a) vabsfuns \\<Rightarrow> ('f, 'a) vval list \\<Rightarrow> 'f expr list \\<Rightarrow> ('f, 'a) vval list \\<Rightarrow> bool\" \n          (\"_ , _ \\<turnstile>* _ \\<Down> _\" [30,0,0,20] 60) \nwhere \n  v_sem_var     : \"\\<xi> , \\<gamma> \\<turnstile> (Var i) \\<Down> (\\<gamma> ! i)\"\n\n| v_sem_lit     : \"\\<xi> , \\<gamma> \\<turnstile> (Lit l) \\<Down> VPrim l\"\n\n| v_sem_prim    : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile>* as \\<Down> as' \n                   \\<rbrakk> \\<Longrightarrow>  \\<xi> , \\<gamma> \\<turnstile> (Prim p as) \\<Down> eval_prim p as'\"\n\n| v_sem_fun     : \"\\<xi> , \\<gamma> \\<turnstile> Fun f ts \\<Down> VFunction f ts\"\n\n| v_sem_afun     : \"\\<xi> , \\<gamma> \\<turnstile> AFun f ts \\<Down> VAFunction f ts\"\n\n| v_sem_abs_app : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VAFunction f ts\n                   ; \\<xi> , \\<gamma> \\<turnstile> y \\<Down> a \n                   ; \\<xi> f a r\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> (App x y) \\<Down> r\"\n\n| v_sem_cast    : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> e \\<Down> VPrim l\n                   ; cast_to \\<tau> l = Some l' \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Cast \\<tau> e \\<Down> VPrim l'\"\n\n| v_sem_app     : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VFunction e ts\n                   ; \\<xi> , \\<gamma> \\<turnstile> y \\<Down> a\n                   ; \\<xi> , [ a ] \\<turnstile> specialise ts e \\<Down> r \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> (App x y) \\<Down> r\"\n\n| v_sem_con     : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> x' \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> (Con _ t x) \\<Down> VSum t x'\"\n\n| v_sem_promote : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> x' \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Promote t x \\<Down> x'\"\n\n| v_sem_member  : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> e \\<Down> VRecord fs \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Member e f \\<Down> fs ! f\"\n\n| v_sem_unit    : \"\\<xi> , \\<gamma> \\<turnstile> Unit \\<Down> VUnit\"\n\n| v_sem_tuple   : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> x' \n                   ; \\<xi> , \\<gamma> \\<turnstile> y \\<Down> y' \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> (Tuple x y) \\<Down> VProduct x' y'\"\n\n| v_sem_esac    : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> t \\<Down> VSum ts v \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Esac t \\<Down> v\" \n\n| v_sem_let     : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> a \\<Down> a'\n                   ; \\<xi> , (a' # \\<gamma>) \\<turnstile> b \\<Down> b' \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Let a b \\<Down> b'\" \n\n| v_sem_letbang : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> a \\<Down> a' \n                   ; \\<xi> , (a' # \\<gamma>) \\<turnstile> b \\<Down> b' \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> LetBang vs a b \\<Down> b'\"\n\n| v_sem_case_m  : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VSum t v\n                   ; \\<xi> , (v # \\<gamma>) \\<turnstile> m \\<Down> m'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Case x t m n \\<Down> m'\"\n\n| v_sem_case_nm : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VSum t' v\n                   ; t \\<noteq> t'\n                   ; \\<xi> , (VSum t' v # \\<gamma>) \\<turnstile> n \\<Down> n'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Case x t m n \\<Down> n'\"\n\n| v_sem_if      : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VPrim (LBool b)\n                   ; \\<xi> , \\<gamma> \\<turnstile> if b then t else e \\<Down> r \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> If x t e \\<Down> r\" \n\n| v_sem_struct  : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile>* xs \\<Down> vs\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Struct ts xs \\<Down> VRecord vs\" \n\n| v_sem_take    : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VRecord fs\n                   ; \\<xi> , (fs ! f # VRecord fs # \\<gamma>) \\<turnstile> e \\<Down> e' \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Take x f e \\<Down> e'\"\n\n| v_sem_put     : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VRecord fs \n                   ; \\<xi> , \\<gamma> \\<turnstile> e \\<Down> e' \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Put x f e \\<Down> VRecord (fs [ f := e' ])\"\n\n| v_sem_split   : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VProduct a b\n                   ; \\<xi> , (a # b # \\<gamma>) \\<turnstile> e \\<Down> e' \n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Split x e \\<Down> e'\"\n\n\n| v_sem_all_empty : \"\\<xi> , \\<gamma> \\<turnstile>* [] \\<Down> []\"\n\n| v_sem_all_cons  : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> v \n                     ; \\<xi> , \\<gamma> \\<turnstile>* xs \\<Down> vs\n                     \\<rbrakk> \\<Longrightarrow>  \\<xi> , \\<gamma> \\<turnstile>* (x # xs) \\<Down> (v # vs)\" \n\ninductive_cases v_sem_varE  [elim] : \"\\<xi> , \\<gamma> \\<turnstile> Var i \\<Down> v\"\ninductive_cases v_sem_funE  [elim] : \"\\<xi> , \\<gamma> \\<turnstile> Fun f ts \\<Down> v\"\ninductive_cases v_sem_afunE [elim] : \"\\<xi> , \\<gamma> \\<turnstile> AFun f ts \\<Down> v\"\ninductive_cases v_sem_appE  [elim] : \"\\<xi> , \\<gamma> \\<turnstile> App a b \\<Down> v\"\n\n\nlocale value_sem =\n  fixes abs_typing :: \"'a \\<Rightarrow> name \\<Rightarrow> type list \\<Rightarrow> bool\"\n  assumes abs_typing_bang : \"abs_typing av n \\<tau>s \\<Longrightarrow> abs_typing av n (map bang \\<tau>s)\"\n\ncontext value_sem begin\n\ninductive vval_typing  :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow> ('f, 'a) vval \\<Rightarrow> type \\<Rightarrow> bool\"\n          (\"_ \\<turnstile> _ :v _\" [30,0,20] 80)\nand vval_typing_record :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow> ('f, 'a) vval list \\<Rightarrow> (type \\<times> bool) list \\<Rightarrow> bool\"\n          (\"_ \\<turnstile>* _ :vr _\" [30,0,20] 80) where\n\n  v_t_prim     : \"\\<Xi> \\<turnstile> VPrim l :v TPrim (lit_type l)\"\n\n| v_t_product  : \"\\<lbrakk> \\<Xi> \\<turnstile> a :v t \n                  ; \\<Xi> \\<turnstile> b :v u \n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VProduct a b :v TProduct t u\"\n\n| v_t_sum      : \"\\<lbrakk> \\<Xi> \\<turnstile> a :v t \n                  ; (g, t) \\<in> set ts \n                  ; distinct (map fst ts)\n                  ; [] \\<turnstile>* map snd ts wellformed\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VSum g a :v TSum ts\"\n\n| v_t_record   : \"\\<lbrakk> \\<Xi> \\<turnstile>* fs :vr ts \n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VRecord fs :v TRecord ts s\"  \n\n| v_t_abstract : \"\\<lbrakk> abs_typing a n ts\n                  ; [] \\<turnstile>* ts wellformed\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VAbstract a :v TCon n ts s\"\n\n| v_t_afun     : \"\\<lbrakk> \\<Xi> f = (ks, a, b)\n                  ; list_all2 (kinding []) ts ks\n                  ; ks \\<turnstile> TFun a b wellformed\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VAFunction f ts :v TFun (instantiate ts a) (instantiate ts b)\" \n\n| v_t_function : \"\\<lbrakk> \\<Xi> , K , [ Some t ] \\<turnstile> f : u\n                  ; K \\<turnstile> t wellformed\n                  ; list_all2 (kinding []) ts K\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VFunction f ts :v TFun (instantiate ts t) (instantiate ts u)\"\n\n| v_t_unit     : \"\\<Xi> \\<turnstile> VUnit :v TUnit\"\n          \n| v_t_r_empty  : \"\\<Xi> \\<turnstile>* [] :vr []\"\n\n| v_t_r_cons1  : \"\\<lbrakk> \\<Xi> \\<turnstile> x :v t\n                  ; \\<Xi> \\<turnstile>* xs :vr ts\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile>* (x # xs) :vr ((t, False) # ts)\"\n\n| v_t_r_cons2  : \"\\<lbrakk> \\<Xi> \\<turnstile>* xs :vr ts\n                  ; [] \\<turnstile> t wellformed\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile>* (x # xs) :vr ((t, True) # ts)\"\n\n\nlemma v_t_prim' [intro]:\nassumes \"lit_type l = \\<tau>\"\nshows   \"\\<Xi> \\<turnstile> VPrim l :v TPrim \\<tau>\"\nusing assms by (auto intro: v_t_prim)\n\ninductive_cases v_t_funE      [elim]: \"\\<Xi> \\<turnstile> VFunction f ts :v t\" \ninductive_cases v_t_afunE     [elim]: \"\\<Xi> \\<turnstile> VAFunction f ts :v t\" \ninductive_cases v_t_recordE   [elim]: \"\\<Xi> \\<turnstile> VRecord fs :v \\<tau>\"\ninductive_cases v_t_productE  [elim]: \"\\<Xi> \\<turnstile> VProduct a b :v \\<tau>\"\ninductive_cases v_t_sumE'     [elim]: \"\\<Xi> \\<turnstile> e :v TSum ts\"\ninductive_cases v_t_primE     [elim]: \"\\<Xi> \\<turnstile> VPrim l :v TPrim (Num \\<tau>)\"\n\n\ninductive_cases v_t_r_emptyE  [elim]: \"\\<Xi> \\<turnstile>* [] :vr \\<tau>s\"\ninductive_cases v_t_r_consE   [elim]: \"\\<Xi> \\<turnstile>* (x # xs) :vr \\<tau>s\"\n\n\ndefinition vval_typing_all :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow> ('f, 'a) vval list \\<Rightarrow> type list \\<Rightarrow> bool\"\n           (\"_  \\<turnstile>* _ :v _\" [30,0,20] 80) where\n   \"(\\<Xi> \\<turnstile>* vs :v ts) \\<equiv> list_all2 (vval_typing \\<Xi>) vs ts\" \n\ndefinition matches :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow>  ('f, 'a) vval env \\<Rightarrow> ctx \\<Rightarrow> bool\"\n           (\"_ \\<turnstile> _ matches _\" [30,0,20] 60) where \n   \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma> \\<equiv> list_all2 (\\<lambda> x m. \\<forall> \\<tau>. m = Some \\<tau> \\<longrightarrow> \\<Xi> \\<turnstile> x :v \\<tau>) \\<gamma> \\<Gamma>\"\n\n\ndefinition proc_env_matches :: \"('f \\<Rightarrow> ('f, 'a) vval \\<Rightarrow> ('f, 'a) vval \\<Rightarrow> bool) \\<Rightarrow> ('f \\<Rightarrow> poly_type) \\<Rightarrow> bool\" \n           (\"_ matches _\" [30,20] 60) where\n  \"\\<xi> matches \\<Xi> \\<equiv> (\\<forall> f. let (K, \\<tau>i, \\<tau>o) = \\<Xi> f \n                        in (\\<forall> \\<tau>s v v'. list_all2 (kinding []) \\<tau>s K \n                                  \\<longrightarrow> (\\<Xi> \\<turnstile> v  :v instantiate \\<tau>s \\<tau>i)\n                                  \\<longrightarrow> \\<xi> f v v'\n                                  \\<longrightarrow> (\\<Xi> \\<turnstile> v' :v instantiate \\<tau>s \\<tau>o)))\"\n\n\nsection {* vval_typing lemmas *}\n\nlemma vval_typing_to_kinding: \nshows \"\\<Xi> \\<turnstile> v :v \\<tau>     \\<Longrightarrow> [] \\<turnstile> \\<tau> wellformed\"\nand   \"\\<Xi> \\<turnstile>* vs :vr fs \\<Longrightarrow> [] \\<turnstile>* map fst fs wellformed\"\nproof (induct rule: vval_typing_vval_typing_record.inducts)\n     case v_t_function then show ?case by (force dest!: typing_to_kinding\n                                                 intro: kinding_kinding_all_kinding_record.intros\n                                                        substitutivity)\nnext case v_t_afun     then show ?case by (force dest: substitutivity)\nqed (auto intro: kinding_kinding_all_kinding_record.intros supersumption kinding_all_record')\n\nlemma vval_typing_bang:\nshows  \"\\<Xi> \\<turnstile> x :v \\<tau> \\<Longrightarrow> \\<Xi> \\<turnstile> x :v bang \\<tau>\"\nand    \"\\<Xi> \\<turnstile>* fs :vr \\<tau>s \\<Longrightarrow> \\<Xi> \\<turnstile>* fs :vr map (\\<lambda> (x, y). (bang x, y)) \\<tau>s\"\nproof (induct rule: vval_typing_vval_typing_record.inducts)\n     case v_t_sum      then show ?case by (force intro: vval_typing_vval_typing_record.intros \n                                                        bang_kind(2) [ where ts = \"map snd ts\" for ts\n                                                                     , simplified]) \nnext case v_t_abstract then show ?case by (force intro: vval_typing_vval_typing_record.intros \n                                                        abs_typing_bang \n                                                        bang_kind(2))\nnext case v_t_r_cons2  then show ?case by (force intro: vval_typing_vval_typing_record.intros \n                                                        bang_kind)\nqed (force intro: vval_typing_vval_typing_record.intros)+\n\nsubsection {* vval_typing_record *}\n\nlemma vval_typing_record_length:\nassumes \"\\<Xi> \\<turnstile>* fs :vr \\<tau>s\"\nshows   \"length fs = length \\<tau>s\"\nusing assms proof (induct fs arbitrary: \\<tau>s)\nqed (auto)\n\nlemma vval_typing_record_nth:\nassumes \"\\<Xi> \\<turnstile>* fs :vr \\<tau>s\"\nand     \"\\<tau>s ! f = (\\<tau>, False)\"\nand     \"f < length \\<tau>s\"\nshows   \"\\<Xi> \\<turnstile> fs ! f :v \\<tau>\"\nusing assms proof (induct fs arbitrary: f \\<tau>s)\n     case Nil  then show ?case by (auto) \nnext case Cons then show ?case by (case_tac f, auto) \nqed\n\n\nlemma vval_typing_all_record:\nassumes \"\\<Xi> \\<turnstile>* vs :v ts\"\nshows \"\\<Xi> \\<turnstile>* vs :vr zip ts (replicate (length ts) False)\"\nusing assms[simplified vval_typing_all_def] proof (induct rule: list_all2_induct)\nqed (auto intro: vval_typing_vval_typing_record.intros)\n\nlemma vval_typing_record_take:\nassumes \"\\<Xi> \\<turnstile>* ts :vr \\<tau>s\" \nand     \"\\<tau>s ! f = (t, False)\"\nand     \"[] \\<turnstile> t :\\<kappa> k\"\nand     \"S \\<in> k \\<or> taken\"\nshows   \"\\<Xi> \\<turnstile>* ts :vr \\<tau>s[ f := (t, taken) ]\"\nusing assms proof (induct ts arbitrary: \\<tau>s f)\n     case Nil  then show ?case by ( force intro: vval_typing_vval_typing_record.intros)\nnext case Cons then show ?case by ( cases taken\n                                  , (force split: nat.split \n                                           intro: vval_typing_vval_typing_record.intros)+ )\nqed\n\nlemma vval_typing_record_put:\nassumes \"\\<Xi> \\<turnstile>* ts :vr \\<tau>s\" \nand     \"\\<tau>s ! f = (t, taken)\"\nand     \"[] \\<turnstile> t :\\<kappa> k\"\nand     \"D \\<in> k \\<or> taken\"\nand     \"\\<Xi> \\<turnstile> v :v t\"\nshows   \"\\<Xi> \\<turnstile>* ts[ f := v ] :vr \\<tau>s[ f := (t, False) ]\"\nusing assms proof (induct ts arbitrary: \\<tau>s f)\n     case Nil  then show ?case by ( force intro: vval_typing_vval_typing_record.intros)\nnext case Cons then show ?case by ( cases taken\n                                  , (fastforce split: nat.split \n                                               intro: vval_typing_vval_typing_record.intros)+ )\nqed\n\nsubsection {* Sums and subtyping *}\n\nlemma width_subtyping: \nassumes \"set ts \\<subseteq> set us\"\nand     \"\\<Xi> \\<turnstile> v :v TSum ts\"\nand     \"[] \\<turnstile> TSum us wellformed\"\nshows   \"\\<Xi> \\<turnstile> v :v TSum us\"\nusing assms \nby (force intro: vval_typing_vval_typing_record.intros)\n\nlemma sum_downcast:\nassumes \"\\<Xi> \\<turnstile> VSum t v :v TSum ts\"\nand     \"t \\<noteq> t'\"\nshows   \"\\<Xi> \\<turnstile> VSum t v :v TSum (filter (\\<lambda> x. fst x \\<noteq> t') ts)\"\nproof -\nhave 1: \"(\\<lambda> x. x \\<noteq> t') \\<circ> fst = (\\<lambda> x. fst x \\<noteq> t')\" by (auto)\nhave 2: \"map fst [ x \\<leftarrow> ts. fst x \\<noteq> t' ] = [ x \\<leftarrow> map fst ts. x \\<noteq> t' ]\"by (simp add: 1 filter_map)\nwith assms show ?thesis by (fastforce intro: vval_typing_vval_typing_record.intros \n                                             kinding_all_subset)\nqed\n\nsubsection {* Introductions under instantiations *}\n\ntext {* An alternative introduction rule used for showing a value is a function under some type instantiation *}\n\nlemma v_t_afun_instantiate:\nassumes \"list_all2 (kinding K') ts K\"\nand     \"list_all2 (kinding []) \\<delta> K'\"\nand     \"K \\<turnstile> t wellformed\"\nand     \"K \\<turnstile> u wellformed\"\nand     \"\\<Xi> f = (K, t, u)\"\nshows   \"\\<Xi> \\<turnstile> VAFunction f (map (instantiate \\<delta>) ts) :v TFun (instantiate \\<delta> (instantiate ts t))\n                                                           (instantiate \\<delta> (instantiate ts u))\"\nproof -\nfrom assms have \"TFun (instantiate \\<delta> (instantiate ts t))\n                      (instantiate \\<delta> (instantiate ts u))\n               = TFun (instantiate (map (instantiate \\<delta>) ts) t)\n                      (instantiate (map (instantiate \\<delta>) ts) u)\"\n           by (force intro: instantiate_instantiate dest: list_all2_lengthD)\nwith assms show ?thesis by (force intro: vval_typing_vval_typing_record.intros \n                                         list_all2_substitutivity\n                                         kinding_kinding_all_kinding_record.intros)\nqed\n\nlemma v_t_function_instantiate:\n  assumes \"\\<Xi>, K, [Some t] \\<turnstile> f : u\"\n  and     \"K \\<turnstile> t wellformed\"\n  and     \"list_all2 (kinding []) \\<delta> K'\"\n  assumes \"list_all2 (kinding K') ts K\"\n  shows   \"\\<Xi> \\<turnstile> VFunction f (map (instantiate \\<delta>) ts) :v TFun (instantiate \\<delta> (instantiate ts t))\n                                                            (instantiate \\<delta> (instantiate ts u))\"\nproof -\nfrom assms have \"TFun (instantiate \\<delta> (instantiate ts t))\n                      (instantiate \\<delta> (instantiate ts u))\n               = TFun (instantiate (map (instantiate \\<delta>) ts) t)\n                      (instantiate (map (instantiate \\<delta>) ts) u)\" \n           by (force intro: instantiate_instantiate dest: list_all2_lengthD dest!: typing_to_kinding)\nwith assms show ?thesis by (force intro: vval_typing_vval_typing_record.intros \n                                         list_all2_substitutivity\n                                         kinding_kinding_all_kinding_record.intros)\nqed\n\nsection {* matches lemmas *}\n\nsubsection {* matches + context manipulation *}\nlemma matches_split':\nassumes \"[] \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>1\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>2\"\nusing assms proof (induct arbitrary: \\<gamma> rule: split.induct)\n     case split_empty\n       case 1 then show ?case by simp\n       case 2 then show ?case by simp\nnext case split_cons note prems = this\n       case 1 with prems show ?case by (force simp:  matches_def \n                                              iff:   list_all2_Cons2 \n                                              elim!: split_comp.cases)\n       case 2 with prems show ?case by (force simp:  matches_def \n                                              iff:   list_all2_Cons2 \n                                              elim!: split_comp.cases)\nqed\n\nlemma matches_split: \nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"list_all2 (kinding []) \\<tau>s K\" \nand     \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>1)\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>2)\"\nusing assms by (auto intro: matches_split' instantiate_ctx_split)\n\n\nlemma matches_split2: \nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"list_all2 (kinding []) \\<tau>s K\" \nand     \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\nshows   \"(\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>1)) \\<and> (\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>2))\"\nusing assms by (auto dest: matches_split)\n\n\nlemma matches_splitE:\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"list_all2 (kinding []) \\<tau>s K\" \nand     \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\nand     \"\\<lbrakk> \\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>1) ; \\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>2) \\<rbrakk> \\<Longrightarrow> P\"\nshows   \"P\"\nusing assms by (auto dest: matches_split2)\n\n\nlemma matches_split_bang':\nassumes \"split_bang [] vs \\<Gamma> \\<Gamma>1 \\<Gamma>2\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>1\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>2\"\nusing assms proof (induct arbitrary: \\<gamma> rule: split_bang.induct)\n     case split_bang_empty\n       case 1 then show ?case by simp\n       case 2 then show ?case by simp\nnext case split_bang_cons note prems = this\n       case 1 with prems show ?case by (force simp:  matches_def \n                                              iff:   list_all2_Cons2 \n                                              elim!: split_comp.cases)\n       case 2 with prems show ?case by (force simp:  matches_def \n                                              iff:   list_all2_Cons2 \n                                              elim!: split_comp.cases)\nnext case split_bang_bang note prems = this\n       case 1 with prems show ?case by (force simp: matches_def\n                                              iff:  list_all2_Cons2\n                                              dest: vval_typing_bang) \n       case 2 with prems show ?case by (force simp: matches_def\n                                              iff:  list_all2_Cons2\n                                              dest: vval_typing_bang)\nqed\n\n\nlemma matches_split_bang: \nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"list_all2 (kinding []) \\<tau>s K\" \nand     \"split_bang K vs \\<Gamma> \\<Gamma>1 \\<Gamma>2\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>1)\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>2)\"\nusing assms by (auto intro: matches_split_bang' instantiate_ctx_split_bang)\n\nlemma matches_weakening':\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nand     \"[] \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>'\"\nusing assms(2) [simplified weakening_def]\n  and assms(1) proof(induct  arbitrary: \\<gamma> rule: list_all2_induct)\n     case Nil  then show ?case by simp\nnext case Cons then show ?case by (force simp:  matches_def\n                                         iff:   list_all2_Cons2\n                                         elim!: weakening_comp.cases)\nqed\n\nlemma matches_weakening:\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"K \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>')\"\nusing assms by (auto dest: instantiate_ctx_weaken intro: matches_weakening')\n\nlemma matches_cons':\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nand     \"\\<Xi> \\<turnstile> x :v \\<tau>\"\nshows   \"\\<Xi> \\<turnstile> (x # \\<gamma>) matches (Some \\<tau> # \\<Gamma>)\"  \nusing assms by (simp add: matches_def)\n\nlemma matches_cons:\nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"\\<Xi> \\<turnstile> x :v instantiate \\<tau>s \\<tau>\"\nshows   \"\\<Xi> \\<turnstile> (x # \\<gamma>) matches (instantiate_ctx \\<tau>s (Some \\<tau> # \\<Gamma>))\"  \nusing assms by (auto intro: matches_cons')\n\nlemma matches_empty':\nshows \"\\<Xi> \\<turnstile> [] matches []\"\nby (simp add: matches_def)\n\nlemma matches_empty:\nshows \"\\<Xi> \\<turnstile> [] matches instantiate_ctx \\<tau>s []\" \nby (simp add: matches_empty' instantiate_ctx_def)\n\nsubsection {* other matches properties *}\n\nlemma matches_length:\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nshows   \"length \\<gamma> = length \\<Gamma>\"\nusing assms by (simp add: matches_def list_all2_lengthD)\n\nlemma matches_proj':\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nand     \"i < length \\<Gamma>\"\nand     \"\\<Gamma> ! i = Some \\<tau>\"\nshows   \"\\<Xi> \\<turnstile> (\\<gamma> ! i) :v \\<tau>\"\nusing assms by (auto dest: list_all2_nthD2\n                     simp: matches_def  \n                     intro: vval_typing_vval_typing_record.intros)\n\nlemma matches_proj:\nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"i < length \\<Gamma>\"\nand     \"\\<Gamma> ! i = Some \\<tau>\"\nshows   \"\\<Xi> \\<turnstile> (\\<gamma> ! i) :v instantiate \\<tau>s \\<tau>\"\nusing assms by (auto intro: matches_proj' simp: instantiate_ctx_def)\n\n\nsection {* procedure environment matches *}\nlemma proc_env_matches_abstract:\nassumes \"\\<xi> matches \\<Xi>\"\nand     \"\\<Xi> f = (K, \\<tau>i, \\<tau>o)\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi> \\<turnstile> v    :v instantiate \\<tau>s \\<tau>i\"\nand     \"\\<xi> f v v'\"\nshows   \"\\<Xi> \\<turnstile> v' :v instantiate \\<tau>s \\<tau>o\"\nusing assms by ( clarsimp simp: proc_env_matches_def\n               , drule_tac x = f in spec\n               , auto)\n\n\nsection {* Type Safety *}\n\ntheorem progress:\nassumes \"\\<Xi>, K, \\<Gamma> \\<turnstile> e : \\<tau>\" \nand     \"\\<xi> matches \\<Xi>\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nshows   \"\\<exists>! v. \\<xi>, \\<gamma> \\<turnstile> specialise \\<tau>s e \\<Down> v\"\noops\n\nlemma v_t_map_TPrimD:\n  \"\\<Xi> \\<turnstile>* vs :v map TPrim \\<tau>s\n    \\<Longrightarrow> \\<exists>lits. vs = map VPrim lits \\<and> map lit_type lits = \\<tau>s\"\n  unfolding vval_typing_all_def list_all2_map2\n  apply (induct rule: list_all2_induct, simp_all)\n  apply clarsimp\n  apply (erule vval_typing.cases, simp_all)\n  apply (rule exI[where x=\"x # xs\" for x xs], simp)\n  done\n\nlemma eval_prim_preservation:\nassumes \"prim_op_type p = (\\<tau>s, \\<tau>)\"\nand     \"\\<Xi> \\<turnstile>* vs :v map TPrim \\<tau>s\"\nshows   \"\\<Xi> \\<turnstile>  eval_prim p vs :v TPrim \\<tau>\"\nusing assms v_t_prim[where \\<Xi>=\\<Xi> and l=\"case eval_prim p vs of VPrim v \\<Rightarrow> v\"]\nby (clarsimp simp add: eval_prim_def o_def eval_prim_op_lit_type dest!: v_t_map_TPrimD)\n\ntheorem preservation: \nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"proc_ctx_wellformed \\<Xi>\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"\\<xi> matches \\<Xi>\"\nshows   \"\\<lbrakk> \\<xi>, \\<gamma> \\<turnstile>  specialise \\<tau>s e \\<Down> v  ; \\<Xi>, K, \\<Gamma> \\<turnstile>  e  : \\<tau>  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile>  v  :v instantiate \\<tau>s \\<tau>\"\nand     \"\\<lbrakk> \\<xi>, \\<gamma> \\<turnstile>* map (specialise \\<tau>s) es \\<Down> vs ; \\<Xi>, K, \\<Gamma> \\<turnstile>* es : \\<tau>s' \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile>* vs :v map (instantiate \\<tau>s) \\<tau>s'\"\nusing assms proof (induct \"specialise \\<tau>s e\"        v \n                      and \"map (specialise \\<tau>s) es\" vs \n                      arbitrary: e  \\<tau>s K \\<tau>   \\<Gamma> \n                             and es \\<tau>s K \\<tau>s' \\<Gamma> \n                      rule: v_sem_v_sem_all.inducts) \n     case v_sem_var     then show ?case by ( case_tac e, simp_all\n                                           , fastforce dest:  matches_weakening \n                                                       intro: matches_proj \n                                                       simp:  empty_length empty_def)\nnext case v_sem_lit     then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: vval_typing_vval_typing_record.intros)\nnext case v_sem_prim    then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: eval_prim_preservation)\nnext case v_sem_cast    then show ?case by ( case_tac e, simp_all\n                                           , fastforce elim!: upcast_valid_cast_to)\nnext case v_sem_afun    then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: v_t_afun_instantiate)\nnext case v_sem_fun     then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: v_t_function_instantiate)\nnext case v_sem_con     then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: vval_typing_vval_typing_record.intros\n                                                       dest:  substitutivity)\nnext case v_sem_promote then show ?case by ( case_tac e, simp_all\n                                           , fastforce dest!: width_subtyping [OF set_subset_map ]\n                                                       intro: kinding_kinding_all_kinding_record.intros \n                                                              substitutivity(2) [ where ts = \"map snd ts\" for ts\n                                                                                , simplified])\nnext case v_sem_member  then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: vval_typing_record_nth)\nnext case v_sem_unit    then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: vval_typing_vval_typing_record.intros) \nnext case v_sem_tuple   then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: matches_split\n                                                              vval_typing_vval_typing_record.intros) \nnext case v_sem_case_m  then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: matches_split \n                                                              matches_cons [simplified]\n                                                       dest:  distinct_fst)\nnext case v_sem_case_nm then show ?case apply ( case_tac e, simp_all)\n                                        apply ( clarsimp elim!: typing_caseE)\n                                        apply ( rule v_sem_case_nm(5),simp+\n                                              , (fastforce dest:  matches_split2 \n                                                           intro!: matches_cons [ where \\<tau> = \"TSum ts\" for ts\n                                                                                , simplified]\n                                                                   sum_downcast \n                                                           simp:   map_filter_fst [ where P = \"\\<lambda>x. x \\<noteq> t\" for t ])+ )\n                                        done (* TODO proper automation *)\nnext case v_sem_esac    then show ?case by ( case_tac e, simp_all\n                                           , fastforce)\nnext case v_sem_let     then show ?case by ( case_tac e, simp_all\n                                           , fastforce dest:   matches_split\n                                                       intro!: matches_cons [simplified])\nnext case v_sem_letbang then show ?case by ( case_tac e, simp_all\n                                           , fastforce dest:   matches_split_bang\n                                                       intro!: matches_cons [simplified])\nnext case v_sem_if      then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro:  matches_split\n                                                       split:  split_if_asm) \nnext case v_sem_struct  then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: vval_typing_vval_typing_record.intros  \n                                                              vval_typing_all_record [ where ts = \"map f ts\" for f ts\n                                                                                     , simplified])\nnext case v_sem_take    then show ?case apply (case_tac e, simp_all, clarsimp elim!: typing_takeE)\n                                        apply (drule(2) matches_split2)\n                                        apply (fastforce intro!: matches_cons \n                                                                 vval_typing_vval_typing_record.intros \n                                                                 vval_typing_record_take \n                                                                 vval_typing_record_nth\n                                                         simp:   map_update\n                                                         intro:  substitutivity)\n                                        done (* TODO automate properly *)\nnext case v_sem_put     then show ?case by ( case_tac e, simp_all\n                                           , fastforce simp:  map_update \n                                                       intro: vval_typing_vval_typing_record.intros \n                                                              vval_typing_record_put\n                                                              substitutivity \n                                                              matches_split)\nnext case v_sem_split   then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro!: matches_cons \n                                                       intro:  matches_split)\nnext case (v_sem_app \\<xi> \\<gamma> x ea ts y a r e \\<tau>s K \\<tau> \\<Gamma>)\nnote IH1  = this(2)\nand  IH2  = this(4)\nand  IH3  = this(6)\nand  rest = this(1,3,5,7-)\nfrom rest show ?case\n  apply (case_tac e, simp_all)\n  apply (clarsimp)\n  apply (fastforce elim!: typing_appE\n                   dest!: IH1 [OF _ _ _ _ matches_split(1)]\n                          IH2 [OF _ _ _ _ matches_split(2)]\n                   intro: IH3\n                   simp:  matches_def\n                          instantiate_ctx_def).\nnext case v_sem_abs_app\nnote IH1  = this(2)\nand  IH2  = this(4)\nand  rest = this(1,3,5-)\nfrom rest show ?case\n  apply (case_tac e, simp_all)\n  apply (clarsimp elim!: typing_appE)\n  apply (frule(7) IH1 [OF _ _ _ _ matches_split(1)])\n  apply (frule(7) IH2 [OF _ _ _ _ matches_split(2)])\n  apply (fastforce intro: proc_env_matches_abstract).\nnext case v_sem_all_empty then show ?case by ( case_tac es, simp_all\n                                             , fastforce simp: vval_typing_all_def)\nnext case v_sem_all_cons  then show ?case by ( case_tac es, simp_all\n                                             , fastforce simp: vval_typing_all_def\n                                                         dest: matches_split)\nqed\n   \n\n(* TODO: \n    - A-normal.\n*)\n\nlemma order_listsum: \"x \\<in> set es \\<Longrightarrow> x < Suc (listsum es)\"\n  apply (simp add: set_conv_nth)\n  apply (induct es)\n  apply (clarsimp)\n  apply (clarsimp)\n  apply (case_tac i)\n  apply (clarsimp)\n  apply (clarsimp)\n  apply (atomize)\n  apply (drule mp)\n  apply (force)\n  apply (simp)\n  done\n\nfunction monoexpr :: \"'f expr \\<Rightarrow> ('f \\<times> type list) expr\" where\n  \"monoexpr (AFun f ts)       = AFun (f, ts) []\"\n| \"monoexpr (Fun f ts)        = Fun (monoexpr (specialise ts f)) []\"\n| \"monoexpr (Var i)           = Var i\"\n| \"monoexpr (Prim p es)       = Prim p (map (monoexpr) es)\"\n| \"monoexpr (App a b)         = App (monoexpr a) (monoexpr b)\"\n| \"monoexpr (Con as t e)      = Con as t (monoexpr e)\" \n| \"monoexpr (Promote as e)    = Promote as (monoexpr e)\"\n| \"monoexpr (Struct ts vs)    = Struct ts (map (monoexpr) vs)\"\n| \"monoexpr (Member v f)      = Member (monoexpr v) f\"\n| \"monoexpr (Unit)            = Unit\"\n| \"monoexpr (Cast t e)        = Cast t (monoexpr e)\"\n| \"monoexpr (Lit v)           = Lit v\"\n| \"monoexpr (Tuple a b)       = Tuple (monoexpr a) (monoexpr b)\"\n| \"monoexpr (Put e f e')      = Put (monoexpr e) f (monoexpr e')\"\n| \"monoexpr (Let e e')        = Let (monoexpr e) (monoexpr e')\"\n| \"monoexpr (LetBang vs e e') = LetBang vs (monoexpr e) (monoexpr e')\"\n| \"monoexpr (Case e t a b)    = Case (monoexpr e) t (monoexpr a) (monoexpr b)\"\n| \"monoexpr (Esac e)          = Esac (monoexpr e)\"\n| \"monoexpr (If c t e)        = If (monoexpr c) (monoexpr t) (monoexpr e)\"\n| \"monoexpr (Take e f e')     = Take (monoexpr e) f (monoexpr e')\"\n| \"monoexpr (Split v va)      = Split (monoexpr v) (monoexpr va)\"\n             by (case_tac x, auto)\n termination by (relation \"measure expr_size\", auto simp: order_listsum)\n \nfun monoval :: \"('f, 'a) vval \\<Rightarrow> ('f \\<times> type list, 'a) vval\"\nwhere \"monoval (VPrim lit) = VPrim lit\"\n    | \"monoval (VProduct t u) = VProduct (monoval t) (monoval u)\"\n    | \"monoval (VSum name v) = VSum name (monoval v)\"\n    | \"monoval (VRecord vs) = VRecord (map monoval vs)\"\n    | \"monoval (VAbstract t) = VAbstract t\"\n    | \"monoval (VAFunction f ts) = VAFunction (f, ts) []\"\n    | \"monoval (VFunction f ts) = VFunction (monoexpr (specialise ts f)) []\"\n    | \"monoval VUnit = VUnit\"\n\n\ndefinition monoprog :: \"('f, 'a) vabsfuns \\<Rightarrow> (('f \\<times> type list), 'a) vabsfuns \\<Rightarrow> bool\"\nwhere \"monoprog \\<xi> \\<xi>' \\<equiv> \\<forall>f \\<tau>s. (\\<forall>v v'. \\<xi> f v v' \\<longleftrightarrow> \\<xi>' (f, \\<tau>s) (monoval v) (monoval v'))\"\n\n\nlemma member_nth_map: \"f < length fs \\<Longrightarrow> \\<xi>', map monoval \\<gamma> \\<turnstile> Member (monoexpr e) f \\<Down> monoval (fs ! f) =  \\<xi>' , map monoval \\<gamma> \\<turnstile> Member (monoexpr e) f \\<Down> (map monoval fs) ! f\"\nby (subst nth_map, simp_all)\nthm v_sem_prim\n\nlemma v_sem_prim': \"\\<xi> , \\<gamma> \\<turnstile>* as \\<Down> as' \\<Longrightarrow> eval_prim p as' = r \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Prim p as \\<Down> r\" \nby (force dest: sym intro: v_sem_prim)\n\nlemma monoval_vprim [simp]: \"monoval \\<circ> VPrim = VPrim\" by (rule ext, simp)\n\nlemma eval_prim_type_change:\nassumes \"(eval_prim :: prim_op \\<Rightarrow> ('f1, 'a1) vval list \\<Rightarrow> ('f1, 'a1) vval) p (map VPrim lits) = VPrim l\"\nshows \"(eval_prim :: prim_op \\<Rightarrow> ('f2, 'a2) vval list \\<Rightarrow> ('f2, 'a2) vval) p (map VPrim lits) = VPrim l\"\nproof -\nhave helper: \"(\\<lambda>vv. case vv of VPrim v \\<Rightarrow> v | _ \\<Rightarrow> LBool False) \\<circ> VPrim = id\" by (rule ext, simp)  \nthen show ?thesis using assms by (simp add: eval_prim_def helper)\nqed\n\nlemma mono_correct:\nassumes \"\\<xi> matches \\<Xi>\"\nand     \"proc_ctx_wellformed \\<Xi>\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nand     \"monoprog \\<xi> \\<xi>'\"\nshows   \"\\<xi>, \\<gamma> \\<turnstile> e \\<Down> e' \\<Longrightarrow>  \\<Xi>, [], \\<Gamma> \\<turnstile> e : \\<tau>    \\<Longrightarrow> \\<xi>', map monoval \\<gamma> \\<turnstile> monoexpr e \\<Down> monoval e'\"\nand     \"\\<xi>, \\<gamma> \\<turnstile>* es \\<Down> es' \\<Longrightarrow> \\<Xi>, [], \\<Gamma> \\<turnstile>* es : \\<tau>s \\<Longrightarrow> \\<xi>', map monoval \\<gamma> \\<turnstile>* map monoexpr es \\<Down> map monoval es'\"\nusing assms proof (induct \\<xi> \\<gamma> e e'\n                      and \\<xi> \\<gamma> es es'\n               arbitrary: \\<tau> \\<Gamma> \n                      and \\<tau>s \\<Gamma>\n                    rule: v_sem_v_sem_all.inducts)\ncase v_sem_app\nnote IH1 = this(2)\nand  IH2 = this(4)\nand  IH3 = this(6)\nand  rest = this(1,3,5,7-)\nthen show ?case\n  apply (clarsimp)\n  apply (erule typing_appE)\n  apply (rule, erule(5) IH1 [OF _ _ _ matches_split'(1), simplified], erule(5) IH2 [OF _ _ _ matches_split'(2), simplified])\n  apply (simp)\n  apply (frule(5) preservation(1) [where \\<tau>s = \"[]\" and K = \"[]\", OF _ _ matches_split'(1), simplified])\n  apply (frule(5) preservation(1) [where \\<tau>s = \"[]\" and K = \"[]\", OF _ _ matches_split'(2), simplified])\n  apply (auto elim!: v_t_funE\n              intro: IH3 [simplified] specialisation\n              simp:  matches_def instantiate_ctx_def)\ndone\nnext case v_sem_abs_app\nnote IH1  = this(2)\nand  IH2  = this(4)\nand  rest = this(1,3,5-)\nthen show ?case \n  apply (clarsimp)\n  apply (erule typing_appE)\n  apply (rule v_sem_v_sem_all.v_sem_abs_app, erule(5) IH1 [OF _ _ _ matches_split'(1), simplified], erule(5) IH2 [OF _ _ _ matches_split'(2), simplified])\n  apply (simp add: monoprog_def)\ndone\nnext case v_sem_var then show ?case by (simp, metis matches_length nth_map typing_varE v_sem_v_sem_all.v_sem_var)\nnext case v_sem_lit then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_lit)\nnext case v_sem_fun then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_fun)\nnext case v_sem_afun then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_afun)\nnext case v_sem_cast then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_cast)\nnext case v_sem_con then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_con)\nnext case v_sem_promote then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_promote)\nnext case v_sem_unit then show ?case by (simp add: v_sem_v_sem_all.v_sem_unit)\nnext case v_sem_tuple then show ?case by (clarsimp elim!: typing_tupleE simp: matches_split' v_sem_v_sem_all.v_sem_tuple)\nnext case v_sem_esac then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_esac)\nnext case v_sem_take\nnote IH1 = this(2)\nand  IH2 = this(4)\nand rest = this(1,3,5-)\nfrom rest show ?case\n  apply (clarsimp elim!: typing_takeE)\n  apply (frule(1) matches_split'(1))\n  apply (frule(1) matches_split'(2))\n  apply (rule v_sem_v_sem_all.v_sem_take)\n   apply (frule(5) IH1[simplified])\n  apply (frule(4) preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified, rotated -3])\n  apply (erule v_t_recordE, simp)\n  apply (frule(2) IH2[simplified])\n    apply (rule matches_cons')\n     apply (rule matches_cons')\n      apply (simp)\n     apply (frule(3) vval_typing_record_take)\n     apply (rule)\n     apply (simp)\n    apply (frule(4) vval_typing_record_nth)\n  apply (simp add: vval_typing_record_length)\ndone\nnext case v_sem_all_empty then show ?case by (simp add: v_sem_v_sem_all.v_sem_all_empty)\nnext case v_sem_all_cons then show ?case by (auto elim!: typing_all_consE dest: matches_split' intro!: v_sem_v_sem_all.intros)\nnext case v_sem_split \nnote IH1 = this(2)\nand  IH2 = this(4)\nand rest = this(1,3,5-)\nfrom rest show ?case\n  apply (clarsimp elim!: typing_splitE)\n  apply (frule(1) matches_split'(1))\n  apply (frule(1) matches_split'(2)) \n  apply (rule v_sem_v_sem_all.v_sem_split)\n   apply (frule(5) IH1[simplified])\n   apply (force dest: preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified, rotated -3]\n                      IH2\n                simp: matches_def\n                elim: v_t_productE)\ndone\nnext case v_sem_member then show ?case\n  apply (clarsimp elim!: typing_memberE)\n  apply (subst member_nth_map\n        , (force dest:preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified] elim!: v_t_recordE dest: vval_typing_record_length intro: v_sem_v_sem_all.intros)+\n        )\ndone\nnext case v_sem_prim \nnote IH = this(2)\nand rest = this(1,3-)\nfrom rest show ?case\n  apply (clarsimp elim!: typing_primE)\n  apply (frule(4) preservation(2) [where \\<tau>s = \"[]\" and K = \"[]\", simplified])\n  apply (frule v_t_map_TPrimD)\n  apply (clarsimp)\n  apply (frule eval_prim_preservation)\n  apply (simp)\n  apply (erule vval_typing.cases, simp_all)\n  apply (rule v_sem_prim')\n  apply (clarsimp)\n  apply (erule(4) IH)\n  apply (force intro: eval_prim_type_change)\ndone\nnext case v_sem_struct then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_struct)\nnext case v_sem_case_m then show ?case\n  apply (clarsimp elim!: typing_caseE)\n  apply (frule(1) matches_split'(1))\n  apply (frule(1) matches_split'(2))\n  apply (rule v_sem_v_sem_all.intros, fastforce)\n  apply (frule(4) preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified, rotated -3])\n  apply (erule v_t_sumE', simp)\n  apply (metis distinct_fst matches_cons')\ndone\nnext case v_sem_case_nm \nnote IH1 = this(2)\nand  IH2 = this(5)\nand rest = this(1,3-4,6-)\nfrom rest show ?case\n  apply (clarsimp elim!: typing_caseE)\n  apply (frule(1) matches_split'(1))\n  apply (frule(1) matches_split'(2))\n  apply (rule v_sem_v_sem_all.intros, frule(6) IH1[simplified])\n  apply (frule(3) IH2[OF _ _ _ matches_cons', simplified])\n  apply (auto intro: sum_downcast dest:preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified])\ndone\nnext case v_sem_let\nnote IH1 = this(2)\nand  IH2 = this(4)\nand rest = this(1,3,5-) \nfrom rest show ?case\n  apply (clarsimp elim!: typing_letE)\n  apply (frule(1) matches_split'(1))\n  apply (frule(1) matches_split'(2))\n  apply (frule(4) preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified])\n  apply (erule(4) v_sem_v_sem_all.v_sem_let [OF IH1])\n  apply (frule(5) IH2 [OF _ _ _ matches_cons', simplified])\n  apply simp\ndone\nnext case v_sem_letbang\nnote IH1 = this(2)\nand  IH2 = this(4)\nand rest = this(1,3,5-) \nfrom rest show ?case\n  apply (clarsimp elim!: typing_letbE)\n  apply (frule(1) matches_split_bang'(1))\n  apply (frule(1) matches_split_bang'(2))\n  apply (frule(4) preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified])\n  apply (erule(4) v_sem_v_sem_all.v_sem_letbang [OF IH1])\n  apply (frule(5) IH2 [OF _ _ _ matches_cons', simplified])\n  apply simp\ndone\nnext case v_sem_if then show ?case by (fastforce elim!: typing_ifE dest: matches_split' intro!: v_sem_v_sem_all.v_sem_if)\nnext case v_sem_put then show ?case\n  apply (clarsimp elim!: typing_putE)\n  apply (frule(1) matches_split'(1))\n  apply (frule(1) matches_split'(2))\n  apply (fastforce simp: map_update intro: v_sem_v_sem_all.v_sem_put)\ndone\nqed\n\nend\n\nend\n", "meta": {"author": "crizkallah", "repo": "cogent", "sha": "cb16e8169d4389e32dc4aecf4eb9f57173264006", "save_path": "github-repos/isabelle/crizkallah-cogent", "path": "github-repos/isabelle/crizkallah-cogent/cogent-cb16e8169d4389e32dc4aecf4eb9f57173264006/cogent/isa/ValueSemantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6548947155710234, "lm_q2_score": 0.5234203489363239, "lm_q1q2_score": 0.3427852205407397}}
{"text": "(*  Title:      Typing_Result.thy\n    Author:     Andreas Viktor Hess, DTU\n    SPDX-License-Identifier: BSD-3-Clause\n*)\n\nsection \\<open>The Typing Result\\<close>\n\ntheory Typing_Result\nimports Typed_Model\nbegin\n\nsubsection \\<open>Locale Setup\\<close>\nlocale typing_result = typed_model arity public Ana \\<Gamma>\n  for arity::\"'fun \\<Rightarrow> nat\"\n    and public::\"'fun \\<Rightarrow> bool\"\n    and Ana::\"('fun,'var) term \\<Rightarrow> (('fun,'var) term list \\<times> ('fun,'var) term list)\"\n    and \\<Gamma>::\"('fun,'var) term \\<Rightarrow> ('fun,'atom::finite) term_type\"\n  +\n  assumes infinite_typed_consts: \"\\<And>a. infinite {c. \\<Gamma> (Fun c []) = TAtom a \\<and> public c}\"\n    and no_private_funs[simp]: \"\\<And>f. arity f > 0 \\<Longrightarrow> public f\"\nbegin\n\nsubsubsection \\<open>Minor Lemmata\\<close>\n\nlemma fun_type_inv': assumes \"\\<Gamma> t = TComp f T\" shows \"arity f > 0\" \"public f\"\nusing assms fun_type_inv by simp_all\n\nlemma infinite_public_consts[simp]: \"infinite {c. public c \\<and> arity c = 0}\"\nproof -\n  fix a::'atom\n  define A where \"A \\<equiv> {c. \\<Gamma> (Fun c []) = TAtom a \\<and> public c}\"\n  define B where \"B \\<equiv> {c. public c \\<and> arity c = 0}\"\n\n  have \"arity c = 0\" when c: \"c \\<in> A\" for c\n    using c const_type_inv unfolding A_def by blast\n  hence \"A \\<subseteq> B\" unfolding A_def B_def by blast\n  hence \"infinite B\"\n    using infinite_typed_consts[of a, unfolded A_def[symmetric]]\n    by (metis infinite_super)\n  thus ?thesis unfolding B_def by blast\nqed\n\nlemma infinite_fun_syms[simp]:\n  \"infinite {c. public c \\<and> arity c > 0} \\<Longrightarrow> infinite \\<Sigma>\\<^sub>f\"\n  \"infinite \\<C>\" \"infinite \\<C>\\<^sub>p\\<^sub>u\\<^sub>b\" \"infinite (UNIV::'fun set)\"\nby (metis \\<Sigma>\\<^sub>f_unfold finite_Collect_conjI,\n    metis infinite_public_consts finite_Collect_conjI,\n    use infinite_public_consts \\<C>pub_unfold in \\<open>force simp add: Collect_conj_eq\\<close>,\n    metis UNIV_I finite_subset subsetI infinite_public_consts(1))\n\nlemma id_univ_proper_subset[simp]: \"\\<Sigma>\\<^sub>f \\<subset> UNIV\" \"(\\<exists>f. arity f > 0) \\<Longrightarrow> \\<C> \\<subset> UNIV\"\nby (metis finite.emptyI inf_top.right_neutral top.not_eq_extremum disjoint_fun_syms\n          infinite_fun_syms(2) inf_commute)\n   (metis top.not_eq_extremum UNIV_I const_arity_eq_zero less_irrefl)\n\nlemma exists_fun_notin_funs_term: \"\\<exists>f::'fun. f \\<notin> funs_term t\"\nby (metis UNIV_eq_I finite_fun_symbols infinite_fun_syms(4))\n\nlemma exists_fun_notin_funs_terms:\n  assumes \"finite M\" shows \"\\<exists>f::'fun. f \\<notin> \\<Union>(funs_term ` M)\"\nby (metis assms finite_fun_symbols infinite_fun_syms(4) ex_new_if_finite finite_UN)\n\nlemma exists_notin_funs\\<^sub>s\\<^sub>t: \"\\<exists>f. f \\<notin> funs\\<^sub>s\\<^sub>t (S::('fun,'var) strand)\"\nby (metis UNIV_eq_I finite_funs\\<^sub>s\\<^sub>t infinite_fun_syms(4))\n\nlemma infinite_typed_consts': \"infinite {c. \\<Gamma> (Fun c []) = TAtom a \\<and> public c \\<and> arity c = 0}\"\nproof -\n  { fix c assume \"\\<Gamma> (Fun c []) = TAtom a\" \"public c\"\n    hence \"arity c = 0\" using const_type[of c] fun_type[of c \"[]\"] by auto\n  } hence \"{c. \\<Gamma> (Fun c []) = TAtom a \\<and> public c \\<and> arity c = 0} =\n           {c. \\<Gamma> (Fun c []) = TAtom a \\<and> public c}\"\n    by auto\n  thus \"infinite {c. \\<Gamma> (Fun c []) = TAtom a \\<and> public c \\<and> arity c = 0}\"\n    using infinite_typed_consts[of a] by metis\nqed\n\nlemma atypes_inhabited: \"\\<exists>c. \\<Gamma> (Fun c []) = TAtom a \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun c []) \\<and> public c \\<and> arity c = 0\"\nproof -\n  obtain c where \"\\<Gamma> (Fun c []) = TAtom a\" \"public c\" \"arity c = 0\"\n    using infinite_typed_consts'(1)[of a] not_finite_existsD by blast\n  thus ?thesis using const_type_inv[OF \\<open>\\<Gamma> (Fun c []) = TAtom a\\<close>] unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\nqed\n\nlemma atype_ground_term_ex: \"\\<exists>t. fv t = {} \\<and> \\<Gamma> t = TAtom a \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\nusing atypes_inhabited[of a] by force\n\nlemma type_ground_inhabited: \"\\<exists>t'. fv t' = {} \\<and> \\<Gamma> t = \\<Gamma> t'\"\nproof -\n  { fix \\<tau>::\"('fun, 'atom) term_type\" assume \"\\<And>f T. Fun f T \\<sqsubseteq> \\<tau> \\<Longrightarrow> 0 < arity f\"\n    hence \"\\<exists>t'. fv t' = {} \\<and> \\<tau> = \\<Gamma> t'\"\n    proof (induction \\<tau>)\n      case (Fun f T)\n      hence \"arity f > 0\" by auto\n    \n      from Fun.IH Fun.prems(1) have \"\\<exists>Y. map \\<Gamma> Y = T \\<and> (\\<forall>x \\<in> set Y. fv x = {})\"\n      proof (induction T)\n        case (Cons x X)\n        hence \"\\<And>g Y. Fun g Y \\<sqsubseteq> Fun f X \\<Longrightarrow> 0 < arity g\" by auto\n        hence \"\\<exists>Y. map \\<Gamma> Y = X \\<and> (\\<forall>x\\<in>set Y. fv x = {})\" using Cons by auto\n        moreover have \"\\<exists>t'. fv t' = {} \\<and> x = \\<Gamma> t'\" using Cons by auto\n        ultimately obtain y Y where\n            \"fv y = {}\" \"\\<Gamma> y = x\" \"map \\<Gamma> Y = X\" \"\\<forall>x\\<in>set Y. fv x = {}\" \n          using Cons by moura\n        hence \"map \\<Gamma> (y#Y) = x#X \\<and> (\\<forall>x\\<in>set (y#Y). fv x = {})\" by auto\n        thus ?case by meson \n      qed simp\n      then obtain Y where \"map \\<Gamma> Y = T\" \"\\<forall>x \\<in> set Y. fv x = {}\" by metis\n      hence \"fv (Fun f Y) = {}\" \"\\<Gamma> (Fun f Y) = TComp f T\" using fun_type[OF \\<open>arity f > 0\\<close>] by auto\n      thus ?case by (metis exI[of \"\\<lambda>t. fv t = {} \\<and> \\<Gamma> t = TComp f T\" \"Fun f Y\"])\n    qed (metis atype_ground_term_ex)\n  }\n  thus ?thesis by (metis \\<Gamma>_wf'')\nqed\n\nlemma type_wfttype_inhabited:\n  assumes \"\\<And>f T. Fun f T \\<sqsubseteq> \\<tau> \\<Longrightarrow> 0 < arity f\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m \\<tau>\"\n  shows \"\\<exists>t. \\<Gamma> t = \\<tau> \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\nusing assms\nproof (induction \\<tau>)\n  case (Fun f Y)\n  have IH: \"\\<exists>t. \\<Gamma> t = y \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m t\" when y: \"y \\<in> set Y \" for y\n  proof -\n    have \"wf\\<^sub>t\\<^sub>r\\<^sub>m y\"\n      using Fun y unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def\n      by (metis Fun_param_is_subterm term.le_less_trans) \n    moreover have \"Fun g Z \\<sqsubseteq> y \\<Longrightarrow> 0 < arity g\" for g Z\n      using Fun y by auto\n    ultimately show ?thesis using Fun.IH[OF y] by auto\n  qed\n\n  from Fun have \"arity f = length Y\" \"arity f > 0\" unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by force+\n  moreover from IH have \"\\<exists>X. map \\<Gamma> X = Y \\<and> (\\<forall>x \\<in> set X. wf\\<^sub>t\\<^sub>r\\<^sub>m x)\"\n    by (induct Y, simp_all, metis list.simps(9) set_ConsD)\n  ultimately show ?case by (metis fun_type length_map wf_trmI)\nqed (use atypes_inhabited wf\\<^sub>t\\<^sub>r\\<^sub>m_def in blast)\n\nlemma type_pgwt_inhabited: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t \\<Longrightarrow> \\<exists>t'. \\<Gamma> t = \\<Gamma> t' \\<and> public_ground_wf_term t'\"\nproof -\n  assume \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n  { fix \\<tau> assume \"\\<Gamma> t = \\<tau>\"\n    hence \"\\<exists>t'. \\<Gamma> t = \\<Gamma> t' \\<and> public_ground_wf_term t'\" using \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close>\n    proof (induction \\<tau> arbitrary: t)\n      case (Var a t)\n      then obtain c where \"\\<Gamma> t = \\<Gamma> (Fun c [])\" \"arity c = 0\" \"public c\"\n        using const_type_inv[of _ \"[]\" a] infinite_typed_consts(1)[of a]  not_finite_existsD\n        by force\n      thus ?case using PGWT[OF \\<open>public c\\<close>, of \"[]\"] by auto\n    next\n      case (Fun f Y t)\n      have *: \"arity f > 0\" \"public f\" \"arity f = length Y\"\n        using fun_type_inv[OF \\<open>\\<Gamma> t = TComp f Y\\<close>] fun_type_inv_wf[OF \\<open>\\<Gamma> t = TComp f Y\\<close> \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close>]\n        by auto\n      have \"\\<And>y. y \\<in> set Y \\<Longrightarrow> \\<exists>t'. y = \\<Gamma> t' \\<and> public_ground_wf_term t'\"\n        using Fun.prems(1) Fun.IH \\<Gamma>_wf''[of _ _ t] \\<Gamma>_wf'[OF \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close>] type_wfttype_inhabited\n        by (metis Fun_param_is_subterm term.order_trans wf_trm_subtermeq) \n      hence \"\\<exists>X. map \\<Gamma> X = Y \\<and> (\\<forall>x \\<in> set X. public_ground_wf_term x)\"\n        by (induct Y, simp_all, metis list.simps(9) set_ConsD)\n      then obtain X where X: \"map \\<Gamma> X = Y\" \"\\<And>x. x \\<in> set X \\<Longrightarrow> public_ground_wf_term x\" by moura\n      hence \"arity f = length X\" using *(3) by auto\n      have \"\\<Gamma> t = \\<Gamma> (Fun f X)\" \"public_ground_wf_term (Fun f X)\"\n        using fun_type[OF *(1), of X] Fun.prems(1) X(1) apply simp\n        using PGWT[OF *(2) \\<open>arity f = length X\\<close> X(2)] by metis\n      thus ?case by metis\n    qed\n  }\n  thus ?thesis using \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close> by auto\nqed\n\nend\n\nsubsection \\<open>The Typing Result for the Composition-Only Intruder\\<close>\ncontext typing_result\nbegin\n\nsubsubsection \\<open>Well-typedness and Type-Flaw Resistance Preservation\\<close>\ncontext\nbegin\n\nprivate lemma LI_preserves_tfr_stp_all_single:\n  assumes \"(S,\\<theta>) \\<leadsto> (S',\\<theta>')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\"\n  and \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\"\n  shows \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\"\nusing assms\nproof (induction rule: LI_rel.induct)\n  case (Compose S X f S' \\<theta>)\n  hence \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" by simp_all\n  moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (map Send1 X)\" by (induct X) auto\n  ultimately show ?case by simp\nnext\n  case (Unify S f Y \\<delta> X S' \\<theta>)\n  hence \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S')\" by simp\n\n  have \"fv\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S') \\<inter> bvars\\<^sub>s\\<^sub>t (S@S') = {}\"\n    using Unify.prems(1) by (auto simp add: wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n  moreover have \"fv (Fun f X) \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S')\" by auto\n  moreover have \"fv (Fun f Y) \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S')\"\n    using Unify.hyps(2) fv_subset_if_in_strand_ik'[of \"Fun f Y\" S] by force\n  ultimately have bvars_disj:\n      \"bvars\\<^sub>s\\<^sub>t (S@S') \\<inter> fv (Fun f X) = {}\" \"bvars\\<^sub>s\\<^sub>t (S@S') \\<inter> fv (Fun f Y) = {}\"\n    by blast+\n\n  have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\" using Unify.prems(5) by simp\n  moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\"\n  proof -\n    obtain x where \"x \\<in> set S\" \"Fun f Y \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\"\n      using Unify.hyps(2) Unify.prems(5) by force+\n    thus ?thesis using wf_trm_subterm by auto\n  qed\n  moreover have\n      \"Fun f X \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S'))\"\n      \"Fun f Y \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S'))\"\n    using SMP_append[of S \"Send1 (Fun f X)#S'\"] SMP_Cons[of \"Send1 (Fun f X)\" S']\n          SMP_ikI[OF Unify.hyps(2)]\n    by auto\n  hence \"\\<Gamma> (Fun f X) = \\<Gamma> (Fun f Y)\"\n    using Unify.prems(4) mgu_gives_MGU[OF Unify.hyps(3)[symmetric]]\n    unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n  ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\" using mgu_wt_if_same_type[OF Unify.hyps(3)[symmetric]] by metis\n  moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\n    using mgu_wf_trm[OF Unify.hyps(3)[symmetric] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\<close> \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\\<close>]\n    by (metis wf_trm_subst_range_iff)\n  moreover have \"bvars\\<^sub>s\\<^sub>t (S@S') \\<inter> range_vars \\<delta> = {}\"\n    using mgu_vars_bounded[OF Unify.hyps(3)[symmetric]] bvars_disj by fast\n  ultimately show ?case using tfr_stp_all_wt_subst_apply[OF \\<open>list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S')\\<close>] by metis\nnext\n  case (Equality S \\<delta> t t' a S' \\<theta>)\n  have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S')\" \"\\<Gamma> t = \\<Gamma> t'\"\n    using tfr_stp_all_same_type[of S a t t' S']\n          tfr_stp_all_split(5)[of S _ S']\n          MGU_is_Unifier[OF mgu_gives_MGU[OF Equality.hyps(2)[symmetric]]]\n          Equality.prems(3)\n    by blast+\n  moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t'\" using Equality.prems(5) by auto\n  ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\"\n    using mgu_wt_if_same_type[OF Equality.hyps(2)[symmetric]]\n    by metis\n  moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\n    using mgu_wf_trm[OF Equality.hyps(2)[symmetric] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close> \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t'\\<close>]\n    by (metis wf_trm_subst_range_iff)\n  moreover have \"fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S') \\<inter> bvars\\<^sub>s\\<^sub>t (S@Equality a t t'#S') = {}\"\n    using Equality.prems(1) by (auto simp add: wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n  hence \"bvars\\<^sub>s\\<^sub>t (S@S') \\<inter> fv t = {}\" \"bvars\\<^sub>s\\<^sub>t (S@S') \\<inter> fv t' = {}\" by auto\n  hence \"bvars\\<^sub>s\\<^sub>t (S@S') \\<inter> range_vars \\<delta> = {}\"\n    using mgu_vars_bounded[OF Equality.hyps(2)[symmetric]] by fast\n  ultimately show ?case using tfr_stp_all_wt_subst_apply[OF \\<open>list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@S')\\<close>] by metis\nqed\n\nprivate lemma LI_in_SMP_subset_single:\n  assumes \"(S,\\<theta>) \\<leadsto> (S',\\<theta>')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\"\n          \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n  and \"trms\\<^sub>s\\<^sub>t S \\<subseteq> SMP M\"\n  shows \"trms\\<^sub>s\\<^sub>t S' \\<subseteq> SMP M\"\nusing assms\nproof (induction rule: LI_rel.induct)\n  case (Compose S X f S' \\<theta>)\n  hence \"SMP (trms\\<^sub>s\\<^sub>t [Send1 (Fun f X)]) \\<subseteq> SMP M\"\n  proof -\n    have \"SMP (trms\\<^sub>s\\<^sub>t [Send1 (Fun f X)]) \\<subseteq> SMP (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S'))\"\n      using trms\\<^sub>s\\<^sub>t_append SMP_mono by auto\n    thus ?thesis\n      using SMP_union[of \"trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S')\" M]\n            SMP_subset_union_eq[OF Compose.prems(6)]\n      by auto\n  qed\n  thus ?case using Compose.prems(6) by auto\nnext\n  case (Unify S f Y \\<delta> X S' \\<theta>)\n  have \"Fun f X \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S'))\" by auto\n  moreover have \"MGU \\<delta> (Fun f X) (Fun f Y)\"\n    by (metis mgu_gives_MGU[OF Unify.hyps(3)[symmetric]])\n  moreover have\n        \"\\<And>x. x \\<in> set S \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\"\n    using Unify.prems(4) by force+\n  moreover have \"Fun f Y \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S'))\"\n    by (meson SMP_ikI Unify.hyps(2) contra_subsetD ik_append_subset(1))\n  ultimately have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\" \"\\<Gamma> (Fun f X) = \\<Gamma> (Fun f Y)\"\n    using ik\\<^sub>s\\<^sub>t_subterm_exD[OF \\<open>Fun f Y \\<in> ik\\<^sub>s\\<^sub>t S\\<close>] \\<open>tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S'))\\<close>\n    unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by (metis (full_types) SMP_wf_trm Unify.prems(4), blast)\n  hence \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\" by (metis mgu_wt_if_same_type[OF Unify.hyps(3)[symmetric] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\<close>])\n  moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\n    using mgu_wf_trm[OF Unify.hyps(3)[symmetric] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\<close> \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\\<close>] by simp\n  ultimately have \"trms\\<^sub>s\\<^sub>t ((S@Send1 (Fun f X)#S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<subseteq> SMP M\"\n    using SMP.Substitution Unify.prems(6) wt_subst_SMP_subset by metis\n  thus ?case by auto\nnext\n  case (Equality S \\<delta> t t' a S' \\<theta>)\n  hence \"\\<Gamma> t = \\<Gamma> t'\"\n    using tfr_stp_all_same_type MGU_is_Unifier[OF mgu_gives_MGU[OF Equality.hyps(2)[symmetric]]]\n    by metis\n  moreover have \"t \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@Equality a t t'#S'))\" \"t' \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@Equality a t t'#S'))\"\n    using Equality.prems(1) by auto\n  moreover have \"MGU \\<delta> t t'\" using mgu_gives_MGU[OF Equality.hyps(2)[symmetric]] by metis\n  moreover have \"\\<And>x. x \\<in> set S \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t'\"\n    using Equality.prems(4) by force+\n  ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\" by (metis mgu_wt_if_same_type[OF Equality.hyps(2)[symmetric] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close>])\n  moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\n    using mgu_wf_trm[OF Equality.hyps(2)[symmetric] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close> \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t'\\<close>] by simp\n  ultimately have \"trms\\<^sub>s\\<^sub>t ((S@Equality a t t'#S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<subseteq> SMP M\"\n    using SMP.Substitution Equality.prems wt_subst_SMP_subset by metis\n  thus ?case by auto\nqed\n\nprivate lemma LI_preserves_tfr_single:\n  assumes \"(S,\\<theta>) \\<leadsto> (S',\\<theta>')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\"\n          \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\"\n          \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n  shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S') \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S')\"\nusing assms\nproof (induction rule: LI_rel.induct)\n  case (Compose S X f S' \\<theta>)\n  let ?SMPmap = \"SMP (trms\\<^sub>s\\<^sub>t (S@map Send1 X@S')) - (Var`\\<V>)\"\n  have \"?SMPmap \\<subseteq> SMP (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S')) - (Var`\\<V>)\"\n    using SMP_fun_map_snd_subset[of X f]\n          SMP_append[of \"map Send1 X\" S'] SMP_Cons[of \"Send1 (Fun f X)\" S']\n          SMP_append[of S \"Send1 (Fun f X)#S'\"] SMP_append[of S \"map Send1 X@S'\"]\n    by auto\n  hence \"\\<forall>s \\<in> ?SMPmap. \\<forall>t \\<in> ?SMPmap. (\\<exists>\\<delta>. Unifier \\<delta> s t) \\<longrightarrow> \\<Gamma> s = \\<Gamma> t\"\n    using Compose unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by (meson subsetCE)\n  thus ?case\n    using LI_preserves_trm_wf[OF r_into_rtrancl[OF LI_rel.Compose[OF Compose.hyps]], of S']\n          Compose.prems(5)\n    unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\nnext\n  case (Unify S f Y \\<delta> X S' \\<theta>)\n  let ?SMP\\<delta> = \"SMP (trms\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)) - (Var`\\<V>)\"\n\n  have \"SMP (trms\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)) \\<subseteq> SMP (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S'))\"\n  proof\n    fix s assume \"s \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>))\" thus \"s \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S'))\"\n      using LI_in_SMP_subset_single[\n              OF LI_rel.Unify[OF Unify.hyps] Unify.prems(1,2,4,5,6)\n                 MP_subset_SMP(2)[of \"S@Send1 (Fun f X)#S'\"]]\n      by (metis SMP_union SMP_subset_union_eq Un_iff)\n  qed\n  hence \"\\<forall>s \\<in> ?SMP\\<delta>. \\<forall>t \\<in> ?SMP\\<delta>. (\\<exists>\\<delta>. Unifier \\<delta> s t) \\<longrightarrow> \\<Gamma> s = \\<Gamma> t\"\n    using Unify.prems(4) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by (meson Diff_iff subsetCE)\n  thus ?case\n    using LI_preserves_trm_wf[OF r_into_rtrancl[OF LI_rel.Unify[OF Unify.hyps]], of S']\n          Unify.prems(5)\n    unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\nnext\n  case (Equality S \\<delta> t t' a S' \\<theta>)\n  let ?SMP\\<delta> = \"SMP (trms\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)) - (Var`\\<V>)\"\n\n  have \"SMP (trms\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)) \\<subseteq> SMP (trms\\<^sub>s\\<^sub>t (S@Equality a t t'#S'))\"\n  proof\n    fix s assume \"s \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>))\" thus \"s \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@Equality a t t'#S'))\"\n      using LI_in_SMP_subset_single[\n              OF LI_rel.Equality[OF Equality.hyps] Equality.prems(1,2,4,5,6)\n                 MP_subset_SMP(2)[of \"S@Equality a t t'#S'\"]]\n      by (metis SMP_union SMP_subset_union_eq Un_iff)\n  qed\n  hence \"\\<forall>s \\<in> ?SMP\\<delta>. \\<forall>t \\<in> ?SMP\\<delta>. (\\<exists>\\<delta>. Unifier \\<delta> s t) \\<longrightarrow> \\<Gamma> s = \\<Gamma> t\"\n    using Equality.prems unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by (meson Diff_iff subsetCE)\n  thus ?case\n    using LI_preserves_trm_wf[OF r_into_rtrancl[OF LI_rel.Equality[OF Equality.hyps]], of _ S']\n          Equality.prems\n    unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\nqed\n\nprivate lemma LI_preserves_welltypedness_single:\n  assumes \"(S,\\<theta>) \\<leadsto> (S',\\<theta>')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\"\n  and \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n  shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>' \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>')\"\nusing assms\nproof (induction rule: LI_rel.induct)\n  case (Unify S f Y \\<delta> X S' \\<theta>)\n  have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\" using Unify.prems(5) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by simp\n  moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\"\n  proof -\n    obtain x where \"x \\<in> set S\" \"Fun f Y \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p x)\"\n      using Unify.hyps(2) Unify.prems(5) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by force\n    thus ?thesis using wf_trm_subterm by auto\n  qed\n  moreover have\n      \"Fun f X \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S'))\" \"Fun f Y \\<in> SMP (trms\\<^sub>s\\<^sub>t (S@Send1 (Fun f X)#S'))\"\n    using SMP_append[of S \"Send1 (Fun f X)#S'\"] SMP_Cons[of \"Send1 (Fun f X)\" S']\n          SMP_ikI[OF Unify.hyps(2)]\n    by auto\n  hence \"\\<Gamma> (Fun f X) = \\<Gamma> (Fun f Y)\"\n    using Unify.prems(4) mgu_gives_MGU[OF Unify.hyps(3)[symmetric]]\n    unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by blast\n  ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\" using mgu_wt_if_same_type[OF Unify.hyps(3)[symmetric]] by metis\n\n  have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\n    by (meson mgu_wf_trm[OF Unify.hyps(3)[symmetric] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f X)\\<close> \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f Y)\\<close>]\n              wf_trm_subst_range_iff)\n  hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\<theta> \\<circ>\\<^sub>s \\<delta>))\"\n    using wf_trm_subst_range_iff wf_trm_subst \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\\<close>\n    unfolding subst_compose_def\n    by (metis (no_types, lifting))\n  thus ?case by (metis wt_subst_compose[OF \\<open>wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\\<close> \\<open>wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\\<close>])\nnext\n  case (Equality S \\<delta> t t' a S' \\<theta>)\n  have \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t'\" using Equality.prems(5) by simp_all\n  moreover have \"\\<Gamma> t = \\<Gamma> t'\"\n    using \\<open>list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (S@Equality a t t'#S')\\<close>\n          MGU_is_Unifier[OF mgu_gives_MGU[OF Equality.hyps(2)[symmetric]]]\n    by auto\n  ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\" using mgu_wt_if_same_type[OF Equality.hyps(2)[symmetric]] by metis\n\n  have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\n    by (meson mgu_wf_trm[OF Equality.hyps(2)[symmetric] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close> \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t'\\<close>] wf_trm_subst_range_iff)\n  hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\<theta> \\<circ>\\<^sub>s \\<delta>))\"\n    using wf_trm_subst_range_iff wf_trm_subst \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\\<close>\n    unfolding subst_compose_def\n    by (metis (no_types, lifting))\n  thus ?case by (metis wt_subst_compose[OF \\<open>wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\\<close> \\<open>wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\\<close>])\nqed metis\n\nlemma LI_preserves_welltypedness:\n  assumes \"(S,\\<theta>) \\<leadsto>\\<^sup>* (S',\\<theta>')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\"\n    and \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n  shows \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>'\" (is \"?A \\<theta>'\")\n    and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>')\" (is \"?B \\<theta>'\")\nproof -\n  have \"?A \\<theta>' \\<and> ?B \\<theta>'\" using assms\n  proof (induction S \\<theta> rule: converse_rtrancl_induct2)\n    case (step S1 \\<theta>1 S2 \\<theta>2)\n    hence \"?A \\<theta>2 \\<and> ?B \\<theta>2\" using LI_preserves_welltypedness_single by presburger\n    moreover have \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S2 \\<theta>2\"\n      by (fact LI_preserves_wellformedness[OF r_into_rtrancl[OF step.hyps(1)] step.prems(1)])\n    moreover have \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S2)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S2)\"\n      using LI_preserves_tfr_single[OF step.hyps(1)] step.prems by presburger+\n    moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S2\"\n      using LI_preserves_tfr_stp_all_single[OF step.hyps(1)] step.prems by fastforce\n    ultimately show ?case using step.IH by presburger\n  qed simp\n  thus \"?A \\<theta>'\" \"?B \\<theta>'\" by simp_all\nqed\n\nlemma LI_preserves_tfr:\n  assumes \"(S,\\<theta>) \\<leadsto>\\<^sup>* (S',\\<theta>')\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\"\n    and \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n  shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S')\" (is \"?A S'\")\n    and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S')\" (is \"?B S'\")\n    and \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" (is \"?C S'\")\nproof -\n  have \"?A S' \\<and> ?B S' \\<and> ?C S'\" using assms\n  proof (induction S \\<theta> rule: converse_rtrancl_induct2)\n    case (step S1 \\<theta>1 S2 \\<theta>2)\n    have \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S2 \\<theta>2\" \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S2)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S2)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S2\"\n      using LI_preserves_wellformedness[OF r_into_rtrancl[OF step.hyps(1)] step.prems(1)]\n            LI_preserves_tfr_single[OF step.hyps(1) step.prems(1,2)]\n            LI_preserves_tfr_stp_all_single[OF step.hyps(1) step.prems(1,2)]\n            step.prems(3,4,5,6)\n      by metis+\n    moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>2\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>2)\"\n      using LI_preserves_welltypedness[OF r_into_rtrancl[OF step.hyps(1)] step.prems]\n      by simp_all\n    ultimately show ?case using step.IH by presburger\n  qed blast\n  thus \"?A S'\" \"?B S'\" \"?C S'\" by simp_all\nqed\n\nlemma LI_preproc_preserves_tfr:\n  assumes \"tfr\\<^sub>s\\<^sub>t S\"\n  shows \"tfr\\<^sub>s\\<^sub>t (LI_preproc S)\"\nunfolding tfr\\<^sub>s\\<^sub>t_def\nproof\n  have S: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using assms unfolding tfr\\<^sub>s\\<^sub>t_def by metis+\n\n  show \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t (LI_preproc S))\" by (metis S(1) LI_preproc_trms_eq)\n\n  show \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (LI_preproc S)\" using S(2)\n  proof (induction S)\n    case (Cons x S)\n    have IH: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (LI_preproc S)\" using Cons by simp\n    have x: \"tfr\\<^sub>s\\<^sub>t\\<^sub>p x\" using Cons.prems by simp\n\n    show ?case using x IH unfolding list_all_iff by (cases x) auto\n  qed simp\nqed\nend\n\nsubsubsection \\<open>Simple Constraints are Well-typed Satisfiable\\<close>\ntext \\<open>Proving the existence of a well-typed interpretation\\<close>\ncontext\nbegin\n\nlemma wt_interpretation_exists: \n  obtains \\<I>::\"('fun,'var) subst\"\n  where \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\" \"subst_range \\<I> \\<subseteq> public_ground_wf_terms\"\nproof\n  define \\<I> where \"\\<I> = (\\<lambda>x. (SOME t. \\<Gamma> (Var x) = \\<Gamma> t \\<and> public_ground_wf_term t))\"\n\n  { fix x t assume \"\\<I> x = t\"\n    hence \"\\<Gamma> (Var x) = \\<Gamma> t \\<and> public_ground_wf_term t\"\n      using someI_ex[of \"\\<lambda>t. \\<Gamma> (Var x) = \\<Gamma> t \\<and> public_ground_wf_term t\",\n                     OF type_pgwt_inhabited[of \"Var x\"]]\n      unfolding \\<I>_def wf\\<^sub>t\\<^sub>r\\<^sub>m_def by simp\n  } hence props: \"\\<I> v = t \\<Longrightarrow> \\<Gamma> (Var v) = \\<Gamma> t \\<and> public_ground_wf_term t\" for v t by metis\n\n  have \"\\<I> v \\<noteq> Var v\" for v using props pgwt_ground by fastforce\n  hence \"subst_domain \\<I> = UNIV\" by auto\n  moreover have \"ground (subst_range \\<I>)\" by (simp add: props pgwt_ground)\n  ultimately show \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\" by metis\n  show \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\" unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def using props by simp\n  show \"subst_range \\<I> \\<subseteq> public_ground_wf_terms\" by (auto simp add: props)\nqed\n\nlemma wt_grounding_subst_exists:\n  \"\\<exists>\\<theta>. wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta> \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>) \\<and> fv (t \\<cdot> \\<theta>) = {}\"\nproof -\n  obtain \\<theta> where \\<theta>: \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\" \"subst_range \\<theta> \\<subseteq> public_ground_wf_terms\"\n    using wt_interpretation_exists by blast\n  show ?thesis using pgwt_wellformed interpretation_grounds[OF \\<theta>(1)] \\<theta>(2,3) by blast\nqed\n\nprivate fun fresh_pgwt::\"'fun set \\<Rightarrow> ('fun,'atom) term_type \\<Rightarrow> ('fun,'var) term\"  where\n  \"fresh_pgwt S (TAtom a) =\n    Fun (SOME c. c \\<notin> S \\<and> \\<Gamma> (Fun c []) = TAtom a \\<and> public c) []\"\n| \"fresh_pgwt S (TComp f T) = Fun f (map (fresh_pgwt S) T)\"\n\nprivate lemma fresh_pgwt_same_type:\n  assumes \"finite S\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n  shows \"\\<Gamma> (fresh_pgwt S (\\<Gamma> t)) = \\<Gamma> t\"\nproof -\n  let ?P = \"\\<lambda>\\<tau>::('fun,'atom) term_type. wf\\<^sub>t\\<^sub>r\\<^sub>m \\<tau> \\<and> (\\<forall>f T. TComp f T \\<sqsubseteq> \\<tau> \\<longrightarrow> 0 < arity f)\"\n  { fix \\<tau> assume \"?P \\<tau>\" hence \"\\<Gamma> (fresh_pgwt S \\<tau>) = \\<tau>\"\n    proof (induction \\<tau>)\n      case (Var a)\n      let ?P = \"\\<lambda>c. c \\<notin> S \\<and> \\<Gamma> (Fun c []) = Var a \\<and> public c\"\n      let ?Q = \"\\<lambda>c. \\<Gamma> (Fun c []) = Var a \\<and> public c\"\n      have \" {c. ?Q c} - S = {c. ?P c}\" by auto\n      hence \"infinite {c. ?P c}\"\n        using Diff_infinite_finite[OF assms(1) infinite_typed_consts[of a]] \n        by metis\n      hence \"\\<exists>c. ?P c\" using not_finite_existsD by blast\n      thus ?case using someI_ex[of ?P] by auto\n    next\n      case (Fun f T)\n      have f: \"0 < arity f\" using Fun.prems fun_type_inv by auto\n      have \"\\<And>t. t \\<in> set T \\<Longrightarrow> ?P t\"\n        using Fun.prems wf_trm_subtermeq term.le_less_trans Fun_param_is_subterm\n        by metis\n      hence \"\\<And>t. t \\<in> set T \\<Longrightarrow> \\<Gamma> (fresh_pgwt S t) = t\" using Fun.prems Fun.IH by auto\n      hence \"map \\<Gamma> (map (fresh_pgwt S) T) = T\"  by (induct T) auto\n      thus ?case using fun_type[OF f] by simp\n    qed\n  } thus ?thesis using assms(1) \\<Gamma>_wf'[OF assms(2)] \\<Gamma>_wf'' by auto\nqed\n\nprivate lemma fresh_pgwt_empty_synth:\n  assumes \"finite S\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n  shows \"{} \\<turnstile>\\<^sub>c fresh_pgwt S (\\<Gamma> t)\"\nproof -\n  let ?P = \"\\<lambda>\\<tau>::('fun,'atom) term_type. wf\\<^sub>t\\<^sub>r\\<^sub>m \\<tau> \\<and> (\\<forall>f T. TComp f T \\<sqsubseteq> \\<tau> \\<longrightarrow> 0 < arity f)\"\n  { fix \\<tau> assume \"?P \\<tau>\" hence \"{} \\<turnstile>\\<^sub>c fresh_pgwt S \\<tau>\"\n    proof (induction \\<tau>)\n      case (Var a)\n      let ?P = \"\\<lambda>c. c \\<notin> S \\<and> \\<Gamma> (Fun c []) = Var a \\<and> public c\"\n      let ?Q = \"\\<lambda>c. \\<Gamma> (Fun c []) = Var a \\<and> public c\"\n      have \" {c. ?Q c} - S = {c. ?P c}\" by auto\n      hence \"infinite {c. ?P c}\"\n        using Diff_infinite_finite[OF assms(1) infinite_typed_consts[of a]] \n        by metis\n      hence \"\\<exists>c. ?P c\" using not_finite_existsD by blast\n      thus ?case\n        using someI_ex[of ?P] intruder_synth.ComposeC[of \"[]\" _ \"{}\"] const_type_inv\n        by auto\n    next\n      case (Fun f T)\n      have f: \"0 < arity f\" \"length T = arity f\" \"public f\" \n        using Fun.prems fun_type_inv unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n      have \"\\<And>t. t \\<in> set T \\<Longrightarrow> ?P t\"\n        using Fun.prems wf_trm_subtermeq term.le_less_trans Fun_param_is_subterm\n        by metis\n      hence \"\\<And>t. t \\<in> set T \\<Longrightarrow> {} \\<turnstile>\\<^sub>c fresh_pgwt S t\" using Fun.prems Fun.IH by auto\n      moreover have \"length (map (fresh_pgwt S) T) = arity f\" using f(2) by auto\n      ultimately show ?case using intruder_synth.ComposeC[of \"map (fresh_pgwt S) T\" f] f by auto\n    qed\n  } thus ?thesis using assms(1) \\<Gamma>_wf'[OF assms(2)] \\<Gamma>_wf'' by auto\nqed\n\nprivate lemma fresh_pgwt_has_fresh_const:\n  assumes \"finite S\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n  obtains c where \"Fun c [] \\<sqsubseteq> fresh_pgwt S (\\<Gamma> t)\" \"c \\<notin> S\"\nproof -\n  let ?P = \"\\<lambda>\\<tau>::('fun,'atom) term_type. wf\\<^sub>t\\<^sub>r\\<^sub>m \\<tau> \\<and> (\\<forall>f T. TComp f T \\<sqsubseteq> \\<tau> \\<longrightarrow> 0 < arity f)\"\n  { fix \\<tau> assume \"?P \\<tau>\" hence \"\\<exists>c. Fun c [] \\<sqsubseteq> fresh_pgwt S \\<tau> \\<and> c \\<notin> S\"\n    proof (induction \\<tau>)\n      case (Var a)\n      let ?P = \"\\<lambda>c. c \\<notin> S \\<and> \\<Gamma> (Fun c []) = Var a \\<and> public c\"\n      let ?Q = \"\\<lambda>c. \\<Gamma> (Fun c []) = Var a \\<and> public c\"\n      have \" {c. ?Q c} - S = {c. ?P c}\" by auto\n      hence \"infinite {c. ?P c}\"\n        using Diff_infinite_finite[OF assms(1) infinite_typed_consts[of a]] \n        by metis\n      hence \"\\<exists>c. ?P c\" using not_finite_existsD by blast\n      thus ?case using someI_ex[of ?P] by auto\n    next\n      case (Fun f T)\n      have f: \"0 < arity f\" \"length T = arity f\" \"public f\" \"T \\<noteq> []\"\n        using Fun.prems fun_type_inv unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n      obtain t' where t': \"t' \\<in> set T\" by (meson all_not_in_conv f(4) set_empty) \n      have \"\\<And>t. t \\<in> set T \\<Longrightarrow> ?P t\"\n        using Fun.prems wf_trm_subtermeq term.le_less_trans Fun_param_is_subterm\n        by metis\n      hence \"\\<And>t. t \\<in> set T \\<Longrightarrow> \\<exists>c. Fun c [] \\<sqsubseteq> fresh_pgwt S t \\<and> c \\<notin> S\"\n        using Fun.prems Fun.IH by auto\n      then obtain c where c: \"Fun c [] \\<sqsubseteq> fresh_pgwt S t'\" \"c \\<notin> S\" using t' by metis\n      thus ?case using t' by auto\n    qed\n  } thus ?thesis using that assms \\<Gamma>_wf'[OF assms(2)] \\<Gamma>_wf'' by blast \nqed\n\nprivate lemma fresh_pgwt_subterm_fresh:\n  assumes \"finite S\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"funs_term s \\<subseteq> S\"\n  shows \"s \\<notin> subterms (fresh_pgwt S (\\<Gamma> t))\"\nproof -\n  let ?P = \"\\<lambda>\\<tau>::('fun,'atom) term_type. wf\\<^sub>t\\<^sub>r\\<^sub>m \\<tau> \\<and> (\\<forall>f T. TComp f T \\<sqsubseteq> \\<tau> \\<longrightarrow> 0 < arity f)\"\n  { fix \\<tau> assume \"?P \\<tau>\" hence \"s \\<notin> subterms (fresh_pgwt S \\<tau>)\"\n    proof (induction \\<tau>)\n      case (Var a)\n      let ?P = \"\\<lambda>c. c \\<notin> S \\<and> \\<Gamma> (Fun c []) = Var a \\<and> public c\"\n      let ?Q = \"\\<lambda>c. \\<Gamma> (Fun c []) = Var a \\<and> public c\"\n      have \" {c. ?Q c} - S = {c. ?P c}\" by auto\n      hence \"infinite {c. ?P c}\"\n        using Diff_infinite_finite[OF assms(1) infinite_typed_consts[of a]] \n        by metis\n      hence \"\\<exists>c. ?P c\" using not_finite_existsD by blast\n      thus ?case using someI_ex[of ?P] assms(4) by auto\n    next\n      case (Fun f T)\n      have f: \"0 < arity f\" \"length T = arity f\" \"public f\" \n        using Fun.prems fun_type_inv unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n      have \"\\<And>t. t \\<in> set T \\<Longrightarrow> ?P t\"\n        using Fun.prems wf_trm_subtermeq term.le_less_trans Fun_param_is_subterm\n        by metis\n      hence \"\\<And>t. t \\<in> set T \\<Longrightarrow> s \\<notin> subterms (fresh_pgwt S t)\" using Fun.prems Fun.IH by auto\n      moreover have \"s \\<noteq> fresh_pgwt S (Fun f T)\"\n      proof -\n        obtain c where c: \"Fun c [] \\<sqsubseteq> fresh_pgwt S (Fun f T)\" \"c \\<notin> S\"\n          using fresh_pgwt_has_fresh_const[OF assms(1)] type_wfttype_inhabited Fun.prems\n          by metis\n        hence \"\\<not>Fun c [] \\<sqsubseteq> s\" using assms(4) subtermeq_imp_funs_term_subset by force\n        thus ?thesis using c(1) by auto\n      qed\n      ultimately show ?case by auto\n    qed\n  } thus ?thesis using assms(1) \\<Gamma>_wf'[OF assms(2)] \\<Gamma>_wf'' by auto\nqed\n\nprivate lemma wt_fresh_pgwt_term_exists:\n  assumes \"finite T\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s T\"\n  obtains t where \"\\<Gamma> t = \\<Gamma> s\" \"{} \\<turnstile>\\<^sub>c t\" \"\\<forall>s \\<in> T. \\<forall>u \\<in> subterms s. u \\<notin> subterms t\"\nproof -\n  have finite_S: \"finite (\\<Union>(funs_term ` T))\" using assms(1) by auto\n\n  have 1: \"\\<Gamma> (fresh_pgwt (\\<Union>(funs_term ` T)) (\\<Gamma> s)) = \\<Gamma> s\"\n    using fresh_pgwt_same_type[OF finite_S assms(2)] by auto\n\n  have 2: \"{} \\<turnstile>\\<^sub>c fresh_pgwt (\\<Union>(funs_term ` T)) (\\<Gamma> s)\"\n    using fresh_pgwt_empty_synth[OF finite_S assms(2)] by auto\n\n  have 3: \"\\<forall>v \\<in> T. \\<forall>u \\<in> subterms v. u \\<notin> subterms (fresh_pgwt (\\<Union>(funs_term ` T)) (\\<Gamma> s))\"\n    using fresh_pgwt_subterm_fresh[OF finite_S assms(2)] assms(3)\n          wf_trm_subtermeq subtermeq_imp_funs_term_subset\n    by force\n\n  show ?thesis by (rule that[OF 1 2 3])\nqed\n\nlemma wt_bij_finite_subst_exists:\n  assumes \"finite (S::'var set)\" \"finite (T::('fun,'var) terms)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s T\"\n  shows \"\\<exists>\\<sigma>::('fun,'var) subst.\n              subst_domain \\<sigma> = S\n            \\<and> bij_betw \\<sigma> (subst_domain \\<sigma>) (subst_range \\<sigma>)\n            \\<and> subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>) \\<subseteq> {t. {} \\<turnstile>\\<^sub>c t} - T\n            \\<and> (\\<forall>s \\<in> subst_range \\<sigma>. \\<forall>u \\<in> subst_range \\<sigma>. (\\<exists>v. v \\<sqsubseteq> s \\<and> v \\<sqsubseteq> u) \\<longrightarrow> s = u)\n            \\<and> wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<sigma>\n            \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<sigma>)\"\nusing assms\nproof (induction rule: finite_induct)\n  case empty\n  have \"subst_domain Var = {}\"\n       \"bij_betw Var (subst_domain Var) (subst_range Var)\"\n       \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range Var) \\<subseteq> {t. {} \\<turnstile>\\<^sub>c t} - T\"\n       \"\\<forall>s \\<in> subst_range Var. \\<forall>u \\<in> subst_range Var. (\\<exists>v. v \\<sqsubseteq> s \\<and> v \\<sqsubseteq> u) \\<longrightarrow> s = u\"\n       \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\"\n       \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\"\n    unfolding bij_betw_def\n    by auto\n  thus ?case by (force simp add: subst_domain_def)\nnext\n  case (insert x S)\n  then obtain \\<sigma> where \\<sigma>:\n      \"subst_domain \\<sigma> = S\" \"bij_betw \\<sigma> (subst_domain \\<sigma>) (subst_range \\<sigma>)\"\n      \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>) \\<subseteq> {t. {} \\<turnstile>\\<^sub>c t} - T\"\n      \"\\<forall>s \\<in> subst_range \\<sigma>. \\<forall>u \\<in> subst_range \\<sigma>. (\\<exists>v. v \\<sqsubseteq> s \\<and> v \\<sqsubseteq> u) \\<longrightarrow> s = u\"\n      \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<sigma>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<sigma>)\"\n    by (auto simp del: subst_range.simps)\n\n  have *: \"finite (T \\<union> subst_range \\<sigma>)\"\n    using insert.prems(1) insert.hyps(1) \\<sigma>(1) by simp\n  have **: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Var x)\" by simp\n  have ***: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (T \\<union> subst_range \\<sigma>)\" using assms(3) \\<sigma>(6) by blast\n  obtain t where t:\n      \"\\<Gamma> t = \\<Gamma> (Var x)\" \"{} \\<turnstile>\\<^sub>c t\"\n      \"\\<forall>s \\<in> T \\<union> subst_range \\<sigma>. \\<forall>u \\<in> subterms s. u \\<notin> subterms t\"\n    using wt_fresh_pgwt_term_exists[OF * ** ***] by auto\n\n  obtain \\<theta> where \\<theta>: \"\\<theta> \\<equiv> \\<lambda>y. if x = y then t else \\<sigma> y\" by simp\n\n  have t_ground: \"fv t = {}\" using t(2) pgwt_ground[of t] pgwt_is_empty_synth[of t] by auto\n  hence x_dom: \"x \\<notin> subst_domain \\<sigma>\" \"x \\<in> subst_domain \\<theta>\" using insert.hyps(2) \\<sigma>(1) \\<theta> by auto\n  moreover have \"subst_range \\<sigma> \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>)\" by auto\n  hence ground_imgs: \"ground (subst_range \\<sigma>)\"\n    using \\<sigma>(3) pgwt_ground pgwt_is_empty_synth\n    by force\n  ultimately have x_img: \"\\<sigma> x \\<notin> subst_range \\<sigma>\"\n    using ground_subst_dom_iff_img\n    by (auto simp add: subst_domain_def)\n\n  have \"ground (insert t (subst_range \\<sigma>))\"\n    using ground_imgs x_dom t_ground\n    by auto\n  have \\<theta>_dom: \"subst_domain \\<theta> = insert x (subst_domain \\<sigma>)\"\n    using \\<theta> t_ground by (auto simp add: subst_domain_def)\n  have \\<theta>_img: \"subst_range \\<theta> = insert t (subst_range \\<sigma>)\"\n  proof\n    show \"subst_range \\<theta> \\<subseteq> insert t (subst_range \\<sigma>)\"\n    proof\n      fix t' assume \"t' \\<in> subst_range \\<theta>\"\n      then obtain y where \"y \\<in> subst_domain \\<theta>\" \"t' = \\<theta> y\" by auto\n      thus \"t' \\<in> insert t (subst_range \\<sigma>)\" using \\<theta> by (auto simp add: subst_domain_def)\n    qed\n    show \"insert t (subst_range \\<sigma>) \\<subseteq> subst_range \\<theta>\"\n    proof\n      fix t' assume t': \"t' \\<in> insert t (subst_range \\<sigma>)\"\n      hence \"fv t' = {}\" using ground_imgs x_img t_ground by auto\n      hence \"t' \\<noteq> Var x\" by auto\n      show \"t' \\<in> subst_range \\<theta>\"\n      proof (cases \"t' = t\")\n        case False\n        hence \"t' \\<in> subst_range \\<sigma>\" using t' by auto\n        then obtain y where \"\\<sigma> y \\<in> subst_range \\<sigma>\" \"t' = \\<sigma> y\" by auto\n        hence \"y \\<in> subst_domain \\<sigma>\" \"t' \\<noteq> Var y\"\n          using ground_subst_dom_iff_img[OF ground_imgs(1)]\n          by (auto simp add: subst_domain_def simp del: subst_range.simps)\n        hence \"x \\<noteq> y\" using x_dom by auto\n        hence \"\\<theta> y = \\<sigma> y\" unfolding \\<theta> by auto\n        thus ?thesis using \\<open>t' \\<noteq> Var y\\<close> \\<open>t' = \\<sigma> y\\<close> subst_imgI[of \\<theta> y] by auto\n      qed (metis subst_imgI \\<theta> \\<open>t' \\<noteq> Var x\\<close>)\n    qed\n  qed\n  hence \\<theta>_ground_img: \"ground (subst_range \\<theta>)\"\n    using ground_imgs t_ground\n    by auto\n\n  have \"subst_domain \\<theta> = insert x S\" using \\<theta>_dom \\<sigma>(1) by auto\n  moreover have \"bij_betw \\<theta> (subst_domain \\<theta>) (subst_range \\<theta>)\"\n  proof (intro bij_betwI')\n    fix y z assume *: \"y \\<in> subst_domain \\<theta>\" \"z \\<in> subst_domain \\<theta>\"\n    hence \"fv (\\<theta> y) = {}\" \"fv (\\<theta> z) = {}\" using \\<theta>_ground_img by auto\n    { assume \"\\<theta> y = \\<theta> z\" hence \"y = z\"\n      proof (cases \"\\<theta> y \\<in> subst_range \\<sigma> \\<and> \\<theta> z \\<in> subst_range \\<sigma>\")\n        case True\n        hence **: \"y \\<in> subst_domain \\<sigma>\" \"z \\<in> subst_domain \\<sigma>\"\n          using \\<theta> \\<theta>_dom True * t(3) by (metis Un_iff term.order_refl insertE)+ \n        hence \"y \\<noteq> x\" \"z \\<noteq> x\" using x_dom by auto\n        hence \"\\<theta> y = \\<sigma> y\" \"\\<theta> z = \\<sigma> z\" using \\<theta> by auto\n        thus ?thesis using \\<open>\\<theta> y = \\<theta> z\\<close> \\<sigma>(2) ** unfolding bij_betw_def inj_on_def by auto\n      qed (metis \\<theta> * \\<open>\\<theta> y = \\<theta> z\\<close> \\<theta>_dom ground_imgs(1) ground_subst_dom_iff_img insertE)\n    }\n    thus \"(\\<theta> y = \\<theta> z) = (y = z)\" by auto\n  next\n    fix y assume \"y \\<in> subst_domain \\<theta>\" thus \"\\<theta> y \\<in> subst_range \\<theta>\" by auto\n  next\n    fix t assume \"t \\<in> subst_range \\<theta>\" thus \"\\<exists>z \\<in> subst_domain \\<theta>. t = \\<theta> z\" by auto\n  qed\n  moreover have \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<theta>) \\<subseteq> {t. {} \\<turnstile>\\<^sub>c t}  - T\"\n  proof -\n    { fix s assume \"s \\<sqsubseteq> t\"\n      hence \"s \\<in> {t. {} \\<turnstile>\\<^sub>c t}  - T\"\n        using t(2,3) \n        by (metis Diff_eq_empty_iff Diff_iff Un_upper1 term.order_refl\n                  deduct_synth_subterm mem_Collect_eq) \n    } thus ?thesis using \\<sigma>(3) \\<theta> \\<theta>_img by auto\n  qed\n  moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\" using \\<theta> t(1) \\<sigma>(5) unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by auto\n  moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\"\n    using \\<theta> \\<sigma>(6) t(2) pgwt_is_empty_synth pgwt_wellformed\n          wf_trm_subst_range_iff[of \\<sigma>] wf_trm_subst_range_iff[of \\<theta>]\n    by metis\n  moreover have \"\\<forall>s\\<in>subst_range \\<theta>. \\<forall>u\\<in>subst_range \\<theta>. (\\<exists>v. v \\<sqsubseteq> s \\<and> v \\<sqsubseteq> u) \\<longrightarrow> s = u\"\n    using \\<sigma>(4) \\<theta>_img t(3) by (auto simp del: subst_range.simps)\n  ultimately show ?case by blast\nqed\n\nprivate lemma wt_bij_finite_tatom_subst_exists_single:\n  assumes \"finite (S::'var set)\" \"finite (T::('fun,'var) terms)\"\n  and \"\\<And>x. x \\<in> S \\<Longrightarrow> \\<Gamma> (Var x) = TAtom a\"\n  shows \"\\<exists>\\<sigma>::('fun,'var) subst. subst_domain \\<sigma> = S\n                      \\<and> bij_betw \\<sigma> (subst_domain \\<sigma>) (subst_range \\<sigma>)\n                      \\<and> subst_range \\<sigma> \\<subseteq> ((\\<lambda>c. Fun c []) `  {c. \\<Gamma> (Fun c []) = TAtom a \\<and>\n                                                            public c \\<and> arity c = 0}) - T\n                      \\<and> wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<sigma>\n                      \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<sigma>)\"\nproof -\n  let ?U = \"{c. \\<Gamma> (Fun c []) = TAtom a \\<and> public c \\<and> arity c = 0}\"\n\n  obtain \\<sigma> where \\<sigma>:\n      \"subst_domain \\<sigma> = S\" \"bij_betw \\<sigma> (subst_domain \\<sigma>) (subst_range \\<sigma>)\"\n      \"subst_range \\<sigma> \\<subseteq> ((\\<lambda>c. Fun c []) ` ?U) - T\"\n    using bij_finite_const_subst_exists'[OF assms(1,2) infinite_typed_consts'[of a]]\n    by auto\n\n  { fix x assume \"x \\<notin> subst_domain \\<sigma>\" hence \"\\<Gamma> (Var x) = \\<Gamma> (\\<sigma> x)\" by auto }\n  moreover\n  { fix x assume \"x \\<in> subst_domain \\<sigma>\"\n    hence \"\\<exists>c \\<in> ?U. \\<sigma> x = Fun c [] \\<and> arity c = 0\" using \\<sigma> by auto\n    hence \"\\<Gamma> (\\<sigma> x) = TAtom a\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<sigma> x)\" using assms(3) const_type wf_trmI[of \"[]\"] by auto\n    hence \"\\<Gamma> (Var x) = \\<Gamma> (\\<sigma> x)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<sigma> x)\" using assms(3) \\<sigma>(1) by force+\n  }\n  ultimately have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<sigma>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<sigma>)\"\n    using wf_trm_subst_range_iff[of \\<sigma>]\n    unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def\n    by force+\n  thus ?thesis using \\<sigma> by auto\nqed\n\nlemma wt_bij_finite_tatom_subst_exists:\n  assumes \"finite (S::'var set)\" \"finite (T::('fun,'var) terms)\"\n  and \"\\<And>x. x \\<in> S \\<Longrightarrow> \\<exists>a. \\<Gamma> (Var x) = TAtom a\"\n  shows \"\\<exists>\\<sigma>::('fun,'var) subst. subst_domain \\<sigma> = S\n                      \\<and> bij_betw \\<sigma> (subst_domain \\<sigma>) (subst_range \\<sigma>)\n                      \\<and> subst_range \\<sigma> \\<subseteq> ((\\<lambda>c. Fun c []) `  \\<C>\\<^sub>p\\<^sub>u\\<^sub>b) - T\n                      \\<and> wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<sigma>\n                      \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<sigma>)\"\nusing assms\nproof (induction rule: finite_induct)\n  case empty\n  have \"subst_domain Var = {}\"\n       \"bij_betw Var (subst_domain Var) (subst_range Var)\"\n       \"subst_range Var \\<subseteq> ((\\<lambda>c. Fun c []) `  \\<C>\\<^sub>p\\<^sub>u\\<^sub>b) - T\"\n       \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\"\n       \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\"\n    unfolding bij_betw_def\n    by auto\n  thus ?case by (auto simp add: subst_domain_def)\nnext\n  case (insert x S)\n  then obtain a where a: \"\\<Gamma> (Var x) = TAtom a\" by fastforce\n\n  from insert obtain \\<sigma> where \\<sigma>:\n      \"subst_domain \\<sigma> = S\" \"bij_betw \\<sigma> (subst_domain \\<sigma>) (subst_range \\<sigma>)\"\n      \"subst_range \\<sigma> \\<subseteq> ((\\<lambda>c. Fun c []) `  \\<C>\\<^sub>p\\<^sub>u\\<^sub>b) - T\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<sigma>\"\n      \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<sigma>)\"\n    by auto\n\n  let ?S' = \"{y \\<in> S. \\<Gamma> (Var y) = TAtom a}\"\n  let ?T' = \"T \\<union> subst_range \\<sigma>\"\n\n  have *: \"finite (insert x ?S')\" using insert by simp\n  have **: \"finite ?T'\" using insert.prems(1) insert.hyps(1) \\<sigma>(1) by simp\n  have ***: \"\\<And>y. y \\<in> insert x ?S' \\<Longrightarrow> \\<Gamma> (Var y) = TAtom a\" using a by auto\n\n  obtain \\<delta> where \\<delta>:\n      \"subst_domain \\<delta> = insert x ?S'\" \"bij_betw \\<delta> (subst_domain \\<delta>) (subst_range \\<delta>)\"\n      \"subst_range \\<delta> \\<subseteq> ((\\<lambda>c. Fun c []) `  \\<C>\\<^sub>p\\<^sub>u\\<^sub>b) - ?T'\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\n    using wt_bij_finite_tatom_subst_exists_single[OF * ** ***] const_type_inv[of _ \"[]\" a]\n    by blast\n\n  obtain \\<theta> where \\<theta>: \"\\<theta> \\<equiv> \\<lambda>y. if x = y then \\<delta> y else \\<sigma> y\" by simp\n\n  have x_dom: \"x \\<notin> subst_domain \\<sigma>\" \"x \\<in> subst_domain \\<delta>\" \"x \\<in> subst_domain \\<theta>\"\n    using insert.hyps(2) \\<sigma>(1) \\<delta>(1) \\<theta> by (auto simp add: subst_domain_def)\n  moreover have ground_imgs: \"ground (subst_range \\<sigma>)\" \"ground (subst_range \\<delta>)\"\n    using pgwt_ground \\<sigma>(3) \\<delta>(3) by auto\n  ultimately have x_img: \"\\<sigma> x \\<notin> subst_range \\<sigma>\" \"\\<delta> x \\<in> subst_range \\<delta>\"\n    using ground_subst_dom_iff_img by (auto simp add: subst_domain_def)\n\n  have \"ground (insert (\\<delta> x) (subst_range \\<sigma>))\" using ground_imgs x_dom by auto\n  have \\<theta>_dom: \"subst_domain \\<theta> = insert x (subst_domain \\<sigma>)\"\n    using \\<delta>(1) \\<theta> by (auto simp add: subst_domain_def)\n  have \\<theta>_img: \"subst_range \\<theta> = insert (\\<delta> x) (subst_range \\<sigma>)\"\n  proof\n    show \"subst_range \\<theta> \\<subseteq> insert (\\<delta> x) (subst_range \\<sigma>)\"\n    proof\n      fix t assume \"t \\<in> subst_range \\<theta>\"\n      then obtain y where \"y \\<in> subst_domain \\<theta>\" \"t = \\<theta> y\" by auto\n      thus \"t \\<in> insert (\\<delta> x) (subst_range \\<sigma>)\" using \\<theta> by (auto simp add: subst_domain_def)\n    qed\n    show \"insert (\\<delta> x) (subst_range \\<sigma>) \\<subseteq> subst_range \\<theta>\"\n    proof\n      fix t assume t: \"t \\<in> insert (\\<delta> x) (subst_range \\<sigma>)\"\n      hence \"fv t = {}\" using ground_imgs x_img(2) by auto\n      hence \"t \\<noteq> Var x\" by auto\n      show \"t \\<in> subst_range \\<theta>\"\n      proof (cases \"t = \\<delta> x\")\n        case True thus ?thesis using subst_imgI \\<theta> \\<open>t \\<noteq> Var x\\<close> by metis\n      next\n        case False\n        hence \"t \\<in> subst_range \\<sigma>\" using t by auto\n        then obtain y where \"\\<sigma> y \\<in> subst_range \\<sigma>\" \"t = \\<sigma> y\" by auto\n        hence \"y \\<in> subst_domain \\<sigma>\" \"t \\<noteq> Var y\"\n          using ground_subst_dom_iff_img[OF ground_imgs(1)]\n          by (auto simp add: subst_domain_def simp del: subst_range.simps)\n        hence \"x \\<noteq> y\" using x_dom by auto\n        hence \"\\<theta> y = \\<sigma> y\" unfolding \\<theta> by auto\n        thus ?thesis using \\<open>t \\<noteq> Var y\\<close> \\<open>t = \\<sigma> y\\<close> subst_imgI[of \\<theta> y] by auto\n      qed\n    qed\n  qed\n  hence \\<theta>_ground_img: \"ground (subst_range \\<theta>)\" using ground_imgs x_img by auto\n\n  have \"subst_domain \\<theta> = insert x S\" using \\<theta>_dom \\<sigma>(1) by auto\n  moreover have \"bij_betw \\<theta> (subst_domain \\<theta>) (subst_range \\<theta>)\"\n  proof (intro bij_betwI')\n    fix y z assume *: \"y \\<in> subst_domain \\<theta>\" \"z \\<in> subst_domain \\<theta>\"\n    hence \"fv (\\<theta> y) = {}\" \"fv (\\<theta> z) = {}\" using \\<theta>_ground_img by auto\n    { assume \"\\<theta> y = \\<theta> z\" hence \"y = z\"\n      proof (cases \"\\<theta> y \\<in> subst_range \\<sigma> \\<and> \\<theta> z \\<in> subst_range \\<sigma>\")\n        case True\n        hence **: \"y \\<in> subst_domain \\<sigma>\" \"z \\<in> subst_domain \\<sigma>\"\n          using \\<theta> \\<theta>_dom x_img(2) \\<delta>(3) True\n          by (metis (no_types) *(1) DiffE Un_upper2 insertE subsetCE,\n              metis (no_types) *(2) DiffE Un_upper2 insertE subsetCE)\n        hence \"y \\<noteq> x\" \"z \\<noteq> x\" using x_dom by auto\n        hence \"\\<theta> y = \\<sigma> y\" \"\\<theta> z = \\<sigma> z\" using \\<theta> by auto\n        thus ?thesis using \\<open>\\<theta> y = \\<theta> z\\<close> \\<sigma>(2) ** unfolding bij_betw_def inj_on_def by auto\n      qed (metis \\<theta> * \\<open>\\<theta> y = \\<theta> z\\<close> \\<theta>_dom ground_imgs(1) ground_subst_dom_iff_img insertE)\n    }\n    thus \"(\\<theta> y = \\<theta> z) = (y = z)\" by auto\n  next\n    fix y assume \"y \\<in> subst_domain \\<theta>\" thus \"\\<theta> y \\<in> subst_range \\<theta>\" by auto\n  next\n    fix t assume \"t \\<in> subst_range \\<theta>\" thus \"\\<exists>z \\<in> subst_domain \\<theta>. t = \\<theta> z\" by auto\n  qed\n  moreover have \"subst_range \\<theta> \\<subseteq> (\\<lambda>c. Fun c []) ` \\<C>\\<^sub>p\\<^sub>u\\<^sub>b - T\"\n    using \\<sigma>(3) \\<delta>(3) \\<theta> by (auto simp add: subst_domain_def)\n  moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\" using \\<sigma>(4) \\<delta>(4) \\<theta> unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by auto\n  moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\"\n    using \\<theta> \\<sigma>(5) \\<delta>(5) wf_trm_subst_range_iff[of \\<delta>]\n          wf_trm_subst_range_iff[of \\<sigma>] wf_trm_subst_range_iff[of \\<theta>]\n    by presburger\n  ultimately show ?case by blast\nqed\n\ntheorem wt_sat_if_simple:\n  assumes \"simple S\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\"\n  and \\<I>': \"\\<forall>X F. Inequality X F \\<in> set S \\<longrightarrow> ineq_model \\<I>' X F\"\n         \"ground (subst_range \\<I>')\"\n         \"subst_domain \\<I>' = {x \\<in> vars\\<^sub>s\\<^sub>t S. \\<exists>X F. Inequality X F \\<in> set S \\<and> x \\<in> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X}\"\n  and tfr_stp_all: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n  shows \"\\<exists>\\<I>. interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I> \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S, \\<theta>\\<rangle>) \\<and> wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I> \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<I>)\"\nproof -\n  from \\<open>wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\\<close> have \"wf\\<^sub>s\\<^sub>t {} S\" \"subst_idem \\<theta>\" and S_\\<theta>_disj: \"\\<forall>v \\<in> vars\\<^sub>s\\<^sub>t S. \\<theta> v = Var v\"\n    using subst_idemI[of \\<theta>] unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by force+\n  \n  obtain \\<I>::\"('fun,'var) subst\"\n    where \\<I>: \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\" \"subst_range \\<I> \\<subseteq> public_ground_wf_terms\"\n    using wt_interpretation_exists by blast\n  hence \\<I>_deduct: \"\\<And>x M. M \\<turnstile>\\<^sub>c \\<I> x\" and \\<I>_wf_trm: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<I>)\"\n    using pgwt_deducible pgwt_wellformed by fastforce+\n\n  let ?P = \"\\<lambda>\\<delta> X. subst_domain \\<delta> = set X \\<and> ground (subst_range \\<delta>)\"\n  let ?Sineqsvars = \"{x \\<in> vars\\<^sub>s\\<^sub>t S. \\<exists>X F. Inequality X F \\<in> set S \\<and> x \\<in> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\<and> x \\<notin> set X}\"\n  let ?Strms = \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t S)\"\n\n  have finite_vars: \"finite ?Sineqsvars\" \"finite ?Strms\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s ?Strms\"\n    using wf_trm_subtermeq assms(5) by fastforce+\n\n  define Q1 where \"Q1 = (\\<lambda>(F::(('fun,'var) term \\<times> ('fun,'var) term) list) X.\n    \\<forall>x \\<in> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X. \\<exists>a. \\<Gamma> (Var x) = TAtom a)\"\n\n  define Q2 where \"Q2 = (\\<lambda>(F::(('fun,'var) term \\<times> ('fun,'var) term) list) X.\n    \\<forall>f T. Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\<longrightarrow> T = [] \\<or> (\\<exists>s \\<in> set T. s \\<notin> Var ` set X))\"\n\n  define Q1' where \"Q1' = (\\<lambda>(t::('fun,'var) term) (t'::('fun,'var) term) X.\n    \\<forall>x \\<in> (fv t \\<union> fv t') - set X. \\<exists>a. \\<Gamma> (Var x) = TAtom a)\"\n\n  define Q2' where \"Q2' = (\\<lambda>(t::('fun,'var) term) (t'::('fun,'var) term) X.\n    \\<forall>f T. Fun f T \\<in> subterms t \\<union> subterms t' \\<longrightarrow> T = [] \\<or> (\\<exists>s \\<in> set T. s \\<notin> Var ` set X))\"\n\n  have ex_P: \"\\<forall>X. \\<exists>\\<delta>. ?P \\<delta> X\" using interpretation_subst_exists' by blast\n\n  have tfr_ineq: \"\\<forall>X F. Inequality X F \\<in> set S \\<longrightarrow> Q1 F X \\<or> Q2 F X\"\n    using tfr_stp_all Q1_def Q2_def tfr\\<^sub>s\\<^sub>t\\<^sub>p_list_all_alt_def[of S] by blast\n\n  have S_fv_bvars_disj: \"fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\" using \\<open>wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\\<close> unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def by metis\n  hence ineqs_vars_not_bound: \"\\<forall>X F x. Inequality X F \\<in> set S \\<longrightarrow> x \\<in> ?Sineqsvars \\<longrightarrow> x \\<notin> set X\"\n    using strand_fv_bvars_disjoint_unfold by blast\n\n  have \\<theta>_vars_S_bvars_disj: \"(subst_domain \\<theta> \\<union> range_vars \\<theta>) \\<inter> set X = {}\"\n    when \"Inequality X F \\<in> set S\" for F X\n    using wf_constr_bvars_disj[OF \\<open>wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\\<close>]\n          strand_fv_bvars_disjointD(1)[OF S_fv_bvars_disj that]\n    by blast\n\n  obtain \\<sigma>::\"('fun,'var) subst\"\n    where \\<sigma>_fv_dom: \"subst_domain \\<sigma> = ?Sineqsvars\"\n    and \\<sigma>_subterm_inj: \"subterm_inj_on \\<sigma> (subst_domain \\<sigma>)\"\n    and \\<sigma>_fresh_pub_img: \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>) \\<subseteq> {t. {} \\<turnstile>\\<^sub>c t} - ?Strms\"\n    and \\<sigma>_wt: \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<sigma>\"\n    and \\<sigma>_wf_trm: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<sigma>)\"\n    using wt_bij_finite_subst_exists[OF finite_vars]\n          subst_inj_on_is_bij_betw subterm_inj_on_alt_def'\n    by moura\n\n  have \\<sigma>_bij_dom_img: \"bij_betw \\<sigma> (subst_domain \\<sigma>) (subst_range \\<sigma>)\"\n    by (metis \\<sigma>_subterm_inj subst_inj_on_is_bij_betw subterm_inj_on_alt_def)\n\n  have \"finite (subst_domain \\<sigma>)\" by(metis \\<sigma>_fv_dom finite_vars(1))\n  hence \\<sigma>_finite_img: \"finite (subst_range \\<sigma>)\" using \\<sigma>_bij_dom_img bij_betw_finite by blast \n  \n  have \\<sigma>_img_subterms: \"\\<forall>s \\<in> subst_range \\<sigma>. \\<forall>u \\<in> subst_range \\<sigma>. (\\<exists>v. v \\<sqsubseteq> s \\<and> v \\<sqsubseteq> u) \\<longrightarrow> s = u\"\n    by (metis \\<sigma>_subterm_inj subterm_inj_on_alt_def')\n\n  have \"subst_range \\<sigma> \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>)\" by auto\n  hence \"subst_range \\<sigma> \\<subseteq> public_ground_wf_terms - ?Strms\"\n      and \\<sigma>_pgwt_img:\n        \"subst_range \\<sigma> \\<subseteq> public_ground_wf_terms\"\n        \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>) \\<subseteq> public_ground_wf_terms\"\n    using \\<sigma>_fresh_pub_img pgwt_is_empty_synth by blast+\n\n  have \\<sigma>_img_ground: \"ground (subst_range \\<sigma>)\"\n    using \\<sigma>_pgwt_img pgwt_ground by auto\n  hence \\<sigma>_inj: \"inj \\<sigma>\"\n    using \\<sigma>_bij_dom_img subst_inj_is_bij_betw_dom_img_if_ground_img by auto\n\n  have \\<sigma>_ineqs_fv_dom: \"\\<And>X F. Inequality X F \\<in> set S \\<Longrightarrow> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X \\<subseteq> subst_domain \\<sigma>\"\n    using \\<sigma>_fv_dom by fastforce\n\n  have \\<sigma>_dom_bvars_disj: \"\\<forall>X F. Inequality X F \\<in> set S \\<longrightarrow> subst_domain \\<sigma> \\<inter> set X = {}\"\n    using ineqs_vars_not_bound \\<sigma>_fv_dom by fastforce\n  \n  have \\<I>'1: \"\\<forall>X F \\<delta>. Inequality X F \\<in> set S \\<longrightarrow> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X \\<subseteq> subst_domain \\<I>'\"\n    using \\<I>'(3) ineqs_vars_not_bound by fastforce\n  \n  have \\<I>'2: \"\\<forall>X F. Inequality X F \\<in> set S \\<longrightarrow> subst_domain \\<I>' \\<inter> set X = {}\"\n    using \\<I>'(3) ineqs_vars_not_bound by blast\n  \n  have doms_eq: \"subst_domain \\<I>' = subst_domain \\<sigma>\" using \\<I>'(3) \\<sigma>_fv_dom by simp\n\n  have \\<sigma>_ineqs_neq: \"ineq_model \\<sigma> X F\" when \"Inequality X F \\<in> set S\" for X F\n  proof -\n    obtain a::\"'fun\" where a: \"a \\<notin> \\<Union>(funs_term ` subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>))\"\n      using exists_fun_notin_funs_terms[OF subterms_union_finite[OF \\<sigma>_finite_img]]\n      by moura\n    hence a': \"\\<And>T. Fun a T \\<notin> subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>)\"\n              \"\\<And>S. Fun a [] \\<in> set (Fun a []#S)\" \"Fun a [] \\<notin> Var ` set X\"\n      by (meson a UN_I term.set_intros(1), auto)\n\n    define t where \"t \\<equiv> Fun a (Fun a []#map fst F)\"\n    define t' where \"t' \\<equiv> Fun a (Fun a []#map snd F)\"\n\n    note F_in = that\n\n    have t_fv: \"fv t \\<union> fv t' \\<subseteq> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F\"\n      unfolding t_def t'_def by force\n\n    have t_subterms: \"subterms t \\<union> subterms t' \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\<union> {t, t', Fun a []}\"\n      unfolding t_def t'_def by force\n\n    have \"t \\<cdot> \\<delta> \\<cdot> \\<sigma> \\<noteq> t' \\<cdot> \\<delta> \\<cdot> \\<sigma>\" when \"?P \\<delta> X\" for \\<delta>\n    proof -\n      have tfr_assms: \"Q1 F X \\<or> Q2 F X\" using tfr_ineq F_in by metis\n  \n      have \"Q1 F X \\<Longrightarrow> \\<forall>x \\<in> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X. \\<exists>c. \\<sigma> x = Fun c []\"\n      proof\n        fix x assume \"Q1 F X\" and x: \"x \\<in> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X\"\n        then obtain a where \"\\<Gamma> (Var x) = TAtom a\" unfolding Q1_def by moura\n        hence a: \"\\<Gamma> (\\<sigma> x) = TAtom a\" using \\<sigma>_wt unfolding wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by simp\n        \n        have \"x \\<in> subst_domain \\<sigma>\" using \\<sigma>_ineqs_fv_dom x F_in by auto\n        then obtain f T where fT: \"\\<sigma> x = Fun f T\" by (meson \\<sigma>_img_ground ground_img_obtain_fun)\n        hence \"T = []\" using \\<sigma>_wf_trm a TAtom_term_cases by fastforce\n        thus \"\\<exists>c. \\<sigma> x = Fun c []\" using fT by metis\n      qed\n      hence 1: \"Q1 F X \\<Longrightarrow> \\<forall>x \\<in> (fv t \\<union> fv t') - set X. \\<exists>c. \\<sigma> x = Fun c []\"\n        using t_fv by auto\n  \n      have 2: \"\\<not>Q1 F X \\<Longrightarrow> Q2 F X\" by (metis tfr_assms)\n  \n      have 3: \"subst_domain \\<sigma> \\<inter> set X = {}\" using \\<sigma>_dom_bvars_disj F_in by auto\n\n      have 4: \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>) \\<inter> (subterms t \\<union> subterms t') = {}\"\n      proof -\n        define M1 where \"M1 \\<equiv> {t, t', Fun a []}\"\n        define M2 where \"M2 \\<equiv> ?Strms\"\n\n        have \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\<subseteq> M2\"\n          using F_in unfolding M2_def by force\n        moreover have \"subterms t \\<union> subterms t' \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F) \\<union> M1\"\n          using t_subterms unfolding M1_def by blast\n        ultimately have *: \"subterms t \\<union> subterms t' \\<subseteq> M2 \\<union> M1\"\n          by auto\n\n        have \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>) \\<inter> M1 = {}\"\n             \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (subst_range \\<sigma>) \\<inter> M2 = {}\"\n          using a' \\<sigma>_fresh_pub_img\n          unfolding t_def t'_def M1_def M2_def\n          by blast+\n        thus ?thesis using * by blast\n      qed\n  \n      have 5: \"(fv t \\<union> fv t') - subst_domain \\<sigma> \\<subseteq> set X\"\n        using \\<sigma>_ineqs_fv_dom[OF F_in] t_fv\n        by auto\n  \n      have 6: \"\\<forall>\\<delta>. ?P \\<delta> X \\<longrightarrow> t \\<cdot> \\<delta> \\<cdot> \\<I>' \\<noteq> t' \\<cdot> \\<delta> \\<cdot> \\<I>'\"\n        by (metis t_def t'_def \\<I>'(1) F_in ineq_model_singleE ineq_model_single_iff)\n  \n      have 7: \"fv t \\<union> fv t' - set X \\<subseteq> subst_domain \\<I>'\" using \\<I>'1 F_in t_fv by force\n  \n      have 8: \"subst_domain \\<I>' \\<inter> set X = {}\" using \\<I>'2 F_in by auto\n\n      have 9: \"Q1' t t' X\" when \"Q1 F X\"\n        using that t_fv\n        unfolding Q1_def Q1'_def t_def t'_def\n        by blast\n\n      have 10: \"Q2' t t' X\" when \"Q2 F X\" unfolding Q2'_def\n      proof (intro allI impI)\n        fix f T assume \"Fun f T \\<in> subterms t \\<union> subterms t'\"\n        moreover {\n          assume \"Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F)\"\n          hence \"T = [] \\<or> (\\<exists>s\\<in>set T. s \\<notin> Var ` set X)\" by (metis Q2_def that)\n        } moreover {\n          assume \"Fun f T = t\" hence \"T = [] \\<or> (\\<exists>s\\<in>set T. s \\<notin> Var ` set X)\"\n            unfolding t_def using a'(2,3) by simp\n        } moreover {\n          assume \"Fun f T = t'\" hence \"T = [] \\<or> (\\<exists>s\\<in>set T. s \\<notin> Var ` set X)\"\n            unfolding t'_def using a'(2,3) by simp\n        } moreover {\n          assume \"Fun f T = Fun a []\" hence \"T = [] \\<or> (\\<exists>s\\<in>set T. s \\<notin> Var ` set X)\" by simp\n        } ultimately show \"T = [] \\<or> (\\<exists>s\\<in>set T. s \\<notin> Var ` set X)\" using t_subterms by blast\n      qed\n\n      note 11 = \\<sigma>_subterm_inj \\<sigma>_img_ground 3 4 5\n  \n      note 12 = 6 7 8 \\<I>'(2) doms_eq\n  \n      show \"t \\<cdot> \\<delta> \\<cdot> \\<sigma> \\<noteq> t' \\<cdot> \\<delta> \\<cdot> \\<sigma>\"\n        using 1 2 9 10 that sat_ineq_subterm_inj_subst[OF 11 _ 12] \n        unfolding Q1'_def Q2'_def by metis\n    qed\n    thus ?thesis by (metis t_def t'_def ineq_model_singleI ineq_model_single_iff)\n  qed\n\n  have \\<sigma>_ineqs_fv_dom': \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\<cdot>\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\<delta>) \\<subseteq> subst_domain \\<sigma>\"\n    when \"Inequality X F \\<in> set S\" and \"?P \\<delta> X\" for F \\<delta> X\n    using \\<sigma>_ineqs_fv_dom[OF that(1)]\n  proof (induction F)\n    case (Cons g G)\n    obtain t t' where g: \"g = (t,t')\" by (metis surj_pair)\n    hence \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (g#G \\<cdot>\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\<delta>)  = fv (t \\<cdot> \\<delta>) \\<union> fv (t' \\<cdot> \\<delta>) \\<union> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\<cdot>\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\<delta>)\"\n          \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (g#G) = fv t \\<union> fv t' \\<union> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s G\"\n      by (simp_all add: subst_apply_pairs_def)\n    moreover have \"fv (t \\<cdot> \\<delta>) = fv t - subst_domain \\<delta>\" \"fv (t' \\<cdot> \\<delta>) = fv t' - subst_domain \\<delta>\"\n      using g that(2) by (simp_all add: subst_fv_unfold_ground_img range_vars_alt_def)\n    moreover have \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (G \\<cdot>\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\<delta>) \\<subseteq> subst_domain \\<sigma>\" using Cons by auto\n    ultimately show ?case using Cons.prems that(2) by auto\n  qed (simp add: subst_apply_pairs_def)\n\n  have \\<sigma>_ineqs_ground: \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s ((F \\<cdot>\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\<delta>) \\<cdot>\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\<sigma>) = {}\"\n    when \"Inequality X F \\<in> set S\" and \"?P \\<delta> X\" for F \\<delta> X\n    using \\<sigma>_ineqs_fv_dom'[OF that]\n  proof (induction F)\n    case (Cons g G)\n    obtain t t' where g: \"g = (t,t')\" by (metis surj_pair)\n    hence \"fv (t \\<cdot> \\<delta>) \\<subseteq> subst_domain \\<sigma>\" \"fv (t' \\<cdot> \\<delta>) \\<subseteq> subst_domain \\<sigma>\"\n      using Cons.prems by (auto simp add: subst_apply_pairs_def)\n    hence \"fv (t \\<cdot> \\<delta> \\<cdot> \\<sigma>) = {}\" \"fv (t' \\<cdot> \\<delta> \\<cdot> \\<sigma>) = {}\"\n      using subst_fv_dom_ground_if_ground_img[OF _ \\<sigma>_img_ground] by metis+\n    thus ?case using g Cons by (auto simp add: subst_apply_pairs_def)\n  qed (simp add: subst_apply_pairs_def)\n \n  from \\<sigma>_pgwt_img \\<sigma>_ineqs_neq have \\<sigma>_deduct: \"M \\<turnstile>\\<^sub>c \\<sigma> x\" when \"x \\<in> subst_domain \\<sigma>\" for x M\n    using that pgwt_deducible by fastforce\n\n  { fix M::\"('fun,'var) terms\"\n    have \"\\<lbrakk>M; S\\<rbrakk>\\<^sub>c (\\<theta> \\<circ>\\<^sub>s \\<sigma> \\<circ>\\<^sub>s \\<I>)\"\n      using \\<open>wf\\<^sub>s\\<^sub>t {} S\\<close> \\<open>simple S\\<close> S_\\<theta>_disj \\<sigma>_ineqs_neq \\<sigma>_ineqs_fv_dom' \\<theta>_vars_S_bvars_disj\n    proof (induction S arbitrary: M rule: wf\\<^sub>s\\<^sub>t_simple_induct)\n      case (ConsSnd v S)\n      hence S_sat: \"\\<lbrakk>M; S\\<rbrakk>\\<^sub>c (\\<theta> \\<circ>\\<^sub>s \\<sigma> \\<circ>\\<^sub>s \\<I>)\" and \"\\<theta> v = Var v\" by auto\n      hence *: \"\\<And>M. M \\<turnstile>\\<^sub>c Var v \\<cdot> (\\<theta> \\<circ>\\<^sub>s \\<sigma> \\<circ>\\<^sub>s \\<I>)\"\n        using \\<I>_deduct \\<sigma>_deduct\n        by (metis ideduct_synth_subst_apply subst_apply_term.simps(1)\n                  subst_subst_compose trm_subst_ident')\n\n      define M' where \"M' \\<equiv> M \\<union> (ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta> \\<circ>\\<^sub>s \\<sigma> \\<circ>\\<^sub>s \\<I>)\"\n\n      have \"\\<forall>t \\<in> set [Var v]. M' \\<turnstile>\\<^sub>c t \\<cdot> (\\<theta> \\<circ>\\<^sub>s \\<sigma> \\<circ>\\<^sub>s \\<I>)\" using *[of M'] by simp\n      thus ?case\n        using strand_sem_append(1)[OF S_sat, of \"[Send1 (Var v)]\", unfolded M'_def[symmetric]]\n              strand_sem_c.simps(1)[of M'] strand_sem_c.simps(2)[of M' \"[Var v]\" \"[]\"]\n        by presburger\n    next\n      case (ConsIneq X F S)\n      have dom_disj: \"subst_domain \\<theta> \\<inter> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F = {}\"\n        using ConsIneq.prems(1) subst_dom_vars_in_subst\n        by force\n      hence *: \"F \\<cdot>\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\<theta> = F\" by blast\n\n      have **: \"ineq_model \\<sigma> X F\" by (meson ConsIneq.prems(2) in_set_conv_decomp)\n\n      have \"\\<And>x. x \\<in> vars\\<^sub>s\\<^sub>t S \\<Longrightarrow> x \\<in> vars\\<^sub>s\\<^sub>t (S@[Inequality X F])\"\n           \"\\<And>x. x \\<in> set S \\<Longrightarrow> x \\<in> set (S@[Inequality X F])\" by auto\n      hence IH: \"\\<lbrakk>M; S\\<rbrakk>\\<^sub>c (\\<theta> \\<circ>\\<^sub>s \\<sigma> \\<circ>\\<^sub>s \\<I>)\" by (metis ConsIneq.IH ConsIneq.prems(1,2,3,4))\n\n      have \"ineq_model (\\<sigma> \\<circ>\\<^sub>s \\<I>) X F\"\n      proof -\n        have \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\<cdot>\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s \\<delta>) \\<subseteq> subst_domain \\<sigma>\" when \"?P \\<delta> X\" for \\<delta>\n          using ConsIneq.prems(3)[OF _ that] by simp\n        hence \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X \\<subseteq> subst_domain \\<sigma>\"\n          using fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s_subst_subset ex_P\n          by (metis Diff_subset_conv Un_commute)\n        thus ?thesis by (metis ineq_model_ground_subst[OF _ \\<sigma>_img_ground **])\n      qed\n      hence \"ineq_model (\\<theta> \\<circ>\\<^sub>s \\<sigma> \\<circ>\\<^sub>s \\<I>) X F\"\n        using * ineq_model_subst' subst_compose_assoc ConsIneq.prems(4)\n        by (metis UnCI list.set_intros(1) set_append)\n      thus ?case using IH by (auto simp add: ineq_model_def)\n    qed auto\n  }\n  moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t (\\<theta> \\<circ>\\<^sub>s \\<sigma> \\<circ>\\<^sub>s \\<I>)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\<theta> \\<circ>\\<^sub>s \\<sigma> \\<circ>\\<^sub>s \\<I>))\"\n    by (metis wt_subst_compose \\<open>wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\\<close> \\<open>wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<sigma>\\<close> \\<open>wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<close>,\n        metis assms(4) \\<I>_wf_trm \\<sigma>_wf_trm wf_trm_subst subst_img_comp_subset')\n  ultimately show ?thesis\n    using interpretation_comp(1)[OF \\<open>interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<close>, of \"\\<theta> \\<circ>\\<^sub>s \\<sigma>\"]\n          subst_idem_support[OF \\<open>subst_idem \\<theta>\\<close>, of \"\\<sigma> \\<circ>\\<^sub>s \\<I>\"] subst_compose_assoc\n    unfolding constr_sem_c_def by metis\nqed\nend\n\n\nsubsubsection \\<open>Theorem: Type-flaw resistant constraints are well-typed satisfiable (composition-only)\\<close>\ntext \\<open>\n  There exists well-typed models of satisfiable type-flaw resistant constraints in the\n  semantics where the intruder is limited to composition only (i.e., he cannot perform\n  decomposition/analysis of deducible messages).\n\\<close>\ntheorem wt_attack_if_tfr_attack:\n  assumes \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\"\n    and \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S, \\<theta>\\<rangle>\"\n    and \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\"\n    and \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\"\n    and \"tfr\\<^sub>s\\<^sub>t S\"\n    and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\"\n    and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\"\n  obtains \\<I>\\<^sub>\\<tau> where \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau>\"\n    and \"\\<I>\\<^sub>\\<tau> \\<Turnstile>\\<^sub>c \\<langle>S, \\<theta>\\<rangle>\"\n    and \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau>\"\n    and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<I>\\<^sub>\\<tau>)\"\nproof -\n  have tfr: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t (LI_preproc S))\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t (LI_preproc S))\"\n            \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (LI_preproc S)\"\n    using assms(5,6) LI_preproc_preserves_tfr \n    unfolding tfr\\<^sub>s\\<^sub>t_def by (metis, metis LI_preproc_trms_eq, metis)\n  have wf_constr: \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r (LI_preproc S) \\<theta>\" by (metis LI_preproc_preserves_wellformedness assms(3))\n  obtain S' \\<theta>' where *: \"simple S'\" \"(LI_preproc S,\\<theta>) \\<leadsto>\\<^sup>* (S',\\<theta>')\" \"\\<lbrakk>{}; S'\\<rbrakk>\\<^sub>c \\<I>\"\n    using LI_completeness[OF assms(3,2)] unfolding constr_sem_c_def\n    by (meson term.order_refl)\n  have **: \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S' \\<theta>'\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>'\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S')\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>')\" \n    using LI_preserves_welltypedness[OF *(2) wf_constr assms(4,7) tfr]\n          LI_preserves_wellformedness[OF *(2) wf_constr]\n          LI_preserves_tfr[OF *(2) wf_constr assms(4,7) tfr]\n    by metis+\n\n  define A where \"A \\<equiv> {x \\<in> vars\\<^sub>s\\<^sub>t S'. \\<exists>X F. Inequality X F \\<in> set S' \\<and> x \\<in> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F \\<and> x \\<notin> set X}\"\n  define B where \"B \\<equiv> UNIV - A\"\n\n  let ?\\<I> = \"rm_vars B \\<I>\"\n\n  have gr\\<I>: \"ground (subst_range \\<I>)\" \"ground (subst_range ?\\<I>)\"\n    using assms(1) rm_vars_img_subset[of B \\<I>] by (auto simp add: subst_domain_def)\n\n  { fix X F\n    assume \"Inequality X F \\<in> set S'\"\n    hence *: \"ineq_model \\<I> X F\"\n      using strand_sem_c_imp_ineq_model[OF *(3)]\n      by (auto simp del: subst_range.simps)\n    hence \"ineq_model ?\\<I> X F\"\n    proof -\n      { fix \\<delta>\n        assume 1: \"subst_domain \\<delta> = set X\" \"ground (subst_range \\<delta>)\"\n            and 2: \"list_ex (\\<lambda>f. fst f \\<cdot> \\<delta> \\<circ>\\<^sub>s \\<I> \\<noteq> snd f \\<cdot> \\<delta> \\<circ>\\<^sub>s \\<I>) F\"\n        have \"list_ex (\\<lambda>f. fst f \\<cdot> \\<delta> \\<circ>\\<^sub>s rm_vars B \\<I> \\<noteq> snd f \\<cdot> \\<delta> \\<circ>\\<^sub>s rm_vars B \\<I>) F\" using 2\n        proof (induction F)\n          case (Cons g G)\n          obtain t t' where g: \"g = (t,t')\" by (metis surj_pair)\n          thus ?case\n            using Cons Unifier_ground_rm_vars[OF gr\\<I>(1), of \"t \\<cdot> \\<delta>\" B \"t' \\<cdot> \\<delta>\"]\n            by auto\n        qed simp\n      } thus ?thesis using * unfolding ineq_model_def list_ex_iff case_prod_unfold by simp\n    qed\n  } moreover have \"subst_domain \\<I> = UNIV\" using assms(1) by metis\n  hence \"subst_domain ?\\<I> = A\" using rm_vars_dom[of B \\<I>] B_def by blast\n  ultimately obtain \\<I>\\<^sub>\\<tau> where\n      \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau>\" \"\\<I>\\<^sub>\\<tau> \\<Turnstile>\\<^sub>c \\<langle>S', \\<theta>'\\<rangle>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<I>\\<^sub>\\<tau>)\"\n    using wt_sat_if_simple[OF *(1) **(1,2,5,4) _ gr\\<I>(2) _ **(3)] A_def\n    by (auto simp del: subst_range.simps)\n  thus ?thesis using that LI_soundness[OF assms(3) *(2)] by metis\nqed\n\ntext \\<open>\n  Contra-positive version: if a type-flaw resistant constraint does not have a well-typed model\n  then it is unsatisfiable\n\\<close>\ncorollary secure_if_wt_secure:\n  assumes \"\\<not>(\\<exists>\\<I>\\<^sub>\\<tau>. interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau> \\<and> (\\<I>\\<^sub>\\<tau> \\<Turnstile>\\<^sub>c \\<langle>S, \\<theta>\\<rangle>) \\<and> wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau>)\"\n  and     \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\" \"tfr\\<^sub>s\\<^sub>t S\"\n  and     \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t S)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\"\n  shows \"\\<not>(\\<exists>\\<I>. interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I> \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S, \\<theta>\\<rangle>))\"\nusing wt_attack_if_tfr_attack[OF _ _ assms(2,3,4,5,6)] assms(1) by metis\n\nend\n\n\nsubsection \\<open>Lifting the Composition-Only Typing Result to the Full Intruder Model\\<close>\ncontext typing_result\nbegin\n\nsubsubsection \\<open>Analysis Invariance\\<close>\ndefinition (in typed_model) Ana_invar_subst where\n  \"Ana_invar_subst \\<M> \\<equiv>\n    (\\<forall>f T K M \\<delta>. Fun f T \\<in> (subterms\\<^sub>s\\<^sub>e\\<^sub>t \\<M>) \\<longrightarrow>\n                 Ana (Fun f T) = (K, M) \\<longrightarrow> Ana (Fun f T \\<cdot> \\<delta>) = (K \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<delta>, M \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<delta>))\"\n\nlemma (in typed_model) Ana_invar_subst_subset:\n  assumes \"Ana_invar_subst M\" \"N \\<subseteq> M\"\n  shows \"Ana_invar_subst N\"\nusing assms unfolding Ana_invar_subst_def by blast\n\nlemma (in typed_model) Ana_invar_substD:\n  assumes \"Ana_invar_subst \\<M>\"\n  and \"Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t \\<M>\" \"Ana (Fun f T) = (K, M)\"\n  shows \"Ana (Fun f T \\<cdot> \\<I>) = (K \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>, M \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>)\"\nusing assms Ana_invar_subst_def by blast\n\nend\n\n\nsubsubsection \\<open>Preliminary Definitions\\<close>\ntext \\<open>Strands extended with \"decomposition steps\"\\<close>\ndatatype (funs\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p: 'a, vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p: 'b) extstrand_step =\n  Step   \"('a,'b) strand_step\"\n| Decomp \"('a,'b) term\"\n\ncontext typing_result\nbegin\n\ncontext\nbegin\nprivate fun trms\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p where\n  \"trms\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p (Step x) = trms\\<^sub>s\\<^sub>t\\<^sub>p x\"\n| \"trms\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p (Decomp t) = {t}\"\n\nprivate abbreviation trms\\<^sub>e\\<^sub>s\\<^sub>t where \"trms\\<^sub>e\\<^sub>s\\<^sub>t S \\<equiv> \\<Union>(trms\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p ` set S)\"\n\nprivate type_synonym ('a,'b) extstrand = \"('a,'b) extstrand_step list\"\nprivate type_synonym ('a,'b) extstrands = \"('a,'b) extstrand set\"\n\nprivate definition decomp::\"('fun,'var) term \\<Rightarrow> ('fun,'var) strand\" where\n  \"decomp t \\<equiv> (case (Ana t) of (K,T) \\<Rightarrow> [send\\<langle>[t]\\<rangle>\\<^sub>s\\<^sub>t,send\\<langle>K\\<rangle>\\<^sub>s\\<^sub>t,receive\\<langle>T\\<rangle>\\<^sub>s\\<^sub>t])\"\n\nprivate fun to_st where\n  \"to_st [] = []\"\n| \"to_st (Step x#S) = x#(to_st S)\"\n| \"to_st (Decomp t#S) = (decomp t)@(to_st S)\"\n\nprivate fun to_est where\n  \"to_est [] = []\"\n| \"to_est (x#S) = Step x#to_est S\"\n\nprivate abbreviation \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<equiv> ik\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"wf\\<^sub>e\\<^sub>s\\<^sub>t V A \\<equiv> wf\\<^sub>s\\<^sub>t V (to_st A)\"\nprivate abbreviation \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\<equiv> assignment_rhs\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"vars\\<^sub>e\\<^sub>s\\<^sub>t A \\<equiv> vars\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t A \\<equiv> wfrestrictedvars\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"bvars\\<^sub>e\\<^sub>s\\<^sub>t A \\<equiv> bvars\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"fv\\<^sub>e\\<^sub>s\\<^sub>t A \\<equiv> fv\\<^sub>s\\<^sub>t (to_st A)\"\nprivate abbreviation \"funs\\<^sub>e\\<^sub>s\\<^sub>t A \\<equiv> funs\\<^sub>s\\<^sub>t (to_st A)\"\n\nprivate definition wf\\<^sub>s\\<^sub>t\\<^sub>s'::\"('fun,'var) strands \\<Rightarrow> ('fun,'var) extstrand \\<Rightarrow> bool\" where\n  \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> \\<A> \\<equiv> (\\<forall>S \\<in> \\<S>. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) (dual\\<^sub>s\\<^sub>t S)) \\<and>\n                 (\\<forall>S \\<in> \\<S>. \\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}) \\<and>\n                 (\\<forall>S \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A> = {}) \\<and>\n                 (\\<forall>S \\<in> \\<S>. fv\\<^sub>s\\<^sub>t (to_st \\<A>) \\<inter> bvars\\<^sub>s\\<^sub>t S = {})\"\n\nprivate definition wf\\<^sub>s\\<^sub>t\\<^sub>s::\"('fun,'var) strands \\<Rightarrow> bool\" where\n  \"wf\\<^sub>s\\<^sub>t\\<^sub>s \\<S> \\<equiv> (\\<forall>S \\<in> \\<S>. wf\\<^sub>s\\<^sub>t {} (dual\\<^sub>s\\<^sub>t S)) \\<and> (\\<forall>S \\<in> \\<S>. \\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {})\"\n\nprivate inductive well_analyzed::\"('fun,'var) extstrand \\<Rightarrow> bool\" where\n  Nil[simp]: \"well_analyzed []\"\n| Step: \"well_analyzed A \\<Longrightarrow> well_analyzed (A@[Step x])\"\n| Decomp: \"\\<lbrakk>well_analyzed A; t \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) - (Var ` \\<V>)\\<rbrakk>\n    \\<Longrightarrow> well_analyzed (A@[Decomp t])\"\n\nprivate fun subst_apply_extstrandstep (infix \"\\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p\" 51) where\n  \"subst_apply_extstrandstep (Step x) \\<theta> = Step (x \\<cdot>\\<^sub>s\\<^sub>t\\<^sub>p \\<theta>)\"\n| \"subst_apply_extstrandstep (Decomp t) \\<theta> = Decomp (t \\<cdot> \\<theta>)\"\n\nprivate lemma subst_apply_extstrandstep'_simps[simp]:\n  \"(Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)) \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta> = Step (send\\<langle>ts \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<theta>\\<rangle>\\<^sub>s\\<^sub>t)\"\n  \"(Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)) \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta> = Step (receive\\<langle>ts \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<theta>\\<rangle>\\<^sub>s\\<^sub>t)\"\n  \"(Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)) \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta> = Step (\\<langle>a: (t \\<cdot> \\<theta>) \\<doteq> (t' \\<cdot> \\<theta>)\\<rangle>\\<^sub>s\\<^sub>t)\"\n  \"(Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)) \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta> = Step (\\<forall>X\\<langle>\\<or>\\<noteq>: (F \\<cdot>\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\<theta>)\\<rangle>\\<^sub>s\\<^sub>t)\"\nby simp_all\n\nprivate lemma vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p_subst_apply_simps[simp]:\n  \"vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p ((Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)) \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta>) = fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta>)\"\n  \"vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p ((Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)) \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta>) = fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta>)\"\n  \"vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p ((Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)) \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta>) = fv (t \\<cdot> \\<theta>) \\<union> fv (t' \\<cdot> \\<theta>)\"\n  \"vars\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p ((Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)) \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta>) = set X \\<union> fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s (F \\<cdot>\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s rm_vars (set X) \\<theta>)\"\nby auto\n\nprivate definition subst_apply_extstrand (infix \"\\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\" 51) where \"S \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta> \\<equiv> map (\\<lambda>x. x \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta>) S\"\n\nprivate abbreviation update\\<^sub>s\\<^sub>t::\"('fun,'var) strands \\<Rightarrow> ('fun,'var) strand \\<Rightarrow> ('fun,'var) strands\"\nwhere\n  \"update\\<^sub>s\\<^sub>t \\<S> S \\<equiv> (case S of Nil \\<Rightarrow> \\<S> - {S} | Cons _ S' \\<Rightarrow> insert S' (\\<S> - {S}))\"\n\nprivate inductive_set decomps\\<^sub>e\\<^sub>s\\<^sub>t::\n  \"('fun,'var) terms \\<Rightarrow> ('fun,'var) terms \\<Rightarrow> ('fun,'var) subst \\<Rightarrow> ('fun,'var) extstrands\"\n(* \\<M>: intruder knowledge\n   \\<N>: additional messages\n*)\nfor \\<M> and \\<N> and \\<I> where\n  Nil: \"[] \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t \\<M> \\<N> \\<I>\"\n| Decomp: \"\\<lbrakk>\\<D> \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t \\<M> \\<N> \\<I>; Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\<M> \\<union> \\<N>);\n            Ana (Fun f T) = (K,M); M \\<noteq> [];\n            (\\<M> \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t \\<D>) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c Fun f T \\<cdot> \\<I>;\n            \\<And>k. k \\<in> set K \\<Longrightarrow> (\\<M> \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t \\<D>) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c k \\<cdot> \\<I>\\<rbrakk>\n            \\<Longrightarrow> \\<D>@[Decomp (Fun f T)] \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t \\<M> \\<N> \\<I>\"\n\nprivate fun decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t::\"('fun,'var) extstrand \\<Rightarrow> ('fun,'var) extstrand\" where\n  \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t [] = []\"\n| \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (Decomp t#S) = decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t S\"\n| \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (Step x#S) = Step x#(decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t S)\"\n\nprivate inductive sem\\<^sub>e\\<^sub>s\\<^sub>t_d::\"('fun,'var) terms \\<Rightarrow> ('fun,'var) subst \\<Rightarrow> ('fun,'var) extstrand \\<Rightarrow> bool\"\nwhere\n  Nil[simp]: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> []\"\n| Send: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> S \\<Longrightarrow> \\<forall>t \\<in> set ts. (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\<union> M\\<^sub>0) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t \\<cdot> \\<I>\n          \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> (S@[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Receive: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> S \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> (S@[Step (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Equality: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> S \\<Longrightarrow> t \\<cdot> \\<I> = t' \\<cdot> \\<I> \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> (S@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Inequality: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> S\n    \\<Longrightarrow> ineq_model \\<I> X F\n    \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> (S@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Decompose: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> S \\<Longrightarrow> (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\<union> M\\<^sub>0) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t \\<cdot> \\<I> \\<Longrightarrow> Ana t = (K, M)\n    \\<Longrightarrow> (\\<And>k. k \\<in> set K \\<Longrightarrow> (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\<union> M\\<^sub>0) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> k \\<cdot> \\<I>) \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> (S@[Decomp t])\"\n\nprivate inductive sem\\<^sub>e\\<^sub>s\\<^sub>t_c::\"('fun,'var) terms \\<Rightarrow> ('fun,'var) subst \\<Rightarrow> ('fun,'var) extstrand \\<Rightarrow> bool\"\nwhere\n  Nil[simp]: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> []\"\n| Send: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> S \\<Longrightarrow> \\<forall>t \\<in> set ts. (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\<union> M\\<^sub>0) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\n          \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> (S@[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Receive: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> S \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> (S@[Step (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Equality: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> S \\<Longrightarrow> t \\<cdot> \\<I> = t' \\<cdot> \\<I> \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> (S@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Inequality: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> S\n    \\<Longrightarrow> ineq_model \\<I> X F\n    \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> (S@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Decompose: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> S \\<Longrightarrow> (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\<union> M\\<^sub>0) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I> \\<Longrightarrow> Ana t = (K, M)\n    \\<Longrightarrow> (\\<And>k. k \\<in> set K \\<Longrightarrow> (ik\\<^sub>e\\<^sub>s\\<^sub>t S \\<union> M\\<^sub>0) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c k \\<cdot> \\<I>) \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> (S@[Decomp t])\"\n\n\nsubsubsection \\<open>Preliminary Lemmata\\<close>\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s_wf\\<^sub>s\\<^sub>t\\<^sub>s':\n  \"wf\\<^sub>s\\<^sub>t\\<^sub>s \\<S> = wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> []\"\nby (simp add: wf\\<^sub>s\\<^sub>t\\<^sub>s_def wf\\<^sub>s\\<^sub>t\\<^sub>s'_def)\n\nprivate lemma decomp_ik:\n  assumes \"Ana t = (K,M)\"\n  shows \"ik\\<^sub>s\\<^sub>t (decomp t) = set M\"\nusing ik_rcv_map ik_rcv_map'\nby (auto simp add: decomp_def inv_def assms)\n\nprivate lemma decomp_assignment_rhs_empty:\n  assumes \"Ana t = (K,M)\"\n  shows \"assignment_rhs\\<^sub>s\\<^sub>t (decomp t) = {}\"\nby (auto simp add: decomp_def inv_def assms)\n\nprivate lemma decomp_tfr\\<^sub>s\\<^sub>t\\<^sub>p:\n  \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (decomp t)\"\nby (auto simp add: decomp_def list_all_def)\n\nprivate lemma trms\\<^sub>e\\<^sub>s\\<^sub>t_ikI:\n  \"t \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<Longrightarrow> t \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nproof (induction A rule: to_st.induct)\n  case (2 x S) thus ?case by (cases x) auto\nnext\n  case (3 t' A)\n  obtain K M where Ana: \"Ana t' = (K,M)\" by (metis surj_pair)\n  show ?case using 3 decomp_ik[OF Ana] Ana_subterm[OF Ana] by auto\nqed simp\n\nprivate lemma trms\\<^sub>e\\<^sub>s\\<^sub>t_ik_assignment_rhsI:\n  \"t \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\<Longrightarrow> t \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nproof (induction A rule: to_st.induct)\n  case (2 x S) thus ?case\n  proof (cases x)\n    case (Equality ac t t') thus ?thesis using 2 by (cases ac) auto\n  qed auto\nnext\n  case (3 t' A)\n  obtain K M where Ana: \"Ana t' = (K,M)\" by (metis surj_pair)\n  show ?case\n    using 3 decomp_ik[OF Ana] decomp_assignment_rhs_empty[OF Ana] Ana_subterm[OF Ana]\n    by auto\nqed simp\n\nprivate lemma trms\\<^sub>e\\<^sub>s\\<^sub>t_ik_subtermsI:\n  assumes \"t \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n  shows \"t \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nproof -\n  obtain t' where \"t' \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A\" \"t \\<sqsubseteq> t'\" using trms\\<^sub>e\\<^sub>s\\<^sub>t_ikI assms by auto\n  thus ?thesis by (meson contra_subsetD in_subterms_subset_Union trms\\<^sub>e\\<^sub>s\\<^sub>t_ikI)\nqed\n\nprivate lemma trms\\<^sub>e\\<^sub>s\\<^sub>tD:\n  assumes \"t \\<in> trms\\<^sub>e\\<^sub>s\\<^sub>t A\"\n  shows \"t \\<in> trms\\<^sub>s\\<^sub>t (to_st A)\"\nusing assms\nproof (induction A)\n  case (Cons a A)\n  obtain K M where Ana: \"Ana t = (K,M)\" by (metis surj_pair)\n  hence \"t \\<in> trms\\<^sub>s\\<^sub>t (decomp t)\" unfolding decomp_def by force\n  thus ?case using Cons.IH Cons.prems by (cases a) auto\nqed simp\n\nprivate lemma subst_apply_extstrand_nil[simp]:\n  \"[] \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta> = []\"\nby (simp add: subst_apply_extstrand_def)\n\nprivate lemma subst_apply_extstrand_singleton[simp]:\n  \"[Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)] \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta> = [Step (Receive (ts \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<theta>))]\"\n  \"[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)] \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta> = [Step (Send (ts \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<theta>))]\"\n  \"[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)] \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta> = [Step (Equality a (t \\<cdot> \\<theta>) (t' \\<cdot> \\<theta>))]\"\n  \"[Decomp t] \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta> = [Decomp (t \\<cdot> \\<theta>)]\"\nunfolding subst_apply_extstrand_def by auto\n\nprivate lemma extstrand_subst_hom:\n  \"(S@S') \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta> = (S \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>)@(S' \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>)\" \"(x#S) \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta> = (x \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta>)#(S \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>)\"\nunfolding subst_apply_extstrand_def by auto\n\nprivate lemma decomp_vars:\n  \"wfrestrictedvars\\<^sub>s\\<^sub>t (decomp t) = fv t\" \"vars\\<^sub>s\\<^sub>t (decomp t) = fv t\" \"bvars\\<^sub>s\\<^sub>t (decomp t) = {}\"\n  \"fv\\<^sub>s\\<^sub>t (decomp t) = fv t\"\nproof -\n  obtain K M where Ana: \"Ana t = (K,M)\" by (metis surj_pair)\n  hence \"decomp t = [send\\<langle>[t]\\<rangle>\\<^sub>s\\<^sub>t,Send K,Receive M]\"\n    unfolding decomp_def by simp\n  moreover have \"\\<Union>(set (map fv K)) = fv\\<^sub>s\\<^sub>e\\<^sub>t (set K)\" \"\\<Union>(set (map fv M)) = fv\\<^sub>s\\<^sub>e\\<^sub>t (set M)\" by auto\n  moreover have \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set K) \\<subseteq> fv t\" \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set M) \\<subseteq> fv t\"\n    using Ana_subterm[OF Ana(1)] Ana_keys_fv[OF Ana(1)]\n    by (simp_all add: UN_least psubsetD subtermeq_vars_subset)\n  ultimately show\n      \"wfrestrictedvars\\<^sub>s\\<^sub>t (decomp t) = fv t\" \"vars\\<^sub>s\\<^sub>t (decomp t) = fv t\" \"bvars\\<^sub>s\\<^sub>t (decomp t) = {}\"\n      \"fv\\<^sub>s\\<^sub>t (decomp t) = fv t\"\n    by auto\nqed\n\nprivate lemma bvars\\<^sub>e\\<^sub>s\\<^sub>t_cons: \"bvars\\<^sub>e\\<^sub>s\\<^sub>t (x#X) = bvars\\<^sub>e\\<^sub>s\\<^sub>t [x] \\<union> bvars\\<^sub>e\\<^sub>s\\<^sub>t X\"\nby (cases x) auto\n\nprivate lemma bvars\\<^sub>e\\<^sub>s\\<^sub>t_append: \"bvars\\<^sub>e\\<^sub>s\\<^sub>t (A@B) = bvars\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> bvars\\<^sub>e\\<^sub>s\\<^sub>t B\"\nproof (induction A)\n  case (Cons x A) thus ?case using bvars\\<^sub>e\\<^sub>s\\<^sub>t_cons[of x \"A@B\"] bvars\\<^sub>e\\<^sub>s\\<^sub>t_cons[of x A] by force\nqed simp\n\nprivate lemma fv\\<^sub>e\\<^sub>s\\<^sub>t_cons: \"fv\\<^sub>e\\<^sub>s\\<^sub>t (x#X) = fv\\<^sub>e\\<^sub>s\\<^sub>t [x] \\<union> fv\\<^sub>e\\<^sub>s\\<^sub>t X\"\nby (cases x) auto\n\nprivate lemma fv\\<^sub>e\\<^sub>s\\<^sub>t_append: \"fv\\<^sub>e\\<^sub>s\\<^sub>t (A@B) = fv\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> fv\\<^sub>e\\<^sub>s\\<^sub>t B\"\nproof (induction A)\n  case (Cons x A) thus ?case using fv\\<^sub>e\\<^sub>s\\<^sub>t_cons[of x \"A@B\"] fv\\<^sub>e\\<^sub>s\\<^sub>t_cons[of x A] by auto\nqed simp\n\nprivate lemma bvars_decomp: \"bvars\\<^sub>e\\<^sub>s\\<^sub>t (A@[Decomp t]) = bvars\\<^sub>e\\<^sub>s\\<^sub>t A\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t (Decomp t#A) = bvars\\<^sub>e\\<^sub>s\\<^sub>t A\"\nusing bvars\\<^sub>e\\<^sub>s\\<^sub>t_append decomp_vars(3) by fastforce+\n\nprivate lemma bvars_decomp_rm: \"bvars\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) = bvars\\<^sub>e\\<^sub>s\\<^sub>t A\"\nusing bvars_decomp by (induct A rule: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t.induct) simp_all+\n\nprivate lemma fv_decomp_rm: \"fv\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<subseteq> fv\\<^sub>e\\<^sub>s\\<^sub>t A\"\nby (induct A rule: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t.induct) auto\n\nprivate lemma ik_assignment_rhs_decomp_fv:\n  assumes \"t \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n  shows \"fv\\<^sub>e\\<^sub>s\\<^sub>t (A@[Decomp t]) = fv\\<^sub>e\\<^sub>s\\<^sub>t A\"\nproof -\n  have \"fv\\<^sub>e\\<^sub>s\\<^sub>t (A@[Decomp t]) = fv\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> fv t\" using fv\\<^sub>e\\<^sub>s\\<^sub>t_append decomp_vars by simp\n  moreover have \"fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\<subseteq> fv\\<^sub>e\\<^sub>s\\<^sub>t A\" by force\n  moreover have \"fv t \\<subseteq> fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n    using fv_subset_subterms[OF assms(1)] by simp\n  ultimately show ?thesis by blast\nqed\n\nprivate lemma wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_subset:\n  \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<subseteq> wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t A\"\nby (induct A rule: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t.induct) auto+\n\nprivate lemma wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_eq_wfrestrictedvars\\<^sub>s\\<^sub>t:\n  \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t A = wfrestrictedvars\\<^sub>s\\<^sub>t (to_st A)\"\nby simp\n\nprivate lemma decomp_set_unfold:\n  assumes \"Ana t = (K, M)\"\n  shows \"set (decomp t) = {send\\<langle>[t]\\<rangle>\\<^sub>s\\<^sub>t,send\\<langle>K\\<rangle>\\<^sub>s\\<^sub>t,receive\\<langle>M\\<rangle>\\<^sub>s\\<^sub>t}\"\nusing assms unfolding decomp_def by auto\n\nprivate lemma ik\\<^sub>e\\<^sub>s\\<^sub>t_finite: \"finite (ik\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nby (rule finite_ik\\<^sub>s\\<^sub>t)\n\nprivate lemma assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_finite: \"finite (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nby (rule finite_assignment_rhs\\<^sub>s\\<^sub>t)\n\nprivate lemma to_est_append: \"to_est (A@B) = to_est A@to_est B\"\nby (induct A rule: to_est.induct) auto\n\nprivate lemma to_st_to_est_inv: \"to_st (to_est A) = A\"\nby (induct A rule: to_est.induct) auto\n\nprivate lemma to_st_append: \"to_st (A@B) = (to_st A)@(to_st B)\"\nby (induct A rule: to_st.induct) auto\n\nprivate lemma to_st_cons: \"to_st (a#B) = (to_st [a])@(to_st B)\"\nusing to_st_append[of \"[a]\" B] by simp\n\nprivate lemma wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split:\n  \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t (x#S) = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t [x] \\<union> wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t S\"\n  \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t (S@S') = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t S \\<union> wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t S'\"\nusing to_st_cons[of x S] to_st_append[of S S'] by auto\n\nprivate lemma ik\\<^sub>e\\<^sub>s\\<^sub>t_append: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B) = ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t B\"\nby (metis ik_append to_st_append)\n\nprivate lemma assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append:\n  \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@B) = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t B\"\nby (metis assignment_rhs_append to_st_append)\n\nprivate lemma ik\\<^sub>e\\<^sub>s\\<^sub>t_cons: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (a#A) = ik\\<^sub>e\\<^sub>s\\<^sub>t [a] \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t A\"\nby (metis ik_append to_st_cons) \n\nprivate lemma ik\\<^sub>e\\<^sub>s\\<^sub>t_append_subst:\n  \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>) = ik\\<^sub>e\\<^sub>s\\<^sub>t (A \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (B \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>)\"\n  \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta> = (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t B \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta>)\"\nby (metis ik\\<^sub>e\\<^sub>s\\<^sub>t_append extstrand_subst_hom(1), simp add: image_Un to_st_append)\n\nprivate lemma assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append_subst:\n  \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@B \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>) = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>) \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (B \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>)\"\n  \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@B) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta> = (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta>) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t B \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta>)\"\nby (metis assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append extstrand_subst_hom(1), use assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append in blast)\n\nprivate lemma ik\\<^sub>e\\<^sub>s\\<^sub>t_cons_subst:\n  \"ik\\<^sub>e\\<^sub>s\\<^sub>t (a#A \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>) = ik\\<^sub>e\\<^sub>s\\<^sub>t ([a \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<theta>]) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (A \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<theta>)\"\n  \"ik\\<^sub>e\\<^sub>s\\<^sub>t (a#A) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta> = (ik\\<^sub>e\\<^sub>s\\<^sub>t [a] \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta>)\"\nby (metis ik\\<^sub>e\\<^sub>s\\<^sub>t_cons extstrand_subst_hom(2), metis image_Un ik\\<^sub>e\\<^sub>s\\<^sub>t_cons)\n\nprivate lemma decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append: \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (S@S') = (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t S)@(decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t S')\"\nby (induct S rule: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t.induct) auto\n\nprivate lemma decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_single[simp]:\n  \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t [Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)] = [Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t [Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)] = [Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  \"decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t [Decomp t] = []\"\nby auto\n\nprivate lemma decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t S) \\<subseteq> ik\\<^sub>e\\<^sub>s\\<^sub>t S\"\nproof (induction S rule: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n  case (3 x S) thus ?case by (cases x) auto\nqed auto\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset: \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I> \\<Longrightarrow> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\<union> N)\"\nproof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n  case (Decomp D f T K M')\n  have \"ik\\<^sub>s\\<^sub>t (decomp (Fun f T)) \\<subseteq> subterms (Fun f T)\"\n       \"ik\\<^sub>s\\<^sub>t (decomp (Fun f T)) = ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f T)]\"\n    using decomp_ik[OF Decomp.hyps(3)] Ana_subterm[OF Decomp.hyps(3)]\n    by auto\n  hence \"ik\\<^sub>s\\<^sub>t (to_st [Decomp (Fun f T)]) \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\<union> N)\"\n    using in_subterms_subset_Union[OF Decomp.hyps(2)]\n    by blast\n  thus ?case using ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of D \"[Decomp (Fun f T)]\"] using Decomp.IH by auto\nqed simp\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_empty: \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I> \\<Longrightarrow> decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t D = []\"\nby (induct D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct) (auto simp add: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append)\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_append:\n  assumes \"A \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t S N \\<I>\" \"B \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t S N \\<I>\"\n  shows \"A@B \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t S N \\<I>\"\nusing assms(2)\nproof (induction B rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n  case Nil show ?case using assms(1) by simp\nnext\n  case (Decomp B f X K T)\n  hence \"S \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t B \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<subseteq> S \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" using ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n  thus ?case\n    using decomps\\<^sub>e\\<^sub>s\\<^sub>t.Decomp[OF Decomp.IH(1) Decomp.hyps(2,3,4)]\n          ideduct_synth_mono[OF Decomp.hyps(5)]\n          ideduct_synth_mono[OF Decomp.hyps(6)]\n    by auto\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_subterms:\n  assumes \"A' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\"\n  shows \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A') \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\<union> N)\"\nusing assms\nproof (induction A' rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n  case (Decomp D f X K T)\n  hence \"Fun f X \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\<union> N)\" by auto\n  hence \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (set X) \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\<union> N)\"\n    using in_subterms_subset_Union[of \"Fun f X\" \"M \\<union> N\"] params_subterms_Union[of X f]\n    by blast\n  moreover have \"ik\\<^sub>s\\<^sub>t (to_st [Decomp (Fun f X)]) = set T\" using Decomp.hyps(3) decomp_ik by simp\n  hence \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>s\\<^sub>t (to_st [Decomp (Fun f X)])) \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (set X)\"\n    using Ana_fun_subterm[OF Decomp.hyps(3)] by auto\n  ultimately show ?case\n    using ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of D \"[Decomp (Fun f X)]\"] Decomp.IH\n    by auto\nqed simp\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_assignment_rhs_empty:\n  assumes \"A' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\"\n  shows \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A' = {}\"\nusing assms\nby (induction A' rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n   (simp_all add: decomp_assignment_rhs_empty assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append) \n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_finite_ik_append:\n  assumes \"finite M\" \"M \\<subseteq> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>\"\n  shows \"\\<exists>D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>. ik\\<^sub>e\\<^sub>s\\<^sub>t D = (\\<Union>m \\<in> M. ik\\<^sub>e\\<^sub>s\\<^sub>t m)\"\nusing assms\nproof (induction M rule: finite_induct)\n  case empty\n  moreover have \"[] \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>\" \"ik\\<^sub>s\\<^sub>t (to_st []) = {}\" using decomps\\<^sub>e\\<^sub>s\\<^sub>t.Nil by auto\n  ultimately show ?case by blast\nnext\n  case (insert m M)\n  then obtain D where \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t D = (\\<Union>m\\<in>M. ik\\<^sub>s\\<^sub>t (to_st m))\" by moura\n  moreover have \"m \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>\" using insert.prems(1) by blast\n  ultimately show ?case using decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[of D A N \\<I> m] ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of D m] by blast\nqed\n\nprivate lemma decomp_snd_exists[simp]: \"\\<exists>D. decomp t = send\\<langle>[t]\\<rangle>\\<^sub>s\\<^sub>t#D\"\nby (metis (mono_tags, lifting) decomp_def prod.case surj_pair)\n\nprivate lemma decomp_nonnil[simp]: \"decomp t \\<noteq> []\"\nusing decomp_snd_exists[of t] by fastforce\n\nprivate lemma to_st_nil_inv[dest]: \"to_st A = [] \\<Longrightarrow> A = []\"\nby (induct A rule: to_st.induct) auto\n\nprivate lemma well_analyzedD:\n  assumes \"well_analyzed A\" \"Decomp t \\<in> set A\"\n  shows \"\\<exists>f T. t = Fun f T\"\nusing assms\nproof (induction A rule: well_analyzed.induct)\n  case (Decomp A t')\n  hence \"\\<exists>f T. t' = Fun f T\" by (cases t') auto\n  moreover have \"Decomp t \\<in> set A \\<or> t = t'\" using Decomp by auto\n  ultimately show ?case using Decomp.IH by auto\nqed auto\n\nprivate lemma well_analyzed_inv:\n  assumes \"well_analyzed (A@[Decomp t])\"\n  shows \"t \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) - (Var ` \\<V>)\"\nusing assms well_analyzed.cases[of \"A@[Decomp t]\"] by fastforce\n\nprivate lemma well_analyzed_split_left_single: \"well_analyzed (A@[a]) \\<Longrightarrow> well_analyzed A\"\nby (induction \"A@[a]\" rule: well_analyzed.induct) auto\n\nprivate lemma well_analyzed_split_left: \"well_analyzed (A@B) \\<Longrightarrow> well_analyzed A\"\nproof (induction B rule: List.rev_induct)\n  case (snoc b B) thus ?case using well_analyzed_split_left_single[of \"A@B\" b] by simp\nqed simp\n\nprivate lemma well_analyzed_append:\n  assumes \"well_analyzed A\" \"well_analyzed B\"\n  shows \"well_analyzed (A@B)\"\nusing assms(2,1)\nproof (induction B rule: well_analyzed.induct)\n  case (Step B x) show ?case using well_analyzed.Step[OF Step.IH[OF Step.prems]] by simp\nnext\n  case (Decomp B t) thus ?case\n    using well_analyzed.Decomp[OF Decomp.IH[OF Decomp.prems]] ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append\n    by auto\nqed simp_all\n\nprivate lemma well_analyzed_singleton:\n  \"well_analyzed [Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\" \"well_analyzed [Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  \"well_analyzed [Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)]\" \"well_analyzed [Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  \"\\<not>well_analyzed [Decomp t]\"\nproof -\n  show \"well_analyzed [Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\" \"well_analyzed [Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"\n       \"well_analyzed [Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)]\" \"well_analyzed [Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)]\"\n    using well_analyzed.Step[OF well_analyzed.Nil]\n    by simp_all\n\n  show \"\\<not>well_analyzed [Decomp t]\" using well_analyzed.cases[of \"[Decomp t]\"] by auto\nqed\n\nprivate lemma well_analyzed_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_fv: \"well_analyzed A \\<Longrightarrow> fv\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) = fv\\<^sub>e\\<^sub>s\\<^sub>t A\"\nproof\n  assume \"well_analyzed A\" thus \"fv\\<^sub>e\\<^sub>s\\<^sub>t A \\<subseteq> fv\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n  proof (induction A rule: well_analyzed.induct)\n    case Decomp thus ?case using ik_assignment_rhs_decomp_fv decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n  next\n    case (Step A x)\n    have \"fv\\<^sub>e\\<^sub>s\\<^sub>t (A@[Step x]) = fv\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> fv\\<^sub>s\\<^sub>t\\<^sub>p x\"\n         \"fv\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (A@[Step x])) = fv\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<union> fv\\<^sub>s\\<^sub>t\\<^sub>p x\"\n      using fv\\<^sub>e\\<^sub>s\\<^sub>t_append decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n    thus ?case using Step by auto\n  qed simp\nqed (rule fv_decomp_rm)\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_d_split_left: assumes \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> (\\<A>@\\<A>')\" shows \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> \\<A>\"\nusing assms sem\\<^sub>e\\<^sub>s\\<^sub>t_d.cases by (induction \\<A>' rule: List.rev_induct) fastforce+\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> \\<A> = \\<lbrakk>M\\<^sub>0; to_st \\<A>\\<rbrakk>\\<^sub>d' \\<I>\"\nproof\n  show \"\\<lbrakk>M\\<^sub>0; to_st \\<A>\\<rbrakk>\\<^sub>d' \\<I> \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> \\<A>\"\n  proof (induction \\<A> arbitrary: M\\<^sub>0 rule: List.rev_induct)\n    case Nil show ?case using to_st_nil_inv by simp\n  next\n    case (snoc a \\<A>)\n    hence IH: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> \\<A>\" and *: \"\\<lbrakk>ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> M\\<^sub>0; to_st [a]\\<rbrakk>\\<^sub>d' \\<I>\"\n      using to_st_append by (auto simp add: sup.commute)\n    thus ?case using snoc\n    proof (cases a)\n      case (Step b) thus ?thesis\n      proof (cases b)\n        case (Send t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Send[OF IH] * Step by auto\n      next\n        case (Receive t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Receive[OF IH] Step by auto\n      next\n        case (Equality a t t') thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Equality[OF IH] * Step by auto\n      next\n        case (Inequality X F) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Inequality[OF IH] * Step by auto\n      qed\n    next\n      case (Decomp t)\n      obtain K M where Ana: \"Ana t = (K,M)\" by moura\n      have \"to_st [a] = decomp t\" using Decomp by auto\n      hence \"to_st [a] = [send\\<langle>[t]\\<rangle>\\<^sub>s\\<^sub>t,Send K,Receive M]\"\n        using Ana unfolding decomp_def by auto\n      hence **: \"ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t \\<cdot> \\<I>\" and \"\\<lbrakk>ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> M\\<^sub>0; [Send K]\\<rbrakk>\\<^sub>d' \\<I>\"\n        using * by auto\n      hence \"\\<And>k. k \\<in> set K \\<Longrightarrow> ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> k \\<cdot> \\<I>\"\n        using * strand_sem_Send_split(2) strand_sem_d.simps(2)\n        unfolding strand_sem_eq_defs(2) list_all_iff\n        by meson\n      thus ?thesis using Decomp sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Decompose[OF IH ** Ana] by metis\n    qed\n  qed\n\n  show \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> \\<A> \\<Longrightarrow> \\<lbrakk>M\\<^sub>0; to_st \\<A>\\<rbrakk>\\<^sub>d' \\<I>\"\n  proof (induction rule: sem\\<^sub>e\\<^sub>s\\<^sub>t_d.induct)\n    case Nil thus ?case by simp\n  next\n    case (Send M\\<^sub>0 \\<I> \\<A> ts) thus ?case\n      using strand_sem_append'[of M\\<^sub>0 \"to_st \\<A>\" \\<I> \"[send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t]\"]\n            to_st_append[of \\<A> \"[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"]\n      by (simp add: sup.commute)\n  next\n    case (Receive M\\<^sub>0 \\<I> \\<A> ts) thus ?case\n      using strand_sem_append'[of M\\<^sub>0 \"to_st \\<A>\" \\<I> \"[receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t]\"]\n            to_st_append[of \\<A> \"[Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"]\n      by (simp add: sup.commute)\n  next\n    case (Equality M\\<^sub>0 \\<I> \\<A> t t' a) thus ?case\n      using strand_sem_append'[of M\\<^sub>0 \"to_st \\<A>\" \\<I> \"[\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t]\"]\n            to_st_append[of \\<A> \"[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)]\"]\n      by (simp add: sup.commute)\n  next\n    case (Inequality M\\<^sub>0 \\<I> \\<A> X F) thus ?case\n      using strand_sem_append'[of M\\<^sub>0 \"to_st \\<A>\" \\<I> \"[\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t]\"]\n            to_st_append[of \\<A> \"[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)]\"]\n      by (simp add: sup.commute)\n  next\n    case (Decompose M\\<^sub>0 \\<I> \\<A> t K M)\n    have \"\\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); decomp t\\<rbrakk>\\<^sub>d' \\<I>\"\n    proof -\n      have \"\\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); [send\\<langle>[t]\\<rangle>\\<^sub>s\\<^sub>t]\\<rbrakk>\\<^sub>d' \\<I>\"\n        using Decompose.hyps(2) by (auto simp add: sup.commute)\n      moreover have \"\\<And>k. k \\<in> set K \\<Longrightarrow> M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> k \\<cdot> \\<I>\"\n        using Decompose by (metis sup.commute)\n      hence \"\\<And>k. k \\<in> set K \\<Longrightarrow> \\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); [Send1 k]\\<rbrakk>\\<^sub>d' \\<I>\" by auto\n      hence \"\\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); [Send K]\\<rbrakk>\\<^sub>d' \\<I>\"\n        using strand_sem_Send_map(4)[of _ \"M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" \\<I>] strand_sem_Send_map(6)\n        unfolding strand_sem_eq_defs(2) by auto\n      moreover have \"\\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); [Receive M]\\<rbrakk>\\<^sub>d' \\<I>\"\n        by (metis strand_sem_Receive_map(6) strand_sem_eq_defs(2))\n      ultimately have\n          \"\\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); [send\\<langle>[t]\\<rangle>\\<^sub>s\\<^sub>t,send\\<langle>K\\<rangle>\\<^sub>s\\<^sub>t,receive\\<langle>M\\<rangle>\\<^sub>s\\<^sub>t]\\<rbrakk>\\<^sub>d' \\<I>\"\n        by auto\n      thus ?thesis using Decompose.hyps(3) unfolding decomp_def by auto\n    qed\n    hence \"\\<lbrakk>M\\<^sub>0; to_st \\<A>@decomp t\\<rbrakk>\\<^sub>d' \\<I>\"\n      using strand_sem_append'[of M\\<^sub>0 \"to_st \\<A>\" \\<I> \"decomp t\"] Decompose.IH\n      by simp\n    thus ?case using to_st_append[of \\<A> \"[Decomp t]\"] by simp\n  qed\nqed\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_c_eq_sem_st: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> \\<A> = \\<lbrakk>M\\<^sub>0; to_st \\<A>\\<rbrakk>\\<^sub>c' \\<I>\"\nproof\n  show \"\\<lbrakk>M\\<^sub>0; to_st \\<A>\\<rbrakk>\\<^sub>c' \\<I> \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> \\<A>\"\n  proof (induction \\<A> arbitrary: M\\<^sub>0 rule: List.rev_induct)\n    case Nil show ?case using to_st_nil_inv by simp\n  next\n    case (snoc a \\<A>)\n    hence IH: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> \\<A>\" and *: \"\\<lbrakk>ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> M\\<^sub>0; to_st [a]\\<rbrakk>\\<^sub>c' \\<I>\"\n      using to_st_append\n      by (auto simp add: sup.commute)\n    thus ?case using snoc\n    proof (cases a)\n      case (Step b) thus ?thesis\n      proof (cases b)\n        case (Send t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Send[OF IH] * Step by auto\n      next\n        case (Receive t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Receive[OF IH] Step by auto\n      next\n        case (Equality t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Equality[OF IH] * Step by auto\n      next\n        case (Inequality t) thus ?thesis using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Inequality[OF IH] * Step by auto\n      qed\n    next\n      case (Decomp t)\n      obtain K M where Ana: \"Ana t = (K,M)\" by moura\n      have \"to_st [a] = decomp t\" using Decomp by auto\n      hence \"to_st [a] = [send\\<langle>[t]\\<rangle>\\<^sub>s\\<^sub>t,send\\<langle>K\\<rangle>\\<^sub>s\\<^sub>t,receive\\<langle>M\\<rangle>\\<^sub>s\\<^sub>t]\"\n        using Ana unfolding decomp_def by auto\n      hence **: \"ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\" and \"\\<lbrakk>ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> M\\<^sub>0; [send\\<langle>K\\<rangle>\\<^sub>s\\<^sub>t]\\<rbrakk>\\<^sub>c' \\<I>\"\n        using * by auto\n      hence \"ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c k \\<cdot> \\<I>\" when k: \"k \\<in> set K\" for k\n        using * strand_sem_Send_split(5)[OF _ k] strand_sem_Send_map(5)\n        unfolding strand_sem_eq_defs(1) by auto\n      thus ?thesis using Decomp sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Decompose[OF IH ** Ana] by metis\n    qed\n  qed\n\n  show \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> \\<A> \\<Longrightarrow> \\<lbrakk>M\\<^sub>0; to_st \\<A>\\<rbrakk>\\<^sub>c' \\<I>\"\n  proof (induction rule: sem\\<^sub>e\\<^sub>s\\<^sub>t_c.induct)\n    case Nil thus ?case by simp\n  next\n    case (Send M\\<^sub>0 \\<I> \\<A> ts) thus ?case\n      using strand_sem_append'[of M\\<^sub>0 \"to_st \\<A>\" \\<I> \"[send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t]\"]\n            to_st_append[of \\<A> \"[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"]\n      by (simp add: sup.commute)\n  next\n    case (Receive M\\<^sub>0 \\<I> \\<A> ts) thus ?case\n      using strand_sem_append'[of M\\<^sub>0 \"to_st \\<A>\" \\<I> \"[receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t]\"]\n            to_st_append[of \\<A> \"[Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"]\n      by (simp add: sup.commute)\n  next\n    case (Equality M\\<^sub>0 \\<I> \\<A> t t' a) thus ?case\n      using strand_sem_append'[of M\\<^sub>0 \"to_st \\<A>\" \\<I> \"[\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t]\"]\n            to_st_append[of \\<A> \"[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)]\"]\n      by (simp add: sup.commute)\n  next\n    case (Inequality M\\<^sub>0 \\<I> \\<A> X F) thus ?case\n      using strand_sem_append'[of M\\<^sub>0 \"to_st \\<A>\" \\<I> \"[\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t]\"]\n            to_st_append[of \\<A> \"[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)]\"]\n      by (auto simp add: sup.commute)\n  next\n    case (Decompose M\\<^sub>0 \\<I> \\<A> t K M)\n    have \"\\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); decomp t\\<rbrakk>\\<^sub>c' \\<I>\"\n    proof -\n      have \"\\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); [send\\<langle>[t]\\<rangle>\\<^sub>s\\<^sub>t]\\<rbrakk>\\<^sub>c' \\<I>\"\n        using Decompose.hyps(2) by (auto simp add: sup.commute)\n      moreover have \"\\<And>k. k \\<in> set K \\<Longrightarrow> M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c k \\<cdot> \\<I>\"\n        using Decompose by (metis sup.commute)\n      hence \"\\<And>k. k \\<in> set K \\<Longrightarrow> \\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); [Send1 k]\\<rbrakk>\\<^sub>c' \\<I>\" by auto\n      hence \"\\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); [Send K]\\<rbrakk>\\<^sub>c' \\<I>\"\n        using strand_sem_Send_map(3)[of K, of \"M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" \\<I>]\n              strand_sem_Send_map(5)\n        unfolding strand_sem_eq_defs(1)\n        by auto\n      moreover have \"\\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); [Receive M]\\<rbrakk>\\<^sub>c' \\<I>\"\n        by (metis strand_sem_Receive_map(5) strand_sem_eq_defs(1))\n      ultimately have\n          \"\\<lbrakk>M\\<^sub>0 \\<union> ik\\<^sub>s\\<^sub>t (to_st \\<A>); [send\\<langle>[t]\\<rangle>\\<^sub>s\\<^sub>t,send\\<langle>K\\<rangle>\\<^sub>s\\<^sub>t,receive\\<langle>M\\<rangle>\\<^sub>s\\<^sub>t]\\<rbrakk>\\<^sub>c' \\<I>\"\n        by auto\n      thus ?thesis using Decompose.hyps(3) unfolding decomp_def by auto\n    qed\n    hence \"\\<lbrakk>M\\<^sub>0; to_st \\<A>@decomp t\\<rbrakk>\\<^sub>c' \\<I>\"\n      using strand_sem_append'[of M\\<^sub>0 \"to_st \\<A>\" \\<I> \"decomp t\"] Decompose.IH\n      by simp\n    thus ?case using to_st_append[of \\<A> \"[Decomp t]\"] by simp\n  qed\nqed\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct_aux:\n  assumes \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> A\" \"t \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" \"t \\<notin> ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n  shows \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t\"\nusing assms\nproof (induction M\\<^sub>0 \\<I> A arbitrary: t rule: sem\\<^sub>e\\<^sub>s\\<^sub>t_c.induct)\n  case (Send M\\<^sub>0 \\<I> A t') thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\nnext\n  case (Receive M\\<^sub>0 \\<I> A t')\n  hence \"t \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" \"t \\<notin> ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n    using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n  hence IH: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t\" using Receive.IH by auto\n  show ?case\n    using ideduct_mono[OF IH] decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append\n    by (metis Un_subset_iff Un_upper1 Un_upper2 image_mono)\nnext\n  case (Equality M\\<^sub>0 \\<I> A t') thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\nnext\n  case (Inequality M\\<^sub>0 \\<I> A t') thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\nnext\n  case (Decompose M\\<^sub>0 \\<I> A t' K M t)\n  have *: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t' \\<cdot> \\<I>\" using Decompose.hyps(2)\n  proof (induction rule: intruder_synth_induct)\n    case (AxiomC t'')\n    moreover {\n      assume \"t'' \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" \"t'' \\<notin> ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n      hence ?case using Decompose.IH by auto\n    }\n    ultimately show ?case by force\n  qed simp\n  \n  { fix k assume \"k \\<in> set K\"\n    hence \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c k \\<cdot> \\<I>\" using Decompose.hyps by auto\n    hence \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> k \\<cdot> \\<I>\"\n    proof (induction rule: intruder_synth_induct)\n      case (AxiomC t'')\n      moreover {\n        assume \"t'' \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" \"t'' \\<notin> ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n        hence ?case using Decompose.IH by auto\n      }\n      ultimately show ?case by force\n    qed simp\n  }\n  hence **: \"\\<And>k. k \\<in> set (K \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>) \\<Longrightarrow> ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> k\" by auto\n  \n  show ?case\n  proof (cases \"t \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\")\n    case True thus ?thesis using Decompose.IH Decompose.prems(2) decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n  next\n    case False\n    hence \"t \\<in> ik\\<^sub>s\\<^sub>t (decomp t') \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" using Decompose.prems(1) ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n    hence ***: \"t \\<in> set (M \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>)\" using Decompose.hyps(3) decomp_ik by auto\n    hence \"M \\<noteq> []\" by auto\n    hence ****: \"Ana (t' \\<cdot> \\<I>) = (K \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>, M \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>)\" using Ana_subst[OF Decompose.hyps(3)] by auto\n\n    have \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t\" by (rule intruder_deduct.Decompose[OF * **** ** ***])\n    thus ?thesis using ideduct_mono decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n  qed\nqed simp\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct:\n  assumes \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> A\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t\"\n  shows \"ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<union> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t\"\nusing assms(2)\nproof (induction t rule: intruder_synth_induct)\n  case (AxiomC t)\n  hence \"t \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<or> t \\<in> M\\<^sub>0 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" by auto\n  moreover {\n    assume \"t \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" \"t \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n    hence ?case using ideduct_mono[OF intruder_deduct.Axiom] by auto\n  }\n  moreover {\n    assume \"t \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" \"t \\<notin> ik\\<^sub>e\\<^sub>s\\<^sub>t (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n    hence ?case using sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct_aux[OF assms(1)] by auto\n  }\n  ultimately show ?case by auto\nqed simp\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_d_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_if_sem\\<^sub>e\\<^sub>s\\<^sub>t_c: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> A \\<Longrightarrow> sem\\<^sub>e\\<^sub>s\\<^sub>t_d M\\<^sub>0 \\<I> (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nproof (induction M\\<^sub>0 \\<I> A rule: sem\\<^sub>e\\<^sub>s\\<^sub>t_c.induct)\n  case (Send M\\<^sub>0 \\<I> A t)\n  thus ?case\n    using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Send[OF Send.IH] sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct\n    unfolding list_all_iff by auto\nnext\n  case (Receive t) thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Receive by auto\nnext\n  case (Equality M\\<^sub>0 \\<I> A t)\n  thus ?case\n    using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Equality[OF Equality.IH] sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct\n    by auto\nnext\n  case (Inequality M\\<^sub>0 \\<I> A t)\n  thus ?case\n    using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append sem\\<^sub>e\\<^sub>s\\<^sub>t_d.Inequality[OF Inequality.IH] sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_deduct\n    by auto\nnext\n  case Decompose thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\nqed auto\n\nprivate lemma sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomps\\<^sub>e\\<^sub>s\\<^sub>t_append:\n  assumes \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> A\" \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) \\<I>\"\n  shows \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> (A@D)\"\nusing assms(2,1)\nproof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n  case (Decomp D f T K M)\n  hence *: \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> (A @ D)\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D) \\<union> {} \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c Fun f T \\<cdot> \\<I>\"\n           \"\\<And>k. k \\<in> set K \\<Longrightarrow> ik\\<^sub>e\\<^sub>s\\<^sub>t (A @ D) \\<union> {} \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c k \\<cdot> \\<I>\"\n    using ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n  show ?case using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Decompose[OF *(1,2) Decomp.hyps(3) *(3)] by simp\nqed auto\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_preserves_wf:\n  assumes \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\<I>\" \"wf\\<^sub>e\\<^sub>s\\<^sub>t V A\"\n  shows \"wf\\<^sub>e\\<^sub>s\\<^sub>t V (A@D)\"\nusing assms\nproof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n  case (Decomp D f T K M)\n  have \"wfrestrictedvars\\<^sub>s\\<^sub>t (decomp (Fun f T)) \\<subseteq> fv\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n    using decomp_vars fv_subset_subterms[OF Decomp.hyps(2)] by fast\n  hence \"wfrestrictedvars\\<^sub>s\\<^sub>t (decomp (Fun f T)) \\<subseteq> wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t A\"\n    using ik\\<^sub>s\\<^sub>t_assignment_rhs\\<^sub>s\\<^sub>t_wfrestrictedvars_subset[of \"to_st A\"] by blast\n  hence \"wfrestrictedvars\\<^sub>s\\<^sub>t (decomp (Fun f T)) \\<subseteq> wfrestrictedvars\\<^sub>s\\<^sub>t (to_st (A@D)) \\<union> V\"\n    using to_st_append[of A D] strand_vars_split(2)[of \"to_st A\" \"to_st D\"]\n    by (metis le_supI1)\n  thus ?case\n    using wf_append_suffix[OF Decomp.IH[OF Decomp.prems], of \"decomp (Fun f T)\"]\n          to_st_append[of \"A@D\" \"[Decomp (Fun f T)]\"]\n    by auto\nqed auto\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_preserves_model_c:\n  assumes \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\<I>\" \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> A\"\n  shows \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c M\\<^sub>0 \\<I> (A@D)\"\nusing assms\nproof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n  case (Decomp D f T K M) show ?case\n    using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Decompose[OF Decomp.IH[OF Decomp.prems] _ Decomp.hyps(3)]\n          Decomp.hyps(5,6) ideduct_synth_mono ik\\<^sub>e\\<^sub>s\\<^sub>t_append\n    by (metis (mono_tags, lifting) List.append_assoc image_Un sup_ge1) \nqed auto\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist_aux:\n  assumes \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\" \"M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<turnstile> t\" \"\\<not>(M \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D) \\<turnstile>\\<^sub>c t)\"\n  obtains D' where\n    \"D@D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\" \"M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D') \\<turnstile>\\<^sub>c t\" \"M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<subset> M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D')\"\nproof -\n  have \"\\<exists>D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>. M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<turnstile>\\<^sub>c t\" using assms(2)\n  proof (induction t rule: intruder_deduct_induct)\n    case (Compose X f)\n    from Compose.IH have \"\\<exists>D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>. \\<forall>x \\<in> set X. M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<turnstile>\\<^sub>c x\"\n    proof (induction X)\n      case (Cons t X)\n      then obtain D' D'' where\n          D': \"D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\" \"M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<turnstile>\\<^sub>c t\" and\n          D'': \"D'' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\" \"\\<forall>x \\<in> set X. M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D'' \\<turnstile>\\<^sub>c x\"\n        by moura\n      hence \"M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\<turnstile>\\<^sub>c t\" \"\\<forall>x \\<in> set X. M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\<turnstile>\\<^sub>c x\"\n        by (auto intro: ideduct_synth_mono simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n      thus ?case using decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF D'(1) D''(1)] by (metis set_ConsD)\n    qed (auto intro: decomps\\<^sub>e\\<^sub>s\\<^sub>t.Nil)\n    thus ?case using intruder_synth.ComposeC[OF Compose.hyps(1,2)] by metis\n  next\n    case (Decompose t K T t\\<^sub>i)\n    have \"\\<exists>D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>. \\<forall>k \\<in> set K. M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<turnstile>\\<^sub>c k\" using Decompose.IH\n    proof (induction K)\n      case (Cons t X)\n      then obtain D' D'' where\n          D': \"D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\" \"M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<turnstile>\\<^sub>c t\" and\n          D'': \"D'' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\" \"\\<forall>x \\<in> set X. M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D'' \\<turnstile>\\<^sub>c x\"\n        using assms(1) by moura\n      hence \"M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\<turnstile>\\<^sub>c t\" \"\\<forall>x \\<in> set X. M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\<turnstile>\\<^sub>c x\"\n        by (auto intro: ideduct_synth_mono simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n      thus ?case using decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF D'(1) D''(1)] by auto\n    qed auto\n    then obtain D' where D': \"D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\" \"\\<And>k. k \\<in> set K \\<Longrightarrow> M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<turnstile>\\<^sub>c k\" by metis\n    obtain D'' where D'': \"D'' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\" \"M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D'' \\<turnstile>\\<^sub>c t\" by (metis Decompose.IH(1))\n    obtain f X where fX: \"t = Fun f X\" \"t\\<^sub>i \\<in> set X\"\n      using Decompose.hyps(2,4) by (cases t) (auto dest: Ana_fun_subterm)\n  \n    from decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF D'(1) D''(1)] D'(2) D''(2) have *:\n        \"D'@D'' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\" \"\\<And>k. k \\<in> set K \\<Longrightarrow> M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\<turnstile>\\<^sub>c k\"\n        \"M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\<turnstile>\\<^sub>c t\"\n      by (auto intro: ideduct_synth_mono simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n    hence **: \"\\<And>k. k \\<in> set K \\<Longrightarrow> M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c k \\<cdot> \\<I>\"\n      using ideduct_synth_subst by auto\n\n    have \"t\\<^sub>i \\<in> ik\\<^sub>s\\<^sub>t (decomp t)\" using Decompose.hyps(2,4) ik_rcv_map unfolding decomp_def by auto\n    with *(3) fX(1) Decompose.hyps(2) show ?case\n    proof (induction t rule: intruder_synth_induct)\n      case (AxiomC t)\n      hence t_in_subterms: \"t \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (M \\<union> N)\"\n        using decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset[OF *(1)] subset_subterms_Union\n        by auto\n      have \"M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@D'') \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\"\n        using ideduct_synth_subst[OF intruder_synth.AxiomC[OF AxiomC.hyps(1)]] by metis\n      moreover have \"T \\<noteq> []\" using decomp_ik[OF \\<open>Ana t = (K,T)\\<close>] \\<open>t\\<^sub>i \\<in> ik\\<^sub>s\\<^sub>t (decomp t)\\<close> by auto\n      ultimately have \"D'@D''@[Decomp (Fun f X)] \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>\"\n        using AxiomC decomps\\<^sub>e\\<^sub>s\\<^sub>t.Decomp[OF *(1) _ _ _ _ **] subset_subterms_Union t_in_subterms\n        by (simp add: subset_eq)\n      moreover have \"decomp t = to_st [Decomp (Fun f X)]\" using AxiomC.prems(1,2) by auto\n      ultimately show ?case\n        by (metis AxiomC.prems(3) UnCI intruder_synth.AxiomC ik\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append)\n    qed (auto intro!: fX(2) *(1))\n  qed (fastforce intro: intruder_synth.AxiomC assms(1))\n  hence \"\\<exists>D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t M N \\<I>. M \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D') \\<turnstile>\\<^sub>c t\"\n    by (auto intro: ideduct_synth_mono simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n  thus thesis using that[OF decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF assms(1)]] assms ik\\<^sub>e\\<^sub>s\\<^sub>t_append by moura\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_max_exist:\n  assumes \"finite A\" \"finite N\"\n  shows \"\\<exists>D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>. \\<forall>D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>. ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<subseteq> ik\\<^sub>e\\<^sub>s\\<^sub>t D\"\nproof -\n  let ?IK = \"\\<lambda>M. \\<Union>D \\<in> M. ik\\<^sub>e\\<^sub>s\\<^sub>t D\"\n  have \"?IK (decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>) \\<subseteq> (\\<Union>t \\<in> A \\<union> N. subterms t)\" by (auto dest!: decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset)\n  hence \"finite (?IK (decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>))\"\n    using subterms_union_finite[OF assms(1)] subterms_union_finite[OF assms(2)] infinite_super\n    by auto\n  then obtain M where M: \"finite M\" \"M \\<subseteq> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>\" \"?IK M = ?IK (decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>)\"\n    using finite_subset_Union by moura\n  show ?thesis using decomps\\<^sub>e\\<^sub>s\\<^sub>t_finite_ik_append[OF M(1,2)] M(3) by auto\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist:\n  assumes \"finite A\" \"finite N\"\n  shows \"\\<exists>D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>. \\<forall>t. A \\<turnstile> t \\<longrightarrow> A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<turnstile>\\<^sub>c t\"\nproof (rule ccontr)\n  assume neg: \"\\<not>(\\<exists>D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>. \\<forall>t. A \\<turnstile> t \\<longrightarrow> A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<turnstile>\\<^sub>c t)\"\n\n  obtain D where D: \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>\" \"\\<forall>D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>. ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<subseteq> ik\\<^sub>e\\<^sub>s\\<^sub>t D\"\n    using decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_max_exist[OF assms] by moura\n  then obtain t where t: \"A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<turnstile> t\" \"\\<not>(A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<turnstile>\\<^sub>c t)\"\n    using neg by (fastforce intro: ideduct_mono)\n\n  obtain D' where D':\n      \"D@D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t A N \\<I>\" \"A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D') \\<turnstile>\\<^sub>c t\"\n      \"A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<subset> A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D')\"\n    by (metis decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist_aux t D(1))\n  hence \"ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<subset> ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D')\" using ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n  moreover have \"ik\\<^sub>e\\<^sub>s\\<^sub>t (D@D') \\<subseteq> ik\\<^sub>e\\<^sub>s\\<^sub>t D\" using D(2) D'(1) by auto\n  ultimately show False by simp\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist_subst:\n  assumes \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t \\<cdot> \\<I>\"\n    and \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> A\" \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} A\" \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\"\n    and \"Ana_invar_subst (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n    and \"well_analyzed A\"\n  shows \"\\<exists>D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\<I>. ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\"\nproof -\n  have ik_eq: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<I>) = ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" using assms(5,6)\n  proof (induction A rule: List.rev_induct)\n    case (snoc a A)\n    hence \"Ana_invar_subst (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n      using Ana_invar_subst_subset[OF snoc.prems(1)] ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append\n      unfolding Ana_invar_subst_def by simp\n    with snoc have IH:\n        \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@[a] \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<I>) = (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t ([a] \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<I>)\"\n        \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@[a]) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> = (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t [a] \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>)\"\n      using well_analyzed_split_left[OF snoc.prems(2)]\n      by (auto simp add: to_st_append ik\\<^sub>e\\<^sub>s\\<^sub>t_append_subst)\n      \n    have \"ik\\<^sub>e\\<^sub>s\\<^sub>t [a \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<I>] = ik\\<^sub>e\\<^sub>s\\<^sub>t [a] \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n    proof (cases a)\n      case (Step b) thus ?thesis by (cases b) auto\n    next\n      case (Decomp t)\n      then obtain f T where t: \"t = Fun f T\" using well_analyzedD[OF snoc.prems(2)] by force\n      obtain K M where Ana_t: \"Ana (Fun f T) = (K,M)\" by (metis surj_pair)\n      moreover have \"Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t ((ik\\<^sub>e\\<^sub>s\\<^sub>t (A@[a]) \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@[a])))\"\n        using t Decomp snoc.prems(2)\n        by (auto dest: well_analyzed_inv simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append)\n      hence \"Ana (Fun f T \\<cdot> \\<I>) = (K \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>, M \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>)\"\n        using Ana_t snoc.prems(1) unfolding Ana_invar_subst_def by blast \n      ultimately show ?thesis using Decomp t by (auto simp add: decomp_ik)\n    qed\n    thus ?case using IH unfolding subst_apply_extstrand_def by simp\n  qed simp\n  moreover have assignment_rhs_eq: \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<I>) = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n    using assms(5,6)\n  proof (induction A rule: List.rev_induct)\n    case (snoc a A)\n    hence \"Ana_invar_subst (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n      using Ana_invar_subst_subset[OF snoc.prems(1)] ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append\n      unfolding Ana_invar_subst_def by simp\n    hence \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<I>) = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n      using snoc.IH well_analyzed_split_left[OF snoc.prems(2)]\n      by simp\n    hence IH:\n        \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@[a] \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<I>) = (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t ([a] \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<I>)\"\n        \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@[a]) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> = (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t [a] \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>)\"\n      by (metis assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append_subst(1), metis assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append_subst(2))\n\n    have \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t [a \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t\\<^sub>p \\<I>] = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t [a] \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n    proof (cases a)\n      case (Step b) thus ?thesis by (cases b) auto\n    next\n      case (Decomp t)\n      then obtain f T where t: \"t = Fun f T\" using well_analyzedD[OF snoc.prems(2)] by force\n      obtain K M where Ana_t: \"Ana (Fun f T) = (K,M)\" by (metis surj_pair)\n      moreover have \"Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t ((ik\\<^sub>e\\<^sub>s\\<^sub>t (A@[a]) \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@[a])))\"\n        using t Decomp snoc.prems(2)\n        by (auto dest: well_analyzed_inv simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append)\n      hence \"Ana (Fun f T \\<cdot> \\<I>) = (K \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>, M \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>)\"\n        using Ana_t snoc.prems(1) unfolding Ana_invar_subst_def by blast\n      ultimately show ?thesis using Decomp t by (auto simp add: decomp_assignment_rhs_empty)\n    qed\n    thus ?case using IH unfolding subst_apply_extstrand_def by simp\n  qed simp\n  ultimately obtain D where D:\n      \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) Var\"\n      \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D) \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\"\n    using decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist[OF ik\\<^sub>e\\<^sub>s\\<^sub>t_finite assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_finite, of \"A \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<I>\" \"A \\<cdot>\\<^sub>e\\<^sub>s\\<^sub>t \\<I>\"]\n          ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append assms(1)\n    by force\n\n  let ?P = \"\\<lambda>D D'. \\<forall>t. (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D) \\<turnstile>\\<^sub>c t \\<longrightarrow> (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c t\"\n\n  have \"\\<exists>D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\<I>. ?P D D'\" using D(1)\n  proof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n    case Nil\n    have \"ik\\<^sub>e\\<^sub>s\\<^sub>t [] = ik\\<^sub>e\\<^sub>s\\<^sub>t [] \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" by auto\n    thus ?case by (metis decomps\\<^sub>e\\<^sub>s\\<^sub>t.Nil)\n  next\n    case (Decomp D f T K M)\n    obtain D' where D': \"D' \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\<I>\" \"?P D D'\"\n      using Decomp.IH by auto\n    hence IH: \"\\<And>k. k \\<in> set K \\<Longrightarrow> (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c k\"\n              \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c Fun f T\"\n      using Decomp.hyps(5,6) by auto\n\n    have D'_ik: \"ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t ((ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n                \"ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n      using decomps\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset[OF D'(1)] by (metis subst_all_mono, metis)\n\n    show ?case using IH(2,1) Decomp.hyps(2,3,4)\n    proof (induction \"Fun f T\" arbitrary: f T K M rule: intruder_synth_induct)\n      case (AxiomC f T)\n      then obtain s where s: \"s \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D'\" \"Fun f T = s \\<cdot> \\<I>\" using AxiomC.prems by blast\n      hence fT_s_in: \"Fun f T \\<in> (subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n                     \"s \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n        using AxiomC D'_ik subset_subterms_Union[of \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A\"]\n              subst_all_mono[OF subset_subterms_Union, of \\<I>]\n        by (metis (no_types) Un_iff image_eqI subset_Un_eq, metis (no_types) Un_iff subset_Un_eq)\n      obtain Ks Ms where Ana_s: \"Ana s = (Ks,Ms)\" by moura\n\n      have AD'_props: \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} (A@D')\" \"\\<lbrakk>{}; to_st (A@D')\\<rbrakk>\\<^sub>c \\<I>\"\n        using decomps\\<^sub>e\\<^sub>s\\<^sub>t_preserves_model_c[OF D'(1) assms(2)]\n              decomps\\<^sub>e\\<^sub>s\\<^sub>t_preserves_wf[OF D'(1) assms(3)]\n              sem\\<^sub>e\\<^sub>s\\<^sub>t_c_eq_sem_st strand_sem_eq_defs(1)\n        by auto\n\n      show ?case\n      proof (cases s)\n        case (Var x)\n        \\<comment> \\<open>In this case \\<open>\\<I> x\\<close> (is a subterm of something that) was derived from an\n            \"earlier intruder knowledge\" because \\<open>A\\<close> is well-formed and has \\<open>\\<I>\\<close> as a model.\n            So either the intruder composed \\<open>Fun f T\\<close> himself (making \\<open>Decomp (Fun f T)\\<close>\n            unnecessary) or \\<open>Fun f T\\<close> is an instance of something else in the intruder\n            knowledge (in which case the \"something\" can be used in place of \\<open>Fun f T\\<close>)\\<close>\n        hence \"Var x \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D')\" \"\\<I> x = Fun f T\" using s ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n\n        show ?thesis\n        proof (cases \"\\<forall>m \\<in> set M. ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c m\")\n          case True\n          \\<comment> \\<open>All terms acquired by decomposing \\<open>Fun f T\\<close> are already derivable.\n              Hence there is no need to consider decomposition of \\<open>Fun f T\\<close> at all.\\<close>\n          have *: \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D@[Decomp (Fun f T)]) = (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<union> set M\"\n            using decomp_ik[OF \\<open>Ana (Fun f T) = (K,M)\\<close>] ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of D \"[Decomp (Fun f T)]\"]\n            by auto\n          \n          { fix t' assume \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<union> set M \\<turnstile>\\<^sub>c t'\"\n            hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c t'\"\n            proof (induction t' rule: intruder_synth_induct)\n              case (AxiomC t') thus ?case\n              proof\n                assume \"t' \\<in> set M\"\n                moreover have \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) = ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" by auto\n                ultimately show ?case using True by auto\n              qed (metis D'(2) intruder_synth.AxiomC)\n            qed auto\n          }\n          thus ?thesis using D'(1) * by metis\n        next\n          case False\n          \\<comment> \\<open>Some term acquired by decomposition of \\<open>Fun f T\\<close> cannot be derived in \\<open>\\<turnstile>\\<^sub>c\\<close>.\n              \\<open>Fun f T\\<close> must therefore be an instance of something else in the intruder knowledge,\n              because of well-formedness.\\<close>\n          then obtain t\\<^sub>i where t\\<^sub>i: \"t\\<^sub>i \\<in> set T\" \"\\<not>ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D') \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t\\<^sub>i\"\n            using Ana_fun_subterm[OF \\<open>Ana (Fun f T) = (K,M)\\<close>] by (auto simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n          obtain S where fS:\n              \"Fun f S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D')) \\<or>\n               Fun f S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@D'))\"\n              \"\\<I> x = Fun f S \\<cdot> \\<I>\"\n            using strand_sem_wf_ik_or_assignment_rhs_fun_subterm[\n                    OF AD'_props \\<open>Var x \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D')\\<close> _ t\\<^sub>i \\<open>interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<close>]\n                  \\<open>\\<I> x = Fun f T\\<close>\n            by moura\n          hence fS_in: \"Fun f S \\<cdot> \\<I> \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n                       \"Fun f S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n            using imageI[OF s(1), of \"\\<lambda>x. x \\<cdot> \\<I>\"] Var\n                  ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of A D'] assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append[of A D']\n                  decomps\\<^sub>e\\<^sub>s\\<^sub>t_subterms[OF D'(1)] decomps\\<^sub>e\\<^sub>s\\<^sub>t_assignment_rhs_empty[OF D'(1)]\n            by auto\n          obtain KS MS where Ana_fS: \"Ana (Fun f S) = (KS, MS)\" by moura\n          hence \"K = KS \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>\" \"M = MS \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>\"\n            using Ana_invar_substD[OF assms(5) fS_in(2)]\n                  s(2) fS(2) \\<open>s = Var x\\<close> \\<open>Ana (Fun f T) = (K,M)\\<close>\n            by simp_all\n          hence \"MS \\<noteq> []\" using \\<open>M \\<noteq> []\\<close> by simp\n          have \"\\<And>k. k \\<in> set KS \\<Longrightarrow> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c k \\<cdot> \\<I>\"\n            using AxiomC.prems(1) \\<open>K = KS \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>\\<close> by (simp add: image_Un)\n          hence D'': \"D'@[Decomp (Fun f S)] \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\<I>\"\n            using decomps\\<^sub>e\\<^sub>s\\<^sub>t.Decomp[OF D'(1) fS_in(2) Ana_fS \\<open>MS \\<noteq> []\\<close>] AxiomC.prems(1)\n                  intruder_synth.AxiomC[OF fS_in(1)]\n            by simp\n          moreover {\n            fix t' assume \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D@[Decomp (Fun f T)]) \\<turnstile>\\<^sub>c t'\"\n            hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@[Decomp (Fun f S)]) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c t'\"\n            proof (induction t' rule: intruder_synth_induct)\n              case (AxiomC t')\n              hence \"t' \\<in> (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<or> t' \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f T)]\"\n                by (simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n              thus ?case\n              proof\n                assume \"t' \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f T)]\"\n                hence \"t' \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f S)] \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n                  using decomp_ik \\<open>Ana (Fun f T) = (K,M)\\<close> \\<open>Ana (Fun f S) = (KS,MS)\\<close> \\<open>M = MS \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>\\<close>\n                  by simp\n                thus ?case\n                  using ideduct_synth_mono[\n                          OF intruder_synth.AxiomC[of t' \"ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f S)] \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"],\n                          of \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@[Decomp (Fun f S)]) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>)\"]\n                  by (auto simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n              next\n                assume \"t' \\<in> (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t D\"\n                hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c t'\"\n                  by (metis D'(2) intruder_synth.AxiomC)\n                hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f S)] \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c t'\"\n                  by (simp add: ideduct_synth_mono)\n                thus ?case\n                  using ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of D' \"[Decomp (Fun f S)]\"]\n                        image_Un[of \"\\<lambda>x. x \\<cdot> \\<I>\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t D'\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun f S)]\"]\n                  by (simp add: sup_aci(2))\n              qed\n            qed auto\n          }\n          ultimately show ?thesis using D'' by auto\n        qed\n      next\n        case (Fun g S) \\<comment> \\<open>Hence \\<open>Decomp (Fun f T)\\<close> can be substituted for \\<open>Decomp (Fun g S)\\<close>\\<close>\n        hence KM: \"K = Ks \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>\" \"M = Ms \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<I>\" \"set K = set Ks \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" \"set M = set Ms \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n          using fT_s_in(2) \\<open>Ana (Fun f T) = (K,M)\\<close> Ana_s s(2)\n                Ana_invar_substD[OF assms(5), of g S]\n          by auto\n        hence Ms_nonempty: \"Ms \\<noteq> []\" using \\<open>M \\<noteq> []\\<close> by auto\n        { fix t' assume \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D@[Decomp (Fun f T)]) \\<turnstile>\\<^sub>c t'\"\n          hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t (D'@[Decomp (Fun g S)]) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c t'\" using AxiomC\n          proof (induction t' rule: intruder_synth_induct)\n            case (AxiomC t')\n            hence \"t' \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<or> t' \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<or> t' \\<in> set M\"\n              by (simp add: decomp_ik ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n            thus ?case\n            proof (elim disjE)\n              assume \"t' \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t D\"\n              hence *: \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c t'\" using D'(2) by simp\n              show ?case by (auto intro: ideduct_synth_mono[OF *] simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append_subst(2))\n            next\n              assume \"t' \\<in> set M\"\n              hence \"t' \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t [Decomp (Fun g S)] \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n                using KM(2) Fun decomp_ik[OF Ana_s] by auto\n              thus ?case by (simp add: image_Un ik\\<^sub>e\\<^sub>s\\<^sub>t_append)\n            qed (simp add: ideduct_synth_mono[OF intruder_synth.AxiomC])\n          qed auto\n        }\n        thus ?thesis\n          using s Fun Ana_s AxiomC.prems(1) KM(3) fT_s_in\n                decomps\\<^sub>e\\<^sub>s\\<^sub>t.Decomp[OF D'(1) _ _ Ms_nonempty, of g S Ks]\n          by (metis AxiomC.hyps image_Un image_eqI intruder_synth.AxiomC)\n      qed\n    next\n      case (ComposeC T f)\n      have *: \"\\<And>m. m \\<in> set M \\<Longrightarrow> (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c m\"\n        using Ana_fun_subterm[OF \\<open>Ana (Fun f T) = (K, M)\\<close>] ComposeC.hyps(3)\n        by auto\n      \n      have **: \"ik\\<^sub>e\\<^sub>s\\<^sub>t (D@[Decomp (Fun f T)]) = ik\\<^sub>e\\<^sub>s\\<^sub>t D \\<union> set M\"\n        using decomp_ik[OF \\<open>Ana (Fun f T) = (K, M)\\<close>] ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n\n      { fix t' assume \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t (D@[Decomp (Fun f T)]) \\<turnstile>\\<^sub>c t'\"\n        hence \"(ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t D' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<turnstile>\\<^sub>c t'\"\n          by (induct rule: intruder_synth_induct) (auto simp add: D'(2) * **)\n      }\n      thus ?case using D'(1) by auto\n    qed\n  qed\n  thus ?thesis using D(2) assms(1) by (auto simp add: ik\\<^sub>e\\<^sub>s\\<^sub>t_append_subst(2))\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist_subst_list:\n  assumes \"\\<forall>t \\<in> set ts. ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t \\<cdot> \\<I>\"\n    and \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> A\" \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} A\" \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\"\n    and \"Ana_invar_subst (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n    and \"well_analyzed A\"\n  shows \"\\<exists>D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\<I>.\n          \\<forall>t \\<in> set ts. ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\"\n    (is \"\\<exists>D \\<in> ?A. ?B D ts\")\nproof -\n  note 0 = decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist_subst[OF _ assms(2-6)]\n\n  show ?thesis using assms(1)\n  proof (induction ts)\n    case (Cons t ts)\n    have 1: \"ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t \\<cdot> \\<I>\" and 2: \"\\<forall>t \\<in> set ts. ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t \\<cdot> \\<I>\"\n      using Cons.prems by auto\n\n    obtain D where D: \"D \\<in> ?A\" \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\"\n      using 0[OF 1] by blast\n\n    obtain D' where D': \"D' \\<in> ?A\" \"?B D' ts\"\n      using Cons.IH[OF 2] by auto\n\n    have \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D@D') \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\"\n      using ideduct_synth_mono[OF D(2)] ik\\<^sub>e\\<^sub>s\\<^sub>t_append_subst(2)[of \\<I> \"A@D\" D'] by fastforce\n    hence \"?B (D@D') (t#ts)\"\n      using D'(2) ideduct_synth_mono[of \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D') \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" _ \"ik\\<^sub>e\\<^sub>s\\<^sub>t (A@D@D') \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"]\n            ik\\<^sub>e\\<^sub>s\\<^sub>t_append_subst(2)[of \\<I>]\n      by auto\n    thus ?case\n      using decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF D(1) D'(1)] by blast\n  qed (fastforce intro: decomps\\<^sub>e\\<^sub>s\\<^sub>t.Nil)\nqed\n\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_nil: assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> \\<A>\" shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' (update\\<^sub>s\\<^sub>t \\<S> []) \\<A>\"\nusing assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_snd:\n  assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> \\<A>\" \"send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\"\n  shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' (update\\<^sub>s\\<^sub>t \\<S> (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S)) (\\<A>@[Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)])\"\nunfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\nproof (intro conjI)\n  let ?S = \"send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S\"\n  let ?A = \"\\<A>@[Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"\n\n  have \\<S>: \"\\<And>S'. S' \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S \\<Longrightarrow> S' = S \\<or> S' \\<in> \\<S>\" by auto\n\n  have 1: \"\\<forall>S \\<in> \\<S>. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) (dual\\<^sub>s\\<^sub>t S)\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n  moreover have 2: \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts)\"\n    using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split(2) by (auto simp add: Un_assoc)\n  ultimately have 3: \"\\<forall>S \\<in> \\<S>. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis wf_vars_mono)\n\n  have 4: \"\\<forall>S \\<in> \\<S>. \\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by simp\n\n  have \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" using 1 2 3 assms(2) by auto\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis 3 \\<S>)\n  \n  have \"fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n       \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\"\n       \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S' \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n    using 4 assms(2) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by force+\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. \\<forall>S' \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" by (metis 4 \\<S>)\n\n  have \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t ?S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S' \\<inter> bvars\\<^sub>s\\<^sub>t ?S = {}\"\n    using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by metis+\n  hence 5: \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A = fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts)\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\"\n           \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts) \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\"\n    using to_st_append by fastforce+\n\n  have *: \"\\<forall>S \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\"\n    using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n  hence \"fv\\<^sub>s\\<^sub>t ?S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" using assms(2) by metis\n  hence \"fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by auto\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by (metis * \\<S>)\n\n  have **: \"\\<forall>S \\<in> \\<S>. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n    using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n  hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t ?S = {}\" using assms(2) by metis\n  hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\" by fastforce\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\" by (metis ** \\<S>)\nqed\n\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_rcv:\n  assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> \\<A>\" \"receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\"\n  shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' (update\\<^sub>s\\<^sub>t \\<S> (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S)) (\\<A>@[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)])\"\nunfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\nproof (intro conjI)\n  let ?S = \"receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S\"\n  let ?A = \"\\<A>@[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"\n\n  have \\<S>: \"\\<And>S'. S' \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S \\<Longrightarrow> S' = S \\<or> S' \\<in> \\<S>\" by auto\n\n  have 1: \"\\<forall>S \\<in> \\<S>. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) (dual\\<^sub>s\\<^sub>t S)\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n  moreover have 2: \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts)\"\n    using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split(2) by (auto simp add: Un_assoc)\n  ultimately have 3: \"\\<forall>S \\<in> \\<S>. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis wf_vars_mono)\n\n  have 4: \"\\<forall>S \\<in> \\<S>. \\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by simp\n\n  have \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" using 1 2 3 assms(2) by auto\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis 3 \\<S>)\n\n  have \"fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n       \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\"\n       \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S' \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n    using 4 assms(2) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by force+\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. \\<forall>S' \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" by (metis 4 \\<S>)\n\n  have \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t ?S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S' \\<inter> bvars\\<^sub>s\\<^sub>t ?S = {}\"\n    using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by metis+\n  hence 5: \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A = fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts)\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\"\n            \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts) \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\"\n    using to_st_append by fastforce+\n\n  have *: \"\\<forall>S \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\"\n    using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n  hence \"fv\\<^sub>s\\<^sub>t ?S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" using assms(2) by metis\n  hence \"fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by auto\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by (metis * \\<S>)\n\n  have **: \"\\<forall>S \\<in> \\<S>. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n    using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n  hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t ?S = {}\" using assms(2) by metis\n  hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\" by fastforce\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\" by (metis ** \\<S>)\nqed\n\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_eq:\n  assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> \\<A>\" \"\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\"\n  shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' (update\\<^sub>s\\<^sub>t \\<S> (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S)) (\\<A>@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)])\"\nunfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\nproof (intro conjI)\n  let ?S = \"\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S\"\n  let ?A = \"\\<A>@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)]\"\n\n  have \\<S>: \"\\<And>S'. S' \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S \\<Longrightarrow> S' = S \\<or> S' \\<in> \\<S>\" by auto\n\n  have 1: \"\\<forall>S \\<in> \\<S>. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) (dual\\<^sub>s\\<^sub>t S)\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n  moreover have 2:\n      \"a = Assign \\<Longrightarrow> wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> fv t \\<union> fv t'\"\n      \"a = Check \\<Longrightarrow> wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\"\n    using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split(2) by (auto simp add: Un_assoc)\n  ultimately have 3: \"\\<forall>S \\<in> \\<S>. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\"\n    by (cases a) (metis wf_vars_mono, metis)\n\n  have 4: \"\\<forall>S \\<in> \\<S>. \\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by simp\n\n  have \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" using 1 2 3 assms(2) by (cases a) auto\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis 3 \\<S>)\n\n  have \"fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n       \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\"\n       \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S' \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n    using 4 assms(2) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by force+\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. \\<forall>S' \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" by (metis 4 \\<S>)\n\n  have \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t ?S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S' \\<inter> bvars\\<^sub>s\\<^sub>t ?S = {}\"\n    using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by metis+\n  hence 5: \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A = fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> fv t \\<union> fv t'\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\"\n           \"\\<forall>S' \\<in> \\<S>. fv t \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" \"\\<forall>S' \\<in> \\<S>. fv t' \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\"\n    using to_st_append by fastforce+\n\n  have *: \"\\<forall>S \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\"\n    using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n  hence \"fv\\<^sub>s\\<^sub>t ?S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" using assms(2) by metis\n  hence \"fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by auto\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by (metis * \\<S>)\n\n  have **: \"\\<forall>S \\<in> \\<S>. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n    using 5 assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n  hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t ?S = {}\" using assms(2) by metis\n  hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\" by fastforce\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\" by (metis ** \\<S>)\nqed\n\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_ineq:\n  assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> \\<A>\" \"\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\"\n  shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' (update\\<^sub>s\\<^sub>t \\<S> (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S)) (\\<A>@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)])\"\nunfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\nproof (intro conjI)\n  let ?S = \"\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S\"\n  let ?A = \"\\<A>@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)]\"\n\n  have \\<S>: \"\\<And>S'. S' \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S \\<Longrightarrow> S' = S \\<or> S' \\<in> \\<S>\" by auto\n\n  have 1: \"\\<forall>S \\<in> \\<S>. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) (dual\\<^sub>s\\<^sub>t S)\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n  moreover have 2: \"wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\"\n    using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split(2) by (auto simp add: Un_assoc)\n  ultimately have 3: \"\\<forall>S \\<in> \\<S>. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by metis\n\n  have 4: \"\\<forall>S \\<in> \\<S>. \\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by simp\n\n  have \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" using 1 2 3 assms(2) by auto\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t ?A) (dual\\<^sub>s\\<^sub>t S)\" by (metis 3 \\<S>)\n\n  have \"fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n       \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\"\n       \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S' \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n    using 4 assms(2) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by force+\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. \\<forall>S' \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" by (metis 4 \\<S>)\n\n  have \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t ?S \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" \"\\<forall>S' \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S' \\<inter> bvars\\<^sub>s\\<^sub>t ?S = {}\"\n    using assms unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by metis+\n  moreover have \"fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X \\<subseteq> fv\\<^sub>s\\<^sub>t (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t # S)\" by auto\n  ultimately have 5:\n      \"\\<forall>S' \\<in> \\<S>. (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X) \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\"\n      \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A = fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X)\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = set X \\<union> bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\" \n      \"\\<forall>S \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> set X = {}\"\n    using to_st_append\n    by (blast, force, force, force)\n\n  have *: \"\\<forall>S \\<in> \\<S>. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" using 5(3,4) assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by blast\n  hence \"fv\\<^sub>s\\<^sub>t ?S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" using assms(2) by metis\n  hence \"fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by auto\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t ?A = {}\" by (metis * \\<S>)\n\n  have **: \"\\<forall>S \\<in> \\<S>. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n    using 5(1,2) assms(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fast\n  hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t ?S = {}\" using assms(2) by metis\n  hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\" by auto\n  thus \"\\<forall>S \\<in> update\\<^sub>s\\<^sub>t \\<S> ?S. fv\\<^sub>e\\<^sub>s\\<^sub>t ?A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\" by (metis ** \\<S>)\nqed\n\nprivate lemma trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq:\n  assumes \"x#S \\<in> \\<S>\"\n  shows \"\\<Union>(trms\\<^sub>s\\<^sub>t ` update\\<^sub>s\\<^sub>t \\<S> (x#S)) \\<union> trms\\<^sub>s\\<^sub>t\\<^sub>p x = \\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)\" (is \"?A = ?B\")\nproof\n  show \"?B \\<subseteq> ?A\"\n  proof\n    have \"trms\\<^sub>s\\<^sub>t\\<^sub>p x \\<subseteq> trms\\<^sub>s\\<^sub>t (x#S)\" by auto\n    hence \"\\<And>t'. t' \\<in> ?B \\<Longrightarrow> t' \\<in> trms\\<^sub>s\\<^sub>t\\<^sub>p x \\<Longrightarrow> t' \\<in> ?A\" by simp\n    moreover {\n      fix t' assume t': \"t' \\<in> ?B\" \"t' \\<notin> trms\\<^sub>s\\<^sub>t\\<^sub>p x\"\n      then obtain S' where S': \"t' \\<in> trms\\<^sub>s\\<^sub>t S'\" \"S' \\<in> \\<S>\" by auto\n      hence \"S' = x#S \\<or> S' \\<in> update\\<^sub>s\\<^sub>t \\<S> (x#S)\" by auto\n      moreover {\n        assume \"S' = x#S\"\n        hence \"t' \\<in> trms\\<^sub>s\\<^sub>t S\" using S' t' by simp\n        hence \"t' \\<in> ?A\" by auto\n      }\n      ultimately have \"t' \\<in> ?A\" using t' S' by auto\n    }\n    ultimately show \"\\<And>t'. t' \\<in> ?B \\<Longrightarrow> t' \\<in> ?A\" by metis\n  qed\n\n  show \"?A \\<subseteq> ?B\"\n  proof\n    have \"\\<And>t'. t' \\<in> ?A \\<Longrightarrow> t' \\<in> trms\\<^sub>s\\<^sub>t\\<^sub>p x \\<Longrightarrow> trms\\<^sub>s\\<^sub>t\\<^sub>p x \\<subseteq> ?B\"\n      using assms by force+\n    moreover {\n      fix t' assume t': \"t' \\<in> ?A\" \"t' \\<notin> trms\\<^sub>s\\<^sub>t\\<^sub>p x\"\n      then obtain S' where \"t' \\<in> trms\\<^sub>s\\<^sub>t S'\" \"S' \\<in> update\\<^sub>s\\<^sub>t \\<S> (x#S)\" by auto\n      hence \"S' = S \\<or> S' \\<in> \\<S>\" by auto\n      moreover have \"trms\\<^sub>s\\<^sub>t S \\<subseteq> ?B\" using assms trms\\<^sub>s\\<^sub>t_cons[of x S] by blast\n      ultimately have \"t' \\<in> ?B\" using t' by fastforce\n    }\n    ultimately show \"\\<And>t'. t' \\<in> ?A \\<Longrightarrow> t' \\<in> ?B\" by blast\n  qed\nqed\n\nprivate lemma trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_snd:\n  assumes \"send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\" \"\\<S>' = update\\<^sub>s\\<^sub>t \\<S> (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S)\" \"\\<A>' = \\<A>@[Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  shows \"(\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) = (\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\nproof -\n  have \"(trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') = (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) \\<union> set ts\" \"\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>') \\<union> set ts = \\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)\"\n    using to_st_append trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq[OF assms(1)] assms(2,3) by auto\n  thus ?thesis\n    by (metis (no_types, lifting) Un_commute Un_left_commute)\nqed\n\nprivate lemma trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_rcv:\n  assumes \"receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\" \"\\<S>' = update\\<^sub>s\\<^sub>t \\<S> (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S)\" \"\\<A>' = \\<A>@[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  shows \"(\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) = (\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\nproof -\n  have \"(trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') = (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) \\<union> set ts\" \"\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>') \\<union> set ts = \\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)\"\n    using to_st_append trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq[OF assms(1)] assms(2,3) by auto\n  thus ?thesis\n    by (metis (no_types, lifting) Un_commute Un_left_commute)\nqed\n\nprivate lemma trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_eq:\n  assumes \"\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\" \"\\<S>' = update\\<^sub>s\\<^sub>t \\<S> (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S)\" \"\\<A>' = \\<A>@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  shows \"(\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) = (\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\nproof -\n  have \"(trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') = (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) \\<union> {t,t'}\" \"\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>') \\<union> {t,t'} = \\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)\"\n    using to_st_append trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq[OF assms(1)] assms(2,3) by auto\n  thus ?thesis\n    by (metis (no_types, lifting) Un_insert_left Un_insert_right sup_bot.right_neutral)\nqed\n\nprivate lemma trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_ineq:\n  assumes \"\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\" \"\\<S>' = update\\<^sub>s\\<^sub>t \\<S> (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S)\" \"\\<A>' = \\<A>@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  shows \"(\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) = (\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\nproof -\n  have \"(trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') = (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) \\<union> trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F\" \"\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>') \\<union> trms\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F = \\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)\"\n    using to_st_append trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq[OF assms(1)] assms(2,3) by auto\n  thus ?thesis by (simp add: Un_commute sup_left_commute)\nqed\n\nprivate lemma ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset:\n  assumes \"x#S \\<in> \\<S>\"\n  shows \"\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` (update\\<^sub>s\\<^sub>t \\<S> (x#S))) \\<subseteq> \\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>)\" (is ?A)\n        \"\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` (update\\<^sub>s\\<^sub>t \\<S> (x#S))) \\<subseteq> \\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)\" (is ?B)\nproof -\n  { fix t assume \"t \\<in> \\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` (update\\<^sub>s\\<^sub>t \\<S> (x#S)))\"\n    then obtain S' where S': \"S' \\<in> update\\<^sub>s\\<^sub>t \\<S> (x#S)\" \"t \\<in> ik\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t S')\" by auto\n  \n    have *: \"ik\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t S) \\<subseteq> ik\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t (x#S))\"\n      using ik_append[of \"dual\\<^sub>s\\<^sub>t [x]\" \"dual\\<^sub>s\\<^sub>t S\"] dual\\<^sub>s\\<^sub>t_append[of \"[x]\" S]\n      by auto\n  \n    hence \"t \\<in> \\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>)\"\n    proof (cases \"S' = S\")\n      case True thus ?thesis using * assms S' by auto\n    next\n      case False thus ?thesis using S' by auto\n    qed\n  }\n  moreover\n  { fix t assume \"t \\<in> \\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` (update\\<^sub>s\\<^sub>t \\<S> (x#S)))\"\n    then obtain S' where S': \"S' \\<in> update\\<^sub>s\\<^sub>t \\<S> (x#S)\" \"t \\<in> assignment_rhs\\<^sub>s\\<^sub>t S'\" by auto\n  \n    have \"assignment_rhs\\<^sub>s\\<^sub>t S \\<subseteq> assignment_rhs\\<^sub>s\\<^sub>t (x#S)\"\n      using assignment_rhs_append[of \"[x]\" S] by simp\n    hence \"t \\<in> \\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)\"\n      using assms S' by (cases \"S' = S\") auto\n  }\n  ultimately show ?A ?B by (metis subsetI)+\nqed\n\nprivate lemma ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_snd:\n  assumes \"send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\"\n          \"\\<S>' = update\\<^sub>s\\<^sub>t \\<S> (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S)\"\n          \"\\<A>' = \\<A>@[Step (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  shows \"(\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') \\<subseteq>\n         (\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" (is ?A)\n        \"(\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') \\<subseteq>\n         (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" (is ?B)\nproof -\n  { fix t' assume t'_in: \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\n    hence \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) \\<union> set ts\" using assms ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n    moreover have \"set ts \\<subseteq> \\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>)\" using assms(1) by force\n    ultimately have \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n      using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n  }\n  moreover\n  { fix t' assume t'_in: \"t' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\n    hence \"t' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n      using assms assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n    hence \"t' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n      using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n  }\n  ultimately show ?A ?B by (metis subsetI)+\nqed\n\nprivate lemma ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_rcv:\n  assumes \"receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\"\n          \"\\<S>' = update\\<^sub>s\\<^sub>t \\<S> (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S)\"\n          \"\\<A>' = \\<A>@[Step (send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  shows \"(\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') \\<subseteq>\n         (\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" (is ?A)\n        \"(\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') \\<subseteq>\n         (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" (is ?B)\nproof -\n  { fix t' assume t'_in: \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\n    hence \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" using assms ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n    hence \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n      using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n  }\n  moreover\n  { fix t' assume t'_in: \"t' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\n    hence \"t' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n      using assms assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n    hence \"t' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n      using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n  }\n  ultimately show ?A ?B by (metis subsetI)+\nqed\n\nprivate lemma ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_eq:\n  assumes \"\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\"\n          \"\\<S>' = update\\<^sub>s\\<^sub>t \\<S> (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S)\"\n          \"\\<A>' = \\<A>@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  shows \"(\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') \\<subseteq>\n         (\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" (is ?A)\n        \"(\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') \\<subseteq>\n         (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" (is ?B)\nproof -\n  have 1: \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n    when \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\n    for t'\n  proof -\n    have \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" using that assms ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n    thus ?thesis using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n  qed\n\n  have 2: \"t'' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n    when \"t'' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\" \"a = Assign\"\n    for t''\n  proof -\n    have \"t'' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>) \\<union> {t'}\"\n      using that assms assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n    moreover have \"t' \\<in> \\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)\" using assms(1) that by force\n    ultimately show ?thesis using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) that by auto\n  qed\n\n  have 3: \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>' = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\" (is ?C)\n          \"(\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<subseteq> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>))\" (is ?D)\n    when \"a = Check\"\n  proof -\n    show ?C using that assms(2,3) by (simp add: assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append)\n    show ?D using assms(1,2,3) ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset(2) by auto \n  qed\n\n  show ?A using 1 2 by (metis subsetI)\n  show ?B using 1 2 3 by (cases a) blast+\nqed\n\nprivate lemma ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_ineq:\n  assumes \"\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>\"\n          \"\\<S>' = update\\<^sub>s\\<^sub>t \\<S> (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S)\"\n          \"\\<A>' = \\<A>@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)]\"\n  shows \"(\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') \\<subseteq>\n          (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" (is ?A)\n        \"(\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>') \\<subseteq>\n         (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" (is ?B)\nproof -\n  { fix t' assume t'_in: \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\n    hence \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\" using assms ik\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n    hence \"t' \\<in> (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n      using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n  }\n  moreover\n  { fix t' assume t'_in: \"t' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\n    hence \"t' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n      using assms assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append by auto\n    hence \"t' \\<in> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\"\n      using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset[OF assms(1)] assms(2) by auto\n  }\n  ultimately show ?A ?B by (metis subsetI)+\nqed\n\n\nsubsubsection \\<open>Transition Systems Definitions\\<close>\ninductive pts_symbolic::\n  \"(('fun,'var) strands \\<times> ('fun,'var) strand) \\<Rightarrow>\n   (('fun,'var) strands \\<times> ('fun,'var) strand) \\<Rightarrow> bool\"\n(infix \"\\<Rightarrow>\\<^sup>\\<bullet>\" 50) where\n  Nil[simp]:        \"[] \\<in> \\<S> \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet> (update\\<^sub>s\\<^sub>t \\<S> [],\\<A>)\"\n| Send[simp]:       \"send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S> \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet> (update\\<^sub>s\\<^sub>t \\<S> (send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S),\\<A>@[receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t])\"\n| Receive[simp]:    \"receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S> \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet> (update\\<^sub>s\\<^sub>t \\<S> (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S),\\<A>@[send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t])\"\n| Equality[simp]:   \"\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S> \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet> (update\\<^sub>s\\<^sub>t \\<S> (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S),\\<A>@[\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t])\"\n| Inequality[simp]: \"\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S> \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet> (update\\<^sub>s\\<^sub>t \\<S> (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S),\\<A>@[\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t])\"\n\nprivate inductive pts_symbolic_c::\n  \"(('fun,'var) strands \\<times> ('fun,'var) extstrand) \\<Rightarrow>\n   (('fun,'var) strands \\<times> ('fun,'var) extstrand) \\<Rightarrow> bool\"\n(infix \"\\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\" 50) where\n  Nil[simp]:        \"[] \\<in> \\<S> \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (update\\<^sub>s\\<^sub>t \\<S> [],\\<A>)\"\n| Send[simp]:       \"send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S> \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (update\\<^sub>s\\<^sub>t \\<S> (send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S),\\<A>@[Step (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Receive[simp]:    \"receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S> \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (update\\<^sub>s\\<^sub>t \\<S> (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S),\\<A>@[Step (send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Equality[simp]:   \"\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S> \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (update\\<^sub>s\\<^sub>t \\<S> (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S),\\<A>@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Inequality[simp]: \"\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S> \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (update\\<^sub>s\\<^sub>t \\<S> (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S),\\<A>@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)])\"\n| Decompose[simp]:  \"Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\n                     \\<Longrightarrow> (\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (\\<S>,\\<A>@[Decomp (Fun f T)])\"\n\nabbreviation pts_symbolic_rtrancl (infix \"\\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>*\" 50) where \"a \\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>* b \\<equiv> pts_symbolic\\<^sup>*\\<^sup>* a b\"\nprivate abbreviation pts_symbolic_c_rtrancl (infix \"\\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>*\" 50) where \"a \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* b \\<equiv> pts_symbolic_c\\<^sup>*\\<^sup>* a b\"\n\nlemma pts_symbolic_induct[consumes 1, case_names Nil Send Receive Equality Inequality]:\n  assumes \"(\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet> (\\<S>',\\<A>')\"\n  and \"\\<lbrakk>[] \\<in> \\<S>; \\<S>' = update\\<^sub>s\\<^sub>t \\<S> []; \\<A>' = \\<A>\\<rbrakk> \\<Longrightarrow> P\"\n  and \"\\<And>t S. \\<lbrakk>send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>; \\<S>' = update\\<^sub>s\\<^sub>t \\<S> (send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S); \\<A>' = \\<A>@[receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t]\\<rbrakk> \\<Longrightarrow> P\"\n  and \"\\<And>t S. \\<lbrakk>receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>; \\<S>' = update\\<^sub>s\\<^sub>t \\<S> (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S); \\<A>' = \\<A>@[send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t]\\<rbrakk> \\<Longrightarrow> P\"\n  and \"\\<And>a t t' S. \\<lbrakk>\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>; \\<S>' = update\\<^sub>s\\<^sub>t \\<S> (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S); \\<A>' = \\<A>@[\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t]\\<rbrakk> \\<Longrightarrow> P\"\n  and \"\\<And>X F S. \\<lbrakk>\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>; \\<S>' = update\\<^sub>s\\<^sub>t \\<S> (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S); \\<A>' = \\<A>@[\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t]\\<rbrakk> \\<Longrightarrow> P\"\n  shows \"P\"\napply (rule pts_symbolic.cases[OF assms(1)])\nusing assms(2,3,4,5,6) by simp_all\n\nprivate lemma pts_symbolic_c_induct[consumes 1, case_names Nil Send Receive Equality Inequality Decompose]:\n  assumes \"(\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (\\<S>',\\<A>')\"\n  and \"\\<lbrakk>[] \\<in> \\<S>; \\<S>' = update\\<^sub>s\\<^sub>t \\<S> []; \\<A>' = \\<A>\\<rbrakk> \\<Longrightarrow> P\"\n  and \"\\<And>t S. \\<lbrakk>send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>; \\<S>' = update\\<^sub>s\\<^sub>t \\<S> (send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S); \\<A>' = \\<A>@[Step (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t)]\\<rbrakk> \\<Longrightarrow> P\"\n  and \"\\<And>t S. \\<lbrakk>receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>; \\<S>' = update\\<^sub>s\\<^sub>t \\<S> (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S); \\<A>' = \\<A>@[Step (send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t)]\\<rbrakk> \\<Longrightarrow> P\"\n  and \"\\<And>a t t' S. \\<lbrakk>\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>; \\<S>' = update\\<^sub>s\\<^sub>t \\<S> (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S); \\<A>' = \\<A>@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)]\\<rbrakk> \\<Longrightarrow> P\"\n  and \"\\<And>X F S. \\<lbrakk>\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S \\<in> \\<S>; \\<S>' = update\\<^sub>s\\<^sub>t \\<S> (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S); \\<A>' = \\<A>@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)]\\<rbrakk> \\<Longrightarrow> P\"\n  and \"\\<And>f T. \\<lbrakk>Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>); \\<S>' = \\<S>; \\<A>' = \\<A>@[Decomp (Fun f T)]\\<rbrakk> \\<Longrightarrow> P\"\n  shows \"P\"\napply (rule pts_symbolic_c.cases[OF assms(1)])\nusing assms(2,3,4,5,6,7) by simp_all\n\nprivate lemma pts_symbolic_c_preserves_wf_prot:\n  assumes \"(\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>',\\<A>')\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> \\<A>\"\n  shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S>' \\<A>'\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n  case (step \\<S>1 \\<A>1 \\<S>2 \\<A>2)\n  from step.hyps(2) step.IH[OF step.prems] show ?case\n  proof (induction rule: pts_symbolic_c_induct)\n    case Decompose\n    hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1\"\n      using bvars_decomp ik_assignment_rhs_decomp_fv by metis+\n    thus ?case using Decompose unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\n      by (metis wf_vars_mono wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_split(2))\n  qed (metis wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_nil, metis wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_snd,\n       metis wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_rcv, metis wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_eq,\n       metis wf\\<^sub>s\\<^sub>t\\<^sub>s'_update\\<^sub>s\\<^sub>t_ineq)\nqed metis\n\nprivate lemma pts_symbolic_c_preserves_wf_is:\n  assumes \"(\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>',\\<A>')\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> \\<A>\" \"wf\\<^sub>s\\<^sub>t V (to_st \\<A>)\"\n  shows \"wf\\<^sub>s\\<^sub>t V (to_st \\<A>')\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n  case (step \\<S>1 \\<A>1 \\<S>2 \\<A>2)\n  hence \"(\\<S>, \\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>2, \\<A>2)\" by auto\n  hence *: \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S>1 \\<A>1\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S>2 \\<A>2\"\n    using pts_symbolic_c_preserves_wf_prot[OF _ step.prems(1)] step.hyps(1)\n    by auto\n\n  from step.hyps(2) step.IH[OF step.prems] show ?case\n  proof (induction rule: pts_symbolic_c_induct)\n    case Nil thus ?case by auto\n  next\n    case (Send ts S)\n    hence \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1) (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#(dual\\<^sub>s\\<^sub>t S))\"\n      using *(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fastforce\n    hence \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts) \\<subseteq> wfrestrictedvars\\<^sub>s\\<^sub>t (to_st \\<A>1) \\<union> V\"\n      using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_eq_wfrestrictedvars\\<^sub>s\\<^sub>t by auto\n    thus ?case using Send wf_rcv_append''' to_st_append by simp\n  next\n    case (Receive ts) thus ?case using wf_snd_append to_st_append by simp\n  next\n    case (Equality a t t' S)\n    hence \"wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1) (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#(dual\\<^sub>s\\<^sub>t S))\"\n      using *(1) unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by fastforce\n    hence \"fv t' \\<subseteq> wfrestrictedvars\\<^sub>s\\<^sub>t (to_st \\<A>1) \\<union> V\" when \"a = Assign\"\n      using wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_eq_wfrestrictedvars\\<^sub>s\\<^sub>t that by auto\n    thus ?case using Equality wf_eq_append''' to_st_append by (cases a) auto\n  next\n    case (Inequality t t' S) thus ?case using wf_ineq_append'' to_st_append by simp\n  next\n    case (Decompose f T)\n    hence \"fv (Fun f T) \\<subseteq> wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1\"\n      by (metis fv_subterms_set fv_subset subset_trans\n                ik\\<^sub>s\\<^sub>t_assignment_rhs\\<^sub>s\\<^sub>t_wfrestrictedvars_subset)\n    hence \"vars\\<^sub>s\\<^sub>t (decomp (Fun f T)) \\<subseteq> wfrestrictedvars\\<^sub>s\\<^sub>t (to_st \\<A>1) \\<union> V\"\n      using decomp_vars[of \"Fun f T\"] wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_eq_wfrestrictedvars\\<^sub>s\\<^sub>t[of \\<A>1] by auto\n    thus ?case\n      using to_st_append[of \\<A>1 \"[Decomp (Fun f T)]\"]\n            wf_append_suffix[OF Decompose.prems] Decompose.hyps(3)\n      by (metis append_Nil2 decomp_vars(1,2) to_st.simps(1,3))\n  qed\nqed metis\n\nprivate lemma pts_symbolic_c_preserves_tfr\\<^sub>s\\<^sub>e\\<^sub>t:\n  assumes \"(\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>',\\<A>')\"\n    and \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ((\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>))\"\n    and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s ((\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>))\"\n  shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ((\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')) \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s ((\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>')) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>'))\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n  case (step \\<S>1 \\<A>1 \\<S>2 \\<A>2)\n  from step.hyps(2) step.IH[OF step.prems] show ?case\n  proof (induction rule: pts_symbolic_c_induct)\n    case Nil\n    hence \"\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>1) = \\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>2)\" by force\n    thus ?case using Nil by metis\n  next\n    case (Decompose f T)\n    obtain t where t: \"t \\<in> ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1\" \"Fun f T \\<sqsubseteq> t\"\n      using Decompose.hyps(1) by auto\n    have t_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n      using Decompose.prems wf_trm_subterm[of _ t]\n            trms\\<^sub>e\\<^sub>s\\<^sub>t_ik_assignment_rhsI[OF t(1)]\n      unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def\n      by (metis UN_E Un_iff)\n    have \"t \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\" using trms\\<^sub>e\\<^sub>s\\<^sub>t_ik_assignment_rhsI t by auto\n    hence \"Fun f T \\<in> SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"\n      by (metis (no_types) SMP.MP SMP.Subterm UN_E t(2)) \n    hence \"{Fun f T} \\<subseteq> SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\" using SMP.Subterm[of \"Fun f T\"] by auto\n    moreover have \"trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = insert (Fun f T) (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"\n      using Decompose.hyps(3) by auto\n    ultimately have *: \"SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1) = SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2)\"\n      using SMP_subset_union_eq[of \"{Fun f T}\"]\n      by (simp add: Un_commute)\n    hence \"SMP ((\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>1)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)) = SMP ((\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>2)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2))\"\n      using Decompose.hyps(2) SMP_union by auto\n    moreover have \"\\<forall>t \\<in> trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1. wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\"\n      using Decompose.prems wf_trm_subterm t(2) t_wf unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by auto\n    hence \"\\<forall>t \\<in> trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2. wf\\<^sub>t\\<^sub>r\\<^sub>m t\" by (metis * SMP.MP SMP_wf_trm) \n    hence \"\\<forall>t \\<in> (\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>2)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2). wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n      using Decompose.prems Decompose.hyps(2) unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by force\n    ultimately show ?thesis using Decompose.prems unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by presburger \n  qed (metis trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_snd, metis trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_rcv,\n       metis trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_eq, metis trms\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_eq_ineq)\nqed metis\n\nprivate lemma pts_symbolic_c_preserves_tfr\\<^sub>s\\<^sub>t\\<^sub>p:\n  assumes \"(\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>',\\<A>')\" \"\\<forall>S \\<in> \\<S> \\<union> {to_st \\<A>}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n  shows \"\\<forall>S \\<in> \\<S>' \\<union> {to_st \\<A>'}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n  case (step \\<S>1 \\<A>1 \\<S>2 \\<A>2)\n  from step.hyps(2) step.IH[OF step.prems] show ?case\n  proof (induction rule: pts_symbolic_c_induct)\n    case Nil\n    have 1: \"\\<forall>S \\<in> {to_st \\<A>2}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Nil by simp\n    have 2: \"\\<S>2 = \\<S>1 - {[]}\" \"\\<forall>S \\<in> \\<S>1. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"  using Nil by simp_all\n    have \"\\<forall>S \\<in> \\<S>2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n    proof\n      fix S assume \"S \\<in> \\<S>2\"\n      hence \"S \\<in> \\<S>1\" using 2(1) by simp\n      thus \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using 2(2) by simp\n    qed\n    thus ?case using 1 by auto\n  next\n    case (Send t S)\n    have 1: \"\\<forall>S \\<in> {to_st \\<A>2}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Send by (simp add: to_st_append)\n    have 2: \"\\<S>2 = insert S (\\<S>1 - {send\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S})\" \"\\<forall>S \\<in> \\<S>1. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"  using Send by simp_all\n    have 3: \"\\<forall>S \\<in> \\<S>2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n    proof\n      fix S' assume \"S' \\<in> \\<S>2\"\n      hence \"S' \\<in> \\<S>1 \\<or> S' = S\" using 2(1) by auto\n      moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Send.hyps 2(2) by auto\n      ultimately show \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" using 2(2) by blast\n    qed\n    thus ?case using 1 by auto\n  next\n    case (Receive t S)\n    have 1: \"\\<forall>S \\<in> {to_st \\<A>2}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Receive by (simp add: to_st_append)\n    have 2: \"\\<S>2 = insert S (\\<S>1 - {receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t#S})\" \"\\<forall>S \\<in> \\<S>1. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n      using Receive by simp_all\n    have 3: \"\\<forall>S \\<in> \\<S>2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n    proof\n      fix S' assume \"S' \\<in> \\<S>2\"\n      hence \"S' \\<in> \\<S>1 \\<or> S' = S\" using 2(1) by auto\n      moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Receive.hyps 2(2) by auto\n      ultimately show \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" using 2(2) by blast\n    qed\n    show ?case using 1 3 by auto\n  next\n    case (Equality a t t' S)\n    have 1: \"to_st \\<A>2 = to_st \\<A>1@[\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t]\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\<A>1)\"\n      using Equality by (simp_all add: to_st_append)\n    have 2: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p [\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t]\" using Equality by fastforce\n    have 3: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\<A>2)\"\n      using tfr_stp_all_append[of \"to_st \\<A>1\" \"[\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t]\"] 1 2 by metis\n    hence 4: \"\\<forall>S \\<in> {to_st \\<A>2}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Equality by simp\n    have 5: \"\\<S>2 = insert S (\\<S>1 - {\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S})\" \"\\<forall>S \\<in> \\<S>1. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n      using Equality by simp_all\n    have 6: \"\\<forall>S \\<in> \\<S>2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" \n    proof\n      fix S' assume \"S' \\<in> \\<S>2\"\n      hence \"S' \\<in> \\<S>1 \\<or> S' = S\" using 5(1) by auto\n      moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Equality.hyps 5(2) by auto\n      ultimately show \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" using 5(2) by blast\n    qed\n    thus ?case using 4 by auto\n  next\n    case (Inequality X F S)\n    have 1: \"to_st \\<A>2 = to_st \\<A>1@[\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t]\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\<A>1)\"\n      using Inequality by (simp_all add: to_st_append)\n    have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S)\" using Inequality(1,4) by blast\n    hence 2: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p [\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t]\" by simp\n    have 3: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\<A>2)\"\n      using tfr_stp_all_append[of \"to_st \\<A>1\" \"[\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t]\"] 1 2 by metis\n    hence 4: \"\\<forall>S \\<in> {to_st \\<A>2}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Inequality by simp\n    have 5: \"\\<S>2 = insert S (\\<S>1 - {\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S})\" \"\\<forall>S \\<in> \\<S>1. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n      using Inequality by simp_all\n    have 6: \"\\<forall>S \\<in> \\<S>2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n    proof\n      fix S' assume \"S' \\<in> \\<S>2\"\n      hence \"S' \\<in> \\<S>1 \\<or> S' = S\" using 5(1) by auto\n      moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" using Inequality.hyps 5(2) by auto\n      ultimately show \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S'\" using 5(2) by blast\n    qed\n    thus ?case using 4 by auto\n  next\n    case (Decompose f T)\n    hence 1: \"\\<forall>S \\<in> \\<S>2. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\" by blast\n    have 2: \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\<A>1)\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st [Decomp (Fun f T)])\"\n      using Decompose.prems decomp_tfr\\<^sub>s\\<^sub>t\\<^sub>p by auto\n    hence \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\<A>1@to_st [Decomp (Fun f T)])\" by auto\n    hence \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\<A>2)\"\n      using Decompose.hyps(3) to_st_append[of \\<A>1 \"[Decomp (Fun f T)]\"]\n      by auto\n    thus ?case using 1 by blast\n  qed\nqed\n\nprivate lemma pts_symbolic_c_preserves_well_analyzed:\n  assumes \"(\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>',\\<A>')\" \"well_analyzed \\<A>\"\n  shows \"well_analyzed \\<A>'\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n  case (step \\<S>1 \\<A>1 \\<S>2 \\<A>2)\n  from step.hyps(2) step.IH[OF step.prems] show ?case\n  proof (induction rule: pts_symbolic_c_induct)\n    case Receive thus ?case by (metis well_analyzed_singleton(1) well_analyzed_append)\n  next\n    case Send thus ?case by (metis well_analyzed_singleton(2) well_analyzed_append)\n  next\n    case Equality thus ?case by (metis well_analyzed_singleton(3) well_analyzed_append)\n  next\n    case Inequality thus ?case by (metis well_analyzed_singleton(4) well_analyzed_append)\n  next\n    case (Decompose f T)\n    hence \"Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1) - (Var`\\<V>)\" by auto\n    thus ?case by (metis well_analyzed.Decomp Decompose.prems Decompose.hyps(3))\n  qed simp\nqed metis\n\nprivate lemma pts_symbolic_c_preserves_Ana_invar_subst:\n  assumes \"(\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>',\\<A>')\"\n    and \"Ana_invar_subst (\n          (\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)) \\<union>\n          (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)))\"\n  shows \"Ana_invar_subst (\n          (\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>') \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')) \\<union>\n          (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>') \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')))\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n  case (step \\<S>1 \\<A>1 \\<S>2 \\<A>2)\n  from step.hyps(2) step.IH[OF step.prems] show ?case\n  proof (induction rule: pts_symbolic_c_induct)\n    case Nil\n    hence \"\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>1) = \\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>2)\"\n          \"\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>1) = \\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>2)\"\n      by force+\n    thus ?case using Nil by metis\n  next \n    case Send show ?case\n      using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_snd[OF Send.hyps]\n            Ana_invar_subst_subset[OF Send.prems]\n      by (metis Un_mono)\n  next\n    case Receive show ?case\n      using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_rcv[OF Receive.hyps]\n            Ana_invar_subst_subset[OF Receive.prems]\n      by (metis Un_mono)\n  next\n    case Equality show ?case\n      using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_eq[OF Equality.hyps]\n            Ana_invar_subst_subset[OF Equality.prems]\n      by (metis Un_mono)\n  next\n    case Inequality show ?case\n      using ik\\<^sub>s\\<^sub>t_update\\<^sub>s\\<^sub>t_subset_ineq[OF Inequality.hyps]\n            Ana_invar_subst_subset[OF Inequality.prems]\n      by (metis Un_mono)\n  next\n    case (Decompose f T)\n    let ?X = \"\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t`\\<S>2) \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2\"\n    let ?Y = \"\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t`\\<S>1) \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1\"\n    obtain K M where Ana: \"Ana (Fun f T) = (K,M)\" by moura\n    hence *: \"ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> set M\" \"assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1\"\n      using ik\\<^sub>e\\<^sub>s\\<^sub>t_append assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append decomp_ik\n            decomp_assignment_rhs_empty Decompose.hyps(3)\n      by auto\n    { fix g S assume \"Fun g S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t`\\<S>2) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 \\<union> ?X)\"\n      hence \"Fun g S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>1) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> set M \\<union> ?X)\"\n        using * Decompose.hyps(2) by auto\n      hence \"Fun g S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>1))\n            \\<or> Fun g S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\n            \\<or> Fun g S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M)\n            \\<or> Fun g S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t`\\<S>1))\n            \\<or> Fun g S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"\n        using Decompose * Ana_fun_subterm[OF Ana] by auto\n      moreover have \"Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"\n        using trms\\<^sub>e\\<^sub>s\\<^sub>t_ik_subtermsI Decompose.hyps(1) by auto \n      hence \"subterms (Fun f T) \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"\n        by (metis in_subterms_subset_Union)\n      hence \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (set M) \\<subseteq> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"\n        by (meson Un_upper2 Ana_subterm[OF Ana] subterms_subset_set psubsetE subset_trans)\n      ultimately have \"Fun g S \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t ` \\<S>1) \\<union> ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> ?Y)\"\n        by auto\n    }\n    thus ?case using Decompose unfolding Ana_invar_subst_def by metis\n  qed\nqed\n\nprivate lemma pts_symbolic_c_preserves_constr_disj_vars:\n  assumes \"(\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>',\\<A>')\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> \\<A>\" \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A> \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A> = {}\"\n  shows \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>' \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>' = {}\"\nusing assms\nproof (induction rule: rtranclp_induct2)\n  case (step \\<S>1 \\<A>1 \\<S>2 \\<A>2)\n  have *: \"\\<And>S. S \\<in> \\<S>1 \\<Longrightarrow> fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 = {}\" \"\\<And>S. S \\<in> \\<S>1 \\<Longrightarrow> fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\"\n    using pts_symbolic_c_preserves_wf_prot[OF step.hyps(1) step.prems(1)]\n    unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def by auto\n  from step.hyps(2) step.IH[OF step.prems]\n  show ?case\n  proof (induction rule: pts_symbolic_c_induct)\n    case Nil thus ?case by auto\n  next \n    case (Send ts S)\n    hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts)\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1\"\n          \"fv\\<^sub>s\\<^sub>t (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S) = fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts) \\<union> fv\\<^sub>s\\<^sub>t S\"\n      using fv\\<^sub>e\\<^sub>s\\<^sub>t_append bvars\\<^sub>e\\<^sub>s\\<^sub>t_append by simp+\n    thus ?case using *(1)[OF Send(1)] Send(4) by auto\n  next\n    case (Receive ts S)\n    hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts)\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1\"\n          \"fv\\<^sub>s\\<^sub>t (receive\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t#S) = fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts) \\<union> fv\\<^sub>s\\<^sub>t S\"\n      using fv\\<^sub>e\\<^sub>s\\<^sub>t_append bvars\\<^sub>e\\<^sub>s\\<^sub>t_append by simp+\n    thus ?case using *(1)[OF Receive(1)] Receive(4) by auto\n  next\n    case (Equality a t t' S)\n    hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> fv t \\<union> fv t'\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1\"\n          \"fv\\<^sub>s\\<^sub>t (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t#S) = fv t \\<union> fv t' \\<union> fv\\<^sub>s\\<^sub>t S\"\n      using fv\\<^sub>e\\<^sub>s\\<^sub>t_append bvars\\<^sub>e\\<^sub>s\\<^sub>t_append by fastforce+\n    thus ?case using *(1)[OF Equality(1)] Equality(4) by auto\n  next\n    case (Inequality X F S)\n    hence \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X)\" \"bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>2 = bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<union> set X\"\n          \"fv\\<^sub>s\\<^sub>t (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t#S) = (fv\\<^sub>p\\<^sub>a\\<^sub>i\\<^sub>r\\<^sub>s F - set X) \\<union> fv\\<^sub>s\\<^sub>t S\"\n      using fv\\<^sub>e\\<^sub>s\\<^sub>t_append bvars\\<^sub>e\\<^sub>s\\<^sub>t_append strand_vars_split(3)[of \"[\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t]\" S]\n      by auto+\n    moreover have \"fv\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1 \\<inter> set X = {}\" using *(2)[OF Inequality(1)] by auto\n    ultimately show ?case using *(1)[OF Inequality(1)] Inequality(4) by auto\n  next\n    case (Decompose f T)\n    thus ?case\n      using Decompose(3,4) bvars_decomp ik_assignment_rhs_decomp_fv[OF Decompose(1)] by auto\n  qed\nqed\n\n\nsubsubsection \\<open>Theorem: The Typing Result Lifted to the Transition System Level\\<close>\nprivate lemma wf\\<^sub>s\\<^sub>t\\<^sub>s'_decomp_rm:\n  assumes \"well_analyzed A\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' S (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t A)\" shows \"wf\\<^sub>s\\<^sub>t\\<^sub>s' S A\"\nunfolding wf\\<^sub>s\\<^sub>t\\<^sub>s'_def\nproof (intro conjI)\n  show \"\\<forall>S\\<in>S. wf\\<^sub>s\\<^sub>t (wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t A) (dual\\<^sub>s\\<^sub>t S)\"\n    by (metis (no_types) assms(2) wf\\<^sub>s\\<^sub>t\\<^sub>s'_def wfrestrictedvars\\<^sub>e\\<^sub>s\\<^sub>t_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_subset\n                wf_vars_mono le_iff_sup)\n\n  show \"\\<forall>Sa\\<in>S. \\<forall>S'\\<in>S. fv\\<^sub>s\\<^sub>t Sa \\<inter> bvars\\<^sub>s\\<^sub>t S' = {}\" by (metis assms(2) wf\\<^sub>s\\<^sub>t\\<^sub>s'_def)\n\n  show \"\\<forall>S\\<in>S. fv\\<^sub>s\\<^sub>t S \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t A = {}\" by (metis assms(2) wf\\<^sub>s\\<^sub>t\\<^sub>s'_def bvars_decomp_rm)\n\n  show \"\\<forall>S\\<in>S. fv\\<^sub>e\\<^sub>s\\<^sub>t A \\<inter> bvars\\<^sub>s\\<^sub>t S = {}\" by (metis assms wf\\<^sub>s\\<^sub>t\\<^sub>s'_def well_analyzed_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_fv)\nqed\n\nprivate lemma decomps\\<^sub>e\\<^sub>s\\<^sub>t_pts_symbolic_c:\n  assumes \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\<I>\"\n  shows \"(S,A) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (S,A@D)\"\nusing assms(1)\nproof (induction D rule: decomps\\<^sub>e\\<^sub>s\\<^sub>t.induct)\n  case (Decomp B f X K T)\n  have \"subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t A \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t A) \\<subseteq>\n        subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B) \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@B))\"\n    using ik\\<^sub>e\\<^sub>s\\<^sub>t_append[of A B] assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t_append[of A B]\n    by auto\n  hence \"Fun f X \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t (A@B) \\<union> assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t (A@B))\" using Decomp.hyps by auto\n  hence \"(S,A@B) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (S,A@B@[Decomp (Fun f X)])\"\n    using pts_symbolic_c.Decompose[of f X \"A@B\"]\n    by simp\n  thus ?case\n    using Decomp.IH rtrancl_into_rtrancl\n          rtranclp_rtrancl_eq[of pts_symbolic_c \"(S,A)\" \"(S,A@B)\"]\n    by auto\nqed simp\n\nprivate lemma pts_symbolic_to_pts_symbolic_c:\n  assumes \"(\\<S>,to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d)) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>* (\\<S>',\\<A>')\" \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d {} \\<I> (to_est \\<A>')\" \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> \\<A>\\<^sub>d\"\n  and wf: \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d)\" \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} \\<A>\\<^sub>d\"\n  and tar: \"Ana_invar_subst ((\\<Union>(ik\\<^sub>s\\<^sub>t` dual\\<^sub>s\\<^sub>t` \\<S>) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d))\n                            \\<union> (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t` \\<S>) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d)))\"\n  and wa: \"well_analyzed \\<A>\\<^sub>d\"\n  and \\<I>: \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\"\n  shows \"\\<exists>\\<A>\\<^sub>d'. \\<A>' = to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d') \\<and> (\\<S>,\\<A>\\<^sub>d) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>',\\<A>\\<^sub>d') \\<and> sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> \\<A>\\<^sub>d'\"\nusing assms(1,2)\nproof (induction rule: rtranclp_induct2)\n  case refl thus ?case using assms by auto\nnext\n  case (step \\<S>1 \\<A>1 \\<S>2 \\<A>2)\n  have \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d {} \\<I> (to_est \\<A>1)\" using step.hyps(2) step.prems\n    by (induct rule: pts_symbolic_induct, metis, (metis sem\\<^sub>e\\<^sub>s\\<^sub>t_d_split_left to_est_append)+)\n  then obtain \\<A>1d where\n      \\<A>1d: \"\\<A>1 = to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1d)\" \"(\\<S>, \\<A>\\<^sub>d) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>1, \\<A>1d)\" \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> \\<A>1d\"\n    using step.IH by moura\n\n  show ?case using step.hyps(2)\n  proof (induction rule: pts_symbolic_induct)\n    case Nil\n    hence \"(\\<S>, \\<A>\\<^sub>d) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>2, \\<A>1d)\" using \\<A>1d pts_symbolic_c.Nil[OF Nil.hyps(1), of \\<A>1d] by simp\n    thus ?case using \\<A>1d Nil by auto\n  next\n    case (Send t S)\n    hence \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> (\\<A>1d@[Step (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t)])\" using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Receive[OF \\<A>1d(3)] by simp\n    moreover have \"(\\<S>1, \\<A>1d) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (\\<S>2, \\<A>1d@[Step (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t)])\"\n      using Send.hyps(2) pts_symbolic_c.Send[OF Send.hyps(1), of \\<A>1d] by simp\n    moreover have \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (\\<A>1d@[Step (receive\\<langle>t\\<rangle>\\<^sub>s\\<^sub>t)])) = \\<A>2\"\n      using Send.hyps(3) decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append \\<A>1d(1) by (simp add: to_st_append) \n    ultimately show ?case using \\<A>1d(2) by auto      \n  next\n    case (Equality a t t' S)\n    hence \"t \\<cdot> \\<I> = t' \\<cdot> \\<I>\"\n      using step.prems sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st[of \"{}\" \\<I> \"to_est \\<A>2\"]\n            to_st_append to_est_append to_st_to_est_inv\n      by auto\n    hence \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> (\\<A>1d@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)])\" using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Equality[OF \\<A>1d(3)] by simp\n    moreover have \"(\\<S>1, \\<A>1d) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (\\<S>2, \\<A>1d@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)])\"\n      using Equality.hyps(2) pts_symbolic_c.Equality[OF Equality.hyps(1), of \\<A>1d] by simp\n    moreover have \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (\\<A>1d@[Step (\\<langle>a: t \\<doteq> t'\\<rangle>\\<^sub>s\\<^sub>t)])) = \\<A>2\"\n      using Equality.hyps(3) decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append \\<A>1d(1) by (simp add: to_st_append) \n    ultimately show ?case using \\<A>1d(2) by auto\n  next\n    case (Inequality X F S)\n    hence \"ineq_model \\<I> X F\"\n      using step.prems sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st[of \"{}\" \\<I> \"to_est \\<A>2\"]\n            to_st_append to_est_append to_st_to_est_inv\n      by auto\n    hence \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> (\\<A>1d@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)])\" using sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Inequality[OF \\<A>1d(3)] by simp\n    moreover have \"(\\<S>1, \\<A>1d) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c (\\<S>2, \\<A>1d@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)])\"\n      using Inequality.hyps(2) pts_symbolic_c.Inequality[OF Inequality.hyps(1), of \\<A>1d] by simp\n    moreover have \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (\\<A>1d@[Step (\\<forall>X\\<langle>\\<or>\\<noteq>: F\\<rangle>\\<^sub>s\\<^sub>t)])) = \\<A>2\"\n      using Inequality.hyps(3) decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append \\<A>1d(1) by (simp add: to_st_append) \n    ultimately show ?case using \\<A>1d(2) by auto\n  next\n    case (Receive ts S)\n    hence \"\\<forall>t \\<in> set ts. ik\\<^sub>s\\<^sub>t \\<A>1 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t \\<cdot> \\<I>\"\n      using step.prems sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st[of \"{}\" \\<I> \"to_est \\<A>2\"]\n            strand_sem_split(4)[of \"{}\" \\<A>1 \"[send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t]\" \\<I>]\n            to_st_append to_est_append to_st_to_est_inv\n      by auto\n    moreover have \"ik\\<^sub>s\\<^sub>t \\<A>1 \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<subseteq> ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1d \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" using \\<A>1d(1) decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_ik_subset by auto\n    ultimately have *: \"\\<forall>t \\<in> set ts. ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1d \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile> t \\<cdot> \\<I>\"\n      using ideduct_mono by auto\n\n    have \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S> \\<A>\\<^sub>d\" by (rule wf\\<^sub>s\\<^sub>t\\<^sub>s'_decomp_rm[OF wa assms(4)])\n    hence **: \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} \\<A>1d\" by (rule pts_symbolic_c_preserves_wf_is[OF \\<A>1d(2) _ assms(5)])\n\n    have \"Ana_invar_subst (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t`\\<S>1) \\<union> (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1d) \\<union>\n                           (\\<Union>(assignment_rhs\\<^sub>s\\<^sub>t`\\<S>1) \\<union> (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1d)))\"\n      using tar \\<A>1d(2) pts_symbolic_c_preserves_Ana_invar_subst by metis\n    hence \"Ana_invar_subst (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1d)\" \"Ana_invar_subst (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1d)\"\n      using Ana_invar_subst_subset by blast+\n    moreover have \"well_analyzed \\<A>1d\"\n      using pts_symbolic_c_preserves_well_analyzed[OF \\<A>1d(2) wa] by metis\n    ultimately obtain D where D:\n        \"D \\<in> decomps\\<^sub>e\\<^sub>s\\<^sub>t (ik\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1d) (assignment_rhs\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1d) \\<I>\"\n        \"\\<forall>t \\<in> set ts. ik\\<^sub>e\\<^sub>s\\<^sub>t (\\<A>1d@D) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\"\n      using decomps\\<^sub>e\\<^sub>s\\<^sub>t_exist_subst_list[OF * \\<A>1d(3) ** assms(8)]\n      unfolding Ana_invar_subst_def by auto\n    \n    have \"(\\<S>, \\<A>\\<^sub>d) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>1, \\<A>1d@D)\" using \\<A>1d(2) decomps\\<^sub>e\\<^sub>s\\<^sub>t_pts_symbolic_c[OF D(1), of \\<S>1] by auto\n    hence \"(\\<S>, \\<A>\\<^sub>d) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>2, \\<A>1d@D@[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)])\"\n      using Receive(2) pts_symbolic_c.Receive[OF Receive.hyps(1), of \"\\<A>1d@D\"] by auto\n    moreover have \"\\<A>2 = to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t (\\<A>1d@D@[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)]))\"\n      using Receive.hyps(3) \\<A>1d(1) decomps\\<^sub>e\\<^sub>s\\<^sub>t_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_empty[OF D(1)]\n            decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append\n      by auto\n    moreover have \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> (\\<A>1d@D@[Step (send\\<langle>ts\\<rangle>\\<^sub>s\\<^sub>t)])\"\n      using D(2) sem\\<^sub>e\\<^sub>s\\<^sub>t_c.Send[OF sem\\<^sub>e\\<^sub>s\\<^sub>t_c_decomps\\<^sub>e\\<^sub>s\\<^sub>t_append[OF \\<A>1d(3) D(1)]] by simp\n    ultimately show ?case by auto\n  qed\nqed\n\nprivate lemma pts_symbolic_c_to_pts_symbolic:\n  assumes \"(\\<S>,\\<A>) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>',\\<A>')\" \"sem\\<^sub>e\\<^sub>s\\<^sub>t_c {} \\<I> \\<A>'\"\n  shows \"(\\<S>,to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>* (\\<S>',to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>'))\"\n        \"sem\\<^sub>e\\<^sub>s\\<^sub>t_d {} \\<I> (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>')\"\nproof -\n  show \"(\\<S>,to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>* (\\<S>',to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>'))\" using assms(1)\n  proof (induction rule: rtranclp_induct2)\n    case (step \\<S>1 \\<A>1 \\<S>2 \\<A>2) show ?case using step.hyps(2,1) step.IH\n    proof (induction rule: pts_symbolic_c_induct)\n      case Nil thus ?case\n        using pts_symbolic.Nil[OF Nil.hyps(1), of \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"] by simp\n    next\n      case (Send t S) thus ?case\n        using pts_symbolic.Send[OF Send.hyps(1), of \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"]\n        by (simp add: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append)\n    next\n      case (Receive t S) thus ?case\n        using pts_symbolic.Receive[OF Receive.hyps(1), of \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"] \n        by (simp add: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append)\n    next\n      case (Equality a t t' S) thus ?case\n        using pts_symbolic.Equality[OF Equality.hyps(1), of \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"] \n        by (simp add: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append)\n    next\n      case (Inequality t t' S) thus ?case\n        using pts_symbolic.Inequality[OF Inequality.hyps(1), of \"to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>1)\"] \n        by (simp add: decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append to_st_append)\n    next\n      case (Decompose t) thus ?case using decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_append by simp\n    qed\n  qed simp\nqed (rule sem\\<^sub>e\\<^sub>s\\<^sub>t_d_decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t_if_sem\\<^sub>e\\<^sub>s\\<^sub>t_c[OF assms(2)])\n\nprivate lemma pts_symbolic_to_pts_symbolic_c_from_initial:\n  assumes \"(\\<S>\\<^sub>0,[]) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>* (\\<S>,\\<A>)\" \"\\<I> \\<Turnstile> \\<langle>\\<A>\\<rangle>\" \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S>\\<^sub>0 []\"\n  and \"Ana_invar_subst (\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>\\<^sub>0) \\<union> \\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>\\<^sub>0))\" \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\"\n  shows \"\\<exists>\\<A>\\<^sub>d. \\<A> = to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d) \\<and> (\\<S>\\<^sub>0,[]) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>,\\<A>\\<^sub>d) \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>to_st \\<A>\\<^sub>d\\<rangle>)\"\nusing assms pts_symbolic_to_pts_symbolic_c[of \\<S>\\<^sub>0 \"[]\" \\<S> \\<A> \\<I>]\n      sem\\<^sub>e\\<^sub>s\\<^sub>t_c_eq_sem_st[of \"{}\" \\<I>] sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st[of \"{}\" \\<I>]\n      to_st_to_est_inv[of \\<A>] strand_sem_eq_defs\nby (auto simp add: constr_sem_c_def constr_sem_d_def simp del: subst_range.simps)\n\nprivate lemma pts_symbolic_c_to_pts_symbolic_from_initial:\n  assumes \"(\\<S>\\<^sub>0,[]) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>,\\<A>)\" \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>to_st \\<A>\\<rangle>\"\n  shows \"(\\<S>\\<^sub>0,[]) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>* (\\<S>,to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>))\" \"\\<I> \\<Turnstile> \\<langle>to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>)\\<rangle>\"\nusing assms pts_symbolic_c_to_pts_symbolic[of \\<S>\\<^sub>0 \"[]\" \\<S> \\<A> \\<I>]\n      sem\\<^sub>e\\<^sub>s\\<^sub>t_c_eq_sem_st[of \"{}\" \\<I>] sem\\<^sub>e\\<^sub>s\\<^sub>t_d_eq_sem_st[of \"{}\" \\<I>] strand_sem_eq_defs\nby (auto simp add: constr_sem_c_def constr_sem_d_def)\n\nprivate lemma to_st_trms_wf:\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t (to_st A))\"\nusing assms\nproof (induction A)\n  case (Cons x A)\n  hence IH: \"\\<forall>t \\<in> trms\\<^sub>s\\<^sub>t (to_st A). wf\\<^sub>t\\<^sub>r\\<^sub>m t\" by auto\n  with Cons show ?case\n  proof (cases x)\n    case (Decomp t)\n    hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using Cons.prems by auto\n    obtain K T where Ana_t: \"Ana t = (K,T)\" by moura\n    hence \"trms\\<^sub>s\\<^sub>t (decomp t) \\<subseteq> {t} \\<union> set K \\<union> set T\" using decomp_set_unfold[OF Ana_t] by force\n    moreover have \"\\<forall>t \\<in> set T. wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using Ana_subterm[OF Ana_t] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close> wf_trm_subterm by auto\n    ultimately have \"\\<forall>t \\<in> trms\\<^sub>s\\<^sub>t (decomp t). wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using Ana_keys_wf'[OF Ana_t] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close> by auto\n    thus ?thesis using IH Decomp by auto\n  qed auto\nqed simp\n\nprivate lemma to_st_trms_SMP_subset: \"trms\\<^sub>s\\<^sub>t (to_st A) \\<subseteq> SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\nproof\n  fix t assume \"t \\<in> trms\\<^sub>s\\<^sub>t (to_st A)\" thus \"t \\<in> SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n  proof (induction A)\n    case (Cons x A)\n    hence *: \"t \\<in> trms\\<^sub>s\\<^sub>t (to_st [x]) \\<union> trms\\<^sub>s\\<^sub>t (to_st A)\" using to_st_append[of \"[x]\" A] by auto\n    have **: \"trms\\<^sub>s\\<^sub>t (to_st A) \\<subseteq> trms\\<^sub>s\\<^sub>t (to_st (x#A))\" \"trms\\<^sub>e\\<^sub>s\\<^sub>t A \\<subseteq> trms\\<^sub>e\\<^sub>s\\<^sub>t (x#A)\"\n      using to_st_append[of \"[x]\" A] by auto\n    show ?case\n    proof (cases \"t \\<in> trms\\<^sub>s\\<^sub>t (to_st A)\")\n      case True thus ?thesis using Cons.IH SMP_mono[OF **(2)] by auto\n    next\n      case False\n      hence ***: \"t \\<in> trms\\<^sub>s\\<^sub>t (to_st [x])\" using * by auto\n      thus ?thesis\n      proof (cases x)\n        case (Decomp t')\n        hence ****: \"t \\<in> trms\\<^sub>s\\<^sub>t (decomp t')\" \"t' \\<in> trms\\<^sub>e\\<^sub>s\\<^sub>t (x#A)\" using *** by auto\n        obtain K T where Ana_t': \"Ana t' = (K,T)\" by moura\n        hence \"t \\<in> {t'} \\<union> set K \\<union> set T\" using decomp_set_unfold[OF Ana_t'] ****(1) by force\n        moreover\n        { assume \"t = t'\" hence ?thesis using SMP.MP[OF ****(2)] by simp }\n        moreover\n        { assume \"t \\<in> set K\" hence ?thesis using SMP.Ana[OF SMP.MP[OF ****(2)] Ana_t'] by auto }\n        moreover\n        { assume \"t \\<in> set T\" \"t \\<noteq> t'\"\n          hence \"t \\<sqsubset> t'\" using Ana_subterm[OF Ana_t'] by blast\n          hence ?thesis using SMP.Subterm[OF SMP.MP[OF ****(2)]] by auto\n        } \n        ultimately show ?thesis using Decomp by auto\n      qed auto\n    qed\n  qed simp\nqed\n\nprivate lemma to_st_trms_tfr\\<^sub>s\\<^sub>e\\<^sub>t:\n  assumes \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n  shows \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t (to_st A))\"\nproof -\n  have *: \"trms\\<^sub>s\\<^sub>t (to_st A) \\<subseteq> SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t A)\"\n    using to_st_trms_wf to_st_trms_SMP_subset assms unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by auto\n  have \"trms\\<^sub>s\\<^sub>t (to_st A) = trms\\<^sub>s\\<^sub>t (to_st A) \\<union> trms\\<^sub>e\\<^sub>s\\<^sub>t A\" by (blast dest!: trms\\<^sub>e\\<^sub>s\\<^sub>tD)\n  hence \"SMP (trms\\<^sub>e\\<^sub>s\\<^sub>t A) = SMP (trms\\<^sub>s\\<^sub>t (to_st A))\" using SMP_subset_union_eq[OF *] by auto\n  thus ?thesis using * assms unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by presburger\nqed\n\ntheorem wt_attack_if_tfr_attack_pts:\n  assumes \"wf\\<^sub>s\\<^sub>t\\<^sub>s \\<S>\\<^sub>0\" \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>\\<^sub>0))\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>\\<^sub>0))\" \"\\<forall>S \\<in> \\<S>\\<^sub>0. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n  and \"Ana_invar_subst (\\<Union>(ik\\<^sub>s\\<^sub>t ` dual\\<^sub>s\\<^sub>t ` \\<S>\\<^sub>0) \\<union> \\<Union>(assignment_rhs\\<^sub>s\\<^sub>t ` \\<S>\\<^sub>0))\"\n  and \"(\\<S>\\<^sub>0,[]) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>* (\\<S>,\\<A>)\" \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\" \"\\<I> \\<Turnstile> \\<langle>\\<A>, Var\\<rangle>\"\n  shows \"\\<exists>\\<I>\\<^sub>\\<tau>. interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau> \\<and> (\\<I>\\<^sub>\\<tau> \\<Turnstile> \\<langle>\\<A>, Var\\<rangle>) \\<and> wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau> \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<I>\\<^sub>\\<tau>)\"\nproof -\n  have \"(\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>\\<^sub>0)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t []) = \\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>\\<^sub>0)\" \"to_st [] = []\" \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p []\"\n    using assms by simp_all\n  hence *: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t ((\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>\\<^sub>0)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t []))\"\n           \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s ((\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>\\<^sub>0)) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t []))\"\n           \"wf\\<^sub>s\\<^sub>t\\<^sub>s' \\<S>\\<^sub>0 []\" \"\\<forall>S \\<in> \\<S>\\<^sub>0 \\<union> {to_st []}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n    using assms wf\\<^sub>s\\<^sub>t\\<^sub>s_wf\\<^sub>s\\<^sub>t\\<^sub>s' by (metis, metis, metis, simp)\n\n  obtain \\<A>\\<^sub>d where \\<A>\\<^sub>d: \"\\<A> = to_st (decomp_rm\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d)\" \"(\\<S>\\<^sub>0,[]) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sub>c\\<^sup>* (\\<S>,\\<A>\\<^sub>d)\" \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>to_st \\<A>\\<^sub>d\\<rangle>\"\n    using pts_symbolic_to_pts_symbolic_c_from_initial assms *(3) by metis\n  hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d))\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\<Union>(trms\\<^sub>s\\<^sub>t ` \\<S>) \\<union> (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d))\"\n    using pts_symbolic_c_preserves_tfr\\<^sub>s\\<^sub>e\\<^sub>t[OF _ *(1,2)] by blast+\n  hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d)\"\n    unfolding tfr\\<^sub>s\\<^sub>e\\<^sub>t_def by (metis DiffE DiffI SMP_union UnCI, metis UnCI)\n  hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t (to_st \\<A>\\<^sub>d))\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t (to_st \\<A>\\<^sub>d))\"\n    by (metis to_st_trms_tfr\\<^sub>s\\<^sub>e\\<^sub>t, metis to_st_trms_wf)\n  moreover have \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r (to_st \\<A>\\<^sub>d) Var\"\n  proof -\n    have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\" \"subst_domain Var \\<inter> vars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d = {}\"\n         \"range_vars Var \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d = {}\"\n      by (simp_all add: range_vars_alt_def)\n    moreover have \"wf\\<^sub>e\\<^sub>s\\<^sub>t {} \\<A>\\<^sub>d\"\n      using pts_symbolic_c_preserves_wf_is[OF \\<A>\\<^sub>d(2) *(3), of \"{}\"]\n      by auto\n    moreover have \"fv\\<^sub>s\\<^sub>t (to_st \\<A>\\<^sub>d) \\<inter> bvars\\<^sub>e\\<^sub>s\\<^sub>t \\<A>\\<^sub>d = {}\"\n      using pts_symbolic_c_preserves_constr_disj_vars[OF \\<A>\\<^sub>d(2)] assms(1) wf\\<^sub>s\\<^sub>t\\<^sub>s_wf\\<^sub>s\\<^sub>t\\<^sub>s'\n      by fastforce\n    ultimately show ?thesis unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by simp\n  qed\n  moreover have \"list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\<A>\\<^sub>d)\"\n    using pts_symbolic_c_preserves_tfr\\<^sub>s\\<^sub>t\\<^sub>p[OF \\<A>\\<^sub>d(2) *(4)] by blast\n  moreover have \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t Var\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\" by simp_all\n  ultimately obtain \\<I>\\<^sub>\\<tau> where \\<I>\\<^sub>\\<tau>:\n      \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau>\" \"\\<I>\\<^sub>\\<tau> \\<Turnstile>\\<^sub>c \\<langle>to_st \\<A>\\<^sub>d, Var\\<rangle>\" \"wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<I>\\<^sub>\\<tau>)\"\n    using wt_attack_if_tfr_attack[OF assms(7) \\<A>\\<^sub>d(3)]\n          \\<open>tfr\\<^sub>s\\<^sub>e\\<^sub>t (trms\\<^sub>s\\<^sub>t (to_st \\<A>\\<^sub>d))\\<close> \\<open>list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p (to_st \\<A>\\<^sub>d)\\<close>\n    unfolding tfr\\<^sub>s\\<^sub>t_def by metis\n  hence \"\\<I>\\<^sub>\\<tau> \\<Turnstile> \\<langle>\\<A>, Var\\<rangle>\" using pts_symbolic_c_to_pts_symbolic_from_initial \\<A>\\<^sub>d by metis\n  thus ?thesis using \\<I>\\<^sub>\\<tau>(1,3,4) by metis\nqed\n\n\nsubsubsection \\<open>Corollary: The Typing Result on the Level of Constraints\\<close>\ntext \\<open>There exists well-typed models of satisfiable type-flaw resistant constraints\\<close>\ncorollary wt_attack_if_tfr_attack_d:\n  assumes \"wf\\<^sub>s\\<^sub>t {} \\<A>\" \"fv\\<^sub>s\\<^sub>t \\<A> \\<inter> bvars\\<^sub>s\\<^sub>t \\<A> = {}\" \"tfr\\<^sub>s\\<^sub>t \\<A>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t \\<A>)\"\n  and \"Ana_invar_subst (ik\\<^sub>s\\<^sub>t \\<A> \\<union> assignment_rhs\\<^sub>s\\<^sub>t \\<A>)\"\n  and \"interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\" \"\\<I> \\<Turnstile> \\<langle>\\<A>\\<rangle>\"\n  shows \"\\<exists>\\<I>\\<^sub>\\<tau>. interpretation\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau> \\<and> (\\<I>\\<^sub>\\<tau> \\<Turnstile> \\<langle>\\<A>\\<rangle>) \\<and> wt\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<I>\\<^sub>\\<tau> \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<I>\\<^sub>\\<tau>)\"\nproof -\n  { fix S A have \"({S},A) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>* ({},A@dual\\<^sub>s\\<^sub>t S)\"\n    proof (induction S arbitrary: A)\n      case Nil thus ?case using pts_symbolic.Nil[of \"{[]}\"] by auto\n    next\n      case (Cons x S)\n      hence \"({S}, A@dual\\<^sub>s\\<^sub>t [x]) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>* ({}, A@dual\\<^sub>s\\<^sub>t (x#S))\"\n        by (metis dual\\<^sub>s\\<^sub>t_append List.append_assoc List.append_Nil List.append_Cons)\n      moreover have \"({x#S}, A) \\<Rightarrow>\\<^sup>\\<bullet> ({S}, A@dual\\<^sub>s\\<^sub>t [x])\"\n        using pts_symbolic.Send[of _ S \"{x#S}\"] pts_symbolic.Receive[of _ S \"{x#S}\"]\n              pts_symbolic.Equality[of _ _ _ S \"{x#S}\"] pts_symbolic.Inequality[of _ _ S \"{x#S}\"]\n        by (cases x) auto\n      ultimately show ?case by simp\n    qed\n  }\n  hence 0: \"({dual\\<^sub>s\\<^sub>t \\<A>},[]) \\<Rightarrow>\\<^sup>\\<bullet>\\<^sup>* ({},\\<A>)\" using dual\\<^sub>s\\<^sub>t_self_inverse by (metis List.append_Nil)\n\n  have \"fv\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t \\<A>) \\<inter> bvars\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t \\<A>) = {}\" using assms(2) dual\\<^sub>s\\<^sub>t_fv dual\\<^sub>s\\<^sub>t_bvars by metis+\n  hence 1: \"wf\\<^sub>s\\<^sub>t\\<^sub>s {dual\\<^sub>s\\<^sub>t \\<A>}\" using assms(1,2) dual\\<^sub>s\\<^sub>t_self_inverse[of \\<A>] unfolding wf\\<^sub>s\\<^sub>t\\<^sub>s_def by auto\n  \n  have \"\\<Union>(trms\\<^sub>s\\<^sub>t ` {\\<A>}) = trms\\<^sub>s\\<^sub>t \\<A>\" \"\\<Union>(trms\\<^sub>s\\<^sub>t ` {dual\\<^sub>s\\<^sub>t \\<A>}) = trms\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t \\<A>)\" by auto\n  hence \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (\\<Union>(trms\\<^sub>s\\<^sub>t ` {\\<A>}))\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\<Union>(trms\\<^sub>s\\<^sub>t ` {\\<A>}))\"\n        \"(\\<Union>(trms\\<^sub>s\\<^sub>t ` {\\<A>})) = \\<Union>(trms\\<^sub>s\\<^sub>t ` {dual\\<^sub>s\\<^sub>t \\<A>})\"\n    using assms(3,4) unfolding tfr\\<^sub>s\\<^sub>t_def\n    by (metis, metis, metis dual\\<^sub>s\\<^sub>t_trms_eq)\n  hence 2: \"tfr\\<^sub>s\\<^sub>e\\<^sub>t (\\<Union>(trms\\<^sub>s\\<^sub>t ` {dual\\<^sub>s\\<^sub>t \\<A>}))\" and 3: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (\\<Union>(trms\\<^sub>s\\<^sub>t ` {dual\\<^sub>s\\<^sub>t \\<A>}))\" by metis+\n\n  have 4: \"\\<forall>S \\<in> {dual\\<^sub>s\\<^sub>t \\<A>}. list_all tfr\\<^sub>s\\<^sub>t\\<^sub>p S\"\n    using dual\\<^sub>s\\<^sub>t_tfr\\<^sub>s\\<^sub>t\\<^sub>p assms(3) unfolding tfr\\<^sub>s\\<^sub>t_def by blast\n\n  have \"assignment_rhs\\<^sub>s\\<^sub>t \\<A> = assignment_rhs\\<^sub>s\\<^sub>t (dual\\<^sub>s\\<^sub>t \\<A>)\"\n    by (induct \\<A> rule: assignment_rhs\\<^sub>s\\<^sub>t.induct) auto\n  hence 5: \"Ana_invar_subst (\\<Union>(ik\\<^sub>s\\<^sub>t`dual\\<^sub>s\\<^sub>t`{dual\\<^sub>s\\<^sub>t \\<A>}) \\<union> \\<Union>(assignment_rhs\\<^sub>s\\<^sub>t`{dual\\<^sub>s\\<^sub>t \\<A>}))\"\n    using assms(5) dual\\<^sub>s\\<^sub>t_self_inverse[of \\<A>] by auto\n\n  show ?thesis by (rule wt_attack_if_tfr_attack_pts[OF 1 2 3 4 5 0 assms(6,7)])\nqed\n\nend\n\nend\n\nend\n\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Stateful_Protocol_Composition_and_Typing/Typing_Result.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.6224593312018546, "lm_q1q2_score": 0.3427306925058808}}
{"text": "(* Author: Andrew Boyton, 2012\n   Maintainers: Gerwin Klein <kleing at cse.unsw.edu.au>\n                Rafal Kolanski <rafal.kolanski at nicta.com.au>\n*)\n\nsection \"A simplified version of the actual capDL specification.\"\n\ntheory Types_D\nimports \"HOL-Word.Word\"\nbegin\n\n(*\n * Objects are named by 32 bit words. \n * This name may correspond to the memory address of the object.\n *)\ntype_synonym cdl_object_id = \"32 word\"\n\ntype_synonym cdl_object_set = \"cdl_object_id set\"\n\n(* The type we use to represent object sizes. *)\ntype_synonym cdl_size_bits = nat\n\n(* An index into a CNode, TCB, or other kernel object that contains caps. *)\ntype_synonym cdl_cnode_index = nat\n\n(* A reference to a capability slot. *)\ntype_synonym cdl_cap_ref = \"cdl_object_id \\<times> cdl_cnode_index\"\n\n(* The possible access-control rights that exist in the system. *)\ndatatype cdl_right = AllowRead | AllowWrite | AllowGrant\n\n\n(*\n * Kernel capabilities.\n *\n * Such capabilities (or \"caps\") give the holder particular rights to\n * a kernel object or system hardware.\n *\n * Caps have attributes such as the object they point to, the rights\n * they give the holder, or how the holder is allowed to interact with\n * the target object.\n *\n * This is a simplified, cut-down version of this datatype for \n * demonstration purposes.\n *)\ndatatype cdl_cap =\n    NullCap\n  | EndpointCap cdl_object_id \"cdl_right set\"\n  | CNodeCap cdl_object_id\n  | TcbCap cdl_object_id\n\n(* A mapping from capability identifiers to capabilities. *)\ntype_synonym cdl_cap_map = \"cdl_cnode_index \\<Rightarrow> cdl_cap option\"\n\ntranslations\n  (type) \"cdl_cap_map\" <= (type) \"nat \\<Rightarrow> cdl_cap option\"\n  (type) \"cdl_cap_ref\" <= (type) \"cdl_object_id \\<times> nat\"\n\n(* A user cap pointer. *)\ntype_synonym cdl_cptr = \"32 word\"\n\n(* Kernel objects *)\nrecord cdl_tcb =\n  cdl_tcb_caps :: cdl_cap_map\n  cdl_tcb_fault_endpoint :: cdl_cptr\n\nrecord cdl_cnode =\n  cdl_cnode_caps :: cdl_cap_map\n  cdl_cnode_size_bits :: cdl_size_bits\n\n(*\n * Kernel objects.\n *\n * These are in-memory objects that may, over the course of the system\n * execution, be created or deleted by users.\n *\n * Again, a simplified version of the real datatype.\n *)\ndatatype cdl_object =\n    Endpoint\n  | Tcb cdl_tcb\n  | CNode cdl_cnode\n\n(*\n * The current state of the system.\n *\n * The state record contains the following primary pieces of information:\n *\n * objects:\n *   The objects that currently exist in the system.\n *\n * current_thread:\n *   The currently running thread. Operations will always be performed\n *   on behalf of this thread.\n *\n * ghost_state: (Used for separation logic)\n *   Which fields are owned by an object.\n *   In capDL this is all of the fields (or none of them).\n *   In any concrete state, this will be all of the fields.\n *)\n\n\n(* The ghost state tracks which components (fields and slots) are owned by an object.\n * Fields + slots are encoded as None + Some nat.\n *)\ntype_synonym cdl_heap = \"cdl_object_id \\<Rightarrow> cdl_object option\"\ntype_synonym cdl_component  = \"nat option\"\ntype_synonym cdl_components = \"cdl_component set\"\ntype_synonym cdl_ghost_state = \"cdl_object_id \\<Rightarrow> cdl_components\"\n\ntranslations\n  (type) \"cdl_heap\" <= (type) \"cdl_object_id \\<Rightarrow> cdl_object option\"\n  (type) \"cdl_ghost_state\" <= (type) \"cdl_object_id \\<Rightarrow> nat option set\"\n\nrecord cdl_state =\n  cdl_objects :: \"cdl_heap\"\n  cdl_current_thread :: \"cdl_object_id option\"\n  cdl_ghost_state :: \"cdl_ghost_state\"\n\n\n(* Kernel objects types. *)\ndatatype cdl_object_type =\n    EndpointType\n  | TcbType\n  | CNodeType\n\n(* Return the type of an object. *)\ndefinition\n  object_type :: \"cdl_object \\<Rightarrow> cdl_object_type\"\nwhere\n  \"object_type x \\<equiv>\n    case x of\n        Endpoint \\<Rightarrow> EndpointType\n      | Tcb _ \\<Rightarrow> TcbType\n      | CNode _ \\<Rightarrow> CNodeType\"\n\n(*\n * Getters and setters for various data types.\n *)\n\n(* Capability getters / setters *)\n\ndefinition cap_objects :: \"cdl_cap \\<Rightarrow> cdl_object_id set\"\nwhere\n    \"cap_objects cap \\<equiv> \n       case cap of\n           TcbCap x \\<Rightarrow> {x}\n         | CNodeCap x \\<Rightarrow> {x}\n         | EndpointCap x _ \\<Rightarrow> {x}\"\n\ndefinition cap_has_object :: \"cdl_cap \\<Rightarrow> bool\"\nwhere\n    \"cap_has_object cap \\<equiv> \n       case cap of\n           NullCap          \\<Rightarrow> False\n         | _                \\<Rightarrow> True\"\n\ndefinition cap_object :: \"cdl_cap \\<Rightarrow> cdl_object_id\"\nwhere\n    \"cap_object cap \\<equiv> \n       if cap_has_object cap \n         then THE obj_id. cap_objects cap = {obj_id}\n         else undefined \"\n\nlemma cap_object_simps:\n  \"cap_object (TcbCap x) = x\"\n  \"cap_object (CNodeCap x) = x\"\n  \"cap_object (EndpointCap x j) = x\"\n  by (simp_all add:cap_object_def cap_objects_def cap_has_object_def)\n\ndefinition\n  cap_rights :: \"cdl_cap \\<Rightarrow> cdl_right set\"\nwhere\n  \"cap_rights c \\<equiv> case c of\n      EndpointCap _ x \\<Rightarrow> x\n    | _ \\<Rightarrow> UNIV\"\n\ndefinition\n  update_cap_rights :: \"cdl_right set \\<Rightarrow> cdl_cap \\<Rightarrow> cdl_cap\"\nwhere\n  \"update_cap_rights r c \\<equiv> case c of\n      EndpointCap f1 _ \\<Rightarrow> EndpointCap f1 r\n    | _ \\<Rightarrow> c\"\n\n(* Kernel object getters / setters *)\ndefinition\n  object_slots :: \"cdl_object \\<Rightarrow> cdl_cap_map\"\nwhere\n  \"object_slots obj \\<equiv> case obj of\n    CNode x \\<Rightarrow> cdl_cnode_caps x\n  | Tcb x \\<Rightarrow> cdl_tcb_caps x\n  | _ \\<Rightarrow> Map.empty\"\n\ndefinition\n  update_slots :: \"cdl_cap_map \\<Rightarrow> cdl_object \\<Rightarrow> cdl_object\"\nwhere\n  \"update_slots new_val obj \\<equiv> case obj of\n    CNode x \\<Rightarrow> CNode (x\\<lparr>cdl_cnode_caps := new_val\\<rparr>)\n  | Tcb x \\<Rightarrow> Tcb (x\\<lparr>cdl_tcb_caps := new_val\\<rparr>)\n  | _ \\<Rightarrow> obj\"\n\n(* Adds new caps to an object. It won't overwrite on a collision. *)\ndefinition\n  add_to_slots :: \"cdl_cap_map \\<Rightarrow> cdl_object \\<Rightarrow> cdl_object\"\nwhere\n  \"add_to_slots new_val obj \\<equiv> update_slots (new_val ++ (object_slots obj)) obj\"\n\ndefinition\n  slots_of :: \"cdl_heap \\<Rightarrow> cdl_object_id \\<Rightarrow> cdl_cap_map\"\nwhere\n  \"slots_of h \\<equiv> \\<lambda>obj_id. \n  case h obj_id of \n    None \\<Rightarrow> Map.empty \n  | Some obj \\<Rightarrow> object_slots obj\"\n\n\ndefinition\n  has_slots :: \"cdl_object \\<Rightarrow> bool\"\nwhere\n  \"has_slots obj \\<equiv> case obj of\n    CNode _ \\<Rightarrow> True\n  | Tcb _ \\<Rightarrow> True\n  | _ \\<Rightarrow> False\"\n\ndefinition\n  object_at :: \"(cdl_object \\<Rightarrow> bool) \\<Rightarrow> cdl_object_id \\<Rightarrow> cdl_heap \\<Rightarrow> bool\"\nwhere\n  \"object_at P p s \\<equiv> \\<exists>object. s p = Some object \\<and> P object\"\n\nabbreviation\n  \"ko_at k \\<equiv> object_at ((=) k)\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Separation_Algebra/ex/capDL/Types_D.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6959583124210896, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3425424243299271}}
{"text": "theory flash96Bra  imports flash96Rev\n \n  begin\nlemma onInv96:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv96 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv96 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv96 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash96Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.749087201911703, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.34243526409941055}}
{"text": "theory \"ConstantMemory\" \n\nimports \n   \"InstructionAux\" \"../../ProgramInAvl\"\n\nbegin\n\ndeclare stack_1_1_op_def [simp del]\ndeclare jump_def [simp del]\n(* declare cut_memory.simps [simp del] *)\n\ntheorem lemma_stack_2_1_op :\n\"stack_2_1_op v c f = InstructionContinue nv \\<Longrightarrow>\n vctx_memory v = vctx_memory nv\"\napply(auto simp:stack_2_1_op_def)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto split:option.split)\ndone\n\ntheorem lemma_stack_3_1_op :\n\"stack_3_1_op v c f = InstructionContinue nv \\<Longrightarrow>\n vctx_memory v = vctx_memory nv\"\napply(auto simp:stack_3_1_op_def)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply auto\napply(cases \"tl (tl (vctx_stack v))\")\napply auto\ndone\n\ntheorem lemma_stack_1_1_op :\n\"stack_1_1_op v c f = InstructionContinue nv \\<Longrightarrow>\n vctx_memory v = vctx_memory nv\"\napply(auto simp:stack_1_1_op_def)\napply(cases \"vctx_stack v\")\napply(auto split:option.split)\ndone\n\ntheorem lemma_jump [simp] :\n\"jump v c = InstructionContinue nv \\<Longrightarrow>\n vctx_memory v = vctx_memory nv\"\napply(auto simp:jump_def)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"vctx_next_instruction\n   (v\\<lparr>vctx_stack := tl (vctx_stack v), vctx_pc := unat (hd (vctx_stack v))\\<rparr>) c\")\napply(auto)\napply(cases \"get_some (vctx_next_instruction\n   (v\\<lparr>vctx_stack := tl (vctx_stack v), vctx_pc := unat (hd (vctx_stack v))\\<rparr>) c)\")\napply(auto)\napply(cases \"get_pc (vctx_next_instruction\n   (v\\<lparr>vctx_stack := tl (vctx_stack v), vctx_pc := unat (hd (vctx_stack v))\\<rparr>) c)\")\napply(auto)\ndone\n\ntheorem lemma_jump_foo [simp] :\n\"jump (v\\<lparr>vctx_stack:=x\\<rparr>) c = InstructionContinue nv \\<Longrightarrow>\n vctx_memory v = vctx_memory nv\"\napply(auto simp:jump_def)\napply(cases \"x\")\napply(auto)\napply(cases \"vctx_next_instruction\n   (v\\<lparr>vctx_stack := tl x, vctx_pc := unat (hd x)\\<rparr>) c\")\napply(auto)\napply(cases \"get_some (vctx_next_instruction\n   (v\\<lparr>vctx_stack := tl x, vctx_pc := unat (hd x)\\<rparr>) c)\")\napply(auto)\napply(cases \"get_pc (vctx_next_instruction\n   (v\\<lparr>vctx_stack := tl x, vctx_pc := unat (hd x)\\<rparr>) c)\")\napply(auto)\ndone\n\ntheorem lemma_pop_stack [simp] :\n\"vctx_memory v = vctx_memory (vctx_pop_stack n v)\"\napply(auto)\ndone\n\ntheorem lemma_update_storage [simp] :\n\"vctx_memory v = vctx_memory (vctx_update_storage a aa v)\"\napply(auto)\ndone\n\nlemma lemma_subtract : \n  \"subtract_gas x (InstructionContinue v) = InstructionContinue nv \\<Longrightarrow>\n   vctx_memory v = vctx_memory nv\"\napply auto\ndone\n\ndeclare instruction_aux_def [simp]\n\ntheorem no_modify_memory_aux :\n  \"inst \\<noteq> Memory MSTORE \\<Longrightarrow>\n   inst \\<noteq> Memory MSTORE8 \\<Longrightarrow>\n   inst \\<noteq> Memory CALLDATACOPY \\<Longrightarrow>\n   inst \\<noteq> Memory CODECOPY \\<Longrightarrow>\n   inst \\<noteq> Memory EXTCODECOPY \\<Longrightarrow>\n   instruction_aux v c inst = InstructionContinue nv \\<Longrightarrow>\n   vctx_memory v = vctx_memory nv\"\napply(cases inst)\n\napply(auto)\n(* apply(auto simp:lemma_subtract) *)\n\napply(cases \"get_bits (Some inst)\",\n   auto simp:lemma_stack_2_1_op lemma_stack_3_1_op lemma_stack_1_1_op)\napply(cases \"get_sarith (Some inst)\",\n   auto simp:lemma_stack_2_1_op lemma_stack_3_1_op lemma_stack_1_1_op)\napply(cases \"get_arith (Some inst)\",\n   auto simp:lemma_stack_2_1_op lemma_stack_3_1_op lemma_stack_1_1_op)\n\napply(auto simp:sha3_def)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"get_info (Some inst)\")\napply(auto simp:lemma_stack_2_1_op lemma_stack_3_1_op lemma_stack_1_1_op\n  split:option.split)\napply(cases \"index (vctx_stack v)\n              (nat (uint (get_dup (Some inst))))\")\napply(auto split:option.split)\napply(cases \"get_memory (Some inst)\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto split:option.split)\napply(cases \"get_storage (Some inst)\")\napply(auto simp:lemma_stack_1_1_op)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto simp:strict_if_def split:option.split)\napply(cases \"get_pc (Some inst)\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto simp:strict_if_def split:option.split)\napply(cases \"hd (tl (vctx_stack v)) = 0\")\napply(auto)\napply(cases \"get_stack inst\")\napply(auto simp:lemma_stack_1_1_op)\napply(cases \"vctx_stack v\")\napply(auto split:option.split)\napply(cases \"index (vctx_stack v)\n              (nat (uint (get_swap (Some inst))))\")\napply(auto split:option.split)\napply(cases \"index (vctx_stack v) (Suc (nat (uint (get_swap (Some inst)))))\")\napply(auto split:option.split)\napply(cases \"index (vctx_stack v) 0\")\napply(auto split:option.split)\n\napply(cases \"get_log (Some inst)\")\napply(auto simp:log_def split:option.split)\napply(cases \"get_misc (Some inst)\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"tl (tl (vctx_stack v))\")\napply(simp)\napply(cases \"vctx_balance v (cctx_this c) < hd (vctx_stack v)\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(simp)\napply(cases \"tl (vctx_stack v)\")\napply(simp)\napply(cases \"tl (tl (vctx_stack v))\")\napply(simp)\napply(cases \"tl (tl (tl (vctx_stack v)))\")\napply(simp)\napply(cases \"tl (tl (tl (tl (vctx_stack v))))\")\napply(simp)\napply(cases \"tl (tl (tl (tl (tl (vctx_stack v)))))\")\napply(simp)\napply(cases \"tl (tl (tl (tl (tl (tl (vctx_stack v))))))\")\napply(auto)\napply(cases \"vctx_balance v (cctx_this c) <\n    hd (tl (tl (vctx_stack v)))\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"tl (tl (vctx_stack v))\")\napply(auto)\napply(cases \"tl (tl (tl (vctx_stack v)))\")\napply(auto)\napply(cases \"tl (tl (tl (tl (vctx_stack v))))\")\napply(auto)\napply(cases \"tl (tl (tl (tl (tl (vctx_stack v)))))\")\napply(auto)\napply(cases \"tl (tl (tl (tl (tl (tl (vctx_stack v))))))\")\napply(auto)\napply(cases \"vctx_balance v (cctx_this c) <\n    hd (tl (tl (vctx_stack v)))\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"tl (tl (vctx_stack v))\")\napply(auto)\napply(cases \"tl (tl (tl (vctx_stack v)))\")\napply(auto)\napply(cases \"tl (tl (tl (tl (vctx_stack v))))\")\napply(auto)\napply(cases \"tl (tl (tl (tl (tl (vctx_stack v)))))\")\napply(auto)\napply(cases \"vctx_balance v (cctx_this c) <\n    vctx_value_sent v\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\ndone\n\nlemma no_modify_memory :\n  \"inst \\<noteq> Memory MSTORE \\<Longrightarrow>\n   inst \\<noteq> Memory MSTORE8 \\<Longrightarrow>\n   inst \\<noteq> Memory CALLDATACOPY \\<Longrightarrow>\n   inst \\<noteq> Memory CODECOPY \\<Longrightarrow>\n   inst \\<noteq> Memory EXTCODECOPY \\<Longrightarrow>\n   instruction_sem v c inst = InstructionContinue nv \\<Longrightarrow>\n   vctx_memory v = vctx_memory nv\"\napply(subst (asm) inst_gas)\napply(cases \"instruction_aux v c inst\")\ndefer\napply(simp)\napply(simp)\n  by (metis lemma_subtract no_modify_memory_aux)\n\nend\n\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/example/termination/ConstantMemory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.749087201911703, "lm_q2_score": 0.45713671682749474, "lm_q1q2_score": 0.34243526409941055}}
{"text": "chapter \\<open>Congruence Closure Algorithm with Explain Operation\\<close>\ntheory CC_Definition2\n  imports CC_Explain_Helper_Lemmata\nbegin \n\ntext \\<open>We extend the congruence closure data structure with timestamps for the edges,\nwhich tell us in which order the edges were added. \\<close>\n\nrecord congruence_closure_t =\n  congruence_closure + \n  time :: \"nat\"\n  timestamps :: \"nat list\" \n\ntext \\<open>Implementation of the timestamps\\<close>\n\nfunction (domintros) add_timestamp :: \"nat list \\<Rightarrow> nat list \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat list\"\n  where\n\"add_timestamp pf ti e e' k = \n(if pf ! e = e then (ti[e := k]) else add_timestamp (pf[e := e']) (ti[e := k]) (pf ! e) e (ti ! e))\"\n  by pat_completeness auto\n\nlemma add_timestamp_dom_if_add_edge_dom:\n   \"add_edge_dom (pf, e, e') \\<longleftrightarrow> add_timestamp_dom (pf, ti, e, e', k)\"\nproof\n  show \"add_edge_dom (pf, e, e') \\<Longrightarrow> add_timestamp_dom (pf, ti, e, e', k)\"\n    apply(induction arbitrary: ti k rule: add_edge.pinduct)\n    using add_timestamp.domintros by blast\n  show \"add_timestamp_dom (pf, ti, e, e', k) \\<Longrightarrow> add_edge_dom (pf, e, e')\"\n    apply(induction arbitrary: ti k rule: add_timestamp.pinduct)\n    using add_edge.domintros by blast\nqed\n\nlemma add_timestamp_domain: \n  assumes \"ufa_invar l\" \"y < length l\" \"y' < length l\" \"rep_of l y \\<noteq> rep_of l y'\"\n  shows \"add_timestamp_dom (l, ti, y, y', k)\"\n  using add_edge_domain add_timestamp_dom_if_add_edge_dom assms by auto\n\nabbreviation propagate_step_t\n  where \n    \"propagate_step_t l u t pe pf pfl ip a b eq k ti \\<equiv>\n congruence_closure.extend (propagate_step l u t pe pf pfl ip a b eq)\n    \\<lparr>time = k + 1,\n    timestamps = add_timestamp pf ti a b k\\<rparr>\"\n\nfunction (domintros) propagate_t :: \"congruence_closure_t \\<Rightarrow> congruence_closure_t\"\n  where\n    \"propagate_t cc = \n(let l = cc_list cc;\nu = use_list cc;\nt = lookup cc;\npe = pending cc;\npf = proof_forest cc;\npfl = pf_labels cc;\nip = input cc;\nk = time cc;\nti = timestamps cc\n in (case pe of \n[] \\<Rightarrow> cc |\neq # pe \\<Rightarrow>\n(let a = left eq; b = right eq in\n  (if rep_of l a = rep_of l b \n    then propagate_t \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf, \nf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr>\n    else\n      propagate_t (propagate_step_t l u t pe pf pfl ip a b eq k ti)\n))))\"\n  by pat_completeness auto\n\nlemma propagate_t_simps1[simp]:\n  assumes \"propagate_t_dom cc\"\n    \"pending cc = []\"\n  shows \"propagate_t cc = cc\"\n  using assms propagate_t.psimps by fastforce\n\nlemma propagate_t_simps2[simp]:\n  assumes \"propagate_t_dom \\<lparr>cc_list = l, use_list = u, lookup = t, pending = (eq # pe), \nproof_forest = pf, pf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr>\"\n    \"rep_of l (left eq) = rep_of l (right eq)\"\n  shows \"propagate_t \n\\<lparr>cc_list = l, use_list = u, lookup = t, pending = (eq # pe), proof_forest = pf, pf_labels = pfl, \ninput = ip, time = k, timestamps = ti\\<rparr>\n = propagate_t \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf, \npf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr>\"\n  using assms propagate_t.psimps unfolding Let_def Case_def by auto\n\nlemma propagate_simps3[simp]:\n  assumes \"propagate_t_dom \\<lparr>cc_list = l, use_list = u, lookup = t, pending = (eq # pe), \nproof_forest = pf, pf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr>\"\n    \"rep_of l (left eq) \\<noteq> rep_of l (right eq)\"\n  shows \"propagate_t \n\\<lparr>cc_list = l, use_list = u, lookup = t, pending = (eq # pe), proof_forest = pf, pf_labels = pfl, \ninput = ip, time = k, timestamps = ti\\<rparr>\n = propagate_t (propagate_step_t l u t pe pf pfl ip (left eq) (right eq) eq k ti)\"\n  using assms propagate_t.psimps unfolding Let_def Case_def by auto\n\nfun merge_t :: \"congruence_closure_t \\<Rightarrow> equation \\<Rightarrow> congruence_closure_t\"\n  where \n    \"merge_t cc\n(a \\<approx> b) =\n(let l = cc_list cc;\nu = use_list cc;\nt = lookup cc;\npe = pending cc;\npf = proof_forest cc;\npfl = pf_labels cc;\nip = input cc;\nk = time cc;\nti = timestamps cc\n in \n  propagate_t \n    \\<lparr>cc_list = l, use_list = u, lookup = t, pending = One (a \\<approx> b)#pe, \nproof_forest = pf, pf_labels = pfl, input = insert (a \\<approx> b) ip, time = k, timestamps = ti\\<rparr>)\"\n\n| \"merge_t cc \n(F a\\<^sub>1 a\\<^sub>2 \\<approx> a) =\n(let l = cc_list cc;\nu = use_list cc;\nt = lookup cc;\npe = pending cc;\npf = proof_forest cc;\npfl = pf_labels cc;\nip = input cc;\nk = time cc;\nti = timestamps cc\n in \n(if (lookup_Some t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a))\n  then propagate_t \\<lparr>cc_list = l, use_list = u, lookup = t, \n            pending = link_to_lookup t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)#pe, proof_forest = pf, pf_labels = pfl, \ninput = insert (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) ip, time = k, timestamps = ti\\<rparr>\n  else \\<lparr>cc_list = l, \n          use_list = (u[rep_of l a\\<^sub>1 := (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)#(u ! rep_of l a\\<^sub>1)])[rep_of l a\\<^sub>2 := (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)#(u ! rep_of l a\\<^sub>2)], \n          lookup = update_lookup t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a), \n          pending = pe, proof_forest = pf, pf_labels = pfl, input = insert (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) ip, \n          time = k, timestamps = ti\\<rparr>)\n)\"\n\ntext \\<open>For the initialisation of the congruence closure algorithm.\\<close>\nabbreviation \n  \"initial_cc_t n \\<equiv> congruence_closure.extend \n(initial_cc n) \\<lparr>time = 0, timestamps = replicate n 0\\<rparr>\"\n\nlemma propagate_step_propagate_step_t_equivalence:\n  \"propagate_step l u t pe pf pfl ip a b eq = \ncongruence_closure.truncate (propagate_step_t l u t pe pf pfl ip a b eq k ti)\" \n  unfolding congruence_closure.truncate_def congruence_closure.extend_def \n  by simp\n\nthm propagate_step_propagate_step_t_equivalence[of l b u a t pe pf pfl eq ip]\nlemma propagate_propagate_t_domain:\n  shows \"propagate_dom cc =\npropagate_t_dom (congruence_closure.extend cc\n\\<lparr>time = k, timestamps = ti\\<rparr>)\"\nproof\n  show \"propagate_dom cc \n\\<Longrightarrow> propagate_t_dom (congruence_closure.extend cc \\<lparr>time = k, timestamps = ti\\<rparr>)\"\n  proof(induction cc arbitrary: k ti rule: propagate.pinduct)\n    case (1 l u t pf pfl ip)\n    then show ?case using propagate_t.domintros unfolding congruence_closure.extend_def \n        congruence_closure.select_convs \n      by (metis congruence_closure.select_convs(4) list.discI)\n  next\n    case (2 l u t eq pe pf pfl ip)\n    then show ?case  \n    proof(cases \"rep_of l (left eq) = rep_of l (right eq)\")\n      case True\n      then have \"propagate_t_dom\n     (congruence_closure.extend\n       \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf, pf_labels = pfl, input = ip\\<rparr>\n       \\<lparr>time = k, timestamps = ti\\<rparr>)\" \n        using \"2.IH\"(1) by blast\n      then show ?thesis using propagate_t.domintros True unfolding congruence_closure.extend_def \n          congruence_closure.select_convs congruence_closure_t.select_convs \n        by (smt (verit) congruence_closure.select_convs(1) congruence_closure.select_convs(2) congruence_closure.select_convs(3) congruence_closure.select_convs(4) congruence_closure.select_convs(5) congruence_closure.select_convs(6) congruence_closure.select_convs(7) congruence_closure_t.select_convs(1) congruence_closure_t.select_convs(2) list_tail_coinc)\n    next\n      case False   \n      then have \"propagate_t_dom\n     (congruence_closure.extend (propagate_step l u t pe pf pfl ip (left eq) (right eq) eq) \n\\<lparr>time = k, timestamps = ti\\<rparr>)\" \n        using \"2.IH\"(2) by blast\n      then show ?thesis using propagate_t.domintros False unfolding congruence_closure.extend_def \n          congruence_closure.select_convs congruence_closure_t.select_convs \n        by (smt (verit) \"2.IH\"(2) congruence_closure.select_convs(1) congruence_closure.select_convs(2) congruence_closure.select_convs(3) congruence_closure.select_convs(4) congruence_closure.select_convs(5) congruence_closure.select_convs(6) congruence_closure.select_convs(7) list_tail_coinc propagate_t.domintros)   \n    qed\n  qed\nnext\n  obtain cc_l u t pe pf pfl ip where cc: \"cc = \n\\<lparr>cc_list = cc_l, use_list = u, lookup = t, pending = pe, proof_forest = pf, pf_labels = pfl,\n         input = ip\\<rparr>\" using congruence_closure.cases by blast\n  assume \"propagate_t_dom (congruence_closure.extend cc \\<lparr>time = k, timestamps = ti\\<rparr>) \"\n  then show \"propagate_dom cc\"\n    using cc proof(induction \"(congruence_closure.extend cc \\<lparr>time = k, timestamps = ti\\<rparr>)\" \n      arbitrary: cc k ti cc_l u t pe pf pfl ip rule: propagate_t.pinduct)\n    case 1\n    then show ?case proof(cases pe)\n      case Nil\n      then show ?thesis using 1(4) propagate.domintros \n        by auto\n    next\n      case (Cons eq list)\n      then show ?thesis proof(cases \"rep_of cc_l (left eq) = rep_of cc_l (right eq)\")\n        case True\n        have \"propagate_dom\n      \\<lparr>cc_list = cc_l, use_list = u, lookup = t, pending = list, proof_forest = pf, pf_labels = pfl,\n         input = ip\\<rparr>\" using 1(2) Cons True\n          unfolding 1(4) congruence_closure.extend_def congruence_closure.select_convs \n            congruence_closure_t.select_convs by simp\n        then show ?thesis \n          using 1(4) propagate.domintros True Cons by blast\n      next\n        case False\n        have \"propagate_dom\n      (propagate_step cc_l u t list pf pfl ip (left eq) (right eq) eq)\" \n          using 1(3)[of cc_l u t pe pf pfl ip k ti eq list \"left eq\" \"right eq\"] Cons False\n          unfolding 1(4) congruence_closure.extend_def congruence_closure.select_convs \n            congruence_closure_t.select_convs \n          by (smt (verit) congruence_closure.surjective old.unit.exhaust)\n        then show ?thesis \n          using 1(4) propagate.domintros False Cons by blast\n      qed\n    qed\n  qed\nqed\n\nlemma propagate_propagate_t_equivalence:\n  assumes \"cc_invar cc\"\n    \"nr_vars cc > 0\"\n  shows \"propagate cc =\ncongruence_closure.truncate (propagate_t (congruence_closure.extend cc \n\\<lparr>time = k, timestamps = ti\\<rparr>))\" \nproof-\n  have \"propagate_dom cc\" using propagate_domain assms by auto\n  then show ?thesis \n  proof(induction arbitrary: k ti rule: propagate.pinduct)\n    case (1 l u t pf pfl ip)\n    then have t_dom: \"propagate_t_dom\n        \\<lparr>cc_list = l, use_list = u, lookup = t, pending = [], proof_forest = pf,\n               pf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr>\" \n      using propagate_propagate_t_domain[of \" \\<lparr>cc_list = l, use_list = u, lookup = t, pending = [], proof_forest = pf,\n               pf_labels = pfl, input = ip\\<rparr>\"] unfolding congruence_closure.extend_def \n      by simp\n    show ?case \n      unfolding propagate.psimps(1)[OF 1] propagate_t.psimps(1)[OF t_dom]\n        Let_def congruence_closure.select_convs \n        congruence_closure.extend_def congruence_closure.truncate_def \n        congruence_closure_t.select_convs\n      by force\n  next\n    case (2 l u t eq pe pf pfl ip)\n    then have t_dom: \"propagate_t_dom\n      \\<lparr>cc_list = l, use_list = u, lookup = t, pending = eq # pe, proof_forest = pf,\n            pf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr>\" \n      using propagate_propagate_t_domain[of \"\\<lparr>cc_list = l, use_list = u, lookup = t, pending = eq # pe, proof_forest = pf,\n            pf_labels = pfl, input = ip\\<rparr>\"] unfolding congruence_closure.extend_def \n      by simp\n    show ?case \n    proof(cases \"rep_of l (left eq) = rep_of l (right eq)\")\n      case True\n      have IH: \"propagate\n     \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf, pf_labels = pfl,\n        input = ip\\<rparr> =\n    congruence_closure.truncate\n     (propagate_t\n       (congruence_closure.extend\n         \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf,\n            pf_labels = pfl, input = ip\\<rparr>\n         \\<lparr>time = k, timestamps = ti\\<rparr>))\" using 2 True by blast\n      then show ?thesis unfolding propagate.psimps(2)[OF 2(1)] propagate_t.psimps[OF t_dom]\n          Let_def congruence_closure.select_convs \n          congruence_closure.extend_def congruence_closure.truncate_def \n          congruence_closure_t.select_convs \n        using True by force\n    next\n      case False\n      then have IH: \"propagate (propagate_step l u t pe pf pfl ip (left eq) (right eq) eq) =\n    congruence_closure.truncate\n     (propagate_t\n       (congruence_closure.extend (propagate_step l u t pe pf pfl ip (left eq) (right eq) eq)\n         \\<lparr>time = k, timestamps = ti\\<rparr>))\" using 2 False by blast\n      have *:\"(propagate_t\n       (congruence_closure.extend\n         \\<lparr>cc_list = l, use_list = u, lookup = t, pending = eq # pe, proof_forest = pf,\n            pf_labels = pfl, input = ip\\<rparr>\n         \\<lparr>time = k, timestamps = ti\\<rparr>)) = \npropagate_t (propagate_step_t l u t pe pf pfl ip (left eq) (right eq) eq k ti)\n\\<and> (propagate\n         \\<lparr>cc_list = l, use_list = u, lookup = t, pending = eq # pe, proof_forest = pf,\n            pf_labels = pfl, input = ip\\<rparr> = \npropagate (propagate_step l u t pe pf pfl ip (left eq) (right eq) eq))\"\n        unfolding propagate.psimps(2)[OF 2(1)] propagate_t.psimps[OF t_dom] \n          Let_def congruence_closure.extend_def congruence_closure.select_convs\n        using False by simp\n      have \"(propagate_step l u t pe pf pfl ip (left eq) (right eq) eq) =\ncongruence_closure.truncate (propagate_step_t l u t pe pf pfl ip (left eq) (right eq) eq k ti)\"\n        using False IH\n          propagate_step_propagate_step_t_equivalence \n        by fast\n      then have \"propagate (propagate_step l u t pe pf pfl ip (left eq) (right eq) eq) =\n    congruence_closure.truncate\n     (propagate_t (propagate_step_t l u t pe pf pfl ip (left eq) (right eq) eq k ti))\"\n        using \"2.IH\"(2) False by blast\n      then show ?thesis using False IH *\n        by argo\n    qed\n  qed\nqed\n\nlemma merge_merge_t_equivalence:\n  assumes \"cc_invar cc\"\n    \"nr_vars cc > 0\"\n    \"valid_vars eq (nr_vars cc)\"\n  shows \"merge cc eq = \ncongruence_closure.truncate (merge_t (congruence_closure.extend cc \\<lparr>time = k, timestamps = ti\\<rparr>) eq)\" \n  using assms proof(induction cc eq rule: merge.induct)\n  case (1 l u t pe pf pfl ip a b)\n  then have \"cc_invar \\<lparr>cc_list = l, use_list = u, lookup = t, pending = One (a \\<approx> b) # pe, proof_forest = pf,\n        pf_labels = pfl, input = insert (a \\<approx> b) ip\\<rparr>\"\n    \"nr_vars \\<lparr>cc_list = l, use_list = u, lookup = t, pending = One (a \\<approx> b) # pe, proof_forest = pf,\n        pf_labels = pfl, input = insert (a \\<approx> b) ip\\<rparr> > 0\" using cc_invar_merge1 by auto\n  then show ?case \n    unfolding merge_t.simps(1) merge.simps(1) Let_def congruence_closure.select_convs \n      congruence_closure.extend_def congruence_closure.truncate_def congruence_closure_t.select_convs \n    using propagate_propagate_t_equivalence[of \"\\<lparr>cc_list = l, use_list = u, lookup = t, pending = One (a \\<approx> b) # pe, proof_forest = pf,\n        pf_labels = pfl, input = insert (a \\<approx> b) ip\\<rparr>\"] unfolding congruence_closure.extend_def congruence_closure.truncate_def \n    by auto\nnext\n  case (2 l u t pe pf pfl ip a\\<^sub>1 a\\<^sub>2 a)\n  then have \" lookup_Some t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) \\<Longrightarrow> cc_invar \\<lparr>cc_list = l, use_list = u, lookup = t,\n             pending = link_to_lookup t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) # pe, proof_forest = pf,\n             pf_labels = pfl, input = insert (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) ip\\<rparr>\"\n    \"nr_vars \\<lparr>cc_list = l, use_list = u, lookup = t,\n             pending = link_to_lookup t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) # pe, proof_forest = pf,\n             pf_labels = pfl, input = insert (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) ip\\<rparr> > 0\" \n    using cc_invar_merge2 by auto\n  then show ?case \n    apply (cases \"(lookup_Some t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a))\")\n    using propagate_propagate_t_equivalence[of \"\\<lparr>cc_list = l, use_list = u, lookup = t,\n             pending = link_to_lookup t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) # pe, proof_forest = pf,\n             pf_labels = pfl, input = insert (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) ip\\<rparr>\"]\n    unfolding merge_t.simps(2) merge.simps(2) Let_def congruence_closure.select_convs If_def\n      congruence_closure.extend_def congruence_closure.truncate_def congruence_closure_t.select_convs\n    unfolding congruence_closure.extend_def congruence_closure.truncate_def\n    by auto\nqed\n\nsection \\<open>Induction rules\\<close>\n\nthm propagate_t.pinduct\nlemma propagate_t_induct[consumes 1]:\n  assumes \"propagate_t_dom a0\"\n\"\\<And>l u t pf pfl ip k ti  .\npropagate_t_dom \\<lparr>cc_list = l, use_list = u, lookup = t, pending = [], proof_forest = pf,\n pf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr> \\<Longrightarrow>  \nP \\<lparr>cc_list = l, use_list = u, lookup = t, pending = [], proof_forest = pf,\n pf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr>\"\n\"(\\<And>l u t pe pf pfl ip k ti a b eq.\npropagate_t_dom \\<lparr>cc_list = l, use_list = u, lookup = t, pending = (eq # pe), proof_forest = pf,\n pf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr> \\<Longrightarrow>  \na = left eq \\<Longrightarrow> b = right eq \\<Longrightarrow>\nrep_of l a = rep_of l b \\<Longrightarrow>\nP \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf,\n pf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr> \\<Longrightarrow>\nP (\\<lparr>cc_list = l, use_list = u, lookup = t, pending = eq # pe, proof_forest = pf, pf_labels = pfl, \ninput = ip, time = k, timestamps = ti\\<rparr>))\"\n\"(\\<And>l u t pe pf pfl ip k ti a b eq. \npropagate_t_dom \\<lparr>cc_list = l, use_list = u, lookup = t, pending = (eq # pe), proof_forest = pf, \npf_labels = pfl, input = ip, time = k, timestamps = ti\\<rparr> \\<Longrightarrow>  \na = left eq \\<Longrightarrow> b = right eq \\<Longrightarrow>\nrep_of l a \\<noteq> rep_of l b \\<Longrightarrow>\nP (propagate_step_t l u t pe pf pfl ip a b eq k ti)\n\\<Longrightarrow> P \\<lparr>cc_list = l, use_list = u, lookup = t, pending = (eq # pe), \nproof_forest = pf, pf_labels = pfl, \ninput = ip, time = k, timestamps = ti\\<rparr>)\"\nshows \"P a0\"\n  using assms proof(induction a0 rule: propagate_t.pinduct)\n  case (1 cc_t)\n  then show ?case proof(cases \"pending cc_t\")\n    case Nil\n    then show ?thesis \n      using 1 \n      by (metis (full_types) congruence_closure_t.surjective old.unit.exhaust)\n  next\n    case (Cons eq list)\n    obtain l u t pe pf pfl ip k ti\n        where cc_t: \"cc_t = \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf, pf_labels = pfl, \ninput = ip, time = k, timestamps = ti\\<rparr>\" \n      using congruence_closure_t.cases by blast\n    then show ?thesis\n    proof(cases \"rep_of (cc_list cc_t) (left eq) = rep_of (cc_list cc_t) (right eq)\")\n      case True\n      have \"P \\<lparr>cc_list = l, use_list = u, lookup = t, pending = list, proof_forest = pf, pf_labels = pfl, \ninput = ip, time = k, timestamps = ti\\<rparr>\" \n        using 1(2) \"1.prems\" True Cons unfolding cc_t congruence_closure.select_convs congruence_closure_t.select_convs \n        by blast\n      then show ?thesis using 1(1,5) cc_t True Cons by force\n    next\n      case False\n      have \"P (propagate_step_t l u t list pf pfl ip (left eq) (right eq) eq k ti)\" \n        using 1(3) \"1.prems\" False Cons unfolding cc_t congruence_closure.select_convs congruence_closure_t.select_convs \n        by blast\n      then show ?thesis using 1(1,6) cc_t False Cons by simp\n    qed\n  qed\nqed\n\nthm merge_t.induct\nlemma merge_t_induct:\n  assumes \"(\\<And>l u t pe pf pfl ip k ti a b. \nP \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf, pf_labels = pfl, \ninput = ip, time = k, timestamps = ti\\<rparr> (a \\<approx> b))\"\n\"(\\<And>l u t pe pf pfl ip k ti a\\<^sub>1 a\\<^sub>2 a. P \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, \nproof_forest = pf, pf_labels = pfl, \ninput = ip, time = k, timestamps = ti\\<rparr> (F a\\<^sub>1 a\\<^sub>2 \\<approx> a))\"\nshows \"P a0 a1\"\n  using assms merge_t.induct congruence_closure_t.cases by metis\n\nend\n", "meta": {"author": "reb-ddm", "repo": "congruence-closure-isabelle", "sha": "fcc4964ff2d19fbea4da76029bb0619f84bac724", "save_path": "github-repos/isabelle/reb-ddm-congruence-closure-isabelle", "path": "github-repos/isabelle/reb-ddm-congruence-closure-isabelle/congruence-closure-isabelle-fcc4964ff2d19fbea4da76029bb0619f84bac724/Congruence_Closure_Explain/CC_Definition2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011686727231, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.3423433691160697}}
{"text": "chapter \\<open>The prover\\<close>\n\nsection \\<open>Proof search procedure\\<close>\n\ntheory Prover\n  imports SeCaV\n    \"HOL-Library.Stream\"\n    Abstract_Completeness.Abstract_Completeness\n    Abstract_Soundness.Finite_Proof_Soundness\n    \"HOL-Library.Countable\"\n    \"HOL-Library.Code_Lazy\"\nbegin\n\ntext \\<open>This theory defines the actual proof search procedure.\\<close>\n\nsubsection \\<open>Datatypes\\<close>\n\ntext \\<open>A sequent is a list of formulas\\<close>\ntype_synonym sequent = \\<open>fm list\\<close>\n\ntext \\<open>We introduce a number of rules to prove sequents.\n  These rules mirror the proof system of SeCaV, but are higher-level in the sense that they apply to\n  all formulas in the sequent at once. This obviates the need for the structural Ext rule.\n  There is also no Basic rule, since this is implicit in the prover.\\<close>\ndatatype rule\n  = AlphaDis | AlphaImp  | AlphaCon\n  | BetaCon | BetaImp | BetaDis\n  | DeltaUni | DeltaExi\n  | NegNeg\n  | GammaExi | GammaUni\n\nsubsection \\<open>Auxiliary functions\\<close>\n\ntext \\<open>Before defining what the rules do, we need to define a number of auxiliary functions needed\n  for the semantics of the rules.\\<close>\n\ntext \\<open>listFunTm is a list of function and constant names in a term\\<close>\nprimrec listFunTm :: \\<open>tm \\<Rightarrow> nat list\\<close> and listFunTms :: \\<open>tm list \\<Rightarrow> nat list\\<close>where\n  \\<open>listFunTm (Fun n ts) = n # listFunTms ts\\<close>\n| \\<open>listFunTm (Var n) = []\\<close>\n| \\<open>listFunTms [] = []\\<close>\n| \\<open>listFunTms (t # ts) = listFunTm t @ listFunTms ts\\<close>\n\ntext \\<open>generateNew uses the \\<open>listFunTms\\<close> function to obtain a fresh function index\\<close>\ndefinition generateNew :: \\<open>tm list \\<Rightarrow> nat\\<close> where\n  \\<open>generateNew ts \\<equiv> 1 + foldr max (listFunTms ts) 0\\<close>\n\ntext \\<open>subtermTm returns a list of all terms occurring within a term\\<close>\nprimrec subtermTm :: \\<open>tm \\<Rightarrow> tm list\\<close> where\n  \\<open>subtermTm (Fun n ts) = Fun n ts # remdups (concat (map subtermTm ts))\\<close>\n| \\<open>subtermTm (Var n) = [Var n]\\<close>\n\ntext \\<open>subtermFm returns a list of all terms occurring within a formula\\<close>\nprimrec subtermFm :: \\<open>fm \\<Rightarrow> tm list\\<close> where\n  \\<open>subtermFm (Pre _ ts) = concat (map subtermTm ts)\\<close>\n| \\<open>subtermFm (Imp p q) = subtermFm p @ subtermFm q\\<close>\n| \\<open>subtermFm (Dis p q) = subtermFm p @ subtermFm q\\<close>\n| \\<open>subtermFm (Con p q) = subtermFm p @ subtermFm q\\<close>\n| \\<open>subtermFm (Exi p) = subtermFm p\\<close>\n| \\<open>subtermFm (Uni p) = subtermFm p\\<close>\n| \\<open>subtermFm (Neg p) = subtermFm p\\<close>\n\ntext \\<open>subtermFms returns a list of all terms occurring within a list of formulas\\<close>\nabbreviation \\<open>subtermFms z \\<equiv> concat (map subtermFm z)\\<close>\n\ntext \\<open>subterms returns a list of all terms occurring within a sequent.\n  This is used to determine which terms to instantiate Gamma-formulas with.\n  We must always be able to instantiate Gamma-formulas, so if there are no terms in the sequent,\n  the function simply returns a list containing the first function.\\<close>\ndefinition subterms :: \\<open>sequent \\<Rightarrow> tm list\\<close> where\n  \\<open>subterms z \\<equiv> case remdups (subtermFms z) of\n                [] \\<Rightarrow> [Fun 0 []]\n              | ts \\<Rightarrow> ts\\<close>\n\ntext \\<open>We need to be able to detect if a sequent is an axiom to know whether a branch of the proof\n  is done. The disjunct \\<open>Neg (Neg p) \\<in> set z\\<close> is not necessary for the prover, but makes the proof\n  of the lemma \\<open>branchDone_contradiction\\<close> easier.\\<close>\nfun branchDone :: \\<open>sequent \\<Rightarrow> bool\\<close> where\n  \\<open>branchDone [] = False\\<close>\n| \\<open>branchDone (Neg p # z) = (p \\<in> set z \\<or> Neg (Neg p) \\<in> set z \\<or> branchDone z)\\<close>\n| \\<open>branchDone (p # z) = (Neg p \\<in> set z \\<or> branchDone z)\\<close>\n\nsubsection \\<open>Effects of rules\\<close>\n\ntext \\<open>This defines the resulting formulas when applying a rule to a single formula.\n  This definition mirrors the semantics of SeCaV.\n  If the rule and the formula do not match, the resulting formula is simply the original formula.\n  Parameter A should be the list of terms on the branch.\\<close>\ndefinition parts :: \\<open>tm list \\<Rightarrow> rule \\<Rightarrow> fm \\<Rightarrow> fm list list\\<close> where\n  \\<open>parts A r f = (case (r, f) of\n      (NegNeg, Neg (Neg p)) \\<Rightarrow> [[p]]\n    | (AlphaImp, Imp p q) \\<Rightarrow> [[Neg p, q]]\n    | (AlphaDis, Dis p q) \\<Rightarrow> [[p, q]]\n    | (AlphaCon, Neg (Con p q)) \\<Rightarrow> [[Neg p, Neg q]]\n    | (BetaImp, Neg (Imp p q)) \\<Rightarrow> [[p], [Neg q]]\n    | (BetaDis, Neg (Dis p q)) \\<Rightarrow> [[Neg p], [Neg q]]\n    | (BetaCon, Con p q) \\<Rightarrow> [[p], [q]]\n    | (DeltaExi, Neg (Exi p)) \\<Rightarrow> [[Neg (sub 0 (Fun (generateNew A) []) p)]]\n    | (DeltaUni, Uni p) \\<Rightarrow> [[sub 0 (Fun (generateNew A) []) p]]\n    | (GammaExi, Exi p) \\<Rightarrow> [Exi p # map (\\<lambda>t. sub 0 t p) A]\n    | (GammaUni, Neg (Uni p)) \\<Rightarrow> [Neg (Uni p) # map (\\<lambda>t. Neg (sub 0 t p)) A]\n    | _ \\<Rightarrow> [[f]])\\<close>\n\ntext \\<open>This function defines the Cartesian product of two lists.\n  This is needed to create the list of branches created when applying a beta rule.\\<close>\nprimrec list_prod :: \\<open>'a list list \\<Rightarrow> 'a list list \\<Rightarrow> 'a list list\\<close> where\n  \\<open>list_prod _ [] = []\\<close>\n| \\<open>list_prod hs (t # ts) = map (\\<lambda>h. h @ t) hs @ list_prod hs ts\\<close>\n\ntext \\<open>This function computes the children of a node in the proof tree.\n  For Alpha rules, Delta rules and Gamma rules, there will be only one sequent, which is the result\n  of applying the rule to every formula in the current sequent.\n  For Beta rules, the proof tree will branch into two branches once for each formula in the sequent\n  that matches the rule, which results in \\<open>2\\<^sup>n\\<close> branches (created using \\<^text>\\<open>list_prod\\<close>).\n  The list of terms in the sequent needs to be updated after applying the rule to each formula since\n  Delta rules and Gamma rules may introduce new terms.\n  Note that any formulas that don't match the rule are left unchanged in the new sequent.\\<close>\nprimrec children :: \\<open>tm list \\<Rightarrow> rule \\<Rightarrow> sequent \\<Rightarrow> sequent list\\<close> where\n  \\<open>children _ _ [] = [[]]\\<close>\n| \\<open>children A r (p # z) =\n  (let hs = parts A r p; A' = remdups (A @ subtermFms (concat hs))\n   in list_prod hs (children A' r z))\\<close>\n\ntext \\<open>The proof state is the combination of a list of terms and a sequent.\\<close>\ntype_synonym state = \\<open>tm list \\<times> sequent\\<close>\n\ntext \\<open>This function defines the effect of applying a rule to a proof state.\n  If the sequent is an axiom, the effect is to end the branch of the proof tree, so an empty set of\n  child branches is returned.\n  Otherwise, we compute the children generated by applying the rule to the current proof state,\n  then add any new subterms to the proof states of the children.\\<close>\nprimrec effect :: \\<open>rule \\<Rightarrow> state \\<Rightarrow> state fset\\<close> where\n  \\<open>effect r (A, z) =\n  (if branchDone z then {||} else\n    fimage (\\<lambda>z'. (remdups (A @ subterms z @ subterms z'), z'))\n    (fset_of_list (children (remdups (A @ subtermFms z)) r z)))\\<close>\n\nsubsection \\<open>The rule stream\\<close>\n\ntext \\<open>We need to define an infinite stream of rules that the prover should try to apply.\n  Since rules simply do nothing if they don't fit the formulas in the sequent, the rule stream is\n  just all rules in the order: Alpha, Delta, Beta, Gamma, which guarantees completeness.\\<close>\ndefinition \\<open>rulesList \\<equiv> [\n  NegNeg, AlphaImp, AlphaDis, AlphaCon,\n  DeltaExi, DeltaUni,\n  BetaImp, BetaDis, BetaCon,\n  GammaExi, GammaUni\n]\\<close>\n\ntext \\<open>By cycling the list of all rules we obtain an infinite stream with every rule occurring\n  infinitely often.\\<close>\ndefinition rules where\n  \\<open>rules = cycle rulesList\\<close>\n\nsubsection \\<open>Abstract completeness\\<close>\n\ntext \\<open>We write effect as a relation to use it with the abstract completeness framework.\\<close>\ndefinition eff where\n  \\<open>eff \\<equiv> \\<lambda>r s ss. effect r s = ss\\<close>\n\ntext \\<open>To use the framework, we need to prove enabledness.\n  This is trivial because all of our rules are always enabled and simply do nothing if they don't\n  match the formulas.\\<close>\nlemma all_rules_enabled: \\<open>\\<forall>st. \\<forall>r \\<in> i.R (cycle rulesList). \\<exists>sl. eff r st sl\\<close>\n  unfolding eff_def by blast\n\ntext \\<open>The first step of the framework is to prove that our prover fits the framework.\\<close>\ninterpretation RuleSystem eff rules UNIV\n  unfolding rules_def RuleSystem_def\n  using all_rules_enabled stream.set_sel(1)\n  by blast\n\ntext \\<open>Next, we need to prove that our rules are persistent.\n  This is also trivial, since all of our rules are always enabled.\\<close>\nlemma all_rules_persistent: \\<open>\\<forall>r. r \\<in> R \\<longrightarrow> per r\\<close>\n  by (metis all_rules_enabled enabled_def per_def rules_def)\n\ntext \\<open>We can then prove that our prover fully fits the framework.\\<close>\ninterpretation PersistentRuleSystem eff rules UNIV\n  unfolding PersistentRuleSystem_def RuleSystem_def PersistentRuleSystem_axioms_def\n  using all_rules_persistent enabled_R\n  by blast\n\ntext \\<open>We can then use the framework to define the prover.\n  The mkTree function applies the rules to build the proof tree using the effect relation, but the\n  prover is not actually executable yet.\\<close>\ndefinition \\<open>secavProver \\<equiv> mkTree rules\\<close>\n\nabbreviation \\<open>rootSequent t \\<equiv> snd (fst (root t))\\<close>\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/FOL_Seq_Calc2/Prover.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5851011542032313, "lm_q1q2_score": 0.34234336064995335}}
{"text": "(******************************************************************************\n * Clean\n *\n * Copyright (c) 2018-2019 Université Paris-Saclay, Univ. Paris-Sud, France\n *\n * All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n *     * Redistributions of source code must retain the above copyright\n *       notice, this list of conditions and the following disclaimer.\n *\n *     * Redistributions in binary form must reproduce the above\n *       copyright notice, this list of conditions and the following\n *       disclaimer in the documentation and/or other materials provided\n *       with the distribution.\n *\n *     * Neither the name of the copyright holders nor the names of its\n *       contributors may be used to endorse or promote products derived\n *       from this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n * \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n ******************************************************************************)\n\n(*\n * IsPrime-Test \n *\n * Authors : Burkhart Wolff, Frédéric Tuong\n *)\n\nchapter \\<open> Clean Semantics : Another Clean Example\\<close>\n\n\ntheory IsPrime\n  imports Clean.Clean\n          Clean.Hoare_Clean\n          Clean.Clean_Symbex\n          \"HOL-Computational_Algebra.Primes\"\nbegin\n\nsection\\<open>The Primality-Test Example at a Glance\\<close>\n\ndefinition \"SQRT_UINT_MAX = (65536::nat)\"\ndefinition \"UINT_MAX = (2^32::nat) - 1\"\n\n\nfunction_spec isPrime(n :: nat) returns bool\npre          \"\\<open>n \\<le> SQRT_UINT_MAX\\<close>\" \npost         \"\\<open>\\<lambda>res. res \\<longleftrightarrow> prime n \\<close>\"\nlocal_vars   i :: nat\ndefines \" if\\<^sub>C \\<open>n < 2\\<close>  \n            then return\\<^bsub>local_isPrime_state.result_value_update\\<^esub> \\<open>False\\<close>\n            else skip\\<^sub>S\\<^sub>E \n          fi ;-\n          \\<open>i := 2\\<close> ;- \n          while\\<^sub>C \\<open>i < SQRT_UINT_MAX \\<and> i*i \\<le> n  \\<close> \n            do if\\<^sub>C \\<open>n mod i = 0\\<close>  \n                  then return\\<^bsub>local_isPrime_state.result_value_update\\<^esub> \\<open>False\\<close>\n                  else skip\\<^sub>S\\<^sub>E \n                fi ;-\n                \\<open>i := i + 1 \\<close> \n            od ;-\n         return\\<^bsub>local_isPrime_state.result_value_update\\<^esub> \\<open>True\\<close>\"\n\nfind_theorems name:isPrime name:core\n\nlemma XXX : \n\"isPrime_core n \\<equiv>\n     if\\<^sub>C (\\<lambda>\\<sigma>. n < 2) then (return\\<^bsub>result_value_update\\<^esub> (\\<lambda>\\<sigma>. False)) \n                     else skip\\<^sub>S\\<^sub>E fi;-\n     i_update :==\\<^sub>L (\\<lambda>\\<sigma>. 2) ;-\n     while\\<^sub>C (\\<lambda>\\<sigma>. (hd\\<circ>i)\\<sigma> < SQRT_UINT_MAX \\<and> (hd\\<circ>i)\\<sigma> * (hd\\<circ>i)\\<sigma> \\<le> n) \n     do\n        (if\\<^sub>C (\\<lambda>\\<sigma>. n mod (hd \\<circ> i) \\<sigma> = 0) \n         then (return\\<^bsub>result_value_update\\<^esub> (\\<lambda>\\<sigma>. False)) \n         else skip\\<^sub>S\\<^sub>E fi ;-\n        i_update :==\\<^sub>L (\\<lambda>\\<sigma>. (hd \\<circ> i) \\<sigma> + 1)) \n     od ;-\n     return\\<^bsub>result_value_update\\<^esub> (\\<lambda>\\<sigma>. True)\"\n\n  by(simp add: isPrime_core_def)\n\nlemma YYY:\n\"isPrime n \\<equiv> block\\<^sub>C push_local_isPrime_state \n                    (isPrime_core n) \n                    pop_local_isPrime_state\"\n  by(simp add: isPrime_def)\n\nlemma isPrime_correct : \n  \"\\<lbrace>\\<lambda>\\<sigma>.   \\<triangleright> \\<sigma> \\<and> isPrime_pre (n)(\\<sigma>) \\<and> \\<sigma> = \\<sigma>\\<^sub>p\\<^sub>r\\<^sub>e \\<rbrace> \n     isPrime n \n   \\<lbrace>\\<lambda>r \\<sigma>. \\<triangleright> \\<sigma> \\<and> isPrime_post(n) (\\<sigma>\\<^sub>p\\<^sub>r\\<^sub>e)(\\<sigma>)(r) \\<rbrace>\"\n   oops\n\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Clean/examples/IsPrime.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.626124191181315, "lm_q1q2_score": 0.3423259831993332}}
{"text": "theory NBA_Rule\nimports Scoring_Rules\n        \"Compositional_Structures/Basic_Modules/Scoring_Module\"\n        \"Compositional_Structures/Basic_Modules/NBA_Module\"\n        \"Compositional_Structures/Elect_Composition\"\n\nbegin\n\nlemma mvp_elect:\n  shows \"electoral_module (elector mvp)\"\nproof(unfold mvp.simps)\n  show \"electoral_module (elector (max_eliminator (scoring vector_A_mvp)))\"\n    using scoring_mod_A by blast \nqed\n\n\nlemma mvp_hom:\n  shows \"homogeneity (elector mvp)\" unfolding mvp.simps \n  using scoring_rules_homogeneity\n  by blast\n\nlemma mvp_reinforcement:\n  shows \"reinforcement (elector mvp)\" unfolding mvp.simps \n  using scoring_module_rein\n  by blast\n\nend\n", "meta": {"author": "ChrisMackKit", "repo": "ba-scoring-rule-reinforcement-homogeneity", "sha": "d87febd04743389ac578b332349ae446b9c55e89", "save_path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity", "path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity/ba-scoring-rule-reinforcement-homogeneity-d87febd04743389ac578b332349ae446b9c55e89/verifiedVotingRuleConstruction-master/theories/NBA_Rule.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.34232597557068944}}
{"text": "section \"Solution to Day 7 of AoC 2020\"\n\ntheory day7\n  imports Main \"HOL.Code_Numeral\" string_utils list_natural_utils natural_utils list_utils\nbegin\n\ntext \"This is a solution to the puzzle for day 7\"\n\nsubsection \"Input parsing\"\n\ntext \"Input parsing for today was a pain in the butt. If I had a language with powerful and easy to\nuse string manipulations then this would be easy. Unfortunately I do not. So some of the string functions\nhave been added for dealing with today's input. The input is still just a line-by-line thing, but it's\npresented in natural language. Fortunately it's quite predictable though.\"\n\ntext \"The bag\\\\_desc function takes one line of the input in the form of a list of tokens.\nA token is just one word from the input, where a word is defined such that you can tokenise the text\nsimply by splitting on spaces. bag\\\\_desc figures out the name of the bag that this line\ndescribes, and then returns the token list for the subbag descriptions\"\n\nprimrec bag_desc :: \"string \\<Rightarrow> (string list) \\<Rightarrow> (string * (string list))\"\n  where\n    \"bag_desc parsed [] = ('''', [''''])\"\n    |\"bag_desc parsed (Cons t toks) = (\n      if t = ''bags'' then\n        (parsed, tl toks)\n      else\n        bag_desc (parsed @ '' '' @ t) toks\n    )\"\n\ntext \"sub\\\\_bags\\\\_parse takes the tokens that bag\\\\_desc didn't parse, and then produces a list of sub bag information.\nEach sub bag is a pair with a number (the number of bags of this type contained in the outer bag) and a name\"\n\nfun sub_bags_parse :: \"(natural * string) list \\<Rightarrow> (natural * string) \\<Rightarrow> string list \\<Rightarrow> (natural * string) list\"\n  where\n    \"sub_bags_parse a part [] = a\"\n  |\"sub_bags_parse a part (Cons n rest) =\n    (let (part_n, part_label) = part in\n    (if contains n [''bag,'',''bags,'',''bag.'',''bags.''] then\n       sub_bags_parse (a @ [(part_n, trim part_label)]) (0, '''') rest\n    else\n      (if part_n = 0 then\n        if n = ''no'' then\n          a\n        else\n        (let next_n = str_to_nat n in\n          sub_bags_parse a (next_n, '''') rest\n        )\n      else\n        sub_bags_parse a (part_n, part_label @ '' '' @ n) rest\n      )\n    )\n)\"\n\ntext \"Parsing a line of text is done by combining the two functions above, this is the parse\\\\_line\nfunction. parse\\\\_all returns a list of all bags in an input text\"\n\ndefinition parse_line :: \"string \\<Rightarrow> (string * ((natural * string) list))\"\n  where \"parse_line line = (let t = split CHR '' '' line in\n    let (bd, sub_bags) = bag_desc '''' t in\n    (trim bd, sub_bags_parse [] (0, '''') sub_bags)\n  )\"\n\ndefinition parse_all where \"parse_all s = map parse_line (split CHR ''\\<newline>'' (trim s))\"\n\nsubsection \"Solution Algorithm\"\n\ntext \"The task concerns calculating some information about the shiny gold bag specifically. In part 1 we need\nto know how many different types of bag could hold a shiny gold bag at an arbitrary depth.\"\n\ndefinition p1col where \"p1col = ''shiny gold''\"\n\ntext \"First I define a function for getting information about a particular bag\"\n\nprimrec get_bag_info where\n  \"get_bag_info [] bag_col = undefined\"\n|\"get_bag_info (Cons bag1_def bag_defs) bag_col = \n  (if fst bag1_def = bag_col then snd bag1_def else get_bag_info bag_defs bag_col)\n  \"\n\ntext \"Then a function for getting all of the names of bags that we know about\"\n\ndefinition all_bag_names where \"all_bag_names bag_defs = map fst bag_defs\"\n\ntext \"can\\\\_hold tells us what bags another bag can hold \\\\_directly\\\\_\"\n\ndefinition can_hold where \"can_hold bag_defs bag_col =\n  (let names = all_bag_names bag_defs in\n    filter (\\<lambda> name . contains bag_col (map snd (get_bag_info bag_defs name))) names\n  )\n\"\n\ntext \"can\\\\_hold\\\\_rec tells us what bags another bag can hold \\\\_recursively\\\\_. To make sure that this function\nalways terminates, I implemented a recursion limit.\"\n\nfun can_hold_rec :: \"natural \\<Rightarrow> (string \\<times> (natural \\<times> string) list) list \\<Rightarrow> string list \\<Rightarrow> string list\" where\n\"can_hold_rec limit bag_defs bag_cols = (if limit = 0 then undefined else  (let new_list =\n  (reduce uniq_ins bag_cols (flatten (map (can_hold bag_defs) bag_cols)))\n  in\n  if natural_len new_list = natural_len bag_cols then bag_cols else can_hold_rec (limit - 1) bag_defs new_list\n))\n\"\n\ntext \"part 1 is now simply the number of bags in can\\\\_hold\\\\_rec for the shiny gold bag\"\n\ndefinition part1 :: \"string \\<Rightarrow> natural\"\n  where \"part1 s = (natural_len (can_hold_rec 99 (parse_all s) [p1col])) - 1\"\n\ntext \"part 2 is actually a bit simpler than part 1. it's faster than part1 given the data structure\nthat I came up with for this task. It involves determining how many bags should end up inside the shiny\ngold bag. num\\\\_held calculates one more than this number\"\n\nfun num_held :: \"natural \\<Rightarrow> _\"\n  where \"num_held limit bag_defs bag_col = \n  (if limit = 0 then undefined else\n    (let subbags = get_bag_info bag_defs bag_col in\n      (if (natural_len subbags) = 0 then 1 else\n        (reduce (+) 0 (map (\\<lambda> (n, name) . n * (num_held (limit - 1) bag_defs name)) subbags)) + 1\n      )\n    )\n  )\"\n\ndefinition part2 :: \"string \\<Rightarrow> natural\"\n  where \"part2 s = (let bags = parse_all s in\n    (num_held 99 bags p1col) - 1\n  )\"\n\nsubsection \"Testing\"\n\ndefinition example_input::string where \"example_input = ''\nlight red bags contain 1 bright white bag, 2 muted yellow bags.\ndark orange bags contain 3 bright white bags, 4 muted yellow bags.\nbright white bags contain 1 shiny gold bag.\nmuted yellow bags contain 2 shiny gold bags, 9 faded blue bags.\nshiny gold bags contain 1 dark olive bag, 2 vibrant plum bags.\ndark olive bags contain 3 faded blue bags, 4 dotted black bags.\nvibrant plum bags contain 5 faded blue bags, 6 dotted black bags.\nfaded blue bags contain no other bags.\ndotted black bags contain no other bags.\n''\"\n\nlemma \"part1 example_input = 4\"\n  by eval\n\nlemma \"part2 example_input = 32\"\n  by eval\n\nexport_code \"part1\" \"part2\" in Haskell module_name Solution\n\nend\n", "meta": {"author": "lexbailey", "repo": "AOC2020_isabelle", "sha": "c08c347793814e9cc3e9d9638dd889d2ada2eb1d", "save_path": "github-repos/isabelle/lexbailey-AOC2020_isabelle", "path": "github-repos/isabelle/lexbailey-AOC2020_isabelle/AOC2020_isabelle-c08c347793814e9cc3e9d9638dd889d2ada2eb1d/day7.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.34232597557068944}}
{"text": "section \\<open> Reactive Design Triples \\<close>\n\ntheory utp_rdes_triples\n  imports utp_rdes_designs\nbegin\n\nsubsection \\<open> Diamond notation\\<close>\n\ndefinition wait'_cond ::\n  \"('t::trace,'\\<alpha>,'\\<beta>) rel_rp \\<Rightarrow> ('t,'\\<alpha>,'\\<beta>) rel_rp \\<Rightarrow> ('t,'\\<alpha>,'\\<beta>) rel_rp\" (infixr \"\\<diamondop>\" 60) where\n[upred_defs]: \"P \\<diamondop> Q = (P \\<triangleleft> $wait\\<acute> \\<triangleright> Q)\"\n\nutp_const wait'_cond\n\nlemma wait'_cond_unrest [unrest]:\n  \"\\<lbrakk> out_var wait \\<bowtie> x; x \\<sharp> P; x \\<sharp> Q \\<rbrakk> \\<Longrightarrow> x \\<sharp> (P \\<diamondop> Q)\"\n  by (simp add: wait'_cond_def unrest)\n\nlemma wait'_cond_subst [usubst]:\n  \"$wait\\<acute> \\<sharp>\\<^sub>s \\<sigma> \\<Longrightarrow> \\<sigma> \\<dagger> (P \\<diamondop> Q) = (\\<sigma> \\<dagger> P) \\<diamondop> (\\<sigma> \\<dagger> Q)\"\n  by (simp add: wait'_cond_def usubst unrest usubst_apply_unrest)\n\nlemma wait'_cond_left_false: \"false \\<diamondop> P = (\\<not> $wait\\<acute> \\<and> P)\"\n  by (rel_auto)\n\nlemma wait'_cond_seq: \"((P \\<diamondop> Q) ;; R) = ((P ;; ($wait \\<and> R)) \\<or> (Q ;; (\\<not>$wait \\<and> R)))\"\n  by (simp add: wait'_cond_def cond_def seqr_or_distl, rel_blast)\n\nlemma wait'_cond_true: \"(P \\<diamondop> Q \\<and> $wait\\<acute>) = (P \\<and> $wait\\<acute>)\"\n  by (rel_auto)\n\nlemma wait'_cond_false: \"(P \\<diamondop> Q \\<and> (\\<not>$wait\\<acute>)) = (Q \\<and> (\\<not>$wait\\<acute>))\"\n  by (rel_auto)\n\nlemma wait'_cond_idem: \"P \\<diamondop> P = P\"\n  by (rel_auto)\n\nlemma wait'_cond_conj_exchange:\n  \"((P \\<diamondop> Q) \\<and> (R \\<diamondop> S)) = (P \\<and> R) \\<diamondop> (Q \\<and> S)\"\n  by (rel_auto)\n\nlemma subst_wait'_cond_true [usubst]: \"(P \\<diamondop> Q)\\<lbrakk>true/$wait\\<acute>\\<rbrakk> = P\\<lbrakk>true/$wait\\<acute>\\<rbrakk>\"\n  by (rel_auto)\n\nlemma subst_wait'_cond_false [usubst]: \"(P \\<diamondop> Q)\\<lbrakk>false/$wait\\<acute>\\<rbrakk> = Q\\<lbrakk>false/$wait\\<acute>\\<rbrakk>\"\n  by (rel_auto)\n\nlemma subst_wait'_left_subst: \"(P\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<diamondop> Q) = (P \\<diamondop> Q)\"\n  by (rel_auto)\n\nlemma subst_wait'_right_subst: \"(P \\<diamondop> Q\\<lbrakk>false/$wait\\<acute>\\<rbrakk>) = (P \\<diamondop> Q)\"\n  by (rel_auto)\n\nlemma wait'_cond_split: \"P\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<diamondop> P\\<lbrakk>false/$wait\\<acute>\\<rbrakk> = P\"\n  by (simp add: wait'_cond_def cond_var_split)\n\nlemma wait_cond'_assoc [simp]: \"P \\<diamondop> Q \\<diamondop> R = P \\<diamondop> R\"\n  by (rel_auto)\n\nlemma wait_cond'_shadow: \"(P \\<diamondop> Q) \\<diamondop> R = P \\<diamondop> Q \\<diamondop> R\"\n  by (rel_auto)\n\nlemma wait_cond'_conj [simp]: \"P \\<diamondop> (Q \\<and> (R \\<diamondop> S)) = P \\<diamondop> (Q \\<and> S)\"\n  by (rel_auto)\n\nlemma R1_wait'_cond: \"R1(P \\<diamondop> Q) = R1(P) \\<diamondop> R1(Q)\"\n  by (rel_auto)\n\nlemma R2s_wait'_cond: \"R2s(P \\<diamondop> Q) = R2s(P) \\<diamondop> R2s(Q)\"\n  by (simp add: wait'_cond_def R2s_def R2s_def usubst)\n\nlemma R2_wait'_cond: \"R2(P \\<diamondop> Q) = R2(P) \\<diamondop> R2(Q)\"\n  by (simp add: R2_def R2s_wait'_cond R1_wait'_cond)\n    \nlemma wait'_cond_R1_closed [closure]: \n  \"\\<lbrakk> P is R1; Q is R1 \\<rbrakk> \\<Longrightarrow> P \\<diamondop> Q is R1\"\n  by (simp add: Healthy_def R1_wait'_cond)\n\nlemma wait'_cond_R2c_closed [closure]: \"\\<lbrakk> P is R2c; Q is R2c \\<rbrakk> \\<Longrightarrow> P \\<diamondop> Q is R2c\"\n  by (simp add: R2c_condr wait'_cond_def Healthy_def, rel_auto)\n\nsubsection \\<open> Export laws \\<close>\n\nlemma RH_design_peri_R1: \"\\<^bold>R(P \\<turnstile> R1(Q) \\<diamondop> R) = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis (no_types, lifting) R1_idem R1_wait'_cond RH_design_export_R1)\n\nlemma RH_design_post_R1: \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R1(R)) = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis R1_wait'_cond RH_design_export_R1 RH_design_peri_R1)\n\nlemma RH_design_peri_R2s: \"\\<^bold>R(P \\<turnstile> R2s(Q) \\<diamondop> R) = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis (no_types, lifting) R2s_idem R2s_wait'_cond RH_design_export_R2s)\n\nlemma RH_design_post_R2s: \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R2s(R)) = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis (no_types, lifting) R2s_idem R2s_wait'_cond RH_design_export_R2s)\n\nlemma RH_design_peri_R2c: \"\\<^bold>R(P \\<turnstile> R2c(Q) \\<diamondop> R) = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis R1_R2s_R2c RH_design_peri_R1 RH_design_peri_R2s)\n\nlemma RHS_design_peri_R1: \"\\<^bold>R\\<^sub>s(P \\<turnstile> R1(Q) \\<diamondop> R) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis (no_types, lifting) R1_idem R1_wait'_cond RHS_design_export_R1)\n\nlemma RHS_design_post_R1: \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R1(R)) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis R1_wait'_cond RHS_design_export_R1 RHS_design_peri_R1)\n\nlemma RHS_design_peri_R2s: \"\\<^bold>R\\<^sub>s(P \\<turnstile> R2s(Q) \\<diamondop> R) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis (no_types, lifting) R2s_idem R2s_wait'_cond RHS_design_export_R2s)\n\nlemma RHS_design_post_R2s: \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R2s(R)) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis R2s_wait'_cond RHS_design_export_R2s RHS_design_peri_R2s)\n\nlemma RHS_design_peri_R2c: \"\\<^bold>R\\<^sub>s(P \\<turnstile> R2c(Q) \\<diamondop> R) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis R1_R2s_R2c RHS_design_peri_R1 RHS_design_peri_R2s)\n\nlemma RH_design_lemma1:\n  \"RH(P \\<turnstile> (R1(R2c(Q)) \\<or> R) \\<diamondop> S) = RH(P \\<turnstile> (Q \\<or> R) \\<diamondop> S)\"\n  by (metis (no_types, lifting) R1_R2c_is_R2 R1_R2s_R2c R2_R1_form R2_disj R2c_idem RH_design_peri_R1 RH_design_peri_R2s)\n\nlemma RHS_design_lemma1:\n  \"RHS(P \\<turnstile> (R1(R2c(Q)) \\<or> R) \\<diamondop> S) = RHS(P \\<turnstile> (Q \\<or> R) \\<diamondop> S)\"\n  by (metis (no_types, lifting) R1_R2c_is_R2 R1_R2s_R2c R2_R1_form R2_disj R2c_idem RHS_design_peri_R1 RHS_design_peri_R2s)\n\nsubsection \\<open> Pre-, peri-, and postconditions \\<close>\n\nsubsubsection \\<open> Definitions \\<close>\n\nabbreviation \"pre\\<^sub>s  \\<equiv> [$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s false, $wait \\<mapsto>\\<^sub>s false]\"\nabbreviation \"cmt\\<^sub>s  \\<equiv> [$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s false]\"\nabbreviation \"peri\\<^sub>s \\<equiv> [$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s false, $wait\\<acute> \\<mapsto>\\<^sub>s true]\"\nabbreviation \"post\\<^sub>s \\<equiv> [$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s false, $wait\\<acute> \\<mapsto>\\<^sub>s false]\"\n\nabbreviation \"npre\\<^sub>R(P) \\<equiv> pre\\<^sub>s \\<dagger> P\"\n\ndefinition [upred_defs]: \"pre\\<^sub>R(P)  = (\\<not>\\<^sub>r npre\\<^sub>R(P))\"\ndefinition [upred_defs]: \"cmt\\<^sub>R(P)  = R1(cmt\\<^sub>s \\<dagger> P)\"\ndefinition [upred_defs]: \"peri\\<^sub>R(P) = R1(peri\\<^sub>s \\<dagger> P)\"\ndefinition [upred_defs]: \"post\\<^sub>R(P) = R1(post\\<^sub>s \\<dagger> P)\"\n\nno_utp_lift pre\\<^sub>R cmt\\<^sub>R peri\\<^sub>R post\\<^sub>R npre\\<^sub>R\n\nsubsubsection \\<open> Unrestriction laws \\<close>\n\nlemma ok_pre_unrest [unrest]: \"$ok \\<sharp> pre\\<^sub>R P\"\n  by (simp add: pre\\<^sub>R_def unrest usubst)\n\nlemma ok_peri_unrest [unrest]: \"$ok \\<sharp> peri\\<^sub>R P\"\n  by (simp add: peri\\<^sub>R_def unrest usubst)\n\nlemma ok_post_unrest [unrest]: \"$ok \\<sharp> post\\<^sub>R P\"\n  by (simp add: post\\<^sub>R_def unrest usubst)\n\nlemma ok_cmt_unrest [unrest]: \"$ok \\<sharp> cmt\\<^sub>R P\"\n  by (simp add: cmt\\<^sub>R_def unrest usubst)\n\nlemma ok'_pre_unrest [unrest]: \"$ok\\<acute> \\<sharp> pre\\<^sub>R P\"\n  by (simp add: pre\\<^sub>R_def unrest usubst)\n\nlemma ok'_peri_unrest [unrest]: \"$ok\\<acute> \\<sharp> peri\\<^sub>R P\"\n  by (simp add: peri\\<^sub>R_def unrest usubst)\n\nlemma ok'_post_unrest [unrest]: \"$ok\\<acute> \\<sharp> post\\<^sub>R P\"\n  by (simp add: post\\<^sub>R_def unrest usubst)\n\nlemma ok'_cmt_unrest [unrest]: \"$ok\\<acute> \\<sharp> cmt\\<^sub>R P\"\n  by (simp add: cmt\\<^sub>R_def unrest usubst)\n\nlemma wait_pre_unrest [unrest]: \"$wait \\<sharp> pre\\<^sub>R P\"\n  by (simp add: pre\\<^sub>R_def unrest usubst)\n\nlemma wait_peri_unrest [unrest]: \"$wait \\<sharp> peri\\<^sub>R P\"\n  by (simp add: peri\\<^sub>R_def unrest usubst)\n\nlemma wait_post_unrest [unrest]: \"$wait \\<sharp> post\\<^sub>R P\"\n  by (simp add: post\\<^sub>R_def unrest usubst)\n\nlemma wait_cmt_unrest [unrest]: \"$wait \\<sharp> cmt\\<^sub>R P\"\n  by (simp add: cmt\\<^sub>R_def unrest usubst)\n\nlemma wait'_peri_unrest [unrest]: \"$wait\\<acute> \\<sharp> peri\\<^sub>R P\"\n  by (simp add: peri\\<^sub>R_def unrest usubst)\n\nlemma wait'_post_unrest [unrest]: \"$wait\\<acute> \\<sharp> post\\<^sub>R P\"\n  by (simp add: post\\<^sub>R_def unrest usubst)\n\nsubsubsection \\<open> Substitution laws \\<close>\n\nlemma pre\\<^sub>s_design: \"pre\\<^sub>s \\<dagger> (P \\<turnstile> Q) = (\\<not> pre\\<^sub>s \\<dagger> P)\"\n  by (simp add: design_def pre\\<^sub>R_def usubst)\n\nlemma peri\\<^sub>s_design: \"peri\\<^sub>s \\<dagger> (P \\<turnstile> Q \\<diamondop> R) = peri\\<^sub>s \\<dagger> (P \\<Rightarrow> Q)\"\n  by (simp add: design_def usubst wait'_cond_def)\n\nlemma post\\<^sub>s_design: \"post\\<^sub>s \\<dagger> (P \\<turnstile> Q \\<diamondop> R) = post\\<^sub>s \\<dagger> (P \\<Rightarrow> R)\"\n  by (simp add: design_def usubst wait'_cond_def)\n\nlemma cmt\\<^sub>s_design: \"cmt\\<^sub>s \\<dagger> (P \\<turnstile> Q) = cmt\\<^sub>s \\<dagger> (P \\<Rightarrow> Q)\"\n  by (simp add: design_def usubst wait'_cond_def)\n\nlemma pre\\<^sub>s_R1 [usubst]: \"pre\\<^sub>s \\<dagger> R1(P) = R1(pre\\<^sub>s \\<dagger> P)\"\n  by (simp add: R1_def usubst)\n\nlemma pre\\<^sub>s_R2c [usubst]: \"pre\\<^sub>s \\<dagger> R2c(P) = R2c(pre\\<^sub>s \\<dagger> P)\"\n  by (simp add: R2c_def R2s_def usubst)\n\nlemma peri\\<^sub>s_R1 [usubst]: \"peri\\<^sub>s \\<dagger> R1(P) = R1(peri\\<^sub>s \\<dagger> P)\"\n  by (simp add: R1_def usubst)\n\nlemma peri\\<^sub>s_R2c [usubst]: \"peri\\<^sub>s \\<dagger> R2c(P) = R2c(peri\\<^sub>s \\<dagger> P)\"\n  by (simp add: R2c_def R2s_def usubst)\n\nlemma post\\<^sub>s_R1 [usubst]: \"post\\<^sub>s \\<dagger> R1(P) = R1(post\\<^sub>s \\<dagger> P)\"\n  by (simp add: R1_def usubst)\n\nlemma post\\<^sub>s_R2c [usubst]: \"post\\<^sub>s \\<dagger> R2c(P) = R2c(post\\<^sub>s \\<dagger> P)\"\n  by (simp add: R2c_def R2s_def usubst)\n\nlemma cmt\\<^sub>s_R1 [usubst]: \"cmt\\<^sub>s \\<dagger> R1(P) = R1(cmt\\<^sub>s \\<dagger> P)\"\n  by (simp add: R1_def usubst)\n\nlemma cmt\\<^sub>s_R2c [usubst]: \"cmt\\<^sub>s \\<dagger> R2c(P) = R2c(cmt\\<^sub>s \\<dagger> P)\"\n  by (simp add: R2c_def R2s_def usubst)\n\nlemma pre_wait_false:\n  \"pre\\<^sub>R(P\\<lbrakk>false/$wait\\<rbrakk>) = pre\\<^sub>R(P)\"\n  by (rel_auto)\n\nlemma cmt_wait_false:\n  \"cmt\\<^sub>R(P\\<lbrakk>false/$wait\\<rbrakk>) = cmt\\<^sub>R(P)\"\n  by (rel_auto)\n\nlemma rea_pre_RH_design: \"pre\\<^sub>R(\\<^bold>R(P \\<turnstile> Q)) = R1(R2c(pre\\<^sub>s \\<dagger> P))\"\n  by (simp add: RH_def usubst R3c_def pre\\<^sub>R_def pre\\<^sub>s_design R1_negate_R1 R2c_not rea_not_def)\n\nlemma rea_pre_RHS_design: \"pre\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q)) = R1(R2c(pre\\<^sub>s \\<dagger> P))\"\n  by (simp add: RHS_def usubst R3h_def pre\\<^sub>R_def pre\\<^sub>s_design R1_negate_R1 R2c_not rea_not_def)\n\nlemma rea_cmt_RH_design: \"cmt\\<^sub>R(\\<^bold>R(P \\<turnstile> Q)) = R1(R2c(cmt\\<^sub>s \\<dagger> (P \\<Rightarrow> Q)))\"\n  by (simp add: RH_def usubst R3c_def cmt\\<^sub>R_def cmt\\<^sub>s_design R1_idem)\n\nlemma rea_cmt_RHS_design: \"cmt\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q)) = R1(R2c(cmt\\<^sub>s \\<dagger> (P \\<Rightarrow> Q)))\"\n  by (simp add: RHS_def usubst R3h_def cmt\\<^sub>R_def cmt\\<^sub>s_design R1_idem)\n\nlemma rea_peri_RH_design: \"peri\\<^sub>R(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = R1(R2c(peri\\<^sub>s \\<dagger> (P \\<Rightarrow>\\<^sub>r Q)))\"\n  by rel_auto\n\nlemma rea_peri_RHS_design: \"peri\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = R1(R2c(peri\\<^sub>s \\<dagger> (P \\<Rightarrow>\\<^sub>r Q)))\"\n  by (simp add:RHS_def usubst peri\\<^sub>R_def R3h_def peri\\<^sub>s_design, rel_auto)\n\nlemma rea_post_RH_design: \"post\\<^sub>R(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = R1(R2c(post\\<^sub>s \\<dagger> (P \\<Rightarrow>\\<^sub>r R)))\"\n  by rel_auto\n\nlemma rea_post_RHS_design: \"post\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = R1(R2c(post\\<^sub>s \\<dagger> (P \\<Rightarrow>\\<^sub>r R)))\"\n  by (simp add:RHS_def usubst post\\<^sub>R_def R3h_def post\\<^sub>s_design, rel_auto)\n\nlemma peri_cmt_def: \"peri\\<^sub>R(P) = (cmt\\<^sub>R(P))\\<lbrakk>true/$wait\\<acute>\\<rbrakk>\"\n  by (rel_auto)\n\nlemma post_cmt_def: \"post\\<^sub>R(P) = (cmt\\<^sub>R(P))\\<lbrakk>false/$wait\\<acute>\\<rbrakk>\"\n  by (rel_auto)\n\nlemma rdes_export_cmt: \"\\<^bold>R\\<^sub>s(P \\<turnstile> cmt\\<^sub>s \\<dagger> Q) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q)\"\n  by (rel_auto)\n\nlemma rdes_export_pre: \"\\<^bold>R\\<^sub>s((P\\<lbrakk>true,false/$ok,$wait\\<rbrakk>) \\<turnstile> Q) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q)\"\n  by (rel_auto)\n\nsubsubsection \\<open> Healthiness laws \\<close>\n\nlemma wait'_unrest_pre_SRD [unrest]:\n  \"$wait\\<acute> \\<sharp> pre\\<^sub>R(P) \\<Longrightarrow>  $wait\\<acute> \\<sharp> pre\\<^sub>R (SRD P)\"\n  apply (rel_auto)\n  using least_zero apply blast+\ndone\n\nlemma R1_R2s_cmt_SRD:\n  assumes \"P is SRD\"\n  shows \"R1(R2s(cmt\\<^sub>R(P))) = cmt\\<^sub>R(P)\"\n  by (metis (no_types, lifting) R1_R2c_commute R1_R2s_R2c R1_idem R2c_idem SRD_reactive_design assms rea_cmt_RHS_design)\n\nlemma R1_R2s_peri_SRD:\n  assumes \"P is SRD\"\n  shows \"R1(R2s(peri\\<^sub>R(P))) = peri\\<^sub>R(P)\"\n  by (metis (no_types, opaque_lifting) Healthy_def R1_R2s_R2c R2_def R2_idem RHS_def SRD_RH_design_form assms R1_idem peri\\<^sub>R_def peri\\<^sub>s_R1 peri\\<^sub>s_R2c)\n\nlemma R1_peri_SRD:\n  assumes \"P is SRD\"\n  shows \"R1(peri\\<^sub>R(P)) = peri\\<^sub>R(P)\"\nproof -\n  have \"R1(peri\\<^sub>R(P)) = R1(R1(R2s(peri\\<^sub>R(P))))\"\n    by (simp add: R1_R2s_peri_SRD assms)\n  also have \"... = peri\\<^sub>R(P)\"\n    by (simp add: R1_idem, simp add: R1_R2s_peri_SRD assms)\n  finally show ?thesis .\nqed\n\nlemma R1_R2c_peri_RHS:\n  assumes \"P is SRD\"\n  shows \"R1(R2c(peri\\<^sub>R(P))) = peri\\<^sub>R(P)\"\n  by (metis R1_R2s_R2c R1_R2s_peri_SRD assms)\n\nlemma R1_R2s_post_SRD:\n  assumes \"P is SRD\"\n  shows \"R1(R2s(post\\<^sub>R(P))) = post\\<^sub>R(P)\"\n  by (metis (no_types, opaque_lifting) Healthy_def R1_R2s_R2c R1_idem R2_def R2_idem RHS_def SRD_RH_design_form assms post\\<^sub>R_def post\\<^sub>s_R1 post\\<^sub>s_R2c)\n\nlemma R2c_peri_SRD:\n  assumes \"P is SRD\"\n  shows \"R2c(peri\\<^sub>R(P)) = peri\\<^sub>R(P)\"\n  by (metis R1_R2c_commute R1_R2c_peri_RHS R1_peri_SRD assms)\n\nlemma R1_post_SRD:\n  assumes \"P is SRD\"\n  shows \"R1(post\\<^sub>R(P)) = post\\<^sub>R(P)\"\nproof -\n  have \"R1(post\\<^sub>R(P)) = R1(R1(R2s(post\\<^sub>R(P))))\"\n    by (simp add: R1_R2s_post_SRD assms)\n  also have \"... = post\\<^sub>R(P)\"\n    by (simp add: R1_idem, simp add: R1_R2s_post_SRD assms)\n  finally show ?thesis .\nqed\n\nlemma R2c_post_SRD:\n  assumes \"P is SRD\"\n  shows \"R2c(post\\<^sub>R(P)) = post\\<^sub>R(P)\"\n  by (metis R1_R2c_commute R1_R2s_R2c R1_R2s_post_SRD R1_post_SRD assms)\n\nlemma R1_R2c_post_RHS:\n  assumes \"P is SRD\"\n  shows \"R1(R2c(post\\<^sub>R(P))) = post\\<^sub>R(P)\"\n  by (metis R1_R2s_R2c R1_R2s_post_SRD assms)\n\nlemma R2_cmt_conj_wait':\n  \"P is SRD \\<Longrightarrow> R2(cmt\\<^sub>R P \\<and> \\<not> $wait\\<acute>) = (cmt\\<^sub>R P \\<and> \\<not> $wait\\<acute>)\"\n  by (simp add: R2_def R2s_conj R2s_not R2s_wait' R1_extend_conj R1_R2s_cmt_SRD)\n\nlemma R2c_preR:\n  \"P is SRD \\<Longrightarrow> R2c(pre\\<^sub>R(P)) = pre\\<^sub>R(P)\"\n  by (metis (no_types, lifting) R1_R2c_commute R2c_idem SRD_reactive_design rea_pre_RHS_design)\n\nlemma preR_R2_closed [closure]: \n  assumes \"P is R2\"\n  shows \"pre\\<^sub>R P is R2\"\nproof -\n  have \"R2(pre\\<^sub>R(R2(P))) = pre\\<^sub>R(R2(P))\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n\nlemma periR_R2_closed [closure]: \n  assumes \"P is R2\"\n  shows \"peri\\<^sub>R P is R2\"\nproof -\n  have \"R2(peri\\<^sub>R(R2(P))) = peri\\<^sub>R(R2(P))\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n\nlemma postR_R2_closed [closure]: \n  assumes \"P is R2\"\n  shows \"post\\<^sub>R P is R2\"\nproof -\n  have \"R2(post\\<^sub>R(R2(P))) = post\\<^sub>R(R2(P))\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n\nlemma postR_SRD_R1 [closure]: \"P is SRD \\<Longrightarrow> post\\<^sub>R(P) is R1\"\n  by (simp add: Healthy_def' R1_post_SRD)\n\nlemma R2c_periR:\n  \"P is SRD \\<Longrightarrow> R2c(peri\\<^sub>R(P)) = peri\\<^sub>R(P)\"\n  by (metis (no_types, lifting) R1_R2c_commute R1_R2s_R2c R1_R2s_peri_SRD R2c_idem)\n\nlemma R2c_postR:\n  \"P is SRD \\<Longrightarrow> R2c(post\\<^sub>R(P)) = post\\<^sub>R(P)\"\n  by (metis (no_types, opaque_lifting) R1_R2c_commute R1_R2c_is_R2 R1_R2s_post_SRD R2_def R2s_idem)\n\nlemma periR_RR [closure]: \"P is R2 \\<Longrightarrow> peri\\<^sub>R(P) is RR\"\n  by (rule RR_intro, simp_all add: closure unrest)\n  \nlemma postR_RR [closure]: \"P is R2 \\<Longrightarrow> post\\<^sub>R(P) is RR\"\n  by (rule RR_intro, simp_all add: closure unrest)\n\nlemma wpR_trace_ident_pre [wp]:\n  \"($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R) wp\\<^sub>r pre\\<^sub>R P = pre\\<^sub>R P\"\n  by (rel_auto)\n    \nlemma R1_preR [closure]:\n  \"pre\\<^sub>R(P) is R1\"\n  by (rel_auto)\n\nlemma trace_ident_left_periR:\n  \"($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R) ;; peri\\<^sub>R(P) = peri\\<^sub>R(P)\"\n  by (rel_auto)\n\nlemma trace_ident_left_postR:\n  \"($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R) ;; post\\<^sub>R(P) = post\\<^sub>R(P)\"\n  by (rel_auto)\n\nlemma trace_ident_right_postR:\n  \"post\\<^sub>R(P) ;; ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R) = post\\<^sub>R(P)\"\n  by (rel_auto)\n\nsubsubsection \\<open> Calculation laws \\<close>\n\nlemma wait'_cond_peri_post_cmt [rdes]:\n  \"cmt\\<^sub>R P = peri\\<^sub>R P \\<diamondop> post\\<^sub>R P\"\n  by (rel_auto)\n\nlemma preR_rdes [rdes]: \n  assumes \"P is RR\"\n  shows \"pre\\<^sub>R(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = P\"\n  by (simp add: rea_pre_RH_design unrest usubst assms Healthy_if RR_implies_R2c RR_implies_R1)\n\nlemma preR_srdes [rdes]: \n  assumes \"P is RR\"\n  shows \"pre\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = P\"\n  by (simp add: rea_pre_RHS_design unrest usubst assms Healthy_if RR_implies_R2c RR_implies_R1)\n\nlemma periR_rdes [rdes]: \n  assumes \"P is RR\" \"Q is RR\"\n  shows \"peri\\<^sub>R(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = (P \\<Rightarrow>\\<^sub>r Q)\"\n  by (simp add: rea_peri_RH_design unrest usubst assms Healthy_if RR_implies_R2c closure)\n\nlemma periR_srdes [rdes]: \n  assumes \"P is RR\" \"Q is RR\"\n  shows \"peri\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = (P \\<Rightarrow>\\<^sub>r Q)\"\n  by (simp add: rea_peri_RHS_design unrest usubst assms Healthy_if RR_implies_R2c closure)\n\nlemma postR_rdes [rdes]: \n  assumes \"P is RR\" \"R is RR\"\n  shows \"post\\<^sub>R(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = (P \\<Rightarrow>\\<^sub>r R)\"\n  by (simp add: rea_post_RH_design unrest usubst assms Healthy_if RR_implies_R2c closure)\n\nlemma postR_srdes [rdes]: \n  assumes \"P is RR\" \"R is RR\"\n  shows \"post\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = (P \\<Rightarrow>\\<^sub>r R)\"\n  by (simp add: rea_post_RHS_design unrest usubst assms Healthy_if RR_implies_R2c closure)\n    \nlemma preR_Chaos [rdes]: \"pre\\<^sub>R(Chaos) = false\"\n  by (simp add: Chaos_def, rel_simp)\n\nlemma periR_Chaos [rdes]: \"peri\\<^sub>R(Chaos) = true\\<^sub>r\"\n  by (simp add: Chaos_def, rel_simp)\n\nlemma postR_Chaos [rdes]: \"post\\<^sub>R(Chaos) = true\\<^sub>r\"\n  by (simp add: Chaos_def, rel_simp)\n\nlemma preR_Miracle [rdes]: \"pre\\<^sub>R(Miracle) = true\\<^sub>r\"\n  by (simp add: Miracle_def, rel_auto)\n\nlemma periR_Miracle [rdes]: \"peri\\<^sub>R(Miracle) = false\"\n  by (simp add: Miracle_def, rel_auto)\n\nlemma postR_Miracle [rdes]: \"post\\<^sub>R(Miracle) = false\"\n  by (simp add: Miracle_def, rel_auto)\n\nlemma preR_srdes_skip [rdes]: \"pre\\<^sub>R(II\\<^sub>R) = true\\<^sub>r\"\n  by (rel_auto)\n\nlemma periR_srdes_skip [rdes]: \"peri\\<^sub>R(II\\<^sub>R) = false\"\n  by (rel_auto)\n\nlemma postR_srdes_skip [rdes]: \"post\\<^sub>R(II\\<^sub>R) = ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R)\"\n  by (rel_auto)\n\nlemma preR_INF [rdes]: \"A \\<noteq> {} \\<Longrightarrow> pre\\<^sub>R(\\<Sqinter> A) = (\\<And> P\\<in>A \\<bullet> pre\\<^sub>R(P))\"\n  by (rel_auto)\n\nlemma periR_INF [rdes]: \"peri\\<^sub>R(\\<Sqinter> A) = (\\<Or> P\\<in>A \\<bullet> peri\\<^sub>R(P))\"\n  by (rel_auto)\n\nlemma postR_INF [rdes]: \"post\\<^sub>R(\\<Sqinter> A) = (\\<Or> P\\<in>A \\<bullet> post\\<^sub>R(P))\"\n  by (rel_auto)\n\nlemma preR_UINF [rdes]: \"pre\\<^sub>R(\\<Sqinter> i \\<bullet> P(i)) = (\\<Squnion> i \\<bullet> pre\\<^sub>R(P(i)))\"\n  by (rel_auto)\n\nlemma periR_UINF [rdes]: \"peri\\<^sub>R(\\<Sqinter> i \\<bullet> P(i)) = (\\<Sqinter> i \\<bullet> peri\\<^sub>R(P(i)))\"\n  by (rel_auto)\n\nlemma postR_UINF [rdes]: \"post\\<^sub>R(\\<Sqinter> i \\<bullet> P(i)) = (\\<Sqinter> i \\<bullet> post\\<^sub>R(P(i)))\"\n  by (rel_auto)\n\nlemma preR_UINF_member [rdes]: \"A \\<noteq> {} \\<Longrightarrow> pre\\<^sub>R(\\<Sqinter> i\\<in>A \\<bullet> P(i)) = (\\<Squnion> i\\<in>A \\<bullet> pre\\<^sub>R(P(i)))\"\n  by (rel_auto)\n    \nlemma preR_UINF_member_2 [rdes]: \"A \\<noteq> {} \\<Longrightarrow> pre\\<^sub>R(\\<Sqinter> (i,j)\\<in>A \\<bullet> P i j) = (\\<Squnion> (i,j)\\<in>A \\<bullet> pre\\<^sub>R(P i j))\"\n  by (rel_auto)\n\nlemma preR_UINF_member_3 [rdes]: \"A \\<noteq> {} \\<Longrightarrow> pre\\<^sub>R(\\<Sqinter> (i,j,k)\\<in>A \\<bullet> P i j k) = (\\<Squnion> (i,j,k)\\<in>A \\<bullet> pre\\<^sub>R(P i j k))\"\n  by (rel_auto)\n\nlemma periR_UINF_member [rdes]: \"peri\\<^sub>R(\\<Sqinter> i\\<in>A \\<bullet> P(i)) = (\\<Sqinter> i\\<in>A \\<bullet> peri\\<^sub>R(P(i)))\"\n  by (rel_auto)\n    \nlemma periR_UINF_member_2 [rdes]: \"peri\\<^sub>R(\\<Sqinter> (i,j)\\<in>A \\<bullet> P i j) = (\\<Sqinter> (i,j)\\<in>A \\<bullet> peri\\<^sub>R(P i j))\"\n  by (rel_auto)\n\nlemma periR_UINF_member_3 [rdes]: \"peri\\<^sub>R(\\<Sqinter> (i,j,k)\\<in>A \\<bullet> P i j k) = (\\<Sqinter> (i,j,k)\\<in>A \\<bullet> peri\\<^sub>R(P i j k))\"\n  by (rel_auto)\n\nlemma postR_UINF_member [rdes]: \"post\\<^sub>R(\\<Sqinter> i\\<in>A \\<bullet> P(i)) = (\\<Sqinter> i\\<in>A \\<bullet> post\\<^sub>R(P(i)))\"\n  by (rel_auto)\n\nlemma postR_UINF_member_2 [rdes]: \"post\\<^sub>R(\\<Sqinter> (i,j)\\<in>A \\<bullet> P i j) = (\\<Sqinter> (i,j)\\<in>A \\<bullet> post\\<^sub>R(P i j))\"\n  by (rel_auto)\n    \nlemma postR_UINF_member_3 [rdes]: \"post\\<^sub>R(\\<Sqinter> (i,j,k)\\<in>A \\<bullet> P i j k) = (\\<Sqinter> (i,j,k)\\<in>A \\<bullet> post\\<^sub>R(P i j k))\"\n  by (rel_auto)    \n    \nlemma preR_inf [rdes]: \"pre\\<^sub>R(P \\<sqinter> Q) = (pre\\<^sub>R(P) \\<and> pre\\<^sub>R(Q))\"\n  by (rel_auto)\n\nlemma periR_inf [rdes]: \"peri\\<^sub>R(P \\<sqinter> Q) = (peri\\<^sub>R(P) \\<or> peri\\<^sub>R(Q))\"\n  by (rel_auto)\n\nlemma postR_inf [rdes]: \"post\\<^sub>R(P \\<sqinter> Q) = (post\\<^sub>R(P) \\<or> post\\<^sub>R(Q))\"\n  by (rel_auto)\n\nlemma preR_SUP [rdes]: \"pre\\<^sub>R(\\<Squnion> A) = (\\<Or> P\\<in>A \\<bullet> pre\\<^sub>R(P))\"\n  by (rel_auto)\n\nlemma periR_SUP [rdes]: \"A \\<noteq> {} \\<Longrightarrow> peri\\<^sub>R(\\<Squnion> A) = (\\<And> P\\<in>A \\<bullet> peri\\<^sub>R(P))\"\n  by (rel_auto)\n\nlemma postR_SUP [rdes]: \"A \\<noteq> {} \\<Longrightarrow> post\\<^sub>R(\\<Squnion> A) = (\\<And> P\\<in>A \\<bullet> post\\<^sub>R(P))\"\n  by (rel_auto)\n\nsubsection \\<open> Formation laws \\<close>\n\nsubsubsection \\<open> Regular \\<close>\n\nlemma rdes_skip_tri_design [rdes_def]: \"II\\<^sub>C = \\<^bold>R(true\\<^sub>r \\<turnstile> false \\<diamondop> II\\<^sub>r)\"\n  apply (simp add: skip_rea_def, rel_auto)\n  using minus_zero_eq apply blast+\n  done\n\nlemma RH_tri_design_form:\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = (II\\<^sub>C \\<triangleleft> $wait \\<triangleright> (($ok \\<and> P\\<^sub>1) \\<Rightarrow>\\<^sub>r ($ok\\<acute> \\<and> (P\\<^sub>2 \\<diamondop> P\\<^sub>3))))\"\nproof -\n  have \"\\<^bold>R(RR(P\\<^sub>1) \\<turnstile> RR(P\\<^sub>2) \\<diamondop> RR(P\\<^sub>3)) = (II\\<^sub>C \\<triangleleft> $wait \\<triangleright> (($ok \\<and> RR(P\\<^sub>1)) \\<Rightarrow>\\<^sub>r ($ok\\<acute> \\<and> (RR(P\\<^sub>2) \\<diamondop> RR(P\\<^sub>3)))))\"\n    apply (rel_auto) using minus_zero_eq by blast\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma RH_design_pre_post_form:\n  \"\\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f) = \\<^bold>R(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\nproof -\n  have \"\\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f) = \\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f)\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>true/$ok\\<rbrakk>)\"\n    by (simp add: design_subst_ok)\n  also have \"... = \\<^bold>R(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n    by (simp add: pre\\<^sub>R_def cmt\\<^sub>R_def usubst, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma RD_as_reactive_design:\n  \"RD(P) = \\<^bold>R(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n  by (simp add: RH_design_pre_post_form RD_RH_design_form)\n\nlemma RD_reactive_design_alt:\n  assumes \"P is RD\"\n  shows \"\\<^bold>R(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) = P\"\nproof -\n  have \"\\<^bold>R(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) = \\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f)\"\n    by (simp add: RH_design_pre_post_form)\n  thus ?thesis\n    by (simp add: RD_reactive_design assms)\nqed\n\nlemma RD_reactive_tri_design_lemma:\n  \"RD(P) = \\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<diamondop> P\\<^sup>t\\<^sub>f\\<lbrakk>false/$wait\\<acute>\\<rbrakk>)\"\n  by (simp add: RD_RH_design_form wait'_cond_split)\n\nlemma RD_as_reactive_tri_design:\n  \"RD(P) = \\<^bold>R(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P))\"\nproof -\n  have \"RD(P) = \\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<diamondop> P\\<^sup>t\\<^sub>f\\<lbrakk>false/$wait\\<acute>\\<rbrakk>)\"\n    by (simp add: RD_RH_design_form wait'_cond_split)\n  also have \"... = \\<^bold>R(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P))\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nlemma RD_reactive_tri_design:\n  assumes \"P is RD\"\n  shows \"\\<^bold>R(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) = P\"\n  by (metis Healthy_if RD_as_reactive_tri_design assms)\n    \nlemma RD_elimination [RD_elim]: \"\\<lbrakk> P is RD; Q(\\<^bold>R(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)))  \\<rbrakk> \\<Longrightarrow> Q(P)\"\n  by (simp add: RD_reactive_tri_design)\n    \nlemma RH_tri_design_is_RD [closure]:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\" \"$ok\\<acute> \\<sharp> R\"\n  shows \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R) is RD\"\n  by (rule RH_design_is_RD, simp_all add: unrest assms)\n\nlemma RD_rdes_intro [closure]:\n  assumes \"P is RR\" \"Q is RR\" \"R is RR\"\n  shows \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R) is RD\"\n  by (rule RH_tri_design_is_RD, simp_all add: unrest closure assms)\n\nsubsubsection \\<open> Stateful \\<close>\n\nlemma srdes_skip_tri_design [rdes_def]: \"II\\<^sub>R = \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> false \\<diamondop> II\\<^sub>r)\"\n  by (simp add: srdes_skip_def, rel_auto)\n\nlemma Chaos_tri_def [rdes_def]: \"Chaos = \\<^bold>R\\<^sub>s(false \\<turnstile> false \\<diamondop> false)\"\n  by (simp add: Chaos_def design_false_pre)\n\nlemma Miracle_tri_def [rdes_def]: \"Miracle = \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> false \\<diamondop> false)\"\n  by (simp add: Miracle_def R1_design_R1_pre wait'_cond_idem)\n\nlemma RHS_tri_design_form:\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = (II\\<^sub>R \\<triangleleft> $wait \\<triangleright> (($ok \\<and> P\\<^sub>1) \\<Rightarrow>\\<^sub>r ($ok\\<acute> \\<and> (P\\<^sub>2 \\<diamondop> P\\<^sub>3))))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(RR(P\\<^sub>1) \\<turnstile> RR(P\\<^sub>2) \\<diamondop> RR(P\\<^sub>3)) = (II\\<^sub>R \\<triangleleft> $wait \\<triangleright> (($ok \\<and> RR(P\\<^sub>1)) \\<Rightarrow>\\<^sub>r ($ok\\<acute> \\<and> (RR(P\\<^sub>2) \\<diamondop> RR(P\\<^sub>3)))))\"\n    apply (rel_auto) using minus_zero_eq by blast\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma RHS_design_pre_post_form:\n  \"\\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f) = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f) = \\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f)\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>true/$ok\\<rbrakk>)\"\n    by (simp add: design_subst_ok)\n  also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n    by (simp add: pre\\<^sub>R_def cmt\\<^sub>R_def usubst, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma SRD_as_reactive_design:\n  \"SRD(P) = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n  by (simp add: RHS_design_pre_post_form SRD_RH_design_form)\n\nlemma SRD_reactive_design_alt:\n  assumes \"P is SRD\"\n  shows \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) = P\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) = \\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f)\"\n    by (simp add: RHS_design_pre_post_form)\n  thus ?thesis\n    by (simp add: SRD_reactive_design assms)\nqed\n\nlemma SRD_reactive_tri_design_lemma:\n  \"SRD(P) = \\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<diamondop> P\\<^sup>t\\<^sub>f\\<lbrakk>false/$wait\\<acute>\\<rbrakk>)\"\n  by (simp add: SRD_RH_design_form wait'_cond_split)\n\nlemma SRD_as_reactive_tri_design:\n  \"SRD(P) = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P))\"\nproof -\n  have \"SRD(P) = \\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<diamondop> P\\<^sup>t\\<^sub>f\\<lbrakk>false/$wait\\<acute>\\<rbrakk>)\"\n    by (simp add: SRD_RH_design_form wait'_cond_split)\n  also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P))\"\n    apply (simp add: usubst)\n    apply (subst design_subst_ok_ok'[THEN sym])\n    apply (simp add: pre\\<^sub>R_def peri\\<^sub>R_def post\\<^sub>R_def usubst unrest)\n    apply (rel_auto)\n  done\n  finally show ?thesis .\nqed\n\nlemma SRD_reactive_tri_design:\n  assumes \"P is SRD\"\n  shows \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) = P\"\n  by (metis Healthy_if SRD_as_reactive_tri_design assms)\n    \nlemma SRD_elim [RD_elim]: \"\\<lbrakk> P is SRD; Q(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)))  \\<rbrakk> \\<Longrightarrow> Q(P)\"\n  by (simp add: SRD_reactive_tri_design)\n    \nlemma RHS_tri_design_is_SRD [closure]:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\" \"$ok\\<acute> \\<sharp> R\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) is SRD\"\n  by (rule RHS_design_is_SRD, simp_all add: unrest assms)\n\nlemma SRD_rdes_intro [closure]:\n  assumes \"P is RR\" \"Q is RR\" \"R is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) is SRD\"\n  by (rule RHS_tri_design_is_SRD, simp_all add: unrest closure assms)\n        \nlemma USUP_R1_R2s_cmt_SRD:\n  assumes \"A \\<subseteq> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"(\\<Squnion> P \\<in> A \\<bullet> R1 (R2s (cmt\\<^sub>R P))) = (\\<Squnion> P \\<in> A \\<bullet> cmt\\<^sub>R P)\"\n  by (rule USUP_cong[of A], metis (mono_tags, lifting) Ball_Collect R1_R2s_cmt_SRD assms)\n\nlemma UINF_R1_R2s_cmt_SRD:\n  assumes \"A \\<subseteq> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"(\\<Sqinter> P \\<in> A \\<bullet> R1 (R2s (cmt\\<^sub>R P))) = (\\<Sqinter> P \\<in> A \\<bullet> cmt\\<^sub>R P)\"\n  by (rule UINF_cong[of A], metis (mono_tags, lifting) Ball_Collect R1_R2s_cmt_SRD assms)\n\nsubsubsection \\<open> Order laws \\<close>\n\nlemma preR_antitone: \"P \\<sqsubseteq> Q \\<Longrightarrow> pre\\<^sub>R(Q) \\<sqsubseteq> pre\\<^sub>R(P)\"\n  by (rel_auto)\n\nlemma periR_monotone: \"P \\<sqsubseteq> Q \\<Longrightarrow> peri\\<^sub>R(P) \\<sqsubseteq> peri\\<^sub>R(Q)\"\n  by (rel_auto)\n\nlemma postR_monotone: \"P \\<sqsubseteq> Q \\<Longrightarrow> post\\<^sub>R(P) \\<sqsubseteq> post\\<^sub>R(Q)\"\n  by (rel_auto)\n\nsubsection \\<open> Composition laws \\<close>\n\ntheorem R1_design_composition_RR:\n  assumes \"P is RR\" \"Q is RR\" \"R is RR\" \"S is RR\"\n  shows\n  \"(R1(P \\<turnstile> Q) ;; R1(R \\<turnstile> S)) = R1(((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<and> Q wp\\<^sub>r R) \\<turnstile> (Q ;; S))\"\n  apply (subst R1_design_composition)\n  apply (simp_all add: assms unrest wp_rea_def Healthy_if closure)\n  apply (rel_auto)\ndone\n\ntheorem R1_design_composition_RC:\n  assumes \"P is RC\" \"Q is RR\" \"R is RR\" \"S is RR\"\n  shows\n  \"(R1(P \\<turnstile> Q) ;; R1(R \\<turnstile> S)) = R1((P \\<and> Q wp\\<^sub>r R) \\<turnstile> (Q ;; S))\"\n  by (simp add: R1_design_composition_RR assms unrest Healthy_if closure wp)\n\nsubsubsection \\<open> Regular \\<close>\n\ntheorem RH_tri_design_composition:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n          \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n  shows \"(\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)) =\n       \\<^bold>R((\\<not> (R1 (\\<not> R2s P) ;; R1 true) \\<and> \\<not> (R1(R2s Q\\<^sub>2) ;; R1 (\\<not> R2s R))) \\<turnstile>\n                       ((Q\\<^sub>1 \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))))\"\nproof -\n  have 1:\"(\\<not> ((R1 (R2s (Q\\<^sub>1 \\<diamondop> Q\\<^sub>2)) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R))) =\n        (\\<not> ((R1 (R2s Q\\<^sub>2) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R)))\"\n    by (metis (no_types, opaque_lifting) R1_extend_conj R2s_conj R2s_not R2s_wait' wait'_cond_false)\n  have 2: \"(R1 (R2s (Q\\<^sub>1 \\<diamondop> Q\\<^sub>2)) ;; (\\<lceil>II\\<rceil>\\<^sub>D \\<triangleleft> $wait \\<triangleright> R1 (R2s (S\\<^sub>1 \\<diamondop> S\\<^sub>2)))) =\n                 (((R1 (R2s Q\\<^sub>1)) \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n  proof -\n    have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n                       = (((R1 (R2s Q\\<^sub>1)) \\<and> $wait\\<acute>))\"\n    proof -\n      have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> ((\\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n           = (R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> (\\<lceil>II\\<rceil>\\<^sub>D)))\"\n        by (rel_auto)\n      also have \"... = ((R1 (R2s Q\\<^sub>1) ;; \\<lceil>II\\<rceil>\\<^sub>D) \\<and> $wait\\<acute>)\"\n        by (rel_auto)\n      also from assms(2) have \"... = ((R1 (R2s Q\\<^sub>1)) \\<and> $wait\\<acute>)\"\n        by (rel_auto, blast)\n      finally show ?thesis .\n    qed\n\n    moreover have \"(R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> ((\\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n                  = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2)))\"\n    proof -\n      have \"(R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n            = (R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\"\n        by (metis (no_types, lifting) cond_def conj_disj_not_abs utp_pred_laws.double_compl utp_pred_laws.inf.left_idem utp_pred_laws.sup_assoc utp_pred_laws.sup_inf_absorb)\n\n      also have \"... = ((R1 (R2s Q\\<^sub>2))\\<lbrakk>false/$wait\\<acute>\\<rbrakk> ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))\\<lbrakk>false/$wait\\<rbrakk>)\"\n        by (metis false_alt_def seqr_right_one_point upred_eq_false wait_vwb_lens)\n\n      also have \"... = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2)))\"\n        by (simp add: wait'_cond_def usubst unrest assms)\n\n      finally show ?thesis .\n    qed\n\n    moreover\n    have \"((R1 (R2s Q\\<^sub>1) \\<and> $wait\\<acute>) \\<or> ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n          = (R1 (R2s Q\\<^sub>1) \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n      by (simp add: wait'_cond_def cond_seq_right_distr cond_and_T_integrate unrest)\n\n    ultimately show ?thesis\n      by (simp add: R2s_wait'_cond R1_wait'_cond wait'_cond_seq ex_conj_contr_right unrest)  \n  qed\n\n  from assms(7,8) have 3: \"(R1 (R2s Q\\<^sub>2) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R) = R1 (R2s Q\\<^sub>2) ;; R1 (\\<not> R2s R)\"\n    by (rel_auto, meson)\n\n  show ?thesis\n    by (simp add: RH_design_composition unrest assms 1 2 3, simp add: R1_R2s_R2c RH_design_lemma1)\nqed\n\ntheorem RH_tri_design_composition_wp:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n          \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n          \"P is R2c\" \"Q\\<^sub>1 is R1\" \"Q\\<^sub>1 is R2c\" \"Q\\<^sub>2 is R1\" \"Q\\<^sub>2 is R2c\"\n          \"R is R2c\" \"S\\<^sub>1 is R1\" \"S\\<^sub>1 is R2c\" \"S\\<^sub>2 is R1\" \"S\\<^sub>2 is R2c\"\n  shows \"\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n          \\<^bold>R(((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> ((Q\\<^sub>1 \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2)))\" (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs = \\<^bold>R ((\\<not> R1 (\\<not> P) ;; R1 true \\<and> \\<not> Q\\<^sub>2 ;; R1 (\\<not> R)) \\<turnstile> (Q\\<^sub>1 \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp add: RH_tri_design_composition assms Healthy_if R2c_healthy_R2s disj_upred_def)\n       (metis (no_types, opaque_lifting) R1_negate_R1 R2c_healthy_R2s assms(11,16))\n  also have \"... = ?rhs\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\ntheorem RH_tri_design_composition_RR_wp:\n  assumes \"P is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\"\n          \"R is RR\" \"S\\<^sub>1 is RR\" \"S\\<^sub>2 is RR\"\n  shows \"\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n          \\<^bold>R(((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> ((Q\\<^sub>1 \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2)))\" (is \"?lhs = ?rhs\")\n  by (simp add: RH_tri_design_composition_wp add: closure assms unrest RR_implies_R2c)\n\nlemma RH_tri_normal_design_composition:\n  assumes\n    \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n    \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n    \"P is R2c\" \"Q\\<^sub>1 is R1\" \"Q\\<^sub>1 is R2c\" \"Q\\<^sub>2 is R1\" \"Q\\<^sub>2 is R2c\"\n    \"R is R2c\" \"S\\<^sub>1 is R1\" \"S\\<^sub>1 is R2c\" \"S\\<^sub>2 is R1\" \"S\\<^sub>2 is R2c\"\n    \"R1 (\\<not> P) ;; R1(true) = R1(\\<not> P)\"\n  shows \"\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\n         = \\<^bold>R((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\nproof -\n  have \"\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n        \\<^bold>R((R1 (\\<not> P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp_all add: RH_tri_design_composition_wp rea_not_def assms unrest)\n  also have \"... = \\<^bold>R((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp add: assms wp_rea_def ex_unrest, rel_auto)\n  finally show ?thesis .\nqed\n  \nlemma RH_tri_normal_design_composition' [rdes_def]:\n  assumes \"P is RC\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"R is RR\" \"S\\<^sub>1 is RR\" \"S\\<^sub>2 is RR\"\n  shows \"\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\n         = \\<^bold>R((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\nproof -\n  have \"R1 (\\<not> P) ;; R1 true = R1(\\<not> P)\"\n    using RC_implies_RC1[OF assms(1)]\n    by (simp add: Healthy_def RC1_def rea_not_def)\n       (metis R1_negate_R1 R1_seqr utp_pred_laws.double_compl)\n  thus ?thesis\n    by (simp add: RH_tri_normal_design_composition assms closure unrest RR_implies_R2c)\nqed\n\nlemma RH_tri_design_right_unit_lemma:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\" \"$ok\\<acute> \\<sharp> R\" \"$wait\\<acute> \\<sharp> R\"\n  shows \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R) ;; II\\<^sub>C = \\<^bold>R((\\<not>\\<^sub>r (\\<not>\\<^sub>r P) ;; true\\<^sub>r) \\<turnstile> (Q \\<diamondop> R))\"\nproof -\n  have \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R) ;; II\\<^sub>C = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R) ;; \\<^bold>R(true \\<turnstile> false \\<diamondop> ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))\"\n    by (simp add: rdes_skip_tri_design, rel_auto)\n  also have \"... = \\<^bold>R ((\\<not> R1 (\\<not> R2s P) ;; R1 true) \\<turnstile> Q \\<diamondop> (R1 (R2s R) ;; R1 (R2s ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))))\"\n    by (simp_all add: RH_tri_design_composition assms unrest R2s_true R1_false R2s_false)\n  also have \"... = \\<^bold>R ((\\<not> R1 (\\<not> R2s P) ;; R1 true) \\<turnstile> Q \\<diamondop> R1 (R2s R))\"\n  proof -\n    from assms(3,4) have \"(R1 (R2s R) ;; R1 (R2s ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))) = R1 (R2s R)\"\n      by (rel_auto, metis (no_types, lifting) minus_zero_eq, meson order_refl trace_class.diff_cancel)\n    thus ?thesis\n      by simp\n  qed\n  also have \"... = \\<^bold>R((\\<not> (\\<not> P) ;; R1 true) \\<turnstile> (Q \\<diamondop> R))\"\n    by (metis (no_types, lifting) R1_R2s_R1_true_lemma R1_R2s_R2c R2c_not RH_design_R2c_pre RH_design_neg_R1_pre RH_design_post_R1 RH_design_post_R2s)\n  also have \"... = \\<^bold>R((\\<not>\\<^sub>r (\\<not>\\<^sub>r P) ;; true\\<^sub>r) \\<turnstile> Q \\<diamondop> R)\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nsubsubsection \\<open> Stateful \\<close>\n\ntheorem RHS_tri_design_composition:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n          \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n  shows \"(\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)) =\n       \\<^bold>R\\<^sub>s((\\<not> (R1 (\\<not> R2s P) ;; R1 true) \\<and> \\<not> (R1(R2s Q\\<^sub>2) ;; R1 (\\<not> R2s R))) \\<turnstile>\n                       (((\\<exists> $st\\<acute> \\<bullet> Q\\<^sub>1) \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))))\"\nproof -\n  have 1:\"(\\<not> ((R1 (R2s (Q\\<^sub>1 \\<diamondop> Q\\<^sub>2)) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R))) =\n        (\\<not> ((R1 (R2s Q\\<^sub>2) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R)))\"\n    by (metis (no_types, opaque_lifting) R1_extend_conj R2s_conj R2s_not R2s_wait' wait'_cond_false)\n  have 2: \"(R1 (R2s (Q\\<^sub>1 \\<diamondop> Q\\<^sub>2)) ;; ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s (S\\<^sub>1 \\<diamondop> S\\<^sub>2)))) =\n                 (((\\<exists> $st\\<acute> \\<bullet> R1 (R2s Q\\<^sub>1)) \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n  proof -\n    have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n                       = (\\<exists> $st\\<acute> \\<bullet> ((R1 (R2s Q\\<^sub>1)) \\<and> $wait\\<acute>))\"\n    proof -\n      have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n           = (R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> (\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D)))\"\n        by (rel_auto, blast+)\n      also have \"... = ((R1 (R2s Q\\<^sub>1) ;; (\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D)) \\<and> $wait\\<acute>)\"\n        by (rel_auto)\n      also from assms(2) have \"... = (\\<exists> $st\\<acute> \\<bullet> ((R1 (R2s Q\\<^sub>1)) \\<and> $wait\\<acute>))\"\n        by (rel_auto, blast)\n      finally show ?thesis .\n    qed\n\n    moreover have \"(R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n                  = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2)))\"\n    proof -\n      have \"(R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n            = (R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\"\n        by (metis (no_types, lifting) cond_def conj_disj_not_abs utp_pred_laws.double_compl utp_pred_laws.inf.left_idem utp_pred_laws.sup_assoc utp_pred_laws.sup_inf_absorb)\n\n      also have \"... = ((R1 (R2s Q\\<^sub>2))\\<lbrakk>false/$wait\\<acute>\\<rbrakk> ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))\\<lbrakk>false/$wait\\<rbrakk>)\"\n        by (metis false_alt_def seqr_right_one_point upred_eq_false wait_vwb_lens)\n\n      also have \"... = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2)))\"\n        by (simp add: wait'_cond_def usubst unrest assms)\n\n      finally show ?thesis .\n    qed\n\n    moreover\n    have \"((R1 (R2s Q\\<^sub>1) \\<and> $wait\\<acute>) \\<or> ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n          = (R1 (R2s Q\\<^sub>1) \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n      by (simp add: wait'_cond_def cond_seq_right_distr cond_and_T_integrate unrest)\n\n    ultimately show ?thesis\n      by (simp add: R2s_wait'_cond R1_wait'_cond wait'_cond_seq ex_conj_contr_right unrest)\n         (simp add: cond_and_T_integrate cond_seq_right_distr unrest_var wait'_cond_def)\n  qed\n\n  from assms(7,8) have 3: \"(R1 (R2s Q\\<^sub>2) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R) = R1 (R2s Q\\<^sub>2) ;; R1 (\\<not> R2s R)\"\n    by (rel_auto, blast, meson)\n\n  show ?thesis\n    apply (subst RHS_design_composition)\n    apply (simp_all add: assms)\n    apply (simp add: assms wait'_cond_def unrest)\n    apply (simp add: assms wait'_cond_def unrest)\n    apply (simp add: 1 2 3)\n    apply (simp add: R1_R2s_R2c RHS_design_lemma1)\n    apply (metis R1_R2c_ex_st RHS_design_lemma1)\n  done\nqed\n \ntheorem RHS_tri_design_composition_wp:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n          \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n          \"P is R2c\" \"Q\\<^sub>1 is R1\" \"Q\\<^sub>1 is R2c\" \"Q\\<^sub>2 is R1\" \"Q\\<^sub>2 is R2c\"\n          \"R is R2c\" \"S\\<^sub>1 is R1\" \"S\\<^sub>1 is R2c\" \"S\\<^sub>2 is R1\" \"S\\<^sub>2 is R2c\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n          \\<^bold>R\\<^sub>s(((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (((\\<exists> $st\\<acute> \\<bullet> Q\\<^sub>1) \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2)))\" (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs = \\<^bold>R\\<^sub>s ((\\<not> R1 (\\<not> P) ;; R1 true \\<and> \\<not> Q\\<^sub>2 ;; R1 (\\<not> R)) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q\\<^sub>1) \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp add: RHS_tri_design_composition assms Healthy_if R2c_healthy_R2s disj_upred_def)\n       (metis (no_types, opaque_lifting) R1_negate_R1 R2c_healthy_R2s assms(11,16))\n  also have \"... = ?rhs\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\ntheorem RHS_tri_design_composition_RR_wp:\n  assumes \"P is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\"\n          \"R is RR\" \"S\\<^sub>1 is RR\" \"S\\<^sub>2 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n          \\<^bold>R\\<^sub>s(((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (((\\<exists> $st\\<acute> \\<bullet> Q\\<^sub>1) \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2)))\" (is \"?lhs = ?rhs\")\n  by (simp add: RHS_tri_design_composition_wp add: closure assms unrest RR_implies_R2c)\n\nlemma RHS_tri_normal_design_composition:\n  assumes\n    \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n    \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n    \"P is R2c\" \"Q\\<^sub>1 is R1\" \"Q\\<^sub>1 is R2c\" \"Q\\<^sub>2 is R1\" \"Q\\<^sub>2 is R2c\"\n    \"R is R2c\" \"S\\<^sub>1 is R1\" \"S\\<^sub>1 is R2c\" \"S\\<^sub>2 is R1\" \"S\\<^sub>2 is R2c\"\n    \"R1 (\\<not> P) ;; R1(true) = R1(\\<not> P)\" \"$st\\<acute> \\<sharp> Q\\<^sub>1\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\n         = \\<^bold>R\\<^sub>s((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n        \\<^bold>R\\<^sub>s ((R1 (\\<not> P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q\\<^sub>1) \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp_all add: RHS_tri_design_composition_wp rea_not_def assms unrest)\n  also have \"... = \\<^bold>R\\<^sub>s((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp add: assms wp_rea_def ex_unrest, rel_auto)\n  finally show ?thesis .\nqed\n  \nlemma RHS_tri_normal_design_composition' [rdes_def]:\n  assumes \"P is RC\" \"Q\\<^sub>1 is RR\" \"$st\\<acute> \\<sharp> Q\\<^sub>1\" \"Q\\<^sub>2 is RR\" \"R is RR\" \"S\\<^sub>1 is RR\" \"S\\<^sub>2 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\n         = \\<^bold>R\\<^sub>s((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\nproof -\n  have \"R1 (\\<not> P) ;; R1 true = R1(\\<not> P)\"\n    using RC_implies_RC1[OF assms(1)]\n    by (simp add: Healthy_def RC1_def rea_not_def)\n       (metis R1_negate_R1 R1_seqr utp_pred_laws.double_compl)\n  thus ?thesis\n    by (simp add: RHS_tri_normal_design_composition assms closure unrest RR_implies_R2c)\nqed\n\nlemma RHS_tri_design_right_unit_lemma:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\" \"$ok\\<acute> \\<sharp> R\" \"$wait\\<acute> \\<sharp> R\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) ;; II\\<^sub>R = \\<^bold>R\\<^sub>s((\\<not>\\<^sub>r (\\<not>\\<^sub>r P) ;; true\\<^sub>r) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> R))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) ;; II\\<^sub>R = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) ;; \\<^bold>R\\<^sub>s(true \\<turnstile> false \\<diamondop> ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))\"\n    by (simp add: srdes_skip_tri_design, rel_auto)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not> R1 (\\<not> R2s P) ;; R1 true) \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> (R1 (R2s R) ;; R1 (R2s ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))))\"\n    by (simp_all add: RHS_tri_design_composition assms unrest R2s_true R1_false R2s_false)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not> R1 (\\<not> R2s P) ;; R1 true) \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> R1 (R2s R))\"\n  proof -\n    from assms(3,4) have \"(R1 (R2s R) ;; R1 (R2s ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))) = R1 (R2s R)\"\n      by (rel_auto, metis (no_types, lifting) minus_zero_eq, meson order_refl trace_class.diff_cancel)\n    thus ?thesis\n      by simp\n  qed\n  also have \"... = \\<^bold>R\\<^sub>s((\\<not> (\\<not> P) ;; R1 true) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> R))\"\n    by (metis (no_types, lifting) R1_R2s_R1_true_lemma R1_R2s_R2c R2c_not RHS_design_R2c_pre RHS_design_neg_R1_pre RHS_design_post_R1 RHS_design_post_R2s)\n  also have \"... = \\<^bold>R\\<^sub>s((\\<not>\\<^sub>r (\\<not>\\<^sub>r P) ;; true\\<^sub>r) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> R))\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nlemma RD_composition_wp:\n  assumes \"P is RD\" \"Q is RD\"\n  shows \"(P ;; Q) = \\<^bold>R (((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<and> post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q) \\<turnstile>\n                       (peri\\<^sub>R P \\<or> (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\<diamondop> (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"(P ;; Q) = (\\<^bold>R(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) ;; \\<^bold>R(pre\\<^sub>R(Q) \\<turnstile> peri\\<^sub>R(Q) \\<diamondop> post\\<^sub>R(Q)))\"\n    by (simp add: RD_reactive_tri_design assms(1) assms(2))\n  also from assms\n  have \"... = ?rhs\"\n    by (simp add: RH_tri_design_composition_wp unrest closure disj_upred_def)\n  finally show ?thesis .\nqed\n\nlemma SRD_composition_wp:\n  assumes \"P is SRD\" \"Q is SRD\"\n  shows \"(P ;; Q) = \\<^bold>R\\<^sub>s (((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<and> post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q) \\<turnstile>\n                       ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<or> (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\<diamondop> (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"(P ;; Q) = (\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\<turnstile> peri\\<^sub>R(Q) \\<diamondop> post\\<^sub>R(Q)))\"\n    by (simp add: SRD_reactive_tri_design assms(1) assms(2))\n  also from assms\n  have \"... = ?rhs\"\n    by (simp add: RHS_tri_design_composition_wp disj_upred_def unrest assms closure)\n  finally show ?thesis .\nqed\n\nsubsection \\<open> Refinement introduction laws \\<close>\n\nsubsubsection \\<open> Regular \\<close>\n\nlemma RH_tri_design_refine:\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"Q\\<^sub>3 is RR\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqsubseteq> \\<^bold>R(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>2 \\<Rightarrow> P\\<^sub>2` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>3 \\<Rightarrow> P\\<^sub>3`\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3 \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3`\"\n    by (simp add: RH_design_refine assms closure RR_implies_R2c unrest ex_unrest)\n  also have \"... \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `(P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3`\"\n    by (rel_auto)\n  also have \"... \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `((P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3)\\<lbrakk>true/$wait\\<acute>\\<rbrakk>` \\<and> `((P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3)\\<lbrakk>false/$wait\\<acute>\\<rbrakk>`\"\n    by (rel_auto, metis)\n  also have \"... \\<longleftrightarrow> ?rhs\"\n    by (simp add: usubst unrest assms)\n  finally show ?thesis .\nqed\n\nlemma RH_tri_design_refine':\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"Q\\<^sub>3 is RR\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqsubseteq> \\<^bold>R(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> (Q\\<^sub>1 \\<sqsubseteq> P\\<^sub>1) \\<and> (P\\<^sub>2 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)) \\<and> (P\\<^sub>3 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>3))\"\n  by (simp add: RH_tri_design_refine assms, rel_auto)\n\nlemma rdes_tri_refine_intro:\n  assumes \"`P\\<^sub>1 \\<Rightarrow> P\\<^sub>2`\" \"`P\\<^sub>1 \\<and> Q\\<^sub>2 \\<Rightarrow> Q\\<^sub>1`\" \"`P\\<^sub>1 \\<and> R\\<^sub>2 \\<Rightarrow> R\\<^sub>1`\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<diamondop> R\\<^sub>1) \\<sqsubseteq> \\<^bold>R(P\\<^sub>2 \\<turnstile> Q\\<^sub>2 \\<diamondop> R\\<^sub>2)\"\n  using assms\n  by (rule_tac rdes_refine_intro, simp_all, rel_auto)  \n    \nlemma rdes_tri_refine_intro':\n  assumes \"P\\<^sub>2 \\<sqsubseteq> P\\<^sub>1\" \"Q\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)\" \"R\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> R\\<^sub>2)\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<diamondop> R\\<^sub>1) \\<sqsubseteq> \\<^bold>R(P\\<^sub>2 \\<turnstile> Q\\<^sub>2 \\<diamondop> R\\<^sub>2)\"\n  using assms\n  by (rule_tac rdes_tri_refine_intro, simp_all add: refBy_order)\n\nsubsubsection \\<open> Stateful \\<close>\n\nlemma RHS_tri_design_refine:\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"Q\\<^sub>3 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqsubseteq> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>2 \\<Rightarrow> P\\<^sub>2` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>3 \\<Rightarrow> P\\<^sub>3`\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3 \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3`\"\n    by (simp add: RHS_design_refine assms closure RR_implies_R2c unrest ex_unrest)\n  also have \"... \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `(P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3`\"\n    by (rel_auto)\n  also have \"... \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `((P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3)\\<lbrakk>true/$wait\\<acute>\\<rbrakk>` \\<and> `((P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3)\\<lbrakk>false/$wait\\<acute>\\<rbrakk>`\"\n    by (rel_auto, metis)\n  also have \"... \\<longleftrightarrow> ?rhs\"\n    by (simp add: usubst unrest assms)\n  finally show ?thesis .\nqed\n\nlemma RHS_tri_design_refine':\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"Q\\<^sub>3 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqsubseteq> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> (Q\\<^sub>1 \\<sqsubseteq> P\\<^sub>1) \\<and> (P\\<^sub>2 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)) \\<and> (P\\<^sub>3 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>3))\"\n  by (simp add: RHS_tri_design_refine assms, rel_auto)\n\nlemma srdes_tri_refine_intro:\n  assumes \"`P\\<^sub>1 \\<Rightarrow> P\\<^sub>2`\" \"`P\\<^sub>1 \\<and> Q\\<^sub>2 \\<Rightarrow> Q\\<^sub>1`\" \"`P\\<^sub>1 \\<and> R\\<^sub>2 \\<Rightarrow> R\\<^sub>1`\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<diamondop> R\\<^sub>1) \\<sqsubseteq> \\<^bold>R\\<^sub>s(P\\<^sub>2 \\<turnstile> Q\\<^sub>2 \\<diamondop> R\\<^sub>2)\"\n  using assms\n  by (rule_tac srdes_refine_intro, simp_all, rel_auto)  \n    \nlemma srdes_tri_refine_intro':\n  assumes \"P\\<^sub>2 \\<sqsubseteq> P\\<^sub>1\" \"Q\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)\" \"R\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> R\\<^sub>2)\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<diamondop> R\\<^sub>1) \\<sqsubseteq> \\<^bold>R\\<^sub>s(P\\<^sub>2 \\<turnstile> Q\\<^sub>2 \\<diamondop> R\\<^sub>2)\"\n  using assms\n  by (rule_tac srdes_tri_refine_intro, simp_all add: refBy_order)\n\nlemma SRD_peri_under_pre:\n  assumes \"P is SRD\" \"$wait\\<acute> \\<sharp> pre\\<^sub>R(P)\"\n  shows \"(pre\\<^sub>R(P) \\<Rightarrow>\\<^sub>r peri\\<^sub>R(P)) = peri\\<^sub>R(P)\"\nproof -\n  have \"peri\\<^sub>R(P) =\n        peri\\<^sub>R(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)))\"\n    by (simp add: SRD_reactive_tri_design assms)\n  also have \"... = (pre\\<^sub>R P \\<Rightarrow>\\<^sub>r peri\\<^sub>R P)\"\n    by (simp add: rea_pre_RHS_design rea_peri_RHS_design assms \n        unrest usubst R1_peri_SRD R2c_preR R1_rea_impl R2c_rea_impl R2c_periR)\n  finally show ?thesis ..\nqed\n\nlemma SRD_post_under_pre:\n  assumes \"P is SRD\" \"$wait\\<acute> \\<sharp> pre\\<^sub>R(P)\"\n  shows \"(pre\\<^sub>R(P) \\<Rightarrow>\\<^sub>r post\\<^sub>R(P)) = post\\<^sub>R(P)\"\nproof -\n  have \"post\\<^sub>R(P) =\n        post\\<^sub>R(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)))\"\n    by (simp add: SRD_reactive_tri_design assms)\n  also have \"... = (pre\\<^sub>R P \\<Rightarrow>\\<^sub>r post\\<^sub>R P)\"\n    by (simp add: rea_pre_RHS_design rea_post_RHS_design assms \n        unrest usubst R1_post_SRD R2c_preR R1_rea_impl R2c_rea_impl R2c_postR)\n  finally show ?thesis ..\nqed\n\nlemma SRD_refine_intro:\n  assumes\n    \"P is SRD\" \"Q is SRD\"\n    \"`pre\\<^sub>R(P) \\<Rightarrow> pre\\<^sub>R(Q)`\" \"`pre\\<^sub>R(P) \\<and> peri\\<^sub>R(Q) \\<Rightarrow> peri\\<^sub>R(P)`\" \"`pre\\<^sub>R(P) \\<and> post\\<^sub>R(Q) \\<Rightarrow> post\\<^sub>R(P)`\"\n  shows \"P \\<sqsubseteq> Q\"\n  by (metis SRD_reactive_tri_design assms(1) assms(2) assms(3) assms(4) assms(5) srdes_tri_refine_intro)\n\nlemma SRD_refine_intro':\n  assumes\n    \"P is SRD\" \"Q is SRD\"\n    \"`pre\\<^sub>R(P) \\<Rightarrow> pre\\<^sub>R(Q)`\" \"peri\\<^sub>R(P) \\<sqsubseteq> (pre\\<^sub>R(P) \\<and> peri\\<^sub>R(Q))\" \"post\\<^sub>R(P) \\<sqsubseteq> (pre\\<^sub>R(P) \\<and> post\\<^sub>R(Q))\"\n  shows \"P \\<sqsubseteq> Q\"\n  using assms by (rule_tac SRD_refine_intro, simp_all add: refBy_order)\n \nlemma SRD_eq_intro:\n  assumes\n    \"P is SRD\" \"Q is SRD\" \"pre\\<^sub>R(P) = pre\\<^sub>R(Q)\" \"peri\\<^sub>R(P) = peri\\<^sub>R(Q)\" \"post\\<^sub>R(P) = post\\<^sub>R(Q)\"\n  shows \"P = Q\"\n  by (metis SRD_reactive_tri_design assms)\n\nlemma srdes_tri_eq_iff:\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"Q\\<^sub>3 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> (P\\<^sub>1 = Q\\<^sub>1 \\<and> (P\\<^sub>1 \\<and> Q\\<^sub>2) = (Q\\<^sub>1 \\<and> P\\<^sub>2) \\<and> (P\\<^sub>1 \\<and> Q\\<^sub>3) = (Q\\<^sub>1 \\<and> P\\<^sub>3))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> \n        (\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqsubseteq> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<and> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<sqsubseteq> \\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3))\"\n    by fastforce\n  also have \"... = (Q\\<^sub>1 \\<sqsubseteq> P\\<^sub>1 \\<and> P\\<^sub>2 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2) \\<and> P\\<^sub>3 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<and> P\\<^sub>1 \\<sqsubseteq> Q\\<^sub>1 \\<and> Q\\<^sub>2 \\<sqsubseteq> (Q\\<^sub>1 \\<and> P\\<^sub>2) \\<and> Q\\<^sub>3 \\<sqsubseteq> (Q\\<^sub>1 \\<and> P\\<^sub>3))\"\n    by (simp add: RHS_tri_design_refine' assms)\n  also have \"... = (P\\<^sub>1 = Q\\<^sub>1 \\<and> P\\<^sub>2 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2) \\<and> P\\<^sub>3 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<and> Q\\<^sub>2 \\<sqsubseteq> (Q\\<^sub>1 \\<and> P\\<^sub>2) \\<and> Q\\<^sub>3 \\<sqsubseteq> (Q\\<^sub>1 \\<and> P\\<^sub>3))\"\n    by fastforce\n  also have \"... = (P\\<^sub>1 = Q\\<^sub>1 \\<and> (P\\<^sub>1 \\<and> Q\\<^sub>2) = (Q\\<^sub>1 \\<and> P\\<^sub>2) \\<and> (P\\<^sub>1 \\<and> Q\\<^sub>3) = (Q\\<^sub>1 \\<and> P\\<^sub>3))\"\n    apply (safe, simp_all)\n    apply (meson eq_iff utp_pred_laws.inf_greatest utp_pred_laws.inf_le1)+\n     apply (metis utp_pred_laws.inf_le2)+\n    done\n  finally show ?thesis .\nqed\n\nlemma rdes_tri_eq_intro:\n  assumes \"P\\<^sub>1 = Q\\<^sub>1\" \"(P\\<^sub>1 \\<and> Q\\<^sub>2) = (Q\\<^sub>1 \\<and> P\\<^sub>2)\" \"(P\\<^sub>1 \\<and> Q\\<^sub>3) = (Q\\<^sub>1 \\<and> P\\<^sub>3)\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)\"\n  by (metis (no_types, opaque_lifting) assms(1) assms(2) assms(3) design_export_pre wait'_cond_conj_exchange wait'_cond_idem)\n\nlemma srdes_tri_eq_intro:\n  assumes \"P\\<^sub>1 = Q\\<^sub>1\" \"(P\\<^sub>1 \\<and> Q\\<^sub>2) = (Q\\<^sub>1 \\<and> P\\<^sub>2)\" \"(P\\<^sub>1 \\<and> Q\\<^sub>3) = (Q\\<^sub>1 \\<and> P\\<^sub>3)\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)\"\n  by (metis (no_types, opaque_lifting) assms(1) assms(2) assms(3) design_export_pre wait'_cond_conj_exchange wait'_cond_idem)\n\nlemma rdes_tri_eq_intro':\n  assumes \"P\\<^sub>1 = Q\\<^sub>1\" \"P\\<^sub>2 = Q\\<^sub>2\" \"P\\<^sub>3 = Q\\<^sub>3\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)\"\n  using assms by (simp)\n\nlemma srdes_tri_eq_intro':\n  assumes \"P\\<^sub>1 = Q\\<^sub>1\" \"P\\<^sub>2 = Q\\<^sub>2\" \"P\\<^sub>3 = Q\\<^sub>3\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)\"\n  using assms by (simp)\n\nsubsection \\<open> Closure laws \\<close>\n\nsubsubsection \\<open> Regular \\<close>\n\nlemma RD_srdes_skip [closure]: \"II\\<^sub>C is RD\"\n  by (simp add: rdes_skip_def RH_design_is_RD unrest)\n\nlemma RD_seqr_closure [closure]:\n  assumes \"P is RD\" \"Q is RD\"\n  shows \"(P ;; Q) is RD\"\nproof -\n  have \"(P ;; Q) = \\<^bold>R (((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<and> post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q) \\<turnstile> \n                       (peri\\<^sub>R P \\<or> (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\<diamondop> (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n    by (simp add: RD_composition_wp assms(1) assms(2))\n  also have \"... is RD\"\n    by (rule RH_design_is_RD, simp_all add: wp_rea_def unrest)\n  finally show ?thesis .\nqed\n\nlemma RD_power_Suc [closure]: \"P is RD \\<Longrightarrow> P\\<^bold>^(Suc n) is RD\"\nproof (induct n)\n  case 0\n  then show ?case\n    by (simp)\nnext\n  case (Suc n)\n  then show ?case\n    using RD_seqr_closure by (simp add: RD_seqr_closure upred_semiring.power_Suc) \nqed\n\nlemma RD_power_comp [closure]: \"P is RD \\<Longrightarrow> P ;; P\\<^bold>^n is RD\"\n  by (metis RD_power_Suc upred_semiring.power_Suc)\n\nlemma uplus_RD_closed [closure]: \"P is RD \\<Longrightarrow> P\\<^sup>+ is RD\"\n  by (simp add: uplus_power_def closure)\n\nsubsubsection \\<open> Stateful \\<close>\n\nlemma SRD_srdes_skip [closure]: \"II\\<^sub>R is SRD\"\n  by (simp add: srdes_skip_def RHS_design_is_SRD unrest)\n\nlemma SRD_seqr_closure [closure]:\n  assumes \"P is SRD\" \"Q is SRD\"\n  shows \"(P ;; Q) is SRD\"\nproof -\n  have \"(P ;; Q) = \\<^bold>R\\<^sub>s (((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<and> post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q) \\<turnstile> \n                       ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<or> (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\<diamondop> (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n    by (simp add: SRD_composition_wp assms(1) assms(2))\n  also have \"... is SRD\"\n    by (rule RHS_design_is_SRD, simp_all add: wp_rea_def unrest)\n  finally show ?thesis .\nqed\n\nlemma SRD_power_Suc [closure]: \"P is SRD \\<Longrightarrow> P\\<^bold>^(Suc n) is SRD\"\nproof (induct n)\n  case 0\n  then show ?case\n    by (simp)\nnext\n  case (Suc n)\n  then show ?case\n    using SRD_seqr_closure by (simp add: SRD_seqr_closure upred_semiring.power_Suc) \nqed\n\nlemma SRD_power_comp [closure]: \"P is SRD \\<Longrightarrow> P ;; P\\<^bold>^n is SRD\"\n  by (metis SRD_power_Suc upred_semiring.power_Suc)\n\nlemma uplus_SRD_closed [closure]: \"P is SRD \\<Longrightarrow> P\\<^sup>+ is SRD\"\n  by (simp add: uplus_power_def closure)\n\nlemma SRD_Sup_closure [closure]:\n  assumes \"A \\<subseteq> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\" \"A \\<noteq> {}\"\n  shows \"(\\<Sqinter> A) is SRD\"\nproof -\n  have \"SRD (\\<Sqinter> A) = (\\<Sqinter> (SRD `A))\"\n    by (simp add: ContinuousD SRD_Continuous assms(2))\n  also have \"... = (\\<Sqinter> A)\"\n    by (simp only: Healthy_carrier_image assms)\n  finally show ?thesis by (simp add: Healthy_def)\nqed\n\nsubsection \\<open> Distribution laws \\<close>\n\nlemma RHS_tri_design_choice [rdes_def]: \n  \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqinter> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<or> Q\\<^sub>2) \\<diamondop> (P\\<^sub>3 \\<or> Q\\<^sub>3))\"\n  apply (simp add: RHS_design_choice)\n  apply (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"])\n   apply (simp)\n  apply (rel_auto)\n  done\n\nlemma RHS_tri_design_disj [rdes_def]: \n  \"(\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<or> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<or> Q\\<^sub>2) \\<diamondop> (P\\<^sub>3 \\<or> Q\\<^sub>3))\"\n  by (simp add: RHS_tri_design_choice disj_upred_def)\n\nlemma RHS_tri_design_sup [rdes_def]: \n  \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<squnion> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\<or> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>1 \\<Rightarrow>\\<^sub>r P\\<^sub>2) \\<and> (Q\\<^sub>1 \\<Rightarrow>\\<^sub>r Q\\<^sub>2)) \\<diamondop> ((P\\<^sub>1 \\<Rightarrow>\\<^sub>r P\\<^sub>3) \\<and> (Q\\<^sub>1 \\<Rightarrow>\\<^sub>r Q\\<^sub>3)))\"\n  by (simp add: RHS_design_sup, rel_auto)\n\nlemma RHS_tri_design_conj [rdes_def]: \n  \"(\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<and> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\<or> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>1 \\<Rightarrow>\\<^sub>r P\\<^sub>2) \\<and> (Q\\<^sub>1 \\<Rightarrow>\\<^sub>r Q\\<^sub>2)) \\<diamondop> ((P\\<^sub>1 \\<Rightarrow>\\<^sub>r P\\<^sub>3) \\<and> (Q\\<^sub>1 \\<Rightarrow>\\<^sub>r Q\\<^sub>3)))\"\n  by (simp add: RHS_tri_design_sup conj_upred_def)\n\nlemma SRD_UINF [rdes_def]:\n  assumes \"A \\<noteq> {}\" \"A \\<subseteq> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"\\<Sqinter> A = \\<^bold>R\\<^sub>s((\\<And> P\\<in>A \\<bullet> pre\\<^sub>R(P)) \\<turnstile> (\\<Or> P\\<in>A \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<Or> P\\<in>A \\<bullet> post\\<^sub>R(P)))\"\nproof -\n  have \"\\<Sqinter> A = \\<^bold>R\\<^sub>s(pre\\<^sub>R(\\<Sqinter> A) \\<turnstile> peri\\<^sub>R(\\<Sqinter> A) \\<diamondop> post\\<^sub>R(\\<Sqinter> A))\"\n    by (metis SRD_as_reactive_tri_design assms srdes_theory.healthy_inf srdes_theory.healthy_inf_def)\n  also have \"... = \\<^bold>R\\<^sub>s((\\<And> P\\<in>A \\<bullet> pre\\<^sub>R(P)) \\<turnstile> (\\<Or> P\\<in>A \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<Or> P\\<in>A \\<bullet> post\\<^sub>R(P)))\"\n    by (simp add: preR_INF periR_INF postR_INF assms)\n  finally show ?thesis .\nqed\n\nlemma RHS_tri_design_USUP [rdes_def]:\n  assumes \"A \\<noteq> {}\"\n  shows \"(\\<Sqinter> i \\<in> A \\<bullet> \\<^bold>R\\<^sub>s(P(i) \\<turnstile> Q(i) \\<diamondop> R(i))) = \\<^bold>R\\<^sub>s((\\<Squnion> i \\<in> A \\<bullet> P(i)) \\<turnstile> (\\<Sqinter> i \\<in> A \\<bullet> Q(i)) \\<diamondop> (\\<Sqinter> i \\<in> A \\<bullet> R(i)))\"\n  by (subst RHS_INF[OF assms, THEN sym], simp add: design_UINF_mem assms, rel_auto)\n\nlemma SRD_UINF_mem:\n  assumes \"A \\<noteq> {}\" \"\\<And> i. P i is SRD\"\n  shows \"(\\<Sqinter> i\\<in>A \\<bullet> P i) = \\<^bold>R\\<^sub>s((\\<And> i\\<in>A \\<bullet> pre\\<^sub>R(P i)) \\<turnstile> (\\<Or> i\\<in>A \\<bullet> peri\\<^sub>R(P i)) \\<diamondop> (\\<Or> i\\<in>A \\<bullet> post\\<^sub>R(P i)))\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs = (\\<Sqinter> (P ` A))\"\n    by (rel_auto) \n  also have \" ... =  \\<^bold>R\\<^sub>s ((\\<Squnion> Pa \\<in> P ` A \\<bullet> pre\\<^sub>R Pa) \\<turnstile> (\\<Sqinter> Pa \\<in> P ` A \\<bullet> peri\\<^sub>R Pa) \\<diamondop> (\\<Sqinter> Pa \\<in> P ` A \\<bullet> post\\<^sub>R Pa))\"\n    by (subst rdes_def, simp_all add: assms image_subsetI)\n  also have \"... = ?rhs\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nlemma RHS_tri_design_UINF_ind [rdes_def]:\n  \"(\\<Sqinter> i \\<bullet> \\<^bold>R\\<^sub>s(P\\<^sub>1(i) \\<turnstile> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i))) = \\<^bold>R\\<^sub>s((\\<And> i \\<bullet> P\\<^sub>1 i) \\<turnstile> (\\<Or> i \\<bullet> P\\<^sub>2(i)) \\<diamondop> (\\<Or> i \\<bullet> P\\<^sub>3(i)))\"\n  by (rel_auto)\n\nlemma cond_srea_form [rdes_def]:\n  \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) \\<triangleleft> b \\<triangleright>\\<^sub>R \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n   \\<^bold>R\\<^sub>s((P \\<triangleleft> b \\<triangleright>\\<^sub>R R) \\<turnstile> (Q\\<^sub>1 \\<triangleleft> b \\<triangleright>\\<^sub>R S\\<^sub>1) \\<diamondop> (Q\\<^sub>2 \\<triangleleft> b \\<triangleright>\\<^sub>R S\\<^sub>2))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) \\<triangleleft> b \\<triangleright>\\<^sub>R \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) \\<triangleleft> R2c(\\<lceil>b\\<rceil>\\<^sub>S\\<^sub><) \\<triangleright> \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\"\n    by (pred_auto)\n  also have \"... = \\<^bold>R\\<^sub>s (P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2 \\<triangleleft> b \\<triangleright>\\<^sub>R R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\"\n    by (simp add: RHS_cond lift_cond_srea_def)\n  also have \"... = \\<^bold>R\\<^sub>s ((P \\<triangleleft> b \\<triangleright>\\<^sub>R R) \\<turnstile> (Q\\<^sub>1 \\<diamondop> Q\\<^sub>2 \\<triangleleft> b \\<triangleright>\\<^sub>R S\\<^sub>1 \\<diamondop> S\\<^sub>2))\"\n    by (simp add: design_condr lift_cond_srea_def)\n  also have \"... = \\<^bold>R\\<^sub>s((P \\<triangleleft> b \\<triangleright>\\<^sub>R R) \\<turnstile> (Q\\<^sub>1 \\<triangleleft> b \\<triangleright>\\<^sub>R S\\<^sub>1) \\<diamondop> (Q\\<^sub>2 \\<triangleleft> b \\<triangleright>\\<^sub>R S\\<^sub>2))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma SRD_cond_srea [closure]:\n  assumes \"P is SRD\" \"Q is SRD\"\n  shows \"P \\<triangleleft> b \\<triangleright>\\<^sub>R Q is SRD\"\nproof -\n  have \"P \\<triangleleft> b \\<triangleright>\\<^sub>R Q = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) \\<triangleleft> b \\<triangleright>\\<^sub>R \\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\<turnstile> peri\\<^sub>R(Q) \\<diamondop> post\\<^sub>R(Q))\"\n    by (simp add: SRD_reactive_tri_design assms)\n  also have \"... = \\<^bold>R\\<^sub>s ((pre\\<^sub>R P \\<triangleleft> b \\<triangleright>\\<^sub>R pre\\<^sub>R Q) \\<turnstile> (peri\\<^sub>R P \\<triangleleft> b \\<triangleright>\\<^sub>R peri\\<^sub>R Q) \\<diamondop> (post\\<^sub>R P \\<triangleleft> b \\<triangleright>\\<^sub>R post\\<^sub>R Q))\"\n    by (simp add: cond_srea_form)\n  also have \"... is SRD\"\n    by (simp add: RHS_tri_design_is_SRD lift_cond_srea_def unrest)\n  finally show ?thesis .\nqed\n\nsubsection \\<open> Algebraic laws \\<close>\n\nlemma RD_left_unit:\n  assumes \"P is RD\"\n  shows \"II\\<^sub>C ;; P = P\"\n  by (simp add: RD1_left_unit RD_healths(1) RD_healths(4) assms)\n\nlemma skip_rdes_self_unit [simp]:\n  \"II\\<^sub>C ;; II\\<^sub>C = II\\<^sub>C\"\n  by (simp add: RD_left_unit closure)\n\nlemma SRD_left_unit:\n  assumes \"P is SRD\"\n  shows \"II\\<^sub>R ;; P = P\"\n  by (simp add: SRD_composition_wp closure rdes wp C1 R1_negate_R1 R1_false \n      rpred trace_ident_left_periR trace_ident_left_postR SRD_reactive_tri_design assms)\n\nlemma skip_srea_self_unit [simp]:\n  \"II\\<^sub>R ;; II\\<^sub>R = II\\<^sub>R\"\n  by (simp add: SRD_left_unit closure)\n\nlemma SRD_right_unit_tri_lemma:\n  assumes \"P is SRD\"\n  shows \"P ;; II\\<^sub>R = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> post\\<^sub>R P)\"\n  by (simp add: SRD_composition_wp closure rdes wp rpred trace_ident_right_postR assms)\n\nlemma Miracle_left_zero:\n  assumes \"P is SRD\"\n  shows \"Miracle ;; P = Miracle\"\nproof -\n  have \"Miracle ;; P = \\<^bold>R\\<^sub>s(true \\<turnstile> false) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n    by (simp add: Miracle_def SRD_reactive_design_alt assms)\n  also have \"... = \\<^bold>R\\<^sub>s(true \\<turnstile> false)\"\n    by (simp add: RHS_design_composition unrest R1_false R2s_false R2s_true)\n  also have \"... = Miracle\"\n    by (simp add: Miracle_def)\n  finally show ?thesis .\nqed\n\nlemma Chaos_left_zero:\n  assumes \"P is SRD\"\n  shows \"(Chaos ;; P) = Chaos\"\nproof -\n  have \"Chaos ;; P = \\<^bold>R\\<^sub>s(false \\<turnstile> true) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n    by (simp add: Chaos_def SRD_reactive_design_alt assms)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not> R1 true \\<and> \\<not> (R1 true \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s (pre\\<^sub>R P))) \\<turnstile>\n                       R1 true ;; ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s (cmt\\<^sub>R P))))\"\n    by (simp add: RHS_design_composition unrest R2s_false R2s_true R1_false)\n  also have \"... = \\<^bold>R\\<^sub>s ((false \\<and> \\<not> (R1 true \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s (pre\\<^sub>R P))) \\<turnstile>\n                       R1 true ;; ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s (cmt\\<^sub>R P))))\"\n    by (simp add: RHS_design_conj_neg_R1_pre)\n  also have \"... = \\<^bold>R\\<^sub>s(true)\"\n    by (simp add: design_false_pre)\n  also have \"... = \\<^bold>R\\<^sub>s(false \\<turnstile> true)\"\n    by (simp add: design_def)\n  also have \"... = Chaos\"\n    by (simp add: Chaos_def)\n  finally show ?thesis .\nqed\n\nlemma SRD_right_Chaos_tri_lemma:\n  assumes \"P is SRD\"\n  shows \"P ;; Chaos = \\<^bold>R\\<^sub>s (((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<and> post\\<^sub>R P wp\\<^sub>r false) \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> false)\"\n  by (simp add: SRD_composition_wp closure rdes assms wp, rel_auto)\n\nlemma SRD_right_Miracle_tri_lemma:\n  assumes \"P is SRD\"\n  shows \"P ;; Miracle = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> false)\"\n  by (simp add: SRD_composition_wp closure rdes assms wp, rel_auto)\n\ntext \\<open> Reactive designs are left unital \\<close>\n\ninterpretation rdes_left_unital: utp_theory_left_unital \"RD\" \"II\\<^sub>C\"\n  by (unfold_locales, simp_all add: closure RD_left_unit)\n\ntext \\<open> Stateful reactive designs are left unital \\<close>\n\ninterpretation srdes_left_unital: utp_theory_left_unital \"SRD\" \"II\\<^sub>R\"\n  by (unfold_locales, simp_all add: closure SRD_left_unit)\n\nsubsection \\<open> Recursion laws \\<close>\n\nlemma mono_srd_iter:\n  assumes \"mono F\" \"F \\<in> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"mono (\\<lambda>X. \\<^bold>R\\<^sub>s(pre\\<^sub>R(F X) \\<turnstile> peri\\<^sub>R(F X) \\<diamondop> post\\<^sub>R (F X)))\"\n  apply (rule monoI)\n  apply (rule srdes_tri_refine_intro')\n  apply (meson assms(1) monoE preR_antitone utp_pred_laws.le_infI2)\n  apply (meson assms(1) monoE periR_monotone utp_pred_laws.le_infI2)\n  apply (meson assms(1) monoE postR_monotone utp_pred_laws.le_infI2)\ndone\n\nlemma mu_srd_SRD:\n  assumes \"mono F\" \"F \\<in> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"(\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s (pre\\<^sub>R (F X) \\<turnstile> peri\\<^sub>R (F X) \\<diamondop> post\\<^sub>R (F X))) is SRD\"\n  apply (subst gfp_unfold)\n  apply (simp add: mono_srd_iter assms)\n  apply (rule RHS_tri_design_is_SRD)\n  apply (simp_all add: unrest)\ndone\n\nlemma mu_srd_iter:\n  assumes \"mono F\" \"F \\<in> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"(\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R(F(X)) \\<turnstile> peri\\<^sub>R(F(X)) \\<diamondop> post\\<^sub>R(F(X)))) = F(\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R(F(X)) \\<turnstile> peri\\<^sub>R(F(X)) \\<diamondop> post\\<^sub>R(F(X))))\"\n  apply (subst gfp_unfold)\n   apply (simp add: mono_srd_iter assms)\n  apply (subst SRD_as_reactive_tri_design[THEN sym])\n  apply (simp add: Healthy_apply_closed SRD_as_reactive_design SRD_reactive_design_alt assms(1) assms(2) mu_srd_SRD)\n  done\n\nlemma mu_srd_form:\n  assumes \"mono F\" \"F \\<in> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"\\<mu>\\<^sub>R F = (\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R(F(X)) \\<turnstile> peri\\<^sub>R(F(X)) \\<diamondop> post\\<^sub>R(F(X))))\"\nproof -\n  have 1: \"F (\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R (F X) \\<turnstile> peri\\<^sub>R(F X) \\<diamondop> post\\<^sub>R (F X))) is SRD\"\n    by (simp add: Healthy_apply_closed assms(1) assms(2) mu_srd_SRD)\n  have 2:\"Mono\\<^bsub>utp_order SRD\\<^esub> F\"\n    by (simp add: assms(1) mono_Monotone_utp_order)\n  hence 3:\"\\<mu>\\<^sub>R F = F (\\<mu>\\<^sub>R F)\"\n    by (simp add: srdes_theory.LFP_unfold[THEN sym] assms)\n  hence \"\\<^bold>R\\<^sub>s(pre\\<^sub>R (F (F (\\<mu>\\<^sub>R F))) \\<turnstile> peri\\<^sub>R (F (F (\\<mu>\\<^sub>R F))) \\<diamondop> post\\<^sub>R (F (F (\\<mu>\\<^sub>R F)))) = \\<mu>\\<^sub>R F\"\n    using SRD_reactive_tri_design by force\n  hence \"(\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R (F X) \\<turnstile> peri\\<^sub>R(F X) \\<diamondop> post\\<^sub>R (F X))) \\<sqsubseteq> F (\\<mu>\\<^sub>R F)\"\n    by (simp add: 2 srdes_theory.weak.LFP_lemma3 gfp_upperbound assms)\n  thus ?thesis\n    using assms 1 3 srdes_theory.weak.LFP_lowerbound eq_iff mu_srd_iter\n    by (metis (mono_tags, lifting))\nqed\n\nlemma Monotonic_SRD_comp [closure]: \"Monotonic ((;;) P \\<circ> SRD)\"\n  by (simp add: mono_def R1_R2c_is_R2 R2_mono R3h_mono RD1_mono RD2_mono RHS_def SRD_def seqr_mono)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/rea_designs/utp_rdes_triples.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241632752915, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3423259679420455}}
{"text": "theory CorrectnessStacked\n  imports \"Denotational-Props\" LaunchburyStacked\nbegin\n\ntext {* This is the main correctness theorem for the stacked semantics. *}\n\ntheorem correctness:\n  assumes \"\\<Gamma> : \\<Gamma>' \\<Down> \\<Delta> : \\<Delta>'\"\n  and \"distinctVars (\\<Gamma>' @ \\<Gamma>)\"\n  shows \"\\<lbrace>\\<Gamma>'@\\<Gamma>\\<rbrace> \\<le> \\<lbrace>\\<Delta>'@\\<Delta>\\<rbrace>\"\n  using assms\nproof(induct rule:reds_distinct_ind)\n\ncase (Lambda x y e \\<Gamma> \\<Gamma>')\n  show ?case by simp\n  -- \"The lambda-case is trival\"\nnext\n\ncase (Application n \\<Gamma> \\<Gamma>' \\<Delta> \\<Delta>' x e y \\<Theta> \\<Theta>' z  e')\n  let \"?restr \\<rho>\" = \"fmap_restr (insert x (heapVars \\<Gamma>' \\<union> heapVars \\<Gamma>)) (\\<rho>::Env)\"\n  let \"?restr2 \\<rho>\" = \"fmap_restr (insert x (heapVars \\<Delta>' \\<union> heapVars \\<Delta>)) (\\<rho>::Env)\"\n\n  have \"n \\<noteq> z\" using Application by (simp add: fresh_Pair fresh_at_base)\n\n  from stack_unchanged[OF distinct_redsD1[OF Application.hyps(8)]]\n  have \"\\<Delta>' = \\<Gamma>'\" by simp\n  hence [simp]:\"atom n \\<sharp> \\<Delta>'\"  using Application by (simp add: fresh_Pair)+\n  \n  have \"atom n \\<sharp> (\\<Gamma>, e)\" using Application by (simp add: fresh_Pair)\n  note reds_fresh[OF Application(8) this]\n  hence \"atom n \\<sharp> (\\<Delta>, Lam [z]. e')\"\n    using Application(5)\n    by (metis (hide_lams, no_types) Application(1) fresh_Pair heapVars_not_fresh)\n  with `n \\<noteq> z`\n  have [simp]: \"atom n \\<sharp> \\<Delta>\" \"atom n \\<sharp> e'\"\n    by (auto simp add: fresh_Pair)\n\n  note subset1 = reds_doesnt_forget'(1)[OF Application.hyps(8), unfolded append_Cons]\n  from reds_doesnt_forget'(2)[OF Application.hyps(8), unfolded append_Cons]\n  have subset2: \"heapVars ((x, App (Var n) y) # \\<Gamma>') \\<subseteq> heapVars ((x, App (Var n) y) # \\<Delta>')\"\n    apply (rule distinctVars_Cons_subset)\n    apply (metis Application(4) distinctVars_appendD1)\n    apply (metis Application(5) distinctVars_appendD1)\n    done\n\n  have \"n \\<noteq> x\" \n    by (metis Application(1) fresh_PairD(1) fresh_PairD(2) not_self_fresh)\n\n  have \"\\<lbrace>((x, App e y) # \\<Gamma>') @ \\<Gamma>\\<rbrace> = (\\<lbrace>(x, App e y) # \\<Gamma>' @ \\<Gamma>\\<rbrace>)\"\n    by simp\n  also\n  have \"... = ?restr (\\<lbrace>(n, e) # (x, App e y) # \\<Gamma>' @ \\<Gamma>\\<rbrace>)\"\n    -- {* Adding a fresh variable *}\n    apply (subst HSem_add_fresh[of fempty \"(x, App e y) # \\<Gamma>' @ \\<Gamma>\" n e, symmetric])\n    apply (rule fempty_is_HSem_cond)\n    apply (rule fempty_is_HSem_cond)\n    using Application(1) apply (simp add: fresh_Pair fresh_Cons fresh_append)\n    apply simp\n    done\n  also have  \"... = ?restr (\\<lbrace>(x, App e y) # (n, e) # \\<Gamma>' @ \\<Gamma>\\<rbrace>)\"\n    by (rule arg_cong[OF HSem_reorder_head[OF `n \\<noteq> x`]])\n  also\n  have \"... = ?restr (\\<lbrace>(x, App (Var n) y) # (n, e) # \\<Gamma>' @ \\<Gamma>\\<rbrace>)\"\n    -- {* Substituting the variable *}\n    apply (rule arg_cong[OF HSem_subst_var_app[symmetric]])\n    apply (rule fempty_is_HSem_cond)\n    apply (rule fempty_is_HSem_cond)\n    using Application(1) apply (simp add: fresh_Pair)\n    done\n  also\n  have \"... = ?restr (\\<lbrace>(n, e) # (x, App (Var n) y) # \\<Gamma>' @ \\<Gamma>\\<rbrace>)\"\n    by (simp add: HSem_reorder_head[OF `n \\<noteq> x`])\n  also\n  have \"... \\<le> ?restr2  (\\<lbrace>(n, Lam [z]. e') # (x, App (Var n) y) # \\<Delta>' @ \\<Delta>\\<rbrace>)\"\n    -- \"Induction hypothesis\"\n    apply (rule fmap_restr_le[OF Application.hyps(9)[simplified]])\n    using subset1 subset2 by auto\n  also\n  have \"... \\<le> ?restr2  (\\<lbrace>(x, App (Var n) y) # (n, Lam [z]. e') # \\<Delta>' @ \\<Delta>\\<rbrace>)\"\n    by (simp add: HSem_reorder_head[OF `n \\<noteq> x`])\n  also\n  have \"... = ?restr2 (\\<lbrace>(x, App (Lam [z]. e') y) # (n, Lam [z]. e') # \\<Delta>' @ \\<Delta>\\<rbrace>)\"\n    -- \"Substituting the variable again\"\n    apply (rule arg_cong[OF HSem_subst_var_app])\n    apply (rule fempty_is_HSem_cond)\n    apply (rule fempty_is_HSem_cond)\n    using Application(1) apply (simp add: fresh_Pair)\n    done\n  also\n  have \"... = ?restr2 (\\<lbrace>(n, Lam [z]. e') # (x, App (Lam [z]. e') y) # \\<Delta>' @ \\<Delta>\\<rbrace>)\"\n    by (simp add: HSem_reorder_head[OF `n \\<noteq> x`])\n  also\n  have \"... = (\\<lbrace>(x, App (Lam [z]. e') y) # \\<Delta>' @ \\<Delta>\\<rbrace>)\"\n    -- \"Removing the fresh variable\"\n    apply (subst HSem_add_fresh[of fempty \"(x, App (Lam [z]. e') y) # \\<Delta>' @ \\<Delta>\" n \"Lam [z]. e'\", symmetric])\n    apply (rule fempty_is_HSem_cond)\n    apply (rule fempty_is_HSem_cond)\n    using Application(1) apply (simp add: fresh_Pair fresh_Cons fresh_append)\n    apply simp\n    done\n  also\n  have \"... =  \\<lbrace>(x, e'[z::=y]) # \\<Delta>' @ \\<Delta>\\<rbrace>\"\n    -- \"Semantics of application\"\n    apply (rule HSem_subst_exp[OF fempty_is_HSem_cond fempty_is_HSem_cond])\n    apply (simp)\n    apply (subgoal_tac \"atom z \\<sharp> \\<rho>'\")\n    apply (subst ESem.simps, assumption)\n    apply simp\n    apply (rule ESem_subst[simplified])\n      using Application(2)\n      apply (auto simp add: sharp_Env fresh_Pair heapVars_not_fresh)\n    done\n  also\n  have \"... \\<le> \\<lbrace>\\<Theta>' @ \\<Theta>\\<rbrace>\"\n    -- \"Induction hypothesis\"\n    by (rule Application.hyps(11)[simplified])\n  finally\n  show \"\\<lbrace>((x, App e y) # \\<Gamma>') @ \\<Gamma>\\<rbrace> \\<le> \\<lbrace>\\<Theta>' @ \\<Theta>\\<rbrace>\".\n\nnext\ncase (Variable y e \\<Gamma> x \\<Gamma>' z \\<Delta>' \\<Delta>)\n  have \"x \\<noteq> y\"\n    using Variable(3) by (auto simp add: distinctVars_Cons distinctVars_append)\n  have \"distinctVars \\<Gamma>\"\n    using Variable(2) by (auto simp add: distinctVars_Cons distinctVars_append)\n  have d2: \"distinctVars (((y, z) # (x, z) # \\<Delta>') @ \\<Delta>)\"\n    using Variable.hyps(4)\n    by (simp add: distinctVars_append distinctVars_Cons)\n\n  have \"\\<lbrace>((x, Var y) # \\<Gamma>') @ \\<Gamma>\\<rbrace> = \\<lbrace>((y, e) # (x, Var y) # \\<Gamma>') @ delete y \\<Gamma>\\<rbrace>\"\n    apply (rule HSem_reorder[OF Variable.hyps(2,3)])\n    using distinctVars_set_delete_insert[OF `distinctVars \\<Gamma>` Variable(1)]\n    by auto\n  also\n  have \"... \\<le>  \\<lbrace>((y, z) # (x, Var y) # \\<Delta>') @ \\<Delta>\\<rbrace>\"\n    -- \"Induction hypothesis\"\n    by fact\n  also\n  have \"... =  \\<lbrace>(y, z) # (x, Var y) # \\<Delta>' @ \\<Delta>\\<rbrace>\"\n    by simp\n  also\n  have \"... =  \\<lbrace>(x, Var y) # (y, z) # \\<Delta>' @ \\<Delta>\\<rbrace>\"\n    by (simp add: HSem_reorder_head[OF `x \\<noteq> y`])\n  also\n  have \"... =  \\<lbrace>(x, z) # (y, z) # \\<Delta>' @ \\<Delta>\\<rbrace>\"\n    -- {* Substituting the variable @{term y} *}\n    apply (rule HSem_subst_var_var)\n    apply (rule fempty_is_HSem_cond)\n    apply (rule fempty_is_HSem_cond)\n    using `x \\<noteq> y` by (simp add: fresh_Pair fresh_at_base)\n  also\n  have \"... =  \\<lbrace>(y, z) # (x, z) # \\<Delta>' @ \\<Delta>\\<rbrace>\"\n    by (simp add: HSem_reorder_head[OF `x \\<noteq> y`])\n  also\n  have \"... =  \\<lbrace>((y, z) # (x, z) # \\<Delta>') @ \\<Delta>\\<rbrace>\"\n    by simp\n  also\n  have \"... = \\<lbrace>((x, z) # \\<Delta>') @ (y, z) # \\<Delta>\\<rbrace>\"\n    -- \"Induction hypothesis\"\n    by (rule HSem_reorder[OF d2 Variable.hyps(5)], auto)\n  finally\n  show \"\\<lbrace>((x, Var y) # \\<Gamma>') @ \\<Gamma>\\<rbrace> \\<le> \\<lbrace>((x, z) # \\<Delta>') @ (y, z) # \\<Delta>\\<rbrace>\".\n\nnext\ncase (Let as \\<Gamma> x \\<Gamma>' body \\<Delta>' \\<Delta>)\n  have \"distinctVars (asToHeap as @ ((x, Terms.Let as body) # \\<Gamma>') @ \\<Gamma>)\"\n    by (metis Let(1) Let(2) Let(3) distinctVars_append_asToHeap fresh_star_Cons fresh_star_Pair fresh_star_append let_binders_fresh)\n  hence d3: \"distinctVars ((x, body) # asToHeap as @ \\<Gamma>' @ \\<Gamma>)\"\n    and d4: \"distinctVars (((x, body) # \\<Gamma>') @ asToHeap as @ \\<Gamma>)\"\n    and d5: \"distinctVars ((x, body) # \\<Gamma>' @ \\<Gamma>)\"\n    by (auto simp add: distinctVars_Cons distinctVars_append)\n\n  have \"\\<lbrace>((x, Let as body) # \\<Gamma>') @ \\<Gamma>\\<rbrace> = \\<lbrace>(x, Let as body) # \\<Gamma>' @ \\<Gamma>\\<rbrace>\"\n    by simp\n  also\n  have \"... \\<le> \\<lbrace>(x, body) # asToHeap as @ \\<Gamma>' @ \\<Gamma>\\<rbrace>\"\n    -- \"Semantics of let\"\n    apply (rule HSem_unfold_let[OF fempty_is_HSem_cond fempty_is_HSem_cond fempty_is_HSem_cond Let(2) d5 _ refl])\n    using Let(1) by (auto simp add: fresh_star_Pair fresh_star_append)[1]\n  also\n  have \"... = \\<lbrace>((x, body) # \\<Gamma>') @ asToHeap as @ \\<Gamma>\\<rbrace>\"\n     by (rule HSem_reorder[OF d3 d4], auto)\n  also\n  have \"... \\<le>  \\<lbrace>\\<Delta>' @ \\<Delta>\\<rbrace>\"\n    -- \"Induction hypothesis\"\n    by fact\n  finally\n  show \"\\<lbrace>((x, Terms.Let as body) # \\<Gamma>') @ \\<Gamma>\\<rbrace> \\<le> \\<lbrace>\\<Delta>' @ \\<Delta>\\<rbrace>\".\nqed\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Launchbury/CorrectnessStacked.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.3423230717621839}}
{"text": "(*  Title:      HOL/Imperative_HOL/Heap.thy\n    Author:     John Matthews, Galois Connections; Alexander Krauss, TU Muenchen\n*)\n\nsection \\<open>A polymorphic heap based on cantor encodings\\<close>\n\ntheory Heap\nimports MainRLT \"HOL-Library.Countable\"\nbegin\n\nsubsection \\<open>Representable types\\<close>\n\ntext \\<open>The type class of representable types\\<close>\n\nclass heap = typerep + countable\n\ninstance unit :: heap ..\n\ninstance bool :: heap ..\n\ninstance nat :: heap ..\n\ninstance prod :: (heap, heap) heap ..\n\ninstance sum :: (heap, heap) heap ..\n\ninstance list :: (heap) heap ..\n\ninstance option :: (heap) heap ..\n\ninstance int :: heap ..\n\ninstance String.literal :: heap ..\n\ninstance char :: heap ..\n\ninstance typerep :: heap ..\n\n\nsubsection \\<open>A polymorphic heap with dynamic arrays and references\\<close>\n\ntext \\<open>\n  References and arrays are developed in parallel,\n  but keeping them separate makes some later proofs simpler.\n\\<close>\n\ntype_synonym addr = nat \\<comment> \\<open>untyped heap references\\<close>\ntype_synonym heap_rep = nat \\<comment> \\<open>representable values\\<close>\n\nrecord heap =\n  arrays :: \"typerep \\<Rightarrow> addr \\<Rightarrow> heap_rep list\"\n  refs :: \"typerep \\<Rightarrow> addr \\<Rightarrow> heap_rep\"\n  lim  :: addr\n\ndefinition empty :: heap where\n  \"empty = \\<lparr>arrays = (\\<lambda>_ _. []), refs = (\\<lambda>_ _. 0), lim = 0\\<rparr>\"\n\ndatatype 'a array = Array addr \\<comment> \\<open>note the phantom type 'a\\<close>\ndatatype 'a ref = Ref addr \\<comment> \\<open>note the phantom type 'a\\<close>\n\nprimrec addr_of_array :: \"'a array \\<Rightarrow> addr\" where\n  \"addr_of_array (Array x) = x\"\n\nprimrec addr_of_ref :: \"'a ref \\<Rightarrow> addr\" where\n  \"addr_of_ref (Ref x) = x\"\n\nlemma addr_of_array_inj [simp]:\n  \"addr_of_array a = addr_of_array a' \\<longleftrightarrow> a = a'\"\n  by (cases a, cases a') simp_all\n\nlemma addr_of_ref_inj [simp]:\n  \"addr_of_ref r = addr_of_ref r' \\<longleftrightarrow> r = r'\"\n  by (cases r, cases r') simp_all\n\ninstance array :: (type) countable\n  by (rule countable_classI [of addr_of_array]) simp\n\ninstance ref :: (type) countable\n  by (rule countable_classI [of addr_of_ref]) simp\n\ninstance array :: (type) heap ..\ninstance ref :: (type) heap ..\n    \n    \ntext \\<open>Syntactic convenience\\<close>\n\nsetup \\<open>\n  Sign.add_const_constraint (\\<^const_name>\\<open>Array\\<close>, SOME \\<^typ>\\<open>nat \\<Rightarrow> 'a::heap array\\<close>)\n  #> Sign.add_const_constraint (\\<^const_name>\\<open>Ref\\<close>, SOME \\<^typ>\\<open>nat \\<Rightarrow> 'a::heap ref\\<close>)\n  #> Sign.add_const_constraint (\\<^const_name>\\<open>addr_of_array\\<close>, SOME \\<^typ>\\<open>'a::heap array \\<Rightarrow> nat\\<close>)\n  #> Sign.add_const_constraint (\\<^const_name>\\<open>addr_of_ref\\<close>, SOME \\<^typ>\\<open>'a::heap ref \\<Rightarrow> nat\\<close>)\n\\<close>\n\nhide_const (open) empty\n\nend\n", "meta": {"author": "dtraytel", "repo": "HOLRLT", "sha": "e9029da59bb3af0c835604a65308498f9696a364", "save_path": "github-repos/isabelle/dtraytel-HOLRLT", "path": "github-repos/isabelle/dtraytel-HOLRLT/HOLRLT-e9029da59bb3af0c835604a65308498f9696a364/HOLRLT/Imperative_HOL/Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3422771357906906}}
{"text": "(*\nTitle: Value-Dependent SIFUM Refinement\nAuthors: Toby Murray, Robert Sison\n*)\ntheory CompositionalRefinement\nimports Dependent_SIFUM_Type_Systems.Compositionality\nbegin\n\n\nlemma inj_card_le: \n  \"inj (f::'a \\<Rightarrow> 'b) \\<Longrightarrow> finite (UNIV::'b set) \\<Longrightarrow> card (UNIV::'a set) \\<le> card (UNIV::'b set)\"\n  by (blast intro: card_inj_on_le)\n\ntext \\<open>\n  We define a generic locale for capturing refinement between an abstract and a concrete\n  program. We then define and prove sufficient, conditions that preserve local security\n  from the abstract to the concrete program.\n\n  Below we define a second locale that is more restrictive than this one. Specifically, this\n  one allows the concrete program to have extra variables not present in the abstract one.\n  These variables might be used, for instance, to implement a runtime stack that was implicit\n  in the semantics of the abstract program; or as temporary storage for expression evaluation\n  that may (appear to be) atomic in the abstract semantics.\n\n  The simpler locale below forbids extra variables in the concrete program, making the\n  necessary conditions for preservation of local security simpler.\n\\<close>\nlocale sifum_refinement = \n  abs: sifum_security dma\\<^sub>A \\<C>_vars\\<^sub>A \\<C>\\<^sub>A eval\\<^sub>A some_val +\n  conc: sifum_security dma\\<^sub>C \\<C>_vars\\<^sub>C \\<C>\\<^sub>C eval\\<^sub>C some_val\n  for dma\\<^sub>A :: \"('Var\\<^sub>A,'Val) Mem \\<Rightarrow> 'Var\\<^sub>A \\<Rightarrow> Sec\"\n  and dma\\<^sub>C :: \"('Var\\<^sub>C,'Val) Mem \\<Rightarrow> 'Var\\<^sub>C \\<Rightarrow> Sec\"\n  and \\<C>_vars\\<^sub>A :: \"'Var\\<^sub>A \\<Rightarrow> 'Var\\<^sub>A set\"\n  and \\<C>_vars\\<^sub>C :: \"'Var\\<^sub>C \\<Rightarrow> 'Var\\<^sub>C set\"\n  and \\<C>\\<^sub>A :: \"'Var\\<^sub>A set\"\n  and \\<C>\\<^sub>C :: \"'Var\\<^sub>C set\"\n  and eval\\<^sub>A :: \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val) LocalConf rel\"\n  and eval\\<^sub>C :: \"('Com\\<^sub>C, 'Var\\<^sub>C, 'Val) LocalConf rel\"\n  and some_val :: \"'Val\" +\n  fixes var\\<^sub>C_of :: \"'Var\\<^sub>A \\<Rightarrow> 'Var\\<^sub>C\"\n  assumes var\\<^sub>C_of_inj: \"inj var\\<^sub>C_of\" \n  assumes dma_consistent:\n    \"dma\\<^sub>A (\\<lambda>x\\<^sub>A. mem\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)) x\\<^sub>A = dma\\<^sub>C mem\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)\"\n  assumes \\<C>_vars_consistent:\n    \"(var\\<^sub>C_of ` \\<C>_vars\\<^sub>A x\\<^sub>A) = \\<C>_vars\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)\"\n  (* we make the (reasonable IMHO) assumption that the only control variables\n     are user-declared and so that the compiler won't introduce new ones. *)\n  assumes control_vars_are_A_vars:\n    \"\\<C>\\<^sub>C = var\\<^sub>C_of ` \\<C>\\<^sub>A\"\n\nsection \"General Compositional Refinement\"\n\ntext \\<open>\n  The type of state relations between the abstract and compiled components.\n  The job of a certifying compiler will be to exhibit one of these for each\n  component it compiles. Below we'll define the conditions that such a\n  relation needs to satisfy to give compositional refinement.\n\\<close>\ntype_synonym ('Com\\<^sub>A, 'Var\\<^sub>A, 'Val, 'Com\\<^sub>C, 'Var\\<^sub>C) state_relation = \n   \"(('Com\\<^sub>A, 'Var\\<^sub>A, 'Val) LocalConf \\<times> ('Com\\<^sub>C, 'Var\\<^sub>C, 'Val) LocalConf) set\"\n\ncontext sifum_refinement begin\n\nabbreviation \n  conf_abv\\<^sub>A :: \"'Com\\<^sub>A \\<Rightarrow> 'Var\\<^sub>A Mds \\<Rightarrow> ('Var\\<^sub>A, 'Val) Mem \\<Rightarrow> (_,_,_) LocalConf\"\n  (\"\\<langle>_, _, _\\<rangle>\\<^sub>A\" [0, 0, 0] 1000)\nwhere\n  \"\\<langle> c, mds, mem \\<rangle>\\<^sub>A \\<equiv> ((c, mds), mem)\"\n\nabbreviation \n  conf_abv\\<^sub>C :: \"'Com\\<^sub>C \\<Rightarrow> 'Var\\<^sub>C Mds \\<Rightarrow> ('Var\\<^sub>C, 'Val) Mem \\<Rightarrow> (_,_,_) LocalConf\"\n  (\"\\<langle>_, _, _\\<rangle>\\<^sub>C\" [0, 0, 0] 1000)\nwhere\n  \"\\<langle> c, mds, mem \\<rangle>\\<^sub>C \\<equiv> ((c, mds), mem)\"\n\nabbreviation \n  eval_abv\\<^sub>A :: \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val) LocalConf \\<Rightarrow> (_, _, _) LocalConf \\<Rightarrow> bool\"\n  (infixl \"\\<leadsto>\\<^sub>A\" 70)\n where\n  \"x \\<leadsto>\\<^sub>A y \\<equiv> (x, y) \\<in> eval\\<^sub>A\"\n\nabbreviation \n  eval_abv\\<^sub>C :: \"('Com\\<^sub>C, 'Var\\<^sub>C, 'Val) LocalConf \\<Rightarrow> (_, _, _) LocalConf \\<Rightarrow> bool\"\n  (infixl \"\\<leadsto>\\<^sub>C\" 70)\nwhere\n  \"x \\<leadsto>\\<^sub>C y \\<equiv> (x, y) \\<in> eval\\<^sub>C\"\n\ndefinition\n  preserves_modes_mem :: \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val, 'Com\\<^sub>C, 'Var\\<^sub>C) state_relation \\<Rightarrow> bool\"\nwhere\n  \"preserves_modes_mem \\<R> \\<equiv> \n  (\\<forall> c\\<^sub>A mds\\<^sub>A mem\\<^sub>A c\\<^sub>C mds\\<^sub>C mem\\<^sub>C. (\\<langle> c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n      (\\<forall>x\\<^sub>A. (mem\\<^sub>A x\\<^sub>A) = (mem\\<^sub>C (var\\<^sub>C_of x\\<^sub>A))) \\<and>\n      (\\<forall>m. var\\<^sub>C_of ` mds\\<^sub>A m = (range var\\<^sub>C_of) \\<inter> mds\\<^sub>C m))\"\n\ndefinition\n  mem\\<^sub>A_of :: \"('Var\\<^sub>C, 'Val) Mem \\<Rightarrow> ('Var\\<^sub>A, 'Val) Mem\"\nwhere\n  \"mem\\<^sub>A_of mem\\<^sub>C \\<equiv>  (\\<lambda>x\\<^sub>A. (mem\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)))\"\n  \ndefinition\n  mds\\<^sub>A_of :: \"'Var\\<^sub>C Mds \\<Rightarrow> 'Var\\<^sub>A Mds\"\nwhere\n  \"mds\\<^sub>A_of mds\\<^sub>C \\<equiv> (\\<lambda> m. (inv var\\<^sub>C_of) ` (range var\\<^sub>C_of \\<inter> mds\\<^sub>C m))\"\n\nlemma low_mds_eq_from_conc_to_abs:\n  \"conc.low_mds_eq mds mem mem' \\<Longrightarrow> abs.low_mds_eq (mds\\<^sub>A_of mds) (mem\\<^sub>A_of mem) (mem\\<^sub>A_of mem')\"\n  apply(clarsimp simp: abs.low_mds_eq_def conc.low_mds_eq_def mem\\<^sub>A_of_def mds\\<^sub>A_of_def)\n  using var\\<^sub>C_of_inj \n  by (metis IntI control_vars_are_A_vars dma_consistent image_eqI inv_f_f rangeI)\n\ndefinition\n  var\\<^sub>A_of :: \"'Var\\<^sub>C \\<Rightarrow> 'Var\\<^sub>A\"\nwhere\n  \"var\\<^sub>A_of \\<equiv> inv var\\<^sub>C_of\"\n\nlemma preserves_modes_mem_mem\\<^sub>A_simp:\n  \"(\\<forall>x\\<^sub>A. (mem\\<^sub>A x\\<^sub>A) = (mem\\<^sub>C (var\\<^sub>C_of x\\<^sub>A))) \\<Longrightarrow>\n      mem\\<^sub>A = mem\\<^sub>A_of mem\\<^sub>C\"\n  unfolding mem\\<^sub>A_of_def by blast\n\n\nlemma preserves_modes_mem_mds\\<^sub>A_simp:\n  \"(\\<forall>m. var\\<^sub>C_of ` mds\\<^sub>A m = range (var\\<^sub>C_of) \\<inter> mds\\<^sub>C m) \\<Longrightarrow>\n      mds\\<^sub>A = mds\\<^sub>A_of mds\\<^sub>C\"\n  unfolding mds\\<^sub>A_of_def\n  apply(rule ext)\n  apply(drule_tac x=m in spec)\n  apply(rule equalityI)\n   apply clarsimp\n   apply(rename_tac x\\<^sub>A)\n   apply(drule equalityD1)\n   apply(drule_tac c=\"var\\<^sub>C_of x\\<^sub>A\" in subsetD)\n    apply blast\n   unfolding image_def\n   apply clarsimp\n   apply(rule_tac x=\"var\\<^sub>C_of x\\<^sub>A\" in bexI)\n    apply(rule sym)\n    apply(rule inv_f_f[OF var\\<^sub>C_of_inj])\n   apply(drule inj_onD[OF var\\<^sub>C_of_inj])\n   apply blast+\n  apply clarsimp\n  apply(rename_tac x\\<^sub>A)\n  apply(simp add: inv_f_f[OF var\\<^sub>C_of_inj])\n  apply(drule equalityD2)\n  apply(drule_tac c=\"var\\<^sub>C_of x\\<^sub>A\" in subsetD)\n   apply blast\n  apply clarsimp\n  apply(drule inj_onD[OF var\\<^sub>C_of_inj])\n  apply blast+\n  done\n\ntext \\<open>\n  This version might be more useful. Not sure yet.\n\\<close>\nlemma preserves_modes_mem_def2:\n  \"preserves_modes_mem \\<R> =\n  (\\<forall> c\\<^sub>A mds\\<^sub>A mem\\<^sub>A c\\<^sub>C mds\\<^sub>C mem\\<^sub>C. (\\<langle> c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n      mem\\<^sub>A = mem\\<^sub>A_of mem\\<^sub>C \\<and>\n      mds\\<^sub>A = mds\\<^sub>A_of mds\\<^sub>C)\"\n  unfolding preserves_modes_mem_def\n  apply(rule iffI)\n   apply(blast dest: preserves_modes_mem_mem\\<^sub>A_simp preserves_modes_mem_mds\\<^sub>A_simp)\n  apply safe\n     apply(elim allE impE, assumption, elim conjE)\n     apply(simp add: mem\\<^sub>A_of_def)\n    apply blast\n   apply clarsimp\n   apply(rename_tac x\\<^sub>A)\n   apply(elim allE impE, assumption, elim conjE)\n   apply clarsimp\n   apply(clarsimp simp: mds\\<^sub>A_of_def image_def)\n   apply(simp add: inv_f_f[OF var\\<^sub>C_of_inj])\n  apply clarsimp\n  apply(rename_tac x\\<^sub>A)\n  apply(rule imageI)\n  apply(elim allE impE, assumption, elim conjE)\n  apply(clarsimp simp: mds\\<^sub>A_of_def)\n  apply(subst image_def)\n  apply clarify\n  apply(rule_tac x=\"var\\<^sub>C_of x\\<^sub>A\" in bexI)\n   apply(simp add: inv_f_f[OF var\\<^sub>C_of_inj])\n  apply blast\n  done\n\ndefinition\n  closed_others :: \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val, 'Com\\<^sub>C, 'Var\\<^sub>C) state_relation \\<Rightarrow> bool\"\nwhere\n  \"closed_others \\<R> \\<equiv> \n  (\\<forall> c\\<^sub>A c\\<^sub>C mds\\<^sub>C mem\\<^sub>C mem\\<^sub>C'. (\\<langle> c\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>C \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n   (\\<forall>x. mem\\<^sub>C x \\<noteq> mem\\<^sub>C' x \\<longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x) \\<longrightarrow>\n   (\\<forall>x. dma\\<^sub>C mem\\<^sub>C x \\<noteq> dma\\<^sub>C mem\\<^sub>C' x \\<longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x) \\<longrightarrow>\n         (\\<langle> c\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>C' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R>)\"\n\ndefinition\n  stops\\<^sub>C :: \"('Com\\<^sub>C, 'Var\\<^sub>C, 'Val) LocalConf \\<Rightarrow> bool\"\nwhere\n  \"stops\\<^sub>C c \\<equiv> \\<forall>c'. \\<not> (c \\<leadsto>\\<^sub>C c')\"\n\nlemmas neval_induct = abs.neval.induct[consumes 1, case_names Zero Suc]\n\n(* FIXME: move to Security.thy or similar *)\nlemma strong_low_bisim_neval':\n  \"abs.neval c\\<^sub>1 n c\\<^sub>n \\<Longrightarrow> (c\\<^sub>1,c\\<^sub>1') \\<in> \\<R>\\<^sub>A \\<Longrightarrow> snd (fst c\\<^sub>1) = snd (fst c\\<^sub>1') \\<Longrightarrow> abs.strong_low_bisim_mm \\<R>\\<^sub>A \\<Longrightarrow>\n  \\<exists>c\\<^sub>n'. abs.neval c\\<^sub>1' n c\\<^sub>n' \\<and> (c\\<^sub>n,c\\<^sub>n') \\<in> \\<R>\\<^sub>A \\<and> snd (fst c\\<^sub>n) = snd (fst (c\\<^sub>n'))\"\nproof(induct  arbitrary: c\\<^sub>1' rule: neval_induct)\n  case (Zero c\\<^sub>1 c\\<^sub>n)\n   hence \"abs.neval c\\<^sub>1' 0 c\\<^sub>1' \\<and> (c\\<^sub>n, c\\<^sub>1') \\<in> \\<R>\\<^sub>A \\<and> snd (fst c\\<^sub>n) = snd (fst c\\<^sub>1')\"\n     by(blast intro: abs.neval.intros(1))\n   thus ?case by blast\nnext\n  case (Suc lc\\<^sub>0 lc\\<^sub>1 n lc\\<^sub>n lc\\<^sub>0')\n  obtain c\\<^sub>0 mds\\<^sub>0 mem\\<^sub>0 \n  where [simp]: \"lc\\<^sub>0 = \\<langle>c\\<^sub>0, mds\\<^sub>0, mem\\<^sub>0\\<rangle>\\<^sub>A\" by (case_tac lc\\<^sub>0, auto)\n  obtain c\\<^sub>1 mds\\<^sub>1 mem\\<^sub>1 \n  where [simp]: \"lc\\<^sub>1 = \\<langle>c\\<^sub>1, mds\\<^sub>1, mem\\<^sub>1\\<rangle>\\<^sub>A\" by (case_tac lc\\<^sub>1, auto)\n  from \\<open>snd (fst lc\\<^sub>0) = snd (fst lc\\<^sub>0')\\<close> obtain c\\<^sub>0' mem\\<^sub>0'\n  where [simp]: \"lc\\<^sub>0' = \\<langle>c\\<^sub>0', mds\\<^sub>0, mem\\<^sub>0'\\<rangle>\\<^sub>A\" by (case_tac lc\\<^sub>0', auto)\n  \n  from \\<open>(lc\\<^sub>0, lc\\<^sub>0') \\<in> \\<R>\\<^sub>A\\<close>[simplified] \\<open>lc\\<^sub>0 \\<leadsto>\\<^sub>A lc\\<^sub>1\\<close>[simplified] \\<open>abs.strong_low_bisim_mm \\<R>\\<^sub>A\\<close>\n  obtain c\\<^sub>1' mem\\<^sub>1' where a: \"\\<langle>c\\<^sub>0',mds\\<^sub>0, mem\\<^sub>0'\\<rangle>\\<^sub>A \\<leadsto>\\<^sub>A \\<langle>c\\<^sub>1',mds\\<^sub>1, mem\\<^sub>1'\\<rangle>\\<^sub>A\" and \n          b: \"(\\<langle>c\\<^sub>1,mds\\<^sub>1,mem\\<^sub>1\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>1',mds\\<^sub>1, mem\\<^sub>1'\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A\"\n    unfolding abs.strong_low_bisim_mm_def\n    by blast\n\n  from this Suc.hyps Suc(6) obtain lc\\<^sub>S' where \"abs.neval \\<langle>c\\<^sub>1',mds\\<^sub>1,mem\\<^sub>1'\\<rangle>\\<^sub>A n lc\\<^sub>S'\" and \"(lc\\<^sub>n, lc\\<^sub>S') \\<in> \\<R>\\<^sub>A\" and \"snd (fst lc\\<^sub>n) = snd (fst lc\\<^sub>S')\"\n    by force\n  with Suc this a b show ?case by(fastforce intro: abs.neval.intros(2))\nqed\n\nlemma strong_low_bisim_neval:\n  \"abs.neval \\<langle>c\\<^sub>1,mds\\<^sub>1,mem\\<^sub>1\\<rangle>\\<^sub>A n \\<langle>c\\<^sub>n,mds\\<^sub>n,mem\\<^sub>n\\<rangle>\\<^sub>A \\<Longrightarrow> (\\<langle>c\\<^sub>1,mds\\<^sub>1,mem\\<^sub>1\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>1',mds\\<^sub>1,mem\\<^sub>1'\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<Longrightarrow> abs.strong_low_bisim_mm \\<R>\\<^sub>A \\<Longrightarrow>\n  \\<exists>c\\<^sub>n' mem\\<^sub>n'. abs.neval \\<langle>c\\<^sub>1',mds\\<^sub>1,mem\\<^sub>1'\\<rangle>\\<^sub>A n \\<langle>c\\<^sub>n',mds\\<^sub>n,mem\\<^sub>n'\\<rangle>\\<^sub>A \\<and> (\\<langle>c\\<^sub>n,mds\\<^sub>n,mem\\<^sub>n\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>n',mds\\<^sub>n,mem\\<^sub>n'\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A\"\n  by(drule strong_low_bisim_neval', simp+)\n\nlemma in_\\<R>_dma':\n  assumes preserves: \"preserves_modes_mem \\<R>\"\n  assumes in_\\<R>: \"(\\<langle>c\\<^sub>A,mds\\<^sub>A,mem\\<^sub>A\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>C,mds\\<^sub>C,mem\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n  shows  \"dma\\<^sub>A mem\\<^sub>A x\\<^sub>A = dma\\<^sub>C mem\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)\"\nproof -\n  from assms have\n    mds\\<^sub>A_def: \"mds\\<^sub>A = mds\\<^sub>A_of mds\\<^sub>C\" and  \n    mem\\<^sub>A_def: \"mem\\<^sub>A = mem\\<^sub>A_of mem\\<^sub>C\"\n    unfolding preserves_modes_mem_def2 by blast+\n  \n  have \"dma\\<^sub>A (mem\\<^sub>A_of mem\\<^sub>C) x\\<^sub>A = dma\\<^sub>C mem\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)\"\n    unfolding mem\\<^sub>A_of_def\n    by(rule dma_consistent)\n  \n  thus ?thesis\n    by(simp add: mem\\<^sub>A_def)\nqed\n\nlemma in_\\<R>_dma:\n  assumes preserves: \"preserves_modes_mem \\<R>\"\n  assumes in_\\<R>: \"(\\<langle>c\\<^sub>A,mds\\<^sub>A,mem\\<^sub>A\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>C,mds\\<^sub>C,mem\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n  shows  \"dma\\<^sub>A mem\\<^sub>A = (dma\\<^sub>C mem\\<^sub>C \\<circ> var\\<^sub>C_of)\"\n  unfolding o_def\n  using assms by(blast intro: in_\\<R>_dma')\n\n\ndefinition\n  new_vars_private ::  \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val, 'Com\\<^sub>C, 'Var\\<^sub>C) state_relation \\<Rightarrow> bool\"\nwhere\n  \"new_vars_private \\<R> \\<equiv>\n  (\\<forall> c\\<^sub>1\\<^sub>A mds\\<^sub>A mem\\<^sub>1\\<^sub>A c\\<^sub>1\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C. \n   (\\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n    (\\<forall> c\\<^sub>1\\<^sub>C' mds\\<^sub>C' mem\\<^sub>1\\<^sub>C'. \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C \\<longrightarrow>\n     (\\<forall>v\\<^sub>C. (mem\\<^sub>1\\<^sub>C' v\\<^sub>C \\<noteq> mem\\<^sub>1\\<^sub>C v\\<^sub>C \\<or> dma\\<^sub>C mem\\<^sub>1\\<^sub>C' v\\<^sub>C < dma\\<^sub>C mem\\<^sub>1\\<^sub>C v\\<^sub>C) \\<and> v\\<^sub>C \\<notin> range var\\<^sub>C_of \\<longrightarrow> v\\<^sub>C \\<in> mds\\<^sub>C' AsmNoReadOrWrite) \\<and>\n     (mds\\<^sub>C AsmNoReadOrWrite - (range var\\<^sub>C_of)) \\<subseteq> (mds\\<^sub>C' AsmNoReadOrWrite - (range var\\<^sub>C_of))))\"\n\nlemma not_less_eq_is_greater_Sec:\n  \"(\\<not> a \\<le> (b::Sec)) = (a > b)\"\n  unfolding less_Sec_def less_eq_Sec_def using Sec.exhaust by blast\n\nlemma doesnt_have_mode:\n  \"(x \\<notin> mds\\<^sub>A_of mds\\<^sub>C m) = (var\\<^sub>C_of x \\<notin> mds\\<^sub>C m)\"\n  apply(clarsimp simp: mds\\<^sub>A_of_def image_def)\n  apply(rule iffI)\n   apply clarsimp\n   apply(drule_tac x=\"var\\<^sub>C_of x\" in bspec)\n    apply blast\n   apply(simp add: inv_f_f[OF var\\<^sub>C_of_inj])\n  apply(clarify)\n  apply(simp add: inv_f_f[OF var\\<^sub>C_of_inj])\n  done\n\nlemma new_vars_private_does_the_thing:\n  assumes nice: \"new_vars_private \\<R>\"\n  assumes in_\\<R>\\<^sub>1: \"(\\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R>\"\n  assumes in_\\<R>\\<^sub>2: \"(\\<langle> c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R>\"\n  assumes step\\<^sub>1\\<^sub>C: \"\\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C\"\n  assumes step\\<^sub>2\\<^sub>C: \"\\<langle> c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C' \\<rangle>\\<^sub>C\"\n  assumes low_mds_eq\\<^sub>C: \"conc.low_mds_eq mds\\<^sub>C mem\\<^sub>1\\<^sub>C mem\\<^sub>2\\<^sub>C\"\n  assumes low_mds_eq\\<^sub>A': \"abs.low_mds_eq (mds\\<^sub>A_of mds\\<^sub>C') (mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C') (mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C')\" \n  shows \"conc.low_mds_eq mds\\<^sub>C' mem\\<^sub>1\\<^sub>C' mem\\<^sub>2\\<^sub>C'\"\n  unfolding conc.low_mds_eq_def\nproof(clarify)\n  let ?mem\\<^sub>1\\<^sub>A = \"mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\"\n  let ?mem\\<^sub>2\\<^sub>A = \"mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\"\n  let ?mem\\<^sub>1\\<^sub>A' = \"mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C'\"\n  let ?mem\\<^sub>2\\<^sub>A' = \"mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C'\"\n  let ?mds\\<^sub>A = \"mds\\<^sub>A_of mds\\<^sub>C\"\n  let ?mds\\<^sub>A' = \"mds\\<^sub>A_of mds\\<^sub>C'\"\n  fix x\\<^sub>C\n  assume is_Low\\<^sub>C': \"dma\\<^sub>C mem\\<^sub>1\\<^sub>C' x\\<^sub>C = Low\"\n  assume is_readable\\<^sub>C': \"x\\<^sub>C \\<in> \\<C>\\<^sub>C \\<or> x\\<^sub>C \\<notin> mds\\<^sub>C' AsmNoReadOrWrite\"\n  show \"mem\\<^sub>1\\<^sub>C' x\\<^sub>C = mem\\<^sub>2\\<^sub>C' x\\<^sub>C\"\n  proof(cases \"dma\\<^sub>C mem\\<^sub>1\\<^sub>C' x\\<^sub>C \\<ge> dma\\<^sub>C mem\\<^sub>1\\<^sub>C x\\<^sub>C \\<and> mem\\<^sub>1\\<^sub>C' x\\<^sub>C = mem\\<^sub>1\\<^sub>C x\\<^sub>C \\<and> mem\\<^sub>2\\<^sub>C' x\\<^sub>C = mem\\<^sub>2\\<^sub>C x\\<^sub>C \\<and> (x\\<^sub>C \\<in> mds\\<^sub>C AsmNoReadOrWrite \\<longrightarrow> x\\<^sub>C \\<in> mds\\<^sub>C' AsmNoReadOrWrite)\")\n    assume easy: \"dma\\<^sub>C mem\\<^sub>1\\<^sub>C' x\\<^sub>C \\<ge> dma\\<^sub>C mem\\<^sub>1\\<^sub>C x\\<^sub>C \\<and> mem\\<^sub>1\\<^sub>C' x\\<^sub>C = mem\\<^sub>1\\<^sub>C x\\<^sub>C \\<and> mem\\<^sub>2\\<^sub>C' x\\<^sub>C = mem\\<^sub>2\\<^sub>C x\\<^sub>C \\<and> (x\\<^sub>C \\<in> mds\\<^sub>C AsmNoReadOrWrite \\<longrightarrow> x\\<^sub>C \\<in> mds\\<^sub>C' AsmNoReadOrWrite)\"\n    with is_Low\\<^sub>C' have is_Low\\<^sub>C: \"dma\\<^sub>C mem\\<^sub>1\\<^sub>C x\\<^sub>C = Low\" by (simp add: less_eq_Sec_def)\n    from easy is_readable\\<^sub>C' have is_readable\\<^sub>C: \"x\\<^sub>C \\<in> \\<C>\\<^sub>C \\<or> x\\<^sub>C \\<notin> mds\\<^sub>C AsmNoReadOrWrite\" by blast\n    from is_Low\\<^sub>C is_readable\\<^sub>C low_mds_eq\\<^sub>C have \"mem\\<^sub>1\\<^sub>C x\\<^sub>C = mem\\<^sub>2\\<^sub>C x\\<^sub>C\"\n      unfolding conc.low_mds_eq_def by blast\n    with easy show ?thesis by metis\n  next\n    assume a: \"\\<not> (dma\\<^sub>C mem\\<^sub>1\\<^sub>C x\\<^sub>C \\<le> dma\\<^sub>C mem\\<^sub>1\\<^sub>C' x\\<^sub>C \\<and>\n       mem\\<^sub>1\\<^sub>C' x\\<^sub>C = mem\\<^sub>1\\<^sub>C x\\<^sub>C \\<and>\n       mem\\<^sub>2\\<^sub>C' x\\<^sub>C = mem\\<^sub>2\\<^sub>C x\\<^sub>C \\<and> (x\\<^sub>C \\<in> mds\\<^sub>C AsmNoReadOrWrite \\<longrightarrow> x\\<^sub>C \\<in> mds\\<^sub>C' AsmNoReadOrWrite))\"\n    hence a_disj: \"(dma\\<^sub>C mem\\<^sub>1\\<^sub>C x\\<^sub>C > dma\\<^sub>C mem\\<^sub>1\\<^sub>C' x\\<^sub>C \\<or>\n       mem\\<^sub>1\\<^sub>C' x\\<^sub>C \\<noteq> mem\\<^sub>1\\<^sub>C x\\<^sub>C \\<or>\n       mem\\<^sub>2\\<^sub>C' x\\<^sub>C \\<noteq> mem\\<^sub>2\\<^sub>C x\\<^sub>C \\<or> (x\\<^sub>C \\<in> mds\\<^sub>C AsmNoReadOrWrite \\<and> x\\<^sub>C \\<notin> mds\\<^sub>C' AsmNoReadOrWrite))\"\n       using not_less_eq_is_greater_Sec by blast\n    show \"mem\\<^sub>1\\<^sub>C' x\\<^sub>C = mem\\<^sub>2\\<^sub>C' x\\<^sub>C\"\n    proof(cases \"x\\<^sub>C \\<in> range var\\<^sub>C_of\")\n      assume C_only_var: \"x\\<^sub>C \\<notin> range var\\<^sub>C_of\"\n      with in_\\<R>\\<^sub>1 step\\<^sub>1\\<^sub>C nice\n      have \"(mem\\<^sub>1\\<^sub>C' x\\<^sub>C \\<noteq> mem\\<^sub>1\\<^sub>C x\\<^sub>C \\<or> dma\\<^sub>C mem\\<^sub>1\\<^sub>C' x\\<^sub>C < dma\\<^sub>C mem\\<^sub>1\\<^sub>C x\\<^sub>C) \\<longrightarrow> x\\<^sub>C \\<in> mds\\<^sub>C' AsmNoReadOrWrite\"\n        unfolding new_vars_private_def  by blast\n      moreover from C_only_var in_\\<R>\\<^sub>2 step\\<^sub>2\\<^sub>C nice have \"(mem\\<^sub>2\\<^sub>C' x\\<^sub>C \\<noteq> mem\\<^sub>2\\<^sub>C x\\<^sub>C) \\<longrightarrow> x\\<^sub>C \\<in> mds\\<^sub>C' AsmNoReadOrWrite\"\n        unfolding new_vars_private_def by blast\n      moreover from C_only_var in_\\<R>\\<^sub>1 step\\<^sub>1\\<^sub>C nice have \"x\\<^sub>C \\<in> mds\\<^sub>C AsmNoReadOrWrite \\<longrightarrow> x\\<^sub>C \\<in> mds\\<^sub>C' AsmNoReadOrWrite\" unfolding new_vars_private_def by blast\n      moreover from C_only_var is_readable\\<^sub>C' have \"x\\<^sub>C \\<notin> mds\\<^sub>C' AsmNoReadOrWrite\"\n        using control_vars_are_A_vars by blast\n      ultimately have False using a_disj by blast\n      thus ?thesis by blast\n    next\n      assume in_val\\<^sub>C_of: \"x\\<^sub>C \\<in> range var\\<^sub>C_of\"\n      from this obtain x\\<^sub>A where x\\<^sub>C_def: \"x\\<^sub>C = var\\<^sub>C_of x\\<^sub>A\" by blast\n      from is_Low\\<^sub>C' have is_Low\\<^sub>A': \"dma\\<^sub>A ?mem\\<^sub>1\\<^sub>A' x\\<^sub>A = Low\"\n        using dma_consistent unfolding mem\\<^sub>A_of_def x\\<^sub>C_def by force\n      from is_readable\\<^sub>C' have is_readable\\<^sub>A': \"x\\<^sub>A \\<in> \\<C>\\<^sub>A \\<or> x\\<^sub>A \\<notin> ?mds\\<^sub>A' AsmNoReadOrWrite\"\n        using control_vars_are_A_vars x\\<^sub>C_def doesnt_have_mode[symmetric] var\\<^sub>C_of_inj inj_image_mem_iff by fast\n      with is_Low\\<^sub>A' low_mds_eq\\<^sub>A' have x\\<^sub>A_eq': \"?mem\\<^sub>1\\<^sub>A' x\\<^sub>A = ?mem\\<^sub>2\\<^sub>A' x\\<^sub>A\" \n        unfolding abs.low_mds_eq_def by blast\n      thus ?thesis by(simp add: mem\\<^sub>A_of_def x\\<^sub>C_def)\n    qed\n  qed\nqed\n\n  \ntext \\<open>\n  Perhaps surprisingly, we don't necessarily \n  care whether the refinement preserves\n  termination or divergence behaviour from the source to the target program.\n  It can do whatever it likes, so long as it transforms two source programs\n  that are low bisimilar (i.e. perform the same low actions at the \n  same time), into two target ones that perform the same low actions at the\n  same time.\n\n  Having the concrete step correspond to zero abstract ones is like expanding\n  abstract code out (think e.g. of side-effect free expression evaluation).\n  Having the concrete step correspond to more than one abstract step is\n  like optimising out abstract code. But importantly, the optimisation needs\n  to look the same for abstract-bisimilar code.\n\n  Additionally, we allow the instantiation of this theory to supply\n  an arbitrary predicate that can be used to restrict our consideration to\n  pairs of concrete steps that correspond to each other in terms of progress.\n  This is particularly important for distinguishing between multiple concrete\n  steps derived from the expansion of a single abstract step.\n\\<close>\ndefinition\n  secure_refinement :: \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val) LocalConf rel \\<Rightarrow> ('Com\\<^sub>A, 'Var\\<^sub>A, 'Val, 'Com\\<^sub>C, 'Var\\<^sub>C) state_relation \\<Rightarrow> \n                          ('Com\\<^sub>C, 'Var\\<^sub>C, 'Val) LocalConf rel \\<Rightarrow> bool\"\nwhere\n  \"secure_refinement \\<R>\\<^sub>A \\<R> P \\<equiv>\n  closed_others \\<R> \\<and>\n  preserves_modes_mem \\<R> \\<and>\n  new_vars_private \\<R> \\<and>\n  conc.closed_glob_consistent P \\<and>\n  (\\<forall> c\\<^sub>1\\<^sub>A mds\\<^sub>A mem\\<^sub>1\\<^sub>A c\\<^sub>1\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C. \n   (\\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n    (\\<forall> c\\<^sub>1\\<^sub>C' mds\\<^sub>C' mem\\<^sub>1\\<^sub>C'. \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C \\<longrightarrow>\n     (\\<exists> n c\\<^sub>1\\<^sub>A' mds\\<^sub>A' mem\\<^sub>1\\<^sub>A'. abs.neval \\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A \\<rangle>\\<^sub>A n \\<langle> c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A' \\<rangle>\\<^sub>A \\<and>\n                   (\\<langle> c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n       (\\<forall>c\\<^sub>2\\<^sub>A mem\\<^sub>2\\<^sub>A c\\<^sub>2\\<^sub>C mem\\<^sub>2\\<^sub>C c\\<^sub>2\\<^sub>A' mem\\<^sub>2\\<^sub>A'. \n         (\\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A \\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<and>\n         (\\<langle> c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n         (\\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C, \\<langle> c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>C) \\<in> P \\<and>\n         abs.neval \\<langle> c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A \\<rangle>\\<^sub>A n \\<langle> c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A' \\<rangle>\\<^sub>A  \\<longrightarrow>\n           (\\<exists> c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'. \\<langle> c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C' \\<rangle>\\<^sub>C \\<and>\n                   (\\<langle> c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n                   (\\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C, \\<langle> c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> P)))))\"\n\nlemma preserves_modes_memD:\n  \"\\<lbrakk>preserves_modes_mem \\<R>; (\\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\\<rbrakk> \\<Longrightarrow> mem\\<^sub>A = mem\\<^sub>A_of mem\\<^sub>C \\<and> mds\\<^sub>A = mds\\<^sub>A_of mds\\<^sub>C\"\n  using preserves_modes_mem_def2 by blast\n\nlemma secure_refinement_def2:\n  \"secure_refinement \\<R>\\<^sub>A \\<R> P \\<equiv>\n  closed_others \\<R> \\<and>\n  preserves_modes_mem \\<R> \\<and>\n  new_vars_private \\<R> \\<and>\n  conc.closed_glob_consistent P \\<and>\n  (\\<forall> c\\<^sub>1\\<^sub>A c\\<^sub>1\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C. \n   (\\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n    (\\<forall> c\\<^sub>1\\<^sub>C' mds\\<^sub>C' mem\\<^sub>1\\<^sub>C'. \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C \\<longrightarrow>\n     (\\<exists> n c\\<^sub>1\\<^sub>A'. abs.neval \\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>A n \\<langle> c\\<^sub>1\\<^sub>A', mds\\<^sub>A_of mds\\<^sub>C', mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>A \\<and>\n                   (\\<langle> c\\<^sub>1\\<^sub>A', mds\\<^sub>A_of mds\\<^sub>C', mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n       (\\<forall>c\\<^sub>2\\<^sub>A c\\<^sub>2\\<^sub>C mem\\<^sub>2\\<^sub>C c\\<^sub>2\\<^sub>A' mem\\<^sub>2\\<^sub>A'. \n         (\\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<and>\n         (\\<langle> c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n         (\\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C, \\<langle> c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>C) \\<in> P \\<and>\n         abs.neval \\<langle> c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>A n \\<langle> c\\<^sub>2\\<^sub>A', mds\\<^sub>A_of mds\\<^sub>C', mem\\<^sub>2\\<^sub>A' \\<rangle>\\<^sub>A  \\<longrightarrow>\n           (\\<exists> c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'. \\<langle> c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C' \\<rangle>\\<^sub>C \\<and>\n                   (\\<langle> c\\<^sub>2\\<^sub>A', mds\\<^sub>A_of mds\\<^sub>C', mem\\<^sub>2\\<^sub>A' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n                   (\\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C, \\<langle> c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> P)))))\"\n  apply(rule eq_reflection)\n  unfolding secure_refinement_def\n  apply(rule conj_cong)\n   apply(fastforce)\n  apply(rule conj_cong)\n   apply(fastforce)\n  apply(rule conj_cong)\n   apply(fastforce)\n  apply(rule conj_cong, fastforce)\n  apply(rule iffI)\n   apply(intro allI conjI impI)\n   apply((drule spec)+,erule (1) impE)\n   apply((drule spec)+,erule (1) impE)\n   using preserves_modes_memD apply metis\n  apply(intro allI conjI impI)\n  apply(frule (1) preserves_modes_memD, clarify)\n  apply((drule spec)+,erule (1) impE)\n  apply((drule spec)+,erule (1) impE)\n  using preserves_modes_memD apply metis\n  done\n\nlemma extra_vars_are_not_control_vars:\n  \"x \\<notin> range var\\<^sub>C_of \\<Longrightarrow> x \\<notin> \\<C>\\<^sub>C\"\n  proof(erule contrapos_nn)\n    assume \"x \\<in> \\<C>\\<^sub>C\"\n    from this obtain x\\<^sub>A where \"x = var\\<^sub>C_of x\\<^sub>A\"\n      using control_vars_are_A_vars by blast\n    thus \"x \\<in> range var\\<^sub>C_of\" by blast\n  qed\n\ndefinition\n  R\\<^sub>C_of :: \n \"((('Com\\<^sub>A \\<times> (Mode \\<Rightarrow> 'Var\\<^sub>A set)) \\<times> ('Var\\<^sub>A \\<Rightarrow> 'Val)) \\<times>\n    ('Com\\<^sub>A \\<times> (Mode \\<Rightarrow> 'Var\\<^sub>A set)) \\<times> ('Var\\<^sub>A \\<Rightarrow> 'Val)) set \\<Rightarrow> \n  ('Com\\<^sub>A, 'Var\\<^sub>A, 'Val, 'Com\\<^sub>C, 'Var\\<^sub>C) state_relation \\<Rightarrow>\n  ((('Com\\<^sub>C \\<times> (Mode \\<Rightarrow> 'Var\\<^sub>C set)) \\<times> ('Var\\<^sub>C \\<Rightarrow> 'Val)) \\<times>\n    ('Com\\<^sub>C \\<times> (Mode \\<Rightarrow> 'Var\\<^sub>C set)) \\<times> ('Var\\<^sub>C \\<Rightarrow> 'Val)) set \\<Rightarrow>\n  ((('Com\\<^sub>C \\<times> (Mode \\<Rightarrow> 'Var\\<^sub>C set)) \\<times> ('Var\\<^sub>C \\<Rightarrow> 'Val)) \\<times>\n    ('Com\\<^sub>C \\<times> (Mode \\<Rightarrow> 'Var\\<^sub>C set)) \\<times> ('Var\\<^sub>C \\<Rightarrow> 'Val)) set\"\nwhere\n  \"R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P \\<equiv> {(x,y). \\<exists>x\\<^sub>A y\\<^sub>A. (x\\<^sub>A,x) \\<in> \\<R> \\<and> (y\\<^sub>A,y) \\<in> \\<R> \\<and> (x\\<^sub>A,y\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<and>\n     snd (fst x) = snd (fst y) \\<comment> \\<open>TODO: annoying to have to say\\<close> \\<and>\n     conc.low_mds_eq (snd (fst x)) (snd x) (snd y) \\<and>\n     (x,y) \\<in> P}\"\n\nlemma abs_low_mds_eq_dma\\<^sub>C_eq:\n  assumes \"abs.low_mds_eq (mds\\<^sub>A_of mds) (mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C)  (mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C)\"\n  shows \"dma\\<^sub>C mem\\<^sub>1\\<^sub>C = dma\\<^sub>C mem\\<^sub>2\\<^sub>C\"\n  proof(rule conc.dma_\\<C>, rule ballI)\n    fix x\\<^sub>C\n    assume \"x\\<^sub>C \\<in> \\<C>\\<^sub>C\"\n    from this obtain x\\<^sub>A where \"var\\<^sub>C_of x\\<^sub>A = x\\<^sub>C\" and \"x\\<^sub>A \\<in> \\<C>\\<^sub>A\" using control_vars_are_A_vars by blast\n    from assms \\<open>x\\<^sub>A \\<in> \\<C>\\<^sub>A\\<close> have \"(mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) x\\<^sub>A = (mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C) x\\<^sub>A\"\n      unfolding abs.low_mds_eq_def\n      using abs.\\<C>_Low by blast\n    thus \"(mem\\<^sub>1\\<^sub>C x\\<^sub>C) = (mem\\<^sub>2\\<^sub>C x\\<^sub>C)\"\n      using \\<open>var\\<^sub>C_of x\\<^sub>A = x\\<^sub>C\\<close> unfolding mem\\<^sub>A_of_def by blast\n  qed\n\nlemma R\\<^sub>C_ofD:\n  assumes rr: \"secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  assumes in_R: \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C', mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P\"\n  shows\n   \"(\\<exists>c\\<^sub>1\\<^sub>A c\\<^sub>2\\<^sub>A.  (\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n             (\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n             (\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A) \\<and>\n    (mds\\<^sub>C' = mds\\<^sub>C) \\<and>\n    conc.low_mds_eq mds\\<^sub>C mem\\<^sub>1\\<^sub>C mem\\<^sub>2\\<^sub>C \\<and>\n    (\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C', mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P\"\n  proof -\n  have \\<R>_preserves_modes_mem: \"preserves_modes_mem \\<R>\"\n    using rr unfolding secure_refinement_def by blast\n\n  from in_R obtain c\\<^sub>1\\<^sub>A mds\\<^sub>1\\<^sub>A mem\\<^sub>1\\<^sub>A c\\<^sub>2\\<^sub>A mds\\<^sub>2\\<^sub>A mem\\<^sub>2\\<^sub>A where\n  in_\\<R>\\<^sub>1: \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>1\\<^sub>A, mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\" and\n  in_\\<R>\\<^sub>2: \"(\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>2\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C', mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\" and\n  in_\\<R>\\<^sub>A: \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>1\\<^sub>A, mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>2\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A\" and\n  pred_holds: \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P\" and\n  mds_eq: \"mds\\<^sub>C = mds\\<^sub>C'\" and\n  mds_eq: \"conc.low_mds_eq mds\\<^sub>C mem\\<^sub>1\\<^sub>C mem\\<^sub>2\\<^sub>C\"\n    unfolding R\\<^sub>C_of_def by force+\n  \n  from this \\<R>_preserves_modes_mem[simplified preserves_modes_mem_def2, rule_format, OF in_\\<R>\\<^sub>1] \\<R>_preserves_modes_mem[simplified preserves_modes_mem_def2, rule_format, OF in_\\<R>\\<^sub>2]\n    show ?thesis by blast\nqed\n\nlemma R\\<^sub>C_ofI:\n   \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<Longrightarrow>\n    (\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<Longrightarrow>\n    (\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<Longrightarrow>\n    conc.low_mds_eq mds\\<^sub>C mem\\<^sub>1\\<^sub>C mem\\<^sub>2\\<^sub>C \\<Longrightarrow>\n    (\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P \\<Longrightarrow>\n     (\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P\"\n  unfolding R\\<^sub>C_of_def by fastforce\n\nlemma R\\<^sub>C_of_sym:\n  assumes \"sym \\<R>\\<^sub>A\"\n  assumes P_sym: \"sym P\"\n  assumes rr: \"secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  assumes mm: \n    \"\\<And>c\\<^sub>1 mds mem\\<^sub>1 c\\<^sub>2 mds mem\\<^sub>2. (\\<langle>c\\<^sub>1, mds, mem\\<^sub>1\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2, mds, mem\\<^sub>2\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<Longrightarrow>\n    abs.low_mds_eq mds mem\\<^sub>1 mem\\<^sub>2\"\n  shows \"sym (R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P)\"\nproof(rule symI, clarify)\n  fix c\\<^sub>1\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C  c\\<^sub>2\\<^sub>C mds\\<^sub>C' mem\\<^sub>2\\<^sub>C\n  assume in_R\\<^sub>C_of: \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C', mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P\"\n  from in_R\\<^sub>C_of obtain c\\<^sub>1\\<^sub>A c\\<^sub>2\\<^sub>A where\n  junk:\n  \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n   (\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n   (\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<and>\n    (mds\\<^sub>C' = mds\\<^sub>C) \\<and> conc.low_mds_eq mds\\<^sub>C mem\\<^sub>1\\<^sub>C mem\\<^sub>2\\<^sub>C \\<and>\n    (\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P\"\n    using rr R\\<^sub>C_ofD by fastforce+\n  hence dma_eq: \"dma\\<^sub>C mem\\<^sub>1\\<^sub>C = dma\\<^sub>C mem\\<^sub>2\\<^sub>C\"\n    using abs_low_mds_eq_dma\\<^sub>C_eq[OF mm] by blast\n  with junk have junk':\n  \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n   (\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n   (\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<and>\n    (mds\\<^sub>C' = mds\\<^sub>C) \\<and>\n   conc.low_mds_eq mds\\<^sub>C' mem\\<^sub>2\\<^sub>C mem\\<^sub>1\\<^sub>C \\<and>\n   (\\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P\"\n    using \\<open>sym \\<R>\\<^sub>A\\<close> P_sym unfolding sym_def using conc.low_mds_eq_sym by metis\n   thus \"(\\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C', mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P\"\n   using R\\<^sub>C_ofI by auto\nqed\n\nlemma R\\<^sub>C_of_simp:\n  assumes rr: \"secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  shows \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P =\n   ((\\<exists>c\\<^sub>1\\<^sub>A c\\<^sub>2\\<^sub>A.  (\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n             (\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n             (\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A) \\<and>\n    conc.low_mds_eq mds\\<^sub>C mem\\<^sub>1\\<^sub>C mem\\<^sub>2\\<^sub>C \\<and>\n    (\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P)\"\n  using assms by(blast dest: R\\<^sub>C_ofD intro: R\\<^sub>C_ofI)\n\ndefinition\n  A\\<^sub>A_of :: \"('Var\\<^sub>C,'Val) adaptation \\<Rightarrow> ('Var\\<^sub>A,'Val) adaptation\"\nwhere\n  \"A\\<^sub>A_of A \\<equiv> \\<lambda>x\\<^sub>A. case A (var\\<^sub>C_of x\\<^sub>A) of None \\<Rightarrow> None |\n                  Some (v,v') \\<Rightarrow> Some (v,v')\"\n\nlemma var_writable\\<^sub>A:\n  \"\\<not> var_asm_not_written mds\\<^sub>C (var\\<^sub>C_of x) \\<Longrightarrow> \\<not> var_asm_not_written (mds\\<^sub>A_of mds\\<^sub>C) x\"\n  apply(simp add: var_asm_not_written_def mds\\<^sub>A_of_def)\n  apply(auto simp: inv_f_f[OF var\\<^sub>C_of_inj])\n  done\n\nlemma A\\<^sub>A_asm_mem:\n  assumes A\\<^sub>C_asm_mem: \"\\<forall>x. case A\\<^sub>C x of None \\<Rightarrow> True\n           | Some (v, v') \\<Rightarrow>\n               mem\\<^sub>1\\<^sub>C x \\<noteq> v \\<or> mem\\<^sub>2\\<^sub>C x \\<noteq> v' \\<longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x\"\n  shows \"case (A\\<^sub>A_of A\\<^sub>C) x of None \\<Rightarrow> True\n           | Some (v, v') \\<Rightarrow>\n               (mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) x \\<noteq> v \\<or> (mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C) x \\<noteq> v' \\<longrightarrow> \\<not> var_asm_not_written (mds\\<^sub>A_of mds\\<^sub>C) x\"\n  apply(split option.splits, simp, intro allI impI)\n  proof -\n    fix v v'\n    assume A\\<^sub>A_not_None: \"A\\<^sub>A_of A\\<^sub>C x = Some (v, v')\"\n    assume A\\<^sub>A_updates_x: \"mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C x = v \\<longrightarrow> mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C x \\<noteq> v'\"\n    from A\\<^sub>A_not_None have\n      A\\<^sub>C_not_None: \"A\\<^sub>C (var\\<^sub>C_of x) = Some (v, v')\"\n      unfolding A\\<^sub>A_of_def by (auto split: option.splits)\n\n    from A\\<^sub>A_updates_x  have\n      A\\<^sub>C_updates_x: \"mem\\<^sub>1\\<^sub>C (var\\<^sub>C_of x) \\<noteq> v \\<or> mem\\<^sub>2\\<^sub>C (var\\<^sub>C_of x) \\<noteq> v'\"\n      unfolding mem\\<^sub>A_of_def by fastforce\n\n    from A\\<^sub>C_not_None A\\<^sub>C_updates_x A\\<^sub>C_asm_mem have\n      \"\\<not> var_asm_not_written mds\\<^sub>C (var\\<^sub>C_of x)\" by (auto split: option.splits)\n\n    thus \"\\<not> var_asm_not_written (mds\\<^sub>A_of mds\\<^sub>C) x\"\n      by(rule var_writable\\<^sub>A)\n  qed\n\nlemma dma\\<^sub>A_adaptation_eq:\n  \"dma\\<^sub>A ((mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C]) x\\<^sub>A = dma\\<^sub>C (mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C]) (var\\<^sub>C_of x\\<^sub>A)\"\n  apply(subst dma_consistent[folded mem\\<^sub>A_of_def, symmetric])\n  apply(rule_tac x=x\\<^sub>A in fun_cong)\n  apply(rule_tac f=\"dma\\<^sub>A\" in arg_cong)\n  apply(rule ext)\n  apply(clarsimp simp: apply_adaptation_def A\\<^sub>A_of_def mem\\<^sub>A_of_def split: option.splits)\n  done\n\n  \nlemma A\\<^sub>A_asm_dma:\n  assumes A\\<^sub>C_asm_dma: \"\\<forall>x. dma\\<^sub>C (mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C]) x \\<noteq> dma\\<^sub>C mem\\<^sub>1\\<^sub>C x \\<longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x\"\n  shows \"dma\\<^sub>A ((mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 (A\\<^sub>A_of A\\<^sub>C)]) x\\<^sub>A \\<noteq> dma\\<^sub>A (mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) x\\<^sub>A \\<longrightarrow> \\<not> var_asm_not_written (mds\\<^sub>A_of mds\\<^sub>C) x\\<^sub>A\"\nproof(intro impI)\n  assume A\\<^sub>A_updates_dma: \"dma\\<^sub>A ((mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C]) x\\<^sub>A \\<noteq> dma\\<^sub>A (mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) x\\<^sub>A\"\n \n  with dma_consistent[folded mem\\<^sub>A_of_def] dma\\<^sub>A_adaptation_eq\n  have \"dma\\<^sub>C (mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C]) (var\\<^sub>C_of x\\<^sub>A) \\<noteq> dma\\<^sub>C mem\\<^sub>1\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)\" by(metis)\n\n  with A\\<^sub>C_asm_dma have \"\\<not> var_asm_not_written mds\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)\" by blast\n\n  thus \" \\<not> var_asm_not_written (mds\\<^sub>A_of mds\\<^sub>C) x\\<^sub>A\" by (rule  var_writable\\<^sub>A)\nqed\n\nlemma var\\<^sub>C_of_in_\\<C>\\<^sub>C: \n  assumes \"x\\<^sub>A \\<in> \\<C>\\<^sub>A\"\n  shows \"var\\<^sub>C_of x\\<^sub>A \\<in> \\<C>\\<^sub>C\"\nproof -\n  from assms obtain y\\<^sub>A where \"x\\<^sub>A \\<in> \\<C>_vars\\<^sub>A y\\<^sub>A\"\n  unfolding abs.\\<C>_def by blast\n\n  hence \"var\\<^sub>C_of x\\<^sub>A \\<in> \\<C>_vars\\<^sub>C (var\\<^sub>C_of y\\<^sub>A)\"\n    using \\<C>_vars_consistent by blast\n\n  thus ?thesis using conc.\\<C>_def by blast\nqed\n\nlemma doesnt_have_mode\\<^sub>C:\n  \"x \\<notin> mds\\<^sub>A_of mds\\<^sub>C m \\<Longrightarrow> var\\<^sub>C_of x \\<notin> mds\\<^sub>C m\"\n  by(simp add: doesnt_have_mode)\n\nlemma has_mode\\<^sub>A: \"var\\<^sub>C_of x \\<in> mds\\<^sub>C m \\<Longrightarrow> x \\<in> mds\\<^sub>A_of mds\\<^sub>C m\"\n  using doesnt_have_mode\\<^sub>C\n  by fastforce\n\nlemma A\\<^sub>A_sec:\n  assumes A\\<^sub>C_sec: \"\\<forall>x. dma\\<^sub>C (mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C]) x = Low \\<and> (x \\<notin> mds\\<^sub>C AsmNoReadOrWrite \\<or> x \\<in> \\<C>\\<^sub>C) \\<longrightarrow>\n           mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C] x = mem\\<^sub>2\\<^sub>C [\\<parallel>\\<^sub>2 A\\<^sub>C] x\"\n  shows \"dma\\<^sub>A ((mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C]) x = Low \\<and> (x \\<notin> mds\\<^sub>A_of mds\\<^sub>C AsmNoReadOrWrite \\<or> x \\<in> \\<C>\\<^sub>A) \\<longrightarrow>\n           (mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C] x = (mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C) [\\<parallel>\\<^sub>2 A\\<^sub>A_of A\\<^sub>C] x\"\nproof(clarify)\n  assume x_is_Low: \"dma\\<^sub>A ((mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C]) x = Low\"\n  assume x_is_readable: \"x \\<notin> mds\\<^sub>A_of mds\\<^sub>C AsmNoReadOrWrite \\<or> x \\<in> \\<C>\\<^sub>A\"\n    \n  from x_is_Low have x_is_Low\\<^sub>C: \"dma\\<^sub>C (mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C]) (var\\<^sub>C_of x) = Low\"\n    using dma\\<^sub>A_adaptation_eq by simp\n  from x_is_readable have \"var\\<^sub>C_of x \\<notin> mds\\<^sub>C AsmNoReadOrWrite \\<or> var\\<^sub>C_of x \\<in> \\<C>\\<^sub>C\"\n    using doesnt_have_mode\\<^sub>C  var\\<^sub>C_of_in_\\<C>\\<^sub>C by blast\n  with A\\<^sub>C_sec x_is_Low\\<^sub>C have \"mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C] (var\\<^sub>C_of x) = mem\\<^sub>2\\<^sub>C [\\<parallel>\\<^sub>2 A\\<^sub>C] (var\\<^sub>C_of x)\"\n    by blast\n  thus \"(mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C] x = (mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C) [\\<parallel>\\<^sub>2 A\\<^sub>A_of A\\<^sub>C] x\"\n    by(auto simp: mem\\<^sub>A_of_def apply_adaptation_def A\\<^sub>A_of_def split: option.splits)\nqed\n\nlemma apply_adaptation\\<^sub>A:\n  \"(mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C] = mem\\<^sub>A_of (mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C])\"\n  \"(mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>2 A\\<^sub>A_of A\\<^sub>C] = mem\\<^sub>A_of (mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>2 A\\<^sub>C])\"\n  by(auto simp: mem\\<^sub>A_of_def A\\<^sub>A_of_def apply_adaptation_def split: option.splits)\n\n \nlemma R\\<^sub>C_of_closed_glob_consistent:\n  assumes mm: \n    \"\\<And>c\\<^sub>1 mds mem\\<^sub>1 c\\<^sub>2 mds mem\\<^sub>2. (\\<langle>c\\<^sub>1, mds, mem\\<^sub>1\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2, mds, mem\\<^sub>2\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<Longrightarrow>\n    abs.low_mds_eq mds mem\\<^sub>1 mem\\<^sub>2\"\n  assumes cgc: \"abs.closed_glob_consistent \\<R>\\<^sub>A\"\n  assumes rr: \"secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  shows \"conc.closed_glob_consistent (R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P)\"\n  unfolding conc.closed_glob_consistent_def\nproof(clarify)\n  fix c\\<^sub>1\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C c\\<^sub>2\\<^sub>C mem\\<^sub>2\\<^sub>C A\\<^sub>C\n  assume \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P\"\n  from this rr obtain c\\<^sub>1\\<^sub>A c\\<^sub>2\\<^sub>A where\n       in_\\<R>\\<^sub>A:  \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A\" and\n       in_\\<R>\\<^sub>1:  \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\" and\n       in_\\<R>\\<^sub>2:  \"(\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n         and\n       mds_eq: \"conc.low_mds_eq mds\\<^sub>C mem\\<^sub>1\\<^sub>C mem\\<^sub>2\\<^sub>C\"\n         and\n       P: \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P\"\n      by (blast dest: R\\<^sub>C_ofD)\n  assume A\\<^sub>C_asm_mem: \"\\<forall>x. case A\\<^sub>C x of None \\<Rightarrow> True\n                                   | Some (v, v') \\<Rightarrow>\n                                      mem\\<^sub>1\\<^sub>C x \\<noteq> v \\<or> mem\\<^sub>2\\<^sub>C x \\<noteq> v' \\<longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x\"\n  hence A\\<^sub>A_asm_mem: \"\\<forall>x. case (A\\<^sub>A_of A\\<^sub>C) x of None \\<Rightarrow> True\n                                           | Some (v, v') \\<Rightarrow>\n               (mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) x \\<noteq> v \\<or> (mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C) x \\<noteq> v' \\<longrightarrow> \\<not> var_asm_not_written (mds\\<^sub>A_of mds\\<^sub>C) x\"\n    by(metis A\\<^sub>A_asm_mem)\n\n  assume A\\<^sub>C_asm_dma: \"\\<forall>x. dma\\<^sub>C (mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C]) x \\<noteq> dma\\<^sub>C mem\\<^sub>1\\<^sub>C x \\<longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x\"\n  hence A\\<^sub>A_asm_dma: \"\\<forall>x\\<^sub>A. dma\\<^sub>A ((mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 (A\\<^sub>A_of A\\<^sub>C)]) x\\<^sub>A \\<noteq> dma\\<^sub>A (mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) x\\<^sub>A \\<longrightarrow> \\<not> var_asm_not_written (mds\\<^sub>A_of mds\\<^sub>C) x\\<^sub>A\"\n    by(metis A\\<^sub>A_asm_dma)\n\n  assume A\\<^sub>C_sec: \"\\<forall>x. dma\\<^sub>C (mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C]) x = Low \\<and> (x \\<notin> mds\\<^sub>C AsmNoReadOrWrite \\<or> x \\<in> \\<C>\\<^sub>C) \\<longrightarrow>\n         mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C] x = mem\\<^sub>2\\<^sub>C [\\<parallel>\\<^sub>2 A\\<^sub>C] x\"\n  hence A\\<^sub>A_sec: \"\\<forall>x. dma\\<^sub>A ((mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C]) x = Low \\<and> (x \\<notin> mds\\<^sub>A_of mds\\<^sub>C AsmNoReadOrWrite \\<or> x \\<in> \\<C>\\<^sub>A) \\<longrightarrow>\n         (mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C] x = (mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C) [\\<parallel>\\<^sub>2 A\\<^sub>A_of A\\<^sub>C] x\"\n    by(metis A\\<^sub>A_sec)\n    \n  from rr have others: \"closed_others \\<R>\"\n    unfolding secure_refinement_def by blast\n  from rr have P_cgc: \"conc.closed_glob_consistent P\"\n    unfolding secure_refinement_def by blast\n  let ?mem\\<^sub>1\\<^sub>C' = \"(mem\\<^sub>1\\<^sub>C [\\<parallel>\\<^sub>1 A\\<^sub>C])\" and\n      ?mem\\<^sub>2\\<^sub>C' = \"(mem\\<^sub>2\\<^sub>C [\\<parallel>\\<^sub>2 A\\<^sub>C])\" and\n      ?mem\\<^sub>1\\<^sub>A = \"(mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C)\" and\n      ?mem\\<^sub>2\\<^sub>A = \"(mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C)\" and\n      ?mem\\<^sub>1\\<^sub>A' = \"(mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C]\" and\n      ?mem\\<^sub>2\\<^sub>A' = \"(mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C) [\\<parallel>\\<^sub>2 A\\<^sub>A_of A\\<^sub>C]\"\n\n  have mem'_simps: \n    \"?mem\\<^sub>1\\<^sub>A' = mem\\<^sub>A_of ?mem\\<^sub>1\\<^sub>C'\" \n    \"?mem\\<^sub>2\\<^sub>A' = mem\\<^sub>A_of ?mem\\<^sub>2\\<^sub>C'\" by(simp add: apply_adaptation\\<^sub>A)+\n\n  from cgc in_\\<R>\\<^sub>A A\\<^sub>A_asm_mem A\\<^sub>A_asm_dma A\\<^sub>A_sec have\n    in_\\<R>\\<^sub>A': \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, (mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C) [\\<parallel>\\<^sub>1 A\\<^sub>A_of A\\<^sub>C]\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, (mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C) [\\<parallel>\\<^sub>2 A\\<^sub>A_of A\\<^sub>C]\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A\" unfolding abs.closed_glob_consistent_def by blast\n\n  from A\\<^sub>C_asm_mem A\\<^sub>C_asm_dma have \n    A\\<^sub>C_asm_mem\\<^sub>1': \"\\<forall>x. mem\\<^sub>1\\<^sub>C x \\<noteq> ?mem\\<^sub>1\\<^sub>C' x \\<longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x\" and\n    A\\<^sub>C_asm_dma\\<^sub>1': \"\\<forall>x. dma\\<^sub>C mem\\<^sub>1\\<^sub>C x \\<noteq> dma\\<^sub>C ?mem\\<^sub>1\\<^sub>C' x \\<longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x\"\n    unfolding apply_adaptation_def by(force split: option.splits)+\n\n  from A\\<^sub>C_asm_mem have\n    A\\<^sub>C_asm_mem\\<^sub>2': \"\\<forall>x. mem\\<^sub>2\\<^sub>C x \\<noteq> ?mem\\<^sub>2\\<^sub>C' x \\<longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x\"\n    unfolding apply_adaptation_def by(force split: option.splits)\n\n  from in_\\<R>\\<^sub>1 A\\<^sub>C_asm_mem\\<^sub>1' A\\<^sub>C_asm_dma\\<^sub>1' others have\n    in_\\<R>\\<^sub>1':  \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, ?mem\\<^sub>1\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, ?mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n    unfolding closed_others_def mem'_simps by blast\n\n  from mm[OF in_\\<R>\\<^sub>A] have \n    dma\\<^sub>C_eq: \"dma\\<^sub>C mem\\<^sub>1\\<^sub>C = dma\\<^sub>C mem\\<^sub>2\\<^sub>C\" by(rule abs_low_mds_eq_dma\\<^sub>C_eq)\n  have dma\\<^sub>C_eq': \"dma\\<^sub>C ?mem\\<^sub>1\\<^sub>C' = dma\\<^sub>C ?mem\\<^sub>2\\<^sub>C'\"\n    apply(rule abs_low_mds_eq_dma\\<^sub>C_eq[OF mm])\n    apply(simp add: mem'_simps[symmetric])\n    by(rule in_\\<R>\\<^sub>A')\n  from dma\\<^sub>C_eq dma\\<^sub>C_eq' A\\<^sub>C_asm_dma\\<^sub>1' have\n    A\\<^sub>C_asm_dma\\<^sub>2': \"\\<forall>x. dma\\<^sub>C mem\\<^sub>2\\<^sub>C x \\<noteq> dma\\<^sub>C ?mem\\<^sub>2\\<^sub>C' x \\<longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x\"\n    by simp\n\n  from in_\\<R>\\<^sub>2  A\\<^sub>C_asm_mem\\<^sub>2' A\\<^sub>C_asm_dma\\<^sub>2' others have\n    in_\\<R>\\<^sub>2':  \"(\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, ?mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, ?mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n    unfolding closed_others_def mem'_simps by blast\n\n  have mds_eq': \"conc.low_mds_eq mds\\<^sub>C ?mem\\<^sub>1\\<^sub>C' ?mem\\<^sub>2\\<^sub>C'\" \n    using A\\<^sub>C_sec unfolding conc.low_mds_eq_def by blast\n   \n from P P_cgc A\\<^sub>C_asm_mem A\\<^sub>C_asm_dma A\\<^sub>C_sec have P': \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, ?mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, ?mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> P\"\n   unfolding conc.closed_glob_consistent_def by blast \n  from in_\\<R>\\<^sub>A' in_\\<R>\\<^sub>1' in_\\<R>\\<^sub>2' mem'_simps R\\<^sub>C_ofI mds_eq' P' show\n  \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, ?mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, ?mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P\"\n    by(metis)\nqed\n\nlemma R\\<^sub>C_of_local_preservation:\n  assumes rr: \"secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  assumes bisim: \"abs.strong_low_bisim_mm \\<R>\\<^sub>A\"\n  assumes in_R\\<^sub>C_of: \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P\"\n  assumes step\\<^sub>1\\<^sub>C: \"\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C\"\n  shows \"\\<exists>c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'.\n          \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C \\<and>\n          (\\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P\"\nproof -\n  from rr in_R\\<^sub>C_of have\n    P: \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P\"\n      by(blast dest: R\\<^sub>C_ofD)\n\n  let ?mds\\<^sub>A = \"mds\\<^sub>A_of mds\\<^sub>C\" and\n      ?mem\\<^sub>1\\<^sub>A = \"mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C\" and\n      ?mem\\<^sub>2\\<^sub>A = \"mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C\" and\n      ?mds\\<^sub>A' = \"mds\\<^sub>A_of mds\\<^sub>C'\" and\n      ?mem\\<^sub>1\\<^sub>A' = \"mem\\<^sub>A_of mem\\<^sub>1\\<^sub>C'\"\n\n  from rr in_R\\<^sub>C_of obtain c\\<^sub>1\\<^sub>A c\\<^sub>2\\<^sub>A where\n    in_\\<R>\\<^sub>1: \"(\\<langle>c\\<^sub>1\\<^sub>A, ?mds\\<^sub>A, ?mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\" and\n    in_\\<R>\\<^sub>2: \"(\\<langle>c\\<^sub>2\\<^sub>A, ?mds\\<^sub>A, ?mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\" and\n    in_\\<R>\\<^sub>A: \"(\\<langle>c\\<^sub>1\\<^sub>A, ?mds\\<^sub>A, ?mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, ?mds\\<^sub>A, ?mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A\" and\n    low_mds_mds\\<^sub>C: \"conc.low_mds_eq mds\\<^sub>C mem\\<^sub>1\\<^sub>C mem\\<^sub>2\\<^sub>C\"\n    by(blast dest: R\\<^sub>C_ofD)+\n\n  from rr in_\\<R>\\<^sub>1 in_\\<R>\\<^sub>A in_\\<R>\\<^sub>2 step\\<^sub>1\\<^sub>C obtain n c\\<^sub>1\\<^sub>A' where\n     a: \"(abs.neval \\<langle> c\\<^sub>1\\<^sub>A, ?mds\\<^sub>A, ?mem\\<^sub>1\\<^sub>A \\<rangle>\\<^sub>A n \\<langle> c\\<^sub>1\\<^sub>A', ?mds\\<^sub>A', ?mem\\<^sub>1\\<^sub>A' \\<rangle>\\<^sub>A \\<and>\n         (\\<langle> c\\<^sub>1\\<^sub>A', ?mds\\<^sub>A', ?mem\\<^sub>1\\<^sub>A' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n       (\\<forall>c\\<^sub>2\\<^sub>A' mem\\<^sub>2\\<^sub>A'. \n         (\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P \\<and>\n         abs.neval \\<langle> c\\<^sub>2\\<^sub>A, ?mds\\<^sub>A, ?mem\\<^sub>2\\<^sub>A \\<rangle>\\<^sub>A n \\<langle> c\\<^sub>2\\<^sub>A', ?mds\\<^sub>A', mem\\<^sub>2\\<^sub>A' \\<rangle>\\<^sub>A  \\<longrightarrow>\n           (\\<exists> c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'. \\<langle> c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C' \\<rangle>\\<^sub>C \\<and>\n                   (\\<langle> c\\<^sub>2\\<^sub>A', ?mds\\<^sub>A', mem\\<^sub>2\\<^sub>A' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n                   (\\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> P)))\"\n  unfolding secure_refinement_def2\n    by metis\n\n  show ?thesis\n  proof -\n    from a have neval\\<^sub>1\\<^sub>A: \"abs.neval \\<langle>c\\<^sub>1\\<^sub>A, ?mds\\<^sub>A, ?mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A n \\<langle>c\\<^sub>1\\<^sub>A', ?mds\\<^sub>A', ?mem\\<^sub>1\\<^sub>A'\\<rangle>\\<^sub>A\" and\n                in_\\<R>\\<^sub>1': \"(\\<langle>c\\<^sub>1\\<^sub>A', ?mds\\<^sub>A', ?mem\\<^sub>1\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n           by blast+\n    from  strong_low_bisim_neval[OF neval\\<^sub>1\\<^sub>A  in_\\<R>\\<^sub>A bisim] obtain c\\<^sub>2\\<^sub>A' mem\\<^sub>2\\<^sub>A' where\n      neval\\<^sub>2\\<^sub>A: \"abs.neval \\<langle>c\\<^sub>2\\<^sub>A, ?mds\\<^sub>A, ?mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A n \\<langle>c\\<^sub>2\\<^sub>A', ?mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A\" and\n      in_\\<R>\\<^sub>A'_help: \"(\\<langle>c\\<^sub>1\\<^sub>A', ?mds\\<^sub>A', ?mem\\<^sub>1\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A', ?mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A\"\n      unfolding abs.strong_low_bisim_mm_def\n      by blast\n\n    from a in_\\<R>\\<^sub>A in_\\<R>\\<^sub>2 neval\\<^sub>2\\<^sub>A P obtain c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C' where\n          step\\<^sub>2\\<^sub>C: \"\\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C\" and\n          in_\\<R>\\<^sub>2'_help: \"(\\<langle>c\\<^sub>2\\<^sub>A', ?mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\" and\n          P': \"(\\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> P\"\n      by blast\n\n    let ?mem\\<^sub>2\\<^sub>A' = \"mem\\<^sub>A_of mem\\<^sub>2\\<^sub>C'\"\n    from in_\\<R>\\<^sub>2'_help rr preserves_modes_memD have \"mem\\<^sub>2\\<^sub>A' = ?mem\\<^sub>2\\<^sub>A'\" \n      unfolding secure_refinement_def by metis\n    with in_\\<R>\\<^sub>2'_help in_\\<R>\\<^sub>A'_help have \n      in_\\<R>\\<^sub>2': \"(\\<langle>c\\<^sub>2\\<^sub>A', ?mds\\<^sub>A', ?mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\" and\n      in_\\<R>\\<^sub>A': \"(\\<langle>c\\<^sub>1\\<^sub>A', ?mds\\<^sub>A', ?mem\\<^sub>1\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A', ?mds\\<^sub>A', ?mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A\"\n      by simp+\n\n    have \"conc.low_mds_eq mds\\<^sub>C' mem\\<^sub>1\\<^sub>C' mem\\<^sub>2\\<^sub>C'\"\n      apply(rule new_vars_private_does_the_thing[where \\<R>=\\<R>, OF _ in_\\<R>\\<^sub>1 in_\\<R>\\<^sub>2 step\\<^sub>1\\<^sub>C step\\<^sub>2\\<^sub>C low_mds_mds\\<^sub>C])\n       using rr apply(fastforce simp: secure_refinement_def)\n      using in_\\<R>\\<^sub>A' bisim unfolding abs.strong_low_bisim_mm_def by blast\n\n    with step\\<^sub>2\\<^sub>C in_\\<R>\\<^sub>1' in_\\<R>\\<^sub>2' in_\\<R>\\<^sub>A' in_\\<R>\\<^sub>2' P' show ?thesis\n      by(blast intro: R\\<^sub>C_ofI)\n  qed\nqed\n  \ntext \\<open>\n  Security of the concrete system should follow straightforwardly from\n  security of the abstract one, via the compositionality theorem, presuming\n  that the compiler also preserves the sound use of modes.\n\\<close>\nlemma R\\<^sub>C_of_strong_low_bisim_mm:\n  assumes abs: \"abs.strong_low_bisim_mm \\<R>\\<^sub>A\"\n  assumes rr: \"secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  assumes P_sym: \"sym P\"\n  shows \"conc.strong_low_bisim_mm (R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P)\"\n  unfolding conc.strong_low_bisim_mm_def\n  apply(intro conjI)\n    apply(rule R\\<^sub>C_of_sym)\n    using abs rr P_sym unfolding abs.strong_low_bisim_mm_def apply blast+\n   apply(rule R\\<^sub>C_of_closed_glob_consistent)\n    using abs unfolding abs.strong_low_bisim_mm_def apply blast+\n   using rr apply blast\n  apply safe\n   apply(fastforce simp: R\\<^sub>C_of_def)\n  apply(rule R\\<^sub>C_of_local_preservation)\n     apply(rule rr)\n    apply(rule abs)\n   apply assumption+\n  done\n\nsection \"A Simpler Proof Principle for General Compositional Refinement\"\n\ntext \\<open>\n  Here we make use of the fact that the source language we are working\n  in is assumed deterministic. This allows us to invert the direction\n  of refinement and thereby to derive a simpler condition for secure\n  compositional refinement.\n  \n  The simpler condition rests on an ordinary definition of refinement,\n  and has the user prove separately that the coupling invariant @{term P}\n  is self-preserving. This allows proofs about coupling invariant properties\n  to be disentangled from the proof of refinement itself.\n\\<close>\n  \ntext \\<open>\n  Given a  bisimulation @{term \\<R>\\<^sub>A}, this definition captures the essence of the extra\n  requirements on a refinement relation~@{term \\<R>} needed to ensure that the refined program is\n  also secure. These requirements are essentially that:\n  \\begin{enumerate}\n    \\item The enabledness of the compiled code depends only on Low abstract data;\n    \\item The length of the abstract program to which a single step of the concrete program\n          corresponds depends only on Low abstract data;\n    \\item The coupling invariant is maintained.\n  \\end{enumerate}\n  \n  The second requirement we express via the parameter~@{term abs_steps} that, given an\n  abstract and corresponding concrete configuration, yields the number of execution steps of\n  the abstract configuration to which a single step of the concrete configuration corresponds.\n  \n  Note that a more specialised version of this definition, fixing the coupling\n  invariant @{term P} to be the one that relates all configurations with\n  identical programs and mode states, appeared in Murray et al., CSF 2016.\n  Here we generalise the theory to support a wider class of coupling invariants.\n\\<close>\ndefinition\n  simpler_refinement_safe \nwhere\n  \"simpler_refinement_safe \\<R>\\<^sub>A \\<R> P abs_steps \\<equiv> \n  \\<forall>c\\<^sub>1\\<^sub>A mds\\<^sub>A mem\\<^sub>1\\<^sub>A c\\<^sub>2\\<^sub>A mem\\<^sub>2\\<^sub>A c\\<^sub>1\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C c\\<^sub>2\\<^sub>C mem\\<^sub>2\\<^sub>C. (\\<langle>c\\<^sub>1\\<^sub>A,mds\\<^sub>A,mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>2\\<^sub>A,mds\\<^sub>A,mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<and> \n      (\\<langle>c\\<^sub>1\\<^sub>A,mds\\<^sub>A,mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and> (\\<langle>c\\<^sub>2\\<^sub>A,mds\\<^sub>A,mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n       (\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P  \\<longrightarrow>\n           (stops\\<^sub>C \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C = stops\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<and>\n           (abs_steps \\<langle>c\\<^sub>1\\<^sub>A,mds\\<^sub>A,mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C = abs_steps \\<langle>c\\<^sub>2\\<^sub>A,mds\\<^sub>A,mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<and>\n           (\\<forall>mds\\<^sub>1\\<^sub>C' mds\\<^sub>2\\<^sub>C' mem\\<^sub>1\\<^sub>C' mem\\<^sub>2\\<^sub>C' c\\<^sub>1\\<^sub>C' c\\<^sub>2\\<^sub>C'. \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>1\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C  \\<and>\n                                          \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>2\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C \\<longrightarrow>\n                                          (\\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>1\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>2\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> P \\<and>\n                                          mds\\<^sub>1\\<^sub>C' = mds\\<^sub>2\\<^sub>C')\"\n\ndefinition\n  secure_refinement_simpler\nwhere\n  \"secure_refinement_simpler \\<R>\\<^sub>A \\<R> P abs_steps \\<equiv>\n  closed_others \\<R> \\<and>\n  preserves_modes_mem \\<R> \\<and>\n  new_vars_private \\<R> \\<and>\n  simpler_refinement_safe \\<R>\\<^sub>A \\<R> P abs_steps \\<and>\n  conc.closed_glob_consistent P \\<and>\n  (\\<forall> c\\<^sub>1\\<^sub>A mds\\<^sub>A mem\\<^sub>1\\<^sub>A c\\<^sub>1\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C. \n   (\\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n    (\\<forall> c\\<^sub>1\\<^sub>C' mds\\<^sub>C' mem\\<^sub>1\\<^sub>C'. \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C \\<longrightarrow>\n     (\\<exists> c\\<^sub>1\\<^sub>A' mds\\<^sub>A' mem\\<^sub>1\\<^sub>A'. abs.neval \\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A \\<rangle>\\<^sub>A (abs_steps \\<langle>c\\<^sub>1\\<^sub>A,mds\\<^sub>A,mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A \\<langle>c\\<^sub>1\\<^sub>C,mds\\<^sub>C,mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<langle> c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A' \\<rangle>\\<^sub>A \\<and>\n                   (\\<langle> c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R>)))\"\n    \nlemma secure_refinement_simpler:\n  assumes rrs: \"secure_refinement_simpler \\<R>\\<^sub>A \\<R> P abs_steps\"\n  shows \"secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  unfolding secure_refinement_def\nproof(safe)\n  from rrs show \"closed_others \\<R>\"\n    unfolding secure_refinement_simpler_def by blast\nnext\n  from rrs show \"preserves_modes_mem \\<R>\"\n    unfolding secure_refinement_simpler_def by blast\nnext\n  from rrs show \"new_vars_private \\<R>\"\n    unfolding secure_refinement_simpler_def by blast\nnext\n  fix c\\<^sub>1\\<^sub>A mds\\<^sub>A mem\\<^sub>1\\<^sub>A c\\<^sub>1\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C c\\<^sub>1\\<^sub>C' mds\\<^sub>C' mem\\<^sub>1\\<^sub>C'\n  let ?n = \"abs_steps \\<langle>c\\<^sub>1\\<^sub>A,mds\\<^sub>A,mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A \\<langle>c\\<^sub>1\\<^sub>C,mds\\<^sub>C,mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C\"\n  assume in_\\<R>\\<^sub>1: \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n     and eval\\<^sub>1\\<^sub>C: \"\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C\"\n  with rrs obtain c\\<^sub>1\\<^sub>A' mds\\<^sub>A' mem\\<^sub>1\\<^sub>A' where\n    neval\\<^sub>1: \"abs.neval \\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A \\<rangle>\\<^sub>A ?n \\<langle> c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A' \\<rangle>\\<^sub>A\" and\n    in_\\<R>\\<^sub>1': \"(\\<langle> c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R>\"\n    unfolding secure_refinement_simpler_def by metis\n  have \"(\\<forall>c\\<^sub>2\\<^sub>A mem\\<^sub>2\\<^sub>A c\\<^sub>2\\<^sub>C mem\\<^sub>2\\<^sub>C c\\<^sub>2\\<^sub>A' mem\\<^sub>2\\<^sub>A'.\n                (\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<and>\n                (\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n                (\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C,\\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P \\<and> abs.neval \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A ?n \\<langle>c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A \\<longrightarrow>\n                (\\<exists>c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'.\n                    \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C \\<and>\n                    (\\<langle>c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and> \n                    (\\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C,\\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> P))\"\n  proof(clarsimp)\n    fix c\\<^sub>2\\<^sub>A mem\\<^sub>2\\<^sub>A c\\<^sub>2\\<^sub>C mem\\<^sub>2\\<^sub>C c\\<^sub>2\\<^sub>A' mem\\<^sub>2\\<^sub>A'\n    assume \n    in_\\<R>\\<^sub>A: \"(\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A\" and \n    in_\\<R>\\<^sub>2: \"(\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\" and\n    neval\\<^sub>2: \"abs.neval \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A ?n \\<langle>c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A\" and\n    in_P: \"(\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C,\\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> P\"\n    have \"\\<forall>c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'. \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C \\<longrightarrow> (\\<langle>c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and> (\\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> P\"\n    proof(clarify)\n      fix c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'\n      assume eval\\<^sub>2\\<^sub>C: \"\\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C\"\n      from in_\\<R>\\<^sub>2 eval\\<^sub>2\\<^sub>C in_P rrs obtain\n      c\\<^sub>2\\<^sub>A'' mds\\<^sub>A'' mem\\<^sub>2\\<^sub>A'' where \n      neval\\<^sub>2': \"abs.neval \\<langle> c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A \\<rangle>\\<^sub>A (abs_steps \\<langle>c\\<^sub>2\\<^sub>A,mds\\<^sub>A,mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A \\<langle>c\\<^sub>2\\<^sub>C,mds\\<^sub>C,mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<langle> c\\<^sub>2\\<^sub>A'', mds\\<^sub>A'', mem\\<^sub>2\\<^sub>A'' \\<rangle>\\<^sub>A\" and\n      in_\\<R>\\<^sub>2': \"(\\<langle> c\\<^sub>2\\<^sub>A'', mds\\<^sub>A'', mem\\<^sub>2\\<^sub>A'' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R>\"\n        unfolding secure_refinement_simpler_def by blast\n      let ?n' = \"(abs_steps \\<langle>c\\<^sub>2\\<^sub>A,mds\\<^sub>A,mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A \\<langle>c\\<^sub>2\\<^sub>C,mds\\<^sub>C,mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C)\"\n      from rrs have pe: \"simpler_refinement_safe \\<R>\\<^sub>A \\<R> P abs_steps\"\n        unfolding secure_refinement_simpler_def by blast\n      with in_\\<R>\\<^sub>A in_\\<R>\\<^sub>1 in_\\<R>\\<^sub>2 in_P\n      have \"?n' = ?n\"\n        unfolding simpler_refinement_safe_def by fastforce\n      with neval\\<^sub>2 neval\\<^sub>2' abs.neval_det \n      have [simp]: \"c\\<^sub>2\\<^sub>A'' = c\\<^sub>2\\<^sub>A'\"  and [simp]: \"mds\\<^sub>A'' = mds\\<^sub>A'\" and [simp]: \"mem\\<^sub>2\\<^sub>A'' = mem\\<^sub>2\\<^sub>A'\"\n        by auto\n      from in_\\<R>\\<^sub>2' have in_\\<R>\\<^sub>2': \"(\\<langle>c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\" by simp\n      from eval\\<^sub>1\\<^sub>C eval\\<^sub>2\\<^sub>C in_P have \n      in_P': \"(\\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C,\\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> P\"\n        using rrs unfolding secure_refinement_simpler_def\n                            simpler_refinement_safe_def\n        using in_\\<R>\\<^sub>A in_\\<R>\\<^sub>1 in_\\<R>\\<^sub>2 in_P by auto\n      with in_\\<R>\\<^sub>2'\n      show \"(\\<langle>c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n       (\\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> P\" by blast\n    qed\n    moreover have \"\\<exists>c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'. \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C\"\n    proof -\n      from rrs have pe: \"simpler_refinement_safe \\<R>\\<^sub>A \\<R> P abs_steps\"\n        unfolding secure_refinement_simpler_def by blast\n      with in_\\<R>\\<^sub>A in_\\<R>\\<^sub>1 in_\\<R>\\<^sub>2 in_P have \"stops\\<^sub>C  \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C = stops\\<^sub>C  \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C\"\n        unfolding simpler_refinement_safe_def by blast\n      moreover from eval\\<^sub>1\\<^sub>C have \"\\<not> stops\\<^sub>C  \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C\"\n        unfolding stops\\<^sub>C_def by blast\n      ultimately have \"\\<not> stops\\<^sub>C  \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C\"\n        by simp          \n      from this obtain c\\<^sub>2\\<^sub>C' mds\\<^sub>C'' mem\\<^sub>2\\<^sub>C'' where eval\\<^sub>2\\<^sub>C': \"\\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C',mds\\<^sub>C'',mem\\<^sub>2\\<^sub>C''\\<rangle>\\<^sub>C\"\n        unfolding stops\\<^sub>C_def by auto\n      with pe eval\\<^sub>1\\<^sub>C in_\\<R>\\<^sub>A in_\\<R>\\<^sub>1 in_\\<R>\\<^sub>2 in_P have in_P': \"(\\<langle>c\\<^sub>1\\<^sub>C',mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C',mds\\<^sub>C'', mem\\<^sub>2\\<^sub>C''\\<rangle>\\<^sub>C) \\<in> P\"\n                                             and [simp]: \"mds\\<^sub>C'' = mds\\<^sub>C'\"\n        unfolding simpler_refinement_safe_def  by blast+\n      from in_P' eval\\<^sub>2\\<^sub>C'\n      show \"\\<exists>c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'. \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C\"\n        by fastforce\n      qed\n    ultimately show \n    \"\\<exists>c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'.\n     \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C \\<and> (\\<langle>c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and> (\\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C,\n           \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C)\n          \\<in> P\"\n      by blast\n  qed\n  with neval\\<^sub>1 in_\\<R>\\<^sub>1 in_\\<R>\\<^sub>1' \n  show \"\\<exists>n c\\<^sub>1\\<^sub>A' mds\\<^sub>A' mem\\<^sub>1\\<^sub>A'.\n            abs.neval \\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A n \\<langle>c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A'\\<rangle>\\<^sub>A \\<and>\n            (\\<langle>c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n            (\\<forall>c\\<^sub>2\\<^sub>A mem\\<^sub>2\\<^sub>A c\\<^sub>2\\<^sub>C mem\\<^sub>2\\<^sub>C c\\<^sub>2\\<^sub>A' mem\\<^sub>2\\<^sub>A'.\n                (\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<and>\n                (\\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n                (\\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C)\n                \\<in> P \\<and>\n                abs.neval \\<langle>c\\<^sub>2\\<^sub>A, mds\\<^sub>A, mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A n \\<langle>c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A \\<longrightarrow>\n                (\\<exists>c\\<^sub>2\\<^sub>C' mem\\<^sub>2\\<^sub>C'.\n                    \\<langle>c\\<^sub>2\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C \\<and>\n                    (\\<langle>c\\<^sub>2\\<^sub>A', mds\\<^sub>A', mem\\<^sub>2\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n                    (\\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C)\n                    \\<in> P))\"\n    by auto\nnext\n  show \"conc.closed_glob_consistent P\"\n    using rrs unfolding secure_refinement_simpler_def by blast\nqed\n\nsection \"Simple Bisimulations and Simple Refinement\"\n\ntext \\<open>\n  We derive the theory of simple refinements from Murray et al. CSF 2016 from the above\n  \\emph{simpler} theory of secure refinement.\n\\<close>\n\ndefinition\n   bisim_simple\nwhere\n  \"bisim_simple \\<R>\\<^sub>A \\<equiv> \\<forall>c\\<^sub>1\\<^sub>A mds mem\\<^sub>1\\<^sub>A c\\<^sub>2\\<^sub>A mem\\<^sub>2\\<^sub>A. (\\<langle>c\\<^sub>1\\<^sub>A,mds,mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>2\\<^sub>A,mds,mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<longrightarrow> \n                                              c\\<^sub>1\\<^sub>A = c\\<^sub>2\\<^sub>A\"\ndefinition\n  simple_refinement_safe\nwhere\n  \"simple_refinement_safe \\<R>\\<^sub>A \\<R> abs_steps \\<equiv> \n  \\<forall>c\\<^sub>A mds\\<^sub>A mem\\<^sub>1\\<^sub>A mem\\<^sub>2\\<^sub>A c\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C mem\\<^sub>2\\<^sub>C. (\\<langle>c\\<^sub>A,mds\\<^sub>A,mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>A,mds\\<^sub>A,mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<and> \n      (\\<langle>c\\<^sub>A,mds\\<^sub>A,mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and> (\\<langle>c\\<^sub>A,mds\\<^sub>A,mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A,\\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n           (stops\\<^sub>C \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C = stops\\<^sub>C \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<and>\n           (abs_steps \\<langle>c\\<^sub>A,mds\\<^sub>A,mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C = abs_steps \\<langle>c\\<^sub>A,mds\\<^sub>A,mem\\<^sub>2\\<^sub>A\\<rangle>\\<^sub>A \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C) \\<and>\n           (\\<forall>mds\\<^sub>1\\<^sub>C' mds\\<^sub>2\\<^sub>C' mem\\<^sub>1\\<^sub>C' mem\\<^sub>2\\<^sub>C' c\\<^sub>1\\<^sub>C' c\\<^sub>2\\<^sub>C'. \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>1\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C  \\<and>\n                                          \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>2\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>2\\<^sub>C', mds\\<^sub>2\\<^sub>C', mem\\<^sub>2\\<^sub>C'\\<rangle>\\<^sub>C \\<longrightarrow>\n                                          c\\<^sub>1\\<^sub>C' = c\\<^sub>2\\<^sub>C' \\<and> mds\\<^sub>1\\<^sub>C' = mds\\<^sub>2\\<^sub>C')\"\n\ndefinition\n  secure_refinement_simple\nwhere\n  \"secure_refinement_simple \\<R>\\<^sub>A \\<R> abs_steps \\<equiv>\n  closed_others \\<R> \\<and>\n  preserves_modes_mem \\<R> \\<and>\n  new_vars_private \\<R> \\<and>\n  simple_refinement_safe \\<R>\\<^sub>A \\<R> abs_steps \\<and>\n  bisim_simple \\<R>\\<^sub>A \\<and>\n  (\\<forall> c\\<^sub>1\\<^sub>A mds\\<^sub>A mem\\<^sub>1\\<^sub>A c\\<^sub>1\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C. \n   (\\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n    (\\<forall> c\\<^sub>1\\<^sub>C' mds\\<^sub>C' mem\\<^sub>1\\<^sub>C'. \\<langle> c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C \\<longrightarrow>\n     (\\<exists> c\\<^sub>1\\<^sub>A' mds\\<^sub>A' mem\\<^sub>1\\<^sub>A'. abs.neval \\<langle> c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A \\<rangle>\\<^sub>A (abs_steps \\<langle>c\\<^sub>1\\<^sub>A,mds\\<^sub>A,mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A \\<langle>c\\<^sub>1\\<^sub>C,mds\\<^sub>C,mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<langle> c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A' \\<rangle>\\<^sub>A \\<and>\n                   (\\<langle> c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C' \\<rangle>\\<^sub>C) \\<in> \\<R>)))\"\n\ndefinition\n  \\<I>simple\nwhere\n  \"\\<I>simple \\<equiv> {(\\<langle>c,mds,mem\\<rangle>\\<^sub>C,\\<langle>c',mds',mem'\\<rangle>\\<^sub>C)| c mds mem c' mds' mem'. c = c'}\"\n\nlemma \\<I>simple_closed_glob_consistent:\n  \"conc.closed_glob_consistent \\<I>simple\"\n  by(auto simp: conc.closed_glob_consistent_def \\<I>simple_def)\n  \nlemma secure_refinement_simple:\n  assumes srs: \"secure_refinement_simple \\<R>\\<^sub>A \\<R> abs_steps\"\n  shows \"secure_refinement_simpler \\<R>\\<^sub>A \\<R> \\<I>simple abs_steps\"\nunfolding secure_refinement_simpler_def\nproof(safe | clarsimp)+\n  from srs show \"closed_others \\<R>\"\n  unfolding secure_refinement_simple_def by blast\nnext\n  from srs show \"preserves_modes_mem \\<R>\"\n  unfolding secure_refinement_simple_def by blast\nnext\n  from srs show \"new_vars_private \\<R>\"\n  unfolding secure_refinement_simple_def by blast\nnext\n  show \"conc.closed_glob_consistent \\<I>simple\" by (rule \\<I>simple_closed_glob_consistent)\nnext\n  from srs have safe: \"simple_refinement_safe \\<R>\\<^sub>A \\<R> abs_steps\"\n  unfolding secure_refinement_simple_def by blast\n  from srs have simple: \"bisim_simple \\<R>\\<^sub>A\"\n  unfolding secure_refinement_simple_def by fastforce\n  \n  from safe simple show \"simpler_refinement_safe \\<R>\\<^sub>A \\<R> \\<I>simple abs_steps\"\n  by(fastforce simp: simpler_refinement_safe_def \\<I>simple_def simple_refinement_safe_def bisim_simple_def)\nnext\n  fix c\\<^sub>1\\<^sub>A mds\\<^sub>A mem\\<^sub>1\\<^sub>A c\\<^sub>1\\<^sub>C mds\\<^sub>C mem\\<^sub>1\\<^sub>C c\\<^sub>1\\<^sub>C' mds\\<^sub>C' mem\\<^sub>1\\<^sub>C'\n  show \" (\\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<Longrightarrow>\n       \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C \\<Longrightarrow>\n       \\<exists>c\\<^sub>1\\<^sub>A' mds\\<^sub>A' mem\\<^sub>1\\<^sub>A'.\n          abs.neval \\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A (abs_steps \\<langle>c\\<^sub>1\\<^sub>A, mds\\<^sub>A, mem\\<^sub>1\\<^sub>A\\<rangle>\\<^sub>A \\<langle>c\\<^sub>1\\<^sub>C, mds\\<^sub>C, mem\\<^sub>1\\<^sub>C\\<rangle>\\<^sub>C)\n           \\<langle>c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A'\\<rangle>\\<^sub>A \\<and>\n          (\\<langle>c\\<^sub>1\\<^sub>A', mds\\<^sub>A', mem\\<^sub>1\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>1\\<^sub>C', mds\\<^sub>C', mem\\<^sub>1\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n    using srs unfolding secure_refinement_simple_def by blast\nqed\n  \nsection \"Sound Mode Use Preservation\"\n\ntext \\<open>\n  Prove that\n  \\begin{quote}\n  acquiring a mode on the concrete version of an abstract\n      variable~@{term x}, and then mapping the new concrete mode state to the\n      corresponding abstract mode state,\n  \\end{quote}\n   is equivalent to\n   \\begin{quote}\n      first mapping the initial concrete mode\n      state to its corresponding abstract mode state and then acquiring the mode\n      on the abstract variable~@{term x}.\n   \\end{quote}\n\n   This lemma essentially justifies why a concrete program doing\n   @{term \"Acq (var\\<^sub>C_of x) SomeMode\"}\n   is a the right way to implement the abstract program doing\n   @{term \"Acq x SomeMode\"}.\n\\<close>\n\n(* FIXME: There might be better names for these *)\nlemma mode_acquire_refinement_helper:\n  \"mds\\<^sub>A_of (mds\\<^sub>C(SomeMode := insert (var\\<^sub>C_of x) (mds\\<^sub>C SomeMode))) =\n   (mds\\<^sub>A_of mds\\<^sub>C)(SomeMode := insert x (mds\\<^sub>A_of mds\\<^sub>C SomeMode))\"\n  apply(clarsimp simp: mds\\<^sub>A_of_def)\n  apply(rule ext)\n  apply(force simp: image_def inv_f_f[OF var\\<^sub>C_of_inj])\n  done\n\nlemma mode_release_refinement_helper:\n  \"mds\\<^sub>A_of (mds\\<^sub>C(SomeMode := {y \\<in> mds\\<^sub>C SomeMode. y \\<noteq> (var\\<^sub>C_of x)})) =\n   (mds\\<^sub>A_of mds\\<^sub>C)(SomeMode := {y \\<in> (mds\\<^sub>A_of mds\\<^sub>C SomeMode). y \\<noteq> x})\"\n  apply(clarsimp simp: mds\\<^sub>A_of_def)\n  apply(rule ext)\n  apply (force simp: image_def inv_f_f[OF var\\<^sub>C_of_inj])\n  done\n\ndefinition\n  preserves_locally_sound_mode_use :: \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val, 'Com\\<^sub>C, 'Var\\<^sub>C) state_relation \\<Rightarrow> bool\"\nwhere\n  \"preserves_locally_sound_mode_use \\<R> \\<equiv>\n   \\<forall>lc\\<^sub>A lc\\<^sub>C.\n      (abs.locally_sound_mode_use lc\\<^sub>A \\<and> (lc\\<^sub>A, lc\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n      conc.locally_sound_mode_use lc\\<^sub>C)\"\n\nlemma secure_refinement_loc_reach:\n  assumes rr: \"secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  assumes in_\\<R>:  \"(\\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n  assumes loc_reach\\<^sub>C: \"\\<langle>c\\<^sub>C', mds\\<^sub>C', mem\\<^sub>C'\\<rangle>\\<^sub>C \\<in> conc.loc_reach \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C\\<rangle>\\<^sub>C\"\n  shows \"\\<exists>c\\<^sub>A' mds\\<^sub>A' mem\\<^sub>A'.\n      (\\<langle>c\\<^sub>A', mds\\<^sub>A', mem\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C', mds\\<^sub>C', mem\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n      \\<langle>c\\<^sub>A', mds\\<^sub>A', mem\\<^sub>A'\\<rangle>\\<^sub>A \\<in> abs.loc_reach \\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A\"\nusing loc_reach\\<^sub>C proof(induct rule: conc.loc_reach.induct)\n  case (refl) show ?case\n    using in_\\<R> abs.loc_reach.refl by force\nnext\n  case (step c\\<^sub>C' mds\\<^sub>C' mem\\<^sub>C' c\\<^sub>C'' mds\\<^sub>C'' mem\\<^sub>C'')\n  from step(2) obtain c\\<^sub>A' mds\\<^sub>A' mem\\<^sub>A' where \n    in_\\<R>': \"(\\<langle>c\\<^sub>A', mds\\<^sub>A', mem\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C', mds\\<^sub>C', mem\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\" and \n    loc_reach\\<^sub>A: \"\\<langle>c\\<^sub>A', mds\\<^sub>A', mem\\<^sub>A'\\<rangle>\\<^sub>A \\<in> abs.loc_reach \\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A \"\n    by blast\n  from rr in_\\<R>' step(3)\n  obtain n c\\<^sub>A'' mds\\<^sub>A'' mem\\<^sub>A'' where \n    neval\\<^sub>A: \"abs.neval \\<langle> c\\<^sub>A', mds\\<^sub>A', mem\\<^sub>A' \\<rangle>\\<^sub>A n \\<langle> c\\<^sub>A'', mds\\<^sub>A'', mem\\<^sub>A'' \\<rangle>\\<^sub>A\" and\n    in_\\<R>'': \"(\\<langle> c\\<^sub>A'', mds\\<^sub>A'', mem\\<^sub>A'' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>C'', mds\\<^sub>C'', mem\\<^sub>C'' \\<rangle>\\<^sub>C) \\<in> \\<R>\"\n    unfolding secure_refinement_def by blast\n  from neval\\<^sub>A loc_reach\\<^sub>A have \"\\<langle>c\\<^sub>A'', mds\\<^sub>A'', mem\\<^sub>A''\\<rangle>\\<^sub>A \\<in> abs.loc_reach \\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A\"\n    using abs.neval_loc_reach\n    by blast\n  with in_\\<R>'' show ?case by blast\nnext\n  case (mem_diff c\\<^sub>C' mds\\<^sub>C' mem\\<^sub>C' mem\\<^sub>C'')\n  from mem_diff(2) obtain c\\<^sub>A' mds\\<^sub>A' mem\\<^sub>A' where \n    in_\\<R>': \"(\\<langle>c\\<^sub>A', mds\\<^sub>A', mem\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C', mds\\<^sub>C', mem\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\" and \n    loc_reach\\<^sub>A: \"\\<langle>c\\<^sub>A', mds\\<^sub>A', mem\\<^sub>A'\\<rangle>\\<^sub>A \\<in> abs.loc_reach \\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A \"\n    by blast\n  from rr have mm: \"preserves_modes_mem \\<R>\" and co: \"closed_others \\<R>\"\n    unfolding secure_refinement_def by blast+\n  from preserves_modes_memD[OF mm in_\\<R>'] have \n    mem\\<^sub>A'_def: \"mem\\<^sub>A' = mem\\<^sub>A_of mem\\<^sub>C'\" and mds\\<^sub>A'_def: \"mds\\<^sub>A' = mds\\<^sub>A_of mds\\<^sub>C'\"\n    by simp+\n  hence in_\\<R>': \"(\\<langle>c\\<^sub>A', mds\\<^sub>A_of mds\\<^sub>C', mem\\<^sub>A_of mem\\<^sub>C'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C', mds\\<^sub>C', mem\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n   and loc_reach\\<^sub>A: \"(\\<langle>c\\<^sub>A', mds\\<^sub>A_of mds\\<^sub>C', mem\\<^sub>A_of mem\\<^sub>C'\\<rangle>\\<^sub>A) \\<in> abs.loc_reach \\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A\"\n    using in_\\<R>' loc_reach\\<^sub>A by simp+\n  with mem_diff(3) co\n  have \"(\\<langle>c\\<^sub>A', mds\\<^sub>A_of mds\\<^sub>C', mem\\<^sub>A_of mem\\<^sub>C''\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C', mds\\<^sub>C', mem\\<^sub>C''\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n    unfolding closed_others_def by blast\n  moreover have \"\\<langle>c\\<^sub>A', mds\\<^sub>A_of mds\\<^sub>C', mem\\<^sub>A_of mem\\<^sub>C''\\<rangle>\\<^sub>A \\<in> abs.loc_reach \\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A\"\n    apply(rule abs.loc_reach.mem_diff)\n     apply(rule loc_reach\\<^sub>A)\n    using mem_diff(3)\n    using calculation in_\\<R>' in_\\<R>_dma' mem\\<^sub>A_of_def mm var_writable\\<^sub>A by fastforce \n  ultimately show ?case by blast\nqed\n\ndefinition preserves_local_guarantee_compliance ::\n  \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val, 'Com\\<^sub>C, 'Var\\<^sub>C) state_relation \\<Rightarrow> bool\"\nwhere\n  \"preserves_local_guarantee_compliance \\<R> \\<equiv>\n    \\<forall>cm\\<^sub>A mem\\<^sub>A cm\\<^sub>C mem\\<^sub>C.\n      abs.respects_own_guarantees cm\\<^sub>A \\<and>\n      ((cm\\<^sub>A, mem\\<^sub>A), (cm\\<^sub>C, mem\\<^sub>C)) \\<in> \\<R> \\<longrightarrow>\n        conc.respects_own_guarantees cm\\<^sub>C\"\n\nlemma preserves_local_guarantee_compliance_def2:\n  \"preserves_local_guarantee_compliance \\<R> \\<equiv>\n    \\<forall>c\\<^sub>A mds\\<^sub>A mem\\<^sub>A c\\<^sub>C mds\\<^sub>C mem\\<^sub>C.\n      abs.respects_own_guarantees (c\\<^sub>A, mds\\<^sub>A) \\<and>\n      (\\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n        conc.respects_own_guarantees (c\\<^sub>C, mds\\<^sub>C)\"\n  unfolding preserves_local_guarantee_compliance_def\n  by simp\n\n(* This lemma proves it is sufficient to require a refinement relation to preserve\n   guarantee compliance to ensure that it also preserves locally sound mode use.\n  TODO: Should preserves_guarantee_compliance become part of secure_refinement's requirements? *)\nlemma locally_sound_mode_use_preservation:\n  assumes rr: \"secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  assumes preserves_guarantee_compliance: \"preserves_local_guarantee_compliance \\<R>\"\n  shows \"preserves_locally_sound_mode_use \\<R>\"\n  unfolding preserves_locally_sound_mode_use_def\nproof(clarsimp)\n  fix c\\<^sub>A mds\\<^sub>A mem\\<^sub>A c\\<^sub>C mds\\<^sub>C mem\\<^sub>C\n  assume locally_sound\\<^sub>A: \"abs.locally_sound_mode_use \\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A\" and\n         in_\\<R>: \"(\\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n \n  show \"conc.locally_sound_mode_use \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C\\<rangle>\\<^sub>C\"\n    unfolding conc.locally_sound_mode_use_def2\n    proof(clarsimp)\n      fix c\\<^sub>C' mds\\<^sub>C' mem\\<^sub>C'\n      assume loc_reach\\<^sub>C: \"\\<langle>c\\<^sub>C', mds\\<^sub>C', mem\\<^sub>C'\\<rangle>\\<^sub>C \\<in> conc.loc_reach \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C\\<rangle>\\<^sub>C\"\n\n      from rr in_\\<R> loc_reach\\<^sub>C\n      obtain c\\<^sub>A' mds\\<^sub>A' mem\\<^sub>A' where\n        in_\\<R>': \"(\\<langle>c\\<^sub>A', mds\\<^sub>A', mem\\<^sub>A'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C', mds\\<^sub>C', mem\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\" and\n        loc_reach\\<^sub>A: \"\\<langle>c\\<^sub>A', mds\\<^sub>A', mem\\<^sub>A'\\<rangle>\\<^sub>A \\<in> abs.loc_reach \\<langle>c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A\"\n        using secure_refinement_loc_reach by blast\n\n      from locally_sound\\<^sub>A loc_reach\\<^sub>A\n      have respects_guarantees\\<^sub>A': \"abs.respects_own_guarantees (c\\<^sub>A', mds\\<^sub>A')\"\n        unfolding abs.locally_sound_mode_use_def2 by auto\n\n      with preserves_guarantee_compliance in_\\<R>'\n      show \"conc.respects_own_guarantees (c\\<^sub>C', mds\\<^sub>C')\"\n        unfolding preserves_local_guarantee_compliance_def by blast\n    qed\nqed\n\nend\n\nsection \"Refinement without changing the Memory Model\"\n\ntext \\<open>\n  Here we define a locale which restricts the refinement to be between an abstract and\n  concrete programs that share identical memory models: i,e. have the same set of variables.\n  This allows us to derive simpler versions of the conditions that are likely to be easier\n  to work with for initial experimentation.\n\\<close>\nlocale sifum_refinement_same_mem = \n  abs: sifum_security dma \\<C>_vars \\<C> eval\\<^sub>A some_val +\n  conc: sifum_security dma \\<C>_vars \\<C> eval\\<^sub>C some_val\n  for dma :: \"('Var,'Val) Mem \\<Rightarrow> 'Var \\<Rightarrow> Sec\"\n  and \\<C>_vars :: \"'Var \\<Rightarrow> 'Var set\"\n  and \\<C> :: \"'Var set\"\n  and eval\\<^sub>A :: \"('Com\\<^sub>A, 'Var, 'Val) LocalConf rel\"\n  and eval\\<^sub>C :: \"('Com\\<^sub>C, 'Var, 'Val) LocalConf rel\"\n  and some_val :: \"'Val\" \n\nsublocale sifum_refinement_same_mem \\<subseteq> \n          gen_refine: sifum_refinement dma dma \\<C>_vars \\<C>_vars \\<C> \\<C> eval\\<^sub>A eval\\<^sub>C some_val id\n  by(unfold_locales, simp_all)\n\ncontext sifum_refinement_same_mem begin\n\n\n\ndefinition\n  preserves_modes_mem :: \"('Com\\<^sub>A, 'Var, 'Val, 'Com\\<^sub>C, 'Var) state_relation \\<Rightarrow> bool\"\nwhere\n  \"preserves_modes_mem \\<R> \\<equiv> \n  (\\<forall> c\\<^sub>A mds\\<^sub>A mem\\<^sub>A c\\<^sub>C mds\\<^sub>C mem\\<^sub>C. (\\<langle> c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n      mem\\<^sub>A = mem\\<^sub>C \\<and> mds\\<^sub>A = mds\\<^sub>C)\"\n\n\ndefinition\n  closed_others :: \"('Com\\<^sub>A, 'Var, 'Val, 'Com\\<^sub>C, 'Var) state_relation \\<Rightarrow> bool\"\nwhere\n  \"closed_others \\<R> \\<equiv> \n  (\\<forall> c\\<^sub>A mds mem c\\<^sub>C mem'. (\\<langle> c\\<^sub>A, mds, mem \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>C, mds, mem \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n   (\\<forall>x. mem x \\<noteq> mem' x \\<longrightarrow> \\<not> var_asm_not_written mds x) \\<longrightarrow>\n   (\\<forall>x. dma mem x \\<noteq> dma mem' x \\<longrightarrow> \\<not> var_asm_not_written mds x) \\<longrightarrow>\n         (\\<langle> c\\<^sub>A, mds, mem' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>C, mds, mem' \\<rangle>\\<^sub>C) \\<in> \\<R>)\"\n\nlemma [simp]:\n  \"gen_refine.mds\\<^sub>A_of x = x\"\n  by(simp add: gen_refine.mds\\<^sub>A_of_def)\n\nlemma [simp]:\n  \"gen_refine.mem\\<^sub>A_of x = x\"\n  by(simp add: gen_refine.mem\\<^sub>A_of_def)\n\nlemma [simp]:\n  \"preserves_modes_mem \\<R> \\<Longrightarrow>\n  gen_refine.closed_others \\<R> = closed_others \\<R>\"\n  unfolding closed_others_def\n            gen_refine.closed_others_def\n            preserves_modes_mem_def\n  by auto\n\nlemma [simp]:\n  \"gen_refine.preserves_modes_mem \\<R> = preserves_modes_mem \\<R>\"\n  unfolding gen_refine.preserves_modes_mem_def2 preserves_modes_mem_def\n  by simp\n\ndefinition\n  secure_refinement :: \"('Com\\<^sub>A, 'Var, 'Val) LocalConf rel \\<Rightarrow> ('Com\\<^sub>A, 'Var, 'Val, 'Com\\<^sub>C, 'Var) state_relation \\<Rightarrow> \n                          ('Com\\<^sub>C, 'Var, 'Val) LocalConf rel \\<Rightarrow> bool\"\nwhere\n  \"secure_refinement \\<R>\\<^sub>A \\<R> P \\<equiv>\n  closed_others \\<R> \\<and>\n  preserves_modes_mem \\<R> \\<and>\n  conc.closed_glob_consistent P \\<and>\n  (\\<forall> c\\<^sub>1\\<^sub>A mds mem\\<^sub>1 c\\<^sub>1\\<^sub>C. \n   (\\<langle> c\\<^sub>1\\<^sub>A, mds, mem\\<^sub>1 \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C, mds, mem\\<^sub>1 \\<rangle>\\<^sub>C) \\<in> \\<R> \\<longrightarrow>\n    (\\<forall> c\\<^sub>1\\<^sub>C' mds' mem\\<^sub>1'. \\<langle> c\\<^sub>1\\<^sub>C, mds, mem\\<^sub>1 \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>1\\<^sub>C', mds', mem\\<^sub>1' \\<rangle>\\<^sub>C \\<longrightarrow>\n     (\\<exists> n c\\<^sub>1\\<^sub>A'. abs.neval \\<langle> c\\<^sub>1\\<^sub>A, mds, mem\\<^sub>1 \\<rangle>\\<^sub>A n \\<langle> c\\<^sub>1\\<^sub>A', mds', mem\\<^sub>1' \\<rangle>\\<^sub>A \\<and>\n                   (\\<langle> c\\<^sub>1\\<^sub>A', mds', mem\\<^sub>1' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>1\\<^sub>C', mds', mem\\<^sub>1' \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n       (\\<forall>c\\<^sub>2\\<^sub>A mem\\<^sub>2 c\\<^sub>2\\<^sub>C c\\<^sub>2\\<^sub>A' mem\\<^sub>2'. \n         (\\<langle> c\\<^sub>1\\<^sub>A, mds, mem\\<^sub>1 \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>A, mds, mem\\<^sub>2 \\<rangle>\\<^sub>A) \\<in> \\<R>\\<^sub>A \\<and>\n         (\\<langle> c\\<^sub>2\\<^sub>A, mds, mem\\<^sub>2 \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>C, mds, mem\\<^sub>2 \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n         (\\<langle>c\\<^sub>1\\<^sub>C, mds, mem\\<^sub>1\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C, mds, mem\\<^sub>2\\<rangle>\\<^sub>C) \\<in> P  \\<and>\n         abs.neval \\<langle> c\\<^sub>2\\<^sub>A, mds, mem\\<^sub>2 \\<rangle>\\<^sub>A n \\<langle> c\\<^sub>2\\<^sub>A', mds', mem\\<^sub>2' \\<rangle>\\<^sub>A  \\<longrightarrow>\n           (\\<exists> c\\<^sub>2\\<^sub>C' . \\<langle> c\\<^sub>2\\<^sub>C, mds, mem\\<^sub>2 \\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle> c\\<^sub>2\\<^sub>C', mds', mem\\<^sub>2' \\<rangle>\\<^sub>C \\<and>\n                   (\\<langle> c\\<^sub>2\\<^sub>A', mds', mem\\<^sub>2' \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>2\\<^sub>C', mds', mem\\<^sub>2' \\<rangle>\\<^sub>C) \\<in> \\<R> \\<and>\n                   (\\<langle>c\\<^sub>1\\<^sub>C', mds', mem\\<^sub>1'\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>2\\<^sub>C', mds', mem\\<^sub>2'\\<rangle>\\<^sub>C) \\<in> P )))))\"\n\nlemma preserves_modes_memD:\n  \"preserves_modes_mem \\<R> \\<Longrightarrow>\n(\\<langle> c\\<^sub>A, mds\\<^sub>A, mem\\<^sub>A \\<rangle>\\<^sub>A, \\<langle> c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C \\<rangle>\\<^sub>C) \\<in> \\<R> \\<Longrightarrow>\n      mem\\<^sub>A = mem\\<^sub>C \\<and> mds\\<^sub>A = mds\\<^sub>C\"\n  by(auto simp: preserves_modes_mem_def)\n\nlemma [simp]:\n  \"gen_refine.secure_refinement \\<R>\\<^sub>A \\<R> P = secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  unfolding gen_refine.secure_refinement_def secure_refinement_def\n  apply safe\n         apply fastforce\n        apply fastforce\n       defer\n       apply fastforce\n      apply fastforce\n     apply fastforce\n    defer\n   apply ((drule spec)+, erule (1) impE)\n   apply ((drule spec)+, erule (1) impE)\n   apply (clarify)\n   apply(rename_tac  n c\\<^sub>1\\<^sub>A' mds\\<^sub>A' mem\\<^sub>1\\<^sub>A')\n   apply(rule_tac x=n in exI)\n   apply(rule_tac x=c\\<^sub>1\\<^sub>A' in exI)\n   apply(fastforce dest: preserves_modes_memD)\n  apply (frule (1) preserves_modes_memD)\n  apply clarify\n  apply ((drule spec)+, erule (1) impE)\n  apply ((drule spec)+, erule (1) impE)\n  apply clarify\n  apply(blast dest: preserves_modes_memD)\n  done\n  \nlemma R\\<^sub>C_of_strong_low_bisim_mm:\n  assumes abs: \"abs.strong_low_bisim_mm \\<R>\\<^sub>A\"\n  assumes rr: \"secure_refinement \\<R>\\<^sub>A \\<R> P\"\n  assumes P_sym: \"sym P\"\n  shows \"conc.strong_low_bisim_mm (gen_refine.R\\<^sub>C_of \\<R>\\<^sub>A \\<R> P)\"\n  using abs rr gen_refine.R\\<^sub>C_of_strong_low_bisim_mm[OF _ _ P_sym]\n  by simp\n\nend\n\ncontext sifum_refinement begin\nlemma use_secure_refinement_helper:\n  \"secure_refinement \\<R>\\<^sub>A \\<R> P \\<Longrightarrow>\n   ((cm\\<^sub>A,mem\\<^sub>A),(cm\\<^sub>C,mem\\<^sub>C)) \\<in> \\<R> \\<Longrightarrow> (cm\\<^sub>C,mem\\<^sub>C) \\<leadsto>\\<^sub>C (cm\\<^sub>C',mem\\<^sub>C') \\<Longrightarrow>\n   (\\<exists>cm\\<^sub>A' mem\\<^sub>A' n. abs.neval (cm\\<^sub>A,mem\\<^sub>A) n (cm\\<^sub>A',mem\\<^sub>A') \\<and>\n                 ((cm\\<^sub>A',mem\\<^sub>A'), (cm\\<^sub>C',mem\\<^sub>C')) \\<in> \\<R>)\"\n  apply(case_tac cm\\<^sub>A, case_tac cm\\<^sub>C)\n  apply clarsimp\n  apply(clarsimp simp: secure_refinement_def)\n  by (metis surjective_pairing)\n  \nlemma closed_othersD:\n  \"closed_others \\<R> \\<Longrightarrow>\n   (\\<langle>c\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>C\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R> \\<Longrightarrow>\n   (\\<And>x. mem\\<^sub>C' x \\<noteq> mem\\<^sub>C x \\<or> dma\\<^sub>C mem\\<^sub>C' x \\<noteq> dma\\<^sub>C mem\\<^sub>C x \\<Longrightarrow> \\<not> var_asm_not_written mds\\<^sub>C x) \\<Longrightarrow>\n   (\\<langle>c\\<^sub>A, mds\\<^sub>A_of mds\\<^sub>C, mem\\<^sub>A_of mem\\<^sub>C'\\<rangle>\\<^sub>A, \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> \\<R>\"\n   unfolding closed_others_def\n   by auto\nend\n\nrecord ('a, 'Val, 'Var\\<^sub>C, 'Com\\<^sub>C, 'Var\\<^sub>A, 'Com\\<^sub>A) componentwise_refinement =\n  priv_mem :: \"'Var\\<^sub>C set\" (* private variables *)\n  \\<R>\\<^sub>A_rel :: \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val) LocalConf rel\" (* abstract bisimulation *)\n  \\<R>_rel :: \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val, 'Com\\<^sub>C, 'Var\\<^sub>C) state_relation\" (* refinement relation *)\n  P_rel :: \"('Com\\<^sub>C, 'Var\\<^sub>C, 'Val) LocalConf rel\"\n\nsection \"Whole System Refinement\"\n\ntext \\<open>\n  A locale to capture componentwise refinement of an entire system.\n\\<close>\nlocale sifum_refinement_sys = \n  sifum_refinement dma\\<^sub>A dma\\<^sub>C \\<C>_vars\\<^sub>A \\<C>_vars\\<^sub>C \\<C>\\<^sub>A \\<C>\\<^sub>C eval\\<^sub>A eval\\<^sub>C some_val var\\<^sub>C_of\n  for dma\\<^sub>A :: \"('Var\\<^sub>A,'Val) Mem \\<Rightarrow> 'Var\\<^sub>A \\<Rightarrow> Sec\"\n  and dma\\<^sub>C :: \"('Var\\<^sub>C,'Val) Mem \\<Rightarrow> 'Var\\<^sub>C \\<Rightarrow> Sec\"\n  and \\<C>_vars\\<^sub>A :: \"'Var\\<^sub>A \\<Rightarrow> 'Var\\<^sub>A set\"\n  and \\<C>_vars\\<^sub>C :: \"'Var\\<^sub>C \\<Rightarrow> 'Var\\<^sub>C set\"\n  and \\<C>\\<^sub>A :: \"'Var\\<^sub>A set\"\n  and \\<C>\\<^sub>C :: \"'Var\\<^sub>C set\"\n  and eval\\<^sub>A :: \"('Com\\<^sub>A, 'Var\\<^sub>A, 'Val) LocalConf rel\"\n  and eval\\<^sub>C :: \"('Com\\<^sub>C, 'Var\\<^sub>C, 'Val) LocalConf rel\"\n  and some_val :: \"'Val\"\n  and var\\<^sub>C_of :: \"'Var\\<^sub>A \\<Rightarrow> 'Var\\<^sub>C\" +\n  fixes cms :: \"('a::wellorder, 'Val, 'Var\\<^sub>C, 'Com\\<^sub>C, 'Var\\<^sub>A, 'Com\\<^sub>A) componentwise_refinement list\" \n  fixes priv_mem\\<^sub>C :: \"'Var\\<^sub>C set list\"\n  defines priv_mem\\<^sub>C_def: \"priv_mem\\<^sub>C \\<equiv> map priv_mem cms\"\n  assumes priv_mem_disjoint: \"i < length cms \\<Longrightarrow> j < length cms \\<Longrightarrow> i \\<noteq> j \\<Longrightarrow> priv_mem\\<^sub>C ! i \\<inter> priv_mem\\<^sub>C ! j = {}\"\n  assumes new_vars_priv: \"- range var\\<^sub>C_of = \\<Union> (set priv_mem\\<^sub>C)\"\n  assumes new_privs_preserved: \"\\<langle>c, mds, mem\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c', mds', mem'\\<rangle>\\<^sub>C \\<Longrightarrow> x \\<notin> range var\\<^sub>C_of \\<Longrightarrow>\n                                 (x \\<in> mds m) = (x \\<in> mds' m)\"\n  assumes secure_refinements: \n    \"i < length cms \\<Longrightarrow> secure_refinement (\\<R>\\<^sub>A_rel (cms ! i)) (\\<R>_rel (cms ! i)) (P_rel (cms ! i))\"\n  assumes local_guarantee_preservation:\n    \"i < length cms \\<Longrightarrow> preserves_local_guarantee_compliance (\\<R>_rel (cms ! i))\"\n  assumes bisims:\n    \"i < length cms \\<Longrightarrow> abs.strong_low_bisim_mm (\\<R>\\<^sub>A_rel (cms ! i))\"\n  assumes Ps_sym:\n    \"\\<And>a b. i < length cms \\<Longrightarrow> sym (P_rel (cms ! i))\"\n  assumes Ps_refl_on_low_mds_eq:\n    \"i < length cms \\<Longrightarrow> conc.low_mds_eq mds\\<^sub>C mem\\<^sub>C mem\\<^sub>C' \\<Longrightarrow> (\\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C\\<rangle>\\<^sub>C, \\<langle>c\\<^sub>C, mds\\<^sub>C, mem\\<^sub>C'\\<rangle>\\<^sub>C) \\<in> (P_rel (cms ! i))\" \n\n(* FIXME: move to a parent theory? *)\ncontext sifum_security begin\nlemma neval_modifies_helper:\n  assumes nevaln: \"neval lcn m lcn'\"\n  assumes lcn_def: \"lcn = (cms ! n, mem)\"\n  assumes lcn'_def: \"lcn' = (cmn', mem')\"\n  assumes len: \"n < length cms\"\n  assumes modified: \"mem x \\<noteq> mem' x \\<or> dma mem x \\<noteq> dma mem' x\"\n  shows \"\\<exists>k cmn'' mem'' cmn''' mem'''. k < m \\<and> neval (cms ! n,mem) k (cmn'',mem'') \\<and>\n                           (cmn'',mem'') \\<leadsto> (cmn''', mem''') \\<and>\n                           (mem'' x \\<noteq> mem''' x \\<or> dma mem'' x \\<noteq> dma mem''' x)\"\nusing nevaln lcn_def lcn'_def modified len\nproof(induct arbitrary: cms cmn' mem mem' rule: neval.induct)\n  case (neval_0 lcn lcn')\n    from neval_0 show ?case by simp\n  next\n  case (neval_S_n lcn lcn'' m lcn')\n  obtain cmn'' mem'' where lcn''_def: \"lcn'' = (cmn'', mem'')\" by fastforce\n  show ?case\n  proof(cases \"mem x \\<noteq> mem'' x \\<or> dma mem x \\<noteq> dma mem'' x\")    \n    assume a: \"mem x \\<noteq> mem'' x \\<or> dma mem x \\<noteq> dma mem'' x\"\n    let ?k = \"0::nat\"\n    let ?cmn'' = \"cms ! n\"\n    let ?mem'' = \"mem\"\n    have \"?k < Suc m \\<and>\n    neval (cms ! n, mem) ?k (?cmn'', ?mem'') \\<and>\n    (?cmn'', ?mem'') \\<leadsto> (cmn'', mem'') \\<and> (?mem'' x \\<noteq> mem'' x \\<or>\n    dma ?mem'' x \\<noteq> dma mem'' x)\"\n      apply (rule conjI, simp add: neval.neval_0)+\n      apply (simp only: a)\n      by (simp add: neval_S_n(1)[simplified neval_S_n lcn''_def])\n    thus ?case by blast\n  next\n    assume a: \"\\<not> (mem x \\<noteq> mem'' x \\<or> dma mem x \\<noteq> dma mem'' x)\"\n    hence unchanged: \"mem'' x = mem x \\<and> dma mem'' x = dma mem x\"\n      by (blast intro: sym)\n    define cms'' where \"cms'' = cms[n := cmn'']\"\n    have len'': \"n < length cms''\"\n      by(simp add: cms''_def neval_S_n)\n    hence lcn''_def2: \"lcn'' = (cms'' ! n, mem'')\"\n      by(simp add: lcn''_def cms''_def)\n    from\n    neval_S_n(3)[OF lcn''_def2 neval_S_n(5), simplified unchanged neval_S_n len'']\n    obtain k cmn''' mem''' cmn'''' mem'''' where\n      hyp:    \"k < m \\<and>\n          neval (cms'' ! n, mem'') k (cmn''', mem''') \\<and>\n          (cmn''', mem''') \\<leadsto> (cmn'''', mem'''') \\<and>\n          (mem''' x \\<noteq> mem'''' x \\<or> dma mem''' x \\<noteq> dma mem'''' x)\"\n      by blast\n    have \"neval (cms ! n, mem) (Suc k) (cmn''', mem''')\"           \n      apply(rule neval.neval_S_n)  \n       prefer 2\n       using hyp apply fastforce \n      apply(simp add: cms''_def neval_S_n)\n      by(rule neval_S_n(1)[simplified neval_S_n lcn''_def])\n    moreover have \"Suc k < Suc m\" using hyp by auto\n    ultimately show ?case using hyp by fastforce\n  qed\nqed\n\nlemma neval_sched_Nil [simp]:\n  \"(cms, mem) \\<rightarrow>\\<^bsub>[]\\<^esub> (cms, mem)\"\n  by simp\n  \nlemma reachable_mode_states_refl:\n  \"map snd cms \\<in> reachable_mode_states (cms, mem)\"\n  apply(clarsimp simp: reachable_mode_states_def)\n  using neval_sched_Nil by blast\n  \nlemma neval_reachable_mode_states:\n  assumes neval: \"neval lc n lc'\"\n  assumes lc_def: \"lc = (cms ! k, mem)\" \n  assumes len: \"k < length cms\"\n  shows \"map snd (cms[k := (fst lc')]) \\<in> reachable_mode_states (cms, mem)\"\nusing neval lc_def len proof(induct arbitrary: cms mem rule: neval.induct)\ncase (neval_0 x y)\n  thus ?case\n  apply simp\n  apply(drule sym, simp add: len reachable_mode_states_refl)\n  done\nnext\ncase (neval_S_n x y n z)\n  define cms' where \"cms' = cms[k := fst y]\"\n  define mem' where \"mem' = snd y\"\n  have y_def: \"y = (cms' ! k, mem')\"\n    by(simp add: cms'_def mem'_def neval_S_n)\n  moreover have len': \"k < length cms'\"\n    by(simp add: cms'_def neval_S_n)\n  ultimately have hyp: \"map snd (cms'[k := fst z]) \\<in> reachable_mode_states (cms', mem')\"\n    using neval_S_n by metis\n  have \"map snd (cms'[k := fst z]) = map snd (cms[k := fst z])\"\n    unfolding cms'_def\n    by simp\n  moreover have \"(cms, mem) \\<leadsto>\\<^bsub>k\\<^esub> (cms', mem')\"\n    using meval_intro neval_S_n y_def cms'_def mem'_def len' by fastforce \n  ultimately show ?case\n  using reachable_modes_subset subsetD hyp by fastforce\nqed\n\n\nlemma meval_sched_sound_mode_use:\n  \"sound_mode_use gc \\<Longrightarrow> meval_sched sched gc gc' \\<Longrightarrow> sound_mode_use gc'\"\nproof(induct rule: meval_sched.induct)\ncase (1 gc)\n  thus ?case by simp\nnext\ncase (2 n ns gc gc')\n  from 2(3) obtain gc'' where \"meval_abv gc n gc''\" and a: \"meval_sched ns gc'' gc'\" by force\n  with 2(2) sound_modes_invariant have b: \"sound_mode_use gc''\" by (metis surjective_pairing)\n  show ?case by (rule 2(1)[OF b a])\nqed\n\nlemma neval_meval:\n  \"neval lcn k lcn' \\<Longrightarrow> n < length cms \\<Longrightarrow> lcn = (cms ! n,mem) \\<Longrightarrow> lcn' = (cmn', mem') \\<Longrightarrow>\n  meval_sched (replicate k n) (cms,mem) (cms[n := cmn'],mem')\"\nproof(induct arbitrary: cms mem cmn' mem' rule: neval.induct)\ncase (neval_0 lcn lcn')  \n  thus ?case by fastforce\nnext\ncase (neval_S_n lcn lcn'' k lcn')\n  define cms'' where [simp]: \"cms'' = cms[n := fst lcn'']\"\n  define mem'' where [simp]: \"mem'' = snd lcn''\"\n  have len'' [simp]: \"n < length cms''\" by(simp add: neval_S_n(4))\n  have lcn''_def: \"lcn'' = (cms'' ! n, mem'')\" using len'' by simp\n  have hyp: \"(cms'', mem'') \\<rightarrow>\\<^bsub>replicate k n\\<^esub> (cms''[n := cmn'], mem')\"\n    by (rule neval_S_n(3)[OF len'' lcn''_def neval_S_n(6)])\n  have meval: \"(cms, mem) \\<leadsto>\\<^bsub>n\\<^esub> (cms'', mem'')\"\n    using cms''_def neval_S_n.hyps(1) neval_S_n.prems(1) neval_S_n.prems(2) by fastforce\n  from hyp meval show ?case\n    by fastforce\nqed\n\nlemma meval_sched_app:\n  \"meval_sched as gc gc' \\<Longrightarrow> meval_sched bs gc' gc'' \\<Longrightarrow> meval_sched (as@bs) gc gc''\"\nproof(induct as arbitrary: gc gc' bs)\ncase Nil thus ?case by simp\nnext\ncase (Cons a as)\n  from Cons(2) \n  obtain gc''' where a: \"meval_abv gc a gc'''\" and as: \"meval_sched as gc''' gc'\" by force\n  from Cons(1)[OF as Cons(3)] a\n  have \"gc \\<rightarrow>\\<^bsub>a # (as @ bs)\\<^esub> gc''\"\n    by (metis meval_sched.simps)\n  thus ?case by simp\nqed\n\nend\n\ncontext sifum_refinement_sys begin\n\nlemma conc_respects_priv:\n  assumes xnin: \"x\\<^sub>C \\<notin> range var\\<^sub>C_of\"\n  assumes modified\\<^sub>C: \"mem\\<^sub>C x\\<^sub>C \\<noteq> mem\\<^sub>C' x\\<^sub>C \\<or> dma\\<^sub>C mem\\<^sub>C x\\<^sub>C \\<noteq> dma\\<^sub>C mem\\<^sub>C' x\\<^sub>C\"\n  assumes eval\\<^sub>C: \"(cms\\<^sub>C ! n, mem\\<^sub>C) \\<leadsto>\\<^sub>C (cm\\<^sub>Cn', mem\\<^sub>C')\"\n  assumes in_\\<R>n: \"((cms\\<^sub>A ! n, mem\\<^sub>A), cms\\<^sub>C ! n, mem\\<^sub>C) \\<in> \\<R>n\"\n  assumes preserves: \"preserves_local_guarantee_compliance \\<R>n\"\n  assumes sound_mode_use\\<^sub>A: \"abs.sound_mode_use (cms\\<^sub>A, mem\\<^sub>A)\"\n  assumes nlen: \"n < length cms\"\n  assumes len_eq: \"length cms\\<^sub>A = length cms\"\n  assumes len_eq': \"length cms\\<^sub>C = length cms\"\n  shows \"x\\<^sub>C \\<notin> (snd (cms\\<^sub>C ! n)) GuarNoWrite \\<and> x\\<^sub>C \\<notin> (snd (cms\\<^sub>C ! n)) GuarNoReadOrWrite\"\nproof -\n  from sound_mode_use\\<^sub>A have \"abs.respects_own_guarantees (cms\\<^sub>A ! n)\"\n    using nlen len_eq abs.locally_sound_respects_guarantees \n    unfolding abs.sound_mode_use_def list_all_length\n    by fastforce\n  with in_\\<R>n have 1: \"conc.respects_own_guarantees (cms\\<^sub>C ! n)\"\n    using preserves\n    unfolding preserves_local_guarantee_compliance_def\n    by metis\n  with eval\\<^sub>C modified\\<^sub>C have 2: \"\\<not> conc.doesnt_modify (fst (cms\\<^sub>C ! n)) x\\<^sub>C\"\n    unfolding conc.doesnt_modify_def\n    by (metis surjective_pairing)\n  then have \"\\<not> conc.doesnt_read_or_modify (fst (cms\\<^sub>C ! n)) x\\<^sub>C\"\n    using conc.doesnt_read_or_modify_doesnt_modify by metis\n  with 1 2 show ?thesis\n    unfolding conc.respects_own_guarantees_def \n    by metis\nqed\n\nlemma modified_variables_are_not_assumed_not_written:\n  fixes cms\\<^sub>A mem\\<^sub>A cms\\<^sub>C mem\\<^sub>C cm\\<^sub>Cn' mem\\<^sub>C' \\<R>n cm\\<^sub>An' mem\\<^sub>A' m\\<^sub>A \\<R>i\n  assumes sound_mode_use\\<^sub>A: \"abs.sound_mode_use (cms\\<^sub>A, mem\\<^sub>A)\"\n  assumes pmmn: \"preserves_modes_mem \\<R>n\"\n  assumes in_\\<R>n: \"((cms\\<^sub>A ! n, mem\\<^sub>A), (cms\\<^sub>C ! n, mem\\<^sub>C)) \\<in> \\<R>n\"\n  assumes pmmi: \"preserves_modes_mem \\<R>i\"\n  assumes in_\\<R>i: \"((cms\\<^sub>A ! i, mem\\<^sub>A), (cms\\<^sub>C ! i, mem\\<^sub>C)) \\<in> \\<R>i\"\n  assumes nlen: \"n < length cms\"\n  assumes len\\<^sub>A: \"length cms\\<^sub>A = length cms\"\n  assumes len\\<^sub>C: \"length cms\\<^sub>C = length cms\"\n  assumes priv_is_asm_priv: \"\\<And>i. i < length cms \\<Longrightarrow> priv_mem\\<^sub>C ! i \\<subseteq> snd (cms\\<^sub>C ! i) AsmNoReadOrWrite\"\n  assumes priv_is_guar_priv: \"\\<And>i j. i < length cms \\<Longrightarrow> j < length cms \\<Longrightarrow> i \\<noteq> j \\<Longrightarrow> priv_mem\\<^sub>C ! i \\<subseteq> snd (cms\\<^sub>C ! j) GuarNoReadOrWrite\"\n  assumes new_asms_only_for_priv: \"\\<And>i. i < length cms \\<Longrightarrow> \n                                           (snd (cms\\<^sub>C ! i) AsmNoReadOrWrite \\<union> snd (cms\\<^sub>C ! i) AsmNoWrite) \\<inter> (- range var\\<^sub>C_of) \\<subseteq> priv_mem\\<^sub>C ! i\"\n  assumes eval\\<^sub>Cn: \"(cms\\<^sub>C ! n,mem\\<^sub>C) \\<leadsto>\\<^sub>C (cm\\<^sub>Cn', mem\\<^sub>C')\"\n  assumes neval\\<^sub>An: \"abs.neval (cms\\<^sub>A ! n,mem\\<^sub>A) m\\<^sub>A (cm\\<^sub>An', mem\\<^sub>A')\"\n  assumes in_\\<R>n': \"((cm\\<^sub>An', mem\\<^sub>A'), (cm\\<^sub>Cn', mem\\<^sub>C')) \\<in> \\<R>n\"\n  assumes modified\\<^sub>C: \"mem\\<^sub>C x\\<^sub>C \\<noteq> mem\\<^sub>C' x\\<^sub>C \\<or> dma\\<^sub>C mem\\<^sub>C x\\<^sub>C \\<noteq> dma\\<^sub>C mem\\<^sub>C' x\\<^sub>C\"\n  assumes neq: \"i \\<noteq> n\"\n  assumes ilen: \"i < length cms\"\n  assumes preserves: \"preserves_local_guarantee_compliance \\<R>n\"\n  shows \"\\<not> var_asm_not_written (snd (cms\\<^sub>C ! i)) x\\<^sub>C\"\nproof(cases \"x\\<^sub>C \\<in> range var\\<^sub>C_of\")\n  assume \"x\\<^sub>C \\<in> range var\\<^sub>C_of\"\n  from this obtain x\\<^sub>A where x\\<^sub>C_def: \"x\\<^sub>C = var\\<^sub>C_of x\\<^sub>A\" by blast\n  obtain c\\<^sub>An mds\\<^sub>An where [simp]: \"cms\\<^sub>A ! n = (c\\<^sub>An, mds\\<^sub>An)\" by fastforce\n  obtain c\\<^sub>Cn mds\\<^sub>Cn where [simp]: \"cms\\<^sub>C ! n = (c\\<^sub>Cn, mds\\<^sub>Cn)\" by fastforce\n  obtain c\\<^sub>Cn' mds\\<^sub>Cn' where [simp]: \"cm\\<^sub>Cn' = (c\\<^sub>Cn', mds\\<^sub>Cn')\" by fastforce\n  obtain c\\<^sub>An' mds\\<^sub>An' where [simp]: \"cm\\<^sub>An' = (c\\<^sub>An', mds\\<^sub>An')\" by fastforce\n\n  from in_\\<R>n pmmn have [simp]: \"mem\\<^sub>A = mem\\<^sub>A_of mem\\<^sub>C\" and [simp]: \"mds\\<^sub>An = mds\\<^sub>A_of mds\\<^sub>Cn\"\n    using preserves_modes_memD by auto\n  from in_\\<R>n' pmmn have [simp]: \"mem\\<^sub>A' = mem\\<^sub>A_of mem\\<^sub>C'\" and [simp]: \"mds\\<^sub>An' = mds\\<^sub>A_of mds\\<^sub>Cn'\"\n    using preserves_modes_memD by auto\n  \n  from modified\\<^sub>C dma_consistent have \n    modified\\<^sub>A: \"mem\\<^sub>A x\\<^sub>A \\<noteq> mem\\<^sub>A' x\\<^sub>A \\<or> dma\\<^sub>A mem\\<^sub>A x\\<^sub>A \\<noteq> dma\\<^sub>A mem\\<^sub>A' x\\<^sub>A\"\n    by (simp add: mem\\<^sub>A_of_def x\\<^sub>C_def)\n    \n  from len\\<^sub>A nlen have nlen\\<^sub>A: \"n < length cms\\<^sub>A\" by simp\n  from len\\<^sub>A ilen have ilen\\<^sub>A: \"i < length cms\\<^sub>A\" by simp\n\n  from abs.neval_modifies_helper[OF neval\\<^sub>An HOL.refl HOL.refl nlen\\<^sub>A modified\\<^sub>A]\n  obtain k\\<^sub>A cm\\<^sub>An'' mem\\<^sub>A'' cm\\<^sub>An''' mem\\<^sub>A''' \n  where \"k\\<^sub>A < m\\<^sub>A\" \n    and neval\\<^sub>An'': \"abs.neval (cms\\<^sub>A ! n, mem\\<^sub>A) k\\<^sub>A (cm\\<^sub>An'', mem\\<^sub>A'')\"\n    and eval\\<^sub>An'': \"(cm\\<^sub>An'', mem\\<^sub>A'') \\<leadsto>\\<^sub>A (cm\\<^sub>An''', mem\\<^sub>A''')\"\n    and modified\\<^sub>A'': \"(mem\\<^sub>A'' x\\<^sub>A \\<noteq> mem\\<^sub>A''' x\\<^sub>A \\<or> dma\\<^sub>A mem\\<^sub>A'' x\\<^sub>A \\<noteq> dma\\<^sub>A mem\\<^sub>A''' x\\<^sub>A)\" by blast\n  let ?c\\<^sub>An'' = \"fst cm\\<^sub>An''\"\n  let ?mds\\<^sub>An'' = \"snd cm\\<^sub>An''\"\n  from eval\\<^sub>An'' modified\\<^sub>A'' have modifies\\<^sub>A'': \"\\<not> abs.doesnt_modify ?c\\<^sub>An'' x\\<^sub>A\"\n    unfolding abs.doesnt_modify_def\n    by (metis surjective_pairing)\n  have loc_reach\\<^sub>A'': \"(cm\\<^sub>An'', mem\\<^sub>A'') \\<in> abs.loc_reach (cms\\<^sub>A ! n, mem\\<^sub>A)\"\n    apply(rule abs.neval_loc_reach)\n     apply(rule neval\\<^sub>An'')\n    using abs.loc_reach.refl by simp\n  have locally_sound_mode_use\\<^sub>An: \"abs.locally_sound_mode_use  (cms\\<^sub>A ! n, mem\\<^sub>A)\"\n    using sound_mode_use\\<^sub>A nlen\\<^sub>A\n    unfolding abs.sound_mode_use_def\n    using list_all_length by fastforce\n  from modifies\\<^sub>A'' loc_reach\\<^sub>A'' locally_sound_mode_use\\<^sub>An abs.doesnt_read_or_modify_doesnt_modify\n  have no_guar\\<^sub>An: \"x\\<^sub>A \\<notin> ?mds\\<^sub>An'' GuarNoReadOrWrite \\<and> x\\<^sub>A \\<notin> ?mds\\<^sub>An'' GuarNoWrite\"\n    unfolding abs.locally_sound_mode_use_def\n    by (metis surjective_pairing)\n  let ?mdss\\<^sub>A'' = \"map snd (cms\\<^sub>A[n := fst (cm\\<^sub>An'',mem\\<^sub>A'')])\"\n  have \"?mdss\\<^sub>A'' \\<in> abs.reachable_mode_states (cms\\<^sub>A, mem\\<^sub>A)\"\n    apply(rule abs.neval_reachable_mode_states)\n      apply(rule neval\\<^sub>An'')\n     apply(rule HOL.refl)\n    by(rule nlen\\<^sub>A)\n  hence compat: \"abs.compatible_modes ?mdss\\<^sub>A''\"\n    using sound_mode_use\\<^sub>A\n    by(simp add: abs.globally_sound_mode_use_def)\n  have n: \"?mdss\\<^sub>A'' ! n = ?mds\\<^sub>An''\"\n    by(simp add: nlen\\<^sub>A)\n  let ?mds\\<^sub>Ai = \"snd (cms\\<^sub>A ! i)\"\n  have i: \"?mdss\\<^sub>A'' ! i = ?mds\\<^sub>Ai\"\n    apply(simp add: ilen\\<^sub>A)\n    by(metis nth_list_update_neq neq)\n  from nlen\\<^sub>A have nlen\\<^sub>A'': \"n < length ?mdss\\<^sub>A''\" by simp\n  from ilen\\<^sub>A have ilen\\<^sub>A'': \"i < length ?mdss\\<^sub>A''\" by simp\n  with compat n i nlen\\<^sub>A'' ilen\\<^sub>A'' no_guar\\<^sub>An neq\n  have no_asm\\<^sub>Ai: \"x\\<^sub>A \\<notin> ?mds\\<^sub>Ai AsmNoWrite \\<and> x\\<^sub>A \\<notin> ?mds\\<^sub>Ai AsmNoReadOrWrite\"\n    unfolding abs.compatible_modes_def\n    by metis\n\n  obtain c\\<^sub>Ai mds\\<^sub>Ai where [simp]: \"cms\\<^sub>A ! i = (c\\<^sub>Ai, mds\\<^sub>Ai)\" by fastforce\n  obtain c\\<^sub>Ci mds\\<^sub>Ci where [simp]: \"cms\\<^sub>C ! i = (c\\<^sub>Ci, mds\\<^sub>Ci)\" by fastforce\n\n  from in_\\<R>i pmmi have [simp]: \"mds\\<^sub>Ai = mds\\<^sub>A_of mds\\<^sub>Ci\"\n    using preserves_modes_memD by auto\n  have [simp]: \"?mds\\<^sub>Ai = mds\\<^sub>Ai\" by simp\n  from no_asm\\<^sub>Ai have no_asm\\<^sub>Ci: \"x\\<^sub>C \\<notin> mds\\<^sub>Ci AsmNoWrite \\<and> x\\<^sub>C \\<notin> mds\\<^sub>Ci AsmNoReadOrWrite\"\n    using x\\<^sub>C_def mds\\<^sub>A_of_def\n    using doesnt_have_mode by auto\n  thus ?thesis\n    unfolding var_asm_not_written_def\n    by simp\nnext\n  let ?mds\\<^sub>Cn = \"snd (cms\\<^sub>C ! n)\"\n  let ?mds\\<^sub>Ci = \"snd (cms\\<^sub>C ! i)\"\n\n  assume new_var: \"x\\<^sub>C \\<notin> range var\\<^sub>C_of\"\n  from conc_respects_priv[OF new_var modified\\<^sub>C eval\\<^sub>Cn in_\\<R>n preserves sound_mode_use\\<^sub>A nlen len\\<^sub>A len\\<^sub>C] \n  have \"x\\<^sub>C \\<notin> ?mds\\<^sub>Cn GuarNoWrite \\<and> x\\<^sub>C \\<notin> ?mds\\<^sub>Cn GuarNoReadOrWrite\" .\n  with priv_is_guar_priv nlen ilen neq\n  have \"x\\<^sub>C \\<notin> priv_mem\\<^sub>C ! i\"\n    by blast\n  with new_var new_asms_only_for_priv ilen\n  have \"x\\<^sub>C \\<notin> ?mds\\<^sub>Ci AsmNoReadOrWrite \\<union> ?mds\\<^sub>Ci AsmNoWrite\"\n    by blast\n  thus ?thesis\n    unfolding var_asm_not_written_def\n    by simp\nqed\n\ndefinition\n  priv_is_asm_priv :: \"'Var\\<^sub>C Mds list \\<Rightarrow> bool\"\nwhere\n  \"priv_is_asm_priv mdss\\<^sub>C \\<equiv>  \\<forall>i < length cms. priv_mem\\<^sub>C ! i \\<subseteq> (mdss\\<^sub>C ! i) AsmNoReadOrWrite\"\n\ndefinition\n  priv_is_guar_priv :: \"'Var\\<^sub>C Mds list \\<Rightarrow> bool\"\nwhere\n  \"priv_is_guar_priv mdss\\<^sub>C \\<equiv> \n    \\<forall>i < length cms. (\\<forall>j < length cms. i \\<noteq> j \\<longrightarrow> priv_mem\\<^sub>C ! i \\<subseteq> (mdss\\<^sub>C ! j) GuarNoReadOrWrite)\"\n \ndefinition\n  new_asms_only_for_priv :: \"'Var\\<^sub>C Mds list \\<Rightarrow> bool\"\nwhere\n  \"new_asms_only_for_priv mdss\\<^sub>C \\<equiv> \n    \\<forall> i < length cms. \n      ((mdss\\<^sub>C ! i) AsmNoReadOrWrite \\<union> (mdss\\<^sub>C ! i) AsmNoWrite) \\<inter> (- range var\\<^sub>C_of) \\<subseteq> priv_mem\\<^sub>C ! i\"\n\ndefinition\n  new_asms_NoReadOrWrite_only :: \"'Var\\<^sub>C Mds list \\<Rightarrow> bool\"\nwhere\n  \"new_asms_NoReadOrWrite_only mdss\\<^sub>C \\<equiv> \n    \\<forall> i < length cms. \n      (mdss\\<^sub>C ! i) AsmNoWrite \\<inter> (- range var\\<^sub>C_of) = {}\"\n\ndefinition\n  modes_respect_priv :: \"'Var\\<^sub>C Mds list \\<Rightarrow> bool\"\nwhere\n  \"modes_respect_priv mdss\\<^sub>C  \\<equiv> priv_is_asm_priv mdss\\<^sub>C \\<and> priv_is_guar_priv mdss\\<^sub>C \\<and>\n                               new_asms_only_for_priv mdss\\<^sub>C \\<and>\n                               new_asms_NoReadOrWrite_only mdss\\<^sub>C\"\n\ndefinition\n  ignores_old_vars :: \"('Var\\<^sub>C Mds list \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n  \"ignores_old_vars P \\<equiv> \\<forall>mdss mdss'. length mdss = length mdss' \\<and> length mdss' = length cms \\<longrightarrow> \n    (map (\\<lambda>x m. x m \\<inter> (- range var\\<^sub>C_of)) mdss) = (map (\\<lambda>x m. x m \\<inter> (- range var\\<^sub>C_of)) mdss') \\<longrightarrow> \n  P mdss = P mdss'\"\n\nlemma ignores_old_vars_conj:\n  assumes Rdef: \"(\\<And>x. R x = (P x \\<and> Q x))\"\n  assumes iP: \"ignores_old_vars P\" \n  assumes iQ: \"ignores_old_vars Q\" \n  shows \"ignores_old_vars R\"\n  unfolding ignores_old_vars_def\n  apply(simp add: Rdef)\n  apply(intro impI allI)\n  apply(rule conj_cong)\n   apply(erule (1) iP[unfolded ignores_old_vars_def, rule_format])\n  apply(erule (1) iQ[unfolded ignores_old_vars_def, rule_format])\n  done\n\n  \nlemma nth_map_eq': \n  \"length xs = length ys \\<Longrightarrow> map f xs = map g ys \\<Longrightarrow> i < length xs \\<Longrightarrow> f (xs ! i) = g (ys ! i)\"  \n  apply(induct xs ys rule: list_induct2)\n   apply simp\n  apply(case_tac i)\n   apply force\n  by (metis length_map nth_map)\n\nlemma nth_map_eq: \n  \"map f xs = map g ys \\<Longrightarrow> i < length xs \\<Longrightarrow> f (xs ! i) = g (ys ! i)\"\n  apply(rule nth_map_eq')\n    apply(erule map_eq_imp_length_eq)\n   apply assumption+\n  done\n\nlemma nth_in_Union_over_set: \n  \"i < length xs \\<Longrightarrow> xs ! i \\<subseteq> \\<Union>(set xs)\"\n  by (simp add: Union_upper)\n\nlemma priv_are_new_vars: \n  \"x \\<in> priv_mem\\<^sub>C ! i \\<Longrightarrow> i < length cms \\<Longrightarrow> x \\<notin> range var\\<^sub>C_of\"\n  using new_vars_priv nth_in_Union_over_set subsetD\n  using priv_mem\\<^sub>C_def by fastforce\n  \nlemma priv_is_asm_priv_ignores_old_vars:\n  \"ignores_old_vars priv_is_asm_priv\"\n  apply(clarsimp simp: ignores_old_vars_def priv_is_asm_priv_def)\n  apply(rule all_cong)\n  apply(drule nth_map_eq)\n   apply simp\n  apply(blast dest: priv_are_new_vars fun_cong)\n  done\n  \nlemma priv_is_guar_priv_ignores_old_vars:\n  \"ignores_old_vars priv_is_guar_priv\"\n  apply(clarsimp simp: ignores_old_vars_def priv_is_guar_priv_def)\n  apply(rule all_cong)\n  apply(rule all_cong)\n  apply(rule imp_cong)\n   apply(rule HOL.refl)\n  apply(frule nth_map_eq)\n   apply simp\n  apply(drule_tac i=j in nth_map_eq)\n   apply simp\n  apply(blast dest: priv_are_new_vars fun_cong)\n  done\n\nlemma new_asms_only_for_priv_ignores_old_vars:\n  \"ignores_old_vars new_asms_only_for_priv\"\n  apply(clarsimp simp: ignores_old_vars_def new_asms_only_for_priv_def)\n  apply(rule all_cong)\n  apply(drule nth_map_eq)\n   apply simp\n  apply(blast dest: priv_are_new_vars fun_cong)\n  done\n\nlemma new_asms_NoReadOrWrite_only_ignores_old_vars:\n  \"ignores_old_vars new_asms_NoReadOrWrite_only\"\n  apply(clarsimp simp: ignores_old_vars_def new_asms_NoReadOrWrite_only_def)\n  apply(rule all_cong)\n  apply(drule nth_map_eq)\n   apply simp\n  apply(blast dest: priv_are_new_vars fun_cong)\n  done\n  \nlemma modes_respect_priv_ignores_old_vars:\n   \"ignores_old_vars modes_respect_priv\"\n   apply(rule ignores_old_vars_conj)\n     apply(subst modes_respect_priv_def)\n     apply(rule HOL.refl)\n    apply(rule priv_is_asm_priv_ignores_old_vars)\n   apply(rule ignores_old_vars_conj)\n    apply(rule HOL.refl)\n   apply(rule priv_is_guar_priv_ignores_old_vars)\n  apply(rule ignores_old_vars_conj)\n    apply(rule HOL.refl)\n   apply(rule new_asms_only_for_priv_ignores_old_vars)\n  apply(rule new_asms_NoReadOrWrite_only_ignores_old_vars)\n  done\n  \nlemma ignores_old_varsD:\n  \"ignores_old_vars P \\<Longrightarrow> length mdss = length mdss' \\<Longrightarrow> length mdss' = length cms \\<Longrightarrow>\n  (map (\\<lambda>x m. x m \\<inter> (- range var\\<^sub>C_of)) mdss) = (map (\\<lambda>x m. x m \\<inter> (- range var\\<^sub>C_of)) mdss') \\<Longrightarrow> \n  P mdss = P mdss'\"\n  unfolding ignores_old_vars_def\n  by force\n  \nlemma new_privs_preserved':\n  \"\\<langle>c, mds, mem\\<rangle>\\<^sub>C \\<leadsto>\\<^sub>C \\<langle>c', mds', mem'\\<rangle>\\<^sub>C \\<Longrightarrow> (mds m \\<inter> (- range var\\<^sub>C_of)) = (mds' m \\<inter> (- range var\\<^sub>C_of))\"\n  using new_privs_preserved by blast\n\nlemma map_nth_eq:\n  \"length xs = length ys \\<Longrightarrow> (\\<And>i. i < length xs \\<Longrightarrow> f (xs ! i) = g (ys ! i)) \\<Longrightarrow>\n  map f xs = map g ys\"\n  apply(induct xs ys rule: list_induct2)\n   apply simp\n  apply force\n  done\n  \nlemma ignores_old_vars_conc_meval:\n  assumes ignores: \"ignores_old_vars P\"\n  assumes meval:  \"conc.meval_abv gc\\<^sub>C n gc\\<^sub>C'\"\n  assumes len_eq: \"length (fst gc\\<^sub>C) = length cms\"\n  shows \"P (map snd (fst gc\\<^sub>C)) = P (map snd (fst gc\\<^sub>C'))\"\nproof -\n  obtain cms\\<^sub>C mem\\<^sub>C where [simp]: \"gc\\<^sub>C = (cms\\<^sub>C, mem\\<^sub>C)\" by fastforce\n  obtain cms\\<^sub>C' mem\\<^sub>C' where [simp]: \"gc\\<^sub>C' = (cms\\<^sub>C', mem\\<^sub>C')\" by fastforce\n  from meval obtain cmn' mem\\<^sub>C' where\n    eval\\<^sub>Cn: \"(cms\\<^sub>C ! n, mem\\<^sub>C) \\<leadsto>\\<^sub>C (cmn', mem\\<^sub>C')\" and len: \"n < length cms\\<^sub>C\" and cms\\<^sub>C'_def: \"cms\\<^sub>C' = cms\\<^sub>C[n := cmn']\"\n    using conc.meval.cases by fastforce\n  have\n    \"P (map snd cms\\<^sub>C) = P (map snd cms\\<^sub>C')\"\n    apply(rule ignores_old_varsD[OF ignores])\n      apply(simp add: cms\\<^sub>C'_def)\n     using len_eq apply (simp add: cms\\<^sub>C'_def)\n    apply(rule map_nth_eq)\n     apply (simp add: cms\\<^sub>C'_def)\n    apply(case_tac \"i = n\")\n     apply simp\n     apply(rule ext)\n     apply(simp add: cms\\<^sub>C'_def)\n     using eval\\<^sub>Cn new_privs_preserved' apply(metis surjective_pairing)\n    by (simp add: cms\\<^sub>C'_def)\n  thus ?thesis by simp\nqed\n\nlemma ignores_old_vars_conc_meval_sched:\n  assumes ignores: \"ignores_old_vars P\"\n  assumes meval_sched:  \"conc.meval_sched sched gc\\<^sub>C gc\\<^sub>C'\"\n  assumes len_eq: \"length (fst gc\\<^sub>C) = length cms\"\n  shows \"P (map snd (fst gc\\<^sub>C)) = P (map snd (fst gc\\<^sub>C'))\"\nusing meval_sched len_eq proof(induct rule: conc.meval_sched.induct)\n  case (1 gc gc')\n  thus ?case by simp\nnext\n  case (2 n ns gc gc')\n  from 2(2) obtain gc'' where b: \"conc.meval_abv gc n gc''\" and a: \"conc.meval_sched ns gc'' gc'\" by force\n  with 2 have \"length (fst gc'') = length cms\"\n    using conc.meval.cases \n    by (metis length_list_update surjective_pairing)\n  with 2 a b show ?case\n  using ignores_old_vars_conc_meval ignores by metis \nqed\n\nlemma meval_sched_modes_respect_priv:\n  \"conc.meval_sched sched gc\\<^sub>C gc\\<^sub>C' \\<Longrightarrow>   length (fst gc\\<^sub>C) = length cms \\<Longrightarrow>\n  modes_respect_priv (map snd (fst gc\\<^sub>C)) \\<Longrightarrow>\n  modes_respect_priv (map snd (fst gc\\<^sub>C'))\"\n  by(blast dest!: ignores_old_vars_conc_meval_sched[OF modes_respect_priv_ignores_old_vars])\n\nlemma meval_modes_respect_priv:\n  \"conc.meval_abv gc\\<^sub>C n gc\\<^sub>C' \\<Longrightarrow>   length (fst gc\\<^sub>C) = length cms \\<Longrightarrow>\n  modes_respect_priv (map snd (fst gc\\<^sub>C)) \\<Longrightarrow>\n  modes_respect_priv (map snd (fst gc\\<^sub>C'))\"\n  by(blast dest!: ignores_old_vars_conc_meval[OF modes_respect_priv_ignores_old_vars])\n  \n(* I think this lemma would guarantee globally sound mode use for all of the\n  var\\<^sub>C_of variables. It should also hold for all of the non var\\<^sub>C_of variables by\n  the locale assumptions above *)\nlemma traces_refinement:\n  \"\\<And>gc\\<^sub>C gc\\<^sub>C' sched\\<^sub>C gc\\<^sub>A. conc.meval_sched sched\\<^sub>C gc\\<^sub>C gc\\<^sub>C' \\<Longrightarrow>\n    length (fst gc\\<^sub>A) = length cms \\<Longrightarrow> length (fst gc\\<^sub>C) = length cms  \\<Longrightarrow>\n    (\\<And>i. i < length cms \\<Longrightarrow> ((fst gc\\<^sub>A ! i, snd gc\\<^sub>A), (fst gc\\<^sub>C ! i, snd gc\\<^sub>C)) \\<in> \\<R>_rel (cms ! i)) \\<Longrightarrow>\n    abs.sound_mode_use gc\\<^sub>A \\<Longrightarrow> modes_respect_priv (map snd (fst gc\\<^sub>C)) \\<Longrightarrow>\n   \\<exists>sched\\<^sub>A gc\\<^sub>A'. abs.meval_sched sched\\<^sub>A gc\\<^sub>A gc\\<^sub>A' \\<and>\n          (\\<forall>i. i < length cms \\<longrightarrow> ((fst gc\\<^sub>A' ! i, snd gc\\<^sub>A'), (fst gc\\<^sub>C' ! i, snd gc\\<^sub>C')) \\<in> \\<R>_rel (cms ! i)) \\<and>\n          abs.sound_mode_use gc\\<^sub>A'\"\nproof -\n  fix gc\\<^sub>C gc\\<^sub>C' sched\\<^sub>C gc\\<^sub>A\n  assume meval\\<^sub>C: \"conc.meval_sched sched\\<^sub>C gc\\<^sub>C gc\\<^sub>C'\"\n     and len_eq [simp]: \"length (fst gc\\<^sub>A) = length cms\"\n     and len_eq'[simp]: \"length (fst gc\\<^sub>C) = length cms\"\n     and in_\\<R>: \"(\\<And>i. i < length cms \\<Longrightarrow> ((fst gc\\<^sub>A ! i, snd gc\\<^sub>A), (fst gc\\<^sub>C ! i, snd gc\\<^sub>C)) \\<in> \\<R>_rel (cms ! i))\"\n     and sound_mode_use\\<^sub>A: \"abs.sound_mode_use gc\\<^sub>A\"\n     and modes_respect_priv: \"modes_respect_priv (map snd (fst gc\\<^sub>C))\"\n  thus\n    \"\\<exists>sched\\<^sub>A gc\\<^sub>A'. abs.meval_sched sched\\<^sub>A gc\\<^sub>A gc\\<^sub>A' \\<and>\n          (\\<forall>i. i < length cms \\<longrightarrow> ((fst gc\\<^sub>A' ! i, snd gc\\<^sub>A'), (fst gc\\<^sub>C' ! i, snd gc\\<^sub>C')) \\<in> \\<R>_rel (cms ! i)) \\<and>\n          abs.sound_mode_use gc\\<^sub>A'\"\n  proof(induct  arbitrary: gc\\<^sub>A rule: conc.meval_sched.induct)\n  case (1 cms\\<^sub>C cms\\<^sub>C')\n    from 1(1) have cms\\<^sub>C'_def [simp]: \"cms\\<^sub>C' = cms\\<^sub>C\" by simp\n    with 1 have \"abs.meval_sched [] gc\\<^sub>A gc\\<^sub>A \\<and>\n    (\\<forall>i<length cms.\n        ((fst gc\\<^sub>A ! i, snd gc\\<^sub>A), fst cms\\<^sub>C' ! i, snd cms\\<^sub>C') \\<in> \\<R>_rel (cms ! i)) \\<and>\n        abs.sound_mode_use gc\\<^sub>A\"\n      by simp\n    thus ?case by blast\n  next\n  case (2 n ns gc\\<^sub>C gc\\<^sub>c')\n    obtain cms\\<^sub>C mem\\<^sub>C where gc\\<^sub>C_def [simp]: \"gc\\<^sub>C = (cms\\<^sub>C, mem\\<^sub>C)\" by force\n    obtain cms\\<^sub>A mem\\<^sub>A where gc\\<^sub>A_def [simp]: \"gc\\<^sub>A = (cms\\<^sub>A, mem\\<^sub>A)\" by force\n    from 2(2) gc\\<^sub>C_def obtain cms\\<^sub>C'' mem\\<^sub>C'' where\n      meval\\<^sub>C: \"((cms\\<^sub>C,mem\\<^sub>C), n, (cms\\<^sub>C'',mem\\<^sub>C'')) \\<in> conc.meval\" and \n      meval_sched\\<^sub>C: \"conc.meval_sched ns (cms\\<^sub>C'',mem\\<^sub>C'') gc\\<^sub>c'\" \n      by force\n  \n    let ?cm\\<^sub>Cn = \"cms\\<^sub>C ! n\"\n    let ?cm\\<^sub>An = \"cms\\<^sub>A ! n\"\n    let ?\\<R>n = \"\\<R>_rel (cms ! n)\"\n    from meval\\<^sub>C obtain cm\\<^sub>Cn'' where\n      eval\\<^sub>Cn: \"(?cm\\<^sub>Cn, mem\\<^sub>C) \\<leadsto>\\<^sub>C (cm\\<^sub>Cn'', mem\\<^sub>C'')\" and\n      len: \"n < length cms\\<^sub>C\" and\n      cms\\<^sub>C''_def: \"cms\\<^sub>C'' = cms\\<^sub>C [n := cm\\<^sub>Cn'']\" by (blast elim: conc.meval.cases)\n    from len have len [simp]: \"n < length cms\" by (simp add: 2[simplified])\n    from cms\\<^sub>C''_def 2 have \n      len_cms\\<^sub>C'' [simp]: \"length cms\\<^sub>C'' = length cms\" by simp\n    from 2 len have \n      in_\\<R>n: \"((?cm\\<^sub>An,mem\\<^sub>A), (?cm\\<^sub>Cn,mem\\<^sub>C)) \\<in> ?\\<R>n\"\n      by simp\n    \n    with eval\\<^sub>Cn use_secure_refinement_helper[OF secure_refinements[OF len]]  \n    obtain cm\\<^sub>An'' mem\\<^sub>A'' m\\<^sub>A where\n      neval\\<^sub>An: \"abs.neval (?cm\\<^sub>An, mem\\<^sub>A) m\\<^sub>A (cm\\<^sub>An'', mem\\<^sub>A'')\" and\n      in_\\<R>n'': \"((cm\\<^sub>An'',mem\\<^sub>A''),(cm\\<^sub>Cn'',mem\\<^sub>C'')) \\<in> ?\\<R>n\"\n      by blast+\n      \n    define cms\\<^sub>A'' where \"cms\\<^sub>A'' = cms\\<^sub>A [n := cm\\<^sub>An'']\" \n    define gc\\<^sub>A'' where [simp]: \"gc\\<^sub>A'' = (cms\\<^sub>A'', mem\\<^sub>A'')\"\n    have len_cms\\<^sub>A'' [simp]: \"length cms\\<^sub>A'' = length cms\" by(simp add: cms\\<^sub>A''_def 2[simplified])\n  \n    have in_\\<R>'': \"(\\<And>i. i < length cms \\<Longrightarrow> ((cms\\<^sub>A'' ! i, mem\\<^sub>A''), cms\\<^sub>C'' ! i, mem\\<^sub>C'') \\<in> \\<R>_rel (cms ! i))\"\n    proof -\n      fix i\n      assume \"i < length cms\"\n      show \"?thesis i\"\n      proof(cases \"i = n\")\n        assume \"i = n\"\n        hence \"cms\\<^sub>A'' ! i = cm\\<^sub>An''\"\n          using cms\\<^sub>A''_def len_cms\\<^sub>A'' len by simp\n        moreover from \\<open>i = n\\<close> have \"cms\\<^sub>C'' ! i = cm\\<^sub>Cn''\"\n          using cms\\<^sub>C''_def len_cms\\<^sub>C'' len by simp\n        ultimately  show ?thesis \n          using in_\\<R>n'' \\<open>i = n\\<close>\n          by simp\n      next\n        obtain c\\<^sub>Ai mds\\<^sub>Ai where cms\\<^sub>Ai_def [simp]: \"(cms\\<^sub>A ! i) = (c\\<^sub>Ai, mds\\<^sub>Ai)\" by fastforce \n        obtain c\\<^sub>Ci mds\\<^sub>Ci where cms\\<^sub>Ci_def [simp]: \"(cms\\<^sub>C ! i) = (c\\<^sub>Ci, mds\\<^sub>Ci)\" by fastforce \n        hence mds\\<^sub>Ci_def: \"mds\\<^sub>Ci = snd (cms\\<^sub>C ! i)\" by simp\n        \n        from 2(5) \\<open>i < length cms\\<close> have \n          in_\\<R>i: \"((cms\\<^sub>A ! i,mem\\<^sub>A), (cms\\<^sub>C ! i,mem\\<^sub>C)) \\<in> \\<R>_rel (cms ! i)\"\n          by force\n          \n        from in_\\<R>n'' secure_refinements len preserves_modes_memD\n        have mem\\<^sub>A''_def [simp]: \"mem\\<^sub>A'' = mem\\<^sub>A_of mem\\<^sub>C''\"\n          unfolding secure_refinement_def\n          by (metis surjective_pairing)\n          \n        from in_\\<R>i secure_refinements  \\<open>i < length cms\\<close> preserves_modes_memD\n             cms\\<^sub>Ai_def cms\\<^sub>Ci_def\n        have mem\\<^sub>A_def [simp]: \"mem\\<^sub>A = mem\\<^sub>A_of mem\\<^sub>C\" and\n             mds\\<^sub>Ai_def [simp]: \"mds\\<^sub>Ai = mds\\<^sub>A_of mds\\<^sub>Ci\"\n          unfolding secure_refinement_def\n          by metis+\n          \n        assume \"i \\<noteq> n\"\n        hence \"cms\\<^sub>A'' ! i = cms\\<^sub>A ! i\"\n          using cms\\<^sub>A''_def len_cms\\<^sub>A'' len by simp\n        moreover from \\<open>i \\<noteq> n\\<close> have \"cms\\<^sub>C'' ! i = cms\\<^sub>C ! i\"\n          using cms\\<^sub>C''_def len_cms\\<^sub>C'' len by simp\n        ultimately  show ?thesis \n        \n          using 2(5)[of i] \\<open>i \\<noteq> n\\<close> \\<open>i < length cms\\<close>\n          apply simp\n          apply(rule closed_othersD)\n            apply(rule secure_refinements[OF \\<open>i < length cms\\<close>, unfolded secure_refinement_def, THEN conjunct1])\n           apply assumption\n          apply(simp only: mds\\<^sub>Ci_def)  \n          apply(rule_tac \\<R>n=\"\\<R>_rel (cms ! n)\"  and \\<R>i=\"\\<R>_rel (cms ! i)\" in modified_variables_are_not_assumed_not_written)\n                           apply(rule 2(6)[unfolded gc\\<^sub>A_def])\n                          using secure_refinements len secure_refinement_def apply blast\n                         apply(rule in_\\<R>n)\n                        using secure_refinements secure_refinement_def apply blast\n                       apply(rule in_\\<R>i)\n                      apply(rule len)\n                      using 2 apply simp\n                    using 2 apply simp\n                   using 2(7) unfolding modes_respect_priv_def priv_is_asm_priv_def gc\\<^sub>C_def \n                   using \"2.prems\"(3) apply auto[1]\n                  using 2(7) unfolding modes_respect_priv_def priv_is_guar_priv_def gc\\<^sub>C_def \n                  using \"2.prems\"(3) apply auto[1]\n                 using 2(7) unfolding modes_respect_priv_def new_asms_only_for_priv_def gc\\<^sub>C_def \n                 using \"2.prems\"(3) apply auto[1]\n                apply(rule eval\\<^sub>Cn)\n               apply(rule neval\\<^sub>An)\n              apply(rule in_\\<R>n'')\n             apply fastforce\n            apply assumption\n           apply assumption\n          apply(rule local_guarantee_preservation)\n          by simp\n      qed\n    qed\n  \n    have meval_sched\\<^sub>A: \"abs.meval_sched (replicate m\\<^sub>A n) gc\\<^sub>A (cms\\<^sub>A'', mem\\<^sub>A'')\"\n      apply(simp add: cms\\<^sub>A''_def)\n      apply(rule abs.neval_meval[OF _ _ HOL.refl HOL.refl])\n       apply(rule neval\\<^sub>An)\n      using \"2.prems\"(2) by auto\n  \n    have sound_mode_use\\<^sub>A'': \"abs.sound_mode_use (cms\\<^sub>A'', mem\\<^sub>A'')\"\n      apply(rule abs.meval_sched_sound_mode_use)\n       apply(rule 2(6))\n      by(rule meval_sched\\<^sub>A)\n   \n    have respects'': \"modes_respect_priv (map snd cms\\<^sub>C'')\"\n      apply(rule meval_modes_respect_priv[where gc\\<^sub>C'=\"(cms\\<^sub>C'',mem\\<^sub>C'')\", simplified])\n        apply(rule meval\\<^sub>C)\n       using \"2.prems\"(3) gc\\<^sub>C_def apply blast\n      using 2 by simp\n\n    from respects'' 2(1)[OF meval_sched\\<^sub>C, where gc\\<^sub>A7 = gc\\<^sub>A''] in_\\<R>'' sound_mode_use\\<^sub>A''\n    obtain sched\\<^sub>A gc\\<^sub>A' \n    where  meval_sched\\<^sub>A'': \"abs.meval_sched sched\\<^sub>A gc\\<^sub>A'' gc\\<^sub>A'\" and\n           in_\\<R>': \"(\\<forall>i<length cms. ((fst gc\\<^sub>A' ! i, snd gc\\<^sub>A'), fst gc\\<^sub>c' ! i, snd gc\\<^sub>c') \\<in> \\<R>_rel (cms ! i))\" and\n           sound_mode_use\\<^sub>A': \"abs.sound_mode_use  gc\\<^sub>A'\" by fastforce\n    define final_sched\\<^sub>A where \"final_sched\\<^sub>A = (replicate m\\<^sub>A n) @ sched\\<^sub>A\"\n    have meval_final_sched\\<^sub>A: \"abs.meval_sched final_sched\\<^sub>A gc\\<^sub>A gc\\<^sub>A'\"\n      using meval_sched\\<^sub>A'' meval_sched\\<^sub>A abs.meval_sched_app final_sched\\<^sub>A_def gc\\<^sub>A''_def by blast\n    \n    from meval_final_sched\\<^sub>A in_\\<R>' sound_mode_use\\<^sub>A'\n    show ?case by blast\n  qed\nqed\n\nend\n\ncontext sifum_security begin\n\ndefinition\n  restrict_modes :: \"'Var Mds list \\<Rightarrow> 'Var set \\<Rightarrow> 'Var Mds list\"\nwhere\n  \"restrict_modes mdss X \\<equiv> map (\\<lambda>mds m. mds m \\<inter> X) mdss\"\n\nlemma restrict_modes_length [simp]:\n  \"length (restrict_modes mdss X) = length mdss\"\n  by(auto simp: restrict_modes_def)\n  \nlemma compatible_modes_by_case_distinction:\n  assumes compat_X: \"compatible_modes (restrict_modes mdss X)\"\n  assumes compat_compX: \"compatible_modes (restrict_modes mdss (-X ))\"\n  shows \"compatible_modes mdss\"\nunfolding compatible_modes_def\nproof(safe)\n  fix i x j\n  assume ilen: \"i < length mdss\"\n  assume jlen: \"j < length mdss\"\n  assume neq: \"j \\<noteq> i\"\n  assume asm: \"x \\<in> (mdss ! i) AsmNoReadOrWrite\"\n  show \"x \\<in> (mdss ! j) GuarNoReadOrWrite\"\n  proof(cases \"x \\<in> X\")\n    assume xin: \"x \\<in> X\"\n    let ?mdss\\<^sub>X = \"restrict_modes mdss X\"\n    from asm xin have \"x \\<in> (?mdss\\<^sub>X ! i) AsmNoReadOrWrite\"\n      unfolding restrict_modes_def\n      using ilen by auto\n    \n    with compat_X jlen ilen neq \n    have \"x \\<in> (?mdss\\<^sub>X ! j) GuarNoReadOrWrite\"\n      unfolding compatible_modes_def\n      by auto\n    with xin jlen show ?thesis\n      unfolding restrict_modes_def by auto\n  next\n    assume xnin: \"x \\<notin> X\"\n    let ?mdss\\<^sub>X = \"restrict_modes mdss (- X)\"\n    from asm xnin have \"x \\<in> (?mdss\\<^sub>X ! i) AsmNoReadOrWrite\"\n      unfolding restrict_modes_def\n      using ilen by auto\n    \n    with compat_compX jlen ilen neq \n    have \"x \\<in> (?mdss\\<^sub>X ! j) GuarNoReadOrWrite\"\n      unfolding compatible_modes_def\n      by auto\n    with xnin jlen show ?thesis\n      unfolding restrict_modes_def by auto\n  qed\nnext\n  fix i x j\n  assume ilen: \"i < length mdss\"\n  assume jlen: \"j < length mdss\"\n  assume neq: \"j \\<noteq> i\"\n  assume asm: \"x \\<in> (mdss ! i) AsmNoWrite\"\n  show \"x \\<in> (mdss ! j) GuarNoWrite\"\n  proof(cases \"x \\<in> X\")\n    assume xin: \"x \\<in> X\"\n    let ?mdss\\<^sub>X = \"restrict_modes mdss X\"\n    from asm xin have \"x \\<in> (?mdss\\<^sub>X ! i) AsmNoWrite\"\n      unfolding restrict_modes_def\n      using ilen by auto\n    \n    with compat_X jlen ilen neq \n    have \"x \\<in> (?mdss\\<^sub>X ! j) GuarNoWrite\"\n      unfolding compatible_modes_def\n      by auto\n    with xin jlen show ?thesis\n      unfolding restrict_modes_def by auto\n  next\n    assume xnin: \"x \\<notin> X\"\n    let ?mdss\\<^sub>X = \"restrict_modes mdss (- X)\"\n    from asm xnin have \"x \\<in> (?mdss\\<^sub>X ! i) AsmNoWrite\"\n      unfolding restrict_modes_def\n      using ilen by auto\n    \n    with compat_compX jlen ilen neq \n    have \"x \\<in> (?mdss\\<^sub>X ! j) GuarNoWrite\"\n      unfolding compatible_modes_def\n      by auto\n    with xnin jlen show ?thesis\n      unfolding restrict_modes_def by auto\n  qed\nqed\n\nlemma in_restrict_modesD:\n  \"i < length mdss \\<Longrightarrow> x \\<in> ((restrict_modes mdss X) ! i) m \\<Longrightarrow> x \\<in> X \\<and> x \\<in> (mdss ! i) m\"\n  by(auto simp: restrict_modes_def)\n\nlemma in_restrict_modesI:\n  \"i < length mdss \\<Longrightarrow> x \\<in> X \\<Longrightarrow> x \\<in> (mdss ! i) m \\<Longrightarrow> x \\<in> ((restrict_modes mdss X) ! i) m \"\n  by(auto simp: restrict_modes_def)\n  \nlemma meval_sched_length:\n  \"meval_sched sched gc gc' \\<Longrightarrow> length (fst gc') = length (fst gc)\"\n  apply(induct sched arbitrary: gc gc')\n  by auto\n  \n  \nend\n\ncontext sifum_refinement_sys begin\n\nlemma compatible_modes_old_vars:\n  assumes compatible_modes\\<^sub>A: \"abs.compatible_modes (map snd cms\\<^sub>A)\" \n  assumes len\\<^sub>A: \"length cms\\<^sub>A = length cms\"\n  assumes len\\<^sub>C: \"length cms\\<^sub>C = length cms\"\n  assumes in_\\<R>: \"(\\<forall>i<length cms. ((cms\\<^sub>A ! i, mem\\<^sub>A), cms\\<^sub>C ! i, mem\\<^sub>C) \\<in> \\<R>_rel (cms ! i))\"\n  shows \"conc.compatible_modes (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of))\"\nunfolding conc.compatible_modes_def\nproof(clarsimp)\n  fix i x\n  assume i_len: \"i < length cms\\<^sub>C\"\n  let ?cms = \"cms ! i\" and\n      ?c\\<^sub>A = \"fst (cms\\<^sub>A ! i)\" and ?mds\\<^sub>A = \"snd (cms\\<^sub>A ! i)\" and\n      ?c\\<^sub>C = \"fst (cms\\<^sub>C ! i)\" and ?mds\\<^sub>C = \"snd (cms\\<^sub>C ! i)\"\n\n  from in_\\<R> i_len len\\<^sub>C\n  have in_\\<R>_i: \"((cms\\<^sub>A ! i, mem\\<^sub>A), cms\\<^sub>C ! i, mem\\<^sub>C) \\<in> \\<R>_rel ?cms\" by simp\n\n  from i_len have \"i < length (map snd cms\\<^sub>C)\" by simp\n  hence m_x_range: \"\\<And>m. x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! i) m \\<Longrightarrow> x \\<in> range var\\<^sub>C_of \\<and> x \\<in> (map snd cms\\<^sub>C ! i) m\"\n    using conc.in_restrict_modesD i_len by blast+\n  hence m_x\\<^sub>C_i: \"\\<And>m. x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! i) m \\<Longrightarrow> x \\<in> ?mds\\<^sub>C m\"\n    by (simp add: i_len)\n\n  from secure_refinements i_len len\\<^sub>C\n  have \"secure_refinement (\\<R>\\<^sub>A_rel ?cms) (\\<R>_rel ?cms) (P_rel ?cms)\" by simp\n  hence preserves_modes_mem_\\<R>_i: \"preserves_modes_mem (\\<R>_rel ?cms)\"\n    unfolding secure_refinement_def by simp\n\n  from in_\\<R>_i have \"(\\<langle>?c\\<^sub>A, ?mds\\<^sub>A, mem\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>?c\\<^sub>C, ?mds\\<^sub>C, mem\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>_rel ?cms\" by clarsimp\n  with preserves_modes_mem_\\<R>_i\n  have \"(\\<forall>x\\<^sub>A. mem\\<^sub>A x\\<^sub>A = mem\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)) \\<and> (\\<forall>m. var\\<^sub>C_of ` ?mds\\<^sub>A m = range var\\<^sub>C_of \\<inter> ?mds\\<^sub>C m)\"\n    unfolding preserves_modes_mem_def by blast\n  with m_x\\<^sub>C_i have m_x\\<^sub>A: \"\\<And>m. x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! i) m \\<Longrightarrow> var\\<^sub>A_of x \\<in> ?mds\\<^sub>A m\"\n    unfolding var\\<^sub>A_of_def using m_x_range inj_image_mem_iff var\\<^sub>C_of_inj by fastforce\n\n  show \"(x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! i) AsmNoReadOrWrite \\<longrightarrow>\n          (\\<forall>j<length cms\\<^sub>C. j \\<noteq> i \\<longrightarrow>\n            x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! j) GuarNoReadOrWrite)) \\<and>\n        (x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! i) AsmNoWrite \\<longrightarrow>\n          (\\<forall>j<length cms\\<^sub>C. j \\<noteq> i \\<longrightarrow>\n            x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! j) GuarNoWrite))\"\n    proof(safe)\n      fix j\n      assume AsmNoRW_x\\<^sub>C: \"x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! i) AsmNoReadOrWrite\" and\n        j_len: \"j < length cms\\<^sub>C\" and\n        j_not_i: \"j \\<noteq> i\"\n      let ?cms' = \"cms ! j\" and\n          ?c\\<^sub>A' = \"fst (cms\\<^sub>A ! j)\" and ?mds\\<^sub>A' = \"snd (cms\\<^sub>A ! j)\" and\n          ?c\\<^sub>C' = \"fst (cms\\<^sub>C ! j)\" and ?mds\\<^sub>C' = \"snd (cms\\<^sub>C ! j)\"\n\n      from AsmNoRW_x\\<^sub>C m_x_range\n      have x_range: \"x \\<in> range var\\<^sub>C_of\" by simp\n\n      from AsmNoRW_x\\<^sub>C m_x\\<^sub>A\n      have \"var\\<^sub>A_of x \\<in> ?mds\\<^sub>A AsmNoReadOrWrite\" by simp\n      with compatible_modes\\<^sub>A\n      have GuarNoRW_x\\<^sub>A: \"var\\<^sub>A_of x \\<in> ?mds\\<^sub>A' GuarNoReadOrWrite\"\n        unfolding abs.compatible_modes_def using i_len len\\<^sub>A len\\<^sub>C j_len j_not_i by clarsimp\n\n      from in_\\<R> j_len len\\<^sub>C\n      have in_\\<R>_j: \"((cms\\<^sub>A ! j, mem\\<^sub>A), cms\\<^sub>C ! j, mem\\<^sub>C) \\<in> \\<R>_rel ?cms'\" by simp\n\n      from j_len have j_len': \"j < length (map snd cms\\<^sub>C)\" by simp\n\n      from secure_refinements j_len len\\<^sub>C\n      have \"secure_refinement (\\<R>\\<^sub>A_rel ?cms') (\\<R>_rel ?cms') (P_rel ?cms')\" by simp\n      hence preserves_modes_mem_\\<R>_j: \"preserves_modes_mem (\\<R>_rel ?cms')\"\n        unfolding secure_refinement_def by simp\n\n      from in_\\<R>_j have \"(\\<langle>?c\\<^sub>A', ?mds\\<^sub>A', mem\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>?c\\<^sub>C', ?mds\\<^sub>C', mem\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>_rel ?cms'\" by clarsimp\n      with preserves_modes_mem_\\<R>_j\n      have \"(\\<forall>x\\<^sub>A. mem\\<^sub>A x\\<^sub>A = mem\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)) \\<and> (\\<forall>m. var\\<^sub>C_of ` ?mds\\<^sub>A' m = range var\\<^sub>C_of \\<inter> ?mds\\<^sub>C' m)\"\n        unfolding preserves_modes_mem_def by blast\n\n      with GuarNoRW_x\\<^sub>A j_len j_len' mds\\<^sub>A_of_def x_range conc.in_restrict_modesI var\\<^sub>C_of_inj\n      show \"x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! j) GuarNoReadOrWrite\"\n        unfolding var\\<^sub>A_of_def\n        by (metis (no_types, lifting) doesnt_have_mode f_inv_into_f image_inv_f_f nth_map)\n    next\n      (* This argument is identical to that for AsmNoReadOrWrite *)\n      fix j\n      assume AsmNoWrite_x\\<^sub>C: \"x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! i) AsmNoWrite\" and\n        j_len: \"j < length cms\\<^sub>C\" and\n        j_not_i: \"j \\<noteq> i\"\n      let ?cms' = \"cms ! j\" and\n          ?c\\<^sub>A' = \"fst (cms\\<^sub>A ! j)\" and ?mds\\<^sub>A' = \"snd (cms\\<^sub>A ! j)\" and\n          ?c\\<^sub>C' = \"fst (cms\\<^sub>C ! j)\" and ?mds\\<^sub>C' = \"snd (cms\\<^sub>C ! j)\"\n\n      from AsmNoWrite_x\\<^sub>C m_x_range\n      have x_range: \"x \\<in> range var\\<^sub>C_of\" by simp\n\n      from AsmNoWrite_x\\<^sub>C m_x\\<^sub>A\n      have \"var\\<^sub>A_of x \\<in> ?mds\\<^sub>A AsmNoWrite\" by simp\n      with compatible_modes\\<^sub>A\n      have GuarNoWrite_x\\<^sub>A: \"var\\<^sub>A_of x \\<in> ?mds\\<^sub>A' GuarNoWrite\"\n        unfolding abs.compatible_modes_def using i_len len\\<^sub>A len\\<^sub>C j_len j_not_i by clarsimp\n\n      from in_\\<R> j_len len\\<^sub>C\n      have in_\\<R>_j: \"((cms\\<^sub>A ! j, mem\\<^sub>A), cms\\<^sub>C ! j, mem\\<^sub>C) \\<in> \\<R>_rel ?cms'\" by simp\n\n      from j_len have j_len': \"j < length (map snd cms\\<^sub>C)\" by simp\n\n      from secure_refinements j_len len\\<^sub>C\n      have \"secure_refinement (\\<R>\\<^sub>A_rel ?cms') (\\<R>_rel ?cms') (P_rel ?cms')\" by simp\n      hence preserves_modes_mem_\\<R>_j: \"preserves_modes_mem (\\<R>_rel ?cms')\"\n        unfolding secure_refinement_def by simp\n\n      from in_\\<R>_j have \"(\\<langle>?c\\<^sub>A', ?mds\\<^sub>A', mem\\<^sub>A\\<rangle>\\<^sub>A, \\<langle>?c\\<^sub>C', ?mds\\<^sub>C', mem\\<^sub>C\\<rangle>\\<^sub>C) \\<in> \\<R>_rel ?cms'\" by clarsimp\n      with preserves_modes_mem_\\<R>_j\n      have \"(\\<forall>x\\<^sub>A. mem\\<^sub>A x\\<^sub>A = mem\\<^sub>C (var\\<^sub>C_of x\\<^sub>A)) \\<and> (\\<forall>m. var\\<^sub>C_of ` ?mds\\<^sub>A' m = range var\\<^sub>C_of \\<inter> ?mds\\<^sub>C' m)\"\n        unfolding preserves_modes_mem_def by blast\n\n      with GuarNoWrite_x\\<^sub>A j_len j_len' mds\\<^sub>A_of_def x_range conc.in_restrict_modesI var\\<^sub>C_of_inj\n      show \"x \\<in> (conc.restrict_modes (map snd cms\\<^sub>C) (range var\\<^sub>C_of) ! j) GuarNoWrite\"\n        unfolding var\\<^sub>A_of_def\n        by (metis (no_types, lifting) doesnt_have_mode f_inv_into_f image_inv_f_f nth_map)\n    qed\nqed\n\nlemma compatible_modes_new_vars:\n  \"length mdss = length cms \\<Longrightarrow> modes_respect_priv mdss \\<Longrightarrow> conc.compatible_modes (conc.restrict_modes mdss (- range var\\<^sub>C_of))\"\nunfolding conc.compatible_modes_def\nproof(safe)\n  let ?X = \"- range var\\<^sub>C_of\"\n  let ?mdss\\<^sub>X = \"conc.restrict_modes mdss ?X\"\n  assume respect: \"modes_respect_priv mdss\"\n  assume len_eq: \"length mdss = length cms\"\n  fix i x\\<^sub>C j\n  assume ilen: \"i < length ?mdss\\<^sub>X\"\n  assume jlen: \"j < length ?mdss\\<^sub>X\"\n  assume neq: \"j \\<noteq> i\"\n  assume asm\\<^sub>X: \"x\\<^sub>C \\<in> (?mdss\\<^sub>X ! i) AsmNoWrite\"\n  from conc.in_restrict_modesD ilen asm\\<^sub>X conc.restrict_modes_length have \n    xin: \"x\\<^sub>C \\<in> ?X\" and\n    asm: \"x\\<^sub>C \\<in> (mdss ! i) AsmNoWrite\" by metis+\n  from asm have \"False\"\n    using respect xin ilen conc.restrict_modes_length len_eq\n    unfolding modes_respect_priv_def new_asms_NoReadOrWrite_only_def\n    by force\n  thus \"x\\<^sub>C \\<in> (?mdss\\<^sub>X ! j) GuarNoWrite\" by blast\nnext\n  let ?X = \"- range var\\<^sub>C_of\"\n  let ?mdss\\<^sub>X = \"conc.restrict_modes mdss ?X\"\n  assume respect: \"modes_respect_priv mdss\"\n  assume len_eq: \"length mdss = length cms\"\n  fix i x\\<^sub>C j\n  assume ilen: \"i < length ?mdss\\<^sub>X\"\n  assume jlen: \"j < length ?mdss\\<^sub>X\"\n  assume neq: \"j \\<noteq> i\"\n  assume asm\\<^sub>X: \"x\\<^sub>C \\<in> (?mdss\\<^sub>X ! i) AsmNoReadOrWrite\"\n  from conc.in_restrict_modesD ilen asm\\<^sub>X conc.restrict_modes_length have \n    xin: \"x\\<^sub>C \\<in> ?X\" and\n    asm: \"x\\<^sub>C \\<in> (mdss ! i) AsmNoReadOrWrite\" by metis+\n  from respect asm xin ilen conc.restrict_modes_length len_eq have\n    \"x\\<^sub>C \\<in> priv_mem\\<^sub>C ! i\"\n    unfolding modes_respect_priv_def new_asms_only_for_priv_def\n    by force\n  with respect ilen jlen neq conc.restrict_modes_length len_eq have\n    \"x\\<^sub>C \\<in> (mdss ! j) GuarNoReadOrWrite\"\n    unfolding modes_respect_priv_def priv_is_guar_priv_def\n    by force\n  with jlen xin conc.in_restrict_modesI show\n    \"x\\<^sub>C \\<in> (?mdss\\<^sub>X ! j) GuarNoReadOrWrite\" by force\nqed\n\n    \nlemma sound_mode_use_preservation:\n  \"\\<And>gc\\<^sub>C gc\\<^sub>A. \n    length (fst gc\\<^sub>A) = length cms \\<Longrightarrow> length (fst gc\\<^sub>C) = length cms  \\<Longrightarrow>\n    (\\<And>i. i < length cms \\<Longrightarrow> ((fst gc\\<^sub>A ! i, snd gc\\<^sub>A), (fst gc\\<^sub>C ! i, snd gc\\<^sub>C)) \\<in> \\<R>_rel (cms ! i)) \\<Longrightarrow>\n    abs.sound_mode_use gc\\<^sub>A \\<Longrightarrow> modes_respect_priv (map snd (fst gc\\<^sub>C)) \\<Longrightarrow>\n    conc.sound_mode_use gc\\<^sub>C\"\nproof -\n  fix gc\\<^sub>C gc\\<^sub>A\n  assume len_eq [simp]: \"length (fst gc\\<^sub>A) = length cms\"\n     and len_eq'[simp]: \"length (fst gc\\<^sub>C) = length cms\"\n     and in_\\<R>: \"(\\<And>i. i < length cms \\<Longrightarrow> ((fst gc\\<^sub>A ! i, snd gc\\<^sub>A), (fst gc\\<^sub>C ! i, snd gc\\<^sub>C)) \\<in> \\<R>_rel (cms ! i))\"\n     and sound_mode_use\\<^sub>A: \"abs.sound_mode_use gc\\<^sub>A\"\n     and modes_respect_priv: \"modes_respect_priv (map snd (fst gc\\<^sub>C))\"\n  have \"conc.globally_sound_mode_use gc\\<^sub>C\"\n  unfolding conc.globally_sound_mode_use_def\n  proof(clarsimp)\n    fix mdss\\<^sub>C'\n    assume in_reachable_modes: \"mdss\\<^sub>C' \\<in> conc.reachable_mode_states gc\\<^sub>C\"\n    from this obtain cms\\<^sub>C' mem\\<^sub>C' sched\\<^sub>C where\n      meval_sched\\<^sub>C: \"conc.meval_sched sched\\<^sub>C gc\\<^sub>C (cms\\<^sub>C', mem\\<^sub>C')\" and\n      mdss\\<^sub>C'_def: \"mdss\\<^sub>C' = map snd cms\\<^sub>C'\"\n      unfolding conc.reachable_mode_states_def by blast\n    from traces_refinement[OF meval_sched\\<^sub>C, OF len_eq len_eq' in_\\<R> sound_mode_use\\<^sub>A modes_respect_priv] \n    obtain sched\\<^sub>A gc\\<^sub>A' cms\\<^sub>A' mem\\<^sub>A' where gc\\<^sub>A'_def [simp]: \"gc\\<^sub>A' = (cms\\<^sub>A', mem\\<^sub>A')\"  and\n      meval_sched\\<^sub>A: \"abs.meval_sched sched\\<^sub>A gc\\<^sub>A gc\\<^sub>A'\" and\n      in_\\<R>: \"(\\<forall>i<length cms.\n              ((cms\\<^sub>A' ! i, mem\\<^sub>A'), cms\\<^sub>C' ! i, mem\\<^sub>C') \\<in> \\<R>_rel (cms ! i))\"\n      and sound_mode_use\\<^sub>A': \"abs.sound_mode_use gc\\<^sub>A'\"\n        by fastforce\n    let ?mdss\\<^sub>A' = \"map snd cms\\<^sub>A'\"\n    have \"?mdss\\<^sub>A' \\<in> abs.reachable_mode_states gc\\<^sub>A\"\n      unfolding abs.reachable_mode_states_def\n      using meval_sched\\<^sub>A by fastforce\n    hence compatible_modes\\<^sub>A': \"abs.compatible_modes ?mdss\\<^sub>A'\"\n      using sound_mode_use\\<^sub>A unfolding abs.sound_mode_use_def abs.globally_sound_mode_use_def\n      by fastforce\n    let ?X = \"range var\\<^sub>C_of\"\n    show \"conc.compatible_modes mdss\\<^sub>C'\"\n    proof(rule conc.compatible_modes_by_case_distinction[where X=\"?X\"])\n      show \"conc.compatible_modes (conc.restrict_modes mdss\\<^sub>C' ?X)\"\n        apply(simp add: mdss\\<^sub>C'_def)\n        apply(rule compatible_modes_old_vars[OF _ _ _ in_\\<R>])\n          apply(rule compatible_modes\\<^sub>A')\n         using len_eq abs.meval_sched_length[OF meval_sched\\<^sub>A] gc\\<^sub>A'_def apply simp\n        using len_eq' conc.meval_sched_length[OF meval_sched\\<^sub>C] by simp\n    next\n      show \"conc.compatible_modes (conc.restrict_modes mdss\\<^sub>C' (- ?X))\"\n        apply(rule compatible_modes_new_vars)\n         using len_eq' conc.meval_sched_length[OF meval_sched\\<^sub>C] mdss\\<^sub>C'_def apply simp\n        apply(simp add: mdss\\<^sub>C'_def)\n        apply(rule meval_sched_modes_respect_priv[OF meval_sched\\<^sub>C, simplified])\n        using modes_respect_priv by simp\n    qed\n  qed\n  \n  moreover have \"list_all (\\<lambda> cm. conc.locally_sound_mode_use (cm, (snd gc\\<^sub>C))) (fst gc\\<^sub>C)\"\n  unfolding list_all_length\n  proof(clarify)\n    fix i\n    assume \"i < length (fst gc\\<^sub>C)\"\n    hence len: \"i < length cms\" by simp\n    have preserves: \"preserves_locally_sound_mode_use (\\<R>_rel (cms ! i))\"\n      apply(rule locally_sound_mode_use_preservation)\n       using secure_refinements len apply blast\n      using local_guarantee_preservation len by blast\n    have \"abs.locally_sound_mode_use (fst gc\\<^sub>A ! i, snd gc\\<^sub>A)\"\n      using sound_mode_use\\<^sub>A \\<open>i < length cms\\<close> len_eq\n      unfolding abs.sound_mode_use_def list_all_length\n      by (simp add: case_prod_unfold)\n    \n    from this in_\\<R>[OF len] preserves[unfolded preserves_locally_sound_mode_use_def]\n    show \"conc.locally_sound_mode_use (fst gc\\<^sub>C ! i, snd gc\\<^sub>C)\"\n      by blast\n  qed\n      \n  ultimately show \"?thesis gc\\<^sub>C gc\\<^sub>A\" unfolding conc.sound_mode_use_def \n  by (simp add: case_prod_unfold)\nqed     \n      \nlemma refined_prog_secure:\n  assumes len\\<^sub>A [simp]: \"length cms\\<^sub>C = length cms\"\n  assumes len\\<^sub>C [simp]: \"length cms\\<^sub>A = length cms\"\n  assumes in_\\<R>: \"(\\<And>i mem\\<^sub>C. i < length cms \\<Longrightarrow>  ((cms\\<^sub>A ! i,mem\\<^sub>A_of mem\\<^sub>C),(cms\\<^sub>C ! i, mem\\<^sub>C)) \\<in> \\<R>_rel (cms ! i))\"\n  assumes in_\\<R>\\<^sub>A: \"(\\<And>i mem\\<^sub>C mem\\<^sub>C'. \\<lbrakk>i < length cms; conc.low_mds_eq (snd (cms\\<^sub>C ! i)) mem\\<^sub>C mem\\<^sub>C'\\<rbrakk>\n       \\<Longrightarrow> ((cms\\<^sub>A ! i, mem\\<^sub>A_of mem\\<^sub>C), (cms\\<^sub>A ! i, mem\\<^sub>A_of mem\\<^sub>C')) \\<in> \\<R>\\<^sub>A_rel (cms ! i))\"\n  assumes sound_mode_use\\<^sub>A: \"(\\<And> mem\\<^sub>A.  abs.sound_mode_use (cms\\<^sub>A, mem\\<^sub>A))\"\n  assumes modes_respect_priv: \"modes_respect_priv (map snd cms\\<^sub>C)\"\n  shows \"conc.prog_sifum_secure_cont cms\\<^sub>C\"\n  apply(rule conc.sifum_compositionality_cont)\n   apply(clarsimp simp: list_all_length)\n   apply(clarsimp simp: conc.com_sifum_secure_def conc.low_indistinguishable_def)\n   apply(rule conc.mm_equiv.intros)\n    apply(rule R\\<^sub>C_of_strong_low_bisim_mm)\n      apply(fastforce intro: bisims)\n     apply(fastforce intro: secure_refinements)\n    apply(fastforce simp: Ps_sym)\n   apply(clarsimp simp: R\\<^sub>C_of_def)\n   apply(rename_tac i c\\<^sub>C mds\\<^sub>C mem\\<^sub>C mem\\<^sub>C')\n   apply(rule_tac x=\"fst (cms\\<^sub>A ! i)\" in exI)\n   apply(rule_tac x=\"snd (cms\\<^sub>A ! i)\" in exI)\n   apply(rule_tac x=\"mem\\<^sub>A_of mem\\<^sub>C\" in exI)\n   apply(rule conjI)\n    using in_\\<R> apply fastforce\n   apply(rule_tac x=\"fst (cms\\<^sub>A ! i)\" in exI)\n   apply(rule_tac x=\"snd (cms\\<^sub>A ! i)\" in exI)\n   apply(rule_tac x=\"mem\\<^sub>A_of mem\\<^sub>C'\" in exI)\n   apply(rule conjI)\n    using in_\\<R> apply fastforce\n   apply(fastforce simp: in_\\<R>\\<^sub>A Ps_refl_on_low_mds_eq)\n  apply(clarify)\n  apply(rename_tac mem\\<^sub>C)\n  apply(rule_tac gc\\<^sub>A=\"(cms\\<^sub>A,mem\\<^sub>A_of mem\\<^sub>C)\" in sound_mode_use_preservation)\n      apply simp\n     apply simp\n    using in_\\<R> apply fastforce\n   apply(rule sound_mode_use\\<^sub>A)\n  apply clarsimp\n  by(rule modes_respect_priv)\n\nlemma refined_prog_secure':\n  assumes len\\<^sub>A [simp]: \"length cms\\<^sub>C = length cms\"\n  assumes len\\<^sub>C [simp]: \"length cms\\<^sub>A = length cms\"\n  assumes in_\\<R>: \"(\\<And>i mem\\<^sub>C. i < length cms \\<Longrightarrow> ((cms\\<^sub>A ! i,mem\\<^sub>A_of mem\\<^sub>C),(cms\\<^sub>C ! i, mem\\<^sub>C)) \\<in> \\<R>_rel (cms ! i))\"\n  assumes in_\\<R>\\<^sub>A: \"(\\<And>i mem\\<^sub>A mem\\<^sub>A'. \\<lbrakk>i < length cms;  abs.low_mds_eq (snd (cms\\<^sub>A ! i)) mem\\<^sub>A mem\\<^sub>A'\\<rbrakk>\n       \\<Longrightarrow> ((cms\\<^sub>A ! i, mem\\<^sub>A), (cms\\<^sub>A ! i, mem\\<^sub>A')) \\<in> \\<R>\\<^sub>A_rel (cms ! i))\"\n  assumes sound_mode_use\\<^sub>A: \"(\\<And> mem\\<^sub>A.  abs.sound_mode_use (cms\\<^sub>A, mem\\<^sub>A))\"\n  assumes modes_respect_priv: \"modes_respect_priv (map snd cms\\<^sub>C)\"\n  shows \"conc.prog_sifum_secure_cont cms\\<^sub>C\"\n  apply(rule refined_prog_secure)\n       apply(rule len\\<^sub>A)\n      apply(rule len\\<^sub>C)\n     apply(blast intro: in_\\<R>)\n    apply(rule in_\\<R>\\<^sub>A)\n     apply assumption\n    apply(subgoal_tac \"snd (cms\\<^sub>A ! i) = mds\\<^sub>A_of (snd (cms\\<^sub>C ! i))\")\n     using low_mds_eq_from_conc_to_abs apply fastforce\n    apply(rule_tac \\<R>1=\"\\<R>_rel (cms ! i)\" and c\\<^sub>A1=\"fst (cms\\<^sub>A ! i)\" and c\\<^sub>C1=\"fst (cms\\<^sub>C ! i)\" in preserves_modes_memD[THEN conjunct2])\n     using secure_refinements unfolding secure_refinement_def apply fast\n    apply clarsimp\n    using in_\\<R> apply fastforce\n   apply(blast intro: sound_mode_use\\<^sub>A)\n  by(rule modes_respect_priv)\n    \nend\n  \ncontext sifum_security begin\n\ndefinition\n  reachable_mems :: \"('Com \\<times> (Mode \\<Rightarrow> 'Var set)) list \\<Rightarrow> ('Var,'Val) Mem \\<Rightarrow> ('Var,'Val) Mem set\"\nwhere\n  \"reachable_mems cms mem \\<equiv> {mem'. \\<exists>sched cms'. meval_sched sched (cms,mem) (cms',mem')}\"\n\nlemma reachable_mems_refl:\n  \"mem \\<in> reachable_mems cms mem\"\n  apply(clarsimp simp: reachable_mems_def)\n  apply(rule_tac x=\"[]\" in exI)\n  apply fastforce\n  done\n  \nend\n\ncontext sifum_refinement_sys begin\n\nlemma reachable_mems_refinement:\n  assumes sys_nonempty: \"length cms > 0\"\n  assumes len\\<^sub>A [simp]: \"length cms\\<^sub>C = length cms\"\n  assumes len\\<^sub>C [simp]: \"length cms\\<^sub>A = length cms\"\n  assumes in_\\<R>: \"(\\<And>i mem\\<^sub>C. i < length cms \\<Longrightarrow> ((cms\\<^sub>A ! i,mem\\<^sub>A_of mem\\<^sub>C),(cms\\<^sub>C ! i, mem\\<^sub>C)) \\<in> \\<R>_rel (cms ! i))\"\n  assumes sound_mode_use\\<^sub>A: \"(\\<And> mem\\<^sub>A. abs.sound_mode_use (cms\\<^sub>A, mem\\<^sub>A))\"\n  assumes modes_respect_priv: \"modes_respect_priv (map snd cms\\<^sub>C)\"\n  assumes reachable\\<^sub>C: \"mem\\<^sub>C' \\<in> conc.reachable_mems cms\\<^sub>C mem\\<^sub>C\"\n  shows \"mem\\<^sub>A_of mem\\<^sub>C' \\<in> abs.reachable_mems cms\\<^sub>A (mem\\<^sub>A_of mem\\<^sub>C)\"\nproof -\n  from reachable\\<^sub>C obtain sched\\<^sub>C cms\\<^sub>C' where\n    meval_sched\\<^sub>C: \"conc.meval_sched sched\\<^sub>C (cms\\<^sub>C, mem\\<^sub>C) (cms\\<^sub>C', mem\\<^sub>C')\"\n    by (fastforce simp: conc.reachable_mems_def)\n  \n  let ?mem\\<^sub>A = \"mem\\<^sub>A_of mem\\<^sub>C\"\n  \n  have sound_mode_use\\<^sub>A: \"abs.sound_mode_use (cms\\<^sub>A, ?mem\\<^sub>A)\"  \n    by(rule sound_mode_use\\<^sub>A)\n\n  from traces_refinement[where gc\\<^sub>A=\"(cms\\<^sub>A,?mem\\<^sub>A)\", OF meval_sched\\<^sub>C, OF _ _ _ sound_mode_use\\<^sub>A]\n       in_\\<R>[of _ mem\\<^sub>C]\n       modes_respect_priv\n  obtain sched\\<^sub>A cms\\<^sub>A' mem\\<^sub>A' where\n    meval_sched\\<^sub>A: \"abs.meval_sched sched\\<^sub>A (cms\\<^sub>A, ?mem\\<^sub>A) (cms\\<^sub>A', mem\\<^sub>A')\" and\n    in_\\<R>': \"(\\<forall>i<length cms.\n               ((cms\\<^sub>A' ! i, mem\\<^sub>A'), cms\\<^sub>C' ! i, mem\\<^sub>C') \\<in> \\<R>_rel (cms ! i))\"\n    by fastforce\n  hence reachable\\<^sub>A: \"mem\\<^sub>A' \\<in> abs.reachable_mems cms\\<^sub>A ?mem\\<^sub>A\"\n    by(fastforce simp: abs.reachable_mems_def)\n  from sys_nonempty obtain i where ilen: \"i < length cms\" by blast\n  let ?\\<R>i = \"\\<R>_rel (cms ! i)\"\n  from ilen secure_refinements have \"preserves_modes_mem ?\\<R>i\"\n    unfolding secure_refinement_def by blast\n  from ilen in_\\<R>' preserves_modes_memD[OF this] have\n    mem\\<^sub>A'_def: \"mem\\<^sub>A' = mem\\<^sub>A_of mem\\<^sub>C'\"\n    by(metis surjective_pairing)\n  with reachable\\<^sub>A show ?thesis by simp\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Dependent_SIFUM_Refinement/CompositionalRefinement.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3422771357906906}}
{"text": "theory CardArityTransformSafe\nimports ArityTransform CardinalityAnalysisSpec AbstractTransform Sestoft SestoftGC ArityEtaExpansionSafe ArityAnalysisStack  ArityConsistent\nbegin\n\ncontext CardinalityPrognosisSafe\nbegin\n  sublocale AbstractTransformBoundSubst\n    \"\\<lambda> a . inc\\<cdot>a\"\n    \"\\<lambda> a . pred\\<cdot>a\"\n    \"\\<lambda> \\<Delta> e a . (a, Aheap \\<Delta> e\\<cdot>a)\"\n    \"fst\"\n    \"snd\"\n    \"\\<lambda> _. 0\"\n    \"Aeta_expand\"\n    \"snd\"\n  apply standard\n  apply (simp add: Aheap_subst)\n  apply (rule subst_Aeta_expand)\n  done\n\n  abbreviation ccTransform where \"ccTransform \\<equiv> transform\"\n\n  lemma supp_transform: \"supp (transform a e) \\<subseteq> supp e\"\n    by (induction rule: transform.induct)\n       (auto simp add: exp_assn.supp Let_supp dest!: set_mp[OF supp_map_transform] set_mp[OF supp_map_transform_step] )\n  interpretation supp_bounded_transform transform\n    by standard (auto simp add: fresh_def supp_transform) \n\n  type_synonym tstate = \"(AEnv \\<times> (var \\<Rightarrow> two) \\<times> Arity \\<times> Arity list \\<times> var list)\"\n\n  fun transform_alts :: \"Arity list \\<Rightarrow> stack \\<Rightarrow> stack\"\n    where \n      \"transform_alts _ [] = []\"\n    | \"transform_alts (a#as) (Alts e1 e2 # S) = (Alts (ccTransform a e1) (ccTransform a e2)) # transform_alts as S\"\n    | \"transform_alts as (x # S) = x # transform_alts as S\"\n\n  lemma transform_alts_Nil[simp]: \"transform_alts [] S = S\"\n    by (induction  S) auto\n\n  lemma Astack_transform_alts[simp]:\n    \"Astack (transform_alts as S) = Astack S\"\n   by (induction rule: transform_alts.induct) auto\n\n  lemma fresh_star_transform_alts[intro]: \"a \\<sharp>* S \\<Longrightarrow> a \\<sharp>* transform_alts as S\"\n   by (induction as S  rule: transform_alts.induct) (auto simp add: fresh_star_Cons)\n\n  fun a_transform :: \"astate \\<Rightarrow> conf \\<Rightarrow> conf\"\n  where \"a_transform (ae, a, as) (\\<Gamma>, e, S) =\n    (map_transform Aeta_expand ae (map_transform ccTransform ae \\<Gamma>), \n     ccTransform a e,\n     transform_alts as  S)\"\n\n  fun restr_conf :: \"var set \\<Rightarrow> conf \\<Rightarrow> conf\"\n    where \"restr_conf V (\\<Gamma>, e, S) = (restrictA V \\<Gamma>, e, restr_stack V S)\"\n\n  fun add_dummies_conf :: \"var list \\<Rightarrow> conf \\<Rightarrow> conf\"\n    where \"add_dummies_conf l (\\<Gamma>, e, S) = (\\<Gamma>, e, S @ map Dummy (rev l))\"\n\n  fun conf_transform :: \"tstate \\<Rightarrow> conf \\<Rightarrow> conf\"\n  where \"conf_transform (ae, ce, a, as, r) c = add_dummies_conf r ((a_transform (ae, a, as) (restr_conf (- set r) c)))\"\n\n  inductive consistent :: \"tstate \\<Rightarrow> conf \\<Rightarrow> bool\" where\n    consistentI[intro!]: \n    \"a_consistent (ae, a, as) (restr_conf (- set r) (\\<Gamma>, e, S))\n    \\<Longrightarrow> edom ae = edom ce\n    \\<Longrightarrow> prognosis ae as a (\\<Gamma>, e, S) \\<sqsubseteq> ce\n    \\<Longrightarrow> (\\<And> x. x \\<in> thunks \\<Gamma> \\<Longrightarrow> many \\<sqsubseteq> ce x \\<Longrightarrow> ae x = up\\<cdot>0)\n    \\<Longrightarrow> set r \\<subseteq> (domA \\<Gamma> \\<union> upds S) - edom ce\n    \\<Longrightarrow> consistent (ae, ce, a, as, r) (\\<Gamma>, e, S)\"  \n  inductive_cases consistentE[elim!]: \"consistent (ae, ce, a, as) (\\<Gamma>, e, S)\"\n\n  lemma closed_consistent:\n    assumes \"fv e = ({}::var set)\"\n    shows \"consistent (\\<bottom>, \\<bottom>, 0, [], []) ([], e, [])\"\n  proof-\n    from assms\n    have \"edom (prognosis \\<bottom> [] 0 ([], e, [])) = {}\"\n     by (auto dest!: set_mp[OF edom_prognosis])\n    thus ?thesis\n      by (auto simp add: edom_empty_iff_bot closed_a_consistent[OF assms])\n  qed\n\n  lemma card_arity_transform_safe:\n    fixes c c'\n    assumes \"c \\<Rightarrow>\\<^sup>* c'\" and \"\\<not> boring_step c'\" and \"heap_upds_ok_conf c\" and \"consistent (ae,ce,a,as,r) c\"\n    shows \"\\<exists>ae' ce' a' as' r'. consistent (ae',ce',a',as',r') c' \\<and> conf_transform (ae,ce,a,as,r) c \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae',ce',a',as',r') c'\"\n  using assms(1,2) heap_upds_ok_invariant assms(3-)\n  proof(induction c c' arbitrary: ae ce a as r rule:step_invariant_induction)\n  case (app\\<^sub>1 \\<Gamma> e x S)\n    have \"prognosis ae as (inc\\<cdot>a) (\\<Gamma>, e, Arg x # S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, App e x, S)\" by (rule prognosis_App)\n    with app\\<^sub>1 have \"consistent (ae, ce, inc\\<cdot>a, as, r) (\\<Gamma>, e, Arg x # S)\"\n      by (auto intro: a_consistent_app\\<^sub>1 elim: below_trans)\n    moreover\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, App e x, S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, inc\\<cdot>a, as, r) (\\<Gamma>, e, Arg x # S)\"\n      by simp rule\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n  case (app\\<^sub>2 \\<Gamma> y e x S)\n    have \"prognosis ae as (pred\\<cdot>a) (\\<Gamma>, e[y::=x], S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, (Lam [y]. e), Arg x # S)\"\n       by (rule prognosis_subst_Lam)\n    then\n    have \"consistent (ae, ce, pred\\<cdot>a, as, r) (\\<Gamma>, e[y::=x], S)\" using app\\<^sub>2\n      by (auto 4 3 intro: a_consistent_app\\<^sub>2 elim: below_trans)\n    moreover\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Lam [y]. e, Arg x # S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, pred \\<cdot> a, as, r) (\\<Gamma>, e[y::=x], S)\" by (simp add: subst_transform[symmetric]) rule\n    ultimately\n    show ?case by (blast  del: consistentI consistentE)\n  next\n  case (thunk \\<Gamma> x e S)\n    hence \"x \\<in> thunks \\<Gamma>\" by auto\n    hence [simp]: \"x \\<in> domA \\<Gamma>\" by (rule set_mp[OF thunks_domA])\n\n    from thunk have \"prognosis ae as a (\\<Gamma>, Var x, S) \\<sqsubseteq> ce\" by auto\n    from below_trans[OF prognosis_called fun_belowD[OF this] ]\n    have [simp]: \"x \\<in> edom ce\" by (auto simp add: edom_def)\n    hence [simp]: \"x \\<notin> set r\" using thunk by auto\n\n    from `heap_upds_ok_conf (\\<Gamma>, Var x, S)`\n    have \"x \\<notin> upds S\" by (auto dest!:  heap_upds_okE)\n\n    have \"x \\<in> edom ae\" using thunk by auto\n    then obtain u where \"ae x = up\\<cdot>u\" by (cases \"ae x\") (auto simp add: edom_def)\n  \n\n    show ?case\n    proof(cases \"ce x\" rule:two_cases)\n      case none\n      with `x \\<in> edom ce` have False by (auto simp add: edom_def)\n      thus ?thesis..\n    next\n      case once\n\n      from `prognosis ae as a (\\<Gamma>, Var x, S) \\<sqsubseteq> ce`\n      have \"prognosis ae as a (\\<Gamma>, Var x, S) x \\<sqsubseteq> once\"\n        using once by (metis (mono_tags) fun_belowD)\n      hence \"x \\<notin> ap S\" using prognosis_ap[of ae as a \\<Gamma> \"(Var x)\" S] by auto\n      \n  \n      from `map_of \\<Gamma> x = Some e` `ae x = up\\<cdot>u` `\\<not> isVal e`\n      have *: \"prognosis ae as u (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> record_call x \\<cdot> (prognosis ae as a (\\<Gamma>, Var x, S))\"\n        by (rule prognosis_Var_thunk)\n  \n      from `prognosis ae as a (\\<Gamma>, Var x, S) x \\<sqsubseteq> once`\n      have \"(record_call x \\<cdot> (prognosis ae as a (\\<Gamma>, Var x, S))) x = none\"\n        by (simp add: two_pred_none)\n      hence **: \"prognosis ae as u (delete x \\<Gamma>, e, Upd x # S) x = none\" using fun_belowD[OF *, where x = x] by auto\n\n      have eq: \"prognosis (env_delete x ae) as u (delete x \\<Gamma>, e, Upd x # S) = prognosis ae as u (delete x \\<Gamma>, e, Upd x # S)\"\n        by (rule prognosis_env_cong) simp\n\n      have [simp]: \"restr_stack (- set r - {x}) S = restr_stack (- set r) S\"\n        using `x \\<notin> upds S` by (auto intro: restr_stack_cong)\n    \n      have \"prognosis (env_delete x ae) as u (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> env_delete x ce\"\n        unfolding eq\n        using ** below_trans[OF below_trans[OF * Cfun.monofun_cfun_arg[OF `prognosis ae as a (\\<Gamma>, Var x, S) \\<sqsubseteq> ce`]] record_call_below_arg]\n        by (rule below_env_deleteI)\n      moreover\n\n      have *: \"a_consistent (env_delete x ae, u, as) (delete x (restrictA (- set r) \\<Gamma>), e, restr_stack (- set r) S)\"\n        using thunk `ae x = up\\<cdot>u`\n        by (auto intro!: a_consistent_thunk_once simp del: restr_delete)\n      ultimately\n\n      have \"consistent (env_delete x ae, env_delete x ce, u, as, x # r) (delete x \\<Gamma>, e, Upd x # S)\" using thunk\n        by (auto simp add: restr_delete_twist Compl_insert elim:below_trans )\n      moreover\n\n      from *\n      have **: \"Astack (transform_alts as (restr_stack (- set r) S) @ map Dummy (rev r) @ [Dummy x]) \\<sqsubseteq> u\" by (auto elim: a_consistent_stackD)\n      \n      {\n      from  `map_of \\<Gamma> x = Some e` `ae x = up\\<cdot>u` once\n      have \"map_of (map_transform Aeta_expand ae (map_transform ccTransform ae (restrictA (- set r) \\<Gamma>))) x = Some (Aeta_expand u (transform u e))\"\n        by (simp add: map_of_map_transform)\n      hence \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sub>G\n             add_dummies_conf r (delete x (map_transform Aeta_expand ae (map_transform ccTransform ae (restrictA (- set r) \\<Gamma>))), Aeta_expand u (ccTransform u e), Upd x # transform_alts as (restr_stack (- set r) S))\"\n          by (auto simp add:  map_transform_delete delete_map_transform_env_delete insert_absorb restr_delete_twist simp del: restr_delete)\n      also\n      have \"\\<dots> \\<Rightarrow>\\<^sub>G\\<^sup>* add_dummies_conf (x # r) (delete x (map_transform Aeta_expand ae (map_transform ccTransform ae (restrictA (- set r) \\<Gamma>))), Aeta_expand u (ccTransform u e), transform_alts as (restr_stack (- set r) S))\"\n        apply (rule r_into_rtranclp)\n        apply (simp add: append_assoc[symmetric] del: append_assoc)\n        apply (rule dropUpd)\n        done\n      also\n      have \"\\<dots> \\<Rightarrow>\\<^sub>G\\<^sup>* add_dummies_conf (x # r) (delete x (map_transform Aeta_expand ae (map_transform ccTransform ae  (restrictA (- set r) \\<Gamma>))), ccTransform u e, transform_alts as (restr_stack (- set r) S))\"\n        by simp (intro  normal_trans Aeta_expand_safe **)\n      also(rtranclp_trans)\n      have \"\\<dots> = conf_transform (env_delete x ae, env_delete x ce, u, as, x # r) (delete x \\<Gamma>, e, Upd x # S)\" \n        by (auto intro!: map_transform_cong simp add:  map_transform_delete[symmetric]  restr_delete_twist Compl_insert)\n      finally(back_subst)\n      have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (env_delete x ae, env_delete x ce, u, as, x # r) (delete x \\<Gamma>, e, Upd x # S)\".\n      }\n      ultimately\n      show ?thesis by (blast del: consistentI consistentE)\n  \n    next\n      case many\n  \n      from `map_of \\<Gamma> x = Some e` `ae x = up\\<cdot>u` `\\<not> isVal e`\n      have \"prognosis ae as u (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> record_call x \\<cdot> (prognosis ae as a (\\<Gamma>, Var x, S))\"\n        by (rule prognosis_Var_thunk)\n      also note record_call_below_arg\n      finally\n      have *: \"prognosis ae as u (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, Var x, S)\" by this simp_all\n  \n      have \"ae x = up\\<cdot>0\" using thunk many `x \\<in> thunks \\<Gamma>` by (auto)\n      hence \"u = 0\" using `ae x = up\\<cdot>u` by simp\n  \n      \n      have \"prognosis ae as 0 (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> ce\" using *[unfolded `u=0`] thunk by (auto elim: below_trans)\n      moreover\n      have \"a_consistent (ae, 0, as) (delete x (restrictA (- set r) \\<Gamma>), e, Upd x # restr_stack (- set r) S)\" using thunk `ae x = up\\<cdot>0`\n        by (auto intro!: a_consistent_thunk_0 simp del: restr_delete)\n      ultimately\n      have \"consistent (ae, ce, 0, as, r) (delete x \\<Gamma>, e, Upd x # S)\" using thunk `ae x = up\\<cdot>u` `u = 0`\n        by (auto simp add:  restr_delete_twist)\n      moreover\n  \n      from  `map_of \\<Gamma> x = Some e` `ae x = up\\<cdot>0` many\n      have \"map_of (map_transform Aeta_expand ae (map_transform ccTransform ae (restrictA (- set r) \\<Gamma>))) x = Some (transform 0 e)\"\n        by (simp add: map_of_map_transform)\n      with `\\<not> isVal e`\n      have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, 0, as, r) (delete x \\<Gamma>, e, Upd x # S)\"\n        by (auto intro: gc_step.intros simp add: map_transform_delete restr_delete_twist intro!: step.intros  simp del: restr_delete)\n      ultimately\n      show ?thesis by (blast del: consistentI consistentE)\n    qed\n  next\n  case (lamvar \\<Gamma> x e S)\n    from lamvar(1) have [simp]: \"x \\<in> domA \\<Gamma>\" by (metis domI dom_map_of_conv_domA)\n\n    from lamvar have \"prognosis ae as a (\\<Gamma>, Var x, S) \\<sqsubseteq> ce\" by auto\n    from below_trans[OF prognosis_called fun_belowD[OF this] ]\n    have [simp]: \"x \\<in> edom ce\" by (auto simp add: edom_def)\n    then obtain c where \"ce x = up\\<cdot>c\" by (cases \"ce x\") (auto simp add: edom_def)\n\n    from lamvar\n    have [simp]: \"x \\<notin> set r\" by auto\n\n    then have \"x \\<in> edom ae\" using lamvar by auto\n    then obtain  u where \"ae x = up\\<cdot>u\"  by (cases \"ae x\") (auto simp add: edom_def)\n\n\n    have \"prognosis ae as u ((x, e) # delete x \\<Gamma>, e, S) = prognosis ae as u (\\<Gamma>, e, S)\"\n      using `map_of \\<Gamma> x = Some e` by (auto intro!: prognosis_reorder)\n    also have \"\\<dots> \\<sqsubseteq> record_call x \\<cdot> (prognosis ae as a (\\<Gamma>, Var x, S))\"\n       using `map_of \\<Gamma> x = Some e` `ae x = up\\<cdot>u` `isVal e`  by (rule prognosis_Var_lam)\n    also have \"\\<dots> \\<sqsubseteq> prognosis ae as a (\\<Gamma>, Var x, S)\" by (rule record_call_below_arg)\n    finally have *: \"prognosis ae as u ((x, e) # delete x \\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, Var x, S)\" by this simp_all\n    moreover\n    have \"a_consistent (ae, u, as) ((x,e) # delete x (restrictA (- set r) \\<Gamma>), e, restr_stack (- set r) S)\" using lamvar `ae x = up\\<cdot>u`\n      by (auto intro!: a_consistent_lamvar simp del: restr_delete)\n    ultimately\n    have \"consistent (ae, ce, u, as, r) ((x, e) # delete x \\<Gamma>, e, S)\"\n      using lamvar edom_mono[OF *] by (auto simp add:  thunks_Cons restr_delete_twist elim: below_trans)\n    moreover\n\n    from `a_consistent _ _`\n    have **: \"Astack (transform_alts as (restr_stack (- set r) S) @ map Dummy (rev r)) \\<sqsubseteq> u\" by (auto elim: a_consistent_stackD) \n\n    {\n    from `isVal e`\n    have \"isVal (transform u e)\" by simp\n    hence \"isVal (Aeta_expand u (transform u e))\" by (rule isVal_Aeta_expand)\n    moreover\n    from  `map_of \\<Gamma> x = Some e`  `ae x = up \\<cdot> u` `ce x = up\\<cdot>c` `isVal (transform u e)`\n    have \"map_of (map_transform Aeta_expand ae (map_transform transform ae (restrictA (- set r) \\<Gamma>))) x = Some (Aeta_expand u (transform u e))\"\n      by (simp add: map_of_map_transform)\n    ultimately\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sub>G\\<^sup>*\n          add_dummies_conf r ((x, Aeta_expand u (transform u e)) # delete x (map_transform Aeta_expand ae (map_transform transform ae (restrictA (- set r) \\<Gamma>))), Aeta_expand u (transform u e), transform_alts as (restr_stack (- set r) S))\"\n       by (auto intro!: normal_trans[OF lambda_var] simp add: map_transform_delete simp del: restr_delete)\n    also have \"\\<dots> = add_dummies_conf r ((map_transform Aeta_expand ae (map_transform transform ae ((x,e) # delete x (restrictA (- set r) \\<Gamma>)))), Aeta_expand u  (transform u e), transform_alts as (restr_stack (- set r) S))\"\n      using `ae x = up \\<cdot> u` `ce x = up\\<cdot>c` `isVal (transform u e)`\n      by (simp add: map_transform_Cons map_transform_delete restr_delete_twist del: restr_delete)\n    also(subst[rotated]) have \"\\<dots> \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae, ce, u, as, r) ((x, e) # delete x \\<Gamma>, e, S)\"\n      by (simp add: restr_delete_twist) (rule normal_trans[OF Aeta_expand_safe[OF ** ]])\n    finally(rtranclp_trans)\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae, ce, u, as, r) ((x, e) # delete x \\<Gamma>, e, S)\".\n    }\n    ultimately show ?case by (blast del: consistentI consistentE)\n  next\n  case (var\\<^sub>2 \\<Gamma> x e S)\n    show ?case\n    proof(cases \"x \\<in> set r\")\n      case [simp]: False\n\n      from var\\<^sub>2\n      have \"a_consistent (ae, a, as) (restrictA (- set r) \\<Gamma>, e, Upd x # restr_stack (-set r) S)\" by auto\n      from a_consistent_UpdD[OF this]\n      have \"ae x = up\\<cdot>0\" and \"a = 0\".\n  \n      from `isVal e` `x \\<notin> domA \\<Gamma>`\n      have *: \"prognosis ae as 0 ((x, e) # \\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as 0 (\\<Gamma>, e, Upd x # S)\" by (rule prognosis_Var2)\n      moreover\n      have \"a_consistent (ae, a, as) ((x, e) # restrictA (- set r) \\<Gamma>, e, restr_stack (- set r) S)\"\n        using var\\<^sub>2 by (auto intro!: a_consistent_var\\<^sub>2)\n      ultimately\n      have \"consistent (ae, ce, 0, as, r) ((x, e) # \\<Gamma>, e, S)\"\n        using var\\<^sub>2 `a = 0`\n        by (auto simp add: thunks_Cons elim: below_trans)\n      moreover\n      have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, e, Upd x # S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, 0, as, r) ((x, e) # \\<Gamma>, e, S)\"\n        using `ae x = up\\<cdot>0` `a = 0` var\\<^sub>2 \n        by (auto intro: gc_step.intros simp add: map_transform_Cons)\n      ultimately show ?thesis by (blast del: consistentI consistentE)\n    next\n      case True\n      hence \"ce x = \\<bottom>\" using var\\<^sub>2 by (auto simp add: edom_def)\n      hence \"x \\<notin> edom ce\" by (simp add: edomIff)\n      hence \"x \\<notin> edom ae\" using var\\<^sub>2 by auto\n      hence [simp]: \"ae x = \\<bottom>\" by (auto simp add: edom_def)\n\n      note  `x \\<in> set r`[simp]\n      \n      have \"prognosis ae as a ((x, e) # \\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as a ((x, e) # \\<Gamma>, e, Upd x # S)\" by (rule prognosis_upd)\n      also have \"\\<dots> \\<sqsubseteq> prognosis ae as a (delete x ((x,e) # \\<Gamma>), e, Upd x # S)\"\n        using `ae x = \\<bottom>` by (rule prognosis_not_called)\n      also have \"delete x ((x,e)#\\<Gamma>) = \\<Gamma>\" using `x \\<notin> domA \\<Gamma>` by simp\n      finally\n      have *: \"prognosis ae as a ((x, e) # \\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, e, Upd x # S)\" by this simp\n      then\n      have \"consistent (ae, ce, a, as, r) ((x, e) # \\<Gamma>, e, S)\" using var\\<^sub>2\n        by (auto simp add: thunks_Cons  elim:below_trans a_consistent_var\\<^sub>2)\n      moreover\n      have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, e, Upd x # S) = conf_transform (ae, ce, a, as, r) ((x, e) # \\<Gamma>, e, S)\"\n        by (auto simp add: map_transform_restrA[symmetric])\n      ultimately show ?thesis\n        by (fastforce del: consistentI consistentE simp del:conf_transform.simps)\n    qed\n  next\n    case (let\\<^sub>1 \\<Delta> \\<Gamma> e S)\n    let ?ae = \"Aheap \\<Delta> e\\<cdot>a\"\n    let ?ce = \"cHeap \\<Delta> e\\<cdot>a\"\n  \n    have \"domA \\<Delta> \\<inter> upds S = {}\" using fresh_distinct_fv[OF let\\<^sub>1(2)] by (auto dest: set_mp[OF ups_fv_subset])\n    hence *: \"\\<And> x. x \\<in> upds S \\<Longrightarrow> x \\<notin> edom ?ae\" by (auto simp add: edom_cHeap dest!: set_mp[OF edom_Aheap])\n    have restr_stack_simp2: \"restr_stack (edom (?ae \\<squnion> ae)) S = restr_stack (edom ae) S\"\n      by (auto intro: restr_stack_cong dest!: *)\n\n    have \"edom ce = edom ae\" using let\\<^sub>1 by auto\n  \n    have \"edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S\" using let\\<^sub>1 by (auto dest!: a_consistent_edom_subsetD)\n    from set_mp[OF this] fresh_distinct[OF let\\<^sub>1(1)] fresh_distinct_fv[OF let\\<^sub>1(2)]\n    have \"edom ae \\<inter> domA \\<Delta> = {}\" by (auto dest: set_mp[OF ups_fv_subset])\n\n    from `edom ae \\<inter> domA \\<Delta> = {}`\n    have [simp]: \"edom (Aheap \\<Delta> e\\<cdot>a) \\<inter> edom ae = {}\" by (auto dest!: set_mp[OF edom_Aheap]) \n\n    from fresh_distinct[OF let\\<^sub>1(1)]\n    have [simp]: \"restrictA (edom ae \\<union> edom (Aheap \\<Delta> e\\<cdot>a)) \\<Gamma> = restrictA (edom ae) \\<Gamma>\"\n      by (auto intro: restrictA_cong dest!: set_mp[OF edom_Aheap]) \n\n    have \"set r \\<subseteq> domA \\<Gamma> \\<union> upds S\" using let\\<^sub>1 by auto\n    have [simp]: \"restrictA (- set r) \\<Delta> = \\<Delta>\"\n      apply (rule restrictA_noop)\n      apply auto\n      by (metis IntI UnE `set r \\<subseteq> domA \\<Gamma> \\<union> upds S` `domA \\<Delta> \\<inter> domA \\<Gamma> = {}` `domA \\<Delta> \\<inter> upds S = {}` contra_subsetD empty_iff)\n\n    {\n    have \"edom (?ae \\<squnion> ae) = edom (?ce \\<squnion> ce)\"\n      using let\\<^sub>1(4) by (auto simp add: edom_cHeap)\n    moreover\n    { fix x e'\n      assume \"x \\<in> thunks \\<Gamma>\"\n      hence \"x \\<notin> edom ?ce\" using fresh_distinct[OF let\\<^sub>1(1)]\n        by (auto simp add: edom_cHeap dest: set_mp[OF edom_Aheap]  set_mp[OF thunks_domA])\n      hence [simp]: \"?ce x = \\<bottom>\" unfolding edomIff by auto\n    \n      assume \"many \\<sqsubseteq> (?ce \\<squnion> ce) x\"\n      with let\\<^sub>1 `x \\<in> thunks \\<Gamma>`\n      have \"(?ae \\<squnion> ae) x = up \\<cdot>0\" by auto\n    }\n    moreover\n    { fix x e'\n      assume \"x \\<in> thunks \\<Delta>\" \n      hence \"x \\<notin> domA \\<Gamma>\" and \"x \\<notin> upds S\"\n        using fresh_distinct[OF let\\<^sub>1(1)] fresh_distinct_fv[OF let\\<^sub>1(2)]\n        by (auto dest!: set_mp[OF thunks_domA] set_mp[OF ups_fv_subset])\n      hence \"x \\<notin> edom ce\" using `edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S` `edom ce = edom ae` by auto\n      hence [simp]: \"ce x = \\<bottom>\"  by (auto simp add: edomIff)\n  \n      assume \"many \\<sqsubseteq> (?ce \\<squnion> ce) x\" with `x \\<in> thunks \\<Delta>`\n      have \"(?ae \\<squnion> ae) x = up\\<cdot>0\" by (auto simp add: Aheap_heap3)\n    }\n    moreover\n    {\n    from let\\<^sub>1(1,2) `edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S`\n    have \"prognosis (?ae \\<squnion> ae) as a (\\<Delta> @ \\<Gamma>, e, S) \\<sqsubseteq> ?ce \\<squnion> prognosis ae as a (\\<Gamma>, Let \\<Delta> e, S)\" by (rule prognosis_Let)\n    also have \"prognosis ae as a (\\<Gamma>, Let \\<Delta> e, S) \\<sqsubseteq> ce\" using let\\<^sub>1 by auto\n    finally have \"prognosis (?ae \\<squnion> ae) as a (\\<Delta> @ \\<Gamma>, e, S) \\<sqsubseteq> ?ce \\<squnion> ce\" by this simp\n    }\n    moreover\n\n    have \"a_consistent (ae, a, as) (restrictA (- set r) \\<Gamma>, Let \\<Delta> e, restr_stack (- set r) S)\"\n      using let\\<^sub>1 by auto\n    hence \"a_consistent (?ae \\<squnion> ae, a, as) (\\<Delta> @ restrictA (- set r) \\<Gamma>, e, restr_stack (- set r) S)\"\n      using let\\<^sub>1(1,2) `edom ae \\<inter> domA \\<Delta> = {}` \n      by (auto intro!:  a_consistent_let simp del: join_comm)\n    hence \"a_consistent (?ae \\<squnion> ae, a, as) (restrictA (- set r) (\\<Delta> @ \\<Gamma>), e, restr_stack (- set r) S)\"\n      by (simp add: restrictA_append)\n    moreover\n    have  \"set r \\<subseteq> (domA \\<Gamma> \\<union> upds S) - edom ce\" using let\\<^sub>1 by auto\n    hence  \"set r \\<subseteq> (domA \\<Gamma> \\<union> upds S) - edom (?ce \\<squnion> ce)\"\n      apply (rule order_trans)\n      using `domA \\<Delta> \\<inter> domA \\<Gamma> = {}` `domA \\<Delta> \\<inter> upds S = {}` \n      apply (auto simp add: edom_cHeap dest!: set_mp[OF edom_Aheap])\n      done\n    ultimately\n    have \"consistent (?ae \\<squnion> ae, ?ce \\<squnion> ce, a, as, r) (\\<Delta> @ \\<Gamma>, e, S)\" by auto\n    }\n    moreover\n    {\n      have \"\\<And> x. x \\<in> domA \\<Gamma> \\<Longrightarrow> x \\<notin> edom ?ae\" \"\\<And> x. x \\<in> domA \\<Gamma> \\<Longrightarrow> x \\<notin> edom ?ce\"\n        using fresh_distinct[OF let\\<^sub>1(1)]\n        by (auto simp add: edom_cHeap dest!: set_mp[OF edom_Aheap])\n      hence \"map_transform Aeta_expand (?ae \\<squnion> ae) (map_transform transform (?ae \\<squnion> ae) (restrictA (-set r) \\<Gamma>))\n         = map_transform Aeta_expand ae (map_transform transform ae (restrictA (-set r) \\<Gamma>))\"\n         by (auto intro!: map_transform_cong restrictA_cong simp add: edomIff)\n      moreover\n  \n      from `edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S` `edom ce = edom ae`\n      have \"\\<And> x. x \\<in> domA \\<Delta> \\<Longrightarrow> x \\<notin> edom ce\" and  \"\\<And> x. x \\<in> domA \\<Delta> \\<Longrightarrow> x \\<notin> edom ae\"\n         using fresh_distinct[OF let\\<^sub>1(1)] fresh_distinct_ups[OF let\\<^sub>1(2)]  by auto\n      hence \"map_transform Aeta_expand (?ae \\<squnion> ae) (map_transform transform (?ae \\<squnion> ae) (restrictA (- set r) \\<Delta>))\n         = map_transform Aeta_expand ?ae (map_transform transform ?ae (restrictA (- set r) \\<Delta>))\"\n         by (auto intro!: map_transform_cong restrictA_cong simp add: edomIff)\n      moreover\n            \n      from  `domA \\<Delta> \\<inter> domA \\<Gamma> = {}`   `domA \\<Delta> \\<inter> upds S = {}`\n      have \"atom ` domA \\<Delta> \\<sharp>* set r\"\n        by (auto simp add: fresh_star_def fresh_at_base fresh_finite_set_at_base dest!: set_mp[OF `set r \\<subseteq> domA \\<Gamma> \\<union> upds S`])\n      hence \"atom ` domA \\<Delta> \\<sharp>* map Dummy (rev r)\" \n        apply -\n        apply (rule eqvt_fresh_star_cong1[where f = \"map Dummy\"], perm_simp, rule)\n        apply (rule eqvt_fresh_star_cong1[where f = \"rev\"], perm_simp, rule)\n        apply (auto simp add: fresh_star_def fresh_set)\n        done\n      ultimately\n      \n      \n      have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Let \\<Delta> e, S) \\<Rightarrow>\\<^sub>G conf_transform (?ae \\<squnion> ae, ?ce \\<squnion> ce, a, as, r) (\\<Delta> @ \\<Gamma>, e, S)\"\n        using restr_stack_simp2 let\\<^sub>1(1,2)  `edom ce = edom ae`\n        apply (auto simp add: map_transform_append restrictA_append edom_cHeap restr_stack_simp2[simplified] )\n        apply (rule normal)\n        apply (rule step.let\\<^sub>1)\n        apply (auto intro: normal step.let\\<^sub>1 dest: set_mp[OF edom_Aheap] simp add: fresh_star_list)\n        done\n    }\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case (if\\<^sub>1 \\<Gamma> scrut e1 e2 S)\n    have \"prognosis ae as a (\\<Gamma>, scrut ? e1 : e2, S) \\<sqsubseteq> ce\" using if\\<^sub>1 by auto\n    hence \"prognosis ae (a#as) 0 (\\<Gamma>, scrut, Alts e1 e2 # S) \\<sqsubseteq> ce\"\n      by (rule below_trans[OF prognosis_IfThenElse])\n    hence \"consistent (ae, ce, 0, a#as, r) (\\<Gamma>, scrut, Alts e1 e2 # S)\"\n      using if\\<^sub>1  by (auto dest: a_consistent_if\\<^sub>1)\n    moreover\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, scrut ? e1 : e2, S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, 0, a#as, r) (\\<Gamma>, scrut, Alts e1 e2 # S)\"\n      by (auto intro: normal step.intros)\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case (if\\<^sub>2 \\<Gamma> b e1 e2 S)\n    hence \"a_consistent (ae, a, as) (restrictA (- set r) \\<Gamma>, Bool b, Alts e1 e2 # restr_stack (-set r) S)\" by auto\n    then  obtain a' as' where [simp]: \"as = a' # as'\" \"a = 0\"\n      by (rule a_consistent_alts_on_stack)\n\n    {\n    have \"prognosis ae (a'#as') 0 (\\<Gamma>, Bool b, Alts e1 e2 # S) \\<sqsubseteq> ce\" using if\\<^sub>2 by auto\n    hence \"prognosis ae as' a' (\\<Gamma>, if b then e1 else e2, S) \\<sqsubseteq> ce\" by (rule below_trans[OF prognosis_Alts])\n    then\n    have \"consistent (ae, ce, a', as', r) (\\<Gamma>, if b then e1 else e2, S)\" \n      using if\\<^sub>2 by (auto dest!: a_consistent_if\\<^sub>2)\n    }\n    moreover\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Bool b, Alts e1 e2 # S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, a', as', r) (\\<Gamma>, if b then e1 else e2, S)\"\n      by (auto intro: normal step.if\\<^sub>2[where b = True, simplified] step.if\\<^sub>2[where b = False, simplified])\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case refl thus ?case by force\n  next\n    case (trans c c' c'')\n      from trans(3)[OF trans(5)]\n      obtain ae' ce' a' as' r'\n      where \"consistent (ae', ce', a', as', r') c'\" and *: \"conf_transform (ae, ce, a, as, r) c \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae', ce', a', as', r') c'\" by blast\n      from trans(4)[OF this(1)]\n      obtain ae'' ce'' a'' as'' r''\n      where \"consistent (ae'', ce'', a'', as'', r'') c''\" and **: \"conf_transform (ae', ce', a', as', r') c' \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae'', ce'', a'', as'', r'') c''\" by blast\n      from this(1) rtranclp_trans[OF * **]\n      show ?case by blast\n  qed\nend\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/CardArityTransformSafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.668880247169804, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.342277129035415}}
{"text": "(*<*)\ntheory TAO_1_Embedding\nimports Main\nbegin\n(*>*)\n\nsection\\<open>Representation Layer\\<close>\ntext\\<open>\\label{TAO_Embedding}\\<close>\n\nsubsection\\<open>Primitives\\<close>\ntext\\<open>\\label{TAO_Embedding_Primitives}\\<close>\n\ntypedecl i \\<comment> \\<open>possible worlds\\<close>\ntypedecl j \\<comment> \\<open>states\\<close>\n\nconsts dw :: i \\<comment> \\<open>actual world\\<close>\nconsts dj :: j \\<comment> \\<open>actual state\\<close>\n\ntypedecl \\<omega> \\<comment> \\<open>ordinary objects\\<close>\ntypedecl \\<sigma> \\<comment> \\<open>special urelements\\<close>\ndatatype \\<upsilon> = \\<omega>\\<upsilon> \\<omega> | \\<sigma>\\<upsilon> \\<sigma> \\<comment> \\<open>urelements\\<close>\n\nsubsection\\<open>Derived Types\\<close>\ntext\\<open>\\label{TAO_Embedding_Derived_Types}\\<close>\n\ntypedef \\<o> = \"UNIV::(j\\<Rightarrow>i\\<Rightarrow>bool) set\"\n  morphisms eval\\<o> make\\<o> .. \\<comment> \\<open>truth values\\<close>\n\ntype_synonym \\<Pi>\\<^sub>0 = \\<o> \\<comment> \\<open>zero place relations\\<close>\ntypedef \\<Pi>\\<^sub>1 = \"UNIV::(\\<upsilon>\\<Rightarrow>j\\<Rightarrow>i\\<Rightarrow>bool) set\"\n  morphisms eval\\<Pi>\\<^sub>1 make\\<Pi>\\<^sub>1 .. \\<comment> \\<open>one place relations\\<close>\ntypedef \\<Pi>\\<^sub>2 = \"UNIV::(\\<upsilon>\\<Rightarrow>\\<upsilon>\\<Rightarrow>j\\<Rightarrow>i\\<Rightarrow>bool) set\"\n  morphisms eval\\<Pi>\\<^sub>2 make\\<Pi>\\<^sub>2 .. \\<comment> \\<open>two place relations\\<close>\ntypedef \\<Pi>\\<^sub>3 = \"UNIV::(\\<upsilon>\\<Rightarrow>\\<upsilon>\\<Rightarrow>\\<upsilon>\\<Rightarrow>j\\<Rightarrow>i\\<Rightarrow>bool) set\"\n  morphisms eval\\<Pi>\\<^sub>3 make\\<Pi>\\<^sub>3 .. \\<comment> \\<open>three place relations\\<close>\n\ntype_synonym \\<alpha> = \"\\<Pi>\\<^sub>1 set\" \\<comment> \\<open>abstract objects\\<close>\n\ndatatype \\<nu> = \\<omega>\\<nu> \\<omega> | \\<alpha>\\<nu> \\<alpha> \\<comment> \\<open>individuals\\<close>\n\ntypedef \\<kappa> = \"UNIV::(\\<nu> option) set\"\n  morphisms eval\\<kappa> make\\<kappa> .. \\<comment> \\<open>individual terms\\<close>\n\nsetup_lifting type_definition_\\<o>\nsetup_lifting type_definition_\\<kappa>\nsetup_lifting type_definition_\\<Pi>\\<^sub>1\nsetup_lifting type_definition_\\<Pi>\\<^sub>2\nsetup_lifting type_definition_\\<Pi>\\<^sub>3\n\nsubsection\\<open>Individual Terms and Definite Descriptions\\<close>\ntext\\<open>\\label{TAO_Embedding_IndividualTerms}\\<close>\n\nlift_definition \\<nu>\\<kappa> :: \"\\<nu>\\<Rightarrow>\\<kappa>\" (\"_\\<^sup>P\" [90] 90) is Some .\nlift_definition proper :: \"\\<kappa>\\<Rightarrow>bool\" is \"(\\<noteq>) None\" .\nlift_definition rep :: \"\\<kappa>\\<Rightarrow>\\<nu>\" is the .\n\nlift_definition that::\"(\\<nu>\\<Rightarrow>\\<o>)\\<Rightarrow>\\<kappa>\" (binder \"\\<^bold>\\<iota>\" [8] 9) is\n  \"\\<lambda> \\<phi> . if (\\<exists>! x . (\\<phi> x) dj dw)\n         then Some (THE x . (\\<phi> x) dj dw)\n         else None\" .\n\nsubsection\\<open>Mapping from Individuals to Urelements\\<close>\ntext\\<open>\\label{TAO_Embedding_AbstractObjectsToSpecialUrelements}\\<close>\n\nconsts \\<alpha>\\<sigma> :: \"\\<alpha>\\<Rightarrow>\\<sigma>\"\naxiomatization where \\<alpha>\\<sigma>_surj: \"surj \\<alpha>\\<sigma>\"\ndefinition \\<nu>\\<upsilon> :: \"\\<nu>\\<Rightarrow>\\<upsilon>\" where \"\\<nu>\\<upsilon> \\<equiv> case_\\<nu> \\<omega>\\<upsilon> (\\<sigma>\\<upsilon> \\<circ> \\<alpha>\\<sigma>)\"\n\nsubsection\\<open>Exemplification of n-place-Relations.\\<close>\ntext\\<open>\\label{TAO_Embedding_Exemplification}\\<close>\n\nlift_definition exe0::\"\\<Pi>\\<^sub>0\\<Rightarrow>\\<o>\" (\"\\<lparr>_\\<rparr>\") is id .\nlift_definition exe1::\"\\<Pi>\\<^sub>1\\<Rightarrow>\\<kappa>\\<Rightarrow>\\<o>\" (\"\\<lparr>_,_\\<rparr>\") is\n  \"\\<lambda> F x s w . (proper x) \\<and> F (\\<nu>\\<upsilon> (rep x)) s w\" .\nlift_definition exe2::\"\\<Pi>\\<^sub>2\\<Rightarrow>\\<kappa>\\<Rightarrow>\\<kappa>\\<Rightarrow>\\<o>\" (\"\\<lparr>_,_,_\\<rparr>\") is\n  \"\\<lambda> F x y s w . (proper x) \\<and> (proper y) \\<and>\n     F (\\<nu>\\<upsilon> (rep x)) (\\<nu>\\<upsilon> (rep y)) s w\" .\nlift_definition exe3::\"\\<Pi>\\<^sub>3\\<Rightarrow>\\<kappa>\\<Rightarrow>\\<kappa>\\<Rightarrow>\\<kappa>\\<Rightarrow>\\<o>\" (\"\\<lparr>_,_,_,_\\<rparr>\") is\n\"\\<lambda> F x y z s w . (proper x) \\<and> (proper y) \\<and> (proper z) \\<and>\n   F (\\<nu>\\<upsilon> (rep x)) (\\<nu>\\<upsilon> (rep y)) (\\<nu>\\<upsilon> (rep z)) s w\" .\n\nsubsection\\<open>Encoding\\<close>\ntext\\<open>\\label{TAO_Embedding_Encoding}\\<close>\n\nlift_definition enc :: \"\\<kappa>\\<Rightarrow>\\<Pi>\\<^sub>1\\<Rightarrow>\\<o>\" (\"\\<lbrace>_,_\\<rbrace>\") is\n  \"\\<lambda> x F s w . (proper x) \\<and> case_\\<nu> (\\<lambda> \\<omega> . False) (\\<lambda> \\<alpha> . F \\<in> \\<alpha>) (rep x)\" .\n\nsubsection\\<open>Connectives and Quantifiers\\<close>\ntext\\<open>\\label{TAO_Embedding_Connectives}\\<close>\n\nconsts I_NOT :: \"j\\<Rightarrow>(i\\<Rightarrow>bool)\\<Rightarrow>i\\<Rightarrow>bool\"\nconsts I_IMPL :: \"j\\<Rightarrow>(i\\<Rightarrow>bool)\\<Rightarrow>(i\\<Rightarrow>bool)\\<Rightarrow>(i\\<Rightarrow>bool)\"\n\nlift_definition not :: \"\\<o>\\<Rightarrow>\\<o>\" (\"\\<^bold>\\<not>_\" [54] 70) is\n  \"\\<lambda> p s w . s = dj \\<and> \\<not>p dj w \\<or> s \\<noteq> dj \\<and> (I_NOT s (p s) w)\" .\nlift_definition impl :: \"\\<o>\\<Rightarrow>\\<o>\\<Rightarrow>\\<o>\" (infixl \"\\<^bold>\\<rightarrow>\" 51) is\n  \"\\<lambda> p q s w . s = dj \\<and> (p dj w \\<longrightarrow> q dj w) \\<or> s \\<noteq> dj \\<and> (I_IMPL s (p s) (q s) w)\" .\nlift_definition forall\\<^sub>\\<nu> :: \"(\\<nu>\\<Rightarrow>\\<o>)\\<Rightarrow>\\<o>\" (binder \"\\<^bold>\\<forall>\\<^sub>\\<nu>\" [8] 9) is\n  \"\\<lambda> \\<phi> s w . \\<forall> x :: \\<nu> . (\\<phi> x) s w\" .\nlift_definition forall\\<^sub>0 :: \"(\\<Pi>\\<^sub>0\\<Rightarrow>\\<o>)\\<Rightarrow>\\<o>\" (binder \"\\<^bold>\\<forall>\\<^sub>0\" [8] 9) is\n  \"\\<lambda> \\<phi> s w . \\<forall> x :: \\<Pi>\\<^sub>0 . (\\<phi> x) s w\" .\nlift_definition forall\\<^sub>1 :: \"(\\<Pi>\\<^sub>1\\<Rightarrow>\\<o>)\\<Rightarrow>\\<o>\" (binder \"\\<^bold>\\<forall>\\<^sub>1\" [8] 9) is\n  \"\\<lambda> \\<phi> s w . \\<forall> x :: \\<Pi>\\<^sub>1  . (\\<phi> x) s w\" .\nlift_definition forall\\<^sub>2 :: \"(\\<Pi>\\<^sub>2\\<Rightarrow>\\<o>)\\<Rightarrow>\\<o>\" (binder \"\\<^bold>\\<forall>\\<^sub>2\" [8] 9) is\n  \"\\<lambda> \\<phi> s w . \\<forall> x :: \\<Pi>\\<^sub>2  . (\\<phi> x) s w\" .\nlift_definition forall\\<^sub>3 :: \"(\\<Pi>\\<^sub>3\\<Rightarrow>\\<o>)\\<Rightarrow>\\<o>\" (binder \"\\<^bold>\\<forall>\\<^sub>3\" [8] 9) is\n  \"\\<lambda> \\<phi> s w . \\<forall> x :: \\<Pi>\\<^sub>3  . (\\<phi> x) s w\" .\nlift_definition forall\\<^sub>\\<o> :: \"(\\<o>\\<Rightarrow>\\<o>)\\<Rightarrow>\\<o>\" (binder \"\\<^bold>\\<forall>\\<^sub>\\<o>\" [8] 9) is\n  \"\\<lambda> \\<phi> s w . \\<forall> x :: \\<o>  . (\\<phi> x) s w\" .\nlift_definition box :: \"\\<o>\\<Rightarrow>\\<o>\" (\"\\<^bold>\\<box>_\" [62] 63) is\n  \"\\<lambda> p s w . \\<forall> v . p s v\" .\nlift_definition actual :: \"\\<o>\\<Rightarrow>\\<o>\" (\"\\<^bold>\\<A>_\" [64] 65) is\n  \"\\<lambda> p s w . p s dw\" .\n\ntext\\<open>\n\\begin{remark}\n  The connectives behave classically if evaluated for the actual state @{term \"dj\"},\n  whereas their behavior is governed by uninterpreted constants for any\n  other state.\n\\end{remark}\n\\<close>\n\nsubsection\\<open>Lambda Expressions\\<close>\ntext\\<open>\\label{TAO_Embedding_Lambda}\\<close>\n\ntext\\<open>\n\\begin{remark}\n  Lambda expressions have to convert maps from individuals to propositions to\n  relations that are represented by maps from urelements to truth values.\n\\end{remark}\n\\<close>\n\nlift_definition lambdabinder0 :: \"\\<o>\\<Rightarrow>\\<Pi>\\<^sub>0\" (\"\\<^bold>\\<lambda>\\<^sup>0\") is id .\nlift_definition lambdabinder1 :: \"(\\<nu>\\<Rightarrow>\\<o>)\\<Rightarrow>\\<Pi>\\<^sub>1\" (binder \"\\<^bold>\\<lambda>\" [8] 9) is\n  \"\\<lambda> \\<phi> u s w . \\<exists> x . \\<nu>\\<upsilon> x = u \\<and> \\<phi> x s w\" .\nlift_definition lambdabinder2 :: \"(\\<nu>\\<Rightarrow>\\<nu>\\<Rightarrow>\\<o>)\\<Rightarrow>\\<Pi>\\<^sub>2\" (\"\\<^bold>\\<lambda>\\<^sup>2\") is\n  \"\\<lambda> \\<phi> u v s w . \\<exists> x y . \\<nu>\\<upsilon> x = u \\<and> \\<nu>\\<upsilon> y = v \\<and> \\<phi> x y s w\" .\nlift_definition lambdabinder3 :: \"(\\<nu>\\<Rightarrow>\\<nu>\\<Rightarrow>\\<nu>\\<Rightarrow>\\<o>)\\<Rightarrow>\\<Pi>\\<^sub>3\" (\"\\<^bold>\\<lambda>\\<^sup>3\") is\n  \"\\<lambda> \\<phi> u v r s w . \\<exists> x y z . \\<nu>\\<upsilon> x = u \\<and> \\<nu>\\<upsilon> y = v \\<and> \\<nu>\\<upsilon> z = r \\<and> \\<phi> x y z s w\" .\n\nsubsection\\<open>Proper Maps\\<close>\ntext\\<open>\\label{TAO_Embedding_Proper}\\<close>\n\ntext\\<open>\n\\begin{remark}\n  The embedding introduces the notion of \\emph{proper} maps from\n  individual terms to propositions.\n\n  Such a map is proper if and only if for all proper individual terms its truth evaluation in the\n  actual state only depends on the urelements corresponding to the individuals the terms denote.\n\n  Proper maps are exactly those maps that - when used as matrix of a lambda-expression - unconditionally\n  allow beta-reduction.\n\\end{remark}\n\\<close>\n\nlift_definition IsProperInX :: \"(\\<kappa>\\<Rightarrow>\\<o>)\\<Rightarrow>bool\" is\n  \"\\<lambda> \\<phi> . \\<forall> x v . (\\<exists> a . \\<nu>\\<upsilon> a = \\<nu>\\<upsilon> x \\<and> (\\<phi> (a\\<^sup>P) dj v)) = (\\<phi> (x\\<^sup>P) dj v)\" .\nlift_definition IsProperInXY :: \"(\\<kappa>\\<Rightarrow>\\<kappa>\\<Rightarrow>\\<o>)\\<Rightarrow>bool\" is\n  \"\\<lambda> \\<phi> . \\<forall> x y v . (\\<exists> a b . \\<nu>\\<upsilon> a = \\<nu>\\<upsilon> x \\<and> \\<nu>\\<upsilon> b = \\<nu>\\<upsilon> y\n                    \\<and> (\\<phi> (a\\<^sup>P) (b\\<^sup>P) dj v)) = (\\<phi> (x\\<^sup>P) (y\\<^sup>P) dj v)\" .\nlift_definition IsProperInXYZ :: \"(\\<kappa>\\<Rightarrow>\\<kappa>\\<Rightarrow>\\<kappa>\\<Rightarrow>\\<o>)\\<Rightarrow>bool\" is\n  \"\\<lambda> \\<phi> . \\<forall> x y z v . (\\<exists> a b c . \\<nu>\\<upsilon> a = \\<nu>\\<upsilon> x \\<and> \\<nu>\\<upsilon> b = \\<nu>\\<upsilon> y \\<and> \\<nu>\\<upsilon> c = \\<nu>\\<upsilon> z\n                      \\<and> (\\<phi> (a\\<^sup>P) (b\\<^sup>P) (c\\<^sup>P) dj v)) = (\\<phi> (x\\<^sup>P) (y\\<^sup>P) (z\\<^sup>P) dj v)\" .\n\n\nsubsection\\<open>Validity\\<close> \ntext\\<open>\\label{TAO_Embedding_Validity}\\<close>\n\nlift_definition valid_in :: \"i\\<Rightarrow>\\<o>\\<Rightarrow>bool\" (infixl \"\\<Turnstile>\" 5) is\n  \"\\<lambda> v \\<phi> . \\<phi> dj v\" .\n\ntext\\<open>\n\\begin{remark}\n  A formula is considered semantically valid for a possible world,\n  if it evaluates to @{term \"True\"} for the actual state @{term \"dj\"}\n  and the given possible world.\n\\end{remark}\n\\<close>\n\nsubsection\\<open>Concreteness\\<close>\ntext\\<open>\\label{TAO_Embedding_Concreteness}\\<close>\n\nconsts ConcreteInWorld :: \"\\<omega>\\<Rightarrow>i\\<Rightarrow>bool\"\n\nabbreviation (input) OrdinaryObjectsPossiblyConcrete where\n  \"OrdinaryObjectsPossiblyConcrete \\<equiv> \\<forall> x . \\<exists> v . ConcreteInWorld x v\"\nabbreviation (input) PossiblyContingentObjectExists where\n  \"PossiblyContingentObjectExists \\<equiv> \\<exists> x v . ConcreteInWorld x v\n                                        \\<and> (\\<exists> w . \\<not> ConcreteInWorld x w)\"\nabbreviation (input) PossiblyNoContingentObjectExists where\n  \"PossiblyNoContingentObjectExists \\<equiv> \\<exists> w . \\<forall> x . ConcreteInWorld x w\n                                        \\<longrightarrow> (\\<forall> v . ConcreteInWorld x v)\"\naxiomatization where\n  OrdinaryObjectsPossiblyConcreteAxiom:\n    \"OrdinaryObjectsPossiblyConcrete\"\n  and PossiblyContingentObjectExistsAxiom:\n    \"PossiblyContingentObjectExists\"\n  and PossiblyNoContingentObjectExistsAxiom:\n    \"PossiblyNoContingentObjectExists\"\n\ntext\\<open>\n\\begin{remark}\n  Care has to be taken that the defined notion of concreteness\n  coincides with the meta-logical distinction between\n  abstract objects and ordinary objects. Furthermore the axioms about\n  concreteness have to be satisfied. This is achieved by introducing an\n  uninterpreted constant @{term \"ConcreteInWorld\"} that determines whether\n  an ordinary object is concrete in a given possible world. This constant is\n  axiomatized, such that all ordinary objects are possibly concrete, contingent\n  objects possibly exist and possibly no contingent objects exist.\n\\end{remark}\n\\<close>\n\n\nlift_definition Concrete::\"\\<Pi>\\<^sub>1\" (\"E!\") is\n  \"\\<lambda> u s w . case u of \\<omega>\\<upsilon> x \\<Rightarrow> ConcreteInWorld x w | _ \\<Rightarrow> False\" .\n\ntext\\<open>\n\\begin{remark}\n  Concreteness of ordinary objects is now defined using this\n  axiomatized uninterpreted constant. Abstract objects on the other\n  hand are never concrete.\n\\end{remark}\n\\<close>\n\nsubsection\\<open>Collection of Meta-Definitions\\<close>\ntext\\<open>\\label{TAO_Embedding_meta_defs}\\<close>\n\nnamed_theorems meta_defs\n\ndeclare not_def[meta_defs] impl_def[meta_defs] forall\\<^sub>\\<nu>_def[meta_defs]\n        forall\\<^sub>0_def[meta_defs] forall\\<^sub>1_def[meta_defs]\n        forall\\<^sub>2_def[meta_defs] forall\\<^sub>3_def[meta_defs] forall\\<^sub>\\<o>_def[meta_defs]\n        box_def[meta_defs] actual_def[meta_defs] that_def[meta_defs]\n        lambdabinder0_def[meta_defs] lambdabinder1_def[meta_defs]\n        lambdabinder2_def[meta_defs] lambdabinder3_def[meta_defs]\n        exe0_def[meta_defs] exe1_def[meta_defs] exe2_def[meta_defs]\n        exe3_def[meta_defs] enc_def[meta_defs] inv_def[meta_defs]\n        that_def[meta_defs] valid_in_def[meta_defs] Concrete_def[meta_defs]\n\ndeclare [[smt_solver = cvc4]]\ndeclare [[simp_depth_limit = 10]] (* prevent the simplifier from running forever *)\ndeclare [[unify_search_bound = 40]] (* prevent unification bound errors *)\n\nsubsection\\<open>Auxiliary Lemmata\\<close>\ntext\\<open>\\label{TAO_Embedding_Aux}\\<close>\n  \nnamed_theorems meta_aux\n\ndeclare make\\<kappa>_inverse[meta_aux] eval\\<kappa>_inverse[meta_aux]\n        make\\<o>_inverse[meta_aux] eval\\<o>_inverse[meta_aux]\n        make\\<Pi>\\<^sub>1_inverse[meta_aux] eval\\<Pi>\\<^sub>1_inverse[meta_aux]\n        make\\<Pi>\\<^sub>2_inverse[meta_aux] eval\\<Pi>\\<^sub>2_inverse[meta_aux]\n        make\\<Pi>\\<^sub>3_inverse[meta_aux] eval\\<Pi>\\<^sub>3_inverse[meta_aux]\nlemma \\<nu>\\<upsilon>_\\<omega>\\<nu>_is_\\<omega>\\<upsilon>[meta_aux]: \"\\<nu>\\<upsilon> (\\<omega>\\<nu> x) = \\<omega>\\<upsilon> x\" by (simp add: \\<nu>\\<upsilon>_def)\nlemma rep_proper_id[meta_aux]: \"rep (x\\<^sup>P) = x\"\n  by (simp add: meta_aux \\<nu>\\<kappa>_def rep_def)\nlemma \\<nu>\\<kappa>_proper[meta_aux]: \"proper (x\\<^sup>P)\"\n  by (simp add: meta_aux \\<nu>\\<kappa>_def proper_def)\nlemma no_\\<alpha>\\<omega>[meta_aux]: \"\\<not>(\\<nu>\\<upsilon> (\\<alpha>\\<nu> x) = \\<omega>\\<upsilon> y)\" by (simp add: \\<nu>\\<upsilon>_def)\nlemma no_\\<sigma>\\<omega>[meta_aux]: \"\\<not>(\\<sigma>\\<upsilon> x = \\<omega>\\<upsilon> y)\" by blast\nlemma \\<nu>\\<upsilon>_surj[meta_aux]: \"surj \\<nu>\\<upsilon>\"\n  using \\<alpha>\\<sigma>_surj unfolding \\<nu>\\<upsilon>_def surj_def\n  by (metis \\<nu>.simps(5) \\<nu>.simps(6) \\<upsilon>.exhaust comp_apply)\nlemma lambda\\<Pi>\\<^sub>1_aux[meta_aux]:\n  \"make\\<Pi>\\<^sub>1 (\\<lambda>u s w. \\<exists>x. \\<nu>\\<upsilon> x = u \\<and> eval\\<Pi>\\<^sub>1 F (\\<nu>\\<upsilon> x) s w) = F\"\n  proof -\n    have \"\\<And> u s w \\<phi> . (\\<exists> x . \\<nu>\\<upsilon> x = u \\<and> \\<phi> (\\<nu>\\<upsilon> x) (s::j) (w::i)) \\<longleftrightarrow> \\<phi> u s w\"\n      using \\<nu>\\<upsilon>_surj unfolding surj_def by metis\n    thus ?thesis apply transfer by simp\n  qed\nlemma lambda\\<Pi>\\<^sub>2_aux[meta_aux]:\n  \"make\\<Pi>\\<^sub>2 (\\<lambda>u v s w. \\<exists>x . \\<nu>\\<upsilon> x = u \\<and> (\\<exists> y . \\<nu>\\<upsilon> y = v \\<and> eval\\<Pi>\\<^sub>2 F (\\<nu>\\<upsilon> x) (\\<nu>\\<upsilon> y) s w)) = F\"\n  proof -\n    have \"\\<And> u v (s ::j) (w::i) \\<phi> .\n      (\\<exists> x . \\<nu>\\<upsilon> x = u \\<and> (\\<exists> y . \\<nu>\\<upsilon> y = v \\<and> \\<phi> (\\<nu>\\<upsilon> x) (\\<nu>\\<upsilon> y) s w))\n      \\<longleftrightarrow> \\<phi> u v s w\"\n      using \\<nu>\\<upsilon>_surj unfolding surj_def by metis\n    thus ?thesis apply transfer by simp\n  qed\nlemma lambda\\<Pi>\\<^sub>3_aux[meta_aux]:\n  \"make\\<Pi>\\<^sub>3 (\\<lambda>u v r s w. \\<exists>x. \\<nu>\\<upsilon> x = u \\<and> (\\<exists>y. \\<nu>\\<upsilon> y = v \\<and>\n   (\\<exists>z. \\<nu>\\<upsilon> z = r \\<and> eval\\<Pi>\\<^sub>3 F (\\<nu>\\<upsilon> x) (\\<nu>\\<upsilon> y) (\\<nu>\\<upsilon> z) s w))) = F\"\n  proof -\n    have \"\\<And> u v r (s::j) (w::i) \\<phi> . \\<exists>x. \\<nu>\\<upsilon> x = u \\<and> (\\<exists>y. \\<nu>\\<upsilon> y = v\n          \\<and> (\\<exists>z. \\<nu>\\<upsilon> z = r \\<and> \\<phi> (\\<nu>\\<upsilon> x) (\\<nu>\\<upsilon> y) (\\<nu>\\<upsilon> z) s w)) = \\<phi> u v r s w\"\n      using \\<nu>\\<upsilon>_surj unfolding surj_def by metis\n    thus ?thesis apply transfer apply (rule ext)+ by metis\n  qed\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/PLM/TAO_1_Embedding.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926666143434, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.3422622228836804}}
{"text": "section  \\<open>Syntax tree helpers\\<close>\n\ntheory CPSUtils\nimports CPSScheme\nbegin\n\ntext \\<open>\nThis theory defines the sets \\<open>lambdas p\\<close>, \\<open>calls p\\<close>, \\<open>calls p\\<close>, \\<open>vars p\\<close>, \\<open>labels p\\<close> and \\<open>prims p\\<close> as the subexpressions of the program \\<open>p\\<close>. Finiteness is shown for each of these sets, and some rules about how these sets relate. All these rules are proven more or less the same ways, which is very inelegant due to the nesting of the type and the shape of the derived induction rule.\n\nIt would be much nicer to start with these rules and define the set inductively. Unfortunately, that approach would make it very hard to show the finiteness of the sets in question.\n\\<close>\n\n\nfun lambdas :: \"lambda \\<Rightarrow> lambda set\"\nand lambdasC :: \"call \\<Rightarrow> lambda set\"\nand lambdasV :: \"val \\<Rightarrow> lambda set\"\nwhere \"lambdas  (Lambda l vs c) = ({Lambda l vs c} \\<union> lambdasC c)\"\n    | \"lambdasC (App l d ds) = lambdasV d \\<union> \\<Union> (lambdasV ` set ds)\"\n    | \"lambdasC (Let l binds c') = (\\<Union>(_, y)\\<in>set binds. lambdas y) \\<union> lambdasC c'\"\n    | \"lambdasV (L l) = lambdas l\"\n    | \"lambdasV _     = {}\"\n\nfun calls :: \"lambda \\<Rightarrow> call set\"\nand callsC :: \"call \\<Rightarrow> call set\"\nand callsV :: \"val \\<Rightarrow> call set\"\nwhere \"calls  (Lambda l vs c) = callsC c\"\n    | \"callsC (App l d ds) = {App l d ds} \\<union> callsV d \\<union> (\\<Union>(callsV ` (set ds)))\"\n    | \"callsC (Let l binds c') = {call.Let l binds c'} \\<union> ((\\<Union>(_, y)\\<in>set binds. calls y) \\<union> callsC c')\"\n    | \"callsV (L l) = calls l\"\n    | \"callsV _     = {}\"\n\nlemma finite_lambdas[simp]: \"finite (lambdas l)\" and \"finite (lambdasC c)\" \"finite (lambdasV v)\"\nby (induct rule: lambdas_lambdasC_lambdasV.induct, auto)\n\nlemma finite_calls[simp]: \"finite (calls l)\" and \"finite (callsC c)\" \"finite (callsV v)\"\nby (induct rule: calls_callsC_callsV.induct, auto)\n\nfun vars :: \"lambda \\<Rightarrow> var set\"\nand varsC :: \"call \\<Rightarrow> var set\"\nand varsV :: \"val \\<Rightarrow> var set\"\nwhere \"vars (Lambda _ vs c) = set vs \\<union> varsC c\"\n    | \"varsC (App _ a as) = varsV a \\<union> \\<Union>(varsV ` (set as))\"\n    | \"varsC (Let _ binds c') = (\\<Union>(v, l)\\<in>set binds. {v} \\<union> vars l) \\<union> varsC c'\"\n    | \"varsV (L l) = vars l\"\n    | \"varsV (R _ v) = {v}\"\n    | \"varsV _  = {}\"\n\n\n\nfun label :: \"lambda + call \\<Rightarrow> label\"\nwhere \"label (Inl (Lambda l _ _)) = l\"\n    | \"label (Inr (App l _ _)) = l\"\n    | \"label (Inr (Let l _ _)) = l\"\n\nfun labels :: \"lambda \\<Rightarrow> label set\"\nand labelsC :: \"call \\<Rightarrow> label set\"\nand labelsV :: \"val \\<Rightarrow> label set\"\nwhere \"labels (Lambda l vs c) = {l} \\<union> labelsC c\"\n    | \"labelsC (App l a as) = {l} \\<union> labelsV a \\<union> \\<Union>(labelsV ` (set as))\"\n    | \"labelsC (Let l binds c') = {l} \\<union> (\\<Union>(v, y)\\<in>set binds. labels y) \\<union> labelsC c'\"\n    | \"labelsV (L l) = labels l\"\n    | \"labelsV (R l _) = {l}\"\n    | \"labelsV _  = {}\"\n\nlemma finite_labels[simp]: \"finite (labels l)\" and \"finite (labelsC c)\" \"finite (labelsV v)\"\nby (induct rule: labels_labelsC_labelsV.induct, auto)\n\nfun prims :: \"lambda \\<Rightarrow> prim set\"\nand primsC :: \"call \\<Rightarrow> prim set\"\nand primsV :: \"val \\<Rightarrow> prim set\"\nwhere \"prims (Lambda _ vs c) = primsC c\"\n    | \"primsC (App _ a as) = primsV a \\<union> \\<Union>(primsV ` (set as))\"\n    | \"primsC (Let _ binds c') = (\\<Union>(_, y)\\<in>set binds. prims y) \\<union> primsC c'\"\n    | \"primsV (L l) = prims l\"\n    | \"primsV (R l v) = {}\"\n    | \"primsV (P prim) = {prim}\"\n    | \"primsV (C l v) = {}\"\n\nlemma finite_prims[simp]: \"finite (prims l)\" and \"finite (primsC c)\" \"finite (primsV v)\"\nby (induct rule: labels_labelsC_labelsV.induct, auto)\n\nfun vals :: \"lambda \\<Rightarrow> val set\"\nand valsC :: \"call \\<Rightarrow> val set\"\nand valsV :: \"val \\<Rightarrow> val set\"\nwhere \"vals (Lambda _ vs c) = valsC c\"\n    | \"valsC (App _ a as) = valsV a \\<union> \\<Union>(valsV ` (set as))\"\n    | \"valsC (Let _ binds c') = (\\<Union>(_, y)\\<in>set binds. vals y) \\<union> valsC c'\"\n    | \"valsV (L l) = {L l} \\<union> vals l\"\n    | \"valsV (R l v) = {R l v}\"\n    | \"valsV (P prim) = {P prim}\"\n    | \"valsV (C l v) = {C l v}\"\n\nlemma\n  fixes list2 :: \"(var \\<times> lambda) list\" and t :: \"var\\<times>lambda\"\n  shows lambdas1: \"Lambda l vs c \\<in> lambdas x \\<Longrightarrow> c \\<in> calls x\"\n  and \"Lambda l vs c \\<in> lambdasC y \\<Longrightarrow> c \\<in> callsC y\"\n  and \"Lambda l vs c \\<in> lambdasV z \\<Longrightarrow> c \\<in> callsV z\"\n  and \"\\<forall>z\\<in> set list. Lambda l vs c \\<in> lambdasV z \\<longrightarrow> c \\<in> callsV z\"\n  and \"\\<forall>x\\<in> set list2. Lambda l vs c \\<in> lambdas (snd x) \\<longrightarrow> c \\<in> calls (snd x)\"\n  and \"Lambda l vs c \\<in> lambdas (snd t) \\<Longrightarrow> c \\<in> calls (snd t)\"\napply (induct rule:mutual_lambda_call_var_inducts)\napply auto\napply (case_tac c, auto)[1]\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n  shows lambdas2: \"Lambda l vs c \\<in> lambdas x \\<Longrightarrow> l \\<in> labels x\"\n  and \"Lambda l vs c \\<in> lambdasC y \\<Longrightarrow> l \\<in> labelsC y\"\n  and \"Lambda l vs c \\<in> lambdasV z \\<Longrightarrow> l \\<in> labelsV z\"\n  and \"\\<forall>z\\<in> set list. Lambda l vs c \\<in> lambdasV z \\<longrightarrow> l \\<in> labelsV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . Lambda l vs c \\<in> lambdas (snd x) \\<longrightarrow> l \\<in> labels (snd x)\"\n  and \"Lambda l vs c \\<in> lambdas (snd (t:: var\\<times>lambda)) \\<Longrightarrow> l \\<in> labels (snd t)\"\napply (induct rule:mutual_lambda_call_var_inducts)\napply auto\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n  shows lambdas3: \"Lambda l vs c \\<in> lambdas x \\<Longrightarrow> set vs \\<subseteq> vars x\"\n  and \"Lambda l vs c \\<in> lambdasC y \\<Longrightarrow> set vs \\<subseteq> varsC y\"\n  and \"Lambda l vs c \\<in> lambdasV z \\<Longrightarrow> set vs \\<subseteq> varsV z\"\n  and \"\\<forall>z\\<in> set list. Lambda l vs c \\<in> lambdasV z \\<longrightarrow> set vs \\<subseteq> varsV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . Lambda l vs c \\<in> lambdas (snd x) \\<longrightarrow> set vs \\<subseteq> vars (snd x)\"\n  and \"Lambda l vs c \\<in> lambdas (snd (t:: var\\<times>lambda)) \\<Longrightarrow> set vs \\<subseteq> vars (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((aa, ba), bb)\" in ballE)\napply (rule_tac x=\"((aa, ba), bb)\" in bexI, auto)\ndone\n\nlemma \n  shows app1: \"App l d ds \\<in> calls x \\<Longrightarrow> d \\<in> vals x\"\n  and \"App l d ds \\<in> callsC y \\<Longrightarrow> d \\<in> valsC y\"\n  and \"App l d ds \\<in> callsV z \\<Longrightarrow> d \\<in> valsV z\"\n  and \"\\<forall>z\\<in> set list. App l d ds \\<in> callsV z \\<longrightarrow> d \\<in> valsV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . App l d ds \\<in> calls (snd x) \\<longrightarrow> d \\<in> vals (snd x)\"\n  and \"App l d ds \\<in> calls (snd (t:: var\\<times>lambda)) \\<Longrightarrow> d \\<in> vals (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (case_tac d, auto)\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n  shows app2: \"App l d ds \\<in> calls x \\<Longrightarrow> set ds \\<subseteq> vals x\"\n  and \"App l d ds \\<in> callsC y \\<Longrightarrow> set ds \\<subseteq> valsC y\"\n  and \"App l d ds \\<in> callsV z \\<Longrightarrow> set ds \\<subseteq> valsV z\"\n  and \"\\<forall>z\\<in> set list. App l d ds \\<in> callsV z \\<longrightarrow> set ds \\<subseteq> valsV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . App l d ds \\<in> calls (snd x) \\<longrightarrow> set ds \\<subseteq> vals (snd x)\"\n  and \"App l d ds \\<in> calls (snd (t:: var\\<times>lambda)) \\<Longrightarrow> set ds \\<subseteq> vals (snd t)\"\napply (induct  x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (case_tac x, auto)\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n  shows let1: \"Let l binds c' \\<in> calls x \\<Longrightarrow> l \\<in> labels x\"\n  and \"Let l binds c' \\<in> callsC y \\<Longrightarrow> l \\<in> labelsC y\"\n  and \"Let l binds c' \\<in> callsV z \\<Longrightarrow> l \\<in> labelsV z\"\n  and \"\\<forall>z\\<in> set list. Let l binds c' \\<in> callsV z \\<longrightarrow> l \\<in> labelsV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . Let l binds c' \\<in> calls (snd x) \\<longrightarrow> l \\<in> labels (snd x)\"\n  and \"Let l binds c' \\<in> calls (snd (t:: var\\<times>lambda)) \\<Longrightarrow> l \\<in> labels (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n  shows let2: \"Let l binds c' \\<in> calls x \\<Longrightarrow> c' \\<in> calls x\"\n  and \"Let l binds c' \\<in> callsC y \\<Longrightarrow> c' \\<in> callsC y\"\n  and \"Let l binds c' \\<in> callsV z \\<Longrightarrow> c' \\<in> callsV z\"\n  and \"\\<forall>z\\<in> set list. Let l binds c' \\<in> callsV z \\<longrightarrow> c' \\<in> callsV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . Let l binds c' \\<in> calls (snd x) \\<longrightarrow> c' \\<in> calls (snd x)\"\n  and \"Let l binds c' \\<in> calls (snd (t:: var\\<times>lambda)) \\<Longrightarrow> c' \\<in> calls (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (case_tac c', auto)\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma \n  shows let3: \"Let l binds c' \\<in> calls x \\<Longrightarrow> fst ` set binds \\<subseteq> vars x\"\n  and \"Let l binds c' \\<in> callsC y \\<Longrightarrow> fst ` set binds \\<subseteq> varsC y\"\n  and \"Let l binds c' \\<in> callsV z \\<Longrightarrow> fst ` set binds \\<subseteq> varsV z\"\n  and \"\\<forall>z\\<in> set list. Let l binds c' \\<in> callsV z \\<longrightarrow> fst ` set binds \\<subseteq> varsV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . Let l binds c' \\<in> calls (snd x) \\<longrightarrow> fst ` set binds \\<subseteq> vars (snd x)\"\n  and \"Let l binds c' \\<in> calls (snd (t:: var\\<times>lambda)) \\<Longrightarrow> fst ` set binds \\<subseteq> vars (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((ab, bc), bd)\" in ballE)\napply (rule_tac x=\"((ab, bc), bd)\" in bexI, auto)\ndone\n\nlemma\n  shows let4: \"Let l binds c' \\<in> calls x \\<Longrightarrow> snd ` set binds \\<subseteq> lambdas x\"\n  and \"Let l binds c' \\<in> callsC y \\<Longrightarrow> snd ` set binds \\<subseteq> lambdasC y\"\n  and \"Let l binds c' \\<in> callsV z \\<Longrightarrow> snd ` set binds \\<subseteq> lambdasV z\"\n  and \"\\<forall>z\\<in> set list. Let l binds c' \\<in> callsV z \\<longrightarrow> snd ` set binds \\<subseteq> lambdasV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . Let l binds c' \\<in> calls (snd x) \\<longrightarrow> snd ` set binds \\<subseteq> lambdas (snd x)\"\n  and \"Let l binds c' \\<in> calls (snd (t:: var\\<times>lambda)) \\<Longrightarrow> snd ` set binds \\<subseteq> lambdas (snd t)\"\napply (induct x and y and z and list and list2 and t rule:mutual_lambda_call_var_inducts)\napply auto\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\napply (case_tac ba, auto)\napply (erule_tac x=\"((aa, bb), bc)\" in ballE)\napply (rule_tac x=\"((aa, bb), bc)\" in bexI, auto)\ndone\n\nlemma\nshows vals1: \"P prim \\<in> vals p \\<Longrightarrow> prim \\<in> prims p\"\n  and \"P prim \\<in> valsC y \\<Longrightarrow> prim \\<in> primsC y\"\n  and \"P prim \\<in> valsV z \\<Longrightarrow> prim \\<in> primsV z\"\n  and \"\\<forall>z\\<in> set list. P prim \\<in> valsV z \\<longrightarrow> prim \\<in> primsV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . P prim \\<in> vals (snd x) \\<longrightarrow> prim \\<in> prims (snd x)\"\n  and \"P prim \\<in> vals (snd (t:: var\\<times>lambda)) \\<Longrightarrow> prim \\<in> prims (snd t)\"\napply (induct rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma\nshows vals2: \"R l var \\<in> vals p \\<Longrightarrow> var \\<in> vars p\"\n  and \"R l var \\<in> valsC y \\<Longrightarrow> var \\<in> varsC y\"\n  and \"R l var \\<in> valsV z \\<Longrightarrow> var \\<in> varsV z\"\n  and \"\\<forall>z\\<in> set list. R l var \\<in> valsV z \\<longrightarrow> var \\<in> varsV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . R l var \\<in> vals (snd x) \\<longrightarrow> var \\<in> vars (snd x)\"\n  and \"R l var \\<in> vals (snd (t:: var\\<times>lambda)) \\<Longrightarrow> var \\<in> vars (snd t)\"\napply (induct rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\ndone\n\nlemma\nshows vals3: \"L l \\<in> vals p \\<Longrightarrow> l \\<in> lambdas p\"\n  and \"L l \\<in> valsC y \\<Longrightarrow> l \\<in> lambdasC y\"\n  and \"L l \\<in> valsV z \\<Longrightarrow> l \\<in> lambdasV z\"\n  and \"\\<forall>z\\<in> set list. L l \\<in> valsV z \\<longrightarrow> l \\<in> lambdasV z\"\n  and \"\\<forall>x\\<in> set (list2 :: (var \\<times> lambda) list) . L l \\<in> vals (snd x) \\<longrightarrow> l \\<in> lambdas (snd x)\"\n  and \"L l \\<in> vals (snd (t:: var\\<times>lambda)) \\<Longrightarrow> l \\<in> lambdas (snd t)\"\napply (induct rule:mutual_lambda_call_var_inducts)\napply auto\napply (erule_tac x=\"((a, b), ba)\" in ballE)\napply (rule_tac x=\"((a, b), ba)\" in bexI, auto)\napply (case_tac l, auto)\ndone\n\n\ndefinition nList :: \"'a set => nat => 'a list set\"\nwhere \"nList A n \\<equiv> {l. set l \\<le> A \\<and> length l = n}\"\n\n\n\ndefinition NList :: \"'a set => nat set => 'a list set\"\nwhere \"NList A N \\<equiv> \\<Union> n \\<in> N. nList A n\"\n\nlemma finite_Nlist[intro]:\n  \"\\<lbrakk> finite A; finite N \\<rbrakk> \\<Longrightarrow> finite (NList A N)\"\nunfolding NList_def by auto\n\ndefinition call_list_lengths\n  where \"call_list_lengths p = {0,1,2,3} \\<union> (\\<lambda>c. case c of (App _ _ ds) \\<Rightarrow> length ds | _ \\<Rightarrow> 0) ` calls p\"\n\nlemma finite_call_list_lengths[simp]: \"finite (call_list_lengths p)\"\n  unfolding call_list_lengths_def by auto\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Shivers-CFA/CPSUtils.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.3422622145739089}}
{"text": "(*<*)\ntheory GewirthArgument\n  imports ExtendedDDL\nbegin\nnitpick_params[user_axioms=true, show_all, expect=genuine, format = 3] \n(*>*)\n\ntext\\<open>\\noindent{Before starting our formalisation in the next section. We show that the axioms defined so far are consistent.\nRather surprisingly, the \\emph{nunchaku} model finder states that no model has been found, while \\emph{nitpick}\nis indeed able to find one:}\\<close>\nlemma True nunchaku[satisfy] nitpick[satisfy] oops\n\nsection \\<open>Gewith's Argument for the Principle of Generic Consistency (PGC)\\<close>\n\ntext\\<open>\\noindent{Alan Gewirth's meta-ethical position is known as moral (or ethical) rationalism. According to it, moral principles are knowable \\emph{a priori},\nby reason alone.\nImmanuel Kant is perhaps the most famous figure who has defended such a position. He has argued for the existence of upper moral principles\n(e.g. his \"categorical imperative\")\nfrom which we can reason (in a top-down fashion) in order to deduce and evaluate other more concrete maxims and actions.\nIn contrast to Kant, Gewirth attempts to derive such upper moral principles by starting from non-moral considerations alone, namely from\nan agent's self-reflection.\nGewirth's Principle of Generic Consistency (PGC) asserts that any agent (by virtue of its self-understanding as an agent) is rationally committed\nto asserting that (i) it has rights to freedom and well-being, and (ii) that all other agents have those same rights. Gewirth claims that, in his informal proof,\nthe latter generalisation step (from \"I\" to all individuals) is done on purely logical grounds and does not presuppose any kind of universal moral principle.\nGewirth's result is thus meant to hold with some kind of apodicticity (i.e.~necessity).\nDeryck Beyleveld, author of an authoritative book on Gewirth's argument, puts it this way:\n\"The argument purports to establish the PGC as a rationally necessary proposition with an apodictic status\n\\emph{for any PPA} equivalent to that enjoyed by the logical principle of noncontradiction itself.\" (@{cite \"Beyleveld\"} p. 1) \nIf this is correct, then he succeeded in the task that Kant set himself, i.e.~to found certain basic principles of morality in reason alone.}\\<close>\ntext\\<open>\\noindent{The argument for the PGC  employs what Gewirth calls \"the dialectically necessary method\" within the \"internal viewpoint\" (perspective) of an agent.\nAlthough the drawn inferences are relative to the reasoning agent, Gewirth further argues that\n\"the dialectically necessary method propounds the contents of this relativity\nas necessary ones, since the statements it presents reflect judgements all agents necessarily make on the basis of what is necessarily\ninvolved in their actions ... The statements the method attributes to the agent are set forth as necessary ones in that they reflect what is conceptually\nnecessary to being an agent who voluntarily or freely acts for purposes he wants to attain.\" (@{cite \"GewirthRM\"}).\nIn other words, the \"dialectical necessity\" of the assertions and inferences made in the argument comes from the definitional features (conceptual analysis)\nof the involved notions of agency, purposeful action, obligation, rights, etc. Hence the alternative notions of logical (i.e.~indexical) validity\nand 'a priori necessity', developed in Kaplan's logical framework LD, have been considered by us as appropriate to model this kind of \"dialectical necessity\".}\\<close>\n\nsubsection \\<open>Conceptual Explications\\<close>\n\ntype_synonym p = \"e\\<Rightarrow>m\" \\<comment> \\<open> Type for properties (function from individuals to sentence meanings) \\<close>\n\nsubsubsection \\<open>Agency\\<close>\n\ntext\\<open>\\noindent{The type chosen to represent what Gewirth calls \"purposes\" is not essential for the argument's validity.\nWe choose to give \"purposes\" the same type as sentence meanings (type 'm'), so \"acting on a purpose\" would be\nrepresented in an analogous way to having a certain propositional attitude (e.g. \"desiring that some proposition obtains\"). }\\<close>\nconsts ActsOnPurpose:: \"e\\<Rightarrow>m\\<Rightarrow>m\" \\<comment> \\<open>  ActsOnPurpose(A,E) gives the meaning of the sentence \"A is acting on purpose E\" \\<close>\nconsts NeedsForPurpose:: \"e\\<Rightarrow>p\\<Rightarrow>m\\<Rightarrow>m\" \\<comment> \\<open>  NeedsForPurpose(A,P,E) gives the meaning of \"A needs to have property P in order to reach purpose E\" \\<close>\n\ntext\\<open>\\noindent{In Gewirth's argument, an individual with agency (i.e.~capable of purposive action) is said to be a PPA (prospective purposive agent).}\\<close>\ndefinition PPA:: \"p\" where \"PPA a \\<equiv> \\<^bold>\\<exists>E. ActsOnPurpose a E\" \\<comment> \\<open>  Definition of PPA \\<close>\n\ntext\\<open>\\noindent{We have added the following axiom in order to guarantee the argument's logical correctness. It basically says that being\na PPA is identity-constitutive for an individual (i.e.~it's an essential property).}\\<close>\naxiomatization where essentialPPA: \"\\<lfloor>\\<^bold>\\<forall>a. PPA a \\<^bold>\\<rightarrow> \\<^bold>\\<box>\\<^sup>D(PPA a)\\<rfloor>\\<^sup>D\" \\<comment> \\<open> being a PPA is an essential property \\<close>\n\ntext\\<open>\\noindent{Quite interestingly, the axiom above entails, as a corollary, a kind of ability for a PPA to recognise other PPAs.\nFor instance, if some individual holds itself as a PPA (i.e.~seen from its own perspective/context 'd') then this individual\n(Agent(d)) is considered as a PPA from any other agent's perspective/context 'c'.}\\<close>\nlemma recognizeOtherPPA: \"\\<forall>c d. \\<lfloor>PPA (Agent d)\\<rfloor>\\<^sub>d \\<longrightarrow> \\<lfloor>PPA (Agent d)\\<rfloor>\\<^sub>c\" using essentialPPA by blast\n\n\nsubsubsection \\<open>Goodness\\<close>\n\ntext\\<open>\\noindent{Gewirth's concept of (subjective) goodness, as employed in his argument, applies to purposes and is relative to some agent.\nIt is therefore modelled as a binary relation relating an individual (type 'e') with a purpose (type 'm').\nOther readings given by Gewirth's for the expression \"P is good for A\" include among others: \"A attaches a positive value to P\",\n\"A values P proactively\" and \"A is motivated to achieve P\".}\\<close>\nconsts Good::\"e\\<Rightarrow>m\\<Rightarrow>m\"\n\ntext\\<open>\\noindent{The following axioms interrelate the concept of goodness with the concept of agency, thus providing\nthe above concepts with some meaning (by framing their inferential roles). Notice that such meaning-constitutive\naxioms (which we call \"explications\") are given as indexically valid (i.e.~a priori) sentences.}\\<close>\naxiomatization where explicationGoodness1: \"\\<lfloor>\\<^bold>\\<forall>a P. ActsOnPurpose a P \\<^bold>\\<rightarrow> Good a P\\<rfloor>\\<^sup>D\"\naxiomatization where explicationGoodness2: \"\\<lfloor>\\<^bold>\\<forall>P M a. Good a P \\<^bold>\\<and> NeedsForPurpose a M P \\<^bold>\\<rightarrow> Good a (M a)\\<rfloor>\\<^sup>D\"\naxiomatization where explicationGoodness3: \"\\<lfloor>\\<^bold>\\<forall>\\<phi> a. \\<^bold>\\<diamond>\\<^sub>p\\<phi> \\<^bold>\\<rightarrow> \\<^bold>O\\<langle>\\<phi> | \\<^bold>\\<box>\\<^sup>DGood a \\<phi>\\<rangle>\\<rfloor>\\<^sup>D\"\n\ntext\\<open>\\noindent{Below we show that all axioms defined so far are consistent:}\\<close>\nlemma True nitpick[satisfy, card c = 1, card e = 1, card w = 1] oops \\<comment> \\<open> one-world model found (card w=1) \\<close>\n\n\ntext\\<open>\\noindent{The first two assertions above have been explicitly provided by Gewirth as premises of his argument.\nThe third axiom, however, has been added by us as an implicit premise in order to render Gewirth's proof as correct.\nThis axiom aims at representing the intuitive notion of \"seeking the good\". In particular, it asserts\nthat, from the point of view of an agent, necessarily good purposes are not only action motivating,\nbut also entail an instrumental obligation to their realisation. The notion of necessity here involved \nis not the usual alethic one (which is represented in DDL with the modal box operators \\<open>\\<^bold>\\<box>\\<^sub>a\\<close> and \\<open>\\<^bold>\\<box>\\<^sub>p\\<close>), but the linguistic one\nintroduced above (\\<open>\\<^bold>\\<box>\\<^sup>D\\<close>) derived from indexical validity, signaling that an agent holds some\npurpose as being true almost 'by definition' (i.e.~a priori).\nThis sets quite high standards for the kind of purposes an agent would ever take to be (instrumentally) obligatory and is \nindeed the weakest implicit premise we could come up with so far (taking away the \\<open>\\<^bold>\\<box>\\<^sup>D\\<close> 'a priori necessity' operator\nwould indeed make this premise much stronger and our proof less credible).}\\<close>\n\nsubsubsection \\<open>Freedom and Well-Being\\<close>\n\ntext\\<open>\\noindent{According to Gewirth, enjoying freedom and well-being (which we take together as a predicate: FWB) is the property \nwhich represents the \"necessary conditions\" or \"generic features\" of agency (i.e.~being capable of purposeful action).\nGewirth argues, the property of enjoying freedom and well-being (FWB) is special amongst other action-enabling properties,\nin that it is always required in order to act on any purpose (no matter which one).}\\<close>\n\nconsts FWB::\"p\" \\<comment> \\<open> Enjoying freedom and well-being (FWB) is a property (i.e.~has type @{text \"e\\<Rightarrow>m\"}) \\<close>\n\naxiomatization where\nexplicationFWB1: \"\\<lfloor>\\<^bold>\\<forall>P a. NeedsForPurpose a FWB P\\<rfloor>\\<^sup>D\"\n\ntext\\<open>\\noindent{We use model finder \\emph{nitpick} to verify that all axioms defined so far are consistent.\n\\emph{Nitpick} can indeed find a 'small' model with cardinality one for the sets of worlds and contexts.}\\<close>\nlemma True nitpick[satisfy, card c = 1, card e = 1, card w = 1] oops \\<comment> \\<open> one-world model found  \\<close>\n\ntext\\<open>\\noindent{At some point in Gewirth's argument we have to show that there exists an (instrumental) obligation to enjoying freedom and well-being (FWB).\nSince, according to the so-called \"Kant's law\" (which is a corollary of DDL), impossible or necessary things cannot be obligatory,\nwe can reasonably demand that\nFWB be (metaphysically) possible for every agent. As before, we take this demand to be an a priori\ncharacteristic of the concept of FWB and therefore axiomatise it as an indexically valid sentence.}\\<close>\naxiomatization where explicationFWB2: \"\\<lfloor>\\<^bold>\\<forall>a. \\<^bold>\\<diamond>\\<^sub>p FWB a\\<rfloor>\\<^sup>D\"  \naxiomatization where explicationFWB3: \"\\<lfloor>\\<^bold>\\<forall>a. \\<^bold>\\<diamond>\\<^sub>p \\<^bold>\\<not>FWB a\\<rfloor>\\<^sup>D\"  \n\ntext\\<open>\\noindent{As a result of enforcing the contingency of FWB, the models found by \\emph{nitpick} now have a cardinality\nof two for the set of worlds:}\\<close>\nlemma True nitpick[satisfy, card c = 1, card e = 1, card w = 1, expect=none] oops \\<comment> \\<open> no model found for one-world models \\<close>\nlemma True nitpick[satisfy, card c = 1, card e = 1, card w = 2] oops \\<comment> \\<open> models need now at least two worlds \\<close>\n\nsubsubsection \\<open>Obligation and Interference\\<close>\n\ntext\\<open>\\noindent{ Kant's Law (\"ought implies can\") is derivable directly from DDL: If \\<open>\\<phi>\\<close> oughts to obtain then \\<open>\\<phi>\\<close> is possible.\nNote that we will use for the formalisation of Gewirth's argument the DDL ideal obligation operator (\\<open>\\<^bold>O\\<^sub>i\\<close>) but\nwe could have also used (mutatis mutandis) the DDL actual obligation operator (\\<open>\\<^bold>O\\<^sub>a\\<close>).}\\<close>\nlemma \"\\<lfloor>\\<^bold>O\\<^sub>i\\<phi> \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>\\<^sub>p\\<phi>\\<rfloor>\" using sem_5ab by simp\n\n\ntext\\<open>\\noindent{Furthermore, we have seen the need to postulate the following (implicit) premise in order to validate the argument.\nThis axiom can be seen as a variation of the so-called Kant's law (\"ought implies can\"), i.e.~an impossible act cannot be obligatory.\nIn the same vein, our variation can be read as \"ought implies ought to can\" and is closer to Gewirth's own description:\nthat having an obligation to do X implies that \"I ought (in the same sense and the same criterion) to be free to do X,\nthat I ought not to be prevented from doing X, that my capacity to do X ought not to be interfered with.\" (@{cite \"GewirthRM\"} p. 91-95)}\\<close>\naxiomatization where OIOAC: \"\\<lfloor>\\<^bold>O\\<^sub>i\\<phi> \\<^bold>\\<rightarrow> \\<^bold>O\\<^sub>i(\\<^bold>\\<diamond>\\<^sub>a\\<phi>)\\<rfloor>\\<^sup>D\"\n\ntext\\<open>\\noindent{Concerning the concept of interference, we state that the existence of an individual (successfully) interfering\nwith some state of affairs S implies that S cannot possibly obtain in any of the actually possible situations (and the other way round).\nNote that for this definition we have employed a possibility operator (\\<open>\\<^bold>\\<diamond>\\<^sub>a\\<close>) which is weaker than metaphysical\npossibility (\\<open>\\<^bold>\\<diamond>\\<^sub>p\\<close>) (see Carmo and Jones DDL framework @{cite \"CJDDL\"} for details).\nAlso note that we have also employed the (stronger) classical notion of modal\nvalidity instead of indexical validity. (So far we haven't been able to get theorem provers and model finders to prove/disprove\nGewirth's proof if formalizing this axiom as simply indexically valid.)}\\<close>\n\nconsts InterferesWith::\"e\\<Rightarrow>m\\<Rightarrow>m\" \\<comment> \\<open> an individual can interfere with some state of affairs (from obtaining) \\<close>\naxiomatization where explicationInterference: \"\\<lfloor>(\\<^bold>\\<exists>b. InterferesWith b \\<phi>) \\<^bold>\\<leftrightarrow> \\<^bold>\\<not>\\<^bold>\\<diamond>\\<^sub>a\\<phi>\\<rfloor>\"\n\ntext\\<open>\\noindent{From the previous axiom we can prove following corollaries: If someone (successfully) interferes with agent 'a' having FWB,\nthen 'a' can no longer possibly enjoy its FWB (and the other way round).}\\<close>\nlemma \"\\<lfloor>\\<^bold>\\<forall>a. (\\<^bold>\\<exists>b. InterferesWith b (FWB a)) \\<^bold>\\<leftrightarrow> \\<^bold>\\<not>\\<^bold>\\<diamond>\\<^sub>a(FWB a)\\<rfloor>\" using explicationInterference by blast\nlemma InterferenceWithFWB: \"\\<lfloor>\\<^bold>\\<forall>a.  \\<^bold>\\<diamond>\\<^sub>a(FWB a) \\<^bold>\\<leftrightarrow> (\\<^bold>\\<forall>b. \\<^bold>\\<not>InterferesWith b (FWB a))\\<rfloor>\" using explicationInterference by blast\n\nsubsubsection \\<open>Rights and Other-Directed Obligations\\<close>\n \ntext\\<open>\\noindent{Gewirth points out the existence of a correlation between an agent's own claim rights and other-referring obligations (see e.g. @{cite \"GewirthRM\"}, p. 66).\nA claim right is a right which entails duties or obligations on other agents regarding the right-holder\n(so-called Hohfeldian claim rights in legal theory).\nWe model this concept of claim rights in such a way that an individual 'a' has a (claim) right to some property 'P' if and only if\nit is obligatory that every\n(other) individual 'b' does not interfere with the state of affairs 'P(a)' from obtaining.\nSince there is no particular individual to whom this directive is addressed, this obligation has been referred to by Gewirth as being \"other-directed\"\n(aka. \"other-referring\") in contrast to \"other-directing\" obligations which entail a moral obligation for some particular subject (@{cite \"Beyleveld\"} p. 41,51).\nThis latter distinction is essential to Gewirth's argument.}\\<close>\ndefinition RightTo::\"e\\<Rightarrow>(e\\<Rightarrow>m)\\<Rightarrow>m\" where \"RightTo a \\<phi> \\<equiv> \\<^bold>O\\<^sub>i(\\<^bold>\\<forall>b. \\<^bold>\\<not>InterferesWith b (\\<phi> a))\"\n\ntext\\<open>\\noindent{Now that all needed axioms and definitions are in place, we use model finder \\emph{nitpick} to show that\nthey are consistent:}\\<close>\nlemma True nitpick[satisfy, card c = 1, card e = 1, card w = 2] oops \\<comment> \\<open> models with at least two worlds found \\<close>\n\nsubsection \\<open>Formal Proof of Gewirth's Argument for the PGC\\<close>\n\ntext\\<open>\\noindent{Following Beyleveld's summary (@{cite \"Beyleveld\"}, ch. 2), the main steps of the argument are (with original numbering): }\\<close>\ntext\\<open>\\noindent{(1) I act voluntarily for some (freely chosen) purpose E (equivalent --by definition-- to: I am a PPA).}\\<close>\ntext\\<open>\\noindent{(2) E is (subjectively) good (i.e.~I value E proactively).}\\<close>\ntext\\<open>\\noindent{(3) My freedom and well-being (FWB) are generically necessary conditions of my agency (i.e.~I need them to achieve any purpose whatsoever).}\\<close>\ntext\\<open>\\noindent{(4) My FWB are necessary goods (at least for me).}\\<close>\ntext\\<open>\\noindent{(5) I (even if no one else) have a claim right to my FWB.}\\<close>\ntext\\<open>\\noindent{(13) Every PPA has a claim right to their FWB.}\\<close>\n\nsubsubsection \\<open>Weak Variant\\<close>\ntext\\<open>\\noindent{In the following we present a formalised proof for a weak variant of the Principle of Generic Consistency (PGC),\nwhich asserts that the following sentence is valid from every PPA's standpoint:\n\"I (as a PPA) have a claim right to my freedom and well-being\".}\\<close>\ntheorem PGC_weak: shows \"\\<forall>C. \\<lfloor>PPA (Agent C) \\<^bold>\\<rightarrow> (RightTo (Agent C) FWB)\\<rfloor>\\<^sub>C\"\nproof - {\n  fix C::c \\<comment> \\<open> 'C' is some arbitrarily chosen context (agent's perspective) \\<close>\n  let ?I = \"(Agent C)\" \\<comment> \\<open> 'I' is/am the agent with perspective 'C' \\<close>\n  {\n    fix E::m \\<comment> \\<open> 'E' is some arbitrarily chosen purpose \\<close>\n    {\n      assume P1: \"\\<lfloor>ActsOnPurpose ?I E\\<rfloor>\\<^sub>C\" \\<comment> \\<open> (1) I act voluntarily on purpose E \\<close>\n      from P1 have P1a: \"\\<lfloor>PPA ?I\\<rfloor>\\<^sub>C\" using PPA_def by auto \\<comment> \\<open> (1a) I am a PPA \\<close>\n      from P1 have C2: \"\\<lfloor>Good ?I E\\<rfloor>\\<^sub>C\" using explicationGoodness1 essentialPPA by meson \\<comment> \\<open> (2) purpose E is good for me \\<close>\n      from explicationFWB1 have C3: \"\\<lfloor>\\<^bold>\\<forall>P. NeedsForPurpose ?I FWB P\\<rfloor>\\<^sup>D\" by simp \\<comment> \\<open> (3) I need FWB for any purpose whatsoever \\<close>\n      hence \"\\<exists>P.\\<lfloor>Good ?I P \\<^bold>\\<and> NeedsForPurpose ?I FWB P\\<rfloor>\\<^sup>D\" using explicationFWB2 explicationGoodness3 sem_5ab by blast\n      hence \"\\<lfloor>Good ?I (FWB ?I)\\<rfloor>\\<^sup>D\" using explicationGoodness2 by blast \\<comment> \\<open> FWB is (a priori) good for me (in a kind of definitional sense) \\<close>\n      hence C4: \"\\<lfloor>\\<^bold>\\<box>\\<^sup>D(Good ?I (FWB ?I))\\<rfloor>\\<^sub>C\" by simp \\<comment> \\<open> (4) FWB is an (a priori) necessary good for me \\<close> \n      have \"\\<lfloor>\\<^bold>O\\<langle>FWB ?I | \\<^bold>\\<box>\\<^sup>D(Good ?I) (FWB ?I)\\<rangle>\\<rfloor>\\<^sub>C\" using explicationGoodness3 explicationFWB2 by blast \\<comment> \\<open> I ought to pursue my FWB on the condition that I consider it to be a necessary good \\<close>\n      hence \"\\<lfloor>\\<^bold>O\\<^sub>i(FWB ?I)\\<rfloor>\\<^sub>C\" using explicationFWB2 explicationFWB3 C4 CJ_14p by fastforce \\<comment> \\<open> There is an (other-directed) obligation to my FWB \\<close>\n      hence \"\\<lfloor>\\<^bold>O\\<^sub>i(\\<^bold>\\<diamond>\\<^sub>a(FWB ?I))\\<rfloor>\\<^sub>C\" using OIOAC by simp \\<comment> \\<open> It must therefore be the case that my FWB is possible \\<close>\n      hence \"\\<lfloor>\\<^bold>O\\<^sub>i(\\<^bold>\\<forall>a. \\<^bold>\\<not>InterferesWith a (FWB ?I))\\<rfloor>\\<^sub>C\" using InterferenceWithFWB by simp \\<comment> \\<open> There is an obligation for others not to interfere with my FWB  \\<close>\n      hence C5: \"\\<lfloor>RightTo ?I FWB\\<rfloor>\\<^sub>C\" using RightTo_def by simp \\<comment> \\<open> (5) I have a claim right to my freedom and well-being \\<close>\n    }\n    hence \"\\<lfloor>ActsOnPurpose ?I E \\<^bold>\\<rightarrow> RightTo ?I FWB\\<rfloor>\\<^sub>C\" by (rule impI) \\<comment> \\<open> I have a claim right to my freedom and well-being (since I act on some purpose E) \\<close>\n  }\n  hence \"\\<lfloor>\\<^bold>\\<forall>P. ActsOnPurpose ?I P \\<^bold>\\<rightarrow> RightTo ?I FWB\\<rfloor>\\<^sub>C\" by (rule allI) \\<comment> \\<open>  \"allI\" is a logical generalisation rule: \"all-quantifier introduction\" \\<close>\n  hence \"\\<lfloor>PPA ?I \\<^bold>\\<rightarrow> RightTo ?I FWB\\<rfloor>\\<^sub>C\" using PPA_def by simp \\<comment> \\<open> (seen from my perspective C) I have a claim right to my freedom and well-being since I am a PPA \\<close>\n  hence \"\\<lfloor>PPA (Agent C) \\<^bold>\\<rightarrow> RightTo (Agent C) FWB\\<rfloor>\\<^sub>C\" by simp \\<comment> \\<open> (seen from the perspective C) C's agent has a claim right to its freedom and well-being since it is a PPA \\<close>\n}\n  thus C13: \"\\<forall>C. \\<lfloor>PPA (Agent C) \\<^bold>\\<rightarrow> (RightTo (Agent C) FWB)\\<rfloor>\\<^sub>C\" by (rule allI) \\<comment> \\<open> (13) For every perspective C: C's agent has a claim right to its freedom and well-being \\<close>\nqed\n\ntext\\<open>\\noindent{Regarding the last inference step, given that the context (agent's perspective) 'C' has been arbitrarily fixed at the beginning, we can use again the \"all-quantifier introduction\" rule\nto generalise the previous assertion to all possible contexts 'C' (and agents 'Agent(C)').\nNote that the generalisation from \"I\" to all individuals has been done on purely logical grounds and does not involve any kind of universal moral principle.\nThis is a main requirement Gewirth has set for his argument.}\\<close>\n\nsubsubsection \\<open>Strong Variant\\<close>\ntext\\<open>\\noindent{This is a proof for a stronger variant of the PGC, which asserts that the following\nsentence is valid from every PPA's standpoint: \"Every PPA has a claim right to its freedom and well-being (FWB)\".}\\<close>\n\ntheorem PGC_strong: shows \"\\<lfloor>\\<^bold>\\<forall>x. PPA x \\<^bold>\\<rightarrow> (RightTo x FWB)\\<rfloor>\\<^sup>D\"\nproof - {\nfix C::c  \\<comment> \\<open> 'C' is some arbitrarily chosen context (agent's perspective) \\<close>\n{\n  fix I::\"e\"  \\<comment> \\<open> 'I' is some arbitrarily chosen individual (agent's perspective) \\<close> \n  {\n    fix E::m  \\<comment> \\<open> 'E' is some arbitrarily chosen purpose \\<close>\n    {     \n     assume P1: \"\\<lfloor>ActsOnPurpose I E\\<rfloor>\\<^sub>C\" \\<comment> \\<open> (1) I act voluntarily on purpose E \\<close>     \n     from P1 have P1a: \"\\<lfloor>PPA I\\<rfloor>\\<^sub>C\" using PPA_def by auto  \\<comment> \\<open> (1a) I am a PPA \\<close>     \n     from P1 have C2: \"\\<lfloor>Good I E\\<rfloor>\\<^sub>C\" using explicationGoodness1 essentialPPA by meson  \\<comment> \\<open> (2) purpose E is good for me \\<close>\n     from explicationFWB1 have C3: \"\\<lfloor>\\<^bold>\\<forall>P. NeedsForPurpose I FWB P\\<rfloor>\\<^sup>D\" by simp  \\<comment> \\<open> (3) I need FWB for any purpose whatsoever \\<close>\n     hence \"\\<exists>P.\\<lfloor>Good I P \\<^bold>\\<and> NeedsForPurpose I FWB P\\<rfloor>\\<^sup>D\" using explicationFWB2 explicationGoodness3 sem_5ab by blast     \n     hence \"\\<lfloor>Good I (FWB I)\\<rfloor>\\<^sup>D\" using explicationGoodness2 by blast  \\<comment> \\<open> FWB is (a priori) good for me (in a kind of definitional sense) \\<close>   \n     hence C4: \"\\<lfloor>\\<^bold>\\<box>\\<^sup>D(Good I (FWB I))\\<rfloor>\\<^sub>C\" by simp  \\<comment> \\<open> (4) FWB is an (a priori) necessary good for me\\<close>  \n     have \"\\<lfloor>\\<^bold>O\\<langle>FWB I | \\<^bold>\\<box>\\<^sup>D(Good I) (FWB I)\\<rangle>\\<rfloor>\\<^sub>C\" using explicationGoodness3 explicationFWB2 by blast  \\<comment> \\<open> I ought to pursue my FWB on the condition that I consider it to be a necessary good\\<close>            \n     hence \"\\<lfloor>\\<^bold>O\\<^sub>i(FWB I)\\<rfloor>\\<^sub>C\" using explicationFWB2 explicationFWB3 C4 CJ_14p by fastforce  \\<comment> \\<open> There is an (other-directed) obligation to my FWB\\<close>  \n     hence \"\\<lfloor>\\<^bold>O\\<^sub>i(\\<^bold>\\<diamond>\\<^sub>a(FWB I))\\<rfloor>\\<^sub>C\" using OIOAC by simp  \\<comment> \\<open> It must therefore be the case that my FWB is possible\\<close>     \n     hence \"\\<lfloor>\\<^bold>O\\<^sub>i(\\<^bold>\\<forall>a. \\<^bold>\\<not>InterferesWith a (FWB I))\\<rfloor>\\<^sub>C\" using InterferenceWithFWB by simp  \\<comment> \\<open> There is an obligation for others not to interfere with my FWB\\<close>\n     hence C5: \"\\<lfloor>RightTo I FWB\\<rfloor>\\<^sub>C\" using RightTo_def by simp  \\<comment> \\<open> (5) I have a claim right to my FWB\\<close>\n   }   \n    hence \"\\<lfloor>ActsOnPurpose I E \\<^bold>\\<rightarrow> RightTo I FWB\\<rfloor>\\<^sub>C\" by (rule impI)  \\<comment> \\<open> I have a claim right to my FWB (since I act on some purpose E)\\<close>   \n  }  \n  hence \"\\<lfloor>\\<^bold>\\<forall>P. ActsOnPurpose I P \\<^bold>\\<rightarrow> RightTo I FWB\\<rfloor>\\<^sub>C\" by (rule allI)  \n  hence \"\\<lfloor>PPA I \\<^bold>\\<rightarrow> RightTo I FWB\\<rfloor>\\<^sub>C\" using PPA_def by simp  \\<comment> \\<open> I have a claim right to my FWB since I am a PPA \\<close>\n}  \n  hence \"\\<forall>x. \\<lfloor>PPA x \\<^bold>\\<rightarrow> RightTo x FWB\\<rfloor>\\<^sub>C\" by simp  \\<comment> \\<open> Every agent has a claim right to its FWB since it is a PPA\\<close>  \n}\nthus C13: \"\\<forall>C. \\<lfloor>\\<^bold>\\<forall>x. PPA x \\<^bold>\\<rightarrow> (RightTo x FWB)\\<rfloor>\\<^sub>C\" by (rule allI)  \\<comment> \\<open> (13) For every perspective C: every agent has a claim right to its FWB\\<close>  \nqed\n\ntext\\<open>\\noindent{We show that the weaker variant of the PGC presented above can be derived \nfrom the stronger one.}\\<close>\nlemma PGC_weak2: \"\\<forall>C. \\<lfloor>PPA (Agent C) \\<^bold>\\<rightarrow> (RightTo (Agent C) FWB)\\<rfloor>\\<^sub>C\" using PGC_strong by simp\n\nsubsubsection \\<open>Some Exemplary Inferences\\<close>\n\ntext\\<open>\\noindent{In the following, we illustrate how to draw some inferences building upon Gewirth's PGC.}\\<close>\n\nconsts X::c  \\<comment> \\<open> Context of use X (to which a certain speaker agent corresponds)\\<close>\nconsts Y::c  \\<comment> \\<open> Context of use Y (to which another speaker agent corresponds)\\<close>\n\ntext\\<open>\\noindent{The agent (of context) X holds itself as a PPA.}\\<close>\naxiomatization where AgentX_X_PPA: \"\\<lfloor>PPA (Agent X)\\<rfloor>\\<^sub>X\"\n\ntext\\<open>\\noindent{The agent (of another context) Y holds the agent (of context) X  as a PPA.}\\<close>\nlemma AgentY_X_PPA: \"\\<lfloor>PPA (Agent X)\\<rfloor>\\<^sub>Y\" using AgentX_X_PPA recognizeOtherPPA by simp\n\ntext\\<open>\\noindent{Now the agent (of context) Y holds itself as a PPA.}\\<close>\naxiomatization where AgentY_Y_PPA: \"\\<lfloor>PPA (Agent Y)\\<rfloor>\\<^sub>Y\"\n\ntext\\<open>\\noindent{The agent Y claims a right to FWB.}\\<close>\nlemma AgentY_Y_FWB: \"\\<lfloor>RightTo (Agent Y) FWB\\<rfloor>\\<^sub>Y\" using AgentY_Y_PPA PGC_weak by simp\n\ntext\\<open>\\noindent{The agent Y accepts X claiming a right to FWB.}\\<close>\nlemma AgentY_X_FWB: \"\\<lfloor>RightTo (Agent X) FWB\\<rfloor>\\<^sub>Y\" using AgentY_X_PPA PGC_strong by simp\n\ntext\\<open>\\noindent{The agent Y accepts an (other-directed) obligation of non-interference with X's FWB.}\\<close>\nlemma AgentY_NonInterference_X_FWB: \"\\<lfloor>\\<^bold>O\\<^sub>i(\\<^bold>\\<forall>z. \\<^bold>\\<not>InterferesWith z (FWB (Agent X)))\\<rfloor>\\<^sub>Y\" using AgentY_X_FWB RightTo_def by simp\n\ntext\\<open>\\noindent{Axiom consistency checked: Nitpick finds a two-world model (card w=2).}\\<close>\nlemma True nitpick[satisfy, card c = 1, card e = 1, card w = 2] oops\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/GewirthPGCProof/GewirthArgument.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5774953651858117, "lm_q1q2_score": 0.3422622145739089}}
{"text": "section \\<open> Linking to the Failures-Divergences Model \\<close>\n\ntheory utp_sfrd_fdsem\n  imports utp_sfrd_recursion\nbegin\n\nsubsection \\<open> Failures-Divergences Semantics \\<close>\n\ntext \\<open> The following functions play a similar role to those in Roscoe's CSP semantics, and are\n  calculated from the Circus reactive design semantics. A major difference is that these three\n  functions account for state. Each divergence, trace, and failure is subject to an initial\n  state. Moreover, the traces are terminating traces, and therefore also provide a final state\n  following the given interaction. A more subtle difference from the Roscoe semantics is that\n  the set of traces do not include the divergences. The same semantic information is present,\n  but we construct a direct analogy with the pre-, peri- and postconditions of our reactive \n  designs. \\<close>\n\ndefinition divergences :: \"('\\<sigma>,'\\<phi>) action \\<Rightarrow> '\\<sigma> \\<Rightarrow> '\\<phi> list set\" (\"dv\\<lbrakk>_\\<rbrakk>_\" [0,100] 100) where\n[upred_defs]: \"divergences P s = {t | t. `(\\<not>\\<^sub>r pre\\<^sub>R(P))\\<lbrakk>\\<guillemotleft>s\\<guillemotright>,\\<guillemotleft>[]\\<guillemotright>,\\<guillemotleft>t\\<guillemotright>/$st,$tr,$tr\\<acute>\\<rbrakk>`}\"\n  \ndefinition traces :: \"('\\<sigma>,'\\<phi>) action \\<Rightarrow> '\\<sigma> \\<Rightarrow> ('\\<phi> list \\<times> '\\<sigma>) set\" (\"tr\\<lbrakk>_\\<rbrakk>_\" [0,100] 100) where\n[upred_defs]: \"traces P s = {(t,s') | t s'. `(pre\\<^sub>R(P) \\<and> post\\<^sub>R(P))\\<lbrakk>\\<guillemotleft>s\\<guillemotright>,\\<guillemotleft>s'\\<guillemotright>,\\<guillemotleft>[]\\<guillemotright>,\\<guillemotleft>t\\<guillemotright>/$st,$st\\<acute>,$tr,$tr\\<acute>\\<rbrakk>`}\"\n\ndefinition failures :: \"('\\<sigma>,'\\<phi>) action \\<Rightarrow> '\\<sigma> \\<Rightarrow> ('\\<phi> list \\<times> '\\<phi> set) set\" (\"fl\\<lbrakk>_\\<rbrakk>_\" [0,100] 100) where\n[upred_defs]: \"failures P s = {(t,r) | t r. `(pre\\<^sub>R(P) \\<and> peri\\<^sub>R(P))\\<lbrakk>\\<guillemotleft>r\\<guillemotright>,\\<guillemotleft>s\\<guillemotright>,\\<guillemotleft>[]\\<guillemotright>,\\<guillemotleft>t\\<guillemotright>/$ref\\<acute>,$st,$tr,$tr\\<acute>\\<rbrakk>`}\"\n\nlemma trace_divergence_disj:\n  assumes \"P is NCSP\" \"(t, s') \\<in> tr\\<lbrakk>P\\<rbrakk>s\" \"t \\<in> dv\\<lbrakk>P\\<rbrakk>s\"\n  shows False\n  using assms(2,3)\n  by (simp add: traces_def divergences_def, rdes_simp cls:assms, rel_auto)\n\nlemma preR_refine_divergences:\n  assumes \"P is NCSP\" \"Q is NCSP\" \"\\<And> s. dv\\<lbrakk>P\\<rbrakk>s \\<subseteq> dv\\<lbrakk>Q\\<rbrakk>s\"\n  shows \"pre\\<^sub>R(P) \\<sqsubseteq> pre\\<^sub>R(Q)\"\nproof (rule CRR_refine_impl_prop, simp_all add: assms closure usubst unrest)\n  fix t s\n  assume a: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> pre\\<^sub>R Q`\"\n  with a show \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> pre\\<^sub>R P`\"\n  proof (rule_tac ccontr)\n    from assms(3)[of s] have b: \"t \\<in> dv\\<lbrakk>P\\<rbrakk>s \\<Longrightarrow> t \\<in> dv\\<lbrakk>Q\\<rbrakk>s\"\n      by (auto)\n    assume \"\\<not> `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> pre\\<^sub>R P`\"\n    hence \"\\<not> `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> CRC(pre\\<^sub>R P)`\"\n      by (simp add: assms closure Healthy_if)\n    hence \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> (\\<not>\\<^sub>r CRC(pre\\<^sub>R P))`\"\n      by (rel_auto)\n    hence \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> (\\<not>\\<^sub>r pre\\<^sub>R P)`\"\n      by (simp add: assms closure Healthy_if)\n    with a b show False\n      by (rel_auto)\n  qed\nqed\n\nlemma preR_eq_divergences:\n  assumes \"P is NCSP\" \"Q is NCSP\" \"\\<And> s. dv\\<lbrakk>P\\<rbrakk>s = dv\\<lbrakk>Q\\<rbrakk>s\"\n  shows \"pre\\<^sub>R(P) = pre\\<^sub>R(Q)\"\n  by (metis assms dual_order.antisym order_refl preR_refine_divergences)\n\nlemma periR_refine_failures:\n  assumes \"P is NCSP\" \"Q is NCSP\" \"\\<And> s. fl\\<lbrakk>Q\\<rbrakk>s \\<subseteq> fl\\<lbrakk>P\\<rbrakk>s\"\n  shows \"(pre\\<^sub>R(P) \\<and> peri\\<^sub>R(P)) \\<sqsubseteq> (pre\\<^sub>R(Q) \\<and> peri\\<^sub>R(Q))\"\nproof (rule CRR_refine_impl_prop, simp_all add: assms closure unrest subst_unrest_3)\n  fix t s r'\n  assume a: \"`[$ref\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>r'\\<guillemotright>, $st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> (pre\\<^sub>R Q \\<and> peri\\<^sub>R Q)`\"\n  from assms(3)[of s] have b: \"(t, r') \\<in> fl\\<lbrakk>Q\\<rbrakk>s \\<Longrightarrow> (t, r') \\<in> fl\\<lbrakk>P\\<rbrakk>s\"\n    by (auto)\n  with a show \"`[$ref\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>r'\\<guillemotright>, $st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> (pre\\<^sub>R P \\<and> peri\\<^sub>R P)`\"\n    by (simp add: failures_def)\nqed\n\nlemma periR_eq_failures:\n  assumes \"P is NCSP\" \"Q is NCSP\" \"\\<And> s. fl\\<lbrakk>P\\<rbrakk>s = fl\\<lbrakk>Q\\<rbrakk>s\"\n  shows \"(pre\\<^sub>R(P) \\<and> peri\\<^sub>R(P)) = (pre\\<^sub>R(Q) \\<and> peri\\<^sub>R(Q))\"\n  by (metis (full_types) assms dual_order.antisym order_refl periR_refine_failures)\n\nlemma postR_refine_traces:\n  assumes \"P is NCSP\" \"Q is NCSP\" \"\\<And> s. tr\\<lbrakk>Q\\<rbrakk>s \\<subseteq> tr\\<lbrakk>P\\<rbrakk>s\"\n  shows \"(pre\\<^sub>R(P) \\<and> post\\<^sub>R(P)) \\<sqsubseteq> (pre\\<^sub>R(Q) \\<and> post\\<^sub>R(Q))\"\nproof (rule CRR_refine_impl_prop, simp_all add: assms closure unrest subst_unrest_5)\n  fix t s s'\n  assume a: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> (pre\\<^sub>R Q \\<and> post\\<^sub>R Q)`\"\n  from assms(3)[of s] have b: \"(t, s') \\<in> tr\\<lbrakk>Q\\<rbrakk>s \\<Longrightarrow> (t, s') \\<in> tr\\<lbrakk>P\\<rbrakk>s\"\n    by (auto)\n  with a show \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> (pre\\<^sub>R P \\<and> post\\<^sub>R P)`\"\n    by (simp add: traces_def)\nqed\n\nlemma postR_eq_traces:\n  assumes \"P is NCSP\" \"Q is NCSP\" \"\\<And> s. tr\\<lbrakk>P\\<rbrakk>s = tr\\<lbrakk>Q\\<rbrakk>s\"\n  shows \"(pre\\<^sub>R(P) \\<and> post\\<^sub>R(P)) = (pre\\<^sub>R(Q) \\<and> post\\<^sub>R(Q))\"\n  by (metis assms dual_order.antisym order_refl postR_refine_traces)\n\nlemma circus_fd_refine_intro:\n  assumes \"P is NCSP\" \"Q is NCSP\" \"\\<And> s. dv\\<lbrakk>Q\\<rbrakk>s \\<subseteq> dv\\<lbrakk>P\\<rbrakk>s\" \"\\<And> s. fl\\<lbrakk>Q\\<rbrakk>s \\<subseteq> fl\\<lbrakk>P\\<rbrakk>s\" \"\\<And> s. tr\\<lbrakk>Q\\<rbrakk>s \\<subseteq> tr\\<lbrakk>P\\<rbrakk>s\"\n  shows \"P \\<sqsubseteq> Q\"\nproof (rule SRD_refine_intro', simp_all add: closure assms)\n  show a: \"`pre\\<^sub>R P \\<Rightarrow> pre\\<^sub>R Q`\"\n    using assms(1) assms(2) assms(3) preR_refine_divergences refBy_order by blast\n  show \"peri\\<^sub>R P \\<sqsubseteq> (pre\\<^sub>R P \\<and> peri\\<^sub>R Q)\"\n  proof -\n    have \"peri\\<^sub>R P \\<sqsubseteq> (pre\\<^sub>R Q \\<and> peri\\<^sub>R Q)\"\n      by (metis (no_types) assms(1) assms(2) assms(4) periR_refine_failures utp_pred_laws.le_inf_iff)\n    then show ?thesis\n      by (metis a refBy_order utp_pred_laws.inf.order_iff utp_pred_laws.inf_assoc)\n  qed\n  show \"post\\<^sub>R P \\<sqsubseteq> (pre\\<^sub>R P \\<and> post\\<^sub>R Q)\"\n  proof -\n    have \"post\\<^sub>R P \\<sqsubseteq> (pre\\<^sub>R Q \\<and> post\\<^sub>R Q)\"\n      by (meson assms(1) assms(2) assms(5) postR_refine_traces utp_pred_laws.le_inf_iff)\n    then show ?thesis\n      by (metis a refBy_order utp_pred_laws.inf.absorb_iff1 utp_pred_laws.inf_assoc)\n  qed\nqed\n\nsubsection \\<open> Circus Operators \\<close>\n\nlemma traces_Skip:\n  \"tr\\<lbrakk>Skip\\<rbrakk>s = {([], s)}\"\n  by (simp add: traces_def rdes alpha closure, rel_simp)\n\nlemma failures_Skip:\n  \"fl\\<lbrakk>Skip\\<rbrakk>s = {}\"\n  by (simp add: failures_def, rdes_calc)\n\nlemma divergences_Skip:\n  \"dv\\<lbrakk>Skip\\<rbrakk>s = {}\"\n  by (simp add: divergences_def, rdes_calc)\n\nlemma traces_Stop:\n  \"tr\\<lbrakk>Stop\\<rbrakk>s = {}\"\n  by (simp add: traces_def, rdes_calc)\n\nlemma failures_Stop:\n  \"fl\\<lbrakk>Stop\\<rbrakk>s = {([], E) | E. True}\"\n  by (simp add: failures_def, rdes_calc, rel_auto)\n\nlemma divergences_Stop:\n  \"dv\\<lbrakk>Stop\\<rbrakk>s = {}\"\n  by (simp add: divergences_def, rdes_calc)\n\nlemma traces_AssignsCSP:\n  \"tr\\<lbrakk>\\<langle>\\<sigma>\\<rangle>\\<^sub>C\\<rbrakk>s = {([], \\<lbrakk>\\<sigma>\\<rbrakk>\\<^sub>e s)}\"\n  by (simp add: traces_def rdes closure usubst alpha, rel_auto)\n\nlemma failures_AssignsCSP:\n  \"fl\\<lbrakk>\\<langle>\\<sigma>\\<rangle>\\<^sub>C\\<rbrakk>s = {}\"\n  by (simp add: failures_def, rdes_calc)\n\nlemma divergences_AssignsCSP:\n  \"dv\\<lbrakk>\\<langle>\\<sigma>\\<rangle>\\<^sub>C\\<rbrakk>s = {}\"\n  by (simp add: divergences_def, rdes_calc)\n\nlemma failures_Miracle: \"fl\\<lbrakk>Miracle\\<rbrakk>s = {}\"\n  by (simp add: failures_def rdes closure usubst)\n\nlemma divergences_Miracle: \"dv\\<lbrakk>Miracle\\<rbrakk>s = {}\"\n  by (simp add: divergences_def rdes closure usubst)\n\nlemma failures_Chaos: \"fl\\<lbrakk>Chaos\\<rbrakk>s = {}\"\n  by (simp add: failures_def rdes, rel_auto)\n\nlemma divergences_Chaos: \"dv\\<lbrakk>Chaos\\<rbrakk>s = UNIV\"\n  by (simp add: divergences_def rdes, rel_auto)\n\nlemma traces_Chaos: \"tr\\<lbrakk>Chaos\\<rbrakk>s = {}\"\n  by (simp add: traces_def rdes closure usubst)\n\nlemma divergences_cond:\n  assumes \"P is NCSP\" \"Q is NCSP\"\n  shows \"dv\\<lbrakk>P \\<triangleleft> b \\<triangleright>\\<^sub>R Q\\<rbrakk>s = (if (\\<lbrakk>b\\<rbrakk>\\<^sub>es) then dv\\<lbrakk>P\\<rbrakk>s else dv\\<lbrakk>Q\\<rbrakk>s)\"\n  by (rdes_simp cls: assms, simp add: divergences_def traces_def rdes closure rpred assms, rel_auto)\n\nlemma traces_cond:\n  assumes \"P is NCSP\" \"Q is NCSP\"\n  shows \"tr\\<lbrakk>P \\<triangleleft> b \\<triangleright>\\<^sub>R Q\\<rbrakk>s = (if (\\<lbrakk>b\\<rbrakk>\\<^sub>es) then tr\\<lbrakk>P\\<rbrakk>s else tr\\<lbrakk>Q\\<rbrakk>s)\"\n  by (rdes_simp cls: assms, simp add: divergences_def traces_def rdes closure rpred assms, rel_auto)\n\nlemma failures_cond:\n  assumes \"P is NCSP\" \"Q is NCSP\"\n  shows \"fl\\<lbrakk>P \\<triangleleft> b \\<triangleright>\\<^sub>R Q\\<rbrakk>s = (if (\\<lbrakk>b\\<rbrakk>\\<^sub>es) then fl\\<lbrakk>P\\<rbrakk>s else fl\\<lbrakk>Q\\<rbrakk>s)\"\n  by (rdes_simp cls: assms, simp add: divergences_def failures_def rdes closure rpred assms, rel_auto)\n\nlemma divergences_guard: \n  assumes \"P is NCSP\"\n  shows \"dv\\<lbrakk>g &\\<^sub>C P\\<rbrakk>s = (if (\\<lbrakk>g\\<rbrakk>\\<^sub>es) then dv\\<lbrakk>g &\\<^sub>C P\\<rbrakk>s else {})\"\n  by (rdes_simp cls: assms, simp add: divergences_def traces_def rdes closure rpred assms, rel_auto)\n\nlemma traces_do: \"tr\\<lbrakk>do\\<^sub>C(e)\\<rbrakk>s = {([\\<lbrakk>e\\<rbrakk>\\<^sub>es], s)}\"\n  by (rdes_simp, simp add: traces_def rdes closure rpred, rel_auto)\n\nlemma failures_do: \"fl\\<lbrakk>do\\<^sub>C(e)\\<rbrakk>s = {([], E) | E. \\<lbrakk>e\\<rbrakk>\\<^sub>es \\<notin> E}\"\n  by (rdes_simp, simp add: failures_def rdes closure rpred usubst, rel_auto)\n\nlemma divergences_do: \"dv\\<lbrakk>do\\<^sub>C(e)\\<rbrakk>s = {}\"\n  by (rel_auto)\n\nlemma divergences_seq:\n  fixes P :: \"('s, 'e) action\"\n  assumes \"P is NCSP\" \"Q is NCSP\"\n  shows \"dv\\<lbrakk>P ;; Q\\<rbrakk>s = dv\\<lbrakk>P\\<rbrakk>s \\<union> {t\\<^sub>1 @ t\\<^sub>2 | t\\<^sub>1 t\\<^sub>2 s\\<^sub>0. (t\\<^sub>1, s\\<^sub>0) \\<in> tr\\<lbrakk>P\\<rbrakk>s \\<and> t\\<^sub>2 \\<in> dv\\<lbrakk>Q\\<rbrakk>s\\<^sub>0}\"\n  (is \"?lhs = ?rhs\")\n  oops\n\nlemma traces_seq:\n  fixes P :: \"('s, 'e) action\"\n  assumes \"P is NCSP\" \"Q is NCSP\"\n  shows \"tr\\<lbrakk>P ;; Q\\<rbrakk>s = \n          {(t\\<^sub>1 @ t\\<^sub>2, s') | t\\<^sub>1 t\\<^sub>2 s\\<^sub>0 s'. (t\\<^sub>1, s\\<^sub>0) \\<in> tr\\<lbrakk>P\\<rbrakk>s \\<and> (t\\<^sub>2, s') \\<in> tr\\<lbrakk>Q\\<rbrakk>s\\<^sub>0 \n                                     \\<and> (t\\<^sub>1@t\\<^sub>2) \\<notin> dv\\<lbrakk>P\\<rbrakk>s \n                                     \\<and> (\\<forall> (t, s\\<^sub>1) \\<in> tr\\<lbrakk>P\\<rbrakk>s. t \\<le> t\\<^sub>1@t\\<^sub>2 \\<longrightarrow> (t\\<^sub>1@t\\<^sub>2)-t \\<notin> dv\\<lbrakk>Q\\<rbrakk>s\\<^sub>1) }\"\n  (is \"?lhs = ?rhs\")\nproof \n  show \"?lhs \\<subseteq> ?rhs\"\n  proof (rdes_expand cls: assms, simp add: traces_def divergences_def rdes closure assms rdes_def unrest rpred usubst, auto)\n    fix t :: \"'e list\" and s' :: \"'s\"\n    let ?\\<sigma> = \"[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>]\"\n    assume \n      a1: \"`?\\<sigma> \\<dagger> (post\\<^sub>R P ;; post\\<^sub>R Q)`\" and\n      a2: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> pre\\<^sub>R P`\" and\n      a3: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> (post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q)`\"\n    from a1 have \"`?\\<sigma> \\<dagger> (\\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> ((post\\<^sub>R P)\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; (post\\<^sub>R Q)\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<rbrakk>) \\<and> \\<guillemotleft>tr\\<^sub>0\\<guillemotright> \\<le>\\<^sub>u $tr\\<acute>)`\"\n      by (simp add: R2_tr_middle assms closure)\n    then obtain tr\\<^sub>0 where p1:\"`?\\<sigma> \\<dagger> ((post\\<^sub>R P)\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; (post\\<^sub>R Q)\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<rbrakk>)`\" and tr0: \"tr\\<^sub>0 \\<le> t\"\n      apply (simp add: usubst)\n      apply (erule taut_shEx_elim)\n       apply (simp add: unrest_all_circus_vars_st_st' closure unrest assms)\n      apply (rel_auto)\n      done\n    from p1 have \"`?\\<sigma> \\<dagger> (\\<^bold>\\<exists> st\\<^sub>0 \\<bullet> (post\\<^sub>R P)\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<acute>\\<rbrakk>\\<lbrakk>\\<guillemotleft>st\\<^sub>0\\<guillemotright>/$st\\<acute>\\<rbrakk> ;; (post\\<^sub>R Q)\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>st\\<^sub>0\\<guillemotright>/$st\\<rbrakk>)`\"\n      by (simp add: seqr_middle[of st, THEN sym])\n    then obtain s\\<^sub>0 where \"`?\\<sigma> \\<dagger> ((post\\<^sub>R P)\\<lbrakk>\\<guillemotleft>s\\<^sub>0\\<guillemotright>,\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$st\\<acute>,$tr\\<acute>\\<rbrakk> ;; (post\\<^sub>R Q)\\<lbrakk>\\<guillemotleft>s\\<^sub>0\\<guillemotright>,\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$st,$tr\\<rbrakk>)`\"\n      apply (simp add: usubst)\n      apply (erule taut_shEx_elim)\n       apply (simp add: unrest_all_circus_vars_st_st' closure unrest assms)\n      apply (rel_auto)\n      done\n    hence \"`(([$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R P) ;;\n             ([$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> post\\<^sub>R Q))`\"\n      by (rel_auto)\n    hence \"`(([$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R P) \\<and>\n             ([$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> post\\<^sub>R Q))`\"\n      by (simp add: seqr_to_conj unrest_any_circus_var assms closure unrest)\n    hence postP: \"`([$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R P)`\" and\n          postQ': \"`([$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> post\\<^sub>R Q)`\"\n      by (rel_auto)+\n    from postQ' have \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>] \\<dagger> [$tr \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright> + (\\<guillemotleft>t\\<guillemotright> - \\<guillemotleft>tr\\<^sub>0\\<guillemotright>)] \\<dagger> post\\<^sub>R Q`\"\n      using tr0 by (rel_auto)\n    hence \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>] \\<dagger> [$tr \\<mapsto>\\<^sub>s 0, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright> - \\<guillemotleft>tr\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R Q`\"\n      by (simp add: R2_subst_tr closure assms)\n    hence postQ: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t - tr\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R Q`\"\n      by (rel_auto)\n    have preP: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R P`\"\n    proof -\n      have \"(pre\\<^sub>R P)\\<lbrakk>0,\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr,$tr\\<acute>\\<rbrakk> \\<sqsubseteq> (pre\\<^sub>R P)\\<lbrakk>0,\\<guillemotleft>t\\<guillemotright>/$tr,$tr\\<acute>\\<rbrakk>\"\n        by (simp add: RC_prefix_refine closure assms tr0)\n      hence \"[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R P \\<sqsubseteq> [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> pre\\<^sub>R P\"\n        by (rel_auto)\n      thus ?thesis\n        by (simp add: taut_refine_impl a2)\n    qed\n\n    have preQ: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t - tr\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R Q`\"\n    proof -\n      from postP a3 have \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> pre\\<^sub>R Q`\"\n        apply (simp add: wp_rea_def)\n        apply (rel_auto)\n        using tr0 apply blast+\n        done\n      hence \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>] \\<dagger> [$tr \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>tr\\<^sub>0\\<guillemotright> + (\\<guillemotleft>t\\<guillemotright> - \\<guillemotleft>tr\\<^sub>0\\<guillemotright>)] \\<dagger> pre\\<^sub>R Q`\"\n        by (rel_auto)\n\n      hence \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>] \\<dagger> [$tr \\<mapsto>\\<^sub>s 0, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright> - \\<guillemotleft>tr\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R Q`\"\n        by (simp add: R2_subst_tr closure assms)\n      thus ?thesis\n        by (rel_auto)\n    qed\n\n    from a2 have ndiv: \"\\<not> `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> (\\<not>\\<^sub>r pre\\<^sub>R P)`\"\n      by (rel_auto)\n\n    have t_minus_tr0: \"tr\\<^sub>0 @ (t - tr\\<^sub>0) = t\"\n      using append_minus tr0 by blast\n\n    from a3\n    have wpr: \"\\<And>t\\<^sub>0 s\\<^sub>1.\n           `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R P` \\<Longrightarrow>\n           `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R P` \\<Longrightarrow>\n            t\\<^sub>0 \\<le> t \\<Longrightarrow> `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t - t\\<^sub>0\\<guillemotright>] \\<dagger> (\\<not>\\<^sub>r pre\\<^sub>R Q)` \\<Longrightarrow> False\"\n    proof -\n      fix t\\<^sub>0 s\\<^sub>1\n      assume b:\n        \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R P`\"\n        \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R P`\"\n        \"t\\<^sub>0 \\<le> t\" \n        \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t - t\\<^sub>0\\<guillemotright>] \\<dagger> (\\<not>\\<^sub>r pre\\<^sub>R Q)`\"\n\n      from a3 have c: \"`\\<^bold>\\<forall> (s\\<^sub>0, t\\<^sub>0) \\<bullet> \\<guillemotleft>t\\<^sub>0\\<guillemotright> \\<le>\\<^sub>u \\<guillemotleft>t\\<guillemotright> \n                                \\<and> [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R P \n                                \\<Rightarrow> [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright> - \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R Q`\"\n        by (simp add: wp_rea_circus_form_alt[of \"post\\<^sub>R P\" \"pre\\<^sub>R Q\"] closure assms unrest usubst)\n           (rel_simp)\n\n      from c b(2-4) show False\n        by (rel_auto)\n    qed\n      \n    show \"\\<exists>t\\<^sub>1 t\\<^sub>2.\n            t = t\\<^sub>1 @ t\\<^sub>2 \\<and>\n            (\\<exists>s\\<^sub>0. `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>] \\<dagger> pre\\<^sub>R P \\<and>\n                    [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>] \\<dagger> post\\<^sub>R P` \\<and>\n                   `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> pre\\<^sub>R Q \\<and>\n                    [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> post\\<^sub>R Q` \\<and>\n                    \\<not> `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1 @ t\\<^sub>2\\<guillemotright>] \\<dagger> (\\<not>\\<^sub>r pre\\<^sub>R P)` \\<and>\n                    (\\<forall>t\\<^sub>0 s\\<^sub>1. `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R P \\<and>\n                             [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R P` \\<longrightarrow>\n                            t\\<^sub>0 \\<le> t\\<^sub>1 @ t\\<^sub>2 \\<longrightarrow> \\<not> `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>(t\\<^sub>1 @ t\\<^sub>2) - t\\<^sub>0\\<guillemotright>] \\<dagger> (\\<not>\\<^sub>r pre\\<^sub>R Q)`))\"\n      apply (rule_tac x=\"tr\\<^sub>0\" in exI)\n      apply (rule_tac x=\"(t - tr\\<^sub>0)\" in exI)\n      apply (auto)\n      using tr0 apply auto[1]\n      apply (rule_tac x=\"s\\<^sub>0\" in exI)\n      apply (auto intro:wpr simp add: taut_conj preP preQ postP postQ ndiv wpr t_minus_tr0)\n      done\n  qed\n\n  show \"?rhs \\<subseteq> ?lhs\"\n  proof (rdes_expand cls: assms, simp add: traces_def divergences_def rdes closure assms rdes_def unrest rpred usubst, auto)\n    fix t\\<^sub>1 t\\<^sub>2 :: \"'e list\" and s\\<^sub>0 s' :: \"'s\"\n    assume\n      a1: \"\\<not> `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1 @ t\\<^sub>2\\<guillemotright>] \\<dagger> (\\<not>\\<^sub>r pre\\<^sub>R P)`\" and \n      a2: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>] \\<dagger> pre\\<^sub>R P`\" and\n      a3: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>] \\<dagger> post\\<^sub>R P`\" and\n      a4: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> pre\\<^sub>R Q`\" and\n      a5: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> post\\<^sub>R Q`\" and\n      a6: \"\\<forall>t s\\<^sub>1. `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> pre\\<^sub>R P \\<and>\n                  [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> post\\<^sub>R P` \\<longrightarrow>\n                  t \\<le> t\\<^sub>1 @ t\\<^sub>2 \\<longrightarrow> \\<not> `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>(t\\<^sub>1 @ t\\<^sub>2) - t\\<guillemotright>] \\<dagger> (\\<not>\\<^sub>r pre\\<^sub>R Q)`\"\n    \n    from a1 have preP: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1 @ t\\<^sub>2\\<guillemotright>] \\<dagger> (pre\\<^sub>R P)`\"\n      by (simp add: taut_not unrest_all_circus_vars_st assms closure unrest, rel_auto)\n\n    have \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>+\\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> post\\<^sub>R Q`\"\n    proof -\n      have \"[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> post\\<^sub>R Q =\n            [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>] \\<dagger> [$tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> post\\<^sub>R Q\"\n        by rel_auto\n      also have \"... = [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>] \\<dagger> [$tr \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>+\\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> post\\<^sub>R Q\"\n        by (simp add: R2_subst_tr assms closure, rel_auto)\n      finally show ?thesis using a5\n        by (rel_auto)\n    qed\n    with a3\n    have postPQ: \" `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1 @ t\\<^sub>2\\<guillemotright>] \\<dagger> (post\\<^sub>R P ;; post\\<^sub>R Q)`\"\n      by (rel_auto, meson Prefix_Order.prefixI)\n\n    have \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>+\\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> pre\\<^sub>R Q`\"\n    proof -\n      have \"[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>+\\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> pre\\<^sub>R Q = \n            [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>] \\<dagger> [$tr \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1\\<guillemotright>+\\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> pre\\<^sub>R Q\"\n        by rel_auto\n      also have \"... = [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>0\\<guillemotright>] \\<dagger> [$tr \\<mapsto>\\<^sub>s 0, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>2\\<guillemotright>] \\<dagger> pre\\<^sub>R Q\"\n        by (simp add: R2_subst_tr assms closure)\n      finally show ?thesis using a4\n        by (rel_auto)\n    qed\n\n    from a6 \n    have a6': \"\\<And> t s\\<^sub>1. \\<lbrakk> t \\<le> t\\<^sub>1 @ t\\<^sub>2; `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> pre\\<^sub>R P`; `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>] \\<dagger> post\\<^sub>R P` \\<rbrakk> \\<Longrightarrow>\n                         `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>(t\\<^sub>1 @ t\\<^sub>2) - t\\<guillemotright>] \\<dagger> pre\\<^sub>R Q`\"\n      apply (subst (asm) taut_not)\n      apply (simp add: unrest_all_circus_vars_st assms closure unrest)\n      apply (rel_auto)\n      done\n\n    have wpR: \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1 @ t\\<^sub>2\\<guillemotright>] \\<dagger> (post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q)`\"\n    proof -\n      have \"\\<And> s\\<^sub>1 t\\<^sub>0. \\<lbrakk> t\\<^sub>0 \\<le> t\\<^sub>1 @ t\\<^sub>2; `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R P` \\<rbrakk>\n                     \\<Longrightarrow> `[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>(t\\<^sub>1 @ t\\<^sub>2) - t\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R Q`\"\n      proof -\n        fix s\\<^sub>1 t\\<^sub>0\n        assume c:\"t\\<^sub>0 \\<le> t\\<^sub>1 @ t\\<^sub>2\" \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> post\\<^sub>R P`\"\n\n        have preP': \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R P`\"\n        proof -\n          have \"(pre\\<^sub>R P)\\<lbrakk>0,\\<guillemotleft>t\\<^sub>0\\<guillemotright>/$tr,$tr\\<acute>\\<rbrakk> \\<sqsubseteq> (pre\\<^sub>R P)\\<lbrakk>0,\\<guillemotleft>t\\<^sub>1 @ t\\<^sub>2\\<guillemotright>/$tr,$tr\\<acute>\\<rbrakk>\"\n            by (simp add: RC_prefix_refine closure assms c)\n          hence \"[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R P \\<sqsubseteq> [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1 @ t\\<^sub>2\\<guillemotright>] \\<dagger> pre\\<^sub>R P\"\n            by (rel_auto)\n          thus ?thesis\n            by (simp add: taut_refine_impl preP)\n        qed\n\n\n        with c a3 preP a6'[of t\\<^sub>0 s\\<^sub>1] show \"`[$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<^sub>1\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>(t\\<^sub>1 @ t\\<^sub>2) - t\\<^sub>0\\<guillemotright>] \\<dagger> pre\\<^sub>R Q`\"\n          by (simp)\n      qed\n\n      thus ?thesis\n        apply (simp_all add: wp_rea_circus_form_alt assms closure unrest usubst rea_impl_alt_def)\n        apply (simp add: R1_def usubst tcontr_alt_def)\n        apply (auto intro!: taut_shAll_intro_2)\n        apply (rule taut_impl_intro)\n        apply (simp add: unrest_all_circus_vars_st_st' unrest closure assms)\n        apply (rel_simp)\n      done\n    qed\n    show \"`([$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1 @ t\\<^sub>2\\<guillemotright>] \\<dagger> pre\\<^sub>R P \\<and>\n         [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1 @ t\\<^sub>2\\<guillemotright>] \\<dagger> (post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q)) \\<and>\n        [$st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $tr \\<mapsto>\\<^sub>s \\<guillemotleft>[]\\<guillemotright>, $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<^sub>1 @ t\\<^sub>2\\<guillemotright>] \\<dagger> (post\\<^sub>R P ;; post\\<^sub>R Q)`\"\n      by (auto simp add: taut_conj preP postPQ wpR)\n  qed\nqed\n\nlemma Cons_minus [simp]: \"(a # t) - [a] = t\"\n  by (metis append_Cons append_Nil append_minus)\n  \nlemma traces_prefix: \n  assumes \"P is NCSP\"\n  shows \"tr\\<lbrakk>\\<guillemotleft>a\\<guillemotright> \\<rightarrow>\\<^sub>C P\\<rbrakk>s = {(a # t, s') | t s'. (t, s') \\<in> tr\\<lbrakk>P\\<rbrakk>s}\"\n  apply (auto simp add: PrefixCSP_def traces_seq traces_do divergences_do lit.rep_eq assms closure Healthy_if trace_divergence_disj)\n  apply (meson assms trace_divergence_disj)\n  done\n\nsubsection \\<open> Deadlock Freedom \\<close>\n\ntext \\<open> The following is a specification for deadlock free actions. In any intermediate observation,\n  there must be at least one enabled event. \\<close>\n\ndefinition CDF :: \"('s, 'e) action\" where\n[rdes_def]: \"CDF = \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> (\\<Sqinter> (s, t, E, e) \\<bullet> \\<E>(\\<guillemotleft>s\\<guillemotright>, \\<guillemotleft>t\\<guillemotright>, \\<guillemotleft>insert e E\\<guillemotright>)) \\<diamondop> true\\<^sub>r)\"\n\nlemma CDF_NCSP [closure]: \"CDF is NCSP\"\n  apply (simp add: CDF_def) \n  apply (rule NCSP_rdes_intro)\n  apply (simp_all add: closure unrest)\n  done\n\nlemma CDF_seq_idem: \"CDF ;; CDF = CDF\"\n  by (rdes_eq)\n\nlemma CDF_refine_intro: \"CDF \\<sqsubseteq> P \\<Longrightarrow> CDF \\<sqsubseteq> (CDF ;; P)\"\n  by (metis CDF_seq_idem urel_dioid.mult_isol)\n\nlemma Skip_deadlock_free: \"CDF \\<sqsubseteq> Skip\"\n  by (rdes_refine)\n\nlemma CDF_ext_st [alpha]: \"CDF \\<oplus>\\<^sub>p abs_st\\<^sub>L = CDF\"\n  by (rdes_eq) \n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/sf_rdes/utp_sfrd_fdsem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665855647395, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.3422622062641374}}
{"text": "(*  Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n\nDatatype of events; function \"spies\"; freshness\n\n\"bad\" agents have been broken by the Spy; their private keys and internal\n    stores are visible to him\n*)(*<*)\n\nsection\\<open>Theory of Events for Security Protocols\\<close>\n\ntheory Event imports Message begin\n\nconsts  (*Initial states of agents -- parameter of the construction*)\n  initState :: \"agent \\<Rightarrow> msg set\"\n\ndatatype\n  event = Says  agent agent msg\n        | Gets  agent       msg\n        | Notes agent       msg\n       \nconsts \n  bad    :: \"agent set\"                         \\<comment> \\<open>compromised agents\\<close>\n\n\ntext\\<open>The constant \"spies\" is retained for compatibility's sake\\<close>\n\nprimrec\n  knows :: \"agent \\<Rightarrow> event list \\<Rightarrow> msg set\"\nwhere\n  knows_Nil:   \"knows A [] = initState A\"\n| knows_Cons:\n    \"knows A (ev # evs) =\n       (if A = Spy then \n        (case ev of\n           Says A' B X \\<Rightarrow> insert X (knows Spy evs)\n         | Gets A' X \\<Rightarrow> knows Spy evs\n         | Notes A' X  \\<Rightarrow> \n             if A' \\<in> bad then insert X (knows Spy evs) else knows Spy evs)\n        else\n        (case ev of\n           Says A' B X \\<Rightarrow> \n             if A'=A then insert X (knows A evs) else knows A evs\n         | Gets A' X    \\<Rightarrow> \n             if A'=A then insert X (knows A evs) else knows A evs\n         | Notes A' X    \\<Rightarrow> \n             if A'=A then insert X (knows A evs) else knows A evs))\"\n\nabbreviation (input)\n  spies  :: \"event list \\<Rightarrow> msg set\" where\n  \"spies == knows Spy\"\n\ntext\\<open>Spy has access to his own key for spoof messages, but Server is secure\\<close>\nspecification (bad)\n  Spy_in_bad     [iff]: \"Spy \\<in> bad\"\n  Server_not_bad [iff]: \"Server \\<notin> bad\"\n    by (rule exI [of _ \"{Spy}\"], simp)\n\n(*\n  Case A=Spy on the Gets event\n  enforces the fact that if a message is received then it must have been sent,\n  therefore the oops case must use Notes\n*)\n\nprimrec\n  (*Set of items that might be visible to somebody:\n    complement of the set of fresh items*)\n  used :: \"event list \\<Rightarrow> msg set\"\nwhere\n  used_Nil:   \"used []         = (UN B. parts (initState B))\"\n| used_Cons:  \"used (ev # evs) =\n                     (case ev of\n                        Says A B X \\<Rightarrow> parts {X} \\<union> used evs\n                      | Gets A X   \\<Rightarrow> used evs\n                      | Notes A X  \\<Rightarrow> parts {X} \\<union> used evs)\"\n    \\<comment> \\<open>The case for \\<^term>\\<open>Gets\\<close> seems anomalous, but \\<^term>\\<open>Gets\\<close> always\n        follows \\<^term>\\<open>Says\\<close> in real protocols.  Seems difficult to change.\n        See \\<^text>\\<open>Gets_correct\\<close> in theory \\<^text>\\<open>Guard/Extensions.thy\\<close>.\\<close>\n\nlemma Notes_imp_used [rule_format]: \"Notes A X \\<in> set evs \\<longrightarrow> X \\<in> used evs\"\napply (induct_tac evs)\napply (auto split: event.split) \ndone\n\nlemma Says_imp_used [rule_format]: \"Says A B X \\<in> set evs \\<longrightarrow> X \\<in> used evs\"\napply (induct_tac evs)\napply (auto split: event.split) \ndone\n\n\nsubsection\\<open>Function \\<^term>\\<open>knows\\<close>\\<close>\n\n(*Simplifying   \n parts(insert X (knows Spy evs)) = parts{X} \\<union> parts(knows Spy evs).\n  This version won't loop with the simplifier.*)\nlemmas parts_insert_knows_A = parts_insert [of _ \"knows A evs\"] for A evs\n\n\n\ntext\\<open>Letting the Spy see \"bad\" agents' notes avoids redundant case-splits\n      on whether \\<^term>\\<open>A=Spy\\<close> and whether \\<^term>\\<open>A\\<in>bad\\<close>\\<close>\nlemma knows_Spy_Notes [simp]:\n     \"knows Spy (Notes A X # evs) =  \n          (if A\\<in>bad then insert X (knows Spy evs) else knows Spy evs)\"\nby simp\n\nlemma knows_Spy_Gets [simp]: \"knows Spy (Gets A X # evs) = knows Spy evs\"\nby simp\n\nlemma knows_Spy_subset_knows_Spy_Says:\n     \"knows Spy evs \\<subseteq> knows Spy (Says A B X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_Spy_subset_knows_Spy_Notes:\n     \"knows Spy evs \\<subseteq> knows Spy (Notes A X # evs)\"\nby force\n\nlemma knows_Spy_subset_knows_Spy_Gets:\n     \"knows Spy evs \\<subseteq> knows Spy (Gets A X # evs)\"\nby (simp add: subset_insertI)\n\ntext\\<open>Spy sees what is sent on the traffic\\<close>\nlemma Says_imp_knows_Spy [rule_format]:\n     \"Says A B X \\<in> set evs \\<longrightarrow> X \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\nlemma Notes_imp_knows_Spy [rule_format]:\n     \"Notes A X \\<in> set evs \\<longrightarrow> A \\<in> bad \\<longrightarrow> X \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\n\ntext\\<open>Elimination rules: derive contradictions from old Says events containing\n  items known to be fresh\\<close>\nlemmas knows_Spy_partsEs =\n     Says_imp_knows_Spy [THEN parts.Inj, elim_format] \n     parts.Body [elim_format]\n\nlemmas Says_imp_analz_Spy = Says_imp_knows_Spy [THEN analz.Inj]\n\ntext\\<open>Compatibility for the old \"spies\" function\\<close>\nlemmas spies_partsEs = knows_Spy_partsEs\nlemmas Says_imp_spies = Says_imp_knows_Spy\nlemmas parts_insert_spies = parts_insert_knows_A [of _ Spy]\n\n\nsubsection\\<open>Knowledge of Agents\\<close>\n\nlemma knows_Says: \"knows A (Says A B X # evs) = insert X (knows A evs)\"\nby simp\n\nlemma knows_Notes: \"knows A (Notes A X # evs) = insert X (knows A evs)\"\nby simp\n\nlemma knows_Gets:\n     \"A \\<noteq> Spy \\<longrightarrow> knows A (Gets A X # evs) = insert X (knows A evs)\"\nby simp\n\n\nlemma knows_subset_knows_Says: \"knows A evs \\<subseteq> knows A (Says A' B X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_subset_knows_Notes: \"knows A evs \\<subseteq> knows A (Notes A' X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_subset_knows_Gets: \"knows A evs \\<subseteq> knows A (Gets A' X # evs)\"\nby (simp add: subset_insertI)\n\ntext\\<open>Agents know what they say\\<close>\nlemma Says_imp_knows [rule_format]: \"Says A B X \\<in> set evs \\<longrightarrow> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext\\<open>Agents know what they note\\<close>\nlemma Notes_imp_knows [rule_format]: \"Notes A X \\<in> set evs \\<longrightarrow> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext\\<open>Agents know what they receive\\<close>\nlemma Gets_imp_knows_agents [rule_format]:\n     \"A \\<noteq> Spy \\<longrightarrow> Gets A X \\<in> set evs \\<longrightarrow> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\n\ntext\\<open>What agents DIFFERENT FROM Spy know \n  was either said, or noted, or got, or known initially\\<close>\nlemma knows_imp_Says_Gets_Notes_initState [rule_format]:\n     \"[| X \\<in> knows A evs; A \\<noteq> Spy |] ==> \\<exists>B.\n  Says A B X \\<in> set evs \\<or> Gets A X \\<in> set evs \\<or> Notes A X \\<in> set evs \\<or> X \\<in> initState A\"\napply (erule rev_mp)\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext\\<open>What the Spy knows -- for the time being --\n  was either said or noted, or known initially\\<close>\nlemma knows_Spy_imp_Says_Notes_initState [rule_format]:\n     \"[| X \\<in> knows Spy evs |] ==> \\<exists>A B.\n  Says A B X \\<in> set evs \\<or> Notes A X \\<in> set evs \\<or> X \\<in> initState Spy\"\napply (erule rev_mp)\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\nlemma parts_knows_Spy_subset_used: \"parts (knows Spy evs) \\<subseteq> used evs\"\napply (induct_tac \"evs\", force)  \napply (simp add: parts_insert_knows_A knows_Cons add: event.split, blast) \ndone\n\nlemmas usedI = parts_knows_Spy_subset_used [THEN subsetD, intro]\n\nlemma initState_into_used: \"X \\<in> parts (initState B) \\<Longrightarrow> X \\<in> used evs\"\napply (induct_tac \"evs\")\napply (simp_all add: parts_insert_knows_A split: event.split, blast)\ndone\n\nlemma used_Says [simp]: \"used (Says A B X # evs) = parts{X} \\<union> used evs\"\nby simp\n\nlemma used_Notes [simp]: \"used (Notes A X # evs) = parts{X} \\<union> used evs\"\nby simp\n\nlemma used_Gets [simp]: \"used (Gets A X # evs) = used evs\"\nby simp\n\nlemma used_nil_subset: \"used [] \\<subseteq> used evs\"\napply simp\napply (blast intro: initState_into_used)\ndone\n\ntext\\<open>NOTE REMOVAL--laws above are cleaner, as they don't involve \"case\"\\<close>\ndeclare knows_Cons [simp del]\n        used_Nil [simp del] used_Cons [simp del]\n\n\ntext\\<open>For proving theorems of the form \\<^term>\\<open>X \\<notin> analz (knows Spy evs) \\<longrightarrow> P\\<close>\n  New events added by induction to \"evs\" are discarded.  Provided \n  this information isn't needed, the proof will be much shorter, since\n  it will omit complicated reasoning about \\<^term>\\<open>analz\\<close>.\\<close>\n\nlemmas analz_mono_contra =\n       knows_Spy_subset_knows_Spy_Says [THEN analz_mono, THEN contra_subsetD]\n       knows_Spy_subset_knows_Spy_Notes [THEN analz_mono, THEN contra_subsetD]\n       knows_Spy_subset_knows_Spy_Gets [THEN analz_mono, THEN contra_subsetD]\n\nlemmas analz_impI = impI [where P = \"Y \\<notin> analz (knows Spy evs)\"] for Y evs\n\nML\n\\<open>\nfun analz_mono_contra_tac ctxt =\n  resolve_tac ctxt @{thms analz_impI} THEN' \n  REPEAT1 o (dresolve_tac ctxt @{thms analz_mono_contra})\n  THEN' mp_tac ctxt\n\\<close>\n\nlemma knows_subset_knows_Cons: \"knows A evs \\<subseteq> knows A (e # evs)\"\nby (induct e, auto simp: knows_Cons)\n\nlemma initState_subset_knows: \"initState A \\<subseteq> knows A evs\"\napply (induct_tac evs, simp) \napply (blast intro: knows_subset_knows_Cons [THEN subsetD])\ndone\n\n\ntext\\<open>For proving \\<open>new_keys_not_used\\<close>\\<close>\nlemma keysFor_parts_insert:\n     \"[| K \\<in> keysFor (parts (insert X G));  X \\<in> synth (analz H) |] \n      ==> K \\<in> keysFor (parts (G \\<union> H)) | Key (invKey K) \\<in> parts H\" \nby (force \n    dest!: parts_insert_subset_Un [THEN keysFor_mono, THEN [2] rev_subsetD]\n           analz_subset_parts [THEN keysFor_mono, THEN [2] rev_subsetD]\n    intro: analz_subset_parts [THEN subsetD] parts_mono [THEN [2] rev_subsetD])\n\nmethod_setup analz_mono_contra = \\<open>\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (analz_mono_contra_tac ctxt)))\\<close>\n    \"for proving theorems of the form X \\<notin> analz (knows Spy evs) \\<longrightarrow> P\"\n\nsubsubsection\\<open>Useful for case analysis on whether a hash is a spoof or not\\<close>\n\nlemmas syan_impI = impI [where P = \"Y \\<notin> synth (analz (knows Spy evs))\"] for Y evs\n\nML\n\\<open>\nval knows_Cons = @{thm knows_Cons};\nval used_Nil = @{thm used_Nil};\nval used_Cons = @{thm used_Cons};\n\nval Notes_imp_used = @{thm Notes_imp_used};\nval Says_imp_used = @{thm Says_imp_used};\nval Says_imp_knows_Spy = @{thm Says_imp_knows_Spy};\nval Notes_imp_knows_Spy = @{thm Notes_imp_knows_Spy};\nval knows_Spy_partsEs = @{thms knows_Spy_partsEs};\nval spies_partsEs = @{thms spies_partsEs};\nval Says_imp_spies = @{thm Says_imp_spies};\nval parts_insert_spies = @{thm parts_insert_spies};\nval Says_imp_knows = @{thm Says_imp_knows};\nval Notes_imp_knows = @{thm Notes_imp_knows};\nval Gets_imp_knows_agents = @{thm Gets_imp_knows_agents};\nval knows_imp_Says_Gets_Notes_initState = @{thm knows_imp_Says_Gets_Notes_initState};\nval knows_Spy_imp_Says_Notes_initState = @{thm knows_Spy_imp_Says_Notes_initState};\nval usedI = @{thm usedI};\nval initState_into_used = @{thm initState_into_used};\nval used_Says = @{thm used_Says};\nval used_Notes = @{thm used_Notes};\nval used_Gets = @{thm used_Gets};\nval used_nil_subset = @{thm used_nil_subset};\nval analz_mono_contra = @{thms analz_mono_contra};\nval knows_subset_knows_Cons = @{thm knows_subset_knows_Cons};\nval initState_subset_knows = @{thm initState_subset_knows};\nval keysFor_parts_insert = @{thm keysFor_parts_insert};\n\n\nval synth_analz_mono = @{thm synth_analz_mono};\n\nval knows_Spy_subset_knows_Spy_Says = @{thm knows_Spy_subset_knows_Spy_Says};\nval knows_Spy_subset_knows_Spy_Notes = @{thm knows_Spy_subset_knows_Spy_Notes};\nval knows_Spy_subset_knows_Spy_Gets = @{thm knows_Spy_subset_knows_Spy_Gets};\n\n\nfun synth_analz_mono_contra_tac ctxt = \n  resolve_tac ctxt @{thms syan_impI} THEN'\n  REPEAT1 o \n    (dresolve_tac ctxt\n     [@{thm knows_Spy_subset_knows_Spy_Says} RS @{thm synth_analz_mono} RS @{thm contra_subsetD},\n      @{thm knows_Spy_subset_knows_Spy_Notes} RS @{thm synth_analz_mono} RS @{thm contra_subsetD},\n      @{thm knows_Spy_subset_knows_Spy_Gets} RS @{thm synth_analz_mono} RS @{thm contra_subsetD}])\n  THEN'\n  mp_tac ctxt\n\\<close>\n\nmethod_setup synth_analz_mono_contra = \\<open>\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (synth_analz_mono_contra_tac ctxt)))\\<close>\n    \"for proving theorems of the form X \\<notin> synth (analz (knows Spy evs)) \\<longrightarrow> P\"\n(*>*)\n\nsection\\<open>Event Traces \\label{sec:events}\\<close>\n\ntext \\<open>\nThe system's behaviour is formalized as a set of traces of\n\\emph{events}.  The most important event, \\<open>Says A B X\\<close>, expresses\n$A\\to B : X$, which is the attempt by~$A$ to send~$B$ the message~$X$.\nA trace is simply a list, constructed in reverse\nusing~\\<open>#\\<close>.  Other event types include reception of messages (when\nwe want to make it explicit) and an agent's storing a fact.\n\nSometimes the protocol requires an agent to generate a new nonce. The\nprobability that a 20-byte random number has appeared before is effectively\nzero.  To formalize this important property, the set \\<^term>\\<open>used evs\\<close>\ndenotes the set of all items mentioned in the trace~\\<open>evs\\<close>.\nThe function \\<open>used\\<close> has a straightforward\nrecursive definition.  Here is the case for \\<open>Says\\<close> event:\n@{thm [display,indent=5] used_Says [no_vars]}\n\nThe function \\<open>knows\\<close> formalizes an agent's knowledge.  Mostly we only\ncare about the spy's knowledge, and \\<^term>\\<open>knows Spy evs\\<close> is the set of items\navailable to the spy in the trace~\\<open>evs\\<close>.  Already in the empty trace,\nthe spy starts with some secrets at his disposal, such as the private keys\nof compromised users.  After each \\<open>Says\\<close> event, the spy learns the\nmessage that was sent:\n@{thm [display,indent=5] knows_Spy_Says [no_vars]}\nCombinations of functions express other important\nsets of messages derived from~\\<open>evs\\<close>:\n\\begin{itemize}\n\\item \\<^term>\\<open>analz (knows Spy evs)\\<close> is everything that the spy could\nlearn by decryption\n\\item \\<^term>\\<open>synth (analz (knows Spy evs))\\<close> is everything that the spy\ncould generate\n\\end{itemize}\n\\<close>\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/Doc/Tutorial/Protocol/Event.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.34224233740639465}}
{"text": "(*File: Cachera.thy\n  Author: L Beringer & M Hofmann, LMU Munich\n  Date: 05/12/2008\n  Purpose: Strong interpretation of, and derived proof system for,\n           heap analysis a la Cachera/Jensen/Pichardie/Schneider,\n           using invariants.\n*)\n(*<*)\ntheory Cachera imports Logic begin\n(*>*)\n\nsection\\<open>A derived logic for a strong type system\\<close>\n\ntext\\<open>In this section we consider a system of derived assertions, for\na type system for bounded heap consumption. The type system arises by\nreformulating the analysis of Cachera, Jensen, Pichardie, and\nSchneider \\cite{CaJePiSc05MemoryUsage} for a high-level functional\nlanguage. The original approach of Cachera et al.~consists of\nformalising the correctness proof of a certain analysis technique in\nCoq. Consequently, the verification of a program requires the\nexecution of the analysis algorithm inside the theorem prover, which\ninvolves the computation of the (method) call graph and fixed point\niterations.  In contrast, our approach follows the proof-carrying code\nparadigm more closely: the analysis amounts to a type inference which\nis left unformalised and can thus be carried out outside the trusted\ncode base. Only the result of the analysis is communicated to the code\nrecipient.  The recipient verifies the validity of the certificate by\na largely syntax-directed single-pass traversal of the (low-level)\ncode using a domain-specific program logic. This approach to\nproof-carrying code was already explored in the MRG project, with\nrespect to program logics of partial correctness\n\\cite{BeringerHofmannMomiglianoShkaravska:LPAR2004} and a type system\nfor memory consumption by Hofmann and\nJost~\\cite{HofmannJost:POPL2003}. In order to obtain\nsyntax-directedness of the proof rules, these had to be formulated at\nthe granularity of typing judgements. In contrast, the present proof\nsystem admits proof rules for individual JVM instructions.\n\nHaving derived proof rules for individual JVM instructions, we\nintroduce a type system for a small functional language, and a\ncompilation into bytecode.  The type system associates a natural\nnumber $n$ to an expression $e$, in a typing context\n$\\Sigma$. Informally, the interpretation of a typing judgement\n$\\Sigma \\rhd e:n$ is that the evaluation of $e$ (which may include\nthe invocation of functions whose resource behaviour is specified in\n$\\Sigma$) does not perform more than $n$ allocations. The type system\nis then formally proven sound, using the derived logic for bytecode.\nBy virtue of the invariants, the guarantee given by the present system\nis stronger than the one given by our encoding of the Hofmann-Jost\nsystem, as even non-terminating programs can be verified in a\nmeaningful way.\\<close>\n\nsubsection\\<open>Syntax and semantics of judgements\\<close>\n\ntext\\<open>The formal interpretation at JVM level of a type \\<open>n\\<close> is\ngiven by a triple $$\\mathit{Cachera}(n) = (A, B, I)$$ consisting of a\n(trivial) precondition, a post-condition, and a strong invariant.\\<close>\n\ndefinition Cachera::\"nat \\<Rightarrow> (Assn \\<times> Post \\<times> Inv)\" where\n\"Cachera n = (\\<lambda> s0 s . True,\n              \\<lambda> s0 (ops,s,h) (k,v) . |k| \\<le> |h| + n,\n              \\<lambda> s0 (ops,s,h) k.  |k| \\<le> |h| + n)\"\n\ntext\\<open>This definition is motivated by the expectation that $\\rhd\n\\lbrace A \\rbrace\\; \\ulcorner\\, e \\urcorner\\, \\lbrace B \\rbrace\\, I$\nshould be derivable whenever the type judgement $\\Sigma \\rhd e:n$\nholds, where $ \\ulcorner e \\urcorner$ is the translation of compiling\nthe expression $e$ into JVML, and the specification table \\<open>MST\\<close>\ncontains the interpretations of the entries in $\\Sigma$.\\<close>\n\ntext\\<open>We abbreviate the above construction of judgements by a\npredicate \\<open>deriv\\<close>.\\<close>\n\ndefinition deriv::\"CTXT \\<Rightarrow> Class \\<Rightarrow> Method \\<Rightarrow> Label \\<Rightarrow> \n                    (Assn \\<times> Post \\<times> Inv) \\<Rightarrow> bool\" where\n\"deriv G C m l (ABI) = (let (A,B,I) = ABI in (G \\<rhd> \\<lbrace> A \\<rbrace> C,m,l \\<lbrace> B \\<rbrace> I))\"\n\ntext\\<open>Thus, the intended interpretation of a typing judgement $\\Sigma\n\\rhd e: n$ is $$\\mathit{deriv}\\; C\\; m\\; l\\; (\\mathit{Cachera}\\; n)$$\nif $e$ translates to a code block whose first instruction is at\n$C.m.l$.\\<close>\n\ntext\\<open>We also define a judgement of the auxiliary form of\nsequents.\\<close>\n\ndefinition derivAssum::\"CTXT \\<Rightarrow> Class \\<Rightarrow> Method \\<Rightarrow> Label \\<Rightarrow> \n                         (Assn \\<times> Post \\<times> Inv) \\<Rightarrow> bool\" where\n\"derivAssum G C m l (ABI) = (let (A,B,I) = ABI in G \\<rhd>  \\<langle> A \\<rangle> C,m,l \\<langle> B \\<rangle> I)\"\n\ntext\\<open>The following operation converts a derived judgement into the\nsyntactical form of method specifications.\\<close>\n\ndefinition mkSPEC::\"(Assn \\<times> Post \\<times> Inv) \\<Rightarrow> ANNO \\<Rightarrow>\n                   (MethSpec \\<times> MethInv \\<times> ANNO)\" where\n\"mkSPEC (ABI) Anno = (let (A,B,I) = ABI in\n       (\\<lambda> s0 t . B s0 (mkState s0) t, \\<lambda> s0 h . I s0 (mkState s0) h, Anno))\"\n\ntext\\<open>This enables the interpretation of typing contexts $\\Sigma$ as a\nset of constraints on the specification table \\<open>MST\\<close>.\\<close>\n\nsubsection\\<open>Derived proof rules\\<close>\n(*<*)\ndeclare Let_def[simp]\n(*>*)\ntext\\<open>We are now ready to prove derived rules, i.e.~proof rules where\nassumptions as well as conclusions are of the restricted assertion\nform. While their justification unfolds the definition of the\npredicate \\<open>deriv\\<close>, their application will not. We first give\nsyntax-directed proof rules for all JVM instructions:\\<close>\n\nlemma CACH_NEW:\n \"\\<lbrakk> ins_is C m l (new c); MST\\<down>(C,m)=Some(Mspec,Minv,Anno);\n    Anno\\<down>(l) = None; n = k + 1; derivAssum G C m (l+1) (Cachera k) \\<rbrakk>\n \\<Longrightarrow> deriv G C m l (Cachera n)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\napply (rule INSTR) apply assumption+ apply simp apply (simp add: heap_def)\napply fast\napply (erule CONSEQ)\napply (simp add: SP_pre_def) \napply clarsimp apply (simp add: SP_post_def) apply clarsimp\n  apply (drule NewElim1, fastforce) apply clarsimp\n  apply (subgoal_tac \"ba\\<down>(nextLoc ba) = None\")\n    apply (simp add: AL_Size_UpdateSuc) \n  apply (rule nextLoc_fresh)\napply clarsimp\n  apply (simp add: SP_inv_def)\n  apply clarsimp\n  apply (drule NewElim1, fastforce) apply clarsimp\n  apply (subgoal_tac \"ba\\<down>(nextLoc ba) = None\")\n    apply (simp add: AL_Size_UpdateSuc) \n  apply (rule nextLoc_fresh)\ndone\n(*>*)\n\nlemma CACH_INSTR:\n \"\\<lbrakk> ins_is C m l I; \n    I \\<in> { const c, dup, pop, swap, load x, store x, binop f, \n          unop g, getfield d F, putfield d F, checkcast d}; \n    MST\\<down>(C,m)=Some(Mspec,Minv,Anno); Anno\\<down>(l) = None; \n    derivAssum G C m (l+1) (Cachera n) \\<rbrakk>\n \\<Longrightarrow> deriv G C m l (Cachera n)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\napply (rule INSTR) apply assumption+ apply simp apply (simp add: heap_def)\napply fast\napply (erule CONSEQ)\napply (simp add: SP_pre_def) \napply (simp add: SP_post_def) apply clarsimp \napply safe\napply (drule ConstElim1, fastforce) apply clarsimp\napply (drule DupElim1, fastforce) apply clarsimp\napply (drule PopElim1, fastforce) apply clarsimp\napply (drule SwapElim1, fastforce) apply clarsimp\napply (drule LoadElim1, fastforce) apply clarsimp\napply (drule StoreElim1, fastforce) apply clarsimp\napply (drule BinopElim1, fastforce) apply clarsimp\napply (drule UnopElim1, fastforce) apply clarsimp\napply (drule GetElim1, fastforce) apply clarsimp\napply (drule PutElim1, fastforce) apply clarsimp\n  apply (simp add: updSize) \napply (drule CastElim1, fastforce) apply clarsimp\n\napply (simp_all add: SP_inv_def)\napply safe\napply (drule ConstElim1, fastforce) apply clarsimp\napply (drule DupElim1, fastforce) apply clarsimp\napply (drule PopElim1, fastforce) apply clarsimp\napply (drule SwapElim1, fastforce) apply clarsimp\napply (drule LoadElim1, fastforce) apply clarsimp\napply (drule StoreElim1, fastforce) apply clarsimp\napply (drule BinopElim1, fastforce) apply clarsimp\napply (drule UnopElim1, fastforce) apply clarsimp\napply (drule GetElim1, fastforce) apply clarsimp\napply (drule PutElim1, fastforce) apply clarsimp\n  apply (simp add: updSize) \napply (drule CastElim1, fastforce) apply clarsimp\ndone\n(*>*)\n\nlemma CACH_RET: \n \"\\<lbrakk> ins_is C m l vreturn; MST\\<down>(C,m)=Some(Mspec,Minv,Anno); \n    Anno\\<down>(l) = None \\<rbrakk>\n  \\<Longrightarrow> deriv G C m l (Cachera 0)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\napply (rule VRET) apply assumption+  apply simp apply (simp add: heap_def)\napply clarsimp\ndone\n(*>*)\n\nlemma CACH_GOTO:\n \"\\<lbrakk> ins_is C m l (goto pc); MST\\<down>(C,m)=Some(Mspec,Minv,Anno);\n    Anno\\<down>(l) = None; derivAssum G C m pc (Cachera n) \\<rbrakk>\n \\<Longrightarrow> deriv G C m l (Cachera n)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\napply (rule GOTO) apply assumption+ apply simp apply (simp add: heap_def)\napply (erule CONSEQ)\napply (simp add: SP_pre_def) \napply (simp add: SP_post_def) apply clarsimp apply (drule GotoElim1, fastforce)\napply clarsimp\napply (simp add: SP_inv_def) apply clarsimp apply (drule GotoElim1, fastforce)\napply clarsimp\ndone\n(*>*)\n\nlemma CACH_IF:\n  \"\\<lbrakk> ins_is C m l (iftrue pc); MST\\<down>(C,m)=Some(Mspec,Minv,Anno); \n     Anno\\<down>(l) = None; derivAssum G C m pc (Cachera n);\n     derivAssum G C m (l+1) (Cachera n) \\<rbrakk>\n  \\<Longrightarrow> deriv G C m l (Cachera n)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\napply (rule IF) apply assumption+ apply (simp, simp add: heap_def)\napply (erule CONSEQ)\napply (simp add: SP_pre_def)\napply (simp add: SP_post_def) apply clarsimp apply (drule IfElim1, fastforce) apply clarsimp\napply (simp add: SP_inv_def) apply clarsimp  apply (drule IfElim1, fastforce) apply clarsimp\napply clarsimp\napply (erule CONSEQ)\napply (simp add: SP_pre_def)\napply (simp add: SP_post_def) apply clarsimp apply (drule IfElim1, fastforce) apply clarsimp\napply (simp add: SP_inv_def) apply clarsimp  apply (drule IfElim1, fastforce) apply clarsimp\ndone\n(*>*)\n\nlemma CACH_INVS: \n  \"\\<lbrakk> ins_is C m l (invokeS D m'); mbody_is D m' (par,code,l0);\n     MST\\<down>(C,m)=Some(Mspec,Minv,Anno); Anno\\<down>(l) = None; \n     MST\\<down>(D, m') = Some(mkSPEC (Cachera k) Anno2);\n     nk = n+k; derivAssum G C m (l+1) (Cachera n)\\<rbrakk>\n   \\<Longrightarrow> deriv G C m l (Cachera nk)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\n\napply (rule INVS) apply assumption+ \napply (simp add: mkSPEC_def) apply fastforce apply simp apply (simp add: heap_def)\napply (simp add: mkState_def)\napply (erule CONSEQ)\napply clarsimp\napply clarsimp apply (simp add: SINV_post_def mkState_def) \napply clarsimp apply (simp add: SINV_inv_def mkState_def) \ndone\n(*>*)\n\ntext\\<open>In addition, we have two rules for subtyping\\<close>\n\nlemma CACH_SUB:\n \"\\<lbrakk> deriv G C m l (Cachera n); n \\<le> k\\<rbrakk> \\<Longrightarrow> deriv G C m l (Cachera k)\"\n(*<*)\napply (simp add: deriv_def derivAssum_def Cachera_def)\napply (rule CONSEQ, assumption+) \napply simp\napply simp\napply simp\ndone\n(*>*)\n\nlemma CACHAssum_SUB:\n \"\\<lbrakk> derivAssum G C m l (Cachera n); n \\<le> k\\<rbrakk>\n  \\<Longrightarrow> derivAssum G C m l (Cachera k)\"\n(*<*)\napply (simp add: derivAssum_def Cachera_def)\napply (rule CONSEQ, assumption+) \napply simp\napply simp\napply simp\ndone\n(*>*)\n\ntext\\<open>and specialised forms of the axiom rule and the injection rule.\\<close>\n\nlemma CACH_AX:\n \"\\<lbrakk> G\\<down>(C,m,l) = Some (Cachera n); MST\\<down>(C,m)=Some(Mspec,Minv,Anno); \n    Anno\\<down>(l) = None\\<rbrakk> \n \\<Longrightarrow> derivAssum G C m l (Cachera n)\"\n(*<*)\napply (simp add: derivAssum_def Cachera_def)\napply (drule AX) apply assumption apply simp apply (simp add: heap_def)\napply (rule CONSEQ) apply assumption+ apply simp apply simp apply simp\ndone\n(*>*)\n\nlemma CACH_INJECT:\n  \"deriv G C m l (Cachera n) \\<Longrightarrow> derivAssum G C m l (Cachera n)\"\n(*<*)\napply (simp add: deriv_def derivAssum_def Cachera_def)\napply (erule INJECT)\ndone\n(*>*)\n\ntext\\<open>Finally, a verified-program rule relates specifications to\njudgements for the method bodies. Thus, even the method specifications\nmay be given as derived assertions (modulo the \\<open>mkSPEC\\<close>-conversion).\\<close>\n\nlemma CACH_VP:\n \"\\<lbrakk> \\<forall> c m par code l0. mbody_is c m (par, code, l0) \\<longrightarrow>\n          (\\<exists> n Anno . MST\\<down>(c,m) = Some(mkSPEC(Cachera n) Anno) \\<and> \n                 deriv G c m l0 (Cachera n));\n    \\<forall> c m l A B I. G\\<down>(c,m,l) = Some(A,B,I) \\<longrightarrow>\n                   (\\<exists> n . (A,B,I) = Cachera n \\<and> deriv G c m l (Cachera n))\\<rbrakk> \n  \\<Longrightarrow> VP\"\n(*<*)\napply (simp add: VP_def) apply (rule_tac x=G in exI, simp add: VP_G_def)\napply safe\n(*G*)\n  apply (erule thin_rl)\n  apply (erule_tac x=C in allE, erule_tac x=m in allE, erule_tac x=l in allE, clarsimp)\n  apply (simp add: deriv_def)\n(*MST*)\napply (rotate_tac 1, erule thin_rl)\napply (erule_tac x=C in allE, erule_tac x=m in allE) \napply(erule_tac x=par in allE, erule_tac x=code in allE, erule_tac x=l0 in allE, clarsimp)\napply (simp add: Cachera_def mkSPEC_def deriv_def, clarsimp)\napply (rule CONSEQ) apply assumption+ \napply simp\napply (simp add: mkPost_def mkState_def)\napply (simp add: mkState_def mkInv_def)\ndone\n(*>*)\n\nsubsection\\<open>Soundness of high-level type system\\<close>\n\ntext\\<open>We define a first-order functional language where expressions\nare stratified into primitive expressions and general expressions. The\nlanguage supports the construction of lists using constructors\n$\\mathit{NilPrim}$ and $\\mathit{ConsPrim}\\; h\\; t$, and includes a\ncorresponding pattern match operation. In order to simplify the\ncompilation, function identifiers are taken to be pairs of class names\nand method names.\\<close>\n\ntype_synonym Fun = \"Class \\<times> Method\"\n\ndatatype Prim =\n  IntPrim int\n| UnPrim \"Val \\<Rightarrow> Val\" Var \n| BinPrim \"Val \\<Rightarrow> Val \\<Rightarrow> Val\" Var Var\n| NilPrim\n| ConsPrim Var Var\n| CallPrim Fun \"Var list\"\n\ndatatype Expr = \n  PrimE Prim\n| LetE Var Prim Expr\n| CondE Var Expr Expr\n| MatchE Var Expr Var Var Expr\n\ntype_synonym FunProg = \"(Fun,Var list \\<times> Expr) AssList\"\n\ntext\\<open>The type system uses contexts that associate a type (natural\nnumber) to function identifiers.\\<close>\n\ntype_synonym TP_Sig = \"(Fun, nat) AssList\"\n\ntext\\<open>We first give the rules for primitive expressions.\\<close>\n\ninductive_set TP_prim::\"(TP_Sig \\<times> Prim \\<times> nat)set\"\nwhere\nTP_int: \"(\\<Sigma>,IntPrim i,0) : TP_prim\"\n|\nTP_un: \"(\\<Sigma>,UnPrim f x,0) : TP_prim\"\n|\nTP_bin: \"(\\<Sigma>,BinPrim f x y,0) : TP_prim\"\n|\nTP_nil: \"(\\<Sigma>,NilPrim,0) : TP_prim\"\n|\nTP_cons: \"(\\<Sigma>,ConsPrim x y,1) : TP_prim\"\n|\nTP_Call: \"\\<lbrakk>\\<Sigma>\\<down>f = Some n\\<rbrakk> \\<Longrightarrow> (\\<Sigma>,CallPrim f args,n) : TP_prim\"\n\ntext\\<open>Next, the rules for general expressions.\\<close>\n\ninductive_set TP_expr::\"(TP_Sig \\<times> Expr \\<times> nat) set\"\nwhere\nTP_sub: \"\\<lbrakk>(\\<Sigma>,e,m):TP_expr; m \\<le> n\\<rbrakk> \\<Longrightarrow> (\\<Sigma>,e,n):TP_expr\"\n|\nTP_prim:\"\\<lbrakk>(\\<Sigma>,p,n):TP_prim\\<rbrakk> \\<Longrightarrow> (\\<Sigma>,PrimE p,n) : TP_expr\"\n|\nTP_let: \"\\<lbrakk>(\\<Sigma>,p,k):TP_prim; (\\<Sigma>,e,m):TP_expr; n = k+m\\<rbrakk> \n        \\<Longrightarrow> (\\<Sigma>,LetE x p e,n) : TP_expr\"\n|\nTP_Cond:\"\\<lbrakk>(\\<Sigma>,e1,n):TP_expr; (\\<Sigma>,e2,n):TP_expr\\<rbrakk> \n        \\<Longrightarrow>(\\<Sigma>,CondE x e1 e2,n) : TP_expr\"\n|\nTP_Match:\"\\<lbrakk>(\\<Sigma>,e1,n):TP_expr; (\\<Sigma>,e2,n):TP_expr \\<rbrakk>\n          \\<Longrightarrow> (\\<Sigma>,MatchE x e1 h t e2,n):TP_expr\"\n\ntext\\<open>A functional program is well-typed if its domain agrees with\nthat of some context such that each function body validates the\ncontext entry.\\<close>\n\ndefinition TP::\"TP_Sig \\<Rightarrow> FunProg \\<Rightarrow> bool\" where\n\"TP \\<Sigma> F = ((\\<forall> f . (\\<Sigma>\\<down>f = None) = (F\\<down>f = None)) \\<and> \n          (\\<forall> f n par e . \\<Sigma>\\<down>f = Some n \\<longrightarrow> F\\<down>f = Some (par,e) \\<longrightarrow> (\\<Sigma>,e,n):TP_expr))\"\n\ntext\\<open>For the translation into bytecode, we introduce identifiers for\na class of lists, the expected field names, and a temporary (reserved)\nvariable name.\\<close> \n\naxiomatization\n  LIST::Class and\n  HD::Field and\n  TL::Field and\n  tmp::Var\n\ntext\\<open>The compilation of primitive expressions extends a code block by\na sequence of JVM instructions that leave a value on the top of the\noperand stack.\\<close>\n\ninductive_set compilePrim::\n  \"(Label \\<times>  (Label,Instr) AssList \\<times> Prim \\<times> ((Label,Instr) AssList \\<times> Label)) set\" \nwhere\ncompileInt: \"(l, code, IntPrim i, (code[l\\<mapsto>(const (IVal i))],l+1)) : compilePrim\"\n|\ncompileUn:\n  \"(l, code, UnPrim f x, (code[l\\<mapsto>(load x)][(l+1)\\<mapsto>(unop f)],l+2)) : compilePrim\"\n|\ncompileBin: \n \"(l, code, BinPrim f x y,\n     (code[l\\<mapsto>(load x)][(l+1)\\<mapsto>(load y)][(l+2)\\<mapsto>(binop f)],l+3)) : compilePrim\"\n|\ncompileNil:\n  \"(l, code, NilPrim, (code[l\\<mapsto>(const (RVal Nullref))],l+1)) : compilePrim\"\n|\ncompileCons:\n  \"(l, code, ConsPrim x y, \n      (code[l\\<mapsto>(load y)][(l+1)\\<mapsto>(load x)]\n           [(l+2)\\<mapsto>(new LIST)][(l+3)\\<mapsto>store tmp]\n           [(l+4)\\<mapsto>load tmp][(l+5)\\<mapsto>(putfield LIST HD)]\n           [(l+6)\\<mapsto>load tmp][(l+7)\\<mapsto>(putfield LIST TL)]\n           [(l+8)\\<mapsto>(load tmp)], l+9)) : compilePrim\"\n|\ncompileCall_Nil:\n  \"(l, code, CallPrim f [],(code[l\\<mapsto>invokeS (fst f) (snd f)],l+1)): compilePrim\"  \n|\ncompileCall_Cons:\n  \"\\<lbrakk> (l+1,code[l\\<mapsto>load x], CallPrim f args, OUT) : compilePrim\\<rbrakk>\n   \\<Longrightarrow> (l, code, CallPrim f (x#args), OUT): compilePrim\"            \n\ntext\\<open>The following lemma shows that the resulting code is an\nextension of the code submitted as an argument, and that the\nnew instructions define a contiguous block.\\<close>\n\nlemma compilePrim_Prop1[rule_format]:\n\"(l, code, p, OUT) : compilePrim \\<Longrightarrow>\n (\\<forall> code1l1 . OUT = (code1, l1) \\<longrightarrow>\n     (l < l1 \\<and> (\\<forall> ll . ll < l \\<longrightarrow> code1\\<down>ll = code\\<down>ll) \\<and> \n       (\\<forall> ll . l \\<le> ll \\<longrightarrow> ll < l1 \\<longrightarrow> (\\<exists> ins . code1\\<down>ll = Some ins))))\"\n(*<*)\napply (erule compilePrim.induct)\napply clarsimp \n  apply rule\n  apply clarsimp apply (rule AL_update2) apply simp \n  apply (rule, rule AL_update1)\napply clarsimp\n  apply rule\n    apply clarsimp\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (simp, simp, simp)\n  apply clarsimp\n    apply (case_tac \"ll=l\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply simp\n    apply (case_tac \"ll=l+1\", clarsimp, rule)\n      apply (simp add: AL_update1)\n    apply simp\n(*BIN*)\n apply clarsimp\n  apply rule\n    apply clarsimp\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (simp, simp, simp, simp)\n  apply clarsimp\n    apply (case_tac \"ll=l\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply (simp, simp)\n    apply (case_tac \"ll=l+1\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply simp\n    apply (case_tac \"ll=l+2\", clarsimp, rule)\n      apply (simp add: AL_update1)\n    apply simp\napply clarsimp \n  apply rule\n    apply clarsimp apply (rule AL_update2) apply simp\n    apply (rule, rule AL_update1) apply simp\napply clarsimp\n  apply rule apply clarsimp\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (simp, simp, simp, simp)\n    apply (simp, simp, simp, simp)\n    apply (simp, simp)\n  apply clarsimp\n    apply (case_tac \"ll=l\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply (simp, simp, simp,simp)\n      apply (simp, simp, simp,simp)\n    apply (case_tac \"ll=l+1\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply (simp, simp, simp,simp)\n      apply (simp, simp, simp)\n    apply (case_tac \"ll=l+2\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply (simp, simp, simp,simp)\n      apply (simp, simp)\n    apply (case_tac \"ll=l+3\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update1) \n      apply (simp, simp, simp,simp)\n      apply simp\n    apply (case_tac \"ll=l+4\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update1) \n      apply (simp, simp, simp,simp)\n    apply (case_tac \"ll=l+5\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update1) \n      apply (simp, simp, simp)\n    apply (case_tac \"ll=l+6\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update1) \n      apply (simp, simp)\n    apply (case_tac \"ll=l+7\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update1) \n      apply (simp)\n    apply (case_tac \"ll=l+8\", clarsimp, rule)\n      apply (rule AL_update1)\n      apply simp\n(*CALL-NIL*)\napply clarsimp \n  apply (rule, clarsimp)\n    apply (rule AL_update5) apply (simp ,simp)\n  apply (rule, rule AL_update1)\n(*CALL-CONS*)\napply clarsimp\n  apply (rule, clarsimp)\n    apply (rule AL_update5) apply simp apply simp\n  apply clarsimp\n    apply (erule_tac x=ll in allE)+ apply clarsimp \n    apply (case_tac \"l=ll\", clarsimp) apply (rule, rule AL_update1) \n    apply clarsimp\ndone\n(*>*)\n\ntext\\<open>A signature corresponds to a method specification table if all\ncontext entries are represented as \\<open>MST\\<close> entries and method\nnames that are defined in the global program \\<open>P\\<close>.\\<close>\n\ndefinition Sig_good::\"TP_Sig \\<Rightarrow> bool\" where\n\"Sig_good \\<Sigma> =\n (\\<forall> C m n. \\<Sigma>\\<down>(C,m) = Some n \\<longrightarrow> \n    (MST\\<down>(C, m) = Some (mkSPEC (Cachera n) emp) \\<and>\n    (\\<exists> par code l0 . mbody_is C m (par,code,l0))))\"\n\ntext\\<open>This definition requires \\<open>MST\\<close> to associate the\nspecification $$\\mathit{mkSPEC}\\; (\\mathit{Cachera}\\; n)\\;\n\\mathit{emp}$$ to each method to which the type signature associates\nthe type $n$. In particular, this requires the annotation table of\nsuch a method to be empty. Additionally, the global program $P$ is\nrequired to contain a method definition for each method\n(i.e.~function) name occurring in the domain of the signature.\\<close>\n\ntext\\<open>An auxiliary abbreviation that captures when a block of code has\ntrivial annotations and only comprises defined program labels.\\<close>\n\ndefinition Segment::\n  \"Class \\<Rightarrow> Method \\<Rightarrow> Label \\<Rightarrow> Label \\<Rightarrow> (Label,Instr)AssList \\<Rightarrow> bool\"\nwhere\n\"Segment C m l l1 code =\n    (\\<exists> Mspec Minv Anno . MST\\<down>(C,m) = Some(Mspec,Minv,Anno) \\<and> \n      (\\<forall>ll. l \\<le> ll \\<longrightarrow> ll < l1 \\<longrightarrow>\n          Anno\\<down>(ll) = None \\<and> (\\<exists>ins. ins_is C m ll ins \\<and> code\\<down>ll = Some ins)))\"\n\n(*<*)\nlemma Segment_triv:\n  \"\\<lbrakk>Segment C m l l1 code; MST\\<down>(C,m) = Some(Mspec,Minv,Anno); l \\<le> ll; ll < l1\\<rbrakk> \n  \\<Longrightarrow> (Anno\\<down>(ll) = None \\<and> (\\<exists>ins. ins_is C m ll ins \\<and> code\\<down>ll = Some ins))\"\nby (simp add: Segment_def)\n\nlemma Segment_triv1:\n  \"\\<lbrakk>Segment C m l l1 code; MST\\<down>(C,m) = Some(Mspec,Minv,Anno); l \\<le> ll; ll < l1\\<rbrakk> \\<Longrightarrow> Anno\\<down>(ll) = None\"\nby (simp add: Segment_def)\n\nlemma Segment_triv2:\n  \"\\<lbrakk>Segment C m l l1 code; l \\<le> ll; ll < l1\\<rbrakk> \\<Longrightarrow> (\\<exists>ins. ins_is C m ll ins \\<and> code\\<down>ll = Some ins)\"\napply (simp add: Segment_def) apply clarsimp done\n\nlemma Segment_A:\n  \"\\<lbrakk>Segment C m l l1 code; l \\<le> ll; ll < l1\\<rbrakk> \\<Longrightarrow> Segment C m ll l1 code\" by (simp add: Segment_def, clarsimp)\n(*>*)\n\ntext\\<open>The soundness of (the translation of) a function call is proven\nby induction on the list of arguments.\\<close>\n\nlemma Call_SoundAux[rule_format]:\n \"\\<Sigma>\\<down>f = Some n \\<longrightarrow> \n    MST\\<down>(fst f,snd f) = Some(mkSPEC (Cachera n) Anno2) \\<longrightarrow>\n    (\\<exists> par body l0 . mbody_is (fst f) (snd f) (par,body,l0)) \\<longrightarrow>\n       (\\<forall>l code code1 l1 G C m T MI k.\n          (l, code, CallPrim f args, code1, l1) \\<in> compilePrim \\<longrightarrow>\n          MST\\<down>(C, m) = Some (T, MI,Anno) \\<longrightarrow> Segment C m l l1 code1 \\<longrightarrow>\n          derivAssum G C m l1 (Cachera k) \\<longrightarrow> \n          deriv G C m l (Cachera (n+k)))\"\n(*<*)\napply (induct args)\napply clarsimp\n  apply (erule compilePrim.cases) apply (simp,simp,simp, simp, simp, clarsimp)  \n    apply (drule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la\", assumption, simp) apply clarsimp \n  apply (erule conjE)+ apply (erule exE)+ apply (erule conjE)+\n  apply (rule CACH_INVS) \n    apply (simp add: AL_update1) apply clarsimp apply fast\n    apply assumption\n    apply assumption\n    apply assumption\n    apply assumption\n    apply simp\n    apply simp\n  apply simp\n(*CONS*)\n  apply clarsimp\n  apply (erule compilePrim.cases) apply (simp, simp, simp, simp, simp, simp) apply clarsimp\n  apply (erule impE) apply fast\n  apply (erule_tac x=\"la+1\" in allE, rotate_tac -1)\n  apply (erule_tac x=\"codea[la\\<mapsto>load x]\" in allE, rotate_tac -1)\n  apply (erule_tac x=ab in allE, rotate_tac -1)\n  apply (erule_tac x=ba in allE, clarsimp)\n  apply (erule_tac x=G in allE, rotate_tac -1)\n  apply (erule_tac x=C in allE, rotate_tac -1)\n  apply (erule_tac x=m in allE, clarsimp)\n  apply (frule compilePrim_Prop1) apply fastforce apply clarsimp \n  apply (erule impE, erule Segment_A) apply simp apply simp \n    apply (drule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la\", assumption, simp) apply clarsimp \n  apply (erule conjE)+ apply (erule exE)+ apply (erule conjE)+\n  apply (rule CACH_INSTR) apply assumption \n    apply (rotate_tac -5, erule_tac x=la in allE, clarsimp)   apply (simp add: AL_update1) \n      apply clarsimp apply fast\n    apply assumption\n    apply assumption\n  apply (rule CACH_INJECT)\n  apply simp\ndone\n(*>*)\n\nlemma Call_Sound:\n \"\\<lbrakk> Sig_good \\<Sigma>; \\<Sigma>\\<down>f = Some n; \n   (l, code, CallPrim f args, code1, l1) \\<in> compilePrim;\n   MST\\<down>(C,m) = Some (T, MI,Anno); Segment C m l l1 code1;\n   derivAssum G C m l1 (Cachera nn); k = n+nn\\<rbrakk> \n \\<Longrightarrow> deriv G C m l (Cachera k)\"\n(*<*)\napply (case_tac f, clarsimp)\napply (rule Call_SoundAux)\napply assumption apply (simp add: Sig_good_def) apply (simp add: Sig_good_def) \napply assumption apply assumption apply assumption apply assumption \ndone\n(*>*)\n \ntext\\<open>The definition of basic instructions.\\<close>\n\ndefinition basic::\"Instr \\<Rightarrow> bool\" where\n\"basic ins = ((\\<exists> c . ins = const c) \\<or> ins = dup \\<or> \n              ins= pop \\<or> ins= swap \\<or> (\\<exists> x. ins= load x) \\<or>\n              (\\<exists> y. ins= store y) \\<or> (\\<exists> f. ins= binop f) \\<or>\n              (\\<exists> g. ins= unop g) \\<or> (\\<exists> c1 F1. ins= getfield c1 F1) \\<or>\n              (\\<exists> c2 F2. ins=  putfield c2 F2) \\<or>\n              (\\<exists> c3. ins=  checkcast c3))\"\n\ntext\\<open>Next, we prove the soundness of basic instructions. The\nhypothesis refers to instructions located at the program\ncontinuation.\\<close>\n\nlemma Basic_Sound: \n  \"\\<lbrakk> Segment C m l ll code; MST\\<down>(C,m) = Some (T, MI,Anno); l\\<le>l1; l1 < ll;\n     l2=l1+1; code\\<down>l1 = Some ins; basic ins; derivAssum G C m l2 (Cachera n)\\<rbrakk>\n   \\<Longrightarrow> deriv G C m l1 (Cachera n)\"\n(*<*)\napply (drule Segment_triv) apply assumption+ apply clarsimp  apply (simp add: basic_def)\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp \napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply clarsimp apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp \ndone\n(*>*)\n\ntext\\<open>Following this, the soundness of the type system for primitive\nexpressions. The proof proceeds by induction on the typing\njudgement.\\<close>\n\nlemma TP_prim_Sound[rule_format]:\n  \"(\\<Sigma>,p,n):TP_prim \\<Longrightarrow> \n   Sig_good \\<Sigma> \\<longrightarrow>\n   (\\<forall> l code code1 l1 G C m T MI Anno nn k.\n         (l, code, p, (code1,l1)) : compilePrim \\<longrightarrow> \n         MST\\<down>(C,m) = Some (T,MI,Anno) \\<longrightarrow>\n         Segment C m l l1 code1 \\<longrightarrow> derivAssum G C m l1 (Cachera nn) \\<longrightarrow> \n         k = n+nn \\<longrightarrow> deriv G C m l (Cachera k))\"\n(*<*)\napply (erule TP_prim.induct)\n(*INT*)\napply clarsimp apply (erule thin_rl)\n  apply (erule compilePrim.cases, simp_all, clarsimp)\n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp,simp) apply simp\n  apply (simp add: AL_update1)\n  apply (simp add: basic_def)\n  apply assumption\n(*UN*) \napply clarsimp apply (erule thin_rl)\n  apply (erule compilePrim.cases, simp_all, clarsimp)\n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) \n  apply simp \n  apply (rule AL_update5) apply (simp add: AL_update1) apply simp\n  apply (simp add: basic_def)\n  apply (rule CACH_INJECT) \n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) \n  apply simp \n  apply (simp add: AL_update1) \n  apply (simp add: basic_def)\n   apply (subgoal_tac \"la+2=2+la\", clarsimp,simp)\n(*BIN*)\napply clarsimp apply (erule thin_rl)\n  apply (erule compilePrim.cases, simp_all, clarsimp)\n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp \n  apply (rule AL_update5) apply (rule AL_update5) apply (simp add: AL_update1) apply (simp, simp)\n  apply (simp add: basic_def)\n  apply (rule CACH_INJECT) \n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) \n  apply simp \n  apply (rule AL_update5) apply (simp add: AL_update1) apply simp\n  apply (simp add: basic_def)\n  apply (rule CACH_INJECT) \n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) \n  apply simp \n  apply (rule AL_update1a) apply simp\n  apply (simp add: basic_def)\n   apply (subgoal_tac \"la+3=3+la\", clarsimp, simp)\n(*Nil*)\napply clarsimp apply (erule thin_rl)\n  apply (erule compilePrim.cases, simp_all, clarsimp)\n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp,simp) apply simp \n  apply (simp add: AL_update1)\n  apply (simp add: basic_def)\n  apply assumption\n(*CONS*)\napply clarsimp apply (erule thin_rl)\n  apply (erule compilePrim.cases, simp_all, clarsimp)\n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n  apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n    apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n    apply (simp add: AL_update1) apply (simp,simp,simp,simp) apply (simp,simp,simp,simp)\n  apply (simp add: basic_def)\n  apply (rule CACH_INJECT) \n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n  apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n    apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n    apply (simp add: AL_update1) apply (simp,simp,simp,simp) apply (simp,simp,simp)\n  apply (simp add: basic_def)\n  apply (rule CACH_INJECT) \n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la+2\", assumption, simp) \n    apply simp \n  apply (subgoal_tac \"la+2=2+la\", clarsimp)\n    apply (drule AL_update3, simp) \n    apply (drule AL_update3, simp) \n    apply (drule AL_update3, simp) \n    apply (drule AL_update3, simp) \n    apply (drule AL_update3, simp) \n    apply (drule AL_update3, simp) apply (simp add: AL_update1) apply clarsimp\n    apply (rule CACH_NEW) apply assumption+\n      apply (simp, simp)\n    apply (rule CACH_INJECT) \n    apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update1a) apply simp apply (simp,simp,simp,simp) apply simp\n      apply (simp add: basic_def)\n    apply (rule CACH_INJECT) \n    apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n        apply (rule AL_update1a) apply simp apply (simp,simp,simp,simp) \n    apply (simp add: basic_def)\n    apply (rule CACH_INJECT) \n      apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n        apply (rule AL_update1a) apply simp apply (simp,simp,simp) \n        apply (simp add: basic_def)\n    apply (rule CACH_INJECT) \n    apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update5) apply (rule AL_update5) \n        apply (rule AL_update1a) apply simp apply (simp,simp) \n        apply (simp add: basic_def)\n    apply (rule CACH_INJECT) \n    apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update5) \n        apply (rule AL_update1a) apply simp apply simp\n        apply (simp add: basic_def)\n    apply (rule CACH_INJECT) \n    apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update1a) apply simp \n      apply (simp add: basic_def)\n      apply (subgoal_tac \"la+9=9+la\", clarsimp, simp)\n  apply simp\n(*Call*)\napply clarsimp\n  apply (rule Call_Sound) apply assumption+ apply simp\ndone\n(*>*)\n\ntext\\<open>The translation of general expressions is defined similarly, but\nno code continuation is required.\\<close>\n\ninductive_set compileExpr::\n  \"(Label \\<times> (Label,Instr) AssList \\<times> Expr \\<times> ((Label,Instr) AssList \\<times> Label)) set\"\nwhere\ncompilePrimE: \n \"\\<lbrakk>(l, code, p, (code1,l1)) : compilePrim; OUT = (code1[l1\\<mapsto>vreturn],l1+1)\\<rbrakk>\n   \\<Longrightarrow> (l, code, PrimE p, OUT):compileExpr\"\n|\ncompileLetE:\n  \"\\<lbrakk>(l, code, p, (code1,l1)) : compilePrim; (code2,l2) = (code1[l1\\<mapsto>(store x)],l1+1);\n     (l2, code2, e, OUT) : compileExpr\\<rbrakk>\n   \\<Longrightarrow> (l, code, LetE x p e, OUT) : compileExpr\"\n|\ncompileCondE:\n  \"\\<lbrakk>(l+2, code, e2, (codeElse,XXX)) : compileExpr;\n     (XXX, codeElse, e1, (codeThen,YYY) ) : compileExpr ;\n     OUT = (codeThen[l\\<mapsto>load x][(l+1)\\<mapsto>(iftrue XXX)], YYY)\\<rbrakk>\n   \\<Longrightarrow> (l, code, CondE x e1 e2, OUT): compileExpr\" \n|                                                                        \ncompileMatchE:\n  \"\\<lbrakk>(l+9, code, e2, (codeCons,lNil)) : compileExpr;\n     (lNil, codeCons, e1, (codeNil,lRes) ) : compileExpr ;\n     OUT = (codeNil[l\\<mapsto>(load x)]\n                   [(l+1)\\<mapsto>(unop (\\<lambda> v . if v = RVal Nullref\n                                 then TRUE else FALSE))]\n                   [(l+2)\\<mapsto>(iftrue lNil)]\n                   [(l+3)\\<mapsto>(load x)]\n                   [(l+4)\\<mapsto>(getfield LIST HD)]\n                   [(l+5)\\<mapsto>(store h)]\n                   [(l+6)\\<mapsto>(load x)]\n                   [(l+7)\\<mapsto>(getfield LIST TL)]\n                   [(l+8)\\<mapsto>(store t)], lRes) \\<rbrakk>\n   \\<Longrightarrow> (l, code, MatchE x e1 h t e2, OUT): compileExpr\"\n\ntext\\<open>Again, we prove an auxiliary result on the emitted code, by\ninduction on the compilation judgement.\\<close>\n\nlemma compileExpr_Prop1[rule_format]:\n\"(l,code,e,OUT) : compileExpr \\<Longrightarrow> \n  (\\<forall> code1 l1 . OUT = (code1, l1) \\<longrightarrow> \n      (l < l1 \\<and> \n       (\\<forall> ll . ll < l \\<longrightarrow> code1\\<down>ll = code\\<down>ll) \\<and> \n       (\\<forall> ll . l \\<le> ll \\<longrightarrow> ll < l1 \\<longrightarrow> (\\<exists> ins . code1\\<down>ll = Some ins))))\"\n(*<*)\napply (erule compileExpr.induct)\n(*PRIM*)\napply clarsimp apply (drule compilePrim_Prop1) apply fastforce  apply clarsimp\n  apply rule apply clarsimp apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule AL_update5) apply simp \n  apply clarsimp apply (case_tac \"ll < l1\", clarsimp) \n      apply (rotate_tac 1, erule_tac x=ll in allE, clarsimp) \n        apply (rule, erule AL_update5) apply simp \n  apply (subgoal_tac \"ll= l1\", clarsimp) apply (rule, simp add: AL_update1) apply simp\n(*LET*)\napply clarsimp\n  apply (drule compilePrim_Prop1) apply fastforce apply clarsimp\n  apply rule apply clarsimp\n    apply (rule AL_update5) apply simp apply simp\n  apply clarsimp apply (erule_tac x=ll in allE)+ apply clarsimp \n    apply (case_tac \"ll <l1\", clarsimp) apply (rule, erule AL_update5) apply simp\n     apply (subgoal_tac \"ll=l1\", clarsimp)\n     apply (simp add: AL_update1) apply simp\n(*COND*)\napply clarsimp \n  apply (rule, clarsimp)\n    apply (rule AL_update5)\n    apply (rule AL_update5) apply (simp ,simp)\n    apply simp\n  apply clarsimp\n    apply (case_tac \"ll=l+1\", clarsimp, rule) apply(rule AL_update1)\n    apply (case_tac \"ll=l\", clarsimp, rule) \n      apply (rule AL_update5) apply(simp add: AL_update1) apply simp\n    apply (case_tac \"XXX \\<le> ll\", clarsimp)\n      apply (rotate_tac -3, erule_tac x=ll in allE, clarsimp)\n        apply rule apply (rule AL_update5) apply (erule AL_update5) apply (simp, simp)\n    apply clarsimp \n      apply (rotate_tac -6, erule_tac x=ll in allE, clarsimp)\n      apply (rotate_tac -2, erule_tac x=ll in allE, clarsimp)\n        apply rule apply (rule AL_update5) apply (erule AL_update5) apply (simp, simp)\n(*Match*)\napply clarsimp \n  apply (rule, clarsimp)\n    apply (rule AL_update5)\n    apply (rule AL_update5) \n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5)\n    apply (rule AL_update5) \n    apply (rule AL_update5) apply (simp ,simp, simp) apply (simp ,simp, simp) apply (simp ,simp, simp)\n    apply simp\n  apply clarsimp\n    apply (case_tac \"ll=l+8\", clarsimp, rule) apply(simp add: AL_update1)\n    apply (case_tac \"ll=l+7\", clarsimp, rule) apply (rule AL_update5) apply(simp add: AL_update1) apply simp\n    apply (case_tac \"ll=l+6\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply(simp add: AL_update1) apply simp apply simp\n    apply (case_tac \"ll=l+5\", clarsimp, rule) apply (rule AL_update5)  apply (rule AL_update5) \n      apply (rule AL_update5)  apply(simp add: AL_update1) apply (simp,simp,simp)\n    apply (case_tac \"ll=l+4\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply(simp add: AL_update1) apply (simp,simp,simp,simp)\n    apply (case_tac \"ll=l+3\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply(simp add: AL_update1)\n      apply (simp,simp,simp,simp,simp)\n    apply (case_tac \"ll=l+2\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n      apply(simp add: AL_update1)\n      apply (simp,simp,simp,simp,simp, simp)\n    apply (case_tac \"ll=l+1\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply(simp add: AL_update1) \n      apply (simp,simp,simp,simp,simp, simp, simp) \n    apply (case_tac \"ll=l\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply(simp add: AL_update1) apply (simp, simp)\n      apply (simp,simp,simp,simp,simp, simp)\n    apply (case_tac \"lNil \\<le> ll\", clarsimp)\n      apply (rotate_tac -3, erule_tac x=ll in allE, clarsimp)\n        apply rule apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n            apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n            apply (rule AL_update5) apply (rule AL_update5) apply (erule AL_update5)\n          apply (simp, simp, simp)\n          apply (simp, simp, simp)\n          apply (simp, simp, simp)\n(*   apply simp*)\n      apply (rotate_tac 5) apply( erule_tac x=ll in allE, erule impE) apply (erule thin_rl) \n         apply (erule thin_rl) apply (rotate_tac -1, erule thin_rl)\n         apply (rotate_tac -1, erule thin_rl) \n         apply (rotate_tac -1, erule thin_rl) \n         apply (rotate_tac -1, erule thin_rl) \n         apply (rotate_tac -1, erule thin_rl) apply simp \n         apply (subgoal_tac \"ll < lNil\")\n         prefer 2 apply(  erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, rotate_tac 1, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) apply simp\n         apply (erule impE, assumption) \n      apply (erule_tac x=ll in allE, erule impE, assumption)\n      apply (erule exE)\n        apply rule apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n         apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n         apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl)  \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) apply simp\n          apply fast+ \ndone\n(*>*)\n\ntext\\<open>Then, soundness of the epxression type system is proven by\ninduction on the typing judgement.\\<close>\n\nlemma TP_epxr_Sound[rule_format]:\n\"(\\<Sigma>,e,n):TP_expr \\<Longrightarrow> Sig_good \\<Sigma> \\<longrightarrow>\n (\\<forall> l code code1 l1 G C m T MI Anno.\n    (l, code, e, (code1,l1)):compileExpr \\<longrightarrow>\n    MST\\<down>(C,m) = Some (T,MI,Anno) \\<longrightarrow>\n    Segment C m l l1 code1 \\<longrightarrow> deriv G C m l (Cachera n))\"\n(*<*)\napply (erule TP_expr.induct)\n(*SUB*)\napply clarsimp\n   apply (rotate_tac 2, erule thin_rl, rotate_tac -2)\n   apply (erule_tac x=l in allE, erule_tac x=code in allE)\n   apply (erule_tac x=code1 in allE, rotate_tac -1, erule_tac x=l1 in allE, clarsimp)\n   apply (erule_tac x=G in allE, erule_tac x=C in allE)\n   apply (erule_tac x=ma in allE, clarsimp)\n   apply (erule CACH_SUB) apply assumption\n(*PRIM*)\napply clarsimp \n  apply (erule compileExpr.cases) \n  prefer 2 apply simp\n  prefer 2 apply simp\n  prefer 2 apply simp\n  apply clarsimp \n  apply (erule TP_prim_Sound) apply fast  apply assumption+\n     apply (simp add: Segment_def, clarsimp)\n     apply (erule_tac x=ll in allE, clarsimp) \n       apply (drule AL_update3) apply simp \n       apply (rule, rule, assumption, assumption)\n     prefer 2 apply simp\n  apply (simp add: Segment_def)\n     apply (erule_tac x=l1a in allE, simp) apply (erule impE)\n       apply (drule compilePrim_Prop1) apply fastforce   apply simp\n     apply clarsimp  \n     apply (simp add: AL_update1, clarsimp)\n     apply (rule CACH_INJECT)\n     apply (erule CACH_RET)  apply assumption apply assumption\n(*LET*)\napply clarsimp \n  apply (erule compileExpr.cases) \n  apply simp\n  prefer 2 apply simp\n  prefer 2 apply simp\n  apply clarsimp\n  apply (frule compilePrim_Prop1) apply fastforce\n  apply (frule compileExpr_Prop1) apply fastforce apply clarsimp \n  apply (erule_tac x=\"l1a+1\" in allE, erule_tac x=\"code1a[l1a\\<mapsto>store xa]\" in allE, \n         erule_tac x=a in allE, rotate_tac -1)\n  apply (erule_tac x=b in allE, clarsimp)\n  apply (erule_tac x=G in allE, erule_tac x=C in allE, erule_tac x=ma in allE, clarsimp)\n  apply (erule impE) apply (erule Segment_A) apply (simp,simp)\n  apply (rule TP_prim_Sound) apply assumption apply assumption\n       apply assumption apply assumption \n         apply (simp add: Segment_def) apply clarsimp apply (erule_tac x=ll in allE, clarsimp) apply (rule, rule, assumption)\n          apply(drule AL_update3) apply simp apply assumption\n    prefer 2 apply simp\n  apply (rule CACH_INJECT)\n    apply (rule Basic_Sound) prefer 2 apply assumption prefer 4 apply simp prefer 2 apply (subgoal_tac \"l1a \\<le> l1a\", assumption, simp)\n    prefer 3 apply (subgoal_tac \"a\\<down>l1a = Some(store xa)\", assumption)\n         apply (rotate_tac -3, erule_tac x=l1a in allE, clarsimp) apply (simp add: AL_update1)\n    apply (subgoal_tac \"Segment C ma l1a b a\", assumption) apply (erule Segment_A) apply (simp,simp) \n    apply simp\n    apply (simp add: basic_def)\n    apply (erule CACH_INJECT)\n(*Cond*)\napply clarsimp\n  apply (erule compileExpr.cases) \n  apply simp apply simp prefer 2 apply simp\n  apply clarsimp\n  apply (erule_tac x=XXX in allE, erule_tac x= codeElse in allE, \n         erule_tac x=codeThen in allE, rotate_tac -1) \n  apply (erule_tac x= YYY in allE, clarsimp)\n  apply (erule_tac x=G in allE, rotate_tac -1, erule_tac x=C in allE,\n         erule_tac x=m in allE, clarsimp)\n  apply (erule_tac x=\"la+2\" in allE, erule_tac x= codea in allE, \n         erule_tac x=codeElse in allE, rotate_tac -1) \n  apply (erule_tac x= XXX in allE, clarsimp)\n  apply (erule_tac x=G in allE, rotate_tac -1, erule_tac x=C in allE,\n         erule_tac x=m in allE, clarsimp)\n  apply (drule compileExpr_Prop1) apply fastforce apply clarsimp \n  apply (drule compileExpr_Prop1) apply fastforce apply clarsimp \n  apply (erule impE) apply (rotate_tac 5, erule thin_rl, simp add: Segment_def,clarsimp)\n    apply (rotate_tac -3, erule_tac x=ll in allE, clarsimp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp) apply (rule, rule, assumption, assumption)\n  apply (erule impE) apply (simp add: Segment_def,clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp) apply clarsimp\n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la\", assumption, simp) apply simp\n  apply clarsimp\n  apply (drule AL_update3) apply simp apply (simp add: AL_update1) apply clarsimp\n  apply (rule CACH_INSTR) \n    apply assumption    \n    apply fast\n    apply assumption\n    apply assumption\n  apply (rule CACH_INJECT)\n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la+1\", assumption, simp) apply simp\n  apply clarsimp\n  apply (simp add: AL_update1) apply clarsimp\n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> XXX\", assumption, simp) apply simp\n  apply clarsimp\n  apply (drule AL_update3, simp)\n  apply (drule AL_update3, simp)\n  apply (rule CACH_IF) \n    apply assumption \n    apply assumption\n    apply assumption\n    apply (erule CACH_INJECT) \n    apply (subgoal_tac \"la+2=2+la\", clarsimp) apply (erule CACH_INJECT) apply simp\n(*Match*)\napply clarsimp\n  apply (erule compileExpr.cases) \n  apply simp apply simp apply simp\n  apply clarsimp\n  apply (erule_tac x=lNil in allE, erule_tac x= codeCons in allE, \n         erule_tac x=codeNil in allE, rotate_tac -1) \n  apply (erule_tac x=lRes in allE, clarsimp)\n  apply (erule_tac x=G in allE, rotate_tac -1, erule_tac x=C in allE,\n         erule_tac x=m in allE, clarsimp)\n  apply (erule_tac x=\"la+9\" in allE, erule_tac x=codea in allE, \n         erule_tac x=codeCons in allE, rotate_tac -1) \n  apply (erule_tac x=lNil in allE, clarsimp)\n  apply (erule_tac x=G in allE, rotate_tac -1, erule_tac x=C in allE,\n         erule_tac x=m in allE, clarsimp)\n  apply (drule compileExpr_Prop1) apply fastforce apply clarsimp \n  apply (drule compileExpr_Prop1) apply fastforce apply clarsimp \n  apply (erule impE) apply (rotate_tac 5, erule thin_rl)\n    apply (simp add: Segment_def, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp) apply clarsimp\n  apply (erule impE) \n    apply (simp add: Segment_def, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp) apply clarsimp\n  apply (rule Basic_Sound) prefer 2 apply assumption prefer 4 apply simp prefer 2 apply (subgoal_tac \"la \\<le> la\", assumption, simp)\n    apply (erule Segment_A) apply simp apply simp apply simp\n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (simp add: AL_update1)  apply (simp, simp, simp) apply (simp, simp, simp)  apply (simp, simp)\n    apply (simp add: basic_def)\n    apply (rule CACH_INJECT)\n  apply (rule Basic_Sound) prefer 2 apply assumption prefer 4 apply simp prefer 2 apply (subgoal_tac \"la +1 \\<le> la+1\", assumption, simp)\n    apply (erule Segment_A) apply simp apply simp apply simp\n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5)\n    apply (simp add: AL_update1)  apply (simp, simp, simp) apply (simp, simp, simp)  apply simp\n    apply (simp add: basic_def)\n    apply (rule CACH_INJECT)\n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> lNil\", assumption, simp, simp)\n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la+3\", assumption, simp, simp)\n  apply clarsimp\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (subgoal_tac \"la+3=3+la\", clarsimp) prefer 2 apply simp\n    apply (simp add: AL_update1) apply clarsimp\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> 2+la\", assumption, simp, simp,clarsimp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (simp add: AL_update1a, clarsimp)    \n    apply (rule CACH_IF)\n      apply assumption\n      apply assumption\n      apply assumption\n      apply (erule CACH_INJECT)\n    apply simp\n    apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption\n      prefer 2 apply (subgoal_tac \"3+la \\<le> 3+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (simp add: AL_update1) \n      apply (simp,simp,simp)\n      apply (simp,simp)\n      apply (simp add: basic_def)\n    apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption \n      prefer 2 apply (subgoal_tac \"4+la \\<le> 4+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update1a) apply simp\n      apply (simp,simp,simp)\n      apply simp\n      apply (simp add: basic_def)\n      apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption\n      prefer 2 apply (subgoal_tac \"5+la \\<le> 5+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update1a) apply simp\n      apply (simp,simp,simp)\n      apply (simp add: basic_def)\n      apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption\n      prefer 2 apply (subgoal_tac \"6+la \\<le> 6+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update1a) apply simp\n      apply (simp,simp)\n      apply (simp add: basic_def)\n      apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption\n      prefer 2 apply (subgoal_tac \"7+la \\<le> 7+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update5)\n      apply (rule AL_update1a) apply simp\n      apply simp\n      apply (simp add: basic_def)\n      apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption\n      prefer 2 apply (subgoal_tac \"8+la \\<le> 8+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update1a) apply simp\n      apply (simp add: basic_def)\n    apply (rule CACH_INJECT) apply (subgoal_tac \"la+9=9+la\", clarsimp)\n    apply simp\ndone\n(*>*)\n\ntext\\<open>The full translation of a functional program into a bytecode\nprogram is defined as follows.\\<close>\n\ndefinition compileProg::\"FunProg \\<Rightarrow> bool\" where\n\"compileProg F =\n  ((\\<forall> C m par e. F\\<down>(C,m) = Some(par,e) \\<longrightarrow> \n          (\\<exists> code l0 l. mbody_is C m (rev par,code,l0) \\<and>\n                       (l0,[],e,(code,l)):compileExpr)) \\<and>\n   (\\<forall> C m. (\\<exists> M. mbody_is C m M) = (\\<exists> fdecl . F\\<down>(C,m) = Some fdecl)))\"\n\ntext\\<open>The final condition relating a typing context to a method\nspecification table.\\<close>\n\ndefinition TP_MST::\"TP_Sig \\<Rightarrow> bool\" where\n\"TP_MST \\<Sigma> =\n   (\\<forall> C m . case (MST\\<down>(C,m)) of\n            None \\<Rightarrow> \\<Sigma>\\<down>(C,m) = None\n          | Some(T,MI,Anno) \\<Rightarrow> Anno = emp \\<and> \n                                (\\<exists> n . \\<Sigma>\\<down>(C,m)=Some n \\<and> \n                                (T,MI,Anno) = mkSPEC (Cachera n) emp))\"\n\ntext\\<open>For well-typed programs, this property implies the earlier\ncondition on signatures.\\<close>\n\nlemma translation_good: \"\\<lbrakk>compileProg F; TP_MST \\<Sigma>; TP \\<Sigma> F\\<rbrakk> \\<Longrightarrow> Sig_good \\<Sigma>\"\n(*<*)\napply (simp add: compileProg_def TP_MST_def Sig_good_def TP_def, clarsimp)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (case_tac \"MST\\<down>(C,m)\", clarsimp,clarsimp)\ndone\n(*>*)\n\ntext\\<open>We can thus prove that well-typed function bodies satisfy the\nspecifications asserted by the typing context.\\<close>\n\nlemma CACH_BodiesDerivable[rule_format]:\n  \"\\<lbrakk> mbody_is C m (par, code, l); compileProg F; TP_MST \\<Sigma>; TP \\<Sigma> F\\<rbrakk> \n  \\<Longrightarrow> \\<exists> n . MST\\<down>(C,m) = Some(mkSPEC(Cachera n) emp) \\<and> \n            deriv [] C m l (Cachera n)\"\n(*<*)\napply (subgoal_tac \"(\\<forall> C m par e. F\\<down>(C,m) = Some(par,e) \\<longrightarrow> \n                     (\\<exists> code l0 l. mbody_is C m (rev par,code,l0) \\<and>\n                                   (l0,[],e,(code,l)):compileExpr)) \\<and>\n                 (\\<forall> C m . (\\<exists> M. mbody_is C m M) = (\\<exists> fdecl . F\\<down>(C,m) = Some fdecl))\")\nprefer 2 apply (simp add: compileProg_def, clarsimp)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (erule_tac x=C in allE, erule_tac x=m in allE, auto)\napply (simp add: mbody_is_def, clarsimp)\napply (subgoal_tac \"((\\<Sigma>\\<down>(C,m) = None) = (F\\<down>(C,m) = None)) \\<and> \n                       (\\<forall> n par e . \\<Sigma>\\<down>(C,m) = Some n \\<longrightarrow> F\\<down>(C,m) = Some (par,e) \\<longrightarrow> (\\<Sigma>,e,n):TP_expr)\")\nprefer 2 apply (simp add: TP_def, clarsimp)\napply (subgoal_tac \"MST\\<down>(C, m) = Some (mkSPEC (Cachera y) emp)\", clarsimp)\nprefer 2 apply (simp add: TP_MST_def) \n  apply (erule_tac x=C in allE, erule_tac x=m in allE)\n  apply (case_tac \"MST\\<down>(C, m)\", clarsimp, clarsimp)\napply (rule_tac x=y in exI, simp)\napply (rule TP_epxr_Sound) apply assumption \n  apply (erule translation_good) apply assumption+\n  apply (simp add: mkSPEC_def Cachera_def)\n\napply (drule compileExpr_Prop1) apply fastforce apply clarsimp\napply (simp add: Segment_def) \napply (rule, rule, rule, rule, simp add: mkSPEC_def Cachera_def)\napply clarsimp apply (rule, rule AL_emp1) \napply (erule_tac x=ll in allE)+ \napply clarsimp \napply (simp add: mbody_is_def get_ins_def ins_is_def) \ndone\n(*>*)\n\ntext\\<open>From this, the overall soundness result follows easily.\\<close>\n\ntheorem CACH_VERIFIED: \"\\<lbrakk>TP \\<Sigma> F; TP_MST \\<Sigma>; compileProg F\\<rbrakk> \\<Longrightarrow> VP\"\n(*<*)\napply (rule CACH_VP)\napply clarsimp apply (drule CACH_BodiesDerivable) apply assumption+ apply fast\napply clarsimp\ndone\n(*>*)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BytecodeLogicJmlTypes/Cachera.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.34224233740639465}}
{"text": "section \\<open> RoboChart Static Semantics \\<close>\n\ntheory RoboChart_Semantics\n  imports RoboChart_Validation RoboChart_Parser RoboChart_StateMachine \n    RoboChart_Semantic_Processors \"Z_Toolkit.Z_Toolkit\" \"Optics.Optics\"\n  keywords \n    \"interface\" \"func\" \"robotic_platform\" \"stm\" \n    \"operation\" \"controller\" \"module\" :: \"thy_decl_block\"\nbegin\n\ntext \\<open> Finally, we turn the validated AST representations into semantics. This often requires\n  the production of terms, which can also be represented in HOL and then code generated. \\<close>\n\ntext \\<open> We can encode functions in different ways. For now, we chose to encode them as partial functions. \\<close>\n\ndefinition \"fun_spec P Q = (\\<lambda> x. if (P x) then (THE y. Q x y) else undefined)\"\n\ndefinition pfun_spec :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Zpfun> 'b\" where\n\"pfun_spec P Q = (\\<lambda> x | P x \\<and> (\\<exists> y. Q x y) \\<bullet> SOME y. Q x y)\"\n\nlemma pfun_spec_app_eqI [intro]: \"\\<lbrakk> P x; \\<And> y. Q x y \\<longleftrightarrow> y = f x \\<rbrakk> \\<Longrightarrow> (pfun_spec P Q)(x)\\<^sub>p = f x\"\n  by (simp add: pfun_spec_def, subst pabs_apply, auto)\n\ndefinition \"rel_spec P Q = {(x, y). P x \\<and> Q x y}\"\n\ndefinition add_free_types :: \"(ID \\<times> typ) list \\<Rightarrow> term \\<Rightarrow> term\" where\n\"add_free_types ps x = subst_free (map (\\<lambda> (n, t). (Free n dummyT, Free n t)) ps) x\"\n\nfun func_body :: \"Function \\<Rightarrow> term\" where\n\"func_body (Func n ps t P Q) = \n  (let res = STR ''result'';\n       Pt = constraint boolT (add_free_types ps P); \n       Qt = constraint boolT (add_free_types ((res, t) # ps) Q); \n       p = mk_tuple (map (\\<lambda> (i, t). Free i t) ps)\n   in mk_equals (free n) (const @{const_name pfun_spec} \n      $ (tupled_lambda p Pt) \n      $ (tupled_lambda p (tupled_lambda (Free (res) t) Qt))))\"\n\ncode_reflect RC_Semantics\n  functions add_free_types func_body\n\nML \\<open> RC_SemProc.RCSem_Proc_ext \\<close>\n\nML \\<open>\n\nstructure RC_Compiler =\nstruct\n\nopen RC_AST;\nopen RC_Validation;\nopen RC_Semantics;\nopen RC_SemProc;\n\ntype RCSem_Proc = unit rCSem_Proc_ext;\n\nstructure Stm_Sem = Theory_Data\n  (type T = RCSem_Proc\n   val empty = null_RCSem_Proc\n   val extend = I\n   val merge = fn (_, x) => x);\n\nfun compileFuncDecl ctx (FuncDecl (n, ps, t, P, Q)) =\n  let open Syntax; open HOLogic in\n    Func (n, map (fn (p, t) => (p, read_typ ctx t)) ps, read_typ ctx t, Library.foldr mk_conj (map (parse_term ctx) P, @{term True}), Library.foldr mk_conj (map (parse_term ctx) Q, @{term True}))\n  end;\n\nfun compileFunction x thy = \n  let open Syntax\n      val ctx = (Named_Target.theory_init thy)\n      val f = check_term ctx (func_body (compileFuncDecl ctx x))\n  in Local_Theory.exit_global (snd (Specification.definition NONE [] [] ((Binding.empty, []), f) ctx))\n\n  end;\n\nexception ROBOCHART_INVALID;\n\nfun compileInterface itf thy = \n  if (validate_Interface itf) \n  then Dataspace.dataspace_cmd \n        (ident itf) [] \n        (map decl_of (constants itf)) [] \n        (map decl_of (variables itf)) \n        (map decl_of (events itf)) \n        ((*RCInterfaces.map (Symtab.update (ident itf, itf))*) thy)\n  else raise ROBOCHART_INVALID;\n\nfun compileContainer cnt thy = \n  if (validate_Interface cnt) (* FIXME: Proper container validation *)\n  then Dataspace.dataspace_cmd \n        (ident cnt) (uses cnt) \n        (map decl_of (constants cnt)) [] \n        (map decl_of (variables cnt)) \n        (map decl_of (events cnt)) \n        ((*RCInterfaces.map (Symtab.update (ident itf, itf))*) thy)\n  else raise ROBOCHART_INVALID;\n\nval machineN = \"machine\";\n\n(* Create a local context with variables and events, and generate a semantic state machine *)\n\nfun stransitionT predT actT probT = Type (@{type_name STransition}, [predT, actT, probT])\n\nval sm_defs = (Binding.empty, [Token.make_src (@{named_theorems sm_defs}, Position.none) []])\n\nfun prove_simplify ctx thms goal = \n  Goal.prove ctx [] []\n      (hd (Type_Infer_Context.infer_types ctx [ goal ]))\n      (fn {context = context, prems = _} =>\n          EVERY [ PARALLEL_ALLGOALS \n                    (asm_simp_tac \n                      (fold Simplifier.add_simp \n                        (thms @ [@{thm Pure.reflexive}] ) \n                  context)) ]);\n\nfun context_Stm_Semantics cont smd thy = \n  let open Syntax; open Logic; open RC_Stm; open Specification\n      val ctx = (Named_Target.init [] (Context.theory_name thy ^ \".\" ^ ident smd) \n                  (compileContainer smd thy))\n      val rsp = Stm_Sem.get thy\n      val predT = predT (rctypes rsp) Lens_Lib.astateT\n      val actionT = actionT (rctypes rsp) Lens_Lib.astateT Dataspace.achanT\n      val probT = probT (rctypes rsp) Lens_Lib.astateT\n      (* State definitions *)\n      val seqs = map (compile_Node_defn ctx (rctypes rsp) predT actionT probT) (nodes smd)\n      val tdefs = map (compile_Transition ctx (rctypes rsp) predT actionT probT) (transitions smd)\n      fun tr_thms ctx = \n        map \n            (prove_simplify ctx (Proof_Context.get_thms ctx @{named_theorems sm_defs}) o check_term ctx)\n            (List.concat (map snd tdefs))\n      fun nd_thms ctx = \n        map \n            (prove_simplify ctx (Proof_Context.get_thms ctx @{named_theorems sm_defs}) o check_term ctx)\n            (List.concat (map snd seqs))\n      val smdef = RC_Stm.compile_StateMachineDef ctx predT actionT probT smd\n      fun sm_thms ctx = \n        map \n            (prove_simplify ctx (Proof_Context.get_thms ctx @{named_theorems sm_defs}) o check_term ctx)\n            (snd smdef)\n      val simp = Attrib.check_src ctx (Token.make_src (\"simp\", Position.none) [])\n  in Local_Theory.exit_global \n      ((  fold (fn (seq, _) => snd o definition NONE [] [] (sm_defs, seq)) seqs\n       #> fold (fn (teq, _) => snd o definition NONE [] [] (sm_defs, check_term ctx teq)) tdefs\n       #> snd o definition NONE [] [] (sm_defs, fst smdef)\n       #> (fn ctx => Local_Theory.note ((Binding.name \"transitions\", [simp]), (tr_thms ctx)) ctx |> snd)\n       #> (fn ctx => Local_Theory.note ((Binding.name \"nodes\", [simp]), (nd_thms ctx)) ctx |> snd)\n       #> (fn ctx => Local_Theory.note ((Binding.name \"machine\", [simp]), (sm_thms ctx)) ctx |> snd)\n       #> cont\n       ) ctx)\n  end;\n\nfun ctx_semantics rsp cont =\n  rctypes_update (K rsp) null_RCSem_Proc \n  |> stm_sem_update (K (context_Stm_Semantics cont));\n\nfun compileStateMachine (n, defs) thy =\n  let val smd = RC_AST.mk_StateMachineDef (n, defs)\n  in \n    if (validate_StateMachine smd)\n    (* Get the current semantic processor *)\n    then stm_sem (Stm_Sem.get thy) smd thy\n    else raise ROBOCHART_INVALID\n  end;\n\nend\n\nval _ =\n  Outer_Syntax.command @{command_keyword func} \"define RoboChart functions\" \n    (RC_Parser.functionParser >> (Toplevel.theory o RC_Compiler.compileFunction));\n\nval _ =\n  Outer_Syntax.command @{command_keyword interface} \"define RoboChart interfaces\" \n    (RC_Parser.interfaceParser >> (Toplevel.theory o RC_Compiler.compileInterface));\n\nval _ =\n  Outer_Syntax.command @{command_keyword controller} \"define RoboChart controllers\" \n    (RC_Parser.controllerParser >> (Toplevel.theory o K I));\n\nval _ =\n  Outer_Syntax.command @{command_keyword robotic_platform} \"define RoboChart robotic platforms\" \n    (RC_Parser.roboticPlatformParser >> (Toplevel.theory o K I));\n\nval _ =\n  Outer_Syntax.command @{command_keyword module} \"define RoboChart modules\" \n    (RC_Parser.moduleParser >> (Toplevel.theory o K I));\n\nval _ =\n  Outer_Syntax.command @{command_keyword stm} \"define RoboChart state machines\"\n    (RC_Parser.stateMachineDefParser >> (Toplevel.theory o RC_Compiler.compileStateMachine));\n\nval _ =\n  Outer_Syntax.command @{command_keyword operation} \"define RoboChart operations\"\n    (RC_Parser.operationParser >> (Toplevel.theory o K I));\n\\<close>\n\ntext \\<open> Set the default semantic processor \\<close>\n\nsetup \\<open>\n  let open RC_Compiler; open RC_SemProc in\n  Stm_Sem.put (ctx_semantics null_RCTypes I)\n  end\n\\<close>\n\nend", "meta": {"author": "isabelle-utp", "repo": "RoboChart-Isabelle", "sha": "4d7306d6791c195c081a918e5e249c3a9712be5c", "save_path": "github-repos/isabelle/isabelle-utp-RoboChart-Isabelle", "path": "github-repos/isabelle/isabelle-utp-RoboChart-Isabelle/RoboChart-Isabelle-4d7306d6791c195c081a918e5e249c3a9712be5c/RoboChart_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.679178686187839, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.34224233086188605}}
{"text": "theory IMP2\nimports \"automation/IMP2_VCG\" \"automation/IMP2_Specification\"\nbegin\n\nsection \\<open>IMP2 Setup\\<close>\n\nlemmas [deriv_unfolds] = Params_def Inline_def AssignIdx_retv_def ArrayCpy_retv_def\n\n\nsection \\<open>Ad-Hoc Regression Tests\\<close>\n  \nexperiment begin\n\nlemma upd_idxSame[named_ss vcg_bb]: \"f(i:=a,i:=b) = f (i:=b)\" by auto\n\nlemmas [named_ss vcg_bb] = triv_forall_equality\n\ndeclare [[eta_contract = false ]]  \nprogram_spec (partial) p2\n  assumes \"n>0\"  \n  ensures \"n=0\"\n  defines \\<open>while (n>0) @invariant \\<open>n\\<ge>0\\<close> { if (n+1>1) {\n    n=n-1; \n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    G1=n; G2=n; G3=n; n=G1; n=G2; n=G3;\n    skip\n  } }\\<close>\n  apply vcg\n  by auto\n\nprogram_spec p2'\n  assumes \"n>0\"  \n  ensures \"n=0\"\n  defines \\<open>while (n>0) @variant \\<open>n\\<close> @invariant \\<open>n\\<ge>0\\<close> { n=n-1 }\\<close>\n  apply vcg\n  by auto\n\n    \nprogram_spec p2''\n  assumes \"n>0\"  \n  ensures \"n=0\"\n  defines \\<open>while (n>0) @relation \\<open>measure nat\\<close> @variant \\<open>n\\<close> @invariant \\<open>n\\<ge>0\\<close> { n=n-1 }\\<close>\n  apply vcg\n  by auto\n\nprogram_spec p3  \n  assumes \"True\"\n  ensures \"n = n\\<^sub>0 \\<and> N=42\"\n  defines \\<open>\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope n = 0;\n    scope {n = 0}; N=42\n  \\<close>\n  apply vcg\n  by auto\n  \n    \nend\n\n\nsubsection \\<open>More Regression Tests\\<close>\n\nexperiment begin\n\nlemmas nat_distribs = nat_add_distrib nat_diff_distrib Suc_diff_le nat_mult_distrib nat_div_distrib \n\n\nprogram_spec exp_count_up1\n  assumes \"0\\<le>n\"\n  ensures \"a = 2^nat n\\<^sub>0\"\n  defines \\<open>\n    a = 1;\n    c = 0;\n    while (c<n) \n      @variant \\<open>n-c\\<close> \n      @invariant \\<open>0\\<le>c \\<and> c\\<le>n \\<and> a=2^nat c\\<close>    \n    {\n      a=2*a;\n      \n      \n      c=c+1\n    }\n  \\<close>\n  apply vcg\n  by (auto simp: algebra_simps nat_distribs)\n\n\nprogram_spec exp_count_up1'\n  assumes \"0\\<le>n\"\n  ensures \"a = 2^nat n\\<^sub>0\"\n  defines \\<open>\n    a = 1;\n    c = 0;\n    while (c<n) \n      @variant \\<open>n-c\\<close> \n      @invariant \\<open>0\\<le>c \\<and> c\\<le>n \\<and> a=2^nat c\\<close>    \n    {\n      a=2*a; a=2*a; a=2*a; a=2*a;\n      a=a / 2; a=a / 2; a=a / 2; a=a / 2; \n      \n      a=2*a;\n      c=c+1\n    }\n  \\<close>\n  apply vcg\n  by (auto simp: algebra_simps nat_distribs)\n  \n  \n(* We've made the program a little larger \\<dots> *)\nprogram_spec exp_count_up\n  assumes \"0\\<le>n\"\n  ensures \"a = 2^nat n\\<^sub>0\"\n  defines \\<open>\n    a = 1;\n    c = 0;\n    while (c<n) \n      @variant \\<open>n-c\\<close> \n      @invariant \\<open>0\\<le>c \\<and> c\\<le>n \\<and> a=2^nat c\\<close>    \n    {\n      a=2*a;\n      \n      {\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;   a=2*a;    a=2*a;    a=2*a;   a=2*a;    a=2*a;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n      a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;  a=a / 2; a=a / 2;  a=a / 2;\n      skip\n      };\n      \n      c=c+1\n    }\n  \\<close>\n  apply vcg\n      apply (all \\<open>simp?\\<close>)\n  apply (auto simp: algebra_simps nat_distribs)\n  done\n\n  \nprogram_spec exp_count_up3\n  assumes \"0\\<le>n\"\n  ensures \"a = 2^nat n\\<^sub>0\"\n  defines \\<open>\n    a = 1;\n    c = 0;\n    while (c<n) \n      @variant \\<open>n-c\\<close> \n      @invariant \\<open>0\\<le>c \\<and> c\\<le>n \\<and> a=2^nat c\\<close>    \n    {\n      a=2*a;\n      \n      { \\<comment> \\<open>Note, this provokes exponential blowup of intermediate, unsimplified terms! \\<close>\n      a=a+a; a=a+a; a=a+a; a = a/8;\n      a=a+a; a=a+a; a=a+a; a = a/8;\n      a=a+a; a=a+a; a=a+a; a = a/8;\n      a=a+a; a = a/2;\n      \n      skip\n      };\n      \n      c=c+1\n    }\n  \\<close>\n  apply vcg\n      apply (all \\<open>simp?\\<close>)\n  apply (auto simp: algebra_simps nat_distribs)\n  done\n  \n  \n    \nend\n\n\nexperiment\nbegin\n\nlemmas nat_distribs = nat_add_distrib nat_diff_distrib Suc_diff_le nat_mult_distrib nat_div_distrib\n\n\nprocedure_spec exp_count_up (n) returns a\n  assumes \"0\\<le>n\"\n  ensures \"a = 2^nat n\\<^sub>0\"\n  defines \\<open>\n      a = 1;\n      c = 0;\n      while (c<n) \n        @variant \\<open>n-c\\<close>\n        @invariant \\<open>0\\<le>c \\<and> c\\<le>n \\<and> a=2^nat c\\<close>\n      {\n        a=2*a;\n        c=c+1\n      }\n  \\<close>\n  apply vcg\n  by (auto simp: algebra_simps nat_distribs)\n\nprogram_spec use_exp \n  assumes \"0\\<le>n\"\n  ensures \\<open>n = 2^(2^nat n\\<^sub>0)\\<close>\n  defines \\<open>\n    n = exp_count_up(n);\n    n = exp_count_up(n)\n  \\<close>\n  apply vcg\n  by auto\n\n\n  \nprocedure_spec add3 (a, b, c) returns r\n  assumes \"a\\<ge>0 \\<and>b\\<ge>0 \\<and>c\\<ge>0\"  \n  ensures \"r = a\\<^sub>0+b\\<^sub>0+c\\<^sub>0\"\n  defines \\<open>\n    r = a+b+c\n  \\<close>\n  apply vcg\n  by auto\n  \nprocedure_spec use_add3 (a, b) returns r\n  assumes \"a\\<ge>0 \\<and> b\\<ge>0\"  \n  ensures \"r = 2*(a\\<^sub>0+b\\<^sub>0+b\\<^sub>0)\"\n  defines \\<open>\n    r1 = add3(a, b, b);\n    r2 = add3(a, b, b);\n    r = r1+r2\n  \\<close>\n  apply vcg\n  by auto\n\n\nprocedure_spec divmod (a,b) returns (c,d)  \n  assumes \"b\\<noteq>0\"\n  ensures \"c = a\\<^sub>0 div b\\<^sub>0 \\<and> d = a\\<^sub>0 mod b\\<^sub>0\"\n  defines \\<open>\n    c = a / b;\n    d = a mod b\n  \\<close>\n  apply vcg\n  by auto\n  \nprocedure_spec use_divmod (a,b) returns r\n  assumes \"b\\<noteq>0\"\n  ensures \"r = a\\<^sub>0\"\n  defines \\<open>\n    (d,m) = divmod (a,b);\n    r = d*b + m\n  \\<close>\n  apply vcg\n  by simp\n  \n  \n    \nend\n  \nexperiment\nbegin\n\nlemmas nat_distribs = nat_add_distrib nat_diff_distrib Suc_diff_le nat_mult_distrib nat_div_distrib\n\n\nprocedure_spec exp_count_up (n) returns a\n  assumes \"0\\<le>n\"\n  ensures \"a = 2^nat n\\<^sub>0\"\n  defines \\<open>\n      a = 1;\n      c = 0;\n      while (c<n) \n        @variant \\<open>n-c\\<close> \n        @invariant \\<open>0\\<le>c \\<and> c\\<le>n \\<and> a=2^nat c\\<close>\n      {\n        a=2*a;\n        c=c+1\n      }\n      \n  \\<close>\n  apply vcg\n  by (auto simp: algebra_simps nat_distribs)\n  \n\nprogram_spec use_exp \n  assumes \"0\\<le>n\"\n  ensures \\<open>n = 2^(2^nat n\\<^sub>0)\\<close>\n  defines \\<open>\n    n = exp_count_up(n);\n    n = exp_count_up(n)\n  \\<close>\n  apply vcg\n  by auto\n\ntext \\<open>Deriving big-step semantics\\<close>\nschematic_goal \n  \"Map.empty: (use_exp,<''n'':=\\<lambda>_. 2>) \\<Rightarrow> ?s\"\n  \"?s ''G_ret_1'' 0 = 16\"\n  unfolding use_exp_def exp_count_up_def\n  apply big_step []\n  by bs_simp\n\nschematic_goal \n  \"Map.empty: (use_exp,<''n'':=\\<lambda>_. 2>) \\<Rightarrow> ?s\"\n  \"?s ''G_ret_1'' 0 = 16\"\n  unfolding use_exp_def exp_count_up_def\n  apply (big_step'+) []\n  by bs_simp\n  \n    \nprocedure_spec add3 (a, b, c) returns r\n  assumes \"a\\<ge>0 \\<and>b\\<ge>0 \\<and>c\\<ge>0\"  \n  ensures \"r = a\\<^sub>0+b\\<^sub>0+c\\<^sub>0\"\n  defines \\<open>\n    r = a+b+c\n  \\<close>\n  apply vcg\n  by auto\n  \nprocedure_spec use_add3 (a, b) returns r\n  assumes \"a\\<ge>0 \\<and> b\\<ge>0\"  \n  ensures \"r = 2*(a\\<^sub>0+b\\<^sub>0+b\\<^sub>0)\"\n  defines \\<open>\n    r1 = add3(a, b, b);\n    r2 = add3(a, b, b);\n    r = r1+r2\n  \\<close>\n  apply vcg\n  by auto\n  \nprocedure_spec no_param () returns r\n  assumes \"True\"\n  ensures \"r = 42\"  \n  defines \\<open>r = 42\\<close>\n  by vcg_cs\n  \nprocedure_spec foobar (a) returns r\n  assumes \\<open>a\\<ge>0\\<close>\n  ensures \"r=84+a\\<^sub>0\"\n  defines \\<open>\n    r1 = no_param();\n    add3(a, a, r1);\n    r2 = add3(a, r1, r1);\n    r = r2\n  \\<close>\n  apply vcg_cs\n  done\n  \nend\n\nexperiment begin  \n\n  lemma [named_ss vcg_bb]: \"BB_PROTECT True\" by (auto simp: BB_PROTECT_def)\n\n  procedure_spec add (a,b) returns r assumes True ensures \"r=a\\<^sub>0+b\\<^sub>0\" defines \\<open>r = a + b\\<close> by vcg_cs\n\n  procedure_spec test (a) returns r assumes True ensures \"r = a\\<^sub>0\" defines \\<open>\n    x1 = add(a,a);\n    x2 = add(a,a);\n    x3 = add (x1-x2, a);\n    \n    x1 = add(a,a);\n    x2 = add(a,a);\n    x3 = add (x1-x2, a);\n  \n    x1 = add(a,a);\n    x2 = add(a,a);\n    x3 = add (x1-x2, a);\n  \n    x1 = add(a,a);\n    x2 = add(a,a);\n    x3 = add (x1-x2, a);\n  \n    x1 = add(a,a);\n    x2 = add(a,a);\n    x3 = add (x1-x2, a);\n  \n    x1 = add(a,a);\n    x2 = add(a,a);\n    x3 = add (x1-x2, a);\n  \n    r = x3\n  \\<close>\n  apply vcg\n  by auto\n\nend\n\n\nexperiment begin  \n\nlemmas nat_distribs = nat_add_distrib nat_diff_distrib Suc_diff_le nat_mult_distrib nat_div_distrib \n  \nrecursive_spec \n  relation \\<open>measure nat\\<close>\n  foo (a) returns b \n    assumes \"a\\<ge>0\"\n    ensures \"b = 2^nat a\\<^sub>0\"\n    variant \"a\"\n    defines \\<open>\n      if (a==0) b=1\n      else {\n        b = rec foo (a-1);\n        b = 2 * b\n      }\n    \\<close>\n  thm vcg_specs  \n  apply vcg\n  apply (auto simp: nat_distribs algebra_simps)\n  by (metis (full_types) Suc_pred le0 le_less nat_0_iff not_le power_Suc)\n  \nthm foo_spec  \n  \n  \nrecursive_spec \n  odd (a) returns b \n    assumes \"a\\<ge>0\"\n    ensures \"b\\<noteq>0 \\<longleftrightarrow> odd a\\<^sub>0\"\n    variant \"a\"\n    defines \\<open>\n      if (a==0) b=0\n      else {\n        b = rec even (a-1)\n      }\n    \\<close>\n  and\n  even (a) returns b\n    assumes \\<open>a\\<ge>0\\<close>\n    ensures \"b\\<noteq>0 \\<longleftrightarrow> even a\\<^sub>0\"\n    variant \"a\"\n    defines \\<open>\n      if (a==0) b=1\n      else {\n        b = rec odd (a-1)\n      }\n    \\<close>\n  apply vcg  \n  by auto  \n\nthm even_spec odd_spec\n  \n\n    \nend  \n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/IMP2/IMP2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442251064863698, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3422184151282659}}
{"text": "(*  File:       Pairwise_Majority_Rule_Ref.thy\n    Copyright   2023  Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\<open>creator \"Valentin Springsklee, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\n\nsection \\<open>Refined Pairwise Majority Rule\\<close>\n\ntheory Pairwise_Majority_Rule_Ref\n  imports \"Verified_Voting_Rule_Construction.Pairwise_Majority_Rule\"\n          \"Compositional_Structures/Basic_Modules/Condorcet_Module_Ref\"  \n          \"Compositional_Structures/Elect_Composition_Ref\"              \nbegin\n\nsubsection \\<open>Refinement to Imperative/HOL\\<close>\n\nsepref_definition pairwise_majority_rule_direct_imp is \n  \"uncurry (elector_opt ((condorcet)))\" :: \"elec_mod_seprel nat_assn\"\n  unfolding elector_opt_def hs.fold_custom_empty\n  apply sepref_dbg_keep\n  done\n\nsubsection \\<open>Correctness\\<close>\n\n\nlemma opt_pmc_correct:\n  shows \"(uncurry pairwise_majority_rule_direct_imp, uncurry (RETURN \n    oo (pairwise_majority_rule:: (nat Electoral_Module))))\n  \\<in> elec_mod_seprel nat_assn\"\n  using pairwise_majority_rule_direct_imp.refine\n  unfolding pairwise_majority_rule.simps elector_opt_eq\n  .\n\ndeclare opt_pmc_correct [sepref_fr_rules]\n\nsubsection \\<open>Properties in Separation Logic\\<close>\n\ntheorem pmc_impl_condorcet:\n  shows \"finite_profile A p \\<and> condorcet_winner A p w \\<Longrightarrow>\n  <(alts_set_impl_assn nat_assn) A hs *\n            (list_assn (ballot_assn nat_assn)) p hp> pairwise_majority_rule_direct_imp hs hp \n  < \\<lambda>r. \\<exists>\\<^sub>Ares. (result_impl_assn (nat_assn)) res r * \n    \\<up> (res = ({w}, A - {w}, {})) >\\<^sub>t\"\n  using opt_pmc_correct[THEN hfrefD, THEN hn_refineD, of \"(A, p)\" \"(hs, hp)\"]\n  apply (clarsimp simp del: condorcet_winner.simps pairwise_majority_rule.simps)\n  apply (erule cons_rule[rotated -1])\n  apply (sep_auto simp add : hn_ctxt_def pure_def simp del : condorcet_winner.simps pairwise_majority_rule.simps)\n  apply (sep_auto simp add: hn_ctxt_def simp del : condorcet_winner.simps pairwise_majority_rule.simps)\n  using condorcet_condorcet condorcet_consistency3\n  by (metis)\n\nexport_code clist convert_list_to_hash_set pairwise_majority_rule_direct_imp in Scala_imp\n\n\nend", "meta": {"author": "SpringVaS", "repo": "RefinementOfVotingRules", "sha": "a01e44b062fb43e172dff81cffbf941856c977d8", "save_path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules", "path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules/RefinementOfVotingRules-a01e44b062fb43e172dff81cffbf941856c977d8/theories/Pairwise_Majority_Rule_Ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.34221841512826584}}
{"text": "theory ERC20\n  imports \"../Phi_Solidity\"\nbegin\n\nconsts Total_Supply :: nat\n\nspecification (Total_Supply)\n  Total_Supply_LE[useful]: \\<open>Total_Supply < 2 ^ Big 256\\<close>\n  unfolding Big_def\n  using less_exp by blast\n\ncontext solidity begin\n\n\ndefinition Currency :: \\<open>('VAL, nat) \\<phi>\\<close>\n  where \\<open>Currency = (\\<lambda>x. (x \\<Ztypecolon> \\<nat>[256]) \\<s>\\<u>\\<b>\\<j> x \\<le> Total_Supply)\\<close>\n\nlemma Currency_expn[\\<phi>expns]:\n  \\<open>(x \\<Ztypecolon> Currency) = ((x \\<Ztypecolon> \\<nat>[256]) \\<s>\\<u>\\<b>\\<j> x \\<le> Total_Supply)\\<close>\n  unfolding \\<phi>Type_def[where T=Currency]\n  unfolding Currency_def\n  ..\n\nlemma [\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> Currency) \\<Longrightarrow> (x \\<le> Total_Supply \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def\n  by (simp add: \\<phi>expns)\n\nlemma Currency_D[\\<phi>reason on \\<open>?x \\<Ztypecolon> Currency \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?y \\<Ztypecolon> \\<nat>[?b] \\<a>\\<n>\\<d> ?P\\<close>]:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> x = x'\n\\<Longrightarrow> x \\<Ztypecolon> Currency \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> \\<nat>[256] \\<a>\\<n>\\<d> x \\<le> Total_Supply\\<close>\n  unfolding Currency_expn \\<medium_left_bracket> \\<medium_right_bracket>. .\n\nlemma Currency_I[\\<phi>reason on \\<open>?y \\<Ztypecolon> \\<nat>[?b] \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?x \\<Ztypecolon> Currency \\<a>\\<n>\\<d> ?P\\<close>]:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> x \\<le> Total_Supply \\<and> x = x'\n\\<Longrightarrow> x \\<Ztypecolon> \\<nat>[256] \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> Currency\\<close>\n  unfolding Currency_expn \\<medium_left_bracket> \\<medium_right_bracket>. .\n\nlemma [\\<phi>reason 1000]:\n  \\<open>\\<phi>SemType (x \\<Ztypecolon> Currency) (\\<tau>Int 256)\\<close>\n  unfolding \\<phi>SemType_def subset_iff\n  by (simp add: \\<phi>expns)\n\n(*\ncontract XXX\n\nmaping<Address, int256> balance;\n\nend\n\n *)\n\nproc balance_of:\n  argument \\<open>msg \\<Ztypecolon> Msg\\<heavy_comma>\n      balance \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> [\\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''balance'', \\<bbbS>\\<m>\\<a>\\<p> (account \\<Ztypecolon> Address)] \\<^bold>\\<rightarrow> n \\<Znrres> \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> Currency \\<heavy_comma>\n      \\<v>\\<a>\\<l> account \\<Ztypecolon> Address\\<close>\n  return   \\<open>msg \\<Ztypecolon> Msg\\<heavy_comma>\n      balance \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> [\\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''balance'', \\<bbbS>\\<m>\\<a>\\<p> (account \\<Ztypecolon> Address)] \\<^bold>\\<rightarrow> n \\<Znrres> \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> Currency \\<heavy_comma>\n      \\<v>\\<a>\\<l> balance \\<Ztypecolon> \\<nat>[256]\\<close>\n  \\<medium_left_bracket> \\<rightarrow> v_account;;\n    op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''balance''\\<close>]\n    op_get_var[where vname=v_account]\n    op_get_mapping_ledgeRef\n  ;;\n\n  ;;op_load_ledge\n  thm \\<phi>lemmata\n  thm \\<phi>morphism\n  \\<medium_right_bracket>. .\n\n(* { P } C {} *)\n(* { x : T * x2 : T2 * x3 : T3 ... \\<and> P x x2 x3 } C { ... }\ncontract \\<rightarrow> field-path \\<rightarrow> value\n\nname \\<rightarrow> heap\n\nlocale\n\nfix msg \\<Ztypecolon> Msg\n\n{ x \\<Ztypecolon> T  } CCCC {...}\n\n\n{} FFF {}\n\nend\n\nbalance \\<Ztypecolon> ledge: (msg.contract msg \\<rightarrow> Map Address\n\n*)\n\nproc transfer:\n  premises \\<open>balance_receiver + amount \\<le> Total_Supply\\<close>\n  argument \\<open>msg \\<Ztypecolon> Msg\\<heavy_comma>\n      balance_sender \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> [\\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''balance'', \\<bbbS>\\<m>\\<a>\\<p> (msg.sender msg \\<Ztypecolon> Address)] \\<^bold>\\<rightarrow> \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> Currency \\<heavy_comma>\n      balance_receiver \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> [\\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''balance'', \\<bbbS>\\<m>\\<a>\\<p> (receiver \\<Ztypecolon> Address)] \\<^bold>\\<rightarrow> \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> Currency \\<heavy_comma>\n      \\<v>\\<a>\\<l> receiver \\<Ztypecolon> Address\\<heavy_comma>\n      \\<v>\\<a>\\<l> amount   \\<Ztypecolon> \\<nat>[256]\\<close>\n  return \\<open>msg \\<Ztypecolon> Msg\\<heavy_comma>\n      (if amount \\<le> balance_sender then balance_sender - amount else balance_sender)\n        \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> [\\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''balance'', \\<bbbS>\\<m>\\<a>\\<p> (msg.sender msg \\<Ztypecolon> Address)] \\<^bold>\\<rightarrow> \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> Currency \\<heavy_comma>\n      (if amount \\<le> balance_sender then balance_receiver + amount else balance_receiver)\n        \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> [\\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''balance'', \\<bbbS>\\<m>\\<a>\\<p> (receiver \\<Ztypecolon> Address)] \\<^bold>\\<rightarrow> \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> Currency \\<heavy_comma>\n      \\<v>\\<a>\\<l> amount \\<le> balance_sender \\<Ztypecolon> \\<bool>\\<close>\n  \\<medium_left_bracket> ;;\n    \\<rightarrow> v_receiver, v_amount\n  have [useful]: \\<open>balance_receiver \\<le> Total_Supply\\<close> \\<open>balance_sender \\<le> Total_Supply\\<close> using \\<phi> by simp+ ;;\n    op_get_var[where vname=v_amount]\n    op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''balance''\\<close>]\n    op_get_msg_addr[where G=msg.sender]\n    op_get_mapping_ledgeRef\n  ;; op_load_ledge\n  thm \\<phi>morphism\n  ;; op_le \\<rightarrow> ret ;;\n    if \\<medium_left_bracket> op_get_var[where vname=ret] \\<medium_right_bracket>.\n  \\<medium_left_bracket> op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''balance''\\<close>]\n    op_get_msg_addr[where G=msg.sender]\n    op_get_mapping_ledgeRef\n    op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''balance''\\<close>]\n    op_get_msg_addr[where G=msg.sender]\n    op_get_mapping_ledgeRef\n  ;;op_load_ledge\n  ;;op_get_var[where vname=v_amount]\n    op_sub\n  thm \\<phi>morphism\n  ;;op_store_ledge\n  thm \\<phi>morphism\n  ;;op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''balance''\\<close>]\n  ;;op_get_var[where vname=v_receiver]\n    op_get_mapping_ledgeRef\n    dup\n  ;;op_load_ledge\n    op_get_var[where vname=v_amount]\n    op_add\n    op_store_ledge\n  \\<medium_right_bracket>. \\<medium_left_bracket> \\<medium_right_bracket>.\n  ;; op_get_var[where vname=ret]\n  \\<medium_right_bracket>. .\n\n\n\nproc transfer_from:\n  premises \\<open>balance_bob + amount \\<le> Total_Supply\\<close>\n  argument \\<open>msg \\<Ztypecolon> Msg\\<heavy_comma>\n      balance_alice \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> \\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''balance'' \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (alice \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>] \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> Currency \\<heavy_comma>\n      balance_bob   \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> \\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''balance'' \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (bob   \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>] \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> Currency \\<heavy_comma>\n      allowance     \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> \\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''allowance'' \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (alice \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (bob \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>] \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> \\<nat>[256] \\<heavy_comma>\n      \\<v>\\<a>\\<l> alice  \\<Ztypecolon> Address\\<heavy_comma>\n      \\<v>\\<a>\\<l> bob    \\<Ztypecolon> Address\\<heavy_comma>\n      \\<v>\\<a>\\<l> amount \\<Ztypecolon> Currency\\<close>\n  return \\<open>msg \\<Ztypecolon> Msg\\<heavy_comma>\n      (if amount \\<le> balance_alice \\<and> amount \\<le> allowance then balance_alice - amount else balance_alice)\n        \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> \\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''balance'' \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (alice \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>] \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> Currency \\<heavy_comma>\n      (if amount \\<le> balance_alice \\<and> amount \\<le> allowance then balance_bob   + amount else balance_bob)\n        \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> \\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''balance'' \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (bob \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>] \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> Currency \\<heavy_comma>\n      (if amount \\<le> balance_alice \\<and> amount \\<le> allowance then allowance - amount else allowance)\n        \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> \\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''allowance'' \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (alice \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (bob \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>] \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> \\<nat>[256] \\<heavy_comma>\n      \\<v>\\<a>\\<l> amount \\<le> balance_alice \\<and> amount \\<le> allowance \\<Ztypecolon> \\<bool>\\<close>\n  \\<medium_left_bracket>\n(* if amount \\<le> balance_alice \\<and> amount \\<le> allowance\n *)\n    \\<rightarrow> v_alice, v_bob, v_amount\n  have [useful]: \\<open>balance_alice \\<le> Total_Supply\\<close>\n                 \\<open>balance_bob \\<le> Total_Supply\\<close>\n                 \\<open>allowance \\<le> 2 ^ Big 256\\<close>\n                using \\<phi> by simp+ ;;\n    op_get_var[where vname=v_amount]\n    op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''balance''\\<close>]\n    op_get_var[where vname=v_alice]\n    op_get_mapping_ledgeRef\n    op_load_ledge\n    op_le\n    op_get_var[where vname=v_amount]\n    op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''allowance''\\<close>]\n    op_get_var[where vname=v_alice]\n    op_get_mapping_ledgeRef\n    op_get_var[where vname=v_bob]\n    op_get_mapping_ledgeRef\n    op_load_ledge\n    op_le\n    op_and \\<rightarrow> ret\n  ;;if \\<open>$ret\\<close>\n  \\<medium_left_bracket>\n  (* balance[alice] -= amount;\n     balance[bob]   += amount;\n     allowance[alice,bob] -= amount;\n   *)\n    op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''balance''\\<close>]\n    op_get_var[where vname=v_alice]\n    op_get_mapping_ledgeRef\n    dup\n    op_load_ledge\n    op_get_var[where vname=v_amount]\n    op_sub\n    op_store_ledge !!!\n  thm \\<phi>morphism\n  ;;\n  ;;op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''allowance''\\<close>]\n    op_get_var[where vname=v_alice]\n    op_get_mapping_ledgeRef\n    op_get_var[where vname=v_bob]\n    op_get_mapping_ledgeRef\n    dup\n    op_load_ledge\n    op_get_var[where vname=v_amount]\n    op_sub\n    op_store_ledge\n  ;;op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''balance''\\<close>]\n    op_get_var[where vname=v_bob]\n    op_get_mapping_ledgeRef\n    dup\n    op_load_ledge\n    op_get_var[where vname=v_amount]\n    op_add\n    op_store_ledge\n  \\<medium_right_bracket>. \\<medium_left_bracket> \\<medium_right_bracket>.\n  ;; \\<open>$ret\\<close>\n  \\<medium_right_bracket>. .\n\n\nproc approve:\n  argument \\<open>msg \\<Ztypecolon> Msg\\<heavy_comma>\n      allowance \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> \\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''allowance''\n                           \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (msg.sender msg \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (spender \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>] \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> \\<nat>[256] \\<heavy_comma>\n      \\<v>\\<a>\\<l> spender \\<Ztypecolon> Address\\<heavy_comma>\n      \\<v>\\<a>\\<l> amount \\<Ztypecolon> \\<nat>[256]\\<close>\n  return \\<open>msg \\<Ztypecolon> Msg\\<heavy_comma>\n      (if allowance + amount < 2 ^ Big 256 then allowance + amount else allowance)\n          \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> \\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''allowance''\n                     \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (msg.sender msg \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (spender \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>] \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> \\<nat>[256] \\<heavy_comma>\n      \\<v>\\<a>\\<l> allowance + amount < 2 ^ Big 256 \\<Ztypecolon> \\<bool>\\<close>\n  \\<medium_left_bracket> \\<rightarrow> v_spender, v_amount;;\n    op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''allowance''\\<close>]\n    op_get_msg_addr[where G=msg.sender]\n    op_get_mapping_ledgeRef\n    op_get_var[where vname=v_spender]\n    op_get_mapping_ledgeRef\n    op_load_ledge \\<rightarrow> v_allowance;;\n(* check the overflow by: allowance \\<le> allowance + amount *)\n    op_get_var[where vname=v_allowance]\n    op_get_var[where vname=v_allowance]\n    op_get_var[where vname=v_amount]\n    op_add_mod\n    op_le\n  have [simp]: \\<open>allowance \\<le> (allowance + amount) mod 2 ^ Big 256 \\<longleftrightarrow> allowance + amount < 2 ^ Big 256\\<close>\n    using \\<phi> mod_if by force\n  ;; \\<rightarrow> ret\n  ;; if \\<open>$ret\\<close>\n  \\<medium_left_bracket> op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''allowance''\\<close>]\n    op_get_msg_addr[where G=msg.sender]\n    op_get_mapping_ledgeRef\n    op_get_var[where vname=v_spender]\n    op_get_mapping_ledgeRef\n    op_get_var[where vname=v_allowance]\n    op_get_var[where vname=v_amount]\n    op_add\n    op_store_ledge\n  \\<medium_right_bracket>. \\<medium_left_bracket> \\<medium_right_bracket>.\n  ;; \\<open>$ret\\<close>\n  \\<medium_right_bracket>. .\n\nthm approve_\\<phi>compilation\n\nproc allowance:\n  argument \\<open>msg \\<Ztypecolon> Msg\\<heavy_comma>\n      allowance \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> \\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''allowance''\n                           \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (msg.sender msg \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (spender \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>] \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> \\<nat>[256] \\<heavy_comma>\n      \\<v>\\<a>\\<l> spender \\<Ztypecolon> Address\\<close>\n  return \\<open>msg \\<Ztypecolon> Msg\\<heavy_comma>\n      allowance \\<Ztypecolon> ledge: msg.contract msg \\<^bold>\\<rightarrow> \\<bbbS>\\<f>\\<i>\\<e>\\<l>\\<d> ''allowance''\n                           \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (msg.sender msg \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub># \\<bbbS>\\<m>\\<a>\\<p> (spender \\<Ztypecolon> Address) \\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>] \\<fish_eye>\\<lbrakk>\\<tau>Int 256\\<rbrakk> \\<nat>[256] \\<heavy_comma>\n      \\<v>\\<a>\\<l> allowance \\<Ztypecolon> \\<nat>[256]\\<close>\n  \\<medium_left_bracket> op_get_msg_addr[where G=msg.contract]\n    op_root_ledge_ref\n    op_get_member_ledgeRef[where field=\\<open>''allowance''\\<close>]\n    op_get_msg_addr[where G=msg.sender]\n    op_get_mapping_ledgeRef\n    \\<open>\\<a>\\<r>\\<g>0\\<close> op_get_mapping_ledgeRef\n    op_load_ledge\n  \\<medium_right_bracket>. .\n\nend\n\nend", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/demo/ERC20.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.34221841512826584}}
{"text": "theory Insider\nimports AT\nbegin\ndatatype action = get | move | eval |put\ntypedecl actor \ntype_synonym identity = string\nconsts Actor :: \"string => actor\"\ntype_synonym policy = \"((actor => bool) * action set)\"\n\ndefinition ID :: \"[actor, string] \\<Rightarrow> bool\"\nwhere \"ID a s \\<equiv> (a = Actor s)\"\n\ndatatype location = Location nat\n  datatype igraph = Lgraph \"(location * location)set\" \"location \\<Rightarrow> identity set\"\n                         \"actor \\<Rightarrow> (string set * string set)\"  \"location \\<Rightarrow> string set\"\ndatatype infrastructure = \n         Infrastructure \"igraph\" \n                        \"[igraph ,location] \\<Rightarrow> policy set\" \n                       \nprimrec loc :: \"location \\<Rightarrow> nat\"\nwhere  \"loc(Location n) = n\"\nprimrec gra :: \"igraph \\<Rightarrow> (location * location)set\"\nwhere  \"gra(Lgraph g a c l) = g\"\nprimrec agra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> identity set)\"\nwhere  \"agra(Lgraph g a c l) = a\"\nprimrec cgra :: \"igraph \\<Rightarrow> (actor \\<Rightarrow> string set * string set)\"\nwhere  \"cgra(Lgraph g a c l) = c\"\nprimrec lgra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> string set)\"\nwhere  \"lgra(Lgraph g a c l) = l\"\n\ndefinition nodes :: \"igraph \\<Rightarrow> location set\" \nwhere \"nodes g == { x. (? y. ((x,y): gra g) | ((y,x): gra g))}\"\n\ndefinition actors_graph :: \"igraph \\<Rightarrow> identity set\"  \nwhere  \"actors_graph g == {x. ? y. y : nodes g \\<and> x \\<in> (agra g y)}\"\n\nprimrec graphI :: \"infrastructure \\<Rightarrow> igraph\"\nwhere \"graphI (Infrastructure g d) = g\"\nprimrec delta :: \"[infrastructure, igraph, location] \\<Rightarrow> policy set\"\nwhere \"delta (Infrastructure g d) = d\"\nprimrec tspace :: \"[infrastructure, actor ] \\<Rightarrow> string set * string set\"\n  where \"tspace (Infrastructure g d) = cgra g\"\nprimrec lspace :: \"[infrastructure, location ] \\<Rightarrow> string set\"\nwhere \"lspace (Infrastructure g d) = lgra g\"\n\ndefinition credentials :: \"string set * string set \\<Rightarrow> string set\"\n  where  \"credentials lxl \\<equiv> (fst lxl)\"\ndefinition has :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"has G ac \\<equiv> snd ac \\<in> credentials(cgra G (fst ac))\"\ndefinition roles :: \"string set * string set \\<Rightarrow> string set\"\n  where  \"roles lxl \\<equiv> (snd lxl)\"\ndefinition role :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"role G ac \\<equiv> snd ac \\<in> roles(cgra G (fst ac))\"\n\ndefinition isin :: \"[igraph,location, string] \\<Rightarrow> bool\" \n  where \"isin G l s \\<equiv> s \\<in> (lgra G l)\"\n  \n  \n  \ndatatype psy_states = happy | depressed | disgruntled | angry | stressed\ndatatype motivations = financial | political | revenge | curious | competitive_advantage | power | peer_recognition\n\ndatatype actor_state = Actor_state \"psy_states\" \"motivations set\"\nprimrec motivation :: \"actor_state \\<Rightarrow> motivations set\" \nwhere \"motivation  (Actor_state p m) =  m\"\nprimrec psy_state :: \"actor_state \\<Rightarrow> psy_states\" \nwhere \"psy_state  (Actor_state p m) = p\"\n\n\ndefinition tipping_point :: \"actor_state \\<Rightarrow> bool\" where\n  \"tipping_point a \\<equiv> ((motivation a \\<noteq> {}) \\<and> (happy \\<noteq> psy_state a))\"\n\n(* idea:: predicate to flag that an actor is isolated *)\nconsts Isolation :: \"[actor_state, (identity * identity) set ] \\<Rightarrow> bool\"\n\n\n(* use above to redefine infrastructure -- adapt policies in nodes\n   so that layed off workers cannot access any more *)\ndefinition lay_off :: \"[infrastructure,actor set] \\<Rightarrow> infrastructure\"\nwhere \"lay_off G A \\<equiv> G\"\n\n(* idea: social graph is derived from activities in infrastructure.\n   Since actors are nodes in the infrastructure graph, we need to \n   have a second graph only on actors reflecting their interaction. *)\nconsts social_graph :: \"(identity * identity) set\"\n(* This social graph is a parameter to the theory. It depends on\n   actual measured activities. We will use it to derive meta-theorems. *)\n\ndefinition UasI ::  \"[identity, identity] \\<Rightarrow> bool \" \nwhere \"UasI a b \\<equiv> (Actor a = Actor b) \\<and> (\\<forall> x y. x \\<noteq> a \\<and> y \\<noteq> a \\<and> Actor x = Actor y \\<longrightarrow> x = y)\"\n\ndefinition UasI' ::  \"[actor => bool, identity, identity] \\<Rightarrow> bool \" \nwhere \"UasI' P a b \\<equiv> P (Actor b) \\<longrightarrow> P (Actor a)\"\n\n(* derive theorems about UasI being a equivalence relation *)\n\nconsts astate :: \"identity \\<Rightarrow> actor_state\"\n\ndefinition Insider :: \"[identity, identity set] \\<Rightarrow> bool\" \nwhere \"Insider a C \\<equiv> (tipping_point (astate a) \\<longrightarrow> (\\<forall> b\\<in>C. UasI a b))\"\n\n\ndefinition Insider' :: \"[actor \\<Rightarrow> bool, identity, identity set] \\<Rightarrow> bool\" \nwhere \"Insider' P a C \\<equiv> (tipping_point (astate a) \\<longrightarrow> (\\<forall> b\\<in>C. UasI' P a b \\<and> inj_on Actor C))\"\n\ndefinition atI :: \"[identity, igraph, location] \\<Rightarrow> bool\" (\"_ @\\<^bsub>(_)\\<^esub> _\" 50)\nwhere \"a @\\<^bsub>G\\<^esub> l \\<equiv> a \\<in> (agra G l)\"\n\ndefinition enables :: \"[infrastructure, location, actor, action] \\<Rightarrow> bool\"\nwhere\n\"enables I l a a' \\<equiv>  (\\<exists> (p,e) \\<in> delta I (graphI I) l. a' \\<in> e \\<and> p a)\"\n\n\n(* behaviour is the good behaviour, i.e. everything allowed by policy *)\ndefinition behaviour :: \"infrastructure \\<Rightarrow> (location * actor * action)set\"\nwhere \"behaviour I \\<equiv> {(t,a,a'). enables I t a a'}\"\n\n(* Most general: misbehaviour is the complement of behaviour *)\ndefinition misbehaviour :: \"infrastructure \\<Rightarrow> (location * actor * action)set\"\nwhere \"misbehaviour I \\<equiv> -(behaviour I)\"\n\n(* state transition on infrastructures *)\ndeclare [[show_types]]\n(*\nprimrec del :: \"['a, 'a list] \\<Rightarrow> 'a list\"\nwhere \ndel_nil: \"del a [] = []\" |\ndel_cons: \"del a (x#ls) = (if x = a then ls else x # (del a ls))\"\n*)\n\nprimrec jonce :: \"['a, 'a list] \\<Rightarrow> bool\"\nwhere\njonce_nil: \"jonce a [] = False\" |\njonce_cons: \"jonce a (x#ls) = (if x = a then (a \\<notin> (set ls)) else jonce a ls)\"\n\nprimrec nodup :: \"['a, 'a list] \\<Rightarrow> bool\"\n  where \n    nodup_nil: \"nodup a [] = True\" |\n    nodup_step: \"nodup a (x # ls) = (if x = a then (a \\<notin> (set ls)) else nodup a ls)\"\n\ndefinition move_graph_a :: \"[identity, location, location, igraph] \\<Rightarrow> igraph\"\nwhere \"move_graph_a n l l' g \\<equiv> Lgraph (gra g) \n                    (if n \\<in> ((agra g) l) &  n \\<notin> ((agra g) l') then \n                     ((agra g)(l := (agra g l) - {n}))(l' := (insert n (agra g l')))\n                     else (agra g))(cgra g)(lgra g)\"\n\ninductive state_transition_in :: \"[infrastructure, infrastructure] \\<Rightarrow> bool\" (\"(_ \\<rightarrow>\\<^sub>n _)\" 50)\nwhere\n  move: \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; l \\<in> nodes G; l' \\<in> nodes G;\n          (a) \\<in> actors_graph(graphI I); enables I l' (Actor a) move;\n         I' = Infrastructure (move_graph_a a l l' (graphI I))(delta I) \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\" \n| get : \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; a' @\\<^bsub>G\\<^esub> l; has G (Actor a, z);\n        enables I l (Actor a) get;\n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)\n                           ((cgra G)(Actor a' := \n                                (insert z (fst(cgra G (Actor a'))), snd(cgra G (Actor a')))))\n                           (lgra G))\n                   (delta I)\n         \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| put : \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; enables I l (Actor a) put;\n        I' = Infrastructure \n                  (Lgraph (gra G)(agra G)(cgra G)\n                          ((lgra G)(l := {z})))\n                   (delta I)\n         \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n  \n(* show that this infrastructure is a state as given in MC.thy *)\ninstantiation \"infrastructure\" :: state\nbegin\n\ndefinition \n   state_transition_infra_def: \"(i \\<rightarrow>\\<^sub>i i') =  (i \\<rightarrow>\\<^sub>n (i' :: infrastructure))\"\n\ninstance\n  by (rule MC.class.MC.state.of_class.intro)\n\ndefinition state_transition_in_refl (\"(_ \\<rightarrow>\\<^sub>n* _)\" 50)\nwhere \"s \\<rightarrow>\\<^sub>n* s' \\<equiv> ((s,s') \\<in> {(x,y). state_transition_in x y}\\<^sup>*)\"\n\nend\n\n  \n  \n(* del related results not needed since we use sets here for credentials etc  \nlemma del_del[rule_format]: \"n \\<in> set (del a S) \\<longrightarrow> n \\<in> set S\"\n  apply (induct_tac S)\n  by auto\n*)\n(* Not true in the current formulation of del since copies are not \n   deleted. But changing that causes extra complxity also elsewhere \n   (see jonce) \nlemma del_del_elim[rule_format]: \"n \\<in> set (S) \\<longrightarrow> n \\<notin> set (del n S)\" *)\n    \n(*    \nlemma del_dec[rule_format]: \"a \\<in> set S \\<longrightarrow> length (del a S) < length S\"  \n  apply (induct_tac S)\n    by auto\n\nlemma del_sort[rule_format]: \"\\<forall> n. (Suc n ::nat) \\<le> length (l) \\<longrightarrow> n \\<le> length (del a (l))\"   \n  apply (induct_tac l)\n   apply simp\n  apply clarify\n  apply (case_tac n)\n   apply simp\n    by simp\n    \nlemma del_jonce: \"jonce a l \\<longrightarrow> a \\<notin> set (del a l)\"\n  apply (induct_tac l)\n  by auto\n    \nlemma del_nodup[rule_format]: \"nodup a l \\<longrightarrow> a \\<notin> set(del a l)\"\n  apply (induct_tac l)\n  by auto\n    \nlemma nodup_up[rule_format]: \"a \\<in> set (del a l) \\<longrightarrow> a \\<in> set l\"\n  apply (induct_tac l)\n  by auto\n    \n    lemma del_up [rule_format]: \"a \\<in> set (del aa l) \\<longrightarrow> a \\<in> set l\"\n   apply (induct_tac l)\n  by auto\n\nlemma nodup_notin[rule_format]:   \"a \\<notin> set list \\<longrightarrow> nodup a list\"\n  apply (induct_tac list)\n  by auto\n    \n    lemma nodup_down[rule_format]: \"nodup a l \\<longrightarrow> nodup a (del a l)\"\n      apply (induct_tac l)\n       apply simp+\n      apply (clarify)\n    by (erule nodup_notin)\n\nlemma del_notin_down[rule_format]: \"a \\<notin> set list \\<longrightarrow> a \\<notin> set (del aa list) \"\n  apply (induct_tac list)\n  by auto\n\nlemma del_not_a[rule_format]: \" x \\<noteq> a \\<longrightarrow> x \\<in> set l \\<longrightarrow> x \\<in> set (del a l)\"\n  apply (induct_tac l)\n    by auto\n      \nlemma nodup_down_notin[rule_format]: \"nodup a l \\<longrightarrow> nodup a (del aa l)\"\n  apply (induct_tac l)\n   apply simp+\n    apply (rule conjI)\n  apply (clarify)\n   apply (erule nodup_notin)\n  apply (rule impI)+\n by (erule del_notin_down)\n*)\n    \nlemma move_graph_eq: \"move_graph_a a l l g = g\"  \nproof (simp add: move_graph_a_def, case_tac g, force)\nqed     \n    \n\nend\n  ", "meta": {"author": "flokam", "repo": "IsabelleAT", "sha": "b8d80c31ac13fdf8c7710f7ae032233b3fa474da", "save_path": "github-repos/isabelle/flokam-IsabelleAT", "path": "github-repos/isabelle/flokam-IsabelleAT/IsabelleAT-b8d80c31ac13fdf8c7710f7ae032233b3fa474da/Insider.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7549149868676283, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.34217416204213214}}
{"text": "(*  Title:      ZF/Inductive.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1993  University of Cambridge\n\nInductive definitions use least fixedpoints with standard products and sums\nCoinductive definitions use greatest fixedpoints with Quine products and sums\n\nSums are used only for mutual recursion;\nProducts are used only to derive \"streamlined\" induction rules for relations\n*)\n\nsection\\<open>Inductive and Coinductive Definitions\\<close>\n\ntheory Inductive\nimports Fixedpt QPair Nat\nkeywords\n  \"inductive\" \"coinductive\" \"inductive_cases\" \"rep_datatype\" \"primrec\" :: thy_decl and\n  \"domains\" \"intros\" \"monos\" \"con_defs\" \"type_intros\" \"type_elims\"\n    \"elimination\" \"induction\" \"case_eqns\" \"recursor_eqns\" :: quasi_command\nbegin\n\nlemma def_swap_iff: \"a \\<equiv> b \\<Longrightarrow> a = c \\<longleftrightarrow> c = b\"\n  by blast\n\nlemma def_trans: \"f \\<equiv> g \\<Longrightarrow> g(a) = b \\<Longrightarrow> f(a) = b\"\n  by simp\n\nlemma refl_thin: \"\\<And>P. a = a \\<Longrightarrow> P \\<Longrightarrow> P\" .\n\nML_file \\<open>ind_syntax.ML\\<close>\nML_file \\<open>Tools/ind_cases.ML\\<close>\nML_file \\<open>Tools/cartprod.ML\\<close>\nML_file \\<open>Tools/inductive_package.ML\\<close>\nML_file \\<open>Tools/induct_tacs.ML\\<close>\nML_file \\<open>Tools/primrec_package.ML\\<close>\n\nML \\<open>\nstructure Lfp =\n  struct\n  val oper      = \\<^Const>\\<open>lfp\\<close>\n  val bnd_mono  = \\<^Const>\\<open>bnd_mono\\<close>\n  val bnd_monoI = @{thm bnd_monoI}\n  val subs      = @{thm def_lfp_subset}\n  val Tarski    = @{thm def_lfp_unfold}\n  val induct    = @{thm def_induct}\n  end;\n\nstructure Standard_Prod =\n  struct\n  val sigma     = \\<^Const>\\<open>Sigma\\<close>\n  val pair      = \\<^Const>\\<open>Pair\\<close>\n  val split_name = \\<^const_name>\\<open>split\\<close>\n  val pair_iff  = @{thm Pair_iff}\n  val split_eq  = @{thm split}\n  val fsplitI   = @{thm splitI}\n  val fsplitD   = @{thm splitD}\n  val fsplitE   = @{thm splitE}\n  end;\n\nstructure Standard_CP = CartProd_Fun (Standard_Prod);\n\nstructure Standard_Sum =\n  struct\n  val sum       = \\<^Const>\\<open>sum\\<close>\n  val inl       = \\<^Const>\\<open>Inl\\<close>\n  val inr       = \\<^Const>\\<open>Inr\\<close>\n  val elim      = \\<^Const>\\<open>case\\<close>\n  val case_inl  = @{thm case_Inl}\n  val case_inr  = @{thm case_Inr}\n  val inl_iff   = @{thm Inl_iff}\n  val inr_iff   = @{thm Inr_iff}\n  val distinct  = @{thm Inl_Inr_iff}\n  val distinct' = @{thm Inr_Inl_iff}\n  val free_SEs  = Ind_Syntax.mk_free_SEs\n            [distinct, distinct', inl_iff, inr_iff, Standard_Prod.pair_iff]\n  end;\n\n\nstructure Ind_Package =\n    Add_inductive_def_Fun\n      (structure Fp=Lfp and Pr=Standard_Prod and CP=Standard_CP\n       and Su=Standard_Sum val coind = false);\n\n\nstructure Gfp =\n  struct\n  val oper      = \\<^Const>\\<open>gfp\\<close>\n  val bnd_mono  = \\<^Const>\\<open>bnd_mono\\<close>\n  val bnd_monoI = @{thm bnd_monoI}\n  val subs      = @{thm def_gfp_subset}\n  val Tarski    = @{thm def_gfp_unfold}\n  val induct    = @{thm def_Collect_coinduct}\n  end;\n\nstructure Quine_Prod =\n  struct\n  val sigma     = \\<^Const>\\<open>QSigma\\<close>\n  val pair      = \\<^Const>\\<open>QPair\\<close>\n  val split_name = \\<^const_name>\\<open>qsplit\\<close>\n  val pair_iff  = @{thm QPair_iff}\n  val split_eq  = @{thm qsplit}\n  val fsplitI   = @{thm qsplitI}\n  val fsplitD   = @{thm qsplitD}\n  val fsplitE   = @{thm qsplitE}\n  end;\n\nstructure Quine_CP = CartProd_Fun (Quine_Prod);\n\nstructure Quine_Sum =\n  struct\n  val sum       = \\<^Const>\\<open>qsum\\<close>\n  val inl       = \\<^Const>\\<open>QInl\\<close>\n  val inr       = \\<^Const>\\<open>QInr\\<close>\n  val elim      = \\<^Const>\\<open>qcase\\<close>\n  val case_inl  = @{thm qcase_QInl}\n  val case_inr  = @{thm qcase_QInr}\n  val inl_iff   = @{thm QInl_iff}\n  val inr_iff   = @{thm QInr_iff}\n  val distinct  = @{thm QInl_QInr_iff}\n  val distinct' = @{thm QInr_QInl_iff}\n  val free_SEs  = Ind_Syntax.mk_free_SEs\n            [distinct, distinct', inl_iff, inr_iff, Quine_Prod.pair_iff]\n  end;\n\n\nstructure CoInd_Package =\n  Add_inductive_def_Fun(structure Fp=Gfp and Pr=Quine_Prod and CP=Quine_CP\n    and Su=Quine_Sum val coind = true);\n\n\\<close>\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/ZF/Inductive.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3421608175009801}}
{"text": "section \\<open>Finding a Path between Nodes\\<close>\ntheory DFS_Find_Path\nimports\n  \"../DFS_Framework\"\n  CAVA_Automata.Digraph_Impl\n  \"../Misc/Impl_Rev_Array_Stack\"\nbegin\ntext \\<open>\n  We instantiate the DFS framework to find a path to some reachable node\n  that satisfies a given predicate. We present four variants of the algorithm:\n  Finding any path, and finding path of at least length one, combined with\n  searching the whole graph, and searching the graph restricted to a given set\n  of nodes. The restricted variants are efficiently implemented by\n  pre-initializing the visited set (cf. @{theory DFS_Framework.Restr_Impl}).\n\n  The restricted variants can be used for incremental search, ignoring already\n  searched nodes in further searches. This is required, e.g., for the inner\n  search of nested DFS (Buchi automaton emptiness check).\n\\<close>\n\nsubsection \\<open>Including empty Path\\<close>\nrecord 'v fp0_state = \"'v state\" +\n  ppath :: \"('v list \\<times> 'v) option\"\n\ntype_synonym 'v fp0_param = \"('v, ('v,unit) fp0_state_ext) parameterization\"\n\n\n\nabbreviation \"no_path \\<equiv> \\<lparr> ppath = None \\<rparr>\"\nabbreviation \"a_path p v \\<equiv> \\<lparr> ppath = Some (p,v) \\<rparr>\"\n\ndefinition fp0_params :: \"('v \\<Rightarrow> bool) \\<Rightarrow> 'v fp0_param\"\n  where \"fp0_params P \\<equiv> \\<lparr>\n  on_init = RETURN no_path,\n  on_new_root = \\<lambda>v0 s. if P v0 then RETURN (a_path [] v0) else RETURN no_path,\n  on_discover = \\<lambda>u v s. if P v\n                   then \\<comment> \\<open>\\<open>v\\<close> is already on the stack, so we need to pop it again\\<close>\n                      RETURN (a_path (rev (tl (stack s))) v)\n                   else RETURN no_path,\n  on_finish = \\<lambda>u s. RETURN (state.more s),\n  on_back_edge = \\<lambda>u v s. RETURN (state.more s),\n  on_cross_edge = \\<lambda>u v s. RETURN (state.more s),\n  is_break = \\<lambda>s. ppath s \\<noteq> None \\<rparr>\"\n\nlemmas fp0_params_simps[simp]\n  = gen_parameterization.simps[mk_record_simp, OF fp0_params_def]\n\ninterpretation fp0: param_DFS_defs where param = \"fp0_params P\"\n  for G P .\n\nlocale fp0 = param_DFS G \"fp0_params P\"\n  for G and P :: \"'v \\<Rightarrow> bool\"\nbegin\n\n  lemma [simp]:\n    \"ppath (empty_state \\<lparr>ppath = e\\<rparr>) = e\"\n    by (simp add: empty_state_def)\n\n  lemma [simp]:\n    \"ppath (s\\<lparr>state.more := state.more s'\\<rparr>) = ppath s'\"\n    by (cases s, cases s') auto\n\n  sublocale DFS where param = \"fp0_params P\"\n    by unfold_locales simp_all\n\nend\n\nlemma fp0I: assumes \"fb_graph G\" shows \"fp0 G\"\nproof - interpret fb_graph G by fact show ?thesis by unfold_locales qed\n\nlocale fp0_invar = fp0 +\n  DFS_invar where param = \"fp0_params P\"\n\nlemma fp0_invar_eq[simp]:\n  \"DFS_invar G (fp0_params P) = fp0_invar G P\"\nproof (intro ext iffI)\n  fix s\n  assume \"DFS_invar G (fp0_params P) s\"\n  interpret DFS_invar G \"fp0_params P\" s by fact\n  show \"fp0_invar G P s\" by unfold_locales\nnext\n  fix s\n  assume \"fp0_invar G P s\"\n  interpret fp0_invar G P s by fact\n  show \"DFS_invar G (fp0_params P) s\" by unfold_locales\nqed\n\ncontext fp0 begin\n\n  lemma i_no_path_no_P_discovered:\n    \"is_invar (\\<lambda>s. ppath s = None \\<longrightarrow> dom (discovered s) \\<inter> Collect P = {})\"\n  by (rule establish_invarI) simp_all\n\n  lemma i_path_to_P:\n    \"is_invar (\\<lambda>s. ppath s = Some (vs,v) \\<longrightarrow> P v)\"\n  by (rule establish_invarI) auto\n\n  lemma i_path_invar:\n    \"is_invar (\\<lambda>s. ppath s = Some (vs,v) \\<longrightarrow>\n                   (vs \\<noteq> [] \\<longrightarrow> hd vs \\<in> V0 \\<and> path E (hd vs) vs v)\n                 \\<and> (vs = [] \\<longrightarrow> v \\<in> V0 \\<and> path E v vs v)\n                 \\<and> (distinct (vs@[v]))\n                 )\"\n  proof (induct rule: establish_invarI)\n    case (discover s s' u v) then interpret fp0_invar where s=s\n      by simp\n\n    from discover have ne: \"stack s \\<noteq> []\" by simp\n    from discover have vnis: \"v\\<notin>set (stack s)\" using stack_discovered by auto\n\n    from pendingD discover have \"v \\<in> succ (hd (stack s))\" by simp\n    with hd_succ_stack_is_path[OF ne] have \"\\<exists>v0\\<in>V0. path E v0 (rev (stack s)) v\" .\n    moreover from last_stack_in_V0 ne have \"last (stack s) \\<in> V0\" by simp\n    ultimately have \"path E (hd (rev (stack s)))  (rev (stack s)) v\" \"hd (rev (stack s)) \\<in> V0\"\n      using hd_rev path_hd[where p=\"rev (stack s)\"] ne\n      by auto\n    with ne discover vnis show ?case by (auto simp: stack_distinct)\n  qed auto\nend\n\ncontext fp0_invar\nbegin\n  lemmas no_path_no_P_discovered\n    = i_no_path_no_P_discovered[THEN make_invar_thm, rule_format]\n\n  lemmas path_to_P\n    = i_path_to_P[THEN make_invar_thm, rule_format]\n\n  lemmas path_invar\n    = i_path_invar[THEN make_invar_thm, rule_format]\n\n  lemma path_invar_nonempty:\n    assumes \"ppath s = Some (vs,v)\"\n    and \"vs \\<noteq> []\"\n    shows \"hd vs \\<in> V0\" \"path E (hd vs) vs v\"\n    using assms path_invar\n    by auto\n\n  lemma path_invar_empty:\n    assumes \"ppath s = Some (vs,v)\"\n    and \"vs = []\"\n    shows \"v \\<in> V0\" \"path E v vs v\"\n    using assms path_invar\n    by auto\n\n  lemma fp0_correct:\n    assumes \"\\<not>cond s\"\n    shows \"case ppath s of\n      None \\<Rightarrow> \\<not>(\\<exists>v0\\<in>V0. \\<exists>v. (v0,v) \\<in> E\\<^sup>* \\<and> P v)\n    | Some (p,v) \\<Rightarrow> (\\<exists>v0\\<in>V0. path E v0 p v \\<and> P v \\<and> distinct (p@[v]))\"\n  proof (cases \"ppath s\")\n    case None with assms nc_discovered_eq_reachable no_path_no_P_discovered have\n      \"reachable \\<inter> Collect P = {}\" by auto\n    thus ?thesis by (auto simp add: None)\n  next\n    case (Some vvs) then obtain v vs where [simp]: \"vvs = (vs,v)\"\n      by (cases vvs) auto\n\n    from Some path_invar[of vs v] path_to_P[of _ v] show ?thesis\n      by auto\n  qed\n\nend\n\ncontext fp0 begin\n  lemma fp0_correct: \"it_dfs \\<le> SPEC (\\<lambda>s. case ppath s of\n      None \\<Rightarrow> \\<not>(\\<exists>v0\\<in>V0. \\<exists>v. (v0,v) \\<in> E\\<^sup>* \\<and> P v)\n    | Some (p,v) \\<Rightarrow> (\\<exists>v0\\<in>V0. path E v0 p v \\<and> P v \\<and> distinct (p@[v])))\"\n    apply (rule weaken_SPEC[OF it_dfs_correct])\n    apply clarsimp\n    apply (simp add: fp0_invar.fp0_correct)\n    done\nend\n\nsubsubsection \\<open>Basic Interface\\<close>\ntext \\<open>Use this interface, rather than the internal stuff above! \\<close>\n(* Making it a well-defined interface. This interface should be used, not\n  the internal stuff. If more information about the result is needed, this\n  interface should be extended! *)\n\ntype_synonym 'v fp_result = \"('v list \\<times> 'v) option\"\ndefinition \"find_path0_pred G P \\<equiv> \\<lambda>r. case r of\n    None \\<Rightarrow> (g_E G)\\<^sup>* `` g_V0 G \\<inter> Collect P = {}\n  | Some (vs,v) \\<Rightarrow> P v \\<and> distinct (vs@[v]) \\<and> (\\<exists> v0 \\<in> g_V0 G. path (g_E G) v0 vs v)\"\n\ndefinition find_path0_spec\n  :: \"('v, _) graph_rec_scheme \\<Rightarrow> ('v \\<Rightarrow> bool) \\<Rightarrow> 'v fp_result nres\"\n  \\<comment> \\<open>Searches a path from the root nodes to some target node that satisfies a\n      given predicate. If such a path is found, the path and the target node\n      are returned\\<close>\nwhere\n  \"find_path0_spec G P \\<equiv> do {\n    ASSERT (fb_graph G);\n    SPEC (find_path0_pred G P)\n  }\"\n\ndefinition find_path0\n  :: \"('v, 'more) graph_rec_scheme \\<Rightarrow> ('v \\<Rightarrow> bool) \\<Rightarrow> 'v fp_result nres\"\n  where \"find_path0 G P \\<equiv> do {\n  ASSERT (fp0 G);\n  s \\<leftarrow> fp0.it_dfs TYPE('more) G P;\n  RETURN (ppath s)\n}\"\n\nlemma find_path0_correct:\n  shows \"find_path0 G P \\<le> find_path0_spec G P\"\n  unfolding find_path0_def find_path0_spec_def find_path0_pred_def\n  apply (refine_vcg le_ASSERTI order_trans[OF fp0.fp0_correct])\n  apply (erule fp0I)\n  apply (auto split: option.split) []\n  done\n\nlemmas find_path0_spec_rule[refine_vcg] =\n  ASSERT_le_defI[OF find_path0_spec_def]\n  ASSERT_leof_defI[OF find_path0_spec_def]\n\nsubsection \\<open>Restricting the Graph\\<close>\ntext \\<open> Extended interface, propagating set of already searched nodes (restriction) \\<close>\n(* Invariant for restriction: The restriction is closed under E\n  and contains no P-nodes *)\ndefinition restr_invar\n  \\<comment> \\<open>Invariant for a node restriction, i.e., a transition closed set of nodes\n    known to not contain a target node that satisfies a predicate.\\<close>\n  where\n  \"restr_invar E R P \\<equiv> E `` R \\<subseteq> R \\<and> R \\<inter> Collect P = {}\"\n\nlemma restr_invar_triv[simp, intro!]: \"restr_invar E {} P\"\n  unfolding restr_invar_def by simp\n\nlemma restr_invar_imp_not_reachable: \"restr_invar E R P \\<Longrightarrow> E\\<^sup>*``R \\<inter> Collect P = {}\"\n  unfolding restr_invar_def by (simp add: Image_closed_trancl)\n\ntype_synonym 'v fpr_result = \"'v set + ('v list \\<times> 'v)\"\ndefinition \"find_path0_restr_pred G P R \\<equiv> \\<lambda>r.\n    case r of\n      Inl R' \\<Rightarrow> R' = R \\<union> (g_E G)\\<^sup>* `` g_V0 G \\<and> restr_invar (g_E G) R' P\n    | Inr (vs,v) \\<Rightarrow> P v \\<and> (\\<exists> v0 \\<in> g_V0 G - R. path (rel_restrict (g_E G) R) v0 vs v)\"\n\ndefinition find_path0_restr_spec\n  \\<comment> \\<open>Find a path to a target node that satisfies a predicate, not considering\n      nodes from the given node restriction. If no path is found, an extended\n      restriction is returned, that contains the start nodes\\<close>\n  where \"find_path0_restr_spec G P R \\<equiv> do {\n    ASSERT (fb_graph G \\<and> restr_invar (g_E G) R P);\n    SPEC (find_path0_restr_pred G P R)}\"\n\nlemmas find_path0_restr_spec_rule[refine_vcg] =\n  ASSERT_le_defI[OF find_path0_restr_spec_def]\n  ASSERT_leof_defI[OF find_path0_restr_spec_def]\n\n\ndefinition find_path0_restr\n  :: \"('v, 'more) graph_rec_scheme \\<Rightarrow> ('v \\<Rightarrow> bool) \\<Rightarrow> 'v set \\<Rightarrow> 'v fpr_result nres\"\n  where \"find_path0_restr G P R \\<equiv> do {\n  ASSERT (fb_graph G);\n  ASSERT (fp0 (graph_restrict G R));\n  s \\<leftarrow> fp0.it_dfs TYPE('more) (graph_restrict G R) P;\n  case ppath s of\n    None \\<Rightarrow> do {\n      ASSERT (dom (discovered s) = dom (finished s));\n      RETURN (Inl (R \\<union> dom (finished s)))\n    }\n  | Some (vs,v) \\<Rightarrow> RETURN (Inr (vs,v))\n}\"\n\n\nlemma find_path0_restr_correct:\n  shows \"find_path0_restr G P R \\<le> find_path0_restr_spec G P R\"\nproof (rule le_ASSERT_defI1[OF find_path0_restr_spec_def], clarify)\n  assume \"fb_graph G\"\n  interpret a: fb_graph G by fact\n  interpret fb_graph \"graph_restrict G R\" by (rule a.fb_graph_restrict)\n\n  assume I: \"restr_invar (g_E G) R P\"\n\n  define reachable where \"reachable = graph_defs.reachable (graph_restrict G R)\"\n\n  interpret fp0 \"graph_restrict G R\" by unfold_locales\n\n  show ?thesis unfolding find_path0_restr_def find_path0_restr_spec_def\n    apply (refine_rcg refine_vcg le_ASSERTI order_trans[OF it_dfs_correct])\n    apply unfold_locales\n    apply (clarsimp_all)\n  proof -\n    fix s\n    assume \"fp0_invar (graph_restrict G R) P s\"\n      and NC[simp]: \"\\<not>fp0.cond TYPE('b) (graph_restrict G R) P s\"\n    then interpret fp0_invar \"graph_restrict G R\" P s by simp\n\n    {\n      assume [simp]: \"ppath s = None\"\n\n      from nc_discovered_eq_finished\n      show \"dom (discovered s) = dom (finished s)\" by simp\n\n      from nc_finished_eq_reachable\n      have DFR[simp]: \"dom (finished s) = reachable\"\n        by (simp add: reachable_def)\n\n      from I have \"g_E G `` R \\<subseteq> R\" unfolding restr_invar_def by auto\n\n      have \"reachable \\<subseteq> (g_E G)\\<^sup>* `` g_V0 G\"\n        unfolding reachable_def\n        by (rule Image_mono, rule rtrancl_mono) (auto simp: rel_restrict_def)\n\n      hence \"R \\<union> dom (finished s) = R \\<union> (g_E G)\\<^sup>* `` g_V0 G\"\n        apply -\n        apply (rule equalityI)\n        apply auto []\n        unfolding DFR reachable_def\n        apply (auto elim: E_closed_restr_reach_cases[OF _ \\<open>g_E G `` R \\<subseteq> R\\<close>]) []\n        done\n      moreover from nc_fin_closed I\n      have \"g_E G `` (R \\<union> dom (finished s)) \\<subseteq> R \\<union> dom (finished s)\"\n        unfolding restr_invar_def by (simp add: rel_restrict_def) blast\n      moreover from no_path_no_P_discovered nc_discovered_eq_finished I\n      have \"(R \\<union> dom (finished s)) \\<inter> Collect P = {}\"\n        unfolding restr_invar_def by auto\n      ultimately\n      show \"find_path0_restr_pred G P R (Inl (R \\<union> dom (finished s)))\"\n        unfolding restr_invar_def find_path0_restr_pred_def by auto\n    }\n\n    {\n      fix v vs\n      assume [simp]: \"ppath s = Some (vs,v)\"\n      from fp0_correct\n      show \"find_path0_restr_pred G P R (Inr (vs, v))\"\n        unfolding find_path0_restr_pred_def by auto\n    }\n  qed\nqed\n\nsubsection \\<open>Path of Minimal Length One, with Restriction\\<close>\ndefinition \"find_path1_restr_pred G P R \\<equiv> \\<lambda>r.\n      case r of\n        Inl R' \\<Rightarrow> R' = R \\<union> (g_E G)\\<^sup>+ `` g_V0 G \\<and> restr_invar (g_E G) R' P\n      | Inr (vs,v) \\<Rightarrow> P v \\<and> vs \\<noteq> [] \\<and> (\\<exists> v0 \\<in> g_V0 G. path (g_E G \\<inter> UNIV \\<times> -R) v0 vs v)\"\n\ndefinition find_path1_restr_spec\n  \\<comment> \\<open>Find a path of length at least one to a target node that satisfies P.\n    Takes an initial node restriction, and returns an extended node restriction.\\<close>\n  where \"find_path1_restr_spec G P R \\<equiv> do {\n    ASSERT (fb_graph G \\<and> restr_invar (g_E G) R P);\n    SPEC (find_path1_restr_pred G P R)}\"\n\nlemmas find_path1_restr_spec_rule[refine_vcg] =\n  ASSERT_le_defI[OF find_path1_restr_spec_def]\n  ASSERT_leof_defI[OF find_path1_restr_spec_def]\n\ndefinition find_path1_restr\n  :: \"('v, 'more) graph_rec_scheme \\<Rightarrow> ('v \\<Rightarrow> bool) \\<Rightarrow> 'v set \\<Rightarrow> 'v fpr_result nres\"\n  where \"find_path1_restr G P R \\<equiv>\n  FOREACHc (g_V0 G) is_Inl (\\<lambda>v0 s. do {\n    ASSERT (is_Inl s); \\<comment> \\<open>TODO: Add FOREACH-condition as precondition in autoref!\\<close>\n    let R = projl s;\n    f0 \\<leftarrow> find_path0_restr_spec (G \\<lparr> g_V0 := g_E G `` {v0} \\<rparr>) P R;\n    case f0 of\n      Inl _ \\<Rightarrow> RETURN f0\n    | Inr (vs,v) \\<Rightarrow> RETURN (Inr (v0#vs,v))\n  }) (Inl R)\"\n\ndefinition \"find_path1_tailrec_invar G P R0 it s \\<equiv>\n  case s of\n    Inl R \\<Rightarrow> R = R0 \\<union> (g_E G)\\<^sup>+ `` (g_V0 G - it) \\<and> restr_invar (g_E G) R P\n  | Inr (vs, v) \\<Rightarrow> P v \\<and> vs \\<noteq> [] \\<and> (\\<exists> v0 \\<in> g_V0 G - it. path (g_E G \\<inter> UNIV \\<times> -R0) v0 vs v)\"\n\n\nlemma find_path1_restr_correct:\n  shows \"find_path1_restr G P R \\<le> find_path1_restr_spec G P R\"\nproof (rule le_ASSERT_defI1[OF find_path1_restr_spec_def], clarify)\n  assume \"fb_graph G\"\n  interpret a: fb_graph G by fact\n  interpret fb0: fb_graph \"G \\<lparr> g_E := g_E G \\<inter> UNIV \\<times> -R \\<rparr>\"\n    by (rule a.fb_graph_subset, auto)\n\n  assume I: \"restr_invar (g_E G) R P\"\n\n  have aux2: \"\\<And>v0. v0 \\<in> g_V0 G \\<Longrightarrow> fb_graph (G \\<lparr> g_V0 := g_E G `` {v0} \\<rparr>)\"\n    by (rule a.fb_graph_subset, auto)\n\n  {\n    fix v0 it s\n    assume IT: \"it \\<subseteq> g_V0 G\" \"v0 \\<in> it\"\n    and \"is_Inl s\"\n    and FPI: \"find_path1_tailrec_invar G P R it s\"\n    and RI: \"restr_invar (g_E G) (projl s \\<union> (g_E G)\\<^sup>+ `` {v0}) P\"\n\n    then obtain R' where [simp]: \"s = Inl R'\" by (cases s) auto\n\n    from FPI have [simp]: \"R' = R \\<union> (g_E G)\\<^sup>+ `` (g_V0 G - it)\"\n      unfolding find_path1_tailrec_invar_def by simp\n\n    have \"find_path1_tailrec_invar G P R (it - {v0})\n            (Inl (projl s \\<union> (g_E G)\\<^sup>+ `` {v0}))\"\n      using RI\n      by (auto simp: find_path1_tailrec_invar_def it_step_insert_iff[OF IT])\n  } note aux4 = this\n\n  {\n    fix v0 u it s v p\n    assume IT: \"it \\<subseteq> g_V0 G\" \"v0 \\<in> it\"\n    and \"is_Inl s\"\n    and FPI: \"find_path1_tailrec_invar G P R it s\"\n    and PV: \"P v\"\n    and PATH: \"path (rel_restrict (g_E G) (projl s)) u p v\" \"(v0,u)\\<in>(g_E G)\"\n    and PR: \"u \\<notin> projl s\"\n\n    then obtain R' where [simp]: \"s = Inl R'\" by (cases s) auto\n\n    from FPI have [simp]: \"R' = R \\<union> (g_E G)\\<^sup>+ `` (g_V0 G - it)\"\n      unfolding find_path1_tailrec_invar_def by simp\n\n    have \"find_path1_tailrec_invar G P R (it - {v0}) (Inr (v0 # p, v))\"\n      apply (simp add: find_path1_tailrec_invar_def PV)\n      apply (rule bexI[where x=v0])\n        using PR PATH(2) path_mono[OF rel_restrict_mono2[of R] PATH(1)]\n        apply (auto simp: path1_restr_conv) []\n\n        using IT apply blast\n      done\n  } note aux5 = this\n\n  show ?thesis\n    unfolding find_path1_restr_def find_path1_restr_spec_def find_path1_restr_pred_def\n    apply (refine_rcg le_ASSERTI\n      refine_vcg FOREACHc_rule[where I=\"find_path1_tailrec_invar G P R\"]\n      (*order_trans[OF find_path0_restr_correct]*)\n      )\n    apply simp\n    using I apply (auto simp add: find_path1_tailrec_invar_def restr_invar_def) []\n\n    apply (blast intro: aux2)\n    apply (auto simp add: find_path1_tailrec_invar_def split: sum.splits) []\n    apply (auto\n      simp: find_path0_restr_pred_def aux4 aux5\n      simp: trancl_Image_unfold_left[symmetric]\n      split: sum.splits) []\n\n    apply (auto simp add: find_path1_tailrec_invar_def split: sum.splits) [2]\n    done\nqed\n\ndefinition \"find_path1_pred G P \\<equiv> \\<lambda>r.\n      case r of\n        None \\<Rightarrow> (g_E G)\\<^sup>+ `` g_V0 G \\<inter> Collect P = {}\n      | Some (vs, v) \\<Rightarrow> P v \\<and> vs \\<noteq> [] \\<and> (\\<exists> v0 \\<in> g_V0 G. path (g_E G) v0 vs v)\"\ndefinition find_path1_spec\n  \\<comment> \\<open>Find a path of length at least one to a target node that satisfies\n      a given predicate.\\<close>\n  where \"find_path1_spec G P \\<equiv> do {\n    ASSERT (fb_graph G);\n    SPEC (find_path1_pred G P)}\"\n\nlemmas find_path1_spec_rule[refine_vcg] =\n  ASSERT_le_defI[OF find_path1_spec_def]\n  ASSERT_leof_defI[OF find_path1_spec_def]\n\nsubsection \\<open>Path of Minimal Length One, without Restriction\\<close>\ndefinition find_path1\n  :: \"('v, 'more) graph_rec_scheme \\<Rightarrow> ('v \\<Rightarrow> bool) \\<Rightarrow> 'v fp_result nres\"\n  where \"find_path1 G P \\<equiv> do {\n  r \\<leftarrow> find_path1_restr_spec G P {};\n  case r of\n    Inl _ \\<Rightarrow> RETURN None\n  | Inr vsv \\<Rightarrow> RETURN (Some vsv)\n}\"\n\nlemma find_path1_correct:\n  shows \"find_path1 G P \\<le> find_path1_spec G P\"\n  unfolding find_path1_def find_path1_spec_def find_path1_pred_def\n  apply (refine_rcg refine_vcg le_ASSERTI order_trans[OF find_path1_restr_correct])\n  apply simp\n  apply (fastforce\n    simp: find_path1_restr_spec_def find_path1_restr_pred_def\n    split: sum.splits\n    dest!: restr_invar_imp_not_reachable tranclD)\n  done\n\nsubsection \\<open>Implementation\\<close>\n\n(* Implementation with stack *)\nrecord 'v fp0_state_impl = \"'v simple_state\" +\n  ppath :: \"('v list \\<times> 'v) option\"\n\ndefinition \"fp0_erel \\<equiv> {\n  (\\<lparr> fp0_state_impl.ppath = p \\<rparr>, \\<lparr> fp0_state.ppath = p\\<rparr>) | p. True }\"\n\nabbreviation \"fp0_rel R \\<equiv> \\<langle>fp0_erel\\<rangle>restr_simple_state_rel R\"\n\nabbreviation \"no_path_impl \\<equiv> \\<lparr> fp0_state_impl.ppath = None \\<rparr>\"\nabbreviation \"a_path_impl p v \\<equiv> \\<lparr> fp0_state_impl.ppath = Some (p,v) \\<rparr>\"\n\nlemma fp0_rel_ppath_cong[simp]:\n  \"(s,s')\\<in>fp0_rel R \\<Longrightarrow> fp0_state_impl.ppath s = fp0_state.ppath s'\"\n  unfolding restr_simple_state_rel_def fp0_erel_def\n  by (cases s, cases s', auto)\n\nlemma fp0_ss_rel_ppath_cong[simp]:\n  \"(s,s')\\<in>\\<langle>fp0_erel\\<rangle>simple_state_rel \\<Longrightarrow> fp0_state_impl.ppath s = fp0_state.ppath s'\"\n  unfolding simple_state_rel_def fp0_erel_def\n  by (cases s, cases s', auto)\n\nlemma fp0i_cong[cong]: \"simple_state.more s = simple_state.more s'\n  \\<Longrightarrow> fp0_state_impl.ppath s = fp0_state_impl.ppath s'\"\n  by (cases s, cases s', auto)\n\nlemma fp0_erelI: \"p=p'\n  \\<Longrightarrow> (\\<lparr> fp0_state_impl.ppath = p \\<rparr>, \\<lparr> fp0_state.ppath = p'\\<rparr>)\\<in>fp0_erel\"\n  unfolding fp0_erel_def by auto\n\ndefinition fp0_params_impl\n  :: \"_ \\<Rightarrow> ('v,'v fp0_state_impl,('v,unit)fp0_state_impl_ext) gen_parameterization\"\nwhere \"fp0_params_impl P \\<equiv> \\<lparr>\n  on_init = RETURN no_path_impl,\n  on_new_root = \\<lambda>v0 s.\n    if P v0 then RETURN (a_path_impl [] v0) else RETURN no_path_impl,\n  on_discover = \\<lambda>u v s.\n    if P v then RETURN (a_path_impl (map fst (rev (tl (CAST (ss_stack s))))) v)\n    else RETURN no_path_impl,\n  on_finish = \\<lambda>u s. RETURN (simple_state.more s),\n  on_back_edge = \\<lambda>u v s. RETURN (simple_state.more s),\n  on_cross_edge = \\<lambda>u v s. RETURN (simple_state.more s),\n  is_break = \\<lambda>s. ppath s \\<noteq> None \\<rparr>\"\n\nlemmas fp0_params_impl_simp[simp, DFS_code_unfold]\n  = gen_parameterization.simps[mk_record_simp, OF fp0_params_impl_def]\n\ninterpretation fp0_impl:\n  restricted_impl_defs \"fp0_params_impl P\" \"fp0_params P\" G R\n  for G P R .\n\nlocale fp0_restr = fb_graph\nbegin\n  sublocale fp0?: fp0 \"graph_restrict G R\"\n    apply (rule fp0I)\n    apply (rule fb_graph_restrict)\n    done\n\n  sublocale impl: restricted_impl G \"fp0_params P\" \"fp0_params_impl P\"\n    fp0_erel R\n    apply unfold_locales\n      apply parametricity\n\n      apply (simp add: fp0_erel_def)\n      apply (auto) [1]\n\n      apply (auto\n        simp: rev_map[symmetric] map_tl comp_def\n        simp: fp0_erel_def simple_state_rel_def) [7]\n\n      apply (auto simp: restr_rel_def) [3]\n      apply (clarsimp simp: restr_rel_def)\n      apply (rule IdD) apply (subst list_rel_id_simp[symmetric])\n      apply parametricity\n    done\nend\n\ndefinition \"find_path0_restr_impl G P R \\<equiv> do {\n  ASSERT (fb_graph G);\n  ASSERT (fp0 (graph_restrict G R));\n  s \\<leftarrow> fp0_impl.tailrec_impl TYPE('a) G R P;\n  case ppath s of\n    None \\<Rightarrow> RETURN (Inl (visited s))\n  | Some (vs,v) \\<Rightarrow> RETURN (Inr (vs,v))\n}\"\n\n\nlemma find_path0_restr_impl[refine]:\n  shows \"find_path0_restr_impl G P R\n     \\<le> \\<Down>(\\<langle>Id,Id\\<times>\\<^sub>rId\\<rangle>sum_rel)\n   (find_path0_restr G P R)\"\nproof (rule refine_ASSERT_defI2[OF find_path0_restr_def])\n  assume \"fb_graph G\"\n  then interpret fb_graph G .\n  interpret fp0_restr G by unfold_locales\n\n  show ?thesis\n   unfolding find_path0_restr_impl_def find_path0_restr_def\n   apply (refine_rcg impl.tailrec_refine)\n   apply refine_dref_type\n   apply (auto simp: restr_simple_state_rel_def)\n   done\nqed\n\ndefinition \"find_path0_impl G P \\<equiv> do {\n  ASSERT (fp0 G);\n  s \\<leftarrow> fp0_impl.tailrec_impl TYPE('a) G {} P;\n  RETURN (ppath s)\n}\"\n\nlemma find_path0_impl[refine]: \"find_path0_impl G P\n  \\<le> \\<Down> (\\<langle>Id\\<times>\\<^sub>rId\\<rangle>option_rel) (find_path0 G P)\"\nproof (rule refine_ASSERT_defI1[OF find_path0_def])\n  assume \"fp0 G\"\n  then interpret fp0 G .\n  interpret r: fp0_restr G by unfold_locales\n\n  show ?thesis\n   unfolding find_path0_impl_def find_path0_def\n   apply (refine_rcg r.impl.tailrec_refine[where R=\"{}\", simplified])\n   apply (auto)\n   done\nqed\n\nsubsection \\<open>Synthesis of Executable Code\\<close>\n(* Autoref *)\n\nrecord ('v,'si,'nsi)fp0_state_impl' = \"('si,'nsi)simple_state_nos_impl\" +\n  ppath_impl :: \"('v list \\<times> 'v) option\"\n\ndefinition [to_relAPP]: \"fp0_state_erel erel \\<equiv> {\n  (\\<lparr>ppath_impl = pi, \\<dots> =  mi\\<rparr>,\\<lparr>ppath = p, \\<dots> = m\\<rparr>) | pi mi p m.\n    (pi,p)\\<in>\\<langle>\\<langle>Id\\<rangle>list_rel \\<times>\\<^sub>r Id\\<rangle>option_rel \\<and> (mi,m)\\<in>erel}\"\n\nconsts\n  i_fp0_state_ext :: \"interface \\<Rightarrow> interface\"\n\nlemmas [autoref_rel_intf] = REL_INTFI[of fp0_state_erel i_fp0_state_ext]\n\n\nterm fp0_state_impl_ext\nlemma [autoref_rules]:\n  fixes ns_rel vis_rel erel\n  defines \"R \\<equiv> \\<langle>ns_rel,vis_rel,\\<langle>erel\\<rangle>fp0_state_erel\\<rangle>ssnos_impl_rel\"\n  shows\n    \"(fp0_state_impl'_ext, fp0_state_impl_ext)\n      \\<in> \\<langle>\\<langle>Id\\<rangle>list_rel \\<times>\\<^sub>r Id\\<rangle>option_rel \\<rightarrow> erel \\<rightarrow> \\<langle>erel\\<rangle>fp0_state_erel\"\n    \"(ppath_impl, fp0_state_impl.ppath) \\<in> R \\<rightarrow> \\<langle>\\<langle>Id\\<rangle>list_rel \\<times>\\<^sub>r Id\\<rangle>option_rel\"\n  unfolding fp0_state_erel_def ssnos_impl_rel_def R_def\n  by auto\n\nschematic_goal find_path0_code:\n  fixes G :: \"('v :: hashable, _) graph_rec_scheme\"\n  assumes [autoref_rules]:\n    \"(Gi, G) \\<in> \\<langle>Rm, Id\\<rangle>g_impl_rel_ext\"\n    \"(Pi, P) \\<in> Id \\<rightarrow> bool_rel\"\n  notes [autoref_tyrel] = TYRELI[where R=\"\\<langle>Id::('v\\<times>'v) set\\<rangle>dflt_ahs_rel\"]\n  shows \"(nres_of (?c::?'c dres), find_path0_impl G P) \\<in> ?R\"\n  unfolding find_path0_impl_def[abs_def] DFS_code_unfold ssnos_unfolds\n  unfolding if_cancel not_not comp_def nres_monad_laws\n  using [[autoref_trace_failed_id]]\n  apply (autoref_monadic (trace))\n  done\n\nconcrete_definition find_path0_code uses find_path0_code\nexport_code find_path0_code checking SML\n\nlemma find_path0_autoref_aux:\n  assumes Vid: \"Rv = (Id :: 'a :: hashable rel)\"\n  shows \"(\\<lambda>G P. nres_of (find_path0_code G P), find_path0_spec)\n    \\<in> \\<langle>Rm, Rv\\<rangle>g_impl_rel_ext \\<rightarrow> (Rv \\<rightarrow> bool_rel)\n      \\<rightarrow> \\<langle>\\<langle>\\<langle>Rv\\<rangle>list_rel \\<times>\\<^sub>r Rv\\<rangle>option_rel\\<rangle>nres_rel\"\n  apply (intro fun_relI nres_relI)\n  unfolding Vid\n  apply (rule\n    order_trans[OF find_path0_code.refine[param_fo, THEN nres_relD]],\n    assumption+\n    )\n  using find_path0_impl find_path0_correct\n  apply (simp add: pw_le_iff refine_pw_simps)\n  apply blast\n  done\nlemmas find_path0_autoref[autoref_rules] = find_path0_autoref_aux[OF PREFER_id_D]\n\n\n\n\nschematic_goal find_path0_restr_code:\n  fixes vis_rel :: \"('v\\<times>'v) set \\<Rightarrow> ('visi\\<times>'v set) set\"\n  notes [autoref_rel_intf] = REL_INTFI[of vis_rel \"i_set\" for I]\n  assumes [autoref_rules]: \"(op_vis_insert, insert)\\<in>Id \\<rightarrow> \\<langle>Id\\<rangle>vis_rel \\<rightarrow> \\<langle>Id\\<rangle>vis_rel\"\n  assumes [autoref_rules]: \"(op_vis_memb, (\\<in>))\\<in>Id \\<rightarrow> \\<langle>Id\\<rangle>vis_rel \\<rightarrow> bool_rel\"\n  assumes [autoref_rules]:\n    \"(Gi, G) \\<in> \\<langle>Rm, Id\\<rangle>g_impl_rel_ext\"\n    \"(Pi,P)\\<in>Id \\<rightarrow> bool_rel\"\n    \"(Ri,R)\\<in>\\<langle>Id\\<rangle>vis_rel\"\n  shows \"(nres_of (?c::?'c dres),\n    find_path0_restr_impl\n      G\n      P\n      (R:::\\<^sub>r\\<langle>Id\\<rangle>vis_rel)) \\<in> ?R\"\n  unfolding find_path0_restr_impl_def[abs_def] DFS_code_unfold ssnos_unfolds\n  unfolding if_cancel not_not comp_def nres_monad_laws\n  using [[autoref_trace_failed_id]]\n  apply (autoref_monadic (trace))\n  done\n\nconcrete_definition find_path0_restr_code uses find_path0_restr_code\nexport_code find_path0_restr_code checking SML\n\nlemma find_path0_restr_autoref_aux:\n  assumes 1: \"(op_vis_insert, insert)\\<in>Rv \\<rightarrow> \\<langle>Rv\\<rangle>vis_rel \\<rightarrow> \\<langle>Rv\\<rangle>vis_rel\"\n  assumes 2: \"(op_vis_memb, (\\<in>))\\<in>Rv \\<rightarrow> \\<langle>Rv\\<rangle>vis_rel \\<rightarrow> bool_rel\"\n  assumes Vid: \"Rv = Id\"\n  shows \"(\\<lambda> G P R. nres_of (find_path0_restr_code op_vis_insert op_vis_memb G P R),\n    find_path0_restr_spec)\n    \\<in> \\<langle>Rm, Rv\\<rangle>g_impl_rel_ext \\<rightarrow> (Rv \\<rightarrow> bool_rel) \\<rightarrow> \\<langle>Rv\\<rangle>vis_rel \\<rightarrow>\n    \\<langle>\\<langle>\\<langle>Rv\\<rangle>vis_rel, \\<langle>Rv\\<rangle>list_rel \\<times>\\<^sub>r Rv\\<rangle>sum_rel\\<rangle>nres_rel\"\n  apply (intro fun_relI nres_relI)\n  unfolding Vid\n  apply (rule\n    order_trans[OF find_path0_restr_code.refine[OF 1[unfolded Vid] 2[unfolded Vid], param_fo, THEN nres_relD]]\n    )\n  apply assumption+\n  using find_path0_restr_impl find_path0_restr_correct\n  apply (simp add: pw_le_iff refine_pw_simps)\n  apply blast\n  done\nlemmas find_path0_restr_autoref[autoref_rules] = find_path0_restr_autoref_aux[OF GEN_OP_D GEN_OP_D PREFER_id_D]\n\nschematic_goal find_path1_restr_code:\n  fixes vis_rel :: \"('v\\<times>'v) set \\<Rightarrow> ('visi\\<times>'v set) set\"\n  notes [autoref_rel_intf] = REL_INTFI[of vis_rel \"i_set\" for I]\n  assumes [autoref_rules]: \"(op_vis_insert, insert)\\<in>Id \\<rightarrow> \\<langle>Id\\<rangle>vis_rel \\<rightarrow> \\<langle>Id\\<rangle>vis_rel\"\n  assumes [autoref_rules]: \"(op_vis_memb, (\\<in>))\\<in>Id \\<rightarrow> \\<langle>Id\\<rangle>vis_rel \\<rightarrow> bool_rel\"\n  assumes [autoref_rules]:\n    \"(Gi, G) \\<in> \\<langle>Rm, Id\\<rangle>g_impl_rel_ext\"\n    \"(Pi,P)\\<in>Id \\<rightarrow> bool_rel\"\n    \"(Ri,R)\\<in>\\<langle>Id\\<rangle>vis_rel\"\n  shows \"(nres_of ?c,find_path1_restr G P R)\n  \\<in> \\<langle>\\<langle>\\<langle>Id\\<rangle>vis_rel, \\<langle>Id\\<rangle>list_rel \\<times>\\<^sub>r Id\\<rangle>sum_rel\\<rangle>nres_rel\"\n  unfolding find_path1_restr_def[abs_def]\n  using [[autoref_trace_failed_id]]\n  apply (autoref_monadic (trace))\n  done\n\nconcrete_definition find_path1_restr_code uses find_path1_restr_code\nexport_code find_path1_restr_code checking SML\n\nlemma find_path1_restr_autoref_aux:\n  assumes G: \"(op_vis_insert, insert)\\<in>V \\<rightarrow> \\<langle>V\\<rangle>vis_rel \\<rightarrow> \\<langle>V\\<rangle>vis_rel\"\n             \"(op_vis_memb, (\\<in>))\\<in>V \\<rightarrow> \\<langle>V\\<rangle>vis_rel \\<rightarrow> bool_rel\"\n  assumes Vid[simp]: \"V=Id\"\n  shows \"(\\<lambda> G P R. nres_of (find_path1_restr_code op_vis_insert op_vis_memb G P R),find_path1_restr_spec)\n  \\<in> \\<langle>Rm, V\\<rangle>g_impl_rel_ext \\<rightarrow> (V \\<rightarrow> bool_rel) \\<rightarrow> \\<langle>V\\<rangle>vis_rel \\<rightarrow>\n    \\<langle>\\<langle>\\<langle>V\\<rangle>vis_rel, \\<langle>V\\<rangle>list_rel \\<times>\\<^sub>r V\\<rangle>sum_rel\\<rangle>nres_rel\"\n\nproof -\n  note find_path1_restr_code.refine[OF G[simplified], param_fo, THEN nres_relD]\n  also note find_path1_restr_correct\n  finally show ?thesis by (force intro!: nres_relI)\nqed\n\nlemmas find_path1_restr_autoref[autoref_rules] = find_path1_restr_autoref_aux[OF GEN_OP_D GEN_OP_D PREFER_id_D]\n\nschematic_goal find_path1_code:\n  assumes Vid: \"V = (Id :: 'a :: hashable rel)\"\n  assumes [unfolded Vid,autoref_rules]:\n    \"(Gi, G) \\<in> \\<langle>Rm, V\\<rangle>g_impl_rel_ext\"\n    \"(Pi,P)\\<in>V \\<rightarrow> bool_rel\"\n  notes [autoref_tyrel] = TYRELI[where R=\"\\<langle>(Id::('a\\<times>'a::hashable)set)\\<rangle>dflt_ahs_rel\"]\n  shows \"(nres_of ?c,find_path1 G P)\n  \\<in> \\<langle>\\<langle>\\<langle>V\\<rangle>list_rel \\<times>\\<^sub>r V\\<rangle>option_rel\\<rangle>nres_rel\"\n  unfolding find_path1_def[abs_def] Vid\n  using [[autoref_trace_failed_id]]\n  apply (autoref_monadic (trace))\n  done\nconcrete_definition find_path1_code uses find_path1_code\n\nexport_code find_path1_code checking SML\n\nlemma find_path1_code_autoref_aux:\n  assumes Vid: \"V = (Id :: 'a :: hashable rel)\"\n  shows \"(\\<lambda> G P. nres_of (find_path1_code G P), find_path1_spec)\n    \\<in> \\<langle>Rm, V\\<rangle>g_impl_rel_ext \\<rightarrow> (V \\<rightarrow> bool_rel) \\<rightarrow> \\<langle>\\<langle>\\<langle>V\\<rangle>list_rel \\<times>\\<^sub>r V\\<rangle>option_rel\\<rangle>nres_rel\"\nproof -\n  note find_path1_code.refine[OF Vid, param_fo, THEN nres_relD, simplified]\n  also note find_path1_correct\n  finally show ?thesis by (force intro!: nres_relI)\nqed\n\nlemmas find_path1_autoref[autoref_rules] = find_path1_code_autoref_aux[OF PREFER_id_D]\n\nsubsection \\<open>Conclusion\\<close>\ntext \\<open>\n  We have synthesized an efficient implementation for an algorithm to find a path\n  to a reachable node that satisfies a predicate. The algorithm comes in four variants,\n  with and without empty path, and with and without node restriction.\n\n  We have set up the Autoref tool, to insert this algorithms for the following\n  specifications:\n  \\<^item> @{term \"find_path0_spec G P\"} --- find path to node that satisfies @{term P}.\n  \\<^item> @{term \"find_path1_spec G P\"} --- find non-empty path to node that satisfies @{term P}.\n  \\<^item> @{term \"find_path0_restr_spec G P R\"} --- find path, with nodes from @{term R} already searched.\n  \\<^item> @{term \"find_path1_restr_spec\"} --- find non-empty path, with nodes from @{term R} already searched.\n\n\\<close>\nthm find_path0_autoref\nthm find_path1_autoref\nthm find_path0_restr_autoref\nthm find_path1_restr_autoref\n\n\nend\n\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/DFS_Framework/Examples/DFS_Find_Path.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5964331462646255, "lm_q1q2_score": 0.3421608175009801}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Peter Lammich <peter dot lammich at uni-muenster.de>\n    Maintainer:  Peter Lammich <peter dot lammich at uni-muenster.de>\n*)\nheader {* \\isaheader{Additions to RB-Trees} *}\ntheory RBT_add\nimports \n  \"~~/src/HOL/Library/RBT_Impl\" \n  \"../Iterator/Iterator\"\nbegin\ntext_raw {*\\label{thy:RBT_add}*}\n\nlemma tlt_trans: \"\\<lbrakk>l |\\<guillemotleft> u; u\\<le>v\\<rbrakk> \\<Longrightarrow> l |\\<guillemotleft> v\"\n  by (induct l) auto\n\nlemma trt_trans: \"\\<lbrakk> u\\<le>v; v\\<guillemotleft>|r \\<rbrakk> \\<Longrightarrow> u\\<guillemotleft>|r\"\n  by (induct r) auto\n\nlemmas tlt_trans' = tlt_trans[OF _ less_imp_le]\nlemmas trt_trans' = trt_trans[OF less_imp_le]\n\nprimrec rm_iterateoi \n  :: \"('k,'v) RBT_Impl.rbt \\<Rightarrow> ('k \\<times> 'v, '\\<sigma>) set_iterator\"\n  where\n  \"rm_iterateoi RBT_Impl.Empty c f \\<sigma> = \\<sigma>\" |\n  \"rm_iterateoi (RBT_Impl.Branch col l k v r) c f \\<sigma> = (\n    if (c \\<sigma>) then\n      let \\<sigma>' = rm_iterateoi l c f \\<sigma> in\n        if (c \\<sigma>') then\n          rm_iterateoi r c f (f (k, v) \\<sigma>')\n        else \\<sigma>'\n    else \n      \\<sigma>\n  )\"\n\nlemma rm_iterateoi_abort :\n  \"\\<not>(c \\<sigma>) \\<Longrightarrow> rm_iterateoi t c f \\<sigma> = \\<sigma>\"\nby (cases t) auto\n\nlemma rm_iterateoi_alt_def :\n  \"rm_iterateoi RBT_Impl.Empty = set_iterator_emp\"\n  \"rm_iterateoi (RBT_Impl.Branch col l k v r) = \n   set_iterator_union (rm_iterateoi l)\n     (set_iterator_union (set_iterator_sng (k, v)) (rm_iterateoi r))\"\nby (simp_all add: fun_eq_iff set_iterator_emp_def rm_iterateoi_abort\n                  set_iterator_union_def set_iterator_sng_def Let_def)\ndeclare rm_iterateoi.simps[simp del]\n\n\nprimrec rm_reverse_iterateoi \n  :: \"('k,'v) RBT_Impl.rbt \\<Rightarrow> ('k \\<times> 'v, '\\<sigma>) set_iterator\"\n  where\n  \"rm_reverse_iterateoi RBT_Impl.Empty c f \\<sigma> = \\<sigma>\" |\n  \"rm_reverse_iterateoi (Branch col l k v r) c f \\<sigma> = (\n    if (c \\<sigma>) then\n      let \\<sigma>' = rm_reverse_iterateoi r c f \\<sigma> in\n        if (c \\<sigma>') then\n          rm_reverse_iterateoi l c f (f (k, v) \\<sigma>')\n        else \\<sigma>'\n    else \n      \\<sigma>\n  )\"\n\nlemma rm_reverse_iterateoi_abort :\n  \"\\<not>(c \\<sigma>) \\<Longrightarrow> rm_reverse_iterateoi t c f \\<sigma> = \\<sigma>\"\nby (cases t) auto\n\nlemma rm_reverse_iterateoi_alt_def :\n  \"rm_reverse_iterateoi RBT_Impl.Empty = set_iterator_emp\"\n  \"rm_reverse_iterateoi (RBT_Impl.Branch col l k v r) = \n   set_iterator_union (rm_reverse_iterateoi r)\n     (set_iterator_union (set_iterator_sng (k, v)) (rm_reverse_iterateoi l))\"\nby (simp_all add: fun_eq_iff set_iterator_emp_def rm_reverse_iterateoi_abort\n                  set_iterator_union_def set_iterator_sng_def Let_def)\ndeclare rm_reverse_iterateoi.simps[simp del]\n\n(*\nlemma finite_dom_lookup [simp, intro!]: \"finite (dom (RBT.lookup t))\"\nby(simp add: RBT.lookup_def)\n\n\ninstantiation rbt :: (\"{equal, linorder}\", equal) equal begin\n\ndefinition \"equal_class.equal (r :: ('a, 'b) rbt) r' == RBT.impl_of r = RBT.impl_of r'\"\n\ninstance\nproof\nqed (simp add: equal_rbt_def RBT.impl_of_inject)\n\nend\n*)\n\nlemma (in linorder) map_to_set_lookup_entries: \n   \"rbt_sorted t \\<Longrightarrow> map_to_set (rbt_lookup t) = set (RBT_Impl.entries t)\"\n  using map_of_entries[symmetric,of t]\n  by (simp add: distinct_entries map_to_set_map_of)\n\nlemma (in linorder) rm_iterateoi_correct:\n  fixes t::\"('a, 'v) RBT_Impl.rbt\"\n  assumes is_sort: \"rbt_sorted t\"\n  defines \"it \\<equiv> \n  RBT_add.rm_iterateoi::(('a, 'v) RBT_Impl.rbt \\<Rightarrow> ('a \\<times> 'v, '\\<sigma>) set_iterator)\"\n  shows \"map_iterator_linord (it t) (rbt_lookup t)\"\n  using is_sort\nproof (induct t)\n  case Empty\n  show ?case unfolding it_def \n    by (simp add: rm_iterateoi_alt_def \n      map_iterator_linord_emp_correct rbt_lookup_Empty)\nnext\n  case (Branch c l k v r)\n  note is_sort_t = Branch(3)\n\n  from Branch(1) is_sort_t have \n    l_it: \"map_iterator_linord (it l) (rbt_lookup l)\" by simp\n  from Branch(2) is_sort_t have \n    r_it: \"map_iterator_linord (it r) (rbt_lookup r)\" by simp\n  note kv_it = map_iterator_linord_sng_correct[of k v]\n\n  have kv_r_it : \"set_iterator_map_linord\n     (set_iterator_union (set_iterator_sng (k, v)) (it r))\n     (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup r))\"\n  proof (rule map_iterator_linord_union_correct [OF kv_it r_it])\n    fix kv kv'\n    assume pre: \"kv \\<in> map_to_set [k \\<mapsto> v]\" \"kv' \\<in> map_to_set (rbt_lookup r)\"\n    obtain k' v' where kv'_eq[simp]: \"kv' = (k', v')\" by (rule PairE)\n \n    from pre is_sort_t show \"fst kv < fst kv'\" \n      apply (simp add: map_to_set_lookup_entries split: prod.splits)\n      apply (metis entry_in_tree_keys rbt_greater_prop)\n      done\n  qed\n\n  have l_kv_r_it : \"set_iterator_map_linord (it (Branch c l k v r))\n     (map_to_set (rbt_lookup l) \n      \\<union> (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup r)))\"\n    unfolding it_def rm_iterateoi_alt_def\n    unfolding it_def[symmetric]\n  proof (rule map_iterator_linord_union_correct [OF l_it kv_r_it])\n    fix kv1 kv2\n    assume pre: \"kv1 \\<in> map_to_set (rbt_lookup l)\" \n                \"kv2 \\<in> map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup r)\" \n\n    obtain k1 v1 where kv1_eq[simp]: \"kv1 = (k1, v1)\" by (rule PairE)\n    obtain k2 v2 where kv2_eq[simp]: \"kv2 = (k2, v2)\" by (rule PairE)\n\n    from pre is_sort_t show \"fst kv1 < fst kv2\" \n      apply (simp add: map_to_set_lookup_entries split: prod.splits)\n      by (metis (lifting) map_of_entries neqE option.simps(3) \n        ord.rbt_lookup_rbt_greater ord.rbt_lookup_rbt_less rbt_greater_trans \n        rbt_less_trans weak_map_of_SomeI)\n  qed\n  \n  from is_sort_t\n  have map_eq: \"map_to_set (rbt_lookup l) \n    \\<union> (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup r)) =\n        map_to_set (rbt_lookup (Branch c l k v r))\" \n    by (simp add: set_eq_iff map_to_set_lookup_entries)\n  \n  from l_kv_r_it[unfolded map_eq]\n  show ?case .\nqed\n\nlemma (in linorder) rm_reverse_iterateoi_correct:\n  fixes t::\"('a, 'v) RBT_Impl.rbt\"\n  assumes is_sort: \"rbt_sorted t\"\n  defines \"it \\<equiv> RBT_add.rm_reverse_iterateoi\n    ::(('a, 'v) RBT_Impl.rbt \\<Rightarrow> ('a \\<times> 'v, '\\<sigma>) set_iterator)\"\n  shows \"map_iterator_rev_linord (it t) (rbt_lookup t)\"\n  using is_sort\nproof (induct t)\n  case Empty\n  show ?case unfolding it_def \n    by (simp add: rm_reverse_iterateoi_alt_def \n      map_iterator_rev_linord_emp_correct rbt_lookup_Empty)\nnext\n  case (Branch c l k v r)\n  note is_sort_t = Branch(3)\n\n  from Branch(1) is_sort_t have \n    l_it: \"map_iterator_rev_linord (it l) (rbt_lookup l)\" by simp\n  from Branch(2) is_sort_t have \n    r_it: \"map_iterator_rev_linord (it r) (rbt_lookup r)\" by simp\n  note kv_it = map_iterator_rev_linord_sng_correct[of k v]\n\n  have kv_l_it : \"set_iterator_map_rev_linord\n     (set_iterator_union (set_iterator_sng (k, v)) (it l))\n     (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup l))\"\n  proof (rule map_iterator_rev_linord_union_correct [OF kv_it l_it])\n    fix kv kv'\n    assume pre: \"kv \\<in> map_to_set [k \\<mapsto> v]\" \"kv' \\<in> map_to_set (rbt_lookup l)\"\n    obtain k' v' where kv'_eq[simp]: \"kv' = (k', v')\" by (rule PairE)\n \n    from pre is_sort_t show \"fst kv > fst kv'\" \n      apply (simp add: map_to_set_lookup_entries split: prod.splits)\n      apply (metis entry_in_tree_keys rbt_less_prop)\n   done\n  qed\n\n  have r_kv_l_it : \"set_iterator_map_rev_linord (it (Branch c l k v r))\n     (map_to_set (rbt_lookup r) \n      \\<union> (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup l)))\"\n    unfolding it_def rm_reverse_iterateoi_alt_def\n    unfolding it_def[symmetric]\n  proof (rule map_iterator_rev_linord_union_correct [OF r_it kv_l_it])\n    fix kv1 kv2\n    assume pre: \"kv1 \\<in> map_to_set (rbt_lookup r)\" \n                \"kv2 \\<in> map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup l)\" \n\n    obtain k1 v1 where kv1_eq[simp]: \"kv1 = (k1, v1)\" by (rule PairE)\n    obtain k2 v2 where kv2_eq[simp]: \"kv2 = (k2, v2)\" by (rule PairE)\n\n    from pre is_sort_t show \"fst kv1 > fst kv2\" \n      apply (simp add: map_to_set_lookup_entries split: prod.splits)\n      by (metis (mono_tags) entry_in_tree_keys neq_iff option.simps(3) \n        ord.rbt_greater_prop ord.rbt_lookup_rbt_less rbt_less_trans \n        rbt_lookup_in_tree)\n  qed\n  \n  from is_sort_t\n  have map_eq: \"map_to_set (rbt_lookup r) \n    \\<union> (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup l)) =\n        map_to_set (rbt_lookup (Branch c l k v r))\" \n    by (auto simp add: set_eq_iff map_to_set_lookup_entries)\n\n  from r_kv_l_it[unfolded map_eq]\n  show ?case .\nqed\n\nlemma pi_rm[icf_proper_iteratorI]: \n  \"proper_it (RBT_add.rm_iterateoi t) (RBT_add.rm_iterateoi t)\"\n  by (induct t) (simp_all add: rm_iterateoi_alt_def icf_proper_iteratorI)\n\nlemma pi_rm_rev[icf_proper_iteratorI]: \n  \"proper_it (RBT_add.rm_reverse_iterateoi t) (RBT_add.rm_reverse_iterateoi t)\"\n  by (induct t) (simp_all add: rm_reverse_iterateoi_alt_def \n    icf_proper_iteratorI)\n\nprimrec bheight_aux :: \"('a,'b) RBT_Impl.rbt \\<Rightarrow> nat \\<Rightarrow> nat\"\nwhere\n  \"\\<And>acc. bheight_aux RBT_Impl.Empty acc = acc\"\n| \"\\<And>acc. bheight_aux (RBT_Impl.Branch c lt k v rt) acc = \n     bheight_aux lt (case c of RBT_Impl.B \\<Rightarrow> Suc acc | RBT_Impl.R \\<Rightarrow> acc)\"\n\nlemma bheight_aux_eq: \"bheight_aux t a = bheight t + a\"\n  by (induct t arbitrary: a) (auto split: RBT_Impl.color.split)\n\ndefinition [code_unfold]: \"rbt_bheight t \\<equiv> bheight_aux t 0\"\nlemma \"rbt_bheight t = bheight t\"\n  unfolding rbt_bheight_def by (simp add: bheight_aux_eq)\n\n(*definition \"black_height t \\<equiv> rbt_bheight (RBT.impl_of t)\"*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/Lib/RBT_add.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5964331462646255, "lm_q1q2_score": 0.3421608175009801}}
{"text": "(* Title: Stream_Fusion_LList\n  Author: Andreas Lochbihler, ETH Zurich *)\n\nheader {* Stream fusion for coinductive lists *}\n\ntheory Stream_Fusion_LList imports\n  Stream_Fusion_List\n  \"../Coinductive/Coinductive_List\"\nbegin\n\ntext {*\n  There are two choices of how many @{const Skip}s may occur consecutively.\n  \\begin{itemize}\n  \\item A generator for @{typ \"'a llist\"} may return only finitely many @{const Skip}s before\n    it has to decide on a @{const Done} or @{const Yield}. Then, we can define stream versions\n    for all functions that can be defined by corecursion up-to. This in particular excludes\n    @{const lfilter}. Moreover, we have to prove that every generator satisfies this\n    restriction.\n  \\item A generator for @{typ \"'a llist\"} may return infinitely many @{const Skip}s in a row.\n    Then, the @{text lunstream} function suffers from the same difficulties as @{const lfilter} with\n    definitions, but we can define it using the least fixpoint approach described in\n    \\cite{LochbihlerHoelzl2014ITP}. Consequently, we can only fuse transformers that are monotone and\n    continuous with respect to the ccpo ordering. This in particular excludes @{const lappend}.\n  \\end{itemize}\n  Here, we take the both approaches where we consider the first preferable to the second.\n  Consequently, we define producers such that they produce generators of the first kind, if possible.\n  There will be multiple equations for transformers and consumers that deal with all the different\n  combinations for their parameter generators. Transformers should yield generators of the first\n  kind whenever possible. Consumers can be defined using @{text lunstream} and refined with custom\n  code equations, i.e., they can operate with infinitely many @{text Skip}s in a row. We just\n  have to lift the fusion equation to the first kind, too.\n*}\n\ntype_synonym ('a, 's) lgenerator = \"'s \\<Rightarrow> ('a, 's) step\"\n\ninductive_set productive_on :: \"('a, 's) lgenerator \\<Rightarrow> 's set\"\nfor g :: \"('a, 's) lgenerator\"\nwhere\n  Done: \"g s = Done \\<Longrightarrow> s \\<in> productive_on g\"\n| Skip: \"\\<lbrakk> g s = Skip s'; s' \\<in> productive_on g \\<rbrakk> \\<Longrightarrow> s \\<in> productive_on g\"\n| Yield: \"g s = Yield x s' \\<Longrightarrow> s \\<in> productive_on g\"\n\ndefinition productive :: \"('a, 's) lgenerator \\<Rightarrow> bool\"\nwhere \"productive g \\<longleftrightarrow> productive_on g = UNIV\"\n\nlemma productiveI [intro?]:\n  \"(\\<And>s. s \\<in> productive_on g) \\<Longrightarrow> productive g\"\nby(auto simp add: productive_def)\n\nlemma productive_onI [dest?]: \"productive g \\<Longrightarrow> s \\<in> productive_on g\"\nby(simp add: productive_def)\n\ntext {* A type of generators that eventually will yield something else than a skip. *}\n\ntypedef ('a, 's) lgenerator' = \"{g :: ('a, 's) lgenerator. productive g}\"\n  morphisms lgenerator Abs_lgenerator'\nproof\n  show \"(\\<lambda>_. Done) \\<in> ?lgenerator'\" by(auto intro: productive_on.intros productiveI)\nqed\n\nsetup_lifting type_definition_lgenerator'\n\nsection {* Conversions to @{typ \"'a llist\"} *}\n\nsubsection {* Infinitely many consecutive @{term Skip}s *}\n\ncontext fixes g :: \"('a, 's) lgenerator\" begin\n\npartial_function (llist) lunstream :: \"'s \\<Rightarrow> 'a llist\"\nwhere\n  \"lunstream s = (case g s of \n     Done \\<Rightarrow> LNil | Skip s' \\<Rightarrow> lunstream s' | Yield x s' \\<Rightarrow> LCons x (lunstream s'))\"\n\ndeclare lunstream.simps[code]\n\nlemma lunstream_simps:\n  \"g s = Done \\<Longrightarrow> lunstream s = LNil\"\n  \"g s = Skip s' \\<Longrightarrow> lunstream s = lunstream s'\"\n  \"g s = Yield x s' \\<Longrightarrow> lunstream s = LCons x (lunstream s')\"\nby(simp_all add: lunstream.simps)\n\nlemma lunstream_sels:\n  shows lnull_lunstream: \"lnull (lunstream s) \\<longleftrightarrow> \n  (case g s of Done \\<Rightarrow> True | Skip s' \\<Rightarrow> lnull (lunstream s') | Yield _ _ \\<Rightarrow> False)\"\n  and lhd_lunstream: \"lhd (lunstream s) =\n  (case g s of Skip s' \\<Rightarrow> lhd (lunstream s') | Yield x _ \\<Rightarrow> x)\"\n  and ltl_lunstream: \"ltl (lunstream s) =\n  (case g s of Done \\<Rightarrow> LNil | Skip s' \\<Rightarrow> ltl (lunstream s') | Yield _ s' \\<Rightarrow> lunstream s')\"\nby(simp_all add: lhd_def lunstream_simps split: step.split)\n\nend\n\nsubsection {* Finitely many consecutive @{term Skip}s *}\n\nlift_definition lunstream' :: \"('a, 's) lgenerator' \\<Rightarrow> 's \\<Rightarrow> 'a llist\"\nis lunstream .\n\nlemma lunstream'_simps:\n  \"lgenerator g s = Done \\<Longrightarrow> lunstream' g s = LNil\"\n  \"lgenerator g s = Skip s' \\<Longrightarrow> lunstream' g s = lunstream' g s'\"\n  \"lgenerator g s = Yield x s' \\<Longrightarrow> lunstream' g s = LCons x (lunstream' g s')\"\nby(transfer, simp add: lunstream_simps)+\n\nlemma lunstream'_sels:\n  shows lnull_lunstream': \"lnull (lunstream' g s) \\<longleftrightarrow> \n  (case lgenerator g s of Done \\<Rightarrow> True | Skip s' \\<Rightarrow> lnull (lunstream' g s') | Yield _ _ \\<Rightarrow> False)\"\n  and lhd_lunstream': \"lhd (lunstream' g s) =\n  (case lgenerator g s of Skip s' \\<Rightarrow> lhd (lunstream' g s') | Yield x _ \\<Rightarrow> x)\"\n  and ltl_lunstream': \"ltl (lunstream' g s) =\n  (case lgenerator g s of Done \\<Rightarrow> LNil | Skip s' \\<Rightarrow> ltl (lunstream' g s') | Yield _ s' \\<Rightarrow> lunstream' g s')\"\nby(transfer, simp add: lunstream_sels)+\n\nsetup {* Context.theory_map (fold\n  Stream_Fusion.add_unstream [@{const_name lunstream}, @{const_name lunstream'}]) *}\n\nsection {* Producers *}\n\nsubsection {* Conversion to streams *}\n\nfun lstream :: \"('a, 'a llist) lgenerator\"\nwhere\n  \"lstream LNil = Done\"\n| \"lstream (LCons x xs) = Yield x xs\"\n\nlemma case_lstream_conv_case_llist:\n  \"(case lstream xs of Done \\<Rightarrow> done | Skip xs' \\<Rightarrow> skip xs' | Yield x xs' \\<Rightarrow> yield x xs') =\n   (case xs of LNil \\<Rightarrow> done | LCons x xs' \\<Rightarrow> yield x xs')\"\nby(simp split: llist.split)\n\nlemma mcont2mcont_lunstream[THEN llist.mcont2mcont, simp, cont_intro]:\n  shows mcont_lunstream: \"mcont lSup lprefix lSup lprefix (lunstream lstream)\"\nby(rule llist.fixp_preserves_mcont1[OF lunstream.mono lunstream_def])(simp add: case_lstream_conv_case_llist)\n\nlemma lunstream_lstream: \"lunstream lstream xs = xs\"\nby(induction xs)(simp_all add: lunstream_simps)\n\nlift_definition lstream' :: \"('a, 'a llist) lgenerator'\"\nis lstream\nproof\n  fix s :: \"'a llist\"\n  show \"s \\<in> productive_on lstream\" by(cases s)(auto intro: productive_on.intros)\nqed\n\nlemma lunstream'_lstream: \"lunstream' lstream' xs = xs\"\nby(transfer)(rule lunstream_lstream)\n\nsubsection {* @{const iterates} *}\n\ndefinition iterates_raw :: \"('a \\<Rightarrow> 'a) \\<Rightarrow> ('a, 'a) lgenerator\"\nwhere \"iterates_raw f s = Yield s (f s)\"\n\nlemma lunstream_iterates_raw: \"lunstream (iterates_raw f) x = iterates f x\"\nby(coinduction arbitrary: x)(auto simp add: iterates_raw_def lunstream_sels)\n\nlift_definition iterates_prod :: \"('a \\<Rightarrow> 'a) \\<Rightarrow> ('a, 'a) lgenerator'\" is iterates_raw\nby(auto 4 3 intro: productiveI productive_on.intros simp add: iterates_raw_def)\n\nlemma lunstream'_iterates_prod [stream_fusion]: \"lunstream' (iterates_prod f) x = iterates f x\"\nby transfer(rule lunstream_iterates_raw)\n\nsubsection {* @{const unfold_llist} *}\n\ndefinition unfold_llist_raw :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'a) \\<Rightarrow> ('b, 'a) lgenerator\"\nwhere\n  \"unfold_llist_raw stop head tail s = (if stop s then Done else Yield (head s) (tail s))\"\n\nlemma lunstream_unfold_llist_raw:\n  \"lunstream (unfold_llist_raw stop head tail) s = unfold_llist stop head tail s\"\nby(coinduction arbitrary: s)(auto simp add: lunstream_sels unfold_llist_raw_def)\n\nlift_definition unfold_llist_prod :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'a) \\<Rightarrow> ('b, 'a) lgenerator'\"\nis unfold_llist_raw\nproof(rule productiveI)\n  fix stop and head :: \"'a \\<Rightarrow> 'b\" and tail s\n  show \"s \\<in> productive_on (unfold_llist_raw stop head tail)\"\n    by(cases \"stop s\")(auto intro: productive_on.intros simp add: unfold_llist_raw_def)\nqed\n\nlemma lunstream'_unfold_llist_prod [stream_fusion]:\n  \"lunstream' (unfold_llist_prod stop head tail) s = unfold_llist stop head tail s\"\nby transfer(rule lunstream_unfold_llist_raw)\n\nsubsection {* @{const inf_llist} *}\n\ndefinition inf_llist_raw :: \"(nat \\<Rightarrow> 'a) \\<Rightarrow> ('a, nat) lgenerator\"\nwhere \"inf_llist_raw f n = Yield (f n) (Suc n)\"\n\nlemma lunstream_inf_llist_raw: \"lunstream (inf_llist_raw f) n = ldropn n (inf_llist f)\"\nby(coinduction arbitrary: n)(auto simp add: lunstream_sels inf_llist_raw_def)\n\nlift_definition inf_llist_prod :: \"(nat \\<Rightarrow> 'a) \\<Rightarrow> ('a, nat) lgenerator'\" is inf_llist_raw\nby(auto 4 3 intro: productiveI productive_on.intros simp add: inf_llist_raw_def)\n\n\n\nsection {* Consumers *}\n\nsubsection {* @{const lhd} *}\n\ncontext fixes g :: \"('a, 's) lgenerator\" begin\n\ndefinition lhd_cons :: \"'s \\<Rightarrow> 'a\"\nwhere [stream_fusion]: \"lhd_cons s = lhd (lunstream g s)\"\n\nlemma lhd_cons_code[code]:\n  \"lhd_cons s = (case g s of Done \\<Rightarrow> undefined | Skip s' \\<Rightarrow> lhd_cons s' | Yield x _ \\<Rightarrow> x)\"\nby(simp add: lhd_cons_def lunstream_simps lhd_def split: step.split)\n\nend\n\nlemma lhd_cons_fusion2 [stream_fusion]:\n  \"lhd_cons (lgenerator g) s = lhd (lunstream' g s)\"\nby transfer(rule lhd_cons_def)\n\nsubsection {* @{const llength} *}\n\ncontext fixes g :: \"('a, 's) lgenerator\" begin\n\ndefinition gen_llength_cons :: \"enat \\<Rightarrow> 's \\<Rightarrow> enat\"\nwhere \"gen_llength_cons n s = n + llength (lunstream g s)\"\n\nlemma gen_llength_cons_code [code]:\n  \"gen_llength_cons n s = (case g s of\n    Done \\<Rightarrow> n | Skip s' \\<Rightarrow> gen_llength_cons n s' | Yield _ s' \\<Rightarrow> gen_llength_cons (eSuc n) s')\"\nby(simp add: gen_llength_cons_def lunstream_simps iadd_Suc_right iadd_Suc split: step.split)\n\nlemma gen_llength_cons_fusion [stream_fusion]:\n  \"gen_llength_cons 0 s = llength (lunstream g s)\"\nby(simp add: gen_llength_cons_def)\n\nend\n\ncontext fixes g :: \"('a, 's) lgenerator'\" begin\n\ndefinition gen_llength_cons' :: \"enat \\<Rightarrow> 's \\<Rightarrow> enat\"\nwhere \"gen_llength_cons' = gen_llength_cons (lgenerator g)\"\n\nlemma gen_llength_cons'_code [code]:\n  \"gen_llength_cons' n s = (case lgenerator g s of\n    Done \\<Rightarrow> n | Skip s' \\<Rightarrow> gen_llength_cons' n s' | Yield _ s' \\<Rightarrow> gen_llength_cons' (eSuc n) s')\"\nby(simp add: gen_llength_cons'_def cong: step.case_cong)(rule gen_llength_cons_code)\n\nlemma gen_llength_cons'_fusion [stream_fusion]:\n  \"gen_llength_cons' 0 s = llength (lunstream' g s)\"\nby(simp add: gen_llength_cons'_def gen_llength_cons_fusion lunstream'.rep_eq)\n\nend\n\nsubsection {* @{const lnull} *}\n\ncontext fixes g :: \"('a, 's) lgenerator\" begin\n\ndefinition lnull_cons :: \"'s \\<Rightarrow> bool\"\nwhere [stream_fusion]: \"lnull_cons s \\<longleftrightarrow> lnull (lunstream g s)\"\n\nlemma lnull_cons_code [code]:\n  \"lnull_cons s \\<longleftrightarrow> (case g s of\n    Done \\<Rightarrow> True | Skip s' \\<Rightarrow> lnull_cons s' | Yield _ _ \\<Rightarrow> False)\"\nby(simp add: lnull_cons_def lunstream_simps split: step.split)\n\nend\n\ncontext fixes g :: \"('a, 's) lgenerator'\" begin\n\ndefinition lnull_cons' :: \"'s \\<Rightarrow> bool\"\nwhere \"lnull_cons' = lnull_cons (lgenerator g)\"\n\nlemma lnull_cons'_code [code]:\n  \"lnull_cons' s \\<longleftrightarrow> (case lgenerator g s of\n    Done \\<Rightarrow> True | Skip s' \\<Rightarrow> lnull_cons' s' | Yield _ _ \\<Rightarrow> False)\"\nby(simp add: lnull_cons'_def cong: step.case_cong)(rule lnull_cons_code)\n\nlemma lnull_cons'_fusion [stream_fusion]:\n  \"lnull_cons' s \\<longleftrightarrow> lnull (lunstream' g s)\"\nby(simp add: lnull_cons'_def lnull_cons_def lunstream'.rep_eq)\n\nend\n\nsubsection {* @{const llist_all2} *}\n\ncontext\n  fixes g :: \"('a, 'sg) lgenerator\"\n  and h :: \"('b, 'sh) lgenerator\"\n  and P :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\"\nbegin\n\ndefinition llist_all2_cons :: \"'sg \\<Rightarrow> 'sh \\<Rightarrow> bool\"\nwhere [stream_fusion]: \"llist_all2_cons sg sh \\<longleftrightarrow> llist_all2 P (lunstream g sg) (lunstream h sh)\"\n\ndefinition llist_all2_cons1 :: \"'a \\<Rightarrow> 'sg \\<Rightarrow> 'sh \\<Rightarrow> bool\"\nwhere \"llist_all2_cons1 x sg' sh = llist_all2 P (LCons x (lunstream g sg')) (lunstream h sh)\"\n\nlemma llist_all2_cons_code [code]:\n  \"llist_all2_cons sg sh = \n  (case g sg of\n     Done \\<Rightarrow> lnull_cons h sh\n   | Skip sg' \\<Rightarrow> llist_all2_cons sg' sh\n   | Yield a sg' \\<Rightarrow> llist_all2_cons1 a sg' sh)\"\nby(simp split: step.split add: llist_all2_cons_def lnull_cons_def llist_all2_cons1_def lunstream_simps lnull_def)\n\nlemma llist_all2_cons1_code [code]:\n  \"llist_all2_cons1 x sg' sh = \n  (case h sh of\n     Done \\<Rightarrow> False\n   | Skip sh' \\<Rightarrow> llist_all2_cons1 x sg' sh'\n   | Yield y sh' \\<Rightarrow> P x y \\<and> llist_all2_cons sg' sh')\"\nby(simp split: step.split add: llist_all2_cons_def lnull_cons_def lnull_def llist_all2_cons1_def lunstream_simps)\n\nend\n\nlemma llist_all2_cons_fusion2 [stream_fusion]:\n  \"llist_all2_cons (lgenerator g) (lgenerator h) P sg sh \\<longleftrightarrow> llist_all2 P (lunstream' g sg) (lunstream' h sh)\"\nby transfer(rule llist_all2_cons_def)\n\nlemma llist_all2_cons_fusion3 [stream_fusion]:\n  \"llist_all2_cons g (lgenerator h) P sg sh \\<longleftrightarrow> llist_all2 P (lunstream g sg) (lunstream' h sh)\"\nby transfer(rule llist_all2_cons_def)\n\nlemma llist_all2_cons_fusion4 [stream_fusion]:\n  \"llist_all2_cons (lgenerator g) h P sg sh \\<longleftrightarrow> llist_all2 P (lunstream' g sg) (lunstream h sh)\"\nby transfer(rule llist_all2_cons_def)\n\nsubsection {* @{const lnth} *}\n\ncontext fixes g :: \"('a, 's) lgenerator\" begin\n\ndefinition lnth_cons :: \"nat \\<Rightarrow> 's \\<Rightarrow> 'a\"\nwhere [stream_fusion]: \"lnth_cons n s = lnth (lunstream g s) n\"\n\nlemma lnth_cons_code [code]:\n  \"lnth_cons n s = (case g s of\n    Done \\<Rightarrow> undefined n\n  | Skip s' \\<Rightarrow> lnth_cons n s'\n  | Yield x s' \\<Rightarrow> (if n = 0 then x else lnth_cons (n - 1) s'))\"\nby(cases n)(simp_all add: lnth_cons_def lunstream_simps lnth_LNil split: step.split)\n\nend\n\n\n\nsubsection {* @{const lprefix} *}\n\ncontext\n  fixes g :: \"('a, 'sg) lgenerator\"\n  and h :: \"('a, 'sh) lgenerator\"\nbegin\n\ndefinition lprefix_cons :: \"'sg \\<Rightarrow> 'sh \\<Rightarrow> bool\"\nwhere [stream_fusion]: \"lprefix_cons sg sh \\<longleftrightarrow> lprefix (lunstream g sg) (lunstream h sh)\"\n\ndefinition lprefix_cons1 :: \"'a \\<Rightarrow> 'sg \\<Rightarrow> 'sh \\<Rightarrow> bool\"\nwhere \"lprefix_cons1 x sg' sh \\<longleftrightarrow> lprefix (LCons x (lunstream g sg')) (lunstream h sh)\"\n\nlemma lprefix_cons_code [code]:\n  \"lprefix_cons sg sh \\<longleftrightarrow> (case g sg of\n     Done \\<Rightarrow> True | Skip sg' \\<Rightarrow> lprefix_cons sg' sh | Yield x sg' \\<Rightarrow> lprefix_cons1 x sg' sh)\"\nby(simp add: lprefix_cons_def lprefix_cons1_def lunstream_simps split: step.split)\n\nlemma lprefix_cons1_code [code]:\n  \"lprefix_cons1 x sg' sh \\<longleftrightarrow> (case h sh of\n     Done \\<Rightarrow> False | Skip sh' \\<Rightarrow> lprefix_cons1 x sg' sh'\n   | Yield y sh' \\<Rightarrow> x = y \\<and> lprefix_cons sg' sh')\"\nby(simp add: lprefix_cons_def lprefix_cons1_def lunstream_simps split: step.split)\n\nend\n\nlemma lprefix_cons_fusion2 [stream_fusion]:\n  \"lprefix_cons (lgenerator g) (lgenerator h) sg sh \\<longleftrightarrow> lprefix (lunstream' g sg) (lunstream' h sh)\"\nby transfer(rule lprefix_cons_def)\n\nlemma lprefix_cons_fusion3 [stream_fusion]:\n  \"lprefix_cons g (lgenerator h) sg sh \\<longleftrightarrow> lprefix (lunstream g sg) (lunstream' h sh)\"\nby transfer(rule lprefix_cons_def)\n\nlemma lprefix_cons_fusion4 [stream_fusion]:\n  \"lprefix_cons (lgenerator g) h sg sh \\<longleftrightarrow> lprefix (lunstream' g sg) (lunstream h sh)\"\nby transfer(rule lprefix_cons_def)\n\nsection {* Transformers *}\n\nsubsection {* @{const lmap} *}\n\ndefinition lmap_trans :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('a, 's) lgenerator \\<Rightarrow> ('b, 's) lgenerator\"\nwhere \"lmap_trans = map_raw\"\n\nlemma lunstream_lmap_trans [stream_fusion]: fixes f g s\n  defines [simp]: \"g' \\<equiv> lmap_trans f g\"\n  shows \"lunstream g' s = lmap f (lunstream g s)\" (is \"?lhs = ?rhs\")\nproof(rule lprefix_antisym)\n  show \"lprefix ?lhs ?rhs\"\n  proof(induction g' arbitrary: s rule: lunstream.fixp_induct) \n    case (3 lunstream_g')\n    then show ?case\n      by(cases \"g s\")(simp_all add: lmap_trans_def map_raw_def lunstream_simps)\n  qed simp_all\nnext\n  note [cont_intro] = ccpo.admissible_leI[OF llist_ccpo]\n  show \"lprefix ?rhs ?lhs\"\n  proof(induction g arbitrary: s rule: lunstream.fixp_induct) \n    case (3 lunstream_g)\n    thus ?case by(cases \"g s\")(simp_all add: lmap_trans_def map_raw_def lunstream_simps)\n  qed simp_all\nqed\n\nlift_definition lmap_trans' :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('a, 's) lgenerator' \\<Rightarrow> ('b, 's) lgenerator'\"\nis lmap_trans\nproof\n  fix f :: \"'a \\<Rightarrow> 'b\" and g :: \"('a, 's) lgenerator\" and s\n  assume \"productive g\"\n  hence \"s \\<in> productive_on g\" ..\n  thus \"s \\<in> productive_on (lmap_trans f g)\"\n    by induction(auto simp add: lmap_trans_def map_raw_def intro: productive_on.intros)\nqed\n\nlemma lunstream'_lmap_trans' [stream_fusion]:\n  \"lunstream' (lmap_trans' f g) s = lmap f (lunstream' g s)\"\nby transfer(rule lunstream_lmap_trans)\n\nsubsection {* @{const ltake} *}\n\nfun ltake_trans :: \"('a, 's) lgenerator \\<Rightarrow> ('a, (enat \\<times> 's)) lgenerator\"\nwhere\n  \"ltake_trans g (n, s) =\n  (if n = 0 then Done else case g s of \n    Done \\<Rightarrow> Done | Skip s' \\<Rightarrow> Skip (n, s') | Yield a s' \\<Rightarrow> Yield a (epred n, s'))\"\n\nlemma ltake_trans_fusion [stream_fusion]:\n  fixes g' g\n  defines [simp]: \"g' \\<equiv> ltake_trans g\"\n  shows \"lunstream g' (n, s) = ltake n (lunstream g s)\" (is \"?lhs = ?rhs\")\nproof(rule lprefix_antisym)\n  show \"lprefix ?lhs ?rhs\"\n  proof(induction g' arbitrary: n s rule: lunstream.fixp_induct)\n    case (3 lunstream_g')\n    thus ?case\n      by(cases \"g s\")(auto simp add: lunstream_simps neq_zero_conv_eSuc)\n  qed simp_all\n  show \"lprefix ?rhs ?lhs\"\n  proof(induction g arbitrary: s n rule: lunstream.fixp_induct)\n    case (3 lunstream_g)\n    thus ?case by(cases \"g s\" n rule: step.exhaust[case_product enat_coexhaust])(auto simp add: lunstream_simps)\n  qed simp_all\nqed\n\nlift_definition ltake_trans' :: \"('a, 's) lgenerator' \\<Rightarrow> ('a, (enat \\<times> 's)) lgenerator'\"\nis \"ltake_trans\"\nproof\n  fix g :: \"('a, 's) lgenerator\" and s :: \"enat \\<times> 's\"\n  obtain n sg where s: \"s = (n, sg)\" by(cases s)\n  assume \"productive g\"\n  hence \"sg \\<in> productive_on g\" ..\n  then show \"s \\<in> productive_on (ltake_trans g)\" unfolding \\<open>s = (n, sg)\\<close>\n    apply(induction arbitrary: n)\n    apply(case_tac [!] n rule: enat_coexhaust)\n    apply(auto intro: productive_on.intros)\n    done\nqed\n\nlemma ltake_trans'_fusion [stream_fusion]:\n  \"lunstream' (ltake_trans' g) (n, s) = ltake n (lunstream' g s)\"\nby transfer(rule ltake_trans_fusion)\n\nsubsection {* @{const ldropn} *}\n\nabbreviation (input) ldropn_trans :: \"('b, 'a) lgenerator \\<Rightarrow> ('b, nat \\<times> 'a) lgenerator\"\nwhere \"ldropn_trans \\<equiv> drop_raw\"\n\nlemma ldropn_trans_fusion [stream_fusion]:\n  fixes g defines [simp]: \"g' \\<equiv> ldropn_trans g\"\n  shows \"lunstream g' (n, s) = ldropn n (lunstream g s)\" (is \"?lhs = ?rhs\")\nproof(rule lprefix_antisym)\n  show \"lprefix ?lhs ?rhs\"\n  proof(induction g' arbitrary: n s rule: lunstream.fixp_induct)\n    case (3 lunstream_g')\n    thus ?case\n      by(cases \"g s\" n rule: step.exhaust[case_product nat.exhaust])\n        (auto simp add: lunstream_simps elim: meta_allE[where x=0])\n  qed simp_all\n  note [cont_intro] = ccpo.admissible_leI[OF llist_ccpo]\n  show \"lprefix ?rhs ?lhs\"\n  proof(induction g arbitrary: n s rule: lunstream.fixp_induct)\n    case (3 lunstream_g)\n    thus ?case by(cases n)(auto split: step.split simp add: lunstream_simps elim: meta_allE[where x=0])\n  qed simp_all\nqed\n\nlift_definition ldropn_trans' :: \"('a, 's) lgenerator' \\<Rightarrow> ('a, nat \\<times> 's) lgenerator'\"\nis ldropn_trans\nproof\n  fix g :: \"('a, 's) lgenerator\" and ns :: \"nat \\<times> 's\"\n  obtain n s where ns: \"ns = (n, s)\" by(cases ns)\n  assume g: \"productive g\"\n  show \"ns \\<in> productive_on (ldropn_trans g)\" unfolding ns\n  proof(induction n arbitrary: s)\n    case 0\n    from g have \"s \\<in> productive_on g\" ..\n    thus ?case by induction(auto intro: productive_on.intros)\n  next\n    case (Suc n)\n    from g have \"s \\<in> productive_on g\" ..\n    thus ?case by induction(auto intro: productive_on.intros Suc.IH)\n  qed\nqed\n\nlemma ldropn_trans'_fusion [stream_fusion]:\n  \"lunstream' (ldropn_trans' g) (n, s) = ldropn n (lunstream' g s)\"\nby transfer(rule ldropn_trans_fusion)\n\nsubsection {* @{const ldrop} *}\n\nfun ldrop_trans :: \"('a, 's) lgenerator \\<Rightarrow> ('a, enat \\<times> 's) lgenerator\"\nwhere\n  \"ldrop_trans g (n, s) = (case g s of \n    Done \\<Rightarrow> Done | Skip s' \\<Rightarrow> Skip (n, s')\n  | Yield x s' \\<Rightarrow> (if n = 0 then Yield x (n, s') else Skip (epred n, s')))\"\n\nlemma ldrop_trans_fusion [stream_fusion]:\n  fixes g g' defines [simp]: \"g' \\<equiv> ldrop_trans g\"\n  shows \"lunstream g' (n, s) = ldrop n (lunstream g s)\" (is \"?lhs = ?rhs\")\nproof(rule lprefix_antisym)\n  show \"lprefix ?lhs ?rhs\"\n    by(induction g' arbitrary: n s rule: lunstream.fixp_induct)\n      (auto simp add: lunstream_simps neq_zero_conv_eSuc elim: meta_allE[where x=0] split: step.split)\n  show \"lprefix ?rhs ?lhs\"\n  proof(induction g arbitrary: n s rule: lunstream.fixp_induct)\n    case (3 lunstream_g)\n    thus ?case\n      by(cases n rule: enat_coexhaust)(auto simp add: lunstream_simps split: step.split elim: meta_allE[where x=0])\n  qed simp_all\nqed\n\nlemma ldrop_trans_fusion2 [stream_fusion]:\n  \"lunstream (ldrop_trans (lgenerator g)) (n, s) = ldrop n (lunstream' g s)\"\nby transfer (rule ldrop_trans_fusion)\n\nsubsection {* @{const ltakeWhile} *}\n\nabbreviation (input) ltakeWhile_trans :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a, 's) lgenerator \\<Rightarrow> ('a, 's) lgenerator\"\nwhere \"ltakeWhile_trans \\<equiv> takeWhile_raw\"\n\nlemma ltakeWhile_trans_fusion [stream_fusion]:\n  fixes P g g' defines [simp]: \"g' \\<equiv> ltakeWhile_trans P g\"\n  shows \"lunstream g' s = ltakeWhile P (lunstream g s)\" (is \"?lhs = ?rhs\")\nproof(rule lprefix_antisym)\n  show \"lprefix ?lhs ?rhs\"\n    by(induction g' arbitrary: s rule: lunstream.fixp_induct)(auto simp add: lunstream_simps takeWhile_raw_def split: step.split)\n  show \"lprefix ?rhs ?lhs\"\n    by(induction g arbitrary: s rule: lunstream.fixp_induct)(auto split: step.split simp add: lunstream_simps takeWhile_raw_def)\nqed\n\nlift_definition ltakeWhile_trans' :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a, 's) lgenerator' \\<Rightarrow> ('a, 's) lgenerator'\"\nis ltakeWhile_trans\nproof\n  fix P and g :: \"('a, 's) lgenerator\" and s\n  assume \"productive g\"\n  hence \"s \\<in> productive_on g\" ..\n  thus \"s \\<in> productive_on (ltakeWhile_trans P g)\"\n    apply(induction)\n    apply(case_tac [3] \"P x\")\n    apply(auto intro: productive_on.intros simp add: takeWhile_raw_def)\n    done\nqed\n\nlemma ltakeWhile_trans'_fusion [stream_fusion]:\n  \"lunstream' (ltakeWhile_trans' P g) s = ltakeWhile P (lunstream' g s)\"\nby transfer(rule ltakeWhile_trans_fusion)\n\nsubsection {* @{const ldropWhile} *}\n\nabbreviation (input) ldropWhile_trans :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a, 'b) lgenerator \\<Rightarrow> ('a, bool \\<times> 'b) lgenerator\"\nwhere \"ldropWhile_trans \\<equiv> dropWhile_raw\"\n\nlemma ldropWhile_trans_fusion [stream_fusion]:\n  fixes P g g' defines [simp]: \"g' \\<equiv> ldropWhile_trans P g\"\n  shows \"lunstream g' (True, s) = ldropWhile P (lunstream g s)\" (is \"?lhs = ?rhs\")\nproof -\n  have \"lprefix ?lhs ?rhs\" \"lprefix (lunstream g' (False, s)) (lunstream g s)\"\n    by(induction g' arbitrary: s rule: lunstream.fixp_induct)(simp_all add: lunstream_simps split: step.split)\n  moreover have \"lprefix ?rhs ?lhs\" \"lprefix (lunstream g s) (lunstream g' (False, s))\"\n    by(induction g arbitrary: s rule: lunstream.fixp_induct)(simp_all add: lunstream_simps split: step.split)\n  ultimately show ?thesis by(blast intro: lprefix_antisym)\nqed\n\nlemma ldropWhile_trans_fusion2 [stream_fusion]:\n  \"lunstream (ldropWhile_trans P (lgenerator g)) (True, s) = ldropWhile P (lunstream' g s)\"\nby transfer(rule ldropWhile_trans_fusion)\n\nsubsection {* @{const lzip} *}\n\nabbreviation (input) lzip_trans :: \"('a, 's1) lgenerator \\<Rightarrow> ('b, 's2) lgenerator \\<Rightarrow> ('a \\<times> 'b, 's1 \\<times> 's2 \\<times> 'a option) lgenerator\"\nwhere \"lzip_trans \\<equiv> zip_raw\"\n\nlemma lzip_trans_fusion [stream_fusion]:\n  fixes g h gh defines [simp]: \"gh \\<equiv> lzip_trans g h\"\n  shows \"lunstream gh (sg, sh, None) = lzip (lunstream g sg) (lunstream h sh)\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"lprefix ?lhs ?rhs\"\n    and \"\\<And>x. lprefix (lunstream gh (sg, sh, Some x)) (lzip (LCons x (lunstream g sg)) (lunstream h sh))\"\n  proof(induction gh arbitrary: sg sh rule: lunstream.fixp_induct) \n    case (3 lunstream)\n    { case 1 show ?case using 3\n        by(cases \"g sg\")(simp_all add: lunstream_simps) }\n    { case 2 show ?case using 3\n        by(cases \"h sh\")(simp_all add: lunstream_simps) }\n  qed simp_all\n  moreover\n  note [cont_intro] = ccpo.admissible_leI[OF llist_ccpo]\n  have \"lprefix ?rhs ?lhs\" \n    and \"\\<And>x. lprefix (lzip (LCons x (lunstream g sg)) (lunstream h sh)) (lunstream gh (sg, sh, Some x))\"\n  proof(induction g arbitrary: sg sh rule: lunstream.fixp_induct)\n    case (3 lunstream_g)\n    note IH = \"3.IH\"\n    { case 1 show ?case using 3\n        by(cases \"g sg\")(simp_all add: lunstream_simps fun_ord_def) }\n    { case 2 show ?case\n      proof(induction h arbitrary: sh sg x rule: lunstream.fixp_induct)\n        case (3 unstream_h)\n        thus ?case\n        proof(cases \"h sh\")\n          case (Yield y sh')\n          thus ?thesis using \"3.prems\" IH \"3.hyps\"\n            by(cases \"g sg\")(auto 4 3 simp add: lunstream_simps fun_ord_def intro: monotone_lzip2[THEN monotoneD] lprefix_trans)\n        qed(simp_all add: lunstream_simps)\n      qed simp_all }\n  next\n    case 2 case 2\n    show ?case\n      by(induction h arbitrary: sh rule: lunstream.fixp_induct)(simp_all add: lunstream_simps split: step.split)\n  qed simp_all\n  ultimately show ?thesis by(blast intro: lprefix_antisym)\nqed\n\nlemma lzip_trans_fusion2 [stream_fusion]:\n  \"lunstream (lzip_trans (lgenerator g) h) (sg, sh, None) = lzip (lunstream' g sg) (lunstream h sh)\"\nby transfer(rule lzip_trans_fusion)\n\nlemma lzip_trans_fusion3 [stream_fusion]:\n  \"lunstream (lzip_trans g (lgenerator h)) (sg, sh, None) = lzip (lunstream g sg) (lunstream' h sh)\"\nby transfer(rule lzip_trans_fusion)\n\nlift_definition lzip_trans' :: \"('a, 's1) lgenerator' \\<Rightarrow> ('b, 's2) lgenerator' \\<Rightarrow> ('a \\<times> 'b, 's1 \\<times> 's2 \\<times> 'a option) lgenerator'\"\nis \"lzip_trans\"\nproof\n  fix g :: \"('a, 's1) lgenerator\" and h :: \"('b, 's2) lgenerator\" and s :: \"'s1 \\<times> 's2 \\<times> 'a option\"\n  assume \"productive g\" and \"productive h\"\n  obtain sg sh mx where s: \"s = (sg, sh, mx)\" by(cases s)\n  { fix x sg\n    from \\<open>productive h\\<close> have \"sh \\<in> productive_on h\" ..\n    hence \"(sg, sh, Some x) \\<in> productive_on (lzip_trans g h)\"\n      by(induction)(auto simp add: intro: productive_on.intros) }\n  moreover\n  from \\<open>productive g\\<close> have \"sg \\<in> productive_on g\" ..\n  then have \"(sg, sh, None) \\<in> productive_on (lzip_trans g h)\"\n    by induction(auto intro: productive_on.intros calculation)\n  ultimately show \"s \\<in> productive_on (lzip_trans g h)\" unfolding s\n    by(cases mx) auto\nqed\n\nlemma lzip_trans'_fusion [stream_fusion]:\n  \"lunstream' (lzip_trans' g h) (sg, sh, None) = lzip (lunstream' g sg) (lunstream' h sh)\"\nby transfer(rule lzip_trans_fusion)\n\nsubsection {* @{const lappend} *}\n\nlift_definition lappend_trans :: \"('a, 'sg) lgenerator' \\<Rightarrow> ('a, 'sh) lgenerator \\<Rightarrow> 'sh \\<Rightarrow> ('a, 'sg + 'sh) lgenerator\"\nis append_raw .\n\nlemma lunstream_append_raw:\n  fixes g h sh gh defines [simp]: \"gh \\<equiv> append_raw g h sh\"\n  assumes \"productive g\"\n  shows \"lunstream gh (Inl sg) = lappend (lunstream g sg) (lunstream h sh)\"\nproof(coinduction arbitrary: sg rule: llist.coinduct_strong)\n  case (Eq_llist sg)\n  { fix sh'\n    have \"lprefix (lunstream gh (Inr sh')) (lunstream h sh')\"\n      by(induction gh arbitrary: sh' rule: lunstream.fixp_induct)(simp_all add: lunstream_simps split: step.split)\n    moreover have \"lprefix (lunstream h sh') (lunstream gh (Inr sh'))\"\n      by(induction h arbitrary: sh' rule: lunstream.fixp_induct)(simp_all add: lunstream_simps split: step.split)\n    ultimately have \"lunstream gh (Inr sh') = lunstream h sh'\"\n      by(blast intro: lprefix_antisym) }\n  note Inr = this[unfolded gh_def]\n  from \\<open>productive g\\<close> have sg: \"sg \\<in> productive_on g\" ..\n  then show ?case by induction(auto simp add: lunstream_sels Inr)\nqed\n\nlemma lappend_trans_fusion [stream_fusion]:\n  \"lunstream (lappend_trans g h sh) (Inl sg) = lappend (lunstream' g sg) (lunstream h sh)\"\nby transfer(rule lunstream_append_raw)\n\nlift_definition lappend_trans' :: \"('a, 'sg) lgenerator' \\<Rightarrow> ('a, 'sh) lgenerator' \\<Rightarrow> 'sh \\<Rightarrow> ('a, 'sg + 'sh) lgenerator'\"\nis append_raw\nproof\n  fix g :: \"('a, 'sg) lgenerator\" and h :: \"('a, 'sh) lgenerator\" and sh s\n  assume \"productive g\" \"productive h\"\n  { fix sh'\n    from \\<open>productive h\\<close> have \"sh' \\<in> productive_on h\" ..\n    then have \"Inr sh' \\<in> productive_on (append_raw g h sh)\"\n      by induction (auto intro: productive_on.intros)\n  } moreover {\n    fix sg\n    from \\<open>productive g\\<close> have \"sg \\<in> productive_on g\" ..\n    then have \"Inl sg \\<in> productive_on (append_raw g h sh)\"\n      by induction(auto intro: productive_on.intros calculation) }\n  ultimately show \"s \\<in> productive_on (append_raw g h sh)\" by(cases s) auto\nqed\n\nlemma lappend_trans'_fusion [stream_fusion]:\n  \"lunstream' (lappend_trans' g h sh) (Inl sg) = lappend (lunstream' g sg) (lunstream' h sh)\"\nby transfer(rule lunstream_append_raw)\n\nsubsection {* @{const lfilter} *}\n\ndefinition lfilter_trans :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a, 's) lgenerator \\<Rightarrow> ('a, 's) lgenerator\"\nwhere \"lfilter_trans = filter_raw\"\n\nlemma lunstream_lfilter_trans [stream_fusion]:\n  fixes P g g' defines [simp]: \"g' \\<equiv> lfilter_trans P g\"\n  shows \"lunstream g' s = lfilter P (lunstream g s)\" (is \"?lhs = ?rhs\")\nproof(rule lprefix_antisym)\n  show \"lprefix ?lhs ?rhs\"\n    by(induction g' arbitrary: s rule: lunstream.fixp_induct)\n      (simp_all add: lfilter_trans_def filter_raw_def lunstream_simps split: step.split)\n  show \"lprefix ?rhs ?lhs\"\n  by(induction g arbitrary: s rule: lunstream.fixp_induct) \n    (simp_all add: lfilter_trans_def filter_raw_def lunstream_simps split: step.split)\nqed\n\nlemma lunstream_lfilter_trans2 [stream_fusion]:\n  \"lunstream (lfilter_trans P (lgenerator g)) s = lfilter P (lunstream' g s)\"\nby transfer(rule lunstream_lfilter_trans)\n\nsubsection {* @{const llist_of} *}\n\nlift_definition llist_of_trans :: \"('a, 's) generator \\<Rightarrow> ('a, 's) lgenerator'\"\nis \"\\<lambda>x. x\"\nproof\n  fix g :: \"('a, 's) raw_generator\" and s\n  assume \"terminates g\"\n  hence \"s \\<in> terminates_on g\" by(simp add: terminates_def)\n  then show \"s \\<in> productive_on g\"\n    by(induction)(auto intro: productive_on.intros)\nqed\n\nlemma lunstream_llist_of_trans [stream_fusion]:\n  \"lunstream' (llist_of_trans g) s = llist_of (unstream g s)\"\napply(induction s taking: g rule: unstream.induct)\napply(rule llist.expand)\napply(auto intro: llist.expand simp add: llist_of_trans.rep_eq lunstream_sels lunstream'.rep_eq split: step.split)\ndone\n\ntext {* We cannot define a stream version of @{const list_of} because we would have to test\n  for finiteness first and therefore traverse the list twice. *}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Stream_Fusion_Code/Stream_Fusion_LList.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331319177488, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.34216080927048675}}
{"text": "theory UnionFind_Intf\nimports  \"SeprefTime.Sepref\" UnionFind  \nbegin\n\nsection \"Union find Implementation\"\n\nsubsection \"MOP interface\"\n\ncontext\n  fixes t ::  \"nat \\<Rightarrow> nat\"\nbegin\n\n  definition \"mop_per_init n = SPECT [ per_init' n \\<mapsto> enat (t n) ]\"\n\n  lemma progress_mop_per_init[progress_rules]: \"t n > 0 \\<Longrightarrow> progress (mop_per_init n)\"\n    unfolding mop_per_init_def by (auto intro!: progress_rules simp add:   zero_enat_def) \n\n  lemma mop_per_init: \"tt \\<le> lst (SPECT [ per_init' n \\<mapsto> t n]) Q \\<Longrightarrow> tt\n           \\<le> lst (mop_per_init n) Q\" unfolding mop_per_init_def by simp\n\n  sepref_register \"mop_per_init\" \nend\n\ncontext\n  fixes t ::  \"('a \\<times> 'a) set \\<Rightarrow> nat\"\nbegin\n\n  definition \"mop_per_compare R a b = SPECT [ per_compare R a b \\<mapsto> enat (t R) ]\"\n\n  sepref_register \"mop_per_compare\" \nend\n\ncontext\n  fixes t ::  \"('a \\<times> 'a) set \\<Rightarrow> nat\"\nbegin\n\n  definition \"mop_per_union R a b = SPECT [ per_union R a b \\<mapsto> enat (t R) ]\"\n\n  sepref_register \"mop_per_union\" \nend\n\n\n\nsubsection \"Implementation Locale\"\n\n\ntype_synonym uf = \"nat array \\<times> nat array\"\n\nlocale UnionFind_Impl = \n  fixes is_uf :: \"(nat\\<times>nat) set \\<Rightarrow> uf \\<Rightarrow> assn\"\n      and uf_init :: \"nat \\<Rightarrow> uf Heap\"\n      and uf_init_time :: \"nat \\<Rightarrow> nat\"\n      and uf_cmp :: \"uf \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool Heap\"\n      and uf_cmp_time :: \"nat \\<Rightarrow> nat\"\n      and uf_union :: \"uf \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> uf Heap\"\n      and uf_union_time :: \"nat \\<Rightarrow> nat\"\n    assumes \nper_init'_sepref_rule[sepref_fr_rules]:  \"\\<And>t x' x. uf_init_time x' \\<le> t x' \\<Longrightarrow>\n     hn_refine (hn_ctxt nat_assn x' x) (uf_init x)\n         (hn_ctxt nat_assn x' x)  \n             is_uf (PR_CONST (mop_per_init t) $  x' )\" \n\n  and\n\nper_compare_sepref_rule[sepref_fr_rules]:  \"\\<And>t R' R a' a b' b . uf_cmp_time (card (Domain R')) \\<le> t R' \\<Longrightarrow>\n     hn_refine (hn_ctxt is_uf R' R * hn_ctxt nat_assn a' a * hn_ctxt nat_assn b' b) (uf_cmp R a b)\n         (hn_ctxt is_uf R' R * hn_ctxt nat_assn a' a * hn_ctxt nat_assn b' b) \n             bool_assn (PR_CONST (mop_per_compare t) $  R' $ a' $ b' )\" \n\n  and\n\nper_union_sepref_rule[sepref_fr_rules]:  \"\\<And>t R' R a' a b' b . a' \\<in> Domain R' \\<Longrightarrow> b' \\<in> Domain R'\n  \\<Longrightarrow> uf_union_time (card (Domain R')) \\<le> t R' \\<Longrightarrow> \n     hn_refine (hn_ctxt is_uf R' R * hn_ctxt nat_assn a' a * hn_ctxt nat_assn b' b) (uf_union R a b)\n         (hn_invalid is_uf R' R * hn_ctxt nat_assn a' a * hn_ctxt nat_assn b' b) \n             is_uf (PR_CONST (mop_per_union t) $  R' $ a' $ b' )\" \n\nbegin\n\n\nthm per_init'_sepref_rule[to_hfref]\nthm per_compare_sepref_rule[to_hfref]\nthm per_union_sepref_rule[to_hfref]\n\n\nend\n\n\n\nend", "meta": {"author": "adrilow", "repo": "Proof-of-the-amortized-time-complexity-of-the-Union-Find-data-structure-in-Isabelle-HOL", "sha": "293b12752261dac7f741483b62b27891bf4be1cc", "save_path": "github-repos/isabelle/adrilow-Proof-of-the-amortized-time-complexity-of-the-Union-Find-data-structure-in-Isabelle-HOL", "path": "github-repos/isabelle/adrilow-Proof-of-the-amortized-time-complexity-of-the-Union-Find-data-structure-in-Isabelle-HOL/Proof-of-the-amortized-time-complexity-of-the-Union-Find-data-structure-in-Isabelle-HOL-293b12752261dac7f741483b62b27891bf4be1cc/UnionFind_Intf.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3420619302881985}}
{"text": "(*  Title:      HOL/Auth/Guard/Guard_Public.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2002  University of Cambridge\n\nLemmas on guarded messages for public protocols.\n*)\n\ntheory Guard_Public imports Guard \"../Public\" Extensions begin\n\nsubsection\\<open>Extensions to Theory \\<open>Public\\<close>\\<close>\n\ndeclare initState.simps [simp del]\n\nsubsubsection\\<open>signature\\<close>\n\ndefinition sign :: \"agent => msg => msg\" where\n\"sign A X == \\<lbrace>Agent A, X, Crypt (priK A) (Hash X)\\<rbrace>\"\n\nlemma sign_inj [iff]: \"(sign A X = sign A' X') = (A=A' & X=X')\"\nby (auto simp: sign_def)\n\nsubsubsection\\<open>agent associated to a key\\<close>\n\ndefinition agt :: \"key => agent\" where\n\"agt K == @A. K = priK A | K = pubK A\"\n\nlemma agt_priK [simp]: \"agt (priK A) = A\"\nby (simp add: agt_def)\n\nlemma agt_pubK [simp]: \"agt (pubK A) = A\"\nby (simp add: agt_def)\n\nsubsubsection\\<open>basic facts about @{term initState}\\<close>\n\nlemma no_Crypt_in_parts_init [simp]: \"Crypt K X ~:parts (initState A)\"\nby (cases A, auto simp: initState.simps)\n\nlemma no_Crypt_in_analz_init [simp]: \"Crypt K X ~:analz (initState A)\"\nby auto\n\nlemma no_priK_in_analz_init [simp]: \"A ~:bad\n==> Key (priK A) ~:analz (initState Spy)\"\nby (auto simp: initState.simps)\n\nlemma priK_notin_initState_Friend [simp]: \"A ~= Friend C\n==> Key (priK A) ~: parts (initState (Friend C))\"\nby (auto simp: initState.simps)\n\nlemma keyset_init [iff]: \"keyset (initState A)\"\nby (cases A, auto simp: keyset_def initState.simps)\n\nsubsubsection\\<open>sets of private keys\\<close>\n\ndefinition priK_set :: \"key set => bool\" where\n\"priK_set Ks == ALL K. K:Ks --> (EX A. K = priK A)\"\n\nlemma in_priK_set: \"[| priK_set Ks; K:Ks |] ==> EX A. K = priK A\"\nby (simp add: priK_set_def)\n\nlemma priK_set1 [iff]: \"priK_set {priK A}\"\nby (simp add: priK_set_def)\n\nlemma priK_set2 [iff]: \"priK_set {priK A, priK B}\"\nby (simp add: priK_set_def)\n\nsubsubsection\\<open>sets of good keys\\<close>\n\ndefinition good :: \"key set => bool\" where\n\"good Ks == ALL K. K:Ks --> agt K ~:bad\"\n\nlemma in_good: \"[| good Ks; K:Ks |] ==> agt K ~:bad\"\nby (simp add: good_def)\n\nlemma good1 [simp]: \"A ~:bad ==> good {priK A}\"\nby (simp add: good_def)\n\nlemma good2 [simp]: \"[| A ~:bad; B ~:bad |] ==> good {priK A, priK B}\"\nby (simp add: good_def)\n\nsubsubsection\\<open>greatest nonce used in a trace, 0 if there is no nonce\\<close>\n\nprimrec greatest :: \"event list => nat\"\nwhere\n  \"greatest [] = 0\"\n| \"greatest (ev # evs) = max (greatest_msg (msg ev)) (greatest evs)\"\n\nlemma greatest_is_greatest: \"Nonce n:used evs ==> n <= greatest evs\"\napply (induct evs, auto simp: initState.simps)\napply (drule used_sub_parts_used, safe)\napply (drule greatest_msg_is_greatest, arith)\nby simp\n\nsubsubsection\\<open>function giving a new nonce\\<close>\n\ndefinition new :: \"event list => nat\" where\n\"new evs == Suc (greatest evs)\"\n\nlemma new_isnt_used [iff]: \"Nonce (new evs) ~:used evs\"\nby (clarify, drule greatest_is_greatest, auto simp: new_def)\n\nsubsection\\<open>Proofs About Guarded Messages\\<close>\n\nsubsubsection\\<open>small hack necessary because priK is defined as the inverse of pubK\\<close>\n\nlemma pubK_is_invKey_priK: \"pubK A = invKey (priK A)\"\nby simp\n\nlemmas pubK_is_invKey_priK_substI = pubK_is_invKey_priK [THEN ssubst]\n\nlemmas invKey_invKey_substI = invKey [THEN ssubst]\n\nlemma \"Nonce n:parts {X} ==> Crypt (pubK A) X:guard n {priK A}\"\napply (rule pubK_is_invKey_priK_substI, rule invKey_invKey_substI)\nby (rule Guard_Nonce, simp+)\n\nsubsubsection\\<open>guardedness results\\<close>\n\nlemma sign_guard [intro]: \"X:guard n Ks ==> sign A X:guard n Ks\"\nby (auto simp: sign_def)\n\nlemma Guard_init [iff]: \"Guard n Ks (initState B)\"\nby (induct B, auto simp: Guard_def initState.simps)\n\nlemma Guard_knows_max': \"Guard n Ks (knows_max' C evs)\n==> Guard n Ks (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Nonce_not_used_Guard_spies [dest]: \"Nonce n ~:used evs\n==> Guard n Ks (spies evs)\"\nby (auto simp: Guard_def dest: not_used_not_known parts_sub)\n\nlemma Nonce_not_used_Guard [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_used parts_trans)\n\nlemma Nonce_not_used_Guard_max [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_max_used parts_trans)\n\nlemma Nonce_not_used_Guard_max' [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in Guard_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection\\<open>regular protocols\\<close>\n\ndefinition regular :: \"event list set => bool\" where\n\"regular p == ALL evs A. evs:p --> (Key (priK A):parts (spies evs)) = (A:bad)\"\n\nlemma priK_parts_iff_bad [simp]: \"[| evs:p; regular p |] ==>\n(Key (priK A):parts (spies evs)) = (A:bad)\"\nby (auto simp: regular_def)\n\nlemma priK_analz_iff_bad [simp]: \"[| evs:p; regular p |] ==>\n(Key (priK A):analz (spies evs)) = (A:bad)\"\nby auto\n\nlemma Guard_Nonce_analz: \"[| Guard n Ks (spies evs); evs:p;\npriK_set Ks; good Ks; regular p |] ==> Nonce n ~:analz (spies evs)\"\napply (clarify, simp only: knows_decomp)\napply (drule Guard_invKey_keyset, simp+, safe)\napply (drule in_good, simp)\napply (drule in_priK_set, simp+, clarify)\napply (frule_tac A=A in priK_analz_iff_bad)\nby (simp add: knows_decomp)+\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/Guard/Guard_Public.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6584174871563662, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.34206192332385055}}
{"text": "(******************************************************************************\n * Orca: A Functional Correctness Verifier for Imperative Programs\n *       Based on Isabelle/UTP\n *\n * Copyright (c) 2016-2018 Virginia Tech, USA\n *               2016-2018 Technische Universität München, Germany\n *               2016-2018 University of York, UK\n *               2016-2018 Université Paris-Saclay, Univ. Paris-Sud, France\n *\n * This software may be distributed and modified according to the terms of\n * the GNU Lesser General Public License version 3.0 or any later version.\n * Note that NO WARRANTY is provided.\n *\n * See CONTRIBUTORS, LICENSE and CITATION files for details.\n ******************************************************************************)\n\ntheory utp_rec_total_des\n  imports \"../AlgebraicLaws/Algebraic_laws_design\"\nbegin\nsection {*Total correctness for recursion*}\n \nsubsection {*AUX lemmas on healthy fixed points*}\n\nlemma nu_design_is_healthy_des[simp]: (*This should be generated automatically in utp_theory*)\n  \"\\<nu>\\<^sub>D F is \\<H>\\<^bsub>DES\\<^esub>\"\n  by (simp add: is_Hcarrier_is_hdesigns)\n\nlemma nu_normal_design_is_healthy_des[simp]: (*This should be generated automatically in utp_theory*)\n  \"\\<nu>\\<^sub>N F is \\<H>\\<^bsub>NDES\\<^esub>\"\n  by (simp add: is_Ncarrier_is_ndesigns)\n  \nlemma mu_design_is_healthy_des[simp]: (*This should be generated automatically in utp_theory*)\n  \"\\<mu>\\<^sub>D F is \\<H>\\<^bsub>DES\\<^esub>\"\n  by (simp add: is_Hcarrier_is_hdesigns)\n\nlemma mu_normal_design_is_healthy_des[simp]: (*This should be generated automatically in utp_theory*)\n  \"\\<mu>\\<^sub>N F is \\<H>\\<^bsub>NDES\\<^esub>\"\n  by (simp add: is_Ncarrier_is_ndesigns)\n\nlemma  design_nu_wf_refine_intro: \n  assumes   WF: \"wf R\"\n    and      M: \"Mono\\<^bsub>uthy_order DES\\<^esub> F\"\n    and      H: \"F \\<in> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n    and      Okey1:\"$ok\\<acute> \\<sharp> p\"\n    and      Okey2:\"$ok\\<acute> \\<sharp> e\"\n    and  induct_step:\n    \"\\<And>st. ((p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile> q) \\<sqsubseteq> (F((p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile> q))\"\n  shows \"(p \\<turnstile> q) \\<sqsubseteq> \\<nu>\\<^sub>D F\"            \nproof -   \n  {\n    fix st\n    have \"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile> q \\<sqsubseteq> \\<nu>\\<^sub>D F\" \n      using WF proof (induction rule: wf_induct_rule)\n      case (less st)\n      hence 0: \"(p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile> q \\<sqsubseteq> \\<nu>\\<^sub>D F\"\n        by rel_blast\n      from M H design_theory_continuous.GFP_lemma2 mono_Monotone_utp_order\n      have 1: \" (\\<nu>\\<^sub>D F) \\<sqsubseteq> F(\\<nu>\\<^sub>D F)\"\n        by blast\n      from 0 1 have 2:\" (p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile> q \\<sqsubseteq> F (\\<nu>\\<^sub>D F)\"\n        by simp \n      have 3: \"F ((p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile> q) \\<sqsubseteq> F (\\<nu>\\<^sub>D F)\"\n      proof (rule Mono_utp_orderD[OF M \"nu_design_is_healthy_des\" \"design_is_healthy_DES_intro\" 0], goal_cases)\n        case 1\n        then show ?case by (simp add: Okey1 Okey2 unrest)\n      qed  \n      have 4:\"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile> q \\<sqsubseteq> \\<dots>\" \n        by (rule induct_step)\n      show ?case\n        using order_trans[OF 3 4] Okey1 H M design_theory_continuous.GFP_lemma3 dual_order.trans mono_Monotone_utp_order \n        by blast\n    qed\n  }\n  thus ?thesis\n    by pred_simp\nqed    \n\nlemma  design_mu_wf_refine_intro: \n  assumes   WF: \"wf R\"\n    and      M: \"Mono\\<^bsub>uthy_order DES\\<^esub> F\"\n    and      H: \"F \\<in> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n    and      Okey1:\"$ok\\<acute> \\<sharp> p\"\n    and      Okey2:\"$ok\\<acute> \\<sharp> e\"\n    and  induct_step:\n    \"\\<And>st. ((p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile> q) \\<sqsubseteq> (F((p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile> q))\"\n  shows \"(p \\<turnstile> q) \\<sqsubseteq> \\<mu>\\<^sub>D  F\"            \nproof -   \n  {\n    fix st\n    have \"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile> q \\<sqsubseteq> \\<mu>\\<^sub>D F\" \n      using WF proof (induction rule: wf_induct_rule)\n      case (less st)\n      hence 0: \"(p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile> q \\<sqsubseteq> \\<mu>\\<^sub>D F\"\n        by rel_blast\n      from M H design_theory_continuous.LFP_lemma3 mono_Monotone_utp_order\n      have 1: \"\\<mu>\\<^sub>D F \\<sqsubseteq>  F (\\<mu>\\<^sub>D F)\"\n        by blast\n      from 0 1 have 2:\"(p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile> q \\<sqsubseteq> F (\\<mu>\\<^sub>D F)\"\n        by simp\n      have 3: \"F ((p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile> q) \\<sqsubseteq> F (\\<mu>\\<^sub>D F)\"\n      proof (rule Mono_utp_orderD[OF M \"mu_design_is_healthy_des\" \"design_is_healthy_DES_intro\" 0], goal_cases)\n        case 1\n        then show ?case by (simp add: Okey2 Okey1 unrest)\n      qed  \n      have 4:\"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile> q \\<sqsubseteq> \\<dots>\" \n        by (rule induct_step)\n      show ?case\n        using order_trans[OF 3 4] Okey1 H M design_theory_continuous.LFP_lemma2 dual_order.trans mono_Monotone_utp_order \n        by blast\n    qed\n  }\n  thus ?thesis\n    by pred_simp\nqed    \n\n  \nlemma rdesign_nu_wf_refine_intro: \n  assumes   WF: \"wf R\"\n    and      M: \"Mono\\<^bsub>uthy_order DES\\<^esub> F\"\n    and      H: \"F \\<in> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n    and  induct_step:\n    \"\\<And>st. ((p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>r q) \\<sqsubseteq> (F ((p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>r q))\"\n  shows \"(p \\<turnstile>\\<^sub>r q) \\<sqsubseteq> \\<nu>\\<^sub>D F\"            \nproof -          \n  {\n  fix st\n  have \"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>r q \\<sqsubseteq> \\<nu>\\<^sub>D F\" \n    using WF proof (induction rule: wf_induct_rule)\n    case (less st)\n    hence 0: \"(p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>r q \\<sqsubseteq> \\<nu>\\<^sub>D F\"\n      by rel_blast\n    from M H design_theory_continuous.GFP_lemma2 mono_Monotone_utp_order\n    have 1: \"\\<nu>\\<^sub>D F \\<sqsubseteq>  F (\\<nu>\\<^sub>D F)\"\n      by blast\n    from 0 1 have 2:\"(p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>r q \\<sqsubseteq> F (\\<nu>\\<^sub>D F)\"\n      by simp\n    have 3: \"F ((p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>r q) \\<sqsubseteq> F (\\<nu>\\<^sub>D F)\"\n      by (auto intro: Mono_utp_orderD M 0)\n    have 4:\"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>r q \\<sqsubseteq> \\<dots>\" \n      by (rule induct_step)\n    show ?case\n      using order_trans[OF 3 4] H M design_theory_continuous.GFP_lemma3 dual_order.trans mono_Monotone_utp_order \n      by blast\n  qed\n  }\n  thus ?thesis\n    by pred_simp\nqed    \n  \nlemma rdesign_mu_wf_refine_intro: \n  assumes   WF: \"wf R\"\n    and      M: \"Mono\\<^bsub>uthy_order DES\\<^esub> F\"\n    and      H: \"F \\<in> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n    and  induct_step:\n    \"\\<And>st. ((p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>r q) \\<sqsubseteq> (F ((p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>r q))\"\n  shows \"(p \\<turnstile>\\<^sub>r q) \\<sqsubseteq> \\<mu>\\<^sub>D F\"            \nproof -          \n  {\n  fix st\n  have \"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>r q \\<sqsubseteq> \\<mu>\\<^sub>D F\" \n    using WF proof (induction rule: wf_induct_rule)\n    case (less st)\n    hence 0: \"(p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>r q \\<sqsubseteq> \\<mu>\\<^sub>D F\"\n      by rel_blast\n    from M H design_theory_continuous.LFP_lemma3 mono_Monotone_utp_order\n    have 1: \"\\<mu>\\<^sub>D F \\<sqsubseteq>  F (\\<mu>\\<^sub>D F)\"\n      by blast\n    from 0 1 have 2:\"(p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>r q \\<sqsubseteq> F (\\<mu>\\<^sub>D F)\"\n      by simp\n    have 3: \"F ((p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>r q) \\<sqsubseteq> F (\\<mu>\\<^sub>D F)\"\n      by (auto intro: Mono_utp_orderD M 0)\n    have 4:\"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>r q \\<sqsubseteq> \\<dots>\" \n      by (rule induct_step)\n    show ?case\n      using order_trans[OF 3 4] H M design_theory_continuous.LFP_lemma2 dual_order.trans mono_Monotone_utp_order \n      by blast\n  qed\n  }\n  thus ?thesis\n    by pred_simp\nqed    \n  \n   \nlemma ndesign_nu_wf_refine_intro: \n  assumes   WF: \"wf R\"\n    and      M: \"Mono\\<^bsub>uthy_order NDES\\<^esub> F\"\n    and      H: \"F \\<in> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H\"\n    and  induct_step:\n    \"\\<And>st. ((p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>n q) \\<sqsubseteq> (F ((p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>n q))\"\n  shows \"(p \\<turnstile>\\<^sub>n q) \\<sqsubseteq> \\<nu>\\<^sub>N F\"            \nproof -          \n  {\n  fix st\n  have \"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>n q \\<sqsubseteq> \\<nu>\\<^sub>N F\" \n    using WF proof (induction rule: wf_induct_rule)\n    case (less st)\n    hence 0: \"(p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>n q \\<sqsubseteq> \\<nu>\\<^sub>N F\"\n      by rel_blast\n    from M H normal_design_theory_continuous.GFP_lemma2 mono_Monotone_utp_order\n    have 1: \"\\<nu>\\<^sub>N F \\<sqsubseteq>  F (\\<nu>\\<^sub>N F)\"\n      by blast\n    from 0 1 have 2:\"(p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>n q \\<sqsubseteq> F (\\<nu>\\<^sub>N F)\"\n      by simp\n    have 3: \"F((p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>n q) \\<sqsubseteq> F (\\<nu>\\<^sub>N F)\"\n      by (auto intro: Mono_utp_orderD M 0)\n    have 4:\"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>n q \\<sqsubseteq> \\<dots>\" \n      by (rule induct_step)\n    show ?case\n      using order_trans[OF 3 4] H M normal_design_theory_continuous.GFP_lemma3 dual_order.trans mono_Monotone_utp_order \n      by blast\n  qed\n  }\n  thus ?thesis\n    by pred_simp\nqed  \n  \nlemma ndesign_mu_wf_refine_intro: \n  assumes   WF: \"wf R\"\n    and      M: \"Mono\\<^bsub>uthy_order NDES\\<^esub> F\"\n    and      H: \"F \\<in> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H\"\n    and  induct_step:\n    \"\\<And>st. ((p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>n q) \\<sqsubseteq> (F ((p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>n q))\"\n  shows \"(p \\<turnstile>\\<^sub>n q) \\<sqsubseteq> \\<mu>\\<^sub>N F\"            \nproof -          \n  {\n  fix st\n  have \"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>n q \\<sqsubseteq> \\<mu>\\<^sub>N F\" \n    using WF proof (induction rule: wf_induct_rule)\n    case (less st)\n    hence 0: \"(p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>n q \\<sqsubseteq> \\<mu>\\<^sub>N F\"\n      by rel_blast\n    from M H normal_design_theory_continuous.LFP_lemma3 mono_Monotone_utp_order\n    have 1: \"\\<mu>\\<^sub>N F \\<sqsubseteq>  F (\\<mu>\\<^sub>N F)\"\n      by blast\n    from 0 1 have 2:\"(p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>n q \\<sqsubseteq> F (\\<mu>\\<^sub>N F)\"\n      by simp\n    have 3: \"F((p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>n q) \\<sqsubseteq> F (\\<mu>\\<^sub>N F)\"\n      by (auto intro: Mono_utp_orderD M 0)\n    have 4:\"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>n q \\<sqsubseteq> \\<dots>\" \n      by (rule induct_step)\n    show ?case\n      using order_trans[OF 3 4] H M normal_design_theory_continuous.LFP_lemma2 dual_order.trans mono_Monotone_utp_order \n      by blast\n  qed\n  }\n  thus ?thesis\n    by pred_simp\nqed  \nend\n\n", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP-Extended/utp/utp_rec_total_des.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5698526514141572, "lm_q1q2_score": 0.3420189278723405}}
{"text": "(*  Title:       Compose\n    Authors:     Jasmin Blanchette, Andrei Popescu, Dmitriy Traytel\n    Maintainer:  Dmitriy Traytel <traytel at inf.ethz.ch>\n*)\n\nsection \\<open>Normalized Composition of BNFs\\<close>\n\ntext \\<open>Expected normal form: outer m-ary BNF is composed with m inner n-ary BNFs.\\<close>\n\n(*<*)\ntheory Compose\n  imports \"HOL-Library.BNF_Axiomatization\"\nbegin\n(*>*)\n\nunbundle cardinal_syntax\n\ndeclare [[bnf_internals]]\nbnf_axiomatization (dead 'p1, F1set1: 'a1, F1set2: 'a2) F1\n  [wits: \"('p1, 'a1, 'a2) F1\"]\n  for map: F1map rel: F1rel\nbnf_axiomatization (dead 'p2, F2set1: 'a1, F2set2: 'a2) F2\n  [wits: \"'a1 \\<Rightarrow> ('p2, 'a1, 'a2) F2\" \"'a2 \\<Rightarrow> ('p2, 'a1, 'a2) F2\"]\n  for map: F2map rel: F2rel\nbnf_axiomatization (dead 'p3, F3set1: 'a1, F3set2: 'a2) F3\n  [wits: \"'a1 \\<Rightarrow> 'a2 \\<Rightarrow> ('p3, 'a1, 'a2) F3\"]\n  for map: F3map rel: F3rel\nbnf_axiomatization (dead 'p, Gset1: 'b1, Gset2: 'b2, Gset3: 'b3) G\n  [wits: \"'b1 \\<Rightarrow> 'b3 \\<Rightarrow> ('p, 'b1, 'b2, 'b3) G\" \"'b2 \\<Rightarrow> 'b3 \\<Rightarrow> ('p, 'b1, 'b2, 'b3) G\"]\n  for map: Gmap rel: Grel\ntype_synonym ('p1, 'p2, 'p3, 'p, 'a1, 'a2) H =\n  \"('p, ('p1, 'a1, 'a2) F1, ('p2, 'a1, 'a2) F2, ('p3, 'a1, 'a2) F3) G\"\ntype_synonym ('p1, 'p2, 'p3, 'p) Hbd_type =\n  \"('p1 bd_type_F1 + 'p2 bd_type_F2 + 'p3 bd_type_F3) \\<times> 'p bd_type_G\"\n\nabbreviation F1in where \"F1in A1 A2 \\<equiv> {x. F1set1 x \\<subseteq> A1 \\<and> F1set2 x \\<subseteq> A2}\"\nabbreviation F2in where \"F2in A1 A2 \\<equiv> {x. F2set1 x \\<subseteq> A1 \\<and> F2set2 x \\<subseteq> A2}\"\nabbreviation F3in where \"F3in A1 A2 \\<equiv> {x. F3set1 x \\<subseteq> A1 \\<and> F3set2 x \\<subseteq> A2}\"\nabbreviation Gin where \"Gin A1 A2 A3 \\<equiv> {x. Gset1 x \\<subseteq> A1 \\<and> Gset2 x \\<subseteq> A2 \\<and> Gset3 x \\<subseteq> A3}\"\n\nabbreviation Gset where\n  \"Gset \\<equiv> BNF_Def.collect {Gset1, Gset2, Gset3}\"\n\nabbreviation Hmap :: \"('a1 \\<Rightarrow> 'b1) \\<Rightarrow> ('a2 \\<Rightarrow> 'b2) \\<Rightarrow>\n  ('p1, 'p2, 'p3, 'p, 'a1, 'a2) H \\<Rightarrow> ('p1, 'p2, 'p3, 'p, 'b1, 'b2) H\" where\n  \"Hmap f g \\<equiv> Gmap (F1map f g) (F2map f g) (F3map f g)\"\n\nabbreviation Hset1 :: \"('p1, 'p2, 'p3, 'p, 'a1, 'a2) H \\<Rightarrow> 'a1 set\" where\n  \"Hset1 \\<equiv> Union o Gset o Gmap F1set1 F2set1 F3set1\"\n\nabbreviation Hset2 :: \"('p1, 'p2, 'p3, 'p, 'a1, 'a2) H \\<Rightarrow> 'a2 set\" where\n  \"Hset2 \\<equiv> Union o Gset o Gmap F1set2 F2set2 F3set2\"\n\nlemma Hset1_alt:\n  \"Hset1 = Union o BNF_Def.collect {image F1set1 o Gset1, image F2set1 o Gset2, image F3set1 o Gset3}\"\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_set_alt_tac @{context} @{thm G.collect_set_map}\\<close>)\n\nlemma Hset2_alt:\n  \"Hset2 = Union o BNF_Def.collect {image F1set2 o Gset1, image F2set2 o Gset2, image F3set2 o Gset3}\"\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_set_alt_tac @{context} @{thm G.collect_set_map}\\<close>)\n\nabbreviation Hbd where\n  \"Hbd \\<equiv> (bd_F1 +c bd_F2 +c bd_F3) *c bd_G\"\n\ntheorem Hmap_id: \"Hmap id id = id\"\n  unfolding G.map_id0 F1.map_id0 F2.map_id0 F3.map_id0 ..\n\n\n\ntheorem Hmap_cong: \"\\<lbrakk>\\<And>z. z \\<in> Hset1 x \\<Longrightarrow> f1 z = g1 z; \\<And>z. z \\<in> Hset2 x \\<Longrightarrow> f2 z = g2 z\\<rbrakk> \\<Longrightarrow>\n  Hmap f1 f2 x = Hmap g1 g2 x\"\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_map_cong0_tac @{context}\n  [] @{thms Hset1_alt Hset2_alt} @{thm G.map_cong0} @{thms F1.map_cong0 F2.map_cong0 F3.map_cong0}\\<close>)\n\ntheorem Hset1_natural: \"Hset1 o Hmap f1 f2 = image f1 o Hset1\"\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_set_map0_tac @{context} @{thm refl} @{thm G.map_comp0} @{thm G.map_cong0}\n  @{thm G.collect_set_map} @{thms F1.set_map0(1) F2.set_map0(1) F3.set_map0(1)}\\<close>)\n\n\n\ntheorem Hbd_card_order: \"card_order Hbd\"\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_bd_card_order_tac @{context}\n  @{thms F1.bd_card_order F2.bd_card_order F3.bd_card_order} @{thm G.bd_card_order}\\<close>)\n\ntheorem Hbd_cinfinite: \"cinfinite Hbd\"\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_bd_cinfinite_tac @{context}\n  @{thm F1.bd_cinfinite} @{thm G.bd_cinfinite}\\<close>)\n\ntheorem Hset1_bd: \"|Hset1 (x :: ('p1, 'p2, 'p3, 'p, 'a1, 'a2) H )| \\<le>o\n  (Hbd :: ('p1, 'p2, 'p3, 'p) Hbd_type rel)\"\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_set_bd_tac @{context} @{thm refl} NONE @{thm Hset1_alt}\n      @{thms comp_single_set_bd[OF F1.bd_Card_order F1.set_bd(1) G.set_bd(1)]\n             comp_single_set_bd[OF F2.bd_Card_order F2.set_bd(1) G.set_bd(2)]\n             comp_single_set_bd[OF F3.bd_Card_order F3.set_bd(1) G.set_bd(3)]}\\<close>)\n\ntheorem Hset2_bd: \"|Hset2 (x :: ('p1, 'p2, 'p3, 'p, 'a1, 'a2) H )| \\<le>o\n  (Hbd :: ('p1, 'p2, 'p3, 'p) Hbd_type rel)\"\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_set_bd_tac @{context} @{thm refl} NONE @{thm Hset2_alt}\n      @{thms comp_single_set_bd[OF F1.bd_Card_order F1.set_bd(2) G.set_bd(1)]\n             comp_single_set_bd[OF F2.bd_Card_order F2.set_bd(2) G.set_bd(2)]\n             comp_single_set_bd[OF F3.bd_Card_order F3.set_bd(2) G.set_bd(3)]}\\<close>)\n\nabbreviation Hin where \"Hin A1 A2 \\<equiv> {x. Hset1 x \\<subseteq> A1 \\<and> Hset2 x \\<subseteq> A2}\"\n\nlemma Hin_alt: \"Hin A1 A2 = Gin (F1in A1 A2) (F2in A1 A2) (F3in A1 A2)\"\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_in_alt_tac @{context} @{thms Hset1_alt Hset2_alt}\\<close>)\n\ndefinition Hwit1 where \"Hwit1 b c = wit1_G wit_F1 (wit_F3 b c)\"\ndefinition Hwit21 where \"Hwit21 b c = wit2_G (wit1_F2 b) (wit_F3 b c)\"\ndefinition Hwit22 where \"Hwit22 b c = wit2_G (wit2_F2 c) (wit_F3 b c)\"\n\nlemma Hwit1:\n  \"\\<And>x. x \\<in> Hset1 (Hwit1 b c) \\<Longrightarrow> x = b\"\n  \"\\<And>x. x \\<in> Hset2 (Hwit1 b c) \\<Longrightarrow> x = c\"\n  unfolding Hwit1_def\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_wit_tac @{context} [] @{thms G.wit1 G.wit2}\n  @{thm G.collect_set_map} @{thms F1.wit F2.wit1 F2.wit2 F3.wit}\\<close>)\n\nlemma Hwit21:\n  \"\\<And>x. x \\<in> Hset1 (Hwit21 b c) \\<Longrightarrow> x = b\"\n  \"\\<And>x. x \\<in> Hset2 (Hwit21 b c) \\<Longrightarrow> x = c\"\n  unfolding Hwit21_def\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_wit_tac @{context} [] @{thms G.wit1 G.wit2}\n  @{thm G.collect_set_map} @{thms F1.wit F2.wit1 F2.wit2 F3.wit}\\<close>)\n\n\nlemma Hwit22:\n  \"\\<And>x. x \\<in> Hset1 (Hwit22 b c) \\<Longrightarrow> x = b\"\n  \"\\<And>x. x \\<in> Hset2 (Hwit22 b c) \\<Longrightarrow> x = c\"\n  unfolding Hwit22_def\n  by (tactic \\<open>BNF_Comp_Tactics.mk_comp_wit_tac @{context} [] @{thms G.wit1 G.wit2}\n  @{thm G.collect_set_map} @{thms F1.wit F2.wit1 F2.wit2 F3.wit}\\<close>)\n\n(* Relator structure for H *)\n\nlemma Grel_cong: \"\\<lbrakk>R1 = S1; R2 = S2; R3 = S3\\<rbrakk> \\<Longrightarrow> Grel R1 R2 R3 = Grel S1 S2 S3\"\n  by hypsubst (rule refl)\n\ndefinition Hrel where\n  \"Hrel R1 R2 = (BNF_Def.Grp (Hin (Collect (case_prod R1)) (Collect (case_prod R2))) (Hmap fst fst))^--1 OO\n                (BNF_Def.Grp (Hin (Collect (case_prod R1)) (Collect (case_prod R2))) (Hmap snd snd))\"\n\nlemmas Hrel_unfold = trans[OF Hrel_def trans[OF OO_Grp_cong[OF Hin_alt]\n      trans[OF arg_cong2[of _ _ _ _ relcompp, OF trans[OF arg_cong[of _ _ conversep, OF sym[OF G.rel_Grp]] G.rel_conversep[symmetric]] sym[OF G.rel_Grp]]\n        trans[OF G.rel_compp[symmetric] Grel_cong[OF sym[OF F1.rel_compp_Grp] sym[OF F2.rel_compp_Grp] sym[OF F3.rel_compp_Grp]]]]]]\n\nbnf H: \"('p1, 'p2, 'p3, 'p, 'a1, 'a2) H\"\n  map: Hmap\n  sets: Hset1 Hset2\n  bd: \"Hbd :: ('p1, 'p2, 'p3, 'p) Hbd_type rel\"\n  rel: Hrel\n            apply -\n            apply (rule Hmap_id)\n           apply (rule Hmap_comp)\n          apply (erule Hmap_cong) apply assumption\n         apply (rule Hset1_natural)\n        apply (rule Hset2_natural)\n       apply (rule Hbd_card_order)\n      apply (rule Hbd_cinfinite)\n     apply (rule Hset1_bd)\n    apply (rule Hset2_bd)\n   apply (unfold Hrel_unfold G.rel_compp[symmetric] F1.rel_compp[symmetric] F2.rel_compp[symmetric] F3.rel_compp[symmetric] eq_OO) [1] apply (rule order_refl)\n  apply (rule Hrel_def[unfolded OO_Grp_alt mem_Collect_eq])\n  done\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BNF_Operations/Compose.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6001883592602051, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3420189278723405}}
{"text": "(*\n   Copyright 2016 Yoichi Hirai\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n*)\n\nsection {* What can Happen during a Contract Invocation *}\n\ntext {* This section defines a set of sequence of account states that can appeear during an\ninvocation of a countract.  The invocation can be a nested reentrancy, but we focus on one\ninvocation.  This means we do not look into details of further reentrancy, but just assume \nthat the inner reentrancy keeps the invariant of the contract.  Of course we need to prove\nthat the invariant holds for the code, but when we do that we can assume that the inner\nnested calls keep the invariants (we can say we are doing mathematical induction on the depth\nof reentrancy)\\footnote{This poses troubles dealing with DELEGATECALL and CALLCODE instructions.\nCurrently execution of these instructions causes an immediate annotation failure.}.  *}\n\ntheory RelationalSem\n\nimports Main \"./ContractSem\"\n\nbegin\n\nsubsection {* Some Possible Changes on Our Account State *}\n\ntext {* The account state might change even when the account's code is not executing. *}\n\ntext {* Between blocks, the account might gain balances because somebody mines \nEth for the account.  Even within a single block,\nthe balance might increase also while other contracts execute\nbecause they might destroy themselves and send their balance to our account.\nWhen a transaction finishes, if our contract is marked as killed, it is destroyed.\nThe following relation captures these possibilities.\n*}\n\ninductive account_state_natural_change :: \"account_state \\<Rightarrow> account_state \\<Rightarrow> bool\"\nwhere\nnatural: -- {* The balance of this account might increase\nwhenever the code in our contract is not executing.  Some other account might\ndestroy itself and give its balance to our account.  *}\n \"old_bal \\<le> new_bal \\<Longrightarrow>\n  account_state_natural_change\n   \\<lparr> account_address = addr\n   , account_storage = str\n   , account_code = code\n   , account_balance = old_bal\n   , account_ongoing_calls = going\n   , account_killed = killed\n   \\<rparr>\n   \\<lparr> account_address = addr\n   , account_storage = str\n   , account_code = code\n   , account_balance = new_bal\n   , account_ongoing_calls = going\n   , account_killed = killed\n   \\<rparr>\"\n| cleaned: -- {* This happens only at the end of a transaction, but we don't know\n              the transaction boundaries.  \n              So this can happen at any moment when there are no ongoing calls.  *}\n  \"account_state_natural_change\n  \\<lparr> account_address = addr\n  , account_storage = str\n  , account_code = code\n  , account_balance = old_bal\n  , account_ongoing_calls = []\n  , account_killed = True\n  \\<rparr>\n  (empty_account addr)\"\n\ndeclare account_state_natural_change.simps [simp]\n\ntext {* When the execution comes back from an external call, the account state might have changed\narbitrarily.  Our strategy is to assume that an invariant is kept here; and later prove that\nthe invariant actually holds (that is, for fewer depth of reentrancy).\nThe whole argument can be seen as a mathematical induction over depths of reentrancy, though\nthis idea has not been formalized yet. *}\n\ninductive account_state_return_change ::\n\"(account_state \\<Rightarrow> bool) \\<Rightarrow> account_state \\<Rightarrow> account_state \\<Rightarrow> bool\"\nwhere\naccount_return:\n\"invariant\n \\<lparr> account_address = addr\n , account_storage = new_str\n , account_code = code\n , account_balance = new_bal\n , account_ongoing_calls = ongoing\n , account_killed = new_killed\n \\<rparr>\n \\<Longrightarrow>\n account_state_return_change\n invariant\n \\<lparr> account_address = addr\n , account_storage = old_str\n , account_code = code\n , account_balance = old_bal\n , account_ongoing_calls = ongoing\n , account_killed = killed\n \\<rparr>\n \\<lparr> account_address = addr\n , account_storage = new_str\n , account_code = code\n , account_balance = new_bal\n , account_ongoing_calls = ongoing\n , account_killed = new_killed\n \\<rparr>\n \"\n\ndeclare account_state_return_change.simps [simp]\n\ntext \"Next we specify which program results might see a return.\"\n\nfun returnable_result :: \"instruction_result \\<Rightarrow> bool\"\nwhere\n  \"returnable_result (InstructionContinue _) = False\"\n| \"returnable_result (InstructionToEnvironment (ContractCall _) _ _) = True\"\n| \"returnable_result (InstructionToEnvironment (ContractDelegateCall _) _ _) = False\"\n| \"returnable_result (InstructionToEnvironment (ContractCreate _) _ _) = True\"\n| \"returnable_result (InstructionToEnvironment (ContractSuicide _) _ _) = False\"\n| \"returnable_result (InstructionToEnvironment (ContractFail _) _ _) = False\"\n-- {* because we are not modeling nested calls here, the effect of the nested calls are modeled in\n      account\\_state\\_return\\_change *}\n| \"returnable_result (InstructionToEnvironment (ContractReturn _) _ _) = False\"\n\nfun returnable_from_delegate_call :: \"instruction_result \\<Rightarrow> bool\"\nwhere\n  \"returnable_from_delegate_call (InstructionContinue _) = False\"\n| \"returnable_from_delegate_call (InstructionToEnvironment (ContractCall _) _ _) = False\"\n| \"returnable_from_delegate_call (InstructionToEnvironment (ContractDelegateCall _) _ _) = True\"\n| \"returnable_from_delegate_call (InstructionToEnvironment (ContractCreate _) _ _) = False\"\n| \"returnable_from_delegate_call (InstructionToEnvironment (ContractSuicide _) _ _) = False\"\n| \"returnable_from_delegate_call (InstructionToEnvironment (ContractFail _) _ _) = False\"\n-- {* because we are not modeling nested calls here, the effect of the nested calls are modeled in\n      account\\_state\\_return\\_change *}\n| \"returnable_from_delegate_call (InstructionToEnvironment (ContractReturn _) _ _) = False\"\n\nsubsection {* A Round of the Game *}\n\ntext {* Now we are ready to specify the environment's turn. *}\n\ndatatype environment_input =\n    Execution \"instruction_result\"\n  | Init \"call_env\"\n\n\ninductive environment_turn ::\n\"(account_state \\<Rightarrow> bool) (* The invariant of our contract*)\n\\<Rightarrow> (account_state * environment_input)\n   (* the account state before the environment's move\n      and the last thing our account did *)\n\\<Rightarrow> (account_state * variable_ctx)\n   (* the account state after the environment's move\n      and the variable environment from which our contract must start. *)\n\\<Rightarrow> bool (* a boolean indicating if that is a possible environment's move. *)\"\nwhere\n  environment_call: -- {* the environment might call our contract.  We only consider the initial invocation here\n  because the deeper reentrant invocations are considered as a part of the adversarial environment. \n  The deeper reentrant invocations are performed without the environment replying to the contract. *}\n  \"(* If a variable environment is built from the old account state *)\n   (* and the call arguments, *)\n   build_vctx_called old_state callargs next_vctx \\<Longrightarrow>\n   \n   (* the environment makes a move, showing the variable environment. *)\n   environment_turn I (old_state, Init callargs) (old_state, next_vctx)\"\n| environment_return: -- {* the environment might return to our contract. *}\n  \"(* If the account state can be changed during reentrancy,*)\n   account_state_return_change I account_state_going_out account_state_back \\<Longrightarrow>\n\n   (* and a variable environment can be recovered from the changed account state,*)\n   build_vctx_returned account_state_back result new_v \\<Longrightarrow>\n\n   (* and the previous move of the contract was a call-like action, *)\n   returnable_result program_r \\<Longrightarrow>\n\n   (* the environment can make a move, telling the contract to continue with *)\n   (* the variable environment. *)\n   environment_turn I (account_state_going_out, Execution program_r)\n                (account_state_pop_ongoing_call account_state_back, new_v)\"\n\n| environment_return_after_delegate_call: -- {* the environment might return to our contract. *}\n  \"(* If the account state can be changed during reentrancy,*)\n   (* the account state might be completely broken *)\n   build_vctx_returned account_state_back result new_v \\<Longrightarrow>\n\n   (* and the previous move of the contract was a call-like action, *)\n   returnable_from_delegate_call program_r \\<Longrightarrow>\n\n   (* the environment can make a move, telling the contract to continue with *)\n   (* the variable environment. *)\n   environment_turn I (account_state_going_out, Execution program_r)\n                (account_state_pop_ongoing_call account_state_back, new_v)\"\n\n  \n| environment_fail: -- {* the environment might fail from an account into our contract. *}\n  \"(* If a variable environment can be recovered from the previous account state,*)\n   build_vctx_failed account_state_going_out = Some new_v \\<Longrightarrow>\n   \n   (* and if the previous action from the contract was a call, *)\n   returnable_result result = True \\<Longrightarrow>\n   \n   (* the environment can make a move, telling the contract to continue with *) \n   (* the variable environment. *)\n   environment_turn I (account_state_going_out, Execution result)\n                (account_state_pop_ongoing_call account_state_going_out, new_v)\"\n\ntext {* As a reply, our contract might make a move, or report an annotation failure.*}\n\ninductive contract_turn ::\n\"network \\<Rightarrow> (account_state * variable_ctx) \\<Rightarrow> (account_state * environment_input) \\<Rightarrow> bool\"\nwhere\n  contract_to_environment:\n  \"(* Under a constant environment built from the old account state, *)\n   build_cctx old_account = cctx \\<Longrightarrow>\n\n   (* if the program behaves like this, *)\n   program_sem k cctx steps net (InstructionContinue old_vctx)\n      = InstructionToEnvironment act v opt_v \\<Longrightarrow>\n\n   (* and if the account state is updated from the program's result, *)\n   account_state_going_out\n     = update_account_state old_account act v opt_v \\<Longrightarrow>\n\n   (* the contract makes a move and udates the account state. *)\n   contract_turn net (old_account, old_vctx)\n      (account_state_going_out, Execution (InstructionToEnvironment act v opt_v))\"\n\ntext {* When we combine the environment's turn and the contract's turn, we get one round.\nThe round is a binary relation over a single set.\n*}\n\ninductive one_round ::\n\"network \\<Rightarrow> (account_state \\<Rightarrow> bool) \\<Rightarrow> \n(account_state * environment_input) \\<Rightarrow> \n(account_state * environment_input) \\<Rightarrow> bool\"\nwhere\nround:\n\"environment_turn I a b \\<Longrightarrow> contract_turn net b c \\<Longrightarrow> one_round net I a c\"\n\nsubsection {* Repetitions of rounds *}\n\ntext {* So, we can repeat rounds and see where they bring us.  *}\ntext {* The definition is taken from the book Concrete Semantics, and then modified *}\ninductive star :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> bool\"\nwhere\nrefl: \"star r x x\" |\nstep: \"r x y \\<Longrightarrow> star r y z \\<Longrightarrow> star r x z\"\n\ntext {* The repetition of rounds is either zero-times or once and a repetition. *}\nlemma star_case :\n\"star r a c \\<Longrightarrow>\n (a = c \\<or> (\\<exists> b. r a b \\<and> star r b c))\"\napply(induction rule: star.induct; auto)\ndone\n\ntext {* The next lemma is purely for convenience.\nActually the rounds can go nowhere after this invocation fails.\n*}\nlemma no_entry_fail [dest!]:\n\"star (one_round net I)\n      (a, Execution (InstructionToEnvironment (ContractFail x) v v_opt))\n      (b, c) \\<Longrightarrow> b = a \\<and> c = Execution (InstructionToEnvironment (ContractFail x) v v_opt)\"\napply(drule star_case; simp)\napply(simp add: one_round.simps add: environment_turn.simps)\ndone\n\ntext {* Similarly, the rounds can go nowhere after this invocation returns. *}\nlemma no_entry_return [dest!]:\n\"star (one_round net I)\n      (a, Execution (InstructionToEnvironment (ContractReturn data) v v_opt))\n      (b, c) \\<Longrightarrow> b = a \\<and> c = Execution (InstructionToEnvironment (ContractReturn data) v v_opt)\"\napply(drule star_case; simp)\napply(simp add: one_round.simps add: environment_turn.simps)\ndone\n\ntext {* Also similarly, the rounds can go nowhere after this invocation\ncauses our contract to destroy itself.\n*}\nlemma no_entry_suicide [dest!]:\n\"star (one_round net I)\n      (a, Execution (InstructionToEnvironment (ContractSuicide dst) v v_opt))\n      (b, c) \\<Longrightarrow> b = a \\<and> c = Execution (InstructionToEnvironment (ContractSuicide dst) v v_opt)\"\napply(drule star_case; simp)\napply(simp add: one_round.simps add: environment_turn.simps)\ndone\n\nsubsection {* How to State an Invariant *}\n\ntext {* For any invariant @{term I} over account states, now @{term \"star net (one_round I)\"}\nrelation shows all possibilities during one invocation\\footnote{More precisely,\nthis transitive closure of rounds guides us through all the possible states when the contract loses the control flow.}, assuming that the\ninvariant is kept during external calls\\footnote{This assumption about deeper reentrancy should\nbe considered as an induction hypothesis.  There has to be a lemma actually perform\nsuch induction.}.\nThe following template traverses the states and states that the invariant is actually kept\nafter every possible round.  Also the template states that no annotation failures happen.\nWhen I state something, I will be then obliged to prove the statement.  This happens in the next section.\n*}\n\ntext {* I define the conjunction of the properties requested at the final states.\nThe whole thing is more readable when I inline-expand @{term invariant_holds_post},\nbut if I do that, the @{text auto} tactic splits out a subgoal for each conjunct.\nThis doubles the already massive number of subgoals.\n*}\n\ndefinition invariant_holds_post ::\n  \"(account_state \\<Rightarrow> bool) \\<Rightarrow> (account_state \\<times> environment_input) \\<Rightarrow> bool\"\nwhere\n\"invariant_holds_post I fin =\n (I (fst fin)(* The invariant holds. *))\n\"\n\nlemma invariant_holds_in_fail [simp] :\n\"I state \\<Longrightarrow>\n invariant_holds_post I (state, Execution (InstructionToEnvironment (ContractFail x) v v_opt))\"\napply(simp add: invariant_holds_post_def)\ndone\n\ntext {* @{term \"invariant_holds\"} is a template for statements.\nIt takes a single argument @{term I} for the invariant.\nThe invariant is assumed to hold at the initial state.\nThe initial state is when the contract is called (this can be the first\ninvocation of this contract in this transaction, or a reentrancy).\nThe statement will request us to prove that the invariant also\nholds whenever the invocation loses the control flow.\nThe invocation loses the control flow when the contract returns or fails\nfrom the invocation, and also when it calls an account.\nWhen the contract calls an account, the invocation does not finish so\nI need to verify further final states against the postconditions, after\nthe call finishes.\nThe repetition is captured by the transitive closure\n@{term \"star (one_round net I)\"}.\n\nWe prove the invariant when our contract calls out,\nand we assume that reentrancy into this contract will\nkeep the invariant.\nThe whole argument can be seen as a mathematical induction\nover the depth of reentrancy.  So we can assume that\nreentrancy of a fewer depth keeps the invariant.\nThis idea comes from Christian Reitwiessner's treatment of\nreentrancy in Why ML.\nI have not justified the idea in Isabelle/HOL.\n*}\n\ndefinition invariant_holds :: \"network \\<Rightarrow> (account_state \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n\"invariant_holds net (I :: account_state \\<Rightarrow> bool) \\<equiv>\n  (\\<forall> addr str code bal ongoing killed callenv.\n    I \\<lparr> account_address = addr, account_storage = str, account_code = code,\n       account_balance = bal,\n       account_ongoing_calls = ongoing,\n       account_killed = killed \\<rparr> \\<longrightarrow>\n  (\\<forall> fin. star (one_round net I) (\n    \\<lparr> account_address = addr, account_storage = str, account_code = code,\n      account_balance = bal, \n      account_ongoing_calls = ongoing,\n      account_killed = killed \\<rparr>\n  , Init callenv) fin \\<longrightarrow>\n  invariant_holds_post I fin))\"\n\nsubsection {* How to State a Pre-Post Condition Pair *}\n\ntext {* After proving a theorem of the above form, I might be interested in \na more specific case (e.g.\\,if the caller is not this particular account, nothing should change).\nFor that purpose, here is another template statement.  This contains everything above plus\nan assumption about the initial call, and a conclusion about the state after the invocation.\n*}\n\ntext {* I pack everything that I want when the contract fails or returns.\nThis definition reduces the number of goals that I need to prove.\nWithout this definition, the @{text auto} tactic\nsplits a goal @{prop \"A \\<Longrightarrow> B \\<and> D\"} into two subgoals @{prop \"A \\<Longrightarrow> B\"} and @{prop \"A \\<Longrightarrow> D\"}.\nWhen I do complicated case analysis on @{prop A}, the number of subgoals grow rapidly.\nSo, I define @{term packed} to be @{prop \"B \\<and> D\"} and prevent the @{text auto} tactic from noticing that it is a conjunction.\n*}\n\ntext {* The following snippet says the invariant still holds in the observed final state%\n\\footnote{After the invocation finishes, some miner can credit Eth to the account under\nverification.  The ``observed'' final state is an arbitrary state \nafter such possible balance increases.}\nand the postconditions hold there. *}\n\ndefinition postcondition_pack\nwhere\n\"postcondition_pack I postcondition fin_observed initial_account initial_call fin\n=\n  (I fin_observed \\<and>\n  postcondition initial_account initial_call (fin_observed, snd fin))\"\n\ntext {* The whole template takes an invariant @{term I}, a @{term precondition}\nand a @{term postcondition}. The statement is about one invocation of the contract.\nThis invocation can be a reentrancy.  The initial state is when the contract is invoked,\nand the final states\\footnote{Since I am considering all possible executions, there are multiple\nfinal states.  Also, even when I concetrate on a single execution, every time the contract calls an\naccount, I have to check the invariants.  Otherwise, I have no knowledge about what happens\nduring the following reentrancy. } are\nwhen this invocation makes a call to an account, returns or fails.\nWe further consider natural balance increases\\footnote{The balnace of an Ethereum account increases\nnaturally when a contract destroys itself and sends its balance to our account, for instance.}\nand use the ``observed final state'' to\nevaluate the post condition.\nOf course, in between, there might be nesting reentrant invocations, that might alter\nthe storage and the balance of the contract.\n\nAt the time of invocation, the invariant and the preconditions are assumed.\nDuring reentrant calls (that are deeper than the current invocation),\nthe statement will request us to prove that the invariant holds at any moment when\nthe contract loses the control flow (when the contract returns, fails or calls an account).\nAlso we will be requested to prove that the postcondition holds on these occasions.\nThe contract regains the control flow after a deeper call finishes, and the contract\nwould lose the control flow again.\nAll these requirements are captured by the transitive closure of @{term one_round} relation.\n*}\n\ndefinition pre_post_conditions ::\n\"network \\<Rightarrow> (account_state \\<Rightarrow> bool) \\<Rightarrow> (account_state \\<Rightarrow> call_env \\<Rightarrow> bool) \\<Rightarrow>\n (account_state \\<Rightarrow> call_env \\<Rightarrow> (account_state \\<times> environment_input) \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n\"pre_post_conditions\n  net\n  (I :: account_state \\<Rightarrow> bool)\n  (precondition :: account_state \\<Rightarrow> call_env\\<Rightarrow> bool)\n  (postcondition :: account_state \\<Rightarrow> call_env \\<Rightarrow>\n                    (account_state \\<times> environment_input) \\<Rightarrow> bool) \\<equiv>\n                    \n  (* for any initial call and initial account state that satisfy *)\n  (* the invariant and the precondition, *)\n  (\\<forall> initial_account initial_call. I initial_account \\<longrightarrow>\n     precondition initial_account initial_call \\<longrightarrow>\n     \n  (* for any final state that are reachable from these initial conditions, *)\n  (\\<forall> fin. star (one_round net I) (initial_account, Init initial_call) fin \\<longrightarrow>\n  \n  (* and for any observed final state after this final state, *)\n  (\\<forall> fin_observed. account_state_natural_change (fst fin) fin_observed \\<longrightarrow>\n  \n  (* the postcondition and the invariant holds. *)\n  postcondition_pack\n  I postcondition fin_observed initial_account initial_call fin)))\n\"\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/RelationalSem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.34201892787234045}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"Signed Words\"\n\ntheory Signed_Words\nimports \"HOL-Word.Word\"\nbegin\n\ntext \\<open>Signed words as separate (isomorphic) word length class. Useful for tagging words in C.\\<close>\n\ntypedef ('a::len0) signed = \"UNIV :: 'a set\" ..\n\nlemma card_signed [simp]: \"CARD (('a::len0) signed) = CARD('a)\"\n  unfolding type_definition.card [OF type_definition_signed]\n  by simp\n\ninstantiation signed :: (len0) len0\nbegin\n\ndefinition\n  len_signed [simp]: \"len_of (x::'a::len0 signed itself) = LENGTH('a)\"\n\ninstance ..\n\nend\n\ninstance signed :: (len) len\n  by (intro_classes, simp)\n\ntype_synonym 'a sword = \"'a signed word\"\ntype_synonym  sword8 =  \"8 sword\"\ntype_synonym sword16 = \"16 sword\"\ntype_synonym sword32 = \"32 sword\"\ntype_synonym sword64 = \"64 sword\"\n\nend\n", "meta": {"author": "Daohub-io", "repo": "cap9-spec", "sha": "de42d102f2054547c1aa0c8d0dc6d9cc2c763181", "save_path": "github-repos/isabelle/Daohub-io-cap9-spec", "path": "github-repos/isabelle/Daohub-io-cap9-spec/cap9-spec-de42d102f2054547c1aa0c8d0dc6d9cc2c763181/Word_Lib/Signed_Words.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.34201892787234045}}
{"text": "theory AbstractSepreftime_Thin\n  imports \"HOL-Library.Extended_Nat\" \"Refine_Monadic.RefineG_Domain\"  Refine_Monadic.Refine_Misc  \n  \"HOL-Library.Monad_Syntax\"   \"HOL-Library.Groups_Big_Fun\"\n  Complex_Main \n  \"HOL-Library.Function_Algebras\" \n\nbegin\n\n\n\n\n\nsection \"Auxiliaries\"\n\nsubsection \"Auxiliaries for option\"\n\nlemma less_eq_option_None_is_None': \"x \\<le> None \\<longleftrightarrow> x = None\" by(auto simp: less_eq_option_None_is_None)\n\nlemma everywhereNone: \"(\\<forall>x\\<in>X. x = None) \\<longleftrightarrow> X = {} \\<or> X = {None}\"\n  by auto\n\nsubsection \"Auxiliaries for enat\"\n\n\nlemma helper: \"x2 \\<le> x2a \\<Longrightarrow> \\<not> x2 < a \\<Longrightarrow> \\<not> x2a < a \\<Longrightarrow>  x2 - (a::enat) \\<le> x2a - a\"\n  apply(cases x2; cases x2a) apply auto apply(cases a) by auto\n\nlemma helper2: \"x2b \\<le> x2 \\<Longrightarrow> \\<not> x2a < x2  \\<Longrightarrow> \\<not> x2a < x2b \\<Longrightarrow> x2a - (x2::enat) \\<le> x2a - x2b\"\n  apply(cases x2; cases x2a) apply auto apply(cases x2b) by auto\n\nlemma Sup_finite_enat: \"Sup X = Some (enat a) \\<Longrightarrow> Some (enat a) \\<in> X\"\n  by (auto simp: Sup_option_def Sup_enat_def these_empty_eq Max_eq_iff in_these_eq split: if_splits)\n\nlemma Sup_enat_less2: \" Sup X = \\<infinity> \\<Longrightarrow> (\\<exists>x\\<in>X. enat t < x)\"\n  unfolding  Sup_enat_def using    finite_enat_bounded linear \n  apply(auto split: if_splits)  \n   apply (smt Max_in empty_iff enat_ord_code(4))\n  by (smt not_less)  \n\n\n\n\nsubsection \"Auxiliary (for Sup and Inf)\"\n\n\n\nlemma aux11: \"f`X={y} \\<longleftrightarrow> (X\\<noteq>{} \\<and> (\\<forall>x\\<in>X. f x = y))\" by auto\n \nlemma aux2: \"(\\<lambda>f. f x) ` {[x \\<mapsto> t1] |x t1. M x = Some t1} = {None} \\<longleftrightarrow> (M x = None \\<and> M\\<noteq>Map.empty)\"\n  apply (cases \"M x\"; auto simp: aux11)\n  by force\n\nlemma aux3: \"(\\<lambda>f. f x) ` {[x \\<mapsto> t1] |x t1. M x = Some t1} = {Some t1 | t1. M x = Some t1} \\<union> ({None | y. y\\<noteq>x \\<and> M y \\<noteq> None })\"\n  by (fastforce split: if_splits simp: image_iff) \n\nlemma Sup_pointwise_eq_fun: \"(SUP f\\<in>{[x \\<mapsto> t1] |x t1. M x = Some t1}. f x) = M x\"\n  unfolding Sup_option_def  \n  apply (simp add: aux2) \n  apply (auto simp: aux3)\n  by (metis (mono_tags, lifting) Some_image_these_eq Sup_least in_these_eq mem_Collect_eq sup_absorb1 these_image_Some_eq)\n\n\nlemma SUP_eq_None_iff: \"(SUP f\\<in>X. f x) = None \\<longleftrightarrow> X={} \\<or> (\\<forall>f\\<in>X. f x = None)\"\n  by (smt SUP_bot_conv(2) SUP_empty Sup_empty empty_Sup)\n\nlemma SUP_eq_Some_iff: \"(SUP f\\<in>X. f x) = Some t \\<longleftrightarrow> (\\<exists>f\\<in>X. f x \\<noteq> None) \\<and> (t=Sup {t' | f t'. f\\<in>X \\<and> f x = Some t' })\"\n  apply auto\n  subgoal \n    by (smt Sup_bot_conv(1) Sup_empty Sup_option_def Sup_pointwise_eq_fun imageE option.distinct(1))\n  subgoal \n    unfolding Sup_option_def\n    apply (clarsimp split: if_splits)\n    apply (fo_rule arg_cong)\n    apply (auto simp: Option.these_def)\n    apply (metis (mono_tags, lifting) image_iff mem_Collect_eq option.sel)\n    apply (metis (mono_tags, lifting) image_iff mem_Collect_eq option.sel)\n    done\n  subgoal \n    unfolding Sup_option_def\n    apply (clarsimp split: if_splits; safe)\n    subgoal by (force simp: image_iff)\n    apply (fo_rule arg_cong)\n    apply (auto simp: Option.these_def)\n    apply (metis (mono_tags, lifting) image_iff mem_Collect_eq option.sel)\n    done\n  done  \n\n\n\nlemma Sup_enat_less: \"X \\<noteq> {} \\<Longrightarrow> enat t \\<le> Sup X \\<longleftrightarrow> (\\<exists>x\\<in>X. enat t \\<le> x)\"\n  apply rule\n  subgoal \n  by (metis Max_in Sup_enat_def finite_enat_bounded linear) \n  subgoal apply auto\n    by (simp add: Sup_upper2)\n  done\n\n\n(* \n  This is how implication can be phrased with an Inf operation.\n  Generalization from boolean to enat can be explained this way.\n *)\n\nlemma fixes Q P  shows\n    \"Inf { P x \\<le> Q x |x. True}  \\<longleftrightarrow> P \\<le> Q\" unfolding le_fun_def by simp\n\n\nsubsection \\<open>continuous\\<close>\nterm sup_continuous  \n\ntext \\<open>That might by Scott continuity;\n      \n     https://en.wikipedia.org/wiki/Scott_continuity \\<close>\n\n\ntext \\<open>There is scott_continuous in Complete_Non_Orders.Fixed_Points\\<close>\n\ndefinition continuous :: \"('a::{Sup} \\<Rightarrow> 'b::{Sup}) \\<Rightarrow> bool\"  where\n  \"continuous f \\<longleftrightarrow> (\\<forall>A. Sup (f ` A) = f (Sup A) )\"\n\n\nterm sup_continuous\nthm continuous_at_Sup_mono\n\nlemma \"continuous (f::'a::{complete_lattice}\\<Rightarrow>'b::{complete_lattice})\n         \\<longleftrightarrow> (\\<forall>A. Inf (f ` A) = f (Inf A) )\" (* wrong conjecture *) oops\n  \nlemma continuousI: \"(\\<And>A. f (Sup A) = Sup (f ` A)) \\<Longrightarrow> continuous f\" by (auto simp: continuous_def)\nlemma continuousD: \"continuous f \\<Longrightarrow> f (Sup A) = Sup (f ` A)\" by (auto simp: continuous_def)\n\n\nlemma continuous_Domain: \"continuous Domain\"\n  apply(rule continuousI) by (fact Domain_Union)\n\nlemma continuous_Range: \"continuous Range\"\n  apply(rule continuousI) by (fact Range_Union)\n  \n\n\nsubsubsection \\<open>combinations are continuous\\<close>\n\n\nlemma continuous_app: \"continuous (\\<lambda>f. f x)\"\n  apply(rule continuousI)\n  by simp\n\n\nlemma \n  continuous_fun:\n  assumes *: \"continuous f\" shows \"continuous  (\\<lambda>X x. (f (X x)))\"\n  apply(rule continuousI)\n  unfolding Sup_fun_def  apply(rule ext) \n  apply(subst continuousD[OF *]) apply(subst image_image) apply(subst image_image) ..\n\n\n\nlemma SupD: \"Sup A = Some f \\<Longrightarrow> A \\<noteq> {} \\<and> A\\<noteq>{None}\"\n  unfolding Sup_option_def by auto\n\n\nlemma ffF: \"Option.these (case_option None (\\<lambda>e. Some (f e)) ` A)\n        = f `(Option.these A)\"\n  unfolding Option.these_def apply (auto split: option.splits)\n   apply force   \n  using image_iff by fastforce \n\nlemma zzz: \"Option.these A \\<noteq> {}\n \\<Longrightarrow> Sup ( (\\<lambda>x. case x of None \\<Rightarrow> None | Some e \\<Rightarrow> Some (f e)) ` A)\n        = Some (Sup ( f ` Option.these A))\"\n  apply(subst Sup_option_def)\n  apply simp\n  apply safe\n  subgoal  \n    by simp  \n  subgoal  \n    by (metis SupD aux11 empty_Sup in_these_eq option.simps(5))  \n  subgoal apply(subst ffF) by simp \n  done\n\n\nlemma assumes \"continuous f\"\n  shows \"continuous (case_option None (Some o f))\" (* TODO: generalize to adding top/bottom element *)\n  apply(rule continuousI)\n  apply(auto split: option.splits)\n  subgoal unfolding Sup_option_def by (auto split: if_splits)\nproof -\n  fix A   and a :: \"'a::{complete_lattice}\"\n  assume a: \"Sup A = Some a\"\n  with SupD have A: \"A \\<noteq> {} \\<and> A \\<noteq> {None}\" by auto\n\n  then have a': \"a= Sup (Option.these A)\"  \n    by (metis Sup_option_def a option.inject)\n\n  from A have oA: \"Option.these A \\<noteq> {}\" unfolding Option.these_def by auto\n\n  have *: \"\\<And>x. Some (f x) = (Some o f) x\" by simp\n  have \"(SUP x\\<in>A. case x of None \\<Rightarrow> None | Some x \\<Rightarrow> (Some \\<circ> f) x)\n        = (SUP x\\<in>A. case x of None \\<Rightarrow> None | Some s \\<Rightarrow> Some (f s))\"\n    by(simp only: *) \n  also have \"\\<dots> = Some (SUP s\\<in>(Option.these A). (f s))\"\n   using oA zzz by metis \n        \n  also have \"(SUP s\\<in>(Option.these A). (f s)) = f a\"\n    using a' assms(1)[THEN continuousD] by metis \n\n  finally show \"Some (f a) = (SUP x\\<in>A. case x of None \\<Rightarrow> None | Some x \\<Rightarrow> (Some \\<circ> f) x)\"  by simp\nqed  \n  \ntext \\<open>a shorter proof\\<close>\n\nlemma my_these_def: \"Option.these M = {f. Some f \\<in> M}\"\n  unfolding  Option.these_def by (auto intro: rev_image_eqI)  \n\nlemma option_Some_image: \n    \"A \\<noteq> {} \\<Longrightarrow> A \\<noteq> {None} \\<Longrightarrow> case_option None (Some \\<circ> f) ` A \\<noteq> {None}\" \n  by (metis (mono_tags, hide_lams) comp_apply empty_iff everywhereNone\n                  imageI in_these_eq option.exhaust option.simps(5) these_insert_None)\n\nlemma continuous_option: (* or generally, adding a bottom element *)\n  assumes *: \"continuous f\"\n  shows \"continuous (case_option None (Some o f))\"\n  apply(rule continuousI)\n  unfolding Sup_option_def[unfolded my_these_def] \n  apply (simp add: option_Some_image continuousD[OF *])\n  apply rule+\n  apply(rule arg_cong[where f=Sup]) \n    by  (auto split: option.splits  intro: rev_image_eqI)   \n\n\nabbreviation (input) \"SUPREMUM S f \\<equiv> Sup (f ` S)\" \n\ndefinition myminus where \"myminus x y = (if x=\\<infinity> \\<and> y=\\<infinity> then 0 else x - y)\"\nlemma \"(a::enat) + x \\<ge> b  \\<longleftrightarrow> x \\<ge> myminus b a \"\n  unfolding myminus_def\n  apply(cases a; cases b; cases x) apply auto oops\n\n\n\n\nsection \"NREST\"\n\ndatatype ('a,'b) nrest = FAILi | REST \"'a \\<Rightarrow> ('b::complete_lattice) option\"\n\n\n                   \ninstantiation nrest :: (type,complete_lattice) complete_lattice\nbegin\n\nfun less_eq_nrest where\n  \"_ \\<le> FAILi \\<longleftrightarrow> True\" |\n  \"(REST a) \\<le> (REST b) \\<longleftrightarrow> a \\<le> b\" |\n  \"FAILi \\<le> (REST _) \\<longleftrightarrow> False\"\n\nfun less_nrest where\n  \"FAILi < _ \\<longleftrightarrow> False\" |\n  \"(REST _) < FAILi \\<longleftrightarrow> True\" |\n  \"(REST a) < (REST b) \\<longleftrightarrow> a < b\"\n\nfun sup_nrest where\n  \"sup _ FAILi = FAILi\" |\n  \"sup FAILi _ = FAILi\" |\n  \"sup (REST a) (REST b) = REST (\\<lambda>x. sup (a x) (b x))\"\n\nfun inf_nrest where \n  \"inf x FAILi = x\" |\n  \"inf FAILi x = x\" |\n  \"inf (REST a) (REST b) = REST (\\<lambda>x. inf (a x) (b x))\"\n\nlemma \"min (None) (Some (1::enat)) = None\" by simp\nlemma \"max (None) (Some (1::enat)) = Some 1\" by eval\n\ndefinition \"Sup X \\<equiv> if FAILi\\<in>X then FAILi else REST (Sup {f . REST f \\<in> X})\"\ndefinition \"Inf X \\<equiv> if \\<exists>f. REST f\\<in>X then REST (Inf {f . REST f \\<in> X}) else FAILi\"\n\ndefinition \"bot \\<equiv> REST (Map.empty)\"\ndefinition \"top \\<equiv> FAILi\"\n\ninstance\n  apply(intro_classes)\n  unfolding Sup_nrest_def  Inf_nrest_def  bot_nrest_def top_nrest_def\n  apply (case_tac x, case_tac [!] y, auto) []\n  apply (case_tac x, auto) []\n  apply (case_tac x, case_tac [!] y, case_tac [!] z, auto) []\n  apply (case_tac x, (case_tac [!] y)?, auto) []\n  apply (case_tac x, (case_tac [!] y)?, simp_all  add: le_fun_def) []\n  apply (case_tac x, (case_tac [!] y)?, auto   simp: le_fun_def) []\n  apply (case_tac x, case_tac [!] y, case_tac [!] z, auto   simp: le_fun_def) []\n  apply (case_tac x, (case_tac [!] y)?, auto   simp: le_fun_def) []\n  apply (case_tac x, (case_tac [!] y)?, auto   simp: le_fun_def) []\n  apply (case_tac x, case_tac [!] y, case_tac [!] z, auto   simp: le_fun_def) []\n  apply (case_tac x, auto simp add: Inf_lower ) [] \n  apply (case_tac z, fastforce+) [] using le_Inf_iff apply fastforce\n  apply (case_tac x, auto simp add: Sup_upper) []\n  apply (case_tac z, fastforce+) []  using Sup_le_iff less_eq_nrest.simps(2) apply fastforce\n  apply auto []\n  apply (auto simp: bot_option_def) []\n  done   \nend\n\n\ndefinition RETURNT :: \"'a \\<Rightarrow> ('a, 'b::{complete_lattice, zero}) nrest\" where\n  \"RETURNT x \\<equiv> REST (\\<lambda>e. if e=x then Some 0 else None)\"\nabbreviation \"FAILT \\<equiv> top::(_,_) nrest\"\nabbreviation \"SUCCEEDT \\<equiv> bot::(_,_) nrest\"\nabbreviation SPECT where \"SPECT \\<equiv> REST\"\n\n\ndefinition \"consume M t \\<equiv> case M of \n          FAILi \\<Rightarrow> FAILT |\n          REST X \\<Rightarrow> REST (map_option ((+) t) o (X))\"\n\n\ndefinition \"SPEC P t = REST (\\<lambda>v. if P v then Some (t v) else None)\"\n\n\nlemma consume_mono:\n  fixes  t :: \"'a::{ordered_ab_semigroup_add,complete_lattice}\"\n  shows \"t\\<le>t' \\<Longrightarrow> M \\<le> M' \\<Longrightarrow> consume M t \\<le> consume M' t'\"\n  unfolding consume_def apply (auto split: nrest.splits )\n  unfolding le_fun_def apply auto\n  subgoal for m m' x apply(cases \"m' x\";cases \"m x\" ) apply auto\n     apply (metis less_eq_option_Some_None)        \n    by (metis add_mono less_eq_option_Some)  \n  done\n\ninstantiation unit :: plus\nbegin\nfun plus_unit where \"() + () = ()\"\ninstance\n  apply(intro_classes) .\nend\n\ninstantiation unit :: zero\nbegin\ndefinition zero_unit where \"0 = ()\"\ninstance\n  apply(intro_classes) .\nend\n(*\ninstantiation \"fun\" :: (type, zero) zero\nbegin \nfun zero_fun where \"zero_fun x = 0\"\ninstance\n  apply(intro_classes) .\nend\n*)\n\ninstantiation unit :: ordered_ab_semigroup_add\nbegin \ninstance\n  apply(intro_classes) by auto\nend \n\n\n(*\ninstantiation \"fun\" :: (type, ordered_ab_semigroup_add) ordered_ab_semigroup_add\nbegin \n\nfun plus_fun where \"plus_fun a b x= a x + b x\"\n\nterm \"a::('f::ab_semigroup_add)\"\n\nthm ab_semigroup_add.add_commute\n\ninstance\n  apply(intro_classes)\n  subgoal apply (rule ext) by (simp add: add.assoc)\n  subgoal apply (rule ext) by (simp add: add.commute)\n  subgoal by (simp add: add_left_mono le_fun_def)  \n  done\nend \n*)\nlemma RETURNT_alt: \"RETURNT x = REST [x\\<mapsto>0]\"\n  unfolding RETURNT_def by auto\n\nlemma nrest_inequalities[simp]: \n  \"FAILT \\<noteq> REST X\"\n  \"FAILT \\<noteq> SUCCEEDT\" \n  \"FAILT \\<noteq> RETURNT x\"\n  \"SUCCEEDT \\<noteq> FAILT\"\n  \"SUCCEEDT \\<noteq> RETURNT x\"\n  \"REST X \\<noteq> FAILT\"\n  \"RETURNT x \\<noteq> FAILT\"\n  \"RETURNT x \\<noteq> SUCCEEDT\"\n  unfolding top_nrest_def bot_nrest_def RETURNT_def  \n  apply (auto) by (metis option.distinct(1))+\n\n\nlemma nrest_more_simps[simp]:\n  \"SUCCEEDT = REST X \\<longleftrightarrow> X=Map.empty\" \n  \"REST X = SUCCEEDT \\<longleftrightarrow> X=Map.empty\" \n  \"REST X = RETURNT x \\<longleftrightarrow> X=[x\\<mapsto>0]\" \n  \"REST X = REST Y \\<longleftrightarrow> X=Y\"\n  \"RETURNT x = REST X \\<longleftrightarrow> X=[x\\<mapsto>0]\"\n  \"RETURNT x = RETURNT y \\<longleftrightarrow> x=y\" \n  unfolding top_nrest_def bot_nrest_def RETURNT_def apply (auto split: if_splits)\n  by (metis option.distinct(1)) \n\n\nlemma nres_simp_internals: \n  \"REST Map.empty = SUCCEEDT\"\n   \"FAILi = FAILT\" \n  unfolding top_nrest_def bot_nrest_def by simp_all\n\n\nlemma nres_order_simps[simp]:\n  \"\\<not> FAILT \\<le> REST M\" \n  \"REST M \\<le> REST M' \\<longleftrightarrow> (M\\<le>M')\"\n  by (auto simp: nres_simp_internals[symmetric])   \n\nlemma nres_top_unique[simp]:\" FAILT \\<le> S' \\<longleftrightarrow> S' = FAILT\"\n  by (rule top_unique) \n\nlemma FAILT_cases[simp]: \"(case FAILT of FAILi \\<Rightarrow> P | REST x \\<Rightarrow> Q x) = P\"\n  by (auto simp: nres_simp_internals[symmetric])  \n\nlemma nrest_Sup_FAILT: \n  \"Sup X = FAILT \\<longleftrightarrow> FAILT \\<in> X\"\n  \"FAILT = Sup X \\<longleftrightarrow> FAILT \\<in> X\"\n  by (auto simp: nres_simp_internals Sup_nrest_def)\n\n\nlemma nrest_Sup_SPECT_D: \"Sup X = SPECT m \\<Longrightarrow> m x = Sup {f x | f. REST f \\<in> X}\"\n  unfolding Sup_nrest_def apply(auto split: if_splits) unfolding Sup_fun_def  \n  apply(fo_rule arg_cong) by blast\n\ndeclare nres_simp_internals(2)[simp]\n\nlemma nrest_noREST_FAILT[simp]: \"(\\<forall>x2. m \\<noteq> REST x2) \\<longleftrightarrow> m=FAILT\"\n  apply (cases m) apply auto done\n\nlemma   no_FAILTE:  \n  assumes \"g xa \\<noteq> FAILT\" \n  obtains X where \"g xa = REST X\" using assms by (cases \"g xa\") auto\n\n\nlemma case_prod_refine:\n  fixes P Q :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('c,_) nrest\"\n  assumes\n    \"\\<And>a b. P a b \\<le> Q a b\"\n  shows\n \"(case x of (a,b) \\<Rightarrow> P a b) \\<le> (case x of (a,b) \\<Rightarrow> Q a b)\"\n  using assms \n  by (simp add: split_def)\n\nlemma case_option_refine: (* obsolete ? *)\n  fixes P Q :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('c,_) nrest\"\n  assumes\n    \"PN \\<le> QN\"\n    \"\\<And>a. PS a \\<le> QS a\"\n  shows\n \"(case x of None \\<Rightarrow> PN | Some a \\<Rightarrow> PS a ) \\<le> (case x of None \\<Rightarrow> QN | Some a \\<Rightarrow> QS a )\"\n  using assms \n  by (auto split: option.splits)\n\n\nsection \"time refine\"\n\n\ndefinition timerefine ::\"('b \\<Rightarrow> 'c \\<Rightarrow> enat)  \\<Rightarrow> ('a, 'b \\<Rightarrow> enat) nrest \\<Rightarrow> ('a, 'c \\<Rightarrow> enat) nrest\"  where\n  \"timerefine R m = (case m of FAILi \\<Rightarrow> FAILi |\n                REST M \\<Rightarrow> REST (\\<lambda>r. case M r of None \\<Rightarrow> None |\n                  Some cm \\<Rightarrow> Some (\\<lambda>cc. Sum_any (\\<lambda>ac. cm ac * R ac cc))))\"\n\ndefinition wfn :: \"('a, 'b \\<Rightarrow> enat) nrest \\<Rightarrow> bool\" where\n  \"wfn m = (case m of FAILi \\<Rightarrow> True |\n                REST M \\<Rightarrow> \\<forall>r\\<in>dom M. (case M r of None \\<Rightarrow> True | Some cm \\<Rightarrow> finite {x. cm x \\<noteq> 0}))\"\n\ndefinition wfR :: \"('b \\<Rightarrow> 'c \\<Rightarrow> enat) \\<Rightarrow> bool\" where\n  \"wfR R = (finite {(s,f). R s f \\<noteq> 0})\"\n\n\n\n\n\nlemma wfR_fst: \"\\<And>y. wfR R \\<Longrightarrow> finite {x. R x y \\<noteq> 0}\"\n  unfolding wfR_def apply(rule finite_subset[where B=\"fst ` {(s, f). R s f \\<noteq> 0}\"])\n  subgoal by auto\n  apply(rule finite_imageI) by simp\n\nlemma wfR_snd: \"\\<And>x. wfR R \\<Longrightarrow> finite {y. R x y \\<noteq> 0}\"\n  unfolding wfR_def apply(rule finite_subset[where B=\"snd ` {(s, f). R s f \\<noteq> 0}\"])\n  subgoal by auto\n  apply(rule finite_imageI) by simp\n\n(*\nlemma finite_same_support:\n  \"\\<And>f. finite {(x,y). R x y \\<noteq> 0} \\<Longrightarrow> (\\<And>x.  f (R x) = 0 \\<longleftrightarrow> R x = 0) \\<Longrightarrow> finite {x. f (R x) \\<noteq> 0}\"\n  oops*)\n\nlemma \n  finite_wfR_middle_mult:\n  assumes \"wfR R1\" \"wfR R2\"\n  shows \"finite {a. R2 x a * R1 a y \\<noteq> (0::enat)}\"\nproof -\n  have \"{a. R2 x a * R1 a y \\<noteq> 0} = {a. R2 x a \\<noteq> 0 \\<and> R1 a y \\<noteq> 0}\" by simp\n  also have \"\\<dots> \\<subseteq> fst ` {(a,a)| a. R2 x a \\<noteq> 0 \\<and> R1 a y \\<noteq> 0}\" by auto\n  also have \"\\<dots> \\<subseteq> fst ` ({a. R2 x a \\<noteq> 0} \\<times> {a. R1 a y \\<noteq> 0})\"\n    apply(rule image_mono) by auto\n  finally\n  show ?thesis apply(rule finite_subset)\n    apply(rule finite_imageI)\n    apply(rule finite_cartesian_product)\n    apply(rule wfR_snd) apply fact\n    apply(rule wfR_fst) by fact\nqed\n\n\n\nlemma wfR_finite_mult_left:\n  assumes \"wfR R2\"\n  shows \"finite {a. Mc a * R2 a ac \\<noteq> (0::enat)}\"\nproof -\n\n  have \"{a. Mc a * R2 a ac \\<noteq> 0} \\<subseteq> {a. R2 a ac \\<noteq> 0}\"\n    by auto\n  then\n  show ?thesis\n    apply(rule finite_subset)\n    apply(rule wfR_fst) by fact\nqed\n\n\n\n\nlemma \n  wfR_finite_crossprod:\n  assumes \"wfR R2\"\n  shows \"finite ({a. \\<exists>b. Mc a * (R2 a b * R1 b cc) \\<noteq> (0::enat)} \\<times> {b. \\<exists>a. Mc a * (R2 a b * R1 b cc) \\<noteq> 0})\"\nproof -\n  have i: \"{a. \\<exists>b. Mc a * (R2 a b * R1 b cc) \\<noteq> 0} \\<subseteq> fst ` ({(a,b).  R2 a b \\<noteq> 0} \\<inter> {(a,b). R1 b cc \\<noteq> 0})\" by auto\n  have ii: \"{b. \\<exists>a. Mc a * (R2 a b * R1 b cc) \\<noteq> 0} \\<subseteq> snd ` ({(a,b).  R2 a b \\<noteq> 0} \\<inter> {(a,b). R1 b cc \\<noteq> 0})\" by auto\n  \n\n  show ?thesis \n    apply(rule finite_cartesian_product)\n    subgoal  apply(rule finite_subset[OF i]) apply(rule finite_imageI)\n      apply(rule finite_Int)   using assms wfR_def by auto\n    subgoal  apply(rule finite_subset[OF ii]) apply(rule finite_imageI)\n      apply(rule finite_Int)   using assms wfR_def by auto\n    done    \nqed\n\nlemma wfR_finite_Sum_any: \n  assumes *: \"wfR R\"\n  shows \"finite {x. ((Sum_any (\\<lambda>ac. ((Mc ac) * (R ac x)))) \\<noteq> (0::enat))}\"\nproof - \n  {fix x\n    have \"((Sum_any (\\<lambda>ac. ((Mc ac) * (R ac x)))) \\<noteq> 0)\n      \\<Longrightarrow> \\<exists>ac. (Mc ac) * (R ac x) \\<noteq> 0\"\n      using Sum_any.not_neutral_obtains_not_neutral by blast \n  } then \n  have \"{x. ((Sum_any (\\<lambda>ac. ((Mc ac) * (R ac x)))) \\<noteq> 0)}\n          \\<subseteq> {x. \\<exists>ac. ((Mc ac) * (R ac x)) \\<noteq> 0}\" by blast\n  also have \"\\<dots> \\<subseteq> snd ` {(ac,x). ((Mc ac) * (R ac x)) \\<noteq> 0}\" by auto \n  also have \"\\<dots> \\<subseteq> snd ` {(ac,x).  (R ac x) \\<noteq> 0}\" by auto\n\n  finally  show ?thesis \n    apply(rule finite_subset )\n    apply(rule finite_imageI) using * unfolding wfR_def by auto\nqed \n\n\n\nlemma assumes \"R' \\<le> R\" \"wfR R\" shows \"wfR R'\"\nproof -                                    \n  from assms(1) have *: \"\\<And> a b. R' a b\\<le> R a b\"\n  unfolding le_fun_def   by auto\n  {fix  a b have \"R a b  = 0 ==> R' a b = 0 \"   \n      using * [of a b] by auto}\n  note f=this\n  show \"wfR R'\"\n    using \\<open>wfR R\\<close> unfolding wfR_def apply(rule rev_finite_subset)\n    apply safe using f by simp\nqed\n\nlemma wfn_timerefine: \"wfn m \\<Longrightarrow> wfR R \\<Longrightarrow> wfn (timerefine R m)\"\nproof -\n  assume \"wfR R\"\n  then show \"wfn (timerefine R m)\"\n    unfolding wfn_def timerefine_def \n    apply(auto split: nrest.splits option.splits)\n    apply(rule wfR_finite_Sum_any) by simp\nqed\n\n\nlemma [simp]: \"timerefine R FAILT = FAILT\" by(auto simp: timerefine_def)\n\ndefinition pp where\n  \"pp R2 R1 = (\\<lambda>a c. Sum_any (%b. R1 a b * R2 b c  ) )\"\n\nlemma Sum_any_mono:\n  assumes fg: \"\\<And>x.    f x \\<le> g x\"\n    and finG: \"finite {x. g x \\<noteq> (0::enat)}\"\nshows \"Sum_any f \\<le> Sum_any g\"\nproof -\n  have \"{x. f x \\<noteq> (0::enat)} \\<subseteq> {x. g x \\<noteq> (0::enat)}\"\n    apply auto using fg   \n    by (metis ile0_eq)  \n  with finG have \"finite {x. f x \\<noteq> (0::enat)}\"  \n    using finite_subset by blast   \n\n  thm sum_mono sum_mono2\n  \n  have \"sum f {x. f x \\<noteq> (0::enat)} \\<le> sum f {x. g x \\<noteq> (0::enat)}\"\n    apply(rule sum_mono2) apply fact apply fact\n    by simp\n  also have \"\\<dots> \\<le> sum g {x. g x \\<noteq> (0::enat)}\"\n    apply(rule sum_mono) using fg by simp\n  finally show ?thesis unfolding Sum_any.expand_set .\nqed\n\nlemma finite_support_mult:  \n  assumes \"finite {xa.  R1 xa \\<noteq> (0::enat)}\"\n  and \"finite {xa. R2 xa \\<noteq> 0}\"\nshows \"finite {xa. R2 xa * R1 xa \\<noteq> 0}\"\nproof -\n \n  have \"{(xa,xa)|xa. R2 xa * R1 xa \\<noteq> 0} = {(xa,xa)|xa. R2 xa \\<noteq> 0 \\<and> R1 xa \\<noteq> 0}\" by auto\n  also have \"\\<dots> \\<subseteq> {(xa,xb)|xa xb. R2 xa \\<noteq> 0 \\<and> R1 xb \\<noteq> 0}\" by auto\n  also have \"\\<dots> = {xa. R2 xa \\<noteq> 0} \\<times> {xb. R1 xb \\<noteq> 0}\" by auto \n  finally have k: \"{xa. R2 xa * R1 xa \\<noteq> 0} \\<subseteq> fst ` ({xa. R2 xa \\<noteq> 0} \\<times> {xb. R1 xb \\<noteq> 0})\" by blast\n\n  show ?thesis\n    apply(rule finite_subset[OF k])\n    apply(rule finite_imageI) \n    apply(rule finite_cartesian_product) by fact+\nqed\n\n\nlemma timerefine_mono: \n  assumes \"wfR R\"\n  shows \"c\\<le>c' \\<Longrightarrow> timerefine R c \\<le> timerefine R c'\"\n  apply(cases c) apply simp\n  apply(cases c') apply (auto simp: timerefine_def split: nrest.splits option.splits simp: le_fun_def)\n  subgoal  by (metis le_some_optE) \n  proof (goal_cases)\n    case (1 x2 x2a x x2b x2c xa)\n    then have l: \"\\<And>ac. x2b ac \\<le> x2c ac\"  \n      by (metis le_funD less_eq_option_Some)    \n    show ?case \n      apply(rule Sum_any_mono)\n      subgoal using l apply(rule mult_right_mono) by simp\n      apply(rule wfR_finite_mult_left) by fact\n  qed \n\n\nlemma assumes \"wfR R1\" \"wfR R2\"\n  shows timerefine_iter: \"timerefine R1 (timerefine R2 c) =  timerefine (pp R1 R2) c\"\n  unfolding timerefine_def \n  apply(cases c) apply simp \n  apply (auto simp: le_fun_def pp_def split: option.splits) apply (rule ext)\n  apply (auto simp: le_fun_def pp_def split: option.splits) \n    apply(subst Sum_any_right_distrib)\n  subgoal apply(rule finite_wfR_middle_mult) using assms by simp_all\n    apply (rule ext)\n  subgoal for mc r Mc cc\n        apply (subst Sum_any.swap[where C=\"{a. \\<exists>b. Mc a * (R2 a b * R1 b cc) \\<noteq> 0} \\<times> {b. \\<exists>a. Mc a * (R2 a b * R1 b cc) \\<noteq> 0}\"])\n        subgoal apply(rule wfR_finite_crossprod) using assms by simp\n        subgoal by simp \n        apply(subst Sum_any_left_distrib)\n        subgoal apply(rule wfR_finite_mult_left) using assms by simp \n        by (meson Sum_any.cong ab_semigroup_mult_class.mult_ac(1))  \n      done \n\nlemma timerefine_trans: \n  assumes \"wfR R1\" \"wfR R2\" shows \n  \"a \\<le> timerefine R1 b \\<Longrightarrow> b \\<le> timerefine R2 c \\<Longrightarrow> a \\<le> timerefine (pp R1 R2) c\"\n  apply(subst timerefine_iter[symmetric, OF assms])\n    apply(rule order.trans) apply simp\n    apply(rule timerefine_mono) using assms by auto\n\n   \n\n\n\nsection \"pointwise reasoning\"\n\nnamed_theorems refine_pw_simps \nML \\<open>\n  structure refine_pw_simps = Named_Thms\n    ( val name = @{binding refine_pw_simps}\n      val description = \"Refinement Framework: \" ^\n        \"Simplifier rules for pointwise reasoning\" )\n\\<close>    \n  \ndefinition nofailT :: \"('a,_) nrest \\<Rightarrow> bool\" where \"nofailT S \\<equiv> S\\<noteq>FAILT\"\n\n\nlemma nofailT_simps[simp]:\n  \"nofailT FAILT \\<longleftrightarrow> False\"\n  \"nofailT (REST X) \\<longleftrightarrow> True\"\n  \"nofailT (RETURNT x) \\<longleftrightarrow> True\"\n  \"nofailT SUCCEEDT \\<longleftrightarrow> True\"\n  unfolding nofailT_def\n  by (simp_all add: RETURNT_def)\n\n\nlemma pw_Sup_nofail[refine_pw_simps]: \"nofailT (Sup X) \\<longleftrightarrow> (\\<forall>x\\<in>X. nofailT x)\"\n  apply (cases \"Sup X\")  \n   apply auto unfolding Sup_nrest_def apply (auto split: if_splits)\n  apply force unfolding nofailT_def apply(force simp add: nres_simp_internals)\n  done\n\nlemma nofailT_SPEC[refine_pw_simps]: \"nofailT (SPEC a b)\"\n  unfolding SPEC_def by auto\n\n\nsubsection \"pw reasoning for enat\"\n\ndefinition inresT :: \"('a,enat) nrest \\<Rightarrow> 'a \\<Rightarrow> nat \\<Rightarrow> bool\" where \n  \"inresT S x t \\<equiv> (case S of FAILi \\<Rightarrow> True | REST X \\<Rightarrow> (\\<exists>t'. X x = Some t' \\<and>  enat t\\<le>t'))\"\n\nlemma inresT_alt: \"inresT S x t \\<longleftrightarrow> REST ([x\\<mapsto>enat t]) \\<le> S\"\n  unfolding inresT_def apply(cases S)  \n  by (auto dest!: le_funD[where x=x] simp: le_funI less_eq_option_def split: option.splits )\n\nlemma inresT_mono: \"inresT S x t \\<Longrightarrow> t' \\<le> t \\<Longrightarrow> inresT S x t'\"\n  unfolding inresT_def apply(cases S) apply auto\n  using enat_ord_simps(1) order_trans by blast\n\nlemma inresT_RETURNT[simp]: \"inresT (RETURNT x) y t \\<longleftrightarrow> t = 0 \\<and> y = x\"\n  by(auto simp: inresT_def RETURNT_def enat_0_iff split: nrest.splits)\n\nlemma inresT_FAILT[simp]: \"inresT FAILT r t\"\n  by(simp add: inresT_def)\n\nlemma fail_inresT[refine_pw_simps]: \"\\<not> nofailT M \\<Longrightarrow> inresT M x t\"\n  unfolding nofailT_def by simp\n\nlemma pw_inresT_Sup[refine_pw_simps]: \"inresT (Sup X) r t \\<longleftrightarrow> (\\<exists>M\\<in>X. \\<exists>t'\\<ge>t.  inresT M r t')\"\n  apply(rule)\n  subgoal (* \\<rightarrow> *)\n    apply(cases \"Sup X\")\n    subgoal by (force simp: nrest_Sup_FAILT)\n    subgoal \n      apply(auto simp: inresT_def  Sup_nrest_def split: if_splits)\n      apply(auto simp: SUP_eq_Some_iff split: nrest.splits)  \n      apply(subst (asm) Sup_enat_less)\n       apply auto []  \n      apply auto  by blast  \n    done\n  subgoal (* <- *)\n    apply(cases \"Sup X\")\n    subgoal by (auto simp: nrest_Sup_FAILT top_Sup)\n    subgoal \n      apply(auto simp: inresT_def  Sup_nrest_def split: if_splits)\n      apply(auto simp: SUP_eq_Some_iff split: nrest.splits)  \n      apply(subst Sup_enat_less)\n       apply auto []\n      apply auto\n      using dual_order.trans enat_ord_simps(1) by blast \n    done\n  done\n         \nlemma inresT_REST[simp]:\n  \"inresT (REST X) x t \\<longleftrightarrow> (\\<exists>t'\\<ge>t. X x = Some t')\" \n  unfolding inresT_def \n  by (auto )\n\n\n\nlemma inres_simps[simp]:\n  \"inresT FAILT = (\\<lambda>_ _. True)\" \n  \"inresT SUCCEEDT = (\\<lambda>_ _ . False)\"\n  unfolding inresT_def [abs_def]\n  by (auto split: nrest.splits simp add: RETURNT_def) \n \nlemma pw_le_iff: \n  \"S \\<le> S' \\<longleftrightarrow> (nofailT S'\\<longrightarrow> (nofailT S \\<and> (\\<forall>x t. inresT S x t \\<longrightarrow> inresT S' x t)))\"\n  apply (cases S; cases S', simp_all)\n  unfolding nofailT_def inresT_def apply (auto split: nrest.splits) \n   apply (metis le_fun_def le_some_optE order.trans) \n  apply(auto intro!: le_funI simp: less_eq_option_def split: option.splits)\n  apply (metis option.distinct(1) zero_enat_def zero_le)\n  by (smt Suc_ile_eq enat.exhaust linorder_not_le option.simps(1) order_refl) \n\nlemma pw_eq_iff:\n  \"S=S' \\<longleftrightarrow> (nofailT S = nofailT S' \\<and> (\\<forall>x t. inresT S x t \\<longleftrightarrow> inresT S' x t))\"\n  apply (rule iffI)\n  apply simp\n  apply (rule antisym)\n  apply (auto simp add: pw_le_iff)\n  done\n\nlemma pw_flat_ge_iff: \"flat_ge S S' \\<longleftrightarrow> \n  (nofailT S) \\<longrightarrow> nofailT S' \\<and> (\\<forall>x t. inresT S x t \\<longleftrightarrow> inresT S' x t)\"\n  apply (simp add: flat_ord_def)\n  apply(simp add: pw_eq_iff) apply safe\n  by (auto simp add: nofailT_def)   \n\n\n\nlemma pw_eqI: \n  assumes \"nofailT S = nofailT S'\" \n  assumes \"\\<And>x t. inresT S x t \\<longleftrightarrow> inresT S' x t\" \n  shows \"S=S'\"\n  using assms by (simp add: pw_eq_iff)\n\n\nlemma inresT_SPEC[refine_pw_simps]: \"inresT (SPEC a b) = (\\<lambda>x t. a x \\<and>  b x \\<ge> t)\"\n    unfolding SPEC_def inresT_REST apply(rule ext) by(auto split: if_splits)\n\n\n\nsubsection \"pw reasoning for 'b => enat\" \n\n\ndefinition inresT2 :: \"('a,'b \\<Rightarrow> enat) nrest \\<Rightarrow> 'a \\<Rightarrow> ('b \\<Rightarrow> nat) \\<Rightarrow> bool\" where \n  \"inresT2 S x t \\<equiv> (case S of FAILi \\<Rightarrow> True | REST X \\<Rightarrow> (\\<exists>t'. X x = Some t' \\<and>  enat o t\\<le>t'))\"\n\n\nlemma inresT2_REST[simp]:\n  \"inresT2 (SPECT X) x t \\<longleftrightarrow> (\\<exists>t'\\<ge>t. X x = Some t')\" \n  unfolding inresT2_def \n  by (auto simp: le_fun_def)\n\ndefinition limitF :: \"'b \\<Rightarrow> ('b\\<Rightarrow>enat) \\<Rightarrow> enat\" where\n  \"limitF b f  \\<equiv> f b\"\n\nlemma limitF: \"limitF b (Sup A)  = Sup (limitF b ` A)\"\n  unfolding limitF_def by simp\n\n\nlemma continuous_limitF: \"continuous (limitF b)\"\n  apply(rule continuousI) by (fact limitF)\n\nlemma limitF_Inf: \"limitF b (Inf A)  = Inf (limitF b ` A)\"\n  unfolding limitF_def by simp\n\ndefinition limitO :: \"'b \\<Rightarrow> ( ('b \\<Rightarrow> enat) option) \\<Rightarrow> enat option\" where\n  \"limitO b F = (case F of None \\<Rightarrow> None | Some f \\<Rightarrow> Some (limitF b f) )\"\n\n\n                                             \nlemma \"(SUP e\\<in>A. (f e)) = Sup (f ` A)\" by simp\n \nlemma limitO: \"limitO b (Sup A) = Sup (limitO b ` A)\"\n  unfolding limitO_def apply(auto split: option.splits)\n  subgoal unfolding Sup_option_def by (auto split: if_splits)\nproof -\n  fix a assume a: \"Sup A = Some a\"\n  with SupD have A: \"A \\<noteq> {} \\<and> A \\<noteq> {None}\" by auto\n\n  then have a': \"a= Sup (Option.these A)\"  \n    by (metis Sup_option_def a option.inject)\n\n  from A have oA: \"Option.these A \\<noteq> {}\" unfolding Option.these_def by auto\n\n  have \"(SUP x\\<in>A. case x of None \\<Rightarrow> None | Some f \\<Rightarrow> Some (limitF b f))\n        = Some (SUP f\\<in>(Option.these A). (limitF b f))\"\n   using oA zzz by metis \n        \n  also have \"(SUP f\\<in>(Option.these A). (limitF b f)) = limitF b a\"\n    using a' limitF by metis \n\n  finally show \"Some (limitF b a) = (SUP x\\<in>A. case x of None \\<Rightarrow> None | Some f \\<Rightarrow> Some (limitF b f))\"  by simp\nqed  \n\nlemma limitO_Inf: \"limitO b (Inf A) = Inf (limitO b ` A)\"\n  unfolding limitO_def apply(auto split: option.splits)\n  subgoal unfolding Inf_option_def apply (auto split: if_splits)  \n    by force  \n  subgoal using limitF_Inf  \n    by (smt Inf_option_def ffF image_cong image_iff option.case_eq_if option.discI option.sel) \n  done\n\n\n\ndefinition limit :: \" 'b \\<Rightarrow> ('a,'b\\<Rightarrow>enat) nrest \\<Rightarrow>('a,enat) nrest\" where\n  \"limit b S  \\<equiv> (case S of FAILi \\<Rightarrow> FAILi | REST X \\<Rightarrow> REST (\\<lambda>x. case X x of None \\<Rightarrow> None | Some m \\<Rightarrow> Some (m b)))\"\n\nlemma limit_limitO: \"limit b S =  (case S of FAILi \\<Rightarrow> FAILi | REST X \\<Rightarrow> REST (\\<lambda>x. (limitO b (X x))))\"\n  unfolding limitO_def limitF_def limit_def by simp\n\ndefinition limitOF where \"limitOF b X = (\\<lambda>x. (limitO b (X x)))\"\n\n\n\nthm Sup_fun_def\nlemma \"(Sup A) x = (Sup ((\\<lambda>f. f x) `A ))\" unfolding Sup_fun_def by simp\n\nlemma limitOF: \"limitOF b (Sup A) = Sup (limitOF b ` A)\"\n  unfolding limitOF_def Sup_fun_def  apply(rule ext) \n  apply(subst limitO) apply(subst image_image) apply(subst image_image) ..\n\nlemma limitOF_Inf: \"limitOF b (Inf A) = Inf (limitOF b ` A)\"\n  unfolding limitOF_def Inf_fun_def apply(rule ext) \n  apply(subst limitO_Inf) apply(subst image_image) apply(subst image_image) ..\n\nlemma limit_limitOF: \"limit b S =  (case S of FAILi \\<Rightarrow> FAILi | REST X \\<Rightarrow> REST (limitOF b X))\"\n  unfolding limit_limitO limitOF_def by simp\n\n \nlemma continuous_nrest: (* or generally, adding a top element *)\n  assumes *: \"continuous f\"\n  shows \"continuous (case_nrest FAILi (REST o f))\"\n  apply(rule continuousI)\n  unfolding Sup_nrest_def apply (auto split: nrest.splits)\n  apply(subst continuousD[OF *])\n  apply(rule arg_cong[where f=Sup]) \n  apply  (auto split: nrest.splits)    \n  using image_iff by fastforce   \nthm Option.these_def\n\n\n\n\n\nlemma limit_Sup: \"limit b (Sup A) = Sup (limit b ` A)\"\n  unfolding limit_limitOF Sup_nrest_def apply (auto split: nrest.splits)\n  apply(subst limitOF)\n  apply(rule arg_cong[where f=Sup]) \n  apply  (auto split: nrest.splits simp: )    \n    using image_iff by fastforce   \n\nlemma limit_Inf: \"limit b (Inf A) = Inf (limit b ` A)\"\n  unfolding limit_limitOF Inf_nrest_def apply (auto split: nrest.splits)\n  subgoal by force\n  apply(subst limitOF_Inf)\n  apply(rule arg_cong[where f=Inf]) \n  apply  (auto split: nrest.splits simp: )    \n    using image_iff by fastforce   \n\n\n\n\nlemma pw_f_le_iff': \n  fixes S:: \"('a,'b\\<Rightarrow>enat) nrest\"\n  shows \n  \"S \\<le> S' \\<longleftrightarrow> (\\<forall>b. (nofailT (limit b S')\\<longrightarrow> (nofailT (limit b S) \\<and> (\\<forall> x t. inresT (limit b S) x t \\<longrightarrow> inresT (limit b S') x t))))\"\n  apply (cases S; cases S', simp_all)\n  unfolding nofailT_def inresT_def limit_def apply (auto split: nrest.splits) \n  subgoal  \n    apply(auto split: option.splits)  \n    apply (metis le_fun_def le_some_optE)  \n    by (metis le_fun_def less_eq_option_Some order.trans) \n  apply(auto intro!: le_funI simp: less_eq_option_def split: option.splits)\n  subgoal for  x2 x2a x x2b \n    by (metis enat_0_iff(1) i0_lb option.distinct(1)) \n  subgoal  for x2 x2a x x2b x2c xa       \n  proof -\n    assume a1: \"\\<forall>b x x2b. x2 x = Some x2b \\<longrightarrow> ((\\<exists>y. x2a x = Some y) \\<or> (\\<forall>t. \\<not> enat t \\<le> x2b b)) \\<and> (\\<forall>x2. x2a x = Some x2 \\<longrightarrow> (\\<forall>t. enat t \\<le> x2b b \\<longrightarrow> enat t \\<le> x2 b))\"\n    assume a2: \"x2 x = Some x2b\"\nassume \"x2a x = Some x2c\"\n  then have f3: \"\\<forall>n b f. (x2b b \\<le> enat n \\<or> enat n < f b) \\<or> Some x2c \\<noteq> Some f\"\n    using a2 a1 by (metis (full_types) Suc_ile_eq not_le)\n  obtain nn :: \"enat \\<Rightarrow> nat\" where\nf4: \"\\<forall>e. e = enat (nn e) \\<or> e = \\<infinity>\"\n    by moura\n  have \"x2c xa = \\<infinity> \\<longrightarrow> x2b xa \\<le> \\<infinity>\"\n    by auto\nthen show ?thesis\n  using f4 f3 by (metis (no_types) le_less not_le)\nqed  \n  done\n\nlemma pw_f_le_iff: \n  fixes S:: \"('a,'b\\<Rightarrow>enat) nrest\"\n  shows \n  \"S \\<le> S' \\<longleftrightarrow> (nofailT S'\\<longrightarrow> (nofailT S \\<and> (\\<forall>b x t. inresT (limit b S) x t \\<longrightarrow> inresT (limit b S') x t)))\"\n  apply (cases S; cases S', simp_all)\n  unfolding nofailT_def inresT_def limit_def apply (auto split: nrest.splits) \n  subgoal  \n    apply(auto split: option.splits)  \n    apply (metis le_fun_def le_some_optE)  \n    by (metis le_fun_def less_eq_option_Some order.trans) \n  apply(auto intro!: le_funI simp: less_eq_option_def split: option.splits)\n  subgoal for  x2 x2a x x2b \n    by (metis enat_0_iff(1) i0_lb option.distinct(1)) \n  subgoal  for x2 x2a x x2b x2c xa       \n  proof -\n    assume a1: \"\\<forall>b x x2b. x2 x = Some x2b \\<longrightarrow> ((\\<exists>y. x2a x = Some y) \\<or> (\\<forall>t. \\<not> enat t \\<le> x2b b)) \\<and> (\\<forall>x2. x2a x = Some x2 \\<longrightarrow> (\\<forall>t. enat t \\<le> x2b b \\<longrightarrow> enat t \\<le> x2 b))\"\n    assume a2: \"x2 x = Some x2b\"\nassume \"x2a x = Some x2c\"\n  then have f3: \"\\<forall>n b f. (x2b b \\<le> enat n \\<or> enat n < f b) \\<or> Some x2c \\<noteq> Some f\"\n    using a2 a1 by (metis (full_types) Suc_ile_eq not_le)\n  obtain nn :: \"enat \\<Rightarrow> nat\" where\nf4: \"\\<forall>e. e = enat (nn e) \\<or> e = \\<infinity>\"\n    by moura\n  have \"x2c xa = \\<infinity> \\<longrightarrow> x2b xa \\<le> \\<infinity>\"\n    by auto\nthen show ?thesis\n  using f4 f3 by (metis (no_types) le_less not_le)\nqed  \n  done\n\n\ndefinition inresTf :: \"('a,'b\\<Rightarrow>enat) nrest \\<Rightarrow> 'a \\<Rightarrow> ('b\\<Rightarrow>nat) \\<Rightarrow> bool\" where \n  \"inresTf S x t \\<equiv> (\\<forall>b. (case S of FAILi \\<Rightarrow> True | REST X \\<Rightarrow> (\\<exists>t'. X x = Some t' \\<and> enat (t b) \\<le> t' b)) )\"\n\nlemma \"inresTf S x t \\<longleftrightarrow> (\\<forall>b. inresT (limit b S) x (t b))\"\n  unfolding inresTf_def inresT_def limit_def \n  apply (auto split: nrest.split)\n  apply force\nproof (goal_cases)\n  case (1 b x2)\n  then obtain t' where  \"(case x2 x of None \\<Rightarrow> None | Some m \\<Rightarrow> Some (m b)) = Some t'\" and *: \"enat (t b) \\<le> t'\" by auto\n  then obtain m where **: \"x2 x = Some m\" \"t' = m b\" by(auto split: option.splits)\n  show ?case apply(rule exI[where x=\"m\"])\n    using * ** by simp\nqed\n(*\nlemma inresTf_alt: \"inresTf S x t \\<longleftrightarrow> REST ([x\\<mapsto>  t]) \\<le> S\"\n  unfolding inresTf_def apply(cases S)  \n  by (auto dest!: le_funD[where x=x] simp: le_funI less_eq_option_def split: option.splits )\n\nlemma inresTf_mono: \"inresTf S x t \\<Longrightarrow> t' \\<le> t \\<Longrightarrow> inresTf S x t'\"\n  unfolding inresTf_def apply(cases S) apply (auto simp: le_fun_def)\n  using enat_ord_simps(1) order_trans by blast\n\nlemma inresTf_RETURNT[simp]: \"inresTf (RETURNT x) y t \\<longleftrightarrow> t = 0 \\<and> y = x\"\n  by(auto simp: le_fun_def inresTf_def RETURNT_def enat_0_iff split: nrest.splits)\n\nlemma inresTf_FAILT[simp]: \"inresTf FAILT r t\"\n  by(simp add: inresTf_def)\n\nlemma fail_inresTf[refine_pw_simps]: \"\\<not> nofailT M \\<Longrightarrow> inresTf M x t\"\n  unfolding nofailT_def by simp\n\nthm Max_in Sup_enat_def finite_enat_bounded linear\n\n\nlemma \"inresTf (Sup X) r t \\<longleftrightarrow> G\"\n  unfolding inresTf_def  oops\n\n(*\nlemma Sup_f_enat_less: \"X \\<noteq> {} \\<Longrightarrow> enat o t \\<le> Sup X \\<longleftrightarrow> (\\<exists>x\\<in>X. enat o t \\<le> x)\"\n  apply rule\n  subgoal  unfolding Sup_fun_def le_fun_def apply simp\n    unfolding Sup_enat_def  \n    sorry\n  subgoal apply auto\n    by (simp add: Sup_upper2)\n  oops \n\nlemma pw_inresTf_Sup: \"inresTf (Sup X) r t \\<longleftrightarrow> (\\<exists>M\\<in>X. \\<exists>t'\\<ge>t.  inresTf M r t')\"\n  apply(rule)\n  subgoal (* \\<rightarrow> *)\n    apply(cases \"Sup X\")\n    subgoal by (force simp: nrest_Sup_FAILT)\n    subgoal \n      apply(auto simp: inresTf_def  Sup_nrest_def split: if_splits)\n      apply(auto simp: SUP_eq_Some_iff split: nrest.splits)  \n      apply(subst (asm) Sup_enat_less)\n       apply auto []  \n      apply auto  by b last  \n    done\n  subgoal (* <- *)\n    apply(cases \"Sup X\")\n    subgoal by (auto simp: nrest_Sup_FAILT top_Sup)\n    subgoal \n      apply(auto simp: inresT_def  Sup_nrest_def split: if_splits)\n      apply(auto simp: SUP_eq_Some_iff split: nrest.splits)  \n      apply(subst Sup_enat_less)\n       apply auto []\n      apply auto\n      using dual_order.trans enat_ord_simps(1) by bl ast \n    done\n  oops\n*)\n         \nlemma inresTf_REST[simp]:\n  \"inresTf (REST X) x t \\<longleftrightarrow> (\\<exists>t'\\<ge>t. X x = Some t')\" \n  unfolding inresTf_def \n  by (auto simp: le_fun_def)\n\n\n\nlemma inresTf_simps[simp]:\n  \"inresTf FAILT = (\\<lambda>_ _. True)\" \n  \"inresTf SUCCEEDT = (\\<lambda>_ _ . False)\"\n  unfolding inresTf_def  \n  by (auto split: nrest.splits simp add: RETURNT_def) \n\n\nlemma helpera:\n  fixes ef :: \"'a :: order\"\n  assumes \"\\<forall>tf. tf \\<le> ef \\<longrightarrow> tf \\<le> ef'\"\n  shows \"ef \\<le> ef'\"\n  using assms \n  by simp  \n \n\nlemma pw_f_le_iff: \n  \"S \\<le> S' \\<longleftrightarrow> (nofailT S'\\<longrightarrow> (nofailT S \\<and> (\\<forall>x t. inresTf S x t \\<longrightarrow> inresTf S' x t)))\"\n  apply (cases S; cases S', simp_all)\n  unfolding nofailT_def inresTf_def apply (auto split: nrest.splits) \n  subgoal  \n    by (metis le_fun_def le_some_optE order_trans)    \n  apply(auto intro!: le_funI simp: less_eq_option_def split: option.splits)\n  subgoal  \n    by fastforce  \n  subgoal  \n    using le_funD by fastforce   \n  done\n\nlemma inresTf_SPEC[refine_pw_simps]: \"inresTf (SPEC a b) = (\\<lambda>x t. a x \\<and>  b x \\<ge> t)\"\n    unfolding SPEC_def apply(rule ext) by(auto split: if_splits)\n\n *)\n\nlemma pw_f_eq_iff':\n  \"S=S' \\<longleftrightarrow> (\\<forall>b. nofailT (limit b S) = nofailT (limit b S') \\<and> (\\<forall> x t. inresT (limit b S) x t \\<longleftrightarrow> inresT (limit b S') x t))\"\n  apply (rule iffI)\n  apply simp\n  apply (rule antisym)\n  apply (auto simp add: pw_f_le_iff')\n  done\n\nlemma pw_f_eq_iff:\n  \"S=S' \\<longleftrightarrow> (nofailT S = nofailT S' \\<and> (\\<forall>b x t. inresT (limit b S) x t \\<longleftrightarrow> inresT (limit b S') x t))\"\n  apply (rule iffI)\n  apply simp\n  apply (rule antisym)\n  apply (auto simp add: pw_f_le_iff)\n  done\n\nlemma pw_f_flat_ge_iff: \"flat_ge S S' \\<longleftrightarrow> \n  (nofailT S) \\<longrightarrow> nofailT S' \\<and> (\\<forall>b x t. inresT (limit b S) x t \\<longleftrightarrow> inresT (limit b S') x t)\"\n  apply (simp add: flat_ord_def)\n  apply(simp add: pw_f_eq_iff) apply safe\n  by (auto simp add: nofailT_def)   \n\n\n\nlemma pw_f_eqI: \n  assumes \"nofailT S = nofailT S'\" \n  assumes \"\\<And>b x t. inresT (limit b S) x t \\<longleftrightarrow> inresT (limit b S') x t\" \n  shows \"S=S'\"\n  using assms by (simp add: pw_f_eq_iff)\n\nlemma pw_f_eqI': \n  assumes \"\\<And>b. nofailT (limit b S) = nofailT (limit b S')\" \n  assumes \"\\<And>b x t. inresT (limit b S) x t \\<longleftrightarrow> inresT (limit b S') x t\" \n  shows \"S=S'\"\n  using assms by (simp add: pw_f_eq_iff')\n\n\nsection \\<open> Monad Operators \\<close>\n\ndefinition bindT :: \"('b,'c::{complete_lattice, plus}) nrest \\<Rightarrow> ('b \\<Rightarrow> ('a,'c) nrest) \\<Rightarrow> ('a,'c) nrest\" where\n  \"bindT M f \\<equiv> case M of \n  FAILi \\<Rightarrow> FAILT |\n  REST X \\<Rightarrow> Sup { (case f x of FAILi \\<Rightarrow> FAILT \n                | REST m2 \\<Rightarrow> REST (map_option ((+) t1) o (m2) ))\n                    |x t1. X x = Some t1}\"\n\nlemma bindT_alt: \"bindT M f = (case M of \n  FAILi \\<Rightarrow> FAILT | \n  REST X \\<Rightarrow> Sup { consume (f x) t1 |x t1. X x = Some t1})\"\n  unfolding bindT_def consume_def by simp\n\n\nlemma \"bindT (REST X) f = \n  (SUP x\\<in>dom X. consume (f x) (the (X x)))\"\nproof -\n  have *: \"\\<And>f X. { f x t |x t. X x = Some t}\n      = (\\<lambda>x. f x (the (X x))) ` (dom X)\"\n    by force\n  show ?thesis by (auto simp: bindT_alt *)\nqed\n\n\nadhoc_overloading\n  Monad_Syntax.bind AbstractSepreftime_Thin.bindT\n\n\nlemma bindT_FAIL[simp]: \"bindT FAILT g = FAILT\"\n  by (auto simp: bindT_def)       \n\n\nlemma \"bindT SUCCEEDT f = SUCCEEDT\"\n  unfolding bindT_def by(auto split: nrest.split simp add: bot_nrest_def) \n(*\n\nlemma pw_inresT_bindT_aux: \"inresTf (bindT m f) r t \\<longleftrightarrow>\n     (nofailT m \\<longrightarrow> (\\<exists>r' t' t''. inresTf m r' t' \\<and> inresTf (f r') r t'' \\<and> t \\<le> t' + t''))\"\n  apply(rule)\n  subgoal (* \\<rightarrow> *)\n    apply(cases m)\n    subgoal by auto\n    subgoal apply(auto simp: bindT_def   split: nrest.splits) \n      subgoal for M x t' t1 \n        apply(rule exI[where x=x])\n        apply(cases \"f x\") apply auto  \n        subgoal for x2 z apply(cases t1)\n           apply auto\n          subgoal for n apply(rule exI[where x=n]) apply auto\n            by (smt dual_order.trans enat_ile enat_ord_simps(1) le_add2 linear order_mono_setup.refl plus_enat_simps(1)) \n          subgoal\n            by (metis le_add1 zero_enat_def zero_le) \n          done\n        done\n      subgoal for x t' t1\n        apply(rule exI[where x=x]) apply auto\n        apply(cases t1) apply auto\n        subgoal for n apply(rule exI[where x=n]) apply auto\n          apply(rule exI[where x=t]) by auto\n        subgoal \n          by presburger\n        done \n      done\n    done\n  subgoal (* <- *)\n    apply(cases m)\n    subgoal by auto\n    subgoal for x2\n      apply (auto simp: bindT_def  split: nrest.splits)\n      apply(auto simp: pw_inresT_Sup )\n      subgoal for r' t' t'a t''\n        apply(cases \"f r'\")\n        subgoal apply auto apply(force) done\n        subgoal for x2a\n          apply(rule exI[where x=\"REST (map_option ((+) t'a) \\<circ> x2a)\"]) \n          apply auto\n           apply(rule exI[where x=r'])\n           apply auto\n          using add_mono by fastforce\n        done\n      done\n    done\n  done\n*)\nlemma pw_inresT_bindT_aux: \"inresT (bindT m f) r t \\<longleftrightarrow>\n     (nofailT m \\<longrightarrow> (\\<exists>r' t' t''. inresT m r' t' \\<and> inresT (f r') r t'' \\<and> t \\<le> t' + t''))\"\n  apply(rule)\n  subgoal (* \\<rightarrow> *)\n    apply(cases m)\n    subgoal by auto\n    subgoal apply(auto simp: bindT_def pw_inresT_Sup split: nrest.splits) \n      subgoal for M x t' t1 \n        apply(rule exI[where x=x])\n        apply(cases \"f x\") apply auto  \n        subgoal for x2 z apply(cases t1)\n           apply auto\n          subgoal for n apply(rule exI[where x=n]) apply auto\n            by (smt dual_order.trans enat_ile enat_ord_simps(1) le_add2 linear order_mono_setup.refl plus_enat_simps(1)) \n          subgoal\n            by (metis le_add1 zero_enat_def zero_le) \n          done\n        done\n      subgoal for x t' t1\n        apply(rule exI[where x=x]) apply auto\n        apply(cases t1) apply auto\n        subgoal for n apply(rule exI[where x=n]) apply auto\n          apply(rule exI[where x=t]) by auto\n        subgoal \n          by presburger\n        done \n      done\n    done\n  subgoal (* <- *)\n    apply(cases m)\n    subgoal by auto\n    subgoal for x2\n      apply (auto simp: bindT_def  split: nrest.splits)\n      apply(auto simp: pw_inresT_Sup )\n      subgoal for r' t' t'a t''\n        apply(cases \"f r'\")\n        subgoal apply auto apply(force) done\n        subgoal for x2a\n          apply(rule exI[where x=\"REST (map_option ((+) t'a) \\<circ> x2a)\"]) \n          apply auto\n           apply(rule exI[where x=r'])\n           apply auto\n          using add_mono by fastforce\n        done\n      done\n    done\n  done\n\nlemma pw_inresT_bindT[refine_pw_simps]: \"inresT (bindT m f) r t \\<longleftrightarrow>\n     (nofailT m \\<longrightarrow> (\\<exists>r' t' t''. inresT m r' t' \\<and> inresT (f r') r t'' \\<and> t = t' + t''))\"\n  apply (auto simp: pw_inresT_bindT_aux) \n  by (metis (full_types) inresT_mono le_iff_add linear nat_add_left_cancel_le) \n\n\nlemma pw_bindT_nofailT[refine_pw_simps]: \"nofailT (bindT M f) \\<longleftrightarrow> (nofailT M \\<and> (\\<forall>x t. inresT M x t \\<longrightarrow> nofailT (f x)))\"\n  unfolding bindT_def   \n   apply (auto elim: no_FAILTE simp: refine_pw_simps  split: nrest.splits )  \n  apply force+ \n  by (metis enat_ile le_cases nofailT_def)\n\nlemma inresT_limit_SPECT[refine_pw_simps]: \"inresT (limit b (SPECT M) ) x t = (\\<exists>t'. t' b \\<ge> enat t \\<and> M x = Some t')\"\n  unfolding inresT_def limit_def by (auto split: option.splits)  \n\n\n\nend\n", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/moreCurr/AbstractSepreftime_Thin.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.34201892787234045}}
{"text": "theory Memory_ExtraLemmas\n  imports\n    \"../AutoCorres/Impl\"\n    \"../lib/ExtraLemmas\"\n    \"$ISABELLE_HOME/src/HOL/Library/LaTeXsugar\"\n    \nbegin\n  \nlemma contrapos: \"(P \\<longrightarrow> Q) = (\\<not>Q \\<longrightarrow> \\<not>P)\"\n  by blast\n\nlemma unat_add_le: \"unat (a + b) \\<le> unat (a::('a::len word)) + unat b \"\n  by unat_arith\n\nlemma eight_eq_eight : \"unat (8::32 word) = 8\" by simp\n\nlemma intvl_no_overflow_lower_bound:\n  \"(a :: ('a::{len}) word) \\<in> {x ..+  sz} \\<Longrightarrow> unat x + sz \\<le> 2 ^ LENGTH('a) \\<Longrightarrow> a \\<ge> x\"\n  apply unat_arith unfolding intvl_def  apply unat_arith\n  apply auto \n  apply (subgoal_tac \"unat (of_nat k) = k\")\n   apply (smt add.commute add_leD1 add_less_mono1 order_less_le_trans unat_of_nat unat_of_nat_eq word_nchotomy)\n  by (smt add.commute add.left_neutral add_diff_cancel_right' add_leD1 add_lessD1 diff_add_inverse \n      diff_diff_cancel diff_le_self le_Suc_ex less_diff_conv less_irrefl_nat less_or_eq_imp_le \n      linorder_not_less nat_add_left_cancel_less nat_less_le not_add_less1 order_less_le_trans unat_of_nat_eq)\n    \nlemma intvl_upper_bound: \"a \\<in> {x ..+ sz} \\<Longrightarrow> \n  unat a < unat x + sz\"\n  unfolding intvl_def\n  apply unat_arith\n  apply (auto simp add: unat_of_nat) \n  using mod_less by blast\n    \nlemma zero_not_in_intvl_lower_bound:\n  \"(a::('a::len) word) \\<in> {x ..+ sz} \\<Longrightarrow> 0 \\<notin> {x ..+  sz}  \\<Longrightarrow> a \\<ge>  x \"\n  apply (drule zero_not_in_intvl_no_overflow)\n  by (rule intvl_no_overflow_lower_bound)\n\nlemma split_goal:\"(P \\<longrightarrow> Q) \\<Longrightarrow> (\\<not>P \\<longrightarrow> Q) \\<Longrightarrow> Q\" \n  by auto\n\nlemma word_div_mult_lower_bound: \n  assumes \"unat x + unat y < 2 ^ 32\"\n    and \"y \\<noteq> 0\"   \n  shows \"((x:: word32) div ( y :: word32)) * y + y \\<ge> x\"\nproof -\n  have \"unat ((x div y) * y) = unat (x div y) * unat y\"\n    apply unat_arith\n    apply auto\n    by (metis (no_types, hide_lams) Word_Miscellaneous.dtle le_unat_uoi unat_div word_arith_nat_mult)\n  have \"unat ((x div y) * y) = (unat x div unat y) * unat y\"\n    apply unat_arith\n    apply auto\n    by (simp add: \\<open>unat (x div y * y) = unat (x div y) * unat y\\<close> unat_div)\n  have \"unat x div unat y * unat y + unat x mod unat y = unat x\"\n    by simp\n  show ?thesis\n    using `unat x + unat y < 2 ^ 32` `y \\<noteq> 0` \n      `unat ((x div y) * y) = (unat x div unat y) * unat y`\n  apply unat_arith\n  apply auto  \n   apply unat_arith\n     apply auto\n    apply (subgoal_tac \"unat x div unat y * unat y + unat x mod unat y = unat x\")\n     apply (metis mod_le_divisor nat_add_left_cancel_le)\n     apply simp\n    using `unat x div unat y * unat y + unat x mod unat y = unat x`\n      by arith\nqed\n\nlemma scast_NOT_simp: \"(scast (~~(flag :: 32 signed word)) :: word32) = ~~ ((scast flag)::word32)\"\n  unfolding word_not_def\n  apply (subst scast_down_wi)\n   defer\n   apply (subst uint_scast)\n   apply (rule refl)\n  apply (subst is_down)\n  by simp  \n\n    \n(* Unused *) \n(*\nlemma c_guard_l1:\n  assumes \"c_guard (a::('a::mem_type) ptr)\"\n    \"\\<not> c_guard (a +\\<^sub>p 1)\"\n    \"b > a\" \n    \"b \\<ge> a +\\<^sub>p 1\"\n  shows \"\\<not> c_null_guard b\" \nproof -\n  have \"\\<not> c_null_guard ( a +\\<^sub>p 1)\" using `c_guard a` `\\<not> c_guard (a +\\<^sub>p 1)`\n    unfolding c_guard_def apply auto    \n    apply(frule ptr_aligned_plus[where i = 1]) by auto\n  hence \"0 \\<in> ptr_span (a +\\<^sub>p 1)\" unfolding c_null_guard_def by auto\n  have \"0 \\<in> ptr_span b\" using `b \\<ge> a +\\<^sub>p 1` using `0 \\<in> ptr_span (a +\\<^sub>p 1)` unfolding intvl_def\n  proof simp\n    assume \"a +\\<^sub>p 1 \\<le> b\"\n      and \"\\<exists>k. ptr_val (a +\\<^sub>p 1) + of_nat k = 0 \\<and> k < size_of TYPE('a)\"\n    then obtain k where k:\"ptr_val (a +\\<^sub>p 1) + of_nat k = 0 \\<and> k < size_of TYPE('a)\" by auto\n    hence \"ptr_val (a +\\<^sub>p 1) + of_nat k = 0\" by auto\n    {\n      assume \"((of_nat k)::32 word) \\<noteq> 0\"\n      have \"ptr_val b \\<ge> ptr_val (a +\\<^sub>p 1)\" using `b \\<ge> a +\\<^sub>p 1`  by (simp add: ptr_le_def ptr_le_def')\n      hence 1:\"ptr_val b - ptr_val (a +\\<^sub>p 1) \\<le> of_nat k\" \n        using `ptr_val (a +\\<^sub>p 1) + of_nat k = 0`\n        apply unat_arith apply auto\n        using `of_nat k \\<noteq> 0` \n        apply (subgoal_tac \"unat ((of_nat k)::32 word) = 0 \\<Longrightarrow> ((of_nat k)::32 word) = 0\")\n         apply auto[1]\n        apply (subst (asm) (3) unat_eq_0)  by auto\n          \n      let ?k2' = \"of_nat k - ( ptr_val b - ptr_val (a +\\<^sub>p 1))\"\n      have \"ptr_val b + ?k2' = of_nat k + ptr_val (a +\\<^sub>p 1)\" by simp\n      hence \"ptr_val b + ?k2' = 0\" using k by (simp add: add.commute)\n      hence 2:\"ptr_val b + of_nat (unat ?k2') = 0\" by simp\n          \n      let ?of_nat_k = \"((of_nat k):: 32 word)\"\n      have \"?k2' \\<le> ?of_nat_k\" using 1  word_sub_le by auto\n      hence \"unat ?k2' \\<le> unat ?of_nat_k\" by (simp add: word_le_nat_alt) \n      moreover have \"unat ?of_nat_k \\<le> k\" by (metis le_cases le_unat_uoi) \n      moreover  have \"k < size_of TYPE('a)\" using k by simp\n      ultimately have \"(unat ?k2') < size_of TYPE('a)\" by simp\n      hence \"ptr_val b + of_nat (unat ?k2') = 0 \\<and> (unat ?k2') < size_of TYPE('a)\" using 2 by simp\n      hence \"\\<exists>k::nat. ptr_val b + of_nat k = (0::32 word) \\<and> k < size_of TYPE('a)\" by (frule exI)\n    }\n    moreover{  \n      assume k_eq_0:\"((of_nat k)::32 word) = 0\" \n      let ?k2' = \"of_nat (size_of TYPE('a)) - ( ptr_val b - ptr_val a)\"\n      have \"ptr_val b > ptr_val a\" using `b>a` \n        by (simp add: ptr_less_def ptr_less_def')\n      hence \"unat (ptr_val b) > unat (ptr_val a)\" using unat_mono by auto\n      from k_eq_0 have \"ptr_val (a +\\<^sub>p 1)= 0\" using k by unat_arith\n      hence 1:\"ptr_val a + of_nat (size_of TYPE('a)) = 0\" unfolding ptr_add_def by simp\n      hence 2: \"ptr_val b - ptr_val a < of_nat (size_of TYPE('a))\" \n        using k_eq_0\n        apply unat_arith (* SLOW! *) apply auto\n         apply (subgoal_tac \"unat (ptr_val a) \\<noteq> (0::nat)\")\n          apply auto[1]\n        using `c_guard a` \n         apply (metis len_of_addr_card max_size mem_type_simps(3) neq0_conv unat_of_nat_len)\n        using `unat (ptr_val b) > unat (ptr_val a)` by simp\n      hence \"ptr_val b + ?k2' = 0\" using 1  by (simp add: add.commute)\n      hence 3:\"ptr_val b + of_nat (unat ?k2') = 0\" by simp\n      have \"ptr_val b - ptr_val a > 0\" using `ptr_val b > ptr_val a` \n        using word_neq_0_conv by fastforce \n      with 2 have \"?k2' < of_nat (size_of TYPE('a))\"  by unat_arith (* VERY SLOW! *)\n      hence \"unat ?k2' < size_of TYPE('a)\" using unat_less_helper by auto\n      with 3 have \"ptr_val b + of_nat (unat ?k2') = 0 \\<and> unat ?k2' < size_of TYPE('a)\" by auto\n      hence \"\\<exists>k::nat. ptr_val b + of_nat k = (0::32 word) \\<and> k < size_of TYPE('a)\" by (frule exI)  \n    }\n    ultimately show \"\\<exists>k::nat. ptr_val b + of_nat k = (0::32 word) \\<and> k < size_of TYPE('a)\"\n      by auto\n  qed \n  thus \"\\<not> c_null_guard b\" unfolding c_null_guard_def by auto\nqed\n*)\n   \nlemma unat_add_lem_3:\n  \"unat (a::'a::len word) + unat b + unat c < 2 ^ LENGTH('a) =\n    (unat (a + b + c) = unat a + unat b + unat c)\"\n  using unat_add_lem\n  by (metis add_lessD1 unat_lt2p) \n    \nlemma unat_addition_less_pres:\"unat (a::'a::len word) + unat b < unat c \\<Longrightarrow> a + b < c\"\n  by unat_arith\n    \nlemma unat_addition_le_pres:\"unat (a::'a::len word) + unat b \\<le> unat c \\<Longrightarrow> a + b \\<le> c\"\n  by unat_arith\n    \nlemma shiftr3_upper_bound:\"(x :: 32 word) >> 3 \\<le> 0x1FFFFFFF\"\n  apply (simp add:shiftr3_is_div_8)\n  apply unat_arith\n  by auto\n  \nlemma intvl_no_overflow2:\n  assumes asm: \"unat (a::'a::len word) + b \\<le> 2 ^ LENGTH('a)\"\n  shows \"(x \\<in> {a..+b}) = (a \\<le> x \\<and> unat x < unat a + b)\"\nproof -\n  {\n    assume \"x \\<in> {a ..+ b}\"\n    with intvl_no_overflow_lower_bound intvl_upper_bound asm\n    have \"(a \\<le> x \\<and> unat x < unat a + b)\" by blast    \n  }moreover\n  {\n    assume \"(a \\<le> x \\<and> unat x < unat a + b)\"\n    thm intvlI   \n    have \"a + of_nat (unat x - unat a) \\<in> {a ..+ b}\"\n      apply (rule intvlI)\n      using `(a \\<le> x \\<and> unat x < unat a + b)` asm\n      by unat_arith\n    moreover have \"a + of_nat (unat x - unat a) = x\" \n      using `(a \\<le> x \\<and> unat x < unat a + b)` asm\n      apply unat_arith\n      apply (subgoal_tac \"unat (x - a) = unat x - unat a\")\n       apply auto\n      by unat_arith\n    ultimately have \"x \\<in> {a ..+ b}\" by argo\n  }\n  ultimately show ?thesis by fast  \nqed\n\nend\n", "meta": {"author": "CriticalTechnologiesInc", "repo": "SableModel", "sha": "a452a2b5e3636b612a4d04cfb6e2ab1c1a132639", "save_path": "github-repos/isabelle/CriticalTechnologiesInc-SableModel", "path": "github-repos/isabelle/CriticalTechnologiesInc-SableModel/SableModel-a452a2b5e3636b612a4d04cfb6e2ab1c1a132639/Proofs/Memory_ExtraLemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.34201891910339244}}
{"text": "(*\n    Author:   Benedikt Seidl\n    Author:   Salomon Sickert\n    License:  BSD\n*)\n\nsection \\<open>Advice functions\\<close>\n\ntheory Advice\nimports\n  LTL.LTL LTL.Equivalence_Relations\n  Syntactic_Fragments_and_Stability After\nbegin\n\nsubsection \\<open>The GF and FG Advice Functions\\<close>\n\nfun GF_advice :: \"'a ltln \\<Rightarrow> 'a ltln set \\<Rightarrow> 'a ltln\" (\"_[_]\\<^sub>\\<nu>\" [90,60] 89)\n  where\n  \"(X\\<^sub>n \\<psi>)[X]\\<^sub>\\<nu> = X\\<^sub>n (\\<psi>[X]\\<^sub>\\<nu>)\"\n| \"(\\<psi>\\<^sub>1 and\\<^sub>n \\<psi>\\<^sub>2)[X]\\<^sub>\\<nu> = (\\<psi>\\<^sub>1[X]\\<^sub>\\<nu>) and\\<^sub>n (\\<psi>\\<^sub>2[X]\\<^sub>\\<nu>)\"\n| \"(\\<psi>\\<^sub>1 or\\<^sub>n \\<psi>\\<^sub>2)[X]\\<^sub>\\<nu> = (\\<psi>\\<^sub>1[X]\\<^sub>\\<nu>) or\\<^sub>n (\\<psi>\\<^sub>2[X]\\<^sub>\\<nu>)\"\n| \"(\\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2)[X]\\<^sub>\\<nu> = (\\<psi>\\<^sub>1[X]\\<^sub>\\<nu>) W\\<^sub>n (\\<psi>\\<^sub>2[X]\\<^sub>\\<nu>)\"\n| \"(\\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2)[X]\\<^sub>\\<nu> = (\\<psi>\\<^sub>1[X]\\<^sub>\\<nu>) R\\<^sub>n (\\<psi>\\<^sub>2[X]\\<^sub>\\<nu>)\"\n| \"(\\<psi>\\<^sub>1 U\\<^sub>n \\<psi>\\<^sub>2)[X]\\<^sub>\\<nu> = (if (\\<psi>\\<^sub>1 U\\<^sub>n \\<psi>\\<^sub>2) \\<in> X then (\\<psi>\\<^sub>1[X]\\<^sub>\\<nu>) W\\<^sub>n (\\<psi>\\<^sub>2[X]\\<^sub>\\<nu>) else false\\<^sub>n)\"\n| \"(\\<psi>\\<^sub>1 M\\<^sub>n \\<psi>\\<^sub>2)[X]\\<^sub>\\<nu> = (if (\\<psi>\\<^sub>1 M\\<^sub>n \\<psi>\\<^sub>2) \\<in> X then (\\<psi>\\<^sub>1[X]\\<^sub>\\<nu>) R\\<^sub>n (\\<psi>\\<^sub>2[X]\\<^sub>\\<nu>) else false\\<^sub>n)\"\n| \"\\<phi>[_]\\<^sub>\\<nu> = \\<phi>\"\n\nfun FG_advice :: \"'a ltln \\<Rightarrow> 'a ltln set \\<Rightarrow> 'a ltln\" (\"_[_]\\<^sub>\\<mu>\" [90,60] 89)\nwhere\n  \"(X\\<^sub>n \\<psi>)[Y]\\<^sub>\\<mu> = X\\<^sub>n (\\<psi>[Y]\\<^sub>\\<mu>)\"\n| \"(\\<psi>\\<^sub>1 and\\<^sub>n \\<psi>\\<^sub>2)[Y]\\<^sub>\\<mu> = (\\<psi>\\<^sub>1[Y]\\<^sub>\\<mu>) and\\<^sub>n (\\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)\"\n| \"(\\<psi>\\<^sub>1 or\\<^sub>n \\<psi>\\<^sub>2)[Y]\\<^sub>\\<mu> = (\\<psi>\\<^sub>1[Y]\\<^sub>\\<mu>) or\\<^sub>n (\\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)\"\n| \"(\\<psi>\\<^sub>1 U\\<^sub>n \\<psi>\\<^sub>2)[Y]\\<^sub>\\<mu> = (\\<psi>\\<^sub>1[Y]\\<^sub>\\<mu>) U\\<^sub>n (\\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)\"\n| \"(\\<psi>\\<^sub>1 M\\<^sub>n \\<psi>\\<^sub>2)[Y]\\<^sub>\\<mu> = (\\<psi>\\<^sub>1[Y]\\<^sub>\\<mu>) M\\<^sub>n (\\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)\"\n| \"(\\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2)[Y]\\<^sub>\\<mu> = (if (\\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2) \\<in> Y then true\\<^sub>n else (\\<psi>\\<^sub>1[Y]\\<^sub>\\<mu>) U\\<^sub>n (\\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>))\"\n| \"(\\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2)[Y]\\<^sub>\\<mu> = (if (\\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2) \\<in> Y then true\\<^sub>n else (\\<psi>\\<^sub>1[Y]\\<^sub>\\<mu>) M\\<^sub>n (\\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>))\"\n| \"\\<phi>[_]\\<^sub>\\<mu> = \\<phi>\"\n\nlemma GF_advice_\\<nu>LTL:\n  \"\\<phi>[X]\\<^sub>\\<nu> \\<in> \\<nu>LTL\"\n  \"\\<phi> \\<in> \\<nu>LTL \\<Longrightarrow> \\<phi>[X]\\<^sub>\\<nu> = \\<phi>\"\n  by (induction \\<phi>) auto\n\nlemma FG_advice_\\<mu>LTL:\n  \"\\<phi>[X]\\<^sub>\\<mu> \\<in> \\<mu>LTL\"\n  \"\\<phi> \\<in> \\<mu>LTL \\<Longrightarrow> \\<phi>[X]\\<^sub>\\<mu> = \\<phi>\"\n  by (induction \\<phi>) auto\n\n\nlemma GF_advice_subfrmlsn:\n  \"subfrmlsn (\\<phi>[X]\\<^sub>\\<nu>) \\<subseteq> {\\<psi>[X]\\<^sub>\\<nu> | \\<psi>. \\<psi> \\<in> subfrmlsn \\<phi>}\"\n  by (induction \\<phi>) force+\n\nlemma FG_advice_subfrmlsn:\n  \"subfrmlsn (\\<phi>[Y]\\<^sub>\\<mu>) \\<subseteq> {\\<psi>[Y]\\<^sub>\\<mu> | \\<psi>. \\<psi> \\<in> subfrmlsn \\<phi>}\"\n  by (induction \\<phi>) force+\n\nlemma GF_advice_subfrmlsn_card:\n  \"card (subfrmlsn (\\<phi>[X]\\<^sub>\\<nu>)) \\<le> card (subfrmlsn \\<phi>)\"\nproof -\n  have \"card (subfrmlsn (\\<phi>[X]\\<^sub>\\<nu>)) \\<le> card {\\<psi>[X]\\<^sub>\\<nu> | \\<psi>. \\<psi> \\<in> subfrmlsn \\<phi>}\"\n    by (simp add: subfrmlsn_finite GF_advice_subfrmlsn card_mono)\n\n  also have \"\\<dots> \\<le> card (subfrmlsn \\<phi>)\"\n    by (metis Collect_mem_eq card_image_le image_Collect subfrmlsn_finite)\n\n  finally show ?thesis .\nqed\n\nlemma FG_advice_subfrmlsn_card:\n  \"card (subfrmlsn (\\<phi>[Y]\\<^sub>\\<mu>)) \\<le> card (subfrmlsn \\<phi>)\"\nproof -\n  have \"card (subfrmlsn (\\<phi>[Y]\\<^sub>\\<mu>)) \\<le> card {\\<psi>[Y]\\<^sub>\\<mu> | \\<psi>. \\<psi> \\<in> subfrmlsn \\<phi>}\"\n    by (simp add: subfrmlsn_finite FG_advice_subfrmlsn card_mono)\n\n  also have \"\\<dots> \\<le> card (subfrmlsn \\<phi>)\"\n    by (metis Collect_mem_eq card_image_le image_Collect subfrmlsn_finite)\n\n  finally show ?thesis .\nqed\n\nlemma GF_advice_monotone:\n  \"X \\<subseteq> Y \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<nu> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>[Y]\\<^sub>\\<nu>\"\nproof (induction \\<phi> arbitrary: w)\n  case (Until_ltln \\<phi> \\<psi>)\n  then show ?case\n    by (cases \"\\<phi> U\\<^sub>n \\<psi> \\<in> X\") (simp_all, blast)\nnext\n  case (Release_ltln \\<phi> \\<psi>)\n  then show ?case by (simp, blast)\nnext\n  case (WeakUntil_ltln \\<phi> \\<psi>)\n  then show ?case by (simp, blast)\nnext\n  case (StrongRelease_ltln \\<phi> \\<psi>)\n  then show ?case\n    by (cases \"\\<phi> M\\<^sub>n \\<psi> \\<in> X\") (simp_all, blast)\nqed auto\n\nlemma FG_advice_monotone:\n  \"X \\<subseteq> Y \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<mu> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>[Y]\\<^sub>\\<mu>\"\nproof (induction \\<phi> arbitrary: w)\n  case (Until_ltln \\<phi> \\<psi>)\n  then show ?case by (simp, blast)\nnext\n  case (Release_ltln \\<phi> \\<psi>)\n  then show ?case\n    by (cases \"\\<phi> R\\<^sub>n \\<psi> \\<in> X\") (auto, blast)\nnext\n  case (WeakUntil_ltln \\<phi> \\<psi>)\n  then show ?case\n    by (cases \"\\<phi> W\\<^sub>n \\<psi> \\<in> X\") (auto, blast)\nnext\n  case (StrongRelease_ltln \\<phi> \\<psi>)\n  then show ?case by (simp, blast)\nqed auto\n\nlemma GF_advice_ite_simps[simp]:\n  \"(if P then true\\<^sub>n else false\\<^sub>n)[X]\\<^sub>\\<nu> = (if P then true\\<^sub>n else false\\<^sub>n)\"\n  \"(if P then false\\<^sub>n else true\\<^sub>n)[X]\\<^sub>\\<nu> = (if P then false\\<^sub>n else true\\<^sub>n)\"\n  by simp_all\n\nlemma FG_advice_ite_simps[simp]:\n  \"(if P then true\\<^sub>n else false\\<^sub>n)[Y]\\<^sub>\\<mu> = (if P then true\\<^sub>n else false\\<^sub>n)\"\n  \"(if P then false\\<^sub>n else true\\<^sub>n)[Y]\\<^sub>\\<mu> = (if P then false\\<^sub>n else true\\<^sub>n)\"\n  by simp_all\n\nsubsection \\<open>Advice Functions on Nested Propositions\\<close>\n\ndefinition nested_prop_atoms\\<^sub>\\<nu> :: \"'a ltln \\<Rightarrow> 'a ltln set \\<Rightarrow> 'a ltln set\"\nwhere\n  \"nested_prop_atoms\\<^sub>\\<nu> \\<phi> X = {\\<psi>[X]\\<^sub>\\<nu> | \\<psi>. \\<psi> \\<in> nested_prop_atoms \\<phi>}\"\n\ndefinition nested_prop_atoms\\<^sub>\\<mu> :: \"'a ltln \\<Rightarrow> 'a ltln set \\<Rightarrow> 'a ltln set\"\nwhere\n  \"nested_prop_atoms\\<^sub>\\<mu> \\<phi> X = {\\<psi>[X]\\<^sub>\\<mu> | \\<psi>. \\<psi> \\<in> nested_prop_atoms \\<phi>}\"\n\nlemma nested_prop_atoms\\<^sub>\\<nu>_finite:\n  \"finite (nested_prop_atoms\\<^sub>\\<nu> \\<phi> X)\"\n  by (simp add: nested_prop_atoms\\<^sub>\\<nu>_def nested_prop_atoms_finite)\n\nlemma nested_prop_atoms\\<^sub>\\<mu>_finite:\n  \"finite (nested_prop_atoms\\<^sub>\\<mu> \\<phi> X)\"\n  by (simp add: nested_prop_atoms\\<^sub>\\<mu>_def nested_prop_atoms_finite)\n\nlemma nested_prop_atoms\\<^sub>\\<nu>_card:\n  \"card (nested_prop_atoms\\<^sub>\\<nu> \\<phi> X) \\<le> card (nested_prop_atoms \\<phi>)\"\n  unfolding nested_prop_atoms\\<^sub>\\<nu>_def\n  by (metis Collect_mem_eq card_image_le image_Collect nested_prop_atoms_finite)\n\nlemma nested_prop_atoms\\<^sub>\\<mu>_card:\n  \"card (nested_prop_atoms\\<^sub>\\<mu> \\<phi> X) \\<le> card (nested_prop_atoms \\<phi>)\"\n  unfolding nested_prop_atoms\\<^sub>\\<mu>_def\n  by (metis Collect_mem_eq card_image_le image_Collect nested_prop_atoms_finite)\n\nlemma GF_advice_nested_prop_atoms\\<^sub>\\<nu>:\n  \"nested_prop_atoms (\\<phi>[X]\\<^sub>\\<nu>) \\<subseteq> nested_prop_atoms\\<^sub>\\<nu> \\<phi> X\"\n  by (induction \\<phi>) (unfold nested_prop_atoms\\<^sub>\\<nu>_def, force+)\n\nlemma FG_advice_nested_prop_atoms\\<^sub>\\<mu>:\n  \"nested_prop_atoms (\\<phi>[Y]\\<^sub>\\<mu>) \\<subseteq> nested_prop_atoms\\<^sub>\\<mu> \\<phi> Y\"\n  by (induction \\<phi>) (unfold nested_prop_atoms\\<^sub>\\<mu>_def, force+)\n\nlemma nested_prop_atoms\\<^sub>\\<nu>_subset:\n  \"nested_prop_atoms \\<phi> \\<subseteq> nested_prop_atoms \\<psi> \\<Longrightarrow> nested_prop_atoms\\<^sub>\\<nu> \\<phi> X \\<subseteq> nested_prop_atoms\\<^sub>\\<nu> \\<psi> X\"\n  unfolding nested_prop_atoms\\<^sub>\\<nu>_def by blast\n\nlemma nested_prop_atoms\\<^sub>\\<mu>_subset:\n  \"nested_prop_atoms \\<phi> \\<subseteq> nested_prop_atoms \\<psi> \\<Longrightarrow> nested_prop_atoms\\<^sub>\\<mu> \\<phi> Y \\<subseteq> nested_prop_atoms\\<^sub>\\<mu> \\<psi> Y\"\n  unfolding nested_prop_atoms\\<^sub>\\<mu>_def by blast\n\nlemma GF_advice_nested_prop_atoms_card:\n  \"card (nested_prop_atoms (\\<phi>[X]\\<^sub>\\<nu>)) \\<le> card (nested_prop_atoms \\<phi>)\"\nproof -\n  have \"card (nested_prop_atoms (\\<phi>[X]\\<^sub>\\<nu>)) \\<le> card (nested_prop_atoms\\<^sub>\\<nu> \\<phi> X)\"\n    by (simp add: nested_prop_atoms\\<^sub>\\<nu>_finite GF_advice_nested_prop_atoms\\<^sub>\\<nu> card_mono)\n\n  then show ?thesis\n    using nested_prop_atoms\\<^sub>\\<nu>_card le_trans by blast\nqed\n\nlemma FG_advice_nested_prop_atoms_card:\n  \"card (nested_prop_atoms (\\<phi>[Y]\\<^sub>\\<mu>)) \\<le> card (nested_prop_atoms \\<phi>)\"\nproof -\n  have \"card (nested_prop_atoms (\\<phi>[Y]\\<^sub>\\<mu>)) \\<le> card (nested_prop_atoms\\<^sub>\\<mu> \\<phi> Y)\"\n    by (simp add: nested_prop_atoms\\<^sub>\\<mu>_finite FG_advice_nested_prop_atoms\\<^sub>\\<mu> card_mono)\n\n  then show ?thesis\n    using nested_prop_atoms\\<^sub>\\<mu>_card le_trans by blast\nqed\n\n\n\nsubsection \\<open>Intersecting the Advice Set\\<close>\n\nlemma GF_advice_inter:\n  \"X \\<inter> subformulas\\<^sub>\\<mu> \\<phi> \\<subseteq> S \\<Longrightarrow> \\<phi>[X \\<inter> S]\\<^sub>\\<nu> = \\<phi>[X]\\<^sub>\\<nu>\"\n  by (induction \\<phi>) auto\n\nlemma GF_advice_inter_subformulas:\n  \"\\<phi>[X \\<inter> subformulas\\<^sub>\\<mu> \\<phi>]\\<^sub>\\<nu> = \\<phi>[X]\\<^sub>\\<nu>\"\n  using GF_advice_inter by blast\n\nlemma GF_advice_minus_subformulas:\n  \"\\<psi> \\<notin> subformulas\\<^sub>\\<mu> \\<phi> \\<Longrightarrow> \\<phi>[X - {\\<psi>}]\\<^sub>\\<nu> = \\<phi>[X]\\<^sub>\\<nu>\"\nproof -\n  assume \"\\<psi> \\<notin> subformulas\\<^sub>\\<mu> \\<phi>\"\n  then have \"subformulas\\<^sub>\\<mu> \\<phi> \\<inter> X \\<subseteq> X - {\\<psi>}\"\n    by blast\n  then show \"\\<phi>[X - {\\<psi>}]\\<^sub>\\<nu> = \\<phi>[X]\\<^sub>\\<nu>\"\n    by (metis GF_advice_inter Diff_subset Int_absorb1 inf.commute)\nqed\n\nlemma GF_advice_minus_size:\n  \"\\<lbrakk>size \\<phi> \\<le> size \\<psi>; \\<phi> \\<noteq> \\<psi>\\<rbrakk> \\<Longrightarrow> \\<phi>[X - {\\<psi>}]\\<^sub>\\<nu> = \\<phi>[X]\\<^sub>\\<nu>\"\n  using subfrmlsn_size subformulas\\<^sub>\\<mu>_subfrmlsn GF_advice_minus_subformulas\n  by fastforce\n\n\n\n\nlemma FG_advice_inter_subformulas:\n  \"\\<phi>[Y \\<inter> subformulas\\<^sub>\\<nu> \\<phi>]\\<^sub>\\<mu> = \\<phi>[Y]\\<^sub>\\<mu>\"\n  using FG_advice_inter by blast\n\nlemma FG_advice_minus_subformulas:\n  \"\\<psi> \\<notin> subformulas\\<^sub>\\<nu> \\<phi> \\<Longrightarrow> \\<phi>[Y - {\\<psi>}]\\<^sub>\\<mu> = \\<phi>[Y]\\<^sub>\\<mu>\"\nproof -\n  assume \"\\<psi> \\<notin> subformulas\\<^sub>\\<nu> \\<phi>\"\n  then have \"subformulas\\<^sub>\\<nu> \\<phi> \\<inter> Y \\<subseteq> Y - {\\<psi>}\"\n    by blast\n  then show \"\\<phi>[Y - {\\<psi>}]\\<^sub>\\<mu>  = \\<phi>[Y]\\<^sub>\\<mu>\"\n    by (metis FG_advice_inter Diff_subset Int_absorb1 inf.commute)\nqed\n\nlemma FG_advice_minus_size:\n  \"\\<lbrakk>size \\<phi> \\<le> size \\<psi>; \\<phi> \\<noteq> \\<psi>\\<rbrakk> \\<Longrightarrow> \\<phi>[Y - {\\<psi>}]\\<^sub>\\<mu> = \\<phi>[Y]\\<^sub>\\<mu>\"\n  using subfrmlsn_size subformulas\\<^sub>\\<nu>_subfrmlsn FG_advice_minus_subformulas\n  by fastforce\n\nlemma FG_advice_insert:\n  \"\\<lbrakk>\\<psi> \\<notin> Y; size \\<phi> < size \\<psi>\\<rbrakk> \\<Longrightarrow> \\<phi>[insert \\<psi> Y]\\<^sub>\\<mu> = \\<phi>[Y]\\<^sub>\\<mu>\"\n  by (metis FG_advice_minus_size Diff_insert_absorb less_imp_le neq_iff)\n\n\n\nsubsection \\<open>Correctness GF-advice function\\<close>\n\nlemma GF_advice_a1:\n  \"\\<lbrakk>\\<F> \\<phi> w \\<subseteq> X; w \\<Turnstile>\\<^sub>n \\<phi>\\<rbrakk> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<nu>\"\nproof (induction \\<phi> arbitrary: w)\n  case (Next_ltln \\<phi>)\n  then show ?case\n    using \\<F>_suffix by simp blast\nnext\n  case (Until_ltln \\<phi>1 \\<phi>2)\n\n  have \"\\<F> (\\<phi>1 W\\<^sub>n \\<phi>2) w \\<subseteq> \\<F> (\\<phi>1 U\\<^sub>n \\<phi>2) w\"\n    by fastforce\n  then have \"\\<F> (\\<phi>1 W\\<^sub>n \\<phi>2) w \\<subseteq> X\" and \"w \\<Turnstile>\\<^sub>n \\<phi>1 W\\<^sub>n \\<phi>2\"\n    using Until_ltln.prems ltln_strong_to_weak by blast+\n  then have \"w \\<Turnstile>\\<^sub>n \\<phi>1[X]\\<^sub>\\<nu> W\\<^sub>n \\<phi>2[X]\\<^sub>\\<nu>\"\n    using Until_ltln.IH\n    by simp (meson \\<F>_suffix subset_trans sup.boundedE)\n\n  moreover\n\n  have \"w \\<Turnstile>\\<^sub>n \\<phi>1 U\\<^sub>n \\<phi>2\"\n    using Until_ltln.prems by simp\n  then have \"\\<phi>1 U\\<^sub>n \\<phi>2 \\<in> \\<F> (\\<phi>1 U\\<^sub>n \\<phi>2) w\"\n    by force\n  then have \"\\<phi>1 U\\<^sub>n \\<phi>2 \\<in> X\"\n    using Until_ltln.prems by fast\n\n  ultimately show ?case\n    by auto\nnext\n  case (Release_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    by simp (meson \\<F>_suffix subset_trans sup.boundedE)\nnext\n  case (WeakUntil_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    by simp (meson \\<F>_suffix subset_trans sup.boundedE)\nnext\n  case (StrongRelease_ltln \\<phi>1 \\<phi>2)\n\n  have \"\\<F> (\\<phi>1 R\\<^sub>n \\<phi>2) w \\<subseteq> \\<F> (\\<phi>1 M\\<^sub>n \\<phi>2) w\"\n    by fastforce\n  then have \"\\<F> (\\<phi>1 R\\<^sub>n \\<phi>2) w \\<subseteq> X\" and \"w \\<Turnstile>\\<^sub>n \\<phi>1 R\\<^sub>n \\<phi>2\"\n    using StrongRelease_ltln.prems ltln_strong_to_weak by blast+\n  then have \"w \\<Turnstile>\\<^sub>n \\<phi>1[X]\\<^sub>\\<nu> R\\<^sub>n \\<phi>2[X]\\<^sub>\\<nu>\"\n    using StrongRelease_ltln.IH\n    by simp (meson \\<F>_suffix subset_trans sup.boundedE)\n\n  moreover\n\n  have \"w \\<Turnstile>\\<^sub>n \\<phi>1 M\\<^sub>n \\<phi>2\"\n    using StrongRelease_ltln.prems by simp\n  then have \"\\<phi>1 M\\<^sub>n \\<phi>2 \\<in> \\<F> (\\<phi>1 M\\<^sub>n \\<phi>2) w\"\n    by force\n  then have \"\\<phi>1 M\\<^sub>n \\<phi>2 \\<in> X\"\n    using StrongRelease_ltln.prems by fast\n\n  ultimately show ?case\n    by auto\nqed auto\n\nlemma GF_advice_a2_helper:\n  \"\\<lbrakk>\\<forall>\\<psi> \\<in> X. w \\<Turnstile>\\<^sub>n G\\<^sub>n (F\\<^sub>n \\<psi>); w \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<nu>\\<rbrakk> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>\"\nproof (induction \\<phi> arbitrary: w)\n  case (Next_ltln \\<phi>)\n  then show ?case\n    unfolding GF_advice.simps semantics_ltln.simps(7)\n    using GF_suffix by blast\nnext\n  case (Until_ltln \\<phi>1 \\<phi>2)\n\n  then have \"\\<phi>1 U\\<^sub>n \\<phi>2 \\<in> X\"\n    using ccontr[of \"\\<phi>1 U\\<^sub>n \\<phi>2 \\<in> X\"] by force\n  then have \"w \\<Turnstile>\\<^sub>n F\\<^sub>n \\<phi>2\"\n    using Until_ltln.prems by fastforce\n\n  moreover\n\n  have \"w \\<Turnstile>\\<^sub>n (\\<phi>1 U\\<^sub>n \\<phi>2)[X]\\<^sub>\\<nu>\"\n    using Until_ltln.prems by simp\n  then have \"w \\<Turnstile>\\<^sub>n (\\<phi>1[X]\\<^sub>\\<nu>) W\\<^sub>n (\\<phi>2[X]\\<^sub>\\<nu>)\"\n    unfolding GF_advice.simps using `\\<phi>1 U\\<^sub>n \\<phi>2 \\<in> X` by simp\n  then have \"w \\<Turnstile>\\<^sub>n \\<phi>1 W\\<^sub>n \\<phi>2\"\n    unfolding GF_advice.simps semantics_ltln.simps(10)\n    by (metis GF_suffix Until_ltln.IH Until_ltln.prems(1))\n\n  ultimately show ?case\n    using ltln_weak_to_strong by blast\nnext\n  case (Release_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    unfolding GF_advice.simps semantics_ltln.simps(9)\n    by (metis GF_suffix Release_ltln.IH Release_ltln.prems(1))\nnext\n  case (WeakUntil_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    unfolding GF_advice.simps semantics_ltln.simps(10)\n    by (metis GF_suffix)\nnext\n  case (StrongRelease_ltln \\<phi>1 \\<phi>2)\n\n  then have \"\\<phi>1 M\\<^sub>n \\<phi>2 \\<in> X\"\n    using ccontr[of \"\\<phi>1 M\\<^sub>n \\<phi>2 \\<in> X\"] by force\n  then have \"w \\<Turnstile>\\<^sub>n F\\<^sub>n \\<phi>1\"\n    using StrongRelease_ltln.prems by fastforce\n\n  moreover\n\n  have \"w \\<Turnstile>\\<^sub>n (\\<phi>1 M\\<^sub>n \\<phi>2)[X]\\<^sub>\\<nu>\"\n    using StrongRelease_ltln.prems by simp\n  then have \"w \\<Turnstile>\\<^sub>n (\\<phi>1[X]\\<^sub>\\<nu>) R\\<^sub>n (\\<phi>2[X]\\<^sub>\\<nu>)\"\n    unfolding GF_advice.simps using `\\<phi>1 M\\<^sub>n \\<phi>2 \\<in> X` by simp\n  then have \"w \\<Turnstile>\\<^sub>n \\<phi>1 R\\<^sub>n \\<phi>2\"\n    unfolding GF_advice.simps semantics_ltln.simps(9)\n    by (metis GF_suffix StrongRelease_ltln.IH StrongRelease_ltln.prems(1))\n\n  ultimately show ?case\n    using ltln_weak_to_strong by blast\nqed auto\n\nlemma GF_advice_a2:\n  \"\\<lbrakk>X \\<subseteq> \\<G>\\<F> \\<phi> w; w \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<nu>\\<rbrakk> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>\"\n  by (metis GF_advice_a2_helper \\<G>\\<F>_elim subset_eq)\n\nlemma GF_advice_a3:\n  \"\\<lbrakk>X = \\<F> \\<phi> w; X = \\<G>\\<F> \\<phi> w\\<rbrakk> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi> \\<longleftrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<nu>\"\n  using GF_advice_a1 GF_advice_a2 by fastforce\n\n\n\nsubsection \\<open>Correctness FG-advice function\\<close>\n\nlemma FG_advice_b1:\n  \"\\<lbrakk>\\<F>\\<G> \\<phi> w \\<subseteq> Y; w \\<Turnstile>\\<^sub>n \\<phi>\\<rbrakk> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>[Y]\\<^sub>\\<mu>\"\nproof (induction \\<phi> arbitrary: w)\n  case (Next_ltln \\<phi>)\n  then show ?case\n    using \\<F>\\<G>_suffix by simp blast\nnext\n  case (Until_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    by simp (metis \\<F>\\<G>_suffix)\nnext\n  case (Release_ltln \\<phi>1 \\<phi>2)\n\n  show ?case\n  proof (cases \"\\<phi>1 R\\<^sub>n \\<phi>2 \\<in> Y\")\n    case False\n    then have \"\\<phi>1 R\\<^sub>n \\<phi>2 \\<notin> \\<F>\\<G> (\\<phi>1 R\\<^sub>n \\<phi>2) w\"\n      using Release_ltln.prems by blast\n    then have \"\\<not> w \\<Turnstile>\\<^sub>n G\\<^sub>n \\<phi>2\"\n      by fastforce\n    then have \"w \\<Turnstile>\\<^sub>n \\<phi>1 M\\<^sub>n \\<phi>2\"\n      using Release_ltln.prems ltln_weak_to_strong by blast\n\n    moreover\n\n    have \"\\<F>\\<G> (\\<phi>1 M\\<^sub>n \\<phi>2) w \\<subseteq> \\<F>\\<G> (\\<phi>1 R\\<^sub>n \\<phi>2) w\"\n      by fastforce\n    then have \"\\<F>\\<G> (\\<phi>1 M\\<^sub>n \\<phi>2) w \\<subseteq> Y\"\n      using Release_ltln.prems by blast\n\n    ultimately show ?thesis\n      using Release_ltln.IH by simp (metis \\<F>\\<G>_suffix)\n  qed simp\nnext\n  case (WeakUntil_ltln \\<phi>1 \\<phi>2)\n\n  show ?case\n  proof (cases \"\\<phi>1 W\\<^sub>n \\<phi>2 \\<in> Y\")\n    case False\n    then have \"\\<phi>1 W\\<^sub>n \\<phi>2 \\<notin> \\<F>\\<G> (\\<phi>1 W\\<^sub>n \\<phi>2) w\"\n      using WeakUntil_ltln.prems by blast\n    then have \"\\<not> w \\<Turnstile>\\<^sub>n G\\<^sub>n \\<phi>1\"\n      by fastforce\n    then have \"w \\<Turnstile>\\<^sub>n \\<phi>1 U\\<^sub>n \\<phi>2\"\n      using WeakUntil_ltln.prems ltln_weak_to_strong by blast\n\n    moreover\n\n    have \"\\<F>\\<G> (\\<phi>1 U\\<^sub>n \\<phi>2) w \\<subseteq> \\<F>\\<G> (\\<phi>1 W\\<^sub>n \\<phi>2) w\"\n      by fastforce\n    then have \"\\<F>\\<G> (\\<phi>1 U\\<^sub>n \\<phi>2) w \\<subseteq> Y\"\n      using WeakUntil_ltln.prems by blast\n\n    ultimately show ?thesis\n      using WeakUntil_ltln.IH by simp (metis \\<F>\\<G>_suffix)\n  qed simp\nnext\n  case (StrongRelease_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    by simp (metis \\<F>\\<G>_suffix)\nqed auto\n\nlemma FG_advice_b2_helper:\n  \"\\<lbrakk>\\<forall>\\<psi> \\<in> Y. w \\<Turnstile>\\<^sub>n G\\<^sub>n \\<psi>; w \\<Turnstile>\\<^sub>n \\<phi>[Y]\\<^sub>\\<mu>\\<rbrakk> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>\"\nproof (induction \\<phi> arbitrary: w)\n  case (Until_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    by simp (metis (no_types, lifting) suffix_suffix)\nnext\n  case (Release_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n  proof (cases \"\\<phi>1 R\\<^sub>n \\<phi>2 \\<in> Y\")\n    case True\n    then show ?thesis\n      using Release_ltln.prems by force\n  next\n    case False\n    then have \"w \\<Turnstile>\\<^sub>n (\\<phi>1[Y]\\<^sub>\\<mu>) M\\<^sub>n (\\<phi>2[Y]\\<^sub>\\<mu>)\"\n      using Release_ltln.prems by simp\n    then have \"w \\<Turnstile>\\<^sub>n \\<phi>1 M\\<^sub>n \\<phi>2\"\n      using Release_ltln\n      by simp (metis (no_types, lifting) suffix_suffix)\n    then show ?thesis\n      using ltln_strong_to_weak by fast\n  qed\nnext\n  case (WeakUntil_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n  proof (cases \"\\<phi>1 W\\<^sub>n \\<phi>2 \\<in> Y\")\n    case True\n    then show ?thesis\n      using WeakUntil_ltln.prems by force\n  next\n    case False\n    then have \"w \\<Turnstile>\\<^sub>n (\\<phi>1[Y]\\<^sub>\\<mu>) U\\<^sub>n (\\<phi>2[Y]\\<^sub>\\<mu>)\"\n      using WeakUntil_ltln.prems by simp\n    then have \"w \\<Turnstile>\\<^sub>n \\<phi>1 U\\<^sub>n \\<phi>2\"\n      using WeakUntil_ltln\n      by simp (metis (no_types, lifting) suffix_suffix)\n    then show ?thesis\n      using ltln_strong_to_weak by fast\n  qed\nnext\n  case (StrongRelease_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    by simp (metis (no_types, lifting) suffix_suffix)\nqed auto\n\nlemma FG_advice_b2:\n  \"\\<lbrakk>Y \\<subseteq> \\<G> \\<phi> w; w \\<Turnstile>\\<^sub>n \\<phi>[Y]\\<^sub>\\<mu>\\<rbrakk> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>\"\n  by (metis FG_advice_b2_helper \\<G>_elim subset_eq)\n\nlemma FG_advice_b3:\n  \"\\<lbrakk>Y = \\<F>\\<G> \\<phi> w; Y = \\<G> \\<phi> w\\<rbrakk> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi> \\<longleftrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>[Y]\\<^sub>\\<mu>\"\n  using FG_advice_b1 FG_advice_b2 by fastforce\n\n\n\nsubsection \\<open>Advice Functions and the ``after'' Function\\<close>\n\nlemma GF_advice_af_letter:\n  \"(x ## w) \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<nu> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n (af_letter \\<phi> x)[X]\\<^sub>\\<nu>\"\nproof (induction \\<phi>)\n  case (Until_ltln \\<phi>1 \\<phi>2)\n\n  then have \"w \\<Turnstile>\\<^sub>n af_letter ((\\<phi>1 U\\<^sub>n \\<phi>2)[X]\\<^sub>\\<nu>) x\"\n    using af_letter_build by blast\n\n  then show ?case\n    using Until_ltln.IH af_letter_build by fastforce\nnext\n  case (Release_ltln \\<phi>1 \\<phi>2)\n\n  then have \"w \\<Turnstile>\\<^sub>n af_letter ((\\<phi>1 R\\<^sub>n \\<phi>2)[X]\\<^sub>\\<nu>) x\"\n    using af_letter_build by blast\n\n  then show ?case\n    using Release_ltln.IH af_letter_build by auto\nnext\n  case (WeakUntil_ltln \\<phi>1 \\<phi>2)\n\n  then have \"w \\<Turnstile>\\<^sub>n af_letter ((\\<phi>1 W\\<^sub>n \\<phi>2)[X]\\<^sub>\\<nu>) x\"\n    using af_letter_build by blast\n\n  then show ?case\n    using WeakUntil_ltln.IH af_letter_build by auto\nnext\n  case (StrongRelease_ltln \\<phi>1 \\<phi>2)\n\n  then have \"w \\<Turnstile>\\<^sub>n af_letter ((\\<phi>1 M\\<^sub>n \\<phi>2)[X]\\<^sub>\\<nu>) x\"\n    using af_letter_build by blast\n\n  then show ?case\n    using StrongRelease_ltln.IH af_letter_build by force\nqed auto\n\nlemma FG_advice_af_letter:\n  \"w \\<Turnstile>\\<^sub>n (af_letter \\<phi> x)[Y]\\<^sub>\\<mu> \\<Longrightarrow> (x ## w) \\<Turnstile>\\<^sub>n \\<phi>[Y]\\<^sub>\\<mu>\"\nproof (induction \\<phi>)\n  case (Prop_ltln a)\n  then show ?case\n    using semantics_ltln.simps(3) by fastforce\nnext\n  case (Until_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    unfolding af_letter.simps FG_advice.simps semantics_ltln.simps(5,6)\n    using af_letter_build apply (cases \"w \\<Turnstile>\\<^sub>n af_letter \\<phi>2 x[Y]\\<^sub>\\<mu>\") apply force\n    by (metis af_letter.simps(8) semantics_ltln.simps(5) semantics_ltln.simps(6))\nnext\n  case (Release_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    apply (cases \"\\<phi>1 R\\<^sub>n \\<phi>2 \\<in> Y\")\n    apply simp\n    unfolding af_letter.simps FG_advice.simps semantics_ltln.simps(5,6)\n    using af_letter_build  apply (cases \"w \\<Turnstile>\\<^sub>n af_letter \\<phi>1 x[Y]\\<^sub>\\<mu>\") apply force\n    by (metis (full_types) af_letter.simps(11) semantics_ltln.simps(5) semantics_ltln.simps(6))\nnext\n  case (WeakUntil_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    apply (cases \"\\<phi>1 W\\<^sub>n \\<phi>2 \\<in> Y\")\n    apply simp\n    unfolding af_letter.simps FG_advice.simps semantics_ltln.simps(5,6)\n    using af_letter_build  apply (cases \"w \\<Turnstile>\\<^sub>n af_letter \\<phi>2 x[Y]\\<^sub>\\<mu>\") apply force\n    by (metis (full_types) af_letter.simps(8) semantics_ltln.simps(5) semantics_ltln.simps(6))\nnext\n  case (StrongRelease_ltln \\<phi>1 \\<phi>2)\n  then show ?case\n    unfolding af_letter.simps FG_advice.simps semantics_ltln.simps(5,6)\n    using af_letter_build apply (cases \"w \\<Turnstile>\\<^sub>n af_letter \\<phi>1 x[Y]\\<^sub>\\<mu>\") apply force\n    by (metis af_letter.simps(11) semantics_ltln.simps(5) semantics_ltln.simps(6))\nqed auto\n\nlemma GF_advice_af:\n  \"(w \\<frown> w') \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<nu> \\<Longrightarrow> w' \\<Turnstile>\\<^sub>n (af \\<phi> w)[X]\\<^sub>\\<nu>\"\n  by (induction w arbitrary: \\<phi>) (simp, insert GF_advice_af_letter, fastforce)\n\nlemma FG_advice_af:\n  \"w' \\<Turnstile>\\<^sub>n (af \\<phi> w)[X]\\<^sub>\\<mu> \\<Longrightarrow> (w \\<frown> w') \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<mu>\"\n  by (induction w arbitrary: \\<phi>) (simp, insert FG_advice_af_letter, fastforce)\n\n\n\nlemma FG_advice_af_2:\n  \"suffix i w \\<Turnstile>\\<^sub>n (af \\<phi> (prefix i w))[X]\\<^sub>\\<mu> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<mu>\"\n  using FG_advice_af by force\n\n(* TODO move to Omega_Words_Fun.thy ?? *)\nlemma prefix_suffix_subsequence: \"prefix i (suffix j w) = (w [j \\<rightarrow> i + j])\"\n  by (simp add: add.commute)\n\ntext \\<open>We show this generic lemma to prove the following theorems:\\<close>\n\nlemma GF_advice_sync:\n  fixes index :: \"nat \\<Rightarrow> nat\"\n  fixes formula :: \"nat \\<Rightarrow> 'a ltln\"\n  assumes \"\\<And>i. i < n \\<Longrightarrow> \\<exists>j. suffix ((index i) + j) w \\<Turnstile>\\<^sub>n af (formula i) (w [index i \\<rightarrow> (index i) + j])[X]\\<^sub>\\<nu>\"\n  shows \"\\<exists>k. (\\<forall>i < n. k \\<ge> index i \\<and> suffix k w \\<Turnstile>\\<^sub>n af (formula i) (w [index i \\<rightarrow> k])[X]\\<^sub>\\<nu>)\"\n  using assms\nproof (induction n)\n  case (Suc n)\n\n  obtain k1 where leq1: \"\\<And>i. i < n \\<Longrightarrow> k1 \\<ge> index i\"\n    and suffix1: \"\\<And>i. i < n \\<Longrightarrow> suffix k1 w \\<Turnstile>\\<^sub>n af (formula i) (w [(index i) \\<rightarrow> k1])[X]\\<^sub>\\<nu>\"\n    using Suc less_SucI by blast\n\n  obtain k2 where leq2: \"k2 \\<ge> index n\"\n    and suffix2: \"suffix k2 w \\<Turnstile>\\<^sub>n af (formula n) (w [index n \\<rightarrow> k2])[X]\\<^sub>\\<nu>\"\n    using le_add1 Suc.prems by blast\n\n  define k where \"k \\<equiv> k1 + k2\"\n\n  have \"\\<And>i. i < Suc n \\<Longrightarrow> k \\<ge> index i\"\n    unfolding k_def by (metis leq1 leq2 less_SucE trans_le_add1 trans_le_add2)\n\n  moreover\n\n  {\n    have \"\\<And>i. i < n \\<Longrightarrow> suffix k w \\<Turnstile>\\<^sub>n af (formula i) (w [(index i) \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\n      unfolding k_def\n      by (metis GF_advice_af_2[OF suffix1, unfolded suffix_suffix prefix_suffix_subsequence] af_subsequence_append leq1 add.commute le_add1)\n\n    moreover\n\n    have \"suffix k w \\<Turnstile>\\<^sub>n af (formula n) (w [index n \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\n      unfolding k_def\n      by (metis GF_advice_af_2[OF suffix2, unfolded suffix_suffix prefix_suffix_subsequence] af_subsequence_append leq2 add.commute le_add1)\n\n    ultimately\n\n    have \"\\<And>i. i \\<le> n \\<Longrightarrow> suffix k w \\<Turnstile>\\<^sub>n af (formula i) (w [(index i) \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\n      using nat_less_le by blast\n  }\n\n  ultimately\n\n  show ?case\n    by (meson less_Suc_eq_le)\nqed simp\n\nlemma GF_advice_sync_and:\n  assumes \"\\<exists>i. suffix i w \\<Turnstile>\\<^sub>n af \\<phi> (prefix i w)[X]\\<^sub>\\<nu>\"\n  assumes \"\\<exists>i. suffix i w \\<Turnstile>\\<^sub>n af \\<psi> (prefix i w)[X]\\<^sub>\\<nu>\"\n  shows \"\\<exists>i. suffix i w \\<Turnstile>\\<^sub>n af \\<phi> (prefix i w)[X]\\<^sub>\\<nu> \\<and> suffix i w \\<Turnstile>\\<^sub>n af \\<psi> (prefix i w)[X]\\<^sub>\\<nu>\"\nproof -\n  let ?formula = \"\\<lambda>i :: nat. (if (i = 0) then \\<phi> else \\<psi>)\"\n\n  have assms: \"\\<And>i. i < 2 \\<Longrightarrow> \\<exists>j. suffix j w \\<Turnstile>\\<^sub>n af (?formula i) (w [0 \\<rightarrow> j])[X]\\<^sub>\\<nu>\"\n    using assms by simp\n  obtain k where k_def: \"\\<And>i :: nat. i < 2 \\<Longrightarrow> suffix k w \\<Turnstile>\\<^sub>n af (if i = 0 then \\<phi> else \\<psi>) (prefix k w)[X]\\<^sub>\\<nu>\"\n    using GF_advice_sync[of \"2\" \"\\<lambda>i. 0\" w ?formula, simplified, OF assms, simplified] by blast\n  show ?thesis\n    using k_def[of 0] k_def[of 1] by auto\nqed\n\nlemma GF_advice_sync_less:\n  assumes \"\\<And>i. i < n \\<Longrightarrow> \\<exists>j. suffix (i + j) w \\<Turnstile>\\<^sub>n af \\<phi> (w [i \\<rightarrow> j + i])[X]\\<^sub>\\<nu>\"\n  assumes \"\\<exists>j. suffix (n + j) w \\<Turnstile>\\<^sub>n af \\<psi> (w [n \\<rightarrow> j + n])[X]\\<^sub>\\<nu>\"\n  shows \"\\<exists>k \\<ge> n. (\\<forall>j < n. suffix k w \\<Turnstile>\\<^sub>n af \\<phi> (w [j \\<rightarrow> k])[X]\\<^sub>\\<nu>) \\<and> suffix k w \\<Turnstile>\\<^sub>n af \\<psi> (w [n \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\nproof -\n  let ?index = \"\\<lambda>i. min i n\"\n  let ?formula = \"\\<lambda>i. if (i < n) then \\<phi> else \\<psi>\"\n\n  {\n    fix i\n    assume \"i < Suc n\"\n    then have min_def: \"min i n = i\"\n      by simp\n    have \"\\<exists>j. suffix ((?index i) + j) w \\<Turnstile>\\<^sub>n af (?formula i) (w [?index i \\<rightarrow> (?index i) + j])[X]\\<^sub>\\<nu>\"\n      unfolding min_def\n      by (cases \"i < n\")\n         (metis (full_types) assms(1) add.commute, metis (full_types) assms(2) \\<open>i < Suc n\\<close> add.commute  less_SucE)\n  }\n\n  then obtain k where leq: \"(\\<And>i. i < Suc n \\<Longrightarrow> min i n \\<le> k)\"\n    and suffix: \"\\<And>i. i < Suc n \\<Longrightarrow> suffix k w \\<Turnstile>\\<^sub>n af (if i < n then \\<phi> else \\<psi>) (w [min i n \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\n    using GF_advice_sync[of \"Suc n\" ?index w ?formula X] by metis\n\n  have \"\\<forall>j < n. suffix k w \\<Turnstile>\\<^sub>n af \\<phi> (w [j \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\n    using suffix by (metis (full_types) less_SucI min.strict_order_iff)\n\n  moreover\n\n  have \"suffix k w \\<Turnstile>\\<^sub>n af \\<psi> (w [n \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\n    using suffix[of n, simplified] by blast\n\n  moreover\n\n  have \"k \\<ge> n\"\n    using leq by presburger\n\n  ultimately\n  show ?thesis\n    by auto\nqed\n\nlemma GF_advice_sync_lesseq:\n  assumes \"\\<And>i. i \\<le> n \\<Longrightarrow> \\<exists>j. suffix (i + j) w \\<Turnstile>\\<^sub>n af \\<phi> (w [i \\<rightarrow> j + i])[X]\\<^sub>\\<nu>\"\n  assumes \"\\<exists>j. suffix (n + j) w \\<Turnstile>\\<^sub>n af \\<psi> (w [n \\<rightarrow> j + n])[X]\\<^sub>\\<nu>\"\n  shows \"\\<exists>k \\<ge> n. (\\<forall>j \\<le> n. suffix k w \\<Turnstile>\\<^sub>n af \\<phi> (w [j \\<rightarrow> k])[X]\\<^sub>\\<nu>) \\<and> suffix k w \\<Turnstile>\\<^sub>n af \\<psi> (w [n \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\nproof -\n  let ?index = \"\\<lambda>i. min i n\"\n  let ?formula = \"\\<lambda>i. if (i \\<le> n) then \\<phi> else \\<psi>\"\n\n  {\n    fix i\n    assume \"i < Suc (Suc n)\"\n    hence \"\\<exists>j. suffix ((?index i) + j) w \\<Turnstile>\\<^sub>n af (?formula i) (w [?index i \\<rightarrow> (?index i) + j])[X]\\<^sub>\\<nu>\"\n    proof (cases \"i < Suc n\")\n      case True\n      then have min_def: \"min i n = i\"\n        by simp\n      show ?thesis\n        unfolding min_def by (metis (full_types) assms(1) Suc_leI Suc_le_mono True add.commute)\n    next\n      case False\n      then have i_def: \"i = Suc n\"\n        using \\<open>i < Suc (Suc n)\\<close> less_antisym by blast\n      have min_def: \"min i n = n\"\n        unfolding i_def by simp\n      show ?thesis\n        using assms(2) False\n        by (simp add: min_def add.commute)\n    qed\n  }\n\n  then obtain k where leq: \"(\\<And>i. i \\<le> Suc n \\<Longrightarrow> min i n \\<le> k)\"\n    and suffix: \"\\<And>i :: nat. i < Suc (Suc n) \\<Longrightarrow> suffix k w \\<Turnstile>\\<^sub>n af (if i \\<le> n then \\<phi> else \\<psi>) (w [min i n \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\n    using GF_advice_sync[of \"Suc (Suc n)\" ?index w ?formula X]\n    by (metis (no_types, hide_lams) less_Suc_eq min_le_iff_disj)\n\n  have \"\\<forall>j \\<le> n. suffix k w \\<Turnstile>\\<^sub>n af \\<phi> (w [j \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\n    using suffix by (metis (full_types) le_SucI less_Suc_eq_le min.orderE)\n\n  moreover\n\n  have \"suffix k w \\<Turnstile>\\<^sub>n af \\<psi> (w [n \\<rightarrow> k])[X]\\<^sub>\\<nu>\"\n    using suffix[of \"Suc n\", simplified] by linarith\n\n  moreover\n\n  have \"k \\<ge> n\"\n    using leq by presburger\n\n  ultimately\n  show ?thesis\n    by auto\nqed\n\nlemma af_subsequence_U_GF_advice:\n  assumes \"i \\<le> n\"\n  assumes \"suffix n w \\<Turnstile>\\<^sub>n ((af \\<psi> (w [i \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n  assumes \"\\<And>j. j < i \\<Longrightarrow> suffix n w \\<Turnstile>\\<^sub>n ((af \\<phi> (w [j \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n  shows \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> U\\<^sub>n \\<psi>) (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n  using assms\nproof (induction i arbitrary: w n)\n  case 0\n  then have A: \"suffix n w \\<Turnstile>\\<^sub>n ((af \\<psi> (w [0 \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n    by blast\n  then have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<psi> (w [0 \\<rightarrow> Suc n]))[X]\\<^sub>\\<nu>\"\n    using GF_advice_af_2[OF A, of 1] by simp\n  then show ?case\n    unfolding GF_advice.simps af_subsequence_U semantics_ltln.simps by blast\nnext\n  case (Suc i)\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<phi> (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n    using Suc.prems(3)[OF zero_less_Suc, THEN GF_advice_af_2, unfolded suffix_suffix, of 1]\n    by simp\n  moreover\n  have B: \"(Suc (n - 1)) = n\"\n    using Suc by simp\n  note Suc.IH[of \"n - 1\" \"suffix 1 w\", unfolded suffix_suffix] Suc.prems\n  then have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> U\\<^sub>n \\<psi>) (w [1 \\<rightarrow> (Suc n)]))[X]\\<^sub>\\<nu>\"\n    by (metis B One_nat_def Suc_le_mono Suc_mono plus_1_eq_Suc subsequence_shift)\n  ultimately\n  show ?case\n    unfolding af_subsequence_U semantics_ltln.simps GF_advice.simps by blast\nqed\n\nlemma af_subsequence_M_GF_advice:\n  assumes \"i \\<le> n\"\n  assumes \"suffix n w \\<Turnstile>\\<^sub>n ((af \\<phi> (w [i \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n  assumes \"\\<And>j. j \\<le> i \\<Longrightarrow> suffix n w \\<Turnstile>\\<^sub>n ((af \\<psi> (w [j \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n  shows \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> M\\<^sub>n \\<psi>) (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n  using assms\nproof (induction i arbitrary: w n)\n  case 0\n  then have A: \"suffix n w \\<Turnstile>\\<^sub>n ((af \\<psi> (w [0 \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n    by blast\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<psi> (w [0 \\<rightarrow> Suc n]))[X]\\<^sub>\\<nu>\"\n    using GF_advice_af_2[OF A, of 1] by simp\n  moreover\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<phi> (w [0 \\<rightarrow> Suc n]))[X]\\<^sub>\\<nu>\"\n    using GF_advice_af_2[OF \"0.prems\"(2), of 1, unfolded suffix_suffix] by auto\n  ultimately\n  show ?case\n    unfolding af_subsequence_M GF_advice.simps semantics_ltln.simps by blast\nnext\n  case (Suc i)\n  have \"suffix 1 (suffix n w) \\<Turnstile>\\<^sub>n af (af \\<psi> (prefix n w)) [suffix n w 0][X]\\<^sub>\\<nu>\"\n    by (metis (no_types) GF_advice_af_2 Suc.prems(3) plus_1_eq_Suc subsequence_singleton suffix_0 suffix_suffix zero_le)\n  then have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<psi> (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n    using Suc.prems(3)[THEN GF_advice_af_2, unfolded suffix_suffix, of 1] by simp\n  moreover\n  have B: \"(Suc (n - 1)) = n\"\n    using Suc by simp\n  note Suc.IH[of _ \"suffix 1 w\", unfolded subsequence_shift suffix_suffix]\n  then have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> M\\<^sub>n \\<psi>) (w [1 \\<rightarrow> (Suc n)]))[X]\\<^sub>\\<nu>\"\n    by (metis B One_nat_def Suc_le_mono plus_1_eq_Suc Suc.prems)\n  ultimately\n  show ?case\n    unfolding af_subsequence_M semantics_ltln.simps GF_advice.simps by blast\nqed\n\nlemma af_subsequence_R_GF_advice:\n  assumes \"i \\<le> n\"\n  assumes \"suffix n w \\<Turnstile>\\<^sub>n ((af \\<phi> (w [i \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n  assumes \"\\<And>j. j \\<le> i \\<Longrightarrow> suffix n w \\<Turnstile>\\<^sub>n ((af \\<psi> (w [j \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n  shows \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> R\\<^sub>n \\<psi>) (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n  using assms\nproof (induction i arbitrary: w n)\n  case 0\n  then have A: \"suffix n w \\<Turnstile>\\<^sub>n ((af \\<psi> (w [0 \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n    by blast\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<psi> (w [0 \\<rightarrow> Suc n]))[X]\\<^sub>\\<nu>\"\n    using GF_advice_af_2[OF A, of 1] by simp\n  moreover\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<phi> (w [0 \\<rightarrow> Suc n]))[X]\\<^sub>\\<nu>\"\n    using GF_advice_af_2[OF \"0.prems\"(2), of 1, unfolded suffix_suffix] by auto\n  ultimately\n  show ?case\n    unfolding af_subsequence_R GF_advice.simps semantics_ltln.simps by blast\nnext\n  case (Suc i)\n  have \"suffix 1 (suffix n w) \\<Turnstile>\\<^sub>n af (af \\<psi> (prefix n w)) [suffix n w 0][X]\\<^sub>\\<nu>\"\n    by (metis (no_types) GF_advice_af_2 Suc.prems(3) plus_1_eq_Suc subsequence_singleton suffix_0 suffix_suffix zero_le)\n  then have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<psi> (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n    using Suc.prems(3)[THEN GF_advice_af_2, unfolded suffix_suffix, of 1] by simp\n  moreover\n  have B: \"(Suc (n - 1)) = n\"\n    using Suc by simp\n  note Suc.IH[of _ \"suffix 1 w\", unfolded subsequence_shift suffix_suffix]\n  then have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> R\\<^sub>n \\<psi>) (w [1 \\<rightarrow> (Suc n)]))[X]\\<^sub>\\<nu>\"\n    by (metis B One_nat_def Suc_le_mono plus_1_eq_Suc Suc.prems)\n  ultimately\n  show ?case\n    unfolding af_subsequence_R semantics_ltln.simps GF_advice.simps by blast\nqed\n\nlemma af_subsequence_W_GF_advice:\n  assumes \"i \\<le> n\"\n  assumes \"suffix n w \\<Turnstile>\\<^sub>n ((af \\<psi> (w [i \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n  assumes \"\\<And>j. j < i \\<Longrightarrow> suffix n w \\<Turnstile>\\<^sub>n ((af \\<phi> (w [j \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n  shows \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> W\\<^sub>n \\<psi>) (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n  using assms\nproof (induction i arbitrary: w n)\n  case 0\n  then have A: \"suffix n w \\<Turnstile>\\<^sub>n ((af \\<psi> (w [0 \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n    by blast\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<psi> (w [0 \\<rightarrow> Suc n]))[X]\\<^sub>\\<nu>\"\n    using GF_advice_af_2[OF A, of 1] by simp\n  then show ?case\n    unfolding af_subsequence_W GF_advice.simps semantics_ltln.simps by blast\nnext\n  case (Suc i)\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<phi> (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n    using Suc.prems(3)[OF zero_less_Suc, THEN GF_advice_af_2, unfolded suffix_suffix, of 1]\n    by simp\n  moreover\n  have B: \"(Suc (n - 1)) = n\"\n    using Suc by simp\n  note Suc.IH[of \"n - 1\" \"suffix 1 w\", unfolded suffix_suffix] Suc.prems\n  then have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> W\\<^sub>n \\<psi>) (w [1 \\<rightarrow> (Suc n)]))[X]\\<^sub>\\<nu>\"\n    by (metis B One_nat_def Suc_le_mono Suc_mono plus_1_eq_Suc subsequence_shift)\n  ultimately\n  show ?case\n    unfolding af_subsequence_W unfolding semantics_ltln.simps GF_advice.simps by simp\nqed\n\nlemma af_subsequence_R_GF_advice_connect:\n  assumes \"i \\<le> n\"\n  assumes \"suffix n w \\<Turnstile>\\<^sub>n af (\\<phi> R\\<^sub>n \\<psi>) (w [i \\<rightarrow> n])[X]\\<^sub>\\<nu>\"\n  assumes \"\\<And>j. j \\<le> i \\<Longrightarrow> suffix n w \\<Turnstile>\\<^sub>n ((af \\<psi> (w [j \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n  shows \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> R\\<^sub>n \\<psi>) (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n  using assms\nproof (induction i arbitrary: w n)\n  case 0\n  then have A: \"suffix n w \\<Turnstile>\\<^sub>n ((af \\<psi> (w [0 \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n    by blast\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<psi> (w [0 \\<rightarrow> Suc n]))[X]\\<^sub>\\<nu>\"\n    using GF_advice_af_2[OF A, of 1] by simp\n  moreover\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> R\\<^sub>n \\<psi>) (w [0 \\<rightarrow> Suc n]))[X]\\<^sub>\\<nu>\"\n    using GF_advice_af_2[OF \"0.prems\"(2), of 1, unfolded suffix_suffix] by simp\n  ultimately\n  show ?case\n    unfolding af_subsequence_R GF_advice.simps semantics_ltln.simps by blast\nnext\n  case (Suc i)\n  have \"suffix 1 (suffix n w) \\<Turnstile>\\<^sub>n af (af \\<psi> (prefix n w)) [suffix n w 0][X]\\<^sub>\\<nu>\"\n    by (metis (no_types) GF_advice_af_2 Suc.prems(3) plus_1_eq_Suc subsequence_singleton suffix_0 suffix_suffix zero_le)\n  then have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<psi> (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n    using Suc.prems(3)[THEN GF_advice_af_2, unfolded suffix_suffix, of 1] by simp\n  moreover\n  have B: \"(Suc (n - 1)) = n\"\n    using Suc by simp\n  note Suc.IH[of _ \"suffix 1 w\", unfolded subsequence_shift suffix_suffix]\n  then have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> R\\<^sub>n \\<psi>) (w [1 \\<rightarrow> (Suc n)]))[X]\\<^sub>\\<nu>\"\n    by (metis B One_nat_def Suc_le_mono plus_1_eq_Suc Suc.prems)\n  ultimately\n  show ?case\n    unfolding af_subsequence_R semantics_ltln.simps GF_advice.simps by blast\nqed\n\nlemma af_subsequence_W_GF_advice_connect:\n  assumes \"i \\<le> n\"\n  assumes \"suffix n w \\<Turnstile>\\<^sub>n af (\\<phi> W\\<^sub>n \\<psi>) (w [i \\<rightarrow> n])[X]\\<^sub>\\<nu>\"\n  assumes \"\\<And>j. j < i \\<Longrightarrow> suffix n w \\<Turnstile>\\<^sub>n ((af \\<phi> (w [j \\<rightarrow> n]))[X]\\<^sub>\\<nu>)\"\n  shows \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> W\\<^sub>n \\<psi>) (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n  using assms\nproof (induction i arbitrary: w n)\n  case 0\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n af_letter (af (\\<phi> W\\<^sub>n \\<psi>) (prefix n w)) (w n)[X]\\<^sub>\\<nu>\"\n    by (simp add: \"0.prems\"(2) GF_advice_af_letter)\n  moreover\n  have \"prefix (Suc n) w = prefix n w @ [w n]\"\n    using subseq_to_Suc by blast\n  ultimately show ?case\n    by (metis (no_types) foldl.simps(1) foldl.simps(2) foldl_append)\nnext\n  case (Suc i)\n  have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af \\<phi> (prefix (Suc n) w))[X]\\<^sub>\\<nu>\"\n    using Suc.prems(3)[OF zero_less_Suc, THEN GF_advice_af_2, unfolded suffix_suffix, of 1] by simp\n  moreover\n  have \"n > 0\" and B: \"(Suc (n - 1)) = n\"\n    using Suc by simp+\n  note Suc.IH[of \"n - 1\" \"suffix 1 w\", unfolded suffix_suffix] Suc.prems\n  then have \"suffix (Suc n) w \\<Turnstile>\\<^sub>n (af (\\<phi> W\\<^sub>n \\<psi>) (w [1 \\<rightarrow> (Suc n)]))[X]\\<^sub>\\<nu>\"\n    by (metis B One_nat_def Suc_le_mono Suc_mono plus_1_eq_Suc subsequence_shift)\n  ultimately\n  show ?case\n    unfolding af_subsequence_W unfolding semantics_ltln.simps GF_advice.simps by simp\nqed\n\n\nsubsection \\<open>Advice Functions and Propositional Entailment\\<close>\n\nlemma GF_advice_prop_entailment:\n  \"\\<A> \\<Turnstile>\\<^sub>P \\<phi>[X]\\<^sub>\\<nu> \\<Longrightarrow> {\\<psi>. \\<psi>[X]\\<^sub>\\<nu> \\<in> \\<A>} \\<Turnstile>\\<^sub>P \\<phi>\"\n  \"false\\<^sub>n \\<notin> \\<A> \\<Longrightarrow> {\\<psi>. \\<psi>[X]\\<^sub>\\<nu> \\<in> \\<A>} \\<Turnstile>\\<^sub>P \\<phi> \\<Longrightarrow> \\<A> \\<Turnstile>\\<^sub>P \\<phi>[X]\\<^sub>\\<nu>\"\n  by (induction \\<phi>) (auto, meson, meson)\n\nlemma GF_advice_iff_prop_entailment:\n  \"false\\<^sub>n \\<notin> \\<A> \\<Longrightarrow> \\<A> \\<Turnstile>\\<^sub>P \\<phi>[X]\\<^sub>\\<nu> \\<longleftrightarrow> {\\<psi>. \\<psi>[X]\\<^sub>\\<nu> \\<in> \\<A>} \\<Turnstile>\\<^sub>P \\<phi>\"\n  by (metis GF_advice_prop_entailment)\n\nlemma FG_advice_prop_entailment:\n  \"true\\<^sub>n \\<in> \\<A> \\<Longrightarrow> \\<A> \\<Turnstile>\\<^sub>P \\<phi>[Y]\\<^sub>\\<mu> \\<Longrightarrow> {\\<psi>. \\<psi>[Y]\\<^sub>\\<mu> \\<in> \\<A>} \\<Turnstile>\\<^sub>P \\<phi>\"\n  \"{\\<psi>. \\<psi>[Y]\\<^sub>\\<mu> \\<in> \\<A>} \\<Turnstile>\\<^sub>P \\<phi> \\<Longrightarrow> \\<A> \\<Turnstile>\\<^sub>P \\<phi>[Y]\\<^sub>\\<mu>\"\n  by (induction \\<phi>) auto\n\nlemma FG_advice_iff_prop_entailment:\n  \"true\\<^sub>n \\<in> \\<A> \\<Longrightarrow> \\<A> \\<Turnstile>\\<^sub>P \\<phi>[X]\\<^sub>\\<mu> \\<longleftrightarrow> {\\<psi>. \\<psi>[X]\\<^sub>\\<mu> \\<in> \\<A>} \\<Turnstile>\\<^sub>P \\<phi>\"\n  by (metis FG_advice_prop_entailment)\n\nlemma GF_advice_subst:\n  \"\\<phi>[X]\\<^sub>\\<nu> = subst \\<phi> (\\<lambda>\\<psi>. Some (\\<psi>[X]\\<^sub>\\<nu>))\"\n  by (induction \\<phi>) auto\n\nlemma FG_advice_subst:\n  \"\\<phi>[X]\\<^sub>\\<mu> = subst \\<phi> (\\<lambda>\\<psi>. Some (\\<psi>[X]\\<^sub>\\<mu>))\"\n  by (induction \\<phi>) auto\n\nlemma GF_advice_prop_congruent:\n  \"\\<phi> \\<longrightarrow>\\<^sub>P \\<psi> \\<Longrightarrow> \\<phi>[X]\\<^sub>\\<nu> \\<longrightarrow>\\<^sub>P \\<psi>[X]\\<^sub>\\<nu>\"\n  \"\\<phi> \\<sim>\\<^sub>P \\<psi> \\<Longrightarrow> \\<phi>[X]\\<^sub>\\<nu> \\<sim>\\<^sub>P \\<psi>[X]\\<^sub>\\<nu>\"\n  by (metis GF_advice_subst subst_respects_ltl_prop_entailment)+\n\nlemma FG_advice_prop_congruent:\n  \"\\<phi> \\<longrightarrow>\\<^sub>P \\<psi> \\<Longrightarrow> \\<phi>[X]\\<^sub>\\<mu> \\<longrightarrow>\\<^sub>P \\<psi>[X]\\<^sub>\\<mu>\"\n  \"\\<phi> \\<sim>\\<^sub>P \\<psi> \\<Longrightarrow> \\<phi>[X]\\<^sub>\\<mu> \\<sim>\\<^sub>P \\<psi>[X]\\<^sub>\\<mu>\"\n  by (metis FG_advice_subst subst_respects_ltl_prop_entailment)+\n\n\nsubsection \\<open>GF-advice with Equivalence Relations\\<close>\n\nlocale GF_advice_congruent = ltl_equivalence +\n  fixes\n    normalise :: \"'a ltln \\<Rightarrow> 'a ltln\"\n  assumes\n    normalise_eq: \"\\<phi> \\<sim> normalise \\<phi>\"\n  assumes\n    normalise_monotonic: \"w \\<Turnstile>\\<^sub>n \\<phi>[X]\\<^sub>\\<nu> \\<Longrightarrow> w \\<Turnstile>\\<^sub>n (normalise \\<phi>)[X]\\<^sub>\\<nu>\"\n  assumes\n    normalise_eventually_equivalent:\n      \"w \\<Turnstile>\\<^sub>n (normalise \\<phi>)[X]\\<^sub>\\<nu> \\<Longrightarrow> (\\<exists>i. suffix i w \\<Turnstile>\\<^sub>n (af \\<phi> (prefix i w))[X]\\<^sub>\\<nu>)\"\n  assumes\n    GF_advice_congruent: \"\\<phi> \\<sim> \\<psi> \\<Longrightarrow> (normalise \\<phi>)[X]\\<^sub>\\<nu> \\<sim> (normalise \\<psi>)[X]\\<^sub>\\<nu>\"\nbegin\n\nlemma normalise_language_equivalent[simp]:\n  \"w \\<Turnstile>\\<^sub>n normalise \\<phi> \\<longleftrightarrow> w \\<Turnstile>\\<^sub>n \\<phi>\"\n  using normalise_eq ltl_lang_equiv_def eq_implies_lang by blast\n\nend\n\ninterpretation prop_GF_advice_compatible: GF_advice_congruent \"(\\<sim>\\<^sub>P)\" \"id\"\n  by unfold_locales (simp add: GF_advice_af GF_advice_prop_congruent(2))+\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/LTL_Master_Theorem/Logical_Characterization/Advice.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.34201891910339244}}
{"text": "(* \n   Title: Psi-calculi   \n   Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Cong_Struct_Cong\n  imports Weak_Cong_Pres Weak_Bisim_Struct_Cong\nbegin\n\ncontext env begin\n\nlemma weakPsiCongParComm:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  \n  shows \"\\<Psi> \\<rhd> P \\<parallel> Q \\<doteq> Q \\<parallel> P\"\nby(metis bisimParComm strongBisimWeakPsiCong)\n\nlemma weakPsiCongResComm:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   y :: name\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"y \\<sharp> \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P) \\<doteq> \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\"\nusing assms\nby(metis bisimResComm strongBisimWeakPsiCong)\n\nlemma weakPsiCongResComm':\n  fixes x    :: name\n  and   \\<Psi>   :: 'b\n  and   xvec :: \"name list\"\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"xvec \\<sharp>* \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>P) \\<doteq> \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\"\nusing assms\nby(metis bisimResComm' strongBisimWeakPsiCong)\n\nlemma weakPsiCongScopeExt:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> P\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q) \\<doteq> P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q\"\nusing assms\nby(metis bisimScopeExt strongBisimWeakPsiCong)\n\nlemma weakPsiCongScopeExtChain:\n  fixes xvec :: \"name list\"\n  and   \\<Psi>    :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"xvec \\<sharp>* \\<Psi>\"\n  and     \"xvec \\<sharp>* P\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q) \\<doteq> P \\<parallel> (\\<lparr>\\<nu>*xvec\\<rparr>Q)\"\nusing assms\nby(metis bisimScopeExtChain strongBisimWeakPsiCong)\n\nlemma weakPsiCongParAssoc:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> (P \\<parallel> Q) \\<parallel> R \\<doteq> P \\<parallel> (Q \\<parallel> R)\"\nby(metis bisimParAssoc strongBisimWeakPsiCong)\n\nlemma weakPsiCongParNil:\n  fixes P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> \\<zero> \\<doteq> P\"\nby(metis bisimParNil strongBisimWeakPsiCong)\n\nlemma weakPsiCongResNil:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  \n  assumes \"x \\<sharp> \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>\\<zero> \\<doteq> \\<zero>\"\nusing assms\nby(metis bisimResNil strongBisimWeakPsiCong)\n\nlemma weakPsiCongOutputPushRes:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   M :: 'a\n  and   N :: 'a\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> M\"\n  and     \"x \\<sharp> N\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P) \\<doteq> M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P\"\nusing assms\nby(metis bisimOutputPushRes strongBisimWeakPsiCong)\n\nlemma weakPsiCongInputPushRes:\n  fixes x    :: name\n  and   \\<Psi>    :: 'b\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> M\"\n  and     \"x \\<sharp> xvec\"\n  and     \"x \\<sharp> N\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P) \\<doteq> M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P\"\nusing assms\nby(metis bisimInputPushRes strongBisimWeakPsiCong)\n\nlemma weakPsiCongCasePushRes:\n  fixes x  :: name\n  and   \\<Psi>  :: 'b\n  and   Cs :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> (map fst Cs)\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(Cases Cs) \\<doteq> Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)\"\nusing assms\nby(metis bisimCasePushRes strongBisimWeakPsiCong)\n\nlemma weakBangExt:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"guarded P\"\n\n  shows \"\\<Psi> \\<rhd> !P \\<doteq> P \\<parallel> !P\"\nusing assms\nby(metis bangExt strongBisimWeakPsiCong)\n\nlemma weakPsiCongParSym:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q\"\n\n  shows \"\\<Psi> \\<rhd> R \\<parallel> P \\<doteq> R \\<parallel> Q\"\nusing assms\nby(metis weakPsiCongParComm weakPsiCongParPres weakPsiCongTransitive)\n\nlemma weakPsiCongScopeExtSym:\n  fixes x :: name\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> Q\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q) \\<doteq> (\\<lparr>\\<nu>x\\<rparr>P) \\<parallel> Q\"\nusing assms\nby(metis weakPsiCongScopeExt weakPsiCongTransitive weakPsiCongParComm weakPsiCongE weakPsiCongResPres)\n\nlemma weakPsiCongScopeExtChainSym:\n  fixes xvec :: \"name list\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"xvec \\<sharp>* \\<Psi>\"\n  and     \"xvec \\<sharp>* Q\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q) \\<doteq> (\\<lparr>\\<nu>*xvec\\<rparr>P) \\<parallel> Q\"\nusing assms\nby(induct xvec) (auto intro: weakPsiCongScopeExtSym weakPsiCongReflexive weakPsiCongTransitive weakPsiCongResPres)\n\nlemma weakPsiCongParPresSym:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<And>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q\"\n\n  shows \"\\<Psi> \\<rhd> R \\<parallel> P \\<doteq> R \\<parallel> Q\"\nusing assms\nby(metis weakPsiCongParComm weakPsiCongParPres weakPsiCongTransitive)\n\nlemma tauCongChainBangI:\n  fixes \\<Psi> :: 'b\n  and   P  :: \"('a, 'b, 'c) psi\"\n  and   P' :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"\\<Psi> \\<rhd> P \\<parallel> P \\<Longrightarrow>\\<^sub>\\<tau> P'\"\n  and     \"guarded P\"\n\n  obtains Q where \"\\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q\" and \"\\<Psi> \\<rhd> Q \\<sim> P' \\<parallel> !P\"\nproof -\n  assume \"\\<And>Q. \\<lbrakk>\\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q; \\<Psi> \\<rhd> Q \\<sim> P' \\<parallel> !P\\<rbrakk> \\<Longrightarrow> thesis\"\n  moreover from \\<open>\\<Psi> \\<rhd> P \\<parallel> P \\<Longrightarrow>\\<^sub>\\<tau> P'\\<close> have \"\\<exists>Q. \\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q \\<and> \\<Psi> \\<rhd> Q \\<sim> P' \\<parallel> !P\"\n  proof(induct x1==\"P \\<parallel> P\" P' rule: tauStepChainInduct)\n    case(TauBase R')\n    from \\<open>\\<Psi> \\<rhd> P \\<parallel> P \\<longmapsto>\\<tau> \\<prec> R'\\<close>\n    obtain Q where \"\\<Psi> \\<rhd> !P \\<longmapsto>\\<tau> \\<prec> Q\" and \"Q \\<sim> R' \\<parallel> !P\" using \\<open>guarded P\\<close> \n      by(rule tauBangI)\n    from \\<open>\\<Psi> \\<rhd> !P \\<longmapsto>\\<tau> \\<prec> Q\\<close> have \"\\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q\" by auto\n    moreover from \\<open>Q \\<sim> R' \\<parallel> !P\\<close> have \"\\<Psi> \\<rhd> Q \\<sim> R' \\<parallel> !P\"\n      apply(drule_tac bisimE(3)[where \\<Psi>'=\\<Psi>])\n      by(rule_tac statEqBisim, assumption) (metis Identity AssertionStatEqSym AssertionStatEqTrans Commutativity)\n    ultimately show ?case by blast\n  next\n    case(TauStep R' R'')\n    then obtain Q where PChain: \"\\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q\" and \"\\<Psi> \\<rhd> Q \\<sim> R' \\<parallel> !P\" by auto\n    from \\<open>\\<Psi> \\<rhd> R' \\<longmapsto>\\<tau> \\<prec> R''\\<close> have \"\\<Psi> \\<otimes> \\<one> \\<rhd> R' \\<longmapsto>\\<tau> \\<prec> R''\" by(rule statEqTransition) (metis Identity AssertionStatEqSym)\n    hence \"\\<Psi> \\<rhd> R' \\<parallel> !P \\<longmapsto>\\<tau> \\<prec> R'' \\<parallel> !P\" by(rule_tac Par1) auto\n    with \\<open>\\<Psi> \\<rhd> Q \\<sim> R' \\<parallel> !P\\<close> obtain Q' where QTrans: \"\\<Psi> \\<rhd> Q \\<longmapsto>\\<tau> \\<prec> Q'\" and \"\\<Psi> \\<rhd> Q' \\<sim> R'' \\<parallel> !P\"\n      by(force dest: bisimE(2) simE)\n    from PChain QTrans have \"\\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q'\" by(auto dest: tauActTauStepChain)\n    thus ?case using \\<open>\\<Psi> \\<rhd> Q' \\<sim> R'' \\<parallel> !P\\<close> by blast\n  qed\n  ultimately show ?thesis by blast\nqed\n\nlemma weakPsiCongBangPres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes PeqQ: \"\\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q\"\n  and     \"guarded P\"\n  and     \"guarded Q\"\n\n  shows   \"\\<Psi> \\<rhd> !P \\<doteq> !Q\"\nproof -\n  from assms have \"(\\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q) \\<and> guarded P \\<and> guarded Q\" by auto\n  hence \"\\<Psi> \\<rhd> \\<zero> \\<parallel> !P \\<doteq> \\<zero> \\<parallel> !Q\"\n  proof(induct rule: weakPsiCongSymI[where C=\"\\<lambda>P. \\<zero> \\<parallel> !P\"])\n    case(cSym P Q)\n    thus ?case by(auto dest: weakPsiCongSym)\n  next\n    case(cWeakBisim P Q)\n    thus ?case by(metis weakPsiCongE weakBisimBangPresAux)\n  next\n    case(cSim P Q)\n    then have \"\\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q\" and \"guarded P\" and \"guarded Q\" by auto\n    moreover hence \"\\<Psi> \\<rhd> P \\<approx> Q\" by(metis weakPsiCongE weakBisimE)\n    moreover have \"\\<And>\\<Psi> P Q. (\\<forall>\\<Psi>. (\\<Psi> \\<rhd> P \\<doteq> Q)) \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q\"\n      by(blast dest: weakPsiCongE)\n    moreover note weakBisimClosed bisimClosed weakBisimE(3) bisimE(3) weakBisimE(2) \n                  weakBisimE(4) bisimE(4) statEqWeakBisim statEqBisim weakBisimTransitive bisimTransitive weakBisimParAssoc[THEN weakBisimE(4)]\n                  bisimParAssoc[THEN bisimE(4)] weakBisimParPres\n    moreover have \"\\<And>P Q. \\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q \\<Longrightarrow> \\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<parallel> P \\<doteq> Q \\<parallel> Q\"\n      by(metis weakPsiCongParPres weakPsiCongParComm weakPsiCongSym weakPsiCongTransitive)\n    moreover note bisimParPresSym\n    moreover from strongBisimWeakBisim have \"bisim \\<subseteq> weakBisim\" by auto\n    moreover have \"\\<And>\\<Psi> \\<Psi>\\<^sub>R P Q R A\\<^sub>R. \\<lbrakk>\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q; extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>; A\\<^sub>R \\<sharp>* \\<Psi>; A\\<^sub>R \\<sharp>* P; A\\<^sub>R \\<sharp>* Q\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<rhd> R \\<parallel> P \\<approx> R \\<parallel> Q\"\n      by(metis weakBisimParComm weakBisimTransitive weakBisimParPresAux)\n    moreover note weakBisimResChainPres bisimResChainPres weakBisimScopeExtChainSym bisimScopeExtChainSym\n    moreover have \"\\<And>\\<Psi> P R S Q. \\<lbrakk>\\<Psi> \\<rhd> P \\<approx> R; \\<Psi> \\<rhd> R \\<approx> S; \\<Psi> \\<rhd> S \\<sim> Q\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<rhd> P \\<approx> Q\"\n      by(blast dest: weakBisimTransitive strongBisimWeakBisim)\n    moreover note weakBisimBangPresAux\n    moreover from bangActE have \"\\<And>\\<Psi> P \\<alpha> P'. \\<lbrakk>\\<Psi> \\<rhd> !P \\<longmapsto>\\<alpha> \\<prec> P'; bn \\<alpha> \\<sharp>* P; guarded P; \\<alpha> \\<noteq> \\<tau>; bn \\<alpha> \\<sharp>* subject \\<alpha>\\<rbrakk> \\<Longrightarrow> \\<exists>Q. \\<Psi> \\<rhd> P \\<longmapsto>\\<alpha> \\<prec> Q \\<and> P' \\<sim> Q \\<parallel> !P\"\n      by blast\n    moreover from bangTauE have \"\\<And>\\<Psi> P P'. \\<lbrakk>\\<Psi> \\<rhd> !P \\<longmapsto>\\<tau> \\<prec> P'; guarded P\\<rbrakk> \\<Longrightarrow> \\<exists>Q. \\<Psi> \\<rhd> P \\<parallel> P \\<longmapsto>\\<tau> \\<prec> Q \\<and> P' \\<sim> Q \\<parallel> !P\"\n      by blast\n    moreover from tauCongChainBangI have \"\\<And>\\<Psi> P P'. \\<lbrakk>\\<Psi> \\<rhd> P \\<parallel> P \\<Longrightarrow>\\<^sub>\\<tau> P'; guarded P\\<rbrakk> \\<Longrightarrow> \\<exists>Q. \\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q \\<and> \\<Psi> \\<rhd> Q \\<sim> P' \\<parallel> !P\"\n      by blast\n    ultimately show ?case\n      by(rule_tac weakCongSimBangPres[where Rel=weakBisim and Rel'=bisim and Rel''=weakBisim and Eq=\"\\<lambda>P Q. \\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q\"])\n  qed\n  thus ?thesis\n    by(metis weakPsiCongParNil weakPsiCongParComm weakPsiCongTransitive weakPsiCongSym)\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Weak_Cong_Struct_Cong.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3418815185785869}}
{"text": "(*  Title:      ZF/UNITY/SubstAx.thy\n    Author:     Sidi O Ehmety, Computer Laboratory\n    Copyright   2001  University of Cambridge\n\nTheory ported from HOL.\n*)\n\nsection{*Weak LeadsTo relation (restricted to the set of reachable states)*}\n\ntheory SubstAx\nimports WFair Constrains\nbegin\n\ndefinition\n  (* The definitions below are not `conventional', but yield simpler rules *)\n  Ensures :: \"[i,i] => i\"            (infixl \"Ensures\" 60)  where\n  \"A Ensures B == {F \\<in> program. F \\<in> (reachable(F) \\<inter> A) ensures (reachable(F) \\<inter> B) }\"\n\ndefinition\n  LeadsTo :: \"[i, i] => i\"            (infixl \"LeadsTo\" 60)  where\n  \"A LeadsTo B == {F \\<in> program. F:(reachable(F) \\<inter> A) leadsTo (reachable(F) \\<inter> B)}\"\n\nnotation (xsymbols)\n  LeadsTo  (infixl \" \\<longmapsto>w \" 60)\n\n\n\n(*Resembles the previous definition of LeadsTo*)\n\n(* Equivalence with the HOL-like definition *)\nlemma LeadsTo_eq:\n\"st_set(B)==> A LeadsTo B = {F \\<in> program. F:(reachable(F) \\<inter> A) leadsTo B}\"\napply (unfold LeadsTo_def)\napply (blast dest: psp_stable2 leadsToD2 constrainsD2 intro: leadsTo_weaken)\ndone\n\nlemma LeadsTo_type: \"A LeadsTo B <=program\"\nby (unfold LeadsTo_def, auto)\n\n(*** Specialized laws for handling invariants ***)\n\n(** Conjoining an Always property **)\nlemma Always_LeadsTo_pre: \"F \\<in> Always(I) ==> (F:(I \\<inter> A) LeadsTo A') \\<longleftrightarrow> (F \\<in> A LeadsTo A')\"\nby (simp add: LeadsTo_def Always_eq_includes_reachable Int_absorb2 Int_assoc [symmetric] leadsToD2)\n\nlemma Always_LeadsTo_post: \"F \\<in> Always(I) ==> (F \\<in> A LeadsTo (I \\<inter> A')) \\<longleftrightarrow> (F \\<in> A LeadsTo A')\"\napply (unfold LeadsTo_def)\napply (simp add: Always_eq_includes_reachable Int_absorb2 Int_assoc [symmetric] leadsToD2)\ndone\n\n(* Like 'Always_LeadsTo_pre RS iffD1', but with premises in the good order *)\nlemma Always_LeadsToI: \"[| F \\<in> Always(C); F \\<in> (C \\<inter> A) LeadsTo A' |] ==> F \\<in> A LeadsTo A'\"\nby (blast intro: Always_LeadsTo_pre [THEN iffD1])\n\n(* Like 'Always_LeadsTo_post RS iffD2', but with premises in the good order *)\nlemma Always_LeadsToD: \"[| F \\<in> Always(C);  F \\<in> A LeadsTo A' |] ==> F \\<in> A LeadsTo (C \\<inter> A')\"\nby (blast intro: Always_LeadsTo_post [THEN iffD2])\n\n(*** Introduction rules \\<in> Basis, Trans, Union ***)\n\nlemma LeadsTo_Basis: \"F \\<in> A Ensures B ==> F \\<in> A LeadsTo B\"\nby (auto simp add: Ensures_def LeadsTo_def)\n\nlemma LeadsTo_Trans:\n     \"[| F \\<in> A LeadsTo B;  F \\<in> B LeadsTo C |] ==> F \\<in> A LeadsTo C\"\napply (simp (no_asm_use) add: LeadsTo_def)\napply (blast intro: leadsTo_Trans)\ndone\n\nlemma LeadsTo_Union:\n\"[|(!!A. A \\<in> S ==> F \\<in> A LeadsTo B); F \\<in> program|]==>F \\<in> \\<Union>(S) LeadsTo B\"\napply (simp add: LeadsTo_def)\napply (subst Int_Union_Union2)\napply (rule leadsTo_UN, auto)\ndone\n\n(*** Derived rules ***)\n\nlemma leadsTo_imp_LeadsTo: \"F \\<in> A leadsTo B ==> F \\<in> A LeadsTo B\"\napply (frule leadsToD2, clarify)\napply (simp (no_asm_simp) add: LeadsTo_eq)\napply (blast intro: leadsTo_weaken_L)\ndone\n\n(*Useful with cancellation, disjunction*)\nlemma LeadsTo_Un_duplicate: \"F \\<in> A LeadsTo (A' \\<union> A') ==> F \\<in> A LeadsTo A'\"\nby (simp add: Un_ac)\n\nlemma LeadsTo_Un_duplicate2:\n     \"F \\<in> A LeadsTo (A' \\<union> C \\<union> C) ==> F \\<in> A LeadsTo (A' \\<union> C)\"\nby (simp add: Un_ac)\n\nlemma LeadsTo_UN:\n    \"[|(!!i. i \\<in> I ==> F \\<in> A(i) LeadsTo B); F \\<in> program|]\n     ==>F:(\\<Union>i \\<in> I. A(i)) LeadsTo B\"\napply (simp add: LeadsTo_def)\napply (simp (no_asm_simp) del: UN_simps add: Int_UN_distrib)\napply (rule leadsTo_UN, auto)\ndone\n\n(*Binary union introduction rule*)\nlemma LeadsTo_Un:\n     \"[| F \\<in> A LeadsTo C; F \\<in> B LeadsTo C |] ==> F \\<in> (A \\<union> B) LeadsTo C\"\napply (subst Un_eq_Union)\napply (rule LeadsTo_Union)\napply (auto dest: LeadsTo_type [THEN subsetD])\ndone\n\n(*Lets us look at the starting state*)\nlemma single_LeadsTo_I:\n    \"[|(!!s. s \\<in> A ==> F:{s} LeadsTo B); F \\<in> program|]==>F \\<in> A LeadsTo B\"\napply (subst UN_singleton [symmetric], rule LeadsTo_UN, auto)\ndone\n\nlemma subset_imp_LeadsTo: \"[| A \\<subseteq> B; F \\<in> program |] ==> F \\<in> A LeadsTo B\"\napply (simp (no_asm_simp) add: LeadsTo_def)\napply (blast intro: subset_imp_leadsTo)\ndone\n\nlemma empty_LeadsTo: \"F \\<in> 0 LeadsTo A \\<longleftrightarrow> F \\<in> program\"\nby (auto dest: LeadsTo_type [THEN subsetD]\n            intro: empty_subsetI [THEN subset_imp_LeadsTo])\ndeclare empty_LeadsTo [iff]\n\nlemma LeadsTo_state: \"F \\<in> A LeadsTo state \\<longleftrightarrow> F \\<in> program\"\nby (auto dest: LeadsTo_type [THEN subsetD] simp add: LeadsTo_eq)\ndeclare LeadsTo_state [iff]\n\nlemma LeadsTo_weaken_R: \"[| F \\<in> A LeadsTo A';  A'<=B'|] ==> F \\<in> A LeadsTo B'\"\napply (unfold LeadsTo_def)\napply (auto intro: leadsTo_weaken_R)\ndone\n\nlemma LeadsTo_weaken_L: \"[| F \\<in> A LeadsTo A'; B \\<subseteq> A |] ==> F \\<in> B LeadsTo A'\"\napply (unfold LeadsTo_def)\napply (auto intro: leadsTo_weaken_L)\ndone\n\nlemma LeadsTo_weaken: \"[| F \\<in> A LeadsTo A'; B<=A; A'<=B' |] ==> F \\<in> B LeadsTo B'\"\nby (blast intro: LeadsTo_weaken_R LeadsTo_weaken_L LeadsTo_Trans)\n\nlemma Always_LeadsTo_weaken:\n\"[| F \\<in> Always(C);  F \\<in> A LeadsTo A'; C \\<inter> B \\<subseteq> A;   C \\<inter> A' \\<subseteq> B' |]\n      ==> F \\<in> B LeadsTo B'\"\napply (blast dest: Always_LeadsToI intro: LeadsTo_weaken Always_LeadsToD)\ndone\n\n(** Two theorems for \"proof lattices\" **)\n\nlemma LeadsTo_Un_post: \"F \\<in> A LeadsTo B ==> F:(A \\<union> B) LeadsTo B\"\nby (blast dest: LeadsTo_type [THEN subsetD]\n             intro: LeadsTo_Un subset_imp_LeadsTo)\n\nlemma LeadsTo_Trans_Un: \"[| F \\<in> A LeadsTo B;  F \\<in> B LeadsTo C |]\n      ==> F \\<in> (A \\<union> B) LeadsTo C\"\napply (blast intro: LeadsTo_Un subset_imp_LeadsTo LeadsTo_weaken_L LeadsTo_Trans dest: LeadsTo_type [THEN subsetD])\ndone\n\n(** Distributive laws **)\nlemma LeadsTo_Un_distrib: \"(F \\<in> (A \\<union> B) LeadsTo C)  \\<longleftrightarrow> (F \\<in> A LeadsTo C & F \\<in> B LeadsTo C)\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken_L)\n\nlemma LeadsTo_UN_distrib: \"(F \\<in> (\\<Union>i \\<in> I. A(i)) LeadsTo B) \\<longleftrightarrow>  (\\<forall>i \\<in> I. F \\<in> A(i) LeadsTo B) & F \\<in> program\"\nby (blast dest: LeadsTo_type [THEN subsetD]\n             intro: LeadsTo_UN LeadsTo_weaken_L)\n\nlemma LeadsTo_Union_distrib: \"(F \\<in> \\<Union>(S) LeadsTo B)  \\<longleftrightarrow>  (\\<forall>A \\<in> S. F \\<in> A LeadsTo B) & F \\<in> program\"\nby (blast dest: LeadsTo_type [THEN subsetD]\n             intro: LeadsTo_Union LeadsTo_weaken_L)\n\n(** More rules using the premise \"Always(I)\" **)\n\nlemma EnsuresI: \"[| F:(A-B) Co (A \\<union> B);  F \\<in> transient (A-B) |] ==> F \\<in> A Ensures B\"\napply (simp add: Ensures_def Constrains_eq_constrains)\napply (blast intro: ensuresI constrains_weaken transient_strengthen dest: constrainsD2)\ndone\n\nlemma Always_LeadsTo_Basis: \"[| F \\<in> Always(I); F \\<in> (I \\<inter> (A-A')) Co (A \\<union> A');\n         F \\<in> transient (I \\<inter> (A-A')) |]\n  ==> F \\<in> A LeadsTo A'\"\napply (rule Always_LeadsToI, assumption)\napply (blast intro: EnsuresI LeadsTo_Basis Always_ConstrainsD [THEN Constrains_weaken] transient_strengthen)\ndone\n\n(*Set difference: maybe combine with leadsTo_weaken_L??\n  This is the most useful form of the \"disjunction\" rule*)\nlemma LeadsTo_Diff:\n     \"[| F \\<in> (A-B) LeadsTo C;  F \\<in> (A \\<inter> B) LeadsTo C |] ==> F \\<in> A LeadsTo C\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken)\n\nlemma LeadsTo_UN_UN:\n     \"[|(!!i. i \\<in> I ==> F \\<in> A(i) LeadsTo A'(i)); F \\<in> program |]\n      ==> F \\<in> (\\<Union>i \\<in> I. A(i)) LeadsTo (\\<Union>i \\<in> I. A'(i))\"\napply (rule LeadsTo_Union, auto)\napply (blast intro: LeadsTo_weaken_R)\ndone\n\n(*Binary union version*)\nlemma LeadsTo_Un_Un:\n  \"[| F \\<in> A LeadsTo A'; F \\<in> B LeadsTo B' |] ==> F:(A \\<union> B) LeadsTo (A' \\<union> B')\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken_R)\n\n(** The cancellation law **)\n\nlemma LeadsTo_cancel2: \"[| F \\<in> A LeadsTo(A' \\<union> B); F \\<in> B LeadsTo B' |] ==> F \\<in> A LeadsTo (A' \\<union> B')\"\nby (blast intro: LeadsTo_Un_Un subset_imp_LeadsTo LeadsTo_Trans dest: LeadsTo_type [THEN subsetD])\n\nlemma Un_Diff: \"A \\<union> (B - A) = A \\<union> B\"\nby auto\n\nlemma LeadsTo_cancel_Diff2: \"[| F \\<in> A LeadsTo (A' \\<union> B); F \\<in> (B-A') LeadsTo B' |] ==> F \\<in> A LeadsTo (A' \\<union> B')\"\napply (rule LeadsTo_cancel2)\nprefer 2 apply assumption\napply (simp (no_asm_simp) add: Un_Diff)\ndone\n\nlemma LeadsTo_cancel1: \"[| F \\<in> A LeadsTo (B \\<union> A'); F \\<in> B LeadsTo B' |] ==> F \\<in> A LeadsTo (B' \\<union> A')\"\napply (simp add: Un_commute)\napply (blast intro!: LeadsTo_cancel2)\ndone\n\nlemma Diff_Un2: \"(B - A) \\<union> A = B \\<union> A\"\nby auto\n\nlemma LeadsTo_cancel_Diff1: \"[| F \\<in> A LeadsTo (B \\<union> A'); F \\<in> (B-A') LeadsTo B' |] ==> F \\<in> A LeadsTo (B' \\<union> A')\"\napply (rule LeadsTo_cancel1)\nprefer 2 apply assumption\napply (simp (no_asm_simp) add: Diff_Un2)\ndone\n\n(** The impossibility law **)\n\n(*The set \"A\" may be non-empty, but it contains no reachable states*)\nlemma LeadsTo_empty: \"F \\<in> A LeadsTo 0 ==> F \\<in> Always (state -A)\"\napply (simp (no_asm_use) add: LeadsTo_def Always_eq_includes_reachable)\napply (cut_tac reachable_type)\napply (auto dest!: leadsTo_empty)\ndone\n\n(** PSP \\<in> Progress-Safety-Progress **)\n\n(*Special case of PSP \\<in> Misra's \"stable conjunction\"*)\nlemma PSP_Stable: \"[| F \\<in> A LeadsTo A';  F \\<in> Stable(B) |]==> F:(A \\<inter> B) LeadsTo (A' \\<inter> B)\"\napply (simp add: LeadsTo_def Stable_eq_stable, clarify)\napply (drule psp_stable, assumption)\napply (simp add: Int_ac)\ndone\n\nlemma PSP_Stable2: \"[| F \\<in> A LeadsTo A'; F \\<in> Stable(B) |] ==> F \\<in> (B \\<inter> A) LeadsTo (B \\<inter> A')\"\napply (simp (no_asm_simp) add: PSP_Stable Int_ac)\ndone\n\nlemma PSP: \"[| F \\<in> A LeadsTo A'; F \\<in> B Co B'|]==> F \\<in> (A \\<inter> B') LeadsTo ((A' \\<inter> B) \\<union> (B' - B))\"\napply (simp (no_asm_use) add: LeadsTo_def Constrains_eq_constrains)\napply (blast dest: psp intro: leadsTo_weaken)\ndone\n\nlemma PSP2: \"[| F \\<in> A LeadsTo A'; F \\<in> B Co B' |]==> F:(B' \\<inter> A) LeadsTo ((B \\<inter> A') \\<union> (B' - B))\"\nby (simp (no_asm_simp) add: PSP Int_ac)\n\nlemma PSP_Unless:\n\"[| F \\<in> A LeadsTo A'; F \\<in> B Unless B'|]==> F:(A \\<inter> B) LeadsTo ((A' \\<inter> B) \\<union> B')\"\napply (unfold op_Unless_def)\napply (drule PSP, assumption)\napply (blast intro: LeadsTo_Diff LeadsTo_weaken subset_imp_LeadsTo)\ndone\n\n(*** Induction rules ***)\n\n(** Meta or object quantifier ????? **)\nlemma LeadsTo_wf_induct: \"[| wf(r);\n         \\<forall>m \\<in> I. F \\<in> (A \\<inter> f-``{m}) LeadsTo\n                            ((A \\<inter> f-``(converse(r) `` {m})) \\<union> B);\n         field(r)<=I; A<=f-``I; F \\<in> program |]\n      ==> F \\<in> A LeadsTo B\"\napply (simp (no_asm_use) add: LeadsTo_def)\napply auto\napply (erule_tac I = I and f = f in leadsTo_wf_induct, safe)\napply (drule_tac [2] x = m in bspec, safe)\napply (rule_tac [2] A' = \"reachable (F) \\<inter> (A \\<inter> f -`` (converse (r) ``{m}) \\<union> B) \" in leadsTo_weaken_R)\napply (auto simp add: Int_assoc)\ndone\n\n\nlemma LessThan_induct: \"[| \\<forall>m \\<in> nat. F:(A \\<inter> f-``{m}) LeadsTo ((A \\<inter> f-``m) \\<union> B);\n      A<=f-``nat; F \\<in> program |] ==> F \\<in> A LeadsTo B\"\napply (rule_tac A1 = nat and f1 = \"%x. x\" in wf_measure [THEN LeadsTo_wf_induct])\napply (simp_all add: nat_measure_field)\napply (simp add: ltI Image_inverse_lessThan vimage_def [symmetric])\ndone\n\n\n(******\n To be ported ??? I am not sure.\n\n  integ_0_le_induct\n  LessThan_bounded_induct\n  GreaterThan_bounded_induct\n\n*****)\n\n(*** Completion \\<in> Binary and General Finite versions ***)\n\nlemma Completion: \"[| F \\<in> A LeadsTo (A' \\<union> C);  F \\<in> A' Co (A' \\<union> C);\n         F \\<in> B LeadsTo (B' \\<union> C);  F \\<in> B' Co (B' \\<union> C) |]\n      ==> F \\<in> (A \\<inter> B) LeadsTo ((A' \\<inter> B') \\<union> C)\"\napply (simp (no_asm_use) add: LeadsTo_def Constrains_eq_constrains Int_Un_distrib)\napply (blast intro: completion leadsTo_weaken)\ndone\n\nlemma Finite_completion_aux:\n     \"[| I \\<in> Fin(X);F \\<in> program |]\n      ==> (\\<forall>i \\<in> I. F \\<in> (A(i)) LeadsTo (A'(i) \\<union> C)) \\<longrightarrow>\n          (\\<forall>i \\<in> I. F \\<in> (A'(i)) Co (A'(i) \\<union> C)) \\<longrightarrow>\n          F \\<in> (\\<Inter>i \\<in> I. A(i)) LeadsTo ((\\<Inter>i \\<in> I. A'(i)) \\<union> C)\"\napply (erule Fin_induct)\napply (auto simp del: INT_simps simp add: Inter_0)\napply (rule Completion, auto)\napply (simp del: INT_simps add: INT_extend_simps)\napply (blast intro: Constrains_INT)\ndone\n\nlemma Finite_completion:\n     \"[| I \\<in> Fin(X); !!i. i \\<in> I ==> F \\<in> A(i) LeadsTo (A'(i) \\<union> C);\n         !!i. i \\<in> I ==> F \\<in> A'(i) Co (A'(i) \\<union> C);\n         F \\<in> program |]\n      ==> F \\<in> (\\<Inter>i \\<in> I. A(i)) LeadsTo ((\\<Inter>i \\<in> I. A'(i)) \\<union> C)\"\nby (blast intro: Finite_completion_aux [THEN mp, THEN mp])\n\nlemma Stable_completion:\n     \"[| F \\<in> A LeadsTo A';  F \\<in> Stable(A');\n         F \\<in> B LeadsTo B';  F \\<in> Stable(B') |]\n    ==> F \\<in> (A \\<inter> B) LeadsTo (A' \\<inter> B')\"\napply (unfold Stable_def)\napply (rule_tac C1 = 0 in Completion [THEN LeadsTo_weaken_R])\n    prefer 5\n    apply blast\napply auto\ndone\n\nlemma Finite_stable_completion:\n     \"[| I \\<in> Fin(X);\n         (!!i. i \\<in> I ==> F \\<in> A(i) LeadsTo A'(i));\n         (!!i. i \\<in> I ==>F \\<in> Stable(A'(i)));   F \\<in> program  |]\n      ==> F \\<in> (\\<Inter>i \\<in> I. A(i)) LeadsTo (\\<Inter>i \\<in> I. A'(i))\"\napply (unfold Stable_def)\napply (rule_tac C1 = 0 in Finite_completion [THEN LeadsTo_weaken_R], simp_all)\napply (rule_tac [3] subset_refl, auto)\ndone\n\nML {*\n(*proves \"ensures/leadsTo\" properties when the program is specified*)\nfun ensures_tac ctxt sact =\n  SELECT_GOAL\n    (EVERY [REPEAT (Always_Int_tac ctxt 1),\n            etac @{thm Always_LeadsTo_Basis} 1\n                ORELSE   (*subgoal may involve LeadsTo, leadsTo or ensures*)\n                REPEAT (ares_tac [@{thm LeadsTo_Basis}, @{thm leadsTo_Basis},\n                                  @{thm EnsuresI}, @{thm ensuresI}] 1),\n            (*now there are two subgoals: co & transient*)\n            simp_tac (ctxt addsimps (Named_Theorems.get ctxt @{named_theorems program})) 2,\n            res_inst_tac ctxt [((\"act\", 0), sact)] @{thm transientI} 2,\n               (*simplify the command's domain*)\n            simp_tac (ctxt addsimps [@{thm domain_def}]) 3,\n            (* proving the domain part *)\n           clarify_tac ctxt 3, dtac @{thm swap} 3, force_tac ctxt 4,\n           rtac @{thm ReplaceI} 3, force_tac ctxt 3, force_tac ctxt 4,\n           asm_full_simp_tac ctxt 3, rtac @{thm conjI} 3, simp_tac ctxt 4,\n           REPEAT (rtac @{thm state_update_type} 3),\n           constrains_tac ctxt 1,\n           ALLGOALS (clarify_tac ctxt),\n           ALLGOALS (asm_full_simp_tac (ctxt addsimps [@{thm st_set_def}])),\n                      ALLGOALS (clarify_tac ctxt),\n          ALLGOALS (asm_lr_simp_tac ctxt)]);\n*}\n\nmethod_setup ensures = {*\n    Args.goal_spec -- Scan.lift Args.name_inner_syntax >>\n    (fn (quant, s) => fn ctxt => SIMPLE_METHOD'' quant (ensures_tac ctxt s))\n*} \"for proving progress properties\"\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/ZF/UNITY/SubstAx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.34188151103423536}}
{"text": "theory Finite_Linear_Tick_Param\n\nimports\n  Finite_Linear_Model\n  Finite_Linear_Ops\nbegin\n  \ntext \\<open>This theory extends the finite linear model to capture termination by\n      considering the special event 'tick' and where termination is unstable. \\<close>\n\ntype_synonym 'e tick = \"'e fltrace \\<Rightarrow> 'e\"\ntype_synonym 'e fltracetick = \"'e \\<Rightarrow> 'e fltrace\"\n\n(* Do we actually need to refuse everything after tick?*)\n\n(* Problem with this treatment of tick, rather than at the\n   data-type level is that we need to enforce tick as the\n   last event possible for a trace via a healthiness\n   condition. *)\n\nprimrec events :: \"'e fltrace \\<Rightarrow> 'e set\" where\n\"events \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> = {}\" |\n\"events (A #\\<^sub>\\<F>\\<^sub>\\<L> xs) = {event(A)} \\<union> events(xs)\"\n\ndefinition Skip :: \"'e \\<Rightarrow> 'e fltrace set\" where\n\"Skip tick = {\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>,\\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>}\"\n\ndefinition SeqComp :: \"'e fltrace set \\<Rightarrow> 'e \\<Rightarrow> 'e fltrace set \\<Rightarrow> 'e fltrace set\" (\"(_/ '(_');\\<^sub>\\<F>\\<^sub>\\<L> _)\" [51, 51, 51] 50) where (*(infixl \";\\<^sub>\\<F>\\<^sub>\\<L>\" 65) where*)\n\"P (tick);\\<^sub>\\<F>\\<^sub>\\<L> Q = {x|x s t. (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P \\<and> t \\<in> Q \\<and> x = s &\\<^sub>\\<F>\\<^sub>\\<L> t) \\<or> (s \\<in> P \\<and> tick \\<notin> events(s) \\<and> x = s)}\" (*  \\<union> {s|s. s\\<in> P \\<and> tick \\<notin> events(s)}\" *)\n\nfun tickWF :: \"'e \\<Rightarrow> 'e fltrace \\<Rightarrow> bool\" where\n\"tickWF tick \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> = (tick \\<notin>\\<^sub>\\<F>\\<^sub>\\<L> A)\" |\n\"tickWF tick (A #\\<^sub>\\<F>\\<^sub>\\<L> xs) = (tick \\<notin>\\<^sub>\\<F>\\<^sub>\\<L> acceptance(A) \\<and> (if event(A) = tick then (xs = \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) else tickWF tick xs))\"\n\ndefinition FLTick0 :: \"'e \\<Rightarrow> 'e fltrace set \\<Rightarrow> bool\" where\n\"FLTick0 tick P \\<equiv> \\<forall>x. x \\<in> P \\<longrightarrow> tickWF tick x\"\n\nlemma FLTick0_Skip:\n  \"FLTick0 tick (Skip tick)\"\n  unfolding Skip_def FLTick0_def by auto\n\nlemma tickWF_last_x_is_emptyset:\n  assumes \"tickWF tick x\" \"tick \\<in> events x\"\n  shows \"last x = \\<bullet>\"\n  using assms apply (induct x rule:tickWF.induct, auto)\n  by fastforce\n\nlemma tickWF_consFL_iff_fixpoint:\n  assumes \"tick \\<in> events x\" \"tickWF tick (x &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\"\n  shows \"x = x &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"\n  using assms apply (induct x, auto, case_tac xa, auto, case_tac x1, auto)\n  apply (case_tac x1a, auto)\n   apply (case_tac a, auto)\n  apply presburger\n  by (metis amember.simps(1) tickWF.simps(1))\n\nfun butlastaevent :: \"'a fltrace \\<Rightarrow> 'a fltrace\" where\n\"butlastaevent \\<langle>x\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> = \\<langle>x\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\" |\n\"butlastaevent (x #\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>y\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) = \\<langle>y\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\" |\n\"butlastaevent (x #\\<^sub>\\<F>\\<^sub>\\<L> xs) = x #\\<^sub>\\<F>\\<^sub>\\<L> butlastaevent xs\"\n\nlemma tickWF_tick_events_butlastaevent:\n  assumes \"tick \\<in> events x\" \"tickWF tick x\"\n  shows \"x = butlastaevent x &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"\n  using assms apply (induct x)\n   apply (case_tac x, auto, case_tac x1a, auto)\n  apply (case_tac x1a, auto)\n   apply (case_tac \"b = tick\", auto)\n   apply (case_tac x, auto)\n   apply (case_tac \"b = tick\", auto)\n  by (case_tac x, auto)\n\nlemma x_in_P_tickWF_exists:\n  assumes \"x \\<in> P\" \"tickWF tick x\"\n  shows \"\\<exists>s. s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P \\<and> (\\<exists>t. (t = \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<or> t = \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) \\<and> x = s &\\<^sub>\\<F>\\<^sub>\\<L> t) \\<or> s \\<in> P \\<and> tick \\<notin> events s \\<and> x = s\"\n  using assms\nproof (cases \"tick \\<in> events(x)\")\n  case True\n  then have butlastaevent:\"x = butlastaevent x &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"\n    by (simp add: assms(2) tickWF_tick_events_butlastaevent)\n  then have \"(\\<exists>t. (t = \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<or> t = \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) \\<and> x = butlastaevent x &\\<^sub>\\<F>\\<^sub>\\<L> t)\"\n    by blast\n  then have \"butlastaevent x &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P \\<and> (\\<exists>t. (t = \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<or> t = \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) \\<and> x = butlastaevent x &\\<^sub>\\<F>\\<^sub>\\<L> t)\"\n    using butlastaevent assms(1) by auto\n  then have \"\\<exists>s. s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P \\<and> (\\<exists>t. (t = \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<or> t = \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) \\<and> x = s &\\<^sub>\\<F>\\<^sub>\\<L> t \\<and> s = butlastaevent x)\"\n    by blast\n  then have \"\\<exists>s. s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P \\<and> (\\<exists>t. (t = \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<or> t = \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) \\<and> x = s &\\<^sub>\\<F>\\<^sub>\\<L> t)\"\n    by blast\n  then show ?thesis\n    by auto\nnext\n  case False\n  then show ?thesis using assms by auto\nqed\n\nlemma Skip_right_unit:\n  assumes \"FL1 P\" \"FLTick0 tick P\"\n  shows \"(P (tick);\\<^sub>\\<F>\\<^sub>\\<L> (Skip tick)) = P\"\n  using assms unfolding SeqComp_def Skip_def apply auto\n  using x_in_P_tickWF_exists\n  by (metis FLTick0_def)\n\nlemma s_and_tick_iff:\n  \"s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> = \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<longleftrightarrow> (s = \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\"\n  by (induct s, auto, case_tac x, auto, case_tac s, auto, case_tac x1, auto)\n\nlemma Stop_is_left_zero:\n  shows \"(Stop (tick);\\<^sub>\\<F>\\<^sub>\\<L> P) = Stop\"\n  unfolding Stop_def SeqComp_def apply auto\n   apply (case_tac s, auto, case_tac x1, auto, case_tac t, auto, case_tac x1, auto)\n  by (case_tac s, auto, case_tac x1, auto)\n\nlemma Div_is_left_zero:\n  shows \"(Div (tick);\\<^sub>\\<F>\\<^sub>\\<L> P) = Div\"\n  unfolding Div_def SeqComp_def apply auto\n  by (metis Finite_Linear_Model.last.simps(1) Finite_Linear_Model.last.simps(2) bullet_right_zero2 fltrace.distinct(1) last_dist_plus rev3.simps(1) rev3_little_more)\n\nlemma Skip_left_unit:\n  assumes \"FL0 P\" \"FL1 P\" \n  shows \"(Skip tick (tick);\\<^sub>\\<F>\\<^sub>\\<L> P) = P\"\n  using assms unfolding SeqComp_def Skip_def apply auto\n  apply (auto simp add:s_and_tick_iff)\n  by (metis Finite_Linear_Model.last.simps(1) Finite_Linear_Model.last.simps(2) bullet_right_zero2 fltrace.distinct(1) last_dist_plus rev3.simps(1) rev3_little_more)\n\nlemma SeqComp_dist_IntChoice_left:\n  shows \"P (tick);\\<^sub>\\<F>\\<^sub>\\<L> (Q \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> R) = (P (tick);\\<^sub>\\<F>\\<^sub>\\<L> Q) \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> (P (tick);\\<^sub>\\<F>\\<^sub>\\<L> R)\"\n  unfolding SeqComp_def IntChoice_def by auto\n\nlemma SeqComp_dist_IntChoice_right:\n  shows \"(P \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> Q) (tick);\\<^sub>\\<F>\\<^sub>\\<L> R = (P (tick);\\<^sub>\\<F>\\<^sub>\\<L> R) \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> (Q (tick);\\<^sub>\\<F>\\<^sub>\\<L> R)\"\n  unfolding SeqComp_def IntChoice_def by auto\n\nlemma\n  shows \"(P \\<box>\\<^sub>\\<F>\\<^sub>\\<L> Q) (tick);\\<^sub>\\<F>\\<^sub>\\<L> R = (P (tick);\\<^sub>\\<F>\\<^sub>\\<L> R) \\<box>\\<^sub>\\<F>\\<^sub>\\<L> (Q (tick);\\<^sub>\\<F>\\<^sub>\\<L> R)\"\n  unfolding SeqComp_def ExtChoice_def apply auto\n  oops\n\nlemma not_in_events_not_in_butlast_twice:\n  assumes \"tick \\<notin> events(x)\"\n  shows \"tick \\<notin> events(butlast(butlast x))\"\n  using assms by (induct x, auto)\n\nend\n", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/FL/Finite_Linear_Tick_Param.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.34188150348988366}}
{"text": "(*  Title:      HOL/Auth/WooLam.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n*)\n\nsection\\<open>The Woo-Lam Protocol\\<close>\n\ntheory WooLam imports Public begin\n\ntext\\<open>Simplified version from page 11 of\n  Abadi and Needham (1996). \n  Prudent Engineering Practice for Cryptographic Protocols.\n  IEEE Trans. S.E. 22(1), pages 6-15.\n\nNote: this differs from the Woo-Lam protocol discussed by Lowe (1996):\n  Some New Attacks upon Security Protocols.\n  Computer Security Foundations Workshop\n\\<close>\n\ninductive_set woolam :: \"event list set\"\n  where\n         (*Initial trace is empty*)\n   Nil:  \"[] \\<in> woolam\"\n\n         (** These rules allow agents to send messages to themselves **)\n\n         (*The spy MAY say anything he CAN say.  We do not expect him to\n           invent new nonces here, but he can also use NS1.  Common to\n           all similar protocols.*)\n | Fake: \"\\<lbrakk>evsf \\<in> woolam;  X \\<in> synth (analz (spies evsf))\\<rbrakk>\n          \\<Longrightarrow> Says Spy B X  # evsf \\<in> woolam\"\n\n         (*Alice initiates a protocol run*)\n | WL1:  \"evs1 \\<in> woolam \\<Longrightarrow> Says A B (Agent A) # evs1 \\<in> woolam\"\n\n         (*Bob responds to Alice's message with a challenge.*)\n | WL2:  \"\\<lbrakk>evs2 \\<in> woolam;  Says A' B (Agent A) \\<in> set evs2\\<rbrakk>\n          \\<Longrightarrow> Says B A (Nonce NB) # evs2 \\<in> woolam\"\n\n         (*Alice responds to Bob's challenge by encrypting NB with her key.\n           B is *not* properly determined -- Alice essentially broadcasts\n           her reply.*)\n | WL3:  \"\\<lbrakk>evs3 \\<in> woolam;\n             Says A  B (Agent A)  \\<in> set evs3;\n             Says B' A (Nonce NB) \\<in> set evs3\\<rbrakk>\n          \\<Longrightarrow> Says A B (Crypt (shrK A) (Nonce NB)) # evs3 \\<in> woolam\"\n\n         (*Bob forwards Alice's response to the Server.  NOTE: usually\n           the messages are shown in chronological order, for clarity.\n           But here, exchanging the two events would cause the lemma\n           WL4_analz_spies to pick up the wrong assumption!*)\n | WL4:  \"\\<lbrakk>evs4 \\<in> woolam;\n             Says A'  B X         \\<in> set evs4;\n             Says A'' B (Agent A) \\<in> set evs4\\<rbrakk>\n          \\<Longrightarrow> Says B Server \\<lbrace>Agent A, Agent B, X\\<rbrace> # evs4 \\<in> woolam\"\n\n         (*Server decrypts Alice's response for Bob.*)\n | WL5:  \"\\<lbrakk>evs5 \\<in> woolam;\n             Says B' Server \\<lbrace>Agent A, Agent B, Crypt (shrK A) (Nonce NB)\\<rbrace>\n               \\<in> set evs5\\<rbrakk>\n          \\<Longrightarrow> Says Server B (Crypt (shrK B) \\<lbrace>Agent A, Nonce NB\\<rbrace>)\n                 # evs5 \\<in> woolam\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body  [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\n\n\n(*A \"possibility property\": there are traces that reach the end*)\nlemma \"\\<exists>NB. \\<exists>evs \\<in> woolam.\n             Says Server B (Crypt (shrK B) \\<lbrace>Agent A, Nonce NB\\<rbrace>) \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] woolam.Nil\n                    [THEN woolam.WL1, THEN woolam.WL2, THEN woolam.WL3,\n                     THEN woolam.WL4, THEN woolam.WL5], possibility)\ndone\n\n(*Could prove forwarding lemmas for WL4, but we do not need them!*)\n\n(**** Inductive proofs about woolam ****)\n\n(** Theorems of the form X \\<notin> parts (spies evs) imply that NOBODY\n    sends messages containing X! **)\n\n(*Spy never sees a good agent's shared key!*)\nlemma Spy_see_shrK [simp]:\n     \"evs \\<in> woolam \\<Longrightarrow> (Key (shrK A) \\<in> parts (spies evs)) = (A \\<in> bad)\"\nby (erule woolam.induct, force, simp_all, blast+)\n\nlemma Spy_analz_shrK [simp]:\n     \"evs \\<in> woolam \\<Longrightarrow> (Key (shrK A) \\<in> analz (spies evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"\\<lbrakk>Key (shrK A) \\<in> parts (knows Spy evs);  evs \\<in> woolam\\<rbrakk> \\<Longrightarrow> A \\<in> bad\"\nby (blast dest: Spy_see_shrK)\n\n\n(**** Autheticity properties for Woo-Lam ****)\n\n(*** WL4 ***)\n\n(*If the encrypted message appears then it originated with Alice*)\nlemma NB_Crypt_imp_Alice_msg:\n     \"\\<lbrakk>Crypt (shrK A) (Nonce NB) \\<in> parts (spies evs);\n         A \\<notin> bad;  evs \\<in> woolam\\<rbrakk>\n      \\<Longrightarrow> \\<exists>B. Says A B (Crypt (shrK A) (Nonce NB)) \\<in> set evs\"\nby (erule rev_mp, erule woolam.induct, force, simp_all, blast+)\n\n(*Guarantee for Server: if it gets a message containing a certificate from\n  Alice, then she originated that certificate.  But we DO NOT know that B\n  ever saw it: the Spy may have rerouted the message to the Server.*)\nlemma Server_trusts_WL4 [dest]:\n     \"\\<lbrakk>Says B' Server \\<lbrace>Agent A, Agent B, Crypt (shrK A) (Nonce NB)\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  evs \\<in> woolam\\<rbrakk>\n      \\<Longrightarrow> \\<exists>B. Says A B (Crypt (shrK A) (Nonce NB)) \\<in> set evs\"\nby (blast intro!: NB_Crypt_imp_Alice_msg)\n\n\n(*** WL5 ***)\n\n(*Server sent WL5 only if it received the right sort of message*)\nlemma Server_sent_WL5 [dest]:\n     \"\\<lbrakk>Says Server B (Crypt (shrK B) \\<lbrace>Agent A, NB\\<rbrace>) \\<in> set evs;\n         evs \\<in> woolam\\<rbrakk>\n      \\<Longrightarrow> \\<exists>B'. Says B' Server \\<lbrace>Agent A, Agent B, Crypt (shrK A) NB\\<rbrace>\n             \\<in> set evs\"\nby (erule rev_mp, erule woolam.induct, force, simp_all, blast+)\n\n(*If the encrypted message appears then it originated with the Server!*)\nlemma NB_Crypt_imp_Server_msg [rule_format]:\n     \"\\<lbrakk>Crypt (shrK B) \\<lbrace>Agent A, NB\\<rbrace> \\<in> parts (spies evs);\n         B \\<notin> bad;  evs \\<in> woolam\\<rbrakk>\n      \\<Longrightarrow> Says Server B (Crypt (shrK B) \\<lbrace>Agent A, NB\\<rbrace>) \\<in> set evs\"\nby (erule rev_mp, erule woolam.induct, force, simp_all, blast+)\n\n(*Guarantee for B.  If B gets the Server's certificate then A has encrypted\n  the nonce using her key.  This event can be no older than the nonce itself.\n  But A may have sent the nonce to some other agent and it could have reached\n  the Server via the Spy.*)\nlemma B_trusts_WL5:\n     \"\\<lbrakk>Says S B (Crypt (shrK B) \\<lbrace>Agent A, Nonce NB\\<rbrace>) \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> woolam\\<rbrakk>\n      \\<Longrightarrow> \\<exists>B. Says A B (Crypt (shrK A) (Nonce NB)) \\<in> set evs\"\nby (blast dest!: NB_Crypt_imp_Server_msg)\n\n\n(*B only issues challenges in response to WL1.  Not used.*)\nlemma B_said_WL2:\n     \"\\<lbrakk>Says B A (Nonce NB) \\<in> set evs;  B \\<noteq> Spy;  evs \\<in> woolam\\<rbrakk>\n      \\<Longrightarrow> \\<exists>A'. Says A' B (Agent A) \\<in> set evs\"\nby (erule rev_mp, erule woolam.induct, force, simp_all, blast+)\n\n\n(**CANNOT be proved because A doesn't know where challenges come from...*)\nlemma \"\\<lbrakk>A \\<notin> bad;  B \\<noteq> Spy;  evs \\<in> woolam\\<rbrakk>\n  \\<Longrightarrow> Crypt (shrK A) (Nonce NB) \\<in> parts (spies evs) \\<and>\n      Says B A (Nonce NB) \\<in> set evs\n      \\<longrightarrow> Says A B (Crypt (shrK A) (Nonce NB)) \\<in> set evs\"\napply (erule rev_mp, erule woolam.induct, force, simp_all, blast, auto)\noops\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/WooLam.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850278370112, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.3418682112651253}}
{"text": "(* \n   Title: Psi-calculi   \n   Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Frame\n  imports Agent\nbegin\n\nlemma permLength[simp]:\n  fixes p    :: \"name prm\"\n  and   xvec :: \"'a::pt_name list\"\n\n  shows \"length(p \\<bullet> xvec) = length xvec\"\nby(induct xvec) auto\n\nnominal_datatype 'assertion frame =\n    FAssert \"'assertion::fs_name\"\n  | FRes \"\\<guillemotleft>name\\<guillemotright> ('assertion frame)\" (\"\\<lparr>\\<nu>_\\<rparr>_\" [80, 80] 80)\n\nprimrec frameResChain :: \"name list \\<Rightarrow> ('a::fs_name) frame \\<Rightarrow> 'a frame\" where\n  base: \"frameResChain [] F = F\"\n| step: \"frameResChain (x#xs) F = \\<lparr>\\<nu>x\\<rparr>(frameResChain xs F)\"\n\nnotation frameResChain (\"\\<lparr>\\<nu>*_\\<rparr>_\" [80, 80] 80)\nnotation FAssert  (\"\\<langle>\\<epsilon>, _\\<rangle>\" [80] 80)\nabbreviation FAssertJudge (\"\\<langle>_, _\\<rangle>\" [80, 80] 80) where \"\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> \\<equiv> frameResChain A\\<^sub>F (FAssert \\<Psi>\\<^sub>F)\"\n\nlemma frameResChainEqvt[eqvt]:\n  fixes perm :: \"name prm\"\n  and   lst  :: \"name list\"\n  and   F    :: \"'a::fs_name frame\"\n  \n  shows \"perm \\<bullet> (\\<lparr>\\<nu>*xvec\\<rparr>F) = \\<lparr>\\<nu>*(perm \\<bullet> xvec)\\<rparr>(perm \\<bullet> F)\"\nby(induct_tac xvec, auto)\n\nlemma frameResChainFresh: \n  fixes x    :: name\n  and   xvec :: \"name list\"\n  and   F    :: \"'a::fs_name frame\"\n\n  shows \"x \\<sharp> \\<lparr>\\<nu>*xvec\\<rparr>F = (x \\<in> set xvec \\<or> x \\<sharp> F)\"\nby (induct xvec) (simp_all add: abs_fresh)\n\nlemma frameResChainFreshSet: \n  fixes Xs   :: \"name set\"\n  and   xvec :: \"name list\"\n  and   F    :: \"'a::fs_name frame\"\n\n  shows \"Xs \\<sharp>* (\\<lparr>\\<nu>*xvec\\<rparr>F) = (\\<forall>x\\<in>Xs. x \\<in> set xvec \\<or> x \\<sharp> F)\"\nby (simp add: fresh_star_def frameResChainFresh)\n\nlemma frameChainAlpha:\n  fixes p    :: \"name prm\"\n  and   xvec :: \"name list\"\n  and   F    :: \"'a::fs_name frame\"\n\n  assumes xvecFreshF: \"(p \\<bullet> xvec) \\<sharp>* F\"\n  and     S: \"set p \\<subseteq> set xvec \\<times> set (p \\<bullet> xvec)\"\n\n  shows \"\\<lparr>\\<nu>*xvec\\<rparr>F = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(p \\<bullet> F)\"\nproof -\n  note pt_name_inst at_name_inst S\n  moreover have \"set xvec \\<sharp>* (\\<lparr>\\<nu>*xvec\\<rparr>F)\"\n    by (simp add: frameResChainFreshSet)\n  moreover from xvecFreshF have \"set (p \\<bullet> xvec) \\<sharp>* (\\<lparr>\\<nu>*xvec\\<rparr>F)\"\n    by (simp add: frameResChainFreshSet) (simp add: fresh_star_def)\n  ultimately have \"\\<lparr>\\<nu>*xvec\\<rparr>F = p \\<bullet> (\\<lparr>\\<nu>*xvec\\<rparr>F)\"\n    by (rule_tac pt_freshs_freshs [symmetric])\n  then show ?thesis by(simp add: eqvts)\nqed\n\nlemma frameChainAlpha':\n  fixes p    :: \"name prm\"\n  and   A\\<^sub>P   :: \"name list\"\n  and   \\<Psi>\\<^sub>P  :: \"'a::fs_name\"\n\n  assumes \"(p \\<bullet> A\\<^sub>P) \\<sharp>* \\<Psi>\\<^sub>P\"\n  and     S: \"set p \\<subseteq> set A\\<^sub>P \\<times> set (p \\<bullet> A\\<^sub>P)\"\n\n  shows \"\\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle> = \\<langle>(p \\<bullet> A\\<^sub>P), p \\<bullet> \\<Psi>\\<^sub>P\\<rangle>\"\nusing assms\nby(subst frameChainAlpha) (auto simp add: fresh_star_def)\n\nlemma alphaFrameRes:\n  fixes x :: name\n  and   F :: \"'a::fs_name frame\"\n  and   y :: name\n\n  assumes \"y \\<sharp> F\"\n\n  shows \"\\<lparr>\\<nu>x\\<rparr>F = \\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> F)\"\nproof(cases \"x = y\")\n  assume \"x=y\"\n  thus ?thesis by simp\nnext\n  assume \"x \\<noteq> y\"\n  with \\<open>y \\<sharp> F\\<close> show ?thesis\n    by(perm_simp add: frame.inject alpha calc_atm fresh_left)\nqed\n\nlemma frameChainAppend:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   F    :: \"'a::fs_name frame\"\n  \n  shows \"\\<lparr>\\<nu>*(xvec@yvec)\\<rparr>F = \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>*yvec\\<rparr>F)\"\nby(induct xvec) auto\n\nlemma frameChainEqLength:\n  fixes xvec :: \"name list\"\n  and   \\<Psi>    :: \"'a::fs_name\"\n  and   yvec :: \"name list\"\n  and   \\<Psi>'   :: \"'a::fs_name\"\n\n  assumes \"\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\"\n\n  shows \"length xvec = length yvec\"\nproof -\n  obtain n where \"n = length xvec\" by auto\n  with assms show ?thesis\n  proof(induct n arbitrary: xvec yvec \\<Psi> \\<Psi>')\n    case(0 xvec yvec \\<Psi> \\<Psi>')\n    from \\<open>0 = length xvec\\<close> have \"xvec = []\" by auto\n    moreover with \\<open>\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\\<close> have \"yvec = []\"\n      by(case_tac yvec) auto\n    ultimately show ?case by simp\n  next\n    case(Suc n xvec yvec \\<Psi> \\<Psi>')\n    from \\<open>Suc n = length xvec\\<close>\n    obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n      by(case_tac xvec) auto\n    from \\<open>\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\\<close> \\<open>xvec = x # xvec'\\<close>\n    obtain y yvec' where \"\\<langle>(x#xvec'), \\<Psi>\\<rangle> = \\<langle>(y#yvec'), \\<Psi>'\\<rangle>\"\n      and \"yvec = y#yvec'\"\n      by(case_tac yvec) auto\n    hence EQ: \"\\<lparr>\\<nu>x\\<rparr>\\<lparr>\\<nu>*xvec'\\<rparr>(FAssert \\<Psi>) = \\<lparr>\\<nu>y\\<rparr>\\<lparr>\\<nu>*yvec'\\<rparr>(FAssert \\<Psi>')\"\n      by simp\n    have IH: \"\\<And>xvec yvec \\<Psi> \\<Psi>'. \\<lbrakk>\\<langle>xvec, (\\<Psi>::'a)\\<rangle> = \\<langle>yvec, (\\<Psi>'::'a)\\<rangle>; n = length xvec\\<rbrakk> \\<Longrightarrow> length xvec = length yvec\"\n      by fact\n    show ?case\n    proof(case_tac \"x = y\")\n      assume \"x = y\"\n      with EQ have \"\\<langle>xvec', \\<Psi>\\<rangle> = \\<langle>yvec', \\<Psi>'\\<rangle>\"\n        by(simp add: alpha frame.inject)\n      with IH \\<open>length xvec' = n\\<close> have \"length xvec' = length yvec'\"\n        by blast\n      with \\<open>xvec = x#xvec'\\<close> \\<open>yvec=y#yvec'\\<close>\n      show ?case by simp\n    next\n      assume \"x \\<noteq> y\"\n      with EQ have \"\\<langle>xvec', \\<Psi>\\<rangle> = [(x, y)] \\<bullet> \\<langle>yvec', \\<Psi>'\\<rangle>\"\n        by(simp add: alpha frame.inject)\n      hence \"\\<langle>xvec', \\<Psi>\\<rangle> = \\<langle>([(x, y)] \\<bullet> yvec'), ([(x, y)] \\<bullet> \\<Psi>')\\<rangle>\"\n        by(simp add: eqvts)\n      with IH \\<open>length xvec' = n\\<close> have \"length xvec' = length ([(x, y)] \\<bullet> yvec')\"\n        by blast\n      hence \"length xvec' = length yvec'\"\n        by simp\n      with \\<open>xvec = x#xvec'\\<close> \\<open>yvec=y#yvec'\\<close>\n      show ?case by simp\n    qed\n  qed\nqed\n\nlemma frameEqFresh:\n  fixes F :: \"('a::fs_name) frame\"\n  and   G :: \"'a frame\"\n  and   x :: name\n  and   y :: name\n\n  assumes \"\\<lparr>\\<nu>x\\<rparr>F = \\<lparr>\\<nu>y\\<rparr>G\"\n  and     \"x \\<sharp> F\"\n  \n  shows \"y \\<sharp> G\"\nusing assms\nby(auto simp add: frame.inject alpha fresh_left calc_atm)  \n\nlemma frameEqSupp:\n  fixes F :: \"('a::fs_name) frame\"\n  and   G :: \"'a frame\"\n  and   x :: name\n  and   y :: name\n\n  assumes \"\\<lparr>\\<nu>x\\<rparr>F = \\<lparr>\\<nu>y\\<rparr>G\"\n  and     \"x \\<in> supp F\"\n  \n  shows \"y \\<in> supp G\"\nusing assms\napply(auto simp add: frame.inject alpha fresh_left calc_atm)\napply(drule_tac pi=\"[(x, y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\nby(simp add: eqvts calc_atm)\n\nlemma frameChainEqSuppEmpty[dest]:\n  fixes xvec :: \"name list\"\n  and   \\<Psi>    :: \"'a::fs_name\"\n  and   yvec :: \"name list\"\n  and   \\<Psi>'   :: \"'a::fs_name\"\n\n  assumes \"\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\"\n  and     \"supp \\<Psi> = ({}::name set)\"\n\n  shows \"\\<Psi> = \\<Psi>'\"\nproof -\n  obtain n where \"n = length xvec\" by auto\n  with assms show ?thesis\n  proof(induct n arbitrary: xvec yvec \\<Psi> \\<Psi>')\n    case(0 xvec yvec \\<Psi> \\<Psi>')\n    from \\<open>0 = length xvec\\<close> have \"xvec = []\" by auto\n    moreover with \\<open>\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\\<close> have \"yvec = []\"\n      by(case_tac yvec) auto\n    ultimately show ?case  using \\<open>\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\\<close>\n      by(simp add: frame.inject) \n  next\n    case(Suc n xvec yvec \\<Psi> \\<Psi>')\n    from \\<open>Suc n = length xvec\\<close>\n    obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n      by(case_tac xvec) auto\n    from \\<open>\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\\<close> \\<open>xvec = x # xvec'\\<close>\n    obtain y yvec' where \"\\<langle>(x#xvec'), \\<Psi>\\<rangle> = \\<langle>(y#yvec'), \\<Psi>'\\<rangle>\"\n      and \"yvec = y#yvec'\"\n      by(case_tac yvec) auto\n    hence EQ: \"\\<lparr>\\<nu>x\\<rparr>\\<lparr>\\<nu>*xvec'\\<rparr>(FAssert \\<Psi>) = \\<lparr>\\<nu>y\\<rparr>\\<lparr>\\<nu>*yvec'\\<rparr>(FAssert \\<Psi>')\"\n      by simp\n    have IH: \"\\<And>xvec yvec \\<Psi> \\<Psi>'. \\<lbrakk>\\<langle>xvec, (\\<Psi>::'a)\\<rangle> = \\<langle>yvec, (\\<Psi>'::'a)\\<rangle>; supp \\<Psi> = ({}::name set); n = length xvec\\<rbrakk> \\<Longrightarrow> \\<Psi> = \\<Psi>'\"\n      by fact\n    show ?case\n    proof(case_tac \"x = y\")\n      assume \"x = y\"\n      with EQ have \"\\<langle>xvec', \\<Psi>\\<rangle> = \\<langle>yvec', \\<Psi>'\\<rangle>\"\n        by(simp add: alpha frame.inject)\n      with IH \\<open>length xvec' = n\\<close> \\<open>supp \\<Psi> = {}\\<close> show ?case\n        by simp\n    next\n      assume \"x \\<noteq> y\"\n      with EQ have \"\\<langle>xvec', \\<Psi>\\<rangle> = [(x, y)] \\<bullet> \\<langle>yvec', \\<Psi>'\\<rangle>\"\n        by(simp add: alpha frame.inject)\n      hence \"\\<langle>xvec', \\<Psi>\\<rangle> = \\<langle>([(x, y)] \\<bullet> yvec'), ([(x, y)] \\<bullet> \\<Psi>')\\<rangle>\"\n        by(simp add: eqvts)\n      with IH \\<open>length xvec' = n\\<close> \\<open>supp \\<Psi> = {}\\<close> have \"\\<Psi> = [(x, y)] \\<bullet> \\<Psi>'\"\n        by(simp add: eqvts)\n      moreover with \\<open>supp \\<Psi> = {}\\<close> have \"supp([(x, y)] \\<bullet> \\<Psi>') = ({}::name set)\"\n        by simp\n      hence \"x \\<sharp> ([(x, y)] \\<bullet> \\<Psi>')\" and \"y \\<sharp> ([(x, y)] \\<bullet> \\<Psi>')\"\n        by(simp add: fresh_def)+\n      with \\<open>x \\<noteq> y\\<close> have \"x \\<sharp> \\<Psi>'\" and \"y \\<sharp> \\<Psi>'\"\n        by(simp add: fresh_left calc_atm)+\n      ultimately show ?case by simp\n    qed\n  qed\nqed\n\nlemma frameChainEq:\n  fixes xvec :: \"name list\"\n  and   \\<Psi>    :: \"'a::fs_name\"\n  and   yvec :: \"name list\"\n  and   \\<Psi>'   :: \"'a::fs_name\"\n\n  assumes \"\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\"\n  and     \"xvec \\<sharp>* yvec\"\n\n  obtains p where \"(set p) \\<subseteq> (set xvec) \\<times> set (yvec)\" and \"distinctPerm p\" and \"\\<Psi>' = p \\<bullet> \\<Psi>\"\nproof -\n  assume \"\\<And>p. \\<lbrakk>set p \\<subseteq> set xvec \\<times> set yvec; distinctPerm p; \\<Psi>' = p \\<bullet> \\<Psi>\\<rbrakk> \\<Longrightarrow> thesis\"\n  moreover obtain n where \"n = length xvec\" by auto\n  with assms have \"\\<exists>p. (set p) \\<subseteq> (set xvec) \\<times> set (yvec) \\<and> distinctPerm p \\<and>  \\<Psi>' = p \\<bullet> \\<Psi>\"\n  proof(induct n arbitrary: xvec yvec \\<Psi> \\<Psi>')\n    case(0 xvec yvec \\<Psi> \\<Psi>')\n    have Eq: \"\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\" by fact\n    from \\<open>0 = length xvec\\<close> have \"xvec = []\" by auto\n    moreover with Eq have \"yvec = []\"\n      by(case_tac yvec) auto\n    ultimately show ?case using Eq\n      by(simp add: frame.inject)\n  next\n    case(Suc n xvec yvec \\<Psi> \\<Psi>')\n    from \\<open>Suc n = length xvec\\<close>\n    obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n      by(case_tac xvec) auto\n    from \\<open>\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\\<close> \\<open>xvec = x # xvec'\\<close>\n    obtain y yvec' where \"\\<langle>(x#xvec'), \\<Psi>\\<rangle> = \\<langle>(y#yvec'), \\<Psi>'\\<rangle>\"\n      and \"yvec = y#yvec'\"\n      by(case_tac yvec) auto\n    hence EQ: \"\\<lparr>\\<nu>x\\<rparr>\\<lparr>\\<nu>*xvec'\\<rparr>(FAssert \\<Psi>) = \\<lparr>\\<nu>y\\<rparr>\\<lparr>\\<nu>*yvec'\\<rparr>(FAssert \\<Psi>')\"\n      by simp\n    from \\<open>xvec = x#xvec'\\<close> \\<open>yvec=y#yvec'\\<close> \\<open>xvec \\<sharp>* yvec\\<close>\n    have \"x \\<noteq> y\" and \"xvec' \\<sharp>* yvec'\" and \"x \\<sharp> yvec'\" and \"y \\<sharp> xvec'\"\n      by auto\n    have IH: \"\\<And>xvec yvec \\<Psi> \\<Psi>'. \\<lbrakk>\\<langle>xvec, (\\<Psi>::'a)\\<rangle> = \\<langle>yvec, (\\<Psi>'::'a)\\<rangle>; xvec \\<sharp>* yvec; n = length xvec\\<rbrakk> \\<Longrightarrow>\n                                 \\<exists>p. (set p) \\<subseteq> (set xvec) \\<times> (set yvec) \\<and> distinctPerm p \\<and>  \\<Psi>' = p \\<bullet> \\<Psi>\"\n      by fact\n\n    from EQ \\<open>x \\<noteq> y\\<close> have EQ': \"\\<langle>xvec', \\<Psi>\\<rangle> = ([(x, y)] \\<bullet> \\<langle>yvec', \\<Psi>'\\<rangle>)\" \n                     and xFresh\\<Psi>': \"x \\<sharp> \\<lparr>\\<nu>*yvec'\\<rparr>(FAssert \\<Psi>')\"\n      by(simp add: frame.inject alpha)+\n\n    show ?case\n    proof(case_tac \"x \\<sharp> \\<langle>xvec', \\<Psi>\\<rangle>\")\n      assume \"x \\<sharp> \\<langle>xvec', \\<Psi>\\<rangle>\"\n      with EQ have \"y \\<sharp> \\<langle>yvec', \\<Psi>'\\<rangle>\"\n        by(rule frameEqFresh)\n      with xFresh\\<Psi>' EQ' have \"\\<langle>xvec', \\<Psi>\\<rangle> = \\<langle>yvec', \\<Psi>'\\<rangle>\" \n        by(simp)\n      with \\<open>xvec' \\<sharp>* yvec'\\<close> \\<open>length xvec' = n\\<close> IH\n      obtain p where S: \"(set p) \\<subseteq> (set xvec') \\<times> (set yvec')\" and \"distinctPerm p\"  and \"\\<Psi>' = p \\<bullet> \\<Psi>\"\n        by blast\n      from S have \"(set p) \\<subseteq> set(x#xvec') \\<times> set(y#yvec')\" by auto\n      with \\<open>xvec = x#xvec'\\<close> \\<open>yvec=y#yvec'\\<close> \\<open>distinctPerm p\\<close> \\<open>\\<Psi>' = p \\<bullet> \\<Psi>\\<close>\n      show ?case by blast\n    next\n      assume \"\\<not>(x \\<sharp> \\<lparr>\\<nu>*xvec'\\<rparr>(FAssert \\<Psi>))\"\n      hence xSupp\\<Psi>: \"x \\<in> supp(\\<langle>xvec', \\<Psi>\\<rangle>)\"\n        by(simp add: fresh_def)\n      with EQ have \"y \\<in> supp (\\<langle>yvec', \\<Psi>'\\<rangle>)\"\n        by(rule frameEqSupp)\n      hence \"y \\<sharp> yvec'\"\n        by(induct yvec') (auto simp add: frame.supp abs_supp)      \n      with \\<open>x \\<sharp> yvec'\\<close> EQ' have \"\\<langle>xvec', \\<Psi>\\<rangle> = \\<langle>yvec', ([(x, y)] \\<bullet> \\<Psi>')\\<rangle>\"\n        by(simp add: eqvts)\n      with  \\<open>xvec' \\<sharp>* yvec'\\<close> \\<open>length xvec' = n\\<close> IH\n      obtain p where S: \"(set p) \\<subseteq> (set xvec') \\<times> (set yvec')\" and \"distinctPerm p\" and \"([(x, y)] \\<bullet> \\<Psi>') = p \\<bullet> \\<Psi>\"\n        by blast\n\n      from xSupp\\<Psi> have \"x \\<sharp> xvec'\"\n        by(induct xvec') (auto simp add: frame.supp abs_supp)      \n      with \\<open>x \\<sharp> yvec'\\<close> \\<open>y \\<sharp> xvec'\\<close> \\<open>y \\<sharp> yvec'\\<close> S have \"x \\<sharp> p\" and \"y \\<sharp> p\"\n        apply(induct p)\n        by(auto simp add: name_list_supp) (auto simp add: fresh_def) \n      from S have \"(set ((x, y)#p)) \\<subseteq> (set(x#xvec')) \\<times> (set(y#yvec'))\"\n        by force\n      moreover from \\<open>x \\<noteq> y\\<close> \\<open>x \\<sharp> p\\<close> \\<open>y \\<sharp> p\\<close> S \\<open>distinctPerm p\\<close>\n      have \"distinctPerm((x,y)#p)\" by simp\n      moreover from \\<open>x \\<sharp> p\\<close> \\<open>y \\<sharp> p\\<close> \\<open>x \\<sharp> xvec'\\<close> \\<open>y \\<sharp> xvec'\\<close> have \"y#(p \\<bullet> xvec') = ((x, y)#p) \\<bullet> (x#xvec')\" \n        by(simp add: eqvts calc_atm freshChainSimps)\n      moreover from \\<open>([(x, y)] \\<bullet> \\<Psi>') = p \\<bullet> \\<Psi>\\<close>\n      have \"([(x, y)] \\<bullet> [(x, y)] \\<bullet> \\<Psi>') = [(x, y)] \\<bullet> p \\<bullet> \\<Psi>\"\n        by(simp add: pt_bij)\n      hence \"\\<Psi>' = ((x, y)#p) \\<bullet> \\<Psi>\" by simp\n      ultimately show ?case using \\<open>xvec=x#xvec'\\<close> \\<open>yvec=y#yvec'\\<close>\n        by blast\n    qed\n  qed\n  ultimately show ?thesis by blast\nqed\n(*\nlemma frameChainEq'':\n  fixes xvec :: \"name list\"\n  and   \\<Psi>    :: \"'a::fs_name\"\n  and   yvec :: \"name list\"\n  and   \\<Psi>'   :: \"'a::fs_name\"\n\n  assumes \"\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\"\n\n  obtains p where \"(set p) \\<subseteq> (set xvec) \\<times> set (yvec)\" and \"\\<Psi>' = p \\<bullet> \\<Psi>\"\nproof -\n  assume \"\\<And>p. \\<lbrakk>set p \\<subseteq> set xvec \\<times> set yvec; \\<Psi>' = p \\<bullet> \\<Psi>\\<rbrakk> \\<Longrightarrow> thesis\"\n  moreover obtain n where \"n = length xvec\" by auto\n  with assms have \"\\<exists>p. (set p) \\<subseteq> (set xvec) \\<times> set (yvec) \\<and> \\<Psi>' = p \\<bullet> \\<Psi>\"\n  proof(induct n arbitrary: xvec yvec \\<Psi> \\<Psi>')\n    case(0 xvec yvec \\<Psi> \\<Psi>')\n    have Eq: \"\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\" by fact\n    from `0 = length xvec` have \"xvec = []\" by auto\n    moreover with Eq have \"yvec = []\"\n      by(case_tac yvec) auto\n    ultimately show ?case using Eq\n      by(simp add: frame.inject)\n  next\n    case(Suc n xvec yvec \\<Psi> \\<Psi>')\n    from `Suc n = length xvec`\n    obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n      by(case_tac xvec) auto\n    from `\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>` `xvec = x # xvec'`\n    obtain y yvec' where \"\\<langle>(x#xvec'), \\<Psi>\\<rangle> = \\<langle>(y#yvec'), \\<Psi>'\\<rangle>\"\n      and \"yvec = y#yvec'\"\n      by(case_tac yvec) auto\n    hence EQ: \"\\<lparr>\\<nu>x\\<rparr>\\<lparr>\\<nu>*xvec'\\<rparr>(FAssert \\<Psi>) = \\<lparr>\\<nu>y\\<rparr>\\<lparr>\\<nu>*yvec'\\<rparr>(FAssert \\<Psi>')\"\n      by simp\n    have IH: \"\\<And>xvec yvec \\<Psi> \\<Psi>'. \\<lbrakk>\\<langle>xvec, (\\<Psi>::'a)\\<rangle> = \\<langle>yvec, (\\<Psi>'::'a)\\<rangle>; n = length xvec\\<rbrakk> \\<Longrightarrow>\n                                 \\<exists>p. (set p) \\<subseteq> (set xvec) \\<times> (set yvec) \\<and> \\<Psi>' = p \\<bullet> \\<Psi>\"\n      by fact\n    show ?case\n    proof(cases \"x=y\")\n      case True\n      from EQ `x = y` have \"\\<langle>xvec', \\<Psi>\\<rangle> = \\<langle>yvec', \\<Psi>'\\<rangle>\" by(simp add: alpha frame.inject)\n      then obtain p where S: \"set p \\<subseteq> set xvec' \\<times> set yvec'\" and \"\\<Psi>' = p \\<bullet> \\<Psi>\" using `length xvec' = n` IH\n        by blast\n      from S have \"set((x, y)#p) \\<subseteq> set(x#xvec') \\<times> set (y#yvec')\" by auto\n      moreover from `x = y` `\\<Psi>' = p \\<bullet> \\<Psi>` have \"\\<Psi>' = ((x, y)#p) \\<bullet> \\<Psi>\" by auto\n      ultimately show ?thesis using `xvec = x#xvec'` `yvec = y#yvec'` by blast\n    next\n      case False\n      from EQ `x \\<noteq> y` have EQ': \"\\<langle>xvec', \\<Psi>\\<rangle> = ([(x, y)] \\<bullet> \\<langle>yvec', \\<Psi>'\\<rangle>)\" \n                       and xFresh\\<Psi>': \"x \\<sharp> \\<lparr>\\<nu>*yvec'\\<rparr>(FAssert \\<Psi>')\"\n        by(simp add: frame.inject alpha)+\n    \n      show ?thesis\n      proof(cases \"x \\<sharp> \\<langle>xvec', \\<Psi>\\<rangle>\")\n        case True\n        from EQ `x \\<sharp> \\<langle>xvec', \\<Psi>\\<rangle>` have \"y \\<sharp> \\<langle>yvec', \\<Psi>'\\<rangle>\"\n          by(rule frameEqFresh)\n        with xFresh\\<Psi>' EQ' have \"\\<langle>xvec', \\<Psi>\\<rangle> = \\<langle>yvec', \\<Psi>'\\<rangle>\" \n          by(simp)\n        with `length xvec' = n` IH\n        obtain p where S: \"(set p) \\<subseteq> (set xvec') \\<times> (set yvec')\" and \"\\<Psi>' = p \\<bullet> \\<Psi>\"\n          by blast\n        from S have \"(set p) \\<subseteq> set(x#xvec') \\<times> set(y#yvec')\" by auto\n        with `xvec = x#xvec'` `yvec=y#yvec'` `\\<Psi>' = p \\<bullet> \\<Psi>`\n        show ?thesis by blast\n      next\n        case False\n        from `\\<not>(x \\<sharp> \\<lparr>\\<nu>*xvec'\\<rparr>(FAssert \\<Psi>))` have xSupp\\<Psi>: \"x \\<in> supp(\\<langle>xvec', \\<Psi>\\<rangle>)\"\n          by(simp add: fresh_def)\n        with EQ have \"y \\<in> supp (\\<langle>yvec', \\<Psi>'\\<rangle>)\"\n          by(rule frameEqSupp)\n        hence \"y \\<sharp> yvec'\"\n          by(induct yvec') (auto simp add: frame.supp abs_supp)\n\n        with `x \\<sharp> yvec'` EQ' have \"\\<langle>xvec', \\<Psi>\\<rangle> = \\<langle>yvec', ([(x, y)] \\<bullet> \\<Psi>')\\<rangle>\"\n          by(simp add: eqvts)\n        with  `xvec' \\<sharp>* yvec'` `length xvec' = n` IH\n        obtain p where S: \"(set p) \\<subseteq> (set xvec') \\<times> (set yvec')\" and \"distinctPerm p\" and \"([(x, y)] \\<bullet> \\<Psi>') = p \\<bullet> \\<Psi>\"\n          by blast\n        \n        from xSupp\\<Psi> have \"x \\<sharp> xvec'\"\n          by(induct xvec') (auto simp add: frame.supp abs_supp)      \n        with `x \\<sharp> yvec'` `y \\<sharp> xvec'` `y \\<sharp> yvec'` S have \"x \\<sharp> p\" and \"y \\<sharp> p\"\n          apply(induct p)\n          by(auto simp add: name_list_supp) (auto simp add: fresh_def) \n        from S have \"(set ((x, y)#p)) \\<subseteq> (set(x#xvec')) \\<times> (set(y#yvec'))\"\n          by force\n        moreover from `x \\<noteq> y` `x \\<sharp> p` `y \\<sharp> p` S `distinctPerm p`\n        have \"distinctPerm((x,y)#p)\" by simp\n        moreover from `x \\<sharp> p` `y \\<sharp> p` `x \\<sharp> xvec'` `y \\<sharp> xvec'` have \"y#(p \\<bullet> xvec') = ((x, y)#p) \\<bullet> (x#xvec')\" \n          by(simp add: eqvts calc_atm freshChainSimps)\n        moreover from `([(x, y)] \\<bullet> \\<Psi>') = p \\<bullet> \\<Psi>`\n        have \"([(x, y)] \\<bullet> [(x, y)] \\<bullet> \\<Psi>') = [(x, y)] \\<bullet> p \\<bullet> \\<Psi>\"\n          by(simp add: pt_bij)\n        hence \"\\<Psi>' = ((x, y)#p) \\<bullet> \\<Psi>\" by simp\n        ultimately show ?case using `xvec=x#xvec'` `yvec=y#yvec'`\n          by blast\n      qed\n    qed\n    ultimately show ?thesis by blast\nqed\n*)\nlemma frameChainEq':\n  fixes xvec :: \"name list\"\n  and   \\<Psi>    :: \"'a::fs_name\"\n  and   yvec :: \"name list\"\n  and   \\<Psi>'   :: \"'a::fs_name\"\n\n  assumes \"\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\"\n  and     \"xvec \\<sharp>* yvec\"\n  and     \"distinct xvec\"\n  and     \"distinct yvec\"\n\n  obtains p where \"(set p) \\<subseteq> (set xvec) \\<times> set (p \\<bullet> xvec)\" and \"distinctPerm p\" and \"yvec = p \\<bullet> xvec\" and \"\\<Psi>' = p \\<bullet> \\<Psi>\"\nproof -\n  assume \"\\<And>p. \\<lbrakk>set p \\<subseteq> set xvec \\<times> set (p \\<bullet> xvec); distinctPerm p; yvec = p \\<bullet> xvec; \\<Psi>' = p \\<bullet> \\<Psi>\\<rbrakk> \\<Longrightarrow> thesis\"\n  moreover obtain n where \"n = length xvec\" by auto\n  with assms have \"\\<exists>p. (set p) \\<subseteq> (set xvec) \\<times> set (yvec) \\<and> distinctPerm p \\<and>  yvec = p \\<bullet> xvec \\<and> \\<Psi>' = p \\<bullet> \\<Psi>\"\n  proof(induct n arbitrary: xvec yvec \\<Psi> \\<Psi>')\n    case(0 xvec yvec \\<Psi> \\<Psi>')\n    have Eq: \"\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\" by fact\n    from \\<open>0 = length xvec\\<close> have \"xvec = []\" by auto\n    moreover with Eq have \"yvec = []\"\n      by(case_tac yvec) auto\n    ultimately show ?case using Eq\n      by(simp add: frame.inject)\n  next\n    case(Suc n xvec yvec \\<Psi> \\<Psi>')\n    from \\<open>Suc n = length xvec\\<close>\n    obtain x xvec' where \"xvec = x#xvec'\" and \"length xvec' = n\"\n      by(case_tac xvec) auto\n    from \\<open>\\<langle>xvec, \\<Psi>\\<rangle> = \\<langle>yvec, \\<Psi>'\\<rangle>\\<close> \\<open>xvec = x # xvec'\\<close>\n    obtain y yvec' where \"\\<langle>(x#xvec'), \\<Psi>\\<rangle> = \\<langle>(y#yvec'), \\<Psi>'\\<rangle>\"\n      and \"yvec = y#yvec'\"\n      by(case_tac yvec) auto\n    hence EQ: \"\\<lparr>\\<nu>x\\<rparr>\\<lparr>\\<nu>*xvec'\\<rparr>(FAssert \\<Psi>) = \\<lparr>\\<nu>y\\<rparr>\\<lparr>\\<nu>*yvec'\\<rparr>(FAssert \\<Psi>')\"\n      by simp\n    from \\<open>xvec = x#xvec'\\<close> \\<open>yvec=y#yvec'\\<close> \\<open>xvec \\<sharp>* yvec\\<close>\n    have \"x \\<noteq> y\" and \"xvec' \\<sharp>* yvec'\" and \"x \\<sharp> yvec'\" and \"y \\<sharp> xvec'\"\n      by auto\n    from \\<open>distinct xvec\\<close> \\<open>distinct yvec\\<close> \\<open>xvec=x#xvec'\\<close> \\<open>yvec=y#yvec'\\<close> have \"x \\<sharp> xvec'\" and \"y \\<sharp> yvec'\" and \"distinct xvec'\" and \"distinct yvec'\"\n      by simp+\n    have IH: \"\\<And>xvec yvec \\<Psi> \\<Psi>'. \\<lbrakk>\\<langle>xvec, (\\<Psi>::'a)\\<rangle> = \\<langle>yvec, (\\<Psi>'::'a)\\<rangle>; xvec \\<sharp>* yvec; distinct xvec; distinct yvec; n = length xvec\\<rbrakk> \\<Longrightarrow> \\<exists>p. (set p) \\<subseteq> (set xvec) \\<times> (set yvec) \\<and> distinctPerm p \\<and>  yvec = p \\<bullet> xvec \\<and> \\<Psi>' = p \\<bullet> \\<Psi>\"\n      by fact\n    from EQ \\<open>x \\<noteq> y\\<close>  \\<open>x \\<sharp> yvec'\\<close> \\<open>y \\<sharp> yvec'\\<close> have \"\\<langle>xvec', \\<Psi>\\<rangle> = \\<langle>yvec', ([(x, y)] \\<bullet> \\<Psi>')\\<rangle>\"\n      by(simp add: frame.inject alpha eqvts)\n    with \\<open>xvec' \\<sharp>* yvec'\\<close> \\<open>distinct xvec'\\<close> \\<open>distinct yvec'\\<close> \\<open>length xvec' = n\\<close> IH\n    obtain p where S: \"(set p) \\<subseteq> (set xvec') \\<times> (set yvec')\" and \"distinctPerm p\" and \"yvec' = p \\<bullet> xvec'\" and \"[(x, y)] \\<bullet> \\<Psi>' = p \\<bullet> \\<Psi>\"\n      by metis\n    from S have \"set((x, y)#p) \\<subseteq> set(x#xvec') \\<times> set(y#yvec')\" by auto\n    moreover from \\<open>x \\<sharp> xvec'\\<close> \\<open>x \\<sharp> yvec'\\<close> \\<open>y \\<sharp> xvec'\\<close> \\<open>y \\<sharp> yvec'\\<close> S have \"x \\<sharp> p\" and \"y \\<sharp> p\"\n      apply(induct p)\n      by(auto simp add: name_list_supp) (auto simp add: fresh_def) \n\n    with S \\<open>distinctPerm p\\<close> \\<open>x \\<noteq> y\\<close> have \"distinctPerm((x, y)#p)\" by auto\n    moreover from \\<open>yvec' = p \\<bullet> xvec'\\<close> \\<open>x \\<sharp> p\\<close> \\<open>y \\<sharp> p\\<close> \\<open>x \\<sharp> xvec'\\<close> \\<open>y \\<sharp> xvec'\\<close> have \"(y#yvec') = ((x, y)#p) \\<bullet> (x#xvec')\"\n      by(simp add: freshChainSimps calc_atm)\n    moreover from \\<open>([(x, y)] \\<bullet> \\<Psi>') = p \\<bullet> \\<Psi>\\<close>\n    have \"([(x, y)] \\<bullet> [(x, y)] \\<bullet> \\<Psi>') = [(x, y)] \\<bullet> p \\<bullet> \\<Psi>\"\n      by(simp add: pt_bij)\n    hence \"\\<Psi>' = ((x, y)#p) \\<bullet> \\<Psi>\"\n      by simp\n    ultimately show ?case using \\<open>xvec=x#xvec'\\<close> \\<open>yvec=y#yvec'\\<close>\n      by blast\n  qed\n  ultimately show ?thesis by blast\nqed\n\nlemma frameEq[simp]:\n  fixes A\\<^sub>F :: \"name list\"\n  and   \\<Psi>  :: \"'a::fs_name\"\n  and   \\<Psi>'  :: 'a\n\n  shows \"\\<langle>A\\<^sub>F, \\<Psi>\\<rangle> = \\<langle>\\<epsilon>, \\<Psi>'\\<rangle> = (A\\<^sub>F = [] \\<and> \\<Psi> = \\<Psi>')\"\n  and   \"\\<langle>\\<epsilon>, \\<Psi>'\\<rangle> = \\<langle>A\\<^sub>F, \\<Psi>\\<rangle>  = (A\\<^sub>F = [] \\<and> \\<Psi> = \\<Psi>')\"\nproof -\n  {\n    assume \"\\<langle>A\\<^sub>F, \\<Psi>\\<rangle> = \\<langle>\\<epsilon>, \\<Psi>'\\<rangle>\"\n    hence A: \"\\<langle>A\\<^sub>F, \\<Psi>\\<rangle> = \\<langle>[], \\<Psi>'\\<rangle>\" by simp\n    hence \"length A\\<^sub>F = length ([]::name list)\"\n      by(rule frameChainEqLength)\n    with A have \"A\\<^sub>F = []\" and \"\\<Psi> = \\<Psi>'\" by(auto simp add: frame.inject)\n  }\n  thus \"\\<langle>A\\<^sub>F, \\<Psi>\\<rangle> = \\<langle>\\<epsilon>, \\<Psi>'\\<rangle> = (A\\<^sub>F = [] \\<and> \\<Psi> = \\<Psi>')\"\n  and  \"\\<langle>\\<epsilon>, \\<Psi>'\\<rangle> = \\<langle>A\\<^sub>F, \\<Psi>\\<rangle>  = (A\\<^sub>F = [] \\<and> \\<Psi> = \\<Psi>')\"\n    by auto\nqed\n\nlemma distinctFrame:\n  fixes A\\<^sub>F :: \"name list\"\n  and   \\<Psi>\\<^sub>F :: \"'a::fs_name\"\n  and   C  :: \"'b::fs_name\"\n  \n  assumes \"A\\<^sub>F \\<sharp>* C\"\n\n  obtains A\\<^sub>F' where  \"\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F\\<rangle>\" and \"distinct A\\<^sub>F'\" and \"A\\<^sub>F' \\<sharp>* C\"\nproof -\n  assume \"\\<And>A\\<^sub>F'. \\<lbrakk>\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F\\<rangle>; distinct A\\<^sub>F'; A\\<^sub>F' \\<sharp>* C\\<rbrakk> \\<Longrightarrow> thesis\"\n  moreover from assms have \"\\<exists>A\\<^sub>F'. \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F\\<rangle> \\<and> distinct A\\<^sub>F' \\<and> A\\<^sub>F' \\<sharp>* C\"\n  proof(induct A\\<^sub>F)\n    case Nil\n    thus ?case by simp\n  next\n    case(Cons a A\\<^sub>F)\n    then obtain A\\<^sub>F' where Eq: \"\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F\\<rangle>\" and \"distinct A\\<^sub>F'\" and \"A\\<^sub>F' \\<sharp>* C\" by force\n    from \\<open>(a#A\\<^sub>F) \\<sharp>* C\\<close> have \"a \\<sharp> C\" and \"A\\<^sub>F \\<sharp>* C\" by simp+\n    show ?case\n    proof(case_tac \"a \\<sharp> \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F\\<rangle>\")\n      assume \"a \\<sharp> \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F\\<rangle>\"\n      obtain b::name where \"b \\<sharp> A\\<^sub>F'\" and \"b \\<sharp> \\<Psi>\\<^sub>F\" and \"b \\<sharp> C\" by(generate_fresh \"name\", auto)\n      have \"\\<langle>(a#A\\<^sub>F), \\<Psi>\\<^sub>F\\<rangle> = \\<langle>(b#A\\<^sub>F'), \\<Psi>\\<^sub>F\\<rangle>\"\n      proof -\n        from Eq have \"\\<langle>(a#A\\<^sub>F), \\<Psi>\\<^sub>F\\<rangle> = \\<langle>(a#A\\<^sub>F'), \\<Psi>\\<^sub>F\\<rangle>\" by(simp add: frame.inject)\n        moreover from \\<open>b \\<sharp> \\<Psi>\\<^sub>F\\<close> have \"\\<dots> = \\<lparr>\\<nu>b\\<rparr>([(a, b)] \\<bullet> \\<lparr>\\<nu>*A\\<^sub>F'\\<rparr>(FAssert \\<Psi>\\<^sub>F))\"\n          by(force intro: alphaFrameRes simp add: frameResChainFresh)\n        ultimately show ?thesis using \\<open>a \\<sharp> \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F\\<rangle>\\<close> \\<open>b \\<sharp> \\<Psi>\\<^sub>F\\<close>\n          by(simp add: frameResChainFresh)\n      qed\n      moreover from \\<open>distinct A\\<^sub>F'\\<close> \\<open>b \\<sharp> A\\<^sub>F'\\<close> have \"distinct(b#A\\<^sub>F')\" by simp\n      moreover from \\<open>A\\<^sub>F' \\<sharp>* C\\<close> \\<open>b \\<sharp> C\\<close> have \"(b#A\\<^sub>F') \\<sharp>* C\" by simp+\n      ultimately show ?case by blast\n    next\n      from Eq have \"\\<langle>(a#A\\<^sub>F), \\<Psi>\\<^sub>F\\<rangle> = \\<langle>(a#A\\<^sub>F'), \\<Psi>\\<^sub>F\\<rangle>\" by(simp add: frame.inject)\n      moreover assume \"\\<not>(a \\<sharp> \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F\\<rangle>)\"\n      hence \"a \\<sharp> A\\<^sub>F'\" apply(simp add: fresh_def)\n        by(induct A\\<^sub>F') (auto simp add: supp_list_nil supp_list_cons supp_atm frame.supp abs_supp)\n      with \\<open>distinct A\\<^sub>F'\\<close> have \"distinct(a#A\\<^sub>F')\" by simp\n      moreover from \\<open>A\\<^sub>F' \\<sharp>* C\\<close> \\<open>a \\<sharp> C\\<close> have \"(a#A\\<^sub>F') \\<sharp>* C\" by simp+\n      ultimately show ?case by blast\n    qed\n  qed\n  ultimately show ?thesis using \\<open>A\\<^sub>F \\<sharp>* C\\<close>\n    by blast\nqed\n\nlemma freshFrame:\n  fixes F  :: \"('a::fs_name) frame\"\n  and   C  :: \"'b ::fs_name\"\n\n  obtains A\\<^sub>F \\<Psi>\\<^sub>F where \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"distinct A\\<^sub>F\" and \"A\\<^sub>F \\<sharp>* C\"\nproof -\n  assume \"\\<And>A\\<^sub>F \\<Psi>\\<^sub>F. \\<lbrakk>F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>; distinct A\\<^sub>F; A\\<^sub>F \\<sharp>* C\\<rbrakk> \\<Longrightarrow> thesis\"\n  moreover have \"\\<exists>A\\<^sub>F \\<Psi>\\<^sub>F. F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> \\<and> A\\<^sub>F \\<sharp>* C\"\n  proof(nominal_induct F avoiding: C rule: frame.strong_induct)\n    case(FAssert \\<Psi>\\<^sub>F)\n    have \"FAssert \\<Psi>\\<^sub>F = \\<langle>[], \\<Psi>\\<^sub>F\\<rangle>\" by simp\n    moreover have \"([]::name list) \\<sharp>* C\" by simp\n    ultimately show ?case by force\n  next\n    case(FRes a F)\n    from \\<open>\\<And>C. \\<exists>A\\<^sub>F \\<Psi>\\<^sub>F. F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> \\<and> A\\<^sub>F \\<sharp>* C\\<close>\n    obtain A\\<^sub>F \\<Psi>\\<^sub>F  where \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"A\\<^sub>F \\<sharp>* C\"\n      by blast\n    with \\<open>a \\<sharp> C\\<close> have \"\\<lparr>\\<nu>a\\<rparr>F = \\<lparr>\\<nu>*(a#A\\<^sub>F)\\<rparr>(FAssert \\<Psi>\\<^sub>F)\" and \"(a#A\\<^sub>F) \\<sharp>* C\"\n      by simp+\n    thus ?case by blast\n  qed\n  ultimately show ?thesis\n    by(auto, rule_tac distinctFrame) auto\nqed\n\nlocale assertionAux = \n  fixes SCompose :: \"'b::fs_name \\<Rightarrow> 'b \\<Rightarrow> 'b\"   (infixr \"\\<otimes>\" 80)\n  and   SImp     :: \"'b \\<Rightarrow> 'c::fs_name \\<Rightarrow> bool\" (\"_ \\<turnstile> _\" [70, 70] 70)\n  and   SBottom  :: 'b                         (\"\\<bottom>\" 90) \n  and   SChanEq  :: \"'a::fs_name \\<Rightarrow> 'a \\<Rightarrow> 'c\"   (\"_ \\<leftrightarrow> _\" [80, 80] 80)\n\n  assumes statEqvt[eqvt]:   \"\\<And>p::name prm. p \\<bullet> (\\<Psi> \\<turnstile> \\<Phi>) = (p \\<bullet> \\<Psi>) \\<turnstile> (p \\<bullet> \\<Phi>)\"\n  and     statEqvt'[eqvt]:  \"\\<And>p::name prm. p \\<bullet> (\\<Psi> \\<otimes> \\<Psi>') = (p \\<bullet> \\<Psi>) \\<otimes> (p \\<bullet> \\<Psi>')\" \n  and     statEqvt''[eqvt]: \"\\<And>p::name prm. p \\<bullet> (M \\<leftrightarrow> N) = (p \\<bullet> M) \\<leftrightarrow> (p \\<bullet> N)\"\n  and     permBottom[eqvt]: \"\\<And>p::name prm. (p \\<bullet> SBottom) = SBottom\"\n\nbegin\n\nlemma statClosed:\n  fixes \\<Psi> :: 'b\n  and   \\<phi> :: 'c\n  and   p :: \"name prm\"\n  \n  assumes \"\\<Psi> \\<turnstile> \\<phi>\"\n\n  shows \"(p \\<bullet> \\<Psi>) \\<turnstile> (p \\<bullet> \\<phi>)\"\nusing assms statEqvt\nby(simp add: perm_bool)\n\nlemma compSupp:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n\n  shows \"(supp(\\<Psi> \\<otimes> \\<Psi>')::name set) \\<subseteq> ((supp \\<Psi>) \\<union> (supp \\<Psi>'))\"\nproof(auto simp add: eqvts supp_def)\n  fix x::name\n  let ?P = \"\\<lambda>y. ([(x, y)] \\<bullet> \\<Psi>) \\<otimes> [(x, y)] \\<bullet> \\<Psi>' \\<noteq> \\<Psi> \\<otimes> \\<Psi>'\"\n  let ?Q = \"\\<lambda>y \\<Psi>. ([(x, y)] \\<bullet> \\<Psi>) \\<noteq> \\<Psi>\"\n  assume \"finite {y. ?Q y \\<Psi>'}\"\n  moreover assume \"finite {y. ?Q y \\<Psi>}\" and \"infinite {y. ?P(y)}\"\n  hence \"infinite({y. ?P(y)} - {y. ?Q y \\<Psi>})\" by(rule Diff_infinite_finite)\n  ultimately have \"infinite(({y. ?P(y)} - {y. ?Q y \\<Psi>}) - {y. ?Q y \\<Psi>'})\" by(rule Diff_infinite_finite)\n  hence \"infinite({y. ?P(y) \\<and> \\<not>(?Q y \\<Psi>) \\<and> \\<not> (?Q y \\<Psi>')})\" by(simp add: set_diff_eq)\n  moreover have \"{y. ?P(y) \\<and> \\<not>(?Q y \\<Psi>) \\<and> \\<not> (?Q y \\<Psi>')} = {}\" by auto\n  ultimately have \"infinite {}\" by(drule_tac Infinite_cong) auto\n  thus False by simp\nqed\n\n\n\n  shows \"(supp(M \\<leftrightarrow> N)::name set) \\<subseteq> ((supp M) \\<union> (supp N))\"\nproof(auto simp add: eqvts supp_def)\n  fix x::name\n  let ?P = \"\\<lambda>y. ([(x, y)] \\<bullet> M) \\<leftrightarrow> [(x, y)] \\<bullet> N \\<noteq> M \\<leftrightarrow> N\"\n  let ?Q = \"\\<lambda>y M. ([(x, y)] \\<bullet> M) \\<noteq> M\"\n  assume \"finite {y. ?Q y N}\"\n  moreover assume \"finite {y. ?Q y M}\" and \"infinite {y. ?P(y)}\"\n  hence \"infinite({y. ?P(y)} - {y. ?Q y M})\" by(rule Diff_infinite_finite)\n  ultimately have \"infinite(({y. ?P(y)} - {y. ?Q y M}) - {y. ?Q y N})\" by(rule Diff_infinite_finite)\n  hence \"infinite({y. ?P(y) \\<and> \\<not>(?Q y M) \\<and> \\<not> (?Q y N)})\" by(simp add: set_diff_eq)\n  moreover have \"{y. ?P(y) \\<and> \\<not>(?Q y M) \\<and> \\<not> (?Q y N)} = {}\" by auto\n  ultimately have \"infinite {}\" by(drule_tac Infinite_cong) auto\n  thus False by simp\nqed\n\nlemma freshComp[intro]:\n  fixes x  :: name\n  and   \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> \\<Psi>'\"\n\n  shows \"x \\<sharp> \\<Psi> \\<otimes> \\<Psi>'\"\nusing assms compSupp\nby(auto simp add: fresh_def)\n\nlemma freshCompChain[intro]:\n  fixes xvec  :: \"name list\"\n  and   Xs    :: \"name set\"\n  and   \\<Psi>     :: 'b\n  and   \\<Psi>'    :: 'b\n\n  shows \"\\<lbrakk>xvec \\<sharp>* \\<Psi>; xvec \\<sharp>* \\<Psi>'\\<rbrakk> \\<Longrightarrow> xvec \\<sharp>* (\\<Psi> \\<otimes> \\<Psi>')\"\n  and   \"\\<lbrakk>Xs \\<sharp>* \\<Psi>; Xs \\<sharp>* \\<Psi>'\\<rbrakk> \\<Longrightarrow> Xs \\<sharp>* (\\<Psi> \\<otimes> \\<Psi>')\"\nby(auto simp add: fresh_star_def)\n\nlemma freshChanEq[intro]:\n  fixes x :: name\n  and   M :: 'a\n  and   N :: 'a\n\n  assumes \"x \\<sharp> M\"\n  and     \"x \\<sharp> N\"\n\n  shows \"x \\<sharp> M \\<leftrightarrow> N\"\nusing assms chanEqSupp\nby(auto simp add: fresh_def)\n\nlemma freshChanEqChain[intro]:\n  fixes xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n  and   M    :: 'a\n  and   N    :: 'a\n\n  shows \"\\<lbrakk>xvec \\<sharp>* M; xvec \\<sharp>* N\\<rbrakk> \\<Longrightarrow> xvec \\<sharp>* (M \\<leftrightarrow> N)\"\n  and   \"\\<lbrakk>Xs \\<sharp>* M; Xs \\<sharp>* N\\<rbrakk> \\<Longrightarrow> Xs \\<sharp>* (M \\<leftrightarrow> N)\"\nby(auto simp add: fresh_star_def)\n\nlemma suppBottom[simp]:\n  shows \"((supp SBottom)::name set) = {}\"\nby(auto simp add: supp_def permBottom)\n\n\n\nlemma freshBottoChain[simp]:\n  fixes xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n\n  shows \"xvec \\<sharp>* (\\<bottom>)\"\n  and   \"Xs   \\<sharp>* (\\<bottom>)\"\nby(auto simp add: fresh_star_def)\n\nlemma chanEqClosed:\n  fixes \\<Psi> :: 'b\n  and   M :: 'a\n  and   N :: 'a\n  and   p :: \"name prm\"\n \n  assumes \"\\<Psi> \\<turnstile> M \\<leftrightarrow> N\"\n\n  shows \"(p \\<bullet> \\<Psi>) \\<turnstile> (p \\<bullet> M) \\<leftrightarrow> (p \\<bullet> N)\"\nproof -\n  from \\<open>\\<Psi> \\<turnstile> M \\<leftrightarrow> N\\<close> have \"(p \\<bullet> \\<Psi>) \\<turnstile> p \\<bullet> (M \\<leftrightarrow> N)\"\n    by(rule statClosed)\n  thus ?thesis by(simp add: eqvts)\nqed\n\ndefinition\n  AssertionStatImp :: \"'b \\<Rightarrow> 'b \\<Rightarrow> bool\" (infix \"\\<hookrightarrow>\" 70)\n  where \"(\\<Psi> \\<hookrightarrow> \\<Psi>') \\<equiv> (\\<forall>\\<Phi>. \\<Psi> \\<turnstile> \\<Phi> \\<longrightarrow> \\<Psi>' \\<turnstile> \\<Phi>)\"\n\ndefinition\n  AssertionStatEq :: \"'b \\<Rightarrow> 'b \\<Rightarrow> bool\" (infix \"\\<simeq>\" 70)\n  where \"(\\<Psi> \\<simeq> \\<Psi>') \\<equiv> \\<Psi> \\<hookrightarrow> \\<Psi>' \\<and> \\<Psi>' \\<hookrightarrow> \\<Psi>\"\n\nlemma statImpEnt:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n  and   \\<Phi>  :: 'c\n\n  assumes \"\\<Psi> \\<hookrightarrow> \\<Psi>'\"\n  and     \"\\<Psi> \\<turnstile> \\<Phi>\"\n\n  shows \"\\<Psi>' \\<turnstile> \\<Phi>\"\nusing assms\nby(simp add: AssertionStatImp_def)\n\nlemma statEqEnt:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n  and   \\<Phi>  :: 'c\n\n  assumes \"\\<Psi> \\<simeq> \\<Psi>'\"\n  and     \"\\<Psi> \\<turnstile> \\<Phi>\"\n\n  shows \"\\<Psi>' \\<turnstile> \\<Phi>\"\nusing assms\nby(auto simp add: AssertionStatEq_def intro: statImpEnt)\n\nlemma AssertionStatImpClosed:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n  and   p  :: \"name prm\"\n\n  assumes \"\\<Psi> \\<hookrightarrow> \\<Psi>'\"\n\n  shows \"(p \\<bullet> \\<Psi>) \\<hookrightarrow> (p \\<bullet> \\<Psi>')\"\nproof(auto simp add: AssertionStatImp_def)\n  fix \\<phi>\n  assume \"(p \\<bullet> \\<Psi>) \\<turnstile> \\<phi>\"\n  hence \"\\<Psi> \\<turnstile> rev p \\<bullet> \\<phi>\" by(drule_tac p=\"rev p\" in statClosed) auto\n  with \\<open>\\<Psi> \\<hookrightarrow> \\<Psi>'\\<close> have \"\\<Psi>' \\<turnstile> rev p \\<bullet> \\<phi>\" by(simp add: AssertionStatImp_def)\n  thus \"(p \\<bullet> \\<Psi>') \\<turnstile> \\<phi>\" by(drule_tac p=p in statClosed) auto\nqed\n\nlemma AssertionStatEqClosed:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n  and   p  :: \"name prm\"\n\n  assumes \"\\<Psi> \\<simeq> \\<Psi>'\"\n\n  shows \"(p \\<bullet> \\<Psi>) \\<simeq> (p \\<bullet> \\<Psi>')\"\nusing assms\nby(auto simp add: AssertionStatEq_def intro: AssertionStatImpClosed)\n\nlemma AssertionStatImpEqvt[eqvt]:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n  and   p  :: \"name prm\"\n\n  shows \"(p \\<bullet> (\\<Psi> \\<hookrightarrow> \\<Psi>')) = ((p \\<bullet> \\<Psi>) \\<hookrightarrow> (p \\<bullet> \\<Psi>'))\"\nby(simp add: AssertionStatImp_def eqvts)\n\nlemma AssertionStatEqEqvt[eqvt]:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n  and   p  :: \"name prm\"\n\n  shows \"(p \\<bullet> (\\<Psi> \\<simeq> \\<Psi>')) = ((p \\<bullet> \\<Psi>) \\<simeq> (p \\<bullet> \\<Psi>'))\"\nby(simp add: AssertionStatEq_def eqvts)\n\nlemma AssertionStatImpRefl[simp]:\n  fixes \\<Psi> :: 'b\n\n  shows \"\\<Psi> \\<hookrightarrow> \\<Psi>\"\nby(simp add: AssertionStatImp_def)\n\nlemma AssertionStatEqRefl[simp]:\n  fixes \\<Psi> :: 'b\n\n  shows \"\\<Psi> \\<simeq> \\<Psi>\"\nby(simp add: AssertionStatEq_def)\n\nlemma AssertionStatEqSym:\n  fixes \\<Psi>   :: 'b\n  and   \\<Psi>'  :: 'b\n\n  assumes \"\\<Psi> \\<simeq> \\<Psi>'\"\n\n  shows \"\\<Psi>' \\<simeq> \\<Psi>\"\nusing assms\nby(auto simp add: AssertionStatEq_def)\n\nlemma AssertionStatImpTrans:\n  fixes \\<Psi>   :: 'b\n  and   \\<Psi>'  :: 'b\n  and   \\<Psi>'' :: 'b\n\n  assumes \"\\<Psi> \\<hookrightarrow> \\<Psi>'\"\n  and     \"\\<Psi>' \\<hookrightarrow> \\<Psi>''\"\n\n  shows \"\\<Psi> \\<hookrightarrow> \\<Psi>''\"\nusing assms\nby(simp add: AssertionStatImp_def)\n\nlemma AssertionStatEqTrans:\n  fixes \\<Psi>   :: 'b\n  and   \\<Psi>'  :: 'b\n  and   \\<Psi>'' :: 'b\n\n  assumes \"\\<Psi> \\<simeq> \\<Psi>'\"\n  and     \"\\<Psi>' \\<simeq> \\<Psi>''\"\n\n  shows \"\\<Psi> \\<simeq> \\<Psi>''\"\nusing assms\nby(auto simp add: AssertionStatEq_def intro: AssertionStatImpTrans)\n\ndefinition \n  FrameImp :: \"'b::fs_name frame \\<Rightarrow> 'c \\<Rightarrow> bool\"   (infixl \"\\<turnstile>\\<^sub>F\" 70)\n  where \"(F \\<turnstile>\\<^sub>F \\<Phi>) = (\\<exists>A\\<^sub>F \\<Psi>\\<^sub>F. F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> \\<and> A\\<^sub>F \\<sharp>* \\<Phi> \\<and> (\\<Psi>\\<^sub>F \\<turnstile> \\<Phi>))\"\n\nlemma frameImpI:\n  fixes F  :: \"'b frame\"\n  and   \\<phi>  :: 'c\n  and   A\\<^sub>F :: \"name list\"\n  and   \\<Psi>\\<^sub>F :: 'b\n\n  assumes \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\"\n  and     \"A\\<^sub>F \\<sharp>* \\<phi>\"\n  and     \"\\<Psi>\\<^sub>F \\<turnstile> \\<phi>\"\n\n  shows \"F \\<turnstile>\\<^sub>F \\<phi>\"\nusing assms\nby(force simp add: FrameImp_def)\n\nlemma frameImpAlphaEnt:\n  fixes A\\<^sub>F  :: \"name list\"\n  and   \\<Psi>\\<^sub>F  :: 'b\n  and   A\\<^sub>F' :: \"name list\"\n  and   \\<Psi>\\<^sub>F' :: 'b\n  and   \\<phi>   :: 'c\n\n  assumes \"\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F'\\<rangle>\" \n  and     \"A\\<^sub>F \\<sharp>* \\<phi>\"\n  and     \"A\\<^sub>F' \\<sharp>* \\<phi>\"\n  and     \"\\<Psi>\\<^sub>F' \\<turnstile> \\<phi>\"\n\n  shows \"\\<Psi>\\<^sub>F \\<turnstile> \\<phi>\"\nproof -\n  from \\<open>\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F'\\<rangle>\\<close>\n  obtain n where \"n = length A\\<^sub>F\" by blast\n  moreover from \\<open>\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F'\\<rangle>\\<close>\n  have \"length A\\<^sub>F = length A\\<^sub>F'\"\n    by(rule frameChainEqLength)\n  ultimately show ?thesis using assms\n  proof(induct n arbitrary: A\\<^sub>F A\\<^sub>F' \\<Psi>\\<^sub>F' rule: nat.induct)\n    case(zero A\\<^sub>F A\\<^sub>F' \\<Psi>\\<^sub>F')\n    thus ?case by(auto simp add: frame.inject)\n  next\n    case(Suc n A\\<^sub>F A\\<^sub>F' \\<Psi>\\<^sub>F')\n    from \\<open>Suc n = length A\\<^sub>F\\<close>\n    obtain x xs where \"A\\<^sub>F = x#xs\" and \"n = length xs\"\n      by(case_tac A\\<^sub>F) auto\n    from \\<open>\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F'\\<rangle>\\<close> \\<open>A\\<^sub>F = x # xs\\<close>\n    obtain y ys where \"\\<langle>(x#xs), \\<Psi>\\<^sub>F\\<rangle> = \\<langle>(y#ys), \\<Psi>\\<^sub>F'\\<rangle>\" and \"A\\<^sub>F' = y#ys\"\n      by(case_tac A\\<^sub>F') auto\n    hence EQ: \"\\<lparr>\\<nu>x\\<rparr>\\<lparr>\\<nu>*xs\\<rparr>(FAssert \\<Psi>\\<^sub>F) = \\<lparr>\\<nu>y\\<rparr>\\<lparr>\\<nu>*ys\\<rparr>(FAssert \\<Psi>\\<^sub>F')\"\n      by simp\n    from \\<open>A\\<^sub>F = x # xs\\<close> \\<open>A\\<^sub>F' = y # ys\\<close> \\<open>length A\\<^sub>F = length A\\<^sub>F'\\<close> \\<open>A\\<^sub>F \\<sharp>* \\<phi>\\<close> \\<open>A\\<^sub>F' \\<sharp>* \\<phi>\\<close>\n    have \"length xs = length ys\" and \"xs \\<sharp>* \\<phi>\" and \"ys \\<sharp>* \\<phi>\" and \"x \\<sharp> \\<phi>\" and \"y \\<sharp> \\<phi>\" \n      by auto\n    \n    have IH: \"\\<And>xs ys \\<Psi>\\<^sub>F'. \\<lbrakk>n = length xs; length xs = length ys; \\<langle>xs, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>ys, (\\<Psi>\\<^sub>F'::'b)\\<rangle>; xs \\<sharp>* \\<phi>; ys \\<sharp>* \\<phi>; \\<Psi>\\<^sub>F' \\<turnstile> \\<phi>\\<rbrakk> \\<Longrightarrow> \\<Psi>\\<^sub>F \\<turnstile> \\<phi>\"\n      by fact\n    show ?case\n    proof(case_tac \"x = y\")\n      assume \"x = y\"\n      with EQ have \"\\<langle>xs, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>ys, \\<Psi>\\<^sub>F'\\<rangle>\" by(simp add: alpha frame.inject)\n      with IH \\<open>n = length xs\\<close> \\<open>length xs = length ys\\<close> \\<open>xs \\<sharp>* \\<phi>\\<close>  \\<open>ys \\<sharp>* \\<phi>\\<close> \\<open>\\<Psi>\\<^sub>F' \\<turnstile> \\<phi>\\<close>\n      show ?case by blast\n    next\n      assume \"x \\<noteq> y\"\n      with EQ have \"\\<langle>xs, \\<Psi>\\<^sub>F\\<rangle> = [(x, y)] \\<bullet> \\<langle>ys, \\<Psi>\\<^sub>F'\\<rangle>\" by(simp add: alpha frame.inject)\n      hence \"\\<langle>xs, \\<Psi>\\<^sub>F\\<rangle> = \\<langle>([(x, y)] \\<bullet> ys), ([(x, y)] \\<bullet> \\<Psi>\\<^sub>F')\\<rangle>\" by(simp add: eqvts)\n      moreover from \\<open>length xs = length ys\\<close> have \"length xs = length([(x, y)] \\<bullet> ys)\"\n        by auto\n      moreover from \\<open>ys \\<sharp>* \\<phi>\\<close> have \"([(x, y)] \\<bullet> ys) \\<sharp>* ([(x, y)] \\<bullet> \\<phi>)\"\n        by(simp add: fresh_star_bij)\n      with \\<open>x \\<sharp> \\<phi>\\<close> \\<open>y \\<sharp> \\<phi>\\<close> have \"([(x, y)] \\<bullet> ys) \\<sharp>* \\<phi>\"\n        by simp\n      moreover with \\<open>\\<Psi>\\<^sub>F' \\<turnstile> \\<phi>\\<close> have \"([(x, y)] \\<bullet> \\<Psi>\\<^sub>F') \\<turnstile> ([(x, y)] \\<bullet> \\<phi>)\"\n        by(simp add: statClosed)\n      with \\<open>x \\<sharp> \\<phi>\\<close> \\<open>y \\<sharp> \\<phi>\\<close> have \"([(x, y)] \\<bullet> \\<Psi>\\<^sub>F') \\<turnstile> \\<phi>\"\n        by simp\n      ultimately show ?case using IH \\<open>n = length xs\\<close> \\<open>xs \\<sharp>* \\<phi>\\<close>\n        by blast\n    qed\n  qed\nqed\n\nlemma frameImpEAux:\n  fixes F  :: \"'b frame\"\n  and   \\<Phi>  :: 'c\n\n  assumes  \"F \\<turnstile>\\<^sub>F \\<Phi>\"\n  and      \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\"\n  and      \"A\\<^sub>F \\<sharp>* \\<Phi>\"\n  \n  shows \"\\<Psi>\\<^sub>F \\<turnstile> \\<Phi>\"\nusing assms\nby(auto simp add: FrameImp_def dest: frameImpAlphaEnt)\n\nlemma frameImpE:\n  fixes F  :: \"'b frame\"\n  and   \\<Phi>  :: 'c\n\n  assumes  \"\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> \\<turnstile>\\<^sub>F \\<Phi>\"\n  and      \"A\\<^sub>F \\<sharp>* \\<Phi>\"\n  \n  shows \"\\<Psi>\\<^sub>F \\<turnstile> \\<Phi>\"\nusing assms\nby(auto elim: frameImpEAux)\n\nlemma frameImpClosed:\n  fixes F :: \"'b frame\"\n  and   \\<Phi> :: 'c\n  and   p :: \"name prm\"\n\n  assumes \"F \\<turnstile>\\<^sub>F \\<Phi>\"\n\n  shows \"(p \\<bullet> F) \\<turnstile>\\<^sub>F (p \\<bullet> \\<Phi>)\"\nusing assms\nby(force simp add: FrameImp_def eqvts pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst]\n         intro: statClosed)\n\nlemma frameImpEqvt[eqvt]:\n  fixes F :: \"'b frame\"\n  and   \\<Phi> :: 'c\n  and   p :: \"name prm\"\n\n  shows \"(p \\<bullet> (F \\<turnstile>\\<^sub>F \\<Phi>)) = (p \\<bullet> F) \\<turnstile>\\<^sub>F (p \\<bullet> \\<Phi>)\"\nproof -\n  have \"F \\<turnstile>\\<^sub>F \\<Phi> \\<Longrightarrow> (p \\<bullet> F) \\<turnstile>\\<^sub>F (p \\<bullet> \\<Phi>)\"\n    by(rule frameImpClosed)\n  moreover have \"(p \\<bullet> F) \\<turnstile>\\<^sub>F (p \\<bullet> \\<Phi>) \\<Longrightarrow> F \\<turnstile>\\<^sub>F \\<Phi>\"\n    by(drule_tac p = \"rev p\" in frameImpClosed) simp\n  ultimately show ?thesis\n    by(auto simp add: perm_bool)\nqed\n\nlemma frameImpEmpty[simp]:\n  fixes \\<Psi> :: 'b\n  and   \\<phi> :: 'c\n\n  shows \"\\<langle>\\<epsilon>, \\<Psi>\\<rangle> \\<turnstile>\\<^sub>F \\<phi> = \\<Psi> \\<turnstile> \\<phi>\" \nby(auto simp add: FrameImp_def)\n\ndefinition\n  FrameStatImp :: \"'b frame \\<Rightarrow> 'b frame\\<Rightarrow> bool\" (infix \"\\<hookrightarrow>\\<^sub>F\" 70)\n  where \"(F \\<hookrightarrow>\\<^sub>F G) \\<equiv> (\\<forall>\\<phi>. F \\<turnstile>\\<^sub>F \\<phi> \\<longrightarrow> G \\<turnstile>\\<^sub>F \\<phi>)\"\n\ndefinition\n  FrameStatEq :: \"'b frame \\<Rightarrow> 'b frame\\<Rightarrow> bool\" (infix \"\\<simeq>\\<^sub>F\" 70)\n  where \"(F \\<simeq>\\<^sub>F G) \\<equiv> F \\<hookrightarrow>\\<^sub>F G \\<and> G \\<hookrightarrow>\\<^sub>F F\"\n\nlemma FrameStatImpClosed:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\"\n  and   p :: \"name prm\"\n\n  assumes \"F \\<hookrightarrow>\\<^sub>F G\"\n\n  shows \"(p \\<bullet> F) \\<hookrightarrow>\\<^sub>F (p \\<bullet> G)\"\nproof(auto simp add: FrameStatImp_def)\n  fix \\<phi>\n  assume \"(p \\<bullet> F) \\<turnstile>\\<^sub>F \\<phi>\"\n  hence \"F \\<turnstile>\\<^sub>F rev p \\<bullet> \\<phi>\" by(drule_tac p=\"rev p\" in frameImpClosed) auto\n  with \\<open>F \\<hookrightarrow>\\<^sub>F G\\<close> have \"G \\<turnstile>\\<^sub>F rev p \\<bullet> \\<phi>\" by(simp add: FrameStatImp_def)\n  thus \"(p \\<bullet> G) \\<turnstile>\\<^sub>F \\<phi>\" by(drule_tac p=p in frameImpClosed) auto\nqed\n\nlemma FrameStatEqClosed:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\"\n  and   p :: \"name prm\"\n\n  assumes \"F \\<simeq>\\<^sub>F G\"\n\n  shows \"(p \\<bullet> F) \\<simeq>\\<^sub>F (p \\<bullet> G)\"\nusing assms\nby(auto simp add: FrameStatEq_def intro: FrameStatImpClosed)\n\nlemma FrameStatImpEqvt[eqvt]:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\"\n  and   p :: \"name prm\"\n\n  shows \"(p \\<bullet> (F \\<hookrightarrow>\\<^sub>F G)) = ((p \\<bullet> F) \\<hookrightarrow>\\<^sub>F (p \\<bullet> G))\"\nby(simp add: FrameStatImp_def eqvts)\n\nlemma FrameStatEqEqvt[eqvt]:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\"\n  and   p :: \"name prm\"\n\n  shows \"(p \\<bullet> (F \\<simeq>\\<^sub>F G)) = ((p \\<bullet> F) \\<simeq>\\<^sub>F (p \\<bullet> G))\"\nby(simp add: FrameStatEq_def eqvts)\n\nlemma FrameStatImpRefl[simp]:\n  fixes F :: \"'b frame\"\n\n  shows \"F \\<hookrightarrow>\\<^sub>F F\"\nby(simp add: FrameStatImp_def)\n\nlemma FrameStatEqRefl[simp]:\n  fixes F :: \"'b frame\"\n\n  shows \"F \\<simeq>\\<^sub>F F\"\nby(simp add: FrameStatEq_def)\n\nlemma FrameStatEqSym:\n  fixes F  :: \"'b frame\"\n  and   G  :: \"'b frame\"\n\n  assumes \"F \\<simeq>\\<^sub>F G\"\n\n  shows \"G \\<simeq>\\<^sub>F F\"\nusing assms\nby(auto simp add: FrameStatEq_def)\n\nlemma FrameStatImpTrans:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\" \n  and   H :: \"'b frame\"\n\n  assumes \"F \\<hookrightarrow>\\<^sub>F G\"\n  and     \"G \\<hookrightarrow>\\<^sub>F H\"\n\n  shows \"F \\<hookrightarrow>\\<^sub>F H\"\nusing assms\nby(simp add: FrameStatImp_def)\n\nlemma FrameStatEqTrans:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\"\n  and   H :: \"'b frame\"\n\n  assumes \"F \\<simeq>\\<^sub>F G\"\n  and     \"G \\<simeq>\\<^sub>F H\"\n\n  shows \"F \\<simeq>\\<^sub>F H\"\nusing assms\nby(auto simp add: FrameStatEq_def intro: FrameStatImpTrans)\n\nlemma fsCompose[simp]: \"finite((supp SCompose)::name set)\"\nby(simp add: supp_def perm_fun_def eqvts)\n\nnominal_primrec \n   insertAssertion :: \"'b frame \\<Rightarrow> 'b \\<Rightarrow> 'b frame\"\nwhere\n  \"insertAssertion (FAssert \\<Psi>) \\<Psi>' = FAssert (\\<Psi>' \\<otimes> \\<Psi>)\"\n| \"x \\<sharp> \\<Psi>' \\<Longrightarrow> insertAssertion (\\<lparr>\\<nu>x\\<rparr>F) \\<Psi>' = \\<lparr>\\<nu>x\\<rparr>(insertAssertion F \\<Psi>')\"\napply(finite_guess add: fsCompose)+\napply(rule TrueI)+\napply(simp add: abs_fresh)\napply(rule supports_fresh[of \"supp \\<Psi>'\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\ndone\n\nlemma insertAssertionEqvt[eqvt]:\n  fixes p :: \"name prm\"\n  and   F :: \"'b frame\"\n  and   \\<Psi> :: 'b\n\n  shows \"p \\<bullet> (insertAssertion F \\<Psi>) = insertAssertion (p \\<bullet> F) (p \\<bullet> \\<Psi>)\"\nby(nominal_induct F avoiding: p \\<Psi> rule: frame.strong_induct)\n  (auto simp add: at_prm_fresh[OF at_name_inst] \n                  pt_fresh_perm_app[OF pt_name_inst, OF at_name_inst] eqvts)\n\n\nnominal_primrec \n   mergeFrame :: \"'b frame \\<Rightarrow> 'b frame \\<Rightarrow> 'b frame\"\nwhere\n  \"mergeFrame (FAssert \\<Psi>) G = insertAssertion G \\<Psi>\"\n| \"x \\<sharp> G \\<Longrightarrow> mergeFrame (\\<lparr>\\<nu>x\\<rparr>F) G = \\<lparr>\\<nu>x\\<rparr>(mergeFrame F G)\"\napply(finite_guess add: fsCompose)+\napply(rule TrueI)+\napply(simp add: abs_fresh)\napply(simp add: fs_name1)\napply(rule supports_fresh[of \"supp G\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess)+\ndone\n\nnotation mergeFrame (infixr \"\\<otimes>\\<^sub>F\" 80)\n\nabbreviation\n  frameBottomJudge (\"\\<bottom>\\<^sub>F\") where \"\\<bottom>\\<^sub>F \\<equiv> (FAssert SBottom)\"\n\nlemma mergeFrameEqvt[eqvt]:\n  fixes p :: \"name prm\"\n  and   F :: \"'b frame\"\n  and   G :: \"'b frame\"\n\n  shows \"p \\<bullet> (mergeFrame F G) = mergeFrame (p \\<bullet> F) (p \\<bullet> G)\"\nby(nominal_induct F avoiding: p G rule: frame.strong_induct)\n  (auto simp add: at_prm_fresh[OF at_name_inst] \n                  pt_fresh_perm_app[OF pt_name_inst, OF at_name_inst] eqvts)\n\nnominal_primrec\n    extractFrame   :: \"('a, 'b, 'c) psi \\<Rightarrow> 'b frame\"\nand extractFrame'  :: \"('a, 'b, 'c) input \\<Rightarrow> 'b frame\"\nand extractFrame'' :: \"('a, 'b, 'c) psiCase \\<Rightarrow> 'b frame\"\n\nwhere\n  \"extractFrame (\\<zero>) =  \\<langle>\\<epsilon>, \\<bottom>\\<rangle>\"\n| \"extractFrame (M\\<lparr>I) = \\<langle>\\<epsilon>, \\<bottom>\\<rangle>\"\n| \"extractFrame (M\\<langle>N\\<rangle>.P) = \\<langle>\\<epsilon>, \\<bottom>\\<rangle>\"\n| \"extractFrame (Case C) = \\<langle>\\<epsilon>, \\<bottom>\\<rangle>\"\n| \"extractFrame (P \\<parallel> Q) = (extractFrame P) \\<otimes>\\<^sub>F (extractFrame Q)\"\n| \"extractFrame ((\\<lbrace>\\<Psi>\\<rbrace>::('a, 'b, 'c) psi)) = \\<langle>\\<epsilon>, \\<Psi>\\<rangle>\" \n\n| \"extractFrame (\\<lparr>\\<nu>x\\<rparr>P) = \\<lparr>\\<nu>x\\<rparr>(extractFrame P)\"\n| \"extractFrame (!P) = \\<langle>\\<epsilon>, \\<bottom>\\<rangle>\" \n\n| \"extractFrame' ((Trm M P)::('a::fs_name, 'b::fs_name, 'c::fs_name) input) = \\<langle>\\<epsilon>, \\<bottom>\\<rangle>\" \n| \"extractFrame' (Bind x I) = \\<langle>\\<epsilon>, \\<bottom>\\<rangle>\" \n\n| \"extractFrame'' (\\<bottom>\\<^sub>c::('a::fs_name, 'b::fs_name, 'c::fs_name) psiCase) = \\<langle>\\<epsilon>, \\<bottom>\\<rangle>\" \n| \"extractFrame'' (\\<box>\\<Phi> \\<Rightarrow> P C) = \\<langle>\\<epsilon>, \\<bottom>\\<rangle>\" \napply(finite_guess add: fsCompose)+\napply(rule TrueI)+\napply(simp add: abs_fresh)+\napply(fresh_guess add: freshBottom)+\napply(rule supports_fresh[of \"{}\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess add: freshBottom)+\napply(rule supports_fresh[of \"{}\"])\napply(force simp add: perm_fun_def eqvts fresh_def[symmetric] supports_def)\napply(simp add: fs_name1)\napply(simp add: fresh_def[symmetric])\napply(fresh_guess add: freshBottom)+\ndone\n\nlemmas extractFrameSimps = extractFrame_extractFrame'_extractFrame''.simps\n\nlemma extractFrameEqvt[eqvt]:\n  fixes p :: \"name prm\"\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   I :: \"('a, 'b, 'c) input\"\n  and   C :: \"('a, 'b, 'c) psiCase\"\n\n  shows \"p \\<bullet> (extractFrame P) = extractFrame (p \\<bullet> P)\"\n  and   \"p \\<bullet> (extractFrame' I) = extractFrame' (p \\<bullet> I)\"\n  and   \"p \\<bullet> (extractFrame'' C) = extractFrame'' (p \\<bullet> C)\"\nby(nominal_induct P and I and C avoiding: p rule: psi_input_psiCase.strong_inducts)\n   (auto simp add: at_prm_fresh[OF at_name_inst] eqvts permBottom\n                  pt_fresh_perm_app[OF pt_name_inst, OF at_name_inst])\n\nlemma insertAssertionFresh[intro]:\n  fixes F :: \"'b frame\"\n  and   \\<Psi> :: 'b\n  and   x :: name\n\n  assumes \"x \\<sharp> F\"\n  and     \"x \\<sharp> \\<Psi>\"\n\n  shows \"x \\<sharp> (insertAssertion F \\<Psi>)\"\nusing assms\nby(nominal_induct F avoiding: x \\<Psi> rule: frame.strong_induct)\n  (auto simp add: abs_fresh)\n\nlemma insertAssertionFreshChain[intro]:\n  fixes F    :: \"'b frame\"\n  and   \\<Psi>    :: 'b\n  and   xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n\n  shows \"\\<lbrakk>xvec \\<sharp>* F; xvec \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> xvec \\<sharp>* (insertAssertion F \\<Psi>)\"\n  and   \"\\<lbrakk>Xs \\<sharp>* F; Xs \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> Xs \\<sharp>* (insertAssertion F \\<Psi>)\"\nby(auto simp add: fresh_star_def)\n\nlemma mergeFrameFresh[intro]:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\"\n  and   x :: name\n\n  shows \"\\<lbrakk>x \\<sharp> F; x \\<sharp> G\\<rbrakk> \\<Longrightarrow> x \\<sharp> (mergeFrame F G)\"\nby(nominal_induct F avoiding: x G rule: frame.strong_induct)\n  (auto simp add: abs_fresh)\n\nlemma mergeFrameFreshChain[intro]:\n  fixes F    :: \"'b frame\"\n  and   G    :: \"'b frame\"\n  and   xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n\n  shows \"\\<lbrakk>xvec \\<sharp>* F; xvec \\<sharp>* G\\<rbrakk> \\<Longrightarrow> xvec \\<sharp>* (mergeFrame F G)\"\n  and   \"\\<lbrakk>Xs \\<sharp>* F; Xs \\<sharp>* G\\<rbrakk> \\<Longrightarrow> Xs \\<sharp>* (mergeFrame F G)\"\nby(auto simp add: fresh_star_def)\n\nlemma extractFrameFresh:\n  fixes P :: \"('a, 'b, 'c) psi\"\n  and   I :: \"('a, 'b, 'c) input\"\n  and   C :: \"('a, 'b, 'c) psiCase\"\n  and   x :: name\n\n  shows \"x \\<sharp> P \\<Longrightarrow> x \\<sharp> extractFrame P\"\n  and   \"x \\<sharp> I \\<Longrightarrow> x \\<sharp> extractFrame' I\"\n  and   \"x \\<sharp> C \\<Longrightarrow> x \\<sharp> extractFrame'' C\"\nby(nominal_induct P and I and C avoiding: x rule: psi_input_psiCase.strong_inducts)\n  (auto simp add: abs_fresh)\n\nlemma extractFrameFreshChain:\n  fixes P    :: \"('a, 'b, 'c) psi\"\n  and   I    :: \"('a, 'b, 'c) input\"\n  and   C    :: \"('a, 'b, 'c) psiCase\"\n  and   xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n\n  shows \"xvec \\<sharp>* P \\<Longrightarrow> xvec \\<sharp>* extractFrame P\"\n  and   \"xvec \\<sharp>* I \\<Longrightarrow> xvec \\<sharp>* extractFrame' I\"\n  and   \"xvec \\<sharp>* C \\<Longrightarrow> xvec \\<sharp>* extractFrame'' C\"\n  and   \"Xs \\<sharp>* P \\<Longrightarrow> Xs \\<sharp>* extractFrame P\"\n  and   \"Xs \\<sharp>* I \\<Longrightarrow> Xs \\<sharp>* extractFrame' I\"\n  and   \"Xs \\<sharp>* C \\<Longrightarrow> Xs \\<sharp>* extractFrame'' C\"\nby(auto simp add: fresh_star_def intro: extractFrameFresh)\n\n\nlemma guardedFrameSupp[simp]:\n  fixes P :: \"('a, 'b, 'c) psi\"\n  and   I :: \"('a, 'b, 'c) input\"\n  and   C :: \"('a, 'b, 'c) psiCase\"\n  and   x :: name \n\n  shows \"guarded P \\<Longrightarrow> x \\<sharp> (extractFrame P)\"\n  and   \"guarded' I \\<Longrightarrow> x \\<sharp> (extractFrame' I)\"\n  and   \"guarded'' C \\<Longrightarrow> x \\<sharp> (extractFrame'' C)\"\nby(nominal_induct P and I and C arbitrary: x rule: psi_input_psiCase.strong_inducts)\n  (auto simp add: frameResChainFresh abs_fresh)\n\nlemma frameResChainFresh': \n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   F    :: \"'b frame\"\n\n  shows \"(xvec \\<sharp>* (\\<lparr>\\<nu>*yvec\\<rparr>F)) = (\\<forall>x \\<in> set xvec. x \\<in> set yvec \\<or> x \\<sharp> F)\"\nby(simp add: frameResChainFresh fresh_star_def)\n\nlemma frameChainFresh[simp]:\n  fixes xvec :: \"name list\"\n  and   \\<Psi>    :: 'b\n  and   Xs   :: \"name set\"\n\n  shows \"xvec \\<sharp>* (FAssert \\<Psi>) = xvec \\<sharp>* \\<Psi>\"\n  and   \"Xs \\<sharp>* (FAssert \\<Psi>) = Xs \\<sharp>* \\<Psi>\"\nby(simp add: fresh_star_def)+\n\nlemma frameResChainFresh''[simp]:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   F    :: \"'b frame\"\n  \n  assumes \"xvec \\<sharp>* yvec\"\n\n  shows \"xvec \\<sharp>* (\\<lparr>\\<nu>*yvec\\<rparr>F) = xvec \\<sharp>* F\"\n\nusing assms\nby(simp_all add: frameResChainFresh')\n  (auto simp add: fresh_star_def fresh_def name_list_supp)\n\nlemma frameResChainFresh'''[simp]:\n  fixes x    :: name\n  and   xvec :: \"name list\"\n  and   F    :: \"'b frame\"\n  \n  assumes \"x \\<sharp> xvec\"\n\n  shows \"x \\<sharp> (\\<lparr>\\<nu>*xvec\\<rparr>F) = x \\<sharp> F\"\nusing assms\nby(induct xvec) (auto simp add: abs_fresh)\n\nlemma FFreshBottom[simp]:\n  fixes xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n\n  shows \"xvec \\<sharp>* (\\<bottom>\\<^sub>F)\"\n  and   \"Xs \\<sharp>* (\\<bottom>\\<^sub>F)\"\nby(auto simp add: fresh_star_def)\n\nlemma SFreshBottom[simp]:\n  fixes xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n\n  shows \"xvec \\<sharp>* (SBottom)\"\n  and   \"Xs \\<sharp>* (SBottom)\"\nby(auto simp add: fresh_star_def)\n(*\nlemma freshChainComp[simp]:\n  fixes xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n  and   \\<Psi>    :: 'b\n  and   \\<Psi>'   :: 'b\n\n  shows \"xvec \\<sharp>* (\\<Psi> \\<otimes> \\<Psi>') = ((xvec \\<sharp>* \\<Psi>) \\<and> xvec \\<sharp>* \\<Psi>')\"\n  and   \"Xs \\<sharp>* (\\<Psi> \\<otimes> \\<Psi>') = ((Xs \\<sharp>* \\<Psi>) \\<and> Xs \\<sharp>* \\<Psi>')\"\nby(auto simp add: fresh_star_def)\n*)\nlemma freshFrameDest[dest]:\n  fixes A\\<^sub>F    :: \"name list\"\n  and   \\<Psi>\\<^sub>F   :: 'b\n  and   xvec  :: \"name list\"\n\n  assumes \"xvec \\<sharp>* (\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>)\"\n\n  shows \"xvec \\<sharp>* A\\<^sub>F \\<Longrightarrow> xvec \\<sharp>* \\<Psi>\\<^sub>F\"\n  and   \"A\\<^sub>F \\<sharp>* xvec \\<Longrightarrow> xvec \\<sharp>* \\<Psi>\\<^sub>F\"\nproof -\n  from assms have \"(set xvec) \\<sharp>* (\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>)\"\n    by(simp add: fresh_star_def)\n  moreover assume \"xvec \\<sharp>* A\\<^sub>F\"\n  ultimately show \"xvec \\<sharp>* \\<Psi>\\<^sub>F\"\n    by(simp add: frameResChainFreshSet) (force simp add: fresh_def name_list_supp fresh_star_def)\nnext\n  from assms have \"(set xvec) \\<sharp>* (\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>)\"\n    by(simp add: fresh_star_def)\n  moreover assume \"A\\<^sub>F \\<sharp>* xvec\"\n  ultimately show \"xvec \\<sharp>* \\<Psi>\\<^sub>F\"\n    by(simp add: frameResChainFreshSet) (force simp add: fresh_def name_list_supp fresh_star_def)\nqed\n\nlemma insertAssertionSimps[simp]:\n  fixes A\\<^sub>F :: \"name list\"\n  and   \\<Psi>\\<^sub>F :: 'b\n  and   \\<Psi>  :: 'b\n  \n  assumes \"A\\<^sub>F \\<sharp>* \\<Psi>\"\n\n  shows \"insertAssertion (\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>) \\<Psi> = \\<langle>A\\<^sub>F, \\<Psi> \\<otimes> \\<Psi>\\<^sub>F\\<rangle>\"\nusing assms\nby(induct A\\<^sub>F arbitrary: F) auto\n\nlemma mergeFrameSimps[simp]:\n  fixes A\\<^sub>F :: \"name list\"\n  and   \\<Psi>\\<^sub>F :: 'b\n  and   \\<Psi>  :: 'b\n\n  assumes \"A\\<^sub>F \\<sharp>* \\<Psi>\"\n\n  shows \"(\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>) \\<otimes>\\<^sub>F \\<langle>\\<epsilon>, \\<Psi>\\<rangle> = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<rangle>\"\nusing assms\nby(induct A\\<^sub>F arbitrary: F) auto\n\nlemma mergeFrames[simp]:\n  fixes A\\<^sub>F  :: \"name list\"\n  and   \\<Psi>\\<^sub>F :: 'b\n  and   A\\<^sub>G  :: \"name list\"\n  and   \\<Psi>\\<^sub>G :: 'b\n\n  assumes \"A\\<^sub>F \\<sharp>* A\\<^sub>G\"\n  and     \"A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G\"\n  and     \"A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F\"\n\n  shows \"(\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>) \\<otimes>\\<^sub>F (\\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle>) = (\\<langle>(A\\<^sub>F@A\\<^sub>G), \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G\\<rangle>)\"\nusing assms\nby(induct A\\<^sub>F) auto\n\nlemma frameImpResFreshLeft:\n  fixes F :: \"'b frame\"\n  and   x :: name\n  \n  assumes \"x \\<sharp> F\"\n\n  shows \"\\<lparr>\\<nu>x\\<rparr>F \\<hookrightarrow>\\<^sub>F F\"\nproof(auto simp add: FrameStatImp_def)\n  fix \\<phi>::'c\n  obtain A\\<^sub>F \\<Psi>\\<^sub>F where Feq: \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"A\\<^sub>F \\<sharp>* (x, \\<phi>)\"\n    by(rule freshFrame)\n  from \\<open>A\\<^sub>F \\<sharp>* (x, \\<phi>)\\<close> have \"x \\<sharp> A\\<^sub>F\" and \"A\\<^sub>F \\<sharp>* \\<phi>\" by simp+\n  obtain y where \"y \\<sharp> \\<phi>\" and \"y \\<sharp> F\" and \"x \\<noteq> y\"\n    by(generate_fresh \"name\", auto)\n  \n  assume \"\\<lparr>\\<nu>x\\<rparr>F \\<turnstile>\\<^sub>F \\<phi>\"\n  with \\<open>y \\<sharp> F\\<close> have \"\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> F) \\<turnstile>\\<^sub>F \\<phi>\" by(simp add: alphaFrameRes)\n  with \\<open>x \\<sharp> F\\<close> \\<open>y \\<sharp> F\\<close> have \"\\<lparr>\\<nu>y\\<rparr>F \\<turnstile>\\<^sub>F \\<phi>\" by simp\n  with Feq have \"\\<langle>(y#A\\<^sub>F), \\<Psi>\\<^sub>F\\<rangle> \\<turnstile>\\<^sub>F \\<phi>\" by simp\n  with Feq \\<open>A\\<^sub>F \\<sharp>* \\<phi>\\<close> \\<open>y \\<sharp> \\<phi>\\<close> show \"F \\<turnstile>\\<^sub>F \\<phi>\"\n    by(force intro: frameImpI dest: frameImpE simp del: frameResChain.simps)\nqed\n\nlemma frameImpResFreshRight:\n  fixes F :: \"'b frame\"\n  and   x :: name\n  \n  assumes \"x \\<sharp> F\"\n\n  shows \"F \\<hookrightarrow>\\<^sub>F \\<lparr>\\<nu>x\\<rparr>F\"\nproof(auto simp add: FrameStatImp_def)\n  fix \\<phi>::'c\n  obtain A\\<^sub>F \\<Psi>\\<^sub>F where Feq: \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"A\\<^sub>F \\<sharp>* (x, \\<phi>)\"\n    by(rule freshFrame)\n  from \\<open>A\\<^sub>F \\<sharp>* (x, \\<phi>)\\<close> have \"x \\<sharp> A\\<^sub>F\" and \"A\\<^sub>F \\<sharp>* \\<phi>\" by simp+\n  obtain y where \"y \\<sharp> \\<phi>\" and \"y \\<sharp> F\" and \"x \\<noteq> y\"\n    by(generate_fresh \"name\", auto)\n  \n  assume \"F \\<turnstile>\\<^sub>F \\<phi>\"\n  with Feq \\<open>A\\<^sub>F \\<sharp>* \\<phi>\\<close> \\<open>y \\<sharp> \\<phi>\\<close> have \"\\<langle>(y#A\\<^sub>F), \\<Psi>\\<^sub>F\\<rangle> \\<turnstile>\\<^sub>F \\<phi>\"\n    by(force intro: frameImpI dest: frameImpE simp del: frameResChain.simps)\n  moreover with \\<open>y \\<sharp> F\\<close> \\<open>x \\<sharp> F\\<close> Feq show \"\\<lparr>\\<nu>x\\<rparr>F \\<turnstile>\\<^sub>F \\<phi>\"\n    by(subst alphaFrameRes) auto\nqed\n\nlemma frameResFresh:\n  fixes F :: \"'b frame\"\n  and   x :: name\n  \n  assumes \"x \\<sharp> F\"\n\n  shows \"\\<lparr>\\<nu>x\\<rparr>F \\<simeq>\\<^sub>F F\"\nusing assms\nby(auto simp add: FrameStatEq_def intro: frameImpResFreshLeft frameImpResFreshRight)\n\nlemma frameImpResPres:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\"\n  and   x :: name\n  \n  assumes \"F \\<hookrightarrow>\\<^sub>F G\"\n\n  shows \"\\<lparr>\\<nu>x\\<rparr>F \\<hookrightarrow>\\<^sub>F \\<lparr>\\<nu>x\\<rparr>G\"\nproof(auto simp add: FrameStatImp_def)\n  fix \\<phi>::'c\n  obtain A\\<^sub>F \\<Psi>\\<^sub>F where Feq: \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"A\\<^sub>F \\<sharp>* (x, \\<phi>)\"\n    by(rule freshFrame)\n  from \\<open>A\\<^sub>F \\<sharp>* (x, \\<phi>)\\<close> have \"x \\<sharp> A\\<^sub>F\" and \"A\\<^sub>F \\<sharp>* \\<phi>\" by simp+\n  obtain y where \"y \\<sharp> A\\<^sub>F\" and \"y \\<sharp> F\" and \"y \\<sharp> G\"\n             and \"x \\<noteq> y\" and \"y \\<sharp> \\<phi>\"\n    by(generate_fresh \"name\", auto)\n  assume \"\\<lparr>\\<nu>x\\<rparr>F \\<turnstile>\\<^sub>F \\<phi>\"\n  with \\<open>y \\<sharp> F\\<close> have \"\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> F) \\<turnstile>\\<^sub>F \\<phi>\" by(simp add: alphaFrameRes)\n  with Feq \\<open>x \\<sharp> A\\<^sub>F\\<close> \\<open>y \\<sharp> A\\<^sub>F\\<close> have \"\\<langle>(y#A\\<^sub>F), [(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<rangle> \\<turnstile>\\<^sub>F \\<phi>\" by(simp add: eqvts)\n  with \\<open>y \\<sharp> \\<phi>\\<close> \\<open>A\\<^sub>F \\<sharp>* \\<phi>\\<close> have \"\\<langle>A\\<^sub>F, [(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<rangle> \\<turnstile>\\<^sub>F \\<phi>\"\n    by(force intro: frameImpI dest: frameImpE simp del: frameResChain.simps)\n  hence \"([(x, y)] \\<bullet> \\<langle>A\\<^sub>F, [(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<rangle>) \\<turnstile>\\<^sub>F ([(x, y)] \\<bullet> \\<phi>)\"\n    by(rule frameImpClosed)\n  with \\<open>x \\<sharp> A\\<^sub>F\\<close> \\<open>y \\<sharp> A\\<^sub>F\\<close> Feq have \"F \\<turnstile>\\<^sub>F [(x, y)] \\<bullet> \\<phi>\"\n    by(simp add: eqvts)\n  with \\<open>F \\<hookrightarrow>\\<^sub>F G\\<close> have \"G \\<turnstile>\\<^sub>F [(x, y)] \\<bullet> \\<phi>\" by(simp add: FrameStatImp_def)\n  \n  obtain A\\<^sub>G \\<Psi>\\<^sub>G where Geq: \"G = \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle>\" and \"A\\<^sub>G \\<sharp>* (x, y, \\<phi>)\"\n    by(rule freshFrame)\n  from \\<open>A\\<^sub>G \\<sharp>* (x, y, \\<phi>)\\<close> have \"x \\<sharp> A\\<^sub>G\" and \"y \\<sharp> A\\<^sub>G\" and \"A\\<^sub>G \\<sharp>* \\<phi>\" by simp+\n  from \\<open>G \\<turnstile>\\<^sub>F [(x, y)] \\<bullet> \\<phi>\\<close> have \"([(x, y)] \\<bullet> G) \\<turnstile>\\<^sub>F [(x, y)] \\<bullet> [(x, y)] \\<bullet> \\<phi>\"\n    by(rule frameImpClosed)\n  with Geq \\<open>x \\<sharp> A\\<^sub>G\\<close> \\<open>y \\<sharp> A\\<^sub>G\\<close> have \"\\<langle>A\\<^sub>G, [(x, y)] \\<bullet> \\<Psi>\\<^sub>G\\<rangle> \\<turnstile>\\<^sub>F \\<phi>\" by(simp add: eqvts)\n  with \\<open>y \\<sharp> \\<phi>\\<close> \\<open>A\\<^sub>G \\<sharp>* \\<phi>\\<close> have \"\\<langle>(y#A\\<^sub>G), [(x, y)] \\<bullet> \\<Psi>\\<^sub>G\\<rangle> \\<turnstile>\\<^sub>F \\<phi>\"\n    by(force intro: frameImpI dest: frameImpE simp del: frameResChain.simps)\n  with \\<open>y \\<sharp> G\\<close> \\<open>x \\<sharp> A\\<^sub>G\\<close> \\<open>y \\<sharp> A\\<^sub>G\\<close> Geq show \"\\<lparr>\\<nu>x\\<rparr>G \\<turnstile>\\<^sub>F \\<phi>\"\n    by(subst alphaFrameRes) (fastforce simp add: eqvts)+\nqed\n\nlemma frameResPres:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\"\n  and   x :: name\n  \n  assumes \"F \\<simeq>\\<^sub>F G\"\n\n  shows \"\\<lparr>\\<nu>x\\<rparr>F \\<simeq>\\<^sub>F \\<lparr>\\<nu>x\\<rparr>G\"\nusing assms\nby(auto simp add: FrameStatEq_def intro: frameImpResPres)\n\nlemma frameImpResComm:\n  fixes x :: name\n  and   y :: name\n  and   F :: \"'b frame\"\n\n  shows \"\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>F) \\<hookrightarrow>\\<^sub>F \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>F)\"\nproof(case_tac \"x = y\")\n  assume \"x = y\"\n  thus ?thesis by simp\nnext\n  assume \"x \\<noteq> y\"\n  show ?thesis\n  proof(auto simp add: FrameStatImp_def)\n    fix \\<phi>::'c\n    obtain A\\<^sub>F \\<Psi>\\<^sub>F where Feq: \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"A\\<^sub>F \\<sharp>* (x, y, \\<phi>)\"\n      by(rule freshFrame)\n    then have \"x \\<sharp> A\\<^sub>F\" and \"y \\<sharp> A\\<^sub>F\" and \"A\\<^sub>F \\<sharp>* \\<phi>\" by simp+\n\n    obtain x'::name where \"x' \\<noteq> x\" and \"x' \\<noteq> y\" and \"x' \\<sharp> F\" and \"x' \\<sharp> \\<phi>\" and \"x' \\<sharp> A\\<^sub>F\"\n      by(generate_fresh \"name\") auto\n    obtain y'::name where \"y' \\<noteq> x\" and \"y' \\<noteq> y\" and \"y' \\<noteq> x'\" and \"y' \\<sharp> F\" and \"y' \\<sharp> \\<phi>\" and \"y' \\<sharp> A\\<^sub>F\"\n      by(generate_fresh \"name\") auto\n  \n    from \\<open>y' \\<sharp> F\\<close> have \"\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>F) = \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y'\\<rparr>([(y, y')] \\<bullet> F))\"\n      by(simp add: alphaFrameRes)\n    moreover from \\<open>x' \\<sharp> F\\<close> \\<open>x' \\<noteq> y\\<close> \\<open>y' \\<noteq> x'\\<close> have \"\\<dots> = \\<lparr>\\<nu>x'\\<rparr>([(x, x')] \\<bullet> (\\<lparr>\\<nu>y'\\<rparr>([(y, y')] \\<bullet> F)))\"\n      by(rule_tac alphaFrameRes) (simp add: abs_fresh fresh_left)\n    moreover with  \\<open>y' \\<noteq> x'\\<close> \\<open>y' \\<noteq> x\\<close> have \"\\<dots> = \\<lparr>\\<nu>x'\\<rparr>(\\<lparr>\\<nu>y'\\<rparr>([(x, x')] \\<bullet> [(y, y')] \\<bullet> F))\"\n      by(simp add: eqvts calc_atm)\n    ultimately have A: \"\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>F)= \\<lparr>\\<nu>x'\\<rparr>(\\<lparr>\\<nu>y'\\<rparr>(\\<lparr>\\<nu>*A\\<^sub>F\\<rparr>(FAssert([(x, x')] \\<bullet> [(y, y')] \\<bullet> \\<Psi>\\<^sub>F))))\"\n      using  Feq \\<open>x \\<sharp> A\\<^sub>F\\<close> \\<open>x' \\<sharp> A\\<^sub>F\\<close> \\<open>y \\<sharp> A\\<^sub>F\\<close> \\<open>y' \\<sharp> A\\<^sub>F\\<close>\n      by(simp add: eqvts)\n\n    from \\<open>x' \\<sharp> F\\<close> have \"\\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>F) = \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x'\\<rparr>([(x, x')] \\<bullet> F))\"\n      by(simp add: alphaFrameRes)\n    moreover from \\<open>y' \\<sharp> F\\<close> \\<open>y' \\<noteq> x\\<close> \\<open>y' \\<noteq> x'\\<close> have \"\\<dots> = \\<lparr>\\<nu>y'\\<rparr>([(y, y')] \\<bullet> (\\<lparr>\\<nu>x'\\<rparr>([(x, x')] \\<bullet> F)))\"\n      by(rule_tac alphaFrameRes) (simp add: abs_fresh fresh_left)\n    moreover with  \\<open>y' \\<noteq> x'\\<close> \\<open>x' \\<noteq> y\\<close> have \"\\<dots> = \\<lparr>\\<nu>y'\\<rparr>(\\<lparr>\\<nu>x'\\<rparr>([(y, y')] \\<bullet> [(x, x')] \\<bullet> F))\"\n      by(simp add: eqvts calc_atm)\n    moreover with \\<open>x' \\<noteq> x\\<close> \\<open>x' \\<noteq> y\\<close> \\<open>y' \\<noteq> x\\<close> \\<open>y' \\<noteq> y\\<close> \\<open>y' \\<noteq> x'\\<close> \\<open>x \\<noteq> y\\<close>\n      have \"\\<dots> = \\<lparr>\\<nu>y'\\<rparr>(\\<lparr>\\<nu>x'\\<rparr>([(x, x')] \\<bullet> [(y, y')] \\<bullet> F))\"\n      apply(simp add: eqvts)\n      by(subst perm_compose) (simp add: calc_atm)\n    ultimately have B: \"\\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>F)= \\<lparr>\\<nu>y'\\<rparr>(\\<lparr>\\<nu>x'\\<rparr>(\\<lparr>\\<nu>*A\\<^sub>F\\<rparr>(FAssert([(x, x')] \\<bullet> [(y, y')] \\<bullet> \\<Psi>\\<^sub>F))))\"\n      using  Feq \\<open>x \\<sharp> A\\<^sub>F\\<close> \\<open>x' \\<sharp> A\\<^sub>F\\<close> \\<open>y \\<sharp> A\\<^sub>F\\<close> \\<open>y' \\<sharp> A\\<^sub>F\\<close>\n      by(simp add: eqvts)\n\n    from \\<open>x' \\<sharp> \\<phi>\\<close> \\<open>y' \\<sharp> \\<phi>\\<close> \\<open>A\\<^sub>F \\<sharp>* \\<phi>\\<close>\n    have \"\\<langle>(x'#y'#A\\<^sub>F), [(x, x')] \\<bullet> [(y, y')] \\<bullet> \\<Psi>\\<^sub>F\\<rangle> \\<turnstile>\\<^sub>F \\<phi> = \\<langle>(y'#x'#A\\<^sub>F), [(x, x')] \\<bullet> [(y, y')] \\<bullet> \\<Psi>\\<^sub>F\\<rangle> \\<turnstile>\\<^sub>F \\<phi>\"\n      by(force dest: frameImpE intro: frameImpI simp del: frameResChain.simps)\n    with A B have \"(\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>F)) \\<turnstile>\\<^sub>F \\<phi> = (\\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>F)) \\<turnstile>\\<^sub>F \\<phi>\"\n      by simp\n    moreover assume \"(\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>F)) \\<turnstile>\\<^sub>F \\<phi>\"\n    ultimately show \"(\\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>F)) \\<turnstile>\\<^sub>F \\<phi>\" by simp\n  qed\nqed\n\nlemma frameResComm:\n  fixes x :: name\n  and   y :: name\n  and   F :: \"'b frame\"\n\n  shows \"\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>F) \\<simeq>\\<^sub>F \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>F)\"\nby(auto simp add: FrameStatEq_def intro: frameImpResComm)\n\nlemma frameImpResCommLeft':\n  fixes x    :: name\n  and   xvec :: \"name list\"\n  and   F    :: \"'b frame\"\n\n  shows \"\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>F) \\<hookrightarrow>\\<^sub>F \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>F)\"\nby(induct xvec) (auto intro: frameImpResComm FrameStatImpTrans frameImpResPres)\n\nlemma frameImpResCommRight':\n  fixes x    :: name\n  and   xvec :: \"name list\"\n  and   F    :: \"'b frame\"\n\n  shows \"\\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>F) \\<hookrightarrow>\\<^sub>F \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>F)\"\nby(induct xvec) (auto intro: frameImpResComm FrameStatImpTrans frameImpResPres)\n\nlemma frameResComm':\n  fixes x    :: name\n  and   xvec :: \"name list\"\n  and   F    :: \"'b frame\"\n\n  shows \"\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>F) \\<simeq>\\<^sub>F \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>F)\"\nby(induct xvec) (auto intro: frameResComm FrameStatEqTrans frameResPres)\n\nlemma frameImpChainComm:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   F    :: \"'b frame\"\n\n  shows \"\\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>*yvec\\<rparr>F) \\<hookrightarrow>\\<^sub>F \\<lparr>\\<nu>*yvec\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>F)\"\nby(induct xvec) (auto intro: frameImpResCommLeft' FrameStatImpTrans frameImpResPres)\n\nlemma frameResChainComm:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   F    :: \"'b frame\"\n\n  shows \"\\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>*yvec\\<rparr>F) \\<simeq>\\<^sub>F \\<lparr>\\<nu>*yvec\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>F)\"\nby(induct xvec) (auto intro: frameResComm' FrameStatEqTrans frameResPres)\n\nlemma frameImpNilStatEq[simp]:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n\n  shows \"(\\<langle>\\<epsilon>, \\<Psi>\\<rangle> \\<hookrightarrow>\\<^sub>F \\<langle>\\<epsilon>, \\<Psi>'\\<rangle>) = (\\<Psi> \\<hookrightarrow> \\<Psi>')\"\nby(simp add: FrameStatImp_def AssertionStatImp_def FrameImp_def)\n\n\nlemma frameNilStatEq[simp]:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n\n  shows \"(\\<langle>\\<epsilon>, \\<Psi>\\<rangle> \\<simeq>\\<^sub>F \\<langle>\\<epsilon>, \\<Psi>'\\<rangle>) = (\\<Psi> \\<simeq> \\<Psi>')\"\nby(simp add: FrameStatEq_def AssertionStatEq_def FrameImp_def)\n\nlemma extractFrameChainStatImp:\n  fixes xvec :: \"name list\"\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  shows \"extractFrame(\\<lparr>\\<nu>*xvec\\<rparr>P) \\<hookrightarrow>\\<^sub>F \\<lparr>\\<nu>*xvec\\<rparr>(extractFrame P)\"\nby(induct xvec) (auto intro: frameImpResPres)\n\nlemma extractFrameChainStatEq:\n  fixes xvec :: \"name list\"\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  shows \"extractFrame(\\<lparr>\\<nu>*xvec\\<rparr>P) \\<simeq>\\<^sub>F \\<lparr>\\<nu>*xvec\\<rparr>(extractFrame P)\"\nby(induct xvec) (auto intro: frameResPres)\n\nlemma insertAssertionExtractFrameFreshImp:\n  fixes xvec :: \"name list\"\n  and   \\<Psi>   :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"xvec \\<sharp>* \\<Psi>\"\n\n  shows \"insertAssertion(extractFrame(\\<lparr>\\<nu>*xvec\\<rparr>P)) \\<Psi> \\<hookrightarrow>\\<^sub>F \\<lparr>\\<nu>*xvec\\<rparr>(insertAssertion (extractFrame P) \\<Psi>)\"\nusing assms\nby(induct xvec) (auto intro: frameImpResPres)\n\nlemma insertAssertionExtractFrameFresh:\n  fixes xvec :: \"name list\"\n  and   \\<Psi>   :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"xvec \\<sharp>* \\<Psi>\"\n\n  shows \"insertAssertion(extractFrame(\\<lparr>\\<nu>*xvec\\<rparr>P)) \\<Psi> \\<simeq>\\<^sub>F \\<lparr>\\<nu>*xvec\\<rparr>(insertAssertion (extractFrame P) \\<Psi>)\"\nusing assms\nby(induct xvec) (auto intro: frameResPres)\n\nlemma frameImpResChainPres:\n  fixes F    :: \"'b frame\"\n  and   G    :: \"'b frame\"\n  and   xvec :: \"name list\"\n\n  assumes \"F \\<hookrightarrow>\\<^sub>F G\"\n\n  shows \"\\<lparr>\\<nu>*xvec\\<rparr>F \\<hookrightarrow>\\<^sub>F \\<lparr>\\<nu>*xvec\\<rparr>G\"\nusing assms\nby(induct xvec) (auto intro: frameImpResPres)\n\nlemma frameResChainPres:\n  fixes F    :: \"'b frame\"\n  and   G    :: \"'b frame\"\n  and   xvec :: \"name list\"\n\n  assumes \"F \\<simeq>\\<^sub>F G\"\n\n  shows \"\\<lparr>\\<nu>*xvec\\<rparr>F \\<simeq>\\<^sub>F \\<lparr>\\<nu>*xvec\\<rparr>G\"\nusing assms\nby(induct xvec) (auto intro: frameResPres)\n\nlemma insertAssertionE:\n  fixes F  :: \"('b::fs_name) frame\"\n  and   \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n  and   A\\<^sub>F :: \"name list\"\n\n  assumes \"insertAssertion F \\<Psi> = \\<langle>A\\<^sub>F, \\<Psi>'\\<rangle>\"\n  and     \"A\\<^sub>F \\<sharp>* F\"\n  and     \"A\\<^sub>F \\<sharp>* \\<Psi>\"\n  and     \"distinct A\\<^sub>F\"\n\n  obtains \\<Psi>\\<^sub>F where \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"\\<Psi>' = \\<Psi> \\<otimes> \\<Psi>\\<^sub>F\"\nproof -\n  assume A: \"\\<And>\\<Psi>\\<^sub>F. \\<lbrakk>F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>; \\<Psi>' = \\<Psi> \\<otimes> \\<Psi>\\<^sub>F\\<rbrakk> \\<Longrightarrow> thesis\"\n  from assms have \"\\<exists>\\<Psi>\\<^sub>F. F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> \\<and> \\<Psi>' = \\<Psi> \\<otimes> \\<Psi>\\<^sub>F\"\n  proof(nominal_induct F avoiding: \\<Psi> A\\<^sub>F \\<Psi>' rule: frame.strong_induct)\n    case(FAssert \\<Psi> A\\<^sub>F \\<Psi>')\n    thus ?case by auto\n  next\n    case(FRes x F \\<Psi> A\\<^sub>F \\<Psi>')\n    from \\<open>insertAssertion (\\<lparr>\\<nu>x\\<rparr>F) \\<Psi> = \\<langle>A\\<^sub>F, \\<Psi>'\\<rangle>\\<close> \\<open>x \\<sharp> \\<Psi>\\<close>\n    obtain y A\\<^sub>F' where \"A\\<^sub>F = y#A\\<^sub>F'\" by(induct A\\<^sub>F) auto\n    with \\<open>insertAssertion (\\<lparr>\\<nu>x\\<rparr>F) \\<Psi> = \\<langle>A\\<^sub>F, \\<Psi>'\\<rangle>\\<close> \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>x \\<sharp> A\\<^sub>F\\<close>\n    have A: \"insertAssertion F \\<Psi> = \\<langle>([(x, y)] \\<bullet> A\\<^sub>F'), [(x, y)] \\<bullet> \\<Psi>'\\<rangle>\"\n      by(simp add: frame.inject alpha eqvts)\n    from \\<open>A\\<^sub>F = y#A\\<^sub>F'\\<close> \\<open>A\\<^sub>F \\<sharp>* \\<Psi>\\<close> have \"y \\<sharp> \\<Psi>\" and \"A\\<^sub>F' \\<sharp>* \\<Psi>\" by simp+\n    from \\<open>distinct A\\<^sub>F\\<close> \\<open>A\\<^sub>F = y#A\\<^sub>F'\\<close> have \"y \\<sharp> A\\<^sub>F'\" and \"distinct A\\<^sub>F'\" by auto\n    from \\<open>A\\<^sub>F \\<sharp>* (\\<lparr>\\<nu>x\\<rparr>F)\\<close> \\<open>x \\<sharp> A\\<^sub>F\\<close> \\<open>A\\<^sub>F = y#A\\<^sub>F'\\<close> have \"y \\<sharp> F\" and \"A\\<^sub>F' \\<sharp>* F\" and \"x \\<sharp> A\\<^sub>F'\"\n      apply -\n      apply(auto simp add: abs_fresh)\n      apply(hypsubst_thin)\n      apply(subst fresh_star_def)\n      apply(erule rev_mp)\n      apply(subst fresh_star_def)\n      apply(clarify)\n      apply(erule_tac x=xa in ballE)\n      apply(simp add: abs_fresh)\n      apply auto\n      by(simp add: fresh_def name_list_supp)\n    with \\<open>x \\<sharp> A\\<^sub>F'\\<close> \\<open>y \\<sharp> A\\<^sub>F'\\<close> have \"([(x, y)] \\<bullet> A\\<^sub>F') \\<sharp>* F\" by simp\n    from \\<open>A\\<^sub>F' \\<sharp>* \\<Psi>\\<close> have \"([(x, y)] \\<bullet> A\\<^sub>F') \\<sharp>* ([(x, y)] \\<bullet> \\<Psi>)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n    with \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> have \"([(x, y)] \\<bullet> A\\<^sub>F') \\<sharp>* \\<Psi>\" by simp\n    with \\<open>\\<And>\\<Psi> A\\<^sub>F \\<Psi>'. \\<lbrakk>insertAssertion F \\<Psi> = \\<langle>A\\<^sub>F, \\<Psi>'\\<rangle>; A\\<^sub>F \\<sharp>* F; A\\<^sub>F \\<sharp>* \\<Psi>; distinct A\\<^sub>F\\<rbrakk> \\<Longrightarrow> \\<exists>\\<Psi>\\<^sub>F. F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> \\<and> \\<Psi>' = \\<Psi> \\<otimes> \\<Psi>\\<^sub>F\\<close> A \n         \\<open>([(x, y)] \\<bullet> A\\<^sub>F') \\<sharp>* F\\<close> \\<open>distinct A\\<^sub>F'\\<close> \\<open>x \\<sharp> A\\<^sub>F'\\<close> \\<open>y \\<sharp> A\\<^sub>F'\\<close>\n    obtain \\<Psi>\\<^sub>F where Feq: \"F = \\<langle>A\\<^sub>F', \\<Psi>\\<^sub>F\\<rangle>\" and \\<Psi>eq: \"([(x, y)] \\<bullet> \\<Psi>') = \\<Psi> \\<otimes> \\<Psi>\\<^sub>F\"\n      by force\n    \n    from Feq have \"\\<lparr>\\<nu>x\\<rparr>F =  \\<langle>(x#A\\<^sub>F'), \\<Psi>\\<^sub>F\\<rangle>\" by(simp add: frame.inject)\n    hence \"([(x, y)] \\<bullet> \\<lparr>\\<nu>x\\<rparr>F) = [(x, y)] \\<bullet> \\<langle>(x#A\\<^sub>F'), \\<Psi>\\<^sub>F\\<rangle>\" by simp\n    hence \"\\<lparr>\\<nu>x\\<rparr>F = \\<langle>A\\<^sub>F, [(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<rangle>\" using \\<open>y \\<sharp> F\\<close> \\<open>A\\<^sub>F = y#A\\<^sub>F'\\<close> \\<open>x \\<sharp> A\\<^sub>F\\<close> \\<open>y \\<sharp> A\\<^sub>F'\\<close>\n      by(simp add: eqvts calc_atm alphaFrameRes)\n\n    moreover from \\<Psi>eq have \"[(x, y)] \\<bullet> ([(x, y)] \\<bullet> \\<Psi>') = [(x, y)] \\<bullet> (\\<Psi> \\<otimes> \\<Psi>\\<^sub>F)\"\n      by simp\n    with \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> have \"\\<Psi>' = \\<Psi> \\<otimes> ([(x, y)] \\<bullet> \\<Psi>\\<^sub>F)\" by(simp add: eqvts)\n    ultimately show ?case\n      by blast\n  qed\n  with A show ?thesis\n    by blast\nqed\n\nlemma mergeFrameE:\n  fixes F   :: \"'b frame\"\n  and   G   :: \"'b frame\"\n  and   A\\<^sub>F\\<^sub>G :: \"name list\"\n  and   \\<Psi>\\<^sub>F\\<^sub>G :: 'b\n\n  assumes \"mergeFrame F G = \\<langle>A\\<^sub>F\\<^sub>G, \\<Psi>\\<^sub>F\\<^sub>G\\<rangle>\"\n  and     \"distinct A\\<^sub>F\\<^sub>G\"\n  and     \"A\\<^sub>F\\<^sub>G \\<sharp>* F\"\n  and     \"A\\<^sub>F\\<^sub>G \\<sharp>* G\"\n\n  obtains A\\<^sub>F \\<Psi>\\<^sub>F A\\<^sub>G \\<Psi>\\<^sub>G where \"A\\<^sub>F\\<^sub>G = A\\<^sub>F@A\\<^sub>G\" and \"\\<Psi>\\<^sub>F\\<^sub>G = \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G\" and \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"G = \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle>\" and \"A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G\" and \"A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F\"\nproof -\n  assume A: \"\\<And>A\\<^sub>F A\\<^sub>G \\<Psi>\\<^sub>F \\<Psi>\\<^sub>G. \\<lbrakk>A\\<^sub>F\\<^sub>G = A\\<^sub>F@A\\<^sub>G; \\<Psi>\\<^sub>F\\<^sub>G = \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G; F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>; G = \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle>; A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G; A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F\\<rbrakk> \\<Longrightarrow> thesis\"\n  from assms have \"\\<exists>A\\<^sub>F \\<Psi>\\<^sub>F A\\<^sub>G \\<Psi>\\<^sub>G. A\\<^sub>F\\<^sub>G = A\\<^sub>F@A\\<^sub>G \\<and> \\<Psi>\\<^sub>F\\<^sub>G = \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G \\<and> F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> \\<and> G = \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle> \\<and> A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G \\<and> A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F\"\n  proof(nominal_induct F avoiding: G A\\<^sub>F\\<^sub>G \\<Psi>\\<^sub>F\\<^sub>G rule: frame.strong_induct)\n    case(FAssert \\<Psi> G A\\<^sub>F\\<^sub>G \\<Psi>\\<^sub>F\\<^sub>G)\n    thus ?case\n      apply auto\n      apply(rule_tac x=\"[]\" in exI) \n      by(drule_tac insertAssertionE) auto\n  next\n    case(FRes x F G A\\<^sub>F\\<^sub>G \\<Psi>\\<^sub>F\\<^sub>G)\n    from \\<open>mergeFrame (\\<lparr>\\<nu>x\\<rparr>F) G = \\<langle>A\\<^sub>F\\<^sub>G, \\<Psi>\\<^sub>F\\<^sub>G\\<rangle>\\<close> \\<open>x \\<sharp> G\\<close>\n    obtain y A\\<^sub>F\\<^sub>G' where \"A\\<^sub>F\\<^sub>G = y#A\\<^sub>F\\<^sub>G'\" by(induct A\\<^sub>F\\<^sub>G) auto\n    with \\<open>A\\<^sub>F\\<^sub>G \\<sharp>* (\\<lparr>\\<nu>x\\<rparr>F)\\<close> \\<open>x \\<sharp> A\\<^sub>F\\<^sub>G\\<close> have \"A\\<^sub>F\\<^sub>G' \\<sharp>* F\" and \"x \\<sharp> A\\<^sub>F\\<^sub>G'\"\n      by(auto simp add: supp_list_cons fresh_star_def fresh_def name_list_supp abs_supp frame.supp)\n    from \\<open>A\\<^sub>F\\<^sub>G = y#A\\<^sub>F\\<^sub>G'\\<close> \\<open>A\\<^sub>F\\<^sub>G \\<sharp>* G\\<close> have \"y \\<sharp> G\" and \"A\\<^sub>F\\<^sub>G' \\<sharp>* G\" by simp+\n    from \\<open>A\\<^sub>F\\<^sub>G = y#A\\<^sub>F\\<^sub>G'\\<close> \\<open>A\\<^sub>F\\<^sub>G \\<sharp>* (\\<lparr>\\<nu>x\\<rparr>F)\\<close> \\<open>x \\<sharp> A\\<^sub>F\\<^sub>G\\<close> have \"y \\<sharp> F\" and \"A\\<^sub>F\\<^sub>G' \\<sharp>* F\"\n      apply(auto simp add: abs_fresh frameResChainFreshSet)\n      apply(hypsubst_thin)\n      by(induct A\\<^sub>F\\<^sub>G') (auto simp add: abs_fresh)\n    from \\<open>distinct A\\<^sub>F\\<^sub>G\\<close> \\<open>A\\<^sub>F\\<^sub>G = y#A\\<^sub>F\\<^sub>G'\\<close> have \"y \\<sharp> A\\<^sub>F\\<^sub>G'\" and \"distinct A\\<^sub>F\\<^sub>G'\" by auto\n    \n    with \\<open>A\\<^sub>F\\<^sub>G = y#A\\<^sub>F\\<^sub>G'\\<close> \\<open>mergeFrame (\\<lparr>\\<nu>x\\<rparr>F) G = \\<langle>A\\<^sub>F\\<^sub>G, \\<Psi>\\<^sub>F\\<^sub>G\\<rangle>\\<close> \\<open>x \\<sharp> G\\<close> \\<open>x \\<sharp> A\\<^sub>F\\<^sub>G\\<close> \\<open>y \\<sharp> A\\<^sub>F\\<^sub>G'\\<close>\n    have \"mergeFrame F G = \\<langle>A\\<^sub>F\\<^sub>G', [(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<^sub>G\\<rangle>\"\n      by(simp add: frame.inject alpha eqvts)\n    with \\<open>distinct A\\<^sub>F\\<^sub>G'\\<close> \\<open>A\\<^sub>F\\<^sub>G' \\<sharp>* F\\<close> \\<open>A\\<^sub>F\\<^sub>G' \\<sharp>* G\\<close>\n         \\<open>\\<And>G A\\<^sub>F\\<^sub>G \\<Psi>\\<^sub>F\\<^sub>G. \\<lbrakk>mergeFrame F G = \\<langle>A\\<^sub>F\\<^sub>G, \\<Psi>\\<^sub>F\\<^sub>G\\<rangle>; distinct A\\<^sub>F\\<^sub>G; A\\<^sub>F\\<^sub>G \\<sharp>* F; A\\<^sub>F\\<^sub>G \\<sharp>* G\\<rbrakk> \\<Longrightarrow> \\<exists>A\\<^sub>F \\<Psi>\\<^sub>F A\\<^sub>G \\<Psi>\\<^sub>G. A\\<^sub>F\\<^sub>G = A\\<^sub>F@A\\<^sub>G \\<and> \\<Psi>\\<^sub>F\\<^sub>G = \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G \\<and> F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle> \\<and> G = \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle> \\<and> A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G \\<and> A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F\\<close>\n    obtain A\\<^sub>F \\<Psi>\\<^sub>F A\\<^sub>G \\<Psi>\\<^sub>G where \"A\\<^sub>F\\<^sub>G' = A\\<^sub>F@A\\<^sub>G\" and \"([(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<^sub>G) = \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G\" and FrF: \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and FrG: \"G = \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle>\" and \"A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G\" and \"A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F\"\n      by metis\n\n    from \\<open>A\\<^sub>F\\<^sub>G' = A\\<^sub>F@A\\<^sub>G\\<close> \\<open>A\\<^sub>F\\<^sub>G = y#A\\<^sub>F\\<^sub>G'\\<close> have  \"A\\<^sub>F\\<^sub>G = (y#A\\<^sub>F)@A\\<^sub>G\" by simp\n    moreover from \\<open>A\\<^sub>F\\<^sub>G' = A\\<^sub>F@A\\<^sub>G\\<close> \\<open>y \\<sharp> A\\<^sub>F\\<^sub>G'\\<close> \\<open>x \\<sharp> A\\<^sub>F\\<^sub>G'\\<close> have \"x \\<sharp> A\\<^sub>F\" and \"y \\<sharp> A\\<^sub>F\" and \"x \\<sharp> A\\<^sub>G\" and \"y \\<sharp> A\\<^sub>G\" by simp+\n    with \\<open>y \\<sharp> G\\<close> \\<open>x \\<sharp> G\\<close> \\<open>x \\<sharp> A\\<^sub>F\\<^sub>G\\<close> FrG have \"y \\<sharp> \\<Psi>\\<^sub>G\" and \"x \\<sharp> \\<Psi>\\<^sub>G\" \n      by auto\n    from \\<open>([(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<^sub>G) = \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G\\<close> have \"([(x, y)] \\<bullet> [(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<^sub>G) = [(x, y)] \\<bullet> (\\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G)\"\n      by simp\n    with \\<open>x \\<sharp> \\<Psi>\\<^sub>G\\<close> \\<open>y \\<sharp> \\<Psi>\\<^sub>G\\<close> have \"\\<Psi>\\<^sub>F\\<^sub>G = ([(x, y)] \\<bullet> \\<Psi>\\<^sub>F) \\<otimes> \\<Psi>\\<^sub>G\" by(simp add: eqvts)\n    moreover from FrF have \"([(x, y)] \\<bullet> F) = [(x, y)] \\<bullet> \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" by simp\n    with \\<open>x \\<sharp> A\\<^sub>F\\<close> \\<open>y \\<sharp> A\\<^sub>F\\<close> have \"([(x, y)] \\<bullet> F) = \\<langle>A\\<^sub>F, [(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<rangle>\" by(simp add: eqvts)\n    hence \"\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> F) = \\<langle>(y#A\\<^sub>F), [(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<rangle>\" by(simp add: frame.inject)\n    with \\<open>y \\<sharp> F\\<close> have \"\\<lparr>\\<nu>x\\<rparr>F = \\<langle>(y#A\\<^sub>F), [(x, y)] \\<bullet> \\<Psi>\\<^sub>F\\<rangle>\" by(simp add: alphaFrameRes)\n    moreover with \\<open>A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F\\<close> have \"([(x, y)] \\<bullet> A\\<^sub>G) \\<sharp>* ([(x, y)] \\<bullet> \\<Psi>\\<^sub>F)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n    with \\<open>x \\<sharp> A\\<^sub>G\\<close> \\<open>y \\<sharp> A\\<^sub>G\\<close> have \"A\\<^sub>G \\<sharp>* ([(x, y)] \\<bullet> \\<Psi>\\<^sub>F)\" by simp\n    moreover from \\<open>A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G\\<close> \\<open>y \\<sharp> \\<Psi>\\<^sub>G\\<close> have \"(y#A\\<^sub>F) \\<sharp>* \\<Psi>\\<^sub>G\" by simp\n    ultimately show ?case using FrG \n      by blast\n  qed\n  with A show ?thesis by blast\nqed\n\n\n\nlemma mergeFrameRes2[simp]:\n  fixes A\\<^sub>F :: \"name list\"\n  and   \\<Psi>\\<^sub>F :: 'b\n  and   x   :: name\n  and   A\\<^sub>G :: \"name list\"\n  and   \\<Psi>\\<^sub>G :: 'b\n  \n  assumes \"A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G\"\n  and     \"A\\<^sub>G \\<sharp>* A\\<^sub>F\"\n  and     \"x \\<sharp> A\\<^sub>F\"\n  and     \"x \\<sharp> \\<Psi>\\<^sub>F\"\n  and     \"A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F\"\n  \n  shows \"(\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>) \\<otimes>\\<^sub>F (\\<lparr>\\<nu>x\\<rparr>(\\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle>)) = (\\<langle>(A\\<^sub>F@x#A\\<^sub>G), \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G\\<rangle>)\"\nusing assms\napply(fold frameResChain.simps)\nby(rule mergeFrames) auto\n\nlemma insertAssertionResChain[simp]:\n  fixes xvec :: \"name list\"\n  and   F    :: \"'b frame\"\n  and   \\<Psi>   :: 'b\n\n  assumes \"xvec \\<sharp>* \\<Psi>\"\n\n  shows \"insertAssertion (\\<lparr>\\<nu>*xvec\\<rparr>F) \\<Psi> = \\<lparr>\\<nu>*xvec\\<rparr>(insertAssertion F \\<Psi>)\"\nusing assms\nby(induct xvec) auto\n\nlemma extractFrameResChain[simp]:\n  fixes xvec :: \"name list\"\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  shows \"extractFrame(\\<lparr>\\<nu>*xvec\\<rparr>P) = \\<lparr>\\<nu>*xvec\\<rparr>(extractFrame P)\"\nby(induct xvec) auto\n\nlemma frameResFreshChain:\n  fixes xvec :: \"name list\"\n  and   F    :: \"'b frame\"\n\n  assumes \"xvec \\<sharp>* F\"\n\n  shows \"\\<lparr>\\<nu>*xvec\\<rparr>F \\<simeq>\\<^sub>F F\"\nusing assms\nproof(induct xvec)\n  case Nil\n  thus ?case by simp\nnext\n  case(Cons x xvec)\n  thus ?case\n    by auto (metis frameResPres frameResFresh FrameStatEqTrans)\nqed\n\nend\n\nlocale assertion = assertionAux SCompose SImp SBottom SChanEq\n  for SCompose  :: \"'b::fs_name \\<Rightarrow> 'b \\<Rightarrow> 'b\"\n  and SImp      :: \"'b \\<Rightarrow> 'c::fs_name \\<Rightarrow> bool\"\n  and SBottom   :: 'b\n  and SChanEq   :: \"'a::fs_name \\<Rightarrow> 'a \\<Rightarrow> 'c\" +\n\n  assumes chanEqSym:     \"SImp \\<Psi> (SChanEq M N) \\<Longrightarrow> SImp \\<Psi> (SChanEq N M)\"\n  and     chanEqTrans:   \"\\<lbrakk>SImp \\<Psi> (SChanEq M N); SImp \\<Psi> (SChanEq N L)\\<rbrakk> \\<Longrightarrow> SImp \\<Psi> (SChanEq M L)\"\n  and     Composition:   \"assertionAux.AssertionStatEq SImp \\<Psi> \\<Psi>' \\<Longrightarrow> assertionAux.AssertionStatEq SImp (SCompose \\<Psi> \\<Psi>'') (SCompose \\<Psi>' \\<Psi>'')\"\n  and     Identity:      \"assertionAux.AssertionStatEq SImp (SCompose \\<Psi> SBottom) \\<Psi>\"\n  and     Associativity: \"assertionAux.AssertionStatEq SImp (SCompose (SCompose \\<Psi> \\<Psi>') \\<Psi>'') (SCompose \\<Psi> (SCompose \\<Psi>' \\<Psi>''))\"\n  and     Commutativity: \"assertionAux.AssertionStatEq SImp (SCompose \\<Psi> \\<Psi>') (SCompose \\<Psi>' \\<Psi>)\"\n\nbegin\n\nnotation SCompose (infixr \"\\<otimes>\" 90)\nnotation SImp (\"_ \\<turnstile> _\" [85, 85] 85)\nnotation SChanEq (\"_ \\<leftrightarrow> _\" [90, 90] 90)\nnotation SBottom (\"\\<bottom>\" 90)\n\nlemma compositionSym:\n  fixes \\<Psi>   :: 'b\n  and   \\<Psi>'  :: 'b\n  and   \\<Psi>'' :: 'b\n\n  assumes \"\\<Psi> \\<simeq> \\<Psi>'\"\n\n  shows \"\\<Psi>'' \\<otimes> \\<Psi> \\<simeq> \\<Psi>'' \\<otimes> \\<Psi>'\"\nproof -\n  have \"\\<Psi>'' \\<otimes> \\<Psi> \\<simeq> \\<Psi> \\<otimes> \\<Psi>''\" by(rule Commutativity)\n  moreover from assms have \"\\<Psi> \\<otimes> \\<Psi>'' \\<simeq> \\<Psi>' \\<otimes> \\<Psi>''\" by(rule Composition)\n  moreover have \"\\<Psi>' \\<otimes> \\<Psi>'' \\<simeq> \\<Psi>'' \\<otimes> \\<Psi>'\" by(rule Commutativity)\n  ultimately show ?thesis by(blast intro: AssertionStatEqTrans)\nqed\n\nlemma Composition':\n  fixes \\<Psi>    :: 'b\n  and   \\<Psi>'   :: 'b\n  and   \\<Psi>''  :: 'b\n  and   \\<Psi>''' :: 'b\n\n  assumes \"\\<Psi> \\<simeq> \\<Psi>'\"\n  and     \"\\<Psi>'' \\<simeq> \\<Psi>'''\"\n  \n  shows \"\\<Psi> \\<otimes> \\<Psi>'' \\<simeq> \\<Psi>' \\<otimes> \\<Psi>'''\"\nusing assms\nby(metis Composition Commutativity AssertionStatEqTrans)\n  \n\nlemma composition':\n  fixes \\<Psi>    :: 'b\n  and   \\<Psi>'   :: 'b\n  and   \\<Psi>''  :: 'b\n  and   \\<Psi>''' :: 'b\n\n  assumes \"\\<Psi> \\<simeq> \\<Psi>'\"\n\n  shows \"(\\<Psi> \\<otimes> \\<Psi>'') \\<otimes> \\<Psi>''' \\<simeq> (\\<Psi>' \\<otimes> \\<Psi>'') \\<otimes> \\<Psi>'''\"\nproof -\n  have \"(\\<Psi> \\<otimes> \\<Psi>'') \\<otimes> \\<Psi>''' \\<simeq> \\<Psi> \\<otimes> (\\<Psi>'' \\<otimes> \\<Psi>''')\"\n    by(rule Associativity)\n  moreover from assms have \"\\<Psi> \\<otimes> (\\<Psi>'' \\<otimes> \\<Psi>''') \\<simeq> \\<Psi>' \\<otimes> (\\<Psi>'' \\<otimes> \\<Psi>''')\"\n    by(rule Composition)\n  moreover have \"\\<Psi>' \\<otimes> (\\<Psi>'' \\<otimes> \\<Psi>''') \\<simeq> (\\<Psi>' \\<otimes> \\<Psi>'') \\<otimes> \\<Psi>'''\"\n    by(rule Associativity[THEN AssertionStatEqSym])\n  ultimately show ?thesis by(blast dest: AssertionStatEqTrans)\nqed\n\nlemma associativitySym:\n  fixes \\<Psi>   :: 'b\n  and   \\<Psi>'  :: 'b\n  and   \\<Psi>'' :: 'b\n  \n  shows \"(\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>'' \\<simeq> (\\<Psi> \\<otimes> \\<Psi>'') \\<otimes> \\<Psi>'\"\nproof -\n  have \"(\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>'' \\<simeq> \\<Psi> \\<otimes> (\\<Psi>' \\<otimes> \\<Psi>'')\"\n    by(rule Associativity)\n  moreover have \"\\<Psi> \\<otimes> (\\<Psi>' \\<otimes> \\<Psi>'') \\<simeq> \\<Psi> \\<otimes> (\\<Psi>'' \\<otimes> \\<Psi>')\"\n    by(rule compositionSym[OF Commutativity])\n  moreover have \"\\<Psi> \\<otimes> (\\<Psi>'' \\<otimes> \\<Psi>') \\<simeq> (\\<Psi> \\<otimes> \\<Psi>'') \\<otimes> \\<Psi>'\"\n    by(rule AssertionStatEqSym[OF Associativity])\n  ultimately show ?thesis\n    by(blast dest: AssertionStatEqTrans)\nqed\n(*\nlemma frameChanEqSym:\n  fixes F :: \"'b frame\"\n  and   M :: 'a\n  and   N :: 'a\n\n  assumes \"F \\<turnstile>\\<^sub>F M \\<leftrightarrow> N\"\n  \n  shows \"F \\<turnstile>\\<^sub>F N \\<leftrightarrow> M\"\nusing assms\napply(auto simp add: FrameImp_def)\nby(force intro: chanEqSym simp add: FrameImp_def)\n\nlemma frameChanEqTrans:\n  fixes F :: \"'b frame\"\n  and   M :: 'a\n  and   N :: 'a\n\n  assumes \"F \\<turnstile>\\<^sub>F M \\<leftrightarrow> N\"\n  and     \"F \\<turnstile>\\<^sub>F N \\<leftrightarrow> L\"\n  \n  shows \"F \\<turnstile>\\<^sub>F M \\<leftrightarrow> L\"\nproof -\n  obtain A\\<^sub>F \\<Psi>\\<^sub>F where \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"A\\<^sub>F \\<sharp>* (M, N, L)\"\n    by(rule freshFrame)\n  with assms show ?thesis\n    by(force dest: frameImpE intro: frameImpI chanEqTrans)\nqed\n*)\nlemma frameIntAssociativity:\n  fixes A\\<^sub>F  :: \"name list\"\n  and   \\<Psi>   :: 'b\n  and   \\<Psi>'  :: 'b\n  and   \\<Psi>'' :: 'b\n\n  shows \"\\<langle>A\\<^sub>F, (\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>''\\<rangle> \\<simeq>\\<^sub>F \\<langle>A\\<^sub>F, \\<Psi> \\<otimes> (\\<Psi>' \\<otimes> \\<Psi>'')\\<rangle>\"\nby(induct A\\<^sub>F) (auto intro: Associativity frameResPres)\n\nlemma frameIntCommutativity:\n  fixes A\\<^sub>F  :: \"name list\"\n  and   \\<Psi>   :: 'b\n  and   \\<Psi>'  :: 'b\n\n  shows \"\\<langle>A\\<^sub>F, \\<Psi> \\<otimes> \\<Psi>'\\<rangle> \\<simeq>\\<^sub>F \\<langle>A\\<^sub>F, \\<Psi>' \\<otimes> \\<Psi>\\<rangle>\"\nby(induct A\\<^sub>F) (auto intro: Commutativity frameResPres)\n\nlemma frameIntIdentity:\n  fixes A\\<^sub>F :: \"name list\"\n  and   \\<Psi>\\<^sub>F :: 'b \n\n  shows \"\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F \\<otimes> SBottom\\<rangle> \\<simeq>\\<^sub>F \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\"\nby(induct A\\<^sub>F) (auto intro: Identity frameResPres)\n\nlemma frameIntComposition:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n  and   A\\<^sub>F :: \"name list\"\n  and   \\<Psi>\\<^sub>F :: 'b\n\n  assumes \"\\<Psi> \\<simeq> \\<Psi>'\"\n\n  shows \"\\<langle>A\\<^sub>F, \\<Psi> \\<otimes> \\<Psi>\\<^sub>F\\<rangle> \\<simeq>\\<^sub>F \\<langle>A\\<^sub>F, \\<Psi>' \\<otimes> \\<Psi>\\<^sub>F\\<rangle>\"\nusing assms\nby(induct A\\<^sub>F) (auto intro: Composition frameResPres)\n\nlemma frameIntCompositionSym:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n  and   A\\<^sub>F :: \"name list\"\n  and   \\<Psi>\\<^sub>F :: 'b\n\n  assumes \"\\<Psi> \\<simeq> \\<Psi>'\"\n\n  shows \"\\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<rangle> \\<simeq>\\<^sub>F \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F \\<otimes> \\<Psi>'\\<rangle>\"\nusing assms\nby(induct A\\<^sub>F) (auto intro: compositionSym frameResPres)\n\nlemma frameCommutativity:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\"\n\n  shows \"F \\<otimes>\\<^sub>F G \\<simeq>\\<^sub>F G \\<otimes>\\<^sub>F F\"\nproof -\n  obtain A\\<^sub>F \\<Psi>\\<^sub>F where \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"A\\<^sub>F \\<sharp>* G\"\n    by(rule freshFrame)\n  moreover obtain A\\<^sub>G \\<Psi>\\<^sub>G where \"G = \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle>\" and \"A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F\" and \"A\\<^sub>G \\<sharp>* A\\<^sub>F\"\n    by(rule_tac C=\"(A\\<^sub>F, \\<Psi>\\<^sub>F)\" in freshFrame) auto\n  moreover from \\<open>A\\<^sub>F \\<sharp>* G\\<close> \\<open>G = \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle>\\<close> \\<open>A\\<^sub>G \\<sharp>* A\\<^sub>F\\<close> have \"A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G\"\n    by auto\n  ultimately show ?thesis\n    by auto (metis FrameStatEqTrans frameChainAppend frameResChainComm frameIntCommutativity)\nqed\n  \nlemma frameScopeExt:\n  fixes x :: name\n  and   F :: \"'b frame\"\n  and   G :: \"'b frame\"\n\n  assumes \"x \\<sharp> F\"\n\n  shows \"\\<lparr>\\<nu>x\\<rparr>(F \\<otimes>\\<^sub>F G) \\<simeq>\\<^sub>F F \\<otimes>\\<^sub>F (\\<lparr>\\<nu>x\\<rparr>G)\"\nproof -\n  have \"\\<lparr>\\<nu>x\\<rparr>(F \\<otimes>\\<^sub>F G) \\<simeq>\\<^sub>F \\<lparr>\\<nu>x\\<rparr>(G \\<otimes>\\<^sub>F F)\"\n    by(metis frameResPres frameCommutativity)\n  with \\<open>x \\<sharp> F\\<close> have \"\\<lparr>\\<nu>x\\<rparr>(F \\<otimes>\\<^sub>F G) \\<simeq>\\<^sub>F (\\<lparr>\\<nu>x\\<rparr>G) \\<otimes>\\<^sub>F F\"\n    by simp\n  moreover have \"(\\<lparr>\\<nu>x\\<rparr>G) \\<otimes>\\<^sub>F F \\<simeq>\\<^sub>F F \\<otimes>\\<^sub>F (\\<lparr>\\<nu>x\\<rparr>G)\"\n    by(rule frameCommutativity)\n  ultimately show ?thesis by(rule FrameStatEqTrans)\nqed\n\nlemma insertDoubleAssertionStatEq:\n  fixes F  :: \"'b frame\"\n  and   \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n\n  shows \"insertAssertion(insertAssertion F \\<Psi>) \\<Psi>' \\<simeq>\\<^sub>F (insertAssertion F) (\\<Psi> \\<otimes> \\<Psi>')\"\nproof -\n  obtain A\\<^sub>F \\<Psi>\\<^sub>F where \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"A\\<^sub>F \\<sharp>* \\<Psi>\" and \"A\\<^sub>F \\<sharp>* \\<Psi>'\" and \"A\\<^sub>F \\<sharp>* (\\<Psi> \\<otimes> \\<Psi>')\"\n    by(rule_tac C=\"(\\<Psi>, \\<Psi>')\" in freshFrame) auto\n  thus ?thesis\n    by auto (metis frameIntComposition Commutativity frameIntAssociativity FrameStatEqTrans FrameStatEqSym)\nqed\n\nlemma guardedStatEq:\n  fixes P  :: \"('a, 'b, 'c) psi\"\n  and   I  :: \"('a, 'b, 'c) input\"\n  and   C  :: \"('a, 'b, 'c) psiCase\"\n  and   A\\<^sub>P :: \"name list\"\n  and   \\<Psi>\\<^sub>P :: 'b\n\n  shows \"\\<lbrakk>guarded P; extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\\<rbrakk> \\<Longrightarrow> \\<Psi>\\<^sub>P \\<simeq> \\<bottom> \\<and> supp \\<Psi>\\<^sub>P = ({}::name set)\"\n  and   \"\\<lbrakk>guarded' I; extractFrame' I = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\\<rbrakk> \\<Longrightarrow> \\<Psi>\\<^sub>P \\<simeq> \\<bottom> \\<and> supp \\<Psi>\\<^sub>P = ({}::name set)\"\n  and   \"\\<lbrakk>guarded'' C; extractFrame'' C = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\\<rbrakk> \\<Longrightarrow> \\<Psi>\\<^sub>P \\<simeq> \\<bottom> \\<and> supp \\<Psi>\\<^sub>P = ({}::name set)\"\nproof(nominal_induct P and I and C arbitrary: A\\<^sub>P \\<Psi>\\<^sub>P rule: psi_input_psiCase.strong_inducts)\n  case(PsiNil A\\<^sub>P \\<Psi>\\<^sub>P)\n  thus ?case by simp\nnext\n  case(Output M N P A\\<^sub>P \\<Psi>\\<^sub>P)\n  thus ?case by simp\nnext\n  case(Input M In  A\\<^sub>P \\<Psi>\\<^sub>P)\n  thus ?case by simp\nnext\n  case(Case psiCase A\\<^sub>P \\<Psi>\\<^sub>P)\n  thus ?case by simp\nnext\n  case(Par P Q A\\<^sub>P\\<^sub>Q \\<Psi>\\<^sub>P\\<^sub>Q)\n  from \\<open>guarded(P \\<parallel> Q)\\<close> have \"guarded P\" and \"guarded Q\" by simp+\n  obtain A\\<^sub>P \\<Psi>\\<^sub>P where FrP: \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* Q\" by(rule freshFrame)\n  obtain A\\<^sub>Q \\<Psi>\\<^sub>Q where FrQ: \"extractFrame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>\" and \"A\\<^sub>Q \\<sharp>* A\\<^sub>P\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\\<^sub>P\" \n    by(rule_tac C=\"(A\\<^sub>P, \\<Psi>\\<^sub>P)\" in freshFrame) auto\n  \n  from \\<open>\\<And>A\\<^sub>P \\<Psi>\\<^sub>P. \\<lbrakk>guarded P; extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\\<rbrakk> \\<Longrightarrow> \\<Psi>\\<^sub>P \\<simeq> \\<bottom> \\<and> (supp \\<Psi>\\<^sub>P = ({}::name set))\\<close> \\<open>guarded P\\<close> FrP\n  have \"\\<Psi>\\<^sub>P \\<simeq> \\<bottom>\" and \"supp \\<Psi>\\<^sub>P = ({}::name set)\" by simp+\n  from \\<open>\\<And>A\\<^sub>Q \\<Psi>\\<^sub>Q. \\<lbrakk>guarded Q; extractFrame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>\\<rbrakk> \\<Longrightarrow> \\<Psi>\\<^sub>Q \\<simeq> \\<bottom> \\<and> (supp \\<Psi>\\<^sub>Q = ({}::name set))\\<close> \\<open>guarded Q\\<close> FrQ\n  have \"\\<Psi>\\<^sub>Q \\<simeq> \\<bottom>\" and \"supp \\<Psi>\\<^sub>Q = ({}::name set)\" by simp+\n  \n  from \\<open>A\\<^sub>P \\<sharp>* Q\\<close> FrQ \\<open>A\\<^sub>Q \\<sharp>* A\\<^sub>P\\<close> have \"A\\<^sub>P \\<sharp>* \\<Psi>\\<^sub>Q\" by(drule_tac extractFrameFreshChain) auto\n  with \\<open>A\\<^sub>Q \\<sharp>* A\\<^sub>P\\<close> \\<open>A\\<^sub>Q \\<sharp>* \\<Psi>\\<^sub>P\\<close> FrP FrQ \\<open>extractFrame(P \\<parallel> Q) = \\<langle>A\\<^sub>P\\<^sub>Q, \\<Psi>\\<^sub>P\\<^sub>Q\\<rangle>\\<close> have \"\\<langle>(A\\<^sub>P@A\\<^sub>Q), \\<Psi>\\<^sub>P \\<otimes> \\<Psi>\\<^sub>Q\\<rangle> = \\<langle>A\\<^sub>P\\<^sub>Q, \\<Psi>\\<^sub>P\\<^sub>Q\\<rangle>\"\n    by auto\n  with \\<open>supp \\<Psi>\\<^sub>P = {}\\<close> \\<open>supp \\<Psi>\\<^sub>Q = {}\\<close> compSupp have \"\\<Psi>\\<^sub>P\\<^sub>Q = \\<Psi>\\<^sub>P \\<otimes> \\<Psi>\\<^sub>Q\"\n    by blast\n  moreover from \\<open>\\<Psi>\\<^sub>P \\<simeq> \\<bottom>\\<close> \\<open>\\<Psi>\\<^sub>Q \\<simeq> \\<bottom>\\<close> have \"\\<Psi>\\<^sub>P \\<otimes> \\<Psi>\\<^sub>Q \\<simeq> \\<bottom>\"\n    by(metis Composition Identity Associativity Commutativity AssertionStatEqTrans)\n  ultimately show ?case using \\<open>supp \\<Psi>\\<^sub>P = {}\\<close> \\<open>supp \\<Psi>\\<^sub>Q = {}\\<close> compSupp\n    by blast\nnext\n  case(Res x P A\\<^sub>x\\<^sub>P \\<Psi>\\<^sub>x\\<^sub>P)\n  from \\<open>guarded(\\<lparr>\\<nu>x\\<rparr>P)\\<close> have \"guarded P\" by simp\n  moreover obtain A\\<^sub>P \\<Psi>\\<^sub>P where FrP: \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" by(rule freshFrame)\n  moreover note \\<open>\\<And>A\\<^sub>P \\<Psi>\\<^sub>P. \\<lbrakk>guarded P; extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\\<rbrakk> \\<Longrightarrow> \\<Psi>\\<^sub>P \\<simeq> \\<bottom> \\<and> (supp \\<Psi>\\<^sub>P = ({}::name set))\\<close>\n  ultimately have \"\\<Psi>\\<^sub>P \\<simeq> \\<bottom>\" and \"supp \\<Psi>\\<^sub>P = ({}::name set)\" by auto\n  from FrP \\<open>extractFrame(\\<lparr>\\<nu>x\\<rparr>P) = \\<langle>A\\<^sub>x\\<^sub>P, \\<Psi>\\<^sub>x\\<^sub>P\\<rangle>\\<close> have \"\\<langle>(x#A\\<^sub>P), \\<Psi>\\<^sub>P\\<rangle> = \\<langle>A\\<^sub>x\\<^sub>P, \\<Psi>\\<^sub>x\\<^sub>P\\<rangle>\" by simp\n  with \\<open>supp \\<Psi>\\<^sub>P = {}\\<close> have \"\\<Psi>\\<^sub>P = \\<Psi>\\<^sub>x\\<^sub>P\" by(auto simp del: frameResChain.simps)\n  with \\<open>\\<Psi>\\<^sub>P \\<simeq> \\<bottom>\\<close> \\<open>supp \\<Psi>\\<^sub>P = {}\\<close> show ?case\n    by simp\nnext\n  case(Assert \\<Psi> A\\<^sub>P \\<Psi>\\<^sub>P)\n  thus ?case by simp\nnext\n  case(Bang P A\\<^sub>P \\<Psi>\\<^sub>P)\n  thus ?case by simp\nnext\n  case(Trm M P)\n  thus ?case by simp\nnext\n  case(Bind x I)\n  thus ?case by simp\nnext\n  case EmptyCase\n  thus ?case by simp\nnext\n  case(Cond \\<phi> P psiCase)\n  thus ?case by simp\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Frame.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961016, "lm_q2_score": 0.6039318337259583, "lm_q1q2_score": 0.3418366118838625}}
{"text": "theory Proto_EOArray\nimports LLVM_DS_NArray\nbegin\n  \n  subsection \\<open>List Assertion\\<close>\n\n  definition \"list_assn A \\<equiv> mk_assn (\\<lambda>xs xsi. \\<up>(length xs = length xsi) ** (\\<Union>*i\\<in>{0..<length xs}. \\<upharpoonleft>A (xs!i) (xsi!i)))\"\n\n  text \\<open>Inductive characterization\\<close>\n  lemma list_assn_ee_simp:\n    \"\\<upharpoonleft>(list_assn A) [] [] = \\<box>\"\n    unfolding list_assn_def\n    by (auto simp: sep_algebra_simps)\n  \n  lemma list_assn_nm_simp:\n    \"\\<upharpoonleft>(list_assn A) [] (xi#xsi) = sep_false\"\n    \"\\<upharpoonleft>(list_assn A) (x#xs) [] = sep_false\"\n    unfolding list_assn_def\n    by (auto simp: sep_algebra_simps)\n\n\n  lemma list_assn_cc_simp:\n    shows \"\\<upharpoonleft>(list_assn A) (x#xs) (xi#xsi) = (\\<upharpoonleft>A x xi ** \\<upharpoonleft>(list_assn A) xs xsi)\"\n  proof -\n    have intv_conv1: \"{0..<Suc n} = insert 0 (Suc`{0..<n})\" for n by auto\n    have 1: \"(\\<Union>*i\\<in>{0..<Suc n}. A i) = (A 0 ** (\\<Union>*i\\<in>{0..<n}. A (Suc i)))\" for A :: \"nat \\<Rightarrow> ll_assn\" and n\n      by (simp del: image_Suc_atLeastLessThan add: intv_conv1 sep_set_img_map)\n  \n    show ?thesis\n      unfolding list_assn_def\n      by (auto simp: sep_algebra_simps entails_lift_extract_simps entails_eq_iff 1)\n      \n  qed    \n  \n\n  lemmas list_assn_simps[simp] = list_assn_ee_simp list_assn_nm_simp list_assn_cc_simp\n  \n  lemma list_assn_empty1_conv[simp]: \"\\<upharpoonleft>(list_assn A) [] ys = \\<up>(ys=[])\"\n    by (cases ys) (auto simp: sep_algebra_simps)\n\n  lemma list_assn_empty2_conv[simp]: \"\\<upharpoonleft>(list_assn A) xs [] = \\<up>(xs=[])\"\n    by (cases xs) (auto simp: sep_algebra_simps)\n    \n    \n  lemma list_assn_cons1_conv: \"\\<upharpoonleft>(list_assn A) (x#xs) yys = (EXS y ys. \\<up>(yys=y#ys) ** \\<upharpoonleft>A x y ** \\<upharpoonleft>(list_assn A) xs ys)\"\n    apply (cases yys)\n    by (auto simp: entails_eq_iff sep_algebra_simps pred_lift_extract_simps)\n  \n  lemma list_assn_cons2_conv: \"\\<upharpoonleft>(list_assn A) xxs (y#ys) = (EXS x xs. \\<up>(xxs=x#xs) ** \\<upharpoonleft>A x y ** \\<upharpoonleft>(list_assn A) xs ys)\"\n    apply (cases xxs)\n    by (auto simp: entails_eq_iff sep_algebra_simps pred_lift_extract_simps)\n  \n  lemma list_assn_append1_conv: \"\\<upharpoonleft>(list_assn A) (xs\\<^sub>1@xs\\<^sub>2) yys = (EXS ys\\<^sub>1 ys\\<^sub>2. \\<up>(yys=ys\\<^sub>1@ys\\<^sub>2) ** \\<upharpoonleft>(list_assn A) xs\\<^sub>1 ys\\<^sub>1 ** \\<upharpoonleft>(list_assn A) xs\\<^sub>2 ys\\<^sub>2)\"\n    apply (induction xs\\<^sub>1 arbitrary: yys)\n    by (auto simp: sep_algebra_simps pred_lift_extract_simps list_assn_cons1_conv)\n  \n  lemma list_assn_append2_conv: \"\\<upharpoonleft>(list_assn A) xxs (ys\\<^sub>1@ys\\<^sub>2) = (EXS xs\\<^sub>1 xs\\<^sub>2. \\<up>(xxs=xs\\<^sub>1@xs\\<^sub>2) ** \\<upharpoonleft>(list_assn A) xs\\<^sub>1 ys\\<^sub>1 ** \\<upharpoonleft>(list_assn A) xs\\<^sub>2 ys\\<^sub>2)\"\n    apply (induction ys\\<^sub>1 arbitrary: xxs)\n    by (auto simp: sep_algebra_simps pred_lift_extract_simps list_assn_cons2_conv)\n\n  lemma list_assn_neq_len[simp]: \n    \"length xs \\<noteq> length xsi \\<Longrightarrow> \\<upharpoonleft>(list_assn A) xs xsi = sep_false\"  \n    \"length xsi \\<noteq> length xs \\<Longrightarrow> \\<upharpoonleft>(list_assn A) xs xsi = sep_false\"  \n    by (auto simp: list_assn_def)\n    \n  lemma list_assn_append[simp]: \"length xs\\<^sub>1 = length ys\\<^sub>1 \n    \\<Longrightarrow> \\<upharpoonleft>(list_assn A) (xs\\<^sub>1@xs\\<^sub>2) (ys\\<^sub>1@ys\\<^sub>2) = (\\<upharpoonleft>(list_assn A) xs\\<^sub>1 ys\\<^sub>1 ** \\<upharpoonleft>(list_assn A) xs\\<^sub>2 ys\\<^sub>2)\"  \n    apply (induction rule: list_induct2)\n    by (auto simp: sep_algebra_simps)\n    \n    \n  lemma list_assn_pure_part[vcg_prep_ext_rules]: \n    \"pure_part (\\<upharpoonleft>(list_assn A) xs ys) \\<Longrightarrow> length xs = length ys\" (* TODO: Extraction should also go to elements! *)  \n    unfolding list_assn_def\n    apply (vcg_prepare_external)\n    by (auto)\n    \n\n  definition \"oelem_assn A \\<equiv> mk_assn (\\<lambda>None \\<Rightarrow> \\<lambda>_. \\<box> | Some x \\<Rightarrow> \\<lambda>xi. \\<upharpoonleft>A x xi)\"\n\n  lemma oelem_assn_simps[simp]:\n    \"\\<upharpoonleft>(oelem_assn A) None xi = \\<box>\"\n    \"\\<upharpoonleft>(oelem_assn A) (Some x) xi = \\<upharpoonleft>A x xi\"  \n    unfolding oelem_assn_def by auto\n\n\n  lemma split_list_according:\n    assumes \"xs = xs\\<^sub>1@x#xs\\<^sub>2\"\n    assumes \"length ys = length xs\"\n    obtains ys\\<^sub>1 y ys\\<^sub>2 where \"ys = ys\\<^sub>1@y#ys\\<^sub>2\" \"length ys\\<^sub>1 = length xs\\<^sub>1\" \"length ys\\<^sub>2 = length xs\\<^sub>2\"\n      using assms\n      apply (subst (asm) id_take_nth_drop[of \"length xs\\<^sub>1\" ys])\n      by auto\n  \n\n  lemma lo_focus_elem_gen:\n    assumes \"i<length xs\" \"xs!i = Some x\"  \n    shows \"\\<upharpoonleft>(list_assn (oelem_assn A)) xs ys = ((\\<upharpoonleft>A x (ys!i)) ** \\<upharpoonleft>(list_assn (oelem_assn A)) (xs[i:=None]) (ys[i:=anything]))\"\n  proof (cases \"length ys = length xs\")\n    case [simp]: True\n    \n    obtain xs\\<^sub>1 xs\\<^sub>2 where XSF[simp]: \"xs = xs\\<^sub>1@Some x#xs\\<^sub>2\" and [simp]: \"i = length xs\\<^sub>1\" \n      using id_take_nth_drop[OF assms(1)] assms(2) by fastforce\n    obtain ys\\<^sub>1 y ys\\<^sub>2 where [simp]: \"ys = ys\\<^sub>1@y#ys\\<^sub>2\" \"length ys\\<^sub>1 = length xs\\<^sub>1\" \"length ys\\<^sub>2 = length xs\\<^sub>2\"\n      using split_list_according[OF XSF True] .\n      \n    show ?thesis\n      by (simp add: nth_append list_update_append sep_algebra_simps sep_conj_ac)\n      \n  qed simp\n      \n  text \\<open>Extract element from list assertion\\<close>\n  lemma lo_extract_elem:\n    assumes \"i<length xs\" \"xs!i = Some x\"  \n    shows \"\\<upharpoonleft>(list_assn (oelem_assn A)) xs ys = ((\\<upharpoonleft>A x (ys!i)) ** \\<upharpoonleft>(list_assn (oelem_assn A)) (xs[i:=None]) ys)\"\n    by (metis list_update_id lo_focus_elem_gen[OF assms])\n    \n  \n  text \\<open>Insert element into list assertion\\<close>  \n  lemma lo_insert_elem:\n    assumes \"i<length xs\" \"xs!i = None\"\n    shows \"\\<upharpoonleft>(list_assn (oelem_assn A)) (xs[i:=Some x]) (ys[i:=y]) = (\\<upharpoonleft>A x y ** \\<upharpoonleft>(list_assn (oelem_assn A)) xs ys)\"\n    apply (cases \"length ys = length xs\")\n    using lo_focus_elem_gen[of i \"xs[i:=Some x]\" x A \"ys[i:=y]\" \"ys!i\"] using assms\n    apply simp_all\n    by (metis list_update_id)\n    \n  \n  definition \"nao_assn A \\<equiv> mk_assn (\\<lambda>xs p. EXS xsi. \\<upharpoonleft>narray_assn xsi p ** \\<upharpoonleft>(list_assn (oelem_assn A)) xs xsi)\"\n\n  \n  lemma nao_nth_rule[vcg_rules]: \"llvm_htriple \n    (\\<upharpoonleft>(nao_assn A) xs p \\<and>* \\<upharpoonleft>snat.assn i ii \\<and>* \\<up>\\<^sub>d(i < length xs \\<and> xs!i\\<noteq>None)) \n    (array_nth p ii)\n    (\\<lambda>ri. \\<upharpoonleft>A (the (xs!i)) ri \\<and>* \\<upharpoonleft>(nao_assn A) (xs[i:=None]) p)\"  \n    unfolding nao_assn_def\n    supply [simp] = lo_extract_elem\n    apply vcg'\n    done\n  \n  \n  lemma nao_upd_rule_snat[vcg_rules]: \"llvm_htriple \n    (\\<upharpoonleft>(nao_assn A) xs p \\<and>* \\<upharpoonleft>A x xi \\<and>* \\<upharpoonleft>snat.assn i ii \\<and>* \\<up>\\<^sub>d(i < length xs \\<and> xs!i=None)) \n    (array_upd p ii xi)\n    (\\<lambda>r. \\<up>(r = p) \\<and>* \\<upharpoonleft>(nao_assn A) (xs[i := Some x]) p)\"\n    unfolding nao_assn_def \n    supply [simp] = lo_insert_elem\n    apply vcg'\n    done\n    \n(*\n  xxx, ctd here: new, free, then integrate into sepref!   \n    XXX: First integrate into sepref, than care about new and free.\n      for sorting algos, we only need get and set!\n        \n*)    \n    \n    \n    \n        \n  \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/ds/Proto_EOArray.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.34183661188386244}}
{"text": "(*\n * Copyright 2017, Data61\n * Commonwealth Scientific and Industrial Research Organisation (CSIRO)\n * ABN 41 687 119 230.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n\n * @TAG(DATA61_BSD)\n *)\n\n(*<*)\ntheory EChronos_arm_sched_prop_state\n\nimports\n  \"../lib/Rule_By_Method\"\nbegin\n(*>*)\n\nsection \\<open>Model\\<close>\n\ntext \\<open>\nWe present here a model of the ARM Cortex-M4 version of the eChronos\nOS scheduling behaviour, formalised in Isabelle/HOL. It is based on\nLeonor Prensa's formalisation of Owicki-Gries in Isabelle/HOL.\n\\<close>\n\nsubsection\\<open>State\\<close>\n\ntext \\<open>\nA routine is just a natural number; we add routines for the $svc_a$\nand $svc_s$ handlers, user routines have numbers from @{text 2} to @{text\n\"nbUsers+2\"}(excluded) and interrupt routines have numbers from @{text\n\"nbUsers+2\"} to @{text \"nbUsers+nbInts+2\"} (excluded). The first user\nto run is arbitrarily chosen to be the first one.\n\\<close>\n    \ntype_synonym routine = nat\n\nconsts nbUsers :: nat\nconsts nbInts :: nat\n\nabbreviation \"nbRoutines \\<equiv> nbUsers+nbInts\"\n\ndefinition \"svc\\<^sub>a \\<equiv> 0 :: routine\"\ndefinition \"svc\\<^sub>s \\<equiv> 1 :: routine\"\ndefinition \"user0 \\<equiv> 2 :: routine\"\ndefinition \"U \\<equiv> {user0..<user0 + nbUsers}\"\ndefinition \"I \\<equiv> {user0 + nbUsers..< user0 + nbRoutines}\"\ndefinition \"I' \\<equiv> I \\<union> {svc\\<^sub>a, svc\\<^sub>s}\"\n\n(*<*)\n\n\nlemma [simp]: \"\\<lbrakk>user0 \\<le> i; i < nbRoutines; i \\<notin> I\\<rbrakk> \\<Longrightarrow> i \\<in> U\"\n  by (simp add: I_def U_def)\n\nlemma [simp]:\n  \"svc\\<^sub>a \\<notin> I\"\n  \"svc\\<^sub>s \\<notin> I\"\n  by (auto simp: svc\\<^sub>a_def svc\\<^sub>s_def I_def user0_def)\n\nlemma [simp]:\n  \"svc\\<^sub>a \\<in> I'\"\n  \"svc\\<^sub>s \\<in> I'\"\n  by (auto simp: I'_def)\n\nlemma I_sub_I'[simp]: \"I \\<subseteq> I'\"\n  by (auto simp: I_def I'_def)\n\nlemma [simp]:\n  \"x \\<in> I \\<Longrightarrow> x \\<noteq> svc\\<^sub>a\"\n  \"x \\<in> I \\<Longrightarrow> x \\<noteq> svc\\<^sub>s\"\n  by auto\n\nlemma [dest]:\n  \"x \\<in> I' \\<Longrightarrow> x \\<noteq> svc\\<^sub>a \\<Longrightarrow> x \\<noteq> svc\\<^sub>s \\<Longrightarrow> x \\<in> I\"\n  by (auto simp: I'_def)\n\nlemma [simp]:\n  \"svc\\<^sub>s \\<noteq> svc\\<^sub>a\"\n  \"svc\\<^sub>a \\<noteq> svc\\<^sub>s\"\n  \"svc\\<^sub>a \\<noteq> user0\"\n  \"svc\\<^sub>s \\<noteq> user0\"\n  by (auto simp: svc\\<^sub>s_def svc\\<^sub>a_def user0_def)\n\nlemmas subset_trans[OF _ I_sub_I', simp, intro]\n\nlemma [simp]: \"\\<lbrakk>user0 \\<le> x; x < user0 + nbRoutines; x \\<notin> I\\<rbrakk> \\<Longrightarrow> x \\<notin> I'\"\n  by (simp add: I_def I'_def svc\\<^sub>a_def svc\\<^sub>s_def user0_def)\n\nlemma [simp]: \"\\<lbrakk>user0 \\<le> x; x < user0 + nbRoutines; x \\<notin> I\\<rbrakk> \\<Longrightarrow> x \\<in> U\"\n  by (simp add: I_def I'_def svc\\<^sub>a_def user0_def U_def)\n\nlemma [simp]:\n  \"user0 \\<le> x \\<Longrightarrow> x < user0 + nbRoutines \\<Longrightarrow> (x \\<notin> I') = (x \\<in> U)\"\n  by (auto simp: I_def I'_def U_def svc\\<^sub>a_def svc\\<^sub>s_def user0_def)\n\nlemma [simp]:\n  \"x \\<in> I \\<Longrightarrow> x \\<notin> U\"\n  by (auto simp: I_def U_def)\n\nlemma [simp]:\n  \"x \\<in> I' \\<Longrightarrow> x \\<notin> U\"\n  by (auto simp: I'_def I_def U_def svc\\<^sub>a_def svc\\<^sub>s_def user0_def)\n\nlemma [simp]:\n  \"svc\\<^sub>a \\<notin> U\"\n  \"svc\\<^sub>s \\<notin> U\"\n  by (auto simp: svc\\<^sub>a_def svc\\<^sub>s_def user0_def U_def)\n\nlemma [simp]:\n  \"x \\<in> U \\<Longrightarrow> x \\<noteq> svc\\<^sub>a\"\n  \"x \\<in> U \\<Longrightarrow> x \\<noteq> svc\\<^sub>s\"\n  by auto\n\nlemma [simp]:\n  \"nbUsers >0 \\<Longrightarrow> nbInts > 0 \\<Longrightarrow> user0 \\<le> nbRoutines\"\n  by (simp add: user0_def)\n\nlemmas [simp] = set_rev_mp[where A=I and B=I', simplified]\n(*>*)\n\ndatatype ghostU = User | Syscall | Yield\ndatatype syscall = SignalSend | Block\n\ntext\\<open>\n\\noindent\nA state is composed of all the hardware variables, the program\nvariables that the targeted invariant or property relies on, plus\npotential ghost variables used for reasoning.\n\\<close>\n\nrecord state =\n  EIT :: \"routine set\"                                                        \\<comment> \"the set of enabled interrupt tasks\"\n  svc\\<^sub>aReq :: bool                                                         \\<comment> \"the $svc_a$ requested bit\"\n  AT :: routine                                                               \\<comment> \"the active routine\"\n  ATStack :: \"routine list\"                                                 \\<comment> \"the stack of suspended routines\"\n\nrecord eChronos_state = state +\n  curUser :: routine                                                       \\<comment> \"current user task\"\n  contexts :: \"routine \\<Rightarrow> (bool \\<times> routine list) option\"     \\<comment> \"stored contexts\"\n  R :: \"routine \\<Rightarrow> bool option\"                                         \\<comment> \"Runnable threads\"\n  E :: \"nat set\"                                                                  \\<comment> \"Events set (current)\"\n  E_tmp :: \"nat set\"                                                           \\<comment> \"Temporary events set\"\n  nextT :: \"routine option\"                                                \\<comment> \"the next Task\"\n  userSyscall :: syscall\n\n  ghostP :: bool                     \\<comment> \"ghost var saying if $svc_a$ routine is executing\"\n  ghostS :: bool                     \\<comment> \"ghost var saying if $svc_s$ routine is executing\"\n  ghostU :: \"routine \\<Rightarrow> ghostU\"      \\<comment> \"ghost var tracking the program counter of user routines\"\n\nlocale foo\n  =\n  fixes Rec :: \"'a eChronos_state_scheme\"\n  begin\n  \nlemmas r_surj = eChronos_state.surjective[of Rec,symmetric]\n\nlemmas foo = state.update_convs[of \"\\<lambda>_. X\" for X, @ (schematic) \\<open>subst (asm) r_surj\\<close>,symmetric]\n             eChronos_state.update_convs[of \"\\<lambda>_. X\" for X, @ (schematic) \\<open>subst (asm) r_surj\\<close>,symmetric]\n\nlemmas foo' = state.select_convs(1) state.select_convs(2) state.select_convs(3)\n              state.select_convs(4) select_convs\n\nlemmas foos =  foo'[@ (schematic) \\<open>subst (asm) foo(1)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(2)\\<close>] \n               foo'[@ (schematic) \\<open>subst (asm) foo(3)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(4)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(6)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(7)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(8)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(9)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(10)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(11)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(12)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(13)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(14)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(15)\\<close>]\n               foo'[@ (schematic) \\<open>subst (asm) foo(16)\\<close>]\n               \n\nend\n\nlemmas eChronos_state_upd_simps = foo.foos \n\n(*--------------------------------------------------------------------------*)\n\nsubsection \\<open>Generic scheduling policy, handling of events and interrupt policy\\<close>\n\ntext\\<open>\nThe scheduling policy (picking the next thread, given the list of\nrunnable threads) is left unspecified here; as well as the updating of\nthis runnable list, given a list of events. The interrupt policy\n(which interrupts are allowed to run, given the currently running\nroutine) is also left unspecified. We have several assumptions about\nthese functions.\nFIXME: these should be assumptions of the lemma, or in a locale\n(context) for the lemma.\n\\<close>\n\nconsts sched_policy :: \"(routine \\<Rightarrow> bool option) \\<Rightarrow> routine option\"\nconsts handle_events :: \"nat set \\<Rightarrow> (routine \\<Rightarrow> bool option) \\<Rightarrow> routine \\<Rightarrow> bool option\"\nconsts interrupt_policy :: \"routine \\<Rightarrow> routine set\"\n(* definition \"interrupt_policy i \\<equiv> {i..<Suc nbRoutines} \\<inter> {nbUsers..<Suc nbRoutines}\" *)\n\ntext\\<open>The scheduler picks a user task (not an interrupt).\\<close>\naxiomatization where sched_picks_user:\n  \"sched_policy xs = t \\<Longrightarrow> t= None \\<or> (\\<exists>n. t=Some n \\<and> n \\<in> U)\"\n\ntext \\<open>Running @{text handle_events} when the irq events set is empty returns the\n        runnable set taken as input.\\<close>\naxiomatization where handle_events_empty:\n  \"handle_events {} runn = runn \"\n\ntext\\<open>user0 is the highest priority task. This is for the invariant to \n   be true initially, where user0 is picked to run first.\\<close>\naxiomatization where user0_is_highest:\n  \"sched_policy (\\<lambda>n. if n\\<in>U then Some True else None) = Some user0\"\n\naxiomatization where interrupt_policy_svc\\<^sub>a:\n  \"interrupt_policy svc\\<^sub>a = I\"\n\naxiomatization where interrupt_policy_svc\\<^sub>s:\n  \"interrupt_policy svc\\<^sub>s = I\"\n\naxiomatization where interrupt_policy_self:\n  \"x \\<notin> interrupt_policy x\"\n\naxiomatization where interrupt_policy_I:\n  \"x \\<in> I \\<Longrightarrow> interrupt_policy x \\<subseteq> I\"\n\naxiomatization where interrupt_policy_I':\n  \"interrupt_policy x \\<subseteq> I'\"\n\naxiomatization where interrupt_policy_U:\n  \"x \\<in> U \\<Longrightarrow> interrupt_policy x = I'\"\n\naxiomatization where interrupt_policy_mono:\n  \"y \\<in> interrupt_policy x \\<Longrightarrow> interrupt_policy y \\<subseteq> interrupt_policy x\"\n\nlemma svc\\<^sub>a_svc\\<^sub>s_priority[simp]:\n  \"svc\\<^sub>a \\<notin> interrupt_policy svc\\<^sub>s\"\n  \"svc\\<^sub>s \\<notin> interrupt_policy svc\\<^sub>a\"\n  by (auto simp: interrupt_policy_svc\\<^sub>s interrupt_policy_svc\\<^sub>a)\n\nlemma interrupt_policy_svc\\<^sub>a':\n  \"x \\<in> I' \\<Longrightarrow> svc\\<^sub>a \\<notin> interrupt_policy x\"\n  unfolding I'_def\n  apply (erule UnE)\n   apply (fastforce dest: interrupt_policy_I)\n  apply (fastforce simp: interrupt_policy_self)\n  done\n\nlemma interrupt_policy_svc\\<^sub>s':\n  \"x \\<in> I' \\<Longrightarrow> svc\\<^sub>s \\<notin> interrupt_policy x\"\n  unfolding I'_def\n  apply (erule UnE)\n   apply (fastforce dest: interrupt_policy_I)\n  apply (fastforce simp: interrupt_policy_self)\n  done\n\nlemma interrupt_policy_trans:\n  \"y \\<in> interrupt_policy x \\<Longrightarrow> z \\<in> interrupt_policy y \\<Longrightarrow> z \\<in> interrupt_policy x\"\n  apply (rule basic_trans_rules(30), simp)\n  apply (erule interrupt_policy_mono)\n  done\n\nlemma interrupt_policy_not_refl:\n  \"x \\<in> interrupt_policy y \\<Longrightarrow> y \\<notin> interrupt_policy x\"\n  apply clarsimp\n  apply (drule (1) interrupt_policy_trans)\n  apply (simp add: interrupt_policy_self)\n  done\n\n(*--------------------------------------------------------------------------*)\n\nsubsection \\<open>The scheduler invariant\\<close>\n\ntext \\<open>\nThe scheduler invariant states that the running user is the one with\nhighest priority. In other words, if the active routine is a user, and\nif preemption is on (we're not in an rtos call, and the user hasn't\nturned off preemption), then if we were to update the list of runnable\nthreads from occurred events, and compute which thread should be\nrunning, we would find the currently running user thread.\n\\<close>\n\ndefinition\n  \"sched_inv x i \\<equiv>\n    i \\<in> U \\<and> svc\\<^sub>a \\<in> EIT x \\<and> \\<not> svc\\<^sub>aReq x\n        \\<longrightarrow> sched_policy (handle_events (E x) (R x)) = Some i\"\n\ndefinition\n  \"scheduler_invariant x \\<equiv> sched_inv x (AT x)\"\n\n(*--------------------------------------------------------------------------*)\n\nsubsection \\<open>The assumed invariants\\<close>\n\ntext \\<open>\nThe invariants that we assume while proving that the scheduler\ninvariant holds. The aim is to then prove that these invariants hold\nindependently.\n\\<close>\n\ndefinition\n  \"EIT_inv x \\<equiv> (*finite (EIT x) \\<and>*) EIT x \\<subseteq> I'\"\n\ntext \\<open>If a user is making an rtos call then preemption is disabled\\<close>\ndefinition\n  \"ghostU_inv x \\<equiv> (\\<exists>i. (ghostU x) i = Syscall) \\<longrightarrow> svc\\<^sub>a \\<notin> EIT x\"\n\ntext \\<open>Only one user can be making an rtos call\\<close>\ndefinition\n  \"ghostU_inv2 x \\<equiv> (\\<forall>j. j \\<noteq> last (AT x # ATStack x)\\<longrightarrow> (ghostU x) j \\<noteq> Syscall)\"\n\ntext \\<open>If a user routine has yielded its context is stored correctly\\<close>\ndefinition\n  \"ghostU_inv3 x \\<equiv>\n    (\\<forall>i. i \\<in> U \\<and> (ghostU x) i = Yield \\<longrightarrow>\n      curUser x = i \\<or> fst (the ((contexts x) i)) = False)\"\n\ntext \\<open>If the $svc_a$ handler is running then only interrupts can be active\\<close>\ndefinition\n  \"ghostP_inv x \\<equiv> ghostP x \\<longrightarrow> AT x \\<in> I'\"\n\ntext \\<open>If ghostP or ghostS is true then the respective task is in the\n  ATStack\\<close>\ndefinition\n  \"ghostP_S_stack_inv x \\<equiv> (ghostP x \\<longrightarrow> svc\\<^sub>a \\<in> set (AT x # ATStack x)) \\<and>\n      (ghostS x \\<longrightarrow> svc\\<^sub>s \\<in> set (AT x # ATStack x))\"\n\ndefinition\n  \"stack_distinct_inv x \\<equiv> distinct (AT x # ATStack x)\"\n\ntext \\<open>The last element of the stack is a user\\<close>\ndefinition\n  \"last_stack_inv x \\<equiv> last (AT x # ATStack x) \\<in> U\"\n\ntext \\<open>Everything but the last of the stack is an interrupt\\<close>\ndefinition\n  \"butlast_stack_inv x \\<equiv> set (butlast (AT x # ATStack x)) \\<subseteq> I'\"\n\ntext \\<open>The saved stack for every user is the singleton list of just that user.\\<close>\ndefinition\n  \"contexts_stack_inv x \\<equiv> \\<forall>i \\<in> U. snd (the ((contexts x) i)) = [i]\"\n\ntext \\<open>The $svc_s$ and $svc_a$ handlers cannot be executing at the same time.\\<close>\ndefinition\n  \"ghostS_ghostP_inv x \\<equiv> \\<not> ghostS x \\<or> \\<not> ghostP x\"\n\nfun sorted_by_policy where\n  \"sorted_by_policy [] = True\"\n| \"sorted_by_policy [x] = True\"\n| \"sorted_by_policy (x # xs) = (x \\<in> interrupt_policy (hd xs) \\<and> sorted_by_policy xs)\"\n\ntext \\<open>The stack is ordered by the interrupt\\_policy\\<close>\ndefinition\n  \"priority_inv x \\<equiv> sorted_by_policy (AT x # ATStack x)\"\n\n(*<*)\n\nlemmas inv_defs = scheduler_invariant_def\n                  sched_inv_def EIT_inv_def ghostU_inv_def\n                  ghostU_inv2_def ghostU_inv3_def ghostP_inv_def\n                  stack_distinct_inv_def last_stack_inv_def\n                  contexts_stack_inv_def butlast_stack_inv_def\n                  priority_inv_def ghostS_ghostP_inv_def\n                  ghostP_S_stack_inv_def\n\nlemma sorted_by_policy_hd:\n  \"sorted_by_policy xs \\<Longrightarrow> x \\<in> set (tl xs) \\<Longrightarrow> (hd xs) \\<in> interrupt_policy x\"\n  apply (induct rule: sorted_by_policy.induct)\n    apply simp\n   apply simp\n  apply (fastforce simp: interrupt_policy_self interrupt_policy_trans)\n  done\n\nlemma sorted_by_policy_tl[simp]:\n  \"sorted_by_policy xs \\<Longrightarrow> xs \\<noteq> [] \\<Longrightarrow> sorted_by_policy (tl xs)\"\n  by (rule sorted_by_policy.cases) auto\n\nlemma sorted_by_policy_Cons[simp]:\n  \"sorted_by_policy (x # xs) \\<Longrightarrow> sorted_by_policy xs\"\n  by (cases xs) auto\n\nlemma sorted_by_policy_hd':\n  \"\\<lbrakk>sorted_by_policy xs; x \\<in> set xs \\<rbrakk> \\<Longrightarrow> x \\<notin> interrupt_policy (hd xs)\"\n  apply (cases xs, simp)\n  apply clarsimp\n  apply (erule disjE)\n   apply (clarsimp simp: interrupt_policy_self)\n  apply (frule sorted_by_policy_hd, simp)\n  apply (clarsimp dest!: interrupt_policy_not_refl)\n  done\n\nlemma sorted_by_policy_Cons_hd:\n  \"sorted_by_policy (x # xs) \\<Longrightarrow> xs \\<noteq> [] \\<Longrightarrow> x \\<in> interrupt_policy (hd xs)\"\n  by (cases xs) auto\n(*>*)\n\nend\n", "meta": {"author": "echronos", "repo": "echronos-proofs", "sha": "5983821e591c6878f1fe96aa831e11c5c97ce385", "save_path": "github-repos/isabelle/echronos-echronos-proofs", "path": "github-repos/isabelle/echronos-echronos-proofs/echronos-proofs-5983821e591c6878f1fe96aa831e11c5c97ce385/verif/EChronos_arm_sched_prop_state.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.34183661188386244}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Peter Lammich <peter dot lammich at uni-muenster.de>\n    Maintainer:  Peter Lammich <peter dot lammich at uni-muenster.de>\n*)\nsection {* \\isaheader{Specification of Maps} *}\ntheory MapSpec\nimports ICF_Spec_Base\nbegin\ntext_raw{*\\label{thy:MapSpec}*}\n\n(*@intf Map\n  @abstype 'k\\<rightharpoonup>'v\n  This interface specifies maps from keys to values.\n*)\n\ntext {*\n  This theory specifies map operations by means of mapping to\n  HOL's map type, i.e. @{typ \"'k \\<rightharpoonup> 'v\"}.\n*}\n\ntype_synonym ('k,'v,'s) map_\\<alpha> = \"'s \\<Rightarrow> 'k \\<rightharpoonup> 'v\"\ntype_synonym ('k,'v,'s) map_invar = \"'s \\<Rightarrow> bool\"\nlocale map = \n  fixes \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"                 -- \"Abstraction to map datatype\"\n  fixes invar :: \"'s \\<Rightarrow> bool\"                 -- \"Invariant\"\n\nlocale map_no_invar = map +\n  assumes invar[simp, intro!]: \"\\<And>s. invar s\"\n\nsubsection \"Basic Map Functions\"\n\nsubsubsection \"Empty Map\"\ntype_synonym ('k,'v,'s) map_empty = \"unit \\<Rightarrow> 's\"\nlocale map_empty = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes empty :: \"unit \\<Rightarrow> 's\"\n  assumes empty_correct:\n    \"\\<alpha> (empty ()) = Map.empty\"\n    \"invar (empty ())\"\n\nsubsubsection \"Lookup\"\ntype_synonym ('k,'v,'s) map_lookup = \"'k \\<Rightarrow> 's \\<Rightarrow> 'v option\"\nlocale map_lookup = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes lookup :: \"'u \\<Rightarrow> 's \\<Rightarrow> 'v option\"\n  assumes lookup_correct:\n    \"invar m \\<Longrightarrow> lookup k m = \\<alpha> m k\"\n\nsubsubsection \"Update\"\ntype_synonym ('k,'v,'s) map_update = \"'k \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_update = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes update :: \"'u \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes update_correct:\n    \"invar m \\<Longrightarrow> \\<alpha> (update k v m) = (\\<alpha> m)(k \\<mapsto> v)\"\n    \"invar m \\<Longrightarrow> invar (update k v m)\"\n\nsubsubsection \"Disjoint Update\"\ntype_synonym ('k,'v,'s) map_update_dj = \"'k \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_update_dj = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes update_dj :: \"'u \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes update_dj_correct: \n    \"\\<lbrakk>invar m; k\\<notin>dom (\\<alpha> m)\\<rbrakk> \\<Longrightarrow> \\<alpha> (update_dj k v m) = (\\<alpha> m)(k \\<mapsto> v)\"\n    \"\\<lbrakk>invar m; k\\<notin>dom (\\<alpha> m)\\<rbrakk> \\<Longrightarrow> invar (update_dj k v m)\"\n\n \nsubsubsection \"Delete\"\ntype_synonym ('k,'v,'s) map_delete = \"'k \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_delete = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes delete :: \"'u \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes delete_correct: \n    \"invar m \\<Longrightarrow> \\<alpha> (delete k m) = (\\<alpha> m) |` (-{k})\"\n    \"invar m \\<Longrightarrow> invar (delete k m)\"\n\nsubsubsection \"Add\"\ntype_synonym ('k,'v,'s) map_add = \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_add = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes add :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes add_correct:\n    \"invar m1 \\<Longrightarrow> invar m2 \\<Longrightarrow> \\<alpha> (add m1 m2) = \\<alpha> m1 ++ \\<alpha> m2\"\n    \"invar m1 \\<Longrightarrow> invar m2 \\<Longrightarrow> invar (add m1 m2)\"\n\ntype_synonym ('k,'v,'s) map_add_dj = \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_add_dj = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes add_dj :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes add_dj_correct:\n    \"\\<lbrakk>invar m1; invar m2; dom (\\<alpha> m1) \\<inter> dom (\\<alpha> m2) = {}\\<rbrakk> \\<Longrightarrow> \\<alpha> (add_dj m1 m2) = \\<alpha> m1 ++ \\<alpha> m2\"\n    \"\\<lbrakk>invar m1; invar m2; dom (\\<alpha> m1) \\<inter> dom (\\<alpha> m2) = {} \\<rbrakk> \\<Longrightarrow> invar (add_dj m1 m2)\"\n\nsubsubsection \"Emptiness Check\"\ntype_synonym ('k,'v,'s) map_isEmpty = \"'s \\<Rightarrow> bool\"\nlocale map_isEmpty = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes isEmpty :: \"'s \\<Rightarrow> bool\"\n  assumes isEmpty_correct : \"invar m \\<Longrightarrow> isEmpty m \\<longleftrightarrow> \\<alpha> m = Map.empty\"\n\nsubsubsection \"Singleton Maps\"\ntype_synonym ('k,'v,'s) map_sng = \"'k \\<Rightarrow> 'v \\<Rightarrow> 's\"\nlocale map_sng = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes sng :: \"'u \\<Rightarrow> 'v \\<Rightarrow> 's\"\n  assumes sng_correct : \n    \"\\<alpha> (sng k v) = [k \\<mapsto> v]\"\n    \"invar (sng k v)\"\n\ntype_synonym ('k,'v,'s) map_isSng = \"'s \\<Rightarrow> bool\"\nlocale map_isSng = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'k \\<rightharpoonup> 'v\"\n  fixes isSng :: \"'s \\<Rightarrow> bool\"\n  assumes isSng_correct:\n    \"invar s \\<Longrightarrow> isSng s \\<longleftrightarrow> (\\<exists>k v. \\<alpha> s = [k \\<mapsto> v])\"\nbegin\n  lemma isSng_correct_exists1 :\n    \"invar s \\<Longrightarrow> (isSng s \\<longleftrightarrow> (\\<exists>!k. \\<exists>v. (\\<alpha> s k = Some v)))\"\n    apply (auto simp add: isSng_correct split: split_if_asm)\n    apply (rule_tac x=k in exI)\n    apply (rule_tac x=v in exI)\n    apply (rule ext)\n    apply (case_tac \"\\<alpha> s x\")\n    apply auto\n    apply force\n    done\n\n  lemma isSng_correct_card :\n    \"invar s \\<Longrightarrow> (isSng s \\<longleftrightarrow> (card (dom (\\<alpha> s)) = 1))\"\n    by (auto simp add: isSng_correct card_Suc_eq dom_eq_singleton_conv)\n\nend\n\nsubsubsection \"Finite Maps\"\nlocale finite_map = map +\n  assumes finite[simp, intro!]: \"invar m \\<Longrightarrow> finite (dom (\\<alpha> m))\"\n\nsubsubsection \"Size\"\ntype_synonym ('k,'v,'s) map_size = \"'s \\<Rightarrow> nat\"\nlocale map_size = finite_map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes size :: \"'s \\<Rightarrow> nat\"\n  assumes size_correct: \"invar s \\<Longrightarrow> size s = card (dom (\\<alpha> s))\"\n  \ntype_synonym ('k,'v,'s) map_size_abort = \"nat \\<Rightarrow> 's \\<Rightarrow> nat\"\nlocale map_size_abort = finite_map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes size_abort :: \"nat \\<Rightarrow> 's \\<Rightarrow> nat\"\n  assumes size_abort_correct: \"invar s \\<Longrightarrow> size_abort m s = min m (card (dom (\\<alpha> s)))\"\n\nsubsubsection \"Iterators\"\ntext {*\n  An iteration combinator over a map applies a function to a state for each \n  map entry, in arbitrary order.\n  Proving of properties is done by invariant reasoning.\n  An iterator can also contain a continuation condition. Iteration is\n  interrupted if the condition becomes false.\n*}\n\n(* Deprecated *)\n(*locale map_iteratei = finite_map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes iteratei :: \"'s \\<Rightarrow> ('u \\<times> 'v,'\\<sigma>) set_iterator\"\n\n  assumes iteratei_rule: \"invar m \\<Longrightarrow> map_iterator (iteratei m) (\\<alpha> m)\"\nbegin\n  lemma iteratei_rule_P:\n    assumes \"invar m\"\n        and I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n        and IP: \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                    \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n        and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n        and II: \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> {}; \\<not> c \\<sigma>; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using map_iterator_rule_P [OF iteratei_rule, of m I \\<sigma>0 c f P]\n    by (simp_all add: assms)\n\n  lemma iteratei_rule_insert_P:\n    assumes  \n      \"invar m\" \n      \"I {} \\<sigma>0\"\n      \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n          \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>)\"\n      \"!!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> dom (\\<alpha> m); \n               \\<not> (c \\<sigma>); \n               I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using map_iterator_rule_insert_P [OF iteratei_rule, of m I \\<sigma>0 c f P]\n    by (simp_all add: assms)\n\n  lemma iterate_rule_P:\n    \"\\<lbrakk>\n      invar m;\n      I (dom (\\<alpha> m)) \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iteratei m (\\<lambda>_. True) f \\<sigma>0)\"\n    using iteratei_rule_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by fast\n\n  lemma iterate_rule_insert_P:\n    \"\\<lbrakk>\n      invar m;\n      I {} \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iteratei m (\\<lambda>_. True) f \\<sigma>0)\"\n    using iteratei_rule_insert_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by fast\nend\n\nlemma map_iteratei_I :\n  assumes \"\\<And>m. invar m \\<Longrightarrow> map_iterator (iti m) (\\<alpha> m)\"\n  shows \"map_iteratei \\<alpha> invar iti\"\nproof\n  fix m \n  assume invar_m: \"invar m\"\n  from assms(1)[OF invar_m] show it_OK: \"map_iterator (iti m) (\\<alpha> m)\" .\n  \n  from set_iterator_genord.finite_S0 [OF it_OK[unfolded set_iterator_def]]\n  show \"finite (dom (\\<alpha> m))\" by (simp add: finite_map_to_set) \nqed\n*)\n\ntype_synonym ('k,'v,'s) map_list_it\n  = \"'s \\<Rightarrow> ('k\\<times>'v,('k\\<times>'v) list) set_iterator\"\nlocale poly_map_iteratei_defs =\n  fixes list_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\"\nbegin\n  definition iteratei :: \"'s \\<Rightarrow> ('u\\<times>'v,'\\<sigma>) set_iterator\"\n    where \"iteratei S \\<equiv> it_to_it (list_it S)\"\n\n  abbreviation \"iterate m \\<equiv> iteratei m (\\<lambda>_. True)\"\nend\n\nlocale poly_map_iteratei =\n  finite_map + poly_map_iteratei_defs list_it\n  for list_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\" +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  assumes list_it_correct: \"invar m \\<Longrightarrow> map_iterator (list_it m) (\\<alpha> m)\"\nbegin\n  lemma iteratei_correct: \"invar S \\<Longrightarrow> map_iterator (iteratei S) (\\<alpha> S)\"\n    unfolding iteratei_def\n    apply (rule it_to_it_correct)\n    by (rule list_it_correct)\n\n  lemma pi_iteratei[icf_proper_iteratorI]: \n    \"proper_it (iteratei S) (iteratei S)\"\n    unfolding iteratei_def \n    by (intro icf_proper_iteratorI)\n\n  lemma iteratei_rule_P:\n    assumes \"invar m\"\n    and I0: \"I (map_to_set (\\<alpha> m)) \\<sigma>0\"\n    and IP: \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; (k,v) \\<in> it; it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (it - {(k,v)}) (f (k, v) \\<sigma>)\"\n    and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and II: \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> map_to_set (\\<alpha> m); it \\<noteq> {}; \\<not> c \\<sigma>; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    apply (rule set_iterator_rule_P[OF iteratei_correct])\n    apply fact\n    apply fact\n    apply (case_tac x, simp add: IP)\n    apply fact\n    apply fact\n    done\n\n  lemma iteratei_rule_insert_P:\n    assumes \"invar m\" \n    and \"I {} \\<sigma>0\"\n    and \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; (k,v) \\<in> (map_to_set (\\<alpha> m) - it); \n                       it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (insert (k,v) it) (f (k, v) \\<sigma>)\"\n    and \"!!\\<sigma>. I (map_to_set (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> map_to_set (\\<alpha> m); it \\<noteq> map_to_set (\\<alpha> m); \n                  \\<not> (c \\<sigma>); \n                  I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    apply (rule set_iterator_rule_insert_P[OF iteratei_correct])\n    apply fact\n    apply fact\n    apply (case_tac x, simp add: assms)\n    apply fact\n    apply fact\n    done\n\n  lemma iterate_rule_P:\n    assumes \"invar m\"\n    and I0: \"I (map_to_set (\\<alpha> m)) \\<sigma>0\"\n    and IP: \"!!k v it \\<sigma>. \\<lbrakk> (k,v) \\<in> it; it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (it - {(k,v)}) (f (k, v) \\<sigma>)\"\n    and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterate m f \\<sigma>0)\"\n    apply (rule iteratei_rule_P)\n    apply fact\n    apply (rule I0)\n    apply (rule IP, assumption+) []\n    apply (rule IF, assumption)\n    apply simp\n    done\n\n  lemma iterate_rule_insert_P:\n    assumes \"invar m\" \n    and I0: \"I {} \\<sigma>0\"\n    and \"!!k v it \\<sigma>. \\<lbrakk> (k,v) \\<in> (map_to_set (\\<alpha> m) - it); \n                       it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (insert (k,v) it) (f (k, v) \\<sigma>)\"\n    and \"!!\\<sigma>. I (map_to_set (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterate m f \\<sigma>0)\"\n    apply (rule iteratei_rule_insert_P)\n    apply fact\n    apply (rule I0)\n    apply (rule assms, assumption+) []\n    apply (rule assms, assumption)\n    apply simp\n    done\n    \n  lemma old_iteratei_rule_P:\n    assumes \"invar m\"\n    and I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    and IP: \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and II: \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> {}; \\<not> c \\<sigma>; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using assms\n    by (rule map_iterator_rule_P[OF iteratei_correct])\n\n  lemma old_iteratei_rule_insert_P:\n    assumes \"invar m\" \n    and \"I {} \\<sigma>0\"\n    and \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; \n                       it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>)\"\n    and \"!!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> dom (\\<alpha> m); \n                  \\<not> (c \\<sigma>); \n                  I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using assms by (rule map_iterator_rule_insert_P[OF iteratei_correct])\n\n  lemma old_iterate_rule_P:\n    \"\\<lbrakk>\n      invar m;\n      I (dom (\\<alpha> m)) \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iterate m f \\<sigma>0)\"\n    using old_iteratei_rule_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\n  lemma old_iterate_rule_insert_P:\n    \"\\<lbrakk>\n      invar m;\n      I {} \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; \n                    it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iteratei m (\\<lambda>_. True) f \\<sigma>0)\"\n    using old_iteratei_rule_insert_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\n  end\n\n\nsubsubsection \"Bounded Quantification\"\ntype_synonym ('k,'v,'s) map_ball = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\nlocale map_ball = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes ball :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  assumes ball_correct: \"invar m \\<Longrightarrow> ball m P \\<longleftrightarrow> (\\<forall>u v. \\<alpha> m u = Some v \\<longrightarrow> P (u, v))\"\n\ntype_synonym ('k,'v,'s) map_bex = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\nlocale map_bex = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes bex :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  assumes bex_correct: \n    \"invar m \\<Longrightarrow> bex m P \\<longleftrightarrow> (\\<exists>u v. \\<alpha> m u = Some v \\<and> P (u, v))\"\n\n\nsubsubsection \"Selection of Entry\"\ntype_synonym ('k,'v,'s,'r) map_sel = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> 'r option) \\<Rightarrow> 'r option\"\nlocale map_sel = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes sel :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> 'r option) \\<Rightarrow> 'r option\"\n  assumes selE: \n  \"\\<lbrakk> invar m; \\<alpha> m u = Some v; f (u, v) = Some r; \n     !!u v r. \\<lbrakk> sel m f = Some r; \\<alpha> m u = Some v; f (u, v) = Some r \\<rbrakk> \\<Longrightarrow> Q \n   \\<rbrakk> \\<Longrightarrow> Q\"\n  assumes selI: \n    \"\\<lbrakk> invar m; \\<forall>u v. \\<alpha> m u = Some v \\<longrightarrow> f (u, v) = None \\<rbrakk> \\<Longrightarrow> sel m f = None\"\n\nbegin\n  lemma sel_someE: \n    \"\\<lbrakk> invar m; sel m f = Some r; \n       !!u v. \\<lbrakk> \\<alpha> m u = Some v; f (u, v) = Some r \\<rbrakk> \\<Longrightarrow> P\n     \\<rbrakk> \\<Longrightarrow> P\"\n    apply (cases \"\\<exists>u v r. \\<alpha> m u = Some v \\<and> f (u, v) = Some r\")\n    apply safe\n    apply (erule_tac u=u and v=v and r=ra in selE)\n    apply assumption\n    apply assumption\n    apply simp\n    apply (auto)\n    apply (drule (1) selI)\n    apply simp\n    done\n\n  lemma sel_noneD: \"\\<lbrakk>invar m; sel m f = None; \\<alpha> m u = Some v\\<rbrakk> \\<Longrightarrow> f (u, v) = None\"\n    apply (rule ccontr)\n    apply simp\n    apply (erule exE)\n    apply (erule_tac f=f and u=u and v=v and r=y in selE)\n    apply auto\n    done\n\nend\n\n  -- \"Equivalent description of sel-map properties\"\nlemma map_sel_altI:\n  assumes S1: \n    \"!!s f r P. \\<lbrakk> invar s; sel s f = Some r; \n                  !!u v. \\<lbrakk>\\<alpha> s u = Some v; f (u, v) = Some r\\<rbrakk> \\<Longrightarrow> P\n                \\<rbrakk> \\<Longrightarrow> P\"\n  assumes S2: \n    \"!!s f u v. \\<lbrakk>invar s; sel s f = None; \\<alpha> s u = Some v\\<rbrakk> \\<Longrightarrow> f (u, v) = None\"\n  shows \"map_sel \\<alpha> invar sel\"\nproof -\n  show ?thesis\n    apply (unfold_locales)\n    apply (case_tac \"sel m f\")\n    apply (force dest: S2)\n    apply (force elim: S1)\n    apply (case_tac \"sel m f\")\n    apply assumption\n    apply (force elim: S1)\n    done\nqed\n\n\nsubsubsection \"Selection of Entry (without mapping)\"\ntype_synonym ('k,'v,'s) map_sel' = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k\\<times>'v) option\"\nlocale map_sel' = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes sel' :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('u\\<times>'v) option\"\n  assumes sel'E: \n  \"\\<lbrakk> invar m; \\<alpha> m u = Some v; P (u, v); \n     !!u v. \\<lbrakk> sel' m P = Some (u,v); \\<alpha> m u = Some v; P (u, v)\\<rbrakk> \\<Longrightarrow> Q \n   \\<rbrakk> \\<Longrightarrow> Q\"\n  assumes sel'I: \n    \"\\<lbrakk> invar m; \\<forall>u v. \\<alpha> m u = Some v \\<longrightarrow> \\<not> P (u, v) \\<rbrakk> \\<Longrightarrow> sel' m P = None\"\n\nbegin\n  lemma sel'_someE: \n    \"\\<lbrakk> invar m; sel' m P = Some (u,v); \n       !!u v. \\<lbrakk> \\<alpha> m u = Some v; P (u, v) \\<rbrakk> \\<Longrightarrow> thesis\n     \\<rbrakk> \\<Longrightarrow> thesis\"\n    apply (cases \"\\<exists>u v. \\<alpha> m u = Some v \\<and> P (u, v)\")\n    apply safe\n    apply (erule_tac u=ua and v=va in sel'E)\n    apply assumption\n    apply assumption\n    apply simp\n    apply (auto)\n    apply (drule (1) sel'I)\n    apply simp\n    done\n\n  lemma sel'_noneD: \"\\<lbrakk>invar m; sel' m P = None; \\<alpha> m u = Some v\\<rbrakk> \\<Longrightarrow> \\<not> P (u, v)\"\n    apply (rule ccontr)\n    apply simp\n    apply (erule (2) sel'E[where P=P])\n    apply auto\n    done\n\n  lemma sel'_SomeD:\n    \"\\<lbrakk> sel' m P = Some (u, v); invar m \\<rbrakk> \\<Longrightarrow> \\<alpha> m u = Some v \\<and> P (u, v)\"\n    apply(cases \"\\<exists>u' v'. \\<alpha> m u' = Some v' \\<and> P (u', v')\")\n     apply clarsimp\n     apply(erule (2) sel'E[where P=P])\n     apply simp\n    apply(clarsimp)\n    apply(drule (1) sel'I)\n    apply simp\n    done\nend\n\nsubsubsection \"Map to List Conversion\"\ntype_synonym ('k,'v,'s) map_to_list = \"'s \\<Rightarrow> ('k\\<times>'v) list\"\nlocale map_to_list = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes to_list :: \"'s \\<Rightarrow> ('u\\<times>'v) list\"\n  assumes to_list_correct: \n    \"invar m \\<Longrightarrow> map_of (to_list m) = \\<alpha> m\"\n    \"invar m \\<Longrightarrow> distinct (map fst (to_list m))\"\n\n\nsubsubsection \"List to Map Conversion\"\ntype_synonym ('k,'v,'s) list_to_map = \"('k\\<times>'v) list \\<Rightarrow> 's\"\nlocale list_to_map = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes to_map :: \"('u\\<times>'v) list \\<Rightarrow> 's\"\n  assumes to_map_correct:\n    \"\\<alpha> (to_map l) = map_of l\"\n    \"invar (to_map l)\"\n\nsubsubsection \"Image of a Map\"\n\ntext {* This locale allows to apply a function to both the keys and\n the values of a map while at the same time filtering entries. *}\n\ndefinition transforms_to_unique_keys ::\n  \"('u1 \\<rightharpoonup> 'v1) \\<Rightarrow> ('u1 \\<times> 'v1 \\<rightharpoonup> ('u2 \\<times> 'v2)) \\<Rightarrow> bool\"\n  where\n  \"transforms_to_unique_keys m f \\<equiv> (\\<forall>k1 k2 v1 v2 k' v1' v2'. ( \n         m k1 = Some v1 \\<and>\n         m k2 = Some v2 \\<and>\n         f (k1, v1) = Some (k', v1') \\<and>\n         f (k2, v2) = Some (k', v2')) -->\n       (k1 = k2))\"\n\ntype_synonym ('k1,'v1,'m1,'k2,'v2,'m2) map_image_filter  \n  = \"('k1 \\<times> 'v1 \\<Rightarrow> ('k2 \\<times> 'v2) option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n\nlocale map_image_filter = m1: map \\<alpha>1 invar1 + m2: map \\<alpha>2 invar2\n  for \\<alpha>1 :: \"'m1 \\<Rightarrow> 'u1 \\<rightharpoonup> 'v1\" and invar1\n  and \\<alpha>2 :: \"'m2 \\<Rightarrow> 'u2 \\<rightharpoonup> 'v2\" and invar2\n  +\n  fixes map_image_filter :: \"('u1 \\<times> 'v1 \\<Rightarrow> ('u2 \\<times> 'v2) option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n  assumes map_image_filter_correct_aux1:\n    \"\\<And>k' v'. \n     \\<lbrakk>invar1 m; transforms_to_unique_keys (\\<alpha>1 m) f\\<rbrakk> \\<Longrightarrow> \n     (invar2 (map_image_filter f m) \\<and>\n      ((\\<alpha>2 (map_image_filter f m) k' = Some v') \\<longleftrightarrow>\n       (\\<exists>k v. (\\<alpha>1 m k = Some v) \\<and> f (k, v) = Some (k', v'))))\"\nbegin\n\n  (*Let's use a definition for the precondition *)\n\n  lemma map_image_filter_correct_aux2 :\n    assumes \"invar1 m\" \n      and \"transforms_to_unique_keys (\\<alpha>1 m) f\"\n    shows \"(\\<alpha>2 (map_image_filter f m) k' = None) \\<longleftrightarrow>\n      (\\<forall>k v v'. \\<alpha>1 m k = Some v \\<longrightarrow> f (k, v) \\<noteq> Some (k', v'))\"\n  proof -\n    note map_image_filter_correct_aux1 [OF assms]\n    have Some_eq: \"\\<And>v'. (\\<alpha>2 (map_image_filter f m) k' = Some v') =\n          (\\<exists>k v. \\<alpha>1 m k = Some v \\<and> f (k, v) = Some (k', v'))\"\n      by (simp add: map_image_filter_correct_aux1 [OF assms])\n    \n    have intro_some: \"(\\<alpha>2 (map_image_filter f m) k' = None) \\<longleftrightarrow>\n                      (\\<forall>v'. \\<alpha>2 (map_image_filter f m) k' \\<noteq> Some v')\" by auto\n    \n    from intro_some Some_eq show ?thesis by auto\n  qed\n\n  lemmas map_image_filter_correct = \n     conjunct1 [OF map_image_filter_correct_aux1] \n     conjunct2 [OF map_image_filter_correct_aux1] \n     map_image_filter_correct_aux2\nend\n    \n\ntext {* Most of the time the mapping function is only applied to values. Then,\n  the precondition disapears.*}\ntype_synonym ('k,'v1,'m1,'k2,'v2,'m2) map_value_image_filter  \n  = \"('k \\<Rightarrow> 'v1 \\<Rightarrow> 'v2 option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n\nlocale map_value_image_filter = m1: map \\<alpha>1 invar1 + m2: map \\<alpha>2 invar2\n  for \\<alpha>1 :: \"'m1 \\<Rightarrow> 'u \\<rightharpoonup> 'v1\" and invar1\n  and \\<alpha>2 :: \"'m2 \\<Rightarrow> 'u \\<rightharpoonup> 'v2\" and invar2\n  +\n  fixes map_value_image_filter :: \"('u \\<Rightarrow> 'v1 \\<Rightarrow> 'v2 option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n  assumes map_value_image_filter_correct_aux:\n    \"invar1 m \\<Longrightarrow> \n     invar2 (map_value_image_filter f m) \\<and>\n     (\\<alpha>2 (map_value_image_filter f m) = \n      (\\<lambda>k. Option.bind (\\<alpha>1 m k) (f k)))\"\nbegin\n\n  lemmas map_value_image_filter_correct =\n    conjunct1[OF map_value_image_filter_correct_aux]\n    conjunct2[OF map_value_image_filter_correct_aux]\n\n\n  lemma map_value_image_filter_correct_alt :\n    \"invar1 m \\<Longrightarrow> \n     invar2 (map_value_image_filter f m)\"\n    \"invar1 m \\<Longrightarrow>\n     (\\<alpha>2 (map_value_image_filter f m) k = Some v') \\<longleftrightarrow>\n     (\\<exists>v. (\\<alpha>1 m k = Some v) \\<and> f k v = Some v')\"\n    \"invar1 m \\<Longrightarrow>\n     (\\<alpha>2 (map_value_image_filter f m) k = None) \\<longleftrightarrow>\n     (\\<forall>v. (\\<alpha>1 m k = Some v) --> f k v = None)\"\n  proof -\n    assume invar_m : \"invar1 m\"\n    note aux = map_value_image_filter_correct_aux [OF invar_m]\n\n    from aux show \"invar2 (map_value_image_filter f m)\" by simp\n    from aux show \"(\\<alpha>2 (map_value_image_filter f m) k = Some v') \\<longleftrightarrow>\n     (\\<exists>v. (\\<alpha>1 m k = Some v) \\<and> f k v = Some v')\" \n      by (cases \"\\<alpha>1 m k\", simp_all)\n    from aux show \"(\\<alpha>2 (map_value_image_filter f m) k = None) \\<longleftrightarrow>\n     (\\<forall>v. (\\<alpha>1 m k = Some v) --> f k v = None)\" \n      by (cases \"\\<alpha>1 m k\", simp_all)\n  qed\nend\n\ntype_synonym ('k,'v,'m1,'m2) map_restrict = \"('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\nlocale map_restrict = m1: map \\<alpha>1 invar1 + m2: map \\<alpha>2 invar2 \n  for \\<alpha>1 :: \"'m1 \\<Rightarrow> 'u \\<rightharpoonup> 'v\" and invar1\n  and \\<alpha>2 :: \"'m2 \\<Rightarrow> 'u \\<rightharpoonup> 'v\" and invar2\n  +\n  fixes restrict :: \"('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n  assumes restrict_correct_aux1 :\n    \"invar1 m \\<Longrightarrow> \\<alpha>2 (restrict P m) = \\<alpha>1 m |` {k. \\<exists>v. \\<alpha>1 m k = Some v \\<and> P (k, v)}\"\n    \"invar1 m \\<Longrightarrow> invar2 (restrict P m)\"\nbegin\n  lemma restrict_correct_aux2 :\n    \"invar1 m \\<Longrightarrow> \\<alpha>2 (restrict (\\<lambda>(k,_). P k) m) = \\<alpha>1 m |` {k. P k}\"\n  proof -\n    assume invar_m : \"invar1 m\"\n    have \"\\<alpha>1 m |` {k. (\\<exists>v. \\<alpha>1 m k = Some v) \\<and> P k} = \\<alpha>1 m |` {k. P k}\"\n      (is \"\\<alpha>1 m |` ?A1 = \\<alpha>1 m |` ?A2\")\n    proof\n      fix k\n      show \"(\\<alpha>1 m |` ?A1) k = (\\<alpha>1 m |` ?A2) k\"\n      proof (cases \"k \\<in> ?A2\")\n        case False thus ?thesis by simp\n      next\n        case True\n        hence P_k : \"P k\" by simp\n\n        show ?thesis\n          by (cases \"\\<alpha>1 m k\", simp_all add: P_k)\n      qed\n    qed\n    with invar_m show \"\\<alpha>2 (restrict (\\<lambda>(k, _). P k) m) = \\<alpha>1 m |` {k. P k}\"\n      by (simp add: restrict_correct_aux1)\n  qed\n\n  lemmas restrict_correct = \n     restrict_correct_aux1\n     restrict_correct_aux2\nend\n\n\nsubsection \"Ordered Maps\"\n  locale ordered_map = map \\<alpha> invar \n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n\n  locale ordered_finite_map = finite_map \\<alpha> invar + ordered_map \\<alpha> invar\n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n\nsubsubsection {* Ordered Iteration *}\n  (* Deprecated *)\n(*\n  locale map_iterateoi = ordered_finite_map \\<alpha> invar\n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n    +\n    fixes iterateoi :: \"'s \\<Rightarrow> ('u \\<times> 'v,'\\<sigma>) set_iterator\"\n    assumes iterateoi_rule: \"\n      invar m \\<Longrightarrow> map_iterator_linord (iterateoi m) (\\<alpha> m)\"\n  begin\n    lemma iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n        c \\<sigma>; \n        k \\<in> it; \n        \\<forall>j\\<in>it. k\\<le>j; \n        \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<le>k; \n        \\<alpha> m k = Some v; \n        it \\<subseteq> dom (\\<alpha> m); \n        I it \\<sigma> \n      \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      assumes II: \"!!\\<sigma> it. \\<lbrakk> \n        it \\<subseteq> dom (\\<alpha> m); \n        it \\<noteq> {}; \n        \\<not> c \\<sigma>; \n        I it \\<sigma>; \n        \\<forall>k\\<in>it. \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<le>k \n      \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (iterateoi m c f \\<sigma>0)\"\n    using map_iterator_linord_rule_P [OF iterateoi_rule, of m I \\<sigma>0 c f P] assms\n    by simp\n\n    lemma iterateo_rule_P[case_names minv inv0 inv_pres i_complete]: \n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> k \\<in> it; \\<forall>j\\<in>it. k\\<le>j; \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<le>k; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (iterateoi m (\\<lambda>_. True) f \\<sigma>0)\"\n    using map_iterator_linord_rule_P [OF iterateoi_rule, of m I \\<sigma>0 \"\\<lambda>_. True\" f P] assms\n    by simp\n  end\n\n  lemma map_iterateoi_I :\n  assumes \"\\<And>m. invar m \\<Longrightarrow> map_iterator_linord (itoi m) (\\<alpha> m)\"\n  shows \"map_iterateoi \\<alpha> invar itoi\"\n  proof\n    fix m \n    assume invar_m: \"invar m\"\n    from assms(1)[OF invar_m] show it_OK: \"map_iterator_linord (itoi m) (\\<alpha> m)\" .\n  \n    from set_iterator_genord.finite_S0 [OF it_OK[unfolded set_iterator_map_linord_def]]\n    show \"finite (dom (\\<alpha> m))\" by (simp add: finite_map_to_set) \n  qed\n\n  locale map_reverse_iterateoi = ordered_finite_map \\<alpha> invar \n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n    +\n    fixes reverse_iterateoi :: \"'s \\<Rightarrow> ('u \\<times> 'v,'\\<sigma>) set_iterator\"\n    assumes reverse_iterateoi_rule: \"\n      invar m \\<Longrightarrow> map_iterator_rev_linord (reverse_iterateoi m) (\\<alpha> m)\"\n  begin\n    lemma reverse_iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n        c \\<sigma>; \n        k \\<in> it; \n        \\<forall>j\\<in>it. k\\<ge>j; \n        \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<ge>k; \n        \\<alpha> m k = Some v; \n        it \\<subseteq> dom (\\<alpha> m); \n        I it \\<sigma> \n      \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      assumes II: \"!!\\<sigma> it. \\<lbrakk> \n        it \\<subseteq> dom (\\<alpha> m); \n        it \\<noteq> {}; \n        \\<not> c \\<sigma>; \n        I it \\<sigma>; \n        \\<forall>k\\<in>it. \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<ge>k \n      \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (reverse_iterateoi m c f \\<sigma>0)\"\n    using map_iterator_rev_linord_rule_P [OF reverse_iterateoi_rule, of m I \\<sigma>0 c f P] assms\n    by simp\n\n    lemma reverse_iterateo_rule_P[case_names minv inv0 inv_pres i_complete]:\n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n        k \\<in> it; \n        \\<forall>j\\<in>it. k\\<ge>j; \n        \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<ge>k; \n        \\<alpha> m k = Some v; \n        it \\<subseteq> dom (\\<alpha> m); \n        I it \\<sigma> \n      \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (reverse_iterateoi m (\\<lambda>_. True) f \\<sigma>0)\"\n    using map_iterator_rev_linord_rule_P[OF reverse_iterateoi_rule, of m I \\<sigma>0 \"\\<lambda>_. True\" f P] assms\n    by simp\n  end\n\n  lemma map_reverse_iterateoi_I :\n  assumes \"\\<And>m. invar m \\<Longrightarrow> map_iterator_rev_linord (ritoi m) (\\<alpha> m)\"\n  shows \"map_reverse_iterateoi \\<alpha> invar ritoi\"\n  proof\n    fix m \n    assume invar_m: \"invar m\"\n    from assms(1)[OF invar_m] show it_OK: \"map_iterator_rev_linord (ritoi m) (\\<alpha> m)\" .\n  \n    from set_iterator_genord.finite_S0 [OF it_OK[unfolded set_iterator_map_rev_linord_def]]\n    show \"finite (dom (\\<alpha> m))\" by (simp add: finite_map_to_set) \n  qed\n*)\n\nlocale poly_map_iterateoi_defs =\n  fixes olist_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\"\nbegin\n  definition iterateoi :: \"'s \\<Rightarrow> ('u\\<times>'v,'\\<sigma>) set_iterator\"\n    where \"iterateoi S \\<equiv> it_to_it (olist_it S)\"\n\n  abbreviation \"iterateo m \\<equiv> iterateoi m (\\<lambda>_. True)\"\nend\n\nlocale poly_map_iterateoi =\n  finite_map \\<alpha> invar + poly_map_iterateoi_defs list_ordered_it\n  for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" \n  and invar \n  and list_ordered_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\" +\n  assumes list_ordered_it_correct: \"invar m \n    \\<Longrightarrow> map_iterator_linord (list_ordered_it m) (\\<alpha> m)\"\nbegin\n  lemma iterateoi_correct: \"invar S \\<Longrightarrow> map_iterator_linord (iterateoi S) (\\<alpha> S)\"\n    unfolding iterateoi_def\n    apply (rule it_to_it_map_linord_correct)\n    by (rule list_ordered_it_correct)\n\n  lemma pi_iterateoi[icf_proper_iteratorI]: \n    \"proper_it (iterateoi S) (iterateoi S)\"\n    unfolding iterateoi_def \n    by (intro icf_proper_iteratorI)\n\n\n  lemma iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      c \\<sigma>; \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<le>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<le>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    assumes II: \"!!\\<sigma> it. \\<lbrakk> \n      it \\<subseteq> dom (\\<alpha> m); \n      it \\<noteq> {}; \n      \\<not> c \\<sigma>; \n      I it \\<sigma>; \n      \\<And>k j. \\<lbrakk>k\\<in>it; j\\<in>dom (\\<alpha> m) - it\\<rbrakk> \\<Longrightarrow> j\\<le>k \n    \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterateoi m c f \\<sigma>0)\"\n    using assms by (rule map_iterator_linord_rule_P[OF iterateoi_correct])\n\n  lemma iterateo_rule_P[case_names minv inv0 inv_pres i_complete]: \n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<le>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<le>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterateo m f \\<sigma>0)\"\n    using assms \n      map_iterator_linord_rule_P[OF iterateoi_correct, of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\nend\n  \ntype_synonym ('k,'v,'s) map_list_rev_it\n  = \"'s \\<Rightarrow> ('k\\<times>'v,('k\\<times>'v) list) set_iterator\"\n\nlocale poly_map_rev_iterateoi_defs =\n  fixes list_rev_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\"\nbegin\n  definition rev_iterateoi :: \"'s \\<Rightarrow> ('u\\<times>'v,'\\<sigma>) set_iterator\"\n    where \"rev_iterateoi S \\<equiv> it_to_it (list_rev_it S)\"\n\n  abbreviation \"rev_iterateo m \\<equiv> rev_iterateoi m (\\<lambda>_. True)\"\n  abbreviation \"reverse_iterateoi \\<equiv> rev_iterateoi\"\n  abbreviation \"reverse_iterateo \\<equiv> rev_iterateo\"\nend\n\nlocale poly_map_rev_iterateoi =\n  finite_map \\<alpha> invar + poly_map_rev_iterateoi_defs list_rev_it\n  for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" \n  and invar\n  and list_rev_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\" +\n  assumes list_rev_it_correct: \n    \"invar m \\<Longrightarrow> map_iterator_rev_linord (list_rev_it m) (\\<alpha> m)\"\nbegin\n  lemma rev_iterateoi_correct: \n    \"invar S \\<Longrightarrow> map_iterator_rev_linord (rev_iterateoi S) (\\<alpha> S)\"\n    unfolding rev_iterateoi_def\n    apply (rule it_to_it_map_rev_linord_correct)\n    by (rule list_rev_it_correct)\n\n  lemma pi_rev_iterateoi[icf_proper_iteratorI]: \n    \"proper_it (rev_iterateoi S) (rev_iterateoi S)\"\n    unfolding rev_iterateoi_def \n    by (intro icf_proper_iteratorI)\n\n\n  lemma rev_iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      c \\<sigma>; \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<ge>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<ge>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    assumes II: \"!!\\<sigma> it. \\<lbrakk> \n      it \\<subseteq> dom (\\<alpha> m); \n      it \\<noteq> {}; \n      \\<not> c \\<sigma>; \n      I it \\<sigma>; \n      \\<And>k j. \\<lbrakk>k\\<in>it; j\\<in>dom (\\<alpha> m) - it\\<rbrakk> \\<Longrightarrow> j\\<ge>k \n    \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (rev_iterateoi m c f \\<sigma>0)\"\n    using assms by (rule map_iterator_rev_linord_rule_P[OF rev_iterateoi_correct])\n\n  lemma rev_iterateo_rule_P[case_names minv inv0 inv_pres i_complete]: \n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<ge>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<ge>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (rev_iterateo m f \\<sigma>0)\"\n    using assms \n      map_iterator_rev_linord_rule_P[OF rev_iterateoi_correct, \n        of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\nend\n\nsubsubsection {* Minimal and Maximal Elements *}\n\n  type_synonym ('k,'v,'s) map_min \n    = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n  locale map_min = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes min :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('u \\<times> 'v) option\"\n    assumes min_correct:\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P \\<noteq> {} \\<rbrakk> \\<Longrightarrow> min s P \\<in> Some ` rel_of (\\<alpha> s) P\"\n      \"\\<lbrakk> invar s; (k,v) \\<in> rel_of (\\<alpha> s) P \\<rbrakk> \\<Longrightarrow> fst (the (min s P)) \\<le> k\"\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P = {} \\<rbrakk> \\<Longrightarrow> min s P = None\"\n  begin\n   lemma minE: \n     assumes A: \"invar s\" \"rel_of (\\<alpha> s) P \\<noteq> {}\"\n     obtains k v where\n     \"min s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\" \"\\<forall>(k',v')\\<in>rel_of (\\<alpha> s) P. k \\<le> k'\"\n   proof -\n     from min_correct(1)[OF A] have MIS: \"min s P \\<in> Some ` rel_of (\\<alpha> s) P\" .\n     then obtain k v where KV: \"min s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\"\n       by auto\n     show thesis \n       apply (rule that[OF KV])\n       apply (clarify)\n       apply (drule min_correct(2)[OF `invar s`])\n       apply (simp add: KV(1))\n       done\n   qed\n\n   lemmas minI = min_correct(3)\n\n   lemma min_Some:\n     \"\\<lbrakk> invar s; min s P = Some (k,v) \\<rbrakk> \\<Longrightarrow> (k,v)\\<in>rel_of (\\<alpha> s) P\"\n     \"\\<lbrakk> invar s; min s P = Some (k,v); (k',v')\\<in>rel_of (\\<alpha> s) P \\<rbrakk> \\<Longrightarrow> k\\<le>k'\"\n     apply -\n     apply (cases \"rel_of (\\<alpha> s) P = {}\")\n     apply (drule (1) min_correct(3))\n     apply simp\n     apply (erule (1) minE)\n     apply auto [1]\n     apply (drule (1) min_correct(2))\n     apply auto\n     done\n     \n   lemma min_None:\n     \"\\<lbrakk> invar s; min s P = None \\<rbrakk> \\<Longrightarrow> rel_of (\\<alpha> s) P = {}\"\n     apply (cases \"rel_of (\\<alpha> s) P = {}\")\n     apply simp\n     apply (drule (1) min_correct(1))\n     apply auto\n     done\n\n  end\n\n  type_synonym ('k,'v,'s) map_max\n    = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n  locale map_max = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes max :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('u \\<times> 'v) option\"\n    assumes max_correct:\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P \\<noteq> {} \\<rbrakk> \\<Longrightarrow> max s P \\<in> Some ` rel_of (\\<alpha> s) P\"\n      \"\\<lbrakk> invar s; (k,v) \\<in> rel_of (\\<alpha> s) P \\<rbrakk> \\<Longrightarrow> fst (the (max s P)) \\<ge> k\"\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P = {} \\<rbrakk> \\<Longrightarrow> max s P = None\"\n  begin\n   lemma maxE: \n     assumes A: \"invar s\" \"rel_of (\\<alpha> s) P \\<noteq> {}\"\n     obtains k v where\n     \"max s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\" \"\\<forall>(k',v')\\<in>rel_of (\\<alpha> s) P. k \\<ge> k'\"\n   proof -\n     from max_correct(1)[OF A] have MIS: \"max s P \\<in> Some ` rel_of (\\<alpha> s) P\" .\n     then obtain k v where KV: \"max s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\"\n       by auto\n     show thesis \n       apply (rule that[OF KV])\n       apply (clarify)\n       apply (drule max_correct(2)[OF `invar s`])\n       apply (simp add: KV(1))\n       done\n   qed\n\n   lemmas maxI = max_correct(3)\n\n   \n\n  end\n\n\nsubsubsection \"Conversion to List\"\n  type_synonym ('k,'v,'s) map_to_sorted_list \n    = \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n  locale map_to_sorted_list = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes to_sorted_list :: \"'s \\<Rightarrow> ('u\\<times>'v) list\"\n    assumes to_sorted_list_correct: \n    \"invar m \\<Longrightarrow> map_of (to_sorted_list m) = \\<alpha> m\"\n    \"invar m \\<Longrightarrow> distinct (map fst (to_sorted_list m))\"\n    \"invar m \\<Longrightarrow> sorted (map fst (to_sorted_list m))\"\n\n  type_synonym ('k,'v,'s) map_to_rev_list \n    = \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n  locale map_to_rev_list = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes to_rev_list :: \"'s \\<Rightarrow> ('u\\<times>'v) list\"\n    assumes to_rev_list_correct: \n    \"invar m \\<Longrightarrow> map_of (to_rev_list m) = \\<alpha> m\"\n    \"invar m \\<Longrightarrow> distinct (map fst (to_rev_list m))\"\n    \"invar m \\<Longrightarrow> sorted (rev (map fst (to_rev_list m)))\"\n\nsubsection \"Record Based Interface\"\n\n  record ('k,'v,'s) map_ops = \n    map_op_\\<alpha> :: \"('k,'v,'s) map_\\<alpha>\"\n    map_op_invar :: \"('k,'v,'s) map_invar\"\n    map_op_empty :: \"('k,'v,'s) map_empty\"\n    map_op_lookup :: \"('k,'v,'s) map_lookup\"\n    map_op_update :: \"('k,'v,'s) map_update\"\n    map_op_update_dj :: \"('k,'v,'s) map_update_dj\"\n    map_op_delete :: \"('k,'v,'s) map_delete\"\n    map_op_list_it :: \"('k,'v,'s) map_list_it\"\n    map_op_sng :: \"('k,'v,'s) map_sng\"\n    map_op_restrict :: \"('k,'v,'s,'s) map_restrict\"\n    map_op_add :: \"('k,'v,'s) map_add\"\n    map_op_add_dj :: \"('k,'v,'s) map_add_dj\"\n    map_op_isEmpty :: \"('k,'v,'s) map_isEmpty\"\n    map_op_isSng :: \"('k,'v,'s) map_isSng\"\n    map_op_ball :: \"('k,'v,'s) map_ball\"\n    map_op_bex :: \"('k,'v,'s) map_bex\"\n    map_op_size :: \"('k,'v,'s) map_size\"\n    map_op_size_abort :: \"('k,'v,'s) map_size_abort\"\n    map_op_sel :: \"('k,'v,'s) map_sel'\"\n    map_op_to_list :: \"('k,'v,'s) map_to_list\"\n    map_op_to_map :: \"('k,'v,'s) list_to_map\"\n\n  locale StdMapDefs = poly_map_iteratei_defs \"map_op_list_it ops\" \n    for ops :: \"('k,'v,'s,'more) map_ops_scheme\"\n  begin\n    abbreviation \\<alpha> where \"\\<alpha> == map_op_\\<alpha> ops\" \n    abbreviation invar where \"invar == map_op_invar ops\" \n    abbreviation empty where \"empty == map_op_empty ops\" \n    abbreviation lookup where \"lookup == map_op_lookup ops\" \n    abbreviation update where \"update == map_op_update ops\" \n    abbreviation update_dj where \"update_dj == map_op_update_dj ops\" \n    abbreviation delete where \"delete == map_op_delete ops\" \n    abbreviation list_it where \"list_it == map_op_list_it ops\" \n    abbreviation sng where \"sng == map_op_sng ops\" \n    abbreviation restrict where \"restrict == map_op_restrict ops\" \n    abbreviation add where \"add == map_op_add ops\" \n    abbreviation add_dj where \"add_dj == map_op_add_dj ops\" \n    abbreviation isEmpty where \"isEmpty == map_op_isEmpty ops\" \n    abbreviation isSng where \"isSng == map_op_isSng ops\" \n    abbreviation ball where \"ball == map_op_ball ops\" \n    abbreviation bex where \"bex == map_op_bex ops\" \n    abbreviation size where \"size == map_op_size ops\" \n    abbreviation size_abort where \"size_abort == map_op_size_abort ops\" \n    abbreviation sel where \"sel == map_op_sel ops\" \n    abbreviation to_list where \"to_list == map_op_to_list ops\" \n    abbreviation to_map where \"to_map == map_op_to_map ops\"\n  end\n\n  locale StdMap = StdMapDefs ops +\n    map \\<alpha> invar +\n    map_empty \\<alpha> invar empty +\n    map_lookup \\<alpha> invar lookup  +\n    map_update \\<alpha> invar update  +\n    map_update_dj \\<alpha> invar update_dj +\n    map_delete \\<alpha> invar delete  +\n    poly_map_iteratei \\<alpha> invar list_it +\n    map_sng \\<alpha> invar sng  +\n    map_restrict \\<alpha> invar \\<alpha> invar restrict +\n    map_add \\<alpha> invar add  +\n    map_add_dj \\<alpha> invar add_dj +\n    map_isEmpty \\<alpha> invar isEmpty  +\n    map_isSng \\<alpha> invar isSng  +\n    map_ball \\<alpha> invar ball  +\n    map_bex \\<alpha> invar bex  +\n    map_size \\<alpha> invar size +\n    map_size_abort \\<alpha> invar size_abort +\n    map_sel' \\<alpha> invar sel  +\n    map_to_list \\<alpha> invar to_list  +\n    list_to_map \\<alpha> invar to_map \n    for ops :: \"('k,'v,'s,'more) map_ops_scheme\"\n  begin\n    lemmas correct =\n      empty_correct\n      sng_correct\n      lookup_correct\n      update_correct\n      update_dj_correct\n      delete_correct\n      restrict_correct\n      add_correct\n      add_dj_correct\n      isEmpty_correct\n      isSng_correct\n      ball_correct\n      bex_correct\n      size_correct\n      size_abort_correct\n      to_list_correct\n      to_map_correct\n  end\n\n  lemmas StdMap_intro = StdMap.intro[rem_dup_prems]\n\n  locale StdMap_no_invar = StdMap + map_no_invar \\<alpha> invar\n\n  record ('k,'v,'s) omap_ops = \"('k,'v,'s) map_ops\" + \n    map_op_ordered_list_it :: \"'s \\<Rightarrow> ('k,'v,('k\\<times>'v) list) map_iterator\"\n    map_op_rev_list_it :: \"'s \\<Rightarrow> ('k,'v,('k\\<times>'v) list) map_iterator\"\n    map_op_min :: \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n    map_op_max :: \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n    map_op_to_sorted_list :: \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n    map_op_to_rev_list :: \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n\n  locale StdOMapDefs = StdMapDefs ops\n    + poly_map_iterateoi_defs \"map_op_ordered_list_it ops\"\n    + poly_map_rev_iterateoi_defs \"map_op_rev_list_it ops\"\n    for ops :: \"('k::linorder,'v,'s,'more) omap_ops_scheme\"\n  begin\n    abbreviation ordered_list_it where \"ordered_list_it \n      \\<equiv> map_op_ordered_list_it ops\"\n    abbreviation rev_list_it where \"rev_list_it \n      \\<equiv> map_op_rev_list_it ops\"\n    abbreviation min where \"min == map_op_min ops\"\n    abbreviation max where \"max == map_op_max ops\"\n    abbreviation to_sorted_list where \n      \"to_sorted_list \\<equiv> map_op_to_sorted_list ops\"\n    abbreviation to_rev_list where \"to_rev_list \\<equiv> map_op_to_rev_list ops\"\n  end\n\n  locale StdOMap = \n    StdOMapDefs ops +\n    StdMap ops +\n    poly_map_iterateoi \\<alpha> invar ordered_list_it +\n    poly_map_rev_iterateoi \\<alpha> invar rev_list_it +\n    map_min \\<alpha> invar min +\n    map_max \\<alpha> invar max +\n    map_to_sorted_list \\<alpha> invar to_sorted_list +\n    map_to_rev_list \\<alpha> invar to_rev_list\n    for ops :: \"('k::linorder,'v,'s,'more) omap_ops_scheme\"\n  begin\n  end\n\n  lemmas StdOMap_intro = \n    StdOMap.intro[OF StdMap_intro, rem_dup_prems]\n\nend\n", "meta": {"author": "andredidier", "repo": "phd", "sha": "113f7c8b360a3914a571db13d9513e313954f4b2", "save_path": "github-repos/isabelle/andredidier-phd", "path": "github-repos/isabelle/andredidier-phd/phd-113f7c8b360a3914a571db13d9513e313954f4b2/thesis/Collections/ICF/spec/MapSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3418366118838624}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Corres_UL\nimports\n  Crunch_Instances_NonDet\n  \"Monad_WP/wp/WPEx\"\n  \"Monad_WP/wp/WPFix\"\n  HaskellLemmaBucket\nbegin\n\ntext \\<open>Definition of correspondence\\<close>\n\ndefinition\n  corres_underlying :: \"(('s \\<times> 't) set) \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow>\n                        ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> bool) \\<Rightarrow> ('t \\<Rightarrow> bool)\n           \\<Rightarrow> ('s, 'a) nondet_monad \\<Rightarrow> ('t, 'b) nondet_monad \\<Rightarrow> bool\"\nwhere\n \"corres_underlying srel nf nf' rrel G G' \\<equiv> \\<lambda>m m'.\n      \\<forall>(s, s') \\<in> srel. G s \\<and> G' s' \\<longrightarrow>\n           (nf \\<longrightarrow> \\<not> snd (m s)) \\<longrightarrow>\n           (\\<forall>(r', t') \\<in> fst (m' s'). \\<exists>(r, t) \\<in> fst (m s). (t, t') \\<in> srel \\<and> rrel r r') \\<and>\n           (nf' \\<longrightarrow> \\<not> snd (m' s'))\"\n\ntext \\<open>Base case facts about correspondence\\<close>\n\nlemma corres_underlyingD:\n  \"\\<lbrakk> corres_underlying R nf nf' rs P P' f f'; (s,s') \\<in> R; P s; P' s'; nf \\<longrightarrow> \\<not> snd (f s) \\<rbrakk>\n  \\<Longrightarrow> (\\<forall>(r',t')\\<in>fst (f' s'). \\<exists>(r,t)\\<in>fst (f s). (t, t') \\<in> R \\<and> rs r r') \\<and> (nf' \\<longrightarrow> \\<not> snd (f' s'))\"\n  by (fastforce simp: corres_underlying_def)\n\nlemma corres_underlyingD2:\n  \"\\<lbrakk> corres_underlying R nf nf' rs P P' f f'; (s,s') \\<in> R; P s; P' s'; (r',t')\\<in>fst (f' s'); nf \\<longrightarrow> \\<not> snd (f s) \\<rbrakk>\n  \\<Longrightarrow> \\<exists>(r,t)\\<in>fst (f s). (t, t') \\<in> R \\<and> rs r r'\"\n  by (fastforce dest: corres_underlyingD)\n\nlemma propagate_no_fail:\n  \"\\<lbrakk> corres_underlying S nf True R P P' f f';\n        no_fail P f; \\<forall>s'. P' s' \\<longrightarrow> (\\<exists>s. P s \\<and> (s,s') \\<in> S) \\<rbrakk>\n  \\<Longrightarrow> no_fail P' f'\"\n  apply (clarsimp simp: corres_underlying_def no_fail_def)\n  apply (erule allE, erule (1) impE)\n  apply clarsimp\n  apply (drule (1) bspec, clarsimp)\n  done\n\nlemma corres_underlying_serial:\n  \"\\<lbrakk> corres_underlying S False True rrel G G' m m'; empty_fail m' \\<rbrakk> \\<Longrightarrow>\n     \\<forall>s. (\\<exists>s'. (s,s') \\<in> S \\<and> G s \\<and> G' s') \\<longrightarrow> fst (m s) \\<noteq> {}\"\n  apply (clarsimp simp: corres_underlying_def empty_fail_def)\n  apply (drule_tac x=\"(s, s')\" in bspec, simp)\n  apply (drule_tac x=s' in spec)\n  apply auto\n  done\n\n(* FIXME: duplicated with HOL.iff_allI *)\nlemma All_eqI:\n  assumes ass: \"\\<And>x. A x = B x\"\n  shows \"(\\<forall>x. A x) = (\\<forall>x. B x)\"\n  apply (subst ass)\n  apply (rule refl)\n  done\n\nlemma corres_singleton:\n \"corres_underlying sr nf nf' r P P' (\\<lambda>s. ({(R s, S s)},x)) (\\<lambda>s. ({(R' s, S' s)},False))\n  = (\\<forall>s s'. P s \\<and> P' s' \\<and> (s, s') \\<in> sr \\<and> (nf \\<longrightarrow> \\<not> x)\n          \\<longrightarrow> ((S s, S' s') \\<in> sr \\<and> r (R s) (R' s')))\"\n  by (auto simp: corres_underlying_def)\n\nlemma corres_return[simp]:\n  \"corres_underlying sr nf nf' r P P' (return a) (return b) =\n   ((\\<exists>s s'. P s \\<and> P' s' \\<and> (s, s') \\<in> sr) \\<longrightarrow> r a b)\"\n  by (simp add: return_def corres_singleton)\n\nlemma corres_get[simp]:\n \"corres_underlying sr nf nf' r P P' get get =\n  (\\<forall> s s'. (s, s') \\<in> sr \\<and> P s \\<and> P' s' \\<longrightarrow> r s s')\"\n  apply (simp add: get_def corres_singleton)\n  apply (rule All_eqI)+\n  apply safe\n  done\n\nlemma corres_gets[simp]:\n \"corres_underlying sr nf nf' r P P' (gets a) (gets b) =\n  (\\<forall> s s'. P s \\<and> P' s' \\<and> (s, s') \\<in> sr \\<longrightarrow> r (a s) (b s'))\"\n  by (simp add: simpler_gets_def corres_singleton)\n\nlemma corres_throwError[simp]:\n  \"corres_underlying sr nf nf' r P P' (throwError a) (throwError b) =\n   ((\\<exists>s s'. P s \\<and> P' s' \\<and> (s, s') \\<in> sr) \\<longrightarrow> r (Inl a) (Inl b))\"\n  by (simp add: throwError_def)\n\nlemma corres_no_failI_base:\n  assumes f: \"nf \\<Longrightarrow> no_fail P f\"\n  assumes f': \"nf' \\<Longrightarrow> no_fail P' f'\"\n  assumes corres: \"\\<forall>(s, s') \\<in> S. P s \\<and> P' s' \\<longrightarrow>\n                     (\\<forall>(r', t') \\<in> fst (f' s'). \\<exists>(r, t) \\<in> fst (f s). (t, t') \\<in> S \\<and> R r r')\"\n  shows \"corres_underlying S nf nf' R P P' f f'\"\n  using assms by (simp add: corres_underlying_def no_fail_def)\n\n(* This lemma gets the shorter name because many existing proofs want nf=False *)\nlemma corres_no_failI:\n  assumes f': \"nf' \\<Longrightarrow> no_fail P' f'\"\n  assumes corres: \"\\<forall>(s, s') \\<in> S. P s \\<and> P' s' \\<longrightarrow>\n                     (\\<forall>(r', t') \\<in> fst (f' s'). \\<exists>(r, t) \\<in> fst (f s). (t, t') \\<in> S \\<and> R r r')\"\n  shows \"corres_underlying S False nf' R P P' f f'\"\n  using assms by (simp add: corres_underlying_def no_fail_def)\n\ntext \\<open>A congruence rule for the correspondence functions.\\<close>\n\nlemma corres_cong:\n  assumes P: \"\\<And>s. P s = P' s\"\n  assumes Q: \"\\<And>s. Q s = Q' s\"\n  assumes f: \"\\<And>s. P' s \\<Longrightarrow> f s = f' s\"\n  assumes g: \"\\<And>s. Q' s \\<Longrightarrow> g s = g' s\"\n  assumes r: \"\\<And>x y s t s' t'. \\<lbrakk> P' s; Q' t; (x, s') \\<in> fst (f' s); (y, t') \\<in> fst (g' t) \\<rbrakk> \\<Longrightarrow> r x y = r' x y\"\n  shows      \"corres_underlying sr nf nf' r P Q f g = corres_underlying sr nf nf' r' P' Q' f' g'\"\n  apply (simp add: corres_underlying_def)\n  apply (rule ball_cong [OF refl])\n  apply (clarsimp simp: P Q)\n  apply (rule imp_cong [OF refl])\n  apply (clarsimp simp: f g)\n  apply (rule imp_cong [OF refl])\n  apply (rule conj_cong)\n   apply (rule ball_cong [OF refl])\n   apply clarsimp\n   apply (rule bex_cong [OF refl])\n   apply (clarsimp simp: r)\n  apply simp\n  done\n\ntext \\<open>The guard weakening rule\\<close>\n\nlemma stronger_corres_guard_imp:\n  assumes x: \"corres_underlying sr nf nf' r Q Q' f g\"\n  assumes y: \"\\<And>s s'. \\<lbrakk> P s; P' s'; (s, s') \\<in> sr \\<rbrakk> \\<Longrightarrow> Q s\"\n  assumes z: \"\\<And>s s'. \\<lbrakk> P s; P' s'; (s, s') \\<in> sr \\<rbrakk> \\<Longrightarrow> Q' s'\"\n  shows      \"corres_underlying sr nf nf' r P P' f g\"\n  using x by (auto simp: y z corres_underlying_def)\n\nlemma corres_guard_imp:\n  assumes x: \"corres_underlying sr nf nf' r Q Q' f g\"\n  assumes y: \"\\<And>s. P s \\<Longrightarrow> Q s\" \"\\<And>s. P' s \\<Longrightarrow> Q' s\"\n  shows      \"corres_underlying sr nf nf' r P P' f g\"\n  apply (rule stronger_corres_guard_imp)\n    apply (rule x)\n   apply (simp add: y)+\n  done\n\nlemma corres_rel_imp:\n  assumes x: \"corres_underlying sr nf nf' r' P P' f g\"\n  assumes y: \"\\<And>x y. r' x y \\<Longrightarrow> r x y\"\n  shows      \"corres_underlying sr nf nf' r P P' f g\"\n  apply (insert x)\n  apply (simp add: corres_underlying_def)\n  apply clarsimp\n  apply (drule (1) bspec, clarsimp)\n  apply (drule (1) bspec, clarsimp)\n  apply (blast intro: y)\n  done\n\ntext \\<open>Splitting rules for correspondence of composite monads\\<close>\n\nlemma corres_underlying_split:\n  assumes ac: \"corres_underlying s nf nf' r' G G' a c\"\n  assumes valid: \"\\<lbrace>G\\<rbrace> a \\<lbrace>P\\<rbrace>\" \"\\<lbrace>G'\\<rbrace> c \\<lbrace>P'\\<rbrace>\"\n  assumes bd: \"\\<forall>rv rv'. r' rv rv' \\<longrightarrow>\n                        corres_underlying s nf nf' r (P rv) (P' rv') (b rv) (d rv')\"\n  shows \"corres_underlying s nf nf' r G G' (a >>= (\\<lambda>rv. b rv)) (c >>= (\\<lambda>rv'. d rv'))\"\n  using ac bd valid\n  apply (clarsimp simp: corres_underlying_def bind_def)\n  apply (clarsimp simp: Bex_def Ball_def valid_def)\n  apply meson\n  done\n\nlemma corres_split':\n  assumes x: \"corres_underlying sr nf nf' r' P P' a c\"\n  assumes y: \"\\<And>rv rv'. r' rv rv' \\<Longrightarrow> corres_underlying sr nf nf' r (Q rv) (Q' rv') (b rv) (d rv')\"\n  assumes    \"\\<lbrace>P\\<rbrace> a \\<lbrace>Q\\<rbrace>\" \"\\<lbrace>P'\\<rbrace> c \\<lbrace>Q'\\<rbrace>\"\n  shows      \"corres_underlying sr nf nf' r P P' (a >>= (\\<lambda>rv. b rv)) (c >>= (\\<lambda>rv'. d rv'))\"\n  by (fastforce intro!: corres_underlying_split assms)\n\ntext \\<open>Derivative splitting rules\\<close>\n\nlemma corres_split:\n  assumes y: \"\\<And>rv rv'. r' rv rv' \\<Longrightarrow> corres_underlying sr nf nf' r (R rv) (R' rv') (b rv) (d rv')\"\n  assumes x: \"corres_underlying sr nf nf' r' P P' a c\"\n  assumes    \"\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>\" \"\\<lbrace>Q'\\<rbrace> c \\<lbrace>R'\\<rbrace>\"\n  shows      \"corres_underlying sr nf nf' r (P and Q) (P' and Q') (a >>= (\\<lambda>rv. b rv)) (c >>= (\\<lambda>rv'. d rv'))\"\n  using assms\n  apply -\n  apply (rule corres_split')\n     apply (rule corres_guard_imp, rule x, simp_all)\n    apply (erule y)\n   apply (rule hoare_weaken_pre, assumption)\n   apply simp\n  apply (rule hoare_weaken_pre, assumption)\n  apply simp\n  done\n\nprimrec\n  rel_sum_comb :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('c \\<Rightarrow> 'd \\<Rightarrow> bool)\n                     \\<Rightarrow> ('a + 'c \\<Rightarrow> 'b + 'd \\<Rightarrow> bool)\" (infixl \"\\<oplus>\" 95)\nwhere\n  \"(f \\<oplus> g) (Inr x) y = (\\<exists>y'. y = Inr y' \\<and> (g x y'))\"\n| \"(f \\<oplus> g) (Inl x) y = (\\<exists>y'. y = Inl y' \\<and> (f x y'))\"\n\nlemma rel_sum_comb_r2[simp]:\n  \"(f \\<oplus> g) x (Inr y) = (\\<exists>x'. x = Inr x' \\<and> g x' y)\"\n  apply (case_tac x, simp_all)\n  done\n\nlemma rel_sum_comb_l2[simp]:\n  \"(f \\<oplus> g) x (Inl y) = (\\<exists>x'. x = Inl x' \\<and> f x' y)\"\n  apply (case_tac x, simp_all)\n  done\n\nlemma corres_splitEE:\n  assumes y: \"\\<And>rv rv'. r' rv rv'\n              \\<Longrightarrow> corres_underlying sr nf nf' (f \\<oplus> r) (R rv) (R' rv') (b rv) (d rv')\"\n  assumes    \"corres_underlying sr nf nf' (f \\<oplus> r') P P' a c\"\n  assumes x: \"\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>,\\<lbrace>\\<top>\\<top>\\<rbrace>\" \"\\<lbrace>Q'\\<rbrace> c \\<lbrace>R'\\<rbrace>,\\<lbrace>\\<top>\\<top>\\<rbrace>\"\n  shows      \"corres_underlying sr nf nf' (f \\<oplus> r) (P and Q) (P' and Q') (a >>=E (\\<lambda>rv. b rv)) (c >>=E (\\<lambda>rv'. d rv'))\"\n  using assms\n  apply (unfold bindE_def validE_def)\n  apply (rule corres_split)\n     defer\n     apply assumption+\n  apply (case_tac rv)\n   apply (clarsimp simp: lift_def y)+\n  done\n\nlemma corres_split_handle:\n  assumes y: \"\\<And>ft ft'. f' ft ft'\n              \\<Longrightarrow> corres_underlying sr nf nf' (f \\<oplus> r) (E ft) (E' ft') (b ft) (d ft')\"\n  assumes    \"corres_underlying sr nf nf' (f' \\<oplus> r) P P' a c\"\n  assumes x: \"\\<lbrace>Q\\<rbrace> a \\<lbrace>\\<top>\\<top>\\<rbrace>,\\<lbrace>E\\<rbrace>\" \"\\<lbrace>Q'\\<rbrace> c \\<lbrace>\\<top>\\<top>\\<rbrace>,\\<lbrace>E'\\<rbrace>\"\n  shows      \"corres_underlying sr nf nf' (f \\<oplus> r) (P and Q) (P' and Q') (a <handle> (\\<lambda>ft. b ft)) (c <handle> (\\<lambda>ft'. d ft'))\"\n  using assms\n  apply (simp add: handleE_def handleE'_def validE_def)\n  apply (rule corres_split)\n     defer\n     apply assumption+\n  apply (case_tac v, simp_all, safe, simp_all add: y)\n  done\n\nlemma corres_split_catch:\n  assumes y: \"\\<And>ft ft'. f ft ft' \\<Longrightarrow> corres_underlying sr nf nf' r (E ft) (E' ft') (b ft) (d ft')\"\n  assumes x: \"corres_underlying sr nf nf' (f \\<oplus> r) P P' a c\"\n  assumes z: \"\\<lbrace>Q\\<rbrace> a \\<lbrace>\\<top>\\<top>\\<rbrace>,\\<lbrace>E\\<rbrace>\" \"\\<lbrace>Q'\\<rbrace> c \\<lbrace>\\<top>\\<top>\\<rbrace>,\\<lbrace>E'\\<rbrace>\"\n  shows      \"corres_underlying sr nf nf' r (P and Q) (P' and Q') (a <catch> (\\<lambda>ft. b ft)) (c <catch> (\\<lambda>ft'. d ft'))\"\n  apply (simp add: catch_def)\n  apply (rule corres_split [OF _ x, where R=\"case_sum E \\<top>\\<top>\" and R'=\"case_sum E' \\<top>\\<top>\"])\n    apply (case_tac x)\n     apply (clarsimp simp: y)\n    apply clarsimp\n   apply (insert z)\n   apply (simp add: validE_def valid_def split_def split: sum.splits)+\n  done\n\nlemma corres_split_eqr:\n assumes y: \"\\<And>rv. corres_underlying sr nf nf' r (R rv) (R' rv) (b rv) (d rv)\"\n assumes x: \"corres_underlying sr nf nf' (=) P P' a c\" \"\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>\" \"\\<lbrace>Q'\\<rbrace> c \\<lbrace>R'\\<rbrace>\"\n shows      \"corres_underlying sr nf nf' r (P and Q) (P' and Q') (a >>= (\\<lambda>rv. b rv)) (c >>= d)\"\n  apply (rule corres_split[OF _ x])\n  apply (simp add: y)\n  done\n\ndefinition\n \"dc \\<equiv> \\<lambda>rv rv'. True\"\n\nlemma dc_simp[simp]: \"dc a b\"\n  by (simp add: dc_def)\n\nlemma dc_o_simp1[simp]: \"dc \\<circ> f = dc\"\n  by (simp add: dc_def o_def)\n\nlemma dc_o_simp2[simp]: \"dc x \\<circ> f = dc x\"\n  by (simp add: dc_def o_def)\n\nlemma unit_dc_is_eq:\n  \"(dc::unit\\<Rightarrow>_\\<Rightarrow>_) = (=)\"\n  by (fastforce simp: dc_def)\n\nlemma corres_split_nor:\n \"\\<lbrakk> corres_underlying sr nf nf' r R R' b d; corres_underlying sr nf nf' dc P P' a c;\n    \\<lbrace>Q\\<rbrace> a \\<lbrace>\\<lambda>x. R\\<rbrace>; \\<lbrace>Q'\\<rbrace> c \\<lbrace>\\<lambda>x. R'\\<rbrace> \\<rbrakk>\n \\<Longrightarrow> corres_underlying sr nf nf' r (P and Q) (P' and Q') (a >>= (\\<lambda>rv. b)) (c >>= (\\<lambda>rv. d))\"\n  apply (rule corres_split, assumption+)\n  done\n\nlemma corres_split_norE:\n   \"\\<lbrakk> corres_underlying sr nf nf' (f \\<oplus> r) R R' b d; corres_underlying sr nf nf' (f \\<oplus> dc) P P' a c;\n    \\<lbrace>Q\\<rbrace> a \\<lbrace>\\<lambda>x. R\\<rbrace>, \\<lbrace>\\<top>\\<top>\\<rbrace>; \\<lbrace>Q'\\<rbrace> c \\<lbrace>\\<lambda>x. R'\\<rbrace>,\\<lbrace>\\<top>\\<top>\\<rbrace> \\<rbrakk>\n \\<Longrightarrow> corres_underlying sr nf nf' (f \\<oplus> r) (P and Q) (P' and Q') (a >>=E (\\<lambda>rv. b)) (c >>=E (\\<lambda>rv. d))\"\n  apply (rule corres_splitEE, assumption+)\n  done\n\nlemma corres_split_eqrE:\n  assumes y: \"\\<And>rv. corres_underlying sr nf nf' (f \\<oplus> r) (R rv) (R' rv) (b rv) (d rv)\"\n  assumes z: \"corres_underlying sr nf nf' (f \\<oplus> (=)) P P' a c\"\n  assumes x: \"\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>,\\<lbrace>\\<top>\\<top>\\<rbrace>\" \"\\<lbrace>Q'\\<rbrace> c \\<lbrace>R'\\<rbrace>,\\<lbrace>\\<top>\\<top>\\<rbrace>\"\n  shows      \"corres_underlying sr nf nf' (f \\<oplus> r) (P and Q) (P' and Q') (a >>=E (\\<lambda>rv. b rv)) (c >>=E d)\"\n  apply (rule corres_splitEE[OF _ z x])\n  apply (simp add: y)\n  done\n\nlemma corres_split_mapr:\n  assumes x: \"\\<And>rv. corres_underlying sr nf nf' r (R rv) (R' (f rv)) (b rv) (d (f rv))\"\n  assumes y: \"corres_underlying sr nf nf' ((=) \\<circ> f) P P' a c\"\n  assumes z: \"\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>\" \"\\<lbrace>Q'\\<rbrace> c \\<lbrace>R'\\<rbrace>\"\n  shows      \"corres_underlying sr nf nf' r (P and Q) (P' and Q') (a >>= (\\<lambda>rv. b rv)) (c >>= d)\"\n  apply (rule corres_split[OF _ y z])\n  apply simp\n  apply (drule sym)\n  apply (simp add: x)\n  done\n\nlemma corres_split_maprE:\n  assumes y: \"\\<And>rv. corres_underlying sr nf nf' (r' \\<oplus> r) (R rv) (R' (f rv)) (b rv) (d (f rv))\"\n  assumes z: \"corres_underlying sr nf nf' (r' \\<oplus> ((=) \\<circ> f)) P P' a c\"\n  assumes x: \"\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>,\\<lbrace>\\<top>\\<top>\\<rbrace>\" \"\\<lbrace>Q'\\<rbrace> c \\<lbrace>R'\\<rbrace>,\\<lbrace>\\<top>\\<top>\\<rbrace>\"\n  shows      \"corres_underlying sr nf nf' (r' \\<oplus> r) (P and Q) (P' and Q') (a >>=E (\\<lambda>rv. b rv)) (c >>=E d)\"\n  apply (rule corres_splitEE[OF _ z x])\n  apply simp\n  apply (drule sym)\n  apply (simp add: y)\n  done\n\ntext \\<open>Some rules for walking correspondence into basic constructs\\<close>\n\nlemma corres_if:\n  \"\\<lbrakk> G = G'; corres_underlying sr nf nf' r P P' a c; corres_underlying sr nf nf' r Q Q' b d \\<rbrakk>\n    \\<Longrightarrow> corres_underlying sr nf nf' r\n                (if G then P else Q) (if G' then P' else Q')\n                (if G then a else b) (if G' then c else d)\"\n  by simp\n\nlemma corres_whenE:\n  \"\\<lbrakk> G = G'; corres_underlying sr nf nf' (fr \\<oplus> r) P P' f g; r () () \\<rbrakk>\n     \\<Longrightarrow> corres_underlying sr nf nf' (fr \\<oplus> r) (\\<lambda>s. G \\<longrightarrow> P s) (\\<lambda>s. G' \\<longrightarrow> P' s) (whenE G f) (whenE G' g)\"\n  by (simp add: whenE_def returnOk_def)\n\nlemmas corres_if2 = corres_if[unfolded if_apply_def2]\nlemmas corres_when =\n    corres_if2[where b=\"return ()\" and d=\"return ()\"\n                and Q=\"\\<top>\" and Q'=\"\\<top>\" and r=dc, simplified,\n                folded when_def]\n\nlemma corres_if_r:\n  \"\\<lbrakk> corres_underlying sr nf nf' r P P' a c; corres_underlying sr nf nf' r P Q' a d \\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr nf nf' r (P) (if G' then P' else Q')\n                                     (a) (if G' then c  else d)\"\n  by (simp)\n\nlemma corres_if3:\n \"\\<lbrakk> G = G';\n    G \\<Longrightarrow> corres_underlying sr nf nf' r P P' a c;\n    \\<not> G' \\<Longrightarrow> corres_underlying sr nf nf' r Q Q' b d \\<rbrakk>\n  \\<Longrightarrow> corres_underlying sr nf nf' r (if G then P else Q) (if G' then P' else Q')\n                                    (if G then a else b) (if G' then c else d)\"\n  by simp\n\n\ntext \\<open>Some equivalences about liftM and other useful simps\\<close>\n\nlemma snd_liftM [simp]:\n  \"snd (liftM t f s) = snd (f s)\"\n  by (auto simp: liftM_def bind_def return_def)\n\nlemma corres_liftM_simp[simp]:\n  \"(corres_underlying sr nf nf' r P P' (liftM t f) g)\n    = (corres_underlying sr nf nf' (r \\<circ> t) P P' f g)\"\n  apply (simp add: corres_underlying_def\n           handy_liftM_lemma Ball_def Bex_def)\n  apply (rule All_eqI)+\n  apply blast\n  done\n\nlemma corres_liftM2_simp[simp]:\n \"corres_underlying sr nf nf' r P P' f (liftM t g) =\n  corres_underlying sr nf nf' (\\<lambda>x. r x \\<circ> t) P P' f g\"\n  apply (simp add: corres_underlying_def\n           handy_liftM_lemma Ball_def)\n  apply (rule All_eqI)+\n  apply blast\n  done\n\nlemma corres_liftE_rel_sum[simp]:\n \"corres_underlying sr nf nf' (f \\<oplus> r) P P' (liftE m) (liftE m') = corres_underlying sr nf nf' r P P' m m'\"\n  by (simp add: liftE_liftM o_def)\n\ntext \\<open>Support for proving correspondence to noop with hoare triples\\<close>\n\nlemma corres_noop:\n  assumes P: \"\\<And>s. P s \\<Longrightarrow> \\<lbrace>\\<lambda>s'. (s, s') \\<in> sr \\<and> P' s'\\<rbrace> f \\<lbrace>\\<lambda>rv s'. (s, s') \\<in> sr \\<and> r x rv\\<rbrace>\"\n  assumes nf': \"\\<And>s. \\<lbrakk> P s; nf' \\<rbrakk> \\<Longrightarrow> no_fail (\\<lambda>s'. (s, s') \\<in> sr \\<and> P' s') f\"\n  shows \"corres_underlying sr nf nf' r P P' (return x) f\"\n  apply (simp add: corres_underlying_def return_def)\n  apply clarsimp\n  apply (frule P)\n  apply (insert nf')\n  apply (clarsimp simp: valid_def no_fail_def)\n  done\n\nlemma corres_noopE:\n  assumes P: \"\\<And>s. P s \\<Longrightarrow> \\<lbrace>\\<lambda>s'. (s, s') \\<in> sr \\<and> P' s'\\<rbrace> f \\<lbrace>\\<lambda>rv s'. (s, s') \\<in> sr \\<and> r x rv\\<rbrace>,\\<lbrace>\\<lambda>r s. False\\<rbrace>\"\n  assumes nf': \"\\<And>s. \\<lbrakk> P s; nf' \\<rbrakk> \\<Longrightarrow> no_fail (\\<lambda>s'. (s, s') \\<in> sr \\<and> P' s') f\"\n  shows \"corres_underlying sr nf nf' (fr \\<oplus> r) P P' (returnOk x) f\"\nproof -\n  have Q: \"\\<And>P f Q E. \\<lbrace>P\\<rbrace>f\\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>r s. case_sum (\\<lambda>e. E e s) (\\<lambda>r. Q r s) r\\<rbrace>\"\n   by (simp add: validE_def)\n  thus ?thesis\n  apply (simp add: returnOk_def)\n  apply (rule corres_noop)\n   apply (rule hoare_post_imp)\n    defer\n    apply (rule Q)\n    apply (rule P)\n    apply assumption\n   apply (erule(1) nf')\n  apply (case_tac ra, simp_all)\n  done\nqed\n\n(* this could be stronger in the no_fail part *)\nlemma corres_noop2:\n  assumes x: \"\\<And>s. P s  \\<Longrightarrow> \\<lbrace>(=) s\\<rbrace> f \\<exists>\\<lbrace>\\<lambda>r. (=) s\\<rbrace>\"\n  assumes y: \"\\<And>s. P' s \\<Longrightarrow> \\<lbrace>(=) s\\<rbrace> g \\<lbrace>\\<lambda>r. (=) s\\<rbrace>\"\n  assumes z: \"nf' \\<Longrightarrow> no_fail P f\" \"nf' \\<Longrightarrow> no_fail P' g\"\n  shows      \"corres_underlying sr nf nf' dc P P' f g\"\n  apply (clarsimp simp: corres_underlying_def)\n  apply (rule conjI)\n   apply clarsimp\n   apply (rule use_exs_valid)\n    apply (rule exs_hoare_post_imp)\n     prefer 2\n     apply (rule x)\n     apply assumption\n    apply simp_all\n   apply (subgoal_tac \"ba = b\")\n    apply simp\n   apply (rule sym)\n   apply (rule use_valid[OF _ y], assumption+)\n   apply simp\n  apply (insert z)\n  apply (clarsimp simp: no_fail_def)\n  done\n\ntext \\<open>Support for dividing correspondence along\n        logical boundaries\\<close>\n\nlemma corres_disj_division:\n  \"\\<lbrakk> P \\<or> Q; P \\<Longrightarrow> corres_underlying sr nf nf' r R S x y; Q \\<Longrightarrow> corres_underlying sr nf nf' r T U x y \\<rbrakk>\n     \\<Longrightarrow> corres_underlying sr nf nf' r (\\<lambda>s. (P \\<longrightarrow> R s) \\<and> (Q \\<longrightarrow> T s)) (\\<lambda>s. (P \\<longrightarrow> S s) \\<and> (Q \\<longrightarrow> U s)) x y\"\n  apply safe\n   apply (rule corres_guard_imp)\n     apply simp\n    apply simp\n   apply simp\n  apply (rule corres_guard_imp)\n    apply simp\n   apply simp\n  apply simp\n  done\n\nlemma corres_weaker_disj_division:\n  \"\\<lbrakk> P \\<or> Q; P \\<Longrightarrow> corres_underlying sr nf nf' r R S x y; Q \\<Longrightarrow> corres_underlying sr nf nf' r T U x y \\<rbrakk>\n     \\<Longrightarrow> corres_underlying sr nf nf' r (R and T) (S and U) x y\"\n  apply (rule corres_guard_imp)\n    apply (rule corres_disj_division)\n      apply simp+\n  done\n\nlemma corres_symmetric_bool_cases:\n  \"\\<lbrakk> P = P'; \\<lbrakk> P; P' \\<rbrakk> \\<Longrightarrow> corres_underlying srel nf nf' r Q Q' f g;\n        \\<lbrakk> \\<not> P; \\<not> P' \\<rbrakk> \\<Longrightarrow> corres_underlying srel nf nf' r R R' f g \\<rbrakk>\n      \\<Longrightarrow> corres_underlying srel nf nf' r (\\<lambda>s. (P \\<longrightarrow> Q s) \\<and> (\\<not> P \\<longrightarrow> R s))\n                                          (\\<lambda>s. (P' \\<longrightarrow> Q' s) \\<and> (\\<not> P' \\<longrightarrow> R' s))\n                                          f g\"\n  by (cases P, simp_all)\n\ntext \\<open>Support for symbolically executing into the guards\n        and manipulating them\\<close>\n\nlemma corres_symb_exec_l:\n  assumes z: \"\\<And>rv. corres_underlying sr nf nf' r (Q rv) P' (x rv) y\"\n  assumes x: \"\\<And>s. P s \\<Longrightarrow> \\<lbrace>(=) s\\<rbrace> m \\<exists>\\<lbrace>\\<lambda>r. (=) s\\<rbrace>\"\n  assumes y: \"\\<lbrace>P\\<rbrace> m \\<lbrace>Q\\<rbrace>\"\n  assumes nf: \"nf' \\<Longrightarrow> no_fail P m\"\n  shows      \"corres_underlying sr nf nf' r P P' (m >>= (\\<lambda>rv. x rv)) y\"\n  apply (rule corres_guard_imp)\n    apply (subst gets_bind_ign[symmetric], rule corres_split)\n       apply (rule z)\n      apply (rule corres_noop2)\n         apply (erule x)\n        apply (rule gets_wp)\n       apply (erule nf)\n      apply (rule non_fail_gets)\n     apply (rule y)\n    apply (rule gets_wp)\n   apply simp+\n  done\n\nlemma corres_symb_exec_r:\n  assumes z: \"\\<And>rv. corres_underlying sr nf nf' r P (Q' rv) x (y rv)\"\n  assumes y: \"\\<lbrace>P'\\<rbrace> m \\<lbrace>Q'\\<rbrace>\"\n  assumes x: \"\\<And>s. P' s \\<Longrightarrow> \\<lbrace>(=) s\\<rbrace> m \\<lbrace>\\<lambda>r. (=) s\\<rbrace>\"\n  assumes nf: \"nf' \\<Longrightarrow> no_fail P' m\"\n  shows      \"corres_underlying sr nf nf' r P P' x (m >>= (\\<lambda>rv. y rv))\"\n  apply (rule corres_guard_imp)\n    apply (subst gets_bind_ign[symmetric], rule corres_split)\n       apply (rule z)\n      apply (rule corres_noop2)\n         apply (simp add: simpler_gets_def exs_valid_def)\n        apply (erule x)\n       apply (rule non_fail_gets)\n      apply (erule nf)\n     apply (rule gets_wp)\n    apply (rule y)\n   apply simp+\n  done\n\nlemma corres_symb_exec_r_conj:\n  assumes z: \"\\<And>rv. corres_underlying sr nf nf' r Q (R' rv) x (y rv)\"\n  assumes y: \"\\<lbrace>Q'\\<rbrace> m \\<lbrace>R'\\<rbrace>\"\n  assumes x: \"\\<And>s. \\<lbrace>\\<lambda>s'. (s, s') \\<in> sr \\<and> P' s'\\<rbrace> m \\<lbrace>\\<lambda>rv s'. (s, s') \\<in> sr\\<rbrace>\"\n  assumes nf: \"\\<And>s. nf' \\<Longrightarrow> no_fail (\\<lambda>s'. (s, s') \\<in> sr \\<and> P' s') m\"\n  shows      \"corres_underlying sr nf nf' r Q (P' and Q') x (m >>= (\\<lambda>rv. y rv))\"\nproof -\n  have P: \"corres_underlying sr nf nf' dc \\<top> P' (return undefined) m\"\n    apply (rule corres_noop)\n     apply (simp add: x)\n    apply (erule nf)\n    done\n  show ?thesis\n  apply (rule corres_guard_imp)\n    apply (subst return_bind[symmetric],\n             rule corres_split [OF _ P])\n      apply (rule z)\n     apply wp\n    apply (rule y)\n   apply simp+\n  done\nqed\n\nlemma corres_bind_return_r:\n  \"corres_underlying S nf nf' (\\<lambda>x y. r x (h y)) P Q f g \\<Longrightarrow>\n   corres_underlying S nf nf' r P Q f (do x \\<leftarrow> g; return (h x) od)\"\n  by (fastforce simp: corres_underlying_def bind_def return_def)\n\nlemma corres_underlying_symb_exec_l:\n  \"\\<lbrakk> corres_underlying sr nf nf' dc P P' f (return ()); \\<And>rv. corres_underlying sr nf nf' r (Q rv) P' (g rv) h;\n     \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<rbrakk>\n    \\<Longrightarrow> corres_underlying sr nf nf' r P P' (f >>= g) h\"\n  apply (drule(1) corres_underlying_split)\n    apply (rule return_wp)\n   apply clarsimp\n   apply (erule meta_allE, assumption)\n  apply simp\n  done\n\ntext \\<open>Inserting assumptions to be proved later\\<close>\n\nlemma corres_req:\n  assumes x: \"\\<And>s s'. \\<lbrakk> (s, s') \\<in> sr; P s; P' s' \\<rbrakk> \\<Longrightarrow> F\"\n  assumes y: \"F \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\"\n  shows      \"corres_underlying sr nf nf' r P P' f g\"\n  apply (cases \"F\")\n   apply (rule y)\n   apply assumption\n  apply (simp add: corres_underlying_def)\n  apply clarsimp\n  apply (subgoal_tac \"F\")\n   apply simp\n  apply (rule x, assumption+)\n  done\n\n(* Insert assumption to be proved later, on the left-hand (abstract) side *)\nlemma corres_gen_asm:\n  assumes x: \"F \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\"\n  shows \"corres_underlying sr nf nf' r (P and (\\<lambda>s. F)) P' f g\"\n  apply (rule corres_req[where F=F])\n   apply simp\n  apply (rule corres_guard_imp [OF x])\n    apply simp+\n  done\n\n(* Insert assumption to be proved later, on the right-hand (concrete) side *)\nlemma corres_gen_asm2:\n  assumes x: \"F \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\"\n  shows \"corres_underlying sr nf nf' r P (P' and (\\<lambda>s. F)) f g\"\n  apply (rule corres_req[where F=F])\n   apply simp\n  apply (rule corres_guard_imp [OF x])\n    apply simp+\n  done\n\nlemma corres_trivial:\n \"corres_underlying sr nf nf' r \\<top> \\<top> f g \\<Longrightarrow> corres_underlying sr nf nf' r \\<top> \\<top> f g\"\n  by assumption\n\nlemma corres_assume_pre:\n  assumes R: \"\\<And>s s'. \\<lbrakk> P s; Q s'; (s,s') \\<in> sr \\<rbrakk> \\<Longrightarrow> corres_underlying sr nf nf' r P Q f g\"\n  shows \"corres_underlying sr nf nf' r P Q f g\"\n  apply (clarsimp simp add: corres_underlying_def)\n  apply (frule (2) R)\n  apply (clarsimp simp add: corres_underlying_def)\n  apply blast\n  done\n\nlemma corres_guard_imp2:\n  \"\\<lbrakk>corres_underlying sr nf nf' r Q P' f g; \\<And>s. P s \\<Longrightarrow> Q s\\<rbrakk> \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\"\n  by (blast intro: corres_guard_imp)\n(* FIXME: names\\<dots> (cf. corres_guard2_imp below) *)\nlemmas corres_guard1_imp = corres_guard_imp2\n\nlemma corres_guard2_imp:\n  \"\\<lbrakk>corres_underlying sr nf nf' r P Q' f g; \\<And>s. P' s \\<Longrightarrow> Q' s\\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\"\n  by (drule (1) corres_guard_imp[where P'=P' and Q=P], assumption+)\n\nlemma corres_initial_splitE:\n\"\\<lbrakk> corres_underlying sr nf nf' (f \\<oplus> r') P P' a c;\n   \\<And>rv rv'. r' rv rv' \\<Longrightarrow> corres_underlying sr nf nf' (f \\<oplus> r) (Q rv) (Q' rv') (b rv) (d rv');\n   \\<lbrace>P\\<rbrace> a \\<lbrace>Q\\<rbrace>, \\<lbrace>\\<lambda>r s. True\\<rbrace>;\n   \\<lbrace>P'\\<rbrace> c \\<lbrace>Q'\\<rbrace>, \\<lbrace>\\<lambda>r s. True\\<rbrace>\\<rbrakk>\n\\<Longrightarrow> corres_underlying sr nf nf' (f \\<oplus> r) P P' (a >>=E b) (c >>=E d)\"\n  apply (rule corres_guard_imp)\n    apply (erule (3) corres_splitEE)\n   apply simp\n  apply simp\n  done\n\nlemma corres_assert_assume:\n  \"\\<lbrakk> P' \\<Longrightarrow> corres_underlying sr nf nf' r P Q f (g ()); \\<And>s. Q s \\<Longrightarrow> P' \\<rbrakk> \\<Longrightarrow>\n  corres_underlying sr nf nf' r P Q f (assert P' >>= g)\"\n  by (auto simp: bind_def assert_def fail_def return_def\n                 corres_underlying_def)\n\nlemma corres_state_assert:\n  \"corres_underlying sr nf nf' rr P Q f (g ()) \\<Longrightarrow>\n   (\\<And>s. Q s \\<Longrightarrow> R s) \\<Longrightarrow>\n   corres_underlying sr nf nf' rr P Q f (state_assert R >>= g)\"\n  by (clarsimp simp: corres_underlying_def state_assert_def get_def assert_def\n                     return_def bind_def)\n\nlemma corres_stateAssert_assume:\n  \"\\<lbrakk> corres_underlying sr nf nf' r P Q f (g ()); \\<And>s. Q s \\<Longrightarrow> P' s \\<rbrakk> \\<Longrightarrow>\n   corres_underlying sr nf nf' r P Q f (stateAssert P' [] >>= g)\"\n  apply (clarsimp simp: bind_assoc stateAssert_def)\n  apply (rule corres_symb_exec_r [OF _ get_sp])\n    apply (rule corres_assert_assume)\n     apply (rule corres_assume_pre)\n     apply (erule corres_guard_imp, clarsimp+)\n   apply (wp | rule no_fail_pre)+\n  done\n\nlemma corres_stateAssert_implied:\n  \"\\<lbrakk> corres_underlying sr nf nf' r P Q f (g ());\n     \\<And>s s'. \\<lbrakk> (s, s') \\<in> sr; P s; P' s; Q s' \\<rbrakk> \\<Longrightarrow> Q' s' \\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr nf nf' r (P and P') Q f (stateAssert Q' [] >>= g)\"\n  apply (clarsimp simp: bind_assoc stateAssert_def)\n  apply (rule corres_symb_exec_r [OF _ get_sp])\n    apply (rule corres_assume_pre)\n    apply (rule corres_assert_assume)\n     apply (erule corres_guard_imp, clarsimp+)\n   apply (wp | rule no_fail_pre)+\n  done\n\nlemma corres_assert:\n  \"corres_underlying sr nf nf' dc (%_. P) (%_. Q) (assert P) (assert Q)\"\n  by (clarsimp simp add: corres_underlying_def return_def)\n\nlemma corres_split2:\n  assumes corr: \"\\<And>a a' b b'. \\<lbrakk> r a a' b b'\\<rbrakk>\n                     \\<Longrightarrow> corres_underlying sr nf nf' r1 (P1 a b) (P1' a' b') (H a b) (H' a' b')\"\n  and    corr': \"corres_underlying sr nf nf' (\\<lambda>(a, b).\\<lambda>(a', b'). r a a' b b') P P'\n                        (do a \\<leftarrow> F; b \\<leftarrow> G; return (a, b) od)\n                        (do a' \\<leftarrow> F'; b' \\<leftarrow> G'; return (a', b') od)\"\n  and       h1: \"\\<lbrace>P\\<rbrace> do fx \\<leftarrow> F; gx \\<leftarrow> G; return (fx, gx) od \\<lbrace>\\<lambda>rv. P1 (fst rv) (snd rv)\\<rbrace>\"\n  and       h2: \"\\<lbrace>P'\\<rbrace> do fx \\<leftarrow> F'; gx \\<leftarrow> G'; return (fx, gx) od \\<lbrace>\\<lambda>rv. P1' (fst rv) (snd rv)\\<rbrace>\"\n  shows \"corres_underlying sr nf nf' r1 P P'\n                (do a \\<leftarrow> F; b \\<leftarrow> G; H a b od)\n                (do a' \\<leftarrow> F'; b' \\<leftarrow> G'; H' a' b' od)\"\nproof -\n  have \"corres_underlying sr nf nf' r1 P P'\n               (do a \\<leftarrow> F; b \\<leftarrow> G; rv \\<leftarrow> return (a, b); H (fst rv) (snd rv) od)\n               (do a' \\<leftarrow> F'; b' \\<leftarrow> G'; rv' \\<leftarrow> return (a', b'); H' (fst rv') (snd rv') od)\"\n     by (rule corres_split' [OF corr' corr, simplified bind_assoc, OF _ h1 h2])\n   (simp add: split_beta split_def)\n\n  thus ?thesis by simp\nqed\n\n\nlemma corres_split3:\n  assumes corr: \"\\<And>a a' b b' c c'. \\<lbrakk> r a a' b b' c c'\\<rbrakk>\n                     \\<Longrightarrow> corres_underlying sr nf nf' r1 (P1 a b c) (P1' a' b' c') (H a b c) (H' a' b' c')\"\n  and    corr': \"corres_underlying sr nf nf' (\\<lambda>(a, b, c).\\<lambda>(a', b', c'). r a a' b b' c c') P P'\n                        (do a \\<leftarrow> A; b \\<leftarrow> B a; c \\<leftarrow> C a b; return (a, b, c) od)\n                        (do a' \\<leftarrow> A'; b' \\<leftarrow> B' a'; c' \\<leftarrow> C' a' b'; return (a', b', c') od)\"\n  and       h1: \"\\<lbrace>P\\<rbrace>\n                    do a \\<leftarrow> A; b \\<leftarrow> B a; c \\<leftarrow> C a b; return (a, b, c) od\n                 \\<lbrace>\\<lambda>(a, b, c). P1 a b c\\<rbrace>\"\n  and       h2: \"\\<lbrace>P'\\<rbrace>\n                    do a' \\<leftarrow> A'; b' \\<leftarrow> B' a'; c' \\<leftarrow> C' a' b'; return (a', b', c') od\n                 \\<lbrace>\\<lambda>(a', b', c'). P1' a' b' c'\\<rbrace>\"\n  shows \"corres_underlying sr nf nf' r1 P P'\n                (do a \\<leftarrow> A; b \\<leftarrow> B a; c \\<leftarrow> C a b; H a b c od)\n                (do a' \\<leftarrow> A'; b' \\<leftarrow> B' a'; c' \\<leftarrow> C' a' b'; H' a' b' c' od)\"\nproof -\n  have \"corres_underlying sr nf nf' r1 P P'\n               (do a \\<leftarrow> A; b \\<leftarrow> B a; c \\<leftarrow> C a b; rv \\<leftarrow> return (a, b, c);\n                          H (fst rv) (fst (snd rv)) (snd (snd rv)) od)\n               (do a' \\<leftarrow> A'; b' \\<leftarrow> B' a'; c' \\<leftarrow> C' a' b'; rv \\<leftarrow> return (a', b', c');\n                          H' (fst rv) (fst (snd rv)) (snd (snd rv)) od)\" using h1 h2\n    by - (rule corres_split' [OF corr' corr, simplified bind_assoc ],\n      simp_all add: split_beta split_def)\n\n  thus ?thesis by simp\nqed\n\n(* A little broken --- see above *)\nlemma corres_split4:\n  assumes corr: \"\\<And>a a' b b' c c' d d'. \\<lbrakk> r a a' b b' c c' d d'\\<rbrakk>\n                     \\<Longrightarrow> corres_underlying sr nf nf' r1 (P1 a b c d) (P1' a' b' c' d')\n                                  (H a b c d) (H' a' b' c' d')\"\n  and    corr': \"corres_underlying sr nf nf' (\\<lambda>(a, b, c, d).\\<lambda>(a', b', c', d'). r a a' b b' c c' d d') P P'\n                        (do a \\<leftarrow> A; b \\<leftarrow> B; c \\<leftarrow> C; d \\<leftarrow> D; return (a, b, c, d) od)\n                        (do a' \\<leftarrow> A'; b' \\<leftarrow> B'; c' \\<leftarrow> C'; d' \\<leftarrow> D'; return (a', b', c', d') od)\"\n  and       h1: \"\\<lbrace>P\\<rbrace>\n                    do a \\<leftarrow> A; b \\<leftarrow> B; c \\<leftarrow> C; d \\<leftarrow> D; return (a, b, c, d) od\n                 \\<lbrace>\\<lambda>(a, b, c, d). P1 a b c d\\<rbrace>\"\n  and       h2: \"\\<lbrace>P'\\<rbrace>\n                    do a' \\<leftarrow> A'; b' \\<leftarrow> B'; c' \\<leftarrow> C'; d' \\<leftarrow> D'; return (a', b', c', d') od\n                 \\<lbrace>\\<lambda>(a', b', c', d'). P1' a' b' c' d'\\<rbrace>\"\n  shows \"corres_underlying sr nf nf' r1 P P'\n                (do a \\<leftarrow> A; b \\<leftarrow> B; c \\<leftarrow> C; d \\<leftarrow> D; H a b c d od)\n                (do a' \\<leftarrow> A'; b' \\<leftarrow> B'; c' \\<leftarrow> C'; d' \\<leftarrow> D'; H' a' b' c' d' od)\"\nproof -\n  have \"corres_underlying sr nf nf' r1 P P'\n               (do a \\<leftarrow> A; b \\<leftarrow> B; c \\<leftarrow> C; d \\<leftarrow> D; rv \\<leftarrow> return (a, b, c, d);\n                   H (fst rv) (fst (snd rv)) (fst (snd (snd rv))) (snd (snd (snd rv))) od)\n               (do a' \\<leftarrow> A'; b' \\<leftarrow> B'; c' \\<leftarrow> C'; d' \\<leftarrow> D'; rv \\<leftarrow> return (a', b', c', d');\n                   H' (fst rv) (fst (snd rv)) (fst (snd (snd rv))) (snd (snd (snd rv))) od)\"\n    using h1 h2\n    by - (rule corres_split' [OF corr' corr, simplified bind_assoc],\n    simp_all add: split_beta split_def)\n\n  thus ?thesis by simp\nqed\n\n(* for instantiations *)\nlemma corres_inst: \"corres_underlying sr nf nf' r P P' f g \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\" .\n\nlemma corres_assert_opt_assume:\n  assumes \"\\<And>x. P' = Some x \\<Longrightarrow> corres_underlying sr nf nf' r P Q f (g x)\"\n  assumes \"\\<And>s. Q s \\<Longrightarrow> P' \\<noteq> None\"\n  shows \"corres_underlying sr nf nf' r P Q f (assert_opt P' >>= g)\" using assms\n  by (auto simp: bind_def assert_opt_def assert_def fail_def return_def\n                 corres_underlying_def split: option.splits)\n\n\ntext \\<open>Support for proving correspondance by decomposing the state relation\\<close>\n\nlemma corres_underlying_decomposition:\n  assumes x: \"corres_underlying {(s, s'). P s s'} nf nf' r Pr Pr' f g\"\n      and y: \"\\<And>s'. \\<lbrace>R s'\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q s s'\\<rbrace>\"\n      and z: \"\\<And>s. \\<lbrace>P s and Q s and K (Pr s) and Pr'\\<rbrace> g \\<lbrace>\\<lambda>rv s'. R s' s\\<rbrace>\"\n  shows      \"corres_underlying {(s, s'). P s s' \\<and> Q s s'} nf nf' r Pr Pr' f g\"\n  using x apply (clarsimp simp: corres_underlying_def)\n  apply (elim allE, drule(1) mp, clarsimp)\n  apply (drule(1) bspec)\n  apply clarsimp\n  apply (rule rev_bexI, assumption)\n  apply simp\n  apply (erule use_valid [OF _ y])\n  apply (erule use_valid [OF _ z])\n  apply simp\n  done\n\n\n\nlemma corres_stronger_no_failI:\n  assumes f': \"nf' \\<Longrightarrow> no_fail (\\<lambda>s'. \\<exists>s. P s \\<and> (s,s') \\<in> S \\<and> P' s')  f'\"\n  assumes corres: \"\\<forall>(s, s') \\<in> S. P s \\<and> P' s' \\<longrightarrow>\n                     (\\<forall>(r', t') \\<in> fst (f' s'). \\<exists>(r, t) \\<in> fst (f s). (t, t') \\<in> S \\<and> R r r')\"\n  shows \"corres_underlying S nf nf' R P P' f f'\"\n  using assms\n  apply (simp add: corres_underlying_def no_fail_def)\n  apply clarsimp\n  apply (rule conjI)\n   apply clarsimp\n   apply blast\n  apply clarsimp\n  apply blast\n  done\n\nlemma corres_fail:\n  assumes no_fail: \"\\<And>s s'. \\<lbrakk> (s,s') \\<in> sr; P s; P' s'; nf' \\<rbrakk> \\<Longrightarrow> False\"\n  shows \"corres_underlying sr nf nf' R P P' f fail\"\n  using no_fail\n  by (auto simp add: corres_underlying_def fail_def)\n\nlemma corres_returnOk:\n  \"(\\<And>s s'. \\<lbrakk> (s,s') \\<in> sr; P s; P' s' \\<rbrakk> \\<Longrightarrow> r x y) \\<Longrightarrow>\n  corres_underlying sr nf nf' (r' \\<oplus> r) P P' (returnOk x) (returnOk y)\"\n  apply (rule corres_noopE)\n   apply wp\n   apply clarsimp\n  apply wp\n  done\n\nlemmas corres_returnOkTT = corres_trivial [OF corres_returnOk]\n\nlemma corres_False [simp]:\n  \"corres_underlying sr nf nf' r P \\<bottom> f f'\"\n  by (simp add: corres_underlying_def)\n\nlemma corres_liftME[simp]:\n  \"corres_underlying sr nf nf' (f \\<oplus> r) P P' (liftME fn m) m'\n   = corres_underlying sr nf nf' (f \\<oplus> (r \\<circ> fn)) P P' m m'\"\n  apply (simp add: liftME_liftM)\n  apply (rule corres_cong [OF refl refl refl refl])\n  apply (case_tac x, simp_all)\n  done\n\nlemma corres_liftME2[simp]:\n  \"corres_underlying sr nf nf' (f \\<oplus> r) P P' m (liftME fn m')\n   = corres_underlying sr nf nf' (f \\<oplus> (\\<lambda>x. r x \\<circ> fn)) P P' m m'\"\n  apply (simp add: liftME_liftM)\n  apply (rule corres_cong [OF refl refl refl refl])\n  apply (case_tac y, simp_all)\n  done\n\nlemma corres_assertE_assume:\n  \"\\<lbrakk>\\<And>s. P s \\<longrightarrow> P'; \\<And>s'. Q s' \\<longrightarrow> Q'\\<rbrakk> \\<Longrightarrow>\n   corres_underlying sr nf nf' (f \\<oplus> (=)) P Q (assertE P') (assertE Q')\"\n  apply (simp add: corres_underlying_def assertE_def returnOk_def\n                   fail_def return_def)\n  by blast\n\ndefinition\n  rel_prod :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('c \\<Rightarrow> 'd \\<Rightarrow> bool) \\<Rightarrow> ('a \\<times> 'c \\<Rightarrow> 'b \\<times> 'd \\<Rightarrow> bool)\"\n  (infix \"\\<otimes>\" 97)\nwhere\n  \"rel_prod \\<equiv> \\<lambda>f g (a,b) (c,d). f a c \\<and> g b d\"\n\nlemma rel_prod_apply [simp]:\n  \"(f \\<otimes> g) (a,b) (c,d) = (f a c \\<and> g b d)\"\n  by (simp add: rel_prod_def)\n\nlemma mapME_x_corres_inv:\n  assumes x: \"\\<And>x. corres_underlying sr nf nf' (f \\<oplus> dc) (P x) (P' x) (m x) (m' x)\"\n  assumes y: \"\\<And>x P. \\<lbrace>P\\<rbrace> m x \\<lbrace>\\<lambda>x. P\\<rbrace>,-\" \"\\<And>x P'. \\<lbrace>P'\\<rbrace> m' x \\<lbrace>\\<lambda>x. P'\\<rbrace>,-\"\n  assumes z: \"xs = ys\"\n  shows      \"corres_underlying sr nf nf' (f \\<oplus> dc) (\\<lambda>s. \\<forall>x \\<in> set xs. P x s) (\\<lambda>s. \\<forall>y \\<in> set ys. P' y s)\n                              (mapME_x m xs) (mapME_x m' ys)\"\n  unfolding z\nproof (induct ys)\n  case Nil\n  show ?case\n    by (simp add: mapME_x_def sequenceE_x_def returnOk_def)\nnext\n  case (Cons z zs)\n    from Cons have IH:\n      \"corres_underlying sr nf nf' (f \\<oplus> dc) (\\<lambda>s. \\<forall>x\\<in>set zs. P x s) (\\<lambda>s. \\<forall>y\\<in>set zs. P' y s)\n                       (mapME_x m zs) (mapME_x m' zs)\" .\n  show ?case\n    apply (simp add: mapME_x_def sequenceE_x_def)\n    apply (fold mapME_x_def sequenceE_x_def dc_def)\n    apply (rule corres_guard_imp)\n      apply (rule corres_splitEE)\n         apply (rule IH)\n        apply (rule x)\n       apply (fold validE_R_def)\n       apply (rule y)+\n     apply simp+\n    done\nqed\n\nlemma select_corres_eq:\n  \"corres_underlying sr nf nf' (=) \\<top> \\<top> (select UNIV) (select UNIV)\"\n  by (simp add: corres_underlying_def select_def)\n\nlemma corres_cases:\n  \"\\<lbrakk> R \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g; \\<not>R \\<Longrightarrow> corres_underlying sr nf nf' r Q Q' f g \\<rbrakk>\n  \\<Longrightarrow> corres_underlying sr nf nf' r (P and Q) (P' and Q') f g\"\n  by (simp add: corres_underlying_def) blast\n\nlemma corres_cases':\n  \"\\<lbrakk> R \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g; \\<not>R \\<Longrightarrow> corres_underlying sr nf nf' r Q Q' f g \\<rbrakk>\n  \\<Longrightarrow> corres_underlying sr nf nf' r (\\<lambda>s. (R \\<longrightarrow> P s) \\<and> (\\<not>R \\<longrightarrow> Q s))\n                                   (\\<lambda>s. (R \\<longrightarrow> P' s) \\<and> (\\<not>R \\<longrightarrow> Q' s)) f g\"\n  by (cases R; simp)\n\nlemma corres_alternate1:\n  \"corres_underlying sr nf nf' r P P' a c \\<Longrightarrow> corres_underlying sr nf nf' r P P' (a OR b) c\"\n  apply (simp add: corres_underlying_def alternative_def)\n  apply clarsimp\n  apply (drule (1) bspec, clarsimp)+\n  apply (rule rev_bexI)\n   apply (rule UnI1)\n   apply assumption\n  apply simp\n  done\n\nlemma corres_alternate2:\n  \"corres_underlying sr nf nf' r P P' b c \\<Longrightarrow> corres_underlying sr nf nf' r P P' (a OR b) c\"\n  apply (simp add: corres_underlying_def alternative_def)\n  apply clarsimp\n  apply (drule (1) bspec, clarsimp)+\n  apply (rule rev_bexI)\n   apply (rule UnI2)\n   apply assumption\n  apply simp\n  done\n\nlemma corres_False':\n  \"corres_underlying sr nf nf' r \\<bottom> P' f g\"\n  by (simp add: corres_underlying_def)\n\nlemma corres_symb_exec_l_Ex:\n  assumes x: \"\\<And>rv. corres_underlying sr nf nf' r (Q rv) P' (g rv) h\"\n  shows      \"corres_underlying sr nf nf' r (\\<lambda>s. \\<exists>rv. Q rv s \\<and> (rv, s) \\<in> fst (f s)) P'\n                       (do rv \\<leftarrow> f; g rv od) h\"\n  apply (clarsimp simp add: corres_underlying_def)\n  apply (cut_tac rv=rv in x)\n  apply (clarsimp simp add: corres_underlying_def)\n  apply (drule(1) bspec, clarsimp)\n  apply (case_tac nf)\n   apply (clarsimp simp: bind_def')\n   apply blast\n  apply clarsimp\n  apply (drule(1) bspec, clarsimp)\n  apply (clarsimp simp: bind_def | erule rev_bexI)+\n  done\n\nlemma corres_symb_exec_r_All:\n  assumes nf: \"\\<And>rv. nf' \\<Longrightarrow> no_fail (Q' rv) g\"\n  assumes x: \"\\<And>rv. corres_underlying sr nf nf' r P (Q' rv) f (h rv)\"\n  shows      \"corres_underlying sr nf nf' r P (\\<lambda>s. (\\<forall>p \\<in> fst (g s). snd p = s \\<and> Q' (fst p) s) \\<and> (\\<exists>rv. Q' rv s))\n                       f (do rv \\<leftarrow> g; h rv od)\"\n  apply (clarsimp simp add: corres_underlying_def bind_def)\n  apply (rule conjI)\n   apply clarsimp\n   apply (cut_tac rv=aa in x)\n   apply (clarsimp simp add: corres_underlying_def bind_def)\n   apply (drule(1) bspec, clarsimp)+\n  apply (insert nf)\n  apply (clarsimp simp: no_fail_def)\n  apply (erule (1) my_BallE)\n  apply (cut_tac rv=\"aa\" in x)\n  apply (clarsimp simp add: corres_underlying_def bind_def)\n  apply (drule(1) bspec, clarsimp)+\n  done\n\nlemma corres_split_bind_case_sum:\n  assumes x: \"corres_underlying sr nf nf' (lr \\<oplus> rr) P P' a d\"\n  assumes y: \"\\<And>rv rv'. lr rv rv' \\<Longrightarrow> corres_underlying sr nf nf' r (R rv) (R' rv') (b rv) (e rv')\"\n  assumes z: \"\\<And>rv rv'. rr rv rv' \\<Longrightarrow> corres_underlying sr nf nf' r (S rv) (S' rv') (c rv) (f rv')\"\n  assumes w: \"\\<lbrace>Q\\<rbrace> a \\<lbrace>S\\<rbrace>,\\<lbrace>R\\<rbrace>\" \"\\<lbrace>Q'\\<rbrace> d \\<lbrace>S'\\<rbrace>,\\<lbrace>R'\\<rbrace>\"\n  shows \"corres_underlying sr nf nf' r (P and Q) (P' and Q')\n            (a >>= (\\<lambda>rv. case_sum b c rv)) (d >>= (\\<lambda>rv'. case_sum e f rv'))\"\n  apply (rule corres_split [OF _ x])\n    defer\n    apply (insert w)[2]\n    apply (simp add: validE_def)+\n  apply (case_tac rv)\n   apply (clarsimp simp: y)\n  apply (clarsimp simp: z)\n  done\n\nlemma whenE_throwError_corres_initial:\n  assumes P: \"frel f f'\"\n  assumes Q: \"P = P'\"\n  assumes R: \"\\<not> P \\<Longrightarrow> corres_underlying sr nf nf' (frel \\<oplus> rvr) Q Q' m m'\"\n  shows      \"corres_underlying sr nf nf' (frel \\<oplus> rvr) Q Q'\n                     (whenE P  (throwError f ) >>=E (\\<lambda>_. m ))\n                     (whenE P' (throwError f') >>=E (\\<lambda>_. m'))\"\n  unfolding whenE_def\n  apply (cases P)\n   apply (simp add: P Q)\n  apply (simp add: Q)\n  apply (rule R)\n  apply (simp add: Q)\n  done\n\nlemma whenE_throwError_corres:\n  assumes P: \"frel f f'\"\n  assumes Q: \"P = P'\"\n  assumes R: \"\\<not> P \\<Longrightarrow> corres_underlying sr nf nf' (frel \\<oplus> rvr) Q Q' m m'\"\n  shows      \"corres_underlying sr nf nf' (frel \\<oplus> rvr) (\\<lambda>s. \\<not> P \\<longrightarrow> Q s) (\\<lambda>s. \\<not> P' \\<longrightarrow> Q' s)\n                     (whenE P  (throwError f ) >>=E (\\<lambda>_. m ))\n                     (whenE P' (throwError f') >>=E (\\<lambda>_. m'))\"\n  apply (rule whenE_throwError_corres_initial)\n  apply (simp_all add: P Q R)\n  done\n\nlemma corres_move_asm:\n  \"\\<lbrakk> corres_underlying sr nf nf' r P  Q f g;\n      \\<And>s s'. \\<lbrakk>(s,s') \\<in> sr; P s; P' s'\\<rbrakk> \\<Longrightarrow> Q s'\\<rbrakk>\n    \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\"\n  by (fastforce simp: corres_underlying_def)\n\nlemmas corres_cross_over_guard = corres_move_asm[rotated]\n\nlemma corres_weak_cong:\n  \"\\<lbrakk>\\<And>s. P s \\<Longrightarrow> f s = f' s; \\<And>s. Q s \\<Longrightarrow> g s = g' s\\<rbrakk>\n  \\<Longrightarrow> corres_underlying sr nf nf' r P Q f g = corres_underlying sr nf nf' r P Q f' g'\"\n  by (simp cong: corres_cong)\n\nlemma corres_either_alternate:\n  \"\\<lbrakk> corres_underlying sr nf nf' r P Pa' a c; corres_underlying sr nf nf' r P Pb' b c \\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr nf nf' r P (Pa' or Pb') (a \\<sqinter> b) c\"\n  apply (simp add: corres_underlying_def alternative_def)\n  apply clarsimp\n  apply (drule (1) bspec, clarsimp)+\n  apply (erule disjE, clarsimp)\n   apply (drule(1) bspec, clarsimp)\n   apply (rule rev_bexI)\n    apply (erule UnI1)\n   apply simp\n  apply (clarsimp, drule(1) bspec, clarsimp)\n  apply (rule rev_bexI)\n   apply (erule UnI2)\n  apply simp\n  done\n\nlemma corres_either_alternate2:\n  \"\\<lbrakk> corres_underlying sr nf nf' r P R a c; corres_underlying sr nf nf' r Q R b c \\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr nf nf' r (P or Q) R (a \\<sqinter> b) c\"\n  apply (simp add: corres_underlying_def alternative_def)\n  apply clarsimp\n  apply (drule (1) bspec, clarsimp)+\n   apply (erule disjE)\n   apply clarsimp\n   apply (drule(1) bspec, clarsimp)\n   apply (rule rev_bexI)\n    apply (erule UnI1)\n   apply simp\n   apply clarsimp\n  apply (drule(1) bspec, clarsimp)\n  apply (rule rev_bexI)\n   apply (erule UnI2)\n  apply simp\n  done\n\nlemma option_corres:\n  assumes None: \"\\<lbrakk> x = None; x' = None \\<rbrakk> \\<Longrightarrow> corres_underlying sr nf nf' r P P' (A None) (C None)\"\n  assumes Some: \"\\<And>z z'. \\<lbrakk> x = Some z; x' = Some z' \\<rbrakk> \\<Longrightarrow>\n             corres_underlying sr nf nf' r (Q z) (Q' z') (A (Some z)) (C (Some z'))\"\n  assumes None_eq: \"(x = None) = (x' = None)\"\n  shows \"corres_underlying sr nf nf' r (\\<lambda>s. (x = None \\<longrightarrow> P s) \\<and> (\\<forall>z. x = Some z \\<longrightarrow> Q z s))\n                  (\\<lambda>s. (x' = None \\<longrightarrow> P' s) \\<and> (\\<forall>z. x' = Some z \\<longrightarrow> Q' z s))\n                  (A x) (C x')\"\n  apply (cases x; cases x'; simp add: assms)\n   apply (simp add: None flip: None_eq)\n  apply (simp flip: None_eq)\n  done\n\n\nlemma corres_bind_return:\n \"corres_underlying sr nf nf' r P P' (f >>= return) g \\<Longrightarrow>\n  corres_underlying sr nf nf' r P P' f g\"\n  by (simp add: corres_underlying_def)\n\nlemma corres_bind_return2:\n  \"corres_underlying sr nf nf' r P P' f (g >>= return) \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\"\n  by simp\n\nlemma corres_stateAssert_implied2:\n  assumes c: \"corres_underlying sr nf nf' r P Q f g\"\n  assumes sr: \"\\<And>s s'. \\<lbrakk>(s, s') \\<in> sr; R s; R' s'\\<rbrakk> \\<Longrightarrow> Q' s'\"\n  assumes f: \"\\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>_. R\\<rbrace>\"\n  assumes g: \"\\<lbrace>Q\\<rbrace> g \\<lbrace>\\<lambda>_. R'\\<rbrace>\"\n  shows \"corres_underlying sr nf nf' dc P Q f (g >>= (\\<lambda>_. stateAssert Q' []))\"\n  apply (subst bind_return[symmetric])\n  apply (rule corres_guard_imp)\n    apply (rule corres_split)\n       prefer 2\n       apply (rule c)\n      apply (clarsimp simp: corres_underlying_def return_def\n                            stateAssert_def bind_def get_def assert_def\n                            fail_def)\n      apply (drule (2) sr)\n      apply simp\n     apply (rule f)\n    apply (rule g)\n   apply simp\n  apply simp\n  done\n\nlemma corres_add_noop_lhs:\n  \"corres_underlying sr nf nf' r P P' (return () >>= (\\<lambda>_. f)) g\n      \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\"\n  by simp\n\nlemma corres_add_noop_lhs2:\n  \"corres_underlying sr nf nf' r P P' (f >>= (\\<lambda>_. return ())) g\n      \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\"\n  by simp\n\nlemmas corres_split_noop_rhs\n  = corres_split_nor[THEN corres_add_noop_lhs, OF _ _ return_wp]\n\nlemmas corres_split_noop_rhs2\n  = corres_split_nor[THEN corres_add_noop_lhs2]\n\nlemmas corres_split_dc = corres_split[where r'=dc, simplified]\n\nlemma isLeft_case_sum:\n  \"isLeft v \\<Longrightarrow> (case v of Inl v' \\<Rightarrow> f v' | Inr v' \\<Rightarrow> g v') = f (theLeft v)\"\n  by (clarsimp simp: isLeft_def)\n\nlemma corres_symb_exec_catch_r:\n  \"\\<lbrakk> \\<And>rv. corres_underlying sr nf nf' r P (Q' rv) f (h rv);\n        \\<lbrace>P'\\<rbrace> g \\<lbrace>\\<bottom>\\<bottom>\\<rbrace>, \\<lbrace>Q'\\<rbrace>; \\<And>s. \\<lbrace>(=) s\\<rbrace> g \\<lbrace>\\<lambda>r. (=) s\\<rbrace>; nf' \\<Longrightarrow> no_fail P' g \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' r P P' f (g <catch> h)\"\n  apply (simp add: catch_def)\n  apply (rule corres_symb_exec_r, simp_all)\n   apply (rule_tac F=\"isLeft x\" in corres_gen_asm2)\n   apply (simp add: isLeft_case_sum)\n   apply assumption\n  apply (simp add: validE_def)\n  apply (erule hoare_chain, simp_all)[1]\n  apply (simp add: isLeft_def split: sum.split_asm)\n  done\n\nlemma corres_return_eq_same:\n  \"a = b \\<Longrightarrow> corres_underlying srel nf' nf (=) \\<top> \\<top> (return a) (return b)\"\n  apply (simp add: corres_underlying_def return_def)\n  done\n\nlemmas corres_discard_r =\n  corres_symb_exec_r [where P'=P' and Q'=\"\\<lambda>_. P'\" for P', simplified]\n\nlemmas corres_returnTT = corres_return[where P=\\<top> and P'=\\<top>, THEN iffD2]\n\nlemma corres_assert_gen_asm:\n  \"\\<lbrakk> F \\<Longrightarrow> corres_underlying sr nf nf' r P Q f (g ()) \\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr nf nf' r (P and (\\<lambda>_. F)) Q f (assert F >>= g)\"\n  by (simp add: corres_gen_asm)\n\nlemma corres_assert_gen_asm_l:\n  \"\\<lbrakk> F \\<Longrightarrow> corres_underlying sr nf nf' r P Q (f ()) g \\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr nf nf' r (P and (\\<lambda>_. F)) Q (assert F >>= f) g\"\n  by (simp add: corres_gen_asm)\n\nlemma corres_assert_gen_asm2:\n  \"\\<lbrakk> F \\<Longrightarrow> corres_underlying sr nf nf' r P Q f (g ()) \\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr nf nf' r P (Q and (\\<lambda>_. F)) f (assert F >>= g)\"\n  by (simp add: corres_gen_asm2)\n\nlemma corres_assert_gen_asm_l2:\n  \"\\<lbrakk> F \\<Longrightarrow> corres_underlying sr nf nf' r P Q (f ()) g \\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr nf nf' r P (Q and (\\<lambda>_. F)) (assert F >>= f) g\"\n  by (simp add: corres_gen_asm2)\n\nlemma corres_add_guard:\n  \"\\<lbrakk>\\<And>s s'. \\<lbrakk>Q s; Q' s'; (s, s') \\<in> sr\\<rbrakk> \\<Longrightarrow> P s \\<and> P' s';\n    corres_underlying sr nf nf' r (Q and P) (Q' and P') f g\\<rbrakk> \\<Longrightarrow>\n    corres_underlying sr nf nf' r Q Q' f g\"\n  by (auto simp: corres_underlying_def)\n\n(* safer non-rewrite version of corres_gets *)\nlemma corres_gets_trivial:\n  \"\\<lbrakk>\\<And>s s'. (s,s') \\<in> sr \\<Longrightarrow> f s = f' s' \\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr nf nf' (=) \\<top> \\<top> (gets f) (gets f')\"\n  unfolding corres_underlying_def gets_def get_def return_def bind_def\n  by clarsimp\n\ntext \\<open>Some setup of specialised methods.\\<close>\n\nlemma (in strengthen_implementation) wpfix_strengthen_corres_guard_imp:\n  \"(\\<And>s. st (\\<not> F) (\\<longrightarrow>) (P s) (Q s))\n    \\<Longrightarrow> (\\<And>s. st (\\<not> F) (\\<longrightarrow>) (P' s) (Q' s))\n    \\<Longrightarrow> st F (\\<longrightarrow>)\n        (corres_underlying sr nf nf' r P P' f g)\n        (corres_underlying sr nf nf' r Q Q' f g)\"\n  by (cases F; auto elim: corres_guard_imp)\n\nlemmas wpfix_strengthen_corres_guard_imp[wp_fix_strgs]\n    = strengthen_implementation.wpfix_strengthen_corres_guard_imp\n\nlemma corres_name_pre:\n  \"\\<lbrakk> \\<And>s s'. \\<lbrakk> P s; P' s'; (s, s') \\<in> sr \\<rbrakk>\n                 \\<Longrightarrow> corres_underlying sr nf nf' r ((=) s) ((=) s') f g \\<rbrakk>\n        \\<Longrightarrow> corres_underlying sr nf nf' r P P' f g\"\n  apply (simp add: corres_underlying_def split_def\n                   Ball_def)\n  apply blast\n  done\n\nlemma corres_return_trivial:\n  \"corres_underlying srel nf' nf dc \\<top> \\<top> (return a) (return b)\"\n  by (simp add: corres_underlying_def return_def)\n\nlemma mapME_x_corres_same_xs:\n  assumes x: \"\\<And>x. x \\<in> set xs\n      \\<Longrightarrow> corres_underlying sr nf nf' (f \\<oplus> dc) (P x) (P' x) (m x) (m' x)\"\n  assumes y: \"\\<And>x. x \\<in> set xs \\<Longrightarrow> \\<lbrace>\\<lambda>s. \\<forall>y \\<in> set xs. P y s\\<rbrace> m x \\<lbrace>\\<lambda>_ s. \\<forall>y \\<in> set xs. P y s\\<rbrace>,-\"\n             \"\\<And>x. x \\<in> set xs \\<Longrightarrow> \\<lbrace>\\<lambda>s. \\<forall>y \\<in> set xs. P' y s\\<rbrace> m' x \\<lbrace>\\<lambda>_ s. \\<forall>y \\<in> set xs. P' y s\\<rbrace>,-\"\n  assumes z: \"xs = ys\"\n  shows      \"corres_underlying sr nf nf' (f \\<oplus> dc) (\\<lambda>s. \\<forall>x \\<in> set xs. P x s) (\\<lambda>s. \\<forall>y \\<in> set ys. P' y s)\n                              (mapME_x m xs) (mapME_x m' ys)\"\n  apply (subgoal_tac \"set ys \\<subseteq> set xs\n        \\<Longrightarrow> corres_underlying sr nf nf' (f \\<oplus> dc) (\\<lambda>s. \\<forall>x \\<in> set xs. P x s) (\\<lambda>s. \\<forall>y \\<in> set xs. P' y s)\n                              (mapME_x m ys) (mapME_x m' ys)\")\n   apply (simp add: z)\nproof (induct ys)\n  case Nil\n  show ?case\n    by (simp add: mapME_x_def sequenceE_x_def returnOk_def)\nnext\n  case (Cons z zs)\n    from Cons have IH:\n      \"corres_underlying sr nf nf' (f \\<oplus> dc) (\\<lambda>s. \\<forall>x\\<in>set xs. P x s) (\\<lambda>s. \\<forall>y\\<in>set xs. P' y s)\n                       (mapME_x m zs) (mapME_x m' zs)\"\n      by (simp add: dc_def)\n    from Cons have in_set:\n      \"z \\<in> set xs\" \"set zs \\<subseteq> set xs\" by auto\n  thus ?case\n    apply (simp add: mapME_x_def sequenceE_x_def)\n    apply (fold mapME_x_def sequenceE_x_def dc_def)\n    apply (rule corres_guard_imp)\n      apply (rule corres_splitEE)\n         apply (rule IH)\n        apply (rule x, simp)\n       apply (wp y | simp)+\n    done\nqed\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/Corres_UL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631840431539, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.34161396252250303}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Peter Lammich <peter dot lammich at uni-muenster.de>\n    Maintainer:  Peter Lammich <peter dot lammich at uni-muenster.de>\n*)\nsection \\<open>\\isaheader{Deprecated: Data Refinement for the While-Combinator}\\<close>\ntheory DatRef\nimports \n  Main \n  \"HOL-Library.While_Combinator\"\nbegin\ntext_raw \\<open>\\label{thy:DatRef}\\<close>\n\ntext \\<open>\n  Note that this theory is deprecated. For new developments, the refinement \n  framework (Refine-Monadic entry of the AFP) should be used.\n\\<close>\n\ntext \\<open>\n  In this theory, a data refinement framework for \n  non-deterministic while-loops is developed. The refinement is based on\n  showing simulation w.r.t. an abstraction function.\n  The case of deterministic while-loops is explicitely handled, to\n  support proper code-generation using the While-Combinator.\n  \n  Note that this theory is deprecated. For new developments, the refinement \n  framework (Refine-Monadic entry of the AFP) should be used.\n\\<close>\n\n(* TODO-LIST and ideas\n  - Model nondeterministic algorithms by their step relation, and show refinement stuff for this (more general) model (c.f. dpn-pre^* formalization)\n    Then, the nondeterministic while-loop would be a special case.\n\n*)\n\n\ntext \\<open>\n  A nondeterministic while-algorithm is described by a set of states, a \n  continuation condition, a step relation, a set of possible initial \n  states and an invariant.\n\\<close>\n\n  \\<comment> \\<open>Encapsulates a while-algorithm and its invariant\\<close>\nrecord 'S while_algo =\n  \\<comment> \\<open>Termination condition\\<close>\n  wa_cond :: \"'S set\"\n  \\<comment> \\<open>Step relation (nondeterministic)\\<close>\n  wa_step :: \"('S \\<times> 'S) set\"\n  \\<comment> \\<open>Initial state (nondeterministic)\\<close>\n  wa_initial :: \"'S set\"\n  \\<comment> \\<open>Invariant\\<close>\n  wa_invar :: \"'S set\"\n  \ntext \\<open>\n  A while-algorithm is called {\\em well-defined} iff the invariant holds for \n  all reachable states and the accessible part of the step-relation is\n  well-founded.\n\\<close>\n  \\<comment> \\<open>Conditions that must hold for a well-defined while-algorithm\\<close>\nlocale while_algo =\n  fixes WA :: \"'S while_algo\"\n\n  \\<comment> \\<open>A step must preserve the invariant\\<close>\n  assumes step_invar: \n    \"\\<lbrakk> s\\<in>wa_invar WA; s\\<in>wa_cond WA; (s,s')\\<in>wa_step WA \\<rbrakk> \\<Longrightarrow> s'\\<in>wa_invar WA\"\n  \\<comment> \\<open>Initial states must satisfy the invariant\\<close>\n  assumes initial_invar: \"wa_initial WA \\<subseteq> wa_invar WA\"\n  \\<comment> \\<open>The accessible part of the step relation must be well-founded\\<close>\n  assumes step_wf: \n    \"wf { (s',s). s\\<in>wa_invar WA \\<and> s\\<in>wa_cond WA \\<and> (s,s')\\<in>wa_step WA }\"\n\ntext \\<open>\n  Next, a refinement relation for while-algorithms is defined.\n  Note that the involved while-algorithms are not required to\n  be well-defined. Later, some lemmas to transfer well-definedness\n  along refinement relations are shown.\n\n  Refinement involves a concrete algorithm, an abstract algorithm and an \n  abstraction function. In essence, a refinement establishes a simulation\n  of the concrete algorithm by the abstract algorithm w.r.t. the abstraction \n  function.\n\\<close>\n\nlocale wa_refine = \n  \\<comment> \\<open>Concrete algorithm\\<close>\n  fixes WAC :: \"'C while_algo\"\n  \\<comment> \\<open>Abstract algorithm\\<close>\n  fixes WAA :: \"'A while_algo\"\n\n  \\<comment> \\<open>Abstraction function\\<close>\n  fixes \\<alpha> :: \"'C \\<Rightarrow> 'A\"\n\n  \\<comment> \\<open>Condition implemented correctly: The concrete condition must be stronger \n      than the abstract one. Intuitively, this ensures that the concrete loop\n      will not run longer than the abstract one that it is simulated by.\\<close>\n  assumes cond_abs: \"\\<lbrakk> s\\<in>wa_invar WAC; s\\<in>wa_cond WAC \\<rbrakk> \\<Longrightarrow> \\<alpha> s \\<in> wa_cond WAA\"\n\n  \\<comment> \\<open>Step implemented correctly: The abstract step relation must simulate the \n      concrete step relation\\<close>\n  assumes step_abs: \"\\<lbrakk> s\\<in>wa_invar WAC; s\\<in>wa_cond WAC; (s,s')\\<in>wa_step WAC \\<rbrakk> \n                      \\<Longrightarrow> (\\<alpha> s, \\<alpha> s')\\<in>wa_step WAA\"\n  \\<comment> \\<open>Initial states implemented correctly: The abstractions of the concrete\n      initial states must be abstract initial states.\\<close>\n  assumes initial_abs: \"\\<alpha> ` wa_initial WAC \\<subseteq> wa_initial WAA\"\n  \\<comment> \\<open>Invariant implemented correctly: The concrete invariant must be stronger\n        then the abstract invariant.\n        Note that, usually, the concrete invariant will be of the \n        form @{term \"I_add \\<inter> {s. \\<alpha> s \\<in> wa_invar WAA}\"}, where @{term I_add} are\n        the additional invariants added by the concrete algorithm.\\<close>\n  assumes invar_abs: \"\\<alpha> ` wa_invar WAC \\<subseteq> wa_invar WAA\"\nbegin\n\n  lemma initial_abs': \"s\\<in>wa_initial WAC \\<Longrightarrow> \\<alpha> s \\<in> wa_initial WAA\"\n    using initial_abs by auto\n\n  lemma invar_abs': \"s\\<in>wa_invar WAC \\<Longrightarrow> \\<alpha> s \\<in> wa_invar WAA\"\n    using invar_abs by auto\n\nend\n\n\\<comment> \\<open>Given a concrete while-algorithm and a well-defined abstract \n  while-algorithm, this lemma shows refinement and \n  well-definedness of the concrete while-algorithm.\n\n  Assuming well-definedness of the abstract algorithm and refinement,\n  some proof-obligations for well-definedness of the concrete algorithm can be\n  discharged automatically.\n\n  For this purpose, the invariant is split into a concrete and an abstract \n  part. The abstract part claims that the abstraction of a state satisfies \n  the abstract invariant. The concrete part makes some additional claims\n  about a valid concrete state. Then, after having shown refinement, the \n  assumptions that the abstract part of the invariant is preserved, can\n  be discharged automatically.\\<close>\nlemma wa_refine_intro:\n  fixes condc :: \"'C set\" and \n        stepc :: \"('C\\<times>'C) set\" and \n        initialc :: \"'C set\" and \n        invar_addc :: \"'C set\"\n  fixes WAA :: \"'A while_algo\"\n  fixes \\<alpha> :: \"'C \\<Rightarrow> 'A\"\n  assumes \"while_algo WAA\"\n\n  \\<comment> \\<open>The concrete step preserves the concrete part of the invariant\\<close>\n  assumes step_invarc: \n    \"!!s s'. \\<lbrakk> s\\<in>invar_addc; s\\<in>condc; \\<alpha> s \\<in> wa_invar WAA; (s,s')\\<in>stepc \\<rbrakk> \n              \\<Longrightarrow> s'\\<in>invar_addc\"\n  \\<comment> \\<open>The concrete initial states satisfy the concrete part of the invariant\\<close>\n  assumes initial_invarc: \"initialc \\<subseteq> invar_addc\"\n\n  \\<comment> \\<open>Condition implemented correctly\\<close>\n  assumes cond_abs: \n    \"!!s. \\<lbrakk> s\\<in>invar_addc; \\<alpha> s \\<in> wa_invar WAA; s\\<in>condc \\<rbrakk> \\<Longrightarrow> \\<alpha> s \\<in> wa_cond WAA\"\n  \\<comment> \\<open>Step implemented correctly\\<close>\n  assumes step_abs: \n    \"!!s s'. \\<lbrakk> s\\<in>invar_addc; s\\<in>condc; \\<alpha> s \\<in> wa_invar WAA; (s,s')\\<in>stepc \\<rbrakk> \n             \\<Longrightarrow> (\\<alpha> s, \\<alpha> s')\\<in>wa_step WAA\"\n  \\<comment> \\<open>Initial states implemented correctly\\<close>\n  assumes initial_abs: \"\\<alpha> ` initialc \\<subseteq> wa_initial WAA\"\n\n  \\<comment> \\<open>Concrete while-algorithm: The invariant is separated into a concrete and\n      an abstract part\\<close>\n  defines \"WAC == \\<lparr> \n   wa_cond=condc, \n   wa_step=stepc, \n   wa_initial=initialc, \n   wa_invar=(invar_addc \\<inter> {s. \\<alpha> s\\<in> wa_invar WAA}) \\<rparr>\"\n\n  shows \n    \"while_algo WAC \\<and> \n     wa_refine WAC WAA \\<alpha>\" (is \"?T1 \\<and> ?T2\")\nproof\n  interpret waa: while_algo WAA by fact\n  show G1: \"?T1\"\n    apply (unfold_locales)\n    apply (simp_all add: WAC_def)\n    apply safe\n    apply (blast intro!: step_invarc)\n\n    apply (frule (3) step_abs)\n    apply (frule (2) cond_abs)\n    apply (erule (2) waa.step_invar)\n\n    apply (erule rev_subsetD[OF _ initial_invarc])\n\n    apply (insert initial_abs waa.initial_invar) [1]\n    apply blast\n\n    apply (rule_tac \n      r=\"inv_image { (s',s). s\\<in>wa_invar WAA \n                     \\<and> s\\<in>wa_cond WAA \n                     \\<and> (s,s')\\<in>wa_step WAA } \\<alpha>\" \n      in wf_subset)\n    apply (simp add: waa.step_wf)\n    apply (auto simp add: cond_abs step_abs) [1]\n    done\n  show ?T2\n    apply (unfold_locales)\n    apply (auto simp add: cond_abs step_abs initial_abs WAC_def)\n    done\nqed\n\n  \\<comment> \\<open>After refinement has been shown, this lemma transfers\n        the well-definedness property up the refinement chain.\n        Like in @{thm [source] wa_refine_intro}, some proof-obligations can\n        be discharged by assuming refinement and well-definedness of the \n        abstract algorithm.\\<close>\nlemma (in wa_refine) wa_intro:\n  \\<comment> \\<open>Concrete part of the invariant\\<close>\n  fixes addi :: \"'C set\"\n  \\<comment> \\<open>The abstract algorithm is well-defined\\<close>\n  assumes \"while_algo WAA\"\n  \\<comment> \\<open>The invariant can be split into concrete and abstract part\\<close>\n  assumes icf: \"wa_invar WAC = addi \\<inter> {s. \\<alpha> s \\<in> wa_invar WAA}\"\n\n  \\<comment> \\<open>The step-relation preserves the concrete part of the invariant\\<close>\n  assumes step_addi: \n    \"!!s s'. \\<lbrakk> s\\<in>addi; s\\<in>wa_cond WAC; \\<alpha> s \\<in> wa_invar WAA; \n               (s,s')\\<in>wa_step WAC \n             \\<rbrakk> \\<Longrightarrow> s'\\<in>addi\"\n\n  \\<comment> \\<open>The initial states satisfy the concrete part of the invariant\\<close>\n  assumes initial_addi: \"wa_initial WAC \\<subseteq> addi\"\n\n  shows \n    \"while_algo WAC\"\nproof -\n  interpret waa: while_algo WAA by fact\n  show ?thesis\n    apply (unfold_locales)\n    apply (subst icf)\n    apply safe\n    apply (simp only: icf)\n    apply safe\n    apply (blast intro!: step_addi)\n\n    apply (frule (2) step_abs)\n    apply (frule (1) cond_abs)\n    apply (simp only: icf)\n    apply clarify\n    apply (erule (2) waa.step_invar)\n\n    apply (simp add: icf)\n    apply (rule conjI)\n    apply (erule rev_subsetD[OF _ initial_addi])\n    apply (insert initial_abs waa.initial_invar) [1]\n    apply blast\n\n    apply (rule_tac \n      r=\"inv_image { (s',s). s\\<in>wa_invar WAA \n                    \\<and> s\\<in>wa_cond WAA \n                    \\<and> (s,s')\\<in>wa_step WAA } \\<alpha>\" \n      in wf_subset)\n    apply (simp add: waa.step_wf)\n    apply (auto simp add: cond_abs step_abs icf) [1]\n    done\nqed\n\ntext \\<open>\n  A special case of refinement occurs, if the concrete condition implements the\n  abstract condition precisely. In this case, the concrete algorithm will run \n  as long as the abstract one that it is simulated by. This allows to \n  transfer properties of the result from the abstract algorithm to the \n  concrete one.\n\\<close>\n\n\\<comment> \\<open>Precise refinement\\<close>\nlocale wa_precise_refine = wa_refine +\n  constrains \\<alpha> :: \"'C \\<Rightarrow> 'A\"\n  assumes cond_precise: \n    \"\\<forall>s. s\\<in>wa_invar WAC \\<and> \\<alpha> s\\<in>wa_cond WAA \\<longrightarrow> s\\<in>wa_cond WAC\"\nbegin\n  \\<comment> \\<open>Transfer correctness property\\<close>\n  lemma transfer_correctness:\n    assumes A: \"\\<forall>s. s\\<in>wa_invar WAA \\<and> s\\<notin>wa_cond WAA \\<longrightarrow> P s\"\n    shows \"\\<forall>sc. sc\\<in>wa_invar WAC \\<and> sc\\<notin>wa_cond WAC \\<longrightarrow> P (\\<alpha> sc)\"\n    using A cond_abs invar_abs cond_precise by blast\nend\n    \ntext \\<open>Refinement as well as precise refinement is reflexive and transitive\\<close>\n\nlemma wa_ref_refl: \"wa_refine WA WA id\"\n  by (unfold_locales) auto\n\nlemma wa_pref_refl: \"wa_precise_refine WA WA id\"\n  by (unfold_locales) auto\n\nlemma wa_ref_trans: \n  assumes \"wa_refine WC WB \\<alpha>1\"\n  assumes \"wa_refine WB WA \\<alpha>2\"\n  shows \"wa_refine WC WA (\\<alpha>2\\<circ>\\<alpha>1)\"\nproof -\n  interpret r1: wa_refine WC WB \\<alpha>1 by fact\n  interpret r2: wa_refine WB WA \\<alpha>2 by fact\n\n  show ?thesis (* Cool, everything by auto! *)\n    apply unfold_locales\n    apply (auto simp add: \n      r1.invar_abs' r2.invar_abs'\n      r1.cond_abs r2.cond_abs\n      r1.step_abs r2.step_abs\n      r1.initial_abs' r2.initial_abs')\n    done\nqed\n\nlemma wa_pref_trans: \n  assumes \"wa_precise_refine WC WB \\<alpha>1\"\n  assumes \"wa_precise_refine WB WA \\<alpha>2\"\n  shows \"wa_precise_refine WC WA (\\<alpha>2\\<circ>\\<alpha>1)\"\nproof -\n  interpret r1: wa_precise_refine WC WB \\<alpha>1 by fact\n  interpret r2: wa_precise_refine WB WA \\<alpha>2 by fact\n  \n  show ?thesis\n    apply intro_locales\n    apply (rule wa_ref_trans)\n    apply (unfold_locales)\n    apply (auto simp add: r1.invar_abs' r2.invar_abs' \n                          r1.cond_precise r2.cond_precise)\n    done\nqed\n\ntext \\<open>\n  A well-defined while-algorithm is {\\em deterministic}, iff\n  the step relation is a function and there is just one \n  initial state. Such an algorithm is suitable for direct implementation \n  by the while-combinator.\n\n  For deterministic while-algorithm, an own record is defined, as well as a\n  function that maps it to the corresponding record for non-deterministic\n  while algorithms. This makes sense as the step-relation may then be modeled\n  as a function, and the initial state may be modeled as a single state rather \n  than a (singleton) set of states.\n\\<close>\n\nrecord 'S det_while_algo =\n  \\<comment> \\<open>Termination condition\\<close>\n  dwa_cond :: \"'S \\<Rightarrow> bool\"\n  \\<comment> \\<open>Step function\\<close>\n  dwa_step :: \"'S \\<Rightarrow> 'S\"\n  \\<comment> \\<open>Initial state\\<close>\n  dwa_initial :: \"'S\"\n  \\<comment> \\<open>Invariant\\<close>\n  dwa_invar :: \"'S set\"\n  \n  \\<comment> \\<open>Maps the record for deterministic while-algo to the corresponding record for\n      the non-deterministic one\\<close>\ndefinition \"det_wa_wa DWA == \\<lparr> \n  wa_cond={s. dwa_cond DWA s}, \n  wa_step={(s,dwa_step DWA s) | s. True}, \n  wa_initial={dwa_initial DWA},\n  wa_invar = dwa_invar DWA\\<rparr>\"\n\n  \\<comment> \\<open>Conditions for a deterministic while-algorithm\\<close>\nlocale det_while_algo = \n  fixes WA :: \"'S det_while_algo\"\n  \\<comment> \\<open>The step preserves the invariant\\<close>\n  assumes step_invar: \n    \"\\<lbrakk> s\\<in>dwa_invar WA; dwa_cond WA s \\<rbrakk> \\<Longrightarrow> dwa_step WA s \\<in> dwa_invar WA\"\n  \\<comment> \\<open>The initial state satisfies the invariant\\<close>\n  assumes initial_invar: \"dwa_initial WA \\<in> dwa_invar WA\"\n  \\<comment> \\<open>The relation made up by the step-function is well-founded.\\<close>\n  assumes step_wf: \n    \"wf { (dwa_step WA s,s) | s. s\\<in>dwa_invar WA \\<and> dwa_cond WA s }\"\n\nbegin\n  lemma is_while_algo: \"while_algo (det_wa_wa WA)\"\n    apply (unfold_locales)\n    apply (auto simp add: det_wa_wa_def step_invar initial_invar)\n    apply (insert step_wf)\n    apply (erule_tac P=wf in back_subst)\n    apply auto\n    done\n\nend\n\nlemma det_while_algo_intro:\n  assumes \"while_algo (det_wa_wa DWA)\" \n  shows \"det_while_algo DWA\"\nproof -\n  interpret while_algo \"(det_wa_wa DWA)\" by fact\n\n  show ?thesis using step_invar initial_invar step_wf\n    apply (unfold_locales)\n    apply (unfold det_wa_wa_def)\n    apply auto\n    apply (erule_tac P=wf in back_subst)\n    apply auto\n    done\n    \nqed\n\n\\<comment> \\<open>A deterministic while-algorithm is well-defined, if and only if the \n    corresponding non-deterministic while-algorithm is well-defined\\<close>\ntheorem dwa_is_wa: \n  \"while_algo (det_wa_wa DWA) \\<longleftrightarrow> det_while_algo DWA\"\n  using det_while_algo_intro det_while_algo.is_while_algo by auto\n\n\ndefinition (in det_while_algo) \n  \"loop == (while (dwa_cond WA) (dwa_step WA) (dwa_initial WA))\"\n\n\\<comment> \\<open>Proof rule for deterministic while loops\\<close>\nlemma (in det_while_algo) while_proof:\n  assumes inv_imp: \"\\<And>s. \\<lbrakk>s\\<in>dwa_invar WA; \\<not> dwa_cond WA s\\<rbrakk> \\<Longrightarrow> Q s\"\n  shows \"Q loop\"\n  apply (unfold loop_def)\n  apply (rule_tac P=\"\\<lambda>x. x\\<in>dwa_invar WA\" and \n                  r=\"{ (dwa_step WA s,s) | s. s\\<in>dwa_invar WA \\<and> dwa_cond WA s }\" \n                  in while_rule)\n  apply (simp_all add: step_invar initial_invar step_wf inv_imp)\n  done\n\n  \\<comment> \\<open>This version is useful when using transferred correctness lemmas\\<close>\nlemma (in det_while_algo) while_proof':\n  assumes inv_imp: \n    \"\\<forall>s. s\\<in>wa_invar (det_wa_wa WA) \\<and> s\\<notin>wa_cond (det_wa_wa WA) \\<longrightarrow> Q s\"\n  shows \"Q loop\"\n  using inv_imp\n  apply (simp add: det_wa_wa_def)\n  apply (blast intro: while_proof)\n  done\n\nlemma (in det_while_algo) loop_invar:\n  \"loop \\<in> dwa_invar WA\"\n  by (rule while_proof) simp\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/ICF/DatRef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.34161395453382754}}
{"text": "theory Finite_Linear_Pri_Tick\n\nimports\n  Finite_Linear_Pri\n  Finite_Linear_Tick_Param\n  Finite_Linear_Induction\nbegin\n\nlemma pri_tickWF:\n  assumes \"pri p x Z\" \"tickWF tick Z\"\n  shows \"tickWF tick x\"\n  using assms by (induct p x Z arbitrary:tick rule:pri.induct, auto)\n\nlemma FLTick0_pri:\n  assumes \"FLTick0 tick P\"\n  shows \"FLTick0 tick (Pri p P)\"\n  using assms unfolding FLTick0_def Pri_def apply auto\n  by (simp add: pri_tickWF)\n\nlemma prirel_extend_both_last_null_imp:\n  assumes \"pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (\\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\" \"length \\<beta> = length \\<Gamma>\" \"a \\<in>\\<^sub>\\<F>\\<^sub>\\<L> A\" \"last \\<beta> = \\<bullet>\" \"last \\<Gamma> = \\<bullet>\"\n  shows \"pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(A,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (\\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(A,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\"\n  using assms by (induct \\<beta> \\<Gamma> rule:pri.induct, auto)\n\nlemma prirel_extend_both_last_null_imp2:\n  assumes \"pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (\\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>B\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\" \"length \\<beta> = length \\<Gamma>\" \"a \\<in>\\<^sub>\\<F>\\<^sub>\\<L> A\" \"last \\<beta> = \\<bullet>\" \"last \\<Gamma> = \\<bullet>\" \"\\<forall>e. e \\<in>\\<^sub>\\<F>\\<^sub>\\<L> A  \\<longrightarrow> e \\<in>\\<^sub>\\<F>\\<^sub>\\<L> B\"\n  shows \"pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(A,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (\\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(B,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\"\n  using assms by (induct \\<beta> \\<Gamma> rule:pri.induct, auto)\n\nlemma prirel_eq_length_imp_last_member:\n  assumes \"length xs = length ys\" \"last xs = \\<bullet>\" \"last ys \\<noteq> \\<bullet>\" \"pri p (xs &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>x\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) ys\"\n  shows  \"\\<forall>e. e \\<in>\\<^sub>\\<F>\\<^sub>\\<L> x  \\<longrightarrow> e \\<in>\\<^sub>\\<F>\\<^sub>\\<L> last ys\"\n  using assms\n  by (induct p xs ys rule:pri.induct, auto)\n \nlemma pri_FL2:\n  assumes \"FL2 P\" \"a \\<in>\\<^sub>\\<F>\\<^sub>\\<L> A\" \"pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) Z\" \"Z \\<in> P\"\n  shows \"\\<exists>Z. pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(A,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) Z \\<and> Z \\<in> P\"\n  using assms\nproof (cases \"last \\<beta> = \\<bullet>\")\n  case True\n  then obtain \\<Gamma> where pGama:\"pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (\\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) \\<and> \\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> = Z \\<and> length \\<beta> = length \\<Gamma>\"\n    using assms \n    by (metis Finite_Linear_Model.last.simps(1) acceptance.distinct(1) add_cancel_right_right amember.elims(2) concat_FL_last_not_bullet_absorb last_bullet_then_last_cons length.simps(1) length_cons prirel_cons_eq_length_imp_prirel_acceptances_last_bullet_eq prirel_cons_eq_length_imp_prirel_acceptances_last_not_bullet prirel_same_length)\n  then show ?thesis\n  proof (cases \"last \\<Gamma> = \\<bullet>\")\n    case True\n    then show ?thesis \n      by (metis FL2_def pGama assms(1) assms(2) assms(4) concat_FL_last_not_bullet_absorb prirel_extend_both_last_null_imp)\n  next\n    case False\n    then have \"\\<Gamma> = Z\"\n      using concat_FL_last_not_bullet_absorb pGama by fastforce\n    then have \"\\<forall>e. e \\<in>\\<^sub>\\<F>\\<^sub>\\<L> A \\<longrightarrow> e \\<in>\\<^sub>\\<F>\\<^sub>\\<L> last \\<Gamma>\"\n      using True pGama False assms(3) prirel_eq_length_imp_last_member by blast\n    then have \"\\<Gamma> = butlast \\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>last \\<Gamma>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"\n      by (simp add: butlast_last_cons2_FL)\n    then have \"butlast \\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(last \\<Gamma>,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P\"\n      by (metis FL2_def \\<open>\\<Gamma> = Z\\<close> \\<open>\\<forall>e. e \\<in>\\<^sub>\\<F>\\<^sub>\\<L> A \\<longrightarrow> e \\<in>\\<^sub>\\<F>\\<^sub>\\<L> Finite_Linear_Model.last \\<Gamma>\\<close> assms(1) assms(2) assms(4))\n\n    have \"pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) \\<Gamma>\"\n      using pGama \\<open>\\<Gamma> = Z\\<close> by auto\n    then have \"pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (butlast \\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>last \\<Gamma>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\"\n      by (simp add: butlast_last_cons2_FL)\n    have \"length \\<beta> = length (butlast \\<Gamma>)\"\n      by (metis butlast_last_cons2_FL pGama rev_rev_butlast strong_less_eq_fltrace_cons_imp_lhs strong_less_eq_fltrace_eq_length strong_less_eq_fltrace_refl)\n\n    then have \"pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(A,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (butlast \\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(last \\<Gamma>,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\"\n      using True \\<open>\\<forall>e. e \\<in>\\<^sub>\\<F>\\<^sub>\\<L> A \\<longrightarrow> e \\<in>\\<^sub>\\<F>\\<^sub>\\<L> Finite_Linear_Model.last \\<Gamma>\\<close> \\<open>pri p (\\<beta> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (Finite_Linear_Model.butlast \\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>Finite_Linear_Model.last \\<Gamma>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\\<close> assms(2) last_butlast_cons_bullet prirel_extend_both_last_null_imp2 \n      by (metis bullet_right_zero2)\n    then show ?thesis\n      using \\<open>Finite_Linear_Model.butlast \\<Gamma> &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(Finite_Linear_Model.last \\<Gamma>,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P\\<close> by blast\n  qed\nnext\ncase False\n  then show ?thesis \n    using assms\n    by (metis concat_FL_last_not_bullet_absorb)\nqed\n\nlemma FL2_pri:\n  assumes \"FL2 P\"\n  shows \"FL2 (Pri p P)\"\n  using assms unfolding FL2_def Pri_def apply auto\n  by (simp add: assms pri_FL2)\n\ntext \\<open>Does Pri distribute through sequential composition in this model?\\<close>\n\nlemma prirel_consFL_both_imp:\n  assumes \"pri p (x &\\<^sub>\\<F>\\<^sub>\\<L>y) (s &\\<^sub>\\<F>\\<^sub>\\<L> t)\" \"length x = length s\" \"last x = \\<bullet>\" \"last s = \\<bullet>\"\n  shows \"pri p x s\"\n  using assms by(induct x s rule:pri.induct, auto)\n\nlemma prirel_consFL_both_imp':\n  assumes \"pri p x s\" \"pri p y t\" \n  shows \"pri p (x &\\<^sub>\\<F>\\<^sub>\\<L>y) (s &\\<^sub>\\<F>\\<^sub>\\<L> t)\" \n  using assms apply(induct x s rule:pri.induct, auto)\n  apply (case_tac Z, auto)\n  by (smt Collect_cong Finite_Linear_Model.last.simps(1) acceptance.distinct(1) concat_FL_last_not_bullet_absorb pri.simps(1) priacc.simps(2))\n\nlemma prirel_consFL_exists:\n  assumes \"pri p x (s &\\<^sub>\\<F>\\<^sub>\\<L> t)\"\n  shows \"\\<exists>y. pri p y s\"\n  using assms apply(induct x s rule:pri.induct, auto)    \n     apply (rule_tac x=\"\\<langle>priacc\\<^sub>[\\<^sub>pa\\<^sub>](Z)\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\" in exI, auto)\n  apply (rule_tac x=\"\\<langle>priacc\\<^sub>[\\<^sub>pa\\<^sub>](Z)\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\" in exI, auto)\n  using pri.simps(4) by fastforce+\n  \n\nlemma prirel_consFL_last_bullet_exists:\n  assumes \"pri p x (s &\\<^sub>\\<F>\\<^sub>\\<L> t)\" \"last s = \\<bullet>\"\n  shows \"\\<exists>s0 t0. x = s0 &\\<^sub>\\<F>\\<^sub>\\<L> t0 \\<and> pri p s0 s \\<and> pri p t0 t\"\n  using assms apply(induct p x s rule:pri.induct, auto)\n     apply (metis bullet_left_zero2 pri.simps(1) priacc.simps(1) )+\n  by (metis fltrace_concat2.simps(2) pri.simps(4))+\n\nlemma prirel_consFL_last_bullet_exists':\n  assumes \"pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> t) x\" \"last s = \\<bullet>\"\n  shows \"\\<exists>s0 t0. x = s0 &\\<^sub>\\<F>\\<^sub>\\<L> t0 \\<and> pri p s s0 \\<and> pri p t t0\"\n  using assms apply(induct x s rule:pri.induct, auto)\n     apply (metis bullet_left_zero2 pri.simps(1) priacc.simps(1) )+\n  by (metis fltrace_concat2.simps(2) pri.simps(4))+\n\nlemma prirel_not_events:\n  assumes \"pri p x s\" \"tick \\<notin> events s\"\n  shows \"tick \\<notin> events x\"\n  using assms by (induct p x s rule:pri.induct, auto)\n\nlemma prirel_not_events':\n  assumes \"pri p x s\" \"tick \\<notin> events x\"\n  shows \"tick \\<notin> events s\"\n  using assms by (induct p x s rule:pri.induct, auto)\n\nlemma prirel_consFL_both_imp_prirel:\n  assumes \"pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> t) (u &\\<^sub>\\<F>\\<^sub>\\<L> v)\" \"last s = \\<bullet>\" \"last u = \\<bullet>\" \"length s = length u\"\n  shows \"pri p t v\"\n  using assms by(induct p s u rule:pri.induct, auto)\n\nlemma prirel_consFL_last_bullet_both:\n  assumes \"pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,b)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (ys &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(a,c)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\" \"last s = \\<bullet>\" \"last ys = \\<bullet>\" \"maximal(p,b)\" \"c \\<in>\\<^sub>\\<F>\\<^sub>\\<L> a \\<or> a = \\<bullet>\"\n  shows \"b = c\"\n  using assms apply(induct p s ys rule:pri.induct, auto)\n         apply (case_tac Z, auto)\n          apply (metis (no_types, hide_lams) Finite_Linear_Model.butlast.simps(1) butlast_last_cons2_FL concat_FL_last_not_bullet_absorb fltrace.exhaust pri.simps(1) pri.simps(2) rev3.simps(1) rev3_little_more_extra)\n         apply (metis fltrace.distinct(1) fltrace.exhaust pri.simps(2) rev3.simps(1) rev3_little_more_extra)\n  apply (metis Finite_Linear_Model.butlast.simps(1) bullet_left_zero2 butlast_last_cons2_FL fltrace.exhaust fltrace_concat2.simps(2) pri.simps(2))\n  by (metis Finite_Linear_Model.butlast.simps(1) bullet_right_zero2 butlast_last_cons2_FL fltrace.exhaust fltrace_concat2.simps(2) pri.simps(3) s_and_tick_iff)+\n\nlemma tickWF_consFL_tick_imp_bullet:\n  assumes \"tickWF tick (ys &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(y,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\" \"last ys = \\<bullet>\" \"tick \\<in>\\<^sub>\\<F>\\<^sub>\\<L> y \\<or> y = \\<bullet>\"\n  shows \"y = \\<bullet>\"\n  using assms apply (induct ys rule:tickWF.induct, auto)\n  by (metis fltrace.distinct(1) rev3.simps(1) rev3_little_more)\n\nlemma pri_eq_length_two_last_bullet:\n  assumes \"xs pri\\<^sub>[\\<^sub>p\\<^sub>] (ys &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>y\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\" \"length xs = length ys\" \"last ys = \\<bullet>\" \"last xs = \\<bullet>\"\n  shows \"y = \\<bullet>\"\n  using assms apply (induct p xs ys rule:pri.induct, auto)\n  by (cases y, auto)\n\nlemma prirel_exists_tick_max:\n  assumes \"pri p S Z\" \"last s = \\<bullet>\" \"maximal(p,tick)\" \"S = (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\" \"tickWF tick Z\"\n  shows \"\\<exists>z. last z = \\<bullet> \\<and> Z = (z &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) \\<and> length s = length z\"\n  using assms \nproof (induct S Z rule:ftrace_cons_induct_both_eq_length)\n  case 1\n  then show ?case \n    using assms(1) prirel_same_length by blast\nnext\n  case (2 x y)\n  then show ?case \n    by (metis fltrace.distinct(1) rev3.simps(1) rev3_little_more)\nnext\n  case (3 x y xs ys)\n  have x_bullet:\"x = \\<bullet>\"\n    by (metis \"3.hyps\"(3) \"3.prems\"(4) Finite_Linear_Model.last.simps(1) assms(2) last_bullet_then_last_cons last_cons_bullet_iff)\n  then have y_bullet:\"y = \\<bullet>\"\n    using 3\n    by (metis bullet_right_zero2 pri_eq_length_two_last_bullet)\n  \n  then have xs_tick:\"xs = s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"\n    using 3 x_bullet by auto\n\n  have xs_pri_ys:\"xs pri\\<^sub>[\\<^sub>p\\<^sub>] ys\"\n    using 3 prirel_consFL_both_imp by blast\n  have \"tickWF tick ys\"\n    using 3 y_bullet by auto\n  then have \"\\<exists>z. Finite_Linear_Model.last z = \\<bullet> \\<and> ys = z &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<and> Finite_Linear_Model.length s = Finite_Linear_Model.length z\"\n    using 3 xs_tick assms xs_pri_ys by blast\n  then show ?case using y_bullet by auto\nnext\n  case (4 x y xs ys)\n  then have \"pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (ys &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>y,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\"\n    by auto\n  then obtain yA yEvent where yA:\"y = (yA,yEvent)\\<^sub>\\<F>\\<^sub>\\<L> \\<and> (yEvent \\<in>\\<^sub>\\<F>\\<^sub>\\<L> yA \\<or> yA = \\<bullet>)\"\n    proof -\n      assume a1: \"\\<And>yA yEvent. y = (yA,yEvent)\\<^sub>\\<F>\\<^sub>\\<L> \\<and> (yEvent \\<in>\\<^sub>\\<F>\\<^sub>\\<L> yA \\<or> yA = \\<bullet>) \\<Longrightarrow> thesis\"\n      have \"y \\<le> (acceptance y,event y)\\<^sub>\\<F>\\<^sub>\\<L>\"\n        by (simp add: less_eq_aevent_def)\n      then show ?thesis\n        using a1 by (metis aevent_less_eq_iff_components event_in_acceptance)\n    qed\n  then have \"pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (ys &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(yA,yEvent)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\"\n    using \"4.prems\"(1) \"4.prems\"(4) by auto\n  then have \"yEvent = tick\"\n            \"yA = \\<bullet>\"\n    using prirel_consFL_last_bullet_both \"4.hyps\"(4) yA assms(2) assms(3) apply fastforce\n    using 4 tickWF_consFL_tick_imp_bullet \n    by (metis prirel_consFL_last_bullet_both yA)\n  then have \"ys &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>y,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> = ys &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<and> Finite_Linear_Model.length s = Finite_Linear_Model.length ys\"\n    by (metis \"4.hyps\"(2) \"4.hyps\"(3) \"4.prems\"(4) assms(2) fltrace.inject(2) rev3_little_more rev3_rev3_const2_last yA)\n  then show ?case\n    using \"4.hyps\"(4) by blast\nqed\n\nlemma pri_dist_SeqComp:\n  assumes \"FLTick0 tick P\" \"maximal(p,tick)\"\n  shows \"Pri p (P (tick);\\<^sub>\\<F>\\<^sub>\\<L> Q) = ((Pri p P) (tick);\\<^sub>\\<F>\\<^sub>\\<L> (Pri p Q))\"\n  using assms unfolding Pri_def SeqComp_def\nproof (auto)\n  fix \"x\" \"s\" \"t\"\n  assume  assm0:\"FLTick0 tick P\"\n      and assm1:\"pri p x (s &\\<^sub>\\<F>\\<^sub>\\<L> t)\"\n      and assm2:\"s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P\"\n      and assm3:\"t \\<in> Q\"\n  show \"\\<exists>s. (\\<exists>Z. pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) Z \\<and> Z \\<in> P) \\<and> (\\<exists>t. (\\<exists>Z. pri p t Z \\<and> Z \\<in> Q) \\<and> x = s &\\<^sub>\\<F>\\<^sub>\\<L> t) \\<or>\n           (\\<exists>Z. pri p s Z \\<and> Z \\<in> P) \\<and> tick \\<notin> events s \\<and> x = s\"\n  proof (cases \"last s = \\<bullet>\")\n    case True\n    then obtain s0 t0 where s0t0:\"x = s0 &\\<^sub>\\<F>\\<^sub>\\<L> t0 \\<and> pri p s0 s \\<and> pri p t0 t\"\n      using assm1 prirel_consFL_last_bullet_exists by blast\n    then have \"pri p \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"\n      using assms(2) by auto\n    then have \"pri p (s0 &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\"\n      using s0t0 prirel_consFL_both_imp' by blast    \n    then show ?thesis\n      using assm2 assm3 s0t0 by blast\n  next\n    case False\n    then show ?thesis\n      by (metis FLTick0_def assm0 assm1 assm2 concat_FL_last_not_bullet_absorb prirel_not_events tickWF_last_x_is_emptyset)\n  qed\nnext\n  fix \"x\" \"s\"\n  assume  assm0:\"FLTick0 tick P\"\n    and   assm1:\"maximal(p,tick)\"\n    and   assm2:\"pri p x s\"\n    and   assm3:\"s \\<in> P\"\n    and   assm4:\"tick \\<notin> events s\"\n  show \"\\<exists>s. (\\<exists>Z. pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) Z \\<and> Z \\<in> P) \\<and> (\\<exists>t. (\\<exists>Z. pri p t Z \\<and> Z \\<in> Q) \\<and> x = s &\\<^sub>\\<F>\\<^sub>\\<L> t) \\<or>\n            (\\<exists>Z. pri p s Z \\<and> Z \\<in> P) \\<and> tick \\<notin> events s \\<and> x = s\"\n  proof -\n    have \"tick \\<notin> events x\"\n      using assm2 assm4 prirel_not_events\n      by fastforce\n    then show ?thesis\n      using assm2 assm3 by blast\n  qed\nnext\n  fix \"s\" \"t\" \"Z\" \"Za\"\n  assume \n      assm0: \"FLTick0 tick P\"\n  and assm1: \"maximal(p,tick)\"\n  and assm2: \"pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) Z\"\n  and assm3: \"Z \\<in> P\"\n  and assm4: \"pri p t Za\"\n  and assm5: \"Za \\<in> Q\"\n  show \"\\<exists>Z. pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> t) Z \\<and> (\\<exists>s. s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P \\<and> (\\<exists>t. t \\<in> Q \\<and> Z = s &\\<^sub>\\<F>\\<^sub>\\<L> t) \\<or> s \\<in> P \\<and> tick \\<notin> events s \\<and> Z = s)\"\n  proof (cases \"last s = \\<bullet>\")\n    case True\n    then obtain s0 where s0:\"pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) (s0 &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) \\<and> last s0 = \\<bullet> \\<and> length s = length s0 \\<and> Z = (s0 &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\"\n      by (metis FLTick0_def assm0 assm1 assm2 assm3 prirel_exists_tick_max)\n    then have \"pri p s s0\"\n      using True prirel_consFL_both_imp by blast\n    then have \"pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> t) (s0 &\\<^sub>\\<F>\\<^sub>\\<L> Za)\"\n      by (simp add: assm4 prirel_consFL_both_imp')\n    then have \"\\<exists>Z. pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> t) (s0 &\\<^sub>\\<F>\\<^sub>\\<L> Za) \\<and> s0 &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P \\<and> Za \\<in> Q \\<and> Z = s0 &\\<^sub>\\<F>\\<^sub>\\<L> Za\"\n      using s0 assm5 assm3 by blast\n    then show ?thesis\n      by blast\n  next\n    case False\n    then show ?thesis \n      by (metis FLTick0_def \\<open>Z \\<in> P\\<close> \\<open>pri p (s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>) Z\\<close> assms(1) concat_FL_last_not_bullet_absorb prirel_cons_eq_length_imp_prirel_acceptances_last_bullet_eq prirel_cons_eq_length_imp_prirel_acceptances_last_not_bullet prirel_same_length tickWF_last_x_is_emptyset)\n  qed\nnext\n  fix \"s\" \"Z\"\n  assume \n       assm0: \"FLTick0 tick P\"\n  and  assm1: \"maximal(p,tick)\"\n  and  assm2: \"tick \\<notin> events s\"\n  and  assm3: \"pri p s Z\"\n  and  assm4: \"Z \\<in> P\"\n  show \"\\<exists>Z. pri p s Z \\<and> (\\<exists>s. s &\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>(\\<bullet>,tick)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<in> P \\<and> (\\<exists>t. t \\<in> Q \\<and> Z = s &\\<^sub>\\<F>\\<^sub>\\<L> t) \\<or> s \\<in> P \\<and> tick \\<notin> events s \\<and> Z = s)\"\n    using assm3 assm4 assm2 apply (rule_tac x=\"Z\" in exI, auto)\n    apply (rule_tac x=\"Z\" in exI, auto)\n    by (simp add: prirel_not_events')+\nqed\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/FL/Finite_Linear_Pri_Tick.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.6076631698328916, "lm_q1q2_score": 0.3416139545338274}}
{"text": "theory Nominal2_Abs\nimports Nominal2_Base\n        \"HOL-Library.Quotient_List\"\n        \"HOL-Library.Quotient_Product\"\nbegin\n\n\nsection \\<open>Abstractions\\<close>\n\nfun\n  alpha_set\nwhere\n  alpha_set[simp del]:\n  \"alpha_set (bs, x) R f p (cs, y) \\<longleftrightarrow>\n     f x - bs = f y - cs \\<and>\n     (f x - bs) \\<sharp>* p \\<and>\n     R (p \\<bullet> x) y \\<and>\n     p \\<bullet> bs = cs\"\n\nfun\n  alpha_res\nwhere\n  alpha_res[simp del]:\n  \"alpha_res (bs, x) R f p (cs, y) \\<longleftrightarrow>\n     f x - bs = f y - cs \\<and>\n     (f x - bs) \\<sharp>* p \\<and>\n     R (p \\<bullet> x) y\"\n\nfun\n  alpha_lst\nwhere\n  alpha_lst[simp del]:\n  \"alpha_lst (bs, x) R f p (cs, y) \\<longleftrightarrow>\n     f x - set bs = f y - set cs \\<and>\n     (f x - set bs) \\<sharp>* p \\<and>\n     R (p \\<bullet> x) y \\<and>\n     p \\<bullet> bs = cs\"\n\nlemmas alphas = alpha_set.simps alpha_res.simps alpha_lst.simps\n\nnotation\n  alpha_set (\"_ \\<approx>set _ _ _ _\" [100, 100, 100, 100, 100] 100) and\n  alpha_res (\"_ \\<approx>res _ _ _ _\" [100, 100, 100, 100, 100] 100) and\n  alpha_lst (\"_ \\<approx>lst _ _ _ _\" [100, 100, 100, 100, 100] 100)\n\nsection \\<open>Mono\\<close>\n\nlemma [mono]:\n  shows \"R1 \\<le> R2 \\<Longrightarrow> alpha_set bs R1 \\<le> alpha_set bs R2\"\n  and   \"R1 \\<le> R2 \\<Longrightarrow> alpha_res bs R1 \\<le> alpha_res bs R2\"\n  and   \"R1 \\<le> R2 \\<Longrightarrow> alpha_lst cs R1 \\<le> alpha_lst cs R2\"\n  by (case_tac [!] bs, case_tac [!] cs)\n     (auto simp: le_fun_def le_bool_def alphas)\n\nsection \\<open>Equivariance\\<close>\n\nlemma alpha_eqvt[eqvt]:\n  shows \"(bs, x) \\<approx>set R f q (cs, y) \\<Longrightarrow> (p \\<bullet> bs, p \\<bullet> x) \\<approx>set (p \\<bullet> R) (p \\<bullet> f) (p \\<bullet> q) (p \\<bullet> cs, p \\<bullet> y)\"\n  and   \"(bs, x) \\<approx>res R f q (cs, y) \\<Longrightarrow> (p \\<bullet> bs, p \\<bullet> x) \\<approx>res (p \\<bullet> R) (p \\<bullet> f) (p \\<bullet> q) (p \\<bullet> cs, p \\<bullet> y)\"\n  and   \"(ds, x) \\<approx>lst R f q (es, y) \\<Longrightarrow> (p \\<bullet> ds, p \\<bullet> x) \\<approx>lst (p \\<bullet> R) (p \\<bullet> f) (p \\<bullet> q) (p \\<bullet> es, p \\<bullet> y)\"\n  unfolding alphas\n  unfolding permute_eqvt[symmetric]\n  unfolding set_eqvt[symmetric]\n  unfolding permute_fun_app_eq[symmetric]\n  unfolding Diff_eqvt[symmetric]\n  unfolding eq_eqvt[symmetric]\n  unfolding fresh_star_eqvt[symmetric]\n  by (auto simp only: permute_bool_def)\n\nsection \\<open>Equivalence\\<close>\n\nlemma alpha_refl:\n  assumes a: \"R x x\"\n  shows \"(bs, x) \\<approx>set R f 0 (bs, x)\"\n  and   \"(bs, x) \\<approx>res R f 0 (bs, x)\"\n  and   \"(cs, x) \\<approx>lst R f 0 (cs, x)\"\n  using a\n  unfolding alphas\n  unfolding fresh_star_def\n  by (simp_all add: fresh_zero_perm)\n\nlemma alpha_sym:\n  assumes a: \"R (p \\<bullet> x) y \\<Longrightarrow> R (- p \\<bullet> y) x\"\n  shows \"(bs, x) \\<approx>set R f p (cs, y) \\<Longrightarrow> (cs, y) \\<approx>set R f (- p) (bs, x)\"\n  and   \"(bs, x) \\<approx>res R f p (cs, y) \\<Longrightarrow> (cs, y) \\<approx>res R f (- p) (bs, x)\"\n  and   \"(ds, x) \\<approx>lst R f p (es, y) \\<Longrightarrow> (es, y) \\<approx>lst R f (- p) (ds, x)\"\n  unfolding alphas fresh_star_def\n  using a\n  by (auto simp: fresh_minus_perm)\n\nlemma alpha_trans:\n  assumes a: \"\\<lbrakk>R (p \\<bullet> x) y; R (q \\<bullet> y) z\\<rbrakk> \\<Longrightarrow> R ((q + p) \\<bullet> x) z\"\n  shows \"\\<lbrakk>(bs, x) \\<approx>set R f p (cs, y); (cs, y) \\<approx>set R f q (ds, z)\\<rbrakk> \\<Longrightarrow> (bs, x) \\<approx>set R f (q + p) (ds, z)\"\n  and   \"\\<lbrakk>(bs, x) \\<approx>res R f p (cs, y); (cs, y) \\<approx>res R f q (ds, z)\\<rbrakk> \\<Longrightarrow> (bs, x) \\<approx>res R f (q + p) (ds, z)\"\n  and   \"\\<lbrakk>(es, x) \\<approx>lst R f p (gs, y); (gs, y) \\<approx>lst R f q (hs, z)\\<rbrakk> \\<Longrightarrow> (es, x) \\<approx>lst R f (q + p) (hs, z)\"\n  using a\n  unfolding alphas fresh_star_def\n  by (simp_all add: fresh_plus_perm)\n\nlemma alpha_sym_eqvt:\n  assumes a: \"R (p \\<bullet> x) y \\<Longrightarrow> R y (p \\<bullet> x)\"\n  and     b: \"p \\<bullet> R = R\"\n  shows \"(bs, x) \\<approx>set R f p (cs, y) \\<Longrightarrow> (cs, y) \\<approx>set R f (- p) (bs, x)\"\n  and   \"(bs, x) \\<approx>res R f p (cs, y) \\<Longrightarrow> (cs, y) \\<approx>res R f (- p) (bs, x)\"\n  and   \"(ds, x) \\<approx>lst R f p (es, y) \\<Longrightarrow> (es, y) \\<approx>lst R f (- p) (ds, x)\"\napply(auto intro!: alpha_sym)\napply(drule_tac [!] a)\napply(rule_tac [!] p=\"p\" in permute_boolE)\napply(simp_all add: b permute_self)\ndone\n\nlemma alpha_set_trans_eqvt:\n  assumes b: \"(cs, y) \\<approx>set R f q (ds, z)\"\n  and     a: \"(bs, x) \\<approx>set R f p (cs, y)\"\n  and     d: \"q \\<bullet> R = R\"\n  and     c: \"\\<lbrakk>R (p \\<bullet> x) y; R y (- q \\<bullet> z)\\<rbrakk> \\<Longrightarrow> R (p \\<bullet> x) (- q \\<bullet> z)\"\n  shows \"(bs, x) \\<approx>set R f (q + p) (ds, z)\"\napply(rule alpha_trans(1)[OF _ a b])\napply(drule c)\napply(rule_tac p=\"q\" in permute_boolE)\napply(simp add: d permute_self)\napply(rotate_tac -1)\napply(drule_tac p=\"q\" in permute_boolI)\napply(simp add: d permute_self permute_eqvt[symmetric])\ndone\n\nlemma alpha_res_trans_eqvt:\n  assumes  b: \"(cs, y) \\<approx>res R f q (ds, z)\"\n  and     a: \"(bs, x) \\<approx>res R f p (cs, y)\"\n  and     d: \"q \\<bullet> R = R\"\n  and     c: \"\\<lbrakk>R (p \\<bullet> x) y; R y (- q \\<bullet> z)\\<rbrakk> \\<Longrightarrow> R (p \\<bullet> x) (- q \\<bullet> z)\"\n  shows \"(bs, x) \\<approx>res R f (q + p) (ds, z)\"\napply(rule alpha_trans(2)[OF _ a b])\napply(drule c)\napply(rule_tac p=\"q\" in permute_boolE)\napply(simp add: d permute_self)\napply(rotate_tac -1)\napply(drule_tac p=\"q\" in permute_boolI)\napply(simp add: d permute_self permute_eqvt[symmetric])\ndone\n\nlemma alpha_lst_trans_eqvt:\n  assumes b: \"(cs, y) \\<approx>lst R f q (ds, z)\"\n  and     a: \"(bs, x) \\<approx>lst R f p (cs, y)\"\n  and     d: \"q \\<bullet> R = R\"\n  and     c: \"\\<lbrakk>R (p \\<bullet> x) y; R y (- q \\<bullet> z)\\<rbrakk> \\<Longrightarrow> R (p \\<bullet> x) (- q \\<bullet> z)\"\n  shows \"(bs, x) \\<approx>lst R f (q + p) (ds, z)\"\napply(rule alpha_trans(3)[OF _ a b])\napply(drule c)\napply(rule_tac p=\"q\" in permute_boolE)\napply(simp add: d permute_self)\napply(rotate_tac -1)\napply(drule_tac p=\"q\" in permute_boolI)\napply(simp add: d permute_self permute_eqvt[symmetric])\ndone\n\nlemmas alpha_trans_eqvt = alpha_set_trans_eqvt alpha_res_trans_eqvt alpha_lst_trans_eqvt\n\n\nsection \\<open>General Abstractions\\<close>\n\nfun\n  alpha_abs_set\nwhere\n  [simp del]:\n  \"alpha_abs_set (bs, x) (cs, y) \\<longleftrightarrow> (\\<exists>p. (bs, x) \\<approx>set ((=)) supp p (cs, y))\"\n\nfun\n  alpha_abs_lst\nwhere\n  [simp del]:\n  \"alpha_abs_lst (bs, x) (cs, y) \\<longleftrightarrow> (\\<exists>p. (bs, x) \\<approx>lst ((=)) supp p (cs, y))\"\n\nfun\n  alpha_abs_res\nwhere\n  [simp del]:\n  \"alpha_abs_res (bs, x) (cs, y) \\<longleftrightarrow> (\\<exists>p. (bs, x) \\<approx>res ((=)) supp p (cs, y))\"\n\nnotation\n  alpha_abs_set (infix \"\\<approx>abs'_set\" 50) and\n  alpha_abs_lst (infix \"\\<approx>abs'_lst\" 50) and\n  alpha_abs_res (infix \"\\<approx>abs'_res\" 50)\n\nlemmas alphas_abs = alpha_abs_set.simps alpha_abs_res.simps alpha_abs_lst.simps\n\n\nlemma alphas_abs_refl:\n  shows \"(bs, x) \\<approx>abs_set (bs, x)\"\n  and   \"(bs, x) \\<approx>abs_res (bs, x)\"\n  and   \"(cs, x) \\<approx>abs_lst (cs, x)\"\n  unfolding alphas_abs\n  unfolding alphas\n  unfolding fresh_star_def\n  by (rule_tac [!] x=\"0\" in exI)\n     (simp_all add: fresh_zero_perm)\n\nlemma alphas_abs_sym:\n  shows \"(bs, x) \\<approx>abs_set (cs, y) \\<Longrightarrow> (cs, y) \\<approx>abs_set (bs, x)\"\n  and   \"(bs, x) \\<approx>abs_res (cs, y) \\<Longrightarrow> (cs, y) \\<approx>abs_res (bs, x)\"\n  and   \"(ds, x) \\<approx>abs_lst (es, y) \\<Longrightarrow> (es, y) \\<approx>abs_lst (ds, x)\"\n  unfolding alphas_abs\n  unfolding alphas\n  unfolding fresh_star_def\n  by (erule_tac [!] exE, rule_tac [!] x=\"-p\" in exI)\n     (auto simp: fresh_minus_perm)\n\nlemma alphas_abs_trans:\n  shows \"\\<lbrakk>(bs, x) \\<approx>abs_set (cs, y); (cs, y) \\<approx>abs_set (ds, z)\\<rbrakk> \\<Longrightarrow> (bs, x) \\<approx>abs_set (ds, z)\"\n  and   \"\\<lbrakk>(bs, x) \\<approx>abs_res (cs, y); (cs, y) \\<approx>abs_res (ds, z)\\<rbrakk> \\<Longrightarrow> (bs, x) \\<approx>abs_res (ds, z)\"\n  and   \"\\<lbrakk>(es, x) \\<approx>abs_lst (gs, y); (gs, y) \\<approx>abs_lst (hs, z)\\<rbrakk> \\<Longrightarrow> (es, x) \\<approx>abs_lst (hs, z)\"\n  unfolding alphas_abs\n  unfolding alphas\n  unfolding fresh_star_def\n  apply(erule_tac [!] exE, erule_tac [!] exE)\n  apply(rule_tac [!] x=\"pa + p\" in exI)\n  by (simp_all add: fresh_plus_perm)\n\nlemma alphas_abs_eqvt:\n  shows \"(bs, x) \\<approx>abs_set (cs, y) \\<Longrightarrow> (p \\<bullet> bs, p \\<bullet> x) \\<approx>abs_set (p \\<bullet> cs, p \\<bullet> y)\"\n  and   \"(bs, x) \\<approx>abs_res (cs, y) \\<Longrightarrow> (p \\<bullet> bs, p \\<bullet> x) \\<approx>abs_res (p \\<bullet> cs, p \\<bullet> y)\"\n  and   \"(ds, x) \\<approx>abs_lst (es, y) \\<Longrightarrow> (p \\<bullet> ds, p \\<bullet> x) \\<approx>abs_lst (p \\<bullet> es, p \\<bullet> y)\"\n  unfolding alphas_abs\n  unfolding alphas\n  unfolding set_eqvt[symmetric]\n  unfolding supp_eqvt[symmetric]\n  unfolding Diff_eqvt[symmetric]\n  apply(erule_tac [!] exE)\n  apply(rule_tac [!] x=\"p \\<bullet> pa\" in exI)\n  by (auto simp only: fresh_star_permute_iff permute_eqvt[symmetric])\n\n\nsection \\<open>Strengthening the equivalence\\<close>\n\nlemma disjoint_right_eq:\n  assumes a: \"A \\<union> B1 = A \\<union> B2\"\n  and     b: \"A \\<inter> B1 = {}\" \"A \\<inter> B2 = {}\"\n  shows \"B1 = B2\"\nusing a b\nby (metis Int_Un_distrib2 Int_absorb2 Int_commute Un_upper2)\n\nlemma supp_property_res:\n  assumes a: \"(as, x) \\<approx>res (=) supp p (as', x')\"\n  shows \"p \\<bullet> (supp x \\<inter> as) = supp x' \\<inter> as'\"\nproof -\n  from a have \"(supp x - as) \\<sharp>* p\" by  (auto simp only: alphas)\n  then have *: \"p \\<bullet> (supp x - as) = (supp x - as)\"\n    by (simp add: atom_set_perm_eq)\n  have \"(supp x' - as') \\<union> (supp x' \\<inter> as') = supp x'\" by auto\n  also have \"\\<dots> = supp (p \\<bullet> x)\" using a by (simp add: alphas)\n  also have \"\\<dots> = p \\<bullet> (supp x)\" by (simp add: supp_eqvt)\n  also have \"\\<dots> = p \\<bullet> ((supp x - as) \\<union> (supp x \\<inter> as))\" by auto\n  also have \"\\<dots> = (p \\<bullet> (supp x - as)) \\<union> (p \\<bullet> (supp x \\<inter> as))\" by (simp add: union_eqvt)\n  also have \"\\<dots> = (supp x - as) \\<union> (p \\<bullet> (supp x \\<inter> as))\" using * by simp\n  also have \"\\<dots> = (supp x' - as') \\<union> (p \\<bullet> (supp x \\<inter> as))\" using a by (simp add: alphas)\n  finally have \"(supp x' - as') \\<union> (supp x' \\<inter> as') = (supp x' - as') \\<union> (p \\<bullet> (supp x \\<inter> as))\" .\n  moreover\n  have \"(supp x' - as') \\<inter> (supp x' \\<inter> as') = {}\" by auto\n  moreover\n  have \"(supp x - as) \\<inter> (supp x \\<inter> as) = {}\" by auto\n  then have \"p \\<bullet> ((supp x - as) \\<inter> (supp x \\<inter> as) = {})\" by (simp add: permute_bool_def)\n  then have \"(p \\<bullet> (supp x - as)) \\<inter> (p \\<bullet> (supp x \\<inter> as)) = {}\" by (perm_simp) (simp)\n  then have \"(supp x - as) \\<inter> (p \\<bullet> (supp x \\<inter> as)) = {}\" using * by simp\n  then have \"(supp x' - as') \\<inter> (p \\<bullet> (supp x \\<inter> as)) = {}\" using a by (simp add: alphas)\n  ultimately show \"p \\<bullet> (supp x \\<inter> as) = supp x' \\<inter> as'\"\n    by (auto dest: disjoint_right_eq)\nqed\n\nlemma alpha_abs_res_stronger1_aux:\n  assumes asm: \"(as, x) \\<approx>res (=) supp p' (as', x')\"\n  shows \"\\<exists>p. (as, x) \\<approx>res (=) supp p (as', x') \\<and> supp p \\<subseteq> (supp x \\<inter> as) \\<union> (supp x' \\<inter> as')\"\nproof -\n  from asm have 0: \"(supp x - as) \\<sharp>* p'\" by  (auto simp only: alphas)\n  then have #: \"p' \\<bullet> (supp x - as) = (supp x - as)\"\n    by (simp add: atom_set_perm_eq)\n  obtain p where *: \"\\<forall>b \\<in> supp x. p \\<bullet> b = p' \\<bullet> b\" and **: \"supp p \\<subseteq> supp x \\<union> p' \\<bullet> supp x\"\n    using set_renaming_perm2 by blast\n  from * have a: \"p \\<bullet> x = p' \\<bullet> x\" using supp_perm_perm_eq by auto\n  from 0 have 1: \"(supp x - as) \\<sharp>* p\" using *\n    by (auto simp: fresh_star_def fresh_perm)\n  then have 2: \"(supp x - as) \\<inter> supp p = {}\"\n    by (auto simp: fresh_star_def fresh_def)\n  have b: \"supp x = (supp x - as) \\<union> (supp x \\<inter> as)\" by auto\n  have \"supp p \\<subseteq> supp x \\<union> p' \\<bullet> supp x\" using ** by simp\n  also have \"\\<dots> = (supp x - as) \\<union> (supp x \\<inter> as) \\<union> (p' \\<bullet> ((supp x - as) \\<union> (supp x \\<inter> as)))\"\n    using b by simp\n  also have \"\\<dots> = (supp x - as) \\<union> (supp x \\<inter> as) \\<union> ((p' \\<bullet> (supp x - as)) \\<union> (p' \\<bullet> (supp x \\<inter> as)))\"\n    by (simp add: union_eqvt)\n  also have \"\\<dots> = (supp x - as) \\<union> (supp x \\<inter> as) \\<union> (p' \\<bullet> (supp x \\<inter> as))\"\n    using # by auto\n  also have \"\\<dots> = (supp x - as) \\<union> (supp x \\<inter> as) \\<union> (supp x' \\<inter> as')\" using asm\n    by (simp add: supp_property_res)\n  finally have \"supp p \\<subseteq> (supp x - as) \\<union> (supp x \\<inter> as) \\<union> (supp x' \\<inter> as')\" .\n  then\n  have \"supp p \\<subseteq> (supp x \\<inter> as) \\<union> (supp x' \\<inter> as')\" using 2 by auto\n  moreover\n  have \"(as, x) \\<approx>res (=) supp p (as', x')\" using asm 1 a by (simp add: alphas)\n  ultimately\n  show \"\\<exists>p. (as, x) \\<approx>res (=) supp p (as', x') \\<and> supp p \\<subseteq> (supp x \\<inter> as) \\<union> (supp x' \\<inter> as')\" by blast\nqed\n\nlemma alpha_abs_res_minimal:\n  assumes asm: \"(as, x) \\<approx>res (=) supp p (as', x')\"\n  shows \"(as \\<inter> supp x, x) \\<approx>res (=) supp p (as' \\<inter> supp x', x')\"\n  using asm unfolding alpha_res by (auto simp: Diff_Int)\n\nlemma alpha_abs_res_abs_set:\n  assumes asm: \"(as, x) \\<approx>res (=) supp p (as', x')\"\n  shows \"(as \\<inter> supp x, x) \\<approx>set (=) supp p (as' \\<inter> supp x', x')\"\nproof -\n  have c: \"p \\<bullet> x = x'\"\n    using alpha_abs_res_minimal[OF asm] unfolding alpha_res by clarify\n  then have a: \"supp x - as \\<inter> supp x = supp (p \\<bullet> x) - as' \\<inter> supp (p \\<bullet> x)\"\n    using alpha_abs_res_minimal[OF asm] by (simp add: alpha_res)\n  have b: \"(supp x - as \\<inter> supp x) \\<sharp>* p\"\n    using alpha_abs_res_minimal[OF asm] unfolding alpha_res by clarify\n  have \"p \\<bullet> (as \\<inter> supp x) = as' \\<inter> supp (p \\<bullet> x)\"\n    by (metis Int_commute asm c supp_property_res)\n  then show ?thesis using a b c unfolding alpha_set by simp\nqed\n\nlemma alpha_abs_set_abs_res:\n  assumes asm: \"(as \\<inter> supp x, x) \\<approx>set (=) supp p (as' \\<inter> supp x', x')\"\n  shows \"(as, x) \\<approx>res (=) supp p (as', x')\"\n  using asm unfolding alphas by (auto simp: Diff_Int)\n\nlemma alpha_abs_res_stronger1:\n  assumes asm: \"(as, x) \\<approx>res (=) supp p' (as', x')\"\n  shows \"\\<exists>p. (as, x) \\<approx>res (=) supp p (as', x') \\<and> supp p \\<subseteq> as \\<union> as'\"\nusing alpha_abs_res_stronger1_aux[OF asm] by auto\n\nlemma alpha_abs_set_stronger1:\n  assumes asm: \"(as, x) \\<approx>set (=) supp p' (as', x')\"\n  shows \"\\<exists>p. (as, x) \\<approx>set (=) supp p (as', x') \\<and> supp p \\<subseteq> as \\<union> as'\"\nproof -\n  from asm have 0: \"(supp x - as) \\<sharp>* p'\" by  (auto simp only: alphas)\n  then have #: \"p' \\<bullet> (supp x - as) = (supp x - as)\"\n    by (simp add: atom_set_perm_eq)\n  obtain p where *: \"\\<forall>b \\<in> (supp x \\<union> as). p \\<bullet> b = p' \\<bullet> b\"\n    and **: \"supp p \\<subseteq> (supp x \\<union> as) \\<union> p' \\<bullet> (supp x \\<union> as)\"\n    using set_renaming_perm2 by blast\n  from * have \"\\<forall>b \\<in> supp x. p \\<bullet> b = p' \\<bullet> b\" by blast\n  then have a: \"p \\<bullet> x = p' \\<bullet> x\" using supp_perm_perm_eq by auto\n  from * have \"\\<forall>b \\<in> as. p \\<bullet> b = p' \\<bullet> b\" by blast\n  then have zb: \"p \\<bullet> as = p' \\<bullet> as\"\n    apply(auto simp: permute_set_def)\n    apply(rule_tac x=\"xa\" in exI)\n    apply(simp)\n    done\n  have zc: \"p' \\<bullet> as = as'\" using asm by (simp add: alphas)\n  from 0 have 1: \"(supp x - as) \\<sharp>* p\" using *\n    by (auto simp: fresh_star_def fresh_perm)\n  then have 2: \"(supp x - as) \\<inter> supp p = {}\"\n    by (auto simp: fresh_star_def fresh_def)\n  have b: \"supp x = (supp x - as) \\<union> (supp x \\<inter> as)\" by auto\n  have \"supp p \\<subseteq> supp x \\<union> as \\<union> p' \\<bullet> supp x \\<union> p' \\<bullet> as\" using ** using union_eqvt by blast\n  also have \"\\<dots> = (supp x - as) \\<union> (supp x \\<inter> as) \\<union> as \\<union> (p' \\<bullet> ((supp x - as) \\<union> (supp x \\<inter> as))) \\<union> p' \\<bullet> as\"\n    using b by simp\n  also have \"\\<dots> = (supp x - as) \\<union> (supp x \\<inter> as) \\<union> as \\<union>\n    ((p' \\<bullet> (supp x - as)) \\<union> (p' \\<bullet> (supp x \\<inter> as))) \\<union> p' \\<bullet> as\" by (simp add: union_eqvt)\n  also have \"\\<dots> = (supp x - as) \\<union> (supp x \\<inter> as) \\<union> as \\<union> (p' \\<bullet> (supp x \\<inter> as)) \\<union> p' \\<bullet> as\"\n    using # by auto\n  also have \"\\<dots> = (supp x - as) \\<union> (supp x \\<inter> as) \\<union> as \\<union> p' \\<bullet> ((supp x \\<inter> as) \\<union> as)\" using union_eqvt\n    by auto\n  also have \"\\<dots> = (supp x - as) \\<union> (supp x \\<inter> as) \\<union> as \\<union> p' \\<bullet> as\"\n    by (metis Int_commute Un_commute sup_inf_absorb)\n  also have \"\\<dots> = (supp x - as) \\<union> as \\<union> p' \\<bullet> as\" by blast\n  finally have \"supp p \\<subseteq> (supp x - as) \\<union> as \\<union> p' \\<bullet> as\" .\n  then have \"supp p \\<subseteq> as \\<union> p' \\<bullet> as\" using 2 by blast\n  moreover\n  have \"(as, x) \\<approx>set (=) supp p (as', x')\" using asm 1 a zb by (simp add: alphas)\n  ultimately\n  show \"\\<exists>p. (as, x) \\<approx>set (=) supp p (as', x') \\<and> supp p \\<subseteq> as \\<union> as'\" using zc by blast\nqed\n\nlemma alpha_abs_lst_stronger1:\n  assumes asm: \"(as, x) \\<approx>lst (=) supp p' (as', x')\"\n  shows \"\\<exists>p. (as, x) \\<approx>lst (=) supp p (as', x') \\<and> supp p \\<subseteq> set as \\<union> set as'\"\nproof -\n  from asm have 0: \"(supp x - set as) \\<sharp>* p'\" by  (auto simp only: alphas)\n  then have #: \"p' \\<bullet> (supp x - set as) = (supp x - set as)\"\n    by (simp add: atom_set_perm_eq)\n  obtain p where *: \"\\<forall>b \\<in> (supp x \\<union> set as). p \\<bullet> b = p' \\<bullet> b\"\n    and **: \"supp p \\<subseteq> (supp x \\<union> set as) \\<union> p' \\<bullet> (supp x \\<union> set as)\"\n    using set_renaming_perm2 by blast\n  from * have \"\\<forall>b \\<in> supp x. p \\<bullet> b = p' \\<bullet> b\" by blast\n  then have a: \"p \\<bullet> x = p' \\<bullet> x\" using supp_perm_perm_eq by auto\n  from * have \"\\<forall>b \\<in> set as. p \\<bullet> b = p' \\<bullet> b\" by blast\n  then have zb: \"p \\<bullet> as = p' \\<bullet> as\" by (induct as) (auto)\n  have zc: \"p' \\<bullet> set as = set as'\" using asm by (simp add: alphas set_eqvt)\n  from 0 have 1: \"(supp x - set as) \\<sharp>* p\" using *\n    by (auto simp: fresh_star_def fresh_perm)\n  then have 2: \"(supp x - set as) \\<inter> supp p = {}\"\n    by (auto simp: fresh_star_def fresh_def)\n  have b: \"supp x = (supp x - set as) \\<union> (supp x \\<inter> set as)\" by auto\n  have \"supp p \\<subseteq> supp x \\<union> set as \\<union> p' \\<bullet> supp x \\<union> p' \\<bullet> set as\" using ** using union_eqvt by blast\n  also have \"\\<dots> = (supp x - set as) \\<union> (supp x \\<inter> set as) \\<union> set as \\<union>\n    (p' \\<bullet> ((supp x - set as) \\<union> (supp x \\<inter> set as))) \\<union> p' \\<bullet> set as\" using b by simp\n  also have \"\\<dots> = (supp x - set as) \\<union> (supp x \\<inter> set as) \\<union> set as \\<union>\n    ((p' \\<bullet> (supp x - set as)) \\<union> (p' \\<bullet> (supp x \\<inter> set as))) \\<union> p' \\<bullet> set as\" by (simp add: union_eqvt)\n  also have \"\\<dots> = (supp x - set as) \\<union> (supp x \\<inter> set as) \\<union> set as \\<union>\n    (p' \\<bullet> (supp x \\<inter> set as)) \\<union> p' \\<bullet> set as\" using # by auto\n  also have \"\\<dots> = (supp x - set as) \\<union> (supp x \\<inter> set as) \\<union> set as \\<union> p' \\<bullet> ((supp x \\<inter> set as) \\<union> set as)\"\n    using union_eqvt by auto\n  also have \"\\<dots> = (supp x - set as) \\<union> (supp x \\<inter> set as) \\<union> set as \\<union> p' \\<bullet> set as\"\n    by (metis Int_commute Un_commute sup_inf_absorb)\n  also have \"\\<dots> = (supp x - set as) \\<union> set as \\<union> p' \\<bullet> set as\" by blast\n  finally have \"supp p \\<subseteq> (supp x - set as) \\<union> set as \\<union> p' \\<bullet> set as\" .\n  then have \"supp p \\<subseteq> set as \\<union> p' \\<bullet> set as\" using 2 by blast\n  moreover\n  have \"(as, x) \\<approx>lst (=) supp p (as', x')\" using asm 1 a zb by (simp add: alphas)\n  ultimately\n  show \"\\<exists>p. (as, x) \\<approx>lst (=) supp p (as', x') \\<and> supp p \\<subseteq> set as \\<union> set as'\" using zc by blast\nqed\n\nlemma alphas_abs_stronger:\n  shows \"(as, x) \\<approx>abs_set (as', x') \\<longleftrightarrow> (\\<exists>p. (as, x) \\<approx>set (=) supp p (as', x') \\<and> supp p \\<subseteq> as \\<union> as')\"\n  and   \"(as, x) \\<approx>abs_res (as', x') \\<longleftrightarrow> (\\<exists>p. (as, x) \\<approx>res (=) supp p (as', x') \\<and> supp p \\<subseteq> as \\<union> as')\"\n  and   \"(bs, x) \\<approx>abs_lst (bs', x') \\<longleftrightarrow>\n   (\\<exists>p. (bs, x) \\<approx>lst (=) supp p (bs', x') \\<and> supp p \\<subseteq> set bs \\<union> set bs')\"\napply(rule iffI)\napply(auto simp: alphas_abs alpha_abs_set_stronger1)[1]\napply(auto simp: alphas_abs)[1]\napply(rule iffI)\napply(auto simp: alphas_abs alpha_abs_res_stronger1)[1]\napply(auto simp: alphas_abs)[1]\napply(rule iffI)\napply(auto simp: alphas_abs alpha_abs_lst_stronger1)[1]\napply(auto simp: alphas_abs)[1]\ndone\n\nlemma alpha_res_alpha_set:\n  \"(bs, x) \\<approx>res (=) supp p (cs, y) \\<longleftrightarrow> (bs \\<inter> supp x, x) \\<approx>set (=) supp p (cs \\<inter> supp y, y)\"\n  using alpha_abs_set_abs_res alpha_abs_res_abs_set by blast\n\nsection \\<open>Quotient types\\<close>\n\nquotient_type\n    'a abs_set = \"(atom set \\<times> 'a::pt)\" / \"alpha_abs_set\"\n  apply(rule equivpI)\n  unfolding reflp_def refl_on_def symp_def sym_def transp_def trans_def\n  by (auto intro: alphas_abs_sym alphas_abs_refl alphas_abs_trans simp only:)\n\nquotient_type\n    'b abs_res = \"(atom set \\<times> 'b::pt)\" / \"alpha_abs_res\"\n  apply(rule equivpI)\n  unfolding reflp_def refl_on_def symp_def sym_def transp_def trans_def\n  by (auto intro: alphas_abs_sym alphas_abs_refl alphas_abs_trans simp only:)\n\nquotient_type\n   'c abs_lst = \"(atom list \\<times> 'c::pt)\" / \"alpha_abs_lst\"\n  apply(rule_tac [!] equivpI)\n  unfolding reflp_def refl_on_def symp_def sym_def transp_def trans_def\n  by (auto intro: alphas_abs_sym alphas_abs_refl alphas_abs_trans simp only:)\n\nquotient_definition\n  Abs_set (\"[_]set. _\" [60, 60] 60)\nwhere\n  \"Abs_set::atom set \\<Rightarrow> ('a::pt) \\<Rightarrow> 'a abs_set\"\nis\n  \"Pair::atom set \\<Rightarrow> ('a::pt) \\<Rightarrow> (atom set \\<times> 'a)\" .\n\nquotient_definition\n  Abs_res (\"[_]res. _\" [60, 60] 60)\nwhere\n  \"Abs_res::atom set \\<Rightarrow> ('a::pt) \\<Rightarrow> 'a abs_res\"\nis\n  \"Pair::atom set \\<Rightarrow> ('a::pt) \\<Rightarrow> (atom set \\<times> 'a)\" .\n\nquotient_definition\n  Abs_lst (\"[_]lst. _\" [60, 60] 60)\nwhere\n  \"Abs_lst::atom list \\<Rightarrow> ('a::pt) \\<Rightarrow> 'a abs_lst\"\nis\n  \"Pair::atom list \\<Rightarrow> ('a::pt) \\<Rightarrow> (atom list \\<times> 'a)\" .\n\nlemma [quot_respect]:\n  shows \"((=) ===> (=) ===> alpha_abs_set) Pair Pair\"\n  and   \"((=) ===> (=) ===> alpha_abs_res) Pair Pair\"\n  and   \"((=) ===> (=) ===> alpha_abs_lst) Pair Pair\"\n  unfolding rel_fun_def\n  by (auto intro: alphas_abs_refl)\n\nlemma [quot_respect]:\n  shows \"((=) ===> alpha_abs_set ===> alpha_abs_set) permute permute\"\n  and   \"((=) ===> alpha_abs_res ===> alpha_abs_res) permute permute\"\n  and   \"((=) ===> alpha_abs_lst ===> alpha_abs_lst) permute permute\"\n  unfolding rel_fun_def\n  by (auto intro: alphas_abs_eqvt simp only: Pair_eqvt)\n\nlemma Abs_eq_iff:\n  shows \"[bs]set. x = [bs']set. y \\<longleftrightarrow> (\\<exists>p. (bs, x) \\<approx>set (=) supp p (bs', y))\"\n  and   \"[bs]res. x = [bs']res. y \\<longleftrightarrow> (\\<exists>p. (bs, x) \\<approx>res (=) supp p (bs', y))\"\n  and   \"[cs]lst. x = [cs']lst. y \\<longleftrightarrow> (\\<exists>p. (cs, x) \\<approx>lst (=) supp p (cs', y))\"\n  by (lifting alphas_abs)\n\nlemma Abs_eq_iff2:\n  shows \"[bs]set. x = [bs']set. y \\<longleftrightarrow> (\\<exists>p. (bs, x) \\<approx>set ((=)) supp p (bs', y) \\<and> supp p \\<subseteq> bs \\<union> bs')\"\n  and   \"[bs]res. x = [bs']res. y \\<longleftrightarrow> (\\<exists>p. (bs, x) \\<approx>res ((=)) supp p (bs', y) \\<and> supp p \\<subseteq> bs \\<union> bs')\"\n  and   \"[cs]lst. x = [cs']lst. y \\<longleftrightarrow> (\\<exists>p. (cs, x) \\<approx>lst ((=)) supp p (cs', y) \\<and> supp p \\<subseteq> set cs \\<union> set cs')\"\n  by (lifting alphas_abs_stronger)\n\n\nlemma Abs_eq_res_set:\n  shows \"[bs]res. x = [cs]res. y \\<longleftrightarrow> [bs \\<inter> supp x]set. x = [cs \\<inter> supp y]set. y\"\n  unfolding Abs_eq_iff alpha_res_alpha_set by rule\n\nlemma Abs_eq_res_supp:\n  assumes asm: \"supp x \\<subseteq> bs\"\n  shows \"[as]res. x = [as \\<inter> bs]res. x\"\n  unfolding Abs_eq_iff alphas\n  apply (rule_tac x=\"0::perm\" in exI)\n  apply (simp add: fresh_star_zero)\n  using asm by blast\n\nlemma Abs_exhausts[cases type]:\n  shows \"(\\<And>as (x::'a::pt). y1 = [as]set. x \\<Longrightarrow> P1) \\<Longrightarrow> P1\"\n  and   \"(\\<And>as (x::'a::pt). y2 = [as]res. x \\<Longrightarrow> P2) \\<Longrightarrow> P2\"\n  and   \"(\\<And>bs (x::'a::pt). y3 = [bs]lst. x \\<Longrightarrow> P3) \\<Longrightarrow> P3\"\n  by (lifting prod.exhaust[where 'a=\"atom set\" and 'b=\"'a\"]\n              prod.exhaust[where 'a=\"atom set\" and 'b=\"'a\"]\n              prod.exhaust[where 'a=\"atom list\" and 'b=\"'a\"])\n\ninstantiation abs_set :: (pt) pt\nbegin\n\nquotient_definition\n  \"permute_abs_set::perm \\<Rightarrow> ('a::pt abs_set) \\<Rightarrow> 'a abs_set\"\nis\n  \"permute:: perm \\<Rightarrow> (atom set \\<times> 'a::pt) \\<Rightarrow> (atom set \\<times> 'a::pt)\"\n  by (auto intro: alphas_abs_eqvt simp only: Pair_eqvt)\n\nlemma permute_Abs_set[simp]:\n  fixes x::\"'a::pt\"\n  shows \"(p \\<bullet> ([as]set. x)) = [p \\<bullet> as]set. (p \\<bullet> x)\"\n  by (lifting permute_prod.simps[where 'a=\"atom set\" and 'b=\"'a\"])\n\ninstance\n  apply standard\n  apply(case_tac [!] x)\n  apply(simp_all)\n  done\n\nend\n\ninstantiation abs_res :: (pt) pt\nbegin\n\nquotient_definition\n  \"permute_abs_res::perm \\<Rightarrow> ('a::pt abs_res) \\<Rightarrow> 'a abs_res\"\nis\n  \"permute:: perm \\<Rightarrow> (atom set \\<times> 'a::pt) \\<Rightarrow> (atom set \\<times> 'a::pt)\"\n  by (auto intro: alphas_abs_eqvt simp only: Pair_eqvt)\n\nlemma permute_Abs_res[simp]:\n  fixes x::\"'a::pt\"\n  shows \"(p \\<bullet> ([as]res. x)) = [p \\<bullet> as]res. (p \\<bullet> x)\"\n  by (lifting permute_prod.simps[where 'a=\"atom set\" and 'b=\"'a\"])\n\ninstance\n  apply standard\n  apply(case_tac [!] x)\n  apply(simp_all)\n  done\n\nend\n\ninstantiation abs_lst :: (pt) pt\nbegin\n\nquotient_definition\n  \"permute_abs_lst::perm \\<Rightarrow> ('a::pt abs_lst) \\<Rightarrow> 'a abs_lst\"\nis\n  \"permute:: perm \\<Rightarrow> (atom list \\<times> 'a::pt) \\<Rightarrow> (atom list \\<times> 'a::pt)\"\n  by (auto intro: alphas_abs_eqvt simp only: Pair_eqvt)\n\nlemma permute_Abs_lst[simp]:\n  fixes x::\"'a::pt\"\n  shows \"(p \\<bullet> ([as]lst. x)) = [p \\<bullet> as]lst. (p \\<bullet> x)\"\n  by (lifting permute_prod.simps[where 'a=\"atom list\" and 'b=\"'a\"])\n\ninstance\n  apply standard\n  apply(case_tac [!] x)\n  apply(simp_all)\n  done\n\nend\n\nlemmas permute_Abs[eqvt] = permute_Abs_set permute_Abs_res permute_Abs_lst\n\n\nlemma Abs_swap1:\n  assumes a1: \"a \\<notin> (supp x) - bs\"\n  and     a2: \"b \\<notin> (supp x) - bs\"\n  shows \"[bs]set. x = [(a \\<rightleftharpoons> b) \\<bullet> bs]set. ((a \\<rightleftharpoons> b) \\<bullet> x)\"\n  and   \"[bs]res. x = [(a \\<rightleftharpoons> b) \\<bullet> bs]res. ((a \\<rightleftharpoons> b) \\<bullet> x)\"\n  unfolding Abs_eq_iff\n  unfolding alphas\n  unfolding supp_eqvt[symmetric] Diff_eqvt[symmetric]\n  unfolding fresh_star_def fresh_def\n  unfolding swap_set_not_in[OF a1 a2]\n  using a1 a2\n  by (rule_tac [!] x=\"(a \\<rightleftharpoons> b)\" in exI)\n     (auto simp: supp_perm swap_atom)\n\nlemma Abs_swap2:\n  assumes a1: \"a \\<notin> (supp x) - (set bs)\"\n  and     a2: \"b \\<notin> (supp x) - (set bs)\"\n  shows \"[bs]lst. x = [(a \\<rightleftharpoons> b) \\<bullet> bs]lst. ((a \\<rightleftharpoons> b) \\<bullet> x)\"\n  unfolding Abs_eq_iff\n  unfolding alphas\n  unfolding supp_eqvt[symmetric] Diff_eqvt[symmetric] set_eqvt[symmetric]\n  unfolding fresh_star_def fresh_def\n  unfolding swap_set_not_in[OF a1 a2]\n  using a1 a2\n  by (rule_tac [!] x=\"(a \\<rightleftharpoons> b)\" in exI)\n     (auto simp: supp_perm swap_atom)\n\nlemma Abs_supports:\n  shows \"((supp x) - as) supports ([as]set. x)\"\n  and   \"((supp x) - as) supports ([as]res. x)\"\n  and   \"((supp x) - set bs) supports ([bs]lst. x)\"\n  unfolding supports_def\n  unfolding permute_Abs\n  by (simp_all add: Abs_swap1[symmetric] Abs_swap2[symmetric])\n\nfunction\n  supp_set  :: \"('a::pt) abs_set \\<Rightarrow> atom set\" and\n  supp_res :: \"('a::pt) abs_res \\<Rightarrow> atom set\" and\n  supp_lst :: \"('a::pt) abs_lst \\<Rightarrow> atom set\"\nwhere\n  \"supp_set ([as]set. x) = supp x - as\"\n| \"supp_res ([as]res. x) = supp x - as\"\n| \"supp_lst (Abs_lst cs x) = (supp x) - (set cs)\"\napply(simp_all add: Abs_eq_iff alphas_abs alphas)\napply(case_tac x)\napply(case_tac a)\napply(simp)\napply(case_tac b)\napply(case_tac a)\napply(simp)\napply(case_tac ba)\napply(simp)\ndone\n\ntermination\n  by lexicographic_order\n\nlemma supp_funs_eqvt[eqvt]:\n  shows \"(p \\<bullet> supp_set x) = supp_set (p \\<bullet> x)\"\n  and   \"(p \\<bullet> supp_res y) = supp_res (p \\<bullet> y)\"\n  and   \"(p \\<bullet> supp_lst z) = supp_lst (p \\<bullet> z)\"\n  apply(case_tac x)\n  apply(simp)\n  apply(case_tac y)\n  apply(simp)\n  apply(case_tac z)\n  apply(simp)\n  done\n\nlemma Abs_fresh_aux:\n  shows \"a \\<sharp> [bs]set. x \\<Longrightarrow> a \\<sharp> supp_set ([bs]set. x)\"\n  and   \"a \\<sharp> [bs]res. x \\<Longrightarrow> a \\<sharp> supp_res ([bs]res. x)\"\n  and   \"a \\<sharp> [cs]lst. x \\<Longrightarrow> a \\<sharp> supp_lst ([cs]lst. x)\"\n  by (rule_tac [!] fresh_fun_eqvt_app)\n     (auto simp only: eqvt_def eqvts_raw)\n\nlemma Abs_supp_subset1:\n  assumes a: \"finite (supp x)\"\n  shows \"(supp x) - as \\<subseteq> supp ([as]set. x)\"\n  and   \"(supp x) - as \\<subseteq> supp ([as]res. x)\"\n  and   \"(supp x) - (set bs) \\<subseteq> supp ([bs]lst. x)\"\n  unfolding supp_conv_fresh\n  by (auto dest!: Abs_fresh_aux)\n     (simp_all add: fresh_def supp_finite_atom_set a)\n\nlemma Abs_supp_subset2:\n  assumes a: \"finite (supp x)\"\n  shows \"supp ([as]set. x) \\<subseteq> (supp x) - as\"\n  and   \"supp ([as]res. x) \\<subseteq> (supp x) - as\"\n  and   \"supp ([bs]lst. x) \\<subseteq> (supp x) - (set bs)\"\n  by (rule_tac [!] supp_is_subset)\n     (simp_all add: Abs_supports a)\n\nlemma Abs_finite_supp:\n  assumes a: \"finite (supp x)\"\n  shows \"supp ([as]set. x) = (supp x) - as\"\n  and   \"supp ([as]res. x) = (supp x) - as\"\n  and   \"supp ([bs]lst. x) = (supp x) - (set bs)\"\nusing Abs_supp_subset1[OF a] Abs_supp_subset2[OF a]\n  by blast+\n\nlemma supp_Abs:\n  fixes x::\"'a::fs\"\n  shows \"supp ([as]set. x) = (supp x) - as\"\n  and   \"supp ([as]res. x) = (supp x) - as\"\n  and   \"supp ([bs]lst. x) = (supp x) - (set bs)\"\nby (simp_all add: Abs_finite_supp finite_supp)\n\ninstance abs_set :: (fs) fs\n  apply standard\n  apply(case_tac x)\n  apply(simp add: supp_Abs finite_supp)\n  done\n\ninstance abs_res :: (fs) fs\n  apply standard\n  apply(case_tac x)\n  apply(simp add: supp_Abs finite_supp)\n  done\n\ninstance abs_lst :: (fs) fs\n  apply standard\n  apply(case_tac x)\n  apply(simp add: supp_Abs finite_supp)\n  done\n\nlemma Abs_fresh_iff:\n  fixes x::\"'a::fs\"\n  shows \"a \\<sharp> [bs]set. x \\<longleftrightarrow> a \\<in> bs \\<or> (a \\<notin> bs \\<and> a \\<sharp> x)\"\n  and   \"a \\<sharp> [bs]res. x \\<longleftrightarrow> a \\<in> bs \\<or> (a \\<notin> bs \\<and> a \\<sharp> x)\"\n  and   \"a \\<sharp> [cs]lst. x \\<longleftrightarrow> a \\<in> (set cs) \\<or> (a \\<notin> (set cs) \\<and> a \\<sharp> x)\"\n  unfolding fresh_def\n  unfolding supp_Abs\n  by auto\n\nlemma Abs_fresh_star_iff:\n  fixes x::\"'a::fs\"\n  shows \"as \\<sharp>* ([bs]set. x) \\<longleftrightarrow> (as - bs) \\<sharp>* x\"\n  and   \"as \\<sharp>* ([bs]res. x) \\<longleftrightarrow> (as - bs) \\<sharp>* x\"\n  and   \"as \\<sharp>* ([cs]lst. x) \\<longleftrightarrow> (as - set cs) \\<sharp>* x\"\n  unfolding fresh_star_def\n  by (auto simp: Abs_fresh_iff)\n\nlemma Abs_fresh_star:\n  fixes x::\"'a::fs\"\n  shows \"as \\<subseteq> as' \\<Longrightarrow> as \\<sharp>* ([as']set. x)\"\n  and   \"as \\<subseteq> as' \\<Longrightarrow> as \\<sharp>* ([as']res. x)\"\n  and   \"bs \\<subseteq> set bs' \\<Longrightarrow> bs \\<sharp>* ([bs']lst. x)\"\n  unfolding fresh_star_def\n  by(auto simp: Abs_fresh_iff)\n\nlemma Abs_fresh_star2:\n  fixes x::\"'a::fs\"\n  shows \"as \\<inter> bs = {} \\<Longrightarrow> as \\<sharp>* ([bs]set. x) \\<longleftrightarrow> as \\<sharp>* x\"\n  and   \"as \\<inter> bs = {} \\<Longrightarrow> as \\<sharp>* ([bs]res. x) \\<longleftrightarrow> as \\<sharp>* x\"\n  and   \"cs \\<inter> set ds = {} \\<Longrightarrow> cs \\<sharp>* ([ds]lst. x) \\<longleftrightarrow> cs \\<sharp>* x\"\n  unfolding fresh_star_def Abs_fresh_iff\n  by auto\n\n\nsection \\<open>Abstractions of single atoms\\<close>\n\n\nlemma Abs1_eq:\n  fixes x y::\"'a::fs\"\n  shows \"[{atom a}]set. x = [{atom a}]set. y \\<longleftrightarrow> x = y\"\n  and   \"[{atom a}]res. x = [{atom a}]res. y \\<longleftrightarrow> x = y\"\n  and   \"[[atom a]]lst. x = [[atom a]]lst. y \\<longleftrightarrow> x = y\"\nunfolding Abs_eq_iff2 alphas\nby (auto simp: supp_perm_singleton fresh_star_def fresh_zero_perm)\n\nlemma Abs1_eq_iff_fresh:\n  fixes x y::\"'a::fs\"\n  and a b c::\"'b::at\"\n  assumes \"atom c \\<sharp> (a, b, x, y)\"\n  shows \"[{atom a}]set. x = [{atom b}]set. y \\<longleftrightarrow> (a \\<leftrightarrow> c) \\<bullet> x = (b \\<leftrightarrow> c) \\<bullet> y\"\n  and   \"[{atom a}]res. x = [{atom b}]res. y \\<longleftrightarrow> (a \\<leftrightarrow> c) \\<bullet> x = (b \\<leftrightarrow> c) \\<bullet> y\"\n  and   \"[[atom a]]lst. x = [[atom b]]lst. y \\<longleftrightarrow> (a \\<leftrightarrow> c) \\<bullet> x = (b \\<leftrightarrow> c) \\<bullet> y\"\nproof -\n  have \"[{atom a}]set. x = (a \\<leftrightarrow> c) \\<bullet> ([{atom a}]set. x)\"\n    by (rule_tac flip_fresh_fresh[symmetric]) (simp_all add: Abs_fresh_iff assms)\n  then have \"[{atom a}]set. x = [{atom c}]set. ((a \\<leftrightarrow> c) \\<bullet> x)\" by simp\n  moreover\n  have \"[{atom b}]set. y = (b \\<leftrightarrow> c) \\<bullet> ([{atom b}]set. y)\"\n    by (rule_tac flip_fresh_fresh[symmetric]) (simp_all add: Abs_fresh_iff assms)\n  then have \"[{atom b}]set. y = [{atom c}]set. ((b \\<leftrightarrow> c) \\<bullet> y)\" by simp\n  ultimately\n  show \"[{atom a}]set. x = [{atom b}]set. y \\<longleftrightarrow> (a \\<leftrightarrow> c) \\<bullet> x = (b \\<leftrightarrow> c) \\<bullet> y\"\n    by (simp add: Abs1_eq)\nnext\n  have \"[{atom a}]res. x = (a \\<leftrightarrow> c) \\<bullet> ([{atom a}]res. x)\"\n    by (rule_tac flip_fresh_fresh[symmetric]) (simp_all add: Abs_fresh_iff assms)\n  then have \"[{atom a}]res. x = [{atom c}]res. ((a \\<leftrightarrow> c) \\<bullet> x)\" by simp\n  moreover\n  have \"[{atom b}]res. y = (b \\<leftrightarrow> c) \\<bullet> ([{atom b}]res. y)\"\n    by (rule_tac flip_fresh_fresh[symmetric]) (simp_all add: Abs_fresh_iff assms)\n  then have \"[{atom b}]res. y = [{atom c}]res. ((b \\<leftrightarrow> c) \\<bullet> y)\" by simp\n  ultimately\n  show \"[{atom a}]res. x = [{atom b}]res. y \\<longleftrightarrow> (a \\<leftrightarrow> c) \\<bullet> x = (b \\<leftrightarrow> c) \\<bullet> y\"\n    by (simp add: Abs1_eq)\nnext\n  have \"[[atom a]]lst. x = (a \\<leftrightarrow> c) \\<bullet> ([[atom a]]lst. x)\"\n    by (rule_tac flip_fresh_fresh[symmetric]) (simp_all add: Abs_fresh_iff assms)\n  then have \"[[atom a]]lst. x = [[atom c]]lst. ((a \\<leftrightarrow> c) \\<bullet> x)\" by simp\n  moreover\n  have \"[[atom b]]lst. y = (b \\<leftrightarrow> c) \\<bullet> ([[atom b]]lst. y)\"\n    by (rule_tac flip_fresh_fresh[symmetric]) (simp_all add: Abs_fresh_iff assms)\n  then have \"[[atom b]]lst. y = [[atom c]]lst. ((b \\<leftrightarrow> c) \\<bullet> y)\" by simp\n  ultimately\n  show \"[[atom a]]lst. x = [[atom b]]lst. y \\<longleftrightarrow> (a \\<leftrightarrow> c) \\<bullet> x = (b \\<leftrightarrow> c) \\<bullet> y\"\n    by (simp add: Abs1_eq)\nqed\n\nlemma Abs1_eq_iff_all:\n  fixes x y::\"'a::fs\"\n  and z::\"'c::fs\"\n  and a b::\"'b::at\"\n  shows \"[{atom a}]set. x = [{atom b}]set. y \\<longleftrightarrow> (\\<forall>c. atom c \\<sharp> z \\<longrightarrow> atom c \\<sharp> (a, b, x, y) \\<longrightarrow> (a \\<leftrightarrow> c) \\<bullet> x = (b \\<leftrightarrow> c) \\<bullet> y)\"\n  and   \"[{atom a}]res. x = [{atom b}]res. y \\<longleftrightarrow> (\\<forall>c. atom c \\<sharp> z \\<longrightarrow> atom c \\<sharp> (a, b, x, y) \\<longrightarrow> (a \\<leftrightarrow> c) \\<bullet> x = (b \\<leftrightarrow> c) \\<bullet> y)\"\n  and   \"[[atom a]]lst. x = [[atom b]]lst. y \\<longleftrightarrow> (\\<forall>c. atom c \\<sharp> z \\<longrightarrow> atom c \\<sharp> (a, b, x, y) \\<longrightarrow> (a \\<leftrightarrow> c) \\<bullet> x = (b \\<leftrightarrow> c) \\<bullet> y)\"\napply(auto)\napply(simp add: Abs1_eq_iff_fresh(1)[symmetric])\napply(rule_tac ?'a=\"'b::at\" and x=\"(a, b, x, y, z)\" in obtain_fresh)\napply(drule_tac x=\"aa\" in spec)\napply(simp)\napply(subst Abs1_eq_iff_fresh(1))\napply(auto simp: fresh_Pair)[2]\napply(simp add: Abs1_eq_iff_fresh(2)[symmetric])\napply(rule_tac ?'a=\"'b::at\" and x=\"(a, b, x, y, z)\" in obtain_fresh)\napply(drule_tac x=\"aa\" in spec)\napply(simp)\napply(subst Abs1_eq_iff_fresh(2))\napply(auto simp: fresh_Pair)[2]\napply(simp add: Abs1_eq_iff_fresh(3)[symmetric])\napply(rule_tac ?'a=\"'b::at\" and x=\"(a, b, x, y, z)\" in obtain_fresh)\napply(drule_tac x=\"aa\" in spec)\napply(simp)\napply(subst Abs1_eq_iff_fresh(3))\napply(auto simp: fresh_Pair)[2]\ndone\n\nlemma Abs1_eq_iff:\n  fixes x y::\"'a::fs\"\n  and a b::\"'b::at\"\n  shows \"[{atom a}]set. x = [{atom b}]set. y \\<longleftrightarrow> (a = b \\<and> x = y) \\<or> (a \\<noteq> b \\<and> x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y)\"\n  and   \"[{atom a}]res. x = [{atom b}]res. y \\<longleftrightarrow> (a = b \\<and> x = y) \\<or> (a \\<noteq> b \\<and> x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y)\"\n  and   \"[[atom a]]lst. x = [[atom b]]lst. y \\<longleftrightarrow> (a = b \\<and> x = y) \\<or> (a \\<noteq> b \\<and> x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y)\"\nproof -\n  { assume \"a = b\"\n    then have \"[{atom a}]set. x = [{atom b}]set. y \\<longleftrightarrow> (a = b \\<and> x = y)\" by (simp add: Abs1_eq)\n  }\n  moreover\n  { assume *: \"a \\<noteq> b\" and **: \"[{atom a}]set. x = [{atom b}]set. y\"\n    have #: \"atom a \\<sharp> [{atom b}]set. y\" by (simp add: **[symmetric] Abs_fresh_iff)\n    have \"[{atom a}]set. ((a \\<leftrightarrow> b) \\<bullet> y) = (a \\<leftrightarrow> b) \\<bullet> ([{atom b}]set. y)\" by (simp)\n    also have \"\\<dots> = [{atom b}]set. y\"\n      by (rule flip_fresh_fresh) (simp add: #, simp add: Abs_fresh_iff)\n    also have \"\\<dots> = [{atom a}]set. x\" using ** by simp\n    finally have \"a \\<noteq> b \\<and> x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y\" using # * by (simp add: Abs1_eq Abs_fresh_iff)\n  }\n  moreover\n  { assume *: \"a \\<noteq> b\" and **: \"x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y\"\n    have \"[{atom a}]set. x = [{atom a}]set. ((a \\<leftrightarrow> b) \\<bullet> y)\" using ** by simp\n    also have \"\\<dots> = (a \\<leftrightarrow> b) \\<bullet> ([{atom b}]set. y)\" by (simp add: permute_set_def)\n    also have \"\\<dots> = [{atom b}]set. y\"\n      by (rule flip_fresh_fresh) (simp add: Abs_fresh_iff **, simp add: Abs_fresh_iff)\n    finally have \"[{atom a}]set. x = [{atom b}]set. y\" .\n  }\n  ultimately\n  show \"[{atom a}]set. x = [{atom b}]set. y \\<longleftrightarrow> (a = b \\<and> x = y) \\<or> (a \\<noteq> b \\<and> x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y)\"\n    by blast\nnext\n  { assume \"a = b\"\n    then have \"Abs_res {atom a} x = Abs_res {atom b} y \\<longleftrightarrow> (a = b \\<and> x = y)\" by (simp add: Abs1_eq)\n  }\n  moreover\n  { assume *: \"a \\<noteq> b\" and **: \"Abs_res {atom a} x = Abs_res {atom b} y\"\n    have #: \"atom a \\<sharp> Abs_res {atom b} y\" by (simp add: **[symmetric] Abs_fresh_iff)\n    have \"Abs_res {atom a} ((a \\<leftrightarrow> b) \\<bullet> y) = (a \\<leftrightarrow> b) \\<bullet> (Abs_res {atom b} y)\" by simp\n    also have \"\\<dots> = Abs_res {atom b} y\"\n      by (rule flip_fresh_fresh) (simp add: #, simp add: Abs_fresh_iff)\n    also have \"\\<dots> = Abs_res {atom a} x\" using ** by simp\n    finally have \"a \\<noteq> b \\<and> x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y\" using # * by (simp add: Abs1_eq Abs_fresh_iff)\n  }\n  moreover\n  { assume *: \"a \\<noteq> b\" and **: \"x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y\"\n    have \"Abs_res {atom a} x = Abs_res {atom a} ((a \\<leftrightarrow> b) \\<bullet> y)\" using ** by simp\n    also have \"\\<dots> = (a \\<leftrightarrow> b) \\<bullet> Abs_res {atom b} y\" by (simp add: permute_set_def)\n    also have \"\\<dots> = Abs_res {atom b} y\"\n      by (rule flip_fresh_fresh) (simp add: Abs_fresh_iff **, simp add: Abs_fresh_iff)\n    finally have \"Abs_res {atom a} x = Abs_res {atom b} y\" .\n  }\n  ultimately\n  show \"Abs_res {atom a} x = Abs_res {atom b} y \\<longleftrightarrow> (a = b \\<and> x = y) \\<or> (a \\<noteq> b \\<and> x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y)\"\n    by blast\nnext\n  { assume \"a = b\"\n    then have \"Abs_lst [atom a] x = Abs_lst [atom b] y \\<longleftrightarrow> (a = b \\<and> x = y)\" by (simp add: Abs1_eq)\n  }\n  moreover\n  { assume *: \"a \\<noteq> b\" and **: \"Abs_lst [atom a] x = Abs_lst [atom b] y\"\n    have #: \"atom a \\<sharp> Abs_lst [atom b] y\" by (simp add: **[symmetric] Abs_fresh_iff)\n    have \"Abs_lst [atom a] ((a \\<leftrightarrow> b) \\<bullet> y) = (a \\<leftrightarrow> b) \\<bullet> (Abs_lst [atom b] y)\" by simp\n    also have \"\\<dots> = Abs_lst [atom b] y\"\n      by (rule flip_fresh_fresh) (simp add: #, simp add: Abs_fresh_iff)\n    also have \"\\<dots> = Abs_lst [atom a] x\" using ** by simp\n    finally have \"a \\<noteq> b \\<and> x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y\" using # * by (simp add: Abs1_eq Abs_fresh_iff)\n  }\n  moreover\n  { assume *: \"a \\<noteq> b\" and **: \"x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y\"\n    have \"Abs_lst [atom a] x = Abs_lst [atom a] ((a \\<leftrightarrow> b) \\<bullet> y)\" using ** by simp\n    also have \"\\<dots> = (a \\<leftrightarrow> b) \\<bullet> Abs_lst [atom b] y\" by simp\n    also have \"\\<dots> = Abs_lst [atom b] y\"\n      by (rule flip_fresh_fresh) (simp add: Abs_fresh_iff **, simp add: Abs_fresh_iff)\n    finally have \"Abs_lst [atom a] x = Abs_lst [atom b] y\" .\n  }\n  ultimately\n  show \"Abs_lst [atom a] x = Abs_lst [atom b] y \\<longleftrightarrow> (a = b \\<and> x = y) \\<or> (a \\<noteq> b \\<and> x = (a \\<leftrightarrow> b) \\<bullet> y \\<and> atom a \\<sharp> y)\"\n    by blast\nqed\n\nlemma Abs1_eq_iff':\n  fixes x::\"'a::fs\"\n  and a b::\"'b::at\"\n  shows \"[{atom a}]set. x = [{atom b}]set. y \\<longleftrightarrow> (a = b \\<and> x = y) \\<or> (a \\<noteq> b \\<and> (b \\<leftrightarrow> a) \\<bullet> x = y \\<and> atom b \\<sharp> x)\"\n  and   \"[{atom a}]res. x = [{atom b}]res. y \\<longleftrightarrow> (a = b \\<and> x = y) \\<or> (a \\<noteq> b \\<and> (b \\<leftrightarrow> a) \\<bullet> x = y \\<and> atom b \\<sharp> x)\"\n  and   \"[[atom a]]lst. x = [[atom b]]lst. y \\<longleftrightarrow> (a = b \\<and> x = y) \\<or> (a \\<noteq> b \\<and> (b \\<leftrightarrow> a) \\<bullet> x = y \\<and> atom b \\<sharp> x)\"\nby (auto simp: Abs1_eq_iff fresh_permute_left)\n\n\nML \\<open>\nfun alpha_single_simproc thm _ ctxt ctrm =\n  let\n    val thy = Proof_Context.theory_of ctxt\n    val _ $ (_ $ x) $ (_ $ y) = Thm.term_of ctrm\n    val cvrs = union (op =) (Term.add_frees x []) (Term.add_frees y [])\n      |> filter (fn (_, ty) => Sign.of_sort thy (ty, @{sort fs}))\n      |> map Free\n      |> HOLogic.mk_tuple\n      |> Thm.cterm_of ctxt\n    val cvrs_ty = Thm.ctyp_of_cterm cvrs\n    val thm' = thm\n      |> Thm.instantiate' [NONE, NONE, SOME cvrs_ty] [NONE, NONE, NONE, NONE, SOME cvrs]\n  in\n    SOME thm'\n  end\n\\<close>\n\nsimproc_setup alpha_set (\"[{atom a}]set. x = [{atom b}]set. y\") =\n  \\<open>alpha_single_simproc @{thm Abs1_eq_iff_all(1)[THEN eq_reflection]}\\<close>\n\nsimproc_setup alpha_res (\"[{atom a}]res. x = [{atom b}]res. y\") =\n  \\<open>alpha_single_simproc @{thm Abs1_eq_iff_all(2)[THEN eq_reflection]}\\<close>\n\nsimproc_setup alpha_lst (\"[[atom a]]lst. x = [[atom b]]lst. y\") =\n  \\<open>alpha_single_simproc @{thm Abs1_eq_iff_all(3)[THEN eq_reflection]}\\<close>\n\n\nsubsection \\<open>Renaming of bodies of abstractions\\<close>\n\nlemma Abs_rename_set:\n  fixes x::\"'a::fs\"\n  assumes a: \"(p \\<bullet> bs) \\<sharp>* x\"\n  (*and     b: \"finite bs\"*)\n  shows \"\\<exists>q. [bs]set. x = [p \\<bullet> bs]set. (q \\<bullet> x) \\<and> q \\<bullet> bs = p \\<bullet> bs\"\nproof -\n  from set_renaming_perm2\n  obtain q where *: \"\\<forall>b \\<in> bs. q \\<bullet> b = p \\<bullet> b\" and **: \"supp q \\<subseteq> bs \\<union> (p \\<bullet> bs)\" by blast\n  have ***: \"q \\<bullet> bs = p \\<bullet> bs\" using *\n    unfolding permute_set_eq_image image_def by auto\n  have \"[bs]set. x =  q \\<bullet> ([bs]set. x)\"\n    apply(rule perm_supp_eq[symmetric])\n    using a **\n    unfolding Abs_fresh_star_iff\n    unfolding fresh_star_def\n    by auto\n  also have \"\\<dots> = [q \\<bullet> bs]set. (q \\<bullet> x)\" by simp\n  finally have \"[bs]set. x = [p \\<bullet> bs]set. (q \\<bullet> x)\" by (simp add: ***)\n  then show \"\\<exists>q. [bs]set. x = [p \\<bullet> bs]set. (q \\<bullet> x) \\<and> q \\<bullet> bs = p \\<bullet> bs\" using *** by metis\nqed\n\nlemma Abs_rename_res:\n  fixes x::\"'a::fs\"\n  assumes a: \"(p \\<bullet> bs) \\<sharp>* x\"\n  (*and     b: \"finite bs\"*)\n  shows \"\\<exists>q. [bs]res. x = [p \\<bullet> bs]res. (q \\<bullet> x) \\<and> q \\<bullet> bs = p \\<bullet> bs\"\nproof -\n  from set_renaming_perm2\n  obtain q where *: \"\\<forall>b \\<in> bs. q \\<bullet> b = p \\<bullet> b\" and **: \"supp q \\<subseteq> bs \\<union> (p \\<bullet> bs)\" by blast\n  have ***: \"q \\<bullet> bs = p \\<bullet> bs\" using *\n    unfolding permute_set_eq_image image_def by auto\n  have \"[bs]res. x =  q \\<bullet> ([bs]res. x)\"\n    apply(rule perm_supp_eq[symmetric])\n    using a **\n    unfolding Abs_fresh_star_iff\n    unfolding fresh_star_def\n    by auto\n  also have \"\\<dots> = [q \\<bullet> bs]res. (q \\<bullet> x)\" by simp\n  finally have \"[bs]res. x = [p \\<bullet> bs]res. (q \\<bullet> x)\" by (simp add: ***)\n  then show \"\\<exists>q. [bs]res. x = [p \\<bullet> bs]res. (q \\<bullet> x) \\<and> q \\<bullet> bs = p \\<bullet> bs\" using *** by metis\nqed\n\nlemma Abs_rename_lst:\n  fixes x::\"'a::fs\"\n  assumes a: \"(p \\<bullet> (set bs)) \\<sharp>* x\"\n  shows \"\\<exists>q. [bs]lst. x = [p \\<bullet> bs]lst. (q \\<bullet> x) \\<and> q \\<bullet> bs = p \\<bullet> bs\"\nproof -\n  from list_renaming_perm\n  obtain q where *: \"\\<forall>b \\<in> set bs. q \\<bullet> b = p \\<bullet> b\" and **: \"supp q \\<subseteq> set bs \\<union> (p \\<bullet> set bs)\" by blast\n  have ***: \"q \\<bullet> bs = p \\<bullet> bs\" using * by (induct bs) (simp_all add: insert_eqvt)\n  have \"[bs]lst. x =  q \\<bullet> ([bs]lst. x)\"\n    apply(rule perm_supp_eq[symmetric])\n    using a **\n    unfolding Abs_fresh_star_iff\n    unfolding fresh_star_def\n    by auto\n  also have \"\\<dots> = [q \\<bullet> bs]lst. (q \\<bullet> x)\" by simp\n  finally have \"[bs]lst. x = [p \\<bullet> bs]lst. (q \\<bullet> x)\" by (simp add: ***)\n  then show \"\\<exists>q. [bs]lst. x = [p \\<bullet> bs]lst. (q \\<bullet> x) \\<and> q \\<bullet> bs = p \\<bullet> bs\" using *** by metis\nqed\n\n\ntext \\<open>for deep recursive binders\\<close>\n\nlemma Abs_rename_set':\n  fixes x::\"'a::fs\"\n  assumes a: \"(p \\<bullet> bs) \\<sharp>* x\"\n  (*and     b: \"finite bs\"*)\n  shows \"\\<exists>q. [bs]set. x = [q \\<bullet> bs]set. (q \\<bullet> x) \\<and> q \\<bullet> bs = p \\<bullet> bs\"\nusing Abs_rename_set[OF a] by metis\n\nlemma Abs_rename_res':\n  fixes x::\"'a::fs\"\n  assumes a: \"(p \\<bullet> bs) \\<sharp>* x\"\n  (*and     b: \"finite bs\"*)\n  shows \"\\<exists>q. [bs]res. x = [q \\<bullet> bs]res. (q \\<bullet> x) \\<and> q \\<bullet> bs = p \\<bullet> bs\"\nusing Abs_rename_res[OF a] by metis\n\nlemma Abs_rename_lst':\n  fixes x::\"'a::fs\"\n  assumes a: \"(p \\<bullet> (set bs)) \\<sharp>* x\"\n  shows \"\\<exists>q. [bs]lst. x = [q \\<bullet> bs]lst. (q \\<bullet> x) \\<and> q \\<bullet> bs = p \\<bullet> bs\"\nusing Abs_rename_lst[OF a] by metis\n\nsection \\<open>Infrastructure for building tuples of relations and functions\\<close>\n\nfun\n  prod_fv :: \"('a \\<Rightarrow> atom set) \\<Rightarrow> ('b \\<Rightarrow> atom set) \\<Rightarrow> ('a \\<times> 'b) \\<Rightarrow> atom set\"\nwhere\n  \"prod_fv fv1 fv2 (x, y) = fv1 x \\<union> fv2 y\"\n\ndefinition\n  prod_alpha :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> ('b \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<times> 'b \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> bool)\"\nwhere\n \"prod_alpha = rel_prod\"\n\nlemma [quot_respect]:\n  shows \"((R1 ===> (=)) ===> (R2 ===> (=)) ===> rel_prod R1 R2 ===> (=)) prod_fv prod_fv\"\n  unfolding rel_fun_def\n  by auto\n\nlemma [quot_preserve]:\n  assumes q1: \"Quotient3 R1 abs1 rep1\"\n  and     q2: \"Quotient3 R2 abs2 rep2\"\n  shows \"((abs1 ---> id) ---> (abs2 ---> id) ---> map_prod rep1 rep2 ---> id) prod_fv = prod_fv\"\n  by (simp add: fun_eq_iff Quotient3_abs_rep[OF q1] Quotient3_abs_rep[OF q2])\n\nlemma [mono]:\n  shows \"A <= B \\<Longrightarrow> C <= D ==> prod_alpha A C <= prod_alpha B D\"\n  unfolding prod_alpha_def\n  by auto\n\nlemma [eqvt]:\n  shows \"p \\<bullet> prod_alpha A B x y = prod_alpha (p \\<bullet> A) (p \\<bullet> B) (p \\<bullet> x) (p \\<bullet> y)\"\n  unfolding prod_alpha_def\n  unfolding rel_prod_conv\n  by (perm_simp) (rule refl)\n\nlemma [eqvt]:\n  shows \"p \\<bullet> prod_fv A B (x, y) = prod_fv (p \\<bullet> A) (p \\<bullet> B) (p \\<bullet> x, p \\<bullet> y)\"\n  unfolding prod_fv.simps\n  by (perm_simp) (rule refl)\n\nlemma prod_fv_supp:\n  shows \"prod_fv supp supp = supp\"\nby (rule ext)\n   (auto simp: supp_Pair)\n\nlemma prod_alpha_eq:\n  shows \"prod_alpha ((=)) ((=)) = ((=))\"\n  unfolding prod_alpha_def\n  by (auto intro!: ext)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Nominal2/Nominal2_Abs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.34159470414198595}}
{"text": "(*\n    Author:     David Sanan\n    Maintainer:  David Sanan, sanan at ntu edu sg\n    License:     LGPL\n*)\n\n(*  Title:      StateSpace.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* State Space Template *}\ntheory StateSpaceProduct imports EmbSimpl.Hoare\nbegin\n\n\ntype_synonym ('g, 'n, 'val) stateSP = \"'g \\<times> ('n \\<Rightarrow> 'val)\"\n\ndefinition\n  upd_globals:: \"('g \\<Rightarrow> 'g) \\<Rightarrow> 'g \\<times> 'l \\<Rightarrow> 'g \\<times> 'l\"\nwhere\n  \"upd_globals upd s = (upd (fst s), snd s)\" \n\n\ndefinition\n  globals_update:: \"('g \\<Rightarrow> 'g) \\<Rightarrow> 'g \\<times> 'l \\<Rightarrow> 'g \\<times> 'l\"\nwhere\n  \"globals_update upd s = (upd (fst s), snd s)\" \n\ndeclare globals_update_def[simp]\n\ndefinition globals ::\"'g \\<times> 'l \\<Rightarrow> 'g\"\n  where \"globals s \\<equiv> fst s\"\n\ndefinition locals :: \" ('g, 'n, 'val) stateSP \\<Rightarrow> ('n \\<Rightarrow> 'val)\"\n  where\n\"locals s \\<equiv> snd s\" \n\ndefinition upd_locals::\"( ('n \\<Rightarrow> 'val) \\<Rightarrow>  ('n \\<Rightarrow> 'val)) \\<Rightarrow> ('g, 'n, 'val) stateSP \\<Rightarrow> ('g, 'n, 'val) stateSP\" \n  where\n\"upd_locals upd s = (fst s, upd (snd s))\"\n\ndefinition locals_update::\"( ('n \\<Rightarrow> 'val) \\<Rightarrow>  ('n \\<Rightarrow> 'val)) \\<Rightarrow> ('g, 'n, 'val) stateSP \\<Rightarrow> ('g, 'n, 'val) stateSP\" \n  where\n\"locals_update upd s = (fst s, upd (snd s))\"\n\ndeclare locals_update_def[simp]\n\n\nlemma upd_globals_conv: \"upd_globals f = (\\<lambda>s. (f (fst s), snd s))\"\n  by (rule ext) (simp add: upd_globals_def)\n\nlemma globals_updates_conv: \"globals_update f = (\\<lambda>s. (f (fst s), snd s))\"\n  by (rule ext) (simp)\n\n\nlemma upd_locals_conv: \"upd_locals f = (\\<lambda>s. (fst s, f (snd s)))\"\n  by (rule ext) (simp add: upd_locals_def)\n\nlemma locals_updates_conv: \"locals_update f = (\\<lambda>s. (fst s, f (snd s)))\"\n  by (rule ext) (simp)\n\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/StateSpaceProduct.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3415946969709353}}
{"text": "theory InstanceBags\nimports NonFreeAnimation\nbegin \n\n(*\ndatatype 'a bag = Emp | Ins 'a ('a bag) \nwhere \n  Ins a1 (Ins a2 s) = Ins a2 (Ins a1 s)\n*)\n\n\nlocale results =\n  fixes alpha :: tyvar\n    and bag_name :: tyco\n    and ins_name :: oper\n    and emp_name :: oper\n    and dummy :: 'a\nbegin\n\nlemma [ffact]: \"decl_tyvars () [alpha]\" ..\nlemma [ffact]: \"alpha tyinterpr TYPE('a)\" ..\n\nlemma [ffact]: \"bag_name tycohaskind (ExtType =K=> IntType)\" ..\n\nlemma [ffact]: \"ins_name operhasty (alpha =T=> bag_name ** alpha =T=> bag_name ** alpha)\" ..\nlemma [ffact]: \"emp_name operhasty (bag_name ** alpha)\" ..\n\ndefinition \"ins_clause_name = (0::nat)\"\n\nlemma [ffact]: \"decl_hcl ins_clause_name (QUANT a:alpha. QUANT a2:alpha. QUANT S: bag_name**alpha.\n  ins_name $ a $ (ins_name $ a2 $ S) === ins_name $ a2 $ (ins_name $ a $ S))\" ..\n\nlocal_setup {* MetaRec.run_expl_frules *}\n\nend\n\n\nthm results.ins_clause\n\n\n\n\nlocale algebra_results = results  alpha bag_name ins_name emp_name dummy\n    for alpha :: tyvar\n    and bag_name :: tyco\n    and emp_name :: oper\n    and ins_name :: oper\n    and dummy :: 'a\nbegin\n\n\nlemma [ffact]: \"(bag_name ** alpha) alginterpr TYPE('a set)\" ..\nlemma [ffact]: \"ins_name operalginterpr (% (x::'a) (xs :: 'a set). {x} Un xs)\" ..\nlemma [ffact]: \"emp_name operalginterpr ({} :: 'a set)\" ..\n\nlemma [ffact]: \"proven_hcl (ALL (x::'a) (x2::'a) (S::'a set). {x} Un ({x2} Un S) = {x2} Un ({x} Un S))\"\n  unfolding proven_hcl_def by blast\n\nlocal_setup {* MetaRec.run_expl_frules *}\n\nend\n\nthm algebra_results.iter_op_clauses0\n\n\n\nend\n", "meta": {"author": "metaforcy", "repo": "nonfree-data", "sha": "f3ce28278a88fdd240faa2e51f893fee5c15f2f2", "save_path": "github-repos/isabelle/metaforcy-nonfree-data", "path": "github-repos/isabelle/metaforcy-nonfree-data/nonfree-data-f3ce28278a88fdd240faa2e51f893fee5c15f2f2/manual-instantiations/InstanceBags.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6992544335934766, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3414343290106885}}
{"text": "(* \n    This file is a part of IsarMathLib - \n    a library of formalized mathematics for Isabelle/Isar.\n\n    Copyright (C) 2005 - 2008  Slawomir Kolodynski\n\n    This program is free software; Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED \nWARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF \nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. \nIN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, \nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, \nPROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; \nOR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, \nWHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \nOTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, \nEVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\nsection \\<open>First Order Logic\\<close>\n\ntheory Fol1 imports ZF.Trancl\n\nbegin\n\ntext\\<open>Isabelle/ZF builds on the first order logic. Almost everything\n  one would like to have in this area is covered in the standard Isabelle \n  libraries. The material in this theory provides some lemmas that are\n  missing or allow for a more readable proof style.\\<close>\n\n\nsubsection\\<open>Notions and lemmas in FOL\\<close>\n\ntext\\<open>This section contains mostly shortcuts and workarounds \n  that allow to use more readable coding style.\\<close>\n\ntext\\<open>The next lemma serves as a workaround to problems with applying \n  the definition of transitivity (of a relation) in our coding style \n  (any attempt to do\n  something like \\<open>using trans_def\\<close> puts Isabelle in an \n  infinite loop).\\<close>\n\nlemma Fol1_L2: assumes \n  A1: \"\\<forall> x y z. \\<langle>x, y\\<rangle> \\<in> r \\<and> \\<langle>y, z\\<rangle> \\<in> r \\<longrightarrow> \\<langle>x, z\\<rangle> \\<in> r\"\n  shows \"trans(r)\"\nproof -\n  from A1 have\n    \"\\<forall> x y z. \\<langle>x, y\\<rangle> \\<in> r \\<longrightarrow> \\<langle>y, z\\<rangle> \\<in> r \\<longrightarrow> \\<langle>x, z\\<rangle> \\<in> r\"\n    using imp_conj by blast\n  then show ?thesis unfolding trans_def by blast\nqed\n\ntext\\<open>Another workaround for the problem of Isabelle simplifier looping when \n  the transitivity definition is used.\\<close>\n\nlemma Fol1_L3: assumes A1: \"trans(r)\" and A2: \"\\<langle> a,b\\<rangle> \\<in> r  \\<and> \\<langle> b,c\\<rangle> \\<in> r\"\n  shows \"\\<langle> a,c\\<rangle> \\<in> r\"\nproof -\n  from A1 have  \"\\<forall>x y z. \\<langle>x, y\\<rangle> \\<in> r \\<longrightarrow> \\<langle>y, z\\<rangle> \\<in> r \\<longrightarrow> \\<langle>x, z\\<rangle> \\<in> r\"\n   unfolding trans_def by blast\n  with A2 show ?thesis using imp_conj by fast\nqed\n  \ntext\\<open>There is a problem with application of the definition of asymetry for\n  relations. The next lemma is a workaround.\\<close>\n\nlemma Fol1_L4: \n  assumes A1: \"antisym(r)\" and A2: \"\\<langle> a,b\\<rangle> \\<in> r\"   \"\\<langle> b,a\\<rangle> \\<in> r\"  \n  shows \"a=b\"\nproof -\n  from A1 have \"\\<forall> x y. \\<langle> x,y\\<rangle> \\<in> r \\<longrightarrow> \\<langle> y,x\\<rangle> \\<in> r \\<longrightarrow> x=y\"\n    unfolding antisym_def by blast\n  with A2 show \"a=b\" using imp_conj by fast\nqed\n\ntext\\<open>The definition below implements a common idiom that states that \n  (perhaps under some assumptions) exactly one of given three statements \n  is true.\\<close>\n\ndefinition\n  \"Exactly_1_of_3_holds(p,q,r) \\<equiv> \n  (p\\<or>q\\<or>r) \\<and> (p \\<longrightarrow> \\<not>q \\<and> \\<not>r) \\<and> (q \\<longrightarrow> \\<not>p \\<and> \\<not>r) \\<and> (r \\<longrightarrow> \\<not>p \\<and> \\<not>q)\"\n\ntext\\<open>The next lemma allows to prove statements of the form \n  \\<open>Exactly_1_of_3_holds(p,q,r)\\<close>.\\<close>\n\nlemma Fol1_L5:\n  assumes \"p\\<or>q\\<or>r\"\n  and \"p \\<longrightarrow> \\<not>q \\<and> \\<not>r\"\n  and \"q \\<longrightarrow> \\<not>p \\<and> \\<not>r\"\n  and \"r \\<longrightarrow> \\<not>p \\<and> \\<not>q\"\n  shows \"Exactly_1_of_3_holds(p,q,r)\"\nproof -\n  from assms have\n    \"(p\\<or>q\\<or>r) \\<and> (p \\<longrightarrow> \\<not>q \\<and> \\<not>r) \\<and> (q \\<longrightarrow> \\<not>p \\<and> \\<not>r) \\<and> (r \\<longrightarrow> \\<not>p \\<and> \\<not>q)\"\n    by blast\n  then show \"Exactly_1_of_3_holds (p,q,r)\"\n    unfolding Exactly_1_of_3_holds_def by fast\nqed\n\ntext\\<open>If exactly one of $p,q,r$ holds and $p$ is not true, then\n  $q$ or $r$.\\<close>\n\nlemma Fol1_L6: \n  assumes A1: \"\\<not>p\" and A2: \"Exactly_1_of_3_holds(p,q,r)\" \n  shows \"q\\<or>r\"\nproof -\n  from A2 have  \n    \"(p\\<or>q\\<or>r) \\<and> (p \\<longrightarrow> \\<not>q \\<and> \\<not>r) \\<and> (q \\<longrightarrow> \\<not>p \\<and> \\<not>r) \\<and> (r \\<longrightarrow> \\<not>p \\<and> \\<not>q)\"\n    unfolding Exactly_1_of_3_holds_def by fast\n  hence \"p \\<or> q \\<or> r\" by blast\n  with A1 show \"q \\<or> r\" by simp\nqed\n\ntext\\<open>If exactly one of $p,q,r$ holds and $q$ is true, then \n  $r$ can not be true.\\<close>\n\nlemma Fol1_L7:\n  assumes A1: \"q\" and A2: \"Exactly_1_of_3_holds(p,q,r)\"\n  shows \"\\<not>r\"\nproof -\n   from A2 have  \n    \"(p\\<or>q\\<or>r) \\<and> (p \\<longrightarrow> \\<not>q \\<and> \\<not>r) \\<and> (q \\<longrightarrow> \\<not>p \\<and> \\<not>r) \\<and> (r \\<longrightarrow> \\<not>p \\<and> \\<not>q)\"\n    unfolding Exactly_1_of_3_holds_def by fast\n  with A1 show \"\\<not>r\" by blast\nqed\n\ntext\\<open>The next lemma demonstrates an elegant form of the \n  \\<open>Exactly_1_of_3_holds(p,q,r)\\<close> predicate.\\<close>\n\nlemma Fol1_L8: \n  shows \"Exactly_1_of_3_holds(p,q,r) \\<longleftrightarrow> (p\\<longleftrightarrow>q\\<longleftrightarrow>r) \\<and> \\<not>(p\\<and>q\\<and>r)\"\nproof\n  assume \"Exactly_1_of_3_holds(p,q,r)\"\n  then have \n    \"(p\\<or>q\\<or>r) \\<and> (p \\<longrightarrow> \\<not>q \\<and> \\<not>r) \\<and> (q \\<longrightarrow> \\<not>p \\<and> \\<not>r) \\<and> (r \\<longrightarrow> \\<not>p \\<and> \\<not>q)\"\n    unfolding Exactly_1_of_3_holds_def by fast\n  thus \"(p\\<longleftrightarrow>q\\<longleftrightarrow>r) \\<and> \\<not>(p\\<and>q\\<and>r)\" by blast\nnext assume \"(p\\<longleftrightarrow>q\\<longleftrightarrow>r) \\<and> \\<not>(p\\<and>q\\<and>r)\" \n  hence\n    \"(p\\<or>q\\<or>r) \\<and> (p \\<longrightarrow> \\<not>q \\<and> \\<not>r) \\<and> (q \\<longrightarrow> \\<not>p \\<and> \\<not>r) \\<and> (r \\<longrightarrow> \\<not>p \\<and> \\<not>q)\"\n    by auto\n  then show \"Exactly_1_of_3_holds(p,q,r)\"\n    unfolding Exactly_1_of_3_holds_def by fast\nqed\n\ntext\\<open>A property of the \\<open>Exactly_1_of_3_holds\\<close> predicate.\\<close>\n\nlemma Fol1_L8A: assumes A1: \"Exactly_1_of_3_holds(p,q,r)\"\n  shows \"p \\<longleftrightarrow> \\<not>(q \\<or> r)\"\nproof -\n  from A1 have \"(p\\<or>q\\<or>r) \\<and> (p \\<longrightarrow> \\<not>q \\<and> \\<not>r) \\<and> (q \\<longrightarrow> \\<not>p \\<and> \\<not>r) \\<and> (r \\<longrightarrow> \\<not>p \\<and> \\<not>q)\"\n    unfolding Exactly_1_of_3_holds_def by fast\n  then show \"p \\<longleftrightarrow> \\<not>(q \\<or> r)\" by blast\nqed\n\ntext\\<open>Exclusive or definition. There is one also defined in the standard \n  Isabelle, denoted \\<open>xor\\<close>, but it relates to boolean values, \n  which are sets. Here we define a logical functor.\\<close>\n\ndefinition\n  Xor (infixl \"Xor\" 66) where\n  \"p Xor q \\<equiv> (p\\<or>q) \\<and> \\<not>(p \\<and> q)\"\n\ntext\\<open>The \"exclusive or\" is the same as negation of equivalence.\\<close>\n\nlemma Fol1_L9: shows \"p Xor q \\<longleftrightarrow> \\<not>(p\\<longleftrightarrow>q)\"\n  using Xor_def by auto\n\ntext\\<open>Equivalence relations are symmetric.\\<close>\n\nlemma equiv_is_sym: assumes A1: \"equiv(X,r)\" and A2: \"\\<langle>x,y\\<rangle> \\<in> r\"\n  shows  \"\\<langle>y,x\\<rangle> \\<in> r\"\nproof -\n  from A1 have \"sym(r)\" using equiv_def by simp\n  then have \"\\<forall>x y. \\<langle>x,y\\<rangle> \\<in> r \\<longrightarrow> \\<langle>y,x\\<rangle> \\<in> r\"\n    unfolding sym_def by fast\n  with A2 show \"\\<langle>y,x\\<rangle> \\<in> r\" by blast\nqed\n\n(* In Isabelle/ZF conjunction associates to the right!.\nlemma test: assumes A1: \"P\" \"Q\\<and>R\"\n  shows \"P\\<and>Q\\<and>R\"\nproof - \n  from A1 show \"P\\<and>Q\\<and>R\" by (rule one_more_conj);\nqed;\n\n*)\nend\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/Fol1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.6723317057447908, "lm_q1q2_score": 0.3414180169082797}}
{"text": "theory Proof_5_13\n  imports Proofs_5\nbegin\n\nabbreviation s where \"s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value \\<equiv>\n (toEnv\n   (setPstate\n     (setVarBool\n       (setVarBool\n         (setVarBool (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value)\n           up' DOWN')\n         moving' DOWN')\n       direction'\n       (getVarBool\n         (setVarBool\n           (setVarBool (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value)\n             up' DOWN')\n           moving' DOWN')\n         directionSwitch'))\n     ERROR Ctrl'motionless))\"\n\ntheorem proof_5_13: \"VC13 inv5 env s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\"\n  apply(simp only: VC13_def inv5_def R5_def extraInv_def)\n  apply(rule impI)\n  apply(rule conjI)\n   apply(rule conjI)\n    apply simp\n   apply((rule allI)+)\n   apply(rule impI)\n   apply((drule conjE)+)\n                      prefer 33\n                      apply assumption\n                      prefer 32\n                      apply assumption\n                      prefer 31\n                      apply assumption\n                     prefer 30\n                      apply assumption\n                      prefer 29\n                      apply assumption\n                      prefer 28\n                      apply assumption\n                      prefer 27\n                      apply assumption\n                      prefer 26\n                      apply assumption\n                      prefer 25\n                      apply assumption\n                      prefer 24\n                      apply assumption\n                      prefer 23\n                      apply assumption\n                      prefer 22\n                      apply assumption\n                      prefer 21\n                      apply assumption\n                      prefer 20\n                      apply assumption\n                     prefer 19\n                     apply assumption\n                    prefer 18\n                    apply assumption\n                   prefer 17\n                   apply assumption\n                  prefer 16\n                  apply assumption\n                 prefer 15\n                 apply assumption\n                prefer 14\n                apply assumption\n               prefer 13\n               apply assumption\n              prefer 12\n              apply assumption\n             prefer 11\n             apply assumption\n            prefer 10\n            apply assumption\n           prefer 9\n           apply assumption\n          prefer 8\n          apply assumption\n         prefer 7\n         apply assumption\n        prefer 6\n        apply assumption\n       prefer 5\n       apply assumption\n      prefer 4\n      apply assumption\n     prefer 3\n     apply assumption\n    prefer 2\n    apply assumption\n  subgoal premises prems for s1 s2\n    apply(rule disjE[OF le_imp_less_or_eq[OF prems(12)]])\n apply(rule cut_rl[of \" \\<exists>s4. toEnvP s4 \\<and>\n         substate s2 s4 \\<and>\n         substate s4  s0 \\<and>\n         toEnvNum s2 s4 \\<le> ERROR \\<and>\n         getVarBool s4 up' = DOWN' \\<and>\n         getVarBool s4 down' = DOWN' \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow> getVarBool s3 up' = UP' \\<or> getVarBool s3 down' = UP')\"])\n      apply(drule exE)\n       prefer 2\n       apply assumption\n    subgoal for s4\n      apply(rule exI[of _ s4])\n      by simp\n    using prems(2) prems(4) prems(6) prems(8) prems(10) prems(16) prems(13) prems(14) apply -[1]\n     apply(drule allE[of _ s1])\n      prefer 2\n      apply assumption\n     apply(drule allE[of _ s2])\n      prefer 2\n      apply assumption\n     apply(simp split: if_splits)\n    apply(rule cut_rl[of \"\\<forall> s5. toEnvP s5 \\<and> substate s2 s5 \\<and> substate s5\n (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \\<longrightarrow>\n pred5 s1 s2\n (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) s5\"])\n     apply(drule allE[of _ s2])\n      prefer 2\n      apply assumption\n     apply(drule impE)\n       prefer 3\n       apply assumption\n    using prems(4,8) substate_refl apply fast\n     apply(simp only: pred5_def)\n     apply(drule impE)\n       prefer 3\n       apply assumption\n    using prems(2)  prems(4) prems(6) prems(8) prems(10) prems(13) prems(14) substate_refl substate_trans substate_antisym\n      apply blast\n     apply fast\n      apply(rule allI)\n    subgoal premises toEnvNums2s for s5\n      apply(induction rule: state_down_ind)\n      using prems(8) apply simp\n      apply(simp only: pred5_def)\n       apply(rule impI)\n       apply((drule conjE)+)\n                  prefer 12\n                  apply assumption\n                 prefer 11\n                 apply assumption\n                prefer 10\n                apply assumption\n               prefer 9\n               apply assumption\n              prefer 8\n              apply assumption\n             prefer 7\n             apply assumption\n            prefer 6\n            apply assumption\n           prefer 5\n           apply assumption\n          prefer 4\n          apply assumption\n         prefer 3\n         apply assumption\n        prefer 2\n        apply assumption\n\n       apply(rule exI[of _ \"s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\"])\n       apply(rule conjI)\n        apply simp\n       apply(rule conjI)\n        apply simp\n       apply(rule conjI)\n        apply simp\n       apply(rule conjI)\n        apply simp\n       apply(rule conjI)\n        apply simp\n       apply(rule conjI)\n      using prems(9) apply(simp split: if_splits)\n      using prems\n        apply (metis substate_refl)\n      using substate_trans substate_antisym apply blast\n\n\n      subgoal for s5\n        apply(simp only: pred5_def)\n        apply(rule impI)\n        apply(cases \"getVarBool (predEnv s5) up' = False  \\<and> getVarBool (predEnv s5) down' = False\")\n       apply(rule exI[of _ \"predEnv s5\"])\n       apply(rule conjI)\n        apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n        apply blast\n       apply(rule conjI)\n      using substate_refl apply simp\n       apply(rule conjI)\n      using predEnv_substate substate_trans apply blast\n       apply(rule conjI)\n      using toEnvNum3[of s2 \"predEnv s5\"\n \"(s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \"]\n        apply force\n       apply(rule conjI)\n        apply fast\n       apply(rule conjI)\n        apply fast\n      using substate_antisym apply fast\n      apply(drule impE)\n        apply(((rule conjI),blast)+)\n      using substate_eq_or_predEnv apply blast\n      prefer 2\n       apply assumption\n      apply(drule exE)\n       prefer 2\n       apply assumption\n      subgoal for s4\n        apply(rule exI[of _ s4])\n       apply(rule conjI)\n         apply blast\n        apply(rule conjI)\n        using predEnv_substate substate_trans apply blast\n        apply(((rule conjI),blast)+)\n        apply((drule conjE)+)\n                          prefer 20\n                           apply assumption\n                          prefer 19\n                          apply assumption\n                         prefer 18\n                         apply assumption\n                        prefer 17\n                        apply assumption\n                       prefer 16\n                       apply assumption\n                      prefer 15\n                      apply assumption\n                     prefer 14\n                     apply assumption\n                    prefer 13\n                    apply assumption\n                   prefer 12\n                   apply assumption\n                  prefer 11\n                  apply assumption\n                 prefer 10\n                 apply assumption\n                prefer 9\n                apply assumption\n               prefer 8\n               apply assumption\n              prefer 7\n              apply assumption\n             prefer 6\n             apply assumption\n            prefer 5\n            apply assumption\n           prefer 4\n           apply assumption\n          prefer 3\n          apply assumption\n         prefer 2\n         apply assumption\n        using predEnv_substate_imp_eq_or_substate by blast\n      done\n    done\n  done", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/escalator/Proof_5_13.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3414180135742385}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005 (modified)    |\n            |                 August 2005 (modified)    |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_mono\nimports CSP_F_domain CSP_T.CSP_T_mono\nbegin\n\n(*****************************************************************\n\n         1. mono check of failuresfun\n         2. \n         3. \n         4. \n\n *****************************************************************)\n\n(*--------------------------------*\n |        STOP,SKIP,DIV           |\n *--------------------------------*)\n\nlemma mono_failures_STOP: \"mono (failures (STOP))\"\nby (simp add: mono_def failures_iff)\n\nlemma mono_failures_SKIP: \"mono (failures (SKIP))\"\nby (simp add: mono_def failures_iff)\n\nlemma mono_failures_DIV: \"mono (failures (DIV))\"\nby (simp add: mono_def failures_iff)\n\n(*--------------------------------*\n |          Act_prefix            |\n *--------------------------------*)\n\nlemma mono_failures_Act_prefix:\n \"mono (failures P) ==> mono (failures (a -> P))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (simp)\napply (rule)\napply (simp add: in_failures)\napply (auto)\ndone\n\n(*--------------------------------*\n |        Ext_pre_choice          |\n *--------------------------------*)\n\nlemma mono_failures_Ext_pre_choice:\n \"ALL a. mono (failures (Pf a))\n  ==> mono (failures (? a:X -> (Pf a)))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (erule disjE, simp)\napply (rule disjI2)\napply (elim conjE exE)\napply (drule_tac x=\"a\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (auto)\ndone\n\n(*--------------------------------*\n |          Ext_choice            |\n *--------------------------------*)\n\nlemma mono_failures_Ext_choice:\n \"[| mono (traces P) ; mono (traces Q) ;\n     mono (failures P) ; mono (failures Q) |]\n  ==> mono (failures (P [+] Q))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"(fstF o x)\" in spec)\napply (drule_tac x=\"(fstF o x)\" in spec)\napply (drule_tac x=\"(fstF o y)\" in spec)\napply (drule_tac x=\"(fstF o y)\" in spec)\napply (simp add: order_prod_def mono_fstF[simplified mono_def])\napply (elim conjE disjE)\napply (force)+\ndone\n\n(*--------------------------------*\n |          Int_choice            |\n *--------------------------------*)\n\nlemma mono_failures_Int_choice:\n \"[| mono (failures P) ; mono (failures Q) |]\n  ==> mono (failures (P |~| Q))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim disjE)\napply (force)\napply (force)\ndone\n\n(*--------------------------------*\n |        Rep_int_choice          |\n *--------------------------------*)\n\nlemma mono_failures_Rep_int_choice:\n \"ALL c. mono (failures (Pf c))\n  ==> mono (failures (!! c:C .. (Pf c)))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim conjE bexE)\napply (drule_tac x=\"c\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (auto)\ndone\n\n(*--------------------------------*\n |              IF                |\n *--------------------------------*)\n\nlemma mono_failures_IF:\n \"[| mono (failures P) ; mono (failures Q) |]\n  ==> mono (failures (IF b THEN P ELSE Q))\"\napply (simp add: mono_def)\napply (auto simp add: in_failures subsetF_iff)\ndone\n\n(*--------------------------------*\n |           Parallel             |\n *--------------------------------*)\n\nlemma mono_failures_Parallel:\n \"[| mono (failures P) ; mono (failures Q) |]\n  ==> mono (failures (P |[X]| Q))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim conjE exE)\napply (rule_tac x=\"Y\" in exI)\napply (rule_tac x=\"Z\" in exI)\napply (simp)\napply (rule_tac x=\"sa\" in exI)\napply (rule_tac x=\"t\" in exI)\napply (auto simp add: subsetF_iff)\ndone\n\n(*--------------------------------*\n |            Hiding              |\n *--------------------------------*)\n\nlemma mono_failures_Hiding:\n \"mono (failures P)\n  ==> mono (failures (P -- X))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI)\napply (auto simp add: subsetF_iff)\ndone\n\n(*--------------------------------*\n |           Renaming             |\n *--------------------------------*)\n\nlemma mono_failures_Renaming:\n \"mono (failures P)\n  ==> mono (failures (P [[r]]))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI)\napply (auto simp add: subsetF_iff)\ndone\n\n(*--------------------------------*\n |           Seq_compo            |\n *--------------------------------*)\n\nlemma mono_failures_Seq_compo:\n \"[| mono (failures P) ; mono (failures Q) |]\n  ==> mono (failures (P ;; Q))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\n\napply (erule disjE)\napply (simp add: subsetF_iff)\napply (elim conjE exE)\napply (rule disjI2)\napply (rule_tac x=\"sa\" in exI)\napply (rule_tac x=\"t\" in exI)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (simp)\n\napply (subgoal_tac \"traces P (fstF o x) <= traces P (fstF o y)\")\napply (force)\napply (subgoal_tac \"fstF o x <= fstF o y\")\napply (simp add: mono_traces[simplified mono_def])\napply (simp add: order_prod_def)\napply (rule allI)\napply (drule_tac x=\"xa\" in spec)\napply (simp add: mono_fstF[simplified mono_def])\ndone\n\n(*--------------------------------*\n |          Depth_rest            |\n *--------------------------------*)\n\nlemma mono_failures_Depth_rest:\n \"mono (failures P)\n  ==> mono (failures (P |. n))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (elim conjE exE disjE)\napply (force)\napply (force)\ndone\n\n(*--------------------------------*\n |            variable            |\n *--------------------------------*)\n\nlemma mono_failures_variable: \n   \"mono (failures ($p))\"\napply (simp add: mono_def)\napply (intro allI impI)\napply (rule)\napply (simp add: in_failures)\napply (simp add: order_prod_def)\napply (drule_tac x=\"p\" in spec)\napply (insert mono_sndF)\napply (simp add: mono_def)\napply (drule_tac x=\"x p\" in spec)\napply (drule_tac x=\"y p\" in spec)\napply (simp add: subsetF_iff order_prod_def)\ndone\n\n(*--------------------------------*\n |            Procfun             |\n *--------------------------------*)\n\nlemma mono_failures: \"mono (failures P)\"\napply (induct_tac P)\napply (simp add: mono_failures_STOP)\napply (simp add: mono_failures_SKIP)\napply (simp add: mono_failures_DIV)\napply (simp add: mono_failures_Act_prefix)\napply (simp add: mono_failures_Ext_pre_choice)\napply (simp add: mono_failures_Ext_choice mono_traces)\napply (simp add: mono_failures_Int_choice)\napply (simp add: mono_failures_Rep_int_choice)\napply (simp add: mono_failures_IF)\napply (simp add: mono_failures_Parallel)\napply (simp add: mono_failures_Hiding)\napply (simp add: mono_failures_Renaming)\napply (simp add: mono_failures_Seq_compo mono_traces)\napply (simp add: mono_failures_Depth_rest)\napply (simp add: mono_failures_variable)\ndone\n\n(*=============================================================*\n |                         [[P]]Ff                             |\n *=============================================================*)\n\nlemma mono_semFf: \"mono [[Pf]]Ff\"\napply (simp add: mono_def)\napply (simp add: subdomF_decompo)\napply (intro allI impI)\n\napply (simp add: mono_failures[simplified mono_def])\n\napply (subgoal_tac \"mono (traces Pf)\")\napply (simp add: mono_def)\napply (drule_tac x=\"fstF o x\" in spec)\napply (drule_tac x=\"fstF o y\" in spec)\napply (drule mp)\n\n apply (simp add: order_prod_def)\n apply (simp add: mono_fstF[simplified mono_def])\n apply (simp)\n\napply (simp add: mono_traces)\ndone\n\n(*=============================================================*\n |                         [[P]]Ffun                           |\n *=============================================================*)\n\nlemma mono_semFfun: \"mono [[PF]]Ffun\"\napply (simp add: prod_mono)\napply (simp add: semFfun_def)\napply (simp add: comp_def)\napply (simp add: proj_fun_def)\napply (simp add: mono_semFf)\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_mono.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6334102775181399, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.34139751139340685}}
{"text": "(*  Title:      statecharts/HA/HAOps.thy\n    Author:     Steffen Helke, Software Engineering Group\n    Copyright   2010 Technische Universitaet Berlin\n*)\n\nsection \\<open>Constructing Hierarchical Automata\\<close>\ntheory HAOps\nimports HA\nbegin\n\nsubsection \"Constructing a Composition Function for a PseudoHA\"\n\ndefinition\n  EmptyMap :: \"'s set => ('s \\<rightharpoonup> (('s,'e,'d)seqauto) set)\" where\n  \"EmptyMap S = (\\<lambda> a . if a \\<in> S then Some {} else None)\"\n\nlemma EmptyMap_dom [simp]:\n  \"dom (EmptyMap S) = S\"\nby (unfold dom_def EmptyMap_def,auto)\n\nlemma EmptyMap_ran [simp]:\n   \"S \\<noteq> {} \\<Longrightarrow> ran (EmptyMap S) = {{}}\"\nby (unfold ran_def EmptyMap_def, auto)\n\nlemma EmptyMap_the [simp]:\n   \"x \\<in> S \\<Longrightarrow> the ((EmptyMap S) x) = {}\"\nby (unfold ran_def EmptyMap_def, auto)\n\nlemma EmptyMap_ran_override:\n  \"\\<lbrakk> S \\<noteq> {}; (S \\<inter> (dom G)) = {} \\<rbrakk> \\<Longrightarrow>  \n  ran (G ++ EmptyMap S) = insert {} (ran G)\"\napply (subst ran_override)\napply (simp add: Int_commute)\napply simp\ndone\n\nlemma EmptyMap_Union_ran_override:\n \"\\<lbrakk> S \\<noteq> {};  \n    S \\<inter> dom G = {} \\<rbrakk> \\<Longrightarrow>  \n  (Union (ran (G ++ (EmptyMap S)))) = (Union (ran G))\"\napply (subst EmptyMap_ran_override)\napply auto\ndone\n\nlemma EmptyMap_Union_ran_override2:\n \"\\<lbrakk> S \\<noteq> {}; S \\<inter> dom G1 = {}; \n    dom G1 \\<inter> dom G2 = {} \\<rbrakk> \\<Longrightarrow> \n   \\<Union> (ran (G1 ++ EmptyMap S ++ G2)) = (\\<Union> (ran G1 \\<union> ran G2))\"\napply (unfold Union_eq UNION_eq EmptyMap_def Int_def ran_def)\napply (simp add: map_add_Some_iff)\napply (unfold dom_def)\napply simp\napply (rule equalityI)\napply (rule subsetI)\napply simp\napply fast\napply (rule subsetI)\napply (rename_tac t)\napply simp\napply (erule bexE)\napply (rename_tac U)\napply simp\napply (erule disjE)\napply (erule exE)\napply (rename_tac v)\napply (rule_tac x=U in exI)\napply simp\napply (rule_tac x=v in exI)\napply auto\ndone\n\nlemma EmptyMap_Root [simp]:\n \"Root {SA} (EmptyMap (States SA)) = SA\"\nby (unfold Root_def, auto)\n\nlemma EmptyMap_RootEx [simp]:\n  \"RootEx {SA} (EmptyMap (States SA))\"\nby (unfold RootEx_def, auto)\n\nlemma EmptyMap_OneAncestor [simp]:\n \"OneAncestor {SA} (EmptyMap (States SA))\"\nby (unfold OneAncestor_def, auto)\n\nlemma EmptyMap_NoCycles [simp]:\n  \"NoCycles {SA} (EmptyMap (States SA))\"\nby (unfold NoCycles_def EmptyMap_def , auto)\n\nlemma EmptyMap_IsCompFun [simp]:\n \"IsCompFun {SA} (EmptyMap (States SA))\"\nby (unfold IsCompFun_def, auto)\n\nlemma EmptyMap_hierauto [simp]:\n \"(D,{SA}, SAEvents SA, EmptyMap (States SA)) \\<in> hierauto\"\nby (unfold hierauto_def HierAuto_def, auto)\n\nsubsection \"Extending a Composition Function by a SA\"\n\ndefinition\n  FAddSA :: \"[('s \\<rightharpoonup> (('s,'e,'d)seqauto) set), 's * ('s,'e,'d)seqauto]\n             => ('s \\<rightharpoonup> (('s,'e,'d)seqauto) set)\"\n           (\"(_ [f+]/ _)\" [10,11]10) where\n  \"FAddSA G SSA = (let  (S,SA) = SSA\n                   in\n                     (if ((S \\<in> dom G) \\<and> (S \\<notin> States SA)) then\n                        (G ++ (Map.empty(S \\<mapsto> (insert SA (the (G S)))))\n                         ++ EmptyMap (States SA))\n                      else G))\"\n\nlemma FAddSA_dom [simp]:\n \"(S \\<notin> (dom (A::('a => ('a,'c,'d)seqauto set option)))) \\<Longrightarrow>\n   ((A [f+] (S,(SA::('a,'c,'d)seqauto))) = A)\"\nby (unfold FAddSA_def Let_def, auto)\n\nlemma FAddSA_States [simp]:\n \"(S \\<in> (States (SA::('a,'c,'d)seqauto))) \\<Longrightarrow>\n   (((A::('a => ('a,'c,'d)seqauto set option)) [f+] (S,SA)) = A)\"\nby (unfold FAddSA_def Let_def, auto)\n\nlemma FAddSA_dom_insert [simp]:\n \"\\<lbrakk> S \\<in> (dom A); S \\<notin>  States SA \\<rbrakk> \\<Longrightarrow> \n   (((A [f+] (S,SA)) S) = Some (insert SA (the (A S))))\"\nby (unfold FAddSA_def Let_def restrict_def, auto)\n\nlemma FAddSA_States_neq [simp]:\n \"\\<lbrakk> S' \\<notin> States (SA::('a,'c,'d)seqauto); S \\<noteq>  S' \\<rbrakk> \\<Longrightarrow> \n  ((((A::('a => ('a,'c,'d)seqauto set option)) [f+] (S,SA)) S') = (A S'))\"\napply (case_tac \"S \\<in> dom A\")\napply (case_tac \"S \\<in> States SA\")\napply auto\napply (case_tac \"S' \\<in> dom A\")\napply (unfold FAddSA_def Let_def)\napply auto\napply (simp add: dom_None)\ndone\n\nlemma FAddSA_dom_emptyset [simp]:\n \"\\<lbrakk> S \\<in> (dom A); S \\<notin> States SA; S' \\<in> States (SA::('a,'c,'d)seqauto) \\<rbrakk> \\<Longrightarrow>  \n    ((((A::('a => ('a,'c,'d)seqauto set option))) [f+] (S,SA)) S') = (Some {})\"\napply (unfold FAddSA_def Let_def)\napply auto\napply (unfold EmptyMap_def)\napply auto\ndone\n\nlemma FAddSA_dom_dom_States [simp]:\n  \"\\<lbrakk> S \\<in> (dom F); S \\<notin> States SA \\<rbrakk> \\<Longrightarrow> \n    (dom ((F::('a \\<rightharpoonup> (('a,'b,'d)seqauto) set)) [f+] (S, SA))) = \n    ((dom F) \\<union> (States (SA::('a,'b,'d)seqauto)))\"\nby (unfold FAddSA_def Let_def, auto)\n\nlemma FAddSA_dom_dom [simp]:\n  \"S \\<notin> (dom F) \\<Longrightarrow>   \n   (dom ((F::('a \\<rightharpoonup> (('a,'b,'d)seqauto) set)) [f+] \n       (S,(SA::('a,'b,'d)seqauto)))) = (dom F)\"\nby (unfold FAddSA_def Let_def, auto)\n\nlemma FAddSA_States_dom [simp]:\n  \"S \\<in> (States SA) \\<Longrightarrow>  \n   (dom ((F::('a \\<rightharpoonup> (('a,'b,'d)seqauto) set)) [f+] \n        (S,(SA::('a,'b,'d)seqauto)))) = (dom F)\"\nby (unfold FAddSA_def Let_def, auto)\n\nlemma FAddSA_dom_insert_dom_disjunct [simp]:\n   \"\\<lbrakk> S \\<in> dom G; States SA \\<inter> dom G = {} \\<rbrakk> \\<Longrightarrow> ((G [f+] (S,SA)) S) = Some (insert SA (the (G S)))\"\napply (rule  FAddSA_dom_insert)\napply auto\ndone\n\nlemma FAddSA_Union_ran:\n \"\\<lbrakk> S \\<in> dom G; (States SA) \\<inter> (dom G) = {} \\<rbrakk> \\<Longrightarrow> \n   (\\<Union> (ran (G [f+] (S,SA)))) = (insert SA (\\<Union> (ran G)))\"\napply (unfold FAddSA_def Let_def)\napply simp\napply (rule conjI)\nprefer 2\napply (rule impI)\napply (unfold Int_def)\napply simp\napply (fold Int_def)\napply (rule impI)\napply (subst EmptyMap_Union_ran_override)\napply auto\ndone\n\nlemma FAddSA_Union_ran2:\n \"\\<lbrakk> S \\<in> dom G1; (States SA) \\<inter> (dom G1) = {}; (dom G1 \\<inter> dom G2) = {} \\<rbrakk> \\<Longrightarrow>\n   (\\<Union> (ran ((G1 [f+] (S,SA)) ++ G2))) = (insert SA (\\<Union> ((ran G1) \\<union> (ran G2))))\"\napply (unfold FAddSA_def Let_def)\napply (simp (no_asm_simp))\napply (rule conjI)\napply (rule impI)\napply (subst EmptyMap_Union_ran_override2)\napply simp\napply simp\napply simp\napply fast\napply (subst Union_Un_distrib)\napply (subst Union_ran_override2)\napply auto\ndone\n\nlemma FAddSA_ran:\n  \"\\<lbrakk> \\<forall> T \\<in> dom G . T \\<noteq> S \\<longrightarrow> (the (G T) \\<inter> the (G S)) = {};  \n     S \\<in> dom G; (States SA) \\<inter>  (dom G) = {} \\<rbrakk> \\<Longrightarrow>  \n    ran (G [f+] (S,SA)) = insert {} (insert (insert SA (the (G S))) (ran G - {the (G S)}))\"\napply (unfold FAddSA_def Let_def)\napply simp\napply (rule conjI)\napply (rule impI)+\nprefer 2\napply fast\napply (simp add: EmptyMap_ran_override)\napply (unfold ran_def)\napply auto\napply (rename_tac Y X a xa xb)\napply (erule_tac x=a in allE)\napply simp\napply (erule_tac x=a in allE)\napply simp\ndone\n\nlemma FAddSA_RootEx_def: \n  \"\\<lbrakk> S \\<in> dom G; (States SA) \\<inter> (dom G) = {} \\<rbrakk> \\<Longrightarrow> \n    RootEx F (G [f+] (S,SA)) = (\\<exists>! A . A \\<in> F \\<and> A \\<notin> insert SA (\\<Union> (ran G)))\"\napply (unfold RootEx_def)\napply (simp only: FAddSA_Union_ran Int_commute)\ndone\n\nlemma FAddSA_RootEx:\n  \"\\<lbrakk> \\<Union> (ran G) = F - {Root F G}; \n     dom G = \\<Union>(States ` F); \n     (dom G \\<inter> States SA) = {}; S \\<in> dom G; \n     RootEx F G \\<rbrakk> \\<Longrightarrow> RootEx (insert SA F) (G [f+] (S,SA))\"\napply (simp add: FAddSA_RootEx_def Int_commute cong: rev_conj_cong)\napply (auto cong: conj_cong) \ndone\n\nlemma FAddSA_Root_def:\n  \"\\<lbrakk> S \\<in> dom G; (States SA) \\<inter> (dom G) = {} \\<rbrakk>  \\<Longrightarrow> \n   (Root F (G [f+] (S,SA)) = (@ A . A \\<in> F \\<and> A \\<notin> insert SA (\\<Union> (ran G))))\" \napply (unfold Root_def)\napply (simp only: FAddSA_Union_ran Int_commute)\ndone\n\nlemma FAddSA_RootEx_Root: \n  \"\\<lbrakk> Union (ran G) = F - {Root F G};  \n     \\<Union>(States ` F) = dom G; \n     (dom G \\<inter> States SA) = {}; S \\<in> dom G;\n     RootEx F G \\<rbrakk> \\<Longrightarrow> (Root (insert SA F) (G [f+] (S,SA))) = (Root F G)\"\napply (simp add: FAddSA_Root_def Int_commute cong: rev_conj_cong)\napply (simp cong:conj_cong)\ndone\n\nlemma FAddSA_OneAncestor:\n  \"\\<lbrakk> \\<Union> (ran G) = F - {Root F G}; \n     (dom G \\<inter> States SA) = {}; S \\<in> dom G; \n     \\<Union>(States ` F) = dom G; RootEx F G;\n     OneAncestor F G \\<rbrakk> \\<Longrightarrow> OneAncestor (insert SA F) (G [f+] (S,SA))\"\napply (subst OneAncestor_def)\napply simp\napply (rule ballI)\napply (rename_tac SAA)\napply (case_tac \"SA = SAA\")\napply (rule_tac a=S in ex1I)\napply (rule conjI)\napply simp\napply fast\napply (subst FAddSA_dom_insert)\napply simp\napply (simp add:Int_def)\napply simp\napply (rename_tac T)\napply (erule conjE bexE exE disjE)+\napply (rename_tac SAAA)\napply simp\napply (erule conjE)\napply (subst not_not [THEN sym])\napply (rule notI)\napply (case_tac \"T \\<in> States SAA\")\napply blast\napply (drule_tac A=G and S=S and SA=SAA in FAddSA_States_neq)\napply fast\napply simp\napply (case_tac \"SAA \\<notin> Union (ran G)\")\napply (frule ran_dom_the)\nprefer 2\napply fast\napply blast\napply simp\napply (erule conjE)\napply (simp add: States_Int_not_mem)\napply (unfold OneAncestor_def)\napply (drule_tac G=G and S=S and SA=SA in FAddSA_RootEx_Root)\napply simp\napply simp\napply simp\napply simp\napply (erule_tac x=SAA in ballE)\nprefer 2\napply simp\napply simp\napply (erule conjE bexE ex1E exE disjE)+\napply (rename_tac T SAAA)\napply (rule_tac a=T in ex1I)\napply (rule conjI)\napply fast\napply (case_tac \"T = S\")\napply simp\napply (case_tac \"S \\<notin> States SA\")\napply simp\napply simp\napply (subst FAddSA_States_neq)\napply blast\napply (rule not_sym)\napply simp\napply simp\napply (rename_tac U)\napply simp\napply (erule conjE bexE)+\napply (rename_tac SAAAA)\napply simp\napply (erule conjE disjE)+\napply (frule FAddSA_dom_emptyset)\nprefer 2\napply fast\nback\nback\napply simp\napply blast\napply simp\napply (erule_tac x=U in allE)\napply (erule impE)\nprefer 2\napply simp\napply (rule conjI)\napply fast\napply (case_tac \"S \\<noteq> U\")\napply (subgoal_tac \"U \\<notin> States SA\")\napply (drule_tac A=G in FAddSA_States_neq)\napply fast\napply simp\napply blast\napply (drule_tac A=G and SA=SA in FAddSA_dom_insert)\napply simp\napply blast\napply auto\ndone\n\n\n\nlemma FAddSA_IsCompFun:\n \"\\<lbrakk> (States SA \\<inter> (\\<Union>(States ` F))) = {};\n     S \\<in> (\\<Union>(States ` F)); \n     IsCompFun F G \\<rbrakk> \\<Longrightarrow>  IsCompFun (insert SA F) (G [f+] (S,SA))\"\napply (unfold IsCompFun_def)\napply (erule conjE)+\napply (simp add: Int_commute FAddSA_RootEx_Root FAddSA_RootEx FAddSA_OneAncestor FAddSA_NoCycles)\napply (rule conjI)\napply (subst FAddSA_dom_dom_States)\napply simp\napply blast\napply (simp add: Un_commute)\napply (simp add: FAddSA_Union_ran)\napply (case_tac \"SA = Root F G\")\nprefer 2\napply blast\napply (subgoal_tac \"States (Root F G) \\<subseteq>  \\<Union>(States ` F)\")\napply simp\napply (frule subset_lemma)\napply auto\ndone\n\nlemma FAddSA_HierAuto:\n  \"\\<lbrakk> (States SA \\<inter> (\\<Union>(States ` F))) = {};\n      S \\<in> (\\<Union>(States ` F)); \n      HierAuto D F E G \\<rbrakk> \\<Longrightarrow> HierAuto D (insert SA F) (E \\<union> SAEvents SA) (G [f+] (S,SA))\"\napply (unfold HierAuto_def)\napply auto\napply (simp add: MutuallyDistinct_Insert)\napply (rule FAddSA_IsCompFun)\napply auto\ndone\n\nlemma FAddSA_HierAuto_insert [simp]:\n  \"\\<lbrakk> (States SA \\<inter> HAStates HA) = {};\n      S \\<in> HAStates HA \\<rbrakk> \\<Longrightarrow> \n    HierAuto (HAInitValue HA)                  \n             (insert SA (SAs HA))              \n             (HAEvents HA \\<union> SAEvents SA)      \n             (CompFun HA [f+] (S,SA))\"\napply (unfold HAStates_def)\napply (rule FAddSA_HierAuto)\napply auto\ndone\n\nsubsection \"Constructing a PseudoHA\" \n\ndefinition\n  PseudoHA :: \"[('s,'e,'d)seqauto,'d data] => ('s,'e,'d)hierauto\" where\n  \"PseudoHA SA D = Abs_hierauto(D,{SA}, SAEvents SA ,EmptyMap (States SA))\"\n\nlemma PseudoHA_SAs [simp]:\n  \"SAs (PseudoHA SA D) = {SA}\"\nby (unfold PseudoHA_def SAs_def, simp add: Abs_hierauto_inverse)\n\nlemma PseudoHA_Events [simp]:\n  \"HAEvents (PseudoHA SA D) = SAEvents SA\"\nby (unfold PseudoHA_def HAEvents_def, simp add: Abs_hierauto_inverse)\n \nlemma PseudoHA_CompFun [simp]:\n  \"CompFun (PseudoHA SA D) = EmptyMap (States SA)\"\nby (unfold PseudoHA_def CompFun_def, simp add: Abs_hierauto_inverse)\n\n\n\nlemma PseudoHA_HAInitValue [simp]:\n  \"(HAInitValue (PseudoHA SA D)) = D\"\nby (unfold PseudoHA_def Let_def HAInitValue_def, simp add: Abs_hierauto_inverse)\n \nlemma PseudoHA_CompFun_the [simp]: \n \"S \\<in> States A \\<Longrightarrow> (the (CompFun (PseudoHA A D) S)) = {}\"\nby simp\n\nlemma PseudoHA_CompFun_ran [simp]:\n \"(ran (CompFun (PseudoHA SA D))) = {{}}\"\nby auto\n\nlemma PseudoHA_HARoot [simp]:\n \"(HARoot (PseudoHA SA D)) = SA\"\nby (unfold HARoot_def, auto)\n\nlemma PseudoHA_HAInitState [simp]:\n  \"HAInitState (PseudoHA A D) = InitState A\"\napply (unfold HAInitState_def)\napply simp\ndone\n\nlemma PseudoHA_HAInitStates [simp]:\n  \"HAInitStates (PseudoHA A D) = {InitState A}\" \napply (unfold HAInitStates_def)\napply simp\ndone\n\nlemma PseudoHA_Chi [simp]:\n  \"S \\<in> States A \\<Longrightarrow> Chi (PseudoHA A D) S = {}\"\napply (unfold Chi_def restrict_def)\napply auto\ndone\n\nlemma PseudoHA_ChiRel [simp]:\n  \"ChiRel (PseudoHA A D) = {}\"\napply (unfold ChiRel_def)\napply simp\ndone\n\nlemma PseudoHA_InitConf [simp]:\n \"InitConf (PseudoHA A D) = {InitState A}\"\napply (unfold InitConf_def)\napply simp\ndone\n\nsubsection \\<open>Extending a HA by a SA (\\<open>AddSA\\<close>)\\<close>\n\ndefinition\n  AddSA :: \"[('s,'e,'d)hierauto, 's * ('s,'e,'d)seqauto]\n             => ('s,'e,'d)hierauto\"\n           (\"(_ [++]/ _)\" [10,11]10) where\n  \"AddSA HA SSA = (let (S,SA) = SSA;\n                        DNew = HAInitValue HA;\n                        FNew = insert SA (SAs HA);\n                        ENew  = HAEvents HA \\<union> SAEvents SA;\n                        GNew  = CompFun HA [f+] (S,SA)\n                   in\n                       Abs_hierauto(DNew,FNew,ENew,GNew))\"\n\ndefinition\n  AddHA :: \"[('s,'e,'d)hierauto, 's * ('s,'e,'d)hierauto]\n             => ('s,'e,'d)hierauto\"\n           (\"(_ [**]/ _)\" [10,11]10) where\n  \"AddHA HA1 SHA =\n            (let (S,HA2)     = SHA;\n                 (D1,F1,E1,G1) = Rep_hierauto (HA1 [++] (S,HARoot HA2));\n                 (D2,F2,E2,G2) = Rep_hierauto HA2;\n                 FNew       = F1 \\<union> F2;\n                 ENew       = E1 \\<union> E2;\n                 GNew       = G1 ++ G2\n             in\n                 Abs_hierauto(D1,FNew,ENew,GNew))\"\n\nlemma AddSA_SAs:\n  \"\\<lbrakk> (States SA \\<inter>  HAStates HA) = {}; \n      S \\<in> HAStates HA \\<rbrakk> \\<Longrightarrow> (SAs (HA [++] (S,SA))) = insert SA (SAs HA)\"\napply (unfold Let_def AddSA_def)\napply (subst SAs_def)\napply (simp add: hierauto_def Abs_hierauto_inverse)\ndone\n\nlemma AddSA_Events:\n  \"\\<lbrakk> (States SA \\<inter> HAStates HA) = {}; \n      S \\<in> HAStates HA \\<rbrakk> \\<Longrightarrow>\n     HAEvents (HA [++] (S,SA)) = (HAEvents HA) \\<union> (SAEvents SA)\"\napply (unfold Let_def AddSA_def)\napply (subst HAEvents_def)\napply (simp add: hierauto_def Abs_hierauto_inverse)\ndone\n\nlemma AddSA_CompFun:\n   \"\\<lbrakk> (States SA \\<inter>  HAStates HA) = {}; \n      S \\<in> HAStates HA \\<rbrakk> \\<Longrightarrow>  \n     CompFun (HA [++] (S,SA)) = (CompFun HA [f+] (S,SA))\"\napply (unfold Let_def AddSA_def)\napply (subst CompFun_def)\napply (simp add: hierauto_def Abs_hierauto_inverse)\ndone\n\nlemma AddSA_HAStates:\n   \"\\<lbrakk> (States SA \\<inter> HAStates HA) = {}; \n       S \\<in> HAStates HA \\<rbrakk> \\<Longrightarrow>\n      HAStates (HA [++] (S,SA)) = (HAStates HA) \\<union> (States SA)\"\napply (unfold HAStates_def)\napply (subst AddSA_SAs)\napply (unfold HAStates_def)\napply auto\ndone\n\nlemma AddSA_HAInitValue:\n   \"\\<lbrakk> (States SA \\<inter> HAStates HA) = {};\n       S \\<in> HAStates HA \\<rbrakk> \\<Longrightarrow>\n      (HAInitValue (HA [++] (S,SA))) = (HAInitValue HA)\"\napply (unfold Let_def AddSA_def)\napply (subst HAInitValue_def)\napply (simp add: hierauto_def Abs_hierauto_inverse)\ndone\n\nlemma AddSA_HARoot:\n   \"\\<lbrakk> (States SA \\<inter> HAStates HA) = {};\n      S \\<in> HAStates HA \\<rbrakk> \\<Longrightarrow> \n      (HARoot (HA [++] (S,SA))) = (HARoot HA)\"\napply (unfold HARoot_def)\napply (simp add: AddSA_CompFun AddSA_SAs)\napply (subst FAddSA_RootEx_Root)\napply auto\napply (simp only: HAStates_SA_mem)\napply (unfold HAStates_def)\napply fast\ndone\n\nlemma AddSA_CompFun_the: \n \"\\<lbrakk> (States SA \\<inter> HAStates A) = {}; \n    S \\<in> HAStates A \\<rbrakk> \\<Longrightarrow> \n  (the ((CompFun (A [++] (S,SA))) S)) = insert SA (the ((CompFun A) S))\"\nby (simp add: AddSA_CompFun)\n\nlemma AddSA_CompFun_the2:\n \"\\<lbrakk> S' \\<in> States (SA::('a,'c,'d)seqauto); \n    (States SA \\<inter> HAStates A) = {};\n    S \\<in> HAStates A \\<rbrakk> \\<Longrightarrow>\n    the ((CompFun (A [++] (S,SA))) S') = {}\"\napply (simp add: AddSA_CompFun)\napply (subst FAddSA_dom_emptyset)\napply auto\ndone\n\nlemma AddSA_CompFun_the3:\n \"\\<lbrakk> S' \\<notin> States (SA::('a,'c,'d)seqauto); \n    S \\<noteq> S'; \n    (States SA \\<inter> HAStates A) = {}; \n    S \\<in> HAStates A \\<rbrakk> \\<Longrightarrow> \n   (the ((CompFun (A [++] (S,SA))) S')) = (the ((CompFun A) S'))\"\nby (simp add: AddSA_CompFun)\n\nlemma AddSA_CompFun_ran:\n \"\\<lbrakk> (States SA \\<inter> HAStates A) = {};\n     S \\<in> HAStates A \\<rbrakk> \\<Longrightarrow> \n   ran (CompFun (A [++] (S,SA))) = \n       insert {} (insert (insert SA (the ((CompFun A) S))) (ran (CompFun A) - {the ((CompFun A) S)}))\"\napply (simp add: AddSA_CompFun)\napply (subst FAddSA_ran)\napply auto\napply (fast dest: CompFun_Int_disjoint) \ndone\n\nlemma AddSA_CompFun_ran2:\n \"\\<lbrakk> (States SA1 \\<inter> HAStates A) = {};\n    (States SA2 \\<inter> (HAStates A \\<union> States SA1)) = {};\n     S \\<in> HAStates A;\n     T \\<in> States SA1 \\<rbrakk> \\<Longrightarrow>\n   ran (CompFun ((A [++] (S,SA1)) [++] (T,SA2))) = \n       insert {} (insert {SA2} (ran (CompFun (A  [++] (S,SA1)))))\"\napply (simp add: AddSA_HAStates AddSA_CompFun)\napply (subst FAddSA_ran)\napply (rule ballI)\napply (rule impI)\napply (subst AddSA_CompFun [THEN sym])\napply simp\napply simp\napply (subst AddSA_CompFun [THEN sym])\napply simp\napply simp\napply (rule CompFun_Int_disjoint)\napply simp\napply (simp add: AddSA_HAStates)\napply (simp add: AddSA_HAStates)\napply (case_tac \"S \\<in> States SA1\")\napply simp\napply (simp only: dom_CompFun [THEN sym])\napply (frule FAddSA_dom_dom_States)\napply fast\napply simp\napply (case_tac \"S \\<in> States SA1\")\napply simp\napply fast\napply (subst FAddSA_dom_dom_States)\napply simp\napply simp\napply simp\napply (case_tac \"S \\<in>  States SA1\")\napply simp\napply fast\napply (subst FAddSA_dom_dom_States)\napply simp\napply simp\napply simp\napply (case_tac \"S \\<in>  States SA1\")\napply simp\napply fast\napply simp\napply fast\ndone\n\nlemma AddSA_CompFun_ran_not_mem:\n \"\\<lbrakk> States SA2 \\<inter> (HAStates A \\<union> States SA1) = {};\n    States SA1 \\<inter> HAStates A = {};\n    S \\<in> HAStates A \\<rbrakk> \\<Longrightarrow> \n   {SA2} \\<notin> ran (CompFun A [f+] (S, SA1))\"\napply (cut_tac HA=\"A [++] (S,SA1)\" and Sas=\"{SA2}\" in ran_CompFun_is_not_SA)\napply (simp add: AddSA_HAStates AddSA_CompFun)\napply (simp add: AddSA_HAStates AddSA_SAs)\napply auto\napply (simp add: Int_def)\napply (cut_tac SA=SA2 in EX_State_SA)\napply (erule exE)\napply (frule HAStates_SA_mem)\napply fast\napply (simp only: HAStates_def)\napply fast\napply (simp add: AddSA_HAStates AddSA_CompFun)\ndone\n\nlemma AddSA_CompFun_ran3:\n \"\\<lbrakk> (States SA1 \\<inter> HAStates A) = {};\n    (States SA2 \\<inter> (HAStates A \\<union> States SA1)) = {};\n    (States SA3 \\<inter> (HAStates A \\<union> States SA1 \\<union> States SA2)) = {};\n     S \\<in> HAStates A; \n     T \\<in> States SA1 \\<rbrakk> \\<Longrightarrow> \n    ran (CompFun ((A [++] (S,SA1)) [++] (T,SA2) [++] (T,SA3))) = \n       insert {} (insert {SA3,SA2} (ran (CompFun (A  [++] (S,SA1)))))\"\napply (simp add: AddSA_HAStates AddSA_CompFun)\napply (subst FAddSA_ran)\napply (rule ballI)\napply (rule impI)\napply (subst AddSA_CompFun [THEN sym])\napply simp\napply simp\napply (subst AddSA_CompFun [THEN sym])\napply (simp add: AddSA_HAStates)\napply (simp add: AddSA_HAStates)\napply (subst AddSA_CompFun [THEN sym])\napply simp\napply simp\napply (subst AddSA_CompFun [THEN sym])\napply (simp add: AddSA_HAStates)\napply (simp add: AddSA_HAStates)\napply (rule CompFun_Int_disjoint)\napply simp\napply (simp add: AddSA_HAStates)\napply (simp add: AddSA_HAStates)\napply (simp only: dom_CompFun [THEN sym])\napply (cut_tac F=\"CompFun A [f+] (S, SA1)\" and S=T and SA=\"SA2\" in FAddSA_dom_dom_States)\napply (cut_tac F=\"CompFun A\" and S=S and SA=\"SA1\" in FAddSA_dom_dom_States)\napply fast\napply fast\napply simp\napply fast\napply simp\napply (cut_tac F=\"CompFun A\" and S=S and SA=\"SA1\" in FAddSA_dom_dom_States)\napply simp\napply fast\napply simp\napply (subst FAddSA_dom_dom_States)\napply (subst FAddSA_dom_dom_States)\napply simp\napply fast\napply simp\napply fast\napply (subst FAddSA_dom_dom_States)\napply simp\napply fast\napply simp\napply (subst FAddSA_dom_dom_States)\napply (subst FAddSA_dom_dom_States)\napply simp\napply fast\napply simp\napply fast\napply (subst FAddSA_dom_dom_States)\napply simp\napply fast\napply simp\napply (subst AddSA_CompFun [THEN sym])\nback\napply simp\napply simp\napply (subst AddSA_CompFun [THEN sym])\nback\napply (simp add: AddSA_HAStates)\napply (simp add: AddSA_HAStates)\napply (subst AddSA_CompFun_ran2)\napply fast\napply fast\napply fast\napply fast\napply (simp add: AddSA_CompFun)\napply (subst  FAddSA_dom_insert)\napply (subst FAddSA_dom_dom_States)\napply simp\napply fast\napply simp\napply fast\napply (subst FAddSA_dom_emptyset)\napply simp\napply fast\napply simp\napply simp\napply (subst  FAddSA_dom_insert)\napply (subst FAddSA_dom_dom_States)\napply simp\napply fast\napply simp\napply fast\napply (subst FAddSA_dom_emptyset)\napply simp\napply fast\napply simp\napply simp\napply (case_tac \"{SA2} \\<notin> ran (CompFun A [f+] (S,SA1))\")\napply fast\napply (simp add:AddSA_CompFun_ran_not_mem) \ndone\n\nlemma AddSA_CompFun_PseudoHA_ran:\n  \"\\<lbrakk> S \\<in> States RootSA;\n     States RootSA \\<inter> States SA = {} \\<rbrakk> \\<Longrightarrow> \n     (ran (CompFun ((PseudoHA RootSA D) [++] (S,SA)))) = (insert {} {{SA}})\"\napply (subst AddSA_CompFun_ran)\napply auto\ndone\n\nlemma AddSA_CompFun_PseudoHA_ran2:\n  \"\\<lbrakk> States SA1 \\<inter> States RootSA = {};\n     States SA2 \\<inter> (States RootSA \\<union> States SA1) = {}; \n     S \\<in> States RootSA \\<rbrakk> \\<Longrightarrow>  \n     (ran (CompFun ((PseudoHA RootSA D) [++] (S,SA1) [++] (S,SA2)))) = (insert {} {{SA2,SA1}})\"\napply (subst AddSA_CompFun_ran) \nprefer 3\napply (subst AddSA_CompFun_the)\napply simp\napply simp\napply (subst AddSA_CompFun_PseudoHA_ran)\napply fast\napply fast\napply (subst AddSA_CompFun_the)\napply simp\napply simp\napply simp\napply fast\napply (simp add: AddSA_HAStates)\napply (simp add: AddSA_HAStates)\ndone\n\nlemma AddSA_HAInitStates [simp]:\n \"\\<lbrakk> States SA \\<inter> HAStates A = {};\n    S \\<in> HAStates A \\<rbrakk> \\<Longrightarrow>\n   HAInitStates (A [++] (S,SA)) = insert (InitState SA) (HAInitStates A)\"\napply (unfold HAInitStates_def)\napply (simp add: AddSA_SAs)\ndone\n\nlemma AddSA_HAInitState [simp]:\n \"\\<lbrakk> States SA \\<inter> HAStates A = {};\n    S \\<in> HAStates A \\<rbrakk> \\<Longrightarrow>\n  HAInitState (A [++] (S,SA)) = (HAInitState A)\"\napply (unfold HAInitState_def)\napply (simp add: AddSA_HARoot)\ndone\n\nlemma AddSA_Chi [simp]:\n \"\\<lbrakk> States SA \\<inter> HAStates A = {};\n   S \\<in> HAStates A \\<rbrakk> \\<Longrightarrow>  \n  Chi (A [++] (S,SA)) S = (States SA) \\<union> (Chi A S)\"\napply (unfold Chi_def restrict_def)\napply (simp add: AddSA_SAs AddSA_HAStates AddSA_CompFun_the)\napply auto\ndone\n\nlemma AddSA_Chi2 [simp]:\n \"\\<lbrakk> States SA \\<inter> HAStates A = {};\n    S \\<in> HAStates A;  \n    T \\<in> States SA \\<rbrakk> \\<Longrightarrow>\n    Chi (A [++] (S,SA)) T = {}\"\napply (unfold Chi_def restrict_def)\napply (simp add: AddSA_SAs AddSA_HAStates AddSA_CompFun_the2)\ndone\n\nlemma AddSA_Chi3 [simp]:\n \"\\<lbrakk> States SA \\<inter> HAStates A = {};\n    S \\<in> HAStates A; \n    T \\<notin> States SA; T \\<noteq> S \\<rbrakk> \\<Longrightarrow>\n    Chi (A [++] (S,SA)) T = Chi A T\"\napply (unfold Chi_def restrict_def)\napply (simp add: AddSA_SAs AddSA_HAStates AddSA_CompFun_the3)\napply auto\ndone\n\nlemma AddSA_ChiRel [simp]:\n \"\\<lbrakk> States SA \\<inter> HAStates A = {};\n    S \\<in> HAStates A \\<rbrakk> \\<Longrightarrow> \n   ChiRel (A [++] (S,SA)) = { (T,T') . T = S \\<and> T' \\<in> States SA } \\<union> (ChiRel A)\" \napply (unfold ChiRel_def)\napply (simp add: AddSA_HAStates)\napply safe\napply (rename_tac T U)\napply (case_tac \"T \\<in> States SA\")\napply simp\napply simp\napply (rename_tac T U)\napply (case_tac \"T \\<noteq> S\")\napply (case_tac \"T \\<in>  States SA\")\napply simp\napply simp\napply simp\napply (rename_tac T U)\napply (case_tac \"T \\<in>  States SA\")\napply simp\napply simp\napply (cut_tac A=A and T=T in Chi_HAStates)\napply fast\napply (case_tac \"T \\<in> States SA\")\napply simp\napply simp\napply (cut_tac A=A and T=T in Chi_HAStates)\napply fast\napply fast\napply (rename_tac T U)\napply (case_tac \"T \\<noteq> S\")\napply (case_tac \"T \\<in> States SA\")\napply simp\napply simp\napply simp\napply (rename_tac T U)\napply (case_tac \"T \\<in>  States SA\")\napply auto\napply (metis AddSA_Chi AddSA_Chi3 Int_iff Un_iff empty_iff)\ndone\n\nlemma help_InitConf:\n  \"\\<lbrakk>States SA \\<inter> HAStates A = {} \\<rbrakk> \\<Longrightarrow> {p. fst p \\<noteq> InitState SA \\<and> snd p \\<noteq> InitState SA \\<and> \n       p \\<in>  insert (InitState SA) (HAInitStates A) \\<times> insert (InitState SA) (HAInitStates A) \\<and>  \n       (p \\<in>  {S} \\<times> States SA \\<or>  p \\<in>  ChiRel A)} = \n   (HAInitStates A \\<times> HAInitStates A \\<inter>  ChiRel A)\"    \napply auto\napply (cut_tac A=SA in InitState_States)\napply (cut_tac A=A in HAInitStates_HAStates, fast)\napply (cut_tac A=SA in InitState_States)\napply (cut_tac A=A in HAInitStates_HAStates, fast)\ndone\n \nlemma AddSA_InitConf [simp]:\n \"\\<lbrakk> States SA \\<inter> HAStates A = {};\n    S \\<in> InitConf A \\<rbrakk> \\<Longrightarrow> \n    InitConf (A [++] (S,SA)) = insert (InitState SA) (InitConf A)\"\napply (frule InitConf_HAStates2)\napply (unfold InitConf_def)\napply (simp del: insert_Times_insert)\napply auto\napply (rename_tac T)\napply (case_tac \"T=S\")\napply auto\nprefer 3\napply (rule_tac R=\"(HAInitStates A) \\<times> (HAInitStates A) \\<inter> ChiRel A\" in trancl_subseteq)\napply auto\napply (rotate_tac 3)\napply (frule trancl_collect)\nprefer 2\napply fast\napply auto\napply (cut_tac A=SA in InitState_States)\napply (frule ChiRel_HAStates)\napply fast\napply (frule ChiRel_HAStates)\napply (cut_tac A=SA in InitState_States)\napply fast\napply (frule ChiRel_HAStates)\napply (cut_tac A=SA in InitState_States)\napply fast\napply (subst help_InitConf [THEN sym])\napply fast\napply auto\napply (rule_tac b=S in rtrancl_into_rtrancl)\napply auto\nprefer 2\napply (erule rtranclE)\napply auto\nprefer 2\napply (erule rtranclE)\napply auto\napply (rule_tac R=\"(HAInitStates A) \\<times> (HAInitStates A) \\<inter> ChiRel A\" in trancl_subseteq)\napply auto\ndone\n\nlemma AddSA_InitConf2 [simp]:\n \"\\<lbrakk> States SA \\<inter> HAStates A = {};\n    S \\<notin> InitConf A;\n  S \\<in> HAStates A \\<rbrakk> \\<Longrightarrow>\n  InitConf (A [++] (S,SA)) = InitConf A\"\napply (unfold InitConf_def)\napply simp\napply auto\napply (rename_tac T)\nprefer 2\napply (rule_tac R=\"(HAInitStates A) \\<times> (HAInitStates A) \\<inter> ChiRel A\" in trancl_subseteq)\napply auto\napply (case_tac \"T=InitState SA\")\napply auto\nprefer 2\napply (rotate_tac 3)\napply (frule trancl_collect)\nprefer 2\napply fast\napply auto\napply (cut_tac A=SA in InitState_States)\napply (frule ChiRel_HAStates)\napply fast\napply (cut_tac A=SA in InitState_States)\napply (frule ChiRel_HAStates)\napply fast\napply (cut_tac A=SA in InitState_States)\napply (cut_tac A=A in HAInitStates_HAStates)\napply fast\napply (subst help_InitConf [THEN sym])\napply fast\napply auto\napply (rule_tac b=\"InitState SA\" in rtrancl_induct)\napply auto\napply (frule ChiRel_HAStates2)\napply (cut_tac A=SA in InitState_States)\napply fast\nprefer 2\napply (frule ChiRel_HAStates)\napply (cut_tac A=SA in InitState_States)\napply fast\napply (rule rtrancl_into_rtrancl)\napply auto\napply (rule rtrancl_into_rtrancl)\napply auto\ndone\n\nsubsection \"Theorems for Calculating Wellformedness of HA\"\n\nlemma PseudoHA_HAStates_IFF:\n \"(States SA) = X  \\<Longrightarrow> (HAStates (PseudoHA SA D)) = X\"\napply simp\ndone\n\nlemma AddSA_SAs_IFF:\n \"\\<lbrakk> States SA \\<inter> HAStates HA = {};\n    S \\<in> HAStates HA;\n    (SAs HA) = X \\<rbrakk> \\<Longrightarrow> (SAs (HA [++] (S, SA))) = (insert SA X)\"\napply (subst AddSA_SAs)\napply auto\ndone\n\nlemma AddSA_Events_IFF:\n \"\\<lbrakk> States SA \\<inter> HAStates HA = {}; \n    S \\<in> HAStates HA; \n    (HAEvents HA) = HAE;\n    (SAEvents SA) = SAE;  \n    (HAE \\<union> SAE) = X \\<rbrakk> \\<Longrightarrow> (HAEvents (HA [++] (S, SA))) = X\"\napply (subst AddSA_Events)\napply auto\ndone\n\nlemma AddSA_CompFun_IFF:\n \"\\<lbrakk> States SA \\<inter>  HAStates HA = {};\n    S \\<in> HAStates HA;\n    (CompFun HA) = HAG;\n    (HAG [f+] (S, SA)) = X \\<rbrakk> \\<Longrightarrow> (CompFun (HA [++] (S, SA))) = X\"\napply (subst AddSA_CompFun)\napply auto\ndone\n\nlemma AddSA_HAStates_IFF: \n \"\\<lbrakk> States SA \\<inter> HAStates HA = {};\n    S \\<in> HAStates HA;\n    (HAStates HA) = HAS;\n    (States SA) = SAS;\n    (HAS \\<union> SAS) = X \\<rbrakk> \\<Longrightarrow> (HAStates (HA [++] (S, SA))) = X\"\napply (subst AddSA_HAStates)\napply auto\ndone\n\nlemma AddSA_HAInitValue_IFF:\n \"\\<lbrakk> States SA \\<inter> HAStates HA = {};\n    S \\<in> HAStates HA;\n    (HAInitValue HA) = X \\<rbrakk> \\<Longrightarrow> (HAInitValue (HA [++] (S, SA))) = X\"\napply (subst AddSA_HAInitValue)\napply auto\ndone\n\nlemma AddSA_HARoot_IFF:\n \"\\<lbrakk> States SA \\<inter> HAStates HA = {};\n    S \\<in> HAStates HA;\n    (HARoot HA) = X \\<rbrakk> \\<Longrightarrow> (HARoot (HA [++] (S, SA))) = X\"\napply (subst AddSA_HARoot)\napply auto\ndone\n\nlemma AddSA_InitConf_IFF:\n \"\\<lbrakk> InitConf A = Y;\n    States SA \\<inter> HAStates A = {};\n    S \\<in> HAStates A; \n    (if S \\<in> Y then insert (InitState SA) Y else Y) = X \\<rbrakk> \\<Longrightarrow> \n    InitConf (A [++] (S,SA)) = X\" \napply (case_tac \"S \\<in> Y\")\napply auto\ndone\n\nlemma AddSA_CompFun_ran_IFF:\n  \"\\<lbrakk> (States SA \\<inter> HAStates A) = {}; \n     S \\<in> HAStates A;\n     (insert {} (insert (insert SA (the ((CompFun A) S))) (ran (CompFun A) - {the ((CompFun A) S)}))) = X \\<rbrakk> \\<Longrightarrow>\n     ran (CompFun (A [++] (S,SA))) = X\"\napply (subst  AddSA_CompFun_ran)\napply auto\ndone\n\nlemma AddSA_CompFun_ran2_IFF:\n \"\\<lbrakk> (States SA1 \\<inter> HAStates A) = {}; \n    (States SA2 \\<inter> (HAStates A \\<union> States SA1)) = {};\n    S \\<in> HAStates A;\n    T \\<in> States SA1;\n    insert {} (insert {SA2} (ran (CompFun (A  [++] (S,SA1))))) = X \\<rbrakk> \\<Longrightarrow>\n    ran (CompFun ((A [++] (S,SA1)) [++] (T,SA2))) = X\"\napply (subst AddSA_CompFun_ran2)\napply auto\ndone\n   \nlemma AddSA_CompFun_ran3_IFF:\n \"\\<lbrakk> (States SA1 \\<inter> HAStates A) = {};\n    (States SA2 \\<inter> (HAStates A \\<union> States SA1)) = {};\n    (States SA3 \\<inter> (HAStates A \\<union> States SA1 \\<union> States SA2)) = {};\n     S \\<in> HAStates A;\n     T \\<in> States SA1;\n     insert {} (insert {SA3,SA2} (ran (CompFun (A  [++] (S,SA1))))) = X \\<rbrakk> \\<Longrightarrow>\n     ran (CompFun ((A [++] (S,SA1)) [++] (T,SA2) [++] (T,SA3))) = X\" \napply (subst AddSA_CompFun_ran3)\napply auto\ndone\n\nlemma AddSA_CompFun_PseudoHA_ran_IFF:\n  \"\\<lbrakk> S \\<in> States RootSA; \n     States RootSA \\<inter> States SA = {};\n   (insert {} {{SA}}) = X \\<rbrakk> \\<Longrightarrow> \n   (ran (CompFun ((PseudoHA RootSA D) [++] (S,SA)))) = X\"\napply (subst AddSA_CompFun_PseudoHA_ran)\napply auto\ndone\n\nlemma AddSA_CompFun_PseudoHA_ran2_IFF:\n  \"\\<lbrakk> States SA1 \\<inter> States RootSA = {};\n     States SA2 \\<inter> (States RootSA \\<union> States SA1) = {};\n     S \\<in> States RootSA;\n     (insert {} {{SA2,SA1}}) = X \\<rbrakk> \\<Longrightarrow> \n     (ran (CompFun ((PseudoHA RootSA D) [++] (S,SA1) [++] (S,SA2)))) = X\" \napply (subst AddSA_CompFun_PseudoHA_ran2)\napply auto\ndone\n\n\nML \\<open>\n\nval AddSA_SAs_IFF = @{thm AddSA_SAs_IFF};\nval AddSA_Events_IFF = @{thm AddSA_Events_IFF};\nval AddSA_CompFun_IFF = @{thm AddSA_CompFun_IFF};\nval AddSA_HAStates_IFF = @{thm AddSA_HAStates_IFF};\nval PseudoHA_HAStates_IFF = @{thm PseudoHA_HAStates_IFF};\nval AddSA_HAInitValue_IFF = @{thm AddSA_HAInitValue_IFF};\nval AddSA_CompFun_ran_IFF = @{thm AddSA_CompFun_ran_IFF};\nval AddSA_HARoot_IFF = @{thm AddSA_HARoot_IFF};\nval insert_inter = @{thm insert_inter};\nval insert_notmem = @{thm insert_notmem};\nval PseudoHA_CompFun = @{thm PseudoHA_CompFun};\nval PseudoHA_Events = @{thm PseudoHA_Events};\nval PseudoHA_SAs = @{thm PseudoHA_SAs};\nval PseudoHA_HARoot = @{thm PseudoHA_HARoot};\nval PseudoHA_HAInitValue = @{thm PseudoHA_HAInitValue};\nval PseudoHA_CompFun_ran = @{thm PseudoHA_CompFun_ran};\nval Un_empty_right = @{thm Un_empty_right};\nval insert_union = @{thm insert_union};\n\n\nfun wellformed_tac ctxt L i =\n  FIRST[resolve_tac ctxt [AddSA_SAs_IFF] i,\n        resolve_tac ctxt [AddSA_Events_IFF] i,\n        resolve_tac ctxt [AddSA_CompFun_IFF] i,\n        resolve_tac ctxt [AddSA_HAStates_IFF] i,\n        resolve_tac ctxt [PseudoHA_HAStates_IFF] i,\n        resolve_tac ctxt [AddSA_HAInitValue_IFF] i,\n        resolve_tac ctxt [AddSA_HARoot_IFF] i,\n        resolve_tac ctxt [AddSA_CompFun_ran_IFF] i,\n        resolve_tac ctxt [insert_inter] i,\n        resolve_tac ctxt [insert_notmem] i,\n        CHANGED (simp_tac (put_simpset HOL_basic_ss ctxt addsimps\n           [PseudoHA_HARoot, PseudoHA_CompFun, PseudoHA_CompFun_ran,PseudoHA_Events,PseudoHA_SAs,insert_union,\n            PseudoHA_HAInitValue,Un_empty_right]@ L) i),\n        fast_tac ctxt i,\n        CHANGED (simp_tac ctxt i)];\n\\<close>\n\nmethod_setup wellformed  = \\<open>Attrib.thms >> (fn thms => fn ctxt => (METHOD (fn facts => \n                                       (HEADGOAL (wellformed_tac ctxt (facts @ thms))))))\\<close>\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Statecharts/HAOps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102498375401, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.341397496474028}}
{"text": "(*\n  File:   SDS_Impossibility.thy\n  Author: Manuel Eberl <eberlm@in.tum.de>\n\n  The proof that there exists no anonymous and neutral SDS for at least \n  four voters and alternatives that satisfies SD-Efficiency and \n  SD-Strategy-Proofness.\n*)\n\nsection \\<open>Incompatibility of SD-Efficiency and SD-Strategy-Proofness\\<close>\n\ntheory SDS_Impossibility\nimports\n  Randomised_Social_Choice.SDS_Automation\n  Randomised_Social_Choice.Randomised_Social_Choice\nbegin\n\nsubsection \\<open>Preliminary Definitions\\<close>\n\nlocale sds_impossibility = \n  anonymous_sds agents alts sds +\n  neutral_sds agents alts sds +\n  sd_efficient_sds agents alts sds +\n  strategyproof_sds agents alts sds\n  for agents :: \"'agent set\" and alts :: \"'alt set\" and sds +\n  assumes agents_ge_4: \"card agents \\<ge> 4\"\n      and alts_ge_4:   \"card alts \\<ge> 4\"\n\nlocale sds_impossibility_4_4 = sds_impossibility agents alts sds\n  for agents :: \"'agent set\" and alts :: \"'alt set\" and sds +\n  fixes A1 A2 A3 A4 :: 'agent and a b c d :: 'alt\n  assumes distinct_agents: \"distinct [A1, A2, A3, A4]\"\n      and distinct_alts: \"distinct [a, b, c, d]\"\n      and agents: \"agents = {A1, A2, A3, A4}\"\n      and alts:   \"alts   = {a, b, c, d}\"\nbegin\n\nlemma an_sds: \"an_sds agents alts sds\" by unfold_locales\nlemma ex_post_efficient_sds: \"ex_post_efficient_sds agents alts sds\" by unfold_locales\nlemma sd_efficient_sds: \"sd_efficient_sds agents alts sds\" by unfold_locales\nlemma strategyproof_an_sds: \"strategyproof_an_sds agents alts sds\" by unfold_locales\n\nlemma distinct_agents' [simp]: \n  \"A1 \\<noteq> A2\" \"A1 \\<noteq> A3\" \"A1 \\<noteq> A4\" \"A2 \\<noteq> A1\" \"A2 \\<noteq> A3\" \"A2 \\<noteq> A4\" \n  \"A3 \\<noteq> A1\" \"A3 \\<noteq> A2\" \"A3 \\<noteq> A4\" \"A4 \\<noteq> A1\" \"A4 \\<noteq> A2\" \"A4 \\<noteq> A3\"\n  using distinct_agents by auto\n  \nlemma distinct_alts' [simp]:\n  \"a \\<noteq> b\" \"a \\<noteq> c\" \"a \\<noteq> d\" \"b \\<noteq> a\" \"b \\<noteq> c\" \"b \\<noteq> d\" \n  \"c \\<noteq> a\" \"c \\<noteq> b\" \"c \\<noteq> d\" \"d \\<noteq> a\" \"d \\<noteq> b\" \"d \\<noteq> c\"\n  using distinct_alts by auto\n\nlemma card_agents [simp]: \"card agents = 4\" and card_alts [simp]: \"card alts = 4\"\n  using distinct_agents distinct_alts by (simp_all add: agents alts)\n\nlemma in_agents [simp]: \"A1 \\<in> agents\" \"A2 \\<in> agents\" \"A3 \\<in> agents\" \"A4 \\<in> agents\"\n  by (simp_all add: agents)\n\nlemma in_alts [simp]: \"a \\<in> alts\" \"b \\<in> alts\" \"c \\<in> alts\" \"d \\<in> alts\"\n  by (simp_all add: alts)\n  \nlemma agent_iff: \"x \\<in> agents \\<longleftrightarrow> x \\<in> {A1, A2, A3, A4}\"\n                 \"(\\<forall>x\\<in>agents. P x) \\<longleftrightarrow> P A1 \\<and> P A2 \\<and> P A3 \\<and> P A4\"\n                 \"(\\<exists>x\\<in>agents. P x) \\<longleftrightarrow> P A1 \\<or> P A2 \\<or> P A3 \\<or> P A4\"\n  by (auto simp add: agents)\n\nlemma alt_iff: \"x \\<in> alts \\<longleftrightarrow> x \\<in> {a,b,c,d}\"\n               \"(\\<forall>x\\<in>alts. P x) \\<longleftrightarrow> P a \\<and> P b \\<and> P c \\<and> P d\"\n               \"(\\<exists>x\\<in>alts. P x) \\<longleftrightarrow> P a \\<or> P b \\<or> P c \\<or> P d\"\n  by (auto simp add: alts)\n\n\n\n\nsubsection \\<open>Definition of Preference Profiles and Fact Gathering\\<close>\n\npreference_profile \n  agents: agents\n  alts:   alts\nwhere R1  = A1: [c, d], [a, b]    A2: [b, d], a, c      A3: a, b, [c, d]      A4: [a, c], [b, d]\n  and R2  = A1: [a, c], [b, d]    A2: [c, d], a, b      A3: [b, d], a, c      A4: a, b, [c, d]\n  and R3  = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: d, [a, b], c      A4: c, a, [b, d]\n  and R4  = A1: [a, b], [c, d]    A2: [a, d], [b, c]    A3: c, [a, b], d      A4: d, c, [a, b]\n  and R5  = A1: [c, d], [a, b]    A2: [a, b], [c, d]    A3: [a, c], d, b      A4: d, [a, b], c\n  and R6  = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], [b, d]    A4: d, b, a, c\n  and R7  = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: a, c, d, b        A4: d, [a, b], c\n  and R8  = A1: [a, b], [c, d]    A2: [a, c], [b, d]    A3: d, [a, b], c      A4: d, c, [a, b]\n  and R9  = A1: [a, b], [c, d]    A2: [a, d], c, b      A3: d, c, [a, b]      A4: [a, b, c], d\n  and R10 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], d, b      A4: [b, d], a, c\n  and R11 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: d, [a, b], c      A4: c, a, b, d\n  and R12 = A1: [c, d], [a, b]    A2: [a, b], [c, d]    A3: [a, c], d, b      A4: [a, b, d], c\n  and R13 = A1: [a, c], [b, d]    A2: [c, d], a, b      A3: [b, d], a, c      A4: a, b, d, c\n  and R14 = A1: [a, b], [c, d]    A2: d, c, [a, b]      A3: [a, b, c], d      A4: a, d, c, b\n  and R15 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [b, d], a, c      A4: a, c, d, b\n  and R16 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: a, c, d, b        A4: [a, b, d], c\n  and R17 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], [b, d]    A4: d, [a, b], c\n  and R18 = A1: [a, b], [c, d]    A2: [a, d], [b, c]    A3: [a, b, c], d      A4: d, c, [a, b]\n  and R19 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [b, d], a, c      A4: [a, c], [b, d]\n  and R20 = A1: [b, d], a, c      A2: b, a, [c, d]      A3: a, c, [b, d]      A4: d, c, [a, b]\n  and R21 = A1: [a, d], c, b      A2: d, c, [a, b]      A3: c, [a, b], d      A4: a, b, [c, d]\n  and R22 = A1: [a, c], d, b      A2: d, c, [a, b]      A3: d, [a, b], c      A4: a, b, [c, d]\n  and R23 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], [b, d]    A4: [a, b, d], c\n  and R24 = A1: [c, d], [a, b]    A2: d, b, a, c        A3: c, a, [b, d]      A4: b, a, [c, d]\n  and R25 = A1: [c, d], [a, b]    A2: [b, d], a, c      A3: a, b, [c, d]      A4: a, c, [b, d]\n  and R26 = A1: [b, d], [a, c]    A2: [c, d], [a, b]    A3: a, b, [c, d]      A4: a, c, [b, d]\n  and R27 = A1: [a, b], [c, d]    A2: [b, d], a, c      A3: [a, c], [b, d]    A4: [c, d], a, b\n  and R28 = A1: [c, d], a, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: a, c, [b, d]\n  and R29 = A1: [a, c], d, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: d, c, [a, b]\n  and R30 = A1: [a, d], c, b      A2: d, c, [a, b]      A3: c, [a, b], d      A4: [a, b], d, c\n  and R31 = A1: [b, d], a, c      A2: [a, c], d, b      A3: c, d, [a, b]      A4: [a, b], c, d\n  and R32 = A1: [a, c], d, b      A2: d, c, [a, b]      A3: d, [a, b], c      A4: [a, b], d, c\n  and R33 = A1: [c, d], [a, b]    A2: [a, c], d, b      A3: a, b, [c, d]      A4: d, [a, b], c\n  and R34 = A1: [a, b], [c, d]    A2: a, c, d, b        A3: b, [a, d], c      A4: c, d, [a, b]\n  and R35 = A1: [a, d], c, b      A2: a, b, [c, d]      A3: [a, b, c], d      A4: d, c, [a, b]\n  and R36 = A1: [c, d], [a, b]    A2: [a, c], d, b      A3: [b, d], a, c      A4: a, b, [c, d]\n  and R37 = A1: [a, c], [b, d]    A2: [b, d], [a, c]    A3: a, b, [c, d]      A4: c, d, [a, b]\n  and R38 = A1: [c, d], a, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: [a, c], b, d\n  and R39 = A1: [a, c], d, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: [c, d], a, b\n  and R40 = A1: [a, d], c, b      A2: [a, b], c, d      A3: [a, b, c], d      A4: d, c, [a, b]\n  and R41 = A1: [a, d], c, b      A2: [a, b], d, c      A3: [a, b, c], d      A4: d, c, [a, b]\n  and R42 = A1: [c, d], [a, b]    A2: [a, b], [c, d]    A3: d, b, a, c        A4: c, a, [b, d]\n  and R43 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: d, [a, b], c      A4: a, [c, d], b\n  and R44 = A1: [c, d], [a, b]    A2: [a, c], d, b      A3: [a, b], d, c      A4: [a, b, d], c\n  and R45 = A1: [a, c], d, b      A2: [b, d], a, c      A3: [a, b], c, d      A4: [c, d], b, a\n  and R46 = A1: [b, d], a, c      A2: d, c, [a, b]      A3: [a, c], [b, d]    A4: b, a, [c, d]\n  and R47 = A1: [a, b], [c, d]    A2: [a, d], c, b      A3: d, c, [a, b]      A4: c, [a, b], d\n  by (simp_all add: agents alts)\n\nderive_orbit_equations (an_sds)\n  R10 R26 R27 R28 R29 R43 R45\n  by simp_all\n\nprove_inefficient_supports (ex_post_efficient_sds sd_efficient_sds)\n  R3 [b] and R4 [b] and R5 [b] and R7 [b] and R8 [b] and\n  R9 [b] and R11 [b] and R12 [b] and R14 [b] and R16 [b] and\n  R17 [b] and R18 [b] and R21 [b] and R22 [b] and R23 [b] and\n  R30 [b] and R32 [b] and R33 [b] and R35 [b] and R40 [b] and\n  R41 [b] and R43 [b] and R44 [b] and R47 [b] and\n  R10 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R15 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R19 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R25 [b, c] witness: [c: 0, d: 1 / 2, a: 1 / 2, b: 0] and\n  R26 [c, b] witness: [b: 0, d: 1 / 2, a: 1 / 2, c: 0] and\n  R27 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R28 [b, c] witness: [c: 0, d: 1 / 2, a: 1 / 2, b: 0] and\n  R29 [b, c] witness: [a: 1 / 2, c: 0, d: 1 / 2, b: 0] and\n  R39 [b, c] witness: [a: 1 / 2, c: 0, d: 1 / 2, b: 0]\n  by (simp_all add: agent_iff alt_iff)\n\nderive_strategyproofness_conditions (strategyproof_an_sds)\n  distance: 2\n  R1 R2 R3 R4 R5 R6 R7 R8 R9 R10 R11 R12 R13 R14 R15 R16 R17 R18 R19 R20\n  R21 R22 R23 R24 R25 R26 R27 R28 R29 R30 R31 R32 R33 R34 R35 R36 R37 R38 R39 R40\n  R41 R42 R43 R44 R45 R46 R47\n  by (simp_all add: agent_iff alt_iff)\n\nlemma lottery_conditions:\n  assumes \"is_pref_profile R\"\n  shows   \"pmf (sds R) a \\<ge> 0\" \"pmf (sds R) b \\<ge> 0\" \"pmf (sds R) c \\<ge> 0\" \"pmf (sds R) d \\<ge> 0\"\n          \"pmf (sds R) a + pmf (sds R) b + pmf (sds R) c + pmf (sds R) d = 1\"\n  using lottery_prob_alts[OF sds_wf[OF assms]]\n  by (simp_all add: alts pmf_nonneg measure_measure_pmf_finite)\n\n\nsubsection \\<open>Main Proof\\<close>\n\nlemma R45 [simp]: \"pmf (sds R45) a = 1/4\" \"pmf (sds R45) b = 1/4\" \n           \"pmf (sds R45) c = 1/4\" \"pmf (sds R45) d = 1/4\"\n  using R45.orbits lottery_conditions[OF R45.wf] by simp_all\n\nlemma R10_bc [simp]: \"pmf (sds R10) b = 0\" \"pmf (sds R10) c = 0\"\n  using R10.support R10.orbits by auto\n\nlemma R10_ad [simp]: \"pmf (sds R10) a = 1/2\" \"pmf (sds R10) d = 1/2\"\n  using lottery_conditions[OF R10.wf] R10_bc R10.orbits by simp_all\n\n\nlemma R26_bc [simp]: \"pmf (sds R26) b = 0\" \"pmf (sds R26) c = 0\"\n  using R26.support R26.orbits by auto\n\nlemma R26_d [simp]: \"pmf (sds R26) d = 1 - pmf (sds R26) a\"\n  using lottery_conditions[OF R26.wf] R26_bc by simp\n\n\nlemma R27_bc [simp]: \"pmf (sds R27) b = 0\" \"pmf (sds R27) c = 0\"\n  using R27.support R27.orbits by auto\n\nlemma R27_d [simp]: \"pmf (sds R27) d = 1 - pmf (sds R27) a\"\n  using lottery_conditions[OF R27.wf] R27_bc by simp\n\n\nlemma R28_bc [simp]: \"pmf (sds R28) b = 0\" \"pmf (sds R28) c = 0\"\n  using R28.support R28.orbits by auto\n\nlemma R28_d [simp]: \"pmf (sds R28) d = 1 - pmf (sds R28) a\"\n  using lottery_conditions[OF R28.wf] R28_bc by simp\n\n\n\n\nlemma R29_ac [simp]: \"pmf (sds R29) a = 1/2\" \"pmf (sds R29) d = 1/2\"\n  using lottery_conditions[OF R29.wf] R29_bc R29.orbits by simp_all\n\n\nlemmas R43_bc [simp] = R43.support\n\nlemma R43_ad [simp]: \"pmf (sds R43) a = 1/2\" \"pmf (sds R43) d = 1/2\"\n  using lottery_conditions[OF R43.wf] R43_bc R43.orbits by simp_all\n\n\nlemma R39_b [simp]: \"pmf (sds R39) b = 0\"\nproof -\n  {\n    assume [simp]: \"pmf (sds R39) c = 0\"\n    with R29_R39.strategyproofness(1)\n      have \"pmf (sds R39) d \\<le> 1/2\" by auto\n    with R39_R29.strategyproofness(1) lottery_conditions[OF R39.wf] \n      have \"pmf (sds R39) b = 0\" by auto\n  }\n  with R39.support show ?thesis by blast\nqed\n\nlemma R36_a [simp]: \"pmf (sds R36) a = 1/2\" and R36_b [simp]: \"pmf (sds R36) b = 0\"\nproof -\n  from R10_R36.strategyproofness(1) lottery_conditions[OF R36.wf] \n    have \"pmf (sds R36) a + pmf (sds R36) b \\<le> 1/2\" by auto\n  with R36_R10.strategyproofness(1) lottery_conditions[OF R36.wf]\n    show \"pmf (sds R36) a = 1/2\" \"pmf (sds R36) b = 0\" by auto\nqed\n\nlemma R36_d [simp]: \"pmf (sds R36) d = 1/2 - pmf (sds R36) c\"\n  using lottery_conditions[OF R36.wf] by simp\n\nlemma R39_a [simp]: \"pmf (sds R39) a = 1/2\"\nproof -\n  from R36_R39.strategyproofness(1) lottery_conditions[OF R39.wf]\n    have \"pmf (sds R39) a \\<ge> 1/2\" by auto\n  with R39_R36.strategyproofness(1) lottery_conditions[OF R39.wf]\n    show ?thesis by auto\nqed\n\nlemma R39_d [simp]: \"pmf (sds R39) d = 1/2 - pmf (sds R39) c\"\n  using lottery_conditions[OF R39.wf] by simp\n\n\n\nlemmas R12_b [simp] = R12.support\n\nlemma R12_c [simp]: \"pmf (sds R12) c = 0\"\n  using R12_R10.strategyproofness(1) lottery_conditions[OF R12.wf] \n  by (auto simp del: pmf_nonneg)\n  \n\nlemma R12_d [simp]: \"pmf (sds R12) d = 1 - pmf (sds R12) a\"\n  using lottery_conditions[OF R12.wf] by simp\n\nlemma R12_a_ge_one_half: \"pmf (sds R12) a \\<ge> 1/2\"\n  using R10_R12.strategyproofness(1) lottery_conditions[OF R12.wf]\n  by auto\n\n\nlemma R44 [simp]: \n  \"pmf (sds R44) a = pmf (sds R12) a\" \"pmf (sds R44) d = 1 - pmf (sds R12) a\"\n  \"pmf (sds R44) b = 0\" \"pmf (sds R44) c = 0\"\nproof -\n  from R12_R44.strategyproofness(1) R44.support have \"pmf (sds R44) a \\<le> pmf (sds R12) a\" by simp\n  with R44_R12.strategyproofness(1) R44.support lottery_conditions[OF R44.wf]\n    show \"pmf (sds R44) a = pmf (sds R12) a\" \"pmf (sds R44) c = 0\"\n         \"pmf (sds R44) d = 1 - pmf (sds R12) a\" by (auto simp del: pmf_nonneg)\nqed (insert R44.support, simp_all)\n\nlemma R9_a [simp]: \"pmf (sds R9) a = pmf (sds R35) a\"\nproof -\n  from R9_R35.strategyproofness(1) R35.support R9.support \n    have \"pmf (sds R35) a \\<le> pmf (sds R9) a\" by simp\n  with R35_R9.strategyproofness(1) R9.support R35.support show ?thesis by simp\nqed\n\nlemma R18_c [simp]: \"pmf (sds R18) c = pmf (sds R9) c\"\nproof -\n  from R18_R9.strategyproofness(1) R18.support R9.support\n    have \"pmf (sds R18) d + pmf (sds R18) a \\<ge> pmf (sds R9) d + pmf (sds R9) a\" by auto\n  with R9_R18.strategyproofness(1) R18.support R9.support\n        lottery_conditions[OF R9.wf] lottery_conditions[OF R18.wf]\n    show ?thesis by auto\nqed\n\nlemma R5_d_ge_one_half: \"pmf (sds R5) d \\<ge> 1/2\"\n  using R5_R10.strategyproofness(1) R5.support lottery_conditions[OF R5.wf] by auto\n\nlemma R7 [simp]: \"pmf (sds R7) a = 1/2\" \"pmf (sds R7) b = 0\" \"pmf (sds R7) c = 0\" \"pmf (sds R7) d = 1/2\"\nproof -\n  from R5_d_ge_one_half have \"1/2 \\<le> pmf (sds R5) d\" by simp\n  also from R5_R17.strategyproofness(1) R17.support lottery_conditions[OF R5.wf] lottery_conditions[OF R17.wf] \n    have \"\\<dots> \\<le> pmf (sds R17) d\" by (auto simp del: pmf_nonneg)\n  also from R17_R7.strategyproofness(1) lottery_conditions[OF R7.wf] lottery_conditions[OF R17.wf] R7.support\n    have \"pmf (sds R17) d \\<le> pmf (sds R7) d\" by (auto simp del: pmf_nonneg)\n  finally have \"pmf (sds R7) d \\<ge> 1/2\" .\n  with R7_R43.strategyproofness(1) lottery_conditions[OF R7.wf] R7.support\n    show \"pmf (sds R7) a = 1/2\" \"pmf (sds R7) b = 0\" \"pmf (sds R7) c = 0\" \"pmf (sds R7) d = 1/2\"\n    by auto\nqed\n\nlemma R5 [simp]: \"pmf (sds R5) a = 1/2\" \"pmf (sds R5) b = 0\" \"pmf (sds R5) c = 0\" \"pmf (sds R5) d = 1/2\"\nproof -\n  from R5_R7.strategyproofness(1) lottery_conditions[OF R5.wf] R5.support \n    have \"pmf (sds R5) d \\<le> 1/2\" by auto\n  with R5_d_ge_one_half show d: \"pmf (sds R5) d = 1 / 2\" by simp\n  with R5_R10.strategyproofness(1) lottery_conditions[OF R5.wf] R5.support\n    show \"pmf (sds R5) c = 0\" \"pmf (sds R5) a = 1/2\" by simp_all\nqed (simp_all add: R5.support)\n\nlemma R15 [simp]: \"pmf (sds R15) a = 1/2\" \"pmf (sds R15) b = 0\" \"pmf (sds R15) c = 0\" \"pmf (sds R15) d = 1/2\"\nproof -\n  {\n    assume \"pmf (sds R15) b = 0\"\n    with R10_R15.strategyproofness(1) lottery_conditions[OF R15.wf]\n      have \"pmf (sds R15) a + pmf (sds R15) c \\<le> 1/2\" by auto\n    with R15_R10.strategyproofness(1) lottery_conditions[OF R15.wf] \n      have \"pmf (sds R15) c = 0\" by auto\n  }\n  with R15.support show [simp]: \"pmf (sds R15) c = 0\" by blast\n  with R15_R5.strategyproofness(1) lottery_conditions[OF R15.wf] \n    have \"pmf (sds R15) a \\<ge> 1/2\" by auto\n  moreover from R15_R7.strategyproofness(1) lottery_conditions[OF R15.wf]\n    have \"pmf (sds R15) b + pmf (sds R15) d \\<ge> 1/2\" by auto\n  ultimately show \"pmf (sds R15) a = 1/2\" using lottery_conditions[OF R15.wf] by auto\n  with R15_R5.strategyproofness(1) lottery_conditions[OF R15.wf]\n    show \"pmf (sds R15) d = 1/2\" \"pmf (sds R15) b = 0\" by auto\nqed\n\nlemma R13_aux: \"pmf (sds R13) b = 0\" \"pmf (sds R13) c = 0\" \"pmf (sds R13) d = 1 - pmf (sds R13) a\"\n  and R27_R13 [simp]: \"pmf (sds R27) a = pmf (sds R13) a\" \n  using R27_R13.strategyproofness(1) R13_R27.strategyproofness(1) lottery_conditions[OF R13.wf] by auto\n\nlemma R13 [simp]: \"pmf (sds R13) a = 1/2\" \"pmf (sds R13) b = 0\" \"pmf (sds R13) c = 0\" \"pmf (sds R13) d = 1/2\"\n  using R15_R13.strategyproofness(1) R13_R15.strategyproofness(1) R13_aux by simp_all\n\nlemma R27 [simp]: \"pmf (sds R27) a = 1/2\" \"pmf (sds R27) b = 0\" \"pmf (sds R27) c = 0\" \"pmf (sds R27) d = 1/2\"\n  by simp_all\n\nlemma R19 [simp]: \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) b = 0\" \"pmf (sds R19) c = 0\" \"pmf (sds R19) d = 1/2\"\nproof -\n  have \"pmf (sds R19) a = 1/2 \\<and> pmf (sds R19) b = 0 \\<and> pmf (sds R19) c = 0 \\<and> pmf (sds R19) d = 1/2\"\n  proof (rule disjE[OF R19.support]; safe)\n    assume [simp]: \"pmf (sds R19) b = 0\"\n    from R10_R19.strategyproofness(1) lottery_conditions[OF R19.wf] \n      have \"pmf (sds R19) a + pmf (sds R19) c \\<le> 1/2\" by auto\n    moreover from R19_R10.strategyproofness(1) \n      have \"pmf (sds R19) a + pmf (sds R19) c \\<ge> 1/2\" by simp\n    ultimately show \"pmf (sds R19) d = 1/2\" using lottery_conditions[OF R19.wf] by simp\n    with R27_R19.strategyproofness(1) lottery_conditions[OF R19.wf] \n      show \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) c = 0\" by auto\n  next\n    assume [simp]: \"pmf (sds R19) c = 0\"\n    from R19_R10.strategyproofness(1) have \"pmf (sds R19) a \\<ge> 1/2\" by auto\n    moreover from R19_R27.strategyproofness(1) have \"pmf (sds R19) d \\<ge> 1/2\" by auto\n    ultimately show \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) d = 1/2\" \"pmf (sds R19) b = 0\"\n      using lottery_conditions[OF R19.wf] by (auto simp del: pmf_nonneg)\n  qed\n  thus \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) b = 0\" \"pmf (sds R19) c = 0\" \"pmf (sds R19) d = 1/2\" \n    by blast+\nqed\n\nlemma R1 [simp]: \"pmf (sds R1) a = 1/2\" \"pmf (sds R1) b = 0\"\nproof -\n  from R19_R1.strategyproofness(1) lottery_conditions[OF R1.wf]\n    have \"pmf (sds R1) a + pmf (sds R1) b \\<le> 1/2\" by simp\n  with R1_R19.strategyproofness(1) lottery_conditions[OF R1.wf]\n    show \"pmf (sds R1) a = 1/2\" \"pmf (sds R1) b = 0\" by auto\nqed\n\nlemma R22 [simp]: \"pmf (sds R22) a = 1/2\" \"pmf (sds R22) b = 0\" \"pmf (sds R22) c = 0\" \"pmf (sds R22) d = 1/2\"\nproof -\n  from R33_R5.strategyproofness(1) R33.support\n    have \"1/2 \\<le> pmf (sds R33) a\" by auto\n  also from R33_R22.strategyproofness(1) R22.support R33.support \n    lottery_conditions[OF R22.wf] lottery_conditions[OF R33.wf]\n    have \"\\<dots> \\<le> pmf (sds R22) a\" by simp\n  finally show \"pmf (sds R22) a = 1/2\" \"pmf (sds R22) b = 0\" \"pmf (sds R22) c = 0\" \"pmf (sds R22) d = 1/2\"\n    using R22_R29.strategyproofness(1) lottery_conditions[OF R22.wf] by (auto simp del: pmf_nonneg)\nqed\n\nlemma R28 [simp]: \"pmf (sds R28) a = 1/2\" \"pmf (sds R28) b = 0\" \"pmf (sds R28) c = 0\" \"pmf (sds R28) d = 1/2\"\nproof -\n  have \"pmf (sds R28) a \\<le> pmf (sds R32) d\"\n    using R32_R28.strategyproofness(1) lottery_conditions[OF R32.wf] by auto\n  hence R32_d: \"pmf (sds R32) d = pmf (sds R28) a\"\n    using R28_R32.strategyproofness(1) lottery_conditions[OF R32.wf] by auto\n\n  from R22_R32.strategyproofness(1) lottery_conditions[OF R32.wf] R32.support \n    have \"pmf (sds R32) a \\<le> 1/2\" by auto\n  with R32_R22.strategyproofness(1) lottery_conditions[OF R32.wf] R32.support \n    show \"pmf (sds R28) a = 1/2\" \"pmf (sds R28) b = 0\" \"pmf (sds R28) c = 0\" \"pmf (sds R28) d = 1/2\"\n    by (auto simp: R32_d simp del: pmf_nonneg)\nqed\n\nlemma R39 [simp]: \"pmf (sds R39) a = 1/2\" \"pmf (sds R39) b = 0\" \"pmf (sds R39) c = 0\" \"pmf (sds R39) d = 1/2\"\nproof -\n  from R28_R39.strategyproofness(1) show \"pmf (sds R39) c = 0\" by simp\n  thus \"pmf (sds R39) a = 1/2\" \"pmf (sds R39) b = 0\" \"pmf (sds R39) d = 1/2\"\n    by simp_all\nqed\n\nlemma R2 [simp]: \"pmf (sds R2) a = 1/2\" \"pmf (sds R2) b = 0\" \"pmf (sds R2) c = 0\" \"pmf (sds R2) d = 1/2\"\nproof -\n  from R1_R2.strategyproofness(1) R2_R1.strategyproofness(1) lottery_conditions[OF R2.wf] lottery_conditions[OF R1.wf]\n    have \"pmf (sds R2) a = 1/2\" \"pmf (sds R2) c + pmf (sds R2) d = 1/2\" \n    by (auto simp: algebra_simps simp del: pmf_nonneg)\n  with R39_R2.strategyproofness(1) lottery_conditions[OF R2.wf]\n    show \"pmf (sds R2) a = 1/2\" \"pmf (sds R2) b = 0\" \"pmf (sds R2) c = 0\" \"pmf (sds R2) d = 1/2\"\n    by auto\nqed\n\nlemma R42 [simp]: \"pmf (sds R42) a = 0\" \"pmf (sds R42) b = 0\" \"pmf (sds R42) c = 1/2\" \"pmf (sds R42) d = 1/2\"\nproof -\n  from R17_R5.strategyproofness(1) lottery_conditions[OF R17.wf] R17.support \n    have \"pmf (sds R17) d \\<le> 1/2\" by auto\n  moreover from R5_R17.strategyproofness(1) R17.support lottery_conditions[OF R17.wf] \n    have \"pmf (sds R17) d \\<ge> 1/2\" by auto\n  ultimately have R17_d: \"pmf (sds R17) d = 1/2\" by simp\n\n  from R6_R42.strategyproofness(1) \n    have \"pmf (sds R42) a + pmf (sds R42) c \\<le> pmf (sds R6) a + pmf (sds R6) c\" by simp\n  also from R6_R19.strategyproofness(1) lottery_conditions[OF R6.wf] \n    have \"pmf (sds R6) a + pmf (sds R6) c \\<le> 1/2\" by (auto simp del: pmf_nonneg)\n  finally have \"pmf (sds R42) a + pmf (sds R42) c \\<le> 1 / 2\" .\n  moreover from R17_R11.strategyproofness(1) R11.support R17.support\n       lottery_conditions[OF R11.wf] lottery_conditions[OF R17.wf]\n    have \"pmf (sds R11) d \\<ge> 1/2\" by (auto simp: R17_d)\n  ultimately have \"pmf (sds R42) a + pmf (sds R42) c \\<le> pmf (sds R11) d\" by simp\n  with R42_R11.strategyproofness(1) R11.support\n    have E: \"pmf (sds R11) d \\<le> pmf (sds R42) c\" by auto\n  with \\<open>pmf (sds R11) d \\<ge> 1/2\\<close> have \"pmf (sds R42) c \\<ge> 1/2\" by simp\n  moreover from R17_R3.strategyproofness(1) R3.support R17.support\n       lottery_conditions[OF R17.wf] lottery_conditions[OF R3.wf] \n    have \"pmf (sds R3) d \\<ge> 1/2\" by (auto simp: R17_d)\n  ultimately show \"pmf (sds R42) a = 0\" \"pmf (sds R42) b = 0\" \"pmf (sds R42) c = 1/2\" \"pmf (sds R42) d = 1/2\"\n    using R42_R3.strategyproofness(1) lottery_conditions[OF R3.wf] lottery_conditions[OF R42.wf]\n    by linarith+\nqed\n\nlemma R37 [simp]: \"pmf (sds R37) a = 1/2\" \"pmf (sds R37) b = 0\" \"pmf (sds R37) c = 1/2\" \"pmf (sds R37) d = 0\"\nproof -\n  from R37_R42.strategyproofness(1) lottery_conditions[OF R37.wf]\n    have \"pmf (sds R37) a = 1/2 \\<or> pmf (sds R37) a + pmf (sds R37) b > 1/2\"\n    by (auto simp del: pmf_nonneg)\n  moreover from R37_R42.strategyproofness(2) lottery_conditions[OF R37.wf]\n    have \"pmf (sds R37) c = 1/2 \\<or> pmf (sds R37) c + pmf (sds R37) d > 1/2\" \n    by (auto simp del: pmf_nonneg)\n  ultimately show \"pmf (sds R37) a = 1/2\" \"pmf (sds R37) b = 0\" \"pmf (sds R37) c = 1/2\" \"pmf (sds R37) d = 0\"\n    using lottery_conditions[OF R37.wf] by (auto simp del: pmf_nonneg)\nqed\n\nlemma R24 [simp]: \"pmf (sds R24) a = 0\" \"pmf (sds R24) b = 0\" \"pmf (sds R24) d = 1 - pmf (sds R24) c\"\n  using R42_R24.strategyproofness(1) lottery_conditions[OF R24.wf] by (auto simp del: pmf_nonneg)\n\nlemma R34 [simp]:\n  \"pmf (sds R34) a = 1 - pmf (sds R24) c\" \"pmf (sds R34) b = pmf (sds R24) c\"\n  \"pmf (sds R34) c = 0\" \"pmf (sds R34) d = 0\"\nproof -\n  from R24_R34.strategyproofness(1) lottery_conditions[OF R34.wf] \n    have \"pmf (sds R34) b \\<le> pmf (sds R24) c\" by (auto simp del: pmf_nonneg)\n  moreover from R34_R24.strategyproofness(1) lottery_conditions[OF R34.wf] \n    have \"pmf (sds R34) b \\<ge> pmf (sds R24) c\" by auto\n  ultimately show bc: \"pmf (sds R34) b = pmf (sds R24) c\" by simp\n  from R34_R24.strategyproofness(1) bc lottery_conditions[OF R34.wf] \n    show \"pmf (sds R34) c = 0\" by auto\n  moreover from R24_R34.strategyproofness(1) bc show \"pmf (sds R34) d = 0\" by simp\n  ultimately show \"pmf (sds R34) a = 1 - pmf (sds R24) c\"\n    using bc lottery_conditions[OF R34.wf] by auto\nqed\n\nlemma R14 [simp]: \"pmf (sds R14) b = 0\" \"pmf (sds R14) d = 0\" \"pmf (sds R14) c = 1 - pmf (sds R14) a\"\n  using R14_R34.strategyproofness(1) R14.support lottery_conditions[OF R14.wf] \n  by (auto simp del: pmf_nonneg)\n\nlemma R46 [simp]: \"pmf (sds R46) a = 0\" \"pmf (sds R46) c = 0\" \"pmf (sds R46) d = 1 - pmf (sds R46) b\"\n  using R46_R37.strategyproofness(1) lottery_conditions[OF R46.wf] by auto\n\nlemma R20 [simp]: \"pmf (sds R20) a = 0\" \"pmf (sds R20) c = 0\" \"pmf (sds R20) d = 1 - pmf (sds R20) b\" \n  using R46_R20.strategyproofness(1) lottery_conditions[OF R20.wf] by (auto simp del: pmf_nonneg)\n\nlemma R21 [simp]: \"pmf (sds R21) d = 1 - pmf (sds R21) a\" \"pmf (sds R21) b = 0\" \"pmf (sds R21) c = 0\"\n  using R20_R21.strategyproofness(1) lottery_conditions[OF R21.wf] by auto\n\n\nlemma R16_R12: \"pmf (sds R16) c + pmf (sds R16) a \\<le> pmf (sds R12) a\"\n  using R12_R16.strategyproofness(1) R16.support lottery_conditions[OF R16.wf] by auto\n\nlemma R16 [simp]: \"pmf (sds R16) b = 0\" \"pmf (sds R16) c = 0\" \"pmf (sds R16) d = 1 - pmf (sds R16) a\"\nproof -\n  from R16_R12 have \"pmf (sds R16) c + pmf (sds R16) a \\<le> pmf (sds R12) a\" by simp\n  also from R44_R40.strategyproofness(1) lottery_conditions[OF R40.wf] R40.support\n    have \"pmf (sds R12) a \\<le> pmf (sds R40) a\" by auto\n  also from R9_R40.strategyproofness(1) R9.support R40.support \n    have \"pmf (sds R40) a \\<le> pmf (sds R9) a\" by auto\n  finally have \"pmf (sds R16) c + pmf (sds R16) a \\<le> pmf (sds R9) a\" by simp\n  moreover from R14_R16.strategyproofness(1) R16.support lottery_conditions[OF R16.wf] \n    have \"pmf (sds R16) a \\<ge> pmf (sds R14) a\" by auto\n  ultimately have \"pmf (sds R16) c \\<le> pmf (sds R9) a - pmf (sds R14) a\" by simp\n  also from R14_R9.strategyproofness(1) R9.support lottery_conditions[OF R9.wf]\n    have \"pmf (sds R9) a - pmf (sds R14) a \\<le> 0\" by (auto simp del: pmf_nonneg)\n  finally show \"pmf (sds R16) b = 0\" \"pmf (sds R16) c = 0\" \"pmf (sds R16) d = 1 - pmf (sds R16) a\"\n    using lottery_conditions[OF R16.wf] R16.support by auto\nqed\n\nlemma R12_R14: \"pmf (sds R14) a \\<le> pmf (sds R12) a\"\n  using R14_R16.strategyproofness(1) R16_R12 by auto\n\nlemma R12_a [simp]: \"pmf (sds R12) a = pmf (sds R9) a\"\nproof -\n  from R44_R40.strategyproofness(1) R40.support lottery_conditions[OF R40.wf] \n    have \"pmf (sds R12) a \\<le> pmf (sds R40) a\" by auto\n  also from R9_R40.strategyproofness(1) R9.support R40.support \n    have \"pmf (sds R40) a \\<le> pmf (sds R9) a\" by auto\n  finally have B: \"pmf (sds R12) a \\<le> pmf (sds R9) a\" by simp\n  moreover from R14_R9.strategyproofness(1) lottery_conditions[OF R9.wf] R9.support \n    have \"pmf (sds R9) a \\<le> pmf (sds R14) a\" by (auto simp del: pmf_nonneg)\n  with R12_R14 have \"pmf (sds R9) a \\<le> pmf (sds R12) a\" by simp\n  ultimately show \"pmf (sds R12) a = pmf (sds R9) a\" by simp\nqed\n\nlemma R9 [simp]: \"pmf (sds R9) b = 0\" \"pmf (sds R9) d = 0\" \"pmf (sds R14) a = pmf (sds R35) a\" \"pmf (sds R9) c = 1 - pmf (sds R35) a\"\n  using R12_R14 R14_R9.strategyproofness(1) lottery_conditions[OF R9.wf] R9.support\n  by auto\n\nlemma R23 [simp]: \"pmf (sds R23) b = 0\" \"pmf (sds R23) c = 0\" \"pmf (sds R23) d = 1 - pmf (sds R23) a\"\n  using R23_R19.strategyproofness(1) lottery_conditions[OF R23.wf] R23.support \n  by (auto simp del: pmf_nonneg)\n\nlemma R35 [simp]: \"pmf (sds R35) a = pmf (sds R21) a\" \"pmf (sds R35) b = 0\" \"pmf (sds R35) c = 0\" \"pmf (sds R35) d = 1 - pmf (sds R21) a\"\nproof -\n  from R35_R21.strategyproofness(1) R35.support\n    have \"pmf (sds R21) a \\<le> pmf (sds R35) a + pmf (sds R35) c\" by auto\n  with R21_R35.strategyproofness(1) R35.support lottery_conditions[OF R35.wf]\n    show \"pmf (sds R35) a = pmf (sds R21) a\" \"pmf (sds R35) b = 0\" \n         \"pmf (sds R35) c = 0\" \"pmf (sds R35) d = 1 - pmf (sds R21) a\" by simp_all\nqed\n\nlemma R18 [simp]: \"pmf (sds R18) a = pmf (sds R14) a\" \"pmf (sds R18) b = 0\"\n                  \"pmf (sds R18) d = 0\" \"pmf (sds R18) c = 1 - pmf (sds R14) a\"\nproof -\n from R23_R12.strategyproofness(1)\n    have R21_R23: \"pmf (sds R21) a \\<le> pmf (sds R23) a\" by simp\n\n  from R23_R18.strategyproofness(1) \n    have \"pmf (sds R18) d \\<le> pmf (sds R21) a - pmf (sds R23) a\" by simp\n  also from R21_R23 have \"\\<dots> \\<le> 0\" by simp\n  finally show \"pmf (sds R18) d = 0\" by simp\n  with lottery_conditions[OF R18.wf] R18.support\n    show \"pmf (sds R18) a = pmf (sds R14) a\"\n         \"pmf (sds R18) c = 1 - pmf (sds R14) a\" by auto\nqed (insert R18.support, simp_all)\n\nlemma R4 [simp]: \"pmf (sds R4) a = pmf (sds R21) a\" \"pmf (sds R4) b = 0\"\n                 \"pmf (sds R4) c = 1 - pmf (sds R4) a\" \"pmf (sds R4) d = 0\"\nproof -\n  from R30_R21.strategyproofness(1) R30.support lottery_conditions[OF R30.wf] \n    have \"pmf (sds R4) c + pmf (sds R21) a \\<le> pmf (sds R4) c + pmf (sds R30) a\" by auto\n  also {\n    have \"pmf (sds R30) a \\<le> pmf (sds R47) a\"\n      using R47_R30.strategyproofness(1) R30.support R47.support \n             lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf] by auto\n    moreover from R4_R47.strategyproofness(1) R4.support R47.support\n           lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf]\n      have \"pmf (sds R4) c \\<le> pmf (sds R47) c\" by simp\n    ultimately have \"pmf (sds R4) c + pmf (sds R30) a \\<le> 1 - pmf (sds R47) d\" \n      using lottery_conditions[OF R47.wf] R47.support by simp\n  }\n  finally have \"pmf (sds R4) c + pmf (sds R14) a \\<le> 1\"\n    using lottery_conditions[OF R47.wf] by (auto simp del: pmf_nonneg)\n  with R4_R18.strategyproofness(1) lottery_conditions[OF R4.wf] R4.support\n    show \"pmf (sds R4) a = pmf (sds R21) a\" \"pmf (sds R4) b = 0\"\n         \"pmf (sds R4) c = 1 - pmf (sds R4) a\" \"pmf (sds R4) d = 0\" by auto\nqed\n\nlemma R8_d [simp]: \"pmf (sds R8) d = 1 - pmf (sds R8) a\"\n  and R8_c [simp]: \"pmf (sds R8) c = 0\"\n  and R26_a [simp]: \"pmf (sds R26) a = 1 - pmf (sds R8) a\"\nproof -\n  from R8_R26.strategyproofness(2) R8.support lottery_conditions[OF R8.wf] \n    have \"pmf (sds R26) a \\<le> pmf (sds R8) d\" by auto\n  with R26_R8.strategyproofness(2) R8.support lottery_conditions[OF R8.wf] \n    have \"pmf (sds R26) a = pmf (sds R8) d\" by auto\n  with R8_R26.strategyproofness(2) R8.support lottery_conditions[OF R8.wf]\n    show \"pmf (sds R8) c = 0\" \"pmf (sds R8) d = 1 - pmf (sds R8) a\" \n         \"pmf (sds R26) a = 1 - pmf (sds R8) a\" by (auto simp del: pmf_nonneg)\nqed\n\nlemma R21_R47: \"pmf (sds R21) d \\<le> pmf (sds R47) c\"\n  using R4_R47.strategyproofness(1) R4.support R47.support\n         lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf] \n  by auto\n\nlemma R30 [simp]: \"pmf (sds R30) a = pmf (sds R47) a\" \"pmf (sds R30) b = 0\" \n  \"pmf (sds R30) c = 0\" \"pmf (sds R30) d = 1 - pmf (sds R47) a\"\nproof -\n  have A: \"pmf (sds R30) a \\<le> pmf (sds R47) a\"\n    using R47_R30.strategyproofness(1) R30.support R47.support \n           lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf] by auto\n  with R21_R47 R30_R21.strategyproofness(1) \n    lottery_conditions[OF R30.wf] lottery_conditions[OF R47.wf]\n    show \"pmf (sds R30) a = pmf (sds R47) a\" \"pmf (sds R30) b = 0\" \n         \"pmf (sds R30) c = 0\" \"pmf (sds R30) d = 1 - pmf (sds R47) a\"\n      by (auto simp: R30.support R47.support simp del: pmf_nonneg) (* tricky step! *)\nqed\n\nlemma R31_c_ge_one_half: \"pmf (sds R31) c \\<ge> 1/2\"\nproof -\n  from R25.support have \"pmf (sds R25) a \\<ge> 1/2\"\n  proof\n    assume \"pmf (sds R25) c = 0\"\n    with R25_R36.strategyproofness(1) lottery_conditions[OF R36.wf]\n       show \"pmf (sds R25) a \\<ge> 1/2\" by (auto simp del: pmf_nonneg)\n  next\n    assume [simp]: \"pmf (sds R25) b = 0\"\n    from R36_R25.strategyproofness(1) lottery_conditions[OF R25.wf]\n      have \"pmf (sds R25) c + pmf (sds R25) a \\<le> pmf (sds R36) c + 1 / 2\" by auto\n    with R25_R36.strategyproofness(1) show \"pmf (sds R25) a \\<ge> 1/2\" by auto\n  qed\n  hence \"pmf (sds R26) a \\<ge> 1/2\"\n    using R25_R26.strategyproofness(1) lottery_conditions[OF R25.wf] by (auto simp del: pmf_nonneg)\n  with lottery_conditions[OF R47.wf]\n    have \"1/2 \\<le> pmf (sds R26) a + pmf (sds R47) d\" by (simp del: pmf_nonneg)\n  also have \"\\<dots> = 1 - pmf (sds R8) a + pmf (sds R47) d\" by simp\n  also from R4_R8.strategyproofness(1) \n    have \"1 - pmf (sds R8) a \\<le> pmf (sds R21) d\" by auto\n  also note R21_R47\n  also from R30_R41.strategyproofness(1) R41.support \n            lottery_conditions[OF R41.wf] lottery_conditions[OF R47.wf] \n    have \"pmf (sds R47) c + pmf (sds R47) d \\<le> pmf (sds R41) d\" by (auto simp del: pmf_nonneg)\n  also from R41_R31.strategyproofness(1) R41.support lottery_conditions[OF R31.wf] \n       lottery_conditions[OF R41.wf]  \n    have \"pmf (sds R41) d \\<le> pmf (sds R31) c\" by auto\n  finally show \"pmf (sds R31) c \\<ge> 1/2\" by simp\nqed\n\nlemma R31: \"pmf (sds R31) a = 0\" \"pmf (sds R31) c = 1/2\" \"pmf (sds R31) b + pmf (sds R31) d = 1/2\"\nproof -\n  from R2_R38.strategyproofness(1) lottery_conditions[OF R38.wf] \n    have A: \"pmf (sds R38) b + pmf (sds R38) d \\<ge> 1/2\" by auto\n  with R31_c_ge_one_half R31_R38.strategyproofness(1) \n        lottery_conditions[OF R31.wf] lottery_conditions[OF R38.wf]\n  have \"pmf (sds R38) b + pmf (sds R38) d = pmf (sds R31) d + pmf (sds R31) b\" by auto\n  with R31_c_ge_one_half A lottery_conditions[OF R31.wf] lottery_conditions[OF R38.wf]\n    show \"pmf (sds R31) a = 0\" \"pmf (sds R31) c = 1/2\" \"pmf (sds R31) b + pmf (sds R31) d = 1/2\"\n    by linarith+\nqed\n\nlemma absurd: False\n  using R31 R45_R31.strategyproofness(2) by simp\n\n\n(* TODO (Re-)move *)\n(* This is just to output a list of all the Strategy-Proofness conditions used in the proof *)\n(*\nML_val \\<open>\nlet\nval thms = @{thms\nR1_R2.strategyproofness(1)\nR1_R19.strategyproofness(1)\nR2_R1.strategyproofness(1)\nR2_R38.strategyproofness(1)\nR4_R8.strategyproofness(1)\nR4_R18.strategyproofness(1)\nR4_R47.strategyproofness(1)\nR5_R7.strategyproofness(1)\nR5_R10.strategyproofness(1)\nR5_R17.strategyproofness(1)\nR6_R19.strategyproofness(1)\nR6_R42.strategyproofness(1)\nR7_R43.strategyproofness(1)\nR8_R26.strategyproofness(2)\nR9_R18.strategyproofness(1)\nR9_R35.strategyproofness(1)\nR9_R40.strategyproofness(1)\nR10_R12.strategyproofness(1)\nR10_R15.strategyproofness(1)\nR10_R19.strategyproofness(1)\nR10_R36.strategyproofness(1)\nR12_R10.strategyproofness(1)\nR12_R16.strategyproofness(1)\nR12_R44.strategyproofness(1)\nR13_R15.strategyproofness(1)\nR13_R27.strategyproofness(1)\nR14_R9.strategyproofness(1)\nR14_R16.strategyproofness(1)\nR14_R34.strategyproofness(1)\nR15_R5.strategyproofness(1)\nR15_R7.strategyproofness(1)\nR15_R10.strategyproofness(1)\nR15_R13.strategyproofness(1)\nR17_R3.strategyproofness(1)\nR17_R5.strategyproofness(1)\nR17_R7.strategyproofness(1)\nR17_R11.strategyproofness(1)\nR18_R9.strategyproofness(1)\nR19_R1.strategyproofness(1)\nR19_R10.strategyproofness(1)\nR19_R27.strategyproofness(1)\nR20_R21.strategyproofness(1)\nR21_R35.strategyproofness(1)\nR22_R29.strategyproofness(1)\nR22_R32.strategyproofness(1)\nR23_R12.strategyproofness(1)\nR23_R18.strategyproofness(1)\nR23_R19.strategyproofness(1)\nR24_R34.strategyproofness(1)\nR25_R26.strategyproofness(1)\nR25_R36.strategyproofness(1)\nR26_R8.strategyproofness(2)\nR27_R13.strategyproofness(1)\nR27_R19.strategyproofness(1)\nR28_R32.strategyproofness(1)\nR28_R39.strategyproofness(1)\nR29_R39.strategyproofness(1)\nR30_R21.strategyproofness(1)\nR30_R41.strategyproofness(1)\nR31_R38.strategyproofness(1)\nR32_R22.strategyproofness(1)\nR32_R28.strategyproofness(1)\nR33_R5.strategyproofness(1)\nR33_R22.strategyproofness(1)\nR34_R24.strategyproofness(1)\nR35_R9.strategyproofness(1)\nR35_R21.strategyproofness(1)\nR36_R10.strategyproofness(1)\nR36_R25.strategyproofness(1)\nR36_R39.strategyproofness(1)\nR37_R42.strategyproofness(1)\nR37_R42.strategyproofness(2)\nR39_R2.strategyproofness(1)\nR39_R29.strategyproofness(1)\nR39_R36.strategyproofness(1)\nR41_R31.strategyproofness(1)\nR42_R3.strategyproofness(1)\nR42_R11.strategyproofness(1)\nR42_R24.strategyproofness(1)\nR44_R12.strategyproofness(1)\nR44_R40.strategyproofness(1)\nR45_R31.strategyproofness(2)\nR46_R20.strategyproofness(1)\nR46_R37.strategyproofness(1)\nR47_R30.strategyproofness(1)\n};\nin\n thms\n |> map (Pretty.quote o Pretty.str o Pretty.unformatted_string_of o Syntax.pretty_term @{context} o Thm.prop_of)\n |> Pretty.list \"[\" \"]\"\n |> (fn x => Pretty.block [Pretty.str \"thms = \", x])\n |> Pretty.string_of\n |> writeln\nend\n\\<close>*)\n\nend\n\n\nsubsection \\<open>Lifting to more than 4 agents and alternatives\\<close>\n\n(* TODO: Move? *)\nlemma finite_list':\n  assumes \"finite A\"\n  obtains xs where \"A = set xs\" \"distinct xs\" \"length xs = card A\"\nproof -\n  from assms obtain xs where \"set xs = A\" using finite_list by blast\n  thus ?thesis using distinct_card[of \"remdups xs\"]\n    by (intro that[of \"remdups xs\"]) simp_all\nqed\n\nlemma finite_list_subset:\n  assumes \"finite A\" \"card A \\<ge> n\"\n  obtains xs where \"set xs \\<subseteq> A\" \"distinct xs\" \"length xs = n\"\nproof -\n  obtain xs where \"A = set xs\" \"distinct xs\" \"length xs = card A\"\n    using finite_list'[OF assms(1)] by blast\n  with assms show ?thesis\n    by (intro that[of \"take n xs\"]) (simp_all add: set_take_subset)\nqed\n\nlemma card_ge_4E:\n  assumes \"finite A\" \"card A \\<ge> 4\"\n  obtains a b c d where \"distinct [a,b,c,d]\" \"{a,b,c,d} \\<subseteq> A\"\nproof -\n  from finite_list_subset[OF assms] guess xs .\n  moreover then obtain a b c d where \"xs = [a, b, c, d]\" \n    by (auto simp: eval_nat_numeral length_Suc_conv)\n  ultimately show ?thesis by (intro that[of a b c d]) simp_all\nqed\n\n\ncontext sds_impossibility\nbegin\n\nlemma absurd: False\nproof -\n  from card_ge_4E[OF finite_agents agents_ge_4] guess A1 A2 A3 A4 .\n  note agents = this\n  from card_ge_4E[OF finite_alts alts_ge_4] guess a b c d .\n  note alts = this\n  define agents' alts' where \"agents' = {A1,A2,A3,A4}\" and \"alts' = {a,b,c,d}\"\n  from agents alts \n    interpret sds_lowering_anonymous_neutral_sdeff_stratproof agents alts sds agents' alts'\n    unfolding agents'_def alts'_def by unfold_locales simp_all\n  from agents alts \n    interpret sds_impossibility_4_4 agents' alts' lowered A1 A2 A3 A4 a b c d\n    by unfold_locales (simp_all add: agents'_def alts'_def)\n  from absurd show False .\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/SDS_Impossibility/SDS_Impossibility.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6113819874558604, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.34135106744701815}}
{"text": "theory Lookup\n  imports \n    \"../Setup\"\n    \"../Bool_Assn_Setup\"\n    \"../Utilities\"\n    OptionI\nbegin\n\n\ncontext rbt_impl\nbegin\ninterpretation rbt_impl_deps .\n\n\npartial_function (M) contains :: \"\n  ('ki, 'vi) rbti \\<Rightarrow> 'ki \\<Rightarrow> 1 word llM\n\" where \"\n  contains rbtp k = do {\n    if rbtp = null\n    then return 0\n    else do {\n      node \\<leftarrow> ll_load rbtp;\n      go_left \\<leftarrow> lt_impl k (rbt_node.key node);\n      if go_left = 1\n      then contains (rbt_node.left node) k\n      else do {\n        go_right \\<leftarrow> lt_impl (rbt_node.key node) k;\n        if go_right = 1\n        then contains (rbt_node.right node) k\n        else return 1\n      }\n    }\n  }\"\n\n\ndefinition \"rbt_contains t k \\<equiv> rbt_lookup t k \\<noteq> None\" \n\n\nlemma contains_correct:\n  \"llvm_htriple\n  (rbt_assn t ti ** \\<upharpoonleft>key_assn k ki)\n  (contains ti ki)\n  (\\<lambda>ri. \\<upharpoonleft>bool.assn (rbt_contains t k) ri ** rbt_assn t ti ** \\<upharpoonleft>key_assn k ki)\"\nproof(induction t arbitrary: ti)\n  case Empty\n  then show ?case\n    unfolding rbt_contains_def\n    apply (subst contains.simps)\n    apply vcg\n    done\nnext\n  case (Branch c lhs key val rhs)\n  note [vcg_rules] = Branch.IH\n  note [simp] = rbt_contains_def\n\n  show ?case\n    apply (subst contains.simps)\n    apply vcg\n    done\nqed\n\n\nabbreviation \"alloc_opt_of v \\<equiv> do {\n    opt \\<leftarrow> ll_balloc;\n    ll_store (OPTION_I v 1) opt;\n    return opt\n}\"\n\n\nabbreviation \"alloc_opt_none \\<equiv> do {\n    opt \\<leftarrow> ll_balloc;\n    ll_store (OPTION_I init 0) opt;\n    return opt\n}\"\n\n\npartial_function (M) lookup ::\n  \"('vi \\<Rightarrow> 'vi llM) \\<Rightarrow> 'ki \\<Rightarrow> ('ki, 'vi) rbti \\<Rightarrow> 'vi option_i llM\" where\n  \"lookup value_copy k node_p = do {\n    if node_p = null\n    then return (OPTION_I init 0)\n    else do {\n      node \\<leftarrow> ll_load node_p;\n      k_old \\<leftarrow> return rbt_node.key node;\n      if!  lt_impl k k_old\n      then! lookup value_copy k (rbt_node.left node)\n      else! if! lt_impl k_old k\n      then! lookup value_copy k (rbt_node.right node)\n      else! do {\n        val_copy \\<leftarrow> value_copy (rbt_node.val node);\n        return (OPTION_I val_copy 1)\n      }\n    }\n  }\"\n\n\nlemmas [llvm_code] = lookup.simps\n\n\ninterpretation v_option: option_impl value_assn .\n\n\ndefinition \"value_option_assn \\<equiv> v_option.option_assn\"\n\n\nlemma lookup_correct [vcg_rules]:\n  assumes\n    copy_rule [vcg_rules]:\n    \"\\<And>v vi.\n      llvm_htriple\n      (\\<upharpoonleft>value_assn v vi)\n      (value_copy vi)\n      (\\<lambda>r. \\<upharpoonleft>value_assn v vi ** \\<upharpoonleft>value_assn v r)\n    \"   \n  shows\n    \"\n      llvm_htriple\n      (rbt_assn t ti ** \\<upharpoonleft>key_assn kn ki)\n      (lookup value_copy ki ti)\n      (\\<lambda>opt.\n        \\<upharpoonleft>value_option_assn (rbt_lookup t kn) opt **\n        rbt_assn t ti **\n        \\<upharpoonleft>key_assn kn ki)\n    \"\nproof(induction t arbitrary: ti)\n  case Empty\n  then show ?case\n    unfolding value_option_assn_def\n    apply (subst lookup.simps)\n    apply vcg\n    done\nnext\n  case (Branch c l k v r)\n\n  note [vcg_rules] = Branch.IH\n\n  from Branch show ?case\n    apply (subst lookup.simps)\n    apply vcg\n    unfolding value_option_assn_def\n    apply vcg\n    done\nqed\n\n\npartial_function (M) lookup_ptr ::\n  \"'ki \\<Rightarrow> ('ki, 'vi) rbti \\<Rightarrow> ('ki, 'vi) rbti llM\" where\n  \"lookup_ptr k node_p = do {\n    if node_p = null\n    then return null\n    else do {\n      node \\<leftarrow> ll_load node_p;\n      k_old \\<leftarrow> return rbt_node.key node;\n      if! lt_impl k k_old\n      then! lookup_ptr k (rbt_node.left node)\n      else! if! lt_impl k_old k\n      then! lookup_ptr k (rbt_node.right node)\n      else! return node_p\n    }\n  }\"\n\n\nlemma H: \n  \"(\\<And>x. llvm_htriple (P x) C (\\<lambda>r. Q x r)) \\<Longrightarrow>\n  llvm_htriple (EXS x. P x) C (\\<lambda>r. EXS x. Q x r) \"\n  unfolding htriple_def wpa_def STATE_def NEMonad.wp_def Sep_Generic_Wp.wp_def\n  by blast\n\n\nlemma rbt_lookup_none_keys:\n \"rbt_sorted t \\<Longrightarrow> k \\<notin> rbt_key_set t \\<Longrightarrow> rbt_lookup t k = None\"\n  using rbt_lookup_iff_keys\n  by blast\n\n\nlemma rbt_lookup_some_keys:\n  assumes \"rbt_sorted t\" and \"k \\<in> rbt_key_set t\" obtains v where \"rbt_lookup t k = Some v\"\n  using rbt_lookup_iff_keys assms\n  by blast\n\nend\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Lookup/Lookup.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6619228891883799, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3413006243384475}}
{"text": "theory flash33Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_FAck ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_InvVsInv33:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Inv  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_InvAck_1VsInv33:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_InvAck_1_HomeVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_InvAck_2VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_GetXVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak1VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak2VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak3VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX1VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX2VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX3VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX4VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX5VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX6VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX7VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX8VsInv33:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Local_GetX_PutX8_homeVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX9VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX10VsInv33:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Local_GetX_PutX10_homeVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX11VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_GetVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak1VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak2VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak3VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put1VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put2VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put3VsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_PutVsInv33:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv33:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Local_PutXAcksDone ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma NI_NakVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Nak  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Nak_ClearVsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Nak_Clear ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Nak_HomeVsInv33:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Nak_Home ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma NI_Remote_GetX_NakVsInv33:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Remote_GetX_Nak_HomeVsInv33:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_PutXVsInv33:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv33:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv33:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Nak2VsInv33:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Remote_Get_Put1VsInv33:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv33:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutVsInv33:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Remote_Put  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                     have allCases:\"formEval  ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true ))  s  \\<or>formEval   (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true )) )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true ))  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n\n    moreover\n                       {assume c1:\"formEval  (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true )) )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately have \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutXVsInv33:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) )  ( Const UNI_PutX ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_PutX ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_ReplaceVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_ReplaceHomeVsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_ReplaceHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_ReplaceHomeShrVldVsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_ReplaceHomeShrVld ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_ReplaceShrVldVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_ShWbVsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_ShWb N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_WbVsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (NI_Wb ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_GetX1VsInv33:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Local_GetX_GetX1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma PI_Local_GetX_GetX2VsInv33:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Local_GetX_GetX2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma PI_Local_GetX_PutX1VsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX2VsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX3VsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Local_GetX_PutX3 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX4VsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Local_GetX_PutX4 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_Get_GetVsInv33:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Local_Get_Get ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma PI_Local_Get_PutVsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Local_Get_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_PutXVsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Local_PutX ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_ReplaceVsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Local_Replace ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Remote_GetVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Remote_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma PI_Remote_GetXVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Remote_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma PI_Remote_PutXVsInv33:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_ReplaceVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (PI_Remote_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma StoreVsInv33:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (Store  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma StoreHomeVsInv33:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv33  iInv1 ) (StoreHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash33Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.3413006174609101}}
{"text": "theory RCCVerification_RCC_FO_in_MetricSpace__T\nimports \"$HETS_ISABELLE_LIB/MainHC\"\nbegin\n\nML_file \"$HETS_ISABELLE_LIB/prelude.ML\"\n\nsetup \"Header.initialize\n       [\\\"Ax1\\\", \\\"C_def\\\", \\\"EMSCB_center\\\", \\\"EMSCB_closed\\\",\n        \\\"EMSCB_rep_pos\\\", \\\"EMSCB_rep_0\\\", \\\"EMSCB_rep_inj\\\", \\\"Ax4\\\",\n        \\\"MS_pos\\\", \\\"MS_zero\\\", \\\"MS_pos_definite\\\", \\\"MS_symm\\\",\n        \\\"MS_triangle\\\", \\\"one_greater_zero\\\", \\\"zero_leq_one\\\",\n        \\\"half_gt_zero\\\", \\\"half_plus_minus\\\", \\\"add_monotone\\\",\n        \\\"sub_leq\\\", \\\"half_leq\\\", \\\"half_leq_zero\\\", \\\"comm_add\\\",\n        \\\"Real_half_plus\\\", \\\"Real_half_minus\\\", \\\"Real_minus_half\\\",\n        \\\"Real_half_monot\\\", \\\"Real_abs_def\\\", \\\"Real_sqr_def\\\",\n        \\\"Real_sqrt_dom\\\", \\\"Real_sqrt_idef\\\", \\\"Real_2_def\\\",\n        \\\"Real_minus_def\\\", \\\"Real_divide_dom\\\", \\\"Real_divide_idef\\\",\n        \\\"Real_half_idef\\\", \\\"Real_ub_def\\\", \\\"Real_lb_def\\\",\n        \\\"Real_inf_def\\\", \\\"Real_sup_def\\\", \\\"Real_isBounded_def\\\",\n        \\\"completeness\\\", \\\"Real_inj_0\\\", \\\"Real_inj_suc\\\",\n        \\\"Real_archimedian\\\", \\\"FWO_plus_right\\\", \\\"FWO_times_right\\\",\n        \\\"FWO_plus\\\", \\\"FWO_plus_left\\\", \\\"FWO_times_left\\\",\n        \\\"Field_unary_minus_idef\\\", \\\"dichotomy_TotalOrder\\\", \\\"antisym\\\",\n        \\\"trans\\\", \\\"refl\\\", \\\"min_inf_relation\\\", \\\"max_sup_relation\\\",\n        \\\"ga_comm_min\\\", \\\"ga_comm_max\\\", \\\"ga_assoc_min\\\",\n        \\\"ga_assoc_max\\\", \\\"ga_left_comm_min\\\", \\\"ga_left_comm_max\\\",\n        \\\"min_def_ExtTotalOrder\\\", \\\"max_def_ExtTotalOrder\\\",\n        \\\"ga_comm_inf\\\", \\\"ga_comm_sup\\\", \\\"inf_def_ExtPartialOrder\\\",\n        \\\"sup_def_ExtPartialOrder\\\", \\\"geq_def_ExtPartialOrder\\\",\n        \\\"less_def_ExtPartialOrder\\\", \\\"greater_def_ExtPartialOrder\\\",\n        \\\"C_non_null\\\", \\\"C_sym\\\", \\\"C_id\\\", \\\"C_non_triv\\\"]\"\n\ntypedecl ClosedBall\ntypedecl Real\ntypedecl S\n\ndatatype X_Nat = X0X1 (\"0''\") | X_suc \"X_Nat\" (\"suc/'(_')\" [3] 999)\n\nconsts\nX0X2 :: \"Real\" (\"0''''\")\nX1 :: \"Real\" (\"1''\")\nX2 :: \"Real\" (\"2''\")\nXMinus__X :: \"Real => Real\" (\"(-''/ _)\" [56] 56)\nXVBar__XVBar :: \"Real => Real\" (\"(|/ _/ |)\" [10] 999)\nX__C__X :: \"ClosedBall => ClosedBall => bool\" (\"(_/ C/ _)\" [44,44] 42)\nX__XGtXEq__X :: \"Real => Real => bool\" (\"(_/ >=''/ _)\" [44,44] 42)\nX__XGt__X :: \"Real => Real => bool\" (\"(_/ >''/ _)\" [44,44] 42)\nX__XLtXEq__XX1 :: \"Real => Real => bool\" (\"(_/ <=''/ _)\" [44,44] 42)\nX__XLtXEq__XX2 :: \"Real => (Real => bool) => bool\" (\"(_/ <=''''/ _)\" [44,44] 42)\nX__XLtXEq__XX3 :: \"(Real => bool) => Real => bool\" (\"(_/ <='_3/ _)\" [44,44] 42)\nX__XLt__X :: \"Real => Real => bool\" (\"(_/ <''/ _)\" [44,44] 42)\nX__XMinus__X :: \"Real => Real => Real\" (\"(_/ -''/ _)\" [54,54] 52)\nX__XPlus__X :: \"Real => Real => Real\" (\"(_/ +''/ _)\" [54,54] 52)\nX__XSlash__X :: \"Real => Real => Real partial\" (\"(_/ '/''/ _)\" [54,54] 52)\nX__Xx__X :: \"Real => Real => Real\" (\"(_/ *''/ _)\" [54,54] 52)\nX_closedBall :: \"S => Real => ClosedBall\" (\"closedBall/'(_,/ _')\" [3,3] 999)\nX_d :: \"S => S => Real\" (\"d/'(_,/ _')\" [3,3] 999)\nX_half :: \"Real => Real\" (\"half/'(_')\" [3] 999)\nX_inj :: \"X_Nat => Real\" (\"inj''/'(_')\" [3] 999)\nX_isBounded :: \"(Real => bool) => bool\" (\"isBounded/'(_')\" [3] 999)\nX_max :: \"Real => Real => Real\" (\"max''/'(_,/ _')\" [3,3] 999)\nX_min :: \"Real => Real => Real\" (\"min''/'(_,/ _')\" [3,3] 999)\nX_nonempty :: \"ClosedBall => bool\" (\"nonempty/'(_')\" [3] 999)\ninfX1 :: \"Real => Real => Real partial\" (\"inf''/'(_,/ _')\" [3,3] 999)\ninfX2 :: \"(Real => bool) => Real partial\" (\"inf''''/'(_')\" [3] 999)\nrep :: \"ClosedBall => S => bool\"\nsqr__X :: \"Real => Real\" (\"(sqr/ _)\" [56] 56)\nsqrt__X :: \"Real => Real partial\" (\"(sqrt/ _)\" [56] 56)\nsupX1 :: \"Real => Real => Real partial\" (\"sup''/'(_,/ _')\" [3,3] 999)\nsupX2 :: \"(Real => bool) => Real partial\" (\"sup''''/'(_')\" [3] 999)\n\naxiomatization\nwhere\nAx1 [rule_format] : \"ALL (x :: ClosedBall). nonempty(x) = (x C x)\"\nand\nC_def [rule_format] :\n\"ALL (x :: ClosedBall).\n ALL (y :: ClosedBall). (x C y) = (EX (s :: S). rep x s & rep y s)\"\nand\nEMSCB_center [rule_format] :\n\"ALL (r :: Real).\n ALL (x :: S). r >' 0'' --> rep (closedBall(x, r)) x\"\nand\nEMSCB_closed [rule_format] :\n\"ALL (a :: ClosedBall).\n ALL (x :: S).\n ~ rep a x -->\n (EX (r :: Real).\n  ALL (y :: S). ~ (rep (closedBall(x, r)) y & ~ rep a y))\"\nand\nEMSCB_rep_pos [rule_format] :\n\"ALL (r :: Real).\n ALL (x :: S).\n ALL (y :: S).\n r >' 0'' --> rep (closedBall(x, r)) y = (d(x, y) <=' r)\"\nand\nEMSCB_rep_0 [rule_format] :\n\"ALL (r :: Real).\n ALL (x :: S).\n ALL (y :: S). ~ r >' 0'' --> ~ rep (closedBall(x, r)) y\"\nand\nEMSCB_rep_inj [rule_format] :\n\"ALL (a :: ClosedBall).\n ALL (b :: ClosedBall). rep a = rep b --> a = b\"\nand\nAx4 [rule_format] :\n\"ALL (a :: ClosedBall).\n EX (z :: S). EX (t :: Real). a = closedBall(z, t)\"\nand\nMS_pos [rule_format] :\n\"ALL (x :: S). ALL (y :: S). 0'' <=' d(x, y)\"\nand\nMS_zero [rule_format] : \"ALL (x :: S). d(x, x) = 0''\"\nand\nMS_pos_definite [rule_format] :\n\"ALL (x :: S). ALL (y :: S). d(x, y) = 0'' = (x = y)\"\nand\nMS_symm [rule_format] :\n\"ALL (x :: S). ALL (y :: S). d(x, y) = d(y, x)\"\nand\nMS_triangle [rule_format] :\n\"ALL (x :: S).\n ALL (y :: S). ALL (z :: S). d(x, z) <=' d(x, y) +' d(y, z)\"\nand\none_greater_zero [rule_format] : \"1' >' 0''\"\nand\nzero_leq_one [rule_format] : \"0'' <=' 1'\"\nand\nhalf_gt_zero [rule_format] :\n\"ALL (r :: Real). r >' 0'' --> half(r) >' 0''\"\nand\nhalf_plus_minus [rule_format] :\n\"ALL (r :: Real).\n ALL (s :: Real). r <=' s --> s +' half(r -' s) <=' s\"\nand\nadd_monotone [rule_format] :\n\"ALL (a :: Real).\n ALL (b :: Real).\n ALL (c :: Real).\n ALL (e :: Real). a <=' b & c <=' e --> a +' c <=' b +' e\"\nand\nsub_leq [rule_format] :\n\"ALL (a :: Real). ALL (b :: Real). ~ a <=' b --> a -' b >' 0''\"\nand\nhalf_leq [rule_format] :\n\"ALL (a :: Real).\n ALL (b :: Real). a <=' half(a -' b) +' b --> a <=' b\"\nand\nhalf_leq_zero [rule_format] :\n\"ALL (r :: Real). 0'' <=' r --> 0'' <=' half(r)\"\nand\ncomm_add [rule_format] :\n\"ALL (a :: Real). ALL (b :: Real). a +' b = b +' a\"\nand\nReal_half_plus [rule_format] :\n\"ALL (r :: Real).\n ALL (s :: Real). half(r +' s) = half(r) +' half(s)\"\nand\nReal_half_minus [rule_format] :\n\"ALL (r :: Real).\n ALL (s :: Real). half(r -' s) = half(r) -' half(s)\"\nand\nReal_minus_half [rule_format] :\n\"ALL (r :: Real). r -' half(r) = half(r)\"\nand\nReal_half_monot [rule_format] :\n\"ALL (r :: Real).\n ALL (s :: Real). (half(r) <=' half(s)) = (r <=' s)\"\nand\nReal_abs_def [rule_format] :\n\"ALL (r :: Real). | r | = max'(r, -' r)\"\nand\nReal_sqr_def [rule_format] : \"ALL (r :: Real). sqr r = r *' r\"\nand\nReal_sqrt_dom [rule_format] :\n\"ALL (r :: Real). defOp (sqrt r) = (r >=' 0'')\"\nand\nReal_sqrt_idef [rule_format] :\n\"ALL (r :: Real). sqrt sqr r = makePartial ( | r | )\"\nand\nReal_2_def [rule_format] : \"2' = 1' +' 1'\"\nand\nReal_minus_def [rule_format] :\n\"ALL (r :: Real). ALL (r' :: Real). r -' r' = r +' -' r'\"\nand\nReal_divide_dom [rule_format] :\n\"ALL (r :: Real). ~ defOp (r /' 0'')\"\nand\nReal_divide_idef [rule_format] :\n\"ALL (r :: Real).\n ALL (r' :: Real).\n ALL (r'' :: Real).\n (~ r' = 0'' --> r /' r' = makePartial r'') = (r'' *' r' = r)\"\nand\nReal_half_idef [rule_format] : \"ALL (r :: Real). 2' *' half(r) = r\"\nand\nReal_ub_def [rule_format] :\n\"ALL (M :: Real => bool).\n ALL (r :: Real). (M <=_3 r) = (ALL (s :: Real). M s --> s <=' r)\"\nand\nReal_lb_def [rule_format] :\n\"ALL (M :: Real => bool).\n ALL (r :: Real). (r <='' M) = (ALL (s :: Real). M s --> r <=' s)\"\nand\nReal_inf_def [rule_format] :\n\"ALL (M :: Real => bool).\n ALL (r :: Real).\n inf''(M) = makePartial r =\n (r <='' M & (ALL (s :: Real). s <='' M --> s <=' r))\"\nand\nReal_sup_def [rule_format] :\n\"ALL (M :: Real => bool).\n ALL (r :: Real).\n sup''(M) = makePartial r =\n (M <=_3 r & (ALL (s :: Real). M <=_3 s --> r <=' s))\"\nand\nReal_isBounded_def [rule_format] :\n\"ALL (M :: Real => bool).\n isBounded(M) =\n (EX (ub :: Real). EX (lb :: Real). lb <='' M & M <=_3 ub)\"\nand\ncompleteness [rule_format] :\n\"ALL (M :: Real => bool).\n isBounded(M) --> defOp (inf''(M)) & defOp (sup''(M))\"\nand\nReal_inj_0 [rule_format] : \"inj'(0') = 0''\"\nand\nReal_inj_suc [rule_format] :\n\"ALL (X_n :: X_Nat). inj'(suc(X_n)) = 1' +' inj'(X_n)\"\nand\nReal_archimedian [rule_format] :\n\"ALL (r :: Real). EX (X_n :: X_Nat). r <=' inj'(X_n)\"\nand\nFWO_plus_right [rule_format] :\n\"ALL (a :: Real).\n ALL (b :: Real). ALL (c :: Real). b <=' c --> a +' b <=' a +' c\"\nand\nFWO_times_right [rule_format] :\n\"ALL (a :: Real).\n ALL (b :: Real).\n ALL (c :: Real). b <=' c & 0'' <=' a --> a *' b <=' a *' c\"\nand\nFWO_plus [rule_format] :\n\"ALL (a :: Real).\n ALL (b :: Real).\n ALL (c :: Real).\n ALL (X_d :: Real). a <=' c & b <=' X_d --> a +' b <=' c +' X_d\"\nand\nFWO_plus_left [rule_format] :\n\"ALL (a :: Real).\n ALL (b :: Real). ALL (c :: Real). a <=' b --> a +' c <=' b +' c\"\nand\nFWO_times_left [rule_format] :\n\"ALL (a :: Real).\n ALL (b :: Real).\n ALL (c :: Real). a <=' b & 0'' <=' c --> a *' c <=' b *' c\"\nand\nField_unary_minus_idef [rule_format] :\n\"ALL (x :: Real). -' x +' x = 0''\"\nand\ndichotomy_TotalOrder [rule_format] :\n\"ALL (x :: Real). ALL (y :: Real). x <=' y | y <=' x\"\nand\nantisym [rule_format] :\n\"ALL (x :: Real). ALL (y :: Real). x <=' y & y <=' x --> x = y\"\nand\ntrans [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real). ALL (z :: Real). x <=' y & y <=' z --> x <=' z\"\nand\nrefl [rule_format] : \"ALL (x :: Real). x <=' x\"\nand\nmin_inf_relation [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real). makePartial (min'(x, y)) = inf'(x, y)\"\nand\nmax_sup_relation [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real). makePartial (max'(x, y)) = sup'(x, y)\"\nand\nga_comm_min [rule_format] :\n\"ALL (x :: Real). ALL (y :: Real). min'(x, y) = min'(y, x)\"\nand\nga_comm_max [rule_format] :\n\"ALL (x :: Real). ALL (y :: Real). max'(x, y) = max'(y, x)\"\nand\nga_assoc_min [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real).\n ALL (z :: Real). min'(min'(x, y), z) = min'(x, min'(y, z))\"\nand\nga_assoc_max [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real).\n ALL (z :: Real). max'(max'(x, y), z) = max'(x, max'(y, z))\"\nand\nga_left_comm_min [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real).\n ALL (z :: Real). min'(x, min'(y, z)) = min'(y, min'(x, z))\"\nand\nga_left_comm_max [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real).\n ALL (z :: Real). max'(x, max'(y, z)) = max'(y, max'(x, z))\"\nand\nmin_def_ExtTotalOrder [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real). min'(x, y) = (if x <=' y then x else y)\"\nand\nmax_def_ExtTotalOrder [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real). max'(x, y) = (if x <=' y then y else x)\"\nand\nga_comm_inf [rule_format] :\n\"ALL (x :: Real). ALL (y :: Real). inf'(x, y) = inf'(y, x)\"\nand\nga_comm_sup [rule_format] :\n\"ALL (x :: Real). ALL (y :: Real). sup'(x, y) = sup'(y, x)\"\nand\ninf_def_ExtPartialOrder [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real).\n ALL (z :: Real).\n inf'(x, y) = makePartial z =\n (z <=' x &\n  z <=' y & (ALL (t :: Real). t <=' x & t <=' y --> t <=' z))\"\nand\nsup_def_ExtPartialOrder [rule_format] :\n\"ALL (x :: Real).\n ALL (y :: Real).\n ALL (z :: Real).\n sup'(x, y) = makePartial z =\n (x <=' z &\n  y <=' z & (ALL (t :: Real). x <=' t & y <=' t --> z <=' t))\"\nand\ngeq_def_ExtPartialOrder [rule_format] :\n\"ALL (x :: Real). ALL (y :: Real). (x >=' y) = (y <=' x)\"\nand\nless_def_ExtPartialOrder [rule_format] :\n\"ALL (x :: Real). ALL (y :: Real). (x <' y) = (x <=' y & ~ x = y)\"\nand\ngreater_def_ExtPartialOrder [rule_format] :\n\"ALL (x :: Real). ALL (y :: Real). (x >' y) = (y <' x)\"\n\ndeclare EMSCB_rep_pos [simp]\ndeclare EMSCB_center [simp]\ndeclare EMSCB_rep_0 [simp]\ndeclare MS_pos [simp]\ndeclare MS_zero [simp]\ndeclare MS_pos_definite [simp]\ndeclare MS_triangle [simp]\ndeclare one_greater_zero [simp]\ndeclare zero_leq_one [simp]\ndeclare half_plus_minus [simp]\ndeclare sub_leq [simp]\ndeclare half_leq_zero [simp]\ndeclare Real_minus_half [simp]\ndeclare Real_half_monot [simp]\ndeclare Real_divide_dom [simp]\ndeclare Real_half_idef [simp]\ndeclare completeness [simp]\ndeclare Real_inj_0 [simp]\ndeclare FWO_plus_right [simp]\ndeclare FWO_plus_left [simp]\ndeclare Field_unary_minus_idef [simp]\ndeclare refl [simp]\ndeclare min_inf_relation [simp]\ndeclare max_sup_relation [simp]\ndeclare ga_comm_min [simp]\ndeclare ga_comm_max [simp]\ndeclare ga_assoc_min [simp]\ndeclare ga_assoc_max [simp]\ndeclare ga_left_comm_min [simp]\ndeclare ga_left_comm_max [simp]\ndeclare ga_comm_inf [simp]\ndeclare ga_comm_sup [simp]\n\ntheorem C_non_null :\n\"ALL (x :: ClosedBall). ALL (y :: ClosedBall). x C y --> x C x\"\nusing Ax1 C_def Real_abs_def Real_sqr_def Real_sqrt_idef Real_2_def\n      Real_minus_def Real_divide_idef Real_half_idef Real_ub_def\n      Real_lb_def Real_inf_def Real_sup_def Real_isBounded_def\n      Field_unary_minus_idef\nby (auto)\n\nsetup \"Header.record \\\"C_non_null\\\"\"\n\ntheorem C_sym :\n\"ALL (x :: ClosedBall). ALL (y :: ClosedBall). x C y --> y C x\"\nusing Ax1 C_def Real_abs_def Real_sqr_def Real_sqrt_idef Real_2_def\n      Real_minus_def Real_divide_idef Real_half_idef Real_ub_def\n      Real_lb_def Real_inf_def Real_sup_def Real_isBounded_def\n      Field_unary_minus_idef\nby (auto)\n\nsetup \"Header.record \\\"C_sym\\\"\"\n\nlemma impLemma : \"[| A; A==>B; B-->D|] ==> D\"\nby auto\n\nlemma reflLemma : \"x=y ==> x <=' y\"\nusing refl by auto\n\nlemma MS_triangle_rev :\n\"d(x, z) <=' (d(x, y) +' d(z, y))\"\nby (simp add: MS_symm)\n\nlemma EMSCB_rep_pos1 : \"rep (closedBall(x, r)) y \\<Longrightarrow> r >' 0'' \\<longrightarrow> d(x, y) <=' r\"\nby auto\n\nlemma C_id_lemma : \"!!x y xa.\n       ALL z. (EX s. rep z s & rep x s) = (EX s. rep z s & rep y s)\n       ==> rep x xa ==> rep y xa\"\napply (erule contrapos_pp)\napply (subst not_all)\napply (insert Ax4 [THEN allI, of \"%x. x\"])\napply (frule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (erule exE)+\napply (subst not_iff)\napply (case_tac \"ta >' 0''\")\napply (rule_tac x=\"closedBall(xa, half (d(za, xa) -' ta))\" in exI)\napply(auto)\napply(drule EMSCB_rep_pos1)+\napply(rule_tac P=\"d(za, xa) <=' ta\" in notE)\napply(assumption)\napply(rule half_leq)\napply(rule trans)\napply(rule conjI)\ndefer\napply(rule add_monotone)\napply(rule conjI)\napply(erule mp)\nback\napply(insert sub_leq)\napply(rule half_gt_zero)\napply(rule sub_leq)\napply(assumption+)\n\napply(rule_tac x=\"xa\" in exI)\napply simp\napply(rule EMSCB_rep_pos [THEN iffD2])\napply(rule half_gt_zero)\napply(rule sub_leq)\napply(assumption)\napply simp\napply(rule half_leq_zero)\napply(drule sub_leq)\napply(simp add: greater_def_ExtPartialOrder\n                less_def_ExtPartialOrder)\napply(rule trans)\napply(rule conjI)\ndefer\napply(rule MS_triangle_rev)\napply(rule reflLemma)\napply(rule MS_symm)\ndone\n\ntheorem C_id :\n\"ALL (x :: ClosedBall).\n ALL (y :: ClosedBall).\n (ALL (z :: ClosedBall). (z C x) = (z C y)) --> x = y\"\napply (auto simp add: C_def)\napply (rule EMSCB_rep_inj)\napply (rule ext)\napply (auto)\napply (rule_tac x=\"x\" in C_id_lemma)\napply(auto)\napply (rule_tac x=\"y\" in C_id_lemma)\napply(auto)\ndone\n\nsetup \"Header.record \\\"C_id\\\"\"\n\ntheorem C_non_triv : \"EX (x :: ClosedBall). x C x\"\napply (simp add: C_def)\napply (rule exI)+\napply (rule EMSCB_rep_pos [THEN iffD2])\napply(rule one_greater_zero)\napply(rule iffD2)\napply(rule arg_cong)\nback\nback\ndefer\napply(rule zero_leq_one)\napply auto\ndone\n\nsetup \"Header.record \\\"C_non_triv\\\"\"\n\nend\n", "meta": {"author": "spechub", "repo": "Hets-lib", "sha": "7bed416952e7000e2fa37f0b6071b5291b299b77", "save_path": "github-repos/isabelle/spechub-Hets-lib", "path": "github-repos/isabelle/spechub-Hets-lib/Hets-lib-7bed416952e7000e2fa37f0b6071b5291b299b77/RCCVerification_RCC_FO_in_MetricSpace__T.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737473266735, "lm_q2_score": 0.5, "lm_q1q2_score": 0.34128687366333677}}
{"text": "(*  Title:      HOL/Auth/NS_Shared.thy\n    Author:     Lawrence C Paulson and Giampaolo Bella\n    Copyright   1996  University of Cambridge\n*)\n\nsection\\<open>Needham-Schroeder Shared-Key Protocol\\<close>\n\ntheory NS_Shared imports Public begin\n\ntext\\<open>\nFrom page 247 of\n  Burrows, Abadi and Needham (1989).  A Logic of Authentication.\n  Proc. Royal Soc. 426\n\\<close>\n\ndefinition\n (* A is the true creator of X if she has sent X and X never appeared on\n    the trace before this event. Recall that traces grow from head. *)\n  Issues :: \"[agent, agent, msg, event list] \\<Rightarrow> bool\"\n             (\"_ Issues _ with _ on _\") where\n   \"A Issues B with X on evs =\n      (\\<exists>Y. Says A B Y \\<in> set evs \\<and> X \\<in> parts {Y} \\<and>\n        X \\<notin> parts (spies (takeWhile (\\<lambda>z. z  \\<noteq> Says A B Y) (rev evs))))\"\n\n\ninductive_set ns_shared :: \"event list set\"\n where\n        (*Initial trace is empty*)\n  Nil:  \"[] \\<in> ns_shared\"\n        (*The spy MAY say anything he CAN say.  We do not expect him to\n          invent new nonces here, but he can also use NS1.  Common to\n          all similar protocols.*)\n| Fake: \"\\<lbrakk>evsf \\<in> ns_shared;  X \\<in> synth (analz (spies evsf))\\<rbrakk>\n         \\<Longrightarrow> Says Spy B X # evsf \\<in> ns_shared\"\n\n        (*Alice initiates a protocol run, requesting to talk to any B*)\n| NS1:  \"\\<lbrakk>evs1 \\<in> ns_shared;  Nonce NA \\<notin> used evs1\\<rbrakk>\n         \\<Longrightarrow> Says A Server \\<lbrace>Agent A, Agent B, Nonce NA\\<rbrace> # evs1  \\<in>  ns_shared\"\n\n        (*Server's response to Alice's message.\n          !! It may respond more than once to A's request !!\n          Server doesn't know who the true sender is, hence the A' in\n              the sender field.*)\n| NS2:  \"\\<lbrakk>evs2 \\<in> ns_shared;  Key KAB \\<notin> used evs2;  KAB \\<in> symKeys;\n          Says A' Server \\<lbrace>Agent A, Agent B, Nonce NA\\<rbrace> \\<in> set evs2\\<rbrakk>\n         \\<Longrightarrow> Says Server A\n               (Crypt (shrK A)\n                  \\<lbrace>Nonce NA, Agent B, Key KAB,\n                    (Crypt (shrK B) \\<lbrace>Key KAB, Agent A\\<rbrace>)\\<rbrace>)\n               # evs2 \\<in> ns_shared\"\n\n         (*We can't assume S=Server.  Agent A \"remembers\" her nonce.\n           Need A \\<noteq> Server because we allow messages to self.*)\n| NS3:  \"\\<lbrakk>evs3 \\<in> ns_shared;  A \\<noteq> Server;\n          Says S A (Crypt (shrK A) \\<lbrace>Nonce NA, Agent B, Key K, X\\<rbrace>) \\<in> set evs3;\n          Says A Server \\<lbrace>Agent A, Agent B, Nonce NA\\<rbrace> \\<in> set evs3\\<rbrakk>\n         \\<Longrightarrow> Says A B X # evs3 \\<in> ns_shared\"\n\n        (*Bob's nonce exchange.  He does not know who the message came\n          from, but responds to A because she is mentioned inside.*)\n| NS4:  \"\\<lbrakk>evs4 \\<in> ns_shared;  Nonce NB \\<notin> used evs4;  K \\<in> symKeys;\n          Says A' B (Crypt (shrK B) \\<lbrace>Key K, Agent A\\<rbrace>) \\<in> set evs4\\<rbrakk>\n         \\<Longrightarrow> Says B A (Crypt K (Nonce NB)) # evs4 \\<in> ns_shared\"\n\n        (*Alice responds with Nonce NB if she has seen the key before.\n          Maybe should somehow check Nonce NA again.\n          We do NOT send NB-1 or similar as the Spy cannot spoof such things.\n          Letting the Spy add or subtract 1 lets him send all nonces.\n          Instead we distinguish the messages by sending the nonce twice.*)\n| NS5:  \"\\<lbrakk>evs5 \\<in> ns_shared;  K \\<in> symKeys;\n          Says B' A (Crypt K (Nonce NB)) \\<in> set evs5;\n          Says S  A (Crypt (shrK A) \\<lbrace>Nonce NA, Agent B, Key K, X\\<rbrace>)\n            \\<in> set evs5\\<rbrakk>\n         \\<Longrightarrow> Says A B (Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace>) # evs5 \\<in> ns_shared\"\n\n        (*This message models possible leaks of session keys.\n          The two Nonces identify the protocol run: the rule insists upon\n          the true senders in order to make them accurate.*)\n| Oops: \"\\<lbrakk>evso \\<in> ns_shared;  Says B A (Crypt K (Nonce NB)) \\<in> set evso;\n          Says Server A (Crypt (shrK A) \\<lbrace>Nonce NA, Agent B, Key K, X\\<rbrace>)\n              \\<in> set evso\\<rbrakk>\n         \\<Longrightarrow> Notes Spy \\<lbrace>Nonce NA, Nonce NB, Key K\\<rbrace> # evso \\<in> ns_shared\"\n\n\ndeclare Says_imp_knows_Spy [THEN parts.Inj, dest]\ndeclare parts.Body  [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\ndeclare analz_into_parts [dest]\n\n\ntext\\<open>A \"possibility property\": there are traces that reach the end\\<close>\nlemma \"\\<lbrakk>A \\<noteq> Server; Key K \\<notin> used []; K \\<in> symKeys\\<rbrakk>\n       \\<Longrightarrow> \\<exists>N. \\<exists>evs \\<in> ns_shared.\n                    Says A B (Crypt K \\<lbrace>Nonce N, Nonce N\\<rbrace>) \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] ns_shared.Nil\n       [THEN ns_shared.NS1, THEN ns_shared.NS2, THEN ns_shared.NS3,\n        THEN ns_shared.NS4, THEN ns_shared.NS5])\napply (possibility, simp add: used_Cons)\ndone\n\n(*This version is similar, while instantiating ?K and ?N to epsilon-terms\nlemma \"A \\<noteq> Server \\<Longrightarrow> \\<exists>evs \\<in> ns_shared.\n                Says A B (Crypt ?K \\<lbrace>Nonce ?N, Nonce ?N\\<rbrace>) \\<in> set evs\"\n*)\n\n\nsubsection\\<open>Inductive proofs about \\<^term>\\<open>ns_shared\\<close>\\<close>\n\nsubsubsection\\<open>Forwarding lemmas, to aid simplification\\<close>\n\ntext\\<open>For reasoning about the encrypted portion of message NS3\\<close>\nlemma NS3_msg_in_parts_spies:\n     \"Says S A (Crypt KA \\<lbrace>N, B, K, X\\<rbrace>) \\<in> set evs \\<Longrightarrow> X \\<in> parts (spies evs)\"\nby blast\n\ntext\\<open>For reasoning about the Oops message\\<close>\nlemma Oops_parts_spies:\n     \"Says Server A (Crypt (shrK A) \\<lbrace>NA, B, K, X\\<rbrace>) \\<in> set evs\n            \\<Longrightarrow> K \\<in> parts (spies evs)\"\nby blast\n\ntext\\<open>Theorems of the form \\<^term>\\<open>X \\<notin> parts (spies evs)\\<close> imply that NOBODY\n    sends messages containing \\<^term>\\<open>X\\<close>\\<close>\n\ntext\\<open>Spy never sees another agent's shared key! (unless it's bad at start)\\<close>\nlemma Spy_see_shrK [simp]:\n     \"evs \\<in> ns_shared \\<Longrightarrow> (Key (shrK A) \\<in> parts (spies evs)) = (A \\<in> bad)\"\napply (erule ns_shared.induct, force, drule_tac [4] NS3_msg_in_parts_spies, simp_all, blast+)\ndone\n\nlemma Spy_analz_shrK [simp]:\n     \"evs \\<in> ns_shared \\<Longrightarrow> (Key (shrK A) \\<in> analz (spies evs)) = (A \\<in> bad)\"\nby auto\n\n\ntext\\<open>Nobody can have used non-existent keys!\\<close>\nlemma new_keys_not_used [simp]:\n    \"\\<lbrakk>Key K \\<notin> used evs; K \\<in> symKeys; evs \\<in> ns_shared\\<rbrakk>\n     \\<Longrightarrow> K \\<notin> keysFor (parts (spies evs))\"\napply (erule rev_mp)\napply (erule ns_shared.induct, force, drule_tac [4] NS3_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake, NS2, NS4, NS5\\<close>\napply (force dest!: keysFor_parts_insert, blast+)\ndone\n\n\nsubsubsection\\<open>Lemmas concerning the form of items passed in messages\\<close>\n\ntext\\<open>Describes the form of K, X and K' when the Server sends this message.\\<close>\nlemma Says_Server_message_form:\n     \"\\<lbrakk>Says Server A (Crypt K' \\<lbrace>N, Agent B, Key K, X\\<rbrace>) \\<in> set evs;\n       evs \\<in> ns_shared\\<rbrakk>\n      \\<Longrightarrow> K \\<notin> range shrK \\<and>\n          X = (Crypt (shrK B) \\<lbrace>Key K, Agent A\\<rbrace>) \\<and>\n          K' = shrK A\"\nby (erule rev_mp, erule ns_shared.induct, auto)\n\n\ntext\\<open>If the encrypted message appears then it originated with the Server\\<close>\nlemma A_trusts_NS2:\n     \"\\<lbrakk>Crypt (shrK A) \\<lbrace>NA, Agent B, Key K, X\\<rbrace> \\<in> parts (spies evs);\n       A \\<notin> bad;  evs \\<in> ns_shared\\<rbrakk>\n      \\<Longrightarrow> Says Server A (Crypt (shrK A) \\<lbrace>NA, Agent B, Key K, X\\<rbrace>) \\<in> set evs\"\napply (erule rev_mp)\napply (erule ns_shared.induct, force, drule_tac [4] NS3_msg_in_parts_spies, auto)\ndone\n\nlemma cert_A_form:\n     \"\\<lbrakk>Crypt (shrK A) \\<lbrace>NA, Agent B, Key K, X\\<rbrace> \\<in> parts (spies evs);\n       A \\<notin> bad;  evs \\<in> ns_shared\\<rbrakk>\n      \\<Longrightarrow> K \\<notin> range shrK \\<and>  X = (Crypt (shrK B) \\<lbrace>Key K, Agent A\\<rbrace>)\"\nby (blast dest!: A_trusts_NS2 Says_Server_message_form)\n\ntext\\<open>EITHER describes the form of X when the following message is sent,\n  OR     reduces it to the Fake case.\n  Use \\<open>Says_Server_message_form\\<close> if applicable.\\<close>\nlemma Says_S_message_form:\n     \"\\<lbrakk>Says S A (Crypt (shrK A) \\<lbrace>Nonce NA, Agent B, Key K, X\\<rbrace>) \\<in> set evs;\n       evs \\<in> ns_shared\\<rbrakk>\n      \\<Longrightarrow> (K \\<notin> range shrK \\<and> X = (Crypt (shrK B) \\<lbrace>Key K, Agent A\\<rbrace>))\n          \\<or> X \\<in> analz (spies evs)\"\nby (blast dest: Says_imp_knows_Spy analz_shrK_Decrypt cert_A_form analz.Inj)\n\n\n(*Alternative version also provable\nlemma Says_S_message_form2:\n  \"\\<lbrakk>Says S A (Crypt (shrK A) \\<lbrace>Nonce NA, Agent B, Key K, X\\<rbrace>) \\<in> set evs;\n    evs \\<in> ns_shared\\<rbrakk>\n   \\<Longrightarrow> Says Server A (Crypt (shrK A) \\<lbrace>Nonce NA, Agent B, Key K, X\\<rbrace>) \\<in> set evs\n       \\<or> X \\<in> analz (spies evs)\"\napply (case_tac \"A \\<in> bad\")\napply (force dest!: Says_imp_knows_Spy [THEN analz.Inj])\nby (blast dest!: A_trusts_NS2 Says_Server_message_form)\n*)\n\n\n(****\n SESSION KEY COMPROMISE THEOREM.  To prove theorems of the form\n\n  Key K \\<in> analz (insert (Key KAB) (spies evs)) \\<Longrightarrow>\n  Key K \\<in> analz (spies evs)\n\n A more general formula must be proved inductively.\n****)\n\ntext\\<open>NOT useful in this form, but it says that session keys are not used\n  to encrypt messages containing other keys, in the actual protocol.\n  We require that agents should behave like this subsequently also.\\<close>\nlemma  \"\\<lbrakk>evs \\<in> ns_shared;  Kab \\<notin> range shrK\\<rbrakk> \\<Longrightarrow>\n         (Crypt KAB X) \\<in> parts (spies evs) \\<and>\n         Key K \\<in> parts {X} \\<longrightarrow> Key K \\<in> parts (spies evs)\"\napply (erule ns_shared.induct, force, drule_tac [4] NS3_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply (blast dest: parts_insert_subset_Un)\ntxt\\<open>Base, NS4 and NS5\\<close>\napply auto\ndone\n\n\nsubsubsection\\<open>Session keys are not used to encrypt other session keys\\<close>\n\ntext\\<open>The equality makes the induction hypothesis easier to apply\\<close>\n\nlemma analz_image_freshK [rule_format]:\n \"evs \\<in> ns_shared \\<Longrightarrow>\n   \\<forall>K KK. KK \\<subseteq> - (range shrK) \\<longrightarrow>\n             (Key K \\<in> analz (Key`KK \\<union> (spies evs))) =\n             (K \\<in> KK \\<or> Key K \\<in> analz (spies evs))\"\napply (erule ns_shared.induct)\napply (drule_tac [8] Says_Server_message_form)\napply (erule_tac [5] Says_S_message_form [THEN disjE], analz_freshK, spy_analz)\ntxt\\<open>NS2, NS3\\<close>\napply blast+\ndone\n\n\nlemma analz_insert_freshK:\n     \"\\<lbrakk>evs \\<in> ns_shared;  KAB \\<notin> range shrK\\<rbrakk> \\<Longrightarrow>\n       (Key K \\<in> analz (insert (Key KAB) (spies evs))) =\n       (K = KAB \\<or> Key K \\<in> analz (spies evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\n\nsubsubsection\\<open>The session key K uniquely identifies the message\\<close>\n\ntext\\<open>In messages of this form, the session key uniquely identifies the rest\\<close>\nlemma unique_session_keys:\n     \"\\<lbrakk>Says Server A (Crypt (shrK A) \\<lbrace>NA, Agent B, Key K, X\\<rbrace>) \\<in> set evs;\n       Says Server A' (Crypt (shrK A') \\<lbrace>NA', Agent B', Key K, X'\\<rbrace>) \\<in> set evs;\n       evs \\<in> ns_shared\\<rbrakk> \\<Longrightarrow> A=A' \\<and> NA=NA' \\<and> B=B' \\<and> X = X'\"\nby (erule rev_mp, erule rev_mp, erule ns_shared.induct, simp_all, blast+)\n\n\nsubsubsection\\<open>Crucial secrecy property: Spy doesn't see the keys sent in NS2\\<close>\n\ntext\\<open>Beware of \\<open>[rule_format]\\<close> and the universal quantifier!\\<close>\nlemma secrecy_lemma:\n     \"\\<lbrakk>Says Server A (Crypt (shrK A) \\<lbrace>NA, Agent B, Key K,\n                                      Crypt (shrK B) \\<lbrace>Key K, Agent A\\<rbrace>\\<rbrace>)\n              \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> ns_shared\\<rbrakk>\n      \\<Longrightarrow> (\\<forall>NB. Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs) \\<longrightarrow>\n         Key K \\<notin> analz (spies evs)\"\napply (erule rev_mp)\napply (erule ns_shared.induct, force)\napply (frule_tac [7] Says_Server_message_form)\napply (frule_tac [4] Says_S_message_form)\napply (erule_tac [5] disjE)\napply (simp_all add: analz_insert_eq analz_insert_freshK pushes split_ifs, spy_analz)\ntxt\\<open>NS2\\<close>\napply blast\ntxt\\<open>NS3\\<close>\napply (blast dest!: Crypt_Spy_analz_bad A_trusts_NS2\n             dest:  Says_imp_knows_Spy analz.Inj unique_session_keys)\ntxt\\<open>Oops\\<close>\napply (blast dest: unique_session_keys)\ndone\n\n\n\ntext\\<open>Final version: Server's message in the most abstract form\\<close>\nlemma Spy_not_see_encrypted_key:\n     \"\\<lbrakk>Says Server A (Crypt K' \\<lbrace>NA, Agent B, Key K, X\\<rbrace>) \\<in> set evs;\n       \\<forall>NB. Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n       A \\<notin> bad;  B \\<notin> bad;  evs \\<in> ns_shared\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> analz (spies evs)\"\nby (blast dest: Says_Server_message_form secrecy_lemma)\n\n\nsubsection\\<open>Guarantees available at various stages of protocol\\<close>\n\ntext\\<open>If the encrypted message appears then it originated with the Server\\<close>\nlemma B_trusts_NS3:\n     \"\\<lbrakk>Crypt (shrK B) \\<lbrace>Key K, Agent A\\<rbrace> \\<in> parts (spies evs);\n       B \\<notin> bad;  evs \\<in> ns_shared\\<rbrakk>\n      \\<Longrightarrow> \\<exists>NA. Says Server A\n               (Crypt (shrK A) \\<lbrace>NA, Agent B, Key K,\n                                 Crypt (shrK B) \\<lbrace>Key K, Agent A\\<rbrace>\\<rbrace>)\n              \\<in> set evs\"\napply (erule rev_mp)\napply (erule ns_shared.induct, force, drule_tac [4] NS3_msg_in_parts_spies, auto)\ndone\n\n\nlemma A_trusts_NS4_lemma [rule_format]:\n   \"evs \\<in> ns_shared \\<Longrightarrow>\n      Key K \\<notin> analz (spies evs) \\<longrightarrow>\n      Says Server A (Crypt (shrK A) \\<lbrace>NA, Agent B, Key K, X\\<rbrace>) \\<in> set evs \\<longrightarrow>\n      Crypt K (Nonce NB) \\<in> parts (spies evs) \\<longrightarrow>\n      Says B A (Crypt K (Nonce NB)) \\<in> set evs\"\napply (erule ns_shared.induct, force, drule_tac [4] NS3_msg_in_parts_spies)\napply (analz_mono_contra, simp_all, blast)\ntxt\\<open>NS2: contradiction from the assumptions \\<^term>\\<open>Key K \\<notin> used evs2\\<close> and\n    \\<^term>\\<open>Crypt K (Nonce NB) \\<in> parts (spies evs2)\\<close>\\<close> \napply (force dest!: Crypt_imp_keysFor)\ntxt\\<open>NS4\\<close>\napply (metis B_trusts_NS3 Crypt_Spy_analz_bad Says_imp_analz_Spy Says_imp_parts_knows_Spy analz.Fst unique_session_keys)\ndone\n\ntext\\<open>This version no longer assumes that K is secure\\<close>\nlemma A_trusts_NS4:\n     \"\\<lbrakk>Crypt K (Nonce NB) \\<in> parts (spies evs);\n       Crypt (shrK A) \\<lbrace>NA, Agent B, Key K, X\\<rbrace> \\<in> parts (spies evs);\n       \\<forall>NB. Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n       A \\<notin> bad;  B \\<notin> bad;  evs \\<in> ns_shared\\<rbrakk>\n      \\<Longrightarrow> Says B A (Crypt K (Nonce NB)) \\<in> set evs\"\nby (blast intro: A_trusts_NS4_lemma\n          dest: A_trusts_NS2 Spy_not_see_encrypted_key)\n\ntext\\<open>If the session key has been used in NS4 then somebody has forwarded\n  component X in some instance of NS4.  Perhaps an interesting property,\n  but not needed (after all) for the proofs below.\\<close>\ntheorem NS4_implies_NS3 [rule_format]:\n  \"evs \\<in> ns_shared \\<Longrightarrow>\n     Key K \\<notin> analz (spies evs) \\<longrightarrow>\n     Says Server A (Crypt (shrK A) \\<lbrace>NA, Agent B, Key K, X\\<rbrace>) \\<in> set evs \\<longrightarrow>\n     Crypt K (Nonce NB) \\<in> parts (spies evs) \\<longrightarrow>\n     (\\<exists>A'. Says A' B X \\<in> set evs)\"\napply (erule ns_shared.induct, force)\napply (drule_tac [4] NS3_msg_in_parts_spies)\napply analz_mono_contra\napply (simp_all add: ex_disj_distrib, blast)\ntxt\\<open>NS2\\<close>\napply (blast dest!: new_keys_not_used Crypt_imp_keysFor)\ntxt\\<open>NS4\\<close>\napply (metis B_trusts_NS3 Crypt_Spy_analz_bad Says_imp_analz_Spy Says_imp_parts_knows_Spy analz.Fst unique_session_keys)\ndone\n\n\nlemma B_trusts_NS5_lemma [rule_format]:\n  \"\\<lbrakk>B \\<notin> bad;  evs \\<in> ns_shared\\<rbrakk> \\<Longrightarrow>\n     Key K \\<notin> analz (spies evs) \\<longrightarrow>\n     Says Server A\n          (Crypt (shrK A) \\<lbrace>NA, Agent B, Key K,\n                            Crypt (shrK B) \\<lbrace>Key K, Agent A\\<rbrace>\\<rbrace>) \\<in> set evs \\<longrightarrow>\n     Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace> \\<in> parts (spies evs) \\<longrightarrow>\n     Says A B (Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace>) \\<in> set evs\"\napply (erule ns_shared.induct, force)\napply (drule_tac [4] NS3_msg_in_parts_spies)\napply (analz_mono_contra, simp_all, blast)\ntxt\\<open>NS2\\<close>\napply (blast dest!: new_keys_not_used Crypt_imp_keysFor)\ntxt\\<open>NS5\\<close>\napply (blast dest!: A_trusts_NS2\n             dest: Says_imp_knows_Spy [THEN analz.Inj]\n                   unique_session_keys Crypt_Spy_analz_bad)\ndone\n\n\ntext\\<open>Very strong Oops condition reveals protocol's weakness\\<close>\nlemma B_trusts_NS5:\n     \"\\<lbrakk>Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace> \\<in> parts (spies evs);\n       Crypt (shrK B) \\<lbrace>Key K, Agent A\\<rbrace> \\<in> parts (spies evs);\n       \\<forall>NA NB. Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n       A \\<notin> bad;  B \\<notin> bad;  evs \\<in> ns_shared\\<rbrakk>\n      \\<Longrightarrow> Says A B (Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace>) \\<in> set evs\"\nby (blast intro: B_trusts_NS5_lemma\n          dest: B_trusts_NS3 Spy_not_see_encrypted_key)\n\ntext\\<open>Unaltered so far wrt original version\\<close>\n\nsubsection\\<open>Lemmas for reasoning about predicate \"Issues\"\\<close>\n\nlemma spies_Says_rev: \"spies (evs @ [Says A B X]) = insert X (spies evs)\"\napply (induct_tac \"evs\")\napply (rename_tac [2] a b)\napply (induct_tac [2] \"a\", auto)\ndone\n\nlemma spies_Gets_rev: \"spies (evs @ [Gets A X]) = spies evs\"\napply (induct_tac \"evs\")\napply (rename_tac [2] a b)\napply (induct_tac [2] \"a\", auto)\ndone\n\nlemma spies_Notes_rev: \"spies (evs @ [Notes A X]) =\n          (if A\\<in>bad then insert X (spies evs) else spies evs)\"\napply (induct_tac \"evs\")\napply (rename_tac [2] a b)\napply (induct_tac [2] \"a\", auto)\ndone\n\nlemma spies_evs_rev: \"spies evs = spies (rev evs)\"\napply (induct_tac \"evs\")\napply (rename_tac [2] a b)\napply (induct_tac [2] \"a\")\napply (simp_all (no_asm_simp) add: spies_Says_rev spies_Gets_rev spies_Notes_rev)\ndone\n\nlemmas parts_spies_evs_revD2 = spies_evs_rev [THEN equalityD2, THEN parts_mono]\n\nlemma spies_takeWhile: \"spies (takeWhile P evs) \\<subseteq> spies evs\"\napply (induct_tac \"evs\")\napply (rename_tac [2] a b)\napply (induct_tac [2] \"a\", auto)\ntxt\\<open>Resembles \\<open>used_subset_append\\<close> in theory Event.\\<close>\ndone\n\nlemmas parts_spies_takeWhile_mono = spies_takeWhile [THEN parts_mono]\n\n\nsubsection\\<open>Guarantees of non-injective agreement on the session key, and\nof key distribution. They also express forms of freshness of certain messages,\nnamely that agents were alive after something happened.\\<close>\n\nlemma B_Issues_A:\n     \"\\<lbrakk> Says B A (Crypt K (Nonce Nb)) \\<in> set evs;\n         Key K \\<notin> analz (spies evs);\n         A \\<notin> bad;  B \\<notin> bad; evs \\<in> ns_shared \\<rbrakk>\n      \\<Longrightarrow> B Issues A with (Crypt K (Nonce Nb)) on evs\"\nunfolding Issues_def\napply (rule exI)\napply (rule conjI, assumption)\napply (simp (no_asm))\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule ns_shared.induct, analz_mono_contra)\napply (simp_all)\ntxt\\<open>fake\\<close>\napply blast\napply (simp_all add: takeWhile_tail)\ntxt\\<open>NS3 remains by pure coincidence!\\<close>\napply (force dest!: A_trusts_NS2 Says_Server_message_form)\ntxt\\<open>NS4 would be the non-trivial case can be solved by Nb being used\\<close>\napply (blast dest: parts_spies_takeWhile_mono [THEN subsetD]\n                   parts_spies_evs_revD2 [THEN subsetD])\ndone\n\ntext\\<open>Tells A that B was alive after she sent him the session key.  The\nsession key must be assumed confidential for this deduction to be meaningful,\nbut that assumption can be relaxed by the appropriate argument.\n\nPrecisely, the theorem guarantees (to A) key distribution of the session key\nto B. It also guarantees (to A) non-injective agreement of B with A on the\nsession key. Both goals are available to A in the sense of Goal Availability.\n\\<close>\nlemma A_authenticates_and_keydist_to_B:\n     \"\\<lbrakk>Crypt K (Nonce NB) \\<in> parts (spies evs);\n       Crypt (shrK A) \\<lbrace>NA, Agent B, Key K, X\\<rbrace> \\<in> parts (spies evs);\n       Key K \\<notin> analz(knows Spy evs);\n       A \\<notin> bad;  B \\<notin> bad;  evs \\<in> ns_shared\\<rbrakk>\n      \\<Longrightarrow> B Issues A with (Crypt K (Nonce NB)) on evs\"\nby (blast intro: A_trusts_NS4_lemma B_Issues_A dest: A_trusts_NS2)\n\nlemma A_trusts_NS5:\n  \"\\<lbrakk> Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace> \\<in> parts(spies evs);\n     Crypt (shrK A) \\<lbrace>Nonce NA, Agent B, Key K, X\\<rbrace> \\<in> parts(spies evs);\n     Key K \\<notin> analz (spies evs);\n     A \\<notin> bad; B \\<notin> bad; evs \\<in> ns_shared \\<rbrakk>\n \\<Longrightarrow> Says A B (Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace>) \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule ns_shared.induct, analz_mono_contra)\napply (simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>NS2\\<close>\napply (force dest!: Crypt_imp_keysFor)\ntxt\\<open>NS3\\<close>\napply (metis NS3_msg_in_parts_spies parts_cut_eq)\ntxt\\<open>NS5, the most important case, can be solved by unicity\\<close>\napply (metis A_trusts_NS2 Crypt_Spy_analz_bad Says_imp_analz_Spy Says_imp_parts_knows_Spy analz.Fst analz.Snd unique_session_keys)\ndone\n\nlemma A_Issues_B:\n     \"\\<lbrakk> Says A B (Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace>) \\<in> set evs;\n        Key K \\<notin> analz (spies evs);\n        A \\<notin> bad;  B \\<notin> bad; evs \\<in> ns_shared \\<rbrakk>\n    \\<Longrightarrow> A Issues B with (Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace>) on evs\"\nunfolding Issues_def\napply (rule exI)\napply (rule conjI, assumption)\napply (simp (no_asm))\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule ns_shared.induct, analz_mono_contra)\napply (simp_all)\ntxt\\<open>fake\\<close>\napply blast\napply (simp_all add: takeWhile_tail)\ntxt\\<open>NS3 remains by pure coincidence!\\<close>\napply (force dest!: A_trusts_NS2 Says_Server_message_form)\ntxt\\<open>NS5 is the non-trivial case and cannot be solved as in \\<^term>\\<open>B_Issues_A\\<close>! because NB is not fresh. We need \\<^term>\\<open>A_trusts_NS5\\<close>, proved for this very purpose\\<close>\napply (blast dest: A_trusts_NS5 parts_spies_takeWhile_mono [THEN subsetD]\n        parts_spies_evs_revD2 [THEN subsetD])\ndone\n\ntext\\<open>Tells B that A was alive after B issued NB.\n\nPrecisely, the theorem guarantees (to B) key distribution of the session key to A. It also guarantees (to B) non-injective agreement of A with B on the session key. Both goals are available to B in the sense of Goal Availability.\n\\<close>\nlemma B_authenticates_and_keydist_to_A:\n     \"\\<lbrakk>Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace> \\<in> parts (spies evs);\n       Crypt (shrK B) \\<lbrace>Key K, Agent A\\<rbrace> \\<in> parts (spies evs);\n       Key K \\<notin> analz (spies evs);\n       A \\<notin> bad;  B \\<notin> bad;  evs \\<in> ns_shared\\<rbrakk>\n   \\<Longrightarrow> A Issues B with (Crypt K \\<lbrace>Nonce NB, Nonce NB\\<rbrace>) on evs\"\nby (blast intro: A_Issues_B B_trusts_NS5_lemma dest: B_trusts_NS3)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/NS_Shared.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7279754489059774, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.34126806686115424}}
{"text": "theory Refine_Reachability_Analysis_C1\n  imports\n    Abstract_Reachability_Analysis_C1\n    Refine_Reachability_Analysis\nbegin\n\nlemma fst_flow1_of_vec1[simp]: \"fst (flow1_of_vec1 x) = fst x\"\n  by (auto simp: flow1_of_vec1_def)\n\nlemma fst_vec1_of_flow[simp]: \"fst (vec1_of_flow1 x) = fst x\"\n  by (auto simp: vec1_of_flow1_def)\n\ncontext approximate_sets_ode'\nbegin\n\nlemma poincare_mapsto_scaleR2I:\n  \"poincare_mapsto P (scaleR2 x1 x2 baa) UNIV x1b (scaleR2 x1 x2 aca)\"\n  if \"poincare_mapsto P (baa) UNIV x1b (aca)\"\n  using that\n  apply (auto simp: poincare_mapsto_def scaleR2_def image_def vimage_def)\n  apply (drule bspec, assumption)\n  apply auto\n  apply (rule exI, rule conjI, assumption)\n  apply (rule exI, rule conjI, assumption, rule conjI, assumption)\n  apply (rule bexI) prefer 2 apply assumption\n  apply (auto simp: scaleR_blinfun_compose_right)\n  done\n\ncontext includes ode_ops.lifting begin\nlemma var_safe_form_eq[simp]: \"var.safe_form = safe_form\"\n  unfolding var.safe_form_def\n  by transfer (auto simp: var_ode_ops_def safe_form_def)\n\nlemma var_ode_e: \"var.ode_e = ode_e'\"\n  unfolding var.ode_e_def\n  by transfer (auto simp: var_ode_ops_def)\nend\n\nlemma wd_imp_var_wd[refine_vcg, intro]: \"wd (TYPE('n rvec)) \\<Longrightarrow> var.wd (TYPE('n::enum vec1))\"\n  unfolding var.wd_def\n  by (auto simp: wd_def length_concat o_def sum_list_distinct_conv_sum_set\n      concat_map_map_index var_ode_e D_def ode_e'_def\n      intro!: max_Var_floatariths_mmult_fa[le] max_Var_floatariths_mapI\n      max_Var_floatarith_FDERIV_floatarith[le]\n      max_Var_floatariths_fold_const_fa[le]\n      max_Var_floatarith_le_max_Var_floatariths_nthI\n      max_Var_floatariths_list_updateI max_Var_floatariths_replicateI)\n\nlemma safe_eq:\n  assumes \"wd TYPE('n::enum rvec)\"\n  shows \"var.Csafe = ((Csafe \\<times> UNIV)::'n vec1 set)\"\n  using assms var.wdD[OF wd_imp_var_wd[OF assms]] wdD[OF assms]\n  unfolding var.safe_def safe_def var.wd_def wd_def var.Csafe_def Csafe_def\n  unfolding ode_e'_def var_ode_e\n  apply (auto simp: D_def)\n  subgoal\n    apply (subst interpret_form_max_Var_cong) prefer 2 apply assumption\n    by (auto simp: nth_Basis_list_prod)\n  subgoal for a b\n    apply (drule isFDERIV_appendD1)\n        apply simp apply simp apply (auto intro!: max_Var_floatariths_fold_const_fa[le])[]\n    apply (rule isFDERIV_max_Var_congI, assumption)\n    by (auto simp: nth_Basis_list_prod)\n  subgoal\n    apply (subst interpret_form_max_Var_cong) prefer 2 apply assumption\n    by (auto simp: nth_Basis_list_prod)\n  subgoal for a b\n    apply (rule isFDERIV_appendI1)\n    apply (rule isFDERIV_max_Var_congI, assumption)\n        apply (auto simp: nth_Basis_list_prod)\n     apply (auto simp: isFDERIV_def FDERIV_floatariths_def in_set_conv_nth isDERIV_inner_iff\n      length_concat o_def sum_list_distinct_conv_sum_set concat_map_map_index\n        intro!: isDERIV_FDERIV_floatarith isDERIV_mmult_fa_nth)\n     apply (rule isDERIV_max_Var_floatarithI[where ys=\"list_of_eucl a\"])\n    subgoal for i j k\n      apply (cases \"i < CARD('n)\")\n      subgoal by auto\n      subgoal apply (rule isDERIV_max_VarI)\n         apply (rule max_Var_floatarith_le_max_Var_floatariths_nthI)\n          apply force\n         apply auto\n        done\n      done\n    subgoal for i j k l by (auto dest!: max_Var_floatariths_lessI simp: nth_Basis_list_prod)\n    subgoal by (auto simp: nth_list_update)\n    done\n  done\n\nlemma\n  var_ode_eq:\n  fixes x::\"'n::enum vec1\"\n  assumes \"wd TYPE('n rvec)\" and [simp]: \"(fst x) \\<in> Csafe\"\n  shows \"var.ode x = (ode (fst x), matrix (ode_d1 (fst x)) ** snd x)\"\nproof -\n  have \"interpret_floatariths ode_e (list_of_eucl x) =\n    interpret_floatariths ode_e (list_of_eucl (fst x))\"\n    apply (rule interpret_floatariths_max_Var_cong)\n    using wdD[OF \\<open>wd _\\<close>]\n    by (auto simp: list_of_eucl_nth_if nth_Basis_list_prod inner_prod_def)\n  moreover\n  have \"eucl_of_list\n            (interpret_floatariths\n              (mmult_fa D D D\n       (concat (map (\\<lambda>j. map (\\<lambda>i. FDERIV_floatarith (ode_e ! j) [0..<D] ((replicate D 0)[i := 1])) [0..<D]) [0..<D]))\n       (map floatarith.Var [D..<D + D * D])) (list_of_eucl x)) =\n    matrix (blinfun_apply (ode_d 0 (fst x) 0)) ** snd x\"\n    unfolding matrix_eq\n    apply auto\n    apply (subst matrix_vector_mul_assoc[symmetric])\n    apply (subst matrix_works)\n    subgoal by (auto simp: linear_matrix_vector_mul_eq\n          intro!: bounded_linear.linear blinfun.bounded_linear_right)\n    apply (subst einterpret_mmult_fa[where 'n='n and 'm = 'n and 'l='n])\n    subgoal by (simp add: wdD[OF \\<open>wd _\\<close>])\n    subgoal by (simp add: length_concat o_def sum_list_distinct_conv_sum_set wdD[OF \\<open>wd _\\<close>])\n    subgoal by (simp add: length_concat o_def sum_list_distinct_conv_sum_set wdD[OF \\<open>wd _\\<close>])\n    subgoal for v\n    proof -\n      have v: \"einterpret (map floatarith.Var [D..<D + D * D]) (list_of_eucl x) *v v = snd x *v v\"\n        apply (vector matrix_vector_mult_def)\n        apply (simp add: vec_nth_eq_list_of_eucl2 wdD[OF \\<open>wd _\\<close>])\n        apply (auto simp: vec_nth_eq_list_of_eucl1 sum_index_enum_eq)\n        apply (subst sum_index_enum_eq)+\n        apply (rule sum.cong)\n        by (auto simp: nth_Basis_list_prod prod_eq_iff inner_prod_def)\n      show ?thesis\n        unfolding matrix_vector_mul_assoc[symmetric]\n        apply (subst v)\n        apply (auto simp: concat_map_map_index vec_nth_eq_list_of_eucl2)\n        apply (subst  eucl_of_list_list_of_eucl[of \"snd x *v v\", symmetric])\n        apply (subst (2) eucl_of_list_list_of_eucl[of \"snd x *v v\", symmetric])\n        apply (subst eucl_of_list_matrix_vector_mult_eq_sum_nth_Basis_list)\n        subgoal by (simp add: length_concat o_def sum_list_distinct_conv_sum_set wdD[OF \\<open>wd _\\<close>])\n        subgoal by simp\n        apply (subst blinfun_apply_eq_sum)\n         apply (auto simp: vec_nth_eq_list_of_eucl1 sum_index_enum_eq)\n        apply (auto simp: scaleR_sum_left ode_d.rep_eq intro!: sum.cong[OF refl])\n        apply (auto simp: ode_d_raw_def wdD[OF \\<open>wd _\\<close>] eucl_of_list_inner )\n        apply (auto simp: ode_d_expr_def FDERIV_floatariths_def wdD[OF \\<open>wd _\\<close>] )\n        apply (rule interpret_floatarith_FDERIV_floatarith_cong)\n        subgoal for x y i\n          using wdD[OF \\<open>wd _\\<close>]\n          by (auto simp add: nth_append inner_prod_def\n              nth_Basis_list_prod dest!: max_Var_floatariths_lessI)\n        subgoal by auto\n        subgoal by auto\n        subgoal\n          apply (auto simp: wdD[OF \\<open>wd _\\<close>] nth_list_update inner_Basis intro!: nth_equalityI)\n          by (metis \\<open>length (list_of_eucl (snd x *v v)) = CARD('n)\\<close> index_Basis_list_nth length_list_of_eucl)\n        done\n    qed\n    done\n  ultimately show ?thesis\n    unfolding var.ode_def ode_def\n    unfolding ode_e'_def var_ode_e\n    by (auto simp: wdD[OF \\<open>wd _\\<close>] ode_d1_def intro!: euclidean_eqI[where 'a=\"'n vec1\"])\nqed\n\nlemma var_existence_ivl_imp_existence_ivl:\n  fixes x::\"'n::enum vec1\"\n  assumes wd: \"wd TYPE('n rvec)\"\n  assumes t: \"t \\<in> var.existence_ivl0 x\"\n  shows \"t \\<in> existence_ivl0 (fst x)\"\nproof (rule existence_ivl_maximal_segment)\n  from var.flow_solves_ode[OF UNIV_I var.mem_existence_ivl_iv_defined(2), OF t]\n  have D: \"(var.flow0 x solves_ode (\\<lambda>_. var.ode)) {0--t} (var.Csafe)\"\n    apply (rule solves_ode_on_subset)\n     apply (rule var.closed_segment_subset_existence_ivl)\n     apply (rule t)\n    apply simp\n    done\n  show \"((\\<lambda>t. fst (var.flow0 x t)) solves_ode (\\<lambda>_. ode)) {0--t} (Csafe)\"\n    using var.closed_segment_subset_existence_ivl[OF t]\n    apply (auto simp: has_vderiv_on_def has_vector_derivative_def subset_iff\n        intro!: solves_odeI derivative_eq_intros)\n        apply (rule refl)\n       apply (rule refl)\n      apply (rule refl)\n     apply (auto simp: var.flowderiv_def )\n     apply (subst var_ode_eq[OF wd(1)])\n      apply (auto simp: blinfun.bilinear_simps)\n    subgoal for s\n      using solves_odeD(2)[OF D, of s]\n      by (subst(asm) (3) safe_eq[OF wd]) (auto )\n    subgoal for s\n      using solves_odeD(2)[OF D, of s]\n      by (subst(asm) (3) safe_eq[OF wd]) (auto )\n    done\nnext\n  show \"fst (var.flow0 x 0) = fst x\"\n    apply (subst var.flow_initial_time)\n      apply simp\n    apply (rule var.mem_existence_ivl_iv_defined[OF t])\n    apply auto\n    done\nqed simp\n\nlemma existence_ivl_imp_var_existence_ivl:\n  fixes x::\"'n::enum rvec\"\n  assumes wd: \"wd TYPE('n rvec)\"\n  assumes t: \"t \\<in> existence_ivl0 x\"\n  shows \"t \\<in> var.existence_ivl0 ((x, W)::'n vec1)\"\nproof (rule var.existence_ivl_maximal_segment)\n  from flow_solves_ode[OF UNIV_I mem_existence_ivl_iv_defined(2), OF t]\n  have D: \"(flow0 x solves_ode (\\<lambda>_. ode)) {0--t} (Csafe)\"\n    apply (rule solves_ode_on_subset)\n     apply (rule closed_segment_subset_existence_ivl)\n     apply (rule t)\n    apply simp\n    done\n  show \"((\\<lambda>t. (flow0 x t, matrix (Dflow x t) ** W)) solves_ode (\\<lambda>_. var.ode)) {0--t} (var.Csafe)\"\n    using closed_segment_subset_existence_ivl[OF t]\n    apply (auto simp: has_vderiv_on_def has_vector_derivative_def subset_iff\n        intro!: solves_odeI derivative_eq_intros)\n        apply (rule refl)\n        apply (rule refl)\n        apply (rule refl)\n       apply (rule has_derivative_at_withinI)\n       apply (rule Dflow_has_derivative)\n       apply force\n      apply (rule refl)\n     apply (auto simp: flowderiv_def )\n     apply (subst var_ode_eq)\n     apply (auto simp: blinfun.bilinear_simps matrix_blinfun_compose wd\n        intro!: ext)\n    subgoal for s h\n      unfolding matrix_scaleR matrix_blinfun_compose matrix_mul_assoc matrix_scaleR_right ..\n    subgoal for s\n      using solves_odeD(2)[OF D, of s] safe_eq[OF wd]\n      by auto\n    done\nnext\n  have \"x \\<in> Csafe\" by rule fact\n  then show \"(flow0 x 0, matrix (blinfun_apply (Dflow x 0)) ** W) = (x, W)\"\n    apply (auto )\n    apply (vector matrix_def matrix_matrix_mult_def axis_def)\n    by (auto simp:  if_distrib if_distribR cong: if_cong)\nqed auto\n\ntheorem var_existence_ivl0_eq_existence_ivl0:\n  fixes x::\"'n::enum vec1\"\n  assumes wd: \"wd TYPE('n rvec)\"\n  shows \"var.existence_ivl0 (x::'n vec1) = existence_ivl0 (fst x)\"\n  apply safe\n  subgoal by (rule var_existence_ivl_imp_existence_ivl[OF wd, of _ \"x\", simplified], simp)\n  subgoal\n    by (rule existence_ivl_imp_var_existence_ivl[OF wd, of _ \"fst x\" \"snd x\", unfolded prod.collapse])\n  done\n\ntheorem var_flow_eq_flow_Dflow:\n  fixes x::\"'n::enum vec1\"\n  assumes wd: \"wd TYPE('n rvec)\"\n  assumes t: \"t \\<in> var.existence_ivl0 x\"\n  shows \"var.flow0 x t = vec1_of_flow1 (flow0 (fst x) t, Dflow (fst x) t o\\<^sub>L blinfun_of_vmatrix (snd x)) \"\nproof -\n  have x: \"x \\<in> var.Csafe\"\n    by (rule var.mem_existence_ivl_iv_defined[OF t])\n  then have \"fst x \\<in> Csafe\"\n    by (subst (asm) safe_eq[OF wd]) auto\n  then have sx[simp]: \"(fst x) \\<in> Csafe\" by simp\n  show ?thesis\n  proof (rule var.flow_unique_on[OF t])\n    show \"vec1_of_flow1 (flow0 (fst x) 0, Dflow (fst x) 0 o\\<^sub>L blinfun_of_vmatrix (snd x)) = x\"\n      by (auto simp: vec1_of_flow1_def x)\n    show \"((\\<lambda>a. vec1_of_flow1 (flow0 (fst x) a, Dflow (fst x) a o\\<^sub>L blinfun_of_vmatrix (snd x))) has_vderiv_on\n     (\\<lambda>t. var.ode (vec1_of_flow1 (flow0 (fst x) t, Dflow (fst x) t o\\<^sub>L blinfun_of_vmatrix (snd x)))))\n     (var.existence_ivl0 x)\"\n      apply (auto simp: has_vderiv_on_def has_vector_derivative_def vec1_of_flow1_def\n          at_within_open[OF _ var.open_existence_ivl] flowderiv_def\n          intro!: derivative_eq_intros var_existence_ivl_imp_existence_ivl[OF wd]\n          Dflow_has_derivative ext)\n      apply (subst var_ode_eq[OF wd(1)])\n       apply (auto simp: blinfun.bilinear_simps)\n      subgoal for t\n        using flow_in_domain[of t \"fst x\"]\n        by (simp add: var_existence_ivl_imp_existence_ivl[OF wd])\n      subgoal for t h\n        by (simp add: matrix_blinfun_compose matrix_scaleR matrix_mul_assoc matrix_scaleR_right)\n      done\n    fix t\n    assume \"t \\<in> var.existence_ivl0 x\"\n    then show \"vec1_of_flow1 (flow0 (fst x) t, Dflow (fst x) t o\\<^sub>L blinfun_of_vmatrix (snd x)) \\<in> var.Csafe\"\n      by (subst safe_eq[OF wd])\n        (auto simp: vec1_of_flow1_def dest!: var_existence_ivl_imp_existence_ivl[OF wd]\n          flow_in_domain)\n  qed\nqed\n\ntheorem flow_Dflow_eq_var_flow:\n  fixes x::\"'n::enum rvec\"\n  assumes wd: \"wd TYPE('n rvec)\"\n  assumes t: \"t \\<in> existence_ivl0 x\"\n  shows \"(flow0 x t, Dflow x t o\\<^sub>L W) = flow1_of_vec1 (var.flow0 (x, matrix W) t::'n vec1)\"\n  using var_flow_eq_flow_Dflow[OF wd existence_ivl_imp_var_existence_ivl[OF wd t]]\n  unfolding var_flow_eq_flow_Dflow[OF wd existence_ivl_imp_var_existence_ivl[OF wd t]]\n  by (auto simp: flow1_of_vec1_def vec1_of_flow1_def)\n\ncontext includes blinfun.lifting begin\nlemma flow1_of_vec1_vec1_of_flow1[simp]:\n  \"flow1_of_vec1 (vec1_of_flow1 X) = X\"\n  unfolding vec1_of_flow1_def flow1_of_vec1_def\n  by (transfer) auto\nend\n\nlemma\n  var_flowpipe0_flowpipe:\n  assumes wd: \"wd TYPE('n::enum rvec)\"\n  assumes \"var.flowpipe0 X0 hl hu (CX) X1\"\n  assumes \"fst ` X0 \\<subseteq> Csafe\"\n  assumes \"fst ` CX \\<subseteq> Csafe\"\n  assumes \"fst ` X1 \\<subseteq> Csafe\"\n  shows \"flowpipe (flow1_of_vec1 ` X0) hl hu (flow1_of_vec1 ` (CX::'n vec1 set)) (flow1_of_vec1 ` X1)\"\n  using assms\n  unfolding flowpipe_def var.flowpipe0_def\n  apply safe\n  subgoal by (auto simp add: flow1_of_vec1_def vec1_of_flow1_def safe_eq[OF wd])\n  subgoal by (auto simp add: flow1_of_vec1_def vec1_of_flow1_def safe_eq[OF wd])\n  subgoal by (auto simp add: flow1_of_vec1_def vec1_of_flow1_def safe_eq[OF wd])\n  subgoal for x W y V h\n    apply (drule bspec[where x=\"(y, V)\"], force)\n    apply (drule bspec, assumption)\n    by (simp add: var_existence_ivl0_eq_existence_ivl0[OF wd] flow1_of_vec1_def)\n  subgoal for x W y V h\n    apply (drule bspec[where x=\"(y, V)\"], force)\n    apply (drule bspec, assumption)\n    apply (subst flow_Dflow_eq_var_flow[OF wd],\n        force simp: var_existence_ivl0_eq_existence_ivl0[OF wd] flow1_of_vec1_def)\n    apply (rule imageI)\n    by (simp add: vec1_of_flow1_def flow1_of_vec1_def)\n  subgoal for x W y V h h'\n    apply (drule bspec[where x=\"vec1_of_flow1 (x, W)\"], force)\n    apply (drule bspec, assumption)\n    apply (subst flow_Dflow_eq_var_flow[OF wd])\n     apply (subst (asm) var_existence_ivl0_eq_existence_ivl0[OF wd])\n     apply (simp add: flow1_of_vec1_def)\n    subgoal\n      by (meson local.existence_ivl_initial_time local.mem_existence_ivl_iv_defined(1)\n          local.mem_existence_ivl_iv_defined(2) mem_is_interval_1_I mvar.interval)\n    subgoal\n      apply (rule imageI)\n      by (simp add: vec1_of_flow1_def flow1_of_vec1_def)\n    done\n  done\n\ntheorem einterpret_solve_poincare_fas:\n  assumes wd: \"wd TYPE('n rvec)\"\n  assumes \"length CXs = D + D*D\" \"n < D\"\n  assumes nz: \"ode (fst (eucl_of_list CXs::'n vec1)) \\<bullet> Basis_list ! n \\<noteq> 0\"\n  shows\n  \"flow1_of_vec1 (einterpret (solve_poincare_fas n) CXs::'n::enum vec1) =\n  (let (x, d) = flow1_of_vec1 (eucl_of_list CXs::'n vec1) in (x,\n     d - (blinfun_scaleR_left (ode (x)) o\\<^sub>L\n    (blinfun_scaleR_left (inverse (ode x \\<bullet> Basis_list ! n)) o\\<^sub>L (blinfun_inner_left (Basis_list ! n) o\\<^sub>L d)))))\"\n  using assms\n  apply (auto intro!: simp: flow1_of_vec1_def solve_poincare_fas_def)\n  subgoal\n    apply (auto intro!: euclidean_eqI[where 'a=\"'n rvec\"])\n    apply (subst eucl_of_list_prod)\n    by (auto simp: eucl_of_list_prod length_concat o_def sum_list_distinct_conv_sum_set D_def Let_def\n        wdD[OF wd] take_eq_map_nth)\n  subgoal premises prems\n  proof -\n    have ode_e_eq: \"interpret_floatarith (ode_e ! i) (map ((!) CXs) [0..<CARD('n)]) = interpret_floatarith (ode_e ! i) CXs\"\n      if \"i < D\"\n      for i\n      apply (rule interpret_floatarith_max_Var_cong)\n      apply (drule max_Var_floatariths_lessI)\n      using that apply (simp add: wdD[OF wd])\n      apply (subst nth_map)\n       apply auto\n      using wdD[OF wd]\n      apply (simp add: )\n      using wdD[OF wd]\n      apply (simp add: )\n      done\n    define z where \"z = (0::float)\"\n    show ?thesis\n      supply [simp] = snd_eucl_of_list_prod fst_eucl_of_list_prod\n      supply [simp del] = eucl_of_list_take_DIM\n      using prems unfolding z_def[symmetric] D_def Let_def\n      including blinfun.lifting\n      apply (transfer fixing: CXs n z)\n      unfolding z_def\n      apply (auto simp: o_def ode_def intro!: ext)\n      apply (vector matrix_vector_mult_def )\n      apply (auto intro!: blinfun_euclidean_eqI simp: inner_Basis_eq_vec_nth wdD[OF wd])\n      apply (auto simp: length_concat o_def sum_list_distinct_conv_sum_set wdD[OF wd] take_eq_map_nth)\n      apply (auto simp: concat_map_map_index)\n      apply (vector )\n      apply (subst vec_nth_eq_list_of_eucl2 vec_nth_eq_list_of_eucl1)+\n      apply (subst (asm) vec_nth_eq_list_of_eucl2 vec_nth_eq_list_of_eucl1)+\n      apply (simp add: less_imp_le wdD[OF wd] index_nth_id )\n      apply (auto simp: algebra_simps ode_e_eq wdD[OF wd] divide_simps)\n      done\n  qed\n  done\n\nlemma choose_step'_flowpipe:\n  assumes wd[refine_vcg]: \"wd TYPE('n::enum rvec)\"\n  assumes safe: \"fst ` X0 \\<subseteq> Csafe\"\n  shows \"var.choose_step (X0::'n vec1 set) h \\<le> SPEC (\\<lambda>(h', _, RES_ivl, RES::'n vec1 set).\n      0 < h' \\<and> h' \\<le> h \\<and> flowpipe (flow1_of_vec1 ` X0) h' h' (flow1_of_vec1 ` RES_ivl) (flow1_of_vec1 ` RES))\"\n  apply refine_vcg\n  apply (auto simp: )\n  apply (frule var.flowpipe0_safeD)\n  apply (drule var_flowpipe0_flowpipe[rotated])\n  by (auto simp: safe_eq wd)\n\nlemma max_Var_floatariths_solve_poincare_fas[le]:\n  assumes wd: \"wd (TYPE('n::enum rvec))\"\n  shows \"i < D \\<Longrightarrow> max_Var_floatariths (solve_poincare_fas i) \\<le> D + D * D\"\n  by (auto simp: solve_poincare_fas_def concat_map_map_index Let_def\n      intro!: max_Var_floatariths_leI Suc_leI)\n   (auto intro!: max_Var_floatarith_le_max_Var_floatariths_nthI max_Var_floatariths_ode_e_wd[OF wd]\n      simp: wdD[OF wd])\n\nlemma length_solve_poincare_fas[simp]: \"length (solve_poincare_fas n) = D + D * D\"\n  by (auto simp: solve_poincare_fas_def length_concat o_def sum_list_distinct_conv_sum_set D_def Let_def)\n\ntheorem interpret_floatariths_solve_poincare_fas:\n  assumes wd: \"wd TYPE('n::enum rvec)\"\n  assumes \"length CXs = D + D*D\" \"n < D\"\n  assumes nz: \"ode (fst (eucl_of_list CXs::'n vec1)) \\<bullet> Basis_list ! n \\<noteq> 0\"\n  shows\n  \"interpret_floatariths (solve_poincare_fas n) CXs =\n    list_of_eucl (vec1_of_flow1 (let (x, d) = flow1_of_vec1 (eucl_of_list CXs::'n vec1) in (x,\n       d - (blinfun_scaleR_left (ode (x)) o\\<^sub>L\n      (blinfun_scaleR_left (inverse (ode x \\<bullet> Basis_list ! n)) o\\<^sub>L (blinfun_inner_left (Basis_list ! n) o\\<^sub>L d))))))\"\n  using arg_cong[where f=\"list_of_eucl::'n vec1 \\<Rightarrow> _\", OF arg_cong[where f=vec1_of_flow1, OF einterpret_solve_poincare_fas[OF assms]]]\n  apply (auto simp: )\n  apply (subst (asm) list_of_eucl_eucl_of_list)\n   apply (auto simp: )\n  apply (auto simp: wdD[OF wd])\n  done\n\nlemma length_solve_poincare_slp[simp]: \"length solve_poincare_slp = D\"\n  by (auto simp: solve_poincare_slp_def)\n\nlemma ne_zero_lemma:\n  assumes\n    \"ode ` fst ` CX \\<subseteq> FC\"\n   \"\\<forall>b\\<in>FC. b \\<bullet> n \\<noteq> 0\"\n   \"(a, b) \\<in> CX\"\n   \"ode a \\<bullet> n = 0\"\n shows \"False\"\nproof -\n  have \"(a, b) \\<in> CX\" by fact\n  then have \"ode (fst (a, b)) \\<in> ode ` fst ` CX\" by blast\n  also have \"\\<dots> \\<subseteq> FC\"\n    by fact\n  finally have \"ode a \\<in> FC\" by simp\n  with assms show False\n    by auto\nqed\n\nlemma ne_zero_lemma2:\n  assumes\n   \"ode ` fst ` flow1_of_vec1 ` env \\<subseteq> F\"\n   \"\\<forall>x\\<in>F. x \\<bullet> n \\<noteq> 0\"\n   \"(a, b) \\<in> env\"\n   \"flow1_of_vec1 (a, b) = (a', b')\"\n   \"ode a' \\<bullet> n = 0\"\n shows False\nproof -\n  have \"(a', b') \\<in> flow1_of_vec1 ` env\"\n    apply (rule image_eqI)\n    using assms by auto\n  then have \"ode (fst (a', b')) \\<in> ode ` fst ` \\<dots>\" by blast\n  also from assms have \"\\<dots> \\<subseteq> F\" by simp\n  finally have \"ode a' \\<in> F\" by simp\n  with assms have \"ode a' \\<bullet> n \\<noteq> 0\" by auto\n  with assms show False by simp\nqed\n\nlemma solve_poincare_plane[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  assumes \"n \\<in> Basis\"\n  shows \"solve_poincare_plane (n::'n::enum rvec) CX \\<le> SPEC (\\<lambda>PDP.\n    fst ` PDP \\<subseteq> Csafe \\<and>\n    (\\<forall>(x, d) \\<in> CX. (x, d - (blinfun_scaleR_left (ode x) o\\<^sub>L\n      (blinfun_scaleR_left (inverse (ode x \\<bullet> n)) o\\<^sub>L (blinfun_inner_left n o\\<^sub>L d)))) \\<in> PDP) \\<and>\n    (\\<forall>(x, d) \\<in> PDP. ode x \\<bullet> n \\<noteq> 0))\"\n  unfolding solve_poincare_plane_def\n  apply (refine_vcg)\n  subgoal using assms by auto\n  subgoal using assms by auto\n  subgoal using assms by auto\n  subgoal using assms by (auto simp: solve_poincare_slp_def)\n  subgoal using assms by auto\n  subgoal for C1 FC _ CX' CX'' P P1 FP _\n    apply auto\n    apply (drule bspec, assumption)\n    apply (rule image_eqI)\n     prefer 2 apply assumption\n    apply (subst einterpret_solve_poincare_fas)\n    subgoal using wd by auto\n    subgoal using wd by auto\n    subgoal using wd by auto\n    subgoal using wd assms by (auto elim!: ne_zero_lemma)\n    subgoal using wd assms by (auto simp: )\n    done\n  subgoal by (auto elim!: ne_zero_lemma2)\n  done\n\nlemma choose_step1_flowpipe[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd TYPE('n::enum rvec)\"\n  shows \"choose_step1 (X0::'n eucl1 set) h \\<le> SPEC (\\<lambda>(h', _, RES_ivl, RES::'n eucl1 set).\n      0 < h' \\<and> h' \\<le> h \\<and> flowpipe X0 h' h' RES_ivl RES)\"\n  using assms\n  unfolding choose_step1_def\n  by (refine_vcg choose_step'_flowpipe[le] wd)\n    (auto simp: image_image,\n      auto simp: safe_eq vec1_of_flow1_def flowpipe0_imp_flowpipe env_len_def)\n\nlemma image_flow1_of_vec1I:\n  \"vec1_of_flow1 x \\<in> X \\<Longrightarrow> x \\<in> flow1_of_vec1 ` X\"\n  by (rule image_eqI) (rule flow1_of_vec1_vec1_of_flow1[symmetric])\n\nlemma inter_sctn1_spec[le, refine_vcg]:\n  \"inter_sctn1_spec X sctn \\<le> SPEC (\\<lambda>(R, S). X \\<inter> plane_of sctn \\<times> UNIV \\<subseteq> R \\<and> fst ` R \\<subseteq> plane_of sctn\n  \\<and> X \\<inter> plane_of sctn \\<times> UNIV \\<subseteq> S \\<and> fst ` S \\<subseteq> plane_of sctn)\"\n  unfolding inter_sctn1_spec_def\n  apply (refine_vcg, auto)\n  subgoal by (rule image_flow1_of_vec1I) (auto simp: plane_of_def inner_prod_def)\n  subgoal by (auto simp: plane_of_def inner_prod_def)\n  subgoal by (rule image_flow1_of_vec1I)\n         (force simp: set_plus_def plane_of_def inner_prod_def vec1_of_flow1_def)\n  subgoal by (force simp: set_plus_def)\n  done\n\nlemma fst_safe_coll[le, refine_vcg]:\n  \"wd TYPE('a) \\<Longrightarrow>\n      fst_safe_coll (X::('a::executable_euclidean_space*'c) set) \\<le> SPEC (\\<lambda>R. R = fst ` X \\<and> fst ` X \\<subseteq> Csafe)\"\n  unfolding fst_safe_coll_def\n  by refine_vcg\n\nlemma vec1reps[THEN order_trans, refine_vcg]: \"vec1reps CX \\<le> SPEC (\\<lambda>R. case R of None \\<Rightarrow> True | Some X \\<Rightarrow> X = vec1_of_flow1 ` CX)\"\n  unfolding vec1reps_def\n  apply (refine_vcg FORWEAK_mono_rule[where\n        I=\"\\<lambda>XS R. case R of None \\<Rightarrow> True | Some R \\<Rightarrow> vec1_of_flow1 ` (\\<Union>XS) \\<subseteq> R \\<and> R \\<subseteq> vec1_of_flow1 ` CX\"])\n  by (auto simp:  split: option.splits) force+\n\nlemma nonzero_component_within[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"nonzero_component_within ivl sctn (PDP::'n eucl1 set) \\<le> SPEC (\\<lambda>b.\n    (b \\<longrightarrow> (\\<forall>x\\<in>PDP. fst x \\<in> ivl \\<and> (\\<forall>\\<^sub>F x in at (fst x) within plane_of sctn. x \\<in> ivl))) \\<and>\n    fst ` PDP \\<subseteq> Csafe \\<and>\n    (\\<forall>x\\<in>PDP. ode (fst x) \\<bullet> normal sctn \\<noteq> 0))\"\n  unfolding nonzero_component_within_def\n  by refine_vcg auto\n\nlemma do_intersection_invar_inside:\n  \"do_intersection_invar guards b ivl sctn X (e, f, m, n, p, q, True) \\<Longrightarrow>\n  fst ` e \\<subseteq> sabove_halfspace sctn \\<Longrightarrow>\n  fst ` mn \\<subseteq> ivl \\<Longrightarrow>\n  mn = m \\<or> mn = n \\<Longrightarrow>\n  do_intersection_spec UNIV guards ivl sctn X (mn, p)\"\n  subgoal premises prems\n  proof -\n    from prems have e: \"e \\<inter> sbelow_halfspace sctn \\<times> UNIV = {}\"\n      by (auto simp: halfspace_simps plane_of_def)\n    with prems(1) have\n      \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} X UNIV p m\"\n      \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} X UNIV p n\"\n      \"e \\<inter> sbelow_halfspace sctn \\<times> UNIV = {}\"\n      \"fst ` X \\<inter> b = {}\"\n      \"fst ` X \\<subseteq> sbelow_halfspace sctn\"\n      \"ivl \\<subseteq> plane (normal sctn) (pstn sctn)\"\n      \"fst ` X \\<subseteq> p\"\n      \"fst ` m \\<subseteq> Csafe\"\n      \"fst ` n \\<subseteq> Csafe\"\n      \"p \\<subseteq> Csafe\"\n      \"fst ` e \\<subseteq> Csafe\"\n      \"f \\<subseteq> {0..}\"\n      \"p \\<subseteq> sbelow_halfspace sctn - guards\"\n      \"e \\<subseteq> (- guards) \\<times> UNIV\"\n      \"fst ` (m \\<union> n) \\<inter> guards = {}\"\n      \"0 \\<notin> (\\<lambda>x. ode x \\<bullet> normal sctn) ` fst ` (m \\<union> n)\"\n      \"\\<forall>x\\<in>m \\<union> n. \\<forall>\\<^sub>F x in at (fst x) within plane (normal sctn) (pstn sctn). x \\<in> ivl\"\n      by (auto simp: do_intersection_invar_def do_intersection_spec_def plane_of_def)\n    then show ?thesis\n      using prems(2-)\n      by (auto simp: do_intersection_spec_def plane_of_def halfspace_simps)\n  qed\n  done\n\nlemma do_intersection_body_lemma:\n  assumes \"flowsto A T (i \\<times> UNIV) (X' \\<inter> sbelow_halfspace sctn \\<times> UNIV)\"\n    \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} B UNIV i PS \"\n    \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} B UNIV i PS2\"\n    \"T \\<subseteq> {0..}\"\n    \"i \\<subseteq> sbelow_halfspace sctn - guards\"\n    \"fst ` (A \\<union> B) \\<subseteq> sbelow_halfspace sctn\"\n    \"fst ` PS \\<subseteq> Csafe \"\n    \"fst ` PS2 \\<subseteq> Csafe \"\n    \\<open>X = A \\<union> B\\<close>\n  assumes ivl: \"closed ivl\" \"ivl \\<subseteq> plane_of sctn\"\n  assumes normal_Basis: \"\\<bar>normal sctn\\<bar> \\<in> Basis\"\n    and inter_empties: \"fst ` Y \\<inter> GUARDS = {}\" \"fst ` CX' \\<inter> GUARDS = {}\"\n    \"fst ` PDP' \\<inter> GUARDS = {}\" \"fst ` PDP'' \\<inter> GUARDS = {}\"\n    and h': \"0 < h'\" \"h' \\<le> h\"\n    and safe: \"fst ` PDP \\<subseteq> Csafe\" \"fst ` CX' \\<subseteq> Csafe\"\n    \"fst ` PDP' \\<subseteq> Csafe\"\n    \"fst ` PDP'' \\<subseteq> Csafe\"\n    and PDP:\n    \"\\<forall>(x,d)\\<in>CX'. (x,\n            d - (blinfun_scaleR_left (ode x) o\\<^sub>L\n                  (blinfun_scaleR_left (inverse (ode x \\<bullet> \\<bar>normal sctn\\<bar>)) o\\<^sub>L\n                  (blinfun_inner_left \\<bar>normal sctn\\<bar> o\\<^sub>L d))))\n               \\<in> PDP\"\n    and PDP': \"PDP \\<inter> plane_of sctn \\<times> UNIV \\<subseteq> PDP'\"\n    and PDP'': \"PDP \\<inter> plane_of sctn \\<times> UNIV \\<subseteq> PDP''\"\n    and evin:\n    \"\\<forall>x\\<in>PDP'. fst x \\<in> ivl \\<and> (\\<forall>\\<^sub>F x in at (fst x) within plane_of sctn. x \\<in> ivl)\"\n    \"\\<forall>x\\<in>PDP''. fst x \\<in> ivl \\<and> (\\<forall>\\<^sub>F x in at (fst x) within plane_of sctn. x \\<in> ivl)\"\n    and through: \"\\<forall>(x, d)\\<in>PDP. ode x \\<bullet> \\<bar>normal sctn\\<bar> \\<noteq> 0\"\n    \"\\<forall>x\\<in>PDP'. ode (fst x) \\<bullet> normal sctn \\<noteq> 0\"\n    \"\\<forall>x\\<in>PDP''. ode (fst x) \\<bullet> normal sctn \\<noteq> 0\"\n    and plane:\n    \"fst ` PDP' \\<subseteq> plane_of sctn\"\n    \"fst ` PDP'' \\<subseteq> plane_of sctn\"\n    and flowpipe: \"flowpipe X' h' h' CX' Y\"\n  shows \"\\<exists>A B. X = A \\<union> B \\<and>\n        flowsto A {0<..} ((fst ` CX' \\<inter> sbelow_halfspace sctn \\<union> i) \\<times> UNIV) (Y \\<inter> sbelow_halfspace sctn \\<times> UNIV) \\<and>\n        poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} B UNIV (fst ` CX' \\<inter> sbelow_halfspace sctn \\<union> i) (PDP' \\<union> PS) \\<and>\n        poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} B UNIV (fst ` CX' \\<inter> sbelow_halfspace sctn \\<union> i) (PDP'' \\<union> PS2)\"\nproof -\n  from flowpipe\n  have 1: \"flowpipe (X' \\<inter> (sbelow_halfspace sctn) \\<times> UNIV) h' h' CX' Y\"\n    by (rule flowpipe_subset) (use flowpipe in \\<open>auto dest!: flowpipe_safeD\\<close>)\n  have 2: \"fst ` (X' \\<inter> (sbelow_halfspace sctn) \\<times> UNIV) \\<inter> {x. pstn sctn \\<le> x \\<bullet> normal sctn} = {}\"\n    by (auto simp: halfspace_simps plane_of_def)\n  from normal_Basis have 3: \"normal sctn \\<noteq> 0\"\n    by (auto simp: )\n  note 4 = \\<open>closed ivl\\<close>\n  from \\<open>ivl \\<subseteq> plane_of sctn\\<close> have 5: \"ivl \\<subseteq> plane (normal sctn) (pstn sctn)\"\n    by (auto simp: plane_of_def)\n  have 6: \"(x, d) \\<in> CX' \\<Longrightarrow> x \\<in> plane (normal sctn) (pstn sctn) \\<Longrightarrow>\n          (x, d - (blinfun_scaleR_left (ode x) o\\<^sub>L\n                   (blinfun_scaleR_left (inverse (ode x \\<bullet> normal sctn)) o\\<^sub>L (blinfun_inner_left (normal sctn) o\\<^sub>L d))))\n          \\<in> PDP' \\<inter> PDP''\" for x d\n    unfolding PDP_abs_lemma[OF normal_Basis]\n    apply (drule PDP[rule_format, of \"(x, d)\", unfolded split_beta' fst_conv snd_conv])\n    using PDP' PDP''\n    by (auto simp: plane_of_def)\n  from normal_Basis through\n  have 7: \"(x, d) \\<in> PDP' \\<Longrightarrow> ode x \\<bullet> normal sctn \\<noteq> 0\" for x d\n    by (auto elim!: abs_in_BasisE)\n  have 8: \"(x, d) \\<in> PDP' \\<Longrightarrow> x \\<in> ivl\" for x d\n    using evin by auto\n  have 9: \"(x, d) \\<in> PDP' \\<Longrightarrow> \\<forall>\\<^sub>F x in at x within plane (normal sctn) (pstn sctn). x \\<in> ivl\" for x d\n    using evin by (auto simp add: plane_of_def)\n  obtain X1 X2\n    where X1X2: \"X' \\<inter> sbelow_halfspace sctn \\<times> UNIV = X1 \\<union> X2\"\n      and X1: \"flowsto X1 {0<..h'} (CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn} \\<times> UNIV)\n                      (CX' \\<inter> {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} \\<times> UNIV)\"\n      and X2: \"flowsto X2 {h'..h'} (CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn} \\<times> UNIV)\n                      (Y \\<inter> {x. x \\<bullet> normal sctn < pstn sctn} \\<times> UNIV)\"\n      and P: \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} X1 UNIV\n                      (fst ` CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn}) (PDP' \\<inter> PDP'')\"\n    by (rule flowpipe_split_at_above_halfspace[OF 1 2 3 4 5 6 7 8 9]) (auto simp: Ball_def)\n  from \\<open>flowsto A _ _ _\\<close>[unfolded X1X2]\n  obtain p1 p2 where p1p2: \"A = p1 \\<union> p2\" and p1: \"flowsto p1 T (i \\<times> UNIV) X1\" and p2: \"flowsto p2 T (i \\<times> UNIV) X2\"\n    by (rule flowsto_unionE)\n  have \"A \\<union> B = p2 \\<union> (p1 \\<union> B)\" using \\<open>A = p1 \\<union> p2\\<close>\n    by auto\n  moreover\n  from flowsto_trans[OF p2 X2]\n  have \"flowsto p2 {0<..} ((fst ` CX' \\<inter> (sbelow_halfspace sctn) \\<union> i) \\<times> UNIV)\n           (Y \\<inter> (sbelow_halfspace sctn) \\<times> UNIV)\"\n    apply (rule flowsto_subset)\n    subgoal by (auto simp: halfspace_simps)\n    subgoal using h' \\<open>T \\<subseteq> _\\<close> by (auto simp: halfspace_simps intro!: add_nonneg_pos)\n    subgoal\n      using flowpipe_source_subset[OF 1, unfolded X1X2] X1X2\n      apply auto\n      by (auto simp: halfspace_simps)\n    subgoal by (auto simp: halfspace_simps)\n    done\n  moreover\n  have cls: \"closed {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn}\"\n    by (rule closed_levelset_within continuous_intros \\<open>closed ivl\\<close>)+\n  from flowsto_trans[OF p1 X1]\n  have ftt: \"flowsto p1 ({s + t |s t. s \\<in> T \\<and> t \\<in> {0<..h'}})\n       (i \\<times> UNIV \\<union> CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn} \\<times> UNIV \\<union> X1 \\<inter> X1)\n       (X1 - X1 \\<union> CX' \\<inter> {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} \\<times> UNIV)\"\n    by auto\n  from X1X2 have X1_sb: \"X1 \\<subseteq> sbelow_halfspace sctn \\<times> UNIV\" by auto\n  have \"{x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} \\<times> UNIV \\<inter> (i \\<times> UNIV \\<union> CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn} \\<times> UNIV \\<union> X1) = {}\"\n    apply (intro Int_Un_eq_emptyI)\n    subgoal using \\<open>i \\<subseteq> sbelow_halfspace sctn - guards\\<close> by (auto simp: halfspace_simps)\n    subgoal by (auto simp: halfspace_simps)\n    subgoal using X1_sb by (auto simp: halfspace_simps)\n    done\n  then have inter_empty:\n    \"{x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} \\<times> UNIV \\<inter> (i \\<times> UNIV \\<union> CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn} \\<times> UNIV \\<union> X1 \\<inter> X1) = {}\"\n    by auto\n  have p1ret: \"returns_to {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} x\"\n    and p1pm: \"poincare_map {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} x \\<in> fst ` (PDP' \\<inter> PDP'')\"\n    if \"(x, d) \\<in> p1\" for x d\n     apply (rule flowsto_poincareD[OF ftt _ inter_empty _ _ _ order_refl])\n    subgoal by auto\n    subgoal by fact\n    subgoal using \\<open>T \\<subseteq> _\\<close> by auto\n    subgoal using that by auto\n    subgoal\n      apply (rule flowsto_poincareD[OF ftt _ inter_empty])\n      subgoal by auto\n      subgoal by fact\n      subgoal using \\<open>T \\<subseteq> _\\<close> by auto\n      subgoal using that by auto\n      subgoal using 6 by force\n      done\n    done\n  have crt: \"isCont (return_time {x \\<in> ivl. x \\<bullet> normal sctn - pstn sctn = 0}) x\" if \"(x, d) \\<in> p1\" for x d\n    apply (rule return_time_isCont_outside[where Ds=\"\\<lambda>_. blinfun_inner_left (normal sctn)\"])\n    subgoal by (simp add: p1ret[OF that])\n    subgoal by fact\n    subgoal by (auto intro!: derivative_eq_intros)\n    subgoal by simp\n    subgoal apply simp\n      using p1pm[OF that]\n      by (auto dest!: 7)\n    subgoal\n      using p1pm[OF that]\n      by (auto dest!: 9 simp: eventually_at_filter)\n    subgoal\n      using \\<open>fst ` (A \\<union> B) \\<subseteq> sbelow_halfspace sctn\\<close> that p1p2\n      by (auto simp: halfspace_simps)\n    done\n  have pmij: \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} p1 UNIV\n        (fst ` (i \\<times> UNIV \\<union> X1) \\<union> fst ` CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn}) (PDP' \\<inter> PDP'')\"\n    apply (rule flowsto_poincare_trans[OF \\<open>flowsto _ _ _ X1\\<close> P])\n    subgoal using \\<open>T \\<subseteq> {0..}\\<close> by auto\n    subgoal by auto\n    subgoal\n      using \\<open>i \\<subseteq> sbelow_halfspace sctn - guards\\<close> X1X2\n      by (force simp: halfspace_simps)\n    subgoal by fact\n    subgoal for x d using crt by simp\n    subgoal by auto\n    done\n  from pmij have \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} p1 UNIV (fst ` (i \\<times> UNIV \\<union> X1) \\<union> fst ` CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn}) PDP'\"\n    apply (rule poincare_mapsto_subset)\n    using \\<open>fst ` PDP' \\<subseteq> Csafe\\<close>\n    by auto\n  from this \\<open>poincare_mapsto _ _ _ i PS\\<close>\n  have \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} (p1 \\<union> B) UNIV\n      ((fst ` (i \\<times> UNIV \\<union> X1) \\<union> fst ` CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn}) \\<union> i) (PDP' \\<union> PS)\"\n    by (intro poincare_mapsto_unionI) (auto simp: plane_of_def)\n  then have \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} (p1 \\<union> B) UNIV (fst ` CX' \\<inter> sbelow_halfspace sctn \\<union> i) (PDP' \\<union> PS)\"\n    apply (rule poincare_mapsto_subset)\n    subgoal by auto\n    subgoal by auto\n    subgoal\n      using flowpipe_source_subset[OF 1, unfolded X1X2] X1X2 \n      apply (auto simp: halfspace_simps subset_iff)\n      done\n    subgoal using safe \\<open>fst ` PS \\<subseteq> Csafe\\<close> by auto\n    done\n  moreover\n  from pmij have \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} p1 UNIV (fst ` (i \\<times> UNIV \\<union> X1) \\<union> fst ` CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn}) PDP''\"\n    apply (rule poincare_mapsto_subset)\n    using \\<open>fst ` PDP'' \\<subseteq> Csafe\\<close>\n    by auto\n  from this \\<open>poincare_mapsto _ _ _ i PS2\\<close>\n  have \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} (p1 \\<union> B) UNIV\n      ((fst ` (i \\<times> UNIV \\<union> X1) \\<union> fst ` CX' \\<inter> {x. x \\<bullet> normal sctn < pstn sctn}) \\<union> i) (PDP'' \\<union> PS2)\"\n    by (intro poincare_mapsto_unionI) (auto simp: plane_of_def)\n  then have \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} (p1 \\<union> B) UNIV (fst ` CX' \\<inter> sbelow_halfspace sctn \\<union> i) (PDP'' \\<union> PS2)\"\n    apply (rule poincare_mapsto_subset)\n    subgoal by auto\n    subgoal by auto\n    subgoal\n      using flowpipe_source_subset[OF 1, unfolded X1X2] X1X2\n      apply (auto simp: halfspace_simps subset_iff)\n      done\n    subgoal using safe \\<open>fst ` PS2 \\<subseteq> Csafe\\<close> by auto\n    done\n  ultimately\n  show ?thesis\n    unfolding \\<open>X = A \\<union> B\\<close> by blast\nqed\n\nlemma do_intersection_body_spec:\n  fixes guards::\"'n::enum rvec set\"\n  assumes invar: \"do_intersection_invar guards GUARDS ivl sctn X (X', T, PS, PS2, i, True, True)\"\n    and wdp[refine_vcg]: \"wd TYPE('n rvec)\"\n    and X: \"fst ` X \\<subseteq> Csafe\"\n    and ivl: \"closed ivl\" and GUARDS: \"guards \\<subseteq> GUARDS\"\n  shows \"do_intersection_body GUARDS ivl sctn h (X', T, PS, PS2, i, True, True) \\<le>\n    SPEC (do_intersection_invar guards GUARDS ivl sctn X)\"\nproof -\n  from invar\n  obtain A B where AB: \"fst ` (A \\<union> B) \\<inter> GUARDS = {} \"\n    \"fst ` (A \\<union> B) \\<subseteq> sbelow_halfspace sctn \"\n    \"ivl \\<subseteq> plane_of sctn \"\n    \"fst ` (A \\<union> B) \\<subseteq> i \"\n    \"fst ` PS \\<subseteq> Csafe \"\n    \"fst ` PS2 \\<subseteq> Csafe \"\n    \"i \\<subseteq> Csafe \"\n    \"fst ` X' \\<subseteq> Csafe \"\n    \"T \\<subseteq> {0..}\"\n    \"i \\<subseteq> sbelow_halfspace sctn - guards \"\n    \"X' \\<subseteq> (- guards) \\<times> UNIV \"\n    \"fst ` (PS \\<union> PS2) \\<inter> guards = {} \"\n    \"0 \\<notin> (\\<lambda>x. ode x \\<bullet> normal sctn) ` fst ` (PS \\<union> PS2) \"\n    \"\\<forall>x\\<in>PS \\<union> PS2. \\<forall>\\<^sub>F x in at (fst x) within plane_of sctn. x \\<in> ivl \"\n    \"X = A \\<union> B \"\n    \"flowsto A T (i \\<times> UNIV) (X' \\<inter> sbelow_halfspace sctn \\<times> UNIV)\"\n    \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} B UNIV i PS \"\n    \"poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} B UNIV i PS2\"\n    by (auto simp: do_intersection_invar_def)\n\n  have ev_in_ivl: \"\\<forall>\\<^sub>F x in at p within plane_of sctn. x \\<in> ivl\" if\n    \\<open>\\<forall>x\\<in>d. fst x \\<in> ivl \\<and> (\\<forall>\\<^sub>F x in at (fst x) within plane_of sctn. x \\<in> ivl)\\<close>\n    \\<open>\\<forall>x\\<in>e. fst x \\<in> ivl \\<and> (\\<forall>\\<^sub>F x in at (fst x) within plane_of sctn. x \\<in> ivl)\\<close>\n    \\<open>(p, q) \\<in> d \\<or> (p, q) \\<in> PS \\<or> (p, q) \\<in> e \\<or> (p, q) \\<in> PS2\\<close>\n    for p q d e\n      using \\<open>\\<forall>x\\<in>PS \\<union> PS2. \\<forall>\\<^sub>F x in at (fst x) within plane_of sctn. x \\<in> ivl\\<close>\n      using that\n      by (auto dest!: bspec[where x=\"(p, q)\"])\n\n  show ?thesis\n    unfolding do_intersection_body_def do_intersection_invar_def\n    apply simp\n    apply (refine_vcg, clarsimp_all)\n    subgoal using AB by (auto simp: )\n    subgoal using AB by (auto simp: )\n    subgoal using AB by (auto simp: )\n    subgoal\n      apply (rule conjI)\n      subgoal using AB by auto\\<comment> \\<open>unnecessarily slow\\<close>\n      subgoal using AB by fastforce\n      done\n    subgoal using AB by (auto simp: )\n    subgoal using AB by (auto simp: )\n    subgoal using AB by (auto simp: )\n    subgoal by (auto dest!: flowpipe_safeD)\n    subgoal\n      apply safe\n      subgoal using AB GUARDS by auto\n      subgoal using AB by auto\n      subgoal using AB by auto\n      subgoal using AB GUARDS by auto\n      subgoal using AB by auto\n      subgoal using AB by auto\n      done\n    subgoal using AB GUARDS by auto\n    subgoal using AB GUARDS by auto\\<comment> \\<open>unnecessarily slow\\<close>\n    subgoal using AB GUARDS by auto\n    subgoal using AB assms by (auto intro: ev_in_ivl)\n    subgoal using AB assms apply - by (rule do_intersection_body_lemma)\n    done\nqed\n\nlemma\n  do_intersection_spec[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"do_intersection guards ivl sctn (X::'n eucl1 set) h \\<le>\n    SPEC (\\<lambda>(inside, P, P2, CX). (inside \\<longrightarrow>\n      (do_intersection_spec UNIV guards ivl sctn X (P, CX) \\<and>\n       do_intersection_spec UNIV guards ivl sctn X (P2, CX)) \\<and> fst ` X \\<subseteq> CX))\"\n  using assms\n  unfolding do_intersection_def autoref_tag_defs\n  apply (refine_vcg, clarsimp_all)\n  subgoal\n    unfolding do_intersection_invar_def\n    apply clarsimp\n    apply (intro conjI)\n       apply force\n      apply force\n     apply force\n    apply (rule exI[where x=X])\n    apply (rule exI[where x=\"{}\"])\n    by (auto intro!: flowsto_self)\n  subgoal by (rule do_intersection_body_spec)\n  subgoal by (rule do_intersection_invar_inside, assumption) auto\n  subgoal by (rule do_intersection_invar_inside, assumption) auto\n  subgoal by (auto simp: plane_of_def halfspace_simps do_intersection_invar_def)\n  done\n\nlemma mem_flow1_of_vec1_image_iff[simp]:\n  \"(c, d) \\<in> flow1_of_vec1 ` a \\<longleftrightarrow> vec1_of_flow1 (c, d) \\<in> a\"\n  by force\n\nlemma mem_vec1_of_flow1_image_iff[simp]:\n  \"(c, d) \\<in> vec1_of_flow1 ` a \\<longleftrightarrow> flow1_of_vec1 (c, d) \\<in> a\"\n  by force\n\nlemma split_spec_param1[le, refine_vcg]: \"split_spec_param1 X \\<le> SPEC (\\<lambda>(A, B). X \\<subseteq> A \\<union> B)\"\n  unfolding split_spec_param1_def\n  apply (refine_vcg)\n  apply (auto simp add: subset_iff split: option.splits)\n  by (metis flow1_of_vec1_vec1_of_flow1 surjective_pairing)\n\nlemma do_intersection_spec_empty:\n  \"X = {} \\<Longrightarrow> Y = {} \\<Longrightarrow> do_intersection_spec S sctns ivl sctn X ({}, Y)\"\n  by (auto simp: do_intersection_spec_def halfspaces_union)\n\nlemma do_intersection_spec_subset:\n  \"do_intersection_spec S osctns ivl csctns Y (a, b) \\<Longrightarrow> X \\<subseteq> Y \\<Longrightarrow> do_intersection_spec S osctns ivl csctns X (a, b)\"\n  by (auto simp: do_intersection_spec_def halfspaces_union intro: flowsto_subset poincare_mapsto_subset)\n\nlemma do_intersection_spec_union:\n  \"do_intersection_spec S osctns ivl csctns a (b, c) \\<Longrightarrow>\n   do_intersection_spec S osctns ivl csctns f (g, h) \\<Longrightarrow>\n   do_intersection_spec S osctns ivl csctns (a \\<union> f) (b \\<union> g, c \\<union> h)\"\n  by (auto simp: do_intersection_spec_def intro!: poincare_mapsto_unionI)\n\nlemma scaleR2_rep_of_coll[le, refine_vcg]:\n  \"scaleR2_rep_coll X \\<le> SPEC (\\<lambda>((l, u), Y). X \\<subseteq> scaleR2 l u Y)\"\n  unfolding scaleR2_rep_coll_def\n  apply (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>Xs ((l, u), Y). \\<Union>Xs \\<subseteq> scaleR2 l u Y\"])\n  subgoal by (auto intro: scaleR2_subset)\n  subgoal\n    apply clarsimp\n    apply safe\n    subgoal by (auto elim: scaleR2_subset)\n    subgoal\n      apply (rule set_rev_mp, assumption)\n      apply (rule order_trans)\n       apply (rule Union_upper, assumption)\n      apply (rule order_trans, assumption)\n      apply (rule subsetI)\n      apply (erule scaleR2_subset)\n      by (auto )\n    done\n  done\n\nlemma split_spec_param1e[le, refine_vcg]: \"split_spec_param1e X \\<le> SPEC (\\<lambda>(A, B). X \\<subseteq> A \\<union> B)\"\n  unfolding split_spec_param1e_def\n  apply (refine_vcg)\n  apply clarsimp\n    apply (thin_tac \"_ \\<noteq> {}\")\n  apply (auto simp: scaleR2_def vimage_def image_def)\n  apply (rule exI, rule conjI, assumption, rule conjI, assumption)\n  apply (auto simp: split_beta')\n  apply (drule_tac x = x in spec)\n  apply auto\n  by (metis (no_types, lifting) UnE prod.sel(1) prod.sel(2) subset_eq)\n\nlemma reduce_spec1[le, refine_vcg]: \"reduce_spec1 ro X \\<le> SPEC (\\<lambda>R. X \\<subseteq> R)\"\n  unfolding reduce_spec1_def\n  by refine_vcg auto\n\nlemma reduce_spec1e[le, refine_vcg]: \"reduce_spec1e ro X \\<le> SPEC (\\<lambda>R. X \\<subseteq> R)\"\n  unfolding reduce_spec1e_def\n  by refine_vcg (auto simp: scaleR2_def image_def vimage_def, force)\n\nlemma split_under_threshold[le, refine_vcg]:\n  \"split_under_threshold ro th X \\<le> SPEC (\\<lambda>R. X \\<subseteq> R)\"\n  unfolding split_under_threshold_def autoref_tag_defs\n  by (refine_vcg) auto\n\nlemma step_split[le, refine_vcg]:\n  \"wd TYPE((real, 'n::enum) vec) \\<Longrightarrow> step_split ro (X::'n eucl1 set) \\<le> SPEC (\\<lambda>Y. X \\<subseteq> Y \\<and> fst ` Y \\<subseteq> Csafe)\"\n  unfolding step_split_def\n  by (refine_vcg refine_vcg) auto\n\nlemma tolerate_error_SPEC[THEN order_trans, refine_vcg]:\n  \"tolerate_error Y E \\<le> SPEC (\\<lambda>b. True)\"\n  unfolding tolerate_error_def\n  by refine_vcg\n\nlemma flowpipe_scaleR2I: \"flowpipe (scaleR2 x1 x2 bc) x1a x1a (fst ` aca \\<times> UNIV) (scaleR2 x1 x2 bca)\"\n  if \"flowpipe (bc) x1a x1a (fst ` aca \\<times> UNIV) (bca)\"\n  using that\n  apply (auto simp: flowpipe_def scaleR2_def)\n  apply (drule bspec, assumption)\n  apply (auto simp: image_def vimage_def )\n  apply (rule exI, rule conjI, assumption, rule conjI, assumption)\n  apply (rule bexI) prefer 2 apply assumption\n  by (auto simp: scaleR_blinfun_compose_right)\n\nlemma choose_step1e_flowpipe[le, refine_vcg]:\n  assumes vwd[refine_vcg]: \"wd TYPE('n::enum rvec)\"\n  shows \"choose_step1e (X0::'n eucl1 set) h \\<le> SPEC (\\<lambda>(h', _, RES_ivl, RES::'n eucl1 set).\n      0 < h' \\<and> h' \\<le> h \\<and> flowpipe X0 h' h' (RES_ivl \\<times> UNIV) RES)\"\n  unfolding choose_step1e_def\n  apply (refine_vcg)\n    apply (auto intro: flowpipe_scaleR2I)\n  apply (erule contrapos_np)\n  apply (auto intro!: flowpipe_scaleR2I)\n  apply (rule flowpipe_subset)\n         apply assumption\n        apply (auto dest!: flowpipe_safeD)\n  done\n\nlemma width_spec_appr1[THEN order_trans, refine_vcg]: \"width_spec_appr1 X \\<le> SPEC (\\<lambda>_. True)\"\n  unfolding width_spec_appr1_def\n  by refine_vcg\n\nlemma tolerate_error1_SPEC[THEN order_trans, refine_vcg]:\n  \"tolerate_error1 Y E \\<le> SPEC (\\<lambda>b. True)\"\n  unfolding tolerate_error1_def\n  by refine_vcg\n\nlemma\n  step_adapt_time[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"step_adapt_time (X::'n eucl1 set) h \\<le> SPEC (\\<lambda>(t, CX, X1, h). flowpipe X t t (CX \\<times> UNIV) X1)\"\n  unfolding step_adapt_time_def  autoref_tag_defs\n  apply (refine_vcg refine_vcg, clarsimp)\n  apply (auto simp: flowpipe_def)\n  apply force\n  done\n\nlemma\n  resolve_step[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"resolve_step roptns (X::'n::enum eucl1 set) h \\<le> SPEC (\\<lambda>(_, CX, X1, _).\n    flowsto X {0..} (CX \\<times> UNIV) X1 \\<and> X \\<union> X1 \\<subseteq> CX \\<times> UNIV \\<and> X1 \\<union> CX \\<times> UNIV \\<subseteq> Csafe \\<times> UNIV)\"\n  unfolding resolve_step_def  autoref_tag_defs\n  apply (refine_vcg refine_vcg)\n  subgoal by (rule flowsto_self) auto\n  subgoal by auto\n  subgoal by auto\n  subgoal\n    apply clarsimp\n    apply (frule flowpipe_imp_flowsto_nonneg)\n    apply (rule flowsto_subset, assumption)\n    by auto\n  subgoal\n    by (auto dest: flowpipe_source_subset)\n  subgoal\n    by (auto dest!: flowpipe_safeD)\n  done\n\nlemma pre_intersection_step[THEN order_trans, refine_vcg]:\n  \"pre_intersection_step ro (X::'n eucl1 set) h \\<le> SPEC (\\<lambda>(X', CX, G). X \\<subseteq> X' \\<union> G \\<and> X \\<union> X' \\<union> G \\<subseteq> CX \\<times> UNIV)\"\n  if [refine_vcg]: \"wd TYPE('n::enum rvec)\"\n  unfolding pre_intersection_step_def autoref_tag_defs\n  by (refine_vcg) auto\n\nlemma [THEN order_trans, refine_vcg]: \"select_with_inter ci a \\<le> SPEC (\\<lambda>_. True)\"\n  unfolding select_with_inter_def\n  by (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>_ _. True\"])\n\nlemmas [refine_vcg del] = scaleR2_rep_of_coll\n\nlemma fst_scaleR2_image[simp]: \"ad \\<le> ereal r \\<Longrightarrow> ereal r \\<le> bd \\<Longrightarrow> fst ` scaleR2 ad bd be = fst ` be\"\n  by (cases ad; cases bd; force simp: scaleR2_def image_image split_beta' vimage_def)\n\nlemma scaleR2_rep_of_coll2[le, refine_vcg]:\n  \"scaleR2_rep_coll X \\<le> SPEC (\\<lambda>((l, u), Y). X \\<subseteq> scaleR2 l u Y \\<and> fst ` X = fst ` Y)\"\n  unfolding scaleR2_rep_coll_def\n  supply [simp del] = mem_scaleR2_union\n  apply (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>Xs ((l, u), Y).\n      \\<Union>Xs \\<subseteq> scaleR2 l u Y \\<and> fst ` \\<Union>Xs \\<subseteq> fst ` Y \\<and> fst ` Y \\<subseteq> fst ` X\"])\n        apply (auto intro: scaleR2_subset)\n  subgoal by (auto simp: scaleR2_def)\n  subgoal by (auto simp: scaleR2_def image_def vimage_def, fastforce)\n  subgoal\n    apply (rule scaleR2_subset)\n       apply (rule subsetD)\n        apply assumption\n       apply auto\n    done\n  subgoal by force\n  subgoal for a b c d e f g h i j k l\n    apply (rule scaleR2_subset)\n       apply (rule subsetD)\n        apply assumption\n    by auto\n  subgoal by (auto simp: scaleR2_def)\n  subgoal by (auto simp: scaleR2_def)\n  subgoal by (auto simp: scaleR2_def image_def vimage_def, fastforce)\n  done\n\nlemma reach_cont[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"reach_cont roptns guards (X::'n eucl1 set) \\<le> SPEC (\\<lambda>(CX, G).\n    G \\<union> (CX \\<times> UNIV) \\<subseteq> (Csafe - guards) \\<times> UNIV \\<and>\n    X \\<union> G \\<subseteq> CX \\<times> UNIV \\<and>\n    flowsto X {0..} (CX \\<times> UNIV) G)\"\n  unfolding reach_cont_def autoref_tag_defs\n  apply (refine_vcg, clarsimp_all simp add: cancel_times_UNIV_subset)\n  subgoal by (rule flowsto_self) (auto simp: )\n  subgoal by (force simp: scaleR2_def)\n  subgoal by (fastforce simp: scaleR2_def vimage_def image_def)\n  subgoal premises prems for _ _ _ _ _ _ _ g\n    using \\<open>flowsto X _ _ (g \\<union> _ \\<union> _)\\<close>  \\<open>flowsto g _ _ _\\<close>\n    apply (rule flowsto_stepI)\n    using prems\n    by auto\n  subgoal\n    apply safe\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    done\n  subgoal by auto\n  subgoal\n    by (rule flowsto_subset, assumption) auto\n  subgoal\n    apply safe\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by fastforce\n    subgoal by auto\n    subgoal by auto\n    subgoal\n      by (metis (mono_tags, lifting) Diff_eq_empty_iff Diff_iff IntI)\n    done\n  subgoal\n    apply safe\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    done\n  subgoal by auto\n  done\n\nlemma reach_cont_par[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"reach_cont_par roptns guards (X::'n eucl1 set) \\<le> SPEC (\\<lambda>(CX, G).\n    G \\<union> (CX \\<times> UNIV) \\<subseteq> (Csafe - guards) \\<times> UNIV \\<and>\n    X \\<union> G \\<subseteq> CX \\<times> UNIV \\<and>\n    flowsto X {0..} (CX \\<times> UNIV) G)\"\n  unfolding reach_cont_par_def\n  apply refine_vcg\n    apply auto\n    apply force\n    apply force\n    apply force\n     apply force\n  subgoal\n    apply (rule bexI)\n     prefer 2 apply assumption\n    by auto\n  subgoal\n    apply (rule bexI)\n     prefer 2 apply assumption\n    by auto\n  subgoal for R\n    apply (rule flowsto_source_Union)\n    apply (drule bspec, assumption)\n    apply auto\n    apply (rule flowsto_subset, assumption)\n       apply auto\n    done\n  done\n\nlemma subset_iplane_coll[THEN order_trans, refine_vcg]:\n  \"subset_iplane_coll x ics \\<le> SPEC (\\<lambda>b. b \\<longrightarrow> x \\<subseteq> ics)\"\n  unfolding subset_iplane_coll_def\n  apply refine_vcg\n  subgoal for X icss\n    by (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>ic b. b \\<longrightarrow> X \\<subseteq> \\<Union>(icss)\"]) auto\n  done\n\nlemma subsets_iplane_coll[THEN order_trans, refine_vcg]:\n  \"subsets_iplane_coll x ics \\<le> SPEC (\\<lambda>b. b \\<longrightarrow> \\<Union>x \\<subseteq> ics)\"\n  unfolding subsets_iplane_coll_def\n  by (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>x b. (b \\<longrightarrow> \\<Union>x \\<subseteq> ics)\"]) auto\n\nlemma symstart_coll[THEN order_trans, refine_vcg]:\n  assumes [refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  assumes [le, refine_vcg]:\n    \"\\<And>X0. X0 \\<subseteq> Csafe \\<times> UNIV \\<Longrightarrow> symstart X0 \\<le> SPEC (\\<lambda>(CX, X). flowsto (X0 - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) (X))\"\n  shows \"symstart_coll symstart X0 \\<le> SPEC (\\<lambda>(CX, X). flowsto ((X0::'n eucl1 set) - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) X)\"\n  unfolding symstart_coll_def autoref_tag_defs\n  apply (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>X (CY, Y). flowsto (\\<Union>X - trap \\<times> UNIV) {0..} (CY \\<times> UNIV) Y\"], clarsimp_all)\n  subgoal by force\n  subgoal for a b c d e by (rule flowsto_subset, assumption) auto\n  subgoal by force\n  subgoal for a b c d e f g\n    unfolding Un_Diff\n    apply (rule flowsto_source_unionI)\n    subgoal by (rule flowsto_subset, assumption) auto\n    subgoal by (rule flowsto_subset, assumption) auto\n    done\n  done\n\nlemma reach_cont_symstart[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  assumes [le, refine_vcg]: \"\\<And>X0. X0 \\<subseteq> Csafe \\<times> UNIV \\<Longrightarrow> symstart X0 \\<le> SPEC (\\<lambda>(CX, X). flowsto (X0 - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) (X))\"\n  shows \"reach_cont_symstart roptns symstart guards (X::'n eucl1 set) \\<le> SPEC (\\<lambda>(CX, G).\n    G \\<union> (CX \\<times> UNIV) \\<subseteq> (Csafe - guards) \\<times> UNIV \\<and>\n    X \\<subseteq> CX \\<times> UNIV \\<and>\n    G \\<subseteq> CX \\<times> UNIV \\<and>\n    flowsto (X - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) (G))\"\n  unfolding reach_cont_symstart_def autoref_tag_defs\n  apply (refine_vcg, clarsimp_all)\n  subgoal by (auto simp: times_subset_iff)\n  subgoal by auto\n  subgoal by auto\n  subgoal for a b c d e f g\n    apply (rule flowsto_stepI[OF _ _ order_refl])\n         apply assumption\n    by assumption auto\n  done\n\nlemma reach_conts[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  assumes [refine_vcg]: \"\\<And>X0. X0 \\<subseteq> Csafe \\<times> UNIV \\<Longrightarrow> symstart X0 \\<le> SPEC (\\<lambda>(CX, X). flowsto (X0 - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) X)\"\n  shows \"reach_conts roptns symstart trap guards (X::'n eucl1 set) \\<le> SPEC (\\<lambda>(CX, IGs, X0).\n    \\<Union>(snd ` IGs) \\<union> (CX \\<times> UNIV) \\<subseteq> (Csafe - guards) \\<times> UNIV \\<and>\n    X \\<subseteq> CX \\<times> UNIV \\<and>\n    \\<Union>(snd ` IGs) \\<subseteq> CX \\<times> UNIV \\<and>\n    \\<Union>(fst ` IGs) \\<subseteq> guards \\<and>\n    X = \\<Union>(X0 ` (snd ` IGs)) \\<and>\n    (\\<forall>(I, G) \\<in> IGs. flowsto (X0 G - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) G))\"\n  unfolding reach_conts_def autoref_tag_defs\n  apply (refine_vcg, clarsimp_all)\n  subgoal for a b\n    apply (erule flowsto_Diff_to_Union_funE)\n    apply (force simp: split_beta')\n    subgoal for f\n      apply (rule exI[where x=f])\n      by (auto simp: split_beta')\n    done\n  subgoal by (auto)\n  subgoal by (auto)\n  subgoal by (auto)\n  done\n\nlemma leaves_halfspace[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"leaves_halfspace S (X::'n::enum rvec set) \\<le>\n    SPEC (\\<lambda>b. case b of None \\<Rightarrow> S = UNIV\n      | Some sctn \\<Rightarrow>\n        (S = below_halfspace sctn \\<and> X \\<subseteq> plane_of sctn \\<and> (\\<forall>x \\<in> X. ode x \\<bullet> normal sctn < 0)))\"\n  unfolding leaves_halfspace_def autoref_tag_defs op_set_to_list_def\n  apply (refine_vcg, clarsimp_all)\n  subgoal by (force simp add: halfspace_simps plane_of_def)\n  done\n\nlemma poincare_start_on[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"poincare_start_on guards sctn (X0::'n eucl1 set) \\<le> SPEC (\\<lambda>(X1S, CX1S).\n    fst ` (X1S \\<union> (CX1S \\<times> UNIV)) \\<subseteq> Csafe \\<and>\n    fst ` X1S \\<subseteq> sbelow_halfspace sctn \\<and>\n    fst ` (X1S \\<union> (CX1S \\<times> UNIV)) \\<inter> guards = {} \\<and>\n    (X0 \\<subseteq> (CX1S \\<times> UNIV)) \\<and>\n    (\\<forall>(x, d) \\<in> CX1S \\<times> UNIV. ode x \\<bullet> normal sctn < 0) \\<and>\n    flowsto X0 pos_reals ((CX1S \\<times> UNIV) \\<inter> (sbelow_halfspace sctn \\<times> UNIV)) X1S)\"\n  unfolding poincare_start_on_def autoref_tag_defs\n  apply refine_vcg\n  apply (rule FORWEAK_mono_rule[where I=\"\\<lambda>X0S (X1S, CX1S).\n      flowsto (\\<Union>X0S) pos_reals ((CX1S \\<times> UNIV) \\<inter> sbelow_halfspace sctn \\<times> UNIV) X1S \\<and>\n        fst ` (X1S \\<union> (CX1S \\<times> UNIV)) \\<subseteq> Csafe \\<and>\n        (\\<Union>X0S) \\<subseteq> X0 \\<and>\n        (\\<Union>X0S) \\<subseteq> (CX1S \\<times> UNIV) \\<and>\n        fst ` (X1S \\<union> (CX1S \\<times> UNIV)) \\<inter> guards = {} \\<and>\n        (\\<forall>(x, d) \\<in> (CX1S \\<times> UNIV). ode x \\<bullet> normal sctn < 0) \\<and>\n        fst ` X1S  \\<subseteq> sbelow_halfspace sctn\"])\n  subgoal by (refine_vcg)\n  subgoal for A B\n    apply (refine_vcg)\n    subgoal\n      apply (auto simp: dest!: flowpipe_imp_flowsto)\n      apply (rule flowsto_subset)\n          apply (rule flowsto_stays_sbelow[where sctn=sctn])\n            apply (rule flowsto_subset) apply assumption\n               apply (rule order_refl)\n              apply force\n             apply (rule order_refl)\n            apply (rule order_refl)\n           apply (auto simp: halfspace_simps)\n      apply (rule le_less_trans)\n       prefer 2 apply assumption\n      apply (drule bspec)\n       apply (rule subsetD, assumption)\n       prefer 2 apply assumption\n      apply auto\n      done\n    subgoal by auto\n    subgoal by force\n    subgoal by (auto simp: dest!: flowpipe_source_subset)\n    subgoal by auto\n    subgoal\n      apply (auto simp: halfspace_simps subset_iff)\n      apply (rule le_less_trans[rotated], assumption)\n      by fastforce\n    done\n  subgoal by (auto intro: flowsto_subset) force\n  subgoal for a b c d\n    using assms\n    apply (refine_vcg, clarsimp_all)\n    subgoal for e f g h i j k l m n\n      apply (rule flowsto_source_unionI)\n      subgoal\n        apply (drule flowpipe_imp_flowsto, assumption)\n        apply (rule flowsto_subset[OF flowsto_stays_sbelow[where sctn=sctn] order_refl])\n             apply (rule flowsto_subset[OF _ order_refl], assumption)\n               apply force\n              apply (rule order_refl)\n             apply (rule order_refl)\n            apply (auto simp: halfspace_simps)\n        apply (rule le_less_trans)\n         prefer 2 apply assumption\n        apply (drule bspec)\n         apply (rule subsetD, assumption)\n         prefer 2 apply assumption\n        apply auto\n        done\n      by (auto intro!: flowsto_source_unionI dest!: flowpipe_imp_flowsto intro: flowsto_subset[OF _ order_refl])\n    subgoal\n      apply (auto simp: subset_iff)\n      apply (auto simp: image_Un)\n      done\n    subgoal by auto\n    subgoal by (auto dest!: flowpipe_source_subset)\n    subgoal by auto\n    subgoal\n      apply (auto simp: halfspace_simps subset_iff)\n      apply (rule le_less_trans[rotated], assumption)\n      by fastforce\n    subgoal by auto\n    done\n  subgoal by auto\n  done\n\nlemma op_inter_fst_coll[le, refine_vcg]: \"op_inter_fst_coll X Y \\<le> SPEC (\\<lambda>R. R = X \\<inter> Y \\<times> UNIV)\"\n  unfolding op_inter_fst_coll_def\n  by (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>Xs R. \\<Union>Xs \\<inter> Y \\<times> UNIV \\<subseteq> R \\<and> R \\<subseteq> X \\<inter> Y \\<times> UNIV\"])\n    auto\n\nlemma scaleRe_ivl_coll_spec[le, refine_vcg]: \"scaleRe_ivl_coll_spec l u X \\<le> SPEC (\\<lambda>Y. Y = scaleR2 l u X)\"\n  unfolding scaleRe_ivl_coll_spec_def\n  apply (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>Xs R. scaleR2 l u (\\<Union>Xs) \\<subseteq> R \\<and> R \\<subseteq> scaleR2 l u X\"])\n      apply (auto simp: intro: scaleR2_subset)\n  subgoal\n    by (force simp: intro: scaleR2_subset)\n  done\n\nlemma do_intersection_spec_scaleR2I:\n  \"do_intersection_spec UNIV sctns ivl sctn (scaleR2 x1 x2 baa) (scaleR2 x1 x2 aca, x1b)\"\n  if \"do_intersection_spec UNIV sctns ivl sctn (baa) (aca, x1b)\"\n  using that\n  by (auto simp: do_intersection_spec_def intro!: poincare_mapsto_scaleR2I)\n     (auto simp: scaleR2_def image_def vimage_def)\n\nlemma do_intersection_core[refine_vcg, le]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"do_intersection_core sctns ivl sctn (X::'n eucl1 set) \\<le>\n    SPEC (\\<lambda>(P1, P2, CX, X0s).\n      do_intersection_spec UNIV sctns ivl sctn (X - X0s) (P1, CX) \\<and>\n      do_intersection_spec UNIV sctns ivl sctn (X - X0s) (P2, CX)\n      \\<and> fst ` (X - X0s) \\<subseteq> CX\n      \\<and> X0s \\<subseteq> X)\"\n  unfolding do_intersection_core_def autoref_tag_defs\n  apply (refine_vcg assms, clarsimp_all)\n  subgoal by (rule do_intersection_spec_scaleR2I) (auto simp: do_intersection_spec_def intro!: )\n  subgoal by (rule do_intersection_spec_scaleR2I) (auto simp: do_intersection_spec_def intro!: )\n  subgoal by (fastforce simp: scaleR2_def)\n  subgoal by (auto simp: do_intersection_spec_def)\n  subgoal by (auto simp: do_intersection_spec_def)\n  done\n\nlemma do_intersection_spec_Union:\n  \"do_intersection_spec S sctns ivl sctn (\\<Union>X) A\"\n  if \"\\<And>x. x \\<in> X \\<Longrightarrow> do_intersection_spec S sctns ivl sctn x A\"\n    \"X \\<noteq> {}\"\n  using that(2)\n  unfolding do_intersection_spec_def\n  apply clarsimp\n  apply safe\n  subgoal by (rule poincare_mapsto_Union) (auto simp: do_intersection_spec_def dest!: that(1))\n  subgoal by (auto simp: do_intersection_spec_def dest!: that(1))\n  subgoal by (auto simp: do_intersection_spec_def dest!: that(1))\n  subgoal by (fastforce simp: do_intersection_spec_def dest!: that(1))\n  subgoal by (fastforce simp: do_intersection_spec_def dest!: that(1))\n  subgoal by (fastforce simp: do_intersection_spec_def dest!: that(1))\n  subgoal by (force simp: do_intersection_spec_def dest!: that(1))\n  subgoal by (auto simp: do_intersection_spec_def dest!: that(1))\n  subgoal by (fastforce simp: do_intersection_spec_def dest!: that(1))\n  subgoal by (fastforce simp: do_intersection_spec_def dest!: that(1))\n  done\n\nlemma do_intersection_spec_subset2:\n  \"do_intersection_spec S p ivl sctn X1 (ab, CY) \\<Longrightarrow> CY \\<subseteq> CX \\<Longrightarrow> CX \\<subseteq> Csafe \\<Longrightarrow>\n    CX \\<inter> p = {} \\<Longrightarrow> CX \\<inter> ivl \\<inter> plane_of sctn = {} \\<Longrightarrow> X0 \\<subseteq> X1 \\<Longrightarrow>\n  do_intersection_spec S p ivl sctn X0 (ab, CX)\"\n  by (auto simp: do_intersection_spec_def intro: poincare_mapsto_subset)\n\nlemma do_intersection_spec_Union3:\n  \"do_intersection_spec S osctns ivl csctns (\\<Union>x\\<in>X. a x) ((\\<Union>x\\<in>X. b x), (\\<Union>x\\<in>X. c x))\"\n  if  \"finite X\" \"X \\<noteq> {}\" \"\\<And>x. x \\<in> X \\<Longrightarrow> do_intersection_spec S osctns ivl csctns (a x) (b x, c x)\"\n  using that\nproof induction\n  case empty\n  then show ?case by (auto simp: )\nnext\n  case (insert x F)\n  show ?case\n    apply (cases \"F = {}\")\n    subgoal using insert by simp\n    subgoal\n      apply simp\n      apply (rule do_intersection_spec_union)\n       apply (rule insert.prems) apply simp\n      apply (rule insert.IH)\n       apply (assumption)\n      apply (rule insert.prems) apply simp\n      done\n    done\nqed\n\nlemma do_intersection_coll[le]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"do_intersection_coll sctns ivl sctn (X::'n eucl1 set) \\<le>\n    SPEC (\\<lambda>(P1, P2, CX, X0s).\n      do_intersection_spec UNIV sctns ivl sctn (X - X0s) (P1, CX) \\<and>\n      do_intersection_spec UNIV sctns ivl sctn (X - X0s) (P2, CX)\n      \\<and> fst ` (X - X0s) \\<subseteq> CX\n      \\<and> X0s \\<subseteq> X)\"\n  unfolding do_intersection_coll_def autoref_tag_defs\n  apply (refine_vcg, clarsimp_all)\n  subgoal\n    apply (rule do_intersection_spec_subset[OF _ diff_subset])\n    apply (rule do_intersection_spec_Union3)\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    done\n  subgoal\n    apply (rule do_intersection_spec_subset[OF _ diff_subset])\n    apply (rule do_intersection_spec_Union3)\n    subgoal by auto\n    subgoal by auto\n    subgoal by auto\n    done\n  subgoal by fastforce\n  subgoal by fastforce\n  done\n\nlemma\n  do_intersection_flowsto_trans_outside:\n  assumes \"flowsto XS0 {0..} (CX \\<times> UNIV) X1\"\n  assumes \"do_intersection_spec UNIV guards ivl sctn X1 (P, CP)\"\n  assumes \"fst ` X1 \\<subseteq> CP\"\n  assumes \"{x \\<in> ivl. x \\<in> plane_of sctn} \\<inter> CX = {}\"\n  assumes \"guards \\<inter> (CX \\<union> CP) = {}\"\n  assumes \"XS0 \\<subseteq> CX \\<times> UNIV\"\n  assumes \"closed ivl\"\n  assumes \"CX \\<subseteq> Csafe\"\n  shows \"do_intersection_spec UNIV guards ivl sctn XS0 (P, CX \\<union> CP)\"\n  using assms\n  apply (auto simp: do_intersection_spec_def)\n  subgoal\n    apply (rule flowsto_poincare_trans, assumption, assumption)\n    subgoal by simp\n    subgoal by auto\n    subgoal using assms(3) by auto\n    subgoal by (auto intro!: closed_levelset_within continuous_intros simp: plane_of_def)\n    subgoal premises prems for x d\n    proof -\n      have [intro, simp]: \"closed {x \\<in> ivl. x \\<in> plane_of sctn} \" \"closed {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn}\"\n        by (auto intro!: closed_levelset_within continuous_intros simp: plane_of_def assms)\n      from flowsto_poincare_mapsto_trans_flowsto[OF \\<open>flowsto _ _ _ _\\<close> \\<open>poincare_mapsto _ _ _ _ _\\<close> _ _ order_refl]\n      have ft: \"flowsto XS0 {0<..} (X1 \\<union> CX \\<times> UNIV \\<union> CP \\<times> UNIV) (fst ` P \\<times> UNIV)\"\n        by (auto simp: )\n      then have ret: \"returns_to {x \\<in> ivl. x \\<bullet> normal sctn - pstn sctn = 0} x\"\n        apply (rule returns_to_flowstoI[OF _ _ _ _ _ _ order_refl])\n        using prems by (auto simp: plane_of_def)\n      have pm: \"poincare_map {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} x \\<in> fst ` P\"\n        apply (rule poincare_map_mem_flowstoI[OF ft])\n        using prems by (auto simp: plane_of_def)\n      from pm prems have \"\\<forall>\\<^sub>F x in at (poincare_map {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} x) within\n        plane_of sctn. x \\<in> ivl\"\n        by auto\n      from ret have \"isCont (return_time {x \\<in> ivl. x \\<bullet> normal sctn - pstn sctn = 0}) x\"\n        apply (rule return_time_isCont_outside)\n        using prems pm\n        by (auto simp: eventually_at_filter plane_of_def intro!: assms derivative_eq_intros)\n      then show \"isCont (return_time {x \\<in> ivl. x \\<in> plane_of sctn}) x\" by (simp add: plane_of_def)\n    qed\n    subgoal by simp\n    done\n  done\n\nlemma do_intersection_coll_flowsto[le]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  assumes ft: \"flowsto X0 {0..} (CX0 \\<times> UNIV) X\"\n  assumes X_subset: \"X \\<subseteq> CX0 \\<times> UNIV\"\n  assumes X0_subset: \"X0 \\<subseteq> CX0 \\<times> UNIV\" and CX0_safe: \"CX0 \\<subseteq> Csafe\"\n  assumes ci: \"closed ivl\"\n  assumes disj: \"ivl \\<inter> plane_of sctn \\<inter> CX0 = {}\" \"sctns \\<inter> CX0 = {}\"\n  shows \"do_intersection_coll sctns ivl sctn (X::'n eucl1 set) \\<le>\n    SPEC (\\<lambda>(P1, P2, CX, X0s).\n      \\<exists>A.\n        do_intersection_spec UNIV sctns ivl sctn A (P1, CX0 \\<union> CX) \\<and>\n        do_intersection_spec UNIV sctns ivl sctn A (P2, CX0 \\<union> CX) \\<and>\n        flowsto (X0 - A) {0..} (CX0 \\<times> UNIV) X0s \\<and>\n        A \\<subseteq> X0 \\<and>\n        P1 \\<inter> X0s = {} \\<and>\n        P2 \\<inter> X0s = {})\"\n  apply (rule do_intersection_coll)\n   apply (rule wd)\nproof (clarsimp, goal_cases)\n  case (1 P1 P2 CX R)\n  from ft have \"flowsto X0 {0..} (CX0 \\<times> UNIV) (X - R \\<union> R)\"\n    by (rule flowsto_subset) auto\n  from flowsto_union_DiffE[OF this]\n  obtain A where AB: \"A \\<subseteq> X0\"\n    and A: \"flowsto A {0..} (CX0 \\<times> UNIV) (X - R)\"\n    and B: \"flowsto (X0 - A) {0..} (CX0 \\<times> UNIV) (R)\"\n    by auto\n  have di: \"do_intersection_spec UNIV sctns ivl sctn A (P1, CX0 \\<union> CX)\"\n    apply (rule do_intersection_flowsto_trans_outside[OF A 1(1)])\n    subgoal using 1 by simp\n    subgoal using disj by auto\n    subgoal using 1 disj by (auto simp: do_intersection_spec_def)\n    subgoal using X0_subset AB by (auto simp: do_intersection_spec_def)\n    subgoal using ci by simp\n    subgoal using CX0_safe .\n    done\n  then have \"P1 \\<subseteq> (ivl \\<inter> plane_of sctn) \\<times> UNIV\"\n    by (auto simp: do_intersection_spec_def)\n  then have disjoint: \"P1 \\<inter> R = {}\"\n    using \\<open>R \\<subseteq> X\\<close> disj X_subset\n      apply (auto simp: subset_iff)\n    by (metis (no_types, lifting) Int_iff disjoint_iff_not_equal)\n\n  have di2: \"do_intersection_spec UNIV sctns ivl sctn A (P2, CX0 \\<union> CX)\"\n    apply (rule do_intersection_flowsto_trans_outside[OF A 1(2)])\n    subgoal using 1 by simp\n    subgoal using disj by auto\n    subgoal using 1 disj by (auto simp: do_intersection_spec_def)\n    subgoal using X0_subset AB by (auto simp: do_intersection_spec_def)\n    subgoal using ci by simp\n    subgoal using CX0_safe .\n    done\n  then have \"P2 \\<subseteq> (ivl \\<inter> plane_of sctn) \\<times> UNIV\"\n    by (auto simp: do_intersection_spec_def)\n  then have \"P2 \\<inter> R = {}\"\n    using \\<open>R \\<subseteq> X\\<close> disj X_subset\n      apply (auto simp: subset_iff)\n    by (metis (no_types, lifting) Int_iff disjoint_iff_not_equal)\n  from AB this disjoint di di2 B show ?case\n    by (auto simp:)\nqed\n\nlemma op_enlarge_ivl_sctn[le, refine_vcg]:\n  \"op_enlarge_ivl_sctn ivl sctn d \\<le> SPEC (\\<lambda>ivl'. ivl \\<subseteq> ivl')\"\n  unfolding op_enlarge_ivl_sctn_def\n  apply refine_vcg\n  unfolding plane_of_def\n  apply (safe intro!: eventually_in_planerectI)\n  apply (auto  intro!: simp: eucl_le[where 'a='a] inner_sum_left inner_Basis if_distrib\n     algebra_simps cong: if_cong)\n  done\n\nlemma resolve_ivlplanes[le]:\n  assumes wd[refine_vcg]: \"wd TYPE('a::enum rvec)\"\n  assumes\n    \"\\<forall>x\\<in>Xg. case x of (I, G) \\<Rightarrow> flowsto (XSf G) {0..} (CXS \\<times> UNIV) G\"\n    \"(\\<Union>x\\<in>Xg. snd x) \\<subseteq> (Csafe - (ivlplanes \\<union> guards)) \\<times> UNIV\"\n    \"CXS \\<times> UNIV \\<subseteq> (Csafe - (ivlplanes \\<union> guards)) \\<times> UNIV\"\n    \"(\\<Union>a\\<in>Xg. XSf (snd a)) \\<subseteq> (CXS::'a rvec set) \\<times> UNIV\"\n    \"(\\<Union>x\\<in>Xg. snd x) \\<subseteq> CXS \\<times> UNIV\"\n    \"(\\<Union>x\\<in>Xg. fst x) \\<subseteq> ivlplanes \\<union> guards\"\n  shows \"resolve_ivlplanes guards ivlplanes Xg \\<le> SPEC (\\<lambda>PS.\n    CXS \\<inter> (guards \\<union> ivlplanes) = {} \\<and>\n    CXS \\<subseteq> Csafe \\<and>\n    (\\<exists>R0 P0. (\\<Union>x\\<in>PS. P0 x) \\<union> (\\<Union>x\\<in>PS. R0 x) = (\\<Union>a\\<in>Xg. XSf (snd a))\\<and>\n       (\\<forall>x\\<in>PS. case x of (X, P1, P2, R, ivl, sctn, CX) \\<Rightarrow>\n          ivl \\<inter> plane_of sctn \\<subseteq> ivlplanes \\<and> closed ivl \\<and>\n          P0 (X, P1, P2, R, ivl, sctn, CX) \\<inter> R0 (X, P1, P2, R, ivl, sctn, CX) = {} \\<and>\n          R0 (X, P1, P2, R, ivl, sctn, CX) \\<subseteq> (CXS \\<times> UNIV) \\<and>\n          flowsto (R0 (X, P1, P2, R, ivl, sctn, CX)) {0..} (CXS \\<times> UNIV) R \\<and>\n          do_intersection_spec UNIV guards ivl sctn (P0 (X, P1, P2, R, ivl, sctn, CX)) (P1, CXS \\<union> CX) \\<and>\n          do_intersection_spec UNIV guards ivl sctn (P0 (X, P1, P2, R, ivl, sctn, CX)) (P2, CXS \\<union> CX))))\"\n  using assms\n  unfolding resolve_ivlplanes_def\n  apply clarsimp_all\n  apply (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>Xgs PS.\n      (\\<exists>R0 P0.\n        snd ` Xgs \\<subseteq> fst ` PS \\<and> fst ` PS \\<subseteq> snd ` Xg \\<and>\n        (\\<forall>(X, P1, P2, R, ivl, sctn, CX) \\<in> PS.\n            P0 (X, P1, P2, R, ivl, sctn, CX) \\<union> R0 (X, P1, P2, R, ivl, sctn, CX) = XSf X\n          \\<and> ivl \\<inter> plane_of sctn \\<subseteq> ivlplanes \\<and> closed ivl\n          \\<and> P0 (X, P1, P2, R, ivl, sctn, CX) \\<inter> R0 (X, P1, P2, R, ivl, sctn, CX) = {}\n          \\<and> R0 (X, P1, P2, R, ivl, sctn, CX) \\<subseteq> (CXS \\<times> UNIV)\n          \\<and> flowsto (R0 (X, P1, P2, R, ivl, sctn, CX)) {0..} (CXS \\<times> UNIV) R\n          \\<and> do_intersection_spec UNIV guards ivl sctn (P0 (X, P1, P2, R, ivl, sctn, CX)) (P1, CXS \\<union> CX)\n          \\<and> do_intersection_spec UNIV guards ivl sctn (P0 (X, P1, P2, R, ivl, sctn, CX)) (P2, CXS \\<union> CX)))\"],\n        clarsimp_all)\n    using [[goals_limit=1]]\n    subgoal by auto\n    subgoal by auto\n    subgoal for a b c\n      apply (frule bspec, assumption, clarsimp)\n      apply (rule do_intersection_coll_flowsto)\n              apply (rule wd)\n             apply assumption\n            apply force\n           apply force\n          apply blast\n         apply assumption\n      subgoal premises prems\n      proof -\n        have \"(b \\<inter> plane_of c, a) \\<in> Xg\" using prems by simp\n        with \\<open>(\\<Union>x\\<in>Xg. fst x) \\<subseteq> ivlplanes \\<union> guards\\<close>\n        have \"b \\<inter> plane_of c \\<subseteq> ivlplanes \\<union> guards\"\n          by (force simp: subset_iff)\n        then show ?thesis\n          using \\<open>CXS \\<times> UNIV \\<subseteq> (Csafe - (ivlplanes \\<union> guards)) \\<times> UNIV\\<close>\n          by auto\n      qed\n      subgoal by (auto simp: subset_iff)\n      subgoal apply (refine_vcg, clarsimp_all) apply force\n        apply (intro exI conjI)defer defer defer apply assumption+\n         apply simp\n         apply force\n        apply force\n        apply force\n        done\n      done\n    subgoal by (auto simp: subset_iff) blast\n    subgoal for a b c d e f R0 P0\n      apply (frule bspec, assumption, clarsimp)\n      apply (rule do_intersection_coll_flowsto)\n              apply (rule wd)\n             apply assumption\n      subgoal\n        apply (rule order_trans[where y=\"(\\<Union>x\\<in>Xg. snd x)\"]) \n        by auto\n      subgoal\n        apply (rule order_trans) defer apply assumption\n        by auto\n      subgoal by blast\n      subgoal by simp\n      subgoal premises prems\n      proof -\n        have \"(d \\<inter> plane_of e, c) \\<in> Xg\" using prems by simp\n        with \\<open>(\\<Union>x\\<in>Xg. fst x) \\<subseteq> ivlplanes \\<union> guards\\<close>\n        have \"d \\<inter> plane_of e \\<subseteq> ivlplanes \\<union> guards\"\n          by (force simp: subset_iff)\n        then show ?thesis\n          using \\<open>CXS \\<times> UNIV \\<subseteq> (Csafe - (ivlplanes \\<union> guards)) \\<times> UNIV\\<close>\n          by auto\n      qed\n      subgoal by (auto simp: subset_iff)\n      subgoal\n        apply (refine_vcg, clarsimp_all)\n        subgoal by (auto simp: subset_iff)\n        subgoal by (auto simp: )\n        subgoal for x1 x1' x2 x3 A\n          apply (rule exI[where x=\"R0((c, x1, x1', x3, d, e, x2):=(XSf c - A))\"])\n          apply (rule exI[where x=\"P0((c, x1, x1', x3, d, e, x2):=A)\"])\n          apply clarsimp\n          apply (rule conjI)\n          subgoal by auto\n          apply (rule conjI)\n          subgoal premises prems\n            using prems\n            apply (auto simp: subset_iff)\n            by fastforce\n          apply clarsimp\n          subgoal\n            apply (drule bspec, assumption)\n            apply (drule bspec, assumption)\n            by force\n          done\n        done\n      done\n    subgoal by (auto simp: subset_iff)\n    subgoal by (auto simp: subset_iff)\n    subgoal for a R0 P0\n      apply (rule exI[where x=R0])\n      apply (rule exI[where x=P0])\n      apply (rule conjI)\n      subgoal premises prems\n      proof -\n        note prems\n        show ?thesis\n          using prems(9,8)\n          by fastforce\n      qed\n      by auto\n    done\n\n\nlemma poincare_onto[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd TYPE('a::enum rvec)\"\n  assumes [refine_vcg]: \"\\<And>X0. X0 \\<subseteq> Csafe \\<times> UNIV \\<Longrightarrow> symstart X0 \\<le>\n    SPEC (\\<lambda>(CX, X). flowsto (X0 - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) X)\"\n  assumes CXS0: \"CXS0 \\<inter> (guards \\<union> ivlplanes) = {}\"\n  shows \"poincare_onto ro symstart trap guards ivlplanes (XS0::'a eucl1 set) CXS0 \\<le>\n    SPEC (\\<lambda>PS.\n      (\\<exists>R0 P0.\n        \\<Union>(P0 ` PS \\<union> R0 ` PS) = XS0 - trap \\<times> UNIV \\<and>\n        (\\<forall>(X, P1, P2, R, ivl, sctn, CX, CXS) \\<in> PS.\n            ivl \\<inter> plane_of sctn \\<subseteq> ivlplanes \\<and> closed ivl\n          \\<and> XS0 \\<subseteq> CXS \\<times> UNIV \\<and> CXS0 \\<subseteq> CXS \\<and> CXS \\<inter> (guards \\<union> ivlplanes) = {}\n          \\<and> P0 (X, P1, P2, R, ivl, sctn, CX, CXS) \\<inter> R0 (X, P1, P2, R, ivl, sctn, CX, CXS) = {}\n          \\<and> R0 (X, P1, P2, R, ivl, sctn, CX, CXS) \\<subseteq> CXS \\<times> UNIV\n          \\<and> flowsto (R0 (X, P1, P2, R, ivl, sctn, CX, CXS)) {0..} (CXS \\<times> UNIV) R\n          \\<and> do_intersection_spec UNIV guards ivl sctn (P0 (X, P1, P2, R, ivl, sctn, CX, CXS)) (P1, CXS \\<union> CX)\n          \\<and> do_intersection_spec UNIV guards ivl sctn (P0 (X, P1, P2, R, ivl, sctn, CX, CXS)) (P2, CXS \\<union> CX))\n        ))\"\n  unfolding poincare_onto_def autoref_tag_defs\n  using [[goals_limit=1]]\n  apply (refine_vcg, clarsimp_all)\n  apply (refine_vcg resolve_ivlplanes[OF wd])\n  subgoal by force\n  apply clarsimp\n  subgoal for a b c d R0 P0\n    apply (rule exI[where x=\"\\<lambda>(X, P1, P2, R, ivl, sctn, CX, CXS). R0 (X, P1, P2, R, ivl, sctn, CX)\"])\n    apply (rule exI[where x=\"\\<lambda>(X, P1, P2, R, ivl, sctn, CX, CXS). P0 (X, P1, P2, R, ivl, sctn, CX)\"])\n    apply (rule conjI)\n    subgoal premises prems\n      using \\<open>(\\<Union>x\\<in>d. P0 x) \\<union> (\\<Union>x\\<in>d. R0 x) = (\\<Union>x\\<in>b. c (snd x)) - trap \\<times> UNIV\\<close>\n      by auto\n    subgoal\n      apply clarsimp\n      apply (drule bspec, assumption)+\n      apply (rule conjI, force)\n      apply (rule conjI, force)\n      apply (rule conjI, force)\n      apply (rule conjI)\n      subgoal using CXS0 by (auto simp: )\n      apply (rule conjI, force)\n      apply (rule conjI, force)\n      apply (rule conjI)\n      subgoal by (auto intro: flowsto_subset)\n      subgoal\n        apply clarsimp\n        apply (rule conjI)\n        subgoal\n          apply (rule do_intersection_spec_subset2, assumption)\n          subgoal by force\n          subgoal by (force simp: do_intersection_spec_def)\n          subgoal using CXS0 by (auto simp: do_intersection_spec_def)\n          subgoal using CXS0 by (auto simp: do_intersection_spec_def)\n          subgoal by auto\n          done\n        subgoal\n          apply (rule do_intersection_spec_subset2, assumption)\n          subgoal by force\n          subgoal by (force simp: do_intersection_spec_def)\n          subgoal using CXS0 by (auto simp: do_intersection_spec_def)\n          subgoal using CXS0 by (auto simp: do_intersection_spec_def)\n          subgoal by auto\n          done\n        done\n      done\n    done\n  done\n\nlemma empty_remainders[le, refine_vcg]:\n  \"empty_remainders PS \\<le> SPEC (\\<lambda>b. b \\<longrightarrow> (\\<forall>(X, P1, P2, R, ivl, sctn, CX) \\<in> PS. R = {}))\"\n  unfolding empty_remainders_def\n  by (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>Xs b. b \\<longrightarrow> (\\<forall>(X, P1, P2, R, ivl, sctn, CX) \\<in> Xs. R = {})\"])\n     auto\n\nlemma poincare_onto_empty[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd TYPE('a::enum rvec)\"\n  assumes CXS0: \"CXS0 \\<inter> (guards \\<union> ivlplanes) = {}\"\n  shows \"poincare_onto_empty ro guards ivlplanes (XS0::'a eucl1 set) CXS0 \\<le>\n    SPEC (\\<lambda>(PS).\n      (\\<exists>R0 P0.\n        \\<Union>(P0 ` PS \\<union> R0 ` PS) = XS0 \\<and>\n        (\\<forall>(X, P1, P2, R, ivl, sctn, CX, CXS) \\<in> PS.\n            ivl \\<inter> plane_of sctn \\<subseteq> ivlplanes \\<and> closed ivl\n          \\<and> XS0 \\<subseteq> CXS \\<times> UNIV \\<and> CXS0 \\<subseteq> CXS \\<and> CXS \\<inter> (guards \\<union> ivlplanes) = {}\n          \\<and> P0 (X, P1, P2, R, ivl, sctn, CX, CXS) \\<inter> R0 (X, P1, P2, R, ivl, sctn, CX, CXS) = {}\n          \\<and> R0 (X, P1, P2, R, ivl, sctn, CX, CXS) \\<subseteq> CXS \\<times> UNIV\n          \\<and> flowsto (R0 (X, P1, P2, R, ivl, sctn, CX, CXS)) {0..} (CXS \\<times> UNIV) R\n          \\<and> do_intersection_spec UNIV guards ivl sctn (P0 (X, P1, P2, R, ivl, sctn, CX, CXS)) (P1, CXS \\<union> CX)\n          \\<and> do_intersection_spec UNIV guards ivl sctn (P0 (X, P1, P2, R, ivl, sctn, CX, CXS)) (P2, CXS \\<union> CX))\n        ))\"\n  using CXS0\n  unfolding poincare_onto_empty_def autoref_tag_defs\n  by (refine_vcg) (auto intro!: flowsto_self)\n\nlemma do_intersection_spec_union2:\n  assumes \"do_intersection_spec S osctns ivl csctns a (b, c)\"\n    \"do_intersection_spec S osctns ivl csctns f (b, c)\"\n  shows \"do_intersection_spec S osctns ivl csctns (a \\<union> f) (b, c)\"\n  using do_intersection_spec_union[OF assms]\n  by auto\n\nlemma poincare_onto2[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd TYPE('a::enum rvec)\"\n  assumes [refine_vcg]: \"\\<And>X0. X0 \\<subseteq> Csafe \\<times> UNIV \\<Longrightarrow> symstart X0 \\<le>\n    SPEC (\\<lambda>(CX, X). flowsto (X0 - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) X)\"\n  notes [refine_vcg_def] = op_set_ndelete_spec\n  shows \"poincare_onto2 ro symstart trap guards ivlplanes (XS0::'a eucl1 set) \\<le>\n    SPEC (\\<lambda>(PS).\n      (\\<exists>P0. \\<Union>(P0 ` PS) = XS0 - trap \\<times> UNIV \\<and>\n        (\\<forall>(s, X, P1, P2, R, ivl, sctn, CX, CXS) \\<in> PS.\n          XS0 \\<subseteq> CXS \\<times> UNIV \\<and>\n          do_intersection_spec UNIV guards ivl sctn (P0 (s, X, P1, P2, R, ivl, sctn, CX, CXS)) (P1, CXS \\<union> CX) \\<and>\n          do_intersection_spec UNIV guards ivl sctn (P0 (s, X, P1, P2, R, ivl, sctn, CX, CXS)) (P2, CXS \\<union> CX))))\"\n  unfolding poincare_onto2_def autoref_tag_defs\n  apply (refine_vcg, clarsimp_all)\n  subgoal for PS R0 P0\n    apply (rule FORWEAK_mono_rule_empty[where I=\"\\<lambda>PS1 PS2.\n      (\\<exists>X0.\n        \\<Union>(R0 ` PS1) \\<subseteq> \\<Union>(X0 ` PS2) \\<and>\n        (\\<forall>(X, P1, P2, R, ivl, sctn, CX, CXS) \\<in> PS2.\n          XS0 \\<subseteq> CXS \\<times> UNIV \\<and>\n          do_intersection_spec UNIV guards ivl sctn (X0 (X, P1, P2, R, ivl, sctn, CX, CXS)) (P1, CXS \\<union> CX) \\<and>\n          do_intersection_spec UNIV guards ivl sctn (X0 (X, P1, P2, R, ivl, sctn, CX, CXS)) (P2, CXS \\<union> CX)))\"])\n    subgoal by refine_vcg\n    subgoal by auto\n    subgoal by auto\n    subgoal\n      apply clarsimp\n      subgoal for c\n        apply (rule exI[where x=c])\n        apply (rule conjI)\n         apply (rule order_trans) prefer 2 apply assumption\n         apply (rule UN_mono) apply assumption apply (rule order_refl) apply assumption\n        done\n      done\n    subgoal for \\<sigma>\n      apply (clarsimp)\n      subgoal for X0\n        apply (rule exI[where x=\"\\<lambda>(b, x). (if b then X0 x else P0 x) \\<inter> XS0 - trap \\<times> UNIV \"])\n        apply (rule conjI)\n        subgoal premises prems\n          using \\<open>(\\<Union>x\\<in>PS. P0 x) \\<union> (\\<Union>x\\<in>PS. R0 x) = XS0 - trap \\<times> UNIV\\<close>\n            \\<open>(\\<Union>x\\<in>PS. R0 x) \\<subseteq> (\\<Union>x\\<in>\\<sigma>. X0 x)\\<close>\n          by auto\n        subgoal by (auto intro: do_intersection_spec_subset)\n        done\n      done\n    apply clarsimp\n    subgoal for a b b' c d e f g h i j\n      apply (cases \"c = {}\")\n      subgoal by (auto intro!: exI[where x=\"j\"])\n      subgoal\n        using [[goals_limit=1]]\n        apply clarsimp\n        apply refine_vcg\n        subgoal premises prems for k l\n        proof -\n          note prems\n          then show ?thesis\n            apply -\n            apply (drule bspec, assumption)+\n            apply clarsimp\n            subgoal premises prems\n              using \\<open>g \\<inter> (guards \\<union> \\<Union>k) = {}\\<close> \\<open>l = k - {d \\<inter> plane_of e} \\<or> l = k\\<close> \\<open>d \\<inter> plane_of e \\<subseteq> \\<Union>k\\<close>\n              by auto\n            done\n        qed\n        apply simp\n        apply (drule bspec, assumption)\n        apply simp\n        apply (erule exE conjE)+\n        subgoal for k l m n p q\n          apply (subgoal_tac \"\\<And>x. x \\<in> m \\<Longrightarrow> p x = {}\")\n           defer\n          subgoal for x\n          proof goal_cases\n            case 1\n            from 1(10,15,24)\n            show ?case\n              by (auto dest!: bspec[where x=x])\n          qed\n          apply simp\n          subgoal premises prems\n          proof -\n            note prems\n            from prems have \"finite (q ` m)\" \"flowsto (R0 (a, b, b', c, d, e, f, g)) {0..} (g \\<times> UNIV) (\\<Union>(q ` m))\"\n              by auto\n            from flowsto_Union_funE[OF this]\n            obtain XGs where\n              XGs: \"\\<And>G. G \\<in> q ` m \\<Longrightarrow> flowsto (XGs G) {0..} (g \\<times> UNIV) G\"\n              \"R0 (a, b, b', c, d, e, f, g) = \\<Union>(XGs ` (q ` m))\"\n              by metis\n            define q0 where \"q0 = XGs o q\"\n            have \"case x of (X, P1, P2, R, ivl, sctn, CX, CXS) \\<Rightarrow>\n                do_intersection_spec UNIV guards ivl sctn (q0 (X, P1, P2, R, ivl, sctn, CX, CXS)) (P1, CXS \\<union> CX) \\<and>\n                do_intersection_spec UNIV guards ivl sctn (q0 (X, P1, P2, R, ivl, sctn, CX, CXS)) (P2, CXS \\<union> CX)\"\n              if \"x \\<in> m\"\n              for x\n            proof (clarsimp, goal_cases)\n              case (1 X P1 P2 R ivl sctn CX CXS)\n              with prems(10)[rule_format, OF \\<open>x \\<in> m\\<close>] prems(15)[rule_format, OF \\<open>x \\<in> m\\<close>] \\<open>_ = c\\<close>\n              have *: \"R = {}\"\n                \"x = (X, P1, P2, {}, ivl, sctn, CX, CXS)\"\n                \"ivl \\<inter> plane_of sctn \\<subseteq> \\<Union>l\"\n                \"closed ivl\"\n                \"c \\<subseteq> CXS \\<times> UNIV\"\n                \"g \\<subseteq> CXS\"\n                \"\\<Union>(q ` m) \\<subseteq> CXS \\<times> UNIV\"\n                \"CXS \\<inter> (guards \\<union> \\<Union>l) = {}\"\n                \"p (X, P1, P2, {}, ivl, sctn, CX, CXS) = {}\"\n                \"p (X, P1, P2, R, ivl, sctn, CX, CXS) \\<subseteq> CXS \\<times> UNIV\"\n                \"do_intersection_spec UNIV guards ivl sctn (q (X, P1, P2, {}, ivl, sctn, CX, CXS)) (P1, CXS \\<union> CX)\"\n                \"do_intersection_spec UNIV guards ivl sctn (q (X, P1, P2, {}, ivl, sctn, CX, CXS)) (P2, CXS \\<union> CX)\"\n                by auto\n              have \"do_intersection_spec UNIV guards ivl sctn (q0 (X, P1, P2, R, ivl, sctn, CX, CXS)) (P1, (CXS \\<union> CX) \\<union> (CXS \\<union> CX))\"\n                apply (rule do_intersection_flowsto_trans_outside)\n                       apply (simp add: q0_def)\n                       apply (rule flowsto_subset)\n                           apply (rule XGs)\n                using \\<open>x \\<in> m\\<close> apply (rule imageI)\n                using 1 apply force\n                         apply force\n                using * apply force\n                       apply (rule order_refl)\n                using * apply (auto intro!: *)[]\n                subgoal\n                  using * \\<open>x \\<in> m\\<close>\n                  by (auto simp add: )\n                subgoal using * by (auto simp: do_intersection_spec_def)\n                subgoal using * by (auto simp: do_intersection_spec_def)\n                subgoal\n                proof -\n                  have \"q0 (X, P1, P2, R, ivl, sctn, CX, CXS) \\<subseteq> XGs (q x)\"\n                    by (auto simp: q0_def 1)\n                  also have \"\\<dots> \\<subseteq> R0 (a, b, b', c, d, e, f, g)\" using \\<open>x \\<in>m\\<close> XGs by auto\n                  also have \"\\<dots> \\<subseteq> (CXS \\<union> CX) \\<times> UNIV\"\n                    using prems(20) \\<open>g \\<subseteq> CXS\\<close> by auto\n                  finally show ?thesis by simp\n                qed\n                subgoal by fact\n                subgoal using * by (auto simp: do_intersection_spec_def)\n                done\n              moreover have \"do_intersection_spec UNIV guards ivl sctn (q0 (X, P1, P2, R, ivl, sctn, CX, CXS)) (P2, (CXS \\<union> CX) \\<union> (CXS \\<union> CX))\"\n                apply (rule do_intersection_flowsto_trans_outside)\n                       apply (simp add: q0_def)\n                       apply (rule flowsto_subset)\n                           apply (rule XGs)\n                using \\<open>x \\<in> m\\<close> apply (rule imageI)\n                using 1 apply force\n                         apply force\n                using * apply force\n                       apply (rule order_refl)\n                using * apply (auto intro!: *)[]\n                subgoal\n                  using * \\<open>x \\<in> m\\<close>\n                  by (auto simp add: )\n                subgoal using * by (auto simp: do_intersection_spec_def)\n                subgoal using * by (auto simp: do_intersection_spec_def)\n                subgoal\n                proof -\n                  have \"q0 (X, P1, P2, R, ivl, sctn, CX, CXS) \\<subseteq> XGs (q x)\"\n                    by (auto simp: q0_def 1)\n                  also have \"\\<dots> \\<subseteq> R0 (a, b, b', c, d, e, f, g)\" using \\<open>x \\<in>m\\<close> XGs by auto\n                  also have \"\\<dots> \\<subseteq> (CXS \\<union> CX) \\<times> UNIV\"\n                    using prems(20) \\<open>g \\<subseteq> CXS\\<close> by auto\n                  finally show ?thesis by simp\n                qed\n                subgoal by fact\n                subgoal using * by (auto simp: do_intersection_spec_def)\n                done\n              ultimately show ?case\n                by (simp add: )\n            qed note q0 = this\n            have q0': \"(a, aa, aa', ab, ac, ad, ae, b) \\<in> m \\<Longrightarrow> XS0 \\<subseteq> b \\<times> UNIV\" for a aa aa' ab ac ad ae b\n              apply (drule prems(15)[rule_format])\n              using \\<open>XS0 \\<subseteq> g \\<times> UNIV\\<close>\n              by auto\n            from prems\n            show ?thesis\n              apply (intro exI[where x=\"\\<lambda>x. if x \\<in> i \\<inter> m then j x \\<union> q0 x else if x \\<in> i then j x else q0 x\"] conjI)\n              subgoal 1 premises prems\n                unfolding XGs\n                apply simp\n                by (auto simp: q0_def)\n              subgoal premises _\n                by (rule order_trans[OF \\<open>(\\<Union>x\\<in>h. R0 x) \\<subseteq> (\\<Union>x\\<in>i. j x)\\<close>]) auto\n              subgoal premises _ using prems(6)[rule_format] q0\n                apply auto\n                subgoal by (auto dest!: prems(6)[rule_format] q0 intro!: do_intersection_spec_union2)\n                subgoal by (auto dest!: prems(6)[rule_format] q0 intro!: do_intersection_spec_union2)\n                subgoal by (auto intro!: do_intersection_spec_union2)\n                subgoal by (auto dest!: prems(6)[rule_format] q0' intro!: do_intersection_spec_union2)\n                subgoal by (auto dest!: prems(6)[rule_format] q0 intro!: do_intersection_spec_union2)\n                subgoal by (auto dest!: prems(6)[rule_format] q0 intro!: do_intersection_spec_union2)\n                subgoal by (auto dest!: prems(6)[rule_format] q0 intro!: do_intersection_spec_union2)\n                subgoal by (auto dest!: prems(6)[rule_format] q0 intro!: do_intersection_spec_union2)\n                done\n              done\n          qed\n          done\n        done\n      done\n    done\n  done\n\nlemma width_spec_ivl[THEN order_trans, refine_vcg]: \"width_spec_ivl M X \\<le> SPEC (\\<lambda>x. True)\"\n  unfolding width_spec_ivl_def\n  by (refine_vcg)\n\nlemma partition_ivl_spec[le, refine_vcg]:\n  shows \"partition_ivl cg XS \\<le> SPEC (\\<lambda>YS. XS \\<subseteq> YS)\"\n  unfolding partition_ivl_def autoref_tag_defs\n  apply (refine_vcg, clarsimp_all)\n  subgoal by fastforce\n  subgoal by fastforce\n  subgoal by fastforce\n  subgoal by fastforce\n  subgoal premises prems for a b c d e f ws g h i j k l m n\n  proof -\n    note prems\n    have disj: \"\\<And>A Aa. n \\<notin> A \\<or> \\<not> XS \\<inter> A \\<subseteq> Aa \\<or> n \\<in> Aa\"\n      using prems by blast\n    then have \"n \\<in> g\"\n      using prems by (metis (no_types) Un_iff atLeastAtMost_iff subset_iff)\n    then show ?thesis\n      using disj prems by (meson atLeastAtMost_iff)\n  qed\n  done\n\nlemma op_inter_fst_ivl_scaleR2[le,refine_vcg]:\n  \"op_inter_fst_ivl_scaleR2 X Y \\<le> SPEC (\\<lambda>R. X \\<inter> (Y \\<times> UNIV) = R)\"\n  unfolding op_inter_fst_ivl_scaleR2_def\n  apply refine_vcg\n  apply (auto simp: scaleR2_def)\n  subgoal for a b c d e f g h i j k\n    by (rule image_eqI[where x=\"(i, (j, k))\"]; fastforce)\n  subgoal for a b c d e f g h i j k\n    by (rule image_eqI[where x=\"(i, (j, k))\"]; fastforce)\n  done\n\nlemma op_inter_fst_ivl_coll_scaleR2[le,refine_vcg]:\n  \"op_inter_fst_ivl_coll_scaleR2 X Y \\<le> SPEC (\\<lambda>R. X \\<inter> (Y \\<times> UNIV) = R)\"\n  unfolding op_inter_fst_ivl_coll_scaleR2_def\n  by (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>Xs R. (\\<Union>Xs) \\<inter> (Y \\<times> UNIV) \\<subseteq> R \\<and> R \\<subseteq> X \\<inter> (Y \\<times> UNIV)\"])\n    auto\n\nlemma op_inter_ivl_co[le, refine_vcg]: \"op_ivl_of_ivl_coll X \\<le> SPEC (\\<lambda>R. X \\<subseteq> R)\"\n  unfolding op_ivl_of_ivl_coll_def\n  apply (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>R (l, u). \\<Union>R \\<subseteq> {l .. u}\"])\n   apply auto\n   apply (metis Set.basic_monos(7) Sup_le_iff atLeastAtMost_iff inf.coboundedI2 inf_sup_aci(1))\n  by (meson Set.basic_monos(7) UnionI atLeastAtMost_iff le_supI1)\n\nlemma op_inter_ivl_coll_scaleR2[le,refine_vcg]:\n  \"op_inter_ivl_coll_scaleR2 X Y \\<le> SPEC (\\<lambda>R. X \\<inter> (Y \\<times> UNIV) \\<subseteq> R)\"\n  unfolding op_inter_ivl_coll_scaleR2_def\n  apply refine_vcg\n  subgoal for _ _ _ A l u\n    by (auto, rule scaleR2_subset[where i'=l and j'=u and k'=A], auto)\n  done\n\nlemma [le, refine_vcg]: \"op_image_fst_ivl_coll X \\<le> SPEC (\\<lambda>R. R = fst ` X)\"\n  unfolding op_image_fst_ivl_coll_def\n  apply (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>Xs R. fst ` (\\<Union>Xs) \\<subseteq> R \\<and> R \\<subseteq> fst ` X\"])\n     apply auto\n  apply force+\n  done\n\nlemma op_single_inter_ivl[le, refine_vcg]: \"op_single_inter_ivl a fxs \\<le> SPEC (\\<lambda>R. a \\<inter> fxs \\<subseteq> R)\"\n  unfolding op_single_inter_ivl_def\n  by refine_vcg auto\n\nlemma partition_ivle_spec[le, refine_vcg]:\n  shows \"partition_ivle cg XS \\<le> SPEC (\\<lambda>YS. XS \\<subseteq> YS)\"\n  unfolding partition_ivle_def autoref_tag_defs\n  supply [refine_vcg del] = scaleR2_rep_of_coll2\n    and [refine_vcg] = scaleR2_rep_of_coll\n  apply (refine_vcg)\n  subgoal by (fastforce simp: scaleR2_def)\n  subgoal by auto\n  apply clarsimp\n  subgoal by (fastforce simp: scaleR2_def)\n  done\n\n\nlemma vec1repse[THEN order_trans, refine_vcg]:\n  \"vec1repse CX \\<le> SPEC (\\<lambda>R. case R of None \\<Rightarrow> True | Some X \\<Rightarrow> X = vec1_of_flow1 ` CX)\"\n  unfolding vec1repse_def\n  apply (refine_vcg FORWEAK_mono_rule[where\n        I=\"\\<lambda>XS R. case R of None \\<Rightarrow> True | Some R \\<Rightarrow> vec1_of_flow1 ` (\\<Union>XS) \\<subseteq> R \\<and> R \\<subseteq> vec1_of_flow1 ` CX\"])\n  apply (auto simp: scaleR2_def split: option.splits)\n  subgoal for a b c d e f g h i j\n    apply (auto simp: vimage_def image_def)\n    apply (rule exI[where x=\"h\"])\n    apply auto\n    apply (rule exI[where x=f])\n    apply (rule exI[where x=\"matrix j\"])\n    apply auto\n     apply (rule bexI)\n    by (auto simp: vec1_of_flow1_def matrix_scaleR)\n  subgoal for a b c d e f g h i j\n    apply (rule bexI)\n     defer apply assumption\n    apply (rule image_eqI[where x=\"(f, g, j)\"])\n    by (auto simp: flow1_of_vec1_def vec1_of_flow1_def matrix_scaleR[symmetric])\n  subgoal by fastforce\n  subgoal for a b c d e f g h i j k l\n    apply (auto simp: vimage_def image_def)\n    apply (rule exI[where x=\"j\"])\n    apply auto\n    apply (rule exI[where x=h])\n    apply (rule exI[where x=\"matrix l\"])\n    apply auto\n     apply (rule bexI)\n    by (auto simp: vec1_of_flow1_def matrix_scaleR)\n  subgoal by fastforce\n  subgoal for a b c d e f g h i j k l\n    apply (rule bexI)\n     defer apply assumption\n    apply (rule image_eqI[where x=\"(h, i, l)\"])\n    by (auto simp: flow1_of_vec1_def vec1_of_flow1_def matrix_scaleR[symmetric])\n  done\n\nlemma scaleR2_rep1[le, refine_vcg]: \"scaleR2_rep1 Y \\<le> SPEC (\\<lambda>R. Y \\<subseteq> R)\"\n  unfolding scaleR2_rep1_def\n  apply refine_vcg\n  subgoal by (auto simp: norm2_slp_def)\n  subgoal for a b c d e y z f g h i j prec k l m n p q r s\n    apply (auto simp: scaleR2_def image_def vimage_def)\n    subgoal premises prems for B C D E\n    proof -\n      define ij where \"ij = (i + j) / 2\"\n      from prems\n      have \"ij > 0\"\n        by (auto simp: ij_def)\n      show ?thesis\n        unfolding ij_def[symmetric]\n        apply (rule exI[where x=\"1 / ij * B\"])\n        apply (intro conjI) prefer 3\n          apply (rule bexI[where x=\"(D, ij *\\<^sub>R E)\"])\n        subgoal using \\<open>ij > 0\\<close> by auto\n        subgoal\n          using prems\n          using \\<open>(D, E) \\<in> c\\<close> \\<open>c \\<subseteq> {(n, p)..(q, r)}\\<close> \\<open>ij > 0\\<close>\n          by (auto simp: ij_def[symmetric] intro!: scaleR_left_mono)\n        subgoal\n          using \\<open>d \\<le> ereal B\\<close> \\<open>0 < ij\\<close> \\<open>0 < d\\<close>\n          apply (cases d)\n            apply (simp only: times_ereal.simps ereal_less_eq)\n            apply (rule mult_mono)\n               apply (rule real_divl)\n          by auto\n        subgoal\n          using \\<open>0 < d\\<close> \\<open>d \\<le> ereal B\\<close> \\<open>ereal B \\<le> e\\<close> \\<open>0 < ij\\<close> \\<open>0 < e\\<close>\n            \\<open>0 < real_divr prec 1 ((i + j) / 2)\\<close>\n          unfolding ij_def[symmetric]\n          apply (cases e; cases d)\n                  apply (simp only: times_ereal.simps ereal_less_eq)\n                  apply (rule mult_mono)\n                     apply (rule real_divr)\n          by auto\n        done\n    qed\n    done\n  done\n\nlemma reduce_ivl[le, refine_vcg]: \"reduce_ivl Y b \\<le> SPEC (\\<lambda>R. Y \\<subseteq> R)\"\n  unfolding reduce_ivl_def\n  apply refine_vcg\n     apply (auto simp add: scaleR2_def image_def vimage_def plane_of_def )\n     prefer 2\n  subgoal using basic_trans_rules(23) by blast\n    prefer 3\n  subgoal using basic_trans_rules(23) by blast\nproof goal_cases\n  case (1 i0 i1 s0 s1 y0 y1)\n  from 1 have le: \"1 \\<le> (y1 \\<bullet> b) / (i1 \\<bullet> b)\"\n    by (auto simp: min_def dest!: inner_Basis_mono[OF _ \\<open>b \\<in> Basis\\<close>])\n  show ?case\n    apply (rule exI[where x=\"(y1 \\<bullet> b) / (i1 \\<bullet> b)\"])\n    apply (rule conjI) apply fact\n    apply (rule bexI[where x=\"(y0, ((i1 \\<bullet> b) / (y1 \\<bullet> b)) *\\<^sub>R y1)\"])\n    subgoal using 1 le by simp\n    subgoal using 1 le apply simp\n      apply (rule conjI)\n      subgoal\n        apply (auto simp: eucl_le[where 'a=\"'c\"])\n        apply (auto simp: divide_simps)\n        apply (subst mult.commute)\n        subgoal for i\n          apply (cases \" y1 \\<bullet> b \\<le> i1 \\<bullet> b\")\n           apply (rule order_trans)\n            apply (rule mult_left_mono[where b=\"y1 \\<bullet> i\"])\n             apply (auto simp: mult_le_cancel_right)\n          apply (cases \"i1 \\<bullet> i \\<le> 0\")\n           apply (rule order_trans)\n            apply (rule mult_right_mono_neg[where b=\"i1 \\<bullet> b\"])\n             apply auto\n          by (auto simp: not_le inner_Basis split: if_splits dest!: bspec[where x=i])\n        done\n      subgoal\n        apply (auto simp: eucl_le[where 'a=\"'c\"])\n        subgoal for i\n          apply (cases \"i = b\")\n           apply (auto simp: divide_simps)\n          subgoal by (auto simp: divide_simps algebra_simps)\n          subgoal apply (auto simp: divide_simps algebra_simps inner_Basis)\n            apply (subst mult.commute)\n            apply (rule order_trans)\n             apply (rule mult_right_mono[where b=\"s1 \\<bullet> i\"]) apply simp\n             apply simp\n            apply (rule mult_left_mono)\n            by auto\n          done\n        done\n      done\n    done\nnext\n  case (2 i0 i1 s0 s1 y0 y1)\n  from 2 have le: \"1 \\<le> (y1 \\<bullet> b) / (s1 \\<bullet> b)\"\n    by (auto simp: min_def abs_real_def divide_simps dest!: inner_Basis_mono[OF _ \\<open>b \\<in> Basis\\<close>])\n  show ?case\n    apply (rule exI[where x=\"(y1 \\<bullet> b) / (s1 \\<bullet> b)\"])\n    apply (rule conjI) apply fact\n    apply (rule bexI[where x=\"(y0, ((s1 \\<bullet> b) / (y1 \\<bullet> b)) *\\<^sub>R y1)\"])\n    subgoal using 2 le by simp\n    subgoal using 2 le apply simp\n      apply (rule conjI)\n      subgoal\n        apply (auto simp: eucl_le[where 'a=\"'c\"])\n        subgoal for i\n          apply (cases \"i = b\")\n           apply (auto simp: divide_simps)\n          subgoal by (auto simp: divide_simps algebra_simps)\n          subgoal apply (auto simp: divide_simps algebra_simps inner_Basis)\n            apply (subst mult.commute)\n            apply (cases \"y1 \\<bullet> i \\<le> 0\")\n             apply (rule order_trans)\n              apply (rule mult_left_mono_neg[where b=\"y1 \\<bullet> b\"])\n               apply (auto simp: mult_le_cancel_right not_le)\n            apply (rule order_trans)\n             apply (rule mult_right_mono_neg[where b=\"i1 \\<bullet> i\"])\n              apply (auto intro!: mult_left_mono_neg)\n            done\n          done\n        done\n      subgoal\n        apply (auto simp: eucl_le[where 'a=\"'c\"])\n        subgoal for i\n          apply (cases \"i = b\")\n          subgoal by (auto simp: divide_simps algebra_simps)\n          subgoal apply (auto simp: divide_simps algebra_simps inner_Basis)\n            apply (subst mult.commute)\n            apply (cases \"y1 \\<bullet> i \\<ge> 0\")\n             apply (rule order_trans)\n              apply (rule mult_left_mono_neg[where b=\"y1 \\<bullet> i\"]) apply simp\n              apply simp\n             apply (rule mult_right_mono) apply force\n             apply force\n          proof -\n            assume a1: \"\\<forall>i\\<in>Basis. s1 \\<bullet> b * (if b = i then 1 else 0) \\<le> s1 \\<bullet> i\"\n            assume a2: \"i \\<in> Basis\"\n            assume a3: \"i \\<noteq> b\"\n            assume a4: \"y1 \\<bullet> b < 0\"\n            assume a5: \"s1 \\<bullet> b < 0\"\n            assume a6: \"\\<not> 0 \\<le> y1 \\<bullet> i\"\n            have \"s1 \\<bullet> b * (if b = i then 1 else 0) \\<le> s1 \\<bullet> i\"\n              using a2 a1 by metis\n            then have f7: \"0 \\<le> s1 \\<bullet> i\"\n              using a3 by (metis (full_types) mult_zero_right)\n            have f8: \"y1 \\<bullet> b \\<le> 0\"\n              using a4 by (metis eucl_less_le_not_le)\n            have \"s1 \\<bullet> b \\<le> 0\"\n              using a5 by (metis eucl_less_le_not_le)\n            then show \"y1 \\<bullet> b * (s1 \\<bullet> i) \\<le> s1 \\<bullet> b * (y1 \\<bullet> i)\"\n              using f8 f7 a6 by (metis mult_right_mono_le mult_zero_left zero_le_mult_iff zero_le_square)\n          qed\n          done\n        done\n      done\n    done\nqed\n\nlemma reduce_ivle[le, refine_vcg]:\n  \"reduce_ivle Y b \\<le> SPEC (\\<lambda>R. Y \\<subseteq> R)\"\n  unfolding reduce_ivle_def\n  apply refine_vcg\n  apply (auto simp: scaleR2_def image_def vimage_def)\n  subgoal for a b c d e f g h i j k\n    apply (drule subsetD, assumption)\n    apply auto\n    subgoal for l m\n    apply (rule exI[where x=\"l * g\"])\n      apply (intro conjI)\n    subgoal\n      unfolding times_ereal.simps[symmetric]\n      apply (rule ereal_mult_mono)\n      subgoal by (cases e) auto\n      subgoal by (cases b) auto\n      subgoal by (cases b) auto\n      subgoal by (cases e) auto\n      done\n    subgoal\n      unfolding times_ereal.simps[symmetric]\n      apply (rule ereal_mult_mono)\n      subgoal by (cases b) auto\n      subgoal by (cases b) auto\n      subgoal by (cases b) auto\n      subgoal by (cases e) auto\n      done\n    subgoal by force\n    done\n  done\n  done\n\n\nlemma reduces_ivle[le, refine_vcg]:\n  \"reduces_ivle X \\<le> SPEC (\\<lambda>R. X \\<subseteq> R)\"\n  unfolding reduces_ivle_def\n  by refine_vcg auto\n\nlemma ivlse_of_setse[le, refine_vcg]: \"ivlse_of_setse X \\<le> SPEC (\\<lambda>R. X \\<subseteq> R)\"\n  unfolding ivlse_of_setse_def\n  by (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>Xs R. \\<Union>Xs \\<subseteq> R\"])\n    (auto simp: scaleR2_def image_def vimage_def)\n\nlemma setse_of_ivlse[le, refine_vcg]:\n  \"setse_of_ivlse X \\<le> SPEC (\\<lambda>R. R = X)\"\n  unfolding setse_of_ivlse_def\n  apply (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>Xs R. \\<Union>Xs \\<subseteq> R \\<and> R \\<subseteq> X\"])\n       apply clarsimp_all\n  subgoal by (rule bexI)\n  subgoal by auto\n  subgoal by auto\n  subgoal by auto\n  done\n\nlemma partition_set_spec[le, refine_vcg]:\n  shows \"partition_set ro XS \\<le> SPEC (\\<lambda>YS. XS \\<subseteq> YS)\"\n  unfolding partition_set_def autoref_tag_defs\n  apply (refine_vcg)\n  subgoal by (fastforce simp: scaleR2_def vimage_def image_def)\n  subgoal by fastforce\n  done\n\nlemma partition_sets_spec[le, refine_vcg]:\n  shows \"partition_sets ro XS \\<le> SPEC (\\<lambda>YS. (\\<Union>(_, _, PS, _, _, _, _, _) \\<in> XS. PS) \\<subseteq> YS)\"\n  unfolding partition_sets_def autoref_tag_defs\n  by (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>X Y. (\\<Union>(_, _, PS, _, _, _, _, _) \\<in> X. PS) \\<subseteq> Y\"]) auto\n\nlemma\n  do_intersection_poincare_mapstos_trans:\n  assumes pm: \"\\<And>i. i \\<in> I \\<Longrightarrow> poincare_mapsto (p i) (X0 i) UNIV (CX i) (X1 i)\"\n  assumes di: \"do_intersection_spec UNIV guards ivl sctn (\\<Union>i\\<in>I. X1 i) (P, CP)\"\n  assumes \"\\<And>i. i \\<in> I \\<Longrightarrow> fst ` (X1 i) \\<subseteq> CP\"\n  assumes \"\\<And>i. i \\<in> I \\<Longrightarrow> {x \\<in> ivl. x \\<in> plane_of sctn} \\<inter> CX i = {}\"\n  assumes \"\\<And>i. i \\<in> I \\<Longrightarrow> guards \\<inter> (CX i \\<union> CP) = {}\"\n  assumes \"\\<And>i. i \\<in> I \\<Longrightarrow> X0 i \\<subseteq> CX i \\<times> UNIV\"\n  assumes \"\\<And>i. i \\<in> I \\<Longrightarrow> closed (p i)\"\n  assumes \"closed ivl\"\n  assumes \"\\<And>i. i \\<in> I \\<Longrightarrow> CX i \\<subseteq> Csafe\"\n  shows \"do_intersection_spec UNIV guards ivl sctn (\\<Union>i\\<in>I. X0 i) (P, (\\<Union>i\\<in>I. CX i) \\<union> CP)\"\n  apply (auto simp: do_intersection_spec_def)\n  subgoal\n    apply (simp del: UN_simps add: UN_extend_simps)\n    apply (rule impI)\n    apply (thin_tac \"I \\<noteq> {}\")\n    subgoal\n    proof -\n      from di have pmi: \"poincare_mapsto {x \\<in> ivl. x \\<in> plane_of sctn} (X1 i) UNIV CP P\" if \"i \\<in> I\" for i\n        by (auto simp: do_intersection_spec_def intro: poincare_mapsto_subset that)\n      show ?thesis\n        apply (rule poincare_mapsto_UnionI)\n         apply (rule poincare_mapsto_trans[OF pm pmi])\n               apply clarsimp_all\n        subgoal s1 using assms by (auto simp: do_intersection_spec_def)\n        subgoal using assms apply (auto simp: do_intersection_spec_def)\n           apply blast\n          by (metis (mono_tags, lifting) s1 mem_Collect_eq mem_simps(2) mem_simps(4))\n        subgoal using assms by auto\n        subgoal using assms by auto\n        subgoal premises prems for i x d\n        proof -\n          note prems\n          have [intro, simp]: \"closed {x \\<in> ivl. x \\<in> plane_of sctn} \" \"closed {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn}\"\n            by (auto intro!: closed_levelset_within continuous_intros simp: plane_of_def assms)\n          have set_eq: \"(CX i \\<union> CP) \\<times> UNIV = (fst ` X1 i \\<times> UNIV \\<union> CX i \\<times> UNIV \\<union> CP \\<times> UNIV)\"\n            using assms prems\n            by auto\n          have empty_inter: \"{x \\<in> ivl. x \\<bullet> normal sctn - pstn sctn = 0} \\<times> UNIV \\<inter> (CX i \\<union> CP) \\<times> UNIV = {}\"\n            apply safe\n            subgoal\n              using assms(4)[of i] \\<open>i \\<in> I\\<close>\n              by (auto simp: plane_of_def )\n            subgoal\n              using assms(4)[of i]\n              using prems assms by (auto simp: plane_of_def do_intersection_spec_def)\n            done\n          have ft: \"flowsto (X0 i) {0<..} ((CX i \\<union> CP) \\<times> UNIV) (fst ` P \\<times> UNIV)\"\n            unfolding set_eq\n            apply (rule flowsto_poincare_mapsto_trans_flowsto[OF poincare_mapsto_imp_flowsto[OF pm[OF \\<open>i \\<in> I\\<close>]]\n                  pmi[OF \\<open>i \\<in> I\\<close>] _ _ order_refl])\n            using assms prems by (auto)\n          then have ret: \"returns_to {x \\<in> ivl. x \\<bullet> normal sctn - pstn sctn = 0} x\"\n            apply (rule returns_to_flowstoI[OF _ _ _ _ _ _ order_refl])\n            subgoal using prems assms by (auto simp: plane_of_def do_intersection_spec_def)\n            subgoal by (rule empty_inter)\n            subgoal using prems assms by (auto simp: plane_of_def do_intersection_spec_def)\n            subgoal using prems assms by (auto simp: plane_of_def do_intersection_spec_def)\n            subgoal using prems assms by (auto simp: plane_of_def do_intersection_spec_def)\n            done\n          have pm: \"poincare_map {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} x \\<in> fst ` P\"\n            apply (rule poincare_map_mem_flowstoI[OF ft])\n            subgoal using prems assms by (auto simp: plane_of_def do_intersection_spec_def)\n            subgoal using empty_inter by simp\n            subgoal by auto\n            subgoal by auto\n            subgoal using prems assms by (auto simp: plane_of_def do_intersection_spec_def)\n            subgoal by auto\n            done\n          from ret have \"isCont (return_time {x \\<in> ivl. x \\<bullet> normal sctn - pstn sctn = 0}) x\"\n            apply (rule return_time_isCont_outside)\n            subgoal by fact\n                apply (force intro!: derivative_eq_intros)\n            subgoal by (auto intro!: continuous_intros)\n            subgoal using prems pm assms by (auto simp: do_intersection_spec_def)\n            subgoal using prems pm assms\n              by (auto simp: eventually_at_filter plane_of_def do_intersection_spec_def)\n            subgoal\n            proof -\n              have \"x \\<in> CX i\" using \\<open>_ \\<in> I \\<Longrightarrow> X0 _ \\<subseteq> CX _ \\<times> UNIV\\<close>[OF \\<open>i \\<in> I\\<close>] \\<open>(x, _) \\<in> _\\<close>\n                by auto\n              with assms(4)[OF \\<open>i \\<in> I\\<close>] show ?thesis\n                by (auto simp: plane_of_def)\n            qed\n            done\n          then show \"isCont (return_time {x \\<in> ivl. x \\<in> plane_of sctn}) x\" by (simp add: plane_of_def)\n        qed\n        done\n    qed\n    done\n  subgoal using assms by (fastforce simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms by (auto simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms by (fastforce simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms by (auto simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms by (auto simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms by (auto simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms by (auto simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms by (auto simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms(9) by (fastforce simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms by (auto simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms by (auto simp: plane_of_def do_intersection_spec_def)\n  subgoal using assms by (auto simp: plane_of_def do_intersection_spec_def)\n  done\n\nlemma flow_in_stable_setD:\n  \"flow0 x0 t \\<in> stable_set trap \\<Longrightarrow> t \\<in> existence_ivl0 x0 \\<Longrightarrow> x0 \\<in> stable_set trap\"\n  apply (auto simp: stable_set_def)\nproof goal_cases\n  case (1 s)\n  then show ?case\n    apply (cases \"s \\<le> t\")\n    apply (meson atLeastAtMost_iff contra_subsetD local.ivl_subset_existence_ivl)\n    using contra_subsetD local.existence_ivl_reverse local.existence_ivl_trans' local.flows_reverse by fastforce\nnext\n  case (2)\n  have \"((\\<lambda>s. flow0 x0 (t + s)) \\<longlongrightarrow> trap) (at_top)\"\n  proof (rule Lim_transform_eventually)\n    have \"\\<forall>\\<^sub>F x in at_top. x > max t 0\"\n      by (simp add: max_def)\n    then show \"\\<forall>\\<^sub>F x in at_top. flow0 (flow0 x0 t) x = flow0 x0 (t + x)\"\n      apply eventually_elim\n      apply (subst flow_trans)\n      using 2\n      by auto\n  qed (use 2 in auto)\n  then show ?case by (simp add: tendsto_at_top_translate_iff ac_simps)\nqed\n\nlemma\n  poincare_mapsto_avoid_trap:\n  assumes \"poincare_mapsto p (X0 - trap \\<times> UNIV) S CX P\"\n  assumes \"closed p\"\n  assumes trapprop[THEN stable_onD]: \"stable_on (CX \\<union> fst ` P) trap\"\n  shows \"poincare_mapsto p (X0 - trap \\<times> UNIV) S CX (P - trap \\<times> UNIV)\"\n  using assms(1,2)\n  apply (auto simp: poincare_mapsto_def)\n  apply (drule bspec, force)\n  apply auto\n  subgoal for x0 d0 D\n    apply (rule exI[where x=D])\n    apply (auto dest!: trapprop simp: poincare_map_def intro!: return_time_exivl assms(1,2) return_time_pos)\n    subgoal for s\n      by (cases \"s = return_time p x0\") (auto simp: )\n    done\n  done\n\nlemma poincare_onto_series[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd TYPE('a::enum rvec)\"\n  assumes [refine_vcg]: \"\\<And>X0. X0 \\<subseteq> Csafe \\<times> UNIV \\<Longrightarrow> symstart X0 \\<le> SPEC (\\<lambda>(CX, X). flowsto (X0 - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) (X))\"\n  assumes trapprop: \"stable_on (Csafe - (ivl \\<inter> plane_of sctn)) trap\"\n  shows \"poincare_onto_series symstart trap guards (X0::'a eucl1 set) ivl sctn ro \\<le>\n       SPEC (\\<lambda>XS. do_intersection_spec UNIV {} ivl sctn (X0 - trap \\<times> UNIV)\n          (XS, Csafe - (ivl \\<inter> plane_of sctn)) \\<and>\n          fst ` X0 - trap \\<subseteq> Csafe - (ivl \\<inter> plane_of sctn))\"\nproof (induction guards arbitrary: X0)\n  case Nil\n  then show ?case\n    apply (simp add:)\n    apply refine_vcg\n    apply (clarsimp simp add: ivlsctn_to_set_def)\n     apply (rule do_intersection_spec_subset2, assumption)\n    subgoal by (auto simp: do_intersection_spec_def)\n    subgoal by (auto simp: do_intersection_spec_def)\n    subgoal by (auto simp: do_intersection_spec_def)\n    subgoal by (auto simp: do_intersection_spec_def)\n    subgoal by (auto simp: do_intersection_spec_def)\n    subgoal by (auto simp: do_intersection_spec_def)\n    done\nnext\n  case (Cons a guards)\n  note Cons.IH[simplified, le, refine_vcg]\n  show ?case\n    apply auto\n    apply refine_vcg\n     apply clarsimp_all\n     defer\n    subgoal premises prems for b c d e f g h\n    proof -\n      from prems have \"(f, g) \\<in> (\\<Union>x\\<in>c. h x)\"\n        by auto\n      then obtain x where \"x \\<in> c\" \"(f, g) \\<in> (h x)\"\n        by auto\n      then show ?thesis\n        using prems(14)[rule_format, OF \\<open>x \\<in> c\\<close>] prems(5-7)\n        by (cases x) (auto simp: do_intersection_spec_def)\n    qed\n    subgoal premises prems for c ro d e f\n    proof -\n      let ?s = \"trap \\<times> UNIV\"\n      note prems\n      from \\<open>do_intersection_spec _ _ _ _ _ _ \\<close>\n      have disro: \"do_intersection_spec UNIV {} ivl sctn ((\\<Union>i\\<in>ro. case i of (_, _, PS, _, _, _, _, _, _) \\<Rightarrow> PS - ?s))\n          (e, Csafe - ivl \\<inter> plane_of sctn)\"\n        apply (rule do_intersection_spec_subset)\n        using prems by auto\n      have subset: \"(Csafe - ivl \\<inter> plane (normal sctn) (pstn sctn)) \\<supseteq>\n        (snd (snd (snd (snd (snd (snd (snd (snd i))))))) \\<union>\n        fst (snd (snd (snd (snd (snd (snd (snd i))))))) \\<union> fst ` fst (snd (snd i)))\" if \"i \\<in> ro\" for i\n        using prems(12)[rule_format, unfolded do_intersection_spec_def, OF that]\n        apply (clarsimp )\n        subgoal for s X P1 P2 R ivla sctna CX CXS\n          apply (rule conjI)\n          subgoal by (auto simp: plane_of_def)\n          subgoal by (auto simp: plane_of_def)\n          done\n        done\n      have pmro: \"poincare_mapsto\n            (case i of (s, X, P1, P2, R, ivla, sctna, CX, CXS) \\<Rightarrow> {x \\<in> ivla. x \\<in> plane_of sctna})\n            (f i - ?s) UNIV\n            (case i of (s, X, P1, P2, R, ivla, sctna, CX, CXS) \\<Rightarrow> CXS \\<union> CX)\n            (case i of (s, X, P1, P2, R, ivla, sctna, CX, CXS) \\<Rightarrow> P1)\"\n        if \"i \\<in> ro\"\n        for i\n        using prems(12)[rule_format, unfolded do_intersection_spec_def, OF that]\n        by (auto intro: poincare_mapsto_subset)\n      then have pmro: \"poincare_mapsto\n            (case i of (s, X, P1, P2, R, ivla, sctna, CX, CXS) \\<Rightarrow> {x \\<in> ivla. x \\<in> plane_of sctna})\n            (f i - ?s) UNIV\n            (case i of (s, X, P1, P2, R, ivla, sctna, CX, CXS) \\<Rightarrow> CXS \\<union> CX)\n            (case i of (s, X, P1, P2, R, ivla, sctna, CX, CXS) \\<Rightarrow> P1 - ?s)\"\n        if \"i \\<in> ro\"\n        for i\n        unfolding split_beta'\n        apply (rule poincare_mapsto_avoid_trap)\n        using that prems assms\n        by (auto intro!: closed_levelset_within continuous_intros\n            stable_on_mono[OF _ subset]\n            simp: plane_of_def)\n      have \"do_intersection_spec UNIV {} ivl sctn (\\<Union>i\\<in>ro. f i - ?s)\n        (e, (\\<Union>i\\<in>ro. case i of (s, X, P1, P2, R, ivla, sctna, CX, CXS) \\<Rightarrow> CXS \\<union> CX) \\<union>\n        (Csafe - ivl \\<inter> plane_of sctn))\"\n        apply (rule do_intersection_poincare_mapstos_trans[OF pmro disro])\n        subgoal by auto\n        subgoal premises that for i\n          using prems(12)[rule_format, unfolded do_intersection_spec_def, OF that]\n          by (auto simp: do_intersection_spec_def)\n        subgoal using assms(1,2) prems by (auto simp: do_intersection_spec_def)\n        subgoal by auto\n        subgoal premises that for i\n          using prems(12)[rule_format, unfolded do_intersection_spec_def, OF that]\n            prems(11) that\n          by (auto simp: do_intersection_spec_def)\n        subgoal using assms(1,2) prems by (auto simp: do_intersection_spec_def)\n        subgoal using assms(1,2) prems by (auto simp: do_intersection_spec_def)\n        subgoal using assms(1,2) prems by (auto simp: do_intersection_spec_def)\n        done\n      then show ?thesis\n        unfolding \\<open>(\\<Union>x\\<in>ro. f x) = X0 - trap \\<times> UNIV\\<close>\n        apply (rule do_intersection_spec_subset2)\n        subgoal using assms(1,2) prems by (auto simp: do_intersection_spec_def)\n        using prems\n        by (auto simp: do_intersection_spec_def intro: poincare_mapsto_subset)\n    qed\n    done\nqed\n\nlemma\n  do_intersection_flowsto_trans_return:\n  assumes \"flowsto XS0 {0<..} (CX \\<times> UNIV) X1\"\n  assumes \"do_intersection_spec UNIV guards ivl sctn X1 (P, CP)\"\n  assumes \"fst ` X1 \\<subseteq> CP\"\n  assumes \"{x \\<in> ivl. x \\<in> plane_of sctn} \\<inter> CX = {}\"\n  assumes \"guards \\<inter> (CX \\<union> CP) = {}\"\n  assumes \"closed ivl\"\n  assumes \"CX \\<subseteq> sbelow_halfspace sctn \\<inter> Csafe\"\n  assumes subset_plane: \"fst ` XS0 \\<subseteq> plane_of sctn \\<inter> ivl\"\n  assumes down: \"\\<And>x d. (x, d) \\<in> XS0 \\<Longrightarrow> ode x \\<bullet> normal sctn < 0\" \"\\<And>x. x \\<in> CX \\<Longrightarrow> ode x \\<bullet> normal sctn < 0\"\n  shows \"do_intersection_spec (below_halfspace sctn) guards ivl sctn XS0 (P, CX \\<union> CP)\"\n  using assms\n  apply (auto simp: do_intersection_spec_def)\n  subgoal\n    apply (rule flowsto_poincare_trans, assumption, assumption)\n    subgoal by simp\n    subgoal by auto\n    subgoal using assms(3) by auto\n    subgoal by (auto intro!: closed_levelset_within continuous_intros simp: plane_of_def)\n     prefer 2\n    subgoal by (auto simp add: plane_of_def halfspace_simps)\n    subgoal premises prems for x d\n    proof -\n      have [intro, simp]: \"closed {x \\<in> ivl. x \\<in> plane_of sctn} \" \"closed {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn}\"\n        by (auto intro!: closed_levelset_within continuous_intros simp: plane_of_def assms)\n      from subset_plane have \"fst ` XS0 \\<subseteq> below_halfspace sctn\" by (auto simp: )\n      from flowsto_stays_sbelow[OF \\<open>flowsto _ _ _ _\\<close> this down(2)]\n      have ft_below: \"flowsto XS0 pos_reals (CX \\<times> UNIV \\<inter> sbelow_halfspace sctn \\<times> UNIV) X1\"\n        by auto\n      from flowsto_poincare_mapsto_trans_flowsto[OF ft_below \\<open>poincare_mapsto _ _ _ _ _\\<close> _ _ order_refl]\n      have ft: \"flowsto XS0 {0<..} (X1 \\<union> CX \\<times> UNIV \\<inter> sbelow_halfspace sctn \\<times> UNIV \\<union> CP \\<times> UNIV) (fst ` P \\<times> UNIV)\"\n        by (auto simp: )\n      have ret: \"returns_to {x \\<in> ivl. x \\<bullet> normal sctn - pstn sctn = 0} x\"\n        apply (rule returns_to_flowstoI[OF ft])\n        using prems by (auto simp: plane_of_def halfspace_simps)\n      have pm: \"poincare_map {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} x \\<in> fst ` P\"\n        apply (rule poincare_map_mem_flowstoI[OF ft])\n        using prems by (auto simp: plane_of_def halfspace_simps)\n      from pm prems have evmem: \"\\<forall>\\<^sub>F x in at (poincare_map {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} x) within\n        plane_of sctn. x \\<in> ivl\"\n        by auto\n      from ret have \"continuous (at x within {x. x \\<bullet> normal sctn - pstn sctn \\<le> 0})\n        (return_time {x \\<in> ivl. x \\<bullet> normal sctn - pstn sctn = 0})\"\n        apply (rule return_time_continuous_below)\n               apply (rule derivative_eq_intros refl)+\n               apply force\n        subgoal using \\<open>closed ivl\\<close> by auto\n        subgoal using prems pm by (auto simp: plane_of_def eventually_at_filter)\n        subgoal by (auto intro!: )\n        subgoal using prems pm by auto\n        subgoal using prems by auto\n        subgoal using prems pm by (auto intro!: assms simp: plane_of_def)\n        subgoal using prems pm by auto\n        done\n      then show \"continuous (at x within below_halfspace sctn) (return_time {x \\<in> ivl. x \\<in> plane_of sctn})\"\n        by (simp add: plane_of_def halfspace_simps)\n    qed\n    done\n  done\n\nlemma do_intersection_spec_sctn_cong:\n  assumes \"sctn = sctn' \\<or> (normal sctn = - normal sctn' \\<and> pstn sctn = - pstn sctn')\"\n  shows \"do_intersection_spec a b c sctn d e = do_intersection_spec a b c sctn' d e\"\n  using assms\n  by (auto simp: do_intersection_spec_def plane_of_def set_eq_iff intro!: )\n\nlemma poincare_onto_from[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd TYPE('a::enum rvec)\"\n  assumes [refine_vcg]: \"\\<And>X0. X0 \\<subseteq> Csafe \\<times> UNIV \\<Longrightarrow> symstart X0 \\<le> SPEC (\\<lambda>(CX, X). flowsto (X0 - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) (X))\"\n  assumes trapprop: \"stable_on (Csafe - (ivl \\<inter> plane_of sctn)) trap\"\n  shows \"poincare_onto_from symstart trap S guards ivl sctn ro (XS0::'a eucl1 set) \\<le>\n    SPEC (poincare_mapsto (ivl \\<inter> plane_of sctn) (XS0 - trap \\<times> UNIV) S (Csafe - ivl \\<inter> plane_of sctn))\"\n  unfolding poincare_onto_from_def autoref_tag_defs\n  apply (refine_vcg, clarsimp_all simp: trapprop)\n  subgoal by (auto simp: do_intersection_spec_def Int_def intro: poincare_mapsto_subset)\n  subgoal premises prems for a b c d e f\n  proof -\n    note prems\n    from trapprop\n    have stable: \"stable_on (fst ` (e \\<times> UNIV \\<inter> sbelow_halfspace a \\<times> UNIV \\<union> d)) trap\"\n      apply (rule stable_on_mono)\n      using \\<open>fst ` (d \\<union> e \\<times> UNIV) \\<subseteq> Csafe\\<close> \\<open>a = sctn \\<or> normal a = - normal sctn \\<and> pstn a = - pstn sctn\\<close>\n        \\<open>fst ` d \\<subseteq> sbelow_halfspace a\\<close>\n      by (auto simp: halfspace_simps plane_of_def image_Un)\n    from prems(16) have \"flowsto (XS0 - trap \\<times> UNIV) {0<..} (e \\<times> UNIV \\<inter> sbelow_halfspace a \\<times> UNIV) d\"\n      by (rule flowsto_subset) auto\n    then have ft: \"flowsto (XS0 - trap \\<times> UNIV) {0<..} ((e \\<inter> sbelow_halfspace a) \\<times> UNIV) (d - trap \\<times> UNIV)\"\n      by (auto intro!: flowsto_mapsto_avoid_trap stable simp: Times_Int_distrib1)\n    from prems(8) have di: \"do_intersection_spec UNIV {} ivl a (d - trap \\<times> UNIV) (f, Csafe - ivl \\<inter> plane_of sctn)\"\n      apply (subst do_intersection_spec_sctn_cong)\n       defer apply assumption\n      using prems(2)\n      by auto\n    have \"do_intersection_spec (below_halfspace a) {} ivl a (XS0 - trap \\<times> UNIV)\n         (f, e \\<inter> sbelow_halfspace a \\<union> (Csafe - ivl \\<inter> plane_of sctn))\"\n      apply (rule do_intersection_flowsto_trans_return[OF ft di])\n      subgoal using prems by (auto simp: do_intersection_spec_def halfspace_simps plane_of_def)\n      subgoal by (auto simp: halfspace_simps plane_of_def)\n      subgoal using prems by (auto simp: halfspace_simps plane_of_def)\n      subgoal using prems by (auto simp: do_intersection_spec_def halfspace_simps plane_of_def)\n      subgoal using prems by (auto simp: image_Un)\n      subgoal using prems by (auto simp: do_intersection_spec_def halfspace_simps plane_of_def)\n      subgoal using prems by (auto simp: do_intersection_spec_def halfspace_simps plane_of_def)\n      subgoal using prems by (auto simp: do_intersection_spec_def halfspace_simps plane_of_def)\n      done\n    moreover have \"plane_of a = plane_of sctn\"\n      using prems(2) by (auto simp: plane_of_def)\n    ultimately show ?thesis\n      apply (auto simp add: do_intersection_spec_def Int_def)\n      apply (rule poincare_mapsto_subset, assumption)\n      by auto\n  qed\n  done\n\nlemma subset_spec1[refine_vcg]: \"subset_spec1 R P dP \\<le> SPEC (\\<lambda>b. b \\<longrightarrow> R \\<subseteq> flow1_of_vec1 ` (P \\<times> dP))\"\n  unfolding subset_spec1_def\n  by refine_vcg (auto simp: vec1_of_flow1_def)\n\n\nlemma subset_spec1_coll[le, refine_vcg]:\n  \"subset_spec1_coll R P dP \\<le> subset_spec R (flow1_of_vec1 ` (P \\<times> dP))\"\n  unfolding autoref_tag_defs subset_spec_def subset_spec1_coll_def\n  by (refine_vcg) (auto simp: subset_iff set_of_ivl_def)\n\nlemma one_step_until_time_spec[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"one_step_until_time (X0::'n eucl1 set) CX t1 \\<le> SPEC (\\<lambda>(R, CX).\n    (\\<forall>(x0, d0) \\<in> X0. t1 \\<in> existence_ivl0 x0 \\<and>\n      (flow0 x0 t1, Dflow x0 t1 o\\<^sub>L d0) \\<in> R \\<and>\n      (\\<forall>t \\<in> {0 .. t1}. flow0 x0 t \\<in> CX)) \\<and>\n      fst ` R \\<union> CX \\<subseteq> Csafe)\"\n  unfolding one_step_until_time_def autoref_tag_defs\n  apply (refine_vcg WHILE_rule[where I=\"\\<lambda>(t, h, X, CX). fst ` X \\<subseteq> Csafe \\<and> CX \\<subseteq> Csafe \\<and> 0 \\<le> h \\<and> 0 \\<le> t \\<and> t \\<le> t1 \\<and>\n        (\\<forall>(x0, d0) \\<in> X0. t \\<in> existence_ivl0 x0 \\<and>\n          (flow0 x0 t, Dflow x0 t o\\<^sub>L d0) \\<in> X \\<and>\n          (\\<forall>s \\<in> {0 .. t}. flow0 x0 s \\<in> CX))\"])\n  subgoal by auto\n  subgoal by (force simp: flowpipe_def existence_ivl_trans flow_trans)\n  subgoal by (auto simp: flowpipe_def existence_ivl_trans flow_trans)\n  apply clarsimp subgoal for startstep rk2_param a b c d e f g h i j\n    apply (safe)\n    subgoal by (auto simp: flowpipe_def intro!: existence_ivl_trans flow_trans)\n    subgoal\n      apply (subst flow_trans, force)\n      subgoal by (auto simp: flowpipe_def intro!: existence_ivl_trans flow_trans)\n      apply (subst Dflow_trans, force)\n      subgoal by (auto simp: flowpipe_def intro!: existence_ivl_trans flow_trans)\n      by (auto simp: blinfun_compose_assoc flowpipe_def)\n    subgoal for s\n      apply (drule bspec[where x=\"(i, j)\"], assumption)\n      apply auto\n      apply (cases \"s \\<le> a\")\n      subgoal by auto\n      subgoal\n        apply (auto simp: blinfun_compose_assoc flowpipe_def)\n        apply (drule bspec, assumption)\n        apply auto\n      proof goal_cases\n        case 1\n        have a: \"a \\<in> existence_ivl0 i\" using 1 by auto\n        have sa: \"s - a \\<in> existence_ivl0 (flow0 i a)\"\n          using \"1\"(15) \"1\"(19) \"1\"(20) local.ivl_subset_existence_ivl by fastforce\n        have \"flow0 i s = flow0 (flow0 i a) (s - a)\"\n          by (auto simp: a sa flow_trans[symmetric])\n        also have \"\\<dots> \\<in> f\"\n          using 1 by auto\n        finally show ?case\n          using 1 by simp\n      qed\n      done\n    done\n  subgoal by auto\n  done\n\ntext \\<open>solve ODE until the time interval \\<open>{t1 .. t2}\\<close>\\<close>\n\nlemma ivl_of_eucl1_coll[THEN order_trans, refine_vcg]: \"ivl_of_eucl_coll X \\<le> SPEC (\\<lambda>R. X \\<times> UNIV \\<subseteq> R)\"\n  unfolding ivl_of_eucl_coll_def\n  by refine_vcg auto\n\nlemma one_step_until_time_ivl_spec[le, refine_vcg]:\n  assumes wd[refine_vcg]: \"wd (TYPE('n::enum rvec))\"\n  shows \"one_step_until_time_ivl (X0::'n eucl1 set) CX t1 t2 \\<le> SPEC (\\<lambda>(R, CX).\n    (\\<forall>(x0, d0) \\<in> X0. {t1 .. t2} \\<subseteq> existence_ivl0 x0 \\<and>\n      (\\<forall>t \\<in> {t1 .. t2}. (flow0 x0 t, Dflow x0 t o\\<^sub>L d0) \\<in> R) \\<and>\n      (\\<forall>t \\<in> {0 .. t1}. (flow0 x0 t) \\<in> CX)) \\<and>\n      fst ` R \\<union> CX \\<subseteq> Csafe)\"\n  unfolding one_step_until_time_ivl_def\n  apply (refine_vcg, clarsimp_all)\n  subgoal for X CX Y CY CY' x0 d0\n    apply (drule bspec, assumption, clarsimp)\n    apply (drule bspec, assumption, clarsimp simp add: nonneg_interval_mem_existence_ivlI)\n    apply (rule subsetD, assumption)\n    subgoal for t\n      apply (drule bspec[where x=0], force)\n      apply (drule bspec[where x=\"t - t1\"], force)\n      using interval_subset_existence_ivl[of t1 x0 t2]\n      by (auto simp: flow_trans')\n    done\n  subgoal\n    by (auto simp: scaleR2_def image_def vimage_def)\n  done\n\nlemma empty_symstart_flowsto:\n  \"X0 \\<subseteq> Csafe \\<times> UNIV \\<Longrightarrow>\n    RETURN ({}, X0) \\<le> SPEC (\\<lambda>(CX, X). flowsto (X0 - {} \\<times> UNIV) {0..} (CX \\<times> UNIV) X)\"\n  by (auto intro!: flowsto_self)\n\nsubsection \\<open>Poincare map returning to\\<close>\n\nlemma poincare_onto_from_ivla[le, refine_vcg]:\n  assumes [refine_vcg]: \"wd TYPE('n::enum rvec)\"\n  assumes [refine_vcg]: \"\\<And>X0. X0 \\<subseteq> Csafe \\<times> UNIV \\<Longrightarrow> symstart X0 \\<le> SPEC (\\<lambda>(CX, X). flowsto (X0 - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) (X))\"\n  assumes trapprop[refine_vcg]: \"stable_on (Csafe - (ivl \\<inter> plane_of sctn)) trap\"\n  shows \"poincare_onto_from symstart trap S guards ivl sctn ro (XS0::'n eucl1 set) \\<le> SPEC\n     (\\<lambda>P.\n        wd TYPE((real, 'n) vec) \\<and>\n        poincare_mapsto (ivl \\<inter> plane_of sctn) (XS0 - trap \\<times> UNIV) S (Csafe - ivl \\<inter> plane_of sctn) P)\"\n  by (refine_vcg)\n\nsubsection \\<open>Poincare map onto (from outside of target)\\<close>\n\nsubsection \\<open>One step method (reachability in time)\\<close>\n\nlemma c0_info_of_apprsI:\n  assumes \"(b, a) \\<in> clw_rel appr_rel\"\n  assumes \"x \\<in> a\"\n  shows \"x \\<in> c0_info_of_apprs b\"\n  using assms\n  by (auto simp: appr_rel_br clw_rel_br c0_info_of_apprs_def c0_info_of_appr_def dest!: brD)\n\nlemma c0_info_of_appr'I:\n  assumes \"(b, a) \\<in> \\<langle>clw_rel appr_rel\\<rangle>phantom_rel\"\n  assumes \"x \\<in> a\"\n  shows \"x \\<in> c0_info_of_appr' b\"\n  using assms\n  by (auto simp add: c0_info_of_appr'_def intro!: c0_info_of_apprsI split: option.splits)\n\nlemma poincare_onto_from_in_ivl[le, refine_vcg]:\n  assumes [refine_vcg]: \"wd TYPE('n::enum rvec)\"\n  assumes [refine_vcg]: \"\\<And>X0. X0 \\<subseteq> Csafe \\<times> UNIV \\<Longrightarrow> symstart X0 \\<le> SPEC (\\<lambda>(CX, X). flowsto (X0 - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) (X))\"\n  assumes trapprop: \"stable_on (Csafe - (ivl \\<inter> plane_of sctn)) trap\"\n  shows \"poincare_onto_from_in_ivl symstart trap S guards ivl sctn ro (XS0::'n::enum eucl1 set) P dP \\<le>\n    SPEC (\\<lambda>b. b \\<longrightarrow> poincare_mapsto (ivl \\<inter> plane_of sctn) (XS0 - trap \\<times> UNIV) S (Csafe - ivl \\<inter> plane_of sctn) (flow1_of_vec1 ` (P \\<times> dP)))\"\n  unfolding poincare_onto_from_in_ivl_def\n  apply (refine_vcg, clarsimp_all)\n   apply (rule trapprop)\n  apply (rule poincare_mapsto_subset)\n      apply assumption\n  by (auto simp: )\n\nlemma lvivl_default_relI:\n  \"(dRi, set_of_lvivl' dRi::'e::executable_euclidean_space set) \\<in> \\<langle>lvivl_rel\\<rangle>default_rel UNIV\"\n  if \"lvivl'_invar DIM('e) dRi\"\n  using that\n  by (auto simp: set_of_lvivl'_def set_of_lvivl_def set_of_ivl_def lvivl'_invar_def\n      intro!: mem_default_relI lvivl_relI)\n\nlemma stable_on_empty[simp]: \"stable_on A {}\"\n  by (auto simp: stable_on_def)\n\nlemma poincare_onto_in_ivl[le, refine_vcg]:\n  assumes [simp]: \"length (ode_e) = CARD('n::enum)\"\n  shows \"poincare_onto_in_ivl guards ivl sctn ro (XS0::'n::enum eucl1 set) P dP \\<le>\n    SPEC (\\<lambda>b. b \\<longrightarrow> poincare_mapsto (ivl \\<inter> plane_of sctn) (XS0) UNIV (Csafe - ivl \\<inter> plane_of sctn) (flow1_of_vec1 ` (P \\<times> dP)))\"\nproof -\n  have wd[refine_vcg]: \"wd TYPE((real, 'n) vec)\" by (simp add: wd_def)\n  show ?thesis\n    unfolding poincare_onto_in_ivl_def\n    apply (refine_vcg)\n    subgoal by (auto intro!: flowsto_self)\n    subgoal\n      apply (clarsimp simp add: do_intersection_spec_def Int_def[symmetric])\n      apply (rule poincare_mapsto_subset)\n          apply assumption\n      by auto\n    done\nqed\n\n\nend\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Ordinary_Differential_Equations/Numerics/Refine_Reachability_Analysis_C1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7401743505760728, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.3412327952321661}}
{"text": "theory flash1Bra  imports flash1Rev\n \n  begin\nlemma onInv1:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv1  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv1  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv1 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash1Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.721743206297598, "lm_q2_score": 0.4726834766204329, "lm_q1q2_score": 0.34115608797992697}}
{"text": "theory Example\n  imports \n    \"../Map_Interface\"\n    List_Less\n    List_Copy\n    Arl_Ext\n    \"../Export_Wrappers\"\nbegin\n\n\ndefinition \"string_dr_assn \\<equiv> mk_assn string_assn\" \n\n\nabbreviation \"string_list_assn strs strsi \\<equiv> arl_elem_assn string_dr_assn strs strsi\"\n\n\nlemma string_dr_assn_eq [simp]: \"\\<upharpoonleft>string_dr_assn = string_assn\"\n  unfolding string_dr_assn_def \n  by fastforce\n\n\ninterpretation map: rbt_map\n  list_le\n  string_dr_assn\n  arl_free\n  snat.assn\n  \"\\<lambda>x. Mreturn ()\"\n  \"TYPE(nat list)\"\n  \"TYPE((8 word, 'l::len2) array_list)\"\n  _\n  _\n  \"\\<lambda>x. Mreturn x\"\nproof(standard, goal_cases)\n  case (1 lhs lhsi rhs rhsi)\n  then show ?case\n    using list_le_rule by fastforce\nnext\n  case (2 k ki)\n  then show ?case by vcg\nnext\n  case (3 v vi)\n  then show ?case by vcg\nnext\n  case (4 v vi)\n  then show ?case by vcg\nqed\n\n\ndefinition list_id_map :: \"'a list \\<Rightarrow> (nat \\<rightharpoonup> 'a)\" where\n  \"list_id_map xs = (\\<lambda>i. if i < length xs then Some (xs ! i) else None)\"\n\n\ndefinition is_id_bijection :: \"'a list \\<Rightarrow> ('a \\<rightharpoonup> 'b) \\<Rightarrow> ('b \\<rightharpoonup> 'a) \\<Rightarrow> bool\" where\n  \"is_id_bijection xs m1 m2 \\<equiv> (\\<forall> x \\<in> set xs. (m2 \\<circ>\\<^sub>m m1) x = Some x)\"\n\n\ntype_synonym stringi = \"(8 word, 64) array_list\"\n\n\ntype_synonym 'a array_list_64 = \"('a, 64) array_list\" \n\n\ninterpretation copy: arl_copy \"TYPE(8 word)\" unat.assn \"\\<lambda>x. Mreturn x\"\n  by (standard, vcg)\n\n\ninterpretation monad_syntax_M_loc .\n\n\nlemma arl_mems_nth_rule [vcg_rules]:\n\"\n  llvm_htriple\n  (arl_elem_assn_ex A xs xsi arl {} ** \\<upharpoonleft>snat.assn i ii ** \\<up>(i < length xs))\n  (arl_nth arl ii)\n  (\\<lambda>elem. arl_elem_assn_ex A xs xsi arl {i} ** \\<upharpoonleft>A (xs ! i) elem ** \\<up>(elem = xsi ! i))\n\"\n  unfolding arl_elem_assn_ex_def\n  apply vcg\n  apply vcg_compat\n  apply (sep | find_sep)+\n    apply ((auto dest!: list_assn_pure_partD))\n  unfolding idxe_map_def\n  by (simp add: restrict_map_insert)\n\n\npartial_function (M) make_id_map_rec' where [llvm_code]:\n  \"make_id_map_rec' strs i = \n  do {\n    len \\<leftarrow> arl_len strs;\n    if i < len\n    then do {\n      ip1 \\<leftarrow> ll_add i 1;\n      m \\<leftarrow> make_id_map_rec' strs ip1;\n      str \\<leftarrow> arl_nth strs i;\n      str_copy \\<leftarrow> copy.arl_copy str;\n      map.insert_opt str_copy i m\n    }\n    else map.empty\n  }\"\n\n\ndefinition make_id_map_loop' where [llvm_code]:\n  \"make_id_map_loop' strs = \n  do {\n    len \\<leftarrow> arl_len strs;\n    empty_map \\<leftarrow> map.empty;\n    llc_for_range 0 len\n    (\\<lambda>i m. do {\n        str \\<leftarrow> arl_nth strs i;\n        str_copy \\<leftarrow> copy.arl_copy str;\n        map.insert_opt str_copy i m\n    })\n    empty_map\n  }\"\n\n\ndefinition \"make_id_map_loop'_inv strs strsi i mi \\<equiv> \n  (\n    EXS m. map.rbt_map_assn m mi **\n    string_list_assn strs strsi **\n    \\<up>(is_id_bijection (take i strs) m (list_id_map strs))\n  )\" \n  \ndeclare string_dr_assn_eq[simp del]\n\n\nlemma pure_part_pure_conjI:\n  \"\\<lbrakk>sep_is_pure_assn X; sep_is_pure_assn Y; pure_part X; pure_part Y\\<rbrakk> \\<Longrightarrow> pure_part (X ** Y)\"\n  by (metis pure_part_pure_conj_eq pure_part_pure_eq)\n\n\nlemma pure_sep_set_img_pure_partI:\n  assumes\n    fin: \"finite X\" and\n    pps: \"\\<And>x. x\\<in>X \\<longrightarrow> sep_is_pure_assn (P x) \\<and> pure_part (P x)\"\n  shows \n    \"pure_part (\\<Union>*x\\<in>X. P x)\" and \"sep_is_pure_assn (\\<Union>*x\\<in>X. P x)\"\n  using fin pps\nproof(induction X arbitrary: )\n  case empty\n  {\n    case 1 thus ?case by auto\n  next\n    case 2 thus ?case by simp\n  }\nnext\n  case (insert x F)\n  {\n    case 1 with insert show ?case\n      apply auto\n      apply (rule pure_part_pure_conjI)\n      apply auto\n      done\n  next\n    case 2 thus ?case\n      by (blast intro: sep_is_pure_assn_imgI)\n  }\nqed \n    \n\nlemma string_assn_arl_elem_assnI:\n\"\\<upharpoonleft>string_dr_assn str (stri::(8 word, 'l::len2) array_list)\n   \\<turnstile> arl_elem_assn unat.assn str stri ** \\<up>(4 < LENGTH('l))\"\n  unfolding string_dr_assn_eq arl_elem_assn_def'\n  apply (sep | find_sep)+\n  apply isep_intro_ex\n  apply (sep | find_sep)+\n  unfolding LLVM_DS_List_Assn.list_assn_def\n  apply (simp_all add: pure_true_conv)\nproof -\n  fix x::\"8 word list\"\n  assume assm: \"\\<forall>i<length str. \\<flat>\\<^sub>punat.assn (str ! i) (x ! i)\"\n  have 1: \"sep_is_pure_assn (\\<Union>*xa\\<in>{0..<length str}. \\<upharpoonleft>unat.assn (str ! xa) (x ! xa))\" \n    apply (rule sep_is_pure_assn_imgI)\n    by (simp add: unat.assn_def)\n\n  have 2: \"pure_part (\\<Union>*xa\\<in>{0..<length str}. \\<upharpoonleft>unat.assn (str ! xa) (x ! xa))\"\n    apply (rule pure_sep_set_img_pure_partI)\n     apply auto\n    apply (simp add: unat.assn_def)\n    using assm by (simp add: thin_dr_pure_asm)\n\n  from 1 2 show \"\\<box> \\<turnstile> (\\<Union>*xa\\<in>{0..<length str}. \\<upharpoonleft>unat.assn (str ! xa) (x ! xa))\"\n    by (metis (mono_tags, lifting) pure_part_pure_eq sep_pureI)\nqed\n\n\nlemma arl_elem_assn_string_assnI:\n  \"arl_elem_assn unat.assn str (stri::(8 word, 'l::len2) array_list) **\n   \\<up>(4 < LENGTH('l)) \\<turnstile> \\<upharpoonleft>string_dr_assn str stri\"\n    unfolding string_dr_assn_eq arl_elem_assn_def'\n    apply (sepE | find_sep)+\n    subgoal unfolding LLVM_DS_List_Assn.list_assn_def\n      apply simp\n      apply (rule pure_entails_boxI sep_is_pure_assn_conjI | simp)+\n      apply (rule sep_is_pure_assn_imgI)\n      by (simp add: unat.assn_def)    \n   \n    apply (auto dest: list_assn_pure_partD)[1]\n    apply (simp add: dr_assn_pure_asm_prefix_def list_assn_pure_partD unat.assn_pure) \n    done\n\n\nlemma arl_elem_assn_update:\n  assumes \"i < length xs\" and \"i\\<in>ex\"\n  shows\n  \"arl_elem_assn_ex A xs xsi arl ex ** \\<upharpoonleft>A (xs ! i) (xsi ! i) \\<turnstile>\n   arl_elem_assn_ex A xs xsi arl (ex - {i})\"\n  unfolding arl_elem_assn_ex_def\n  apply isep_extract_pure\n  apply (isep_drule drule: LLVM_DS_List_Assn.list_assn_update[where i=i]) \n  using assms apply (auto simp: idxe_map_def dest: list_assn_pure_partD)\n  apply sep\n  done\n\n\nlemma make_id_map_rec'_rule:\n  \"\n  llvm_htriple\n  (string_list_assn strs strsi ** \\<upharpoonleft>snat.assn i ii)\n  (make_id_map_rec' strsi ii)\n  (\\<lambda>mi. (EXS m. map.rbt_map_assn m mi **\n                  string_list_assn strs strsi **\n                  \\<up>(is_id_bijection (drop i strs) m (list_id_map strs))))\n\"\nproof(induction \"length strs - i\" arbitrary: i ii)\n  case 0\n  from 0 show ?case \n    apply (subst make_id_map_rec'.simps)\n    apply vcg\n    apply vcg_compat\n    apply (sepE | find_sep)+\n    unfolding is_id_bijection_def\n    by simp\nnext\n  case (Suc x)\n  note Suc(1)[vcg_rules]\n  show ?case\n    apply (subst make_id_map_rec'.simps)\n    apply vcg\n    subgoal using Suc(2) by simp\n    subgoal\n      apply vcg\n      apply vcg_rl\n       apply vcg_compat\n       apply (isep_drule drule: string_assn_arl_elem_assnI)\n       apply isep_extract_pure\n       apply (isep_rule rule: sep_pureI, simp)\n       apply (sepE | find_sep)+\n      apply vcg_solve\n      apply vcg_rl\n       apply vcg_compat\n\n       apply (isep_rule rule: arl_elem_assn_string_assnI)\n       apply (isep_rule rule: pure_pure_asm_prefixI, simp)        \n       apply (sepEwith simp)\n       apply simp\n\n      apply vcg_solve\n      apply vcg\n\n      apply vcg_compat\n      apply isep_intro_ex\n      apply isep_assumption\n\n\n      apply (isep_drule drule: arl_elem_assn_string_assnI)\n        apply (sepEwith simp)\n       apply isep_assumption\n\n      apply (isep_drule drule: arl_elem_assn_update)\n        apply simp_all\n      apply (sepEwith simp)\n      unfolding is_id_bijection_def list_id_map_def map_comp_def\n      apply auto\n      by (simp add: drop_Suc_nth)\n    subgoal using Suc by simp (*unreachable*)\n    done\nqed\n\n\nlemma make_id_map_loop'_rule:\n  \"\n  llvm_htriple\n  (string_list_assn strs strsi)\n  (make_id_map_loop' strsi)\n  (\\<lambda>mi. (EXS m. map.rbt_map_assn m mi **\n                  string_list_assn strs strsi **\n                  \\<up>(is_id_bijection strs m (list_id_map strs))))\n  \"\n  unfolding make_id_map_loop'_def\n  supply llc_for_range_rule[where I=\"make_id_map_loop'_inv strs strsi\", vcg_rules]\n  apply vcg\n  apply vcg_rl\n  (*precond*)\n  unfolding make_id_map_loop'_inv_def\n  apply vcg_try_solve\n  apply vcg_compat\n  unfolding is_id_bijection_def apply simp\n    apply (sepEwith simp)\n  subgoal for asf x r ra s ia iia si (*step*)\n    apply vcg\n      (*arl copy*)\n    apply vcg_rl \n     apply vcg_compat\n     apply (isep_drule drule: string_assn_arl_elem_assnI)\n     apply isep_extract_pure\n     apply (isep_rule rule: sep_pureI, simp)\n     apply (sepE | find_sep)+\n    (*done*)\n    apply vcg_solve\n    (*insert*)\n    apply vcg_rl\n     apply vcg_compat\n     apply (isep_rule rule: arl_elem_assn_string_assnI)\n     apply (isep_rule rule: pure_pure_asm_prefixI, simp)        \n     apply (sepEwith simp)\n    (*done*)\n    apply vcg_solve\n    apply vcg\n        apply vcg_compat\n      apply isep_intro_ex\n      apply isep_assumption\n\n\n      apply (isep_drule drule: arl_elem_assn_string_assnI)\n        apply (sepEwith simp)\n       apply isep_assumption\n\n      apply (isep_drule drule: arl_elem_assn_update)\n        apply simp_all\n    apply (sep | find_sep)+\n      unfolding is_id_bijection_def list_id_map_def map_comp_def\n      apply (simp add: take_Suc_conv_app_nth)\n      done\n    subgoal (*post loop*) by vcg_solve+\n    done\n\n\n\n\ndefinition make_id_map_rec\n  :: \"stringi array_list_64 \\<Rightarrow> ((stringi, 64 word) rbti \\<times> stringi array_list_64) llM\" where\n  \"make_id_map_rec strs =\n  do {\n    m \\<leftarrow> make_id_map_rec' strs 0;\n    return (m, strs)\n  }\"\n\n\ndefinition make_id_map_loop\n  :: \"stringi array_list_64 \\<Rightarrow> ((stringi, 64 word) rbti \\<times> stringi array_list_64) llM\" where\n  \"make_id_map_loop strs =\n  do {\n    m \\<leftarrow> make_id_map_loop' strs;\n    return (m, strs)\n  }\"\n\n\nlemmas [llvm_code] = make_id_map_rec_def make_id_map_loop_def\n\n\nlemma make_id_map_rec_rule:\n  \"\n  llvm_htriple\n  (string_list_assn strs strsi)\n  (make_id_map_rec strsi)\n  (\\<lambda>(mi, li). EXS m l. map.rbt_map_assn m mi ** string_list_assn l li ** \\<up>(is_id_bijection strs m (list_id_map l)))\n\"\n  supply make_id_map_rec'_rule[vcg_rules]\n  unfolding make_id_map_rec_def\n  apply vcg\n  done\n\nlemma make_id_map_loop_rule:\n  \"\n  llvm_htriple\n  (string_list_assn strs strsi)\n  (make_id_map_loop strsi)\n  (\\<lambda>(mi, li). (EXS m l. map.rbt_map_assn m mi ** string_list_assn l li ** \\<up>(is_id_bijection strs m (list_id_map l))))\n\"\n  supply make_id_map_loop'_rule[vcg_rules]\n  unfolding make_id_map_loop_def\n  apply vcg\n  done\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Example/Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.341048057064018}}
{"text": "header {* \\isaheader{Equivalence} *}\n\ntheory WEquivalence imports Semantics WCFG begin\n\n\nsubsection {* From @{term \"prog \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle>\"} to\\\\\n  @{term \"c \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)\"} with @{term transfers} and @{term preds} *}\n\nlemma Skip_WCFG_edge_Exit:\n  \"\\<lbrakk>labels prog l Skip\\<rbrakk> \\<Longrightarrow> prog \\<turnstile> (_ l _) -\\<Up>id\\<rightarrow> (_Exit_)\"\nproof(induct prog l Skip rule:labels.induct)\n  case Labels_Base\n  show ?case by(fastforce intro:WCFG_Skip)\nnext\n  case (Labels_LAss V e)\n  show ?case by(rule WCFG_LAssSkip)\nnext\n  case (Labels_Seq2 c\\<^sub>2 l c\\<^sub>1)\n  from `c\\<^sub>2 \\<turnstile> (_ l _) -\\<Up>id\\<rightarrow> (_Exit_)`\n  have \"c\\<^sub>1;;c\\<^sub>2 \\<turnstile> (_ l _) \\<oplus> #:c\\<^sub>1 -\\<Up>id\\<rightarrow> (_Exit_) \\<oplus> #:c\\<^sub>1\"\n    by(fastforce intro:WCFG_SeqSecond)\n  thus ?case by(simp del:id_apply)\nnext\n  case (Labels_CondTrue c\\<^sub>1 l b c\\<^sub>2)\n  from `c\\<^sub>1 \\<turnstile> (_ l _) -\\<Up>id\\<rightarrow> (_Exit_)`\n  have \"if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> (_ l _) \\<oplus> 1 -\\<Up>id\\<rightarrow> (_Exit_) \\<oplus> 1\"\n    by(fastforce intro:WCFG_CondThen)\n  thus ?case by(simp del:id_apply)\nnext\n  case (Labels_CondFalse c\\<^sub>2 l b c\\<^sub>1)\n  from `c\\<^sub>2 \\<turnstile> (_ l _) -\\<Up>id\\<rightarrow> (_Exit_)`\n  have \"if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> (_ l _) \\<oplus> (#:c\\<^sub>1 + 1) -\\<Up>id\\<rightarrow> (_Exit_) \\<oplus> (#:c\\<^sub>1 + 1)\"\n    by(fastforce intro:WCFG_CondElse)\n  thus ?case by(simp del:id_apply)\nnext\n  case (Labels_WhileExit b c')\n  show ?case by(rule WCFG_WhileFalseSkip)\nqed\n\n\nlemma step_WCFG_edge:\n  assumes \"prog \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle>\"\n  obtains et where \"prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)\" and \"transfer et s = s'\"\n  and \"pred et s\"\nproof -\n  from `prog \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle>`\n  have \"\\<exists>et. prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _) \\<and> transfer et s = s' \\<and> pred et s\"\n  proof(induct rule:step.induct)\n    case (StepLAss V e s)\n    have \"pred \\<Up>(\\<lambda>s. s(V:=(interpret e s))) s\" by simp\n    have \"V:=e \\<turnstile> (_0_) -\\<Up>(\\<lambda>s. s(V:=(interpret e s)))\\<rightarrow> (_1_)\"\n      by(rule WCFG_LAss)\n    have \"transfer \\<Up>(\\<lambda>s. s(V:=(interpret e s))) s = s(V:=(interpret e s))\" by simp\n    with `pred \\<Up>(\\<lambda>s. s(V:=(interpret e s))) s`\n      `V:=e \\<turnstile> (_0_) -\\<Up>(\\<lambda>s. s(V:=(interpret e s)))\\<rightarrow> (_1_)` show ?case by blast\n  next\n    case (StepSeq c\\<^sub>1 c\\<^sub>2 l s)\n    from `labels (c\\<^sub>1;;c\\<^sub>2) l (Skip;;c\\<^sub>2)` `l < #:c\\<^sub>1` have \"labels c\\<^sub>1 l Skip\"\n      by(auto elim:labels.cases intro:Labels_Base)\n    hence \"c\\<^sub>1 \\<turnstile> (_ l _) -\\<Up>id\\<rightarrow> (_Exit_)\" \n      by(fastforce intro:Skip_WCFG_edge_Exit)\n    hence \"c\\<^sub>1;;c\\<^sub>2 \\<turnstile> (_ l _) -\\<Up>id\\<rightarrow> (_0_) \\<oplus> #:c\\<^sub>1\" \n      by(rule WCFG_SeqConnect,simp)\n    thus ?case by auto\n  next\n    case (StepSeqWhile b cx l s)\n    from `labels (while (b) cx) l (Skip;;while (b) cx)`\n    obtain lx where \"labels cx lx Skip\" \n      and [simp]:\"l = lx + 2\" by(auto elim:labels.cases)\n    hence \"cx \\<turnstile> (_ lx _) -\\<Up>id\\<rightarrow> (_Exit_)\" \n      by(fastforce intro:Skip_WCFG_edge_Exit)\n    hence \"while (b) cx \\<turnstile> (_ lx _) \\<oplus> 2 -\\<Up>id\\<rightarrow> (_0_)\"\n      by(fastforce intro:WCFG_WhileBodyExit)\n    thus ?case by auto\n  next\n    case (StepCondTrue b s c\\<^sub>1 c\\<^sub>2)\n    from `interpret b s = Some true`\n    have \"pred (\\<lambda>s. interpret b s = Some true)\\<^sub>\\<surd> s\" by simp\n    moreover\n    have \"if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> (_0_) -(\\<lambda>s. interpret b s = Some true)\\<^sub>\\<surd>\\<rightarrow> (_0_) \\<oplus> 1\"\n      by(rule WCFG_CondTrue)\n    moreover\n    have \"transfer (\\<lambda>s. interpret b s = Some true)\\<^sub>\\<surd> s = s\" by simp\n    ultimately show ?case by auto\n  next\n    case (StepCondFalse b s c\\<^sub>1 c\\<^sub>2)\n    from `interpret b s = Some false`\n    have \"pred (\\<lambda>s. interpret b s = Some false)\\<^sub>\\<surd> s\" by simp\n    moreover\n    have \"if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> (_0_) -(\\<lambda>s. interpret b s = Some false)\\<^sub>\\<surd>\\<rightarrow> \n                                   (_0_) \\<oplus> (#:c\\<^sub>1 + 1)\"\n      by(rule WCFG_CondFalse)\n    moreover\n    have \"transfer (\\<lambda>s. interpret b s = Some false)\\<^sub>\\<surd> s = s\" by simp\n    ultimately show ?case by auto\n  next\n    case (StepWhileTrue b s c)\n    from `interpret b s = Some true`\n    have \"pred (\\<lambda>s. interpret b s = Some true)\\<^sub>\\<surd> s\" by simp\n    moreover\n    have \"while (b) c \\<turnstile> (_0_) -(\\<lambda>s. interpret b s = Some true)\\<^sub>\\<surd>\\<rightarrow> (_0_) \\<oplus> 2\" \n      by(rule WCFG_WhileTrue)\n    moreover\n    have \"transfer (\\<lambda>s. interpret b s = Some true)\\<^sub>\\<surd> s = s\" by simp\n    ultimately show ?case by(auto simp del:add_2_eq_Suc')\n  next\n    case (StepWhileFalse b s c)\n    from `interpret b s = Some false`\n    have \"pred (\\<lambda>s. interpret b s = Some false)\\<^sub>\\<surd> s\" by simp\n    moreover\n    have \"while (b) c \\<turnstile> (_0_) -(\\<lambda>s. interpret b s = Some false)\\<^sub>\\<surd>\\<rightarrow> (_1_)\"\n      by(rule WCFG_WhileFalse)\n    moreover\n    have \"transfer (\\<lambda>s. interpret b s = Some false)\\<^sub>\\<surd> s = s\" by simp\n    ultimately show ?case by auto\n  next\n    case (StepRecSeq1 prog c s l c' s' l' c\\<^sub>2)\n    from `\\<exists>et. prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _) \\<and> transfer et s = s' \\<and> pred et s`\n    obtain et where \"prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)\" \n      and \"transfer et s = s'\" and \"pred et s\" by blast\n    moreover\n    from `prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)` have \"prog;;c\\<^sub>2 \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)\"\n      by(fastforce intro:WCFG_SeqFirst)\n    ultimately show ?case by blast\n  next\n    case (StepRecSeq2 prog c s l c' s' l' c\\<^sub>1)\n    from `\\<exists>et. prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _) \\<and> transfer et s = s' \\<and> pred et s`\n    obtain et where \"prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)\" \n      and \"transfer et s = s'\" and \"pred et s\" by blast\n    moreover\n    from `prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)` \n    have \"c\\<^sub>1;;prog \\<turnstile> (_ l _) \\<oplus> #:c\\<^sub>1 -et\\<rightarrow> (_ l' _) \\<oplus> #:c\\<^sub>1\"\n      by(fastforce intro:WCFG_SeqSecond)\n    ultimately show ?case by simp blast\n  next\n    case (StepRecCond1 prog c s l c' s' l' b c\\<^sub>2)\n    from `\\<exists>et. prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _) \\<and> transfer et s = s' \\<and> pred et s`\n    obtain et where \"prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)\" \n      and \"transfer et s = s'\" and \"pred et s\" by blast\n    moreover\n    from `prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)` \n    have \"if (b) prog else c\\<^sub>2 \\<turnstile> (_ l _) \\<oplus> 1 -et\\<rightarrow> (_ l' _) \\<oplus> 1\"\n      by(fastforce intro:WCFG_CondThen)\n    ultimately show ?case by simp blast\n  next\n    case (StepRecCond2 prog c s l c' s' l' b c\\<^sub>1)\n    from `\\<exists>et. prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _) \\<and> transfer et s = s' \\<and> pred et s`\n    obtain et where \"prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)\" \n      and \"transfer et s = s'\" and \"pred et s\" by blast\n    moreover\n    from `prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)`\n    have \"if (b) c\\<^sub>1 else prog \\<turnstile> (_ l _) \\<oplus> (#:c\\<^sub>1 + 1) -et\\<rightarrow> (_ l' _) \\<oplus> (#:c\\<^sub>1 + 1)\"\n      by(fastforce intro:WCFG_CondElse)\n    ultimately show ?case by simp blast\n  next\n    case (StepRecWhile cx c s l c' s' l' b)\n    from `\\<exists>et. cx \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _) \\<and> transfer et s = s' \\<and> pred et s`\n    obtain et where \"cx \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)\"\n      and \"transfer et s = s'\" and \"pred et s\" by blast\n    moreover\n    hence \"while (b) cx \\<turnstile> (_ l _) \\<oplus> 2 -et\\<rightarrow> (_ l' _) \\<oplus> 2\"\n      by(fastforce intro:WCFG_WhileBody)\n    ultimately show ?case by simp blast\n  qed\n  with that show ?thesis by blast\nqed\n\n\nsubsection {* From @{term \"c \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _)\"} with @{term transfers} \n  and @{term preds} to\\\\\n  @{term \"prog \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle>\"} *}\n\n(*<*)declare One_nat_def [simp del] add_2_eq_Suc' [simp del](*>*)\n\nlemma WCFG_edge_Exit_Skip:\n  \"\\<lbrakk>prog \\<turnstile> n -et\\<rightarrow> (_Exit_); n \\<noteq> (_Entry_)\\<rbrakk>\n  \\<Longrightarrow> \\<exists>l. n = (_ l _) \\<and> labels prog l Skip \\<and> et = \\<Up>id\"\nproof(induct prog n et \"(_Exit_)\" rule:WCFG_induct)\n  case WCFG_Skip show ?case by(fastforce intro:Labels_Base)\nnext\n  case WCFG_LAssSkip show ?case by(fastforce intro:Labels_LAss)\nnext\n  case (WCFG_SeqSecond c\\<^sub>2 n et n' c\\<^sub>1)\n  note IH = `\\<lbrakk>n' = (_Exit_); n \\<noteq> (_Entry_)\\<rbrakk> \n    \\<Longrightarrow> \\<exists>l. n = (_ l _) \\<and> labels c\\<^sub>2 l Skip \\<and> et = \\<Up>id`\n  from `n' \\<oplus> #:c\\<^sub>1 = (_Exit_)` have \"n' = (_Exit_)\" by(cases n') auto\n  from IH[OF this `n \\<noteq> (_Entry_)`] obtain l where [simp]:\"n = (_ l _)\" \"et = \\<Up>id\"\n    and \"labels c\\<^sub>2 l Skip\" by blast\n  hence \"labels (c\\<^sub>1;;c\\<^sub>2) (l + #:c\\<^sub>1) Skip\" by(fastforce intro:Labels_Seq2)\n  thus ?case by(fastforce simp:id_def)\nnext\n  case (WCFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2)\n  note IH = `\\<lbrakk>n' = (_Exit_); n \\<noteq> (_Entry_)\\<rbrakk>\n    \\<Longrightarrow> \\<exists>l. n = (_ l _) \\<and> labels c\\<^sub>1 l Skip \\<and> et = \\<Up>id`\n  from `n' \\<oplus> 1 = (_Exit_)` have \"n' = (_Exit_)\" by(cases n') auto\n  from IH[OF this `n \\<noteq> (_Entry_)`] obtain l where [simp]:\"n = (_ l _)\" \"et = \\<Up>id\"\n    and \"labels c\\<^sub>1 l Skip\" by blast\n  hence \"labels (if (b) c\\<^sub>1 else c\\<^sub>2) (l + 1) Skip\"\n    by(fastforce intro:Labels_CondTrue)\n  thus ?case by(fastforce simp:id_def)\nnext\n  case (WCFG_CondElse c\\<^sub>2 n et n' b c\\<^sub>1)\n  note IH = `\\<lbrakk>n' = (_Exit_); n \\<noteq> (_Entry_)\\<rbrakk>\n    \\<Longrightarrow> \\<exists>l. n = (_ l _) \\<and> labels c\\<^sub>2 l Skip \\<and> et = \\<Up>id`\n  from `n' \\<oplus> #:c\\<^sub>1 + 1 = (_Exit_)` have \"n' = (_Exit_)\" by(cases n') auto\n  from IH[OF this `n \\<noteq> (_Entry_)`] obtain l where [simp]:\"n = (_ l _)\" \"et = \\<Up>id\"\n    and label:\"labels c\\<^sub>2 l Skip\" by blast\n  hence \"labels (if (b) c\\<^sub>1 else c\\<^sub>2) (l + #:c\\<^sub>1 + 1) Skip\"\n    by(fastforce intro:Labels_CondFalse)\n  thus ?case by(fastforce simp:add.assoc id_def)\nnext\n  case WCFG_WhileFalseSkip show ?case by(fastforce intro:Labels_WhileExit)\nnext\n  case (WCFG_WhileBody c' n et n' b) thus ?case by(cases n') auto\nqed simp_all\n\n\nlemma WCFG_edge_step:\n  \"\\<lbrakk>prog \\<turnstile> (_ l _) -et\\<rightarrow> (_ l' _); transfer et s = s'; pred et s\\<rbrakk>\n  \\<Longrightarrow> \\<exists>c c'. prog \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle> \\<and> labels prog l c \\<and> labels prog l' c'\"\nproof(induct prog \"(_ l _)\" et \"(_ l' _)\" arbitrary:l l' rule:WCFG_induct)\n  case (WCFG_LAss V e)\n  from `transfer \\<Up>\\<lambda>s. s(V:=(interpret e s)) s = s'`\n  have [simp]:\"s' = s(V:=(interpret e s))\" by(simp del:fun_upd_apply)\n  have \"labels (V:=e) 0 (V:=e)\" by(fastforce intro:Labels_Base)\n  moreover\n  hence \"labels (V:=e) 1 Skip\" by(fastforce intro:Labels_LAss)\n  ultimately show ?case\n    apply(rule_tac x=\"V:=e\" in exI)\n    apply(rule_tac x=\"Skip\" in exI)\n    by(fastforce intro:StepLAss simp del:fun_upd_apply)\nnext\n  case (WCFG_SeqFirst c\\<^sub>1 et c\\<^sub>2)\n  note IH = `\\<lbrakk>transfer et s = s'; pred et s\\<rbrakk>\n    \\<Longrightarrow> \\<exists>c c'. c\\<^sub>1 \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle> \\<and> labels c\\<^sub>1 l c \\<and> labels c\\<^sub>1 l' c'`\n  from IH[OF `transfer et s = s'` `pred et s`]\n  obtain c c' where \"c\\<^sub>1 \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle>\"\n    and \"labels c\\<^sub>1 l c\" and \"labels c\\<^sub>1 l' c'\" by blast\n  from `c\\<^sub>1 \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle>` have \"c\\<^sub>1;;c\\<^sub>2 \\<turnstile> \\<langle>c;;c\\<^sub>2,s,l\\<rangle> \\<leadsto> \\<langle>c';;c\\<^sub>2,s',l'\\<rangle>\"\n    by(rule StepRecSeq1)\n  moreover \n  from `labels c\\<^sub>1 l c` have \"labels (c\\<^sub>1;;c\\<^sub>2) l (c;;c\\<^sub>2)\"\n    by(fastforce intro:Labels_Seq1)\n  moreover \n  from `labels c\\<^sub>1 l' c'` have \"labels (c\\<^sub>1;;c\\<^sub>2) l' (c';;c\\<^sub>2)\"\n    by(fastforce intro:Labels_Seq1)\n  ultimately show ?case by blast\nnext\n  case (WCFG_SeqConnect c\\<^sub>1 et c\\<^sub>2)\n  from `c\\<^sub>1 \\<turnstile> (_ l _) -et\\<rightarrow> (_Exit_)`\n  have \"labels c\\<^sub>1 l Skip\" and [simp]:\"et = \\<Up>id\"\n    by(auto dest:WCFG_edge_Exit_Skip)\n  from `transfer et s = s'` have [simp]:\"s' = s\" by simp\n  have \"labels c\\<^sub>2 0 c\\<^sub>2\" by(fastforce intro:Labels_Base)\n  hence \"labels (c\\<^sub>1;;c\\<^sub>2) #:c\\<^sub>1 c\\<^sub>2\" by(fastforce dest:Labels_Seq2)\n  moreover\n  from `labels c\\<^sub>1 l Skip` have \"labels (c\\<^sub>1;;c\\<^sub>2) l (Skip;;c\\<^sub>2)\"\n    by(fastforce intro:Labels_Seq1)\n  moreover\n  from `labels c\\<^sub>1 l Skip` have \"l < #:c\\<^sub>1\" by(rule label_less_num_inner_nodes)\n  ultimately \n  have \"c\\<^sub>1;;c\\<^sub>2 \\<turnstile> \\<langle>Skip;;c\\<^sub>2,s,l\\<rangle> \\<leadsto> \\<langle>c\\<^sub>2,s,#:c\\<^sub>1\\<rangle>\" by -(rule StepSeq)\n  with `labels (c\\<^sub>1;;c\\<^sub>2) l (Skip;;c\\<^sub>2)`\n    `labels (c\\<^sub>1;;c\\<^sub>2) #:c\\<^sub>1 c\\<^sub>2` `(_0_) \\<oplus> #:c\\<^sub>1 = (_ l' _)` show ?case by simp blast\nnext\n  case (WCFG_SeqSecond c\\<^sub>2 n et n' c\\<^sub>1)\n  note IH = `\\<And>l l'. \\<lbrakk>n = (_ l _); n' = (_ l' _); transfer et s = s'; pred et s\\<rbrakk>\n    \\<Longrightarrow> \\<exists>c c'. c\\<^sub>2 \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle> \\<and> labels c\\<^sub>2 l c \\<and> labels c\\<^sub>2 l' c'`\n  from `n \\<oplus> #:c\\<^sub>1 = (_ l _)` obtain lx where \"n = (_ lx _)\" \n    and [simp]:\"l = lx + #:c\\<^sub>1\"\n    by(cases n) auto\n  from `n' \\<oplus> #:c\\<^sub>1 = (_ l' _)` obtain lx' where \"n' = (_ lx' _)\" \n    and [simp]:\"l' = lx' + #:c\\<^sub>1\"\n    by(cases n') auto\n  from IH[OF `n = (_ lx _)` `n' = (_ lx' _)` `transfer et s = s'` `pred et s`]\n  obtain c c' where \"c\\<^sub>2 \\<turnstile> \\<langle>c,s,lx\\<rangle> \\<leadsto> \\<langle>c',s',lx'\\<rangle>\"\n    and \"labels c\\<^sub>2 lx c\" and \"labels c\\<^sub>2 lx' c'\" by blast\n  from `c\\<^sub>2 \\<turnstile> \\<langle>c,s,lx\\<rangle> \\<leadsto> \\<langle>c',s',lx'\\<rangle>` have \"c\\<^sub>1;;c\\<^sub>2 \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle>\"\n    by(fastforce intro:StepRecSeq2)\n  moreover \n  from `labels c\\<^sub>2 lx c` have \"labels (c\\<^sub>1;;c\\<^sub>2) l c\" by(fastforce intro:Labels_Seq2)\n  moreover \n  from `labels c\\<^sub>2 lx' c'` have \"labels (c\\<^sub>1;;c\\<^sub>2) l' c'\" by(fastforce intro:Labels_Seq2)\n  ultimately show ?case by blast\nnext\n  case (WCFG_CondTrue b c\\<^sub>1 c\\<^sub>2)\n  from `(_0_) \\<oplus> 1 = (_ l' _)` have [simp]:\"l' = 1\" by simp\n  from `transfer (\\<lambda>s. interpret b s = Some true)\\<^sub>\\<surd> s = s'` have [simp]:\"s' = s\" by simp\n  have \"labels (if (b) c\\<^sub>1 else c\\<^sub>2) 0 (if (b) c\\<^sub>1 else c\\<^sub>2)\"\n    by(fastforce intro:Labels_Base)\n  have \"labels c\\<^sub>1 0 c\\<^sub>1\" by(fastforce intro:Labels_Base)\n  hence \"labels (if (b) c\\<^sub>1 else c\\<^sub>2) 1 c\\<^sub>1\" by(fastforce dest:Labels_CondTrue)\n  from `pred (\\<lambda>s. interpret b s = Some true)\\<^sub>\\<surd> s`\n  have \"interpret b s = Some true\" by simp\n  hence \"if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> \\<langle>if (b) c\\<^sub>1 else c\\<^sub>2,s,0\\<rangle> \\<leadsto> \\<langle>c\\<^sub>1,s,1\\<rangle>\"\n    by(rule StepCondTrue)\n  with  `labels (if (b) c\\<^sub>1 else c\\<^sub>2) 0 (if (b) c\\<^sub>1 else c\\<^sub>2)`\n    `labels (if (b) c\\<^sub>1 else c\\<^sub>2) 1 c\\<^sub>1` show ?case by simp blast\nnext\n  case (WCFG_CondFalse b c\\<^sub>1 c\\<^sub>2)\n  from `(_0_) \\<oplus> #:c\\<^sub>1 + 1 = (_ l' _)` have [simp]:\"l' = #:c\\<^sub>1 + 1\" by simp\n  from `transfer (\\<lambda>s. interpret b s = Some false)\\<^sub>\\<surd> s = s'` have [simp]:\"s' = s\"\n    by simp\n  have \"labels (if (b) c\\<^sub>1 else c\\<^sub>2) 0 (if (b) c\\<^sub>1 else c\\<^sub>2)\"\n    by(fastforce intro:Labels_Base)\n  have \"labels c\\<^sub>2 0 c\\<^sub>2\" by(fastforce intro:Labels_Base)\n  hence \"labels (if (b) c\\<^sub>1 else c\\<^sub>2) (#:c\\<^sub>1 + 1) c\\<^sub>2\" by(fastforce dest:Labels_CondFalse)\n  from `pred (\\<lambda>s. interpret b s = Some false)\\<^sub>\\<surd> s`\n  have \"interpret b s = Some false\" by simp\n  hence \"if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> \\<langle>if (b) c\\<^sub>1 else c\\<^sub>2,s,0\\<rangle> \\<leadsto> \\<langle>c\\<^sub>2,s,#:c\\<^sub>1 + 1\\<rangle>\"\n    by(rule StepCondFalse)\n  with `labels (if (b) c\\<^sub>1 else c\\<^sub>2) 0 (if (b) c\\<^sub>1 else c\\<^sub>2)`\n    `labels (if (b) c\\<^sub>1 else c\\<^sub>2) (#:c\\<^sub>1 + 1) c\\<^sub>2` show ?case by simp blast\nnext\n  case (WCFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2)\n  note IH = `\\<And>l l'. \\<lbrakk>n = (_ l _); n' = (_ l' _); transfer et s = s'; pred et s\\<rbrakk>\n    \\<Longrightarrow> \\<exists>c c'. c\\<^sub>1 \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle> \\<and> labels c\\<^sub>1 l c \\<and> labels c\\<^sub>1 l' c'`\n  from `n \\<oplus> 1 = (_ l _)` obtain lx where \"n = (_ lx _)\" and [simp]:\"l = lx + 1\"\n    by(cases n) auto\n  from `n' \\<oplus> 1 = (_ l' _)` obtain lx' where \"n' = (_ lx' _)\" and [simp]:\"l' = lx' + 1\"\n    by(cases n') auto\n  from IH[OF `n = (_ lx _)` `n' = (_ lx' _)` `transfer et s = s'` `pred et s`]\n  obtain c c'  where \"c\\<^sub>1 \\<turnstile> \\<langle>c,s,lx\\<rangle> \\<leadsto> \\<langle>c',s',lx'\\<rangle>\"\n    and \"labels c\\<^sub>1 lx c\" and \"labels c\\<^sub>1 lx' c'\" by blast\n  from `c\\<^sub>1 \\<turnstile> \\<langle>c,s,lx\\<rangle> \\<leadsto> \\<langle>c',s',lx'\\<rangle>` have \"if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle>\"\n    by(fastforce intro:StepRecCond1)\n  moreover \n  from `labels c\\<^sub>1 lx c` have \"labels (if (b) c\\<^sub>1 else c\\<^sub>2) l c\"\n    by(fastforce intro:Labels_CondTrue)\n  moreover \n  from `labels c\\<^sub>1 lx' c'` have \"labels (if (b) c\\<^sub>1 else c\\<^sub>2) l' c'\"\n    by(fastforce intro:Labels_CondTrue)\n  ultimately show ?case by blast\nnext\n  case (WCFG_CondElse c\\<^sub>2 n et n' b c\\<^sub>1)\n  note IH = `\\<And>l l'. \\<lbrakk>n = (_ l _); n' = (_ l' _); transfer et s = s'; pred et s\\<rbrakk>\n    \\<Longrightarrow> \\<exists>c c'. c\\<^sub>2 \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle> \\<and> labels c\\<^sub>2 l c \\<and> labels c\\<^sub>2 l' c'`\n  from `n \\<oplus> #:c\\<^sub>1 + 1 = (_ l _)` obtain lx where \"n = (_ lx _)\" \n    and [simp]:\"l = lx + #:c\\<^sub>1 + 1\"\n    by(cases n) auto\n  from `n' \\<oplus> #:c\\<^sub>1 + 1 = (_ l' _)` obtain lx' where \"n' = (_ lx' _)\" \n    and [simp]:\"l' = lx' + #:c\\<^sub>1 + 1\"\n    by(cases n') auto\n  from IH[OF `n = (_ lx _)` `n' = (_ lx' _)` `transfer et s = s'` `pred et s`]\n  obtain c c' where \"c\\<^sub>2 \\<turnstile> \\<langle>c,s,lx\\<rangle> \\<leadsto> \\<langle>c',s',lx'\\<rangle>\"\n    and \"labels c\\<^sub>2 lx c\" and \"labels c\\<^sub>2 lx' c'\" by blast\n  from `c\\<^sub>2 \\<turnstile> \\<langle>c,s,lx\\<rangle> \\<leadsto> \\<langle>c',s',lx'\\<rangle>` have \"if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle>\"\n    by(fastforce intro:StepRecCond2)\n  moreover \n  from `labels c\\<^sub>2 lx c` have \"labels (if (b) c\\<^sub>1 else c\\<^sub>2) l c\"\n    by(fastforce intro:Labels_CondFalse)\n  moreover \n  from `labels c\\<^sub>2 lx' c'` have \"labels (if (b) c\\<^sub>1 else c\\<^sub>2) l' c'\"\n    by(fastforce intro:Labels_CondFalse)\n  ultimately show ?case by blast\nnext\n  case (WCFG_WhileTrue b cx)\n  from `(_0_) \\<oplus> 2 = (_ l' _)` have [simp]:\"l' = 2\" by simp\n  from `transfer (\\<lambda>s. interpret b s = Some true)\\<^sub>\\<surd> s = s'` have [simp]:\"s' = s\" by simp\n  have \"labels (while (b) cx) 0 (while (b) cx)\"\n    by(fastforce intro:Labels_Base)\n  have \"labels cx 0 cx\" by(fastforce intro:Labels_Base)\n  hence \"labels (while (b) cx) 2 (cx;;while (b) cx)\"\n    by(fastforce dest:Labels_WhileBody)\n  from `pred (\\<lambda>s. interpret b s = Some true)\\<^sub>\\<surd> s` have \"interpret b s = Some true\" by simp\n  hence \"while (b) cx \\<turnstile> \\<langle>while (b) cx,s,0\\<rangle> \\<leadsto> \\<langle>cx;;while (b) cx,s,2\\<rangle>\"\n    by(rule StepWhileTrue)\n  with `labels (while (b) cx) 0 (while (b) cx)`\n    `labels (while (b) cx) 2 (cx;;while (b) cx)` show ?case by simp blast\nnext\n  case (WCFG_WhileFalse b cx)\n  from `transfer (\\<lambda>s. interpret b s = Some false)\\<^sub>\\<surd> s = s'` have [simp]:\"s' = s\"\n    by simp\n  have \"labels (while (b) cx) 0 (while (b) cx)\" by(fastforce intro:Labels_Base)\n  have \"labels (while (b) cx) 1 Skip\" by(fastforce intro:Labels_WhileExit)\n  from `pred (\\<lambda>s. interpret b s = Some false)\\<^sub>\\<surd> s` have \"interpret b s = Some false\"\n    by simp\n  hence \"while (b) cx \\<turnstile> \\<langle>while (b) cx,s,0\\<rangle> \\<leadsto> \\<langle>Skip,s,1\\<rangle>\"\n    by(rule StepWhileFalse)\n  with `labels (while (b) cx) 0 (while (b) cx)` `labels (while (b) cx) 1 Skip`\n  show ?case by simp blast\nnext\n  case (WCFG_WhileBody cx n et n' b)\n  note IH = `\\<And>l l'. \\<lbrakk>n = (_ l _); n' = (_ l' _); transfer et s = s'; pred et s\\<rbrakk>\n    \\<Longrightarrow> \\<exists>c c'. cx \\<turnstile> \\<langle>c,s,l\\<rangle> \\<leadsto> \\<langle>c',s',l'\\<rangle> \\<and> labels cx l c \\<and> labels cx l' c'`\n  from `n \\<oplus> 2 = (_ l _)` obtain lx where \"n = (_ lx _)\" and [simp]:\"l = lx + 2\"\n    by(cases n) auto\n  from `n' \\<oplus> 2 = (_ l' _)` obtain lx' where \"n' = (_ lx' _)\" \n    and [simp]:\"l' = lx' + 2\" by(cases n') auto\n  from IH[OF `n = (_ lx _)` `n' = (_ lx' _)` `transfer et s = s'` `pred et s`]\n  obtain c c' where \"cx \\<turnstile> \\<langle>c,s,lx\\<rangle> \\<leadsto> \\<langle>c',s',lx'\\<rangle>\"\n    and \"labels cx lx c\" and \"labels cx lx' c'\" by blast\n  hence \"while (b) cx \\<turnstile> \\<langle>c;;while (b) cx,s,l\\<rangle> \\<leadsto> \\<langle>c';;while (b) cx,s',l'\\<rangle>\"\n    by(fastforce intro:StepRecWhile)\n  moreover \n  from `labels cx lx c` have \"labels (while (b) cx) l (c;;while (b) cx)\"\n    by(fastforce intro:Labels_WhileBody)\n  moreover \n  from `labels cx lx' c'` have \"labels (while (b) cx) l' (c';;while (b) cx)\"\n    by(fastforce intro:Labels_WhileBody)\n  ultimately show ?case by blast\nnext\n  case (WCFG_WhileBodyExit cx n et b)\n  from `n \\<oplus> 2 = (_ l _)` obtain lx where [simp]:\"n = (_ lx _)\" and [simp]:\"l = lx + 2\"\n    by(cases n) auto\n  from `cx \\<turnstile> n -et\\<rightarrow> (_Exit_)` have \"labels cx lx Skip\" and [simp]:\"et = \\<Up>id\"\n    by(auto dest:WCFG_edge_Exit_Skip)\n  from `transfer et s = s'` have [simp]:\"s' = s\" by simp\n  from `labels cx lx Skip` have \"labels (while (b) cx) l (Skip;;while (b) cx)\"\n    by(fastforce intro:Labels_WhileBody)\n  hence \"while (b) cx \\<turnstile> \\<langle>Skip;;while (b) cx,s,l\\<rangle> \\<leadsto> \\<langle>while (b) cx,s,0\\<rangle>\"\n    by(rule StepSeqWhile)\n  moreover\n  have \"labels (while (b) cx) 0 (while (b) cx)\"\n    by(fastforce intro:Labels_Base)\n  ultimately show ?case \n    using `labels (while (b) cx) l (Skip;;while (b) cx)` by simp blast\nqed\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/While/WEquivalence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.341048057064018}}
{"text": "theory Balance_Opt\n  imports \"../Balance\"\nbegin\n\ncontext rbt_impl\nbegin\ninterpretation rbt_impl_deps .\n\ndefinition \"rotate_left n_p \\<equiv>\n  do {\n    r_p \\<leftarrow> right n_p;\n    rl_p \\<leftarrow> left r_p;\n    set_left_p n_p r_p;\n    set_right_p rl_p n_p;\n    return r_p\n  }\n\"\n\ndefinition \"rotate_right n_p \\<equiv>\n  do {\n    l_p \\<leftarrow> left n_p;\n    lr_p \\<leftarrow> right l_p;\n    set_right_p n_p l_p;\n    set_left_p lr_p n_p;\n    return l_p\n  }\n\"\n\ndefinition \"balance_opt_case_1 n_p \\<equiv> \n  do {\n    n \\<leftarrow> ll_load n_p;\n    set_color_p 0 n_p;\n    set_color_p 1 (rbt_node.left n);\n    set_color_p 1 (rbt_node.right n);\n    return n_p\n  }\"\n                            \ndefinition \"balance_opt_case_2 n_p \\<equiv> \n  do {\n    n2_p \\<leftarrow> rotate_right n_p;\n    l_p \\<leftarrow> left n2_p;\n    set_color_p 1 l_p;\n    return n2_p\n  }\"\n\ndefinition \"balance_opt_case_3 n_p \\<equiv> \n  do {\n    l_p \\<leftarrow> left n_p;\n    l2_p \\<leftarrow> rotate_left l_p;\n    set_left_p l2_p n_p;\n    n2_p \\<leftarrow> rotate_right n_p;\n    set_color_p 1 l_p;\n    return n2_p\n  }\"\n\ndefinition \"balance_opt_case_4 n_p \\<equiv> \n  do {\n    n2_p \\<leftarrow> rotate_left n_p;\n    r_p \\<leftarrow> right n2_p;\n    set_color_p 1 r_p;\n    return n2_p\n  }\"\n\ndefinition \"balance_opt_case_5 n_p \\<equiv> \n  do {\n    r_p \\<leftarrow> right n_p;\n    r2_p \\<leftarrow> rotate_right r_p;\n    set_right_p r2_p n_p;\n    n2_p \\<leftarrow> rotate_left n_p;\n    set_color_p 1 r_p;\n    return n2_p\n  }\"\n\ndefinition \"balance_opt n_p \\<equiv>\n  do {\n    if! ll_matches_rbt\n        (RP_Branch CP_Var \n          (RP_Branch CP_R RP_Var RP_Var)\n          (RP_Branch CP_R RP_Var RP_Var)\n        ) n_p\n    then! balance_opt_case_1 n_p\n    else!\n    do {\n      n \\<leftarrow> ll_load n_p;\n      l_p \\<leftarrow> return rbt_node.left n;\n      r_p \\<leftarrow> return rbt_node.right n;\n      if! ll_matches_rbt\n        (RP_Branch CP_R (RP_Branch CP_R RP_Var RP_Var) RP_Var) l_p\n      then! balance_opt_case_2 n_p\n      else! if! ll_matches_rbt \n        (RP_Branch CP_R RP_Var (RP_Branch CP_R RP_Var RP_Var)) l_p\n      then! balance_opt_case_3 n_p\n      else! if! ll_matches_rbt \n        (RP_Branch CP_R RP_Var (RP_Branch CP_R RP_Var RP_Var)) r_p\n      then! balance_opt_case_4 n_p\n      else! if! ll_matches_rbt \n        (RP_Branch CP_R (RP_Branch CP_R RP_Var RP_Var) RP_Var) r_p\n      then! balance_opt_case_5 n_p\n      else! return n_p\n    }\n  }\n\"\n\nlemmas [llvm_inline] =\n    balance_opt_case_1_def\n    balance_opt_case_2_def\n    balance_opt_case_3_def\n    balance_opt_case_4_def\n    balance_opt_case_5_def\n    rotate_left_def    \n    rotate_right_def\n\nlemmas [llvm_code] = balance_opt_def\n\n\nlemma balance_opt_correct [vcg_rules]:\n  \"llvm_htriple\n  (\n    \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) n_p **\n    rbt_assn l li **\n    rbt_assn r ri **   \n    \\<upharpoonleft>key_assn k ki **\n    \\<upharpoonleft>value_assn v vi **\n    color_assn color.B ci\n  )\n  (balance_opt n_p)\n  (\\<lambda>res. rbt_assn (rbt_balance l k v r) res) \n  \"\n  unfolding \n    balance_opt_def\n    balance_opt_case_1_def\n    balance_opt_case_2_def\n    balance_opt_case_3_def\n    balance_opt_case_4_def\n    balance_opt_case_5_def\n    rotate_left_def    \n    rotate_right_def\n\n  apply vcg\n  subgoal (*Case 1*)\n    apply (cases \"(l, k, v, r)\" rule: RBT_Impl.balance.cases)\n                        apply auto\n    apply vcg\n    done\n  subgoal (*Case 2+*)\n    apply vcg\n    subgoal (*Case 3*)\n      apply (cases \"(l, k, v, r)\" rule: RBT_Impl.balance.cases)\n                          apply auto\n       apply vcg\n      done\n    subgoal (*Case 4+*)\n      apply vcg\n      subgoal (*Case 4*)\n        apply (cases \"(l, k, v, r)\" rule: RBT_Impl.balance.cases)\n                            apply auto\n           apply vcg\n        done\n      subgoal (*Case 5+*)\n        apply vcg\n        subgoal (*Case 5*)\n          apply (cases \"(l, k, v, r)\" rule: RBT_Impl.balance.cases)\n                              apply auto\n           apply vcg\n          done\n        subgoal (*Case 6*)\n          apply (cases \"(l, k, v, r)\" rule: RBT_Impl.balance.cases)\n                              apply auto\n                              apply vcg\n          done\n        done\n      done\n    done\n  done\n\nend\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Insert/Alloc_Optimized/Balance_Opt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3410480492395055}}
{"text": "(*  Title:      HOL/Auth/n_germanSimp.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanSimp Protocol Case Study*} \n\ntheory n_germanSimp imports n_germanSimp_lemma_invs_on_rules n_germanSimp_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_germanSimp/n_germanSimp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878414043814, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.34104804141499295}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |                    May 2005               |\n            |                   June 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |               November 2005  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2017         |\n            |                  April 2018  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_law_rep_par\nimports CSP_F_law_alpha_par CSP_F_op_rep_par CSP_T.CSP_T_law_rep_par\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(*****************************************************************\n\n         1. associativity of [||]:I\n         2. commutativity of [||]:I\n         3. \n         4. \n\n *****************************************************************)\n\n(*****************************************************\n   replace an index set with another equal index set\n *****************************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Rep_parallel_index_eq_lm1:\n   \"[| inj_on f I1 ; ALL i:I1. PXf2 (f i) = PXf1 i |] ==>\n    Union {(Yf i Int insert Tick (Ev ` snd (PXf1 i))) |i. i : I1} =\n    Union {(Yf (inv_on I1 f i) Int insert Tick (Ev ` snd (PXf2 i))) |i. i : f ` I1}\"\napply (rule) \n\n (* => *)\n apply (rule, simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"(Yf i) Int insert Tick (Ev ` snd (PXf2 (f i)))\" in exI)\n apply (simp)\n apply (rule_tac x=\"f i\" in exI)\n apply (simp add: inv_f_f_on)\n\n (* <= *)\n apply (rule, simp)\n apply (simp add: image_iff)\n apply (elim conjE exE bexE)\n apply (rule_tac x=\n   \"(Yf xb) Int insert Tick (Ev ` snd (PXf1 xb))\" in exI)\n apply (simp)\n apply (simp add: inv_f_f_on)\n apply (rule_tac x=\"xb\" in exI)\n apply (simp)\ndone\n\nlemma cspF_Rep_parallel_index_eq_lm2:\n   \"ALL i:I1. PXf2 (f i) = PXf1 i ==>\n    Union {(Yf i Int insert Tick (Ev ` snd (PXf2 i))) |i. i : f ` I1} =\n    Union {(Yf (f i) Int insert Tick (Ev ` snd (PXf1 i))) |i. i : I1}\"\napply (rule) \n\n (* => *)\n apply (rule, simp)\n apply (simp add: image_iff)\n apply (elim conjE exE bexE)\n apply (simp)\n apply (rule_tac x=\"xa\" in exI)\n apply (simp)\n apply (rule_tac x=\"xb\" in exI)\n apply (simp)\n\n (* <= *)\n apply (rule, simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"xa\" in exI)\n apply (simp)\n apply (rule_tac x=\"f i\" in exI)\n apply (simp)\ndone\n\n(* main *)\n\nlemma cspF_Rep_parallel_index_eq:\n   \"[| finite I1 ;\n       EX f. I2 = f ` I1 & inj_on f I1 &\n             (ALL i:I1. PXf2 (f i) = PXf1 i) |]\n     ==> [||]:I1 PXf1 =F[M,M] [||]:I2 PXf2\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_parallel_index_eq)\napply (case_tac \"I1 = {}\", simp)\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)\n apply (elim conjE exE)\n apply (simp add: in_failures_Rep_parallel)\n apply (subgoal_tac \"Union (snd ` PXf2 ` f ` I1) = Union (snd ` PXf1 ` I1)\")\n apply (simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"(%i. Yf (inv_on I1 f i))\" in exI)\n apply (simp add: inv_f_f_on)\n apply (simp add: cspF_Rep_parallel_index_eq_lm1)\n apply (simp add: Union_index_fun)\n\n (* => *)\n apply (rule)\n apply (elim conjE exE)\n apply (simp add: in_failures_Rep_parallel)\n apply (subgoal_tac \"Union (snd ` PXf2 ` f ` I1) = Union (snd ` PXf1 ` I1)\")\n apply (simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"(%i. Yf (f i))\" in exI)\n apply (simp)\n apply (simp add: cspF_Rep_parallel_index_eq_lm2)\n apply (simp add: Union_index_fun)\ndone\n\n(*********************************************************\n                [||]:I PXf ==> [||] PXs\n *********************************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Index_to_Inductive_parallel:\n  \"[| finite I ; Is isListOf I |] ==>\n   [||]:I PXf =F[M,M] [||] (map PXf Is)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Index_to_Inductive_parallel)\napply (case_tac \"I = {}\", simp)\n\napply (case_tac \"map PXf Is = []\")\napply (simp)\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)\n apply (simp add: in_failures_Rep_parallel)\n apply (simp add: in_failures_Inductive_parallel_nth)\n apply (simp add: isListOf_set_eq)\n apply (elim conjE exE)\n  apply (rule_tac x= \"map Yf Is\" in exI)\n  apply (simp)\n  apply (rule conjI)\n  apply (rule in_failures_Rep_parallel_lm2, simp)\n  apply (intro allI impI)\n  apply (drule_tac x=\"Is ! i\" in bspec)\n  apply (simp add: isListOf_nth_in_index)\n  apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp add: in_failures_Rep_parallel)\n apply (simp add: in_failures_Inductive_parallel_nth)\n apply (simp add: isListOf_set_eq)\n apply (elim conjE exE)\n apply (rule_tac x= \"(%i. (Ys!(THE n. (Is!n) = i & n<length Is)))\" in exI)\n  apply (rule conjI)\n  apply (simp add: in_failures_Rep_parallel_lm1)\n  apply (rule ballI)\n\n  apply (erule isListOf_index_to_nthE)\n  apply (drule_tac x=\"i\" in bspec, simp)\n  apply (elim conjE exE, simp)\n\n  apply (drule_tac x=\"n\" in spec, simp)\n  apply (rotate_tac 4)\n  apply (drule sym)\n  apply (simp add: isListOf_THE_nth)\ndone\n\n(************************************\n |       [||]:I PXf and SKIP        |\n ************************************)\n\nlemma cspF_SKIP_Rep_parallel_right_lm1:\n  \"I ~= {} ==>\n   insert Tick (Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I})\n   = Union {(insert Tick (Yf i Int Ev ` snd (PXf i))) |i. i : I}\"\nby (auto)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_SKIP_Rep_parallel_right:\n  \"finite I ==>\n   (([||]:I PXf) |[Union (snd `  PXf ` I), {}]| SKIP) =F[M,M]\n   ([||]:I PXf)\"\napply (case_tac \"I={}\")\napply (simp add: cspF_SKIP_Alpha_parallel)\n\n  apply (simp add: cspF_cspT_semantics)\n(* Isabelle 2017 *)\napply (simp add: cspT_SKIP_Rep_parallel_right[simplified])\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (simp add: in_failures_Rep_parallel)\n apply (elim conjE exE)\n\n  apply (case_tac \"Tick ~: Z\")\n  apply (simp)\n  apply (rule_tac x=\"Yf\" in exI)\n  apply (rule conjI)\n  apply (subgoal_tac \"Z Int {Tick} = {}\")\n  apply (simp (no_asm_simp))\n  apply (simp)\n\n  apply (intro ballI)\n  apply (drule_tac x=\"i\" in bspec, simp)\n  apply (subgoal_tac \" snd (PXf i) <= Union (snd ` PXf ` I)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n  apply (force)\n\n  apply (simp add: in_failures)\n  apply (erule disjE)\n  apply (simp add: Evset_def)\n  apply (force)\n\n  apply (rule_tac x=\"(%i. insert Tick (Yf i))\" in exI)\n  apply (simp)\n  apply (subgoal_tac \"Z Int {Tick} = {Tick}\", simp)\n  apply (simp add: cspF_SKIP_Rep_parallel_right_lm1)\n\n  apply (intro ballI)\n  apply (drule_tac x=\"i\" in bspec, simp)\n  apply (subgoal_tac \" snd (PXf i) <= Union (snd ` PXf ` I)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n\n  apply (simp add: rest_tr_Tick_sett)\n  apply (elim conjE exE)\n  apply (simp)\n  apply (rule proc_T2_T3)\n  apply (simp)\n  apply (simp)\n  apply (force)\n  apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (rule_tac x=\"X\" in exI)\n apply (rule_tac x=\"{}\" in exI)\n apply (simp)\n\n apply (simp add: in_failures)\n apply (simp add: rest_tr_empty)\n apply (simp add: in_failures_Rep_parallel)\n apply (elim conjE exE)\n apply (rule_tac x=\"Yf\" in exI)\n apply (simp)\n apply (intro ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n\n apply (subgoal_tac \" snd (PXf i) <= Union (snd ` PXf ` I)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\ndone\n\n(************************************\n |        SKIP and [||]:I PXf       |\n ************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_SKIP_Rep_parallel_left:\n  \"finite I ==>\n   (SKIP |[{}, Union (snd ` PXf ` I)]| ([||]:I PXf)) =F[M,M]\n   ([||]:I PXf)\"\napply (subgoal_tac \n    \"(SKIP |[{}, Union (snd ` PXf ` I)]| ([||]:I PXf)) =F[M,M]\n     (([||]:I PXf) |[Union (snd ` PXf ` I), {}]| SKIP)\")\napply (rule cspF_trans)\n    apply (simp)\n(* Isabelle 2017 *)\napply (simp add: cspF_SKIP_Rep_parallel_right[simplified])\napply (simp add: cspF_Alpha_parallel_commut)\ndone\n\n(*** left and right ***)\n\nlemmas cspF_SKIP_Rep_parallel = cspF_SKIP_Rep_parallel_left\n                                  cspF_SKIP_Rep_parallel_right\n\n(************************************\n |          associativity           |\n ************************************)\n\nlemma cspF_Rep_parallel_ass_lm1:\n   \"Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I} Int\n           insert Tick (Ev ` Union (snd ` PXf ` I))\n    = Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I}\"\nby (auto)\n\nlemma cspF_Rep_parallel_ass_lm2:\n   \"I1 Int I2 = {} ==>\n    Union {(Yf1 i Int insert Tick (Ev ` snd (PXf i))) |i. i : I1} Un\n    Union {(Yf2 i Int insert Tick (Ev ` snd (PXf i))) |i. i : I2} =\n    Union {(if i : I1 then Yf1 i else Yf2 i) Int insert Tick (Ev ` snd (PXf i)) |i.\n           i : I1 | i : I2}\"\napply (rule)\n\n apply (rule)\n apply (simp)\n apply (elim disjE conjE exE)\n\n  apply (rule_tac x=\"Yf1 i Int insert Tick (Ev ` snd (PXf i))\" in exI, simp)\n  apply (rule_tac x=\"i\" in exI, simp)\n  apply (rule_tac x=\"Yf2 i Int insert Tick (Ev ` snd (PXf i))\" in exI, simp)\n  apply (rule_tac x=\"i\" in exI, simp)\n  apply (force)\n\n apply (rule)\n apply (simp)\n apply (elim disjE conjE exE)\n\n  apply (rule disjI1)\n  apply (rule_tac x=\"Yf1 i Int insert Tick (Ev ` snd (PXf i))\" in exI, simp)\n  apply (rule_tac x=\"i\" in exI, simp)\n  apply (rule disjI2)\n  apply (case_tac \"i ~: I1\")\n  apply (rule_tac x=\"Yf2 i Int insert Tick (Ev ` snd (PXf i))\" in exI, simp)\n  apply (rule_tac x=\"i\" in exI, simp)\n  apply (force)\ndone\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Rep_parallel_assoc:\n \"[| I1 Int I2 = {} ; finite I1 ; finite I2 |] ==>\n  [||]:(I1 Un I2) PXf =F[M,M]\n  [||]:I1 PXf |[Union (snd ` PXf ` I1), Union (snd ` PXf ` I2)]| [||]:I2 PXf\"\n\napply (case_tac \"I1 = {}\")\napply (case_tac \"I2 = {}\")\napply (rule cspF_sym)\napply (simp add: cspF_SKIP_Alpha_parallel)\n   apply (rule cspF_sym)\n(* Isabellle 2017 *)\napply (simp add: cspF_SKIP_Rep_parallel[simplified])\n\napply (case_tac \"I2 = {}\")\n   apply (rule cspF_sym)\n(* Isabelle2017 *)\napply (simp add: cspF_SKIP_Rep_parallel[simplified])\n\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Rep_parallel_assoc[simplified])\napply (rule order_antisym)\n\n (* => *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (simp add: in_failures_Rep_parallel)\n apply (elim conjE exE)\n\n apply (rule_tac x=\"Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I1}\" in exI)\n apply (rule_tac x=\"Union {(Yf i Int insert Tick (Ev ` snd (PXf i))) |i. i : I2}\" in exI)\n apply (simp add: Union_snd_Un)\n apply (rule conjI)\n  apply (simp add: cspF_Rep_parallel_ass_lm1[simplified])\n  apply (blast)\n\n apply (rule conjI)\n\n  (* I1 *)\n  apply (rule_tac x=\"Yf\" in exI)\n  apply (simp add: cspF_Rep_parallel_ass_lm1[simplified])\n\n  apply (intro ballI)\n  apply (drule_tac x=\"i\" in bspec, simp)\n  apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I1)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n  apply (force)\n\n  (* I2 *)\n  apply (rule_tac x=\"Yf\" in exI)\n  apply (simp add: cspF_Rep_parallel_ass_lm1[simplified])\n\n  apply (intro ballI)\n  apply (drule_tac x=\"i\" in bspec, simp)\n  apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I2)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n  apply (force)\n\n (* <= *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (simp add: in_failures_Rep_parallel)\n apply (elim exE conjE)\n apply (simp add: Union_snd_Un)\n apply (rename_tac s X Y Z Yf1 Yf2)\n\n apply (rule_tac x=\"(%i. if i:I1 then Yf1 i else Yf2 i)\" in exI)\n       (* the necessity of the condition \"I1 Int I2 = {}\" *)\n apply (simp add: cspF_Rep_parallel_ass_lm2)\n\n apply (intro ballI)\n apply (simp)\n apply (erule disjE)\n\n  apply (drule_tac x=\"i\" in bspec, simp, simp)\n  apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I1)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n  apply (force)\n\n  apply (drule_tac x=\"i\" in bspec, simp)\n  apply (case_tac \"i ~: I1\")\n  apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I2)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n  apply (force)\n  apply (blast)\ndone\n\n(************************************\n |             induct               |\n ************************************)\n\n(*------------------*\n |     csp law      |\n |   (derivable)    |\n *------------------*)\n\nlemma cspF_Rep_parallel_induct:\n \"[| finite I ; i ~: I |] ==>\n  [||]:(insert i I) PXf =F[M,M]\n  fst (PXf i) |[snd (PXf i), Union (snd ` PXf ` I)]| [||]:I PXf\"\napply (insert cspF_Rep_parallel_assoc[of \"{i}\" I PXf M])\napply (simp add: Rep_parallel_one)\napply (rule cspF_rw_left)\napply (simp)\n\napply (insert cspF_Alpha_parallel_assoc\n  [of \"fst (PXf i)\" \"snd (PXf i)\" \"{}\" \"SKIP\" \"Union (snd ` PXf ` I)\" \"[||]:I PXf\" M])\napply (rule cspF_trans)\napply (simp)\n\napply (rule cspF_decompo_Alpha_parallel)\napply (simp_all)\n(* Isabelle 2017 *)\napply (simp add: cspF_SKIP_Rep_parallel[simplified])\ndone\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(*\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\nend\n\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_law_rep_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878414043814, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.34104804141499295}}
{"text": "section \\<open>Auxiliary material\\<close>\ntheory Prime_Number_Theorem_Library\nimports\n  Zeta_Function.Zeta_Function\n  \"HOL-Real_Asymp.Real_Asymp\"\nbegin\n\ntext \\<open>Conflicting notation from \\<^theory>\\<open>HOL-Analysis.Infinite_Sum\\<close>\\<close>\nno_notation Infinite_Sum.abs_summable_on (infixr \"abs'_summable'_on\" 46)\n\nlemma homotopic_loopsI:\n  fixes h :: \"real \\<times> real \\<Rightarrow> _\"\n  assumes \"continuous_on ({0..1} \\<times> {0..1}) h\"\n          \"h ` ({0..1} \\<times> {0..1}) \\<subseteq> s\"\n          \"\\<And>x. x \\<in> {0..1} \\<Longrightarrow> h (0, x) = p x\"\n          \"\\<And>x. x \\<in> {0..1} \\<Longrightarrow> h (1, x) = q x\"\n          \"\\<And>x. x \\<in> {0..1} \\<Longrightarrow> pathfinish (h \\<circ> Pair x) = pathstart (h \\<circ> Pair x)\"\n  shows   \"homotopic_loops s p q\"\n  using assms unfolding homotopic_loops by (intro exI[of _ h]) auto\n\nlemma homotopic_pathsI:\n  fixes h :: \"real \\<times> real \\<Rightarrow> _\"\n  assumes \"continuous_on ({0..1} \\<times> {0..1}) h\"\n  assumes \"h ` ({0..1} \\<times> {0..1}) \\<subseteq> s\"\n  assumes \"\\<And>x. x \\<in> {0..1} \\<Longrightarrow> h (0, x) = p x\"\n  assumes \"\\<And>x. x \\<in> {0..1} \\<Longrightarrow> h (1, x) = q x\"\n  assumes \"\\<And>x. x \\<in> {0..1} \\<Longrightarrow> pathstart (h \\<circ> Pair x) = pathstart p\"\n  assumes \"\\<And>x. x \\<in> {0..1} \\<Longrightarrow> pathfinish (h \\<circ> Pair x) = pathfinish p\"\n  shows   \"homotopic_paths s p q\"\n  using assms unfolding homotopic_paths by (intro exI[of _ h]) auto\n\nlemma sum_upto_ln_conv_sum_upto_mangoldt:\n  \"sum_upto (\\<lambda>n. ln (real n)) x = sum_upto (\\<lambda>n. mangoldt n * nat \\<lfloor>x / real n\\<rfloor>) x\"\nproof -\n  have \"sum_upto (\\<lambda>n. ln (real n)) x =\n          sum_upto (\\<lambda>n. \\<Sum>d | d dvd n. mangoldt d) x\"\n    by (intro sum_upto_cong) (simp_all add: mangoldt_sum)\n  also have \"\\<dots> = sum_upto (\\<lambda>k. sum_upto (\\<lambda>d. mangoldt k) (x / real k)) x\"\n    by (rule sum_upto_sum_divisors)\n  also have \"\\<dots> = sum_upto (\\<lambda>n. mangoldt n * nat \\<lfloor>x / real n\\<rfloor>) x\"\n    unfolding sum_upto_altdef by (simp add: mult_ac)\n  finally show ?thesis .\nqed\n\nlemma ln_fact_conv_sum_upto_mangoldt:\n  \"ln (fact n) = sum_upto (\\<lambda>k. mangoldt k * (n div k)) n\"\nproof -\n  have [simp]: \"{0<..Suc n} = insert (Suc n) {0<..n}\" for n by auto\n  have \"ln (fact n) = sum_upto (\\<lambda>n. ln (real n)) n\"\n    by (induction n) (auto simp: sum_upto_altdef nat_add_distrib ln_mult)\n  also have \"\\<dots> = sum_upto (\\<lambda>k. mangoldt k * (n div k)) n\"\n    unfolding sum_upto_ln_conv_sum_upto_mangoldt\n    by (intro sum_upto_cong) (auto simp: floor_divide_of_nat_eq)\n  finally show ?thesis .\nqed\n\nlemma fds_abs_converges_comparison_test:\n  fixes s :: \"'a :: dirichlet_series\"\n  assumes \"eventually (\\<lambda>n. norm (fds_nth f n) \\<le> fds_nth g n) at_top\" and \"fds_converges g (s \\<bullet> 1)\"\n  shows   \"fds_abs_converges f s\"\n  unfolding fds_abs_converges_def\nproof (rule summable_comparison_test_ev)\n  from assms(2) show \"summable (\\<lambda>n. fds_nth g n / n powr (s \\<bullet> 1))\"\n    by (auto simp: fds_converges_def)\n  from assms(1) eventually_gt_at_top[of 0]\n    show \"eventually (\\<lambda>n. norm (norm (fds_nth f n / nat_power n s)) \\<le>\n                            fds_nth g n / real n powr (s \\<bullet> 1)) at_top\"\n    by eventually_elim (auto simp: norm_divide norm_nat_power intro!: divide_right_mono)\nqed\n\nlemma fds_converges_scaleR [intro]:\n  assumes \"fds_converges f s\"\n  shows   \"fds_converges (c *\\<^sub>R f) s\"\nproof -\n  from assms have \"summable (\\<lambda>n. c *\\<^sub>R (fds_nth f n / nat_power n s))\"\n    by (intro summable_scaleR_right) (auto simp: fds_converges_def)\n  also have \"(\\<lambda>n. c *\\<^sub>R (fds_nth f n / nat_power n s)) = (\\<lambda>n. (c *\\<^sub>R fds_nth f n / nat_power n s))\"\n    by (simp add: scaleR_conv_of_real)\n  finally show ?thesis by (simp add: fds_converges_def)\nqed\n\nlemma fds_abs_converges_scaleR [intro]:\n  assumes \"fds_abs_converges f s\"\n  shows   \"fds_abs_converges (c *\\<^sub>R f) s\"\nproof -\n  from assms have \"summable (\\<lambda>n. abs c * norm (fds_nth f n / nat_power n s))\"\n    by (intro summable_mult) (auto simp: fds_abs_converges_def)\n  also have \"(\\<lambda>n. abs c * norm (fds_nth f n / nat_power n s)) =\n               (\\<lambda>n. norm ((c *\\<^sub>R fds_nth f n) / nat_power n s))\" by (simp add: norm_divide)\n  finally show ?thesis by (simp add: fds_abs_converges_def)\nqed\n\nlemma conv_abscissa_scaleR: \"conv_abscissa (scaleR c f) \\<le> conv_abscissa f\"\n  by (rule conv_abscissa_mono) auto\n\nlemma abs_conv_abscissa_scaleR: \"abs_conv_abscissa (scaleR c f) \\<le> abs_conv_abscissa f\"\n  by (rule abs_conv_abscissa_mono) auto\n\nlemma fds_abs_converges_mult_const_left [intro]:\n  \"fds_abs_converges f s \\<Longrightarrow> fds_abs_converges (fds_const c * f) s\"\n  by (auto simp: fds_abs_converges_def norm_mult norm_divide dest: summable_mult[of _ \"norm c\"])\n\nlemma conv_abscissa_mult_const_left:\n  \"conv_abscissa (fds_const c * f) \\<le> conv_abscissa f\"\n  by (intro conv_abscissa_mono) auto\n\nlemma abs_conv_abscissa_mult_const_left:\n  \"abs_conv_abscissa (fds_const c * f) \\<le> abs_conv_abscissa f\"\n  by (intro abs_conv_abscissa_mono) auto\n\nlemma fds_abs_converges_mult_const_right [intro]:\n  \"fds_abs_converges f s \\<Longrightarrow> fds_abs_converges (f * fds_const c) s\"\n  by (metis mult.commute fds_abs_converges_mult_const_left)\n\n\n\nlemma abs_conv_abscissa_mult_const_right:\n  \"abs_conv_abscissa (f * fds_const c) \\<le> abs_conv_abscissa f\"\n  by (intro abs_conv_abscissa_mono) auto\n\n\nlemma bounded_coeffs_imp_fds_abs_converges:\n  fixes s :: \"'a :: dirichlet_series\" and f :: \"'a fds\"\n  assumes \"Bseq (fds_nth f)\" \"s \\<bullet> 1 > 1\"\n  shows   \"fds_abs_converges f s\"\nproof -\n  from assms obtain C where C: \"\\<And>n. norm (fds_nth f n) \\<le> C\"\n    by (auto simp: Bseq_def)\n  show ?thesis\n  proof (rule fds_abs_converges_comparison_test)\n    from \\<open>s \\<bullet> 1 > 1\\<close> show \"fds_converges (C *\\<^sub>R fds_zeta) (s \\<bullet> 1)\"\n      by (intro fds_abs_converges_imp_converges) auto\n    from C show \"eventually (\\<lambda>n. norm (fds_nth f n) \\<le> fds_nth (C *\\<^sub>R fds_zeta) n) at_top\"\n      by (intro always_eventually) (auto simp: fds_nth_zeta)\n  qed\nqed\n\nlemma bounded_coeffs_imp_fds_abs_converges':\n  fixes s :: \"'a :: dirichlet_series\" and f :: \"'a fds\"\n  assumes \"Bseq (\\<lambda>n. fds_nth f n * nat_power n s0)\" \"s \\<bullet> 1 > 1 - s0 \\<bullet> 1\"\n  shows   \"fds_abs_converges f s\"\nproof -\n  have \"fds_nth (fds_shift s0 f) = (\\<lambda>n. fds_nth f n * nat_power n s0)\"\n    by (auto simp: fun_eq_iff)\n  with assms have \"Bseq (fds_nth (fds_shift s0 f))\" by simp\n  with assms(2) have \"fds_abs_converges (fds_shift s0 f) (s + s0)\"\n    by (intro bounded_coeffs_imp_fds_abs_converges) (auto simp: algebra_simps)\n  thus ?thesis by simp\nqed\n\nlemma bounded_coeffs_imp_abs_conv_abscissa_le:\n  fixes s :: \"'a :: dirichlet_series\" and f :: \"'a fds\" and c :: ereal\n  assumes \"Bseq (\\<lambda>n. fds_nth f n * nat_power n s)\" \"1 - s \\<bullet> 1 \\<le> c\"\n  shows   \"abs_conv_abscissa f \\<le> c\"\nproof (rule abs_conv_abscissa_leI_weak)\n  fix x assume \"c < ereal x\"\n  have \"ereal (1 - s \\<bullet> 1) \\<le> c\" by fact\n  also have \"\\<dots> < ereal x\" by fact\n  finally have \"1 - s \\<bullet> 1 < ereal x\" by simp\n  thus \"fds_abs_converges f (of_real x)\"\n    by (intro bounded_coeffs_imp_fds_abs_converges'[OF assms(1)]) auto\nqed\n\nlemma bounded_coeffs_imp_abs_conv_abscissa_le_1:\n  fixes s :: \"'a :: dirichlet_series\" and f :: \"'a fds\"\n  assumes \"Bseq (\\<lambda>n. fds_nth f n)\"\n  shows   \"abs_conv_abscissa f \\<le> 1\"\nproof -\n  have [simp]: \"fds_nth f n * nat_power n 0 = fds_nth f n\" for n\n    by (cases \"n = 0\") auto\n  show ?thesis\n    by (rule bounded_coeffs_imp_abs_conv_abscissa_le[where s = 0]) (insert assms, auto simp:)\nqed\n\n(* EXAMPLE: This might make a good example to illustrate real_asymp *)\nlemma\n  fixes a b c :: real\n  assumes ab: \"a + b > 0\" and c: \"c < -1\"\n  shows set_integrable_powr_at_top: \"(\\<lambda>x. (b + x) powr c) absolutely_integrable_on {a<..}\"\n  and   set_lebesgue_integral_powr_at_top:\n          \"(\\<integral>x\\<in>{a<..}. ((b + x) powr c) \\<partial>lborel) = -((b + a) powr (c + 1) / (c + 1))\"\n  and   powr_has_integral_at_top:\n          \"((\\<lambda>x. (b + x) powr c) has_integral -((b + a) powr (c + 1) / (c + 1))) {a<..}\"\nproof -\n  let ?f = \"\\<lambda>x. (b + x) powr c\" and ?F = \"\\<lambda>x. (b + x) powr (c + 1) / (c + 1)\"\n  have limits: \"((?F \\<circ> real_of_ereal) \\<longlongrightarrow> ?F a) (at_right (ereal a))\"\n               \"((?F \\<circ> real_of_ereal) \\<longlongrightarrow> 0) (at_left \\<infinity>)\"\n    using c ab unfolding ereal_tendsto_simps1 by (real_asymp simp: field_simps)+\n  have 1: \"set_integrable lborel (einterval a \\<infinity>) ?f\" using ab c limits\n    by (intro interval_integral_FTC_nonneg) (auto intro!: derivative_eq_intros)\n  thus 2: \"?f absolutely_integrable_on {a<..}\"\n    by (auto simp: set_integrable_def integrable_completion)\n  have \"LBINT x=ereal a..\\<infinity>. (b + x) powr c = 0 - ?F a\" using ab c limits\n    by (intro interval_integral_FTC_nonneg) (auto intro!: derivative_eq_intros)\n  thus 3: \"(\\<integral>x\\<in>{a<..}. ((b + x) powr c) \\<partial>lborel) = -((b + a) powr (c + 1) / (c + 1))\"\n    by (simp add: interval_integral_to_infinity_eq)\n  show \"(?f has_integral -((b + a) powr (c + 1) / (c + 1))) {a<..}\"\n    using set_borel_integral_eq_integral[OF 1] 3 by (simp add: has_integral_iff)\nqed\n\nlemma fds_converges_altdef2:\n  \"fds_converges f s \\<longleftrightarrow> convergent (\\<lambda>N. eval_fds (fds_truncate N f) s)\"\n  unfolding fds_converges_def summable_iff_convergent' eval_fds_truncate\n  by (auto simp: not_le intro!: convergent_cong always_eventually sum.mono_neutral_right)\n\nlemma tendsto_eval_fds_truncate:\n  assumes \"fds_converges f s\"\n  shows   \"(\\<lambda>N. eval_fds (fds_truncate N f) s) \\<longlonglongrightarrow> eval_fds f s\"\nproof -\n  have \"(\\<lambda>N. eval_fds (fds_truncate N f) s) \\<longlonglongrightarrow> eval_fds f s \\<longleftrightarrow>\n          (\\<lambda>N. \\<Sum>i\\<le>N. fds_nth f i / nat_power i s) \\<longlonglongrightarrow> eval_fds f s\"\n    unfolding eval_fds_truncate\n    by (intro filterlim_cong always_eventually allI sum.mono_neutral_left) (auto simp: not_le)\n  also have \\<dots> using assms\n    by (simp add: fds_converges_iff sums_def' atLeast0AtMost)\n  finally show ?thesis .\nqed\n\nlemma linepath_translate_left: \"linepath (c + a) (c + a) = (\\<lambda>x. c + a) \\<circ> linepath a b\"\n  by auto\n\nlemma linepath_translate_right: \"linepath (a + c) (b + c) = (\\<lambda>x. x + c) \\<circ> linepath a b\"\n  by (auto simp: fun_eq_iff linepath_def algebra_simps)\n\n\n\nlemma contour_integrable_linepath_same_Im_iff:\n  fixes a b :: complex and f :: \"complex \\<Rightarrow> complex\"\n  assumes \"Im a = Im b\" \"Re a < Re b\"\n  shows   \"(f contour_integrable_on linepath a b) \\<longleftrightarrow>\n             (\\<lambda>x. f (of_real x + Im a * \\<i>)) integrable_on {Re a..Re b}\"\n  using contour_integrable_on_def has_contour_integral_linepath_same_Im_iff[OF assms] by blast\n\nlemma contour_integral_linepath_same_Im:\n  fixes a b :: complex and f :: \"complex \\<Rightarrow> complex\"\n  assumes \"Im a = Im b\" \"Re a < Re b\"\n  shows   \"contour_integral (linepath a b) f = integral {Re a..Re b} (\\<lambda>x. f (x + Im a * \\<i>))\"\nproof (cases \"f contour_integrable_on linepath a b\")\n  case True\n  thus ?thesis using has_contour_integral_linepath_same_Im_iff[OF assms, of f]\n    using has_contour_integral_integral has_contour_integral_unique by blast\nnext\n  case False\n  thus ?thesis using contour_integrable_linepath_same_Im_iff[OF assms, of f]\n    by (simp add: not_integrable_contour_integral not_integrable_integral)\nqed\n\n\nlemmas [simp del] = div_mult_self3 div_mult_self4 div_mult_self2 div_mult_self1\n\ninterpretation cis: periodic_fun_simple cis \"2 * pi\"\n  by standard (simp_all add: complex_eq_iff)\n\nlemma analytic_onE_box:\n  assumes \"f analytic_on A\" \"s \\<in> A\"\n  obtains a b where \"Re a < Re b\" \"Im a < Im b\" \"s \\<in> box a b\" \"f analytic_on box a b\"\nproof -\n  from assms obtain r where r: \"r > 0\" \"f holomorphic_on ball s r\"\n    by (auto simp: analytic_on_def)\n  with open_contains_box[of \"ball s r\" s] obtain a b\n    where \"box a b \\<subseteq> ball s r\" \"s \\<in> box a b\" \"\\<forall>i\\<in>Basis. a \\<bullet> i < b \\<bullet> i\" by auto\n  moreover from r have \"f analytic_on ball s r\" by (simp add: analytic_on_open)\n  ultimately show ?thesis using that[of a b] analytic_on_subset[of _ \"ball s r\" \"box a b\"]\n    by (auto simp: Basis_complex_def)\nqed\n\nlemma Re_image_box:\n  assumes \"Re a < Re b\" \"Im a < Im b\"\n  shows   \"Re ` box a b = {Re a<..<Re b}\"\n  using inner_image_box[of \"1::complex\" a b] assms by (auto simp: Basis_complex_def)\n\nlemma Im_image_box:\n  assumes \"Re a < Re b\" \"Im a < Im b\"\n  shows   \"Im ` box a b = {Im a<..<Im b}\"\n  using inner_image_box[of \"\\<i>::complex\" a b] assms by (auto simp: Basis_complex_def)\n\nlemma Re_image_cbox:\n  assumes \"Re a \\<le> Re b\" \"Im a \\<le> Im b\"\n  shows   \"Re ` cbox a b = {Re a..Re b}\"\n  using inner_image_cbox[of \"1::complex\" a b] assms by (auto simp: Basis_complex_def)\n\nlemma Im_image_cbox:\n  assumes \"Re a \\<le> Re b\" \"Im a \\<le> Im b\"\n  shows   \"Im ` cbox a b = {Im a..Im b}\"\n  using inner_image_cbox[of \"\\<i>::complex\" a b] assms by (auto simp: Basis_complex_def)\n\nlemma analytic_onE_cball:\n  assumes \"f analytic_on A\" \"s \\<in> A\" \"ub > (0::real)\"\n  obtains R where \"R > 0\" \"R < ub\" \"f analytic_on cball s R\"\nproof -\n  from assms obtain r where \"r > 0\" \"f holomorphic_on ball s r\"\n    by (auto simp: analytic_on_def)\n  hence \"f analytic_on ball s r\" by (simp add: analytic_on_open)\n  hence \"f analytic_on cball s (min (ub / 2) (r / 2))\"\n    by (rule analytic_on_subset, subst cball_subset_ball_iff) (use \\<open>r > 0\\<close> in auto)\n  moreover have \"min (ub / 2) (r / 2) > 0\" and \"min (ub / 2) (r / 2) < ub\"\n    using \\<open>r > 0\\<close> and \\<open>ub > 0\\<close> by (auto simp: min_def)\n  ultimately show ?thesis using that[of \"min (ub / 2) (r / 2)\"]\n    by blast\nqed\n\n\ncorollary analytic_pre_zeta' [analytic_intros]:\n  assumes \"f analytic_on A\" \"a > 0\"\n  shows   \"(\\<lambda>x. pre_zeta a (f x)) analytic_on A\"\n  using analytic_on_compose_gen[OF assms(1) analytic_pre_zeta[of a UNIV]] assms(2)\n  by (auto simp: o_def)\n\ncorollary analytic_hurwitz_zeta' [analytic_intros]:\n  assumes \"f analytic_on A\" \"(\\<And>x. x \\<in> A \\<Longrightarrow> f x \\<noteq> 1)\" \"a > 0\"\n  shows   \"(\\<lambda>x. hurwitz_zeta a (f x)) analytic_on A\"\n  using analytic_on_compose_gen[OF assms(1) analytic_hurwitz_zeta[of a \"-{1}\"]] assms(2,3)\n  by (auto simp: o_def)\n\ncorollary analytic_zeta' [analytic_intros]:\n  assumes \"f analytic_on A\" \"(\\<And>x. x \\<in> A \\<Longrightarrow> f x \\<noteq> 1)\"\n  shows   \"(\\<lambda>x. zeta (f x)) analytic_on A\"\n  using analytic_on_compose_gen[OF assms(1) analytic_zeta[of \"-{1}\"]] assms(2)\n  by (auto simp: o_def)\n\n\nlemma logderiv_zeta_analytic: \"(\\<lambda>s. deriv zeta s / zeta s) analytic_on {s. Re s \\<ge> 1} - {1}\"\n  using zeta_Re_ge_1_nonzero by (auto intro!: analytic_intros)\n\nlemma mult_real_sqrt: \"x \\<ge> 0 \\<Longrightarrow> x * sqrt y = sqrt (x ^ 2 * y)\"\n  by (simp add: real_sqrt_mult)\n\nlemma arcsin_pos: \"x \\<in> {0<..1} \\<Longrightarrow> arcsin x > 0\"\n  using arcsin_less_arcsin[of 0 x] by simp\n\nlemmas analytic_imp_holomorphic' = holomorphic_on_subset[OF analytic_imp_holomorphic]\n\nlemma residue_simple':\n  assumes \"open s\" \"0 \\<in> s\" \"f holomorphic_on s\"\n  shows   \"residue (\\<lambda>w. f w / w) 0 = f 0\"\n  using residue_simple[of s 0 f] assms by simp\n\n\nlemma fds_converges_cong:\n  assumes \"eventually (\\<lambda>n. fds_nth f n = fds_nth g n) at_top\" \"s = s'\"\n  shows   \"fds_converges f s \\<longleftrightarrow> fds_converges g s'\"\n  unfolding fds_converges_def\n  by (intro summable_cong eventually_mono[OF assms(1)]) (simp_all add: assms)\n\nlemma fds_abs_converges_cong:\n  assumes \"eventually (\\<lambda>n. fds_nth f n = fds_nth g n) at_top\" \"s = s'\"\n  shows   \"fds_abs_converges f s \\<longleftrightarrow> fds_abs_converges g s'\"\n  unfolding fds_abs_converges_def\n  by (intro summable_cong eventually_mono[OF assms(1)]) (simp_all add: assms)\n\nlemma conv_abscissa_cong:\n  assumes \"eventually (\\<lambda>n. fds_nth f n = fds_nth g n) at_top\"\n  shows   \"conv_abscissa f = conv_abscissa g\"\nproof -\n  have \"fds_converges f = fds_converges g\"\n    by (intro ext fds_converges_cong assms refl)\n  thus ?thesis by (simp add: conv_abscissa_def)\nqed\n\nlemma abs_conv_abscissa_cong:\n  assumes \"eventually (\\<lambda>n. fds_nth f n = fds_nth g n) at_top\"\n  shows   \"abs_conv_abscissa f = abs_conv_abscissa g\"\nproof -\n  have \"fds_abs_converges f = fds_abs_converges g\"\n    by (intro ext fds_abs_converges_cong assms refl)\n  thus ?thesis by (simp add: abs_conv_abscissa_def)\nqed\n\n\ndefinition fds_remainder where\n  \"fds_remainder m = fds_subseries (\\<lambda>n. n > m)\"\n\nlemma fds_nth_remainder: \"fds_nth (fds_remainder m f) = (\\<lambda>n. if n > m then fds_nth f n else 0)\"\n  by (simp add: fds_remainder_def fds_subseries_def fds_nth_fds')\n\nlemma fds_converges_remainder_iff [simp]:\n  \"fds_converges (fds_remainder m f) s \\<longleftrightarrow> fds_converges f s\"\n  by (intro fds_converges_cong eventually_mono[OF eventually_gt_at_top[of m]])\n     (auto simp: fds_nth_remainder)\n\nlemma fds_abs_converges_remainder_iff [simp]:\n  \"fds_abs_converges (fds_remainder m f) s \\<longleftrightarrow> fds_abs_converges f s\"\n  by (intro fds_abs_converges_cong eventually_mono[OF eventually_gt_at_top[of m]])\n     (auto simp: fds_nth_remainder)\n\nlemma fds_converges_remainder [intro]:\n        \"fds_converges f s \\<Longrightarrow> fds_converges (fds_remainder m f) s\"\n  and fds_abs_converges_remainder [intro]:\n        \"fds_abs_converges f s \\<Longrightarrow> fds_abs_converges (fds_remainder m f) s\"\n  by simp_all\n\nlemma conv_abscissa_remainder [simp]:\n  \"conv_abscissa (fds_remainder m f) = conv_abscissa f\"\n  by (intro conv_abscissa_cong eventually_mono[OF eventually_gt_at_top[of m]])\n     (auto simp: fds_nth_remainder)\n\nlemma abs_conv_abscissa_remainder [simp]:\n  \"abs_conv_abscissa (fds_remainder m f) = abs_conv_abscissa f\"\n  by (intro abs_conv_abscissa_cong eventually_mono[OF eventually_gt_at_top[of m]])\n     (auto simp: fds_nth_remainder)\n\nlemma eval_fds_remainder:\n   \"eval_fds (fds_remainder m f) s = (\\<Sum>n. fds_nth f (n + Suc m) / nat_power (n + Suc m) s)\"\n    (is \"_ = suminf (\\<lambda>n. ?f (n + Suc m))\")\nproof (cases \"fds_converges f s\")\n  case False\n  hence \"\\<not>fds_converges (fds_remainder m f) s\" by simp\n  hence \"(\\<lambda>x. (\\<lambda>n. fds_nth (fds_remainder m f) n / nat_power n s) sums x) = (\\<lambda>_. False)\"\n    by (auto simp: fds_converges_def summable_def)\n  hence \"eval_fds (fds_remainder m f) s = (THE _. False)\"\n    by (simp add: eval_fds_def suminf_def)\n  moreover from False have \"\\<not>summable (\\<lambda>n. ?f (n + Suc m))\" unfolding fds_converges_def\n    by (subst summable_iff_shift) auto\n  hence \"(\\<lambda>x. (\\<lambda>n. ?f (n + Suc m)) sums x) = (\\<lambda>_. False)\"\n    by (auto simp: summable_def)\n  hence \"suminf (\\<lambda>n. ?f (n + Suc m)) = (THE _. False)\"\n    by (simp add: suminf_def)\n  ultimately show ?thesis by simp\nnext\n  case True\n  hence *: \"fds_converges (fds_remainder m f) s\" by simp\n  have \"eval_fds (fds_remainder m f) s = (\\<Sum>n. fds_nth (fds_remainder m f) n / nat_power n s)\"\n    unfolding eval_fds_def ..\n  also have \"\\<dots> = (\\<Sum>n. fds_nth (fds_remainder m f) (n + Suc m) / nat_power (n + Suc m) s)\"\n    using * unfolding fds_converges_def\n    by (subst suminf_minus_initial_segment) (auto simp: fds_nth_remainder)\n  also have \"(\\<lambda>n. fds_nth (fds_remainder m f) (n + Suc m)) = (\\<lambda>n. fds_nth f (n + Suc m))\"\n    by (intro ext) (auto simp: fds_nth_remainder)\n  finally show ?thesis .\nqed\n\nlemma fds_truncate_plus_remainder: \"fds_truncate m f + fds_remainder m f = f\"\n  by (intro fds_eqI) (auto simp: fds_truncate_def fds_remainder_def fds_subseries_def)\n\n\nlemma holomorphic_fds_eval' [holomorphic_intros]:\n  assumes \"g holomorphic_on A\" \"\\<And>x. x \\<in> A \\<Longrightarrow> Re (g x) > conv_abscissa f\"\n  shows   \"(\\<lambda>x. eval_fds f (g x)) holomorphic_on A\"\n  using holomorphic_on_compose_gen[OF assms(1) holomorphic_fds_eval[OF order.refl, of f]] assms(2)\n  by (auto simp: o_def)\n\nlemma analytic_fds_eval' [analytic_intros]:\n  assumes \"g analytic_on A\" \"\\<And>x. x \\<in> A \\<Longrightarrow> Re (g x) > conv_abscissa f\"\n  shows   \"(\\<lambda>x. eval_fds f (g x)) analytic_on A\"\n  using analytic_on_compose_gen[OF assms(1) analytic_fds_eval[OF order.refl, of f]] assms(2)\n  by (auto simp: o_def)\n\nlemma continuous_on_linepath [continuous_intros]:\n  assumes \"continuous_on A a\" \"continuous_on A b\" \"continuous_on A f\"\n  shows   \"continuous_on A (\\<lambda>x. linepath (a x) (b x) (f x))\"\n  using assms by (auto simp: linepath_def intro!: continuous_intros assms)\n\nlemma continuous_on_part_circlepath [continuous_intros]:\n  assumes \"continuous_on A c\" \"continuous_on A r\" \"continuous_on A a\" \"continuous_on A b\"\n          \"continuous_on A f\"\n  shows   \"continuous_on A (\\<lambda>x. part_circlepath (c x) (r x) (a x) (b x) (f x))\"\n  using assms by (auto simp: part_circlepath_def intro!: continuous_intros assms)\n\nlemma homotopic_loops_part_circlepath:\n  assumes \"sphere c r \\<subseteq> A\" and \"r \\<ge> 0\" and\n          \"b1 = a1 + 2 * of_int k * pi\" and \"b2 = a2 + 2 * of_int k * pi\"\n  shows   \"homotopic_loops A (part_circlepath c r a1 b1) (part_circlepath c r a2 b2)\"\nproof -\n  define h where \"h = (\\<lambda>(x,y). part_circlepath c r (linepath a1 a2 x) (linepath b1 b2 x) y)\"\n  show ?thesis\n  proof (rule homotopic_loopsI)\n    show \"continuous_on ({0..1} \\<times> {0..1}) h\"\n      by (auto simp: h_def case_prod_unfold intro!: continuous_intros)\n  next\n    from assms have \"h ` ({0..1} \\<times> {0..1}) \\<subseteq> sphere c r\"\n      by (auto simp: h_def part_circlepath_def dist_norm norm_mult)\n    also have \"\\<dots> \\<subseteq> A\" by fact\n    finally show \"h ` ({0..1} \\<times> {0..1}) \\<subseteq> A\" .\n  next\n    fix x :: real assume x: \"x \\<in> {0..1}\"\n    show \"h (0, x) = part_circlepath c r a1 b1 x\" and \"h (1, x) = part_circlepath c r a2 b2 x\"\n      by (simp_all add: h_def linepath_def)\n    have \"cis (pi * (real_of_int k * 2)) = 1\"\n      using cis.plus_of_int[of 0 k] by (simp add: algebra_simps)\n    thus \"pathfinish (h \\<circ> Pair x) = pathstart (h \\<circ> Pair x)\"\n      by (simp add: h_def o_def exp_eq_polar linepath_def algebra_simps\n                    cis_mult [symmetric] cis_divide [symmetric] assms)\n  qed\nqed\n\nlemma part_circlepath_conv_subpath:\n  \"part_circlepath c r a b = subpath (a / (2*pi)) (b / (2*pi)) (circlepath c r)\"\n  by (simp add: part_circlepath_def circlepath_def subpath_def linepath_def algebra_simps exp_eq_polar)\n\nlemma homotopic_paths_part_circlepath:\n  assumes \"a \\<le> b\" \"b \\<le> c\"\n  assumes \"path_image (part_circlepath C r a c) \\<subseteq> A\" \"r \\<ge> 0\"\n  shows   \"homotopic_paths A (part_circlepath C r a c)\n             (part_circlepath C r a b +++ part_circlepath C r b c)\"\n  (is \"homotopic_paths _ ?g (?h1 +++ ?h2)\")\nproof (cases \"a = c\")\n  case False\n  with assms have \"a < c\" by simp\n  define slope where \"slope = (b - a) / (c - a)\"\n  from assms and \\<open>a < c\\<close> have slope: \"slope \\<in> {0..1}\"\n    by (auto simp: field_simps slope_def)\n  define f :: \"real \\<Rightarrow> real\" where\n    \"f = linepath 0 slope +++ linepath slope 1\"\n\n  show ?thesis\n  proof (rule homotopic_paths_reparametrize)\n    fix t :: real assume t: \"t \\<in> {0..1}\"\n    show \"(?h1 +++ ?h2) t = ?g (f t)\"\n    proof (cases \"t \\<le> 1 / 2\")\n      case True\n      hence \"?g (f t) = C + r * cis ((1 - f t) * a + f t * c)\"\n        by (simp add: joinpaths_def part_circlepath_def exp_eq_polar linepath_def)\n      also from True \\<open>a < c\\<close> have \"(1 - f t) * a + f t * c = (1 - 2 * t) * a + 2 * t * b\"\n        unfolding f_def slope_def linepath_def joinpaths_def\n        by (simp add: divide_simps del: div_mult_self3 div_mult_self4 div_mult_self2 div_mult_self1)\n           (simp add: algebra_simps)?\n      also from True have \"C + r * cis \\<dots> = (?h1 +++ ?h2) t\"\n        by (simp add: joinpaths_def part_circlepath_def exp_eq_polar linepath_def)\n      finally show ?thesis ..\n    next\n      case False\n      hence \"?g (f t) = C + r * cis ((1 - f t) * a + f t * c)\"\n        by (simp add: joinpaths_def part_circlepath_def exp_eq_polar linepath_def)\n      also from False \\<open>a < c\\<close> have \"(1 - f t) * a + f t * c = (2 - 2 * t) * b + (2 * t - 1) * c\"\n        unfolding f_def slope_def linepath_def joinpaths_def\n        by (simp add: divide_simps del: div_mult_self3 div_mult_self4 div_mult_self2 div_mult_self1)\n           (simp add: algebra_simps)?\n      also from False have \"C + r * cis \\<dots> = (?h1 +++ ?h2) t\"\n        by (simp add: joinpaths_def part_circlepath_def exp_eq_polar linepath_def)\n      finally show ?thesis ..\n    qed\n  next\n    from slope have \"path_image f \\<subseteq> {0..1}\"\n      by (auto simp: f_def path_image_join closed_segment_eq_real_ivl)\n    thus \"f ` {0..1} \\<subseteq> {0..1}\" by (simp add: path_image_def)\n  next\n    have \"path f\" unfolding f_def by auto\n    thus \"continuous_on {0..1} f\" by (simp add: path_def)\n  qed (insert assms, auto simp: f_def joinpaths_def linepath_def)\nnext\n  case [simp]: True\n  with assms have [simp]: \"b = c\" by auto\n  have \"part_circlepath C r c c +++ part_circlepath C r c c = part_circlepath C r c c\"\n    by (simp add: fun_eq_iff joinpaths_def part_circlepath_def)\n  thus ?thesis using assms by simp\nqed\n\nlemma path_image_part_circlepath_subset:\n  assumes \"a \\<le> a'\" \"a' \\<le> b'\" \"b' \\<le> b\"\n  shows   \"path_image (part_circlepath c r a' b') \\<subseteq> path_image (part_circlepath c r a b)\"\n  using assms by (subst (1 2) path_image_part_circlepath) auto\n\nlemma part_circlepath_mirror:\n  assumes \"a' = a + pi + 2 * pi * of_int k\" \"b' = b + pi + 2 * pi * of_int k\" \"c' = -c\"\n  shows   \"-part_circlepath c r a b = part_circlepath c' r a' b'\"\nproof\n  fix x :: real\n  have \"part_circlepath c' r a' b' x = c' + r * cis (linepath a b x + pi + k * (2 * pi))\"\n    by (simp add: part_circlepath_def exp_eq_polar assms linepath_translate_right mult_ac)\n  also have \"cis (linepath a b x + pi + k * (2 * pi)) = cis (linepath a b x + pi)\"\n    by (rule cis.plus_of_int)\n  also have \"\\<dots> = -cis (linepath a b x)\"\n    by (simp add: minus_cis)\n  also have \"c' + r * \\<dots> = -part_circlepath c r a b x\"\n    by (simp add: part_circlepath_def assms exp_eq_polar)\n  finally show \"(- part_circlepath c r a b) x = part_circlepath c' r a' b' x\"\n    by simp\nqed\n\nlemma path_mirror [intro]: \"path (g :: _ \\<Rightarrow> 'b::topological_group_add) \\<Longrightarrow> path (-g)\"\n  by (auto simp: path_def intro!: continuous_intros)\n\nlemma path_mirror_iff [simp]: \"path (-g :: _ \\<Rightarrow> 'b::topological_group_add) \\<longleftrightarrow> path g\"\n  using path_mirror[of g] path_mirror[of \"-g\"] by (auto simp: fun_Compl_def)\n\nlemma valid_path_mirror [intro]: \"valid_path g \\<Longrightarrow> valid_path (-g)\"\n  by (auto simp: valid_path_def fun_Compl_def piecewise_C1_differentiable_neg)\n\nlemma valid_path_mirror_iff [simp]: \"valid_path (-g) \\<longleftrightarrow> valid_path g\"\n  using valid_path_mirror[of g] valid_path_mirror[of \"-g\"] by (auto simp: fun_Compl_def)\n\nlemma pathstart_mirror [simp]: \"pathstart (-g) = -pathstart g\"\n  and pathfinish_mirror [simp]: \"pathfinish (-g) = -pathfinish g\"\n  by (simp_all add: pathstart_def pathfinish_def)\n\nlemma path_image_mirror: \"path_image (-g) = uminus ` path_image g\"\n  by (auto simp: path_image_def)\n\nlemma cos_le_zero:\n  assumes \"x \\<in> {pi/2..3*pi/2}\"\n  shows   \"cos x \\<le> 0\"\nproof -\n  have \"cos x = -cos (x - pi)\" by (simp add: cos_diff)\n  moreover from assms have \"cos (x - pi) \\<ge> 0\"\n    by (intro cos_ge_zero) auto\n  ultimately show ?thesis by simp\nqed\n\nlemma cos_le_zero': \"x \\<in> {-3*pi/2..-pi/2} \\<Longrightarrow> cos x \\<le> 0\"\n  using cos_le_zero[of \"-x\"] by simp\n\nlemma winding_number_join_pos_combined':\n     \"\\<lbrakk>valid_path \\<gamma>1 \\<and> z \\<notin> path_image \\<gamma>1 \\<and> 0 < Re (winding_number \\<gamma>1 z);\n       valid_path \\<gamma>2 \\<and> z \\<notin> path_image \\<gamma>2 \\<and> 0 < Re (winding_number \\<gamma>2 z);\n       pathfinish \\<gamma>1 = pathstart \\<gamma>2\\<rbrakk>\n      \\<Longrightarrow> valid_path(\\<gamma>1 +++ \\<gamma>2) \\<and> z \\<notin> path_image(\\<gamma>1 +++ \\<gamma>2) \\<and> 0 < Re(winding_number(\\<gamma>1 +++ \\<gamma>2) z)\"\n  by (simp add: valid_path_join path_image_join winding_number_join valid_path_imp_path)\n\nlemma Union_atLeastAtMost_real_of_nat:\n  assumes \"a < b\"\n  shows   \"(\\<Union>n\\<in>{a..<b}. {real n..real (n + 1)}) = {real a..real b}\"\nproof (intro equalityI subsetI)\n  fix x assume x: \"x \\<in> {real a..real b}\"\n  thus \"x \\<in> (\\<Union>n\\<in>{a..<b}. {real n..real (n + 1)})\"\n  proof (cases \"x = real b\")\n    case True\n    with assms show ?thesis by (auto intro!: bexI[of _ \"b - 1\"])\n  next\n    case False\n    with x have x: \"x \\<ge> real a\" \"x < real b\" by simp_all\n    hence \"x \\<ge> real (nat \\<lfloor>x\\<rfloor>)\" \"x \\<le> real (Suc (nat \\<lfloor>x\\<rfloor>))\" by linarith+\n    moreover from x have \"nat \\<lfloor>x\\<rfloor> \\<ge> a\" \"nat \\<lfloor>x\\<rfloor> < b\" by linarith+\n    ultimately show ?thesis by force\n  qed\nqed auto\n\nlemma nat_sum_has_integral_floor:\n  fixes f :: \"nat \\<Rightarrow> 'a :: banach\"\n  assumes mn: \"m < n\"\n  shows \"((\\<lambda>x. f (nat \\<lfloor>x\\<rfloor>)) has_integral sum f {m..<n}) {real m..real n}\"\nproof -\n  define D where \"D = (\\<lambda>i. {real i..real (Suc i)}) ` {m..<n}\"\n  have D: \"D division_of {m..n}\"\n    using Union_atLeastAtMost_real_of_nat[OF mn] by (simp add: division_of_def D_def)\n  have \"((\\<lambda>x. f (nat \\<lfloor>x\\<rfloor>)) has_integral (\\<Sum>X\\<in>D. f (nat \\<lfloor>Inf X\\<rfloor>))) {real m..real n}\"\n  proof (rule has_integral_combine_division)\n    fix X assume X: \"X \\<in> D\"\n    have \"nat \\<lfloor>x\\<rfloor> = nat \\<lfloor>Inf X\\<rfloor>\" if \"x \\<in> X - {Sup X}\" for x\n      using that X by (auto simp: D_def nat_eq_iff floor_eq_iff)\n    hence \"((\\<lambda>x. f (nat \\<lfloor>x\\<rfloor>)) has_integral f (nat \\<lfloor>Inf X\\<rfloor>)) X \\<longleftrightarrow>\n           ((\\<lambda>x. f (nat \\<lfloor>Inf X\\<rfloor>)) has_integral f (nat \\<lfloor>Inf X\\<rfloor>)) X\" using X\n      by (intro has_integral_spike_eq[of \"{Sup X}\"]) auto\n    also from X have \"\\<dots>\" using has_integral_const_real[of \"f (nat \\<lfloor>Inf X\\<rfloor>)\" \"Inf X\" \"Sup X\"]\n      by (auto simp: D_def)\n    finally show \"((\\<lambda>x. f (nat \\<lfloor>x\\<rfloor>)) has_integral f (nat \\<lfloor>Inf X\\<rfloor>)) X\" .\n  qed fact+\n  also have \"(\\<Sum>X\\<in>D. f (nat \\<lfloor>Inf X\\<rfloor>)) = (\\<Sum>k\\<in>{m..<n}. f k)\"\n    unfolding D_def by (subst sum.reindex) (auto simp: inj_on_def nat_add_distrib)\n  finally show ?thesis .\nqed\n\nlemma nat_sum_has_integral_ceiling:\n  fixes f :: \"nat \\<Rightarrow> 'a :: banach\"\n  assumes mn: \"m < n\"\n  shows \"((\\<lambda>x. f (nat \\<lceil>x\\<rceil>)) has_integral sum f {m<..n}) {real m..real n}\"\nproof -\n  define D where \"D = (\\<lambda>i. {real i..real (Suc i)}) ` {m..<n}\"\n  have D: \"D division_of {m..n}\"\n    using Union_atLeastAtMost_real_of_nat[OF mn] by (simp add: division_of_def D_def)\n  have \"((\\<lambda>x. f (nat \\<lceil>x\\<rceil>)) has_integral (\\<Sum>X\\<in>D. f (nat \\<lfloor>Sup X\\<rfloor>))) {real m..real n}\"\n  proof (rule has_integral_combine_division)\n    fix X assume X: \"X \\<in> D\"\n    have \"nat \\<lceil>x\\<rceil> = nat \\<lfloor>Sup X\\<rfloor>\" if \"x \\<in> X - {Inf X}\" for x\n      using that X by (auto simp: D_def nat_eq_iff ceiling_eq_iff)\n    hence \"((\\<lambda>x. f (nat \\<lceil>x\\<rceil>)) has_integral f (nat \\<lfloor>Sup X\\<rfloor>)) X \\<longleftrightarrow>\n           ((\\<lambda>x. f (nat \\<lfloor>Sup X\\<rfloor>)) has_integral f (nat \\<lfloor>Sup X\\<rfloor>)) X\" using X\n      by (intro has_integral_spike_eq[of \"{Inf X}\"]) auto\n    also from X have \"\\<dots>\" using has_integral_const_real[of \"f (nat \\<lfloor>Sup X\\<rfloor>)\" \"Inf X\" \"Sup X\"]\n      by (auto simp: D_def)\n    finally show \"((\\<lambda>x. f (nat \\<lceil>x\\<rceil>)) has_integral f (nat \\<lfloor>Sup X\\<rfloor>)) X\" .\n  qed fact+\n  also have \"(\\<Sum>X\\<in>D. f (nat \\<lfloor>Sup X\\<rfloor>)) = (\\<Sum>k\\<in>{m..<n}. f (Suc k))\"\n    unfolding D_def by (subst sum.reindex) (auto simp: inj_on_def nat_add_distrib)\n  also have \"\\<dots> = (\\<Sum>k\\<in>{m<..n}. f k)\"\n    by (intro sum.reindex_bij_witness[of _ \"\\<lambda>x. x - 1\" Suc]) auto\n  finally show ?thesis .\nqed\n\nlemma zeta_partial_sum_le:\n  fixes x :: real and m :: nat\n  assumes x: \"x \\<in> {0<..1}\"\n  shows \"(\\<Sum>k=1..m. real k powr (x - 1)) \\<le> real m powr x / x\"\nproof -\n  consider \"m = 0\" | \"m = 1\" | \"m > 1\" by force\n  thus ?thesis\n  proof cases\n    assume m: \"m > 1\"\n    hence \"{1..m} = insert 1 {1<..m}\" by auto\n    also have \"(\\<Sum>k\\<in>\\<dots>. real k powr (x - 1)) = 1 + (\\<Sum>k\\<in>{1<..m}. real k powr (x - 1))\"\n      by simp\n    also have \"(\\<Sum>k\\<in>{1<..m}. real k powr (x - 1)) \\<le> real m powr x / x - 1 / x\"\n    proof (rule has_integral_le)\n      show \"((\\<lambda>t. (nat \\<lceil>t\\<rceil>) powr (x - 1)) has_integral (\\<Sum>n\\<in>{1<..m}. n powr (x - 1))) {real 1..m}\"\n        using m by (intro nat_sum_has_integral_ceiling) auto\n    next\n      have \"((\\<lambda>t. t powr (x - 1)) has_integral (real m powr x / x - real 1 powr x / x))\n              {real 1..real m}\"\n        by (intro fundamental_theorem_of_calculus)\n           (insert x m, auto simp flip: has_real_derivative_iff_has_vector_derivative\n                             intro!: derivative_eq_intros)\n      thus \"((\\<lambda>t. t powr (x - 1)) has_integral (real m powr x / x - 1 / x)) {real 1..real m}\"\n        by simp\n    qed (insert x, auto intro!: powr_mono2')\n    also have \"1 + (real m powr x / x - 1 / x) \\<le> real m powr x / x\"\n      using x by (simp add: field_simps)\n    finally show ?thesis by simp\n  qed (use assms in auto)\nqed\n\nlemma zeta_partial_sum_le':\n  fixes x :: real and m :: nat\n  assumes x: \"x > 0\" and m: \"m > 0\"\n  shows   \"(\\<Sum>n=1..m. real n powr (x - 1)) \\<le> m powr x * (1 / x + 1 / m)\"\nproof (cases \"x > 1\")\n  case False\n  with assms have \"(\\<Sum>n=1..m. real n powr (x - 1)) \\<le> m powr x / x\"\n    by (intro zeta_partial_sum_le) auto\n  also have \"\\<dots> \\<le> m powr x * (1 / x + 1 / m)\"\n    using assms by (simp add: field_simps)\n  finally show ?thesis .\nnext\n  case True\n  have \"(\\<Sum>n\\<in>{1..m}. n powr (x - 1)) = (\\<Sum>n\\<in>insert m {0..<m}. n powr (x - 1))\"\n    by (intro sum.mono_neutral_left) auto\n  also have \"\\<dots> = m powr (x - 1) + (\\<Sum>n\\<in>{0..<m}. n powr (x - 1))\" by simp\n  also have \"(\\<Sum>n\\<in>{0..<m}. n powr (x - 1)) \\<le> real m powr x / x\"\n  proof (rule has_integral_le)\n    show \"((\\<lambda>t. (nat \\<lfloor>t\\<rfloor>) powr (x - 1)) has_integral (\\<Sum>n\\<in>{0..<m}. n powr (x - 1))) {real 0..m}\"\n      using m by (intro nat_sum_has_integral_floor) auto\n  next\n    show \"((\\<lambda>t. t powr (x - 1)) has_integral (real m powr x / x)) {real 0..real m}\"\n      using has_integral_powr_from_0[of \"x - 1\"] x by auto\n  next\n    fix t assume \"t \\<in> {real 0..real m}\"\n    with \\<open>x > 1\\<close> show \"real (nat \\<lfloor>t\\<rfloor>) powr (x - 1) \\<le> t powr (x - 1)\"\n      by (cases \"t = 0\") (auto intro: powr_mono2)\n  qed\n  also have \"m powr (x - 1) + m powr x / x = m powr x * (1 / x + 1 / m)\"\n    using m x by (simp add: powr_diff field_simps)\n  finally show ?thesis by simp\nqed\n\nlemma natfun_bigo_1E:\n  assumes \"(f :: nat \\<Rightarrow> _) \\<in> O(\\<lambda>_. 1)\"\n  obtains C where \"C \\<ge> lb\" \"\\<And>n. norm (f n) \\<le> C\"\nproof -\n  from assms obtain C N where \"\\<forall>n\\<ge>N. norm (f n) \\<le> C\"\n    by (auto elim!: landau_o.bigE simp: eventually_at_top_linorder)\n  hence *: \"norm (f n) \\<le> Max ({C, lb} \\<union> (norm ` f ` {..<N}))\" for n\n    by (cases \"n \\<ge> N\") (subst Max_ge_iff; force simp: image_iff)+\n  moreover have \"Max ({C, lb} \\<union> (norm ` f ` {..<N})) \\<ge> lb\"\n    by (intro Max.coboundedI) auto\n  ultimately show ?thesis using that by blast\nqed\n\nlemma natfun_bigo_iff_Bseq: \"f \\<in> O(\\<lambda>_. 1) \\<longleftrightarrow> Bseq f\"\nproof\n  assume \"Bseq f\"\n  then obtain C where \"C > 0\" \"\\<And>n. norm (f n) \\<le> C\" by (auto simp: Bseq_def)\n  thus \"f \\<in> O(\\<lambda>_. 1)\" by (intro bigoI[of _ C]) auto\nnext\n  assume \"f \\<in> O(\\<lambda>_. 1)\"\n  from natfun_bigo_1E[OF this, where lb = 1] obtain C where \"C \\<ge> 1\" \"\\<And>n. norm (f n) \\<le> C\"\n    by auto\n  thus \"Bseq f\" by (auto simp: Bseq_def intro!: exI[of _ C])\nqed\n\nlemma enn_decreasing_sum_le_set_nn_integral:\n  fixes f :: \"real \\<Rightarrow> ennreal\"\n  assumes decreasing: \"\\<And>x y. 0 \\<le> x \\<Longrightarrow> x \\<le> y \\<Longrightarrow> f y \\<le> f x\"\n  shows \"(\\<Sum>n. f (real (Suc n))) \\<le> set_nn_integral lborel {0..} f\"\nproof -\n  have \"(\\<Sum>n. (f (Suc n))) =\n          (\\<Sum>n. \\<integral>\\<^sup>+x\\<in>{real n<..real (Suc n)}. (f (Suc n)) \\<partial>lborel)\"\n    by (subst nn_integral_cmult_indicator) auto\n  also have \"nat \\<lceil>x\\<rceil> = Suc n\" if \"x \\<in> {real n<..real (Suc n)}\" for x n\n    using that by (auto simp: nat_eq_iff ceiling_eq_iff)\n  hence \"(\\<Sum>n. \\<integral>\\<^sup>+x\\<in>{real n<..real (Suc n)}. (f (Suc n)) \\<partial>lborel) =\n          (\\<Sum>n. \\<integral>\\<^sup>+x\\<in>{real n<..real (Suc n)}. (f (real (nat \\<lceil>x\\<rceil>))) \\<partial>lborel)\"\n    by (intro suminf_cong nn_integral_cong) (auto simp: indicator_def)\n  also have \"\\<dots> = (\\<integral>\\<^sup>+x\\<in>(\\<Union>i. {real i<..real (Suc i)}). (f (nat \\<lceil>x::real\\<rceil>)) \\<partial>lborel)\"\n    by (subst nn_integral_disjoint_family)\n       (auto simp: disjoint_family_on_def)\n  also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+x\\<in>{0..}. (f x) \\<partial>lborel)\"\n    by (intro nn_integral_mono) (auto simp: indicator_def intro!: decreasing)\n  finally show ?thesis .\nqed\n\nlemma abs_summable_on_uminus_iff:\n  \"(\\<lambda>x. -f x) abs_summable_on A \\<longleftrightarrow> f abs_summable_on A\"\n  by (simp add: abs_summable_on_def)\n\nlemma abs_summable_on_cmult_right_iff:\n  fixes f :: \"'a \\<Rightarrow> 'b :: {banach, real_normed_field, second_countable_topology}\"\n  assumes \"c \\<noteq> 0\"\n  shows   \"(\\<lambda>x. c * f x) abs_summable_on A \\<longleftrightarrow> f abs_summable_on A\"\n  by (simp add: abs_summable_on_altdef assms)\n\nlemma abs_summable_on_cmult_left_iff:\n  fixes f :: \"'a \\<Rightarrow> 'b :: {banach, real_normed_field, second_countable_topology}\"\n  assumes \"c \\<noteq> 0\"\n  shows   \"(\\<lambda>x. f x * c) abs_summable_on A \\<longleftrightarrow> f abs_summable_on A\"\n  by (simp add: abs_summable_on_altdef assms)\n\nlemma decreasing_sum_le_integral:\n  fixes f :: \"real \\<Rightarrow> real\"\n  assumes nonneg: \"\\<And>x. x \\<ge> 0 \\<Longrightarrow> f x \\<ge> 0\"\n  assumes decreasing: \"\\<And>x y. 0 \\<le> x \\<Longrightarrow> x \\<le> y \\<Longrightarrow> f y \\<le> f x\"\n  assumes integral: \"(f has_integral I) {0..}\"\n  shows   \"summable (\\<lambda>i. f (real (Suc i)))\" and \"suminf (\\<lambda>i. f (real (Suc i))) \\<le> I\"\nproof -\n  have [simp]: \"I \\<ge> 0\"\n    by (intro has_integral_nonneg[OF integral] nonneg) auto\n  have \"(\\<Sum>n. ennreal (f (Suc n))) =\n          (\\<Sum>n. \\<integral>\\<^sup>+x\\<in>{real n<..real (Suc n)}. ennreal (f (Suc n)) \\<partial>lborel)\"\n    by (subst nn_integral_cmult_indicator) auto\n  also have \"nat \\<lceil>x\\<rceil> = Suc n\" if \"x \\<in> {real n<..real (Suc n)}\" for x n\n    using that by (auto simp: nat_eq_iff ceiling_eq_iff)\n  hence \"(\\<Sum>n. \\<integral>\\<^sup>+x\\<in>{real n<..real (Suc n)}. ennreal (f (Suc n)) \\<partial>lborel) =\n          (\\<Sum>n. \\<integral>\\<^sup>+x\\<in>{real n<..real (Suc n)}. ennreal (f (real (nat \\<lceil>x\\<rceil>))) \\<partial>lborel)\"\n    by (intro suminf_cong nn_integral_cong) (auto simp: indicator_def)\n  also have \"\\<dots> = (\\<integral>\\<^sup>+x\\<in>(\\<Union>i. {real i<..real (Suc i)}). ennreal (f (nat \\<lceil>x::real\\<rceil>)) \\<partial>lborel)\"\n    by (subst nn_integral_disjoint_family)\n       (auto simp: disjoint_family_on_def intro!: measurable_completion)\n  also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+x\\<in>{0..}. ennreal (f x) \\<partial>lborel)\"\n    by (intro nn_integral_mono) (auto simp: indicator_def nonneg intro!: decreasing)\n  also have \"\\<dots> = (\\<integral>\\<^sup>+ x. ennreal (indicat_real {0..} x * f x) \\<partial>lborel)\"\n    by (intro nn_integral_cong) (auto simp: indicator_def)\n  also have \"\\<dots> = ennreal I\"\n    using nn_integral_has_integral_lebesgue[OF nonneg integral] by (auto simp: nonneg)\n  finally have *: \"(\\<Sum>n. ennreal (f (Suc n))) \\<le> ennreal I\" .\n  from * show summable: \"summable (\\<lambda>i. f (real (Suc i)))\"\n    by (intro summable_suminf_not_top) (auto simp: top_unique intro: nonneg)\n  note *\n  also from summable have \"(\\<Sum>n. ennreal (f (Suc n))) = ennreal (\\<Sum>n. f (Suc n))\"\n    by (subst suminf_ennreal2) (auto simp: o_def nonneg)\n  finally show \"(\\<Sum>n. f (real (Suc n))) \\<le> I\" by (subst (asm) ennreal_le_iff) auto\nqed\n\nlemma decreasing_sum_le_integral':\n  fixes f :: \"real \\<Rightarrow> real\"\n  assumes \"\\<And>x. x \\<ge> 0 \\<Longrightarrow> f x \\<ge> 0\"\n  assumes \"\\<And>x y. 0 \\<le> x \\<Longrightarrow> x \\<le> y \\<Longrightarrow> f y \\<le> f x\"\n  assumes \"(f has_integral I) {0..}\"\n  shows   \"summable (\\<lambda>i. f (real i))\" and \"suminf (\\<lambda>i. f (real i)) \\<le> f 0 + I\"\nproof -\n  have \"summable ((\\<lambda>i. f (real (Suc i))))\"\n    using decreasing_sum_le_integral[OF assms] by (simp add: o_def)\n  thus *: \"summable (\\<lambda>i. f (real i))\" by (subst (asm) summable_Suc_iff)\n  have \"(\\<Sum>n. f (real (Suc n))) \\<le> I\" by (intro decreasing_sum_le_integral assms)\n  thus \"suminf (\\<lambda>i. f (real i)) \\<le> f 0 + I\"\n    using * by (subst (asm) suminf_split_head) auto\nqed\n\nlemma of_nat_powr_neq_1_complex [simp]:\n  assumes \"n > 1\" \"Re s \\<noteq> 0\"\n  shows   \"of_nat n powr s \\<noteq> (1::complex)\"\nproof -\n  have \"norm (of_nat n powr s) = real n powr Re s\"\n    by (simp add: norm_powr_real_powr)\n  also have \"\\<dots> \\<noteq> 1\"\n    using assms by (auto simp: powr_def)\n  finally show ?thesis by auto\nqed\n\nlemma fds_logderiv_completely_multiplicative:\n  fixes f :: \"'a :: {real_normed_field} fds\"\n  assumes \"completely_multiplicative_function (fds_nth f)\" \"fds_nth f 1 \\<noteq> 0\"\n  shows   \"fds_deriv f / f = - fds (\\<lambda>n. fds_nth f n * mangoldt n)\"\nproof -\n  have \"fds_deriv f / f = - fds (\\<lambda>n. fds_nth f n * mangoldt n) * f / f\"\n    using completely_multiplicative_fds_deriv[of \"fds_nth f\"] assms by simp\n  also have \"\\<dots> = - fds (\\<lambda>n. fds_nth f n * mangoldt n)\"\n    using assms by (simp add: divide_fds_def fds_right_inverse)\n  finally show ?thesis .\nqed\n\nlemma fds_nth_logderiv_completely_multiplicative:\n  fixes f :: \"'a :: {real_normed_field} fds\"\n  assumes \"completely_multiplicative_function (fds_nth f)\" \"fds_nth f 1 \\<noteq> 0\"\n  shows   \"fds_nth (fds_deriv f / f) n = -fds_nth f n * mangoldt n\"\n  using assms by (subst fds_logderiv_completely_multiplicative) (simp_all add: fds_nth_fds')\n\nlemma eval_fds_logderiv_completely_multiplicative:\n  fixes s :: \"'a :: dirichlet_series\" and l :: 'a and f :: \"'a fds\"\n  defines \"h \\<equiv> fds_deriv f / f\"\n  assumes \"completely_multiplicative_function (fds_nth f)\" and [simp]: \"fds_nth f 1 \\<noteq> 0\"\n  assumes \"s \\<bullet> 1 > abs_conv_abscissa f\"\n  shows  \"(\\<lambda>p. of_real (ln (real p)) * (1 / (1 - fds_nth f p / nat_power p s) - 1))\n            abs_summable_on {p. prime p}\" (is ?th1)\n    and  \"eval_fds h s = -(\\<Sum>\\<^sub>ap | prime p. of_real (ln (real p)) *\n                            (1 / (1 - fds_nth f p / nat_power p s) - 1))\" (is ?th2)\nproof -\n  let ?P = \"{p::nat. prime p}\"\n  interpret f: completely_multiplicative_function \"fds_nth f\" by fact\n  have \"fds_abs_converges h s\"\n    using abs_conv_abscissa_completely_multiplicative_log_deriv[OF assms(2)] assms\n    by (intro fds_abs_converges) auto\n  hence *: \"(\\<lambda>n. fds_nth h n / nat_power n s) abs_summable_on UNIV\"\n    by (auto simp: h_def fds_abs_converges_altdef')\n\n  note *\n  also have \"(\\<lambda>n. fds_nth h n / nat_power n s) abs_summable_on UNIV \\<longleftrightarrow>\n          (\\<lambda>x. -fds_nth f x * mangoldt x / nat_power x s) abs_summable_on Collect primepow\"\n    unfolding h_def using fds_nth_logderiv_completely_multiplicative[OF assms(2)]\n    by (intro abs_summable_on_cong_neutral) (auto simp: fds_nth_fds mangoldt_def)\n  finally have sum1: \"(\\<lambda>x. -fds_nth f x * mangoldt x / nat_power x s)\n                      abs_summable_on Collect primepow\"\n    by (rule abs_summable_on_subset) auto\n  also have \"?this \\<longleftrightarrow> (\\<lambda>(p,k). -fds_nth f (p ^ Suc k) * mangoldt (p ^ Suc k) /\n                                nat_power (p ^ Suc k) s) abs_summable_on (?P \\<times> UNIV)\"\n    using bij_betw_primepows unfolding case_prod_unfold\n    by (intro abs_summable_on_reindex_bij_betw [symmetric])\n  also have \"\\<dots> \\<longleftrightarrow> (\\<lambda>(p,k). -((fds_nth f p / nat_power p s) ^ Suc k * of_real (ln (real p))))\n                abs_summable_on (?P \\<times> UNIV)\"\n    unfolding case_prod_unfold\n    by (intro abs_summable_on_cong, subst mangoldt_primepow)\n       (auto simp: f.mult f.power nat_power_mult_distrib nat_power_power_left power_divide\n             dest: prime_gt_1_nat)\n  finally have sum2: \\<dots> .\n\n  have sum4: \"summable (\\<lambda>n. (norm (fds_nth f p / nat_power p s)) ^ Suc n)\" if p: \"prime p\" for p\n  proof -\n    have \"summable (\\<lambda>n. \\<bar>ln (real p)\\<bar> * (norm (fds_nth f p / nat_power p s)) ^ Suc n)\"\n      using p abs_summable_on_Sigma_project2[OF sum2, of p] unfolding abs_summable_on_nat_iff'\n      by (simp add: norm_power norm_mult norm_divide mult_ac del: power_Suc)\n    thus ?thesis by (rule summable_mult_D) (insert p, auto dest: prime_gt_1_nat)\n  qed\n  have sums: \"(\\<lambda>n. (fds_nth f p / nat_power p s) ^ Suc n) sums\n                (1 / (1 - fds_nth f p / nat_power p s) - 1)\" if p: \"prime p\" for p :: nat\n  proof -\n    from sum4[OF p] have \"norm (fds_nth f p / nat_power p s) < 1\"\n      unfolding summable_Suc_iff by (simp add: summable_geometric_iff)\n    from geometric_sums[OF this] show ?thesis by (subst sums_Suc_iff) auto\n  qed\n\n  have eq: \"(\\<Sum>\\<^sub>ak. - ((fds_nth f p / nat_power p s) ^ Suc k * of_real (ln (real p)))) =\n               -(of_real (ln (real p)) * (1 / (1 - fds_nth f p / nat_power p s) - 1))\"\n    if p: \"prime p\" for p\n  proof -\n    have \"(\\<Sum>\\<^sub>ak. - ((fds_nth f p / nat_power p s) ^ Suc k * of_real (ln (real p)))) =\n             (\\<Sum>\\<^sub>ak. (fds_nth f p / nat_power p s) ^ Suc k) * of_real (-ln (real p))\"\n      using sum4[of p] p\n      by (subst infsetsum_cmult_left [symmetric])\n         (auto simp: abs_summable_on_nat_iff' norm_power simp del: power_Suc)\n    also have \"(\\<Sum>\\<^sub>ak. (fds_nth f p / nat_power p s) ^ Suc k) =\n                 (1 / (1 - fds_nth f p / nat_power p s) - 1)\" using sum4[OF p] sums[OF p]\n      by (subst infsetsum_nat')\n         (auto simp: sums_iff abs_summable_on_nat_iff' norm_power simp del: power_Suc)\n    finally show ?thesis by (simp add: mult_ac)\n  qed\n\n  have sum3: \"(\\<lambda>x. \\<Sum>\\<^sub>ay. - ((fds_nth f x / nat_power x s) ^ Suc y * of_real (ln (real x))))\n                 abs_summable_on {p. prime p}\"\n    using sum2 by (rule abs_summable_on_Sigma_project1') auto\n  also have \"?this \\<longleftrightarrow> (\\<lambda>p. -(of_real (ln (real p)) *\n                (1 / (1 - fds_nth f p / nat_power p s) - 1))) abs_summable_on {p. prime p}\"\n    by (intro abs_summable_on_cong eq) auto\n  also have \"\\<dots> \\<longleftrightarrow> ?th1\" by (subst abs_summable_on_uminus_iff) auto\n  finally show ?th1 .\n\n  have \"eval_fds h s = (\\<Sum>\\<^sub>an. fds_nth h n / nat_power n s)\"\n    using * unfolding eval_fds_def by (subst infsetsum_nat') auto\n  also have \"\\<dots> = (\\<Sum>\\<^sub>an \\<in> {n. primepow n}. -fds_nth f n * mangoldt n / nat_power n s)\"\n    unfolding h_def using fds_nth_logderiv_completely_multiplicative[OF assms(2)]\n    by (intro infsetsum_cong_neutral) (auto simp: fds_nth_fds mangoldt_def)\n  also have \"\\<dots> = (\\<Sum>\\<^sub>a(p,k)\\<in>(?P \\<times> UNIV). -fds_nth f (p ^ Suc k) * mangoldt (p ^ Suc k) /\n                                            nat_power (p ^ Suc k) s)\"\n     using bij_betw_primepows unfolding case_prod_unfold\n     by (intro infsetsum_reindex_bij_betw [symmetric])\n  also have \"\\<dots> = (\\<Sum>\\<^sub>a(p,k)\\<in>(?P \\<times> UNIV).\n                     -((fds_nth f p / nat_power p s) ^ Suc k) * of_real (ln (real p)))\"\n    by (intro infsetsum_cong)\n       (auto simp: f.mult f.power mangoldt_def aprimedivisor_prime_power ln_realpow prime_gt_0_nat\n          nat_power_power_left divide_simps simp del: power_Suc)\n  also have \"\\<dots> = (\\<Sum>\\<^sub>ap | prime p. \\<Sum>\\<^sub>ak.\n                    - ((fds_nth f p / nat_power p s) ^ Suc k) * of_real (ln (real p)))\"\n    using sum2 by (subst infsetsum_Times) (auto simp: case_prod_unfold)\n  also have \"\\<dots> = (\\<Sum>\\<^sub>ap | prime p. -(of_real (ln (real p)) *\n                    (1 / (1 - fds_nth f p / nat_power p s) - 1)))\"\n    using eq by (intro infsetsum_cong) auto\n  finally show ?th2 by (subst (asm) infsetsum_uminus)\nqed\n\nlemma eval_fds_logderiv_zeta:\n  assumes \"Re s > 1\"\n  shows  \"(\\<lambda>p. of_real (ln (real p)) / (p powr s - 1))\n            abs_summable_on {p. prime p}\" (is ?th1)\n    and  \"deriv zeta s / zeta s =\n            -(\\<Sum>\\<^sub>ap | prime p. of_real (ln (real p)) / (p powr s - 1))\" (is ?th2)\nproof -\n  have *: \"completely_multiplicative_function (fds_nth fds_zeta :: _ \\<Rightarrow> complex)\"\n    by standard auto\n  note abscissa = le_less_trans[OF abs_conv_abscissa_completely_multiplicative_log_deriv[OF *]]\n  have \"(\\<lambda>p. ln (real p) * (1 / (1 - fds_nth fds_zeta p / p powr s) - 1))\n           abs_summable_on {p. prime p}\"\n    using eval_fds_logderiv_completely_multiplicative[OF *, of s] assms by auto\n  also have \"?this \\<longleftrightarrow> (\\<lambda>p. ln (real p) / (p powr s - 1)) abs_summable_on {p. prime p}\" using assms\n    by (intro abs_summable_on_cong) (auto simp: fds_nth_zeta divide_simps dest: prime_gt_1_nat)\n  finally show ?th1 .\n\n  from assms have ev: \"eventually (\\<lambda>z. z \\<in> {z. Re z > 1}) (nhds s)\"\n    by (intro eventually_nhds_in_open open_halfspace_Re_gt) auto\n  have \"deriv zeta s = deriv (eval_fds fds_zeta) s\"\n    by (intro deriv_cong_ev[OF eventually_mono[OF ev]]) (auto simp: eval_fds_zeta)\n  also have \"deriv (eval_fds fds_zeta) s / zeta s = eval_fds (fds_deriv fds_zeta / fds_zeta) s\"\n    using assms zeta_Re_gt_1_nonzero[of s]\n    by (subst eval_fds_log_deriv) (auto simp: eval_fds_zeta eval_fds_deriv intro!: abscissa)\n  also have \"eval_fds (fds_deriv fds_zeta / fds_zeta) s =\n               -(\\<Sum>\\<^sub>ap | prime p. ln (real p) * (1 / (1 - fds_nth fds_zeta p / p powr s) - 1))\"\n    (is \"_ = -?S\") using eval_fds_logderiv_completely_multiplicative[OF *, of s] assms by auto\n  also have \"?S = (\\<Sum>\\<^sub>ap | prime p. ln (real p) / (p powr s - 1))\" using assms\n    by (intro infsetsum_cong) (auto simp: fds_nth_zeta divide_simps dest: prime_gt_1_nat)\n  finally show ?th2 .\nqed\n\nlemma sums_logderiv_zeta:\n  assumes \"Re s > 1\"\n  shows   \"(\\<lambda>p. if prime p then of_real (ln (real p)) / (of_nat p powr s - 1) else 0) sums\n             -(deriv zeta s / zeta s)\" (is \"?f sums _\")\nproof -\n  note * = eval_fds_logderiv_zeta[OF assms]\n  from sums_infsetsum_nat[OF *(1)] and *(2) show ?thesis by simp\nqed\n\nlemma range_add_nat: \"range (\\<lambda>n. n + c) = {(c::nat)..}\"\n  using Nat.le_imp_diff_is_add by auto\n\nlemma abs_summable_hurwitz_zeta:\n  assumes \"Re s > 1\" \"a + real b > 0\"\n  shows   \"(\\<lambda>n. 1 / (of_nat n + a) powr s) abs_summable_on {b..}\"\nproof -\n  from assms have \"summable (\\<lambda>n. cmod (1 / (of_nat (n + b) + a) powr s))\"\n    using summable_hurwitz_zeta_real[of \"Re s\" \"a + b\"]\n    by (auto simp: norm_divide powr_minus field_simps norm_powr_real_powr)\n  hence \"(\\<lambda>n. 1 / (of_nat (n + b) + a) powr s) abs_summable_on UNIV\"\n    by (auto simp: abs_summable_on_nat_iff' add_ac)\n  also have \"?this \\<longleftrightarrow> (\\<lambda>n. 1 / (of_nat n + a) powr s) abs_summable_on range (\\<lambda>n. n + b)\"\n    by (rule abs_summable_on_reindex_iff) auto\n  also have \"range (\\<lambda>n. n + b) = {b..}\" by (rule range_add_nat)\n  finally show ?thesis .\nqed\n\nlemma hurwitz_zeta_nat_conv_infsetsum:\n  assumes \"a > 0\" and \"Re s > 1\"\n  shows   \"hurwitz_zeta (real a) s = (\\<Sum>\\<^sub>an. of_nat (n + a) powr -s)\"\n          \"hurwitz_zeta (real a) s = (\\<Sum>\\<^sub>an\\<in>{a..}. of_nat n powr -s)\"\nproof -\n  have \"hurwitz_zeta (real a) s = (\\<Sum>n. of_nat (n + a) powr -s)\"\n    using assms by (subst hurwitz_zeta_conv_suminf) auto\n  also have \"\\<dots> = (\\<Sum>\\<^sub>an. of_nat (n + a) powr -s)\"\n    using abs_summable_hurwitz_zeta[of s a 0] assms\n    by (intro infsetsum_nat' [symmetric]) (auto simp: powr_minus field_simps)\n  finally show \"hurwitz_zeta (real a) s = (\\<Sum>\\<^sub>an. of_nat (n + a) powr -s)\" .\n  also have \"\\<dots> = (\\<Sum>\\<^sub>an\\<in>range (\\<lambda>n. n + a). of_nat n powr -s)\"\n    by (rule infsetsum_reindex [symmetric]) auto\n  also have \"range (\\<lambda>n. n + a) = {a..}\" by (rule range_add_nat)\n  finally show \"hurwitz_zeta (real a) s = (\\<Sum>\\<^sub>an\\<in>{a..}. of_nat n powr -s)\" .\nqed\n\nlemma pre_zeta_bound:\n  assumes \"0 < Re s\" and a: \"a > 0\"\n  shows   \"norm (pre_zeta a s) \\<le> (1 + norm s / Re s) / 2 * a powr -Re s\"\nproof -\n  let ?f = \"\\<lambda>x. - (s * (x + a) powr (-1-s))\"\n  let ?g' = \"\\<lambda>x. norm s * (x + a) powr (-1-Re s)\"\n  let ?g = \"\\<lambda>x. -norm s / Re s * (x + a) powr (-Re s)\"\n  define R where \"R = EM_remainder 1 ?f 0\"\n  have [simp]: \"-Re s - 1 = -1 - Re s\" by (simp add: algebra_simps)\n\n  have \"\\<bar>frac x - 1 / 2\\<bar> \\<le> 1 / 2\" for x :: real unfolding frac_def\n    by linarith\n  hence \"\\<bar>pbernpoly (Suc 0) x\\<bar> \\<le> 1 / 2\" for x\n    by (simp add: pbernpoly_def bernpoly_def)\n  moreover have \"((\\<lambda>b. cmod s * (b + a) powr - Re s / Re s) \\<longlongrightarrow> 0) at_top\"\n    using \\<open>Re s > 0\\<close> \\<open>a > 0\\<close> by real_asymp\n  ultimately have *: \"\\<forall>x. x \\<ge> real 0 \\<longrightarrow> norm (EM_remainder 1 ?f (int x)) \\<le>\n                           (1 / 2) / fact 1 * (-?g (real x))\"\n    using \\<open>a > 0\\<close> \\<open>Re s > 0\\<close>\n    by (intro norm_EM_remainder_le_strong_nat'[where g' = ?g' and Y = \"{}\"])\n       (auto intro!: continuous_intros derivative_eq_intros\n             simp: field_simps norm_mult norm_powr_real_powr add_eq_0_iff)\n  have R: \"norm R \\<le> norm s / (2 * Re s) * a powr -Re s\"\n    unfolding R_def using spec[OF *, of 0] by simp\n\n  from assms have \"pre_zeta a s = a powr -s / 2 + R\"\n    by (simp add: pre_zeta_def pre_zeta_aux_def R_def)\n  also have \"norm \\<dots> \\<le> a powr -Re s / 2 + norm s / (2 * Re s) * a powr -Re s\" using a\n    by (intro order.trans[OF norm_triangle_ineq] add_mono R) (auto simp: norm_powr_real_powr)\n  also have \"\\<dots> = (1 + norm s / Re s) / 2 * a powr -Re s\"\n    by (simp add: field_simps)\n  finally show ?thesis .\nqed\n\nlemma pre_zeta_bound':\n  assumes \"0 < Re s\" and a: \"a > 0\"\n  shows   \"norm (pre_zeta a s) \\<le> norm s / (Re s * a powr Re s)\"\nproof -\n  from assms have \"norm (pre_zeta a s) \\<le> (1 + norm s / Re s) / 2 * a powr -Re s\"\n    by (intro pre_zeta_bound) auto\n  also have \"\\<dots> = (Re s + norm s) / 2 / (Re s * a powr Re s)\"\n    using assms by (auto simp: field_simps powr_minus)\n  also have \"Re s + norm s \\<le> norm s + norm s\" by (intro add_right_mono complex_Re_le_cmod)\n  also have \"(norm s + norm s) / 2 = norm s\" by simp\n  finally show \"norm (pre_zeta a s) \\<le> norm s / (Re s * a powr Re s)\"\n    using assms by (simp add: divide_right_mono)\nqed\n\nlemma deriv_zeta_eq:\n  assumes s: \"s \\<noteq> 1\"\n  shows   \"deriv zeta s = deriv (pre_zeta 1) s - 1 / (s - 1)\\<^sup>2\"\nproof -\n  from s have ev: \"eventually (\\<lambda>z. z \\<noteq> 1) (nhds s)\" by (intro t1_space_nhds)\n  have [derivative_intros]: \"(pre_zeta 1 has_field_derivative deriv (pre_zeta 1) s) (at s)\"\n    by (intro holomorphic_derivI[of _ UNIV] holomorphic_intros) auto\n  have \"((\\<lambda>s. pre_zeta 1 s + 1 / (s - 1)) has_field_derivative\n          (deriv (pre_zeta 1) s - 1 / (s - 1)\\<^sup>2)) (at s)\"\n    using s by (auto intro!: derivative_eq_intros simp: power2_eq_square)\n  also have \"?this \\<longleftrightarrow> (zeta has_field_derivative (deriv (pre_zeta 1) s - 1 / (s - 1)\\<^sup>2)) (at s)\"\n    by (intro has_field_derivative_cong_ev eventually_mono[OF ev])\n       (auto simp: zeta_def hurwitz_zeta_def)\n  finally show ?thesis by (rule DERIV_imp_deriv)\nqed\n\nlemma zeta_remove_zero:\n  assumes \"Re s \\<ge> 1\"\n  shows   \"(s - 1) * pre_zeta 1 s + 1 \\<noteq> 0\"\nproof (cases \"s = 1\")\n  case False\n  hence \"(s - 1) * pre_zeta 1 s + 1 = (s - 1) * zeta s\"\n    by (simp add: zeta_def hurwitz_zeta_def divide_simps)\n  also from False assms have \"\\<dots> \\<noteq> 0\" using zeta_Re_ge_1_nonzero[of s] by auto\n  finally show ?thesis .\nqed auto\n\nlemma eval_fds_deriv_zeta:\n  assumes \"Re s > 1\"\n  shows   \"eval_fds (fds_deriv fds_zeta) s = deriv zeta s\"\nproof -\n  have ev: \"eventually (\\<lambda>z. z \\<in> {z. Re z > 1}) (nhds s)\"\n    using assms by (intro eventually_nhds_in_open open_halfspace_Re_gt) auto\n  from assms have \"eval_fds (fds_deriv fds_zeta) s = deriv (eval_fds fds_zeta) s\"\n    by (subst eval_fds_deriv) auto\n  also have \"\\<dots> = deriv zeta s\"\n    by (intro deriv_cong_ev eventually_mono[OF ev]) (auto simp: eval_fds_zeta)\n  finally show ?thesis .\nqed\n\nlemma le_nat_iff': \"x \\<le> nat y \\<longleftrightarrow> x = 0 \\<and> y \\<le> 0 \\<or> int x \\<le> y\"\n  by auto\n\nlemma sum_upto_plus1:\n  assumes \"x \\<ge> 0\"\n  shows   \"sum_upto f (x + 1) = sum_upto f x + f (Suc (nat \\<lfloor>x\\<rfloor>))\"\nproof -\n  have \"sum_upto f (x + 1) = sum f {0<..Suc (nat \\<lfloor>x\\<rfloor>)}\"\n    using assms by (simp add: sum_upto_altdef nat_add_distrib)\n  also have \"{0<..Suc (nat \\<lfloor>x\\<rfloor>)} = insert (Suc (nat \\<lfloor>x\\<rfloor>)) {0<..nat \\<lfloor>x\\<rfloor>}\"\n    by auto\n  also have \"sum f \\<dots> = sum_upto f x + f (Suc (nat \\<lfloor>x\\<rfloor>))\"\n    by (subst sum.insert) (auto simp: sum_upto_altdef add_ac)\n  finally show ?thesis .\nqed\n\nlemma sum_upto_minus1:\n  assumes \"x \\<ge> 1\"\n  shows   \"sum_upto f (x - 1) = (sum_upto f x - f (nat \\<lfloor>x\\<rfloor>) :: 'a :: ab_group_add)\"\n  using sum_upto_plus1[of \"x - 1\" f] assms by (simp add: algebra_simps nat_diff_distrib)\n\nlemma integral_smallo:\n  fixes f g g' :: \"real \\<Rightarrow> real\"\n  assumes \"f \\<in> o(g')\" and \"filterlim g at_top at_top\"\n  assumes \"\\<And>a' x. a \\<le> a' \\<Longrightarrow> a' \\<le> x \\<Longrightarrow> f integrable_on {a'..x}\"\n  assumes deriv: \"\\<And>x. x \\<ge> a \\<Longrightarrow> (g has_field_derivative g' x) (at x)\"\n  assumes cont: \"continuous_on {a..} g'\"\n  assumes nonneg: \"\\<And>x. x \\<ge> a \\<Longrightarrow> g' x \\<ge> 0\"\n  shows   \"(\\<lambda>x. integral {a..x} f) \\<in> o(g)\"\nproof (rule landau_o.smallI)\n  fix c :: real assume c: \"c > 0\"\n  note [continuous_intros] = continuous_on_subset[OF cont]\n  define c' where \"c' = c / 2\"\n  from c have c': \"c' > 0\" by (simp add: c'_def)\n  from landau_o.smallD[OF assms(1) this]\n    obtain b where b: \"\\<And>x. x \\<ge> b \\<Longrightarrow> norm (f x) \\<le> c' * norm (g' x)\"\n    unfolding eventually_at_top_linorder by blast\n  define b' where \"b' = max a b\"\n  define D where \"D = norm (integral {a..b'} f)\"\n\n  have \"filterlim (\\<lambda>x. c' * g x) at_top at_top\"\n    using c' by (intro filterlim_tendsto_pos_mult_at_top[OF tendsto_const] assms)\n  hence \"eventually (\\<lambda>x. c' * g x \\<ge> D - c' * g b') at_top\"\n    by (auto simp: filterlim_at_top)\n  thus \"eventually (\\<lambda>x. norm (integral {a..x} f) \\<le> c * norm (g x)) at_top\"\n    using eventually_ge_at_top[of b']\n  proof eventually_elim\n    case (elim x)\n    have b': \"a \\<le> b'\" \"b \\<le> b'\" by (auto simp: b'_def)\n    from elim b' have integrable: \"(\\<lambda>x. \\<bar>g' x\\<bar>) integrable_on {b'..x}\"\n      by (intro integrable_continuous_real continuous_intros) auto\n    have \"integral {a..x} f = integral {a..b'} f + integral {b'..x} f\"\n      using elim b' by (intro Henstock_Kurzweil_Integration.integral_combine [symmetric] assms) auto\n    also have \"norm \\<dots> \\<le> D + norm (integral {b'..x} f)\"\n      unfolding D_def by (rule norm_triangle_ineq)\n    also have \"norm (integral {b'..x} f) \\<le> integral {b'..x} (\\<lambda>x. c' * norm (g' x))\"\n      using b' elim assms c' integrable by (intro integral_norm_bound_integral b assms) auto\n    also have \"\\<dots> = c' * integral {b'..x} (\\<lambda>x. \\<bar>g' x\\<bar>)\" by simp\n    also have \"integral {b'..x} (\\<lambda>x. \\<bar>g' x\\<bar>) = integral {b'..x} g'\"\n      using assms b' by (intro integral_cong) auto\n    also have \"(g' has_integral (g x - g b')) {b'..x}\" using b' elim\n      by (intro fundamental_theorem_of_calculus)\n         (auto simp flip: has_real_derivative_iff_has_vector_derivative\n               intro!: has_field_derivative_at_within[OF deriv])\n    hence \"integral {b'..x} g' = g x - g b'\"\n      by (simp add: has_integral_iff)\n    also have \"D + c' * (g x - g b') \\<le> c * g x\"\n      using elim by (simp add: field_simps c'_def)\n    also have \"\\<dots> \\<le> c * norm (g x)\"\n      using c by (intro mult_left_mono) auto\n    finally show ?case by simp\n  qed\nqed\n\nlemma integral_bigo:\n  fixes f g g' :: \"real \\<Rightarrow> real\"\n  assumes \"f \\<in> O(g')\" and \"filterlim g at_top at_top\"\n  assumes \"\\<And>a' x. a \\<le> a' \\<Longrightarrow> a' \\<le> x \\<Longrightarrow> f integrable_on {a'..x}\"\n  assumes deriv: \"\\<And>x. x \\<ge> a \\<Longrightarrow> (g has_field_derivative g' x) (at x within {a..})\"\n  assumes cont: \"continuous_on {a..} g'\"\n  assumes nonneg: \"\\<And>x. x \\<ge> a \\<Longrightarrow> g' x \\<ge> 0\"\n  shows   \"(\\<lambda>x. integral {a..x} f) \\<in> O(g)\"\nproof -\n  note [continuous_intros] = continuous_on_subset[OF cont]\n  from landau_o.bigE[OF assms(1)]\n    obtain c b where c: \"c > 0\" and b: \"\\<And>x. x \\<ge> b \\<Longrightarrow> norm (f x) \\<le> c * norm (g' x)\"\n      unfolding eventually_at_top_linorder by metis\n  define c' where \"c' = c / 2\"\n  define b' where \"b' = max a b\"\n  define D where \"D = norm (integral {a..b'} f)\"\n\n  have \"filterlim (\\<lambda>x. c * g x) at_top at_top\"\n    using c by (intro filterlim_tendsto_pos_mult_at_top[OF tendsto_const] assms)\n  hence \"eventually (\\<lambda>x. c * g x \\<ge> D - c * g b') at_top\"\n    by (auto simp: filterlim_at_top)\n  hence \"eventually (\\<lambda>x. norm (integral {a..x} f) \\<le> 2 * c * norm (g x)) at_top\"\n    using eventually_ge_at_top[of b']\n  proof eventually_elim\n    case (elim x)\n    have b': \"a \\<le> b'\" \"b \\<le> b'\" by (auto simp: b'_def)\n    from elim b' have integrable: \"(\\<lambda>x. \\<bar>g' x\\<bar>) integrable_on {b'..x}\"\n      by (intro integrable_continuous_real continuous_intros) auto\n    have \"integral {a..x} f = integral {a..b'} f + integral {b'..x} f\"\n      using elim b' by (intro Henstock_Kurzweil_Integration.integral_combine [symmetric] assms) auto\n    also have \"norm \\<dots> \\<le> D + norm (integral {b'..x} f)\"\n      unfolding D_def by (rule norm_triangle_ineq)\n    also have \"norm (integral {b'..x} f) \\<le> integral {b'..x} (\\<lambda>x. c * norm (g' x))\"\n      using b' elim assms c integrable by (intro integral_norm_bound_integral b assms) auto\n    also have \"\\<dots> = c * integral {b'..x} (\\<lambda>x. \\<bar>g' x\\<bar>)\" by simp\n    also have \"integral {b'..x} (\\<lambda>x. \\<bar>g' x\\<bar>) = integral {b'..x} g'\"\n      using assms b' by (intro integral_cong) auto\n    also have \"(g' has_integral (g x - g b')) {b'..x}\" using b' elim\n      by (intro fundamental_theorem_of_calculus)\n         (auto simp flip: has_real_derivative_iff_has_vector_derivative\n               intro!: DERIV_subset[OF deriv])\n    hence \"integral {b'..x} g' = g x - g b'\"\n      by (simp add: has_integral_iff)\n    also have \"D + c * (g x - g b') \\<le> 2 * c * g x\"\n      using elim by (simp add: field_simps c'_def)\n    also have \"\\<dots> \\<le> 2 * c * norm (g x)\"\n      using c by (intro mult_left_mono) auto\n    finally show ?case by simp\n  qed\n  thus ?thesis by (rule bigoI)\nqed\n\nlemma primepows_le_subset:\n  assumes x: \"x > 0\" and l: \"l > 0\"\n  shows   \"{(p, i). prime p \\<and> l \\<le> i \\<and> real (p ^ i) \\<le> x} \\<subseteq> {..nat \\<lfloor>root l x\\<rfloor>} \\<times> {..nat \\<lfloor>log 2 x\\<rfloor>}\"\nproof safe\n  fix p i :: nat assume pi: \"prime p\" \"i \\<ge> l\" \"real (p ^ i) \\<le> x\"\n  have \"real p ^ l \\<le> real p ^ i\" using pi x l\n    by (intro power_increasing) (auto dest: prime_gt_0_nat)\n  also have \"\\<dots> \\<le> x\" using pi by simp\n  finally have \"root l (real p ^ l) \\<le> root l x\"\n    using x pi l by (subst real_root_le_iff) auto\n  also have \"root l (real p ^ l) = real p\"\n    using pi l by (subst real_root_pos2) auto\n  finally show \"p \\<le> nat \\<lfloor>root l x\\<rfloor>\" using pi l x by (simp add: le_nat_iff' le_floor_iff)\n\n  from pi have \"2 ^ i \\<le> real p ^ i\" using l\n    by (intro power_mono) (auto dest: prime_gt_1_nat)\n  also have \"\\<dots> \\<le> x\" using pi by simp\n  finally show \"i \\<le> nat \\<lfloor>log 2 x\\<rfloor>\" using pi x\n    by (auto simp: le_nat_iff' le_floor_iff le_log_iff powr_realpow)\nqed\n\nlemma mangoldt_non_primepow: \"\\<not>primepow n \\<Longrightarrow> mangoldt n = 0\"\n  by (auto simp: mangoldt_def)\n\n(* TODO: unneeded. But why does real_asymp not work? *)\nlemma ln_minus_ln_floor_bigo: \"(\\<lambda>x. ln x - ln (real (nat \\<lfloor>x\\<rfloor>))) \\<in> O(\\<lambda>_. 1)\"\nproof (intro le_imp_bigo_real[of 1] eventually_mono[OF eventually_ge_at_top[of 1]])\n  fix x :: real assume x: \"x \\<ge> 1\"\n  from x have *: \"x - real (nat \\<lfloor>x\\<rfloor>) \\<le> 1\" by linarith\n  from x have \"ln x - ln (real (nat \\<lfloor>x\\<rfloor>)) \\<le> (x - real (nat \\<lfloor>x\\<rfloor>)) / real (nat \\<lfloor>x\\<rfloor>)\"\n    by (intro ln_diff_le) auto\n  also have \"\\<dots> \\<le> 1 / 1\" using x * by (intro frac_le) auto\n  finally show \"ln x - ln (real (nat \\<lfloor>x\\<rfloor>)) \\<le> 1 * 1\" by simp\nqed auto\n\nlemma cos_geD:\n  assumes \"cos x \\<ge> cos a\" \"0 \\<le> a\" \"a \\<le> pi\" \"-pi \\<le> x\" \"x \\<le> pi\"\n  shows   \"x \\<in> {-a..a}\"\nproof (cases \"x \\<ge> 0\")\n  case True\n  with assms show ?thesis\n    by (subst (asm) cos_mono_le_eq) auto\nnext\n  case False\n  with assms show ?thesis using cos_mono_le_eq[of a \"-x\"]\n    by auto\nqed\n\n(* TODO: Could be generalised *)\nlemma path_image_part_circlepath_same_Re:\n  assumes \"0 \\<le> b\" \"b \\<le> pi\" \"a = -b\" \"r \\<ge> 0\"\n  shows   \"path_image (part_circlepath c r a b) = sphere c r \\<inter> {s. Re s \\<ge> Re c + r * cos a}\"\nproof safe\n  fix z assume \"z \\<in> path_image (part_circlepath c r a b)\"\n  with assms obtain t where t: \"t \\<in> {a..b}\" \"z = c + of_real r * cis t\"\n    by (auto simp: path_image_part_circlepath exp_eq_polar)\n  from t and assms show \"z \\<in> sphere c r\"\n    by (auto simp: dist_norm norm_mult)\n  from t and assms show \"Re z \\<ge> Re c + r * cos a\"\n    using cos_monotone_0_pi_le[of t b] cos_monotone_minus_pi_0'[of a t]\n    by (cases \"t \\<ge> 0\") (auto intro!: mult_left_mono)\nnext\n  fix z assume z: \"z \\<in> sphere c r\" \"Re z \\<ge> Re c + r * cos a\"\n  show \"z \\<in> path_image (part_circlepath c r a b)\"\n  proof (cases \"r = 0\")\n    case False\n    with assms have r: \"r > 0\" by simp\n    with z have z_eq: \"z = c + r * cis (Arg (z - c))\"\n      using Arg_eq[of \"z - c\"] by (auto simp: dist_norm exp_eq_polar norm_minus_commute)\n  moreover from z(2) r assms have \"cos b \\<le> cos (Arg (z - c))\"\n    by (subst (asm) z_eq) auto\n  with assms have \"Arg (z - c) \\<in> {-b..b}\"\n    using Arg_le_pi[of \"z - c\"] mpi_less_Arg[of \"z - c\"] by (intro cos_geD) auto\n  ultimately show \"z \\<in> path_image (part_circlepath c r a b)\"\n    using assms by (subst path_image_part_circlepath) (auto simp: exp_eq_polar)\n  qed (insert assms z, auto simp: path_image_part_circlepath)\nqed\n\nlemma part_circlepath_rotate_left:\n  \"part_circlepath c r (x + a) (x + b) = (\\<lambda>z. c + cis x * (z - c)) \\<circ> part_circlepath c r a b\"\n  by (simp add: part_circlepath_def exp_eq_polar fun_eq_iff\n                linepath_translate_left linepath_translate_right cis_mult add_ac)\n\nlemma part_circlepath_rotate_right:\n  \"part_circlepath c r (a + x) (b + x) = (\\<lambda>z. c + cis x * (z - c)) \\<circ> part_circlepath c r a b\"\n  by (simp add: part_circlepath_def exp_eq_polar fun_eq_iff\n                linepath_translate_left linepath_translate_right cis_mult add_ac)\n\nlemma path_image_semicircle_Re_ge:\n  assumes \"r \\<ge> 0\"\n  shows   \"path_image (part_circlepath c r (-pi/2) (pi/2)) =\n             sphere c r \\<inter> {s. Re s \\<ge> Re c}\"\n  by (subst path_image_part_circlepath_same_Re) (simp_all add: assms)\n\nlemma sphere_rotate: \"(\\<lambda>z. c + cis x * (z - c)) ` sphere c r = sphere c r\"\nproof safe\n  fix z assume z: \"z \\<in> sphere c r\"\n  hence \"z = c + cis x * (c + cis (-x) * (z - c) - c)\"\n        \"c + cis (-x) * (z - c) \\<in> sphere c r\"\n    by (auto simp: dist_norm norm_mult norm_minus_commute\n                   cis_conv_exp exp_minus field_simps norm_divide)\n  with z show \"z \\<in> (\\<lambda>z. c + cis x * (z - c)) ` sphere c r\" by blast\nqed (auto simp: dist_norm norm_minus_commute norm_mult)\n\n\nlemma path_image_semicircle_Re_le:\n  assumes \"r \\<ge> 0\"\n  shows   \"path_image (part_circlepath c r (pi/2) (3/2*pi)) =\n             sphere c r \\<inter> {s. Re s \\<le> Re c}\"\nproof -\n  let ?f = \"(\\<lambda>z. c + cis pi * (z - c))\"\n  have *: \"part_circlepath c r (pi/2) (3/2*pi) = part_circlepath c r (pi + (-pi/2)) (pi + pi/2)\"\n    by simp\n  have \"path_image (part_circlepath c r (pi/2) (3/2*pi)) =\n          ?f ` sphere c r \\<inter> ?f ` {s. Re c \\<le> Re s}\"\n    unfolding * part_circlepath_rotate_left path_image_compose path_image_semicircle_Re_ge[OF assms]\n    by auto\n  also have \"?f ` sphere c r = sphere c r\"\n    by (rule sphere_rotate)\n  also have \"?f ` {s. Re c \\<le> Re s} = {s. Re c \\<ge> Re s}\"\n    by (auto simp: image_iff intro!: exI[of _ \"2 * c - x\" for x])\n  finally show ?thesis .\nqed\n\nlemma path_image_semicircle_Im_ge:\n  assumes \"r \\<ge> 0\"\n  shows   \"path_image (part_circlepath c r 0 pi) =\n             sphere c r \\<inter> {s. Im s \\<ge> Im c}\"\nproof -\n  let ?f = \"(\\<lambda>z. c + cis (pi/2) * (z - c))\"\n  have *: \"part_circlepath c r 0 pi = part_circlepath c r (pi / 2 + (-pi/2)) (pi / 2 + pi/2)\"\n    by simp\n  have \"path_image (part_circlepath c r 0 pi) =\n          ?f ` sphere c r \\<inter> ?f ` {s. Re c \\<le> Re s}\"\n    unfolding * part_circlepath_rotate_left path_image_compose path_image_semicircle_Re_ge[OF assms]\n    by auto\n  also have \"?f ` sphere c r = sphere c r\"\n    by (rule sphere_rotate)\n  also have \"?f ` {s. Re c \\<le> Re s} = {s. Im c \\<le> Im s}\"\n    by (auto simp: image_iff intro!: exI[of _ \"c - \\<i> * (x - c)\" for x])\n  finally show ?thesis .\nqed\n\nlemma path_image_semicircle_Im_le:\n  assumes \"r \\<ge> 0\"\n  shows   \"path_image (part_circlepath c r pi (2 * pi)) =\n             sphere c r \\<inter> {s. Im s \\<le> Im c}\"\nproof -\n  let ?f = \"(\\<lambda>z. c + cis (3*pi/2) * (z - c))\"\n  have *: \"part_circlepath c r pi (2*pi) = part_circlepath c r (3*pi/2 + (-pi/2)) (3*pi/2 + pi/2)\"\n    by simp\n  have \"path_image (part_circlepath c r pi (2 * pi)) =\n          ?f ` sphere c r \\<inter> ?f ` {s. Re c \\<le> Re s}\"\n    unfolding * part_circlepath_rotate_left path_image_compose path_image_semicircle_Re_ge[OF assms]\n    by auto\n  also have \"?f ` sphere c r = sphere c r\"\n    by (rule sphere_rotate)\n  also have \"cis (3 * pi / 2) = -\\<i>\"\n    using cis_mult[of pi \"pi / 2\"] by simp\n  hence \"?f ` {s. Re c \\<le> Re s} = {s. Im c \\<ge> Im s}\"\n    by (auto simp: image_iff intro!: exI[of _ \"c + \\<i> * (x - c)\" for x])\n  finally show ?thesis .\nqed\n\nlemma eval_fds_logderiv_zeta_real:\n  assumes \"x > (1 :: real)\"\n  shows  \"(\\<lambda>p. ln (real p) / (p powr x - 1)) abs_summable_on {p. prime p}\" (is ?th1)\n    and  \"deriv zeta (of_real x) / zeta (of_real x) =\n            -of_real (\\<Sum>\\<^sub>ap | prime p. ln (real p) / (p powr x - 1))\" (is ?th2)\nproof -\n  have \"(\\<lambda>p. Re (of_real (ln (real p)) / (of_nat p powr of_real x - 1)))\n          abs_summable_on {p. prime p}\" using assms\n    by (intro abs_summable_Re eval_fds_logderiv_zeta) auto\n  also have \"?this \\<longleftrightarrow> ?th1\"\n    by (intro abs_summable_on_cong) (auto simp: powr_Reals_eq)\n  finally show ?th1 .\n  show ?th2 using assms\n    by (subst eval_fds_logderiv_zeta) (auto simp: infsetsum_of_real [symmetric] powr_Reals_eq)\nqed\n\nlemma\n  fixes a b c d :: real\n  assumes ab: \"d * a + b \\<ge> 1\" and c: \"c < -1\" and d: \"d > 0\"\n  defines \"C \\<equiv> - ((ln (d * a + b) - 1 / (c + 1)) * (d * a + b) powr (c + 1) / (d * (c + 1)))\"\n  shows set_integrable_ln_powr_at_top:\n          \"(\\<lambda>x. (ln (d * x + b) * ((d * x + b) powr c))) absolutely_integrable_on {a<..}\" (is ?th1)\n  and   set_lebesgue_integral_ln_powr_at_top:\n          \"(\\<integral>x\\<in>{a<..}. (ln (d * x + b) * ((d * x + b) powr c)) \\<partial>lborel) = C\" (is ?th2)\n  and   ln_powr_has_integral_at_top:\n          \"((\\<lambda>x. ln (d * x + b) * (d * x + b) powr c) has_integral C) {a<..}\" (is ?th3)\nproof -\n  define f where \"f = (\\<lambda>x. ln (d * x + b) * (d * x + b) powr c)\"\n  define F where \"F = (\\<lambda>x. (ln (d * x + b) - 1 / (c + 1)) * (d * x + b) powr (c + 1) / (d * (c + 1)))\"\n\n  have *: \"(F has_field_derivative f x) (at x)\" \"isCont f x\" \"f x \\<ge> 0\" if \"x > a\" for x\n  proof -\n    have \"1 \\<le> d * a + b\" by fact\n    also have \"\\<dots> < d * x + b\" using that assms\n      by (intro add_strict_right_mono mult_strict_left_mono)\n    finally have gt_1: \"d * x + b > 1\" .\n    show \"(F has_field_derivative f x) (at x)\" \"isCont f x\" using ab c d gt_1\n    by (auto simp: F_def f_def divide_simps intro!: derivative_eq_intros continuous_intros)\n       (auto simp: algebra_simps powr_add)?\n    show \"f x \\<ge> 0\" using gt_1 by (auto simp: f_def)\n  qed\n\n  have limits: \"((F \\<circ> real_of_ereal) \\<longlongrightarrow> F a) (at_right (ereal a))\"\n               \"((F \\<circ> real_of_ereal) \\<longlongrightarrow> 0) (at_left \\<infinity>)\"\n    using c ab d unfolding ereal_tendsto_simps1 F_def  by (real_asymp; simp add: field_simps)+\n  have 1: \"set_integrable lborel (einterval a \\<infinity>) f\" using ab c limits\n    by (intro interval_integral_FTC_nonneg) (auto intro!: * AE_I2)\n  thus 2: \"f absolutely_integrable_on {a<..}\"\n    by (auto simp: set_integrable_def integrable_completion)\n  have \"(LBINT x=ereal a..\\<infinity>. f x) = 0 - F a\" using ab c limits\n    by (intro interval_integral_FTC_nonneg) (auto intro!: *)\n  thus 3: ?th2\n    by (simp add: interval_integral_to_infinity_eq F_def f_def C_def)\n  show ?th3\n    using set_borel_integral_eq_integral[OF 1] 3 by (simp add: has_integral_iff f_def C_def)\nqed\n\nlemma ln_fact_conv_sum_upto: \"ln (fact n) = sum_upto ln n\"\n  by (induction n) (auto simp: sum_upto_plus1 add.commute[of 1] ln_mult)\n\nlemma sum_upto_ln_conv_ln_fact: \"sum_upto ln x = ln (fact (nat \\<lfloor>x\\<rfloor>))\"\n  by (simp add: ln_fact_conv_sum_upto sum_upto_altdef)\n\nlemma real_of_nat_div: \"real (a div b) = real_of_int \\<lfloor>real a / real b\\<rfloor>\"\n  by (simp add: floor_divide_of_nat_eq)\n\nlemma measurable_sum_upto [measurable]:\n  fixes f :: \"'a \\<Rightarrow> nat \\<Rightarrow> real\"\n  assumes [measurable]: \"\\<And>y. (\\<lambda>t. f t y) \\<in> M \\<rightarrow>\\<^sub>M borel\"\n  assumes [measurable]: \"x \\<in> M \\<rightarrow>\\<^sub>M borel\"\n  shows \"(\\<lambda>t. sum_upto (f t) (x t)) \\<in> M \\<rightarrow>\\<^sub>M borel\"\nproof -\n  have meas: \"(\\<lambda>t. set_lebesgue_integral lborel {y. y \\<ge> 0 \\<and> y - real (nat \\<lfloor>x t\\<rfloor>) \\<le> 0} (\\<lambda>y. f t (nat \\<lceil>y\\<rceil>)))\n          \\<in> M \\<rightarrow>\\<^sub>M borel\" (is \"?f \\<in> _\") unfolding set_lebesgue_integral_def\n    by measurable\n  also have \"?f = (\\<lambda>t. sum_upto (f t) (x t))\"\n  proof\n    fix t :: 'a\n    show \"?f t = sum_upto (f t) (x t)\"\n    proof (cases \"x t < 1\")\n      case True\n      hence \"{y. y \\<ge> 0 \\<and> y - real (nat \\<lfloor>x t\\<rfloor>) \\<le> 0} = {0}\" by auto\n      thus ?thesis using True\n        by (simp add: set_integral_at_point sum_upto_altdef)\n    next\n      case False\n      define n where \"n = nat \\<lfloor>x t\\<rfloor>\"\n      from False have \"n > 0\" by (auto simp: n_def)\n\n      have *: \"((\\<lambda>x. f t (nat \\<lceil>x\\<rceil>)) has_integral sum (f t) {0<..n}) {real 0..real n}\"\n        using \\<open>n > 0\\<close> by (intro nat_sum_has_integral_ceiling) auto\n\n      have **: \"(\\<lambda>x. f t (nat \\<lceil>x\\<rceil>)) absolutely_integrable_on {real 0..real n}\"\n      proof (rule absolutely_integrable_absolutely_integrable_ubound)\n        show \"(\\<lambda>_. MAX n\\<in>{0..n}. \\<bar>f t n\\<bar>) absolutely_integrable_on {real 0..real n}\"\n          using \\<open>n > 0\\<close> by (subst absolutely_integrable_on_iff_nonneg)\n                           (auto simp: Max_ge_iff intro!: exI[of _ \"f t 0\"])\n        show \"(\\<lambda>x. f t (nat \\<lceil>x\\<rceil>)) integrable_on {real 0..real n}\"\n          using * by (simp add: has_integral_iff)\n      next\n        fix y :: real assume y: \"y \\<in> {real 0..real n}\"\n        have \"f t (nat \\<lceil>y\\<rceil>) \\<le> \\<bar>f t (nat \\<lceil>y\\<rceil>)\\<bar>\"\n          by simp\n        also have \"\\<dots> \\<le> (MAX n\\<in>{0..n}. \\<bar>f t n\\<bar>)\"\n          using y by (intro Max.coboundedI) auto\n        finally show \"f t (nat \\<lceil>y\\<rceil>) \\<le> (MAX n\\<in>{0..n}. \\<bar>f t n\\<bar>)\" .\n      qed\n      have \"sum (f t) {0<..n} = (\\<integral>x\\<in>{real 0..real n}. f t (nat \\<lceil>x\\<rceil>) \\<partial>lebesgue)\"\n        using has_integral_set_lebesgue[OF **] * by (simp add: has_integral_iff)\n      also have \"\\<dots> = (\\<integral>x\\<in>{real 0..real n}. f t (nat \\<lceil>x\\<rceil>) \\<partial>lborel)\"\n        unfolding set_lebesgue_integral_def by (subst integral_completion) auto\n      also have \"{real 0..real n} = {y. 0 \\<le> y \\<and> y - real (nat \\<lfloor>x t\\<rfloor>) \\<le> 0}\"\n        by (auto simp: n_def)\n      also have \"sum (f t) {0<..n} = sum_upto (f t) (x t)\"\n        by (simp add: sum_upto_altdef n_def)\n      finally show ?thesis ..\n    qed\n  qed\n  finally show ?thesis .\nqed\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Prime_Number_Theorem/Prime_Number_Theorem_Library.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5544704502361149, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.34104804018275975}}
{"text": "(*  Title:      HOL/UNITY/PPROD.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1998  University of Cambridge\n\nAbstraction over replicated components (PLam)\nGeneral products of programs (Pi operation)\n\nSome dead wood here!\n*)\n\ntheory PPROD imports Lift_prog begin\n\ndefinition PLam :: \"[nat set, nat => ('b * ((nat=>'b) * 'c)) program]\n            => ((nat=>'b) * 'c) program\" where\n    \"PLam I F == \\<Squnion>i \\<in> I. lift i (F i)\"\n\nsyntax\n  \"_PLam\" :: \"[pttrn, nat set, 'b set] => (nat => 'b) set\"  (\"(3plam _:_./ _)\" 10)\ntranslations\n  \"plam x : A. B\" == \"CONST PLam A (%x. B)\"\n\n\n(*** Basic properties ***)\n\nlemma Init_PLam [simp]: \"Init (PLam I F) = (\\<Inter>i \\<in> I. lift_set i (Init (F i)))\"\nby (simp add: PLam_def lift_def lift_set_def)\n\nlemma PLam_empty [simp]: \"PLam {} F = SKIP\"\nby (simp add: PLam_def)\n\nlemma PLam_SKIP [simp]: \"(plam i : I. SKIP) = SKIP\"\nby (simp add: PLam_def JN_constant)\n\nlemma PLam_insert: \"PLam (insert i I) F = (lift i (F i)) \\<squnion> (PLam I F)\"\nby (unfold PLam_def, auto)\n\nlemma PLam_component_iff: \"((PLam I F) \\<le> H) = (\\<forall>i \\<in> I. lift i (F i) \\<le> H)\"\nby (simp add: PLam_def JN_component_iff)\n\nlemma component_PLam: \"i \\<in> I ==> lift i (F i) \\<le> (PLam I F)\"\napply (unfold PLam_def)\n(*blast_tac doesn't use HO unification*)\napply (fast intro: component_JN)\ndone\n\n\n(** Safety & Progress: but are they used anywhere? **)\n\nlemma PLam_constrains:\n     \"[| i \\<in> I;  \\<forall>j. F j \\<in> preserves snd |]\n      ==> (PLam I F \\<in> (lift_set i (A \\<times> UNIV)) co\n                      (lift_set i (B \\<times> UNIV)))  =\n          (F i \\<in> (A \\<times> UNIV) co (B \\<times> UNIV))\"\napply (simp add: PLam_def JN_constrains)\napply (subst insert_Diff [symmetric], assumption)\napply (simp add: lift_constrains)\napply (blast intro: constrains_imp_lift_constrains)\ndone\n\nlemma PLam_stable:\n     \"[| i \\<in> I;  \\<forall>j. F j \\<in> preserves snd |]\n      ==> (PLam I F \\<in> stable (lift_set i (A \\<times> UNIV))) =\n          (F i \\<in> stable (A \\<times> UNIV))\"\nby (simp add: stable_def PLam_constrains)\n\nlemma PLam_transient:\n     \"i \\<in> I ==>\n    PLam I F \\<in> transient A = (\\<exists>i \\<in> I. lift i (F i) \\<in> transient A)\"\nby (simp add: JN_transient PLam_def)\n\ntext\\<open>This holds because the \\<^term>\\<open>F j\\<close> cannot change \\<^term>\\<open>lift_set i\\<close>\\<close>\nlemma PLam_ensures:\n     \"[| i \\<in> I;  F i \\<in> (A \\<times> UNIV) ensures (B \\<times> UNIV);\n         \\<forall>j. F j \\<in> preserves snd |]\n      ==> PLam I F \\<in> lift_set i (A \\<times> UNIV) ensures lift_set i (B \\<times> UNIV)\"\napply (simp add: ensures_def PLam_constrains PLam_transient\n              lift_set_Un_distrib [symmetric] lift_set_Diff_distrib [symmetric]\n              Times_Un_distrib1 [symmetric] Times_Diff_distrib1 [symmetric])\napply (rule rev_bexI, assumption)\napply (simp add: lift_transient)\ndone\n\nlemma PLam_leadsTo_Basis:\n     \"[| i \\<in> I;\n         F i \\<in> ((A \\<times> UNIV) - (B \\<times> UNIV)) co\n               ((A \\<times> UNIV) \\<union> (B \\<times> UNIV));\n         F i \\<in> transient ((A \\<times> UNIV) - (B \\<times> UNIV));\n         \\<forall>j. F j \\<in> preserves snd |]\n      ==> PLam I F \\<in> lift_set i (A \\<times> UNIV) leadsTo lift_set i (B \\<times> UNIV)\"\nby (rule PLam_ensures [THEN leadsTo_Basis], rule_tac [2] ensuresI)\n\n\n\n(** invariant **)\n\nlemma invariant_imp_PLam_invariant:\n     \"[| F i \\<in> invariant (A \\<times> UNIV);  i \\<in> I;\n         \\<forall>j. F j \\<in> preserves snd |]\n      ==> PLam I F \\<in> invariant (lift_set i (A \\<times> UNIV))\"\nby (auto simp add: PLam_stable invariant_def)\n\n\nlemma PLam_preserves_fst [simp]:\n     \"\\<forall>j. F j \\<in> preserves snd\n      ==> (PLam I F \\<in> preserves (v o sub j o fst)) =\n          (if j \\<in> I then F j \\<in> preserves (v o fst) else True)\"\nby (simp add: PLam_def lift_preserves_sub)\n\nlemma PLam_preserves_snd [simp,intro]:\n     \"\\<forall>j. F j \\<in> preserves snd ==> PLam I F \\<in> preserves snd\"\nby (simp add: PLam_def lift_preserves_snd_I)\n\n\n\n(*** guarantees properties ***)\n\ntext\\<open>This rule looks unsatisfactory because it refers to \\<^term>\\<open>lift\\<close>. \n  One must use\n  \\<open>lift_guarantees_eq_lift_inv\\<close> to rewrite the first subgoal and\n  something like \\<open>lift_preserves_sub\\<close> to rewrite the third.  However\n  there's no obvious alternative for the third premise.\\<close>\nlemma guarantees_PLam_I:\n    \"[| lift i (F i) \\<in> X guarantees Y;  i \\<in> I;\n        OK I (\\<lambda>i. lift i (F i)) |]\n     ==> (PLam I F) \\<in> X guarantees Y\"\napply (unfold PLam_def)\napply (simp add: guarantees_JN_I)\ndone\n\nlemma Allowed_PLam [simp]:\n     \"Allowed (PLam I F) = (\\<Inter>i \\<in> I. lift i ` Allowed(F i))\"\nby (simp add: PLam_def)\n\n\nlemma PLam_preserves [simp]:\n     \"(PLam I F) \\<in> preserves v = (\\<forall>i \\<in> I. F i \\<in> preserves (v o lift_map i))\"\nby (simp add: PLam_def lift_def rename_preserves)\n\n\n(**UNUSED\n    (*The f0 premise ensures that the product is well-defined.*)\n    lemma PLam_invariant_imp_invariant:\n     \"[| PLam I F \\<in> invariant (lift_set i A);  i \\<in> I;\n             f0: Init (PLam I F) |] ==> F i \\<in> invariant A\"\n    apply (auto simp add: invariant_def)\n    apply (drule_tac c = \"f0 (i:=x) \" in subsetD)\n    apply auto\n    done\n\n    lemma PLam_invariant:\n     \"[| i \\<in> I;  f0: Init (PLam I F) |]\n          ==> (PLam I F \\<in> invariant (lift_set i A)) = (F i \\<in> invariant A)\"\n    apply (blast intro: invariant_imp_PLam_invariant PLam_invariant_imp_invariant)\n    done\n\n    (*The f0 premise isn't needed if F is a constant program because then\n      we get an initial state by replicating that of F*)\n    lemma reachable_PLam:\n     \"i \\<in> I\n          ==> ((plam x \\<in> I. F) \\<in> invariant (lift_set i A)) = (F \\<in> invariant A)\"\n    apply (auto simp add: invariant_def)\n    done\n**)\n\n\n(**UNUSED\n    (** Reachability **)\n\n    Goal \"[| f \\<in> reachable (PLam I F);  i \\<in> I |] ==> f i \\<in> reachable (F i)\"\n    apply (erule reachable.induct)\n    apply (auto intro: reachable.intrs)\n    done\n\n    (*Result to justify a re-organization of this file*)\n    lemma \"{f. \\<forall>i \\<in> I. f i \\<in> R i} = (\\<Inter>i \\<in> I. lift_set i (R i))\"\n    by auto\n\n    lemma reachable_PLam_subset1:\n     \"reachable (PLam I F) \\<subseteq> (\\<Inter>i \\<in> I. lift_set i (reachable (F i)))\"\n    apply (force dest!: reachable_PLam)\n    done\n\n    (*simplify using reachable_lift??*)\n    lemma reachable_lift_Join_PLam [rule_format]:\n      \"[| i \\<notin> I;  A \\<in> reachable (F i) |]\n       ==> \\<forall>f. f \\<in> reachable (PLam I F)\n                  --> f(i:=A) \\<in> reachable (lift i (F i) \\<squnion> PLam I F)\"\n    apply (erule reachable.induct)\n    apply (ALLGOALS Clarify_tac)\n    apply (erule reachable.induct)\n    (*Init, Init case*)\n    apply (force intro: reachable.intrs)\n    (*Init of F, action of PLam F case*)\n    apply (rule_tac act = act in reachable.Acts)\n    apply force\n    apply assumption\n    apply (force intro: ext)\n    (*induction over the 2nd \"reachable\" assumption*)\n    apply (erule_tac xa = f in reachable.induct)\n    (*Init of PLam F, action of F case*)\n    apply (rule_tac act = \"lift_act i act\" in reachable.Acts)\n    apply force\n    apply (force intro: reachable.Init)\n    apply (force intro: ext simp add: lift_act_def)\n    (*last case: an action of PLam I F*)\n    apply (rule_tac act = acta in reachable.Acts)\n    apply force\n    apply assumption\n    apply (force intro: ext)\n    done\n\n\n    (*The index set must be finite: otherwise infinitely many copies of F can\n      perform actions, and PLam can never catch up in finite time.*)\n    lemma reachable_PLam_subset2:\n     \"finite I\n          ==> (\\<Inter>i \\<in> I. lift_set i (reachable (F i))) \\<subseteq> reachable (PLam I F)\"\n    apply (erule finite_induct)\n    apply (simp (no_asm))\n    apply (force dest: reachable_lift_Join_PLam simp add: PLam_insert)\n    done\n\n    lemma reachable_PLam_eq:\n     \"finite I ==>\n          reachable (PLam I F) = (\\<Inter>i \\<in> I. lift_set i (reachable (F i)))\"\n    apply (REPEAT_FIRST (ares_tac [equalityI, reachable_PLam_subset1, reachable_PLam_subset2]))\n    done\n\n\n    (** Co **)\n\n    lemma Constrains_imp_PLam_Constrains:\n     \"[| F i \\<in> A Co B;  i \\<in> I;  finite I |]\n          ==> PLam I F \\<in> (lift_set i A) Co (lift_set i B)\"\n    apply (auto simp add: Constrains_def Collect_conj_eq [symmetric] reachable_PLam_eq)\n    apply (auto simp add: constrains_def PLam_def)\n    apply (REPEAT (blast intro: reachable.intrs))\n    done\n\n\n\n    lemma PLam_Constrains:\n     \"[| i \\<in> I;  finite I;  f0: Init (PLam I F) |]\n          ==> (PLam I F \\<in> (lift_set i A) Co (lift_set i B)) =\n              (F i \\<in> A Co B)\"\n    apply (blast intro: Constrains_imp_PLam_Constrains PLam_Constrains_imp_Constrains)\n    done\n\n    lemma PLam_Stable:\n     \"[| i \\<in> I;  finite I;  f0: Init (PLam I F) |]\n          ==> (PLam I F \\<in> Stable (lift_set i A)) = (F i \\<in> Stable A)\"\n    apply (simp del: Init_PLam add: Stable_def PLam_Constrains)\n    done\n\n\n    (** const_PLam (no dependence on i) doesn't require the f0 premise **)\n\n    lemma const_PLam_Constrains:\n     \"[| i \\<in> I;  finite I |]\n          ==> ((plam x \\<in> I. F) \\<in> (lift_set i A) Co (lift_set i B)) =\n              (F \\<in> A Co B)\"\n    apply (blast intro: Constrains_imp_PLam_Constrains const_PLam_Constrains_imp_Constrains)\n    done\n\n    lemma const_PLam_Stable:\n     \"[| i \\<in> I;  finite I |]\n          ==> ((plam x \\<in> I. F) \\<in> Stable (lift_set i A)) = (F \\<in> Stable A)\"\n    apply (simp add: Stable_def const_PLam_Constrains)\n    done\n\n    lemma const_PLam_Increasing:\n         \"[| i \\<in> I;  finite I |]\n          ==> ((plam x \\<in> I. F) \\<in> Increasing (f o sub i)) = (F \\<in> Increasing f)\"\n    apply (unfold Increasing_def)\n    apply (subgoal_tac \"\\<forall>z. {s. z \\<subseteq> (f o sub i) s} = lift_set i {s. z \\<subseteq> f s}\")\n    apply (asm_simp_tac (simpset () add: lift_set_sub) 2)\n    apply (simp add: finite_lessThan const_PLam_Stable)\n    done\n**)\n\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/UNITY/PPROD.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6513548782017745, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3409323976297497}}
{"text": "theory CoronaAppOne\n  imports InfrastructureOne\nbegin\nlocale scenarioCoronaOne = scenarioCorona +\n\n  fixes corona_actorsO :: \"identity set\"\ndefines corona_actorsO_def: \"corona_actorsO \\<equiv> {''Alice'', ''Bob'', ''Charly'', ''David'', ''Eve'', ''Flo''}\"\n\nfixes corona_locationsO :: \"location set\"\ndefines corona_locationsO_def: \"corona_locationsO \\<equiv> {Location 0, Location 1}\"\nfixes pubO :: \"location\"\ndefines pubO_def: \"pubO \\<equiv> Location 0\"\nfixes shopO :: \"location\"\ndefines shopO_def: \"shopO \\<equiv> Location 1\"\n\n(* not relevant any more. It was made for earlier versions where the intersection happened\n   implicitly in the semantics. \nfixes identifiable :: \"[infrastructure,actor,efid, location] \\<Rightarrow> bool\"\ndefines identifiable_def: \"identifiable I a eid l\\<equiv> is_singleton{(Id,Eid). (Id, Eid) \\<in> kgra (graphI I) a l \\<and> Eid = eid}\"\nfixes global_policy :: \"[infrastructure, efid] \\<Rightarrow> bool\"\ndefines global_policy_def: \"global_policy I eid \\<equiv>  (\\<exists> l. \\<not>(identifiable I (Actor ''Eve'') eid l))\"\n*)\n\nfixes identifiableO' :: \"[efid, (identity * efid)set] \\<Rightarrow> bool\"\ndefines identifiableO'_def: \"identifiableO' eid A \\<equiv> is_singleton{(Id,Eid). (Id, Eid) \\<in> A \\<and> Eid = eid}\"\n\n(* This version is apparently different from the below global_policy'' where we use the image operator\nfixes global_policy' :: \"[infrastructure, efid] \\<Rightarrow> bool\"\ndefines global_policy'_def: \"global_policy' I eid \\<equiv>  \n             \\<not>(identifiable' eid \n                ((\\<Inter> {A. (\\<exists> l \\<in> nodes(graphI I). (A = (kgra(graphI I)(Actor ''Eve'') l)))})\n                 - {(x,y). x = ''Eve''}))\"\n*)\n\nfixes global_policyO'' :: \"[infrastructure, efid] \\<Rightarrow> bool\"\ndefines global_policyO''_def: \"global_policyO'' I eid \\<equiv>  \n             \\<not>(identifiableO' eid \n                ((\\<Inter> (kgra(graphI I)(''Eve'')`(nodes(graphI I))))\n                 - {(x,y). x = ''Eve''}))\"\n\nfixes global_policyO :: \"[infrastructure, efid] \\<Rightarrow> bool\"\ndefines global_policyO_def: \"global_policyO I eid \\<equiv>  \n             \\<forall> L. L \\<subseteq> nodes(graphI I) \\<longrightarrow> (\\<not>(identifiableO' eid \n               ((\\<Inter> (kgra(graphI I)(''Eve'')`L))\n                          - {(x,y). x = ''Eve''})))\"\n\nfixes ex_credsO :: \"identity \\<Rightarrow> efidlist\"\ndefines ex_credsO_def: \n          \"ex_credsO \\<equiv> (\\<lambda> x. if x = ''Alice'' then (Efids (Efid 1) 0 (\\<lambda> n. Efid (2^(n+1)))) else \n                            (if x = ''Bob'' then  (Efids (Efid 2) 0 (\\<lambda> n. Efid (3^(n+1)))) else \n                            (if x = ''Charly'' then (Efids (Efid 3) 0 (\\<lambda> n. Efid (5^(n+1)))) else\n                            (if x = ''David'' then (Efids (Efid 4) 0 (\\<lambda> n. Efid (7^(n+1)))) else\n                            (if x = ''Eve'' then (Efids (Efid 5) 0 (\\<lambda> n. Efid (11^(n+1)))) else \n                            (if x = ''Flo'' then (Efids (Efid 6) 0 (\\<lambda> n. Efid (13^(n+1)))) else \n                                 (Efids (Efid 0) 0 (\\<lambda> n. Efid (17^(n+1))))))))))\"\n\nfixes ex_locsO :: \"location \\<Rightarrow> string * (dlm * data) set\"\ndefines \"ex_locsO \\<equiv> (\\<lambda> x. ('''',{}))\"\n\nfixes ex_loc_assO :: \"location \\<Rightarrow> identity set\"\ndefines ex_loc_assO_def: \"ex_loc_assO \\<equiv>\n          (\\<lambda> x. if x = pubO then {''Alice'', ''Bob'', ''Eve''}  \n                 else (if x = shopO then {''Charly'', ''David'', ''Flo''} \n                       else {}))\"\nfixes ex_loc_assO' :: \"location \\<Rightarrow> identity set\"\ndefines ex_loc_assO'_def: \"ex_loc_assO' \\<equiv>\n          (\\<lambda> x. if x = pubO then {''Alice'', ''Eve''}  \n                 else (if x = shopO then { ''Bob'', ''Charly'', ''David'', ''Flo''} \n                       else {}))\"\nfixes ex_loc_assO'' :: \"location \\<Rightarrow> identity set\"\ndefines ex_loc_assO''_def: \"ex_loc_assO'' \\<equiv>\n          (\\<lambda> x. if x = pubO then {''Alice''}  \n                 else (if x = shopO then {''Eve'', ''Bob'', ''Charly'', ''David'', ''Flo''} \n                       else {}))\"\n\nfixes ex_efidsO :: \"location \\<Rightarrow> efid set\"\ndefines ex_efidsO_def: \"ex_efidsO \\<equiv> \n          (\\<lambda> x. if x = pubO then {Efid 2, Efid 3, Efid 11}\n                else (if x = shopO then {Efid 5, Efid 7, Efid 13}\n                      else {}))\"\n\nfixes ex_efidsO' :: \"location \\<Rightarrow> efid set\"\ndefines ex_efidsO'_def: \"ex_efidsO' \\<equiv> \n          (\\<lambda> x. if x = pubO then {Efid 2, Efid 11}\n                else (if x = shopO then {Efid 3, Efid 5, Efid 7, Efid 13}\n                      else {}))\"\n\nfixes ex_efidsO'' :: \"location \\<Rightarrow> efid set\"\ndefines ex_efidsO''_def: \"ex_efidsO'' \\<equiv> \n          (\\<lambda> x. if x = pubO then {Efid 2}\n                else (if x = shopO then {Efid 11, Efid 3, Efid 5, Efid 7, Efid 13}\n                      else {}))\"\n\nfixes ex_knosO :: \"identity \\<Rightarrow> location \\<Rightarrow> (identity * efid) set\"\ndefines ex_knosO_def: \"ex_knosO \\<equiv> (\\<lambda> x :: identity. \n                  (if x = ''Eve'' then (\\<lambda> l :: location. {} :: (identity * efid) set) \n                   else (\\<lambda> l :: location. {} :: (identity * efid) set)))\"\n\nfixes ex_knosO' :: \"identity \\<Rightarrow> location \\<Rightarrow> (identity * efid) set\"\ndefines ex_knosO'_def: \"ex_knosO' \\<equiv> (\\<lambda> x :: identity. \n                  (if x = ''Eve'' then \n                     (\\<lambda> l :: location.\n                        (if l = pubO then \n                                  ({(''Alice'', Efid 2),(''Alice'', Efid 3),(''Alice'', Efid 11),\n                                    (''Bob'', Efid 2),(''Bob'', Efid 3),(''Bob'', Efid 11),\n                                    (''Eve'', Efid 2),(''Eve'', Efid 3),(''Eve'', Efid 11)})\n                         else {})) \n                   else (\\<lambda> l :: location. {} :: (identity * efid) set)))\"\n\nfixes ex_knosO'' :: \"identity \\<Rightarrow> location \\<Rightarrow> (identity * efid) set\"\ndefines ex_knosO''_def: \"ex_knosO'' \\<equiv> (\\<lambda> x :: identity.                       \n                  (if x = ''Eve'' then \n                      (\\<lambda> l :: location.\n                           (if l = pubO then \n                                  ({(''Alice'', Efid 2),(''Alice'', Efid 3),(''Alice'', Efid 11),\n                                    (''Bob'', Efid 2),(''Bob'', Efid 3),(''Bob'', Efid 11),\n                                    (''Eve'', Efid 2),(''Eve'', Efid 3),(''Eve'', Efid 11)})\n                            else (if l = shopO then \n                                     ({(''Eve'', Efid 11),(''Eve'', Efid 3),(''Eve'', Efid 5),(''Eve'', Efid 7), (''Eve'', Efid 13),\n                                       (''Bob'', Efid 11),(''Bob'', Efid 3),(''Bob'', Efid 5),(''Bob'', Efid 7), (''Bob'', Efid 13),\n                                       (''Charly'', Efid 11),(''Charly'', Efid 3),(''Charly'', Efid 5),(''Charly'', Efid 7), (''Charly'', Efid 13),\n                                       (''David'', Efid 11),(''David'', Efid 3),(''David'', Efid 5),(''David'', Efid 7), (''David'', Efid 13),\n                                       (''Flo'', Efid 11),(''Flo'', Efid 3),(''Flo'', Efid 5),(''Flo'', Efid 7), (''Flo'', Efid 13)\n})\n                                   else {})))\n                   else (\\<lambda> l :: location. {} :: (identity * efid) set)))\"\n\n(* The nicer representation with case suffers from\n   not so nice presentation in the cases (need to unfold the syntax)  \nfixes ex_loc_ass_alt :: \"location \\<Rightarrow> identity set\"\ndefines ex_loc_ass_alt_def: \"ex_loc_ass_alt \\<equiv>\n          (\\<lambda> x.  (case x of \n             Location (Suc 0) \\<Rightarrow> {''Alice'', ''Bob'', ''Eve''}  \n           | Location (Suc (Suc 0)) \\<Rightarrow> {''Charly'', ''David''} \n           |  _ \\<Rightarrow> {}))\"\n*)\n\n(* initial *)\nfixes ex_graphO :: \"igraph\"\ndefines ex_graphO_def: \"ex_graphO \\<equiv> Lgraph {(pubO, shopO)} ex_loc_assO ex_credsO ex_locsO ex_efidsO ex_knosO\"\n\n(* Eve gets the ex_knos *)\nfixes ex_graphO' :: \"igraph\"\ndefines ex_graphO'_def: \"ex_graphO' \\<equiv> Lgraph {(pubO, shopO)} ex_loc_assO ex_credsO ex_locsO ex_efidsO ex_knosO'\"\n\n(* Bob goes to shop *)\nfixes ex_graphO'' :: \"igraph\"\ndefines ex_graphO''_def: \"ex_graphO'' \\<equiv> Lgraph {(pubO, shopO)} ex_loc_assO' ex_credsO ex_locsO ex_efidsO' ex_knosO'\"\n\n(* Eve goes to shop *)\nfixes ex_graphO''' :: \"igraph\"\ndefines ex_graphO'''_def: \"ex_graphO''' \\<equiv> Lgraph {(pubO, shopO)} ex_loc_assO'' ex_credsO ex_locsO ex_efidsO'' ex_knosO'\"\n\n(* Eve gets ex_knos at shop *)\nfixes ex_graphO'''' :: \"igraph\"\ndefines ex_graphO''''_def: \"ex_graphO'''' \\<equiv> Lgraph {(pubO, shopO)} ex_loc_assO'' ex_credsO ex_locsO ex_efidsO'' ex_knosO''\"\n\n(* Same as above: the nicer representation with case suffers from\n   not so nice presentation in the cases (need to unfold the syntax) \nfixes local_policies_alt :: \"[igraph, location] \\<Rightarrow> policy set\"\ndefines local_policies_alt_def: \"local_policies_alt G \\<equiv> \n    (\\<lambda> x. case x of \n         Location (Suc 0) \\<Rightarrow> {(\\<lambda> y. True, {put,get,move,eval})}\n       | Location 0 \\<Rightarrow> {((\\<lambda> y. has G (y, ''PIN'')), {put,get,move,eval})} \n       | Location (Suc (Suc (Suc 0))) \\<Rightarrow> {(\\<lambda> y. True, {put,get,move,eval})}\n       | Location (Suc (Suc 0)) \\<Rightarrow>\n                {((\\<lambda> y. (\\<exists> n. (n  @\\<^bsub>G\\<^esub> hospital) \\<and> Actor n = y \\<and> \n                           has G (y, ''skey''))), {put,get,move,eval})} \n       | _ \\<Rightarrow>  {})\"\n*)\n\nfixes local_policiesO :: \"[igraph, location] \\<Rightarrow> policy set\"\ndefines local_policiesO_def: \"local_policiesO G \\<equiv> \n    (\\<lambda> x. if x = pubO then  {(\\<lambda> y. True, {get,move,put})}\n          else (if x = shopO then {(\\<lambda> y. True, {get,move,put})} \n                else {}))\"\n\n(* problems with case in locales?\ndefines local_policies_def: \"local_policies G x \\<equiv> \n     (case x of \n       home \\<Rightarrow> {(\\<lambda> y. True, {put,get,move,eval})}\n     | sphone \\<Rightarrow> {((\\<lambda> y. has G (y, ''PIN'')), {put,get,move,eval})} \n     | cloud \\<Rightarrow> {(\\<lambda> y. True, {put,get,move,eval})}\n     | hospital \\<Rightarrow> {((\\<lambda> y. (\\<exists> n. (n  @\\<^bsub>G\\<^esub> hospital) \\<and> Actor n = y \\<and> \n                           has G (y, ''skey''))), {put,get,move,eval})} \n     | _ \\<Rightarrow>  {})\"\n*)\n\nfixes rmapO :: \"InfrastructureOne.infrastructure \\<Rightarrow> Infrastructure.infrastructure\"\ndefines rmapO_def:\n\"rmapO I \\<equiv> InfrastructureOne.ref_map I local_policies\"\n\nfixes corona_scenarioO :: \"infrastructure\"\ndefines corona_scenarioO_def:\n\"corona_scenarioO \\<equiv> Infrastructure ex_graphO local_policiesO\"\nfixes IcoronaO :: \"infrastructure set\"\ndefines IcoronaO_def:\n  \"IcoronaO \\<equiv> {corona_scenarioO}\"\n\n(* other states of scenario *)\n(* First step: Bob goes to shop *)\n\nfixes corona_scenarioO' :: \"infrastructure\"\ndefines corona_scenarioO'_def: \"corona_scenarioO' \\<equiv> Infrastructure ex_graphO' local_policiesO\"\nfixes CoronaO' :: \"infrastructure set\"\ndefines CoronaO'_def: \"CoronaO' \\<equiv> {corona_scenarioO'}\"\nfixes corona_scenarioO'' :: \"infrastructure\"\ndefines corona_scenarioO''_def: \"corona_scenarioO'' \\<equiv> Infrastructure ex_graphO'' local_policiesO\"\nfixes CoronaO'' :: \"infrastructure set\"\ndefines CoronaO''_def: \"CoronaO'' \\<equiv> {corona_scenarioO''}\"\nfixes corona_scenarioO''' :: \"infrastructure\"\ndefines corona_scenarioO'''_def: \"corona_scenarioO''' \\<equiv> Infrastructure ex_graphO''' local_policiesO\"\nfixes CoronaO''' :: \"infrastructure set\"\ndefines CoronaO'''_def: \"CoronaO''' \\<equiv> {corona_scenarioO'''}\"\nfixes corona_scenarioO'''' :: \"infrastructure\"\ndefines corona_scenarioO''''_def: \"corona_scenarioO'''' \\<equiv> Infrastructure ex_graphO'''' local_policiesO\"\nfixes CoronaO'''' :: \"infrastructure set\"\ndefines CoronaO''''_def: \"CoronaO'''' \\<equiv> {corona_scenarioO''''}\"\n\nfixes corona_statesO\ndefines corona_statesO_def: \"corona_statesO \\<equiv> { I. corona_scenarioO \\<rightarrow>\\<^sub>i* I }\"\nfixes corona_KripkeO\ndefines \"corona_KripkeO \\<equiv> Kripke corona_statesO IcoronaO\"\nfixes scoronaO \ndefines \"scoronaO \\<equiv> {x. \\<exists> n. \\<not> global_policyO'' x (Efid n)}\"  \nfixes scoronaO' \ndefines \"scoronaO' \\<equiv> {x. \\<exists> n. \\<not> global_policyO x (Efid n)}\"  \n\nbegin\n(* For the encoding of the efids as powers of primes we need some mathematical facts to \n   provide the foundations to show injectivity results. *)\nlemma powers_diff: \"n > 0 \\<Longrightarrow> x > 1 \\<Longrightarrow> (x :: nat)^n < x^(n+1)\"\n  by (meson less_add_one power_strict_increasing)\n\nlemma prime_powers_diff0: \"(m :: nat) > 0 \\<Longrightarrow> (n:: nat) > 0 \\<Longrightarrow> (p::nat) > 1 \\<Longrightarrow> (q:: nat)> 1 \\<Longrightarrow> \n                          coprime p q \\<Longrightarrow> p^n = q^m \\<Longrightarrow> p = q\"\n  by (metis One_nat_def coprime_1_right coprime_crossproduct_nat coprime_power_left_iff less_numeral_extra(4) one_less_power power_0 power_Suc power_one_right)\n\nlemma prime_powers_diff: \"(m :: nat) > 0 \\<Longrightarrow> (n:: nat) > 0 \\<Longrightarrow> (p::nat) > 1 \\<Longrightarrow> (q:: nat)> 1 \\<Longrightarrow> \n                          coprime p q \\<Longrightarrow> p \\<noteq> q \\<Longrightarrow> p^n \\<noteq> q^m\" \n  apply (erule contrapos_nn)\n  by (erule prime_powers_diff0)\n\nlemma Efid_eq: \"n \\<noteq> m \\<Longrightarrow> Efid n \\<noteq> Efid m\"\n  by simp\n\ndefinition prime:: \"nat \\<Rightarrow> bool\"\n  where\n  \"prime p \\<equiv> 1 < p \\<and> (\\<forall> x:: nat. x dvd p \\<longrightarrow> x = 1 \\<or> x = p)\"\n\nlemma primeI: \"1 < p \\<Longrightarrow> (\\<forall> x:: nat. x dvd p \\<longrightarrow> x = 1 \\<or> x = p) \\<Longrightarrow> prime p\"\n  by (unfold prime_def, simp)\n\nlemma prime_coprime: \"p \\<noteq> q \\<Longrightarrow> prime p \\<Longrightarrow> prime q \\<Longrightarrow> coprime p q\"\n  by (metis nat_dvd_1_iff_1 not_coprimeE scenarioCoronaOne.prime_def)\n\nlemma dvd_imp_le: \"0 < (n :: nat) \\<Longrightarrow> (q :: nat) dvd n \\<Longrightarrow> q \\<le> n\"\n  by (rule Nat.dvd_imp_le)\n\nlemma not_prime_div_primeOO: \"\\<forall> (n :: nat) > 1. (\\<exists> (q :: nat). q dvd n)\"\n  by blast \n\nlemma not_prime_div_primeO: \"\\<forall> (n :: nat) > 1. prime n \\<or> (\\<exists> (q :: nat) < n. prime q \\<and> q dvd n)\" \n  apply (rule allI)\n  apply (rule nat_less_induct)\n  by (metis dvd_pos_nat gcd_nat.strict_trans less_trans nat_dvd_not_less nat_neq_iff one_dvd scenarioCoronaOne.primeI zero_less_one)\n\nlemma not_prime_div_prime[rule_format]: \"\\<forall> (n :: nat) > 1. \\<not>(prime n) \\<longrightarrow> (\\<exists> (q :: nat) < n. prime q \\<and> q dvd n)\"\n by (insert not_prime_div_primeO, blast)\n\n(* need a simplifying lemma to enhance prime number checking*)\nlemma prime_check_upto_squareroot: \"1 < x \\<Longrightarrow> (\\<And> (q:: nat). q^2 \\<le> x \\<Longrightarrow> prime q \\<Longrightarrow> \\<not>(q dvd x)) \\<Longrightarrow> prime x\"\n  apply (rule primeI, assumption)\n  apply (rule allI, rule impI)\n  apply (subgoal_tac \"~(1 < xa \\<and> xa < x)\")\n   apply (metis One_nat_def Suc_leI dvdE dvd_imp_le le_neq_implies_less mult_eq_0_iff neq0_conv not_less_zero)\n  apply (rule notI)\n  apply (erule conjE)\n  apply (case_tac \"xa^2 \\<le> x\")\n(* *)\n   apply (case_tac \"prime xa\")\n    apply simp\n   apply (frule_tac n = xa in not_prime_div_prime, assumption)\n   apply (erule exE, erule conjE, erule conjE)\n   apply (subgoal_tac \"q dvd x\",simp)\n    apply (subgoal_tac \"q^2 \\<le> x\",simp)\n  apply (meson le_trans nat_le_linear not_less power2_nat_le_eq_le)\n  apply (erule dvd_trans,assumption)\n(* *)\n  apply (subgoal_tac \"? xb. xa * xb = x \\<and> xb^2 \\<le> x\")\n   prefer 2\n   apply (subgoal_tac \"\\<exists> k. x = xa * k\")\n    prefer 2\n    apply force\n   apply (erule exE)\n   apply (rule_tac x = k in exI)\n  apply (rule conjI, erule sym)\n   apply (subgoal_tac \"(xa * k)^2 > x\")\n    apply (subgoal_tac \"xa^2 > x\")\n     prefer 2\n  apply simp\n    apply (metis mult.commute mult_le_mono1 nat_le_linear power2_eq_square)\n   apply (metis nat_1_add_1 power_one_right scenarioCoronaOne.powers_diff zero_less_one)\n  apply (erule exE)\n  apply (erule conjE)\n  apply (subgoal_tac \"xb dvd x\")\n   prefer 2\n  apply force\n(* same proof as before *)\n   apply (case_tac \"prime xb\")\n   apply simp\n  apply (subgoal_tac \"1 < xb\")\n   prefer 2\n  apply (simp add: prime_def, force)\n   apply (frule_tac n = xb in not_prime_div_prime, assumption)\n   apply (erule exE, erule conjE, erule conjE)\n   apply (subgoal_tac \"q dvd x\",simp)\n    apply (subgoal_tac \"q^2 \\<le> x\",simp)\n  apply (meson le_trans nat_le_linear not_less power2_nat_le_eq_le)\nby (erule dvd_trans,assumption)\n\n\nlemma prime_2: \"prime 2\"\n  by (metis One_nat_def Suc_leI lessI not_less numeral_2_eq_2 scenarioCoronaOne.not_prime_div_prime scenarioCoronaOne.prime_def)\n(*\n  apply (rule prime_check_upto_squareroot)\n   apply simp\n  by (metis One_nat_def Suc_leI add_Suc_right less_irrefl less_le_trans nat_arith.rule0 numeral_2_eq_2 power2_eq_square power_one_right scenarioCoronaOne.powers_diff scenarioCoronaOne.prime_def zero_less_Suc)\n*)\n(*\n  by (smt (verit, ccfv_SIG) dvdE dvd_antisym dvd_triv_right even_mult_iff mult.commute mult_2 mult_cancel_left nat.simps(3) nat_1_add_1 numerals(2) scenarioCoronaOne.prime_def)\n*)\n  \nlemma prime_3: \"prime 3\"\n  by (metis (no_types, lifting) Nat.dvd_imp_le One_nat_def Suc_leI antisym le_neq_implies_less less_add_same_cancel2 numeral_2_eq_2 numeral_3_eq_3 numeral_Bit1 numerals(1) odd_numeral one_add_one prime_check_upto_squareroot scenarioCoronaOne.prime_def zero_less_Suc)\n\n\nlemma prime_5: \"prime 5\"\n  apply (rule prime_check_upto_squareroot)\n   apply simp\n  apply (subgoal_tac \"q = 2 \\<or> q = 3\")\n  using Groups.add_ac(2) apply auto[1]\n  apply (simp add: prime_def)\n  by (smt (z3) Groups.add_ac(2) One_nat_def Suc_leI add_Suc_right add_le_cancel_left add_left_cancel le_less_trans mult.commute mult_2 n_less_n_mult_m nat.simps(1) nat_arith.rule0 nat_le_linear nat_neq_iff not_less numeral.simps(2) numeral.simps(3) power2_eq_square times_nat.simps(2) zero_less_one)\n\nlemma prime_7: \"prime 7\"\n  apply (rule prime_check_upto_squareroot)\n   apply simp\n  apply (subgoal_tac \"q = 2\")\n  apply (smt (z3) Groups.add_ac(2) Suc3_eq_add_3 Suc_eq_numeral less_add_same_cancel2 mult.commute mult_2 mult_Suc_right not_less numeral.simps(2) numeral.simps(3) numeral_3_eq_3 numeral_nat(1) odd_numeral plus_nat.simps(2) power2_eq_square zero_less_Suc)\n  apply (simp add: prime_def)\n  by (smt (z3) Suc3_eq_add_3 Suc_leI add_mono_thms_linordered_semiring(1) le_less_trans le_neq_implies_less less_Suc_eq mult_Suc_right n_less_m_mult_n nat.simps(1) not_le numeral.simps(3) numeral_2_eq_2 numeral_3_eq_3 numeral_nat(1) plus_nat.simps(2) power2_eq_square)\n\nlemma prime_11: \"prime 11\"\n  apply (rule prime_check_upto_squareroot)\n   apply simp\n  apply (subgoal_tac \"q = 2 \\<or> q = 3\")\n  using Groups.add_ac(2) apply auto[1]\n  apply (simp add: prime_def)\n  by (smt (z3) Groups.add_ac(2) One_nat_def Suc_leI add_Suc_right add_le_cancel_left add_left_cancel le_less_trans mult.commute mult_2 n_less_n_mult_m nat.simps(1) nat_arith.rule0 nat_le_linear nat_neq_iff not_less numeral.simps(2) numeral.simps(3) power2_eq_square times_nat.simps(2) zero_less_one)\n\nlemma prime_13: \"prime 13\"\n  apply (rule prime_check_upto_squareroot)\n   apply simp\n  apply (subgoal_tac \"q = 2 \\<or> q = 3\")\n  using Groups.add_ac(2) apply auto[1]\n  apply (simp add: prime_def)\n  by (smt (z3) Groups.add_ac(2) One_nat_def Suc_leI add_Suc_right add_le_cancel_left add_left_cancel le_less_trans mult.commute mult_2 n_less_n_mult_m nat.simps(1) nat_arith.rule0 nat_le_linear nat_neq_iff not_less numeral.simps(2) numeral.simps(3) power2_eq_square times_nat.simps(2) zero_less_one)\n\n\nlemma square_le: \"(n :: nat) \\<le> m \\<Longrightarrow> n^2 \\<le> m^2\"\n  using power2_nat_le_eq_le by blast\n\nlemma five_sq: \"(5 :: nat)\\<^sup>2 = (25 :: nat)\"\n  by auto\n\nlemma fivelem: \"(5 :: nat) \\<le> (q :: nat) \\<Longrightarrow> (25 :: nat) \\<le> (q :: nat)^2\" \n  apply (subgoal_tac \"(5 :: nat)^2 = 25\")\n   apply (metis scenarioCoronaOne.square_le)\nby (rule five_sq)\n\nlemma q4_gr: \"(q :: nat) > 4 \\<Longrightarrow> q^2 > 17\"\n  apply (subgoal_tac \"5 \\<le> (q :: nat)\")\n  prefer 2\n   apply simp\n  apply (subgoal_tac \"(25 :: nat) \\<le> (q :: nat)^2\")\n  apply linarith\n  using scenarioCoronaOne.fivelem by auto\n\nlemma prime_17: \"prime 17\"\n  apply (rule prime_check_upto_squareroot)\n   apply simp\n  apply (subgoal_tac \"q = 2 \\<or> q = 3\")\n  using Groups.add_ac(2) apply auto[1]\n  apply (subgoal_tac \"q \\<le> 4\")\n  apply (simp add: prime_def)\n  apply (metis Suc_leI add_Suc_right antisym even_numeral le_neq_implies_less nat_arith.rule0 numeral_2_eq_2 numeral_3_eq_3 numeral_Bit0)\n  by (meson not_le scenarioCoronaOne.q4_gr)\n\nlemma coprime_sym: \"coprime a b \\<Longrightarrow> coprime b a\"\n  by (rule Rings.algebraic_semidom_class.coprime_imp_coprime)\n\n(* coprime lemmas for the first few primes *)\nlemma coprime_2_3: \"coprime (2:: nat) 3\"\n  apply  (rule prime_coprime)\n    apply simp\n  apply (rule prime_2)\n  by (rule prime_3)\n\nlemma coprime_3_2: \"coprime (3::nat) 2\"\n  by (rule coprime_sym, rule coprime_2_3)\n\nlemma coprime_2_13: \"coprime (2 :: nat) 13\"\n  apply  (rule prime_coprime)\n    apply simp\n  apply (rule prime_2)\n  by (rule prime_13)\n\nlemma coprime_13_2: \"coprime (13:: nat) 2\"\n  by (rule coprime_sym, rule coprime_2_13)\n\nlemma coprime_3_13: \"coprime (3:: nat) 13\"\n  apply  (rule prime_coprime)\n    apply simp\n  apply (rule prime_3)\n  by (rule prime_13)\n\nlemma coprime_13_3: \"coprime (13::nat) 3\"\n  by (rule coprime_sym, rule coprime_3_13)\n\nlemma coprime_5_2: \"coprime (5 :: nat) 2\"\n  apply (rule prime_coprime)\n    apply simp\n  apply (rule prime_5)\n  by (rule prime_2)\n\nlemma coprime_2_5: \"coprime (2 :: nat) 5\"\n  by (rule coprime_sym, rule coprime_5_2)\n\nlemma coprime_5_3: \"coprime (5 :: nat) 3\"\n  apply (rule prime_coprime)\n    apply simp\n  apply (rule prime_5)\n  by (rule prime_3)\n\nlemma coprime_3_5: \"coprime 3 (5 :: nat)\"\n  by (rule coprime_sym, rule coprime_5_3)\n\nlemma coprime_5_11: \"coprime (5:: nat) 11\"\n  apply (rule prime_coprime)\n    apply simp\n  apply (rule prime_5)\n  by (rule prime_11)\n\nlemma coprime_5_13: \"coprime (5:: nat) 13\"\n  apply (rule prime_coprime)\n    apply simp\n  apply (rule prime_5)\n  by (rule prime_13)\n\nlemma coprime_13_5: \"coprime (13:: nat) 5\"\n  by (rule coprime_sym, rule coprime_5_13)\n\nlemma coprime_7_2: \"coprime (7 :: nat)(2 :: nat)\"\n  apply (rule prime_coprime)\n    apply simp\n  apply (rule prime_7)\n  by (rule prime_2)\n\nlemma coprime_2_7: \"coprime (2 :: nat) 7\"\n  by (rule coprime_sym, rule coprime_7_2)\n\nlemma coprime_7_3: \"coprime (7 :: nat)(3 :: nat)\"\n  apply (rule prime_coprime)\n    apply simp\n  apply (rule prime_7)\n  by (rule prime_3)\n\nlemma coprime_3_7: \"coprime (3 :: nat) 7\"\n  by (rule coprime_sym, rule coprime_7_3)\n\n\nlemma coprime_7_5: \"coprime (7 :: nat)(5 :: nat)\"\n  apply (rule prime_coprime)\n    apply simp\n  apply (rule prime_7)\n  by (rule prime_5)\n\nlemma coprime_5_7: \"coprime (5::nat)(7::nat)\"\n  by (rule coprime_sym, rule coprime_7_5)\n\nlemma coprime_7_13: \"coprime (7 :: nat)(13 :: nat)\"\n  apply (rule prime_coprime)\n    apply simp\n  apply (rule prime_7)\n  by (rule prime_13)\n\nlemma coprime_13_7: \"coprime (13:: nat) 7\"\n  by (rule coprime_sym, rule coprime_7_13)\n\nlemma coprime_11_7: \"coprime (11 :: nat) (7:: nat)\"\n  apply (rule prime_coprime)\n    apply simp\n  apply (rule prime_11)\n  by (rule prime_7)\n\nlemma coprime_7_11: \"coprime (7:: nat) 11\"\n  by (rule coprime_sym, rule coprime_11_7)\n\n\nlemma coprime_11_5: \"coprime (11 :: nat) 5\"\n  apply (rule prime_coprime)\n    apply simp\n  apply (rule prime_11)\n  by (rule prime_5)\n\nlemma coprime_11_3: \"coprime (11 :: nat)(3::nat)\"\n  apply (rule prime_coprime)\n    apply arith\n  apply (rule prime_11)\n  by (rule prime_3)\n\nlemma coprime_3_11: \"coprime (3 :: nat) 11\"\n  by (rule coprime_sym, rule coprime_11_3)\n\nlemma coprime_11_2: \"coprime (11:: nat)(2::nat)\"\n  apply (rule prime_coprime)\n    apply arith\n  apply (rule prime_11)\n  by (rule prime_2)\n\nlemma coprime_2_11: \"coprime (2 :: nat) 11\"\n  by (rule coprime_sym, rule coprime_11_2)\n\nlemma coprime_11_13: \"coprime (11 :: nat) 13\"\n  apply (rule prime_coprime)\n    apply arith\n  apply (rule prime_11)\n  by (rule prime_13)\n\nlemma coprime_13_11: \"coprime (13:: nat) 11\"\n  by (rule coprime_sym, rule coprime_11_13)\n\nlemma coprime_2_17: \"coprime (2:: nat) 17\"\n  apply (rule prime_coprime)\n    apply arith\n  apply (rule prime_2)\n  by (rule prime_17)\n\nlemma coprime_17_2: \"coprime (17:: nat) 2\"\n  by (rule coprime_sym, rule coprime_2_17)\n\nlemma coprime_3_17: \"coprime (3:: nat) 17\"\n  apply (rule prime_coprime)\n    apply arith\n  apply (rule prime_3)\n  by (rule prime_17)\n\nlemma coprime_17_3: \"coprime (17:: nat) 3\"\n  by (rule coprime_sym, rule coprime_3_17)\n\nlemma coprime_5_17: \"coprime (5:: nat) 17\"\n  apply (rule prime_coprime)\n    apply arith\n  apply (rule prime_5)\n  by (rule prime_17)\n\nlemma coprime_17_5: \"coprime (17:: nat) 5\"\n  by (rule coprime_sym, rule coprime_5_17)\n\nlemma coprime_7_17: \"coprime (7:: nat) 17\"\n  apply (rule prime_coprime)\n    apply arith\n  apply (rule prime_7)\n  by (rule prime_17)\n\nlemma coprime_17_7: \"coprime (17:: nat) 7\"\n  by (rule coprime_sym, rule coprime_7_17)\n\nlemma coprime_11_17: \"coprime (11:: nat) 17\"\n  apply (rule prime_coprime)\n    apply arith\n  apply (rule prime_11)\n  by (rule prime_17)\n\nlemma coprime_17_11: \"coprime (17:: nat) 11\"\n  by (rule coprime_sym, rule coprime_11_17)\n\nlemma coprime_13_17: \"coprime (13:: nat) 17\"\n  apply (rule prime_coprime)\n    apply arith\n  apply (rule prime_13)\n  by (rule prime_17)\n\nlemma coprime_17_13: \"coprime (17:: nat) 13\"\n  by (rule coprime_sym, rule coprime_13_17)\n\n\n\n\nlemma coprime_range_disjointO: \n\"coprime p q \\<Longrightarrow> 1 < p \\<Longrightarrow> 1 < q \\<Longrightarrow> \\<exists>z. z \\<in> range (\\<lambda>x. Efid (p ^ (x + 1))) \\<and> z \\<in> range (\\<lambda>x. Efid (q ^ (x + 1))) \\<Longrightarrow> False\"\n  apply (erule exE, erule conjE, erule rangeE, erule rangeE)\n  apply (subgoal_tac \"Efid (p ^ (x + 1)) \\<noteq>  Efid (q ^ (xa + 1))\")\n   apply (erule notE, simp)\n  apply (rule Efid_eq)\n  apply (rule prime_powers_diff)\n  apply simp+\n  by (metis coprime_Suc_0_right coprime_crossproduct_nat less_not_refl3 mult.commute)\n\n\nlemma coprime_range_disjoint: \n  assumes \"coprime (p :: nat) (q :: nat)\" and \"1 < p\" and \"1 < q\"\n  shows \"range (\\<lambda>(x :: nat). Efid (p ^ (x + 1))) \\<inter> range (\\<lambda>x. Efid (q  ^ (x + 1))) = {}\"\nproof -\n  have a: \"coprime (p :: nat) (q :: nat) \\<Longrightarrow> 1 < p \\<Longrightarrow> 1 < q \\<Longrightarrow>\n                   (\\<exists> z. z \\<in> range (\\<lambda>(x :: nat). Efid (p ^ (x + 1))) \\<and> z \\<in> range (\\<lambda>x. Efid (q  ^ (x + 1))))\n                    \\<Longrightarrow> False\" \n  proof - \n    show \"coprime p q \\<Longrightarrow>\n    1 < p \\<Longrightarrow> 1 < q \\<Longrightarrow> \\<exists>z. z \\<in> range (\\<lambda>x. Efid (p ^ (x + 1))) \\<and> z \\<in> range (\\<lambda>x. Efid (q ^ (x + 1))) \\<Longrightarrow> False \"\n      by (rule coprime_range_disjointO)\n  qed\n    then have \"coprime (p :: nat) (q :: nat) \\<Longrightarrow> 1 < p \\<Longrightarrow> 1 < q \\<Longrightarrow>\n                   \\<not>(\\<exists> z. z \\<in> range (\\<lambda>(x :: nat). Efid (p ^ (x + 1))) \\<and> z \\<in> range (\\<lambda>x. Efid (q  ^ (x + 1))))\" \n    by (rule notI) \n  from this and assms show ?thesis by auto\nqed\n\nlemma coprime_range_disjointOO: \n  \"coprime (p :: nat) (q :: nat) \\<Longrightarrow> 1 < p \\<Longrightarrow>1 < q \\<Longrightarrow>\n  range (\\<lambda>(x :: nat). Efid (p * p ^ x)) \\<inter> range (\\<lambda>x. Efid (q * q ^ x)) = {}\"\n  by (drule coprime_range_disjoint, assumption+, simp)\n\n\n(* actor invariants for example *)\nlemma all_actors: \"actors_graph(graphI corona_scenarioO) = corona_actorsO\"\nproof (simp add: corona_scenarioO_def corona_actorsO_def ex_graphO_def actors_graph_def nodes_def\n                 ex_loc_assO_def, rule equalityI)\n  show \"{x. \\<exists>y. (y = shopO \\<longrightarrow>\n             (shopO = pubO \\<longrightarrow> x = ''Alice'' \\<or> x = ''Bob'' \\<or> x = ''Eve'') \\<and>\n             (shopO \\<noteq> pubO \\<longrightarrow> x = ''Charly'' \\<or> x = ''David'' \\<or> x = ''Flo'')) \\<and>\n            (y \\<noteq> shopO \\<longrightarrow>\n             (y = pubO \\<longrightarrow> (\\<exists>y. y = shopO \\<or> y = pubO \\<and> pubO = shopO) \\<and> (x = ''Alice'' \\<or> x = ''Bob'' \\<or> x = ''Eve'')) \\<and>\n             y = pubO)}\n    \\<subseteq> {''Alice'', ''Bob'', ''Charly'', ''David'', ''Eve'', ''Flo''}\"\n    by auto\nnext show \"{''Alice'', ''Bob'', ''Charly'', ''David'', ''Eve'', ''Flo''}\n    \\<subseteq> {x. \\<exists>y. (y = shopO \\<longrightarrow>\n                (shopO = pubO \\<longrightarrow> x = ''Alice'' \\<or> x = ''Bob'' \\<or> x = ''Eve'') \\<and>\n                (shopO \\<noteq> pubO \\<longrightarrow> x = ''Charly'' \\<or> x = ''David'' \\<or> x = ''Flo'')) \\<and>\n               (y \\<noteq> shopO \\<longrightarrow>\n                (y = pubO \\<longrightarrow> (\\<exists>y. y = shopO \\<or> y = pubO \\<and> pubO = shopO) \\<and> (x = ''Alice'' \\<or> x = ''Bob'' \\<or> x = ''Eve'')) \\<and>\n                y = pubO)}\"\n    using pubO_def shopO_def by auto\nqed\n\nlemma all_corona_actors: \"(corona_scenarioO, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \n              \\<Longrightarrow> actors_graph(graphI y) = corona_actorsO\"\n  using all_actors same_actors by auto\n\n(* nodes invariants *)\nlemma same_nodes: \"(corona_scenarioO, s) \\<in> {(x::InfrastructureOne.infrastructure, y::InfrastructureOne.infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\n\\<Longrightarrow> InfrastructureOne.nodes (graphI corona_scenarioO) = InfrastructureOne.nodes (graphI s)\"\nby (erule same_nodes)\n\n(* efids invariants *)\n\nlemma isthere_lem00: \" a \\<in>  agra (graphI corona_scenarioO) l \\<Longrightarrow> l \\<in> nodes (graphI corona_scenarioO) \\<Longrightarrow>\n            efids_cur (cgra (graphI corona_scenarioO) a) \\<in> egra (graphI corona_scenarioO) l\"\n  apply (simp add: corona_scenarioO_def ex_graphO_def ex_loc_assO_def nodes_def ex_credsO_def ex_efidsO_def\n             shopO_def pubO_def)\n  by (smt One_nat_def char.inject insertE list.inject location.inject mem_Collect_eq n_not_Suc_n shopO_def singleton_conv)\n\nlemma isthere_lem': \"(corona_scenarioO, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow> a \\<in>  agra (graphI s) l  \\<Longrightarrow>\nefids_cur (InfrastructureOne.cgra (graphI s) a) \\<in> egra (graphI s) l\"\n  apply (erule rtrancl_induct)\n  oops\n\nlemma efids_root_lem: \"a \\<in> actors_graph (InfrastructureOne.graphI corona_scenarioO) \\<Longrightarrow> \n                      a' \\<in> actors_graph (InfrastructureOne.graphI corona_scenarioO) \\<Longrightarrow>\n                 a \\<noteq> a' \\<Longrightarrow>\n                  efids_root (cgra (InfrastructureOne.graphI corona_scenarioO) a) \\<noteq> \n                  efids_root (cgra (InfrastructureOne.graphI corona_scenarioO) a')\"\n    apply (simp add: rmapO_def ref_map_def move_graph_a_def  corona_scenarioO_def Infrastructure.move_graph_a_def)\n  apply (simp add: repl_efr_def ex_graphO_def ex_credsO_def)\n  by (smt CollectD InfrastructureOne.actors_graph_def InfrastructureOne.agra.simps InfrastructureOne.gra.simps InfrastructureOne.nodes_def ex_loc_assO_def insertE prod.inject singletonD)\n\n\nlemma efids_root_minus: \"(corona_scenarioO, I) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \n      \\<Longrightarrow> a \\<in> InfrastructureOne.agra (InfrastructureOne.graphI I) l \n      \\<Longrightarrow> l \\<in> InfrastructureOne.nodes (InfrastructureOne.graphI I)  \\<Longrightarrow>\n(\\<lambda>x. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) x)) `\n       (InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a}) =\n       (\\<lambda>a. efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)) `\n       InfrastructureOne.agra (InfrastructureOne.graphI I) l -\n       {efids_root (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)}\"\n  apply auto\n  apply (frule eroots_inj_on_inv)\n  using efids_root_lem inj_on_def apply blast\n  by (metis (mono_tags, lifting) InfrastructureOne.actors_graph_def inj_on_def mem_Collect_eq)\n\n\ntext \\<open>Other invariants are that the efids at egra l are in fact efids of the actors at\n      that location, i.e. \n       e \\<in> egra G l = (\\<exists>! a \\<in> agra G l.  e \\<in> efid_list (cgra G a) (for InfrastructureOne))\n                      .....        /\\ e = efid_root (cgra G a) \n      \n      \\<close>\n(* We need to develop the starting points for the invariants that are needed to unleash the\n   lemma is_there_lem needed in the get case.*)\nlemma range_disjoint_corona_scenarioO[rule_format]: \"(\\<forall> a \\<in> actors_graph (InfrastructureOne.graphI corona_scenarioO). \n   (\\<forall> a' \\<in> actors_graph(InfrastructureOne.graphI corona_scenarioO). a \\<noteq> a' \\<longrightarrow>\n     ((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI corona_scenarioO) a)) \\<inter> \n      (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI corona_scenarioO) a')))) = {})))\"\nproof (unfold corona_scenarioO_def ex_graphO_def ex_credsO_def, simp)\n  show \"\\<forall>a\\<in>InfrastructureOne.actors_graph\n         (InfrastructureOne.igraph.Lgraph {(pubO, shopO)} ex_loc_assO\n           (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                     else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                          else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                               else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                    else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                         else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n           ex_locsO ex_efidsO ex_knosO).\n       (a = ''Flo'' \\<longrightarrow>\n        (\\<forall>a'\\<in>InfrastructureOne.actors_graph\n               (InfrastructureOne.igraph.Lgraph {(pubO, shopO)} ex_loc_assO\n                 (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                      else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                           else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                     else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                          else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                               else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                 ex_locsO ex_efidsO ex_knosO).\n            (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n            (a' \\<noteq> ''Eve'' \\<longrightarrow>\n             (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n             (a' \\<noteq> ''David'' \\<longrightarrow>\n              (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n              (a' \\<noteq> ''Charly'' \\<longrightarrow>\n               (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n               (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                (a' \\<noteq> ''Alice'' \\<longrightarrow>\n                 ''Flo'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n       (a \\<noteq> ''Flo'' \\<longrightarrow>\n        (a = ''Eve'' \\<longrightarrow>\n         (\\<forall>a'\\<in>InfrastructureOne.actors_graph\n                (InfrastructureOne.igraph.Lgraph {(pubO, shopO)} ex_loc_assO\n                  (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                       else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                            else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                 else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                      else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                           else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                  ex_locsO ex_efidsO ex_knosO).\n             (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n             (a' \\<noteq> ''Flo'' \\<longrightarrow>\n              (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n              (a' \\<noteq> ''David'' \\<longrightarrow>\n               (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n               (a' \\<noteq> ''Charly'' \\<longrightarrow>\n                (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n                (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                 (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''Alice'' \\<longrightarrow>\n                  ''Eve'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n        (a \\<noteq> ''Eve'' \\<longrightarrow>\n         (a = ''David'' \\<longrightarrow>\n          (\\<forall>a'\\<in>InfrastructureOne.actors_graph\n                 (InfrastructureOne.igraph.Lgraph {(pubO, shopO)} ex_loc_assO\n                   (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                        else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                             else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                  else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                       else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                            else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                 else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                   ex_locsO ex_efidsO ex_knosO).\n              (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n              (a' \\<noteq> ''Flo'' \\<longrightarrow>\n               (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n               (a' \\<noteq> ''Eve'' \\<longrightarrow>\n                (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n                (a' \\<noteq> ''Charly'' \\<longrightarrow>\n                 (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                  (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                  (a' \\<noteq> ''Alice'' \\<longrightarrow>\n                   ''David'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n         (a \\<noteq> ''David'' \\<longrightarrow>\n          (a = ''Charly'' \\<longrightarrow>\n           (\\<forall>a'\\<in>InfrastructureOne.actors_graph\n                  (InfrastructureOne.igraph.Lgraph {(pubO, shopO)} ex_loc_assO\n                    (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                         else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                              else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                   else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                        else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                             else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                  else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                    ex_locsO ex_efidsO ex_knosO).\n               (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n               (a' \\<noteq> ''Flo'' \\<longrightarrow>\n                (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n                (a' \\<noteq> ''Eve'' \\<longrightarrow>\n                 (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''David'' \\<longrightarrow>\n                  (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n                  (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                   (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                   (a' \\<noteq> ''Alice'' \\<longrightarrow>\n                    ''Charly'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n          (a \\<noteq> ''Charly'' \\<longrightarrow>\n           (a = ''Bob'' \\<longrightarrow>\n            (\\<forall>a'\\<in>InfrastructureOne.actors_graph\n                   (InfrastructureOne.igraph.Lgraph {(pubO, shopO)} ex_loc_assO\n                     (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                          else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                               else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                    else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                         else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                              else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                   else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                     ex_locsO ex_efidsO ex_knosO).\n                (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n                (a' \\<noteq> ''Flo'' \\<longrightarrow>\n                 (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''Eve'' \\<longrightarrow>\n                  (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n                  (a' \\<noteq> ''David'' \\<longrightarrow>\n                   (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n                   (a' \\<noteq> ''Charly'' \\<longrightarrow>\n                    (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                    (a' \\<noteq> ''Alice'' \\<longrightarrow>\n                     ''Bob'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n           (a \\<noteq> ''Bob'' \\<longrightarrow>\n            (a = ''Alice'' \\<longrightarrow>\n             (\\<forall>a'\\<in>InfrastructureOne.actors_graph\n                    (InfrastructureOne.igraph.Lgraph {(pubO, shopO)} ex_loc_assO\n                      (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                           else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                                else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                     else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                          else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                               else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                    else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                      ex_locsO ex_efidsO ex_knosO).\n                 (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''Flo'' \\<longrightarrow>\n                  (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n                  (a' \\<noteq> ''Eve'' \\<longrightarrow>\n                   (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n                   (a' \\<noteq> ''David'' \\<longrightarrow>\n                    (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n                    (a' \\<noteq> ''Charly'' \\<longrightarrow>\n                     (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n                     (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                      ''Alice'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n            (a \\<noteq> ''Alice'' \\<longrightarrow>\n             (\\<forall>a'\\<in>InfrastructureOne.actors_graph\n                    (InfrastructureOne.igraph.Lgraph {(pubO, shopO)} ex_loc_assO\n                      (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                           else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                                else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                     else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                          else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                               else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                    else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                      ex_locsO ex_efidsO ex_knosO).\n                 (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''Flo'' \\<longrightarrow>\n                  (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n                  (a' \\<noteq> ''Eve'' \\<longrightarrow>\n                   (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n                   (a' \\<noteq> ''David'' \\<longrightarrow>\n                    (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n                    (a' \\<noteq> ''Charly'' \\<longrightarrow>\n                     (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n                     (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                      (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                      (a' \\<noteq> ''Alice'' \\<longrightarrow> a = a')))))))))))))\"\n    apply (rule ballI)+\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_13_11, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_13_7, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_13_5, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_13_3, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_13_2, simp, simp)\n     apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n        apply (rule coprime_13_17, simp, simp)\n    apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_11_13, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_11_7, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_11_5, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n        apply (rule coprime_11_3, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n        apply (rule coprime_11_2, arith, arith)\n     apply (rule impI)+\n     apply (rule coprime_range_disjointOO)\n    apply (rule coprime_11_17, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_13, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_11, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_5, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_3, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_2, arith, arith)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_17, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_13, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_11, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_7, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_3, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_2, arith, arith)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_17, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_13, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_11, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_7, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_5, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_2, arith, arith)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_17, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_13, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_11, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_7, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_5, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_3, arith, arith)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_17, arith, arith)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n     apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_13, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_11, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n     apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_7, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_5, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_3, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n     apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_2, arith, arith)\n     apply (rule impI)+\n    by (smt (z3) InfrastructureOne.actors_graph_def InfrastructureOne.agra.simps all_not_in_conv ex_loc_assO_def insertE mem_Collect_eq)\nqed\n\nlemma inj_on_corona_scenarioO: \"inj_on (\\<lambda>x. efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI corona_scenarioO) x))\n        (InfrastructureOne.actors_graph (InfrastructureOne.graphI corona_scenarioO))\"\n  by (simp add: corona_scenarioO_def inj_on_def ex_graphO_def ex_knosO_def pubO_def shopO_def\n                   ex_loc_assO_def ex_credsO_def ex_locsO_def ex_efidsO_def actors_graph_def)\n \n\nlemma l_eq_corona_scenarioO[rule_format]: \"(\\<forall> l l'. l \\<in> nodes (graphI corona_scenarioO) \\<longrightarrow>\n                a \\<in>  agra (graphI corona_scenarioO) l \\<longrightarrow>  a \\<in>  agra (graphI corona_scenarioO) l' \\<longrightarrow> l = l')\"\n  by (simp add: corona_scenarioO_def ex_graphO_def ex_loc_assO_def nodes_def)\n\nlemma coronaO_efids_list_inj: \n\"a \\<in> actors_graph(InfrastructureOne.graphI corona_scenarioO) \\<Longrightarrow> \ninj (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI corona_scenarioO) a))\"\n  by (simp add: corona_scenarioO_def ex_graphO_def ex_loc_assO_def nodes_def\n                    ex_credsO_def ex_locsO_def ex_efidsO_def ex_knosO_def pubO_def shopO_def inj_def)\n\nlemma efid_in_range_corona_scenarioO: \"(\\<forall> l \\<in> nodes (graphI corona_scenarioO).\n         (\\<forall> e \\<in> (egra (InfrastructureOne.graphI corona_scenarioO) l).\n         (\\<exists> a \\<in> actors_graph (graphI corona_scenarioO). \n             e \\<in> range (efids_list (InfrastructureOne.cgra (graphI corona_scenarioO) a)))))\"\n  apply (simp add: corona_scenarioO_def ex_graphO_def nodes_def)\n  apply (rule allI)\n   apply (rule impI)+\n   apply (rule ballI)\n  apply (simp add: ex_efidsO_def actors_graph_def ex_loc_assO_def)\n  apply (erule exE)\n  apply (erule disjE)\n   apply (simp add: pubO_def shopO_def ex_credsO_def nodes_def)\n   apply (erule disjE)\n    apply (rule_tac x = \"''Alice''\" in exI)\n  apply simp\n    apply blast\n   apply (erule disjE)\n  apply (rule_tac x = \"''Bob''\" in exI)\n  apply simp\n    apply blast\n   apply (rule_tac x = \"''Eve''\" in exI)\n  apply simp\n    apply blast\n   apply (simp add: pubO_def shopO_def ex_credsO_def nodes_def)\n   apply (erule disjE)\n   apply (rule_tac x = \"''Charly''\" in exI)\n  apply simp\n   apply (erule disjE)\n   apply (rule_tac x = \"''David''\" in exI)\n  apply simp\n  apply (rule_tac x = \"''Flo''\" in exI)\n  by simp\n\nlemma efid_kgra_in_range_corona_scenarioO: \"(\\<forall> l \\<in> InfrastructureOne.nodes (InfrastructureOne.graphI corona_scenarioO). \n         (\\<forall> h \\<in> InfrastructureOne.actors_graph(InfrastructureOne.graphI corona_scenarioO).\n         (\\<forall> e \\<in> (snd`((InfrastructureOne.kgra (InfrastructureOne.graphI corona_scenarioO) h l))).\n         (\\<exists> a \\<in> InfrastructureOne.actors_graph (InfrastructureOne.graphI corona_scenarioO). \n           e \\<in> range (InfrastructureOne.efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI corona_scenarioO) a))))))\"\n  by (simp add: corona_scenarioO_def ex_graphO_def nodes_def\n                 ex_credsO_def ex_locsO_def ex_efidsO_def ex_knosO_def pubO_def shopO_def)\n\nlemma efid_eq_efid_cur_corona_scenarioO: \"lb \\<in> InfrastructureOne.nodes (InfrastructureOne.graphI corona_scenarioO) \\<Longrightarrow>\n       e \\<in> InfrastructureOne.egra (InfrastructureOne.graphI corona_scenarioO) lb \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureOne.agra (InfrastructureOne.graphI corona_scenarioO) lb.\n          e = efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI corona_scenarioO) a)\"\n  apply (simp add: corona_scenarioO_def ex_graphO_def nodes_def ex_loc_assO_def \n                 ex_credsO_def ex_locsO_def ex_efidsO_def ex_knosO_def pubO_def shopO_def)\n  using shopO_def by fastforce\n\n\nlemma anonymous_actor_corona_scenarioO: \" lb \\<in> InfrastructureOne.nodes (InfrastructureOne.graphI corona_scenarioO) \\<Longrightarrow>\n       e \\<in> InfrastructureOne.egra (InfrastructureOne.graphI corona_scenarioO) lb \\<Longrightarrow>\n       anonymous_actor corona_scenarioO e \\<in> InfrastructureOne.agra (InfrastructureOne.graphI corona_scenarioO) lb\"\n  thm anonymous_actor_def1a\n    apply (subgoal_tac \"InfrastructureOne.actors_graph (InfrastructureOne.graphI corona_scenarioO) \\<noteq> {}\")\n   apply (drule_tac e = e in anonymous_actor_def1a)\n  prefer 6\n  using efid_in_range_corona_scenarioO apply force\n      prefer 5\n      apply (erule conjE)\n      apply (simp add: actors_graph_def)\n      apply (erule exE)\n      apply (erule conjE)\n  apply (metis (no_types, lifting) InfrastructureOne.actors_graph_def efid_eq_efid_cur_corona_scenarioO efids_cur_efids_list_actor_unique mem_Collect_eq range_disjoint_corona_scenarioO)\n\n  using coronaO_efids_list_inj apply blast\n      apply (simp add: range_disjoint_corona_scenarioO, assumption)\n  by (simp add: efid_in_range_corona_scenarioO)\n\nlemma refmapOne_lem: \"\\<forall>s::InfrastructureOne.infrastructure.\n       (corona_scenarioO, s) \\<in> {(x::InfrastructureOne.infrastructure, y::InfrastructureOne.infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<longrightarrow>\n       (\\<forall>s'::InfrastructureOne.infrastructure. s \\<rightarrow>\\<^sub>n s' \\<longrightarrow> rmapO s \\<rightarrow>\\<^sub>n rmapO s')\"\nproof (clarify, frule same_nodes, frule init_state_policy, erule state_transition_in.cases)\n  show \"\\<And>s s' G I a l l' I'.\n       (corona_scenarioO, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureOne.nodes (InfrastructureOne.graphI corona_scenarioO) =\n       InfrastructureOne.nodes (InfrastructureOne.graphI s) \\<Longrightarrow>\n       InfrastructureOne.delta corona_scenarioO = InfrastructureOne.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureOne.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureOne.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureOne.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureOne.actors_graph (InfrastructureOne.graphI I) \\<Longrightarrow>\n       InfrastructureOne.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI I))\n        (InfrastructureOne.delta I) \\<Longrightarrow>\n       rmapO s \\<rightarrow>\\<^sub>n rmapO s'\"\n    apply (subgoal_tac \"(\\<forall> a \\<in> actors_graph (InfrastructureOne.graphI s). \n(\\<forall> a' \\<in> actors_graph(InfrastructureOne.graphI s). a \\<noteq> a' \\<longrightarrow>\n((range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI s) a)) \\<inter> \n (range (efids_list (InfrastructureOne.cgra (InfrastructureOne.graphI s) a')))) = {})))\")\n    prefer 2\n     apply (simp add: ran_efids_list_disjoint_refl range_disjoint_corona_scenarioO)\n  apply (rule_tac I = \"rmapO s\" and I' = \"rmapO s'\" and l = l and l' = l' \n                             and a = a \n in Infrastructure.state_transition_in.move)\n  apply (rule refl)\n         apply (simp add: rmapO_def ref_map_def atI_def Infrastructure.atI_def)\n         apply (simp add: rmapO_def ref_map_def nodes_def Infrastructure.nodes_def)\n         apply (simp add: rmapO_def ref_map_def nodes_def Infrastructure.nodes_def)\n      apply (simp add: rmapO_def ref_map_def actors_graph_def Infrastructure.actors_graph_def)\n    apply (simp add: Infrastructure.nodes_def InfrastructureOne.nodes_def)\n      apply (simp add: nodes_def Infrastructure.nodes_def atI_def rmapO_def local_policies_def)\n(* *)\n     apply (simp add: rmapO_def ref_map_def enables_def Infrastructure.enables_def)\n     apply (erule bexE)\n    apply (case_tac x, simp, erule conjE)\n  apply (rule_tac x = x in bexI, simp)\n     apply(simp add: local_policies_def shop_def pub_def atI_def)\n    apply (smt InfrastructureOne.delta.simps One_nat_def corona_scenarioO_def empty_iff local_policiesO_def prod.inject pubO_def shopO_def singletonD)\n(* *)\n    apply (simp add: rmapO_def ref_map_def  corona_scenarioO_def InfrastructureOne.move_graph_a_def\n                     Infrastructure.move_graph_a_def)\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (erule conjE)\n     apply (rule conjI)\n      apply (rule ext,simp)\n    apply (rule conjI)\n      apply (rule impI)\n      apply (rule conjI)\n    apply (rule impI)\n       apply simp\n      apply (rule impI)\n    thm repl_efr_def\n      apply (unfold repl_efr_def) \n      apply (simp add: corona_scenarioO_def efids_root_minus)\n      apply blast \n    apply (rule ext_ifte)\n    apply (smt (z3) Collect_cong Diff_iff InfrastructureOne.actors_graph_def InfrastructureOne.agra.simps InfrastructureOne.gra.simps InfrastructureOne.nodes_def fun_upd_apply insert_iff singletonD)\n    apply simp\n     apply (rule ext_image)\n     apply (rule ballI)\n     apply (case_tac x, simp)\n(* *)\n    apply (subgoal_tac \"(anonymous_actor (InfrastructureOne.infrastructure.Infrastructure\n              (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n                ((InfrastructureOne.agra (InfrastructureOne.graphI I))\n                 (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l - {a},\n                  l' := insert a (InfrastructureOne.agra (InfrastructureOne.graphI I) l')))\n                (InfrastructureOne.cgra (InfrastructureOne.graphI I)) (InfrastructureOne.lgra (InfrastructureOne.graphI I))\n                ((InfrastructureOne.egra (InfrastructureOne.graphI I))\n                 (l := InfrastructureOne.egra (InfrastructureOne.graphI I) l -\n                       {efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a)},\n                  l' :=\n                    insert (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) a))\n                     (InfrastructureOne.egra (InfrastructureOne.graphI I) l')))\n                (InfrastructureOne.kgra (InfrastructureOne.graphI I)))\n              (InfrastructureOne.delta I))\n            b) = (anonymous_actor I b)\")\n      apply (rotate_tac -1)\n    apply (erule ssubst)\n      apply (rule refl)\n     apply (rule sym)\n    apply (rule anonymous_actor_eq)\n    using InfrastructureOne.move_graph_a_def InfrastructureOne.state_transition_in.move apply presburger\n        apply force\n    apply (rule ballI)\n       apply (rule efids_list_inj_refl)\n    apply simp\n    using all_corona_actors corona_scenarioO_def apply blast\n    using all_corona_actors coronaO_efids_list_inj corona_scenarioO_def apply blast\n      apply blast\n     apply simp\n    thm efid_kgra_in_range_invariantOO\n     apply (rule_tac I = corona_scenarioO in efid_kgra_in_range_invariantOO)\n    using corona_scenarioO_def apply presburger\n    using efid_in_range_corona_scenarioO apply fastforce\n        apply (meson efid_kgra_in_range_corona_scenarioO)\n       prefer 3\n    apply (subgoal_tac \"b \\<in> snd ` (InfrastructureOne.kgra (InfrastructureOne.graphI I) aa la)\")\n        apply simp\n    apply (metis image_iff snd_conv)\n    apply (erule conjE)\n       apply assumption\n    apply (erule conjE)\n     apply assumption\n(* *)\n    apply (rule impI)+\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (rule conjI)\n      apply force\n    apply (rule ext_ifte)\n      apply force\n     apply force\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (rule conjI)\n    apply meson\n    apply (rule ext_ifte)\n    apply force\n     apply simp\n    apply (rule ext_ifte)\n    using InfrastructureOne.actors_graph_def InfrastructureOne.agra.simps InfrastructureOne.gra.simps InfrastructureOne.nodes_def apply presburger\n    apply simp\n     apply (rule ext_image)\n     apply (rule ballI)\n     apply (case_tac x, simp)\n    apply (subgoal_tac \"(anonymous_actor\n            (InfrastructureOne.infrastructure.Infrastructure\n              (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n                (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n                (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I))\n                (InfrastructureOne.kgra (InfrastructureOne.graphI I)))\n              (InfrastructureOne.delta I))\n            b) = (anonymous_actor I b)\")\n      apply (rotate_tac -1)\n    apply (erule ssubst)\n      apply (rule refl)\n     apply (rule sym)\n    apply (rule anonymous_actor_eq)\n    using InfrastructureOne.move_graph_a_def InfrastructureOne.state_transition_in.move apply presburger\n    apply force\n    apply (rule ballI)\n       apply (rule efids_list_inj_refl)\n    apply simp\n    using all_corona_actors corona_scenarioO_def apply blast\n    using all_corona_actors coronaO_efids_list_inj corona_scenarioO_def apply blast\n      apply blast\n     apply simp\n     apply (rule_tac I = corona_scenarioO in efid_kgra_in_range_invariantOO)\n    using corona_scenarioO_def apply presburger\n    using efid_in_range_corona_scenarioO apply fastforce\n        apply (meson efid_kgra_in_range_corona_scenarioO)\n       prefer 3\n    apply (subgoal_tac \"b \\<in> snd ` (InfrastructureOne.kgra (InfrastructureOne.graphI I) aa la)\")\n        apply simp\n    apply (metis image_iff snd_conv)\n    apply (erule conjE)\n       apply assumption\n    apply (erule conjE)\n     by assumption\n next show \"\\<And>s s' G I a l I'.\n       (corona_scenarioO, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureOne.nodes (InfrastructureOne.graphI corona_scenarioO) =\n       InfrastructureOne.nodes (InfrastructureOne.graphI s) \\<Longrightarrow>\n       InfrastructureOne.delta corona_scenarioO = InfrastructureOne.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureOne.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureOne.nodes G \\<Longrightarrow>\n       InfrastructureOne.enables I l (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureOne.infrastructure.Infrastructure\n        (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n          (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n          ((InfrastructureOne.kgra G)\n           (a := (InfrastructureOne.kgra G a)\n              (l := {(x, y). x \\<in> InfrastructureOne.agra G l \\<and> y \\<in> InfrastructureOne.egra G l}))))\n        (InfrastructureOne.delta I) \\<Longrightarrow>\n       rmapO s \\<rightarrow>\\<^sub>n rmapO s'\"\n  proof (rule_tac I = \"rmapO s\" and I' = \"rmapO s'\" and l = l  \n                             and a = a \n in Infrastructure.state_transition_in.get, rule refl, simp add: rmapO_def ref_map_def atI_def Infrastructure.atI_def\n     ,simp add: rmapO_def ref_map_def nodes_def enables_def Infrastructure.enables_def\n              local_policies_def Infrastructure.nodes_def shop_def pub_def)\nshow \"\\<And>s s' G I a l I'.\n       (corona_scenarioO, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureOne.nodes (InfrastructureOne.graphI corona_scenarioO) =\n       InfrastructureOne.nodes (InfrastructureOne.graphI s) \\<Longrightarrow>\n       InfrastructureOne.delta corona_scenarioO = InfrastructureOne.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureOne.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureOne.nodes G \\<Longrightarrow>\n       InfrastructureOne.enables I l (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureOne.infrastructure.Infrastructure\n        (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n          (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n          ((InfrastructureOne.kgra G)\n           (a := (InfrastructureOne.kgra G a)\n              (l := {(x, y). x \\<in> InfrastructureOne.agra G l \\<and> y \\<in> InfrastructureOne.egra G l}))))\n        (InfrastructureOne.delta I) \\<Longrightarrow>\n       Infrastructure.enables (rmapO s) l (Actor a) get\"\n   proof (simp add: rmapO_def ref_map_def nodes_def enables_def Infrastructure.enables_def\n              local_policies_def Infrastructure.nodes_def shop_def pub_def)\n     show \"\\<And>s s' G I a l I'.\n       (corona_scenarioO, I) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       {x. \\<exists>y. (x, y) \\<in> InfrastructureOne.gra (InfrastructureOne.graphI corona_scenarioO) \\<or>\n               (y, x) \\<in> InfrastructureOne.gra (InfrastructureOne.graphI corona_scenarioO)} =\n       {x. \\<exists>y. (x, y) \\<in> InfrastructureOne.gra (InfrastructureOne.graphI I) \\<or>\n               (y, x) \\<in> InfrastructureOne.gra (InfrastructureOne.graphI I)} \\<Longrightarrow>\n       InfrastructureOne.delta corona_scenarioO = InfrastructureOne.delta I \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' =\n       InfrastructureOne.infrastructure.Infrastructure\n        (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n          (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n          (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I))\n          ((InfrastructureOne.kgra (InfrastructureOne.graphI I))\n           (a := (InfrastructureOne.kgra (InfrastructureOne.graphI I) a)\n              (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l \\<times>\n                    InfrastructureOne.egra (InfrastructureOne.graphI I) l))))\n        (InfrastructureOne.delta I) \\<Longrightarrow>\n       G = InfrastructureOne.graphI I \\<Longrightarrow>\n       a @\\<^bsub>InfrastructureOne.graphI I\\<^esub> l \\<Longrightarrow>\n       \\<exists>y. (l, y) \\<in> InfrastructureOne.gra (InfrastructureOne.graphI I) \\<or>\n           (y, l) \\<in> InfrastructureOne.gra (InfrastructureOne.graphI I) \\<Longrightarrow>\n       \\<exists>x\\<in>InfrastructureOne.delta I (InfrastructureOne.graphI I) l. case x of (p, e) \\<Rightarrow> get \\<in> e \\<and> p (Actor a) \\<Longrightarrow>\n       I' =\n       InfrastructureOne.infrastructure.Infrastructure\n        (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n          (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n          (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I))\n          ((InfrastructureOne.kgra (InfrastructureOne.graphI I))\n           (a := (InfrastructureOne.kgra (InfrastructureOne.graphI I) a)\n              (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l \\<times>\n                    InfrastructureOne.egra (InfrastructureOne.graphI I) l))))\n        (InfrastructureOne.delta I) \\<Longrightarrow>\n       l \\<noteq> Location (Suc 0) \\<longrightarrow> l = Location 0\"\n        by (metis InfrastructureOne.delta.simps One_nat_def corona_scenarioO_def empty_iff local_policiesO_def pubO_def shopO_def)\n    qed\n  next show \"\\<And>s s' G I a l I'.\n       (corona_scenarioO, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureOne.nodes (InfrastructureOne.graphI corona_scenarioO) =\n       InfrastructureOne.nodes (InfrastructureOne.graphI s) \\<Longrightarrow>\n       InfrastructureOne.delta corona_scenarioO = InfrastructureOne.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureOne.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureOne.nodes G \\<Longrightarrow>\n       InfrastructureOne.enables I l (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureOne.infrastructure.Infrastructure\n        (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra G) (InfrastructureOne.agra G) (InfrastructureOne.cgra G)\n          (InfrastructureOne.lgra G) (InfrastructureOne.egra G)\n          ((InfrastructureOne.kgra G)\n           (a := (InfrastructureOne.kgra G a)\n              (l := {(x, y). x \\<in> InfrastructureOne.agra G l \\<and> y \\<in> InfrastructureOne.egra G l}))))\n        (InfrastructureOne.delta I) \\<Longrightarrow>\n       rmapO s' =\n       Infrastructure.infrastructure.Infrastructure\n        (Infrastructure.igraph.Lgraph (Infrastructure.gra (Infrastructure.graphI (rmapO s)))\n          (Infrastructure.agra (Infrastructure.graphI (rmapO s))) (Infrastructure.cgra (Infrastructure.graphI (rmapO s)))\n          (Infrastructure.lgra (Infrastructure.graphI (rmapO s))) (Infrastructure.egra (Infrastructure.graphI (rmapO s)))\n          ((Infrastructure.kgra (Infrastructure.graphI (rmapO s)))\n           (a := (Infrastructure.kgra (Infrastructure.graphI (rmapO s)) a)\n              (l := {(x, y).\n                     x \\<in> Infrastructure.agra (Infrastructure.graphI (rmapO s)) l \\<and>\n                     y \\<in> Infrastructure.egra (Infrastructure.graphI (rmapO s)) l}))))\n        (Infrastructure.delta (rmapO s)) \"\n      apply (simp add: rmapO_def ref_map_def)\n     apply (rule ext,simp)\n      apply (rule conjI)\n       apply (rule impI)\n    apply (rule ext,simp)\n       apply (rule conjI)\n        apply (rule impI)+\n        apply (rule conjI)\n         apply (rule impI)+\n         apply (rule conjI)\n          apply (rule impI)+\n          apply (rule conjI)\n      apply (rule impI)+\n    apply (simp add: image_def)\n           apply (rule equalityI)\n            apply (rule subsetI)\n      apply (case_tac x)\n            apply simp\n            apply (erule conjE)+\n            apply (erule bexE)\n            apply (rotate_tac -1)\n      apply (erule ssubst)\n      apply (rule_tac x = \"(anonymous_actor\n               (InfrastructureOne.infrastructure.Infrastructure\n                 (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n                   (InfrastructureOne.agra (InfrastructureOne.graphI I))\n                   (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n                   (InfrastructureOne.lgra (InfrastructureOne.graphI I))\n                   (InfrastructureOne.egra (InfrastructureOne.graphI I))\n                   ((InfrastructureOne.kgra (InfrastructureOne.graphI I))\n                    (a := (InfrastructureOne.kgra (InfrastructureOne.graphI I) a)\n                       (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l \\<times>\n                             InfrastructureOne.egra (InfrastructureOne.graphI I) l))))\n                 (InfrastructureOne.delta I))\n               y)\" in bexI)\n             apply (rule refl)\n      apply (subgoal_tac \"anonymous_actor\n        (InfrastructureOne.infrastructure.Infrastructure\n          (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n            (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n            (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I))\n            ((InfrastructureOne.kgra (InfrastructureOne.graphI I))\n             (a := (InfrastructureOne.kgra (InfrastructureOne.graphI I) a)\n                (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l \\<times>\n                      InfrastructureOne.egra (InfrastructureOne.graphI I) l))))\n          (InfrastructureOne.delta I))\n        y = anonymous_actor I y\")\n             apply (rotate_tac -1)\n      apply (erule ssubst)\n      thm anonymous_actor_invOO\n             apply (rule anonymous_actor_invOO)\n      apply assumption\n      using all_corona_actors apply force\n      using coronaO_efids_list_inj apply presburger\n      using range_disjoint_corona_scenarioO apply presburger\n      using efid_in_range_corona_scenarioO apply fastforce\n      using l_eq_corona_scenarioO apply presburger\n      using efid_eq_efid_cur_corona_scenarioO apply presburger\n      using anonymous_actor_corona_scenarioO apply presburger\n              apply blast\n      apply assumption\n      using InfrastructureOne.same_actors0 InfrastructureOne.state_transition_in.get anonymous_actor_def apply fastforce\n            apply (rule subsetI)\n      apply (case_tac x)\n            apply simp\n(* *)\n           apply (erule conjE)+\n           apply (erule bexE)\n      apply (rule_tac x = \"efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) xa)\" in bexI)\n            prefer 2\n      apply (rule is_there_lem, assumption)\n      using range_disjoint_corona_scenarioO apply presburger\n      apply (rule inj_on_corona_scenarioO)\n      using coronaO_efids_list_inj apply presburger\n      using l_eq_corona_scenarioO apply presburger\n      using local.isthere_lem00 apply presburger\n             apply blast\n      apply assumption\n(* *)\n      apply (rotate_tac -1)\n           apply (erule ssubst)\n      apply (subgoal_tac \"xa = (anonymous_actor\n            (InfrastructureOne.infrastructure.Infrastructure\n              (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n                (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n                (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I))\n                ((InfrastructureOne.kgra (InfrastructureOne.graphI I))\n                 (a := (InfrastructureOne.kgra (InfrastructureOne.graphI I) a)\n                    (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l \\<times>\n                          InfrastructureOne.egra (InfrastructureOne.graphI I) l))))\n              (InfrastructureOne.delta I))\n            (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) xa)))\")\n            apply (rotate_tac -1)\n            apply (erule subst, rule refl)\n      apply (subgoal_tac \"anonymous_actor\n        (InfrastructureOne.infrastructure.Infrastructure\n          (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI I))\n            (InfrastructureOne.agra (InfrastructureOne.graphI I)) (InfrastructureOne.cgra (InfrastructureOne.graphI I))\n            (InfrastructureOne.lgra (InfrastructureOne.graphI I)) (InfrastructureOne.egra (InfrastructureOne.graphI I))\n            ((InfrastructureOne.kgra (InfrastructureOne.graphI I))\n             (a := (InfrastructureOne.kgra (InfrastructureOne.graphI I) a)\n                (l := InfrastructureOne.agra (InfrastructureOne.graphI I) l \\<times>\n                      InfrastructureOne.egra (InfrastructureOne.graphI I) l))))\n          (InfrastructureOne.delta I))  (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) xa))\n         = anonymous_actor I  (efids_cur (InfrastructureOne.cgra (InfrastructureOne.graphI I) xa))\")\n      apply (rotate_tac -1)\n            apply (erule ssubst)\n      prefer 2\n      using InfrastructureOne.actors_graph_def InfrastructureOne.agra.simps InfrastructureOne.cgra.simps InfrastructureOne.gra.simps InfrastructureOne.graphI.simps InfrastructureOne.nodes_def anonymous_actor_def apply presburger\n      apply (rule anonymous_actor_def1b)\n      apply (metis empty_iff)\n      using all_corona_actors coronaO_efids_list_inj efids_list_inj_refl apply blast\n              apply (simp add: ran_efids_list_disjoint_refl range_disjoint_corona_scenarioO)\n             apply assumption\n            apply (simp)\n            apply (rule_tac x = xa in bexI)\n             apply (rule efids_cur_in_efids_listO)\n             apply (simp add: actors_graph_def, rule_tac x = l in exI, rule conjI, assumption, assumption)+\n           apply (rule conjI)\n             apply (simp add: actors_graph_def, rule_tac x = l in exI, rule conjI, assumption, assumption)\n             apply (rule efids_cur_in_efids_listO)\n             apply (simp add: actors_graph_def, rule_tac x = l in exI, rule conjI, assumption, assumption)\n(* *)\n          apply (rule impI)\n      apply (rule ext_image)\n          apply (rule ballI)\n      using InfrastructureOne.same_actors0 InfrastructureOne.state_transition_in.get anonymous_actor_def apply fastforce\n         apply (rule impI)+\n      apply (rule conjI)\n          apply (rule impI)+\n      apply simp\n      using InfrastructureOne.actors_graph_def InfrastructureOne.atI_def apply force\n      apply (simp add: InfrastructureOne.actors_graph_def InfrastructureOne.nodes_def)\n      using InfrastructureOne.nodes_def apply fastforce\n       apply (rule impI)+\n       apply (rule conjI)\n        apply (rule impI)+\n        apply (rule conjI)\n         apply (rule impI)+\n      apply (rule conjI)\n          apply (rule impI)+\n      apply force\n      apply (rule impI)\n      apply (rule ext_image)\n          apply (rule ballI)\n      apply (simp add: InfrastructureOne.nodes_def)\n      using InfrastructureOne.nodes_def apply force\n       apply (rule impI)+\n       apply (rule conjI)\n        apply (rule impI)+\n        apply (rule conjI)\n         apply (rule impI)+\n      using InfrastructureOne.same_actors0 InfrastructureOne.same_nodes0 InfrastructureOne.state_transition_in.get apply fastforce\n      using InfrastructureOne.actors_graph_def InfrastructureOne.nodes_def apply force\n      using InfrastructureOne.actors_graph_def InfrastructureOne.atI_def apply force\n      apply (rule impI)+\n      apply (rule ext_ifte'')\n      using InfrastructureOne.actors_graph_def InfrastructureOne.agra.simps InfrastructureOne.gra.simps InfrastructureOne.nodes_def apply presburger\n      apply simp\n      using InfrastructureOne.same_actors0 InfrastructureOne.state_transition_in.get anonymous_actor_def by fastforce\n  qed\nnext show \"\\<And>s s' G I a l I'.\n       (corona_scenarioO, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureOne.nodes (InfrastructureOne.graphI corona_scenarioO) =\n       InfrastructureOne.nodes (InfrastructureOne.graphI s) \\<Longrightarrow>\n       InfrastructureOne.delta corona_scenarioO = InfrastructureOne.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureOne.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureOne.enables I l (Actor a) put \\<Longrightarrow>\n       I' =\n       InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.put_graph_efid a l G)\n        (InfrastructureOne.delta I) \\<Longrightarrow>\n       rmapO s \\<rightarrow>\\<^sub>n rmapO s'\"\n  proof (rule_tac I = \"rmapO s\" and I' = \"rmapO s'\" and l = l  \n                             and a = a \n in Infrastructure.state_transition_in.put, rule refl, simp add: rmapO_def ref_map_def atI_def Infrastructure.atI_def\n     ,simp add: rmapO_def ref_map_def nodes_def enables_def Infrastructure.enables_def\n              local_policies_def Infrastructure.nodes_def shop_def pub_def)\n    show \"\\<And>s s' G I a l I'.\n       (corona_scenarioO, I) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       {x. \\<exists>y. (x, y) \\<in> InfrastructureOne.gra (InfrastructureOne.graphI corona_scenarioO) \\<or>\n               (y, x) \\<in> InfrastructureOne.gra (InfrastructureOne.graphI corona_scenarioO)} =\n       {x. \\<exists>y. (x, y) \\<in> InfrastructureOne.gra (InfrastructureOne.graphI I) \\<or>\n               (y, x) \\<in> InfrastructureOne.gra (InfrastructureOne.graphI I)} \\<Longrightarrow>\n       InfrastructureOne.delta corona_scenarioO = InfrastructureOne.delta I \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' =\n       InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.put_graph_efid a l (InfrastructureOne.graphI I))\n        (InfrastructureOne.delta I) \\<Longrightarrow>\n       G = InfrastructureOne.graphI I \\<Longrightarrow>\n       a @\\<^bsub>InfrastructureOne.graphI I\\<^esub> l \\<Longrightarrow>\n       \\<exists>x\\<in>InfrastructureOne.delta I (InfrastructureOne.graphI I) l. case x of (p, e) \\<Rightarrow> put \\<in> e \\<and> p (Actor a) \\<Longrightarrow>\n       I' =\n       InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.put_graph_efid a l (InfrastructureOne.graphI I))\n        (InfrastructureOne.delta I) \\<Longrightarrow>\n       l \\<noteq> Location (Suc 0) \\<longrightarrow> l = Location 0\"\n      using all_not_in_conv corona_scenarioO_def local_policiesO_def pubO_def shopO_def by fastforce\n  next show \"\\<And>s s' G I a l I'.\n       (corona_scenarioO, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureOne.nodes (InfrastructureOne.graphI corona_scenarioO) =\n       InfrastructureOne.nodes (InfrastructureOne.graphI s) \\<Longrightarrow>\n       InfrastructureOne.delta corona_scenarioO = InfrastructureOne.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureOne.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureOne.enables I l (Actor a) put \\<Longrightarrow>\n       I' =\n       InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.put_graph_efid a l G)\n        (InfrastructureOne.delta I) \\<Longrightarrow>\n       rmapO s' =\n       Infrastructure.infrastructure.Infrastructure (Infrastructure.put_graph_efid a l (Infrastructure.graphI (rmapO s)))\n        (Infrastructure.delta (rmapO s)) \"\n      apply (simp add: rmapO_def ref_map_def)\n    apply (simp add: put_graph_efid_def Infrastructure.put_graph_efid_def)\n      apply (rule conjI)\n      apply (rule ext, simp)\n      using efids_root_efids_inc_lem repl_efr_def apply presburger\n      apply (rule conjI)\n       apply (rule ext, simp)\n       apply (rule conjI)\n        apply (rule impI)\n      apply (simp add: InfrastructureOne.atI_def efids_root_efids_inc_lem ext_image insert_absorb repl_efr_def)\n       apply (rule impI)\n      apply (simp add: efids_root_efids_inc_lem ext_image)\n      apply (rule ext_ifte)\n      apply (metis InfrastructureOne.graphI.simps InfrastructureOne.put_graph_efid_def InfrastructureOne.same_actors0 InfrastructureOne.same_nodes0 InfrastructureOne.state_transition_in.put)\n(* *)\n      apply (subgoal_tac \"InfrastructureOne.kgra\n        (InfrastructureOne.graphI\n          (InfrastructureOne.infrastructure.Infrastructure\n            (InfrastructureOne.put_graph_efid a l (InfrastructureOne.graphI I)) (InfrastructureOne.delta I))) =\n          InfrastructureOne.kgra (InfrastructureOne.graphI I)\")\n       prefer 2\n      using InfrastructureOne.graphI.simps InfrastructureOne.kgra.simps InfrastructureOne.put_graph_efid_def apply presburger\n       apply (rotate_tac -1)\n      apply (erule ssubst)\n      apply (rule ext_image)\n      apply (rule ballI)\n      apply (case_tac x)\n      apply simp\n      apply (subgoal_tac \"(anonymous_actor I b) = (anonymous_actor\n                   (InfrastructureOne.infrastructure.Infrastructure\n                     (InfrastructureOne.put_graph_efid a l (InfrastructureOne.graphI I)) (InfrastructureOne.delta I))\n                   b)\")\n       prefer 2\n      apply (rule anonymous_actor_eq)\n      apply (meson InfrastructureOne.state_transition_in.put)\n      apply fastforce\n      using InfrastructureOne.same_actors coronaO_efids_list_inj efids_list_inj_refl apply blast\n        apply (simp add: ran_efids_list_disjoint_refl range_disjoint_corona_scenarioO)\n       apply simp\n      prefer 2\n      using InfrastructureOne.put_graph_efid_def efids_root_efids_inc_lem apply force\n(* here *)\n      thm efid_kgra_in_range_invariantOO\n      apply (rule_tac l = la and h' = aa in efid_kgra_in_range_invariantOO)\n      apply assumption\n      using efid_in_range_corona_scenarioO apply fastforce\n         apply (meson efid_kgra_in_range_corona_scenarioO)\n        apply (erule conjE, assumption)+\n      by force\n  qed\nqed\n\n\ntheorem refmapOne: \"corona_Kripke \\<sqsubseteq>\\<^sub>rmapO corona_KripkeO\"\nproof (rule strong_mt', simp add: corona_KripkeO_def corona_Kripke_def corona_states_def corona_statesO_def state_transition_refl_def, rule conjI)\n  show \"IcoronaO \\<subseteq> {I. (corona_scenarioO, I) \\<in> {(x, y). x \\<rightarrow>\\<^sub>i y}\\<^sup>*}\"\n    using IcoronaO_def by fastforce\nnext show \"Icorona \\<subseteq> {I. (corona_scenario, I) \\<in> {(x, y). x \\<rightarrow>\\<^sub>i y}\\<^sup>*} \\<and>\n    rmapO ` IcoronaO \\<subseteq> Icorona \\<and>\n    (\\<forall>s. (\\<exists>s0\\<in>IcoronaO. (s0, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>i y}\\<^sup>*) \\<longrightarrow> (\\<forall>s'. s \\<rightarrow>\\<^sub>i s' \\<longrightarrow> rmapO s \\<rightarrow>\\<^sub>i rmapO s')) \"\n    apply (rule conjI)\n    using Icorona_def apply blast\n    apply (rule conjI)\n     apply (simp add: rmapO_def IcoronaO_def Icorona_def corona_scenarioO_def corona_scenario_def\n            ref_map_def ex_graphO_def ex_graph_def pubO_def pub_def shopO_def shop_def ex_loc_ass_def\n            ex_loc_assO_def ext ex_credsO_def  ex_creds_def ex_locsO_def ex_locs_def ex_efids_def\n            ex_knos_def ex_knosO_def repl_efr_def)\n    using IcoronaO_def Infrastructure.state_transition_infra_def InfrastructureOne.state_transition_infra_def refmapOne_lem by auto\nqed\n\n\nlemma step1: \"corona_scenarioO  \\<rightarrow>\\<^sub>n corona_scenarioO'\"\nproof (rule_tac l = pubO and a = \"''Eve''\" in get)\n  show \"graphI corona_scenarioO = graphI corona_scenarioO\" by (rule refl)\nnext show \"''Eve'' @\\<^bsub>graphI corona_scenarioO\\<^esub> pubO\" \n    by (simp add: corona_scenarioO_def ex_graphO_def ex_loc_assO_def atI_def nodes_def)\nnext show \"enables corona_scenarioO pubO (Actor ''Eve'') get\"\n    by (simp add: enables_def corona_scenarioO_def ex_graphO_def local_policiesO_def\n                    ex_credsO_def ex_locsO_def)\nnext show \"pubO \\<in> nodes (graphI corona_scenarioO)\"\n    using corona_scenarioO_def ex_graphO_def nodes_def by auto \nnext show \"corona_scenarioO' =\n    Infrastructure\n     (Lgraph (gra (graphI corona_scenarioO)) (agra (graphI corona_scenarioO)) (cgra (graphI corona_scenarioO))\n       (lgra (graphI corona_scenarioO)) (egra (graphI corona_scenarioO))\n       ((kgra (graphI corona_scenarioO))\n        (''Eve'' := (kgra (graphI corona_scenarioO) (''Eve''))\n           (pubO := {(x, y). x \\<in> agra (graphI corona_scenarioO) pubO \\<and> y \\<in> egra (graphI corona_scenarioO) pubO}))))\n     (delta corona_scenarioO)\"\n    apply (simp add: corona_scenarioO'_def ex_graphO'_def move_graph_a_def \n                     corona_scenarioO_def ex_graphO_def pubO_def shopO_def \n                     ex_loc_assO'_def ex_loc_assO_def ex_efidsO'_def ex_efidsO_def \n                     ex_knosO_def ex_knosO'_def ex_credsO_def)\n    apply (rule ext, simp add: insert_Diff_if shopO_def pubO_def)\n      apply (rule impI, rule ext)\nby auto[1]\nqed\n\n\nlemma step1r: \"corona_scenarioO  \\<rightarrow>\\<^sub>n* corona_scenarioO'\"\nproof (simp add: state_transition_in_refl_def)\n  show \" (corona_scenarioO, corona_scenarioO') \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n  by (insert step1, auto)\nqed\n\n\n\nlemma step2r: \"corona_scenarioO'  \\<rightarrow>\\<^sub>n* corona_scenarioO''\"\nproof (simp add: state_transition_in_refl_def)\n  show \"(corona_scenarioO', corona_scenarioO'') \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n    by (insert step2, auto)\nqed\n\nlemma step3: \"corona_scenarioO''  \\<rightarrow>\\<^sub>n corona_scenarioO'''\"\nproof (rule_tac l' = shopO and l = pubO and a = \"''Eve''\" in move, rule refl)\n  show \"''Eve'' @\\<^bsub>graphI corona_scenarioO''\\<^esub> pubO\"\n   by (simp add: corona_scenarioO''_def ex_graphO''_def pubO_def shopO_def atI_def ex_loc_assO'_def)\nnext show \\<open>pubO \\<in> nodes (graphI corona_scenarioO'')\\<close>\n    by (simp add: corona_scenarioO''_def pubO_def ex_graphO''_def nodes_def, blast)\nnext show \\<open>shopO \\<in> nodes (graphI corona_scenarioO'')\\<close>\n    by (simp add: corona_scenarioO''_def pubO_def ex_graphO''_def nodes_def, blast)\nnext show \\<open>''Eve'' \\<in> actors_graph (graphI corona_scenarioO'')\\<close>\n    by (simp add: actors_graph_def corona_scenarioO''_def ex_graphO''_def nodes_def ex_loc_assO'_def \n                  shopO_def pubO_def, blast)\nnext show \\<open>enables corona_scenarioO'' shopO (Actor ''Eve'') move\\<close>\n    by (simp add: enables_def corona_scenarioO''_def local_policiesO_def)\nnext show \\<open>corona_scenarioO''' =\n    Infrastructure (move_graph_a ''Eve'' pubO shopO (graphI corona_scenarioO'')) (delta corona_scenarioO'')\\<close>\n    apply (simp add: corona_scenarioO'''_def ex_graphO'''_def move_graph_a_def pubO_def shopO_def\n                     corona_scenarioO''_def ex_graphO''_def ex_loc_assO''_def ex_loc_assO'_def)\n    apply (rule conjI)\n     apply (rule ext, simp add: insert_Diff_if shopO_def pubO_def)+\n    apply (simp add: ex_efidsO'_def ex_efidsO''_def shopO_def pubO_def ex_credsO_def)\n    by (simp add: insert_Diff_if shopO_def pubO_def)\nqed\n\nlemma step3r: \"corona_scenarioO''  \\<rightarrow>\\<^sub>n* corona_scenarioO'''\"\nproof (simp add: state_transition_in_refl_def)\n  show \"(corona_scenarioO'', corona_scenarioO''') \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n    by (insert step3, auto)\nqed\n\nlemma step4: \"corona_scenarioO'''  \\<rightarrow>\\<^sub>n corona_scenarioO''''\"\nproof (rule_tac l = shopO and a = \"''Eve''\" in get, rule refl)\n  show \\<open>''Eve'' @\\<^bsub>graphI corona_scenarioO'''\\<^esub> shopO\\<close>\n   by (simp add: corona_scenarioO'''_def ex_graphO'''_def pubO_def shopO_def atI_def ex_loc_assO''_def)\nnext show \\<open>enables corona_scenarioO''' shopO (Actor ''Eve'') get\\<close>\n    by (simp add: enables_def corona_scenarioO'''_def local_policiesO_def)\nnext show \"shopO \\<in> nodes (graphI corona_scenarioO''')\"\n    using corona_scenarioO'''_def ex_graphO'''_def nodes_def by auto\nnext show \\<open>corona_scenarioO'''' =\n    Infrastructure\n     (Lgraph (gra (graphI corona_scenarioO''')) (agra (graphI corona_scenarioO''')) (cgra (graphI corona_scenarioO'''))\n       (lgra (graphI corona_scenarioO''')) (egra (graphI corona_scenarioO'''))\n       ((kgra (graphI corona_scenarioO'''))\n        (''Eve'' := (kgra (graphI corona_scenarioO''') (''Eve''))\n           (shopO := {(x, y). x \\<in> agra (graphI corona_scenarioO''') shopO \\<and> y \\<in> egra (graphI corona_scenarioO''') shopO}))))\n     (delta corona_scenarioO''') \\<close>\n    apply (simp add: corona_scenarioO'''_def ex_graphO'''_def move_graph_a_def pubO_def shopO_def\n                     corona_scenarioO''''_def ex_graphO''''_def ex_loc_assO''_def ex_loc_assO'_def)\n     apply (rule ext, simp add: insert_Diff_if shopO_def pubO_def)+\n    apply (simp add: ex_efidsO''_def shopO_def pubO_def ex_knosO'_def ex_knosO''_def)\n    apply (rule impI, rule ext)\n    apply (simp add: insert_Diff_if shopO_def pubO_def)\n    apply (rule impI)+\n    apply (rule equalityI)\n     apply (rule subsetI)\n     apply (case_tac xa)\n    apply simp\n    apply linarith\n     apply (rule subsetI)\n     apply (case_tac xa)\n    apply simp\n    by metis\nqed\n\nlemma step4r: \"corona_scenarioO'''  \\<rightarrow>\\<^sub>n* corona_scenarioO''''\"\nproof (simp add: state_transition_in_refl_def)\n  show \"(corona_scenarioO''', corona_scenarioO'''') \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n    by (insert step4, auto)\nqed\n\nlemma corona_refO: \"[\\<N>\\<^bsub>(IcoronaO,scoronaO)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO,scoronaO)\\<^esup> \\<sqsubseteq>\n                  ([\\<N>\\<^bsub>(IcoronaO,CoronaO')\\<^esub>, \\<N>\\<^bsub>(CoronaO',CoronaO'')\\<^esub>,  \\<N>\\<^bsub>(CoronaO'',CoronaO''')\\<^esub>, \\<N>\\<^bsub>(CoronaO''',scoronaO)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO,scoronaO)\\<^esup>)\"\n  by (metis append_Cons append_Nil refI)  \n\nlemma corona_refO': \"[\\<N>\\<^bsub>(IcoronaO,scoronaO')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO,scoronaO')\\<^esup> \\<sqsubseteq>\n                  ([\\<N>\\<^bsub>(IcoronaO,CoronaO')\\<^esub>, \\<N>\\<^bsub>(CoronaO',CoronaO'')\\<^esub>,  \\<N>\\<^bsub>(CoronaO'',CoronaO''')\\<^esub>, \\<N>\\<^bsub>(CoronaO''',scoronaO')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO,scoronaO')\\<^esup>)\"\n  by (metis append_Cons append_Nil refI)  \n\nlemma att_coronaO: \"\\<turnstile>([\\<N>\\<^bsub>(IcoronaO,CoronaO')\\<^esub>, \\<N>\\<^bsub>(CoronaO',CoronaO'')\\<^esub>,  \\<N>\\<^bsub>(CoronaO'',CoronaO''')\\<^esub>, \\<N>\\<^bsub>(CoronaO''',scoronaO)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO,scoronaO)\\<^esup>)\"\nproof (subst att_and, simp, rule conjI)\n  show \" \\<turnstile>\\<N>\\<^bsub>(IcoronaO, CoronaO')\\<^esub>\"\n    apply (simp add: IcoronaO_def CoronaO'_def att_base)\n    using state_transition_infra_def step1 by blast\nnext show \\<open> \\<turnstile>[\\<N>\\<^bsub>(CoronaO', CoronaO'')\\<^esub>, \\<N>\\<^bsub>(CoronaO'', CoronaO''')\\<^esub>, \\<N>\\<^bsub>(CoronaO''', scoronaO)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(CoronaO', scoronaO)\\<^esup>\\<close>\n    apply (subst att_and, simp)\n    apply (rule conjI)\n     apply (simp add: CoronaO'_def CoronaO''_def att_base state_transition_infra_def step2)\n    apply (subst att_and, simp, rule conjI)\n     apply (simp add: CoronaO''_def CoronaO'''_def att_base state_transition_infra_def step3)\n    apply (subst att_and, simp)\n    apply (simp add: CoronaO'''_def scoronaO_def att_base state_transition_infra_def step4)\n    apply (rule_tac x = \"corona_scenarioO''''\" in exI)\n    apply (rule conjI)\n     prefer 2\n    apply (rule step4)\n     apply (unfold corona_scenarioO''''_def global_policyO''_def)\n     apply (unfold global_policyO''_def identifiableO'_def ex_graphO''''_def ex_loc_assO''_def nodes_def is_singleton_def\n                  ex_efidsO''_def pubO_def shopO_def ex_credsO_def ex_locsO_def ex_knosO''_def local_policiesO_def)\n     apply (rule_tac x = 3 in exI, simp)\n     apply (rule conjI)\n    apply (rule impI)\n     apply (rule_tac x = \"''Bob''\" in exI)\n      apply (rule_tac  x = \"Efid 3\" in exI)\n      apply (rule equalityI)\n          apply auto[1]\n      apply simp\nby blast\nqed\n\n\nlemma att_coronaO': \"\\<turnstile>([\\<N>\\<^bsub>(IcoronaO,CoronaO')\\<^esub>, \\<N>\\<^bsub>(CoronaO',CoronaO'')\\<^esub>,  \\<N>\\<^bsub>(CoronaO'',CoronaO''')\\<^esub>, \\<N>\\<^bsub>(CoronaO''',scoronaO')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO,scoronaO')\\<^esup>)\"\nproof (subst att_and, simp, rule conjI)\n  show \" \\<turnstile>\\<N>\\<^bsub>(IcoronaO, CoronaO')\\<^esub>\"\n    apply (simp add: IcoronaO_def CoronaO'_def att_base)\n    using state_transition_infra_def step1 by blast\nnext show \\<open> \\<turnstile>[\\<N>\\<^bsub>(CoronaO', CoronaO'')\\<^esub>, \\<N>\\<^bsub>(CoronaO'', CoronaO''')\\<^esub>, \\<N>\\<^bsub>(CoronaO''', scoronaO')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(CoronaO', scoronaO')\\<^esup>\\<close>\n    apply (subst att_and, simp)\n    apply (rule conjI)\n     apply (simp add: CoronaO'_def CoronaO''_def att_base state_transition_infra_def step2)\n    apply (subst att_and, simp, rule conjI)\n     apply (simp add: CoronaO''_def CoronaO'''_def att_base state_transition_infra_def step3)\n    apply (subst att_and, simp)\n    apply (simp add: CoronaO'''_def scoronaO'_def att_base state_transition_infra_def step4)\n    apply (rule_tac x = \"corona_scenarioO''''\" in exI)\n    apply (rule conjI)\n     prefer 2\n    apply (rule step4)\n     apply (unfold corona_scenarioO''''_def global_policyO_def)\n     apply (unfold global_policyO_def identifiableO'_def ex_graphO''''_def ex_loc_assO''_def nodes_def is_singleton_def\n                  ex_efidsO''_def pubO_def shopO_def ex_credsO_def ex_locsO_def ex_knosO''_def local_policiesO_def)\n    apply (rule_tac x = 3 in exI, simp)\n    apply (rule set_exI)\n     prefer 2\n    apply (subgoal_tac \n    \"{Location 0, Location 1} \\<subseteq> {x. \\<exists>y. x = Location 0 \\<and> y = Location (Suc 0) \\<or> y = Location 0 \\<and> x = Location (Suc 0)}\")\n      apply assumption\n    apply simp\n     apply (rule_tac x = \"''Bob''\" in exI)\n      apply (rule_tac  x = \"Efid 3\" in exI)\n      apply (rule equalityI)\n     apply simp\n     apply auto[1]\n    apply (rule subsetI)\n    apply (rule CollectI)\n      apply (case_tac x)\nby simp\nqed\n  \nlemma corona_abs_attO: \"\\<turnstile>\\<^sub>V([\\<N>\\<^bsub>(IcoronaO,scoronaO)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO,scoronaO)\\<^esup>)\"\n   by (rule ref_valI, rule corona_refO, rule att_coronaO)\n\nlemma corona_abs_attO': \"\\<turnstile>\\<^sub>V([\\<N>\\<^bsub>(IcoronaO,scoronaO')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO,scoronaO')\\<^esup>)\"\n   by (rule ref_valI, rule corona_refO', rule att_coronaO')\n\n\nlemma corona_attO: \"corona_KripkeO \\<turnstile> EF {x. \\<exists> n. \\<not>(global_policyO'' x (Efid n))}\"\nproof -\n  have a: \" \\<turnstile>([\\<N>\\<^bsub>(IcoronaO,CoronaO')\\<^esub>, \\<N>\\<^bsub>(CoronaO',CoronaO'')\\<^esub>,  \\<N>\\<^bsub>(CoronaO'',CoronaO''')\\<^esub>, \\<N>\\<^bsub>(CoronaO''',scoronaO)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO, scoronaO)\\<^esup>)\"\n    by (rule att_coronaO)\n  hence \"(IcoronaO,scoronaO) = attack ([\\<N>\\<^bsub>(IcoronaO,CoronaO')\\<^esub>, \\<N>\\<^bsub>(CoronaO',CoronaO'')\\<^esub>,  \\<N>\\<^bsub>(CoronaO'',CoronaO''')\\<^esub>, \\<N>\\<^bsub>(CoronaO''',scoronaO)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO, scoronaO)\\<^esup>)\"\n    by simp\n  hence \"Kripke {s::infrastructure. \\<exists>i::infrastructure\\<in>IcoronaO. i \\<rightarrow>\\<^sub>i* s} IcoronaO \\<turnstile> EF scoronaO\"\n    using ATV_EF corona_abs_attO by fastforce \n  thus \"corona_KripkeO \\<turnstile> EF {x::infrastructure.  \\<exists> n. \\<not> global_policyO'' x (Efid n)}\"\n    by (simp add: corona_KripkeO_def corona_statesO_def IcoronaO_def scoronaO_def)\nqed\n\nlemma corona_attO': \"corona_KripkeO \\<turnstile> EF {x. \\<exists> n. \\<not>(global_policyO x (Efid n))}\"\nproof -\n  have a: \" \\<turnstile>([\\<N>\\<^bsub>(IcoronaO,CoronaO')\\<^esub>, \\<N>\\<^bsub>(CoronaO',CoronaO'')\\<^esub>,  \\<N>\\<^bsub>(CoronaO'',CoronaO''')\\<^esub>, \\<N>\\<^bsub>(CoronaO''',scoronaO')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO, scoronaO')\\<^esup>)\"\n    by (rule att_coronaO')\n  hence \"(IcoronaO,scoronaO') = attack ([\\<N>\\<^bsub>(IcoronaO,CoronaO')\\<^esub>, \\<N>\\<^bsub>(CoronaO',CoronaO'')\\<^esub>,  \\<N>\\<^bsub>(CoronaO'',CoronaO''')\\<^esub>, \\<N>\\<^bsub>(CoronaO''',scoronaO')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaO, scoronaO')\\<^esup>)\"\n    by simp\n  hence \"Kripke {s::infrastructure. \\<exists>i::infrastructure\\<in>IcoronaO. i \\<rightarrow>\\<^sub>i* s} IcoronaO \\<turnstile> EF scoronaO'\"\n    using ATV_EF corona_abs_attO' by fastforce \n  thus \"corona_KripkeO \\<turnstile> EF {x::infrastructure.  \\<exists> n. \\<not> global_policyO x (Efid n)}\"\n    by (simp add: corona_KripkeO_def corona_statesO_def IcoronaO_def scoronaO'_def)\nqed\n\n\ntheorem corona_EFO: \"corona_KripkeO \\<turnstile> EF scoronaO\"\n  using corona_attO scoronaO_def by blast \n\ntheorem corona_EFO': \"corona_KripkeO \\<turnstile> EF scoronaO'\"\n  using corona_attO' scoronaO'_def by blast \n\n\ntheorem corona_ATO: \"\\<exists> A. \\<turnstile> A \\<and> attack A = (IcoronaO,scoronaO)\"\n  using att_coronaO attack.simps(2) by blast  \n\ntheorem corona_ATO': \"\\<exists> A. \\<turnstile> A \\<and> attack A = (IcoronaO,scoronaO')\"\n  using att_coronaO' attack.simps(2) by blast  \n\ntext \\<open>Conversely, since we have an attack given by rule @{text \\<open>corona_AT\\<close>}, we can immediately \n   infer @{text \\<open>EF s\\<close>} using Correctness @{text \\<open>AT_EF\\<close>}\\footnote{Clearly, this theorem is identical\n   to @{text \\<open>corona_EF\\<close>} and could thus be inferred from that one but we want to show here an \n   alternative way of proving it using the Correctness theorem @{text \\<open>AT_EF\\<close>}.}.\\<close>\ntheorem corona_EFO'': \"corona_KripkeO \\<turnstile> EF scoronaO\"\n  using corona_EFO by auto\n\ntheorem corona_EFO''': \"corona_KripkeO \\<turnstile> EF scoronaO'\"\n  using corona_EFO' by auto\n\nend\nend\n", "meta": {"author": "flokam", "repo": "CoronaApp", "sha": "6258178b8f9d10f43e0825d99cbb0126ee51612c", "save_path": "github-repos/isabelle/flokam-CoronaApp", "path": "github-repos/isabelle/flokam-CoronaApp/CoronaApp-6258178b8f9d10f43e0825d99cbb0126ee51612c/IsabelleCorona/CoronaAppOne.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6926419704455589, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.340910160155578}}
{"text": "section \\<open>Priority Maps implemented with List and Map\\<close>\ntheory IICF_Abs_Heapmap\nimports IICF_Abs_Heap \"HOL-Library.Rewrite\" \"../../Intf/IICF_Prio_Map\"\nbegin\n\n  type_synonym ('k,'v) ahm = \"'k list \\<times> ('k \\<rightharpoonup> 'v)\"\n\n  subsection \\<open>Basic Setup\\<close>\n\n  text \\<open>First, we define a mapping to list-based heaps\\<close>\n  definition hmr_\\<alpha> :: \"('k,'v) ahm \\<Rightarrow> 'v heap\" where\n    \"hmr_\\<alpha> \\<equiv> \\<lambda>(pq,m). map (the o m) pq\"\n\n  definition \"hmr_invar \\<equiv> \\<lambda>(pq,m). distinct pq \\<and> dom m = set pq\"\n\n  definition \"hmr_rel \\<equiv> br hmr_\\<alpha> hmr_invar\"\n\n  lemmas hmr_rel_defs = hmr_rel_def br_def hmr_\\<alpha>_def hmr_invar_def\n\n  lemma hmr_empty_invar[simp]: \"hmr_invar ([],Map.empty)\"\n    by (auto simp: hmr_invar_def)\n\n\n  locale hmstruct = h: heapstruct prio for prio :: \"'v \\<Rightarrow> 'b::linorder\"\n  begin\n\n    text \\<open>Next, we define a mapping to priority maps.\\<close>\n\n    definition heapmap_\\<alpha> :: \"('k,'v) ahm \\<Rightarrow> ('k \\<rightharpoonup> 'v)\" where\n      \"heapmap_\\<alpha> \\<equiv> \\<lambda>(pq,m). m\"\n\n    definition heapmap_invar :: \"('k,'v) ahm \\<Rightarrow> bool\" where\n      \"heapmap_invar \\<equiv> \\<lambda>hm. hmr_invar hm \\<and> h.heap_invar (hmr_\\<alpha> hm)\"\n      \n    definition \"heapmap_rel \\<equiv> br heapmap_\\<alpha> heapmap_invar\"\n\n    lemmas heapmap_rel_defs = heapmap_rel_def br_def heapmap_\\<alpha>_def heapmap_invar_def\n\n    lemma [refine_dref_RELATES]: \"RELATES hmr_rel\" by (simp add: RELATES_def)\n\n\n    lemma h_heap_invarI[simp]: \"heapmap_invar hm \\<Longrightarrow> h.heap_invar (hmr_\\<alpha> hm)\"  \n      by (simp add: heapmap_invar_def)\n\n    lemma hmr_invarI[simp]: \"heapmap_invar hm \\<Longrightarrow> hmr_invar hm\"  \n      unfolding heapmap_invar_def by blast\n\n\n\n    lemma set_hmr_\\<alpha>[simp]: \"hmr_invar hm \\<Longrightarrow> set (hmr_\\<alpha> hm) = ran (heapmap_\\<alpha> hm)\"\n      apply (clarsimp simp: hmr_\\<alpha>_def hmr_invar_def heapmap_\\<alpha>_def \n        eq_commute[of \"dom _\" \"set _\"] ran_def)\n      apply force\n      done\n\n    lemma in_h_hmr_\\<alpha>_conv[simp]: \"hmr_invar hm \\<Longrightarrow> x \\<in># h.\\<alpha> (hmr_\\<alpha> hm) \\<longleftrightarrow> x \\<in> ran (heapmap_\\<alpha> hm)\"  \n      by (force simp: hmr_\\<alpha>_def hmr_invar_def heapmap_\\<alpha>_def in_multiset_in_set ran_is_image)\n\n    subsection \\<open>Basic Operations\\<close>\n    (* length, val_of_op, update, butlast, append, empty *)\n\n    text \\<open>In this section, we define the basic operations on heapmaps, \n      and their relations to heaps and maps.\\<close>\n\n    subsubsection \\<open>Length\\<close>\n    text \\<open>Length of the list that represents the heap\\<close>\n    definition hm_length :: \"('k,'v) ahm \\<Rightarrow> nat\" where\n      \"hm_length \\<equiv> \\<lambda>(pq,_). length pq\"\n\n    lemma hm_length_refine: \"(hm_length, length) \\<in> hmr_rel \\<rightarrow> nat_rel\"  \n      apply (intro fun_relI)\n      unfolding hm_length_def\n      by (auto simp: hmr_rel_defs)\n        \n    lemma hm_length_hmr_\\<alpha>[simp]: \"length (hmr_\\<alpha> hm) = hm_length hm\"\n      by (auto simp: hm_length_def hmr_\\<alpha>_def split: prod.splits)\n\n    lemmas [refine] = hm_length_refine[param_fo]\n\n    subsubsection \\<open>Valid\\<close>\n    text \\<open>Check whether index is valid\\<close>\n    definition \"hm_valid hm i \\<equiv> i>0 \\<and> i\\<le> hm_length hm\"\n\n    lemma hm_valid_refine: \"(hm_valid,h.valid)\\<in>hmr_rel \\<rightarrow> nat_rel \\<rightarrow> bool_rel\"\n      apply (intro fun_relI)\n      unfolding hm_valid_def h.valid_def\n      by (parametricity add: hm_length_refine)\n\n    lemma hm_valid_hmr_\\<alpha>[simp]: \"h.valid (hmr_\\<alpha> hm) = hm_valid hm\"\n      by (intro ext) (auto simp: h.valid_def hm_valid_def)\n\n    subsubsection \\<open>Key-Of\\<close>\n    definition hm_key_of :: \"('k,'v) ahm \\<Rightarrow> nat \\<Rightarrow> 'k\" where  \n      \"hm_key_of \\<equiv> \\<lambda>(pq,m) i. pq!(i - 1)\"\n\n    definition hm_key_of_op :: \"('k,'v) ahm \\<Rightarrow> nat \\<Rightarrow> 'k nres\" where\n      \"hm_key_of_op \\<equiv> \\<lambda>(pq,m) i. ASSERT (i>0) \\<then> mop_list_get pq (i - 1)\"\n\n    lemma hm_key_of_op_unfold:\n      shows \"hm_key_of_op hm i = ASSERT (hm_valid hm i) \\<then> RETURN (hm_key_of hm i)\"\n      unfolding hm_valid_def hm_length_def hm_key_of_op_def hm_key_of_def\n      by (auto split: prod.splits simp: pw_eq_iff refine_pw_simps)\n\n    lemma val_of_hmr_\\<alpha>[simp]: \"hm_valid hm i \\<Longrightarrow> h.val_of (hmr_\\<alpha> hm) i \n      = the (heapmap_\\<alpha> hm (hm_key_of hm i))\"\n      by (auto \n        simp: hmr_\\<alpha>_def h.val_of_def heapmap_\\<alpha>_def hm_key_of_def hm_valid_def hm_length_def\n        split: prod.splits)\n \n    lemma hm_\\<alpha>_key_ex[simp]:\n      \"\\<lbrakk>hmr_invar hm; hm_valid hm i\\<rbrakk> \\<Longrightarrow> (heapmap_\\<alpha> hm (hm_key_of hm i) \\<noteq> None)\"\n      unfolding heapmap_invar_def hmr_invar_def hm_valid_def heapmap_\\<alpha>_def \n        hm_key_of_def hm_length_def\n      by (auto split: prod.splits)  \n\n    subsubsection \\<open>Lookup\\<close>\n    abbreviation (input) hm_lookup where \"hm_lookup \\<equiv> heapmap_\\<alpha>\"\n\n    definition \"hm_the_lookup_op hm k \\<equiv> \n      ASSERT (heapmap_\\<alpha> hm k \\<noteq> None \\<and> hmr_invar hm) \n      \\<then> RETURN (the (heapmap_\\<alpha> hm k))\"\n\n\n    subsubsection \\<open>Exchange\\<close>  \n    text \\<open>Exchange two indices\\<close>\n\n    definition \"hm_exch_op \\<equiv> \\<lambda>(pq,m) i j. do {\n      ASSERT (hm_valid (pq,m) i);\n      ASSERT (hm_valid (pq,m) j);\n      ASSERT (hmr_invar (pq,m));\n      pq \\<leftarrow> mop_list_swap pq (i - 1) (j - 1);\n      RETURN (pq,m)\n    }\"\n\n    lemma hm_exch_op_invar: \"hm_exch_op hm i j \\<le>\\<^sub>n SPEC hmr_invar\"\n      unfolding hm_exch_op_def h.exch_op_def h.val_of_op_def h.update_op_def\n      apply simp\n      apply refine_vcg\n      apply (auto simp: hm_valid_def map_swap hm_length_def hmr_rel_defs)\n      done\n\n    lemma hm_exch_op_refine: \"(hm_exch_op,h.exch_op) \\<in> hmr_rel \\<rightarrow> nat_rel \\<rightarrow> nat_rel \\<rightarrow> \\<langle>hmr_rel\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding hm_exch_op_def h.exch_op_def h.val_of_op_def h.update_op_def\n      apply simp\n      apply refine_vcg\n      apply (auto simp: hm_valid_def map_swap hm_length_def hmr_rel_defs)\n      done\n      \n    lemmas hm_exch_op_refine'[refine] = hm_exch_op_refine[param_fo, THEN nres_relD]\n\n    definition hm_exch :: \"('k,'v) ahm \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ('k,'v) ahm\"\n      where \"hm_exch \\<equiv> \\<lambda>(pq,m) i j. (swap pq (i-1) (j-1),m)\"\n\n      \n    lemma hm_exch_op_\\<alpha>_correct: \"hm_exch_op hm i j \\<le>\\<^sub>n SPEC (\\<lambda>hm'. \n      hm_valid hm i \\<and> hm_valid hm j \\<and> hm'=hm_exch hm i j\n      )\"\n      unfolding hm_exch_op_def\n      apply refine_vcg\n      apply (vc_solve simp: hm_valid_def hm_length_def heapmap_\\<alpha>_def solve: asm_rl)\n      apply (auto simp add: hm_key_of_def hm_exch_def swap_def) []\n      done\n\n    lemma hm_exch_\\<alpha>[simp]: \"heapmap_\\<alpha> (hm_exch hm i j) = (heapmap_\\<alpha> hm)\"\n      by (auto simp: heapmap_\\<alpha>_def hm_exch_def split: prod.splits)\n    lemma hm_exch_valid[simp]: \"hm_valid (hm_exch hm i j) = hm_valid hm\"\n      by (intro ext) (auto simp: hm_valid_def hm_length_def hm_exch_def split: prod.splits)\n    lemma hm_exch_length[simp]: \"hm_length (hm_exch hm i j) = hm_length hm\"\n      by (auto simp: hm_length_def hm_exch_def split: prod.splits)\n\n    lemma hm_exch_same[simp]: \"hm_exch hm i i = hm\"  \n      by (auto simp: hm_exch_def split: prod.splits)\n      \n\n    lemma hm_key_of_exch_conv[simp]:   \n      \"\\<lbrakk>hm_valid hm i; hm_valid hm j; hm_valid hm k\\<rbrakk> \\<Longrightarrow> \n        hm_key_of (hm_exch hm i j) k = (\n          if k=i then hm_key_of hm j\n          else if k=j then hm_key_of hm i\n          else hm_key_of hm k\n          )\"\n      unfolding hm_exch_def hm_valid_def hm_length_def hm_key_of_def\n      by (auto split: prod.splits)\n\n    lemma hm_key_of_exch_matching[simp]:  \n      \"\\<lbrakk>hm_valid hm i; hm_valid hm j\\<rbrakk> \\<Longrightarrow> hm_key_of (hm_exch hm i j) i = hm_key_of hm j\"\n      \"\\<lbrakk>hm_valid hm i; hm_valid hm j\\<rbrakk> \\<Longrightarrow> hm_key_of (hm_exch hm i j) j = hm_key_of hm i\"\n      by simp_all\n\n    subsubsection \\<open>Index\\<close>\n    text \\<open>Obtaining the index of a key\\<close>\n    definition \"hm_index \\<equiv> \\<lambda>(pq,m) k. index pq k + 1\"\n\n    lemma hm_index_valid[simp]: \"\\<lbrakk>hmr_invar hm; heapmap_\\<alpha> hm k \\<noteq> None\\<rbrakk> \\<Longrightarrow> hm_valid hm (hm_index hm k)\"\n      by (force simp: hm_valid_def heapmap_\\<alpha>_def hmr_invar_def hm_index_def hm_length_def Suc_le_eq)\n\n    lemma hm_index_key_of[simp]: \"\\<lbrakk>hmr_invar hm; heapmap_\\<alpha> hm k \\<noteq> None\\<rbrakk> \\<Longrightarrow> hm_key_of hm (hm_index hm k) = k\"\n      by (force \n          simp: hm_valid_def heapmap_\\<alpha>_def hmr_invar_def hm_index_def hm_length_def hm_key_of_def Suc_le_eq)\n\n\n    definition \"hm_index_op \\<equiv> \\<lambda>(pq,m) k. \n      do {\n        ASSERT (hmr_invar (pq,m) \\<and> heapmap_\\<alpha> (pq,m) k \\<noteq> None);\n        i \\<leftarrow> mop_list_index pq k;\n        RETURN (i+1)\n      }\"\n\n    lemma hm_index_op_correct:\n      assumes \"hmr_invar hm\"\n      assumes \"heapmap_\\<alpha> hm k \\<noteq> None\"\n      shows \"hm_index_op hm k \\<le> SPEC (\\<lambda>r. r= hm_index hm k)\"\n      using assms unfolding hm_index_op_def\n      apply refine_vcg\n      apply (auto simp: heapmap_\\<alpha>_def hmr_invar_def hm_index_def index_nth_id)\n      done\n    lemmas [refine_vcg] = hm_index_op_correct  \n      \n\n    subsubsection \\<open>Update\\<close>  \n    text \\<open>Updating the heap at an index\\<close>\n    definition hm_update_op :: \"('k,'v) ahm \\<Rightarrow> nat \\<Rightarrow> 'v \\<Rightarrow> ('k,'v) ahm nres\" where\n      \"hm_update_op \\<equiv> \\<lambda>(pq,m) i v. do {\n        ASSERT (hm_valid (pq,m) i \\<and> hmr_invar (pq,m));\n        k \\<leftarrow> mop_list_get pq (i - 1);\n        RETURN (pq, m(k \\<mapsto> v))\n      }\"\n    \n    lemma hm_update_op_invar: \"hm_update_op hm k v \\<le>\\<^sub>n SPEC hmr_invar\"\n      unfolding hm_update_op_def h.update_op_def\n      apply refine_vcg\n      by (auto simp: hmr_rel_defs map_distinct_upd_conv hm_valid_def hm_length_def)\n\n    lemma hm_update_op_refine: \"(hm_update_op, h.update_op) \\<in> hmr_rel \\<rightarrow> nat_rel \\<rightarrow> Id \\<rightarrow> \\<langle>hmr_rel\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding hm_update_op_def h.update_op_def mop_list_get_alt mop_list_set_alt\n      apply refine_vcg\n      apply (auto simp: hmr_rel_defs map_distinct_upd_conv hm_valid_def hm_length_def)\n      done\n      \n    lemmas [refine] = hm_update_op_refine[param_fo, THEN nres_relD]\n\n    lemma hm_update_op_\\<alpha>_correct:\n      assumes \"hmr_invar hm\"\n      assumes \"heapmap_\\<alpha> hm k \\<noteq> None\"\n      shows \"hm_update_op hm (hm_index hm k) v \\<le>\\<^sub>n SPEC (\\<lambda>hm'. heapmap_\\<alpha> hm' = (heapmap_\\<alpha> hm)(k\\<mapsto>v))\"  \n      using assms\n      unfolding hm_update_op_def\n      apply refine_vcg\n      apply (force simp: heapmap_rel_defs hmr_rel_defs hm_index_def)\n      done\n\n    subsubsection \\<open>Butlast\\<close>  \n    text \\<open>Remove last element\\<close>  \n    definition hm_butlast_op :: \"('k,'v) ahm \\<Rightarrow> ('k,'v) ahm nres\" where\n      \"hm_butlast_op \\<equiv> \\<lambda>(pq,m). do {\n        ASSERT (hmr_invar (pq,m));\n        k \\<leftarrow> mop_list_get pq (length pq - 1);\n        pq \\<leftarrow> mop_list_butlast pq;\n        let m = m(k:=None);\n        RETURN (pq,m)\n      }\"\n\n    lemma hm_butlast_op_refine: \"(hm_butlast_op, h.butlast_op) \\<in> hmr_rel \\<rightarrow> \\<langle>hmr_rel\\<rangle>nres_rel\"\n      supply [simp del] = map_upd_eq_restrict\n      apply (intro fun_relI nres_relI)\n      unfolding hm_butlast_op_def h.butlast_op_def\n      apply simp\n      apply refine_vcg\n      apply (clarsimp_all simp: hmr_rel_defs map_butlast distinct_butlast)\n      apply (auto simp: neq_Nil_rev_conv) []\n      done\n\n    lemmas [refine] = hm_butlast_op_refine[param_fo, THEN nres_relD]\n\n    lemma hm_butlast_op_\\<alpha>_correct: \"hm_butlast_op hm \\<le>\\<^sub>n SPEC (\n      \\<lambda>hm'. heapmap_\\<alpha> hm' = (heapmap_\\<alpha> hm)( hm_key_of hm (hm_length hm) := None ))\"\n      unfolding hm_butlast_op_def\n      apply refine_vcg\n      apply (auto simp: heapmap_\\<alpha>_def hm_key_of_def hm_length_def)\n      done\n      \n    subsubsection \\<open>Append\\<close>\n    text \\<open>Append new element at end of heap\\<close>\n\n    definition hm_append_op :: \"('k,'v) ahm \\<Rightarrow> 'k \\<Rightarrow> 'v \\<Rightarrow> ('k,'v) ahm nres\"\n      where \"hm_append_op \\<equiv> \\<lambda>(pq,m) k v. do {\n        ASSERT (k \\<notin> dom m);\n        ASSERT (hmr_invar (pq,m));\n        pq \\<leftarrow> mop_list_append pq k;\n        let m = m (k \\<mapsto> v);\n        RETURN (pq,m)\n      }\"\n\n    lemma hm_append_op_invar: \"hm_append_op hm k v \\<le>\\<^sub>n SPEC hmr_invar\"  \n      unfolding hm_append_op_def h.append_op_def\n      apply refine_vcg\n      unfolding heapmap_\\<alpha>_def hmr_rel_defs\n      apply (auto simp: )\n      done\n\n    lemma hm_append_op_refine: \"\\<lbrakk> heapmap_\\<alpha> hm k = None; (hm,h)\\<in>hmr_rel \\<rbrakk> \n      \\<Longrightarrow> (hm_append_op hm k v, h.append_op h v) \\<in> \\<langle>hmr_rel\\<rangle>nres_rel\"  \n      apply (intro fun_relI nres_relI)\n      unfolding hm_append_op_def h.append_op_def\n      apply refine_vcg\n      unfolding heapmap_\\<alpha>_def hmr_rel_defs\n      apply (auto simp: )\n      done\n\n    lemmas hm_append_op_refine'[refine] = hm_append_op_refine[param_fo, THEN nres_relD]\n    \n    lemma hm_append_op_\\<alpha>_correct: \n      \"hm_append_op hm k v \\<le>\\<^sub>n SPEC (\\<lambda>hm'. heapmap_\\<alpha> hm' = (heapmap_\\<alpha> hm) (k \\<mapsto> v))\"\n      unfolding hm_append_op_def\n      apply refine_vcg\n      by (auto simp: heapmap_\\<alpha>_def)\n\n\n    subsection \\<open>Auxiliary Operations\\<close>  \n    text \\<open>Auxiliary operations on heapmaps, which are derived \n      from the basic operations, but do not correspond to \n      operations of the priority map interface\\<close>\n    \n\n    text \\<open>We start with some setup\\<close>\n\n    lemma heapmap_hmr_relI: \"(hm,h)\\<in>heapmap_rel \\<Longrightarrow> (hm,hmr_\\<alpha> hm) \\<in> hmr_rel\"  \n      by (auto simp: heapmap_rel_defs hmr_rel_defs)\n\n    lemma heapmap_hmr_relI': \"heapmap_invar hm \\<Longrightarrow> (hm,hmr_\\<alpha> hm) \\<in> hmr_rel\"  \n      by (auto simp: heapmap_rel_defs hmr_rel_defs)\n\n    text \\<open>The basic principle how we prove correctness of our operations:\n      Invariant preservation is shown by relating the operations to \n      operations on heaps. Then, only correctness on the abstraction \n      remains to be shown, assuming the operation does not fail.\n      \\<close>  \n    lemma heapmap_nres_relI':\n      assumes \"hm \\<le> \\<Down>hmr_rel h'\"\n      assumes \"h' \\<le> SPEC (h.heap_invar)\"\n      assumes \"hm \\<le>\\<^sub>n SPEC (\\<lambda>hm'. RETURN (heapmap_\\<alpha> hm') \\<le> h)\"\n      shows \"hm \\<le> \\<Down>heapmap_rel h\"\n      using assms\n      unfolding heapmap_rel_defs hmr_rel_def\n      by (auto simp: pw_le_iff pw_leof_iff refine_pw_simps)\n\n    lemma heapmap_nres_relI'':\n      assumes \"hm \\<le> \\<Down>hmr_rel h'\"\n      assumes \"h' \\<le> SPEC \\<Phi>\"\n      assumes \"\\<And>h'. \\<Phi> h' \\<Longrightarrow> h.heap_invar h'\"\n      assumes \"hm \\<le>\\<^sub>n SPEC (\\<lambda>hm'. RETURN (heapmap_\\<alpha> hm') \\<le> h)\"\n      shows \"hm \\<le> \\<Down>heapmap_rel h\"\n      apply (rule heapmap_nres_relI')\n      apply fact\n      apply (rule order_trans, fact)\n      apply (clarsimp; fact)\n      apply fact\n      done\n\n    subsubsection \\<open>Val-of\\<close>\n    text \\<open>Indexing into the heap\\<close>\n    definition hm_val_of_op :: \"('k,'v) ahm \\<Rightarrow> nat \\<Rightarrow> 'v nres\" where\n      \"hm_val_of_op \\<equiv> \\<lambda>hm i. do {\n        k \\<leftarrow> hm_key_of_op hm i;\n        v \\<leftarrow> hm_the_lookup_op hm k;\n        RETURN v\n      }\"\n\n    lemma hm_val_of_op_refine: \"(hm_val_of_op,h.val_of_op) \\<in> (hmr_rel \\<rightarrow> nat_rel \\<rightarrow> \\<langle>Id\\<rangle>nres_rel)\"  \n      apply (intro fun_relI nres_relI)\n      unfolding hm_val_of_op_def h.val_of_op_def \n        hm_key_of_op_def hm_key_of_def hm_valid_def hm_length_def\n        hm_the_lookup_op_def\n      apply clarsimp\n      apply (rule refine_IdD)\n      apply refine_vcg\n      apply (auto simp: hmr_rel_defs heapmap_\\<alpha>_def)\n      done\n\n    lemmas [refine] = hm_val_of_op_refine[param_fo, THEN nres_relD]\n\n    subsubsection \\<open>Prio-of\\<close>  \n    text \\<open>Priority of key\\<close>\n    definition \"hm_prio_of_op h i \\<equiv> do {v \\<leftarrow> hm_val_of_op h i; RETURN (prio v)}\"\n    \n    lemma hm_prio_of_op_refine: \"(hm_prio_of_op, h.prio_of_op) \\<in> hmr_rel \\<rightarrow> nat_rel \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding hm_prio_of_op_def h.prio_of_op_def\n      apply refine_rcg\n      by auto\n\n    lemmas hm_prio_of_op_refine'[refine] = hm_prio_of_op_refine[param_fo, THEN nres_relD]\n\n    subsubsection \\<open>Swim\\<close>\n\n    definition hm_swim_op :: \"('k,'v) ahm \\<Rightarrow> nat \\<Rightarrow> ('k,'v) ahm nres\" where\n      \"hm_swim_op h i \\<equiv> do {\n        RECT (\\<lambda>swim (h,i). do {\n          ASSERT (hm_valid h i \\<and> h.swim_invar (hmr_\\<alpha> h) i);\n          if hm_valid h (h.parent i) then do {\n            ppi \\<leftarrow> hm_prio_of_op h (h.parent i);\n            pi \\<leftarrow> hm_prio_of_op h i;\n            if (\\<not>ppi \\<le> pi) then do {\n              h \\<leftarrow> hm_exch_op h i (h.parent i);\n              swim (h, h.parent i)\n            } else\n              RETURN h\n          } else \n            RETURN h\n        }) (h,i)\n      }\"\n\n    lemma hm_swim_op_refine: \"(hm_swim_op, h.swim_op) \\<in> hmr_rel \\<rightarrow> nat_rel \\<rightarrow> \\<langle>hmr_rel\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding hm_swim_op_def h.swim_op_def\n      apply refine_rcg\n      apply refine_dref_type\n      apply (clarsimp_all simp: hm_valid_refine[param_fo, THEN IdD])\n      apply (simp add: hmr_rel_def in_br_conv)\n      done\n\n    lemmas hm_swim_op_refine'[refine] = hm_swim_op_refine[param_fo, THEN nres_relD]\n\n\n    lemma hm_swim_op_nofail_imp_valid: \n      \"nofail (hm_swim_op hm i) \\<Longrightarrow> hm_valid hm i \\<and> h.swim_invar (hmr_\\<alpha> hm) i\"\n      unfolding hm_swim_op_def\n      apply (subst (asm) RECT_unfold, refine_mono)\n      by (auto simp: refine_pw_simps)\n\n    lemma hm_swim_op_\\<alpha>_correct: \"hm_swim_op hm i \\<le>\\<^sub>n SPEC (\\<lambda>hm'. heapmap_\\<alpha> hm' = heapmap_\\<alpha> hm)\"\n      apply (rule leof_add_nofailI)\n      apply (drule hm_swim_op_nofail_imp_valid)\n      unfolding hm_swim_op_def\n      apply (rule RECT_rule_leof[where \n            pre=\"\\<lambda>(hm',i). hm_valid hm' i \\<and> heapmap_\\<alpha> hm' = heapmap_\\<alpha> hm\"\n            and V = \"inv_image less_than snd\"\n            ])\n      apply simp\n      apply simp\n\n      unfolding hm_prio_of_op_def hm_val_of_op_def \n        hm_exch_op_def hm_key_of_op_def hm_the_lookup_op_def\n      apply (refine_vcg)\n      apply (vc_solve simp add: hm_valid_def hm_length_def)\n      apply rprems\n      apply (vc_solve simp: heapmap_\\<alpha>_def h.parent_def)\n      done\n\n    subsubsection \\<open>Sink\\<close>  \n    definition hm_sink_op\n    where   \n      \"hm_sink_op h k \\<equiv> RECT (\\<lambda>D (h,k). do {\n        ASSERT (k>0 \\<and> k\\<le>hm_length h);\n        let len = hm_length h;\n        if (2*k \\<le> len) then do {\n          let j = 2*k;\n          pj \\<leftarrow> hm_prio_of_op h j;\n\n          j \\<leftarrow> (\n            if j<len then do {\n              psj \\<leftarrow> hm_prio_of_op h (Suc j);\n              if pj>psj then RETURN (j+1) else RETURN j\n            } else RETURN j);\n\n          pj \\<leftarrow> hm_prio_of_op h j;\n          pk \\<leftarrow> hm_prio_of_op h k;\n          if (pk > pj) then do {\n            h \\<leftarrow> hm_exch_op h k j;\n            D (h,j)\n          } else\n            RETURN h\n        } else RETURN h    \n      }) (h,k)\"\n    \n    lemma hm_sink_op_refine: \"(hm_sink_op, h.sink_op) \\<in> hmr_rel \\<rightarrow> nat_rel \\<rightarrow> \\<langle>hmr_rel\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding hm_sink_op_def h.sink_op_opt_eq[symmetric] h.sink_op_opt_def\n      apply refine_rcg\n      apply refine_dref_type\n\n      unfolding hmr_rel_def heapmap_rel_def \n      apply (clarsimp_all simp: in_br_conv)\n      done\n\n    lemmas hm_sink_op_refine'[refine] = hm_sink_op_refine[param_fo, THEN nres_relD]\n\n    lemma hm_sink_op_nofail_imp_valid: \"nofail (hm_sink_op hm i) \\<Longrightarrow> hm_valid hm i\"\n      unfolding hm_sink_op_def\n      apply (subst (asm) RECT_unfold, refine_mono)\n      by (auto simp: refine_pw_simps hm_valid_def)\n      \n    lemma hm_sink_op_\\<alpha>_correct: \"hm_sink_op hm i \\<le>\\<^sub>n SPEC (\\<lambda>hm'. heapmap_\\<alpha> hm' = heapmap_\\<alpha> hm)\"\n      apply (rule leof_add_nofailI)\n      apply (drule hm_sink_op_nofail_imp_valid)\n      unfolding hm_sink_op_def\n      apply (rule RECT_rule_leof[where \n            pre=\"\\<lambda>(hm',i). hm_valid hm' i \\<and> heapmap_\\<alpha> hm' = heapmap_\\<alpha> hm \\<and> hm_length hm' = hm_length hm\"\n            and V = \"measure (\\<lambda>(hm',i). hm_length hm' - i)\"\n            ])\n      apply simp\n      apply simp\n\n      unfolding hm_prio_of_op_def hm_val_of_op_def hm_exch_op_def \n        hm_key_of_op_def hm_the_lookup_op_def\n      apply (refine_vcg)\n      apply (vc_solve simp add: hm_valid_def hm_length_def) (* Takes long *)\n      apply rprems\n      apply (vc_solve simp: heapmap_\\<alpha>_def h.parent_def split: prod.splits)\n      apply (auto)\n      done\n\n    subsubsection \\<open>Repair\\<close>\n    definition \"hm_repair_op hm i \\<equiv> do {\n      hm \\<leftarrow> hm_sink_op hm i;\n      hm \\<leftarrow> hm_swim_op hm i;\n      RETURN hm\n    }\"\n    \n    lemma hm_repair_op_refine: \"(hm_repair_op, h.repair_op) \\<in> hmr_rel \\<rightarrow> nat_rel \\<rightarrow> \\<langle>hmr_rel\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding hm_repair_op_def h.repair_op_def\n      by refine_rcg\n      \n    lemmas hm_repair_op_refine'[refine] = hm_repair_op_refine[param_fo, THEN nres_relD]\n\n    lemma hm_repair_op_\\<alpha>_correct: \"hm_repair_op hm i \\<le>\\<^sub>n SPEC (\\<lambda>hm'. heapmap_\\<alpha> hm' = heapmap_\\<alpha> hm)\"\n      unfolding hm_repair_op_def\n      apply (refine_vcg \n        hm_swim_op_\\<alpha>_correct[THEN leof_trans] \n        hm_sink_op_\\<alpha>_correct[THEN leof_trans])\n      by auto\n\n\n    subsection \\<open>Operations\\<close>    \n    text \\<open>In this section, we define the operations that implement the priority-map interface\\<close>\n\n    subsubsection \\<open>Empty\\<close>\n    definition hm_empty_op :: \"('k,'v) ahm nres\" \n      where \"hm_empty_op \\<equiv> RETURN ([],Map.empty)\"\n\n    lemma hm_empty_aref: \"(hm_empty_op,RETURN op_map_empty) \\<in> \\<langle>heapmap_rel\\<rangle>nres_rel\"  \n      unfolding hm_empty_op_def \n      by (auto simp: heapmap_rel_defs hmr_rel_defs intro: nres_relI)\n\n    subsubsection \\<open>Insert\\<close>\n    definition hm_insert_op :: \"'k \\<Rightarrow> 'v \\<Rightarrow> ('k,'v) ahm \\<Rightarrow> ('k,'v) ahm nres\" where\n      \"hm_insert_op \\<equiv> \\<lambda>k v h. do {\n        ASSERT (h.heap_invar (hmr_\\<alpha> h));\n        h \\<leftarrow> hm_append_op h k v;\n        let l = hm_length h;\n        h \\<leftarrow> hm_swim_op h l;\n        RETURN h\n      }\"\n      \n    lemma hm_insert_op_refine[refine]: \"\\<lbrakk> heapmap_\\<alpha> hm k = None; (hm,h)\\<in>hmr_rel \\<rbrakk> \\<Longrightarrow>\n      hm_insert_op k v hm \\<le> \\<Down>hmr_rel (h.insert_op v h)\"\n      unfolding hm_insert_op_def h.insert_op_def\n      apply refine_rcg\n      by (auto simp: hmr_rel_def br_def)\n\n    lemma hm_insert_op_aref: \n      \"(hm_insert_op,mop_map_update_new) \\<in> Id \\<rightarrow> Id \\<rightarrow> heapmap_rel \\<rightarrow> \\<langle>heapmap_rel\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding mop_map_update_new_alt\n      apply (rule ASSERT_refine_right)\n      apply (rule heapmap_nres_relI''[OF hm_insert_op_refine h.insert_op_correct])\n      apply (unfold heapmap_rel_def in_br_conv; clarsimp)\n      apply (erule heapmap_hmr_relI)\n      apply (unfold heapmap_rel_def in_br_conv; clarsimp)\n      apply (unfold heapmap_rel_def in_br_conv; clarsimp)\n      unfolding hm_insert_op_def\n      apply (refine_vcg \n        hm_append_op_\\<alpha>_correct[THEN leof_trans]\n        hm_swim_op_\\<alpha>_correct[THEN leof_trans])\n      apply (unfold heapmap_rel_def in_br_conv; clarsimp)\n      done\n\n    subsubsection \\<open>Is-Empty\\<close>  \n\n    lemma hmr_\\<alpha>_empty_iff[simp]: \n      \"hmr_invar hm \\<Longrightarrow> hmr_\\<alpha> hm = [] \\<longleftrightarrow> heapmap_\\<alpha> hm = Map.empty\"  \n      by (auto \n        simp: hmr_\\<alpha>_def heapmap_invar_def heapmap_\\<alpha>_def hmr_invar_def\n        split: prod.split)  \n\n    definition hm_is_empty_op :: \"('k,'v) ahm \\<Rightarrow> bool nres\" where\n      \"hm_is_empty_op \\<equiv> \\<lambda>hm. do {\n        ASSERT (hmr_invar hm);\n        let l = hm_length hm;\n        RETURN (l=0)\n      }\"\n\n    lemma hm_is_empty_op_refine: \"(hm_is_empty_op, h.is_empty_op) \\<in> hmr_rel \\<rightarrow> \\<langle>bool_rel\\<rangle>nres_rel\"  \n      apply (intro fun_relI nres_relI)\n      unfolding hm_is_empty_op_def h.is_empty_op_def\n      apply refine_rcg\n      apply (auto simp: hmr_rel_defs) []\n      apply (parametricity add: hm_length_refine)\n      done\n\n\n    lemma hm_is_empty_op_aref: \"(hm_is_empty_op, RETURN o op_map_is_empty) \\<in> heapmap_rel \\<rightarrow> \\<langle>bool_rel\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding hm_is_empty_op_def\n      apply refine_vcg\n      apply (auto simp: hmr_rel_defs heapmap_rel_defs hm_length_def)\n      done\n\n    subsubsection \\<open>Lookup\\<close>  \n\n    definition hm_lookup_op :: \"'k \\<Rightarrow> ('k,'v) ahm \\<Rightarrow> 'v option nres\"\n      where \"hm_lookup_op \\<equiv> \\<lambda>k hm. ASSERT (heapmap_invar hm) \\<then> RETURN (hm_lookup hm k)\"\n\n    lemma hm_lookup_op_aref: \"(hm_lookup_op,RETURN oo op_map_lookup) \\<in> Id \\<rightarrow> heapmap_rel \\<rightarrow> \\<langle>\\<langle>Id\\<rangle>option_rel\\<rangle>nres_rel\"  \n      apply (intro fun_relI nres_relI)\n      unfolding hm_lookup_op_def heapmap_rel_def in_br_conv\n      apply refine_vcg\n      apply simp_all\n      done\n\n    subsubsection \\<open>Contains-Key\\<close>  \n\n    definition \"hm_contains_key_op \\<equiv> \\<lambda>k (pq,m). ASSERT (heapmap_invar (pq,m)) \\<then> RETURN (k\\<in>dom m)\"\n    lemma hm_contains_key_op_aref: \"(hm_contains_key_op,RETURN oo op_map_contains_key) \\<in> Id \\<rightarrow> heapmap_rel \\<rightarrow> \\<langle>bool_rel\\<rangle>nres_rel\"  \n      apply (intro fun_relI nres_relI)\n      unfolding hm_contains_key_op_def heapmap_rel_defs\n      apply refine_vcg\n      by (auto)\n\n    subsubsection \\<open>Decrease-Key\\<close>  \n\n\n    definition \"hm_decrease_key_op \\<equiv> \\<lambda>k v hm. do {\n      ASSERT (heapmap_invar hm);\n      ASSERT (heapmap_\\<alpha> hm k \\<noteq> None \\<and> prio v \\<le> prio (the (heapmap_\\<alpha> hm k)));\n      i \\<leftarrow> hm_index_op hm k;\n      hm \\<leftarrow> hm_update_op hm i v;\n      hm_swim_op hm i\n    }\"\n\n    definition (in heapstruct) \"decrease_key_op i v h \\<equiv> do {\n      ASSERT (valid h i \\<and> prio v \\<le> prio_of h i);\n      h \\<leftarrow> update_op h i v;\n      swim_op h i\n    }\"\n\n    lemma (in heapstruct) decrease_key_op_invar: \n      \"\\<lbrakk>heap_invar h; valid h i; prio v \\<le> prio_of h i\\<rbrakk> \\<Longrightarrow> decrease_key_op i v h \\<le> SPEC heap_invar\"\n      unfolding decrease_key_op_def\n      apply refine_vcg\n      by (auto simp: swim_invar_decr)\n\n\n    lemma index_op_inline_refine:\n      assumes \"heapmap_invar hm\"\n      assumes \"heapmap_\\<alpha> hm k \\<noteq> None\"\n      assumes \"f (hm_index hm k) \\<le> m\"\n      shows \"do {i \\<leftarrow> hm_index_op hm k; f i} \\<le> m\"  \n      using hm_index_op_correct[of hm k] assms\n      by (auto simp: pw_le_iff refine_pw_simps)\n\n    lemma hm_decrease_key_op_refine: \n      \"\\<lbrakk>(hm,h)\\<in>hmr_rel; (hm,m)\\<in>heapmap_rel; m k = Some v'\\<rbrakk> \n        \\<Longrightarrow> hm_decrease_key_op k v hm \\<le>\\<Down>hmr_rel (h.decrease_key_op (hm_index hm k) v h)\"  \n      unfolding hm_decrease_key_op_def h.decrease_key_op_def\n      (*apply (rewrite at \"Let (hm_index hm k) _\" Let_def)*)\n      apply (refine_rcg index_op_inline_refine)\n      unfolding hmr_rel_def heapmap_rel_def in_br_conv\n      apply (clarsimp_all)\n      done\n\n    lemma hm_index_op_inline_leof: \n      assumes \"f (hm_index hm k) \\<le>\\<^sub>n m\"\n      shows \"do {i \\<leftarrow> hm_index_op hm k; f i} \\<le>\\<^sub>n m\"\n      using hm_index_op_correct[of hm k] assms unfolding hm_index_op_def\n      by (auto simp: pw_le_iff pw_leof_iff refine_pw_simps split: prod.splits)\n\n    lemma hm_decrease_key_op_\\<alpha>_correct: \n      \"heapmap_invar hm \\<Longrightarrow> hm_decrease_key_op k v hm \\<le>\\<^sub>n SPEC (\\<lambda>hm'. heapmap_\\<alpha> hm' = heapmap_\\<alpha> hm(k\\<mapsto>v))\"\n      unfolding hm_decrease_key_op_def\n      apply (refine_vcg \n        hm_update_op_\\<alpha>_correct[THEN leof_trans] \n        hm_swim_op_\\<alpha>_correct[THEN leof_trans]\n        hm_index_op_inline_leof\n        )\n      apply simp_all\n      done\n\n    lemma hm_decrease_key_op_aref: \n      \"(hm_decrease_key_op, PR_CONST (mop_pm_decrease_key prio)) \\<in> Id \\<rightarrow> Id \\<rightarrow> heapmap_rel \\<rightarrow> \\<langle>heapmap_rel\\<rangle>nres_rel\"\n      unfolding PR_CONST_def\n      apply (intro fun_relI nres_relI)\n      apply (frule heapmap_hmr_relI)\n      unfolding mop_pm_decrease_key_alt\n      apply (rule ASSERT_refine_right; clarsimp)\n      apply (rule heapmap_nres_relI')\n      apply (rule hm_decrease_key_op_refine; assumption)\n      unfolding heapmap_rel_def hmr_rel_def in_br_conv\n      apply (rule h.decrease_key_op_invar; simp; fail )\n      apply (refine_vcg hm_decrease_key_op_\\<alpha>_correct[THEN leof_trans]; simp; fail)\n      done\n\n    subsubsection \\<open>Increase-Key\\<close>  \n\n    definition \"hm_increase_key_op \\<equiv> \\<lambda>k v hm. do {\n      ASSERT (heapmap_invar hm);\n      ASSERT (heapmap_\\<alpha> hm k \\<noteq> None \\<and> prio v \\<ge> prio (the (heapmap_\\<alpha> hm k)));\n      i \\<leftarrow> hm_index_op hm k;\n      hm \\<leftarrow> hm_update_op hm i v;\n      hm_sink_op hm i\n    }\"\n\n    definition (in heapstruct) \"increase_key_op i v h \\<equiv> do {\n      ASSERT (valid h i \\<and> prio v \\<ge> prio_of h i);\n      h \\<leftarrow> update_op h i v;\n      sink_op h i\n    }\"\n\n    lemma (in heapstruct) increase_key_op_invar: \n      \"\\<lbrakk>heap_invar h; valid h i; prio v \\<ge> prio_of h i\\<rbrakk> \\<Longrightarrow> increase_key_op i v h \\<le> SPEC heap_invar\"\n      unfolding increase_key_op_def\n      apply refine_vcg\n      by (auto simp: sink_invar_incr)\n\n    lemma hm_increase_key_op_refine: \n      \"\\<lbrakk>(hm,h)\\<in>hmr_rel; (hm,m)\\<in>heapmap_rel; m k = Some v'\\<rbrakk> \n        \\<Longrightarrow> hm_increase_key_op k v hm \\<le>\\<Down>hmr_rel (h.increase_key_op (hm_index hm k) v h)\"  \n      unfolding hm_increase_key_op_def h.increase_key_op_def\n      (*apply (rewrite at \"Let (hm_index hm k) _\" Let_def)*)\n      apply (refine_rcg index_op_inline_refine)\n      unfolding hmr_rel_def heapmap_rel_def in_br_conv\n      apply (clarsimp_all)\n      done\n\n    lemma hm_increase_key_op_\\<alpha>_correct: \n      \"heapmap_invar hm \\<Longrightarrow> hm_increase_key_op k v hm \\<le>\\<^sub>n SPEC (\\<lambda>hm'. heapmap_\\<alpha> hm' = heapmap_\\<alpha> hm(k\\<mapsto>v))\"\n      unfolding hm_increase_key_op_def\n      apply (refine_vcg \n        hm_update_op_\\<alpha>_correct[THEN leof_trans] \n        hm_sink_op_\\<alpha>_correct[THEN leof_trans]\n        hm_index_op_inline_leof)\n      apply simp_all\n      done\n\n    lemma hm_increase_key_op_aref: \n      \"(hm_increase_key_op, PR_CONST (mop_pm_increase_key prio)) \\<in> Id \\<rightarrow> Id \\<rightarrow> heapmap_rel \\<rightarrow> \\<langle>heapmap_rel\\<rangle>nres_rel\"\n      unfolding PR_CONST_def\n      apply (intro fun_relI nres_relI)\n      apply (frule heapmap_hmr_relI)\n      unfolding mop_pm_increase_key_alt\n      apply (rule ASSERT_refine_right; clarsimp)\n      apply (rule heapmap_nres_relI')\n      apply (rule hm_increase_key_op_refine; assumption)\n      unfolding heapmap_rel_def hmr_rel_def in_br_conv\n      apply (rule h.increase_key_op_invar; simp; fail )\n      apply (refine_vcg hm_increase_key_op_\\<alpha>_correct[THEN leof_trans]; simp)\n      done\n\n    subsubsection \\<open>Change-Key\\<close>  \n\n    definition \"hm_change_key_op \\<equiv> \\<lambda>k v hm. do {\n      ASSERT (heapmap_invar hm);\n      ASSERT (heapmap_\\<alpha> hm k \\<noteq> None);\n      i \\<leftarrow> hm_index_op hm k;\n      hm \\<leftarrow> hm_update_op hm i v;\n      hm_repair_op hm i\n    }\"\n\n    definition (in heapstruct) \"change_key_op i v h \\<equiv> do {\n      ASSERT (valid h i);\n      h \\<leftarrow> update_op h i v;\n      repair_op h i\n    }\"\n\n    lemma (in heapstruct) change_key_op_invar: \n      \"\\<lbrakk>heap_invar h; valid h i\\<rbrakk> \\<Longrightarrow> change_key_op i v h \\<le> SPEC heap_invar\"\n      unfolding change_key_op_def\n      apply (refine_vcg)\n      apply hypsubst\n      apply refine_vcg\n      by (auto simp: sink_invar_incr)\n\n    lemma hm_change_key_op_refine: \n      \"\\<lbrakk>(hm,h)\\<in>hmr_rel; (hm,m)\\<in>heapmap_rel; m k = Some v'\\<rbrakk> \n        \\<Longrightarrow> hm_change_key_op k v hm \\<le>\\<Down>hmr_rel (h.change_key_op (hm_index hm k) v h)\"  \n      unfolding hm_change_key_op_def h.change_key_op_def\n      (*apply (rewrite at \"Let (hm_index hm k) _\" Let_def)*)\n      apply (refine_rcg index_op_inline_refine)\n      unfolding hmr_rel_def heapmap_rel_def in_br_conv\n      apply (clarsimp_all)\n      done\n\n    lemma hm_change_key_op_\\<alpha>_correct: \n      \"heapmap_invar hm \\<Longrightarrow> hm_change_key_op k v hm \\<le>\\<^sub>n SPEC (\\<lambda>hm'. heapmap_\\<alpha> hm' = heapmap_\\<alpha> hm(k\\<mapsto>v))\"\n      unfolding hm_change_key_op_def\n      apply (refine_vcg \n        hm_update_op_\\<alpha>_correct[THEN leof_trans] \n        hm_repair_op_\\<alpha>_correct[THEN leof_trans]\n        hm_index_op_inline_leof)\n      unfolding heapmap_rel_def in_br_conv\n      apply simp\n      apply simp\n      done\n\n    lemma hm_change_key_op_aref: \n      \"(hm_change_key_op, mop_map_update_ex) \\<in> Id \\<rightarrow> Id \\<rightarrow> heapmap_rel \\<rightarrow> \\<langle>heapmap_rel\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      apply (frule heapmap_hmr_relI)\n      unfolding mop_map_update_ex_alt\n      apply (rule ASSERT_refine_right; clarsimp)\n      apply (rule heapmap_nres_relI')\n      apply (rule hm_change_key_op_refine; assumption)\n      unfolding heapmap_rel_def hmr_rel_def in_br_conv\n      apply (rule h.change_key_op_invar; simp; fail )\n      apply ((refine_vcg hm_change_key_op_\\<alpha>_correct[THEN leof_trans]; simp))\n      done\n\n    subsubsection \\<open>Set\\<close>  \n\n    text \\<open>Realized as generic algorithm!\\<close> (* TODO: Implement as such! *)\n    lemma (in -) op_pm_set_gen_impl: \"RETURN ooo op_map_update = (\\<lambda>k v m. do {\n      c \\<leftarrow> RETURN (op_map_contains_key k m);\n      if c then \n        mop_map_update_ex k v m\n      else\n        mop_map_update_new k v m\n    })\"\n      apply (intro ext)\n      unfolding op_map_contains_key_def mop_map_update_ex_def mop_map_update_new_def\n      by simp\n\n    definition \"hm_set_op k v hm \\<equiv> do {\n      c \\<leftarrow> hm_contains_key_op k hm;\n      if c then\n        hm_change_key_op k v hm\n      else\n        hm_insert_op k v hm\n    }\"\n\n    lemma hm_set_op_aref: \n      \"(hm_set_op, RETURN ooo op_map_update) \\<in> Id \\<rightarrow> Id \\<rightarrow> heapmap_rel \\<rightarrow> \\<langle>heapmap_rel\\<rangle>nres_rel\"\n      unfolding op_pm_set_gen_impl\n      apply (intro fun_relI nres_relI)\n      unfolding hm_set_op_def o_def\n      apply (refine_rcg \n        hm_contains_key_op_aref[param_fo, unfolded o_def, THEN nres_relD]\n        hm_change_key_op_aref[param_fo, THEN nres_relD]\n        hm_insert_op_aref[param_fo, THEN nres_relD]\n        )\n      by auto\n\n\n \n    subsubsection \\<open>Pop-Min\\<close>  \n\n    definition hm_pop_min_op :: \"('k,'v) ahm \\<Rightarrow> (('k\\<times>'v) \\<times> ('k,'v) ahm) nres\" where\n      \"hm_pop_min_op hm \\<equiv> do {\n        ASSERT (heapmap_invar hm);\n        ASSERT (hm_valid hm 1);\n        k \\<leftarrow> hm_key_of_op hm 1;\n        v \\<leftarrow> hm_the_lookup_op hm k;\n        let l = hm_length hm;\n        hm \\<leftarrow> hm_exch_op hm 1 l;\n        hm \\<leftarrow> hm_butlast_op hm;\n        \n        if (l\\<noteq>1) then do {\n          hm \\<leftarrow> hm_sink_op hm 1;\n          RETURN ((k,v),hm)\n        } else RETURN ((k,v),hm)\n      }\"\n\n    lemma hm_pop_min_op_refine: \n      \"(hm_pop_min_op, h.pop_min_op) \\<in> hmr_rel \\<rightarrow> \\<langle>UNIV \\<times>\\<^sub>r hmr_rel\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding hm_pop_min_op_def h.pop_min_op_def\n      (* Project away stuff of second component *)\n      unfolding ignore_snd_refine_conv hm_the_lookup_op_def hm_key_of_op_unfold\n      apply (simp cong: if_cong add: Let_def)\n      apply (simp add: unused_bind_conv h.val_of_op_def refine_pw_simps)\n\n      (* Prove refinement *)\n      apply refine_rcg\n      unfolding hmr_rel_def in_br_conv\n      apply (unfold heapmap_invar_def;simp)\n      apply (auto simp: in_br_conv)\n      done\n\n    text \\<open>We demonstrate two different approaches for proving correctness \n      here.\n      The first approach uses the relation to plain heaps only to establish\n      the invariant. \n\n      The second approach also uses the relation to heaps to establish \n      correctness of the result.\n\n      The first approach seems to be more robust against badly set \n      up simpsets, which may be the case in early stages of development.\n\n      Assuming a working simpset, the second approach may be less work,\n      and the proof may look more elegant.\n      \\<close>  \n\n    text_raw \\<open>\\paragraph{First approach}\\<close>\n    text \\<open>Transfer heapmin-property to heapmap-domain\\<close>\n    lemma heapmap_min_prop:\n      assumes INV: \"heapmap_invar hm\"  \n      assumes V': \"heapmap_\\<alpha> hm k = Some v'\"\n      assumes NE: \"hm_valid hm (Suc 0)\"\n      shows \"prio (the (heapmap_\\<alpha> hm (hm_key_of hm (Suc 0)))) \\<le> prio v'\"\n    proof -  \n      \\<comment> \\<open>Transform into the domain of heaps\\<close>\n      obtain pq m where [simp]: \"hm=(pq,m)\" by (cases hm)\n\n      from NE have [simp]: \"pq\\<noteq>[]\" by (auto simp: hm_valid_def hm_length_def)\n\n      have CNV_LHS: \"prio (the (heapmap_\\<alpha> hm (hm_key_of hm (Suc 0)))) \n        = h.prio_of (hmr_\\<alpha> hm) (Suc 0)\"\n        by (auto simp: heapmap_\\<alpha>_def hm_key_of_def hmr_\\<alpha>_def h.val_of_def)\n        \n      from INV have INV': \"h.heap_invar (hmr_\\<alpha> hm)\"  \n        unfolding heapmap_invar_def by auto\n\n      from V' INV obtain i where IDX: \"h.valid (hmr_\\<alpha> hm) i\" \n        and CNV_RHS: \"prio v' = h.prio_of (hmr_\\<alpha> hm) i\" \n        apply (clarsimp simp: heapmap_\\<alpha>_def heapmap_invar_def hmr_invar_def hmr_\\<alpha>_def\n          h.valid_def h.val_of_def)\n        by (metis (no_types, hide_lams) Suc_leI comp_apply diff_Suc_Suc \n          diff_zero domI index_less_size_conv neq0_conv nth_index nth_map \n          old.nat.distinct(2) option.sel)\n        \n      from h.heap_min_prop[OF INV' IDX] show ?thesis\n        unfolding CNV_LHS CNV_RHS .\n    qed    \n\n\n    text \\<open>With the above lemma, the correctness proof is straightforward\\<close>\n    \n\n    lemma heapmap_nres_rel_prodI:\n      assumes \"hmx \\<le> \\<Down>(UNIV \\<times>\\<^sub>r hmr_rel) h'x\"\n      assumes \"h'x \\<le> SPEC (\\<lambda>(_,h'). h.heap_invar h')\"\n      assumes \"hmx \\<le>\\<^sub>n SPEC (\\<lambda>(r,hm'). RETURN (r,heapmap_\\<alpha> hm') \\<le> \\<Down>(R\\<times>\\<^sub>rId) hx)\"\n      shows \"hmx \\<le> \\<Down>(R\\<times>\\<^sub>rheapmap_rel) hx\"\n      using assms\n      unfolding heapmap_rel_def hmr_rel_def br_def heapmap_invar_def\n      apply (auto simp: pw_le_iff pw_leof_iff refine_pw_simps; blast)\n      done\n      \n\n    lemma hm_pop_min_op_aref: \"(hm_pop_min_op, PR_CONST (mop_pm_pop_min prio)) \\<in> heapmap_rel \\<rightarrow> \\<langle>(Id\\<times>\\<^sub>rId)\\<times>\\<^sub>rheapmap_rel\\<rangle>nres_rel\"  \n      unfolding PR_CONST_def\n      apply (intro fun_relI nres_relI)\n      apply (frule heapmap_hmr_relI)\n      unfolding mop_pm_pop_min_alt\n      apply (intro ASSERT_refine_right)\n      apply (rule heapmap_nres_rel_prodI)\n      apply (rule hm_pop_min_op_refine[param_fo, THEN nres_relD]; assumption)\n      unfolding heapmap_rel_def hmr_rel_def in_br_conv\n      apply (refine_vcg; simp)\n      apply (refine_vcg hm_pop_min_\\<alpha>_correct[THEN leof_trans]; simp split: prod.splits)\n      done\n      \n    text_raw \\<open>\\paragraph{Second approach}\\<close>\n\n    (* Alternative approach: Also use knowledge about result\n      in multiset domain. Obtaining property seems infeasible at first attempt! *)  \n\n    definition \"hm_kv_of_op hm i \\<equiv> do {\n      ASSERT (hm_valid hm i \\<and> hmr_invar hm);\n      k \\<leftarrow> hm_key_of_op hm i;\n      v \\<leftarrow> hm_the_lookup_op hm k;\n      RETURN (k, v)\n    }\"\n\n\n    definition \"kvi_rel hm i \\<equiv> {((k,v),v) | k v. hm_key_of hm i = k}\"\n\n    lemma hm_kv_op_refine[refine]:\n      assumes \"(hm,h)\\<in>hmr_rel\"\n      shows \"hm_kv_of_op hm i \\<le> \\<Down>(kvi_rel hm i) (h.val_of_op h i)\"\n      unfolding hm_kv_of_op_def h.val_of_op_def kvi_rel_def \n        hm_key_of_op_unfold hm_the_lookup_op_def\n      apply simp  \n      apply refine_vcg\n      using assms\n      by (auto \n        simp: hm_valid_def hm_length_def hmr_rel_defs heapmap_\\<alpha>_def hm_key_of_def\n        split: prod.splits)\n\n    definition hm_pop_min_op' :: \"('k,'v) ahm \\<Rightarrow> (('k\\<times>'v) \\<times> ('k,'v) ahm) nres\" where\n      \"hm_pop_min_op' hm \\<equiv> do {\n        ASSERT (heapmap_invar hm);\n        ASSERT (hm_valid hm 1);\n        kv \\<leftarrow> hm_kv_of_op hm 1;\n        let l = hm_length hm;\n        hm \\<leftarrow> hm_exch_op hm 1 l;\n        hm \\<leftarrow> hm_butlast_op hm;\n        \n        if (l\\<noteq>1) then do {\n          hm \\<leftarrow> hm_sink_op hm 1;\n          RETURN (kv,hm)\n        } else RETURN (kv,hm)\n      }\"\n\n\n    lemma hm_pop_min_op_refine': \n      \"\\<lbrakk> (hm,h)\\<in>hmr_rel \\<rbrakk> \\<Longrightarrow> hm_pop_min_op' hm \\<le> \\<Down>(kvi_rel hm 1 \\<times>\\<^sub>r hmr_rel) (h.pop_min_op h)\"\n      unfolding hm_pop_min_op'_def h.pop_min_op_def\n      (* Project away stuff of second component *)\n      unfolding ignore_snd_refine_conv\n      (* Prove refinement *)\n      apply refine_rcg\n      unfolding hmr_rel_def heapmap_rel_def\n      apply (unfold heapmap_invar_def; simp add: in_br_conv)\n      apply (simp_all add: in_br_conv)\n      done\n\n\n    lemma heapmap_nres_rel_prodI':\n      assumes \"hmx \\<le> \\<Down>(S \\<times>\\<^sub>r hmr_rel) h'x\"\n      assumes \"h'x \\<le> SPEC \\<Phi>\"\n      assumes \"\\<And>h' r. \\<Phi> (r,h') \\<Longrightarrow> h.heap_invar h'\"\n      assumes \"hmx \\<le>\\<^sub>n SPEC (\\<lambda>(r,hm'). (\\<exists>r'. (r,r')\\<in>S \\<and> \\<Phi> (r',hmr_\\<alpha> hm')) \\<and> hmr_invar hm' \\<longrightarrow> RETURN (r,heapmap_\\<alpha> hm') \\<le> \\<Down>(R\\<times>\\<^sub>rId) hx)\"\n      shows \"hmx \\<le> \\<Down>(R\\<times>\\<^sub>rheapmap_rel) hx\"\n      using assms\n      unfolding heapmap_rel_def hmr_rel_def heapmap_invar_def\n      apply (auto \n        simp: pw_le_iff pw_leof_iff refine_pw_simps in_br_conv\n        )\n      by meson\n\n    lemma ex_in_kvi_rel_conv:\n      \"(\\<exists>r'. (r,r')\\<in>kvi_rel hm i \\<and> \\<Phi> r') \\<longleftrightarrow> (fst r = hm_key_of hm i \\<and> \\<Phi> (snd r))\"  \n      unfolding kvi_rel_def\n      apply (cases r)\n      apply auto\n      done\n\n      \n    lemma hm_pop_min_aref': \"(hm_pop_min_op', mop_pm_pop_min prio) \\<in> heapmap_rel \\<rightarrow> \\<langle>(Id\\<times>\\<^sub>rId) \\<times>\\<^sub>r heapmap_rel\\<rangle>nres_rel\"  \n      apply (intro fun_relI nres_relI)\n      apply (frule heapmap_hmr_relI)\n      unfolding mop_pm_pop_min_alt\n      apply (intro ASSERT_refine_right)\n      apply (rule heapmap_nres_rel_prodI')\n        apply (erule hm_pop_min_op_refine')\n\n        apply (unfold heapmap_rel_def hmr_rel_def in_br_conv) []\n        apply (rule h.pop_min_op_correct)\n        apply simp\n        apply simp\n\n        apply simp\n\n        apply (clarsimp simp: ex_in_kvi_rel_conv split: prod.splits)\n        unfolding hm_pop_min_op'_def hm_kv_of_op_def hm_key_of_op_unfold\n          hm_the_lookup_op_def\n        apply (refine_vcg \n          hm_exch_op_\\<alpha>_correct[THEN leof_trans]\n          hm_butlast_op_\\<alpha>_correct[THEN leof_trans]\n          hm_sink_op_\\<alpha>_correct[THEN leof_trans]\n          )\n        unfolding heapmap_rel_def hmr_rel_def in_br_conv\n        apply (auto intro: ranI) \n      done\n\n    subsubsection \\<open>Remove\\<close>  \n\n    definition \"hm_remove_op k hm \\<equiv> do {\n      ASSERT (heapmap_invar hm);\n      ASSERT (k \\<in> dom (heapmap_\\<alpha> hm));\n      i \\<leftarrow> hm_index_op hm k;\n      let l = hm_length hm;\n      hm \\<leftarrow> hm_exch_op hm i l;\n      hm \\<leftarrow> hm_butlast_op hm;\n      if i \\<noteq> l then\n        hm_repair_op hm i\n      else  \n        RETURN hm\n    }\"\n\n    definition (in heapstruct) \"remove_op i h \\<equiv> do {\n      ASSERT (heap_invar h);\n      ASSERT (valid h i);\n      let l = length h;\n      h \\<leftarrow> exch_op h i l;\n      h \\<leftarrow> butlast_op h;\n      if i \\<noteq> l then\n        repair_op h i\n      else  \n        RETURN h\n    }\"\n\n    lemma (in -) swap_empty_iff[iff]: \"swap l i j = [] \\<longleftrightarrow> l=[]\"\n      by (auto simp: swap_def)\n\n    lemma (in heapstruct) \n      butlast_exch_last: \"butlast (exch h i (length h)) = update (butlast h) i (last h)\"  \n      unfolding exch_def update_def\n      apply (cases h rule: rev_cases)\n      apply (auto simp: swap_def butlast_list_update)\n      done\n\n    lemma (in heapstruct) remove_op_invar: \n      \"\\<lbrakk> heap_invar h; valid h i \\<rbrakk> \\<Longrightarrow> remove_op i h \\<le> SPEC heap_invar\"\n      unfolding remove_op_def\n      apply refine_vcg\n      apply (auto simp: valid_def) []\n      apply (auto simp: valid_def exch_def) []\n      apply (simp add: butlast_exch_last)\n      apply refine_vcg\n      apply auto []\n      apply auto []\n      apply (auto simp: valid_def) []\n      apply auto []\n      apply auto []\n      done\n\n    lemma hm_remove_op_refine[refine]: \n      \"\\<lbrakk> (hm,m)\\<in>heapmap_rel; (hm,h)\\<in>hmr_rel; heapmap_\\<alpha> hm k \\<noteq> None\\<rbrakk> \\<Longrightarrow> \n        hm_remove_op k hm \\<le> \\<Down>hmr_rel (h.remove_op (hm_index hm k) h)\"\n      unfolding hm_remove_op_def h.remove_op_def heapmap_rel_def\n      (*apply (rewrite at \"Let (hm_index hm k) _\" Let_def)*)\n      apply (refine_rcg index_op_inline_refine)\n      unfolding hmr_rel_def\n      apply (auto simp: in_br_conv)\n      done\n\n    \n\n    lemma hm_remove_op_aref:\n      \"(hm_remove_op,mop_map_delete_ex) \\<in> Id \\<rightarrow> heapmap_rel \\<rightarrow> \\<langle>heapmap_rel\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding mop_map_delete_ex_alt\n      apply (rule ASSERT_refine_right)\n      apply (frule heapmap_hmr_relI)\n      apply (rule heapmap_nres_relI')\n      apply (rule hm_remove_op_refine; assumption?)\n      apply (unfold heapmap_rel_def in_br_conv; auto)\n\n      unfolding heapmap_rel_def hmr_rel_def in_br_conv \n      apply (refine_vcg h.remove_op_invar; clarsimp; fail)\n      apply (refine_vcg hm_remove_op_\\<alpha>_correct[THEN leof_trans]; simp; fail)\n      done\n      \n    subsubsection \\<open>Peek-Min\\<close> \n\n\n    definition hm_peek_min_op :: \"('k,'v) ahm \\<Rightarrow> ('k\\<times>'v) nres\" where\n      \"hm_peek_min_op hm \\<equiv> hm_kv_of_op hm 1\"\n\n    lemma hm_peek_min_op_aref: \n      \"(hm_peek_min_op, PR_CONST (mop_pm_peek_min prio)) \\<in> heapmap_rel \\<rightarrow> \\<langle>Id\\<times>\\<^sub>rId\\<rangle>nres_rel\"  \n      unfolding PR_CONST_def\n      apply (intro fun_relI nres_relI)\n    proof -  \n      fix hm and m :: \"'k \\<rightharpoonup> 'v\"\n      assume A: \"(hm,m)\\<in>heapmap_rel\"\n      \n      from A have [simp]: \"h.heap_invar (hmr_\\<alpha> hm)\" \"hmr_invar hm\" \"m=heapmap_\\<alpha> hm\"\n        unfolding heapmap_rel_def in_br_conv heapmap_invar_def\n        by simp_all\n\n      have \"hm_peek_min_op hm \\<le> \\<Down> (kvi_rel hm 1) (h.peek_min_op (hmr_\\<alpha> hm))\"\n        unfolding hm_peek_min_op_def  h.peek_min_op_def\n        apply (refine_rcg hm_kv_op_refine)\n        using A\n        apply (simp add: heapmap_hmr_relI)\n        done\n      also have \"\\<lbrakk>hmr_\\<alpha> hm \\<noteq> []\\<rbrakk> \\<Longrightarrow> (h.peek_min_op (hmr_\\<alpha> hm)) \n        \\<le> SPEC (\\<lambda>v. v\\<in>ran (heapmap_\\<alpha> hm) \\<and> (\\<forall>v'\\<in>ran (heapmap_\\<alpha> hm). prio v \\<le> prio v'))\"  \n        apply refine_vcg\n        by simp_all\n      finally show \"hm_peek_min_op hm \\<le> \\<Down> (Id \\<times>\\<^sub>r Id) (mop_pm_peek_min prio m)\"  \n        unfolding mop_pm_peek_min_alt\n        apply (simp add: pw_le_iff refine_pw_simps hm_peek_min_op_def hm_kv_of_op_def \n            hm_key_of_op_unfold hm_the_lookup_op_def)\n        apply (fastforce simp: kvi_rel_def ran_def)\n        done\n\n    qed    \n\n\n  end\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/IICF/Impl/Heaps/IICF_Abs_Heapmap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370308082623216, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3408741844879085}}
{"text": "(*\n    File:        dTermDef.thy\n    Time-stamp:  <2016-01-03T15:09:36Z>\n    Author:      JRF\n    Web:         http://jrf.cocolog-nifty.com/software/2016/01/post.html\n    Logic Image: ZF (of Isabelle2015)\n*)\n\ntheory dTermDef imports Sum Nat_ZF Nth SubOcc LVariable begin\n\nconsts\n  dTerm :: i\n  dTag :: i\n\ndatatype\n  dTerm = dVar( \"x: LVariable\" )\n        | dBound( \"n: nat\" )\n        | dLam( \"M: dTerm\" )\n        | dApp( \"M: dTerm\", \"N: dTerm\")\n\ndatatype\n  dTag = TdVar( \"x: LVariable\" )\n       | TdBound( \"n: nat\" )\n       | TdLam\n       | TdApp\n\ndefinition dArity :: \"i=>i\" where\n\"dArity(T) == dTag_case(%z. 0, %z. 0, 1, 2, T)\"\n\ndefinition dTerm_cons :: \"[i, i]=>i\" where\n\"dTerm_cons(T, l) = dTag_case(%z. dVar(z), %z. dBound(z),\n                      dLam(nth(0, l)), dApp(nth(0, l), nth(1, l)), T)\"\n\ndefinition dOcc :: \"i=>i\" where\n\"dOcc(M) == dTerm_rec(\n            %x. Occ_cons(TdVar(x), []),\n            %n. Occ_cons(TdBound(n), []),\n            %N r. Occ_cons(TdLam, [r]),\n            %M N rm rn. Occ_cons(TdApp, [rm, rn]), M)\"\n\ndefinition dOccinv :: \"i=>i\" where\n\"dOccinv(x) == THE M. M: dTerm & x = dOcc(M)\"\n\ndefinition dSub :: \"i=>i\" where\n\"dSub(M) == {<l, dOccinv(Occ_Subtree(l, dOcc(M)))>. <l, T>: dOcc(M)}\"\n\ndefinition dsubterm :: \"[i, i]=>i\" where\n\"dsubterm(M, l) == THE N. <l, N>: dSub(M)\"\n\n\nlemma dTerm_rec_type:\n  assumes \"M: dTerm\"\n  and \"!!x. [| x: LVariable |] ==> c(x): C(dVar(x))\"\n  and \"!!n. [| n: nat |] ==> b(n): C(dBound(n))\"\n  and \"!!M r. [| M: dTerm;  r: C(M) |] ==>\n                   h(M,r): C(dLam(M))\"\n  and \"!!M N rm rn. [| M: dTerm;  N: dTerm;\n           rm: C(M); rn: C(N) |] ==> k(M,N,rm,rn): C(dApp(M,N))\"\n  shows \"dTerm_rec(c,b,h,k,M) : C(M)\"\napply (rule assms(1) [THEN dTerm.induct])\napply (simp_all add: assms)\ndone\n\nlemma dTerm_cons_eqns:\n  \"dTerm_cons(TdVar(x), []) = dVar(x)\"\n  \"dTerm_cons(TdBound(n), []) = dBound(n)\"\n  \"dTerm_cons(TdLam, [M]) = dLam(M)\"\n  \"dTerm_cons(TdApp, [M, N]) = dApp(M, N)\"\napply (simp_all add: dTerm_cons_def)\ndone\n\nlemma dArity_eqns:\n  \"dArity(TdVar(x)) = 0\"\n  \"dArity(TdBound(n)) = 0\"\n  \"dArity(TdLam) = 1\"\n  \"dArity(TdApp) = 2\"\napply (simp_all add: dArity_def)\ndone\n\nlemma dOcc_eqns:\n  \"dOcc(dVar(x)) = Occ_cons(TdVar(x), [])\"\n  \"dOcc(dBound(n)) = Occ_cons(TdBound(n), [])\"\n  \"dOcc(dLam(M)) = Occ_cons(TdLam, [dOcc(M)])\"\n  \"dOcc(dApp(M, N)) = Occ_cons(TdApp, [dOcc(M), dOcc(N)])\"\napply (simp_all add: dOcc_def)\ndone\n\nlemma dTerm_Term_cons_intrs:\n  \"x: LVariable ==> dTerm_cons(TdVar(x), []): dTerm\"\n  \"n: nat ==> dTerm_cons(TdBound(n), []): dTerm\"\n  \"[| M: dTerm |] ==> dTerm_cons(TdLam, [M]): dTerm\"\n  \"[| M: dTerm; N: dTerm |] ==> dTerm_cons(TdApp, [M, N]): dTerm\"\napply (simp_all add: dTerm_cons_eqns)\napply (assumption | rule dTerm.intros)+\ndone\n\nlemma dArity_type:\n  \"T: dTag ==> dArity(T): nat\"\napply (erule dTag.cases)\napply (simp_all add: dArity_eqns)\ndone\n\nlemma dTerm_Occ_cons_cond:\n  \"Occ_cons_cond(dTerm, dOcc, dTag, dArity)\"\napply (rule Occ_cons_condI)\napply (elim dTag.cases)\napply (simp_all add: dArity_eqns)\napply (elim dTag.cases)\napply (simp_all add: dArity_eqns)\n\napply (rule bexI)\napply (rule dOcc_eqns)\napply (typecheck add: dTerm.intros)\n\napply (rule bexI)\napply (rule dOcc_eqns)\napply (typecheck add: dTerm.intros)\n\napply (elim bexE conjE)\napply (erule nth_0E)\napply assumption\napply simp\napply simp\napply (rule bexI)\napply (rule dOcc_eqns)\napply (typecheck add: dTerm.intros)\n\napply (elim bexE conjE)\napply (erule nth_0E)\napply assumption\napply simp\napply simp\napply (erule nth_0E)\napply assumption\napply simp\napply simp\napply (rule bexI)\napply (rule dOcc_eqns)\napply (typecheck add: dTerm.intros)\ndone\n\nlemma dTerm_Occ_ind_cond:\n  \"Occ_ind_cond(dTerm, dOcc, dTag, dArity, dTerm_cons)\"\napply (rule Occ_ind_condI)\napply (erule dTerm.induct)\n\napply (drule bspec)\napply (drule_tac [2] bspec)\napply (drule_tac [3] mp)\napply (erule_tac [4] dTerm_cons_eqns [THEN subst])\napply (typecheck add: dTag.intros)\napply (simp add: dTerm_cons_eqns dArity_eqns dOcc_eqns)\napply (typecheck add: dTerm.intros)\n\napply (drule bspec)\napply (drule_tac [2] bspec)\napply (drule_tac [3] mp)\napply (erule_tac [4] dTerm_cons_eqns [THEN subst])\napply (typecheck add: dTag.intros)\napply (simp add: dTerm_cons_eqns dArity_eqns dOcc_eqns)\napply (typecheck add: dTerm.intros)\n\napply (drule bspec)\napply (drule_tac [2] bspec)\napply (drule_tac [3] mp)\napply (erule_tac [4] dTerm_cons_eqns [THEN subst])\napply (typecheck add: dTag.intros)\napply (simp add: dTerm_cons_eqns dArity_eqns dOcc_eqns)\napply (typecheck add: dTerm.intros)\n\napply (drule bspec)\napply (drule_tac [2] bspec)\napply (drule_tac [3] mp)\napply (erule_tac [4] dTerm_cons_eqns [THEN subst])\napply (typecheck add: dTag.intros)\napply (simp add: dTerm_cons_eqns dArity_eqns dOcc_eqns)\napply (typecheck add: dTerm.intros)\n\ndone\n\nlemma dTerm_Term_cons_inj_cond:\n  \"Term_cons_inj_cond(dTerm, dTag, dArity, dTerm_cons)\"\napply (rule Term_cons_inj_condI)\napply (rule iffI)\napply (elim dTag.cases)\nprefer 17\napply (elim dTag.cases)\napply (simp_all add: dTerm_cons_def dArity_def)\ndone\n\nlemmas dTerm_Term_cons_typechecks = (* nth_typechecks *)\n    dTerm_Term_cons_intrs dTag.intros \n    dArity_type Occ_ind_cond_Occ_domain [OF dTerm_Occ_ind_cond]\n    Occ_ind_cond_Occ_in_Occ_range [OF dTerm_Occ_ind_cond]\n    PowI succI1 succI2 (* consI1 *)consI2 (* nat_0I nat_succI *)\n\ndeclare dTerm_Term_cons_typechecks [TC]\n\nlemmas dTerm_Term_cons_simps = dArity_eqns (* dTerm_cons_eqns [THEN sym] *)\n\ndeclare dTerm_Term_cons_simps [simp]\n\nlemmas dTerm_cons_eqns_sym = dTerm_cons_eqns [THEN sym]\n\nend\n", "meta": {"author": "JRF-2018", "repo": "isabelle_TheLambda", "sha": "e89eff1cbbf26da9bc6a3af603ae9d099d97c1ad", "save_path": "github-repos/isabelle/JRF-2018-isabelle_TheLambda", "path": "github-repos/isabelle/JRF-2018-isabelle_TheLambda/isabelle_TheLambda-e89eff1cbbf26da9bc6a3af603ae9d099d97c1ad/legacy2015/dTermDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.340874177113215}}
{"text": "theory Universe\nimports Main \"HOL.BNF_Cardinal_Order_Relation\" Misc Tools TermX_Antiquot \"HOL-Library.Nat_Bijection\" \"HOL-Library.Rewrite\" \"HOL-ZF.HOLZF\"\nbegin\n\n(* For proving instances of types declared with \n  \"datatype\" (not \"datatype_new\"), see, e.g., \"char\"\n\n  For proving instances of types declared with \n  \"typedef\", see, e.g., \"ell1\"\n*)\n                                       \n(* definition \"powertower t == \\<forall>n. \\<exists>i. inj_on i (Pow (t n)) \\<and> i ` (Pow (t n)) \\<subseteq> t (Suc n)\" *)\n\n    \n\nlemma ZF_Pow_explode: \"Pow (explode z) = explode ` explode (Power z)\"\nproof (rule; rule)\n  fix x assume \"x \\<in> Pow (explode z)\" \n  hence \"x \\<subseteq> explode z\" by simp\n      \n  hence \"y \\<in> (explode z)\" if \"y \\<in> x\" for y  \n    using that by blast\n  hence yz: \"Elem y z\" if \"y \\<in> x\" for y\n    by (simp add: explode_Elem that) \n      \n  define y where \"y = Replacement z (\\<lambda>t. if (t \\<in> x) then Some t else None)\"\n  have xy: \"x = explode y\"\n    unfolding y_def explode_def Replacement\n    using yz by auto \n  have \"Elem y (Power z)\"\n    unfolding y_def\n    using Power xy y_def explode_Elem subset_def yz by force\n      \n  with xy show \"x \\<in> explode ` explode (Power z)\" \n    apply (subst explode_def) by auto\nnext\n  fix x assume \"x \\<in> explode ` explode (Power z)\"\n  thus \"x \\<in> Pow (explode z)\"\n    using Power explode_Elem subset_def by auto\nqed\n\n  \ntypedef val = \"{(x,n) | x n. Elem x ((Power ^^ n) Inf)}\" \n  apply (rule exI[of _ \"(Empty,0)\"])\n  by (simp add: Infinity)\n(*\nAlternatively, val can be axiomatized as follows, which is weaker than the ZF axioms \n(the axiomatization below is implied by existence of a smaller cardinal, namely beth_\\<omega>)\n\ntypedecl val\naxiomatization val_powertower :: \"nat \\<Rightarrow> val set\" where\n    val_powertower: \"\\<exists>i. inj_on i (Pow (val_powertower n)) \\<and> i ` (Pow (val_powertower n)) \\<subseteq> val_powertower (Suc n)\"\nand val_powertower_disjoint: \"x \\<in> val_powertower n \\<Longrightarrow> x \\<in> val_powertower m \\<Longrightarrow> n=m\"\nand val_powertower_nat: \"\\<exists>n (i::nat\\<Rightarrow>val). inj i \\<and> range i \\<subseteq> val_powertower n\" \nand val_powertower_all: \"(\\<Union>n. val_powertower n) = UNIV\"\n*)\n\n    \nsetup_lifting type_definition_val\ndefinition \"val_powertower n = {Abs_val (x,n) | x. Elem x ((Power ^^ n) Inf)}\"\nlemma val_powertower: \"\\<exists>i. inj_on i (Pow (val_powertower n)) \\<and> i ` (Pow (val_powertower n)) \\<subseteq> val_powertower (Suc n)\"\nproof -\n  define D0 where \"D0 = Pow (val_powertower n)\"\n  define i0 where \"i0 x = Rep_val ` x\" for x\n  have \"inj_on i0 D0\"\n    by (metis Rep_val_inverse \\<open>i0 \\<equiv> (`) Rep_val\\<close> inj_on_image inj_on_inverseI)\n  define D1 where \"D1 = i0 ` D0\"\n  have D1: \"D1 = Pow {(x,n) | x. Elem x ((Power ^^ n) Inf)}\" \n    unfolding D1_def i0_def D0_def val_powertower_def\n    apply (subst image_Pow_surj) apply rule\n    apply (subst image_Collect)\n    by (metis (no_types, hide_lams) Domainp.cases Rep_val_inverse cr_val_def val.domain_eq val.pcr_cr_eq)\n  define i1 where i1_def: \"i1 x = fst ` x\" for x :: \"(ZF*nat) set\"\n  have \"inj_on i1 D1\"\n    apply (rule inj_onI) unfolding i1_def D1 \n    apply auto\n    apply (smt \\<open>i1 \\<equiv> (`) fst\\<close> contra_subsetD fst_conv imageI image_iff mem_Collect_eq old.prod.exhaust prod.inject)\n    by (smt \\<open>i1 \\<equiv> (`) fst\\<close> contra_subsetD fst_conv imageI image_iff mem_Collect_eq old.prod.exhaust prod.inject)\n\n  define D2 where \"D2 = i1 ` D1\" \n  have \"D2 = Pow (explode ((Power ^^ n) Inf))\"\n    unfolding D2_def i1_def D1 explode_def\n    apply (subst image_Pow_surj) apply rule\n    apply (subst image_Collect) by auto\n  hence D2: \"D2 = explode ` explode ((Power ^^ Suc n) Inf)\"\n    unfolding ZF_Pow_explode by simp\n      \n  define i2 where \"i2 = implode\"\n  have \"inj_on i2 D2\"\n    apply (rule inj_onI) unfolding D2 i2_def by auto\n\n  define D3 where \"D3 = i2 ` D2\"\n  have D3: \"D3 = explode ((Power ^^ Suc n) Inf)\"\n    unfolding D3_def D2 i2_def  image_comp o_def  by simp\n  define i3 where \"i3 z = Abs_val (z, Suc n)\" for z\n  have \"inj_on i3 D3\"\n    apply (rule inj_onI)\n    unfolding i3_def\n    by (metis D3 Domainp.cases Rep_val_inverse cr_val_def explode_Elem prod.sel(1) val.domain_eq val.pcr_cr_eq)\n      \n  define D4 where \"D4 = i3 ` D3\" \n  have D4: \"D4 = val_powertower (Suc n)\" \n    unfolding val_powertower_def D4_def D3 i3_def\n    by (simp add: explode_def image_Collect)\n      \n  define i where \"i = i3 o i2 o i1 o i0\"\n  have inj_i: \"inj_on i D0\" \n    unfolding i_def \n    apply (rule comp_inj_on, fact \\<open>inj_on i0 D0\\<close>)\n    unfolding D1_def[symmetric]\n    apply (rule comp_inj_on, fact \\<open>inj_on i1 D1\\<close>)\n    unfolding D2_def[symmetric]\n    apply (rule comp_inj_on, fact \\<open>inj_on i2 D2\\<close>)\n    unfolding D3_def[symmetric]\n    by (fact \\<open>inj_on i3 D3\\<close>)\n      \n  have i_D0: \"i ` D0 = D4\" \n    unfolding D4_def D3_def D2_def D1_def i_def by auto\n      \n  show ?thesis\n    apply (rule exI[of _ i])\n    using D0_def inj_i i_D0 D4\n    by auto\nqed\n  \nlemma val_powertower_disjoint: \"x \\<in> val_powertower n \\<Longrightarrow> x \\<in> val_powertower m \\<Longrightarrow> n=m\"\n  using type_definition.Abs_inject type_definition_val val_powertower_def by fastforce\n  \nlemma val_powertower_nat: \"\\<exists>n (i::nat\\<Rightarrow>val). inj i \\<and> range i \\<subseteq> val_powertower n\"\nproof - \n  define i where \"i m = Abs_val (nat2Nat m, 0)\" for m\n  have \"inj i\" \n    apply (rule injI) unfolding i_def\n    apply (subst (asm) Abs_val_inject)\n      apply (simp add: Elem_nat2Nat_inf)\n     apply (simp add: Elem_nat2Nat_inf)\n    by (meson injD inj_nat2Nat old.prod.inject)\n      \n  moreover have \"range i \\<subseteq> val_powertower 0\"\n    unfolding val_powertower_def i_def by auto\n      \n  ultimately show ?thesis\n    by auto\nqed\n  \nlemma val_powertower_all: \"(\\<Union>n. val_powertower n) = UNIV\"\n  unfolding val_powertower_def\n  apply auto\n  by (smt Rep_val Rep_val_inverse mem_Collect_eq)\n\n\ninstantiation val :: equal begin\ndefinition \"equal_val (v::val) w = (v=w)\"\ninstance apply intro_classes\n  by (simp add: equal_val_def)\nend\n\n(* definition \"small_cardinal (_::'a itself) = (\\<exists>t n (i::'a\\<Rightarrow>val). powertower t \\<and> inj i \\<and> range i \\<subseteq> t n)\" *)\n\nclass prog_type = default +\n  fixes embedding' :: \"('a \\<Rightarrow> val) \\<times> nat\"\n  assumes embedding'_range: \"range (fst embedding') \\<subseteq> val_powertower (snd embedding')\"\n  assumes inj_embedding': \"inj (fst embedding')\"\n  (* assumes small_cardinal: \"\\<exists>t n. powertower t \\<and> range embedding \\<subseteq> t n\" *)\n\ndefinition embedding'_default :: \"('a\\<Rightarrow>val) \\<times> nat\" where \n  \"embedding'_default == (SOME fn. inj (fst fn) \\<and> range (fst fn) \\<subseteq> val_powertower (snd fn))\"\n\ndefinition \"embedding = fst embedding'\" \n(* definition embedding :: \"'a::prog_type \\<Rightarrow> val\" where\n  \"embedding == (SOME f::'a\\<Rightarrow>val. inj f)\" *)\n\nlemma embedding_inv [simp]: \"(embedding x = embedding y) = (x = y)\"\n  using inj_embedding' unfolding embedding_def inj_on_def by auto\n\nlemma embedding_inv' [simp]: \"inv embedding (embedding x) = x\"\n  by (metis embedding_inv f_inv_into_f range_eqI)\n  \ntype_synonym 'a val_embedding = \"('a\\<Rightarrow>val)\\<times>nat\"\n\ninstantiation \"nat\" :: prog_type begin\ndefinition \"(embedding'::nat val_embedding) = embedding'_default\"\ninstance proof (intro_classes, goal_cases)\ncase 1\n  let ?e = \"embedding'::nat val_embedding\"\n  from val_powertower_nat obtain f::\"nat\\<Rightarrow>val\" and n where inj: \"inj f\" and range: \"range f \\<subseteq> val_powertower n\" by auto\n  have theses: \"inj (fst ?e) \\<and> range (fst ?e) \\<subseteq> val_powertower (snd ?e)\"\n    unfolding embedding'_nat_def embedding'_default_def \n    apply (rule someI[where P=\"\\<lambda>fn. inj (fst fn) \\<and> range (fst fn) \\<subseteq> val_powertower (snd fn)\" and x=\"(f,n)\"])\n    using inj range by auto\n  thus ?case by simp\ncase 2 show ?case using theses by simp\nqed\nend\n\nlemma prog_type_classI':\n  assumes \"inj (f::'a\\<Rightarrow>'b::prog_type)\"\n  shows \"range (fst (embedding'_default::'a val_embedding)) \\<subseteq> val_powertower (snd (embedding'_default::'a val_embedding))\" and \"inj (fst (embedding'_default::'a val_embedding))\"\nproof -\n(*   obtain n where range: \"range (embedding::'b\\<Rightarrow>val) \\<subseteq> val_powertower n\"\n    using embedding_range by auto *)\n  let ?e = \"(\\<lambda>x. fst embedding' (f x), snd (embedding'::'b val_embedding))\"\n  let ?e' = \"embedding'_default :: 'a val_embedding\"\n  have theses: \"inj (fst ?e) \\<and> range (fst ?e) \\<subseteq> val_powertower (snd ?e)\"\n    using assms[THEN injD] embedding'_range inj_embedding'[THEN injD] unfolding inj_on_def apply auto by blast\n  have \"inj (fst ?e') \\<and> range (fst ?e') \\<subseteq> val_powertower (snd ?e')\"\n    unfolding embedding'_default_def \n    apply (rule someI[where P=\"\\<lambda>f. inj (fst f) \\<and> range (fst f) \\<subseteq> val_powertower (snd f)\"])\n    by (fact theses)\n  then show \"range (fst ?e') \\<subseteq> val_powertower (snd (embedding'_default::'a val_embedding))\" \n       and \"inj (fst (embedding'_default::'a val_embedding))\"\n     by auto\nqed\n\n(* Hack to allow to state lemma prog_type_classI. Is there a cleaner way? *)\nML {*  \n  val consts_to_unconstrain = [@{const_name embedding'}]\n  val consts_orig_constraints = map (Sign.the_const_constraint @{theory}) consts_to_unconstrain\n*}\nsetup {*\n  fold (fn c => fn thy => Sign.add_const_constraint (c,NONE) thy) consts_to_unconstrain\n*}\n\nlemma prog_type_classI:\n  assumes emb: \"(embedding'::'a val_embedding) = embedding'_default\"\n  assumes inj: \"inj (f::'a\\<Rightarrow>'b::prog_type)\"\n  shows \"OFCLASS('a, prog_type_class)\"\napply intro_classes using prog_type_classI'[OF inj] unfolding emb by auto\n\n(* Recover stored type constraints *)\nsetup {*\n  fold2 (fn c => fn T => fn thy => Sign.add_const_constraint (c,SOME (Logic.unvarifyT_global T)) thy)\n      consts_to_unconstrain consts_orig_constraints\n*}\n\ndefinition val_powertower_level :: \"val \\<Rightarrow> nat\" where\n  \"val_powertower_level x = (SOME n. x \\<in> val_powertower n)\"\nlemma val_powertower_level: \"x \\<in> val_powertower (val_powertower_level x)\"\n  unfolding val_powertower_level_def apply (rule someI_ex)\n  using val_powertower_all by auto\n\ndefinition val_set_embedding :: \"nat \\<Rightarrow> val set \\<Rightarrow> val\" where\n  \"val_set_embedding n = (SOME f. inj_on f (Pow (val_powertower n)) \\<and> f ` Pow (val_powertower n) \\<subseteq> val_powertower (Suc n))\"\n(* definition val_set_embedding_level :: \"nat \\<Rightarrow> nat\" where\n  \"val_set_embedding_level n == (SOME m. \\<forall>x. x \\<subseteq> val_powertower n \\<longrightarrow> val_set_embedding x \\<in> val_powertower m)\" *)\n\nlemma val_set_embedding_inj: \"inj_on (val_set_embedding n) (Pow (val_powertower n))\" (is ?thesis1)\n  and val_set_embedding_range: \"x \\<subseteq> val_powertower n \\<Longrightarrow> (val_set_embedding n) x \\<in> val_powertower (Suc n)\" (is \"PROP ?thesis2\")\nproof -\n  obtain f where \"inj_on f (Pow (val_powertower n)) \\<and> f ` Pow (val_powertower n) \\<subseteq> val_powertower (Suc n)\"\n    apply atomize_elim using val_powertower by simp\n  hence \"inj_on f (Pow (val_powertower n)) \\<and> f ` Pow (val_powertower n) \\<subseteq> val_powertower (Suc n)\"\n    by auto\n  hence \"inj_on (val_set_embedding n) (Pow (val_powertower n)) \\<and> (val_set_embedding n) ` Pow (val_powertower n) \\<subseteq> val_powertower (Suc n)\"\n    unfolding val_set_embedding_def by (rule someI[where P=\"\\<lambda>f. inj_on f (Pow (val_powertower n)) \\<and> f ` Pow (val_powertower n) \\<subseteq> val_powertower (Suc n)\"])\n  thus ?thesis1 and \"PROP ?thesis2\" by auto\nqed\n\ninstantiation set :: (prog_type) prog_type begin\ndefinition \"(embedding' :: 'a set val_embedding) = \n  (\\<lambda>M. val_set_embedding (snd (embedding'::'a val_embedding)) (fst (embedding'::'a val_embedding) ` M), \n        Suc (snd (embedding'::'a val_embedding)))\"\ninstance proof\n  let ?ea = \"embedding' :: 'a val_embedding\"\n  let ?e = \"embedding' :: 'a set val_embedding\"\n  show \"range (fst ?e) \\<subseteq> val_powertower (snd ?e)\"\n    unfolding embedding'_set_def apply auto\n    apply (rule val_set_embedding_range[where n=\"snd ?ea\"])\n    using embedding'_range by auto\n  show \"inj (fst ?e)\"\n    unfolding embedding'_set_def  \n    apply simp apply (rule injI)\n    apply (frule val_set_embedding_inj[THEN inj_onD])\n      using embedding'_range image_subsetI apply auto[2]\n    using inj_embedding'[THEN injD] by auto\nqed\nend\n\n(*instantiation set :: (prog_type) prog_type begin\ndefinition \"(embedding :: 'a set \\<Rightarrow> val) = embedding_default\"\ninstance proof\n  obtain n where range: \"range (embedding::'a\\<Rightarrow>val) \\<subseteq> val_powertower n\"\n    using embedding_range by auto\n\n  obtain i2::\"val set\\<Rightarrow>val\" where i2inj: \"inj_on i2 (Pow (val_powertower n))\" \n                                       and i2rng: \"i2 ` Pow(val_powertower n) \\<subseteq> val_powertower (Suc n)\"\n    using val_powertower by blast\n  define i3 where \"i3 \\<equiv> \\<lambda>s::'a set. i2 (embedding ` s)\"\n  have \"inj i3\"\n  proof (rule injI, unfold i3_def)\n    fix x y :: \"'a set\"\n    from inj_embedding have i: \"embedding ` x = embedding ` y \\<Longrightarrow> x = y\"\n      by (metis inj_image_eq_iff)\n    show \"i2 (embedding ` x) = i2 (embedding ` y) \\<Longrightarrow> x = y\"\n      apply (rule i)\n      apply (subst inj_on_eq_iff[symmetric, where f=i2 and A=\"Pow(val_powertower n)\"])\n      using i2inj range by auto\n  qed\n  have i3rng: \"range i3 \\<subseteq> val_powertower (Suc n)\"\n  proof (unfold i3_def, auto)\n    fix s :: \"'a set\"\n    have \"embedding ` s \\<in> Pow (val_powertower n)\" using range by auto\n    hence \"i2 (embedding ` s) \\<in> i2 ` (Pow (val_powertower n))\" by auto\n    with i2rng show \"i2 (embedding ` s) \\<in> val_powertower (Suc n)\" by auto\n  qed\n\n  let ?e = \"embedding::'a set\\<Rightarrow>_\"\n  have ex_emb: \"inj i3 \\<and> (\\<exists>n. range i3 \\<subseteq> val_powertower n)\"\n    using i3rng `inj i3` by auto\n  have \"inj ?e \\<and> (\\<exists>n. range ?e \\<subseteq> val_powertower n)\"\n    unfolding embedding_set_def embedding_default_def \n    apply (rule someI[where P=\"\\<lambda>f. inj f \\<and> (\\<exists>n. range f \\<subseteq> val_powertower n)\"])\n    using ex_emb by simp\n  (* thus \"inj (embedding::'a set \\<Rightarrow> val)\" by simp *)\n  thus \"\\<exists>n. range (embedding::'a set\\<Rightarrow>val) \\<subseteq> val_powertower n\"\n   and \"inj (embedding::'a set\\<Rightarrow>val)\"  by auto\nqed\nend*)\n\ninstantiation bool :: prog_type begin\ndefinition \"(embedding' :: bool val_embedding) = embedding'_default\"\ninstance apply (rule prog_type_classI[OF embedding'_bool_def, of \"\\<lambda>b. if b then 0 else Suc 0\"])\n  apply (rule injI)\n  by (case_tac x, case_tac y, auto)\nend\n\n(* TODO needed? *)\nlemma ordered_cardinals: \"(\\<exists>i::'a\\<Rightarrow>'b. inj i) \\<or> (\\<exists>j::'b\\<Rightarrow>'a. inj j)\"\nproof -\n  have leq: \"ordLeq2 (card_of (Inl ` UNIV :: ('a+'b)set)) (card_of (Inr ` UNIV :: ('a+'b)set)) \\<or>\n        ordLeq2 (card_of (Inr ` UNIV :: ('a+'b)set)) (card_of (Inl ` UNIV :: ('a+'b)set))\"\n        by (rule ordLeq_total, rule card_of_Well_order, rule card_of_Well_order)\n  show ?thesis proof (rule leq[THEN disjE], fold card_of_ordLeq)\n    assume \"\\<exists>f::'a+'b \\<Rightarrow> 'a+'b. inj_on f (range Inl) \\<and> f ` range Inl \\<subseteq> range Inr\"\n    then obtain f::\"'a+'b \\<Rightarrow> 'a+'b\" where finj: \"inj_on f (range Inl)\" and frng: \"f ` range Inl \\<subseteq> range Inr\" by auto\n    define i where \"i == \\<lambda>x. case f (Inl x) of Inr y \\<Rightarrow> y\"\n    have \"inj i\" proof (rule injI, unfold i_def) \n      fix x y assume eq:\"(case f (Inl x) of Inr y \\<Rightarrow> y) = (case f (Inl y) of Inr y \\<Rightarrow> y)\"\n      from frng obtain x' where x': \"f (Inl x) = Inr x'\" by blast\n      from frng obtain y' where y': \"f (Inl y) = Inr y'\" by blast\n      from eq have \"f (Inl x) = f (Inl y)\" unfolding x' y' by simp\n      with finj have \"Inl x = Inl y\" unfolding inj_on_def by simp\n      thus \"x = y\" by auto\n    qed\n    thus ?thesis by auto\n  next\n    assume \"\\<exists>f::'a+'b \\<Rightarrow> 'a+'b. inj_on f (range Inr) \\<and> f ` range Inr \\<subseteq> range Inl\"\n    then obtain f::\"'a+'b \\<Rightarrow> 'a+'b\" where finj: \"inj_on f (range Inr)\" and frng: \"f ` range Inr \\<subseteq> range Inl\" by auto\n    define j where \"j == \\<lambda>x. case f (Inr x) of Inl y \\<Rightarrow> y\"\n    have \"inj j\" proof (rule injI, unfold j_def) \n      fix x y assume eq:\"(case f (Inr x) of Inl y \\<Rightarrow> y) = (case f (Inr y) of Inl y \\<Rightarrow> y)\"\n      from frng obtain x' where x': \"f (Inr x) = Inl x'\" by blast\n      from frng obtain y' where y': \"f (Inr y) = Inl y'\" by blast\n      from eq have \"f (Inr x) = f (Inr y)\" unfolding x' y' by simp\n      with finj have \"Inr x = Inr y\" unfolding inj_on_def by simp\n      thus \"x = y\" by auto\n    qed\n    thus ?thesis by auto\n  qed\nqed\n\nfunction val_embed_up :: \"nat \\<Rightarrow> nat \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"val_embed_up n n x = x\"\n| \"m > n \\<Longrightarrow> val_embed_up n m x = val_set_embedding (m-1) {val_embed_up n (m-1) x}\"\n| \"m < n \\<Longrightarrow> val_embed_up n m x = undefined\"\napply auto apply atomize_elim by auto\ntermination by lexicographic_order\n\n\nlemma range_val_embed_up: \n  \"m\\<ge>n \\<Longrightarrow> x \\<in> val_powertower n \\<Longrightarrow> val_embed_up n m x \\<in> val_powertower m\"\nproof (induction \"m-n\" arbitrary: m)\ncase 0 thus ?case by simp\nnext case (Suc m_n)\n  from Suc have \"m > n\" by auto\n  hence m: \"m = Suc (m - Suc 0)\" by auto\n  show ?case\n    apply (simp add: \\<open>m > n\\<close>)\n    apply (subst m, rule val_set_embedding_range)\n    using Suc by simp\nqed\n\nlemma inj_val_embed_up: \n  \"m\\<ge>n \\<Longrightarrow> val_embed_up n m x = val_embed_up n m y \\<Longrightarrow>\n       x \\<in> val_powertower n \\<Longrightarrow> y \\<in> val_powertower n \\<Longrightarrow> x = y\"\nproof (induction \"m-n\" arbitrary: m)\ncase 0 thus ?case by simp\nnext case (Suc m_n)\n  from Suc have \"m > n\" by auto\n  with Suc.prems have set: \"val_set_embedding (m-1) {val_embed_up n (m-1) x} = val_set_embedding (m-1) {val_embed_up n (m-1) y}\" by auto\n  have \"{val_embed_up n (m-1) x} = {val_embed_up n (m-1) y}\"\n    apply (rule val_set_embedding_inj[THEN inj_onD, of \"m-1\"])\n      using set close\n    using range_val_embed_up Suc.hyps Suc.prems by auto\n  with Suc.hyps(1)[of \"m-1\"] show ?case apply auto\n    by (metis One_nat_def Suc.hyps(2) Suc.prems(3) Suc.prems(4) Suc_diff_Suc \\<open>n < m\\<close> diff_Suc_1 le_add1 less_imp_Suc_add)\nqed\n\ndefinition val_sum_embedding :: \"nat \\<Rightarrow> nat \\<Rightarrow> val+val \\<Rightarrow> val\" where\n  \"val_sum_embedding n m x = (let mn = prod_encode (n,m) in val_set_embedding (Suc mn) (val_set_embedding mn ` \n      (case x of Inl a \\<Rightarrow> {{val_embed_up n mn a}} | Inr b \\<Rightarrow> {{val_embed_up m mn b},{}})))\"\nlemma inj_val_sum_embedding: \"inj_on (val_sum_embedding n m) (val_powertower n <+> val_powertower m)\"\n  and range_val_sum_embedding: \"x \\<in> val_powertower n <+> val_powertower m \n              \\<Longrightarrow> val_sum_embedding n m x \\<in> val_powertower (prod_encode (n,m) + 2)\"\nproof -\n  have range2: \"\\<And>x. x \\<in> val_powertower n <+> val_powertower m \\<Longrightarrow>\n           (case x of Inl a \\<Rightarrow> {{val_embed_up n (prod_encode(n,m)) a}} | Inr b \\<Rightarrow> {{val_embed_up m (prod_encode(n,m)) b}, {}})\n           \\<subseteq> Pow (val_powertower (prod_encode(n,m)))\" \n    apply auto \n     close (rule range_val_embed_up, auto intro: le_prod_encode_1)\n    by (rule range_val_embed_up, auto intro: le_prod_encode_2)\n  have range1: \"\\<And>x. x \\<in> val_powertower n <+> val_powertower m \\<Longrightarrow>\n           val_set_embedding (prod_encode(n,m)) `\n           (case x of Inl a \\<Rightarrow> {{val_embed_up n (prod_encode(n,m)) a}} \n                   | Inr b \\<Rightarrow> {{val_embed_up m (prod_encode(n,m)) b}, {}})\n           \\<in> Pow (val_powertower (Suc (prod_encode(n,m))))\" \n    apply (simp add: image_subset_iff, rule ballI)\n    apply (rule val_set_embedding_range)\n    using range2 by auto\n  have range2: \"(case x of Inl a \\<Rightarrow> {{val_embed_up n (prod_encode(n,m)) a}} \n                         | Inr b \\<Rightarrow> {{val_embed_up m (prod_encode(n,m)) b}, {}})\n                   \\<subseteq> Pow (val_powertower (prod_encode(n,m)))\" \n           if \"x \\<in> val_powertower n <+> val_powertower m\" for x\n    apply (cases x; simp)\n     apply (rule range_val_embed_up) using le_prod_encode_1 that close 2\n    apply (rule range_val_embed_up) using le_prod_encode_2 that by auto\n  have inj1: \"\\<And>xa xb. val_embed_up n (prod_encode(n,m)) xa = val_embed_up n (prod_encode(n,m)) xb \\<Longrightarrow>\n             xa \\<in> val_powertower n \\<Longrightarrow> xb \\<in> val_powertower n \\<Longrightarrow> xa = xb\" using inj_val_embed_up\n    using le_prod_encode_1 by blast\n  have inj2: \"\\<And>ya yb. {{val_embed_up m (prod_encode(n,m)) ya}, {}} = {{val_embed_up m (prod_encode(n,m)) yb}, {}} \\<Longrightarrow>\n             ya \\<in> val_powertower m \\<Longrightarrow> yb \\<in> val_powertower m \\<Longrightarrow> ya = yb\"\n    by (metis doubleton_eq_iff inj_val_embed_up le_prod_encode_2)\n  show \"val_sum_embedding n m x \\<in> val_powertower (prod_encode(n,m) + 2)\"\n          if \"x \\<in> val_powertower n <+> val_powertower m\" \n    unfolding val_sum_embedding_def Let_def apply simp\n    apply (rule val_set_embedding_range)\n    apply (rule image_subset_iff[THEN iffD2, rule_format])\n    apply (rule val_set_embedding_range)\n    apply (cases x, auto)\n     apply (rule range_val_embed_up) using le_prod_encode_1 that close 2\n    apply (rule range_val_embed_up) using le_prod_encode_2 that by auto\n  show \"inj_on (val_sum_embedding n m) (val_powertower n <+> val_powertower m)\"\n    apply (rule inj_onI) unfolding val_sum_embedding_def Let_def\n    apply (subst (asm) val_set_embedding_inj[THEN inj_on_eq_iff])\n      close (rule range1, simp)\n     close (rule range1, simp)\n    apply (subst (asm) val_set_embedding_inj[THEN inj_on_image_eq_iff])\n      close (rule range2, simp)\n     close (rule range2, simp)\n    by (auto intro: inj1 inj2)\nqed\n\ninstantiation sum :: (prog_type,prog_type) prog_type begin\ndefinition \"(embedding' :: ('a+'b) val_embedding) = \n  (\\<lambda>x. val_sum_embedding (snd (embedding'::'a val_embedding)) (snd (embedding'::'b val_embedding))\n    (map_sum (fst embedding') (fst embedding') x), \n  prod_encode (snd (embedding'::'a val_embedding), snd (embedding'::'b val_embedding)) + 2)\"\ninstance proof (intro_classes, goal_cases)\ncase 1\n  show ?case unfolding embedding'_sum_def \n    apply auto apply (rule range_val_sum_embedding[simplified])\n    apply (case_tac xa) using embedding'_range by auto\ncase 2\n  show ?case unfolding embedding'_sum_def\n    apply (rule injI) apply simp \n    apply (drule_tac inj_val_sum_embedding[THEN inj_onD])\n    unfolding map_sum_def\n      close (case_tac x; auto intro!: embedding'_range[unfolded image_subset_iff, rule_format]) \n     close (case_tac y; auto intro!: embedding'_range[unfolded image_subset_iff, rule_format]) \n    apply (case_tac x; case_tac y; simp)\n    using inj_embedding'[THEN injD] by auto\nqed\nend\n\n(*instantiation sum :: (prog_type,prog_type) prog_type begin\ninstance proof (intro_classes, cases \"\\<exists>i::'a\\<Rightarrow>'b. inj i\")\ncase True\n  then obtain i::\"'a\\<Rightarrow>'b\" where \"inj i\" by auto\n  define i2 where \"i2 \\<equiv> \\<lambda>x::'a+'b. case x of Inl a \\<Rightarrow> {{i a}} | Inr b \\<Rightarrow> {{b},{}}\"\n  have \"inj i2\" apply (rule injI) unfolding i2_def \n    apply (case_tac x, case_tac y, auto)\n    apply (metis `inj i` inj_eq)\n    by (case_tac y, auto)\n  hence \"\\<exists>f::'a+'b\\<Rightarrow>'b set set. inj f\"\n    by (rule exI[of _ i2])\n  thus \"\\<exists>t n (i::'a+'b\\<Rightarrow>val). powertower t \\<and> inj i \\<and> range i \\<subseteq> t n\"\n    by (rule prog_type_classI')\nnext \ncase False\n  with ordered_cardinals obtain i::\"'b\\<Rightarrow>'a\" where \"inj i\" by auto\n  define i2 where \"i2 \\<equiv> \\<lambda>x::'a+'b. case x of Inl a \\<Rightarrow> {{a},{}} | Inr b \\<Rightarrow> {{i b}}\"\n  have \"inj i2\" apply (rule injI) unfolding i2_def \n    apply (case_tac x, case_tac y, auto)\n    apply (case_tac y, auto)\n    by (metis `inj i` inj_eq)\n  hence \"\\<exists>f::'a+'b\\<Rightarrow>'a set set. inj f\"\n    by (rule exI[of _ i2])\n  thus \"\\<exists>t n (i::'a+'b\\<Rightarrow>val). powertower t \\<and> inj i \\<and> range i \\<subseteq> t n\"\n    by (rule prog_type_classI')\nqed\nend*)\n\ndefinition val_prod_embedding' :: \"nat \\<Rightarrow> nat \\<Rightarrow> val*val \\<Rightarrow> val\" where\n  \"val_prod_embedding' n m x = val_set_embedding (prod_encode(n,m) + 2) (val_sum_embedding n m ` {Inl (fst x), Inr (snd x)})\"\nlemma inj_val_prod_embedding': \"inj_on (val_prod_embedding' n m) (val_powertower n \\<times> val_powertower m)\" (is ?inj)\n  and range_val_prod_embedding': \"x \\<in> val_powertower n \\<times> val_powertower m \\<Longrightarrow> val_prod_embedding' n m x \\<in> val_powertower (prod_encode(n,m) + 3)\" (is \"?assm \\<Longrightarrow> ?range\")\nproof -\n  have range1: \"val_sum_embedding n m ` {Inl (fst x), Inr (snd x)} \\<in> Pow (val_powertower (prod_encode (n, m) + 2))\" \n               if \"x \\<in> val_powertower n \\<times> val_powertower m\" for x\n    apply auto\n     apply (rule range_val_sum_embedding[simplified])\n     using that close\n    apply (rule range_val_sum_embedding[simplified])\n    using that by auto\n  have inj1: \"inj_on (val_sum_embedding n m) ({Inl (fst x), Inr (snd x)} \\<union> {Inl (fst y), Inr (snd y)})\" \n             if \"x \\<in> val_powertower n \\<times> val_powertower m\" and \"y \\<in> val_powertower n \\<times> val_powertower m\" for x y\n    apply (rule inj_onI)\n    apply (drule inj_val_sum_embedding[THEN inj_onD])\n    using that by auto\n  show ?inj\n    apply (rule inj_onI)\n    unfolding val_prod_embedding'_def\n    apply (drule val_set_embedding_inj[THEN inj_onD])\n      using range1 close 2\n    apply (subst (asm) inj_on_Un_image_eq_iff[where f=\"val_sum_embedding n m\"])\n     using inj1 close\n    by force\n  assume ?assm\n  show ?range\n    unfolding val_prod_embedding'_def\n    apply (rewrite at \"_ + 3\" to \"Suc (_ + 2)\" eq_reflection) close\n    apply (rule val_set_embedding_range)\n    using range1[OF `?assm`] by auto\nqed\n\ndefinition val_prod_embedding :: \"val\\<times>val \\<Rightarrow> val\" where\n  \"val_prod_embedding xy = val_prod_embedding' (val_powertower_level (fst xy)) (val_powertower_level (snd xy)) xy\"\n(* Could be made injective on all val\\<times>val, by fixing a monotone nat\\<Rightarrow>nat\\<Rightarrow>nat: prod_encode *)\nlemma inj_val_prod_embedding: \"inj val_prod_embedding\"\nproof (rule injI)\n  fix x y :: \"val\\<times>val\"\n  assume emb_eq: \"val_prod_embedding x = val_prod_embedding y\"\n\n  obtain x1 x2 where x: \"x=(x1,x2)\" by (atomize_elim, auto)\n  define n1 n2 \n    where \"n1 == val_powertower_level x1\"\n      and \"n2 == val_powertower_level x2\"\n  have \"x1 \\<in> val_powertower n1\"  \n   and \"x2 \\<in> val_powertower n2\" unfolding n1_def n2_def by (simp_all add: val_powertower_level) \n  hence x_tower: \"x \\<in> val_powertower n1 \\<times> val_powertower n2\" unfolding x by auto\n  hence emb_x: \"val_prod_embedding' n1 n2 x \\<in> val_powertower (prod_encode(n1,n2) + 3)\"\n    by (rule range_val_prod_embedding')\n\n  obtain y1 y2 where y: \"y=(y1,y2)\" by (atomize_elim, auto)\n  define m1 m2\n    where \"m1 == val_powertower_level y1\"\n      and \"m2 == val_powertower_level y2\"\n  have \"y1 \\<in> val_powertower m1\"  \n   and \"y2 \\<in> val_powertower m2\" unfolding m1_def m2_def by (simp_all add: val_powertower_level) \n  hence y_tower: \"y \\<in> val_powertower m1 \\<times> val_powertower m2\" unfolding y by auto\n  hence emb_y: \"val_prod_embedding' m1 m2 y \\<in> val_powertower (prod_encode(m1,m2) + 3)\"\n    by (rule range_val_prod_embedding')\n\n  have emb_eq': \"val_prod_embedding' n1 n2 x = val_prod_embedding' m1 m2 y\"\n    using emb_eq unfolding val_prod_embedding_def x y n1_def n2_def m1_def m2_def\n    by simp\n\n  from emb_x emb_y have \"prod_encode(n1,n2) + 3 = prod_encode(m1,m2) + 3\"\n    unfolding emb_eq' by (rule val_powertower_disjoint)\n  hence eq1: \"n1 = m1\" and eq2: \"n2 = m2\"\n    by (simp_all add: prod_encode_eq) \n\n  show \"x=y\"\n    apply (rule inj_val_prod_embedding'[THEN inj_onD])\n    using emb_eq' eq1 eq2 x_tower y_tower by auto\nqed\n\nlemma range_val_prod_embedding: \n  assumes \"x \\<in> val_powertower n \\<times> val_powertower m\"\n  shows \"val_prod_embedding x \\<in> val_powertower (prod_encode(n,m) + 3)\"\nproof -\n  obtain x1 x2 where x: \"x=(x1,x2)\" by (atomize_elim,auto)\n  have n: \"n = val_powertower_level x1\"\n    using assms unfolding x\n    using val_powertower_disjoint val_powertower_level by auto\n  have m: \"m = val_powertower_level x2\"\n    using assms unfolding x\n    using val_powertower_disjoint val_powertower_level by auto\n  show ?thesis\n    unfolding val_prod_embedding_def \n    using range_val_prod_embedding'[OF assms] \n    unfolding x n m by simp\nqed\n\ninstantiation prod :: (prog_type,prog_type) prog_type begin\ndefinition \"(embedding' :: ('a\\<times>'b) val_embedding) = \n  (\\<lambda>x. val_prod_embedding (map_prod (fst embedding') (fst embedding') x), \n  prod_encode (snd (embedding'::'a val_embedding), snd (embedding'::'b val_embedding)) + 3)\"\ninstance proof\n  let ?e = \"embedding'::('a\\<times>'b)val_embedding\"\n  show \"range (fst ?e) \\<subseteq> val_powertower (snd ?e)\"\n    apply auto unfolding embedding'_prod_def apply simp\n    apply (rule range_val_prod_embedding) apply auto\n    using embedding'_range by auto\n  show \"inj (fst ?e)\"\n    apply (rule injI)\n    unfolding embedding'_prod_def apply simp\n    apply (frule inj_val_prod_embedding[THEN injD])\n    by (auto simp: inj_embedding' inj_eq)\nqed\nend\n\n(* instance apply (rule prog_type_classI)\n  apply (rule exI[where x=\"\\<lambda>(x::'a,y::'b). {Inl x,Inr y}\"])\n  apply (rule injI)\n  by (case_tac x, case_tac y, auto)\nend *)\n\n\n\ninstantiation \"fun\" :: (prog_type,prog_type)prog_type begin\ndefinition \"(embedding' :: ('a\\<Rightarrow>'b) val_embedding) = embedding'_default\"\ninstance apply (rule prog_type_classI[OF embedding'_fun_def, of \"\\<lambda>f. {(x,f x)| x. True}\"])\n  by (rule injI, auto)\nend\n\ninstantiation list :: (prog_type) prog_type begin\ndefinition \"(embedding' :: 'a list val_embedding) = embedding'_default\"\ninstance apply (rule prog_type_classI[OF embedding'_list_def, of \"\\<lambda>l. (length l, nth l)\"])\n  by (rule injI, metis nth_equalityI old.prod.inject)\nend\n\nlocal_setup {* \n  Local_Theory.define ((@{binding embedding'_UNCONSTRAINED},NoSyn),((@{binding embedding'_UNCONSTRAINED_def},[]),\n      Const(@{const_name embedding'},@{typ \"'a val_embedding\"}))) #> snd\n*}\n\nlemma OFCLASS_prog_type_typedef[unfolded embedding'_UNCONSTRAINED_def]:\n  fixes Rep::\"'a\\<Rightarrow>'b::prog_type\"\n  assumes emb: \"(embedding'_UNCONSTRAINED :: 'a val_embedding) \\<equiv> (fst embedding' o Rep, snd (embedding'::'b val_embedding))\"\n  assumes inj: \"\\<And>x y. (Rep x = Rep y) = (x = y)\" \n  shows \"OFCLASS('a,prog_type_class)\"\nproof (intro_classes, fold embedding'_UNCONSTRAINED_def)\n  let ?e = \"embedding'_UNCONSTRAINED :: 'a val_embedding\"\n  show \"range (fst ?e) \\<subseteq> val_powertower (snd ?e)\"\n    unfolding emb apply simp using embedding'_range by auto\n  have \"inj Rep\" apply (rule injI) using inj by simp\n  show \"inj (fst ?e)\"\n    unfolding emb using inj inj_embedding' `inj Rep` by (auto intro: inj_comp)\nqed\n\n\n(*instantiation int::prog_type begin\ninstance by (fact OFCLASS_prog_type_typedef[OF Rep_int_inject]) end *)\n\n(*\ninstantiation rat::prog_type begin\ninstance by (fact OFCLASS_prog_type_typedef[OF Rep_rat_inject]) end\n  \ninstantiation real::prog_type begin\ninstance by (fact OFCLASS_prog_type_typedef[OF Rep_real_inject]) end\n*)\n\nsubsection {* Automatically instantiate new types (defined via typedef) *}\n\nML {*\nfun instantiate_prog_type tycon thy =\nlet val arity = Sign.arity_number thy tycon\n    val sorts = replicate arity @{sort \"prog_type\"}\n    val vs = Name.invent_names Name.context \"'a\" sorts\n    val tycon_info = \n      case Typedef.get_info_global thy tycon of\n        [info] => info\n      | [] => error (tycon^\" not defined by typedef\")\n      | _ => error (\"Typedef.get_info_global thy \\\"\"^tycon^\"\\\" returns several items\")\n    val Rep_inject = #Rep_inject (snd tycon_info)\n    val rep_type = #rep_type (fst tycon_info)\n    val abs_type = #abs_type (fst tycon_info)\n    val Rep = Const(#Rep_name (fst tycon_info), abs_type --> rep_type)\n    (* val inst_type = Type(tycon,map TFree vs) *)\n    val OFCLASS_prog_type_typedef = @{thm OFCLASS_prog_type_typedef} (* Global_Theory.get_thm thy \"Universe.OFCLASS_prog_type_typedef\" *)\n    val lthy = Class.instantiation ([tycon],vs,@{sort \"prog_type\"}) thy\n\n    val bind = Binding.suffix_name (\"_\"^(List.last (Long_Name.explode tycon))) @{binding embedding'}\n    val rhs = @{termx \"(fst embedding' \\<circ> (?Rep::?'abs_type::prog_type\\<Rightarrow>?'rep_type::prog_type), snd (embedding'::?'rep_type val_embedding))\"}\n    val ((_,(_,emb_thm)),lthy) = Local_Theory.define ((bind,NoSyn), ((Thm.def_binding bind,[]), rhs)) lthy\n    val emb_thm_global = Proof_Context.export lthy (lthy |> Proof_Context.theory_of |> Proof_Context.init_global) [emb_thm] |> hd\n\n    val OFCLASS_thm = OFCLASS_prog_type_typedef OF [emb_thm_global,Rep_inject]\n    val thy = Class.prove_instantiation_exit (fn _ => resolve0_tac [OFCLASS_thm] 1) lthy\nin\nthy\nend;\n\nfun try_instantiate_prog_type tycon thy =\n  instantiate_prog_type tycon thy\n  handle ERROR _ => (tracing (\"Did not instantiate \"^tycon^\" :: prog_type\"); thy)\n       | THM _ => (tracing (\"Did not instantiate \"^tycon^\" :: prog_type\"); thy);\n*}\n\n(* typedef 'a bla = \"UNIV::'a set\" by auto\n(* TODO remove *)\nsetup {* instantiate_prog_type @{type_name \"bla\"} *}\n *)\n\nsetup {* Typedef.interpretation (Local_Theory.background_theory o try_instantiate_prog_type) *}\n\nsubsection {* Instantiation for types not handled by automated mechanism *}\n\n(*instantiation option :: (prog_type)prog_type begin\ninstance apply (rule prog_type_classI, rule exI[where x=\"\\<lambda>x. case x of Some x \\<Rightarrow> Inl x | None \\<Rightarrow> Inr ()\"])\nproof (rule injI) (* Sledgehammer proof *)\n  fix x :: \"'a option\" and y :: \"'a option\"\n  assume a1: \"(case x of None \\<Rightarrow> Inr () | Some f \\<Rightarrow> Inl f) = (case y of None \\<Rightarrow> Inr () | Some f \\<Rightarrow> Inl f)\"\n  then obtain esk3\\<^sub>1 :: \"'a option \\<Rightarrow> 'a\" where \"y = x \\<or> None = x \\<or> y = None\" by (metis option.case(2) option.exhaust sum.sel(1))\n  thus \"x = y\" using a1 by (metis (no_types) Inr_not_Inl option.case_eq_if)\nqed\nend*)\n\n(*instantiation distr::(prog_type)prog_type begin\ninstance by (fact OFCLASS_prog_type_typedef[OF Rep_distr_inject]) end*)\n\n(*instantiation nibble::prog_type begin\ninstance by (fact OFCLASS_prog_type_typedef[OF Rep_nibble_inject]) end*)\n\n(*instantiation char :: prog_type begin\ninstance apply (rule prog_type_classI, rule exI[where x=Rep_char])\n  by (metis Rep_char_inverse injI)\nend*)\n\nend\n", "meta": {"author": "dominique-unruh", "repo": "IsaCrypt", "sha": "1abc2041871af7b758adcc914b83f0d9135ec129", "save_path": "github-repos/isabelle/dominique-unruh-IsaCrypt", "path": "github-repos/isabelle/dominique-unruh-IsaCrypt/IsaCrypt-1abc2041871af7b758adcc914b83f0d9135ec129/Universe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.340874177113215}}
{"text": "theory Safety_Certification\n  imports\n    Simulation_Graphs_Certification2\n    Certification.Unreachability_Common\n    \"~/Code/Explorer/Guess_Explore\"\nbegin\n\nlocale Unreachability_Invariant_paired_pre_defs =\n  fixes E :: \"'l \\<times> 's \\<Rightarrow> 'l \\<times> 's \\<Rightarrow> bool\" and P :: \"'l \\<times> 's \\<Rightarrow> bool\"\n    and less_eq :: \"'s \\<Rightarrow> 's set \\<Rightarrow> bool\" (infix \"\\<preceq>\" 50)\nbegin\n\nsublocale Unreachability_Invariant_pre_defs where\n  less_eq = \"\\<lambda>(l, s) S. (\\<forall>(l', s') \\<in> S. l' = l) \\<and> s \\<preceq> R_of S\" .\n\nend\n\n\\<comment> \\<open>Contains all auxiliary assumptions that will not be checked computationally.\\<close>\nlocale Unreachability_Invariant_paired_pre =\n  Unreachability_Invariant_paired_pre_defs +\n  \\<^cancel>\\<open>assumes mono: \"a \\<preceq> B \\<Longrightarrow> E a a' \\<Longrightarrow> P a \\<Longrightarrow> (\\<forall>b \\<in> B. P b)\n    \\<Longrightarrow> \\<exists>B'. (\\<forall>b' \\<in> B'. \\<exists>b \\<in> B. E b b') \\<and> a' \\<preceq> B'\"\\<close>\n  assumes mono:\n    \"s \\<preceq> S \\<Longrightarrow> E (l, s) (l', t) \\<Longrightarrow> P (l, s) \\<Longrightarrow> \\<forall>s \\<in> S. P (l, s)\n    \\<Longrightarrow> \\<exists> T. t \\<preceq> T \\<and> (\\<forall>t' \\<in> T. \\<exists>s' \\<in> S. E (l, s') (l', t'))\"\n  \\<^cancel>\\<open>assumes P_invariant: \"P a \\<Longrightarrow> E a a' \\<Longrightarrow> P b\"\\<close>\n  assumes P_invariant: \"P (l, s) \\<Longrightarrow> E (l, s) (l', s') \\<Longrightarrow> P (l', s')\"\n  assumes subsumes_Subsumed: \"a \\<preceq> A \\<Longrightarrow> \\<forall>s \\<in> A. \\<exists>T' \\<subseteq> A'. s \\<preceq> T' \\<Longrightarrow> a \\<preceq> A'\"\nbegin\n\nsublocale Unreachability_Invariant where\n  less_eq = \"\\<lambda>(l, s) S. (\\<forall>(l', s') \\<in> S. l' = l) \\<and> s \\<preceq> R_of S\"\n  apply standard\n  oops\n\nend\n\ndefinition project (infix \"\\<restriction>\" 55) where\n  \"project S l = {s | s. (l, s) \\<in> S}\"\n\nlocale Reachability_Impl_base =\n  Certification_Impl_base where E = E +\n  Unreachability_Invariant_paired_pre_defs where E = E\n  for E :: \"'l \\<times> 's \\<Rightarrow> _\" +\n  fixes P' and F\n  assumes P'_P: \"\\<And> l s. P' (l, s) \\<Longrightarrow> P (l, s)\"\n  assumes F_mono:\n    \"\\<And>a A. P a \\<Longrightarrow> F a \\<Longrightarrow> (\\<lambda>(l, s) S. s \\<preceq> S \\<restriction> l) a A\n    \\<Longrightarrow> (\\<forall> a \\<in> A. P a) \\<Longrightarrow> (\\<exists> a \\<in> A. F a)\"\n\nlocale Reachability_Impl_pre =\n  Reachability_Impl_base where E = E +\n  Unreachability_Invariant_paired_pre where E = E +\n  Paired_Graph_Set where E = E for E :: \"'l \\<times> 's \\<Rightarrow> _\"\nbegin\n\n\\<comment> \\<open>Note that these instantiations can be restricted more,\n  e.g.\\ to allow subsumption checking with certificates.\\<close>\nsublocale Certification_Impl\n  where R = \"\\<lambda>l s xs. s \\<preceq> xs\"\n    and R_impl = \"\\<lambda>l s xs. RETURN (s \\<preceq> xs)\"\n  by standard rule\n\nend\n\nlocale Reachability_Impl_pre_start =\n  Reachability_Impl_pre where E = E for E :: \"'l \\<times> 's \\<Rightarrow> _\" +\n  fixes l\\<^sub>0 :: 'l and s\\<^sub>0 :: 's\nbegin\n\nsublocale Certification_Impl_Start\n  where R = \"\\<lambda>l s xs. s \\<preceq> xs\"\n    and R_impl = \"\\<lambda>l s xs. RETURN (s \\<preceq> xs)\"\n  ..\n\nend\n\nlocale Reachability_Impl_correct =\n  Reachability_Impl_pre_start where E = E +\n  Unreachability_Invariant_paired_pre where E = E for E :: \"'l \\<times> 's \\<Rightarrow> _\"\nbegin\n\ndefinition I where\n  \"I \\<equiv> \\<lambda>(l, s). l \\<in> L \\<and> s \\<in> M l\"\n\ndefinition less_eq' where\n  \"less_eq' \\<equiv> \\<lambda>(l, s) S. s \\<preceq> S \\<restriction> l\"\n\nlemma less_eq'_pair [simp]:\n  \"less_eq' (l, s) S \\<longleftrightarrow> s \\<preceq> S \\<restriction> l\"\n  unfolding less_eq'_def project_def from_R_def by auto\n\nlemma project_from_R [simp]:\n  \"from_R l S \\<restriction> l = S\"\n  unfolding project_def from_R_def by simp\n\nlemma subsumes_Subsumed_lifted:\n  assumes \"s \\<preceq> R_of A\" \"A \\<sqsubseteq> A'\" shows \"s \\<preceq> R_of A'\"\n  using assms unfolding Subsumed_def\n  by (elim subsumes_Subsumed) (fastforce simp: R_of_def subset_image_iff dest: bspec)\n\nlemma mem_project_iff:\n  \"s \\<in> A \\<restriction> l \\<longleftrightarrow> (l, s) \\<in> A\"\n  unfolding project_def by auto\n\nlemma project_subsI:\n  \"A \\<restriction> l \\<subseteq> B \\<restriction> l\" if \"A \\<subseteq> B\"\n  using that unfolding project_def by auto\n\n\\<comment> \\<open>Note that the second occurrence of \\<^term>\\<open>less_eq'\\<close> can be restricted\n  to only use certain subsumptions (e.g.\\ from certificates).\\<close>\nlemma Unreachability_Invariant_pairedI[rule_format]:\n  \"check_all_spec \\<longrightarrow> Unreachability_Invariant E P less_eq' I less_eq'\"\n  unfolding check_all_spec_def check_all_pre_spec_def check_invariant_spec_def\nproof safe\n  assume invariant:\n    \"\\<forall>l\\<in>L. \\<forall>s\\<in>M l. \\<forall>l' s'. (l, s) \\<rightarrow> (l', s') \\<longrightarrow> l' \\<in> L \\<and> s' \\<preceq> M l'\" and\n    wf: \"\\<forall>l\\<in>L. \\<forall>s\\<in>M l. P' (l, s)\" and\n    \\<comment> \\<open>Unused:\\<close>\n    \"l\\<^sub>0 \\<in> L\"\n    \"s\\<^sub>0 \\<preceq> M l\\<^sub>0\"\n    \"P' (l\\<^sub>0, s\\<^sub>0)\"\n  show \"Unreachability_Invariant E P less_eq' I less_eq'\"\n  proof standard\n    fix a :: \"'l \\<times> 's\" and B :: \"('l \\<times> 's) set\" and a' :: \"'l \\<times> 's\"\n    assume prems:\n      \"less_eq' a B\"\n      \"a \\<rightarrow> a'\"\n      \"P a\"\n      \"\\<forall>b\\<in>B. P b\"\n    obtain l s l' s' where [simp]: \"a = (l, s)\" \"a' = (l', s')\"\n      by (cases a; cases a')\n    have \"\\<forall>s\\<in>B \\<restriction> l. P (l, s)\" for l\n      using prems(4) unfolding project_def by auto\n    with prems(1-3) obtain T where \"s' \\<preceq> T\" \"\\<forall>t'\\<in>T. \\<exists>s'\\<in>B \\<restriction> l. (l, s') \\<rightarrow> (l', t')\"\n      by atomize_elim (rule mono, auto)\n    then show \"\\<exists>B'. (\\<forall>b'\\<in>B'. \\<exists>b\\<in>B. b \\<rightarrow> b') \\<and> less_eq' a' B'\"\n      by (inst_existentials \"from_R l' T\") (auto simp: from_R_def project_def)\n  next\n    fix s :: \"'l \\<times> 's\" and t :: \"'l \\<times> 's\"\n    assume prems: \"I s\" \"s \\<rightarrow> t\"\n    obtain l' s' where \"t = (l', s')\"\n      by (cases t)\n    with prems invariant show \"\\<exists>T. Ball T I \\<and> less_eq' t T\"\n      by (inst_existentials \"from_R l' (M l')\"; clarsimp) (auto simp: from_R_def I_def)\n  next\n    fix s :: \"'l \\<times> 's\" and T :: \"('l \\<times> 's) set\"\n    assume \"less_eq' s T\"\n    then show \"less_eq' s T\" .\n  next\n    fix s :: \"'l \\<times> 's\"\n    assume \"I s\"\n    with wf show \"P s\"\n      by (metis (no_types, lifting) I_def P'_P case_prodE)\n  next\n    fix a :: \"'l \\<times> 's\" and a' :: \"'l \\<times> 's\"\n    assume  \"P a\" and \"a \\<rightarrow> a'\"\n    then show \"P a'\"\n      by - (cases a; cases a'; simp only:; rule P_invariant)\n  next\n    fix a :: \"'l \\<times> 's\" and A :: \"('l \\<times> 's) set\" and A' :: \"('l \\<times> 's) set\"\n    assume prems:\n      \"less_eq' a A\"\n      \"Unreachability_Invariant_pre_defs.Subsumed less_eq' A A'\"\n    obtain l s where [simp]: \"a = (l, s)\"\n      by (cases a)\n    have \"\\<exists>T'\\<subseteq>A' \\<restriction> l. s \\<preceq> T'\" if \"s \\<in> A \\<restriction> l\" for s\n    proof -\n      from that prems (2) obtain T' where\n        \"(l, s) \\<in> A\" \"T' \\<subseteq> A'\" \"s \\<preceq> T' \\<restriction> l\"\n        unfolding Unreachability_Invariant_pre_defs.Subsumed_def by (auto simp: mem_project_iff)\n      then show ?thesis\n        by (auto dest: project_subsI)\n    qed\n    with prems(1) show \"less_eq' a A'\"\n      by (auto elim: subsumes_Subsumed)\n  qed\nqed\n\nlemma check_all_correct':\n  \"check_all \\<le> SPEC (\\<lambda>r. r \\<longrightarrow> Unreachability_Invariant E P less_eq' I less_eq')\"\n  by (refine_vcg Unreachability_Invariant_pairedI check_all_correct) fast\n\nlemma in_from_R_conv:\n  \"(l, s) \\<in> from_R l' S \\<longleftrightarrow> l = l' \\<and> s \\<in> S\"\n  unfolding from_R_def by auto\n\nlemma F_mono':\n  \"P (l, s) \\<Longrightarrow> F (l, s) \\<Longrightarrow> s \\<preceq> B \\<restriction> l \\<Longrightarrow> \\<forall>x \\<in> B. P x \\<Longrightarrow> \\<exists>b \\<in> B. F b\"\n  by (drule F_mono[rotated, where A = \"B\"]) (auto simp: mem_project_iff)\n\nlemma certify_unreachableI:\n  \"check_all_spec \\<and> check_final_spec \\<longrightarrow> (\\<nexists>s'. E\\<^sup>*\\<^sup>* (l\\<^sub>0, s\\<^sub>0) s' \\<and> F s')\"\n  by (rule impI Unreachability_Invariant.final_unreachable[where S\\<^sub>0 = \"from_R l\\<^sub>0 (M l\\<^sub>0)\"]\n        Unreachability_Invariant_pairedI)+\n     (auto intro: F_mono P'_P\n       simp: check_final_spec_def check_all_spec_def check_all_pre_spec_def\n        Unreachability_Invariant_defs.Inv_def I_def in_from_R_conv)\n\nlemma certify_unreachable_correct':\n  \"certify_unreachable \\<le> SPEC (\\<lambda>r. r \\<longrightarrow> (\\<nexists>s'. E\\<^sup>*\\<^sup>* (l\\<^sub>0, s\\<^sub>0) s' \\<and> F s'))\"\n  by (refine_vcg certify_unreachableI[rule_format] certify_unreachable_correct; fast)\n\nend\n\nlocale Reachability_Impl =\n  Certification_Impl_imp where M = M and K = K and A = A +\n  Reachability_Impl_correct where M = \"\\<lambda>x. case M x of None \\<Rightarrow> {} | Some S \\<Rightarrow> S\"\n    for M :: \"'k \\<Rightarrow> 'a set option\"\n    and K :: \"'k \\<Rightarrow> 'ki :: {hashable,heap} \\<Rightarrow> assn\"\n    and A :: \"'a \\<Rightarrow> 'ai :: heap \\<Rightarrow> assn\" +\n  \\<comment> \\<open>Again, as explained above, this can be replaced with a more specific subsumption.\\<close>\n  fixes Lei\n  assumes Lei[sepref_fr_rules]:\n    \"(uncurry Lei,uncurry (RETURN oo PR_CONST less_eq)) \\<in> A\\<^sup>k *\\<^sub>a (lso_assn A)\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n\nend", "meta": {"author": "wimmers", "repo": "munta-games", "sha": "12da82b74f595c33278aeac82b58cbfbfd2fd6a3", "save_path": "github-repos/isabelle/wimmers-munta-games", "path": "github-repos/isabelle/wimmers-munta-games/munta-games-12da82b74f595c33278aeac82b58cbfbfd2fd6a3/Safety_Certification.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.34087417711321494}}
{"text": "theory Next_Key\n  imports Heap_Hash_Map\nbegin\n\nsection \\<open>A next-key operation for hashmaps\\<close>\n\nsubsection \\<open>Definition and key properties\\<close>\n\ndefinition\n  \"hm_it_next_key ht = do {\n    n\\<leftarrow>Array.len (the_array ht);\n    if n = 0 then raise (STR ''Map is empty!'')\n    else do {\n      i\\<leftarrow>hm_it_adjust (n - 1) ht;\n      l\\<leftarrow>Array.nth (the_array ht) i;\n      case l of\n        [] \\<Rightarrow> raise (STR ''Map is empty!'')\n      | (x # _) \\<Rightarrow> return (fst x)\n    }\n  }\n\"\n\nlemma hm_it_next_key_rule:\n  \"<is_hashmap m ht> hm_it_next_key ht <\\<lambda>r. is_hashmap m ht * \\<up> (r \\<in> dom m)>\"\n  if \"m \\<noteq> Map.empty\"\n  using that\n  unfolding hm_it_next_key_def\n  unfolding is_hashmap_def unfolding is_hashmap'_def\n  apply (sep_auto intro: hm_it_adjust_rule)\n  subgoal\n    using le_imp_less_Suc by fastforce\n  subgoal premises prems for l xs i xs'\n  proof -\n    from prems have \"l ! i \\<noteq> []\"\n      by (auto simp: concat_take_Suc_empty)\n    with prems(1-6) show ?thesis\n      apply (cases xs')\n       apply sep_auto\n      apply sep_auto\n      subgoal for a b list aa ba\n        apply (rule weak_map_of_SomeI[of _ b])\n        apply clarsimp\n        apply (rule bexI[of _ \"l ! i\"])\n        subgoal\n          by (metis list.set_intros(1))\n        subgoal\n          by (cases \"length l\"; fastforce simp: take_Suc_conv_app_nth)\n        done\n      done\n  qed\n  done\n\n\ndefinition\n  \"next_key m = do {\n    ASSERT (m \\<noteq> Map.empty);\n    k \\<leftarrow> SPEC (\\<lambda> k. k \\<in> dom m);\n    RETURN k\n  }\n  \"\n\nlemma hm_it_next_key_next_key_aux:\n  assumes \"is_pure K\" \"nofail (next_key m)\"\n  shows\n    \"<hm.assn K V m mi>\n      hm_it_next_key mi\n    <\\<lambda>r. \\<exists>\\<^sub>Axa. hm.assn K V m mi * K xa r * true * \\<up> (RETURN xa \\<le> next_key m)>\"\n  using \\<open>nofail _\\<close> unfolding next_key_def\n  apply (simp add: pw_bind_nofail pw_ASSERT(1))\n  unfolding hm.assn_def hr_comp_def\n  apply sep_auto\n  subgoal for m'\n    apply (rule cons_post_rule)\n     apply (rule hm_it_next_key_rule)\n     defer\n     apply (sep_auto eintros del: exI)\n    subgoal premises prems for x v'\n    proof -\n      from prems obtain k v where \"m k = Some v\" \"(x, k) \\<in> the_pure K\" \"(v', v) \\<in> the_pure V\"\n        apply atomize_elim\n        by (meson map_rel_obtain2)\n      with prems \\<open>is_pure K\\<close> show ?thesis\n        apply -\n        apply (rule exI[where x = k], rule exI[where x = m'])\n        apply sep_auto\n        apply (rule entailsI)\n        apply sep_auto\n        by (metis mod_pure_star_dist mod_star_trueI pure_def pure_the_pure)\n    qed\n    by force\n  done\n\nlemma hm_it_next_key_next_key:\n  assumes \"CONSTRAINT is_pure K\"\n  shows \"(hm_it_next_key, next_key) \\<in> (hm.assn K V)\\<^sup>k \\<rightarrow>\\<^sub>a K\"\n  using assms by sepref_to_hoare (sep_auto intro!: hm_it_next_key_next_key_aux)\n\nlemma hm_it_next_key_next_key':\n  \"(hm_it_next_key, next_key) \\<in> (hm.hms_assn V)\\<^sup>k \\<rightarrow>\\<^sub>a id_assn\"\n  unfolding hm.hms_assn_def\n  apply sepref_to_hoare\n  apply sep_auto\n  unfolding next_key_def\n  apply (simp add: refine_pw_simps)\n  subgoal for m m' mi\n    apply (rule cons_rule[where\n          P' = \"is_hashmap mi m' * map_assn V m mi * \\<up>(mi \\<noteq> Map.empty)\"\n          and Q = \"\\<lambda> x. is_hashmap mi m' * \\<up> (x \\<in> dom mi) * map_assn V m mi\"]\n        )\n      apply (sep_auto; unfold map_assn_def; auto; fail)+\n    by (rule norm_pre_pure_rule1, rule frame_rule[OF hm_it_next_key_rule[of mi m']]) sep_auto\n  done\n\nlemma no_fail_next_key_iff:\n  \"nofail (next_key m) \\<longleftrightarrow> m \\<noteq> Map.empty\"\n  unfolding next_key_def by auto\n\ncontext\n  fixes mi m K\n  assumes map_rel: \"(mi, m) \\<in> \\<langle>K, Id\\<rangle>map_rel\"\nbegin\n\nprivate lemma k_aux:\n  assumes \"k \\<in> dom mi\" \"(mi, m) \\<in> \\<langle>K, Id\\<rangle>map_rel\"\n  shows \"\\<exists> k'. (k, k') \\<in> K\"\n  using assms unfolding map_rel_def by auto\n\nprivate lemma k_aux2:\n  assumes \"k \\<in> dom mi\" \"(k, k') \\<in> K\"\n  shows \"k' \\<in> dom m\"\n  using assms map_rel unfolding map_rel_def by (cases \"m k'\") (auto dest: fun_relD)\n\nprivate lemma map_empty_iff: \"mi \\<noteq> Map.empty \\<longleftrightarrow> m \\<noteq> Map.empty\"\n  using map_rel by auto\n\nprivate lemma aux:\n  assumes \"RETURN k \\<le> next_key mi\"\n  shows \"RETURN (SOME k'. (k, k') \\<in> K) \\<le> next_key m\"\n  using map_rel assms\n  unfolding next_key_def\n  apply (cases \"m \\<noteq> Map.empty\")\n   apply (clarsimp simp: map_empty_iff)\n  apply (frule (1) k_aux[OF domI])\n  apply (drule someI_ex)\n  apply (auto dest: k_aux2[OF domI])\n  done\n\nprivate lemma aux1:\n  assumes \"RETURN k \\<le> next_key mi\" \"nofail (next_key m)\"\n  shows \"(k, SOME k'. (k, k') \\<in> K) \\<in> K\"\n  using map_rel assms\n  unfolding next_key_def\n  apply (cases \"m \\<noteq> Map.empty\")\n   apply (auto simp: map_empty_iff)\n  apply (drule (1) k_aux[OF domI], erule someI_ex)\n  done\n\nlemmas hm_it_next_key_next_key''_aux = aux aux1\n\nend (* Anonymous context *)\n\nlemma hm_it_next_key_next_key'':\n  assumes \"is_pure K\"\n  shows \"(hm_it_next_key, next_key) \\<in> (hm.hms_assn' K V)\\<^sup>k \\<rightarrow>\\<^sub>a K\"\n  unfolding hm.hms_assn'_def\n  apply sepref_to_hoare\n  unfolding hr_comp_def\n  apply sep_auto\n  subgoal for m m' mi\n    using hm_it_next_key_next_key'[to_hnr, unfolded hn_refine_def, of mi V m']\n    apply (sep_auto simp: hn_ctxt_def)\n    subgoal\n      unfolding no_fail_next_key_iff by auto\n    apply (erule cons_post_rule)\n    using \\<open>is_pure K\\<close>\n    apply sep_auto\n     apply (erule (1) hm_it_next_key_next_key''_aux)\n    apply (subst pure_the_pure[symmetric, of K], assumption)\n    apply (sep_auto intro: hm_it_next_key_next_key''_aux simp: pure_def)\n    done\n  done\n\n\nsubsection \\<open>Computing the range of a map\\<close>\n\ndefinition ran_of_map where\n  \"ran_of_map m \\<equiv> do\n      {\n        (xs, m) \\<leftarrow> WHILEIT\n          (\\<lambda> (xs, m'). finite (dom m') \\<and> ran m = ran m' \\<union> set xs) (\\<lambda> (_, m). Map.empty \\<noteq> m)\n            (\\<lambda> (xs, m). do\n              {\n                k \\<leftarrow> next_key m;\n                let (x, m) = op_map_extract k m;\n                ASSERT (x \\<noteq> None);\n                RETURN (the x # xs, m)\n              }\n            )\n            ([], m);\n        RETURN xs\n      }\n  \"\n\ncontext\nbegin\n\nprivate definition\n  \"ran_of_map_var = (inv_image (measure (card o dom)) (\\<lambda> (a, b). b))\"\n\nprivate lemma wf_ran_of_map_var:\n  \"wf ran_of_map_var\"\n  unfolding ran_of_map_var_def by auto\n\n(* XXX Maybe move *)\nprivate lemma insert_restrict_ran:\n  \"insert v (ran (m |` (- {k}))) = ran m \" if \"m k = Some v\"\n  using that unfolding ran_def restrict_map_def by force\n\nlemma ran_of_map_correct[refine]:\n  \"ran_of_map m \\<le> SPEC (\\<lambda> r. set r = ran m)\" if \"finite (dom m)\"\n  using that unfolding ran_of_map_def next_key_def\n  apply (refine_vcg wf_ran_of_map_var)\n         apply (clarsimp; fail)+\n  subgoal for s xs m' x v xs' xs1 xs'1\n    unfolding dom_def by (clarsimp simp: map_upd_eq_restrict, auto dest: insert_restrict_ran)\n  subgoal\n    unfolding ran_of_map_var_def op_map_extract_def by (fastforce intro: card_Diff1_less)\n  by auto\n\nend \\<comment> \\<open>End of private context for auxiliary facts and definitions\\<close>\n\nsepref_register next_key :: \"(('b, 'a) i_map \\<Rightarrow> 'b nres)\"\n\ndefinition (in imp_map_is_empty) [code_unfold]: \"hms_is_empty \\<equiv> is_empty\"\n\nlemma (in imp_map_is_empty) hms_empty_rule [sep_heap_rules]:\n  \"<hms_assn A m mi> hms_is_empty mi <\\<lambda>r. hms_assn A m mi * \\<up>(r \\<longleftrightarrow> m=Map.empty)>\\<^sub>t\"\n  unfolding hms_is_empty_def hms_assn_def map_assn_def by sep_auto\n\ncontext imp_map_is_empty\nbegin\n\nlemma hms_is_empty_hnr[sepref_fr_rules]:\n  \"(hms_is_empty, RETURN o op_map_is_empty) \\<in> (hms_assn A)\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  by sepref_to_hoare sep_auto\n\nsepref_decl_impl is_empty: hms_is_empty_hnr uses op_map_is_empty.fref[where V = Id] .\n\nend\n\nlemma (in imp_map) hms_assn'_id_hms_assn:\n  \"hms_assn' id_assn A = hms_assn A\"\n  by (subst hms_assn'_def) simp\n\n(* This is to make the pre-processing phase pick the right type for the input *)\nlemma [intf_of_assn]:\n  \"intf_of_assn (hm.hms_assn' a b) TYPE(('aa, 'bb) i_map)\"\n  by simp\n\ncontext\n  fixes K :: \"_ \\<Rightarrow> _ :: {hashable, heap} \\<Rightarrow> assn\"\n  assumes is_pure_K[safe_constraint_rules]: \"is_pure K\"\n  and left_unique_K[safe_constraint_rules]: \"IS_LEFT_UNIQUE (the_pure K)\"\n  and right_unique_K[safe_constraint_rules]: \"IS_RIGHT_UNIQUE (the_pure K)\"\n  notes [sepref_fr_rules] = hm_it_next_key_next_key''[OF is_pure_K]\nbegin\n\nsepref_definition ran_of_map_impl is\n  \"ran_of_map\" :: \"(hm.hms_assn' K A)\\<^sup>d \\<rightarrow>\\<^sub>a list_assn A\"\n  unfolding ran_of_map_def hm.hms_assn'_id_hms_assn[symmetric]\n  unfolding op_map_is_empty_def[symmetric]\n  unfolding hm.hms_fold_custom_empty HOL_list.fold_custom_empty\n  by sepref\n\nend (* Anonymous context for setup *)\n\nlemmas ran_of_map_impl_code[code] =\n  ran_of_map_impl_def[of \"pure Id\", simplified, OF Sepref_Constraints.safe_constraint_rules(41)]\n\ncontext\n  notes [sepref_fr_rules] = hm_it_next_key_next_key'[folded hm.hms_assn'_id_hms_assn]\nbegin\n\nsepref_definition ran_of_map_impl' is\n  \"ran_of_map\" :: \"(hm.hms_assn A)\\<^sup>d \\<rightarrow>\\<^sub>a list_assn A\"\n  unfolding ran_of_map_def hm.hms_assn'_id_hms_assn[symmetric]\n  unfolding op_map_is_empty_def[symmetric]\n  unfolding hm.hms_fold_custom_empty HOL_list.fold_custom_empty\n  by sepref\n\nend (* Anonymous context for setup *)\n\nend (* Theory *)\n", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Worklist_Algorithms/Next_Key.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.6370307806984445, "lm_q1q2_score": 0.34087416973852125}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |               November 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_law_SKIP_DIV\nimports CSP_F_law_SKIP CSP_F_law_DIV CSP_T_law_SKIP_DIV\nbegin\n\n(*********************************************************\n                   (SKIP [+] DIV)\n *********************************************************)\n\nlemma cspF_SKIP_DIV_Ext_choice1: \"(SKIP [+] DIV) =F[M1,M2] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_DIV_Ext_choice)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces in_failures)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_traces in_failures)\n apply (force)\ndone\n\n(*********************************************************\n                   (DIV [+] SKIP)\n *********************************************************)\n\nlemma cspF_SKIP_DIV_Ext_choice2: \"(DIV [+] SKIP) =F[M1,M2] SKIP\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_SKIP_DIV_Ext_choice1)\ndone\n\nlemmas cspF_SKIP_DIV_Ext_choice =\n       cspF_SKIP_DIV_Ext_choice1\n       cspF_SKIP_DIV_Ext_choice2\n\n(*********************************************************\n                    SKIP |[X]| DIV\n *********************************************************)\n\nlemma cspF_SKIP_DIV_Parallel1:\n   \"SKIP |[X]| DIV =F[M1,M2] DIV\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_DIV_Parallel1)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\ndone\n\nlemma cspF_SKIP_DIV_Parallel2:\n   \"DIV |[X]| SKIP =F[M1,M2] DIV\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_DIV_Parallel1)\napply (rule cspF_reflex)\ndone\n\nlemmas cspF_SKIP_DIV_Parallel =\n       cspF_SKIP_DIV_Parallel1\n       cspF_SKIP_DIV_Parallel2\n       cspF_Parallel_term\n       cspF_DIV_Parallel\n\n(*********************************************************\n                 DIV and Parallel-SKIP\n *********************************************************)\n\n(*********************************************************\n                      SKIP and Parallel\n *********************************************************)\n\n(*** SKIP and DIV ***)\n\nlemma cspF_DIV_Parallel_Ext_choice_SKIP_l:\n  \"(P [+] SKIP) |[X]| DIV =F[M,M] (P |[X]| DIV)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_DIV_Parallel_Ext_choice_SKIP_l)\napply (rule order_antisym)\napply (rule, simp add: in_failures)+\ndone\n\nlemma cspF_DIV_Parallel_Ext_choice_SKIP_r:\n  \"DIV |[X]| (P [+] SKIP) =F[M,M] (DIV |[X]| P)\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_DIV_Parallel_Ext_choice_SKIP_l)\napply (rule cspF_commut)\ndone\n\nlemmas cspF_DIV_Parallel_Ext_choice_SKIP =\n       cspF_DIV_Parallel_Ext_choice_SKIP_l\n       cspF_DIV_Parallel_Ext_choice_SKIP_r\n\nlemmas cspF_DIV_Parallel_Ext_choice =\n       cspF_DIV_Parallel_Ext_choice_SKIP\n       cspF_DIV_Parallel_Ext_choice_DIV\n\n(*********************************************************\n                 SKIP and Parallel-DIV\n *********************************************************)\n\n(*** DIV and SKIP ***)\n\nlemma cspF_SKIP_Parallel_Ext_choice_DIV_l:\n  \"((? :Y -> Pf) [+] DIV) |[X]| SKIP =F[M,M]\n   (? x:(Y - X) -> (Pf x |[X]| SKIP)) [+] DIV\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Parallel_Ext_choice_DIV_l)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (simp add: par_tr_nil_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp)\n  apply (rule_tac x=\"sb\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n\n  apply (simp add: par_tr_Tick_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp)\n  apply (rule_tac x=\"sb\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n\n  apply (simp add: in_traces)\n\n(* <= *)\n apply (rule, simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (simp add: in_traces)\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp add: par_tr_nil_right)\n  apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n  apply (simp add: image_iff)\n  apply (fast)\n\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp add: par_tr_Tick_right)\n  apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n  apply (simp add: image_iff)\n  apply (fast)\n\n  apply (simp add: in_traces)\n  apply (simp add: in_traces)\ndone\n\nlemma cspF_SKIP_Parallel_Ext_choice_DIV_r:\n  \"SKIP |[X]| ((? :Y -> Pf) [+] DIV) =F[M,M]\n   (? x:(Y - X) -> (SKIP |[X]| Pf x)) [+] DIV\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_Parallel_Ext_choice_DIV_l)\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_commut)\napply (rule cspF_reflex)\napply (rule cspF_reflex)\ndone\n\nlemmas cspF_SKIP_Parallel_Ext_choice_DIV =\n       cspF_SKIP_Parallel_Ext_choice_DIV_l\n       cspF_SKIP_Parallel_Ext_choice_DIV_r\n\nlemmas cspF_SKIP_Parallel_Ext_choice =\n       cspF_SKIP_Parallel_Ext_choice_SKIP\n       cspF_SKIP_Parallel_Ext_choice_DIV\n\n(*---------------------------------------------*\n |                 SKIP , DIV                  |\n *---------------------------------------------*)\n\nlemmas cspF_SKIP_DIV_Parallel_step =\n       cspF_Parallel_preterm\n       cspF_DIV_Parallel_step\n\nlemmas cspF_SKIP_DIV_Parallel_Ext_choice =\n       cspF_SKIP_Parallel_Ext_choice\n       cspF_DIV_Parallel_Ext_choice\n\nlemmas cspF_SKIP_DIV_Hiding_Id =\n       cspF_SKIP_Hiding_Id\n       cspF_DIV_Hiding_Id\n\nlemmas cspF_SKIP_DIV_Hiding_step =\n       cspF_DIV_Hiding_step\n       cspF_SKIP_Hiding_step\n\nlemmas cspF_SKIP_DIV_Renaming_Id =\n       cspF_SKIP_Renaming_Id\n       cspF_DIV_Renaming_Id\n\nlemmas cspF_SKIP_DIV_Seq_compo =\n       cspF_Seq_compo_unit\n       cspF_DIV_Seq_compo\n\nlemmas cspF_SKIP_DIV_Seq_compo_step =\n       cspF_SKIP_Seq_compo_step\n       cspF_DIV_Seq_compo_step\n\nlemmas cspF_SKIP_DIV_Depth_rest =\n       cspF_SKIP_Depth_rest\n       cspF_DIV_Depth_rest\n\nlemmas cspF_SKIP_DIV =\n       cspF_SKIP_DIV_Parallel_step\n       cspF_SKIP_DIV_Ext_choice\n       cspF_SKIP_DIV_Parallel\n       cspF_SKIP_DIV_Parallel_Ext_choice\n       cspF_SKIP_DIV_Hiding_Id\n       cspF_SKIP_DIV_Hiding_step\n       cspF_SKIP_DIV_Renaming_Id\n       cspF_SKIP_DIV_Seq_compo\n       cspF_SKIP_DIV_Seq_compo_step\n       cspF_SKIP_DIV_Depth_rest\n\n(*** resolve ***)\n\nlemmas cspF_Ext_choice_SKIP_DIV_resolve =\n       cspF_Ext_choice_SKIP_resolve\n       cspF_Ext_choice_DIV_resolve\n\n(*----------------------------------------------*\n |                                              |\n |        for convenienve  (SKIP or DIV)        |\n |                                              |\n *----------------------------------------------*)\n\n(*********************************************************\n            (SKIP or DIV [+] SKIP or DIV)\n *********************************************************)\n\nlemma cspF_SKIP_or_DIV_Ext_choice:\n  \"[| P = SKIP | P = DIV ; Q = SKIP | Q = DIV |] ==>\n   (P [+] Q) =F[M1,M2] (if (P = SKIP | Q = SKIP) then SKIP else DIV)\"\napply (elim disjE)\napply (simp_all)\napply (rule cspF_rw_left)\napply (rule cspF_Ext_choice_idem)\napply (simp)\napply (simp add: cspF_SKIP_DIV)\napply (simp add: cspF_SKIP_DIV)\napply (rule cspF_rw_left)\napply (rule cspF_Ext_choice_idem)\napply (simp)\ndone\n\n(*********************************************************\n            (SKIP or DIV |[X]| SKIP or DIV)\n *********************************************************)\n\nlemma cspF_SKIP_or_DIV_Parallel:\n  \"[| P = SKIP | P = DIV ; Q = SKIP | Q = DIV |] ==>\n   (P |[X]| Q) =F[M1,M2] (if (P = SKIP & Q = SKIP) then SKIP else DIV)\"\napply (elim disjE)\napply (simp_all add: cspF_SKIP_DIV)\ndone\n\n(*********************************************************\n                  (SKIP or DIV) and Hiding\n *********************************************************)\n\nlemma cspF_SKIP_or_DIV_Hiding_step:\n  \"Q = SKIP | Q = DIV ==>\n   ((? :Y -> Pf) [+] Q) -- X =F[M,M] \n   (((? x:(Y-X) -> (Pf x -- X)) [+] Q) |~| (! x:(Y Int X) .. (Pf x -- X)))\"\napply (erule disjE)\napply (simp_all add: cspF_SKIP_DIV)\ndone\n\n(*********************************************************\n                  SKIP or DIV |. Suc n\n *********************************************************)\n\nlemma cspF_SKIP_or_DIV_Depth_rest: \n   \"Q = SKIP | Q = DIV ==> Q |. (Suc n) =F[M1,M2] Q\"\napply (erule disjE)\napply (simp_all add: cspF_SKIP_DIV)\ndone\n\n(*********************************************************\n                    P [+] (SKIP or DIV)\n *********************************************************)\n\nlemma cspF_Ext_choice_SKIP_or_DIV_resolve:\n  \"Q = SKIP | Q = DIV ==> P [+] Q =F[M,M] P [> Q\"\napply (erule disjE)\napply (simp_all add: cspF_Ext_choice_SKIP_DIV_resolve)\ndone\n\nlemmas cspF_SKIP_or_DIV =\n       cspF_SKIP_or_DIV_Ext_choice\n       cspF_SKIP_or_DIV_Parallel\n       cspF_SKIP_or_DIV_Hiding_step\n       cspF_SKIP_or_DIV_Depth_rest\n\n       (* no resolv *)\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_law_SKIP_DIV.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3408741697385212}}
{"text": "(*<*)\ntheory Everything\nimports DenotationalEquivalences Correctness  \"Correctness-Counterexample\" \"~~/src/HOL/Library/LaTeXsugar\" \nbegin\n\n(*\nnotation (latex output) DenotationalUpd.ESem (\"\\<lbrakk>_\\<rbrakk>\\<^bsup>u\\<^esup>\\<^bsub>_\\<^esub>\"  [60,60] 60)\nnotation (latex output) \"Denotational-PropsUpd.HSem_syn\" (\"\\<lbrace>_\\<rbrace>\\<^bsup>u\\<^esup>_\"  [60,60] 60)\n*)\n\ntranslations\n  \"xs\" <= \"CONST set xs\"\ntranslations\n  \"xs\" <= \"CONST asToHeap xs\"\ntranslations\n  \"a\" <= \"CONST atom a\"\n\nlemma Terms:\n  \"\\<exists> x assn e'. (e = (Lam [x]. e') \\<or> (e = Var x) \\<or> (e = App e' x) \\<or> (e = Let assn e'))\"\n  by (metis Terms.exp_assn.exhaust(1))\nlemma expressions_grammar:\n\"(\\<forall> var. y = Var var \\<longrightarrow> P) \\<longrightarrow>\n(\\<forall> exp var. y = App exp var \\<longrightarrow> P) \\<longrightarrow>\n(\\<forall> assn exp. y = Terms.Let assn exp \\<longrightarrow> P) \\<longrightarrow> (\\<forall> var exp. y = Lam [var]. exp \\<longrightarrow> P) \\<longrightarrow> P\"\n  by (metis exp_assn.exhaust(1)) \n\nabbreviation (Grammar output)\n  \"grammar_imp\"\nwhere\n  \"grammar_imp \\<equiv> op \\<longrightarrow>\"\n\nsyntax (Grammar output)\n  \"_grapats\" :: \"term \\<Rightarrow> term \\<Rightarrow> term\" (\"_ | _\")\n  \"_grafirst\" :: \"term \\<Rightarrow> term \\<Rightarrow> term\" (\"_ ::= _\")\n  \"_grarest\" :: \"term \\<Rightarrow> term \\<Rightarrow> term\"\n  \"_firsteq\" :: \"term \\<Rightarrow> term \\<Rightarrow> term\"\n  \"_resteq\" :: \"term \\<Rightarrow> term \\<Rightarrow> term\"\n\ntranslations\n  \"_grapats (_firsteq all) (_grarest (CONST grammar_imp rest1 rest2))\" <= \"CONST grammar_imp all (CONST grammar_imp rest1 rest2)\"\n  \"_grapats (_resteq all) (_grarest (CONST grammar_imp rest1 rest2))\" <= \"_grarest (CONST grammar_imp all (CONST grammar_imp rest1 rest2))\"\n  \"_resteq all\" <= \"_grarest (CONST grammar_imp all rest)\"\n  \"_resteq all\" <= \"_resteq (CONST grammar_imp all rest)\"\n  \"_firsteq all\" <= \"_firsteq (CONST grammar_imp all rest)\"\n  \"_firsteq imp\" <= \"_firsteq (ALL x. imp)\"\n  \"_resteq imp\" <= \"_resteq (ALL x. imp)\"\n  \"_grafirst x t\" <= \"_firsteq (x = t)\"\n  \"t\" <= \"_resteq (x = t)\"\n\n(*\nthm expressions_grammar[no_vars]\nthm (Grammar) expressions_grammar[no_vars]\nthm (latex) expressions_grammar[no_vars]\nthm (latex Grammar) expressions_grammar[no_vars]\n*)\n\ndeclare [[names_short]]\n\n(*>*)\nsubsection {* Main definitions and theorems *}\n\ntext {*\nFor your convenience, the main definitions and theorems of the present work are assembled in this section. The following \nformulas are mechanically pretty-printed versions of the statements as defined resp.\\ proven in Isabelle.\nFree variables are all-quantified. Some type conversion functions (like @{term_type set}) are omitted.\nThe relations @{text \\<sharp>} and @{text \"\\<sharp>*\"} come from the Nominal package and express freshness of the\nvariables on the left with regard to the expressions on the right.\n\n\\input{map.tex}\n*}\n\nsubsubsection {* Expressions *}\n\ntext {*\nThe type @{typ var} of variables is abstract and provided by the Nominal package. All we know about\nit is that it is countably infinite.\nExpressions of type @{typ exp} are given by the following grammar:\n\\begin{alignatstar}{2}\n@{term e} \\Coloneqq {}& @{term \"Lam [x]. e\"} &\\quad& \\text{lambda abstraction}\\\\\n\\mid {} & @{term \"App e x\"} && \\text{application}\\\\\n\\mid {} & @{term \"Var x\"} && \\text{variable} \\\\\n\\mid {} & @{term \"Let as e\"} && \\text{recursive let}\n\\end{alignatstar}\nIn the introduction we pretty-print expressions to match the notation in \\cite{launchbury} and omit\nthe constructor names @{term Var}, @{term App}, @{text Lam} and @{term Let}. In the actual theories, these are visible.\nThese expressions are, due to the machinery of the Nominal package, actually alpha-equivalency classes, so @{thm alpha_test[no_vars]} holds provably. This differs from Launchbury's original definition, which expects distinctly-named expressions and performs explicit alpha-renaming in the semantics.\n\nThe type @{type heap} is an abbreviation for @{typ \"(var \\<times> exp) list\"}. These are \\emph{not} alpha-equivalency classes, i.e.\\ we manage the bindings in heaps explicitly.\n*}\n\nsubsubsection {* The natural semantics *}\n\ntext_raw {*\n\\newlength{\\rulelen}\n\\setlength{\\rulelen}{\\linewidth}\n\\newlength{\\rulenamelen}\n\\settowidth{\\rulenamelen}{~{\\sc Application}}\n\\addtolength{\\rulelen}{-\\rulenamelen}\n*}\n\ntext {*\nLaunchbury's original semantics, extended with some technical overhead related to name binding,\nis defined as follows:\\\\\n%\\begin{center}\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Axiom] Launchbury.reds.Lambda[no_vars]}}~{\\sc Lambda}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] Launchbury.reds.Application[no_vars]}}~{\\sc Application}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] Launchbury.reds.Variable[no_vars]}}~{\\sc Variable}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] Launchbury.reds.Let[no_vars]}}~{\\sc Let}\n%\\end{center}\n*}\n\nsubsubsection {* The stacked semantics *}\n\ntext {*\nThis is our modified semantics that allows the correctness theorem to go through without generalisation:\\\\\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Axiom] LaunchburyStacked.reds.Lambda[no_vars]}}~{\\sc Lambda}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] LaunchburyStacked.reds.Application[no_vars]}}~{\\sc Application}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] LaunchburyStacked.reds.Variable[no_vars]}}~{\\sc Variable}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] LaunchburyStacked.reds.Let[no_vars]}}~{\\sc Let}\n*}\nsubsubsection {* The denotational semantics *}\n\ntext {*\nThe value domain of the denotational semantics is the initial solution to\n\\[\nD = [D \\to D]_\\bot\n\\]\nas introduced in \\cite{abramsky}. The type @{typ Value}, together with the bottom value @{term_type \"\\<bottom>::Value\"}, the\ninjection @{term_type \"Fn\"} and the projection @{term \"DUMMY \\<down>Fn DUMMY\"}@{text \"::\"}@{typeof \"Fn_project\"},\nis constructed as a pointed chain-complete partial order from this equation by the HOLCF package.\nThe type of semantic environments, @{typ Env}, is an abbreviation for @{typ \"var f\\<rightharpoonup> Value\"}.\n\nThe semantics of an expression @{term_type \"e :: exp\"} in an environment @{term \"\\<rho>\"}@{text \"::\"}@{typ Env} is \nwritten \\mbox{@{term_type \"Rep_cfun (Denotational.ESem e) \\<rho>\"}} and defined by the following equations:\n\\begin{alignstar}\n@{thm (lhs) Denotational.ESem.simps(1)[no_vars]} & = @{thm (rhs) Denotational.ESem.simps(1)[no_vars]} \\\\\n@{thm (lhs) Denotational.ESem.simps(2)[no_vars]} & = @{thm (rhs) Denotational.ESem.simps(2)[no_vars]} \\\\\n@{thm (lhs) Denotational.ESem.simps(3)[no_vars]} & = @{thm (rhs) Denotational.ESem.simps(3)[no_vars]} \\\\\n@{thm (lhs) Denotational.ESem.simps(4)[no_vars]} & = @{thm (rhs) Denotational.ESem.simps(4)[no_vars]}.\n\\end{alignstar}\n*}\n\ntext {*\nWe study two alternatives for the semantics @{term \"Rep_cfun (Denotational.HSem \\<Gamma>) \\<rho>\"}@{text \"::\"}@{typ Env} of a\nheap @{term \"\\<Gamma> :: heap\"}@{text \"::\"}@{typ heap}\nin an environment @{term \"\\<rho>\"}@{text \"::\"}@{typ Env}. As this is used in denotations of a Let expression,\nwe have also two expression semantics. Their defining equations are, besides the choice of heap semantics, identical.\n\nThe first involves a least upper bound ($\\sqcup$) and is defined by the recursive equation\n\\[ @{thm (concl) Denotational.HSem_eq[no_vars]}, \\]\nwhere the set in the index position indicates the expansion of the map to the given domain and\n@{term \"heapToEnv:: heap \\<Rightarrow> (exp \\<Rightarrow> Value) \\<Rightarrow> Env\"}@{text \"::\"}@{typ \"heap \\<Rightarrow> (exp \\<Rightarrow> Value) \\<Rightarrow> Env\"}\nmaps the given expression semantics over the heap, producing a semantic environment.\n\nThe other, here shown with a superscript @{text \"u\"}, uses the right-sided update operator @{text \"f++\"}\nand is defined by the recursive equation\n\\[ @ {thm \"Denotational-PropsUpd.UHSem_eq\"[no_vars]}. \\]\n\nThe semantics of the heap in the empty environment @{term \"fempty\"} is abbreviated as @ {abbrev \"HSem_fempty \\<Gamma>\"}.\n\nIt is worth noting that the two semantics agree on expressions, i.e. @ {thm UHSem_join_update(1)[no_vars] },\nbut obviously not on heaps that bind variables that also occur in the environment.\n*}\n\nsubsubsection {* Equivalences *}\ntext {*\nThe stacked semantics is equivalent to the original semantics in the following sense:\n\\begin{itemize}\n\\item If @{thm[mode=IfThen] (prem 1) forget_stack_nice[no_vars] } is derivable in the stacked semantics,\nand @{term L} is chosen such that @{thm[mode=IfThen] (prem 2) forget_stack_nice[no_vars]} holds, then\n @{thm[mode=IfThen] (concl) forget_stack_nice[no_vars]} is derivable in the original semantics.\n\\item If @{thm[mode=IfThen] (prem 1) add_stack[no_vars]} is derivable in the original semantics and\n@{term \"x\"} and @{term \"\\<Gamma>'\"} are chosen such that @{thm[mode=IfThen] (prem 2) add_stack[no_vars]} and\n@{thm[mode=IfThen] (prem 3) add_stack[no_vars]} holds, then  @{thm[mode=IfThen] (concl) add_stack[no_vars]}\nis derivable in the stacked semantics.\n\\end{itemize}\n*}\n\nsubsubsection {* Correctness *}\ntext {* The statement of correctness for the stacked semantics reads:\nIf @{thm [mode=IfThen] (prem 1) CorrectnessStacked.correctness[no_vars]} and, as a side condition,\n@{thm [mode=IfThen] (prem 2) CorrectnessStacked.correctness[no_vars]} holds, then @{thm [mode=IfThen] (concl) CorrectnessStacked.correctness(1)[no_vars]}. *}\n\ntext {* By the stated equivalency, we obtain the correctness of the original semantics:\nIf \\mbox{@{thm [mode=IfThen] (prem 1) Correctness.correctness(1)[no_vars]}} and, as a side condition,\n@{thm [mode=IfThen] (prem 2) Correctness.correctness(1)[no_vars]} holds, then @{thm [mode=IfThen] (concl) Correctness.correctness(1)[no_vars]} and \n @{thm [mode=IfThen] (concl) Correctness.correctness(2)[no_vars]} *}\n\ntext {* The generalization introduced by Launchbury is true if the update-based semantics is chosen:\nIf @ {thm [mode=IfThen] (prem 1) CorrectnessUpd.correctness(1)[no_vars]} and, as a side condition,\n@ {thm [mode=IfThen] (prem 2) CorrectnessUpd.correctness(1)[no_vars]} and\n\\mbox{@ {thm [mode=IfThen] (prem 3) CorrectnessUpd.correctness(1)[no_vars]}} hold,\nthen @ {thm [mode=IfThen] (concl) CorrectnessUpd.correctness(1)[no_vars]} and  @ {thm [mode=IfThen] (concl) CorrectnessUpd.correctness(2)[no_vars]}. *}\n\n\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/Everything.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804337438502, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.34070506446845467}}
{"text": "theory Lift_Option\n  imports \"../Lifter\"\nbegin\n\n(*\n * option\n *)\ndefinition option_l ::\n  \"('x, 'a, 'b) lifting \\<Rightarrow> ('x, 'a, 'b option) lifting\" where\n\"option_l t =\n    LMake (\\<lambda> s a b . \n              (case b of\n                Some b' \\<Rightarrow> Some (LUpd t s a b')\n                | None \\<Rightarrow> Some (LUpd t s a (LBase t s))))\n            (\\<lambda> s b . (case b of Some b' \\<Rightarrow> LOut t s b'\n                        | None \\<Rightarrow> LOut t s (LBase t s)))\n            (\\<lambda> s . None)\"\n\ndefinition option_l_S :: \"('s, 'b) valid_set \\<Rightarrow> ('s, 'b option) valid_set\" where\n\"option_l_S S s = (Some ` S s)\"\n\n\n(* TODO: clean up mergeable instances so that we are consistently using Weakb instances\n   where needed. *)\nlocale option_l_valid_weak = lifting_valid_weak\n\nsublocale option_l_valid_weak \\<subseteq> out : lifting_valid_weak \"option_l l\" \"option_l_S S\"\nproof\n\n  fix s a b\n  show \"LOut (option_l l) s (LUpd (option_l l) s a b) = a\"\n    using put_get \n    by(auto simp add:option_l_def split:option.splits)\nnext\n  fix s b\n  assume Hb : \"b \\<in> option_l_S S s\"\n  thus \"b <[ LUpd (option_l l) s (LOut (option_l l) s b) b\"\n    using get_put_weak\n    by(auto simp add:option_l_def option_l_S_def option_pleq split:option.splits)\nnext\n  fix s :: 'a\n  fix a\n  fix b :: \"'c option\"\n  show \"LUpd (option_l l) s a b \\<in> option_l_S S s\"\n    using put_S\n    by(auto simp add: option_l_def option_l_S_def split:option.splits)\nqed\n\nlemma (in option_l_valid_weak) ax :\n  shows \"lifting_valid_weak (option_l l) (option_l_S S)\"\n  using out.lifting_valid_weak_axioms\n    by auto\n\nlemma (in option_l_valid_weak) ax_g :\n  assumes \"S' = option_l_S S\"\n  shows \"lifting_valid_weak (option_l l) S'\"\n  using out.lifting_valid_weak_axioms assms\n  by auto\n\nlocale option_l_valid_base_ext = lifting_sig\n\nsublocale option_l_valid_base_ext \\<subseteq> out : lifting_valid_base_ext \"option_l l\" \"option_l_S S\"\nproof\n  fix s\n  show \"LBase (option_l l) s = \\<bottom>\"\n    by(auto simp add: option_l_def option_bot)\nqed\n\nlemma (in option_l_valid_base_ext) ax :\n  shows \"lifting_valid_base_ext (option_l l)\"\n  using out.lifting_valid_base_ext_axioms by auto\n\n(*\nlocale option_l_valid_weak_base = option_l_valid_weak + option_l_valid_base_ext\n\nsublocale option_l_valid_weak_base \\<subseteq> out: lifting_valid_weak_base \"option_l l\" \"option_l_S S\"\nproof\nqed\n\nlemma (in option_l_valid_weak_base) ax :\n  shows \"lifting_valid_weak_base (option_l l) (option_l_S S)\"\n  using out.lifting_valid_weak_base_axioms\n    by auto\n\nlemma (in option_l_valid_weak_base) ax_g :\n  assumes \"S' = option_l_S S\"\n  shows \"lifting_valid_weak_base (option_l l) S'\"\n  using out.lifting_valid_weak_base_axioms assms\n  by auto\n*)\n\nlocale option_l_valid_ext = lifting_valid_ext\n\nsublocale option_l_valid_ext \\<subseteq> out : lifting_valid_ext \"option_l l\" \"option_l_S S\"\nproof\n  fix s a b\n  (*assume \"b \\<in> option_l_S S s\"*)\n  show \"b <[ LUpd (option_l l) s a b\"\n    using get_put\n    by(auto simp add:option_l_def option_l_S_def LNew_def option_pleq split:option.splits)\nqed\n\nlemma (in option_l_valid_ext) ax :\n  shows \"lifting_valid_ext (option_l l)\"\n  using out.lifting_valid_ext_axioms\n    by auto\n\nlocale option_l_valid_ok_ext = lifting_valid_ok_ext\n\nsublocale option_l_valid_ok_ext \\<subseteq> out: lifting_valid_ok_ext \"option_l l\" \"option_l_S S\"\nproof\n  fix s\n  show \"ok_S \\<subseteq> option_l_S S s\" using ok_S_valid\n    by(auto simp add: option_l_S_def option_ok_S)\nnext\n  fix s a b\n  assume \"(b :: 'c option) \\<in> ok_S\"\n  then show \"LUpd (option_l l) s a b \\<in> ok_S\"\n    using ok_S_put\n    by(auto simp add: option_l_S_def option_l_def option_ok_S split: option.splits)\nqed\n\nlemma (in option_l_valid_ok_ext) ax:\n  shows \"lifting_valid_ok_ext (option_l l) (option_l_S S)\"\n  using out.lifting_valid_ok_ext_axioms\n  by auto\n\nlemma (in option_l_valid_ok_ext) ax_g :\n  assumes \"S' = option_l_S S\"\n  shows \"lifting_valid_ok_ext (option_l l) S'\"\n  using out.lifting_valid_ok_ext_axioms assms\n  by auto\n\n\nlocale option_l_valid_pres_ext = lifting_valid_pres_ext + option_l_valid_weak\n\nsublocale option_l_valid_pres_ext \\<subseteq> out : lifting_valid_pres_ext \"option_l l\" \"option_l_S S\"\nproof\n  fix V\n  fix s \n  fix v supr :: \"'c option\"\n  fix f\n\n  assume Nemp : \"v \\<in> V\"\n  assume V_valid : \"V \\<subseteq> option_l_S S s\"\n\n  assume Hsup : \"is_sup V supr\"\n  assume Hsup_in : \"supr \\<in> option_l_S S s\"\n\n  obtain supr' where Supr' : \"supr = Some supr'\" \"supr' \\<in> S s\"\n    using V_valid Hsup_in by(auto simp add: option_l_S_def)\n\n  show \"is_sup (LMap (option_l l) f s ` V) (LMap (option_l l) f s supr)\"\n  proof(rule is_supI)\n    fix x\n\n    assume X : \"x \\<in> LMap (option_l l) f s ` V\"\n\n    then obtain xo where Xo : \"xo \\<in> V\" \"LMap (option_l l) f s xo = x\"\n      by auto\n\n    have \"xo <[ supr\" using is_supD1[OF Hsup Xo(1)] by simp\n\n    have \"x \\<in> option_l_S S s\"\n      using put_S Xo\n      by(auto simp add: option_l_S_def option_l_def split: option.splits)\n\n    then obtain x' where X' : \"x = Some x'\" \"x' \\<in> S s\"\n      by(auto simp add: option_l_S_def)\n\n    obtain xo' where Xo' : \"xo = Some xo'\" \"xo' \\<in> S s\" using V_valid Xo\n      by(auto simp add: option_l_S_def)\n\n    have \"xo' <[ supr'\" using Xo' Supr' `xo <[ supr`\n      by(simp add: option_pleq)\n\n    hence \"is_sup {xo', supr'} supr'\"\n      using is_sup_pair by auto\n\n    hence Conc' : \"is_sup (LMap l f s ` {xo', supr'}) (LMap l f s supr')\"\n      using Xo' Supr' pres[of xo' \"{xo', supr'}\" s supr' f] \n      by auto\n\n    thus \"x <[ LMap (option_l l) f s supr\"\n      using is_supD1[OF Conc', of x'] X' Xo Xo' Supr'\n      by(cases l; auto simp add: option_l_def option_pleq)\n  next\n\n    fix z\n\n    assume Ub : \"is_ub (LMap (option_l l) f s ` V) z\" \n\n    obtain V' where SV' : \"V = Some ` V'\" \"V' \\<subseteq> S s\"\n      using V_valid\n      by(auto simp add: option_l_S_def; blast)\n\n    obtain v' where V' : \"v = Some v'\" \"v' \\<in> V'\"\n      using Nemp SV'\n      by auto\n\n    have Supr'_sup : \"is_sup V' supr'\"\n    proof(rule is_supI)\n      fix x'\n\n      assume \"x' \\<in> V'\"\n\n      then show \"x' <[ supr'\"\n        using is_supD1[OF Hsup, of \"Some x'\"] Supr' SV' V'\n        by(auto simp add: option_pleq)\n    next\n\n      fix z'\n\n      assume \"is_ub V' z'\"\n\n      then have \"is_ub V (Some z')\"\n        using V' SV'\n        by(auto simp add: option_pleq is_ub_def)\n\n      then show \"supr' <[ z'\"\n        using is_supD2[OF Hsup, of \"Some z'\"] Supr'\n        by(auto simp add: option_pleq)\n    qed\n\n    have Supr'_sup : \"is_sup (LMap l f s ` V') (LMap l f s supr')\"\n      using pres[OF V'(2) SV'(2) Supr'_sup, of f] Supr'(2)\n      by auto\n\n    obtain vr' where Vr' : \"LMap (option_l l) f s v = Some vr'\"\n      using put_get V'\n      by(cases l; auto simp add: option_l_def)\n\n    have \"LMap (option_l l) f s v <[ z\"\n      using is_ubE[OF Ub, of \"LMap (option_l l) f s v\"] Nemp\n      by(auto)\n\n    then obtain z' where Z' : \"z = Some z'\" using Vr'\n      by(cases z; auto simp add: option_pleq)\n\n    hence \"is_ub (LMap l f s ` V') z'\"\n      using Ub SV'\n      by(cases l; auto simp add: option_l_def is_ub_def option_pleq)\n\n    hence \"LMap l f s supr' <[ z'\"\n      using is_supD2[OF Supr'_sup] by auto\n\n    then show \"LMap (option_l l) f s supr <[ z\" using V' Z' Supr'\n      by(cases l; auto simp add: option_l_def is_ub_def option_pleq)\n  qed\nqed\n\nlemma (in option_l_valid_pres_ext) ax:\n  shows \"lifting_valid_pres_ext (option_l l) (option_l_S S)\"\n  using out.lifting_valid_pres_ext_axioms\n  by auto\n\nlemma (in option_l_valid_pres_ext) ax_g :\n  assumes \"S' = option_l_S S\"\n  shows \"lifting_valid_pres_ext (option_l l) S'\"\n  using out.lifting_valid_pres_ext_axioms assms\n  by auto\n\nlocale option_l_valid_base_pres_ext = option_l_valid_pres_ext\n\nsublocale option_l_valid_base_pres_ext \\<subseteq> out: lifting_valid_base_pres_ext \"option_l l\" \"option_l_S S\"\nproof\n  show \"\\<And> s . \\<bottom> \\<notin> option_l_S S s\"\n    by(auto simp add: option_l_S_def option_bot)\nqed\n\nlemma (in option_l_valid_base_pres_ext) ax :\n  shows \"lifting_valid_base_pres_ext (option_l l) (option_l_S S)\"\n  using out.lifting_valid_base_pres_ext_axioms\n  by auto\n\nlemma (in option_l_valid_base_pres_ext) ax_g :\n  assumes \"S' = option_l_S S\"\n  shows \"lifting_valid_base_pres_ext (option_l l) S'\"\n  using out.lifting_valid_base_pres_ext_axioms assms\n  by auto\n  \n\nlocale option_l_valid_pairwise_ext = \n  lifting_valid_pairwise_ext\n\nsublocale option_l_valid_pairwise_ext \\<subseteq> out : lifting_valid_pairwise_ext \"option_l_S S\"\nproof\n  fix s\n  fix x1 x2 x3 s12 s13 s23 s123 :: \"'b option\"\n  assume X1 : \"x1 \\<in> option_l_S S s\"\n  assume X2 :\"x2 \\<in> option_l_S S s\"\n  assume X3 : \"x3 \\<in> option_l_S S s\"\n  assume S12 :\"is_sup {x1, x2} s12\"\n  assume S12_in :\"s12 \\<in> option_l_S S s\"\n  assume S23 :\"is_sup {x2, x3} s23\"\n  assume S23_in :\"s23 \\<in> option_l_S S s\"\n  assume S13 :\"is_sup {x1, x3} s13\" \n  assume S13_in :\"s13 \\<in> option_l_S S s\"  \n  assume S123 :\"is_sup {x1, x2, x3} s123\"\n\n  obtain x1' where X1' : \"x1 = Some x1'\" \"x1' \\<in> S s\"\n    using X1\n    by(auto simp add: option_l_S_def)\n\n  obtain x2' where X2' : \"x2 = Some x2'\" \"x2' \\<in> S s\"\n    using X2\n    by(auto simp add: option_l_S_def)\n\n  obtain x3' where X3' : \"x3 = Some x3'\" \"x3' \\<in> S s\"\n    using X3\n    by(auto simp add: option_l_S_def)\n\n  obtain s12' where S12' : \"s12 = Some s12'\"  \"s12' \\<in> S s\"\n    using S12_in\n    by(auto simp add: option_l_S_def)\n\n  obtain s13' where S13' : \"s13 = Some s13'\" \"s13' \\<in> S s\"\n    using S13_in\n    by(auto simp add: option_l_S_def)\n\n  obtain s23' where S23' : \"s23 = Some s23'\" \"s23' \\<in> S s\"\n    using S23_in\n    by(auto simp add: option_l_S_def)\n\n  have S12'_sup : \"is_sup {x1', x2'} s12'\"\n    using is_sup_Some'[of x1' \"{x1', x2'}\" s12'] S12\n    unfolding S12' X1' X2'\n    by auto\n\n  have S13'_sup : \"is_sup {x1', x3'} s13'\"\n    using is_sup_Some'[of x1' \"{x1', x3'}\" s13'] S13\n    unfolding S13' X1' X3'\n    by auto\n\n  have S23'_sup : \"is_sup {x2', x3'} s23'\"\n    using is_sup_Some'[of x2' \"{x2', x3'}\" s23'] S23\n    unfolding S23' X2' X3'\n    by auto\n\n  obtain s123' where S123' : \"s123 = Some s123'\"\n    using is_supD1[OF S123, of x1]\n    unfolding X1'\n    by(cases s123; auto simp add: option_pleq)\n\n  have S123'_sup : \"is_sup {x1', x2', x3'} s123'\"\n    using is_sup_Some'[of x1' \"{x1', x2', x3'}\" s123'] S123\n    unfolding X1' X2' X3' S123'\n    by auto\n\n  have \"s123' \\<in> S s\"\n    using pairwise_S[OF X1'(2) X2'(2) X3'(2) S12'_sup S12'(2) S23'_sup S23'(2) S13'_sup S13'(2) S123'_sup ]\n    by auto\n\n  then show \" s123 \\<in> option_l_S S s\"\n    using S123'\n    by(auto simp add: option_l_S_def)\nqed\n\n\nlemma (in option_l_valid_pairwise_ext) ax :\n  shows \"lifting_valid_pairwise_ext (option_l_S S)\"\n  using out.lifting_valid_pairwise_ext_axioms\n  by auto\n\nlemma (in option_l_valid_pairwise_ext) ax_g :\n  assumes \"S' = option_l_S S\"\n  shows \"lifting_valid_pairwise_ext S'\"\n  using out.lifting_valid_pairwise_ext_axioms assms\n  by auto\n\nlocale option_l_ortho =\n  l_ortho\n\nsublocale option_l_ortho \\<subseteq> out : l_ortho \"option_l l1\"  \"option_l_S S1\" \"option_l l2\" \"option_l_S S2\"\nproof\n  fix s\n  show \"LBase (option_l l1) s = LBase (option_l l2) s\"\n    by(auto simp add: option_l_def)\nnext\n\n  fix b s \n  fix a1 :: 'b\n  fix a2 :: 'd\n\n  have Base: \"LBase l1 s = LBase l2 s\"\n    using eq_base by auto\n\n  show \"LUpd (option_l l1) s a1 (LUpd (option_l l2) s a2 b) =\n       LUpd (option_l l2) s a2 (LUpd (option_l l1) s a1 b)\"\n  proof(cases b)\n    case None\n\n    then show ?thesis\n      using compat[of s a1 a2 \"LBase l1 s\"] eq_base\n      by(auto simp add: option_l_def)\n  next\n    case (Some b')\n\n    then show ?thesis\n      using compat\n      by(auto simp add: option_l_def)\n  qed\nnext\n\n  fix b s a1\n  show \"LOut (option_l l2) s (LUpd (option_l l1) s a1 b) = LOut (option_l l2) s b\"\n    using eq_base put1_get2\n    by(cases b; auto simp add: option_l_def)\nnext\n  fix b s a2\n  show \"LOut (option_l l1) s (LUpd (option_l l2) s a2 b) =\n       LOut (option_l l1) s b\"\n    using eq_base put2_get1\n    by(cases b; auto simp add: option_l_def)\nnext\n  fix b s a1\n\n  assume B: \"b \\<in> option_l_S S2 s\"\n\n  then obtain b' where B' : \"b = Some b'\" \"b' \\<in> S2 s\"\n    by(auto simp add: option_l_S_def)\n\n  have \"Some (LUpd l1 s a1 b') \\<in> Some ` S2 s\"\n    using put1_S2[OF B'(2)]\n    by auto\n\n  then show \"LUpd (option_l l1) s a1 b \\<in> option_l_S S2 s\"\n    using B'\n    by(auto simp add: option_l_S_def option_l_def)\nnext\n  fix b s a2\n  assume B: \"b \\<in> option_l_S S1 s\"\n\n  then obtain b' where B' : \"b = Some b'\" \"b' \\<in> S1 s\"\n    by(auto simp add: option_l_S_def)\n\n  have \"Some (LUpd l2 s a2 b') \\<in> Some ` S1 s\"\n    using put2_S1[OF B'(2)]\n    by auto\n\n  then show \"LUpd (option_l l2) s a2 b \\<in> option_l_S S1 s\"\n    using B'\n    by(auto simp add: option_l_S_def option_l_def)\nqed\n\nlemma (in option_l_ortho) ax :\n  shows \"l_ortho (option_l l1)  (option_l_S S1) (option_l l2) (option_l_S S2)\"\n  using out.l_ortho_axioms\n  by auto\n\nlemma (in option_l_ortho) ax_g :\n  assumes H1 : \"\\<And> x . S'1 x = option_l_S S1 x\"\n  assumes H2 : \"\\<And> x . S'2 x = option_l_S S2 x\"\n  shows \"l_ortho (option_l l1) S'1 (option_l l2) S'2\"\nproof-\n  have H1' : \"S'1 = option_l_S S1\"\n    using H1 by auto\n\n  have H2' : \"S'2 = option_l_S S2\"\n    using H2 by auto\n\n  show ?thesis using ax unfolding H1' H2'\n    by auto\nqed\n\nlemma sup_singleton :\n  \"is_sup {x} x\"\n  by(auto simp add: is_least_def is_ub_def is_sup_def leq_refl)\n\nlocale option_l_ortho_base_ext = l_ortho_base_ext\n\nsublocale option_l_ortho_base_ext \\<subseteq> out : l_ortho_base_ext \"option_l l1\" \"option_l l2\"\nproof\n  fix s\n\n  show \"LBase (option_l l1) s = \\<bottom>\"\n    by(auto simp add: option_l_def option_bot)\nnext\n\n  fix s\n  show \"LBase (option_l l2) s = \\<bottom>\"\n    by(auto simp add: option_l_def option_bot)\nqed\n\nlemma (in option_l_ortho_base_ext) ax :\n  shows \"l_ortho_base_ext (option_l l1) (option_l l2)\"\n  using out.l_ortho_base_ext_axioms\n  by auto\n\n\n(* NB we are not currenly using l_ortho_pres *)\n(*\nlocale option_l_ortho_pres = option_l_ortho + l_ortho_pres + l_ortho_base\n\nsublocale option_l_ortho_pres \\<subseteq> out : l_ortho_pres \"option_l l1\" \"option_l_S S1\" \"option_l l2\" \"option_l_S S2\"\nproof\n  fix s f1 f2 s1 s2 v V\n\n  assume Sup1 : \"is_sup (LMap (option_l l1) f1 s ` V) s1\"\n  assume Sup2 : \"is_sup (LMap (option_l l2) f2 s ` V) s2\"\n  assume Vin : \"v \\<in> V\"\n  assume Vsub1 : \"V \\<subseteq> option_l_S S1 s\"\n  assume Sin1 : \"s1 \\<in> option_l_S S1 s \\<inter> option_l_S S2 s\"\n  assume Vsub2 : \"V \\<subseteq> option_l_S S2 s\"\n  assume Sin2 : \"s2 \\<in> option_l_S S1 s \\<inter> option_l_S S2 s\"\n\n  obtain V' where SV' : \"V' = { x' . Some x' \\<in> V}\"\n    by auto\n\n  have Vv' : \"V = Some ` V'\"\n    using Vsub1 SV'\n    by(auto simp add: option_l_S_def)\n\n  have V'sub1 : \"V' \\<subseteq> S1 s\"\n    using Vv' Vsub1\n    by(auto simp add: option_l_S_def)\n\n  have V'sub2 : \"V' \\<subseteq> S2 s\"\n    using Vv' Vsub2\n    by(auto simp add: option_l_S_def)\n\n  obtain v' where V' :\n    \"v' \\<in> V'\" \"v = Some v'\"\n    using Vin\n    unfolding Vv'\n    by auto\n\n  have Some_map1 : \"LMap (option_l l1) f1 s `V = Some ` LMap l1 f1 s ` V'\"\n  proof\n    show \"LMap (option_l l1) f1 s ` V \\<subseteq> Some ` LMap l1 f1 s ` V'\"\n      using Vv'\n      by(auto simp add: option_l_def)\n  next\n    show \"Some ` LMap l1 f1 s ` V' \\<subseteq> LMap (option_l l1) f1 s ` V\"\n    proof\n      fix x\n\n      assume X: \"x \\<in> Some ` LMap l1 f1 s ` V'\"\n\n      then obtain xo where Xo : \"xo \\<in> V'\" \"x = Some (LMap l1 f1 s xo)\"\n        by auto\n\n      then have X_eq : \"x = LMap (option_l l1) f1 s (Some xo)\"\n        by(auto simp add: option_l_def)\n\n      have Xo_in : \"Some xo \\<in> V\"\n        using Xo Vv' by auto\n\n      then show \"x \\<in> LMap (option_l l1) f1 s ` V\"\n        using imageI[OF Xo_in, of \"LMap (option_l l1) f1 s\"] Xo\n        by(auto simp add: option_l_def)\n    \n    qed\n  qed\n\n  have Some_map2 : \"LMap (option_l l2) f2 s `V = Some ` LMap l2 f2 s ` V'\"\n  proof\n    show \"LMap (option_l l2) f2 s ` V \\<subseteq> Some ` LMap l2 f2 s ` V'\"\n      using Vv'\n      by(auto simp add: option_l_def)\n  next\n    show \"Some ` LMap l2 f2 s ` V' \\<subseteq> LMap (option_l l2) f2 s ` V\"\n    proof\n      fix x\n\n      assume X: \"x \\<in> Some ` LMap l2 f2 s ` V'\"\n\n      then obtain xo where Xo : \"xo \\<in> V'\" \"x = Some (LMap l2 f2 s xo)\"\n        by auto\n\n      then have X_eq : \"x = LMap (option_l l2) f2 s (Some xo)\"\n        by(auto simp add: option_l_def)\n\n      have Xo_in : \"Some xo \\<in> V\"\n        using Xo Vv' by auto\n\n      then show \"x \\<in> LMap (option_l l2) f2 s ` V\"\n        using imageI[OF Xo_in, of \"LMap (option_l l2) f2 s\"] Xo\n        by(auto simp add: option_l_def)\n    qed\n  qed\n\n  have Some_map3 : \"LMap (option_l l1) f1 s ` Some ` LMap l2 f2 s ` V' = Some ` LMap l1 f1 s ` LMap l2 f2 s ` V'\"\n  proof\n    show \"LMap (option_l l1) f1 s ` Some ` LMap l2 f2 s ` V'\n      \\<subseteq> Some ` LMap l1 f1 s ` LMap l2 f2 s ` V'\"\n      using Vv'\n      by(auto simp add: option_l_def)\n  next\n    show \"Some ` LMap l1 f1 s ` LMap l2 f2 s ` V'\n      \\<subseteq> LMap (option_l l1) f1 s ` Some ` LMap l2 f2 s ` V'\"\n    proof\n      fix x\n      assume X: \"x \\<in> Some ` LMap l1 f1 s ` LMap l2 f2 s ` V'\"\n\n      then obtain xo where Xo : \"xo \\<in> V'\" \"x = Some (LMap l1 f1 s (LMap l2 f2 s xo))\"\n        by auto\n\n      then have X_eq : \"x = LMap (option_l l1) f1 s (Some (LMap l2 f2 s xo))\"\n        using Vv'\n        by(auto simp add: option_l_def)\n\n      have Xo_in : \"Some xo \\<in> V\"\n        using Xo Vv' by auto\n\n      have Xo_in' : \"Some (LMap l2 f2 s xo) \\<in> Some ` LMap l2 f2 s ` V'\"\n        using Xo\n        by auto\n\n      show \"x \\<in> LMap (option_l l1) f1 s ` Some ` LMap l2 f2 s ` V'\"\n        using imageI[OF Xo_in', of \"LMap (option_l l1) f1 s\"] X Xo\n        by(auto simp add: option_l_def)\n    qed\n  qed\n\n  show \"is_sup\n        (LMap (option_l l1) f1 s `\n         LMap (option_l l2) f2 s ` V)\n        (LMap (option_l l1) f1 s s2)\"\n  proof(cases s1)\n    case None\n    have \"LMap (option_l l1) f1 s v <[ s1\"\n      using is_supD1[OF Sup1 imageI[OF Vin]]\n      by(auto)\n\n    then have False using None\n      by(cases v; auto simp add: option_l_def option_pleq)\n\n    then show ?thesis by auto\n  next\n    case (Some s1')\n\n    show ?thesis\n    proof(cases s2)\n      case None' : None\n\n      have \"LMap (option_l l2) f2 s v <[ s2\"\n        using is_supD1[OF Sup2 imageI[OF Vin]]\n        by(auto)\n\n      then have False using None'\n        by(cases v; auto simp add: option_l_def option_pleq)\n\n      then show ?thesis by auto\n    next\n      case Some' : (Some s2')\n\n      have Sup'1 : \"is_sup (LMap l1 f1 s ` V') s1'\"\n      proof(rule is_supI)\n        fix x\n        assume X : \"x \\<in> LMap l1 f1 s ` V'\"\n\n        then obtain x' where X' : \"x' \\<in> V'\" \"LMap l1 f1 s x' = x\"\n          by auto\n\n        have \"Some x \\<in> LMap (option_l l1) f1 s ` V\"\n          unfolding Some_map1\n          using imageI[OF X, of Some]\n          by(auto simp add: option_l_def)\n\n        then show \"x <[ s1'\"\n          using is_supD1[OF Sup1, of \"Some x\"] Some\n          by(auto simp add: option_pleq)\n      next\n        fix w\n\n        assume Ub : \"is_ub (LMap l1 f1 s ` V') w\"\n        have Ub' : \"is_ub (LMap (option_l l1) f1 s ` V) (Some w)\"\n        proof(rule is_ubI)\n          fix z\n          assume Z: \"z \\<in> LMap (option_l l1) f1 s ` V\"\n\n          then have \"z \\<in> Some ` LMap l1 f1 s ` V'\"\n            unfolding Some_map1\n            by auto\n\n          then obtain z' where Z' : \"z' \\<in> LMap l1 f1 s ` V'\" \"z = Some z'\"\n            by auto\n\n          show \"z <[ Some w\"\n            using is_ubE[OF Ub Z'(1)] Z'(2)\n            by(auto simp add: option_pleq)\n        qed\n\n        show \"s1' <[ w\"\n          using is_supD2[OF Sup1 Ub'] Some\n          by(auto simp add: option_pleq)\n      qed\n\n      have Sup'2 : \"is_sup (LMap l2 f2 s ` V') s2'\"\n      proof(rule is_supI)\n        fix x\n        assume X : \"x \\<in> LMap l2 f2 s ` V'\"\n\n        then obtain x' where X' : \"x' \\<in> V'\" \"LMap l2 f2 s x' = x\"\n          by auto\n\n        have \"Some x \\<in> LMap (option_l l2) f2 s ` V\"\n          unfolding Some_map2\n          using imageI[OF X, of Some]\n          by(auto simp add: option_l_def)\n\n        then show \"x <[ s2'\"\n          using is_supD1[OF Sup2, of \"Some x\"] Some'\n          by(auto simp add: option_pleq)\n      next\n        fix w\n\n        assume Ub : \"is_ub (LMap l2 f2 s ` V') w\"\n        have Ub' : \"is_ub (LMap (option_l l2) f2 s ` V) (Some w)\"\n        proof(rule is_ubI)\n          fix z\n          assume Z: \"z \\<in> LMap (option_l l2) f2 s ` V\"\n\n          then have \"z \\<in> Some ` LMap l2 f2 s ` V'\"\n            unfolding Some_map2\n            by auto\n\n          then obtain z' where Z' : \"z' \\<in> LMap l2 f2 s ` V'\" \"z = Some z'\"\n            by auto\n\n          show \"z <[ Some w\"\n            using is_ubE[OF Ub Z'(1)] Z'(2)\n            by(auto simp add: option_pleq)\n        qed\n\n        show \"s2' <[ w\"\n          using is_supD2[OF Sup2 Ub'] Some'\n          by(auto simp add: option_pleq)\n      qed\n\n      have Sin1' : \"s1' \\<in> S1 s \\<inter> S2 s\"\n        using Sin1 Some\n        by(auto simp add: option_l_S_def)\n\n      have Sin2' : \"s2' \\<in> S1 s \\<inter> S2 s\"\n        using Sin2 Some'\n        by(auto simp add: option_l_S_def)\n\n      have Conc' : \"is_sup (LMap l1 f1 s ` LMap l2 f2 s ` V') (LMap l1 f1 s s2')\"\n        using compat_pres1[OF V'(1) V'sub1 V'sub2 Sup'1 Sin1' Sup'2 Sin2']\n        by auto\n\n      show \"is_sup\n          (LMap (option_l l1) f1 s ` LMap (option_l l2) f2 s ` V)\n          (LMap (option_l l1) f1 s s2)\"\n      proof(rule is_supI)\n        fix z\n\n        assume Z: \"z \\<in> LMap (option_l l1) f1 s `\n             LMap (option_l l2) f2 s ` V \"\n\n        then have Z1 : \"z \\<in> LMap (option_l l1) f1 s `\n             (Some ` LMap l2 f2 s ` V')\"\n          using Some_map2\n          by auto\n\n        then obtain z' where Z2 : \"z = Some z'\" \"z' \\<in> LMap l1 f1 s ` LMap l2 f2 s ` V'\"\n          unfolding Some_map3\n          by auto\n\n        show \"z <[ LMap (option_l l1) f1 s s2\"\n          using is_supD1[OF Conc' Z2(2)] Some' Z2(1)\n          by(auto simp add: option_l_def option_pleq)\n      next\n\n        fix w\n\n        assume Ub : \"is_ub\n           (LMap (option_l l1) f1 s ` LMap (option_l l2) f2 s ` V)\n           w\"\n\n        then have Ub1 : \"is_ub (LMap (option_l l1) f1 s `\n             (Some ` LMap l2 f2 s ` V')) w\"\n          using Some_map2\n          by auto\n\n        show \"LMap (option_l l1) f1 s s2 <[ w\"\n        proof(cases w)\n          case None'' : None\n\n          have In' : \"LMap (option_l l1) f1 s (Some (LMap l2 f2 s v')) \\<in> LMap (option_l l1) f1 s ` Some ` LMap l2 f2 s ` V' \"\n            using imageI[OF V'(1), of \"LMap (option_l l1) f1 s o Some o LMap l2 f2 s\"]\n            by auto\n\n          have False using is_ubE[OF Ub1 In'] None''\n            by(auto simp add: option_l_def option_pleq)\n\n          then show ?thesis by auto\n        next\n          case Some'' : (Some w')\n          have Ub2 : \"is_ub (LMap l1 f1 s ` LMap l2 f2 s ` V') w'\"\n          proof(rule is_ubI)\n            fix k\n\n            assume K: \"k \\<in> LMap l1 f1 s ` LMap l2 f2 s ` V'\"\n\n            then have K' : \"Some k \\<in> Some ` LMap l1 f1 s ` LMap l2 f2 s ` V'\"\n              by auto\n\n            show \"k <[ w'\"\n              using is_ubE[OF Ub1, of \"Some k\"] Some'' K'\n              unfolding Some_map3\n              by(auto simp add: option_pleq)\n          qed\n          \n          show ?thesis \n            using is_supD2[OF Conc' Ub2] Some'' Some'\n            by(auto simp add: option_l_def option_pleq)\n        qed\n      qed\n    qed\n  qed\n*)\n\n\nlocale option_l_ortho_ok_ext =\n  option_l_ortho + l_ortho_ok_ext\n\nsublocale option_l_ortho_ok_ext \\<subseteq> out : l_ortho_ok_ext \"option_l l1\" \"option_l l2\" .\n\nlocale option_l_valid_oc_ext =\n  lifting_valid_oc_ext\n\nsublocale option_l_valid_oc_ext \\<subseteq> out : lifting_valid_oc_ext \"option_l l\" \"option_l_S S\"\nproof\n  fix Xs :: \"('c :: Pord_Weak) option set\"\n  fix supr :: \"'c option\" \n  fix s :: 'a\n  fix r :: 'b\n  fix w :: \"'c option\"\n  assume W: \"w \\<in> Xs\"\n  assume Supr : \"is_sup Xs supr\"\n  assume Compat :\n    \"(\\<And>x. x \\<in> Xs \\<Longrightarrow>\n             LOut (option_l l) s x = r)\"\n\n\n\n  show \"LOut (option_l l) s supr = r\"\n  proof(cases supr)\n    case None\n\n    then have \"w = None\"\n      using is_supD1[OF Supr W]\n      by(cases w; auto simp add: option_pleq)\n\n    then have \"r = LOut l s (LBase l s)\"\n      using Compat[OF W]\n      by(auto simp add: option_l_def)\n\n    then show ?thesis using None\n      by(auto simp add: option_l_def)\n  next\n    case (Some supr')\n\n    show ?thesis\n    proof(cases \"Xs = {None}\")\n      case True\n\n      have Ub' : \"is_ub {None} None\"\n        by(auto simp add: is_ub_def leq_refl)\n\n      then have False using is_supD2[OF Supr[unfolded True] Ub'] True Some\n        by(auto simp add: option_pleq)\n\n      then show ?thesis by auto\n    next\n      case False\n\n      show ?thesis\n      proof(cases \"\\<exists> y . y \\<in> Xs \\<and> y \\<noteq> None\")\n        case Y_false : False\n\n        then have \"Xs = {}\" using False\n          by(auto)\n\n        then have False using W by auto\n\n        then show ?thesis by auto\n      next\n        case Y_true : True\n\n        then obtain y' where Y' : \"Some y' \\<in> Xs\"\n          by auto\n\n        obtain Xs' where Xs' : \"Xs' = {x . (Some x \\<in> Xs)}\"\n          by simp\n\n        then have Y'_in : \"y' \\<in> Xs'\" using Y' by auto\n\n        have Sup_some : \"is_sup (Some ` Xs') (Some supr')\"\n        proof(rule is_supI)\n          fix x\n          assume \"x \\<in> Some ` Xs'\"\n\n          then have X_orig : \"x \\<in> Xs\"\n            using Xs'\n            by auto\n\n          show \"x <[ Some supr'\"\n            using is_supD1[OF Supr X_orig] Some\n            by auto\n        next\n          fix x'\n          assume Ub: \"is_ub (Some ` Xs') x'\"\n\n          have Ub' : \"is_ub Xs x'\"\n          proof(rule is_ubI)\n            fix z\n            assume Z: \"z \\<in> Xs\"\n\n            show \"z <[ x'\"\n            proof(cases z)\n              case None' : None\n              then show \"z <[ x'\"\n                by(auto simp add: option_pleq)\n            next\n              case Some' : (Some z')\n\n              then have Z'_in1 : \"z' \\<in> Xs'\"\n                using Xs' Z\n                by(auto)\n\n              then have Z'_in2 : \"Some z' \\<in> (Some ` Xs')\"\n                by auto\n\n              then show ?thesis using is_ubE[OF Ub Z'_in2] Some'\n                by auto\n            qed\n          qed\n\n          show \"Some supr' <[ x'\"\n            using is_supD2[OF Supr Ub']\n              Some\n            by auto\n        qed\n\n        then have Sup_xs' : \"is_sup Xs' supr'\"\n          using is_sup_Some'[OF Y'_in Sup_some]\n          by auto\n\n        have Xs'_compat :\n          \"(\\<And>x. x \\<in> Xs' \\<Longrightarrow> LOut l s x = r)\"\n        proof-\n          fix k\n          assume K : \"k \\<in> Xs'\"\n\n          then have K1 : \"Some k \\<in> Xs\"\n            using Xs'\n            by auto\n\n          show \"LOut l s k = r\"\n            using Compat[OF K1]\n            by(auto simp add: option_l_def)\n        qed\n          \n        show \"LOut (option_l l) s supr = r\"\n          using output_consistent[OF Y'_in Sup_xs' Xs'_compat]\n            Some\n          by(auto simp add: option_l_def)\n      qed\n    qed\n  qed\nqed\n\nlemma (in option_l_valid_oc_ext) ax :\n  shows \"lifting_valid_oc_ext (option_l l)\"\n  using out.lifting_valid_oc_ext_axioms\n  by auto\n\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Lifter/Instances/Lift_Option.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3407050644684546}}
{"text": "theory flash92Bra  imports flash92Rev\n \n  begin\nlemma onInv92:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv92 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv92 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv92 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash92Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7577943822145998, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.340547213806014}}
{"text": "(*  Title:      ZF/Induct/Datatypes.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1994  University of Cambridge\n*)\n\nsection \\<open>Sample datatype definitions\\<close>\n\ntheory Datatypes imports ZF begin\n\nsubsection \\<open>A type with four constructors\\<close>\n\ntext \\<open>\n  It has four contructors, of arities 0--3, and two parameters \\<open>A\\<close> and \\<open>B\\<close>.\n\\<close>\n\nconsts\n  data :: \"[i, i] \\<Rightarrow> i\"\n\ndatatype \"data(A, B)\" =\n    Con0\n  | Con1 (\"a \\<in> A\")\n  | Con2 (\"a \\<in> A\", \"b \\<in> B\")\n  | Con3 (\"a \\<in> A\", \"b \\<in> B\", \"d \\<in> data(A, B)\")\n\nlemma data_unfold: \"data(A, B) = ({0} + A) + (A \\<times> B + A \\<times> B \\<times> data(A, B))\"\n  by (fast intro!: data.intros [unfolded data.con_defs]\n    elim: data.cases [unfolded data.con_defs])\n\ntext \\<open>\n  \\medskip Lemmas to justify using \\<^term>\\<open>data\\<close> in other recursive\n  type definitions.\n\\<close>\n\nlemma data_mono: \"\\<lbrakk>A \\<subseteq> C; B \\<subseteq> D\\<rbrakk> \\<Longrightarrow> data(A, B) \\<subseteq> data(C, D)\"\n    unfolding data.defs\n  apply (rule lfp_mono)\n   apply (rule data.bnd_mono)+\n  apply (rule univ_mono Un_mono basic_monos | assumption)+\n  done\n\nlemma data_univ: \"data(univ(A), univ(A)) \\<subseteq> univ(A)\"\n    unfolding data.defs data.con_defs\n  apply (rule lfp_lowerbound)\n   apply (rule_tac [2] subset_trans [OF A_subset_univ Un_upper1, THEN univ_mono])\n  apply (fast intro!: zero_in_univ Inl_in_univ Inr_in_univ Pair_in_univ)\n  done\n\nlemma data_subset_univ:\n    \"\\<lbrakk>A \\<subseteq> univ(C); B \\<subseteq> univ(C)\\<rbrakk> \\<Longrightarrow> data(A, B) \\<subseteq> univ(C)\"\n  by (rule subset_trans [OF data_mono data_univ])\n\n\nsubsection \\<open>Example of a big enumeration type\\<close>\n\ntext \\<open>\n  Can go up to at least 100 constructors, but it takes nearly 7\n  minutes \\dots\\ (back in 1994 that is).\n\\<close>\n\nconsts\n  enum :: i\n\ndatatype enum =\n    C00 | C01 | C02 | C03 | C04 | C05 | C06 | C07 | C08 | C09\n  | C10 | C11 | C12 | C13 | C14 | C15 | C16 | C17 | C18 | C19\n  | C20 | C21 | C22 | C23 | C24 | C25 | C26 | C27 | C28 | C29\n  | C30 | C31 | C32 | C33 | C34 | C35 | C36 | C37 | C38 | C39\n  | C40 | C41 | C42 | C43 | C44 | C45 | C46 | C47 | C48 | C49\n  | C50 | C51 | C52 | C53 | C54 | C55 | C56 | C57 | C58 | C59\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/ZF/Induct/Datatypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6757645879592641, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3405219456977147}}
{"text": "theory \n  TickTock_Max\nimports\n  \"TickTock.TickTock_Core\"\nbegin\n\nsection \\<open> Healthiness conditions of Tick-Tock processes whose refusals are maximal. \\<close>\n\ntext \\<open> TTM1 requires that every event e that is not refused can be performed. \\<close>\n\ndefinition TTM1 :: \"'e ttobs list set \\<Rightarrow> bool\" where\n  \"TTM1 P = (\\<forall> \\<rho> X e. (\\<rho> @ [[X]\\<^sub>R] \\<in> P \\<and> e \\<notin> X \\<and> e \\<noteq> Tock) \\<longrightarrow> \\<rho> @ [[e]\\<^sub>E] \\<in> P)\"\n\nlemma TTM1_union_empty_trace:\n  \"TTM1(P \\<union> {[]}) = TTM1(P)\"\n  unfolding TTM1_def by auto\n\ndefinition mkTTM1 :: \"'e ttobs list set \\<Rightarrow> 'e ttobs list set\" where\n\"mkTTM1 P = P \\<union> {\\<rho> @ [[e]\\<^sub>E]|\\<rho> X e. \\<rho> @ [[X]\\<^sub>R] \\<in> P \\<and> e \\<notin> X \\<and> e \\<noteq> Tock}\"\n\nlemma TTM1_mkTTM1 [simp]: \"TTM1 (mkTTM1 P)\"\n  unfolding mkTTM1_def TTM1_def by auto\n\nlemma TT1w_mkTTM1:\n  assumes \"TT1w P\"\n  shows \"TT1w (mkTTM1 P)\"\n  using assms unfolding mkTTM1_def TT1w_def apply auto\n  by (meson tt_prefix_concat tt_prefix_notfront_is_whole)\n\ntext \\<open> TTM2 is similar to TTM1, but requires Tock to happen after the refusal. \\<close>\n\ndefinition TTM2 :: \"'e ttobs list set \\<Rightarrow> bool\" where\n  \"TTM2 P = (\\<forall> \\<rho> X e. (\\<rho> @ [[X]\\<^sub>R] \\<in> P \\<and> e \\<notin> X \\<and> e = Tock) \\<longrightarrow> \\<rho> @ [[X]\\<^sub>R,[e]\\<^sub>E] \\<in> P)\"\n\nlemma TTM2_union_empty_trace:\n  \"TTM2(P \\<union> {[]}) = TTM2(P)\"\n  unfolding TTM2_def by auto\n\ndefinition mkTTM2 :: \"'e ttobs list set \\<Rightarrow> 'e ttobs list set\" where\n\"mkTTM2 P = P \\<union> {\\<rho> @ [[X]\\<^sub>R,[Tock]\\<^sub>E]|\\<rho> X. \\<rho> @ [[X]\\<^sub>R] \\<in> P \\<and> Tock \\<notin> X}\"\n\nlemma TTM2_mkTTM2 [simp]: \"TTM2 (mkTTM2 P)\"\n  unfolding mkTTM2_def TTM2_def by auto\n\nlemma mkTTM2_mkTTM1_commute: \"mkTTM2 (mkTTM1 P) = mkTTM1 (mkTTM2 P)\"\n  unfolding mkTTM2_def mkTTM1_def by auto\n\nlemma mkTTM2_dist_union:\n  \"mkTTM2(P \\<union> Q) = (mkTTM2(P) \\<union> mkTTM2(Q))\"\n  unfolding mkTTM2_def by auto\n\nlemma mkTTM2_in_mkTT1w_for_TT1w:\n  assumes \"TT1w P\"\n  shows \"mkTTM2({\\<rho>|\\<rho> \\<sigma>. \\<rho> \\<le>\\<^sub>C \\<sigma> \\<and> \\<sigma> \\<in> P}) = ({\\<rho>|\\<rho> \\<sigma>. \\<rho> \\<le>\\<^sub>C \\<sigma> \\<and> \\<sigma> \\<in> mkTTM2(P)})\"\n  unfolding mkTTM2_def apply auto\n  apply (rule_tac x=\"\\<rho> @ [[X]\\<^sub>R, [Tock]\\<^sub>E]\" in exI, auto)\n  apply (simp add: tt_prefix_refl)\n  using TT1w_def assms apply blast\n  by (smt TT1w_prefix_concat_in Nil_is_append_conv append_Cons append_Nil2 append_eq_append_conv2 append_self_conv2 assms ttWF.simps(1) tt_prefix_append_split tt_prefix_notfront_is_whole tt_prefix_refl tt_prefix_same_front same_append_eq split_tocks)\n\nlemma mkTTM2_mkTT1w_commute:\n  assumes \"TT1w P\"\n  shows \"mkTTM2(mkTT1w(P)) = mkTT1w(mkTTM2(P))\"\nproof -\n  have \"mkTTM2(mkTT1w(P)) = mkTTM2(P \\<union> {\\<rho>|\\<rho> \\<sigma>. \\<rho> \\<le>\\<^sub>C \\<sigma> \\<and> \\<sigma> \\<in> P})\"\n    unfolding mkTT1w_def by auto\n  also have \"... = mkTTM2(P) \\<union> mkTTM2({\\<rho>|\\<rho> \\<sigma>. \\<rho> \\<le>\\<^sub>C \\<sigma> \\<and> \\<sigma> \\<in> P})\"\n    using mkTTM2_dist_union by auto\n  also have \"... = mkTTM2(P) \\<union> {\\<rho>|\\<rho> \\<sigma>. \\<rho> \\<le>\\<^sub>C \\<sigma> \\<and> \\<sigma> \\<in> mkTTM2(P)}\"\n    using assms mkTTM2_in_mkTT1w_for_TT1w by blast\n  also have \"... = mkTT1w(mkTTM2(P))\"\n    unfolding mkTT1w_def by auto\n  finally show ?thesis .\nqed\n\nlemma TT1w_mkTTM2:\n  assumes \"TT1w P\"\n  shows \"TT1w (mkTTM2 P)\"\nproof -\n  have \"TT1w P = (P = mkTT1w(P))\"\n    using TT1w_fixpoint_mkTT1w by blast\n  then have \"TT1w (mkTTM2 P) = TT1w (mkTTM2(mkTT1w(P)))\"\n    using assms by auto\n  also have \"... = TT1w(mkTT1w(mkTTM2(P)))\"\n    using assms by (simp add: mkTTM2_mkTT1w_commute)\n  also have \"... = True\"\n    by (metis TT1w_fixpoint_mkTT1w assms mkTTM2_mkTT1w_commute)\n  then show ?thesis using calculation by auto\nqed\n\nlemma TT1w_mkTTM1_mkTTM2_mkTT1w:\n  \"TT1w (mkTTM1 (mkTTM2 (mkTT1w P)))\"\nproof -\n  have \"TT1w (mkTTM2 (mkTT1w P))\"\n    using TT1w_mkTTM2 TT1w_mkTT1w by blast\n  then have \"TT1w (mkTTM1 (mkTTM2 (mkTT1w P)))\"\n    using TT1w_mkTTM1 by blast\n  then show ?thesis .\nqed\n\nfun TTickTrace :: \"('a ttobs) list \\<Rightarrow> bool\" where\n\"TTickTrace [] = True\" |\n\"TTickTrace ([e]\\<^sub>E # xs) = TTickTrace xs\" |\n\"TTickTrace ([r]\\<^sub>R # xs) = (Tick \\<in> r \\<and> TTickTrace xs)\"\n\nlemma TTickTrace_eq_add_Tick_refusal_trace_fixpoint:\n  \"TTickTrace t \\<longleftrightarrow> add_Tick_refusal_trace t = t\"\n  by (induct t rule:add_Tick_refusal_trace.induct, auto)\n\nlemma TTickTrace_dist_concat:\n  \"TTickTrace (xs @ ys) = (TTickTrace xs \\<and> TTickTrace ys)\"\n  by (induct xs rule:TTickTrace.induct, auto)\n\nlemma TTickTrace_prefix:\n  assumes \"TTickTrace s\" \"t \\<le>\\<^sub>C s\" \n  shows \"TTickTrace t\"\n  using assms apply (induct t s rule:tt_prefix.induct, auto)\n  by (case_tac y, auto)\n\ntext \\<open> TTM3 requires that every refusal in every trace contains Tick. \\<close>\n\ndefinition TTM3 :: \"('a ttobs) list set \\<Rightarrow> bool\" where\n\"TTM3 P = (\\<forall>t. t \\<in> P \\<longrightarrow> TTickTrace t)\"\n\nlemma TTM3_dist_union:\n  \"TTM3 (P \\<union> Q) = (TTM3(P) \\<and> TTM3(Q))\"\n  unfolding TTM3_def by auto\n\nlemma TTM3_dist_empty_trace: \"TTM3(P \\<union> {[]}) = TTM3(P)\"\n  unfolding TTM3_def by auto\n\nlemma TTM3_singleton_imp_prefixes:\n  assumes \"TTM3 {s}\"\n  shows \"TTM3 {x. x \\<le>\\<^sub>C s}\"\n  using assms unfolding TTM3_def apply auto\n  using TTickTrace_prefix by blast\n\nlemma TTM3_singleton_mkTTM1:\n  assumes \"TTM3 {s}\"\n  shows \"TTM3(mkTTM1 {x. x \\<le>\\<^sub>C s})\"\n  using assms unfolding mkTTM1_def TTM3_def apply auto\n  using TTickTrace_prefix apply blast\n  by (metis TTickTrace.simps(1) TTickTrace.simps(2) TTickTrace_dist_concat TTickTrace_prefix)\n\nlemma TTM3_singleton_mkTTM2:\n  assumes \"TTM3 {s}\"\n  shows \"TTM3(mkTTM2 {x. x \\<le>\\<^sub>C s})\"\n  using assms unfolding mkTTM2_def TTM3_def apply auto\n  using TTickTrace_prefix apply blast\n  by (metis TTickTrace.simps(2) TTickTrace.simps(3) TTickTrace_dist_concat TTickTrace_prefix)\n\nlemma TTM3_imp_TTM3_mkTTM1_mkTTM2:\n  assumes \"TTM3 {s}\"\n  shows \"TTM3 (mkTTM1 (mkTTM2 {x. x \\<le>\\<^sub>C s}))\"\n  using assms unfolding mkTTM1_def mkTTM2_def TTM3_def apply auto\n  using TTickTrace_prefix apply blast\n  apply (metis TTickTrace.simps(2) TTickTrace.simps(3) TTickTrace_dist_concat TTickTrace_prefix)\n  by (metis TTickTrace.simps(1) TTickTrace.simps(2) TTickTrace_dist_concat TTickTrace_prefix)\n\nlemma TTM3_imp_TTM3_mkTTM1_mkTTM2_mkTT1w:\n  assumes \"TTM3 {s}\"\n  shows \"TTM3 (mkTTM1 (mkTTM2 (mkTT1w{s})))\"\n  using assms unfolding mkTTM1_def mkTTM2_def mkTT1w_def TTM3_def apply auto\n  using TTickTrace_prefix apply blast\n     apply (metis TTickTrace.simps(2) TTickTrace.simps(3) TTickTrace_dist_concat)\n  apply (metis TTickTrace.simps(2) TTickTrace.simps(3) TTickTrace_dist_concat TTickTrace_prefix)\n  apply (metis TTickTrace.simps(1) TTickTrace.simps(2) TTickTrace_dist_concat)\n  by (metis TTickTrace.simps(2) TTickTrace.simps(3) TTickTrace_dist_concat TTickTrace_prefix)\n  \n\ntext \\<open> A useful weaker variant is defined by TTick, that considers a\n       single refusal at the end of a trace to contain Tick. This is\n       useful in some proofs. \\<close>\n\ndefinition TTick :: \"('a ttobs) list set \\<Rightarrow> bool\" where\n\"TTick P = (\\<forall>t X. t @ [[X]\\<^sub>R] \\<in> P \\<longrightarrow> Tick \\<in> X)\"\n\nlemma TTick_dist_union:\n  \"TTick (P \\<union> Q) = (TTick(P) \\<and> TTick(Q))\"\n  unfolding TTick_def by auto\n\nlemma TTM3_TTick_part:\n  assumes \"TTM3 P\" \"t @ [[X]\\<^sub>R] \\<in> P\"\n  shows \"Tick \\<in> X\"\n  using assms apply (induct t rule:rev_induct, auto) \n  using TTM3_def TTickTrace.simps(3) apply blast\n  by (meson TTM3_def TTickTrace.simps(3) TTickTrace_dist_concat)\n\nlemma TTM3_TTick:\n  assumes \"TTM3 P\"\n  shows \"TTick P\"\n  using assms unfolding  TTick_def apply auto\n  using TTM3_TTick_part by blast\n\nlemma TTick_imp_TTick_mkTTM1_mkTTM2:\n  assumes \"TTick {s}\"\n  shows \"TTick (mkTTM1 (mkTTM2 {s}))\"\n  using assms unfolding mkTTM2_def mkTTM1_def TTick_def by auto\n\nlemma TTick_Nil [simp]:\n  \"TTick {[]}\"\n  unfolding TTick_def by auto\n\nlemma TTick_dist_empty_trace: \"TTick(P \\<union> {[]}) = TTick(P)\"\n  unfolding TTick_def by auto\n\nlemma TTick_Refusal_Tock [simp]:\n  assumes \"TTick {saa}\"\n  shows \"TTick {[S]\\<^sub>R # [Tock]\\<^sub>E # saa}\"\n  using assms unfolding TTick_def apply auto                               \n  by (metis (no_types, hide_lams) append.left_neutral append1_eq_conv append_Cons ttobs.distinct(1) rev_exhaust)                            \n\nlemma TTick_Refusal_Tock':\n  assumes \"TTick {[S]\\<^sub>R # [Tock]\\<^sub>E # saa}\"\n  shows \"TTick {saa}\"\n  using assms unfolding TTick_def by auto\n\nlemma TTick_event [simp]:\n  assumes \"TTick {saa}\"\n  shows \"TTick {[e]\\<^sub>E # saa}\"\n  using assms unfolding TTick_def apply auto  \n  by (metis Cons_eq_append_conv ttobs.distinct(1) list.inject)\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/TickTock-FL/TickTock_Max.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.34050163185622123}}
{"text": "(*  Title:      HOL/Auth/Event.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n\nDatatype of events; function \"spies\"; freshness\n\n\"bad\" agents have been broken by the Spy; their private keys and internal\n    stores are visible to him\n*)\n\nsection\\<open>Theory of Events for Security Protocols\\<close>\n\ntheory Event imports Message begin\n\nconsts  (*Initial states of agents -- parameter of the construction*)\n  initState :: \"agent => msg set\"\n\ndatatype\n  event = Says  agent agent msg\n        | Gets  agent       msg\n        | Notes agent       msg\n       \nconsts \n  bad    :: \"agent set\"                         \\<comment> \\<open>compromised agents\\<close>\n\ntext\\<open>Spy has access to his own key for spoof messages, but Server is secure\\<close>\nspecification (bad)\n  Spy_in_bad     [iff]: \"Spy \\<in> bad\"\n  Server_not_bad [iff]: \"Server \\<notin> bad\"\n    by (rule exI [of _ \"{Spy}\"], simp)\n\nprimrec knows :: \"agent => event list => msg set\"\nwhere\n  knows_Nil:   \"knows A [] = initState A\"\n| knows_Cons:\n    \"knows A (ev # evs) =\n       (if A = Spy then \n        (case ev of\n           Says A' B X => insert X (knows Spy evs)\n         | Gets A' X => knows Spy evs\n         | Notes A' X  => \n             if A' \\<in> bad then insert X (knows Spy evs) else knows Spy evs)\n        else\n        (case ev of\n           Says A' B X => \n             if A'=A then insert X (knows A evs) else knows A evs\n         | Gets A' X    => \n             if A'=A then insert X (knows A evs) else knows A evs\n         | Notes A' X    => \n             if A'=A then insert X (knows A evs) else knows A evs))\"\n(*\n  Case A=Spy on the Gets event\n  enforces the fact that if a message is received then it must have been sent,\n  therefore the oops case must use Notes\n*)\n\ntext\\<open>The constant \"spies\" is retained for compatibility's sake\\<close>\n\nabbreviation (input)\n  spies  :: \"event list => msg set\" where\n  \"spies == knows Spy\"\n\n\n(*Set of items that might be visible to somebody:\n    complement of the set of fresh items*)\n\nprimrec used :: \"event list => msg set\"\nwhere\n  used_Nil:   \"used []         = (UN B. parts (initState B))\"\n| used_Cons:  \"used (ev # evs) =\n                     (case ev of\n                        Says A B X => parts {X} \\<union> used evs\n                      | Gets A X   => used evs\n                      | Notes A X  => parts {X} \\<union> used evs)\"\n    \\<comment>\\<open>The case for @{term Gets} seems anomalous, but @{term Gets} always\n        follows @{term Says} in real protocols.  Seems difficult to change.\n        See \\<open>Gets_correct\\<close> in theory \\<open>Guard/Extensions.thy\\<close>.\\<close>\n\nlemma Notes_imp_used [rule_format]: \"Notes A X \\<in> set evs --> X \\<in> used evs\"\napply (induct_tac evs)\napply (auto split: event.split) \ndone\n\nlemma Says_imp_used [rule_format]: \"Says A B X \\<in> set evs --> X \\<in> used evs\"\napply (induct_tac evs)\napply (auto split: event.split) \ndone\n\n\nsubsection\\<open>Function @{term knows}\\<close>\n\n(*Simplifying   \n parts(insert X (knows Spy evs)) = parts{X} \\<union> parts(knows Spy evs).\n  This version won't loop with the simplifier.*)\nlemmas parts_insert_knows_A = parts_insert [of _ \"knows A evs\"] for A evs\n\n\n\ntext\\<open>Letting the Spy see \"bad\" agents' notes avoids redundant case-splits\n      on whether @{term \"A=Spy\"} and whether @{term \"A\\<in>bad\"}\\<close>\nlemma knows_Spy_Notes [simp]:\n     \"knows Spy (Notes A X # evs) =  \n          (if A:bad then insert X (knows Spy evs) else knows Spy evs)\"\nby simp\n\nlemma knows_Spy_Gets [simp]: \"knows Spy (Gets A X # evs) = knows Spy evs\"\nby simp\n\nlemma knows_Spy_subset_knows_Spy_Says:\n     \"knows Spy evs \\<subseteq> knows Spy (Says A B X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_Spy_subset_knows_Spy_Notes:\n     \"knows Spy evs \\<subseteq> knows Spy (Notes A X # evs)\"\nby force\n\nlemma knows_Spy_subset_knows_Spy_Gets:\n     \"knows Spy evs \\<subseteq> knows Spy (Gets A X # evs)\"\nby (simp add: subset_insertI)\n\ntext\\<open>Spy sees what is sent on the traffic\\<close>\nlemma Says_imp_knows_Spy [rule_format]:\n     \"Says A B X \\<in> set evs --> X \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\nlemma Notes_imp_knows_Spy [rule_format]:\n     \"Notes A X \\<in> set evs --> A: bad --> X \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\n\ntext\\<open>Elimination rules: derive contradictions from old Says events containing\n  items known to be fresh\\<close>\nlemmas Says_imp_parts_knows_Spy = \n       Says_imp_knows_Spy [THEN parts.Inj, elim_format] \n\nlemmas knows_Spy_partsEs =\n     Says_imp_parts_knows_Spy parts.Body [elim_format]\n\nlemmas Says_imp_analz_Spy = Says_imp_knows_Spy [THEN analz.Inj]\n\ntext\\<open>Compatibility for the old \"spies\" function\\<close>\nlemmas spies_partsEs = knows_Spy_partsEs\nlemmas Says_imp_spies = Says_imp_knows_Spy\nlemmas parts_insert_spies = parts_insert_knows_A [of _ Spy]\n\n\nsubsection\\<open>Knowledge of Agents\\<close>\n\nlemma knows_subset_knows_Says: \"knows A evs \\<subseteq> knows A (Says A' B X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_subset_knows_Notes: \"knows A evs \\<subseteq> knows A (Notes A' X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_subset_knows_Gets: \"knows A evs \\<subseteq> knows A (Gets A' X # evs)\"\nby (simp add: subset_insertI)\n\ntext\\<open>Agents know what they say\\<close>\nlemma Says_imp_knows [rule_format]: \"Says A B X \\<in> set evs --> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext\\<open>Agents know what they note\\<close>\nlemma Notes_imp_knows [rule_format]: \"Notes A X \\<in> set evs --> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext\\<open>Agents know what they receive\\<close>\nlemma Gets_imp_knows_agents [rule_format]:\n     \"A \\<noteq> Spy --> Gets A X \\<in> set evs --> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\n\ntext\\<open>What agents DIFFERENT FROM Spy know \n  was either said, or noted, or got, or known initially\\<close>\nlemma knows_imp_Says_Gets_Notes_initState [rule_format]:\n     \"[| X \\<in> knows A evs; A \\<noteq> Spy |] ==> EX B.  \n  Says A B X \\<in> set evs | Gets A X \\<in> set evs | Notes A X \\<in> set evs | X \\<in> initState A\"\napply (erule rev_mp)\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext\\<open>What the Spy knows -- for the time being --\n  was either said or noted, or known initially\\<close>\nlemma knows_Spy_imp_Says_Notes_initState [rule_format]:\n     \"[| X \\<in> knows Spy evs |] ==> EX A B.  \n  Says A B X \\<in> set evs | Notes A X \\<in> set evs | X \\<in> initState Spy\"\napply (erule rev_mp)\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\nlemma parts_knows_Spy_subset_used: \"parts (knows Spy evs) \\<subseteq> used evs\"\napply (induct_tac \"evs\", force)  \napply (simp add: parts_insert_knows_A knows_Cons add: event.split, blast) \ndone\n\nlemmas usedI = parts_knows_Spy_subset_used [THEN subsetD, intro]\n\nlemma initState_into_used: \"X \\<in> parts (initState B) ==> X \\<in> used evs\"\napply (induct_tac \"evs\")\napply (simp_all add: parts_insert_knows_A split: event.split, blast)\ndone\n\nlemma used_Says [simp]: \"used (Says A B X # evs) = parts{X} \\<union> used evs\"\nby simp\n\nlemma used_Notes [simp]: \"used (Notes A X # evs) = parts{X} \\<union> used evs\"\nby simp\n\nlemma used_Gets [simp]: \"used (Gets A X # evs) = used evs\"\nby simp\n\nlemma used_nil_subset: \"used [] \\<subseteq> used evs\"\napply simp\napply (blast intro: initState_into_used)\ndone\n\ntext\\<open>NOTE REMOVAL--laws above are cleaner, as they don't involve \"case\"\\<close>\ndeclare knows_Cons [simp del]\n        used_Nil [simp del] used_Cons [simp del]\n\n\ntext\\<open>For proving theorems of the form @{term \"X \\<notin> analz (knows Spy evs) --> P\"}\n  New events added by induction to \"evs\" are discarded.  Provided \n  this information isn't needed, the proof will be much shorter, since\n  it will omit complicated reasoning about @{term analz}.\\<close>\n\nlemmas analz_mono_contra =\n       knows_Spy_subset_knows_Spy_Says [THEN analz_mono, THEN contra_subsetD]\n       knows_Spy_subset_knows_Spy_Notes [THEN analz_mono, THEN contra_subsetD]\n       knows_Spy_subset_knows_Spy_Gets [THEN analz_mono, THEN contra_subsetD]\n\n\nlemma knows_subset_knows_Cons: \"knows A evs \\<subseteq> knows A (e # evs)\"\nby (cases e, auto simp: knows_Cons)\n\nlemma initState_subset_knows: \"initState A \\<subseteq> knows A evs\"\napply (induct_tac evs, simp) \napply (blast intro: knows_subset_knows_Cons [THEN subsetD])\ndone\n\n\ntext\\<open>For proving \\<open>new_keys_not_used\\<close>\\<close>\nlemma keysFor_parts_insert:\n     \"[| K \\<in> keysFor (parts (insert X G));  X \\<in> synth (analz H) |] \n      ==> K \\<in> keysFor (parts (G \\<union> H)) | Key (invKey K) \\<in> parts H\"\nby (force \n    dest!: parts_insert_subset_Un [THEN keysFor_mono, THEN [2] rev_subsetD]\n           analz_subset_parts [THEN keysFor_mono, THEN [2] rev_subsetD]\n    intro: analz_subset_parts [THEN subsetD] parts_mono [THEN [2] rev_subsetD])\n\n\nlemmas analz_impI = impI [where P = \"Y \\<notin> analz (knows Spy evs)\"] for Y evs\n\nML\n\\<open>\nfun analz_mono_contra_tac ctxt = \n  resolve_tac ctxt @{thms analz_impI} THEN' \n  REPEAT1 o (dresolve_tac ctxt @{thms analz_mono_contra})\n  THEN' (mp_tac ctxt)\n\\<close>\n\nmethod_setup analz_mono_contra = \\<open>\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (analz_mono_contra_tac ctxt)))\\<close>\n    \"for proving theorems of the form X \\<notin> analz (knows Spy evs) --> P\"\n\nsubsubsection\\<open>Useful for case analysis on whether a hash is a spoof or not\\<close>\n\nlemmas syan_impI = impI [where P = \"Y \\<notin> synth (analz (knows Spy evs))\"] for Y evs\n\nML\n\\<open>\nfun synth_analz_mono_contra_tac ctxt = \n  resolve_tac ctxt @{thms syan_impI} THEN'\n  REPEAT1 o \n    (dresolve_tac ctxt\n     [@{thm knows_Spy_subset_knows_Spy_Says} RS @{thm synth_analz_mono} RS @{thm contra_subsetD},\n      @{thm knows_Spy_subset_knows_Spy_Notes} RS @{thm synth_analz_mono} RS @{thm contra_subsetD},\n      @{thm knows_Spy_subset_knows_Spy_Gets} RS @{thm synth_analz_mono} RS @{thm contra_subsetD}])\n  THEN'\n  mp_tac ctxt\n\\<close>\n\nmethod_setup synth_analz_mono_contra = \\<open>\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (synth_analz_mono_contra_tac ctxt)))\\<close>\n    \"for proving theorems of the form X \\<notin> synth (analz (knows Spy evs)) --> P\"\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/Event.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018545, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3403222644268806}}
{"text": "(*  Title:      Intruder_Deduction.thy\n    Author:     Andreas Viktor Hess, DTU\n    SPDX-License-Identifier: BSD-3-Clause\n*)\n\nsection \\<open>Dolev-Yao Intruder Model\\<close>\ntheory Intruder_Deduction\nimports Messages More_Unification\nbegin\n\nsubsection \\<open>Syntax for the Intruder Deduction Relations\\<close>\nconsts INTRUDER_SYNTH::\"('f,'v) terms \\<Rightarrow> ('f,'v) term \\<Rightarrow> bool\" (infix \"\\<turnstile>\\<^sub>c\" 50)\nconsts INTRUDER_DEDUCT::\"('f,'v) terms \\<Rightarrow> ('f,'v) term \\<Rightarrow> bool\" (infix \"\\<turnstile>\" 50)\n\n\nsubsection \\<open>Intruder Model Locale\\<close>\ntext \\<open>\n  The intruder model is parameterized over arbitrary function symbols (e.g, cryptographic operators)\n  and variables. It requires three functions:\n  - \\<open>arity\\<close> that assigns an arity to each function symbol.\n  - \\<open>public\\<close> that partitions the function symbols into those that will be available to the intruder\n    and those that will not.\n  - \\<open>Ana\\<close>, the analysis interface, that defines how messages can be decomposed (e.g., decryption).\n\\<close>\nlocale intruder_model =\n  fixes arity :: \"'fun \\<Rightarrow> nat\"\n    and public :: \"'fun \\<Rightarrow> bool\"\n    and Ana :: \"('fun,'var) term \\<Rightarrow> (('fun,'var) term list \\<times> ('fun,'var) term list)\"\n  assumes Ana_keys_fv: \"\\<And>t K R. Ana t = (K,R) \\<Longrightarrow> fv\\<^sub>s\\<^sub>e\\<^sub>t (set K) \\<subseteq> fv t\"\n    and Ana_keys_wf: \"\\<And>t k K R f T.\n      Ana t = (K,R) \\<Longrightarrow> (\\<And>g S. Fun g S \\<sqsubseteq> t \\<Longrightarrow> length S = arity g)\n                    \\<Longrightarrow> k \\<in> set K \\<Longrightarrow> Fun f T \\<sqsubseteq> k \\<Longrightarrow> length T = arity f\"\n    and Ana_var[simp]: \"\\<And>x. Ana (Var x) = ([],[])\"\n    and Ana_fun_subterm: \"\\<And>f T K R. Ana (Fun f T) = (K,R) \\<Longrightarrow> set R \\<subseteq> set T\"\n    and Ana_subst: \"\\<And>t \\<delta> K R. \\<lbrakk>Ana t = (K,R); K \\<noteq> [] \\<or> R \\<noteq> []\\<rbrakk> \\<Longrightarrow> Ana (t \\<cdot> \\<delta>) = (K \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<delta>,R \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<delta>)\"\nbegin\n\nlemma Ana_subterm: assumes \"Ana t = (K,T)\" shows \"set T \\<subset> subterms t\"\nusing assms\nby (cases t)\n   (simp add: psubsetI,\n    metis Ana_fun_subterm Fun_gt_params UN_I term.order_refl\n          params_subterms psubsetI subset_antisym subset_trans)\n\nlemma Ana_subterm': \"s \\<in> set (snd (Ana t)) \\<Longrightarrow> s \\<sqsubseteq> t\"\nusing Ana_subterm by (cases \"Ana t\") auto\n\nlemma Ana_vars: assumes \"Ana t = (K,M)\" shows \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set K) \\<subseteq> fv t\" \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set M) \\<subseteq> fv t\"\nby (rule Ana_keys_fv[OF assms]) (use Ana_subterm[OF assms] subtermeq_vars_subset in auto)\n\nabbreviation \\<V> where \"\\<V> \\<equiv> UNIV::'var set\"\nabbreviation \\<Sigma>n (\"\\<Sigma>\\<^sup>_\") where \"\\<Sigma>\\<^sup>n \\<equiv> {f::'fun. arity f = n}\"\nabbreviation \\<Sigma>npub (\"\\<Sigma>\\<^sub>p\\<^sub>u\\<^sub>b\\<^sup>_\") where \"\\<Sigma>\\<^sub>p\\<^sub>u\\<^sub>b\\<^sup>n \\<equiv> {f. public f} \\<inter> \\<Sigma>\\<^sup>n\"\nabbreviation \\<Sigma>npriv (\"\\<Sigma>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v\\<^sup>_\") where \"\\<Sigma>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v\\<^sup>n \\<equiv> {f. \\<not>public f} \\<inter> \\<Sigma>\\<^sup>n\"\nabbreviation \\<Sigma>\\<^sub>p\\<^sub>u\\<^sub>b where \"\\<Sigma>\\<^sub>p\\<^sub>u\\<^sub>b \\<equiv> (\\<Union>n. \\<Sigma>\\<^sub>p\\<^sub>u\\<^sub>b\\<^sup>n)\"\nabbreviation \\<Sigma>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v where \"\\<Sigma>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v \\<equiv> (\\<Union>n. \\<Sigma>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v\\<^sup>n)\"\nabbreviation \\<Sigma> where \"\\<Sigma> \\<equiv> (\\<Union>n. \\<Sigma>\\<^sup>n)\"\nabbreviation \\<C> where \"\\<C> \\<equiv> \\<Sigma>\\<^sup>0\"\nabbreviation \\<C>\\<^sub>p\\<^sub>u\\<^sub>b where \"\\<C>\\<^sub>p\\<^sub>u\\<^sub>b \\<equiv> {f. public f} \\<inter> \\<C>\"\nabbreviation \\<C>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v where \"\\<C>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v \\<equiv> {f. \\<not>public f} \\<inter> \\<C>\"\nabbreviation \\<Sigma>\\<^sub>f where \"\\<Sigma>\\<^sub>f \\<equiv> \\<Sigma> - \\<C>\"\nabbreviation \\<Sigma>\\<^sub>f\\<^sub>p\\<^sub>u\\<^sub>b where \"\\<Sigma>\\<^sub>f\\<^sub>p\\<^sub>u\\<^sub>b \\<equiv> \\<Sigma>\\<^sub>f \\<inter> \\<Sigma>\\<^sub>p\\<^sub>u\\<^sub>b\"\nabbreviation \\<Sigma>\\<^sub>f\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v where \"\\<Sigma>\\<^sub>f\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v \\<equiv> \\<Sigma>\\<^sub>f \\<inter> \\<Sigma>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v\"\n\nlemma disjoint_fun_syms: \"\\<Sigma>\\<^sub>f \\<inter> \\<C> = {}\" by auto\nlemma id_union_univ: \"\\<Sigma>\\<^sub>f \\<union> \\<C> = UNIV\" \"\\<Sigma> = UNIV\" by auto\nlemma const_arity_eq_zero[dest]: \"c \\<in> \\<C> \\<Longrightarrow> arity c = 0\" by simp\nlemma const_pub_arity_eq_zero[dest]: \"c \\<in> \\<C>\\<^sub>p\\<^sub>u\\<^sub>b \\<Longrightarrow> arity c = 0 \\<and> public c\" by simp\nlemma const_priv_arity_eq_zero[dest]: \"c \\<in> \\<C>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v \\<Longrightarrow> arity c = 0 \\<and> \\<not>public c\" by simp\nlemma fun_arity_gt_zero[dest]: \"f \\<in> \\<Sigma>\\<^sub>f \\<Longrightarrow> arity f > 0\" by fastforce\nlemma pub_fun_public[dest]: \"f \\<in> \\<Sigma>\\<^sub>f\\<^sub>p\\<^sub>u\\<^sub>b \\<Longrightarrow> public f\" by fastforce\nlemma pub_fun_arity_gt_zero[dest]: \"f \\<in> \\<Sigma>\\<^sub>f\\<^sub>p\\<^sub>u\\<^sub>b \\<Longrightarrow> arity f > 0\" by fastforce\n\nlemma \\<Sigma>\\<^sub>f_unfold: \"\\<Sigma>\\<^sub>f = {f::'fun. arity f > 0}\" by auto\nlemma \\<C>_unfold: \"\\<C> = {f::'fun. arity f = 0}\" by auto\nlemma \\<C>pub_unfold: \"\\<C>\\<^sub>p\\<^sub>u\\<^sub>b = {f::'fun. arity f = 0 \\<and> public f}\" by auto\nlemma \\<C>priv_unfold: \"\\<C>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v = {f::'fun. arity f = 0 \\<and> \\<not>public f}\" by auto\nlemma \\<Sigma>npub_unfold: \"(\\<Sigma>\\<^sub>p\\<^sub>u\\<^sub>b\\<^sup>n) = {f::'fun. arity f = n \\<and> public f}\" by auto\nlemma \\<Sigma>npriv_unfold: \"(\\<Sigma>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v\\<^sup>n) = {f::'fun. arity f = n \\<and> \\<not>public f}\" by auto\nlemma \\<Sigma>fpub_unfold: \"\\<Sigma>\\<^sub>f\\<^sub>p\\<^sub>u\\<^sub>b = {f::'fun. arity f > 0 \\<and> public f}\" by auto\nlemma \\<Sigma>fpriv_unfold: \"\\<Sigma>\\<^sub>f\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>v = {f::'fun. arity f > 0 \\<and> \\<not>public f}\" by auto\nlemma \\<Sigma>n_m_eq: \"\\<lbrakk>(\\<Sigma>\\<^sup>n) \\<noteq> {}; (\\<Sigma>\\<^sup>n) = (\\<Sigma>\\<^sup>m)\\<rbrakk> \\<Longrightarrow> n = m\" by auto\n\n\nsubsection \\<open>Term Well-formedness\\<close>\ndefinition \"wf\\<^sub>t\\<^sub>r\\<^sub>m t \\<equiv> \\<forall>f T. Fun f T \\<sqsubseteq> t \\<longrightarrow> length T = arity f\"\n\nabbreviation \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s T \\<equiv> \\<forall>t \\<in> T. wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n\nlemma Ana_keys_wf': \"Ana t = (K,T) \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m t \\<Longrightarrow> k \\<in> set K \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m k\"\nusing Ana_keys_wf unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by metis\n\nlemma wf_trm_Var[simp]: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Var x)\" unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by simp\n\nlemma wf_trm_subst_range_Var[simp]: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range Var)\" by simp\n\nlemma wf_trm_subst_range_iff: \"(\\<forall>x. wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<theta> x)) \\<longleftrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\"\nby force\n\n\n\nlemma wf_trm_subst_rangeI[intro]:\n  \"(\\<And>x. wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<delta> x)) \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\nby (metis wf_trm_subst_range_iff)\n\nlemma wf_trmI[intro]:\n  assumes \"\\<And>t. t \\<in> set T \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"length T = arity f\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\"\nusing assms unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n\nlemma wf_trm_subterm: \"\\<lbrakk>wf\\<^sub>t\\<^sub>r\\<^sub>m t; s \\<sqsubset> t\\<rbrakk> \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m s\"\nunfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by (induct t) auto\n\nlemma wf_trm_subtermeq:\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"s \\<sqsubseteq> t\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\"\nproof (cases \"s = t\")\n  case False thus \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" using assms(2) wf_trm_subterm[OF assms(1)] by simp\nqed (metis assms(1))\n\nlemma wf_trm_param:\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\" \"t \\<in> set T\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\nby (meson assms subtermeqI'' wf_trm_subtermeq)\n\nlemma wf_trm_param_idx:\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\"\n    and \"i < length T\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m (T ! i)\"\nusing wf_trm_param[OF assms(1), of \"T ! i\"] assms(2)\nby fastforce\n\n\n\n  show \"wf\\<^sub>t\\<^sub>r\\<^sub>m (t \\<cdot> \\<delta>) \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n  proof (induction t)\n    case (Fun f T)\n    hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" when \"t \\<in> set (map (\\<lambda>s. s \\<cdot> \\<delta>) T)\" for t\n      by (metis that wf\\<^sub>t\\<^sub>r\\<^sub>m_def Fun_param_is_subterm term.order_trans subst_apply_term.simps(2)) \n    hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" when \"t \\<in> set T\" for t using that Fun.IH by auto\n    moreover have \"length (map (\\<lambda>t. t \\<cdot> \\<delta>) T) = arity f\"\n      using Fun.prems unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n    ultimately show ?case by fastforce\n  qed (simp add: assms)\nqed\n\nlemma wf_trm_subst_singleton:\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t'\" shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m (t \\<cdot> Var(v := t'))\"\nproof -\n  have \"wf\\<^sub>t\\<^sub>r\\<^sub>m ((Var(v := t')) w)\" for w using assms(2) unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by simp\n  thus ?thesis using assms(1) wf_trm_subst[of \"Var(v := t')\" t, OF wf_trm_subst_rangeI] by simp\nqed\n\nlemma wf_trm_subst_rm_vars:\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m (t \\<cdot> \\<delta>)\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m (t \\<cdot> rm_vars X \\<delta>)\"\nusing assms\nproof (induction t)\n  case (Fun f T)\n  have \"wf\\<^sub>t\\<^sub>r\\<^sub>m (t \\<cdot> \\<delta>)\" when \"t \\<in> set T\" for t\n    using that wf_trm_param[of f \"map (\\<lambda>t. t \\<cdot> \\<delta>) T\"] Fun.prems\n    by auto\n  hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m (t \\<cdot> rm_vars X \\<delta>)\" when \"t \\<in> set T\" for t using that Fun.IH by simp\n  moreover have \"length T = arity f\" using Fun.prems unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\n  ultimately show ?case unfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto\nqed simp\n\nlemma wf_trm_subst_rm_vars': \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<delta> v) \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m (rm_vars X \\<delta> v)\"\nby auto\n\nlemma wf_trms_subst:\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (M \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<delta>)\"\nby (metis (no_types, lifting) assms imageE wf_trm_subst)\n\nlemma wf_trms_subst_rm_vars:\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (M \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<delta>)\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (M \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t rm_vars X \\<delta>)\"\nusing assms wf_trm_subst_rm_vars by blast\n\nlemma wf_trms_subst_rm_vars':\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (rm_vars X \\<delta>))\"\nusing assms by force  \n\nlemma wf_trms_subst_compose:\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\<theta> \\<circ>\\<^sub>s \\<delta>))\"\nusing assms subst_img_comp_subset' wf_trm_subst by blast \n\nlemma wf_trm_subst_compose:\n  fixes \\<delta>::\"('fun, 'v) subst\"\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<theta> x)\" \"\\<And>x. wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<delta> x)\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m ((\\<theta> \\<circ>\\<^sub>s \\<delta>) x)\"\nusing wf_trm_subst[of \\<delta> \"\\<theta> x\", OF wf_trm_subst_rangeI[OF assms(2)]] assms(1)\n      subst_subst_compose[of \"Var x\" \\<theta> \\<delta>]\n      subst_apply_term.simps(1)[of x \\<theta>]\n      subst_apply_term.simps(1)[of x \"\\<theta> \\<circ>\\<^sub>s \\<delta>\"]\nby argo\n\nlemma wf_trms_Var_range:\n  assumes \"subst_range \\<delta> \\<subseteq> range Var\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\nusing assms by fastforce\n\nlemma wf_trms_subst_compose_Var_range:\n  assumes \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<theta>)\"\n    and \"subst_range \\<delta> \\<subseteq> range Var\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\<delta> \\<circ>\\<^sub>s \\<theta>))\"\n    and \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range (\\<theta> \\<circ>\\<^sub>s \\<delta>))\"\nusing assms wf_trms_subst_compose wf_trms_Var_range by metis+\n\nlemma wf_trm_subst_inv: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (t \\<cdot> \\<delta>) \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\nunfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by (induct t) auto\n\nlemma wf_trms_subst_inv: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (M \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<delta>) \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M\"\nusing wf_trm_subst_inv by fast\n\nlemma wf_trm_subterms: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subterms t)\"\nusing wf_trm_subterm by blast\n\nlemma wf_trms_subterms: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subterms\\<^sub>s\\<^sub>e\\<^sub>t M)\"\nusing wf_trm_subterms by blast\n\nlemma wf_trm_arity: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T) \\<Longrightarrow> length T = arity f\"\nunfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by blast\n\nlemma wf_trm_subterm_arity: \"wf\\<^sub>t\\<^sub>r\\<^sub>m t \\<Longrightarrow> Fun f T \\<sqsubseteq> t \\<Longrightarrow> length T = arity f\"\nunfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def by blast\n\nlemma unify_list_wf_trm:\n  assumes \"Unification.unify E B = Some U\" \"\\<forall>(s,t) \\<in> set E. wf\\<^sub>t\\<^sub>r\\<^sub>m s \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n  and \"\\<forall>(v,t) \\<in> set B. wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n  shows \"\\<forall>(v,t) \\<in> set U. wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\nusing assms\nproof (induction E B arbitrary: U rule: Unification.unify.induct)\n  case (1 B U) thus ?case by auto\nnext\n  case (2 f T g S E B U)\n  have wf_fun: \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun g S)\" using \"2.prems\"(2) by auto\n  from \"2.prems\"(1) obtain E' where *: \"decompose (Fun f T) (Fun g S) = Some E'\"\n    and [simp]: \"f = g\" \"length T = length S\" \"E' = zip T S\"\n    and **: \"Unification.unify (E'@E) B = Some U\"\n    by (auto split: option.splits)\n  hence \"t \\<sqsubset> Fun f T\" \"t' \\<sqsubset> Fun g S\" when \"(t,t') \\<in> set E'\" for t t'\n    using that by (metis zip_arg_subterm(1), metis zip_arg_subterm(2))\n  hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t'\" when \"(t,t') \\<in> set E'\" for t t'\n    using wf_trm_subterm wf_fun \\<open>f = g\\<close> that by blast+\n  thus ?case using \"2.IH\"[OF * ** _ \"2.prems\"(3)] \"2.prems\"(2) by fastforce\nnext\n  case (3 v t E B)\n  hence *: \"\\<forall>(w,x) \\<in> set ((v, t) # B). wf\\<^sub>t\\<^sub>r\\<^sub>m x\"\n      and **: \"\\<forall>(s,t) \\<in> set E. wf\\<^sub>t\\<^sub>r\\<^sub>m s \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n    by auto\n\n  show ?case\n  proof (cases \"t = Var v\")\n    case True thus ?thesis using \"3.prems\" \"3.IH\"(1) by auto\n  next\n    case False\n    hence \"v \\<notin> fv t\" using \"3.prems\"(1) by auto\n    hence \"Unification.unify (subst_list (subst v t) E) ((v, t)#B) = Some U\"\n      using \\<open>t \\<noteq> Var v\\<close> \"3.prems\"(1) by auto\n    moreover have \"\\<forall>(s, t) \\<in> set (subst_list (subst v t) E). wf\\<^sub>t\\<^sub>r\\<^sub>m s \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n      using wf_trm_subst_singleton[OF _ \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m t\\<close>] \"3.prems\"(2)\n      unfolding subst_list_def subst_def by auto\n    ultimately show ?thesis using \"3.IH\"(2)[OF \\<open>t \\<noteq> Var v\\<close> \\<open>v \\<notin> fv t\\<close> _ _ *] by metis\n  qed\nnext\n  case (4 f T v E B U)\n  hence *: \"\\<forall>(w,x) \\<in> set ((v, Fun f T) # B). wf\\<^sub>t\\<^sub>r\\<^sub>m x\"\n      and **: \"\\<forall>(s,t) \\<in> set E. wf\\<^sub>t\\<^sub>r\\<^sub>m s \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\"\n    by auto\n\n  have \"v \\<notin> fv (Fun f T)\" using \"4.prems\"(1) by force\n  hence \"Unification.unify (subst_list (subst v (Fun f T)) E) ((v, Fun f T)#B) = Some U\"\n    using \"4.prems\"(1) by auto\n  moreover have \"\\<forall>(s, t) \\<in> set (subst_list (subst v (Fun f T)) E). wf\\<^sub>t\\<^sub>r\\<^sub>m s \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n    using wf_trm_subst_singleton[OF _ \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m (Fun f T)\\<close>] \"4.prems\"(2)\n    unfolding subst_list_def subst_def by auto\n  ultimately show ?case using \"4.IH\"[OF \\<open>v \\<notin> fv (Fun f T)\\<close> _ _ *] by metis\nqed\n\nlemma mgu_wf_trm:\n  assumes \"mgu s t = Some \\<sigma>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<sigma> v)\"\nproof -\n  from assms obtain \\<sigma>' where \"subst_of \\<sigma>' = \\<sigma>\" \"\\<forall>(v,t) \\<in> set \\<sigma>'. wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n    using unify_list_wf_trm[of \"[(s,t)]\" \"[]\"] by (auto simp: mgu_def split: option.splits)\n  thus ?thesis\n  proof (induction \\<sigma>' arbitrary: \\<sigma> v rule: List.rev_induct)\n    case (snoc x \\<sigma>' \\<sigma> v)\n    define \\<theta> where \"\\<theta> = subst_of \\<sigma>'\"\n    hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<theta> v)\" for v using snoc.prems(2) snoc.IH[of \\<theta>] by fastforce \n    moreover obtain w t where x: \"x = (w,t)\" by (metis surj_pair) \n    hence \\<sigma>: \"\\<sigma> = Var(w := t) \\<circ>\\<^sub>s \\<theta>\" using snoc.prems(1) by (simp add: subst_def \\<theta>_def)\n    moreover have \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" using snoc.prems(2) x by auto\n    ultimately show ?case using wf_trm_subst[of _ t] unfolding subst_compose_def by auto\n  qed (simp add: wf\\<^sub>t\\<^sub>r\\<^sub>m_def)\nqed\n\nlemma mgu_wf_trms:\n  assumes \"mgu s t = Some \\<sigma>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m s\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\n  shows \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<sigma>)\"\nusing mgu_wf_trm[OF assms] by simp\n\nsubsection \\<open>Definitions: Intruder Deduction Relations\\<close>\ntext \\<open>\n  A standard Dolev-Yao intruder.\n\\<close>\ninductive intruder_deduct::\"('fun,'var) terms \\<Rightarrow> ('fun,'var) term \\<Rightarrow> bool\"\nwhere\n  Axiom[simp]:   \"t \\<in> M \\<Longrightarrow> intruder_deduct M t\"\n| Compose[simp]: \"\\<lbrakk>length T = arity f; public f; \\<And>t. t \\<in> set T \\<Longrightarrow> intruder_deduct M t\\<rbrakk>\n                  \\<Longrightarrow> intruder_deduct M (Fun f T)\"\n| Decompose:     \"\\<lbrakk>intruder_deduct M t; Ana t = (K, T); \\<And>k. k \\<in> set K \\<Longrightarrow> intruder_deduct M k;\n                   t\\<^sub>i \\<in> set T\\<rbrakk>\n                  \\<Longrightarrow> intruder_deduct M t\\<^sub>i\"\n\ntext \\<open>\n  A variant of the intruder relation which limits the intruder to composition only.\n\\<close>\ninductive intruder_synth::\"('fun,'var) terms \\<Rightarrow> ('fun,'var) term \\<Rightarrow> bool\"\nwhere\n  AxiomC[simp]:   \"t \\<in> M \\<Longrightarrow> intruder_synth M t\"\n| ComposeC[simp]: \"\\<lbrakk>length T = arity f; public f; \\<And>t. t \\<in> set T \\<Longrightarrow> intruder_synth M t\\<rbrakk>\n                    \\<Longrightarrow> intruder_synth M (Fun f T)\"\n\nadhoc_overloading INTRUDER_DEDUCT intruder_deduct\nadhoc_overloading INTRUDER_SYNTH intruder_synth\n\nlemma intruder_deduct_induct[consumes 1, case_names Axiom Compose Decompose]:\n  assumes \"M \\<turnstile> t\" \"\\<And>t. t \\<in> M \\<Longrightarrow> P M t\"\n          \"\\<And>T f. \\<lbrakk>length T = arity f; public f;\n                  \\<And>t. t \\<in> set T \\<Longrightarrow> M \\<turnstile> t;\n                  \\<And>t. t \\<in> set T \\<Longrightarrow> P M t\\<rbrakk> \\<Longrightarrow> P M (Fun f T)\"\n          \"\\<And>t K T t\\<^sub>i. \\<lbrakk>M \\<turnstile> t; P M t; Ana t = (K, T); \\<And>k. k \\<in> set K \\<Longrightarrow> M \\<turnstile> k;\n                       \\<And>k. k \\<in> set K \\<Longrightarrow> P M k; t\\<^sub>i \\<in> set T\\<rbrakk> \\<Longrightarrow> P M t\\<^sub>i\"\n  shows \"P M t\"\nusing assms by (induct rule: intruder_deduct.induct) blast+\n\nlemma intruder_synth_induct[consumes 1, case_names AxiomC ComposeC]:\n  fixes M::\"('fun,'var) terms\" and t::\"('fun,'var) term\"\n  assumes \"M \\<turnstile>\\<^sub>c t\" \"\\<And>t. t \\<in> M \\<Longrightarrow> P M t\"\n          \"\\<And>T f. \\<lbrakk>length T = arity f; public f;\n                  \\<And>t. t \\<in> set T \\<Longrightarrow> M \\<turnstile>\\<^sub>c t;\n                  \\<And>t. t \\<in> set T \\<Longrightarrow> P M t\\<rbrakk> \\<Longrightarrow> P M (Fun f T)\"\n  shows \"P M t\"\nusing assms by (induct rule: intruder_synth.induct) auto\n\n\nsubsection \\<open>Definitions: Analyzed Knowledge and Public Ground Well-formed Terms (PGWTs)\\<close>\ndefinition analyzed::\"('fun,'var) terms \\<Rightarrow> bool\" where\n  \"analyzed M \\<equiv> \\<forall>t. M \\<turnstile> t \\<longleftrightarrow> M \\<turnstile>\\<^sub>c t\"\n\ndefinition analyzed_in where\n  \"analyzed_in t M \\<equiv> \\<forall>K R. (Ana t = (K,R) \\<and> (\\<forall>k \\<in> set K. M \\<turnstile>\\<^sub>c k)) \\<longrightarrow> (\\<forall>r \\<in> set R. M \\<turnstile>\\<^sub>c r)\"\n\ndefinition decomp_closure::\"('fun,'var) terms \\<Rightarrow> ('fun,'var) terms \\<Rightarrow> bool\" where\n  \"decomp_closure M M' \\<equiv> \\<forall>t. M \\<turnstile> t \\<and> (\\<exists>t' \\<in> M. t \\<sqsubseteq> t') \\<longleftrightarrow> t \\<in> M'\"\n\ninductive public_ground_wf_term::\"('fun,'var) term \\<Rightarrow> bool\" where\n  PGWT[simp]: \"\\<lbrakk>public f; arity f = length T;\n                \\<And>t. t \\<in> set T \\<Longrightarrow> public_ground_wf_term t\\<rbrakk>\n                  \\<Longrightarrow> public_ground_wf_term (Fun f T)\"\n\nabbreviation \"public_ground_wf_terms \\<equiv> {t. public_ground_wf_term t}\"\n\nlemma public_const_deduct:\n  assumes \"c \\<in> \\<C>\\<^sub>p\\<^sub>u\\<^sub>b\"\n  shows \"M \\<turnstile> Fun c []\" \"M \\<turnstile>\\<^sub>c Fun c []\"\nproof -\n  have \"arity c = 0\" \"public c\" using const_arity_eq_zero \\<open>c \\<in> \\<C>\\<^sub>p\\<^sub>u\\<^sub>b\\<close> by auto\n  thus \"M \\<turnstile> Fun c []\" \"M \\<turnstile>\\<^sub>c Fun c []\"\n    using intruder_synth.ComposeC[OF _ \\<open>public c\\<close>, of \"[]\"]\n          intruder_deduct.Compose[OF _ \\<open>public c\\<close>, of \"[]\"]\n    by auto\nqed\n\nlemma public_const_deduct'[simp]:\n  assumes \"arity c = 0\" \"public c\"\n  shows \"M \\<turnstile> Fun c []\" \"M \\<turnstile>\\<^sub>c Fun c []\"\nusing intruder_deduct.Compose[of \"[]\" c] intruder_synth.ComposeC[of \"[]\" c] assms by simp_all\n\nlemma private_fun_deduct_in_ik:\n  assumes t: \"M \\<turnstile> t\" \"Fun f T \\<in> subterms t\"\n    and f: \"\\<not>public f\"\n  shows \"Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t M\"\nusing t\nproof (induction t rule: intruder_deduct.induct)\n  case Decompose thus ?case by (meson Ana_subterm psubsetD term.order_trans)\nqed (auto simp add: f in_subterms_Union)\n\nlemma private_fun_deduct_in_ik':\n  assumes t: \"M \\<turnstile> Fun f T\"\n    and f: \"\\<not>public f\"\n  shows \"Fun f T \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t M\"\nby (rule private_fun_deduct_in_ik[OF t term.order_refl f])\n\nlemma pgwt_public: \"\\<lbrakk>public_ground_wf_term t; Fun f T \\<sqsubseteq> t\\<rbrakk> \\<Longrightarrow> public f\"\nby (induct t rule: public_ground_wf_term.induct) auto\n\nlemma pgwt_ground: \"public_ground_wf_term t \\<Longrightarrow> fv t = {}\"\nby (induct t rule: public_ground_wf_term.induct) auto\n\nlemma pgwt_fun: \"public_ground_wf_term t \\<Longrightarrow> \\<exists>f T. t = Fun f T\"\nusing pgwt_ground[of t] by (cases t) auto\n\nlemma pgwt_arity: \"\\<lbrakk>public_ground_wf_term t; Fun f T \\<sqsubseteq> t\\<rbrakk> \\<Longrightarrow> arity f = length T\"\nby (induct t rule: public_ground_wf_term.induct) auto\n\nlemma pgwt_wellformed: \"public_ground_wf_term t \\<Longrightarrow> wf\\<^sub>t\\<^sub>r\\<^sub>m t\"\nby (induct t rule: public_ground_wf_term.induct) auto\n\nlemma pgwt_deducible: \"public_ground_wf_term t \\<Longrightarrow> M \\<turnstile>\\<^sub>c t\"\nby (induct t rule: public_ground_wf_term.induct) auto\n\nlemma pgwt_is_empty_synth: \"public_ground_wf_term t \\<longleftrightarrow> {} \\<turnstile>\\<^sub>c t\"\nproof -\n  { fix M::\"('fun,'var) term set\" assume \"M \\<turnstile>\\<^sub>c t\" \"M = {}\" hence \"public_ground_wf_term t\"\n      by (induct t rule: intruder_synth.induct) auto\n  }\n  thus ?thesis using pgwt_deducible by auto\nqed\n\nlemma ideduct_synth_subst_apply:\n  fixes M::\"('fun,'var) terms\" and t::\"('fun,'var) term\"\n  assumes \"{} \\<turnstile>\\<^sub>c t\" \"\\<And>v. M \\<turnstile>\\<^sub>c \\<theta> v\"\n  shows \"M \\<turnstile>\\<^sub>c t \\<cdot> \\<theta>\"\nproof -\n  { fix M'::\"('fun,'var) term set\" assume \"M' \\<turnstile>\\<^sub>c t\" \"M' = {}\" hence \"M \\<turnstile>\\<^sub>c t \\<cdot> \\<theta>\"\n    proof (induction t rule: intruder_synth.induct)\n      case (ComposeC T f M')\n      hence \"length (map (\\<lambda>t. t \\<cdot> \\<theta>) T) = arity f\" \"\\<And>x. x \\<in> set (map (\\<lambda>t. t \\<cdot> \\<theta>) T) \\<Longrightarrow> M \\<turnstile>\\<^sub>c x\"\n        by auto\n      thus ?case using intruder_synth.ComposeC[of \"map (\\<lambda>t. t \\<cdot> \\<theta>) T\" f M] \\<open>public f\\<close> by fastforce\n    qed simp\n  }\n  thus ?thesis using assms by metis\nqed\n  \n\nsubsection \\<open>Lemmata: Monotonicity, Deduction of Private Constants, etc.\\<close>\ncontext\nbegin\nlemma ideduct_mono:\n  \"\\<lbrakk>M \\<turnstile> t; M \\<subseteq> M'\\<rbrakk> \\<Longrightarrow> M' \\<turnstile> t\"\nproof (induction rule: intruder_deduct.induct)\n  case (Decompose M t K T t\\<^sub>i)\n  have \"\\<forall>k. k \\<in> set K \\<longrightarrow> M' \\<turnstile> k\" using Decompose.IH \\<open>M \\<subseteq> M'\\<close> by simp\n  moreover have \"M' \\<turnstile> t\" using Decompose.IH \\<open>M \\<subseteq> M'\\<close> by simp\n  ultimately show ?case using Decompose.hyps intruder_deduct.Decompose by blast\nqed auto\n\nlemma ideduct_synth_mono:\n  fixes M::\"('fun,'var) terms\" and t::\"('fun,'var) term\"\n  shows \"\\<lbrakk>M \\<turnstile>\\<^sub>c t; M \\<subseteq> M'\\<rbrakk> \\<Longrightarrow> M' \\<turnstile>\\<^sub>c t\"\nby (induct rule: intruder_synth.induct) auto\n\ncontext\nbegin\n\n\\<comment> \\<open>Used by \\<open>inductive_set\\<close>\\<close>\nprivate lemma ideduct_mono_set[mono_set]:\n  \"M \\<subseteq> N \\<Longrightarrow> M \\<turnstile> t \\<longrightarrow> N \\<turnstile> t\"\n  \"M \\<subseteq> N \\<Longrightarrow> M \\<turnstile>\\<^sub>c t \\<longrightarrow> N \\<turnstile>\\<^sub>c t\"\nusing ideduct_mono ideduct_synth_mono by (blast, blast)\n\nend\n\nlemma ideduct_reduce:\n  \"\\<lbrakk>M \\<union> M' \\<turnstile> t; \\<And>t'. t' \\<in> M' \\<Longrightarrow> M \\<turnstile> t'\\<rbrakk> \\<Longrightarrow> M \\<turnstile> t\"\nproof (induction rule: intruder_deduct_induct)\n  case Decompose thus ?case using intruder_deduct.Decompose by blast \nqed auto\n\nlemma ideduct_synth_reduce:\n  fixes M::\"('fun,'var) terms\" and t::\"('fun,'var) term\"\n  shows \"\\<lbrakk>M \\<union> M' \\<turnstile>\\<^sub>c t; \\<And>t'. t' \\<in> M' \\<Longrightarrow> M \\<turnstile>\\<^sub>c t'\\<rbrakk> \\<Longrightarrow> M \\<turnstile>\\<^sub>c t\"\nby (induct rule: intruder_synth_induct) auto\n\nlemma ideduct_mono_eq:\n  assumes \"\\<forall>t. M \\<turnstile> t \\<longleftrightarrow> M' \\<turnstile> t\" shows \"M \\<union> N \\<turnstile> t \\<longleftrightarrow> M' \\<union> N \\<turnstile> t\"\nproof\n  show \"M \\<union> N \\<turnstile> t \\<Longrightarrow> M' \\<union> N \\<turnstile> t\"\n  proof (induction t rule: intruder_deduct_induct)\n    case (Axiom t) thus ?case\n    proof (cases \"t \\<in> M\")\n      case True\n      hence \"M \\<turnstile> t\" using intruder_deduct.Axiom by metis\n      thus ?thesis using assms ideduct_mono[of M' t \"M' \\<union> N\"] by simp\n    qed auto\n  next\n    case (Compose T f) thus ?case using intruder_deduct.Compose by auto\n  next\n    case (Decompose t K T t\\<^sub>i) thus ?case using intruder_deduct.Decompose[of \"M' \\<union> N\" t K T] by auto\n  qed\n\n  show \"M' \\<union> N \\<turnstile> t \\<Longrightarrow> M \\<union> N \\<turnstile> t\"\n  proof (induction t rule: intruder_deduct_induct)\n    case (Axiom t) thus ?case\n    proof (cases \"t \\<in> M'\")\n      case True\n      hence \"M' \\<turnstile> t\" using intruder_deduct.Axiom by metis\n      thus ?thesis using assms ideduct_mono[of M t \"M \\<union> N\"] by simp\n    qed auto\n  next\n    case (Compose T f) thus ?case using intruder_deduct.Compose by auto\n  next\n    case (Decompose t K T t\\<^sub>i) thus ?case using intruder_deduct.Decompose[of \"M \\<union> N\" t K T] by auto\n  qed\nqed\n\nlemma deduct_synth_subterm:\n  fixes M::\"('fun,'var) terms\" and t::\"('fun,'var) term\"\n  assumes \"M \\<turnstile>\\<^sub>c t\" \"s \\<in> subterms t\" \"\\<forall>m \\<in> M. \\<forall>s \\<in> subterms m. M \\<turnstile>\\<^sub>c s\"\n  shows \"M \\<turnstile>\\<^sub>c s\"\nusing assms by (induct t rule: intruder_synth.induct) auto\n\nlemma deduct_if_synth[intro, dest]: \"M \\<turnstile>\\<^sub>c t \\<Longrightarrow> M \\<turnstile> t\"\nby (induct rule: intruder_synth.induct) auto\n\nprivate lemma ideduct_ik_eq: assumes \"\\<forall>t \\<in> M. M' \\<turnstile> t\" shows \"M' \\<turnstile> t \\<longleftrightarrow> M' \\<union> M \\<turnstile> t\"\nby (meson assms ideduct_mono ideduct_reduce sup_ge1)\n\nprivate lemma synth_if_deduct_empty: \"{} \\<turnstile> t \\<Longrightarrow> {} \\<turnstile>\\<^sub>c t\"\nproof (induction t rule: intruder_deduct_induct)\n  case (Decompose t K M m)\n  then obtain f T where \"t = Fun f T\" \"m \\<in> set T\"\n    using Ana_fun_subterm Ana_var by (cases t) fastforce+\n  with Decompose.IH(1) show ?case by (induction rule: intruder_synth_induct) auto\nqed auto\n\nprivate lemma ideduct_deduct_synth_mono_eq:\n  assumes \"\\<forall>t. M \\<turnstile> t \\<longleftrightarrow> M' \\<turnstile>\\<^sub>c t\" \"M \\<subseteq> M'\"\n  and \"\\<forall>t. M' \\<union> N \\<turnstile> t \\<longleftrightarrow> M' \\<union> N \\<union> D \\<turnstile>\\<^sub>c t\"\n  shows \"M \\<union> N \\<turnstile> t \\<longleftrightarrow> M' \\<union> N \\<union> D \\<turnstile>\\<^sub>c t\"\nproof -\n  have \"\\<forall>m \\<in> M'. M \\<turnstile> m\" using assms(1) by auto\n  hence \"\\<forall>t. M \\<turnstile> t \\<longleftrightarrow> M' \\<turnstile> t\" by (metis assms(1,2) deduct_if_synth ideduct_reduce sup.absorb2)\n  hence \"\\<forall>t. M' \\<union> N \\<turnstile> t \\<longleftrightarrow> M \\<union> N \\<turnstile> t\" by (meson ideduct_mono_eq)\n  thus ?thesis by (meson assms(3))\nqed\n\nlemma ideduct_subst: \"M \\<turnstile> t \\<Longrightarrow> M \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<delta> \\<turnstile> t \\<cdot> \\<delta>\"\nproof (induction t rule: intruder_deduct_induct)\n  case (Compose T f)\n  hence \"length (map (\\<lambda>t. t \\<cdot> \\<delta>) T) = arity f\" \"\\<And>t. t \\<in> set T \\<Longrightarrow> M \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<delta> \\<turnstile> t \\<cdot> \\<delta>\" by auto\n  thus ?case using intruder_deduct.Compose[OF _ Compose.hyps(2), of \"map (\\<lambda>t. t \\<cdot> \\<delta>) T\"] by auto\nnext\n  case (Decompose t K M' m')\n  hence \"Ana (t \\<cdot> \\<delta>) = (K \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<delta>, M' \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<delta>)\"\n        \"\\<And>k. k \\<in> set (K \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<delta>) \\<Longrightarrow> M \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<delta> \\<turnstile> k\"\n        \"m' \\<cdot> \\<delta> \\<in> set (M' \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<delta>)\"\n    using Ana_subst[OF Decompose.hyps(2)] by fastforce+\n  thus ?case using intruder_deduct.Decompose[OF Decompose.IH(1)] by metis\nqed simp\n\nlemma ideduct_synth_subst:\n  fixes M::\"('fun,'var) terms\" and t::\"('fun,'var) term\" and \\<delta>::\"('fun,'var) subst\"\n  shows \"M \\<turnstile>\\<^sub>c t \\<Longrightarrow> M \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<delta> \\<turnstile>\\<^sub>c t \\<cdot> \\<delta>\"\nproof (induction t rule: intruder_synth_induct)\n  case (ComposeC T f)\n  hence \"length (map (\\<lambda>t. t \\<cdot> \\<delta>) T) = arity f\" \"\\<And>t. t \\<in> set T \\<Longrightarrow> M \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<delta> \\<turnstile>\\<^sub>c t \\<cdot> \\<delta>\" by auto\n  thus ?case using intruder_synth.ComposeC[OF _ ComposeC.hyps(2), of \"map (\\<lambda>t. t \\<cdot> \\<delta>) T\"] by auto\nqed simp\n\nlemma ideduct_vars:\n  assumes \"M \\<turnstile> t\"\n  shows \"fv t \\<subseteq> fv\\<^sub>s\\<^sub>e\\<^sub>t M\"\nusing assms \nproof (induction t rule: intruder_deduct_induct)\n  case (Decompose t K T t\\<^sub>i) thus ?case\n    using Ana_vars(2) fv_subset by blast \nqed auto\n\nlemma ideduct_synth_vars:\n  fixes M::\"('fun,'var) terms\" and t::\"('fun,'var) term\"\n  assumes \"M \\<turnstile>\\<^sub>c t\"\n  shows \"fv t \\<subseteq> fv\\<^sub>s\\<^sub>e\\<^sub>t M\"\nusing assms by (induct t rule: intruder_synth_induct) auto\n\nlemma ideduct_synth_priv_fun_in_ik:\n  fixes M::\"('fun,'var) terms\" and t::\"('fun,'var) term\"\n  assumes \"M \\<turnstile>\\<^sub>c t\" \"f \\<in> funs_term t\" \"\\<not>public f\"\n  shows \"f \\<in> \\<Union>(funs_term ` M)\"\nusing assms by (induct t rule: intruder_synth_induct) auto\n\nlemma ideduct_synth_priv_const_in_ik:\n  fixes M::\"('fun,'var) terms\" and t::\"('fun,'var) term\"\n  assumes \"M \\<turnstile>\\<^sub>c Fun c []\" \"\\<not>public c\"\n  shows \"Fun c [] \\<in> M\"\nusing intruder_synth.cases[OF assms(1)] assms(2) by fast\n\nlemma ideduct_synth_ik_replace:\n  fixes M::\"('fun,'var) terms\" and t::\"('fun,'var) term\"\n  assumes \"\\<forall>t \\<in> M. N \\<turnstile>\\<^sub>c t\"\n    and \"M \\<turnstile>\\<^sub>c t\"\n  shows \"N \\<turnstile>\\<^sub>c t\"\nusing assms(2,1) by (induct t rule: intruder_synth.induct) auto\nend\n\nsubsection \\<open>Lemmata: Analyzed Intruder Knowledge Closure\\<close>\nlemma deducts_eq_if_analyzed: \"analyzed M \\<Longrightarrow> M \\<turnstile> t \\<longleftrightarrow> M \\<turnstile>\\<^sub>c t\"\nunfolding analyzed_def by auto\n\n\n\nlemma deduct_if_closure_deduct: \"\\<lbrakk>M' \\<turnstile> t; decomp_closure M M'\\<rbrakk> \\<Longrightarrow> M \\<turnstile> t\"\nproof (induction t rule: intruder_deduct.induct)\n  case (Decompose M' t K T t\\<^sub>i)\n  thus ?case using intruder_deduct.Decompose[OF _ \\<open>Ana t = (K,T)\\<close> _ \\<open>t\\<^sub>i \\<in> set T\\<close>] by simp\nqed (auto simp add: decomp_closure_def)\n\nlemma deduct_if_closure_synth: \"\\<lbrakk>decomp_closure M M'; M' \\<turnstile>\\<^sub>c t\\<rbrakk> \\<Longrightarrow> M \\<turnstile> t\"\nusing deduct_if_closure_deduct by blast\n\nlemma decomp_closure_subterms_composable:\n  assumes \"decomp_closure M M'\"\n  and \"M' \\<turnstile>\\<^sub>c t'\" \"M' \\<turnstile> t\" \"t \\<sqsubseteq> t'\"\n  shows \"M' \\<turnstile>\\<^sub>c t\"\nusing \\<open>M' \\<turnstile>\\<^sub>c t'\\<close> assms\nproof (induction t' rule: intruder_synth.induct)\n  case (AxiomC t' M')\n  have \"M \\<turnstile> t\" using \\<open>M' \\<turnstile> t\\<close> deduct_if_closure_deduct AxiomC.prems(1) by blast\n  moreover\n  { have \"\\<exists>s \\<in> M. t' \\<sqsubseteq> s\" using \\<open>t' \\<in> M'\\<close> AxiomC.prems(1) unfolding decomp_closure_def by blast\n    hence \"\\<exists>s \\<in> M. t \\<sqsubseteq> s\" using \\<open>t \\<sqsubseteq> t'\\<close> term.order_trans by auto\n  }\n  ultimately have \"t \\<in> M'\" using AxiomC.prems(1) unfolding decomp_closure_def by blast\n  thus ?case by simp\nnext\n  case (ComposeC T f M')\n  let ?t' = \"Fun f T\"\n  { assume \"t = ?t'\" have \"M' \\<turnstile>\\<^sub>c t\" using \\<open>M' \\<turnstile>\\<^sub>c ?t'\\<close> \\<open>t = ?t'\\<close> by simp }\n  moreover\n  { assume \"t \\<noteq> ?t'\"\n    have \"\\<exists>x \\<in> set T. t \\<sqsubseteq> x\" using \\<open>t \\<sqsubseteq> ?t'\\<close> \\<open>t \\<noteq> ?t'\\<close> by simp\n    hence \"M' \\<turnstile>\\<^sub>c t\" using ComposeC.IH ComposeC.prems(1,3) ComposeC.hyps(3) by blast\n  }\n  ultimately show ?case using cases_simp[of \"t = ?t'\" \"M' \\<turnstile>\\<^sub>c t\"] by simp\nqed\n\nlemma decomp_closure_analyzed:\n  assumes \"decomp_closure M M'\"\n  shows \"analyzed M'\"\nproof -\n  { fix t assume \"M' \\<turnstile> t\" have \"M' \\<turnstile>\\<^sub>c t\" using \\<open>M' \\<turnstile> t\\<close> assms\n    proof (induction t rule: intruder_deduct.induct)\n      case (Decompose M' t K T t\\<^sub>i) \n      hence \"M' \\<turnstile> t\\<^sub>i\" using Decompose.hyps intruder_deduct.Decompose by blast\n      moreover have \"t\\<^sub>i \\<sqsubseteq> t\"\n        using Decompose.hyps(4) Ana_subterm[OF Decompose.hyps(2)] by blast\n      moreover have \"M' \\<turnstile>\\<^sub>c t\" using Decompose.IH(1) Decompose.prems by blast\n      ultimately show \"M' \\<turnstile>\\<^sub>c t\\<^sub>i\" using decomp_closure_subterms_composable Decompose.prems by blast\n    qed auto\n  }\n  moreover have \"\\<forall>t. M \\<turnstile>\\<^sub>c t \\<longrightarrow> M \\<turnstile> t\" by auto\n  ultimately show ?thesis by (auto simp add: decomp_closure_def analyzed_def)\nqed\n\nlemma analyzed_if_all_analyzed_in:\n  assumes M: \"\\<forall>t \\<in> M. analyzed_in t M\"\n  shows \"analyzed M\"\nproof (unfold analyzed_def, intro allI iffI)\n  fix t\n  assume t: \"M \\<turnstile> t\"\n  thus \"M \\<turnstile>\\<^sub>c t\"\n  proof (induction t rule: intruder_deduct_induct)\n    case (Decompose t K T t\\<^sub>i)\n    { assume \"t \\<in> M\"\n      hence ?case\n        using M Decompose.IH(2) Decompose.hyps(2,4)\n        unfolding analyzed_in_def by fastforce\n    } moreover {\n      fix f S assume \"t = Fun f S\" \"\\<And>s. s \\<in> set S \\<Longrightarrow> M \\<turnstile>\\<^sub>c s\"\n      hence ?case using Ana_fun_subterm[of f S] Decompose.hyps(2,4) by blast\n    } ultimately show ?case using intruder_synth.cases[OF Decompose.IH(1), of ?case] by blast\n  qed simp_all\nqed auto\n\nlemma analyzed_is_all_analyzed_in:\n  \"(\\<forall>t \\<in> M. analyzed_in t M) \\<longleftrightarrow> analyzed M\"\nproof\n  show \"analyzed M \\<Longrightarrow> \\<forall>t \\<in> M. analyzed_in t M\"\n    unfolding analyzed_in_def analyzed_def\n    by (auto intro: intruder_deduct.Decompose[OF intruder_deduct.Axiom])\nqed (rule analyzed_if_all_analyzed_in)\n\nlemma ik_has_synth_ik_closure:\n  fixes M :: \"('fun,'var) terms\"\n  shows \"\\<exists>M'. (\\<forall>t. M \\<turnstile> t \\<longleftrightarrow> M' \\<turnstile>\\<^sub>c t) \\<and> decomp_closure M M' \\<and> (finite M \\<longrightarrow> finite M')\"\nproof -\n  let ?M' = \"{t. M \\<turnstile> t \\<and> (\\<exists>t' \\<in> M. t \\<sqsubseteq> t')}\"\n\n  have M'_closes: \"decomp_closure M ?M'\" unfolding decomp_closure_def by simp\n  hence \"M \\<subseteq> ?M'\" using closure_is_superset by simp\n\n  have \"\\<forall>t. ?M' \\<turnstile>\\<^sub>c t \\<longrightarrow> M \\<turnstile> t\" using deduct_if_closure_synth[OF M'_closes] by blast \n  moreover have \"\\<forall>t. M \\<turnstile> t \\<longrightarrow> ?M' \\<turnstile> t\" using ideduct_mono[OF _ \\<open>M \\<subseteq> ?M'\\<close>] by simp\n  moreover have \"analyzed ?M'\" using decomp_closure_analyzed[OF M'_closes] .\n  ultimately have \"\\<forall>t. M \\<turnstile> t \\<longleftrightarrow> ?M' \\<turnstile>\\<^sub>c t\" unfolding analyzed_def by blast\n  moreover have \"finite M \\<longrightarrow> finite ?M'\" by auto\n  ultimately show ?thesis using M'_closes by blast\nqed\n\nlemma deducts_eq_if_empty_ik:\n  \"{} \\<turnstile> t \\<longleftrightarrow> {} \\<turnstile>\\<^sub>c t\"\nusing analyzed_is_all_analyzed_in[of \"{}\"] deducts_eq_if_analyzed[of \"{}\" t] by blast\n\n\nsubsection \\<open>Intruder Variants: Numbered and Composition-Restricted Intruder Deduction Relations\\<close>\ntext \\<open>\n  A variant of the intruder relation which restricts composition to only those terms that satisfy\n  a given predicate Q.\n\\<close>\ninductive intruder_deduct_restricted::\n  \"('fun,'var) terms \\<Rightarrow> (('fun,'var) term \\<Rightarrow> bool) \\<Rightarrow> ('fun,'var) term \\<Rightarrow> bool\"\n  (\"\\<langle>_;_\\<rangle> \\<turnstile>\\<^sub>r _\" 50)\nwhere\n  AxiomR[simp]:   \"t \\<in> M \\<Longrightarrow> \\<langle>M; Q\\<rangle> \\<turnstile>\\<^sub>r t\"\n| ComposeR[simp]: \"\\<lbrakk>length T = arity f; public f; \\<And>t. t \\<in> set T \\<Longrightarrow> \\<langle>M; Q\\<rangle> \\<turnstile>\\<^sub>r t; Q (Fun f T)\\<rbrakk>\n                    \\<Longrightarrow> \\<langle>M; Q\\<rangle> \\<turnstile>\\<^sub>r Fun f T\"\n| DecomposeR:     \"\\<lbrakk>\\<langle>M; Q\\<rangle> \\<turnstile>\\<^sub>r t; Ana t = (K, T); \\<And>k. k \\<in> set K \\<Longrightarrow> \\<langle>M; Q\\<rangle> \\<turnstile>\\<^sub>r k; t\\<^sub>i \\<in> set T\\<rbrakk>\n                    \\<Longrightarrow> \\<langle>M; Q\\<rangle> \\<turnstile>\\<^sub>r t\\<^sub>i\"\n\ntext \\<open>\n  A variant of the intruder relation equipped with a number representing the height of the\n  derivation tree (i.e., \\<open>\\<langle>M; k\\<rangle> \\<turnstile>\\<^sub>n t\\<close> iff k is the maximum number of applications of the compose\n  and decompose rules in any path of the derivation tree for \\<open>M \\<turnstile> t\\<close>).\n\\<close>\ninductive intruder_deduct_num::\n  \"('fun,'var) terms \\<Rightarrow> nat \\<Rightarrow> ('fun,'var) term \\<Rightarrow> bool\"\n  (\"\\<langle>_; _\\<rangle> \\<turnstile>\\<^sub>n _\" 50)\nwhere\n  AxiomN[simp]:   \"t \\<in> M \\<Longrightarrow> \\<langle>M; 0\\<rangle> \\<turnstile>\\<^sub>n t\"\n| ComposeN[simp]: \"\\<lbrakk>length T = arity f; public f; \\<And>t. t \\<in> set T \\<Longrightarrow> \\<langle>M; steps t\\<rangle> \\<turnstile>\\<^sub>n t\\<rbrakk>\n                    \\<Longrightarrow> \\<langle>M; Suc (Max (insert 0 (steps ` set T)))\\<rangle> \\<turnstile>\\<^sub>n Fun f T\"\n| DecomposeN:     \"\\<lbrakk>\\<langle>M; n\\<rangle> \\<turnstile>\\<^sub>n t; Ana t = (K, T); \\<And>k. k \\<in> set K \\<Longrightarrow> \\<langle>M; steps k\\<rangle> \\<turnstile>\\<^sub>n k; t\\<^sub>i \\<in> set T\\<rbrakk>\n                    \\<Longrightarrow> \\<langle>M; Suc (Max (insert n (steps ` set K)))\\<rangle> \\<turnstile>\\<^sub>n t\\<^sub>i\"\n\nlemma intruder_deduct_restricted_induct[consumes 1, case_names AxiomR ComposeR DecomposeR]:\n  assumes \"\\<langle>M; Q\\<rangle> \\<turnstile>\\<^sub>r t\" \"\\<And>t. t \\<in> M \\<Longrightarrow> P M Q t\"\n          \"\\<And>T f. \\<lbrakk>length T = arity f; public f;\n                  \\<And>t. t \\<in> set T \\<Longrightarrow> \\<langle>M; Q\\<rangle> \\<turnstile>\\<^sub>r t;\n                  \\<And>t. t \\<in> set T \\<Longrightarrow> P M Q t; Q (Fun f T)\n                  \\<rbrakk> \\<Longrightarrow> P M Q (Fun f T)\"\n          \"\\<And>t K T t\\<^sub>i. \\<lbrakk>\\<langle>M; Q\\<rangle> \\<turnstile>\\<^sub>r t; P M Q t; Ana t = (K, T); \\<And>k. k \\<in> set K \\<Longrightarrow> \\<langle>M; Q\\<rangle> \\<turnstile>\\<^sub>r k;\n                       \\<And>k. k \\<in> set K \\<Longrightarrow> P M Q k; t\\<^sub>i \\<in> set T\\<rbrakk> \\<Longrightarrow> P M Q t\\<^sub>i\"\n  shows \"P M Q t\"\nusing assms by (induct t rule: intruder_deduct_restricted.induct) blast+\n\nlemma intruder_deduct_num_induct[consumes 1, case_names AxiomN ComposeN DecomposeN]:\n  assumes \"\\<langle>M; n\\<rangle> \\<turnstile>\\<^sub>n t\" \"\\<And>t. t \\<in> M \\<Longrightarrow> P M 0 t\"\n          \"\\<And>T f steps.\n              \\<lbrakk>length T = arity f; public f;\n               \\<And>t. t \\<in> set T \\<Longrightarrow> \\<langle>M; steps t\\<rangle> \\<turnstile>\\<^sub>n t;\n               \\<And>t. t \\<in> set T \\<Longrightarrow> P M (steps t) t\\<rbrakk>\n              \\<Longrightarrow> P M (Suc (Max (insert 0 (steps ` set T)))) (Fun f T)\"\n          \"\\<And>t K T t\\<^sub>i steps n.\n              \\<lbrakk>\\<langle>M; n\\<rangle> \\<turnstile>\\<^sub>n t; P M n t; Ana t = (K, T);\n               \\<And>k. k \\<in> set K \\<Longrightarrow> \\<langle>M; steps k\\<rangle> \\<turnstile>\\<^sub>n k;\n               t\\<^sub>i \\<in> set T; \\<And>k. k \\<in> set K \\<Longrightarrow> P M (steps k) k\\<rbrakk>\n              \\<Longrightarrow> P M (Suc (Max (insert n (steps ` set K)))) t\\<^sub>i\"\n  shows \"P M n t\"\nusing assms by (induct rule: intruder_deduct_num.induct) blast+\n\nlemma ideduct_restricted_mono:\n  \"\\<lbrakk>\\<langle>M; P\\<rangle> \\<turnstile>\\<^sub>r t; M \\<subseteq> M'\\<rbrakk> \\<Longrightarrow> \\<langle>M'; P\\<rangle> \\<turnstile>\\<^sub>r t\"\nproof (induction rule: intruder_deduct_restricted_induct)\n  case (DecomposeR t K T t\\<^sub>i)\n  have \"\\<forall>k. k \\<in> set K \\<longrightarrow> \\<langle>M'; P\\<rangle> \\<turnstile>\\<^sub>r k\" using DecomposeR.IH \\<open>M \\<subseteq> M'\\<close> by simp\n  moreover have \"\\<langle>M'; P\\<rangle> \\<turnstile>\\<^sub>r t\" using DecomposeR.IH \\<open>M \\<subseteq> M'\\<close> by simp\n  ultimately show ?case\n    using DecomposeR\n          intruder_deduct_restricted.DecomposeR[OF _ DecomposeR.hyps(2) _ DecomposeR.hyps(4)]\n    by blast\nqed auto\n\n\nsubsection \\<open>Lemmata: Intruder Deduction Equivalences\\<close>\nlemma deduct_if_restricted_deduct: \"\\<langle>M;P\\<rangle> \\<turnstile>\\<^sub>r m \\<Longrightarrow> M \\<turnstile> m\"\nproof (induction m rule: intruder_deduct_restricted_induct)\n  case (DecomposeR t K T t\\<^sub>i) thus ?case using intruder_deduct.Decompose by blast\nqed simp_all\n\nlemma restricted_deduct_if_restricted_ik:\n  assumes \"\\<langle>M;P\\<rangle> \\<turnstile>\\<^sub>r m\" \"\\<forall>m \\<in> M. P m\"\n  and P: \"\\<forall>t t'. P t \\<longrightarrow> t' \\<sqsubseteq> t \\<longrightarrow> P t'\"\n  shows \"P m\"\nusing assms(1)\nproof (induction m rule: intruder_deduct_restricted_induct)\n  case (DecomposeR t K T t\\<^sub>i)\n  obtain f S where \"t = Fun f S\" using Ana_var \\<open>t\\<^sub>i \\<in> set T\\<close> \\<open>Ana t = (K, T)\\<close> by (cases t) auto\n  thus ?case using DecomposeR assms(2) P Ana_subterm by blast\nqed (simp_all add: assms(2))\n\nlemma deduct_restricted_if_synth:\n  assumes P: \"P m\" \"\\<forall>t t'. P t \\<longrightarrow> t' \\<sqsubseteq> t \\<longrightarrow> P t'\"\n  and m: \"M \\<turnstile>\\<^sub>c m\"\n  shows \"\\<langle>M; P\\<rangle> \\<turnstile>\\<^sub>r m\"\nusing m P(1)\nproof (induction m rule: intruder_synth_induct)\n  case (ComposeC T f)\n  hence \"\\<langle>M; P\\<rangle> \\<turnstile>\\<^sub>r t\" when t: \"t \\<in> set T\" for t\n    using t P(2) subtermeqI''[of _ T f]\n    by fastforce\n  thus ?case\n    using intruder_deduct_restricted.ComposeR[OF ComposeC.hyps(1,2)] ComposeC.prems(1)\n    by metis\nqed simp\n\nlemma deduct_zero_in_ik:\n  assumes \"\\<langle>M; 0\\<rangle> \\<turnstile>\\<^sub>n t\" shows \"t \\<in> M\"\nproof -\n  { fix k assume \"\\<langle>M; k\\<rangle> \\<turnstile>\\<^sub>n t\" hence \"k > 0 \\<or> t \\<in> M\" by (induct t) auto\n  } thus ?thesis using assms by auto\nqed\n\nlemma deduct_if_deduct_num: \"\\<langle>M; k\\<rangle> \\<turnstile>\\<^sub>n t \\<Longrightarrow> M \\<turnstile> t\"\nby (induct t rule: intruder_deduct_num.induct)\n   (metis intruder_deduct.Axiom,\n    metis intruder_deduct.Compose,\n    metis intruder_deduct.Decompose)\n\n\n\nlemma deduct_normalize:\n  assumes M: \"\\<forall>m \\<in> M. \\<forall>f T. Fun f T \\<sqsubseteq> m \\<longrightarrow> P f T\"\n  and t: \"\\<langle>M; k\\<rangle> \\<turnstile>\\<^sub>n t\" \"Fun f T \\<sqsubseteq> t\" \"\\<not>P f T\"\n  shows \"\\<exists>l \\<le> k. (\\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n Fun f T) \\<and> (\\<forall>t \\<in> set T. \\<exists>j < l. \\<langle>M; j\\<rangle> \\<turnstile>\\<^sub>n t)\"\nusing t\nproof (induction t rule: intruder_deduct_num_induct)\n  case (AxiomN t) thus ?case using M by auto\nnext\n  case (ComposeN T' f' steps) thus ?case\n  proof (cases \"Fun f' T' = Fun f T\")\n    case True\n    hence \"\\<langle>M; Suc (Max (insert 0 (steps ` set T')))\\<rangle> \\<turnstile>\\<^sub>n Fun f T\" \"T = T'\"\n      using intruder_deduct_num.ComposeN[OF ComposeN.hyps] by auto\n    moreover have \"\\<And>t. t \\<in> set T \\<Longrightarrow> \\<langle>M; steps t\\<rangle> \\<turnstile>\\<^sub>n t\"\n      using True ComposeN.hyps(3) by auto\n    moreover have \"\\<And>t. t \\<in> set T \\<Longrightarrow> steps t < Suc (Max (insert 0 (steps ` set T)))\"\n      using Max_less_iff[of \"insert 0 (steps ` set T)\" \"Suc (Max (insert 0 (steps ` set T)))\"]\n      by auto\n    ultimately show ?thesis by auto\n  next\n    case False\n    then obtain t' where t': \"t' \\<in> set T'\" \"Fun f T \\<sqsubseteq> t'\" using ComposeN by auto\n    hence \"\\<exists>l \\<le> steps t'. (\\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n Fun f T) \\<and> (\\<forall>t \\<in> set T. \\<exists>j < l. \\<langle>M; j\\<rangle> \\<turnstile>\\<^sub>n t)\"\n      using ComposeN.IH[OF _ _ ComposeN.prems(2)] by auto\n    moreover have \"steps t' < Suc (Max (insert 0 (steps ` set T')))\"\n      using Max_less_iff[of \"insert 0 (steps ` set T')\" \"Suc (Max (insert 0 (steps ` set T')))\"]\n      using t'(1) by auto\n    ultimately show ?thesis using ComposeN.hyps(3)[OF t'(1)]\n      by (meson Suc_le_eq le_Suc_eq le_trans)\n  qed\nnext\n  case (DecomposeN t K T' t\\<^sub>i steps n)\n  hence *: \"Fun f T \\<sqsubseteq> t\"\n    using term.order_trans[of \"Fun f T\" t\\<^sub>i t] Ana_subterm[of t K T']\n    by blast\n  have \"\\<exists>l \\<le> n. (\\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n Fun f T) \\<and> (\\<forall>t' \\<in> set T. \\<exists>j < l. \\<langle>M; j\\<rangle> \\<turnstile>\\<^sub>n t')\"\n    using DecomposeN.IH(1)[OF * DecomposeN.prems(2)] by auto\n  moreover have \"n < Suc (Max (insert n (steps ` set K)))\"\n      using Max_less_iff[of \"insert n (steps ` set K)\" \"Suc (Max (insert n (steps ` set K)))\"]\n      by auto\n  ultimately show ?case using DecomposeN.hyps(4) by (meson Suc_le_eq le_Suc_eq le_trans)\nqed\n\nlemma deduct_inv:\n  assumes \"\\<langle>M; n\\<rangle> \\<turnstile>\\<^sub>n t\"\n  shows \"t \\<in> M \\<or>\n         (\\<exists>f T. t = Fun f T \\<and> public f \\<and> length T = arity f \\<and> (\\<forall>t \\<in> set T. \\<exists>l < n. \\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n t)) \\<or>\n         (\\<exists>m \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t M.\n            (\\<exists>l < n. \\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n m) \\<and> (\\<forall>k \\<in> set (fst (Ana m)). \\<exists>l < n. \\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n k) \\<and>\n            t \\<in> set (snd (Ana m)))\"\n    (is \"?P t n \\<or> ?Q t n \\<or> ?R t n\")\nusing assms\nproof (induction n arbitrary: t rule: nat_less_induct)\n  case (1 n t) thus ?case\n  proof (cases n)\n    case 0\n    hence \"t \\<in> M\" using deduct_zero_in_ik \"1.prems\"(1) by metis\n    thus ?thesis by auto\n  next\n    case (Suc n')\n    hence \"\\<langle>M; Suc n'\\<rangle> \\<turnstile>\\<^sub>n t\"\n          \"\\<forall>m < Suc n'. \\<forall>x. (\\<langle>M; m\\<rangle> \\<turnstile>\\<^sub>n x) \\<longrightarrow> ?P x m \\<or> ?Q x m \\<or> ?R x m\"\n      using \"1.prems\" \"1.IH\" by blast+\n    hence \"?P t (Suc n') \\<or> ?Q t (Suc n') \\<or> ?R t (Suc n')\"\n    proof (induction t rule: intruder_deduct_num_induct)\n      case (AxiomN t) thus ?case by simp\n    next\n      case (ComposeN T f steps)\n      have \"\\<And>t. t \\<in> set T \\<Longrightarrow> steps t < Suc (Max (insert 0 (steps ` set T)))\"\n          using Max_less_iff[of \"insert 0 (steps ` set T)\" \"Suc (Max (insert 0 (steps ` set T)))\"]\n          by auto\n      thus ?case using ComposeN.hyps by metis\n    next\n      case (DecomposeN t K T t\\<^sub>i steps n)\n      have 0: \"n < Suc (Max (insert n (steps ` set K)))\"\n              \"\\<And>k. k \\<in> set K \\<Longrightarrow> steps k < Suc (Max (insert n (steps ` set K)))\"\n        using Max_less_iff[of \"insert n (steps ` set K)\" \"Suc (Max (insert n (steps ` set K)))\"]\n        by auto\n\n      have IH1: \"?P t j \\<or> ?Q t j \\<or> ?R t j\" when jt: \"j < n\" \"\\<langle>M; j\\<rangle> \\<turnstile>\\<^sub>n t\" for j t\n        using jt DecomposeN.prems(1) 0(1)\n        by simp\n\n      have IH2: \"?P t n \\<or> ?Q t n \\<or> ?R t n\"\n        using DecomposeN.IH(1) IH1\n        by simp\n\n      have 1: \"\\<forall>k \\<in> set (fst (Ana t)). \\<exists>l < Suc (Max (insert n (steps ` set K))). \\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n k\"\n        using DecomposeN.hyps(1,2,3) 0(2)\n        by auto\n    \n      have 2: \"t\\<^sub>i \\<in> set (snd (Ana t))\"\n        using DecomposeN.hyps(2,4)\n        by fastforce\n    \n      have 3: \"t \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t M\" when \"t \\<in> set (snd (Ana m))\" \"m \\<sqsubseteq>\\<^sub>s\\<^sub>e\\<^sub>t M\" for m\n        using that(1) Ana_subterm[of m _ \"snd (Ana m)\"] in_subterms_subset_Union[OF that(2)]\n        by (metis (no_types, lifting) prod.collapse psubsetD subsetCE subsetD) \n    \n      have 4: \"?R t\\<^sub>i (Suc (Max (insert n (steps ` set K))))\" when \"?R t n\"\n        using that 0(1) 1 2 3 DecomposeN.hyps(1)\n        by (metis (no_types, lifting)) \n    \n      have 5: \"?R t\\<^sub>i (Suc (Max (insert n (steps ` set K))))\" when \"?P t n\"\n        using that 0(1) 1 2 DecomposeN.hyps(1)\n        by blast\n    \n      have 6: ?case when *: \"?Q t n\"\n      proof -\n        obtain g S where g:\n            \"t = Fun g S\" \"public g\" \"length S = arity g\" \"\\<forall>t \\<in> set S. \\<exists>l < n. \\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n t\"\n          using * by moura\n        then obtain l where l: \"l < n\" \"\\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n t\\<^sub>i\"\n          using 0(1) DecomposeN.hyps(2,4) Ana_fun_subterm[of g S K T] by blast\n    \n        have **: \"l < Suc (Max (insert n (steps ` set K)))\" using l(1) 0(1) by simp\n    \n        show ?thesis using IH1[OF l] less_trans[OF _ **] by fastforce\n      qed\n\n      show ?case using IH2 4 5 6 by argo\n    qed\n    thus ?thesis using Suc by fast\n  qed\nqed\n\nlemma deduct_inv':\n  assumes \"M \\<turnstile> Fun f ts\"\n  shows \"Fun f ts \\<sqsubseteq>\\<^sub>s\\<^sub>e\\<^sub>t M \\<or> (\\<forall>t \\<in> set ts. M \\<turnstile> t)\"\nproof -\n  obtain k where k: \"intruder_deduct_num M k (Fun f ts)\"\n    using deduct_num_if_deduct[OF assms] by fast\n\n  have \"Fun f ts \\<sqsubseteq>\\<^sub>s\\<^sub>e\\<^sub>t M \\<or> (\\<forall>t \\<in> set ts. \\<exists>l. intruder_deduct_num M l t)\"\n    using deduct_inv[OF k] Ana_subterm'[of \"Fun f ts\"] in_subterms_subset_Union by blast\n  thus ?thesis using deduct_if_deduct_num by blast\nqed\n\nlemma restricted_deduct_if_deduct:\n  assumes M: \"\\<forall>m \\<in> M. \\<forall>f T. Fun f T \\<sqsubseteq> m \\<longrightarrow> P (Fun f T)\"\n  and P_subterm: \"\\<forall>f T t. M \\<turnstile> Fun f T \\<longrightarrow> P (Fun f T) \\<longrightarrow> t \\<in> set T \\<longrightarrow> P t\"\n  and P_Ana_key: \"\\<forall>t K T k. M \\<turnstile> t \\<longrightarrow> P t \\<longrightarrow> Ana t = (K, T) \\<longrightarrow> M \\<turnstile> k \\<longrightarrow> k \\<in> set K \\<longrightarrow> P k\"\n  and m: \"M \\<turnstile> m\" \"P m\"\n  shows \"\\<langle>M; P\\<rangle> \\<turnstile>\\<^sub>r m\"\nproof -\n  { fix k assume \"\\<langle>M; k\\<rangle> \\<turnstile>\\<^sub>n m\"\n    hence ?thesis using m(2)\n    proof (induction k arbitrary: m rule: nat_less_induct)\n      case (1 n m) thus ?case\n      proof (cases n)\n        case 0\n        hence \"m \\<in> M\" using deduct_zero_in_ik \"1.prems\"(1) by metis\n        thus ?thesis by auto\n      next\n        case (Suc n')\n        hence \"\\<langle>M; Suc n'\\<rangle> \\<turnstile>\\<^sub>n m\"\n              \"\\<forall>m < Suc n'. \\<forall>x. (\\<langle>M; m\\<rangle> \\<turnstile>\\<^sub>n x) \\<longrightarrow> P x \\<longrightarrow> \\<langle>M;P\\<rangle> \\<turnstile>\\<^sub>r x\"\n          using \"1.prems\" \"1.IH\" by blast+\n        thus ?thesis using \"1.prems\"(2)\n        proof (induction m rule: intruder_deduct_num_induct)\n          case (ComposeN T f steps)\n          have *: \"steps t < Suc (Max (insert 0 (steps ` set T)))\" when \"t \\<in> set T\" for t\n            using Max_less_iff[of \"insert 0 (steps ` set T)\"] that\n            by blast\n\n          have **: \"P t\" when \"t \\<in> set T\" for t\n            using P_subterm ComposeN.prems(2) that\n                  Fun_param_is_subterm[OF that]\n                  intruder_deduct.Compose[OF ComposeN.hyps(1,2)]\n                  deduct_if_deduct_num[OF ComposeN.hyps(3)]\n            by blast\n\n          have \"\\<langle>M; P\\<rangle> \\<turnstile>\\<^sub>r t\" when \"t \\<in> set T\" for t\n            using ComposeN.prems(1) ComposeN.hyps(3)[OF that] *[OF that] **[OF that]\n            by blast\n          thus ?case\n            by (metis intruder_deduct_restricted.ComposeR[OF ComposeN.hyps(1,2)] ComposeN.prems(2))\n        next\n          case (DecomposeN t K T t\\<^sub>i steps l)\n          show ?case\n          proof (cases \"P t\")\n            case True\n            hence \"\\<And>k. k \\<in> set K \\<Longrightarrow> P k\"\n              using P_Ana_key DecomposeN.hyps(1,2,3) deduct_if_deduct_num\n              by blast\n            moreover have\n                \"\\<And>k m x. k \\<in> set K \\<Longrightarrow> m < steps k \\<Longrightarrow> \\<langle>M; m\\<rangle> \\<turnstile>\\<^sub>n x \\<Longrightarrow> P x \\<Longrightarrow> \\<langle>M;P\\<rangle> \\<turnstile>\\<^sub>r x\"\n            proof -\n              fix k m x assume *: \"k \\<in> set K\" \"m < steps k\" \"\\<langle>M; m\\<rangle> \\<turnstile>\\<^sub>n x\" \"P x\"\n              have \"steps k \\<in> insert l (steps ` set K)\" using *(1) by simp\n              hence \"m < Suc (Max (insert l (steps ` set K)))\"\n                using less_trans[OF *(2), of \"Suc (Max (insert l (steps ` set K)))\"]\n                      Max_less_iff[of \"insert l (steps ` set K)\"\n                                      \"Suc (Max (insert l (steps ` set K)))\"]\n                by auto\n              thus \"\\<langle>M;P\\<rangle> \\<turnstile>\\<^sub>r x\" using DecomposeN.prems(1) *(3,4) by simp\n            qed\n            ultimately have \"\\<And>k. k \\<in> set K \\<Longrightarrow> \\<langle>M; P\\<rangle> \\<turnstile>\\<^sub>r k\"\n              using DecomposeN.IH(2) by auto\n            moreover have \"\\<langle>M; P\\<rangle> \\<turnstile>\\<^sub>r t\"\n              using True DecomposeN.prems(1) DecomposeN.hyps(1) le_imp_less_Suc\n                    Max_less_iff[of \"insert l (steps ` set K)\" \"Suc (Max (insert l (steps ` set K)))\"]\n              by blast\n            ultimately show ?thesis\n              using intruder_deduct_restricted.DecomposeR[OF _ DecomposeN.hyps(2)\n                                                             _ DecomposeN.hyps(4)]\n              by metis\n          next\n            case False\n            obtain g S where gS: \"t = Fun g S\" using DecomposeN.hyps(2,4) by (cases t) moura+\n            hence *: \"Fun g S \\<sqsubseteq> t\" \"\\<not>P (Fun g S)\" using False by force+\n            have \"\\<exists>j<l. \\<langle>M; j\\<rangle> \\<turnstile>\\<^sub>n t\\<^sub>i\"\n              using gS DecomposeN.hyps(2,4) Ana_fun_subterm[of g S K T]\n                    deduct_normalize[of M \"\\<lambda>f T. P (Fun f T)\", OF M DecomposeN.hyps(1) *]\n              by force\n            hence \"\\<exists>j<Suc (Max (insert l (steps ` set K))). \\<langle>M; j\\<rangle> \\<turnstile>\\<^sub>n t\\<^sub>i\"\n              using Max_less_iff[of \"insert l (steps ` set K)\"\n                                    \"Suc (Max (insert l (steps ` set K)))\"]\n                    less_trans[of _ l \"Suc (Max (insert l (steps ` set K)))\"]\n              by blast\n            thus ?thesis using DecomposeN.prems(1,2) by meson\n          qed\n        qed auto\n      qed\n    qed\n  } thus ?thesis using deduct_num_if_deduct m(1) by metis\nqed\n\nlemma restricted_deduct_if_deduct':\n  assumes \"\\<forall>m \\<in> M. P m\"\n    and \"\\<forall>t t'. P t \\<longrightarrow> t' \\<sqsubseteq> t \\<longrightarrow> P t'\"\n    and \"\\<forall>t K T k. P t \\<longrightarrow> Ana t = (K, T) \\<longrightarrow> k \\<in> set K \\<longrightarrow> P k\"\n    and \"M \\<turnstile> m\" \"P m\"\n  shows \"\\<langle>M; P\\<rangle> \\<turnstile>\\<^sub>r m\"\nusing restricted_deduct_if_deduct[of M P m] assms\nby blast\n\nlemma private_const_deduct:\n  assumes c: \"\\<not>public c\" \"M \\<turnstile> (Fun c []::('fun,'var) term)\"\n  shows \"Fun c [] \\<in> M \\<or>\n         (\\<exists>m \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t M. M \\<turnstile> m \\<and> (\\<forall>k \\<in> set (fst (Ana m)). M \\<turnstile> m) \\<and>\n                             Fun c [] \\<in> set (snd (Ana m)))\"\nproof -\n  obtain n where \"\\<langle>M; n\\<rangle> \\<turnstile>\\<^sub>n Fun c []\"\n    using c(2) deduct_num_if_deduct by moura\n  hence \"Fun c [] \\<in> M \\<or>\n         (\\<exists>m \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t M.\n            (\\<exists>l < n. \\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n m) \\<and>\n            (\\<forall>k \\<in> set (fst (Ana m)). \\<exists>l < n. \\<langle>M; l\\<rangle> \\<turnstile>\\<^sub>n k) \\<and> Fun c [] \\<in> set (snd (Ana m)))\"\n    using deduct_inv[of M n \"Fun c []\"] c(1) by fast\n  thus ?thesis using deduct_if_deduct_num[of M] by blast\nqed\n\nlemma private_fun_deduct_in_ik'':\n  assumes t: \"M \\<turnstile> Fun f T\" \"Fun c [] \\<in> set T\" \"\\<forall>m \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t M. Fun f T \\<notin> set (snd (Ana m))\"\n    and c: \"\\<not>public c\" \"Fun c [] \\<notin> M\" \"\\<forall>m \\<in> subterms\\<^sub>s\\<^sub>e\\<^sub>t M. Fun c [] \\<notin> set (snd (Ana m))\"\n  shows \"Fun f T \\<in> M\"\nproof -\n  have *: \"\\<nexists>n. \\<langle>M; n\\<rangle> \\<turnstile>\\<^sub>n Fun c []\"\n    using private_const_deduct[OF c(1)] c(2,3) deduct_if_deduct_num\n    by blast\n\n  obtain n where n: \"\\<langle>M; n\\<rangle> \\<turnstile>\\<^sub>n Fun f T\"\n    using t(1) deduct_num_if_deduct\n    by blast\n\n  show ?thesis\n    using deduct_inv[OF n] t(2,3) *\n    by blast\nqed\n\nend\n\nsubsection \\<open>Executable Definitions for Code Generation\\<close>\nfun intruder_synth' where\n  \"intruder_synth' pu ar M (Var x) = (Var x \\<in> M)\"\n| \"intruder_synth' pu ar M (Fun f T) = (\n    Fun f T \\<in> M \\<or> (pu f \\<and> length T = ar f \\<and> list_all (intruder_synth' pu ar M) T))\"\n\ndefinition \"wf\\<^sub>t\\<^sub>r\\<^sub>m' ar t \\<equiv> (\\<forall>s \\<in> subterms t. is_Fun s \\<longrightarrow> ar (the_Fun s) = length (args s))\"\n\ndefinition \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s' ar M \\<equiv> (\\<forall>t \\<in> M. wf\\<^sub>t\\<^sub>r\\<^sub>m' ar t)\"\n\ndefinition \"analyzed_in' An pu ar t M \\<equiv> (case An t of\n    (K,T) \\<Rightarrow> (\\<forall>k \\<in> set K. intruder_synth' pu ar M k) \\<longrightarrow> (\\<forall>s \\<in> set T. intruder_synth' pu ar M s))\"\n\nlemma (in intruder_model) intruder_synth'_induct[consumes 1, case_names Var Fun]:\n  assumes \"intruder_synth' public arity M t\"\n          \"\\<And>x. intruder_synth' public arity M (Var x) \\<Longrightarrow> P (Var x)\"\n          \"\\<And>f T. (\\<And>z. z \\<in> set T \\<Longrightarrow> intruder_synth' public arity M z \\<Longrightarrow> P z) \\<Longrightarrow>\n                  intruder_synth' public arity M (Fun f T) \\<Longrightarrow> P (Fun f T) \"\n  shows \"P t\"\nusing assms by (induct public arity M t rule: intruder_synth'.induct) auto\n\nlemma (in intruder_model) wf\\<^sub>t\\<^sub>r\\<^sub>m_code[code_unfold]:\n  \"wf\\<^sub>t\\<^sub>r\\<^sub>m t = wf\\<^sub>t\\<^sub>r\\<^sub>m' arity t\"\nunfolding wf\\<^sub>t\\<^sub>r\\<^sub>m_def wf\\<^sub>t\\<^sub>r\\<^sub>m'_def\nby auto\n\nlemma (in intruder_model) wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s_code[code_unfold]:\n  \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s M = wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s' arity M\"\nusing wf\\<^sub>t\\<^sub>r\\<^sub>m_code\nunfolding wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s'_def\nby auto\n\nlemma (in intruder_model) intruder_synth_code[code_unfold]:\n  \"intruder_synth M t = intruder_synth' public arity M t\"\n  (is \"?A \\<longleftrightarrow> ?B\")\nproof\n  show \"?A \\<Longrightarrow> ?B\"\n  proof (induction t rule: intruder_synth_induct)\n    case (AxiomC t) thus ?case by (cases t) auto\n  qed (fastforce simp add: list_all_iff)\n\n  show \"?B \\<Longrightarrow> ?A\"\n  proof (induction t rule: intruder_synth'_induct)\n    case (Fun f T) thus ?case\n    proof (cases \"Fun f T \\<in> M\")\n      case False\n      hence \"public f\" \"length T = arity f\" \"list_all (intruder_synth' public arity M) T\"\n        using Fun.hyps by fastforce+\n      thus ?thesis\n        using Fun.IH intruder_synth.ComposeC[of T f M] Ball_set[of T]\n        by blast\n    qed simp\n  qed simp\nqed\n\nlemma (in intruder_model) analyzed_in_code[code_unfold]:\n  \"analyzed_in t M = analyzed_in' Ana public arity t M\"\nusing intruder_synth_code[of M]\nunfolding analyzed_in_def analyzed_in'_def\nby fastforce\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Stateful_Protocol_Composition_and_Typing/Intruder_Deduction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.3403117782996634}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory ListRev\nimports \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"list_rev.c\"\ninstall_C_file \"list_rev.c\"\n\nautocorres [heap_abs_syntax] \"list_rev.c\"\n\nprimrec\n  list :: \"lifted_globals \\<Rightarrow> node_C ptr \\<Rightarrow> node_C ptr list \\<Rightarrow> bool\"\nwhere\n  \"list s p [] = (p = NULL)\"\n| \"list s p (x#xs) = (\n       p = x \\<and> p \\<noteq> NULL \\<and> is_valid_node_C s p \\<and> list s (s[p]\\<rightarrow>next) xs)\"\n\nlemma list_empty [simp]:\n  \"list s NULL xs = (xs = [])\"\n  by (induct xs) auto\n\nlemma list_in [simp]:\n  \"\\<lbrakk> list s p xs; p \\<noteq> NULL \\<rbrakk> \\<Longrightarrow> p \\<in> set xs\"\n  by (induct xs) auto\n\nlemma list_non_NULL:\n  \"\\<lbrakk> p \\<noteq> NULL \\<rbrakk> \\<Longrightarrow>\n    list s p xs = (\\<exists>ys. xs = p # ys \\<and> is_valid_node_C s p \\<and> list s (s[p]\\<rightarrow>next) ys)\"\n  by (cases xs) auto\n\nlemma list_unique:\n  \"list s p xs \\<Longrightarrow> list s p ys \\<Longrightarrow> xs = ys\"\n  by (induct xs arbitrary: p ys) (auto simp add: list_non_NULL)\n\nlemma list_append_Ex:\n  \"list s p (xs @ ys) \\<Longrightarrow> (\\<exists>q. list s q ys)\"\n  by (induct xs arbitrary: p) auto\n\nlemma list_distinct [simp]:\n  \"list s p xs \\<Longrightarrow> distinct xs\"\n  apply (induct xs arbitrary: p)\n   apply simp\n  apply (clarsimp dest!: split_list)\n  apply (frule list_append_Ex)\n  apply (auto dest: list_unique)\n  done\n\nlemma list_heap_update_ignore [simp]:\n  \"q \\<notin> set xs \\<Longrightarrow> list (s[q\\<rightarrow>next := v]) p xs = list s p xs\"\n  apply (induct xs arbitrary: p)\n   apply clarsimp\n  apply (clarsimp simp: fun_upd_def)\n  done\n\ndefinition\n  the_list :: \"lifted_globals \\<Rightarrow> node_C ptr \\<Rightarrow> node_C ptr list\"\nwhere\n  \"the_list s p = (THE xs. list s p xs)\"\n\nlemma the_list_val [simp]: \"list s p xs \\<Longrightarrow> the_list s p = xs\"\n  apply (clarsimp simp: the_list_def)\n  apply (metis (lifting) list_unique the_equality)\n  done\n\n\n\ndefinition \"reverse_inv xs list' rev' s =\n                 (\\<exists>ys zs. list s list' ys\n                    \\<and> list s rev' zs\n                    \\<and> rev xs = rev ys @ zs\n                    \\<and> distinct (rev xs))\"\n\nlemma (in list_rev) reverse_correct:\n  \"\\<lbrace> \\<lambda>s. list s p xs \\<rbrace>\n     reverse' p\n   \\<lbrace> \\<lambda>rv s. list s rv (rev xs) \\<rbrace>!\"\n  apply (clarsimp simp: reverse'_def)\n  apply (subst whileLoop_add_inv [where\n        I=\"\\<lambda>(list', rev') s. reverse_inv xs list' rev' s\"\n        and M=\"\\<lambda>((list', rev'), s). length (the_list s list')\",\n        unfolded reverse_inv_def])\n  apply wp\n    apply (clarsimp simp del: distinct_rev)\n    apply (case_tac ys, fastforce)\n    apply (clarsimp simp del: distinct_rev)\n    apply (rule_tac x=lista in exI)\n    apply (simp add: fun_upd_def)\n   apply (clarsimp simp del: distinct_rev)\n  apply simp\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/tests/examples/ListRev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.3403117782996634}}
{"text": "theory flash50Bra  imports flash50Rev\n \n  begin\nlemma onInv50:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv50  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv50  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv50 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash50Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.685949467848392, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3402952983284481}}
{"text": "(*  Title:      HOL/Auth/n_mutualExSimp_lemma_inv__3_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExSimp Protocol Case Study*} \n\ntheory n_mutualExSimp_lemma_inv__3_on_rules imports n_mutualExSimp_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__3  p__Inv3 p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_CritVsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_ExitVsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_IdleVsinv__3) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExSimp/n_mutualExSimp_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300573952054, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.34029156840820424}}
{"text": "(*  Title:      HOL/Auth/n_mutualExSimp_lemma_inv__5_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExSimp Protocol Case Study*} \n\ntheory n_mutualExSimp_lemma_inv__5_on_rules imports n_mutualExSimp_lemma_on_inv__5\nbegin\nsection{*All lemmas on causal relation between inv__5*}\nlemma lemma_inv__5_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__5  p__Inv3 p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_CritVsinv__5) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_ExitVsinv__5) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_IdleVsinv__5) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExSimp/n_mutualExSimp_lemma_inv__5_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300449389326, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.34029156237463376}}
{"text": "(* \n    This file is a part of IsarMathLib - \n    a library of formalized mathematics for Isabelle/Isar.\n\n    Copyright (C) 2008 - 2019 Slawomir Kolodynski\n\n    This program is free software Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,\nINCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\nPARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,\nINDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE, DATA, OR PROFITS OR\nBUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\nSTRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE\nUSE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\nsection \\<open>Finite sets - introduction\\<close>\n\ntheory Finite_ZF imports ZF1 Nat_ZF_IML ZF.Cardinal\n\nbegin\n\ntext\\<open>Standard Isabelle Finite.thy contains a very useful \n  notion of finite powerset: the set of finite subsets of a given set.\n  The definition, however, is specific to Isabelle and based on the notion\n  of \"datatype\", obviously not something that belongs to ZF set theory.\n  This theory file devolops the notion of finite powerset similarly as\n  in Finite.thy, but based on standard library's \n  Cardinal.thy. This theory file is intended to \n  replace IsarMathLib's \\<open>Finite1\\<close> and \\<open>Finite_ZF_1\\<close> theories\n  that are currently derived from the \"datatype\" approach.\n\\<close>\n\nsubsection\\<open>Definition and basic properties of finite powerset\\<close>\n\ntext\\<open>The goal of this section is to prove an induction theorem about\n  finite powersets: if the empty set has some property and this property is \n  preserved by adding a single element of a set, \n  then this property is true for all finite subsets of this set.\\<close>\n\n\ntext\\<open>We defined the finite powerset \\<open>FinPow(X)\\<close> as those elements \n  of the powerset that are finite.\\<close>\n\ndefinition\n  \"FinPow(X) \\<equiv> {A \\<in> Pow(X). Finite(A)}\"\n\ntext\\<open>The cardinality of an element of finite powerset is a natural number.\\<close>\n\nlemma card_fin_is_nat: assumes \"A \\<in> FinPow(X)\" \n  shows \"|A| \\<in> nat\" and \"A \\<approx> |A|\"\n  using assms FinPow_def Finite_def cardinal_cong nat_into_Card \n    Card_cardinal_eq by auto\n\ntext\\<open>A reformulation of \\<open>card_fin_is_nat\\<close>: for a finit\n  set $A$ there is a bijection between $|A|$ and $A$.\\<close>\n\nlemma fin_bij_card: assumes A1: \"A \\<in> FinPow(X)\"\n  shows \"\\<exists>b. b \\<in> bij(|A|, A)\"\nproof -\n  from A1 have \"|A| \\<approx> A\" using card_fin_is_nat eqpoll_sym\n    by blast\n  then show ?thesis using eqpoll_def by auto\nqed\n\ntext\\<open>If a set has the same number of elements as $n \\in \\mathbb{N}$, \n  then its cardinality is $n$. Recall that in set theory a natural number\n  $n$ is a set that has $n$ elements.\\<close>\n\nlemma card_card: assumes \"A \\<approx> n\" and \"n \\<in> nat\"\n  shows \"|A| = n\"\n  using assms cardinal_cong nat_into_Card Card_cardinal_eq\n  by auto\n\ntext\\<open>If we add a point to a finite set, the cardinality \n  increases by one. To understand the second assertion\n  $| A \\cup \\{ a\\}| = |A| \\cup \\{ |A|\\} $ recall that\n  the cardinality $|A|$ of $A$ is a natural number\n  and for natural numbers we have $n+1 = n \\cup \\{ n\\}$. \n\\<close>\n\nlemma card_fin_add_one: assumes A1: \"A \\<in> FinPow(X)\" and A2: \"a \\<in> X-A\"\n  shows \n  \"|A \\<union> {a}| = succ( |A| )\"\n  \"|A \\<union> {a}| = |A| \\<union> {|A|}\"\nproof -\n  from A1 A2 have \"cons(a,A) \\<approx> cons( |A|, |A| )\"\n    using card_fin_is_nat mem_not_refl cons_eqpoll_cong\n    by auto\n  moreover have  \"cons(a,A) = A \\<union> {a}\" by (rule consdef) \n  moreover have \"cons( |A|, |A| ) = |A| \\<union> {|A|}\"\n    by (rule consdef)\n  ultimately have \"A\\<union>{a} \\<approx> succ( |A| )\" using succ_explained\n    by simp\n  with A1 show \n    \"|A \\<union> {a}| = succ( |A| )\" and \"|A \\<union> {a}| = |A| \\<union> {|A|}\"\n    using card_fin_is_nat card_card by auto\nqed\n  \ntext\\<open>We can decompose the finite powerset into collection of\n  sets of the same natural cardinalities.\\<close>\n\nlemma finpow_decomp: \n  shows \"FinPow(X) = (\\<Union>n \\<in> nat. {A \\<in> Pow(X). A \\<approx> n})\"\n  using Finite_def FinPow_def by auto\n\ntext\\<open>Finite powerset is the union of sets of cardinality\n  bounded by natural numbers.\\<close>\n\nlemma finpow_union_card_nat: \n  shows \"FinPow(X) = (\\<Union>n \\<in> nat. {A \\<in> Pow(X). A \\<lesssim> n})\"\nproof -\n  have \"FinPow(X) \\<subseteq> (\\<Union>n \\<in> nat. {A \\<in> Pow(X). A \\<lesssim> n})\"\n    using finpow_decomp FinPow_def eqpoll_imp_lepoll\n    by auto\n  moreover have \n    \"(\\<Union>n \\<in> nat. {A \\<in> Pow(X). A \\<lesssim> n}) \\<subseteq> FinPow(X)\"\n    using lepoll_nat_imp_Finite FinPow_def by auto\n  ultimately show ?thesis by auto\nqed\n\ntext\\<open>A different form of \\<open>finpow_union_card_nat\\<close> (see above) -\n  a subset that has not more elements than a given natural number \n  is in the finite powerset.\\<close>\n\nlemma lepoll_nat_in_finpow: \n  assumes \"n \\<in> nat\"   \"A \\<subseteq> X\"  \"A \\<lesssim> n\"\n  shows \"A \\<in> FinPow(X)\"\n  using assms finpow_union_card_nat by auto\n\ntext\\<open>Natural numbers are finite subsets of the set of natural numbers.\\<close>\n\nlemma nat_finpow_nat: assumes \"n \\<in> nat\" shows \"n \\<in> FinPow(nat)\"\n  using assms nat_into_Finite nat_subset_nat FinPow_def\n  by simp\n  \ntext\\<open>A finite subset is a finite subset of itself.\\<close>\n\nlemma fin_finpow_self: assumes \"A \\<in> FinPow(X)\" shows \"A \\<in> FinPow(A)\"\n  using assms FinPow_def by auto\n\ntext\\<open>If we remove an element and put it back we get the set back.\n\\<close>\n\nlemma rem_add_eq: assumes \"a\\<in>A\" shows \"(A-{a}) \\<union> {a} = A\"\n  using assms by auto\n\ntext\\<open>Induction for finite powerset. This is smilar to the\n  standard Isabelle's \\<open>Fin_induct\\<close>.\\<close>\n\ntheorem FinPow_induct: assumes A1: \"P(0)\" and\n  A2: \"\\<forall>A \\<in> FinPow(X). P(A) \\<longrightarrow> (\\<forall>a\\<in>X. P(A \\<union> {a}))\" and\n  A3: \"B \\<in> FinPow(X)\"\n  shows \"P(B)\"\nproof -\n  { fix n assume \"n \\<in> nat\"\n    moreover from A1 have I: \"\\<forall>B\\<in>Pow(X). B \\<lesssim> 0 \\<longrightarrow> P(B)\"\n      using lepoll_0_is_0 by auto\n    moreover have \"\\<forall> k \\<in> nat. \n      (\\<forall>B \\<in> Pow(X). (B \\<lesssim> k \\<longrightarrow> P(B))) \\<longrightarrow> \n      (\\<forall>B \\<in> Pow(X). (B \\<lesssim> succ(k) \\<longrightarrow> P(B)))\"\n    proof -\n      { fix k assume A4: \"k \\<in> nat\"\n\tassume A5: \"\\<forall> B \\<in> Pow(X). (B \\<lesssim> k \\<longrightarrow> P(B))\"\n\tfix B assume A6: \"B \\<in> Pow(X)\"  \"B \\<lesssim> succ(k)\"\n\thave \"P(B)\"\n\tproof -\n\t  have \"B = 0 \\<longrightarrow> P(B)\"\n\t  proof -\n\t    { assume \"B = 0\"\n\t      then have \"B \\<lesssim> 0\" using lepoll_0_iff\n\t\tby simp\n\t      with I A6 have \"P(B)\" by simp \n\t    } thus \"B = 0 \\<longrightarrow> P(B)\" by simp\n\t  qed\n\t  moreover have \"B\\<noteq>0 \\<longrightarrow> P(B)\"\n\t  proof -\n\t    { assume \"B \\<noteq> 0\"\n\t      then obtain a where II: \"a\\<in>B\" by auto\n\t      let ?A = \"B - {a}\"\n\t      from A6 II have \"?A \\<subseteq> X\" and \"?A \\<lesssim> k\" \n\t\tusing Diff_sing_lepoll by auto\n\t      with A4 A5 have \"?A \\<in> FinPow(X)\" and \"P(?A)\" \n\t\tusing lepoll_nat_in_finpow finpow_decomp \n\t\tby auto\n\t      with A2 A6 II have \" P(?A \\<union> {a})\"\n\t\tby auto\n\t      moreover from II have \"?A \\<union> {a} = B\"\n\t\tby auto\n\t      ultimately have \"P(B)\" by simp \n\t    } thus \"B\\<noteq>0 \\<longrightarrow> P(B)\" by simp\n\t  qed\n\t  ultimately show \"P(B)\" by auto\n\tqed\n      } thus ?thesis by blast\n    qed\n    ultimately have \"\\<forall>B \\<in> Pow(X). (B \\<lesssim> n \\<longrightarrow> P(B))\"\n      by (rule ind_on_nat)\n  } then have \"\\<forall>n \\<in> nat. \\<forall>B \\<in> Pow(X). (B \\<lesssim> n \\<longrightarrow> P(B))\"\n    by auto\n  with A3 show \"P(B)\" using finpow_union_card_nat\n    by auto\nqed\n\ntext\\<open>A subset of a finite subset is a finite subset.\\<close>\n\nlemma subset_finpow: assumes \"A \\<in> FinPow(X)\" and \"B \\<subseteq> A\"\n  shows \"B \\<in> FinPow(X)\"\n  using assms FinPow_def subset_Finite by auto\n\ntext\\<open>If we subtract anything from a finite set, \n  the resulting set is finite.\\<close>\n\nlemma diff_finpow: \n  assumes \"A \\<in> FinPow(X)\" shows \"A-B \\<in> FinPow(X)\"\n  using assms subset_finpow by blast\n\ntext\\<open>If we remove a point from a finites subset,\n  we get a finite subset.\\<close>\n\ncorollary fin_rem_point_fin: assumes \"A \\<in> FinPow(X)\"\n  shows \"A - {a} \\<in> FinPow(X)\"\n  using assms diff_finpow by simp\n\ntext\\<open>Cardinality of a nonempty finite set is a successsor\n  of some natural number.\\<close>\n\nlemma card_non_empty_succ: \n  assumes A1: \"A \\<in> FinPow(X)\" and A2: \"A \\<noteq> 0\"\n  shows \"\\<exists>n \\<in> nat. |A| = succ(n)\"\nproof -\n  from A2 obtain a where \"a \\<in> A\" by auto\n  let ?B = \"A - {a}\"\n  from A1 \\<open>a \\<in> A\\<close> have \n    \"?B \\<in> FinPow(X)\" and \"a \\<in> X - ?B\"\n    using FinPow_def fin_rem_point_fin by auto\n  then have \"|?B \\<union> {a}| = succ( |?B| )\"\n    using card_fin_add_one by auto\n  moreover from \\<open>a \\<in> A\\<close> \\<open>?B \\<in> FinPow(X)\\<close> have \n    \"A = ?B \\<union> {a}\" and \"|?B| \\<in> nat\"\n    using card_fin_is_nat by auto\n  ultimately show \"\\<exists>n \\<in> nat. |A| = succ(n)\" by auto\nqed\n\ntext\\<open>Nonempty set has non-zero cardinality. This is probably\n  true without the assumption that the set is finite, but\n  I couldn't derive it from standard Isabelle theorems.\n\\<close>\n\nlemma card_non_empty_non_zero:\n  assumes \"A \\<in> FinPow(X)\" and \"A \\<noteq> 0\"\n  shows \"|A| \\<noteq> 0\"\nproof -\n  from assms obtain n where \"|A| = succ(n)\"\n    using card_non_empty_succ by auto\n  then show \"|A| \\<noteq> 0\" using succ_not_0\n    by simp\nqed\n\ntext\\<open>Another variation on the induction theme:\n  If we can show something holds for the empty set and\n  if it holds for all finite sets with \n  at most $k$ elements then it holds for all \n  finite sets with at most $k+1$\n  elements, the it holds for all finite sets.\\<close>\n\ntheorem FinPow_card_ind: assumes A1: \"P(0)\" and\n  A2: \"\\<forall>k\\<in>nat.\n  (\\<forall>A \\<in> FinPow(X). A \\<lesssim> k \\<longrightarrow> P(A)) \\<longrightarrow>\n  (\\<forall>A \\<in> FinPow(X). A \\<lesssim> succ(k) \\<longrightarrow> P(A))\"\n  and A3: \"A \\<in>  FinPow(X)\" shows \"P(A)\"\nproof -\n  from A3 have \"|A| \\<in> nat\" and \"A \\<in>  FinPow(X)\" and \"A \\<lesssim> |A|\"\n    using card_fin_is_nat eqpoll_imp_lepoll by auto\n  moreover have \"\\<forall>n \\<in> nat. (\\<forall>A \\<in> FinPow(X).\n    A \\<lesssim> n \\<longrightarrow> P(A))\"\n  proof\n    fix n assume \"n \\<in> nat\"\n    moreover from A1 have \"\\<forall>A \\<in> FinPow(X). A \\<lesssim> 0 \\<longrightarrow> P(A)\"\n      using lepoll_0_is_0 by auto\n    moreover note A2\n    ultimately show\n      \"\\<forall>A \\<in> FinPow(X). A \\<lesssim> n \\<longrightarrow> P(A)\"\n      by (rule ind_on_nat)\n  qed\n  ultimately show \"P(A)\" by simp\nqed  \n\ntext\\<open>Another type of induction (or, maybe recursion).\n  In the induction step  we try to find a point in the set that\n  if we remove it, the fact that the property holds for the \n  smaller set implies that the property holds for the whole set. \n\\<close>\n\nlemma FinPow_ind_rem_one: assumes A1: \"P(0)\" and \n  A2: \"\\<forall> A \\<in> FinPow(X). A \\<noteq> 0 \\<longrightarrow> (\\<exists>a\\<in>A. P(A-{a}) \\<longrightarrow> P(A))\"\n  and A3: \"B \\<in>  FinPow(X)\"\n  shows \"P(B)\"\nproof -\n  note A1\n  moreover have \"\\<forall>k\\<in>nat.\n  (\\<forall>B \\<in> FinPow(X). B \\<lesssim> k \\<longrightarrow> P(B)) \\<longrightarrow>\n  (\\<forall>C \\<in> FinPow(X). C \\<lesssim> succ(k) \\<longrightarrow> P(C))\"\n  proof -\n    { fix k assume \"k \\<in> nat\"\n      assume A4: \"\\<forall>B \\<in> FinPow(X). B \\<lesssim> k \\<longrightarrow> P(B)\"\n      have \"\\<forall>C \\<in> FinPow(X). C \\<lesssim> succ(k) \\<longrightarrow> P(C)\"\n      proof -\n\t{ fix C assume \"C \\<in> FinPow(X)\"\n\t  assume \"C \\<lesssim> succ(k)\"\n\t  note A1\n\t  moreover\n\t  { assume \"C \\<noteq> 0\"\n\t    with A2 \\<open>C \\<in> FinPow(X)\\<close> obtain a where\n\t      \"a\\<in>C\" and \"P(C-{a}) \\<longrightarrow> P(C)\"\n\t      by auto\n\t    with A4 \\<open>C \\<in> FinPow(X)\\<close> \\<open>C \\<lesssim> succ(k)\\<close>\n\t    have \"P(C)\" using Diff_sing_lepoll fin_rem_point_fin\n\t      by simp }\n\t  ultimately have \"P(C)\" by auto\n\t} thus ?thesis by simp\n      qed\n    } thus ?thesis by blast\n  qed\n  moreover note A3\n  ultimately show \"P(B)\" by (rule FinPow_card_ind)\nqed\n\ntext\\<open>Yet another induction theorem. This is similar, but \n  slightly more complicated than \\<open>FinPow_ind_rem_one\\<close>.\n  The difference is in the treatment of the empty set to allow \n  to show properties that are not true for empty set.\n\\<close>\n\nlemma FinPow_rem_ind: assumes A1: \"\\<forall>A \\<in> FinPow(X). \n  A = 0 \\<or> (\\<exists>a\\<in>A. A = {a} \\<or> P(A-{a}) \\<longrightarrow> P(A))\"\n  and A2: \"A \\<in>  FinPow(X)\" and A3: \"A\\<noteq>0\"\n  shows \"P(A)\"\nproof -\n  have \"0 = 0 \\<or> P(0)\" by simp\n  moreover have\n    \"\\<forall>k\\<in>nat.\n    (\\<forall>B \\<in> FinPow(X). B \\<lesssim> k \\<longrightarrow> (B=0 \\<or> P(B))) \\<longrightarrow>\n    (\\<forall>A \\<in> FinPow(X). A \\<lesssim> succ(k) \\<longrightarrow> (A=0 \\<or> P(A)))\"\n  proof -\n    { fix k assume \"k \\<in> nat\"\n      assume A4: \"\\<forall>B \\<in> FinPow(X). B \\<lesssim> k \\<longrightarrow> (B=0 \\<or> P(B))\"\n      have \"\\<forall>A \\<in> FinPow(X). A \\<lesssim> succ(k) \\<longrightarrow> (A=0 \\<or> P(A))\"\n      proof -\n\t{ fix A assume \"A \\<in> FinPow(X)\"\n\t  assume \"A \\<lesssim> succ(k)\"  \"A\\<noteq>0\"\n\t  from A1 \\<open>A \\<in> FinPow(X)\\<close> \\<open>A\\<noteq>0\\<close> obtain a \n\t    where \"a\\<in>A\" and \"A = {a} \\<or> P(A-{a}) \\<longrightarrow> P(A)\"\n\t    by auto\n\t  let ?B = \"A-{a}\"\n\t  from A4 \\<open>A \\<in> FinPow(X)\\<close> \\<open>A \\<lesssim> succ(k)\\<close> \\<open>a\\<in>A\\<close>\n\t  have \"?B = 0 \\<or> P(?B)\" \n\t    using Diff_sing_lepoll fin_rem_point_fin\n\t    by simp\n\t  with \\<open>a\\<in>A\\<close> \\<open>A = {a} \\<or> P(A-{a}) \\<longrightarrow> P(A)\\<close>\n\t  have \"P(A)\" by auto\n\t} thus  ?thesis by auto\n      qed\t  \n    } thus ?thesis by blast\n  qed\n  moreover note A2\n  ultimately have \"A=0 \\<or> P(A)\" by (rule FinPow_card_ind)\n  with A3 show \"P(A)\" by simp\nqed\n\ntext\\<open>If a family of sets is closed with respect to taking intersections\n  of two sets then it is closed with respect to taking intersections \n  of any nonempty finite collection.\\<close>\n\nlemma inter_two_inter_fin: \n  assumes A1: \"\\<forall>V\\<in>T. \\<forall>W\\<in>T. V \\<inter> W \\<in> T\" and\n  A2: \"N \\<noteq> 0\" and A3: \"N \\<in> FinPow(T)\"\n  shows \"(\\<Inter>N \\<in> T)\"\nproof -\n  have \"0 = 0 \\<or> (\\<Inter>0 \\<in> T)\" by simp\n  moreover have \"\\<forall>M \\<in> FinPow(T). (M = 0 \\<or> \\<Inter>M \\<in> T) \\<longrightarrow> \n    (\\<forall>W \\<in> T. M\\<union>{W} = 0 \\<or> \\<Inter>(M \\<union> {W}) \\<in> T)\"\n  proof -\n    { fix M assume \"M \\<in> FinPow(T)\"\n      assume A4: \"M = 0 \\<or> \\<Inter>M \\<in> T\"\n      { assume \"M = 0\"\n\thence \"\\<forall>W \\<in> T. M\\<union>{W} = 0 \\<or> \\<Inter>(M \\<union> {W}) \\<in> T\"\n\t  by auto }\n      moreover\n      { assume \"M \\<noteq> 0\" \n\twith A4 have \"\\<Inter>M \\<in> T\" by simp\n\t{ fix W assume \"W \\<in> T\"\n\t  from \\<open>M \\<noteq> 0\\<close> have \"\\<Inter>(M \\<union> {W}) = (\\<Inter>M) \\<inter> W\" \n\t    by auto\n\t  with A1 \\<open>\\<Inter>M \\<in> T\\<close> \\<open>W \\<in> T\\<close> have \"\\<Inter>(M \\<union> {W}) \\<in> T\"\n\t    by simp\n\t} hence \"\\<forall>W \\<in> T. M\\<union>{W} = 0 \\<or> \\<Inter>(M \\<union> {W}) \\<in> T\"\n\t  by simp }\n      ultimately have \"\\<forall>W \\<in> T. M\\<union>{W} = 0 \\<or> \\<Inter>(M \\<union> {W}) \\<in> T\"\n\tby blast\n    } thus ?thesis by simp\n  qed\n  moreover note \\<open>N \\<in> FinPow(T)\\<close>\n  ultimately have \"N = 0 \\<or> (\\<Inter>N \\<in> T)\"\n    by (rule FinPow_induct)\n  with A2 show \"(\\<Inter>N \\<in> T)\" by simp\nqed\n\ntext\\<open>If a family of sets contains the empty set and\n  is closed with respect to taking unions\n  of two sets then it is closed with respect to taking unions \n  of any finite collection.\\<close>\n\nlemma union_two_union_fin:\n  assumes A1: \"0 \\<in> C\" and A2: \"\\<forall>A\\<in>C. \\<forall>B\\<in>C. A\\<union>B \\<in> C\" and \n  A3: \"N \\<in> FinPow(C)\"\n  shows \"\\<Union>N \\<in> C\"\nproof -\n  from \\<open>0 \\<in> C\\<close> have \"\\<Union>0 \\<in> C\" by simp\n  moreover have \"\\<forall>M \\<in> FinPow(C). \\<Union>M \\<in> C \\<longrightarrow> (\\<forall>A\\<in>C. \\<Union>(M \\<union> {A}) \\<in> C)\"\n  proof -\n    { fix M assume \"M \\<in> FinPow(C)\"\n      assume \"\\<Union>M \\<in> C\"\n      fix A assume \"A\\<in>C\"\n      have \"\\<Union>(M \\<union> {A}) = (\\<Union>M) \\<union> A\" by auto\n      with A2 \\<open>\\<Union>M \\<in> C\\<close>  \\<open>A\\<in>C\\<close> have  \"\\<Union>(M \\<union> {A}) \\<in> C\"\n\tby simp\n    } thus ?thesis by simp\n  qed\n  moreover note \\<open>N \\<in> FinPow(C)\\<close>\n  ultimately show \"\\<Union>N \\<in> C\" by (rule FinPow_induct)\nqed\n\ntext\\<open>Empty set is in finite power set.\\<close>\n\nlemma empty_in_finpow: shows \"0 \\<in> FinPow(X)\"\n  using FinPow_def by simp\n\ntext\\<open>Singleton is in the finite powerset.\\<close>\n\nlemma singleton_in_finpow: assumes \"x \\<in> X\"\n  shows \"{x} \\<in> FinPow(X)\" using assms FinPow_def by simp\n\ntext\\<open>Union of two finite subsets is a finite subset.\\<close>\n\nlemma union_finpow: assumes \"A \\<in> FinPow(X)\" and \"B \\<in> FinPow(X)\"\n  shows \"A \\<union> B \\<in> FinPow(X)\"\n  using assms FinPow_def by auto\n\ntext\\<open>Union of finite number of finite sets is finite.\\<close>\n\nlemma fin_union_finpow: assumes \"M \\<in> FinPow(FinPow(X))\"\n  shows \"\\<Union>M \\<in> FinPow(X)\"\n  using assms empty_in_finpow union_finpow union_two_union_fin\n  by simp\n\n(*text{*A subset of a finites subset is a finite subset.*}\n\nlemma subset_finpow: assumes \"A \\<in> FinPow(X)\" and \"B \\<subseteq> A\"\n  shows \"B \\<in> FinPow(X)\"\n  using assms FinPow_def subset_Finite by auto;*)\ntext\\<open>If a set is finite after removing one element, then it is finite.\\<close>\n\nlemma rem_point_fin_fin: \n  assumes A1: \"x \\<in> X\" and A2: \"A - {x} \\<in> FinPow(X)\"\n  shows \"A \\<in> FinPow(X)\"\nproof -\n  from assms have \"(A - {x}) \\<union> {x} \\<in> FinPow(X)\"\n    using singleton_in_finpow union_finpow by simp\n  moreover have \"A \\<subseteq> (A - {x}) \\<union> {x}\" by auto\n  ultimately show \"A \\<in> FinPow(X)\" \n    using FinPow_def subset_Finite by auto\nqed\n \ntext\\<open>An image of a finite set is finite.\\<close>\n  \nlemma fin_image_fin: assumes \"\\<forall>V\\<in>B. K(V)\\<in>C\" and \"N \\<in> FinPow(B)\"\n  shows \"{K(V). V\\<in>N} \\<in> FinPow(C)\"\nproof -\n  have \"{K(V). V\\<in>0} \\<in> FinPow(C)\" using FinPow_def\n    by auto\n  moreover have \"\\<forall>A \\<in> FinPow(B). \n    {K(V). V\\<in>A} \\<in> FinPow(C) \\<longrightarrow> (\\<forall>a\\<in>B. {K(V). V \\<in> (A \\<union> {a})} \\<in> FinPow(C))\"\n  proof -\n    { fix A assume \"A \\<in> FinPow(B)\"\n      assume  \"{K(V). V\\<in>A} \\<in> FinPow(C)\"\n      fix a assume \"a\\<in>B\"\n      have  \"{K(V). V \\<in> (A \\<union> {a})} \\<in> FinPow(C)\"\n      proof -\n\thave \"{K(V). V \\<in> (A \\<union> {a})} = {K(V). V\\<in>A} \\<union> {K(a)}\"\n\t  by auto\n\tmoreover note \\<open>{K(V). V\\<in>A} \\<in> FinPow(C)\\<close>\n\tmoreover from \\<open>\\<forall>V\\<in>B. K(V) \\<in> C\\<close>  \\<open>a\\<in>B\\<close> have \"{K(a)} \\<in>  FinPow(C)\"\n\t  using singleton_in_finpow by simp\n\tultimately show ?thesis using union_finpow by simp\n      qed\n    } thus ?thesis by simp\n  qed\n  moreover note \\<open>N \\<in> FinPow(B)\\<close>\n  ultimately show \"{K(V). V\\<in>N} \\<in> FinPow(C)\"\n    by (rule FinPow_induct)\nqed\n\ntext\\<open>Union of a finite indexed family of finite sets is finite.\\<close>\n\nlemma union_fin_list_fin: \n  assumes A1: \"n \\<in> nat\" and A2: \"\\<forall>k \\<in> n. N(k) \\<in> FinPow(X)\"\n  shows \n  \"{N(k). k \\<in> n} \\<in>  FinPow(FinPow(X))\" and \"(\\<Union>k \\<in> n. N(k)) \\<in> FinPow(X)\"\nproof -\n  from A1 have \"n \\<in> FinPow(n)\" \n    using nat_finpow_nat fin_finpow_self by auto\n  with A2 show \"{N(k). k \\<in> n} \\<in>  FinPow(FinPow(X))\"\n    by (rule fin_image_fin)\n  then show \"(\\<Union>k \\<in> n. N(k)) \\<in> FinPow(X)\"\n    using fin_union_finpow by simp\nqed\n  \nend\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/Finite_ZF.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.6548947357776796, "lm_q1q2_score": 0.34023177887068673}}
{"text": "theory TopoS_Helper\nimports Main TopoS_Interface \n  TopoS_ENF\n  vertex_example_simps\nbegin\n\nlemma (in SecurityInvariant_preliminaries) sinvar_valid_remove_flattened_offending_flows:\n  assumes \"wf_graph \\<lparr>nodes = nodesG, edges = edgesG\\<rparr>\" (*TODO: we could get rid of this assumption*)\n  shows \"sinvar \\<lparr>nodes = nodesG, edges = edgesG - \\<Union> (set_offending_flows \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP) \\<rparr> nP\"\nproof -\n  { fix f\n    assume *: \"f\\<in>set_offending_flows \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP\"\n\n    from * have 1: \"sinvar \\<lparr>nodes = nodesG, edges = edgesG - f \\<rparr> nP\"\n      by (metis (hide_lams, mono_tags) SecurityInvariant_withOffendingFlows.valid_without_offending_flows delete_edges_simp2 graph.select_convs(1) graph.select_convs(2))\n    from * have 2: \"edgesG - \\<Union> (set_offending_flows \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP) \\<subseteq> edgesG - f\"\n      by blast\n    note 1 2\n  }\n  with assms show ?thesis \n    by (metis (hide_lams, no_types) Diff_empty Union_empty defined_offending equals0I mono_sinvar wf_graph_remove_edges)\nqed\n\n\nlemma (in SecurityInvariant_preliminaries) sinvar_valid_remove_SOME_offending_flows:\n  assumes \"set_offending_flows \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP \\<noteq> {}\"\n  shows \"sinvar \\<lparr>nodes = nodesG, edges = edgesG - (SOME F. F \\<in> set_offending_flows \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP) \\<rparr> nP\"\nproof -\n  { fix f\n    assume *: \"f\\<in>set_offending_flows \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP\"\n\n    from * have 1: \"sinvar \\<lparr>nodes = nodesG, edges = edgesG - f \\<rparr> nP\"\n      by (metis (hide_lams, mono_tags) SecurityInvariant_withOffendingFlows.valid_without_offending_flows delete_edges_simp2 graph.select_convs(1) graph.select_convs(2))\n    from * have 2: \"edgesG - \\<Union> (set_offending_flows \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP) \\<subseteq> edgesG - f\"\n      by blast\n    note 1 2\n  }\n  with assms show ?thesis by (simp add: some_in_eq)\nqed\n\n\nlemma (in SecurityInvariant_preliminaries) sinvar_valid_remove_minimalize_offending_overapprox:\n  assumes \"wf_graph \\<lparr>nodes = nodesG, edges = edgesG\\<rparr>\"\n      and \"\\<not> sinvar \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP\" (*\"set_offending_flows \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP \\<noteq> {}\"*)\n      and \"set Es = edgesG\" and \"distinct Es\"\n  shows \"sinvar \\<lparr>nodes = nodesG, edges = edgesG -\n              set (minimalize_offending_overapprox Es [] \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP) \\<rparr> nP\"\nproof -\n  from assms have off_Es: \"is_offending_flows (set Es) \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP\"\n    by (metis (no_types, lifting) Diff_cancel\n        SecurityInvariant_withOffendingFlows.valid_empty_edges_iff_exists_offending_flows defined_offending\n        delete_edges_simp2 graph.select_convs(2) is_offending_flows_def sinvar_monoI) \n  from minimalize_offending_overapprox_gives_back_an_offending_flow[OF assms(1) off_Es _ assms(4)] have\n    in_offending: \"set (minimalize_offending_overapprox Es [] \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP)\n      \\<in> set_offending_flows \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP\"\n     using assms(3) by simp\n\n  { fix f\n    assume *: \"f\\<in>set_offending_flows \\<lparr>nodes = nodesG, edges = edgesG\\<rparr> nP\"\n    from * have 1: \"sinvar \\<lparr>nodes = nodesG, edges = edgesG - f \\<rparr> nP\"\n      by (metis (hide_lams, mono_tags) SecurityInvariant_withOffendingFlows.valid_without_offending_flows delete_edges_simp2 graph.select_convs(1) graph.select_convs(2))\n    note 1\n  }\n  with in_offending show ?thesis by (simp add: some_in_eq)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/TopoS_Helper.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.34023177537142385}}
{"text": "subsection \\<open>Instantiation for transition systems\\<close>\n\n(*<*)\ntheory BD_Security_TS\nimports Abstract_BD_Security Filtermap Transition_System\nbegin\n(*>*)\n\ndeclare Let_def[simp]\n\nno_notation relcomp (infixr \"O\" 75)\n\n\nlocale BD_Security_TS = Transition_System istate validTrans srcOf tgtOf\n for istate :: 'state and validTrans :: \"'trans \\<Rightarrow> bool\"\n     and srcOf :: \"'trans \\<Rightarrow> 'state\" and tgtOf :: \"'trans \\<Rightarrow> 'state\"\n+\nfixes (* value filtering and production:  *)\n   \\<phi> :: \"'trans => bool\" and f :: \"'trans \\<Rightarrow> 'value\"\n and (* observation filtering and production: *)\n   \\<gamma> :: \"'trans => bool\" and g :: \"'trans \\<Rightarrow> 'obs\"\n and (* declassification trigger:  *)\n   T :: \"'trans \\<Rightarrow> bool\"\n and (* declassification bound: *)\n   B :: \"'value list \\<Rightarrow> 'value list \\<Rightarrow> bool\"\nbegin\n\n(* The value function: *)\ndefinition V :: \"'trans list \\<Rightarrow> 'value list\" where \"V \\<equiv> filtermap \\<phi> f\"\n(* The observation function: *)\ndefinition O :: \"'trans trace \\<Rightarrow> 'obs list\" where \"O \\<equiv> filtermap \\<gamma> g\"\n\nsublocale Abstract_BD_Security\n  where validSystemTrace = \"validFrom istate\" and V = V and O = O and B = B and TT = \"never T\" .\n\nlemma O_map_filter: \"O tr = map g (filter \\<gamma> tr)\" unfolding O_def filtermap_map_filter ..\nlemma V_map_filter: \"V tr = map f (filter \\<phi> tr)\" unfolding V_def filtermap_map_filter ..\n\nlemma V_simps[simp]:\n\"V [] = []\"  \"\\<not> \\<phi> trn \\<Longrightarrow> V (trn # tr) = V tr\"  \"\\<phi> trn \\<Longrightarrow> V (trn # tr) = f trn # V tr\"\nunfolding V_def by auto\n\nlemma V_Cons_unfold: \"V (trn # tr) = (if \\<phi> trn then f trn # V tr else V tr)\"\nby auto\n\nlemma O_simps[simp]:\n\"O [] = []\"  \"\\<not> \\<gamma> trn \\<Longrightarrow> O (trn # tr) = O tr\"  \"\\<gamma> trn \\<Longrightarrow> O (trn # tr) = g trn # O tr\"\nunfolding O_def by auto\n\nlemma O_Cons_unfold: \"O (trn # tr) = (if \\<gamma> trn then g trn # O tr else O tr)\"\nby auto\n\nlemma V_append: \"V (tr @ tr1) = V tr @ V tr1\"\nunfolding V_def using filtermap_append by auto\n\nlemma V_snoc:\n\"\\<not> \\<phi> trn \\<Longrightarrow> V (tr ## trn) = V tr\"  \"\\<phi> trn \\<Longrightarrow> V (tr ## trn) = V tr ## f trn\"\nunfolding V_def by auto\n\nlemma O_snoc:\n\"\\<not> \\<gamma> trn \\<Longrightarrow> O (tr ## trn) = O tr\"  \"\\<gamma> trn \\<Longrightarrow> O (tr ## trn) = O tr ## g trn\"\nunfolding O_def by auto\n\nlemma V_Nil_list_ex: \"V tr = [] \\<longleftrightarrow> \\<not> list_ex \\<phi> tr\"\nunfolding V_def using filtermap_Nil_list_ex by auto\n\nlemma V_Nil_never: \"V tr = [] \\<longleftrightarrow> never \\<phi> tr\"\nunfolding V_def using filtermap_Nil_never by auto\n\nlemma Nil_V_never: \"[] = V tr \\<longleftrightarrow> never \\<phi> tr\"\nunfolding V_def filtermap_map_filter by (induction tr) auto\n\nlemma list_ex_iff_length_V:\n\"list_ex \\<phi> tr \\<longleftrightarrow> length (V tr) > 0\"\nby (metis V_Nil_list_ex length_greater_0_conv)\n\nlemma length_V: \"length (V tr) \\<le> length tr\"\nby (auto simp: V_def length_filtermap)\n\nlemma V_list_all: \"V tr = map f tr \\<longleftrightarrow> list_all \\<phi> tr\"\nby (auto simp: V_def length_filtermap)\n\nlemma V_eq_Cons:\nassumes \"V tr = v # vl1\"\nshows \"\\<exists> trn tr2 tr1. tr = tr2 @ [trn] @ tr1 \\<and> never \\<phi> tr2 \\<and> \\<phi> trn \\<and> f trn = v \\<and> V tr1 = vl1\"\nusing assms filtermap_eq_Cons unfolding V_def by auto\n\nlemma V_eq_append:\nassumes \"V tr = vl1 @ vl2\"\nshows \"\\<exists> tr1 tr2. tr = tr1 @ tr2 \\<and> V tr1 = vl1 \\<and> V tr2 = vl2\"\nusing assms filtermap_eq_append[of \\<phi> f] unfolding V_def by auto\n\nlemma V_eq_RCons:\nassumes \"V tr = vl1 ## v\"\nshows \"\\<exists> trn tr1 tr2. tr = tr1 @ [trn] @ tr2 \\<and> \\<phi> trn \\<and> f trn = v \\<and> V tr1 = vl1 \\<and> never \\<phi> tr2\"\nusing assms filtermap_eq_RCons[of \\<phi> f] unfolding V_def by blast\n\nlemma V_eq_Cons_RCons:\nassumes \"V tr = v # vl1 ## w\"\nshows \"\\<exists> trv trnv tr1 trnw trw.\n   tr = trv @ [trnv] @ tr1 @ [trnw] @ trw \\<and>\n   never \\<phi> trv \\<and> \\<phi> trnv \\<and> f trnv = v \\<and> V tr1 = vl1 \\<and> \\<phi> trnw \\<and> f trnw = w \\<and> never \\<phi> trw\"\nusing assms filtermap_eq_Cons_RCons[of \\<phi> f] unfolding V_def by blast\n\nlemma O_append: \"O (tr @ tr1) = O tr @ O tr1\"\nunfolding O_def using filtermap_append by auto\n\nlemma O_Nil_list_ex: \"O tr = [] \\<longleftrightarrow> \\<not> list_ex \\<gamma> tr\"\nunfolding O_def using filtermap_Nil_list_ex by auto\n\nlemma O_Nil_never: \"O tr = [] \\<longleftrightarrow> never \\<gamma> tr\"\nunfolding O_def using filtermap_Nil_never by auto\n\nlemma Nil_O_never: \"[] = O tr \\<longleftrightarrow> never \\<gamma> tr\"\nunfolding O_def filtermap_map_filter by (induction tr) auto\n\nlemma length_O: \"length (O tr) \\<le> length tr\"\nby (auto simp: O_def length_filtermap)\n\nlemma O_list_all: \"O tr = map g tr \\<longleftrightarrow> list_all \\<gamma> tr\"\nby (auto simp: O_def length_filtermap)\n\nlemma O_eq_Cons:\nassumes \"O tr = obs # obsl1\"\nshows \"\\<exists> trn tr2 tr1. tr = tr2 @ [trn] @ tr1 \\<and> never \\<gamma> tr2 \\<and> \\<gamma> trn \\<and> g trn = obs \\<and> O tr1 = obsl1\"\nusing assms filtermap_eq_Cons unfolding O_def by auto\n\nlemma O_eq_append:\nassumes \"O tr = obsl1 @ obsl2\"\nshows \"\\<exists> tr1 tr2. tr = tr1 @ tr2 \\<and> O tr1 = obsl1 \\<and> O tr2 = obsl2\"\nusing assms filtermap_eq_append[of \\<gamma> g] unfolding O_def by auto\n\nlemma O_eq_RCons:\nassumes \"O tr = oul1 ## ou\"\nshows \"\\<exists> trn tr1 tr2. tr = tr1 @ [trn] @ tr2 \\<and> \\<gamma> trn \\<and> g trn = ou \\<and> O tr1 = oul1 \\<and> never \\<gamma> tr2\"\nusing assms filtermap_eq_RCons[of \\<gamma> g] unfolding O_def by blast\n\nlemma O_eq_Cons_RCons:\nassumes \"O tr0 = ou # oul1 ## ouu\"\nshows \"\\<exists> tr trn tr1 trnn trr.\n   tr0 = tr @ [trn] @ tr1 @ [trnn] @ trr \\<and>\n   never \\<gamma> tr \\<and> \\<gamma> trn \\<and> g trn = ou \\<and> O tr1 = oul1 \\<and> \\<gamma> trnn \\<and> g trnn = ouu \\<and> never \\<gamma> trr\"\nusing assms filtermap_eq_Cons_RCons[of \\<gamma> g] unfolding O_def by blast\n\nlemma O_eq_Cons_RCons_append:\nassumes \"O tr0 = ou # oul1 ## ouu @ oull\"\nshows \"\\<exists> tr trn tr1 trnn trr.\n   tr0 = tr @ [trn] @ tr1 @ [trnn] @ trr \\<and>\n   never \\<gamma> tr \\<and> \\<gamma> trn \\<and> g trn = ou \\<and> O tr1 = oul1 \\<and> \\<gamma> trnn \\<and> g trnn = ouu \\<and> O trr = oull\"\nproof-\n  from O_eq_append[of tr0 \"ou # oul1 ## ouu\" oull] assms\n  obtain tr00 trrr where 1: \"tr0 = tr00 @ trrr\"\n  and 2: \"O tr00 = ou # oul1 ## ouu\" and 3: \"O trrr = oull\" by auto\n  from O_eq_Cons_RCons[OF 2] obtain tr trn tr1 trnn trr where\n  4:\"tr00 = tr @ [trn] @ tr1 @ [trnn] @ trr \\<and>\n     never \\<gamma> tr \\<and>\n     \\<gamma> trn \\<and> g trn = ou \\<and> O tr1 = oul1 \\<and> \\<gamma> trnn \\<and> g trnn = ouu \\<and> never \\<gamma> trr\" by auto\n  show ?thesis apply(rule exI[of _ tr], rule exI[of _ trn], rule exI[of _ tr1],\n     rule exI[of _ trnn], rule exI[of _ \"trr @ trrr\"])\n  using 1 3 4 by (simp add: O_append O_Nil_never)\nqed\n\nlemma O_Nil_tr_Nil: \"O tr \\<noteq> [] \\<Longrightarrow> tr \\<noteq> []\"\nby (induction tr) auto\n\nlemma V_Cons_eq_append: \"V (trn # tr) = V [trn] @ V tr\"\nby (cases \"\\<phi> trn\") auto\n\nlemma set_V: \"set (V tr) \\<subseteq> {f trn | trn . trn \\<in>\\<in> tr \\<and> \\<phi> trn}\"\nusing set_filtermap unfolding V_def .\n\nlemma set_O: \"set (O tr) \\<subseteq> {g trn | trn . trn \\<in>\\<in> tr \\<and> \\<gamma> trn}\"\nusing set_filtermap unfolding O_def .\n\nlemma list_ex_length_O:\nassumes \"list_ex \\<gamma> tr\"  shows \"length (O tr) > 0\"\nby (metis assms O_Nil_list_ex length_greater_0_conv)\n\nlemma list_ex_iff_length_O:\n\"list_ex \\<gamma> tr \\<longleftrightarrow> length (O tr) > 0\"\nby (metis O_Nil_list_ex length_greater_0_conv)\n\nlemma length1_O_list_ex_iff:\n\"length (O tr) > 1 \\<Longrightarrow> list_ex \\<gamma> tr\"\nunfolding list_ex_iff_length_O by auto\n\nlemma list_all_O_map: \"list_all \\<gamma> tr \\<Longrightarrow> O tr = map g tr\"\nusing O_list_all by auto\n\nlemma never_O_Nil: \"never \\<gamma> tr \\<Longrightarrow> O tr = []\"\nusing O_Nil_never by auto\n\nlemma list_all_V_map: \"list_all \\<phi> tr \\<Longrightarrow> V tr = map f tr\"\nusing V_list_all by auto\n\nlemma never_V_Nil: \"never \\<phi> tr \\<Longrightarrow> V tr = []\"\nusing V_Nil_never by auto\n\n(* Reachable states by transitions satisfying T: *)\ninductive reachNT:: \"'state \\<Rightarrow> bool\" where\nIstate: \"reachNT istate\"\n|\nStep:\n\"\\<lbrakk>reachNT (srcOf trn); validTrans trn; \\<not> T trn\\<rbrakk>\n \\<Longrightarrow> reachNT (tgtOf trn)\"\n\nlemma reachNT_reach: assumes \"reachNT s\"  shows \"reach s\"\nusing assms apply induct by (auto intro: reach.intros)\n\nlemma V_iff_non_\\<phi>[simp]: \"V (trn # tr) = V tr \\<longleftrightarrow> \\<not> \\<phi> trn\"\nby (cases \"\\<phi> trn\") auto\n\nlemma V_imp_\\<phi>: \"V (trn # tr) = v # V tr \\<Longrightarrow> \\<phi> trn\"\nby (cases \"\\<phi> trn\") auto\n\nlemma V_imp_Nil: \"V (trn # tr) = [] \\<Longrightarrow> V tr = []\"\nby (cases \"\\<phi> trn\") auto\n\nlemma V_iff_Nil[simp]: \"V (trn # tr) = [] \\<longleftrightarrow> \\<not> \\<phi> trn \\<and> V tr = []\"\nby (metis V_iff_non_\\<phi> V_imp_Nil)\n\nend (* locale BD_Security_TS *)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Bounded_Deducibility_Security/BD_Security_TS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6548947155710233, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.340231768372898}}
{"text": "theory S_R_Spark_Obligation\nimports S_R_Spark_User\n\nbegin\n\n\n\nlemma goal2'1: \n  assumes R1: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> S_R_Spark_Declaration.rotate_amount__first''\n            <= S_R_Spark_Declaration.s_values'' I''\n  \"\n  assumes R2: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> S_R_Spark_Declaration.s_values'' I''\n            <= S_R_Spark_Declaration.rotate_amount__last''\n  \"\n  assumes R3: \n  \" S_R_Spark_Declaration.s_values''\n    = ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( S_R_Spark_Declaration.rotate_definition___default_arr''\n                                                                                                                                                                    ( S_R_Spark_Declaration.round_index__first''\n                                                                                                                                                                      := (8 :: int)\n                                                                                                                                                                    )\n                                                                                                                                                                  )\n                                                                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (1 :: int)\n                                                                                                                                                                    := (9 :: int)\n                                                                                                                                                                  )\n                                                                                                                                                                )\n                                                                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (2 :: int)\n                                                                                                                                                                  := (9 :: int)\n                                                                                                                                                                )\n                                                                                                                                                              )\n                                                                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (3 :: int)\n                                                                                                                                                                := (11 :: int)\n                                                                                                                                                              )\n                                                                                                                                                            )\n                                                                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (4 :: int)\n                                                                                                                                                              := (13 :: int)\n                                                                                                                                                            )\n                                                                                                                                                          )\n                                                                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (5 :: int)\n                                                                                                                                                            := (15 :: int)\n                                                                                                                                                          )\n                                                                                                                                                        )\n                                                                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (6 :: int)\n                                                                                                                                                          := (15 :: int)\n                                                                                                                                                        )\n                                                                                                                                                      )\n                                                                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (7 :: int)\n                                                                                                                                                        := (5 :: int)\n                                                                                                                                                      )\n                                                                                                                                                    )\n                                                                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (8 :: int)\n                                                                                                                                                      := (7 :: int)\n                                                                                                                                                    )\n                                                                                                                                                  )\n                                                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (9 :: int)\n                                                                                                                                                    := (7 :: int)\n                                                                                                                                                  )\n                                                                                                                                                )\n                                                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (10 :: int)\n                                                                                                                                                  := (8 :: int)\n                                                                                                                                                )\n                                                                                                                                              )\n                                                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (11 :: int)\n                                                                                                                                                := (11 :: int)\n                                                                                                                                              )\n                                                                                                                                            )\n                                                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (12 :: int)\n                                                                                                                                              := (14 :: int)\n                                                                                                                                            )\n                                                                                                                                          )\n                                                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (13 :: int)\n                                                                                                                                            := (14 :: int)\n                                                                                                                                          )\n                                                                                                                                        )\n                                                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (14 :: int)\n                                                                                                                                          := (12 :: int)\n                                                                                                                                        )\n                                                                                                                                      )\n                                                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (15 :: int)\n                                                                                                                                        := (6 :: int)\n                                                                                                                                      )\n                                                                                                                                    )\n                                                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (16 :: int)\n                                                                                                                                      := (9 :: int)\n                                                                                                                                    )\n                                                                                                                                  )\n                                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (17 :: int)\n                                                                                                                                    := (13 :: int)\n                                                                                                                                  )\n                                                                                                                                )\n                                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (18 :: int)\n                                                                                                                                  := (15 :: int)\n                                                                                                                                )\n                                                                                                                              )\n                                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (19 :: int)\n                                                                                                                                := (7 :: int)\n                                                                                                                              )\n                                                                                                                            )\n                                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (20 :: int)\n                                                                                                                              := (12 :: int)\n                                                                                                                            )\n                                                                                                                          )\n                                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (21 :: int)\n                                                                                                                            := (8 :: int)\n                                                                                                                          )\n                                                                                                                        )\n                                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (22 :: int)\n                                                                                                                          := (9 :: int)\n                                                                                                                        )\n                                                                                                                      )\n                                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (23 :: int)\n                                                                                                                        := (11 :: int)\n                                                                                                                      )\n                                                                                                                    )\n                                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (24 :: int)\n                                                                                                                      := (7 :: int)\n                                                                                                                    )\n                                                                                                                  )\n                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (25 :: int)\n                                                                                                                    := (7 :: int)\n                                                                                                                  )\n                                                                                                                )\n                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (26 :: int)\n                                                                                                                  := (12 :: int)\n                                                                                                                )\n                                                                                                              )\n                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (27 :: int)\n                                                                                                                := (7 :: int)\n                                                                                                              )\n                                                                                                            )\n                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (28 :: int)\n                                                                                                              := (6 :: int)\n                                                                                                            )\n                                                                                                          )\n                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (29 :: int)\n                                                                                                            := (15 :: int)\n                                                                                                          )\n                                                                                                        )\n                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (30 :: int)\n                                                                                                          := (13 :: int)\n                                                                                                        )\n                                                                                                      )\n                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (31 :: int)\n                                                                                                        := (11 :: int)\n                                                                                                      )\n                                                                                                    )\n                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (32 :: int)\n                                                                                                      := (9 :: int)\n                                                                                                    )\n                                                                                                  )\n                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (33 :: int)\n                                                                                                    := (7 :: int)\n                                                                                                  )\n                                                                                                )\n                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (34 :: int)\n                                                                                                  := (15 :: int)\n                                                                                                )\n                                                                                              )\n                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (35 :: int)\n                                                                                                := (11 :: int)\n                                                                                              )\n                                                                                            )\n                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (36 :: int)\n                                                                                              := (8 :: int)\n                                                                                            )\n                                                                                          )\n                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (37 :: int)\n                                                                                            := (6 :: int)\n                                                                                          )\n                                                                                        )\n                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (38 :: int)\n                                                                                          := (6 :: int)\n                                                                                        )\n                                                                                      )\n                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (39 :: int)\n                                                                                        := (14 :: int)\n                                                                                      )\n                                                                                    )\n                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (40 :: int)\n                                                                                      := (12 :: int)\n                                                                                    )\n                                                                                  )\n                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (41 :: int)\n                                                                                    := (13 :: int)\n                                                                                  )\n                                                                                )\n                                                                                ( S_R_Spark_Declaration.round_index__first'' + (42 :: int)\n                                                                                  := (5 :: int)\n                                                                                )\n                                                                              )\n                                                                              ( S_R_Spark_Declaration.round_index__first'' + (43 :: int)\n                                                                                := (14 :: int)\n                                                                              )\n                                                                            )\n                                                                            ( S_R_Spark_Declaration.round_index__first'' + (44 :: int)\n                                                                              := (13 :: int)\n                                                                            )\n                                                                          )\n                                                                          ( S_R_Spark_Declaration.round_index__first'' + (45 :: int)\n                                                                            := (13 :: int)\n                                                                          )\n                                                                        )\n                                                                        ( S_R_Spark_Declaration.round_index__first'' + (46 :: int)\n                                                                          := (7 :: int)\n                                                                        )\n                                                                      )\n                                                                      ( S_R_Spark_Declaration.round_index__first'' + (47 :: int)\n                                                                        := (5 :: int)\n                                                                      )\n                                                                    )\n                                                                    ( S_R_Spark_Declaration.round_index__first'' + (48 :: int)\n                                                                      := (15 :: int)\n                                                                    )\n                                                                  )\n                                                                  ( S_R_Spark_Declaration.round_index__first'' + (49 :: int)\n                                                                    := (5 :: int)\n                                                                  )\n                                                                )\n                                                                ( S_R_Spark_Declaration.round_index__first'' + (50 :: int)\n                                                                  := (8 :: int)\n                                                                )\n                                                              )\n                                                              ( S_R_Spark_Declaration.round_index__first'' + (51 :: int)\n                                                                := (11 :: int)\n                                                              )\n                                                            )\n                                                            ( S_R_Spark_Declaration.round_index__first'' + (52 :: int)\n                                                              := (14 :: int)\n                                                            )\n                                                          )\n                                                          ( S_R_Spark_Declaration.round_index__first'' + (53 :: int)\n                                                            := (14 :: int)\n                                                          )\n                                                        )\n                                                        ( S_R_Spark_Declaration.round_index__first'' + (54 :: int)\n                                                          := (6 :: int)\n                                                        )\n                                                      )\n                                                      ( S_R_Spark_Declaration.round_index__first'' + (55 :: int)\n                                                        := (14 :: int)\n                                                      )\n                                                    )\n                                                    ( S_R_Spark_Declaration.round_index__first'' + (56 :: int)\n                                                      := (6 :: int)\n                                                    )\n                                                  )\n                                                  ( S_R_Spark_Declaration.round_index__first'' + (57 :: int)\n                                                    := (9 :: int)\n                                                  )\n                                                )\n                                                ( S_R_Spark_Declaration.round_index__first'' + (58 :: int)\n                                                  := (12 :: int)\n                                                )\n                                              )\n                                              ( S_R_Spark_Declaration.round_index__first'' + (59 :: int)\n                                                := (9 :: int)\n                                              )\n                                            )\n                                            ( S_R_Spark_Declaration.round_index__first'' + (60 :: int)\n                                              := (12 :: int)\n                                            )\n                                          )\n                                          ( S_R_Spark_Declaration.round_index__first'' + (61 :: int)\n                                            := (5 :: int)\n                                          )\n                                        )\n                                        ( S_R_Spark_Declaration.round_index__first'' + (62 :: int)\n                                          := (15 :: int)\n                                        )\n                                      )\n                                      ( S_R_Spark_Declaration.round_index__first'' + (63 :: int)\n                                        := (8 :: int)\n                                      )\n                                    )\n                                    ( S_R_Spark_Declaration.round_index__first'' + (64 :: int)\n                                      := (8 :: int)\n                                    )\n                                  )\n                                  ( S_R_Spark_Declaration.round_index__first'' + (65 :: int)\n                                    := (5 :: int)\n                                  )\n                                )\n                                ( S_R_Spark_Declaration.round_index__first'' + (66 :: int)\n                                  := (12 :: int)\n                                )\n                              )\n                              ( S_R_Spark_Declaration.round_index__first'' + (67 :: int)\n                                := (9 :: int)\n                              )\n                            )\n                            ( S_R_Spark_Declaration.round_index__first'' + (68 :: int)\n                              := (12 :: int)\n                            )\n                          )\n                          ( S_R_Spark_Declaration.round_index__first'' + (69 :: int)\n                            := (5 :: int)\n                          )\n                        )\n                        ( S_R_Spark_Declaration.round_index__first'' + (70 :: int)\n                          := (14 :: int)\n                        )\n                      )\n                      ( S_R_Spark_Declaration.round_index__first'' + (71 :: int)\n                        := (6 :: int)\n                      )\n                    )\n                    ( S_R_Spark_Declaration.round_index__first'' + (72 :: int)\n                      := (8 :: int)\n                    )\n                  )\n                  ( S_R_Spark_Declaration.round_index__first'' + (73 :: int)\n                    := (13 :: int)\n                  )\n                )\n                ( S_R_Spark_Declaration.round_index__first'' + (74 :: int)\n                  := (6 :: int)\n                )\n              )\n              ( S_R_Spark_Declaration.round_index__first'' + (75 :: int)\n                := (5 :: int)\n              )\n            )\n            ( S_R_Spark_Declaration.round_index__first'' + (76 :: int)\n              := (15 :: int)\n            )\n          )\n          ( S_R_Spark_Declaration.round_index__first'' + (77 :: int)\n            := (13 :: int)\n          )\n        )\n        ( S_R_Spark_Declaration.round_index__first'' + (78 :: int)\n          := (11 :: int)\n        )\n      )\n      ( S_R_Spark_Declaration.round_index__first'' + (79 :: int)\n        := (11 :: int)\n      )\n  \"\n  assumes R4: \" (0 :: int) <= S_R_Spark_Declaration.integer__size'' \"\n  assumes R5: \n  \" S_R_Spark_Declaration.integer__first'' <= S_R_Spark_Declaration.integer__last''\n  \"\n  assumes R6: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes R7: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__first''\n  \"\n  assumes R8: \n  \" S_R_Spark_Declaration.integer__last''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes R9: \n  \" (0 :: int) <= S_R_Spark_Declaration.round_index__size''\n  \"\n  assumes R10: \n  \" S_R_Spark_Declaration.round_index__first'' = (0 :: int)\n  \"\n  assumes R11: \n  \" S_R_Spark_Declaration.round_index__last'' = (79 :: int)\n  \"\n  assumes R12: \n  \" S_R_Spark_Declaration.round_index__base__first''\n    <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R13: \n  \" S_R_Spark_Declaration.round_index__base__first''\n    <= S_R_Spark_Declaration.round_index__first''\n  \"\n  assumes R14: \n  \" S_R_Spark_Declaration.round_index__last''\n    <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R15: \n  \" (0 :: int) <= S_R_Spark_Declaration.rotate_amount__size''\n  \"\n  assumes R16: \n  \" S_R_Spark_Declaration.rotate_amount__first'' = (0 :: int)\n  \"\n  assumes R17: \n  \" S_R_Spark_Declaration.rotate_amount__last'' = (15 :: int)\n  \"\n  assumes R18: \n  \" S_R_Spark_Declaration.rotate_amount__base__first''\n    <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  assumes R19: \n  \" S_R_Spark_Declaration.rotate_amount__base__first''\n    <= S_R_Spark_Declaration.rotate_amount__first''\n  \"\n  assumes R20: \n  \" S_R_Spark_Declaration.rotate_amount__last''\n    <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  assumes R21: \n  \" ALL ( i1'' :: int ) ( v'' :: int )\n    .   ( S_R_Spark_Declaration.rotate_definition___mk_const_arr' v'' ) i1''\n        = v''\n  \"\n  assumes H1: \" (0 :: int) <= S_R_Spark_Declaration.j'' \"\n  assumes H2: \" S_R_Spark_Declaration.j'' <= (79 :: int) \"\n  assumes H3: \" (0 :: int) <= S_R_Spark_Declaration.integer__size'' \"\n  assumes H4: \n  \" S_R_Spark_Declaration.integer__first'' <= S_R_Spark_Declaration.integer__last''\n  \"\n  assumes H5: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes H6: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__first''\n  \"\n  assumes H7: \n  \" S_R_Spark_Declaration.integer__last''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes H8: \n  \" (0 :: int) <= S_R_Spark_Declaration.round_index__size''\n  \"\n  assumes H9: \n  \" S_R_Spark_Declaration.round_index__base__first''\n    <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes H10: \n  \" (0 :: int) <= S_R_Spark_Declaration.rotate_amount__size''\n  \"\n  assumes H11: \n  \" S_R_Spark_Declaration.rotate_amount__base__first''\n    <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  assumes H12: \n  \" S_R_Spark_Declaration.round_index__base__first'' <= (0 :: int)\n  \"\n  assumes H13: \n  \" (79 :: int) <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes H14: \n  \" S_R_Spark_Declaration.rotate_amount__base__first'' <= (0 :: int)\n  \"\n  assumes H15: \n  \" (15 :: int) <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  shows \" ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( S_R_Spark_Declaration.rotate_definition___default_arr''\n                                                                                                                                                                          ( (0 :: int)\n                                                                                                                                                                            := (8 :: int)\n                                                                                                                                                                          )\n                                                                                                                                                                        )\n                                                                                                                                                                        ( (1 :: int)\n                                                                                                                                                                          := (9 :: int)\n                                                                                                                                                                        )\n                                                                                                                                                                      )\n                                                                                                                                                                      ( (2 :: int)\n                                                                                                                                                                        := (9 :: int)\n                                                                                                                                                                      )\n                                                                                                                                                                    )\n                                                                                                                                                                    ( (3 :: int)\n                                                                                                                                                                      := (11 :: int)\n                                                                                                                                                                    )\n                                                                                                                                                                  )\n                                                                                                                                                                  ( (4 :: int)\n                                                                                                                                                                    := (13 :: int)\n                                                                                                                                                                  )\n                                                                                                                                                                )\n                                                                                                                                                                ( (5 :: int)\n                                                                                                                                                                  := (15 :: int)\n                                                                                                                                                                )\n                                                                                                                                                              )\n                                                                                                                                                              ( (6 :: int)\n                                                                                                                                                                := (15 :: int)\n                                                                                                                                                              )\n                                                                                                                                                            )\n                                                                                                                                                            ( (7 :: int)\n                                                                                                                                                              := (5 :: int)\n                                                                                                                                                            )\n                                                                                                                                                          )\n                                                                                                                                                          ( (8 :: int)\n                                                                                                                                                            := (7 :: int)\n                                                                                                                                                          )\n                                                                                                                                                        )\n                                                                                                                                                        ( (9 :: int)\n                                                                                                                                                          := (7 :: int)\n                                                                                                                                                        )\n                                                                                                                                                      )\n                                                                                                                                                      ( (10 :: int)\n                                                                                                                                                        := (8 :: int)\n                                                                                                                                                      )\n                                                                                                                                                    )\n                                                                                                                                                    ( (11 :: int)\n                                                                                                                                                      := (11 :: int)\n                                                                                                                                                    )\n                                                                                                                                                  )\n                                                                                                                                                  ( (12 :: int)\n                                                                                                                                                    := (14 :: int)\n                                                                                                                                                  )\n                                                                                                                                                )\n                                                                                                                                                ( (13 :: int)\n                                                                                                                                                  := (14 :: int)\n                                                                                                                                                )\n                                                                                                                                              )\n                                                                                                                                              ( (14 :: int)\n                                                                                                                                                := (12 :: int)\n                                                                                                                                              )\n                                                                                                                                            )\n                                                                                                                                            ( (15 :: int)\n                                                                                                                                              := (6 :: int)\n                                                                                                                                            )\n                                                                                                                                          )\n                                                                                                                                          ( (16 :: int)\n                                                                                                                                            := (9 :: int)\n                                                                                                                                          )\n                                                                                                                                        )\n                                                                                                                                        ( (17 :: int)\n                                                                                                                                          := (13 :: int)\n                                                                                                                                        )\n                                                                                                                                      )\n                                                                                                                                      ( (18 :: int)\n                                                                                                                                        := (15 :: int)\n                                                                                                                                      )\n                                                                                                                                    )\n                                                                                                                                    ( (19 :: int)\n                                                                                                                                      := (7 :: int)\n                                                                                                                                    )\n                                                                                                                                  )\n                                                                                                                                  ( (20 :: int)\n                                                                                                                                    := (12 :: int)\n                                                                                                                                  )\n                                                                                                                                )\n                                                                                                                                ( (21 :: int)\n                                                                                                                                  := (8 :: int)\n                                                                                                                                )\n                                                                                                                              )\n                                                                                                                              ( (22 :: int)\n                                                                                                                                := (9 :: int)\n                                                                                                                              )\n                                                                                                                            )\n                                                                                                                            ( (23 :: int)\n                                                                                                                              := (11 :: int)\n                                                                                                                            )\n                                                                                                                          )\n                                                                                                                          ( (24 :: int)\n                                                                                                                            := (7 :: int)\n                                                                                                                          )\n                                                                                                                        )\n                                                                                                                        ( (25 :: int)\n                                                                                                                          := (7 :: int)\n                                                                                                                        )\n                                                                                                                      )\n                                                                                                                      ( (26 :: int)\n                                                                                                                        := (12 :: int)\n                                                                                                                      )\n                                                                                                                    )\n                                                                                                                    ( (27 :: int)\n                                                                                                                      := (7 :: int)\n                                                                                                                    )\n                                                                                                                  )\n                                                                                                                  ( (28 :: int)\n                                                                                                                    := (6 :: int)\n                                                                                                                  )\n                                                                                                                )\n                                                                                                                ( (29 :: int)\n                                                                                                                  := (15 :: int)\n                                                                                                                )\n                                                                                                              )\n                                                                                                              ( (30 :: int)\n                                                                                                                := (13 :: int)\n                                                                                                              )\n                                                                                                            )\n                                                                                                            ( (31 :: int)\n                                                                                                              := (11 :: int)\n                                                                                                            )\n                                                                                                          )\n                                                                                                          ( (32 :: int)\n                                                                                                            := (9 :: int)\n                                                                                                          )\n                                                                                                        )\n                                                                                                        ( (33 :: int)\n                                                                                                          := (7 :: int)\n                                                                                                        )\n                                                                                                      )\n                                                                                                      ( (34 :: int)\n                                                                                                        := (15 :: int)\n                                                                                                      )\n                                                                                                    )\n                                                                                                    ( (35 :: int)\n                                                                                                      := (11 :: int)\n                                                                                                    )\n                                                                                                  )\n                                                                                                  ( (36 :: int)\n                                                                                                    := (8 :: int)\n                                                                                                  )\n                                                                                                )\n                                                                                                ( (37 :: int)\n                                                                                                  := (6 :: int)\n                                                                                                )\n                                                                                              )\n                                                                                              ( (38 :: int)\n                                                                                                := (6 :: int)\n                                                                                              )\n                                                                                            )\n                                                                                            ( (39 :: int)\n                                                                                              := (14 :: int)\n                                                                                            )\n                                                                                          )\n                                                                                          ( (40 :: int)\n                                                                                            := (12 :: int)\n                                                                                          )\n                                                                                        )\n                                                                                        ( (41 :: int)\n                                                                                          := (13 :: int)\n                                                                                        )\n                                                                                      )\n                                                                                      ( (42 :: int)\n                                                                                        := (5 :: int)\n                                                                                      )\n                                                                                    )\n                                                                                    ( (43 :: int)\n                                                                                      := (14 :: int)\n                                                                                    )\n                                                                                  )\n                                                                                  ( (44 :: int)\n                                                                                    := (13 :: int)\n                                                                                  )\n                                                                                )\n                                                                                ( (45 :: int)\n                                                                                  := (13 :: int)\n                                                                                )\n                                                                              )\n                                                                              ( (46 :: int)\n                                                                                := (7 :: int)\n                                                                              )\n                                                                            )\n                                                                            ( (47 :: int)\n                                                                              := (5 :: int)\n                                                                            )\n                                                                          )\n                                                                          ( (48 :: int)\n                                                                            := (15 :: int)\n                                                                          )\n                                                                        )\n                                                                        ( (49 :: int)\n                                                                          := (5 :: int)\n                                                                        )\n                                                                      )\n                                                                      ( (50 :: int)\n                                                                        := (8 :: int)\n                                                                      )\n                                                                    )\n                                                                    ( (51 :: int)\n                                                                      := (11 :: int)\n                                                                    )\n                                                                  )\n                                                                  ( (52 :: int)\n                                                                    := (14 :: int)\n                                                                  )\n                                                                )\n                                                                ( (53 :: int)\n                                                                  := (14 :: int)\n                                                                )\n                                                              )\n                                                              ( (54 :: int)\n                                                                := (6 :: int)\n                                                              )\n                                                            )\n                                                            ( (55 :: int)\n                                                              := (14 :: int)\n                                                            )\n                                                          )\n                                                          ( (56 :: int)\n                                                            := (6 :: int)\n                                                          )\n                                                        )\n                                                        ( (57 :: int)\n                                                          := (9 :: int)\n                                                        )\n                                                      )\n                                                      ( (58 :: int)\n                                                        := (12 :: int)\n                                                      )\n                                                    )\n                                                    ( (59 :: int)\n                                                      := (9 :: int)\n                                                    )\n                                                  )\n                                                  ( (60 :: int)\n                                                    := (12 :: int)\n                                                  )\n                                                )\n                                                ( (61 :: int)\n                                                  := (5 :: int)\n                                                )\n                                              )\n                                              ( (62 :: int)\n                                                := (15 :: int)\n                                              )\n                                            )\n                                            ( (63 :: int)\n                                              := (8 :: int)\n                                            )\n                                          )\n                                          ( (64 :: int)\n                                            := (8 :: int)\n                                          )\n                                        )\n                                        ( (65 :: int)\n                                          := (5 :: int)\n                                        )\n                                      )\n                                      ( (66 :: int)\n                                        := (12 :: int)\n                                      )\n                                    )\n                                    ( (67 :: int)\n                                      := (9 :: int)\n                                    )\n                                  )\n                                  ( (68 :: int)\n                                    := (12 :: int)\n                                  )\n                                )\n                                ( (69 :: int)\n                                  := (5 :: int)\n                                )\n                              )\n                              ( (70 :: int)\n                                := (14 :: int)\n                              )\n                            )\n                            ( (71 :: int)\n                              := (6 :: int)\n                            )\n                          )\n                          ( (72 :: int)\n                            := (8 :: int)\n                          )\n                        )\n                        ( (73 :: int)\n                          := (13 :: int)\n                        )\n                      )\n                      ( (74 :: int)\n                        := (6 :: int)\n                      )\n                    )\n                    ( (75 :: int)\n                      := (5 :: int)\n                    )\n                  )\n                  ( (76 :: int)\n                    := (15 :: int)\n                  )\n                )\n                ( (77 :: int)\n                  := (13 :: int)\n                )\n              )\n              ( (78 :: int)\n                := (11 :: int)\n              )\n            )\n            ( (79 :: int)\n              := (11 :: int)\n            )\n          )\n            S_R_Spark_Declaration.j''\n          = S_R_Spark_Specification.s_r' S_R_Spark_Declaration.j''\n        \" (is \"?C1\")\napply (insert assms) by (rule userlemmas)\n\nlemma goal2'2: \n  assumes R1: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> S_R_Spark_Declaration.rotate_amount__first''\n            <= S_R_Spark_Declaration.s_values'' I''\n  \"\n  assumes R2: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> S_R_Spark_Declaration.s_values'' I''\n            <= S_R_Spark_Declaration.rotate_amount__last''\n  \"\n  assumes R3: \n  \" S_R_Spark_Declaration.s_values''\n    = ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( S_R_Spark_Declaration.rotate_definition___default_arr''\n                                                                                                                                                                    ( S_R_Spark_Declaration.round_index__first''\n                                                                                                                                                                      := (8 :: int)\n                                                                                                                                                                    )\n                                                                                                                                                                  )\n                                                                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (1 :: int)\n                                                                                                                                                                    := (9 :: int)\n                                                                                                                                                                  )\n                                                                                                                                                                )\n                                                                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (2 :: int)\n                                                                                                                                                                  := (9 :: int)\n                                                                                                                                                                )\n                                                                                                                                                              )\n                                                                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (3 :: int)\n                                                                                                                                                                := (11 :: int)\n                                                                                                                                                              )\n                                                                                                                                                            )\n                                                                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (4 :: int)\n                                                                                                                                                              := (13 :: int)\n                                                                                                                                                            )\n                                                                                                                                                          )\n                                                                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (5 :: int)\n                                                                                                                                                            := (15 :: int)\n                                                                                                                                                          )\n                                                                                                                                                        )\n                                                                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (6 :: int)\n                                                                                                                                                          := (15 :: int)\n                                                                                                                                                        )\n                                                                                                                                                      )\n                                                                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (7 :: int)\n                                                                                                                                                        := (5 :: int)\n                                                                                                                                                      )\n                                                                                                                                                    )\n                                                                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (8 :: int)\n                                                                                                                                                      := (7 :: int)\n                                                                                                                                                    )\n                                                                                                                                                  )\n                                                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (9 :: int)\n                                                                                                                                                    := (7 :: int)\n                                                                                                                                                  )\n                                                                                                                                                )\n                                                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (10 :: int)\n                                                                                                                                                  := (8 :: int)\n                                                                                                                                                )\n                                                                                                                                              )\n                                                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (11 :: int)\n                                                                                                                                                := (11 :: int)\n                                                                                                                                              )\n                                                                                                                                            )\n                                                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (12 :: int)\n                                                                                                                                              := (14 :: int)\n                                                                                                                                            )\n                                                                                                                                          )\n                                                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (13 :: int)\n                                                                                                                                            := (14 :: int)\n                                                                                                                                          )\n                                                                                                                                        )\n                                                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (14 :: int)\n                                                                                                                                          := (12 :: int)\n                                                                                                                                        )\n                                                                                                                                      )\n                                                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (15 :: int)\n                                                                                                                                        := (6 :: int)\n                                                                                                                                      )\n                                                                                                                                    )\n                                                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (16 :: int)\n                                                                                                                                      := (9 :: int)\n                                                                                                                                    )\n                                                                                                                                  )\n                                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (17 :: int)\n                                                                                                                                    := (13 :: int)\n                                                                                                                                  )\n                                                                                                                                )\n                                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (18 :: int)\n                                                                                                                                  := (15 :: int)\n                                                                                                                                )\n                                                                                                                              )\n                                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (19 :: int)\n                                                                                                                                := (7 :: int)\n                                                                                                                              )\n                                                                                                                            )\n                                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (20 :: int)\n                                                                                                                              := (12 :: int)\n                                                                                                                            )\n                                                                                                                          )\n                                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (21 :: int)\n                                                                                                                            := (8 :: int)\n                                                                                                                          )\n                                                                                                                        )\n                                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (22 :: int)\n                                                                                                                          := (9 :: int)\n                                                                                                                        )\n                                                                                                                      )\n                                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (23 :: int)\n                                                                                                                        := (11 :: int)\n                                                                                                                      )\n                                                                                                                    )\n                                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (24 :: int)\n                                                                                                                      := (7 :: int)\n                                                                                                                    )\n                                                                                                                  )\n                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (25 :: int)\n                                                                                                                    := (7 :: int)\n                                                                                                                  )\n                                                                                                                )\n                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (26 :: int)\n                                                                                                                  := (12 :: int)\n                                                                                                                )\n                                                                                                              )\n                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (27 :: int)\n                                                                                                                := (7 :: int)\n                                                                                                              )\n                                                                                                            )\n                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (28 :: int)\n                                                                                                              := (6 :: int)\n                                                                                                            )\n                                                                                                          )\n                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (29 :: int)\n                                                                                                            := (15 :: int)\n                                                                                                          )\n                                                                                                        )\n                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (30 :: int)\n                                                                                                          := (13 :: int)\n                                                                                                        )\n                                                                                                      )\n                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (31 :: int)\n                                                                                                        := (11 :: int)\n                                                                                                      )\n                                                                                                    )\n                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (32 :: int)\n                                                                                                      := (9 :: int)\n                                                                                                    )\n                                                                                                  )\n                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (33 :: int)\n                                                                                                    := (7 :: int)\n                                                                                                  )\n                                                                                                )\n                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (34 :: int)\n                                                                                                  := (15 :: int)\n                                                                                                )\n                                                                                              )\n                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (35 :: int)\n                                                                                                := (11 :: int)\n                                                                                              )\n                                                                                            )\n                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (36 :: int)\n                                                                                              := (8 :: int)\n                                                                                            )\n                                                                                          )\n                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (37 :: int)\n                                                                                            := (6 :: int)\n                                                                                          )\n                                                                                        )\n                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (38 :: int)\n                                                                                          := (6 :: int)\n                                                                                        )\n                                                                                      )\n                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (39 :: int)\n                                                                                        := (14 :: int)\n                                                                                      )\n                                                                                    )\n                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (40 :: int)\n                                                                                      := (12 :: int)\n                                                                                    )\n                                                                                  )\n                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (41 :: int)\n                                                                                    := (13 :: int)\n                                                                                  )\n                                                                                )\n                                                                                ( S_R_Spark_Declaration.round_index__first'' + (42 :: int)\n                                                                                  := (5 :: int)\n                                                                                )\n                                                                              )\n                                                                              ( S_R_Spark_Declaration.round_index__first'' + (43 :: int)\n                                                                                := (14 :: int)\n                                                                              )\n                                                                            )\n                                                                            ( S_R_Spark_Declaration.round_index__first'' + (44 :: int)\n                                                                              := (13 :: int)\n                                                                            )\n                                                                          )\n                                                                          ( S_R_Spark_Declaration.round_index__first'' + (45 :: int)\n                                                                            := (13 :: int)\n                                                                          )\n                                                                        )\n                                                                        ( S_R_Spark_Declaration.round_index__first'' + (46 :: int)\n                                                                          := (7 :: int)\n                                                                        )\n                                                                      )\n                                                                      ( S_R_Spark_Declaration.round_index__first'' + (47 :: int)\n                                                                        := (5 :: int)\n                                                                      )\n                                                                    )\n                                                                    ( S_R_Spark_Declaration.round_index__first'' + (48 :: int)\n                                                                      := (15 :: int)\n                                                                    )\n                                                                  )\n                                                                  ( S_R_Spark_Declaration.round_index__first'' + (49 :: int)\n                                                                    := (5 :: int)\n                                                                  )\n                                                                )\n                                                                ( S_R_Spark_Declaration.round_index__first'' + (50 :: int)\n                                                                  := (8 :: int)\n                                                                )\n                                                              )\n                                                              ( S_R_Spark_Declaration.round_index__first'' + (51 :: int)\n                                                                := (11 :: int)\n                                                              )\n                                                            )\n                                                            ( S_R_Spark_Declaration.round_index__first'' + (52 :: int)\n                                                              := (14 :: int)\n                                                            )\n                                                          )\n                                                          ( S_R_Spark_Declaration.round_index__first'' + (53 :: int)\n                                                            := (14 :: int)\n                                                          )\n                                                        )\n                                                        ( S_R_Spark_Declaration.round_index__first'' + (54 :: int)\n                                                          := (6 :: int)\n                                                        )\n                                                      )\n                                                      ( S_R_Spark_Declaration.round_index__first'' + (55 :: int)\n                                                        := (14 :: int)\n                                                      )\n                                                    )\n                                                    ( S_R_Spark_Declaration.round_index__first'' + (56 :: int)\n                                                      := (6 :: int)\n                                                    )\n                                                  )\n                                                  ( S_R_Spark_Declaration.round_index__first'' + (57 :: int)\n                                                    := (9 :: int)\n                                                  )\n                                                )\n                                                ( S_R_Spark_Declaration.round_index__first'' + (58 :: int)\n                                                  := (12 :: int)\n                                                )\n                                              )\n                                              ( S_R_Spark_Declaration.round_index__first'' + (59 :: int)\n                                                := (9 :: int)\n                                              )\n                                            )\n                                            ( S_R_Spark_Declaration.round_index__first'' + (60 :: int)\n                                              := (12 :: int)\n                                            )\n                                          )\n                                          ( S_R_Spark_Declaration.round_index__first'' + (61 :: int)\n                                            := (5 :: int)\n                                          )\n                                        )\n                                        ( S_R_Spark_Declaration.round_index__first'' + (62 :: int)\n                                          := (15 :: int)\n                                        )\n                                      )\n                                      ( S_R_Spark_Declaration.round_index__first'' + (63 :: int)\n                                        := (8 :: int)\n                                      )\n                                    )\n                                    ( S_R_Spark_Declaration.round_index__first'' + (64 :: int)\n                                      := (8 :: int)\n                                    )\n                                  )\n                                  ( S_R_Spark_Declaration.round_index__first'' + (65 :: int)\n                                    := (5 :: int)\n                                  )\n                                )\n                                ( S_R_Spark_Declaration.round_index__first'' + (66 :: int)\n                                  := (12 :: int)\n                                )\n                              )\n                              ( S_R_Spark_Declaration.round_index__first'' + (67 :: int)\n                                := (9 :: int)\n                              )\n                            )\n                            ( S_R_Spark_Declaration.round_index__first'' + (68 :: int)\n                              := (12 :: int)\n                            )\n                          )\n                          ( S_R_Spark_Declaration.round_index__first'' + (69 :: int)\n                            := (5 :: int)\n                          )\n                        )\n                        ( S_R_Spark_Declaration.round_index__first'' + (70 :: int)\n                          := (14 :: int)\n                        )\n                      )\n                      ( S_R_Spark_Declaration.round_index__first'' + (71 :: int)\n                        := (6 :: int)\n                      )\n                    )\n                    ( S_R_Spark_Declaration.round_index__first'' + (72 :: int)\n                      := (8 :: int)\n                    )\n                  )\n                  ( S_R_Spark_Declaration.round_index__first'' + (73 :: int)\n                    := (13 :: int)\n                  )\n                )\n                ( S_R_Spark_Declaration.round_index__first'' + (74 :: int)\n                  := (6 :: int)\n                )\n              )\n              ( S_R_Spark_Declaration.round_index__first'' + (75 :: int)\n                := (5 :: int)\n              )\n            )\n            ( S_R_Spark_Declaration.round_index__first'' + (76 :: int)\n              := (15 :: int)\n            )\n          )\n          ( S_R_Spark_Declaration.round_index__first'' + (77 :: int)\n            := (13 :: int)\n          )\n        )\n        ( S_R_Spark_Declaration.round_index__first'' + (78 :: int)\n          := (11 :: int)\n        )\n      )\n      ( S_R_Spark_Declaration.round_index__first'' + (79 :: int)\n        := (11 :: int)\n      )\n  \"\n  assumes R4: \" (0 :: int) <= S_R_Spark_Declaration.integer__size'' \"\n  assumes R5: \n  \" S_R_Spark_Declaration.integer__first'' <= S_R_Spark_Declaration.integer__last''\n  \"\n  assumes R6: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes R7: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__first''\n  \"\n  assumes R8: \n  \" S_R_Spark_Declaration.integer__last''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes R9: \n  \" (0 :: int) <= S_R_Spark_Declaration.round_index__size''\n  \"\n  assumes R10: \n  \" S_R_Spark_Declaration.round_index__first'' = (0 :: int)\n  \"\n  assumes R11: \n  \" S_R_Spark_Declaration.round_index__last'' = (79 :: int)\n  \"\n  assumes R12: \n  \" S_R_Spark_Declaration.round_index__base__first''\n    <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R13: \n  \" S_R_Spark_Declaration.round_index__base__first''\n    <= S_R_Spark_Declaration.round_index__first''\n  \"\n  assumes R14: \n  \" S_R_Spark_Declaration.round_index__last''\n    <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R15: \n  \" (0 :: int) <= S_R_Spark_Declaration.rotate_amount__size''\n  \"\n  assumes R16: \n  \" S_R_Spark_Declaration.rotate_amount__first'' = (0 :: int)\n  \"\n  assumes R17: \n  \" S_R_Spark_Declaration.rotate_amount__last'' = (15 :: int)\n  \"\n  assumes R18: \n  \" S_R_Spark_Declaration.rotate_amount__base__first''\n    <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  assumes R19: \n  \" S_R_Spark_Declaration.rotate_amount__base__first''\n    <= S_R_Spark_Declaration.rotate_amount__first''\n  \"\n  assumes R20: \n  \" S_R_Spark_Declaration.rotate_amount__last''\n    <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  assumes R21: \n  \" ALL ( i1'' :: int ) ( v'' :: int )\n    .   ( S_R_Spark_Declaration.rotate_definition___mk_const_arr' v'' ) i1''\n        = v''\n  \"\n  assumes H1: \" (0 :: int) <= S_R_Spark_Declaration.j'' \"\n  assumes H2: \" S_R_Spark_Declaration.j'' <= (79 :: int) \"\n  assumes H3: \" (0 :: int) <= S_R_Spark_Declaration.integer__size'' \"\n  assumes H4: \n  \" S_R_Spark_Declaration.integer__first'' <= S_R_Spark_Declaration.integer__last''\n  \"\n  assumes H5: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes H6: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__first''\n  \"\n  assumes H7: \n  \" S_R_Spark_Declaration.integer__last''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes H8: \n  \" (0 :: int) <= S_R_Spark_Declaration.round_index__size''\n  \"\n  assumes H9: \n  \" S_R_Spark_Declaration.round_index__base__first''\n    <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes H10: \n  \" (0 :: int) <= S_R_Spark_Declaration.rotate_amount__size''\n  \"\n  assumes H11: \n  \" S_R_Spark_Declaration.rotate_amount__base__first''\n    <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  assumes H12: \n  \" S_R_Spark_Declaration.round_index__base__first'' <= (0 :: int)\n  \"\n  assumes H13: \n  \" (79 :: int) <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes H14: \n  \" S_R_Spark_Declaration.rotate_amount__base__first'' <= (0 :: int)\n  \"\n  assumes H15: \n  \" (15 :: int) <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  shows \" (0 :: int)\n          <= ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( S_R_Spark_Declaration.rotate_definition___default_arr''\n                                                                                                                                                                             ( (0 :: int)\n                                                                                                                                                                               := (8 :: int)\n                                                                                                                                                                             )\n                                                                                                                                                                           )\n                                                                                                                                                                           ( (1 :: int)\n                                                                                                                                                                             := (9 :: int)\n                                                                                                                                                                           )\n                                                                                                                                                                         )\n                                                                                                                                                                         ( (2 :: int)\n                                                                                                                                                                           := (9 :: int)\n                                                                                                                                                                         )\n                                                                                                                                                                       )\n                                                                                                                                                                       ( (3 :: int)\n                                                                                                                                                                         := (11 :: int)\n                                                                                                                                                                       )\n                                                                                                                                                                     )\n                                                                                                                                                                     ( (4 :: int)\n                                                                                                                                                                       := (13 :: int)\n                                                                                                                                                                     )\n                                                                                                                                                                   )\n                                                                                                                                                                   ( (5 :: int)\n                                                                                                                                                                     := (15 :: int)\n                                                                                                                                                                   )\n                                                                                                                                                                 )\n                                                                                                                                                                 ( (6 :: int)\n                                                                                                                                                                   := (15 :: int)\n                                                                                                                                                                 )\n                                                                                                                                                               )\n                                                                                                                                                               ( (7 :: int)\n                                                                                                                                                                 := (5 :: int)\n                                                                                                                                                               )\n                                                                                                                                                             )\n                                                                                                                                                             ( (8 :: int)\n                                                                                                                                                               := (7 :: int)\n                                                                                                                                                             )\n                                                                                                                                                           )\n                                                                                                                                                           ( (9 :: int)\n                                                                                                                                                             := (7 :: int)\n                                                                                                                                                           )\n                                                                                                                                                         )\n                                                                                                                                                         ( (10 :: int)\n                                                                                                                                                           := (8 :: int)\n                                                                                                                                                         )\n                                                                                                                                                       )\n                                                                                                                                                       ( (11 :: int)\n                                                                                                                                                         := (11 :: int)\n                                                                                                                                                       )\n                                                                                                                                                     )\n                                                                                                                                                     ( (12 :: int)\n                                                                                                                                                       := (14 :: int)\n                                                                                                                                                     )\n                                                                                                                                                   )\n                                                                                                                                                   ( (13 :: int)\n                                                                                                                                                     := (14 :: int)\n                                                                                                                                                   )\n                                                                                                                                                 )\n                                                                                                                                                 ( (14 :: int)\n                                                                                                                                                   := (12 :: int)\n                                                                                                                                                 )\n                                                                                                                                               )\n                                                                                                                                               ( (15 :: int)\n                                                                                                                                                 := (6 :: int)\n                                                                                                                                               )\n                                                                                                                                             )\n                                                                                                                                             ( (16 :: int)\n                                                                                                                                               := (9 :: int)\n                                                                                                                                             )\n                                                                                                                                           )\n                                                                                                                                           ( (17 :: int)\n                                                                                                                                             := (13 :: int)\n                                                                                                                                           )\n                                                                                                                                         )\n                                                                                                                                         ( (18 :: int)\n                                                                                                                                           := (15 :: int)\n                                                                                                                                         )\n                                                                                                                                       )\n                                                                                                                                       ( (19 :: int)\n                                                                                                                                         := (7 :: int)\n                                                                                                                                       )\n                                                                                                                                     )\n                                                                                                                                     ( (20 :: int)\n                                                                                                                                       := (12 :: int)\n                                                                                                                                     )\n                                                                                                                                   )\n                                                                                                                                   ( (21 :: int)\n                                                                                                                                     := (8 :: int)\n                                                                                                                                   )\n                                                                                                                                 )\n                                                                                                                                 ( (22 :: int)\n                                                                                                                                   := (9 :: int)\n                                                                                                                                 )\n                                                                                                                               )\n                                                                                                                               ( (23 :: int)\n                                                                                                                                 := (11 :: int)\n                                                                                                                               )\n                                                                                                                             )\n                                                                                                                             ( (24 :: int)\n                                                                                                                               := (7 :: int)\n                                                                                                                             )\n                                                                                                                           )\n                                                                                                                           ( (25 :: int)\n                                                                                                                             := (7 :: int)\n                                                                                                                           )\n                                                                                                                         )\n                                                                                                                         ( (26 :: int)\n                                                                                                                           := (12 :: int)\n                                                                                                                         )\n                                                                                                                       )\n                                                                                                                       ( (27 :: int)\n                                                                                                                         := (7 :: int)\n                                                                                                                       )\n                                                                                                                     )\n                                                                                                                     ( (28 :: int)\n                                                                                                                       := (6 :: int)\n                                                                                                                     )\n                                                                                                                   )\n                                                                                                                   ( (29 :: int)\n                                                                                                                     := (15 :: int)\n                                                                                                                   )\n                                                                                                                 )\n                                                                                                                 ( (30 :: int)\n                                                                                                                   := (13 :: int)\n                                                                                                                 )\n                                                                                                               )\n                                                                                                               ( (31 :: int)\n                                                                                                                 := (11 :: int)\n                                                                                                               )\n                                                                                                             )\n                                                                                                             ( (32 :: int)\n                                                                                                               := (9 :: int)\n                                                                                                             )\n                                                                                                           )\n                                                                                                           ( (33 :: int)\n                                                                                                             := (7 :: int)\n                                                                                                           )\n                                                                                                         )\n                                                                                                         ( (34 :: int)\n                                                                                                           := (15 :: int)\n                                                                                                         )\n                                                                                                       )\n                                                                                                       ( (35 :: int)\n                                                                                                         := (11 :: int)\n                                                                                                       )\n                                                                                                     )\n                                                                                                     ( (36 :: int)\n                                                                                                       := (8 :: int)\n                                                                                                     )\n                                                                                                   )\n                                                                                                   ( (37 :: int)\n                                                                                                     := (6 :: int)\n                                                                                                   )\n                                                                                                 )\n                                                                                                 ( (38 :: int)\n                                                                                                   := (6 :: int)\n                                                                                                 )\n                                                                                               )\n                                                                                               ( (39 :: int)\n                                                                                                 := (14 :: int)\n                                                                                               )\n                                                                                             )\n                                                                                             ( (40 :: int)\n                                                                                               := (12 :: int)\n                                                                                             )\n                                                                                           )\n                                                                                           ( (41 :: int)\n                                                                                             := (13 :: int)\n                                                                                           )\n                                                                                         )\n                                                                                         ( (42 :: int)\n                                                                                           := (5 :: int)\n                                                                                         )\n                                                                                       )\n                                                                                       ( (43 :: int)\n                                                                                         := (14 :: int)\n                                                                                       )\n                                                                                     )\n                                                                                     ( (44 :: int)\n                                                                                       := (13 :: int)\n                                                                                     )\n                                                                                   )\n                                                                                   ( (45 :: int)\n                                                                                     := (13 :: int)\n                                                                                   )\n                                                                                 )\n                                                                                 ( (46 :: int)\n                                                                                   := (7 :: int)\n                                                                                 )\n                                                                               )\n                                                                               ( (47 :: int)\n                                                                                 := (5 :: int)\n                                                                               )\n                                                                             )\n                                                                             ( (48 :: int)\n                                                                               := (15 :: int)\n                                                                             )\n                                                                           )\n                                                                           ( (49 :: int)\n                                                                             := (5 :: int)\n                                                                           )\n                                                                         )\n                                                                         ( (50 :: int)\n                                                                           := (8 :: int)\n                                                                         )\n                                                                       )\n                                                                       ( (51 :: int)\n                                                                         := (11 :: int)\n                                                                       )\n                                                                     )\n                                                                     ( (52 :: int)\n                                                                       := (14 :: int)\n                                                                     )\n                                                                   )\n                                                                   ( (53 :: int)\n                                                                     := (14 :: int)\n                                                                   )\n                                                                 )\n                                                                 ( (54 :: int)\n                                                                   := (6 :: int)\n                                                                 )\n                                                               )\n                                                               ( (55 :: int)\n                                                                 := (14 :: int)\n                                                               )\n                                                             )\n                                                             ( (56 :: int)\n                                                               := (6 :: int)\n                                                             )\n                                                           )\n                                                           ( (57 :: int)\n                                                             := (9 :: int)\n                                                           )\n                                                         )\n                                                         ( (58 :: int)\n                                                           := (12 :: int)\n                                                         )\n                                                       )\n                                                       ( (59 :: int)\n                                                         := (9 :: int)\n                                                       )\n                                                     )\n                                                     ( (60 :: int)\n                                                       := (12 :: int)\n                                                     )\n                                                   )\n                                                   ( (61 :: int)\n                                                     := (5 :: int)\n                                                   )\n                                                 )\n                                                 ( (62 :: int)\n                                                   := (15 :: int)\n                                                 )\n                                               )\n                                               ( (63 :: int)\n                                                 := (8 :: int)\n                                               )\n                                             )\n                                             ( (64 :: int)\n                                               := (8 :: int)\n                                             )\n                                           )\n                                           ( (65 :: int)\n                                             := (5 :: int)\n                                           )\n                                         )\n                                         ( (66 :: int)\n                                           := (12 :: int)\n                                         )\n                                       )\n                                       ( (67 :: int)\n                                         := (9 :: int)\n                                       )\n                                     )\n                                     ( (68 :: int)\n                                       := (12 :: int)\n                                     )\n                                   )\n                                   ( (69 :: int)\n                                     := (5 :: int)\n                                   )\n                                 )\n                                 ( (70 :: int)\n                                   := (14 :: int)\n                                 )\n                               )\n                               ( (71 :: int)\n                                 := (6 :: int)\n                               )\n                             )\n                             ( (72 :: int)\n                               := (8 :: int)\n                             )\n                           )\n                           ( (73 :: int)\n                             := (13 :: int)\n                           )\n                         )\n                         ( (74 :: int)\n                           := (6 :: int)\n                         )\n                       )\n                       ( (75 :: int)\n                         := (5 :: int)\n                       )\n                     )\n                     ( (76 :: int)\n                       := (15 :: int)\n                     )\n                   )\n                   ( (77 :: int)\n                     := (13 :: int)\n                   )\n                 )\n                 ( (78 :: int)\n                   := (11 :: int)\n                 )\n               )\n               ( (79 :: int)\n                 := (11 :: int)\n               )\n             )\n               S_R_Spark_Declaration.j''\n        \" (is \"?C1\")\napply (insert assms) by (rule userlemmas)\n\nlemma goal2'3: \n  assumes R1: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> S_R_Spark_Declaration.rotate_amount__first''\n            <= S_R_Spark_Declaration.s_values'' I''\n  \"\n  assumes R2: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> S_R_Spark_Declaration.s_values'' I''\n            <= S_R_Spark_Declaration.rotate_amount__last''\n  \"\n  assumes R3: \n  \" S_R_Spark_Declaration.s_values''\n    = ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( S_R_Spark_Declaration.rotate_definition___default_arr''\n                                                                                                                                                                    ( S_R_Spark_Declaration.round_index__first''\n                                                                                                                                                                      := (8 :: int)\n                                                                                                                                                                    )\n                                                                                                                                                                  )\n                                                                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (1 :: int)\n                                                                                                                                                                    := (9 :: int)\n                                                                                                                                                                  )\n                                                                                                                                                                )\n                                                                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (2 :: int)\n                                                                                                                                                                  := (9 :: int)\n                                                                                                                                                                )\n                                                                                                                                                              )\n                                                                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (3 :: int)\n                                                                                                                                                                := (11 :: int)\n                                                                                                                                                              )\n                                                                                                                                                            )\n                                                                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (4 :: int)\n                                                                                                                                                              := (13 :: int)\n                                                                                                                                                            )\n                                                                                                                                                          )\n                                                                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (5 :: int)\n                                                                                                                                                            := (15 :: int)\n                                                                                                                                                          )\n                                                                                                                                                        )\n                                                                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (6 :: int)\n                                                                                                                                                          := (15 :: int)\n                                                                                                                                                        )\n                                                                                                                                                      )\n                                                                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (7 :: int)\n                                                                                                                                                        := (5 :: int)\n                                                                                                                                                      )\n                                                                                                                                                    )\n                                                                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (8 :: int)\n                                                                                                                                                      := (7 :: int)\n                                                                                                                                                    )\n                                                                                                                                                  )\n                                                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (9 :: int)\n                                                                                                                                                    := (7 :: int)\n                                                                                                                                                  )\n                                                                                                                                                )\n                                                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (10 :: int)\n                                                                                                                                                  := (8 :: int)\n                                                                                                                                                )\n                                                                                                                                              )\n                                                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (11 :: int)\n                                                                                                                                                := (11 :: int)\n                                                                                                                                              )\n                                                                                                                                            )\n                                                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (12 :: int)\n                                                                                                                                              := (14 :: int)\n                                                                                                                                            )\n                                                                                                                                          )\n                                                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (13 :: int)\n                                                                                                                                            := (14 :: int)\n                                                                                                                                          )\n                                                                                                                                        )\n                                                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (14 :: int)\n                                                                                                                                          := (12 :: int)\n                                                                                                                                        )\n                                                                                                                                      )\n                                                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (15 :: int)\n                                                                                                                                        := (6 :: int)\n                                                                                                                                      )\n                                                                                                                                    )\n                                                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (16 :: int)\n                                                                                                                                      := (9 :: int)\n                                                                                                                                    )\n                                                                                                                                  )\n                                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (17 :: int)\n                                                                                                                                    := (13 :: int)\n                                                                                                                                  )\n                                                                                                                                )\n                                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (18 :: int)\n                                                                                                                                  := (15 :: int)\n                                                                                                                                )\n                                                                                                                              )\n                                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (19 :: int)\n                                                                                                                                := (7 :: int)\n                                                                                                                              )\n                                                                                                                            )\n                                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (20 :: int)\n                                                                                                                              := (12 :: int)\n                                                                                                                            )\n                                                                                                                          )\n                                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (21 :: int)\n                                                                                                                            := (8 :: int)\n                                                                                                                          )\n                                                                                                                        )\n                                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (22 :: int)\n                                                                                                                          := (9 :: int)\n                                                                                                                        )\n                                                                                                                      )\n                                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (23 :: int)\n                                                                                                                        := (11 :: int)\n                                                                                                                      )\n                                                                                                                    )\n                                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (24 :: int)\n                                                                                                                      := (7 :: int)\n                                                                                                                    )\n                                                                                                                  )\n                                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (25 :: int)\n                                                                                                                    := (7 :: int)\n                                                                                                                  )\n                                                                                                                )\n                                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (26 :: int)\n                                                                                                                  := (12 :: int)\n                                                                                                                )\n                                                                                                              )\n                                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (27 :: int)\n                                                                                                                := (7 :: int)\n                                                                                                              )\n                                                                                                            )\n                                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (28 :: int)\n                                                                                                              := (6 :: int)\n                                                                                                            )\n                                                                                                          )\n                                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (29 :: int)\n                                                                                                            := (15 :: int)\n                                                                                                          )\n                                                                                                        )\n                                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (30 :: int)\n                                                                                                          := (13 :: int)\n                                                                                                        )\n                                                                                                      )\n                                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (31 :: int)\n                                                                                                        := (11 :: int)\n                                                                                                      )\n                                                                                                    )\n                                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (32 :: int)\n                                                                                                      := (9 :: int)\n                                                                                                    )\n                                                                                                  )\n                                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (33 :: int)\n                                                                                                    := (7 :: int)\n                                                                                                  )\n                                                                                                )\n                                                                                                ( S_R_Spark_Declaration.round_index__first'' + (34 :: int)\n                                                                                                  := (15 :: int)\n                                                                                                )\n                                                                                              )\n                                                                                              ( S_R_Spark_Declaration.round_index__first'' + (35 :: int)\n                                                                                                := (11 :: int)\n                                                                                              )\n                                                                                            )\n                                                                                            ( S_R_Spark_Declaration.round_index__first'' + (36 :: int)\n                                                                                              := (8 :: int)\n                                                                                            )\n                                                                                          )\n                                                                                          ( S_R_Spark_Declaration.round_index__first'' + (37 :: int)\n                                                                                            := (6 :: int)\n                                                                                          )\n                                                                                        )\n                                                                                        ( S_R_Spark_Declaration.round_index__first'' + (38 :: int)\n                                                                                          := (6 :: int)\n                                                                                        )\n                                                                                      )\n                                                                                      ( S_R_Spark_Declaration.round_index__first'' + (39 :: int)\n                                                                                        := (14 :: int)\n                                                                                      )\n                                                                                    )\n                                                                                    ( S_R_Spark_Declaration.round_index__first'' + (40 :: int)\n                                                                                      := (12 :: int)\n                                                                                    )\n                                                                                  )\n                                                                                  ( S_R_Spark_Declaration.round_index__first'' + (41 :: int)\n                                                                                    := (13 :: int)\n                                                                                  )\n                                                                                )\n                                                                                ( S_R_Spark_Declaration.round_index__first'' + (42 :: int)\n                                                                                  := (5 :: int)\n                                                                                )\n                                                                              )\n                                                                              ( S_R_Spark_Declaration.round_index__first'' + (43 :: int)\n                                                                                := (14 :: int)\n                                                                              )\n                                                                            )\n                                                                            ( S_R_Spark_Declaration.round_index__first'' + (44 :: int)\n                                                                              := (13 :: int)\n                                                                            )\n                                                                          )\n                                                                          ( S_R_Spark_Declaration.round_index__first'' + (45 :: int)\n                                                                            := (13 :: int)\n                                                                          )\n                                                                        )\n                                                                        ( S_R_Spark_Declaration.round_index__first'' + (46 :: int)\n                                                                          := (7 :: int)\n                                                                        )\n                                                                      )\n                                                                      ( S_R_Spark_Declaration.round_index__first'' + (47 :: int)\n                                                                        := (5 :: int)\n                                                                      )\n                                                                    )\n                                                                    ( S_R_Spark_Declaration.round_index__first'' + (48 :: int)\n                                                                      := (15 :: int)\n                                                                    )\n                                                                  )\n                                                                  ( S_R_Spark_Declaration.round_index__first'' + (49 :: int)\n                                                                    := (5 :: int)\n                                                                  )\n                                                                )\n                                                                ( S_R_Spark_Declaration.round_index__first'' + (50 :: int)\n                                                                  := (8 :: int)\n                                                                )\n                                                              )\n                                                              ( S_R_Spark_Declaration.round_index__first'' + (51 :: int)\n                                                                := (11 :: int)\n                                                              )\n                                                            )\n                                                            ( S_R_Spark_Declaration.round_index__first'' + (52 :: int)\n                                                              := (14 :: int)\n                                                            )\n                                                          )\n                                                          ( S_R_Spark_Declaration.round_index__first'' + (53 :: int)\n                                                            := (14 :: int)\n                                                          )\n                                                        )\n                                                        ( S_R_Spark_Declaration.round_index__first'' + (54 :: int)\n                                                          := (6 :: int)\n                                                        )\n                                                      )\n                                                      ( S_R_Spark_Declaration.round_index__first'' + (55 :: int)\n                                                        := (14 :: int)\n                                                      )\n                                                    )\n                                                    ( S_R_Spark_Declaration.round_index__first'' + (56 :: int)\n                                                      := (6 :: int)\n                                                    )\n                                                  )\n                                                  ( S_R_Spark_Declaration.round_index__first'' + (57 :: int)\n                                                    := (9 :: int)\n                                                  )\n                                                )\n                                                ( S_R_Spark_Declaration.round_index__first'' + (58 :: int)\n                                                  := (12 :: int)\n                                                )\n                                              )\n                                              ( S_R_Spark_Declaration.round_index__first'' + (59 :: int)\n                                                := (9 :: int)\n                                              )\n                                            )\n                                            ( S_R_Spark_Declaration.round_index__first'' + (60 :: int)\n                                              := (12 :: int)\n                                            )\n                                          )\n                                          ( S_R_Spark_Declaration.round_index__first'' + (61 :: int)\n                                            := (5 :: int)\n                                          )\n                                        )\n                                        ( S_R_Spark_Declaration.round_index__first'' + (62 :: int)\n                                          := (15 :: int)\n                                        )\n                                      )\n                                      ( S_R_Spark_Declaration.round_index__first'' + (63 :: int)\n                                        := (8 :: int)\n                                      )\n                                    )\n                                    ( S_R_Spark_Declaration.round_index__first'' + (64 :: int)\n                                      := (8 :: int)\n                                    )\n                                  )\n                                  ( S_R_Spark_Declaration.round_index__first'' + (65 :: int)\n                                    := (5 :: int)\n                                  )\n                                )\n                                ( S_R_Spark_Declaration.round_index__first'' + (66 :: int)\n                                  := (12 :: int)\n                                )\n                              )\n                              ( S_R_Spark_Declaration.round_index__first'' + (67 :: int)\n                                := (9 :: int)\n                              )\n                            )\n                            ( S_R_Spark_Declaration.round_index__first'' + (68 :: int)\n                              := (12 :: int)\n                            )\n                          )\n                          ( S_R_Spark_Declaration.round_index__first'' + (69 :: int)\n                            := (5 :: int)\n                          )\n                        )\n                        ( S_R_Spark_Declaration.round_index__first'' + (70 :: int)\n                          := (14 :: int)\n                        )\n                      )\n                      ( S_R_Spark_Declaration.round_index__first'' + (71 :: int)\n                        := (6 :: int)\n                      )\n                    )\n                    ( S_R_Spark_Declaration.round_index__first'' + (72 :: int)\n                      := (8 :: int)\n                    )\n                  )\n                  ( S_R_Spark_Declaration.round_index__first'' + (73 :: int)\n                    := (13 :: int)\n                  )\n                )\n                ( S_R_Spark_Declaration.round_index__first'' + (74 :: int)\n                  := (6 :: int)\n                )\n              )\n              ( S_R_Spark_Declaration.round_index__first'' + (75 :: int)\n                := (5 :: int)\n              )\n            )\n            ( S_R_Spark_Declaration.round_index__first'' + (76 :: int)\n              := (15 :: int)\n            )\n          )\n          ( S_R_Spark_Declaration.round_index__first'' + (77 :: int)\n            := (13 :: int)\n          )\n        )\n        ( S_R_Spark_Declaration.round_index__first'' + (78 :: int)\n          := (11 :: int)\n        )\n      )\n      ( S_R_Spark_Declaration.round_index__first'' + (79 :: int)\n        := (11 :: int)\n      )\n  \"\n  assumes R4: \" (0 :: int) <= S_R_Spark_Declaration.integer__size'' \"\n  assumes R5: \n  \" S_R_Spark_Declaration.integer__first'' <= S_R_Spark_Declaration.integer__last''\n  \"\n  assumes R6: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes R7: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__first''\n  \"\n  assumes R8: \n  \" S_R_Spark_Declaration.integer__last''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes R9: \n  \" (0 :: int) <= S_R_Spark_Declaration.round_index__size''\n  \"\n  assumes R10: \n  \" S_R_Spark_Declaration.round_index__first'' = (0 :: int)\n  \"\n  assumes R11: \n  \" S_R_Spark_Declaration.round_index__last'' = (79 :: int)\n  \"\n  assumes R12: \n  \" S_R_Spark_Declaration.round_index__base__first''\n    <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R13: \n  \" S_R_Spark_Declaration.round_index__base__first''\n    <= S_R_Spark_Declaration.round_index__first''\n  \"\n  assumes R14: \n  \" S_R_Spark_Declaration.round_index__last''\n    <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R15: \n  \" (0 :: int) <= S_R_Spark_Declaration.rotate_amount__size''\n  \"\n  assumes R16: \n  \" S_R_Spark_Declaration.rotate_amount__first'' = (0 :: int)\n  \"\n  assumes R17: \n  \" S_R_Spark_Declaration.rotate_amount__last'' = (15 :: int)\n  \"\n  assumes R18: \n  \" S_R_Spark_Declaration.rotate_amount__base__first''\n    <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  assumes R19: \n  \" S_R_Spark_Declaration.rotate_amount__base__first''\n    <= S_R_Spark_Declaration.rotate_amount__first''\n  \"\n  assumes R20: \n  \" S_R_Spark_Declaration.rotate_amount__last''\n    <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  assumes R21: \n  \" ALL ( i1'' :: int ) ( v'' :: int )\n    .   ( S_R_Spark_Declaration.rotate_definition___mk_const_arr' v'' ) i1''\n        = v''\n  \"\n  assumes H1: \" (0 :: int) <= S_R_Spark_Declaration.j'' \"\n  assumes H2: \" S_R_Spark_Declaration.j'' <= (79 :: int) \"\n  assumes H3: \" (0 :: int) <= S_R_Spark_Declaration.integer__size'' \"\n  assumes H4: \n  \" S_R_Spark_Declaration.integer__first'' <= S_R_Spark_Declaration.integer__last''\n  \"\n  assumes H5: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes H6: \n  \" S_R_Spark_Declaration.integer__base__first''\n    <= S_R_Spark_Declaration.integer__first''\n  \"\n  assumes H7: \n  \" S_R_Spark_Declaration.integer__last''\n    <= S_R_Spark_Declaration.integer__base__last''\n  \"\n  assumes H8: \n  \" (0 :: int) <= S_R_Spark_Declaration.round_index__size''\n  \"\n  assumes H9: \n  \" S_R_Spark_Declaration.round_index__base__first''\n    <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes H10: \n  \" (0 :: int) <= S_R_Spark_Declaration.rotate_amount__size''\n  \"\n  assumes H11: \n  \" S_R_Spark_Declaration.rotate_amount__base__first''\n    <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  assumes H12: \n  \" S_R_Spark_Declaration.round_index__base__first'' <= (0 :: int)\n  \"\n  assumes H13: \n  \" (79 :: int) <= S_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes H14: \n  \" S_R_Spark_Declaration.rotate_amount__base__first'' <= (0 :: int)\n  \"\n  assumes H15: \n  \" (15 :: int) <= S_R_Spark_Declaration.rotate_amount__base__last''\n  \"\n  shows \" ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( S_R_Spark_Declaration.rotate_definition___default_arr''\n                                                                                                                                                                          ( (0 :: int)\n                                                                                                                                                                            := (8 :: int)\n                                                                                                                                                                          )\n                                                                                                                                                                        )\n                                                                                                                                                                        ( (1 :: int)\n                                                                                                                                                                          := (9 :: int)\n                                                                                                                                                                        )\n                                                                                                                                                                      )\n                                                                                                                                                                      ( (2 :: int)\n                                                                                                                                                                        := (9 :: int)\n                                                                                                                                                                      )\n                                                                                                                                                                    )\n                                                                                                                                                                    ( (3 :: int)\n                                                                                                                                                                      := (11 :: int)\n                                                                                                                                                                    )\n                                                                                                                                                                  )\n                                                                                                                                                                  ( (4 :: int)\n                                                                                                                                                                    := (13 :: int)\n                                                                                                                                                                  )\n                                                                                                                                                                )\n                                                                                                                                                                ( (5 :: int)\n                                                                                                                                                                  := (15 :: int)\n                                                                                                                                                                )\n                                                                                                                                                              )\n                                                                                                                                                              ( (6 :: int)\n                                                                                                                                                                := (15 :: int)\n                                                                                                                                                              )\n                                                                                                                                                            )\n                                                                                                                                                            ( (7 :: int)\n                                                                                                                                                              := (5 :: int)\n                                                                                                                                                            )\n                                                                                                                                                          )\n                                                                                                                                                          ( (8 :: int)\n                                                                                                                                                            := (7 :: int)\n                                                                                                                                                          )\n                                                                                                                                                        )\n                                                                                                                                                        ( (9 :: int)\n                                                                                                                                                          := (7 :: int)\n                                                                                                                                                        )\n                                                                                                                                                      )\n                                                                                                                                                      ( (10 :: int)\n                                                                                                                                                        := (8 :: int)\n                                                                                                                                                      )\n                                                                                                                                                    )\n                                                                                                                                                    ( (11 :: int)\n                                                                                                                                                      := (11 :: int)\n                                                                                                                                                    )\n                                                                                                                                                  )\n                                                                                                                                                  ( (12 :: int)\n                                                                                                                                                    := (14 :: int)\n                                                                                                                                                  )\n                                                                                                                                                )\n                                                                                                                                                ( (13 :: int)\n                                                                                                                                                  := (14 :: int)\n                                                                                                                                                )\n                                                                                                                                              )\n                                                                                                                                              ( (14 :: int)\n                                                                                                                                                := (12 :: int)\n                                                                                                                                              )\n                                                                                                                                            )\n                                                                                                                                            ( (15 :: int)\n                                                                                                                                              := (6 :: int)\n                                                                                                                                            )\n                                                                                                                                          )\n                                                                                                                                          ( (16 :: int)\n                                                                                                                                            := (9 :: int)\n                                                                                                                                          )\n                                                                                                                                        )\n                                                                                                                                        ( (17 :: int)\n                                                                                                                                          := (13 :: int)\n                                                                                                                                        )\n                                                                                                                                      )\n                                                                                                                                      ( (18 :: int)\n                                                                                                                                        := (15 :: int)\n                                                                                                                                      )\n                                                                                                                                    )\n                                                                                                                                    ( (19 :: int)\n                                                                                                                                      := (7 :: int)\n                                                                                                                                    )\n                                                                                                                                  )\n                                                                                                                                  ( (20 :: int)\n                                                                                                                                    := (12 :: int)\n                                                                                                                                  )\n                                                                                                                                )\n                                                                                                                                ( (21 :: int)\n                                                                                                                                  := (8 :: int)\n                                                                                                                                )\n                                                                                                                              )\n                                                                                                                              ( (22 :: int)\n                                                                                                                                := (9 :: int)\n                                                                                                                              )\n                                                                                                                            )\n                                                                                                                            ( (23 :: int)\n                                                                                                                              := (11 :: int)\n                                                                                                                            )\n                                                                                                                          )\n                                                                                                                          ( (24 :: int)\n                                                                                                                            := (7 :: int)\n                                                                                                                          )\n                                                                                                                        )\n                                                                                                                        ( (25 :: int)\n                                                                                                                          := (7 :: int)\n                                                                                                                        )\n                                                                                                                      )\n                                                                                                                      ( (26 :: int)\n                                                                                                                        := (12 :: int)\n                                                                                                                      )\n                                                                                                                    )\n                                                                                                                    ( (27 :: int)\n                                                                                                                      := (7 :: int)\n                                                                                                                    )\n                                                                                                                  )\n                                                                                                                  ( (28 :: int)\n                                                                                                                    := (6 :: int)\n                                                                                                                  )\n                                                                                                                )\n                                                                                                                ( (29 :: int)\n                                                                                                                  := (15 :: int)\n                                                                                                                )\n                                                                                                              )\n                                                                                                              ( (30 :: int)\n                                                                                                                := (13 :: int)\n                                                                                                              )\n                                                                                                            )\n                                                                                                            ( (31 :: int)\n                                                                                                              := (11 :: int)\n                                                                                                            )\n                                                                                                          )\n                                                                                                          ( (32 :: int)\n                                                                                                            := (9 :: int)\n                                                                                                          )\n                                                                                                        )\n                                                                                                        ( (33 :: int)\n                                                                                                          := (7 :: int)\n                                                                                                        )\n                                                                                                      )\n                                                                                                      ( (34 :: int)\n                                                                                                        := (15 :: int)\n                                                                                                      )\n                                                                                                    )\n                                                                                                    ( (35 :: int)\n                                                                                                      := (11 :: int)\n                                                                                                    )\n                                                                                                  )\n                                                                                                  ( (36 :: int)\n                                                                                                    := (8 :: int)\n                                                                                                  )\n                                                                                                )\n                                                                                                ( (37 :: int)\n                                                                                                  := (6 :: int)\n                                                                                                )\n                                                                                              )\n                                                                                              ( (38 :: int)\n                                                                                                := (6 :: int)\n                                                                                              )\n                                                                                            )\n                                                                                            ( (39 :: int)\n                                                                                              := (14 :: int)\n                                                                                            )\n                                                                                          )\n                                                                                          ( (40 :: int)\n                                                                                            := (12 :: int)\n                                                                                          )\n                                                                                        )\n                                                                                        ( (41 :: int)\n                                                                                          := (13 :: int)\n                                                                                        )\n                                                                                      )\n                                                                                      ( (42 :: int)\n                                                                                        := (5 :: int)\n                                                                                      )\n                                                                                    )\n                                                                                    ( (43 :: int)\n                                                                                      := (14 :: int)\n                                                                                    )\n                                                                                  )\n                                                                                  ( (44 :: int)\n                                                                                    := (13 :: int)\n                                                                                  )\n                                                                                )\n                                                                                ( (45 :: int)\n                                                                                  := (13 :: int)\n                                                                                )\n                                                                              )\n                                                                              ( (46 :: int)\n                                                                                := (7 :: int)\n                                                                              )\n                                                                            )\n                                                                            ( (47 :: int)\n                                                                              := (5 :: int)\n                                                                            )\n                                                                          )\n                                                                          ( (48 :: int)\n                                                                            := (15 :: int)\n                                                                          )\n                                                                        )\n                                                                        ( (49 :: int)\n                                                                          := (5 :: int)\n                                                                        )\n                                                                      )\n                                                                      ( (50 :: int)\n                                                                        := (8 :: int)\n                                                                      )\n                                                                    )\n                                                                    ( (51 :: int)\n                                                                      := (11 :: int)\n                                                                    )\n                                                                  )\n                                                                  ( (52 :: int)\n                                                                    := (14 :: int)\n                                                                  )\n                                                                )\n                                                                ( (53 :: int)\n                                                                  := (14 :: int)\n                                                                )\n                                                              )\n                                                              ( (54 :: int)\n                                                                := (6 :: int)\n                                                              )\n                                                            )\n                                                            ( (55 :: int)\n                                                              := (14 :: int)\n                                                            )\n                                                          )\n                                                          ( (56 :: int)\n                                                            := (6 :: int)\n                                                          )\n                                                        )\n                                                        ( (57 :: int)\n                                                          := (9 :: int)\n                                                        )\n                                                      )\n                                                      ( (58 :: int)\n                                                        := (12 :: int)\n                                                      )\n                                                    )\n                                                    ( (59 :: int)\n                                                      := (9 :: int)\n                                                    )\n                                                  )\n                                                  ( (60 :: int)\n                                                    := (12 :: int)\n                                                  )\n                                                )\n                                                ( (61 :: int)\n                                                  := (5 :: int)\n                                                )\n                                              )\n                                              ( (62 :: int)\n                                                := (15 :: int)\n                                              )\n                                            )\n                                            ( (63 :: int)\n                                              := (8 :: int)\n                                            )\n                                          )\n                                          ( (64 :: int)\n                                            := (8 :: int)\n                                          )\n                                        )\n                                        ( (65 :: int)\n                                          := (5 :: int)\n                                        )\n                                      )\n                                      ( (66 :: int)\n                                        := (12 :: int)\n                                      )\n                                    )\n                                    ( (67 :: int)\n                                      := (9 :: int)\n                                    )\n                                  )\n                                  ( (68 :: int)\n                                    := (12 :: int)\n                                  )\n                                )\n                                ( (69 :: int)\n                                  := (5 :: int)\n                                )\n                              )\n                              ( (70 :: int)\n                                := (14 :: int)\n                              )\n                            )\n                            ( (71 :: int)\n                              := (6 :: int)\n                            )\n                          )\n                          ( (72 :: int)\n                            := (8 :: int)\n                          )\n                        )\n                        ( (73 :: int)\n                          := (13 :: int)\n                        )\n                      )\n                      ( (74 :: int)\n                        := (6 :: int)\n                      )\n                    )\n                    ( (75 :: int)\n                      := (5 :: int)\n                    )\n                  )\n                  ( (76 :: int)\n                    := (15 :: int)\n                  )\n                )\n                ( (77 :: int)\n                  := (13 :: int)\n                )\n              )\n              ( (78 :: int)\n                := (11 :: int)\n              )\n            )\n            ( (79 :: int)\n              := (11 :: int)\n            )\n          )\n            S_R_Spark_Declaration.j''\n          <= (15 :: int)\n        \" (is \"?C1\")\napply (insert assms) by (rule userlemmas)\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/RIPEMD-160-SPARK/S_R_Spark_Obligation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.7634837635542924, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.3401545661866069}}
{"text": "theory SepLogK_VCG \nimports SepLogK_Hoare\nbegin\n  \nlemmas conseqS = conseq[where k=1, simplified]\n\ndatatype acom =\n  Askip                  (\"SKIP\") |\n  Aassign vname aexp     (\"(_ ::= _)\" [1000, 61] 61) |\n  Aseq   acom acom       (\"_;;/ _\"  [60, 61] 60) | \n  Aif bexp acom acom     (\"(IF _/ THEN _/ ELSE _)\"  [0, 0, 61] 61) |\n  Awhile assn2 bexp acom  (\"({_}/ WHILE _/ DO _)\"  [0, 0, 61] 61) \n    \nnotation com.SKIP (\"SKIP\")\n  \nfun strip :: \"acom \\<Rightarrow> com\" where\n\"strip SKIP = SKIP\" |\n\"strip (x ::= a) = (x ::= a)\" |\n\"strip (C\\<^sub>1;; C\\<^sub>2) = (strip C\\<^sub>1;; strip C\\<^sub>2)\" |\n\"strip (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) = (IF b THEN strip C\\<^sub>1 ELSE strip C\\<^sub>2)\" |\n\"strip ({_} WHILE b DO C) = (WHILE b DO strip C)\"  \n\n\nfun pre :: \"acom \\<Rightarrow> assn2 \\<Rightarrow> assn2\" where\n\"pre SKIP Q = ($1 ** Q)\" |\n\"pre (x ::= a) Q = ((\\<lambda>(ps,t). x\\<in>dom ps \\<and> vars a \\<subseteq> dom ps \\<and> Q (ps(x\\<mapsto>(paval a ps)),t) ) ** $1)\" |\n\"pre (C\\<^sub>1;; C\\<^sub>2) Q = pre C\\<^sub>1 (pre C\\<^sub>2 Q)\" |\n\"pre (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) Q = (\n   $1 **  (\\<lambda>(ps,n). vars b \\<subseteq> dom ps \\<and> (if pbval b ps then pre C\\<^sub>1 Q (ps,n)  else pre C\\<^sub>2 Q (ps,n) )))\" |\n\"pre ({I} WHILE b DO C) Q = (I ** $1)\"  \n  \n  \nfun vc :: \"acom \\<Rightarrow> assn2 \\<Rightarrow> bool\" where\n\"vc SKIP Q = True\" |\n\"vc (x ::= a) Q = True\" |\n\"vc (C\\<^sub>1 ;; C\\<^sub>2) Q = ((vc C\\<^sub>1 (pre C\\<^sub>2 Q)) \\<and> (vc C\\<^sub>2 Q) )\" |\n\"vc (IF b THEN C\\<^sub>1 ELSE C\\<^sub>2) Q = (vc C\\<^sub>1 Q \\<and> vc C\\<^sub>2 Q)\" |  \n\"vc ({I} WHILE b DO C) Q =  ( (\\<forall>s. (I s \\<longrightarrow> vars b \\<subseteq> dom (fst s) ) \\<and> ((\\<lambda>(s,n). I (s,n) \\<and> lmaps_to_axpr b True s) s \\<longrightarrow> pre C (I ** $ 1) s)\n         \\<and> ( (\\<lambda>(s,n). I (s,n) \\<and> lmaps_to_axpr b False s) s \\<longrightarrow> Q s)) \\<and> vc C (I  ** $ 1))\" \n\n \nlemma dollar0_left: \"($ 0 \\<and>* Q) = Q\"  \n apply rule unfolding dollar_def sep_conj_def  \n  by force\n  \nlemma vc_sound: \"vc C Q \\<Longrightarrow>  \\<turnstile>\\<^sub>3\\<^sub>' {pre C Q} strip C { Q }\"\nproof (induct C arbitrary: Q)\n  case Askip\n  then show ?case\n    apply simp\n    apply(rule conseqS[OF Frame[OF Skip]])\n        by (auto simp: dollar0_left)  \nnext\n  case (Aassign x1 x2)\n  then show ?case \n    apply simp\n    apply(rule conseqS)\n      apply(rule Assign4)\n      apply auto done\nnext\n  case (Aseq C1 C2)\n  then show ?case   apply (auto intro: Seq)  done\nnext\n  case (Aif b C1 C2)\n  then have Aif1: \"\\<turnstile>\\<^sub>3\\<^sub>' {pre C1 Q} strip C1 {Q}\"\n        and Aif2: \"\\<turnstile>\\<^sub>3\\<^sub>' {pre C2 Q} strip C2 {Q}\"  by auto\n  show ?case apply simp\n    apply (rule conseqS) \n      apply(rule If[where P=\"%(ps,n).  (if pbval b ps then pre C1 Q (ps,n) else pre C2 Q (ps,n))\" and Q=\"Q\"])\n    subgoal apply simp\n      apply (rule conseqS) apply(fact Aif1) by auto \n    subgoal apply simp\n      apply (rule conseqS) apply(fact Aif2) by auto \n     apply (auto simp: sep_conj_ac) \n    unfolding sep_conj_def by blast \nnext\n  case (Awhile I b C)\n  then have\n       dom : \"\\<And>s. (I s \\<longrightarrow> vars b \\<subseteq> dom (fst s) )\"\n      and i: \"\\<And>s.  (\\<lambda>(s,n). I (s,n) \\<and> lmaps_to_axpr b True s) s \\<longrightarrow> pre C (I ** $ 1) s\"\n      and ii: \"\\<And>s.  (\\<lambda>(s,n). I (s,n) \\<and> lmaps_to_axpr b False s) s \\<longrightarrow> Q s\"\n      and C: \"\\<turnstile>\\<^sub>3\\<^sub>' {pre C (I ** $ 1)} strip C {I ** $ 1}\"\n     by fastforce+\n    \n  show ?case\n    apply simp \n    apply(rule conseqS)\n       apply(rule While[where P=I])\n       apply(rule conseqS)\n        apply(rule C)\n    subgoal using i by auto\n    subgoal apply simp using dom unfolding sep_conj_def by force\n    subgoal apply simp using dom unfolding sep_conj_def by force\n    subgoal using ii apply auto done\n    done\nqed  \n  \nlemma vc2valid: \"vc C Q \\<Longrightarrow> \\<forall>s. P s \\<longrightarrow> pre C Q s \\<Longrightarrow> \\<Turnstile>\\<^sub>3\\<^sub>' {P} strip C { Q}\"\n  using hoareT_sound2_part weakenpre vc_sound by metis\n\nlemma pre_mono: assumes \"\\<forall>s. P s \\<longrightarrow> Q s\" shows \"\\<And>s. pre C P s \\<Longrightarrow> pre C Q s\"   \nusing assms proof(induct C arbitrary: P Q)\n  case Askip\n  then show ?case  apply (auto simp: sep_conj_def dollar_def)\n    by force\nnext\n  case (Aassign x1 x2)\n  then show ?case by (auto simp: sep_conj_def dollar_def)\nnext\n  case (Aseq C1 C2)\n  then show ?case by auto\nnext\n  case (Aif b C1 C2)\n  then show ?case apply (auto simp: sep_conj_def dollar_def) \n    subgoal for ps n\n      apply(rule exI[where x=0]) \n      apply(rule exI[where x=1])\n      apply(rule exI[where x=ps]) by auto\n    done\nnext\n  case (Awhile x1 x2 C)\n  then show ?case by auto\nqed\n  \nlemma vc_mono: assumes \"\\<forall>s. P s \\<longrightarrow> Q s\" shows \"vc C P \\<Longrightarrow> vc C Q\"        \nusing assms proof(induct C arbitrary: P Q)\n  case Askip\n  then show ?case by auto\nnext\n  case (Aassign x1 x2)\n  then show ?case  by auto\nnext\n  case (Aseq C1 C2 P Q)\n  then have i: \"vc C1 (pre C2 P)\" and ii: \"vc C2 P\" by auto\n  from  pre_mono[OF ] Aseq(4) have iii: \"\\<forall>s. pre C2 P s \\<longrightarrow> pre C2 Q s\" by blast\n  show ?case  apply auto\n      using Aseq(1)[OF i  iii] Aseq(2)[OF ii Aseq(4)] by auto\nnext\n  case (Aif x1 C1 C2)\n  then show ?case  by auto\nnext\n  case (Awhile I b C P Q)\n  then show ?case by auto\nqed\n\n\nlemma vc_sound': \"vc C Q \\<Longrightarrow> (\\<And>s n. P' (s, n) \\<Longrightarrow> pre C Q (s, k * n)) \\<Longrightarrow> (\\<And>s n. Q (s, n) \\<Longrightarrow> Q' (s, n div k)) \\<Longrightarrow> 0 < k \\<Longrightarrow> \\<turnstile>\\<^sub>3\\<^sub>' {P'} strip C { Q'}\"\n  using conseq vc_mono vc_sound by metis\n\n\n  \n  \n        \nlemma pre_Frame: \"(\\<forall>s. P s \\<longrightarrow> pre C Q s) \\<Longrightarrow> vc C Q\n     \\<Longrightarrow> (\\<exists>C'. strip C = strip C' \\<and>  vc C' (Q ** F) \\<and> (\\<forall>s. (P ** F) s \\<longrightarrow> pre C' (Q ** F) s) )\"  \nproof (induct C arbitrary: P Q)\n  case Askip\n  show ?case \n  proof (rule exI[where x=\"Askip\"], safe)\n    fix a b\n    assume \"(P \\<and>* F) (a, b)\"\n    then obtain ps1 ps2 n1 n2 where A: \"ps1##ps2\" \"a=ps1+ps2\" \"b=n1+n2\"\n      and P: \"P (ps1,n1)\" and F: \"F (ps2,n2)\" unfolding sep_conj_def by auto\n    from P Askip have p: \"($ (Suc 0) \\<and>* Q) (ps1, n1)\" by auto\n    \n    from p A F\n    have \"(($ (Suc 0) \\<and>* Q) \\<and>* F) (a, b)\"\n      apply(subst (2) sep_conj_def) by auto\n    then show \"pre SKIP (Q \\<and>* F) (a, b)\" by (simp add: sep_conj_ac)\n  qed simp\nnext\n  case (Aassign x a)\n  show ?case \n  proof (rule exI[where x=\"Aassign x a\"], safe)\n    fix ps n\n    assume \"(P \\<and>* F) (ps,n)\"\n    then obtain ps1 ps2 n1 n2 where o: \"ps1##ps2\" \"ps=ps1+ps2\" \"n=n1+n2\"\n      and P: \"P (ps1,n1)\" and F: \"F (ps2,n2)\" unfolding sep_conj_def by auto\n    from P Aassign(1) have z: \"((\\<lambda>(ps, t). x \\<in> dom ps \\<and> vars a \\<subseteq> dom ps \\<and> Q (ps(x \\<mapsto> paval a ps), t))\n                                     \\<and>* $ (Suc 0)) (ps1, n1)\" \n        by auto    \n    with o F show \" pre (x ::= a) (Q \\<and>* F) (ps,n)\" apply auto\n      unfolding sep_conj_def dollar_def apply (auto)\n        subgoal by(simp add: plus_fun_def)  \n        subgoal by(auto simp add: plus_fun_def)  \n        subgoal\n          by (smt add_update_distrib dom_fun_upd domain_conv insert_dom option.simps(3) paval_extend sep_disj_fun_def)\n        done\n  qed auto\nnext\n  case (Aseq C1 C2) \n  from Aseq(3) have pre: \"\\<forall>s. P s \\<longrightarrow> pre C1 (pre C2 Q) s\" by auto\n  from Aseq(4) have vc1: \"vc C1 (pre C2 Q)\" and vc2: \"vc C2 Q\" by auto\n  from Aseq(1)[OF pre vc1] obtain C1' where S1: \"strip C1 = strip C1'\"\n      and vc1': \"vc C1' (pre C2 Q \\<and>* F)\"\n      and I1: \"(\\<forall>s. (P \\<and>* F) s \\<longrightarrow> pre C1' (pre C2 Q \\<and>* F) s)\" by blast\n  from Aseq(2)[of \"pre C2 Q\" Q, OF _ vc2] obtain C2' where S2: \"strip C2 = strip C2'\"\n      and vc2': \"vc C2' (Q \\<and>* F)\"\n      and I2: \"(\\<forall>s. (pre C2 Q \\<and>* F) s \\<longrightarrow> pre C2' (Q \\<and>* F) s) \" by blast\n   \n  show ?case apply(rule exI[where x=\"Aseq C1' C2'\"])    \n    apply safe\n    subgoal using S1 S2 by auto\n    subgoal apply simp apply safe\n      subgoal using vc_mono[OF I2 vc1'] .\n      subgoal by (fact vc2')\n    done\n    subgoal using I1 I2 pre_mono\n      by force \n    done\nnext\n  case (Aif b C1 C2)\n  from Aif(3) have i: \"\\<forall>s. P s \\<longrightarrow>\n          ($ (Suc 0) \\<and>*\n           (\\<lambda>(ps, n). vars b \\<subseteq> dom ps \\<and> (if pbval b ps then pre C1 Q (ps, n) else pre C2 Q (ps, n))))\n           s\" by simp  \n  from Aif(4) have vc1: \"vc C1 Q\" and vc2: \"vc C2 Q\" by auto \n  from Aif(1)[where P=\"pre C1 Q\" and Q=\"Q\", OF _ vc1] obtain C1' where\n    s1: \"strip C1 = strip C1'\" and v1: \"vc C1' (Q \\<and>* F)\"\n    and p1: \"(\\<forall>s. (pre C1 Q \\<and>* F) s \\<longrightarrow> pre C1' (Q \\<and>* F) s)\"\n    by auto\n  from Aif(2)[where P=\"pre C2 Q\" and Q=\"Q\", OF _ vc2] obtain C2' where\n    s2: \"strip C2 = strip C2'\" and v2: \"vc C2' (Q \\<and>* F)\" \n    and p2: \"(\\<forall>s. (pre C2 Q \\<and>* F) s \\<longrightarrow> pre C2' (Q \\<and>* F) s)\"\n    by auto\n    \n  show ?case apply(rule exI[where x=\"Aif b C1' C2'\"])\n  proof safe\n    fix ps n\n    assume \"(P \\<and>* F) (ps, n)\"\n    then obtain ps1 ps2 n1 n2 where o: \"ps1##ps2\" \"ps=ps1+ps2\" \"n=n1+n2\"\n      and P: \"P (ps1,n1)\" and F: \"F (ps2,n2)\" unfolding sep_conj_def by auto\n    from P i have P': \"($ (Suc 0) \\<and>*\n         (\\<lambda>(ps, n). vars b \\<subseteq> dom ps \\<and> (if pbval b ps then pre C1 Q (ps, n) else pre C2 Q (ps, n))))\n         (ps1,n1)\" by auto\n    have PF: \"(($ (Suc 0) \\<and>*\n         (\\<lambda>(ps, n). vars b \\<subseteq> dom ps \\<and> (if pbval b ps then pre C1 Q (ps, n) else pre C2 Q (ps, n)))) ** F)\n         (ps,n)\" apply(subst (2) sep_conj_def)\n        apply(rule exI[where x=\"(ps1,n1)\"])\n        apply(rule exI[where x=\"(ps2,n2)\"])\n      using F P' o by auto \n    from this[simplified sep_conj_assoc] obtain ps1 ps2 n1 n2 where o: \"ps1##ps2\" \"ps=ps1+ps2\" \"n=n1+n2\"\n      and P: \"($ (Suc 0)) (ps1,n1)\" and F: \"((\\<lambda>(ps, n). vars b \\<subseteq> dom ps \\<and> (if pbval b ps then pre C1 Q (ps, n) else pre C2 Q (ps, n))) \\<and>* F) (ps2,n2)\"\n      unfolding sep_conj_def apply auto by fast\n    then have \"((\\<lambda>(ps, n). vars b \\<subseteq> dom ps \\<and> (if pbval b ps then (pre C1 Q  \\<and>* F) (ps, n) else (pre C2 Q  \\<and>* F) (ps, n)))) (ps2,n2)\"    \n      unfolding sep_conj_def apply auto\n      apply (metis contra_subsetD domD map_add_dom_app_simps(1) plus_fun_conv sep_add_commute)\n      using pbval_extend apply auto[1]                                                     \n      apply (metis contra_subsetD domD map_add_dom_app_simps(1) plus_fun_conv sep_add_commute) \n      using pbval_extend apply auto[1]    done\n    then have \"((\\<lambda>(ps, n). vars b \\<subseteq> dom ps \\<and> (if pbval b ps then (pre C1' (Q \\<and>* F)) (ps, n) else (pre C2' (Q \\<and>* F)) (ps, n)))) (ps2,n2)\" \n      using p1 p2  by auto\n    with o P \n    show \"pre (IF b THEN C1' ELSE C2') (Q \\<and>* F) (ps, n)\"\n      apply auto apply(subst sep_conj_def) by force\n  qed (auto simp: s1 s2 v1 v2)\nnext\n  case (Awhile I b C)\n  from Awhile(2) have pre: \"\\<forall>s. P s \\<longrightarrow>  (I ** $1) s\"  by auto\n  from Awhile(3) have \n    dom:  \"\\<forall>ps n. I (ps, n) \\<longrightarrow> vars b \\<subseteq> dom ps\" \n  and  tB: \"\\<forall>s. I s \\<and> vars b \\<subseteq> dom (fst s) \\<and> pbval b (fst s) \\<longrightarrow> pre C (I \\<and>* $ (Suc 0)) s\"\n  and  fB: \"\\<forall>ps n. I (ps, n) \\<and> vars b \\<subseteq> dom ps \\<and> \\<not> pbval b ps \\<longrightarrow> Q (ps, n)\"\n  and vcB: \"vc C (I \\<and>* $(Suc 0))\" by auto\n  from Awhile(1)[OF tB vcB] obtain C' where st: \"strip C = strip C'\"\n    and vc': \"vc C' ((I \\<and>* $ (Suc 0)) \\<and>* F)\"\n    and pre': \"(\\<forall>s. ((\\<lambda>a. I a \\<and> vars b \\<subseteq> dom (fst a) \\<and> pbval b (fst a)) \\<and>* F) s \\<longrightarrow>\n            pre C' ((I \\<and>* $ (Suc 0)) \\<and>* F) s)\"\n    by auto\n  show ?case apply(rule exI[where x=\"Awhile (I**F) b C'\"])\n    apply safe\n    subgoal using st by simp \n    subgoal apply simp apply safe\n        subgoal using dom unfolding sep_conj_def apply auto\n          by (metis domD sep_substate_disj_add subState subsetCE) \n        subgoal  using pre' apply(auto simp: sep_conj_ac) \n            apply(subst (asm)  sep_conj_def)\n            apply(subst (asm)  sep_conj_def) apply auto\n          by (metis dom pbval_extend sep_add_commute sep_disj_commuteI)\n        subgoal using fB unfolding sep_conj_def apply auto\n          using dom pbval_extend by fastforce\n        subgoal using vc' apply(auto simp: sep_conj_ac) done\n        done\n      subgoal apply simp using pre unfolding sep_conj_def apply auto\n        by (smt semiring_normalization_rules(23) sep_add_assoc sep_add_commute sep_add_disjD sep_add_disjI1)\n      done\nqed\n\n  \n  \n        \n        \n        \nlemma vc_complete: \"\\<turnstile>\\<^sub>3\\<^sub>a {P} c { Q } \\<Longrightarrow> (\\<exists>C. vc C Q \\<and> (\\<forall>s. P s \\<longrightarrow> pre C Q s) \\<and> strip C = c)\"\nproof(induct   rule: hoare3a.induct)\n  case Skip\n  then show ?case apply(rule exI[where x=\"Askip\"]) by auto\nnext\n  case (Assign4 x a Q)\n  then show ?case apply(rule exI[where x=\"Aassign x a\"]) by auto\nnext\n  case (If P b c\\<^sub>1 Q c\\<^sub>2)\n  from If(2) obtain C1 where A1: \"vc C1 Q\" \"strip C1 = c\\<^sub>1\" and \n    A2: \"\\<And>ps n. (P (ps, n) \\<and> lmaps_to_axpr b True ps) \\<longrightarrow> pre C1 Q (ps,n)\"\n    by blast\n  from If(4) obtain C2 where B1: \"vc C2 Q\" \"strip C2 = c\\<^sub>2\" and B2:\n    \"\\<And>ps n. (P (ps, n) \\<and> lmaps_to_axpr b False ps) \\<longrightarrow> pre C2 Q (ps,n)\"\n    by blast\n      \n  show ?case apply(rule exI[where x=\"Aif b C1 C2\"]) using A1 B1 apply auto\n    subgoal for ps n\n      unfolding sep_conj_def dollar_def apply auto\n      apply(rule exI[where x=\"0\"])\n      apply(rule exI[where x=\"1\"])\n      apply(rule exI[where x=\"ps\"])\n      using A2 B2 by auto\n  done\nnext\n  case (Frame P C Q F) \n  then obtain C' where vc: \"vc C' Q\" and pre: \"(\\<forall>s. P s \\<longrightarrow> pre C' Q s)\"\n      and strip: \"strip C' = C\" by auto \n  show ?case using pre_Frame[OF pre vc] strip by metis\nnext\n  case (Seq P c\\<^sub>1 Q c\\<^sub>2 R)\n  from Seq(2) obtain C1 where A1: \"vc C1 Q\" \"strip C1 = c\\<^sub>1\" and \n    A2: \"\\<And>s. P s \\<longrightarrow> pre C1 Q s\"\n    by blast\n  from Seq(4) obtain C2 where B1: \"vc C2 R\" \"strip C2 = c\\<^sub>2\" and \n    B2: \"\\<And>s. Q s \\<longrightarrow> pre C2 R s\"\n    by blast\n  show ?case apply(rule exI[where x=\"Aseq C1 C2\"])\n    using B1 A1 apply auto\n    subgoal using vc_mono B2 by auto\n    subgoal apply(rule pre_mono[where P=Q])  using  B2 apply auto\n      using A2 by auto\n    done\nnext\n  case (While I b c)\n  then obtain C where 1: \"vc C ((\\<lambda>(s, n). I (s, n) \\<and> vars b \\<subseteq> dom s) \\<and>* $ 1)\"\n          \"strip C = c\" and 2:\n         \"\\<And>ps n. (I (ps, n) \\<and> lmaps_to_axpr b True ps) \\<longrightarrow>\n              pre C ((\\<lambda>(s, n). I (s, n) \\<and> vars b \\<subseteq> dom s) \\<and>* $ 1) (ps,n) \" by blast\n    \n  show ?case apply(rule exI[where x=\"Awhile (\\<lambda>(s, n). I (s, n) \\<and> vars b \\<subseteq> dom s) b C\"])\n    using 1 2 by auto \nnext\n  case (conseqS P c Q P' Q')\n  then obtain C' where C': \"vc C' Q\" \"(\\<forall>s. P s \\<longrightarrow> pre C' Q s)\" \"strip C' = c\"\n    by blast\n  show ?case apply(rule exI[where x=C'])\n      using C' conseqS(3,4) pre_mono vc_mono by force\nqed \n           \n   \n  \n  \ntheorem vc_completeness:\n  assumes \"\\<Turnstile>\\<^sub>3\\<^sub>' {P} c { Q}\"\n  shows \"\\<exists>C k. vc C (Q ** sep_true)\n          \\<and> (\\<forall>ps n. P (ps, n) \\<longrightarrow> pre C (\\<lambda>(ps, n). (Q ** sep_true) (ps, n div k)) (ps, k * n))\n          \\<and> strip C = c\"\nproof - \n  let ?QG = \"\\<lambda>k (ps,n). (Q ** sep_true) (ps,n div k)\"\n  from assms obtain k where k[simp]: \"k>0\" and p: \"\\<And>ps n. P (ps, n) \\<Longrightarrow> wp\\<^sub>3\\<^sub>' c (\\<lambda>(ps, n). (Q ** sep_true) (ps, n div k)) (ps, k * n)\" \n    using valid_wp by blast \n      \n  from wpT_is_pre  have R: \"\\<turnstile>\\<^sub>3\\<^sub>a {wp\\<^sub>3\\<^sub>' c (?QG k)} c {?QG k}\" by auto\n  \n  have z: \"(\\<forall>s. (\\<lambda>(ps, n). (Q \\<and>* (\\<lambda>s. True)) (ps, n div k)) s) \\<Longrightarrow> (\\<forall>s. (\\<lambda>(ps, n). (Q \\<and>* (\\<lambda>s. True)) (ps, n)) s)\"\n    by (metis (no_types) case_prod_conv k neq0_conv nonzero_mult_div_cancel_left old.prod.exhaust)\n  \n     \n  have z: \"\\<And>ps n. ((Q \\<and>* (\\<lambda>s. True)) (ps, n div k) \\<Longrightarrow> (Q \\<and>* (\\<lambda>s. True)) (ps, n))\"   \n  proof -\n    fix ps n\n    assume \"(Q \\<and>* (\\<lambda>s. True)) (ps, n div k) \"\n    then guess ps1 n1 ps2 n2 unfolding sep_conj_def by auto\n    note o = this\n    from o(4) have nn1: \"n\\<ge>n1\" using k\n      by (metis (full_types) add_leE div_le_dividend) \n    show \"(Q \\<and>* (\\<lambda>s. True)) (ps, n)\" unfolding sep_conj_def\n        apply(rule exI[where x=\"(ps1, n1)\"])\n      apply(rule exI[where x=\"(ps2, n - n1)\"])\n      using o nn1 by auto   \n  qed\n  then have z': \"\\<forall>s. ((Q \\<and>* (\\<lambda>s. True)) (fst s, (snd s) div k) \\<longrightarrow> (Q \\<and>* (\\<lambda>s. True)) s)\"\n    by (metis prod.collapse)   \n      \n  from vc_complete[OF R]   guess C by auto\n  note o = this\n    \n  have y: \"\\<And>ps n. P (ps, n) \\<Longrightarrow>  pre C (\\<lambda>(ps, n). (Q \\<and>* (\\<lambda>s. True)) (ps, n div k)) (ps, k * n)\"\n    using o p by metis \n    \n  show ?thesis apply(rule exI[where x=C])  apply(rule exI[where x=k])\n    apply safe\n    subgoal apply(rule vc_mono[OF _ o(1)]) using z  by blast\n    subgoal using y by blast\n    subgoal using o by simp\n    done\nqed\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Hoare_Time/SepLogK_VCG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.34012110927789324}}
{"text": "section \\<open>Shallow Embedding of LLVM Semantics\\<close>\ntheory LLVM_Shallow\nimports Main  \n  \"LLVM_Memory\"\nbegin\n  text \\<open>We define a type synonym for the LLVM monad\\<close>\n  type_synonym 'a llM = \"('a,unit,llvm_memory,err) M\"\n  translations\n    (type) \"'a llM\" \\<leftharpoondown> (type) \"('a, unit, llvm_memory, err) M\"\n  \n    \n\n  subsection \\<open>Shallow Embedding of Values\\<close>  \n\n  text \\<open>We use a type class to characterize types that can be injected into the value type.\n    We will instantiate this type class to obtain injections from types of shape \n    \\<open>T = T\\<times>T | _ word | _ ptr\\<close>\n  \n    Although, this type class can be instantiated by other types, those will not be accepted \n    by the code generator.\n    \n    We also define a class \\<open>llvm_repv\\<close>, which additionally contains \\<open>unit\\<close>. \n    This is required for void functions, and if-the-else statements that produce no result.\n    \n    Again, while this class might be instantiated for other types, those will be rejected\n    by the code generator.\n  \\<close>\n  \n  class llvm_repv  \n    \n  class llvm_rep = llvm_repv +\n    fixes to_val :: \"'a \\<Rightarrow> llvm_val\"\n      and from_val :: \"llvm_val \\<Rightarrow> 'a\"\n      and struct_of :: \"'a itself \\<Rightarrow> llvm_vstruct\"\n      and init :: 'a\n    assumes from_to_id[simp]: \"from_val o to_val = id\"\n    assumes to_from_id[simp]: \"llvm_vstruct v = struct_of TYPE('a) \\<Longrightarrow> to_val (from_val v) = v\"\n    assumes struct_of_matches[simp]: \"llvm_vstruct (to_val x) = (struct_of TYPE('a))\"\n    assumes init_zero: \"to_val init = llvm_zero_initializer (struct_of TYPE('a))\"\n    \n  begin\n  \n    lemma from_to_id'[simp]: \"from_val (to_val x) = x\" \n      using pointfree_idE[OF from_to_id] .\n  \n    lemma \"to_val x = to_val y \\<longleftrightarrow> x=y\"  \n      by (metis from_to_id')\n      \n  end\n  \n  text \\<open>We use a phantom type to attach the type of the pointed to value to a pointer.\n    Note that we define pointers for any datatype. While it will always point to \n    representable datatypes, this enables easy \\<open>llvm_rep\\<close> instantiations for recursive structures\n    via pointers, such as linked list cells. \n  \\<close>\n  datatype 'a ptr = PTR (the_raw_ptr: llvm_ptr)\n  definition null :: \"'a ptr\" where \"null = PTR llvm_null\"\n  \n\n  text \\<open>We instantiate the type classes for the supported types, \n    i.e., unit, word, ptr, and prod.\\<close>\n  \n  instance unit :: llvm_repv by standard\n  \n  instantiation word :: (len) llvm_rep begin\n    definition \"to_val w \\<equiv> llvm_int (lconst (len_of TYPE('a)) (uint w))\"\n    definition \"from_val v \\<equiv> word_of_int (lint_to_uint (llvm_the_int v))\"\n    definition [simp]: \"struct_of_word (_::'a word itself) \\<equiv> llvm_s_int (len_of TYPE('a))\"\n    definition [simp]: \"init_word \\<equiv> 0::'a word\"\n    \n    \n    lemma int_inv_aux: \"width i = LENGTH('a) \\<Longrightarrow> lconst LENGTH('a) (uint (word_of_int (lint_to_uint i) :: 'a word)) = i\"\n      by (metis uint_const uint_eq uint_lower_bound uint_upper_bound width_lconst word_of_int_inverse word_ubin.norm_Rep)\n    \n    instance\n      apply standard\n      apply (rule ext)\n      apply (auto simp: from_val_word_def to_val_word_def)\n      apply (auto simp: llvm_s_int_def llvm_zero_initializer_def llvm_int_def)\n      subgoal for v apply (cases v) \n        apply (auto simp: llvm_int_def llvm_the_int_def llvm_s_ptr_def llvm_struct_def llvm_ptr_def llvm_vstruct_def)\n        using int_inv_aux apply (simp add: llvm_vstruct_def) \n      done\n      done\n      \n  end\n  \n  instantiation ptr :: (type) llvm_rep begin\n    definition \"to_val_ptr \\<equiv> llvm_ptr o ptr.the_raw_ptr\"\n    definition \"from_val_ptr v \\<equiv> PTR (llvm_the_ptr v)\"\n    definition [simp]: \"struct_of_ptr (_::'a ptr itself) \\<equiv> llvm_s_ptr\"\n    definition [simp]: \"init_ptr::'a ptr \\<equiv> null\"\n  \n    instance\n      apply standard\n      apply (rule ext)\n      apply (auto simp: from_val_ptr_def to_val_ptr_def)\n      apply (auto simp: llvm_zero_initializer_def llvm_ptr_def llvm_s_ptr_def null_def llvm_null_def)\n      subgoal for v apply (cases v)\n        by (auto simp: llvm_s_int_def llvm_s_struct_def llvm_ptr_def llvm_the_ptr_def)\n      done\n      \n  end\n  \n  instantiation prod :: (llvm_rep, llvm_rep) llvm_rep begin\n    definition \"to_val_prod \\<equiv> \\<lambda>(a,b). llvm_struct [to_val a, to_val b]\"\n    definition \"from_val_prod p \\<equiv> case llvm_the_struct p of [a,b] \\<Rightarrow> (from_val a, from_val b)\"\n    definition [simp]: \"struct_of_prod (_::('a\\<times>'b) itself) \\<equiv> llvm_s_struct [struct_of TYPE('a), struct_of TYPE('b)]\"\n    definition [simp]: \"init_prod ::'a\\<times>'b \\<equiv> (init,init)\"\n    \n    instance\n      apply standard\n      apply (rule ext)\n      apply (auto simp: from_val_prod_def to_val_prod_def)\n      apply (auto simp: llvm_struct_def llvm_s_struct_def init_zero llvm_zero_initializer_def)\n      subgoal for v\n        apply (cases v)\n        apply (auto simp: llvm_s_int_def llvm_s_ptr_def llvm_struct_def llvm_the_struct_def \n          llvm_val.the_val_def llvm_vstruct_def split: prod.splits llvm_val.splits val.split)\n        done\n      done\n      \n  end\n\n  lemma to_val_prod_conv[simp]: \"to_val (a,b) = llvm_struct [to_val a, to_val b]\"\n    unfolding to_val_prod_def by auto\n  \n  \n  text \\<open>Checked conversion from value\\<close>  \n  definition checked_from_val :: \"llvm_val \\<Rightarrow> 'a::llvm_rep llM\" where\n    \"checked_from_val v \\<equiv> doM {\n      fcheck (STATIC_ERROR ''Type mismatch'') (llvm_vstruct v = struct_of TYPE('a));\n      return (from_val v)\n    }\" \n\n      \n  subsection \\<open>Instructions\\<close>  \n  \n  text \\<open>The instructions are arranged in the order as they are described in the \n    LLVM Language Reference Manual \\<^url>\\<open>https://llvm.org/docs/LangRef.html\\<close>.\\<close>\n    \n  \n  subsubsection \\<open>Binary Operations\\<close>  \n  text \\<open>We define a generic lifter for binary arithmetic operations.\n    It is parameterized by an error condition.\n  \\<close> (* TODO: Use precondition instead of negated precondition! *)\n  \n  definition op_lift_arith2 :: \"_ \\<Rightarrow> _ \\<Rightarrow> 'a::len word \\<Rightarrow> 'a word \\<Rightarrow> 'a word llM\"\n    where \"op_lift_arith2 ovf f a b \\<equiv> doM {\n    let a = word_to_lint a;\n    let b = word_to_lint b;\n    fcheck (OVERFLOW_ERROR) (\\<not>ovf a b);\n    return (lint_to_word (f a b))\n  }\"\n        \n  definition \"op_lift_arith2' \\<equiv> op_lift_arith2 (\\<lambda>_ _. False)\"\n\n  definition udivrem_is_undef :: \"lint \\<Rightarrow> lint \\<Rightarrow> bool\" \n    where \"udivrem_is_undef a b \\<equiv> lint_to_uint b=0\"\n  definition sdivrem_is_undef :: \"lint \\<Rightarrow> lint \\<Rightarrow> bool\" \n    where \"sdivrem_is_undef a b \\<equiv> lint_to_sint b=0 \\<or> sdivrem_ovf a b\"\n  \n  definition \"ll_add \\<equiv> op_lift_arith2' (+)\"\n  definition \"ll_sub \\<equiv> op_lift_arith2' (-)\"\n  definition \"ll_mul \\<equiv> op_lift_arith2' (*)\"\n  definition \"ll_udiv \\<equiv> op_lift_arith2 udivrem_is_undef (div)\"\n  definition \"ll_urem \\<equiv> op_lift_arith2 udivrem_is_undef (mod)\"\n  definition \"ll_sdiv \\<equiv> op_lift_arith2 sdivrem_is_undef (sdiv)\"\n  definition \"ll_srem \\<equiv> op_lift_arith2 sdivrem_is_undef (smod)\"\n  \n  \n  subsubsection \\<open>Compare Operations\\<close>\n  definition op_lift_cmp :: \"_ \\<Rightarrow> 'a::len word \\<Rightarrow> 'a word \\<Rightarrow> 1 word llM\"\n    where \"op_lift_cmp f a b \\<equiv> doM {\n    let a = word_to_lint a;\n    let b = word_to_lint b;\n    return (lint_to_word (bool_to_lint (f a b)))\n  }\"\n    \n  definition \"ll_icmp_eq \\<equiv>  op_lift_cmp (=)\"\n  definition \"ll_icmp_ne \\<equiv>  op_lift_cmp (\\<noteq>)\"\n  definition \"ll_icmp_sle \\<equiv> op_lift_cmp (\\<le>\\<^sub>s)\"\n  definition \"ll_icmp_slt \\<equiv> op_lift_cmp (<\\<^sub>s)\"\n  definition \"ll_icmp_ule \\<equiv> op_lift_cmp (\\<le>)\"\n  definition \"ll_icmp_ult \\<equiv> op_lift_cmp (<)\"\n\n  \n\n  \n  subsubsection \\<open>Bitwise Binary Operations\\<close>  \n  definition \"shift_ovf a n \\<equiv> nat (lint_to_uint n) \\<ge> width a\"\n  definition \"bitSHL' a n \\<equiv> bitSHL a (nat (lint_to_uint n))\"\n  definition \"bitASHR' a n \\<equiv> bitASHR a (nat (lint_to_uint n))\"\n  definition \"bitLSHR' a n \\<equiv> bitLSHR a (nat (lint_to_uint n))\"\n  \n  definition \"ll_shl \\<equiv> op_lift_arith2 shift_ovf bitSHL'\"  \n  definition \"ll_lshr \\<equiv> op_lift_arith2 shift_ovf bitLSHR'\"  \n  definition \"ll_ashr \\<equiv> op_lift_arith2 shift_ovf bitASHR'\"\n  \n  definition \"ll_and \\<equiv> op_lift_arith2' (lliAND)\"\n  definition \"ll_or \\<equiv> op_lift_arith2' (lliOR)\"\n  definition \"ll_xor \\<equiv> op_lift_arith2' (lliXOR)\"\n    \n\n  subsubsection \\<open>Aggregate Operations\\<close>\n  text \\<open>In LLVM, there is an \\<open>extractvalue\\<close> and \\<open>insertvalue\\<close> operation.\n    In our shallow embedding, these get instantiated for \\<open>fst\\<close> and \\<open>snd\\<close>.\\<close>\n    \n    \n  definition ll_extract_value :: \"'t::llvm_rep \\<Rightarrow> nat \\<Rightarrow> 't\\<^sub>1::llvm_rep llM\"\n    where \"ll_extract_value p i \\<equiv> doM {\n      fcheck (STATIC_ERROR ''Expected struct'') (llvm_is_struct (to_val p));\n      let vs = llvm_the_struct (to_val p);\n      fcheck (STATIC_ERROR ''Field index out of range'') (i<length vs);\n      checked_from_val (vs!i)\n    }\"  \n    \n  definition ll_insert_value :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>1::llvm_rep \\<Rightarrow> nat \\<Rightarrow> 't::llvm_rep llM\"\n    where \"ll_insert_value p x i \\<equiv> doM {\n      fcheck (STATIC_ERROR ''Expected struct'') (llvm_is_struct (to_val p));\n      let vs = llvm_the_struct (to_val p);\n      fcheck (STATIC_ERROR ''Field index out of range'') (i<length vs);\n      checked_from_val (llvm_struct (vs[i:=to_val x]))\n    }\"\n    \n    \n  (*\n  definition \"checked_split_pair v \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Expected pair'') (llvm_is_pair v);\n    return (llvm_the_pair v)\n  }\"\n  \n  definition ll_extract_fst :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>1::llvm_rep llM\" where \"ll_extract_fst p = doM { (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val a }\"\n  definition ll_extract_snd :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>2::llvm_rep llM\" where \"ll_extract_snd p = doM { (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val b }\"\n  definition ll_insert_fst :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>1::llvm_rep \\<Rightarrow> 't llM\" where \"ll_insert_fst p x = doM { (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val (llvm_pair (to_val x) b) }\" \n  definition ll_insert_snd :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>2::llvm_rep \\<Rightarrow> 't llM\" where \"ll_insert_snd p x = doM { (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val (llvm_pair a (to_val x)) }\" \n  *)  \n  \n  \n  (*  \n  definition ll_extract_fst :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'a llM\" where \"ll_extract_fst ab \\<equiv> return (fst ab)\"\n  definition ll_extract_snd :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'b llM\" where \"ll_extract_snd ab \\<equiv> return (snd ab)\"\n  definition ll_insert_fst :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'a \\<Rightarrow> ('a\\<times>'b) llM\" where \"ll_insert_fst ab a \\<equiv> return (a,snd ab)\"\n  definition ll_insert_snd :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'b \\<Rightarrow> ('a\\<times>'b) llM\" where \"ll_insert_snd ab b \\<equiv> return (fst ab,b)\"\n  *)\n    \n  subsubsection \\<open>Memory Access and Addressing Operations\\<close>\n    \n  definition ll_load :: \"'a::llvm_rep ptr \\<Rightarrow> 'a llM\" where\n    \"ll_load p \\<equiv> doM {\n      r \\<leftarrow> llvm_load (the_raw_ptr p);\n      checked_from_val r\n    }\"\n    \n  definition ll_store :: \"'a::llvm_rep \\<Rightarrow> 'a ptr \\<Rightarrow> unit llM\" where\n    \"ll_store v p \\<equiv> llvm_store (to_val v) (the_raw_ptr p)\"\n\n  text \\<open>Note that LLVM itself does not have malloc and free instructions.\n    However, these are primitive instructions in our abstract memory model, \n    such that we have to model them in our semantics.\n    \n    The code generator will map them to the C standard library \n    functions \\<open>calloc\\<close> and \\<open>free\\<close>.\n  \\<close>\n    \n  definition ll_malloc :: \"'a::llvm_rep itself \\<Rightarrow> _::len word \\<Rightarrow> 'a ptr llM\" where\n    \"ll_malloc TYPE('a) n = doM {\n      fcheck MEM_ERROR (unat n > 0); \\<comment> \\<open>Disallow empty malloc\\<close>\n      r \\<leftarrow> llvm_allocn (to_val (init::'a)) (unat n);\n      return (PTR r)\n    }\"\n        \n  definition ll_free :: \"'a::llvm_rep ptr \\<Rightarrow> unit llM\" \n    where \"ll_free p \\<equiv> llvm_free (the_raw_ptr p)\"\n\n\n  text \\<open>As for the aggregate operations, the \\<open>getelementptr\\<close> instruction is instantiated \n    for pointer and structure indexing. \\<close>\n      \n  definition ll_ofs_ptr :: \"'a::llvm_rep ptr \\<Rightarrow> _::len word \\<Rightarrow> 'a ptr llM\" where \"ll_ofs_ptr p ofs = doM {\n    r \\<leftarrow> llvm_checked_idx_ptr (the_raw_ptr p) (sint ofs);\n    return (PTR r)\n  }\"  \n\n  definition ll_gep_struct :: \"'p::llvm_rep ptr \\<Rightarrow> nat \\<Rightarrow> 'a::llvm_rep ptr llM\" where \"ll_gep_struct p i = doM {\n    fcheck (STATIC_ERROR ''gep_struct: Expected struct type'') (llvm_is_s_struct (struct_of TYPE('p)));\n    r \\<leftarrow> llvm_checked_gep (the_raw_ptr p) (PFLD i);\n    return (PTR r)\n  }\"\n\n  subsubsection \\<open>Pointer Comparison\\<close>  \n  text \\<open>Note: There are no pointer comparison instructions in LLVM. \n    To compare pointers in LLVM, they have to be casted to integers first.\n    However, our abstract memory model cannot assign a bit-width to pointers.\n    \n    Thus, we model pointer comparison instructions in our semantics, and let the \n    code generator translate them to integer comparisons. \n    \n    Up to now, we only model pointer equality. \n    \n    Note that the operand pointers must be null, or point to currently allocated memory.\n    \n    For less-than, more preconditions are required, which are consistent with the \n    actual memory layout of LLVM. We could, e.g., adopt the rules from the C standard here.\n  \\<close>\n  \n  text \\<open>Check if a pair of pointers is valid for comparison operation, i.e., one is null or both are currently allocated\\<close>\n  definition check_ptrs_cmp :: \"'a::llvm_rep ptr \\<Rightarrow> 'a ptr \\<Rightarrow> unit llM\" where\n    \"check_ptrs_cmp p\\<^sub>1 p\\<^sub>2 \\<equiv> if p\\<^sub>1=null \\<or> p\\<^sub>2=null then return () else doM { ll_load p\\<^sub>1; ll_load p\\<^sub>2; return ()}\"\n  \n  definition op_lift_ptr_cmp :: \"_ \\<Rightarrow> 'a::llvm_rep ptr \\<Rightarrow> 'a ptr \\<Rightarrow> 1 word llM\"\n    where \"op_lift_ptr_cmp f a b \\<equiv> doM {\n    check_ptrs_cmp a b;  \n    return (lint_to_word (bool_to_lint (f a b)))\n  }\"\n  \n  definition \"ll_ptrcmp_eq \\<equiv> op_lift_ptr_cmp (=)\"\n  definition \"ll_ptrcmp_ne \\<equiv> op_lift_ptr_cmp (\\<noteq>)\"\n  \n  \n  subsubsection \\<open>Conversion Operations\\<close>\n  definition \"llb_trunc i w \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Trunc must go to smaller type'') (width i > w);\n    return (trunc w i)\n  }\"\n  \n  definition \"llb_sext i w \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Sext must go to greater type'') (width i < w);\n    return (sext w i)\n  }\"\n  \n  definition \"llb_zext i w \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Zext must go to greater type'') (width i < w);\n    return (zext w i)\n  }\"\n  \n  definition op_lift_iconv :: \"_ \\<Rightarrow> 'a::len word \\<Rightarrow> 'b::len word itself  \\<Rightarrow> 'b word llM\"\n    where \"op_lift_iconv f a _ \\<equiv> doM {\n    let a = word_to_lint a;\n    let w = LENGTH('b);\n    r \\<leftarrow> f a w;\n    return (lint_to_word r)\n  }\"\n  \n  definition \"ll_trunc \\<equiv> op_lift_iconv llb_trunc\"\n  definition \"ll_sext \\<equiv> op_lift_iconv llb_sext\"\n  definition \"ll_zext \\<equiv> op_lift_iconv llb_zext\"\n  \n    \n        \n        \n  subsection \\<open>Control Flow\\<close>  \n\n  text \\<open>Our shallow embedding uses a structured control flow, which allows\n    only sequential composition, if-then-else, and function calls.\n    \n    The code generator then maps sequential composition to basic blocks, \n    and if-then-else to a control flow graph with conditional branching.\n    Function calls are mapped to LLVM function calls.  \n   \\<close>\n  \n  text \\<open>We use the to Boolean conversion from word-lib. We re-state its semantics here.\\<close>\n    \n  lemma to_bool_as_lint_to_bool:\n    \"to_bool (w::1 word) = lint_to_bool (word_to_lint w)\"\n    unfolding to_bool_def word_to_lint_def\n    apply (clarsimp simp: ltrue_def lfalse_def lint_to_bool_def)\n    apply transfer\n    apply auto\n    done\n  \n  lemma to_bool_eq[simp]: \"to_bool (w::1 word) \\<longleftrightarrow> w\\<noteq>0\"\n    by (rule to_bool_neq_0)\n  \n  definition llc_if :: \"1 word \\<Rightarrow> 'a::llvm_repv llM \\<Rightarrow> 'a llM \\<Rightarrow> 'a llM\" where\n    \"llc_if b t e \\<equiv> doM {\n      if to_bool b then t else e\n    }\"\n  \n  lemma llc_if_mono[partial_function_mono]:      \n    \"\\<lbrakk>monotone orda ordb F; monotone orda ordb G\\<rbrakk> \\<Longrightarrow> monotone orda ordb (\\<lambda>f. llc_if b (F f) (G f))\"\n    unfolding llc_if_def by pf_mono_prover\n\n  subsubsection \\<open>While-Combinator\\<close>\n  text \\<open>\n    Note that we also include the while combinator at this point, as we plan\n    to add direct translation of while to a control flow graph as an optional \n    feature of the code generator. \n    \n    In the current state, the code generator will recognize the while combinator, \n    but refuse to translate it.\n  \n    Note that the standard way of using a while combinator is to translate it to \n    a tail recursive function call, which the preprocessor can do automatically.\n  \\<close>\n    \n  definition llc_while :: \"('a::llvm_repv \\<Rightarrow> 1 word llM) \\<Rightarrow> ('a \\<Rightarrow> 'a llM) \\<Rightarrow> 'a \\<Rightarrow> 'a llM\" where\n    \"llc_while b f s\\<^sub>0 \\<equiv> mwhile (\\<lambda>s. b s \\<bind> return o to_bool) f s\\<^sub>0\"\n      \n  lemma gen_code_thm_llc_while:\n    assumes \"f \\<equiv> llc_while b body\"\n    shows \"f s = doM { ctd \\<leftarrow> b s; llc_if ctd (doM { s\\<leftarrow>body s; f s}) (return s)}\"\n    unfolding assms\n    unfolding llc_while_def llc_if_def\n    apply (rewrite mwhile_unfold)\n    by simp\n\n  (* 'Definition' of llc_while for presentation in paper: *)  \n  lemma \"llc_while b c s \\<equiv> doM { x \\<leftarrow> b s; llc_if x (doM {s\\<leftarrow>c s; llc_while b c s}) (return s) }\"\n    unfolding llc_while_def llc_if_def\n    apply (rewrite mwhile_unfold)\n    by simp\n    \n      \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/basic/kernel/LLVM_Shallow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.34012110927789324}}
{"text": "theory formal_assurance\n  imports refinement\nbegin\n\ntext \\<open> Cyber-Physical State Space: controlled, monitored, and internal variables \\<close>\n\nalphabet ('c, 'm, 's) cpst =\n  ctrl  :: 'c\n  mon   :: 'm\n  state :: 's\n\ntype_synonym ('c, 'm, 's) cpsprog = \"('c, 'm, 's) cpst hrel\"\n\ntext \\<open> A cyber-physical system model consists of a state invariant over the controlled variables,\n  and a body over the entire state \\<close>\n\ntype_synonym ('c, 'm, 's) cps = \"('c, 'm, 's) cpst machine\"\n  \nlocale valid_cps = machine M for M :: \"('c, 'm, 's) cps\" (structure) +\n  \\<comment> \\<open> The invariant does not refer to monitored variables \\<close>\n  assumes invs_nmon: \"mon \\<sharp> Invs\"\n  \\<comment> \\<open> The actions do not change the monitored variables \\<close>\n  and body_mon_unch: \"($mon\\<acute> =\\<^sub>u $mon) \\<sqsubseteq> Body\"\nbegin\n\n  text \\<open> Any predicate on monitored variables is invariant \\<close>\n\n  lemma env_assm_inv:\n    assumes \"ctrl \\<sharp> A\" \"state \\<sharp> A\"\n    shows \"\\<lbrace>A\\<rbrace>Body\\<lbrace>A\\<rbrace>\\<^sub>u\"\n  proof -\n    from assms have \"\\<lbrace>A\\<rbrace>($mon\\<acute> =\\<^sub>u $mon \\<and> Body)\\<lbrace>A\\<rbrace>\\<^sub>u\"\n      by (rel_blast)\n    thus ?thesis\n      by (simp add: body_mon_unch utp_pred_laws.inf.absorb2)\n  qed\n\n  lemma env_assm_inv':\n    assumes \"ctrl \\<sharp> A\" \"state \\<sharp> A\"\n    shows \"`A \\<Rightarrow> Body wlp A`\"\n    using assms(1) assms(2) env_assm_inv wlp_hoare_link by auto\n\n  lemma env_assm_inv'':\n    \"`(\\<exists> &ctrl \\<bullet> \\<exists> &state \\<bullet> A) \\<Rightarrow> Body wlp (\\<exists> &ctrl \\<bullet> \\<exists> &state \\<bullet> A)`\"\n    by (rule env_assm_inv', simp_all add: unrest)\nend\n\ntext \\<open> Demonstration that the unchanging monitored variable property can be demonstrated using wp. \\<close>\n\nlemma mon_unch_prop: \n  fixes P :: \"('c, 'm, 's) cpsprog\"\n  shows \"($mon\\<acute> =\\<^sub>u $mon) \\<sqsubseteq> P \\<longleftrightarrow> (\\<forall> r. `P wp r \\<Rightarrow> (\\<exists> &ctrl \\<bullet> \\<exists> &state \\<bullet> r)`)\"\nproof -\n  have \"($mon\\<acute> =\\<^sub>u $mon) \\<sqsubseteq> P \\<longleftrightarrow> ctrl := * ;; state := * \\<sqsubseteq> P\"\n    by rel_auto\n  also have \"... = (\\<forall>r. `P wp r \\<Rightarrow> (\\<^bold>\\<exists> v \\<bullet> (\\<^bold>\\<exists> v \\<bullet> r\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/&state\\<rbrakk>)\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/&ctrl\\<rbrakk>)`)\"\n    by (subst wp_refine_iff[THEN sym], simp add: wp)\n  also have \"... = (\\<forall> r. `P wp r \\<Rightarrow> (\\<exists> &ctrl \\<bullet> \\<exists> &state \\<bullet> r)`)\"\n    by (rel_simp')\n  finally show ?thesis .\nqed\n\n\ntype_synonym ('s\\<^sub>1, 's\\<^sub>2) cinv = \"('s\\<^sub>1, 's\\<^sub>2) urel\"\n\ntext \\<open> Formal Assurance Case Signature \\<close>\n\ndatatype reqtype = nxt | glob | fin\n\nrecord ('c, 'm, 's) reqbody = \n  pre   :: \"('c, 'm, 's) cpst upred\"\n  post  :: \"('c, 'm, 's) cpst upred\"\n\nno_utp_lift pre (0)\nno_utp_lift post (0)\n\ntype_synonym ('c, 'm, 's) req = \"reqtype \\<times> ('c, 'm, 's) reqbody\"\n\ntext \\<open> The body of the CPS satisfies the safety or liveness requirement \\<close>\n\nfun req_sat :: \"_ \\<times> ('c, 'm, 's) cps \\<Rightarrow> ('c, 'm, 's) req \\<Rightarrow> bool\" (\"_ \\<TTurnstile> _\" [100, 101] 100) where\n\"(A, M) \\<TTurnstile> (nxt, rb)  = `(A \\<and> invs M \\<and> pre rb) \\<Rightarrow> (body M) wlp (post rb)`\" |\n\"(A, M) \\<TTurnstile> (glob, rb) = (\\<exists> I. \\<lbrace>I\\<rbrace>body M\\<lbrace>I\\<rbrace>\\<^sub>u \\<and> `A \\<and> pre rb \\<and> invs M \\<Rightarrow> I` \\<and> `A \\<and> I \\<and> invs M \\<Rightarrow> post rb`)\" |\n\"(A, M) \\<TTurnstile> (fin, rb) = `(A \\<and> invs M \\<and> pre rb) \\<Rightarrow> (body M)\\<^sup>\\<star> wp (post rb)`\"\n\nlemma global_satisfaction:\n  assumes \"valid_cps M\" \"(A, M) \\<TTurnstile> (glob, rb)\" \"ctrl \\<sharp> A\" \"state \\<sharp> A\"\n  shows \"\\<lbrace>A \\<and> pre rb \\<and> invs M\\<rbrace>(body M)\\<^sup>\\<star>\\<lbrace>post rb\\<rbrace>\\<^sub>u\"\nproof -\n  obtain I where I:\"\\<lbrace>I\\<rbrace>body M\\<lbrace>I\\<rbrace>\\<^sub>u\" \"`A \\<and> pre rb \\<and> invs M \\<Rightarrow> I`\" \"`A \\<and> I \\<and> invs M \\<Rightarrow> post rb`\"\n    by (meson assms req_sat.simps(2))\n  from I(3) have post: \"`I \\<Rightarrow> A \\<and> invs M \\<Rightarrow> post rb`\"\n    by (rel_auto)\n \n  have \"\\<lbrace>A \\<and> pre rb \\<and> invs M\\<rbrace>(body M)\\<^sup>\\<star>\\<lbrace>A \\<and> invs M \\<Rightarrow> post rb\\<rbrace>\\<^sub>u\"\n    using I(1) I(2) hoare_r_conseq iter_hoare_r post by blast\n  moreover have \"\\<lbrace>invs M\\<rbrace>(body M)\\<^sup>\\<star>\\<lbrace>invs M\\<rbrace>\\<^sub>u\"\n    using assms(1) iter_hoare_r machine.body_invs' valid_cps.axioms(1) by blast\n  moreover have \"\\<lbrace>A\\<rbrace>(body M)\\<^sup>\\<star>\\<lbrace>A\\<rbrace>\\<^sub>u\"\n    by (simp add: assms(1) assms(3) assms(4) iter_hoare_r valid_cps.env_assm_inv)\n  ultimately show ?thesis\n    by (simp add: wlp_hoare_link, rel_auto)\nqed\n\ntext \\<open> A formal assurance case consists of assumptions, guarantees, and a model \\<close>\n\nrecord ('c, 'm, 's) fac =\n  assm  :: \"('c, 'm, 's) cpst upred\"\n  guar  :: \"('c, 'm, 's) req set\"\n\nno_utp_lift assm (0)\nno_utp_lift guar (0)\n\nrecord ('c, 'm, 's) fmac = \"('c, 'm, 's) fac\" +\n  model :: \"('c, 'm, 's) cps\"\n\ndefinition fac_sem where \"fac_sem AC = (mon := * ;; ?[assm AC] ;; body (model AC))\\<^sup>\\<star>\"\n\nlocale valid_fac =\n  fixes AC :: \"('c, 'm, 's) fmac\"\n  assumes valid_cps: \"valid_cps (model AC)\"\n  \\<comment> \\<open> The assumption refers only to monitored variables \\<close>\n  and \"ctrl \\<sharp> assm AC\" \"state \\<sharp> assm AC\"\n  \\<comment> \\<open> All requirements are satisfied by the model \\<close>\n  and reqs_satisfied: \"\\<And> R. R \\<in> guar AC \\<Longrightarrow> (assm AC, model AC) \\<TTurnstile> R\"\nbegin\n\n  lemma assm_invar_body: \"\\<lbrace>assm AC\\<rbrace>body (model AC)\\<lbrace>assm AC\\<rbrace>\\<^sub>u\"\n    using valid_cps.env_assm_inv valid_fac_axioms valid_fac_def by blast\n\nend\n\ntext \\<open> Lift safety requirements using a functional retrieve relation\\<close>\n\ndefinition lift_sreqs :: \n  \"('c\\<^sub>1, 'm\\<^sub>1, 's\\<^sub>1) fmac \\<Rightarrow> \n   (('c\\<^sub>2, 'm\\<^sub>2, 's\\<^sub>2) cpst, ('c\\<^sub>1, 'm\\<^sub>1, 's\\<^sub>1) cpst) psubst \\<Rightarrow> \n   reqtype \\<leftrightarrow> ('c\\<^sub>2, 'm\\<^sub>2, 's\\<^sub>2) reqbody\" where\n\"lift_sreqs AC \\<sigma> \\<equiv> {(t, \\<lparr> pre = \\<sigma> \\<dagger> (assm AC \\<and> pre b), post = \\<sigma> \\<dagger> post b \\<rparr>) | t b. t \\<in> {nxt, glob} \\<and> (t, b) \\<in> guar AC}\"\n\ntext \\<open> Extend an existing FAC with a new model and additional requirements; we assume that a \n  data refinement will be exhibited between the abstract and concrete models \\<close>\n\ndefinition fac_extend :: \n  \"('c\\<^sub>1, 'm\\<^sub>1, 's\\<^sub>1) fmac \\<Rightarrow> (('c\\<^sub>2, 'm\\<^sub>2, 's\\<^sub>2) cpst, ('c\\<^sub>1, 'm\\<^sub>1, 's\\<^sub>1) cpst) psubst \\<Rightarrow>\n   ('c\\<^sub>2, 'm\\<^sub>2, 's\\<^sub>2) fmac \\<Rightarrow> ('c\\<^sub>2, 'm\\<^sub>2, 's\\<^sub>2) fmac\" where\n  \"fac_extend AC\\<^sub>1 \\<sigma> AC\\<^sub>2 = \\<lparr> assm = assm AC\\<^sub>2, guar = lift_sreqs AC\\<^sub>1 \\<sigma> \\<union> guar AC\\<^sub>2, model = model AC\\<^sub>2 \\<rparr>\"\n\ntext \\<open> Theorem to prove the validity of the above; requires a data refinement argument \\<close>\n\nlemma fac_extend_intro:\n  assumes \n    \\<comment> \\<open> Valid models \\<close>\n    \"valid_cps (model AC\\<^sub>1)\" \"valid_cps (model AC\\<^sub>2)\"\n    \\<comment> \\<open> Original assurance case is valid \\<close>\n    \"valid_fac AC\\<^sub>1\"\n    \\<comment> \\<open> Weaken the assumption \\<close>\n    \"`(\\<sigma> \\<dagger> assm AC\\<^sub>1) \\<Rightarrow> assm AC\\<^sub>2`\"\n    \\<comment> \\<open> Demonstrate a backward functional refinement \\<close>\n    \"func_refinement (func_refine (model AC\\<^sub>1) (model AC\\<^sub>2) \\<sigma>) \\<sigma>\"\n    \\<comment> \\<open> Prove all additional requirements \\<close>\n    \"\\<And> R. R \\<in> guar AC\\<^sub>2 \\<Longrightarrow> ((assm AC\\<^sub>2, model AC\\<^sub>2) \\<TTurnstile> R)\"\n    \\<comment> \\<open> New assumption refers only to monitored variables \\<close>    \n    \"ctrl \\<sharp> assm AC\\<^sub>2\" \"state \\<sharp> assm AC\\<^sub>2\"\n  shows \"valid_fac (fac_extend AC\\<^sub>1 \\<sigma> AC\\<^sub>2)\"\nproof (rule valid_fac.intro)\n  interpret func_refinement \"func_refine (model AC\\<^sub>1) (model AC\\<^sub>2) \\<sigma>\" \\<sigma>\n    by (simp add: assms)\n  show \"valid_cps (model (fac_extend AC\\<^sub>1 \\<sigma> AC\\<^sub>2))\"\n    by (simp add: fac_extend_def assms)\n  show \"\\<And>R. R \\<in> guar (fac_extend AC\\<^sub>1 \\<sigma> AC\\<^sub>2) \\<Longrightarrow> (assm (fac_extend AC\\<^sub>1 \\<sigma> AC\\<^sub>2), model (fac_extend AC\\<^sub>1 \\<sigma> AC\\<^sub>2)) \\<TTurnstile> R\"\n  proof (clarsimp simp add: fac_extend_def, erule disjE)\n    fix rt rb\n    assume \"(rt, rb) \\<in> guar AC\\<^sub>2\"\n    thus \"(assm AC\\<^sub>2, model AC\\<^sub>2) \\<TTurnstile> (rt, rb)\"\n      by (simp add: assms)\n  next\n    fix rt rb\n    assume a: \"(rt, rb) \\<in> lift_sreqs AC\\<^sub>1 \\<sigma>\"\n    hence rt: \"rt = nxt \\<or> rt = glob\"\n      by (auto simp add: lift_sreqs_def)\n    from a obtain Pre Post where rb: \"(rt, \\<lparr> pre = Pre, post = Post \\<rparr>) \\<in> guar AC\\<^sub>1\" \"rb = \\<lparr> pre = \\<sigma> \\<dagger> (assm AC\\<^sub>1 \\<and> Pre), post = \\<sigma> \\<dagger> Post \\<rparr>\"\n      by (auto simp add: lift_sreqs_def, (metis (full_types) old.unit.exhaust reqbody.surjective)+)\n    have osat: \"(assm AC\\<^sub>1, model AC\\<^sub>1) \\<TTurnstile> (rt, \\<lparr> pre = Pre, post = Post \\<rparr>)\"\n      by (simp add: assms(3) rb(1) valid_fac.reqs_satisfied)\n    show \"(assm AC\\<^sub>2, model AC\\<^sub>2) \\<TTurnstile> (rt, rb)\"\n    proof (cases \"rt = nxt\")\n      case True\n      have \"`assm AC\\<^sub>1 \\<Rightarrow> Invs\\<^bsub>model AC\\<^sub>1\\<^esub> \\<and> Pre \\<Rightarrow> Body\\<^bsub>model AC\\<^sub>1\\<^esub> wlp Post`\"\n        by (metis True assms(3) hoare_gcmd rb(1) req_sat.simps(1) reqbody.select_convs(1) reqbody.select_convs(2) valid_fac.reqs_satisfied wlp_gcmd wlp_hoare_link)\n      hence \"`Invs\\<^bsub>model AC\\<^sub>1\\<^esub> \\<and> (Pre \\<and> assm AC\\<^sub>1) \\<Rightarrow> Body\\<^bsub>model AC\\<^sub>1\\<^esub> wlp Post`\"\n        by (rel_auto)\n      hence \"`Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<and> (\\<sigma> \\<dagger> (Pre \\<and> assm AC\\<^sub>1)) \\<Rightarrow> Body\\<^bsub>model AC\\<^sub>2\\<^esub> wlp (\\<sigma> \\<dagger> Post)`\"\n        using refinement_preserves_safety_wlp_func\n        by (simp add: func_refine_def)\n      with rb True show ?thesis\n        by (auto, metis hoare_r_weaken_pre(2) utp_pred_laws.inf.commute wlp_hoare_link)\n    next\n      case False\n      with rt have glob:\"rt = glob\"\n        by auto\n      with osat obtain I where I:\"\\<lbrace>I\\<rbrace> Body\\<^bsub>model AC\\<^sub>1\\<^esub> \\<lbrace>I\\<rbrace>\\<^sub>u\" \"`assm AC\\<^sub>1 \\<and> Pre \\<and> Invs\\<^bsub>model AC\\<^sub>1\\<^esub> \\<Rightarrow> I`\" \"`assm AC\\<^sub>1 \\<and> I \\<and> Invs\\<^bsub>model AC\\<^sub>1\\<^esub> \\<Rightarrow> Post`\"\n        by (auto)\n      hence 1:\"\\<lbrace>Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<and> (\\<sigma> \\<dagger> (I \\<and> assm AC\\<^sub>1))\\<rbrace>Body\\<^bsub>model AC\\<^sub>2\\<^esub>\\<lbrace>(\\<sigma> \\<dagger> I)\\<rbrace>\\<^sub>u\"\n        by (metis func_refine_def hoare_r_weaken_pre(1) refinement.refinement.select_convs(1) refinement.refinement.select_convs(2) refinement_preserves_safety_func utp_pred_laws.inf_commute)\n      have 2: \"\\<lbrace>Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<and> (\\<sigma> \\<dagger> assm AC\\<^sub>1)\\<rbrace>Body\\<^bsub>model AC\\<^sub>2\\<^esub>\\<lbrace>\\<sigma> \\<dagger> assm AC\\<^sub>1\\<rbrace>\\<^sub>u\"\n      proof -\n        have \"\\<lbrace>Invs\\<^bsub>model AC\\<^sub>1\\<^esub> \\<and> assm AC\\<^sub>1\\<rbrace>Body\\<^bsub>model AC\\<^sub>1\\<^esub>\\<lbrace>assm AC\\<^sub>1\\<rbrace>\\<^sub>u\"\n          by (simp add: assms(3) hoare_r_weaken_pre(2) valid_fac.assm_invar_body) \n        thus ?thesis\n          using refinement_preserves_safety_func by (simp add: func_refine_def)\n      qed\n      have 3: \"\\<lbrace>Invs\\<^bsub>model AC\\<^sub>2\\<^esub>\\<rbrace>Body\\<^bsub>model AC\\<^sub>2\\<^esub>\\<lbrace>Invs\\<^bsub>model AC\\<^sub>2\\<^esub>\\<rbrace>\\<^sub>u\"\n        by (simp add: assms(2) machine.body_invs' valid_cps.axioms(1))\n      from 1 2 3 have 4:\"\\<lbrace>Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<and> (\\<sigma> \\<dagger> (I \\<and> assm AC\\<^sub>1))\\<rbrace>Body\\<^bsub>model AC\\<^sub>2\\<^esub>\\<lbrace>Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<and> (\\<sigma> \\<dagger> (I \\<and> assm AC\\<^sub>1))\\<rbrace>\\<^sub>u\"\n        by (smt hoare_r_conj hoare_r_weaken_pre(2) subst_conj utp_pred_laws.conj_assoc utp_pred_laws.inf_commute)\n      have 5: \"`assm AC\\<^sub>2 \\<and> pre rb \\<and> Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<Rightarrow> Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<and> \\<sigma> \\<dagger> (I \\<and> assm AC\\<^sub>1)`\"\n      proof -\n        from I(2) have \"`\\<sigma> \\<dagger> (assm AC\\<^sub>1 \\<and> Pre \\<and> Invs\\<^bsub>model AC\\<^sub>1\\<^esub>) \\<Rightarrow> \\<sigma> \\<dagger> I`\"\n          by (rel_auto)\n        moreover have \"`Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<Rightarrow> \\<sigma> \\<dagger> Invs\\<^bsub>model AC\\<^sub>1\\<^esub>`\"\n          by (metis func_invs func_refine_def refinement.refinement.select_convs(1) refinement.refinement.select_convs(2))\n        ultimately show ?thesis\n          by (simp add: rb usubst, rel_simp)\n      qed\n      from I(3) have 6: \"`assm AC\\<^sub>2 \\<and> (Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<and> \\<sigma> \\<dagger> (I \\<and> assm AC\\<^sub>1)) \\<and> Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<Rightarrow> post rb`\"\n      proof -\n        from I(3) have \"`\\<sigma> \\<dagger> (assm AC\\<^sub>1 \\<and> I \\<and> Invs\\<^bsub>model AC\\<^sub>1\\<^esub>) \\<Rightarrow> \\<sigma> \\<dagger> Post`\"\n          by (rel_auto)\n        moreover have \"`Invs\\<^bsub>model AC\\<^sub>2\\<^esub> \\<Rightarrow> \\<sigma> \\<dagger> Invs\\<^bsub>model AC\\<^sub>1\\<^esub>`\"\n          by (metis func_invs func_refine_def refinement.refinement.select_convs(1) refinement.refinement.select_convs(2))\n        ultimately show ?thesis\n          by (simp add: rb usubst, rel_auto)\n      qed\n      from glob I(2-3) 4 5 6 show ?thesis\n        by (auto)\n    qed\n  qed\n  show \"ctrl \\<sharp> assm (fac_extend AC\\<^sub>1 \\<sigma> AC\\<^sub>2)\"\n    by (simp add: fac_extend_def assms)\n  show \"state \\<sharp> assm (fac_extend AC\\<^sub>1 \\<sigma> AC\\<^sub>2)\"\n    by (simp add: fac_extend_def assms)\nqed\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/assurance/fmac/formal_assurance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.34008074362672436}}
{"text": "(* @SUITE wp *)\n\ntheory wp_assign\nimports \"../Hoare_Tactics\"\nbegin\n\nabbreviation \"z == Variable ''z'' :: int variable\"\n\nlemma \n  assumes \"hoare {P &m} skip {z+2=99}\"\n  shows \"hoare {P &m} z:=z+2 {z=99}\"\n  apply wp\n  by (fact assms)\n\nend\n", "meta": {"author": "dominique-unruh", "repo": "IsaCrypt", "sha": "1abc2041871af7b758adcc914b83f0d9135ec129", "save_path": "github-repos/isabelle/dominique-unruh-IsaCrypt", "path": "github-repos/isabelle/dominique-unruh-IsaCrypt/IsaCrypt-1abc2041871af7b758adcc914b83f0d9135ec129/tests/wp_assign.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.34000003985159916}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Strengthen\nimports Main\nbegin\n\ntext {* Implementation of the @{text strengthen} tool and the @{text mk_strg}\nattribute. See the theory @{text Strengthen_Demo} for a demonstration. *}\n\nlocale strengthen_implementation begin\n\ndefinition \"st P rel x y = (x = y \\<or> (P \\<and> rel x y) \\<or> (\\<not> P \\<and> rel y x))\"\n\ndefinition\n  st_prop1 :: \"prop \\<Rightarrow> prop \\<Rightarrow> prop\"\nwhere\n  \"st_prop1 (PROP P) (PROP Q) \\<equiv> (PROP Q \\<Longrightarrow> PROP P)\"\n\ndefinition\n  st_prop2 :: \"prop \\<Rightarrow> prop \\<Rightarrow> prop\"\nwhere\n  \"st_prop2 (PROP P) (PROP Q) \\<equiv> (PROP P \\<Longrightarrow> PROP Q)\"\n\ndefinition \"failed == True\"\n\ndefinition elim :: \"prop \\<Rightarrow> prop\"\nwhere\n \"elim (P :: prop) == P\"\n\ndefinition \"oblig (P :: prop) == P\"\n\nend\n\nnotation strengthen_implementation.elim (\"{elim| _ |}\")\nnotation strengthen_implementation.oblig (\"{oblig| _ |}\")\nnotation strengthen_implementation.failed (\"<strg-failed>\")\n\nsyntax\n  \"_ap_strg_bool\" :: \"['a, 'a] => 'a\"  (\"_ =strg<--|=> _\")\n  \"_ap_wkn_bool\" :: \"['a, 'a] => 'a\"  (\"_ =strg-->|=> _\")\n  \"_ap_ge_bool\" :: \"['a, 'a] => 'a\"  (\"_ =strg<=|=> _\")\n  \"_ap_le_bool\" :: \"['a, 'a] => 'a\"  (\"_ =strg>=|=> _\")\n\nsyntax(xsymbols)\n  \"_ap_strg_bool\" :: \"['a, 'a] => 'a\"  (\"_ =strg\\<longleftarrow>|=> _\")\n  \"_ap_wkn_bool\" :: \"['a, 'a] => 'a\"  (\"_ =strg\\<longrightarrow>|=> _\")\n  \"_ap_ge_bool\" :: \"['a, 'a] => 'a\"  (\"_ =strg\\<le>|=> _\")\n  \"_ap_le_bool\" :: \"['a, 'a] => 'a\"  (\"_ =strg\\<ge>|=> _\")\n\ntranslations\n  \"P =strg\\<longleftarrow>|=> Q\" == \"CONST strengthen_implementation.st (CONST False) (CONST HOL.implies) P Q\"\n  \"P =strg\\<longrightarrow>|=> Q\" == \"CONST strengthen_implementation.st (CONST True) (CONST HOL.implies) P Q\"\n  \"P =strg\\<le>|=> Q\" == \"CONST strengthen_implementation.st (CONST False) (CONST Orderings.less_eq) P Q\"\n  \"P =strg\\<ge>|=> Q\" == \"CONST strengthen_implementation.st (CONST True) (CONST Orderings.less_eq) P Q\"\n\ncontext strengthen_implementation begin\n\nlemma failedI:\n  \"<strg-failed>\"\n  by (simp add: failed_def)\n\nlemma strengthen_refl:\n  \"st P rel x x\"\n  by (simp add: st_def)\n\nlemma st_prop_refl:\n  \"PROP (st_prop1 (PROP P) (PROP P))\"\n  \"PROP (st_prop2 (PROP P) (PROP P))\"\n  unfolding st_prop1_def st_prop2_def\n  by safe\n\nlemma strengthenI:\n  \"rel x y \\<Longrightarrow> st True rel x y\"\n  \"rel y x \\<Longrightarrow> st False rel x y\"\n  by (simp_all add: st_def)\n\nlemmas imp_to_strengthen = strengthenI(2)[where rel=\"op \\<longrightarrow>\"]\nlemmas rev_imp_to_strengthen = strengthenI(1)[where rel=\"op \\<longrightarrow>\"]\nlemmas ord_to_strengthen = strengthenI[where rel=\"op \\<le>\"]\n\nlemma use_strengthen_imp:\n  \"st False (op \\<longrightarrow>) Q P \\<Longrightarrow> P \\<Longrightarrow> Q\"\n  by (simp add: st_def)\n\nlemma use_strengthen_prop_elim:\n  \"PROP P \\<Longrightarrow> PROP (st_prop2 (PROP P) (PROP Q))\n    \\<Longrightarrow> (PROP Q \\<Longrightarrow> PROP R) \\<Longrightarrow> PROP R\"\n  unfolding st_prop2_def\n  apply (drule(1) meta_mp)+\n  apply assumption\n  done\n\nlemma strengthen_Not:\n  \"st False rel x y \\<Longrightarrow> st (\\<not> True) rel x y\"\n  \"st True rel x y \\<Longrightarrow> st (\\<not> False) rel x y\"\n  by auto\n\nlemmas gather =\n    swap_prems_eq[where A=\"PROP (Trueprop P)\" and B=\"PROP (elim Q)\" for P Q]\n    swap_prems_eq[where A=\"PROP (Trueprop P)\" and B=\"PROP (oblig Q)\" for P Q]\n\nlemma mk_True_imp:\n  \"P \\<equiv> True \\<longrightarrow> P\"\n  by simp\n\nlemma narrow_quant:\n  \"(\\<And>x. PROP P \\<Longrightarrow> PROP (Q x)) \\<equiv> (PROP P \\<Longrightarrow> (\\<And>x. PROP (Q x)))\"\n  \"(\\<And>x. (R \\<longrightarrow> S x)) \\<equiv> PROP (Trueprop (R \\<longrightarrow> (\\<forall>x. S x)))\"\n  \"(\\<And>x. (S x \\<longrightarrow> R)) \\<equiv> PROP (Trueprop ((\\<exists>x. S x) \\<longrightarrow> R))\"\n  apply (simp_all add: atomize_all)\n  apply rule\n   apply assumption\n  apply assumption\n  done\n\nML {*\nstructure Make_Strengthen_Rule = struct\n\nfun binop_conv' cv1 cv2 = Conv.combination_conv (Conv.arg_conv cv1) cv2;\n\nval mk_elim = Conv.rewr_conv @{thm elim_def[symmetric]}\nval mk_oblig = Conv.rewr_conv @{thm oblig_def[symmetric]}\n\nfun count_vars t = Term.fold_aterms\n    (fn (Var v) => Termtab.map_default (Var v, 0) (fn x => x + 1)\n        | _ => I) t Termtab.empty\n\nfun gather_to_imp ctxt drule pattern = let\n    val pattern = (if drule then \"D\" :: pattern else pattern)\n    fun inner pat ct = case (head_of (Thm.term_of ct), pat) of\n        (@{term Pure.imp}, (\"E\" :: pat)) => binop_conv' mk_elim (inner pat) ct\n      | (@{term Pure.imp}, (\"A\" :: pat)) => binop_conv' mk_elim (inner pat) ct\n      | (@{term Pure.imp}, (\"O\" :: pat)) => binop_conv' mk_oblig (inner pat) ct\n      | (@{term Pure.imp}, _) => binop_conv' (Object_Logic.atomize ctxt) (inner (drop 1 pat)) ct\n      | (_, []) => Object_Logic.atomize ctxt ct\n      | (_, pat) => raise THM (\"gather_to_imp: leftover pattern: \" ^ commas pat, 1, [])\n    fun simp thms = Raw_Simplifier.rewrite ctxt false thms\n    fun ensure_imp ct = case strip_comb (Thm.term_of ct) |> apsnd (map head_of)\n     of\n        (@{term Pure.imp}, _) => Conv.arg_conv ensure_imp ct\n      | (@{term HOL.Trueprop}, [@{term HOL.implies}]) => Conv.all_conv ct\n      | (@{term HOL.Trueprop}, _) => Conv.arg_conv (Conv.rewr_conv @{thm mk_True_imp}) ct\n      | _ => raise CTERM (\"gather_to_imp\", [ct])\n    val gather = simp @{thms gather}\n        then_conv (if drule then Conv.all_conv else simp @{thms atomize_conjL})\n        then_conv simp @{thms atomize_imp}\n        then_conv ensure_imp\n  in Conv.fconv_rule (inner pattern then_conv gather) end\n\nfun imp_list t = let\n    val (x, y) = Logic.dest_implies t\n  in x :: imp_list y end handle TERM _ => [t]\n\nfun mk_ex (xnm, T) t = HOLogic.exists_const T $ Term.lambda (Var (xnm, T)) t\nfun mk_all (xnm, T) t = HOLogic.all_const T $ Term.lambda (Var (xnm, T)) t\n\nfun quantify_vars ctxt drule thm = let\n    val (lhs, rhs) = Thm.concl_of thm |> HOLogic.dest_Trueprop\n      |> HOLogic.dest_imp\n    val all_vars = count_vars (Thm.prop_of thm)\n    val new_vars = count_vars (if drule then rhs else lhs)\n    val quant = filter (fn v => Termtab.lookup new_vars v = Termtab.lookup all_vars v)\n            (Termtab.keys new_vars)\n        |> map (Thm.cterm_of ctxt)\n  in fold Thm.forall_intr quant thm\n    |> Conv.fconv_rule (Raw_Simplifier.rewrite ctxt false @{thms narrow_quant})\n  end\n\nfun mk_strg (typ, pat) ctxt thm = let\n    val drule = typ = \"D\" orelse typ = \"D'\"\n    val imp = gather_to_imp ctxt drule pat thm\n      |> (if typ = \"I'\" orelse typ = \"D'\"\n          then quantify_vars ctxt drule else I)\n  in if typ = \"I\" orelse typ = \"I'\"\n    then imp RS @{thm imp_to_strengthen}\n    else if drule then imp RS @{thm rev_imp_to_strengthen}\n    else if typ = \"lhs\" then imp RS @{thm ord_to_strengthen(1)}\n    else if typ = \"rhs\" then imp RS @{thm ord_to_strengthen(2)}\n    else raise THM (\"mk_strg: unknown type: \" ^ typ, 1, [thm])\n end\n\nfun auto_mk ctxt thm = let\n    val concl_C = try (fst o dest_Const o head_of\n        o HOLogic.dest_Trueprop) (Thm.concl_of thm)\n  in case (Thm.nprems_of thm, concl_C) of\n    (_, SOME @{const_name failed}) => thm\n  | (_, SOME @{const_name st}) => thm\n  | (0, SOME @{const_name HOL.implies}) => (thm RS @{thm imp_to_strengthen}\n      handle THM _ => @{thm failedI})\n  | _ => mk_strg (\"I'\", []) ctxt thm\n  end\n\nfun mk_strg_args (SOME (typ, pat)) ctxt thm = mk_strg (typ, pat) ctxt thm\n  | mk_strg_args NONE ctxt thm = auto_mk ctxt thm\n\nval arg_pars = Scan.option (Scan.first (map Args.$$$ [\"I\", \"I'\", \"D\", \"D'\", \"lhs\", \"rhs\"])\n  -- Scan.repeat (Args.$$$ \"A\" || Args.$$$ \"E\" || Args.$$$ \"O\" || Args.$$$ \"_\"))\n\nval attr_pars : attribute context_parser\n    = (Scan.lift arg_pars -- Args.context)\n        >> (fn (args, ctxt) => Thm.rule_attribute [] (K (mk_strg_args args ctxt)))\n\n\nend\n*}\n\nend\n\nattribute_setup mk_strg = \\<open>Make_Strengthen_Rule.attr_pars\\<close>\n          \"put rule in 'strengthen' form (see theory Strengthen_Demo)\"\n\ntext {* Quick test. *}\n\nlemmas foo = nat.induct[mk_strg I O O]\n    nat.induct[mk_strg D O]\n    nat.induct[mk_strg I' E]\n    exI[mk_strg I'] exI[mk_strg I]\n\ncontext strengthen_implementation begin\n\nlemma do_elim:\n  \"PROP P \\<Longrightarrow> PROP elim (PROP P)\"\n  by (simp add: elim_def)\n\nlemma intro_oblig:\n  \"PROP P \\<Longrightarrow> PROP oblig (PROP P)\"\n  by (simp add: oblig_def)\n\nML {*\n\nstructure Strengthen = struct\n\nstructure Congs = Theory_Data\n(struct\n    type T = thm list\n    val empty = []\n    val extend = I\n    val merge = Thm.merge_thms;\nend);\n\nval tracing = Attrib.config_bool @{binding strengthen_trace} (K false)\n\nfun map_context_total f (Context.Theory t) = (Context.Theory (f t))\n  | map_context_total f (Context.Proof p)\n    = (Context.Proof (Context.raw_transfer (f (Proof_Context.theory_of p)) p))\n\nval strg_add = Thm.declaration_attribute\n        (fn thm => map_context_total (Congs.map (Thm.add_thm thm)));\n\nval strg_del = Thm.declaration_attribute\n        (fn thm => map_context_total (Congs.map (Thm.del_thm thm)));\n\nval setup =\n  Attrib.setup @{binding \"strg\"} (Attrib.add_del strg_add strg_del)\n    \"strengthening congruence rules\"\n    #> snd tracing;\n\nfun goal_predicate t = let\n    val gl = Logic.strip_assums_concl t\n    val cn = head_of #> dest_Const #> fst\n  in if cn gl = @{const_name oblig} then \"oblig\"\n    else if cn gl = @{const_name elim} then \"elim\"\n    else if cn gl = @{const_name st_prop1} then \"st_prop1\"\n    else if cn gl = @{const_name st_prop2} then \"st_prop2\"\n    else if cn (HOLogic.dest_Trueprop gl) = @{const_name st} then \"st\"\n    else \"\"\n  end handle TERM _ => \"\"\n\nfun do_elim ctxt = SUBGOAL (fn (t, i) => if goal_predicate t = \"elim\"\n    then eresolve_tac ctxt @{thms do_elim} i else all_tac)\n\nfun final_oblig_strengthen ctxt = SUBGOAL (fn (t, i) => case goal_predicate t of\n    \"oblig\" => resolve_tac ctxt @{thms intro_oblig} i\n  | \"st\" => resolve_tac ctxt @{thms strengthen_refl} i\n  | \"st_prop1\" => resolve_tac ctxt @{thms st_prop_refl} i\n  | \"st_prop2\" => resolve_tac ctxt @{thms st_prop_refl} i\n  | _ => all_tac)\n\ninfix 1 THEN_TRY_ALL_NEW;\n\n(* Like THEN_ALL_NEW but allows failure, although at least one subsequent\n   method must succeed. *)\nfun (tac1 THEN_TRY_ALL_NEW tac2) i st = let\n    fun inner b j st = if i > j then (if b then all_tac else no_tac) st\n      else ((tac2 j THEN inner true (j - 1)) ORELSE inner b (j - 1)) st\n  in st |> (tac1 i THEN (fn st' =>\n    inner false (i + Thm.nprems_of st' - Thm.nprems_of st) st')) end\n\nfun maybe_trace_tac false _ _ = K all_tac\n  | maybe_trace_tac true ctxt msg = SUBGOAL (fn (t, _) => let\n    val tr = Pretty.big_list msg [Syntax.pretty_term ctxt t]\n  in\n    Pretty.writeln tr;\n    all_tac\n  end)\n\nfun maybe_trace_rule false _ _ rl = rl\n  | maybe_trace_rule true ctxt msg rl = let\n    val tr = Pretty.big_list msg [Syntax.pretty_term ctxt (Thm.prop_of rl)]\n  in\n    Pretty.writeln tr;\n    rl\n  end\n\ntype params = {trace : bool, once : bool}\n\nfun params once ctxt = {trace = Config.get ctxt (fst tracing), once = once}\n\nfun apply_tac_as_strg ctxt (params : params) (tac : tactic)\n  = SUBGOAL (fn (t, i) => case Logic.strip_assums_concl t of\n      @{term Trueprop} $ (@{term \"st False (op \\<longrightarrow>)\"} $ x $ _)\n      => let\n    val triv = Thm.trivial (Thm.cterm_of ctxt (HOLogic.mk_Trueprop x))\n    val trace = #trace params\n  in\n    fn thm => tac triv\n        |> Seq.map (maybe_trace_rule trace ctxt \"apply_tac_as_strg: making strg\")\n        |> Seq.maps (Seq.try (Make_Strengthen_Rule.auto_mk ctxt))\n        |> Seq.maps (fn str_rl => resolve_tac ctxt [str_rl] i thm)\n  end | _ => no_tac)\n\nfun opt_tac f (SOME v) = f v\n  | opt_tac _ NONE = K no_tac\n\nfun apply_strg ctxt (params : params) congs rules tac = EVERY' [\n    maybe_trace_tac (#trace params) ctxt \"apply_strg\",\n    DETERM o TRY o resolve_tac ctxt @{thms strengthen_Not},\n    DETERM o ((resolve_tac ctxt rules THEN_ALL_NEW do_elim ctxt)\n        ORELSE' (opt_tac (apply_tac_as_strg ctxt params) tac)\n        ORELSE' (resolve_tac ctxt congs THEN_TRY_ALL_NEW\n            (fn i => apply_strg ctxt params congs rules tac i)))\n]\n\nfun setup_strg ctxt params thms meths = let\n    val congs = Congs.get (Proof_Context.theory_of ctxt)\n    val rules = map (Make_Strengthen_Rule.auto_mk ctxt) thms\n    val tac = case meths of [] => NONE\n      | _ => SOME (FIRST (map (fn meth => Method.NO_CONTEXT_TACTIC ctxt\n        (Method.evaluate meth ctxt [])) meths))\n  in apply_strg ctxt params congs rules tac\n        THEN_ALL_NEW final_oblig_strengthen ctxt end\n\nfun strengthen ctxt asm concl thms meths = let\n    val strg = setup_strg ctxt (params false ctxt) thms meths\n  in\n    (if not concl then K no_tac\n        else resolve_tac ctxt @{thms use_strengthen_imp} THEN' strg)\n    ORELSE' (if not asm then K no_tac\n        else eresolve_tac ctxt @{thms use_strengthen_prop_elim} THEN' strg)\n  end\n\nfun default_strengthen ctxt thms = strengthen ctxt false true thms []\n\nval strengthen_args =\n  Attrib.thms >> curry (fn (rules, ctxt) =>\n    Method.CONTEXT_METHOD (fn _ =>\n      Method.RUNTIME (Method.CONTEXT_TACTIC\n        (strengthen ctxt false true rules [] 1))\n    )\n  );\n\nval strengthen_asm_args =\n  Attrib.thms >> curry (fn (rules, ctxt) =>\n    Method.CONTEXT_METHOD (fn _ =>\n      Method.RUNTIME (Method.CONTEXT_TACTIC\n        (strengthen ctxt true false rules [] 1))\n    )\n  );\n\nval strengthen_method_args =\n  Method.text_closure >> curry (fn (meth, ctxt) =>\n    Method.CONTEXT_METHOD (fn _ =>\n      Method.RUNTIME (Method.CONTEXT_TACTIC\n        (strengthen ctxt true true [] [meth] 1))\n    )\n  );\n\nend\n\n*}\n\nend\n\nsetup \"Strengthen.setup\"\n\nmethod_setup strengthen = {* Strengthen.strengthen_args *}\n  \"strengthen the goal (see theory Strengthen_Demo)\"\n\nmethod_setup strengthen_asm = {* Strengthen.strengthen_asm_args *}\n  \"apply ''strengthen'' to weaken an assumption\"\n\nmethod_setup strengthen_method = {* Strengthen.strengthen_method_args *}\n  \"use an argument method in ''strengthen'' sites\"\n\ntext {* Important strengthen congruence rules. *}\n\ncontext strengthen_implementation begin\n\nlemma strengthen_imp_imp[simp]:\n  \"st True (op \\<longrightarrow>) A B = (A \\<longrightarrow> B)\"\n  \"st False (op \\<longrightarrow>) A B = (B \\<longrightarrow> A)\"\n  by (simp_all add: st_def)\n\nabbreviation(input)\n  \"st_ord t \\<equiv> st t (op \\<le> :: ('a :: preorder) \\<Rightarrow> _)\"\n\nlemma strengthen_imp_ord[simp]:\n  \"st_ord True A B = (A \\<le> B)\"\n  \"st_ord False A B = (B \\<le> A)\"\n  by (auto simp add: st_def)\n\nlemma strengthen_imp_conj [strg]:\n  \"\\<lbrakk> B \\<Longrightarrow> st F (op \\<longrightarrow>) A A'; st F (op \\<longrightarrow>) B B' \\<rbrakk>\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (A \\<and> B) (A' \\<and> B')\"\n  by (cases F, auto)\n\nlemma strengthen_imp_disj [strg]:\n  \"\\<lbrakk> \\<not> B \\<Longrightarrow> st F (op \\<longrightarrow>) A A'; st F (op \\<longrightarrow>) B B' \\<rbrakk>\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (A \\<or> B) (A' \\<or> B')\"\n  by (cases F, auto)\n\nlemma strengthen_imp_implies [strg]:\n  \"\\<lbrakk> st (\\<not> F) (op \\<longrightarrow>) X X'; X \\<Longrightarrow> st F (op \\<longrightarrow>) Y Y' \\<rbrakk>\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (X \\<longrightarrow> Y) (X' \\<longrightarrow> Y')\"\n  by (cases F, auto)\n\nlemma strengthen_all[strg]:\n  \"\\<lbrakk> \\<And>x. st F (op \\<longrightarrow>) (P x) (Q x) \\<rbrakk>\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (\\<forall>x. P x) (\\<forall>x. Q x)\"\n  by (cases F, auto)\n\nlemma strengthen_ex[strg]:\n  \"\\<lbrakk> \\<And>x. st F (op \\<longrightarrow>) (P x) (Q x) \\<rbrakk>\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (\\<exists>x. P x) (\\<exists>x. Q x)\"\n  by (cases F, auto)\n\nlemma strengthen_Ball[strg]:\n  \"\\<lbrakk> st_ord (Not F) S S';\n        \\<And>x. x \\<in> S \\<Longrightarrow> st F (op \\<longrightarrow>) (P x) (Q x) \\<rbrakk>\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (\\<forall>x \\<in> S. P x) (\\<forall>x \\<in> S'. Q x)\"\n  by (cases F, auto)\n\nlemma strengthen_Bex[strg]:\n  \"\\<lbrakk> st_ord F S S';\n        \\<And>x. x \\<in> S \\<Longrightarrow> st F (op \\<longrightarrow>) (P x) (Q x) \\<rbrakk>\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (\\<exists>x \\<in> S. P x) (\\<exists>x \\<in> S'. Q x)\"\n  by (cases F, auto)\n\nlemma strengthen_Collect[strg]:\n  \"\\<lbrakk> \\<And>x. st F (op \\<longrightarrow>) (P x) (P' x) \\<rbrakk>\n    \\<Longrightarrow> st_ord F {x. P x} {x. P' x}\"\n  by (cases F, auto)\n\nlemma strengthen_mem[strg]:\n  \"\\<lbrakk> st_ord F S S' \\<rbrakk>\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (x \\<in> S) (x \\<in> S')\"\n  by (cases F, auto)\n\nlemma strengthen_ord[strg]:\n  \"st_ord (\\<not> F) x x' \\<Longrightarrow> st_ord F y y'\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (x \\<le> y) (x' \\<le> y')\"\n  by (cases F, simp_all, (metis order_trans)+)\n\nlemma strengthen_strict_ord[strg]:\n  \"st_ord (\\<not> F) x x' \\<Longrightarrow> st_ord F y y'\n    \\<Longrightarrow> st F (op \\<longrightarrow>) (x < y) (x' < y')\"\n  by (cases F, simp_all, (metis order_le_less_trans order_less_le_trans)+)\n\nlemma strengthen_image[strg]:\n  \"st_ord F S S' \\<Longrightarrow> st_ord F (f ` S) (f ` S')\"\n  by (cases F, auto)\n\nlemma strengthen_vimage[strg]:\n  \"st_ord F S S' \\<Longrightarrow> st_ord F (f -` S) (f -` S')\"\n  by (cases F, auto)\n\nlemma strengthen_Int[strg]:\n  \"st_ord F A A' \\<Longrightarrow> st_ord F B B' \\<Longrightarrow> st_ord F (A \\<inter> B) (A' \\<inter> B')\"\n  by (cases F, auto)\n\nlemma strengthen_Un[strg]:\n  \"st_ord F A A' \\<Longrightarrow> st_ord F B B' \\<Longrightarrow> st_ord F (A \\<union> B) (A' \\<union> B')\"\n  by (cases F, auto)\n\nlemma strengthen_UN[strg]:\n  \"st_ord F A A' \\<Longrightarrow> (\\<And>x. x \\<in> A \\<Longrightarrow> st_ord F (B x) (B' x))\n    \\<Longrightarrow> st_ord F (\\<Union>x \\<in> A. B x) (\\<Union>x \\<in> A'. B' x)\"\n  by (cases F, auto)\n\nlemma strengthen_INT[strg]:\n  \"st_ord (\\<not> F) A A' \\<Longrightarrow> (\\<And>x. x \\<in> A \\<Longrightarrow> st_ord F (B x) (B' x))\n    \\<Longrightarrow> st_ord F (\\<Inter>x \\<in> A. B x) (\\<Inter>x \\<in> A'. B' x)\"\n  by (cases F, auto)\n\nlemma strengthen_imp_strengthen_prop[strg]:\n  \"st False (op \\<longrightarrow>) P Q \\<Longrightarrow> PROP (st_prop1 (Trueprop P) (Trueprop Q))\"\n  \"st True (op \\<longrightarrow>) P Q \\<Longrightarrow> PROP (st_prop2 (Trueprop P) (Trueprop Q))\"\n  unfolding st_prop1_def st_prop2_def\n  by auto\n\nlemma st_prop_meta_imp[strg]:\n  \"PROP (st_prop2 (PROP X) (PROP X'))\n    \\<Longrightarrow> PROP (st_prop1 (PROP Y) (PROP Y'))\n    \\<Longrightarrow> PROP (st_prop1 (PROP X \\<Longrightarrow> PROP Y) (PROP X' \\<Longrightarrow> PROP Y'))\"\n  \"PROP (st_prop1 (PROP X) (PROP X'))\n    \\<Longrightarrow> PROP (st_prop2 (PROP Y) (PROP Y'))\n    \\<Longrightarrow> PROP (st_prop2 (PROP X \\<Longrightarrow> PROP Y) (PROP X' \\<Longrightarrow> PROP Y'))\"\n  unfolding st_prop1_def st_prop2_def\n  by (erule meta_mp | assumption)+\n\nlemma st_prop_meta_all[strg]:\n  \"(\\<And>x. PROP (st_prop1 (PROP (X x)) (PROP (X' x))))\n    \\<Longrightarrow> PROP (st_prop1 (\\<And>x. PROP (X x)) (\\<And>x. PROP (X' x)))\"\n  \"(\\<And>x. PROP (st_prop2 (PROP (X x)) (PROP (X' x))))\n    \\<Longrightarrow> PROP (st_prop2 (\\<And>x. PROP (X x)) (\\<And>x. PROP (X' x)))\"\n  unfolding st_prop1_def st_prop2_def\n   apply (rule Pure.asm_rl)\n   apply (erule meta_allE, erule meta_mp)\n   apply assumption\n  apply (rule Pure.asm_rl)\n  apply (erule meta_allE, erule meta_mp)\n  apply assumption\n  done\n\n(* to think about, what more monotonic constructions can we find? *)\n\nend\n\nlemma imp_consequent:\n  \"P \\<longrightarrow> Q \\<longrightarrow> P\" by simp\n\ntext {* Test cases. *}\n\nlemma\n  assumes x: \"\\<And>x. P x \\<longrightarrow> Q x\"\n  shows \"{x. x \\<noteq> None \\<and> P (the x)} \\<subseteq> {y. \\<forall>x. y = Some x \\<longrightarrow> Q x}\"\n  apply (strengthen x)\n  apply clarsimp\n  done\n\nlocale strengthen_silly_test begin\n\ndefinition\n  silly :: \"nat \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"silly x y = (x \\<le> y)\"\n\nlemma silly_trans:\n  \"silly x y \\<Longrightarrow> silly y z \\<Longrightarrow> silly x z\"\n  by (simp add: silly_def)\n\nlemma silly_refl:\n  \"silly x x\"\n  by (simp add: silly_def)\n\nlemma foo:\n  \"silly x y \\<Longrightarrow> silly a b \\<Longrightarrow> silly b c\n    \\<Longrightarrow> silly x y \\<and> (\\<forall>x :: nat. silly a c )\"\n  using [[strengthen_trace = true]]\n  apply (strengthen silly_trans[mk_strg I E])+\n  apply (strengthen silly_refl)\n  apply simp\n  done\n\nlemma foo_asm:\n  \"silly x y \\<Longrightarrow> silly y z\n    \\<Longrightarrow> (silly x z \\<Longrightarrow> silly a b) \\<Longrightarrow> silly z z \\<Longrightarrow> silly a b\"\n  apply (strengthen_asm silly_trans[mk_strg I A])\n  apply (strengthen_asm silly_trans[mk_strg I A])\n  apply simp\n  done\n\nlemma foo_method:\n  \"silly x y \\<Longrightarrow> silly a b \\<Longrightarrow> silly b c\n    \\<Longrightarrow> silly x y \\<and> (\\<forall>x :: nat. z \\<longrightarrow> silly a c )\"\n  using [[strengthen_trace = true]]\n  apply simp\n  apply (strengthen_method \\<open>rule silly_trans\\<close>)\n  apply (strengthen_method \\<open>rule exI[where x=b]\\<close>)\n  apply simp\n  done\n\nend\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/lib/Monad_WP/Strengthen.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.34000003985159916}}
{"text": "(* \n   Title: Psi-calculi   \n   Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weakening\n  imports Weak_Bisimulation\nbegin\n\nlocale weak = env + \n  assumes weaken: \"\\<Psi> \\<hookrightarrow> \\<Psi> \\<otimes> \\<Psi>'\"\nbegin\n\nlemma entWeaken:\n  fixes \\<Psi> :: 'b\n  and   \\<phi> :: 'c\n\n  assumes \"\\<Psi> \\<turnstile> \\<phi>\"\n\n  shows \"\\<Psi> \\<otimes> \\<Psi>' \\<turnstile> \\<phi>\"\nusing assms weaken\nby(auto simp add: Assertion_stat_imp_def)\n\nlemma assertWeaken:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n\n  shows \"\\<Psi> \\<hookrightarrow> \\<Psi> \\<otimes> \\<Psi>'\"\nby(auto simp add: Assertion_stat_imp_def entWeaken)\n\nlemma frameWeaken:\n  fixes F :: \"'b frame\"\n  and   G :: \"'b frame\"\n\n  shows \"F \\<hookrightarrow>\\<^sub>F F \\<otimes>\\<^sub>F G\"\nproof -\n  obtain A\\<^sub>F \\<Psi>\\<^sub>F where FrF: \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\" and \"A\\<^sub>F \\<sharp>* F\" and  \"A\\<^sub>F \\<sharp>* G\"\n    by(rule_tac F=F and C=\"(F, G)\" in fresh_frame) auto\n  obtain A\\<^sub>G \\<Psi>\\<^sub>G where FrG: \"G = \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>G\\<rangle>\" and \"A\\<^sub>G \\<sharp>* F\" and  \"A\\<^sub>G \\<sharp>* G\" and \"A\\<^sub>G \\<sharp>* A\\<^sub>F\" and \"A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F\"\n    by(rule_tac F=G and C=\"(F, G, A\\<^sub>F, \\<Psi>\\<^sub>F)\" in fresh_frame) auto\n  from FrG `A\\<^sub>F \\<sharp>* G` `A\\<^sub>G \\<sharp>* A\\<^sub>F` have \"A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G\" by auto\n  have \"\\<Psi>\\<^sub>F \\<hookrightarrow> \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G\" by(rule weaken)\n  hence \"\\<langle>A\\<^sub>G, \\<Psi>\\<^sub>F\\<rangle> \\<hookrightarrow>\\<^sub>F \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G\\<rangle>\" by(rule_tac frame_imp_res_chain_pres) auto\n  with `A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F` have \"\\<langle>\\<epsilon>, \\<Psi>\\<^sub>F\\<rangle> \\<hookrightarrow>\\<^sub>F \\<langle>A\\<^sub>G, \\<Psi>\\<^sub>F \\<otimes> \\<Psi>\\<^sub>G\\<rangle>\" using frame_res_fresh_chain\n    by(rule_tac Frame_stat_imp_trans) (auto simp add: Frame_stat_eq_def)\n  with FrF FrG `A\\<^sub>G \\<sharp>* A\\<^sub>F` `A\\<^sub>G \\<sharp>* \\<Psi>\\<^sub>F` `A\\<^sub>F \\<sharp>* \\<Psi>\\<^sub>G` show ?thesis\n    by(force simp add: frame_chain_append intro: frame_imp_res_chain_pres)\nqed\n\nlemma unitAssertWeaken:\n  fixes \\<Psi> :: 'b\n\n  shows \"\\<one> \\<hookrightarrow> \\<Psi>\"\nproof -\n  have \"\\<one> \\<hookrightarrow> \\<one> \\<otimes> \\<Psi>\" by(rule assertWeaken)\n  moreover have \"\\<one> \\<otimes> \\<Psi> \\<hookrightarrow> \\<Psi>\" by(metis Identity Assertion_stat_eq_def Commutativity Assertion_stat_eq_trans)\n  ultimately show ?thesis by(rule Assertion_stat_imp_trans)\nqed\n\nlemma unitFrameWeaken:\n  fixes F :: \"'b frame\"\n\n  shows \"\\<langle>\\<epsilon>, \\<one>\\<rangle> \\<hookrightarrow>\\<^sub>F F\"\nproof -\n  have \"\\<langle>\\<epsilon>, \\<one>\\<rangle> \\<hookrightarrow>\\<^sub>F ((\\<langle>\\<epsilon>, \\<one>\\<rangle>) \\<otimes>\\<^sub>F F)\" by(rule frameWeaken)\n  moreover obtain A\\<^sub>F \\<Psi>\\<^sub>F where FrF: \"F = \\<langle>A\\<^sub>F, \\<Psi>\\<^sub>F\\<rangle>\"\n    by(rule_tac F=F and C=\"()\" in fresh_frame) auto\n  hence \"(\\<langle>\\<epsilon>, \\<one>\\<rangle>) \\<otimes>\\<^sub>F F \\<simeq>\\<^sub>F F\" \n    by simp (metis frame_int_identity frame_int_commutativity Frame_stat_eq_trans Frame_stat_eq_sym)\n  ultimately show ?thesis by(metis Frame_stat_imp_trans Frame_stat_eq_def)\nqed\n\nlemma insert_assertionWeaken:\n  fixes F :: \"'b frame\"\n  and   \\<Psi> :: 'b\n\n  shows \"\\<langle>\\<epsilon>, \\<Psi>\\<rangle> \\<hookrightarrow>\\<^sub>F insert_assertion F \\<Psi>\"\nproof -\n  have \"\\<langle>\\<epsilon>, \\<Psi>\\<rangle> \\<hookrightarrow>\\<^sub>F (\\<langle>\\<epsilon>, \\<Psi>\\<rangle>) \\<otimes>\\<^sub>F F\" by(rule frameWeaken)\n  thus ?thesis by simp\nqed\n\nlemma frameImpStatEq:\n  fixes A\\<^sub>F  :: \"name list\"\n  and   \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n  and   \\<phi>  :: 'c\n\n  assumes \"(\\<langle>A\\<^sub>F, \\<Psi>\\<rangle>) \\<turnstile>\\<^sub>F \\<phi>\"\n  and     \"\\<Psi> \\<simeq> \\<Psi>'\"\n\n  shows \"(\\<langle>A\\<^sub>F, \\<Psi>'\\<rangle>) \\<turnstile>\\<^sub>F \\<phi>\"\nproof -\n  obtain p::\"name prm\" where \"(p \\<bullet> A\\<^sub>F) \\<sharp>* \\<phi>\" and \"(p \\<bullet> A\\<^sub>F) \\<sharp>* \\<Psi>\" and \"(p \\<bullet> A\\<^sub>F) \\<sharp>* \\<Psi>'\"\n                         and \"distinct_perm p\" and S: \"set p \\<subseteq> set A\\<^sub>F \\<times> set(p \\<bullet> A\\<^sub>F)\"\n    by(rule_tac c=\"(\\<phi>, \\<Psi>, \\<Psi>')\" in name_list_avoiding) auto\n  from `(\\<langle>A\\<^sub>F, \\<Psi>\\<rangle>) \\<turnstile>\\<^sub>F \\<phi>` `(p \\<bullet> A\\<^sub>F) \\<sharp>* \\<Psi>` S have \"(\\<langle>(p \\<bullet> A\\<^sub>F), p \\<bullet> \\<Psi>\\<rangle>) \\<turnstile>\\<^sub>F \\<phi>\" by(simp add: frame_chain_alpha)\n  hence \"(p \\<bullet> \\<Psi>) \\<turnstile> \\<phi>\" using `(p \\<bullet> A\\<^sub>F) \\<sharp>* \\<phi>` by(rule frame_impE)\n  moreover from `\\<Psi> \\<simeq> \\<Psi>'` have \"(p \\<bullet> \\<Psi>) \\<simeq> (p \\<bullet> \\<Psi>')\" by(rule Assertion_stat_eq_closed)\n  ultimately have \"(p \\<bullet> \\<Psi>') \\<turnstile> \\<phi>\" by(simp add: Assertion_stat_eq_def Assertion_stat_imp_def)\n  hence \"(\\<langle>(p \\<bullet> A\\<^sub>F), p \\<bullet> \\<Psi>'\\<rangle>) \\<turnstile>\\<^sub>F \\<phi>\" using `(p \\<bullet> A\\<^sub>F) \\<sharp>* \\<phi>` \n    by(rule_tac frame_impI) auto\n  with `(p \\<bullet> A\\<^sub>F) \\<sharp>* \\<Psi>'` S show ?thesis by(simp add: frame_chain_alpha)\nqed\n\n\n\n  assumes \"\\<Psi> \\<rhd> P \\<longmapsto>None @ \\<tau> \\<prec> P'\"\n\n  shows \"insert_assertion (extract_frame P) \\<Psi> \\<hookrightarrow>\\<^sub>F insert_assertion (extract_frame P') \\<Psi>\"\nproof(auto simp add: Frame_stat_imp_def)\n  fix \\<phi> :: 'c\n  obtain A\\<^sub>P \\<Psi>\\<^sub>P where FrP: \"extract_frame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* P\" and \"A\\<^sub>P \\<sharp>* \\<phi>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\" and \"distinct A\\<^sub>P\" \n    by(rule_tac C=\"(P, \\<phi>, \\<Psi>)\" in fresh_frame) auto\n  with `\\<Psi> \\<rhd> P \\<longmapsto>None @ \\<tau> \\<prec> P'` obtain \\<Psi>' A\\<^sub>P' \\<Psi>\\<^sub>P' where FrP': \"extract_frame P' = \\<langle>A\\<^sub>P', \\<Psi>\\<^sub>P'\\<rangle>\" and \"\\<Psi>\\<^sub>P \\<otimes> \\<Psi>' \\<simeq> \\<Psi>\\<^sub>P'\" \n                                              and \"A\\<^sub>P' \\<sharp>* P'\" and \"A\\<^sub>P' \\<sharp>* \\<phi>\"  and \"A\\<^sub>P' \\<sharp>* \\<Psi>\" \n    by(rule_tac C=\"(\\<Psi>, \\<phi>)\" in expand_tau_frame) auto\n  assume \"insert_assertion (extract_frame P) \\<Psi> \\<turnstile>\\<^sub>F \\<phi>\"\n  with FrP `A\\<^sub>P \\<sharp>* \\<phi>` `A\\<^sub>P \\<sharp>* \\<Psi>` have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>P \\<turnstile> \\<phi>\" by(auto dest: frame_impE)\n  hence \"(\\<Psi> \\<otimes> \\<Psi>\\<^sub>P) \\<otimes> \\<Psi>' \\<turnstile> \\<phi>\" by(rule entWeaken)\n  hence \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>P' \\<turnstile> \\<phi>\" using `\\<Psi>\\<^sub>P \\<otimes> \\<Psi>' \\<simeq> \\<Psi>\\<^sub>P'`\n    by(rule_tac stat_eq_ent, auto) (metis Associativity composition_sym Assertion_stat_eq_trans Assertion_stat_eq_sym Commutativity)\n  with `A\\<^sub>P' \\<sharp>* \\<phi>` `A\\<^sub>P' \\<sharp>* \\<Psi>` FrP' show \"insert_assertion (extract_frame P') \\<Psi> \\<turnstile>\\<^sub>F \\<phi>\"\n    by(force intro: frame_impI)\nqed\n\nlemma weakenTransition:\n  fixes \\<Psi>  :: 'b\n  and   P  :: \"('a, 'b, 'c) psi\"\n  and   Rs :: \"('a, 'b, 'c) residual\"\n  and   \\<Psi>' :: 'b\n\n  assumes \"\\<Psi> \\<rhd> P \\<longmapsto> \\<pi> @ Rs\"\n\n  shows \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P \\<longmapsto> \\<pi> @ Rs\"\nusing assms\nproof(nominal_induct avoiding: \\<Psi>' rule: semantics.strong_induct)\n  case(c_input \\<Psi> M K xvec N Tvec P \\<Psi>')\n  from `\\<Psi> \\<turnstile> M \\<leftrightarrow> K` have \"\\<Psi> \\<otimes> \\<Psi>' \\<turnstile> M \\<leftrightarrow> K\" by(rule entWeaken)\n  thus ?case using `distinct xvec` `set xvec \\<subseteq> (supp N)` `length xvec = length Tvec` \n    by(rule Input)\nnext\n  case(Output \\<Psi> M K N P \\<Psi>')\n  from `\\<Psi> \\<turnstile> M \\<leftrightarrow> K` have \"\\<Psi> \\<otimes> \\<Psi>' \\<turnstile> M \\<leftrightarrow> K\" by(rule entWeaken)\n  thus ?case by(rule semantics.Output)\nnext\n  case(Case \\<Psi> P \\<pi> Rs \\<phi> Cs \\<Psi>')\n  have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P \\<longmapsto> \\<pi> @ Rs\" by(rule Case)\n  moreover note `(\\<phi>, P) mem Cs`\n  moreover from `\\<Psi> \\<turnstile> \\<phi>` have \"\\<Psi> \\<otimes> \\<Psi>' \\<turnstile> \\<phi>\" by(rule entWeaken)\n  ultimately show ?case using `guarded P`\n    by(rule semantics.Case)\nnext\n  case(c_par1 \\<Psi> \\<Psi>\\<^sub>Q P \\<pi> \\<alpha> P' Q A\\<^sub>Q \\<Psi>')\n  have \"(\\<Psi> \\<otimes> \\<Psi>\\<^sub>Q) \\<otimes> \\<Psi>' \\<rhd> P \\<longmapsto>\\<pi> @ \\<alpha> \\<prec> P'\" by(rule c_par1)\n  hence \"(\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>\\<^sub>Q \\<rhd> P \\<longmapsto>\\<pi> @ \\<alpha> \\<prec> P'\"\n    by(metis stat_eq_transition Composition Associativity Commutativity Assertion_stat_eq_trans)\n  thus ?case using `extract_frame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>` `bn \\<alpha> \\<sharp>* Q` `A\\<^sub>Q \\<sharp>* \\<Psi>` `A\\<^sub>Q \\<sharp>* \\<Psi>'` `A\\<^sub>Q \\<sharp>* P` `A\\<^sub>Q \\<sharp>* \\<alpha>`\n    by(rule_tac Par1) auto\nnext\n  case(c_par2 \\<Psi> \\<Psi>\\<^sub>P Q \\<pi> \\<alpha> Q' P A\\<^sub>P \\<Psi>')\n  have \"(\\<Psi> \\<otimes> \\<Psi>\\<^sub>P) \\<otimes> \\<Psi>' \\<rhd> Q \\<longmapsto>\\<pi> @ \\<alpha> \\<prec> Q'\" by(rule c_par2)\n  hence \"(\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>\\<^sub>P \\<rhd> Q \\<longmapsto>\\<pi> @ \\<alpha> \\<prec> Q'\"\n    by(metis stat_eq_transition Composition Associativity Commutativity Assertion_stat_eq_trans)\n  thus ?case using `extract_frame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>` `bn \\<alpha> \\<sharp>* P` `A\\<^sub>P \\<sharp>* \\<Psi>` `A\\<^sub>P \\<sharp>* \\<Psi>'` `A\\<^sub>P \\<sharp>* Q` `A\\<^sub>P \\<sharp>* \\<alpha>`\n    by(rule_tac Par2) auto\nnext\n  case(c_comm1 \\<Psi> \\<Psi>\\<^sub>Q P A\\<^sub>P yvec K M N P' \\<Psi>\\<^sub>P Q A\\<^sub>Q zvec xvec Q' \\<Psi>')\n  have \"(\\<Psi> \\<otimes> \\<Psi>\\<^sub>Q) \\<otimes> \\<Psi>' \\<rhd> P \\<longmapsto> Some (\\<langle>A\\<^sub>P; yvec, K\\<rangle>) @ M\\<lparr>N\\<rparr> \\<prec> P'\" by(rule c_comm1)\n  hence \"(\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>\\<^sub>Q \\<rhd> P \\<longmapsto> Some (\\<langle>A\\<^sub>P; yvec, K\\<rangle>) @ M\\<lparr>N\\<rparr> \\<prec> P'\"\n    by(metis stat_eq_transition Composition Associativity Commutativity Assertion_stat_eq_trans)\n  moreover note `extract_frame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>`\n  moreover have \"(\\<Psi> \\<otimes> \\<Psi>\\<^sub>P) \\<otimes> \\<Psi>' \\<rhd> Q \\<longmapsto>Some (\\<langle>A\\<^sub>Q; zvec, M\\<rangle>) @ K\\<lparr>\\<nu>*xvec\\<rparr>\\<langle>N\\<rangle> \\<prec> Q'\" by(rule c_comm1)\n  hence \"(\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>\\<^sub>P \\<rhd> Q \\<longmapsto>Some (\\<langle>A\\<^sub>Q; zvec, M\\<rangle>) @ K\\<lparr>\\<nu>*xvec\\<rparr>\\<langle>N\\<rangle> \\<prec> Q'\"\n    by(metis stat_eq_transition Composition Associativity Commutativity Assertion_stat_eq_trans)\n  moreover note `extract_frame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>`\n  ultimately show ?case using `A\\<^sub>P \\<sharp>* \\<Psi>` `A\\<^sub>P \\<sharp>* \\<Psi>'` `A\\<^sub>P \\<sharp>* P` `A\\<^sub>P \\<sharp>* Q` `A\\<^sub>P \\<sharp>* M` `A\\<^sub>P \\<sharp>* A\\<^sub>Q`\n                              `A\\<^sub>Q \\<sharp>* \\<Psi>` `A\\<^sub>Q \\<sharp>* \\<Psi>'` `A\\<^sub>Q \\<sharp>* P` `A\\<^sub>Q \\<sharp>* Q` `A\\<^sub>Q \\<sharp>* K` `xvec \\<sharp>* P`\n                              `yvec \\<sharp>* \\<Psi>` `yvec \\<sharp>* \\<Psi>\\<^sub>P` `yvec \\<sharp>* \\<Psi>'` `yvec \\<sharp>* Q`\n                              `zvec \\<sharp>* \\<Psi>` `zvec \\<sharp>* \\<Psi>\\<^sub>Q` `zvec \\<sharp>* \\<Psi>'` `zvec \\<sharp>* P`\n    by(rule_tac Comm1) (assumption | auto)+\nnext\n  case(c_comm2 \\<Psi> \\<Psi>\\<^sub>Q P A\\<^sub>P yvec K M xvec N P' \\<Psi>\\<^sub>P Q A\\<^sub>Q zvec Q' \\<Psi>')\n  have \"(\\<Psi> \\<otimes> \\<Psi>\\<^sub>Q) \\<otimes> \\<Psi>' \\<rhd> P \\<longmapsto>Some (\\<langle>A\\<^sub>P; yvec, K\\<rangle>) @ M\\<lparr>\\<nu>*xvec\\<rparr>\\<langle>N\\<rangle> \\<prec> P'\" by(rule c_comm2)\n  hence \"(\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>\\<^sub>Q \\<rhd> P \\<longmapsto>Some (\\<langle>A\\<^sub>P; yvec, K\\<rangle>) @ M\\<lparr>\\<nu>*xvec\\<rparr>\\<langle>N\\<rangle> \\<prec> P'\"\n    by(metis stat_eq_transition Composition Associativity Commutativity Assertion_stat_eq_trans)\n  moreover note `extract_frame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>`\n  moreover have \"(\\<Psi> \\<otimes> \\<Psi>\\<^sub>P) \\<otimes> \\<Psi>' \\<rhd> Q \\<longmapsto>Some (\\<langle>A\\<^sub>Q; zvec, M\\<rangle>) @ K\\<lparr>N\\<rparr> \\<prec> Q'\" by(rule c_comm2)\n  hence \"(\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>\\<^sub>P \\<rhd> Q \\<longmapsto>Some (\\<langle>A\\<^sub>Q; zvec, M\\<rangle>) @ K\\<lparr>N\\<rparr> \\<prec> Q'\"\n    by(metis stat_eq_transition Composition Associativity Commutativity Assertion_stat_eq_trans)\n  moreover note `extract_frame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>`\n  ultimately show ?case using `A\\<^sub>P \\<sharp>* \\<Psi>` `A\\<^sub>P \\<sharp>* \\<Psi>'` `A\\<^sub>P \\<sharp>* P` `A\\<^sub>P \\<sharp>* Q` `A\\<^sub>P \\<sharp>* M` `A\\<^sub>P \\<sharp>* A\\<^sub>Q`\n                              `A\\<^sub>Q \\<sharp>* \\<Psi>` `A\\<^sub>Q \\<sharp>* \\<Psi>'` `A\\<^sub>Q \\<sharp>* P` `A\\<^sub>Q \\<sharp>* Q` `A\\<^sub>Q \\<sharp>* K` `xvec \\<sharp>* Q`\n                              `yvec \\<sharp>* \\<Psi>` `yvec \\<sharp>* \\<Psi>\\<^sub>P` `yvec \\<sharp>* \\<Psi>'` `yvec \\<sharp>* Q`\n                              `zvec \\<sharp>* \\<Psi>` `zvec \\<sharp>* \\<Psi>\\<^sub>Q` `zvec \\<sharp>* \\<Psi>'` `zvec \\<sharp>* P`\n    by(rule_tac Comm2) (assumption | auto)+\nnext\n  case(c_open \\<Psi> P \\<pi> M xvec yvec N P' x \\<Psi>')\n  have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P \\<longmapsto>Some \\<pi> @ M\\<lparr>\\<nu>*(xvec@yvec)\\<rparr>\\<langle>N\\<rangle> \\<prec> P'\" by(rule c_open)\n  thus ?case using `x \\<in> supp N` `x \\<sharp> \\<Psi>` `x \\<sharp> \\<Psi>'` `x \\<sharp> M` `x \\<sharp> xvec` `x \\<sharp> yvec`\n    by(rule_tac Open) auto\nnext  \n  case(c_scope \\<Psi> P \\<pi> \\<alpha> P' x \\<Psi>')\n  have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P \\<longmapsto>\\<pi> @ \\<alpha> \\<prec> P'\" by(rule c_scope)\n  thus ?case using `x \\<sharp> \\<Psi>` `x \\<sharp> \\<Psi>'` `x \\<sharp> \\<alpha>` by(rule_tac Scope) auto\nnext\n  case(Bang \\<Psi> P \\<pi> Rs \\<Psi>')\n  have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P \\<parallel> !P\\<longmapsto>\\<pi> @ Rs\" by(rule Bang)\n  thus ?case using `guarded P` by(rule semantics.Bang)\nqed\n\nend\n\nend\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Weakening.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3400000312119444}}
{"text": "(*  Title:      HOL/IMPP/Natural.thy\n    Author:     David von Oheimb (based on a theory by Tobias Nipkow et al), TUM\n*)\n\nsection {* Natural semantics of commands *}\n\ntheory Natural\nimports Com\nbegin\n\n(** Execution of commands **)\n\nconsts\n  newlocs :: locals\n  setlocs :: \"state => locals => state\"\n  getlocs :: \"state => locals\"\n  update  :: \"state => vname => val => state\"     (\"_/[_/::=/_]\" [900,0,0] 900)\n\nabbreviation\n  loc :: \"state => locals\"  (\"_<_>\" [75,0] 75) where\n  \"s<X> == getlocs s X\"\n\ninductive\n  evalc :: \"[com,state,    state] => bool\"  (\"<_,_>/ -c-> _\" [0,0,  51] 51)\n  where\n    Skip:    \"<SKIP,s> -c-> s\"\n\n  | Assign:  \"<X :== a,s> -c-> s[X::=a s]\"\n\n  | Local:   \"<c, s0[Loc Y::= a s0]> -c-> s1 ==>\n              <LOCAL Y := a IN c, s0> -c-> s1[Loc Y::=s0<Y>]\"\n\n  | Semi:    \"[| <c0,s0> -c-> s1; <c1,s1> -c-> s2 |] ==>\n              <c0;; c1, s0> -c-> s2\"\n\n  | IfTrue:  \"[| b s; <c0,s> -c-> s1 |] ==>\n              <IF b THEN c0 ELSE c1, s> -c-> s1\"\n\n  | IfFalse: \"[| ~b s; <c1,s> -c-> s1 |] ==>\n              <IF b THEN c0 ELSE c1, s> -c-> s1\"\n\n  | WhileFalse: \"~b s ==> <WHILE b DO c,s> -c-> s\"\n\n  | WhileTrue:  \"[| b s0;  <c,s0> -c-> s1;  <WHILE b DO c, s1> -c-> s2 |] ==>\n                 <WHILE b DO c, s0> -c-> s2\"\n\n  | Body:       \"<the (body pn), s0> -c-> s1 ==>\n                 <BODY pn, s0> -c-> s1\"\n\n  | Call:       \"<BODY pn, (setlocs s0 newlocs)[Loc Arg::=a s0]> -c-> s1 ==>\n                 <X:=CALL pn(a), s0> -c-> (setlocs s1 (getlocs s0))\n                                          [X::=s1<Res>]\"\n\ninductive\n  evaln :: \"[com,state,nat,state] => bool\"  (\"<_,_>/ -_-> _\" [0,0,0,51] 51)\n  where\n    Skip:    \"<SKIP,s> -n-> s\"\n\n  | Assign:  \"<X :== a,s> -n-> s[X::=a s]\"\n\n  | Local:   \"<c, s0[Loc Y::= a s0]> -n-> s1 ==>\n              <LOCAL Y := a IN c, s0> -n-> s1[Loc Y::=s0<Y>]\"\n\n  | Semi:    \"[| <c0,s0> -n-> s1; <c1,s1> -n-> s2 |] ==>\n              <c0;; c1, s0> -n-> s2\"\n\n  | IfTrue:  \"[| b s; <c0,s> -n-> s1 |] ==>\n              <IF b THEN c0 ELSE c1, s> -n-> s1\"\n\n  | IfFalse: \"[| ~b s; <c1,s> -n-> s1 |] ==>\n              <IF b THEN c0 ELSE c1, s> -n-> s1\"\n\n  | WhileFalse: \"~b s ==> <WHILE b DO c,s> -n-> s\"\n\n  | WhileTrue:  \"[| b s0;  <c,s0> -n-> s1;  <WHILE b DO c, s1> -n-> s2 |] ==>\n                 <WHILE b DO c, s0> -n-> s2\"\n\n  | Body:       \"<the (body pn), s0> -    n-> s1 ==>\n                 <BODY pn, s0> -Suc n-> s1\"\n\n  | Call:       \"<BODY pn, (setlocs s0 newlocs)[Loc Arg::=a s0]> -n-> s1 ==>\n                 <X:=CALL pn(a), s0> -n-> (setlocs s1 (getlocs s0))\n                                          [X::=s1<Res>]\"\n\n\ninductive_cases evalc_elim_cases:\n  \"<SKIP,s> -c-> t\"  \"<X:==a,s> -c-> t\"  \"<LOCAL Y:=a IN c,s> -c-> t\"\n  \"<c1;;c2,s> -c-> t\"  \"<IF b THEN c1 ELSE c2,s> -c-> t\"\n  \"<BODY P,s> -c-> s1\"  \"<X:=CALL P(a),s> -c-> s1\"\n\ninductive_cases evaln_elim_cases:\n  \"<SKIP,s> -n-> t\"  \"<X:==a,s> -n-> t\"  \"<LOCAL Y:=a IN c,s> -n-> t\"\n  \"<c1;;c2,s> -n-> t\"  \"<IF b THEN c1 ELSE c2,s> -n-> t\"\n  \"<BODY P,s> -n-> s1\"  \"<X:=CALL P(a),s> -n-> s1\"\n\ninductive_cases evalc_WHILE_case: \"<WHILE b DO c,s> -c-> t\"\ninductive_cases evaln_WHILE_case: \"<WHILE b DO c,s> -n-> t\"\n\ndeclare evalc.intros [intro]\ndeclare evaln.intros [intro]\n\ndeclare evalc_elim_cases [elim!]\ndeclare evaln_elim_cases [elim!]\n\n(* evaluation of com is deterministic *)\nlemma com_det [rule_format (no_asm)]: \"<c,s> -c-> t ==> (!u. <c,s> -c-> u --> u=t)\"\napply (erule evalc.induct)\napply (erule_tac [8] V = \"<?c,s1> -c-> s2\" in thin_rl)\n(*blast needs unify_search_bound = 40*)\napply (best elim: evalc_WHILE_case)+\ndone\n\nlemma evaln_evalc: \"<c,s> -n-> t ==> <c,s> -c-> t\"\napply (erule evaln.induct)\napply (tactic {* ALLGOALS (resolve_tac @{thms evalc.intros} THEN_ALL_NEW atac) *})\ndone\n\nlemma Suc_le_D_lemma: \"[| Suc n <= m'; (!!m. n <= m ==> P (Suc m)) |] ==> P m'\"\napply (frule Suc_le_D)\napply blast\ndone\n\nlemma evaln_nonstrict [rule_format]: \"<c,s> -n-> t ==> !m. n<=m --> <c,s> -m-> t\"\napply (erule evaln.induct)\napply (auto elim!: Suc_le_D_lemma)\ndone\n\nlemma evaln_Suc: \"<c,s> -n-> s' ==> <c,s> -Suc n-> s'\"\napply (erule evaln_nonstrict)\napply auto\ndone\n\nlemma evaln_max2: \"[| <c1,s1> -n1-> t1;  <c2,s2> -n2-> t2 |] ==>  \n    ? n. <c1,s1> -n -> t1 & <c2,s2> -n -> t2\"\napply (cut_tac m = \"n1\" and n = \"n2\" in nat_le_linear)\napply (blast dest: evaln_nonstrict)\ndone\n\nlemma evalc_evaln: \"<c,s> -c-> t ==> ? n. <c,s> -n-> t\"\napply (erule evalc.induct)\napply (tactic {* ALLGOALS (REPEAT o etac exE) *})\napply (tactic {* TRYALL (EVERY' [dtac @{thm evaln_max2}, assume_tac @{context},\n  REPEAT o eresolve_tac [exE, conjE]]) *})\napply (tactic {* ALLGOALS (rtac exI THEN' resolve_tac @{thms evaln.intros} THEN_ALL_NEW atac) *})\ndone\n\nlemma eval_eq: \"<c,s> -c-> t = (? n. <c,s> -n-> t)\"\napply (fast elim: evalc_evaln evaln_evalc)\ndone\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/IMPP/Natural.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.3400000312119444}}
{"text": "section \\<open>\\isaheader{Map Interface}\\<close>\ntheory Intf_Map\nimports Refine_Monadic.Refine_Monadic\nbegin\n\nconsts i_map :: \"interface \\<Rightarrow> interface \\<Rightarrow> interface\"\n\ndefinition [simp]: \"op_map_empty \\<equiv> Map.empty\"\ndefinition op_map_lookup :: \"'k \\<Rightarrow> ('k\\<rightharpoonup>'v) \\<rightharpoonup> 'v\"\n  where [simp]: \"op_map_lookup k m \\<equiv> m k\"\ndefinition [simp]: \"op_map_update k v m \\<equiv> m(k\\<mapsto>v)\"\ndefinition [simp]: \"op_map_delete k m \\<equiv> m |` (-{k})\"\ndefinition [simp]: \"op_map_restrict P m \\<equiv> m |` {k\\<in>dom m. P (k, the (m k))}\"\ndefinition [simp]: \"op_map_isEmpty x \\<equiv> x=Map.empty\"\ndefinition [simp]: \"op_map_isSng x \\<equiv> \\<exists>k v. x=[k\\<mapsto>v]\"\ndefinition [simp]: \"op_map_ball m P \\<equiv> Ball (map_to_set m) P\"\ndefinition [simp]: \"op_map_bex m P \\<equiv> Bex (map_to_set m) P\"\ndefinition [simp]: \"op_map_size m \\<equiv> card (dom m)\"\ndefinition [simp]: \"op_map_size_abort n m \\<equiv> min n (card (dom m))\"\ndefinition [simp]: \"op_map_sel m P \\<equiv> SPEC (\\<lambda>(k,v). m k = Some v \\<and> P k v)\"\ndefinition [simp]: \"op_map_pick m \\<equiv> SPEC (\\<lambda>(k,v). m k = Some v)\"\n\ndefinition [simp]: \"op_map_pick_remove m \\<equiv> \n  SPEC (\\<lambda>((k,v),m'). m k = Some v \\<and> m' = m |` (-{k}))\"\n\n\ncontext begin interpretation autoref_syn .\n\n\n\n  \"m=Map.empty \\<equiv> op_map_isEmpty$m\"\n  \"Map.empty=m \\<equiv> op_map_isEmpty$m\"\n  \"dom m = {} \\<equiv> op_map_isEmpty$m\"\n  \"{} = dom m \\<equiv> op_map_isEmpty$m\"\n\n  \"\\<exists>k v. m=[k\\<mapsto>v] \\<equiv> op_map_isSng$m\"\n  \"\\<exists>k v. [k\\<mapsto>v]=m \\<equiv> op_map_isSng$m\"\n  \"\\<exists>k. dom m={k} \\<equiv> op_map_isSng$m\"\n  \"\\<exists>k. {k} = dom m \\<equiv> op_map_isSng$m\"\n  \"1 = card (dom m) \\<equiv> op_map_isSng$m\"\n\n  \"\\<And>P. Ball (map_to_set m) P \\<equiv> op_map_ball$m$P\"\n  \"\\<And>P. Bex (map_to_set m) P \\<equiv> op_map_bex$m$P\"\n\n  \"card (dom m) \\<equiv> op_map_size$m\"\n\n  \"min n (card (dom m)) \\<equiv> op_map_size_abort$n$m\"\n  \"min (card (dom m)) n \\<equiv> op_map_size_abort$n$m\"\n\n  \"\\<And>P. SPEC (\\<lambda>(k,v). m k=Some v \\<and> P k v) \\<equiv> op_map_sel$m$P\"\n  \"\\<And>P. SPEC (\\<lambda>(k,v). P k v \\<and> m k=Some v) \\<equiv> op_map_sel$m$P\"\n\n  \"\\<And>P. SPEC (\\<lambda>(k,v). m k = Some v) \\<equiv> op_map_pick$m\"\n  \"\\<And>P. SPEC (\\<lambda>(k,v). (k,v) \\<in> map_to_set m) \\<equiv> op_map_pick$m\"\n  by (auto \n    intro!: eq_reflection ext\n    simp: restrict_map_def dom_eq_singleton_conv card_Suc_eq map_to_set_def\n    dest!: sym[of \"Suc 0\" \"card (dom m)\"] sym[of _ \"dom m\"]\n  )\n\n  lemma [autoref_op_pat]: \n    \"SPEC (\\<lambda>((k,v),m'). m k = Some v \\<and> m' = m |` (-{k})) \n      \\<equiv> op_map_pick_remove$m\"\n    by simp\n\n  lemma op_map_pick_remove_alt: \"\n    do {((k,v),m) \\<leftarrow> op_map_pick_remove m; f k v m}\n      = (\n    do {\n      (k,v)\\<leftarrow>SPEC (\\<lambda>(k,v). m k = Some v); \n       let m=m |` (-{k});\n       f k v m\n    })\"\n    unfolding op_map_pick_remove_def\n    apply (auto simp: pw_eq_iff refine_pw_simps)\n    done\n\n  lemma [autoref_op_pat]: \n    \"do {\n      (k,v)\\<leftarrow>SPEC (\\<lambda>(k,v). m k = Some v); \n       let m=m |` (-{k});\n       f k v m\n    } \\<equiv> do {((k,v),m) \\<leftarrow> op_map_pick_remove m; f k v m}\"\n    unfolding op_map_pick_remove_alt .\n\n\nend\n\nlemma [autoref_itype]:\n  \"op_map_empty ::\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map\"\n  \"op_map_lookup ::\\<^sub>i Ik \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i \\<langle>Iv\\<rangle>\\<^sub>ii_option\"\n  \"op_map_update ::\\<^sub>i Ik \\<rightarrow>\\<^sub>i Iv \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map\"\n  \"op_map_delete ::\\<^sub>i Ik \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map\"\n  \"op_map_restrict \n    ::\\<^sub>i (\\<langle>Ik,Iv\\<rangle>\\<^sub>ii_prod \\<rightarrow>\\<^sub>i i_bool) \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map\"\n  \"op_map_isEmpty ::\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i i_bool\"\n  \"op_map_isSng ::\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i i_bool\"\n  \"op_map_ball ::\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i (\\<langle>Ik,Iv\\<rangle>\\<^sub>ii_prod \\<rightarrow>\\<^sub>i i_bool) \\<rightarrow>\\<^sub>i i_bool\"\n  \"op_map_bex ::\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i (\\<langle>Ik,Iv\\<rangle>\\<^sub>ii_prod \\<rightarrow>\\<^sub>i i_bool) \\<rightarrow>\\<^sub>i i_bool\"\n  \"op_map_size ::\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i i_nat\"\n  \"op_map_size_abort ::\\<^sub>i i_nat \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i i_nat\"\n  \"(++) ::\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map\"\n  \"map_of ::\\<^sub>i \\<langle>\\<langle>Ik,Iv\\<rangle>\\<^sub>ii_prod\\<rangle>\\<^sub>ii_list \\<rightarrow>\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map\"\n\n  \"op_map_sel ::\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i (Ik \\<rightarrow>\\<^sub>i Iv \\<rightarrow>\\<^sub>i i_bool) \n    \\<rightarrow>\\<^sub>i \\<langle>\\<langle>Ik,Iv\\<rangle>\\<^sub>ii_prod\\<rangle>\\<^sub>ii_nres\"\n  \"op_map_pick ::\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i \\<langle>\\<langle>Ik,Iv\\<rangle>\\<^sub>ii_prod\\<rangle>\\<^sub>ii_nres\"\n  \"op_map_pick_remove \n    ::\\<^sub>i \\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map \\<rightarrow>\\<^sub>i \\<langle>\\<langle>\\<langle>Ik,Iv\\<rangle>\\<^sub>ii_prod,\\<langle>Ik,Iv\\<rangle>\\<^sub>ii_map\\<rangle>\\<^sub>ii_prod\\<rangle>\\<^sub>ii_nres\"\n  by simp_all\n\nlemma hom_map1[autoref_hom]:\n  \"CONSTRAINT Map.empty (\\<langle>Rk,Rv\\<rangle>Rm)\"\n  \"CONSTRAINT map_of (\\<langle>\\<langle>Rk,Rv\\<rangle>prod_rel\\<rangle>list_rel \\<rightarrow> \\<langle>Rk,Rv\\<rangle>Rm)\"\n  \"CONSTRAINT (++) (\\<langle>Rk,Rv\\<rangle>Rm \\<rightarrow> \\<langle>Rk,Rv\\<rangle>Rm \\<rightarrow> \\<langle>Rk,Rv\\<rangle>Rm)\"\n  by simp_all\n\nterm op_map_restrict\n\n\n  \"CONSTRAINT op_map_sel (\\<langle>Rk,Rv\\<rangle>Rm\\<rightarrow>(Rk \\<rightarrow> Rv \\<rightarrow> bool_rel)\\<rightarrow>\\<langle>Rk\\<times>\\<^sub>rRv\\<rangle>nres_rel)\"\n  \"CONSTRAINT op_map_pick (\\<langle>Rk,Rv\\<rangle>Rm \\<rightarrow> \\<langle>Rk\\<times>\\<^sub>rRv\\<rangle>nres_rel)\"\n  \"CONSTRAINT op_map_pick_remove (\\<langle>Rk,Rv\\<rangle>Rm \\<rightarrow> \\<langle>(Rk\\<times>\\<^sub>rRv)\\<times>\\<^sub>r\\<langle>Rk,Rv\\<rangle>Rm\\<rangle>nres_rel)\"\n  by simp_all\n\n\ndefinition \"finite_map_rel R \\<equiv> Range R \\<subseteq> Collect (finite \\<circ> dom)\"\nlemma finite_map_rel_trigger: \"finite_map_rel R \\<Longrightarrow> finite_map_rel R\" .\n\n\ndeclaration \\<open>Tagged_Solver.add_triggers \n  \"Relators.relator_props_solver\" @{thms finite_map_rel_trigger}\\<close>\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/GenCF/Intf/Intf_Map.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5926665855647395, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3400000229570963}}
{"text": "section \\<open>Basic Parametricity Reasoning\\<close>\ntheory Param_Tool\nimports Relators\nbegin\n\n  subsection \\<open>Auxiliary Lemmas\\<close>\n  lemma tag_both: \"\\<lbrakk> (Let x f,Let x' f')\\<in>R \\<rbrakk> \\<Longrightarrow> (f x,f' x')\\<in>R\" by simp\n  lemma tag_rhs: \"\\<lbrakk> (c,Let x f)\\<in>R \\<rbrakk> \\<Longrightarrow> (c,f x)\\<in>R\" by simp\n  lemma tag_lhs: \"\\<lbrakk> (Let x f,a)\\<in>R \\<rbrakk> \\<Longrightarrow> (f x,a)\\<in>R\" by simp\n\n  lemma tagged_fun_relD_both: \n    \"\\<lbrakk> (f,f')\\<in>A\\<rightarrow>B; (x,x')\\<in>A \\<rbrakk> \\<Longrightarrow> (Let x f,Let x' f')\\<in>B\"\n    and tagged_fun_relD_rhs: \"\\<lbrakk> (f,f')\\<in>A\\<rightarrow>B; (x,x')\\<in>A \\<rbrakk> \\<Longrightarrow> (f x,Let x' f')\\<in>B\"\n    and tagged_fun_relD_lhs: \"\\<lbrakk> (f,f')\\<in>A\\<rightarrow>B; (x,x')\\<in>A \\<rbrakk> \\<Longrightarrow> (Let x f,f' x')\\<in>B\"\n    and tagged_fun_relD_none: \"\\<lbrakk> (f,f')\\<in>A\\<rightarrow>B; (x,x')\\<in>A \\<rbrakk> \\<Longrightarrow> (f x,f' x')\\<in>B\"\n    by (simp_all add: fun_relD)\n\n\n  subsection \\<open>ML-Setup\\<close>\n\n  ML \\<open>\n    signature PARAMETRICITY = sig\n      type param_ruleT = {\n        lhs: term,\n        rhs: term,\n        R: term,\n        rhs_head: term,\n        arity: int\n      }\n    \n      val dest_param_term: term -> param_ruleT\n      val dest_param_rule: thm -> param_ruleT\n      val dest_param_goal: int -> thm -> param_ruleT\n\n      val safe_fun_relD_tac: Proof.context -> tactic'\n\n      val adjust_arity: int -> thm -> thm\n      val adjust_arity_tac: int -> Proof.context -> tactic'\n      val unlambda_tac: Proof.context -> tactic'\n      val prepare_tac: Proof.context -> tactic'\n\n      val fo_rule: thm -> thm\n\n      (*** Basic tactics ***)\n      val param_rule_tac: Proof.context -> thm -> tactic'\n      val param_rules_tac: Proof.context -> thm list -> tactic'\n      val asm_param_tac: Proof.context -> tactic'\n\n\n      (*** Nets of parametricity rules ***)\n      type param_net\n      val net_empty: param_net\n      val net_add: thm -> param_net -> param_net\n      val net_del: thm -> param_net -> param_net\n      val net_add_int: Context.generic -> thm -> param_net -> param_net\n      val net_del_int: Context.generic -> thm -> param_net -> param_net\n      val net_tac: param_net -> Proof.context -> tactic'\n    \n      (*** Default parametricity rules ***)\n      val add_dflt: thm -> Context.generic -> Context.generic\n      val add_dflt_attr: attribute\n      val del_dflt: thm -> Context.generic -> Context.generic\n      val del_dflt_attr: attribute\n      val get_dflt: Proof.context -> param_net\n\n      (** Configuration **)\n      val cfg_use_asm: bool Config.T\n      val cfg_single_step: bool Config.T\n\n      (** Setup **)\n      val setup: theory -> theory\n    end\n\n    structure Parametricity : PARAMETRICITY = struct\n      type param_ruleT = {\n        lhs: term,\n        rhs: term,\n        R: term,\n        rhs_head: term,\n        arity: int\n      }\n\n      fun dest_param_term t = \n        case \n          strip_all_body t |> Logic.strip_imp_concl |> HOLogic.dest_Trueprop\n        of \n          @{mpat \"(?lhs,?rhs):?R\"} => let \n            val (rhs_head,arity) = \n              case strip_comb rhs of\n                (c as Const _,l) => (c,length l)\n              | (c as Free _,l) => (c,length l)\n              | (c as Abs _,l) => (c,length l)\n              | _ => raise TERM (\"dest_param_term: Head\",[t])\n          in \n            { lhs = lhs, rhs = rhs, R=R, rhs_head = rhs_head, arity = arity }\n          end\n        | t => raise TERM (\"dest_param_term: Expected (_,_):_\",[t])\n\n      val dest_param_rule = dest_param_term o Thm.prop_of\n      fun dest_param_goal i st = \n        if i > Thm.nprems_of st then\n          raise THM (\"dest_param_goal\",i,[st])\n        else\n          dest_param_term (Logic.concl_of_goal (Thm.prop_of st) i)\n\n\n      fun safe_fun_relD_tac ctxt = let\n        fun t a b = fo_resolve_tac [a] ctxt THEN' resolve_tac ctxt [b]\n      in\n        DETERM o (\n          t @{thm tag_both} @{thm tagged_fun_relD_both} ORELSE'\n          t @{thm tag_rhs} @{thm tagged_fun_relD_rhs} ORELSE'\n          t @{thm tag_lhs} @{thm tagged_fun_relD_lhs} ORELSE'\n          resolve_tac ctxt @{thms tagged_fun_relD_none}\n        )\n      end\n\n      fun adjust_arity i thm = \n        if i = 0 then thm \n        else if i<0 then funpow (~i) (fn thm => thm RS @{thm fun_relI}) thm\n        else funpow i (fn thm => thm RS @{thm fun_relD}) thm\n\n      fun NTIMES k tac = \n        if k <= 0 then K all_tac \n        else tac THEN' NTIMES (k-1) tac\n\n      fun adjust_arity_tac n ctxt i st = \n        (if n = 0 then K all_tac\n        else if n>0 then NTIMES n (DETERM o resolve_tac ctxt @{thms fun_relI})\n        else NTIMES (~n) (safe_fun_relD_tac ctxt)) i st\n\n      fun unlambda_tac ctxt i st = \n        case try (dest_param_goal i) st of\n          NONE => Seq.empty\n        | SOME g => let\n            val n = Term.strip_abs (#rhs_head g) |> #1 |> length\n          in NTIMES n (resolve_tac ctxt @{thms fun_relI}) i st end\n\n      fun prepare_tac ctxt = \n        Subgoal.FOCUS (K (PRIMITIVE (Drule.eta_contraction_rule))) ctxt\n        THEN' unlambda_tac ctxt\n\n\n      fun could_param_rl rl i st = \n        if i > Thm.nprems_of st then NONE\n        else (\n          case (try (dest_param_goal i) st, try dest_param_term rl) of\n            (SOME g, SOME r) =>\n              if Term.could_unify (#rhs_head g, #rhs_head r) then\n                SOME (#arity r - #arity g)\n              else NONE\n          | _ => NONE\n        )\n\n      fun param_rule_tac_aux ctxt rl i st = \n        case could_param_rl (Thm.prop_of rl) i st of\n          SOME adj => (adjust_arity_tac adj ctxt THEN' resolve_tac ctxt [rl]) i st\n        | _ => Seq.empty\n\n      fun param_rule_tac ctxt rl = \n        prepare_tac ctxt THEN' param_rule_tac_aux ctxt rl\n\n      fun param_rules_tac ctxt rls = \n        prepare_tac ctxt THEN' FIRST' (map (param_rule_tac_aux ctxt) rls)\n\n      fun asm_param_tac_aux ctxt i st = \n        if i > Thm.nprems_of st then Seq.empty\n        else let\n          val prems = Logic.prems_of_goal (Thm.prop_of st) i |> tag_list 1\n          \n          fun tac (n,t) i st = case could_param_rl t i st of\n            SOME adj => (adjust_arity_tac adj ctxt THEN' rprem_tac n ctxt) i st\n          | NONE => Seq.empty\n        in\n          FIRST' (map tac prems) i st\n        end\n\n      fun asm_param_tac ctxt = prepare_tac ctxt THEN' asm_param_tac_aux ctxt\n    \n      type param_net = (param_ruleT * thm) Item_Net.T\n\n      local\n        val param_get_key = single o #rhs_head o #1\n      in \n        val net_empty = Item_Net.init (Thm.eq_thm o apply2 #2) param_get_key\n      end\n\n      fun wrap_pr_op f context thm = case try (`dest_param_rule) thm of\n        NONE => \n          let \n            val msg = \"Ignoring invalid parametricity theorem: \"\n              ^ Thm.string_of_thm (Context.proof_of context) thm\n            val _ = warning msg\n          in I end\n      | SOME p => f p\n    \n      val net_add_int = wrap_pr_op Item_Net.update \n      val net_del_int = wrap_pr_op Item_Net.remove\n\n      val net_add = Item_Net.update o `dest_param_rule\n      val net_del = Item_Net.remove o `dest_param_rule\n\n      fun net_tac_aux net ctxt i st = \n        if i > Thm.nprems_of st then \n          Seq.empty \n        else\n          let\n            val g = dest_param_goal i st\n            val rls = Item_Net.retrieve net (#rhs_head g)\n        \n            fun tac (r,thm) = \n              adjust_arity_tac (#arity r - #arity g) ctxt \n              THEN' DETERM o resolve_tac ctxt [thm]\n          in \n            FIRST' (map tac rls) i st\n          end\n\n      fun net_tac net ctxt = prepare_tac ctxt THEN' net_tac_aux net ctxt\n\n      structure dflt_rules = Generic_Data (\n        type T = param_net\n        val empty = net_empty\n        val extend = I\n        val merge = Item_Net.merge\n      )\n        \n      fun add_dflt thm context = dflt_rules.map (net_add_int context thm) context\n      fun del_dflt thm context = dflt_rules.map (net_del_int context thm) context\n      val add_dflt_attr = Thm.declaration_attribute add_dflt\n      val del_dflt_attr = Thm.declaration_attribute del_dflt\n\n      val get_dflt = dflt_rules.get o Context.Proof\n\n      val cfg_use_asm = \n        Attrib.setup_config_bool @{binding param_use_asm} (K true)\n      val cfg_single_step = \n        Attrib.setup_config_bool @{binding param_single_step} (K false)\n\n      local\n        open Refine_Util\n\n        val param_modifiers =\n          [Args.add -- Args.colon >> K (Method.modifier add_dflt_attr \\<^here>),\n           Args.del -- Args.colon >> K (Method.modifier del_dflt_attr \\<^here>),\n           Args.$$$ \"only\" -- Args.colon >>\n            K {init = Context.proof_map (dflt_rules.map (K net_empty)),\n                attribute = add_dflt_attr, pos = \\<^here>}]\n\n        val param_flags = \n           parse_bool_config \"use_asm\" cfg_use_asm\n        || parse_bool_config \"single_step\" cfg_single_step\n\n      in\n          \n        val parametricity_method = \n          parse_paren_lists param_flags |-- Method.sections param_modifiers >> \n          (fn _ => fn ctxt => \n            let\n              val net2 = get_dflt ctxt\n              val asm_tac = \n                if Config.get ctxt cfg_use_asm then \n                  asm_param_tac ctxt\n                else K no_tac\n   \n              val RPT = \n                if Config.get ctxt cfg_single_step then I\n                else REPEAT_ALL_NEW_FWD\n  \n            in\n              SIMPLE_METHOD' (\n                RPT (\n                  (assume_tac ctxt \n                    ORELSE' net_tac net2 ctxt\n                    ORELSE' asm_tac)\n                ) \n              )\n            end\n          )\n      end\n\n      fun fo_rule thm = case Thm.concl_of thm of\n            @{mpat \"Trueprop ((_,_)\\<in>_\\<rightarrow>_)\"} => fo_rule (thm RS @{thm fun_relD})\n          | _ => thm \n          \n      val param_fo_attr = Scan.succeed (Thm.rule_attribute [] (K fo_rule))\n\n      val setup = I\n        #> Attrib.setup @{binding param} \n            (Attrib.add_del add_dflt_attr del_dflt_attr)\n            \"declaration of parametricity theorem\"\n        #> Global_Theory.add_thms_dynamic (@{binding param}, \n             map #2 o Item_Net.content o dflt_rules.get)\n        #> Method.setup @{binding parametricity} parametricity_method \n             \"Parametricity solver\"\n        #> Attrib.setup @{binding param_fo} param_fo_attr \n             \"Parametricity: Rule in first-order form\"\n\n    end\n\\<close>\n\n  setup Parametricity.setup\n\n\n\n  subsection \\<open>Convenience Tools\\<close>\n\n  ML \\<open>\n    (* Prefix p_ or wrong type supresses generation of relAPP *)\n  \n    fun cnv_relAPP t = let\n      fun consider (Var ((name,_),T)) =\n        if String.isPrefix \"p_\" name then false   \n        else (\n          case T of\n            Type(@{type_name set},[Type(@{type_name prod},_)]) => true\n          | _ => false)\n      | consider _ = true\n  \n      fun strip_rcomb u : term * term list =\n        let \n          fun stripc (x as (f$t, ts)) = \n            if consider t then stripc (f, t::ts) else x\n          | stripc  x =  x\n        in  stripc(u,[])  end;\n  \n      val (f,a) = strip_rcomb t\n    in \n      Relators.list_relAPP a f\n    end\n  \n    fun to_relAPP_conv ctxt = Refine_Util.f_tac_conv ctxt \n      cnv_relAPP \n      (ALLGOALS (simp_tac \n        (put_simpset HOL_basic_ss ctxt addsimps @{thms relAPP_def})))\n  \n  \n    val to_relAPP_attr = Thm.rule_attribute [] (fn context => let\n      val ctxt = Context.proof_of context\n    in\n      Conv.fconv_rule (Conv.arg1_conv (to_relAPP_conv ctxt))\n    end)\n\\<close>\n  \n  attribute_setup to_relAPP = \\<open>Scan.succeed (to_relAPP_attr)\\<close> \n    \"Convert relator definition to prefix-form\"\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Automatic_Refinement/Parametricity/Param_Tool.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.339899834098418}}
{"text": "(* A particular case of the second calculus, with policy constant on types: *)\ntheory Mcalc2C\nimports Mcalc2\nbegin\n\nsubsection\\<open>Constant policy on types\\<close>\n\ntext\\<open>Currently our soundness proof only covers the case of the calculus\nhaving different extension policies for different predicates, but not\nfor differnt types versus the same predicate. This is sufficient for our purpose\nof proving soundness of the guard encodings.\\<close>\n\nlocale ProblemIkPolMcalc2C =\nProblemIkPolMcalc2 wtFsym wtPsym arOf resOf parOf \\<Phi> infTp pol grdOf\nfor wtFsym :: \"'fsym \\<Rightarrow> bool\" and wtPsym :: \"'psym \\<Rightarrow> bool\"\nand arOf :: \"'fsym \\<Rightarrow> 'tp list\"\nand resOf and parOf and \\<Phi> and infTp and pol and grdOf\n+ assumes pol_ct: \"pol \\<sigma>1 P = pol \\<sigma>2 P\"\n\ncontext ProblemIkPolMcalc2C begin\n\ndefinition \"polC \\<equiv> pol any\"\n\nlemma pol_polC: \"pol \\<sigma> P = polC P\"\nunfolding polC_def using pol_ct by auto\n\nlemma nv2L_simps[simp]:\n\"nv2L (Pos (Pr p Tl)) = (case polC p of Fext \\<Rightarrow> \\<Union> (set (map nv2T Tl)) |_ \\<Rightarrow> {})\"\n\"nv2L (Neg (Pr p Tl)) = (case polC p of Text \\<Rightarrow> \\<Union> (set (map nv2T Tl)) |_ \\<Rightarrow> {})\"\nby (auto split: epol.splits simp: pol_polC)\n\ndeclare nv2L.simps(3,4)[simp del]\n\nlemma isGuard_simps[simp]:\n\"isGuard x (Pos (Pr p Tl)) \\<longleftrightarrow> x \\<in> \\<Union> (set (map nv2T Tl)) \\<and> polC p = Text\"\n\"isGuard x (Neg (Pr p Tl)) \\<longleftrightarrow> x \\<in> \\<Union> (set (map nv2T Tl)) \\<and> polC p = Fext\"\nby (auto simp: pol_polC)\n\ndeclare isGuard.simps(3,4)[simp del]\n\n\nend (* context  ProblemIkPolMcalc2 *)\n\n\nlocale ModelIkPolMcalc2C =\nModelIk wtFsym wtPsym arOf resOf parOf \\<Phi> infTp intT intF intP +\nProblemIkPolMcalc2C wtFsym wtPsym arOf resOf parOf \\<Phi> infTp pol grdOf\nfor wtFsym :: \"'fsym \\<Rightarrow> bool\" and wtPsym :: \"'psym \\<Rightarrow> bool\"\nand arOf :: \"'fsym \\<Rightarrow> 'tp list\"\nand resOf and parOf and \\<Phi> and infTp pol and grdOf and intT and intF and intP\n\n\nsubsection\\<open>Extension of a structure to an infinte structure\nby adding indistinguishable elements\\<close>\n\ncontext ModelIkPolMcalc2C begin\n\n(* The projection from univ to a structure: *)\ndefinition proj where \"proj \\<sigma> a \\<equiv> if intT \\<sigma> a then a else pickT \\<sigma>\"\n\nlemma intT_proj[simp]: \"intT \\<sigma> (proj \\<sigma> a)\"\nunfolding proj_def using pickT by auto\n\nlemma proj_id[simp]: \"intT \\<sigma> a \\<Longrightarrow> proj \\<sigma> a = a\"\nunfolding proj_def by auto\n\nlemma map_proj_id[simp]:\nassumes \"list_all2 intT \\<sigma>l al\"\nshows \"map2 proj \\<sigma>l al = al\"\napply(rule nth_equalityI)\nusing assms unfolding list_all2_length by auto\n\nlemma surj_proj:\nassumes \"intT \\<sigma> a\"   shows \"\\<exists> b. proj \\<sigma> b = a\"\nusing assms by (intro exI[of _ a]) simp\n\ndefinition \"I_intT \\<sigma> (a::univ) \\<equiv> infTp \\<sigma> \\<longrightarrow> intT \\<sigma> a\"\ndefinition \"I_intF f al \\<equiv> intF f (map2 proj (arOf f) al)\"\ndefinition\n\"I_intP p al \\<equiv>\n case polC p of\n   Cext \\<Rightarrow> intP p (map2 proj (parOf p) al)\n  |Text \\<Rightarrow> if list_all2 intT (parOf p) al then intP p al else True\n  |Fext \\<Rightarrow> if list_all2 intT (parOf p) al then intP p al else False\"\n\nlemma not_infTp_I_intT[simp]: \"\\<not> infTp \\<sigma> \\<Longrightarrow> I_intT \\<sigma> a\"\nunfolding I_intT_def by simp\n\nlemma infTp_I_intT[simp]: \"infTp \\<sigma> \\<Longrightarrow> I_intT \\<sigma> a = intT \\<sigma> a\"\nunfolding I_intT_def by simp\n\nlemma NE_I_intT: \"NE (I_intT \\<sigma>)\"\nusing NE_intT by (cases \"infTp \\<sigma>\", auto)\n\nlemma I_intP_Cext[simp]:\n\"polC p = Cext \\<Longrightarrow> I_intP p al = intP p (map2 proj (parOf p) al)\"\nunfolding I_intP_def by simp\n\nlemma I_intP_Text_imp[simp]:\nassumes \"polC p = Text\" and \"intP p al\"\nshows \"I_intP p al\"\nusing assms unfolding I_intP_def by auto\n\nlemma I_intP_Fext_imp[simp]:\nassumes \"polC p = Fext\" and \"\\<not> intP p al\"\nshows \"\\<not> I_intP p al\"\nusing assms unfolding I_intP_def by (cases \"list_all2 intT (parOf p) al\", auto)\n\nlemma I_intP_intT[simp]:\nassumes \"list_all2 intT (parOf p) al\"\nshows \"I_intP p al = intP p al\"\nusing assms unfolding I_intP_def by (cases \"polC p\") auto\n\nlemma I_intP_Text_not_intT[simp]:\nassumes \"polC p = Text\" and \"\\<not> list_all2 intT (parOf p) al\"\nshows \"I_intP p al\"\nusing assms unfolding I_intP_def by auto\n\nlemma I_intP_Fext_not_intT[simp]:\nassumes \"polC p = Fext\" and \"\\<not> list_all2 intT (parOf p) al\"\nshows \"\\<not> I_intP p al\"\nusing assms unfolding I_intP_def by auto\n\nlemma I_intF:\nassumes f: \"wtFsym f\" and al: \"list_all2 I_intT (arOf f) al\"\nshows \"I_intT (resOf f) (I_intF f al)\"\nunfolding I_intT_def I_intF_def apply safe apply(rule intF[OF f])\nusing al unfolding list_all2_length by auto\n\nlemma Tstruct_I_intT: \"Tstruct I_intT\"\nby standard (rule NE_I_intT)\n\nlemma inf_I_intT: \"infinite {a. I_intT \\<sigma> a}\"\nby (cases \"infTp \\<sigma>\", auto)\n\nlemma InfStruct: \"IInfStruct I_intT I_intF I_intP\"\napply standard using NE_I_intT I_intF Tstruct_I_intT inf_I_intT by auto\n\nend (* context ModelIkPolMcalc2C *)\n\nsublocale ModelIkPolMcalc2C < InfStruct where\nintT = I_intT and intF = I_intF and intP = I_intP\nusing InfStruct .\n\nsubsection\\<open>The soundness of the calculus\\<close>\n\n(* In what follows, ``Ik\" stands for the original\n(augmented with infiniteness-knowledge)\nand ``I\" for the infinite structure constructed from it\nthrough the above sublocale statement. *)\n\ncontext ModelIkPolMcalc2C begin\n(* The environment translation along the projection: *)\ndefinition \"transE \\<xi> \\<equiv> \\<lambda> x. proj (tpOfV x) (\\<xi> x)\"\n\n\n\nlemma wtE_transE[simp]: \"I.wtE \\<xi> \\<Longrightarrow> Ik.wtE (transE \\<xi>)\"\nunfolding Ik.wtE_def I.wtE_def transE_def by auto\n\nabbreviation \"Ik_intT \\<equiv> intT\"\nabbreviation \"Ik_intF \\<equiv> intF\"\nabbreviation \"Ik_intP \\<equiv> intP\"\n\nlemma Ik_intT_int:\nassumes wt: \"Ik.wt T\" and \\<xi>: \"I.wtE \\<xi>\"\nand nv2T: \"infTp (Ik.tpOf T) \\<or> (\\<forall> x \\<in> nv2T T. tpOfV x \\<noteq> Ik.tpOf T)\"\nshows \"Ik_intT (Ik.tpOf T) (I.int \\<xi> T)\"\nproof(cases \"\\<exists> x. T = Var x\")\n  case True then obtain x where T: \"T = Var x\" by auto\n  show ?thesis proof(cases \"infTp (tpOf T)\")\n    case True thus ?thesis using T using wtE_transE[OF \\<xi>]\n    by (metis I.wt_int I_intT_def \\<xi> wt)\n  next\n    case False hence \"\\<forall> x \\<in> nv2T T. tpOfV x \\<noteq> tpOf T\" using nv2T by auto\n    hence \"Ik.full (tpOf T)\" using T by (cases T, simp_all)\n    thus ?thesis unfolding Ik.full_def by simp\n  qed\nnext\n  case False hence nonVar: \"\\<not> (\\<exists> x. T = Var x)\" by (cases T, auto)\n  thus ?thesis using nonVar wt apply(induct T, force)\n  unfolding I_intF_def tpOf.simps int.simps\n  apply(rule Ik.intF, simp) apply(rule listAll2_map2I) by auto\nqed\n\nlemma int_transE_proj:\n  assumes wt: \"Ik.wt T\"\n  shows \"Ik.int (transE \\<xi>) T = proj (tpOf T) (I.int \\<xi> T)\"\n  using wt proof (induct T)\n  case (Fn f Tl)\n  have 0: \"Ik_intT (resOf f) (I_intF f (map (int \\<xi>) Tl))\" (is \"Ik_intT ?\\<sigma> ?a\")\n    unfolding I_intF_def apply(rule Ik.intF)\n    using Fn unfolding list_all2_length list_all_iff by auto\n  have 1: \"proj ?\\<sigma> ?a = ?a\" using proj_id[OF 0] .\n  show ?case\n    using [[unfold_abs_def = false]]\n    unfolding Ik.int.simps int.simps tpOf.simps 1\n    unfolding I_intF_def apply(rule arg_cong[of _ _ \"intF f\"])\n  proof (rule nth_equalityI)\n    have l[simp]: \"length (arOf f) = length Tl\" using Fn by simp\n    fix i assume \"i < length (map (Ik.int (transE \\<xi>)) Tl)\"\n    hence i[simp]: \"i < length Tl\" by simp\n    have 0: \"arOf f ! i = tpOf (Tl ! i)\" using Fn by simp\n    have [simp]: \"Ik.int (transE \\<xi>) (Tl ! i) = proj (arOf f ! i) (I.int \\<xi> (Tl ! i))\"\n      unfolding 0 using Fn by (auto simp: list_all_length transE_def)\n    show \"map (Ik.int (transE \\<xi>)) Tl ! i =\n          map2 proj (arOf f) (map (I.int \\<xi>) Tl) ! i\"\n      using Fn unfolding list_all_length by simp\n  qed(insert Fn, simp)\nqed simp\n\nlemma int_transE_nv2T:\nassumes wt: \"Ik.wt T\" and \\<xi>: \"I.wtE \\<xi>\"\nand nv2T: \"infTp (Ik.tpOf T) \\<or> (\\<forall> x \\<in> nv2T T. tpOfV x \\<noteq> Ik.tpOf T)\"\nshows \"Ik.int (transE \\<xi>) T = I.int \\<xi> T\"\nunfolding int_transE_proj[OF wt] apply(rule proj_id)\nusing Ik_intT_int[OF wt \\<xi> nv2T] .\n\nlemma isGuard_not_satL_intT:\nassumes wtL: \"Ik.wtL l\"\nand (* crucial hypothesis--the essence of guarding:*) ns: \"\\<not> I.satL \\<xi> l\"\nand g: \"isGuard x l\" and \\<xi>: \"I.wtE \\<xi>\"\nshows \"Ik_intT (tpOfV x) (\\<xi> x)\" (is \"Ik_intT ?\\<sigma> (\\<xi> x)\")\n(* \"proj \\<sigma> (\\<xi> \\<sigma> x) = \\<xi> \\<sigma> x\" *)\n(* \"Ik.int (transE \\<xi>) (Var \\<sigma> x) = I.int \\<xi> (Var \\<sigma> x)\" *)\nproof(cases l)\n  case (Pos at)  show ?thesis proof(cases at)\n    case (Pr p Tl)\n    then obtain T where Tin: \"T \\<in> set Tl\" and x: \"x \\<in> nv2T T\" and pol: \"polC p = Text\"\n    using g unfolding Pos Pr by auto\n    hence T: \"T = Var x\" by (simp add: in_nv2T)\n    obtain i where i: \"i < length Tl\" and Ti: \"T = Tl!i\" using Tin\n    by (metis in_set_conv_nth)\n    hence 0 : \"wt T\" \"parOf p ! i = ?\\<sigma>\" using wtL unfolding Pos Pr T\n    apply (simp_all add: list_all_iff) by (metis T x in_nv2T tpOf.simps)\n    have \"list_all2 Ik_intT (parOf p) (map (I.int \\<xi>) Tl)\" (is ?phi)\n    using ns unfolding Pos Pr using pol by (cases ?phi, auto)\n    hence \"Ik_intT ?\\<sigma> (I.int \\<xi> T)\"\n    using ns 0 i Ti unfolding Pos Pr by (auto simp add: list_all2_length nth_map)\n    thus ?thesis unfolding T by simp\n  qed(insert g, unfold Pos, simp)\nnext\n  case (Neg at)  show ?thesis proof(cases at)\n    case (Eq T1 T2)\n    hence 0: \"T1 = Var x \\<or> T2 = Var x\" using g unfolding Neg by auto\n    hence wt1: \"Ik.wt T1\" \"Ik.tpOf T1 = tpOfV x\"\n    and wt2: \"Ik.wt T2\" \"Ik.tpOf T2 = tpOfV x\"\n    using wtL unfolding Neg Eq by auto\n    have eq: \"I.int \\<xi> T1 = I.int \\<xi> T2\" using ns unfolding Neg Eq by simp\n    show ?thesis proof(cases \"T1 = Var x\")\n      case True note T1 = True obtain f Tl where \"T2 = Fn f Tl\"\n      using g T1 Eq unfolding Neg by auto\n      hence \"\\<And> \\<sigma>. infTp \\<sigma> \\<or> (\\<forall> x \\<in> nv2T T2. tpOfV x \\<noteq> \\<sigma>)\" by auto\n      hence 1: \"I.int \\<xi> T2 = Ik.int (transE \\<xi>) T2\" using int_transE_nv2T wt2 \\<xi> by auto\n      have \"Ik_intT ?\\<sigma> (I.int \\<xi> T1)\" unfolding eq 1 using wt2 \\<xi> Ik.wt_int by force\n      thus ?thesis unfolding T1 by simp\n    next\n      case False then obtain f Tl where T2: \"T2 = Var x\" and \"T1 = Fn f Tl\"\n      using Eq Neg g by auto\n      hence \"\\<And> \\<sigma>. infTp \\<sigma> \\<or> (\\<forall> x \\<in> nv2T T1. tpOfV x \\<noteq> \\<sigma>)\" by simp\n      hence 1: \"I.int \\<xi> T1 = Ik.int (transE \\<xi>) T1\" using int_transE_nv2T wt1 \\<xi> by auto\n      have \"Ik_intT ?\\<sigma> (I.int \\<xi> T2)\" unfolding eq[symmetric] 1\n      using wt1 \\<xi> Ik.wt_int by force\n      thus ?thesis unfolding T2 by simp\n    qed\n  next\n    case (Pr p Tl)\n    then obtain T where Tin: \"T \\<in> set Tl\" and x: \"x \\<in> nv2T T\" and pol: \"polC p = Fext\"\n    using g unfolding Neg Pr by auto\n    hence T: \"T = Var x\" by (simp add: in_nv2T)\n    obtain i where i: \"i < length Tl\" and Ti: \"T = Tl!i\" using Tin\n    by (metis in_set_conv_nth)\n    hence 0 : \"wt T\" \"parOf p ! i = ?\\<sigma>\" using wtL unfolding Neg Pr T\n    apply (simp_all add: list_all_iff) by (metis T x in_nv2T tpOf.simps)\n    have \"list_all2 Ik_intT (parOf p) (map (I.int \\<xi>) Tl)\" (is ?phi)\n    using ns unfolding Neg Pr using pol by (cases ?phi, auto)\n    hence \"Ik_intT ?\\<sigma> (I.int \\<xi> T)\"\n    using ns 0 i Ti unfolding Neg Pr by (auto simp add: list_all2_length nth_map)\n    thus ?thesis unfolding T by simp\n  qed\nqed\n\nlemma int_transE[simp]:\nassumes wt: \"Ik.wt T\" and \\<xi>: \"I.wtE \\<xi>\" and\nnv2T: \"\\<And> x. \\<lbrakk>\\<not> infTp (tpOfV x); x \\<in> nv2T T\\<rbrakk> \\<Longrightarrow>\n           \\<exists> l. Ik.wtL l \\<and> \\<not> I.satL \\<xi> l \\<and> isGuard x l\"\nshows \"Ik.int (transE \\<xi>) T = I.int \\<xi> T\"\nproof(cases \"infTp (Ik.tpOf T) \\<or> (\\<forall> x \\<in> nv2T T. tpOfV x \\<noteq> Ik.tpOf T)\")\n  case True\n  thus ?thesis using int_transE_nv2T[OF wt \\<xi>] by auto\nnext\n  define \\<sigma> where \"\\<sigma> = Ik.tpOf T\"\n  case False then obtain x where i: \"\\<not> infTp \\<sigma>\" and x: \"x \\<in> nv2T T\"\n  unfolding \\<sigma>_def by auto\n  hence T: \"T = Var x\" by (simp add: in_nv2T)\n  hence \\<sigma>: \"\\<sigma> = tpOfV x\" unfolding \\<sigma>_def by simp\n  obtain l where 0: \"Ik.wtL l\" \"\\<not> I.satL \\<xi> l\" \"isGuard x l\"\n  using nv2T[OF i[unfolded \\<sigma>] x] by auto\n  show ?thesis unfolding T using isGuard_not_satL_intT[OF 0 \\<xi>] by simp\nqed\n\nlemma intT_int_transE[simp]:\nassumes wt: \"Ik.wt T\" and \\<xi>: \"I.wtE \\<xi>\" and\nnv2T: \"\\<And> x. \\<lbrakk>\\<not> infTp (tpOfV x); x \\<in> nv2T T\\<rbrakk> \\<Longrightarrow>\n           \\<exists> l. Ik.wtL l \\<and> \\<not> I.satL \\<xi> l \\<and> isGuard x l\"\nshows \"Ik_intT (Ik.tpOf T) (I.int \\<xi> T)\"\nproof-\n  have 0: \"I.int \\<xi> T = Ik.int (transE \\<xi>) T\" using int_transE[OF assms] by simp\n  show ?thesis unfolding 0 using Ik.wt_int[OF wtE_transE[OF \\<xi>] wt] .\nqed\n\nlemma map_int_transE_nv2T[simp]:\nassumes wt: \"list_all Ik.wt Tl\" and \\<xi>: \"I.wtE \\<xi>\" and\nnv2T: \"\\<And> x. \\<lbrakk>\\<not> infTp (tpOfV x); \\<exists>T\\<in>set Tl. x \\<in> nv2T T\\<rbrakk> \\<Longrightarrow>\n           \\<exists> l. Ik.wtL l \\<and> \\<not> I.satL \\<xi> l \\<and> isGuard x l\"\nshows \"map (Ik.int (transE \\<xi>)) Tl = map (I.int \\<xi>) Tl\"\napply(rule nth_equalityI) using assms by (force simp: list_all_iff intro: int_transE)+\n\nlemma list_all2_intT_int_transE_nv2T[simp]:\nassumes wt: \"list_all Ik.wt Tl\" and \\<xi>: \"I.wtE \\<xi>\" and\nnv2T: \"\\<And> x. \\<lbrakk>\\<not> infTp (tpOfV x); \\<exists>T\\<in>set Tl. x \\<in> nv2T T\\<rbrakk> \\<Longrightarrow>\n           \\<exists> l. Ik.wtL l \\<and> \\<not> I.satL \\<xi> l \\<and> isGuard x l\"\nshows \"list_all2 Ik_intT (map Ik.tpOf Tl) (map (I.int \\<xi>) Tl)\"\nunfolding list_all2_length using assms\nunfolding list_all_iff apply simp_all by (metis intT_int_transE nth_mem)\n\nlemma map_proj_transE[simp]:\nassumes wt: \"list_all wt Tl\"\nshows \"map (Ik.int (transE \\<xi>)) Tl =\n       map2 proj (map tpOf Tl) (map (I.int \\<xi>) Tl)\"\napply(rule nth_equalityI) using assms\nusing int_transE_proj unfolding list_all_length by auto\n\nlemma satL_transE[simp]:\nassumes wtL: \"Ik.wtL l\" and \\<xi>: \"I.wtE \\<xi>\" and\nnv2T:  \"\\<And> x. \\<lbrakk>\\<not> infTp (tpOfV x); x \\<in> nv2L l\\<rbrakk> \\<Longrightarrow>\n             \\<exists> l'. Ik.wtL l' \\<and> \\<not> I.satL \\<xi> l' \\<and> isGuard x l'\"\nand \"Ik.satL (transE \\<xi>) l\"\nshows \"I.satL \\<xi> l\"\nproof(cases l)\n  case (Pos at) show ?thesis proof (cases at)\n    case (Pr p Tl) show ?thesis using assms unfolding Pos Pr\n    apply(cases \"polC p\")\n      apply force\n      apply(cases \"list_all2 intT (map Ik.tpOf Tl) (map (I.int \\<xi>) Tl)\", force, force)\n      by simp\n  qed(insert assms, unfold Pos, simp)\nnext\n  case (Neg at) show ?thesis proof (cases at)\n    case (Pr p Tl) show ?thesis using assms unfolding Neg Pr\n    apply(cases \"polC p\")\n      apply force apply force\n      by (cases \"list_all2 intT (map Ik.tpOf Tl) (map (I.int \\<xi>) Tl)\", force, force)\n  qed(insert assms int_transE_proj, unfold Neg, auto)\nqed\n\nlemma satPB_transE[simp]:\nassumes \\<xi>: \"I.wtE \\<xi>\"  shows \"I.satPB \\<xi> \\<Phi>\"\nunfolding I.satPB_def proof safe\n  fix c assume cin: \"c \\<in> \\<Phi>\"  let ?thesis = \"I.satC \\<xi> c\"\n  have mc: \"\\<And> \\<sigma>. \\<sigma> \\<turnstile>2 c\" using mcalc2[OF cin] .\n  have c: \"Ik.satC (transE \\<xi>) c\"\n  using sat_\\<Phi> wtE_transE[OF \\<xi>] cin unfolding Ik.satPB_def by auto\n  have wtC: \"Ik.wtC c\" using wt_\\<Phi> cin unfolding wtPB_def by auto\n  obtain l where lin: \"l \\<in> set c\" and l: \"Ik.satL (transE \\<xi>) l\"\n  using c unfolding Ik.satC_iff_set by auto\n  have wtL: \"Ik.wtL l\" using wtC unfolding wtC_def\n  by (metis (lifting) lin list_all_iff)\n  {assume \"\\<not> ?thesis\"\n   hence 0: \"\\<And> l'. l' \\<in> set c \\<Longrightarrow> \\<not> I.satL \\<xi> l'\" unfolding I.satC_iff_set by auto\n   have \"I.satL \\<xi> l\"\n   proof (rule satL_transE[OF wtL \\<xi> _ l])\n     fix x let ?\\<sigma> = \"tpOfV x\"\n     assume \\<sigma>: \"\\<not> infTp ?\\<sigma>\" and x: \"x \\<in> nv2L l\"\n     hence g: \"isGuard x (grdOf c l x)\" using mc[of ?\\<sigma>] lin unfolding mcalc2_iff by simp\n     show \"\\<exists> l'. Ik.wtL l' \\<and> \\<not> I.satL \\<xi> l' \\<and> isGuard x l'\"\n     apply(rule exI[of _ \"grdOf c l x\"]) apply safe\n     using g \\<sigma> cin lin wtL_grdOf x 0 grdOf x by auto\n   qed\n   hence False using 0 lin by auto\n   hence ?thesis by simp\n  }\n  thus ?thesis by auto\nqed\n\nlemma I_SAT: \"I.SAT \\<Phi>\"\nunfolding I.SAT_def by simp\n\nlemma InfModel: \"IInfModel I_intT I_intF I_intP\"\n  by standard (rule I_SAT)\n\nend (* context ModelIkPolMcalc2C *)\n\nsublocale ModelIkPolMcalc2C < inf?: InfModel where\nintT = I_intT and intF = I_intF and intP = I_intP\nusing InfModel .\n\ncontext ProblemIkPolMcalc2C begin\n\nabbreviation\n\"MModelIkPolMcalc2C \\<equiv> ModelIkPolMcalc2C wtFsym wtPsym arOf resOf parOf \\<Phi> infTp pol grdOf\"\n\n\n\nend (* context ProblemIkPolMcalc2 *)\n\ntext\\<open>Final theorem in sublocale form: Any problem that passes the\n  monotonicity calculus is monotonic:\\<close>\nsublocale ProblemIkPolMcalc2C < MonotProblem\nby standard (rule monot)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Sort_Encodings/Mcalc2C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3398998265238403}}
{"text": "section \\<open>Proper Iterators\\<close>\ntheory Proper_Iterator\nimports \n  SetIteratorOperations \n  Automatic_Refinement.Refine_Lib\nbegin\n  text \\<open>\n    Proper iterators provide a way to obtain polymorphic iterators even\n    inside locale contexts.\n\n    For this purpose, an iterator that converts the set to a list is fixed\n    inside the locale, and polymorphic iterators are described by folding\n    over the generated list.\n\n    In order to ensure efficiency, it is shown that folding over the generated\n    list is equivalent to directly iterating over the set, and this equivalence\n    is set up as a code preprocessing rule.\n\\<close>\n\n  subsection \\<open>Proper Iterators\\<close>\n\n  text \\<open>A proper iterator can be expressed as a fold over a list, where\n    the list does only depend on the set. In particular, it does not depend\n    on the type of the state. We express this by the following definition, \n    using two iterators with different types:\\<close>\n\n  definition proper_it \n    :: \"('x,'\\<sigma>1) set_iterator \\<Rightarrow> ('x,'\\<sigma>2) set_iterator \\<Rightarrow> bool\"\n    where \"proper_it it it' \\<equiv> (\\<exists>l. it=foldli l \\<and> it'=foldli l)\"\n\n  lemma proper_itI[intro?]:\n    fixes it :: \"('x,'\\<sigma>1) set_iterator\" \n    and it' :: \"('x,'\\<sigma>2) set_iterator\"\n    assumes \"it=foldli l \\<and> it'=foldli l\"\n    shows \"proper_it it it'\"\n    using assms unfolding proper_it_def by auto\n\n  lemma proper_itE:\n    fixes it :: \"('x,'\\<sigma>1) set_iterator\" \n    and it' :: \"('x,'\\<sigma>2) set_iterator\"\n    assumes \"proper_it it it'\"\n    obtains l where \"it=foldli l\" and \"it'=foldli l\"\n    using assms unfolding proper_it_def by auto\n\n  lemma proper_it_parE:\n    fixes it :: \"'a \\<Rightarrow> ('x,'\\<sigma>1) set_iterator\" \n    and it' :: \"'a \\<Rightarrow> ('x,'\\<sigma>2) set_iterator\"\n    assumes \"\\<forall>x. proper_it (it x) (it' x)\"\n    obtains f where \"it = (\\<lambda>x. foldli (f x))\" and \"it' = (\\<lambda>x. foldli (f x))\"\n    using assms unfolding proper_it_def\n    by metis\n\n  definition \n    proper_it'\n    where \"proper_it' it it' \\<equiv> \\<forall>s. proper_it (it s) (it' s)\"\n\n  lemma proper_it'I:\n    \"\\<lbrakk>\\<And>s. proper_it (it s) (it' s)\\<rbrakk> \\<Longrightarrow> proper_it' it it'\"\n    unfolding proper_it'_def by blast\n\n  lemma proper_it'D:\n    \"proper_it' it it' \\<Longrightarrow> proper_it (it s) (it' s)\"\n    unfolding proper_it'_def by blast\n\n\n\n\n\n  subsubsection \\<open>Properness Preservation\\<close>\n  ML \\<open>\n    structure Icf_Proper_Iterator = struct\n\n      structure icf_proper_iteratorI = Named_Thms\n        ( val name = @{binding icf_proper_iteratorI_raw}\n          val description = \"ICF (internal): Rules to show properness of iterators\" )\n\n      val get = icf_proper_iteratorI.get\n  \n      fun add_thm thm = icf_proper_iteratorI.add_thm thm\n  \n      val add = Thm.declaration_attribute add_thm\n\n      fun del_thm thm = icf_proper_iteratorI.del_thm thm\n\n      val del = Thm.declaration_attribute del_thm\n\n      val setup = I\n        #> icf_proper_iteratorI.setup\n        #> Attrib.setup @{binding icf_proper_iteratorI} \n          (Attrib.add_del add del) \n          (\"ICF: Rules to show properness of iterators\")\n        #> Global_Theory.add_thms_dynamic (@{binding icf_proper_iteratorI}, \n             get o Context.proof_of\n            )\n        \n  \n    end\n\\<close>\n  setup \\<open>Icf_Proper_Iterator.setup\\<close>\n\n  lemma proper_iterator_trigger: \n    \"proper_it it it' \\<Longrightarrow> proper_it it it'\"\n    \"proper_it' itf itf' \\<Longrightarrow> proper_it' itf itf'\" .\n\n  declaration \\<open>\n    Tagged_Solver.declare_solver @{thms proper_iterator_trigger} \n      @{binding proper_iterator} \"Proper iterator solver\"\n      (fn ctxt => REPEAT_ALL_NEW (resolve_tac ctxt (Icf_Proper_Iterator.get ctxt)))\n\\<close>\n\n  lemma pi_foldli[icf_proper_iteratorI]: \n    \"proper_it (foldli l :: ('a,'\\<sigma>) set_iterator) (foldli l)\"\n    unfolding proper_it_def \n    by auto\n\n  lemma pi_foldri[icf_proper_iteratorI]: \n    \"proper_it (foldri l :: ('a,'\\<sigma>) set_iterator) (foldri l)\"\n    unfolding proper_it_def foldri_def by auto\n\n  lemma pi'_foldli[icf_proper_iteratorI]: \n    \"proper_it' (foldli o tsl) (foldli o tsl)\"\n    apply (clarsimp simp add: proper_it'_def)\n    apply (tagged_solver)\n    done\n\n  lemma pi'_foldri[icf_proper_iteratorI]: \n    \"proper_it' (foldri o tsl) (foldri o tsl)\"\n    apply (clarsimp simp add: proper_it'_def)\n    apply (tagged_solver)\n    done\n\n  text \\<open>Iterator combinators preserve properness\\<close>\n  lemma pi_emp[icf_proper_iteratorI]: \n    \"proper_it set_iterator_emp set_iterator_emp\"\n    unfolding proper_it_def set_iterator_emp_def[abs_def]\n    by (auto intro!: ext exI[where x=\"[]\"])\n\n  lemma pi_sng[icf_proper_iteratorI]:\n    \"proper_it (set_iterator_sng x) (set_iterator_sng x)\"\n    unfolding proper_it_def set_iterator_sng_def[abs_def]\n    by (auto intro!: ext exI[where x=\"[x]\"])\n\n  lemma pi_union[icf_proper_iteratorI]:\n    assumes PA: \"proper_it it_a it_a'\"\n    assumes PB: \"proper_it it_b it_b'\"\n    shows \"proper_it (set_iterator_union it_a it_b)\n      (set_iterator_union it_a' it_b')\"\n    unfolding set_iterator_union_def\n    apply (rule proper_itE[OF PA])\n    apply (rule proper_itE[OF PB])\n    apply (rule_tac l=\"l@la\" in proper_itI)\n    apply simp\n    apply (intro conjI ext)\n    apply (simp_all add: foldli_append)\n    done\n\n  lemma pi_product[icf_proper_iteratorI]:\n    fixes it_a :: \"('a,'\\<sigma>a) set_iterator\"\n    fixes it_b :: \"'a \\<Rightarrow> ('b,'\\<sigma>a) set_iterator\"\n    assumes PA: \"proper_it it_a it_a'\"\n    and PB: \"\\<And>x. proper_it (it_b x) (it_b' x)\"\n    shows \"proper_it (set_iterator_product it_a it_b)\n      (set_iterator_product it_a' it_b')\"\n  proof -\n    from PB have PB': \"\\<forall>x. proper_it (it_b x) (it_b' x)\" ..\n    show ?thesis\n      unfolding proper_it_def\n      apply (rule proper_itE[OF PA])\n      apply (rule proper_it_parE[OF PB'])\n      apply (auto simp add: set_iterator_product_foldli_conv)\n      done\n  qed\n\n  lemma pi_image_filter[icf_proper_iteratorI]:\n    fixes it :: \"('x,'\\<sigma>1) set_iterator\" \n    and it' :: \"('x,'\\<sigma>2) set_iterator\"\n    and g :: \"'x \\<Rightarrow> 'y option\"\n    assumes P: \"proper_it it it'\"\n    shows \"proper_it (set_iterator_image_filter g it) \n      (set_iterator_image_filter g it')\"\n    unfolding proper_it_def\n    apply (rule proper_itE[OF P])\n    apply (auto simp: set_iterator_image_filter_foldli_conv)\n    done\n\n  lemma pi_filter[icf_proper_iteratorI]:\n    assumes P: \"proper_it it it'\"\n    shows \"proper_it (set_iterator_filter P it) \n      (set_iterator_filter P it')\"\n    unfolding proper_it_def\n    apply (rule proper_itE[OF P])\n    by (auto simp: set_iterator_filter_foldli_conv)\n\n  lemma pi_image[icf_proper_iteratorI]:\n    assumes P: \"proper_it it it'\"\n    shows \"proper_it (set_iterator_image g it) \n      (set_iterator_image g it')\"\n    unfolding proper_it_def\n    apply (rule proper_itE[OF P])\n    by (auto simp: set_iterator_image_foldli_conv)\n\n  lemma pi_dom[icf_proper_iteratorI]:\n    assumes P: \"proper_it it it'\"\n    shows \"proper_it (map_iterator_dom it) \n      (map_iterator_dom it')\"\n    unfolding proper_it_def\n    apply (rule proper_itE[OF P])\n    by (auto simp: map_iterator_dom_foldli_conv)\n\n  lemma set_iterator_product_eq2:\n    assumes \"\\<forall>a\\<in>set la. itb a = itb' a\"\n    shows \"set_iterator_product (foldli la) itb\n    = set_iterator_product (foldli la) itb'\"\n  proof (intro ext)\n    fix c f \\<sigma>\n    show \"set_iterator_product (foldli la) itb c f \\<sigma>\n      = set_iterator_product (foldli la) itb' c f \\<sigma>\"\n      using assms\n      unfolding set_iterator_product_def\n      apply (induct la arbitrary: \\<sigma>)\n      apply (auto)\n      done\n  qed\n\n\nsubsubsection \\<open>Optimizing Folds\\<close>\n  text \\<open>\n    Using an iterator to create a list. The optimizations will\n    match the pattern \\<open>foldli (it_to_list it s)\\<close>\n\\<close>\n  definition \"it_to_list it s \\<equiv> (it s) (\\<lambda>_. True) (\\<lambda>x l. l@[x]) []\"\n\n  lemma map_it_to_list_genord_correct:\n    assumes A: \"map_iterator_genord (it s) m (\\<lambda>(k,_) (k',_). R k k')\"\n    shows \"map_of (it_to_list it s) = m\n      \\<and> distinct (map fst (it_to_list it s))\n      \\<and> sorted_wrt R ((map fst (it_to_list it s)))\"\n    unfolding it_to_list_def\n    apply (rule map_iterator_genord_rule_insert_P[OF A, where I=\"\n      \\<lambda>it l. map_of l = m |` it \n        \\<and> distinct (map fst l) \n        \\<and> sorted_wrt R ((map fst l))\n      \"])\n    apply auto\n    apply (auto simp: restrict_map_def) []\n    apply (metis Some_eq_map_of_iff restrict_map_eq(2))\n    apply (auto simp add: sorted_wrt_append)\n    by (metis (lifting) restrict_map_eq(2) weak_map_of_SomeI)\n\n  lemma (in linorder) map_it_to_list_linord_correct:\n    assumes A: \"map_iterator_linord (it s) m\"\n    shows \"map_of (it_to_list it s) = m\n      \\<and> distinct (map fst (it_to_list it s))\n      \\<and> sorted ((map fst (it_to_list it s)))\"\n    using map_it_to_list_genord_correct[where it=it,\n      OF A[unfolded set_iterator_map_linord_def]]\n    by (simp add: sorted_sorted_wrt)\n\n  \n\n \nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/Iterator/Proper_Iterator.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3398998265238403}}
{"text": "(*  Title:      HOL/HOL.thy\n    Author:     Tobias Nipkow, Markus Wenzel, and Larry Paulson\n*)\n\nsection \\<open>The basis of Higher-Order Logic\\<close>\n\ntheory HOL\nimports Pure Tools.Code_Generator\nkeywords\n  \"try\" \"solve_direct\" \"quickcheck\" \"print_coercions\" \"print_claset\"\n    \"print_induct_rules\" :: diag and\n  \"quickcheck_params\" :: thy_decl\nabbrevs \"?<\" = \"\\<exists>\\<^sub>\\<le>\\<^sub>1\"\nbegin\n\nML_file \\<open>~~/src/Tools/misc_legacy.ML\\<close>\nML_file \\<open>~~/src/Tools/try.ML\\<close>\nML_file \\<open>~~/src/Tools/quickcheck.ML\\<close>\nML_file \\<open>~~/src/Tools/solve_direct.ML\\<close>\nML_file \\<open>~~/src/Tools/IsaPlanner/zipper.ML\\<close>\nML_file \\<open>~~/src/Tools/IsaPlanner/isand.ML\\<close>\nML_file \\<open>~~/src/Tools/IsaPlanner/rw_inst.ML\\<close>\nML_file \\<open>~~/src/Provers/hypsubst.ML\\<close>\nML_file \\<open>~~/src/Provers/splitter.ML\\<close>\nML_file \\<open>~~/src/Provers/classical.ML\\<close>\nML_file \\<open>~~/src/Provers/blast.ML\\<close>\nML_file \\<open>~~/src/Provers/clasimp.ML\\<close>\nML_file \\<open>~~/src/Tools/eqsubst.ML\\<close>\nML_file \\<open>~~/src/Provers/quantifier1.ML\\<close>\nML_file \\<open>~~/src/Tools/atomize_elim.ML\\<close>\nML_file \\<open>~~/src/Tools/cong_tac.ML\\<close>\nML_file \\<open>~~/src/Tools/intuitionistic.ML\\<close> setup \\<open>Intuitionistic.method_setup \\<^binding>\\<open>iprover\\<close>\\<close>\nML_file \\<open>~~/src/Tools/project_rule.ML\\<close>\nML_file \\<open>~~/src/Tools/subtyping.ML\\<close>\nML_file \\<open>~~/src/Tools/case_product.ML\\<close>\n\n\nML \\<open>Plugin_Name.declare_setup \\<^binding>\\<open>extraction\\<close>\\<close>\n\nML \\<open>\n  Plugin_Name.declare_setup \\<^binding>\\<open>quickcheck_random\\<close>;\n  Plugin_Name.declare_setup \\<^binding>\\<open>quickcheck_exhaustive\\<close>;\n  Plugin_Name.declare_setup \\<^binding>\\<open>quickcheck_bounded_forall\\<close>;\n  Plugin_Name.declare_setup \\<^binding>\\<open>quickcheck_full_exhaustive\\<close>;\n  Plugin_Name.declare_setup \\<^binding>\\<open>quickcheck_narrowing\\<close>;\n\\<close>\nML \\<open>\n  Plugin_Name.define_setup \\<^binding>\\<open>quickcheck\\<close>\n   [\\<^plugin>\\<open>quickcheck_exhaustive\\<close>,\n    \\<^plugin>\\<open>quickcheck_random\\<close>,\n    \\<^plugin>\\<open>quickcheck_bounded_forall\\<close>,\n    \\<^plugin>\\<open>quickcheck_full_exhaustive\\<close>,\n    \\<^plugin>\\<open>quickcheck_narrowing\\<close>]\n\\<close>\n\n\nsubsection \\<open>Primitive logic\\<close>\n\ntext \\<open>\nThe definition of the logic is based on Mike Gordon's technical report \\<^cite>\\<open>\"Gordon-TR68\"\\<close> that\ndescribes the first implementation of HOL. However, there are a number of differences.\nIn particular, we start with the definite description operator and introduce Hilbert's \\<open>\\<epsilon>\\<close> operator\nonly much later. Moreover, axiom \\<open>(P \\<longrightarrow> Q) \\<longrightarrow> (Q \\<longrightarrow> P) \\<longrightarrow> (P = Q)\\<close> is derived from the other\naxioms. The fact that this axiom is derivable was first noticed by Bruno Barras (for Mike Gordon's\nline of HOL systems) and later independently by Alexander Maletzky (for Isabelle/HOL).\n\\<close>\n\nsubsubsection \\<open>Core syntax\\<close>\n\nsetup \\<open>Axclass.class_axiomatization (\\<^binding>\\<open>type\\<close>, [])\\<close>\ndefault_sort type\nsetup \\<open>Object_Logic.add_base_sort \\<^sort>\\<open>type\\<close>\\<close>\n\nsetup \\<open>Proofterm.set_preproc (Proof_Rewrite_Rules.standard_preproc [])\\<close>\n\naxiomatization where fun_arity: \"OFCLASS('a \\<Rightarrow> 'b, type_class)\"\ninstance \"fun\" :: (type, type) type by (rule fun_arity)\n\naxiomatization where itself_arity: \"OFCLASS('a itself, type_class)\"\ninstance itself :: (type) type by (rule itself_arity)\n\ntypedecl bool\n\njudgment Trueprop :: \"bool \\<Rightarrow> prop\"  (\"(_)\" 5)\n\naxiomatization implies :: \"[bool, bool] \\<Rightarrow> bool\"  (infixr \"\\<longrightarrow>\" 25)\n  and eq :: \"['a, 'a] \\<Rightarrow> bool\"\n  and The :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a\"\n\nnotation (input)\n  eq  (infixl \"=\" 50)\nnotation (output)\n  eq  (infix \"=\" 50)\n\ntext \\<open>The input syntax for \\<open>eq\\<close> is more permissive than the output syntax\nbecause of the large amount of material that relies on infixl.\\<close>\n\nsubsubsection \\<open>Defined connectives and quantifiers\\<close>\n\ndefinition True :: bool\n  where \"True \\<equiv> ((\\<lambda>x::bool. x) = (\\<lambda>x. x))\"\n\ndefinition All :: \"('a \\<Rightarrow> bool) \\<Rightarrow> bool\"  (binder \"\\<forall>\" 10)\n  where \"All P \\<equiv> (P = (\\<lambda>x. True))\"\n\ndefinition Ex :: \"('a \\<Rightarrow> bool) \\<Rightarrow> bool\"  (binder \"\\<exists>\" 10)\n  where \"Ex P \\<equiv> \\<forall>Q. (\\<forall>x. P x \\<longrightarrow> Q) \\<longrightarrow> Q\"\n\ndefinition False :: bool\n  where \"False \\<equiv> (\\<forall>P. P)\"\n\ndefinition Not :: \"bool \\<Rightarrow> bool\"  (\"\\<not> _\" [40] 40)\n  where not_def: \"\\<not> P \\<equiv> P \\<longrightarrow> False\"\n\ndefinition conj :: \"[bool, bool] \\<Rightarrow> bool\"  (infixr \"\\<and>\" 35)\n  where and_def: \"P \\<and> Q \\<equiv> \\<forall>R. (P \\<longrightarrow> Q \\<longrightarrow> R) \\<longrightarrow> R\"\n\ndefinition disj :: \"[bool, bool] \\<Rightarrow> bool\"  (infixr \"\\<or>\" 30)\n  where or_def: \"P \\<or> Q \\<equiv> \\<forall>R. (P \\<longrightarrow> R) \\<longrightarrow> (Q \\<longrightarrow> R) \\<longrightarrow> R\"\n\ndefinition Uniq :: \"('a \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  where \"Uniq P \\<equiv> (\\<forall>x y. P x \\<longrightarrow> P y \\<longrightarrow> y = x)\"\n\ndefinition Ex1 :: \"('a \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  where \"Ex1 P \\<equiv> \\<exists>x. P x \\<and> (\\<forall>y. P y \\<longrightarrow> y = x)\"\n\n\nsubsubsection \\<open>Additional concrete syntax\\<close>\n\nsyntax (ASCII) \"_Uniq\" :: \"pttrn \\<Rightarrow> bool \\<Rightarrow> bool\"  (\"(4?< _./ _)\" [0, 10] 10)\nsyntax \"_Uniq\" :: \"pttrn \\<Rightarrow> bool \\<Rightarrow> bool\"  (\"(2\\<exists>\\<^sub>\\<le>\\<^sub>1 _./ _)\" [0, 10] 10)\ntranslations \"\\<exists>\\<^sub>\\<le>\\<^sub>1x. P\" \\<rightleftharpoons> \"CONST Uniq (\\<lambda>x. P)\"\n\nprint_translation \\<open>\n [Syntax_Trans.preserve_binder_abs_tr' \\<^const_syntax>\\<open>Uniq\\<close> \\<^syntax_const>\\<open>_Uniq\\<close>]\n\\<close> \\<comment> \\<open>to avoid eta-contraction of body\\<close>\n\n\nsyntax (ASCII)\n  \"_Ex1\" :: \"pttrn \\<Rightarrow> bool \\<Rightarrow> bool\"  (\"(3EX! _./ _)\" [0, 10] 10)\nsyntax (input)\n  \"_Ex1\" :: \"pttrn \\<Rightarrow> bool \\<Rightarrow> bool\"  (\"(3?! _./ _)\" [0, 10] 10)\nsyntax \"_Ex1\" :: \"pttrn \\<Rightarrow> bool \\<Rightarrow> bool\"  (\"(3\\<exists>!_./ _)\" [0, 10] 10)\ntranslations \"\\<exists>!x. P\" \\<rightleftharpoons> \"CONST Ex1 (\\<lambda>x. P)\"\n\nprint_translation \\<open>\n [Syntax_Trans.preserve_binder_abs_tr' \\<^const_syntax>\\<open>Ex1\\<close> \\<^syntax_const>\\<open>_Ex1\\<close>]\n\\<close> \\<comment> \\<open>to avoid eta-contraction of body\\<close>\n\n\nsyntax\n  \"_Not_Ex\" :: \"idts \\<Rightarrow> bool \\<Rightarrow> bool\"  (\"(3\\<nexists>_./ _)\" [0, 10] 10)\n  \"_Not_Ex1\" :: \"pttrn \\<Rightarrow> bool \\<Rightarrow> bool\"  (\"(3\\<nexists>!_./ _)\" [0, 10] 10)\ntranslations\n  \"\\<nexists>x. P\" \\<rightleftharpoons> \"\\<not> (\\<exists>x. P)\"\n  \"\\<nexists>!x. P\" \\<rightleftharpoons> \"\\<not> (\\<exists>!x. P)\"\n\n\nabbreviation not_equal :: \"['a, 'a] \\<Rightarrow> bool\"  (infix \"\\<noteq>\" 50)\n  where \"x \\<noteq> y \\<equiv> \\<not> (x = y)\"\n\nnotation (ASCII)\n  Not  (\"~ _\" [40] 40) and\n  conj  (infixr \"&\" 35) and\n  disj  (infixr \"|\" 30) and\n  implies  (infixr \"-->\" 25) and\n  not_equal  (infix \"~=\" 50)\n\nabbreviation (iff)\n  iff :: \"[bool, bool] \\<Rightarrow> bool\"  (infixr \"\\<longleftrightarrow>\" 25)\n  where \"A \\<longleftrightarrow> B \\<equiv> A = B\"\n\nsyntax \"_The\" :: \"[pttrn, bool] \\<Rightarrow> 'a\"  (\"(3THE _./ _)\" [0, 10] 10)\ntranslations \"THE x. P\" \\<rightleftharpoons> \"CONST The (\\<lambda>x. P)\"\nprint_translation \\<open>\n  [(\\<^const_syntax>\\<open>The\\<close>, fn _ => fn [Abs abs] =>\n      let val (x, t) = Syntax_Trans.atomic_abs_tr' abs\n      in Syntax.const \\<^syntax_const>\\<open>_The\\<close> $ x $ t end)]\n\\<close>  \\<comment> \\<open>To avoid eta-contraction of body\\<close>\n\nnonterminal letbinds and letbind\nsyntax\n  \"_bind\"       :: \"[pttrn, 'a] \\<Rightarrow> letbind\"              (\"(2_ =/ _)\" 10)\n  \"\"            :: \"letbind \\<Rightarrow> letbinds\"                 (\"_\")\n  \"_binds\"      :: \"[letbind, letbinds] \\<Rightarrow> letbinds\"     (\"_;/ _\")\n  \"_Let\"        :: \"[letbinds, 'a] \\<Rightarrow> 'a\"                (\"(let (_)/ in (_))\" [0, 10] 10)\n\nnonterminal case_syn and cases_syn\nsyntax\n  \"_case_syntax\" :: \"['a, cases_syn] \\<Rightarrow> 'b\"  (\"(case _ of/ _)\" 10)\n  \"_case1\" :: \"['a, 'b] \\<Rightarrow> case_syn\"  (\"(2_ \\<Rightarrow>/ _)\" 10)\n  \"\" :: \"case_syn \\<Rightarrow> cases_syn\"  (\"_\")\n  \"_case2\" :: \"[case_syn, cases_syn] \\<Rightarrow> cases_syn\"  (\"_/ | _\")\nsyntax (ASCII)\n  \"_case1\" :: \"['a, 'b] \\<Rightarrow> case_syn\"  (\"(2_ =>/ _)\" 10)\n\nnotation (ASCII)\n  All  (binder \"ALL \" 10) and\n  Ex  (binder \"EX \" 10)\n\nnotation (input)\n  All  (binder \"! \" 10) and\n  Ex  (binder \"? \" 10)\n\n\nsubsubsection \\<open>Axioms and basic definitions\\<close>\n\naxiomatization where\n  refl: \"t = (t::'a)\" and\n  subst: \"s = t \\<Longrightarrow> P s \\<Longrightarrow> P t\" and\n  ext: \"(\\<And>x::'a. (f x ::'b) = g x) \\<Longrightarrow> (\\<lambda>x. f x) = (\\<lambda>x. g x)\"\n    \\<comment> \\<open>Extensionality is built into the meta-logic, and this rule expresses\n         a related property.  It is an eta-expanded version of the traditional\n         rule, and similar to the ABS rule of HOL\\<close> and\n\n  the_eq_trivial: \"(THE x. x = a) = (a::'a)\"\n\naxiomatization where\n  impI: \"(P \\<Longrightarrow> Q) \\<Longrightarrow> P \\<longrightarrow> Q\" and\n  mp: \"\\<lbrakk>P \\<longrightarrow> Q; P\\<rbrakk> \\<Longrightarrow> Q\" and\n\n  True_or_False: \"(P = True) \\<or> (P = False)\"\n\ndefinition If :: \"bool \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\" (\"(if (_)/ then (_)/ else (_))\" [0, 0, 10] 10)\n  where \"If P x y \\<equiv> (THE z::'a. (P = True \\<longrightarrow> z = x) \\<and> (P = False \\<longrightarrow> z = y))\"\n\ndefinition Let :: \"'a \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'b\"\n  where \"Let s f \\<equiv> f s\"\n\ntranslations\n  \"_Let (_binds b bs) e\"  \\<rightleftharpoons> \"_Let b (_Let bs e)\"\n  \"let x = a in e\"        \\<rightleftharpoons> \"CONST Let a (\\<lambda>x. e)\"\n\naxiomatization undefined :: 'a\n\nclass default = fixes default :: 'a\n\n\nsubsection \\<open>Fundamental rules\\<close>\n\nsubsubsection \\<open>Equality\\<close>\n\nlemma sym: \"s = t \\<Longrightarrow> t = s\"\n  by (erule subst) (rule refl)\n\nlemma ssubst: \"t = s \\<Longrightarrow> P s \\<Longrightarrow> P t\"\n  by (drule sym) (erule subst)\n\nlemma trans: \"\\<lbrakk>r = s; s = t\\<rbrakk> \\<Longrightarrow> r = t\"\n  by (erule subst)\n\nlemma trans_sym [Pure.elim?]: \"r = s \\<Longrightarrow> t = s \\<Longrightarrow> r = t\"\n  by (rule trans [OF _ sym])\n\nlemma meta_eq_to_obj_eq:\n  assumes \"A \\<equiv> B\"\n  shows \"A = B\"\n  unfolding assms by (rule refl)\n\ntext \\<open>Useful with \\<open>erule\\<close> for proving equalities from known equalities.\\<close>\n     (* a = b\n        |   |\n        c = d   *)\nlemma box_equals: \"\\<lbrakk>a = b; a = c; b = d\\<rbrakk> \\<Longrightarrow> c = d\"\n  by (iprover intro: sym trans)\n\ntext \\<open>For calculational reasoning:\\<close>\n\nlemma forw_subst: \"a = b \\<Longrightarrow> P b \\<Longrightarrow> P a\"\n  by (rule ssubst)\n\nlemma back_subst: \"P a \\<Longrightarrow> a = b \\<Longrightarrow> P b\"\n  by (rule subst)\n\n\nsubsubsection \\<open>Congruence rules for application\\<close>\n\ntext \\<open>Similar to \\<open>AP_THM\\<close> in Gordon's HOL.\\<close>\nlemma fun_cong: \"(f :: 'a \\<Rightarrow> 'b) = g \\<Longrightarrow> f x = g x\"\n  by (iprover intro: refl elim: subst)\n\ntext \\<open>Similar to \\<open>AP_TERM\\<close> in Gordon's HOL and FOL's \\<open>subst_context\\<close>.\\<close>\nlemma arg_cong: \"x = y \\<Longrightarrow> f x = f y\"\n  by (iprover intro: refl elim: subst)\n\nlemma arg_cong2: \"\\<lbrakk>a = b; c = d\\<rbrakk> \\<Longrightarrow> f a c = f b d\"\n  by (iprover intro: refl elim: subst)\n\nlemma cong: \"\\<lbrakk>f = g; (x::'a) = y\\<rbrakk> \\<Longrightarrow> f x = g y\"\n  by (iprover intro: refl elim: subst)\n\nML \\<open>fun cong_tac ctxt = Cong_Tac.cong_tac ctxt @{thm cong}\\<close>\n\n\nsubsubsection \\<open>Equality of booleans -- iff\\<close>\n\nlemma iffD2: \"\\<lbrakk>P = Q; Q\\<rbrakk> \\<Longrightarrow> P\"\n  by (erule ssubst)\n\nlemma rev_iffD2: \"\\<lbrakk>Q; P = Q\\<rbrakk> \\<Longrightarrow> P\"\n  by (erule iffD2)\n\nlemma iffD1: \"Q = P \\<Longrightarrow> Q \\<Longrightarrow> P\"\n  by (drule sym) (rule iffD2)\n\nlemma rev_iffD1: \"Q \\<Longrightarrow> Q = P \\<Longrightarrow> P\"\n  by (drule sym) (rule rev_iffD2)\n\nlemma iffE:\n  assumes major: \"P = Q\"\n    and minor: \"\\<lbrakk>P \\<longrightarrow> Q; Q \\<longrightarrow> P\\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  by (iprover intro: minor impI major [THEN iffD2] major [THEN iffD1])\n\n\nsubsubsection \\<open>True (1)\\<close>\n\nlemma TrueI: True\n  unfolding True_def by (rule refl)\n\nlemma eqTrueE: \"P = True \\<Longrightarrow> P\"\n  by (erule iffD2) (rule TrueI)\n\n\nsubsubsection \\<open>Universal quantifier (1)\\<close>\n\nlemma spec: \"\\<forall>x::'a. P x \\<Longrightarrow> P x\"\n  unfolding All_def by (iprover intro: eqTrueE fun_cong)\n\nlemma allE:\n  assumes major: \"\\<forall>x. P x\" and minor: \"P x \\<Longrightarrow> R\"\n  shows R\n  by (iprover intro: minor major [THEN spec])\n\nlemma all_dupE:\n  assumes major: \"\\<forall>x. P x\" and minor: \"\\<lbrakk>P x; \\<forall>x. P x\\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  by (iprover intro: minor major major [THEN spec])\n\n\nsubsubsection \\<open>False\\<close>\n\ntext \\<open>\n  Depends upon \\<open>spec\\<close>; it is impossible to do propositional\n  logic before quantifiers!\n\\<close>\n\nlemma FalseE: \"False \\<Longrightarrow> P\"\n  unfolding False_def by (erule spec)\n\nlemma False_neq_True: \"False = True \\<Longrightarrow> P\"\n  by (erule eqTrueE [THEN FalseE])\n\n\nsubsubsection \\<open>Negation\\<close>\n\nlemma notI:\n  assumes \"P \\<Longrightarrow> False\"\n  shows \"\\<not> P\"\n  unfolding not_def by (iprover intro: impI assms)\n\nlemma False_not_True: \"False \\<noteq> True\"\n  by (iprover intro: notI elim: False_neq_True)\n\nlemma True_not_False: \"True \\<noteq> False\"\n  by (iprover intro: notI dest: sym elim: False_neq_True)\n\nlemma notE: \"\\<lbrakk>\\<not> P; P\\<rbrakk> \\<Longrightarrow> R\"\n  unfolding not_def\n  by (iprover intro: mp [THEN FalseE])\n\n\nsubsubsection \\<open>Implication\\<close>\n\nlemma impE:\n  assumes \"P \\<longrightarrow> Q\" P \"Q \\<Longrightarrow> R\"\n  shows R\n  by (iprover intro: assms mp)\n\ntext \\<open>Reduces \\<open>Q\\<close> to \\<open>P \\<longrightarrow> Q\\<close>, allowing substitution in \\<open>P\\<close>.\\<close>\nlemma rev_mp: \"\\<lbrakk>P; P \\<longrightarrow> Q\\<rbrakk> \\<Longrightarrow> Q\"\n  by (rule mp)\n\nlemma contrapos_nn:\n  assumes major: \"\\<not> Q\"\n    and minor: \"P \\<Longrightarrow> Q\"\n  shows \"\\<not> P\"\n  by (iprover intro: notI minor major [THEN notE])\n\ntext \\<open>Not used at all, but we already have the other 3 combinations.\\<close>\nlemma contrapos_pn:\n  assumes major: \"Q\"\n    and minor: \"P \\<Longrightarrow> \\<not> Q\"\n  shows \"\\<not> P\"\n  by (iprover intro: notI minor major notE)\n\nlemma not_sym: \"t \\<noteq> s \\<Longrightarrow> s \\<noteq> t\"\n  by (erule contrapos_nn) (erule sym)\n\nlemma eq_neq_eq_imp_neq: \"\\<lbrakk>x = a; a \\<noteq> b; b = y\\<rbrakk> \\<Longrightarrow> x \\<noteq> y\"\n  by (erule subst, erule ssubst, assumption)\n\n\nsubsubsection \\<open>Disjunction (1)\\<close>\n\nlemma disjE:\n  assumes major: \"P \\<or> Q\"\n    and minorP: \"P \\<Longrightarrow> R\"\n    and minorQ: \"Q \\<Longrightarrow> R\"\n  shows R\n  by (iprover intro: minorP minorQ impI\n      major [unfolded or_def, THEN spec, THEN mp, THEN mp])\n\n\nsubsubsection \\<open>Derivation of \\<open>iffI\\<close>\\<close>\n\ntext \\<open>In an intuitionistic version of HOL \\<open>iffI\\<close> needs to be an axiom.\\<close>\n\nlemma iffI:\n  assumes \"P \\<Longrightarrow> Q\" and \"Q \\<Longrightarrow> P\"\n  shows \"P = Q\"\nproof (rule disjE[OF True_or_False[of P]])\n  assume 1: \"P = True\"\n  note Q = assms(1)[OF eqTrueE[OF this]]\n  from 1 show ?thesis\n  proof (rule ssubst)\n    from True_or_False[of Q] show \"True = Q\"\n    proof (rule disjE)\n      assume \"Q = True\"\n      thus ?thesis by(rule sym)\n    next\n      assume \"Q = False\"\n      with Q have False by (rule rev_iffD1)\n      thus ?thesis by (rule FalseE)\n    qed\n  qed\nnext\n  assume 2: \"P = False\"\n  thus ?thesis\n  proof (rule ssubst)\n    from True_or_False[of Q] show \"False = Q\"\n    proof (rule disjE)\n      assume \"Q = True\"\n      from 2 assms(2)[OF eqTrueE[OF this]] have False by (rule iffD1)\n      thus ?thesis by (rule FalseE)\n    next\n      assume \"Q = False\"\n      thus ?thesis by(rule sym)\n    qed\n  qed\nqed\n\n\nsubsubsection \\<open>True (2)\\<close>\n\nlemma eqTrueI: \"P \\<Longrightarrow> P = True\"\n  by (iprover intro: iffI TrueI)\n\n\nsubsubsection \\<open>Universal quantifier (2)\\<close>\n\nlemma allI:\n  assumes \"\\<And>x::'a. P x\"\n  shows \"\\<forall>x. P x\"\n  unfolding All_def by (iprover intro: ext eqTrueI assms)\n\n\nsubsubsection \\<open>Existential quantifier\\<close>\n\nlemma exI: \"P x \\<Longrightarrow> \\<exists>x::'a. P x\"\n  unfolding Ex_def by (iprover intro: allI allE impI mp)\n\nlemma exE:\n  assumes major: \"\\<exists>x::'a. P x\"\n    and minor: \"\\<And>x. P x \\<Longrightarrow> Q\"\n  shows \"Q\"\n  by (rule major [unfolded Ex_def, THEN spec, THEN mp]) (iprover intro: impI [THEN allI] minor)\n\n\nsubsubsection \\<open>Conjunction\\<close>\n\nlemma conjI: \"\\<lbrakk>P; Q\\<rbrakk> \\<Longrightarrow> P \\<and> Q\"\n  unfolding and_def by (iprover intro: impI [THEN allI] mp)\n\nlemma conjunct1: \"\\<lbrakk>P \\<and> Q\\<rbrakk> \\<Longrightarrow> P\"\n  unfolding and_def by (iprover intro: impI dest: spec mp)\n\nlemma conjunct2: \"\\<lbrakk>P \\<and> Q\\<rbrakk> \\<Longrightarrow> Q\"\n  unfolding and_def by (iprover intro: impI dest: spec mp)\n\nlemma conjE:\n  assumes major: \"P \\<and> Q\"\n    and minor: \"\\<lbrakk>P; Q\\<rbrakk> \\<Longrightarrow> R\"\n  shows R\nproof (rule minor)\n  show P by (rule major [THEN conjunct1])\n  show Q by (rule major [THEN conjunct2])\nqed\n\nlemma context_conjI:\n  assumes P \"P \\<Longrightarrow> Q\"\n  shows \"P \\<and> Q\"\n  by (iprover intro: conjI assms)\n\n\nsubsubsection \\<open>Disjunction (2)\\<close>\n\nlemma disjI1: \"P \\<Longrightarrow> P \\<or> Q\"\n  unfolding or_def by (iprover intro: allI impI mp)\n\nlemma disjI2: \"Q \\<Longrightarrow> P \\<or> Q\"\n  unfolding or_def by (iprover intro: allI impI mp)\n\n\nsubsubsection \\<open>Classical logic\\<close>\n\nlemma classical:\n  assumes \"\\<not> P \\<Longrightarrow> P\"\n  shows P\nproof (rule True_or_False [THEN disjE])\n  show P if \"P = True\"\n    using that by (iprover intro: eqTrueE)\n  show P if \"P = False\"\n  proof (intro notI assms)\n    assume P\n    with that show False\n      by (iprover elim: subst)\n  qed\nqed\n\nlemmas ccontr = FalseE [THEN classical]\n\ntext \\<open>\\<open>notE\\<close> with premises exchanged; it discharges \\<open>\\<not> R\\<close> so that it can be used to\n  make elimination rules.\\<close>\nlemma rev_notE:\n  assumes premp: P\n    and premnot: \"\\<not> R \\<Longrightarrow> \\<not> P\"\n  shows R\n  by (iprover intro: ccontr notE [OF premnot premp])\n\n\ntext \\<open>Double negation law.\\<close>\nlemma notnotD: \"\\<not>\\<not> P \\<Longrightarrow> P\"\n  by (iprover intro: ccontr notE )\n\nlemma contrapos_pp:\n  assumes p1: Q\n    and p2: \"\\<not> P \\<Longrightarrow> \\<not> Q\"\n  shows P\n  by (iprover intro: classical p1 p2 notE)\n\n\nsubsubsection \\<open>Unique existence\\<close>\n\nlemma Uniq_I [intro?]:\n  assumes \"\\<And>x y. \\<lbrakk>P x; P y\\<rbrakk> \\<Longrightarrow> y = x\"\n  shows \"Uniq P\"\n  unfolding Uniq_def by (iprover intro: assms allI impI)\n\nlemma Uniq_D [dest?]: \"\\<lbrakk>Uniq P; P a; P b\\<rbrakk> \\<Longrightarrow> a=b\"\n  unfolding Uniq_def by (iprover dest: spec mp)\n\nlemma ex1I:\n  assumes \"P a\" \"\\<And>x. P x \\<Longrightarrow> x = a\"\n  shows \"\\<exists>!x. P x\"\n  unfolding Ex1_def by (iprover intro: assms exI conjI allI impI)\n\ntext \\<open>Sometimes easier to use: the premises have no shared variables. Safe!\\<close>\nlemma ex_ex1I:\n  assumes ex_prem: \"\\<exists>x. P x\"\n    and eq: \"\\<And>x y. \\<lbrakk>P x; P y\\<rbrakk> \\<Longrightarrow> x = y\"\n  shows \"\\<exists>!x. P x\"\n  by (iprover intro: ex_prem [THEN exE] ex1I eq)\n\nlemma ex1E:\n  assumes major: \"\\<exists>!x. P x\" and minor: \"\\<And>x. \\<lbrakk>P x; \\<forall>y. P y \\<longrightarrow> y = x\\<rbrakk> \\<Longrightarrow> R\"\n  shows R\nproof (rule major [unfolded Ex1_def, THEN exE])\n  show \"\\<And>x. P x \\<and> (\\<forall>y. P y \\<longrightarrow> y = x) \\<Longrightarrow> R\"\n    by (iprover intro: minor elim: conjE)\nqed\n\nlemma ex1_implies_ex: \"\\<exists>!x. P x \\<Longrightarrow> \\<exists>x. P x\"\n  by (iprover intro: exI elim: ex1E)\n\nsubsubsection \\<open>Classical intro rules for disjunction and existential quantifiers\\<close>\n\nlemma disjCI:\n  assumes \"\\<not> Q \\<Longrightarrow> P\"\n  shows \"P \\<or> Q\"\n  by (rule classical) (iprover intro: assms disjI1 disjI2 notI elim: notE)\n\nlemma excluded_middle: \"\\<not> P \\<or> P\"\n  by (iprover intro: disjCI)\n\ntext \\<open>\n  case distinction as a natural deduction rule.\n  Note that \\<open>\\<not> P\\<close> is the second case, not the first.\n\\<close>\nlemma case_split [case_names True False]:\n  assumes \"P \\<Longrightarrow> Q\" \"\\<not> P \\<Longrightarrow> Q\"\n  shows Q\n  using excluded_middle [of P]\n    by (iprover intro: assms elim: disjE)\n\ntext \\<open>Classical implies (\\<open>\\<longrightarrow>\\<close>) elimination.\\<close>\nlemma impCE:\n  assumes major: \"P \\<longrightarrow> Q\"\n    and minor: \"\\<not> P \\<Longrightarrow> R\" \"Q \\<Longrightarrow> R\"\n  shows R\n  using excluded_middle [of P]\n  by (iprover intro: minor major [THEN mp] elim: disjE)+\n\ntext \\<open>\n  This version of \\<open>\\<longrightarrow>\\<close> elimination works on \\<open>Q\\<close> before \\<open>P\\<close>.  It works best for\n  those cases in which \\<open>P\\<close> holds \"almost everywhere\".  Can't install as\n  default: would break old proofs.\n\\<close>\nlemma impCE':\n  assumes major: \"P \\<longrightarrow> Q\"\n    and minor: \"Q \\<Longrightarrow> R\" \"\\<not> P \\<Longrightarrow> R\"\n  shows R\n  using assms by (elim impCE)\n\n\ntext \\<open>Classical \\<open>\\<longleftrightarrow>\\<close> elimination.\\<close>\nlemma iffCE:\n  assumes major: \"P = Q\"\n    and minor: \"\\<lbrakk>P; Q\\<rbrakk> \\<Longrightarrow> R\" \"\\<lbrakk>\\<not> P; \\<not> Q\\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  by (rule major [THEN iffE]) (iprover intro: minor elim: impCE notE)\n\nlemma exCI:\n  assumes \"\\<forall>x. \\<not> P x \\<Longrightarrow> P a\"\n  shows \"\\<exists>x. P x\"\n  by (rule ccontr) (iprover intro: assms exI allI notI notE [of \"\\<exists>x. P x\"])\n\n\nsubsubsection \\<open>Intuitionistic Reasoning\\<close>\n\nlemma impE':\n  assumes 1: \"P \\<longrightarrow> Q\"\n    and 2: \"Q \\<Longrightarrow> R\"\n    and 3: \"P \\<longrightarrow> Q \\<Longrightarrow> P\"\n  shows R\nproof -\n  from 3 and 1 have P .\n  with 1 have Q by (rule impE)\n  with 2 show R .\nqed\n\nlemma allE':\n  assumes 1: \"\\<forall>x. P x\"\n    and 2: \"P x \\<Longrightarrow> \\<forall>x. P x \\<Longrightarrow> Q\"\n  shows Q\nproof -\n  from 1 have \"P x\" by (rule spec)\n  from this and 1 show Q by (rule 2)\nqed\n\nlemma notE':\n  assumes 1: \"\\<not> P\"\n    and 2: \"\\<not> P \\<Longrightarrow> P\"\n  shows R\nproof -\n  from 2 and 1 have P .\n  with 1 show R by (rule notE)\nqed\n\nlemma TrueE: \"True \\<Longrightarrow> P \\<Longrightarrow> P\" .\nlemma notFalseE: \"\\<not> False \\<Longrightarrow> P \\<Longrightarrow> P\" .\n\nlemmas [Pure.elim!] = disjE iffE FalseE conjE exE TrueE notFalseE\n  and [Pure.intro!] = iffI conjI impI TrueI notI allI refl\n  and [Pure.elim 2] = allE notE' impE'\n  and [Pure.intro] = exI disjI2 disjI1\n\nlemmas [trans] = trans\n  and [sym] = sym not_sym\n  and [Pure.elim?] = iffD1 iffD2 impE\n\n\nsubsubsection \\<open>Atomizing meta-level connectives\\<close>\n\naxiomatization where\n  eq_reflection: \"x = y \\<Longrightarrow> x \\<equiv> y\"  \\<comment> \\<open>admissible axiom\\<close>\n\nlemma atomize_all [atomize]: \"(\\<And>x. P x) \\<equiv> Trueprop (\\<forall>x. P x)\"\nproof\n  assume \"\\<And>x. P x\"\n  then show \"\\<forall>x. P x\" ..\nnext\n  assume \"\\<forall>x. P x\"\n  then show \"\\<And>x. P x\" by (rule allE)\nqed\n\nlemma atomize_imp [atomize]: \"(A \\<Longrightarrow> B) \\<equiv> Trueprop (A \\<longrightarrow> B)\"\nproof\n  assume r: \"A \\<Longrightarrow> B\"\n  show \"A \\<longrightarrow> B\" by (rule impI) (rule r)\nnext\n  assume \"A \\<longrightarrow> B\" and A\n  then show B by (rule mp)\nqed\n\nlemma atomize_not: \"(A \\<Longrightarrow> False) \\<equiv> Trueprop (\\<not> A)\"\nproof\n  assume r: \"A \\<Longrightarrow> False\"\n  show \"\\<not> A\" by (rule notI) (rule r)\nnext\n  assume \"\\<not> A\" and A\n  then show False by (rule notE)\nqed\n\nlemma atomize_eq [atomize, code]: \"(x \\<equiv> y) \\<equiv> Trueprop (x = y)\"\nproof\n  assume \"x \\<equiv> y\"\n  show \"x = y\" by (unfold \\<open>x \\<equiv> y\\<close>) (rule refl)\nnext\n  assume \"x = y\"\n  then show \"x \\<equiv> y\" by (rule eq_reflection)\nqed\n\nlemma atomize_conj [atomize]: \"(A &&& B) \\<equiv> Trueprop (A \\<and> B)\"\nproof\n  assume conj: \"A &&& B\"\n  show \"A \\<and> B\"\n  proof (rule conjI)\n    from conj show A by (rule conjunctionD1)\n    from conj show B by (rule conjunctionD2)\n  qed\nnext\n  assume conj: \"A \\<and> B\"\n  show \"A &&& B\"\n  proof -\n    from conj show A ..\n    from conj show B ..\n  qed\nqed\n\nlemmas [symmetric, rulify] = atomize_all atomize_imp\n  and [symmetric, defn] = atomize_all atomize_imp atomize_eq\n\n\nsubsubsection \\<open>Atomizing elimination rules\\<close>\n\nlemma atomize_exL[atomize_elim]: \"(\\<And>x. P x \\<Longrightarrow> Q) \\<equiv> ((\\<exists>x. P x) \\<Longrightarrow> Q)\"\n  by (rule equal_intr_rule) iprover+\n\nlemma atomize_conjL[atomize_elim]: \"(A \\<Longrightarrow> B \\<Longrightarrow> C) \\<equiv> (A \\<and> B \\<Longrightarrow> C)\"\n  by (rule equal_intr_rule) iprover+\n\nlemma atomize_disjL[atomize_elim]: \"((A \\<Longrightarrow> C) \\<Longrightarrow> (B \\<Longrightarrow> C) \\<Longrightarrow> C) \\<equiv> ((A \\<or> B \\<Longrightarrow> C) \\<Longrightarrow> C)\"\n  by (rule equal_intr_rule) iprover+\n\nlemma atomize_elimL[atomize_elim]: \"(\\<And>B. (A \\<Longrightarrow> B) \\<Longrightarrow> B) \\<equiv> Trueprop A\" ..\n\n\nsubsection \\<open>Package setup\\<close>\n\nML_file \\<open>Tools/hologic.ML\\<close>\nML_file \\<open>Tools/rewrite_hol_proof.ML\\<close>\n\nsetup \\<open>Proofterm.set_preproc (Proof_Rewrite_Rules.standard_preproc Rewrite_HOL_Proof.rews)\\<close>\n\n\nsubsubsection \\<open>Sledgehammer setup\\<close>\n\ntext \\<open>\n  Theorems blacklisted to Sledgehammer. These theorems typically produce clauses\n  that are prolific (match too many equality or membership literals) and relate to\n  seldom-used facts. Some duplicate other rules.\n\\<close>\n\nnamed_theorems no_atp \"theorems that should be filtered out by Sledgehammer\"\n\n\nsubsubsection \\<open>Classical Reasoner setup\\<close>\n\nlemma imp_elim: \"P \\<longrightarrow> Q \\<Longrightarrow> (\\<not> R \\<Longrightarrow> P) \\<Longrightarrow> (Q \\<Longrightarrow> R) \\<Longrightarrow> R\"\n  by (rule classical) iprover\n\nlemma swap: \"\\<not> P \\<Longrightarrow> (\\<not> R \\<Longrightarrow> P) \\<Longrightarrow> R\"\n  by (rule classical) iprover\n\nlemma thin_refl: \"\\<lbrakk>x = x; PROP W\\<rbrakk> \\<Longrightarrow> PROP W\" .\n\nML \\<open>\nstructure Hypsubst = Hypsubst\n(\n  val dest_eq = HOLogic.dest_eq\n  val dest_Trueprop = HOLogic.dest_Trueprop\n  val dest_imp = HOLogic.dest_imp\n  val eq_reflection = @{thm eq_reflection}\n  val rev_eq_reflection = @{thm meta_eq_to_obj_eq}\n  val imp_intr = @{thm impI}\n  val rev_mp = @{thm rev_mp}\n  val subst = @{thm subst}\n  val sym = @{thm sym}\n  val thin_refl = @{thm thin_refl};\n);\nopen Hypsubst;\n\nstructure Classical = Classical\n(\n  val imp_elim = @{thm imp_elim}\n  val not_elim = @{thm notE}\n  val swap = @{thm swap}\n  val classical = @{thm classical}\n  val sizef = Drule.size_of_thm\n  val hyp_subst_tacs = [Hypsubst.hyp_subst_tac]\n);\n\nstructure Basic_Classical: BASIC_CLASSICAL = Classical;\nopen Basic_Classical;\n\\<close>\n\nsetup \\<open>\n  (*prevent substitution on bool*)\n  let\n    fun non_bool_eq (\\<^const_name>\\<open>HOL.eq\\<close>, Type (_, [T, _])) = T <> \\<^typ>\\<open>bool\\<close>\n      | non_bool_eq _ = false;\n    fun hyp_subst_tac' ctxt =\n      SUBGOAL (fn (goal, i) =>\n        if Term.exists_Const non_bool_eq goal\n        then Hypsubst.hyp_subst_tac ctxt i\n        else no_tac);\n  in\n    Context_Rules.addSWrapper (fn ctxt => fn tac => hyp_subst_tac' ctxt ORELSE' tac)\n  end\n\\<close>\n\ndeclare iffI [intro!]\n  and notI [intro!]\n  and impI [intro!]\n  and disjCI [intro!]\n  and conjI [intro!]\n  and TrueI [intro!]\n  and refl [intro!]\n\ndeclare iffCE [elim!]\n  and FalseE [elim!]\n  and impCE [elim!]\n  and disjE [elim!]\n  and conjE [elim!]\n\ndeclare ex_ex1I [intro!]\n  and allI [intro!]\n  and exI [intro]\n\ndeclare exE [elim!]\n  allE [elim]\n\nML \\<open>val HOL_cs = claset_of \\<^context>\\<close>\n\nlemma contrapos_np: \"\\<not> Q \\<Longrightarrow> (\\<not> P \\<Longrightarrow> Q) \\<Longrightarrow> P\"\n  by (erule swap)\n\ndeclare ex_ex1I [rule del, intro! 2]\n  and ex1I [intro]\n\ndeclare ext [intro]\n\nlemmas [intro?] = ext\n  and [elim?] = ex1_implies_ex\n\ntext \\<open>Better than \\<open>ex1E\\<close> for classical reasoner: needs no quantifier duplication!\\<close>\nlemma alt_ex1E [elim!]:\n  assumes major: \"\\<exists>!x. P x\"\n    and minor: \"\\<And>x. \\<lbrakk>P x; \\<forall>y y'. P y \\<and> P y' \\<longrightarrow> y = y'\\<rbrakk> \\<Longrightarrow> R\"\n  shows R\nproof (rule ex1E [OF major minor])\n  show \"\\<forall>y y'. P y \\<and> P y' \\<longrightarrow> y = y'\" if \"P x\" and \\<section>: \"\\<forall>y. P y \\<longrightarrow> y = x\" for x\n    using \\<open>P x\\<close> \\<section> \\<section> by fast\nqed assumption\n\ntext \\<open>And again using Uniq\\<close>\nlemma alt_ex1E':\n  assumes  \"\\<exists>!x. P x\" \"\\<And>x. \\<lbrakk>P x; \\<exists>\\<^sub>\\<le>\\<^sub>1x. P x\\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  using assms unfolding Uniq_def by fast\n\nlemma ex1_iff_ex_Uniq: \"(\\<exists>!x. P x) \\<longleftrightarrow> (\\<exists>x. P x) \\<and> (\\<exists>\\<^sub>\\<le>\\<^sub>1x. P x)\"\n  unfolding Uniq_def by fast\n\n\nML \\<open>\n  structure Blast = Blast\n  (\n    structure Classical = Classical\n    val Trueprop_const = dest_Const \\<^Const>\\<open>Trueprop\\<close>\n    val equality_name = \\<^const_name>\\<open>HOL.eq\\<close>\n    val not_name = \\<^const_name>\\<open>Not\\<close>\n    val notE = @{thm notE}\n    val ccontr = @{thm ccontr}\n    val hyp_subst_tac = Hypsubst.blast_hyp_subst_tac\n  );\n  val blast_tac = Blast.blast_tac;\n\\<close>\n\n\nsubsubsection \\<open>THE: definite description operator\\<close>\n\nlemma the_equality [intro]:\n  assumes \"P a\"\n    and \"\\<And>x. P x \\<Longrightarrow> x = a\"\n  shows \"(THE x. P x) = a\"\n  by (blast intro: assms trans [OF arg_cong [where f=The] the_eq_trivial])\n\nlemma theI:\n  assumes \"P a\"\n    and \"\\<And>x. P x \\<Longrightarrow> x = a\"\n  shows \"P (THE x. P x)\"\n  by (iprover intro: assms the_equality [THEN ssubst])\n\nlemma theI': \"\\<exists>!x. P x \\<Longrightarrow> P (THE x. P x)\"\n  by (blast intro: theI)\n\ntext \\<open>Easier to apply than \\<open>theI\\<close>: only one occurrence of \\<open>P\\<close>.\\<close>\nlemma theI2:\n  assumes \"P a\" \"\\<And>x. P x \\<Longrightarrow> x = a\" \"\\<And>x. P x \\<Longrightarrow> Q x\"\n  shows \"Q (THE x. P x)\"\n  by (iprover intro: assms theI)\n\nlemma the1I2:\n  assumes \"\\<exists>!x. P x\" \"\\<And>x. P x \\<Longrightarrow> Q x\"\n  shows \"Q (THE x. P x)\"\n  by (iprover intro: assms(2) theI2[where P=P and Q=Q] ex1E[OF assms(1)] elim: allE impE)\n\nlemma the1_equality [elim?]: \"\\<lbrakk>\\<exists>!x. P x; P a\\<rbrakk> \\<Longrightarrow> (THE x. P x) = a\"\n  by blast\n\nlemma the1_equality': \"\\<lbrakk>\\<exists>\\<^sub>\\<le>\\<^sub>1x. P x; P a\\<rbrakk> \\<Longrightarrow> (THE x. P x) = a\"\n  unfolding Uniq_def by blast\n\nlemma the_sym_eq_trivial: \"(THE y. x = y) = x\"\n  by blast\n\n\nsubsubsection \\<open>Simplifier\\<close>\n\nlemma eta_contract_eq: \"(\\<lambda>s. f s) = f\" ..\n\nlemma subst_all:\n  \\<open>(\\<And>x. x = a \\<Longrightarrow> PROP P x) \\<equiv> PROP P a\\<close>\n  \\<open>(\\<And>x. a = x \\<Longrightarrow> PROP P x) \\<equiv> PROP P a\\<close>\nproof -\n  show \\<open>(\\<And>x. x = a \\<Longrightarrow> PROP P x) \\<equiv> PROP P a\\<close>\n  proof (rule equal_intr_rule)\n    assume *: \\<open>\\<And>x. x = a \\<Longrightarrow> PROP P x\\<close>\n    show \\<open>PROP P a\\<close>\n      by (rule *) (rule refl)\n  next\n    fix x\n    assume \\<open>PROP P a\\<close> and \\<open>x = a\\<close>\n    from \\<open>x = a\\<close> have \\<open>x \\<equiv> a\\<close>\n      by (rule eq_reflection)\n    with \\<open>PROP P a\\<close> show \\<open>PROP P x\\<close>\n      by simp\n  qed\n  show \\<open>(\\<And>x. a = x \\<Longrightarrow> PROP P x) \\<equiv> PROP P a\\<close>\n  proof (rule equal_intr_rule)\n    assume *: \\<open>\\<And>x. a = x \\<Longrightarrow> PROP P x\\<close>\n    show \\<open>PROP P a\\<close>\n      by (rule *) (rule refl)\n  next\n    fix x\n    assume \\<open>PROP P a\\<close> and \\<open>a = x\\<close>\n    from \\<open>a = x\\<close> have \\<open>a \\<equiv> x\\<close>\n      by (rule eq_reflection)\n    with \\<open>PROP P a\\<close> show \\<open>PROP P x\\<close>\n      by simp\n  qed\nqed\n\nlemma simp_thms:\n  shows not_not: \"(\\<not> \\<not> P) = P\"\n  and Not_eq_iff: \"((\\<not> P) = (\\<not> Q)) = (P = Q)\"\n  and\n    \"(P \\<noteq> Q) = (P = (\\<not> Q))\"\n    \"(P \\<or> \\<not>P) = True\"    \"(\\<not> P \\<or> P) = True\"\n    \"(x = x) = True\"\n  and not_True_eq_False [code]: \"(\\<not> True) = False\"\n  and not_False_eq_True [code]: \"(\\<not> False) = True\"\n  and\n    \"(\\<not> P) \\<noteq> P\"  \"P \\<noteq> (\\<not> P)\"\n    \"(True = P) = P\"\n  and eq_True: \"(P = True) = P\"\n  and \"(False = P) = (\\<not> P)\"\n  and eq_False: \"(P = False) = (\\<not> P)\"\n  and\n    \"(True \\<longrightarrow> P) = P\"  \"(False \\<longrightarrow> P) = True\"\n    \"(P \\<longrightarrow> True) = True\"  \"(P \\<longrightarrow> P) = True\"\n    \"(P \\<longrightarrow> False) = (\\<not> P)\"  \"(P \\<longrightarrow> \\<not> P) = (\\<not> P)\"\n    \"(P \\<and> True) = P\"  \"(True \\<and> P) = P\"\n    \"(P \\<and> False) = False\"  \"(False \\<and> P) = False\"\n    \"(P \\<and> P) = P\"  \"(P \\<and> (P \\<and> Q)) = (P \\<and> Q)\"\n    \"(P \\<and> \\<not> P) = False\"    \"(\\<not> P \\<and> P) = False\"\n    \"(P \\<or> True) = True\"  \"(True \\<or> P) = True\"\n    \"(P \\<or> False) = P\"  \"(False \\<or> P) = P\"\n    \"(P \\<or> P) = P\"  \"(P \\<or> (P \\<or> Q)) = (P \\<or> Q)\" and\n    \"(\\<forall>x. P) = P\"  \"(\\<exists>x. P) = P\"  \"\\<exists>x. x = t\"  \"\\<exists>x. t = x\"\n  and\n    \"\\<And>P. (\\<exists>x. x = t \\<and> P x) = P t\"\n    \"\\<And>P. (\\<exists>x. t = x \\<and> P x) = P t\"\n    \"\\<And>P. (\\<forall>x. x = t \\<longrightarrow> P x) = P t\"\n    \"\\<And>P. (\\<forall>x. t = x \\<longrightarrow> P x) = P t\"\n    \"(\\<forall>x. x \\<noteq> t) = False\"  \"(\\<forall>x. t \\<noteq> x) = False\"\n  by (blast, blast, blast, blast, blast, iprover+)\n\nlemma disj_absorb: \"A \\<or> A \\<longleftrightarrow> A\"\n  by blast\n\nlemma disj_left_absorb: \"A \\<or> (A \\<or> B) \\<longleftrightarrow> A \\<or> B\"\n  by blast\n\nlemma conj_absorb: \"A \\<and> A \\<longleftrightarrow> A\"\n  by blast\n\nlemma conj_left_absorb: \"A \\<and> (A \\<and> B) \\<longleftrightarrow> A \\<and> B\"\n  by blast\n\nlemma eq_ac:\n  shows eq_commute: \"a = b \\<longleftrightarrow> b = a\"\n    and iff_left_commute: \"(P \\<longleftrightarrow> (Q \\<longleftrightarrow> R)) \\<longleftrightarrow> (Q \\<longleftrightarrow> (P \\<longleftrightarrow> R))\"\n    and iff_assoc: \"((P \\<longleftrightarrow> Q) \\<longleftrightarrow> R) \\<longleftrightarrow> (P \\<longleftrightarrow> (Q \\<longleftrightarrow> R))\"\n  by (iprover, blast+)\n\nlemma neq_commute: \"a \\<noteq> b \\<longleftrightarrow> b \\<noteq> a\" by iprover\n\nlemma conj_comms:\n  shows conj_commute: \"P \\<and> Q \\<longleftrightarrow> Q \\<and> P\"\n    and conj_left_commute: \"P \\<and> (Q \\<and> R) \\<longleftrightarrow> Q \\<and> (P \\<and> R)\" by iprover+\nlemma conj_assoc: \"(P \\<and> Q) \\<and> R \\<longleftrightarrow> P \\<and> (Q \\<and> R)\" by iprover\n\nlemmas conj_ac = conj_commute conj_left_commute conj_assoc\n\nlemma disj_comms:\n  shows disj_commute: \"P \\<or> Q \\<longleftrightarrow> Q \\<or> P\"\n    and disj_left_commute: \"P \\<or> (Q \\<or> R) \\<longleftrightarrow> Q \\<or> (P \\<or> R)\" by iprover+\nlemma disj_assoc: \"(P \\<or> Q) \\<or> R \\<longleftrightarrow> P \\<or> (Q \\<or> R)\" by iprover\n\nlemmas disj_ac = disj_commute disj_left_commute disj_assoc\n\nlemma conj_disj_distribL: \"P \\<and> (Q \\<or> R) \\<longleftrightarrow> P \\<and> Q \\<or> P \\<and> R\" by iprover\nlemma conj_disj_distribR: \"(P \\<or> Q) \\<and> R \\<longleftrightarrow> P \\<and> R \\<or> Q \\<and> R\" by iprover\n\nlemma disj_conj_distribL: \"P \\<or> (Q \\<and> R) \\<longleftrightarrow> (P \\<or> Q) \\<and> (P \\<or> R)\" by iprover\nlemma disj_conj_distribR: \"(P \\<and> Q) \\<or> R \\<longleftrightarrow> (P \\<or> R) \\<and> (Q \\<or> R)\" by iprover\n\nlemma imp_conjR: \"(P \\<longrightarrow> (Q \\<and> R)) = ((P \\<longrightarrow> Q) \\<and> (P \\<longrightarrow> R))\" by iprover\nlemma imp_conjL: \"((P \\<and> Q) \\<longrightarrow> R) = (P \\<longrightarrow> (Q \\<longrightarrow> R))\" by iprover\nlemma imp_disjL: \"((P \\<or> Q) \\<longrightarrow> R) = ((P \\<longrightarrow> R) \\<and> (Q \\<longrightarrow> R))\" by iprover\n\ntext \\<open>These two are specialized, but \\<open>imp_disj_not1\\<close> is useful in \\<open>Auth/Yahalom\\<close>.\\<close>\nlemma imp_disj_not1: \"(P \\<longrightarrow> Q \\<or> R) \\<longleftrightarrow> (\\<not> Q \\<longrightarrow> P \\<longrightarrow> R)\" by blast\nlemma imp_disj_not2: \"(P \\<longrightarrow> Q \\<or> R) \\<longleftrightarrow> (\\<not> R \\<longrightarrow> P \\<longrightarrow> Q)\" by blast\n\nlemma imp_disj1: \"((P \\<longrightarrow> Q) \\<or> R) \\<longleftrightarrow> (P \\<longrightarrow> Q \\<or> R)\" by blast\nlemma imp_disj2: \"(Q \\<or> (P \\<longrightarrow> R)) \\<longleftrightarrow> (P \\<longrightarrow> Q \\<or> R)\" by blast\n\nlemma imp_cong: \"(P = P') \\<Longrightarrow> (P' \\<Longrightarrow> (Q = Q')) \\<Longrightarrow> ((P \\<longrightarrow> Q) \\<longleftrightarrow> (P' \\<longrightarrow> Q'))\"\n  by iprover\n\nlemma de_Morgan_disj: \"\\<not> (P \\<or> Q) \\<longleftrightarrow> \\<not> P \\<and> \\<not> Q\" by iprover\nlemma de_Morgan_conj: \"\\<not> (P \\<and> Q) \\<longleftrightarrow> \\<not> P \\<or> \\<not> Q\" by blast\nlemma not_imp: \"\\<not> (P \\<longrightarrow> Q) \\<longleftrightarrow> P \\<and> \\<not> Q\" by blast\nlemma not_iff: \"P \\<noteq> Q \\<longleftrightarrow> (P \\<longleftrightarrow> \\<not> Q)\" by blast\nlemma disj_not1: \"\\<not> P \\<or> Q \\<longleftrightarrow> (P \\<longrightarrow> Q)\" by blast\nlemma disj_not2: \"P \\<or> \\<not> Q \\<longleftrightarrow> (Q \\<longrightarrow> P)\" by blast  \\<comment> \\<open>changes orientation :-(\\<close>\nlemma imp_conv_disj: \"(P \\<longrightarrow> Q) \\<longleftrightarrow> (\\<not> P) \\<or> Q\" by blast\nlemma disj_imp: \"P \\<or> Q \\<longleftrightarrow> \\<not> P \\<longrightarrow> Q\" by blast\n\nlemma iff_conv_conj_imp: \"(P \\<longleftrightarrow> Q) \\<longleftrightarrow> (P \\<longrightarrow> Q) \\<and> (Q \\<longrightarrow> P)\" by iprover\n\n\nlemma cases_simp: \"(P \\<longrightarrow> Q) \\<and> (\\<not> P \\<longrightarrow> Q) \\<longleftrightarrow> Q\"\n  \\<comment> \\<open>Avoids duplication of subgoals after \\<open>if_split\\<close>, when the true and false\\<close>\n  \\<comment> \\<open>cases boil down to the same thing.\\<close>\n  by blast\n\nlemma not_all: \"\\<not> (\\<forall>x. P x) \\<longleftrightarrow> (\\<exists>x. \\<not> P x)\" by blast\nlemma imp_all: \"((\\<forall>x. P x) \\<longrightarrow> Q) \\<longleftrightarrow> (\\<exists>x. P x \\<longrightarrow> Q)\" by blast\nlemma not_ex: \"\\<not> (\\<exists>x. P x) \\<longleftrightarrow> (\\<forall>x. \\<not> P x)\" by iprover\nlemma imp_ex: \"((\\<exists>x. P x) \\<longrightarrow> Q) \\<longleftrightarrow> (\\<forall>x. P x \\<longrightarrow> Q)\" by iprover\nlemma all_not_ex: \"(\\<forall>x. P x) \\<longleftrightarrow> \\<not> (\\<exists>x. \\<not> P x)\" by blast\n\ndeclare All_def [no_atp]\n\nlemma ex_disj_distrib: \"(\\<exists>x. P x \\<or> Q x) \\<longleftrightarrow> (\\<exists>x. P x) \\<or> (\\<exists>x. Q x)\" by iprover\nlemma all_conj_distrib: \"(\\<forall>x. P x \\<and> Q x) \\<longleftrightarrow> (\\<forall>x. P x) \\<and> (\\<forall>x. Q x)\" by iprover\n\ntext \\<open>\n  \\<^medskip> The \\<open>\\<and>\\<close> congruence rule: not included by default!\n  May slow rewrite proofs down by as much as 50\\%\\<close>\n\nlemma conj_cong: \"P = P' \\<Longrightarrow> (P' \\<Longrightarrow> Q = Q') \\<Longrightarrow> (P \\<and> Q) = (P' \\<and> Q')\"\n  by iprover\n\nlemma rev_conj_cong: \"Q = Q' \\<Longrightarrow> (Q' \\<Longrightarrow> P = P') \\<Longrightarrow> (P \\<and> Q) = (P' \\<and> Q')\"\n  by iprover\n\ntext \\<open>The \\<open>|\\<close> congruence rule: not included by default!\\<close>\n\nlemma disj_cong: \"P = P' \\<Longrightarrow> (\\<not> P' \\<Longrightarrow> Q = Q') \\<Longrightarrow> (P \\<or> Q) = (P' \\<or> Q')\"\n  by blast\n\n\ntext \\<open>\\<^medskip> if-then-else rules\\<close>\n\nlemma if_True [code]: \"(if True then x else y) = x\"\n  unfolding If_def by blast\n\nlemma if_False [code]: \"(if False then x else y) = y\"\n  unfolding If_def by blast\n\nlemma if_P: \"P \\<Longrightarrow> (if P then x else y) = x\"\n  unfolding If_def by blast\n\nlemma if_not_P: \"\\<not> P \\<Longrightarrow> (if P then x else y) = y\"\n  unfolding If_def by blast\n\nlemma if_split: \"P (if Q then x else y) = ((Q \\<longrightarrow> P x) \\<and> (\\<not> Q \\<longrightarrow> P y))\"\nproof (rule case_split [of Q])\n  show ?thesis if Q\n    using that by (simplesubst if_P) blast+\n  show ?thesis if \"\\<not> Q\"\n    using that by (simplesubst if_not_P) blast+\nqed\n\nlemma if_split_asm: \"P (if Q then x else y) = (\\<not> ((Q \\<and> \\<not> P x) \\<or> (\\<not> Q \\<and> \\<not> P y)))\"\n  by (simplesubst if_split) blast\n\nlemmas if_splits [no_atp] = if_split if_split_asm\n\nlemma if_cancel: \"(if c then x else x) = x\"\n  by (simplesubst if_split) blast\n\nlemma if_eq_cancel: \"(if x = y then y else x) = x\"\n  by (simplesubst if_split) blast\n\nlemma if_bool_eq_conj: \"(if P then Q else R) = ((P \\<longrightarrow> Q) \\<and> (\\<not> P \\<longrightarrow> R))\"\n  \\<comment> \\<open>This form is useful for expanding \\<open>if\\<close>s on the RIGHT of the \\<open>\\<Longrightarrow>\\<close> symbol.\\<close>\n  by (rule if_split)\n\nlemma if_bool_eq_disj: \"(if P then Q else R) = ((P \\<and> Q) \\<or> (\\<not> P \\<and> R))\"\n  \\<comment> \\<open>And this form is useful for expanding \\<open>if\\<close>s on the LEFT.\\<close>\n  by (simplesubst if_split) blast\n\nlemma Eq_TrueI: \"P \\<Longrightarrow> P \\<equiv> True\" unfolding atomize_eq by iprover\nlemma Eq_FalseI: \"\\<not> P \\<Longrightarrow> P \\<equiv> False\" unfolding atomize_eq by iprover\n\ntext \\<open>\\<^medskip> let rules for simproc\\<close>\n\nlemma Let_folded: \"f x \\<equiv> g x \\<Longrightarrow> Let x f \\<equiv> Let x g\"\n  by (unfold Let_def)\n\nlemma Let_unfold: \"f x \\<equiv> g \\<Longrightarrow> Let x f \\<equiv> g\"\n  by (unfold Let_def)\n\ntext \\<open>\n  The following copy of the implication operator is useful for\n  fine-tuning congruence rules.  It instructs the simplifier to simplify\n  its premise.\n\\<close>\n\ndefinition simp_implies :: \"prop \\<Rightarrow> prop \\<Rightarrow> prop\"  (infixr \"=simp=>\" 1)\n  where \"simp_implies \\<equiv> (\\<Longrightarrow>)\"\n\nlemma simp_impliesI:\n  assumes PQ: \"(PROP P \\<Longrightarrow> PROP Q)\"\n  shows \"PROP P =simp=> PROP Q\"\n  unfolding simp_implies_def\n  by (iprover intro: PQ)\n\nlemma simp_impliesE:\n  assumes PQ: \"PROP P =simp=> PROP Q\"\n    and P: \"PROP P\"\n    and QR: \"PROP Q \\<Longrightarrow> PROP R\"\n  shows \"PROP R\"\n  by (iprover intro: QR P PQ [unfolded simp_implies_def])\n\nlemma simp_implies_cong:\n  assumes PP' :\"PROP P \\<equiv> PROP P'\"\n    and P'QQ': \"PROP P' \\<Longrightarrow> (PROP Q \\<equiv> PROP Q')\"\n  shows \"(PROP P =simp=> PROP Q) \\<equiv> (PROP P' =simp=> PROP Q')\"\n  unfolding simp_implies_def\nproof (rule equal_intr_rule)\n  assume PQ: \"PROP P \\<Longrightarrow> PROP Q\"\n    and P': \"PROP P'\"\n  from PP' [symmetric] and P' have \"PROP P\"\n    by (rule equal_elim_rule1)\n  then have \"PROP Q\" by (rule PQ)\n  with P'QQ' [OF P'] show \"PROP Q'\" by (rule equal_elim_rule1)\nnext\n  assume P'Q': \"PROP P' \\<Longrightarrow> PROP Q'\"\n    and P: \"PROP P\"\n  from PP' and P have P': \"PROP P'\" by (rule equal_elim_rule1)\n  then have \"PROP Q'\" by (rule P'Q')\n  with P'QQ' [OF P', symmetric] show \"PROP Q\"\n    by (rule equal_elim_rule1)\nqed\n\nlemma uncurry:\n  assumes \"P \\<longrightarrow> Q \\<longrightarrow> R\"\n  shows \"P \\<and> Q \\<longrightarrow> R\"\n  using assms by blast\n\nlemma iff_allI:\n  assumes \"\\<And>x. P x = Q x\"\n  shows \"(\\<forall>x. P x) = (\\<forall>x. Q x)\"\n  using assms by blast\n\nlemma iff_exI:\n  assumes \"\\<And>x. P x = Q x\"\n  shows \"(\\<exists>x. P x) = (\\<exists>x. Q x)\"\n  using assms by blast\n\nlemma all_comm: \"(\\<forall>x y. P x y) = (\\<forall>y x. P x y)\"\n  by blast\n\nlemma ex_comm: \"(\\<exists>x y. P x y) = (\\<exists>y x. P x y)\"\n  by blast\n\nML_file \\<open>Tools/simpdata.ML\\<close>\nML \\<open>open Simpdata\\<close>\n\nsetup \\<open>\n  map_theory_simpset (put_simpset HOL_basic_ss) #>\n  Simplifier.method_setup Splitter.split_modifiers\n\\<close>\n\nsimproc_setup defined_Ex (\"\\<exists>x. P x\") = \\<open>K Quantifier1.rearrange_Ex\\<close>\nsimproc_setup defined_All (\"\\<forall>x. P x\") = \\<open>K Quantifier1.rearrange_All\\<close>\nsimproc_setup defined_all(\"\\<And>x. PROP P x\") = \\<open>K Quantifier1.rearrange_all\\<close>\n\ntext \\<open>Simproc for proving \\<open>(y = x) \\<equiv> False\\<close> from premise \\<open>\\<not> (x = y)\\<close>:\\<close>\n\nsimproc_setup neq (\"x = y\") = \\<open>fn _ =>\n  let\n    val neq_to_EQ_False = @{thm not_sym} RS @{thm Eq_FalseI};\n    fun is_neq eq lhs rhs thm =\n      (case Thm.prop_of thm of\n        _ $ (Not $ (eq' $ l' $ r')) =>\n          Not = HOLogic.Not andalso eq' = eq andalso\n          r' aconv lhs andalso l' aconv rhs\n      | _ => false);\n    fun proc ss ct =\n      (case Thm.term_of ct of\n        eq $ lhs $ rhs =>\n          (case find_first (is_neq eq lhs rhs) (Simplifier.prems_of ss) of\n            SOME thm => SOME (thm RS neq_to_EQ_False)\n          | NONE => NONE)\n       | _ => NONE);\n  in proc end\n\\<close>\n\nsimproc_setup let_simp (\"Let x f\") = \\<open>\n  let\n    fun count_loose (Bound i) k = if i >= k then 1 else 0\n      | count_loose (s $ t) k = count_loose s k + count_loose t k\n      | count_loose (Abs (_, _, t)) k = count_loose  t (k + 1)\n      | count_loose _ _ = 0;\n    fun is_trivial_let (Const (\\<^const_name>\\<open>Let\\<close>, _) $ x $ t) =\n      (case t of\n        Abs (_, _, t') => count_loose t' 0 <= 1\n      | _ => true);\n  in\n    fn _ => fn ctxt => fn ct =>\n      if is_trivial_let (Thm.term_of ct)\n      then SOME @{thm Let_def} (*no or one ocurrence of bound variable*)\n      else\n        let (*Norbert Schirmer's case*)\n          val t = Thm.term_of ct;\n          val (t', ctxt') = yield_singleton (Variable.import_terms false) t ctxt;\n        in\n          Option.map (hd o Variable.export ctxt' ctxt o single)\n            (case t' of Const (\\<^const_name>\\<open>Let\\<close>,_) $ x $ f => (* x and f are already in normal form *)\n              if is_Free x orelse is_Bound x orelse is_Const x\n              then SOME @{thm Let_def}\n              else\n                let\n                  val n = case f of (Abs (x, _, _)) => x | _ => \"x\";\n                  val cx = Thm.cterm_of ctxt x;\n                  val xT = Thm.typ_of_cterm cx;\n                  val cf = Thm.cterm_of ctxt f;\n                  val fx_g = Simplifier.rewrite ctxt (Thm.apply cf cx);\n                  val (_ $ _ $ g) = Thm.prop_of fx_g;\n                  val g' = abstract_over (x, g);\n                  val abs_g'= Abs (n, xT, g');\n                in\n                  if g aconv g' then\n                    let\n                      val rl =\n                        infer_instantiate ctxt [((\"f\", 0), cf), ((\"x\", 0), cx)] @{thm Let_unfold};\n                    in SOME (rl OF [fx_g]) end\n                  else if (Envir.beta_eta_contract f) aconv (Envir.beta_eta_contract abs_g')\n                  then NONE (*avoid identity conversion*)\n                  else\n                    let\n                      val g'x = abs_g' $ x;\n                      val g_g'x = Thm.symmetric (Thm.beta_conversion false (Thm.cterm_of ctxt g'x));\n                      val rl =\n                        @{thm Let_folded} |> infer_instantiate ctxt\n                          [((\"f\", 0), Thm.cterm_of ctxt f),\n                           ((\"x\", 0), cx),\n                           ((\"g\", 0), Thm.cterm_of ctxt abs_g')];\n                    in SOME (rl OF [Thm.transitive fx_g g_g'x]) end\n                end\n            | _ => NONE)\n        end\n  end\n\\<close>\n\nlemma True_implies_equals: \"(True \\<Longrightarrow> PROP P) \\<equiv> PROP P\"\nproof\n  assume \"True \\<Longrightarrow> PROP P\"\n  from this [OF TrueI] show \"PROP P\" .\nnext\n  assume \"PROP P\"\n  then show \"PROP P\" .\nqed\n\nlemma implies_True_equals: \"(PROP P \\<Longrightarrow> True) \\<equiv> Trueprop True\"\n  by standard (intro TrueI)\n\nlemma False_implies_equals: \"(False \\<Longrightarrow> P) \\<equiv> Trueprop True\"\n  by standard simp_all\n\n(* It seems that making this a simp rule is slower than using the simproc below *)\nlemma implies_False_swap:\n  \"(False \\<Longrightarrow> PROP P \\<Longrightarrow> PROP Q) \\<equiv> (PROP P \\<Longrightarrow> False \\<Longrightarrow> PROP Q)\"\n  by (rule swap_prems_eq)\n\nML \\<open>\nfun eliminate_false_implies ct =\n  let\n    val (prems, concl) = Logic.strip_horn (Thm.term_of ct)\n    fun go n =\n      if n > 1 then\n        Conv.rewr_conv @{thm Pure.swap_prems_eq}\n        then_conv Conv.arg_conv (go (n - 1))\n        then_conv Conv.rewr_conv @{thm HOL.implies_True_equals}\n      else\n        Conv.rewr_conv @{thm HOL.False_implies_equals}\n  in\n    case concl of\n      Const (@{const_name HOL.Trueprop}, _) $ _ => SOME (go (length prems) ct)\n    | _ => NONE\n  end\n\\<close>\n\nsimproc_setup eliminate_false_implies (\"False \\<Longrightarrow> PROP P\") = \\<open>K (K eliminate_false_implies)\\<close>\n\n\nlemma ex_simps:\n  \"\\<And>P Q. (\\<exists>x. P x \\<and> Q)   = ((\\<exists>x. P x) \\<and> Q)\"\n  \"\\<And>P Q. (\\<exists>x. P \\<and> Q x)   = (P \\<and> (\\<exists>x. Q x))\"\n  \"\\<And>P Q. (\\<exists>x. P x \\<or> Q)   = ((\\<exists>x. P x) \\<or> Q)\"\n  \"\\<And>P Q. (\\<exists>x. P \\<or> Q x)   = (P \\<or> (\\<exists>x. Q x))\"\n  \"\\<And>P Q. (\\<exists>x. P x \\<longrightarrow> Q) = ((\\<forall>x. P x) \\<longrightarrow> Q)\"\n  \"\\<And>P Q. (\\<exists>x. P \\<longrightarrow> Q x) = (P \\<longrightarrow> (\\<exists>x. Q x))\"\n  \\<comment> \\<open>Miniscoping: pushing in existential quantifiers.\\<close>\n  by (iprover | blast)+\n\nlemma all_simps:\n  \"\\<And>P Q. (\\<forall>x. P x \\<and> Q)   = ((\\<forall>x. P x) \\<and> Q)\"\n  \"\\<And>P Q. (\\<forall>x. P \\<and> Q x)   = (P \\<and> (\\<forall>x. Q x))\"\n  \"\\<And>P Q. (\\<forall>x. P x \\<or> Q)   = ((\\<forall>x. P x) \\<or> Q)\"\n  \"\\<And>P Q. (\\<forall>x. P \\<or> Q x)   = (P \\<or> (\\<forall>x. Q x))\"\n  \"\\<And>P Q. (\\<forall>x. P x \\<longrightarrow> Q) = ((\\<exists>x. P x) \\<longrightarrow> Q)\"\n  \"\\<And>P Q. (\\<forall>x. P \\<longrightarrow> Q x) = (P \\<longrightarrow> (\\<forall>x. Q x))\"\n  \\<comment> \\<open>Miniscoping: pushing in universal quantifiers.\\<close>\n  by (iprover | blast)+\n\nlemmas [simp] =\n  triv_forall_equality  \\<comment> \\<open>prunes params\\<close>\n  True_implies_equals implies_True_equals  \\<comment> \\<open>prune \\<open>True\\<close> in asms\\<close>\n  False_implies_equals  \\<comment> \\<open>prune \\<open>False\\<close> in asms\\<close>\n  if_True\n  if_False\n  if_cancel\n  if_eq_cancel\n  imp_disjL \\<comment> \\<open>In general it seems wrong to add distributive laws by default: they\n    might cause exponential blow-up.  But \\<open>imp_disjL\\<close> has been in for a while\n    and cannot be removed without affecting existing proofs.  Moreover,\n    rewriting by \\<open>(P \\<or> Q \\<longrightarrow> R) = ((P \\<longrightarrow> R) \\<and> (Q \\<longrightarrow> R))\\<close> might be justified on the\n    grounds that it allows simplification of \\<open>R\\<close> in the two cases.\\<close>\n  conj_assoc\n  disj_assoc\n  de_Morgan_conj\n  de_Morgan_disj\n  imp_disj1\n  imp_disj2\n  not_imp\n  disj_not1\n  not_all\n  not_ex\n  cases_simp\n  the_eq_trivial\n  the_sym_eq_trivial\n  ex_simps\n  all_simps\n  simp_thms\n  subst_all\n\nlemmas [cong] = imp_cong simp_implies_cong\nlemmas [split] = if_split\n\nML \\<open>val HOL_ss = simpset_of \\<^context>\\<close>\n\ntext \\<open>Simplifies \\<open>x\\<close> assuming \\<open>c\\<close> and \\<open>y\\<close> assuming \\<open>\\<not> c\\<close>.\\<close>\nlemma if_cong:\n  assumes \"b = c\"\n    and \"c \\<Longrightarrow> x = u\"\n    and \"\\<not> c \\<Longrightarrow> y = v\"\n  shows \"(if b then x else y) = (if c then u else v)\"\n  using assms by simp\n\ntext \\<open>Prevents simplification of \\<open>x\\<close> and \\<open>y\\<close>:\n  faster and allows the execution of functional programs.\\<close>\nlemma if_weak_cong [cong]:\n  assumes \"b = c\"\n  shows \"(if b then x else y) = (if c then x else y)\"\n  using assms by (rule arg_cong)\n\ntext \\<open>Prevents simplification of t: much faster\\<close>\nlemma let_weak_cong:\n  assumes \"a = b\"\n  shows \"(let x = a in t x) = (let x = b in t x)\"\n  using assms by (rule arg_cong)\n\ntext \\<open>To tidy up the result of a simproc.  Only the RHS will be simplified.\\<close>\nlemma eq_cong2:\n  assumes \"u = u'\"\n  shows \"(t \\<equiv> u) \\<equiv> (t \\<equiv> u')\"\n  using assms by simp\n\nlemma if_distrib: \"f (if c then x else y) = (if c then f x else f y)\"\n  by simp\n\nlemma if_distribR: \"(if b then f else g) x = (if b then f x else g x)\"\n  by simp\n\nlemma all_if_distrib: \"(\\<forall>x. if x = a then P x else Q x) \\<longleftrightarrow> P a \\<and> (\\<forall>x. x\\<noteq>a \\<longrightarrow> Q x)\"\n  by auto\n\nlemma ex_if_distrib: \"(\\<exists>x. if x = a then P x else Q x) \\<longleftrightarrow> P a \\<or> (\\<exists>x. x\\<noteq>a \\<and> Q x)\"\n  by auto\n\nlemma if_if_eq_conj: \"(if P then if Q then x else y else y) = (if P \\<and> Q then x else y)\"\n  by simp\n\ntext \\<open>As a simplification rule, it replaces all function equalities by\n  first-order equalities.\\<close>\nlemma fun_eq_iff: \"f = g \\<longleftrightarrow> (\\<forall>x. f x = g x)\"\n  by auto\n\n\nsubsubsection \\<open>Generic cases and induction\\<close>\n\ntext \\<open>Rule projections:\\<close>\nML \\<open>\nstructure Project_Rule = Project_Rule\n(\n  val conjunct1 = @{thm conjunct1}\n  val conjunct2 = @{thm conjunct2}\n  val mp = @{thm mp}\n);\n\\<close>\n\ncontext\nbegin\n\nqualified definition \"induct_forall P \\<equiv> \\<forall>x. P x\"\nqualified definition \"induct_implies A B \\<equiv> A \\<longrightarrow> B\"\nqualified definition \"induct_equal x y \\<equiv> x = y\"\nqualified definition \"induct_conj A B \\<equiv> A \\<and> B\"\nqualified definition \"induct_true \\<equiv> True\"\nqualified definition \"induct_false \\<equiv> False\"\n\nlemma induct_forall_eq: \"(\\<And>x. P x) \\<equiv> Trueprop (induct_forall (\\<lambda>x. P x))\"\n  by (unfold atomize_all induct_forall_def)\n\nlemma induct_implies_eq: \"(A \\<Longrightarrow> B) \\<equiv> Trueprop (induct_implies A B)\"\n  by (unfold atomize_imp induct_implies_def)\n\nlemma induct_equal_eq: \"(x \\<equiv> y) \\<equiv> Trueprop (induct_equal x y)\"\n  by (unfold atomize_eq induct_equal_def)\n\nlemma induct_conj_eq: \"(A &&& B) \\<equiv> Trueprop (induct_conj A B)\"\n  by (unfold atomize_conj induct_conj_def)\n\nlemmas induct_atomize' = induct_forall_eq induct_implies_eq induct_conj_eq\nlemmas induct_atomize = induct_atomize' induct_equal_eq\nlemmas induct_rulify' [symmetric] = induct_atomize'\nlemmas induct_rulify [symmetric] = induct_atomize\nlemmas induct_rulify_fallback =\n  induct_forall_def induct_implies_def induct_equal_def induct_conj_def\n  induct_true_def induct_false_def\n\nlemma induct_forall_conj: \"induct_forall (\\<lambda>x. induct_conj (A x) (B x)) =\n    induct_conj (induct_forall A) (induct_forall B)\"\n  by (unfold induct_forall_def induct_conj_def) iprover\n\nlemma induct_implies_conj: \"induct_implies C (induct_conj A B) =\n    induct_conj (induct_implies C A) (induct_implies C B)\"\n  by (unfold induct_implies_def induct_conj_def) iprover\n\nlemma induct_conj_curry: \"(induct_conj A B \\<Longrightarrow> PROP C) \\<equiv> (A \\<Longrightarrow> B \\<Longrightarrow> PROP C)\"\nproof\n  assume r: \"induct_conj A B \\<Longrightarrow> PROP C\"\n  assume ab: A B\n  show \"PROP C\" by (rule r) (simp add: induct_conj_def ab)\nnext\n  assume r: \"A \\<Longrightarrow> B \\<Longrightarrow> PROP C\"\n  assume ab: \"induct_conj A B\"\n  show \"PROP C\" by (rule r) (simp_all add: ab [unfolded induct_conj_def])\nqed\n\nlemmas induct_conj = induct_forall_conj induct_implies_conj induct_conj_curry\n\nlemma induct_trueI: \"induct_true\"\n  by (simp add: induct_true_def)\n\ntext \\<open>Method setup.\\<close>\n\nML_file \\<open>~~/src/Tools/induct.ML\\<close>\nML \\<open>\nstructure Induct = Induct\n(\n  val cases_default = @{thm case_split}\n  val atomize = @{thms induct_atomize}\n  val rulify = @{thms induct_rulify'}\n  val rulify_fallback = @{thms induct_rulify_fallback}\n  val equal_def = @{thm induct_equal_def}\n  fun dest_def (Const (\\<^const_name>\\<open>induct_equal\\<close>, _) $ t $ u) = SOME (t, u)\n    | dest_def _ = NONE\n  fun trivial_tac ctxt = match_tac ctxt @{thms induct_trueI}\n)\n\\<close>\n\nML_file \\<open>~~/src/Tools/induction.ML\\<close>\n\ndeclaration \\<open>\n  fn _ => Induct.map_simpset (fn ss => ss\n    addsimprocs\n      [Simplifier.make_simproc \\<^context> \"swap_induct_false\"\n        {lhss = [\\<^term>\\<open>induct_false \\<Longrightarrow> PROP P \\<Longrightarrow> PROP Q\\<close>],\n         proc = fn _ => fn _ => fn ct =>\n          (case Thm.term_of ct of\n            _ $ (P as _ $ \\<^Const_>\\<open>induct_false\\<close>) $ (_ $ Q $ _) =>\n              if P <> Q then SOME Drule.swap_prems_eq else NONE\n          | _ => NONE)},\n       Simplifier.make_simproc \\<^context> \"induct_equal_conj_curry\"\n        {lhss = [\\<^term>\\<open>induct_conj P Q \\<Longrightarrow> PROP R\\<close>],\n         proc = fn _ => fn _ => fn ct =>\n          (case Thm.term_of ct of\n            _ $ (_ $ P) $ _ =>\n              let\n                fun is_conj \\<^Const_>\\<open>induct_conj for P Q\\<close> =\n                      is_conj P andalso is_conj Q\n                  | is_conj \\<^Const_>\\<open>induct_equal _ for _ _\\<close> = true\n                  | is_conj \\<^Const_>\\<open>induct_true\\<close> = true\n                  | is_conj \\<^Const_>\\<open>induct_false\\<close> = true\n                  | is_conj _ = false\n              in if is_conj P then SOME @{thm induct_conj_curry} else NONE end\n            | _ => NONE)}]\n    |> Simplifier.set_mksimps (fn ctxt =>\n        Simpdata.mksimps Simpdata.mksimps_pairs ctxt #>\n        map (rewrite_rule ctxt (map Thm.symmetric @{thms induct_rulify_fallback}))))\n\\<close>\n\ntext \\<open>Pre-simplification of induction and cases rules\\<close>\n\nlemma [induct_simp]: \"(\\<And>x. induct_equal x t \\<Longrightarrow> PROP P x) \\<equiv> PROP P t\"\n  unfolding induct_equal_def\nproof\n  assume r: \"\\<And>x. x = t \\<Longrightarrow> PROP P x\"\n  show \"PROP P t\" by (rule r [OF refl])\nnext\n  fix x\n  assume \"PROP P t\" \"x = t\"\n  then show \"PROP P x\" by simp\nqed\n\nlemma [induct_simp]: \"(\\<And>x. induct_equal t x \\<Longrightarrow> PROP P x) \\<equiv> PROP P t\"\n  unfolding induct_equal_def\nproof\n  assume r: \"\\<And>x. t = x \\<Longrightarrow> PROP P x\"\n  show \"PROP P t\" by (rule r [OF refl])\nnext\n  fix x\n  assume \"PROP P t\" \"t = x\"\n  then show \"PROP P x\" by simp\nqed\n\nlemma [induct_simp]: \"(induct_false \\<Longrightarrow> P) \\<equiv> Trueprop induct_true\"\n  unfolding induct_false_def induct_true_def\n  by (iprover intro: equal_intr_rule)\n\nlemma [induct_simp]: \"(induct_true \\<Longrightarrow> PROP P) \\<equiv> PROP P\"\n  unfolding induct_true_def\nproof\n  assume \"True \\<Longrightarrow> PROP P\"\n  then show \"PROP P\" using TrueI .\nnext\n  assume \"PROP P\"\n  then show \"PROP P\" .\nqed\n\nlemma [induct_simp]: \"(PROP P \\<Longrightarrow> induct_true) \\<equiv> Trueprop induct_true\"\n  unfolding induct_true_def\n  by (iprover intro: equal_intr_rule)\n\nlemma [induct_simp]: \"(\\<And>x::'a::{}. induct_true) \\<equiv> Trueprop induct_true\"\n  unfolding induct_true_def\n  by (iprover intro: equal_intr_rule)\n\nlemma [induct_simp]: \"induct_implies induct_true P \\<equiv> P\"\n  by (simp add: induct_implies_def induct_true_def)\n\nlemma [induct_simp]: \"x = x \\<longleftrightarrow> True\"\n  by (rule simp_thms)\n\nend\n\nML_file \\<open>~~/src/Tools/induct_tacs.ML\\<close>\n\n\nsubsubsection \\<open>Coherent logic\\<close>\n\nML_file \\<open>~~/src/Tools/coherent.ML\\<close>\nML \\<open>\nstructure Coherent = Coherent\n(\n  val atomize_elimL = @{thm atomize_elimL};\n  val atomize_exL = @{thm atomize_exL};\n  val atomize_conjL = @{thm atomize_conjL};\n  val atomize_disjL = @{thm atomize_disjL};\n  val operator_names = [\\<^const_name>\\<open>HOL.disj\\<close>, \\<^const_name>\\<open>HOL.conj\\<close>, \\<^const_name>\\<open>Ex\\<close>];\n);\n\\<close>\n\n\nsubsubsection \\<open>Reorienting equalities\\<close>\n\nML \\<open>\nsignature REORIENT_PROC =\nsig\n  val add : (term -> bool) -> theory -> theory\n  val proc : morphism -> Proof.context -> cterm -> thm option\nend;\n\nstructure Reorient_Proc : REORIENT_PROC =\nstruct\n  structure Data = Theory_Data\n  (\n    type T = ((term -> bool) * stamp) list;\n    val empty = [];\n    fun merge data : T = Library.merge (eq_snd (op =)) data;\n  );\n  fun add m = Data.map (cons (m, stamp ()));\n  fun matches thy t = exists (fn (m, _) => m t) (Data.get thy);\n\n  val meta_reorient = @{thm eq_commute [THEN eq_reflection]};\n  fun proc phi ctxt ct =\n    let\n      val thy = Proof_Context.theory_of ctxt;\n    in\n      case Thm.term_of ct of\n        (_ $ t $ u) => if matches thy u then NONE else SOME meta_reorient\n      | _ => NONE\n    end;\nend;\n\\<close>\n\n\nsubsection \\<open>Other simple lemmas and lemma duplicates\\<close>\n\nlemma eq_iff_swap: \"(x = y \\<longleftrightarrow> P) \\<Longrightarrow> (y = x \\<longleftrightarrow> P)\"\nby blast\n\nlemma all_cong1: \"(\\<And>x. P x = P' x) \\<Longrightarrow> (\\<forall>x. P x) = (\\<forall>x. P' x)\"\n  by auto\n\nlemma ex_cong1: \"(\\<And>x. P x = P' x) \\<Longrightarrow> (\\<exists>x. P x) = (\\<exists>x. P' x)\"\n  by auto\n\nlemma all_cong: \"(\\<And>x. Q x \\<Longrightarrow> P x = P' x) \\<Longrightarrow> (\\<forall>x. Q x \\<longrightarrow> P x) = (\\<forall>x. Q x \\<longrightarrow> P' x)\"\n  by auto\n\nlemma ex_cong: \"(\\<And>x. Q x \\<Longrightarrow> P x = P' x) \\<Longrightarrow> (\\<exists>x. Q x \\<and> P x) = (\\<exists>x. Q x \\<and> P' x)\"\n  by auto\n\nlemma ex1_eq [iff]: \"\\<exists>!x. x = t\" \"\\<exists>!x. t = x\"\n  by blast+\n\nlemma choice_eq: \"(\\<forall>x. \\<exists>!y. P x y) = (\\<exists>!f. \\<forall>x. P x (f x))\" (is \"?lhs = ?rhs\")\nproof (intro iffI allI)\n  assume L: ?lhs\n  then have \\<section>: \"\\<forall>x. P x (THE y. P x y)\"\n    by (best intro: theI')\n  show ?rhs\n    by (rule ex1I) (use L \\<section> in \\<open>fast+\\<close>)\nnext\n  fix x\n  assume R: ?rhs\n  then obtain f where f: \"\\<forall>x. P x (f x)\" and f1: \"\\<And>y. (\\<forall>x. P x (y x)) \\<Longrightarrow> y = f\"\n    by (blast elim: ex1E)\n  show \"\\<exists>!y. P x y\"\n  proof (rule ex1I)\n    show \"P x (f x)\"\n      using f by blast\n    show \"y = f x\" if \"P x y\" for y\n    proof -\n      have \"P z (if z = x then y else f z)\" for z\n        using f that by (auto split: if_split)\n      with f1 [of \"\\<lambda>z. if z = x then y else f z\"] f\n      show ?thesis\n        by (auto simp add: split: if_split_asm dest: fun_cong)\n    qed\n  qed\nqed\n\nlemmas eq_sym_conv = eq_commute\n\nlemma nnf_simps:\n  \"(\\<not> (P \\<and> Q)) = (\\<not> P \\<or> \\<not> Q)\"\n  \"(\\<not> (P \\<or> Q)) = (\\<not> P \\<and> \\<not> Q)\"\n  \"(P \\<longrightarrow> Q) = (\\<not> P \\<or> Q)\"\n  \"(P = Q) = ((P \\<and> Q) \\<or> (\\<not> P \\<and> \\<not> Q))\"\n  \"(\\<not> (P = Q)) = ((P \\<and> \\<not> Q) \\<or> (\\<not> P \\<and> Q))\"\n  \"(\\<not> \\<not> P) = P\"\n  by blast+\n\n\nsubsection \\<open>Basic ML bindings\\<close>\n\nML \\<open>\nval FalseE = @{thm FalseE}\nval Let_def = @{thm Let_def}\nval TrueI = @{thm TrueI}\nval allE = @{thm allE}\nval allI = @{thm allI}\nval all_dupE = @{thm all_dupE}\nval arg_cong = @{thm arg_cong}\nval box_equals = @{thm box_equals}\nval ccontr = @{thm ccontr}\nval classical = @{thm classical}\nval conjE = @{thm conjE}\nval conjI = @{thm conjI}\nval conjunct1 = @{thm conjunct1}\nval conjunct2 = @{thm conjunct2}\nval disjCI = @{thm disjCI}\nval disjE = @{thm disjE}\nval disjI1 = @{thm disjI1}\nval disjI2 = @{thm disjI2}\nval eq_reflection = @{thm eq_reflection}\nval ex1E = @{thm ex1E}\nval ex1I = @{thm ex1I}\nval ex1_implies_ex = @{thm ex1_implies_ex}\nval exE = @{thm exE}\nval exI = @{thm exI}\nval excluded_middle = @{thm excluded_middle}\nval ext = @{thm ext}\nval fun_cong = @{thm fun_cong}\nval iffD1 = @{thm iffD1}\nval iffD2 = @{thm iffD2}\nval iffI = @{thm iffI}\nval impE = @{thm impE}\nval impI = @{thm impI}\nval meta_eq_to_obj_eq = @{thm meta_eq_to_obj_eq}\nval mp = @{thm mp}\nval notE = @{thm notE}\nval notI = @{thm notI}\nval not_all = @{thm not_all}\nval not_ex = @{thm not_ex}\nval not_iff = @{thm not_iff}\nval not_not = @{thm not_not}\nval not_sym = @{thm not_sym}\nval refl = @{thm refl}\nval rev_mp = @{thm rev_mp}\nval spec = @{thm spec}\nval ssubst = @{thm ssubst}\nval subst = @{thm subst}\nval sym = @{thm sym}\nval trans = @{thm trans}\n\\<close>\n\nlocale cnf\nbegin\n\nlemma clause2raw_notE: \"\\<lbrakk>P; \\<not>P\\<rbrakk> \\<Longrightarrow> False\" by auto\nlemma clause2raw_not_disj: \"\\<lbrakk>\\<not> P; \\<not> Q\\<rbrakk> \\<Longrightarrow> \\<not> (P \\<or> Q)\" by auto\nlemma clause2raw_not_not: \"P \\<Longrightarrow> \\<not>\\<not> P\" by auto\n\nlemma iff_refl: \"(P::bool) = P\" by auto\nlemma iff_trans: \"[| (P::bool) = Q; Q = R |] ==> P = R\" by auto\nlemma conj_cong: \"[| P = P'; Q = Q' |] ==> (P \\<and> Q) = (P' \\<and> Q')\" by auto\nlemma disj_cong: \"[| P = P'; Q = Q' |] ==> (P \\<or> Q) = (P' \\<or> Q')\" by auto\n\nlemma make_nnf_imp: \"[| (\\<not>P) = P'; Q = Q' |] ==> (P \\<longrightarrow> Q) = (P' \\<or> Q')\" by auto\nlemma make_nnf_iff: \"[| P = P'; (\\<not>P) = NP; Q = Q'; (\\<not>Q) = NQ |] ==> (P = Q) = ((P' \\<or> NQ) \\<and> (NP \\<or> Q'))\" by auto\nlemma make_nnf_not_false: \"(\\<not>False) = True\" by auto\nlemma make_nnf_not_true: \"(\\<not>True) = False\" by auto\nlemma make_nnf_not_conj: \"[| (\\<not>P) = P'; (\\<not>Q) = Q' |] ==> (\\<not>(P \\<and> Q)) = (P' \\<or> Q')\" by auto\nlemma make_nnf_not_disj: \"[| (\\<not>P) = P'; (\\<not>Q) = Q' |] ==> (\\<not>(P \\<or> Q)) = (P' \\<and> Q')\" by auto\nlemma make_nnf_not_imp: \"[| P = P'; (\\<not>Q) = Q' |] ==> (\\<not>(P \\<longrightarrow> Q)) = (P' \\<and> Q')\" by auto\nlemma make_nnf_not_iff: \"[| P = P'; (\\<not>P) = NP; Q = Q'; (\\<not>Q) = NQ |] ==> (\\<not>(P = Q)) = ((P' \\<or> Q') \\<and> (NP \\<or> NQ))\" by auto\nlemma make_nnf_not_not: \"P = P' ==> (\\<not>\\<not>P) = P'\" by auto\n\nlemma simp_TF_conj_True_l: \"[| P = True; Q = Q' |] ==> (P \\<and> Q) = Q'\" by auto\nlemma simp_TF_conj_True_r: \"[| P = P'; Q = True |] ==> (P \\<and> Q) = P'\" by auto\nlemma simp_TF_conj_False_l: \"P = False ==> (P \\<and> Q) = False\" by auto\nlemma simp_TF_conj_False_r: \"Q = False ==> (P \\<and> Q) = False\" by auto\nlemma simp_TF_disj_True_l: \"P = True ==> (P \\<or> Q) = True\" by auto\nlemma simp_TF_disj_True_r: \"Q = True ==> (P \\<or> Q) = True\" by auto\nlemma simp_TF_disj_False_l: \"[| P = False; Q = Q' |] ==> (P \\<or> Q) = Q'\" by auto\nlemma simp_TF_disj_False_r: \"[| P = P'; Q = False |] ==> (P \\<or> Q) = P'\" by auto\n\nlemma make_cnf_disj_conj_l: \"[| (P \\<or> R) = PR; (Q \\<or> R) = QR |] ==> ((P \\<and> Q) \\<or> R) = (PR \\<and> QR)\" by auto\nlemma make_cnf_disj_conj_r: \"[| (P \\<or> Q) = PQ; (P \\<or> R) = PR |] ==> (P \\<or> (Q \\<and> R)) = (PQ \\<and> PR)\" by auto\n\nlemma make_cnfx_disj_ex_l: \"((\\<exists>(x::bool). P x) \\<or> Q) = (\\<exists>x. P x \\<or> Q)\" by auto\nlemma make_cnfx_disj_ex_r: \"(P \\<or> (\\<exists>(x::bool). Q x)) = (\\<exists>x. P \\<or> Q x)\" by auto\nlemma make_cnfx_newlit: \"(P \\<or> Q) = (\\<exists>x. (P \\<or> x) \\<and> (Q \\<or> \\<not>x))\" by auto\nlemma make_cnfx_ex_cong: \"(\\<forall>(x::bool). P x = Q x) \\<Longrightarrow> (\\<exists>x. P x) = (\\<exists>x. Q x)\" by auto\n\nlemma weakening_thm: \"[| P; Q |] ==> Q\" by auto\n\nlemma cnftac_eq_imp: \"[| P = Q; P |] ==> Q\" by auto\n\nend\n\nML_file \\<open>Tools/cnf.ML\\<close>\n\n\nsection \\<open>\\<open>NO_MATCH\\<close> simproc\\<close>\n\ntext \\<open>\n  The simplification procedure can be used to avoid simplification of terms\n  of a certain form.\n\\<close>\n\ndefinition NO_MATCH :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\"\n  where \"NO_MATCH pat val \\<equiv> True\"\n\nlemma NO_MATCH_cong[cong]: \"NO_MATCH pat val = NO_MATCH pat val\"\n  by (rule refl)\n\ndeclare [[coercion_args NO_MATCH - -]]\n\nsimproc_setup NO_MATCH (\"NO_MATCH pat val\") = \\<open>fn _ => fn ctxt => fn ct =>\n  let\n    val thy = Proof_Context.theory_of ctxt\n    val dest_binop = Term.dest_comb #> apfst (Term.dest_comb #> snd)\n    val m = Pattern.matches thy (dest_binop (Thm.term_of ct))\n  in if m then NONE else SOME @{thm NO_MATCH_def} end\n\\<close>\n\ntext \\<open>\n  This setup ensures that a rewrite rule of the form \\<^term>\\<open>NO_MATCH pat val \\<Longrightarrow> t\\<close>\n  is only applied, if the pattern \\<open>pat\\<close> does not match the value \\<open>val\\<close>.\n\\<close>\n\n\ntext\\<open>\n  Tagging a premise of a simp rule with ASSUMPTION forces the simplifier\n  not to simplify the argument and to solve it by an assumption.\n\\<close>\n\ndefinition ASSUMPTION :: \"bool \\<Rightarrow> bool\"\n  where \"ASSUMPTION A \\<equiv> A\"\n\nlemma ASSUMPTION_cong[cong]: \"ASSUMPTION A = ASSUMPTION A\"\n  by (rule refl)\n\nlemma ASSUMPTION_I: \"A \\<Longrightarrow> ASSUMPTION A\"\n  by (simp add: ASSUMPTION_def)\n\nlemma ASSUMPTION_D: \"ASSUMPTION A \\<Longrightarrow> A\"\n  by (simp add: ASSUMPTION_def)\n\nsetup \\<open>\nlet\n  val asm_sol = mk_solver \"ASSUMPTION\" (fn ctxt =>\n    resolve_tac ctxt [@{thm ASSUMPTION_I}] THEN'\n    resolve_tac ctxt (Simplifier.prems_of ctxt))\nin\n  map_theory_simpset (fn ctxt => Simplifier.addSolver (ctxt,asm_sol))\nend\n\\<close>\n\n\nsubsection \\<open>Code generator setup\\<close>\n\nsubsubsection \\<open>Generic code generator preprocessor setup\\<close>\n\nlemma conj_left_cong: \"P \\<longleftrightarrow> Q \\<Longrightarrow> P \\<and> R \\<longleftrightarrow> Q \\<and> R\"\n  by (fact arg_cong)\n\nlemma disj_left_cong: \"P \\<longleftrightarrow> Q \\<Longrightarrow> P \\<or> R \\<longleftrightarrow> Q \\<or> R\"\n  by (fact arg_cong)\n\nsetup \\<open>\n  Code_Preproc.map_pre (put_simpset HOL_basic_ss) #>\n  Code_Preproc.map_post (put_simpset HOL_basic_ss) #>\n  Code_Simp.map_ss (put_simpset HOL_basic_ss #>\n  Simplifier.add_cong @{thm conj_left_cong} #>\n  Simplifier.add_cong @{thm disj_left_cong})\n\\<close>\n\n\nsubsubsection \\<open>Equality\\<close>\n\nclass equal =\n  fixes equal :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  assumes equal_eq: \"equal x y \\<longleftrightarrow> x = y\"\nbegin\n\nlemma equal: \"equal = (=)\"\n  by (rule ext equal_eq)+\n\nlemma equal_refl: \"equal x x \\<longleftrightarrow> True\"\n  unfolding equal by (rule iffI TrueI refl)+\n\nlemma eq_equal: \"(=) \\<equiv> equal\"\n  by (rule eq_reflection) (rule ext, rule ext, rule sym, rule equal_eq)\n\nend\n\ndeclare eq_equal [symmetric, code_post]\ndeclare eq_equal [code]\n\nsetup \\<open>\n  Code_Preproc.map_pre (fn ctxt =>\n    ctxt addsimprocs\n      [Simplifier.make_simproc \\<^context> \"equal\"\n        {lhss = [\\<^term>\\<open>HOL.eq\\<close>],\n         proc = fn _ => fn _ => fn ct =>\n          (case Thm.term_of ct of\n            Const (_, Type (\\<^type_name>\\<open>fun\\<close>, [Type _, _])) => SOME @{thm eq_equal}\n          | _ => NONE)}])\n\\<close>\n\n\nsubsubsection \\<open>Generic code generator foundation\\<close>\n\ntext \\<open>Datatype \\<^typ>\\<open>bool\\<close>\\<close>\n\ncode_datatype True False\n\n\n\nlemma [code]:\n  shows \"False \\<or> P \\<longleftrightarrow> P\"\n    and \"True \\<or> P \\<longleftrightarrow> True\"\n    and \"P \\<or> False \\<longleftrightarrow> P\"\n    and \"P \\<or> True \\<longleftrightarrow> True\"\n  by simp_all\n\nlemma [code]:\n  shows \"(False \\<longrightarrow> P) \\<longleftrightarrow> True\"\n    and \"(True \\<longrightarrow> P) \\<longleftrightarrow> P\"\n    and \"(P \\<longrightarrow> False) \\<longleftrightarrow> \\<not> P\"\n    and \"(P \\<longrightarrow> True) \\<longleftrightarrow> True\"\n  by simp_all\n\ntext \\<open>More about \\<^typ>\\<open>prop\\<close>\\<close>\n\nlemma [code nbe]:\n  shows \"(True \\<Longrightarrow> PROP Q) \\<equiv> PROP Q\"\n    and \"(PROP Q \\<Longrightarrow> True) \\<equiv> Trueprop True\"\n    and \"(P \\<Longrightarrow> R) \\<equiv> Trueprop (P \\<longrightarrow> R)\"\n  by (auto intro!: equal_intr_rule)\n\nlemma Trueprop_code [code]: \"Trueprop True \\<equiv> Code_Generator.holds\"\n  by (auto intro!: equal_intr_rule holds)\n\ndeclare Trueprop_code [symmetric, code_post]\n\ntext \\<open>Equality\\<close>\n\ndeclare simp_thms(6) [code nbe]\n\ninstantiation itself :: (type) equal\nbegin\n\ndefinition equal_itself :: \"'a itself \\<Rightarrow> 'a itself \\<Rightarrow> bool\"\n  where \"equal_itself x y \\<longleftrightarrow> x = y\"\n\ninstance\n  by standard (fact equal_itself_def)\n\nend\n\nlemma equal_itself_code [code]: \"equal TYPE('a) TYPE('a) \\<longleftrightarrow> True\"\n  by (simp add: equal)\n\nsetup \\<open>Sign.add_const_constraint (\\<^const_name>\\<open>equal\\<close>, SOME \\<^typ>\\<open>'a::type \\<Rightarrow> 'a \\<Rightarrow> bool\\<close>)\\<close>\n\nlemma equal_alias_cert: \"OFCLASS('a, equal_class) \\<equiv> (((=) :: 'a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<equiv> equal)\"\n  (is \"?ofclass \\<equiv> ?equal\")\nproof\n  assume \"PROP ?ofclass\"\n  show \"PROP ?equal\"\n    by (tactic \\<open>ALLGOALS (resolve_tac \\<^context> [Thm.unconstrainT @{thm eq_equal}])\\<close>)\n      (fact \\<open>PROP ?ofclass\\<close>)\nnext\n  assume \"PROP ?equal\"\n  show \"PROP ?ofclass\" proof\n  qed (simp add: \\<open>PROP ?equal\\<close>)\nqed\n\nsetup \\<open>Sign.add_const_constraint (\\<^const_name>\\<open>equal\\<close>, SOME \\<^typ>\\<open>'a::equal \\<Rightarrow> 'a \\<Rightarrow> bool\\<close>)\\<close>\n\nsetup \\<open>Nbe.add_const_alias @{thm equal_alias_cert}\\<close>\n\ntext \\<open>Cases\\<close>\n\nlemma Let_case_cert:\n  assumes \"CASE \\<equiv> (\\<lambda>x. Let x f)\"\n  shows \"CASE x \\<equiv> f x\"\n  using assms by simp_all\n\nsetup \\<open>\n  Code.declare_case_global @{thm Let_case_cert} #>\n  Code.declare_undefined_global \\<^const_name>\\<open>undefined\\<close>\n\\<close>\n\ndeclare [[code abort: undefined]]\n\n\nsubsubsection \\<open>Generic code generator target languages\\<close>\n\ntext \\<open>type \\<^typ>\\<open>bool\\<close>\\<close>\n\ncode_printing\n  type_constructor bool \\<rightharpoonup>\n    (SML) \"bool\" and (OCaml) \"bool\" and (Haskell) \"Bool\" and (Scala) \"Boolean\"\n| constant True \\<rightharpoonup>\n    (SML) \"true\" and (OCaml) \"true\" and (Haskell) \"True\" and (Scala) \"true\"\n| constant False \\<rightharpoonup>\n    (SML) \"false\" and (OCaml) \"false\" and (Haskell) \"False\" and (Scala) \"false\"\n\ncode_reserved SML\n  bool true false\n\ncode_reserved OCaml\n  bool\n\ncode_reserved Scala\n  Boolean\n\ncode_printing\n  constant Not \\<rightharpoonup>\n    (SML) \"not\" and (OCaml) \"not\" and (Haskell) \"not\" and (Scala) \"'! _\"\n| constant HOL.conj \\<rightharpoonup>\n    (SML) infixl 1 \"andalso\" and (OCaml) infixl 3 \"&&\" and (Haskell) infixr 3 \"&&\" and (Scala) infixl 3 \"&&\"\n| constant HOL.disj \\<rightharpoonup>\n    (SML) infixl 0 \"orelse\" and (OCaml) infixl 2 \"||\" and (Haskell) infixl 2 \"||\" and (Scala) infixl 1 \"||\"\n| constant HOL.implies \\<rightharpoonup>\n    (SML) \"!(if (_)/ then (_)/ else true)\"\n    and (OCaml) \"!(if (_)/ then (_)/ else true)\"\n    and (Haskell) \"!(if (_)/ then (_)/ else True)\"\n    and (Scala) \"!(if ((_))/ (_)/ else true)\"\n| constant If \\<rightharpoonup>\n    (SML) \"!(if (_)/ then (_)/ else (_))\"\n    and (OCaml) \"!(if (_)/ then (_)/ else (_))\"\n    and (Haskell) \"!(if (_)/ then (_)/ else (_))\"\n    and (Scala) \"!(if ((_))/ (_)/ else (_))\"\n\ncode_reserved SML\n  not\n\ncode_reserved OCaml\n  not\n\ncode_identifier\n  code_module Pure \\<rightharpoonup>\n    (SML) HOL and (OCaml) HOL and (Haskell) HOL and (Scala) HOL\n\ntext \\<open>Using built-in Haskell equality.\\<close>\ncode_printing\n  type_class equal \\<rightharpoonup> (Haskell) \"Eq\"\n| constant HOL.equal \\<rightharpoonup> (Haskell) infix 4 \"==\"\n| constant HOL.eq \\<rightharpoonup> (Haskell) infix 4 \"==\"\n\ntext \\<open>\\<open>undefined\\<close>\\<close>\ncode_printing\n  constant undefined \\<rightharpoonup>\n    (SML) \"!(raise/ Fail/ \\\"undefined\\\")\"\n    and (OCaml) \"failwith/ \\\"undefined\\\"\"\n    and (Haskell) \"error/ \\\"undefined\\\"\"\n    and (Scala) \"!sys.error(\\\"undefined\\\")\"\n\n\nsubsubsection \\<open>Evaluation and normalization by evaluation\\<close>\n\nmethod_setup eval = \\<open>\n  let\n    fun eval_tac ctxt =\n      let val conv = Code_Runtime.dynamic_holds_conv\n      in\n        CONVERSION (Conv.params_conv ~1 (Conv.concl_conv ~1 o conv) ctxt) THEN'\n        resolve_tac ctxt [TrueI]\n      end\n  in\n    Scan.succeed (SIMPLE_METHOD' o eval_tac)\n  end\n\\<close> \"solve goal by evaluation\"\n\nmethod_setup normalization = \\<open>\n  Scan.succeed (fn ctxt =>\n    SIMPLE_METHOD'\n      (CHANGED_PROP o\n        (CONVERSION (Nbe.dynamic_conv ctxt)\n          THEN_ALL_NEW (TRY o resolve_tac ctxt [TrueI]))))\n\\<close> \"solve goal by normalization\"\n\n\nsubsection \\<open>Counterexample Search Units\\<close>\n\nsubsubsection \\<open>Quickcheck\\<close>\n\nquickcheck_params [size = 5, iterations = 50]\n\n\nsubsubsection \\<open>Nitpick setup\\<close>\n\nnamed_theorems nitpick_unfold \"alternative definitions of constants as needed by Nitpick\"\n  and nitpick_simp \"equational specification of constants as needed by Nitpick\"\n  and nitpick_psimp \"partial equational specification of constants as needed by Nitpick\"\n  and nitpick_choice_spec \"choice specification of constants as needed by Nitpick\"\n\ndeclare if_bool_eq_conj [nitpick_unfold, no_atp]\n  and if_bool_eq_disj [no_atp]\n\n\nsubsection \\<open>Preprocessing for the predicate compiler\\<close>\n\nnamed_theorems code_pred_def \"alternative definitions of constants for the Predicate Compiler\"\n  and code_pred_inline \"inlining definitions for the Predicate Compiler\"\n  and code_pred_simp \"simplification rules for the optimisations in the Predicate Compiler\"\n\n\nsubsection \\<open>Legacy tactics and ML bindings\\<close>\n\nML \\<open>\n  (* combination of (spec RS spec RS ...(j times) ... spec RS mp) *)\n  local\n    fun wrong_prem (Const (\\<^const_name>\\<open>All\\<close>, _) $ Abs (_, _, t)) = wrong_prem t\n      | wrong_prem (Bound _) = true\n      | wrong_prem _ = false;\n    val filter_right = filter (not o wrong_prem o HOLogic.dest_Trueprop o hd o Thm.prems_of);\n    fun smp i = funpow i (fn m => filter_right ([spec] RL m)) [mp];\n  in\n    fun smp_tac ctxt j = EVERY' [dresolve_tac ctxt (smp j), assume_tac ctxt];\n  end;\n\n  local\n    val nnf_ss =\n      simpset_of (put_simpset HOL_basic_ss \\<^context> addsimps @{thms simp_thms nnf_simps});\n  in\n    fun nnf_conv ctxt = Simplifier.rewrite (put_simpset nnf_ss ctxt);\n  end\n\\<close>\n\nhide_const (open) eq equal\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5964331462646255, "lm_q1q2_score": 0.3398790097901846}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Andreas Lochbihler <andreas dot lochbihler at kit.edu>\n    Maintainer:  Andreas Lochbihler <andreas dot lochbihler at kit.edu>\n*)\nsection {* \\isaheader{Set implementation via tries} *}\ntheory TrieSetImpl imports\n  TrieMapImpl\n  \"../gen_algo/SetByMap\"\n  \"../gen_algo/SetGA\"\nbegin\n\n(*@impl Set\n  @type ('a) ts\n  @abbrv ts,t\n  Sets of elements of type @{typ \"'a list\"} implemented by tries.\n*)\n\nsubsection \"Definitions\"\n\ntype_synonym\n  'a ts = \"('a, unit) trie\"\n\nsetup Locale_Code.open_block\ninterpretation ts_sbm: SetByMap tm_basic_ops by unfold_locales\nsetup Locale_Code.close_block\n\ndefinition ts_ops :: \"('a list,'a ts) set_ops\"\n  where [icf_rec_def]:\n  \"ts_ops \\<equiv> ts_sbm.basic.dflt_ops\"\n\nsetup Locale_Code.open_block\ninterpretation ts: StdSet ts_ops\n  unfolding ts_ops_def by (rule ts_sbm.basic.dflt_ops_impl)\ninterpretation ts: StdSet_no_invar ts_ops\n  by unfold_locales (simp add: icf_rec_unf SetByMapDefs.invar_def)\nsetup Locale_Code.close_block\n\nsetup {* ICF_Tools.revert_abbrevs \"ts\"*}\n\nlemmas ts_it_to_it_map_code_unfold[code_unfold] = \n  it_to_it_map_fold'[OF pi_trie]\n\nlemma pi_ts[proper_it]: \"proper_it' ts.iteratei ts.iteratei\"\n  unfolding ts.iteratei_def[abs_def]\n  by (rule proper_it'I icf_proper_iteratorI)+\n\ninterpretation pi_ts: proper_it_loc ts.iteratei ts.iteratei\n  by unfold_locales (rule pi_ts)\n\ndefinition test_codegen where \"test_codegen \\<equiv> (\n  ts.empty,\n  ts.memb,\n  ts.ins,\n  ts.delete,\n  ts.list_it,\n  ts.sng,\n  ts.isEmpty,\n  ts.isSng,\n  ts.ball,\n  ts.bex,\n  ts.size,\n  ts.size_abort,\n  ts.union,\n  ts.union_dj,\n  ts.diff,\n  ts.filter,\n  ts.inter,\n  ts.subset,\n  ts.equal,\n  ts.disjoint,\n  ts.disjoint_witness,\n  ts.sel,\n  ts.to_list,\n  ts.from_list\n)\"\n\nexport_code test_codegen in SML\n\nend\n", "meta": {"author": "andredidier", "repo": "phd", "sha": "113f7c8b360a3914a571db13d9513e313954f4b2", "save_path": "github-repos/isabelle/andredidier-phd", "path": "github-repos/isabelle/andredidier-phd/phd-113f7c8b360a3914a571db13d9513e313954f4b2/thesis/Collections/ICF/impl/TrieSetImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.33987900979018454}}
{"text": "theory R_R_Spark_Obligation\nimports R_R_Spark_User\n\nbegin\n\n\n\nlemma goal2'1: \n  assumes R1: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> R_R_Spark_Declaration.block_index__first''\n            <= R_R_Spark_Declaration.r_values'' I''\n  \"\n  assumes R2: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> R_R_Spark_Declaration.r_values'' I''\n            <= R_R_Spark_Declaration.block_index__last''\n  \"\n  assumes R3: \n  \" R_R_Spark_Declaration.r_values''\n    = ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( R_R_Spark_Declaration.block_permutation___default_arr''\n                                                                                                                                                                    ( R_R_Spark_Declaration.round_index__first''\n                                                                                                                                                                      := (5 :: int)\n                                                                                                                                                                    )\n                                                                                                                                                                  )\n                                                                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (1 :: int)\n                                                                                                                                                                    := (14 :: int)\n                                                                                                                                                                  )\n                                                                                                                                                                )\n                                                                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (2 :: int)\n                                                                                                                                                                  := (7 :: int)\n                                                                                                                                                                )\n                                                                                                                                                              )\n                                                                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (3 :: int)\n                                                                                                                                                                := (0 :: int)\n                                                                                                                                                              )\n                                                                                                                                                            )\n                                                                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (4 :: int)\n                                                                                                                                                              := (9 :: int)\n                                                                                                                                                            )\n                                                                                                                                                          )\n                                                                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (5 :: int)\n                                                                                                                                                            := (2 :: int)\n                                                                                                                                                          )\n                                                                                                                                                        )\n                                                                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (6 :: int)\n                                                                                                                                                          := (11 :: int)\n                                                                                                                                                        )\n                                                                                                                                                      )\n                                                                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (7 :: int)\n                                                                                                                                                        := (4 :: int)\n                                                                                                                                                      )\n                                                                                                                                                    )\n                                                                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (8 :: int)\n                                                                                                                                                      := (13 :: int)\n                                                                                                                                                    )\n                                                                                                                                                  )\n                                                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (9 :: int)\n                                                                                                                                                    := (6 :: int)\n                                                                                                                                                  )\n                                                                                                                                                )\n                                                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (10 :: int)\n                                                                                                                                                  := (15 :: int)\n                                                                                                                                                )\n                                                                                                                                              )\n                                                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (11 :: int)\n                                                                                                                                                := (8 :: int)\n                                                                                                                                              )\n                                                                                                                                            )\n                                                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (12 :: int)\n                                                                                                                                              := (1 :: int)\n                                                                                                                                            )\n                                                                                                                                          )\n                                                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (13 :: int)\n                                                                                                                                            := (10 :: int)\n                                                                                                                                          )\n                                                                                                                                        )\n                                                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (14 :: int)\n                                                                                                                                          := (3 :: int)\n                                                                                                                                        )\n                                                                                                                                      )\n                                                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (15 :: int)\n                                                                                                                                        := (12 :: int)\n                                                                                                                                      )\n                                                                                                                                    )\n                                                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (16 :: int)\n                                                                                                                                      := (6 :: int)\n                                                                                                                                    )\n                                                                                                                                  )\n                                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (17 :: int)\n                                                                                                                                    := (11 :: int)\n                                                                                                                                  )\n                                                                                                                                )\n                                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (18 :: int)\n                                                                                                                                  := (3 :: int)\n                                                                                                                                )\n                                                                                                                              )\n                                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (19 :: int)\n                                                                                                                                := (7 :: int)\n                                                                                                                              )\n                                                                                                                            )\n                                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (20 :: int)\n                                                                                                                              := (0 :: int)\n                                                                                                                            )\n                                                                                                                          )\n                                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (21 :: int)\n                                                                                                                            := (13 :: int)\n                                                                                                                          )\n                                                                                                                        )\n                                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (22 :: int)\n                                                                                                                          := (5 :: int)\n                                                                                                                        )\n                                                                                                                      )\n                                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (23 :: int)\n                                                                                                                        := (10 :: int)\n                                                                                                                      )\n                                                                                                                    )\n                                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (24 :: int)\n                                                                                                                      := (14 :: int)\n                                                                                                                    )\n                                                                                                                  )\n                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (25 :: int)\n                                                                                                                    := (15 :: int)\n                                                                                                                  )\n                                                                                                                )\n                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (26 :: int)\n                                                                                                                  := (8 :: int)\n                                                                                                                )\n                                                                                                              )\n                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (27 :: int)\n                                                                                                                := (12 :: int)\n                                                                                                              )\n                                                                                                            )\n                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (28 :: int)\n                                                                                                              := (4 :: int)\n                                                                                                            )\n                                                                                                          )\n                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (29 :: int)\n                                                                                                            := (9 :: int)\n                                                                                                          )\n                                                                                                        )\n                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (30 :: int)\n                                                                                                          := (1 :: int)\n                                                                                                        )\n                                                                                                      )\n                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (31 :: int)\n                                                                                                        := (2 :: int)\n                                                                                                      )\n                                                                                                    )\n                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (32 :: int)\n                                                                                                      := (15 :: int)\n                                                                                                    )\n                                                                                                  )\n                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (33 :: int)\n                                                                                                    := (5 :: int)\n                                                                                                  )\n                                                                                                )\n                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (34 :: int)\n                                                                                                  := (1 :: int)\n                                                                                                )\n                                                                                              )\n                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (35 :: int)\n                                                                                                := (3 :: int)\n                                                                                              )\n                                                                                            )\n                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (36 :: int)\n                                                                                              := (7 :: int)\n                                                                                            )\n                                                                                          )\n                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (37 :: int)\n                                                                                            := (14 :: int)\n                                                                                          )\n                                                                                        )\n                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (38 :: int)\n                                                                                          := (6 :: int)\n                                                                                        )\n                                                                                      )\n                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (39 :: int)\n                                                                                        := (9 :: int)\n                                                                                      )\n                                                                                    )\n                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (40 :: int)\n                                                                                      := (11 :: int)\n                                                                                    )\n                                                                                  )\n                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (41 :: int)\n                                                                                    := (8 :: int)\n                                                                                  )\n                                                                                )\n                                                                                ( R_R_Spark_Declaration.round_index__first'' + (42 :: int)\n                                                                                  := (12 :: int)\n                                                                                )\n                                                                              )\n                                                                              ( R_R_Spark_Declaration.round_index__first'' + (43 :: int)\n                                                                                := (2 :: int)\n                                                                              )\n                                                                            )\n                                                                            ( R_R_Spark_Declaration.round_index__first'' + (44 :: int)\n                                                                              := (10 :: int)\n                                                                            )\n                                                                          )\n                                                                          ( R_R_Spark_Declaration.round_index__first'' + (45 :: int)\n                                                                            := (0 :: int)\n                                                                          )\n                                                                        )\n                                                                        ( R_R_Spark_Declaration.round_index__first'' + (46 :: int)\n                                                                          := (4 :: int)\n                                                                        )\n                                                                      )\n                                                                      ( R_R_Spark_Declaration.round_index__first'' + (47 :: int)\n                                                                        := (13 :: int)\n                                                                      )\n                                                                    )\n                                                                    ( R_R_Spark_Declaration.round_index__first'' + (48 :: int)\n                                                                      := (8 :: int)\n                                                                    )\n                                                                  )\n                                                                  ( R_R_Spark_Declaration.round_index__first'' + (49 :: int)\n                                                                    := (6 :: int)\n                                                                  )\n                                                                )\n                                                                ( R_R_Spark_Declaration.round_index__first'' + (50 :: int)\n                                                                  := (4 :: int)\n                                                                )\n                                                              )\n                                                              ( R_R_Spark_Declaration.round_index__first'' + (51 :: int)\n                                                                := (1 :: int)\n                                                              )\n                                                            )\n                                                            ( R_R_Spark_Declaration.round_index__first'' + (52 :: int)\n                                                              := (3 :: int)\n                                                            )\n                                                          )\n                                                          ( R_R_Spark_Declaration.round_index__first'' + (53 :: int)\n                                                            := (11 :: int)\n                                                          )\n                                                        )\n                                                        ( R_R_Spark_Declaration.round_index__first'' + (54 :: int)\n                                                          := (15 :: int)\n                                                        )\n                                                      )\n                                                      ( R_R_Spark_Declaration.round_index__first'' + (55 :: int)\n                                                        := (0 :: int)\n                                                      )\n                                                    )\n                                                    ( R_R_Spark_Declaration.round_index__first'' + (56 :: int)\n                                                      := (5 :: int)\n                                                    )\n                                                  )\n                                                  ( R_R_Spark_Declaration.round_index__first'' + (57 :: int)\n                                                    := (12 :: int)\n                                                  )\n                                                )\n                                                ( R_R_Spark_Declaration.round_index__first'' + (58 :: int)\n                                                  := (2 :: int)\n                                                )\n                                              )\n                                              ( R_R_Spark_Declaration.round_index__first'' + (59 :: int)\n                                                := (13 :: int)\n                                              )\n                                            )\n                                            ( R_R_Spark_Declaration.round_index__first'' + (60 :: int)\n                                              := (9 :: int)\n                                            )\n                                          )\n                                          ( R_R_Spark_Declaration.round_index__first'' + (61 :: int)\n                                            := (7 :: int)\n                                          )\n                                        )\n                                        ( R_R_Spark_Declaration.round_index__first'' + (62 :: int)\n                                          := (10 :: int)\n                                        )\n                                      )\n                                      ( R_R_Spark_Declaration.round_index__first'' + (63 :: int)\n                                        := (14 :: int)\n                                      )\n                                    )\n                                    ( R_R_Spark_Declaration.round_index__first'' + (64 :: int)\n                                      := (12 :: int)\n                                    )\n                                  )\n                                  ( R_R_Spark_Declaration.round_index__first'' + (65 :: int)\n                                    := (15 :: int)\n                                  )\n                                )\n                                ( R_R_Spark_Declaration.round_index__first'' + (66 :: int)\n                                  := (10 :: int)\n                                )\n                              )\n                              ( R_R_Spark_Declaration.round_index__first'' + (67 :: int)\n                                := (4 :: int)\n                              )\n                            )\n                            ( R_R_Spark_Declaration.round_index__first'' + (68 :: int)\n                              := (1 :: int)\n                            )\n                          )\n                          ( R_R_Spark_Declaration.round_index__first'' + (69 :: int)\n                            := (5 :: int)\n                          )\n                        )\n                        ( R_R_Spark_Declaration.round_index__first'' + (70 :: int)\n                          := (8 :: int)\n                        )\n                      )\n                      ( R_R_Spark_Declaration.round_index__first'' + (71 :: int)\n                        := (7 :: int)\n                      )\n                    )\n                    ( R_R_Spark_Declaration.round_index__first'' + (72 :: int)\n                      := (6 :: int)\n                    )\n                  )\n                  ( R_R_Spark_Declaration.round_index__first'' + (73 :: int)\n                    := (2 :: int)\n                  )\n                )\n                ( R_R_Spark_Declaration.round_index__first'' + (74 :: int)\n                  := (13 :: int)\n                )\n              )\n              ( R_R_Spark_Declaration.round_index__first'' + (75 :: int)\n                := (14 :: int)\n              )\n            )\n            ( R_R_Spark_Declaration.round_index__first'' + (76 :: int)\n              := (0 :: int)\n            )\n          )\n          ( R_R_Spark_Declaration.round_index__first'' + (77 :: int)\n            := (3 :: int)\n          )\n        )\n        ( R_R_Spark_Declaration.round_index__first'' + (78 :: int)\n          := (9 :: int)\n        )\n      )\n      ( R_R_Spark_Declaration.round_index__first'' + (79 :: int)\n        := (11 :: int)\n      )\n  \"\n  assumes R4: \n  \" (0 :: int) <= R_R_Spark_Declaration.block_index__size''\n  \"\n  assumes R5: \n  \" R_R_Spark_Declaration.block_index__first'' = (0 :: int)\n  \"\n  assumes R6: \n  \" R_R_Spark_Declaration.block_index__last'' = (15 :: int)\n  \"\n  assumes R7: \n  \" R_R_Spark_Declaration.block_index__base__first''\n    <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes R8: \n  \" R_R_Spark_Declaration.block_index__base__first''\n    <= R_R_Spark_Declaration.block_index__first''\n  \"\n  assumes R9: \n  \" R_R_Spark_Declaration.block_index__last''\n    <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes R10: \n  \" (0 :: int) <= R_R_Spark_Declaration.round_index__size''\n  \"\n  assumes R11: \n  \" R_R_Spark_Declaration.round_index__first'' = (0 :: int)\n  \"\n  assumes R12: \n  \" R_R_Spark_Declaration.round_index__last'' = (79 :: int)\n  \"\n  assumes R13: \n  \" R_R_Spark_Declaration.round_index__base__first''\n    <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R14: \n  \" R_R_Spark_Declaration.round_index__base__first''\n    <= R_R_Spark_Declaration.round_index__first''\n  \"\n  assumes R15: \n  \" R_R_Spark_Declaration.round_index__last''\n    <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R16: \n  \" ALL ( i1'' :: int ) ( v'' :: int )\n    .   ( R_R_Spark_Declaration.block_permutation___mk_const_arr' v'' ) i1''\n        = v''\n  \"\n  assumes H1: \" (0 :: int) <= R_R_Spark_Declaration.j'' \"\n  assumes H2: \" R_R_Spark_Declaration.j'' <= (79 :: int) \"\n  assumes H3: \n  \" (0 :: int) <= R_R_Spark_Declaration.block_index__size''\n  \"\n  assumes H4: \n  \" R_R_Spark_Declaration.block_index__base__first''\n    <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes H5: \n  \" (0 :: int) <= R_R_Spark_Declaration.round_index__size''\n  \"\n  assumes H6: \n  \" R_R_Spark_Declaration.round_index__base__first''\n    <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes H7: \n  \" R_R_Spark_Declaration.block_index__base__first'' <= (0 :: int)\n  \"\n  assumes H8: \n  \" (15 :: int) <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes H9: \n  \" R_R_Spark_Declaration.round_index__base__first'' <= (0 :: int)\n  \"\n  assumes H10: \n  \" (79 :: int) <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  shows \" ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( R_R_Spark_Declaration.block_permutation___default_arr''\n                                                                                                                                                                          ( (0 :: int)\n                                                                                                                                                                            := (5 :: int)\n                                                                                                                                                                          )\n                                                                                                                                                                        )\n                                                                                                                                                                        ( (1 :: int)\n                                                                                                                                                                          := (14 :: int)\n                                                                                                                                                                        )\n                                                                                                                                                                      )\n                                                                                                                                                                      ( (2 :: int)\n                                                                                                                                                                        := (7 :: int)\n                                                                                                                                                                      )\n                                                                                                                                                                    )\n                                                                                                                                                                    ( (3 :: int)\n                                                                                                                                                                      := (0 :: int)\n                                                                                                                                                                    )\n                                                                                                                                                                  )\n                                                                                                                                                                  ( (4 :: int)\n                                                                                                                                                                    := (9 :: int)\n                                                                                                                                                                  )\n                                                                                                                                                                )\n                                                                                                                                                                ( (5 :: int)\n                                                                                                                                                                  := (2 :: int)\n                                                                                                                                                                )\n                                                                                                                                                              )\n                                                                                                                                                              ( (6 :: int)\n                                                                                                                                                                := (11 :: int)\n                                                                                                                                                              )\n                                                                                                                                                            )\n                                                                                                                                                            ( (7 :: int)\n                                                                                                                                                              := (4 :: int)\n                                                                                                                                                            )\n                                                                                                                                                          )\n                                                                                                                                                          ( (8 :: int)\n                                                                                                                                                            := (13 :: int)\n                                                                                                                                                          )\n                                                                                                                                                        )\n                                                                                                                                                        ( (9 :: int)\n                                                                                                                                                          := (6 :: int)\n                                                                                                                                                        )\n                                                                                                                                                      )\n                                                                                                                                                      ( (10 :: int)\n                                                                                                                                                        := (15 :: int)\n                                                                                                                                                      )\n                                                                                                                                                    )\n                                                                                                                                                    ( (11 :: int)\n                                                                                                                                                      := (8 :: int)\n                                                                                                                                                    )\n                                                                                                                                                  )\n                                                                                                                                                  ( (12 :: int)\n                                                                                                                                                    := (1 :: int)\n                                                                                                                                                  )\n                                                                                                                                                )\n                                                                                                                                                ( (13 :: int)\n                                                                                                                                                  := (10 :: int)\n                                                                                                                                                )\n                                                                                                                                              )\n                                                                                                                                              ( (14 :: int)\n                                                                                                                                                := (3 :: int)\n                                                                                                                                              )\n                                                                                                                                            )\n                                                                                                                                            ( (15 :: int)\n                                                                                                                                              := (12 :: int)\n                                                                                                                                            )\n                                                                                                                                          )\n                                                                                                                                          ( (16 :: int)\n                                                                                                                                            := (6 :: int)\n                                                                                                                                          )\n                                                                                                                                        )\n                                                                                                                                        ( (17 :: int)\n                                                                                                                                          := (11 :: int)\n                                                                                                                                        )\n                                                                                                                                      )\n                                                                                                                                      ( (18 :: int)\n                                                                                                                                        := (3 :: int)\n                                                                                                                                      )\n                                                                                                                                    )\n                                                                                                                                    ( (19 :: int)\n                                                                                                                                      := (7 :: int)\n                                                                                                                                    )\n                                                                                                                                  )\n                                                                                                                                  ( (20 :: int)\n                                                                                                                                    := (0 :: int)\n                                                                                                                                  )\n                                                                                                                                )\n                                                                                                                                ( (21 :: int)\n                                                                                                                                  := (13 :: int)\n                                                                                                                                )\n                                                                                                                              )\n                                                                                                                              ( (22 :: int)\n                                                                                                                                := (5 :: int)\n                                                                                                                              )\n                                                                                                                            )\n                                                                                                                            ( (23 :: int)\n                                                                                                                              := (10 :: int)\n                                                                                                                            )\n                                                                                                                          )\n                                                                                                                          ( (24 :: int)\n                                                                                                                            := (14 :: int)\n                                                                                                                          )\n                                                                                                                        )\n                                                                                                                        ( (25 :: int)\n                                                                                                                          := (15 :: int)\n                                                                                                                        )\n                                                                                                                      )\n                                                                                                                      ( (26 :: int)\n                                                                                                                        := (8 :: int)\n                                                                                                                      )\n                                                                                                                    )\n                                                                                                                    ( (27 :: int)\n                                                                                                                      := (12 :: int)\n                                                                                                                    )\n                                                                                                                  )\n                                                                                                                  ( (28 :: int)\n                                                                                                                    := (4 :: int)\n                                                                                                                  )\n                                                                                                                )\n                                                                                                                ( (29 :: int)\n                                                                                                                  := (9 :: int)\n                                                                                                                )\n                                                                                                              )\n                                                                                                              ( (30 :: int)\n                                                                                                                := (1 :: int)\n                                                                                                              )\n                                                                                                            )\n                                                                                                            ( (31 :: int)\n                                                                                                              := (2 :: int)\n                                                                                                            )\n                                                                                                          )\n                                                                                                          ( (32 :: int)\n                                                                                                            := (15 :: int)\n                                                                                                          )\n                                                                                                        )\n                                                                                                        ( (33 :: int)\n                                                                                                          := (5 :: int)\n                                                                                                        )\n                                                                                                      )\n                                                                                                      ( (34 :: int)\n                                                                                                        := (1 :: int)\n                                                                                                      )\n                                                                                                    )\n                                                                                                    ( (35 :: int)\n                                                                                                      := (3 :: int)\n                                                                                                    )\n                                                                                                  )\n                                                                                                  ( (36 :: int)\n                                                                                                    := (7 :: int)\n                                                                                                  )\n                                                                                                )\n                                                                                                ( (37 :: int)\n                                                                                                  := (14 :: int)\n                                                                                                )\n                                                                                              )\n                                                                                              ( (38 :: int)\n                                                                                                := (6 :: int)\n                                                                                              )\n                                                                                            )\n                                                                                            ( (39 :: int)\n                                                                                              := (9 :: int)\n                                                                                            )\n                                                                                          )\n                                                                                          ( (40 :: int)\n                                                                                            := (11 :: int)\n                                                                                          )\n                                                                                        )\n                                                                                        ( (41 :: int)\n                                                                                          := (8 :: int)\n                                                                                        )\n                                                                                      )\n                                                                                      ( (42 :: int)\n                                                                                        := (12 :: int)\n                                                                                      )\n                                                                                    )\n                                                                                    ( (43 :: int)\n                                                                                      := (2 :: int)\n                                                                                    )\n                                                                                  )\n                                                                                  ( (44 :: int)\n                                                                                    := (10 :: int)\n                                                                                  )\n                                                                                )\n                                                                                ( (45 :: int)\n                                                                                  := (0 :: int)\n                                                                                )\n                                                                              )\n                                                                              ( (46 :: int)\n                                                                                := (4 :: int)\n                                                                              )\n                                                                            )\n                                                                            ( (47 :: int)\n                                                                              := (13 :: int)\n                                                                            )\n                                                                          )\n                                                                          ( (48 :: int)\n                                                                            := (8 :: int)\n                                                                          )\n                                                                        )\n                                                                        ( (49 :: int)\n                                                                          := (6 :: int)\n                                                                        )\n                                                                      )\n                                                                      ( (50 :: int)\n                                                                        := (4 :: int)\n                                                                      )\n                                                                    )\n                                                                    ( (51 :: int)\n                                                                      := (1 :: int)\n                                                                    )\n                                                                  )\n                                                                  ( (52 :: int)\n                                                                    := (3 :: int)\n                                                                  )\n                                                                )\n                                                                ( (53 :: int)\n                                                                  := (11 :: int)\n                                                                )\n                                                              )\n                                                              ( (54 :: int)\n                                                                := (15 :: int)\n                                                              )\n                                                            )\n                                                            ( (55 :: int)\n                                                              := (0 :: int)\n                                                            )\n                                                          )\n                                                          ( (56 :: int)\n                                                            := (5 :: int)\n                                                          )\n                                                        )\n                                                        ( (57 :: int)\n                                                          := (12 :: int)\n                                                        )\n                                                      )\n                                                      ( (58 :: int)\n                                                        := (2 :: int)\n                                                      )\n                                                    )\n                                                    ( (59 :: int)\n                                                      := (13 :: int)\n                                                    )\n                                                  )\n                                                  ( (60 :: int)\n                                                    := (9 :: int)\n                                                  )\n                                                )\n                                                ( (61 :: int)\n                                                  := (7 :: int)\n                                                )\n                                              )\n                                              ( (62 :: int)\n                                                := (10 :: int)\n                                              )\n                                            )\n                                            ( (63 :: int)\n                                              := (14 :: int)\n                                            )\n                                          )\n                                          ( (64 :: int)\n                                            := (12 :: int)\n                                          )\n                                        )\n                                        ( (65 :: int)\n                                          := (15 :: int)\n                                        )\n                                      )\n                                      ( (66 :: int)\n                                        := (10 :: int)\n                                      )\n                                    )\n                                    ( (67 :: int)\n                                      := (4 :: int)\n                                    )\n                                  )\n                                  ( (68 :: int)\n                                    := (1 :: int)\n                                  )\n                                )\n                                ( (69 :: int)\n                                  := (5 :: int)\n                                )\n                              )\n                              ( (70 :: int)\n                                := (8 :: int)\n                              )\n                            )\n                            ( (71 :: int)\n                              := (7 :: int)\n                            )\n                          )\n                          ( (72 :: int)\n                            := (6 :: int)\n                          )\n                        )\n                        ( (73 :: int)\n                          := (2 :: int)\n                        )\n                      )\n                      ( (74 :: int)\n                        := (13 :: int)\n                      )\n                    )\n                    ( (75 :: int)\n                      := (14 :: int)\n                    )\n                  )\n                  ( (76 :: int)\n                    := (0 :: int)\n                  )\n                )\n                ( (77 :: int)\n                  := (3 :: int)\n                )\n              )\n              ( (78 :: int)\n                := (9 :: int)\n              )\n            )\n            ( (79 :: int)\n              := (11 :: int)\n            )\n          )\n            R_R_Spark_Declaration.j''\n          = R_R_Spark_Specification.r_r' R_R_Spark_Declaration.j''\n        \" (is \"?C1\")\napply (insert assms) by (rule userlemmas)\n\nlemma goal2'2: \n  assumes R1: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> R_R_Spark_Declaration.block_index__first''\n            <= R_R_Spark_Declaration.r_values'' I''\n  \"\n  assumes R2: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> R_R_Spark_Declaration.r_values'' I''\n            <= R_R_Spark_Declaration.block_index__last''\n  \"\n  assumes R3: \n  \" R_R_Spark_Declaration.r_values''\n    = ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( R_R_Spark_Declaration.block_permutation___default_arr''\n                                                                                                                                                                    ( R_R_Spark_Declaration.round_index__first''\n                                                                                                                                                                      := (5 :: int)\n                                                                                                                                                                    )\n                                                                                                                                                                  )\n                                                                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (1 :: int)\n                                                                                                                                                                    := (14 :: int)\n                                                                                                                                                                  )\n                                                                                                                                                                )\n                                                                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (2 :: int)\n                                                                                                                                                                  := (7 :: int)\n                                                                                                                                                                )\n                                                                                                                                                              )\n                                                                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (3 :: int)\n                                                                                                                                                                := (0 :: int)\n                                                                                                                                                              )\n                                                                                                                                                            )\n                                                                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (4 :: int)\n                                                                                                                                                              := (9 :: int)\n                                                                                                                                                            )\n                                                                                                                                                          )\n                                                                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (5 :: int)\n                                                                                                                                                            := (2 :: int)\n                                                                                                                                                          )\n                                                                                                                                                        )\n                                                                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (6 :: int)\n                                                                                                                                                          := (11 :: int)\n                                                                                                                                                        )\n                                                                                                                                                      )\n                                                                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (7 :: int)\n                                                                                                                                                        := (4 :: int)\n                                                                                                                                                      )\n                                                                                                                                                    )\n                                                                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (8 :: int)\n                                                                                                                                                      := (13 :: int)\n                                                                                                                                                    )\n                                                                                                                                                  )\n                                                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (9 :: int)\n                                                                                                                                                    := (6 :: int)\n                                                                                                                                                  )\n                                                                                                                                                )\n                                                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (10 :: int)\n                                                                                                                                                  := (15 :: int)\n                                                                                                                                                )\n                                                                                                                                              )\n                                                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (11 :: int)\n                                                                                                                                                := (8 :: int)\n                                                                                                                                              )\n                                                                                                                                            )\n                                                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (12 :: int)\n                                                                                                                                              := (1 :: int)\n                                                                                                                                            )\n                                                                                                                                          )\n                                                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (13 :: int)\n                                                                                                                                            := (10 :: int)\n                                                                                                                                          )\n                                                                                                                                        )\n                                                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (14 :: int)\n                                                                                                                                          := (3 :: int)\n                                                                                                                                        )\n                                                                                                                                      )\n                                                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (15 :: int)\n                                                                                                                                        := (12 :: int)\n                                                                                                                                      )\n                                                                                                                                    )\n                                                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (16 :: int)\n                                                                                                                                      := (6 :: int)\n                                                                                                                                    )\n                                                                                                                                  )\n                                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (17 :: int)\n                                                                                                                                    := (11 :: int)\n                                                                                                                                  )\n                                                                                                                                )\n                                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (18 :: int)\n                                                                                                                                  := (3 :: int)\n                                                                                                                                )\n                                                                                                                              )\n                                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (19 :: int)\n                                                                                                                                := (7 :: int)\n                                                                                                                              )\n                                                                                                                            )\n                                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (20 :: int)\n                                                                                                                              := (0 :: int)\n                                                                                                                            )\n                                                                                                                          )\n                                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (21 :: int)\n                                                                                                                            := (13 :: int)\n                                                                                                                          )\n                                                                                                                        )\n                                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (22 :: int)\n                                                                                                                          := (5 :: int)\n                                                                                                                        )\n                                                                                                                      )\n                                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (23 :: int)\n                                                                                                                        := (10 :: int)\n                                                                                                                      )\n                                                                                                                    )\n                                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (24 :: int)\n                                                                                                                      := (14 :: int)\n                                                                                                                    )\n                                                                                                                  )\n                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (25 :: int)\n                                                                                                                    := (15 :: int)\n                                                                                                                  )\n                                                                                                                )\n                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (26 :: int)\n                                                                                                                  := (8 :: int)\n                                                                                                                )\n                                                                                                              )\n                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (27 :: int)\n                                                                                                                := (12 :: int)\n                                                                                                              )\n                                                                                                            )\n                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (28 :: int)\n                                                                                                              := (4 :: int)\n                                                                                                            )\n                                                                                                          )\n                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (29 :: int)\n                                                                                                            := (9 :: int)\n                                                                                                          )\n                                                                                                        )\n                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (30 :: int)\n                                                                                                          := (1 :: int)\n                                                                                                        )\n                                                                                                      )\n                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (31 :: int)\n                                                                                                        := (2 :: int)\n                                                                                                      )\n                                                                                                    )\n                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (32 :: int)\n                                                                                                      := (15 :: int)\n                                                                                                    )\n                                                                                                  )\n                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (33 :: int)\n                                                                                                    := (5 :: int)\n                                                                                                  )\n                                                                                                )\n                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (34 :: int)\n                                                                                                  := (1 :: int)\n                                                                                                )\n                                                                                              )\n                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (35 :: int)\n                                                                                                := (3 :: int)\n                                                                                              )\n                                                                                            )\n                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (36 :: int)\n                                                                                              := (7 :: int)\n                                                                                            )\n                                                                                          )\n                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (37 :: int)\n                                                                                            := (14 :: int)\n                                                                                          )\n                                                                                        )\n                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (38 :: int)\n                                                                                          := (6 :: int)\n                                                                                        )\n                                                                                      )\n                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (39 :: int)\n                                                                                        := (9 :: int)\n                                                                                      )\n                                                                                    )\n                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (40 :: int)\n                                                                                      := (11 :: int)\n                                                                                    )\n                                                                                  )\n                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (41 :: int)\n                                                                                    := (8 :: int)\n                                                                                  )\n                                                                                )\n                                                                                ( R_R_Spark_Declaration.round_index__first'' + (42 :: int)\n                                                                                  := (12 :: int)\n                                                                                )\n                                                                              )\n                                                                              ( R_R_Spark_Declaration.round_index__first'' + (43 :: int)\n                                                                                := (2 :: int)\n                                                                              )\n                                                                            )\n                                                                            ( R_R_Spark_Declaration.round_index__first'' + (44 :: int)\n                                                                              := (10 :: int)\n                                                                            )\n                                                                          )\n                                                                          ( R_R_Spark_Declaration.round_index__first'' + (45 :: int)\n                                                                            := (0 :: int)\n                                                                          )\n                                                                        )\n                                                                        ( R_R_Spark_Declaration.round_index__first'' + (46 :: int)\n                                                                          := (4 :: int)\n                                                                        )\n                                                                      )\n                                                                      ( R_R_Spark_Declaration.round_index__first'' + (47 :: int)\n                                                                        := (13 :: int)\n                                                                      )\n                                                                    )\n                                                                    ( R_R_Spark_Declaration.round_index__first'' + (48 :: int)\n                                                                      := (8 :: int)\n                                                                    )\n                                                                  )\n                                                                  ( R_R_Spark_Declaration.round_index__first'' + (49 :: int)\n                                                                    := (6 :: int)\n                                                                  )\n                                                                )\n                                                                ( R_R_Spark_Declaration.round_index__first'' + (50 :: int)\n                                                                  := (4 :: int)\n                                                                )\n                                                              )\n                                                              ( R_R_Spark_Declaration.round_index__first'' + (51 :: int)\n                                                                := (1 :: int)\n                                                              )\n                                                            )\n                                                            ( R_R_Spark_Declaration.round_index__first'' + (52 :: int)\n                                                              := (3 :: int)\n                                                            )\n                                                          )\n                                                          ( R_R_Spark_Declaration.round_index__first'' + (53 :: int)\n                                                            := (11 :: int)\n                                                          )\n                                                        )\n                                                        ( R_R_Spark_Declaration.round_index__first'' + (54 :: int)\n                                                          := (15 :: int)\n                                                        )\n                                                      )\n                                                      ( R_R_Spark_Declaration.round_index__first'' + (55 :: int)\n                                                        := (0 :: int)\n                                                      )\n                                                    )\n                                                    ( R_R_Spark_Declaration.round_index__first'' + (56 :: int)\n                                                      := (5 :: int)\n                                                    )\n                                                  )\n                                                  ( R_R_Spark_Declaration.round_index__first'' + (57 :: int)\n                                                    := (12 :: int)\n                                                  )\n                                                )\n                                                ( R_R_Spark_Declaration.round_index__first'' + (58 :: int)\n                                                  := (2 :: int)\n                                                )\n                                              )\n                                              ( R_R_Spark_Declaration.round_index__first'' + (59 :: int)\n                                                := (13 :: int)\n                                              )\n                                            )\n                                            ( R_R_Spark_Declaration.round_index__first'' + (60 :: int)\n                                              := (9 :: int)\n                                            )\n                                          )\n                                          ( R_R_Spark_Declaration.round_index__first'' + (61 :: int)\n                                            := (7 :: int)\n                                          )\n                                        )\n                                        ( R_R_Spark_Declaration.round_index__first'' + (62 :: int)\n                                          := (10 :: int)\n                                        )\n                                      )\n                                      ( R_R_Spark_Declaration.round_index__first'' + (63 :: int)\n                                        := (14 :: int)\n                                      )\n                                    )\n                                    ( R_R_Spark_Declaration.round_index__first'' + (64 :: int)\n                                      := (12 :: int)\n                                    )\n                                  )\n                                  ( R_R_Spark_Declaration.round_index__first'' + (65 :: int)\n                                    := (15 :: int)\n                                  )\n                                )\n                                ( R_R_Spark_Declaration.round_index__first'' + (66 :: int)\n                                  := (10 :: int)\n                                )\n                              )\n                              ( R_R_Spark_Declaration.round_index__first'' + (67 :: int)\n                                := (4 :: int)\n                              )\n                            )\n                            ( R_R_Spark_Declaration.round_index__first'' + (68 :: int)\n                              := (1 :: int)\n                            )\n                          )\n                          ( R_R_Spark_Declaration.round_index__first'' + (69 :: int)\n                            := (5 :: int)\n                          )\n                        )\n                        ( R_R_Spark_Declaration.round_index__first'' + (70 :: int)\n                          := (8 :: int)\n                        )\n                      )\n                      ( R_R_Spark_Declaration.round_index__first'' + (71 :: int)\n                        := (7 :: int)\n                      )\n                    )\n                    ( R_R_Spark_Declaration.round_index__first'' + (72 :: int)\n                      := (6 :: int)\n                    )\n                  )\n                  ( R_R_Spark_Declaration.round_index__first'' + (73 :: int)\n                    := (2 :: int)\n                  )\n                )\n                ( R_R_Spark_Declaration.round_index__first'' + (74 :: int)\n                  := (13 :: int)\n                )\n              )\n              ( R_R_Spark_Declaration.round_index__first'' + (75 :: int)\n                := (14 :: int)\n              )\n            )\n            ( R_R_Spark_Declaration.round_index__first'' + (76 :: int)\n              := (0 :: int)\n            )\n          )\n          ( R_R_Spark_Declaration.round_index__first'' + (77 :: int)\n            := (3 :: int)\n          )\n        )\n        ( R_R_Spark_Declaration.round_index__first'' + (78 :: int)\n          := (9 :: int)\n        )\n      )\n      ( R_R_Spark_Declaration.round_index__first'' + (79 :: int)\n        := (11 :: int)\n      )\n  \"\n  assumes R4: \n  \" (0 :: int) <= R_R_Spark_Declaration.block_index__size''\n  \"\n  assumes R5: \n  \" R_R_Spark_Declaration.block_index__first'' = (0 :: int)\n  \"\n  assumes R6: \n  \" R_R_Spark_Declaration.block_index__last'' = (15 :: int)\n  \"\n  assumes R7: \n  \" R_R_Spark_Declaration.block_index__base__first''\n    <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes R8: \n  \" R_R_Spark_Declaration.block_index__base__first''\n    <= R_R_Spark_Declaration.block_index__first''\n  \"\n  assumes R9: \n  \" R_R_Spark_Declaration.block_index__last''\n    <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes R10: \n  \" (0 :: int) <= R_R_Spark_Declaration.round_index__size''\n  \"\n  assumes R11: \n  \" R_R_Spark_Declaration.round_index__first'' = (0 :: int)\n  \"\n  assumes R12: \n  \" R_R_Spark_Declaration.round_index__last'' = (79 :: int)\n  \"\n  assumes R13: \n  \" R_R_Spark_Declaration.round_index__base__first''\n    <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R14: \n  \" R_R_Spark_Declaration.round_index__base__first''\n    <= R_R_Spark_Declaration.round_index__first''\n  \"\n  assumes R15: \n  \" R_R_Spark_Declaration.round_index__last''\n    <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R16: \n  \" ALL ( i1'' :: int ) ( v'' :: int )\n    .   ( R_R_Spark_Declaration.block_permutation___mk_const_arr' v'' ) i1''\n        = v''\n  \"\n  assumes H1: \" (0 :: int) <= R_R_Spark_Declaration.j'' \"\n  assumes H2: \" R_R_Spark_Declaration.j'' <= (79 :: int) \"\n  assumes H3: \n  \" (0 :: int) <= R_R_Spark_Declaration.block_index__size''\n  \"\n  assumes H4: \n  \" R_R_Spark_Declaration.block_index__base__first''\n    <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes H5: \n  \" (0 :: int) <= R_R_Spark_Declaration.round_index__size''\n  \"\n  assumes H6: \n  \" R_R_Spark_Declaration.round_index__base__first''\n    <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes H7: \n  \" R_R_Spark_Declaration.block_index__base__first'' <= (0 :: int)\n  \"\n  assumes H8: \n  \" (15 :: int) <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes H9: \n  \" R_R_Spark_Declaration.round_index__base__first'' <= (0 :: int)\n  \"\n  assumes H10: \n  \" (79 :: int) <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  shows \" (0 :: int)\n          <= ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( R_R_Spark_Declaration.block_permutation___default_arr''\n                                                                                                                                                                             ( (0 :: int)\n                                                                                                                                                                               := (5 :: int)\n                                                                                                                                                                             )\n                                                                                                                                                                           )\n                                                                                                                                                                           ( (1 :: int)\n                                                                                                                                                                             := (14 :: int)\n                                                                                                                                                                           )\n                                                                                                                                                                         )\n                                                                                                                                                                         ( (2 :: int)\n                                                                                                                                                                           := (7 :: int)\n                                                                                                                                                                         )\n                                                                                                                                                                       )\n                                                                                                                                                                       ( (3 :: int)\n                                                                                                                                                                         := (0 :: int)\n                                                                                                                                                                       )\n                                                                                                                                                                     )\n                                                                                                                                                                     ( (4 :: int)\n                                                                                                                                                                       := (9 :: int)\n                                                                                                                                                                     )\n                                                                                                                                                                   )\n                                                                                                                                                                   ( (5 :: int)\n                                                                                                                                                                     := (2 :: int)\n                                                                                                                                                                   )\n                                                                                                                                                                 )\n                                                                                                                                                                 ( (6 :: int)\n                                                                                                                                                                   := (11 :: int)\n                                                                                                                                                                 )\n                                                                                                                                                               )\n                                                                                                                                                               ( (7 :: int)\n                                                                                                                                                                 := (4 :: int)\n                                                                                                                                                               )\n                                                                                                                                                             )\n                                                                                                                                                             ( (8 :: int)\n                                                                                                                                                               := (13 :: int)\n                                                                                                                                                             )\n                                                                                                                                                           )\n                                                                                                                                                           ( (9 :: int)\n                                                                                                                                                             := (6 :: int)\n                                                                                                                                                           )\n                                                                                                                                                         )\n                                                                                                                                                         ( (10 :: int)\n                                                                                                                                                           := (15 :: int)\n                                                                                                                                                         )\n                                                                                                                                                       )\n                                                                                                                                                       ( (11 :: int)\n                                                                                                                                                         := (8 :: int)\n                                                                                                                                                       )\n                                                                                                                                                     )\n                                                                                                                                                     ( (12 :: int)\n                                                                                                                                                       := (1 :: int)\n                                                                                                                                                     )\n                                                                                                                                                   )\n                                                                                                                                                   ( (13 :: int)\n                                                                                                                                                     := (10 :: int)\n                                                                                                                                                   )\n                                                                                                                                                 )\n                                                                                                                                                 ( (14 :: int)\n                                                                                                                                                   := (3 :: int)\n                                                                                                                                                 )\n                                                                                                                                               )\n                                                                                                                                               ( (15 :: int)\n                                                                                                                                                 := (12 :: int)\n                                                                                                                                               )\n                                                                                                                                             )\n                                                                                                                                             ( (16 :: int)\n                                                                                                                                               := (6 :: int)\n                                                                                                                                             )\n                                                                                                                                           )\n                                                                                                                                           ( (17 :: int)\n                                                                                                                                             := (11 :: int)\n                                                                                                                                           )\n                                                                                                                                         )\n                                                                                                                                         ( (18 :: int)\n                                                                                                                                           := (3 :: int)\n                                                                                                                                         )\n                                                                                                                                       )\n                                                                                                                                       ( (19 :: int)\n                                                                                                                                         := (7 :: int)\n                                                                                                                                       )\n                                                                                                                                     )\n                                                                                                                                     ( (20 :: int)\n                                                                                                                                       := (0 :: int)\n                                                                                                                                     )\n                                                                                                                                   )\n                                                                                                                                   ( (21 :: int)\n                                                                                                                                     := (13 :: int)\n                                                                                                                                   )\n                                                                                                                                 )\n                                                                                                                                 ( (22 :: int)\n                                                                                                                                   := (5 :: int)\n                                                                                                                                 )\n                                                                                                                               )\n                                                                                                                               ( (23 :: int)\n                                                                                                                                 := (10 :: int)\n                                                                                                                               )\n                                                                                                                             )\n                                                                                                                             ( (24 :: int)\n                                                                                                                               := (14 :: int)\n                                                                                                                             )\n                                                                                                                           )\n                                                                                                                           ( (25 :: int)\n                                                                                                                             := (15 :: int)\n                                                                                                                           )\n                                                                                                                         )\n                                                                                                                         ( (26 :: int)\n                                                                                                                           := (8 :: int)\n                                                                                                                         )\n                                                                                                                       )\n                                                                                                                       ( (27 :: int)\n                                                                                                                         := (12 :: int)\n                                                                                                                       )\n                                                                                                                     )\n                                                                                                                     ( (28 :: int)\n                                                                                                                       := (4 :: int)\n                                                                                                                     )\n                                                                                                                   )\n                                                                                                                   ( (29 :: int)\n                                                                                                                     := (9 :: int)\n                                                                                                                   )\n                                                                                                                 )\n                                                                                                                 ( (30 :: int)\n                                                                                                                   := (1 :: int)\n                                                                                                                 )\n                                                                                                               )\n                                                                                                               ( (31 :: int)\n                                                                                                                 := (2 :: int)\n                                                                                                               )\n                                                                                                             )\n                                                                                                             ( (32 :: int)\n                                                                                                               := (15 :: int)\n                                                                                                             )\n                                                                                                           )\n                                                                                                           ( (33 :: int)\n                                                                                                             := (5 :: int)\n                                                                                                           )\n                                                                                                         )\n                                                                                                         ( (34 :: int)\n                                                                                                           := (1 :: int)\n                                                                                                         )\n                                                                                                       )\n                                                                                                       ( (35 :: int)\n                                                                                                         := (3 :: int)\n                                                                                                       )\n                                                                                                     )\n                                                                                                     ( (36 :: int)\n                                                                                                       := (7 :: int)\n                                                                                                     )\n                                                                                                   )\n                                                                                                   ( (37 :: int)\n                                                                                                     := (14 :: int)\n                                                                                                   )\n                                                                                                 )\n                                                                                                 ( (38 :: int)\n                                                                                                   := (6 :: int)\n                                                                                                 )\n                                                                                               )\n                                                                                               ( (39 :: int)\n                                                                                                 := (9 :: int)\n                                                                                               )\n                                                                                             )\n                                                                                             ( (40 :: int)\n                                                                                               := (11 :: int)\n                                                                                             )\n                                                                                           )\n                                                                                           ( (41 :: int)\n                                                                                             := (8 :: int)\n                                                                                           )\n                                                                                         )\n                                                                                         ( (42 :: int)\n                                                                                           := (12 :: int)\n                                                                                         )\n                                                                                       )\n                                                                                       ( (43 :: int)\n                                                                                         := (2 :: int)\n                                                                                       )\n                                                                                     )\n                                                                                     ( (44 :: int)\n                                                                                       := (10 :: int)\n                                                                                     )\n                                                                                   )\n                                                                                   ( (45 :: int)\n                                                                                     := (0 :: int)\n                                                                                   )\n                                                                                 )\n                                                                                 ( (46 :: int)\n                                                                                   := (4 :: int)\n                                                                                 )\n                                                                               )\n                                                                               ( (47 :: int)\n                                                                                 := (13 :: int)\n                                                                               )\n                                                                             )\n                                                                             ( (48 :: int)\n                                                                               := (8 :: int)\n                                                                             )\n                                                                           )\n                                                                           ( (49 :: int)\n                                                                             := (6 :: int)\n                                                                           )\n                                                                         )\n                                                                         ( (50 :: int)\n                                                                           := (4 :: int)\n                                                                         )\n                                                                       )\n                                                                       ( (51 :: int)\n                                                                         := (1 :: int)\n                                                                       )\n                                                                     )\n                                                                     ( (52 :: int)\n                                                                       := (3 :: int)\n                                                                     )\n                                                                   )\n                                                                   ( (53 :: int)\n                                                                     := (11 :: int)\n                                                                   )\n                                                                 )\n                                                                 ( (54 :: int)\n                                                                   := (15 :: int)\n                                                                 )\n                                                               )\n                                                               ( (55 :: int)\n                                                                 := (0 :: int)\n                                                               )\n                                                             )\n                                                             ( (56 :: int)\n                                                               := (5 :: int)\n                                                             )\n                                                           )\n                                                           ( (57 :: int)\n                                                             := (12 :: int)\n                                                           )\n                                                         )\n                                                         ( (58 :: int)\n                                                           := (2 :: int)\n                                                         )\n                                                       )\n                                                       ( (59 :: int)\n                                                         := (13 :: int)\n                                                       )\n                                                     )\n                                                     ( (60 :: int)\n                                                       := (9 :: int)\n                                                     )\n                                                   )\n                                                   ( (61 :: int)\n                                                     := (7 :: int)\n                                                   )\n                                                 )\n                                                 ( (62 :: int)\n                                                   := (10 :: int)\n                                                 )\n                                               )\n                                               ( (63 :: int)\n                                                 := (14 :: int)\n                                               )\n                                             )\n                                             ( (64 :: int)\n                                               := (12 :: int)\n                                             )\n                                           )\n                                           ( (65 :: int)\n                                             := (15 :: int)\n                                           )\n                                         )\n                                         ( (66 :: int)\n                                           := (10 :: int)\n                                         )\n                                       )\n                                       ( (67 :: int)\n                                         := (4 :: int)\n                                       )\n                                     )\n                                     ( (68 :: int)\n                                       := (1 :: int)\n                                     )\n                                   )\n                                   ( (69 :: int)\n                                     := (5 :: int)\n                                   )\n                                 )\n                                 ( (70 :: int)\n                                   := (8 :: int)\n                                 )\n                               )\n                               ( (71 :: int)\n                                 := (7 :: int)\n                               )\n                             )\n                             ( (72 :: int)\n                               := (6 :: int)\n                             )\n                           )\n                           ( (73 :: int)\n                             := (2 :: int)\n                           )\n                         )\n                         ( (74 :: int)\n                           := (13 :: int)\n                         )\n                       )\n                       ( (75 :: int)\n                         := (14 :: int)\n                       )\n                     )\n                     ( (76 :: int)\n                       := (0 :: int)\n                     )\n                   )\n                   ( (77 :: int)\n                     := (3 :: int)\n                   )\n                 )\n                 ( (78 :: int)\n                   := (9 :: int)\n                 )\n               )\n               ( (79 :: int)\n                 := (11 :: int)\n               )\n             )\n               R_R_Spark_Declaration.j''\n        \" (is \"?C1\")\napply (insert assms) by (rule userlemmas)\n\nlemma goal2'3: \n  assumes R1: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> R_R_Spark_Declaration.block_index__first''\n            <= R_R_Spark_Declaration.r_values'' I''\n  \"\n  assumes R2: \n  \" ALL ( I'' :: int )\n    .   (0 :: int) <= I'' & I'' <= (79 :: int)\n        --> R_R_Spark_Declaration.r_values'' I''\n            <= R_R_Spark_Declaration.block_index__last''\n  \"\n  assumes R3: \n  \" R_R_Spark_Declaration.r_values''\n    = ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( R_R_Spark_Declaration.block_permutation___default_arr''\n                                                                                                                                                                    ( R_R_Spark_Declaration.round_index__first''\n                                                                                                                                                                      := (5 :: int)\n                                                                                                                                                                    )\n                                                                                                                                                                  )\n                                                                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (1 :: int)\n                                                                                                                                                                    := (14 :: int)\n                                                                                                                                                                  )\n                                                                                                                                                                )\n                                                                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (2 :: int)\n                                                                                                                                                                  := (7 :: int)\n                                                                                                                                                                )\n                                                                                                                                                              )\n                                                                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (3 :: int)\n                                                                                                                                                                := (0 :: int)\n                                                                                                                                                              )\n                                                                                                                                                            )\n                                                                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (4 :: int)\n                                                                                                                                                              := (9 :: int)\n                                                                                                                                                            )\n                                                                                                                                                          )\n                                                                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (5 :: int)\n                                                                                                                                                            := (2 :: int)\n                                                                                                                                                          )\n                                                                                                                                                        )\n                                                                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (6 :: int)\n                                                                                                                                                          := (11 :: int)\n                                                                                                                                                        )\n                                                                                                                                                      )\n                                                                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (7 :: int)\n                                                                                                                                                        := (4 :: int)\n                                                                                                                                                      )\n                                                                                                                                                    )\n                                                                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (8 :: int)\n                                                                                                                                                      := (13 :: int)\n                                                                                                                                                    )\n                                                                                                                                                  )\n                                                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (9 :: int)\n                                                                                                                                                    := (6 :: int)\n                                                                                                                                                  )\n                                                                                                                                                )\n                                                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (10 :: int)\n                                                                                                                                                  := (15 :: int)\n                                                                                                                                                )\n                                                                                                                                              )\n                                                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (11 :: int)\n                                                                                                                                                := (8 :: int)\n                                                                                                                                              )\n                                                                                                                                            )\n                                                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (12 :: int)\n                                                                                                                                              := (1 :: int)\n                                                                                                                                            )\n                                                                                                                                          )\n                                                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (13 :: int)\n                                                                                                                                            := (10 :: int)\n                                                                                                                                          )\n                                                                                                                                        )\n                                                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (14 :: int)\n                                                                                                                                          := (3 :: int)\n                                                                                                                                        )\n                                                                                                                                      )\n                                                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (15 :: int)\n                                                                                                                                        := (12 :: int)\n                                                                                                                                      )\n                                                                                                                                    )\n                                                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (16 :: int)\n                                                                                                                                      := (6 :: int)\n                                                                                                                                    )\n                                                                                                                                  )\n                                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (17 :: int)\n                                                                                                                                    := (11 :: int)\n                                                                                                                                  )\n                                                                                                                                )\n                                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (18 :: int)\n                                                                                                                                  := (3 :: int)\n                                                                                                                                )\n                                                                                                                              )\n                                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (19 :: int)\n                                                                                                                                := (7 :: int)\n                                                                                                                              )\n                                                                                                                            )\n                                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (20 :: int)\n                                                                                                                              := (0 :: int)\n                                                                                                                            )\n                                                                                                                          )\n                                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (21 :: int)\n                                                                                                                            := (13 :: int)\n                                                                                                                          )\n                                                                                                                        )\n                                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (22 :: int)\n                                                                                                                          := (5 :: int)\n                                                                                                                        )\n                                                                                                                      )\n                                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (23 :: int)\n                                                                                                                        := (10 :: int)\n                                                                                                                      )\n                                                                                                                    )\n                                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (24 :: int)\n                                                                                                                      := (14 :: int)\n                                                                                                                    )\n                                                                                                                  )\n                                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (25 :: int)\n                                                                                                                    := (15 :: int)\n                                                                                                                  )\n                                                                                                                )\n                                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (26 :: int)\n                                                                                                                  := (8 :: int)\n                                                                                                                )\n                                                                                                              )\n                                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (27 :: int)\n                                                                                                                := (12 :: int)\n                                                                                                              )\n                                                                                                            )\n                                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (28 :: int)\n                                                                                                              := (4 :: int)\n                                                                                                            )\n                                                                                                          )\n                                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (29 :: int)\n                                                                                                            := (9 :: int)\n                                                                                                          )\n                                                                                                        )\n                                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (30 :: int)\n                                                                                                          := (1 :: int)\n                                                                                                        )\n                                                                                                      )\n                                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (31 :: int)\n                                                                                                        := (2 :: int)\n                                                                                                      )\n                                                                                                    )\n                                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (32 :: int)\n                                                                                                      := (15 :: int)\n                                                                                                    )\n                                                                                                  )\n                                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (33 :: int)\n                                                                                                    := (5 :: int)\n                                                                                                  )\n                                                                                                )\n                                                                                                ( R_R_Spark_Declaration.round_index__first'' + (34 :: int)\n                                                                                                  := (1 :: int)\n                                                                                                )\n                                                                                              )\n                                                                                              ( R_R_Spark_Declaration.round_index__first'' + (35 :: int)\n                                                                                                := (3 :: int)\n                                                                                              )\n                                                                                            )\n                                                                                            ( R_R_Spark_Declaration.round_index__first'' + (36 :: int)\n                                                                                              := (7 :: int)\n                                                                                            )\n                                                                                          )\n                                                                                          ( R_R_Spark_Declaration.round_index__first'' + (37 :: int)\n                                                                                            := (14 :: int)\n                                                                                          )\n                                                                                        )\n                                                                                        ( R_R_Spark_Declaration.round_index__first'' + (38 :: int)\n                                                                                          := (6 :: int)\n                                                                                        )\n                                                                                      )\n                                                                                      ( R_R_Spark_Declaration.round_index__first'' + (39 :: int)\n                                                                                        := (9 :: int)\n                                                                                      )\n                                                                                    )\n                                                                                    ( R_R_Spark_Declaration.round_index__first'' + (40 :: int)\n                                                                                      := (11 :: int)\n                                                                                    )\n                                                                                  )\n                                                                                  ( R_R_Spark_Declaration.round_index__first'' + (41 :: int)\n                                                                                    := (8 :: int)\n                                                                                  )\n                                                                                )\n                                                                                ( R_R_Spark_Declaration.round_index__first'' + (42 :: int)\n                                                                                  := (12 :: int)\n                                                                                )\n                                                                              )\n                                                                              ( R_R_Spark_Declaration.round_index__first'' + (43 :: int)\n                                                                                := (2 :: int)\n                                                                              )\n                                                                            )\n                                                                            ( R_R_Spark_Declaration.round_index__first'' + (44 :: int)\n                                                                              := (10 :: int)\n                                                                            )\n                                                                          )\n                                                                          ( R_R_Spark_Declaration.round_index__first'' + (45 :: int)\n                                                                            := (0 :: int)\n                                                                          )\n                                                                        )\n                                                                        ( R_R_Spark_Declaration.round_index__first'' + (46 :: int)\n                                                                          := (4 :: int)\n                                                                        )\n                                                                      )\n                                                                      ( R_R_Spark_Declaration.round_index__first'' + (47 :: int)\n                                                                        := (13 :: int)\n                                                                      )\n                                                                    )\n                                                                    ( R_R_Spark_Declaration.round_index__first'' + (48 :: int)\n                                                                      := (8 :: int)\n                                                                    )\n                                                                  )\n                                                                  ( R_R_Spark_Declaration.round_index__first'' + (49 :: int)\n                                                                    := (6 :: int)\n                                                                  )\n                                                                )\n                                                                ( R_R_Spark_Declaration.round_index__first'' + (50 :: int)\n                                                                  := (4 :: int)\n                                                                )\n                                                              )\n                                                              ( R_R_Spark_Declaration.round_index__first'' + (51 :: int)\n                                                                := (1 :: int)\n                                                              )\n                                                            )\n                                                            ( R_R_Spark_Declaration.round_index__first'' + (52 :: int)\n                                                              := (3 :: int)\n                                                            )\n                                                          )\n                                                          ( R_R_Spark_Declaration.round_index__first'' + (53 :: int)\n                                                            := (11 :: int)\n                                                          )\n                                                        )\n                                                        ( R_R_Spark_Declaration.round_index__first'' + (54 :: int)\n                                                          := (15 :: int)\n                                                        )\n                                                      )\n                                                      ( R_R_Spark_Declaration.round_index__first'' + (55 :: int)\n                                                        := (0 :: int)\n                                                      )\n                                                    )\n                                                    ( R_R_Spark_Declaration.round_index__first'' + (56 :: int)\n                                                      := (5 :: int)\n                                                    )\n                                                  )\n                                                  ( R_R_Spark_Declaration.round_index__first'' + (57 :: int)\n                                                    := (12 :: int)\n                                                  )\n                                                )\n                                                ( R_R_Spark_Declaration.round_index__first'' + (58 :: int)\n                                                  := (2 :: int)\n                                                )\n                                              )\n                                              ( R_R_Spark_Declaration.round_index__first'' + (59 :: int)\n                                                := (13 :: int)\n                                              )\n                                            )\n                                            ( R_R_Spark_Declaration.round_index__first'' + (60 :: int)\n                                              := (9 :: int)\n                                            )\n                                          )\n                                          ( R_R_Spark_Declaration.round_index__first'' + (61 :: int)\n                                            := (7 :: int)\n                                          )\n                                        )\n                                        ( R_R_Spark_Declaration.round_index__first'' + (62 :: int)\n                                          := (10 :: int)\n                                        )\n                                      )\n                                      ( R_R_Spark_Declaration.round_index__first'' + (63 :: int)\n                                        := (14 :: int)\n                                      )\n                                    )\n                                    ( R_R_Spark_Declaration.round_index__first'' + (64 :: int)\n                                      := (12 :: int)\n                                    )\n                                  )\n                                  ( R_R_Spark_Declaration.round_index__first'' + (65 :: int)\n                                    := (15 :: int)\n                                  )\n                                )\n                                ( R_R_Spark_Declaration.round_index__first'' + (66 :: int)\n                                  := (10 :: int)\n                                )\n                              )\n                              ( R_R_Spark_Declaration.round_index__first'' + (67 :: int)\n                                := (4 :: int)\n                              )\n                            )\n                            ( R_R_Spark_Declaration.round_index__first'' + (68 :: int)\n                              := (1 :: int)\n                            )\n                          )\n                          ( R_R_Spark_Declaration.round_index__first'' + (69 :: int)\n                            := (5 :: int)\n                          )\n                        )\n                        ( R_R_Spark_Declaration.round_index__first'' + (70 :: int)\n                          := (8 :: int)\n                        )\n                      )\n                      ( R_R_Spark_Declaration.round_index__first'' + (71 :: int)\n                        := (7 :: int)\n                      )\n                    )\n                    ( R_R_Spark_Declaration.round_index__first'' + (72 :: int)\n                      := (6 :: int)\n                    )\n                  )\n                  ( R_R_Spark_Declaration.round_index__first'' + (73 :: int)\n                    := (2 :: int)\n                  )\n                )\n                ( R_R_Spark_Declaration.round_index__first'' + (74 :: int)\n                  := (13 :: int)\n                )\n              )\n              ( R_R_Spark_Declaration.round_index__first'' + (75 :: int)\n                := (14 :: int)\n              )\n            )\n            ( R_R_Spark_Declaration.round_index__first'' + (76 :: int)\n              := (0 :: int)\n            )\n          )\n          ( R_R_Spark_Declaration.round_index__first'' + (77 :: int)\n            := (3 :: int)\n          )\n        )\n        ( R_R_Spark_Declaration.round_index__first'' + (78 :: int)\n          := (9 :: int)\n        )\n      )\n      ( R_R_Spark_Declaration.round_index__first'' + (79 :: int)\n        := (11 :: int)\n      )\n  \"\n  assumes R4: \n  \" (0 :: int) <= R_R_Spark_Declaration.block_index__size''\n  \"\n  assumes R5: \n  \" R_R_Spark_Declaration.block_index__first'' = (0 :: int)\n  \"\n  assumes R6: \n  \" R_R_Spark_Declaration.block_index__last'' = (15 :: int)\n  \"\n  assumes R7: \n  \" R_R_Spark_Declaration.block_index__base__first''\n    <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes R8: \n  \" R_R_Spark_Declaration.block_index__base__first''\n    <= R_R_Spark_Declaration.block_index__first''\n  \"\n  assumes R9: \n  \" R_R_Spark_Declaration.block_index__last''\n    <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes R10: \n  \" (0 :: int) <= R_R_Spark_Declaration.round_index__size''\n  \"\n  assumes R11: \n  \" R_R_Spark_Declaration.round_index__first'' = (0 :: int)\n  \"\n  assumes R12: \n  \" R_R_Spark_Declaration.round_index__last'' = (79 :: int)\n  \"\n  assumes R13: \n  \" R_R_Spark_Declaration.round_index__base__first''\n    <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R14: \n  \" R_R_Spark_Declaration.round_index__base__first''\n    <= R_R_Spark_Declaration.round_index__first''\n  \"\n  assumes R15: \n  \" R_R_Spark_Declaration.round_index__last''\n    <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes R16: \n  \" ALL ( i1'' :: int ) ( v'' :: int )\n    .   ( R_R_Spark_Declaration.block_permutation___mk_const_arr' v'' ) i1''\n        = v''\n  \"\n  assumes H1: \" (0 :: int) <= R_R_Spark_Declaration.j'' \"\n  assumes H2: \" R_R_Spark_Declaration.j'' <= (79 :: int) \"\n  assumes H3: \n  \" (0 :: int) <= R_R_Spark_Declaration.block_index__size''\n  \"\n  assumes H4: \n  \" R_R_Spark_Declaration.block_index__base__first''\n    <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes H5: \n  \" (0 :: int) <= R_R_Spark_Declaration.round_index__size''\n  \"\n  assumes H6: \n  \" R_R_Spark_Declaration.round_index__base__first''\n    <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  assumes H7: \n  \" R_R_Spark_Declaration.block_index__base__first'' <= (0 :: int)\n  \"\n  assumes H8: \n  \" (15 :: int) <= R_R_Spark_Declaration.block_index__base__last''\n  \"\n  assumes H9: \n  \" R_R_Spark_Declaration.round_index__base__first'' <= (0 :: int)\n  \"\n  assumes H10: \n  \" (79 :: int) <= R_R_Spark_Declaration.round_index__base__last''\n  \"\n  shows \" ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( R_R_Spark_Declaration.block_permutation___default_arr''\n                                                                                                                                                                          ( (0 :: int)\n                                                                                                                                                                            := (5 :: int)\n                                                                                                                                                                          )\n                                                                                                                                                                        )\n                                                                                                                                                                        ( (1 :: int)\n                                                                                                                                                                          := (14 :: int)\n                                                                                                                                                                        )\n                                                                                                                                                                      )\n                                                                                                                                                                      ( (2 :: int)\n                                                                                                                                                                        := (7 :: int)\n                                                                                                                                                                      )\n                                                                                                                                                                    )\n                                                                                                                                                                    ( (3 :: int)\n                                                                                                                                                                      := (0 :: int)\n                                                                                                                                                                    )\n                                                                                                                                                                  )\n                                                                                                                                                                  ( (4 :: int)\n                                                                                                                                                                    := (9 :: int)\n                                                                                                                                                                  )\n                                                                                                                                                                )\n                                                                                                                                                                ( (5 :: int)\n                                                                                                                                                                  := (2 :: int)\n                                                                                                                                                                )\n                                                                                                                                                              )\n                                                                                                                                                              ( (6 :: int)\n                                                                                                                                                                := (11 :: int)\n                                                                                                                                                              )\n                                                                                                                                                            )\n                                                                                                                                                            ( (7 :: int)\n                                                                                                                                                              := (4 :: int)\n                                                                                                                                                            )\n                                                                                                                                                          )\n                                                                                                                                                          ( (8 :: int)\n                                                                                                                                                            := (13 :: int)\n                                                                                                                                                          )\n                                                                                                                                                        )\n                                                                                                                                                        ( (9 :: int)\n                                                                                                                                                          := (6 :: int)\n                                                                                                                                                        )\n                                                                                                                                                      )\n                                                                                                                                                      ( (10 :: int)\n                                                                                                                                                        := (15 :: int)\n                                                                                                                                                      )\n                                                                                                                                                    )\n                                                                                                                                                    ( (11 :: int)\n                                                                                                                                                      := (8 :: int)\n                                                                                                                                                    )\n                                                                                                                                                  )\n                                                                                                                                                  ( (12 :: int)\n                                                                                                                                                    := (1 :: int)\n                                                                                                                                                  )\n                                                                                                                                                )\n                                                                                                                                                ( (13 :: int)\n                                                                                                                                                  := (10 :: int)\n                                                                                                                                                )\n                                                                                                                                              )\n                                                                                                                                              ( (14 :: int)\n                                                                                                                                                := (3 :: int)\n                                                                                                                                              )\n                                                                                                                                            )\n                                                                                                                                            ( (15 :: int)\n                                                                                                                                              := (12 :: int)\n                                                                                                                                            )\n                                                                                                                                          )\n                                                                                                                                          ( (16 :: int)\n                                                                                                                                            := (6 :: int)\n                                                                                                                                          )\n                                                                                                                                        )\n                                                                                                                                        ( (17 :: int)\n                                                                                                                                          := (11 :: int)\n                                                                                                                                        )\n                                                                                                                                      )\n                                                                                                                                      ( (18 :: int)\n                                                                                                                                        := (3 :: int)\n                                                                                                                                      )\n                                                                                                                                    )\n                                                                                                                                    ( (19 :: int)\n                                                                                                                                      := (7 :: int)\n                                                                                                                                    )\n                                                                                                                                  )\n                                                                                                                                  ( (20 :: int)\n                                                                                                                                    := (0 :: int)\n                                                                                                                                  )\n                                                                                                                                )\n                                                                                                                                ( (21 :: int)\n                                                                                                                                  := (13 :: int)\n                                                                                                                                )\n                                                                                                                              )\n                                                                                                                              ( (22 :: int)\n                                                                                                                                := (5 :: int)\n                                                                                                                              )\n                                                                                                                            )\n                                                                                                                            ( (23 :: int)\n                                                                                                                              := (10 :: int)\n                                                                                                                            )\n                                                                                                                          )\n                                                                                                                          ( (24 :: int)\n                                                                                                                            := (14 :: int)\n                                                                                                                          )\n                                                                                                                        )\n                                                                                                                        ( (25 :: int)\n                                                                                                                          := (15 :: int)\n                                                                                                                        )\n                                                                                                                      )\n                                                                                                                      ( (26 :: int)\n                                                                                                                        := (8 :: int)\n                                                                                                                      )\n                                                                                                                    )\n                                                                                                                    ( (27 :: int)\n                                                                                                                      := (12 :: int)\n                                                                                                                    )\n                                                                                                                  )\n                                                                                                                  ( (28 :: int)\n                                                                                                                    := (4 :: int)\n                                                                                                                  )\n                                                                                                                )\n                                                                                                                ( (29 :: int)\n                                                                                                                  := (9 :: int)\n                                                                                                                )\n                                                                                                              )\n                                                                                                              ( (30 :: int)\n                                                                                                                := (1 :: int)\n                                                                                                              )\n                                                                                                            )\n                                                                                                            ( (31 :: int)\n                                                                                                              := (2 :: int)\n                                                                                                            )\n                                                                                                          )\n                                                                                                          ( (32 :: int)\n                                                                                                            := (15 :: int)\n                                                                                                          )\n                                                                                                        )\n                                                                                                        ( (33 :: int)\n                                                                                                          := (5 :: int)\n                                                                                                        )\n                                                                                                      )\n                                                                                                      ( (34 :: int)\n                                                                                                        := (1 :: int)\n                                                                                                      )\n                                                                                                    )\n                                                                                                    ( (35 :: int)\n                                                                                                      := (3 :: int)\n                                                                                                    )\n                                                                                                  )\n                                                                                                  ( (36 :: int)\n                                                                                                    := (7 :: int)\n                                                                                                  )\n                                                                                                )\n                                                                                                ( (37 :: int)\n                                                                                                  := (14 :: int)\n                                                                                                )\n                                                                                              )\n                                                                                              ( (38 :: int)\n                                                                                                := (6 :: int)\n                                                                                              )\n                                                                                            )\n                                                                                            ( (39 :: int)\n                                                                                              := (9 :: int)\n                                                                                            )\n                                                                                          )\n                                                                                          ( (40 :: int)\n                                                                                            := (11 :: int)\n                                                                                          )\n                                                                                        )\n                                                                                        ( (41 :: int)\n                                                                                          := (8 :: int)\n                                                                                        )\n                                                                                      )\n                                                                                      ( (42 :: int)\n                                                                                        := (12 :: int)\n                                                                                      )\n                                                                                    )\n                                                                                    ( (43 :: int)\n                                                                                      := (2 :: int)\n                                                                                    )\n                                                                                  )\n                                                                                  ( (44 :: int)\n                                                                                    := (10 :: int)\n                                                                                  )\n                                                                                )\n                                                                                ( (45 :: int)\n                                                                                  := (0 :: int)\n                                                                                )\n                                                                              )\n                                                                              ( (46 :: int)\n                                                                                := (4 :: int)\n                                                                              )\n                                                                            )\n                                                                            ( (47 :: int)\n                                                                              := (13 :: int)\n                                                                            )\n                                                                          )\n                                                                          ( (48 :: int)\n                                                                            := (8 :: int)\n                                                                          )\n                                                                        )\n                                                                        ( (49 :: int)\n                                                                          := (6 :: int)\n                                                                        )\n                                                                      )\n                                                                      ( (50 :: int)\n                                                                        := (4 :: int)\n                                                                      )\n                                                                    )\n                                                                    ( (51 :: int)\n                                                                      := (1 :: int)\n                                                                    )\n                                                                  )\n                                                                  ( (52 :: int)\n                                                                    := (3 :: int)\n                                                                  )\n                                                                )\n                                                                ( (53 :: int)\n                                                                  := (11 :: int)\n                                                                )\n                                                              )\n                                                              ( (54 :: int)\n                                                                := (15 :: int)\n                                                              )\n                                                            )\n                                                            ( (55 :: int)\n                                                              := (0 :: int)\n                                                            )\n                                                          )\n                                                          ( (56 :: int)\n                                                            := (5 :: int)\n                                                          )\n                                                        )\n                                                        ( (57 :: int)\n                                                          := (12 :: int)\n                                                        )\n                                                      )\n                                                      ( (58 :: int)\n                                                        := (2 :: int)\n                                                      )\n                                                    )\n                                                    ( (59 :: int)\n                                                      := (13 :: int)\n                                                    )\n                                                  )\n                                                  ( (60 :: int)\n                                                    := (9 :: int)\n                                                  )\n                                                )\n                                                ( (61 :: int)\n                                                  := (7 :: int)\n                                                )\n                                              )\n                                              ( (62 :: int)\n                                                := (10 :: int)\n                                              )\n                                            )\n                                            ( (63 :: int)\n                                              := (14 :: int)\n                                            )\n                                          )\n                                          ( (64 :: int)\n                                            := (12 :: int)\n                                          )\n                                        )\n                                        ( (65 :: int)\n                                          := (15 :: int)\n                                        )\n                                      )\n                                      ( (66 :: int)\n                                        := (10 :: int)\n                                      )\n                                    )\n                                    ( (67 :: int)\n                                      := (4 :: int)\n                                    )\n                                  )\n                                  ( (68 :: int)\n                                    := (1 :: int)\n                                  )\n                                )\n                                ( (69 :: int)\n                                  := (5 :: int)\n                                )\n                              )\n                              ( (70 :: int)\n                                := (8 :: int)\n                              )\n                            )\n                            ( (71 :: int)\n                              := (7 :: int)\n                            )\n                          )\n                          ( (72 :: int)\n                            := (6 :: int)\n                          )\n                        )\n                        ( (73 :: int)\n                          := (2 :: int)\n                        )\n                      )\n                      ( (74 :: int)\n                        := (13 :: int)\n                      )\n                    )\n                    ( (75 :: int)\n                      := (14 :: int)\n                    )\n                  )\n                  ( (76 :: int)\n                    := (0 :: int)\n                  )\n                )\n                ( (77 :: int)\n                  := (3 :: int)\n                )\n              )\n              ( (78 :: int)\n                := (9 :: int)\n              )\n            )\n            ( (79 :: int)\n              := (11 :: int)\n            )\n          )\n            R_R_Spark_Declaration.j''\n          <= (15 :: int)\n        \" (is \"?C1\")\napply (insert assms) by (rule userlemmas)\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/RIPEMD-160-SPARK/R_R_Spark_Obligation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.7310585669110202, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.3398702765229108}}
{"text": "theory Proof_3_6\n  imports HandDryer VCTheoryLemmas Extra\nbegin\n\ntheorem proof_3_6:\n\"VC6 inv3 s0 hands_value\"\n  apply(simp only: VC6_def inv3_def  R3_def \n  dryer_def)\n  apply(rule impI)\n  apply(rule conjI)\n   apply(rule conjI)\n    apply(simp)\nproof -\n  define s:: state where\n\"s =(toEnv\n          (setPstate (setVarAny s0 hands_value) Ctrl\n            waiting))\"\n  assume VC: \"   ((toEnvP s0 \\<and>\n      (\\<forall>s1 s2.\n          substate s1 s2 \\<and>\n          substate s2 s0 \\<and>\n          toEnvP s1 \\<and>\n          toEnvP s2 \\<and>\n          toEnvNum s1 s2 = hands \\<and>\n          10 \\<le> toEnvNum s2 s0 \\<and>\n          getVarBool s1 hands = ON \\<and>\n          getVarBool s1 (Suc (Suc 0)) = ON \\<and>\n          getVarBool s2 hands = OFF \\<longrightarrow>\n          (\\<exists>s4. toEnvP s4 \\<and>\n                substate s2 s4 \\<and>\n                substate s4 s0 \\<and>\n                toEnvNum s2 s4 \\<le> 10 \\<and>\n                (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n                 getVarBool s4 hands = ON) \\<and>\n                (\\<forall>s3. toEnvP s3 \\<and>\n                      substate s2 s3 \\<and>\n                      substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                      getVarBool s3 (Suc (Suc 0)) =\n                      ON \\<and>\n                      getVarBool s3 hands =\n                      OFF)))) \\<and>\n     extraInv s0) \\<and>\n    env (setVarAny s0 hands_value) hands_value \\<and>\n    getPstate (setVarAny s0 hands_value) Ctrl =\n    drying \\<and>\n    getVarBool (setVarAny s0 hands_value) hands \\<noteq>\n    ON \\<and>\n    10 \\<le> ltimeEnv (setVarAny s0 hands_value)\n           Ctrl\"\n  show \"\\<forall>s1 s2.\n       substate s1 s2 \\<and>\n       substate s2\n        (toEnv\n          (setPstate (setVarAny s0 hands_value) Ctrl\n            waiting)) \\<and>\n       toEnvP s1 \\<and>\n       toEnvP s2 \\<and>\n       toEnvNum s1 s2 = hands \\<and>\n       10 \\<le> toEnvNum s2\n              (toEnv\n                (setPstate (setVarAny s0 hands_value)\n                  Ctrl waiting)) \\<and>\n       getVarBool s1 hands = ON \\<and>\n       getVarBool s1 (Suc (Suc 0)) = ON \\<and>\n       getVarBool s2 hands = OFF \\<longrightarrow>\n       (\\<exists>s4. toEnvP s4 \\<and>\n             substate s2 s4 \\<and>\n             substate s4\n              (toEnv\n                (setPstate (setVarAny s0 hands_value)\n                  Ctrl waiting)) \\<and>\n             toEnvNum s2 s4 \\<le> 10 \\<and>\n             (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n              getVarBool s4 hands = ON) \\<and>\n             (\\<forall>s3. toEnvP s3 \\<and>\n                   substate s2 s3 \\<and>\n                   substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                   getVarBool s3 (Suc (Suc 0)) =\n                   ON \\<and>\n                   getVarBool s3 hands = OFF))\"\n    apply(simp only: s_def[symmetric])\n  proof(rule allI; rule allI; rule impI)\n    fix s1 s2\n    assume req_prems: \"substate s1 s2 \\<and>\n       substate s2 s \\<and>\n       toEnvP s1 \\<and>\n       toEnvP s2 \\<and>\n       toEnvNum s1 s2 = hands \\<and>\n       10 \\<le> toEnvNum s2 s \\<and>\n       getVarBool s1 hands = ON \\<and>\n       getVarBool s1 (Suc (Suc 0)) = ON \\<and>\n       getVarBool s2 hands = OFF\"\n    then obtain \"10 \\<le> toEnvNum s2 s\" by auto\n    from le_imp_less_or_eq[OF this]\n    show \" \\<exists>s4. toEnvP s4 \\<and>\n            substate s2 s4 \\<and>\n            substate s4 s \\<and>\n            toEnvNum s2 s4 \\<le> 10 \\<and>\n            (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n             getVarBool s4 hands = ON) \\<and>\n            (\\<forall>s3. toEnvP s3 \\<and>\n                  substate s2 s3 \\<and>\n                  substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                  getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n                  getVarBool s3 hands = OFF)\"\n    proof\n      assume 1: \"10 < toEnvNum s2 s\"\n      with req_prems substate_eq_or_predEnv\n toEnvNum_id s_def  have 2: \"substate s2 s0\" \n        by (simp add: s_def split: if_splits)\n      from VC obtain \"\\<forall>s1 s2.\n          substate s1 s2 \\<and>\n          substate s2 s0 \\<and>\n          toEnvP s1 \\<and>\n          toEnvP s2 \\<and>\n          toEnvNum s1 s2 = hands \\<and>\n          10 \\<le> toEnvNum s2 s0 \\<and>\n          getVarBool s1 hands = ON \\<and>\n          getVarBool s1 (Suc (Suc 0)) = ON \\<and>\n          getVarBool s2 hands = OFF \\<longrightarrow>\n          (\\<exists>s4. toEnvP s4 \\<and>\n                substate s2 s4 \\<and>\n                substate s4 s0 \\<and>\n                toEnvNum s2 s4 \\<le> 10 \\<and>\n                (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n                 getVarBool s4 hands = ON) \\<and>\n                (\\<forall>s3. toEnvP s3 \\<and>\n                      substate s2 s3 \\<and>\n                      substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                      getVarBool s3 (Suc (Suc 0)) =\n                      ON \\<and>\n                      getVarBool s3 hands =\n                      OFF))\"\n        by auto\n      with req_prems 1 2 have \"\\<exists>s4. toEnvP s4 \\<and>\n                substate s2 s4 \\<and>\n                substate s4 s0 \\<and>\n                toEnvNum s2 s4 \\<le> 10 \\<and>\n                (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n                 getVarBool s4 hands = ON) \\<and>\n                (\\<forall>s3. toEnvP s3 \\<and>\n                      substate s2 s3 \\<and>\n                      substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                      getVarBool s3 (Suc (Suc 0)) =\n                      ON \\<and>\n                      getVarBool s3 hands =\n                      OFF)\"\n        by (auto simp add: s_def split: if_splits)\n      then obtain s4 where 3: \" toEnvP s4 \\<and>\n                substate s2 s4 \\<and>\n                substate s4 s0 \\<and>\n                toEnvNum s2 s4 \\<le> 10 \\<and>\n                (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n                 getVarBool s4 hands = ON) \\<and>\n                (\\<forall>s3. toEnvP s3 \\<and>\n                      substate s2 s3 \\<and>\n                      substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                      getVarBool s3 (Suc (Suc 0)) =\n                      ON \\<and>\n                      getVarBool s3 hands =\n                      OFF)\" ..\n      have  \"(toEnvP s4 \\<and>\n      substate s2 s4 \\<and>\n      substate s4 s \\<and>\n      toEnvNum s2 s4 \\<le> 10 \\<and>\n      (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n       getVarBool s4 hands = ON)) \\<and>\n      (\\<forall>s3. toEnvP s3 \\<and>\n            substate s2 s3 \\<and>\n            substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n            getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n            getVarBool s3 hands = OFF)\"\n      proof\n        from 3 show \"toEnvP s4 \\<and>\n      substate s2 s4 \\<and>\n      substate s4 s \\<and>\n      toEnvNum s2 s4 \\<le> 10 \\<and>\n      (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n       getVarBool s4 hands = ON)\" \n          by (simp add: s_def)\n      next\n        from 3 show \"\\<forall>s3. toEnvP s3 \\<and>\n         substate s2 s3 \\<and>\n         substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n         getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n         getVarBool s3 hands = OFF\"\n          by simp\n      qed\n      thus ?thesis by auto\n    next\n      assume 4: \"10 = toEnvNum s2 s\"\n      from substate_asym have 5:\n\"\\<forall>s3. toEnvP s3 \\<and>\n               substate s2 s3 \\<and>\n               substate s3 s2 \\<and> s3 \\<noteq> s2 \\<longrightarrow>\n               getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n               getVarBool s3 hands = OFF\"\n        by auto\n      show ?thesis\n      proof -\n        define s5:: state where \"s5=s2\"\n        have \"toEnvP s5 \\<and> substate s2 s5 \\<and>\nsubstate s5 s \\<longrightarrow>pred3 s2 s s5\" \n        proof(induction rule: state_down_ind)\n          case 1\n          then show ?case \n            using req_prems s_def by auto\n        next\n          case 2\n          then show ?case \n            apply(simp only: pred3_def)\n          proof\n            assume 6: \" \\<forall>s3. toEnvP s3 \\<and>\n         substate s2 s3 \\<and>\n         substate s3 s \\<and> s3 \\<noteq> s \\<longrightarrow>\n         getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n         getVarBool s3 hands = OFF\"\n            from VC have \"\\<exists> s3. ~ (toEnvP s3 \\<and>\n         substate s2 s3 \\<and>\n         substate s3 s \\<and> s3 \\<noteq> s \\<longrightarrow>\n         getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n         getVarBool s3 hands = OFF)\"\n              apply(simp only: extraInv_def)\n            proof -\n              assume \"((toEnvP s0 \\<and>\n      (\\<forall>s1 s2.\n          substate s1 s2 \\<and>\n          substate s2 s0 \\<and>\n          toEnvP s1 \\<and>\n          toEnvP s2 \\<and>\n          toEnvNum s1 s2 = hands \\<and>\n          10 \\<le> toEnvNum s2 s0 \\<and>\n          getVarBool s1 hands = ON \\<and>\n          getVarBool s1 (Suc (Suc 0)) = ON \\<and>\n          getVarBool s2 hands = OFF \\<longrightarrow>\n          (\\<exists>s4. toEnvP s4 \\<and>\n                substate s2 s4 \\<and>\n                substate s4 s0 \\<and>\n                toEnvNum s2 s4 \\<le> 10 \\<and>\n                (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n                 getVarBool s4 hands = ON) \\<and>\n                (\\<forall>s3. toEnvP s3 \\<and>\n                      substate s2 s3 \\<and>\n                      substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                      getVarBool s3 (Suc (Suc 0)) =\n                      ON \\<and>\n                      getVarBool s3 hands =\n                      OFF)))) \\<and>\n     toEnvP s0 \\<and>\n     (getPstate s0 Ctrl = drying \\<longrightarrow>\n      0 < ltimeEnv s0 Ctrl \\<and>\n      ltimeEnv s0 Ctrl \\<le> 10 \\<and>\n      (\\<forall>s1. toEnvP s1 \\<and>\n            substate s1 s0 \\<and>\n            toEnvNum s1 s0 + hands =\n            ltimeEnv s0 Ctrl \\<longrightarrow>\n            getVarBool s1 hands = ON \\<and>\n            getVarBool s1 dryer = ON) \\<and>\n      (\\<forall>s1. toEnvP s1 \\<and>\n            substate s1 s0 \\<and>\n            toEnvNum s1 s0 + hands\n            < ltimeEnv s0 Ctrl \\<longrightarrow>\n            getVarBool s1 hands = OFF \\<and>\n            getVarBool s1 dryer = ON)) \\<and>\n     (\\<forall>s1. toEnvP s1 \\<and> substate s1 s0 \\<longrightarrow>\n           getPstate s1 Ctrl = waiting \\<or>\n           getPstate s1 Ctrl = drying)) \\<and>\n    env (setVarAny s0 hands_value) hands_value \\<and>\n    getPstate (setVarAny s0 hands_value) Ctrl =\n    drying \\<and>\n    getVarBool (setVarAny s0 hands_value) hands \\<noteq>\n    ON \\<and>\n    10 \\<le> ltimeEnv (setVarAny s0 hands_value)\n           Ctrl\"\n              then obtain 7:\n \" 0 < ltimeEnv s0 Ctrl \\<and> ltimeEnv s0 Ctrl \\<le> 10 \\<and>\n(\\<forall>s1. toEnvP s1 \\<and>\n            substate s1 s0 \\<and>\n            toEnvNum s1 s0 + hands =\n            ltimeEnv s0 Ctrl \\<longrightarrow>\n            getVarBool s1 hands = ON \\<and>\n            getVarBool s1 dryer = ON)\" by auto\n              from shiftEnv_substate have 8:\n\"substate (shiftEnv s0 (ltimeEnv s0 Ctrl - 1)) s0\"\n                by auto\nfrom VC obtain  9: \"toEnvP s0\" by auto\n            from 7 obtain 10:\n \"0 < ltimeEnv s0 Ctrl\" by auto\n            from 9 10 ltime_le_toEnvNum[of s0 Ctrl]\nshift_spec have 11: \"toEnvP (shiftEnv s0 (ltimeEnv s0 Ctrl - 1))\"\n              by auto\n              have\n\"toEnvNum (shiftEnv s0 (ltimeEnv s0 Ctrl - 1)) s0\n+ 1 = ltimeEnv s0 Ctrl\"\n              proof -\n                from VC obtain  9: \"toEnvP s0\" by auto\n            from 7 obtain 10:\n \"0 < ltimeEnv s0 Ctrl\" by auto\n                with 9 10 ltime_le_toEnvNum[of s0 Ctrl] \ntoEnvNum_shift show ?thesis \n                  by auto\n              qed\n              with 7 8 11 have 12:\n\"getVarBool (shiftEnv s0 (ltimeEnv s0 Ctrl - 1)) \nhands = ON \\<and>\n getVarBool (shiftEnv s0 (ltimeEnv s0 Ctrl - 1))\ndryer = ON\" by auto\n              have 13:\"substate s2 (shiftEnv s0 (ltimeEnv s0 Ctrl - 1))\"\n              proof -\n                from 4 req_prems substate_eq_or_predEnv\n toEnvNum_id s_def  have 2: \"substate s2 s0\" \n                  by (simp add: s_def split: if_splits)\n                from 7 obtain 14: \"ltimeEnv s0 Ctrl \\<le> 10\" by auto\n      from req_prems obtain \"toEnvP s2\"\n        by auto\n                with 2 9 10 4 14  substate_shift[of s2 s0 \"ltimeEnv s0 Ctrl - 1\"]\n                show ?thesis \n                  by (auto simp add: s_def split: if_splits)\n              qed\n              have 14: \"substate (shiftEnv s0 (ltimeEnv s0 Ctrl - hands)) s0\"\n                using shiftEnv_substate by auto\n              have 15: \"substate s0 s\" using substate_refl\n                by (auto simp add: s_def)\n              with 14 have 16:  \"substate (shiftEnv s0 (ltimeEnv s0 Ctrl - hands)) s\"\n                using substate_trans by blast\n              have  \" (shiftEnv s0 (ltimeEnv s0 Ctrl - hands)) \\<noteq> s\"\n              proof\n                assume \"shiftEnv s0 (ltimeEnv s0 Ctrl - hands) = s\"\n                with shiftEnv_substate\n                have \"substate s s0\" by auto\n                with 15 substate_asym \n                have \"s0 = s\" by auto\n                with s_def show False by auto\n              qed\n              with 11 12 13 16 show ?thesis\n                by auto\n            qed\n            with 6 show \" \\<exists>s4. toEnvP s4 \\<and>\n         substate s s4 \\<and>\n         substate s4 s \\<and>\n         toEnvNum s2 s4 \\<le> 10 \\<and>\n         (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n          getVarBool s4 hands = ON) \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and>\n               substate s s3 \\<and>\n               substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n               getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n               getVarBool s3 hands = OFF)\" by auto\n          qed              \n        next\n          case (3 s5)\n          then show ?case \n            apply(simp only: pred3_def)\n          proof\n            from 3(3) have  6: \" (\\<forall>s3. toEnvP s3 \\<and>\n          substate s2 s3 \\<and>\n          substate s3 s5 \\<and> s3 \\<noteq> s5 \\<longrightarrow>\n          getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n          getVarBool s3 hands = OFF) \\<Longrightarrow>\n    (\\<exists>s4. toEnvP s4 \\<and>\n          substate s5 s4 \\<and>\n          substate s4 s \\<and>\n          toEnvNum s2 s4 \\<le> 10 \\<and>\n          (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n           getVarBool s4 hands = ON) \\<and>\n          (\\<forall>s3. toEnvP s3 \\<and>\n                substate s5 s3 \\<and>\n                substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n                getVarBool s3 hands = OFF)) \"\n              by (auto simp add: pred3_def)\n            assume 7: \" \\<forall>s3. toEnvP s3 \\<and>\n         substate s2 s3 \\<and>\n         substate s3 (predEnv s5) \\<and>\n         s3 \\<noteq> predEnv s5 \\<longrightarrow>\n         getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n         getVarBool s3 hands = OFF\"\n            show \"\\<exists>s4. toEnvP s4 \\<and>\n         substate (predEnv s5) s4 \\<and>\n         substate s4 s \\<and>\n         toEnvNum s2 s4 \\<le> 10 \\<and>\n         (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n          getVarBool s4 hands = ON) \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and>\n               substate (predEnv s5) s3 \\<and>\n               substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n               getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n               getVarBool s3 hands = OFF)\"\n            proof cases\n              assume 10: \"(getVarBool (predEnv s5) (Suc (Suc 0)) = OFF \\<or>\n          getVarBool (predEnv s5) hands = ON)\"\n              from predEnv_substate 3 \nsubstate_trans have 8:  \"substate (predEnv s5) s\"\n                by blast\n              from 3(2) substate_eq_or_predEnv req_prems \n              have 9: \"substate s2 (predEnv s5)\" \n                by auto\n              have \"toEnvP (predEnv s5) \\<and>\n         substate (predEnv s5) (predEnv s5) \\<and>\n         substate (predEnv s5) s \\<and>\n         toEnvNum s2 (predEnv s5) \\<le> 10 \\<and>\n         (getVarBool (predEnv s5) (Suc (Suc 0)) = OFF \\<or>\n          getVarBool (predEnv s5) hands = ON) \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and>\n               substate (predEnv s5) s3 \\<and>\n               substate s3 (predEnv s5) \\<and>\n s3 \\<noteq> (predEnv s5) \\<longrightarrow>\n               getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n               getVarBool s3 hands = OFF)\"\n              proof -\n                from predEnvP_or_emptyState[of s5]\n                have \"toEnvP (predEnv s5)\"\n                proof      \n                  assume \"toEnvP (predEnv s5)\"\n                  thus ?thesis by assumption\n                next\n                  assume   \"predEnv s5 = emptyState\"\n                  with 9 req_prems show ?thesis\n                    by (cases s2; auto)\n                qed\n                moreover from substate_refl have\n\" substate (predEnv s5) (predEnv s5)\" by auto\n                moreover from 8 \n                have \"substate (predEnv s5) s\"\n                  by assumption\n                moreover from 4 8 9 toEnvNum3\n                have \"toEnvNum s2 (predEnv s5) \\<le> 10\"\n                  by auto\n                moreover from 10\n                have \"(getVarBool (predEnv s5) (Suc (Suc 0)) = OFF \\<or>\n     getVarBool (predEnv s5) hands = ON)\"\n                  by assumption\n                moreover from substate_asym\n                have \"\\<forall>s3. toEnvP s3 \\<and>\n          substate (predEnv s5) s3 \\<and>\n          substate s3 (predEnv s5) \\<and>\n          s3 \\<noteq> predEnv s5 \\<longrightarrow>\n          getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n          getVarBool s3 hands = OFF\" by auto\n                ultimately show ?thesis by auto\n              qed\n              thus ?thesis by auto\n            next\n              assume 10: \"\\<not> (getVarBool (predEnv s5) (Suc (Suc 0)) = OFF \\<or>\n        getVarBool (predEnv s5) hands = ON)\"\n              with substate_eq_or_predEnv 7\n              have \" \\<forall>s3. toEnvP s3 \\<and>\n         substate s2 s3 \\<and>\n         substate s3  s5 \\<and>\n         s3 \\<noteq> s5 \\<longrightarrow>\n         getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n         getVarBool s3 hands = OFF\"\n                by auto\n              from 6[OF this] obtain s4 where 11:\n\"toEnvP s4 \\<and>\n       substate s5 s4 \\<and>\n       substate s4 s \\<and>\n       toEnvNum s2 s4 \\<le> 10 \\<and>\n       (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n        getVarBool s4 hands = ON) \\<and>\n       (\\<forall>s3. toEnvP s3 \\<and>\n             substate s5 s3 \\<and>\n             substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n             getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n             getVarBool s3 hands = OFF)\" ..\n              have \"(toEnvP s4 \\<and>\n      substate (predEnv s5) s4 \\<and>\n      substate s4 s \\<and>\n      toEnvNum s2 s4 \\<le> 10 \\<and>\n      (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n       getVarBool s4 hands = ON)) \\<and>\n      (\\<forall>s3. toEnvP s3 \\<and>\n            substate (predEnv s5) s3 \\<and>\n            substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n            getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n            getVarBool s3 hands = OFF)\" \n              proof\n                from 11 predEnv_substate substate_trans \n                show \"toEnvP s4 \\<and>\n      substate (predEnv s5) s4 \\<and>\n      substate s4 s \\<and>\n      toEnvNum s2 s4 \\<le> 10 \\<and>\n      (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n       getVarBool s4 hands = ON)\" by blast\n              next \n                show \"\\<forall>s3. toEnvP s3 \\<and>\n            substate (predEnv s5) s3 \\<and>\n            substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n            getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n            getVarBool s3 hands = OFF\"\n                proof(rule allI; rule impI)\n                  fix s3\n                  assume 12: \"toEnvP s3 \\<and>\n            substate (predEnv s5) s3 \\<and>\n            substate s3 s4 \\<and> s3 \\<noteq> s4\"\n                  with  11 3(1) predEnv_substate_imp_eq_or_substate\n                  have \"s3 = predEnv s5 \\<or> substate s5 s3\"\n                    by auto \n                  with 10 11 12 show \"getVarBool s3 (Suc (Suc 0)) = ON \\<and>\n            getVarBool s3 hands = OFF\"\n                    by auto\n\n                qed\n              qed\n              thus ?thesis by auto\n            qed\n          qed\n        qed\n        with s5_def req_prems substate_refl\n pred3_def 5 show ?thesis by auto\n      qed\n    qed\n  qed\nnext\n  assume \"((toEnvP s0 \\<and>\n      (\\<forall>s1 s2.\n          substate s1 s2 \\<and>\n          substate s2 s0 \\<and>\n          toEnvP s1 \\<and>\n          toEnvP s2 \\<and>\n          toEnvNum s1 s2 = hands \\<and>\n          10 \\<le> toEnvNum s2 s0 \\<and>\n          getVarBool s1 hands = ON \\<and>\n          getVarBool s1 (Suc (Suc 0)) = ON \\<and>\n          getVarBool s2 hands = OFF \\<longrightarrow>\n          (\\<exists>s4. toEnvP s4 \\<and>\n                substate s2 s4 \\<and>\n                substate s4 s0 \\<and>\n                toEnvNum s2 s4 \\<le> 10 \\<and>\n                (getVarBool s4 (Suc (Suc 0)) = OFF \\<or>\n                 getVarBool s4 hands = ON) \\<and>\n                (\\<forall>s3. toEnvP s3 \\<and>\n                      substate s2 s3 \\<and>\n                      substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                      getVarBool s3 (Suc (Suc 0)) =\n                      ON \\<and>\n                      getVarBool s3 hands =\n                      OFF)))) \\<and>\n     extraInv s0) \\<and>\n    env (setVarAny s0 hands_value) hands_value \\<and>\n    getPstate (setVarAny s0 hands_value) Ctrl =\n    drying \\<and>\n    getVarBool (setVarAny s0 hands_value) hands \\<noteq>\n    ON \\<and>\n    10 \\<le> ltimeEnv (setVarAny s0 hands_value)\n           Ctrl \"\n  with extra6 show \" extraInv\n     (toEnv\n       (setPstate (setVarAny s0 hands_value) Ctrl\n         waiting))\"\n    by (auto simp add: VC6_def)\nqed\n\nend", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/HandDryer/Proof_3_6.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6959583376458152, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.33982490009014354}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\nsection \"Words of Length 8\"\n\ntheory Word_8\nimports\n  More_Word\n  Enumeration_Word\n  Even_More_List\n  Signed_Words\n  Word_Lemmas\nbegin\n\nlemma len8: \"len_of (x :: 8 itself) = 8\" by simp\n\nlemma word8_and_max_simp:\n  \\<open>x AND 0xFF = x\\<close> for x :: \\<open>8 word\\<close>\n  using word_and_full_mask_simp [of x]\n  by (simp add: numeral_eq_Suc mask_Suc_exp)\n\nlemma enum_word8_eq:\n  \\<open>enum = [0 :: 8 word, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,\n                            20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36,\n                            37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53,\n                            54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70,\n                            71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87,\n                            88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103,\n                            104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117,\n                            118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131,\n                            132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145,\n                            146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159,\n                            160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173,\n                            174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187,\n                            188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201,\n                            202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215,\n                            216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229,\n                            230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243,\n                            244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255]\\<close> (is \\<open>?lhs = ?rhs\\<close>)\nproof -\n  have \\<open>map unat ?lhs = [0..<256]\\<close>\n    by (simp add: enum_word_def comp_def take_bit_nat_eq_self map_idem_upt_eq)\n  also have \\<open>\\<dots> = map unat ?rhs\\<close>\n    by (simp add: upt_zero_numeral_unfold)\n  finally show ?thesis\n    using unat_inj by (rule map_injective)\nqed\n\nlemma set_enum_word8_def:\n  \"(set enum :: 8 word set) = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,\n                            20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36,\n                            37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53,\n                            54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70,\n                            71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87,\n                            88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103,\n                            104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117,\n                            118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131,\n                            132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145,\n                            146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159,\n                            160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173,\n                            174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187,\n                            188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201,\n                            202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215,\n                            216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229,\n                            230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243,\n                            244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255}\"\n  by (simp add: enum_word8_eq)\n\nlemma set_strip_insert: \"\\<lbrakk> x \\<in> insert a S; x \\<noteq> a \\<rbrakk> \\<Longrightarrow> x \\<in> S\"\n  by simp\n\nlemma word8_exhaust:\n  fixes x :: \\<open>8 word\\<close>\n  shows \"\\<lbrakk>x \\<noteq> 0; x \\<noteq> 1; x \\<noteq> 2; x \\<noteq> 3; x \\<noteq> 4; x \\<noteq> 5; x \\<noteq> 6; x \\<noteq> 7; x \\<noteq> 8; x \\<noteq> 9; x \\<noteq> 10; x \\<noteq> 11; x \\<noteq>\n          12; x \\<noteq> 13; x \\<noteq> 14; x \\<noteq> 15; x \\<noteq> 16; x \\<noteq> 17; x \\<noteq> 18; x \\<noteq> 19; x \\<noteq> 20; x \\<noteq> 21; x \\<noteq> 22; x \\<noteq>\n          23; x \\<noteq> 24; x \\<noteq> 25; x \\<noteq> 26; x \\<noteq> 27; x \\<noteq> 28; x \\<noteq> 29; x \\<noteq> 30; x \\<noteq> 31; x \\<noteq> 32; x \\<noteq> 33; x \\<noteq>\n          34; x \\<noteq> 35; x \\<noteq> 36; x \\<noteq> 37; x \\<noteq> 38; x \\<noteq> 39; x \\<noteq> 40; x \\<noteq> 41; x \\<noteq> 42; x \\<noteq> 43; x \\<noteq> 44; x \\<noteq>\n          45; x \\<noteq> 46; x \\<noteq> 47; x \\<noteq> 48; x \\<noteq> 49; x \\<noteq> 50; x \\<noteq> 51; x \\<noteq> 52; x \\<noteq> 53; x \\<noteq> 54; x \\<noteq> 55; x \\<noteq>\n          56; x \\<noteq> 57; x \\<noteq> 58; x \\<noteq> 59; x \\<noteq> 60; x \\<noteq> 61; x \\<noteq> 62; x \\<noteq> 63; x \\<noteq> 64; x \\<noteq> 65; x \\<noteq> 66; x \\<noteq>\n          67; x \\<noteq> 68; x \\<noteq> 69; x \\<noteq> 70; x \\<noteq> 71; x \\<noteq> 72; x \\<noteq> 73; x \\<noteq> 74; x \\<noteq> 75; x \\<noteq> 76; x \\<noteq> 77; x \\<noteq>\n          78; x \\<noteq> 79; x \\<noteq> 80; x \\<noteq> 81; x \\<noteq> 82; x \\<noteq> 83; x \\<noteq> 84; x \\<noteq> 85; x \\<noteq> 86; x \\<noteq> 87; x \\<noteq> 88; x \\<noteq>\n          89; x \\<noteq> 90; x \\<noteq> 91; x \\<noteq> 92; x \\<noteq> 93; x \\<noteq> 94; x \\<noteq> 95; x \\<noteq> 96; x \\<noteq> 97; x \\<noteq> 98; x \\<noteq> 99; x \\<noteq>\n          100; x \\<noteq> 101; x \\<noteq> 102; x \\<noteq> 103; x \\<noteq> 104; x \\<noteq> 105; x \\<noteq> 106; x \\<noteq> 107; x \\<noteq> 108; x \\<noteq> 109; x \\<noteq>\n          110; x \\<noteq> 111; x \\<noteq> 112; x \\<noteq> 113; x \\<noteq> 114; x \\<noteq> 115; x \\<noteq> 116; x \\<noteq> 117; x \\<noteq> 118; x \\<noteq> 119; x \\<noteq>\n          120; x \\<noteq> 121; x \\<noteq> 122; x \\<noteq> 123; x \\<noteq> 124; x \\<noteq> 125; x \\<noteq> 126; x \\<noteq> 127; x \\<noteq> 128; x \\<noteq> 129; x \\<noteq>\n          130; x \\<noteq> 131; x \\<noteq> 132; x \\<noteq> 133; x \\<noteq> 134; x \\<noteq> 135; x \\<noteq> 136; x \\<noteq> 137; x \\<noteq> 138; x \\<noteq> 139; x \\<noteq>\n          140; x \\<noteq> 141; x \\<noteq> 142; x \\<noteq> 143; x \\<noteq> 144; x \\<noteq> 145; x \\<noteq> 146; x \\<noteq> 147; x \\<noteq> 148; x \\<noteq> 149; x \\<noteq>\n          150; x \\<noteq> 151; x \\<noteq> 152; x \\<noteq> 153; x \\<noteq> 154; x \\<noteq> 155; x \\<noteq> 156; x \\<noteq> 157; x \\<noteq> 158; x \\<noteq> 159; x \\<noteq>\n          160; x \\<noteq> 161; x \\<noteq> 162; x \\<noteq> 163; x \\<noteq> 164; x \\<noteq> 165; x \\<noteq> 166; x \\<noteq> 167; x \\<noteq> 168; x \\<noteq> 169; x \\<noteq>\n          170; x \\<noteq> 171; x \\<noteq> 172; x \\<noteq> 173; x \\<noteq> 174; x \\<noteq> 175; x \\<noteq> 176; x \\<noteq> 177; x \\<noteq> 178; x \\<noteq> 179; x \\<noteq>\n          180; x \\<noteq> 181; x \\<noteq> 182; x \\<noteq> 183; x \\<noteq> 184; x \\<noteq> 185; x \\<noteq> 186; x \\<noteq> 187; x \\<noteq> 188; x \\<noteq> 189; x \\<noteq>\n          190; x \\<noteq> 191; x \\<noteq> 192; x \\<noteq> 193; x \\<noteq> 194; x \\<noteq> 195; x \\<noteq> 196; x \\<noteq> 197; x \\<noteq> 198; x \\<noteq> 199; x \\<noteq>\n          200; x \\<noteq> 201; x \\<noteq> 202; x \\<noteq> 203; x \\<noteq> 204; x \\<noteq> 205; x \\<noteq> 206; x \\<noteq> 207; x \\<noteq> 208; x \\<noteq> 209; x \\<noteq>\n          210; x \\<noteq> 211; x \\<noteq> 212; x \\<noteq> 213; x \\<noteq> 214; x \\<noteq> 215; x \\<noteq> 216; x \\<noteq> 217; x \\<noteq> 218; x \\<noteq> 219; x \\<noteq>\n          220; x \\<noteq> 221; x \\<noteq> 222; x \\<noteq> 223; x \\<noteq> 224; x \\<noteq> 225; x \\<noteq> 226; x \\<noteq> 227; x \\<noteq> 228; x \\<noteq> 229; x \\<noteq>\n          230; x \\<noteq> 231; x \\<noteq> 232; x \\<noteq> 233; x \\<noteq> 234; x \\<noteq> 235; x \\<noteq> 236; x \\<noteq> 237; x \\<noteq> 238; x \\<noteq> 239; x \\<noteq>\n          240; x \\<noteq> 241; x \\<noteq> 242; x \\<noteq> 243; x \\<noteq> 244; x \\<noteq> 245; x \\<noteq> 246; x \\<noteq> 247; x \\<noteq> 248; x \\<noteq> 249; x \\<noteq>\n          250; x \\<noteq> 251; x \\<noteq> 252; x \\<noteq> 253; x \\<noteq> 254; x \\<noteq> 255\\<rbrakk> \\<Longrightarrow> P\"\n  apply (subgoal_tac \"x \\<in> set enum\", subst (asm) set_enum_word8_def)\n    apply (drule set_strip_insert, assumption)+\n   apply (erule emptyE)\n  apply (subst enum_UNIV, rule UNIV_I)\n  done\n\nend\n", "meta": {"author": "ethereum", "repo": "yul-isabelle", "sha": "4d760a0dabfeab19efc772330be1059021208ad9", "save_path": "github-repos/isabelle/ethereum-yul-isabelle", "path": "github-repos/isabelle/ethereum-yul-isabelle/yul-isabelle-4d760a0dabfeab19efc772330be1059021208ad9/Word_Lib/Word_8.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.33971054342622387}}
{"text": "(*    This file is a part of IsarMathLib - \n    a library of formalized mathematics for Isabelle/Isar.\n\n    Copyright (C) 2005 - 2009  Slawomir Kolodynski\n\n    This program is free software; Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED \nWARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF \nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. \nIN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, \nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, \nPROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; \nOR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, \nWHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \nOTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, \nEVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\nsection \\<open>Integers 2\\<close>\n\ntheory Int_ZF_2 imports func_ZF_1 Int_ZF_1 IntDiv_ZF_IML Group_ZF_3\n\nbegin\n\ntext\\<open>In this theory file we consider the properties of integers that are \n  needed for the real numbers construction in \\<open>Real_ZF\\<close> series.\\<close>\n\nsubsection\\<open>Slopes\\<close>\n\ntext\\<open>In this section we study basic properties of slopes - the integer \n  almost homomorphisms. \n  The general definition of an almost homomorphism $f$ on a group $G$ \n  written in additive notation requires the set \n  $\\{f(m+n) - f(m) - f(n): m,n\\in G\\}$ to be finite.\n  In this section we establish a definition that is equivalent for integers: \n  that for all integer $m,n$ we have $|f(m+n) - f(m) - f(n)| \\leq L$ for\n  some $L$.\\<close>\n\ntext\\<open>First we extend the standard notation for integers with notation related\n  to slopes. We define slopes as almost homomorphisms on the additive group of\n  integers. The set of slopes is denoted \\<open>\\<S>\\<close>. We also define \"positive\" \n  slopes as those that take infinite number of positive values on positive integers.\n  We write \\<open>\\<delta>(s,m,n)\\<close> to denote the homomorphism \n  difference of $s$ at $m,n$ (i.e the expression $s(m+n) - s(m) - s(n)$).\n  We denote \\<open>max\\<delta>(s)\\<close> the maximum absolute value of homomorphism \n  difference of $s$ as $m,n$ range over integers.\n  If $s$ is a slope, \n  then the set of homomorphism differences is finite and \n  this maximum exists.\n  In \\<open>Group_ZF_3\\<close> we define the equivalence relation on \n  almost homomorphisms using the notion of a quotient group relation\n  and use \"\\<open>\\<approx>\\<close>\" to denote it. As here this symbol seems to be hogged\n  by the standard Isabelle, we will use \"\\<open>\\<sim>\\<close>\" instead \"\\<open>\\<approx>\\<close>\".\n  We show in this section that $s\\sim r$ iff for some $L$ we \n  have $|s(m)-r(m)| \\leq L$ for all integer $m$.\n  The \"\\<open>\\<fp>\\<close>\" denotes the first operation on almost homomorphisms. \n  For slopes this is addition of functions defined in the natural way.\n  The \"\\<open>\\<circ>\\<close>\" symbol denotes the second operation on almost homomorphisms\n  (see \\<open>Group_ZF_3\\<close> for definition), \n  defined for the group of integers.  In short \"\\<open>\\<circ>\\<close>\" \n  is the composition of slopes.\n  The \"\\<open>\\<inverse>\\<close>\" symbol acts as an infix operator that assigns the value \n  $\\min\\{n\\in Z_+: p\\leq f(n)\\}$ to a pair (of sets) $f$ and $p$. \n  In application\n  $f$ represents a function defined on $Z_+$ and $p$ is a positive integer.\n  We choose this notation because we use it to construct the right inverse \n  in the ring of classes of slopes and show that this ring is in fact a field.\n  To study the homomorphism difference of the function defined by $p\\mapsto f^{-1}(p)$\n  we introduce the symbol \\<open>\\<epsilon>\\<close> defined as \n  $\\varepsilon(f,\\langle m,n \\rangle ) = f^{-1}(m+n)-f^{-1}(m)-f^{-1}(n)$. Of course the intention is\n  to use the fact that $\\varepsilon(f,\\langle m,n \\rangle )$ is the homomorphism difference\n  of the function $g$ defined as $g(m) = f^{-1}(m)$. We also define $\\gamma (s,m,n)$ as the \n  expression $\\delta(f,m,-n)+s(0)-\\delta (f,n,-n)$. This is useful because of the identity \n  $f(m-n) = \\gamma (m,n) + f(m)-f(n)$ that allows to obtain bounds on the value of a slope\n  at the difference of of two integers.\n  For every integer $m$ we introduce notation $m^S$ defined by $m^E(n)=m\\cdot n$. The mapping\n  $q\\mapsto q^S$ embeds integers into \\<open>\\<S>\\<close> preserving the order, (that is, \n  maps positive integers into \\<open>\\<S>\\<^sub>+\\<close>).\\<close>\n\nlocale int1 = int0 +\n\n  fixes slopes (\"\\<S>\" )\n  defines slopes_def[simp]: \"\\<S> \\<equiv> AlmostHoms(\\<int>,IntegerAddition)\"\n\n  fixes posslopes (\"\\<S>\\<^sub>+\")\n  defines posslopes_def[simp]: \"\\<S>\\<^sub>+ \\<equiv> {s\\<in>\\<S>. s``(\\<int>\\<^sub>+) \\<inter> \\<int>\\<^sub>+ \\<notin> Fin(\\<int>)}\"\n \n  fixes \\<delta> \n  defines \\<delta>_def[simp]: \"\\<delta>(s,m,n) \\<equiv> s`(m\\<ra>n)\\<rs>s`(m)\\<rs>s`(n)\"\n\n  fixes maxhomdiff (\"max\\<delta>\" )\n  defines maxhomdiff_def[simp]: \n  \"max\\<delta>(s) \\<equiv> Maximum(IntegerOrder,{abs(\\<delta>(s,m,n)). \\<langle> m,n\\<rangle> \\<in> \\<int>\\<times>\\<int>})\"\n\n  fixes AlEqRel\n  defines AlEqRel_def[simp]: \n  \"AlEqRel \\<equiv> QuotientGroupRel(\\<S>,AlHomOp1(\\<int>,IntegerAddition),FinRangeFunctions(\\<int>,\\<int>))\"\n\n  fixes AlEq (infix \"\\<sim>\" 68)\n  defines AlEq_def[simp]: \"s \\<sim> r \\<equiv> \\<langle> s,r\\<rangle> \\<in> AlEqRel\"\n\n  fixes slope_add (infix \"\\<fp>\" 70)\n  defines slope_add_def[simp]: \"s \\<fp> r \\<equiv>  AlHomOp1(\\<int>,IntegerAddition)`\\<langle> s,r\\<rangle>\"\n\n  fixes slope_comp (infix \"\\<circ>\" 70)\n  defines slope_comp_def[simp]: \"s \\<circ> r \\<equiv>  AlHomOp2(\\<int>,IntegerAddition)`\\<langle> s,r\\<rangle>\"\n\n  fixes neg (\"\\<fm>_\" [90] 91)\n  defines neg_def[simp]: \"\\<fm>s \\<equiv> GroupInv(\\<int>,IntegerAddition) O s\"\n\n  fixes slope_inv (infix \"\\<inverse>\" 71)\n  defines slope_inv_def[simp]: \n  \"f\\<inverse>(p) \\<equiv> Minimum(IntegerOrder,{n\\<in>\\<int>\\<^sub>+. p \\<lsq> f`(n)})\"\n  fixes \\<epsilon>\n  defines \\<epsilon>_def[simp]: \n  \"\\<epsilon>(f,p) \\<equiv> f\\<inverse>(fst(p)\\<ra>snd(p)) \\<rs> f\\<inverse>(fst(p)) \\<rs> f\\<inverse>(snd(p))\"\n\n  fixes \\<gamma> \n  defines \\<gamma>_def[simp]:\n  \"\\<gamma>(s,m,n) \\<equiv> \\<delta>(s,m,\\<rm>n) \\<rs> \\<delta>(s,n,\\<rm>n) \\<ra> s`(\\<zero>)\"\n\n  fixes intembed (\"_\\<^sup>S\")\n  defines intembed_def[simp]: \"m\\<^sup>S \\<equiv> {\\<langle>n,m\\<cdot>n\\<rangle>. n\\<in>\\<int>}\"\n\ntext\\<open>We can use theorems proven in the \\<open>group1\\<close> context.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L1: shows \"group1(\\<int>,IntegerAddition)\"\n  using Int_ZF_1_T2 group1_axioms.intro group1_def by simp\n\ntext\\<open>Type information related to the homomorphism difference expression.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L2: assumes \"f\\<in>\\<S>\" and \"n\\<in>\\<int>\" \"m\\<in>\\<int>\"\n  shows \n  \"m\\<ra>n \\<in> \\<int>\"  \n  \"f`(m\\<ra>n) \\<in> \\<int>\"  \n  \"f`(m) \\<in> \\<int>\"   \"f`(n) \\<in> \\<int>\"\n  \"f`(m) \\<ra> f`(n) \\<in> \\<int>\"  \n  \"HomDiff(\\<int>,IntegerAddition,f,\\<langle> m,n\\<rangle>) \\<in> \\<int>\" \n  using assms Int_ZF_2_1_L1 group1.Group_ZF_3_2_L4A\n  by auto\n\ntext\\<open>Type information related to the homomorphism difference expression.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L2A: \n  assumes \"f:\\<int>\\<rightarrow>\\<int>\" and \"n\\<in>\\<int>\"  \"m\\<in>\\<int>\"\n  shows \n  \"m\\<ra>n \\<in> \\<int>\" \n  \"f`(m\\<ra>n) \\<in> \\<int>\"   \"f`(m) \\<in> \\<int>\"   \"f`(n) \\<in> \\<int>\"\n  \"f`(m) \\<ra> f`(n) \\<in> \\<int>\" \n  \"HomDiff(\\<int>,IntegerAddition,f,\\<langle> m,n\\<rangle>) \\<in> \\<int>\"\n  using assms Int_ZF_2_1_L1 group1.Group_ZF_3_2_L4\n  by auto\n\ntext\\<open>Slopes map integers into integers.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L2B: \n  assumes A1: \"f\\<in>\\<S>\" and A2: \"m\\<in>\\<int>\" \n  shows \"f`(m) \\<in> \\<int>\"\nproof -\n  from A1 have \"f:\\<int>\\<rightarrow>\\<int>\" using AlmostHoms_def by simp\n  with A2 show \"f`(m) \\<in> \\<int>\" using apply_funtype by simp\nqed\n\ntext\\<open>The homomorphism difference in multiplicative notation is defined as\n  the expression $s(m\\cdot n)\\cdot(s(m)\\cdot s(n))^{-1}$. The next lemma \n  shows that \n  in the additive notation used for integers the homomorphism \n  difference is $f(m+n) - f(m) - f(n)$ which we denote as \\<open>\\<delta>(f,m,n)\\<close>.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L3: \n  assumes \"f:\\<int>\\<rightarrow>\\<int>\" and \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"\n  shows \"HomDiff(\\<int>,IntegerAddition,f,\\<langle> m,n\\<rangle>) = \\<delta>(f,m,n)\"\n  using assms Int_ZF_2_1_L2A Int_ZF_1_T2 group0.group0_4_L4A \n    HomDiff_def by auto\n\ntext\\<open>The next formula restates the definition of the homomorphism \n  difference to express the value an almost homomorphism on a sum.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L3A: \n  assumes A1: \"f\\<in>\\<S>\" and A2: \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"\n  shows \n  \"f`(m\\<ra>n) = f`(m)\\<ra>(f`(n)\\<ra>\\<delta>(f,m,n))\"\nproof -\n  from A1 A2 have\n    T: \"f`(m)\\<in> \\<int>\"  \"f`(n) \\<in> \\<int>\"  \"\\<delta>(f,m,n) \\<in> \\<int>\" and\n    \"HomDiff(\\<int>,IntegerAddition,f,\\<langle> m,n\\<rangle>) = \\<delta>(f,m,n)\"  \n    using Int_ZF_2_1_L2 AlmostHoms_def Int_ZF_2_1_L3 by auto\n  with A1 A2 show  \"f`(m\\<ra>n) = f`(m)\\<ra>(f`(n)\\<ra>\\<delta>(f,m,n))\" \n    using Int_ZF_2_1_L3 Int_ZF_1_L3 \n      Int_ZF_2_1_L1 group1.Group_ZF_3_4_L1 \n    by simp\nqed\n\ntext\\<open>The homomorphism difference of any integer function is integer.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L3B: \n  assumes \"f:\\<int>\\<rightarrow>\\<int>\" and \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"\n  shows \"\\<delta>(f,m,n) \\<in> \\<int>\"\n  using assms Int_ZF_2_1_L2A Int_ZF_2_1_L3 by simp\n\ntext\\<open>The value of an integer function at a sum expressed in \n  terms of \\<open>\\<delta>\\<close>.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L3C: assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and A2: \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"\n  shows \"f`(m\\<ra>n) = \\<delta>(f,m,n) \\<ra> f`(n) \\<ra> f`(m)\"\nproof -\n  from A1 A2 have T:\n    \"\\<delta>(f,m,n) \\<in> \\<int>\"  \"f`(m\\<ra>n) \\<in> \\<int>\"  \"f`(m) \\<in> \\<int>\"  \"f`(n) \\<in> \\<int>\"\n    using Int_ZF_1_1_L5 apply_funtype by auto\n  then show \"f`(m\\<ra>n) = \\<delta>(f,m,n) \\<ra> f`(n) \\<ra> f`(m)\"\n    using Int_ZF_1_2_L15 by simp\nqed\n\n\ntext\\<open>The next lemma presents two ways the set of homomorphism differences\n  can be written.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L4: assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\"\n  shows \"{abs(HomDiff(\\<int>,IntegerAddition,f,x)). x \\<in> \\<int>\\<times>\\<int>} =\n  {abs(\\<delta>(f,m,n)). \\<langle> m,n\\<rangle> \\<in> \\<int>\\<times>\\<int>}\"\nproof -\n  from A1 have \"\\<forall>m\\<in>\\<int>. \\<forall>n\\<in>\\<int>. \n    abs(HomDiff(\\<int>,IntegerAddition,f,\\<langle> m,n\\<rangle>)) = abs(\\<delta>(f,m,n))\"\n    using Int_ZF_2_1_L3 by simp\n  then show ?thesis by (rule ZF1_1_L4A)\nqed\n\ntext\\<open>If $f$ maps integers into integers and \n  for all $m,n\\in Z$ we have $|f(m+n) - f(m) - f(n)| \\leq L$ for some $L$,\n  then $f$ is a slope.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L5: assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\"\n  and A2: \"\\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>. abs(\\<delta>(f,m,n)) \\<lsq> L\"\n  shows \"f\\<in>\\<S>\"\nproof -\n  let ?Abs = \"AbsoluteValue(\\<int>,IntegerAddition,IntegerOrder)\"\n  have \"group3(\\<int>,IntegerAddition,IntegerOrder)\" \n    \"IntegerOrder {is total on} \\<int>\"\n    using Int_ZF_2_T1 by auto\n  moreover from A1 A2 have \n    \"\\<forall>x\\<in>\\<int>\\<times>\\<int>. HomDiff(\\<int>,IntegerAddition,f,x) \\<in> \\<int> \\<and>\n    \\<langle>?Abs`(HomDiff(\\<int>,IntegerAddition,f,x)),L \\<rangle> \\<in> IntegerOrder\"\n    using Int_ZF_2_1_L2A Int_ZF_2_1_L3 by auto\n  ultimately have \n    \"IsBounded({HomDiff(\\<int>,IntegerAddition,f,x). x\\<in>\\<int>\\<times>\\<int>},IntegerOrder)\"\n    by (rule group3.OrderedGroup_ZF_3_L9A)\n  with A1 show \"f \\<in> \\<S>\" using Int_bounded_iff_fin AlmostHoms_def\n    by simp\nqed\n\ntext\\<open>The absolute value of homomorphism difference \n  of a slope $s$ does not exceed \\<open>max\\<delta>(s)\\<close>.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L7: \n  assumes A1: \"s\\<in>\\<S>\" and A2: \"n\\<in>\\<int>\"  \"m\\<in>\\<int>\"\n  shows \n  \"abs(\\<delta>(s,m,n)) \\<lsq> max\\<delta>(s)\"   \n  \"\\<delta>(s,m,n) \\<in> \\<int>\"   \"max\\<delta>(s) \\<in> \\<int>\"\n  \"(\\<rm>max\\<delta>(s)) \\<lsq> \\<delta>(s,m,n)\"\nproof -\n  from A1 A2 show T: \"\\<delta>(s,m,n) \\<in> \\<int>\"\n    using Int_ZF_2_1_L2 Int_ZF_1_1_L5 by simp\n  let ?A = \"{abs(HomDiff(\\<int>,IntegerAddition,s,x)). x\\<in>\\<int>\\<times>\\<int>}\"\n  let ?B = \"{abs(\\<delta>(s,m,n)). \\<langle> m,n\\<rangle> \\<in> \\<int>\\<times>\\<int>}\"\n  let ?d = \"abs(\\<delta>(s,m,n))\"\n  have \"IsLinOrder(\\<int>,IntegerOrder)\" using Int_ZF_2_T1\n    by simp\n  moreover have \"?A \\<in> Fin(\\<int>)\" \n  proof -\n    have \"\\<forall>k\\<in>\\<int>. abs(k) \\<in> \\<int>\" using Int_ZF_2_L14 by simp\n    moreover from A1 have \n      \"{HomDiff(\\<int>,IntegerAddition,s,x). x \\<in> \\<int>\\<times>\\<int>} \\<in> Fin(\\<int>)\"\n      using AlmostHoms_def by simp\n    ultimately show \"?A \\<in> Fin(\\<int>)\" by (rule Finite1_L6C)\n  qed\n  moreover have \"?A\\<noteq>0\" by auto\n  ultimately have \"\\<forall>k\\<in>?A. \\<langle>k,Maximum(IntegerOrder,?A)\\<rangle> \\<in> IntegerOrder\"\n    by (rule Finite_ZF_1_T2)\n  moreover from A1 A2 have \"?d\\<in>?A\" using AlmostHoms_def Int_ZF_2_1_L4\n    by auto\n  ultimately have \"?d \\<lsq> Maximum(IntegerOrder,?A)\" by auto \n  with A1 show \"?d \\<lsq> max\\<delta>(s)\"  \"max\\<delta>(s) \\<in> \\<int>\"\n    using AlmostHoms_def Int_ZF_2_1_L4 Int_ZF_2_L1A \n    by auto\n  with T show \"(\\<rm>max\\<delta>(s)) \\<lsq> \\<delta>(s,m,n)\"\n    using Int_ZF_1_3_L19 by simp\nqed\n\ntext\\<open>A useful estimate for the value of a slope at $0$, plus some type information\n  for slopes.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L8: assumes A1: \"s\\<in>\\<S>\"\n  shows \n  \"abs(s`(\\<zero>)) \\<lsq> max\\<delta>(s)\"\n  \"\\<zero> \\<lsq> max\\<delta>(s)\"  \n  \"abs(s`(\\<zero>)) \\<in> \\<int>\"   \"max\\<delta>(s) \\<in> \\<int>\"\n  \"abs(s`(\\<zero>)) \\<ra> max\\<delta>(s) \\<in> \\<int>\"\nproof -\n  from A1 have \"s`(\\<zero>) \\<in> \\<int>\" \n    using int_zero_one_are_int Int_ZF_2_1_L2B by simp\n  then have I: \"\\<zero> \\<lsq> abs(s`(\\<zero>))\"  \n    and \"abs(\\<delta>(s,\\<zero>,\\<zero>)) = abs(s`(\\<zero>))\" \n    using int_abs_nonneg int_zero_one_are_int Int_ZF_1_1_L4 \n      Int_ZF_2_L17 by auto\n  moreover from A1 have \"abs(\\<delta>(s,\\<zero>,\\<zero>)) \\<lsq> max\\<delta>(s)\"\n    using int_zero_one_are_int Int_ZF_2_1_L7 by simp\n  ultimately show II: \"abs(s`(\\<zero>)) \\<lsq> max\\<delta>(s)\"\n    by simp\n  with I show \"\\<zero>\\<lsq>max\\<delta>(s)\" by (rule Int_order_transitive)\n  with II show \n    \"max\\<delta>(s) \\<in> \\<int>\"   \"abs(s`(\\<zero>)) \\<in> \\<int>\" \n    \"abs(s`(\\<zero>)) \\<ra> max\\<delta>(s) \\<in> \\<int>\"\n    using Int_ZF_2_L1A Int_ZF_1_1_L5 by auto\nqed\n\ntext\\<open>Int \\<open>Group_ZF_3.thy\\<close> we show that finite range functions \n  valued in an abelian group \n  form a normal subgroup of almost homomorphisms. \n  This allows to define the equivalence relation \n  between almost homomorphisms as the relation resulting from dividing \n  by that normal subgroup. \n  Then we show in \\<open>Group_ZF_3_4_L12\\<close> that if the difference of $f$ and $g$ \n  has finite range (actually $f(n)\\cdot g(n)^{-1}$ as we use multiplicative \n  notation \n  in \\<open>Group_ZF_3.thy\\<close>), then $f$ and $g$ are equivalent.\n  The next lemma translates that fact into the notation used in \\<open>int1\\<close> \n  context.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L9: assumes A1: \"s\\<in>\\<S>\"  \"r\\<in>\\<S>\"\n  and A2: \"\\<forall>m\\<in>\\<int>. abs(s`(m)\\<rs>r`(m)) \\<lsq> L\"\n  shows \"s \\<sim> r\"\nproof -\n  from A1 A2 have \n    \"\\<forall>m\\<in>\\<int>. s`(m)\\<rs>r`(m) \\<in> \\<int> \\<and> abs(s`(m)\\<rs>r`(m)) \\<lsq> L\"\n    using Int_ZF_2_1_L2B Int_ZF_1_1_L5 by simp\n  then have\n    \"IsBounded({s`(n)\\<rs>r`(n). n\\<in>\\<int>}, IntegerOrder)\"\n    by (rule Int_ZF_1_3_L20)\n  with A1 show \"s \\<sim> r\" using Int_bounded_iff_fin \n    Int_ZF_2_1_L1 group1.Group_ZF_3_4_L12 by simp\nqed\n\ntext\\<open>A neccessary condition for two slopes to be almost equal. \n  For slopes the definition postulates the \n  set $\\{f(m)-g(m): m\\in Z\\}$ to be finite. \n  This lemma shows that this implies that\n  $|f(m)-g(m)|$ is bounded (by some integer) as $m$ varies over integers.\n  We also mention here that in this context \\<open>s \\<sim> r\\<close> implies that both\n  $s$ and $r$ are slopes.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L9A: assumes \"s \\<sim> r\" \n  shows \n  \"\\<exists>L\\<in>\\<int>. \\<forall>m\\<in>\\<int>. abs(s`(m)\\<rs>r`(m)) \\<lsq> L\"\n  \"s\\<in>\\<S>\"  \"r\\<in>\\<S>\"\n  using assms Int_ZF_2_1_L1 group1.Group_ZF_3_4_L11 \n    Int_ZF_1_3_L20AA QuotientGroupRel_def by auto\n\ntext\\<open>Let's recall that the relation of almost equality is an equivalence relation\n  on the set of slopes.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L9B: shows\n  \"AlEqRel \\<subseteq> \\<S>\\<times>\\<S>\"\n  \"equiv(\\<S>,AlEqRel)\"\n  using Int_ZF_2_1_L1 group1.Group_ZF_3_3_L3 by auto\n\ntext\\<open>Another version of sufficient condition for two slopes to be almost\n  equal: if the difference of two slopes is a finite range function, then\n  they are almost equal.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L9C: assumes \"s\\<in>\\<S>\"  \"r\\<in>\\<S>\" and \n  \"s \\<fp> (\\<fm>r) \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\n  shows  \n  \"s \\<sim> r\"  \n  \"r \\<sim> s\"\n  using assms Int_ZF_2_1_L1 \n    group1.Group_ZF_3_2_L13 group1.Group_ZF_3_4_L12A\n  by auto\n\n\ntext\\<open>If two slopes are almost equal, then the difference has finite range.\n  This is the inverse of \\<open>Int_ZF_2_1_L9C\\<close>.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L9D: assumes A1: \"s \\<sim> r\"\n  shows \"s \\<fp> (\\<fm>r) \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\nproof -\n  let ?G = \"\\<int>\"\n  let ?f = \"IntegerAddition\"\n  from A1 have \"AlHomOp1(?G, ?f)`\\<langle>s,GroupInv(AlmostHoms(?G, ?f),AlHomOp1(?G, ?f))`(r)\\<rangle> \n    \\<in> FinRangeFunctions(?G, ?G)\"\n    using Int_ZF_2_1_L1 group1.Group_ZF_3_4_L12B by auto\n  with A1 show \"s \\<fp> (\\<fm>r) \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\n    using Int_ZF_2_1_L9A Int_ZF_2_1_L1 group1.Group_ZF_3_2_L13\n    by simp\nqed\n  \ntext\\<open>What is the value of a composition of slopes?\\<close>\n\nlemma (in int1) Int_ZF_2_1_L10: \n  assumes \"s\\<in>\\<S>\"  \"r\\<in>\\<S>\" and \"m\\<in>\\<int>\"\n  shows \"(s\\<circ>r)`(m) = s`(r`(m))\"  \"s`(r`(m)) \\<in> \\<int>\"\n  using assms Int_ZF_2_1_L1 group1.Group_ZF_3_4_L2 by auto\n\ntext\\<open>Composition of slopes is a slope.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L11:\n  assumes \"s\\<in>\\<S>\"  \"r\\<in>\\<S>\"\n  shows \"s\\<circ>r \\<in> \\<S>\"\n  using assms Int_ZF_2_1_L1 group1.Group_ZF_3_4_T1 by simp\n\ntext\\<open>Negative of a slope is a slope.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L12: assumes \"s\\<in>\\<S>\" shows \"\\<fm>s \\<in> \\<S>\"\n  using assms Int_ZF_1_T2 Int_ZF_2_1_L1 group1.Group_ZF_3_2_L13 \n  by simp\n\ntext\\<open>What is the value of a negative of a slope?\\<close>\n\nlemma (in int1) Int_ZF_2_1_L12A: \n  assumes \"s\\<in>\\<S>\" and \"m\\<in>\\<int>\" shows \"(\\<fm>s)`(m) = \\<rm>(s`(m))\"\n  using assms Int_ZF_2_1_L1 group1.Group_ZF_3_2_L5\n  by simp\n\ntext\\<open>What are the values of a sum of slopes?\\<close>\n\nlemma (in int1) Int_ZF_2_1_L12B: assumes \"s\\<in>\\<S>\"  \"r\\<in>\\<S>\" and \"m\\<in>\\<int>\"\n  shows \"(s\\<fp>r)`(m) = s`(m) \\<ra> r`(m)\"\n  using assms Int_ZF_2_1_L1 group1.Group_ZF_3_2_L12\n  by simp\n\ntext\\<open>Sum of slopes is a slope.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L12C: assumes \"s\\<in>\\<S>\"  \"r\\<in>\\<S>\"\n  shows \"s\\<fp>r \\<in> \\<S>\"\n  using assms Int_ZF_2_1_L1 group1.Group_ZF_3_2_L16\n  by simp\n\ntext\\<open>A simple but useful identity.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L13: \n  assumes \"s\\<in>\\<S>\" and \"n\\<in>\\<int>\"  \"m\\<in>\\<int>\"\n  shows \"s`(n\\<cdot>m) \\<ra> (s`(m) \\<ra> \\<delta>(s,n\\<cdot>m,m)) = s`((n\\<ra>\\<one>)\\<cdot>m)\"\n  using assms Int_ZF_1_1_L5 Int_ZF_2_1_L2B Int_ZF_1_2_L9 Int_ZF_1_2_L7\n  by simp\n\ntext\\<open>Some estimates for the absolute value of a slope at the opposite \n  integer.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L14: assumes A1: \"s\\<in>\\<S>\" and A2: \"m\\<in>\\<int>\"\n  shows \n  \"s`(\\<rm>m) = s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m) \\<rs> s`(m)\"\n  \"abs(s`(m)\\<ra>s`(\\<rm>m)) \\<lsq> \\<two>\\<cdot>max\\<delta>(s)\"\n  \"abs(s`(\\<rm>m)) \\<lsq> \\<two>\\<cdot>max\\<delta>(s) \\<ra> abs(s`(m))\"\n  \"s`(\\<rm>m) \\<lsq> abs(s`(\\<zero>)) \\<ra> max\\<delta>(s) \\<rs> s`(m)\"\nproof -\n  from A1 A2 have T:\n    \"(\\<rm>m) \\<in> \\<int>\"  \"abs(s`(m)) \\<in> \\<int>\"  \"s`(\\<zero>) \\<in> \\<int>\"  \"abs(s`(\\<zero>)) \\<in> \\<int>\"  \n    \"\\<delta>(s,m,\\<rm>m) \\<in> \\<int>\"   \"s`(m) \\<in> \\<int>\"   \"s`(\\<rm>m) \\<in> \\<int>\"  \n    \"(\\<rm>(s`(m))) \\<in> \\<int>\"  \"s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m) \\<in> \\<int>\"\n    using Int_ZF_1_1_L4 Int_ZF_2_1_L2B Int_ZF_2_L14 Int_ZF_2_1_L2 \n      Int_ZF_1_1_L5 int_zero_one_are_int by auto\n  with A2 show I: \"s`(\\<rm>m) = s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m) \\<rs> s`(m)\"\n    using Int_ZF_1_1_L4 Int_ZF_1_2_L15 by simp\n  from T have \"abs(s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m)) \\<lsq> abs(s`(\\<zero>)) \\<ra> abs(\\<delta>(s,m,\\<rm>m))\"\n    using Int_triangle_ineq1 by simp\n  moreover from A1 A2 T have \"abs(s`(\\<zero>)) \\<ra> abs(\\<delta>(s,m,\\<rm>m)) \\<lsq>  \\<two>\\<cdot>max\\<delta>(s)\"\n    using Int_ZF_2_1_L7 Int_ZF_2_1_L8 Int_ZF_1_3_L21 by simp\n  ultimately have \"abs(s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m)) \\<lsq> \\<two>\\<cdot>max\\<delta>(s)\"\n    by (rule Int_order_transitive)\n  moreover\n  from I have \"s`(m) \\<ra> s`(\\<rm>m) = s`(m) \\<ra> (s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m) \\<rs> s`(m))\"\n    by simp\n  with T have \"abs(s`(m) \\<ra> s`(\\<rm>m)) = abs(s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m))\"\n    using Int_ZF_1_2_L3 by simp\n  ultimately show \"abs(s`(m)\\<ra>s`(\\<rm>m)) \\<lsq> \\<two>\\<cdot>max\\<delta>(s)\"\n    by simp\n  from I have \"abs(s`(\\<rm>m)) = abs(s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m) \\<rs> s`(m))\"\n    by simp\n  with T have \n    \"abs(s`(\\<rm>m)) \\<lsq> abs(s`(\\<zero>)) \\<ra> abs(\\<delta>(s,m,\\<rm>m)) \\<ra> abs(s`(m))\"\n    using int_triangle_ineq3 by simp\n  moreover from A1 A2 T have\n    \"abs(s`(\\<zero>)) \\<ra> abs(\\<delta>(s,m,\\<rm>m)) \\<ra> abs(s`(m)) \\<lsq> \\<two>\\<cdot>max\\<delta>(s) \\<ra> abs(s`(m))\"\n    using Int_ZF_2_1_L7 Int_ZF_2_1_L8 Int_ZF_1_3_L21 int_ord_transl_inv by simp\n  ultimately show \"abs(s`(\\<rm>m)) \\<lsq> \\<two>\\<cdot>max\\<delta>(s) \\<ra> abs(s`(m))\"\n    by (rule Int_order_transitive)\n  from T have \"s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m) \\<lsq> abs(s`(\\<zero>)) \\<ra> abs(\\<delta>(s,m,\\<rm>m))\"\n    using Int_ZF_2_L15E by simp\n  moreover from A1 A2 T have \n    \"abs(s`(\\<zero>)) \\<ra> abs(\\<delta>(s,m,\\<rm>m)) \\<lsq> abs(s`(\\<zero>)) \\<ra> max\\<delta>(s)\"\n    using Int_ZF_2_1_L7 int_ord_transl_inv by simp\n  ultimately have \"s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m) \\<lsq> abs(s`(\\<zero>)) \\<ra> max\\<delta>(s)\"\n    by (rule Int_order_transitive)\n  with T have \n    \"s`(\\<zero>) \\<rs> \\<delta>(s,m,\\<rm>m) \\<rs> s`(m) \\<lsq> abs(s`(\\<zero>)) \\<ra> max\\<delta>(s) \\<rs> s`(m)\"\n    using int_ord_transl_inv by simp\n  with I show \"s`(\\<rm>m) \\<lsq> abs(s`(\\<zero>)) \\<ra> max\\<delta>(s) \\<rs> s`(m)\"\n    by simp\nqed\n\ntext\\<open>An identity that expresses the value of an integer function at the opposite\n  integer in terms of the value of that function at the integer, zero, and the \n  homomorphism difference. We have a similar identity in \\<open>Int_ZF_2_1_L14\\<close>, but\n  over there we assume that $f$ is a slope.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L14A: assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and A2: \"m\\<in>\\<int>\"\n  shows \"f`(\\<rm>m) = (\\<rm>\\<delta>(f,m,\\<rm>m)) \\<ra> f`(\\<zero>) \\<rs> f`(m)\"\nproof -\n  from A1 A2 have T:\n    \"f`(\\<rm>m) \\<in> \\<int>\"  \"\\<delta>(f,m,\\<rm>m) \\<in> \\<int>\"  \"f`(\\<zero>) \\<in> \\<int>\"  \"f`(m) \\<in> \\<int>\"\n    using Int_ZF_1_1_L4 Int_ZF_1_1_L5 int_zero_one_are_int apply_funtype \n    by auto\n   with A2 show \"f`(\\<rm>m) = (\\<rm>\\<delta>(f,m,\\<rm>m)) \\<ra> f`(\\<zero>) \\<rs> f`(m)\"\n     using Int_ZF_1_1_L4 Int_ZF_1_2_L15 by simp\nqed\n\ntext\\<open>The next lemma allows to use the expression \\<open>maxf(f,\\<zero>..M-1)\\<close>. \n  Recall that \\<open>maxf(f,A)\\<close> is the maximum of (function) $f$ on \n  (the set) $A$.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L15:\n  assumes \"s\\<in>\\<S>\" and \"M \\<in> \\<int>\\<^sub>+\"\n  shows \n  \"maxf(s,\\<zero>..(M\\<rs>\\<one>)) \\<in> \\<int>\"\n  \"\\<forall>n \\<in> \\<zero>..(M\\<rs>\\<one>). s`(n) \\<lsq> maxf(s,\\<zero>..(M\\<rs>\\<one>))\"\n  \"minf(s,\\<zero>..(M\\<rs>\\<one>)) \\<in> \\<int>\"\n  \"\\<forall>n \\<in> \\<zero>..(M\\<rs>\\<one>). minf(s,\\<zero>..(M\\<rs>\\<one>)) \\<lsq> s`(n)\"\n  using assms AlmostHoms_def Int_ZF_1_5_L6 Int_ZF_1_4_L2\n  by auto\n\ntext\\<open>A lower estimate for the value of a slope at $nM+k$.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L16:\n  assumes A1: \"s\\<in>\\<S>\"  and A2: \"m\\<in>\\<int>\" and A3: \"M \\<in> \\<int>\\<^sub>+\" and A4: \"k \\<in> \\<zero>..(M\\<rs>\\<one>)\"\n  shows \"s`(m\\<cdot>M) \\<ra> (minf(s,\\<zero>..(M\\<rs>\\<one>))\\<rs> max\\<delta>(s)) \\<lsq> s`(m\\<cdot>M\\<ra>k)\"\nproof -\n  from A3 have \"\\<zero>..(M\\<rs>\\<one>) \\<subseteq> \\<int>\"\n    using Int_ZF_1_5_L6 by simp\n  with A1 A2 A3 A4 have T: \"m\\<cdot>M \\<in> \\<int>\"   \"k \\<in> \\<int>\"  \"s`(m\\<cdot>M) \\<in> \\<int>\"\n    using PositiveSet_def Int_ZF_1_1_L5  Int_ZF_2_1_L2B\n    by auto\n  with A1 A3 A4 have \n    \"s`(m\\<cdot>M) \\<ra> (minf(s,\\<zero>..(M\\<rs>\\<one>)) \\<rs> max\\<delta>(s)) \\<lsq> s`(m\\<cdot>M) \\<ra> (s`(k) \\<ra> \\<delta>(s,m\\<cdot>M,k))\"\n    using Int_ZF_2_1_L15 Int_ZF_2_1_L7 int_ineq_add_sides int_ord_transl_inv\n    by simp\n  with A1 T show ?thesis using Int_ZF_2_1_L3A by simp\nqed\n\ntext\\<open>Identity is a slope.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L17: shows \"id(\\<int>) \\<in> \\<S>\"\n  using Int_ZF_2_1_L1 group1.Group_ZF_3_4_L15 by simp\n\ntext\\<open>Simple identities about (absolute value of) homomorphism differences.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L18:  \n  assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and A2: \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"\n  shows \n  \"abs(f`(n) \\<ra> f`(m) \\<rs> f`(m\\<ra>n)) = abs(\\<delta>(f,m,n))\"\n  \"abs(f`(m) \\<ra> f`(n) \\<rs> f`(m\\<ra>n)) = abs(\\<delta>(f,m,n))\"\n  \"(\\<rm>(f`(m))) \\<rs> f`(n) \\<ra> f`(m\\<ra>n) = \\<delta>(f,m,n)\"\n  \"(\\<rm>(f`(n))) \\<rs> f`(m) \\<ra> f`(m\\<ra>n) = \\<delta>(f,m,n)\"\n  \"abs((\\<rm>f`(m\\<ra>n)) \\<ra> f`(m) \\<ra> f`(n)) = abs(\\<delta>(f,m,n))\"\nproof -\n  from A1 A2 have T: \n    \"f`(m\\<ra>n) \\<in> \\<int>\"  \"f`(m) \\<in> \\<int>\"  \"f`(n) \\<in> \\<int>\"\n    \"f`(m\\<ra>n) \\<rs> f`(m) \\<rs>  f`(n)  \\<in> \\<int>\"\n    \"(\\<rm>(f`(m))) \\<in> \\<int>\"\n    \"(\\<rm>f`(m\\<ra>n)) \\<ra> f`(m) \\<ra> f`(n) \\<in> \\<int>\"\n    using apply_funtype Int_ZF_1_1_L4 Int_ZF_1_1_L5 by auto\n  then have \n    \"abs(\\<rm>(f`(m\\<ra>n) \\<rs> f`(m) \\<rs>  f`(n))) = abs(f`(m\\<ra>n) \\<rs> f`(m) \\<rs>  f`(n))\"\n    using Int_ZF_2_L17 by simp\n  moreover from T have \n    \"(\\<rm>(f`(m\\<ra>n) \\<rs> f`(m) \\<rs>  f`(n))) = f`(n) \\<ra> f`(m) \\<rs> f`(m\\<ra>n)\"\n    using Int_ZF_1_2_L9A by simp\n  ultimately show \"abs(f`(n) \\<ra> f`(m) \\<rs> f`(m\\<ra>n)) = abs(\\<delta>(f,m,n))\"\n    by simp\n  moreover from T have \"f`(n) \\<ra> f`(m) = f`(m) \\<ra> f`(n)\"\n    using Int_ZF_1_1_L5 by simp\n  ultimately show \"abs(f`(m) \\<ra> f`(n) \\<rs> f`(m\\<ra>n)) = abs(\\<delta>(f,m,n))\"\n    by simp\n  from T show \n    \"(\\<rm>(f`(m))) \\<rs> f`(n) \\<ra> f`(m\\<ra>n) = \\<delta>(f,m,n)\"\n    \"(\\<rm>(f`(n))) \\<rs> f`(m) \\<ra> f`(m\\<ra>n) = \\<delta>(f,m,n)\"\n    using Int_ZF_1_2_L9 by auto\n  from T have \n    \"abs((\\<rm>f`(m\\<ra>n)) \\<ra> f`(m) \\<ra> f`(n)) =\n    abs(\\<rm>((\\<rm>f`(m\\<ra>n)) \\<ra> f`(m) \\<ra> f`(n)))\"\n    using Int_ZF_2_L17 by simp\n  also from T have \n    \"abs(\\<rm>((\\<rm>f`(m\\<ra>n)) \\<ra> f`(m) \\<ra> f`(n))) = abs(\\<delta>(f,m,n))\"\n    using Int_ZF_1_2_L9 by simp\n  finally show \"abs((\\<rm>f`(m\\<ra>n)) \\<ra> f`(m) \\<ra> f`(n)) = abs(\\<delta>(f,m,n))\"\n    by simp\nqed\n  \ntext\\<open>Some identities about the homomorphism difference of odd functions.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L19: \n  assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and A2: \"\\<forall>x\\<in>\\<int>. (\\<rm>f`(\\<rm>x)) = f`(x)\"\n  and A3: \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"\n  shows\n  \"abs(\\<delta>(f,\\<rm>m,m\\<ra>n)) = abs(\\<delta>(f,m,n))\"\n  \"abs(\\<delta>(f,\\<rm>n,m\\<ra>n)) = abs(\\<delta>(f,m,n))\"\n  \"\\<delta>(f,n,\\<rm>(m\\<ra>n)) = \\<delta>(f,m,n)\"\n  \"\\<delta>(f,m,\\<rm>(m\\<ra>n)) = \\<delta>(f,m,n)\"\n  \"abs(\\<delta>(f,\\<rm>m,\\<rm>n)) = abs(\\<delta>(f,m,n))\"\nproof -\n  from A1 A2 A3 show \n    \"abs(\\<delta>(f,\\<rm>m,m\\<ra>n)) = abs(\\<delta>(f,m,n))\"\n    \"abs(\\<delta>(f,\\<rm>n,m\\<ra>n)) = abs(\\<delta>(f,m,n))\"\n    using Int_ZF_1_2_L3 Int_ZF_2_1_L18 by auto\n  from A3 have T: \"m\\<ra>n \\<in> \\<int>\" using Int_ZF_1_1_L5 by simp\n  from A1 A2 have I: \"\\<forall>x\\<in>\\<int>. f`(\\<rm>x) = (\\<rm>f`(x))\"\n    using Int_ZF_1_5_L13 by simp\n  with A1 A2 A3 T show \n    \"\\<delta>(f,n,\\<rm>(m\\<ra>n)) = \\<delta>(f,m,n)\"\n    \"\\<delta>(f,m,\\<rm>(m\\<ra>n)) = \\<delta>(f,m,n)\"\n    using Int_ZF_1_2_L3 Int_ZF_2_1_L18 by auto\n  from A3 have \n    \"abs(\\<delta>(f,\\<rm>m,\\<rm>n)) = abs(f`(\\<rm>(m\\<ra>n)) \\<rs> f`(\\<rm>m) \\<rs> f`(\\<rm>n))\"\n    using Int_ZF_1_1_L5 by simp\n  also from A1 A2 A3 T I have \"\\<dots> = abs(\\<delta>(f,m,n))\"\n    using Int_ZF_2_1_L18 by simp\n  finally show \"abs(\\<delta>(f,\\<rm>m,\\<rm>n)) = abs(\\<delta>(f,m,n))\" by simp\nqed\n\ntext\\<open>Recall that $f$ is a slope iff $f(m+n)-f(m)-f(n)$ is bounded\n  as $m,n$ ranges over integers. The next lemma is the first \n  step in showing that we only need to check this condition as $m,n$ ranges\n  over positive intergers. Namely we show that if the condition holds for\n  positive integers, then it holds if one integer is positive and the second \n  one is nonnegative.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L20: assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and\n  A2: \"\\<forall>a\\<in>\\<int>\\<^sub>+. \\<forall>b\\<in>\\<int>\\<^sub>+. abs(\\<delta>(f,a,b)) \\<lsq> L\" and\n  A3:  \"m\\<in>\\<int>\\<^sup>+\"  \"n\\<in>\\<int>\\<^sub>+\"\n  shows \n  \"\\<zero> \\<lsq> L\"\n  \"abs(\\<delta>(f,m,n)) \\<lsq> L \\<ra> abs(f`(\\<zero>))\"\nproof -       \n  from A1 A2 have \n    \"\\<delta>(f,\\<one>,\\<one>) \\<in> \\<int>\"  and \"abs(\\<delta>(f,\\<one>,\\<one>)) \\<lsq> L\" \n    using int_one_two_are_pos PositiveSet_def Int_ZF_2_1_L3B\n    by auto\n  then show I: \"\\<zero> \\<lsq> L\" using Int_ZF_1_3_L19 by simp\n  from A1 A3 have T: \n    \"n \\<in> \\<int>\"  \"f`(n) \\<in> \\<int>\"  \"f`(\\<zero>) \\<in> \\<int>\"  \n    \"\\<delta>(f,m,n) \\<in> \\<int>\"  \"abs(\\<delta>(f,m,n)) \\<in> \\<int>\"\n    using PositiveSet_def int_zero_one_are_int apply_funtype\n      Nonnegative_def Int_ZF_2_1_L3B Int_ZF_2_L14 by auto\n  from A3 have \"m=\\<zero> \\<or> m\\<in>\\<int>\\<^sub>+\" using Int_ZF_1_5_L3A by auto\n  moreover\n  { assume \"m = \\<zero>\"\n    with T I have \"abs(\\<delta>(f,m,n)) \\<lsq> L \\<ra> abs(f`(\\<zero>))\"\n      using Int_ZF_1_1_L4 Int_ZF_1_2_L3 Int_ZF_2_L17 \n\tint_ord_is_refl refl_def Int_ZF_2_L15F by simp }\n  moreover\n  { assume \"m\\<in>\\<int>\\<^sub>+\"\n    with A2 A3 T have \"abs(\\<delta>(f,m,n)) \\<lsq> L \\<ra> abs(f`(\\<zero>))\"\n       using int_abs_nonneg Int_ZF_2_L15F by simp }\n   ultimately show \"abs(\\<delta>(f,m,n)) \\<lsq> L \\<ra> abs(f`(\\<zero>))\"\n     by auto\nqed\n\ntext\\<open>If the slope condition holds for all pairs of integers such that one integer is \n  positive and the second one is nonnegative, then it holds when both integers are \n  nonnegative.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L21: assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and\n  A2: \"\\<forall>a\\<in>\\<int>\\<^sup>+. \\<forall>b\\<in>\\<int>\\<^sub>+. abs(\\<delta>(f,a,b)) \\<lsq> L\" and\n  A3: \"n\\<in>\\<int>\\<^sup>+\"  \"m\\<in>\\<int>\\<^sup>+\"\n  shows \"abs(\\<delta>(f,m,n)) \\<lsq> L \\<ra> abs(f`(\\<zero>))\"\nproof -\n  from A1 A2 have \n    \"\\<delta>(f,\\<one>,\\<one>) \\<in> \\<int>\"  and \"abs(\\<delta>(f,\\<one>,\\<one>)) \\<lsq> L\" \n    using int_one_two_are_pos PositiveSet_def Nonnegative_def Int_ZF_2_1_L3B\n    by auto\n  then have I: \"\\<zero> \\<lsq> L\" using Int_ZF_1_3_L19 by simp\n  from A1 A3 have T: \n    \"m \\<in> \\<int>\"  \"f`(m) \\<in> \\<int>\"  \"f`(\\<zero>) \\<in> \\<int>\"  \"(\\<rm>f`(\\<zero>)) \\<in> \\<int>\"  \n    \"\\<delta>(f,m,n) \\<in> \\<int>\"  \"abs(\\<delta>(f,m,n)) \\<in> \\<int>\"\n    using int_zero_one_are_int apply_funtype Nonnegative_def \n      Int_ZF_2_1_L3B Int_ZF_2_L14 Int_ZF_1_1_L4 by auto\n  from A3 have \"n=\\<zero> \\<or> n\\<in>\\<int>\\<^sub>+\" using Int_ZF_1_5_L3A by auto\n  moreover\n  { assume \"n=\\<zero>\"\n     with T have \"\\<delta>(f,m,n) = \\<rm>f`(\\<zero>)\"\n      using Int_ZF_1_1_L4 by simp\n    with T have \"abs(\\<delta>(f,m,n)) = abs(f`(\\<zero>))\"\n      using Int_ZF_2_L17 by simp\n    with T have \"abs(\\<delta>(f,m,n)) \\<lsq> abs(f`(\\<zero>))\"\n      using int_ord_is_refl refl_def by simp\n    with T I have \"abs(\\<delta>(f,m,n)) \\<lsq> L \\<ra> abs(f`(\\<zero>))\"\n      using Int_ZF_2_L15F by simp }\n  moreover\n  { assume \"n\\<in>\\<int>\\<^sub>+\"\n    with A2 A3 T have \"abs(\\<delta>(f,m,n)) \\<lsq> L \\<ra> abs(f`(\\<zero>))\"\n      using int_abs_nonneg Int_ZF_2_L15F by simp }\n  ultimately show  \"abs(\\<delta>(f,m,n)) \\<lsq> L \\<ra> abs(f`(\\<zero>))\"\n    by auto\nqed\n\ntext\\<open>If the homomorphism difference is bounded on \\<open>\\<int>\\<^sub>+\\<times>\\<int>\\<^sub>+\\<close>, \n  then it is bounded on \\<open>\\<int>\\<^sup>+\\<times>\\<int>\\<^sup>+\\<close>.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L22: assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and\n  A2: \"\\<forall>a\\<in>\\<int>\\<^sub>+. \\<forall>b\\<in>\\<int>\\<^sub>+. abs(\\<delta>(f,a,b)) \\<lsq> L\"\n  shows \"\\<exists>M. \\<forall>m\\<in>\\<int>\\<^sup>+. \\<forall>n\\<in>\\<int>\\<^sup>+. abs(\\<delta>(f,m,n)) \\<lsq> M\"\nproof -\n  from A1 A2 have \n    \"\\<forall>m\\<in>\\<int>\\<^sup>+. \\<forall>n\\<in>\\<int>\\<^sup>+. abs(\\<delta>(f,m,n)) \\<lsq> L \\<ra> abs(f`(\\<zero>)) \\<ra> abs(f`(\\<zero>))\"\n    using Int_ZF_2_1_L20 Int_ZF_2_1_L21 by simp\n  then show ?thesis by auto\nqed\n\ntext\\<open>For odd functions we can do better than in \\<open>Int_ZF_2_1_L22\\<close>: \n  if the homomorphism \n  difference of $f$ is bounded on \\<open>\\<int>\\<^sup>+\\<times>\\<int>\\<^sup>+\\<close>, then it is bounded \n  on \\<open>\\<int>\\<times>\\<int>\\<close>, hence $f$ is a slope. \n  Loong prof by splitting the \\<open>\\<int>\\<times>\\<int>\\<close> into six subsets.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L23: assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and\n  A2: \"\\<forall>a\\<in>\\<int>\\<^sub>+. \\<forall>b\\<in>\\<int>\\<^sub>+. abs(\\<delta>(f,a,b)) \\<lsq> L\"\n  and A3: \"\\<forall>x\\<in>\\<int>. (\\<rm>f`(\\<rm>x)) = f`(x)\"\n  shows (*\"\\<exists>M. \\<forall>m\\<in>\\<int>. \\<forall>n\\<in>\\<int>. abs(\\<delta>(f,m,n)) \\<lsq> M\"*) \"f\\<in>\\<S>\"\nproof -\n  from A1 A2 have\n    \"\\<exists>M.\\<forall>a\\<in>\\<int>\\<^sup>+. \\<forall>b\\<in>\\<int>\\<^sup>+. abs(\\<delta>(f,a,b)) \\<lsq> M\"\n    by (rule Int_ZF_2_1_L22)\n  then obtain M where I: \"\\<forall>m\\<in>\\<int>\\<^sup>+. \\<forall>n\\<in>\\<int>\\<^sup>+. abs(\\<delta>(f,m,n)) \\<lsq> M\"\n    by auto\n  { fix a b assume A4: \"a\\<in>\\<int>\"  \"b\\<in>\\<int>\"\n    then have \n      \"\\<zero>\\<lsq>a \\<and> \\<zero>\\<lsq>b  \\<or>  a\\<lsq>\\<zero> \\<and> b\\<lsq>\\<zero>  \\<or>  \n      a\\<lsq>\\<zero> \\<and> \\<zero>\\<lsq>b \\<and> \\<zero> \\<lsq> a\\<ra>b  \\<or> a\\<lsq>\\<zero> \\<and> \\<zero>\\<lsq>b \\<and> a\\<ra>b \\<lsq> \\<zero>  \\<or>  \n      \\<zero>\\<lsq>a \\<and> b\\<lsq>\\<zero> \\<and> \\<zero> \\<lsq> a\\<ra>b  \\<or>  \\<zero>\\<lsq>a \\<and> b\\<lsq>\\<zero> \\<and> a\\<ra>b \\<lsq> \\<zero>\"\n      using int_plane_split_in6 by simp\n    moreover\n    { assume \"\\<zero>\\<lsq>a \\<and> \\<zero>\\<lsq>b\" \n      then have \"a\\<in>\\<int>\\<^sup>+\"  \"b\\<in>\\<int>\\<^sup>+\"\n\tusing Int_ZF_2_L16 by auto\n      with I have \"abs(\\<delta>(f,a,b)) \\<lsq> M\" by simp }\n    moreover\n    { assume \"a\\<lsq>\\<zero> \\<and> b\\<lsq>\\<zero>\"\n      with I have \"abs(\\<delta>(f,\\<rm>a,\\<rm>b)) \\<lsq> M\"\n\tusing Int_ZF_2_L10A Int_ZF_2_L16 by simp\n      with A1 A3 A4 have \"abs(\\<delta>(f,a,b)) \\<lsq> M\"\n\tusing Int_ZF_2_1_L19 by simp }\n    moreover\n    { assume \"a\\<lsq>\\<zero> \\<and> \\<zero>\\<lsq>b \\<and> \\<zero> \\<lsq> a\\<ra>b\"\n      with I have \"abs(\\<delta>(f,\\<rm>a,a\\<ra>b)) \\<lsq> M\"\n\tusing Int_ZF_2_L10A Int_ZF_2_L16 by simp\n      with A1 A3 A4 have \"abs(\\<delta>(f,a,b)) \\<lsq> M\"\n\tusing Int_ZF_2_1_L19 by simp } \n    moreover\n    { assume \"a\\<lsq>\\<zero> \\<and> \\<zero>\\<lsq>b \\<and> a\\<ra>b \\<lsq> \\<zero>\"\n      with I have \"abs(\\<delta>(f,b,\\<rm>(a\\<ra>b))) \\<lsq> M\"\n\tusing Int_ZF_2_L10A Int_ZF_2_L16 by simp\n      with A1 A3 A4 have \"abs(\\<delta>(f,a,b)) \\<lsq> M\"\n\tusing Int_ZF_2_1_L19 by simp }\n    moreover\n    { assume \"\\<zero>\\<lsq>a \\<and> b\\<lsq>\\<zero> \\<and> \\<zero> \\<lsq> a\\<ra>b\"\n      with I have \"abs(\\<delta>(f,\\<rm>b,a\\<ra>b)) \\<lsq> M\"\n\tusing Int_ZF_2_L10A Int_ZF_2_L16 by simp\n      with A1 A3 A4 have \"abs(\\<delta>(f,a,b)) \\<lsq> M\"\n\tusing Int_ZF_2_1_L19 by simp }\n    moreover\n    { assume \"\\<zero>\\<lsq>a \\<and> b\\<lsq>\\<zero> \\<and> a\\<ra>b \\<lsq> \\<zero>\" \n      with I have \"abs(\\<delta>(f,a,\\<rm>(a\\<ra>b))) \\<lsq> M\"\n\tusing Int_ZF_2_L10A Int_ZF_2_L16 by simp\n      with A1 A3 A4 have \"abs(\\<delta>(f,a,b)) \\<lsq> M\"\n\tusing Int_ZF_2_1_L19 by simp }\n    ultimately have \"abs(\\<delta>(f,a,b)) \\<lsq> M\" by auto } \n  then have \"\\<forall>m\\<in>\\<int>. \\<forall>n\\<in>\\<int>. abs(\\<delta>(f,m,n)) \\<lsq> M\" by simp\n  with A1 show \"f\\<in>\\<S>\" by (rule Int_ZF_2_1_L5)\nqed\n\ntext\\<open>If the homomorphism difference of a function defined \n  on positive integers is bounded, then the odd extension\n  of this function is a slope.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L24: \n  assumes A1: \"f:\\<int>\\<^sub>+\\<rightarrow>\\<int>\" and A2: \"\\<forall>a\\<in>\\<int>\\<^sub>+. \\<forall>b\\<in>\\<int>\\<^sub>+. abs(\\<delta>(f,a,b)) \\<lsq> L\"\n  shows \"OddExtension(\\<int>,IntegerAddition,IntegerOrder,f) \\<in> \\<S>\"\nproof -\n  let ?g = \"OddExtension(\\<int>,IntegerAddition,IntegerOrder,f)\"\n  from A1 have \"?g : \\<int>\\<rightarrow>\\<int>\"\n    using Int_ZF_1_5_L10 by simp\n  moreover have \"\\<forall>a\\<in>\\<int>\\<^sub>+. \\<forall>b\\<in>\\<int>\\<^sub>+. abs(\\<delta>(?g,a,b)) \\<lsq> L\"\n  proof -\n    { fix a b assume A3: \"a\\<in>\\<int>\\<^sub>+\"  \"b\\<in>\\<int>\\<^sub>+\"\n      with A1 have \"abs(\\<delta>(f,a,b)) =  abs(\\<delta>(?g,a,b))\"\n\tusing pos_int_closed_add_unfolded Int_ZF_1_5_L11 \n\tby simp\n      moreover from A2 A3 have \"abs(\\<delta>(f,a,b)) \\<lsq> L\" by simp\n      ultimately have \"abs(\\<delta>(?g,a,b)) \\<lsq> L\" by simp\n    } then show ?thesis by simp\n  qed\n  moreover from A1 have \"\\<forall>x\\<in>\\<int>. (\\<rm>?g`(\\<rm>x)) = ?g`(x)\"\n    using int_oddext_is_odd_alt by simp\n  ultimately show \"?g \\<in> \\<S>\" by (rule Int_ZF_2_1_L23)\nqed\n\ntext\\<open>Type information related to $\\gamma$.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L25: \n  assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and A2: \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"\n  shows \n  \"\\<delta>(f,m,\\<rm>n) \\<in> \\<int>\"\n  \"\\<delta>(f,n,\\<rm>n) \\<in> \\<int>\"\n  \"(\\<rm>\\<delta>(f,n,\\<rm>n)) \\<in> \\<int>\"\n  \"f`(\\<zero>) \\<in> \\<int>\"\n  \"\\<gamma>(f,m,n)  \\<in> \\<int>\"\nproof -\n  from A1 A2 show T1:\n    \"\\<delta>(f,m,\\<rm>n) \\<in> \\<int>\"  \"f`(\\<zero>) \\<in> \\<int>\"\n    using Int_ZF_1_1_L4 Int_ZF_2_1_L3B int_zero_one_are_int apply_funtype\n    by auto\n  from A2 have \"(\\<rm>n) \\<in> \\<int>\"\n    using Int_ZF_1_1_L4 by simp\n  with A1 A2 show \"\\<delta>(f,n,\\<rm>n) \\<in> \\<int>\"\n    using Int_ZF_2_1_L3B by simp\n  then show \"(\\<rm>\\<delta>(f,n,\\<rm>n)) \\<in> \\<int>\"\n    using Int_ZF_1_1_L4 by simp\n  with T1 show \"\\<gamma>(f,m,n)  \\<in> \\<int>\"\n    using Int_ZF_1_1_L5 by simp\nqed \n\ntext\\<open>A couple of formulae involving $f(m-n)$ and $\\gamma(f,m,n)$.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L26: \n  assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and A2: \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"\n  shows \n  \"f`(m\\<rs>n) = \\<gamma>(f,m,n) \\<ra> f`(m) \\<rs> f`(n)\"\n  \"f`(m\\<rs>n) = \\<gamma>(f,m,n) \\<ra> (f`(m) \\<rs> f`(n))\"\n  \"f`(m\\<rs>n) \\<ra> (f`(n) \\<rs> \\<gamma>(f,m,n)) = f`(m)\"\nproof -\n  from A1 A2 have T:\n    \"(\\<rm>n) \\<in> \\<int>\"  \"\\<delta>(f,m,\\<rm>n) \\<in> \\<int>\"  \n    \"f`(\\<zero>) \\<in> \\<int>\"  \"f`(m) \\<in> \\<int>\"  \"f`(n) \\<in> \\<int>\"  \"(\\<rm>f`(n)) \\<in> \\<int>\"\n    \"(\\<rm>\\<delta>(f,n,\\<rm>n)) \\<in> \\<int>\"  \n    \"(\\<rm>\\<delta>(f,n,\\<rm>n))  \\<ra> f`(\\<zero>) \\<in> \\<int>\"\n    \"\\<gamma>(f,m,n) \\<in> \\<int>\"\n    using  Int_ZF_1_1_L4 Int_ZF_2_1_L25 apply_funtype Int_ZF_1_1_L5 \n    by auto\n   with A1 A2 have \"f`(m\\<rs>n) = \n    \\<delta>(f,m,\\<rm>n) \\<ra> ((\\<rm>\\<delta>(f,n,\\<rm>n)) \\<ra> f`(\\<zero>) \\<rs> f`(n)) \\<ra> f`(m)\"\n    using Int_ZF_2_1_L3C Int_ZF_2_1_L14A by simp\n  with T have \"f`(m\\<rs>n) =\n    \\<delta>(f,m,\\<rm>n) \\<ra> ((\\<rm>\\<delta>(f,n,\\<rm>n)) \\<ra> f`(\\<zero>)) \\<ra> f`(m) \\<rs> f`(n)\"\n    using Int_ZF_1_2_L16 by simp\n  moreover from T have \n    \"\\<delta>(f,m,\\<rm>n) \\<ra> ((\\<rm>\\<delta>(f,n,\\<rm>n)) \\<ra> f`(\\<zero>)) = \\<gamma>(f,m,n)\"\n    using Int_ZF_1_1_L7 by simp\n  ultimately show  I: \"f`(m\\<rs>n) = \\<gamma>(f,m,n) \\<ra> f`(m) \\<rs> f`(n)\"\n    by simp\n  then have \"f`(m\\<rs>n) \\<ra> (f`(n) \\<rs> \\<gamma>(f,m,n)) = \n    (\\<gamma>(f,m,n) \\<ra> f`(m) \\<rs> f`(n)) \\<ra> (f`(n) \\<rs> \\<gamma>(f,m,n))\"\n    by simp\n  moreover from T have \"\\<dots> = f`(m)\" using Int_ZF_1_2_L18 \n    by simp\n  ultimately show \"f`(m\\<rs>n) \\<ra> (f`(n) \\<rs> \\<gamma>(f,m,n)) = f`(m)\"\n    by simp\n  from T have \"\\<gamma>(f,m,n) \\<in> \\<int>\"  \"f`(m) \\<in> \\<int>\"  \"(\\<rm>f`(n)) \\<in> \\<int>\"\n    by auto\n  then have \n    \"\\<gamma>(f,m,n) \\<ra> f`(m) \\<ra> (\\<rm>f`(n)) =  \\<gamma>(f,m,n) \\<ra> (f`(m) \\<ra> (\\<rm>f`(n)))\"\n    by (rule Int_ZF_1_1_L7)\n  with I show  \"f`(m\\<rs>n) = \\<gamma>(f,m,n) \\<ra> (f`(m) \\<rs> f`(n))\" by simp\nqed\n\ntext\\<open>A formula expressing the difference between $f(m-n-k)$ and\n  $f(m)-f(n)-f(k)$ in terms of $\\gamma$.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L26A: \n  assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and A2: \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"  \"k\\<in>\\<int>\"\n  shows \n  \"f`(m\\<rs>n\\<rs>k) \\<rs> (f`(m)\\<rs> f`(n) \\<rs> f`(k)) = \\<gamma>(f,m\\<rs>n,k) \\<ra> \\<gamma>(f,m,n)\"\nproof -\n  from A1 A2 have \n    T: \"m\\<rs>n \\<in> \\<int>\" \"\\<gamma>(f,m\\<rs>n,k) \\<in> \\<int>\"  \"f`(m) \\<rs> f`(n) \\<rs> f`(k) \\<in> \\<int>\" and\n    T1: \"\\<gamma>(f,m,n) \\<in> \\<int>\"  \"f`(m) \\<rs> f`(n) \\<in> \\<int>\"  \"(\\<rm>f`(k)) \\<in> \\<int>\"\n    using Int_ZF_1_1_L4 Int_ZF_1_1_L5 Int_ZF_2_1_L25 apply_funtype \n    by auto\n  from A1 A2 have \n    \"f`(m\\<rs>n) \\<rs> f`(k) = \\<gamma>(f,m,n) \\<ra> (f`(m) \\<rs> f`(n)) \\<ra> (\\<rm>f`(k))\"\n    using Int_ZF_2_1_L26 by simp\n  also from T1 have \"\\<dots> = \\<gamma>(f,m,n) \\<ra> (f`(m) \\<rs> f`(n) \\<ra> (\\<rm>f`(k)))\"\n    by (rule Int_ZF_1_1_L7)\n  finally have \n    \"f`(m\\<rs>n) \\<rs> f`(k) = \\<gamma>(f,m,n) \\<ra> (f`(m) \\<rs> f`(n) \\<rs> f`(k))\"\n    by simp\n  moreover from A1 A2 T have\n    \"f`(m\\<rs>n\\<rs>k) =  \\<gamma>(f,m\\<rs>n,k) \\<ra> (f`(m\\<rs>n)\\<rs>f`(k))\"\n    using Int_ZF_2_1_L26 by simp\n  ultimately have \n    \"f`(m\\<rs>n\\<rs>k) \\<rs> (f`(m)\\<rs> f`(n) \\<rs> f`(k)) = \n    \\<gamma>(f,m\\<rs>n,k) \\<ra> ( \\<gamma>(f,m,n) \\<ra> (f`(m) \\<rs> f`(n) \\<rs> f`(k))) \n    \\<rs> (f`(m)\\<rs> f`(n) \\<rs> f`(k))\"\n    by simp\n  with T T1 show ?thesis \n    using Int_ZF_1_2_L17 by simp\nqed\n\n\ntext\\<open>If $s$ is a slope, then $\\gamma (s,m,n)$ is uniformly bounded.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L27: assumes A1: \"s\\<in>\\<S>\"\n  shows \"\\<exists>L\\<in>\\<int>. \\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>. abs(\\<gamma>(s,m,n)) \\<lsq> L\"\nproof -\n  let ?L = \"max\\<delta>(s) \\<ra> max\\<delta>(s) \\<ra> abs(s`(\\<zero>))\"\n  from A1 have T: \n    \"max\\<delta>(s) \\<in> \\<int>\"  \"abs(s`(\\<zero>)) \\<in> \\<int>\"  \"?L \\<in> \\<int>\"\n    using Int_ZF_2_1_L8 int_zero_one_are_int Int_ZF_2_1_L2B \n      Int_ZF_2_L14 Int_ZF_1_1_L5 by auto\n  moreover\n  { fix m \n    fix n\n    assume A2: \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"\n    with A1 have T: \n      \"(\\<rm>n) \\<in> \\<int>\"\n      \"\\<delta>(s,m,\\<rm>n) \\<in> \\<int>\"\n      \"\\<delta>(s,n,\\<rm>n) \\<in> \\<int>\"\n      \"(\\<rm>\\<delta>(s,n,\\<rm>n)) \\<in> \\<int>\"\n      \"s`(\\<zero>) \\<in> \\<int>\"  \"abs(s`(\\<zero>)) \\<in> \\<int>\"\n      using Int_ZF_1_1_L4 AlmostHoms_def Int_ZF_2_1_L25 Int_ZF_2_L14\n      by auto\n    with T have\n      \"abs(\\<delta>(s,m,\\<rm>n) \\<rs> \\<delta>(s,n,\\<rm>n) \\<ra> s`(\\<zero>)) \\<lsq>\n      abs(\\<delta>(s,m,\\<rm>n)) \\<ra> abs(\\<rm>\\<delta>(s,n,\\<rm>n)) \\<ra> abs(s`(\\<zero>))\"\n      using Int_triangle_ineq3 by simp\n    moreover from A1 A2 T have \n      \"abs(\\<delta>(s,m,\\<rm>n)) \\<ra> abs(\\<rm>\\<delta>(s,n,\\<rm>n)) \\<ra> abs(s`(\\<zero>)) \\<lsq> ?L\"\n      using Int_ZF_2_1_L7 int_ineq_add_sides int_ord_transl_inv Int_ZF_2_L17\n      by simp\n   ultimately have \"abs(\\<delta>(s,m,\\<rm>n) \\<rs> \\<delta>(s,n,\\<rm>n) \\<ra> s`(\\<zero>)) \\<lsq> ?L\"\n      by (rule Int_order_transitive)    \n    then have \"abs(\\<gamma>(s,m,n)) \\<lsq> ?L\" by simp }\n  ultimately show \"\\<exists>L\\<in>\\<int>. \\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>. abs(\\<gamma>(s,m,n)) \\<lsq> L\"\n    by auto\nqed\n\n\ntext\\<open>If $s$ is a slope, then $s(m) \\leq s(m-1) + M$, where $L$ does not depend\n  on $m$.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L28: assumes A1: \"s\\<in>\\<S>\"\n  shows \"\\<exists>M\\<in>\\<int>. \\<forall>m\\<in>\\<int>. s`(m) \\<lsq> s`(m\\<rs>\\<one>) \\<ra> M\"\nproof -\n  from A1 have\n    \"\\<exists>L\\<in>\\<int>. \\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.abs(\\<gamma>(s,m,n)) \\<lsq> L\"\n    using Int_ZF_2_1_L27 by simp\n  then obtain L where T: \"L\\<in>\\<int>\" and \"\\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.abs(\\<gamma>(s,m,n)) \\<lsq> L\"\n    using Int_ZF_2_1_L27 by auto\n  then have I: \"\\<forall>m\\<in>\\<int>.abs(\\<gamma>(s,m,\\<one>)) \\<lsq> L\"\n    using int_zero_one_are_int by simp\n  let ?M = \"s`(\\<one>) \\<ra> L\"\n  from A1 T have \"?M \\<in> \\<int>\"\n    using int_zero_one_are_int Int_ZF_2_1_L2B Int_ZF_1_1_L5\n    by simp\n  moreover\n  { fix m assume A2: \"m\\<in>\\<int>\"\n    with A1 have \n      T1: \"s:\\<int>\\<rightarrow>\\<int>\"  \"m\\<in>\\<int>\"  \"\\<one>\\<in>\\<int>\" and\n      T2: \"\\<gamma>(s,m,\\<one>) \\<in> \\<int>\"  \"s`(\\<one>) \\<in> \\<int>\"\n      using int_zero_one_are_int AlmostHoms_def \n\tInt_ZF_2_1_L25 by auto\n    from A2 T1 have T3: \"s`(m\\<rs>\\<one>) \\<in> \\<int>\"\n      using Int_ZF_1_1_L5 apply_funtype by simp\n    from I A2 T2 have \n      \"(\\<rm>\\<gamma>(s,m,\\<one>)) \\<lsq> abs(\\<gamma>(s,m,\\<one>))\"\n      \"abs(\\<gamma>(s,m,\\<one>)) \\<lsq> L\"\n      using Int_ZF_2_L19C by auto\n    then have \"(\\<rm>\\<gamma>(s,m,\\<one>)) \\<lsq> L\"\n      by (rule Int_order_transitive)\n    with T2 T3 have \n      \"s`(m\\<rs>\\<one>) \\<ra> (s`(\\<one>) \\<rs> \\<gamma>(s,m,\\<one>)) \\<lsq> s`(m\\<rs>\\<one>) \\<ra> ?M\"\n      using int_ord_transl_inv by simp\n    moreover from T1 have\n      \"s`(m\\<rs>\\<one>) \\<ra> (s`(\\<one>) \\<rs> \\<gamma>(s,m,\\<one>)) = s`(m)\"\n      by (rule Int_ZF_2_1_L26)\n    ultimately have \"s`(m) \\<lsq> s`(m\\<rs>\\<one>) \\<ra> ?M\"  by simp  }\n  ultimately show \"\\<exists>M\\<in>\\<int>. \\<forall>m\\<in>\\<int>. s`(m) \\<lsq> s`(m\\<rs>\\<one>) \\<ra> M\"\n    by auto\nqed\n\ntext\\<open>If $s$ is a slope, then the difference between \n  $s(m-n-k)$ and $s(m)-s(n)-s(k)$ is uniformly bounded.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L29: assumes A1: \"s\\<in>\\<S>\"\n  shows \n  \"\\<exists>M\\<in>\\<int>. \\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.\\<forall>k\\<in>\\<int>. abs(s`(m\\<rs>n\\<rs>k) \\<rs> (s`(m)\\<rs>s`(n)\\<rs>s`(k))) \\<lsq>M\"\nproof -\n  from A1 have \"\\<exists>L\\<in>\\<int>. \\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>. abs(\\<gamma>(s,m,n)) \\<lsq> L\"\n    using Int_ZF_2_1_L27 by simp\n  then obtain L where I: \"L\\<in>\\<int>\" and \n    II: \"\\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>. abs(\\<gamma>(s,m,n)) \\<lsq> L\"\n    by auto\n  from I have \"L\\<ra>L \\<in> \\<int>\"\n    using Int_ZF_1_1_L5 by simp\n  moreover\n  { fix m n k assume A2: \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"  \"k\\<in>\\<int>\"\n    with A1 have T: \n      \"m\\<rs>n \\<in> \\<int>\"  \"\\<gamma>(s,m\\<rs>n,k) \\<in> \\<int>\"  \"\\<gamma>(s,m,n) \\<in> \\<int>\"\n      using Int_ZF_1_1_L5 AlmostHoms_def Int_ZF_2_1_L25 \n      by auto\n    then have \n      I: \"abs(\\<gamma>(s,m\\<rs>n,k) \\<ra> \\<gamma>(s,m,n)) \\<lsq> abs(\\<gamma>(s,m\\<rs>n,k)) \\<ra> abs(\\<gamma>(s,m,n))\"\n      using Int_triangle_ineq by simp\n    from II A2 T have \n      \"abs(\\<gamma>(s,m\\<rs>n,k)) \\<lsq> L\"\n      \"abs(\\<gamma>(s,m,n)) \\<lsq> L\"\n      by auto\n    then have \"abs(\\<gamma>(s,m\\<rs>n,k)) \\<ra> abs(\\<gamma>(s,m,n)) \\<lsq> L\\<ra>L\"\n      using int_ineq_add_sides by simp\n    with I have \"abs(\\<gamma>(s,m\\<rs>n,k) \\<ra> \\<gamma>(s,m,n)) \\<lsq> L\\<ra>L\"\n      by (rule Int_order_transitive)\n    moreover from A1 A2 have \n      \"s`(m\\<rs>n\\<rs>k) \\<rs> (s`(m)\\<rs> s`(n) \\<rs> s`(k)) = \\<gamma>(s,m\\<rs>n,k) \\<ra> \\<gamma>(s,m,n)\"\n      using AlmostHoms_def Int_ZF_2_1_L26A by simp\n    ultimately have \n      \"abs(s`(m\\<rs>n\\<rs>k) \\<rs> (s`(m)\\<rs> s`(n) \\<rs> s`(k))) \\<lsq> L\\<ra>L\"\n      by simp }\n  ultimately show ?thesis by auto\nqed\n\ntext\\<open>If $s$ is a slope, then we can find integers $M,K$ such that\n  $s(m-n-k) \\leq s(m)-s(n)-s(k) + M$ and $s(m)-s(n)-s(k) + K \\leq s(m-n-k)$, \n  for all integer $m,n,k$.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L30: assumes A1: \"s\\<in>\\<S>\"\n  shows \n  \"\\<exists>M\\<in>\\<int>. \\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.\\<forall>k\\<in>\\<int>. s`(m\\<rs>n\\<rs>k) \\<lsq> s`(m)\\<rs>s`(n)\\<rs>s`(k)\\<ra>M\"\n  \"\\<exists>K\\<in>\\<int>. \\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.\\<forall>k\\<in>\\<int>. s`(m)\\<rs>s`(n)\\<rs>s`(k)\\<ra>K \\<lsq> s`(m\\<rs>n\\<rs>k)\"\nproof -\n  from A1 have\n    \"\\<exists>M\\<in>\\<int>. \\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.\\<forall>k\\<in>\\<int>. abs(s`(m\\<rs>n\\<rs>k) \\<rs> (s`(m)\\<rs>s`(n)\\<rs>s`(k))) \\<lsq>M\"\n    using Int_ZF_2_1_L29 by simp\n  then obtain M where I: \"M\\<in>\\<int>\" and II:\n    \"\\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.\\<forall>k\\<in>\\<int>. abs(s`(m\\<rs>n\\<rs>k) \\<rs> (s`(m)\\<rs>s`(n)\\<rs>s`(k))) \\<lsq>M\"\n    by auto\n  from I have III: \"(\\<rm>M) \\<in> \\<int>\" using Int_ZF_1_1_L4 by simp\n  { fix m n k assume A2: \"m\\<in>\\<int>\"  \"n\\<in>\\<int>\"  \"k\\<in>\\<int>\"\n    with A1 have \"s`(m\\<rs>n\\<rs>k) \\<in> \\<int>\"  and \"s`(m)\\<rs>s`(n)\\<rs>s`(k) \\<in> \\<int>\"\n      using Int_ZF_1_1_L5 Int_ZF_2_1_L2B by auto\n    moreover from II A2 have\n      \"abs(s`(m\\<rs>n\\<rs>k) \\<rs> (s`(m)\\<rs>s`(n)\\<rs>s`(k))) \\<lsq>M\"\n      by simp\n    ultimately have \n      \"s`(m\\<rs>n\\<rs>k) \\<lsq> s`(m)\\<rs>s`(n)\\<rs>s`(k)\\<ra>M \\<and> \n      s`(m)\\<rs>s`(n)\\<rs>s`(k) \\<rs> M \\<lsq> s`(m\\<rs>n\\<rs>k)\"\n      using Int_triangle_ineq2 by simp\n  } then have \n      \"\\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.\\<forall>k\\<in>\\<int>. s`(m\\<rs>n\\<rs>k) \\<lsq> s`(m)\\<rs>s`(n)\\<rs>s`(k)\\<ra>M\"\n      \"\\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.\\<forall>k\\<in>\\<int>. s`(m)\\<rs>s`(n)\\<rs>s`(k) \\<rs> M \\<lsq> s`(m\\<rs>n\\<rs>k)\"\n    by auto\n  with I III show  \n    \"\\<exists>M\\<in>\\<int>. \\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.\\<forall>k\\<in>\\<int>. s`(m\\<rs>n\\<rs>k) \\<lsq> s`(m)\\<rs>s`(n)\\<rs>s`(k)\\<ra>M\"\n    \"\\<exists>K\\<in>\\<int>. \\<forall>m\\<in>\\<int>.\\<forall>n\\<in>\\<int>.\\<forall>k\\<in>\\<int>. s`(m)\\<rs>s`(n)\\<rs>s`(k)\\<ra>K \\<lsq> s`(m\\<rs>n\\<rs>k)\"\n    by auto\nqed\n\ntext\\<open>By definition functions $f,g$ are almost equal if $f-g$* is bounded. \n  In the next lemma we show it is sufficient to check the boundedness on positive\n  integers.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L31: assumes A1: \"s\\<in>\\<S>\"  \"r\\<in>\\<S>\" \n  and A2: \"\\<forall>m\\<in>\\<int>\\<^sub>+. abs(s`(m)\\<rs>r`(m)) \\<lsq> L\"\n  shows \"s \\<sim> r\"\nproof -\n  let ?a = \"abs(s`(\\<zero>) \\<rs> r`(\\<zero>))\"\n  let ?c = \"\\<two>\\<cdot>max\\<delta>(s) \\<ra> \\<two>\\<cdot>max\\<delta>(r) \\<ra> L\"\n  let ?M = \"Maximum(IntegerOrder,{?a,L,?c})\"\n  from A2 have \"abs(s`(\\<one>)\\<rs>r`(\\<one>)) \\<lsq> L\"\n    using int_one_two_are_pos by simp\n  then have T: \"L\\<in>\\<int>\" using Int_ZF_2_L1A by simp\n  moreover from A1 have \"?a \\<in> \\<int>\"\n    using int_zero_one_are_int Int_ZF_2_1_L2B \n      Int_ZF_1_1_L5 Int_ZF_2_L14 by simp\n  moreover from A1 T have \"?c \\<in> \\<int>\"\n    using Int_ZF_2_1_L8 int_two_three_are_int Int_ZF_1_1_L5\n    by simp\n  ultimately have \n    I: \"?a \\<lsq> ?M\" and\n    II: \"L \\<lsq> ?M\" and \n    III: \"?c \\<lsq> ?M\"\n    using Int_ZF_1_4_L1A by auto\n  \n  { fix m assume A5: \"m\\<in>\\<int>\"\n    with A1 have T: \n      \"s`(m) \\<in> \\<int>\"  \"r`(m) \\<in> \\<int>\"  \"s`(m) \\<rs> r`(m) \\<in> \\<int>\"\n      \"s`(\\<rm>m) \\<in> \\<int>\"  \"r`(\\<rm>m) \\<in> \\<int>\"\n      using Int_ZF_2_1_L2B Int_ZF_1_1_L4 Int_ZF_1_1_L5 \n      by auto\n    from A5 have \"m=\\<zero> \\<or> m\\<in>\\<int>\\<^sub>+ \\<or> (\\<rm>m) \\<in> \\<int>\\<^sub>+\"\n      using int_decomp_cases by simp\n    moreover\n    { assume \"m=\\<zero>\"\n      with I have \"abs(s`(m) \\<rs> r`(m)) \\<lsq> ?M\"\n\tby simp }\n    moreover\n    { assume \"m\\<in>\\<int>\\<^sub>+\"\n      with A2 II have \n\t\"abs(s`(m)\\<rs>r`(m)) \\<lsq> L\" and \"L\\<lsq>?M\"\n\tby auto\n      then have \"abs(s`(m)\\<rs>r`(m)) \\<lsq> ?M\"\n\tby (rule Int_order_transitive) }\n    moreover\n    { assume A6: \"(\\<rm>m) \\<in> \\<int>\\<^sub>+\"\n      from T have \"abs(s`(m)\\<rs>r`(m)) \\<lsq> \n\tabs(s`(m)\\<ra>s`(\\<rm>m)) \\<ra> abs(r`(m)\\<ra>r`(\\<rm>m)) \\<ra> abs(s`(\\<rm>m)\\<rs>r`(\\<rm>m))\"\n\tusing Int_ZF_1_3_L22A by simp\n      moreover \n      from A1 A2 III A5 A6 have\n\t\"abs(s`(m)\\<ra>s`(\\<rm>m)) \\<ra> abs(r`(m)\\<ra>r`(\\<rm>m)) \\<ra> abs(s`(\\<rm>m)\\<rs>r`(\\<rm>m)) \\<lsq> ?c\"\n\t\"?c \\<lsq> ?M\"\n\tusing Int_ZF_2_1_L14 int_ineq_add_sides by auto\n      then have \n\t\"abs(s`(m)\\<ra>s`(\\<rm>m)) \\<ra> abs(r`(m)\\<ra>r`(\\<rm>m)) \\<ra> abs(s`(\\<rm>m)\\<rs>r`(\\<rm>m)) \\<lsq> ?M\"\n\tby (rule Int_order_transitive)\n      ultimately have  \"abs(s`(m)\\<rs>r`(m)) \\<lsq> ?M\"\n\tby (rule Int_order_transitive) }\n    ultimately have \"abs(s`(m) \\<rs> r`(m)) \\<lsq> ?M\"\n      by auto\n  } then have \"\\<forall>m\\<in>\\<int>. abs(s`(m)\\<rs>r`(m)) \\<lsq> ?M\"\n    by simp\n  with A1 show \"s \\<sim> r\" by (rule Int_ZF_2_1_L9)\nqed\n\ntext\\<open>A sufficient condition for an odd slope to be almost equal to identity:\n  If for all positive integers the value of the slope at $m$ is between $m$ and\n  $m$ plus some constant independent of $m$, then the slope is almost identity.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L32: assumes A1: \"s\\<in>\\<S>\"  \"M\\<in>\\<int>\"\n  and A2: \"\\<forall>m\\<in>\\<int>\\<^sub>+. m \\<lsq> s`(m) \\<and> s`(m) \\<lsq> m\\<ra>M\"\n  shows \"s \\<sim> id(\\<int>)\"\nproof -\n  let ?r = \"id(\\<int>)\"\n  from A1 have \"s\\<in>\\<S>\"  \"?r \\<in> \\<S>\"\n    using Int_ZF_2_1_L17 by auto\n  moreover from A1 A2 have \"\\<forall>m\\<in>\\<int>\\<^sub>+. abs(s`(m)\\<rs>?r`(m)) \\<lsq> M\"\n    using Int_ZF_1_3_L23 PositiveSet_def id_conv by simp\n  ultimately show \"s \\<sim> id(\\<int>)\" by (rule Int_ZF_2_1_L31)\nqed\n\ntext\\<open>A lemma about adding a constant to slopes. This is actually proven in\n  \\<open>Group_ZF_3_5_L1\\<close>, in \\<open>Group_ZF_3.thy\\<close> here we just refer to \n  that lemma to show it in notation used for integers. Unfortunately we have\n  to use raw set notation in the proof.\\<close>\n\nlemma (in int1) Int_ZF_2_1_L33:\n  assumes A1: \"s\\<in>\\<S>\" and A2: \"c\\<in>\\<int>\" and \n  A3: \"r = {\\<langle>m,s`(m)\\<ra>c\\<rangle>. m\\<in>\\<int>}\"\n  shows\n  \"\\<forall>m\\<in>\\<int>. r`(m) = s`(m)\\<ra>c\"\n  \"r\\<in>\\<S>\"\n  \"s \\<sim> r\"\nproof -\n  let ?G = \"\\<int>\"\n  let ?f = \"IntegerAddition\"\n  let ?AH = \"AlmostHoms(?G, ?f)\"\n  from assms have I:\n    \"group1(?G, ?f)\"\n    \"s \\<in> AlmostHoms(?G, ?f)\"\n    \"c \\<in> ?G\"\n    \"r = {\\<langle>x, ?f`\\<langle>s`(x), c\\<rangle>\\<rangle>. x \\<in> ?G}\"\n    using Int_ZF_2_1_L1 by auto\n  then have \"\\<forall>x\\<in>?G. r`(x) = ?f`\\<langle>s`(x),c\\<rangle>\"\n    by (rule group1.Group_ZF_3_5_L1)\n  moreover from I have \"r \\<in> AlmostHoms(?G, ?f)\"\n    by (rule group1.Group_ZF_3_5_L1)\n  moreover from I have \n    \"\\<langle>s, r\\<rangle> \\<in> QuotientGroupRel(AlmostHoms(?G, ?f), AlHomOp1(?G, ?f), FinRangeFunctions(?G, ?G))\"\n    by (rule group1.Group_ZF_3_5_L1)\n  ultimately show \n    \"\\<forall>m\\<in>\\<int>. r`(m) = s`(m)\\<ra>c\"\n    \"r\\<in>\\<S>\"\n    \"s \\<sim> r\"\n    by auto\nqed  \n\nsubsection\\<open>Composing slopes\\<close>\n\ntext\\<open>Composition of slopes is not commutative. However, as we show in this \n  section if $f$ and $g$ are slopes then the range of $f\\circ g - g\\circ f$ \n  is bounded. This allows to show that the multiplication of real \n  numbers is commutative.\\<close>\n\ntext\\<open>Two useful estimates.\\<close>\n\nlemma (in int1) Int_ZF_2_2_L1: \n  assumes A1: \"f:\\<int>\\<rightarrow>\\<int>\" and A2: \"p\\<in>\\<int>\"  \"q\\<in>\\<int>\"\n  shows \n  \"abs(f`((p\\<ra>\\<one>)\\<cdot>q)\\<rs>(p\\<ra>\\<one>)\\<cdot>f`(q)) \\<lsq> abs(\\<delta>(f,p\\<cdot>q,q))\\<ra>abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q))\"\n  \"abs(f`((p\\<rs>\\<one>)\\<cdot>q)\\<rs>(p\\<rs>\\<one>)\\<cdot>f`(q)) \\<lsq> abs(\\<delta>(f,(p\\<rs>\\<one>)\\<cdot>q,q))\\<ra>abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q))\"\nproof -\n  let ?R = \"\\<int>\"\n  let ?A = \"IntegerAddition\"\n  let ?M = \"IntegerMultiplication\"\n  let ?I = \"GroupInv(?R, ?A)\"\n  let ?a = \"f`((p\\<ra>\\<one>)\\<cdot>q)\"\n  let ?b = \"p\"\n  let ?c = \"f`(q)\"\n  let ?d = \"f`(p\\<cdot>q)\"\n  from A1 A2 have T1:\n    \"ring0(?R, ?A, ?M)\"  \"?a \\<in> ?R\"  \"?b \\<in> ?R\"  \"?c \\<in> ?R\"  \"?d \\<in> ?R\"\n    using  Int_ZF_1_1_L2 int_zero_one_are_int Int_ZF_1_1_L5 apply_funtype \n    by auto\n  then have \n    \"?A`\\<langle>?a,?I`(?M`\\<langle>?A`\\<langle>?b, TheNeutralElement(?R, ?M)\\<rangle>,?c\\<rangle>)\\<rangle> =\n    ?A`\\<langle>?A`\\<langle>?A`\\<langle>?a,?I`(?d)\\<rangle>,?I`(?c)\\<rangle>,?A`\\<langle>?d, ?I`(?M`\\<langle>?b, ?c\\<rangle>)\\<rangle>\\<rangle>\"\n    by (rule ring0.Ring_ZF_2_L2)\n  with A2 have \n    \"f`((p\\<ra>\\<one>)\\<cdot>q)\\<rs>(p\\<ra>\\<one>)\\<cdot>f`(q) = \\<delta>(f,p\\<cdot>q,q)\\<ra>(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q))\"\n    using int_zero_one_are_int Int_ZF_1_1_L1 Int_ZF_1_1_L4 by simp\n  moreover from A1 A2 T1 have \"\\<delta>(f,p\\<cdot>q,q) \\<in> \\<int>\" \"f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q) \\<in> \\<int>\"\n    using Int_ZF_1_1_L5 apply_funtype by auto\n  ultimately show \n    \"abs(f`((p\\<ra>\\<one>)\\<cdot>q)\\<rs>(p\\<ra>\\<one>)\\<cdot>f`(q)) \\<lsq> abs(\\<delta>(f,p\\<cdot>q,q))\\<ra>abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q))\"\n    using Int_triangle_ineq by simp\n  from A1 A2 have T1: \n    \"f`((p\\<rs>\\<one>)\\<cdot>q) \\<in> \\<int>\"   \"p\\<in>\\<int>\"  \"f`(q) \\<in> \\<int>\"   \"f`(p\\<cdot>q) \\<in> \\<int>\" \n    using int_zero_one_are_int Int_ZF_1_1_L5 apply_funtype by auto\n  then have\n    \"f`((p\\<rs>\\<one>)\\<cdot>q)\\<rs>(p\\<rs>\\<one>)\\<cdot>f`(q) = (f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q))\\<rs>(f`(p\\<cdot>q)\\<rs>f`((p\\<rs>\\<one>)\\<cdot>q)\\<rs>f`(q))\"\n    by (rule Int_ZF_1_2_L6)\n  with A2 have \"f`((p\\<rs>\\<one>)\\<cdot>q)\\<rs>(p\\<rs>\\<one>)\\<cdot>f`(q) = (f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q))\\<rs>\\<delta>(f,(p\\<rs>\\<one>)\\<cdot>q,q)\"\n    using Int_ZF_1_2_L7 by simp\n  moreover from A1 A2 have \n    \"f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q) \\<in> \\<int>\"   \"\\<delta>(f,(p\\<rs>\\<one>)\\<cdot>q,q) \\<in> \\<int>\" \n    using Int_ZF_1_1_L5 int_zero_one_are_int apply_funtype by auto\n  ultimately show \n    \"abs(f`((p\\<rs>\\<one>)\\<cdot>q)\\<rs>(p\\<rs>\\<one>)\\<cdot>f`(q)) \\<lsq> abs(\\<delta>(f,(p\\<rs>\\<one>)\\<cdot>q,q))\\<ra>abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q))\"\n    using Int_triangle_ineq1 by simp\nqed\n  \ntext\\<open>If $f$ is a slope, then \n  $|f(p\\cdot q)-p\\cdot f(q)|\\leq (|p|+1)\\cdot$\\<open>max\\<delta>(f)\\<close>. \n  The proof is by induction on $p$ and the next lemma is the induction step for the case when $0\\leq p$.\\<close>\n\nlemma (in int1) Int_ZF_2_2_L2: \n  assumes A1: \"f\\<in>\\<S>\" and A2: \"\\<zero>\\<lsq>p\"  \"q\\<in>\\<int>\"\n  and A3: \"abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q)) \\<lsq> (abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\n  shows \n  \"abs(f`((p\\<ra>\\<one>)\\<cdot>q)\\<rs>(p\\<ra>\\<one>)\\<cdot>f`(q)) \\<lsq> (abs(p\\<ra>\\<one>)\\<ra> \\<one>)\\<cdot>max\\<delta>(f)\"\nproof -\n  from A2 have \"q\\<in>\\<int>\"  \"p\\<cdot>q \\<in> \\<int>\" \n    using Int_ZF_2_L1A Int_ZF_1_1_L5 by auto\n  with A1 have I: \"abs(\\<delta>(f,p\\<cdot>q,q)) \\<lsq> max\\<delta>(f)\" by (rule Int_ZF_2_1_L7)\n  moreover note A3\n  moreover from A1 A2 have\n    \"abs(f`((p\\<ra>\\<one>)\\<cdot>q)\\<rs>(p\\<ra>\\<one>)\\<cdot>f`(q)) \\<lsq> abs(\\<delta>(f,p\\<cdot>q,q))\\<ra>abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q))\"\n    using AlmostHoms_def Int_ZF_2_L1A Int_ZF_2_2_L1 by simp\n  ultimately have \n    \"abs(f`((p\\<ra>\\<one>)\\<cdot>q)\\<rs>(p\\<ra>\\<one>)\\<cdot>f`(q)) \\<lsq> max\\<delta>(f)\\<ra>(abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\n    by (rule Int_ZF_2_L15)\n  moreover from I A2 have \n    \"max\\<delta>(f)\\<ra>(abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f) = (abs(p\\<ra>\\<one>)\\<ra> \\<one>)\\<cdot>max\\<delta>(f)\"\n    using Int_ZF_2_L1A Int_ZF_1_2_L2 by simp\n  ultimately show\n    \"abs(f`((p\\<ra>\\<one>)\\<cdot>q)\\<rs>(p\\<ra>\\<one>)\\<cdot>f`(q)) \\<lsq> (abs(p\\<ra>\\<one>)\\<ra> \\<one>)\\<cdot>max\\<delta>(f)\"\n    by simp\nqed\n\ntext\\<open>If $f$ is a slope, then \n  $|f(p\\cdot q)-p\\cdot f(q)|\\leq (|p|+1)\\cdot$\\<open>max\\<delta>\\<close>. \n  The proof is by induction on $p$ and the next lemma is the induction step for the case when $p\\leq 0$.\\<close>\n\nlemma (in int1) Int_ZF_2_2_L3: \n  assumes A1: \"f\\<in>\\<S>\" and A2: \"p\\<lsq>\\<zero>\"  \"q\\<in>\\<int>\"\n  and A3: \"abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q)) \\<lsq> (abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\n  shows  \"abs(f`((p\\<rs>\\<one>)\\<cdot>q)\\<rs>(p\\<rs>\\<one>)\\<cdot>f`(q)) \\<lsq> (abs(p\\<rs>\\<one>)\\<ra> \\<one>)\\<cdot>max\\<delta>(f)\"\nproof -\n  from A2 have \"q\\<in>\\<int>\"  \"(p\\<rs>\\<one>)\\<cdot>q \\<in> \\<int>\" \n    using Int_ZF_2_L1A int_zero_one_are_int Int_ZF_1_1_L5 by auto\n  with A1 have I: \"abs(\\<delta>(f,(p\\<rs>\\<one>)\\<cdot>q,q)) \\<lsq> max\\<delta>(f)\" by (rule Int_ZF_2_1_L7)\n  moreover note A3\n  moreover from A1 A2 have \n    \"abs(f`((p\\<rs>\\<one>)\\<cdot>q)\\<rs>(p\\<rs>\\<one>)\\<cdot>f`(q)) \\<lsq> abs(\\<delta>(f,(p\\<rs>\\<one>)\\<cdot>q,q))\\<ra>abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q))\"\n    using AlmostHoms_def Int_ZF_2_L1A Int_ZF_2_2_L1 by simp\n  ultimately have \n    \"abs(f`((p\\<rs>\\<one>)\\<cdot>q)\\<rs>(p\\<rs>\\<one>)\\<cdot>f`(q)) \\<lsq> max\\<delta>(f)\\<ra>(abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\n    by (rule Int_ZF_2_L15)\n  with I A2 show ?thesis using Int_ZF_2_L1A Int_ZF_1_2_L5 by simp\nqed\n\ntext\\<open>If $f$ is a slope, then \n  $|f(p\\cdot q)-p\\cdot f(q)|\\leq (|p|+1)\\cdot$\\<open>max\\<delta>\\<close>$(f)$.\n  Proof by cases on $0 \\leq p$.\\<close> \n\nlemma (in int1) Int_ZF_2_2_L4: \n  assumes A1: \"f\\<in>\\<S>\" and A2: \"p\\<in>\\<int>\" \"q\\<in>\\<int>\"\n  shows \"abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q)) \\<lsq> (abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\nproof -\n  { assume \"\\<zero>\\<lsq>p\"\n    moreover from A1 A2 have \"abs(f`(\\<zero>\\<cdot>q)\\<rs>\\<zero>\\<cdot>f`(q)) \\<lsq> (abs(\\<zero>)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\n      using int_zero_one_are_int Int_ZF_2_1_L2B Int_ZF_1_1_L4 \n\tInt_ZF_2_1_L8 Int_ZF_2_L18 by simp\n    moreover from A1 A2 have \n      \"\\<forall>p. \\<zero>\\<lsq>p \\<and> abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q)) \\<lsq> (abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f) \\<longrightarrow>\n      abs(f`((p\\<ra>\\<one>)\\<cdot>q)\\<rs>(p\\<ra>\\<one>)\\<cdot>f`(q)) \\<lsq> (abs(p\\<ra>\\<one>)\\<ra> \\<one>)\\<cdot>max\\<delta>(f)\"\n      using Int_ZF_2_2_L2 by simp\n    ultimately have \"abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q)) \\<lsq> (abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\" \n      by (rule Induction_on_int) }\n  moreover\n  { assume \"\\<not>(\\<zero>\\<lsq>p)\"\n    with A2 have \"p\\<lsq>\\<zero>\" using Int_ZF_2_L19A by simp\n    moreover from A1 A2 have \"abs(f`(\\<zero>\\<cdot>q)\\<rs>\\<zero>\\<cdot>f`(q)) \\<lsq> (abs(\\<zero>)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\n      using int_zero_one_are_int Int_ZF_2_1_L2B Int_ZF_1_1_L4\n\tInt_ZF_2_1_L8 Int_ZF_2_L18 by simp\n    moreover from A1 A2 have \n      \"\\<forall>p. p\\<lsq>\\<zero> \\<and> abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q)) \\<lsq> (abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f) \\<longrightarrow>\n      abs(f`((p\\<rs>\\<one>)\\<cdot>q)\\<rs>(p\\<rs>\\<one>)\\<cdot>f`(q)) \\<lsq> (abs(p\\<rs>\\<one>)\\<ra> \\<one>)\\<cdot>max\\<delta>(f)\"\n      using Int_ZF_2_2_L3 by simp\n    ultimately have \"abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q)) \\<lsq> (abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\" \n      by (rule Back_induct_on_int) }\n  ultimately show ?thesis by blast\nqed\n\ntext\\<open>The next elegant result is Lemma 7 in the Arthan's paper \\cite{Arthan2004}.\\<close>\n\nlemma (in int1) Arthan_Lem_7: \n assumes A1: \"f\\<in>\\<S>\" and A2: \"p\\<in>\\<int>\"  \"q\\<in>\\<int>\"\n  shows \"abs(q\\<cdot>f`(p)\\<rs>p\\<cdot>f`(q)) \\<lsq> (abs(p)\\<ra>abs(q)\\<ra>\\<two>)\\<cdot>max\\<delta>(f)\"\nproof -\n  from A1 A2 have T:\n    \"q\\<cdot>f`(p)\\<rs>f`(p\\<cdot>q) \\<in> \\<int>\" \n    \"f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q) \\<in> \\<int>\"\n    \"f`(q\\<cdot>p) \\<in> \\<int>\"  \"f`(p\\<cdot>q) \\<in> \\<int>\"\n    \"q\\<cdot>f`(p) \\<in> \\<int>\"  \"p\\<cdot>f`(q) \\<in> \\<int>\" \n    \"max\\<delta>(f) \\<in> \\<int>\"\n    \"abs(q) \\<in> \\<int>\"  \"abs(p) \\<in> \\<int>\"\n    using Int_ZF_1_1_L5 Int_ZF_2_1_L2B Int_ZF_2_1_L7 Int_ZF_2_L14 by auto\n  moreover have \"abs(q\\<cdot>f`(p)\\<rs>f`(p\\<cdot>q)) \\<lsq> (abs(q)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\n  proof -\n    from A1 A2 have \"abs(f`(q\\<cdot>p)\\<rs>q\\<cdot>f`(p)) \\<lsq> (abs(q)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\n      using Int_ZF_2_2_L4 by simp\n    with T A2 show ?thesis\n      using Int_ZF_2_L20 Int_ZF_1_1_L5 by simp\n  qed\n  moreover from A1 A2 have \"abs(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q)) \\<lsq> (abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\n    using Int_ZF_2_2_L4 by simp\n  ultimately have \n    \"abs(q\\<cdot>f`(p)\\<rs>f`(p\\<cdot>q)\\<ra>(f`(p\\<cdot>q)\\<rs>p\\<cdot>f`(q))) \\<lsq> (abs(q)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\\<ra>(abs(p)\\<ra>\\<one>)\\<cdot>max\\<delta>(f)\"\n    using Int_ZF_2_L21 by simp\n  with T show ?thesis using Int_ZF_1_2_L9 int_zero_one_are_int Int_ZF_1_2_L10\n    by simp\nqed\n\ntext\\<open>This is Lemma 8 in the Arthan's paper.\\<close>\n\nlemma (in int1) Arthan_Lem_8: assumes A1: \"f\\<in>\\<S>\"\n  shows \"\\<exists>A B. A\\<in>\\<int> \\<and> B\\<in>\\<int> \\<and> (\\<forall>p\\<in>\\<int>. abs(f`(p)) \\<lsq> A\\<cdot>abs(p)\\<ra>B)\"\nproof -\n  let ?A = \"max\\<delta>(f) \\<ra> abs(f`(\\<one>))\"\n  let ?B = \"\\<three>\\<cdot>max\\<delta>(f)\"\n  from A1 have \"?A\\<in>\\<int>\" \"?B\\<in>\\<int>\"\n    using int_zero_one_are_int Int_ZF_1_1_L5 Int_ZF_2_1_L2B \n      Int_ZF_2_1_L7 Int_ZF_2_L14 by auto\n  moreover have \"\\<forall>p\\<in>\\<int>. abs(f`(p)) \\<lsq> ?A\\<cdot>abs(p)\\<ra>?B\"\n  proof\n    fix p assume A2: \"p\\<in>\\<int>\" \n    with A1 have T: \n      \"f`(p) \\<in> \\<int>\"  \"abs(p) \\<in> \\<int>\"  \"f`(\\<one>) \\<in> \\<int>\" \n      \"p\\<cdot>f`(\\<one>) \\<in> \\<int>\"  \"\\<three>\\<in>\\<int>\"  \"max\\<delta>(f) \\<in> \\<int>\"\n      using Int_ZF_2_1_L2B Int_ZF_2_L14 int_zero_one_are_int \n\tInt_ZF_1_1_L5 Int_ZF_2_1_L7 by auto\n    from A1 A2 have \n      \"abs(\\<one>\\<cdot>f`(p)\\<rs>p\\<cdot>f`(\\<one>)) \\<lsq> (abs(p)\\<ra>abs(\\<one>)\\<ra>\\<two>)\\<cdot>max\\<delta>(f)\"\n      using int_zero_one_are_int Arthan_Lem_7 by simp\n    with T have \"abs(f`(p)) \\<lsq> abs(p\\<cdot>f`(\\<one>))\\<ra>(abs(p)\\<ra>\\<three>)\\<cdot>max\\<delta>(f)\"\n      using Int_ZF_2_L16A Int_ZF_1_1_L4 Int_ZF_1_2_L11 \n\tInt_triangle_ineq2 by simp\n    with A2 T show \"abs(f`(p)) \\<lsq> ?A\\<cdot>abs(p)\\<ra>?B\"\n      using Int_ZF_1_3_L14 by simp\n  qed\n  ultimately show ?thesis by auto\nqed\n\ntext\\<open>If $f$ and $g$ are slopes, then $f\\circ g$ is equivalent \n  (almost equal) to $g\\circ f$. This is Theorem 9 in Arthan's paper \\cite{Arthan2004}.\\<close>\n\ntheorem (in int1) Arthan_Th_9: assumes A1: \"f\\<in>\\<S>\"  \"g\\<in>\\<S>\"\n  shows \"f\\<circ>g \\<sim> g\\<circ>f\"\nproof -\n   from A1 have \n      \"\\<exists>A B. A\\<in>\\<int> \\<and> B\\<in>\\<int> \\<and> (\\<forall>p\\<in>\\<int>. abs(f`(p)) \\<lsq> A\\<cdot>abs(p)\\<ra>B)\"\n      \"\\<exists>C D. C\\<in>\\<int> \\<and> D\\<in>\\<int> \\<and> (\\<forall>p\\<in>\\<int>. abs(g`(p)) \\<lsq> C\\<cdot>abs(p)\\<ra>D)\"\n      using Arthan_Lem_8 by auto\n    then obtain A B C D where D1: \"A\\<in>\\<int>\" \"B\\<in>\\<int>\" \"C\\<in>\\<int>\" \"D\\<in>\\<int>\" and D2: \n      \"\\<forall>p\\<in>\\<int>. abs(f`(p)) \\<lsq> A\\<cdot>abs(p)\\<ra>B\"\n      \"\\<forall>p\\<in>\\<int>. abs(g`(p)) \\<lsq> C\\<cdot>abs(p)\\<ra>D\"\n      by auto\n    let ?E = \"max\\<delta>(g)\\<cdot>(A\\<ra>\\<one>) \\<ra> max\\<delta>(f)\\<cdot>(C\\<ra>\\<one>)\"\n    let ?F = \"(B\\<cdot>max\\<delta>(g) \\<ra> \\<two>\\<cdot>max\\<delta>(g)) \\<ra> (D\\<cdot>max\\<delta>(f) \\<ra> \\<two>\\<cdot>max\\<delta>(f))\"\n  { fix p assume A2: \"p\\<in>\\<int>\"\n    with A1 have T1:\n      \"g`(p) \\<in> \\<int>\"  \"f`(p) \\<in> \\<int>\"  \"abs(p) \\<in> \\<int>\"  \"\\<two> \\<in> \\<int>\"\n      \"f`(g`(p)) \\<in> \\<int>\"  \"g`(f`(p)) \\<in> \\<int>\"  \"f`(g`(p)) \\<rs> g`(f`(p)) \\<in> \\<int>\"\n      \"p\\<cdot>f`(g`(p)) \\<in> \\<int>\"  \"p\\<cdot>g`(f`(p)) \\<in> \\<int>\"\n      \"abs(f`(g`(p))\\<rs>g`(f`(p))) \\<in> \\<int>\"\n      using Int_ZF_2_1_L2B Int_ZF_2_1_L10 Int_ZF_1_1_L5 Int_ZF_2_L14 int_two_three_are_int\n      by auto\n    with A1 A2 have\n      \"abs((f`(g`(p))\\<rs>g`(f`(p)))\\<cdot>p) \\<lsq> \n      (abs(p)\\<ra>abs(f`(p))\\<ra>\\<two>)\\<cdot>max\\<delta>(g) \\<ra> (abs(p)\\<ra>abs(g`(p))\\<ra>\\<two>)\\<cdot>max\\<delta>(f)\"\n      using Arthan_Lem_7 Int_ZF_1_2_L10A Int_ZF_1_2_L12 by simp\n    moreover have \n      \"(abs(p)\\<ra>abs(f`(p))\\<ra>\\<two>)\\<cdot>max\\<delta>(g) \\<ra> (abs(p)\\<ra>abs(g`(p))\\<ra>\\<two>)\\<cdot>max\\<delta>(f) \\<lsq>\n      ((max\\<delta>(g)\\<cdot>(A\\<ra>\\<one>) \\<ra> max\\<delta>(f)\\<cdot>(C\\<ra>\\<one>)))\\<cdot>abs(p) \\<ra>\n      ((B\\<cdot>max\\<delta>(g) \\<ra> \\<two>\\<cdot>max\\<delta>(g)) \\<ra> (D\\<cdot>max\\<delta>(f) \\<ra> \\<two>\\<cdot>max\\<delta>(f)))\"\n    proof -\n      from D2 A2 T1 have \n\t\"abs(p)\\<ra>abs(f`(p))\\<ra>\\<two> \\<lsq> abs(p)\\<ra>(A\\<cdot>abs(p)\\<ra>B)\\<ra>\\<two>\"\n\t\"abs(p)\\<ra>abs(g`(p))\\<ra>\\<two> \\<lsq> abs(p)\\<ra>(C\\<cdot>abs(p)\\<ra>D)\\<ra>\\<two>\"\n\tusing Int_ZF_2_L15C by auto\n      with A1 have \n\t\"(abs(p)\\<ra>abs(f`(p))\\<ra>\\<two>)\\<cdot>max\\<delta>(g) \\<lsq> (abs(p)\\<ra>(A\\<cdot>abs(p)\\<ra>B)\\<ra>\\<two>)\\<cdot>max\\<delta>(g)\"\n\t\"(abs(p)\\<ra>abs(g`(p))\\<ra>\\<two>)\\<cdot>max\\<delta>(f) \\<lsq> (abs(p)\\<ra>(C\\<cdot>abs(p)\\<ra>D)\\<ra>\\<two>)\\<cdot>max\\<delta>(f)\"\n\tusing Int_ZF_2_1_L8 Int_ZF_1_3_L13 by auto\n      moreover from A1 D1 T1 have \n\t\"(abs(p)\\<ra>(A\\<cdot>abs(p)\\<ra>B)\\<ra>\\<two>)\\<cdot>max\\<delta>(g) = \n\tmax\\<delta>(g)\\<cdot>(A\\<ra>\\<one>)\\<cdot>abs(p) \\<ra> (B\\<cdot>max\\<delta>(g) \\<ra> \\<two>\\<cdot>max\\<delta>(g))\"\n\t\"(abs(p)\\<ra>(C\\<cdot>abs(p)\\<ra>D)\\<ra>\\<two>)\\<cdot>max\\<delta>(f) = \n\tmax\\<delta>(f)\\<cdot>(C\\<ra>\\<one>)\\<cdot>abs(p) \\<ra> (D\\<cdot>max\\<delta>(f) \\<ra> \\<two>\\<cdot>max\\<delta>(f))\"\n\tusing Int_ZF_2_1_L8 Int_ZF_1_2_L13 by auto\n      ultimately have \n\t\"(abs(p)\\<ra>abs(f`(p))\\<ra>\\<two>)\\<cdot>max\\<delta>(g) \\<ra> (abs(p)\\<ra>abs(g`(p))\\<ra>\\<two>)\\<cdot>max\\<delta>(f) \\<lsq>\n\t(max\\<delta>(g)\\<cdot>(A\\<ra>\\<one>)\\<cdot>abs(p) \\<ra> (B\\<cdot>max\\<delta>(g) \\<ra> \\<two>\\<cdot>max\\<delta>(g))) \\<ra> \n\t(max\\<delta>(f)\\<cdot>(C\\<ra>\\<one>)\\<cdot>abs(p) \\<ra> (D\\<cdot>max\\<delta>(f) \\<ra> \\<two>\\<cdot>max\\<delta>(f)))\"\n\tusing int_ineq_add_sides by simp\n      moreover from A1 A2 D1 have \"abs(p) \\<in> \\<int>\"\n\t\"max\\<delta>(g)\\<cdot>(A\\<ra>\\<one>) \\<in> \\<int>\"  \"B\\<cdot>max\\<delta>(g) \\<ra> \\<two>\\<cdot>max\\<delta>(g) \\<in> \\<int>\"\n\t\"max\\<delta>(f)\\<cdot>(C\\<ra>\\<one>) \\<in> \\<int>\"  \"D\\<cdot>max\\<delta>(f) \\<ra> \\<two>\\<cdot>max\\<delta>(f) \\<in> \\<int>\" \n\tusing Int_ZF_2_L14 Int_ZF_2_1_L8 int_zero_one_are_int \n\t  Int_ZF_1_1_L5 int_two_three_are_int by auto\n      ultimately show ?thesis using Int_ZF_1_2_L14 by simp\n    qed\n    ultimately have\n      \"abs((f`(g`(p))\\<rs>g`(f`(p)))\\<cdot>p) \\<lsq> ?E\\<cdot>abs(p) \\<ra> ?F\"\n      by (rule Int_order_transitive)\n    with A2 T1 have\n      \"abs(f`(g`(p))\\<rs>g`(f`(p)))\\<cdot>abs(p) \\<lsq> ?E\\<cdot>abs(p) \\<ra> ?F\"\n      \"abs(f`(g`(p))\\<rs>g`(f`(p))) \\<in> \\<int>\"\n      using Int_ZF_1_3_L5 by auto\n  } then have \n      \"\\<forall>p\\<in>\\<int>. abs(f`(g`(p))\\<rs>g`(f`(p))) \\<in> \\<int>\"\n      \"\\<forall>p\\<in>\\<int>. abs(f`(g`(p))\\<rs>g`(f`(p)))\\<cdot>abs(p) \\<lsq> ?E\\<cdot>abs(p) \\<ra> ?F\"\n    by auto\n  moreover from A1 D1 have \"?E \\<in> \\<int>\"  \"?F \\<in> \\<int>\"\n    using int_zero_one_are_int int_two_three_are_int Int_ZF_2_1_L8 Int_ZF_1_1_L5\n    by auto\n  ultimately have\n    \"\\<exists>L. \\<forall>p\\<in>\\<int>. abs(f`(g`(p))\\<rs>g`(f`(p))) \\<lsq> L\"\n    by (rule Int_ZF_1_7_L1)\n  with A1 obtain L where \"\\<forall>p\\<in>\\<int>. abs((f\\<circ>g)`(p)\\<rs>(g\\<circ>f)`(p)) \\<lsq> L\"\n    using Int_ZF_2_1_L10 by auto\n  moreover from A1 have \"f\\<circ>g \\<in> \\<S>\"  \"g\\<circ>f \\<in> \\<S>\"\n    using Int_ZF_2_1_L11 by auto\n  ultimately show \"f\\<circ>g \\<sim> g\\<circ>f\" using Int_ZF_2_1_L9 by auto\nqed\n \nend\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/Int_ZF_2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.6442251064863697, "lm_q1q2_score": 0.33971054342622387}}
{"text": "theory IMP_Minus_Minus_To_SAS_Plus_Plus_Reduction_Nat\n  imports \n    Primitives IMP_Minus_Minus_To_SAS_Plus_Plus_State_Translations_Nat  IMP_Minus_Minus_Subprograms_Nat\n IMP_Minus_Minus_To_SAS_Plus_Plus_Reduction  \nbegin                               \ndefinition domain_nat :: \"nat\" where\n\"domain_nat = list_encode [prod_encode(0,0), prod_encode(0,1)]\"\n\ndefinition domain_tail :: \"nat \" where \"domain_tail = domain_nat\"\n\nlemma subtail_domain  : \"domain_tail = domain_nat\" using domain_tail_def by auto\n\nlemma sub_domain: \"domain_nat = list_encode (map domain_element_encode domain)\"\n  apply (auto simp add:domain_nat_def)\n  done\n\ndefinition pc_to_com_nat :: \"nat\\<Rightarrow> nat\" where\n\"pc_to_com_nat l =(if fst_nat(snd_nat(hd_nat l)) = 1 then snd_nat (snd_nat (hd_nat l)) \n                  else  0##0)\"\n\ndefinition pc_to_com_tail ::\" nat \\<Rightarrow> nat\" where \n\"pc_to_com_tail l = pc_to_com_nat l\"\n\nlemma subtail_pc_to_com:\n\"pc_to_com_tail l = pc_to_com_nat l\" using pc_to_com_tail_def by auto\n\nlemma sub_pc_to_com :\n  \"pc_to_com_nat (sas_assignment_list_encode l) = comm_encode (pc_to_com l)\"\n  apply (cases l)\n  apply (auto simp only: pc_to_com_nat_def sas_assignment_list_encode_def sub_hd \n              pc_to_com_def list.map head.simps sas_assignment_encode.simps\n                    sub_snd snd_def nth.simps \n                  split:list.splits)\n  apply(simp add:fst_nat_def snd_nat_def prod_decode_def prod_decode_aux.simps cons_def)\n      \n  subgoal for a b l\n    apply (cases b)\n     apply (auto simp only: domain_element_encode.simps sub_snd snd_def sub_fst cons0)\n     apply auto\n    done\n  done\n\ndeclare nth_nat.simps[simp del]\n\nfun map_com_to_operators:: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_com_to_operators c c2 n = (if n = 0 then 0 else \n (let c1' = pc_to_com_nat (nth_nat (Suc 0) (hd_nat n)) in  \n        (list_update_nat (nth_nat 0 (hd_nat n)) 0 (prod_encode (0,prod_encode(1,c))))##\n        (list_update_nat (nth_nat (Suc 0) (hd_nat n)) 0 (prod_encode(0, prod_encode(1, 2 ##c1'##c2##0))))##0 )\n## map_com_to_operators c c2 (tl_nat n)\n)\"\n\nfun map_com_to_operators_acc:: \" nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_com_to_operators_acc c c2 acc n = (if n = 0 then acc else map_com_to_operators_acc c c2 \n ((let c1' = pc_to_com_tail (nth_nat (Suc 0) (hd_nat n)) in  \n        (list_update_tail (nth_nat 0 (hd_nat n)) 0 (prod_encode (0,prod_encode(1,c))))##\n        (list_update_tail (nth_nat (Suc 0) (hd_nat n)) 0 (prod_encode(0, prod_encode(1, 2 ##c1'##c2##0))))##0 )\n## acc) (tl_nat n)\n)\"\n\nlemma map_com_to_operators_induct:\n\"map_com_to_operators_acc c c2 acc n = map_acc(\\<lambda> op. \n    (let c1' = pc_to_com_nat (nth_nat (Suc 0) op) in  \n        (list_update_nat (nth_nat 0 op) 0 (prod_encode (0,prod_encode(1,c))))##\n        (list_update_nat (nth_nat (Suc 0) op) 0 (prod_encode(0, prod_encode(1, 2 ##c1'##c2##0))))##0 ))\nacc n \"\n  apply(induct c c2 acc n rule:map_com_to_operators_acc.induct)\n  apply(auto simp add: subtail_pc_to_com subtail_list_update)\n  done\n\ndefinition map_com_to_operators_tail :: \"nat => nat => nat => nat\" where \n\"map_com_to_operators_tail c c2 n =  reverse_nat (map_com_to_operators_acc c c2 0 n)\"\n\nlemma submap_com_to_operators:\n\"map_com_to_operators c c2 n =\n map_nat (\\<lambda> op. \n    (let c1' = pc_to_com_nat (nth_nat (Suc 0) op) in  \n        (list_update_nat (nth_nat 0 op) 0 (prod_encode (0,prod_encode(1,c))))##\n        (list_update_nat (nth_nat (Suc 0) op) 0 (prod_encode(0, prod_encode(1, 2 ##c1'##c2##0))))##0 )) n\n \"\n  apply (induct c c2 n rule:map_com_to_operators.induct)\n  apply auto\n  done\n\nlemma subtail_map_com_to_operators:\n\"map_com_to_operators_tail c c2 n = map_com_to_operators c c2 n\"\n  using  submap_com_to_operators  map_com_to_operators_tail_def\n map_com_to_operators_induct subtail_map by presburger\n\nfun map_com_to_operators2 :: \"nat \\<Rightarrow> nat\" where \n\" map_com_to_operators2 n = (if n = 0 then 0 else (prod_encode(Suc (hd_nat n), prod_encode(0,0)))##  map_com_to_operators2 (tl_nat n))\"\n\n\nlemma submap_com_to_operators2: \n\" map_com_to_operators2 n =  map_nat (\\<lambda>v. prod_encode(Suc v, prod_encode(0,0))) n\"\n  apply (induct n rule:map_com_to_operators2.induct)\n  apply auto\n  done\n\nfun map_com_to_operators2_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\" map_com_to_operators2_acc acc n = (if n = 0 then acc else map_com_to_operators2_acc\n((prod_encode(Suc (hd_nat n), prod_encode(0,0)))## acc )(tl_nat n))\"\n\nlemma map_com_to_operators2_induct: \n\"map_com_to_operators2_acc acc n = map_acc (\\<lambda>v. prod_encode(Suc v, prod_encode(0,0))) acc n\"\n  apply(induct acc n rule:map_com_to_operators2_acc.induct)\napply auto\n  done\n\ndefinition map_com_to_operators2_tail :: \"nat => nat\" where \n\"map_com_to_operators2_tail n =  reverse_nat (map_com_to_operators2_acc 0 n)\"\n\nlemma subtail_map_com_to_operators2:\n\"map_com_to_operators2_tail  n = map_com_to_operators2 n\"\n  using  submap_com_to_operators2  map_com_to_operators2_tail_def\n map_com_to_operators2_induct subtail_map by presburger\n\nfun  map_com_to_operators3 :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_com_to_operators3 i c1 n  = (if n =0 then 0 else ((((prod_encode(0, i))## (prod_encode(Suc (hd_nat n), prod_encode(0,1)))##0)## \n         ((prod_encode(0, prod_encode(1, c1)))##0)## 0)) ##map_com_to_operators3 i c1 (tl_nat n))\"\n\nfun  map_com_to_operators3_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_com_to_operators3_acc  i c1 acc n  = (if n =0 then acc else map_com_to_operators3_acc  i c1  (((((prod_encode(0, i))## (prod_encode(Suc (hd_nat n), prod_encode(0,1)))##0)## \n         ((prod_encode(0, prod_encode(1, c1)))##0)## 0)) ##acc) (tl_nat n))\"\n\nlemma submap_com_to_operators3:\n\"map_com_to_operators3 i c1 n = map_nat (\\<lambda> v. \n      ( ((prod_encode(0, i))## (prod_encode(Suc v, prod_encode(0,1)))##0)## \n         ((prod_encode(0, prod_encode(1, c1)))##0)## 0)) n\"\n  apply (induct i c1 n rule:map_com_to_operators3.induct)\n  apply auto\n  done\nlemma map_com_to_operators3_induct:\n\"map_com_to_operators3_acc  i c1 acc n = map_acc  (\\<lambda> v. \n      ( ((prod_encode(0, i))## (prod_encode(Suc v, prod_encode(0,1)))##0)## \n         ((prod_encode(0, prod_encode(1, c1)))##0)## 0)) acc n\"\n  apply(induct  i c1 acc n  rule:map_com_to_operators3_acc.induct)\n  apply auto\n  done\n\ndefinition map_com_to_operators3_tail :: \" nat \\<Rightarrow> nat \\<Rightarrow> nat => nat\" where \n\"map_com_to_operators3_tail i c1 n =  reverse_nat (map_com_to_operators3_acc i c1 0 n)\"\n\nlemma subtail_map_com_to_operators3:\n\"map_com_to_operators3_tail i c1 n = map_com_to_operators3 i c1 n\"\n  using  submap_com_to_operators3  map_com_to_operators3_tail_def\n map_com_to_operators3_induct subtail_map by presburger\n\nfun  map_com_to_operators4 :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow>nat\" where \n\"map_com_to_operators4 i j n = (if n=0 then 0 else ((((prod_encode(0, i)) ## (prod_encode (Suc (hd_nat n), prod_encode(0,1) )) ##0)) ## \n         (((prod_encode(0, j))##0) ## 0 )) ## map_com_to_operators4 i j (tl_nat n))\"\n\nlemma submap_com_to_operators4:\n\"map_com_to_operators4 i j n =  map_nat (\\<lambda> v. \n       (((prod_encode(0, i)) ## (prod_encode (Suc v, prod_encode(0,1) )) ##0)) ## \n         (((prod_encode(0, j))##0) ## 0 )) n \"\n  apply (induct i j n rule:map_com_to_operators4.induct)\n  apply auto\n  done\nfun  map_com_to_operators4_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow>nat\" where \n\"map_com_to_operators4_acc i j acc n = (if n=0 then acc else map_com_to_operators4_acc i j  (((((prod_encode(0, i)) ## (prod_encode (Suc (hd_nat n), prod_encode(0,1) )) ##0)) ## \n         (((prod_encode(0, j))##0) ## 0 )) ## acc) (tl_nat n))\"\n\nlemma map_com_to_operators4_induct:\n\"map_com_to_operators4_acc i j acc n = map_acc(\\<lambda> v. \n      ( (((prod_encode(0, i)) ## (prod_encode (Suc v, prod_encode(0,1) )) ##0)) ## \n         (((prod_encode(0, j))##0) ## 0 ))) acc n\"\n  apply(induct i j acc n rule:map_com_to_operators4_acc.induct)\n  apply auto\n  done\n\n\ndefinition map_com_to_operators4_tail :: \" nat \\<Rightarrow> nat \\<Rightarrow> nat => nat\" where \n\"map_com_to_operators4_tail i j n =  reverse_nat (map_com_to_operators4_acc i j 0 n)\"\n\nlemma subtail_map_com_to_operators4:\n\"map_com_to_operators4_tail i j n = map_com_to_operators4 i j n\"\n  using  submap_com_to_operators4  map_com_to_operators4_tail_def\n map_com_to_operators4_induct subtail_map by presburger\n\n\ndatatype com_op = Bot \"operator list\" |\n                  SKIP |\n                  Assign vname bit |\n                  Seq_0 com com |\n                  Seq_f com com \"operator list\"|\n                  If \"vname list\" com com |\n                  While \"vname list\" com\n\nfun com_op_encode :: \"com_op \\<Rightarrow> nat\" where \n\"com_op_encode SKIP = list_encode [0]\"|\n\"com_op_encode (Assign v b) = list_encode [1,vname_encode v, bit_encode b]\"|\n\"com_op_encode (Seq_0 c1 c2) = list_encode [2,comm_encode c1, comm_encode c2]\"|\n\"com_op_encode (If v c1 c2) = list_encode [3, vname_list_encode v, comm_encode c1 ,comm_encode c2] \"|\n\"com_op_encode (While v c) = list_encode [4,vname_list_encode v, comm_encode c] \"|\n\"com_op_encode (Seq_f c1 c2 op) = list_encode [5, comm_encode c1, comm_encode c2, list_encode (map operator_encode op)]\"|\n\"com_op_encode (Bot x) = list_encode [6, list_encode (map operator_encode x)]\"\n\nfun com_op_decode :: \"nat \\<Rightarrow> com_op\" where \n\"com_op_decode n = (case list_decode n of \n    [0] \\<Rightarrow> SKIP |\n    [Suc 0,v,b] \\<Rightarrow> Assign (vname_decode v) (bit_decode b)|\n    [Suc (Suc 0), c1, c2] \\<Rightarrow> Seq_0 (comm_decode c1) (comm_decode c2)|\n    [Suc (Suc (Suc 0)),v ,c1 ,c2] \\<Rightarrow> If (vname_list_decode v) (comm_decode c1) (comm_decode c2)|\n    [Suc (Suc (Suc (Suc 0))), v, c] \\<Rightarrow> While (vname_list_decode v) (comm_decode c)|\n    [Suc (Suc (Suc (Suc (Suc 0)))),c1,c2,op] \\<Rightarrow> Seq_f (comm_decode c1) (comm_decode c2) (map operator_decode (list_decode op))|\n    [Suc (Suc (Suc (Suc (Suc (Suc 0))))),op] \\<Rightarrow> Bot (map operator_decode (list_decode op))\n)\"\n\nlemma com_op_id: \n\"com_op_decode (com_op_encode x) = x\"\n  apply(induct x)\n        apply(auto simp add: operator_id comp_def vname_id comm_id \n          vname_list_id simp del: comm_decode.simps )\n  done\n\nfun push_to_stack_op :: \"com \\<Rightarrow> com_op list \\<Rightarrow> com_op list\" where \n\"push_to_stack_op com.SKIP s = SKIP#s \"|\n\"push_to_stack_op (com.Assign v n) s = Assign v n #s\"|\n\"push_to_stack_op (com.Seq c1 c2)  s = Seq_0 c1 c2 # s \"|\n\"push_to_stack_op (com.If v c1 c2) s = If v c1 c2 #s\"|\n\"push_to_stack_op (com.While v c) s = While v c #s\"\n\ndefinition push_to_stack_op_nat :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"push_to_stack_op_nat c s = (c ## s)\"\n\nlemma sub_push_to_stack_op :\n\"push_to_stack_op_nat (comm_encode c) (list_encode (map com_op_encode  s))\n = list_encode (map com_op_encode (push_to_stack_op c s)) \"\n  apply(cases c)\n      apply(auto simp add:  push_to_stack_op_nat_def \nsub_cons  simp del:list_encode.simps)\n  done\n\nfun add_res_to_stack_op :: \"operator list \\<Rightarrow> com_op list \\<Rightarrow> com_op list\" where \n\"add_res_to_stack_op op [] = [Bot op]\"|\n\"add_res_to_stack_op op (Seq_0 c1 c2 # s) = Seq_f c1 c2 op # s\"|\n\"add_res_to_stack_op op s = s\"\n\ndefinition add_res_to_stack_op_nat :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"add_res_to_stack_op_nat op s = (if s = 0 then (6 ## op ## 0)##0\nelse if hd_nat (hd_nat s) = 2 then (5 ## (nth_nat (Suc 0) (hd_nat s)) ## (nth_nat (Suc (Suc 0)) (hd_nat s)) ## op ## 0)## (tl_nat s)\nelse s)\"\n\nlemma list_encode_0:\"(list_encode s = 0) = (s= [])\"\n  using list_encode_eq by fastforce\n\nlemma sub_add_res_to_stack:\n\"add_res_to_stack_op_nat (list_encode (map operator_encode op)) (list_encode (map com_op_encode s))\n = list_encode (map com_op_encode (add_res_to_stack_op op s))\"\n   apply(cases s)\n  apply (auto simp add: sub_hd add_res_to_stack_op_nat_def list_encode_0  sub_cons cons0  simp del: list_encode.simps  )\n  subgoal for a xs\n    apply(cases a)\n      apply (auto simp add: sub_nth sub_tl sub_hd list_encode_0  sub_cons cons0  simp del: list_encode.simps  )\n    done\n  subgoal for a xs\n    apply(cases a)\n      apply (auto simp add: sub_nth sub_tl sub_hd list_encode_0  sub_cons cons0  simp del: list_encode.simps  )\n    done\n  done\n\nfun size_e :: \"com \\<Rightarrow> nat\" where \n\"size_e com.SKIP = 1 \"|\n\"size_e (com.Assign v a)  = 1\"|\n\"size_e (com.Seq c1 c2) = Suc (size_e c1)\"|\n\"size_e (com.If v c1 c2) = 1\"|\n\"size_e (com.While v c) = 1\"\n\nfun stack_size_rev :: \"com_op list \\<Rightarrow> nat\" where \n\"stack_size_rev (Seq_0 c1 c2 # s ) = (if s = [] then Suc (2 * size_e c1) else \n  Suc (stack_size_rev s))\"|\n\"stack_size_rev (Bot x # s) = (if s = [] then 0 else Suc (stack_size_rev s))\"|\n\"stack_size_rev (_ #s) = (if s = [] then 1 else Suc (stack_size_rev s))\"|\n\"stack_size_rev [] = 1\"\n\nfun stack_size :: \"com_op list \\<Rightarrow> nat\" where \n\"stack_size s = stack_size_rev (rev s)\"\n\nlemma \nstack_size_mono :\" x \\<noteq> [] \\<Longrightarrow>y \\<noteq>  [] \\<Longrightarrow> stack_size_rev y < stack_size_rev x\n \\<Longrightarrow> stack_size_rev (s @ y) < stack_size_rev (s @ x) \"\n  apply(induct s )\n   apply auto\n  subgoal for a xs\n    apply (cases a)\n           apply (auto)\n    done\n  done\n\nlemma stack_size_0:\"(stack_size_rev x = 0) = (\\<exists>n. x = [Bot n]) \"\n  apply(cases x)\n   apply auto\n  subgoal for a xs\n    apply (cases a)\n           apply (auto split :if_splits)\n    done\n subgoal for a xs\n    apply (cases a)\n           apply (auto split :if_splits)\n   done\n  done\n\nlemma add_res_less:\n\"\\<forall>x. s \\<noteq> [Bot x] \\<and> a \\<noteq> Bot x \\<Longrightarrow> stack_size (add_res_to_stack_op r s) < stack_size (a#s) \"\n  apply(cases s)\n   apply auto\n   apply (cases a)\n  apply (auto simp add: stack_size_mono)\n  subgoal for a xs\n    apply (cases a)\n    using stack_size_mono stack_size_0 nat_less_le    apply (auto )\n    done\n  done\n\nfunction com_to_operators_stack :: \"com_op list \\<Rightarrow> operator list\" where \n\"com_to_operators_stack (Bot x # s) = x \"|\n\"com_to_operators_stack (SKIP# s) = com_to_operators_stack (add_res_to_stack_op [] s)\"|\n\"com_to_operators_stack (Assign v b # s) = com_to_operators_stack (add_res_to_stack_op\n     [\\<lparr> precondition_of = [(PC, PCV (com.Assign v b))], \n      effect_of = [(PC, PCV com.SKIP), (VN v, EV b)]\\<rparr>] s )\" |\n\"com_to_operators_stack (Seq_0 c1 c2 #s) = \n(if c1 = com.SKIP then com_to_operators_stack ( add_res_to_stack_op  [\\<lparr> precondition_of = [(PC, PCV (c1 ;; c2))],\n                                                   effect_of = [(PC, PCV c2)]\\<rparr>] s)\nelse com_to_operators_stack (push_to_stack_op c1 (Seq_0 c1 c2 #s))\n)\"|\n\"com_to_operators_stack (Seq_f c1 c2 ops # s) = \ncom_to_operators_stack (add_res_to_stack_op ( map (\\<lambda> op. \n    (let c1' = pc_to_com (effect_of op) in \n      \\<lparr> precondition_of = \n        list_update (precondition_of op) 0 (PC, PCV (com.Seq c1 c2)),\n        effect_of = \n        list_update (effect_of op) 0 (PC, PCV (com.Seq c1' c2))\\<rparr>)) ops) s)\"|\n\"com_to_operators_stack (If vs c1 c2 #s) = \ncom_to_operators_stack (add_res_to_stack_op   (let i = PCV (IF vs\\<noteq>0 THEN c1 ELSE c2)\n   in  \\<lparr> precondition_of = (PC, i) # map (\\<lambda>v. (VN v, EV Zero)) (remdups vs), \n        effect_of = [(PC, PCV c2)]\\<rparr> \n      # map (\\<lambda> v. \n      \\<lparr> precondition_of = [(PC, i), (VN v, EV One)], \n         effect_of = [(PC, PCV c1)]\\<rparr>) vs)   s )\" |\n\"com_to_operators_stack (While vs c # s) = \ncom_to_operators_stack (add_res_to_stack_op  (let i = PCV (com.While vs c) ;\n  j = PCV (com.Seq c (com.While vs c)); k = PCV (com.SKIP) in \n    \\<lparr> precondition_of = (PC, i) # map (\\<lambda>v. (VN v, EV Zero)) (remdups vs), \n        effect_of = [(PC, k)]\\<rparr> \n      # map (\\<lambda> v. \n      \\<lparr> precondition_of = [(PC, i), (VN v, EV One)], \n         effect_of = [(PC, j)]\\<rparr>) vs) s)\"|\n\"com_to_operators_stack [] = []\"\n  by pat_completeness auto\ntermination\nproof (relation \"measure stack_size\",goal_cases)\ncase 1\nthen show ?case by auto\nnext\n  case (2 s)\n  then show ?case using add_res_less apply auto\n    by (metis add_res_to_stack_op.simps butlast.simps(2) butlast_snoc com_op.distinct \nneq0_conv not_Cons_self2 rev_singleton_conv stack_size_0)\n\n    \nnext\n  case (3 v b s)\n   then show ?case using add_res_less apply auto\n     by (smt One_nat_def Zero_not_Suc add_res_to_stack_op.simps(3) \nlast_ConsL last_snoc less_nat_zero_code linorder_neqE_nat rev_singleton_conv \nstack_size_0 stack_size_rev.simps(4))\n      \nnext\n  case (4 c1 c2 s)\n  then show ?case using add_res_less apply auto\n     by (smt One_nat_def Zero_not_Suc add_res_to_stack_op.simps\nlast_ConsL last_snoc less_nat_zero_code linorder_neqE_nat rev_singleton_conv \nstack_size_0 stack_size_rev.simps)\n\nnext\n  case (5 c1 c2 s)\n  then show ?case using stack_size_mono  by (cases c1) auto\n\nnext\n  case (6 c1 c2 ops s)\n  then show ?case using add_res_less apply auto\n     by (smt One_nat_def Zero_not_Suc add_res_to_stack_op.simps\nlast_ConsL last_snoc less_nat_zero_code linorder_neqE_nat rev_singleton_conv \nstack_size_0 stack_size_rev.simps)\nnext\ncase (7 vs c1 c2 s)\nthen show ?case using add_res_less apply auto\n     by (smt One_nat_def Zero_not_Suc add_res_to_stack_op.simps\nlast_ConsL last_snoc less_nat_zero_code linorder_neqE_nat rev_singleton_conv \nstack_size_0 stack_size_rev.simps)\nnext\n  case (8 vs c s)\n  then show ?case using add_res_less apply auto\n     by (smt One_nat_def Zero_not_Suc add_res_to_stack_op.simps\nlast_ConsL last_snoc less_nat_zero_code linorder_neqE_nat rev_singleton_conv \nstack_size_0 stack_size_rev.simps)\nqed\n\n\nlemma com_to_operators_stack_correct:\n\"com_to_operators_stack (push_to_stack_op c s) = com_to_operators_stack (add_res_to_stack_op (\ncom_to_operators c) s)\"\n  apply(induct c  arbitrary:s rule: com_to_operators.induct)\n      apply auto\n  done\n\ndefinition com_to_operators_t :: \"com  \\<Rightarrow> operator list\" where \n\"com_to_operators_t c = com_to_operators_stack (push_to_stack_op c [])\"\n\nlemma subtailnat_com_to_operators:\n\"com_to_operators_t c = com_to_operators c\"\n  using com_to_operators_stack_correct[of c \"[]\"]\n  apply(auto simp add: com_to_operators_t_def)\n  done\n\n\nfunction (domintros) com_to_operators_stack_nat :: \"nat \\<Rightarrow> nat\" where \n\"com_to_operators_stack_nat s = ( if s = 0 then 0 else let c = hd_nat s ; t = tl_nat s in  \n(if hd_nat c = 0 then com_to_operators_stack_nat (add_res_to_stack_op_nat 0 t) else \nif hd_nat c = 1 then com_to_operators_stack_nat (add_res_to_stack_op_nat ((\n                        ((prod_encode(0,prod_encode(1,c)))##0)\n                        ##\n                          (\n                              (prod_encode(0,prod_encode(1,0##0)))\n                                ##\n                              (prod_encode(Suc (nth_nat (Suc 0) c),prod_encode(0,nth_nat (Suc (Suc 0)) c)))\n                               ##0\n                          )\n                        ##0)##0) t)\nelse if hd_nat c = 2 then (let c1 = nth_nat (Suc 0) c; c2= nth_nat (Suc (Suc 0)) c in \n  (if c1 = 0##0 then  com_to_operators_stack_nat (add_res_to_stack_op_nat ( (((prod_encode(0,prod_encode(1,c)))##0)##((prod_encode(0,prod_encode(1,c2)))##0)##0)##0) t)\nelse  com_to_operators_stack_nat (push_to_stack_op_nat c1 s)))\nelse if hd_nat c = 3 then \n(let i = prod_encode (1, c); vs = nth_nat (Suc 0) c ; c1 = nth_nat (Suc (Suc 0)) c ; c2 = nth_nat (Suc (Suc (Suc 0))) c\n   in com_to_operators_stack_nat (add_res_to_stack_op_nat (( ((prod_encode(0, i)) ## map_com_to_operators2_tail (remdups_tail vs))## \n        ((prod_encode(0, prod_encode(1, c2)))##0)## 0)\n      ## map_com_to_operators3_tail i c1 vs ) t ) )\nelse  if hd_nat c = 4 then (let i = prod_encode(1,c) ;  vs = nth_nat (Suc 0) c ; c' = nth_nat (Suc (Suc 0)) c ; \n  j = prod_encode(1, (2##c'## c##0)); k = prod_encode(1, 0##0) in \n  com_to_operators_stack_nat (add_res_to_stack_op_nat (( ((prod_encode(0, i)) ##  map_com_to_operators2_tail (remdups_tail vs))## \n        (((prod_encode(0, k))##0))##0) \n      ## map_com_to_operators4_tail i j vs) t))\nelse if hd_nat c = 5 then \n(let ops = nth_nat (Suc (Suc (Suc 0))) c; c2 = nth_nat (Suc (Suc 0)) c ; c1 = nth_nat (Suc 0) c  in  com_to_operators_stack_nat (add_res_to_stack_op_nat  (map_com_to_operators_tail (2 ## c1 ##c2 ## 0) c2 ops) t))\nelse nth_nat (Suc 0) c\n))\n\"  by pat_completeness auto\n \n\n\n\n\nlemma push_stack_not_Nil :\n\"push_to_stack_op c s \\<noteq> []\"\n  apply (cases c)\n  apply auto\n  done\n\nlemma add_res_not_Nil : \n\"add_res_to_stack_op c s \\<noteq> []\"\n  apply (cases s)\n   apply auto\n  subgoal for a xs\n    apply( cases a)\n          apply auto\n    done\n  done\nlemma Nil_is_map_op:\n\"[] = map operator_encode []\"\n  by  auto\nlemma sas_singleton:\"list_encode [sas_assignment_encode x] = sas_assignment_list_encode [x]\"\n  apply (auto simp add: sas_assignment_list_encode_def)\n  done\n\nlemma op_singleton:\"[operator_encode x] = map operator_encode [x]\"\n  apply (auto)\n  done\n\nlemma sas_couple:\"list_encode [sas_assignment_encode x,sas_assignment_encode y] = sas_assignment_list_encode [x,y]\"\n  apply (auto simp add: sas_assignment_list_encode_def)\n  done\nlemma operator_encode_simps: \n\"list_encode [sas_assignment_list_encode x, sas_assignment_list_encode y] = operator_encode \\<lparr>\n  precondition_of = x, effect_of = y\n\\<rparr>\"\n  apply (auto simp add:operator_encode_def)\n  done\nlemma comm_inj_simps: \"(comm_encode x= comm_encode y) = (x=y)\"\n  by (simp add: comm_inj inj_eq)\n\n\nlemma sub_map_dec: \"map_nat P xs = list_encode (map P (list_decode xs))\"\n  using sub_map list_decode_inverse by metis\n\n\nlemma comm_encode_eq : \"(comm_encode c1 = comm_encode c2) = (c1 = c2)\"\n  apply (cases c2)\n  apply (induct c1 arbitrary:c2)\n          apply (auto simp add:prod_encode_eq)\n  apply (metis One_nat_def comm_encode.simps(2) comm_id list_encode.simps(1) list_encode.simps(2))\n  apply (metis comm_encode.simps(3) comm_id list_encode.simps(1) list_encode.simps(2))\n   apply (metis comm_encode.simps(4) comm_id list_encode.simps(1) list_encode.simps(2))\n  by (metis comm_encode.simps(5) comm_id cons0 cons_def list_encode.simps(2))\n\n\n  \nlemma list_encode_empty:\"(list_encode l = 0) =(l = [])\"\n  apply (auto)\n  using list_encode_eq by force\n\nlemma suc_eq: \"(Suc i = Suc j) = (i=j) \"\n  by simp\n\nlemma list_update_nat_zero: \"list_update_nat 0 0 n = 0\"\n  apply auto\n  done\n\nlemma  simp_op_id:\"\\<lparr>sas_plus_operator.precondition_of =\n                       sas_plus_operator.precondition_of a,\n                       effect_of = effect_of a\\<rparr> = a\"\n  by auto\nlemma ev_zero_encode:\"prod_encode (0,0) = domain_element_encode (EV Zero)\"\n  apply auto\n  done\nlemma com_to_operators_term:\n\"com_to_operators_stack_nat_dom (list_encode (map  com_op_encode s))\"\nproof (induct s rule: com_to_operators_stack.induct)\ncase (1 x s)\n  then show ?case using com_to_operators_stack_nat.domintros[of \n        \"list_encode\n       (list_encode [6, list_encode (map operator_encode x)] # map com_op_encode s)\"]\n        apply(simp only: list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps )    \ndone\nnext\n  case (2 s)\n  then show ?case using com_to_operators_stack_nat.domintros[of \n        \"list_encode\n       (list_encode [0] # map com_op_encode s)\"]\n        apply(simp only: list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps )  \n       apply (simp only: sub_add_res_to_stack list_encode_eq  Nil_is_map_op   flip: list_encode.simps  )\n    apply simp\ndone\nnext\n  case (3 v b s)\n  then show ?case  using com_to_operators_stack_nat.domintros[of \n        \"list_encode\n       (list_encode [1, vname_encode v, bit_encode b] # map com_op_encode s)\"]\n        apply(simp only: One_nat_def non_empty_positive list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps ) \n         \n  apply(simp only:   flip: comm_encode.simps One_nat_def del:list_encode.simps)\n      apply (simp only:sub_hd  head.simps sub_cons cons0 sub_map sub_nth\n                                      nth.simps  flip: domain_element_encode.simps  variable_encode.simps sas_assignment_encode.simps comm_encode.simps )\n      apply (simp only: nth.simps  sub_hd sub_add_res_to_stack op_singleton operator_encode_simps  sas_singleton sas_couple  head.simps sub_cons cons0 sub_map sub_nth variable_encode.simps(1)\n                                      nth.simps  flip:  domain_element_encode.simps  sas_assignment_encode.simps comm_encode.simps )\n    done\nnext\n  case (4 c1 c2 s)\n  then show ?case  using com_to_operators_stack_nat.domintros[of \n        \"list_encode\n       (list_encode [2, comm_encode c1, comm_encode c2] # map com_op_encode s)\"]\n    apply (cases \"c1=com.SKIP\")\n        apply(auto simp only: non_empty_positive list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def  \n                   simp del: list_encode.simps ) \n  apply( simp only:    flip: comm_encode.simps One_nat_def  del:list_encode.simps)\n      apply (auto  simp only:sub_hd  head.simps sub_cons cons0 sub_map sub_nth\n                                      nth.simps  simp flip:  domain_element_encode.simps  variable_encode.simps sas_assignment_encode.simps comm_encode.simps )[1]\n      apply ( auto simp only: sub_hd sub_add_res_to_stack sub_push_to_stack_op op_singleton operator_encode_simps  sas_singleton sas_couple  head.simps sub_cons cons0 sub_map sub_nth variable_encode.simps(1)\n                                      nth.simps   simp  flip:  domain_element_encode.simps  sas_assignment_encode.simps )\n    apply (auto simp only:sub_push_to_stack_op sub_add_res_to_stack list_encode_0 comm_inj_simps simp flip: One_nat_def com_op_encode.simps(3) comm_encode.simps(1) list.map(2) split: if_splits)\n    apply auto\n    done\nnext\n  case (5 c1 c2 ops s)\n  then show ?case   using com_to_operators_stack_nat.domintros[of \n        \"list_encode\n       (list_encode  [5, comm_encode c1, comm_encode c2, list_encode (map operator_encode ops)] # map com_op_encode s)\"]\n        apply(simp only: list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps ) \n    apply(simp only:subtail_map_com_to_operators\n        submap_com_to_operators   sub_nth nth.simps  flip: comm_encode.simps del:list_encode.simps)\n      apply (simp only:sub_hd sub_list_update  head.simps sub_cons cons0 sub_map sub_nth\n                                      nth.simps  flip: domain_element_encode.simps  variable_encode.simps sas_assignment_encode.simps comm_encode.simps del: list_encode.simps )\n      apply (simp only:sub_hd sub_add_res_to_stack op_singleton operator_encode_simps  sas_singleton sas_couple  head.simps sub_cons cons0 sub_map sub_nth variable_encode.simps(1)\n                                      nth.simps  flip:  domain_element_encode.simps  sas_assignment_encode.simps comm_encode.simps )\n      apply (auto simp only: sub_hd list_encode_eq suc_eq list_encode_empty comm_encode_eq head.simps sub_cons cons0 sub_map sub_map_dec sub_nth com_to_operators.simps\n                         sub_list_update sas_plus_operator.simps sas_assignment_list_encode_def list.map prod_encode_eq  nth.simps sub_pc_to_com Let_def comp_def operator_encode_def\n  domain_element_encode.simps  variable_encode.simps  sas_assignment_encode.simps\n    map_map list_encode_inverse subtail_remdups sub_remdups  comm_encode.simps submap_com_to_operators\n  simp flip: comm_encode.simps\n                          del: list_encode.simps hd_nat_def cons_def pc_to_com_nat_def map_nat.simps nth_nat.simps list_update_nat.simps split:if_splits)\n  apply (auto simp only:sub_pc_to_com simp flip:  sas_assignment_list_encode_def  comm_encode.simps )\n    apply (auto simp only:  operator_encode_simps sas_assignment_list_encode_def list.simps map_update \n            sas_assignment_encode.simps variable_encode.simps domain_element_encode.simps  simp flip:  sas_assignment_encode.simps sas_assignment_list_encode_def map_update  variable_encode.simps domain_element_encode.simps comm_encode.simps)\n     apply (auto simp only:  simp flip:comp_def[of operator_encode \n\"\\<lambda>x.  \\<lparr>sas_plus_operator.precondition_of = (sas_plus_operator.precondition_of x)\n                           [variable_encode PC := (PC, PCV (_;; _))],\n                           effect_of = (effect_of x)\n                             [variable_encode PC := (PC, PCV (pc_to_com (effect_of x);; _))]\\<rparr>\"\n\n ] )\n    apply(auto simp only:sub_add_res_to_stack simp_op_id simp flip: map_map)\n    apply auto\n    done\n\nnext\n  case (6 vs c1 c2 s)\n  then show ?case  using com_to_operators_stack_nat.domintros[of \n        \"list_encode\n       (list_encode   [3, list_encode (map vname_encode vs), comm_encode c1, comm_encode c2] # map com_op_encode s)\"]\n        apply(simp only: non_empty_positive subtail_remdups sub_remdups vname_list_encode_def list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps ) \n    apply(simp only:subtail_map_com_to_operators2\n        submap_com_to_operators2  subtail_map_com_to_operators3\n        submap_com_to_operators3   sub_nth nth.simps  flip: comm_encode.simps  vname_list_encode_def del:list_encode.simps)\n      apply (simp only:sub_hd sub_list_update  head.simps sub_cons cons0 sub_map sub_nth\n                                      nth.simps  flip: domain_element_encode.simps  variable_encode.simps sas_assignment_encode.simps comm_encode.simps del: list_encode.simps )\n      apply (simp only:sub_hd sub_add_res_to_stack op_singleton operator_encode_simps  sas_singleton sas_couple  head.simps sub_cons cons0 sub_map sub_nth variable_encode.simps(1)\n                                      nth.simps   variable_encode.simps  flip:  bit_encode.simps domain_element_encode.simps  sas_assignment_encode.simps comm_encode.simps )\n    apply( simp only: bit_encode.simps  flip:One_nat_def domain_element_encode.simps)\n    apply (simp only:  flip: bit_encode.simps)\n  using vname_inj\n   apply(simp only: remdups_map  map_map comp_def flip: variable_encode.simps sas_assignment_encode.simps)\n  apply(simp only: ev_zero_encode  bit_encode.simps(1) cons0 sub_cons sub_map flip:  sas_assignment_encode.simps domain_element_encode.simps )\n  apply (simp only:  flip: sas_assignment_encode.simps   variable_encode.simps  comp_def[of sas_assignment_encode \"\\<lambda>x. (VN x, EV Zero)\"] map_map list.map(2))\n   apply( simp only: sub_map vname_list_encode_def map_map comp_def sas_singleton sas_couple operator_encode_simps sub_cons flip: variable_encode.simps sas_assignment_encode.simps  sas_assignment_list_encode_def ) \n  apply( simp only: sub_add_res_to_stack flip: map_map list.map comp_def [of operator_encode \"\\<lambda>x. \\<lparr>sas_plus_operator.precondition_of =\n                                                [(PC, PCV (IF _\\<noteq>0 THEN _ ELSE _)), (VN x, EV One)],\n                                                effect_of = [(PC, PCV _)]\\<rparr>\" ])\n  apply simp\n done\nnext\n  case (7 vs c s)\n  then show ?case  using com_to_operators_stack_nat.domintros[of \n        \"list_encode\n       (list_encode   [4, list_encode (map vname_encode vs), comm_encode c] # map com_op_encode s)\"]\n       apply(simp only: subtail_remdups sub_remdups vname_list_encode_def list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps ) \n    apply(simp only:subtail_map_com_to_operators4\n        submap_com_to_operators4  subtail_map_com_to_operators2\n        submap_com_to_operators2   sub_nth nth.simps  flip: comm_encode.simps  vname_list_encode_def del:list_encode.simps)\n      apply (simp only:sub_hd sub_list_update  head.simps sub_cons cons0 sub_map sub_nth\n                                      nth.simps  flip: domain_element_encode.simps  variable_encode.simps sas_assignment_encode.simps comm_encode.simps del: list_encode.simps )\n      apply (simp only:sub_hd sub_add_res_to_stack op_singleton operator_encode_simps  sas_singleton sas_couple  head.simps sub_cons cons0 sub_map sub_nth variable_encode.simps(1)\n                                      nth.simps   variable_encode.simps  flip:  bit_encode.simps domain_element_encode.simps  sas_assignment_encode.simps comm_encode.simps )\n      apply( simp only: bit_encode.simps  flip:One_nat_def domain_element_encode.simps)\n    apply (simp only:  flip: bit_encode.simps)\n  using vname_inj\n   apply(simp only: remdups_map  map_map comp_def flip: variable_encode.simps sas_assignment_encode.simps)\n  apply(simp only: ev_zero_encode  bit_encode.simps(1) cons0 sub_cons sub_map flip:  sas_assignment_encode.simps domain_element_encode.simps )\n  apply (simp only:  flip: sas_assignment_encode.simps   variable_encode.simps  comp_def[of sas_assignment_encode \"\\<lambda>x. (VN x, EV Zero)\"] map_map list.map(2))\n   apply( simp only: sub_map vname_list_encode_def map_map comp_def sas_singleton sas_couple operator_encode_simps sub_cons flip: variable_encode.simps sas_assignment_encode.simps  sas_assignment_list_encode_def )\n  apply( simp only: sub_add_res_to_stack flip: map_map list.map(2) comp_def [of operator_encode \"\\<lambda>x.\\<lparr>sas_plus_operator.precondition_of =\n                                                     [(PC, PCV (WHILE _\\<noteq>0 DO _ )), (VN x, EV One)],\n                                                     effect_of = [(PC, PCV (_;; WHILE _\\<noteq>0 DO _))]\\<rparr>\" ])\n  apply simp\n  done\nnext\n  case 8\n  then show ?case by (auto intro: com_to_operators_stack_nat.domintros)\nqed\n\nlemma sub_com_to_operators_stack:\n\" com_to_operators_stack_nat (list_encode (map  com_op_encode s))\n= list_encode (map operator_encode(com_to_operators_stack s))\"\nproof (induct s rule: com_to_operators_stack.induct)\ncase (1 x s)\n  then show ?case apply(subst com_to_operators_stack_nat.psimps)\n    using  com_to_operators_term apply blast\n        apply(simp only: list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps )    \n    apply simp\ndone\nnext\n  case (2 s)\n  then show ?case  apply(subst com_to_operators_stack_nat.psimps)\n    using  com_to_operators_term apply blast\n        apply(simp only: list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps )  \n       apply (simp only: sub_add_res_to_stack list_encode_eq  Nil_is_map_op   flip: list_encode.simps  )\n    apply simp\ndone\nnext\n  case (3 v b s)\n  then show ?case  apply(subst com_to_operators_stack_nat.psimps)\n    using  com_to_operators_term apply blast\n        apply(simp only: list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps ) \n  apply(simp only:  flip: comm_encode.simps del:list_encode.simps)\n      apply (simp only:sub_hd  head.simps sub_cons cons0 sub_map sub_nth\n                                      nth.simps  flip: domain_element_encode.simps  variable_encode.simps sas_assignment_encode.simps comm_encode.simps )\n      apply (simp only:sub_hd sub_add_res_to_stack op_singleton operator_encode_simps  sas_singleton sas_couple  head.simps sub_cons cons0 sub_map sub_nth variable_encode.simps(1)\n                                      nth.simps  flip:  domain_element_encode.simps  sas_assignment_encode.simps comm_encode.simps )\n    apply simp\n    done\nnext\n  case (4 c1 c2 s)\n  then show ?case apply(subst com_to_operators_stack_nat.psimps)\n    using  com_to_operators_term apply blast\n    apply (cases \"c1=com.SKIP\")\n        apply(auto simp only: list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps ) \n  apply(simp only:   flip: comm_encode.simps del:list_encode.simps)\n      apply ( simp only:sub_hd  head.simps sub_cons cons0 sub_map sub_nth\n                                      nth.simps   flip: domain_element_encode.simps  variable_encode.simps sas_assignment_encode.simps comm_encode.simps )\n      apply ( simp only:sub_hd sub_add_res_to_stack op_singleton operator_encode_simps  sas_singleton sas_couple  head.simps sub_cons cons0 sub_map sub_nth variable_encode.simps(1)\n                                      nth.simps   flip:  domain_element_encode.simps  sas_assignment_encode.simps comm_encode.simps )\n     apply simp\n    apply (auto simp only:sub_push_to_stack_op list_encode_0 comm_inj_simps simp flip: com_op_encode.simps(3) comm_encode.simps(1) list.map(2) split: if_splits)\n    done\nnext\n  case (5 c1 c2 ops s)\n  then show ?case apply(subst com_to_operators_stack_nat.psimps)\n    using  com_to_operators_term apply blast\n        apply(simp only: list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps ) \n    apply(simp only:subtail_map_com_to_operators\n        submap_com_to_operators   sub_nth nth.simps  flip: comm_encode.simps del:list_encode.simps)\n      apply (simp only:sub_hd sub_list_update  head.simps sub_cons cons0 sub_map sub_nth\n                                      nth.simps  flip: domain_element_encode.simps  variable_encode.simps sas_assignment_encode.simps comm_encode.simps del: list_encode.simps )\n      apply (simp only:sub_hd sub_add_res_to_stack op_singleton operator_encode_simps  sas_singleton sas_couple  head.simps sub_cons cons0 sub_map sub_nth variable_encode.simps(1)\n                                      nth.simps  flip:  domain_element_encode.simps  sas_assignment_encode.simps comm_encode.simps )\n      apply (auto simp only: sub_hd list_encode_eq suc_eq list_encode_empty comm_encode_eq head.simps sub_cons cons0 sub_map sub_map_dec sub_nth com_to_operators.simps\n                         sub_list_update sas_plus_operator.simps sas_assignment_list_encode_def list.map prod_encode_eq  nth.simps sub_pc_to_com Let_def comp_def operator_encode_def\n  domain_element_encode.simps  variable_encode.simps  sas_assignment_encode.simps\n    map_map list_encode_inverse subtail_remdups sub_remdups  comm_encode.simps submap_com_to_operators\n  simp flip: comm_encode.simps\n                          del: list_encode.simps hd_nat_def cons_def pc_to_com_nat_def map_nat.simps nth_nat.simps list_update_nat.simps split:if_splits)\n  apply (auto simp only:sub_pc_to_com simp flip:  sas_assignment_list_encode_def  comm_encode.simps )\n    apply (auto simp only:  operator_encode_simps sas_assignment_list_encode_def list.simps map_update \n            sas_assignment_encode.simps variable_encode.simps domain_element_encode.simps  simp flip:  sas_assignment_encode.simps sas_assignment_list_encode_def map_update  variable_encode.simps domain_element_encode.simps comm_encode.simps)\n     apply (auto simp only:  simp flip:comp_def[of operator_encode \n\"\\<lambda>x.  \\<lparr>sas_plus_operator.precondition_of = (sas_plus_operator.precondition_of x)\n                           [variable_encode PC := (PC, PCV (_;; _))],\n                           effect_of = (effect_of x)\n                             [variable_encode PC := (PC, PCV (pc_to_com (effect_of x);; _))]\\<rparr>\"\n\n ] )\n     apply(auto simp only:sub_add_res_to_stack simp_op_id simp flip: map_map)\n    done\n\nnext\n  case (6 vs c1 c2 s)\n  then show ?case apply(subst com_to_operators_stack_nat.psimps)\n    using  com_to_operators_term apply blast\n        apply(simp only: subtail_remdups sub_remdups vname_list_encode_def list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps ) \n    apply(simp only:subtail_map_com_to_operators2\n        submap_com_to_operators2  subtail_map_com_to_operators3\n        submap_com_to_operators3   sub_nth nth.simps  flip: comm_encode.simps  vname_list_encode_def del:list_encode.simps)\n      apply (simp only:sub_hd sub_list_update  head.simps sub_cons cons0 sub_map sub_nth\n                                      nth.simps  flip: domain_element_encode.simps  variable_encode.simps sas_assignment_encode.simps comm_encode.simps del: list_encode.simps )\n      apply (simp only:sub_hd sub_add_res_to_stack op_singleton operator_encode_simps  sas_singleton sas_couple  head.simps sub_cons cons0 sub_map sub_nth variable_encode.simps(1)\n                                      nth.simps   variable_encode.simps  flip:  bit_encode.simps domain_element_encode.simps  sas_assignment_encode.simps comm_encode.simps )\n   apply(subst (6) bit_encode.simps) \n   apply( simp only: flip: domain_element_encode.simps)\n  using vname_inj\n   apply(simp only: remdups_map  map_map comp_def flip: variable_encode.simps sas_assignment_encode.simps)\n   apply(simp only: bit_encode.simps(1) cons0 sub_cons sub_map flip: domain_element_encode.simps comp_def[of sas_assignment_encode \"\\<lambda>x. (VN x, EV Zero)\"] map_map list.map(2))\n   apply( simp only: sub_map vname_list_encode_def map_map comp_def sas_singleton sas_couple operator_encode_simps sub_cons flip: variable_encode.simps sas_assignment_encode.simps  sas_assignment_list_encode_def ) \n  apply( simp only: sub_add_res_to_stack flip: map_map list.map(2) comp_def [of operator_encode \"\\<lambda>x. \\<lparr>sas_plus_operator.precondition_of =\n                                                [(PC, PCV (IF _\\<noteq>0 THEN _ ELSE _)), (VN x, EV One)],\n                                                effect_of = [(PC, PCV _)]\\<rparr>\" ])\n   apply simp\ndone\nnext\n  case (7 vs c s)\n  then show ?case apply(subst com_to_operators_stack_nat.psimps)\n    using  com_to_operators_term apply blast\n        apply(simp only: subtail_remdups sub_remdups vname_list_encode_def list.simps head.simps tail.simps com_op_encode.simps cons0 sub_cons sub_nth\n                        nth.simps com_to_operators_stack.simps\n                        add_res_not_Nil push_stack_not_Nil sub_hd sub_tl Let_def \n                   del: list_encode.simps ) \n    apply(simp only:subtail_map_com_to_operators4\n        submap_com_to_operators4  subtail_map_com_to_operators2\n        submap_com_to_operators2   sub_nth nth.simps  flip: comm_encode.simps  vname_list_encode_def del:list_encode.simps)\n      apply (simp only:sub_hd sub_list_update  head.simps sub_cons cons0 sub_map sub_nth\n                                      nth.simps  flip: domain_element_encode.simps  variable_encode.simps sas_assignment_encode.simps comm_encode.simps del: list_encode.simps )\n      apply (simp only:sub_hd sub_add_res_to_stack op_singleton operator_encode_simps  sas_singleton sas_couple  head.simps sub_cons cons0 sub_map sub_nth variable_encode.simps(1)\n                                      nth.simps   variable_encode.simps  flip:  bit_encode.simps domain_element_encode.simps  sas_assignment_encode.simps comm_encode.simps )\n   apply(subst (10) bit_encode.simps) \n   apply( simp only: flip: domain_element_encode.simps)\n  using vname_inj\n   apply(simp only: remdups_map map_map comp_def flip: variable_encode.simps sas_assignment_encode.simps)\n   apply(simp only: bit_encode.simps(1) cons0 sub_cons sub_map flip: domain_element_encode.simps comp_def[of sas_assignment_encode \"\\<lambda>x. (VN x, EV Zero)\"] map_map list.map(2))\n   apply( simp only: sub_map vname_list_encode_def map_map comp_def sas_singleton sas_couple operator_encode_simps sub_cons flip: variable_encode.simps sas_assignment_encode.simps  sas_assignment_list_encode_def ) \n  apply( simp only: sub_add_res_to_stack flip: map_map list.map(2) comp_def [of operator_encode \"\\<lambda>x.\\<lparr>sas_plus_operator.precondition_of =\n                                                     [(PC, PCV (WHILE _\\<noteq>0 DO _ )), (VN x, EV One)],\n                                                     effect_of = [(PC, PCV (_;; WHILE _\\<noteq>0 DO _))]\\<rparr>\" ])\n  apply simp\n  done\nnext\n  case 8\n  then show ?case apply(subst com_to_operators_stack_nat.psimps)\n    using  com_to_operators_term apply blast\n    apply auto\n    done\nqed\n\n                \n        \n        \n     \n\ndefinition com_to_operators_nat:: \"nat \\<Rightarrow> nat\" where \n\"com_to_operators_nat c = com_to_operators_stack_nat (push_to_stack_op_nat c 0)\"\n\nlemma subnat_com_to_operators: \n\"com_to_operators_nat (comm_encode c) = list_encode (map operator_encode (com_to_operators_t c)) \"\n  by (metis com_to_operators_nat_def com_to_operators_t_def list.simps(8) list_encode.simps(1)\n push_stack_not_Nil sub_com_to_operators_stack sub_push_to_stack_op)\n\nlemma sub_com_to_operators:\n\"com_to_operators_nat (comm_encode c) = list_encode (map operator_encode (com_to_operators c))\"\n  by (simp add: subnat_com_to_operators subtailnat_com_to_operators)\n\ndefinition com_to_operators_tail:: \"nat \\<Rightarrow> nat\" where\n\"com_to_operators_tail c = com_to_operators_nat c\"\n\nlemma subtail_com_to_operators:\n\"com_to_operators_tail c = com_to_operators_nat c\"\n  by (simp add: com_to_operators_tail_def)\nfun map_coms_to_operators :: \"nat \\<Rightarrow> nat\" where \n\"map_coms_to_operators n = (if n = 0 then 0 else (com_to_operators_nat (hd_nat n)) ## map_coms_to_operators (tl_nat n))\"\n\nfun map_coms_to_operators_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_coms_to_operators_acc acc  n = (if n = 0 then acc else map_coms_to_operators_acc ((com_to_operators_tail (hd_nat n)) ## acc) (tl_nat n))\"\n\nlemma map_coms_to_operators_induct:\n\"map_coms_to_operators_acc acc  n = map_acc  com_to_operators_nat acc n\"\n  apply(induct acc n rule: map_coms_to_operators_acc.induct)\n  apply (auto simp add: subtail_com_to_operators)\n  done\n\n\nlemma submap_coms_to_operators : \n\"map_coms_to_operators n  = map_nat com_to_operators_nat n \"\n  apply (induct n rule:map_coms_to_operators.induct)\n  apply auto\n  done\n\ndefinition  map_coms_to_operators_tail:: \"nat \\<Rightarrow> nat\" where \n\"map_coms_to_operators_tail n = reverse_nat (map_coms_to_operators_acc 0 n)\"\n\nlemma subtail_map_coms_to_operators:\n\"map_coms_to_operators_tail n = map_coms_to_operators n\"\n  \n  using map_coms_to_operators_induct map_coms_to_operators_tail_def submap_coms_to_operators \nsubtail_map by auto\n\ndefinition coms_to_operators_nat :: \"nat \\<Rightarrow> nat\" where\n\"coms_to_operators_nat cs = concat_nat (map_coms_to_operators cs)\"\n\ndefinition coms_to_operators_tail :: \"nat \\<Rightarrow> nat\" where\n\"coms_to_operators_tail cs = concat_tail (map_coms_to_operators_tail cs)\"\nlemma subtail_coms_to_operators:\n\"coms_to_operators_tail cs = coms_to_operators_nat cs\"\n  by (simp add: coms_to_operators_nat_def\n coms_to_operators_tail_def subtail_concat subtail_map_coms_to_operators)\n\nlemma sub_coms_to_operators:\n    \"coms_to_operators_nat (list_encode( map comm_encode cs)) = \n          list_encode (map operator_encode (coms_to_operators cs)) \"\n  apply (auto simp only: coms_to_operators_nat_def sub_map map_map comp_def\n        sub_com_to_operators submap_coms_to_operators )\n  apply (auto simp only: coms_to_operators_def sub_concat map_concat simp flip: \ncomp_def[of \"list_encode\" \"%x.(map operator_encode (com_to_operators x))\"]\n            map_map)\n  apply (auto simp add: comp_def)\n  done\n\n\n\ndefinition imp_minus_minus_to_sas_plus_list::\n\"com \\<Rightarrow> (vname,bit) assignment list  \\<Rightarrow> (vname,bit) assignment list \\<Rightarrow> \n      (variable,domain_element) sas_plus_list_problem\" where \n\"imp_minus_minus_to_sas_plus_list c I G = (let cs = enumerate_subprograms c ; \n  initial_vs = restrict_list I (enumerate_variables c) ;\n  goal_vs = restrict_list G (enumerate_variables c) ;\n  pc_d = map (\\<lambda> i. PCV i) cs in\n    \\<lparr> variables_ofl = PC # (map VN (enumerate_variables c)),\n      operators_ofl = coms_to_operators cs, \n      initial_ofl = imp_minus_state_to_sas_plus_list (c, initial_vs),\n      goal_ofl = imp_minus_state_to_sas_plus_list (com.SKIP, goal_vs),\n      range_ofl = (PC, pc_d)#(map (\\<lambda> v. (VN v, domain)) (enumerate_variables c))\\<rparr>)\"\n\nlemma sublist_imp_minus_minus_to_sas_plus:\n\"list_problem_to_problem (imp_minus_minus_to_sas_plus_list c I G) = \n    imp_minus_minus_to_sas_plus c (map_of I) (map_of G)\"\n  apply (auto simp add:\n          imp_minus_minus_to_sas_plus_list_def list_problem_to_problem.simps\n          sub_restrict_list Let_def sas_plus_problem.simps sas_plus_list_problem.simps\n            sublist_imp_minus_state_to_sas_plus \n            imp_minus_minus_to_sas_plus_def  )\n  done\n\nfun map_PCV :: \"nat \\<Rightarrow> nat\" where \n\"map_PCV n = (if n = 0 then 0 else  (prod_encode(1, hd_nat n))## map_PCV (tl_nat n))\"\n\nlemma submap_PCV : \n\"map_PCV n =  map_nat (\\<lambda> i. prod_encode(1, i)) n \"\n  apply (induct n rule: map_PCV.induct)\n  apply (auto)\n  done\n\nfun map_PCV_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_PCV_acc acc n = (if n = 0 then acc else map_PCV_acc ((prod_encode(1, hd_nat n))## acc) (tl_nat n))\"\n\nlemma map_PCV_induct: \n\"map_PCV_acc acc n = map_acc (\\<lambda> i. prod_encode(1, i)) acc n\"\n  apply(induct acc n rule:map_PCV_acc.induct)\n  apply auto done\n\ndefinition map_PCV_tail :: \"nat \\<Rightarrow> nat\" where \n\"map_PCV_tail n = reverse_nat (map_PCV_acc 0 n)\"\n\nlemma subtail_map_PCV:\n\"map_PCV_tail n =  map_PCV n\"\n  using map_PCV_tail_def map_PCV_induct submap_PCV subtail_map by presburger\n\nfun map_Suc :: \"nat \\<Rightarrow> nat\" where \n\"map_Suc n = (if n = 0 then 0 else (Suc(hd_nat n)) ## (map_Suc (tl_nat n)))\"\n\nfun map_Suc_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_Suc_acc acc n = (if n = 0 then acc else map_Suc_acc ((Suc(hd_nat n)) ## acc) (tl_nat n))\"\n\nlemma submap_Suc :\n\"map_Suc n = map_nat Suc n\"\n  apply (induct n rule:map_Suc.induct)\n  apply auto\n  done\n\nlemma map_Suc_induct : \n\"map_Suc_acc acc n = map_acc Suc acc n\"\n  apply(induct acc n rule:map_Suc_acc.induct)\n  apply auto\n  done\n\ndefinition map_Suc_tail :: \"nat \\<Rightarrow> nat\" where \n\"map_Suc_tail n = reverse_nat (map_Suc_acc 0 n)\"\n\nlemma subtail_map_Suc:\n\"map_Suc_tail n = map_Suc n\"\n  \n  using map_Suc_induct map_Suc_tail_def submap_Suc subtail_map by auto\n\nfun map_domain :: \"nat\\<Rightarrow> nat\" where \n\"map_domain n = (if n = 0 then 0 else (prod_encode(Suc (hd_nat n), domain_nat)) ## map_domain (tl_nat n))\"\n\nfun map_domain_acc :: \" nat \\<Rightarrow> nat\\<Rightarrow> nat\" where \n\"map_domain_acc acc n = (if n = 0 then acc else  map_domain_acc ((prod_encode(Suc (hd_nat n), domain_nat)) ## acc) (tl_nat n))\"\n\nlemma submap_domain :\n\"map_domain n = map_nat (\\<lambda> v. (prod_encode(Suc v, domain_nat))) n\"\n  apply (induct n rule:map_domain.induct)\n  apply auto\n  done\nlemma map_domain_induct: \n\"map_domain_acc acc n = map_acc   (\\<lambda> v. (prod_encode(Suc v, domain_nat))) acc n\"\n  apply(induct acc n rule:map_domain_acc.induct)\n  apply auto\n  done\n\ndefinition map_domain_tail :: \"nat  \\<Rightarrow> nat\" where \n\"map_domain_tail n = reverse_nat (map_domain_acc 0 n )\"\n\nlemma subtail_map_domain:\n\"map_domain_tail n = map_domain n\"\n  using map_domain_induct map_domain_tail_def submap_domain subtail_map by presburger\n\ndefinition imp_minus_minus_to_sas_plus_nat:: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"imp_minus_minus_to_sas_plus_nat c I G = (let cs = enumerate_subprograms_nat c ; \n  initial_vs = restrict_nat I (enumerate_variables_nat c) ;\n  goal_vs = restrict_nat G (enumerate_variables_nat c) ;\n  pc_d = map_PCV cs in\n   (0 ## (map_Suc (enumerate_variables_nat c)))## \n      (coms_to_operators_nat cs) ## \n      (imp_minus_state_to_sas_plus_nat (prod_encode (c, initial_vs)))##\n      (imp_minus_state_to_sas_plus_nat (prod_encode (0##0, goal_vs)))##\n      ((prod_encode(0, pc_d))##(map_domain (enumerate_variables_nat c)))##0 )\"\n\ndefinition imp_minus_minus_to_sas_plus_tail:: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"imp_minus_minus_to_sas_plus_tail c I G = (let cs = enumerate_subprograms_tail c ; \n  initial_vs = restrict_tail I (enumerate_variables_tail c) ;\n  goal_vs = restrict_tail G (enumerate_variables_tail c) ;\n  pc_d = map_PCV_tail cs in\n   (0 ## (map_Suc_tail (enumerate_variables_tail c)))## \n      (coms_to_operators_tail cs) ## \n      (imp_minus_state_to_sas_plus_tail (prod_encode (c, initial_vs)))##\n      (imp_minus_state_to_sas_plus_tail (prod_encode (0##0, goal_vs)))##\n      ((prod_encode(0, pc_d))##(map_domain_tail (enumerate_variables_tail c)))##0 )\"\n\nlemma subtail_imp_minus_minus_to_sas_plus:\n\"imp_minus_minus_to_sas_plus_tail c I G = imp_minus_minus_to_sas_plus_nat c I G\"\n  apply (auto simp only:  imp_minus_minus_to_sas_plus_tail_def imp_minus_minus_to_sas_plus_nat_def\n      subtail_enumerate_subprograms subtail_map_PCV subtail_map_Suc subtail_enumerate_variables\n      subtail_coms_to_operators subtail_map_domain subtail_imp_minus_state_to_sas_plus \nsubtail_restrict\n) done\n\nlemma subnat_imp_minus_minus_to_sas_plus:\n\"imp_minus_minus_to_sas_plus_nat (comm_encode c) \n            (imp_assignment_list_encode I) (imp_assignment_list_encode G) =\n list_problem_encode (imp_minus_minus_to_sas_plus_list c I G)\"\n  apply (auto simp only: imp_minus_minus_to_sas_plus_nat_def\n      sub_enumerate_subprograms sub_restrict_nat sub_enumerate_variables sub_map\n      sub_cons cons0 Let_def submap_PCV submap_Suc submap_domain\n)\n  apply (auto simp only: vname_list_encode_def sub_map sub_cons\n      sub_coms_to_operators sub_domain\n   subnat_imp_minus_state_to_sas_plus map_map comp_def\n        simp flip: comm_encode.simps(1) cilist_encode.simps variable_encode.simps(2))\n  apply (auto simp only: subnat_imp_minus_state_to_sas_plus list_problem_encode_def  sas_plus_list_problem.simps \n              imp_minus_minus_to_sas_plus_list_def Let_def list.simps simp flip: comp_def map_map )\n  apply (auto simp only: domain_element_encode.simps sas_assignment_list_encode_def map_map[of \"vdlist_encode\"] map_map[of \"domain_element_encode\"] comp_def vdlist_encode.simps variable_encode.simps)\n  done\n\nlemma sub_imp_minus_minus_to_sas:\n\"list_problem_to_problem (list_problem_decode (imp_minus_minus_to_sas_plus_nat (comm_encode c) \n            (imp_assignment_list_encode I) (imp_assignment_list_encode G)))\n= imp_minus_minus_to_sas_plus c (map_of I) (map_of G)\"\n  apply (auto simp only: subnat_imp_minus_minus_to_sas_plus sublist_imp_minus_minus_to_sas_plus list_problem_id)\n  done\n\n   \n  \n\n\n      \n        \n        \n\n\n    \nend", "meta": {"author": "AlexiosFan", "repo": "BA_NP_Reduction", "sha": "0e37ddc58cb822b0a09b2ce7c15e7b88652e154c", "save_path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction", "path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction/BA_NP_Reduction-0e37ddc58cb822b0a09b2ce7c15e7b88652e154c/poly-reductions/Cook_Levin/IMP-_To_SAS+/IMP--_To_SAS++/IMP_Minus_Minus_To_SAS_Plus_Plus_Reduction_Nat.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7185944046238981, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.33966770145761416}}
{"text": "theory Ex_Typed\nimports Monad2 LLVM_Integer \"Show.Show_Instances\"\nbegin\n  datatype err = is_static: STATIC_ERROR string | MEM_ERROR | UNINIT_ERROR | OVERFLOW_ERROR\n  hide_const (open) is_static\n\n  abbreviation lift_lens_static (\"'(_')\\<^sub>S\")\n    where \"lift_lens_static \\<equiv> lift_lens (STATIC_ERROR ''lens'')\"\n\n  abbreviation lift_lens_mem (\"'(_')\\<^sub>M\")\n    where \"lift_lens_mem \\<equiv> lift_lens MEM_ERROR\"\n\n  abbreviation lift_lens_uninit (\"'(_')\\<^sub>U\")\n    where \"lift_lens_uninit \\<equiv> lift_lens UNINIT_ERROR\"\n\n  datatype 'v memory = MEM (mem: \"'v option list\")\n  hide_const (open) mem\n  define_lenses memory\n\n  abbreviation \"memL \\<equiv> (mem\\<^sub>L)\\<^sub>S\"\n  abbreviation \"idxL i \\<equiv> (idx\\<^sub>L i)\\<^sub>M\"\n\n  datatype block_addr = BLOCK_ADDR (the_block: nat)\n\n  definition \"mem_empty \\<equiv> MEM []\"\n\n  definition \"block_allocate v \\<equiv> (doM {\n    \\<mu>\\<leftarrow>use memL;\n    memL %= (\\<lambda>\\<mu>. \\<mu>@[Some v]);\n    return (BLOCK_ADDR (length \\<mu>))\n  })\"\n\n  definition \"block_free b \\<equiv> doM {\n    let L = memL \\<bullet> idxL (the_block b);\n    b\\<leftarrow>use L;\n    fcheck MEM_ERROR (b\\<noteq>None);\n    L := None\n  }\"\n\n  definition \"blockL b \\<equiv> memL \\<bullet> (idx\\<^sub>L (the_block b))\\<^sub>S \\<bullet> (the\\<^sub>L)\\<^sub>M\"\n\n  \n\n  datatype va_item = VA_ARRAY_IDX (aidx: nat) | VA_FIELD_IDX (fidx: nat)\n  hide_const (open) aidx fidx\n  define_lenses (open) va_item\n\n  type_synonym vaddr = \"va_item list\"\n\n  datatype addr = ADDR (block_addr: block_addr) (vaddr: vaddr)\n  hide_const (open) block_addr vaddr\n  define_lenses (open) addr\n\n  datatype val =\n    VINT (lint: \"nat + lint\")   \\<comment> \\<open>\\<open>width + lint\\<close>\\<close>\n  | VPTR (addr: \"addr option option\")\n  | VARRAY (items: \"val list\")\n  | VSTRUCT (fields: \"val list\")\n\n  hide_const (open) lint addr items fields\n  define_lenses (open) val\n\n  fun wpi_width where\n    \"wpi_width (Inl w) = w\"\n  | \"wpi_width (Inr i) = width i\"\n  \n\n  fun same_struct :: \"val \\<Rightarrow> val \\<Rightarrow> bool\" where\n    \"same_struct (VINT a) (VINT b) \\<longleftrightarrow> wpi_width a = wpi_width b\"\n  | \"same_struct (VPTR _) (VPTR _) \\<longleftrightarrow> True\"\n  | \"same_struct (VARRAY xs) (VARRAY ys) \\<longleftrightarrow> list_all2 same_struct xs ys\"\n  | \"same_struct (VSTRUCT xs) (VSTRUCT ys) \\<longleftrightarrow> list_all2 same_struct xs ys\"\n  | \"same_struct _ _ \\<longleftrightarrow> False\"\n\n  lemma same_struct_refl[simp]: \"same_struct v v\"\n    apply (induction v)\n    apply (auto simp: list.rel_refl_strong)\n    done\n\n  lemma same_struct_sym: \"same_struct a b \\<Longrightarrow> same_struct b a\"\n    apply (induction a b rule: same_struct.induct)\n    apply (auto simp: list_all2_conv_all_nth)\n    done\n\n  lemma same_struct_trans[trans]: \"same_struct a b \\<Longrightarrow> same_struct b c \\<Longrightarrow> same_struct a c\"\n    apply (induction a b arbitrary: c rule: same_struct.induct)\n    apply simp_all\n    apply (case_tac c; auto simp: list_all2_conv_all_nth in_set_conv_nth; blast)+\n    done\n\n\n  datatype (discs_sels) type =\n    TINT nat | TPTR type | TARRAY nat type | TSTRUCT \"type list\"\n\n\n  datatype memT = MEM_TYPE (memT: \"type option list\")\n  hide_const (open) memT\n\n  fun vaddr_of_type :: \"type \\<Rightarrow> vaddr \\<Rightarrow> type \\<Rightarrow> bool\" where\n    \"vaddr_of_type bT [] T \\<longleftrightarrow> T=bT\"\n  | \"vaddr_of_type (TARRAY n bT) (VA_ARRAY_IDX i#as) T \\<longleftrightarrow> \\<^cancel>\\<open>*i<n \\<and> \\<close> vaddr_of_type bT as T\"\n  | \"vaddr_of_type (TSTRUCT bTs) (VA_FIELD_IDX i#as) T \\<longleftrightarrow> i<length bTs \\<and> vaddr_of_type (bTs!i) as T\"\n  | \"vaddr_of_type _ _ _ \\<longleftrightarrow> False\"\n\n  context fixes \\<mu>T :: memT begin\n\n    definition addr_of_type where\n      \"addr_of_type a T \\<equiv>\n        let\n          b = the_block (addr.block_addr a);\n          \\<mu>T = memT.memT \\<mu>T\n        in\n          if b < length \\<mu>T then\n            case \\<mu>T!b of\n              None \\<Rightarrow> True\n            | Some bT \\<Rightarrow> vaddr_of_type bT (addr.vaddr a) T\n          else False\"\n\n    fun of_type :: \"type \\<Rightarrow> val \\<Rightarrow> bool\"\n    where\n      \"of_type (TINT w) (VINT v) \\<longleftrightarrow> w = wpi_width v\"\n    | \"of_type (TPTR T) (VPTR (Some (Some a))) \\<longleftrightarrow> addr_of_type a T\"\n    | \"of_type (TPTR T) (VPTR _) \\<longleftrightarrow> True\"\n    | \"of_type (TARRAY n T) (VARRAY vs) \\<longleftrightarrow> n=length vs \\<and> (\\<forall>v\\<in>List.set vs. of_type T v)\"\n    | \"of_type (TSTRUCT Ts) (VSTRUCT vs) \\<longleftrightarrow> list_all2 of_type Ts vs\"\n    | \"of_type _ _ \\<longleftrightarrow> False\"\n\n  end\n\n  definition mem_of_type :: \"memT \\<Rightarrow> val memory \\<Rightarrow> bool\"\n    where \"mem_of_type \\<mu>T \\<mu> \\<equiv> list_all2 (rel_option (of_type \\<mu>T)) (memT.memT \\<mu>T) (get' mem\\<^sub>L \\<mu>)\"\n\n  lemma mem_of_type_lengthD:\n    \"mem_of_type \\<mu>T \\<mu> \\<Longrightarrow> length (memT.memT \\<mu>T) = length (get' mem\\<^sub>L \\<mu>)\"\n    \"mem_of_type (MEM_TYPE Ts) \\<mu> \\<Longrightarrow> length (Ts) = length (get' mem\\<^sub>L \\<mu>)\"\n    by (auto simp: mem_of_type_def list_all2_lengthD)\n\n\n\n  definition \"struct_field\\<^sub>L i \\<equiv> (val.fields\\<^sub>L \\<bullet>\\<^sub>L idx\\<^sub>L i)\\<^sub>S\"\n  (*definition \"static_array_item\\<^sub>L i \\<equiv> (val.items\\<^sub>L \\<bullet>\\<^sub>L idx\\<^sub>L i)\\<^sub>S\"*)\n  definition \"array_item\\<^sub>L i \\<equiv> (val.items\\<^sub>L)\\<^sub>S \\<bullet> idxL i\"\n\n  fun lens_of_vai where\n    \"lens_of_vai (VA_ARRAY_IDX i) = array_item\\<^sub>L i\"\n  | \"lens_of_vai (VA_FIELD_IDX i) = struct_field\\<^sub>L i\"\n\n  definition \"lens_of_vaddr va \\<equiv> foldr (\\<lambda>vai p. lens_of_vai vai \\<bullet> p) va (id\\<^sub>L)\\<^sub>S\"\n\n  fun lens_of_addr where\n    \"lens_of_addr (ADDR b va) = blockL b \\<bullet> lens_of_vaddr va\"\n\n\n(*\n  definition op_get_field where\n    \"op_get_field v i \\<equiv> mget (struct_field\\<^sub>L i) v\"\n  definition op_put_field where\n    \"op_put_field v i v' \\<equiv> mput (struct_field\\<^sub>L i) v' v\"\n\n  definition op_get_array_item where\n    \"op_get_array_item v i \\<equiv> mget (array_item\\<^sub>L i) v\"\n  definition op_put_array_item where\n    \"op_put_array_item v i v' \\<equiv> mput (array_item\\<^sub>L i) v' v\"\n*)\n  (*\n  definition op_ptr_field where\n    \"op_ptr_field p i \\<equiv> p \\<bullet> (struct_field\\<^sub>L i)\"\n  definition op_ptr_array_item where\n    \"op_ptr_array_item p i \\<equiv> p \\<bullet> array_item\\<^sub>L i\"\n  *)\n\n\n  datatype label_name = LABEL_NAME (the_name: string)\n  hide_const (open) the_name\n  datatype proc_name = PROC_NAME (the_name: string)\n  hide_const (open) the_name\n  datatype lvar_name = LVAR_NAME (the_name: string)\n  hide_const (open) the_name\n\n  datatype operand = OP_ICONST int | OP_LVAR lvar_name\n\n  datatype icmp_code = EQ | NE | SLE | SLT | ULE | ULT\n  hide_const (open) EQ NE SLE SLT ULE ULT\n\n\n  datatype basic_instr_aux =\n    ADD type operand operand\n  | SUB type operand operand\n  | MUL type operand operand\n  | UDIV type operand operand\n  | UREM type operand operand\n  | SDIV type operand operand\n  | SREM type operand operand\n  | AND type operand operand\n  | OR type operand operand\n  | XOR type operand operand\n  | SHL type operand operand\n  | ASHR type operand operand\n  | LSHR type operand operand\n  | TRUNC_TO type operand type\n  | ZEXT_TO type operand type\n  | SEXT_TO type operand type\n  | ICMP icmp_code type operand operand\n  | ALLOCA type type operand\n  | MALLOC type type operand\n  | LOAD type type operand\n  | STORE type operand type operand\n  | FREE type operand\n  | INSERT_A_VALUE type operand type operand nat\n  | INSERT_S_VALUE type operand type operand nat\n  | EXTRACT_A_VALUE type operand nat\n  | EXTRACT_S_VALUE type operand nat\n  | OFS_PTR type operand type operand  \\<comment> \\<open>\\<open>getelementptr ty, ty* ptr, ty i \\<close>\\<close>\n  | INDEX_A_PTR type operand type operand \\<comment> \\<open>\\<open>getelementptr ty, ty* ptr, i32 0, ty i \\<close>\\<close>\n  | INDEX_S_PTR type operand nat \\<comment> \\<open>\\<open>getelementptr ty, ty* ptr, i32 0, ty i \\<close>\\<close>\n\n  datatype nt_instr_aux =\n    BASIC basic_instr_aux\n  | CALL type proc_name \"(type \\<times> operand) list\"\n\n  datatype nt_instr = NT_INSTR \"lvar_name option\" nt_instr_aux\n\n\n  datatype t_instr =\n    RETURN type operand\n  | RETURN_VOID\n  | BR label_name\n  | CBR type operand label_name label_name\n\n  datatype basic_block = BBLOCK \"nt_instr list\" t_instr\n\n  datatype procedure = PROC\n    (params: \"(type \\<times> lvar_name) list\")\n    (prologue: basic_block)\n    (blocks: \"(label_name\\<times>basic_block) list\")\n    (rtype: \"type option\")\n  hide_const (open) params prologue blocks rtype\n\n  datatype program = PROG (procedures: \"(proc_name \\<times> procedure) list\")\n  hide_const (open) procedures\n\n\n  datatype exec_state = EXEC_STATE\n    (lvars: \"lvar_name \\<rightharpoonup> val\")\n    (local_blocks: \"block_addr list\")\n    (memory: \"val memory\")\n  hide_const (open) lvars local_blocks memory\n  define_lenses (open) exec_state\n\n  (*\n  lemma exec_state_l_indep[simp]: \n    \"exec_state.lvars\\<^sub>L \\<bowtie> exec_state.memory\\<^sub>L\"\n    \"exec_state.lvars\\<^sub>L \\<bowtie> exec_state.local_blocks\\<^sub>L\"\n    \"exec_state.local_blocks\\<^sub>L \\<bowtie> exec_state.memory\\<^sub>L\"\n    apply unfold_locales\n    unfolding exec_state.lvars\\<^sub>L_def exec_state.memory\\<^sub>L_def exec_state.local_blocks\\<^sub>L_def\n    find_theorems \"\\<not>True \\<longleftrightarrow> False\"\n    apply (simp only: LENS_downstage option.sel exec_state.simps option.simps HOL.simp_thms split: exec_state.splits | intro allI impI conjI)+\n  *)\n  \n\n\n  definition \"lvar\\<^sub>L x \\<equiv> (exec_state.lvars\\<^sub>L \\<bullet>\\<^sub>L fun\\<^sub>L x \\<bullet>\\<^sub>L the\\<^sub>L)\\<^sub>S\"\n\n  fun load_opr where\n    \"load_opr ty (OP_ICONST i) = (\n      case ty of\n        TINT w \\<Rightarrow> doM {\n          fcheck (STATIC_ERROR ''i0 type'') (w\\<noteq>0); \\<^cancel>\\<open>TODO: How does LLVM handle overflow? The same way as lconst? \\<close>\n          return (VINT (Inr (lconst w i)))\n        }\n      | _ \\<Rightarrow> fail (STATIC_ERROR ''int const with non-int type''))\"\n  | \"load_opr _ (OP_LVAR x) = use (lvar\\<^sub>L x)\" \\<comment> \\<open>We omit a type check here\\<close>\n\n\n  definition to_ptr where\n    \"to_ptr v \\<equiv> case (v) of\n        (VPTR (Some p)) \\<Rightarrow> return p\n      | (VPTR None) \\<Rightarrow> fail UNINIT_ERROR\n      | _ \\<Rightarrow> fail (STATIC_ERROR ''to_ptr'')\"\n\n  definition to_addr where\n    \"to_addr v \\<equiv> case (v) of\n        (VPTR (Some (Some p))) \\<Rightarrow> return p\n      | (VPTR (Some None)) \\<Rightarrow> fail MEM_ERROR\n      | (VPTR None) \\<Rightarrow> fail UNINIT_ERROR\n      | _ \\<Rightarrow> fail (STATIC_ERROR ''to_addr'')\"\n\n  definition to_int where\n    \"to_int v \\<equiv> case (v) of\n        (VINT (Inr i)) \\<Rightarrow> return i\n      | (VINT (Inl _)) \\<Rightarrow> fail UNINIT_ERROR\n      | _ \\<Rightarrow> fail (STATIC_ERROR ''to_int'')\"\n\n  definition to_bool where\n    \"to_bool v \\<equiv> case (v) of\n        (VINT v) \\<Rightarrow> doM {\n          fcheck (STATIC_ERROR ''to_bool'') (wpi_width v = 1);\n          case v of\n            Inl _ \\<Rightarrow> fail UNINIT_ERROR\n          | Inr i \\<Rightarrow> return (lint_to_bool i)\n        }\n      | _ \\<Rightarrow> fail (STATIC_ERROR ''to_bool'')\"\n\n  definition \"to_idx i \\<equiv> doM {fcheck MEM_ERROR (i\\<ge>0); return (nat i)}\"\n\n  definition load_int where\n    \"load_int ty opr \\<equiv> doM {\n      v \\<leftarrow> load_opr ty opr;\n      to_int v\n    }\"\n\n  definition load_ptr where\n    \"load_ptr ty opr \\<equiv> doM {\n      v \\<leftarrow> load_opr ty opr;\n      to_ptr v\n    }\"\n\n  definition load_addr where\n    \"load_addr ty opr \\<equiv> doM {\n      v \\<leftarrow> load_opr ty opr;\n      to_addr v\n    }\"\n\n  definition load_bool where\n    \"load_bool ty opr \\<equiv> doM {\n      v \\<leftarrow> load_opr ty opr;\n      to_bool v\n    }\"\n\n\n  definition define_lvar where\n    \"define_lvar name val \\<equiv> zoom (exec_state.lvars\\<^sub>L)\\<^sub>S (doM {\n      l\\<leftarrow>get;\n      fcheck (STATIC_ERROR ''lvar redefined'') (name \\<notin> dom l);\n      let l = l(name\\<mapsto>val);\n      set l\n    })\"\n\n\n  fun uninit where\n    \"uninit (TINT w) = VINT (Inl w)\"\n  | \"uninit (TPTR _) = VPTR None\"\n  | \"uninit (TARRAY n ty) = VARRAY (replicate n (uninit ty))\"\n  | \"uninit (TSTRUCT tys) = VSTRUCT (map uninit tys)\"\n\n\ndefinition \"noexcept m \\<equiv> handle m (\\<lambda>_. fail (STATIC_ERROR ''noexcept''))\"\nlemma noexcept_mono[partial_function_mono]:\n  \"monotone M.le_fun M_ord m \\<Longrightarrow> monotone M.le_fun M_ord (\\<lambda>f. noexcept (m f))\"\n  unfolding noexcept_def\n  by pf_mono_prover\n\n\nfun lint_icmp where\n  \"lint_icmp icmp_code.EQ a b \\<longleftrightarrow>  (a = b)\"\n| \"lint_icmp icmp_code.NE a b \\<longleftrightarrow>  (a \\<noteq> b)\"\n| \"lint_icmp icmp_code.SLE a b \\<longleftrightarrow> (a \\<le> b)\"\n| \"lint_icmp icmp_code.SLT a b \\<longleftrightarrow> (a < b)\"\n| \"lint_icmp icmp_code.ULE a b \\<longleftrightarrow> (a \\<le>\\<^sub>s b)\"\n| \"lint_icmp icmp_code.ULT a b \\<longleftrightarrow> (a <\\<^sub>s b)\"\n\n\ndefinition \"instr_alloca ty n = doM {\n  fcheck MEM_ERROR (n>0);\n  let n = nat n;\n  let v = uninit (TARRAY n ty);\n  r \\<leftarrow> zoom (exec_state.memory\\<^sub>L)\\<^sub>S (block_allocate v);\n  (exec_state.local_blocks\\<^sub>L)\\<^sub>S %= (#) r;\n  return (ADDR r [VA_ARRAY_IDX 0])\n}\"\n\ndefinition \"instr_malloc ty n = doM {\n  fcheck MEM_ERROR (n>0);\n  let n = nat n;\n  let v = uninit (TARRAY n ty);\n  r \\<leftarrow> zoom (exec_state.memory\\<^sub>L)\\<^sub>S (block_allocate v);\n  return (ADDR r [VA_ARRAY_IDX 0])\n}\"\n\ndefinition \"instr_free addr = doM {\n  case addr of\n      ADDR b [VA_ARRAY_IDX 0] \\<Rightarrow> zoom (exec_state.memory\\<^sub>L)\\<^sub>S (block_free b)\n    | _ \\<Rightarrow> fail MEM_ERROR\n}\"\n\ndefinition instr_load where\n  \"instr_load addr \\<equiv> doM {\n    zoom (exec_state.memory\\<^sub>L)\\<^sub>S (use (lens_of_addr addr))\n  }\"\n\ndefinition instr_store where\n  \"instr_store v addr \\<equiv> doM {\n    zoom (exec_state.memory\\<^sub>L)\\<^sub>S (doM {\n      ov \\<leftarrow> use (lens_of_addr addr);\n      fcheck (STATIC_ERROR ''mem-struct change'') (same_struct v ov);\n      lens_of_addr addr := v\n    })\n  }\"\n\ndefinition \"put_same_struct L a b \\<equiv> doM {\n  v \\<leftarrow> mget L b;\n  fcheck (STATIC_ERROR ''val-struct change'') (same_struct a v);\n  mput L a b\n}\"\n\n\ndefinition \"instr_insert_a_value bv ev idx \\<equiv> put_same_struct (array_item\\<^sub>L idx) ev bv\"\ndefinition \"instr_insert_s_value bv ev idx \\<equiv> put_same_struct (struct_field\\<^sub>L idx) ev bv\"\ndefinition \"instr_extract_a_value bv idx \\<equiv> mget (array_item\\<^sub>L idx) bv\"\ndefinition \"instr_extract_s_value bv idx \\<equiv> mget (struct_field\\<^sub>L idx) bv\"\n\ndefinition instr_ofs_addr :: \"addr \\<Rightarrow> int \\<Rightarrow> _\" where\n  \"instr_ofs_addr a i \\<equiv> map_lens (addr.vaddr\\<^sub>L\\<bullet>\\<^sub>Llast\\<^sub>L\\<bullet>\\<^sub>Lva_item.aidx\\<^sub>L)\\<^sub>M (\\<lambda>idx. doM {\n    let idx = int idx + i;\n    fcheck MEM_ERROR (idx\\<ge>0);\n    return (nat idx)\n  }) a\"\n\ndefinition instr_idx_array :: \"addr \\<Rightarrow> int \\<Rightarrow> _\" where\n  \"instr_idx_array a i \\<equiv> map_lens (addr.vaddr\\<^sub>L)\\<^sub>S (\\<lambda>x. doM {\n    i \\<leftarrow> to_idx i;\n    return (x@[VA_ARRAY_IDX i])\n  } ) a\"\n\ndefinition instr_idx_field :: \"addr \\<Rightarrow> nat \\<Rightarrow> _\" where\n  \"instr_idx_field a i \\<equiv> map_lens (addr.vaddr\\<^sub>L)\\<^sub>S (\\<lambda>x. doM {\n    return (x@[VA_FIELD_IDX i])\n  } ) a\"\n\n\ndefinition \"instr_arith2 ovf f ty op1 op2 = doM {\n  x1 \\<leftarrow> load_int ty op1;\n  x2 \\<leftarrow> load_int ty op2;\n  fcheck (STATIC_ERROR ''arith2 incompatible widths'') (width x1 = width x2);\n  fcheck (OVERFLOW_ERROR) (\\<not>ovf x1 x2);\n  return (Some (VINT (Inr (f x1 x2))))\n}\"\n\nabbreviation \"instr_arith2' \\<equiv> instr_arith2 (\\<lambda>_ _. False)\"\n\n\n\ndefinition \"instr_arith_cmp f ty op1 op2 = doM {\n  x1 \\<leftarrow> load_int ty op1;\n  x2 \\<leftarrow> load_int ty op2;\n  fcheck (STATIC_ERROR ''arith2cmp incompatible widths'') (width x1 = width x2);\n  return (Some (VINT (Inr (bool_to_lint (f x1 x2)))))\n}\"\n\n\ndefinition \"instr_trunc ty op1 ty' = doM {\n  x \\<leftarrow> load_int ty op1;\n  case ty' of\n    TINT w \\<Rightarrow> doM {\n      fcheck (STATIC_ERROR ''Trunc must go to smaller type'') (width x > w);\n      return (Some (VINT (Inr (trunc w x))))\n    }\n  | _ \\<Rightarrow> fail (STATIC_ERROR ''Non-integer type as target for trunc'')\n}\"\n\ndefinition \"instr_ext f ty op1 ty' = doM {\n  x \\<leftarrow> load_int ty op1;\n  case ty' of\n    TINT w \\<Rightarrow> doM {\n      fcheck (STATIC_ERROR ''ext must go to greater type'') (width x < w);\n      return (Some (VINT (Inr (f w x))))\n    }\n  | _ \\<Rightarrow> fail (STATIC_ERROR ''Non-integer type as target for ext'')\n}\"\n\n\n\ndefinition \"shift_ovf a n \\<equiv> nat (lint_to_uint n) \\<ge> width a\"\n\ndefinition \"bitSHL' a n \\<equiv> bitSHL a (nat (lint_to_uint n))\"\ndefinition \"bitASHR' a n \\<equiv> bitASHR a (nat (lint_to_uint n))\"\ndefinition \"bitLSHR' a n \\<equiv> bitLSHR a (nat (lint_to_uint n))\"\n\ncontext\n  fixes exec_proc_name :: \"proc_name \\<times> val list \\<Rightarrow> (val option,unit,val memory,err) M\"\nbegin\n\n  primrec exec_basic_instr_aux where\n    \"exec_basic_instr_aux (ADD ty op1 op2) = instr_arith2' (+) ty op1 op2\"\n  | \"exec_basic_instr_aux (SUB ty op1 op2) = instr_arith2' (-) ty op1 op2\"\n  | \"exec_basic_instr_aux (MUL ty op1 op2) = instr_arith2' ( * ) ty op1 op2\"\n  | \"exec_basic_instr_aux (UDIV ty op1 op2) = instr_arith2' (div) ty op1 op2\"\n  | \"exec_basic_instr_aux (UREM ty op1 op2) = instr_arith2' (mod) ty op1 op2\"\n  | \"exec_basic_instr_aux (SDIV ty op1 op2) = instr_arith2 (sdivrem_ovf) (div\\<^sub>s) ty op1 op2\"\n  | \"exec_basic_instr_aux (SREM ty op1 op2) = instr_arith2 (sdivrem_ovf) (rem\\<^sub>s) ty op1 op2\"\n  | \"exec_basic_instr_aux (SHL ty op1 op2) = instr_arith2 (shift_ovf) bitSHL' ty op1 op2\"\n  | \"exec_basic_instr_aux (LSHR ty op1 op2) = instr_arith2 (shift_ovf) bitLSHR' ty op1 op2\"\n  | \"exec_basic_instr_aux (ASHR ty op1 op2) = instr_arith2 (shift_ovf) bitASHR' ty op1 op2\"\n  | \"exec_basic_instr_aux (ICMP code ty op1 op2) = instr_arith_cmp (lint_icmp code) ty op1 op2\"\n\n  | \"exec_basic_instr_aux (TRUNC_TO ty op1 ty') = instr_trunc ty op1 ty'\"\n  | \"exec_basic_instr_aux (ZEXT_TO ty op1 ty') = instr_ext zext ty op1 ty'\"\n  | \"exec_basic_instr_aux (SEXT_TO ty op1 ty') = instr_ext sext ty op1 ty'\"\n\n  | \"exec_basic_instr_aux (basic_instr_aux.AND ty op1 op2) = instr_arith2' (AND) ty op1 op2\"\n  | \"exec_basic_instr_aux (basic_instr_aux.OR ty op1 op2) = instr_arith2' (OR) ty op1 op2\"\n  | \"exec_basic_instr_aux (basic_instr_aux.XOR ty op1 op2) = instr_arith2' (XOR) ty op1 op2\"\n  | \"exec_basic_instr_aux (ALLOCA ty tyi opr) = doM {\n      n \\<leftarrow> load_int tyi opr;\n      addr \\<leftarrow> instr_alloca ty (lint_to_uint n);\n      return (Some (VPTR (Some (Some addr))))\n    }\"\n  | \"exec_basic_instr_aux (MALLOC ty tyi opr) = doM {\n      n \\<leftarrow> load_int tyi opr;\n      addr \\<leftarrow> instr_malloc ty (lint_to_uint n);\n      return (Some (VPTR (Some (Some addr))))\n    }\"\n  | \"exec_basic_instr_aux (FREE ty opr) = doM {\n      addr \\<leftarrow> load_addr ty opr;\n      instr_free addr;\n      return None\n    }\"\n  | \"exec_basic_instr_aux (LOAD ty typ opr) = doM {\n      addr \\<leftarrow> load_addr typ opr;\n      r \\<leftarrow> instr_load addr;\n      return (Some r)\n    }\"\n  | \"exec_basic_instr_aux (STORE tyv oprv typ oprp) = doM {\n      v \\<leftarrow> load_opr tyv oprv;\n      addr \\<leftarrow> load_addr typ oprp;\n      instr_store v addr;\n      return None\n    }\"\n  | \"exec_basic_instr_aux (INSERT_A_VALUE bty bopr ety eopr idx) = doM {\n      bv \\<leftarrow> load_opr bty bopr;\n      ev \\<leftarrow> load_opr ety eopr;\n      r \\<leftarrow> instr_insert_a_value bv ev idx;\n      return (Some r)\n    }\"\n  | \"exec_basic_instr_aux (INSERT_S_VALUE bty bopr ety eopr idx) = doM {\n      bv \\<leftarrow> load_opr bty bopr;\n      ev \\<leftarrow> load_opr ety eopr;\n      r \\<leftarrow> instr_insert_s_value bv ev idx;\n      return (Some r)\n    }\"\n  | \"exec_basic_instr_aux (EXTRACT_A_VALUE bty bopr idx) = doM {\n      bv \\<leftarrow> load_opr bty bopr;\n      r \\<leftarrow> instr_extract_a_value bv idx;\n      return (Some r)\n    }\"\n  | \"exec_basic_instr_aux (EXTRACT_S_VALUE bty bopr idx) = doM {\n      bv \\<leftarrow> load_opr bty bopr;\n      r \\<leftarrow> instr_extract_s_value bv idx;\n      return (Some r)\n    }\"\n  | \"exec_basic_instr_aux (OFS_PTR bty bopr ity iopr) = doM {\n      addr \\<leftarrow> load_addr bty bopr;\n      idx \\<leftarrow> load_int ity iopr;\n      r \\<leftarrow> instr_ofs_addr addr (lint_to_sint idx);\n      return (Some ((VPTR (Some (Some r)))))\n    }\"\n  | \"exec_basic_instr_aux (INDEX_A_PTR bty bopr ity iopr) = doM {\n      addr \\<leftarrow> load_addr bty bopr;\n      idx \\<leftarrow> load_int ity iopr;\n      r \\<leftarrow> instr_idx_array addr (lint_to_uint idx);\n      return (Some ((VPTR (Some (Some r)))))\n    }\"\n  | \"exec_basic_instr_aux (INDEX_S_PTR bty bopr idx) = doM {\n      addr \\<leftarrow> load_addr bty bopr;\n      r \\<leftarrow> instr_idx_field addr idx;\n      return (Some ((VPTR (Some (Some r)))))\n    }\"\n\n  primrec exec_nt_instr_aux where\n    \"exec_nt_instr_aux (BASIC i) = exec_basic_instr_aux i\"\n  | \"exec_nt_instr_aux (CALL ty name args) = doM {\n      argvs \\<leftarrow> mmap (uncurry load_opr) args;\n      r \\<leftarrow> zoom (exec_state.memory\\<^sub>L)\\<^sub>S (noexcept (exec_proc_name (name, argvs)));\n      return r\n    }\"\n\n  primrec exec_nt_instr where\n    \"exec_nt_instr (NT_INSTR resname i) = doM {\n      r \\<leftarrow> exec_nt_instr_aux i;\n      case resname of\n        None \\<Rightarrow> return ()\n      | Some resvar \\<Rightarrow> doM {\n        r \\<leftarrow> mget (the\\<^sub>L)\\<^sub>S r;\n        define_lvar resvar r\n      }\n    }\"\n\n  primrec exec_t_instr where\n    \"exec_t_instr (RETURN_VOID) = raise None\"\n  | \"exec_t_instr (RETURN ty opr) = doM { v \\<leftarrow> load_opr ty opr; raise (Some v) }\"\n  | \"exec_t_instr (BR label) = return label\"\n  | \"exec_t_instr (CBR ty opr lt lf) = doM {\n      v \\<leftarrow> load_bool ty opr;\n      if v then return lt else return lf\n  }\"\n\n  definition \"exec_block \\<equiv> \\<lambda>BBLOCK ntis ti\\<Rightarrow> doM {\n    \\<comment> \\<open>Execute nonterminal instructions\\<close>\n    mfold' exec_nt_instr ntis;\n    \\<comment> \\<open>Execute terminal instruction\\<close>\n    exec_t_instr ti\n  }\"\n\n  term mmblock\n\n  definition \"exec_block_reset block \\<equiv> doM {\n    \\<comment> \\<open>Save local definitions\\<close>\n    saved_lvars \\<leftarrow> use (exec_state.lvars\\<^sub>L)\\<^sub>S;\n\n    mmblock (get) (\\<lambda>s'. doM {set s'; (exec_state.lvars\\<^sub>L)\\<^sub>S := saved_lvars}) (exec_block block)\n  }\"\n\n  definition \"mk_fresh_exec_state mem \\<equiv> EXEC_STATE Map.empty [] mem\"\n\n  definition \"exec_proc \\<equiv> \\<lambda>PROC params prologue blocks rtype \\<Rightarrow> \\<lambda>args. doM {\n    fcheck (STATIC_ERROR ''|arg| != |param|'') (length params = length args);\n    mblock (mk_fresh_exec_state) (get' exec_state.memory\\<^sub>L) (doM {\n      \\<comment> \\<open>Define Parameters\\<close>\n      mfold' (uncurry define_lvar) (zip (map snd params) args);\n\n      handle (doM {\n        \\<comment> \\<open>Execute Prologue\\<close>\n        label \\<leftarrow> exec_block prologue;\n\n        \\<comment> \\<open>Execute Blocks\\<close>\n        let block_map = map_of blocks;\n        mwhile (\\<lambda>_. return True) (\\<lambda>label. doM {\n          \\<comment> \\<open>Lookup label\\<close>\n          block \\<leftarrow> lookup (STATIC_ERROR ''undef label'') block_map label;\n          exec_block_reset block\n        }) label;\n\n        fail (STATIC_ERROR ''unreachable'') \\<comment> \\<open>Unreachable\\<close>\n      }) (\\<lambda>r. doM {\n        \\<comment> \\<open>Free alloca-blocks\\<close>\n        lbs \\<leftarrow> use (exec_state.local_blocks\\<^sub>L)\\<^sub>S;\n        mfold' (\\<lambda>b. zoom (exec_state.memory\\<^sub>L)\\<^sub>S (block_free b)) lbs;\n        \\<comment> \\<open>Return result\\<close>\n        return r})\n    })\n  }\"\n\n\nend (* Context fixing \\<open>exec_proc_name\\<close> *)\n\nterm exec_proc\n\ncontext fixes \\<pi> :: program begin\n  definition \"proc_map \\<equiv> map_of (program.procedures \\<pi>)\"\n\n  definition \"exec_proc_name \\<equiv>\n    REC (\\<lambda>exec_proc_name (name,args). doM {\n      proc \\<leftarrow> lookup (STATIC_ERROR ''undef proc'') proc_map name;\n      exec_proc exec_proc_name proc args\n    }) \"\n\nend\n\nterm exec_proc\n\nlemma rec_cases_instr_eq:\n  \"rec_nt_instr = case_nt_instr\"\n  \"rec_nt_instr_aux = case_nt_instr_aux\"\n  by (intro ext; auto split: nt_instr.split nt_instr_aux.split; fail)+\n\n\nthm partial_function_mono(10)\n\nlemma execute_proc_body_mono[partial_function_mono]:\n  \"M.mono_body (\\<lambda>fa. exec_proc fa proc args)\"\n  unfolding exec_proc_def exec_block_def exec_nt_instr_def exec_nt_instr_aux_def\n    exec_block_reset_def\n  unfolding rec_cases_instr_eq\n  by pf_mono_prover\n\n\n(*lemmas exec_proc_name_unfold[code] = REC_unfold[OF exec_proc_name_def, discharge_monos]*)\n\nlemmas exec_proc_name_unfold[code] = REC_unfold[OF exec_proc_name_def, discharge_monos]\n   and exec_proc_name_partial = lrmwpe_REC_partial[OF exec_proc_name_def, discharge_monos, consumes 1, case_names nterm step]\n   and exec_proc_name_total = lrmwpe_REC_total[OF exec_proc_name_def, discharge_monos, consumes 1, case_names wf step]\n\n\nterm mwhile\nterm exec_proc_name\n\ndefinition \"foo a b \\<equiv> (a::lint) = b\"\n\n\ndefinition \"test \\<equiv> PROG [(PROC_NAME ''main'',PROC [] (\n  BBLOCK [\n    NT_INSTR (Some (LVAR_NAME ''p'')) (BASIC (MALLOC (TINT 32) (TINT 32) (OP_ICONST 5)))\n    ,\n    NT_INSTR (Some (LVAR_NAME ''p2'')) (BASIC (OFS_PTR (TPTR (TINT 32)) (OP_LVAR (LVAR_NAME ''p'')) (TINT 32) (OP_ICONST 2)))\n    ,\n    NT_INSTR None (BASIC (STORE (TINT 32) (OP_ICONST 42) (TPTR (TINT 32)) (OP_LVAR (LVAR_NAME ''p2''))))\n\n  ] (RETURN (TPTR (TINT 32)) (OP_LVAR (LVAR_NAME ''p'')))\n) [] (Some (TPTR (TINT 32))))]\"\n\nvalue \"run (exec_proc_name test (PROC_NAME ''main'',[])) (MEM [])\"\n\n\n\nabbreviation \"no_static_err e \\<equiv> \\<not>err.is_static e\"\n\nlemma fold_elens[simp]:\n  \"\\<lbrakk>elens L; \\<And>x. x\\<in>list.set xs \\<Longrightarrow> elens (f x)\\<rbrakk> \\<Longrightarrow> elens (fold (\\<lambda>x p. p \\<bullet> f x) xs L)\"\n  by (induction xs arbitrary: L) auto\n\nlemma foldr_elens[simp]:\n  \"\\<lbrakk>elens L; \\<And>x. x\\<in>list.set xs \\<Longrightarrow> elens (f x)\\<rbrakk> \\<Longrightarrow> elens (foldr (\\<lambda>x p. f x \\<bullet> p) xs L)\"\n  by (induction xs arbitrary: L) auto\n\n\nlemma [simp]: \"elens (array_item\\<^sub>L idx)\" by (auto simp: array_item\\<^sub>L_def)\nlemma [simp]: \"elens (struct_field\\<^sub>L idx)\" by (auto simp: struct_field\\<^sub>L_def)\n\nlemma [simp]: \"elens (lens_of_vai vai)\" by (cases vai) auto\n\nlemma [simp]: \"elens (lens_of_vaddr va)\" unfolding lens_of_vaddr_def by auto\n\n\nlemma [simp]: \"put' mem\\<^sub>L x s = MEM x\"\n  by (auto simp: mem\\<^sub>L_def split: memory.split)\n\nlemma blockL_pre_simp[simp]: \"epre_get (blockL b) \\<mu> = (\n  if \\<not> the_block b < length (get' mem\\<^sub>L \\<mu>) then\n    Some (STATIC_ERROR ''lens'')\n  else if (get' mem\\<^sub>L \\<mu>)!the_block b = None then\n    Some MEM_ERROR\n  else\n    None\n)\"\n  unfolding blockL_def\n  by (auto split: option.split)\n\nlemma blockL_get_simp[simp]:\n  \"\\<lbrakk>the_block b < length (get' mem\\<^sub>L \\<mu>); (get' mem\\<^sub>L \\<mu>)!the_block b = Some v\\<rbrakk>\n    \\<Longrightarrow> eget' (blockL b) \\<mu> = v\"\n  unfolding blockL_def\n  by (auto split: option.split)\n\nlemma blockL_put_simp[simp]:\n  \"\\<lbrakk>the_block b < length (get' mem\\<^sub>L \\<mu>); (get' mem\\<^sub>L \\<mu>)!the_block b \\<noteq> None  \\<rbrakk>\n    \\<Longrightarrow> eput' (blockL b) v \\<mu> = MEM (get' mem\\<^sub>L \\<mu> [the_block b := Some v])\"\n  unfolding blockL_def\n  by (auto split: option.split)\n\n\nlemma lens_of_vaddr_Nil[simp]:\n  \"lens_of_vaddr [] = (id\\<^sub>L)\\<^sub>S\"\n  by (auto simp: lens_of_vaddr_def)\n\nlemma lens_of_vaddr_Cons[simp]:\n  \"lens_of_vaddr (va#vas) = lens_of_vai va \\<bullet> lens_of_vaddr vas\"\n  by (auto simp: lens_of_vaddr_def)\n\n\nlemma of_type_inv2[simp]:\n  \"of_type \\<mu>T (TARRAY n bT) bv \\<longleftrightarrow> (\\<exists>vs. bv = VARRAY vs \\<and> n = length vs \\<and> (\\<forall>v\\<in>list.set vs. of_type \\<mu>T bT v))\"\n  by (cases bv) auto\n\n\nlemma [simp]:\n  \"epre_get (array_item\\<^sub>L i) x = (case x of VARRAY vs \\<Rightarrow> if i<length vs then None else Some MEM_ERROR | _ \\<Rightarrow> Some (STATIC_ERROR ''lens''))\"\n  \"epre_put (array_item\\<^sub>L i) v x = epre_get (array_item\\<^sub>L i) x\"\n  \"i<length vs \\<Longrightarrow> eget' (array_item\\<^sub>L i) (VARRAY vs) = vs!i\"\n  \"i<length vs \\<Longrightarrow> eput' (array_item\\<^sub>L i) v (VARRAY vs) = VARRAY (vs[i:=v])\"\n  by (auto simp: array_item\\<^sub>L_def split: option.split val.splits)\n\nlemma [simp]:\n  \"epre_get (struct_field\\<^sub>L i) x = (case x of VSTRUCT vs \\<Rightarrow> if i<length vs then None else Some (STATIC_ERROR ''lens'') | _ \\<Rightarrow> Some (STATIC_ERROR ''lens''))\"\n  \"epre_put (struct_field\\<^sub>L i) v x = epre_get (struct_field\\<^sub>L i) x\"\n  \"i<length vs \\<Longrightarrow> eget' (struct_field\\<^sub>L i) (VSTRUCT vs) = vs!i\"\n  \"i<length vs \\<Longrightarrow> eput' (struct_field\\<^sub>L i) v (VSTRUCT vs) = VSTRUCT (vs[i:=v])\"\n  by (auto simp: struct_field\\<^sub>L_def split: option.split val.splits)\n\nlemma tyco_get_lens_of_vaddr_aux:\n  assumes \"of_type \\<mu>T bT bv\" \"vaddr_of_type bT p T\"\n  shows \"case epre_get (lens_of_vaddr p) bv of\n    None \\<Rightarrow> of_type \\<mu>T T (eget' (lens_of_vaddr p) bv)\n  | Some e \\<Rightarrow> \\<not>err.is_static e\n  \"\n  using assms\n  apply (induction bT p T arbitrary: bv rule: vaddr_of_type.induct)\n  apply (auto split: option.splits val.splits simp: Ball_def in_set_conv_nth list_all2_conv_all_nth)\n  apply force+\n  done\n\nlemma tyco_get_lens_of_vaddr:\n  assumes \"of_type \\<mu>T bT bv\" \"vaddr_of_type bT p T\"\n  shows \"epre_get (lens_of_vaddr p) bv = None \\<Longrightarrow> of_type \\<mu>T T (eget' (lens_of_vaddr p) bv)\"\n    and \"epre_get (lens_of_vaddr p) bv = Some e \\<Longrightarrow> \\<not>err.is_static e\"\n  using tyco_get_lens_of_vaddr_aux[OF assms] by (auto)\n\nlemma tyco_put_lens_of_vaddr_aux:\n  assumes \"of_type \\<mu>T bT bv\" \"vaddr_of_type bT p T\" \"of_type \\<mu>T T v\"\n  shows \"case epre_put (lens_of_vaddr p) v bv of\n      None \\<Rightarrow> of_type \\<mu>T bT (eput' (lens_of_vaddr p) v bv)\n    | Some e \\<Rightarrow> \\<not>err.is_static e\"\n  using assms\n  apply (induction bT p T arbitrary: bv rule: vaddr_of_type.induct)\n  apply (auto split: option.splits val.splits simp: Ball_def in_set_conv_nth list_all2_conv_all_nth nth_list_update)\n  apply force+\n  done\n\nlemma tyco_put_lens_of_vaddr:\n  assumes \"of_type \\<mu>T bT bv\" \"vaddr_of_type bT p T\" \"of_type \\<mu>T T v\"\n  shows \"epre_put (lens_of_vaddr p) v bv = None \\<Longrightarrow> of_type \\<mu>T bT (eput' (lens_of_vaddr p) v bv)\"\n    and \"epre_put (lens_of_vaddr p) v bv = Some e \\<Longrightarrow> \\<not>err.is_static e\"\n  using tyco_put_lens_of_vaddr_aux[OF assms] by (auto)\n\n\nlemma tyco_use_lens_of_addr:\n  assumes \"mem_of_type \\<mu>T \\<mu>\"\n  assumes \"addr_of_type \\<mu>T a T\"\n  shows \"mwp (run (use (lens_of_addr a)) \\<mu>) bot no_static_err bot (\\<lambda>v \\<mu>'. \\<mu>'=\\<mu> \\<and> of_type \\<mu>T T v)\"\n  using assms\n  apply (cases a)\n  apply (auto\n    simp: run_simps addr_of_type_def Let_def mem_of_type_def list_all2_conv_all_nth\n    simp: tyco_get_lens_of_vaddr\n    split: if_splits option.splits)\n  done\n\nlemma tyco_put_lens_of_addr:\n  assumes \"mem_of_type \\<mu>T \\<mu>\"\n  assumes \"addr_of_type \\<mu>T a T\"\n  assumes \"of_type \\<mu>T T v\"\n  shows \"mwp (run ((lens_of_addr a := v)) \\<mu>) bot no_static_err bot (\\<lambda>_ \\<mu>'. mem_of_type \\<mu>T \\<mu>')\"\n  using assms\n  apply (cases a)\n  apply (auto\n    simp: run_simps addr_of_type_def Let_def mem_of_type_def list_all2_conv_all_nth\n    simp: tyco_put_lens_of_vaddr nth_list_update\n    split: if_splits option.splits)\n  done\n\n\nterm \"allocate\"\n\nfun memT_le where \"memT_le (MEM_TYPE \\<mu>T) (MEM_TYPE \\<mu>T') \\<longleftrightarrow>\n  length \\<mu>T \\<le> length \\<mu>T' \\<and> (\\<forall>i<length \\<mu>T. \\<mu>T'!i = None \\<or> \\<mu>T'!i=\\<mu>T!i)\"\n\nlemma memT_le_refl[intro!,simp]: \"memT_le \\<mu>T \\<mu>T\"\n  by (cases \\<mu>T) auto\n\nlemma memT_le_trans[trans]: \"memT_le \\<mu>T\\<^sub>1 \\<mu>T\\<^sub>2 \\<Longrightarrow> memT_le \\<mu>T\\<^sub>2 \\<mu>T\\<^sub>3 \\<Longrightarrow> memT_le \\<mu>T\\<^sub>1 \\<mu>T\\<^sub>3\"\n  apply (cases \\<mu>T\\<^sub>1;cases \\<mu>T\\<^sub>2;cases \\<mu>T\\<^sub>3)\n  apply auto\n  by (metis less_le_trans)\n\nlemma memT_le_idx_conv:\n  \"\\<lbrakk>memT_le \\<mu>T \\<mu>T'; i<length (memT.memT \\<mu>T); memT.memT \\<mu>T' ! i \\<noteq> None \\<rbrakk> \\<Longrightarrow> memT.memT \\<mu>T' ! i = memT.memT \\<mu>T ! i\"\n  by (cases \\<mu>T; cases \\<mu>T'; auto)\n\nlemma memT_le_idx_conv1:\n  \"\\<lbrakk> memT_le \\<mu>T \\<mu>T'; i<length (memT.memT \\<mu>T); memT.memT \\<mu>T' ! i = Some T \\<rbrakk> \\<Longrightarrow> memT.memT \\<mu>T ! i = Some T  \"\n  using memT_le_idx_conv by auto\n\nlemma addr_of_type_memT_le: \"\\<lbrakk>memT_le \\<mu>T \\<mu>T'; addr_of_type \\<mu>T a T\\<rbrakk> \\<Longrightarrow> addr_of_type \\<mu>T' a T\"\n  apply (cases \\<mu>T; cases \\<mu>T'; simp)\n  apply (auto simp: addr_of_type_def Let_def split: if_splits option.splits)\n  done\n\nlemma of_type_memT_le:\n  assumes \"memT_le \\<mu>T \\<mu>T'\"\n  assumes \"of_type \\<mu>T T v\"\n  shows \"of_type \\<mu>T' T v\"\n  using assms\n  apply (induction T v rule: of_type.induct)\n  apply (auto simp: addr_of_type_memT_le list_all2_conv_all_nth)\n  done\n\n\nlemma tyco_block_allocate_aux:\n  fixes \\<mu>T T\n  defines \"\\<mu>T' \\<equiv> MEM_TYPE (memT.memT \\<mu>T @ [Some T])\"\n  assumes \"mem_of_type \\<mu>T \\<mu>\"\n  assumes \"of_type \\<mu>T T v\"\n  shows \"memT_le \\<mu>T \\<mu>T'\" \"mem_of_type \\<mu>T' (MEM (get' mem\\<^sub>L \\<mu> @ [Some v]))\"\nproof -\n  show 1: \"memT_le \\<mu>T \\<mu>T'\"\n    unfolding \\<mu>T'_def by (cases \\<mu>T) auto\n\n  have [simp]: \"length (memT.memT \\<mu>T') = Suc (length (get' mem\\<^sub>L \\<mu>))\"\n    using assms(2) unfolding \\<mu>T'_def\n      by (cases \\<mu>T) (auto simp: mem_of_type_def list_all2_lengthD)\n\n  have [simp]: \"memT.memT \\<mu>T' ! length (get' mem\\<^sub>L \\<mu>) = Some T\"\n    using assms(2)\n    by (auto simp: \\<mu>T'_def nth_append mem_of_type_def list_all2_lengthD)\n\n  have [simp]: \"get' mem\\<^sub>L \\<mu> ! i = None\" if \"i<length (memT.memT \\<mu>T)\" \"memT.memT \\<mu>T' ! i = None\" for i\n  proof -\n    from that have \"memT.memT \\<mu>T ! i = None\" unfolding \\<mu>T'_def\n      by (cases \\<mu>T) (auto simp: nth_append split: if_splits)\n    with assms(2) that show ?thesis\n      by (auto simp: mem_of_type_def list_all2_conv_all_nth)\n  qed\n\n  show \"mem_of_type \\<mu>T' (MEM (get' mem\\<^sub>L \\<mu> @ [Some v]))\"\n    using assms(2,3) 1\n    unfolding mem_of_type_def\n    by (auto\n      simp: list_all2_conv_all_nth nth_append less_Suc_eq_le of_type_memT_le rel_option_iff memT_le_idx_conv1\n      split: option.splits)\n\nqed\n\nlemma tyco_block_allocate:\n  assumes \"mem_of_type \\<mu>T \\<mu>\"\n  assumes \"of_type \\<mu>T T v\"\n  shows \"mwp (run (block_allocate v) \\<mu>) bot no_static_err bot (\\<lambda>p \\<mu>'.\n    \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> mem_of_type \\<mu>T' \\<mu>' \\<and> the_block p < length (memT.memT \\<mu>T') \\<and> memT.memT \\<mu>T'!the_block p = Some T)\"\n  using tyco_block_allocate_aux[OF assms]\n  by (fastforce\n    simp: block_allocate_def run_simps\n    split: option.splits\n    dest: mem_of_type_lengthD[symmetric])\n\nlemma tyco_block_free_aux1:\n  assumes \"b < length (\\<mu>T)\"\n  shows \"memT_le (MEM_TYPE \\<mu>T) (MEM_TYPE (\\<mu>T [b := None]))\"\n  using assms\n  by (auto simp: nth_list_update)\n\nlemma tyco_block_free_aux2:\n  assumes \"the_block b < length (get' mem\\<^sub>L \\<mu>)\"\n  assumes \"mem_of_type \\<mu>T \\<mu>\"\n  shows \"mem_of_type (MEM_TYPE (memT.memT \\<mu>T [the_block b := None])) (MEM (get' mem\\<^sub>L \\<mu>[the_block b := None]))\"\n  using assms\n  apply (cases \\<mu>; cases \\<mu>T)\n  apply (auto simp: mem_of_type_def list_all2_conv_all_nth nth_list_update)\n  apply (auto simp: rel_option_iff of_type_memT_le[OF tyco_block_free_aux1] split: option.splits)\n  done\n\n\nlemma tyco_block_free:\n  assumes \"mem_of_type \\<mu>T \\<mu>\"\n  shows \"mwp (run (block_free b) \\<mu>) bot no_static_err bot (\\<lambda>p \\<mu>'.\n    \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> mem_of_type \\<mu>T' \\<mu>')\"\n  using assms apply (cases \\<mu>T)\n  using tyco_block_free_aux2[OF _ assms(1)]\n  by (auto 0 3\n    simp: block_free_def run_simps mem_of_type_lengthD\n    intro: tyco_block_free_aux1\n    split: option.splits)\n\n\ndefinition \"tyI_exec_state \\<mu>T sT s \\<equiv>\n    mem_of_type \\<mu>T (get' exec_state.memory\\<^sub>L s)\n  \\<and> rel_fun (=) (rel_option (of_type \\<mu>T)) sT (get' exec_state.lvars\\<^sub>L s)\"\n\n\n\ndefinition \"lvty\\<^sub>L x \\<equiv> lift_lens (''Undef local variable '' @ lvar_name.the_name x) (fun\\<^sub>L x \\<bullet>\\<^sub>L the\\<^sub>L)\"\n\nlemma [simp]: \"elens (lvty\\<^sub>L x)\"\n  by (auto simp: lvty\\<^sub>L_def)\n\n(* TODO: Move *)\nlemma [simp]: \"elens (lvar\\<^sub>L x)\"\n  by (auto simp: lvar\\<^sub>L_def)\n\nfun check_int_type where\n  \"check_int_type (TINT w) = fcheck (''i0 type'') (w\\<noteq>0)\"\n| \"check_int_type _ = fail ''Expected int type''\"\n\nfun tyco_load_opr where\n  \"tyco_load_opr ty (OP_ICONST _) = doM { check_int_type ty; return ty }\"\n| \"tyco_load_opr ty (OP_LVAR x) = doM { ty' \\<leftarrow> use (lvty\\<^sub>L x); fcheck ''var declared witnh different type'' (ty=ty'); return ty' }\"\n\nlemma tyco_load_opr:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"run (tyco_load_opr ty x) sT = SUCC T sT'\"\n  shows \"mwp (run (load_opr ty x) s) bot no_static_err bot (\\<lambda>v s'. s'=s \\<and> sT'=sT \\<and> T=ty \\<and> of_type \\<mu>T T v)\"\n  using assms\n  apply (cases x; simp)\n  apply (auto simp: run_simps split: option.splits type.splits if_splits)\n  subgoal for v\n    by (auto simp: tyI_exec_state_def lvty\\<^sub>L_def lvar\\<^sub>L_def dest: rel_funD[where x=v and y=v])\n  subgoal for v e\n    by (auto simp: lvar\\<^sub>L_def lvty\\<^sub>L_def tyI_exec_state_def dest: rel_funD[where x=v and y=v])\n  done\n\nlemma tyco_to_int:\n  assumes \"of_type \\<mu>T (TINT w) v\"\n  shows \"mwp (run (to_int v) s) bot no_static_err bot (\\<lambda>i s'. s'=s \\<and> width i = w)\"\n  using assms by (auto simp: to_int_def run_simps split: val.splits sum.splits)\n\nlemma tyco_to_bool:\n  assumes \"of_type \\<mu>T (TINT 1) v\"\n  shows \"mwp (run (to_bool v) s) bot no_static_err bot (\\<lambda>_ s'. s'=s)\"\n  using assms by (auto simp: to_bool_def run_simps split: val.splits sum.splits)\n\nlemma tyco_to_addr:\n  assumes \"of_type \\<mu>T (TPTR ty) v\"\n  shows \"mwp (run (to_addr v) s) bot no_static_err bot (\\<lambda>v s'. s'=s \\<and> addr_of_type \\<mu>T v ty)\"\n  using assms by (auto simp: to_addr_def run_simps split: val.splits option.splits)\n\n\ndefinition \"tyco_load_int ty opr \\<equiv> doM {\n    fcheck ''Expected INT'' (is_TINT ty);\n    tyco_load_opr ty opr;\n    return ()\n  }\"\n\ndefinition \"tyco_load_bool ty opr \\<equiv> doM {\n    fcheck ''Expected BOOL'' (ty = TINT 1);\n    tyco_load_opr ty opr;\n    return ()\n  }\"\n\ndefinition \"tyco_load_addr ty opr \\<equiv> doM {\n    fcheck ''Expected PTR'' (is_TPTR ty);\n    tyco_load_opr ty opr;\n    return ()\n  }\"\n\n\n\nlemma tyco_load_int:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"run (tyco_load_int ty x) sT = SUCC () sT'\"\n  shows \"mwp (run (load_int ty x) s) bot no_static_err bot (\\<lambda>i s'. \\<exists>w. s'=s \\<and> sT'=sT \\<and> ty = TINT w \\<and> width i = w)\"\n  using assms\n  apply (cases ty)\n  by (auto\n    simp: run_simps load_int_def tyco_load_int_def\n    intro!: mwp_cons[OF tyco_load_opr] mwp_cons[OF tyco_to_int]\n    elim!: mwp_eq_cases\n    split: if_splits\n    )\n\nlemma tyco_load_bool:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"run (tyco_load_bool ty x) sT = SUCC () sT'\"\n  shows \"mwp (run (load_bool ty x) s) bot no_static_err bot (\\<lambda>v s'. s'=s \\<and> sT'=sT \\<and> ty=TINT 1)\"\n  using assms\n  by (auto\n    simp: run_simps load_bool_def tyco_load_bool_def\n    intro!: mwp_cons[OF tyco_load_opr] mwp_cons[OF tyco_to_bool]\n    elim!: mwp_eq_cases\n    split: if_splits\n    )\n\nlemma tyco_load_addr:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"run (tyco_load_addr ty x) sT = SUCC () sT'\"\n  shows \"mwp (run (load_addr ty x) s) bot no_static_err bot\n    (\\<lambda>v s'. \\<exists>ty'. s'=s \\<and> sT'=sT \\<and> ty=TPTR ty' \\<and> addr_of_type \\<mu>T v ty')\"\n  using assms\n  apply (cases ty)\n  apply (auto\n    simp: run_simps load_addr_def tyco_load_addr_def\n    intro!: mwp_cons[OF tyco_load_opr] mwp_cons[OF tyco_to_addr]\n    elim!: mwp_eq_cases\n    split: if_splits\n    )\n  done\n\nlemma of_type_uninit[simp]: \"of_type \\<mu>T ty (uninit ty)\"\n  apply (induction ty rule: uninit.induct)\n  apply (auto simp: list_all2_conv_all_nth)\n  done\n\nlemma rel_fun_opt_memT_le_mono:\n  \"\\<lbrakk>rel_fun (=) (rel_option (of_type \\<mu>T)) sT s; memT_le \\<mu>T \\<mu>T'\\<rbrakk>\n       \\<Longrightarrow> rel_fun (=) (rel_option (of_type \\<mu>T')) sT s\"\n  apply (rule rel_funI, drule rel_funD, assumption; clarsimp)\n  subgoal for x\n    by (cases \"sT x\"; cases \"s x\"; simp add: of_type_memT_le)\n  done\n\nlemma rel_opt_memT_le_mono:\n  \"\\<lbrakk>rel_option (of_type \\<mu>T) T v; memT_le \\<mu>T \\<mu>T'\\<rbrakk>\n       \\<Longrightarrow> rel_option (of_type \\<mu>T') T v\"\n  by (cases \"T\"; cases \"v\"; simp add: of_type_memT_le)\n\n\nlemma tyco_instr_alloca:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  shows \"mwp (run (instr_alloca ty n) s) bot no_static_err bot\n    (\\<lambda>r s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT s' \\<and> addr_of_type \\<mu>T' r ty)\"\n  using assms\n  apply (auto\n    simp: instr_alloca_def run_simps tyI_exec_state_def\n    intro!: mwp_cons[OF tyco_block_allocate[where T=\"TARRAY (nat n) ty\"]]\n    split: option.splits)\n  apply (cases s; simp)\n  apply (intro exI conjI, assumption, assumption)\n  apply (simp add: rel_fun_opt_memT_le_mono)\n  apply (auto simp: addr_of_type_def Let_def split: option.splits)\n  done\n\nlemma tyco_instr_malloc:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  shows \"mwp (run (instr_malloc ty n) s) bot no_static_err bot\n    (\\<lambda>r s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT s' \\<and> addr_of_type \\<mu>T' r ty)\"\n  using assms\n  apply (auto\n    simp: instr_malloc_def run_simps tyI_exec_state_def\n    intro!: mwp_cons[OF tyco_block_allocate[where T=\"TARRAY (nat n) ty\"]]\n    split: option.splits)\n  apply (cases s; simp)\n  apply (intro exI conjI, assumption, assumption)\n  apply (simp add: rel_fun_opt_memT_le_mono)\n  apply (auto simp: addr_of_type_def Let_def split: option.splits)\n  done\n\nlemma tyco_instr_free:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  shows \"mwp (run (instr_free x) s) bot no_static_err bot\n    (\\<lambda>_ s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT s')\"\n  using assms\n  apply (auto\n    simp: instr_free_def run_simps tyI_exec_state_def\n    intro!: mwp_cons[OF tyco_block_free]\n    split: option.splits addr.splits list.splits va_item.splits nat.splits)\n  apply (cases s; simp)\n  apply (intro exI conjI, assumption, assumption)\n  apply (simp add: rel_fun_opt_memT_le_mono)\n  done\n\n\n  definition \"tyco_instr_arith2 ty op1 op2 = doM {\n    tyco_load_int ty op1;\n    tyco_load_int ty op2;\n    return (Some ty)\n  }\"\n  \n  definition \"tyco_instr_arith_cmp ty op1 op2 = doM {\n    tyco_load_int ty op1;\n    tyco_load_int ty op2;\n    return (Some (TINT 1))\n  }\"                                  \n\n  definition \"tyco_instr_trunc ty op1 ty' = doM {\n    tyco_load_int ty op1;\n    case (ty,ty') of\n      (TINT w1, TINT w2) \\<Rightarrow> doM {\n        fcheck ''i0 type'' (w2>0);\n        fcheck ''Trunc must go to smaller width'' (w1>w2);\n        return (Some ty')\n      }\n    | _ \\<Rightarrow> fail ''trunc type error''\n  }\"\n\n  definition \"tyco_instr_ext ty op1 ty' = doM {\n    tyco_load_int ty op1;\n    case (ty,ty') of\n      (TINT w1, TINT w2) \\<Rightarrow> doM {\n        fcheck ''Ext must go to greater width'' (w1<w2);\n        return (Some ty')\n      }\n    | _ \\<Rightarrow> fail ''ext type error''\n  }\"\n\n  primrec tyco_exec_basic_instr_aux :: \"_ \\<Rightarrow> (_,unit,_,_) M\" where\n    \"tyco_exec_basic_instr_aux (ADD ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (SUB ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (MUL ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (UDIV ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (UREM ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (SDIV ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (SREM ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (SHL ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (LSHR ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (ASHR ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n\n  | \"tyco_exec_basic_instr_aux (TRUNC_TO ty op1 ty') = tyco_instr_trunc ty op1 ty'\"\n  | \"tyco_exec_basic_instr_aux (ZEXT_TO ty op1 ty') = tyco_instr_ext ty op1 ty'\"\n  | \"tyco_exec_basic_instr_aux (SEXT_TO ty op1 ty') = tyco_instr_ext ty op1 ty'\"\n     \n  | \"tyco_exec_basic_instr_aux (ICMP code ty op1 op2) = tyco_instr_arith_cmp ty op1 op2\"\n     \n  | \"tyco_exec_basic_instr_aux (basic_instr_aux.AND ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (basic_instr_aux.OR ty op1 op2) =  tyco_instr_arith2 ty op1 op2\"\n  | \"tyco_exec_basic_instr_aux (basic_instr_aux.XOR ty op1 op2) = tyco_instr_arith2 ty op1 op2\"\n\n  | \"tyco_exec_basic_instr_aux (ALLOCA ty tyi opr) = doM {\n      tyco_load_int tyi opr;\n      return (Some (TPTR ty))\n    }\"\n  | \"tyco_exec_basic_instr_aux (MALLOC ty tyi opr) = doM {\n      tyco_load_int tyi opr;\n      return (Some (TPTR ty))\n    }\"\n  | \"tyco_exec_basic_instr_aux (FREE ty opr) = doM {\n      tyco_load_addr ty opr;\n      return None\n    }\"\n  | \"tyco_exec_basic_instr_aux (LOAD ty typ opr) = doM {\n      tyco_load_addr (typ) opr;\n      fcheck ''LOAD: Type mismatch'' (typ = TPTR ty);\n      return (Some ty)\n    }\"\n  | \"tyco_exec_basic_instr_aux (STORE tyv oprv typ oprp) = doM {\n      tyco_load_opr tyv oprv;\n      tyco_load_addr typ oprp;\n      fcheck ''STORE: Incompatible types'' (typ = TPTR tyv);\n      return None\n    }\"\n  | \"tyco_exec_basic_instr_aux (INSERT_A_VALUE bty bopr ety eopr idx) = doM {\n      tyco_load_opr bty bopr;\n      tyco_load_opr ety eopr;\n      fcheck ''insert_a_value type mismatch'' (case bty of TARRAY _ ety' \\<Rightarrow> ety=ety' | _ \\<Rightarrow> False);\n      return (Some bty)\n    }\"\n  | \"tyco_exec_basic_instr_aux (INSERT_S_VALUE bty bopr ety eopr idx) = doM {\n      tyco_load_opr bty bopr;\n      tyco_load_opr ety eopr;\n      fcheck ''insert_s_value type mismatch'' (case bty of\n         TSTRUCT ftys \\<Rightarrow> idx<length ftys \\<and> ftys!idx = ety\n       | _ \\<Rightarrow> False);\n      return (Some bty)\n    }\"\n  | \"tyco_exec_basic_instr_aux (EXTRACT_A_VALUE bty bopr idx) = doM {\n      tyco_load_opr bty bopr;\n      case bty of\n        TARRAY _ ty \\<Rightarrow> return (Some ty)\n      | _ \\<Rightarrow> fail ''extract_a_value type mismatch''\n    }\"\n  | \"tyco_exec_basic_instr_aux (EXTRACT_S_VALUE bty bopr idx) = doM {\n      tyco_load_opr bty bopr;\n      case bty of\n        TSTRUCT ftys \\<Rightarrow> doM {\n          fcheck ''Field index out of range'' (idx < length ftys);\n          return (Some (ftys!idx))\n        }\n      | _ \\<Rightarrow> fail ''extract_s_value type mismatch''\n    }\"\n  | \"tyco_exec_basic_instr_aux (OFS_PTR bty bopr ity iopr) = doM {\n      tyco_load_addr bty bopr;\n      tyco_load_int ity iopr;\n      return (Some bty)\n    }\"\n  | \"tyco_exec_basic_instr_aux (INDEX_A_PTR bty bopr ity iopr) = doM {\n      tyco_load_addr bty bopr;\n      tyco_load_int ity iopr;\n      case bty of\n        TPTR (TARRAY _ ty) \\<Rightarrow> return (Some (TPTR ty))\n      | _ \\<Rightarrow> fail ''index_a_ptr type mismatch''\n    }\"\n  | \"tyco_exec_basic_instr_aux (INDEX_S_PTR bty bopr idx) = doM {\n      tyco_load_addr bty bopr;\n      case bty of\n        TPTR (TSTRUCT ftys) \\<Rightarrow> doM {\n          fcheck ''index_s_ptr field index out of range'' (idx < length ftys);\n          return (Some (TPTR (ftys!idx)))\n        }\n      | _ \\<Rightarrow> fail ''index_s_ptr type mismatch''\n    }\"\n                              \n\n  definition \"param_args_match \\<mu>T params args \\<equiv> list_all2 (of_type \\<mu>T) (map fst params) args\"\n\n  primrec tyco_exec_nt_instr_aux :: \"_ \\<Rightarrow> _ \\<Rightarrow> (_,unit,_,_) M\" where\n    \"tyco_exec_nt_instr_aux \\<pi> (BASIC i) = tyco_exec_basic_instr_aux i\"\n  | \"tyco_exec_nt_instr_aux \\<pi> (CALL ty name args) = doM {\n      proc \\<leftarrow> lookup ''Undefined procedure'' (proc_map \\<pi>) name;\n      mmap (uncurry tyco_load_opr) args;\n      fcheck ''Argument type mismatch'' (map fst (procedure.params proc) = map fst args);\n      return (procedure.rtype proc)\n    }\"\n\n\nlemma tyco_instr_load:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"addr_of_type \\<mu>T addr T\"\n  shows \"mwp (run (instr_load addr) s) bot no_static_err bot (\\<lambda>v s'. s'=s \\<and> of_type \\<mu>T T v)\"\n  using assms\n  by (auto\n    simp: run_simps instr_load_def Let_def tyI_exec_state_def\n    split: option.splits if_splits\n    intro!: tyco_use_lens_of_addr[THEN mwp_cons])\n\nnamed_theorems_rev tyco_rules\n\nmethod tyco_step = (\n    (rule tyco_rules[THEN mwp_cons]; assumption?; clarsimp?)\n  | (auto simp: run_simps elim!: mwp_eq_cases split: option.splits if_splits)\n)\n\nmethod tyco = use nothing in \\<open>insert method_facts, tyco_step+\\<close>\n\nlemmas [tyco_rules] = tyco_load_int tyco_load_bool tyco_instr_alloca\n  tyco_instr_malloc tyco_instr_free tyco_load_addr tyco_instr_load tyco_load_opr\n  tyco_use_lens_of_addr tyco_put_lens_of_addr\n  tyco_block_free\n\n\nlemma same_type_imp_same_struct: \"of_type \\<mu>T T a \\<Longrightarrow> of_type \\<mu>T T b \\<Longrightarrow> same_struct a b\"\n  apply (induction T a arbitrary: b rule: of_type.induct)\n  apply (auto simp: list_all2_conv_all_nth)\n  apply (case_tac [!] b)\n  apply (fastforce simp: list_all2_conv_all_nth in_set_conv_nth)+\n  done\n\n\nlemma tyco_instr_store[tyco_rules]:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"addr_of_type \\<mu>T addr T\"\n  assumes \"of_type \\<mu>T T v\"\n  shows \"mwp (run (instr_store v addr) s) bot no_static_err bot (\\<lambda>_ s'. tyI_exec_state \\<mu>T sT s')\"\n  using assms\n  unfolding instr_store_def Let_def tyI_exec_state_def\n  apply (cases s)\n  apply clarsimp\n  apply tyco\n  apply (simp add: same_type_imp_same_struct)\n  apply tyco\n  done\n\n(*lemma [simp]:\n  \"pre_get addr.vaddr\\<^sub>L x\"\n  \"get' addr.vaddr\\<^sub>L (ADDR blk va) = va\"\n  \"put' addr.vaddr\\<^sub>L va' (ADDR blk va) = ADDR blk va'\"\n  by (auto simp: addr.vaddr\\<^sub>L_def split: addr.splits)\n\nlemma [simp]:\n  \"pre_get va_item.aidx\\<^sub>L va = is_VA_ARRAY_IDX va\"\n  \"get' va_item.aidx\\<^sub>L (VA_ARRAY_IDX idx) = idx\"\n  \"put' va_item.aidx\\<^sub>L idx' (VA_ARRAY_IDX idx) = VA_ARRAY_IDX idx'\"\n  by (auto split: va_item.split)\n*)\n\n\nlemma vaddr_of_type_change_last_array_idx: \"vaddr_of_type bT (vas @ [VA_ARRAY_IDX i]) T\n  \\<Longrightarrow> vaddr_of_type bT (vas @ [VA_ARRAY_IDX i']) T\"\n  apply (induction bT vas T rule: vaddr_of_type.induct)\n  apply auto\n  apply (case_tac bT; case_tac T; auto)\n  done\n\nlemma vaddr_of_type_append_aidx:\n  assumes \"vaddr_of_type bT vas (TARRAY n T)\"\n  shows \"vaddr_of_type bT (vas @ [VA_ARRAY_IDX idx]) T\"\n  using assms\n  apply (induction bT vas T rule: vaddr_of_type.induct)\n  apply auto\n  done\n\nlemma addr_of_type_append_aidx:\n  assumes \"addr_of_type \\<mu>T addr (TARRAY n T)\"\n  shows \"addr_of_type \\<mu>T (put' addr.vaddr\\<^sub>L (get' addr.vaddr\\<^sub>L addr @ [VA_ARRAY_IDX idx]) addr) T\"\n  using assms\n  apply (cases addr)\n  unfolding addr_of_type_def Let_def\n  apply (auto simp: vaddr_of_type_append_aidx split: if_splits option.splits)\n  done\n\nlemma vaddr_of_type_append_fidx:\n  assumes \"vaddr_of_type bT vas (TSTRUCT Ts)\"\n  assumes \"idx < length Ts\"\n  shows \"vaddr_of_type bT (vas @ [VA_FIELD_IDX idx]) (Ts!idx)\"\n  using assms\n  apply (induction bT vas T\\<equiv>\"Ts!idx\" rule: vaddr_of_type.induct)\n  apply auto\n  done\n\nlemma addr_of_type_append_fidx:\n  assumes \"addr_of_type \\<mu>T addr (TSTRUCT Ts)\"\n  assumes \"idx < length Ts\"\n  shows \"addr_of_type \\<mu>T (put' addr.vaddr\\<^sub>L (get' addr.vaddr\\<^sub>L addr @ [VA_FIELD_IDX idx]) addr) (Ts!idx)\"\n  using assms\n  apply (cases addr)\n  unfolding addr_of_type_def Let_def\n  apply (auto simp: vaddr_of_type_append_fidx split: if_splits option.splits)\n  done\n\nlemma tyco_instr_ofs_addr[tyco_rules]:\n  assumes \"addr_of_type \\<mu>T a ty\"\n  shows \"mwp (run (instr_ofs_addr a i) s) bot no_static_err bot (\\<lambda>a' s'. s'=s \\<and> addr_of_type \\<mu>T a' ty)\"\n  using assms\n  apply (cases a)\n  subgoal for blk va\n    apply (cases va rule: rev_cases)\n    subgoal by (auto simp: run_simps instr_ofs_addr_def split: option.splits)\n    subgoal for vas vai\n      apply (cases vai)\n      by (auto\n        simp: run_simps instr_ofs_addr_def addr_of_type_def Let_def\n        elim!: vaddr_of_type_change_last_array_idx\n        split: option.splits)\n    done\n  done\n\nthm memT_le_refl\n\nlemma tyco_instr_arith2[tyco_rules]: \n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"run (tyco_instr_arith2 ty a b) sT = SUCC T sT'\"\n  assumes \"\\<And>x y. \\<not>ovf x y \\<Longrightarrow> width x = width y \\<Longrightarrow> width (f x y) = width y\"\n  shows \"mwp (run (instr_arith2 ovf f ty a b) s) bot no_static_err bot \n    (\\<lambda>vv s'. \\<exists>v. vv=Some v \\<and> s'=s \\<and> T=Some ty \\<and> sT'=sT \\<and> of_type \\<mu>T ty v)\"\n  using assms unfolding tyco_instr_arith2_def instr_arith2_def\n  by tyco\n\nlemma tyco_instr_arith_cmp[tyco_rules]: \n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"run (tyco_instr_arith_cmp ty a b) sT = SUCC T sT'\"\n  shows \"mwp (run (instr_arith_cmp f ty a b) s) bot no_static_err bot \n    (\\<lambda>vv s'. \\<exists>v. vv=Some v \\<and> s'=s \\<and> T=Some (TINT 1) \\<and> sT'=sT \\<and> of_type \\<mu>T (TINT 1) v)\"\n  using assms unfolding tyco_instr_arith_cmp_def instr_arith_cmp_def\n  by tyco\n\n\nlemma tyco_instr_trunc[tyco_rules]: \n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"run (tyco_instr_trunc ty a ty') sT = SUCC T sT'\"\n  shows \"mwp (run (instr_trunc ty a ty') s) bot no_static_err bot \n    (\\<lambda>vv s'. \\<exists>v. vv=Some v \\<and> s'=s \\<and> T=Some ty' \\<and> sT'=sT \\<and> of_type \\<mu>T ty' v)\"\n  using assms unfolding tyco_instr_trunc_def instr_trunc_def\n  supply type.splits[split]\n  by tyco\n\nlemma tyco_instr_ext[tyco_rules]: \n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"run (tyco_instr_ext ty a ty') sT = SUCC T sT'\"\n  assumes \"f\\<in>{zext,sext}\"\n  shows \"mwp (run (instr_ext f ty a ty') s) bot no_static_err bot \n    (\\<lambda>vv s'. \\<exists>v. vv=Some v \\<and> s'=s \\<and> T=Some ty' \\<and> sT'=sT \\<and> of_type \\<mu>T ty' v)\"\n  using assms unfolding tyco_instr_ext_def instr_ext_def\n  supply type.splits[split]\n  by tyco\n\n\nlemma tyco_exec_basic_instr_aux[tyco_rules]:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"run (tyco_exec_basic_instr_aux instr) sT = SUCC T sT'\"\n  shows \"mwp (run (exec_basic_instr_aux instr) s) bot no_static_err bot\n    (\\<lambda>v s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT' s' \\<and> rel_option (of_type \\<mu>T') T v)\"\n  using assms\n  apply (cases instr; simp)\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal unfolding bitSHL'_def by tyco\n  subgoal unfolding bitASHR'_def by tyco\n  subgoal unfolding bitLSHR'_def by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal by tyco\n  subgoal\n    supply [split] = type.splits\n      and [simp] = same_type_imp_same_struct in_set_conv_nth Ball_def nth_list_update\n    unfolding instr_insert_a_value_def put_same_struct_def\n    by tyco\n  subgoal\n    supply [split] = type.splits val.splits\n      and [simp] = same_type_imp_same_struct in_set_conv_nth Ball_def nth_list_update\n      and [simp] = list_all2_conv_all_nth\n    unfolding instr_insert_s_value_def put_same_struct_def\n    by tyco\n  subgoal\n    supply [split] = type.splits val.splits\n      and [simp] = same_type_imp_same_struct in_set_conv_nth Ball_def nth_list_update\n      and [simp] = list_all2_conv_all_nth\n    unfolding instr_extract_a_value_def put_same_struct_def\n    by tyco\n  subgoal\n    supply [split] = type.splits val.splits\n      and [simp] = same_type_imp_same_struct in_set_conv_nth Ball_def nth_list_update\n      and [simp] = list_all2_conv_all_nth\n    unfolding instr_extract_s_value_def put_same_struct_def\n    by tyco\n  subgoal by tyco\n  subgoal\n    supply [split] = type.splits\n    supply [simp] = addr_of_type_append_aidx\n    unfolding instr_idx_array_def to_idx_def\n    by tyco\n  subgoal\n    supply [split] = type.splits\n    supply [simp] = addr_of_type_append_fidx\n    unfolding instr_idx_field_def to_idx_def\n    apply tyco\n    done\n  done\n\nlemma tyco_mmap_load_opr[tyco_rules]:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"run (mmap (uncurry tyco_load_opr) ops) sT = (SUCC uus sT' :: (_,'e,_,_) mres)\"\n  shows \"mwp (run (mmap (uncurry load_opr) ops) s) bot no_static_err bot\n    (\\<lambda>vs s'. sT'=sT \\<and> s'=s \\<and> list_all2 (of_type \\<mu>T) (map fst ops) vs)\"\n  using assms(2)\nproof (induction ops arbitrary: uus)\n  case Nil\n  then show ?case by tyco\nnext\n  case (Cons ty_opr ops)\n\n  obtain ty opr where [simp]: \"ty_opr=(ty,opr)\" by (cases ty_opr)\n\n  from Cons.prems obtain T sTh where\n        1: \"run (tyco_load_opr ty opr) sT = (SUCC T sTh :: (_,'e,_,_) mres)\"\n    and 2: \"run (mmap (uncurry tyco_load_opr) ops) sTh = (SUCC (tl uus) sT' :: (_,'e,_,_) mres)  \"\n    by (auto simp: run_simps elim!: mwp_eq_cases)\n\n  note [tyco_rules] = tyco_load_opr[OF assms(1) 1] Cons.IH[simplified]\n  show ?case using 2 by tyco\nqed\n\nlemma run_noexcept[run_simps]:\n  \"run (noexcept m) s = mwp (run m s) NTERM FAIL (\\<lambda>_ _. FAIL (STATIC_ERROR ''noexcept'')) SUCC\"\n  unfolding noexcept_def\n  by (simp add: run_simps cong del: mwp_cong)\n\n\ndefinition tyco_define_lvar :: \"_ \\<Rightarrow> _ \\<Rightarrow> (_,unit,_,_) M\" where\n  \"tyco_define_lvar ty name \\<equiv> (doM {\n    l\\<leftarrow>get;\n    fcheck (''lvar redefined'') (name \\<notin> dom l);\n    let l = l(name\\<mapsto>ty);\n    set l\n  })\"\n\nlemma tyco_define_lvar[tyco_rules]:\n  assumes \"tyI_exec_state \\<mu>T sT s\"\n  assumes \"of_type \\<mu>T ty v\"\n  assumes \"run (tyco_define_lvar ty name) sT = SUCC () sT'\"\n  shows \"mwp (run (define_lvar name v) s) bot no_static_err bot (\\<lambda>_ s'.\n    tyI_exec_state \\<mu>T sT' s')\"\n  using assms\n  unfolding define_lvar_def tyco_define_lvar_def tyI_exec_state_def\n  apply tyco\n    apply (metis (full_types) option.rel_distinct(1) rel_funD)\n  using rel_funD by fastforce\n\n\nprimrec tyco_exec_nt_instr where\n  \"tyco_exec_nt_instr \\<pi> (NT_INSTR resname i) = doM {\n    rT \\<leftarrow> tyco_exec_nt_instr_aux \\<pi> i;\n    case resname of\n      None \\<Rightarrow> return ()\n    | Some resvar \\<Rightarrow> doM {\n      rT \\<leftarrow> mget (lift_lens '''' the\\<^sub>L) rT;\n      tyco_define_lvar rT resvar\n    }\n  }\"\n\ncontext\n  fixes proc :: procedure\nbegin\n\n  primrec tyco_exec_t_instr where\n    \"tyco_exec_t_instr (RETURN_VOID) =\n      fcheck ''Non-void procedure returns void'' (procedure.rtype proc = None)\"\n  | \"tyco_exec_t_instr (RETURN ty opr) = doM {\n      tyco_load_opr ty opr;\n      fcheck ''Procedure return type mismatch'' (procedure.rtype proc = Some ty)\n    }\"\n  | \"tyco_exec_t_instr (BR label) = fcheck ''Undefined label'' (label \\<in> fst`list.set (procedure.blocks proc))\"\n  | \"tyco_exec_t_instr (CBR ty opr lt lf) = doM {\n      tyco_load_bool ty opr;\n      fcheck ''Undefined label'' ({lt,lf} \\<subseteq> fst`list.set (procedure.blocks proc))\n  }\"\n\n\n  lemma tyco_exec_t_instr[tyco_rules]:\n    assumes \"tyI_exec_state \\<mu>T sT s\"\n    assumes \"run (tyco_exec_t_instr instr) sT = SUCC uu sT'\"\n    shows \"mwp (run (exec_t_instr instr) s) bot no_static_err\n      (\\<lambda>rv s'. s'=s \\<and> sT'=sT \\<and> rel_option (of_type \\<mu>T) (procedure.rtype proc) rv)\n      (\\<lambda>l s'. s'=s \\<and> sT'=sT \\<and> l\\<in>fst`list.set (procedure.blocks proc))\"\n    using assms\n    apply (cases instr; simp)\n    by tyco\n\n  definition \"tyco_exec_block \\<pi> \\<equiv> \\<lambda>BBLOCK ntis ti\\<Rightarrow> doM {\n    \\<comment> \\<open>Execute nonterminal instructions\\<close>\n    mfold' (tyco_exec_nt_instr \\<pi>) ntis;\n    \\<comment> \\<open>Execute terminal instruction\\<close>\n    tyco_exec_t_instr ti\n  }\"\n\n\n  definition \"tyco_exec_block_reset \\<pi> block \\<equiv> doM {\n    saved_lts \\<leftarrow> get;\n    mmblock get (\\<lambda>_. set saved_lts) (tyco_exec_block \\<pi> block)\n  }\"\n\n\nend\n\ndefinition \"tyco_exec_proc \\<pi> proc \\<equiv>\n  case proc of PROC params prologue blocks rtype \\<Rightarrow> doM {\n    mblock (\\<lambda>_. Map.empty) (\\<lambda>_. ()) (doM {\n\n      \\<comment> \\<open>Define Parameters\\<close>\n      mfold' (uncurry tyco_define_lvar) params;\n\n      \\<comment> \\<open>Execute Prologue\\<close>\n      tyco_exec_block proc \\<pi> prologue;\n\n      \\<comment> \\<open>Execute Blocks\\<close>\n      mmap (tyco_exec_block_reset proc \\<pi>) (map snd blocks);\n\n      return ()\n    })\n}\"\n\n\n(*\ndefinition \"tyco_exec_proc \\<pi> proc args \\<equiv>\n  case proc of PROC params prologue blocks rtype \\<Rightarrow> doM {\n    fcheck (''|arg| != |param|'') (length params = length args);\n    fcheck (''arg-types !~ param-types'') (args = map fst params);\n    mblock (\\<lambda>_. Map.empty) (\\<lambda>_. ()) (doM {\n\n      (* Define Parameters*)\n      mfold' (uncurry tyco_define_lvar) params;\n\n      (* Execute Prologue *)\n      tyco_exec_block proc \\<pi> prologue;\n\n      (* Execute Blocks *)\n      mmap (tyco_exec_block_reset proc \\<pi>) (map snd blocks);\n\n      return ()\n    })\n}\"\n*)\n\nlocale tyco_exec_proc_name_IH =\n  fixes exec_proc_name :: \"proc_name \\<times> val list \\<Rightarrow> (val option, unit, val memory, err) M\"\n    and \\<pi> :: program\n  assumes tyco_exec_proc_name[tyco_rules]: \"\\<lbrakk>\n    proc_map \\<pi> pname = Some proc;\n    param_args_match \\<mu>T (procedure.params proc) args;\n    mem_of_type \\<mu>T \\<mu>\n  \\<rbrakk> \\<Longrightarrow> mwp (run (exec_proc_name (pname,args)) \\<mu>) top no_static_err bot\n    (\\<lambda>r \\<mu>'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> mem_of_type \\<mu>T' \\<mu>' \\<and> rel_option (of_type \\<mu>T') (procedure.rtype proc) r)\"\nbegin\n\n  lemma tyco_exec_nt_instr_aux[tyco_rules]:\n    assumes \"tyI_exec_state \\<mu>T sT s\"\n    assumes \"run (tyco_exec_nt_instr_aux \\<pi> instr) sT = SUCC T sT'\"\n    shows \"mwp (run (exec_nt_instr_aux exec_proc_name instr) s) top no_static_err bot\n      (\\<lambda>v s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT' s' \\<and> rel_option (of_type \\<mu>T') T v)\"\n    using assms\n    apply (cases instr; simp)\n    subgoal by tyco\n    subgoal\n      supply [simp] = tyI_exec_state_def param_args_match_def\n      supply [intro] = rel_fun_opt_memT_le_mono\n      by tyco\n    done\n\n  lemma tyco_exec_nt_instr[tyco_rules]:\n    assumes \"tyI_exec_state \\<mu>T sT s\"\n    assumes \"run (tyco_exec_nt_instr \\<pi> instr) sT = SUCC T sT'\"\n    shows \"mwp (run (exec_nt_instr exec_proc_name instr) s) top no_static_err bot\n      (\\<lambda>_ s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT' s')\"\n    using assms\n    apply (cases instr; simp)\n    supply [simp] = option.rel_sel\n    by tyco\n\n  lemma tyco_exec_nt_instrs[tyco_rules]:\n    assumes \"tyI_exec_state \\<mu>T sT s\"\n    assumes \"run (mfold' (tyco_exec_nt_instr \\<pi>) instrs) sT = SUCC T sT'\"\n    shows \"mwp (run (mfold' (exec_nt_instr exec_proc_name) instrs) s) top no_static_err bot\n        (\\<lambda>_ s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT' s')\"\n    using assms\n  proof (induction instrs arbitrary: \\<mu>T sT s)\n    case Nil\n    then show ?case by tyco\n  next\n    case (Cons a instrs)\n\n    from Cons.prems show ?case\n      supply [dest] = memT_le_trans\n      apply tyco\n      (* Have to apply this rule explicitly, as assumption must be applied to\n        first subgoal first, not to last subgoal as in default ;assumption?\n      *)\n      apply (rule Cons.IH[THEN mwp_cons], assumption)\n      apply tyco\n      done\n\n  qed\n\n\n  lemma tyco_exec_block[tyco_rules]:\n    assumes \"tyI_exec_state \\<mu>T sT s\"\n    assumes \"run (tyco_exec_block proc \\<pi> blk) sT = SUCC uu sT'\"\n    shows \"mwp (run (exec_block exec_proc_name blk) s) top no_static_err\n      (\\<lambda>rv s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT' s' \\<and> rel_option (of_type \\<mu>T') (procedure.rtype proc) rv)\n      (\\<lambda>l s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT' s' \\<and> l\\<in>fst`list.set (procedure.blocks proc))\"\n  proof -\n    show ?thesis\n      using assms unfolding exec_block_def tyco_exec_block_def\n      apply (cases blk; simp)\n      by tyco\n  qed\n\n  lemma tyco_exec_block_reset[tyco_rules]:\n    assumes \"tyI_exec_state \\<mu>T sT s\"\n    assumes \"run (tyco_exec_block_reset proc \\<pi> blk) sT = SUCC uu sT'\"\n    shows \"mwp (run (exec_block_reset exec_proc_name blk) s) top no_static_err\n      (\\<lambda>rv s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> get' exec_state.lvars\\<^sub>L s' = get' exec_state.lvars\\<^sub>L s \\<and> sT'=sT \\<and> tyI_exec_state \\<mu>T' sT s' \\<and> rel_option (of_type \\<mu>T') (procedure.rtype proc) rv)\n      (\\<lambda>l s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> get' exec_state.lvars\\<^sub>L s' = get' exec_state.lvars\\<^sub>L s \\<and> sT'=sT \\<and> tyI_exec_state \\<mu>T' sT s' \\<and> l\\<in>fst`list.set (procedure.blocks proc))\"\n    using assms\n    unfolding tyco_exec_block_reset_def exec_block_reset_def\n    apply tyco\n    unfolding tyI_exec_state_def\n    apply (auto intro: rel_fun_opt_memT_le_mono)\n    done\n\n  term tyco_exec_proc\n  term exec_proc\n\n  lemma tyco_mfold_define_lvar[tyco_rules]:\n    assumes \"tyI_exec_state \\<mu>T sT s\"\n    assumes \"map fst nvs = map snd tns\"\n    assumes \"list_all2 (of_type \\<mu>T) (map fst tns) (map snd nvs)\"\n    assumes \"run (mfold' (uncurry tyco_define_lvar) tns) sT = SUCC () sT'\"\n    shows \"mwp (run (mfold' (uncurry define_lvar) nvs) s) bot no_static_err bot (\\<lambda>_ s'.\n      tyI_exec_state \\<mu>T sT' s'\n    )\"\n    using assms\n  proof (induction nvs arbitrary: tns sT s)\n    case Nil\n    then show ?case by tyco\n  next\n    case (Cons a nvs)\n\n    note Cons.IH[tyco_rules]\n\n    from Cons.prems show ?case\n      by (cases a; clarsimp) tyco\n\n  qed\n\n  lemma tyI_exec_state_fresh[simp]:\n    \"tyI_exec_state \\<mu>T Map.empty (mk_fresh_exec_state \\<mu>) = mem_of_type \\<mu>T \\<mu>\"\n    by (auto simp: tyI_exec_state_def mk_fresh_exec_state_def)\n\n  (* TODO: Move *)\n  lemma tyI_exec_state_simp[simp]:\n    \"tyI_exec_state \\<mu>T sT (EXEC_STATE lvs lbs \\<mu>) \\<longleftrightarrow> mem_of_type \\<mu>T \\<mu> \\<and> rel_fun (=) (rel_option (of_type \\<mu>T)) sT lvs\"\n    by (simp add: tyI_exec_state_def)\n\n  lemma tyco_mfold_free_alloca_blocks[tyco_rules]:\n    assumes \"tyI_exec_state \\<mu>T sT s\"\n    shows \"mwp (run (mfold' (\\<lambda>x. zoom (exec_state.memory\\<^sub>L)\\<^sub>S (block_free x)) bs) s)\n      bot no_static_err bot (\\<lambda>_ s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and>  tyI_exec_state \\<mu>T' sT s')\"\n    using assms\n  proof (induction bs arbitrary: s \\<mu>T)\n    case Nil\n    then show ?case by tyco\n  next\n    case (Cons a bs)\n    note Cons.IH\n\n    from Cons.prems show ?case\n      apply (cases s; simp add: )\n      apply tyco\n      subgoal for x1 x2 x3 sh \\<mu>Th\n        apply (rule Cons.IH[of \\<mu>Th, THEN mwp_cons])\n        by (auto simp: rel_fun_opt_memT_le_mono dest: memT_le_trans)\n      done\n  qed\n\n  lemma exec_state_mem_of_typeI: \"tyI_exec_state \\<mu>T sT s \\<Longrightarrow> mem_of_type \\<mu>T (get' exec_state.memory\\<^sub>L s)\"\n    unfolding tyI_exec_state_def by simp\n\n\n  lemma tyco_exec_blocks_aux:\n    assumes \"tyI_exec_state \\<mu>T sT s\"\n    assumes \"l\\<in>L\"\n    assumes IH: \"\\<And>l \\<mu>Th sh. \\<lbrakk> memT_le \\<mu>T \\<mu>Th; tyI_exec_state \\<mu>Th sT sh; l\\<in>L\\<rbrakk> \\<Longrightarrow>\n      mwp (run (f l) sh) top no_static_err\n        (\\<lambda>rv s'. \\<exists>\\<mu>T'. memT_le \\<mu>Th \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT s' \\<and> rel_option (of_type \\<mu>T') rT rv)\n        (\\<lambda>l s'. \\<exists>\\<mu>T'. memT_le \\<mu>Th \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT s' \\<and> l\\<in>L)\n    \"\n    shows \"mwp (run (mwhile (\\<lambda>_. return True) f l) s)\n      top no_static_err (\\<lambda>rv s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT s' \\<and>  rel_option (of_type \\<mu>T') rT rv) bot\"\n    apply (rule mwhile_invar_rule[OF refl,\n      where I=\"\\<lambda>l s'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> tyI_exec_state \\<mu>T' sT s' \\<and> l\\<in>L\"])\n    subgoal by simp\n    subgoal using assms by auto\n    subgoal\n      apply tyco\n      apply (rule IH[THEN mwp_cons])\n      apply (assumption | simp)+\n      apply (auto dest: memT_le_trans)\n      done\n    done\n\n\n  lemma tyco_exec_block_reset_pres_sT_aux: \"run (tyco_exec_block_reset proc \\<pi> blk) sT = SUCC uu sT' \\<Longrightarrow> sT'=sT\"\n    unfolding tyco_exec_block_reset_def\n    by (auto simp: run_simps elim!: mwp_eq_cases)\n\n  lemma tyco_exec_block_reset_pres_sT[simp]:\n    \"NO_MATCH sT' sT \\<Longrightarrow> run (tyco_exec_block_reset proc \\<pi> blk) sT = SUCC uu sT' \\<longleftrightarrow>\n    run (tyco_exec_block_reset proc \\<pi> blk) sT = SUCC uu sT \\<and> sT'=sT\"\n    using tyco_exec_block_reset_pres_sT_aux by blast\n\n  lemma mmap_tyco_exec_block_reset_pres_sT_aux:\n    assumes \"run (mmap (tyco_exec_block_reset proc \\<pi>) blks) s = SUCC (uul::unit list) ss'\"\n    shows \"ss' = s\"\n    using assms\n    apply (induction blks arbitrary: s uul)\n    by (auto simp: run_simps elim!: mwp_eq_cases)\n\n  lemma mmap_tyco_exec_block_reset_pres_sT[simp]:\n    \"NO_MATCH s' s \\<Longrightarrow> run (mmap (tyco_exec_block_reset proc \\<pi>) blks) s = SUCC (uul::unit list) s'\n      \\<longleftrightarrow> run (mmap (tyco_exec_block_reset proc \\<pi>) blks) s = SUCC (uul::unit list) s \\<and> s'=s\"\n    using mmap_tyco_exec_block_reset_pres_sT_aux[of proc blks s uul s'] by blast\n\n  lemma run_tyco_mmapI:\n    assumes \"run (mmap (tyco_exec_block_reset proc \\<pi>) blks) s = SUCC (uul::unit list) ss'\"\n    assumes \"blk\\<in>List.set blks\"\n    shows \"run (tyco_exec_block_reset proc \\<pi> blk) s = SUCC () s\"\n    using assms\n    by (auto simp: in_set_conv_decomp run_simps elim!: mwp_eq_cases)\n\n\n(*\n  lemma tyco_exec_proc[tyco_rules]:\n    assumes \"mem_of_type \\<mu>T \\<mu>\"\n    assumes \"list_all2 (of_type \\<mu>T) argTs args\"\n    assumes \"run (tyco_exec_proc \\<pi> proc argTs) () = SUCC () ()\"\n    shows \"mwp (run (exec_proc exec_proc_name proc args) \\<mu>) top no_static_err bot (\\<lambda>_ \\<mu>'.\n      \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> mem_of_type \\<mu>T' \\<mu>'\n    )\"\n  using assms\n  unfolding tyco_exec_proc_def exec_proc_def\n  (* TODO: Clean up this mess! *)\n  apply (cases proc; clarsimp)\n  supply [simp] = list_all2_lengthD[of _ argTs args, symmetric] exec_state_mem_of_typeI\n  supply [dest] = memT_le_trans\n  apply tyco\n  apply (rule tyco_exec_blocks_aux[where L=\"fst`List.set (procedure.blocks proc)\", THEN mwp_cons])\n  apply (assumption)\n  supply [simp] = weak_map_of_SomeI\n  supply [elim!] = run_tyco_mmapI\n  apply tyco\n  apply (erule run_tyco_mmapI)\n  using map_of_SomeD apply fastforce\n  apply tyco\n  apply (intro exI exec_state_mem_of_typeI conjI; assumption?)\n  apply auto\n  done\n*)\n\n\n  lemma tyco_exec_proc[tyco_rules]:\n    assumes \"mem_of_type \\<mu>T \\<mu>\"\n    assumes \"list_all2 (of_type \\<mu>T) (map fst (procedure.params proc)) args\"\n    assumes \"run (tyco_exec_proc \\<pi> proc) () = SUCC () ()\"\n    shows \"mwp (run (exec_proc exec_proc_name proc args) \\<mu>) top no_static_err bot (\\<lambda>rv \\<mu>'.\n      \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> mem_of_type \\<mu>T' \\<mu>' \\<and> rel_option (of_type \\<mu>T') (procedure.rtype proc) rv\n    )\"\n  using assms\n  unfolding tyco_exec_proc_def exec_proc_def\n  (* TODO: Clean up this mess! *)\n  apply (cases proc; clarsimp)\n  supply [simp] = exec_state_mem_of_typeI rel_opt_memT_le_mono\n  supply [dest] = memT_le_trans\n  apply (frule list_all2_lengthD; simp)\n  apply tyco\n  apply (rule tyco_exec_blocks_aux[where L=\"fst`List.set (procedure.blocks proc)\", THEN mwp_cons])\n  apply (assumption)\n  supply [simp] = weak_map_of_SomeI\n  supply [elim!] = run_tyco_mmapI\n  apply tyco\n  apply (erule run_tyco_mmapI)\n  using map_of_SomeD apply fastforce\n  apply tyco\n  apply (intro exI exec_state_mem_of_typeI conjI)\n  prefer 2\n  apply assumption\n  apply auto\n  done\n\n\n\nend\n\ndefinition \"tyco_program \\<pi> \\<equiv> doM {\n  fcheck ''Duplicate procedure name'' (distinct (map fst (program.procedures \\<pi>)));\n  mmap (tyco_exec_proc \\<pi> o snd) (program.procedures \\<pi>);\n  return ()\n}\"\n\nlemma tyco_exec_proc_name[tyco_rules]:\n  assumes \"(run (exec_proc_name \\<pi> (pname,args)) \\<mu>) = r\"\n  assumes \"proc_map \\<pi> pname = Some proc\"\n  assumes \"param_args_match \\<mu>T (procedure.params proc) args\"\n  assumes \"mem_of_type \\<mu>T \\<mu>\"\n  assumes TYCO_PROG: \"run (tyco_program \\<pi>) () = SUCC () ()\"\n  shows \"mwp r top no_static_err bot\n    (\\<lambda>r \\<mu>'. \\<exists>\\<mu>T'. memT_le \\<mu>T \\<mu>T' \\<and> mem_of_type \\<mu>T' \\<mu>' \\<and> rel_option (of_type \\<mu>T') (procedure.rtype proc) r)\"\n  using assms(1-4)\nproof (induction \"(pname,args)\" \\<mu> r arbitrary: pname proc args \\<mu>T rule: exec_proc_name_partial)\n  case (nterm s)\n  then show ?case by tyco\nnext\n  case (step exec_proc_name s r)\n\n  from step.hyps(1)[OF refl]\n  interpret tyco_exec_proc_name_IH exec_proc_name \\<pi> by unfold_locales\n\n\n  from step.prems have \"(pname,proc) \\<in> List.set (program.procedures \\<pi>)\"\n    by (auto simp: proc_map_def map_of_SomeD)\n  with TYCO_PROG have \"run (tyco_exec_proc \\<pi> proc) () = SUCC () ()\"\n    unfolding tyco_program_def\n    by (auto simp: run_simps split: if_splits elim!: mwp_eq_cases dest!:run_mmap_unit_state_elemD)\n\n  with step.hyps(2) step.prems show ?case\n    unfolding param_args_match_def\n    by tyco\n\nqed\n\nlemma mem_of_type_init[simp]: \"mem_of_type (MEM_TYPE []) (MEM [])\"\n  by (auto simp: mem_of_type_def)\n\n\n\nexport_code tyco_program in SML\n\nvalue \"run (tyco_program test) ()\"\n\n\ntyp \"32 word\"\n\ntype_synonym cval = \"type \\<times> operand\"\n\ntype_synonym estate = \"nat \\<times> nt_instr list \\<times> ('a) mapping\"\n\n\ntype_synonym 'a eM = \"('a,unit,estate,unit) M\"\n\nfind_consts \"nat \\<Rightarrow> string\"\n\nvalue \"(''var_'' +#+ shows (42::nat)) ''''\"\n\ndefinition fresh_num :: \"_ eM\" where \"fresh_num \\<equiv> doM {\n  zoom (lift_lens () fst\\<^sub>L) (doM {\n    n \\<leftarrow> get;\n    set (Suc n);\n    return n\n  })\n}\"\n\ndefinition emit_instr :: \"nt_instr \\<Rightarrow> _ eM\" where \"emit_instr i \\<equiv> doM {\n  lift_lens () snd\\<^sub>L %= (\\<lambda>is. is@[i])\n}\"\n\n\ndefinition \"uniq_variant s \\<equiv> doM {\n  n\\<leftarrow>fresh_num;\n  return ((s +#+ ''_'' +#+ shows n) '''')\n}\"\n\ndefinition emit_instr_aux :: \"nt_instr_aux \\<Rightarrow> _ eM\" where \"emit_instr_aux i \\<equiv> doM {\n  v \\<leftarrow> uniq_variant ''tmp'';\n  let v = LVAR_NAME v;\n  emit_instr (NT_INSTR (Some v) i);\n  return v\n}\"\n\ntype_synonym expr = \"cval eM\"\n\ndefinition e_const :: \"nat \\<Rightarrow> int \\<Rightarrow> expr\" where \n  \"e_const w i \\<equiv> return (TINT w, OP_ICONST i)\"\n\ndefinition e_add :: \"expr \\<Rightarrow> expr \\<Rightarrow> expr\" where\n  \"e_add a b \\<equiv> doM {\n    (tya,va)\\<leftarrow>a;\n    (tyb,vb)\\<leftarrow>b;\n    v\\<leftarrow>emit_instr_aux (BASIC (ADD tya va vb));\n    return (tya,OP_LVAR v)\n  }\"\n\n\nvalue \"run (e_add (e_const 32 4) (e_add (e_const 32 1) (e_const 32 38))) (0,[])\"\n\n\n\noops\n\nxxx, ctd here:\n  fresh-monad to produce llvm code\n  pretty-printer to actual llvm\n  instantiate floyd verification, separation logic\n\n\n\nend\n\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/others/simple/Ex_Typed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3396653319985615}}
{"text": "(*  Title:       Exploit Logic\n    Authors:     Freek Verbeek, Nico Naus, Marc Schoolderman\n    Year:        2021\n    Maintainer:  Freek Verbeek (freek@vt.edu)\n*)\n\ntheory ExploitLogic\n  imports Main \"HOL-Library.Word\" \nbegin\n\n\n\n\n(*\n  TYPES: Variables, Meta-Variables, Operations, Regions in memory, Expressions, Predicates\n\n  An expression of type E is deterministic. It may contain meta-variables, which should be closed\n  by an existential quantifier.\n\n  For example, the predicate:\n\n    Exists ID\\<^sub>0 (MetaVar ID\\<^sub>0 \\<le>\\<^sub>s 100) (MetaVar ID\\<^sub>0 + MetaVar ID\\<^sub>0 ==\\<^sub>s Num 0)\n\n  can be read as:\n \n    \\<exists> v\\<^sub>0 \\<le> 100 \\<cdot> v\\<^sub>0 + v\\<^sub>0 == 0\n\n  An expression of type E' can be non-deterministic. For example, the expression:\n\n    NDExpr ID\\<^sub>0 (MetaVar ID\\<^sub>0 \\<le>\\<^sub>s 100)\n\n  can be read as:\n\n    { v\\<^sub>0 .  v\\<^sub>0 \\<le> 100 }\n\n*)\ntype_synonym V  = string\ntype_synonym \\<mu>V = int\n\ndatatype Op = Plus | Mult | Eq | Le | And | Or\ndatatype R =  Region E nat (\"\\<lbrakk>_,_\\<rbrakk>\")\n     and E =\n    Num \"64 word\"   \\<comment> \\<open>Immediate number\\<close>\n  | Var V           \\<comment> \\<open>Normal variable\\<close>\n  | MetaVar \\<mu>V      \\<comment> \\<open>Meta variable\\<close>\n  | Deref R         \\<comment> \\<open>Read from region\\<close>\n  | SP_AL R R E E   \\<comment> \\<open>Case split for separation and aliasing\\<close>\n  | App E Op E      \\<comment> \\<open>Application of the pure operator op to LHS and RHS\\<close>\n\ndatatype E' = \n    DExpr E     \\<comment> \\<open>deterministic\\<close>\n  | NDExpr \\<mu>V E \\<comment> \\<open>non-deterministic\\<close>\n\ndatatype P = Exists \\<mu>V E P | Expr E\n\n\n(*\n  TYPES: Statements, Blocks, Programs\n*)\ndatatype Statement = \n    Assign V E' (infixl \"::=\" 40)\n  | Store R V\n\ndatatype Block = \n    Seq Statement Block (infixl \";\" 30)\n  | Jump E E E\n  | Exit\n\nlocale program = \n  fixes entry  :: \"64 word\"           \\<comment> \\<open>Entry address\\<close>\n    and blocks :: \"64 word \\<Rightarrow> Block\"  \\<comment> \\<open>Blocks per address\\<close>\n\n\n(*\n  Some notation for symbolic operators\n*)\nabbreviation plus_s (infixl \"+\\<^sub>s\" 65)\n  where \"e0 +\\<^sub>s e1 \\<equiv> App e0 Plus e1\"\nabbreviation mult_s (infixl \"*\\<^sub>s\" 70)\n  where \"e0 *\\<^sub>s e1 \\<equiv> App e0 Mult e1\"\nabbreviation equal_s (infixl \"==\\<^sub>s\" 49) \n  where \"e0 ==\\<^sub>s e1 \\<equiv> App e0 Eq e1\"\nabbreviation less_equal_s (infixl \"\\<le>\\<^sub>s\" 49)\n  where \"e0 \\<le>\\<^sub>s e1 \\<equiv> App e0 Le e1\"\nabbreviation and_s  (infixr \"\\<and>\\<^sub>s\" 35)\n  where \"e0 \\<and>\\<^sub>s e1 \\<equiv> App e0 And e1\"\nabbreviation or_s  (infixr \"\\<or>\\<^sub>s\" 35)\n  where \"e0 \\<or>\\<^sub>s e1 \\<equiv> App e0 Or e1\"\nabbreviation not_s :: \"E \\<Rightarrow> E\"  (\"\\<not>\\<^sub>s _\" [40] 40)\n  where \"\\<not>\\<^sub>s e \\<equiv> e ==\\<^sub>s Num 0\"\n\n\n(*\n  As state, we simply assign words to variable names.\n  Moreover, there is some polymorhpic type 'M representing memory.\n*)\nrecord 'M state =\n  mem  :: 'M\n  vars :: \"V \\<Rightarrow> 64 word\"  \n\n\n\nlocale memory = program +\n  fixes write_region :: \"64 word \\<times> nat \\<Rightarrow> 64 word \\<Rightarrow> 'M state \\<Rightarrow> 'M state\"\n    and read_region  :: \"64 word \\<times> nat \\<Rightarrow> 'M state \\<Rightarrow> 64 word\"\n    and separate     :: \"64 word \\<times> nat \\<Rightarrow> 64 word \\<times> nat \\<Rightarrow> bool\" (infixl \"\\<bowtie>\" 55)\n    and aliasing     :: \"64 word \\<times> nat \\<Rightarrow> 64 word \\<times> nat \\<Rightarrow> bool\" (infixl \"\\<simeq>\" 55)\n  assumes read_write_SP:                 \"r' \\<bowtie> r \\<Longrightarrow> read_region r (write_region r' v \\<sigma>) = read_region r \\<sigma>\"\n      and read_write_AL:                 \"read_region r (write_region r v \\<sigma>) = v\"\n      and regs_after_write_region[simp]: \"vars (write_region r v \\<sigma>) = vars \\<sigma>\"\n      and read_region_reg_update[simp]:  \"read_region r (\\<sigma>\\<lparr>vars := x\\<rparr>) = read_region r \\<sigma>\"\n      and separate_irreflexive[simp]:    \"\\<not> separate r r\"\n      and separate_symmetric[symmetric]: \"r \\<bowtie> r' = r' \\<bowtie> r\"\n      and separate_or_aliasing:          \"r \\<bowtie> r' \\<or> r \\<simeq> r'\"\n      and aliasing_def:                  \"r \\<simeq> r' \\<equiv> r = r'\"\n      and finite_states:                 \"finite (UNIV :: 'M state set)\"\nbegin\n\n(* Evaluation *)\nabbreviation \"bool2expr f e0 e1 \\<equiv> if f e0 e1 then 1 else 0\"\n\nprimrec eval_Op\n  where \n    \"eval_Op Plus = (+)\"\n  | \"eval_Op Mult = (*)\"\n  | \"eval_Op Eq   = bool2expr (=)\"\n  | \"eval_Op Le   = bool2expr (\\<le>)\"\n  | \"eval_Op And  = bool2expr (\\<lambda> e0 e1 . e0 \\<noteq> 0 \\<and> e1 \\<noteq> 0)\"\n  | \"eval_Op Or   = bool2expr (\\<lambda> e0 e1 . e0 \\<noteq> 0 \\<or> e1 \\<noteq> 0)\"\n\n(* to evaluate an expression and a predicate, a valuation \\<phi> is needed, i.e., an assignment of values to metavariables *)\nfun eval_E :: \"'M state \\<Rightarrow> (\\<mu>V \\<Rightarrow> 64 word) \\<Rightarrow> E \\<Rightarrow> 64 word\"\n  where \n    \"eval_E s \\<phi> (Num n)          = n\"\n  | \"eval_E s \\<phi> (Var v)          = vars s v\"\n  | \"eval_E s \\<phi> (MetaVar v)      = \\<phi> v\"\n  | \"eval_E s \\<phi> (Deref \\<lbrakk>a,si\\<rbrakk>)    = read_region (eval_E s \\<phi> a,si) s\"\n  | \"eval_E s \\<phi> (SP_AL \\<lbrakk>a0,s0\\<rbrakk> \\<lbrakk>a1,s1\\<rbrakk> e0 e1) = \n      (if  (eval_E s \\<phi> a0,s0) \\<bowtie> (eval_E s \\<phi> a1,s1) then eval_E s \\<phi> e0 else eval_E s \\<phi> e1)\"\n  | \"eval_E s \\<phi> (App e0 op e1)  =  eval_Op op (eval_E s \\<phi> e0) (eval_E s \\<phi> e1)\"\n\nprimrec eval_E' :: \"'M state \\<Rightarrow> (\\<mu>V \\<Rightarrow> 64 word) \\<Rightarrow> E' \\<Rightarrow> 64 word set\"\n  where \"eval_E' s \\<phi> (DExpr e) = {eval_E s \\<phi> e}\"\n  | \"eval_E' s \\<phi> (NDExpr \\<mu>v e) = { i . eval_E s (\\<phi>(\\<mu>v := i)) e \\<noteq> 0 }\"\n\nfun eval_P \n  where \n    \"eval_P s \\<phi> (Expr e) m = (eval_E s \\<phi> e = m)\"\n  | \"eval_P s \\<phi> (Exists \\<mu>v e P) m = (\\<exists> i . eval_E s (\\<phi>(\\<mu>v := i)) e \\<noteq> 0 \\<and> eval_P s (\\<phi>(\\<mu>v := i)) P m)\"\n\n(*\n  A predicate holds if it holds for some initial valuation\n*)\ndefinition holds_P :: \"'M state \\<Rightarrow> P \\<Rightarrow> bool\"\n  where \"holds_P s P \\<equiv> \\<exists> \\<phi> i . eval_P s \\<phi> P i \\<and> i \\<noteq> 0\"\n\n\n(* Semantics: the step function\n\n  Loop B C:\n    goes from state s to s' if there exists some path [s, ...s\\<^sub>n, s'] where B holds for all states other than s'\n    n may be zero, i.e., it may be that s == s'\n  While B C:\n    goes from state s to s' if Loop B C goes from s to s' and B does not hold in state s'.\n\n  The reason for the split between Loop and While is because it makes proving easier.\n*)\ninductive step\\<^sub>S :: \"Statement \\<Rightarrow> 'M state \\<Rightarrow> 'M state \\<Rightarrow> bool\"\n  where \n    \"m \\<in> eval_E' s \\<phi> e' \\<Longrightarrow> s' = s\\<lparr>vars := (vars s)(v := m)\\<rparr> \\<Longrightarrow> step\\<^sub>S (v ::= e') s s'\"\n  | \"eval_E s \\<phi> a = m \\<Longrightarrow> eval_E s \\<phi> (Var v) = m' \\<Longrightarrow> s' = write_region (m,si) m' s \\<Longrightarrow> step\\<^sub>S (Store \\<lbrakk>a,si\\<rbrakk> v) s s'\"\n\n\ninductive step\\<^sub>B :: \"Block \\<Rightarrow> 'M state \\<Rightarrow> 'M state \\<Rightarrow> bool\"\n  where \n    \"step\\<^sub>S S s s' \\<Longrightarrow> step\\<^sub>B B s' s'' \\<Longrightarrow>  step\\<^sub>B (S;B) s s''\"\n  | \"holds_P s (Expr e) \\<Longrightarrow> m = eval_E s \\<phi> a\\<^sub>0 \\<Longrightarrow> step\\<^sub>B (blocks m) s s' \\<Longrightarrow> step\\<^sub>B (Jump e a\\<^sub>0 a\\<^sub>1) s s'\"\n  | \"holds_P s (Expr (\\<not>\\<^sub>s e)) \\<Longrightarrow> m = eval_E s \\<phi> a\\<^sub>1 \\<Longrightarrow>  step\\<^sub>B (blocks m) s s' \\<Longrightarrow> step\\<^sub>B (Jump e a\\<^sub>0 a\\<^sub>1) s s'\"\n  | \"s = s' \\<Longrightarrow> step\\<^sub>B Exit s s'\"\n\ndefinition step\\<^sub>P :: \"64 word \\<Rightarrow> 'M state \\<Rightarrow> 'M state \\<Rightarrow> bool\"\n  where \"step\\<^sub>P addr \\<equiv> step\\<^sub>B (blocks addr)\"\n\n\n(*\n   The definition of an exploit-triple:\n    If P holds, then after execution of code C, postcondition Q may hold.\n *)\ndefinition exploit_triple :: \"P \\<Rightarrow> Block \\<Rightarrow> P \\<Rightarrow> bool\" (\"\\<lbrace>_\\<rbrace> _ \\<lbrace>_\\<rbrace>\")\n  where \"\\<lbrace>P\\<rbrace> b \\<lbrace>Q\\<rbrace> \\<equiv> \\<forall> s . holds_P s P \\<longrightarrow> (\\<exists> s' . step\\<^sub>B b s s' \\<and> holds_P s' Q)\"\n\ndefinition exploit_tripleS :: \"P \\<Rightarrow> Statement \\<Rightarrow> P \\<Rightarrow> bool\" (\"\\<lbrace>_\\<rbrace>\\<^sub>S _ \\<lbrace>_\\<rbrace>\")\n  where \"\\<lbrace>P\\<rbrace>\\<^sub>S S \\<lbrace>Q\\<rbrace> \\<equiv> \\<forall> s . holds_P s P \\<longrightarrow> (\\<exists> s' . step\\<^sub>S S s s' \\<and> holds_P s' Q)\"\n\n\n\n(*\n  Substitution: replacing a variable with an expression, i.e:\n  \n    subst_E v e' e \n\n  is equal to:\n\n    e[v := e']\n*)\nfun subst_E :: \"V \\<Rightarrow> E \\<Rightarrow> E \\<Rightarrow> E\"\n  where\n    \"subst_E v e' (Num n)                    = Num n\"\n  | \"subst_E v e' (Var v')                   = (if v = v' then e' else Var v')\"\n  | \"subst_E v e' (MetaVar v')               = MetaVar v'\"\n  | \"subst_E v e' (Deref \\<lbrakk>a,s\\<rbrakk>)               = Deref \\<lbrakk>subst_E v e' a,s\\<rbrakk>\"\n  | \"subst_E v e' (SP_AL \\<lbrakk>a,s\\<rbrakk> \\<lbrakk>a',s'\\<rbrakk> e0 e1) = SP_AL \\<lbrakk>subst_E v e' a,s\\<rbrakk> \\<lbrakk>subst_E v e' a',s'\\<rbrakk> (subst_E v e' e0) (subst_E v e' e1)\"\n  | \"subst_E v e' (App e0 f e1)              = App (subst_E v e' e0) f (subst_E v e' e1)\"\n\nprimrec subst_P :: \"V \\<Rightarrow> E \\<Rightarrow> P \\<Rightarrow> P\"\n  where \"subst_P v e' (Expr e'') = Expr (subst_E v e' e'')\"\n  | \"subst_P v e' (Exists v'' e'' P) = Exists v'' (subst_E v e' e'') (subst_P v e' P)\"\n\n(*\n  Substitution: replacing a meta variable with another meta-variable:\n  \n    subst_\\<mu>v \\<mu>v \\<mu>v' e \n\n  is equal to:\n\n    e[\\<mu>v := \\<mu>v']\n*)\nfun subst_\\<mu>v :: \"\\<mu>V \\<Rightarrow> \\<mu>V \\<Rightarrow> E \\<Rightarrow> E\"\n  where\n    \"subst_\\<mu>v \\<mu>v \\<mu>v' (Num n)                    = Num n\"\n  | \"subst_\\<mu>v \\<mu>v \\<mu>v' (Var v)                    = Var v\"\n  | \"subst_\\<mu>v \\<mu>v \\<mu>v' (MetaVar \\<mu>v'')             = (if \\<mu>v'' = \\<mu>v then MetaVar \\<mu>v' else MetaVar \\<mu>v'')\"\n  | \"subst_\\<mu>v \\<mu>v \\<mu>v' (Deref \\<lbrakk>a,s\\<rbrakk>)               = Deref \\<lbrakk>subst_\\<mu>v \\<mu>v \\<mu>v' a,s\\<rbrakk>\"\n  | \"subst_\\<mu>v \\<mu>v \\<mu>v' (SP_AL \\<lbrakk>a,s\\<rbrakk> \\<lbrakk>a',s'\\<rbrakk> e0 e1) = SP_AL \\<lbrakk>subst_\\<mu>v \\<mu>v \\<mu>v' a,s\\<rbrakk> \\<lbrakk>subst_\\<mu>v \\<mu>v \\<mu>v' a',s'\\<rbrakk> (subst_\\<mu>v \\<mu>v \\<mu>v' e0) (subst_\\<mu>v \\<mu>v \\<mu>v' e1)\"\n  | \"subst_\\<mu>v \\<mu>v \\<mu>v' (App e0 f e1)              = App (subst_\\<mu>v \\<mu>v \\<mu>v' e0) f (subst_\\<mu>v \\<mu>v \\<mu>v' e1)\"\n\n(*\n  The set of metavariables from the expression/predicate\n*)\nfun \\<mu>vars :: \"E \\<Rightarrow> \\<mu>V list\"\n  where\n    \"\\<mu>vars (Num n) = []\"\n  | \"\\<mu>vars (Var v) = []\"\n  | \"\\<mu>vars (MetaVar v) = [v]\"\n  | \"\\<mu>vars (Deref \\<lbrakk>a,s\\<rbrakk>) = \\<mu>vars a\"\n  | \"\\<mu>vars (SP_AL \\<lbrakk>a,s\\<rbrakk> \\<lbrakk>a',s'\\<rbrakk>  e0 e1) = \\<mu>vars a @ \\<mu>vars a' @ \\<mu>vars e0 @ \\<mu>vars e1\"\n  | \"\\<mu>vars (App e0 op e1) = \\<mu>vars e0 @ \\<mu>vars e1\"\n\nprimrec \\<mu>vars_P\n  where \"\\<mu>vars_P (Expr e) = \\<mu>vars e\"\n  | \"\\<mu>vars_P (Exists \\<mu>v e P) = [\\<mu>v] @ \\<mu>vars e @ \\<mu>vars_P P\"\n\n(*\n  Conjunction of a predicate and an expression\n*)\nprimrec and_P :: \"P \\<Rightarrow> E \\<Rightarrow> P\"  (infixr \"\\<and>\\<^sub>P\" 35)\n  where\n    \"(Expr e \\<and>\\<^sub>P e0) = Expr (e \\<and>\\<^sub>s e0)\"\n  | \"(Exists v e P \\<and>\\<^sub>P e0) = Exists v e (P \\<and>\\<^sub>P e0)\"\n\n(*\n  Implication for predicates\n*)\n\ndefinition implies_P :: \"[P,P] \\<Rightarrow> bool\"  (infixr \"\\<longrightarrow>\\<^sub>P\" 25)\n  where \"P \\<longrightarrow>\\<^sub>P Q \\<equiv> \\<forall> s . holds_P s P \\<longrightarrow> holds_P s Q\"\n\n\n(* Predicate transformation *)\n\n\n(* First, predicate transformation for dealing with writing to memory (store) *)\nfun \\<tau>_store_E   :: \"Statement \\<Rightarrow> E \\<Rightarrow> E\"\nand \\<tau>_store_R :: \"Statement \\<Rightarrow> R \\<Rightarrow> E\"\n  where\n    \"\\<tau>_store_E c (Deref \\<lbrakk>a,s\\<rbrakk>)               = \\<tau>_store_R c \\<lbrakk>a,s\\<rbrakk> \"\n  | \"\\<tau>_store_E c (SP_AL \\<lbrakk>a,s\\<rbrakk> \\<lbrakk>a',s'\\<rbrakk> e0 e1)  = (SP_AL \\<lbrakk>\\<tau>_store_E c a,s\\<rbrakk> \\<lbrakk>\\<tau>_store_E c a',s'\\<rbrakk>) (\\<tau>_store_E c e0) (\\<tau>_store_E c e1)\"\n  | \"\\<tau>_store_E c (App e0 op e1)              = App (\\<tau>_store_E c e0) op (\\<tau>_store_E c e1)\"\n  | \"\\<tau>_store_E c (Num n)                     = Num n\"\n  | \"\\<tau>_store_E c (Var v)                     = Var v\"\n  | \"\\<tau>_store_E c (MetaVar v)                 = MetaVar v\"\n  | \"\\<tau>_store_R   (Store \\<lbrakk>a',s'\\<rbrakk> v) \\<lbrakk>a,s\\<rbrakk>      = (let a_\\<tau> = \\<tau>_store_E (Store \\<lbrakk>a',s'\\<rbrakk> v) a in\n                                                  SP_AL \\<lbrakk>a_\\<tau>,s\\<rbrakk> \\<lbrakk>a',s'\\<rbrakk> (Deref \\<lbrakk>a_\\<tau>,s\\<rbrakk>) (Var v))\"\n\nprimrec \\<tau>_store_P :: \"Statement \\<Rightarrow> P \\<Rightarrow> P\"\n  where\n    \"\\<tau>_store_P c (Expr e)       = Expr (\\<tau>_store_E c e)\"\n  | \"\\<tau>_store_P c (Exists v e P) = Exists v (\\<tau>_store_E c e) (\\<tau>_store_P c P)\"\n\ndefinition \"fresh_\\<mu>var P \\<equiv> foldr max (\\<mu>vars_P P) 0 + 1\"\n\n(* The complete predicate transformation function *)\ninductive \\<tau>\\<^sub>S :: \"Statement \\<Rightarrow> P \\<Rightarrow> P \\<Rightarrow> bool\"\n  where\n  \\<tau>_assign_D:  \"\\<mu>vars e = [] \\<Longrightarrow> P = subst_P v e Q \\<Longrightarrow> \\<tau>\\<^sub>S (v ::= DExpr e) P Q\"\n| \\<tau>_assign_ND: \"\\<mu>v\\<^sub>f = fresh_\\<mu>var (Q \\<and>\\<^sub>P e) \\<Longrightarrow> P = Exists \\<mu>v\\<^sub>f (subst_\\<mu>v \\<mu>v \\<mu>v\\<^sub>f e) (subst_P v (MetaVar \\<mu>v\\<^sub>f) Q) \\<Longrightarrow> \\<tau>\\<^sub>S (v ::= NDExpr \\<mu>v e) P Q\"\n| \\<tau>_store:     \"case r of \\<lbrakk>a,si\\<rbrakk> \\<Rightarrow> \\<mu>vars a = [] \\<Longrightarrow> P = \\<tau>_store_P (Store r v) Q \\<Longrightarrow> \\<tau>\\<^sub>S (Store r v) P Q\"\n\ndefinition possible :: \"P \\<Rightarrow> bool\"\n  where \"possible P \\<equiv> \\<exists> s . holds_P s P\"\n\ndefinition jump_target\n  where \"jump_target e a\\<^sub>0 a\\<^sub>1 P m \\<equiv> (P \\<and>\\<^sub>P  ((e \\<and>\\<^sub>s Num m ==\\<^sub>s a\\<^sub>0) \\<or>\\<^sub>s ((\\<not>\\<^sub>s e) \\<and>\\<^sub>s Num m ==\\<^sub>s a\\<^sub>1)))\"\n\ninductive \\<tau>\\<^sub>B :: \"Block \\<Rightarrow> P \\<Rightarrow> P \\<Rightarrow> bool\"\n  where\n  \\<tau>_seq:      \"\\<tau>\\<^sub>B B Q R \\<Longrightarrow> \\<tau>\\<^sub>S S P Q \\<Longrightarrow> \\<tau>\\<^sub>B (S;B) P R\"\n| \\<tau>_jump:    \"\\<mu>vars e = [] \\<Longrightarrow> \\<mu>vars a\\<^sub>0 = [] \\<Longrightarrow> \\<mu>vars a\\<^sub>1 = [] \\<Longrightarrow> \n              \\<forall> m . possible (jump_target e a\\<^sub>0 a\\<^sub>1 P m) \\<longrightarrow> (\\<exists> P' . (P \\<longrightarrow>\\<^sub>P P') \\<and> \\<tau>\\<^sub>B (blocks m) P' Q) \\<Longrightarrow> \\<tau>\\<^sub>B (Jump e a\\<^sub>0 a\\<^sub>1) P Q\"\n| \\<tau>_exit:     \"P = Q \\<Longrightarrow> \\<tau>\\<^sub>B Exit P Q\"\n\ndefinition \\<tau>\\<^sub>P :: \"P \\<Rightarrow> P \\<Rightarrow> bool\"\n  where \"\\<tau>\\<^sub>P \\<equiv> \\<tau>\\<^sub>B (blocks entry)\"\n\n(*\nSome logic lemma's over holds_P:\n*)\n\nlemma unsat_preserves:\n  assumes \"\\<lbrace>P\\<rbrace> b \\<lbrace>Q\\<rbrace>\"\n  shows \"\\<forall> s' . \\<not> (holds_P s' Q) \\<Longrightarrow> \\<not> (holds_P s P) \"\n  using assms\n  using exploit_triple_def by blast\n\nlemma valuation_independent:\n  shows \"\\<mu>vars e = [] \\<Longrightarrow> eval_E s \\<phi> e = eval_E s \\<phi>' e\"\n  by (induct s \\<phi> e rule: eval_E.induct ,auto)\n\nlemma eval_P_conj1:\n  shows \"i \\<noteq> 0 \\<Longrightarrow> eval_P s \\<phi> (P \\<and>\\<^sub>P B) i \\<Longrightarrow> \\<exists>i. eval_P s \\<phi> P i \\<and> i \\<noteq> 0\"\n  apply (induct s \\<phi> P i rule: eval_P.induct)\n  apply (auto simp add: split: if_split_asm)\n  by blast\n\nlemma holds_P_conj1:\n  shows \"holds_P s (P\\<^sub>1 \\<and>\\<^sub>P B) \\<Longrightarrow> holds_P s P\\<^sub>1\"\n  apply (auto simp add: holds_P_def)\n  using eval_P_conj1 by blast\n\nlemma eval_P_conj2:\n  shows \"i \\<noteq> 0 \\<Longrightarrow> \\<mu>vars B = [] \\<Longrightarrow> eval_P s \\<phi> (P \\<and>\\<^sub>P B) i \\<Longrightarrow> \\<exists>i. i \\<noteq> 0 \\<and> eval_E s \\<phi> B = i\"\n  apply (induct s \\<phi> P i rule: eval_P.induct)\n  apply (auto simp add: split: if_split_asm)\n  by (metis valuation_independent)\n\nlemma holds_P_conj2:\n  shows \"holds_P s' (P\\<^sub>1 \\<and>\\<^sub>P B) \\<Longrightarrow> \\<mu>vars B = [] \\<Longrightarrow> holds_P s' (Expr B)\"\n  apply (auto simp add: holds_P_def )\n  using eval_P_conj2 by blast\n\nlemma holds_P_conj_Expr:\n  assumes \"\\<mu>vars e\\<^sub>0 = []\"\n      and \"\\<mu>vars e\\<^sub>1 = []\"\n    shows \"holds_P s (Expr (e\\<^sub>0 \\<and>\\<^sub>s e\\<^sub>1)) \\<longleftrightarrow> (holds_P s (Expr e\\<^sub>0) \\<and> holds_P s (Expr e\\<^sub>1))\"\n  using assms\n  apply (auto simp add: holds_P_def )\n  by (metis valuation_independent)\n\nlemma eval_P_conjI:\nassumes \"eval_P s \\<phi> P i' \\<and> i' \\<noteq> 0\"\n    and \"\\<mu>vars e = []\"\n    and \"eval_E s \\<phi>' e \\<noteq> 0\"\n  shows \"eval_P s \\<phi> (P \\<and>\\<^sub>P e) 1\"\n  using assms\n  apply (induct P arbitrary: \\<phi>,auto)\n  by (metis valuation_independent)\n\nlemma holds_P_conjI:\n  assumes \"\\<mu>vars e = []\"\n    shows \"holds_P s (P \\<and>\\<^sub>P e) \\<longleftrightarrow> (holds_P s P \\<and> holds_P s (Expr e))\"\n  using assms\n  apply (auto simp add: holds_P_def )\n  using holds_P_conj1 holds_P_def apply blast\n  using eval_P_conj2 apply blast\n  by (metis eval_P_conjI zero_neq_one)\n\nlemma holds_P_disjE:\n  assumes \"holds_P s (Expr (e\\<^sub>0 \\<or>\\<^sub>s e\\<^sub>1))\"\n    shows \"holds_P s (Expr e\\<^sub>0) \\<or> holds_P s (Expr e\\<^sub>1)\"\n  using assms\n  apply (auto simp add: holds_P_def)\n  by meson\n\nlemma holds_P_disjI1:\n  assumes \"holds_P s (Expr e\\<^sub>0)\"\n    shows \"holds_P s (Expr (e\\<^sub>0 \\<or>\\<^sub>s e\\<^sub>1))\"\n  using assms\n  by (auto simp add: holds_P_def)\n\nlemma holds_P_disjI2:\n  assumes \"holds_P s (Expr e\\<^sub>1)\"\n    shows \"holds_P s (Expr (e\\<^sub>0 \\<or>\\<^sub>s e\\<^sub>1))\"\n  using assms\n  by (auto simp add: holds_P_def)\n\nlemma holds_P_not_Expr:\n  assumes \"\\<mu>vars e = []\"\n    shows \"holds_P s (Expr (\\<not>\\<^sub>s e)) \\<longleftrightarrow> \\<not>(holds_P s (Expr e))\"\n  using assms\n  apply (auto simp add: holds_P_def)\n  by (metis valuation_independent)\n\n\n(*\n  Some convenient rewrite lemma's\n*)\nlemma step\\<^sub>S_DExpr:\nassumes \"\\<mu>vars e = []\"\n  shows \"step\\<^sub>S (v ::= DExpr e) s s' \\<longleftrightarrow> s' = s\\<lparr>vars := (vars s)(v := eval_E s undefined e)\\<rparr>\"\n  using assms step\\<^sub>S.intros(1)[of \"eval_E s undefined e\" s undefined \"DExpr e\" s' v] valuation_independent\n  apply auto\n  apply (cases \"v ::= DExpr e\" s s' rule: step\\<^sub>S.cases)\n  apply auto\n  by (metis)\n\nlemma step\\<^sub>S_NDExpr:\n  shows \"step\\<^sub>S (v ::= NDExpr \\<mu>v e) s s' \\<longleftrightarrow> (\\<exists> m \\<phi> . m \\<in> eval_E' s \\<phi> (NDExpr \\<mu>v e) \\<and> s' = s\\<lparr>vars := (vars s)(v := m)\\<rparr>)\"\n  using step\\<^sub>S.intros(1)[of _ s _ \"NDExpr \\<mu>v e\" s' v] \n  apply auto\n  apply (cases \"v ::= NDExpr \\<mu>v e\" s s' rule: step\\<^sub>S.cases)\n  by auto\n\nlemma step\\<^sub>S_Store:\n  shows \"step\\<^sub>S (Store \\<lbrakk>a,si\\<rbrakk> v) s s' \\<longleftrightarrow> (\\<exists> \\<phi> . s' = write_region (eval_E s \\<phi> a,si) (eval_E s \\<phi> (Var v)) s)\"\n  using step\\<^sub>S.intros(2)[of s _ a _ v _ s' si] \n  apply auto\n  apply (cases \"Store \\<lbrakk>a,si\\<rbrakk> v\" s s' rule: step\\<^sub>S.cases)\n  by auto\n\nlemma step\\<^sub>B_jump:\n  assumes \"\\<mu>vars e = []\"\n  and \"\\<mu>vars a\\<^sub>0 = []\"\n  and \"\\<mu>vars a\\<^sub>1 = []\"\n  shows \"step\\<^sub>B (Jump e a\\<^sub>0 a\\<^sub>1) s s' \\<longleftrightarrow> step\\<^sub>B (blocks (eval_E s undefined (if holds_P s (Expr e) then a\\<^sub>0 else a\\<^sub>1))) s s'\"\n  using assms step\\<^sub>B.intros(2)\n        step\\<^sub>B.intros(3) holds_P_not_Expr\n  apply auto\n  by (cases \"Jump e a\\<^sub>0 a\\<^sub>1\" s s' rule: step\\<^sub>B.cases,auto,metis valuation_independent)+\n\nlemma step\\<^sub>B_exit:\n  shows \"step\\<^sub>B Exit s s' \\<longleftrightarrow> s = s'\"\n  using step\\<^sub>B.intros(4)\n  apply auto\n  by (cases \"Exit\" s s' rule: step\\<^sub>B.cases)\n\n\n\n(*\n   We prove soundness of tau.\n  First, substitution lemma's:\n*)\n\n(* For determinstic expressions *)\nlemma eval_E_subst_E:\n  shows \"eval_E s \\<phi> (subst_E v e e') = eval_E (s\\<lparr>vars := (vars s)(v := eval_E s \\<phi> e)\\<rparr>) \\<phi> e'\"\n  by (induct v e e' rule: subst_E.induct,auto)\n\nlemma eval_P_subst_P:\nassumes \"\\<mu>vars e = []\"\n  shows \"eval_P s \\<phi> (subst_P v e c) i \\<longleftrightarrow> eval_P (s\\<lparr>vars := (vars s)(v := eval_E s \\<phi> e)\\<rparr>) \\<phi> c i\"\n  using assms\n  apply (induct \"s\\<lparr>vars := (vars s)(v := eval_E s \\<phi> e)\\<rparr>\" \\<phi> c i rule: eval_P.induct,auto simp add: eval_E_subst_E fun_upd_twist valuation_independent)\n  by (metis (full_types) valuation_independent)+\n\nlemma holds_P_subst_P:\nassumes \"\\<mu>vars e = []\"\n    shows \"holds_P s (subst_P v e Q) \\<longleftrightarrow> (\\<exists> \\<phi> . holds_P (s\\<lparr>vars := (vars s)(v := eval_E s \\<phi> e)\\<rparr>) Q)\"\n  using assms  \n  apply (auto simp add: holds_P_def eval_P_subst_P)\n  by (metis valuation_independent)\n\n\n(* For non-deterministic expressions *)\nlemma eval_E_subst_E_\\<mu>var:\n  assumes \"\\<mu>v \\<notin> set (\\<mu>vars e)\"\n  shows \"eval_E s (\\<phi>(\\<mu>v := m)) (subst_E v (MetaVar \\<mu>v) e) = eval_E (s\\<lparr>vars := (vars s)(v := m)\\<rparr>) \\<phi> e\"\n  using assms\n  by (induct v \"MetaVar \\<mu>v\" e rule: subst_E.induct,auto)\n\nlemma eval_P_subst_P_\\<mu>var:\nassumes \"\\<mu>v  \\<notin> set (\\<mu>vars_P c)\"\nshows \"eval_P s (\\<phi>(\\<mu>v := m)) (subst_P v (MetaVar \\<mu>v) c) i \\<longleftrightarrow> eval_P (s\\<lparr>vars := (vars s)(v := m)\\<rparr>) \\<phi> c i\"\n  using assms\n  by (induct \"s\\<lparr>vars := (vars s)(v := m)\\<rparr>\" \\<phi> c i arbitrary: m rule: eval_P.induct,auto simp add: eval_E_subst_E_\\<mu>var fun_upd_twist)\n\nlemma holds_P_subst_P_\\<mu>var:\nassumes \"\\<mu>v \\<notin> set (\\<mu>vars_P Q)\"\n    and \"holds_P s (Exists \\<mu>v e (subst_P v (MetaVar \\<mu>v) Q))\"\n  shows \"\\<exists> \\<phi> m . eval_E s (\\<phi>(\\<mu>v := m)) e \\<noteq> 0 \\<and> holds_P (s\\<lparr>vars := (vars s)(v := m)\\<rparr>) Q\"\n  using assms  \n  by (auto simp add: holds_P_def eval_P_subst_P_\\<mu>var)\n\nlemma eval_E_subst_fresh_\\<mu>var:\n  assumes \"\\<mu>v\\<^sub>f \\<notin> set (\\<mu>vars e)\"\n  shows \"eval_E s (\\<phi>(\\<mu>v\\<^sub>f := m)) (subst_\\<mu>v \\<mu>v \\<mu>v\\<^sub>f e) = eval_E s (\\<phi>(\\<mu>v := m)) e\"\n  using assms\n  by (induct s \"(\\<phi>(\\<mu>v := m))\" e rule: eval_E.induct ,auto)\n\nlemma foldr_max_is_max:\n  fixes a :: int\n  assumes \"a \\<in> set s\"\n  shows \"foldr max s 0 \\<ge> a\"\n  using assms\n  by (induct s arbitrary: a,auto simp add: max.coboundedI2)\n\nlemma fresh_\\<mu>var_is_fresh:\n  shows \"fresh_\\<mu>var P \\<notin> set (\\<mu>vars_P P)\"\n  using foldr_max_is_max[of \"foldr max (\\<mu>vars_P P) 0 + 1\" \"\\<mu>vars_P P\"]\n  by (auto simp add: fresh_\\<mu>var_def)\n\nlemma \\<mu>vars_and_P:\n  shows \"set (\\<mu>vars_P (P \\<and>\\<^sub>P e)) = (set (\\<mu>vars_P P) \\<union> set (\\<mu>vars e))\"\n  by (induct P,auto)\n\n(* we prove soundness of the transformation for a Store *)\nlemma \\<tau>_store_E_sound_store:\n  assumes \"c = Store \\<lbrakk>a,si\\<rbrakk> v\"\n      and \"s' = write_region (eval_E s \\<phi> a, si) (vars s v) s\"\n  shows \"eval_E s' \\<phi> e          = eval_E s \\<phi> (\\<tau>_store_E c e)\"\n    and \"eval_E s' \\<phi> (Deref r') = eval_E s \\<phi> (\\<tau>_store_R c r')\"\n  using assms\n  apply (induct c e and c r' rule:  \\<tau>_store_E_\\<tau>_store_R.induct)\n  apply (auto simp add: Let_def read_write_SP separate_symmetric)\n  using aliasing_def read_write_AL separate_or_aliasing by metis\n\nlemma \\<tau>_store_P_sound_store:\n assumes \"\\<mu>vars a = []\"\n  shows \"eval_P (write_region (eval_E s \\<phi> a, si) (vars s v) s) \\<phi> Q i \\<longleftrightarrow> eval_P s \\<phi> (\\<tau>_store_P (Store \\<lbrakk>a,si\\<rbrakk> v) Q) i\"\n  using assms          \nproof(induct Q arbitrary: \\<phi>)\n  case (Exists \\<mu>v' e Q)\n  thus ?case \n    using Exists valuation_independent\n    apply auto\n    by (metis \\<tau>_store_E_sound_store(1))+\nnext\n  case (Expr x)\n  then show ?case \n    apply auto\n    using \\<tau>_store_E_sound_store(1)\n    apply presburger\n    by (meson \\<tau>_store_E_sound_store(1))\nqed\n\n\nlemma not_in_butlast:\n  shows \"a \\<in> set p \\<Longrightarrow> a \\<notin> set (butlast p) \\<Longrightarrow> a = last p\"\n  by (induct p,auto)\n\ntheorem \\<tau>\\<^sub>S_sound:\n  assumes \"\\<tau>\\<^sub>S S P Q\"\n      and \"holds_P s P\"\n  shows \"\\<exists> s' . step\\<^sub>S S s s' \\<and> holds_P s' Q\"\n  using assms\nproof(cases)\n  case (\\<tau>_assign_D e v)\n  {\n    fix s\n    assume \"holds_P s P\"\n    hence \"holds_P s (subst_P v e Q)\"\n      using \\<tau>_assign_D \n      by simp\n    then obtain \\<phi> where \"holds_P (s\\<lparr>vars := (vars s)(v := eval_E s \\<phi> e)\\<rparr>) Q\"\n      using holds_P_subst_P[of e s v Q] \\<tau>_assign_D(2)\n      by auto\n    moreover\n    hence \"step\\<^sub>S (v ::= DExpr e) s (s\\<lparr>vars := (vars s)(v := eval_E s \\<phi> e)\\<rparr>)\"\n      using step\\<^sub>S.intros(1)[of \"eval_E s \\<phi> e\" s \\<phi> \"DExpr e\" \"s\\<lparr>vars := (vars s)(v := eval_E s \\<phi> e)\\<rparr>\" v]\n      by auto\n    ultimately\n    have \"\\<exists> s' . step\\<^sub>S (v ::= DExpr e) s s' \\<and> holds_P s' Q\"\n      by auto\n  }\n  thus ?thesis\n    using assms(2) \\<tau>_assign_D\n    by (auto)\nnext\n  case (\\<tau>_assign_ND \\<mu>v\\<^sub>f e \\<mu>v v)\n  {\n    fix s\n    assume \"holds_P s P\"\n    hence \"holds_P s (Exists \\<mu>v\\<^sub>f (subst_\\<mu>v \\<mu>v \\<mu>v\\<^sub>f e) (subst_P v (MetaVar \\<mu>v\\<^sub>f) Q))\"\n      using \\<tau>_assign_ND \n      by simp\n    then obtain \\<phi> m where \"eval_E s (\\<phi>(\\<mu>v\\<^sub>f := m)) (subst_\\<mu>v \\<mu>v \\<mu>v\\<^sub>f e) \\<noteq> 0 \\<and> holds_P (s\\<lparr>vars := (vars s)(v := m)\\<rparr>) Q\"\n      using holds_P_subst_P_\\<mu>var[of \\<mu>v\\<^sub>f Q s \"subst_\\<mu>v \\<mu>v \\<mu>v\\<^sub>f e\" v] \\<tau>_assign_ND(1,2) fresh_\\<mu>var_is_fresh[of \"Q \\<and>\\<^sub>P e\"]\n      by (auto simp add: \\<mu>vars_and_P)\n    hence \"eval_E s (\\<phi>(\\<mu>v := m)) e \\<noteq> 0 \\<and> holds_P (s\\<lparr>vars := (vars s)(v := m)\\<rparr>) Q\"\n      using \\<tau>_assign_ND fresh_\\<mu>var_is_fresh[of \"Q \\<and>\\<^sub>P e\"]\n      by (auto simp add: eval_E_subst_fresh_\\<mu>var \\<mu>vars_and_P)\n    moreover\n    hence \"step\\<^sub>S (v ::= NDExpr \\<mu>v e) s (s\\<lparr>vars := (vars s)(v := m)\\<rparr>)\"\n      using step\\<^sub>S.intros(1)[of m s \\<phi> \"NDExpr \\<mu>v e\" \"s\\<lparr>vars := (vars s)(v := m)\\<rparr>\" v]\n      by auto\n    ultimately\n    have \"\\<exists> s' . step\\<^sub>S (v ::= NDExpr \\<mu>v e) s s' \\<and> holds_P s' Q\"\n      by auto\n  }\n  thus ?thesis\n    using assms(2) \\<tau>_assign_ND\n    by (auto)\nnext\n  case (\\<tau>_store r v)\n  {\n    fix s\n    assume \"holds_P s P\"\n    hence P: \"holds_P s (\\<tau>_store_P (Store r v) Q)\"\n      using \\<tau>_store \n      by simp\n    obtain a si where r: \"r = \\<lbrakk>a,si\\<rbrakk>\"\n      by (cases r,auto)\n    obtain i \\<phi> where i: \"i \\<noteq> 0 \\<and> eval_P s \\<phi> (\\<tau>_store_P (Store r v) Q) i\"\n      using P\n      by (auto simp add: holds_P_def)\n    let ?s' = \"write_region (eval_E s \\<phi> a, si) (eval_E s \\<phi> (Var v)) s\"\n    have \"step\\<^sub>S (Store r v) s ?s'\"\n      using step\\<^sub>S.intros(2) r\n      by auto\n    moreover\n    have \"i \\<noteq> 0 \\<and> eval_P ?s' \\<phi> Q i\"\n      using \\<tau>_store_P_sound_store[of a s \\<phi> si v Q i] P i r \\<tau>_store\n      by auto\n    ultimately\n    have \"\\<exists> s' . step\\<^sub>S (Store r v) s s' \\<and> holds_P s' Q\"\n      by (auto simp add: holds_P_def)\n  }\n  thus ?thesis\n    using assms(2) \\<tau>_store\n    by (auto simp add: exploit_triple_def)\nqed\n\n\n\ntheorem \\<tau>\\<^sub>B_sound:\nassumes \"\\<tau>\\<^sub>B B P Q\"\n  shows \"\\<lbrace>P\\<rbrace> B \\<lbrace>Q\\<rbrace>\"\n  using assms\nproof(induct B P Q rule: \\<tau>\\<^sub>B.induct)\n  case (\\<tau>_seq B Q R S P)\n    {\n      fix s\n      assume \"holds_P s P\"\n      then obtain s' where 1: \"step\\<^sub>S S s s' \\<and> holds_P s' Q\"\n        using \\<tau>\\<^sub>S_sound[of S P Q s] \\<tau>_seq(3)\n        by auto\n      then obtain s'' where \"step\\<^sub>B B s' s'' \\<and> holds_P s'' R\"\n        using \\<tau>_seq(2)\n        by (auto simp add: exploit_triple_def)\n      hence \"\\<exists> s'' . step\\<^sub>B (S ; B) s s'' \\<and> holds_P s'' R\"\n        using 1 step\\<^sub>B.intros(1)[of _ _ s']\n        by blast\n    }\n    thus ?case\n      by (auto simp add: exploit_triple_def)\nnext\n  case (\\<tau>_jump e a\\<^sub>0 a\\<^sub>1 P Q)\n    {\n      fix s\n      assume 3: \"holds_P s P\"\n      consider \"holds_P s (Expr e)\" | \"holds_P s (Expr (\\<not>\\<^sub>s e))\"\n        using holds_P_not_Expr \\<tau>_jump(1)\n        by auto\n      hence \"\\<exists> s' . step\\<^sub>B (Jump e a\\<^sub>0 a\\<^sub>1) s s' \\<and> holds_P s' Q\"\n      proof(cases)\n        case 1\n        let ?m = \"eval_E s undefined a\\<^sub>0\"\n        have \"possible (jump_target e a\\<^sub>0 a\\<^sub>1 P ?m)\"\n          using 1 3 \n          apply (auto simp add: possible_def jump_target_def holds_P_conjI \\<tau>_jump)\n          apply (rule exI[of _ s])\n          apply (auto)\n          apply (rule holds_P_disjI1)\n          apply (auto simp add: holds_P_conj_Expr \\<tau>_jump)\n          by (auto simp add: holds_P_def)\n        then obtain P' where P': \"\\<tau>\\<^sub>B (blocks ?m) P' Q \\<and> \\<lbrace>P'\\<rbrace> blocks ?m \\<lbrace>Q\\<rbrace> \\<and> (P \\<longrightarrow>\\<^sub>P P')\"\n          using \\<tau>_jump\n          by auto\n        then obtain s' where \"step\\<^sub>B (blocks ?m) s s' \\<and> holds_P s' Q\"\n          using 3\n          apply (auto simp add: exploit_triple_def holds_P_def implies_P_def split: if_split_asm)\n          by blast\n        thus ?thesis\n          using 1 3 step\\<^sub>B.intros(2)[of s e ?m undefined a\\<^sub>0 s' a\\<^sub>1] \n          by auto\n      next\n        case 2\n        let ?m = \"eval_E s undefined a\\<^sub>1\"\n        have \"possible (jump_target e a\\<^sub>0 a\\<^sub>1 P ?m)\"\n          using 2 3 \n          apply (auto simp add: possible_def jump_target_def holds_P_conjI \\<tau>_jump)\n          apply (rule exI[of _ s])\n          apply (auto)\n          apply (rule holds_P_disjI2)\n          apply (auto simp add: holds_P_conj_Expr \\<tau>_jump)\n          by (auto simp add: holds_P_def)\n        then obtain P' where P': \"\\<tau>\\<^sub>B (blocks ?m) P' Q \\<and> \\<lbrace>P'\\<rbrace> blocks ?m \\<lbrace>Q\\<rbrace> \\<and> (P \\<longrightarrow>\\<^sub>P P')\"\n          using \\<tau>_jump\n          by auto\n        then obtain s' where \"step\\<^sub>B (blocks ?m) s s' \\<and> holds_P s' Q\"\n          using 3\n          apply (auto simp add: exploit_triple_def holds_P_def implies_P_def split: if_split_asm)\n          by blast\n        thus ?thesis\n          using 2 3 step\\<^sub>B.intros(3)[of s e ?m undefined a\\<^sub>1 s' a\\<^sub>0] \n          by auto\n      qed\n    }\n    thus ?case\n      by (auto simp add: exploit_triple_def)\nnext\n  case (\\<tau>_exit P Q)\n  thus ?case\n    using step\\<^sub>B.intros(4)\n    by (auto simp add: exploit_triple_def)\nqed\n\n\n\n\n\n(*\n  Completeness\n*)\n\n\nlemma DAssign_completeness:\n  assumes \"\\<lbrace>P\\<rbrace>\\<^sub>S v ::= DExpr e \\<lbrace>Q\\<rbrace>\"\n     and \"\\<mu>vars e = []\"\n   shows \"P \\<longrightarrow>\\<^sub>P subst_P v e Q\"\n  using assms\n  apply (auto simp add: implies_P_def holds_P_subst_P exploit_tripleS_def)\n  by (subst (asm) step\\<^sub>S_DExpr,simp,auto)\n\nlemma valuation_independent_one_\\<mu>var:\n  shows \"set (\\<mu>vars e) \\<subseteq> {\\<mu>v} \\<Longrightarrow> eval_E s (\\<phi>(\\<mu>v := m)) e = eval_E s (\\<phi>'(\\<mu>v := m)) e\"\n  by (induct s \"\\<phi>(\\<mu>v := m)\" e rule: eval_E.induct ,auto)\n\nlemma NDAssign_completeness:\n  assumes \"\\<lbrace>P\\<rbrace>\\<^sub>S v ::= NDExpr \\<mu>v e \\<lbrace>Q\\<rbrace>\"\n      and \"\\<mu>vars e = [\\<mu>v]\"\n  shows \"P \\<longrightarrow>\\<^sub>P (let \\<mu>v\\<^sub>f = fresh_\\<mu>var (Q \\<and>\\<^sub>P e) in Exists \\<mu>v\\<^sub>f (subst_\\<mu>v \\<mu>v \\<mu>v\\<^sub>f e) (subst_P v (MetaVar \\<mu>v\\<^sub>f) Q))\"\nproof-\n  {\n    fix s\n    assume \"holds_P s P\"\n    then obtain m \\<phi> s' where 0: \"m \\<in> eval_E' s \\<phi> (NDExpr \\<mu>v e) \\<and> s' = s\\<lparr>vars := (vars s)(v := m)\\<rparr> \\<and> holds_P s' Q\"\n      using assms\n      by (auto simp add: exploit_tripleS_def step\\<^sub>S_NDExpr)\n    have 1: \"fresh_\\<mu>var (Q \\<and>\\<^sub>P e) \\<notin> set (\\<mu>vars e)\"\n      using \\<mu>vars_and_P fresh_\\<mu>var_is_fresh\n      by auto\n    have 2: \"fresh_\\<mu>var (Q \\<and>\\<^sub>P e) \\<notin> set (\\<mu>vars_P Q)\"\n      using \\<mu>vars_and_P fresh_\\<mu>var_is_fresh \n      by auto\n    have \"holds_P s (let \\<mu>v\\<^sub>f = fresh_\\<mu>var (Q \\<and>\\<^sub>P e) in Exists \\<mu>v\\<^sub>f (subst_\\<mu>v \\<mu>v \\<mu>v\\<^sub>f e) (subst_P v (MetaVar \\<mu>v\\<^sub>f) Q))\"\n      using 1 2 0 assms\n      apply (auto simp add: holds_P_def Let_def eval_E_subst_fresh_\\<mu>var eval_P_subst_P_\\<mu>var)\n      subgoal for \\<phi>' i\n        apply (rule exI[of _ \\<phi>'])\n        apply (rule exI[of _ i])\n        apply simp\n        apply (rule exI[of _ m])\n        by (auto simp add: valuation_independent_one_\\<mu>var[of e \\<mu>v s \\<phi> m \\<phi>'])\n      done\n  }\n  thus ?thesis\n    by (auto simp add: implies_P_def)\nqed\n\n\nlemma Store_completeness:\nassumes \"\\<lbrace>P\\<rbrace>\\<^sub>S Store \\<lbrakk>a,si\\<rbrakk> v \\<lbrace>Q\\<rbrace>\"\n    and \"\\<mu>vars a = []\"\n  shows \"P \\<longrightarrow>\\<^sub>P \\<tau>_store_P (Store \\<lbrakk>a,si\\<rbrakk> v) Q\"\nproof-\n  {\n    fix s\n    assume \"holds_P s P\"\n    then obtain \\<phi> s' where s': \"s' = write_region (eval_E s \\<phi> a,si) (eval_E s \\<phi> (Var v)) s \\<and> holds_P s' Q\"\n      using assms\n      by (auto simp add: exploit_tripleS_def step\\<^sub>S_Store)\n    then obtain \\<phi>' i where \"eval_P s' \\<phi>' Q i \\<and> i \\<noteq> 0\"\n      by (auto simp add: holds_P_def)\n    have \"holds_P s (\\<tau>_store_P (Store \\<lbrakk>a,si\\<rbrakk> v) Q)\"\n      using \\<tau>_store_P_sound_store assms(2) s'\n      apply (auto simp add: holds_P_def)\n      by (metis valuation_independent)\n  }\n  thus ?thesis\n    by (auto simp add: implies_P_def)\nqed\n\n(*\n  Basic sanity conditions: no meta variables in the program other than in ND expressions.\n  If indirections_allowed == False, then all jumps must be direct.\n*)\nfun sane_stmt\n  where \n  \"sane_stmt (Assign v (DExpr e))     =  (\\<mu>vars e = [])\"\n| \"sane_stmt (Assign v (NDExpr \\<mu>v e)) = (\\<mu>vars e = [\\<mu>v])\"\n| \"sane_stmt (Store \\<lbrakk>a,si\\<rbrakk> v)         = (\\<mu>vars a = [])\"\n                 \ndefinition direct_jump\n  where \"direct_jump e a\\<^sub>0 a\\<^sub>1 \\<equiv> \\<forall> m s P . possible (jump_target e a\\<^sub>0 a\\<^sub>1 P m) \\<longrightarrow> eval_E s undefined (if holds_P s (Expr e) then a\\<^sub>0 else a\\<^sub>1) = m\"\n\nprimrec sane_block\n  where \n  \"sane_block indirections_allowed (S;B)         =  (sane_stmt S \\<and> sane_block indirections_allowed B)\"\n| \"sane_block indirections_allowed (Jump e a\\<^sub>0 a\\<^sub>1) = (\\<mu>vars e = [] \\<and> \\<mu>vars a\\<^sub>0 = [] \\<and> \\<mu>vars a\\<^sub>1 = [] \\<and> (indirections_allowed \\<or> direct_jump e a\\<^sub>0 a\\<^sub>1))\"\n| \"sane_block indirections_allowed (Exit)        = True\"\n\n\n\nlemma \\<tau>\\<^sub>S_completeness:\n  assumes \"\\<lbrace>P\\<rbrace>\\<^sub>S S \\<lbrace>Q\\<rbrace>\"\n      and \"sane_stmt S\"\n  shows \"\\<exists> P' . \\<tau>\\<^sub>S S P' Q \\<and> (P \\<longrightarrow>\\<^sub>P P')\"\nproof(cases S)\n  case (Assign v e')\n  show ?thesis\n  proof(cases e')\n    case (DExpr e)\n    thus ?thesis\n      using Assign DAssign_completeness[of P v e Q] \\<tau>_assign_D assms\n      apply (auto)\n      by blast\n  next \n    case (NDExpr \\<mu>v e)\n    thus ?thesis\n      using Assign NDAssign_completeness[of P v \\<mu>v e Q] assms \\<tau>_assign_D\n      apply auto\n      by (meson \\<tau>_assign_ND)\n  qed\nnext\n  case (Store r v)\n  obtain a si where r: \"r = \\<lbrakk>a,si\\<rbrakk>\"\n    by (cases r,auto)\n  thus ?thesis\n    using Store Store_completeness[of P a si v Q] assms\n    apply auto\n    using R.case \\<tau>_store\n    by force\nqed\n\nlemma \\<tau>\\<^sub>S_sound_and_complete:\nassumes \"sane_stmt S\"\n  shows \"\\<lbrace>P\\<rbrace>\\<^sub>S S \\<lbrace>Q\\<rbrace> \\<longleftrightarrow> (\\<exists> P' . \\<tau>\\<^sub>S S P' Q \\<and> (P \\<longrightarrow>\\<^sub>P P'))\"\n  using assms \\<tau>\\<^sub>S_completeness \\<tau>\\<^sub>S_sound\n  by (auto simp add: implies_P_def exploit_tripleS_def)\n\n\n\nlemma set_of_states_describable:\n  fixes S :: \"'M state set\"\nassumes state_describable: \"\\<forall> s . \\<exists> e . \\<forall> s' . holds_P s' (Expr e) = (s = s')\"\n  shows \"\\<exists> P . \\<forall> s. holds_P s P \\<longleftrightarrow> s \\<in> S\"\nproof-\n  obtain L where L: \"set L = S\"\n    using finite_list[of S] finite_states\n    by (meson finite_subset top_greatest)\n  have \"\\<exists> e . \\<forall> s. holds_P s (Expr e) \\<longleftrightarrow> s \\<in> set L\"\n  proof(induct L)\n    case Nil\n    thus ?case\n      apply (rule exI[of _ \"(Num 42) ==\\<^sub>s (Num 43)\"])\n      by (auto simp add: holds_P_def)\n  next\n    case (Cons s L)\n    then obtain e where e: \"\\<forall>s. holds_P s (Expr e) = (s \\<in> set L)\"\n      by auto\n    obtain e' where e': \"\\<forall>s'. holds_P s' (Expr e') = (s = s')\"\n      using assms\n      by auto\n    show ?case\n      apply (rule exI[of _ \"e \\<or>\\<^sub>s e'\"])\n      using e e'\n      apply auto\n      apply (metis holds_P_disjE)\n      using holds_P_disjI2 apply presburger\n      using holds_P_disjI1 apply blast\n      done\n  qed\n  then obtain e where e: \"\\<forall>s. holds_P s (Expr e) = (s \\<in> set L)\"\n    by auto\n  show ?thesis\n    apply (rule exI[of _ \"Expr e\"])\n    using e L\n    by auto\nqed\n\n\n\nfunction exec_block :: \"Block \\<Rightarrow> P \\<Rightarrow> bool\"\n  where \"exec_block (S;B) P = (\\<exists> Q . \\<lbrace>P\\<rbrace>\\<^sub>S S \\<lbrace>Q\\<rbrace> \\<and> exec_block B Q)\"\n  | \"exec_block (Jump e a\\<^sub>0 a\\<^sub>1) P = (\\<exists> m \\<in> {m . possible (jump_target e a\\<^sub>0 a\\<^sub>1 P m)} . exec_block (blocks m) P)\"\n  | \"exec_block (Exit) P = True\"\n  by (pat_completeness,auto)\n\nlemma \\<tau>\\<^sub>B_complete:\nassumes \"exec_block_dom (B,P)\"\n    and \"sane_block False B\"\n    and \"\\<forall> m . sane_block False (blocks m)\"\n    and state_describable: \"\\<forall> s . \\<exists> e . \\<forall> s' . holds_P s' (Expr e) = (s = s')\"\n    and \"\\<lbrace>P\\<rbrace> B \\<lbrace>Q\\<rbrace>\"\n  shows \"\\<exists> P' . \\<tau>\\<^sub>B B P' Q \\<and> (P \\<longrightarrow>\\<^sub>P P')\"\n  using assms(1,2,5)\nproof(induct B P rule: exec_block.pinduct)\n  case (1 S B P)\n  from 1(4) have 0: \"\\<forall> s . holds_P s P \\<longrightarrow> (\\<exists> s' s'' . step\\<^sub>S S s s' \\<and> step\\<^sub>B B s' s'' \\<and> holds_P s'' Q)\"\n    apply (auto simp add: exploit_triple_def)\n    using step\\<^sub>B.cases\n    by fastforce    \n  let ?S' = \"{ s' . \\<exists> s s'' . holds_P s P \\<and> step\\<^sub>S S s s' \\<and> step\\<^sub>B B s' s'' \\<and> holds_P s'' Q }\"\n  obtain P' where P': \"\\<forall> s' . holds_P s' P' \\<longleftrightarrow> s' \\<in> ?S'\"\n    using set_of_states_describable[OF state_describable]\n    by presburger\n  have 2: \"\\<lbrace>P'\\<rbrace> B \\<lbrace>Q\\<rbrace>\"\n    using P'\n    by (auto simp add: exploit_triple_def)\n  then obtain P\\<^sub>B where P\\<^sub>B: \"\\<tau>\\<^sub>B B P\\<^sub>B Q \\<and> (P' \\<longrightarrow>\\<^sub>P P\\<^sub>B)\"\n    using 1(2)[of P'] 1(3)\n    by auto\n  hence 3: \"\\<lbrace>P\\<rbrace>\\<^sub>S S \\<lbrace>P\\<^sub>B\\<rbrace>\"\n    using 0 P'\n    apply (auto simp add: exploit_tripleS_def implies_P_def)\n    by blast\n  then obtain P\\<^sub>S where P\\<^sub>S: \"\\<tau>\\<^sub>S S P\\<^sub>S P\\<^sub>B \\<and> (P \\<longrightarrow>\\<^sub>P P\\<^sub>S)\"\n    using \\<tau>\\<^sub>S_completeness[of P S P\\<^sub>B] 1(3)\n    by auto\n  have \"\\<tau>\\<^sub>B (S;B) P\\<^sub>S Q \\<and> (P \\<longrightarrow>\\<^sub>P P\\<^sub>S)\"\n    using P\\<^sub>B P\\<^sub>S \\<tau>_seq[of _ P\\<^sub>B]\n    by auto\n  then show ?case\n    by auto\nnext\n  case (2 e a\\<^sub>0 a\\<^sub>1 P)\n  have 3: \"\\<mu>vars e = []\" and 4: \"\\<mu>vars a\\<^sub>0 = []\" and 5: \"\\<mu>vars a\\<^sub>1 = []\"\n    using 2(3)\n    by auto\n  {\n    fix m\n    assume m: \"possible (jump_target e a\\<^sub>0 a\\<^sub>1 P m)\"\n    have \"\\<lbrace>P\\<rbrace> blocks m \\<lbrace>Q\\<rbrace>\"\n    proof-\n      {\n        fix s\n        assume \"holds_P s P\"\n        then obtain s' where \"step\\<^sub>B (blocks (eval_E s undefined (if holds_P s (Expr e) then a\\<^sub>0 else a\\<^sub>1))) s s' \\<and> holds_P s' Q\"\n          using 2(4) 3 4 5 step\\<^sub>B_jump[of e a\\<^sub>0 a\\<^sub>1]\n          by (auto simp add: exploit_triple_def)\n        moreover\n        have \"direct_jump e a\\<^sub>0 a\\<^sub>1\"\n          using 2(3)\n          by auto\n        hence \"eval_E s undefined (if holds_P s (Expr e) then a\\<^sub>0 else a\\<^sub>1) = m\"\n          using m\n          apply (auto simp add: direct_jump_def)\n          by force+\n        ultimately\n        have \"\\<exists> s' . step\\<^sub>B (blocks m) s s' \\<and> holds_P s' Q\"\n          by auto\n      }\n      thus ?thesis\n        by (auto simp add: exploit_triple_def)\n    qed\n    hence \"\\<exists>P'. \\<tau>\\<^sub>B (blocks m) P' Q \\<and> (P \\<longrightarrow>\\<^sub>P P')\"\n      using 2(2)[of m] m assms(3)\n      by auto\n  }\n  note 1 = this\n  show ?case\n    apply (rule exI,auto)\n    apply (rule \\<tau>_jump[of _ _ _ P])\n    using 1 3 4 5\n    by (auto simp add: implies_P_def)\nnext\n  case (3 P)\n  show ?case\n    apply (rule exI[of _ Q],auto)\n     apply (rule \\<tau>_exit)\n    using 3\n    by (auto simp add: implies_P_def exploit_triple_def step\\<^sub>B_exit)\nqed\n\n\n\n\n(*\n  FINAL THEOREMS\n*)\n\ntheorem \\<tau>\\<^sub>P_sound:\nassumes \"\\<tau>\\<^sub>P P Q\"                                              \\<comment> \\<open>P is derived from Q\\<close>\n  shows \"\\<lbrace>P\\<rbrace> blocks entry \\<lbrace>Q\\<rbrace>\"                                \\<comment> \\<open>P is an exploit for Q\\<close>\n  using \\<tau>\\<^sub>B_sound assms                                      \n  by (auto simp add: \\<tau>\\<^sub>P_def)                                \n                                                             \nlemma \\<tau>\\<^sub>P_complete:                                          \nassumes \"exec_block_dom (blocks entry,P)\"                     \\<comment> \\<open>execution of the entry block terminates\\<close>\n    and \"\\<forall> m . sane_block False (blocks m)\"                   \\<comment> \\<open>no indirections\\<close>\n    and \"\\<forall> s . \\<exists> e . \\<forall> s' . holds_P s' (Expr e) = (s = s')\"   \\<comment> \\<open>states can precisely be described by a predicate\\<close>\n\n    and \"\\<lbrace>P\\<rbrace> blocks entry \\<lbrace>Q\\<rbrace>\"                                 \\<comment> \\<open>P is an exploit for Q\\<close>\n  shows \"\\<exists> P' . \\<tau>\\<^sub>B (blocks entry) P' Q \\<and> (P \\<longrightarrow>\\<^sub>P P')\"          \\<comment> \\<open>some precondition weaker than P is derived from Q\\<close>\n  using \\<tau>\\<^sub>B_complete assms\n  by (auto simp add: \\<tau>\\<^sub>P_def)\n\n\n\nend\nend", "meta": {"author": "niconaus", "repo": "reachability-logic", "sha": "fde3db7cf705be4890146468e88d2cf3fb057465", "save_path": "github-repos/isabelle/niconaus-reachability-logic", "path": "github-repos/isabelle/niconaus-reachability-logic/reachability-logic-fde3db7cf705be4890146468e88d2cf3fb057465/isabelle/ExploitLogic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3396653319985615}}
{"text": "section {*L\\_ATS\\_Simulation\\_Configuration\\_WeakLRB*}\ntheory\n  L_ATS_Simulation_Configuration_WeakLRB\n\nimports\n  L_ATS_Simulation_Configuration_Weak\n\nbegin\n\nlocale ATS_Simulation_Configuration_WeakLRB =\n  ATS_Simulation_Configuration_Weak\n  \"TSstructure1 :: 'TSstructure1 \\<Rightarrow> bool\"\n  \"configurations1 :: 'TSstructure1 \\<Rightarrow> 'conf1 set\"\n  \"initial_configurations1 :: 'TSstructure1 \\<Rightarrow> 'conf1 set\"\n  \"step_labels1 :: 'TSstructure1 \\<Rightarrow> 'label1 set\"\n  \"step_relation1 :: 'TSstructure1 \\<Rightarrow> 'conf1 \\<Rightarrow> 'label1 \\<Rightarrow> 'conf1 \\<Rightarrow> bool\"\n  \"effects1 :: 'TSstructure1 \\<Rightarrow> 'event1 set\"\n  \"marking_condition1 :: 'TSstructure1 \\<Rightarrow> ('label1,'conf1)derivation \\<Rightarrow> bool\"\n  \"marked_effect1 :: 'TSstructure1 \\<Rightarrow> ('label1,'conf1)derivation \\<Rightarrow> 'event1 set\"\n  \"unmarked_effect1 :: 'TSstructure1 \\<Rightarrow> ('label1,'conf1)derivation \\<Rightarrow> 'event1 set\"\n  \"TSstructure2 :: 'TSstructure2 \\<Rightarrow> bool\"\n  \"configurations2 :: 'TSstructure2 \\<Rightarrow> 'conf2 set\"\n  \"initial_configurations2 :: 'TSstructure2 \\<Rightarrow> 'conf2 set\"\n  \"step_labels2 :: 'TSstructure2 \\<Rightarrow> 'label2 set\"\n  \"step_relation2 :: 'TSstructure2 \\<Rightarrow> 'conf2 \\<Rightarrow> 'label2 \\<Rightarrow> 'conf2 \\<Rightarrow> bool\"\n  \"effects2 :: 'TSstructure2 \\<Rightarrow> 'event2 set\"\n  \"marking_condition2 :: 'TSstructure2 \\<Rightarrow> ('label2,'conf2)derivation \\<Rightarrow> bool\"\n  \"marked_effect2 :: 'TSstructure2 \\<Rightarrow> ('label2,'conf2)derivation \\<Rightarrow> 'event2 set\"\n  \"unmarked_effect2 :: 'TSstructure2 \\<Rightarrow> ('label2,'conf2)derivation \\<Rightarrow> 'event2 set\"\n  \"relation_configuration :: 'TSstructure1 \\<Rightarrow> 'TSstructure2 \\<Rightarrow> 'conf1 \\<Rightarrow> 'conf2 \\<Rightarrow> bool\"\n  \"relation_initial_configuration :: 'TSstructure1 \\<Rightarrow> 'TSstructure2 \\<Rightarrow> 'conf1 \\<Rightarrow> 'conf2 \\<Rightarrow> bool\"\n  \"relation_effect :: 'TSstructure1 \\<Rightarrow> 'TSstructure2 \\<Rightarrow> 'event1 \\<Rightarrow> 'event2 \\<Rightarrow> bool\"\n  \"relation_TSstructure :: 'TSstructure1 \\<Rightarrow> 'TSstructure2 \\<Rightarrow> bool\"\n  for\n    TSstructure1 configurations1 initial_configurations1 step_labels1 step_relation1 effects1 marking_condition1 marked_effect1 unmarked_effect1 TSstructure2 configurations2 initial_configurations2 step_labels2 step_relation2 effects2 marking_condition2 marked_effect2 unmarked_effect2 relation_configuration relation_initial_configuration relation_effect relation_TSstructure\n    +\n\nfixes AX_relation_initial_simulationB :: \"'TSstructure1 \\<Rightarrow> 'TSstructure2 \\<Rightarrow> 'conf1 \\<Rightarrow> 'conf2 \\<Rightarrow> (nat \\<Rightarrow> ('label2, 'conf2) derivation_configuration option) \\<Rightarrow> bool\"\n\nfixes AX_relation_step_simulationB :: \"'TSstructure1 \\<Rightarrow> 'TSstructure2 \\<Rightarrow> 'conf1 \\<Rightarrow> 'label1 \\<Rightarrow> 'conf1 \\<Rightarrow> 'conf2 \\<Rightarrow> (nat \\<Rightarrow> ('label2, 'conf2) derivation_configuration option) \\<Rightarrow> bool\"\n\nassumes AX_relation_initial_simulationB: \"\n  relation_TSstructure G1 G2\n  \\<Longrightarrow> c1 \\<in> initial_configurations1 G1\n  \\<Longrightarrow> relation_configuration G1 G2 c1 c2\n  \\<Longrightarrow> \\<exists>d2 n.\n  GR.derivation_initial G2 d2\n  \\<and> relation_initial_configuration G1 G2 c1 (the(get_configuration(d2 0)))\n  \\<and> AX_relation_initial_simulationB G1 G2 c1 c2 d2\n  \\<and> maximum_of_domain d2 n\n  \\<and> get_configuration (d2 n) = Some c2\"\n\nassumes AX_relation_step_simulationB: \"\n  relation_TSstructure G1 G2\n  \\<Longrightarrow> relation_configuration G1 G2 c1 c2\n  \\<Longrightarrow> e1 \\<in> step_labels1 G1\n  \\<Longrightarrow> c1' \\<in> configurations1 G1\n  \\<Longrightarrow> step_relation1 G1 c1' e1 c1\n  \\<Longrightarrow> \\<exists>d2 n.\n  GR.derivation G2 d2\n  \\<and> GR.belongs G2 d2\n  \\<and> the(get_configuration(d2 n)) = c2\n  \\<and> AX_relation_step_simulationB G1 G2 c1' e1 c1 c2 d2\n  \\<and> maximum_of_domain d2 n\n  \\<and> relation_configuration G1 G2 c1' (the(get_configuration(d2 0)))\"\n\nassumes AX_initial_contained: \"\n  relation_TSstructure G1 G2\n  \\<Longrightarrow> relation_initial_configuration G1 G2 c1 c2\n  \\<Longrightarrow> relation_configuration G1 G2 c1 c2\"\n\ncontext ATS_Simulation_Configuration_WeakLRB begin\n\nlemma ATS_Simulation_Configuration_WeakLRB_simulation_derivation_exists: \"\n  relation_TSstructure G1 G2\n  \\<Longrightarrow> GL.derivation G1 d1\n  \\<Longrightarrow> GL.belongs G1 d1\n  \\<Longrightarrow> d1 x = Some (pair e1x c1x)\n  \\<Longrightarrow> d1 y = Some (pair e1y c1y)\n  \\<Longrightarrow> x\\<le>y\n  \\<Longrightarrow> relation_configuration G1 G2 c1y c2y\n  \\<Longrightarrow> \\<exists>d2 n2.\n  GR.derivation G2 d2\n  \\<and> maximum_of_domain d2 n2\n  \\<and> relation_configuration G1 G2 c1x (the (get_configuration (d2 0)))\n  \\<and> c2y = (the (get_configuration (d2 n2)))\n  \\<and> (c1x \\<in> initial_configurations1 G1 \\<longrightarrow> (the (get_configuration (d2 0))) \\<in> initial_configurations2 G2)\"\n  apply(induct \"y-x\" arbitrary: x e1x c1x)\n   apply(rename_tac x e1x c1x)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"c1y \\<in> initial_configurations1 G1\")\n    apply(subgoal_tac \"\\<exists>d2 n. GR.derivation_initial G2 d2 \\<and> relation_initial_configuration G1 G2 c1y (the(get_configuration(d2 0))) \\<and> AX_relation_initial_simulationB G1 G2 c1y c2y d2 \\<and> maximum_of_domain d2 n \\<and> get_configuration (d2 n) = Some c2y\")\n     prefer 2\n     apply(rule AX_relation_initial_simulationB)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(clarsimp)\n    apply(rename_tac d2 n)(*strict*)\n    apply(rule_tac\n      x=\"d2\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac d2 n)(*strict*)\n     apply(rule GR.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac d2 n)(*strict*)\n    apply(rule_tac\n      x=\"n\"\n      in exI)\n    apply(clarsimp)\n    apply(subgoal_tac \"\\<exists>c. d2 0 = Some (pair None c)\")\n     apply(rename_tac d2 n)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac d2 n c)(*strict*)\n     apply(subgoal_tac \"\\<exists>e c. d2 n = Some (pair e c)\")\n      apply(rename_tac d2 n c)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac d2 n c e ca)(*strict*)\n      apply(simp add: get_configuration_def GR.derivation_initial_def)\n      apply (metis AX_initial_contained)\n     apply(rename_tac d2 n c)(*strict*)\n     apply(simp add: get_configuration_def)\n     apply(case_tac \"d2 n\")\n      apply(rename_tac d2 n c)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac d2 n c a)(*strict*)\n     apply(case_tac a)\n     apply(rename_tac d2 n c a option b)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d2 n)(*strict*)\n    apply (metis GR.derivation_initial_is_derivation GR.some_position_has_details_at_0)\n   apply(rule_tac\n      x=\"der1 c2y\"\n      in exI)\n   apply(rule conjI)\n    apply(rule GR.der1_is_derivation)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule conjI)\n    apply(rule der1_maximum_of_domain)\n   apply(simp add: der1_def get_configuration_def)\n  apply(rename_tac xa x e1x c1x)(*strict*)\n  apply(clarsimp)\n  apply(case_tac y)\n   apply(rename_tac xa x e1x c1x)(*strict*)\n   apply(force)\n  apply(rename_tac xa x e1x c1x nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y)\n  apply(rename_tac xa x e1x c1x y)(*strict*)\n  apply(erule_tac\n      x=\"Suc x\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 x = Some (pair e1 c1) \\<and> d1 (Suc x) = Some (pair (Some e2) c2) \\<and> step_relation1 G1 c1 e2 c2\")\n   apply(rename_tac xa x e1x c1x y)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc y\"\n      in GL.step_detail_before_some_position)\n     apply(rename_tac xa x e1x c1x y)(*strict*)\n     apply(force)\n    apply(rename_tac xa x e1x c1x y)(*strict*)\n    apply(force)\n   apply(rename_tac xa x e1x c1x y)(*strict*)\n   apply(force)\n  apply(rename_tac xa x e1x c1x y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa x e1x c1x y e2 c2)(*strict*)\n  apply(erule_tac\n      x=\"Some e2\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"c2\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule meta_impE)\n   apply(rename_tac xa x e1x c1x y e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac xa x e1x c1x y e2 c2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac xa x e1x c1x y e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac xa x e1x c1x y e2 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n  apply(subgoal_tac \"\\<exists>d2' n. GR.derivation G2 d2' \\<and> GR.belongs G2 d2' \\<and> the(get_configuration(d2' n)) = the(get_configuration(d2 0)) \\<and> AX_relation_step_simulationB G1 G2 c1x e2 c2 (the(get_configuration(d2 0))) d2' \\<and> maximum_of_domain d2' n \\<and> relation_configuration G1 G2 c1x (the(get_configuration(d2' 0)))\")\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n   prefer 2\n   apply(rule AX_relation_step_simulationB)\n       apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n       apply(force)\n      apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n      apply(force)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n     apply(rule GL.AX_step_relation_preserves_belongsE)\n       apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n       apply (metis AX_TSstructure_relation_TSstructure1_belongs)\n      apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n      apply(force)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n     apply (metis GL.belongs_configurations)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n    apply (metis GL.belongs_configurations)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n   apply(force)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n  apply(case_tac \"c1x \\<in> initial_configurations1 G1\")\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"derivation_append d2' d2 n\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n    apply(rule GR.derivation_append_preserves_derivation)\n      apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n      apply(force)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n     apply(force)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n    apply(simp add: maximum_of_domain_def)\n    apply(clarsimp)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n ya yb)(*strict*)\n    apply(case_tac yb)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n ya yb option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n ya option b)(*strict*)\n    apply(subgoal_tac \"\\<exists>c. d2 0 = Some (pair None c)\")\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n ya option b)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n ya option b c)(*strict*)\n     apply(simp add: get_configuration_def)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n ya option b)(*strict*)\n    apply (metis GR.some_position_has_details_at_0)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n   apply(rule_tac\n      x=\"n+n2\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n    apply (metis concat_has_max_dom)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n    apply (simp add: get_configuration_def derivation_append_def)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n    apply (simp add: get_configuration_def derivation_append_def)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n  apply(subgoal_tac \"\\<exists>d2 n. GR.derivation_initial G2 d2 \\<and> relation_initial_configuration G1 G2 c1x (the(get_configuration(d2 0))) \\<and> AX_relation_initial_simulationB G1 G2 c1x (the (get_configuration (d2' 0))) d2 \\<and> maximum_of_domain d2 n \\<and> get_configuration (d2 n) = Some (the (get_configuration (d2' 0)))\")\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n   prefer 2\n   apply(rule AX_relation_initial_simulationB)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n     apply(force)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n    apply(force)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n   apply(force)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n  apply(rule_tac\n      x=\"derivation_append d2a (derivation_append d2' d2 n) na\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n   apply(rule GR.derivation_append_preserves_derivation)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n     apply(rule GR.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n    apply(rule GR.derivation_append_preserves_derivation)\n      apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n      apply(force)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n     apply(force)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n    apply(subgoal_tac \"\\<exists>e c. d2' n = Some (pair e c)\")\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na e c)(*strict*)\n     apply(subgoal_tac \"\\<exists>c. d2 0 = Some (pair None c)\")\n      apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na e c)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na e c ca)(*strict*)\n      apply(simp add: get_configuration_def GR.derivation_initial_def)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na e c)(*strict*)\n     apply (metis GR.some_position_has_details_at_0)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n    apply(rule GR.some_position_has_details_before_max_dom)\n      apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n      apply(force)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n     apply(force)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n    apply(force)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d2a na = Some (pair e c)\")\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na e c)(*strict*)\n    apply(simp add: derivation_append_def)\n    apply(subgoal_tac \"\\<exists>c. d2' 0 = Some (pair None c)\")\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na e c)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na e c ca)(*strict*)\n     apply(simp add: get_configuration_def)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na e c)(*strict*)\n    apply (metis GR.some_position_has_details_at_0)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n   apply(rule GR.some_position_has_details_before_max_dom)\n     apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n     apply(rule GR.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n    apply(force)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n   apply(force)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n  apply(rule_tac\n      x=\"na+(n+n2)\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n   apply (metis concat_has_max_dom)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n   apply (simp add: get_configuration_def derivation_append_def)\n   apply (metis get_configuration_def AX_initial_contained)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n   apply (simp add: get_configuration_def derivation_append_def)\n   apply(clarsimp)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. d2a 0 = Some (pair None c)\")\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na c)(*strict*)\n   apply (simp add: get_configuration_def derivation_append_def GR.derivation_initial_def)\n  apply(rename_tac xa x e1x c1x y e2 c2 d2 n2 d2' n d2a na)(*strict*)\n  apply (metis GR.derivation_initial_is_derivation GR.some_position_has_details_at_0)\n  done\n\nlemma ATS_Simulation_Configuration_WeakLRB_simulation_initial_derivation_exists: \"\n  relation_TSstructure G1 G2\n  \\<Longrightarrow> GL.derivation_initial G1 d1\n  \\<Longrightarrow> d1 x = Some (pair e1 c1)\n  \\<Longrightarrow> relation_configuration G1 G2 c1 c2\n  \\<Longrightarrow> \\<exists>d2 n2.\n  GR.derivation_initial G2 d2\n  \\<and> maximum_of_domain d2 n2\n  \\<and> c2 = (the (get_configuration (d2 n2)))\"\n  apply(subgoal_tac \"\\<exists>c. d1 0 = Some (pair None c)\")\n   apply(clarsimp)\n   apply(rename_tac c)(*strict*)\n   apply(subgoal_tac \"\\<exists>d2 n2. GR.derivation G2 d2 \\<and> maximum_of_domain d2 n2 \\<and> relation_configuration G1 G2 c (the (get_configuration (d2 0))) \\<and> c2 = (the (get_configuration (d2 n2))) \\<and> (c \\<in> initial_configurations1 G1 \\<longrightarrow> (the (get_configuration (d2 0))) \\<in> initial_configurations2 G2)\")\n    apply(rename_tac c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      ?d1.0=\"d1\"\n      in ATS_Simulation_Configuration_WeakLRB_simulation_derivation_exists)\n          apply(rename_tac c)(*strict*)\n          apply(force)\n         apply(rename_tac c)(*strict*)\n         apply(rule GL.derivation_initial_is_derivation)\n         apply(force)\n        apply(rename_tac c)(*strict*)\n        apply(rule GL.derivation_initial_belongs)\n         apply(rename_tac c)(*strict*)\n         apply (metis AX_TSstructure_relation_TSstructure1_belongs)\n        apply(rename_tac c)(*strict*)\n        apply(force)\n       apply(rename_tac c)(*strict*)\n       apply(force)\n      apply(rename_tac c)(*strict*)\n      apply(force)\n     apply(rename_tac c)(*strict*)\n     apply(force)\n    apply(rename_tac c)(*strict*)\n    apply(force)\n   apply(rename_tac c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c d2 n2)(*strict*)\n   apply(subgoal_tac \"\\<exists>c. d2 0 = Some (pair None c)\")\n    apply(rename_tac c d2 n2)(*strict*)\n    apply(rule_tac\n      x=\"d2\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac c d2 n2)(*strict*)\n     apply(simp add: GR.derivation_initial_def)\n     apply(clarsimp)\n     apply(rename_tac c d2 n2 ca)(*strict*)\n     apply (simp add: get_configuration_def)\n     apply(erule impE)\n      apply(rename_tac c d2 n2 ca)(*strict*)\n      apply(simp add: GL.derivation_initial_def)\n     apply(rename_tac c d2 n2 ca)(*strict*)\n     apply(force)\n    apply(rename_tac c d2 n2)(*strict*)\n    apply(rule_tac\n      x=\"n2\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac c d2 n2)(*strict*)\n   apply (metis GR.some_position_has_details_at_0)\n  apply (metis GL.derivation_initial_is_derivation GL.some_position_has_details_at_0)\n  done\n\ntheorem ATS_Simulation_Configuration_WeakLRB_get_accessible_configurations_transfer: \"\n  relation_TSstructure G1 G2\n  \\<Longrightarrow> relation_configuration G1 G2 c1 c2\n  \\<Longrightarrow> c1 \\<in> GL.get_accessible_configurations G1\n  \\<Longrightarrow> c2 \\<in> GR.get_accessible_configurations G2\"\n  apply(simp add: GL.get_accessible_configurations_def GR.get_accessible_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac d i)(*strict*)\n  apply(case_tac \"d i\")\n   apply(rename_tac d i)(*strict*)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac d i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac d i a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d i option b)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(subgoal_tac \"\\<exists>d2 n2. GR.derivation_initial G2 d2 \\<and> maximum_of_domain d2 n2 \\<and> c2 = (the (get_configuration (d2 n2)))\")\n   apply(rename_tac d i option b)(*strict*)\n   prefer 2\n   apply(rule ATS_Simulation_Configuration_WeakLRB_simulation_initial_derivation_exists)\n      apply(rename_tac d i option b)(*strict*)\n      apply(force)\n     apply(rename_tac d i option b)(*strict*)\n     apply(force)\n    apply(rename_tac d i option b)(*strict*)\n    apply(force)\n   apply(rename_tac d i option b)(*strict*)\n   apply(force)\n  apply(rename_tac d i option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d i option d2 n2)(*strict*)\n  apply(rule_tac\n      x=\"d2\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"n2\"\n      in exI)\n  apply(simp add: get_configuration_def)\n  apply(simp add: maximum_of_domain_def)\n  apply(clarsimp)\n  apply(rename_tac d i option d2 n2 y)(*strict*)\n  apply(case_tac y)\n  apply(rename_tac d i option d2 n2 y optiona conf)(*strict*)\n  apply(clarsimp)\n  done\n\nend\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_06_06/L_ATS_Simulation_Configuration_WeakLRB.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3395893495876965}}
{"text": "theory flash79Bra  imports flash79Rev\n \n  begin\nlemma onInv79:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv79  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv79  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv79 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash79Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6791786861878392, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3395893430939196}}
{"text": "theory UserDataTypeType\n  imports\n    Main\n    \"Ecore-GROOVE-Mapping.Type_Model_Graph_Mapping\"\n    \"Ecore-GROOVE-Mapping.Identifier_List\"\nbegin\n\nsection \"Definition of a type model which introduces a User defined data type\"\n\ndefinition tmod_userdatatype :: \"'t Id \\<Rightarrow> 't type_model\" where\n  \"tmod_userdatatype name = \\<lparr>\n    Class = {},\n    Enum = {},\n    UserDataType = {name},\n    Field = {},\n    FieldSig = (\\<lambda>x. undefined),\n    EnumValue = {},\n    Inh = {},\n    Prop = {},\n    Constant = {},\n    ConstType = (\\<lambda>x. undefined)\n  \\<rparr>\"\n\nlemma tmod_userdatatype_correct: \"type_model (tmod_userdatatype name)\"\nproof (intro type_model.intro)\n  have \"asym {} \\<and> irrefl {}\"\n    by (simp add: asym.intros irrefl_def)\n  then show \"asym (Inh (tmod_userdatatype name)) \\<and> irrefl ((Inh (tmod_userdatatype name))\\<^sup>+)\"\n    unfolding tmod_userdatatype_def\n    by simp\nqed (simp_all add: tmod_userdatatype_def)\n\nlemma tmod_userdatatype_combine_correct:\n  assumes \"type_model Tmod\"\n  assumes new_userdatatype: \"name \\<notin> Class Tmod \\<union> Enum Tmod \\<union> UserDataType Tmod\"\n  assumes \"\\<And>x. x \\<in> Class Tmod \\<union> Enum Tmod \\<union> UserDataType Tmod \\<Longrightarrow> \\<not>id_in_ns name (Identifier x) \\<and> \\<not>id_in_ns x (Identifier name)\"\n  shows \"type_model (tmod_combine Tmod (tmod_userdatatype name))\"\nproof (intro tmod_combine_full_distinct_correct)\n  show \"type_model (tmod_userdatatype name)\"\n    by (fact tmod_userdatatype_correct)\nnext\n  show \"(Class Tmod \\<union> Enum Tmod \\<union> UserDataType Tmod) \\<inter> (Class (tmod_userdatatype name) \\<union> Enum (tmod_userdatatype name) \\<union> UserDataType (tmod_userdatatype name)) = {}\"\n    unfolding tmod_userdatatype_def\n    using new_userdatatype\n    by simp\nqed (simp_all add: assms tmod_userdatatype_def)\n\n\n\nsection \"Encoding of an User defined data type as Node Type in GROOVE\"\n\ndefinition tg_userdatatype_as_node_type :: \"'t Id \\<Rightarrow> 't \\<Rightarrow> ('t list) type_graph\" where\n  \"tg_userdatatype_as_node_type name data_edge = \\<lparr>\n    NT = {type (id_to_list name), string},\n    ET = {(type (id_to_list name), edge [data_edge], string)},\n    inh = {(type (id_to_list name), type (id_to_list name)), (string, string)},\n    abs = {},\n    mult = (\\<lambda>x. (if x = (type (id_to_list name), edge [data_edge], string) then (\\<^bold>0..\\<^emph>, \\<^bold>1..\\<^bold>1) else undefined)),\n    contains = {}\n  \\<rparr>\"\n\nlemma tg_userdatatype_as_node_type_correct: \"type_graph (tg_userdatatype_as_node_type name data_edge)\"\nproof (intro type_graph.intro)\n  fix n\n  assume \"n \\<in> NT (tg_userdatatype_as_node_type name data_edge)\"\n  then have \"n = type (id_to_list name) \\<or> n = string\"\n    unfolding tg_userdatatype_as_node_type_def\n    by simp\n  then show \"n \\<in> Lab\\<^sub>t \\<union> Lab\\<^sub>p\"\n    using Lab\\<^sub>p_def Lab\\<^sub>t.simps\n    by blast\nnext\n  fix s l t\n  assume \"(s, l, t) \\<in> ET (tg_userdatatype_as_node_type name data_edge)\"\n  then show \"s \\<in> NT (tg_userdatatype_as_node_type name data_edge) \\<and> l \\<in> Lab\\<^sub>e \\<union> Lab\\<^sub>f \\<and> t \\<in> NT (tg_userdatatype_as_node_type name data_edge)\"\n  proof (intro conjI)\n    assume \"(s, l, t) \\<in> ET (tg_userdatatype_as_node_type name data_edge)\"\n    then show \"s \\<in> NT (tg_userdatatype_as_node_type name data_edge)\"\n      unfolding tg_userdatatype_as_node_type_def\n      by simp\n  next\n    assume \"(s, l, t) \\<in> ET (tg_userdatatype_as_node_type name data_edge)\"\n    then have \"l = edge [data_edge]\"\n      unfolding tg_userdatatype_as_node_type_def\n      by simp\n    then show \"l \\<in> Lab\\<^sub>e \\<union> Lab\\<^sub>f\"\n      by (simp add: Lab\\<^sub>e.rule_edge_labels)\n  next\n    assume \"(s, l, t) \\<in> ET (tg_userdatatype_as_node_type name data_edge)\"\n    then show \"t \\<in> NT (tg_userdatatype_as_node_type name data_edge)\"\n      unfolding tg_userdatatype_as_node_type_def\n      by simp\n  qed\nnext\n  have \"Relation.Field (inh (tg_userdatatype_as_node_type name data_edge)) = {type (id_to_list name), string}\"\n    unfolding tg_userdatatype_as_node_type_def\n    by fastforce\n  then show \"Relation.Field (inh (tg_userdatatype_as_node_type name data_edge)) = NT (tg_userdatatype_as_node_type name data_edge)\"\n    unfolding tg_userdatatype_as_node_type_def\n    by simp\nnext\n  fix e\n  assume e_def: \"e \\<in> ET (tg_userdatatype_as_node_type name data_edge)\"\n  have \"multiplicity_pair (\\<^bold>0..\\<^emph>, \\<^bold>1..\\<^bold>1)\"\n  proof (intro multiplicity_pair.intro)\n    show \"multiplicity (m_in (\\<^bold>0..\\<^emph>, \\<^bold>1..\\<^bold>1))\"\n      by (simp add: multiplicity_def)\n  next\n    show \"multiplicity (m_out (\\<^bold>0..\\<^emph>, \\<^bold>1..\\<^bold>1))\"\n      by (simp add: multiplicity_def)\n  qed\n  then show \"multiplicity_pair (mult (tg_userdatatype_as_node_type name data_edge) e)\"\n    using e_def\n    unfolding tg_userdatatype_as_node_type_def\n    by simp\nnext\n  show \"Partial_order (inh (tg_userdatatype_as_node_type name data_edge))\"\n    unfolding partial_order_on_def preorder_on_def\n  proof (intro conjI)\n    show \"Refl (inh (tg_userdatatype_as_node_type name data_edge))\"\n      unfolding refl_on_def tg_userdatatype_as_node_type_def\n      by simp\n  next\n    show \"trans (inh (tg_userdatatype_as_node_type name data_edge))\"\n      unfolding trans_def tg_userdatatype_as_node_type_def\n      by simp\n  next\n    show \"antisym (inh (tg_userdatatype_as_node_type name data_edge))\"\n      unfolding antisym_def tg_userdatatype_as_node_type_def\n      by simp\n  qed\nqed (simp_all add: tg_userdatatype_as_node_type_def)\n\nlemma tg_userdatatype_as_node_type_combine_inh:\n  assumes \"type_graph TG\"\n  shows \"(inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+ =\n    inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge)\"\nproof\n  show \"(inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+ \\<subseteq>\n    inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge)\"\n  proof\n    fix x\n    assume \"x \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+\"\n    then have \"x \\<in> (inh TG)\\<^sup>+ \\<union> inh (tg_userdatatype_as_node_type name data_edge)\"\n    proof (induct x)\n      case (Pair a b)\n      then show ?case\n      proof (induct)\n        case (base y)\n        then show ?case\n          by auto\n      next\n        case (step y z)\n        then show ?case\n        proof (elim UnE)\n          assume yz_def: \"(y, z) \\<in> inh TG\"\n          assume ay_def: \"(a, y) \\<in> (inh TG)\\<^sup>+\"\n          show ?thesis\n            using yz_def ay_def\n            by auto\n        next\n          assume yz_def: \"(y, z) \\<in> inh (tg_userdatatype_as_node_type name data_edge)\"\n          assume ay_def: \"(a, y) \\<in> (inh TG)\\<^sup>+\"\n          show ?thesis\n            using yz_def ay_def\n            unfolding tg_userdatatype_as_node_type_def\n            by auto\n        next\n          assume yz_def: \"(y, z) \\<in> inh TG\"\n          assume ay_def: \"(a, y) \\<in> inh (tg_userdatatype_as_node_type name data_edge)\"\n          show ?thesis\n            using yz_def ay_def\n            unfolding tg_userdatatype_as_node_type_def\n            by auto\n        next\n          assume yz_def: \"(y, z) \\<in> inh (tg_userdatatype_as_node_type name data_edge)\"\n          assume ay_def: \"(a, y) \\<in> inh (tg_userdatatype_as_node_type name data_edge)\"\n          show ?thesis\n            using yz_def ay_def\n            unfolding tg_userdatatype_as_node_type_def\n            by auto\n        qed\n      qed\n    qed\n    then show \"x \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge)\"\n      by (simp add: assms type_graph.validity_inh_trans)\n  qed\nnext\n  show \"inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge) \\<subseteq>\n    (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+\"\n    by auto\nqed\n\nlemma tg_userdatatype_as_node_type_combine_correct:\n  assumes \"type_graph TG\"\n  assumes combined_node_types: \"NT TG \\<inter> {type (id_to_list name), string} \\<subseteq> {string}\"\n  shows \"type_graph (tg_combine TG (tg_userdatatype_as_node_type name data_edge))\"\nproof (intro tg_combine_merge_correct)\n  show \"type_graph (tg_userdatatype_as_node_type name data_edge)\"\n    by (fact tg_userdatatype_as_node_type_correct)\nnext\n  show \"ET TG \\<inter> ET (tg_userdatatype_as_node_type name data_edge) = {}\"\n    unfolding tg_userdatatype_as_node_type_def\n    using assms type_graph.structure_edges_wellformed_src_node\n    by fastforce\nnext\n  fix l s1 t1 s2 t2\n  assume edge1: \"(s1, l, t1) \\<in> ET TG\"\n  assume edge2: \"(s2, l, t2) \\<in> ET TG\"\n  assume \"(s1, s2) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+ - inh TG \\<or>\n    (s2, s1) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+ - inh TG\"\n  then have \"(s1, s2) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge) - inh TG \\<or>\n    (s2, s1) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge) - inh TG\"\n    by (simp add: assms tg_userdatatype_as_node_type_combine_inh)\n  then have \"(s1, s2) \\<in> inh (tg_userdatatype_as_node_type name data_edge) \\<or>\n    (s2, s1) \\<in> inh (tg_userdatatype_as_node_type name data_edge)\"\n    by blast\n  then have src_eq: \"s1 = s2\"\n    unfolding tg_userdatatype_as_node_type_def\n    by auto\n  assume \"(t1, t2) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+ \\<or>\n    (t2, t1) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+\"\n  then have \"(t1, t2) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge) \\<or>\n    (t2, t1) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge)\"\n    by (simp add: assms tg_userdatatype_as_node_type_combine_inh)\n  then have \"(t1, t2) \\<in> inh TG \\<or> (t2, t1) \\<in> inh TG \\<or> \n    (t1, t2) = (type (id_to_list name), type (id_to_list name)) \\<or> (t1, t2) = (string, string)\"\n    unfolding tg_userdatatype_as_node_type_def\n    by auto\n  then have tgt_eq: \"t1 = t2\"\n  proof (elim disjE)\n    assume \"(t1, t2) \\<in> inh TG\"\n    then show ?thesis\n      using assms(1) edge1 edge2 src_eq type_graph.structure_edges_wellformed_src_node \n      using type_graph.validity_edges_inh type_graph.validity_inh_node\n      by fastforce\n  next\n    assume \"(t2, t1) \\<in> inh TG\"\n    then show ?thesis\n      using assms(1) edge1 edge2 src_eq type_graph.structure_edges_wellformed_src_node \n      using type_graph.validity_edges_inh type_graph.validity_inh_node\n      by fastforce\n  qed (simp_all)\n  show \"s1 = s2 \\<and> t1 = t2\"\n    using src_eq tgt_eq\n    by simp\nnext\n  fix l s1 t1 s2 t2\n  assume edge1: \"(s1, l, t1) \\<in> ET TG\"\n  assume edge2: \"(s2, l, t2) \\<in> ET TG\"\n  assume \"(t1, t2) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+ - inh TG \\<or>\n    (t2, t1) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+ - inh TG\"\n  then have \"(t1, t2) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge) - inh TG \\<or>\n    (t2, t1) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge) - inh TG\"\n    by (simp add: assms tg_userdatatype_as_node_type_combine_inh)\n  then have \"(t1, t2) \\<in> inh (tg_userdatatype_as_node_type name data_edge) \\<or>\n    (t2, t1) \\<in> inh (tg_userdatatype_as_node_type name data_edge)\"\n    by blast\n  then have tgt_eq: \"t1 = t2\"\n    unfolding tg_userdatatype_as_node_type_def\n    by auto\n  assume \"(s1, s2) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+ \\<or>\n    (s2, s1) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+\"\n  then have \"(s1, s2) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge) \\<or>\n    (s2, s1) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge)\"\n    by (simp add: assms tg_userdatatype_as_node_type_combine_inh)\n  then have \"(s1, s2) \\<in> inh TG \\<or> (s2, s1) \\<in> inh TG \\<or> \n    (s1, s2) = (type (id_to_list name), type (id_to_list name)) \\<or> (s1, s2) = (string, string)\"\n    unfolding tg_userdatatype_as_node_type_def\n    by auto\n  then have src_eq: \"s1 = s2\"\n  proof (elim disjE)\n    assume \"(s1, s2) \\<in> inh TG\"\n    then show ?thesis\n      using assms(1) edge1 edge2 tgt_eq type_graph.structure_edges_wellformed_tgt_node \n      using type_graph.validity_edges_inh type_graph.validity_inh_node\n      by fastforce\n  next\n    assume \"(s2, s1) \\<in> inh TG\"\n    then show ?thesis\n      using assms(1) edge1 edge2 tgt_eq type_graph.structure_edges_wellformed_tgt_node \n      using type_graph.validity_edges_inh type_graph.validity_inh_node\n      by fastforce\n  qed (simp_all)\n  show \"s1 = s2 \\<and> t1 = t2\"\n    using src_eq tgt_eq\n    by simp\nnext\n  fix l s1 t1 s2 t2\n  assume edge1: \"(s1, l, t1) \\<in> ET TG\"\n  assume \"(s2, l, t2) \\<in> ET (tg_userdatatype_as_node_type name data_edge)\"\n  then have edge2: \"(s2, l, t2) = (type (id_to_list name), edge [data_edge], string)\"\n    unfolding tg_userdatatype_as_node_type_def\n    by simp\n  then have not_inh_tg: \"(s1, s2) \\<notin> inh TG \\<and> (s2, s1) \\<notin> inh TG\"\n    using assms type_graph.structure_inheritance_wellformed_first_node \n    using type_graph.structure_inheritance_wellformed_second_node\n    by fastforce\n  assume \"(s1, s2) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+ \\<or>\n    (s2, s1) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+\"\n  then have \"(s1, s2) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge) \\<or>\n    (s2, s1) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge)\"\n    by (simp add: assms tg_userdatatype_as_node_type_combine_inh)\n  then have src_eq: \"s1 = s2\"\n    unfolding tg_userdatatype_as_node_type_def\n    using not_inh_tg\n    by auto\n  assume \"(t1, t2) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+ \\<or>\n    (t2, t1) \\<in> (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+\"\n  then have \"(t1, t2) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge) \\<or>\n    (t2, t1) \\<in> inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge)\"\n    by (simp add: assms tg_userdatatype_as_node_type_combine_inh)\n  then show \"s1 = s2 \\<and> t1 = t2\"\n    using assms(1) edge1 edge2 src_eq not_inh_tg \n    using type_graph.structure_edges_wellformed_src_node type_graph.validity_inh_node\n    by blast\nnext\n  have \"antisym (inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\"\n    using assms type_graph.validity_inh_antisym\n    unfolding antisym_def tg_userdatatype_as_node_type_def\n    by simp\n  then show \"antisym ((inh TG \\<union> inh (tg_userdatatype_as_node_type name data_edge))\\<^sup>+)\"\n    by (simp add: assms tg_userdatatype_as_node_type_combine_inh)\nqed (simp_all add: tg_userdatatype_as_node_type_def assms)\n\n\nsubsection \"Transformation functions\"\n\ndefinition tmod_userdatatype_to_tg_userdatatype_as_node_type :: \"'t \\<Rightarrow> 't type_model \\<Rightarrow> ('t list) type_graph\" where\n  \"tmod_userdatatype_to_tg_userdatatype_as_node_type data_edge Tmod = \\<lparr>\n    NT = type ` id_to_list ` UserDataType Tmod \\<union> {string},\n    ET = type ` id_to_list ` UserDataType Tmod \\<times> {edge [data_edge]} \\<times> {string},\n    inh = type ` id_to_list ` UserDataType Tmod \\<times> type ` id_to_list ` UserDataType Tmod \\<union> {(string, string)},\n    abs = {},\n    mult = (\\<lambda>x. (if x \\<in> type ` id_to_list ` UserDataType Tmod \\<times> {edge [data_edge]} \\<times> {string} then (\\<^bold>0..\\<^emph>, \\<^bold>1..\\<^bold>1) else undefined)),\n    contains = {}\n  \\<rparr>\"\n\nlemma tmod_userdatatype_to_tg_userdatatype_as_node_type_proj:\n  shows \"tmod_userdatatype_to_tg_userdatatype_as_node_type data_edge (tmod_userdatatype name) = tg_userdatatype_as_node_type name data_edge\"\n  unfolding tmod_userdatatype_to_tg_userdatatype_as_node_type_def tmod_userdatatype_def tg_userdatatype_as_node_type_def\n  by auto\n\nlemma tmod_userdatatype_to_tg_userdatatype_as_node_type_func:\n  shows \"tg_combine_mapping_function (tmod_userdatatype_to_tg_userdatatype_as_node_type data_edge) (tmod_userdatatype name) (tg_userdatatype_as_node_type name data_edge)\"\n  by (intro tg_combine_mapping_function.intro)\n    (auto simp add: tmod_userdatatype_to_tg_userdatatype_as_node_type_def tmod_userdatatype_def tg_userdatatype_as_node_type_def tmod_combine_def)\n\ndefinition tg_userdatatype_as_node_type_to_tmod_userdatatype :: \"('t list) type_graph \\<Rightarrow> 't type_model\" where\n  \"tg_userdatatype_as_node_type_to_tmod_userdatatype TG = \\<lparr>\n    Class = {},\n    Enum = {},\n    UserDataType = list_to_id ` unlabel ` (NT TG \\<inter> Lab\\<^sub>t),\n    Field = {},\n    FieldSig = (\\<lambda>x. undefined),\n    EnumValue = {},\n    Inh = {},\n    Prop = {},\n    Constant = {},\n    ConstType = (\\<lambda>x. undefined)\n  \\<rparr>\"\n\nlemma tg_userdatatype_as_node_type_to_tmod_userdatatype_proj:\n  shows \"tg_userdatatype_as_node_type_to_tmod_userdatatype (tg_userdatatype_as_node_type name data_edge) = tmod_userdatatype name\"\nproof-\n  have \"list_to_id ` unlabel ` {type (id_to_list name)} = {name}\"\n    by (simp add: id_to_list_inverse)\n  then have \"list_to_id ` unlabel ` ({type (id_to_list name), string} \\<inter> Lab\\<^sub>t) = {name}\"\n    by (simp add: Lab\\<^sub>t.rule_type_labels)\n  then have \"list_to_id ` unlabel ` (NT (tg_userdatatype_as_node_type name data_edge) \\<inter> Lab\\<^sub>t) = {name}\"\n    unfolding tg_userdatatype_as_node_type_def\n    by simp\n  then show \"tg_userdatatype_as_node_type_to_tmod_userdatatype (tg_userdatatype_as_node_type name data_edge) = tmod_userdatatype name\"\n    unfolding tg_userdatatype_as_node_type_to_tmod_userdatatype_def tmod_userdatatype_def\n    by simp\nqed\n\nlemma tg_userdatatype_as_node_type_to_tmod_userdatatype_func:\n  shows \"tmod_combine_mapping_function (tg_userdatatype_as_node_type_to_tmod_userdatatype) (tg_userdatatype_as_node_type name data_edge) (tmod_userdatatype name)\"\nproof (intro tmod_combine_mapping_function.intro)\n  show \"tg_userdatatype_as_node_type_to_tmod_userdatatype (tg_userdatatype_as_node_type name data_edge) = tmod_userdatatype name\"\n    by (fact tg_userdatatype_as_node_type_to_tmod_userdatatype_proj)\nnext\n  fix TGX\n  have \"(NT (tg_userdatatype_as_node_type name data_edge) \\<inter> Lab\\<^sub>t) \\<subseteq>\n    (NT (tg_combine (tg_userdatatype_as_node_type name data_edge) TGX) \\<inter> Lab\\<^sub>t)\"\n    unfolding tg_combine_def\n    by fastforce\n  then have \"list_to_id ` unlabel ` (NT (tg_userdatatype_as_node_type name data_edge) \\<inter> Lab\\<^sub>t) \\<subseteq>\n    list_to_id ` unlabel ` (NT (tg_combine (tg_userdatatype_as_node_type name data_edge) TGX) \\<inter> Lab\\<^sub>t)\"\n    by fastforce\n  then show \"UserDataType (tg_userdatatype_as_node_type_to_tmod_userdatatype (tg_userdatatype_as_node_type name data_edge)) \\<subseteq>\n    UserDataType (tg_userdatatype_as_node_type_to_tmod_userdatatype (tg_combine (tg_userdatatype_as_node_type name data_edge) TGX))\"\n    unfolding tg_userdatatype_as_node_type_to_tmod_userdatatype_def\n    by simp\nqed (simp_all add: tg_userdatatype_as_node_type_to_tmod_userdatatype_def)\n\nend", "meta": {"author": "RemcodM", "repo": "thesis-ecore-groove-formalisation", "sha": "a0e860c4b60deb2f3798ae2ffc09f18a98cf42ca", "save_path": "github-repos/isabelle/RemcodM-thesis-ecore-groove-formalisation", "path": "github-repos/isabelle/RemcodM-thesis-ecore-groove-formalisation/thesis-ecore-groove-formalisation-a0e860c4b60deb2f3798ae2ffc09f18a98cf42ca/isabelle/Ecore-GROOVE-Mapping-Library/UserDataTypeType.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.679178686187839, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3395893430939195}}
{"text": "theory newzfc imports ZFC_in_HOL.ZFC_in_HOL\nbegin\n\naxiomatization Collect :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a set\" \\<comment> \\<open>comprehension\\<close>\n  and member :: \"'a \\<Rightarrow> 'a set \\<Rightarrow> bool\" \\<comment> \\<open>membership\\<close>\n  where mem_Collect_eq [iff, code_unfold]: \"member a (Collect P) = P a\"\n    and Collect_mem_eq [simp]: \"Collect (\\<lambda>x. member x A) = A\"\n\n(*\nsyntax\n  \"_Coll\" :: \"pttrn \\<Rightarrow> bool \\<Rightarrow> 'a set\"    (\"(1{_./ _})\")\ntranslations\n  \"{x. P}\" \\<rightleftharpoons> \"CONST Collect (\\<lambda>x. P)\"\n\nclass top =\n  fixes top :: 'a (\"\\<top>\")\n*)\n(*\ndefinition image :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a set \\<Rightarrow> 'b set\"    (infixr \"`\" 90)\n  where \"f ` A = {y. \\<exists>x\\<in>A. y = f x}\"\n*)\nabbreviation UNIV :: \"'a set\"\n  where \"UNIV \\<equiv> top\"\n\nabbreviation range :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'b set\"  \\<comment> \\<open>of function\\<close>\n  where \"range f \\<equiv> f ` UNIV\"\n\nclass Sup =\n  fixes Sup :: \"'a set \\<Rightarrow> 'a\"  (\"\\<Squnion>\")\n\n(*\nabbreviation Union :: \"'a set set \\<Rightarrow> 'a set\"  (\"\\<Union>\")\n  where \"\\<Union>S \\<equiv> \\<Squnion>S\"\n*)\ndefinition Pow :: \"'a set \\<Rightarrow> 'a set set\"\n  where Pow_def: \"Pow A = {B. B \\<subseteq> A}\"\n\ndefinition inv_into :: \"'a set \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> ('b \\<Rightarrow> 'a)\" where\n\"inv_into A f = (\\<lambda>x. SOME y. y \\<in> A \\<and> f y = x)\"\n\nlemma inv_into_def2: \"inv_into A f x = (SOME y. y \\<in> A \\<and> f y = x)\"\nby(simp add: inv_into_def)\n\nabbreviation inv :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('b \\<Rightarrow> 'a)\" where\n\"inv \\<equiv> inv_into UNIV\"\n\ndefinition wf :: \"('a \\<times> 'a) set \\<Rightarrow> bool\"\n  where \"wf r \\<longleftrightarrow> (\\<forall>P. (\\<forall>x. (\\<forall>y. (y, x) \\<in> r \\<longrightarrow> P y) \\<longrightarrow> P x) \\<longrightarrow> (\\<forall>x. P x))\"\n\naxiomatization elts :: \"V \\<Rightarrow> V set\"\n where ext [intro?]:    \"elts x = elts y \\<Longrightarrow> x=y\"\n   and down_raw:        \"Y \\<subseteq> elts x \\<Longrightarrow> Y \\<in> range elts\"\n   and Union_raw:       \"X \\<in> range elts \\<Longrightarrow> Union (elts ` X) \\<in> range elts\"\n   and Pow_raw:         \"X \\<in> range elts \\<Longrightarrow> inv elts ` Pow X \\<in> range elts\"\n   and replacement_raw: \"X \\<in> range elts \\<Longrightarrow> f ` X \\<in> range elts\"\n   and inf_raw:         \"range (g :: nat \\<Rightarrow> V) \\<in> range elts\"\n   and foundation:      \"wf {(x,y). x \\<in> elts y}\"\n\n\ntheorem t1 : \\<open>A \\<Longrightarrow> A\\<close>\nproof -\n  assume H:\\<open>A\\<close>\n  show \\<open>A\\<close>\n    by (rule  H)\nqed\n\naxiomatization qwe :: \"bool set\"\n\ntheorem t2 : \\<open>elts 0=elts 0\\<close>\n  oops\n(**)\n\nend", "meta": {"author": "georgydunaev", "repo": "article_isabelle_in_zfc", "sha": "29480bab0a514a1d07a5259dd57fe41e48f3dbeb", "save_path": "github-repos/isabelle/georgydunaev-article_isabelle_in_zfc", "path": "github-repos/isabelle/georgydunaev-article_isabelle_in_zfc/article_isabelle_in_zfc-29480bab0a514a1d07a5259dd57fe41e48f3dbeb/newzfc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.749087201911703, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.33953264946317313}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2009-2       |\n            |                October 2010  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2017         |\n            |                  April 2018  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory Domain_T_cpo \nimports Domain_T CSP.CPO\nbegin\n\n(*****************************************************************\n\n         1. Domain_T is a pointed cpo.\n         2. \n         3. \n         4. \n\n *****************************************************************)\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(*********************************************************\n                      Bottom in Dom_T\n *********************************************************)\n(* isabelle 2009-1\ninstance domT :: (type) bot0\nby (intro_classes)\n\ndefs (overloaded)\n  bottom_domT_def   :  \"Bot == {<>}t\"\n*)\n\ninstantiation domT :: (type) bot0\nbegin\n\ndefinition\n  bottom_domT_def : \"Bot == {<>}t\"\n\ninstance ..\n\nend\n\n\nlemma bottom_domT : \"Bot <= (T::'a domT)\"\nby (simp add: bottom_domT_def)\n\ninstance domT :: (type) bot\napply (intro_classes)\nby (simp add: bottom_domT)\n\n(********************************************************** \n      lemmas used in a proof that domain_T is a cpo.\n **********************************************************)\n\n(* UnionT Ts is an upper bound of Ts *)\n\nlemma UnionT_isUB : \"(UnionT Ts) isUB Ts\"\napply (simp add: isUB_def)\napply (simp add: subdomT_iff)\napply (intro allI impI)\napply (subgoal_tac \"Ts ~= {}\")\napply (simp)\napply (rule_tac x=y in bexI)\nby (auto)\n\n(* UnionT Ts is the least upper bound of Ts *)\n\nlemma UnionT_isLUB : \"Ts ~= {} ==> UnionT Ts isLUB Ts\"\napply (simp add: isLUB_def UnionT_isUB)\napply (simp add: isUB_def)\napply (simp add: subdomT_iff)\napply (intro allI impI)\napply (erule bexE)\napply (drule_tac x=\"T\" in spec)\nby (simp)\n\n(* the least upper bound of Ts is UnionT Ts *)\n\nlemma isLUB_UnionT_only_if: \"[| Ts ~= {} ; T isLUB Ts |] ==> T = UnionT Ts\"\napply (insert UnionT_isLUB[of Ts])\napply (simp)\napply (rule LUB_unique)\nby (simp_all)\n\n(* iff *)\n\nlemma isLUB_UnionT : \"Ts ~= {} ==> (T isLUB Ts) = (T = UnionT Ts)\"\napply (rule iffI)\napply (simp add: isLUB_UnionT_only_if)\napply (simp add: UnionT_isLUB)\ndone\n\n(* LUB is UnionT Ts *)\n\nlemma LUB_UnionT : \"Ts ~= {} ==> LUB Ts = UnionT Ts\"\nby (simp add: isLUB_LUB UnionT_isLUB)\n\n(********************************************************** \n                 ( domT, <= ) is a CPO\n **********************************************************)\n\ninstance domT :: (type) cpo\napply (intro_classes)\napply (simp add: hasLUB_def)\napply (rule_tac x=\"UnionT X\" in exI)\napply (simp add: directed_def UnionT_isLUB)\ndone\n\n(********************************************************** \n              ( domT, <= ) is a pointed CPO\n **********************************************************)\n\ninstance domT :: (type) cpo_bot\nby (intro_classes)\n\n(****************** to add them again ******************)\n\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(*\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/Domain_T_cpo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.6039318337259584, "lm_q1q2_score": 0.33951628505760295}}
{"text": "theory MDP_Reachability_Problem\n  imports Markov_Decision_Process\nbegin\n\nlemma (in finite_measure) ereal_integral_real:\n  assumes [measurable]: \"f \\<in> borel_measurable M\" \n  assumes ae: \"AE x in M. 0 \\<le> f x\" \"AE x in M. f x \\<le> ereal B\"\n  shows \"ereal (\\<integral>x. real (f x) \\<partial>M) = (\\<integral>\\<^sup>+x. f x \\<partial>M)\"\nproof (subst nn_integral_eq_integral[symmetric])\n  show \"integrable M (\\<lambda>x. real (f x))\"\n    using ae by (intro integrable_const_bound[where B=B]) (auto simp: real_le_ereal_iff)\n  show \"AE x in M. 0 \\<le> real (f x)\"\n    using ae by (auto simp: real_of_ereal_pos)\n  show \"(\\<integral>\\<^sup>+ x. ereal (real (f x)) \\<partial>M) = integral\\<^sup>N M f\"\n    using ae by (intro nn_integral_cong_AE) (auto simp: ereal_real)\nqed\n\nlemma (in MC_syntax) AE_not_suntil_coinduct [consumes 1, case_names \\<psi> \\<phi>]:\n  assumes \"P s\"\n  assumes \\<psi>: \"\\<And>s. P s \\<Longrightarrow> s \\<notin> \\<psi>\"\n  assumes \\<phi>: \"\\<And>s t. P s \\<Longrightarrow> s \\<in> \\<phi> \\<Longrightarrow> t \\<in> K s \\<Longrightarrow> P t\"\n  shows \"AE \\<omega> in T s. not (HLD \\<phi> suntil HLD \\<psi>) (s ## \\<omega>)\"\nproof -\n  { fix \\<omega> have \"\\<not> (HLD \\<phi> suntil HLD \\<psi>) (s ## \\<omega>) \\<longleftrightarrow>\n      (\\<forall>n. \\<not> ((\\<lambda>R. HLD \\<psi> or (HLD \\<phi> aand nxt R)) ^^ n) \\<bottom> (s ## \\<omega>))\"\n      unfolding suntil_def\n      by (subst continuous_lfp)\n         (auto simp add: Order_Continuity.continuous_def) }\n  moreover \n  { fix n from `P s` have \"AE \\<omega> in T s. \\<not> ((\\<lambda>R. HLD \\<psi> or (HLD \\<phi> aand nxt R)) ^^ n) \\<bottom> (s ## \\<omega>)\"\n    proof (induction n arbitrary: s)\n      case (Suc n) then show ?case\n        apply (subst AE_T_iff)\n        apply (rule measurable_compose[OF measurable_Stream, where M1=\"count_space UNIV\"])\n        apply measurable\n        apply simp\n        apply (auto simp: bot_fun_def intro!: AE_impI dest: \\<phi> \\<psi>)\n        done\n    qed simp }\n  ultimately show ?thesis\n    by (simp add: AE_all_countable)\nqed\n\nlemma (in MC_syntax) AE_not_suntil_coinduct_strong [consumes 1, case_names \\<psi> \\<phi>]:\n  assumes \"P s\"\n  assumes P_\\<psi>: \"\\<And>s. P s \\<Longrightarrow> s \\<notin> \\<psi>\"\n  assumes P_\\<phi>: \"\\<And>s t. P s \\<Longrightarrow> s \\<in> \\<phi> \\<Longrightarrow> t \\<in> K s \\<Longrightarrow> P t \\<or> \n    (AE \\<omega> in T t. not (HLD \\<phi> suntil HLD \\<psi>) (t ## \\<omega>))\"\n  shows \"AE \\<omega> in T s. not (HLD \\<phi> suntil HLD \\<psi>) (s ## \\<omega>)\" (is \"?nuntil s\")\nproof -\n  have \"P s \\<or> ?nuntil s\"\n    using `P s` by auto\n  then show ?thesis\n  proof (coinduction arbitrary: s rule: AE_not_suntil_coinduct)\n    case (\\<phi> t s) then show ?case\n      by (auto simp: AE_T_iff[of _ s] suntil_Stream[of _ _ s] dest: P_\\<phi>)\n  qed (auto simp: suntil_Stream dest: P_\\<psi>)\nqed\n\ndeclare [[coercion real_of_rat]]\n\nlemma of_rat_setsum: \"of_rat (\\<Sum>a\\<in>A. f a) = (\\<Sum>a\\<in>A. of_rat (f a))\"\n  by (induct rule: infinite_finite_induct) (auto simp: of_rat_add)\n\nlemma setsum_strict_mono_single: \n  fixes f :: \"_ \\<Rightarrow> 'a :: {comm_monoid_add,ordered_cancel_ab_semigroup_add}\"\n  shows \"finite A \\<Longrightarrow> a \\<in> A \\<Longrightarrow> f a < g a \\<Longrightarrow> (\\<And>a. a \\<in> A \\<Longrightarrow> f a \\<le> g a) \\<Longrightarrow> setsum f A < setsum g A\"\n  using setsum_strict_mono_ex1[of A f g] by auto\n\nlemma prob_space_point_measure:\n  \"finite S \\<Longrightarrow> (\\<And>s. s \\<in> S \\<Longrightarrow> 0 \\<le> p s) \\<Longrightarrow> (\\<Sum>s\\<in>S. p s) = 1 \\<Longrightarrow> prob_space (point_measure S p)\"\n  by (rule prob_spaceI) (simp add: space_point_measure emeasure_point_measure_finite)\n\nlemma diff_mono:\n  fixes a b c d :: \"'a :: ordered_ab_group_add\"\n  assumes \"a \\<le> b\" \"d \\<le> c\" shows \"a - c \\<le> b - d\"\n  unfolding diff_conv_add_uminus by (intro add_mono le_imp_neg_le assms)\n\ninductive_set directed_towards :: \"'a set \\<Rightarrow> ('a \\<times> 'a) set \\<Rightarrow> 'a set\" for A r where\n  start: \"\\<And>x. x \\<in> A \\<Longrightarrow> x \\<in> directed_towards A r\"\n| step: \"\\<And>x y. y \\<in> directed_towards A r \\<Longrightarrow> (x, y) \\<in> r \\<Longrightarrow> x \\<in> directed_towards A r\"\n\nhide_fact (open) start step\n\nlemma directed_towards_mono:\n  assumes \"s \\<in> directed_towards A F\" \"F \\<subseteq> G\" shows \"s \\<in> directed_towards A G\"\n  using assms by induct (auto intro: directed_towards.intros)\n\n\nlocale Reachability_Problem = Finite_Markov_Decision_Process K S for K :: \"'s \\<Rightarrow> 's pmf set\" and S +\n  fixes S1 S2 :: \"'s set\"\n  assumes S1: \"S1 \\<subseteq> S\" and S2: \"S2 \\<subseteq> S\" and S1_S2: \"S1 \\<inter> S2 = {}\"\nbegin\n\nlemma [measurable]:\n  \"S \\<in> sets (count_space UNIV)\" \"S1 \\<in> sets (count_space UNIV)\" \"S2 \\<in> sets (count_space UNIV)\"\n  by auto\n\ndefinition\n  \"v = (\\<lambda>cfg\\<in>valid_cfg. emeasure (T cfg) {x\\<in>space St. (HLD S1 suntil HLD S2) (state cfg ## x)})\"\n\nlemma v_eq: \"cfg \\<in> valid_cfg \\<Longrightarrow>\n    v cfg = emeasure (T cfg) {x\\<in>space St. (HLD S1 suntil HLD S2) (state cfg ## x)}\"\n  by (auto simp add: v_def)\n\nlemma v_nonneg: \"cfg \\<in> valid_cfg \\<Longrightarrow> 0 \\<le> v cfg\"\n  by (auto simp add: v_def emeasure_nonneg)\n\nlemma real_v: \"cfg \\<in> valid_cfg \\<Longrightarrow> real (v cfg) = \\<P>(\\<omega> in T cfg. (HLD S1 suntil HLD S2) (state cfg ## \\<omega>))\"\n  by (auto simp add: v_def T.emeasure_eq_measure)\n\nlemma v_le_1: \"cfg \\<in> valid_cfg \\<Longrightarrow> v cfg \\<le> 1\"\n  by (auto simp add: v_def T.emeasure_eq_measure one_ereal_def)\n\nlemma v_neq_Pinf[simp]: \"cfg \\<in> valid_cfg \\<Longrightarrow> v cfg \\<noteq> \\<infinity>\"\n  by (auto simp add: v_def)\n\nlemma v_neq_Minf[simp]: \"cfg \\<in> valid_cfg \\<Longrightarrow> v cfg \\<noteq> - \\<infinity>\"\n  by (auto simp add: v_def)\n\nlemma v_neq_Inf[simp]: \"cfg \\<in> valid_cfg \\<Longrightarrow> \\<bar>v cfg\\<bar> \\<noteq> \\<infinity>\"\n  by (auto intro!: ereal_infinity_cases)\n\nlemma v_1_AE: \"cfg \\<in> valid_cfg \\<Longrightarrow> v cfg = 1 \\<longleftrightarrow> (AE \\<omega> in T cfg. (HLD S1 suntil HLD S2) (state cfg ## \\<omega>))\"\n  unfolding v_eq T.emeasure_eq_measure ereal_eq_1 space_T[symmetric, of cfg]\n  by (rule T.prob_Collect_eq_1) simp\n\nlemma v_0_AE: \"cfg \\<in> valid_cfg \\<Longrightarrow> v cfg = 0 \\<longleftrightarrow> (AE x in T cfg. not (HLD S1 suntil HLD S2) (state cfg ## x))\"\n  unfolding v_eq T.emeasure_eq_measure ereal_eq_0 space_T[symmetric, of cfg]\n  by (rule T.prob_Collect_eq_0) simp\n\nlemma v_S2[simp]: \"cfg \\<in> valid_cfg \\<Longrightarrow> state cfg \\<in> S2 \\<Longrightarrow> v cfg = 1\"\n  using S2 by (subst v_1_AE) (auto simp: suntil_Stream)\n\nlemma v_nS12[simp]: \"cfg \\<in> valid_cfg \\<Longrightarrow> state cfg \\<notin> S1 \\<Longrightarrow> state cfg \\<notin> S2 \\<Longrightarrow> v cfg = 0\"\n  by (subst v_0_AE) (auto simp: suntil_Stream)\n\nlemma v_nS[simp]: \"cfg \\<notin> valid_cfg \\<Longrightarrow> v cfg = undefined\"\n  by (auto simp add: v_def)\n\nlemma v_S1:\n  assumes cfg[simp, intro]: \"cfg \\<in> valid_cfg\" and cfg_S1[simp]: \"state cfg \\<in> S1\"\n  shows \"v cfg = (\\<integral>\\<^sup>+s. v (cont cfg s) \\<partial>action cfg)\"\nproof -\n  have [simp]: \"state cfg \\<notin> S2\"\n    using cfg_S1 S1_S2 S1 by blast\n  show ?thesis\n    by (auto simp: v_eq emeasure_Collect_T[of _ cfg] K_cfg_def map_pmf.rep_eq nn_integral_distr\n                   AE_measure_pmf_iff suntil_Stream[of _ _ \"state cfg\"]\n                   valid_cfg_cont\n             intro!: nn_integral_cong_AE)\nqed\n\nlemma real_v_integrable:\n  \"integrable (action cfg) (\\<lambda>s. real (v (cont cfg s)))\"\n  by (rule measure_pmf.integrable_const_bound[where B=\"max 1 (real \\<bar>undefined::ereal\\<bar>)\"])\n     (auto simp add: v_def emeasure_nonneg measure_def[symmetric] le_max_iff_disj)\n\nlemma real_v_integral_eq:\n  assumes cfg[simp]: \"cfg \\<in> valid_cfg\"\n  shows \"real (\\<integral>\\<^sup>+ s. v (cont cfg s) \\<partial>action cfg) = \\<integral> s. real (v (cont cfg s)) \\<partial>action cfg\"\n by (subst integral_eq_nn_integral)\n    (auto simp: AE_measure_pmf_iff measure_nonneg v_eq T.emeasure_eq_measure valid_cfg_cont\n          intro!: arg_cong[where f=real] nn_integral_cong_AE)\n\n\n\n\ndefinition \"p = (\\<lambda>s\\<in>S. P_sup s (\\<lambda>\\<omega>. (HLD S1 suntil HLD S2) (s ## \\<omega>)))\"\n\nlemma p_eq_SUP_v: \"s \\<in> S \\<Longrightarrow> p s = (SUP cfg : cfg_on s. v cfg)\"\n  by (auto simp add: p_def v_def P_sup_def T.emeasure_eq_measure intro: valid_cfgI intro!: SUP_cong)\n\nlemma v_le_p: \"cfg \\<in> valid_cfg \\<Longrightarrow> v cfg \\<le> p (state cfg)\"\n  by (subst p_eq_SUP_v) (auto intro!: SUP_upper dest: valid_cfgD valid_cfg_state_in_S)\n\nlemma p_eq_0_imp: \"cfg \\<in> valid_cfg \\<Longrightarrow> p (state cfg) = 0 \\<Longrightarrow> v cfg = 0\"\n  using v_le_p[of cfg] v_nonneg[of cfg] by (auto intro: antisym)\n\nlemma p_eq_0_iff: \"s \\<in> S \\<Longrightarrow> p s = 0 \\<longleftrightarrow> (\\<forall>cfg\\<in>cfg_on s. v cfg = 0)\"\n  unfolding p_eq_SUP_v by (subst SUP_eq_iff) (auto intro: v_nonneg[OF valid_cfgI])\n\nlemma p_le_1: \"s \\<in> S \\<Longrightarrow> p s \\<le> 1\"\n  by (auto simp: p_eq_SUP_v intro!: SUP_least v_le_1 intro: valid_cfgI)\n\nlemma p_nonneg: \"s \\<in> S \\<Longrightarrow> 0 \\<le> p s\"\n  by (auto simp: p_eq_SUP_v intro!: v_nonneg SUP_upper2[of \"simple arb_act s\"])\n\nlemma p_undefined[simp]: \"s \\<notin> S \\<Longrightarrow> p s = undefined\"\n  by (simp add: p_def)\n\nlemma p_not_inf[simp]: \"s \\<in> S \\<Longrightarrow> p s \\<noteq> \\<infinity>\" \"s \\<in> S \\<Longrightarrow> p s \\<noteq> -\\<infinity>\"\n  using p_nonneg[of s] p_le_1[of s] by auto\n\nlemma p_S1: \"s \\<in> S1 \\<Longrightarrow> p s = (\\<Squnion>D\\<in>K s. \\<integral>\\<^sup>+ t. p t \\<partial>D)\"\n  using S1 S1_S2 K_closed[of s] unfolding p_def\n  by (simp add: P_sup_iterate[of _ s] subset_eq set_eq_iff suntil_Stream[of _ _ s])\n     (auto intro!: SUP_cong nn_integral_cong_AE simp add: AE_measure_pmf_iff)\n\nlemma p_S2[simp]: \"s \\<in> S2 \\<Longrightarrow> p s = 1\"\n  using S2 by (auto simp: v_S2[OF valid_cfgI] p_eq_SUP_v)\n\nlemma p_nS12: \"s \\<in> S \\<Longrightarrow> s \\<notin> S1 \\<Longrightarrow> s \\<notin> S2 \\<Longrightarrow> p s = 0\"\n  by (auto simp: p_eq_SUP_v v_nS12[OF valid_cfgI])\n\nlemma p_pos: \n  assumes \"(s, t) \\<in> (SIGMA s:S1. \\<Union>D\\<in>K s. set_pmf D)\\<^sup>*\" \"t \\<in> S2\" shows \"0 < p s\"\nusing assms proof (induction rule: converse_rtrancl_induct)\n  case (step s t')\n  then obtain D where \"s \\<in> S1\" \"D \\<in> K s\" \"t' \\<in> D\" \"0 < p t'\"\n    by auto\n  with S1 set_pmf_closed[of s D] have in_S: \"\\<And>t. t \\<in> D \\<Longrightarrow> t \\<in> S\"\n    by auto\n  from `t' \\<in> D` `0 < p t'` have \"0 < pmf D t' * p t'\"\n    by (auto simp add: ereal_zero_less_0_iff pmf_positive)\n  also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+t. p t' * indicator {t'} t\\<partial>D)\"\n    using in_S[OF `t' \\<in> D`]\n    by (subst nn_integral_cmult_indicator)\n       (auto intro!: ereal_0_le_mult p_nonneg simp: ac_simps emeasure_pmf_single)\n  also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+t. p t \\<partial>D)\"\n    by (auto intro!: nn_integral_mono_AE p_nonneg split: split_indicator simp: in_S AE_measure_pmf_iff)\n  also have \"\\<dots> \\<le> p s\"\n    using `s \\<in> S1` `D \\<in> K s` by (auto intro: SUP_upper simp add: p_S1)\n  finally show ?case .\nqed simp\n\ndefinition F_sup :: \"('s \\<Rightarrow> ereal) \\<Rightarrow> 's \\<Rightarrow> ereal\" where\n  \"F_sup f = (\\<lambda>s\\<in>S. if s \\<in> S2 then 1 else if s \\<in> S1 then SUP D:K s. \\<integral>\\<^sup>+t. f t \\<partial>D else 0)\"\n\nlemma F_sup_cong: \"(\\<And>s. s \\<in> S \\<Longrightarrow> f s = g s) \\<Longrightarrow> F_sup f s = F_sup g s\"\n  using K_closed[of s]\n  by (auto simp: F_sup_def AE_measure_pmf_iff subset_eq\n              intro!: SUP_cong nn_integral_cong_AE)\n\nlemma continuous_F_sup: \"Order_Continuity.continuous F_sup\"\n  unfolding Order_Continuity.continuous_def fun_eq_iff F_sup_def[abs_def]\n  by (auto simp:  SUP_apply[abs_def] nn_integral_monotone_convergence_SUP intro: SUP_commute)\n\nlemma mono_F_sup: \"mono F_sup\"\n  by (intro continuous_mono continuous_F_sup)\n\nlemma F_sup_nonneg: \"s \\<in> S \\<Longrightarrow> 0 \\<le> F_sup F s\"\n  by (auto simp: F_sup_def intro!: SUP_upper2 nn_integral_nonneg intro: arb_actI)\n\nlemma lfp_F_sup_iterate: \"lfp F_sup = (SUP i. (F_sup ^^ i) (\\<lambda>x\\<in>S. 0))\"\nproof -\n  { have \"(SUP i. (F_sup ^^ i) \\<bottom>) = (SUP i. (F_sup ^^ i) (\\<lambda>x\\<in>S. 0))\"\n    proof (rule SUP_eq)\n      fix i show \"\\<exists>j\\<in>UNIV. (F_sup ^^ i) \\<bottom> \\<le> (F_sup ^^ j) (\\<lambda>x\\<in>S. 0)\"\n        by (intro bexI[of _ i] funpow_mono mono_F_sup) auto\n      have *: \"(\\<lambda>x\\<in>S. 0) \\<le> F_sup \\<bottom>\"\n        using K_wf by (auto simp: F_sup_def le_fun_def) (blast intro: SUP_upper2 nn_integral_nonneg)\n      show \"\\<exists>j\\<in>UNIV. (F_sup ^^ i) (\\<lambda>x\\<in>S. 0) \\<le> (F_sup ^^ j) \\<bottom>\"\n        by (auto intro!: exI[of _ \"Suc i\"] funpow_mono mono_F_sup  *\n                 simp del: funpow.simps simp add: funpow_Suc_right F_sup_nonneg le_funI)\n    qed }\n  then show ?thesis\n    by (auto simp: continuous_lfp continuous_F_sup)\nqed\n\nlemma p_eq_lfp_F_sup: \"p = lfp F_sup\"\nproof -\n  { fix s assume \"s \\<in> S\" let ?F = \"\\<lambda>P. HLD S2 or (HLD S1 aand nxt P)\"\n    have \"P_sup s (\\<lambda>\\<omega>. (HLD S1 suntil HLD S2) (s ## \\<omega>)) = (\\<Squnion>i. P_sup s (\\<lambda>\\<omega>. (?F ^^ i) \\<bottom> (s ## \\<omega>)))\"\n    proof (simp add: suntil_def, rule P_sup_lfp)\n      show \"op ## s \\<in> measurable St St\"\n        by simp\n      (* This proof should work automatically *)\n      fix P assume P: \"Measurable.pred St P\"\n      show \"Measurable.pred St (HLD S2 or (HLD S1 aand (\\<lambda>\\<omega>. P (stl \\<omega>))))\"\n        by (intro pred_intros_logic measurable_compose[OF _ P] measurable_compose[OF measurable_shd]) auto\n    qed (auto simp: Order_Continuity.continuous_def)\n    also have \"\\<dots> = (SUP i. (F_sup ^^ i) (\\<lambda>x\\<in>S. 0) s)\"\n    proof (rule SUP_cong)\n      fix i from `s \\<in> S` show \"P_sup s (\\<lambda>\\<omega>. (?F ^^ i) \\<bottom> (s##\\<omega>)) = (F_sup ^^ i) (\\<lambda>x\\<in>S. 0) s\"\n      proof (induct i arbitrary: s) \n        case (Suc n) show ?case\n        proof (subst P_sup_iterate)\n          (* This proof should work automatically *)\n          show \"Measurable.pred St (\\<lambda>\\<omega>. (?F ^^ Suc n) \\<bottom> (s ## \\<omega>))\"\n            apply (intro measurable_compose[OF measurable_Stream[OF measurable_const measurable_ident_sets[OF refl]] measurable_predpow])\n            apply simp\n            apply (simp add: bot_fun_def[abs_def])\n            apply (intro pred_intros_logic measurable_compose[OF measurable_stl]  measurable_compose[OF measurable_shd])\n            apply auto\n            done\n        next\n          show \"(\\<Squnion>D\\<in>K s. \\<integral>\\<^sup>+ t. P_sup t (\\<lambda>\\<omega>. (?F ^^ Suc n) \\<bottom> (s ## t ## \\<omega>)) \\<partial>D) =\n            (F_sup ^^ Suc n) (\\<lambda>x\\<in>S. 0) s\"\n            unfolding funpow.simps comp_def\n            using S1 S2 `s \\<in> S`\n            by (subst F_sup_cong[OF Suc(1)[symmetric]])\n               (auto simp add: F_sup_def measure_pmf.emeasure_space_1[simplified] K_wf subset_eq)\n        qed\n      qed simp\n    qed simp\n    finally have \"lfp F_sup s = P_sup s (\\<lambda>\\<omega>. (HLD S1 suntil HLD S2) (s ## \\<omega>))\"\n      by (simp add: lfp_F_sup_iterate) }\n  moreover have \"\\<And>s. s \\<notin> S \\<Longrightarrow> lfp F_sup s = undefined\"\n    by (subst lfp_unfold[OF mono_F_sup]) (auto simp add: F_sup_def)\n  ultimately show ?thesis\n    by (auto simp: p_def)\nqed\n\ndefinition \"S\\<^sub>e = {s\\<in>S. p s = 0}\"\n\nlemma S\\<^sub>e: \"S\\<^sub>e \\<subseteq> S\"\n  by (auto simp add: S\\<^sub>e_def)\n\nlemma v_S\\<^sub>e: \"cfg \\<in> valid_cfg \\<Longrightarrow> state cfg \\<in> S\\<^sub>e \\<Longrightarrow> v cfg = 0\"\n  using p_eq_0_imp[of cfg] by (auto simp: S\\<^sub>e_def)\n\nlemma S\\<^sub>e_nS2: \"S\\<^sub>e \\<inter> S2 = {}\"\n  by (auto simp: S\\<^sub>e_def)\n\nlemma S\\<^sub>e_E1: \"s \\<in> S\\<^sub>e \\<inter> S1 \\<Longrightarrow> (s, t) \\<in> E \\<Longrightarrow> t \\<in> S\\<^sub>e\"\n  unfolding S\\<^sub>e_def using S1\n  by (auto simp: p_S1 SUP_eq_iff K_wf nn_integral_nonneg nn_integral_0_iff_AE AE_measure_pmf_iff E_def\n           intro: set_pmf_closed p_nonneg antisym\n           cong: rev_conj_cong)\n\nlemma S\\<^sub>e_E2: \"s \\<in> S1 \\<Longrightarrow> (\\<And>t. (s, t) \\<in> E \\<Longrightarrow> t \\<in> S\\<^sub>e) \\<Longrightarrow> s \\<in> S\\<^sub>e\"\n  unfolding S\\<^sub>e_def using S1 S1_S2\n  by (force simp: p_S1 SUP_eq_iff K_wf nn_integral_nonneg nn_integral_0_iff_AE AE_measure_pmf_iff E_def\n            cong: rev_conj_cong)\n\nlemma S\\<^sub>e_E_iff: \"s \\<in> S1 \\<Longrightarrow> s \\<in> S\\<^sub>e \\<longleftrightarrow> (\\<forall>t. (s, t) \\<in> E \\<longrightarrow> t \\<in> S\\<^sub>e)\"\n  using S\\<^sub>e_E1[of s] S\\<^sub>e_E2[of s] by blast\n\ndefinition \"S\\<^sub>r = S - (S\\<^sub>e \\<union> S2)\"\n\nlemma S\\<^sub>r: \"S\\<^sub>r \\<subseteq> S\"\n  by (auto simp: S\\<^sub>r_def)\n\nlemma S\\<^sub>r_S1: \"S\\<^sub>r \\<subseteq> S1\"\n  by (auto simp: p_nS12 S\\<^sub>r_def S\\<^sub>e_def)\n\nlemma S\\<^sub>r_eq: \"S\\<^sub>r = S1 - S\\<^sub>e\"\n  using S1_S2 S1 S2 by (auto simp add: S\\<^sub>r_def S\\<^sub>e_def p_nS12)\n\nlemma v_neq_0_imp: \"cfg \\<in> valid_cfg \\<Longrightarrow> v cfg \\<noteq> 0 \\<Longrightarrow> state cfg \\<in> S\\<^sub>r \\<union> S2\"\n  using p_eq_0_imp[of cfg] by (auto simp add: S\\<^sub>r_def S\\<^sub>e_def valid_cfg_state_in_S)\n\nlemma valid_cfg_action_in_K: \"cfg \\<in> valid_cfg \\<Longrightarrow> action cfg \\<in> K (state cfg)\"\n  by (auto dest!: valid_cfgD)\n\nlemma K_cfg_E: \"cfg \\<in> valid_cfg \\<Longrightarrow> cfg' \\<in> K_cfg cfg \\<Longrightarrow> (state cfg, state cfg') \\<in> E\"\n  by (auto simp: E_def K_cfg_def set_pmf_map valid_cfg_action_in_K)\n\nlemma S\\<^sub>r_directed_towards_S2:\n  assumes s: \"s \\<in> S\\<^sub>r\"\n  shows \"s \\<in> directed_towards S2 {(s, t) | s t. s \\<in> S\\<^sub>r \\<and> (s, t) \\<in> E}\" (is \"s \\<in> ?D\")\nproof -\n  { fix cfg assume \"s \\<notin> ?D\" \"cfg \\<in> cfg_on s\"\n    with s S\\<^sub>r have \"state cfg \\<in> S\\<^sub>r\" \"state cfg \\<notin> ?D\" \"cfg \\<in> valid_cfg\"\n      by (auto intro: valid_cfgI)\n    then have \"v cfg = 0\"\n    proof (coinduction arbitrary: cfg rule: v_eq_0_coinduct)\n      case (cont cfg' cfg)\n      with v_neq_0_imp[of cfg'] show ?case\n        by (auto intro: directed_towards.intros K_cfg_E)\n    qed (auto intro: directed_towards.intros) }\n  with p_eq_0_iff[of s] s show ?thesis\n    unfolding S\\<^sub>r_def S\\<^sub>e_def by blast\nqed\n\ndefinition \"proper ct \\<longleftrightarrow> ct \\<in> Pi\\<^sub>E S K \\<and> (\\<forall>s\\<in>S\\<^sub>r. v (simple ct s) > 0)\"\n\nlemma S\\<^sub>r_nS2: \"s \\<in> S\\<^sub>r \\<Longrightarrow> s \\<notin> S2\"\n  by (auto simp: S\\<^sub>r_def)\n\nlemma properD1: \"proper ct \\<Longrightarrow> ct \\<in> Pi\\<^sub>E S K\"\n  by (auto simp: proper_def)\n\nlemma proper_eq:\n  assumes ct[simp, intro]: \"ct \\<in> Pi\\<^sub>E S K\"\n  shows \"proper ct \\<longleftrightarrow> S\\<^sub>r \\<subseteq> directed_towards S2 (SIGMA s:S\\<^sub>r. ct s)\"\n    (is \"_ \\<longleftrightarrow> _ \\<subseteq> ?D\")\nproof -\n  have *[simp]: \"\\<And>s. s \\<in> S\\<^sub>r \\<Longrightarrow> s \\<in> S\" and ct': \"ct \\<in> Pi S K\"\n    using ct by (auto simp: S\\<^sub>r_def simp del: ct)\n  { fix s t have \"s \\<in> S \\<Longrightarrow> t \\<in> ct s \\<Longrightarrow> t \\<in> S\"\n      using K_closed[of s] ct' by (auto simp add: subset_eq) }\n  note ct_closed = this\n\n  let ?C = \"simple ct\"\n  from ct have valid_C[simp]: \"\\<And>s. s \\<in> S \\<Longrightarrow> ?C s \\<in> valid_cfg\"\n    by (auto simp add: PiE_def)\n  { fix s assume \"s \\<in> ?D\"\n    then have \"0 < v (?C s)\"\n    proof induct\n      case (step s t)\n      then have s: \"s \\<in> S\\<^sub>r\" and t: \"t \\<in> ct s\" and [simp]: \"s \\<in> S\"\n        by auto\n      with S\\<^sub>r_S1 ct have \"v (?C s) = (\\<integral>\\<^sup>+t. v (?C t) \\<partial>ct s)\"\n        by (subst v_S1) auto\n      also have \"\\<dots> \\<noteq> 0\"\n        using ct t\n        by (subst nn_integral_0_iff_AE) (auto simp add: Pi_iff AE_measure_pmf_iff not_le step intro!: bexI[of _ t])\n      finally show ?case\n        using ct by (auto simp add: less_le v_nonneg)\n    qed (subst v_S2, insert S2, auto) }\n  moreover\n  { fix s assume s: \"s \\<notin> ?D\" \"s \\<in> S\\<^sub>r\"\n    with ct' have C: \"?C s \\<in> cfg_on s\" and [simp]: \"s \\<in> S\"\n      by auto\n    from s have \"v (?C s) = 0\"\n    proof (coinduction arbitrary: s rule: v_eq_0_coinduct)\n      case (cont cfg s)\n      with S1 obtain t where \"cfg = ?C t\" \"t \\<in> ct s\" \"s \\<in> S\"\n        by (auto simp: set_K_cfg subset_eq)\n      with cont(1,2) v_neq_0_imp[of \"?C t\"] ct_closed[of s t] show ?case\n        by (intro exI[of _ t] disjCI) (auto intro: directed_towards.intros)\n    qed (auto simp: S\\<^sub>r_nS2) }\n  ultimately show ?thesis\n    unfolding proper_def using ct by (force simp del: v_nS v_S2 v_nS12 ct)\nqed\n\nlemma exists_proper:\n  obtains ct where \"proper ct\"\nproof atomize_elim\n  def r \\<equiv> \"rec_nat S2 (\\<lambda>_ S'. {s\\<in>S\\<^sub>r. \\<exists>t\\<in>S'. (s, t) \\<in> E})\"\n  then have [simp]: \"r 0 = S2\" \"\\<And>n. r (Suc n) = {s\\<in>S\\<^sub>r. \\<exists>t\\<in>r n. (s, t) \\<in> E}\"\n    by simp_all\n\n  { fix s assume \"s \\<in> S\\<^sub>r\"\n    then have \"s \\<in> directed_towards S2 {(s, t) | s t. s \\<in> S\\<^sub>r \\<and> (s, t) \\<in> E}\"\n      by (rule S\\<^sub>r_directed_towards_S2)\n    from this `s\\<in>S\\<^sub>r` have \"\\<exists>n. s \\<in> r n\"\n    proof induction\n      case (step s t)\n      show ?case\n      proof cases\n        assume \"t \\<in> S2\" with step.prems step.hyps show ?thesis\n          by (intro exI[of _ \"Suc 0\"]) force\n      next\n        assume \"t \\<notin> S2\"\n        with step obtain n where \"t \\<in> r n\" \"t \\<in> S\\<^sub>r\"\n          by (auto elim: directed_towards.cases)\n        with `t\\<in>S\\<^sub>r` step.hyps show ?thesis\n          by (intro exI[of _ \"Suc n\"]) force\n      qed\n    qed (simp add: S\\<^sub>r_def) }\n  note r = this\n\n  { fix s assume \"s \\<in> S\"\n    have \"\\<exists>D\\<in>K s. s \\<in> S\\<^sub>r \\<longrightarrow> (\\<exists>t\\<in>D. \\<exists>n. t \\<in> r n \\<and> (\\<forall>m. s \\<in> r m \\<longrightarrow> n < m))\"\n    proof cases\n      assume s: \"s \\<in> S\\<^sub>r\"\n      def n \\<equiv> \"LEAST n. s \\<in> r n\"\n      then have \"s \\<in> r n\" and n: \"\\<And>i. i < n \\<Longrightarrow> s \\<notin> r i\"\n        using r s by (auto intro: LeastI_ex dest: not_less_Least)\n      with s have \"n \\<noteq> 0\"\n        by (intro notI) (auto simp: S\\<^sub>r_def)\n      then obtain n' where \"n = Suc n'\"\n        by (cases n) auto\n      with `s \\<in> r n` obtain t D where \"D \\<in> K s\" \"t \\<in> D\" \"t \\<in> r n'\"\n        by (auto simp: E_def)\n      with n `n = Suc n'` s show ?thesis\n        by (auto intro!: bexI[of _ D] bexI[of _ t] exI[of _ n'] simp: not_less_eq[symmetric])\n    qed (insert K_wf `s\\<in>S`, auto) }\n  then obtain ct where ct: \"\\<And>s. s \\<in> S \\<Longrightarrow> ct s \\<in> K s\"\n    \"\\<And>s. s \\<in> S \\<Longrightarrow> s \\<in> S\\<^sub>r \\<Longrightarrow> \\<exists>t\\<in>ct s. \\<exists>n. t \\<in> r n \\<and> (\\<forall>m. s \\<in> r m \\<longrightarrow> n < m)\"\n    by metis\n  then have *: \"restrict ct S \\<in> Pi\\<^sub>E S K\"\n    by auto\n\n  moreover\n  { fix s assume \"s \\<in> S\\<^sub>r\"\n    then obtain n where \"s \\<in> r n\"\n      by (metis r)\n    with `s \\<in> S\\<^sub>r` have \"s \\<in> directed_towards S2 (SIGMA s : S\\<^sub>r. ct s)\"\n    proof (induction n arbitrary: s rule: less_induct)\n      case (less n s)\n      moreover with S\\<^sub>r have \"s \\<in> S\" by auto\n      ultimately obtain t m where \"t \\<in> ct s\" \"t \\<in> r m\" \"m < n\"\n        using ct[of s] by (auto simp: E_def)\n      with less.IH[of m t] `s \\<in> S\\<^sub>r` show ?case\n        by (cases m) (auto intro: directed_towards.intros)\n    qed }\n\n  ultimately show \"\\<exists>ct. proper ct\"\n    using S\\<^sub>r S2\n    by (auto simp: proper_eq[OF *] subset_eq\n             intro!: exI[of _ \"restrict ct S\"]\n             cong: Sigma_cong)\nqed\n\ndefinition \"l_desc X ct l s \\<longleftrightarrow>\n    s \\<in> directed_towards S2 (SIGMA s : X. {l s}) \\<and>\n    v (simple ct s) \\<le> v (simple ct (l s)) \\<and>\n    l s \\<in> maximal (\\<lambda>s. v (simple ct s)) (ct s)\"\n\nlemma exists_l_desc:\n  assumes ct: \"proper ct\"\n  shows \"\\<exists>l\\<in>S\\<^sub>r \\<rightarrow> S\\<^sub>r \\<union> S2. \\<forall>s\\<in>S\\<^sub>r. l_desc S\\<^sub>r ct l s\"\nproof -\n  have ct_closed: \"\\<And>s t. s \\<in> S \\<Longrightarrow> t \\<in> ct s \\<Longrightarrow> t \\<in> S\"\n    using ct K_closed by (auto simp: proper_def PiE_iff)\n  have ct_Pi: \"ct \\<in> Pi S K\"\n    using ct by (auto simp: proper_def)\n\n  have \"finite S\\<^sub>r\"\n    using S_finite by (auto simp: S\\<^sub>r_def)\n  then show ?thesis\n  proof (induct rule: finite_induct_select)\n    case (select X)\n    then obtain l where l: \"l \\<in> X \\<rightarrow> X \\<union> S2\" and desc: \"\\<And>s. s \\<in> X \\<Longrightarrow> l_desc X ct l s\"\n      by auto\n    obtain x where x: \"x \\<in> S\\<^sub>r - X\"\n      using `X \\<subset> S\\<^sub>r` by auto\n    then have \"x \\<in> S\"\n      by (auto simp: S\\<^sub>r_def)\n\n    let ?C = \"simple ct\"\n    let ?v = \"\\<lambda>s. v (?C s)\" and ?E = \"\\<lambda>s. set_pmf (ct s)\"\n    let ?M = \"\\<lambda>s. maximal ?v (?E s)\"\n\n    have finite_E[simp]: \"\\<And>s. s \\<in> S \\<Longrightarrow> finite (?E s)\"\n      using K_closed ct by (intro finite_subset[OF _ S_finite]) (auto simp: proper_def subset_eq)\n\n    have valid_C[simp]: \"\\<And>s. s \\<in> S \\<Longrightarrow> ?C s \\<in> valid_cfg\"\n      using ct by (auto simp: proper_def intro!: simple_valid_cfg)\n    \n    have E_ne[simp]: \"\\<And>s. ?E s \\<noteq> {}\"\n        by (rule set_pmf_not_empty)\n\n    have \"\\<exists>s\\<in>S\\<^sub>r - X. \\<exists>t\\<in>?M s. t \\<in> S2 \\<union> X\"\n    proof (rule ccontr)\n      assume \"\\<not> ?thesis\"\n      then have not_M: \"\\<And>s. s \\<in> S\\<^sub>r - X \\<Longrightarrow> ?M s \\<inter> (S2 \\<union> X) = {}\"\n        by auto\n\n      let ?S\\<^sub>m = \"maximal ?v (S\\<^sub>r - X)\"\n\n      have \"finite (S\\<^sub>r - X)\" \"S\\<^sub>r - X \\<noteq> {}\"\n        using `X \\<subset> S\\<^sub>r` by (auto intro!: finite_subset[OF _ S_finite] simp: S\\<^sub>r_def)\n      from maximal_ne[OF this] obtain s\\<^sub>m where s\\<^sub>m: \"s\\<^sub>m \\<in> ?S\\<^sub>m\"\n        by force\n\n      have \"\\<exists>s\\<^sub>0\\<in>?S\\<^sub>m. \\<exists>t\\<in>?E s\\<^sub>0. t \\<notin> ?S\\<^sub>m\"\n      proof (rule ccontr)\n        assume \"\\<not> ?thesis\"\n        then have S\\<^sub>m: \"\\<And>s\\<^sub>0 t. s\\<^sub>0 \\<in> ?S\\<^sub>m \\<Longrightarrow> t \\<in> ?E s\\<^sub>0 \\<Longrightarrow> t \\<in> ?S\\<^sub>m\" by blast\n        from `s\\<^sub>m \\<in> ?S\\<^sub>m` have [simp]: \"s\\<^sub>m \\<in> S\" and \"s\\<^sub>m \\<in> S\\<^sub>r\"\n          by (auto simp: S\\<^sub>r_def dest: maximalD1)\n\n        from `s\\<^sub>m \\<in> ?S\\<^sub>m` have \"v (?C s\\<^sub>m) = 0\"\n        proof (coinduction arbitrary: s\\<^sub>m rule: v_eq_0_coinduct)\n          case (cont t s\\<^sub>m) with S1 show ?case\n            by (intro exI[of _ \"state t\"] disjCI conjI S\\<^sub>m[of s\\<^sub>m \"state t\"])\n               (auto simp: set_K_cfg)\n        qed (auto simp: S\\<^sub>r_def ct_Pi dest!: maximalD1)\n        with `s\\<^sub>m \\<in> S\\<^sub>r` `proper ct` show False\n          by (auto simp: proper_def)\n      qed\n      then obtain s\\<^sub>0 t where \"s\\<^sub>0 \\<in> ?S\\<^sub>m\" and t: \"t \\<in> ?E s\\<^sub>0\" \"t \\<notin> ?S\\<^sub>m\"\n        by metis\n      with S\\<^sub>r_S1 have s\\<^sub>0: \"s\\<^sub>0 \\<in> S\\<^sub>r - X\" and [simp]: \"s\\<^sub>0 \\<in> S\" and \"s\\<^sub>0 \\<in> S1\"\n        by (auto simp: S\\<^sub>r_def dest: maximalD1)\n\n      { fix t assume t: \"t \\<in> S2 \\<union> X\" \"t \\<in> ?E s\\<^sub>0\" and \"?v s\\<^sub>0 \\<le> ?v t\"\n        have \"maximal ?v (?E s\\<^sub>0 \\<inter> (S2 \\<union> X)) \\<noteq> {}\"\n          using finite_E t by (intro maximal_ne) auto\n        moreover\n        { fix x y assume x: \"x \\<in> S2 \\<union> X\" \"x \\<in> ?E s\\<^sub>0\" \n            and *: \"\\<forall>y\\<in>?E s\\<^sub>0 \\<inter> (S2 \\<union> X). ?v y \\<le> ?v x\" and y: \"y \\<in> ?E s\\<^sub>0\"\n          with S2 `s\\<^sub>0 \\<in> S`[THEN ct_closed] have [simp]: \"x \\<in> S\" \"y \\<in> S\"\n            by auto\n\n          have \"?v y \\<le> ?v x\"\n          proof cases\n            assume \"y \\<in> S\\<^sub>r - X\"\n            then have \"?v y \\<le> ?v s\\<^sub>0\"\n              using `s\\<^sub>0 \\<in> ?S\\<^sub>m` by (auto intro: maximalD2)\n            also note `?v s\\<^sub>0 \\<le> ?v t`\n            also have \"?v t \\<le> ?v x\"\n              using * t by auto\n            finally show ?thesis .\n          next\n            assume \"y \\<notin> S\\<^sub>r - X\" with y * show ?thesis\n              by (auto simp: S\\<^sub>r_def v_S\\<^sub>e[of \"?C y\"] v_nonneg[of \"?C x\"] ct_Pi)\n          qed }\n        then have \"maximal ?v (?E s\\<^sub>0 \\<inter> (S2 \\<union> X)) \\<subseteq> maximal ?v (?E s\\<^sub>0)\"\n          by (auto simp: maximal_def)\n        moreover note not_M[OF s\\<^sub>0]\n        ultimately have False\n          by (blast dest: maximalD1) }\n      then have less_s\\<^sub>0: \"\\<And>t. t \\<in> S2 \\<union> X \\<Longrightarrow> t \\<in> ?E s\\<^sub>0 \\<Longrightarrow> ?v t < ?v s\\<^sub>0\"\n        by (auto simp add: not_le[symmetric])\n\n      let ?K = \"ct s\\<^sub>0\"\n      from `proper ct` `s\\<^sub>0 \\<in> S` s\\<^sub>0 have \"?v s\\<^sub>0 \\<noteq> 0\"\n        by (auto simp add: proper_def)\n\n      have \"?v s\\<^sub>0 = (\\<integral>\\<^sup>+ x. ?v x \\<partial>?K)\"\n        using v_S1[of \"?C s\\<^sub>0\"] `s\\<^sub>0 \\<in> S1` `s\\<^sub>0 \\<in> S` by (simp add: ct_Pi)\n      also have \"\\<dots> < (\\<integral>\\<^sup>+x. ?v s\\<^sub>0 \\<partial>?K)\"\n      proof (intro nn_integral_less)\n        have \"(\\<integral>\\<^sup>+x. ?v x \\<partial>?K) \\<le> (\\<integral>\\<^sup>+x. 1 \\<partial>?K)\"\n          using ct ct_closed[of s\\<^sub>0]\n          by (intro nn_integral_mono_AE)\n             (auto intro!: v_le_1 simp: AE_measure_pmf_iff proper_def ct_Pi)\n        then show \"(\\<integral>\\<^sup>+x. ?v x \\<partial>?K) \\<noteq> \\<infinity>\"\n          by auto\n        have \"?v t < ?v s\\<^sub>0\"\n        proof cases\n          assume \"t \\<in> S2 \\<union> X\" then show ?thesis\n            using less_s\\<^sub>0[of t] t by simp\n        next\n          assume \"t \\<notin> S2 \\<union> X\"\n          show ?thesis\n          proof cases\n            assume \"t \\<in> S\\<^sub>e\" with `?v s\\<^sub>0 \\<noteq> 0` v_S\\<^sub>e[of \"?C t\"] S\\<^sub>e v_nonneg[of \"?C s\\<^sub>0\"] show ?thesis\n              by (auto simp: subset_eq ct_Pi)\n          next\n            assume \"t \\<notin> S\\<^sub>e\"\n            with t(1) `t \\<notin> S2 \\<union> X` ct_closed[of s\\<^sub>0 t] have \"t \\<in> S\\<^sub>r - X\"\n              unfolding S\\<^sub>r_def by (auto simp: E_def)\n            with t(2) show ?thesis\n              using `s\\<^sub>0 \\<in> ?S\\<^sub>m` by (auto simp: maximal_def not_le intro: less_le_trans)\n          qed\n        qed\n        then show \"\\<not> (AE x in ?K. ?v s\\<^sub>0 \\<le> ?v x)\"\n          using t by (auto simp: not_le AE_measure_pmf_iff E_def cong del: AE_cong intro!: exI[of _ \"t\"])\n\n        show \"AE x in ?K. ?v x \\<le> ?v s\\<^sub>0\"\n        proof (subst AE_measure_pmf_iff, safe)\n          fix t assume t: \"t \\<in> ?E s\\<^sub>0\"\n          show \"?v t \\<le> ?v s\\<^sub>0\"\n          proof cases\n            assume \"t \\<in> S2 \\<union> X\" then show ?thesis\n              using less_s\\<^sub>0[of t] t by simp\n          next\n            assume \"t \\<notin> S2 \\<union> X\"\n            show ?thesis\n            proof cases\n              assume \"t \\<in> S\\<^sub>e\"\n              then have \"?v t = 0\"\n                by (simp add: p_eq_0_imp S\\<^sub>e_def ct_Pi)\n              with `?v s\\<^sub>0 \\<noteq> 0` show ?thesis\n                by (auto simp: v_nonneg ct_Pi)\n            next\n              assume \"t \\<notin> S\\<^sub>e\" with t `s\\<^sub>0 \\<in> ?S\\<^sub>m` `t \\<notin> S2 \\<union> X` `s\\<^sub>0 \\<in> S` show ?thesis\n                by (elim maximalD2) (auto simp: S\\<^sub>r_def intro!: ct_closed[of _ t])\n            qed\n          qed\n        qed\n      next\n        show \"AE x in measure_pmf (ct s\\<^sub>0). 0 \\<le> v (?C x)\"\n          using ct_Pi K_closed[of s\\<^sub>0] `s\\<^sub>0 \\<in> S`\n          by (auto simp add: AE_measure_pmf_iff subset_eq Pi_iff intro!: v_nonneg[OF valid_C])\n      qed auto\n      also have \"\\<dots> = ?v s\\<^sub>0\"\n        using `s\\<^sub>0 \\<in> S` measure_pmf.emeasure_space_1[of \"ct s\\<^sub>0\"] by (simp add: v_nonneg[OF valid_C])\n      finally show False\n        by simp\n    qed\n    then obtain s t where s: \"s \\<in> S\\<^sub>r - X\" and t: \"t \\<in> S2 \\<union> X\" \"t \\<in> ?M s\"\n      by auto\n    with S2 `X \\<subset> S\\<^sub>r` have \"s \\<notin> S2\" and \"s \\<in> S \\<and> s \\<notin> S2\" and \"s \\<notin> X\"and [simp]: \"t \\<in> S\"\n      by (auto simp add: S\\<^sub>r_def)\n    def l' \\<equiv> \"l(s := t)\"\n    then have l'_s[simp, intro]: \"l' s = t\"\n      by simp\n\n    let ?D = \"\\<lambda>X l. directed_towards S2 (SIGMA s : X. {l s})\"\n    { fix s' assume \"s' \\<in> ?D X l\" \"s' \\<in> X\"\n      from this(1) have \"s' \\<in> ?D (insert s X) l'\"\n        by (rule directed_towards_mono) (auto simp: l'_def `s \\<notin> X`) }\n    note directed_towards_l' = this\n\n    show ?case\n    proof (intro bexI ballI, elim insertE)\n      show \"s \\<in> S\\<^sub>r - X\" by fact\n      show \"l' \\<in> insert s X \\<rightarrow> insert s X \\<union> S2\"\n        using s t l by (auto simp: l'_def)\n    next\n      fix s' assume s': \"s' \\<in> X\"\n      moreover\n      from desc[OF this] have \"s' \\<in> ?D X l\" and *: \"?v s' \\<le> ?v (l s')\" \"l s' \\<in> ?M s'\"\n        by (auto simp: l_desc_def)\n      moreover have \"l' s' = l s'\"\n        using `s' \\<in> X` s by (auto simp add: l'_def)\n      ultimately show \"l_desc (insert s X) ct l' s'\"\n        by (auto simp: l_desc_def intro!: directed_towards_l')\n    next\n      fix s' assume \"s' = s\"\n      show \"l_desc (insert s X) ct l' s'\"\n        unfolding `s' = s` l_desc_def l'_s\n      proof (intro conjI)\n        show \"s \\<in> ?D (insert s X) l'\"\n        proof cases\n          assume \"t \\<notin> S2\"\n          with t have \"t \\<in> X\" by auto\n          with desc have \"t \\<in> ?D X l\"  \n            by (simp add: l_desc_def)\n          then show ?thesis\n            by (force intro: directed_towards.step[OF directed_towards_l'] `t \\<in> X`)\n        qed (force intro: directed_towards.step directed_towards.start)\n\n        from `s \\<in> S\\<^sub>r - X` S\\<^sub>r_S1 have [simp]: \"s \\<in> S1\" \"s \\<in> S\"\n          by (auto simp: S\\<^sub>r_def)\n        show \"?v s \\<le> ?v t\"\n          using t(2)[THEN maximalD2] ct\n          by (auto simp add: v_S1 AE_measure_pmf_iff proper_def Pi_iff PiE_def\n                   intro!: measure_pmf.nn_integral_le_const v_nonneg)\n      qed fact\n    qed\n  qed simp\nqed\n\nlemma F_v_memoryless:\n  obtains ct where \"ct \\<in> Pi\\<^sub>E S K\" \"v\\<circ>simple ct = F_sup (v\\<circ>simple ct)\"\nproof atomize_elim\n  def R \\<equiv> \"{(ct(s := D), ct) | ct s D.\n    ct \\<in> Pi\\<^sub>E S K \\<and> proper ct \\<and>\n    s \\<in> S\\<^sub>r \\<and> D \\<in> K s \\<and> v (simple ct s) < (\\<integral>\\<^sup>+t. v (simple ct t) \\<partial>D) }\"\n\n  { fix ct ct' assume ct_ct': \"(ct', ct) \\<in> R\"\n    let ?v = \"\\<lambda>s. v (simple ct s)\" and ?v' = \"\\<lambda>s. v (simple ct' s)\"\n\n    from ct_ct' obtain s D where \"ct \\<in> Pi\\<^sub>E S K\" \"proper ct\" and s: \"s \\<in> S\\<^sub>r\" and D: \"D \\<in> K s\"\n      and not_maximal: \"?v s < (\\<integral>\\<^sup>+t. ?v t \\<partial>D)\" and ct'_eq: \"ct' = ct(s := D)\"\n      by (auto simp: R_def)\n    with S\\<^sub>r_S1 have ct: \"ct \\<in> Pi S K\" and \"s \\<in> S\" and \"s \\<in> S1\"\n      by (auto simp: S\\<^sub>r_def)\n    then have valid_ct[simp]: \"\\<And>s. s \\<in> S \\<Longrightarrow> simple ct s \\<in> cfg_on s\"\n      by simp\n\n    from ct'_eq have [simp]: \"ct' s = D\" \"\\<And>t. t \\<noteq> s \\<Longrightarrow> ct' t = ct t\"\n      by simp_all\n\n    from ct_ct' S\\<^sub>r have ct'_E: \"ct' \\<in> Pi\\<^sub>E S K\"\n      by (auto simp: ct'_eq R_def)\n    from ct s D have ct': \"ct' \\<in> Pi S K\"\n      by (auto simp: ct'_eq)\n    then have valid_ct'[simp]: \"\\<And>s. s \\<in> S \\<Longrightarrow> simple ct' s \\<in> cfg_on s\"\n      by simp\n    \n    from exists_l_desc[OF `proper ct`]\n    obtain l where l: \"l \\<in> S\\<^sub>r \\<rightarrow> S\\<^sub>r \\<union> S2\" and \"\\<And>s. s \\<in> S\\<^sub>r \\<Longrightarrow> l_desc S\\<^sub>r ct l s\"\n      by auto\n    then have directed_l: \"\\<And>s. s \\<in> S\\<^sub>r \\<Longrightarrow> s \\<in> directed_towards S2 (SIGMA s:S\\<^sub>r. {l s})\"\n      and v_l_mono: \"\\<And>s. s \\<in> S\\<^sub>r \\<Longrightarrow> ?v s \\<le> ?v (l s)\"\n      and l_in_Ea: \"\\<And>s. s \\<in> S\\<^sub>r \\<Longrightarrow> l s \\<in> ct s\"\n      by (auto simp: l_desc_def dest!: maximalD1)\n\n    let ?E = \"\\<lambda>ct. SIGMA s:S\\<^sub>r. ct s\"\n    let ?D = \"\\<lambda>ct. directed_towards S2 (?E ct)\"\n\n    have finite_E[simp]: \"\\<And>s. s \\<in> S \\<Longrightarrow> finite (ct' s)\"\n      using ct' K_closed by (intro rev_finite_subset[OF S_finite]) auto\n    \n    have \"maximal ?v (ct' s) \\<noteq> {}\"\n      using ct' D `s\\<in>S` finite_E[of s] by (intro maximal_ne set_pmf_not_empty) (auto simp del: finite_E)\n    then obtain s' where s': \"s' \\<in> maximal ?v (ct' s)\"\n      by blast\n    with K_closed[OF `s \\<in> S`] D have \"s' \\<in> S\"\n      by (auto dest!: maximalD1)\n\n    have \"s' \\<noteq> s\"\n    proof\n      assume [simp]: \"s' = s\"\n      have \"?v s < (\\<integral>\\<^sup>+t. ?v t \\<partial>D)\"\n        by fact\n      also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+t. ?v s \\<partial>D)\"\n        using `s \\<in> S` s' D by (intro nn_integral_mono_AE) (auto simp: AE_measure_pmf_iff intro: maximalD2)\n      finally show False\n        using measure_pmf.emeasure_space_1[of D] by (simp add: v_nonneg `s \\<in> S` ct)\n    qed\n\n    have \"p s' \\<noteq> 0\"\n    proof\n      assume \"p s' = 0\"\n      then have \"?v s' = 0\"\n        using v_le_p[of \"simple ct s'\"] ct `s' \\<in> S` by (auto intro!: antisym v_nonneg ct)\n      then have \"(\\<integral>\\<^sup>+t. ?v t \\<partial>D) = 0\"\n        using maximalD2[OF s'] by (subst nn_integral_0_iff_AE) (auto simp: `s\\<in>S` D AE_measure_pmf_iff)\n      then have \"?v s < 0\"\n        using not_maximal by auto\n      then show False\n        using v_nonneg[of \"simple ct s\"] `s\\<in>S` by (simp add: ct)\n    qed\n    with `s' \\<in> S` have \"s' \\<in> S2 \\<union> S\\<^sub>r\"\n      by (auto simp: S\\<^sub>r_def S\\<^sub>e_def)\n\n    have l_acyclic: \"(s', s) \\<notin> (SIGMA s:S\\<^sub>r. {l s})^+\"\n    proof\n      assume \"(s', s) \\<in> (SIGMA s:S\\<^sub>r. {l s})^+\"\n      then have \"?v s' \\<le> ?v s\"  \n        by induct (blast intro: order_trans v_l_mono)+\n      also have \"\\<dots> < (\\<integral>\\<^sup>+t. ?v t \\<partial>D)\"\n        using not_maximal .\n      also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+t. ?v s' \\<partial>D)\"\n        using s' by (intro nn_integral_mono_AE) (auto simp: `s \\<in> S` D AE_measure_pmf_iff intro: maximalD2)\n      finally show False\n        using measure_pmf.emeasure_space_1[of D] by (simp add: v_nonneg `s' \\<in> S` ct)\n    qed\n\n    from `s' \\<in> S2 \\<union> S\\<^sub>r` have \"s' \\<in> ?D ct'\"\n    proof\n      assume \"s' \\<in> S\\<^sub>r\"\n      then have \"l s' \\<in> directed_towards S2 (SIGMA s:S\\<^sub>r. {l s})\"\n        using l directed_l[of \"l s'\"] by (auto intro: directed_towards.start)\n      moreover from `s' \\<in> S\\<^sub>r` have \"(s', l s') \\<in> (SIGMA s:S\\<^sub>r. {l s})^+\"\n        by auto\n      ultimately have \"l s' \\<in> ?D ct'\"\n      proof induct\n        case (step t t')\n        then have t: \"t \\<noteq> s\" \"t \\<in> S\\<^sub>r\" \"t' = l t\"\n          using l_acyclic by auto\n\n        from step have \"(s', t') \\<in> (SIGMA s:S\\<^sub>r. {l s})\\<^sup>+\"\n          by (blast intro: trancl_into_trancl)\n        from step(2)[OF this] show ?case\n          by (rule directed_towards.step) (simp add: l_in_Ea t)\n      qed (rule directed_towards.start)\n      then show \"s' \\<in> ?D ct'\"\n        by (rule directed_towards.step)\n           (simp add: l_in_Ea `s' \\<in> S\\<^sub>r` `s \\<in> S\\<^sub>r` `s' \\<noteq> s`)\n    qed (rule directed_towards.start)\n\n    have proper: \"proper ct'\"\n      unfolding proper_eq[OF ct'_E]\n    proof\n      fix t assume \"t \\<in> S\\<^sub>r\"\n      from directed_l[OF this] show \"t \\<in> ?D ct'\"\n      proof induct\n        case (step t t')\n        show ?case\n        proof cases\n          assume \"t = s\"\n          with `s \\<in> S\\<^sub>r` s'[THEN maximalD1] have \"(t, s') \\<in> ?E ct'\"\n            by auto\n          with `s' \\<in> ?D ct'` show ?thesis\n            by (rule directed_towards.step)\n        next\n          assume \"t \\<noteq> s\"\n          with step have \"(t, t') \\<in> ?E ct'\"\n            by (auto simp: l_in_Ea)\n          with step.hyps(2) show ?thesis\n            by (rule directed_towards.step)\n        qed\n      qed (rule directed_towards.start)\n    qed\n\n    have \"?v \\<le> ?v'\"\n    proof (intro le_funI leI notI)\n      fix t' assume *: \"?v' t' < ?v t'\"\n      then have \"t' \\<in> S\"\n        by (metis v_nS simple_valid_cfg_iff ct' ct order.irrefl)\n\n      def \\<Delta> \\<equiv> \"\\<lambda>t. real (?v t) - real (?v' t)\"\n      with * `t' \\<in> S` v_nonneg[of \"simple ct' t'\"] have \"0 < \\<Delta> t'\"\n        by (cases \"?v t'\" \"?v' t'\" rule: ereal2_cases) (auto simp add: ct' ct)\n\n      { fix t assume t: \"t \\<in> maximal \\<Delta> S\"\n        with `t' \\<in> S` have \"\\<Delta> t' \\<le> \\<Delta> t\"\n          by (auto intro: maximalD2)\n        with `0 < \\<Delta> t'` have \"0 < \\<Delta> t\" by simp\n        with t have \"t \\<in> S\\<^sub>r\"\n          by (auto simp add: S\\<^sub>r_def v_S\\<^sub>e ct ct' \\<Delta>_def dest!: maximalD1) }\n      note max_is_S\\<^sub>r = this\n\n      { fix s assume \"s \\<in> S\"\n        with v_nonneg[of \"simple ct' s\"] v_le_1[of \"simple ct' s\"] \n             v_nonneg[of \"simple ct s\"] v_le_1[of \"simple ct s\"]\n        have \"\\<bar>\\<Delta> s\\<bar> \\<le> 1\"\n          by (cases \"?v s\" \"?v' s\" rule: ereal2_cases)\n             (auto simp: \\<Delta>_def one_ereal_def abs_real_def ct ct') }\n      note \\<Delta>_le_1[simp] = this\n      then have ereal_\\<Delta>: \"\\<And>s. s \\<in> S \\<Longrightarrow> \\<Delta> s = ?v s - ?v' s\"\n        by (auto simp add: \\<Delta>_def v_def T.emeasure_eq_measure ct ct')\n      \n      from `s \\<in> S` S_finite have \"maximal \\<Delta> S \\<noteq> {}\"\n        by (intro maximal_ne) auto\n      then obtain t where \"t \\<in> maximal \\<Delta> S\" by auto\n      from max_is_S\\<^sub>r[OF this] proper have \"t \\<in> ?D ct'\"\n        unfolding proper_eq[OF ct'_E] by auto\n      from this `t \\<in> maximal \\<Delta> S` show False\n      proof induct\n        case (start t)\n        then have \"t \\<in> S\\<^sub>r\"\n          by (intro max_is_S\\<^sub>r)\n        with `t \\<in> S2` show False\n          by (auto simp: S\\<^sub>r_def)\n      next\n        case (step t t')\n        then have t': \"t' \\<in> ct' t\" and \"t \\<in> S\\<^sub>r\" and t: \"t \\<in> maximal \\<Delta> S\"\n          by (auto intro: max_is_S\\<^sub>r simp: comp_def)\n        then have \"t' \\<in> S\" \"t \\<in> S1\" \"t \\<in> S\"\n          using S\\<^sub>r_S1 S1 \n          by (auto simp: Pi_closed[OF ct'])\n  \n        have \"\\<Delta> t \\<le> \\<Delta> t'\"\n        proof (intro leI notI)\n          assume less: \"\\<Delta> t' < \\<Delta> t\"\n          have \"(\\<integral>s. \\<Delta> s \\<partial>ct' t) < (\\<integral>s. \\<Delta> t \\<partial>ct' t)\"\n          proof (intro measure_pmf.integral_less_AE)\n            show \"emeasure (ct' t) {t'} \\<noteq> 0\" \"{t'} \\<in> sets (ct' t)\"\n              \"AE s in ct' t. s\\<in>{t'} \\<longrightarrow> \\<Delta> s \\<noteq> \\<Delta> t\"\n              using t' less by (auto simp add: emeasure_pmf_single_eq_zero_iff)\n            show \"AE s in ct' t. \\<Delta> s \\<le> \\<Delta> t\"\n              using ct' ct t D\n              by (auto simp add: AE_measure_pmf_iff ct `t\\<in>S` Pi_iff E_def Pi_closed[OF ct']\n                       intro!: maximalD2[of t \\<Delta>] intro: Pi_closed[OF ct'] maximalD1)\n            show \"integrable (ct' t) (\\<lambda>_. \\<Delta> t)\" \"integrable (ct' t) \\<Delta>\"\n              using ct ct' `t \\<in> S` D\n              by (auto intro!: measure_pmf.integrable_const_bound[where B=1] \\<Delta>_le_1\n                       simp: AE_measure_pmf_iff dest: Pi_closed)\n          qed\n          also have \"\\<dots> = \\<Delta> t\"\n            using measure_pmf.prob_space[of \"ct' t\"] by simp\n          also have \"\\<Delta> t \\<le> (\\<integral>s. real (?v s) \\<partial>ct' t) - (\\<integral>s. real (?v' s) \\<partial>ct' t)\"\n          proof -\n            have \"?v t \\<le> (\\<integral>\\<^sup>+s. ?v s \\<partial>ct' t)\"\n            proof cases\n              assume \"t = s\" with not_maximal show ?thesis by simp\n            next\n              assume \"t \\<noteq> s\" with S1 `t\\<in>S1` ct ct' show ?thesis\n                by (subst v_S1) auto\n            qed\n            also have \"\\<dots> = ereal (\\<integral>s. real (?v s) \\<partial>ct' t)\"\n              using ct ct' `t\\<in>S`\n              by (intro measure_pmf.ereal_integral_real[symmetric, where B=1])\n                 (auto simp: AE_measure_pmf_iff one_ereal_def[symmetric]\n                       intro!: v_nonneg v_le_1 simple_valid_cfg intro: Pi_closed)\n            finally have \"real (?v t) \\<le> (\\<integral>s. real (?v s) \\<partial>ct' t)\"\n              using ct `t\\<in>S` by (simp add: v_def T.emeasure_eq_measure)\n            moreover\n            { have \"?v' t = (\\<integral>\\<^sup>+s. ?v' s \\<partial>ct' t)\"\n                using ct ct' `t \\<in> S1` S1 by (subst v_S1) auto\n              also have \"\\<dots> = ereal (\\<integral>s. real (?v' s) \\<partial>ct' t)\"\n                using ct' `t\\<in>S`\n                by (intro measure_pmf.ereal_integral_real[symmetric, where B=1])\n                   (auto simp: AE_measure_pmf_iff one_ereal_def[symmetric]\n                         intro!: v_nonneg v_le_1 simple_valid_cfg intro: Pi_closed)\n              finally have \"real (?v' t) = (\\<integral>s. real (?v' s) \\<partial>ct' t)\"\n                using ct' `t\\<in>S` by (simp add: v_def T.emeasure_eq_measure) }\n            ultimately show ?thesis\n              using `t \\<in> S` by (simp add: \\<Delta>_def ereal_minus_mono)\n          qed\n          also have \"\\<dots> = (\\<integral>s. \\<Delta> s \\<partial>ct' t)\"\n            unfolding \\<Delta>_def using Pi_closed[OF ct `t\\<in>S`] Pi_closed[OF ct' `t\\<in>S`] ct ct'\n            by (intro integral_diff[symmetric] measure_pmf.integrable_const_bound[where B=1])\n               (auto simp: AE_measure_pmf_iff real_v v_nonneg intro!: real_of_ereal_le_1)\n          finally show False\n            by simp\n        qed\n        with t[THEN  maximalD2] `t \\<in> S` `t' \\<in> S` have \"\\<Delta> t = \\<Delta> t'\"\n          by (auto intro: antisym)\n        with t `t' \\<in> S` have \"t' \\<in> maximal \\<Delta> S\"\n          by (auto simp: maximal_def)\n        then show ?case\n          by fact\n      qed \n    qed\n    moreover have \"?v s < ?v' s\"\n    proof -\n      have \"?v s < (\\<integral>\\<^sup>+t. ?v t \\<partial>D)\"\n        by fact\n      also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+t. ?v' t \\<partial>D)\"\n        using `?v \\<le> ?v'` `s\\<in>S` D ct ct'\n        by (intro nn_integral_mono) (auto simp: le_fun_def)\n      also have \"\\<dots> = ?v' s\"\n        using `s\\<in>S1` S1 ct' by (subst (2) v_S1) auto\n      finally show ?thesis .\n    qed\n    ultimately have \"?v < ?v'\"\n      by (auto simp: less_le le_fun_def fun_eq_iff)\n    note this proper ct' }\n  note v_strict = this(1) and proper = this(2) and sc'_R = this(3)\n\n  have \"finite (Pi\\<^sub>E S K \\<times> Pi\\<^sub>E S K)\"\n    by (intro finite_PiE S_finite K_finite finite_SigmaI)\n  then have \"finite R\"\n    by (rule rev_finite_subset) (auto simp add: PiE_iff S\\<^sub>r_def R_def intro: extensional_arb)\n  moreover\n  from v_strict have \"acyclic R\"\n    by (rule acyclicI_order)\n  ultimately have \"wf R\"\n    by (rule finite_acyclic_wf)\n  \n  from exists_proper obtain ct' where ct': \"proper ct'\" .\n  def ct \\<equiv> \"restrict ct' S\"\n  with ct' have sc_Pi: \"ct \\<in> Pi S K\" and \"ct' \\<in> Pi S K\"\n    by (auto simp: proper_def)\n  then have ct: \"ct \\<in> {ct \\<in> Pi\\<^sub>E S K. proper ct}\"\n    using ct' directed_towards_mono[where F=\"SIGMA s:S\\<^sub>r. ct' s\" and G=\"SIGMA s:S\\<^sub>r. ct s\"]\n    apply simp\n    apply (subst proper_eq)\n    by (auto simp: ct_def proper_eq[OF properD1[OF ct']] subset_eq S\\<^sub>r_def)\n\n  show \"\\<exists>ct. ct \\<in> Pi\\<^sub>E S K \\<and> v\\<circ>simple ct = F_sup (v\\<circ>simple ct)\"\n  proof (rule wfE_min[OF `wf R` ct])\n    fix ct assume ct: \"ct \\<in> {ct \\<in> Pi\\<^sub>E S K. proper ct}\"\n    then have \"ct \\<in> Pi S K\" \"proper ct\"\n      by (auto simp: proper_def)\n    assume min: \"\\<And>ct'. (ct', ct) \\<in> R \\<Longrightarrow> ct' \\<notin> {ct \\<in> Pi\\<^sub>E S K. proper ct}\"\n    let ?v = \"\\<lambda>s. v (simple ct s)\"\n    { fix s assume \"s \\<in> S\" \"s \\<in> S1\" \"s \\<notin> S2\"\n      with ct have \"ct s \\<in> K s\" \"?v s \\<le> integral\\<^sup>N (ct s) ?v\" \n        by (auto simp: v_S1 PiE_def intro!: nn_integral_mono)\n      moreover\n      { have \"0 \\<le> ?v s\"\n          using `s\\<in>S` ct by (simp add: v_nonneg PiE_def)\n        also assume v_less: \"?v s < (SUP D:K s. integral\\<^sup>N D ?v)\"\n        also have \"\\<dots> \\<le> p s\"\n          unfolding p_S1[OF `s\\<in>S1`] using `s\\<in>S` ct v_le_p[OF simple_valid_cfg, OF `ct \\<in> Pi S K`]\n          by (auto intro!: SUP_mono nn_integral_mono_AE bexI\n                   simp: PiE_def AE_measure_pmf_iff set_pmf_closed)\n        finally have \"s \\<in> S\\<^sub>r\"\n          using `s\\<in>S` `s\\<notin>S2` by (simp add: S\\<^sub>r_def S\\<^sub>e_def)\n\n        from v_less obtain D where \"D \\<in> K s\" \"?v s < integral\\<^sup>N D ?v\"\n          by (auto simp: less_SUP_iff)\n        with ct `s\\<in>S` `s\\<in>S\\<^sub>r` have \"(ct(s:=D), ct) \\<in> R\" \"ct(s:=D) \\<in> PiE S K\"\n          unfolding R_def by (auto simp: PiE_def extensional_def)\n        from proper[OF this(1)] min[OF this(1)] ct `D \\<in> K s` `s\\<in>S` this(2)\n        have False\n          by simp }\n      ultimately have \"?v s = (SUP D:K s. integral\\<^sup>N D ?v)\"\n        by (auto intro: antisym SUP_upper2[where i=\"ct s\"] leI)\n      also have \"\\<dots> = (SUP D:K s. integral\\<^sup>N D (\\<lambda>s\\<in>S. ?v s))\"\n        using `s\\<in>S` by (auto intro!: SUP_cong nn_integral_cong v_nS simp: ct simple_valid_cfg_iff `ct \\<in> Pi S K`)\n      finally have \"?v s = (SUP D:K s. integral\\<^sup>N D (\\<lambda>s\\<in>S. ?v s))\" . }\n    then have \"?v = F_sup ?v\"\n      unfolding F_sup_def using ct\n      by (auto intro!: ext v_S2 simple_cfg_on v_nS v_nS12 SUP_cong nn_integral_cong\n               simp: PiE_def simple_valid_cfg_iff)\n    with ct show ?thesis\n      by (auto simp: comp_def)\n  qed\nqed\n\nlemma p_v_memoryless:\n  obtains ct where \"ct \\<in> Pi\\<^sub>E S K\" \"p = v\\<circ>simple ct\"\nproof -\n  obtain ct where ct_PiE: \"ct \\<in> Pi\\<^sub>E S K\" and eq: \"v\\<circ>simple ct = F_sup (v\\<circ>simple ct)\"\n    by (rule F_v_memoryless)\n  then have ct: \"ct \\<in> Pi S K\"\n    by (simp add: PiE_def)\n  have \"p = v\\<circ>simple ct\"\n  proof (rule antisym)\n    show \"p \\<le> v\\<circ>simple ct\"\n      unfolding p_eq_lfp_F_sup by (rule lfp_lowerbound) (metis order_refl eq)\n    show \"v\\<circ>simple ct \\<le> p\"\n    proof (rule le_funI)\n      fix s show \"(v\\<circ>simple ct) s \\<le> p s\"\n        using v_le_p[of \"simple ct s\"]\n        by (cases \"s \\<in> S\") (auto simp del: simp add: v_def ct)\n    qed\n  qed\n  with ct_PiE that show thesis by auto\nqed\n\ndefinition \"n = (\\<lambda>s\\<in>S. P_inf s (\\<lambda>\\<omega>. (HLD S1 suntil HLD S2) (s ## \\<omega>)))\"\n\nlemma n_eq_INF_v: \"s \\<in> S \\<Longrightarrow> n s = (\\<Sqinter>cfg\\<in>cfg_on s. v cfg)\"\n  by (auto simp add: n_def v_def P_inf_def T.emeasure_eq_measure valid_cfgI intro!: INF_cong)\n\nlemma n_le_v: \"s \\<in> S \\<Longrightarrow> cfg \\<in> cfg_on s \\<Longrightarrow> n s \\<le> v cfg\"\n  by (subst n_eq_INF_v) (blast intro!: INF_lower)+\n\nlemma n_eq_1_imp: \"s \\<in> S \\<Longrightarrow> cfg \\<in> cfg_on s \\<Longrightarrow> n s = 1 \\<Longrightarrow> v cfg = 1\"\n  using n_le_v[of s cfg] v_le_1[of cfg] by (auto intro: antisym valid_cfgI)\n\nlemma n_eq_1_iff: \"s \\<in> S \\<Longrightarrow> n s = 1 \\<longleftrightarrow> (\\<forall>cfg\\<in>cfg_on s. v cfg = 1)\"\n  apply rule\n  apply (metis n_eq_1_imp)\n  apply (auto simp: n_eq_INF_v intro!: INF_eqI)\n  done\n\nlemma n_le_1: \"s \\<in> S \\<Longrightarrow> n s \\<le> 1\"\n  by (auto simp: n_eq_INF_v intro!: INF_lower2[OF simple_cfg_on[of arb_act]] v_le_1)\n\nlemma n_nonneg: \"s \\<in> S \\<Longrightarrow> 0 \\<le> n s\"\n  by (auto simp: n_eq_INF_v intro!: v_nonneg INF_greatest valid_cfgI)\n\nlemma n_undefined[simp]: \"s \\<notin> S \\<Longrightarrow> n s = undefined\"\n  by (simp add: n_def)\n\nlemma n_eq_0: \"s \\<in> S \\<Longrightarrow> cfg \\<in> cfg_on s \\<Longrightarrow> v cfg = 0 \\<Longrightarrow> n s = 0\"\n  using n_le_v[of s cfg] n_nonneg[of s] by auto\n\nlemma n_not_inf[simp]: \"s \\<in> S \\<Longrightarrow> n s \\<noteq> \\<infinity>\" \"s \\<in> S \\<Longrightarrow> n s \\<noteq> -\\<infinity>\"\n  using n_nonneg[of s] n_le_1[of s] by auto\n\nlemma n_S1: \"s \\<in> S1 \\<Longrightarrow> n s = (\\<Sqinter>D\\<in>K s. \\<integral>\\<^sup>+ t. n t \\<partial>D)\"\n  using S1 S1_S2 unfolding n_def\n  apply auto\n  apply (subst P_inf_iterate)\n  apply (auto intro!: nn_integral_cong_AE INF_cong intro: set_pmf_closed\n              simp: AE_measure_pmf_iff suntil_Stream set_eq_iff)\n  done\n\nlemma n_S2[simp]: \"s \\<in> S2 \\<Longrightarrow> n s = 1\"\n  using S2 by (auto simp add: n_eq_INF_v valid_cfgI)\n\nlemma n_nS12: \"s \\<in> S \\<Longrightarrow> s \\<notin> S1 \\<Longrightarrow> s \\<notin> S2 \\<Longrightarrow> n s = 0\"\n  by (auto simp add: n_eq_INF_v valid_cfgI)\n\nlemma n_pos:\n  assumes \"P s\" \"s \\<in> S1\" \"wf R\"\n  assumes cont: \"\\<And>s D. P s \\<Longrightarrow> s \\<in> S1 \\<Longrightarrow> D \\<in> K s \\<Longrightarrow> \\<exists>w\\<in>D. ((w, s) \\<in> R \\<and> w \\<in> S1 \\<and> P w) \\<or> 0 < n w\"\n  shows \"0 < n s\"\n  using `wf R` `P s` `s\\<in>S1`\nproof (induction s)\n  case (less s)\n  with S1 have [simp]: \"s \\<in> S\" by auto\n  let ?I = \"\\<lambda>D::'s pmf. \\<integral>\\<^sup>+t. n t \\<partial>D\"\n  have \"0 < Min (?I`K s)\"\n  proof (safe intro!: Min_grI)\n    fix D assume [simp]: \"D \\<in> K s\"\n    from cont[OF `P s` `s \\<in> S1` `D \\<in> K s`]\n    obtain w where w: \"w \\<in> D\" \"0 < n w\"\n      by (force intro: less.IH)\n    have in_S: \"\\<And>t. t \\<in> D \\<Longrightarrow> t \\<in> S\"\n      using set_pmf_closed[OF `s \\<in> S` `D \\<in> K s`] by auto\n    from w have \"0 < pmf D w * n w\"\n      by (simp add: ereal_zero_less_0_iff pmf_positive)\n    also have \"\\<dots> = (\\<integral>\\<^sup>+t. n w * indicator {w} t \\<partial>D)\"\n      by (subst nn_integral_cmult_indicator)\n         (auto intro!: n_nonneg simp: ac_simps emeasure_pmf_single in_S `w \\<in> D`)\n    also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+t. n t \\<partial>D)\"\n      by (intro nn_integral_mono_AE) (auto split: split_indicator intro: n_nonneg simp: AE_measure_pmf_iff in_S)\n    finally show \"0 < (\\<integral>\\<^sup>+t. n t \\<partial>D)\" .\n  qed (insert K_wf K_finite `s\\<in>S`, auto)\n  also have \"\\<dots> = n s\"\n    unfolding n_S1[OF `s \\<in> S1`] INF_def\n    using K_wf K_finite `s\\<in>S` by (intro Min_Inf) auto\n  finally show \"0 < n s\" .\nqed\n\ndefinition F_inf :: \"('s \\<Rightarrow> ereal) \\<Rightarrow> ('s \\<Rightarrow> ereal)\" where\n  \"F_inf f = (\\<lambda>s\\<in>S. if s \\<in> S2 then 1 else if s \\<in> S1 then (\\<Sqinter>D\\<in>K s. \\<integral>\\<^sup>+ t. f t \\<partial>D) else 0)\"\n\nlemma F_inf_n: \"F_inf n = n\"\n  by (simp add: F_inf_def n_nS12 n_S1 fun_eq_iff)\n\nlemma F_inf_nS[simp]: \"s \\<notin> S \\<Longrightarrow> F_inf f s = undefined\"\n  by (simp add: F_inf_def)\n\nlemma mono_F_inf: \"mono F_inf\"\n  by (auto intro!: INF_superset_mono nn_integral_mono simp: mono_def F_inf_def le_fun_def)\n\nlemma F_inf_nonneg: \"s \\<in> S \\<Longrightarrow> 0 \\<le> F_inf F s\"\n  by (auto simp: F_inf_def intro!: INF_greatest nn_integral_nonneg intro: arb_actI)\n\nlemma S1_nS2: \"s \\<in> S1 \\<Longrightarrow> s \\<notin> S2\"\n  using S1_S2 by auto\n\nlemma n_eq_lfp_F_inf: \"n = lfp F_inf\"\nproof (intro antisym lfp_lowerbound le_funI)\n  fix s let ?I = \"\\<lambda>D. (\\<integral>\\<^sup>+t. lfp F_inf t \\<partial>measure_pmf D)\"\n  def ct \\<equiv> \"\\<lambda>s. SOME D. D \\<in> K s \\<and> (s \\<in> S1 \\<longrightarrow> lfp F_inf s = ?I D)\"\n  { fix s assume s: \"s \\<in> S\"\n    then have \"finite (?I ` K s)\"\n      by (auto intro: K_finite)\n    with s obtain D where \"D \\<in> K s\" \"(\\<integral>\\<^sup>+t. lfp F_inf t \\<partial>D) = Min (?I ` K s)\"\n      by (auto simp: K_wf dest!: Min_in)\n    note this(2)\n    also have \"\\<dots> = (INF D : K s. ?I D)\"\n      using s K_wf by (subst Min_Inf) (auto intro: K_finite)\n    also have \"s \\<in> S1 \\<Longrightarrow> \\<dots> = lfp F_inf s\"\n      using s S1_S2 by (subst (3) lfp_unfold[OF mono_F_inf]) (auto simp add: F_inf_def)\n    finally have \"\\<exists>D. D \\<in> K s \\<and> (s \\<in> S1 \\<longrightarrow> lfp F_inf s = ?I D)\"\n      using `D \\<in> K s` by auto\n    then have \"ct s \\<in> K s \\<and> (s \\<in> S1 \\<longrightarrow> lfp F_inf s = ?I (ct s))\"\n      unfolding ct_def by (rule someI_ex)\n    then have \"ct s \\<in> K s\" \"s \\<in> S1 \\<Longrightarrow> lfp F_inf s = ?I (ct s)\"\n      by auto }\n  note ct = this\n  then have Pi_ct: \"ct \\<in> Pi S K\"\n    by auto\n  then have valid_ct[simp]: \"\\<And>s. s \\<in> S \\<Longrightarrow> simple ct s \\<in> valid_cfg\"\n    by simp\n  let ?F = \"\\<lambda>P. HLD S2 or (HLD S1 aand nxt P)\"\n  def P \\<equiv> \"\\<lambda>s n. emeasure (T (simple ct s)) {x\\<in>space (T (simple ct s)). (?F ^^ n) (\\<lambda>x. False) (s ## x)}\"\n  { assume \"s \\<in> S\"\n    with S1 have [simp, measurable]: \"s \\<in> S\" by auto\n    then have \"n s \\<le> v (simple ct s)\"\n      by (intro n_le_v) (auto intro: simple_cfg_on[OF Pi_ct])\n    also have \"\\<dots> = emeasure (T (simple ct s)) {x\\<in>space (T (simple ct s)). lfp ?F (s ## x)}\"\n      using S1_S2\n      by (simp add: v_eq[OF simple_valid_cfg[OF Pi_ct `s\\<in>S`]])\n         (simp add: suntil_lfp space_T[symmetric, of \"simple ct s\"] del: space_T)\n    also have \"\\<dots> = (\\<Squnion>n. P s n)\" unfolding P_def\n      apply (rule emeasure_lfp2[where P=\"\\<lambda>M. \\<exists>s. M = T (simple ct s)\" and M=\"T (simple ct s)\"])\n      apply (intro exI[of _ s] refl)\n      apply (auto simp: continuous_def) []\n      apply auto []\n    proof safe\n      fix A s assume \"\\<And>N. \\<exists>s. N = T (simple ct s) \\<Longrightarrow> Measurable.pred N A\"\n      then have \"\\<And>s. Measurable.pred (T (simple ct s)) A\"\n        by metis\n      then have \"\\<And>s. Measurable.pred St A\"\n        by simp\n      then show \"Measurable.pred (T (simple ct s)) (\\<lambda>xs. HLD S2 xs \\<or> HLD S1 xs \\<and> nxt A xs)\"\n        by simp\n    qed\n    also have \"\\<dots> \\<le> lfp F_inf s\"\n    proof (intro SUP_least)\n      fix n from `s\\<in>S` show \"P s n \\<le> lfp F_inf s\"\n      proof (induct n arbitrary: s)\n        case 0 with S1 show ?case\n          by (subst lfp_unfold[OF mono_F_inf]) (auto simp: P_def intro: F_inf_nonneg)\n      next\n        case (Suc n)\n        \n        show ?case\n        proof cases\n          assume \"s \\<in> S1\" with S1_S2 S1 have s[simp]: \"s \\<notin> S2\" \"s \\<in> S\" \"s \\<in> S1\" by auto\n          have \"P s (Suc n) = (\\<integral>\\<^sup>+t. P t n \\<partial>ct s)\"\n            unfolding P_def space_T\n            apply (subst emeasure_Collect_T)\n            apply (rule measurable_compose[OF measurable_Stream[OF measurable_const measurable_ident_sets[OF refl]]])\n            apply (measurable, assumption)\n            apply (auto simp: K_cfg_def map_pmf.rep_eq nn_integral_distr\n                        intro!: nn_integral_cong)\n            done\n          also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+t. lfp F_inf t \\<partial>ct s)\"\n            using Pi_closed[OF Pi_ct `s \\<in> S`]\n            by (auto intro!: nn_integral_mono_AE Suc simp: AE_measure_pmf_iff)\n          also have \"\\<dots> = lfp F_inf s\"\n            by (intro ct(2)[symmetric]) auto\n          finally show ?thesis .\n        next\n          assume \"s \\<notin> S1\" with S2 `s \\<in> S` show ?case\n            using T.emeasure_space_1[of \"simple ct s\"]\n            by (subst lfp_unfold[OF mono_F_inf]) (auto simp: F_inf_def P_def)\n        qed\n      qed\n    qed\n    finally have \"n s \\<le> lfp F_inf s\" . }\n  moreover have \"s \\<notin> S \\<Longrightarrow> n s \\<le> lfp F_inf s\"\n    by (subst lfp_unfold[OF mono_F_inf]) (simp add: n_def F_inf_def)\n  ultimately show \"n s \\<le> lfp F_inf s\"\n    by blast\nqed (simp add: F_inf_n)\n\n\nlemma real_n: \"s \\<in> S \\<Longrightarrow> ereal (real (n s)) = n s\"\n  by (cases \"n s\") simp_all\n\nlemma real_p: \"s \\<in> S \\<Longrightarrow> ereal (real (p s)) = p s\"\n  by (cases \"p s\") simp_all\n\nlemma p_ub:\n  fixes x\n  assumes \"s \\<in> S\"\n  assumes solution: \"\\<And>s D. s \\<in> S1 \\<Longrightarrow> D \\<in> K s \\<Longrightarrow> (\\<Sum>t\\<in>S. pmf D t * x t) \\<le> x s\"\n  assumes solution_0: \"\\<And>s. s \\<in> S \\<Longrightarrow> p s = 0 \\<Longrightarrow> x s = 0\"\n  assumes solution_S2: \"\\<And>s. s \\<in> S2 \\<Longrightarrow> x s = 1\"\n  shows \"real (p s) \\<le> x s\" (is \"?y s \\<le> _\")\nproof -\n  let ?p = \"\\<lambda>s. real (p s)\"\n  from p_v_memoryless obtain sc where \"sc \\<in> Pi\\<^sub>E S K\" and p_eq: \"p = v \\<circ> simple sc\"\n    by auto\n  then have sch: \"\\<And>s. s \\<in> S \\<Longrightarrow> sc s \\<in> K s\" and sc_Pi: \"sc \\<in> Pi S K\"\n    by (auto simp: PiE_iff)\n\n  interpret sc!: MC_syntax sc .\n\n  def N \\<equiv> \"{s\\<in>S. p s = 0} \\<union> S2\"\n  { fix s assume \"s \\<in> S\" \"s \\<notin> N\"\n    with p_nS12 have \"s \\<in> S1\"\n      by (auto simp add: N_def) }\n  note N = this\n\n  have N_S: \"N \\<subseteq> S\"\n    using S2 by (auto simp: N_def)\n  \n  show ?thesis\n  proof cases\n    assume \"s \\<in> S - N\"\n    then show ?thesis\n    proof (rule mono_les)\n      show \"(\\<Union>x\\<in>S - N. sc x) \\<subseteq> S - N \\<union> N\"\n        using Pi_closed[OF sc_Pi] by auto\n      show \"finite ((\\<lambda>s. ?p s - x s) ` (S - N \\<union> N))\"\n        using N_S by (intro finite_imageI finite_subset[OF _ S_finite]) auto\n    next\n      fix s assume \"s \\<in> N\" then show \"?p s \\<le> x s\"\n        by (auto simp: N_def solution_S2 solution_0)\n    next\n      fix s assume s: \"s \\<in> S - N\"\n      then show \"integrable (sc s) x\" \"integrable (sc s) ?p\"\n        by (auto intro!: integrable_measure_pmf_finite set_pmf_finite sch)\n      \n      from s have \"s \\<in> S1\" \"s \\<in> S\"\n        using p_nS12[of s] by (auto simp: N_def)\n      then show \"?p s \\<le> (\\<integral> t. ?p t \\<partial>sc s) + 0\"\n        unfolding p_eq using real_v_integral_eq[of \"simple sc s\"] by (simp add: v_S1 sc_Pi)\n      show \"(\\<integral> t. x t \\<partial>sc s) + 0 \\<le> x s\"\n        using solution[OF `s \\<in> S1` sch[OF `s \\<in> S`]]\n        by (subst integral_measure_pmf[where A=S])\n           (auto intro: S_finite Pi_closed[OF sc_Pi] `s \\<in> S` simp: ac_simps)\n\n      def X \\<equiv> \"SIGMA x:UNIV. sc x\"\n      show \"\\<exists>t\\<in>N. (s, t) \\<in> X\\<^sup>*\"\n      proof (rule ccontr)\n        assume \"\\<not> ?thesis\"\n        then have *: \"\\<forall>t\\<in>N. (s, t) \\<notin> X\\<^sup>*\"\n          by auto\n        with `s\\<in>S` have \"v (simple sc s) = 0\"\n        proof (coinduction arbitrary: s rule: v_eq_0_coinduct)\n          case (valid t) with sch show ?case\n            by auto\n        next\n          case (nS2 s) then show ?case\n            by (auto simp: N_def)\n        next\n          case (cont cfg s)\n          then have \"(s, state cfg) \\<in> X\\<^sup>*\"\n            by (auto simp: X_def set_K_cfg)\n          with cont show ?case\n            by (auto simp: set_K_cfg intro!: exI intro: Pi_closed[OF sc_Pi])\n               (blast intro: rtrancl_trans)\n        qed\n        then have \"p s = 0\"\n          unfolding p_eq by simp\n        with `s\\<in>S` have \"s\\<in>N\"\n          by (auto simp: N_def)\n        with * show False\n          by auto\n      qed\n    qed\n  next\n    assume \"s \\<notin> S - N\" with `s \\<in> S` show \"?p s \\<le> x s\"\n      by (auto simp: N_def solution_0 solution_S2)\n  qed\nqed\n\nlemma n_lb:\n  fixes x\n  assumes \"s \\<in> S\"\n  assumes solution: \"\\<And>s D. s \\<in> S1 \\<Longrightarrow> D \\<in> K s \\<Longrightarrow> x s \\<le> (\\<Sum>t\\<in>S. pmf D t * x t)\"\n  assumes solution_n0: \"\\<And>s. s \\<in> S \\<Longrightarrow> n s = 0 \\<Longrightarrow> x s = 0\"\n  assumes solution_S2: \"\\<And>s. s \\<in> S2 \\<Longrightarrow> x s = 1\"\n  shows \"x s \\<le> real (n s)\" (is \"_ \\<le> ?y s\")\nproof -\n  let ?I = \"\\<lambda>D::'s pmf. \\<integral>\\<^sup>+x. n x \\<partial>D\"\n  { fix s assume \"s \\<in> S1\"\n    with S1 S1_S2 have \"n s = (\\<Sqinter>D\\<in>K s. ?I D)\"\n      by (subst n_eq_lfp_F_inf, subst lfp_unfold[OF mono_F_inf])\n         (auto simp add: F_inf_def n_eq_lfp_F_inf)\n    moreover have \"(\\<Sqinter>D\\<in>K s. \\<integral>\\<^sup>+x. n x \\<partial>D) = Min (?I`K s)\"\n      unfolding INF_def using `s \\<in> S1` S1 K_wf\n      by (intro cInf_eq_Min finite_imageI K_finite) auto\n    moreover have \"Min (?I`K s) \\<in> ?I`K s\"\n      using `s \\<in> S1` S1 K_wf by (intro Min_in finite_imageI K_finite) auto\n    ultimately have \"\\<exists>D\\<in>K s. (\\<integral>\\<^sup>+x. n x \\<partial>D) = n s\"\n      by auto }\n  then have \"\\<And>s. s \\<in> S \\<Longrightarrow> \\<exists>D\\<in>K s. s \\<in> S1 \\<longrightarrow> (\\<integral>\\<^sup>+x. n x \\<partial>D) = n s\"\n    using K_wf by auto\n  then obtain sc where sch: \"\\<And>s. s \\<in> S \\<Longrightarrow> sc s \\<in> K s\"\n    and n_sc: \"\\<And>s. s \\<in> S1 \\<Longrightarrow> (\\<integral>\\<^sup>+x. n x \\<partial>sc s) = n s\"\n    by (metis S1 subsetD)\n  then have sc_Pi: \"sc \\<in> Pi S K\"\n    by auto\n\n  def N \\<equiv> \"{s\\<in>S. n s = 0} \\<union> S2\"\n  with S2 have N_S: \"N \\<subseteq> S\"\n    by auto\n  { fix s assume \"s \\<in> S\" \"s \\<notin> N\"\n    with n_nS12 have \"s \\<in> S1\"\n      by (auto simp add: N_def) }\n  note N = this\n\n  let ?n = \"\\<lambda>s. real (n s)\"\n  show ?thesis\n  proof cases\n    assume \"s \\<in> S - N\"\n    then show ?thesis\n    proof (rule mono_les)\n      show \"(\\<Union>x\\<in>S - N. sc x) \\<subseteq> S - N \\<union> N\"\n        using Pi_closed[OF sc_Pi] by auto\n      show \"finite ((\\<lambda>s. x s - ?n s) ` (S - N \\<union> N))\"\n        using N_S by (intro finite_imageI finite_subset[OF _ S_finite]) auto\n    next\n      fix s assume \"s \\<in> N\" then show \"x s \\<le> ?n s\"\n        by (auto simp: N_def solution_S2 solution_n0)\n    next\n      fix s assume s: \"s \\<in> S - N\"\n      then show \"integrable (sc s) x\" \"integrable (sc s) ?n\"\n        by (auto intro!: integrable_measure_pmf_finite set_pmf_finite sch)\n      \n      from s have \"s \\<in> S1\" \"s \\<in> S\"\n        using n_nS12[of s] by (auto simp: N_def)\n      then have \"(\\<integral> t. ?n t \\<partial>sc s) = ?n s\"\n        apply (subst n_sc[symmetric, of s])\n        apply simp_all\n        apply (subst integral_eq_nn_integral)\n        apply (auto simp: Pi_closed[OF sc_Pi] AE_measure_pmf_iff \n                    intro!: n_nonneg real_of_ereal_pos arg_cong[where f=real] nn_integral_cong_AE real_n)\n        done\n      then show \"(\\<integral> t. ?n t \\<partial>sc s) + 0 \\<le> ?n s\"\n        by simp\n\n      show \"x s \\<le> (\\<integral> t. x t \\<partial>sc s) + 0\"\n        using solution[OF `s \\<in> S1` sch[OF `s \\<in> S`]]\n        by (subst integral_measure_pmf[where A=S])\n           (auto intro: S_finite Pi_closed[OF sc_Pi] `s \\<in> S` simp: ac_simps)\n\n      def X \\<equiv> \"SIGMA x:UNIV. sc x\"\n      show \"\\<exists>t\\<in>N. (s, t) \\<in> X\\<^sup>*\"\n      proof (rule ccontr)\n        assume \"\\<not> ?thesis\"\n        then have *: \"\\<forall>t\\<in>N. (s, t) \\<notin> X\\<^sup>*\"\n          by auto\n        with `s\\<in>S` have \"v (simple sc s) = 0\"\n        proof (coinduction arbitrary: s rule: v_eq_0_coinduct)\n          case (valid t) with sch show ?case\n            by auto\n        next\n          case (nS2 s) then show ?case\n            by (auto simp: N_def)\n        next\n          case (cont cfg s)\n          then have \"(s, state cfg) \\<in> X\\<^sup>*\"\n            by (auto simp: X_def set_K_cfg)\n          with cont show ?case\n            by (auto simp: set_K_cfg intro!: exI intro: Pi_closed[OF sc_Pi])\n               (blast intro: rtrancl_trans)\n        qed\n        from n_eq_0[OF `s \\<in> S` simple_cfg_on this] have \"n s = 0\"\n          by (auto simp: sc_Pi)\n        with `s\\<in>S` have \"s\\<in>N\"\n          by (auto simp: N_def)\n        with * show False\n          by auto\n      qed\n    qed\n  next\n    assume \"s \\<notin> S - N\" with `s \\<in> S` show \"x s \\<le> ?n s\"\n      by (auto simp: N_def solution_n0 solution_S2)\n  qed\nqed\n\nend\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Markov_Models/MDP_Reachability_Problem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.33951628505760284}}
{"text": "theory Trieber\n  imports Nat_Language\nbegin\n\nsection \\<open>Define the variables\\<close>\ndatatype addr = i | j | r | val | level | head | l\\<^sub>0 | l\\<^sub>1 | l\\<^sub>2 | t\\<^sub>0 | t\\<^sub>1 | t\\<^sub>2 | n\\<^sub>0 | n\\<^sub>1 | n\\<^sub>2 | public | x | exit\ndefinition all_vars\n  where \"all_vars = [i, j, r, val, level, exit, head, l\\<^sub>0, l\\<^sub>1, l\\<^sub>2, t\\<^sub>0, t\\<^sub>1, t\\<^sub>2, n\\<^sub>0, n\\<^sub>1, n\\<^sub>2, public, x]\"\ndefinition locals\n  where \"locals = [j, r, val, level, x, exit]\"\n\nsection \\<open>Establish the language & logic\\<close>\nglobal_interpretation natlang: nat_language all_vars locals\n  defines \\<Gamma>\\<^sub>a = natlang.\\<Gamma>\\<^sub>a\n      and \\<Gamma>\\<^sub>b = natlang.\\<Gamma>\\<^sub>b\n      and wp = natlang.wp\n      and stabilize = natlang.stabilize\n      and wp\\<^sub>Q = natlang.wp\\<^sub>Q\n      and guar = natlang.guar\n      and PO = natlang.PO\n      and secureUpd = natlang.secureUpd\n      and ctrled = natlang.ctrled\n      and if_secure = natlang.if_secure\n      and wellformed = natlang.wellformed\n      and negate = natlang.negate\n      and var_policy = natlang.var_policy\n      and \\<Gamma>\\<^sub>e = natlang.\\<Gamma>\\<^sub>e\n      and invar = natlang.invar\n      and low\\<^sub>v = natlang.low\\<^sub>v\n      and wf\\<^sub>\\<L> = natlang.wf\\<^sub>\\<L>\n      and step = natlang.step\n      and str_env = natlang.str_env\n      and onlyGlobals = natlang.onlyGlobals\n  apply unfold_locales unfolding all_vars_def by allvars_tac\n\nsyntax\n  \"_Assign\" :: \"'addr \\<Rightarrow> ('addr) aexp \\<Rightarrow> ('addr, nat, 'addr aexp, 'addr bexp) WPLang\"\n    (\"(_ :=/ _)\" [70, 65] 61)\n  \"_Store\" :: \"'addr \\<Rightarrow> ('addr) aexp \\<Rightarrow> ('addr) aexp \\<Rightarrow> ('addr, nat, 'addr aexp, 'addr bexp) WPLang\"\n    (\"(_ IN _ :=/ _)\" [70, 70, 65] 61)\n  \"_Load\" :: \"'addr \\<Rightarrow> ('addr) list \\<Rightarrow> ('addr) aexp \\<Rightarrow> ('addr, nat, 'addr aexp, 'addr bexp) WPLang\"\n    (\"(_ :=/ _ IN/ _)\" [70, 70, 70] 61)\n  \"_Secure\" :: \"('addr,nat) rpred \\<Rightarrow> ('addr,nat) rpred \\<Rightarrow> ('addr \\<Rightarrow> 'addr bexp) \\<Rightarrow> ('addr,nat) pred \\<Rightarrow> ('addr, nat, 'addr aexp, 'addr bexp) WPLang \\<Rightarrow> bool\"\n    (\"(0_,_ \\<turnstile> R: _ /G: _ /{_})\" [0, 0, 0, 0, 0] 61)\n\ntranslations\n  \"x := a\" \\<rightharpoonup> \"CONST Act (CONST Assign x a)\"\n  \"x IN i := a\" \\<rightharpoonup> \"CONST Act (CONST Store x i a)\"\n  \"r := a IN i\" \\<rightharpoonup> \"CONST Act (CONST Action.Load r a i)\"\n  \"L,P \\<turnstile> R: RP G: GP {c}\" \\<rightharpoonup> \"CONST if_secure RP GP L P c\"\n\nsection \\<open>Example\\<close>\n\nsubsection \\<open>Specification\\<close>\n\nfun \\<L> :: \"addr \\<Rightarrow> addr bexp\" where\n  \"\\<L> head = true\" |\n  \"\\<L> l\\<^sub>0 = true\" |\n  \"\\<L> l\\<^sub>1 = true\" |\n  \"\\<L> l\\<^sub>2 = true\" |\n  \"\\<L> n\\<^sub>0 = true\" |\n  \"\\<L> n\\<^sub>1 = true\" |\n  \"\\<L> n\\<^sub>2 = true\" |\n  \"\\<L> t\\<^sub>0 = UCmp (\\<lambda>x. x = 0) (Load l\\<^sub>0)\" |\n  \"\\<L> t\\<^sub>1 = UCmp (\\<lambda>x. x = 0) (Load l\\<^sub>1)\" |\n  \"\\<L> t\\<^sub>2 = UCmp (\\<lambda>x. x = 0) (Load l\\<^sub>2)\" |\n  \"\\<L> public = true\" |\n  \"\\<L> _ = false\"\n\ndefinition \"P\\<^sub>0 \\<equiv> (PCmp (=) (Var i) (Const 0) \\<longrightarrow>\\<^sub>p PCmp (=) (Var l\\<^sub>0) (Const 1)) \\<and>\\<^sub>p\n                 (PCmp (=) (Var i) (Const 1) \\<longrightarrow>\\<^sub>p PCmp (=) (Var l\\<^sub>1) (Const 1)) \\<and>\\<^sub>p\n                 (PCmp (=) (Var i) (Const 2) \\<longrightarrow>\\<^sub>p PCmp (=) (Var l\\<^sub>2) (Const 1)) \"\n\ndefinition \"R \\<equiv> (PCmp (=) (Var i\\<^sup>o) (Const 0) \\<longrightarrow>\\<^sub>p (const l\\<^sub>0 \\<and>\\<^sub>p const t\\<^sub>0)) \\<and>\\<^sub>p\n                 (PCmp (=) (Var i\\<^sup>o) (Const 1) \\<longrightarrow>\\<^sub>p (const l\\<^sub>1 \\<and>\\<^sub>p const t\\<^sub>1)) \\<and>\\<^sub>p\n                 (PCmp (=) (Var i\\<^sup>o) (Const 2) \\<longrightarrow>\\<^sub>p (const l\\<^sub>2 \\<and>\\<^sub>p const t\\<^sub>2)) \\<and>\\<^sub>p\n                 const i\"\n\ndefinition \"G \\<equiv> (PCmp (=) (Var l\\<^sub>0\\<^sup>o) (Const (0 :: nat)) \\<longrightarrow>\\<^sub>p PCmp (=) (Var l\\<^sub>0`) (Const 0)) \\<and>\\<^sub>p\n                 (PCmp (=) (Var l\\<^sub>1\\<^sup>o) (Const 0) \\<longrightarrow>\\<^sub>p PCmp (=) (Var l\\<^sub>1`) (Const 0)) \\<and>\\<^sub>p\n                 (PCmp (=) (Var l\\<^sub>2\\<^sup>o) (Const 0) \\<longrightarrow>\\<^sub>p PCmp (=) (Var l\\<^sub>2`) (Const 0))\"\n\ndeclare G_def [natlang.RGSimp]\ndeclare R_def [natlang.RGSimp]\n\nsubsection \\<open>Constants\\<close>\n\ndefinition \"levels = [l\\<^sub>0, l\\<^sub>1, l\\<^sub>2]\"\ndefinition \"vals = [t\\<^sub>0, t\\<^sub>1, t\\<^sub>2]\"\ndefinition \"nexts = [n\\<^sub>0, n\\<^sub>1, n\\<^sub>2]\"\ndefinition \"L = Nat 3\"\n\nsubsection \\<open>Functions\\<close>\n\nlemma put:\n  \"\\<L>,P\\<^sub>0 \\<and>\\<^sub>p Low i \\<and>\\<^sub>p Low level \\<and>\\<^sub>p (PCmp (=) (Var level) (Const 0) \\<longrightarrow>\\<^sub>p (Low val)) \\<turnstile>\n   R: R\n   G: G\n   {\n    vals IN Load i := Nat 0;\n    levels IN Load i := Load level;\n    vals IN Load i := Load val;\n    DO\n      j := Load head;\n      nexts IN Load i := Load j\n    INV {Low j \\<and>\\<^sub>p Low i}\n    WHILE NCAS head (Load j) (Load i)\n   }\"\n  by natlang.vcgsolve\n  \nlemma pop:\n  \"\\<L>,Low r \\<and>\\<^sub>p Low x \\<and>\\<^sub>p Low j \\<turnstile>\n   R: G\n   G: R\n   {\n    exit := Nat 0;\n    DO\n      x := Load head;\n      IF \\<lbrace>BCmp (Load x) (<) L\\<rbrace>\n      THEN\n        j := levels IN Load x;\n        IF \\<lbrace>BCmp (Load j) (=) (Nat 0)\\<rbrace>\n        THEN\n          j := nexts IN Load x;\n          r := vals IN Load x;\n          IF CAS head (Load x) (Load j)\n          THEN exit := Nat 1\n          ELSE Skip\n          FI\n        ELSE Skip\n        FI\n      ELSE Skip\n      FI\n    INV {Low r \\<and>\\<^sub>p Low exit}\n    WHILE \\<lbrace>BCmp (Load exit) (=) (Nat 0)\\<rbrace>;\n    public := Load r\n   }\"\n  by natlang.vcgsolve\n\nend", "meta": {"author": "UQ-PAC", "repo": "wpif_CSF21", "sha": "e2fd527115dcd01c5a8e0664480bb982eb696d7e", "save_path": "github-repos/isabelle/UQ-PAC-wpif_CSF21", "path": "github-repos/isabelle/UQ-PAC-wpif_CSF21/wpif_CSF21-e2fd527115dcd01c5a8e0664480bb982eb696d7e/Examples/Trieber.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6584175139669997, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.3394931830622218}}
{"text": "(* uses Isabelle2017 and autocorres version 1.0 *)\ntheory myGraph\n  imports \n  \"checker-verification/Library/Autocorres_Misc\"\n  \"checker-verification/Witness_Property/Connected_Components\"\n  \"checker-verification/Witness_Property/ShortestPath\"\nbegin\n(* Parse the input file. *)\ninstall_C_file \"Graph_copy.c\"\n\nautocorres \"Graph_copy.c\"\n\ncontext Graph_copy begin\n\nthm \"is_wellformed_body_def\"\nthm \"trian_body_def\"\nthm \"just_body_def\"\nthm \"no_path_body_def\"\nthm \"pos_cost_body_def\"\nthm \"check_basic_just_sp_body_def\"\nthm \"check_sp_body_def\"\n\nthm \"is_wellformed'_def\"\nthm \"trian'_def\"\nthm \"just'_def\"\nthm \"no_path'_def\"\nthm \"pos_cost'_def\"\nthm \"check_basic_just_sp'_def\"\nthm \"check_sp'_def\"\n\n(*Implementation Graph Types*)\n\ntype_synonym IVertex = \"32 word\"\ntype_synonym IEdge_Id = \"32 word\"\ntype_synonym IEdge = \"IVertex \\<times> IVertex\"\ntype_synonym IPEdge = \"IVertex \\<Rightarrow> 32 word\"\ntype_synonym INum = \"IVertex \\<Rightarrow> 32 word\"\ntype_synonym IDist = \"IVertex \\<Rightarrow> 32 word\"\ntype_synonym ICost = \"IVertex \\<Rightarrow> 32 word\"\ntype_synonym IGraph = \"32 word \\<times> 32 word \\<times> (IEdge_Id \\<Rightarrow> IEdge)\"\n\nabbreviation \n  ivertex_cnt :: \"IGraph \\<Rightarrow> 32 word\"\nwhere \n  \"ivertex_cnt G \\<equiv> fst G\"\n\nabbreviation \n  iedge_cnt :: \"IGraph \\<Rightarrow> 32 word\"\nwhere \n  \"iedge_cnt G \\<equiv> fst (snd G)\"\n\nabbreviation \n  iedges :: \"IGraph \\<Rightarrow> IEdge_Id \\<Rightarrow> IEdge\"\nwhere \n  \"iedges G \\<equiv> snd (snd G)\"\n\n(* Make List - makes a list containing the result of a function *)\nfun \n  bool::\"32 word \\<Rightarrow> bool\" \nwhere \n  \"bool b = (if b=0 then False else True)\"\n\nfun \n  mk_list' :: \"nat \\<Rightarrow> (32 word \\<Rightarrow> 'b) \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list' n f = map f  (map of_nat [0..<n])\"\n\nfun \n  mk_list'_temp :: \"nat \\<Rightarrow> (32 word \\<Rightarrow> 'b) \\<Rightarrow> nat \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list'_temp 0 _ _ = []\" |\n  \"mk_list'_temp (Suc x) f i = (f (of_nat i)) # mk_list'_temp x f (Suc i)\"\n\n(* Make graph lists *)\nfun\n  mk_iedge_list :: \"IGraph \\<Rightarrow> IEdge list\"\nwhere \n  \"mk_iedge_list G = mk_list' (unat (iedge_cnt G)) (iedges G)\"\n\nfun \n  mk_inum_list :: \"IGraph \\<Rightarrow> INum \\<Rightarrow> 32 word list\"\nwhere \n  \"mk_inum_list G num = mk_list' (unat (ivertex_cnt G)) num\"\n  \nfun \n  mk_ipedge_list :: \"IGraph \\<Rightarrow> IPEdge \\<Rightarrow> 32 word list\"\nwhere\n  \"mk_ipedge_list G pedge = mk_list' (unat (ivertex_cnt G)) pedge\"\n\nfun\n  mk_idist_list :: \"IGraph \\<Rightarrow> IDist \\<Rightarrow> 32 word list\"\nwhere\n  \"mk_idist_list G dis = mk_list' (unat (ivertex_cnt G)) dis\"\n\nfun\n  mk_icost_list :: \"IGraph \\<Rightarrow> ICost \\<Rightarrow> 32 word list\"\nwhere\n  \"mk_icost_list G cost = mk_list' (unat (iedge_cnt G)) cost\"\n\n(* Equate to Implementation *)\n\nlemma sint_ucast: \n  \"sint (ucast (x ::word32) :: sword32) = sint x\"\n  by (clarsimp simp: sint_uint uint_up_ucast is_up)\n\nfun\n  to_edge :: \"IEdge \\<Rightarrow> IEdge_C\"\nwhere\n  \"to_edge (u,v) = IEdge_C u v\"\n\nlemma s_C_pte[simp]:\n  \"first_C (to_edge e) = fst e\"\n  by (cases e) auto\n\nlemma t_C_pte[simp]:\n  \"second_C (to_edge e) = snd e\"\n  by (cases e) auto\n\ndefinition is_graph where\n  \"is_graph h iG p \\<equiv>\n    is_valid_IGraph_C h p \\<and> \n    ivertex_cnt iG = num_vertices_C (heap_IGraph_C h p) \\<and> \n    iedge_cnt iG = num_edges_C (heap_IGraph_C h p) \\<and>\n    arrlist (heap_IEdge_C h) (is_valid_IEdge_C h)\n      (map to_edge (mk_iedge_list iG)) (arcs_C (heap_IGraph_C h p))\"\n\ndefinition \n  \"is_numm h iG iN (p:: 32 signed word ptr) \\<equiv> arrlist (\\<lambda>p. heap_w32 h (ptr_coerce p))\n        (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) (mk_inum_list iG iN) p\"\n\ndefinition\n  \"is_pedge h iG iP (p:: 32 signed word ptr) \\<equiv> arrlist (\\<lambda>p. heap_w32 h (ptr_coerce p))\n        (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) (mk_ipedge_list iG iP) p\"\n\ndefinition\n  \"is_dist h iG iD (p:: 32 signed word ptr) \\<equiv> arrlist (\\<lambda>p. heap_w32 h (ptr_coerce p))\n        (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) (mk_idist_list iG iD) p\"\n\ndefinition \n  \"is_cost h iG iC p \\<equiv> arrlist (heap_w32 h) (is_valid_w32 h) (mk_icost_list iG iC) p\"\n\n(* Abstract Graph *)\n\ndefinition \n  no_loops :: \"('a, 'b) pre_digraph \\<Rightarrow> bool\" \nwhere\n  \"no_loops G \\<equiv> \\<forall>e \\<in> arcs G. tail G e \\<noteq> head G e\"\n\ndefinition \n  abs_IGraph :: \"IGraph \\<Rightarrow> (32 word, 32 word) pre_digraph\" \nwhere\n  \"abs_IGraph G \\<equiv> \\<lparr> verts = {0..<ivertex_cnt G}, arcs = {0..<iedge_cnt G},\n    tail = fst o iedges G, head = snd o iedges G \\<rparr>\"\n\nlemma verts_absI[simp]: \"verts (abs_IGraph G) = {0..<ivertex_cnt G}\"\n  and edges_absI[simp]: \"arcs (abs_IGraph G) = {0..<iedge_cnt G}\"\n  and start_absI[simp]: \"tail (abs_IGraph G) e = fst (iedges G e)\"\n  and target_absI[simp]: \"head (abs_IGraph G) e = snd (iedges G e)\"\n  by (auto simp: abs_IGraph_def)\n\ndefinition \n  abs_pedge :: \"(32 word \\<Rightarrow> 32 word) \\<Rightarrow> 32 word \\<Rightarrow> 32 word option\" \nwhere\n  \"abs_pedge p \\<equiv> (\\<lambda>v. if sint (p v) < 0 then None else Some (p v))\"\n\nlemma None_abs_pedgeI[simp]: \n  \"((abs_pedge p) v = None) = (sint (p v) < 0)\"\n  using abs_pedge_def by auto\n\nlemma Some_abs_pedgeI[simp]: \n  \"(\\<exists>e. (abs_pedge p) v = Some e) = (sint (p v) \\<ge> 0)\"\n  using None_not_eq None_abs_pedgeI \n  by (metis abs_pedge_def linorder_not_le option.simps(3))\n    \n(*Helper Lemmas*)\n\nlemma wellformed_iGraph:\n  assumes \"wf_digraph (abs_IGraph G)\"\n  shows \"\\<And>e. e < iedge_cnt G \\<Longrightarrow> \n        fst (iedges G e) < ivertex_cnt G \\<and> \n        snd (iedges G e) < ivertex_cnt G\" \n  using assms unfolding wf_digraph_def by simp\n\nlemma unat_image_upto:\n  fixes n :: \"32 word\"\n  shows \"unat ` {0..<n} = {unat 0..<unat n}\" (is \"?A = ?B\")\nproof\n  show \"?B \\<subseteq> ?A\"  \n  proof \n    fix i assume a: \"i \\<in> ?B\"\n    then obtain i':: \"32 word\" where ii: \"i=  unat i'\"\n      by (metis atLeastLessThan_iff le_unat_uoi less_or_eq_imp_le)\n    then have \"i' \\<in> {0..<n}\" \n      using a word_less_nat_alt by auto\n    thus  \"i \\<in> ?A\" using ii by fast\n  qed\nnext\n  show \"?A \\<subseteq> ?B\"\n  proof\n     fix i assume a: \"i \\<in> ?A\"\n    then obtain i':: \"32 word\" where ii: \"i=  unat i'\" by blast\n    then have \"i' \\<in> {0..<n}\" using a by force\n    thus  \"i \\<in> ?B\"   \n      by (metis Un_iff atLeast0LessThan ii ivl_disj_un(8) \n          lessThan_iff unat_0 unat_mono word_zero_le)\n  qed\nqed\n\nlemma path_length:\n  assumes \"vpath p (abs_IGraph iG)\"\n  shows \"vwalk_length p < unat (ivertex_cnt iG)\" \nproof -\n  have pne: \"p \\<noteq> []\" and dp: \"distinct p\" using assms by fast+\n  have \"unat (ivertex_cnt iG) = card (unat ` {0..<(fst iG)})\"  \n    using unat_image_upto by simp\n  then have \"unat (ivertex_cnt iG) = card ((verts (abs_IGraph iG)))\"  \n     by (simp add: inj_on_def card_image)\n  hence \"length p  \\<le> unat (ivertex_cnt iG)\" \n      by (metis finite_code card_mono vwalk_def\n          distinct_card[OF dp] vpath_def assms)\n  hence \"length p - 1 < unat (ivertex_cnt iG)\" \n    by (metis pne Nat.diff_le_self le_neq_implies_less \n        less_imp_diff_less minus_eq one_neq_zero length_0_conv)\n  thus \"vwalk_length p < unat (fst iG)\"\n    using  assms \n    unfolding vpath_def vwalk_def by simp\nqed\n\nlemma ptr_coerce_ptr_add_uint[simp]:\n  \"ptr_coerce (p +\\<^sub>p uint x) =  p +\\<^sub>p  (uint x)\"\n  by auto\n\nlemma pedge_num_dist_heap:\n  \"\\<lbrakk>arrlist (\\<lambda>p. heap_w32 h p) (\\<lambda>p. is_valid_w32 h p) \n  (map (iL \\<circ> of_nat) [0..<unat n]) l; i < n\\<rbrakk> \\<Longrightarrow>\n    iL i = heap_w32 h (l +\\<^sub>p int (unat i))\" \n  apply (subgoal_tac \n  \"heap_w32 h (l +\\<^sub>p int (unat i)) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (simp add: arrlist_nth_value unat_mono)\n  done\n\nlemma pedge_num_dist_heap_ptr_coerce:\n  \"\\<lbrakk>arrlist (\\<lambda>p. heap_w32 h (ptr_coerce p)) (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) \n  (map (iL \\<circ> of_nat) [0..<unat n]) l; i < n; 0 \\<le> i\\<rbrakk> \\<Longrightarrow>\n    iL i = heap_w32 h (ptr_coerce (l +\\<^sub>p int (unat i)))\" \n  apply (subgoal_tac \n  \"heap_w32 h (ptr_coerce (l +\\<^sub>p int (unat i))) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (drule arrlist_nth_value[where i=\"int (unat i)\"], (simp add:unat_mono)+)\n  done\n\nlemma edge_heap:\n  \"\\<lbrakk> arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep;\n  e < m\\<rbrakk> \\<Longrightarrow> to_edge ((iedges iG) e) = h (ep +\\<^sub>p (int (unat e)))\" \n  apply (subgoal_tac \"h (ep +\\<^sub>p (int (unat e))) = \n  (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ! unat e\")\n   apply (subgoal_tac \"to_edge ((iedges iG) e) = \n   (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ! unat e\")\n    apply presburger \n   apply (metis (hide_lams, mono_tags) length_map length_upt o_apply\n      map_upt_eq_vals_D minus_nat.diff_0 unat_mono word_unat.Rep_inverse)\n  apply (fastforce simp: unat_mono arrlist_nth_value)\n  done\n\n\nlemma head_heap:\n  \"\\<lbrakk>arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  snd ((iedges iG) e) = second_C (h (ep +\\<^sub>p (uint e)))\" \n  using edge_heap to_edge.simps t_C_pte by (metis uint_nat)\n\nlemma tail_heap:\n  \"\\<lbrakk>arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  fst ((iedges iG) e) =  first_C (h (ep +\\<^sub>p  (uint e)))\" \n  using edge_heap to_edge.simps s_C_pte uint_nat by metis\n\nthm \"is_wellformed'_def\"\n\ndefinition is_wellformed_inv :: \"IGraph \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"is_wellformed_inv G i \\<equiv> \\<forall>k < i. ivertex_cnt G > fst (iedges G k)\n        \\<and> ivertex_cnt G > snd (iedges G k)\"\n\nlemma is_wellformed_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g) \\<rbrace>\n   is_wellformed' g\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> is_wellformed_inv iG (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: is_wellformed'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> is_wellformed_inv iG ee \\<and> \n                   ee \\<le> iedge_cnt iG \\<and> \n                   wf_digraph (abs_IGraph iG) \\<and>\n                   is_graph s iG g\"])\n  apply (simp add: skipE_def)\n  apply wp\n  unfolding is_graph_def is_wellformed_inv_def\n    apply (subst if_bool_eq_conj)+\n    apply (simp split: if_split_asm, safe, simp_all add: arrlist_nth)\n         apply (rule_tac x = \"ee\" in exI)\n         apply (subgoal_tac \"num_vertices_C (heap_IGraph_C s g) \\<le> fst (snd (snd iG) ee)\")\n          apply force\n         apply (subgoal_tac \"first_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p uint ee)) = fst (snd (snd iG) ee)\")\n          apply simp\n         apply (subst tail_heap[where iG=iG], simp)\n          apply blast\n         apply blast\n        apply(rule_tac x = \"ee\" in exI)\n        apply (subgoal_tac \"num_vertices_C (heap_IGraph_C s g) \\<le> snd (snd (snd iG) ee)\")\n         apply force\n        apply (subgoal_tac \"second_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p uint ee)) = snd (snd (snd iG) ee)\")\n         apply simp\n        apply (subst head_heap[where iG=iG], simp)\n         apply blast\n        apply blast\n       apply (metis edge_heap s_C_pte le_cases le_step uint_nat word_le_less_eq)\n      apply (metis head_heap le_step not_less)\n     apply (simp add: le_step word_not_le)\n  using le_step not_less \n     apply blast\n    apply (metis (mono_tags, hide_lams) diff_diff_add diff_self_eq_0 eq_iff_diff_eq_0 measure_unat not_less0 word_less_nat_alt zero_less_diff)\n   apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n  apply wp\n  apply fast\n  done\n\ndefinition trian_inv :: \"IGraph \\<Rightarrow> IDist \\<Rightarrow> ICost \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"trian_inv G d c m \\<equiv> \n    \\<forall>i < m. d (snd (iedges G i)) \\<le> d (fst (iedges G i)) + c i\"\n\nlemma trian_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c)\\<rbrace>\n   trian' g d c\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> trian_inv iG iD iC (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: trian'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> trian_inv iG iD iC ee \\<and> \n                   ee \\<le> iedge_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and> \n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_cost s iG iC c\"])\n  apply (simp add: skipE_def)\n  apply wp\n  unfolding is_graph_def is_dist_def is_cost_def trian_inv_def\n    apply (subst if_bool_eq_conj)+\n    apply (simp split: if_split_asm, safe, simp_all add: arrlist_nth)\n          apply (rule_tac x = \"ee\" in exI)\n          apply (rule conjI, simp+)\n          apply (subst pedge_num_dist_heap_ptr_coerce[where l=d and iL=iD])\n             apply fast\n            apply (subst head_heap[where iG=iG], simp+)\n            apply (metis head_heap wellformed_iGraph, simp+)\n          apply (subst pedge_num_dist_heap_ptr_coerce[where l=d and iL=iD])\n             apply fast\n            apply (subst tail_heap[where iG=iG], simp+)\n            apply (metis tail_heap wellformed_iGraph, simp+)\n          apply (drule wellformed_iGraph[where G=iG])\n           apply simp+\n          apply (subst head_heap[where iG=iG], simp+)\n          apply (subst tail_heap[where iG=iG], simp+)\n          apply (subgoal_tac \"heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat (second_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p uint ee))))))\n             > heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat (first_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p uint ee)))))) + iC ee\")\n           apply simp+\n          apply (subst pedge_num_dist_heap[where l=c and iL=iC])\n            apply simp+\n          apply (metis uint_nat)\n         apply (subst pedge_num_dist_heap_ptr_coerce[where l=d and iL=iD])\n            apply fast\n           apply (subst head_heap[where iG=iG], simp+)\n  using le_step less_trans \n            apply blast\n           apply (metis (no_types, hide_lams) head_heap wellformed_iGraph le_step less_trans)\n  using word_zero_le \n          apply blast\n         apply (subst pedge_num_dist_heap_ptr_coerce[where l=d and iL=iD])\n            apply fast\n           apply (subst tail_heap[where iG=iG], simp+)\n  using le_step less_trans\n            apply blast\n           apply (metis (no_types, hide_lams) tail_heap wellformed_iGraph le_step less_trans)\n          apply simp\n         apply (subst pedge_num_dist_heap[where l=c and iL=iC])\n           apply (simp add: uint_nat)+\n  using le_step less_trans\n          apply blast\n         apply (subst head_heap[where iG=iG], simp+)\n  using le_step less_trans \n          apply blast\n         apply (subst tail_heap[where iG=iG], simp+)\n  using le_step less_trans \n          apply blast\n         apply (subgoal_tac \"i < num_edges_C (heap_IGraph_C s g)\")\n          apply (subgoal_tac \"\\<And>w. \\<not> w < num_edges_C (heap_IGraph_C s g) \\<or> heap_w32 s (c +\\<^sub>p uint w) = iC w\")\n           apply (subgoal_tac \"\\<And>w. \\<not> w < num_edges_C (heap_IGraph_C s g) \\<or> heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p uint w) = to_edge (snd (snd iG) w)\")\n            apply (subgoal_tac \"\\<And>w. \\<not> w < fst iG \\<or> heap_w32 s (ptr_coerce (d +\\<^sub>p uint w)) = iD w\")\n             apply (subgoal_tac \"\\<And>w. \\<not> w < num_edges_C (heap_IGraph_C s g) \\<or> snd (snd (snd iG) w) < fst iG\")\n              apply (subgoal_tac \"\\<And>w. \\<not> w < num_edges_C (heap_IGraph_C s g) \\<or> fst (snd (snd iG) w) < fst iG\")\n               apply (subgoal_tac \"heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat (second_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p uint i)))))) \\<le> heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat (first_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p uint i)))))) + heap_w32 s (c +\\<^sub>p int (unat i))\")\n                apply metis\n               apply (subgoal_tac \"\\<forall>w. heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat w))) = iD w \\<or> \\<not> w < fst iG\")\n                apply (subgoal_tac \"heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat (second_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p int (unat i))))))) \\<le> heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat (first_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p int (unat i))))))) + iC i\")\n                 apply (subgoal_tac \"heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat (second_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p uint i)))))) \\<le> heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat (first_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p uint i)))))) + heap_w32 s (c +\\<^sub>p int (unat i))\")\n                  apply (simp add:uint_nat)+\n                apply (metis (no_types, hide_lams) le_step word_not_le)\n               apply (metis uint_nat)\n              apply (simp add: wf_digraph_def)\n             apply (simp add: wf_digraph_def)\n            apply (simp add: pedge_num_dist_heap_ptr_coerce uint_nat)\n           apply (simp add: edge_heap uint_nat)\n          apply (simp add: pedge_num_dist_heap uint_nat)\n  using le_step less_trans \n         apply blast\n  using le_step not_less \n        apply blast\n       apply (metis (no_types, hide_lams) diff_diff_add eq_iff_diff_eq_0 measure_unat word_not_le)\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n      apply (metis tail_heap wellformed_iGraph uint_nat word_less_nat_alt)\n     apply (rule_tac i=\"uint ee\" in arrlist_nth_valid, simp+)\n     apply (simp add:uint_nat)  \n  using word_less_nat_alt\n     apply blast\n    apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n    apply (metis head_heap wellformed_iGraph uint_nat word_less_nat_alt)\n   apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n  apply wp\n  apply fast\n  done\n\ndefinition just_inv :: \n  \"IGraph \\<Rightarrow> IDist \\<Rightarrow> ICost \\<Rightarrow> IVertex \\<Rightarrow> INum \\<Rightarrow> IPEdge \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"just_inv G d c s n p k \\<equiv>\n    \\<forall>v < k. v \\<noteq> s \\<and> n v \\<ge> 0 \\<longrightarrow>\n      (\\<exists> e. e = p v (*\\<and> p v \\<ge> 0*) \\<and> e < iedge_cnt G \\<and>\n        v = snd (iedges G e) \\<and>\n        d v = d (fst (iedges G e)) + c e \\<and>\n        n v = n (fst (iedges G e)) + 1)\"\n\n\n\nlemma just_inv_step:\n  assumes v_less_max: \"v < max_word\"\n  shows \"just_inv G d c s n p (v + 1) \\<longleftrightarrow> just_inv G d c s n p v\n    \\<and> (v \\<noteq> s \\<and> n v \\<ge> 0 \\<longrightarrow> \n      (\\<exists> e. e =  (p v) \\<and> e < iedge_cnt G \\<and> \n        v = snd (iedges G e) \\<and>\n        d v = d (fst (iedges G e)) +  c e \\<and>\n        n v = n (fst (iedges G e)) +  1))\"\n  unfolding just_inv_def using v_less_max \n  by (auto simp add : less_x_plus_1)\n\nlemma just_inv_le:\n  assumes leq: \"j \\<le> i\" \n  assumes just_i: \"just_inv G d c s n p i\"\n  shows \"just_inv G d c s n p j\"\n  using assms \n  by (induct j) (auto simp add: just_inv_def)\n\nlemma not_just_verts:\n  fixes G R c d n p s v\n  assumes v_less_max: \"v < max_word\"\n  assumes \"v < ivertex_cnt G\"\n  assumes \"v \\<noteq> s \\<and> n v \\<ge> 0 \\<and>\n        (iedge_cnt G \\<le> p v \\<or>\n        snd (iedges G (p v)) \\<noteq> v \\<or> \n        d v \\<noteq> \n          d (fst (iedges G (p v))) + c (p v) \\<or> \n        n v \\<noteq> n (fst (iedges G (p v))) + 1)\"\n  shows \"\\<not> just_inv G d c s n p (ivertex_cnt G)\"\nproof (rule notI)\n  assume jv: \"just_inv G d c s n p (ivertex_cnt G)\"\n  have \"just_inv G d c s n p (v + 1)\"\n    by (metis le_step order.asym word_not_le just_inv_le[OF _ jv] assms(2))\n  then have \"(v \\<noteq> s \\<and> n v \\<ge> 0 \\<longrightarrow> \n      (\\<exists> e. e = p v \\<and> e < iedge_cnt G \\<and> \n        v = snd (iedges G e) \\<and>\n        d v = d (fst (iedges G e)) + c e \\<and>\n        n v = n (fst (iedges G e)) + 1))\"\n    unfolding just_inv_def\n    using v_less_max just_inv_step\n    by (auto simp add : less_x_plus_1)\n  with assms show False by force\nqed\n\n\nlemma just_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          sc < ivertex_cnt iG \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   just' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> just_inv iG iD iC sc iN iP (ivertex_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: just'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(vv, s). unat (ivertex_cnt iG - vv)\" and\n        I=\"\\<lambda>vv s. P s \\<and> just_inv iG iD iC sc iN iP vv \\<and>\n                   vv \\<le> ivertex_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and>\n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_cost s iG iC c \\<and>\n                   sc < ivertex_cnt iG \\<and>\n                   is_numm s iG iN n \\<and>\n                   is_pedge s iG iP p\"])\n  apply (simp add: skipE_def)\n  apply wp\n  unfolding is_graph_def is_dist_def is_cost_def is_numm_def is_pedge_def just_inv_def\n    apply (subst if_bool_eq_conj)+\n    apply (simp split: if_split_asm, simp_all add: arrlist_nth) \n    apply (safe)\n                                                       apply (metis pedge_num_dist_heap_ptr_coerce uint_nat word_not_le word_zero_le)\n                                                      apply (metis (no_types) head_heap pedge_num_dist_heap_ptr_coerce uint_nat word_zero_le)\n                                                     prefer 52\n                                                     apply wp\n                                                     apply force\n                                                    prefer 51\n                                                    apply force\n                                                   prefer 50\n                                                   apply (rule_tac i=\"(uint sc)\" in arrlist_nth_valid, simp+)\n                                                   apply (simp add: uint_nat word_less_def)\n                                                  prefer 49\n                                                  apply (metis (no_types, hide_lams) diff_diff_add eq_iff_diff_eq_0 measure_unat word_not_le)\n                                                 prefer 48\n                                                 apply argo\n                                                prefer 47\n                                                apply argo\n                                               prefer 46\n                                               apply argo\n                                              prefer 45\n                                              apply argo\n                                             prefer 44\n                                             apply argo\n                                            prefer 43\n                                            apply (metis (mono_tags, hide_lams) le_step not_less)\n                                           prefer 42\n  using le_step \n                                           apply blast\n                                          prefer 41\n  using le_step \n                                          apply blast\n                                         prefer 40\n  using le_step\n                                        apply blast\n                                       prefer 39\n  using le_step \n                                       apply metis\n                                      prefer 38\n                                      apply (rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+)\n                                      apply (simp add: uint_nat word_less_def)\n                                     prefer 37\n                                     apply (rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+)\n                                     apply (simp add: uint_nat word_less_def)\n                                    prefer 36\n                                    apply (metis (no_types, hide_lams) diff_diff_add eq_iff_diff_eq_0 measure_unat word_not_le)\n                                   prefer 35\n                                   apply argo\n                                  prefer 34\n                                  apply argo\n                                 prefer 33\n                                 apply presburger\n                                prefer 32\n                                apply argo\n                               prefer 31\n                               apply argo\n                              prefer 30\n                              apply presburger\n                             prefer 29\n                             apply (metis (mono_tags, hide_lams) le_step not_less)\n                            prefer 28\n                            prefer 27\n                            prefer 26\n                            prefer 25\n                            prefer 24\n                            apply (rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+)\n                            apply (simp add: uint_nat word_less_def)\n                           prefer 23\n                           prefer 22\n                           prefer 21\n                           apply (rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+)\n                           apply (simp add: uint_nat word_less_def)\n                          prefer 20\n                          apply (metis (mono_tags, hide_lams) diff_diff_add eq_iff_diff_eq_0 measure_unat word_not_le)\n                         prefer 19\n                         apply argo\n                        prefer 18\n                        apply argo\n                       prefer 17\n                       apply presburger\n                      prefer 16\n                      apply argo\n                      prefer 15\n                      apply argo\n                     prefer 14\n                     apply argo\n                    prefer 13\n                    apply (metis le_step not_less)\n                   prefer 12\n                   prefer 11\n                   apply (metis (no_types) edge_heap pedge_num_dist_heap_ptr_coerce t_C_pte le_step not_less uint_nat word_zero_le)\n                  prefer 10\n                  apply (metis (no_types) pedge_num_dist_heap_ptr_coerce le_step not_less uint_nat word_zero_le)\n                 prefer 9\n                 apply (subgoal_tac \"\\<forall>w. heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat w))) = iP w \\<or> \\<not> w < fst iG\")\n                  apply (subgoal_tac \"\\<forall>w. heap_w32 s (ptr_coerce (n +\\<^sub>p int (unat w))) = iN w \\<or> \\<not> w < fst iG\")\n                   apply (subgoal_tac \"\\<exists>w<num_vertices_C (heap_IGraph_C s g). w \\<noteq> sc \\<and> (iD w = iD (fst (snd (snd iG) (iP w))) + iC (iP w) \\<longrightarrow> w = snd (snd (snd iG) (iP w)) \\<longrightarrow> iP w < num_edges_C (heap_IGraph_C s g) \\<longrightarrow> iN w \\<noteq> iN (fst (snd (snd iG) (iP w))) + 1)\")\n                    apply (metis (no_types))\n                   apply (metis (no_types, hide_lams) tail_heap wellformed_iGraph uint_nat)\n                  apply (metis pedge_num_dist_heap_ptr_coerce word_zero_le)\n                 apply (metis pedge_num_dist_heap_ptr_coerce word_zero_le)\n                apply (subst pedge_num_dist_heap_ptr_coerce[where l=p and iL=iP])\n                   apply simp+\n  using le_step less_trans\n                  apply blast\n                 apply fastforce\n                apply (subst pedge_num_dist_heap_ptr_coerce[where l=n and iL=iN])\n                   apply simp+\n  using le_step less_trans\n                  apply blast\n                 apply fastforce\n                apply (subst pedge_num_dist_heap_ptr_coerce[where l=n and iL=iN])\n                   apply simp+\n                  apply (metis (no_types) pedge_num_dist_heap_ptr_coerce wellformed_iGraph le_step uint_nat word_not_le word_zero_le)\n                 apply fastforce\n                apply (subgoal_tac \"\\<forall>w. heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat w))) = iP w \\<or> \\<not> w < fst iG\")\n                 apply (subgoal_tac \"\\<forall>w. heap_w32 s (ptr_coerce (n +\\<^sub>p int (unat w))) = iN w \\<or> \\<not> w < fst iG\")\n                  apply (subgoal_tac \"heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat vv))) < fst (snd iG)\")\n                   apply (subgoal_tac \"heap_w32 s (ptr_coerce (n +\\<^sub>p int (unat v))) = heap_w32 s (ptr_coerce (n +\\<^sub>p int (unat (fst (snd (snd iG) (heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat v))))))))) + 1\")\n                    apply (metis (no_types))\n                   apply (metis (no_types, hide_lams) edge_heap s_C_pte wellformed_iGraph le_step uint_nat)\n                  apply (simp add:uint_nat)\n                 apply (metis pedge_num_dist_heap_ptr_coerce word_zero_le)\n                apply (metis pedge_num_dist_heap_ptr_coerce word_zero_le)\n               prefer 8\n               apply (subst pedge_num_dist_heap_ptr_coerce[where l=d and iL=iD], simp+)\n  using le_step less_trans\n                 apply blast\n                apply simp\n               apply (subst pedge_num_dist_heap_ptr_coerce[where l=p and iL=iP], simp+)\n  using le_step less_trans\n                 apply blast\n                apply simp\n               apply (subst tail_heap[where iG=iG], simp+)\n                apply (subgoal_tac \"\\<forall>w. w < num_vertices_C (heap_IGraph_C s g) \\<or> \\<not> w < vv\")\n                 apply (subgoal_tac \"heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat v))) < num_edges_C (heap_IGraph_C s g)\")\n                  apply (meson less_trans)\n                 apply (metis (no_types) pedge_num_dist_heap_ptr_coerce le_step not_less uint_nat word_zero_le)\n                apply fastforce\n               apply (subst pedge_num_dist_heap_ptr_coerce[where l=d and iL=iD], simp+)\n                 apply (subgoal_tac \"\\<forall>w. heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat w))) = iP w \\<or> \\<not> w < fst iG\")\n                  apply (subgoal_tac \"first_C (heap_IEdge_C s (arcs_C (heap_IGraph_C s g) +\\<^sub>p uint (heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat v)))))) < num_vertices_C (heap_IGraph_C s g)\")\n  using pedge_num_dist_heap_ptr_coerce \n                   apply fastforce\n                  apply (metis (no_types) tail_heap wellformed_iGraph le_step not_less uint_nat)\n                 apply (metis pedge_num_dist_heap_ptr_coerce word_zero_le)\n                apply force\n               apply (subst pedge_num_dist_heap_ptr_coerce[where l=p and iL=iP], simp+)\n  using le_step less_trans\n                 apply blast\n                apply simp\n               apply (subst pedge_num_dist_heap[where l=c and iL=iC], simp+)\n                apply (subgoal_tac \"\\<forall>w. w < num_vertices_C (heap_IGraph_C s g) \\<or> \\<not> w < vv\")\n                 apply (subgoal_tac \"heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat v))) < num_edges_C (heap_IGraph_C s g)\")\n  using less_trans \n                  apply blast\n                 apply (metis (no_types) pedge_num_dist_heap_ptr_coerce le_step not_less uint_nat word_zero_le)\n  using less_trans\n                apply (blast, clarsimp)\n  \n  sorry\n\ndefinition no_path_inv :: \"IGraph \\<Rightarrow> IDist \\<Rightarrow> INum \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"no_path_inv G d n k \\<equiv>  \\<forall>v < k. (d v < 0 \\<longleftrightarrow> n v < 0)\"\n\nlemma no_path_inv_step:\n  \"no_path_inv G d n (v + 1) \\<longleftrightarrow> no_path_inv G d n v\n    \\<and> (d v < 0 \\<longleftrightarrow> n v < 0)\"\n  by (auto simp add: no_path_inv_def)\n\nlemma no_path_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n)\\<rbrace>\n   no_path' g d n\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> no_path_inv iG iD iN (ivertex_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: no_path'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(vv, s). unat (ivertex_cnt iG - vv)\" and\n        I=\"\\<lambda>vv s. P s \\<and> no_path_inv iG iD iN vv \\<and> \n                   vv \\<le> ivertex_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and> \n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_numm s iG iN n\"])\n  apply (simp add: skipE_def)\n  apply wp\n  unfolding is_graph_def is_dist_def is_numm_def no_path_inv_def\n    apply (subst if_bool_eq_conj)+\n    apply (simp split: if_split_asm, safe, simp_all add: arrlist_nth)\n           prefer 10\n           apply wp\n           apply fast\n          prefer 9\n          apply (rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+)\n          apply (simp add: uint_nat word_less_def)\n         prefer 6\n  using le_step not_less \n         apply blast\n        prefer 6\n        apply (metis (no_types, hide_lams) diff_diff_add eq_iff_diff_eq_0 measure_unat word_not_le)\n       prefer 2\n  using le_step not_less \n       apply blast\n      prefer 2\n      apply (metis (no_types, hide_lams) diff_diff_add eq_iff_diff_eq_0 measure_unat word_not_le)\n     prefer 2\n     apply (rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+)\n     apply (simp add:uint_nat word_less_def)\n    prefer 3\n    apply(rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+)\n    apply (simp add:uint_nat word_less_def)\n   prefer 2 \n   apply (simp add: uint_nat sint_ucast)\n   apply (rule classical, erule notE, simp)\n  \n  \n  \n(*\n   apply (subgoal_tac \"sint (heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat vv)))) < 0\")\n    apply force\n   apply (thin_tac \"\\<not> sint (heap_w32 s (ptr_coerce (d +\\<^sub>p int (unat vv)))) < 0\")\n\n   apply (drule_tac i=vv in pedge_num_dist_heap_ptr_coerce[where l=d and iL=iD])\n     apply simp+\n   apply (drule_tac i=vv in pedge_num_dist_heap_ptr_coerce[where l=n and iL=iN])\n     apply simp+\n*)\n(*\n  apply (subst \"sint_eq_uint\")\n  apply (rule not_msb_from_less)\n  find_theorems(99) \"sint _ = uint _\"\n  find_theorems \"msb\"\n*) \n  \n  sorry\n\ndefinition pos_cost_inv :: \"IGraph \\<Rightarrow> ICost \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"pos_cost_inv G c m \\<equiv>  \\<forall>e < m. c e \\<ge> 0\"\n\nlemma pos_cost_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_cost s iG iC c)\\<rbrace>\n   pos_cost' g c\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> pos_cost_inv iG iC (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: pos_cost'_def)\n  apply (subst whileLoop_add_inv [where\n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> pos_cost_inv iG iC ee \\<and>\n                   ee \\<le> iedge_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and>\n                   is_graph s iG g \\<and>\n                   is_cost s iG iC c\"])\n  apply wp\n  unfolding is_graph_def is_cost_def pos_cost_inv_def\n    apply (simp split: if_split_asm, safe, simp_all add: arrlist_nth)\n  using le_step not_less \n     apply blast\n    apply (subgoal_tac \"num_edges_C (heap_IGraph_C s g) - ee \\<noteq> 0\")\n     apply simp\n     apply (subgoal_tac \"\\<And>w wa. (w::32 word) - wa = 0 \\<or> unat (w - 1 - wa) < unat (w - wa)\")\n      apply (subgoal_tac \"unat (num_edges_C (heap_IGraph_C s g) - 1 - ee) < unat (num_edges_C (heap_IGraph_C s g) - ee)\")\n       apply (subgoal_tac \"unat (num_edges_C (heap_IGraph_C s g) - (ee + 1)) < unat (num_edges_C (heap_IGraph_C s g) - ee)\")\n        apply (simp add: add.commute diff_diff_add)\n       apply (simp add: diff_add_eq_diff_diff_swap)\n      apply fastforce\n     apply (metis (no_types) add.commute diff_diff_add measure_unat)\n    apply simp\n   apply (rule_tac i=\"(uint ee)\" in arrlist_nth_valid, simp+)\n   apply (simp add: uint_nat word_less_def)\n  apply wp\n  apply fast\n  done\n\nend\n\nend", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/myGraph.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297746074044135, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.33943794620615264}}
{"text": "(*  Title:      HOL/Record.thy\n    Author:     Wolfgang Naraschewski, TU Muenchen\n    Author:     Markus Wenzel, TU Muenchen\n    Author:     Norbert Schirmer, TU Muenchen\n    Author:     Thomas Sewell, NICTA\n    Author:     Florian Haftmann, TU Muenchen\n*)\n\nsection {* Extensible records with structural subtyping *}\n\ntheory Record\nimports Quickcheck_Exhaustive\nkeywords \"record\" :: thy_decl\nbegin\n\nsubsection {* Introduction *}\n\ntext {*\n  Records are isomorphic to compound tuple types. To implement\n  efficient records, we make this isomorphism explicit. Consider the\n  record access/update simplification @{text \"alpha (beta_update f\n  rec) = alpha rec\"} for distinct fields alpha and beta of some record\n  rec with n fields. There are @{text \"n ^ 2\"} such theorems, which\n  prohibits storage of all of them for large n. The rules can be\n  proved on the fly by case decomposition and simplification in O(n)\n  time. By creating O(n) isomorphic-tuple types while defining the\n  record, however, we can prove the access/update simplification in\n  @{text \"O(log(n)^2)\"} time.\n\n  The O(n) cost of case decomposition is not because O(n) steps are\n  taken, but rather because the resulting rule must contain O(n) new\n  variables and an O(n) size concrete record construction. To sidestep\n  this cost, we would like to avoid case decomposition in proving\n  access/update theorems.\n\n  Record types are defined as isomorphic to tuple types. For instance,\n  a record type with fields @{text \"'a\"}, @{text \"'b\"}, @{text \"'c\"}\n  and @{text \"'d\"} might be introduced as isomorphic to @{text \"'a \\<times>\n  ('b \\<times> ('c \\<times> 'd))\"}. If we balance the tuple tree to @{text \"('a \\<times>\n  'b) \\<times> ('c \\<times> 'd)\"} then accessors can be defined by converting to the\n  underlying type then using O(log(n)) fst or snd operations.\n  Updators can be defined similarly, if we introduce a @{text\n  \"fst_update\"} and @{text \"snd_update\"} function. Furthermore, we can\n  prove the access/update theorem in O(log(n)) steps by using simple\n  rewrites on fst, snd, @{text \"fst_update\"} and @{text \"snd_update\"}.\n\n  The catch is that, although O(log(n)) steps were taken, the\n  underlying type we converted to is a tuple tree of size\n  O(n). Processing this term type wastes performance. We avoid this\n  for large n by taking each subtree of size K and defining a new type\n  isomorphic to that tuple subtree. A record can now be defined as\n  isomorphic to a tuple tree of these O(n/K) new types, or, if @{text\n  \"n > K*K\"}, we can repeat the process, until the record can be\n  defined in terms of a tuple tree of complexity less than the\n  constant K.\n\n  If we prove the access/update theorem on this type with the\n  analogous steps to the tuple tree, we consume @{text \"O(log(n)^2)\"}\n  time as the intermediate terms are @{text \"O(log(n))\"} in size and\n  the types needed have size bounded by K.  To enable this analogous\n  traversal, we define the functions seen below: @{text\n  \"iso_tuple_fst\"}, @{text \"iso_tuple_snd\"}, @{text \"iso_tuple_fst_update\"}\n  and @{text \"iso_tuple_snd_update\"}. These functions generalise tuple\n  operations by taking a parameter that encapsulates a tuple\n  isomorphism.  The rewrites needed on these functions now need an\n  additional assumption which is that the isomorphism works.\n\n  These rewrites are typically used in a structured way. They are here\n  presented as the introduction rule @{text \"isomorphic_tuple.intros\"}\n  rather than as a rewrite rule set. The introduction form is an\n  optimisation, as net matching can be performed at one term location\n  for each step rather than the simplifier searching the term for\n  possible pattern matches. The rule set is used as it is viewed\n  outside the locale, with the locale assumption (that the isomorphism\n  is valid) left as a rule assumption. All rules are structured to aid\n  net matching, using either a point-free form or an encapsulating\n  predicate.\n*}\n\nsubsection {* Operators and lemmas for types isomorphic to tuples *}\n\ndatatype (dead 'a, dead 'b, dead 'c) tuple_isomorphism =\n  Tuple_Isomorphism \"'a \\<Rightarrow> 'b \\<times> 'c\" \"'b \\<times> 'c \\<Rightarrow> 'a\"\n\nprimrec\n  repr :: \"('a, 'b, 'c) tuple_isomorphism \\<Rightarrow> 'a \\<Rightarrow> 'b \\<times> 'c\" where\n  \"repr (Tuple_Isomorphism r a) = r\"\n\nprimrec\n  abst :: \"('a, 'b, 'c) tuple_isomorphism \\<Rightarrow> 'b \\<times> 'c \\<Rightarrow> 'a\" where\n  \"abst (Tuple_Isomorphism r a) = a\"\n\ndefinition\n  iso_tuple_fst :: \"('a, 'b, 'c) tuple_isomorphism \\<Rightarrow> 'a \\<Rightarrow> 'b\" where\n  \"iso_tuple_fst isom = fst \\<circ> repr isom\"\n\ndefinition\n  iso_tuple_snd :: \"('a, 'b, 'c) tuple_isomorphism \\<Rightarrow> 'a \\<Rightarrow> 'c\" where\n  \"iso_tuple_snd isom = snd \\<circ> repr isom\"\n\ndefinition\n  iso_tuple_fst_update ::\n    \"('a, 'b, 'c) tuple_isomorphism \\<Rightarrow> ('b \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'a)\" where\n  \"iso_tuple_fst_update isom f = abst isom \\<circ> apfst f \\<circ> repr isom\"\n\ndefinition\n  iso_tuple_snd_update ::\n    \"('a, 'b, 'c) tuple_isomorphism \\<Rightarrow> ('c \\<Rightarrow> 'c) \\<Rightarrow> ('a \\<Rightarrow> 'a)\" where\n  \"iso_tuple_snd_update isom f = abst isom \\<circ> apsnd f \\<circ> repr isom\"\n\ndefinition\n  iso_tuple_cons ::\n    \"('a, 'b, 'c) tuple_isomorphism \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'a\" where\n  \"iso_tuple_cons isom = curry (abst isom)\"\n\n\nsubsection {* Logical infrastructure for records *}\n\ndefinition\n  iso_tuple_surjective_proof_assist :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> bool\" where\n  \"iso_tuple_surjective_proof_assist x y f \\<longleftrightarrow> f x = y\"\n\ndefinition\n  iso_tuple_update_accessor_cong_assist ::\n    \"(('b \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'a)) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> bool\" where\n  \"iso_tuple_update_accessor_cong_assist upd ac \\<longleftrightarrow>\n     (\\<forall>f v. upd (\\<lambda>x. f (ac v)) v = upd f v) \\<and> (\\<forall>v. upd id v = v)\"\n\ndefinition\n  iso_tuple_update_accessor_eq_assist ::\n    \"(('b \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'a)) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> ('b \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b \\<Rightarrow> bool\" where\n  \"iso_tuple_update_accessor_eq_assist upd ac v f v' x \\<longleftrightarrow>\n     upd f v = v' \\<and> ac v = x \\<and> iso_tuple_update_accessor_cong_assist upd ac\"\n\nlemma update_accessor_congruence_foldE:\n  assumes uac: \"iso_tuple_update_accessor_cong_assist upd ac\"\n    and r: \"r = r'\" and v: \"ac r' = v'\"\n    and f: \"\\<And>v. v' = v \\<Longrightarrow> f v = f' v\"\n  shows \"upd f r = upd f' r'\"\n  using uac r v [symmetric]\n  apply (subgoal_tac \"upd (\\<lambda>x. f (ac r')) r' = upd (\\<lambda>x. f' (ac r')) r'\")\n   apply (simp add: iso_tuple_update_accessor_cong_assist_def)\n  apply (simp add: f)\n  done\n\nlemma update_accessor_congruence_unfoldE:\n  \"iso_tuple_update_accessor_cong_assist upd ac \\<Longrightarrow>\n    r = r' \\<Longrightarrow> ac r' = v' \\<Longrightarrow> (\\<And>v. v = v' \\<Longrightarrow> f v = f' v) \\<Longrightarrow>\n    upd f r = upd f' r'\"\n  apply (erule(2) update_accessor_congruence_foldE)\n  apply simp\n  done\n\nlemma iso_tuple_update_accessor_cong_assist_id:\n  \"iso_tuple_update_accessor_cong_assist upd ac \\<Longrightarrow> upd id = id\"\n  by rule (simp add: iso_tuple_update_accessor_cong_assist_def)\n\nlemma update_accessor_noopE:\n  assumes uac: \"iso_tuple_update_accessor_cong_assist upd ac\"\n    and ac: \"f (ac x) = ac x\"\n  shows \"upd f x = x\"\n  using uac\n  by (simp add: ac iso_tuple_update_accessor_cong_assist_id [OF uac, unfolded id_def]\n    cong: update_accessor_congruence_unfoldE [OF uac])\n\nlemma update_accessor_noop_compE:\n  assumes uac: \"iso_tuple_update_accessor_cong_assist upd ac\"\n    and ac: \"f (ac x) = ac x\"\n  shows \"upd (g \\<circ> f) x = upd g x\"\n  by (simp add: ac cong: update_accessor_congruence_unfoldE[OF uac])\n\nlemma update_accessor_cong_assist_idI:\n  \"iso_tuple_update_accessor_cong_assist id id\"\n  by (simp add: iso_tuple_update_accessor_cong_assist_def)\n\nlemma update_accessor_cong_assist_triv:\n  \"iso_tuple_update_accessor_cong_assist upd ac \\<Longrightarrow>\n    iso_tuple_update_accessor_cong_assist upd ac\"\n  by assumption\n\nlemma update_accessor_accessor_eqE:\n  \"iso_tuple_update_accessor_eq_assist upd ac v f v' x \\<Longrightarrow> ac v = x\"\n  by (simp add: iso_tuple_update_accessor_eq_assist_def)\n\nlemma update_accessor_updator_eqE:\n  \"iso_tuple_update_accessor_eq_assist upd ac v f v' x \\<Longrightarrow> upd f v = v'\"\n  by (simp add: iso_tuple_update_accessor_eq_assist_def)\n\nlemma iso_tuple_update_accessor_eq_assist_idI:\n  \"v' = f v \\<Longrightarrow> iso_tuple_update_accessor_eq_assist id id v f v' v\"\n  by (simp add: iso_tuple_update_accessor_eq_assist_def update_accessor_cong_assist_idI)\n\nlemma iso_tuple_update_accessor_eq_assist_triv:\n  \"iso_tuple_update_accessor_eq_assist upd ac v f v' x \\<Longrightarrow>\n    iso_tuple_update_accessor_eq_assist upd ac v f v' x\"\n  by assumption\n\nlemma iso_tuple_update_accessor_cong_from_eq:\n  \"iso_tuple_update_accessor_eq_assist upd ac v f v' x \\<Longrightarrow>\n    iso_tuple_update_accessor_cong_assist upd ac\"\n  by (simp add: iso_tuple_update_accessor_eq_assist_def)\n\nlemma iso_tuple_surjective_proof_assistI:\n  \"f x = y \\<Longrightarrow> iso_tuple_surjective_proof_assist x y f\"\n  by (simp add: iso_tuple_surjective_proof_assist_def)\n\nlemma iso_tuple_surjective_proof_assist_idE:\n  \"iso_tuple_surjective_proof_assist x y id \\<Longrightarrow> x = y\"\n  by (simp add: iso_tuple_surjective_proof_assist_def)\n\nlocale isomorphic_tuple =\n  fixes isom :: \"('a, 'b, 'c) tuple_isomorphism\"\n  assumes repr_inv: \"\\<And>x. abst isom (repr isom x) = x\"\n    and abst_inv: \"\\<And>y. repr isom (abst isom y) = y\"\nbegin\n\nlemma repr_inj: \"repr isom x = repr isom y \\<longleftrightarrow> x = y\"\n  by (auto dest: arg_cong [of \"repr isom x\" \"repr isom y\" \"abst isom\"]\n    simp add: repr_inv)\n\nlemma abst_inj: \"abst isom x = abst isom y \\<longleftrightarrow> x = y\"\n  by (auto dest: arg_cong [of \"abst isom x\" \"abst isom y\" \"repr isom\"]\n    simp add: abst_inv)\n\nlemmas simps = Let_def repr_inv abst_inv repr_inj abst_inj\n\nlemma iso_tuple_access_update_fst_fst:\n  \"f o h g = j o f \\<Longrightarrow>\n    (f o iso_tuple_fst isom) o (iso_tuple_fst_update isom o h) g =\n      j o (f o iso_tuple_fst isom)\"\n  by (clarsimp simp: iso_tuple_fst_update_def iso_tuple_fst_def simps\n    fun_eq_iff)\n\nlemma iso_tuple_access_update_snd_snd:\n  \"f o h g = j o f \\<Longrightarrow>\n    (f o iso_tuple_snd isom) o (iso_tuple_snd_update isom o h) g =\n      j o (f o iso_tuple_snd isom)\"\n  by (clarsimp simp: iso_tuple_snd_update_def iso_tuple_snd_def simps\n    fun_eq_iff)\n\nlemma iso_tuple_access_update_fst_snd:\n  \"(f o iso_tuple_fst isom) o (iso_tuple_snd_update isom o h) g =\n    id o (f o iso_tuple_fst isom)\"\n  by (clarsimp simp: iso_tuple_snd_update_def iso_tuple_fst_def simps\n    fun_eq_iff)\n\nlemma iso_tuple_access_update_snd_fst:\n  \"(f o iso_tuple_snd isom) o (iso_tuple_fst_update isom o h) g =\n    id o (f o iso_tuple_snd isom)\"\n  by (clarsimp simp: iso_tuple_fst_update_def iso_tuple_snd_def simps\n    fun_eq_iff)\n\nlemma iso_tuple_update_swap_fst_fst:\n  \"h f o j g = j g o h f \\<Longrightarrow>\n    (iso_tuple_fst_update isom o h) f o (iso_tuple_fst_update isom o j) g =\n      (iso_tuple_fst_update isom o j) g o (iso_tuple_fst_update isom o h) f\"\n  by (clarsimp simp: iso_tuple_fst_update_def simps apfst_compose fun_eq_iff)\n\nlemma iso_tuple_update_swap_snd_snd:\n  \"h f o j g = j g o h f \\<Longrightarrow>\n    (iso_tuple_snd_update isom o h) f o (iso_tuple_snd_update isom o j) g =\n      (iso_tuple_snd_update isom o j) g o (iso_tuple_snd_update isom o h) f\"\n  by (clarsimp simp: iso_tuple_snd_update_def simps apsnd_compose fun_eq_iff)\n\nlemma iso_tuple_update_swap_fst_snd:\n  \"(iso_tuple_snd_update isom o h) f o (iso_tuple_fst_update isom o j) g =\n    (iso_tuple_fst_update isom o j) g o (iso_tuple_snd_update isom o h) f\"\n  by (clarsimp simp: iso_tuple_fst_update_def iso_tuple_snd_update_def\n    simps fun_eq_iff)\n\nlemma iso_tuple_update_swap_snd_fst:\n  \"(iso_tuple_fst_update isom o h) f o (iso_tuple_snd_update isom o j) g =\n    (iso_tuple_snd_update isom o j) g o (iso_tuple_fst_update isom o h) f\"\n  by (clarsimp simp: iso_tuple_fst_update_def iso_tuple_snd_update_def simps\n    fun_eq_iff)\n\nlemma iso_tuple_update_compose_fst_fst:\n  \"h f o j g = k (f o g) \\<Longrightarrow>\n    (iso_tuple_fst_update isom o h) f o (iso_tuple_fst_update isom o j) g =\n      (iso_tuple_fst_update isom o k) (f o g)\"\n  by (clarsimp simp: iso_tuple_fst_update_def simps apfst_compose fun_eq_iff)\n\nlemma iso_tuple_update_compose_snd_snd:\n  \"h f o j g = k (f o g) \\<Longrightarrow>\n    (iso_tuple_snd_update isom o h) f o (iso_tuple_snd_update isom o j) g =\n      (iso_tuple_snd_update isom o k) (f o g)\"\n  by (clarsimp simp: iso_tuple_snd_update_def simps apsnd_compose fun_eq_iff)\n\nlemma iso_tuple_surjective_proof_assist_step:\n  \"iso_tuple_surjective_proof_assist v a (iso_tuple_fst isom o f) \\<Longrightarrow>\n    iso_tuple_surjective_proof_assist v b (iso_tuple_snd isom o f) \\<Longrightarrow>\n    iso_tuple_surjective_proof_assist v (iso_tuple_cons isom a b) f\"\n  by (clarsimp simp: iso_tuple_surjective_proof_assist_def simps\n    iso_tuple_fst_def iso_tuple_snd_def iso_tuple_cons_def)\n\nlemma iso_tuple_fst_update_accessor_cong_assist:\n  assumes \"iso_tuple_update_accessor_cong_assist f g\"\n  shows \"iso_tuple_update_accessor_cong_assist\n    (iso_tuple_fst_update isom o f) (g o iso_tuple_fst isom)\"\nproof -\n  from assms have \"f id = id\"\n    by (rule iso_tuple_update_accessor_cong_assist_id)\n  with assms show ?thesis\n    by (clarsimp simp: iso_tuple_update_accessor_cong_assist_def simps\n      iso_tuple_fst_update_def iso_tuple_fst_def)\nqed\n\nlemma iso_tuple_snd_update_accessor_cong_assist:\n  assumes \"iso_tuple_update_accessor_cong_assist f g\"\n  shows \"iso_tuple_update_accessor_cong_assist\n    (iso_tuple_snd_update isom o f) (g o iso_tuple_snd isom)\"\nproof -\n  from assms have \"f id = id\"\n    by (rule iso_tuple_update_accessor_cong_assist_id)\n  with assms show ?thesis\n    by (clarsimp simp: iso_tuple_update_accessor_cong_assist_def simps\n      iso_tuple_snd_update_def iso_tuple_snd_def)\nqed\n\nlemma iso_tuple_fst_update_accessor_eq_assist:\n  assumes \"iso_tuple_update_accessor_eq_assist f g a u a' v\"\n  shows \"iso_tuple_update_accessor_eq_assist\n    (iso_tuple_fst_update isom o f) (g o iso_tuple_fst isom)\n    (iso_tuple_cons isom a b) u (iso_tuple_cons isom a' b) v\"\nproof -\n  from assms have \"f id = id\"\n    by (auto simp add: iso_tuple_update_accessor_eq_assist_def\n      intro: iso_tuple_update_accessor_cong_assist_id)\n  with assms show ?thesis\n    by (clarsimp simp: iso_tuple_update_accessor_eq_assist_def\n      iso_tuple_fst_update_def iso_tuple_fst_def\n      iso_tuple_update_accessor_cong_assist_def iso_tuple_cons_def simps)\nqed\n\nlemma iso_tuple_snd_update_accessor_eq_assist:\n  assumes \"iso_tuple_update_accessor_eq_assist f g b u b' v\"\n  shows \"iso_tuple_update_accessor_eq_assist\n    (iso_tuple_snd_update isom o f) (g o iso_tuple_snd isom)\n    (iso_tuple_cons isom a b) u (iso_tuple_cons isom a b') v\"\nproof -\n  from assms have \"f id = id\"\n    by (auto simp add: iso_tuple_update_accessor_eq_assist_def\n      intro: iso_tuple_update_accessor_cong_assist_id)\n  with assms show ?thesis\n    by (clarsimp simp: iso_tuple_update_accessor_eq_assist_def\n      iso_tuple_snd_update_def iso_tuple_snd_def\n      iso_tuple_update_accessor_cong_assist_def iso_tuple_cons_def simps)\nqed\n\nlemma iso_tuple_cons_conj_eqI:\n  \"a = c \\<and> b = d \\<and> P \\<longleftrightarrow> Q \\<Longrightarrow>\n    iso_tuple_cons isom a b = iso_tuple_cons isom c d \\<and> P \\<longleftrightarrow> Q\"\n  by (clarsimp simp: iso_tuple_cons_def simps)\n\nlemmas intros =\n  iso_tuple_access_update_fst_fst\n  iso_tuple_access_update_snd_snd\n  iso_tuple_access_update_fst_snd\n  iso_tuple_access_update_snd_fst\n  iso_tuple_update_swap_fst_fst\n  iso_tuple_update_swap_snd_snd\n  iso_tuple_update_swap_fst_snd\n  iso_tuple_update_swap_snd_fst\n  iso_tuple_update_compose_fst_fst\n  iso_tuple_update_compose_snd_snd\n  iso_tuple_surjective_proof_assist_step\n  iso_tuple_fst_update_accessor_eq_assist\n  iso_tuple_snd_update_accessor_eq_assist\n  iso_tuple_fst_update_accessor_cong_assist\n  iso_tuple_snd_update_accessor_cong_assist\n  iso_tuple_cons_conj_eqI\n\nend\n\nlemma isomorphic_tuple_intro:\n  fixes repr abst\n  assumes repr_inj: \"\\<And>x y. repr x = repr y \\<longleftrightarrow> x = y\"\n    and abst_inv: \"\\<And>z. repr (abst z) = z\"\n    and v: \"v \\<equiv> Tuple_Isomorphism repr abst\"\n  shows \"isomorphic_tuple v\"\nproof\n  fix x have \"repr (abst (repr x)) = repr x\"\n    by (simp add: abst_inv)\n  then show \"Record.abst v (Record.repr v x) = x\"\n    by (simp add: v repr_inj)\nnext\n  fix y\n  show \"Record.repr v (Record.abst v y) = y\"\n    by (simp add: v) (fact abst_inv)\nqed\n\ndefinition\n  \"tuple_iso_tuple \\<equiv> Tuple_Isomorphism id id\"\n\nlemma tuple_iso_tuple:\n  \"isomorphic_tuple tuple_iso_tuple\"\n  by (simp add: isomorphic_tuple_intro [OF _ _ reflexive] tuple_iso_tuple_def)\n\nlemma refl_conj_eq: \"Q = R \\<Longrightarrow> P \\<and> Q \\<longleftrightarrow> P \\<and> R\"\n  by simp\n\nlemma iso_tuple_UNIV_I: \"x \\<in> UNIV \\<equiv> True\"\n  by simp\n\nlemma iso_tuple_True_simp: \"(True \\<Longrightarrow> PROP P) \\<equiv> PROP P\"\n  by simp\n\nlemma prop_subst: \"s = t \\<Longrightarrow> PROP P t \\<Longrightarrow> PROP P s\"\n  by simp\n\nlemma K_record_comp: \"(\\<lambda>x. c) \\<circ> f = (\\<lambda>x. c)\"\n  by (simp add: comp_def)\n\n\nsubsection {* Concrete record syntax *}\n\nnonterminal\n  ident and\n  field_type and\n  field_types and\n  field and\n  fields and\n  field_update and\n  field_updates\n\nsyntax\n  \"_constify\"           :: \"id => ident\"                        (\"_\")\n  \"_constify\"           :: \"longid => ident\"                    (\"_\")\n\n  \"_field_type\"         :: \"ident => type => field_type\"        (\"(2_ ::/ _)\")\n  \"\"                    :: \"field_type => field_types\"          (\"_\")\n  \"_field_types\"        :: \"field_type => field_types => field_types\"    (\"_,/ _\")\n  \"_record_type\"        :: \"field_types => type\"                (\"(3'(| _ |'))\")\n  \"_record_type_scheme\" :: \"field_types => type => type\"        (\"(3'(| _,/ (2... ::/ _) |'))\")\n\n  \"_field\"              :: \"ident => 'a => field\"               (\"(2_ =/ _)\")\n  \"\"                    :: \"field => fields\"                    (\"_\")\n  \"_fields\"             :: \"field => fields => fields\"          (\"_,/ _\")\n  \"_record\"             :: \"fields => 'a\"                       (\"(3'(| _ |'))\")\n  \"_record_scheme\"      :: \"fields => 'a => 'a\"                 (\"(3'(| _,/ (2... =/ _) |'))\")\n\n  \"_field_update\"       :: \"ident => 'a => field_update\"        (\"(2_ :=/ _)\")\n  \"\"                    :: \"field_update => field_updates\"      (\"_\")\n  \"_field_updates\"      :: \"field_update => field_updates => field_updates\"  (\"_,/ _\")\n  \"_record_update\"      :: \"'a => field_updates => 'b\"          (\"_/(3'(| _ |'))\" [900, 0] 900)\n\nsyntax (xsymbols)\n  \"_record_type\"        :: \"field_types => type\"                (\"(3\\<lparr>_\\<rparr>)\")\n  \"_record_type_scheme\" :: \"field_types => type => type\"        (\"(3\\<lparr>_,/ (2\\<dots> ::/ _)\\<rparr>)\")\n  \"_record\"             :: \"fields => 'a\"                       (\"(3\\<lparr>_\\<rparr>)\")\n  \"_record_scheme\"      :: \"fields => 'a => 'a\"                 (\"(3\\<lparr>_,/ (2\\<dots> =/ _)\\<rparr>)\")\n  \"_record_update\"      :: \"'a => field_updates => 'b\"          (\"_/(3\\<lparr>_\\<rparr>)\" [900, 0] 900)\n\n\nsubsection {* Record package *}\n\nML_file \"Tools/record.ML\"\n\nhide_const (open) Tuple_Isomorphism repr abst iso_tuple_fst iso_tuple_snd\n  iso_tuple_fst_update iso_tuple_snd_update iso_tuple_cons\n  iso_tuple_surjective_proof_assist iso_tuple_update_accessor_cong_assist\n  iso_tuple_update_accessor_eq_assist tuple_iso_tuple\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Record.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297746074044135, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.33943794620615264}}
{"text": "(*  Title:       The Embedding Path Order for Lambda-Free Higher-Order Terms\n    Author:      Alexander Bentkamp <a.bentkamp at vu.nl>, 2018\n    Maintainer:  Alexander Bentkamp <a.bentkamp at vu.nl>\n*)\n\nsection \\<open>The Embedding Path Order for Lambda-Free Higher-Order Terms\\<close>\n\ntheory Lambda_Free_EPO\nimports Chop Nested_Multisets_Ordinals.Multiset_More\nabbrevs \">t\" = \">\\<^sub>t\"\n  and \"\\<ge>t\" = \"\\<ge>\\<^sub>t\"\nbegin\n\ntext \\<open>\nThis theory defines the embedding path order for \\<open>\\<lambda>\\<close>-free\nhigher-order terms.\n\\<close>\n\nsubsection \\<open>Setup\\<close>\n\nlocale epo = ground_heads \"(>\\<^sub>s)\" arity_sym arity_var\n    for\n      gt_sym :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (infix \">\\<^sub>s\" 50) and\n      arity_sym :: \"'s \\<Rightarrow> enat\" and\n      arity_var :: \"'v \\<Rightarrow> enat\" +\n  fixes\n    extf :: \"'s \\<Rightarrow> (('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool) \\<Rightarrow> ('s, 'v) tm list \\<Rightarrow> ('s, 'v) tm list \\<Rightarrow> bool\"\n  assumes\n    extf_ext_trans_before_irrefl: \"ext_trans_before_irrefl (extf f)\" and\n    extf_ext_compat_list: \"ext_compat_list (extf f)\"\n  assumes extf_ext_compat_snoc: \"ext_compat_snoc (extf f)\"\n  assumes extf_ext_compat_cons: \"ext_compat_cons (extf f)\"\n  assumes extf_min_empty: \"extf f gt [a] []\" (* TODO: seperate definition? *)\nbegin\n\nlemma extf_ext_trans: \"ext_trans (extf f)\"\n  by (rule ext_trans_before_irrefl.axioms(1)[OF extf_ext_trans_before_irrefl])\n\nlemma extf_ext: \"ext (extf f)\"\n  by (rule ext_trans.axioms(1)[OF extf_ext_trans])\n\nlemmas extf_mono_strong = ext.mono_strong[OF extf_ext]\nlemmas extf_mono = ext.mono[OF extf_ext, mono]\nlemmas extf_map = ext.map[OF extf_ext]\nlemmas extf_trans = ext_trans.trans[OF extf_ext_trans]\nlemmas extf_irrefl_from_trans =\n  ext_trans_before_irrefl.irrefl_from_trans[OF extf_ext_trans_before_irrefl]\nlemmas extf_compat_list = ext_compat_list.compat_list[OF extf_ext_compat_list]\n\nlemmas extf_compat_cons = ext_compat_cons.compat_cons[OF extf_ext_compat_cons]\nlemmas extf_compat_snoc = ext_compat_snoc.compat_snoc[OF extf_ext_compat_snoc]\n\nlemmas extf_compat_append_right = ext_compat_snoc.compat_append_right[OF extf_ext_compat_snoc]\nlemmas extf_compat_append_left = ext_compat_cons.compat_append_left[OF extf_ext_compat_cons]\n\nlemma extf_snoc: \"extf f gt (xs @ [z]) xs\"\nproof (induction xs)\n  case Nil\n  then show ?case \n    using extf_min_empty by force\nnext\n  case (Cons a xs)\n  then show ?case\n    by (simp add: extf_compat_cons)\nqed\n\nsubsection \\<open>Inductive Definitions\\<close>\n\ndefinition\n  chkchop :: \"(('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool) \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\"\nwhere\n  [simp]: \"chkchop gt t s \\<longleftrightarrow> is_Hd s \\<or> gt t (chop s)\"\n\ndefinition\n  chkchop_same :: \"(('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool) \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\"\nwhere\n  [simp]: \"chkchop_same gt t s \\<longleftrightarrow> \n            (if is_Var (head t) \n            then is_App t \\<and> chkchop gt (chop t) s \n            else chkchop gt t s)\"\n\nlemma chkchop_mono[mono]: \"gt \\<le> gt' \\<Longrightarrow> chkchop gt \\<le> chkchop gt'\"\n  using chkchop_def by blast\n\nlemma chkchop_same_mono[mono]: \"gt \\<le> gt' \\<Longrightarrow> chkchop_same gt \\<le> chkchop_same gt'\"\n  using chkchop_same_def by fastforce\n\ninductive gt :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" (infix \">\\<^sub>t\" 50) where\n  gt_chop: \"is_App t \\<Longrightarrow> chop t >\\<^sub>t s \\<or> chop t = s \\<Longrightarrow> t >\\<^sub>t s\"\n| gt_diff: \"head t >\\<^sub>h\\<^sub>d head s \\<Longrightarrow> is_Sym (head s) \\<Longrightarrow> chkchop (>\\<^sub>t) t s \\<Longrightarrow> t >\\<^sub>t s\"\n| gt_same: \"head t = head s \\<Longrightarrow> chkchop_same (>\\<^sub>t) t s \\<Longrightarrow>\n    (\\<forall>f \\<in> ground_heads (head t). extf f (>\\<^sub>t) (args t) (args s)) \\<Longrightarrow> t >\\<^sub>t s\"\n\nabbreviation ge :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" (infix \"\\<ge>\\<^sub>t\" 50) where\n  \"t \\<ge>\\<^sub>t s \\<equiv> t >\\<^sub>t s \\<or> t = s\"\n\ninductive gt_chop :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" where\n  gt_chopI: \"is_App t \\<Longrightarrow> chop t \\<ge>\\<^sub>t s \\<Longrightarrow> gt_chop t s\"\n\ninductive gt_diff :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" where\n  gt_diffI: \"head t >\\<^sub>h\\<^sub>d head s \\<Longrightarrow> is_Sym (head s) \\<Longrightarrow> chkchop (>\\<^sub>t) t s \\<Longrightarrow> gt_diff t s\"\n\ninductive gt_same :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" where\n  gt_sameI: \"head t = head s \\<Longrightarrow> chkchop_same (>\\<^sub>t) t s \\<Longrightarrow>\n    (\\<forall>f \\<in> ground_heads (head t). extf f (>\\<^sub>t) (args t) (args s)) \\<Longrightarrow> gt_same t s\"\n\nlemma gt_iff_chop_diff_same: \"t >\\<^sub>t s \\<longleftrightarrow> gt_chop t s \\<or> gt_diff t s \\<or> gt_same t s\"\n  by (subst gt.simps) (auto simp: gt_chop.simps gt_diff.simps gt_same.simps)\n\nsubsection \\<open>Transitivity\\<close>\n\nlemma t_gt_chop_t: \"is_App t \\<Longrightarrow> t >\\<^sub>t chop t\"\n  by (simp add: gt_chop)\n\nlemma gt_trans: \"u >\\<^sub>t t \\<Longrightarrow> t >\\<^sub>t s \\<Longrightarrow> u >\\<^sub>t s\"\nproof (simp only: atomize_imp,\n    rule measure_induct_rule[of \"\\<lambda>(u, t, s). {#hsize u, hsize t, hsize s#}\"\n        \"\\<lambda>(u, t, s). u >\\<^sub>t t \\<longrightarrow> t >\\<^sub>t s \\<longrightarrow> u >\\<^sub>t s\" \"(u, t, s)\",\n      simplified prod.case],\n    simp only: split_paired_all prod.case atomize_imp[symmetric])\n  fix u t s\n  assume\n    ih: \"\\<And>ua ta sa. {#hsize ua, hsize ta, hsize sa#} < {#hsize u, hsize t, hsize s#} \\<Longrightarrow>\n      ua >\\<^sub>t ta \\<Longrightarrow> ta >\\<^sub>t sa \\<Longrightarrow> ua >\\<^sub>t sa\" and\n    u_gt_t: \"u >\\<^sub>t t\" and t_gt_s: \"t >\\<^sub>t s\"\n\n  show \"u >\\<^sub>t s\"\n    using u_gt_t\n  proof cases\n    case gt_chop\n    then have \"chop u >\\<^sub>t s\" using ih[of \"chop u\" t s]\n      using add_mset_lt_left_lt hsize_chop_lt t_gt_s by blast\n    show ?thesis\n      using local.gt_chop(1) local.gt_chop(2) \\<open>chop u >\\<^sub>t s\\<close> gt.gt_chop by presburger\n  next\n    case gt_diff_u_t: gt_diff\n    show ?thesis\n      using t_gt_s\n    proof cases\n      case gt_chop\n      then have \"u >\\<^sub>t chop t\" \n        using chkchop_def gt_diff_u_t(3) by presburger \n      then show ?thesis using ih[of u \"chop t\" s]\n        using hsize_chop_lt local.gt_chop(1) local.gt_chop(2) by fastforce\n    next\n      case gt_diff_t_s: gt_diff\n      have \"head u >\\<^sub>h\\<^sub>d head s\"\n        using gt_diff_u_t(1) gt_diff_t_s(1) by (auto intro: gt_hd_trans)\n      thus ?thesis using ih[of u t \"chop s\"]\n        by (metis add_mset_lt_left_lt add_mset_lt_right_lt chkchop_def gt_diff gt_diff_t_s(2) \n          gt_diff_t_s(3) hsize_chop_lt u_gt_t)\n    next\n      case gt_same_t_s: gt_same\n      have \"head u >\\<^sub>h\\<^sub>d head s\"\n        using gt_diff_u_t(1) gt_same_t_s(1) by auto\n      thus ?thesis using ih[of u t \"chop s\"]\n        by (metis add_mset_lt_left_lt add_mset_lt_right_lt chkchop_def chkchop_same_def gt_diff \n          gt_diff_u_t(2) gt_same_t_s(1) gt_same_t_s(2) hsize_chop_lt u_gt_t)\n    qed\n  next\n    case gt_same_u_t: gt_same\n    show ?thesis\n      using t_gt_s\n    proof cases\n      case gt_chop\n      then show ?thesis \n      proof (cases \"is_Var (head u)\")\n        case True\n        then show ?thesis  using ih[of \"chop u\" \"chop t\" s]\n          by (metis add_mset_lt_left_lt add_mset_lt_lt_lt chkchop_def chkchop_same_def gt.gt_chop \n            gt_same_u_t(2) hsize_chop_lt local.gt_chop(1) local.gt_chop(2))\n      next\n        case False\n        then show ?thesis using ih[of u \"chop t\" s] \n          by (metis add_mset_lt_left_lt add_mset_lt_right_lt chkchop_def chkchop_same_def \n            gt_same_u_t(2) hsize_chop_lt local.gt_chop(1) local.gt_chop(2))\n      qed\n    next\n      case gt_diff_t_s: gt_diff\n      have \"head u >\\<^sub>h\\<^sub>d head s\"\n        by (simp add: gt_diff_t_s(1) gt_same_u_t(1))\n      thus ?thesis using ih[of u t \"chop s\"]\n        by (metis add_mset_lt_left_lt add_mset_lt_right_lt chkchop_def gt_diff gt_diff_t_s(1)\n         gt_diff_t_s(2) gt_diff_t_s(3) gt_same_u_t(1) hsize_chop_lt  u_gt_t)\n    next\n      case gt_same_t_s: gt_same\n      have hd_u_s: \"head u = head s\"\n        using gt_same_u_t(1) gt_same_t_s(1) by simp\n\n      let ?S = \"set (args u) \\<union> set (args t) \\<union> set (args s)\"\n\n      have gt_trans_args: \"\\<forall>ua \\<in> ?S. \\<forall>ta \\<in> ?S. \\<forall>sa \\<in> ?S. ua >\\<^sub>t ta \\<longrightarrow> ta >\\<^sub>t sa \\<longrightarrow> ua >\\<^sub>t sa\"\n      proof clarify\n        fix sa ta ua\n        assume\n          ua_in: \"ua \\<in> ?S\" and ta_in: \"ta \\<in> ?S\" and sa_in: \"sa \\<in> ?S\" and\n          ua_gt_ta: \"ua >\\<^sub>t ta\" and ta_gt_sa: \"ta >\\<^sub>t sa\"\n        show \"ua >\\<^sub>t sa\"\n          by (auto intro!: ih[OF Max_lt_imp_lt_mset ua_gt_ta ta_gt_sa])\n            (meson ua_in ta_in sa_in Un_iff max.strict_coboundedI1 max.strict_coboundedI2\n               hsize_in_args)+\n      qed\n\n      have \"\\<forall>f \\<in> ground_heads (head u). extf f (>\\<^sub>t) (args u) (args s)\"\n      proof (clarify, rule extf_trans[OF _ _ _ gt_trans_args])\n        fix f\n        assume f_in_grounds: \"f \\<in> ground_heads (head u)\"\n        show \"extf f (>\\<^sub>t) (args u) (args t)\"\n          using f_in_grounds gt_same_u_t(3) by blast\n        show \"extf f (>\\<^sub>t) (args t) (args s)\"\n          using f_in_grounds gt_same_t_s(3) unfolding gt_same_u_t(1) by blast\n      qed auto\n      have \"chkchop_same (>\\<^sub>t) u s\"\n      proof (cases \"head u\")\n        case (Var x)\n        then show ?thesis\n        proof (cases u)\n          case (Hd _)\n          then show ?thesis \n            using Var\n            using gt_same_u_t(2) by force\n        next\n          case (App u1 u2)\n          then have \"chop u >\\<^sub>t chop t\" \n            by (metis Var chkchop_def chkchop_same_def gt_same_t_s(2) gt_same_u_t(1) \n              gt_same_u_t(2) hd.disc(1))\n          then show ?thesis\n          proof (cases t)\n            case (Hd _)\n            then show ?thesis\n              using Var gt_same_t_s(2) gt_same_u_t(1) by force\n          next\n            case t_App: (App t1 t2)\n            then have \"is_App s \\<Longrightarrow> chop t >\\<^sub>t chop s\" \n              using gt_same_t_s unfolding chkchop_same_def unfolding chkchop_def using Var hd_u_s by auto\n            then have \"chkchop (>\\<^sub>t) (chop u) s\" \n              unfolding chkchop_def using ih[of \"chop u\" \"chop t\" \"chop s\"]\n              by (metis App \\<open>chop u >\\<^sub>t chop t\\<close> t_App add_mset_lt_lt_le less_imp_le mset_lt_single_iff hsize_chop_lt tm.disc(2))\n            then show ?thesis unfolding chkchop_same_def \n              using Var by (simp add: App)\n          qed\n        qed\n      next\n        case (Sym f)\n        have \"chkchop (>\\<^sub>t) u s\" \n         proof (cases s)\n           case (Hd _)\n           then show ?thesis \n             by simp\n         next\n           case (App s1 s2)\n           then have \"t >\\<^sub>t chop s\"\n             using Sym gt_same_t_s(1) gt_same_t_s(2) hd_u_s by auto\n           then have \"u >\\<^sub>t chop s\" using ih[of u t \"chop s\"] \n             by (metis App add_mset_lt_right_lt mset_lt_single_iff hsize_chop_lt tm.disc(2) u_gt_t)\n           then show ?thesis unfolding chkchop_def\n             by blast\n         qed\n        then show ?thesis\n          by (simp add: Sym) \n      qed\n      thus ?thesis \n        using \\<open>\\<forall>f\\<in>local.ground_heads (head u). extf f (>\\<^sub>t) (args u) (args s)\\<close> gt_same hd_u_s by blast\n    qed\n  qed\nqed\n\nsubsection \\<open>Irreflexivity\\<close>\n\ntheorem gt_irrefl: \"\\<not> s >\\<^sub>t s\"\nproof (standard, induct s rule: measure_induct_rule[of hsize])\n  case (less s)\n  note ih = this(1) and s_gt_s = this(2)\n\n  show False\n    using s_gt_s\n  proof cases\n    case gt_chop\n    then show False using ih[of \"chop s\"]\n      by (metis gt.gt_chop gt_trans hsize_chop_lt)\n  next\n    case gt_diff\n    thus False\n      by (cases \"head s\") (auto simp: gt_hd_irrefl)\n  next\n    case gt_same\n    note in_grounds = this(3)\n\n    obtain si where si_in_args: \"si \\<in> set (args s)\" and si_gt_si: \"si >\\<^sub>t si\"\n      using in_grounds\n      by (metis (full_types) all_not_in_conv extf_irrefl_from_trans ground_heads_nonempty gt_trans)\n    have \"hsize si < hsize s\"\n      by (rule hsize_in_args[OF si_in_args])\n    thus False\n      by (rule ih[OF _ si_gt_si])\n  qed\nqed\n\nlemma gt_antisym: \"t >\\<^sub>t s \\<Longrightarrow> \\<not> s >\\<^sub>t t\"\n  using gt_irrefl gt_trans by blast\n\n\n\nsubsection \\<open>Subterm Property\\<close>\n\nlemma gt_emb_fun: \"App s t >\\<^sub>t s\"\nproof (induction s rule:measure_induct_rule[of \"hsize\"])\n  case (less s)\n  have extf: \"\\<forall>f \\<in> ground_heads (head s). extf f (>\\<^sub>t) (args (App s t)) (args s)\"\n    using extf_snoc by force\n  have \"head (App s t) = head s\"\n    by simp\n  have \"chkchop_same (>\\<^sub>t) (App s t) s\"\n  proof (cases \"is_Hd s\")\n    case True\n    then show ?thesis\n      by simp\n  next\n    case False\n    have chop_gt_chop: \"(chop (App s t)) >\\<^sub>t chop s\" using less[of \"chop s\"]\n      using False hsize_chop_lt by (metis App_apps apps.simps(1) chop_apps)\n    then show ?thesis \n    proof (cases \"is_Var (head s)\")\n      case True\n      then show ?thesis\n        by (simp add: True chop_gt_chop)\n    next\n      case False\n      then show ?thesis using less[of \"chop s\"]\n        by (simp add: chop_gt_chop gt_chop)\n    qed\n  qed\n  then show ?case\n    using extf gt_same by auto\nqed\n\nlemma gt_emb_arg: \"App s t >\\<^sub>t t\"\nproof (induction s rule:measure_induct_rule[of \"hsize\"])\n  case (less s)\n  then show ?case\n  proof (cases \"is_Hd s\")\n    case True\n    then show ?thesis \n      by (metis chop_App_Hd t_gt_chop_t tm.disc(2))\n  next\n    case False\n    have \"chop (App s t) >\\<^sub>t t\" using less[of \"chop s\"] \n      by (metis App_apps False apps.simps(1) chop_apps hsize_chop_lt)\n    then show ?thesis \n      using gt_chop tm.disc(2) by blast\n  qed\nqed\n\nsubsection \\<open>Compatibility with Contexts\\<close>\n\nlemma gt_compat_fun:\n  assumes \"t' >\\<^sub>t t\"\n  shows \"App s t' >\\<^sub>t App s t\"\nusing assms  apply (simp only:atomize_imp)\nproof (induction rule:measure_induct_rule[of \"\\<lambda>(t, s). hsize t + hsize s\" \"\\<lambda>(t, s). t' >\\<^sub>t t \\<longrightarrow> App s t' >\\<^sub>t App s t\" \"(t,s)\", \n  simplified prod.case],\n  simp only: split_paired_all prod.case atomize_imp[symmetric])\n\n  fix t s ::\"('s, 'v) tm\" \n  assume ih:\"\\<And>ta sa. hsize ta + hsize sa < hsize t + hsize s \\<Longrightarrow> t' >\\<^sub>t ta \\<Longrightarrow> App sa t' >\\<^sub>t App sa ta\"\n  and t'_gt_t:\"t' >\\<^sub>t t\" \n\n  have t'_ne_t: \"t' \\<noteq> t\"\n    using gt_antisym t'_gt_t by blast\n  have extf_args_single: \"\\<forall>f \\<in> ground_heads (head s). extf f (>\\<^sub>t) (args s @ [t']) (args s @ [t])\"\n    by (simp add: extf_compat_list t'_gt_t t'_ne_t)\n\n  show  \"App s t' >\\<^sub>t App s t\"\n  proof (rule gt_same)\n    show \"head (App s t') = head (App s t)\" by simp\n    show \"\\<forall>f\\<in>local.ground_heads (head (App s t')). extf f (>\\<^sub>t) (args (App s t')) (args (App s t))\"\n      by (simp add: extf_args_single)\n    have 0: \"chop (App s t') >\\<^sub>t chop (App s t)\" \n    proof (cases s)\n      case (Hd _)\n      then show ?thesis using chop_App_Hd\n        by (simp add: chop_App_Hd t'_gt_t)\n    next\n      case (App s1 s2)\n      then show ?thesis using ih[of t \"chop s\"] chop_fun \n        by (metis nat_add_left_cancel_less hsize_chop_lt t'_gt_t tm.disc(2) tm.sel(4) tm.sel(6))\n    qed\n    show \"chkchop_same (>\\<^sub>t) (App s t') (App s t)\"\n    proof (cases \"is_Var (head (App s t'))\")\n      case True\n      then show ?thesis unfolding chkchop_same_def chkchop_def\n        using True 0 by auto\n    next\n      case False\n      have \"App s t' >\\<^sub>t chop (App s t)\" using 0 by (simp add: gt_chop)\n      then show ?thesis  unfolding chkchop_same_def chkchop_def \n        using False by auto\n    qed\n  qed\nqed\n\ntheorem gt_compat_arg:\n  shows \"s' >\\<^sub>t s \\<Longrightarrow> t' \\<ge>\\<^sub>t t \\<Longrightarrow> App s' t' >\\<^sub>t App s t\"\nproof (simp only:atomize_imp,induction rule:measure_induct[of \"\\<lambda>(s',s,t). hsize s' + hsize s + hsize t\" \"\\<lambda>(s',s,t). s' >\\<^sub>t s \\<longrightarrow> t' \\<ge>\\<^sub>t t \\<longrightarrow> App s' t' >\\<^sub>t App s t\" \"(s',s,t)\", simplified prod.case],\n    simp only: split_paired_all prod.case atomize_imp[symmetric] atomize_all[symmetric])\n  fix s' s t\n  assume ih:\"\\<And>ab ac ba. hsize ab + hsize ac + hsize ba < hsize s' + hsize s + hsize t \\<Longrightarrow> ab >\\<^sub>t ac \\<Longrightarrow> t' \\<ge>\\<^sub>t ba \\<Longrightarrow> App ab t' >\\<^sub>t App ac ba\" \n    and \"s' >\\<^sub>t s\" and \"t' \\<ge>\\<^sub>t t\" \n\n  {\n    fix s''::\"('s,'v) tm\" assume hsize_s'':\"hsize s'' \\<le> hsize s'\"\n    assume chkchop_s'_s: \"chkchop (>\\<^sub>t) s'' s\"\n    then have \"chkchop (>\\<^sub>t) (App s'' t') (App s t)\" \n    proof (cases \"is_Hd s\")\n      case True\n      then show ?thesis using chkchop_s'_s unfolding chkchop_def\n        by (metis \\<open>t' \\<ge>\\<^sub>t t\\<close> chop_App_Hd gt_emb_arg gt_trans)\n    next\n      case False\n      then show ?thesis using chkchop_s'_s unfolding chkchop_def\n        using ih[of s'' \"chop s\" t] hsize_s''\n        by (metis \\<open>t' \\<ge>\\<^sub>t t\\<close> add_less_mono add_mono_thms_linordered_field(1) chop_fun le_eq_less_or_eq nat_add_left_cancel_less hsize_chop_lt tm.sel(4) tm.sel(6))\n    qed\n  }\n  note chkchop_compat_arg = this\n\n  show \"App s' t' >\\<^sub>t App s t \" using \\<open>s' >\\<^sub>t s\\<close>\n  proof (cases rule:gt.cases)\n    case gt_chop\n    then show ?thesis \n    proof (cases \"t = t'\")\n      case True\n      show ?thesis using True gt.gt_chop[of \"App s' t'\" \"App s t\"] gt_chop chkchop_compat_arg[of \"chop s'\"]\n        by (metis add_strict_right_mono chop_fun ih hsize_chop_lt tm.disc(2) tm.sel(4) tm.sel(6))\n    next\n      case False\n      then have \"t' >\\<^sub>t t\"\n        using \\<open>t' \\<ge>\\<^sub>t t\\<close> by blast\n      have \"App s' t' >\\<^sub>t App (chop s') t'\"\n        by (metis chop_fun local.gt_chop(1) t_gt_chop_t tm.disc(2) tm.sel(4) tm.sel(6))\n      moreover have \"... >\\<^sub>t App s t\"  using ih[of \"chop s'\" s t]\n        using \\<open>t' >\\<^sub>t t\\<close> gt_compat_fun local.gt_chop(1) local.gt_chop(2) hsize_chop_lt by fastforce\n      ultimately show ?thesis using gt_trans by blast\n    qed\n  next\n    case gt_diff\n    then show ?thesis \n      using chkchop_compat_arg gt.gt_diff by auto\n  next\n    case gt_same\n    have hd_s'_eq_s: \"head s' = head s\" \n      by (simp add: local.gt_same(1))\n    {\n      fix f assume f_gh: \"f \\<in> ground_heads (head s)\"\n      have f_s_args: \n        \"extf f (>\\<^sub>t) (args s') (args s)\"\n        using local.gt_same(3) f_gh by (simp add: hd_s'_eq_s)\n      have f_compat_snoc: \n        \"\\<And>xs ys x. extf f (>\\<^sub>t) ys xs \\<Longrightarrow> extf f (>\\<^sub>t) (ys @ [x]) (xs @ [x])\" \n        by (simp add: extf_compat_append_right)\n     \n      have f_st_args2:\n        \"extf f (>\\<^sub>t) (args (App s' t)) (args (App s t))\"\n        by (simp add: f_compat_snoc f_s_args)\n      have 0:\"\\<forall>z\\<in>UNIV. \\<forall>y\\<in>UNIV. \\<forall>x\\<in>UNIV. z >\\<^sub>t y \\<longrightarrow> y >\\<^sub>t x \\<longrightarrow> z >\\<^sub>t x\" \n        using gt_trans by blast\n      then have f_trans:\"\\<And>xs ys zs. extf f (>\\<^sub>t) zs ys \\<Longrightarrow> extf f (>\\<^sub>t) ys xs \\<Longrightarrow> extf f (>\\<^sub>t) zs xs\" \n        using  extf_trans[of _ UNIV, unfolded lists_UNIV, OF UNIV_I UNIV_I UNIV_I 0] by metis\n      have \"extf f (>\\<^sub>t) (args (App s' t')) (args (App s t))\"\n      proof (cases \"t' = t\")\n        case True\n        then show ?thesis using f_st_args2 by metis\n      next\n        case False\n        have f_st_args1: \n          \"extf f (>\\<^sub>t) (args (App s' t')) (args (App s' t))\"\n          using extf_compat_list \\<open>t' \\<ge>\\<^sub>t t\\<close> False by simp\n        then show ?thesis using f_trans f_st_args1 f_st_args2 by metis\n      qed\n    }\n    note extf_cond = this\n    have \"chkchop_same (>\\<^sub>t) (App s' t') (App s t)\" unfolding chkchop_same_def\n      using chop_fun chkchop_compat_arg[of \"chop s'\", unfolded le_eq_less_or_eq] \n      chkchop_compat_arg[of s'] chkchop_def chkchop_same_def \n      hsize_chop_lt   epo.extf_min_empty[OF epo_axioms] gt.gt_same gt_antisym hd_s'_eq_s head_App \n      leI less_irrefl_nat local.gt_same(2) local.gt_same(3) tm.sel(4) tm.sel(6) tm.disc(2)\n      by metis\n    then show ?thesis \n      using extf_cond gt.gt_same hd_s'_eq_s by auto\n  qed\nqed\n\ntheorem gt_compat_fun_strong:\n  assumes t'_gt_t: \"t' >\\<^sub>t t\"\n  shows \"apps s (t' # us) >\\<^sub>t apps s (t # us)\" \nproof (induct us rule: rev_induct)\n  case Nil\n  then show ?case \n  by (simp add: gt_compat_fun t'_gt_t)\nnext\n  case (snoc x xs)\n  then show ?case unfolding App_apps[symmetric] append_Cons[symmetric]\n    using gt_compat_arg by blast\nqed\n\ntheorem gt_or_eq_compat_App: \"s' \\<ge>\\<^sub>t s \\<Longrightarrow> t' \\<ge>\\<^sub>t t \\<Longrightarrow> App s' t' \\<ge>\\<^sub>t App s t\"\n  using gt_compat_fun gt_compat_arg by blast\n\ntheorem gt_compat_App:\n  shows \"s' \\<ge>\\<^sub>t s \\<Longrightarrow> t' >\\<^sub>t t \\<Longrightarrow> App s' t' >\\<^sub>t App s t\"\n  using gt_compat_fun gt_compat_arg by blast\n\n\nsubsection \"Compatibility with Embedding Relation\"\n\nlemma gt_embedding_step_property:\n  assumes \"t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b s\"\n  shows \"t >\\<^sub>t s\"\nusing assms proof (induct)\n  case (left t1 t2)\n  then show ?case \n    using gt_emb_fun by blast\nnext\n  case (right t1 t2)\n  then show ?case \n    using gt_emb_arg by blast\nnext\n  case (context_left t s u)\n  then show ?case \n    using gt_compat_arg by blast\nnext\n  case (context_right t s u)\n  then show ?case\n    using gt_compat_fun by auto\nqed\n\nlemma gt_embedding_property:\n  assumes \"t \\<unrhd>\\<^sub>e\\<^sub>m\\<^sub>b s\" \"t \\<noteq> s\"\n  shows \"t >\\<^sub>t s\"\n  using assms \nproof (induction)\n  case (refl t)\n  then show ?case by simp\nnext\n  case (step t u s)\n  then show ?case using gt_embedding_step_property gt_trans by blast\nqed\n\nsubsection \"Stability under Substitutions\"\n\n(* TODO: move *)\nlemma extf_map2:\n  assumes\n    \"\\<forall>y\\<in>set ys \\<union> set xs. \\<forall>x\\<in>set ys \\<union> set xs. y >\\<^sub>t x \\<longrightarrow> (h y) >\\<^sub>t (h x)\"\n    \"extf f (>\\<^sub>t) ys xs\"\n  shows\n    \"extf f (>\\<^sub>t) (map h ys) (map h xs)\"\n  apply (rule extf_map[of \"set ys \\<union> set xs\" ys xs \"(>\\<^sub>t)\" h f])\n        apply simp\n       apply (simp add: in_listsI)\n      apply (simp add: in_listsI)\n  using gt_antisym apply blast\n  using gt_trans apply blast\n  by (simp add: assms)+\n\ntheorem gt_sus: \n  assumes \\<rho>_wary: \"wary_subst \\<rho>\"\n  assumes ghd: \"\\<And>x. ground_heads (Var x) = UNIV\" (* This condition is only needed for gt_same, not for gt_diff ! *)\n  shows \"t >\\<^sub>t s \\<Longrightarrow> subst \\<rho> t >\\<^sub>t subst \\<rho> s\"\nproof (simp only:atomize_imp,induction rule:measure_induct[of \"\\<lambda>(t,s). {# hsize t, hsize s #}\" \"\\<lambda>(t,s). t >\\<^sub>t s \\<longrightarrow> subst \\<rho> t >\\<^sub>t subst \\<rho> s\" \"(t,s)\", simplified prod.case],\n    simp only: split_paired_all prod.case atomize_imp[symmetric] atomize_all[symmetric])\n  fix t s\n  assume ih:\"\\<And>tt ss.\n               {# hsize tt, hsize ss #} < {# hsize t, hsize s #} \\<Longrightarrow>\n               tt >\\<^sub>t ss \\<Longrightarrow> subst \\<rho> tt >\\<^sub>t subst \\<rho> ss\" \n    and \"t >\\<^sub>t s\" \n  show \"subst \\<rho> t >\\<^sub>t subst \\<rho> s\" using \\<open>t >\\<^sub>t s\\<close>\n  proof (cases)\n    case t_gt_s_chop: gt_chop\n    then show ?thesis \n      using emb_step_subst emb_step_chop[OF t_gt_s_chop(1)] gt_embedding_step_property \n       emb_step_hsize gt_trans ih[of \"chop t\" s] by (metis add_mset_lt_left_lt)\n  next\n    case t_gt_s_diff: gt_diff\n    have gt_diff1: \"head (subst \\<rho> t) >\\<^sub>h\\<^sub>d head (subst \\<rho> s)\" \n      by (meson assms gt_hd_def subsetCE t_gt_s_diff(1) wary_subst_ground_heads)\n    have gt_diff2: \"is_Sym (head (subst \\<rho> s))\"\n      by (metis ground_imp_subst_iden hd.collapse(2) hd.simps(18) head_subst t_gt_s_diff(2) tm.sel(1) tm.simps(17))\n    have gt_diff3: \"chkchop (>\\<^sub>t) (subst \\<rho> t) (subst \\<rho> s)\"    \n    proof (cases s)\n      case (Hd _)\n      then show ?thesis \n        using t_gt_s_diff unfolding chkchop_def \n        by (metis ground_imp_subst_iden hd.collapse(2) hd.simps(18) tm.disc(1) tm.sel(1) tm.simps(17))\n    next\n      case s_App: (App s1 s2)\n      then show ?thesis using t_gt_s_diff unfolding chkchop_def\n        using ih[of t \"chop s\"] chop_subst_Sym hsize_chop_lt tm.disc(2)\n        by (metis add_mset_lt_left_lt add_mset_lt_right_lt)\n    qed\n    show ?thesis\n      using gt_diff gt_diff1 gt_diff2 gt_diff3 by blast\n  next\n    case t_gt_s_same: gt_same\n    have gt_same1: \"head (subst \\<rho> t) = head (subst \\<rho> s)\" \n      by (simp add: t_gt_s_same(1))\n\n    have extf_map_ts:\"\\<forall>f\\<in>ground_heads (head t). extf f (>\\<^sub>t) (map (subst \\<rho>) (args t)) (map (subst \\<rho>) (args s))\"\n    proof -\n      have ih_args: \"\\<forall>y\\<in>set (args t) \\<union> set (args s). \\<forall>x\\<in>set (args t) \\<union> set (args s). y >\\<^sub>t x \\<longrightarrow> subst \\<rho> y >\\<^sub>t subst \\<rho> x\"\n        by (metis Un_iff less_multiset_doubletons hsize_in_args ih)\n      have \"\\<forall>f\\<in>ground_heads (head t). extf f (>\\<^sub>t) (args t) (args s)\"  \n        using ghd t_gt_s_same(3) by metis\n      then show ?thesis\n        using extf_map[of \"set (args t) \\<union> set (args s)\" \"args t\" \"args s\" gt \"subst \\<rho>\"]\n        using gt_irrefl gt_trans ih_args by blast\n    qed\n\n    show ?thesis\n    proof (cases \"head t\")\n      case (Var x1)\n      then have \"is_Var (head t)\" by simp\n      {\n        fix u :: \"('s, 'v) tm\"\n        assume \"ground_heads (head u) \\<subseteq> ground_heads (head t)\" \"hsize u \\<le> hsize (subst \\<rho> (Hd (head t)))\"\n        then have \"apps u (map (subst \\<rho>) (args t)) >\\<^sub>t apps u (map (subst \\<rho>) (args s))\" \n        proof (induct \"hsize u\" arbitrary:u rule:less_induct)\n          case less\n          then show ?case \n          proof (cases u)\n            case u_Hd: (Hd _)\n            then have \"args u = []\" \n              by simp\n            then show ?thesis \n            proof (cases s)\n              case s_Hd: (Hd _)\n              show ?thesis\n                by (smt (verit, best) Nil_is_map_conv UNIV_I Var \\<open>args u = []\\<close> \\<open>is_Var (head t)\\<close> \n                     append_self_conv2 args.simps(1) args_Nil_iff_is_Hd args_apps chkchop_def \n                     chkchop_same_def extf_map_ts ghd gt_same head_apps s_Hd t_gt_s_same(2))\n            next\n              case s_App: (App _ _)\n              then have \"is_App t\"\n                using \\<open>is_Var (head t)\\<close> chkchop_same_def t_gt_s_same(2) by presburger\n  \n              have \"chop t >\\<^sub>t chop s\" \n                using \\<open>is_App t\\<close> \\<open>is_Var (head t)\\<close> s_App t_gt_s_same(2) by auto\n              then have \"subst \\<rho> (chop t) >\\<^sub>t subst \\<rho> (chop s)\" using ih\n                by (metis \\<open>is_App t\\<close> less_multiset_doubletons s_App hsize_chop_lt tm.disc(2))\n  \n              define ut where \"ut = apps u (map (subst \\<rho>) (args t))\"\n              define us where \"us = apps u (map (subst \\<rho>) (args s))\"\n              have 0:\"\\<And>ss. args (apps u ss) = ss\" \n                using  \\<open>args u = []\\<close> by simp\n              have chop_us: \"chop us = subst \\<rho> (chop s)\" \n                unfolding chop_def subst_apps us_def 0 using hd_map\n                by (metis (no_types, lifting) args_Nil_iff_is_Hd map_tl s_App tm.disc(2))\n              have chop_ut: \"chop ut = subst \\<rho> (chop t)\"\n                unfolding chop_def subst_apps ut_def 0 using \\<open>is_App t\\<close> \n                by (simp add: args_Nil_iff_is_Hd hd_map map_tl)\n  \n              have \"head ut = head us\" \n                by (simp add: us_def ut_def)\n              moreover have \"chkchop_same (>\\<^sub>t) ut us\" unfolding chkchop_def chkchop_same_def\n                by (metis \"0\" Nil_is_map_conv \\<open>is_App t\\<close> \\<open>subst \\<rho> (chop t) >\\<^sub>t subst \\<rho> (chop s)\\<close> \n                  args_Nil_iff_is_Hd chop_us chop_ut gt_chop ut_def)\n              moreover have \"\\<forall>f\\<in>local.ground_heads (head ut). extf f (>\\<^sub>t) (args ut) (args us)\" \n                using extf_map_ts less us_def ut_def using \"0\" by auto\n              ultimately show \"ut >\\<^sub>t us\" \n                using gt_same by blast\n            qed\n          next\n            case u_app: (App _ _)\n            let ?ut = \"apps u (map (subst \\<rho>) (args t))\"\n            let ?us = \"apps u (map (subst \\<rho>) (args s))\"\n            have 1:\"head ?ut = head ?ut\" \n              by simp\n            have \"apps (chop u) (map (subst \\<rho>) (args t)) >\\<^sub>t apps (chop u) (map (subst \\<rho>) (args s))\"\n              using less.hyps[of \"chop u\"] hsize_chop_lt \n              by (metis Var dual_order.trans ghd less.prems(2) less_or_eq_imp_le subset_UNIV tm.disc(2) u_app)\n            then have \"chop ?ut >\\<^sub>t chop ?us\" \n              by (simp add: chop_apps u_app)\n            then have 2:\"chkchop_same (>\\<^sub>t) ?ut ?us\" unfolding chkchop_same_def chkchop_def\n              by (metis (no_types, lifting) Nil_is_map_conv \\<open>is_Var (head t)\\<close> append_is_Nil_conv \n                args_Nil_iff_is_Hd args_apps chkchop_same_def gt.simps t_gt_s_same(2))\n            have 3:\"\\<forall>f\\<in>local.ground_heads (head ?ut). extf f (>\\<^sub>t) (args ?ut) (args ?us)\"\n              using extf_compat_append_left extf_map_ts less.prems(1) by auto\n            show ?thesis using gt_same 1 2 3 by simp\n          qed\n        qed\n      }\n      note inner_induction = this\n      show ?thesis using inner_induction[of \"subst \\<rho> (Hd (head t))\", unfolded subst_apps[symmetric]]\n        by (metis Var ghd order_refl subset_UNIV t_gt_s_same(1) tm_collapse_apps)\n    next\n      case (Sym _)\n      then have \"is_Sym (head (subst \\<rho> t))\" \"head (subst \\<rho> t) = head t\"\n        by simp_all\n      then have \"chkchop_same (>\\<^sub>t) t s\"\n        using t_gt_s_same unfolding chkchop_same_def chkchop_def\n        using Sym by metis\n      then have gt_same2: \"chkchop_same (>\\<^sub>t) (subst \\<rho> t) (subst \\<rho> s)\" unfolding chkchop_same_def chkchop_def\n         using ih[of t \"chop s\"] \n         by (metis (no_types, lifting) Sym \\<open>head (subst \\<rho> t) = head t\\<close> \\<open>is_Sym (head (subst \\<rho> t))\\<close> \n             add_mset_commute add_mset_lt_left_lt chop_subst_Sym ground_imp_subst_iden hd.simps(18) \n             hsize_chop_lt t_gt_s_same(1) tm.collapse(1) tm.simps(17))\n      have gt_same3: \"\\<forall>f\\<in>local.ground_heads (head (subst \\<rho> t)). extf f (>\\<^sub>t) (args (subst \\<rho> t)) (args (subst \\<rho> s))\"\n        using \\<open>head (subst \\<rho> t) = head t\\<close> extf_compat_append_left extf_map_ts t_gt_s_same(1) by auto\n      show ?thesis using gt_same gt_same1 gt_same2 gt_same3 by blast\n    qed\n  qed\nqed\n\n\nsubsection \\<open>Totality on Ground Terms\\<close>\n\ntheorem gt_total_ground:\n  assumes extf_total: \"\\<And>f. ext_total (extf f)\"\n  shows \"ground t \\<Longrightarrow> ground s \\<Longrightarrow> t >\\<^sub>t s \\<or> s >\\<^sub>t t \\<or> t = s\"\nproof (simp only: atomize_imp,\n    rule measure_induct_rule[of \"\\<lambda>(t, s). {# hsize t, hsize s #}\"\n      \"\\<lambda>(t, s). ground t \\<longrightarrow> ground s \\<longrightarrow> t >\\<^sub>t s \\<or> s >\\<^sub>t t \\<or> t = s\" \"(t, s)\", simplified prod.case],\n    simp only: split_paired_all prod.case atomize_imp[symmetric])\n  fix t s :: \"('s, 'v) tm\"\n  assume\n    ih: \"\\<And>ta sa. {# hsize ta, hsize sa #} < {# hsize t, hsize s #} \\<Longrightarrow> ground ta \\<Longrightarrow> ground sa \\<Longrightarrow>\n      ta >\\<^sub>t sa \\<or> sa >\\<^sub>t ta \\<or> ta = sa\" and\n    gr_t: \"ground t\" and gr_s: \"ground s\"\n\n  let ?case = \"t >\\<^sub>t s \\<or> s >\\<^sub>t t \\<or> t = s\"\n\n  have \"chkchop (>\\<^sub>t) t s \\<or> s >\\<^sub>t t\"\n    unfolding chkchop_def tm.case_eq_if using ih[of t \"chop s\"]\n    by (metis (no_types, lifting) add_mset_commute add_mset_lt_left_lt gr_s gr_t ground_chop gt_chop hsize_chop_lt)\n  moreover have \"chkchop (>\\<^sub>t) s t \\<or> t >\\<^sub>t s\"\n    unfolding chkchop_def tm.case_eq_if using ih[of \"chop t\" s]\n    by (metis add_mset_lt_left_lt gr_s gr_t ground_chop gt_chop.intros gt_iff_chop_diff_same hsize_chop_lt)\n  moreover\n  {\n    assume\n      chkembs_t_s: \"chkchop (>\\<^sub>t) t s\" and\n      chkembs_s_t: \"chkchop (>\\<^sub>t) s t\"\n\n    obtain g where g: \"head t = Sym g\"\n      using gr_t by (metis ground_head hd.collapse(2))\n    obtain f where f: \"head s = Sym f\"\n      using gr_s by (metis ground_head hd.collapse(2))\n\n    {\n      assume g_gt_f: \"g >\\<^sub>s f\"\n      have \"t >\\<^sub>t s\"\n        using chkembs_t_s f g g_gt_f gt_diff gt_sym_imp_hd by auto\n    }\n    moreover\n    {\n      assume f_gt_g: \"f >\\<^sub>s g\"\n      have \"s >\\<^sub>t t\" \n        using chkembs_s_t f f_gt_g g gt_diff gt_sym_imp_hd by auto\n    }\n    moreover\n    {\n      assume g_eq_f: \"g = f\"\n      hence hd_t: \"head t = head s\"\n        using g f by auto\n\n      let ?ts = \"args t\"\n      let ?ss = \"args s\"\n\n      have gr_ts: \"\\<forall>ta \\<in> set ?ts. ground ta\"\n        using ground_args[OF _ gr_t] by blast\n      have gr_ss: \"\\<forall>sa \\<in> set ?ss. ground sa\"\n        using ground_args[OF _ gr_s] by blast\n\n      {\n        assume ts_eq_ss: \"?ts = ?ss\"\n        have \"t = s\"\n          using hd_t ts_eq_ss by (rule tm_expand_apps)\n      }\n      moreover\n      {\n        assume ts_gt_ss: \"extf g (>\\<^sub>t) ?ts ?ss\"\n        have \"t >\\<^sub>t s\"\n          using chkembs_t_s g gt_same hd_t ts_gt_ss by auto\n      }\n      moreover\n      {\n        assume ss_gt_ts: \"extf g (>\\<^sub>t) ?ss ?ts\"\n        have \"s >\\<^sub>t t\"\n          using chkembs_s_t f g_eq_f gt_same hd_t ss_gt_ts by auto\n      }\n      ultimately have ?case\n        using ih gr_ss gr_ts\n          ext_total.total[OF extf_total, rule_format, of \"set ?ts \\<union> set ?ss\" \"(>\\<^sub>t)\" ?ts ?ss g]\n        using less_multiset_doubletons epo_axioms hsize_in_args in_listsI by (metis Un_iff)\n    }\n    ultimately have ?case\n      using gt_sym_total by blast\n  }\n  ultimately show ?case\n    by fast\nqed\n\n\nsubsection \\<open>Well-foundedness\\<close>\n\n\nlemma gt_imp_vars: \"t >\\<^sub>t s \\<Longrightarrow> vars t \\<supseteq> vars s\"\nproof (simp only: atomize_imp,\n    rule measure_induct_rule[of \"\\<lambda>(t, s). hsize t + hsize s\"\n      \"\\<lambda>(t, s). t >\\<^sub>t s \\<longrightarrow> vars t \\<supseteq> vars s\" \"(t, s)\", simplified prod.case],\n    simp only: split_paired_all prod.case atomize_imp[symmetric])\n  fix t s\n  assume\n    ih: \"\\<And>ta sa. hsize ta + hsize sa < hsize t + hsize s \\<Longrightarrow> ta >\\<^sub>t sa \\<Longrightarrow> vars ta \\<supseteq> vars sa\" and\n    t_gt_s: \"t >\\<^sub>t s\"\n  show \"vars t \\<supseteq> vars s\"\n    using t_gt_s\n  proof cases\n    case (gt_chop)\n    thus ?thesis\n      using ih\n      by (metis add_mono_thms_linordered_field(1) le_supI1 order_refl hsize_chop_lt vars_chop)\n  next\n    case gt_diff\n    show ?thesis \n    proof (cases s)\n      case Hd\n      thus ?thesis\n        using gt_diff(2) \n        by (metis empty_iff hd.collapse(2) hd.simps(18) subsetI tm.sel(1) tm.simps(17))\n    next\n      case (App s1 s2)\n      have \"vars (chop s) \\<subseteq> vars t\" using ih \n        using App chkchop_def local.gt_diff(3) nat_add_left_cancel_less hsize_chop_lt tm.disc(2) by blast\n      thus ?thesis \n        using  App  le_sup_iff local.gt_diff(2) tm.disc(2) vars_chop\n        by (metis empty_iff hd.collapse(2) hd.simps(18) subsetI)\n    qed\n  next\n    case gt_same\n    thus ?thesis\n    proof (cases \"head t\")\n      case (Var x)\n      then show ?thesis \n      proof (cases t)\n        case (Hd _)\n        then show ?thesis using Var local.gt_same(2) by force\n      next\n        case (App t1 t2)\n        then show ?thesis\n        proof (cases s)\n          case (Hd _)\n          then show ?thesis \n            using local.gt_same(1) vars_head_subseteq by fastforce\n        next\n          case (App s1 s2)\n          then have \"chop t >\\<^sub>t chop s\"\n            using Var local.gt_same(2) by force\n          then have \"vars (chop s) \\<subseteq> vars (chop t)\" using ih[OF _ \\<open>chop t >\\<^sub>t chop s\\<close>] \n            by (metis App Var add_less_mono chkchop_same_def hd.disc(1) hsize_chop_lt \n             local.gt_same(2) tm.disc(2))\n          then show ?thesis using gt_same(1) vars_chop[of t] vars_chop[of s]\n            by (metis App Var chkchop_same_def hd.disc(1) le_sup_iff local.gt_same(2) \n              sup.coboundedI1 tm.disc(2) vars_head_subseteq)\n        qed\n      qed\n    next\n      case (Sym f)\n      then have \"chkchop (>\\<^sub>t) t s\" using gt_same chkchop_same_def by auto\n      then show ?thesis \n      proof (cases s)\n        case (Hd _)\n        then show ?thesis using local.gt_same(1) vars_head_subseteq by force \n      next\n        case (App s1 s2)\n        then show ?thesis unfolding chkchop_def using vars_chop ih[of t \"chop s\"] \n          by (metis \\<open>chkchop (>\\<^sub>t) t s\\<close> chkchop_def le_sup_iff local.gt_same(1) \n              nat_add_left_cancel_less hsize_chop_lt tm.disc(2) vars_head_subseteq)\n      qed\n    qed\n  qed      \nqed  \n\nabbreviation gtg :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" (infix \">\\<^sub>t\\<^sub>g\" 50) where\n  \"(>\\<^sub>t\\<^sub>g) \\<equiv> \\<lambda>t s. ground t \\<and> t >\\<^sub>t s\"\n\ntheorem gt_wf:\n  assumes ghd_UNIV: \"\\<And>x. ground_heads_var x = UNIV\"\n  assumes extf_wf: \"\\<And>f. ext_wf (extf f)\"\n  shows \"wfP (\\<lambda>s t. t >\\<^sub>t s)\"\nproof -\n  have ground_wfP: \"wfP (\\<lambda>s t. t >\\<^sub>t\\<^sub>g s)\"\n    unfolding wfP_iff_no_inf_chain\n  proof\n    assume \"\\<exists>f. inf_chain (>\\<^sub>t\\<^sub>g) f\"\n    then obtain t where t_bad: \"bad (>\\<^sub>t\\<^sub>g) t\"\n      unfolding inf_chain_def bad_def by blast\n\n    let ?ff = \"worst_chain (>\\<^sub>t\\<^sub>g) (\\<lambda>t s. hsize t > hsize s)\"\n    let ?U_of = \"\\<lambda>i. {u. (?ff i) \\<rhd>\\<^sub>e\\<^sub>m\\<^sub>b u}\"\n\n    note wf_sz = wf_app[OF wellorder_class.wf, of hsize, simplified]\n\n    define U where \"U = (\\<Union>i. ?U_of i)\"\n\n    have gr: \"\\<And>i. ground (?ff i)\"\n      using worst_chain_bad[OF wf_sz t_bad, unfolded inf_chain_def] by fast\n    have gr_u: \"\\<And>u. u \\<in> U \\<Longrightarrow> ground u\" unfolding U_def\n      using gr ground_emb by fastforce\n\n    have \"\\<not> bad (>\\<^sub>t\\<^sub>g) u\" if u_in: \"u \\<in> ?U_of i\" for u i\n    proof\n      let ?ti = \"?ff i\"\n\n      assume u_bad: \"bad (>\\<^sub>t\\<^sub>g) u\"\n      have sz_u: \"hsize u < hsize ?ti\"\n        using emb_hsize_neq u_in by blast\n\n      show False\n      proof (cases i)\n        case 0\n        thus False\n          using sz_u min_worst_chain_0[OF wf_sz u_bad] by simp\n      next\n        case Suc\n        hence \"?ff (i - 1) >\\<^sub>t ?ff i\"\n          using worst_chain_pred[OF wf_sz t_bad] by simp\n        moreover have \"?ff i >\\<^sub>t u\"\n          using gt_embedding_property u_in by blast\n        ultimately have \"?ff (i - 1) >\\<^sub>t u\"\n          by (rule gt_trans)\n        thus False\n          using Suc sz_u min_worst_chain_Suc[OF wf_sz u_bad] gr by fastforce\n      qed\n    qed\n    hence u_good: \"\\<And>u. u \\<in> U \\<Longrightarrow> \\<not> bad (>\\<^sub>t\\<^sub>g) u\"\n      unfolding U_def by blast\n\n    have bad_diff_same: \"inf_chain (\\<lambda>t s. ground t \\<and> (gt_diff t s \\<or> gt_same t s)) ?ff\"\n      unfolding inf_chain_def\n    proof (intro allI conjI)\n      fix i\n\n      show \"ground (?ff i)\"\n        by (rule gr)\n\n      have gt: \"?ff i >\\<^sub>t ?ff (Suc i)\"\n        using worst_chain_pred[OF wf_sz t_bad] by blast\n\n      have \"\\<not> gt_chop (?ff i) (?ff (Suc i))\" \n      proof\n        assume a: \"gt_chop (?ff i) (?ff (Suc i))\"\n        then have \"chop (?ff i) \\<in> ?U_of i\" \n          by (metis (mono_tags, lifting) emb_step_chop emb_step_is_emb gt_chop gt_chop.cases gt_irrefl mem_Collect_eq)\n        then have  uij_in:\"chop (?ff i) \\<in> U\" unfolding U_def by fast\n\n        have \"\\<And>n. ?ff n >\\<^sub>t ?ff (Suc n)\"\n          by (rule worst_chain_pred[OF wf_sz t_bad, THEN conjunct2])\n        hence uij_gt_i_plus_3: \"chop (?ff i) >\\<^sub>t ?ff (Suc (Suc i))\"\n          using gt_trans by (metis (mono_tags, lifting) a gt_chop.cases)\n\n        have \"inf_chain (>\\<^sub>t\\<^sub>g) (\\<lambda>j. if j = 0 then chop (?ff i) else ?ff (Suc (i + j)))\"\n          unfolding inf_chain_def\n          by (auto intro!: gr gr_u[OF uij_in] uij_gt_i_plus_3 worst_chain_pred[OF wf_sz t_bad])\n        hence \"bad (>\\<^sub>t\\<^sub>g) (chop (?ff i))\"\n          unfolding bad_def by fastforce\n        thus False\n          using u_good[OF uij_in] by sat\n      qed\n      thus \"gt_diff (?ff i) (?ff (Suc i)) \\<or> gt_same (?ff i) (?ff (Suc i))\"\n        using gt unfolding gt_iff_chop_diff_same by sat\n    qed\n\n    have \"wf {(s, t). ground s \\<and> ground t \\<and> sym (head t) >\\<^sub>s sym (head s)}\"\n      using gt_sym_wf unfolding wfP_def wf_iff_no_infinite_down_chain by fast\n    moreover have \"{(s, t). ground t \\<and> gt_diff t s}\n      \\<subseteq> {(s, t). ground s \\<and> ground t \\<and> sym (head t) >\\<^sub>s sym (head s)}\"\n    proof (clarsimp, intro conjI)\n      fix s t\n      assume gr_t: \"ground t\" and gt_diff_t_s: \"gt_diff t s\"\n      thus gr_s: \"ground s\"\n        using gt_iff_chop_diff_same gt_imp_vars by fastforce\n\n      show \"sym (head t) >\\<^sub>s sym (head s)\"\n        using gt_diff_t_s ground_head[OF gr_s] ground_head[OF gr_t]\n        by (cases; cases \"head s\"; cases \"head t\") (auto simp: gt_hd_def)\n    qed\n    ultimately have wf_diff: \"wf {(s, t). ground t \\<and> gt_diff t s}\"\n      by (rule wf_subset)\n\n    have diff_O_same: \"{(s, t). ground t \\<and> gt_diff t s} O {(s, t). ground t \\<and> gt_same t s}\n      \\<subseteq> {(s, t). ground t \\<and> gt_diff t s}\"\n      unfolding gt_diff.simps gt_same.simps\n      by clarsimp (metis chkchop_def chkchop_same_def gt_same gt_trans)\n\n    have diff_same_as_union: \"{(s, t). ground t \\<and> (gt_diff t s \\<or> gt_same t s)} =\n      {(s, t). ground t \\<and> gt_diff t s} \\<union> {(s, t). ground t \\<and> gt_same t s}\"\n      by auto\n\n    obtain k where bad_same: \"inf_chain (\\<lambda>t s. ground t \\<and> gt_same t s) (\\<lambda>i. ?ff (i + k))\"\n      using wf_infinite_down_chain_compatible[OF wf_diff _ diff_O_same, of ?ff] bad_diff_same\n      unfolding inf_chain_def diff_same_as_union[symmetric] by auto\n    hence hd_sym: \"\\<And>i. is_Sym (head (?ff (i + k)))\"\n      unfolding inf_chain_def by (simp add: ground_head)\n\n    define f where \"f = sym (head (?ff k))\"\n\n    have hd_eq_f: \"head (?ff (i + k)) = Sym f\" for i\n    proof (induct i)\n      case 0\n      thus ?case\n        by (auto simp: f_def hd.collapse(2)[OF hd_sym, of 0, simplified])\n    next\n      case (Suc ia)\n      thus ?case\n        using bad_same unfolding inf_chain_def gt_same.simps by simp\n    qed\n\n    let ?gtu = \"\\<lambda>t s. t \\<in> U \\<and> t >\\<^sub>t s\"\n    thm UnionI CollectI\n    have \"t \\<in> set (args (?ff i)) \\<Longrightarrow> t \\<in> U\" for t i\n      unfolding U_def apply (rule UnionI[of \"?U_of i\"]) \n      using arg_emb CollectI arg_emb hsize_in_args by fast+\n    moreover have \"\\<And>i. extf f (>\\<^sub>t\\<^sub>g) (args (?ff (i + k))) (args (?ff (Suc i + k)))\"\n      using bad_same hd_eq_f unfolding  inf_chain_def gt_same.simps f_def hd.collapse(2)[OF ground_head, OF gr]\n      using extf_mono_strong[of _ _ \"(>\\<^sub>t)\" \"(\\<lambda>t s. ground t \\<and> t >\\<^sub>t s)\" ] ground_hd_in_ground_heads \n      by (metis (no_types, lifting) ground_args)\n    ultimately have \"\\<And>i. extf f ?gtu (args (?ff (i + k))) (args (?ff (Suc i + k)))\"\n      using extf_mono_strong[of _ _ \"(\\<lambda>t s. ground t \\<and> t >\\<^sub>t s)\" \"\\<lambda>t s. t \\<in> U \\<and> t >\\<^sub>t s\"] unfolding U_def by blast\n    hence \"inf_chain (extf f ?gtu) (\\<lambda>i. args (?ff (i + k)))\"\n      unfolding inf_chain_def by blast\n    hence nwf_ext: \"\\<not> wfP (\\<lambda>xs ys. extf f ?gtu ys xs)\"\n      unfolding wfP_iff_no_inf_chain by fast\n\n    have gtu_le_gtg: \"?gtu \\<le> (>\\<^sub>t\\<^sub>g)\"\n      by (auto intro!: gr_u)\n\n    have \"wfP (\\<lambda>s t. ?gtu t s)\"\n      unfolding wfP_iff_no_inf_chain\n    proof (intro notI, elim exE)\n      fix f\n      assume bad_f: \"inf_chain ?gtu f\"\n      hence bad_f0: \"bad ?gtu (f 0)\"\n        by (rule inf_chain_bad)\n\n      have \"f 0 \\<in> U\"\n        using bad_f unfolding inf_chain_def by blast\n      hence good_f0: \"\\<not> bad ?gtu (f 0)\"\n        using u_good bad_f inf_chain_bad inf_chain_subset[OF _ gtu_le_gtg] by blast\n\n      show False\n        using bad_f0 good_f0 by sat\n    qed\n    hence wf_ext: \"wfP (\\<lambda>xs ys. extf f ?gtu ys xs)\"\n      by (rule ext_wf.wf[OF extf_wf, rule_format])\n\n    show False\n      using nwf_ext wf_ext by blast\n  qed\n\n  let ?subst = \"subst grounding_\\<rho>\"\n\n  have \"wfP (\\<lambda>s t. ?subst t >\\<^sub>t\\<^sub>g ?subst s)\"\n    by (rule wfP_app[OF ground_wfP])\n  hence \"wfP (\\<lambda>s t. ?subst t >\\<^sub>t ?subst s)\"\n    by (simp add: ground_grounding_\\<rho>)\n  thus ?thesis\n    using gt_sus ghd_UNIV ground_heads.simps(1) wary_grounding_\\<rho> wfP_eq_minimal\n    by (metis (no_types, lifting))\nqed\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Lambda_Free_EPO/Lambda_Free_EPO.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3394379462061526}}
{"text": "(*  Title:      Jinja/J/Conform.thy\n\n    Author:     David von Oheimb, Tobias Nipkow\n    Copyright   1999 Technische Universitaet Muenchen\n*)\n\nheader {* \\isaheader{Conformance Relations for Type Soundness Proofs} *}\n\ntheory Conform\nimports Exceptions\nbegin\n\ndefinition conf :: \"'m prog \\<Rightarrow> heap \\<Rightarrow> val \\<Rightarrow> ty \\<Rightarrow> bool\"   (\"_,_ \\<turnstile> _ :\\<le> _\"  [51,51,51,51] 50)\nwhere\n  \"P,h \\<turnstile> v :\\<le> T  \\<equiv>\n  \\<exists>T'. typeof\\<^bsub>h\\<^esub> v = Some T' \\<and> P \\<turnstile> T' \\<le> T\"\n\ndefinition oconf :: \"'m prog \\<Rightarrow> heap \\<Rightarrow> obj \\<Rightarrow> bool\"   (\"_,_ \\<turnstile> _ \\<surd>\" [51,51,51] 50)\nwhere\n  \"P,h \\<turnstile> obj \\<surd>  \\<equiv>\n  let (C,fs) = obj in \\<forall>F D T. P \\<turnstile> C has F:T in D \\<longrightarrow>\n  (\\<exists>v. fs(F,D) = Some v \\<and> P,h \\<turnstile> v :\\<le> T)\"\n\ndefinition hconf :: \"'m prog \\<Rightarrow> heap \\<Rightarrow> bool\"  (\"_ \\<turnstile> _ \\<surd>\" [51,51] 50)\nwhere\n  \"P \\<turnstile> h \\<surd>  \\<equiv>\n  (\\<forall>a obj. h a = Some obj \\<longrightarrow> P,h \\<turnstile> obj \\<surd>) \\<and> preallocated h\"\n\ndefinition lconf :: \"'m prog \\<Rightarrow> heap \\<Rightarrow> (vname \\<rightharpoonup> val) \\<Rightarrow> (vname \\<rightharpoonup> ty) \\<Rightarrow> bool\"   (\"_,_ \\<turnstile> _ '(:\\<le>') _\" [51,51,51,51] 50)\nwhere\n  \"P,h \\<turnstile> l (:\\<le>) E  \\<equiv>\n  \\<forall>V v. l V = Some v \\<longrightarrow> (\\<exists>T. E V = Some T \\<and> P,h \\<turnstile> v :\\<le> T)\"\n\nabbreviation\n  confs :: \"'m prog \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> ty list \\<Rightarrow> bool\" \n             (\"_,_ \\<turnstile> _ [:\\<le>] _\" [51,51,51,51] 50) where\n  \"P,h \\<turnstile> vs [:\\<le>] Ts \\<equiv> list_all2 (conf P h) vs Ts\"\n\n\nsection{* Value conformance @{text\":\\<le>\"} *}\n\nlemma conf_Null [simp]: \"P,h \\<turnstile> Null :\\<le> T  =  P \\<turnstile> NT \\<le> T\"\n(*<*)\napply (unfold conf_def)\napply (simp (no_asm))\ndone\n(*>*)\n\nlemma typeof_conf[simp]: \"typeof\\<^bsub>h\\<^esub> v = Some T \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T\"\n(*<*)\napply (unfold conf_def)\napply (induct v)\napply auto\ndone\n(*>*)\n\nlemma typeof_lit_conf[simp]: \"typeof v = Some T \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T\"\n(*<*)by (rule typeof_conf[OF typeof_lit_typeof])(*>*)\n\nlemma defval_conf[simp]: \"P,h \\<turnstile> default_val T :\\<le> T\"\n(*<*)\napply (unfold conf_def)\napply (cases T)\napply auto\ndone\n(*>*)\n\nlemma conf_upd_obj: \"h a = Some(C,fs) \\<Longrightarrow> (P,h(a\\<mapsto>(C,fs')) \\<turnstile> x :\\<le> T) = (P,h \\<turnstile> x :\\<le> T)\"\n(*<*)\napply (unfold conf_def)\napply (rule val.induct)\napply (auto simp:fun_upd_apply)\ndone\n(*>*)\n\nlemma conf_widen: \"P,h \\<turnstile> v :\\<le> T \\<Longrightarrow> P \\<turnstile> T \\<le> T' \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T'\"\n(*<*)\napply (unfold conf_def)\napply (induct v)\napply (auto intro: widen_trans)\ndone\n(*>*)\n\nlemma conf_hext: \"h \\<unlhd> h' \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T \\<Longrightarrow> P,h' \\<turnstile> v :\\<le> T\"\n(*<*)\napply (unfold conf_def)\napply (induct v)\napply (auto dest: hext_objD)\ndone\n(*>*)\n\nlemma conf_ClassD: \"P,h \\<turnstile> v :\\<le> Class C \\<Longrightarrow>\n  v = Null \\<or> (\\<exists>a obj T. v = Addr a \\<and>  h a = Some obj \\<and> obj_ty obj = T \\<and>  P \\<turnstile> T \\<le> Class C)\"\n(*<*)\napply (unfold conf_def)\napply(induct \"v\")\napply(auto)\ndone\n(*>*)\n\nlemma conf_NT [iff]: \"P,h \\<turnstile> v :\\<le> NT = (v = Null)\"\n(*<*)by (auto simp add: conf_def)(*>*)\n\nlemma non_npD: \"\\<lbrakk> v \\<noteq> Null; P,h \\<turnstile> v :\\<le> Class C \\<rbrakk>\n  \\<Longrightarrow> \\<exists>a C' fs. v = Addr a \\<and> h a = Some(C',fs) \\<and> P \\<turnstile> C' \\<preceq>\\<^sup>* C\"\n(*<*)\napply (drule conf_ClassD)\napply auto\ndone\n(*>*)\n\n\nsection{* Value list conformance @{text\"[:\\<le>]\"} *}\n\nlemma confs_widens [trans]: \"\\<lbrakk>P,h \\<turnstile> vs [:\\<le>] Ts; P \\<turnstile> Ts [\\<le>] Ts'\\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> vs [:\\<le>] Ts'\"\n(*<*)\n  apply (rule list_all2_trans)\n    apply (rule conf_widen, assumption, assumption)\n   apply assumption\n  apply assumption\n  done\n(*>*)\n\nlemma confs_rev: \"P,h \\<turnstile> rev s [:\\<le>] t = (P,h \\<turnstile> s [:\\<le>] rev t)\"\n(*<*)\n  apply rule\n  apply (rule subst [OF list_all2_rev])\n  apply simp\n  apply (rule subst [OF list_all2_rev])\n  apply simp\n  done\n(*>*)\n\nlemma confs_conv_map:\n  \"\\<And>Ts'. P,h \\<turnstile> vs [:\\<le>] Ts' = (\\<exists>Ts. map typeof\\<^bsub>h\\<^esub> vs = map Some Ts \\<and> P \\<turnstile> Ts [\\<le>] Ts')\"\n(*<*)\napply(induct vs)\n apply simp\napply(case_tac Ts')\napply(auto simp add:conf_def)\ndone\n(*>*)\n\nlemma confs_hext: \"P,h \\<turnstile> vs [:\\<le>] Ts \\<Longrightarrow> h \\<unlhd> h' \\<Longrightarrow> P,h' \\<turnstile> vs [:\\<le>] Ts\"\n(*<*)by (erule list_all2_mono, erule conf_hext, assumption)(*>*)\n\nlemma confs_Cons2: \"P,h \\<turnstile> xs [:\\<le>] y#ys = (\\<exists>z zs. xs = z#zs \\<and> P,h \\<turnstile> z :\\<le> y \\<and> P,h \\<turnstile> zs [:\\<le>] ys)\"\n(*<*)by (rule list_all2_Cons2)(*>*)\n\n\nsection \"Object conformance\"\n\nlemma oconf_hext: \"P,h \\<turnstile> obj \\<surd> \\<Longrightarrow> h \\<unlhd> h' \\<Longrightarrow> P,h' \\<turnstile> obj \\<surd>\"\n(*<*)\napply (unfold oconf_def)\napply (fastforce elim:conf_hext)\ndone\n(*>*)\n\nlemma oconf_init_fields:\n \"P \\<turnstile> C has_fields FDTs \\<Longrightarrow> P,h \\<turnstile> (C, init_fields FDTs) \\<surd>\"\nby(fastforce simp add: has_field_def oconf_def init_fields_def map_of_map\n            dest: has_fields_fun)\n\nlemma oconf_fupd [intro?]:\n  \"\\<lbrakk> P \\<turnstile> C has F:T in D; P,h \\<turnstile> v :\\<le> T; P,h \\<turnstile> (C,fs) \\<surd> \\<rbrakk> \n  \\<Longrightarrow> P,h \\<turnstile> (C, fs((F,D)\\<mapsto>v)) \\<surd>\"\n(*<*)\n  apply (unfold oconf_def has_field_def)\n  apply clarsimp\n  apply (drule (1) has_fields_fun)\n  apply (auto simp add: fun_upd_apply)\n  done                                    \n(*>*)\n\n(*<*)\nlemmas oconf_new = oconf_hext [OF _ hext_new]\nlemmas oconf_upd_obj = oconf_hext [OF _ hext_upd_obj]\n(*>*)\n\nsection \"Heap conformance\"\n\nlemma hconfD: \"\\<lbrakk> P \\<turnstile> h \\<surd>; h a = Some obj \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> obj \\<surd>\"\n(*<*)\napply (unfold hconf_def)\napply (fast)\ndone\n(*>*)\n\nlemma hconf_new: \"\\<lbrakk> P \\<turnstile> h \\<surd>; h a = None; P,h \\<turnstile> obj \\<surd> \\<rbrakk> \\<Longrightarrow> P \\<turnstile> h(a\\<mapsto>obj) \\<surd>\"\n(*<*)by (unfold hconf_def) (auto intro: oconf_new preallocated_new)(*>*)\n\nlemma hconf_upd_obj: \"\\<lbrakk> P \\<turnstile> h\\<surd>; h a = Some(C,fs); P,h \\<turnstile> (C,fs')\\<surd> \\<rbrakk> \\<Longrightarrow> P \\<turnstile> h(a\\<mapsto>(C,fs'))\\<surd>\"\n(*<*)by (unfold hconf_def) (auto intro: oconf_upd_obj preallocated_upd_obj)(*>*)\n\n\nsection \"Local variable conformance\"\n\nlemma lconf_hext: \"\\<lbrakk> P,h \\<turnstile> l (:\\<le>) E; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> l (:\\<le>) E\"\n(*<*)\napply (unfold lconf_def)\napply  (fast elim: conf_hext)\ndone\n(*>*)\n\nlemma lconf_upd:\n  \"\\<lbrakk> P,h \\<turnstile> l (:\\<le>) E; P,h \\<turnstile> v :\\<le> T; E V = Some T \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> l(V\\<mapsto>v) (:\\<le>) E\"\n(*<*)\napply (unfold lconf_def)\napply auto\ndone\n(*>*)\n\nlemma lconf_empty[iff]: \"P,h \\<turnstile> empty (:\\<le>) E\"\n(*<*)by(simp add:lconf_def)(*>*)\n\nlemma lconf_upd2: \"\\<lbrakk>P,h \\<turnstile> l (:\\<le>) E; P,h \\<turnstile> v :\\<le> T\\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> l(V\\<mapsto>v) (:\\<le>) E(V\\<mapsto>T)\"\n(*<*)by(simp add:lconf_def)(*>*)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/Common/Conform.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3394379462061526}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2005         |\n            |                  March 2007               |\n            |                                           |\n            |        CSP-Prover on Isabelle2017         |\n            |                  April 2018  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_law_fix\nimports CSP_F_law_fp CSP_T.CSP_T_law_fix\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(*-----------*\n |    Bot    |\n *-----------*)\n\nlemma failures_prod_Bot: \"(%p. failures DIV M) = Bot\"\napply (simp add: prod_Bot_def)\napply (simp add: fun_eq_iff)\napply (simp add: failures_iff)\napply (simp add: bottom_setF_def)\ndone\n\nlemma traces_failures_prod_Bot: \n   \"(%p. (traces DIV (fstF o M) ,, failures DIV M)) = Bot\"\napply (simp add: prod_Bot_def)\napply (simp add: fun_eq_iff)\napply (simp add: bottom_domF_def)\napply (simp add: traces_iff failures_iff)\ndone\n\nlemma semF_prod_Bot: \"(%p. [[DIV]]F) = Bot\"\napply (simp add: semF_def semFf_def)\napply (simp add: traces_failures_prod_Bot)\ndone\n\n(*-----------*\n |   FIX P   |\n *-----------*)\n\n(*** iteration lemmas ***)\n\nlemma semTfun_iteration_semFfun_Bot:\n  \"ALL p. ([[Pf]]Tfun ^^ n) Bot p = fstF (([[Pf]]Ffun ^^ n) Bot p)\"\napply (induct_tac n)\napply (simp_all)\n\n(* base *)\napply (simp add: prod_Bot_def bottom_domF_def)\napply (simp add: bottom_domT_def)\napply (simp add: pairF_fstF)\n\n(* step *)\napply (simp add: fun_eq_iff[THEN sym])\napply (simp add: fun_eq_iff)\napply (simp add: semFfun_def)\napply (fold comp_def)\napply (simp add: semTfun_fstF_semFf)\ndone\n\nlemma semF_iteration_semFfun_Bot:\n  \"ALL p. [[(((Pf <<<) ^^ n) (%q. DIV) p)]]F = (([[Pf]]Ffun ^^ n) Bot p)\"\napply (induct_tac n)\napply (simp_all)\n\n(* base *)\napply (simp add: semF_def semFf_def)\napply (simp add: traces_iff failures_iff)\napply (simp add: prod_Bot_def bottom_domF_def)\n\n(* step *)\napply (simp add: Subst_procfun_prod_def)\napply (simp add: semF_subst)\napply (simp add: fun_eq_iff[THEN sym])\napply (simp add: semFf_semFfun)\ndone\n\nlemma semF_iteration_semFfun_Bot_sndF: \n  \"failures (((Pf <<<) ^^ n) (%q. DIV) p) MF\n   = sndF (([[Pf]]Ffun ^^ n) Bot p)\"\napply (rule semF_decompo_sndF)\nby (simp add: semF_iteration_semFfun_Bot)\n\n(*** FIX ***)\n\nlemma semF_FIX_LUB_domF_T:\n   \"fst ` Rep_domF ` \n   {y. EX x. (EX n. x = ([[P]]Ffun ^^ n) Bot) & y = x p}\n = {t. EX n. t = (fstF ((([[P]]Ffun ^^ n) Bot) p))}\"\nby (auto simp add: fstF_def)\n\nlemma semF_FIX_LUB_domF_F:\n   \"Union (Rep_setF ` snd ` Rep_domF ` \n           {y. EX x. (EX n. x = ([[P]]Ffun ^^ n) Bot) & y = x p})\n    = {f. EX n. f :f (sndF ((([[P]]Ffun ^^ n) Bot) p))}\"\n(* it is not necessary to add Union_image_eq in Isabelle 2017\nby (auto simp add: Union_image_eq memF_def sndF_def)\n*)\nby (auto simp add: memF_def sndF_def)\n\nlemma semF_FIX: \n    \"[[(FIX Pf) p]]F\n     = LUB_domF {y. EX x. (EX n. x = ([[Pf]]Ffun ^^ n) Bot) & y = x p}\"\napply (simp add: semF_def semFf_def)\napply (simp add: pairF_def)\napply (simp add: LUB_domF_def)\napply (subgoal_tac \"EX x n. x = ([[Pf]]Ffun ^^ n) Bot\")\napply (subgoal_tac \n \"{y. EX x. (EX n. x = ([[Pf]]Ffun ^^ n) Bot) & y = x p} ~= {}\")\napply (simp add: Abs_domF_inject LUB_TF_in_Rep)\napply (simp add: LUB_TF_def)\napply (simp add: semF_FIX_LUB_domF_T)\napply (simp add: UnionF_def)\n(* for Isabelle 2018 *)\napply (simp add: semF_FIX_LUB_domF_F[simplified])\napply (rule) \n\n (* T *)\n apply (simp add: traces_FIX)\n apply (simp add: semTfun_iteration_semFfun_Bot)\n\n (* F *)\n apply (simp add: FIX_def FIXn_def)\n apply (rule order_antisym)\n\n  (* <= *)\n  apply (rule)\n  apply (simp add: in_failures)\n  apply (elim conjE exE)\n  apply (simp add: semF_iteration_semFfun_Bot_sndF)\n  apply (force)\n\n  (* => *)\n  apply (rule)\n  apply (simp add: in_failures)\n  apply (elim conjE exE)\n  apply (simp add: semF_iteration_semFfun_Bot_sndF)\n  apply (force)\n\nby (auto)\n\n(*** FIX is LUB ***)\n\nlemma semF_FIX_isLUB:\n   \"(%p. [[(FIX Pf) p]]F) isLUB {x. EX n. x = ([[Pf]]Ffun ^^ n) Bot}\"\napply (simp add: prod_LUB_decompo)\napply (intro allI)\napply (simp add: proj_fun_def)\napply (simp add: image_def)\napply (simp add: semF_FIX)\napply (subgoal_tac \n     \"{y. EX x. (EX n. x = ([[Pf]]Ffun ^^ n) Bot) & y = x i} =\n      {u. EX n. u = ([[Pf]]Ffun ^^ n) Bot i}\")\napply (simp)\napply (rule LUB_domF_isLUB)\napply (auto)\ndone\n\n\nlemma semF_FIX_LUB:\n   \"(%p. [[(FIX Pf) p]]F) = LUB {x. EX n. x = ([[Pf]]Ffun ^^ n) Bot}\"\napply (rule sym)\napply (rule isLUB_LUB)\napply (simp add: semF_FIX_isLUB)\ndone\n\nlemma semF_FIX_LFP:\n   \"(%p. [[(FIX Pf) p]]F) = LFP ([[Pf]]Ffun)\"\napply (simp add: semF_FIX_LUB)\napply (simp add: Tarski_thm_LFP_LUB continuous_semFfun)\ndone\n\nlemma semF_FIX_LFP_p:\n   \"[[(FIX Pf) p]]F = LFP ([[Pf]]Ffun) p\"\napply (insert semF_FIX_LFP[of Pf])\napply (simp add: fun_eq_iff)\ndone\n\nlemma semF_FIX_isLFP:\n   \"(%p. [[(FIX Pf) p]]F) isLFP [[Pf]]Ffun\"\napply (simp add: semF_FIX_LFP)\napply (simp add: LFP_is Tarski_thm_EX continuous_semFfun)\ndone\n\nlemma semF_FIX_LFP_fixed_point:\n   \"[[Pf]]Ffun (%p. [[(FIX Pf) p]]F) = (%p. [[(FIX Pf) p]]F)\"\napply (insert semF_FIX_isLFP[of Pf])\napply (simp add: isLFP_def)\ndone\n\nlemma semF_FIX_LFP_least:\n   \"ALL M. [[Pf]]Ffun M = M --> (%p. [[(FIX Pf) p]]F) <= M\"\napply (insert semF_FIX_isLFP[of Pf])\napply (simp add: isLFP_def)\ndone\n\n(*=======================================================*\n |                                                       |\n |                        CPO                            |\n |                                                       |\n *=======================================================*)\n\nlemma cspF_FIX_cpo:\n  \"[| FPmode = CPOmode |\n      FPmode = MIXmode ;\n      Pf = PNfun |]\n  ==> $p =F (FIX Pf)(p)\"\napply (simp add: eqF_def)\napply (fold semF_def)\napply (simp add: semF_FIX_LFP_p)\napply (simp add: semF_LFP_cpo)\ndone\n\nlemma cspF_FIX_cms:\n  \"[| FPmode = CMSmode ;\n      Pf = PNfun ;\n      guardedfun (Pf) |]\n  ==> $p =F (FIX Pf)(p)\"\napply (simp add: eqF_def)\napply (fold semF_def)\napply (simp add: semF_FIX_LFP_p)\napply (simp add: semF_guarded_LFP_UFP)\napply (simp add: semF_UFP_cms)\ndone\n\nlemma cspF_FIX:\n  \"[| FPmode = CPOmode | \n      FPmode = CMSmode & guardedfun (Pf) |\n      FPmode = MIXmode ;\n      Pf = PNfun |]\n  ==> $p =F (FIX Pf)(p)\"\napply (erule disjE)\napply (simp add: cspF_FIX_cpo)\napply (erule disjE)\napply (simp add: cspF_FIX_cms)\napply (simp add: cspF_FIX_cpo)\ndone\n\n(*==============================================================*\n |                                                              |\n | replace process names by infinite repcicated internal choice |\n |                         rmPN   (FIX)                         |\n |                                                              |\n *==============================================================*)\n\nlemma cspF_rmPN_eqF:\n  \"FPmode = CPOmode | \n   FPmode = CMSmode & guardedfun (PNfun::('p=>('p,'a) proc)) |\n   FPmode = MIXmode \n   ==> (P::('p,'a) proc) =F rmPN(P)\"\napply (induct_tac P)\napply (simp_all add: cspF_decompo)\napply (rule cspF_FIX)\napply (simp_all)\ndone\n\n(*-------------------------------------------------------*\n |                                                       |\n |         FIX expansion (CSP-Prover intro rule)         |\n |                                                       |\n *-------------------------------------------------------*)\n\nlemma failures_FIXn_plus_sub_lm:\n \"ALL n m p. failures ((FIX[n] Pf) p) M <= failures ((FIX[n+m] Pf) p) M\"\napply (rule)\napply (induct_tac n)\napply (simp add: FIXn_def)\napply (intro allI)\napply (rule)\napply (simp add: in_failures)\n\napply (rule allI)\napply (simp add: FIXn_def Subst_procfun_prod_def)\napply (drule_tac x=\"m\" in spec)\napply (simp add: failrues_subst)\napply (rule allI)\napply (subgoal_tac\n  \"(%q. [[((%Qf p. (Pf p) << Qf) ^^ na) (%q. DIV) q]]Ff M) <=\n   (%q. [[((%Qf p. (Pf p) << Qf) ^^ (na + m)) (%q. DIV) q]]Ff M)\")\napply (simp add: mono_failures[simplified mono_def])\napply (unfold order_prod_def)\napply (intro allI)\napply (simp add: subdomF_decompo)\napply (insert traces_FIXn_plus_sub_lm[of Pf \"fstF o M\"])\napply (simp add: FIXn_def Subst_procfun_prod_def)\ndone\n\nlemma failures_FIXn_plus_sub: \n   \"failures ((FIX[n] Pf) p) M <= failures ((FIX[n+m] Pf) p) M\"\nby (simp add: failures_FIXn_plus_sub_lm)\n\nlemma semF_FIXn_plus_sub:\n \"[[(FIX[n] Pf) p]]Ff M <= [[(FIX[n+m] Pf) p]]Ff M\"\napply (simp add: subdomF_decompo)\napply (simp add: traces_FIXn_plus_sub)\napply (simp add: failures_FIXn_plus_sub)\ndone\n\nlemma in_failures_FIXn_plus_sub: \n  \"(s,X) :f failures ((FIX[n] Pf) p) M\n   ==> (s,X) :f failures ((FIX[n+m] Pf) p) M\"\napply (insert failures_FIXn_plus_sub[of n Pf p M m])\nby (auto)\n\n(*-----------------------------------------------------*\n |  sometimes FIX[n + f n] is useful more than FIX[n]  |\n *-----------------------------------------------------*)\n\nlemma cspF_FIX_plus_eq: \n     \"ALL f p. (FIX Pf) p =F (!nat n .. ((FIX[n + f n] Pf) p))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_FIX_plus_eq)\n\napply (simp add: FIX_def)\napply (intro allI)\napply (rule order_antisym)\n\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE)\n apply (rule_tac x=\"n\" in exI)\n apply (simp add: in_failures_FIXn_plus_sub)\n\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE)\n apply (rule_tac x=\"n + f n\" in exI)\n apply (simp)\ndone\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(*\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_law_fix.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.33927475118110456}}
{"text": "section \\<open>Correctness proofs for congruence closure\\<close>\ntheory CC_Correctness\n  imports CC_Termination \nbegin \n\nlemma are_congruent_rep_of:\n  assumes \"cc_invar cc\"\n\"are_congruent cc (a \\<approx> b)\"\n\"a < nr_vars cc\" \"b < nr_vars cc\"\nshows \"rep_of (cc_list cc) a = rep_of (cc_list cc) b\"\n\"rep_of (proof_forest cc) a = rep_of (proof_forest cc) b\"\nproof-\n  show \"rep_of (cc_list cc) a = rep_of (cc_list cc) b\"\n    by (metis (full_types) are_congruent.simps(1) assms(2) congruence_closure.surjective old.unit.exhaust)\n  then show \"rep_of (proof_forest cc) a = rep_of (proof_forest cc) b\"\n    using assms same_length_invar_def same_eq_classes_invar_def \n    by auto\nqed\n\nlemma are_congruent_rep_of_neq:\n  assumes \"cc_invar cc\"\n\"\\<not> are_congruent cc (a \\<approx> b)\"\n\"a < nr_vars cc\" \"b < nr_vars cc\"\nshows \"rep_of (cc_list cc) a \\<noteq> rep_of (cc_list cc) b\"\n\"rep_of (proof_forest cc) a \\<noteq> rep_of (proof_forest cc) b\"\nproof-\n  show \"rep_of (cc_list cc) a \\<noteq> rep_of (cc_list cc) b\"\n    by (metis (full_types) are_congruent.simps(1) assms(2) congruence_closure.surjective old.unit.exhaust)\n  then show \"rep_of (proof_forest cc) a \\<noteq> rep_of (proof_forest cc) b\"\n    using assms same_length_invar_def same_eq_classes_invar_def \n    by auto\nqed\n\ntheorem cc_invar_merge: \n  assumes \"cc_invar cc\" \"valid_vars eq (nr_vars cc)\"\n  shows \"cc_invar (merge cc eq)\"\n  using assms proof(induction cc eq rule: merge.induct)\n  case (1 l u t pe pf pfl ip a b)\n  then have \"cc_invar \\<lparr>cc_list = l, use_list = u, lookup = t, pending = One (a \\<approx> b)#pe, \n      proof_forest = pf, pf_labels = pfl, input = insert (a \\<approx> b) ip\\<rparr>\" \n    using cc_invar_merge1 by simp\n  with 1 propagate_domain' show ?case \n    using merge.simps(1) cc_invar_propagate \n    by (metis congruence_closure.select_convs(1))\nnext\n  case (2 l u t pe pf pfl ip a\\<^sub>1 a\\<^sub>2 a)\n  then show ?case \n  proof(cases \"lookup_Some t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)\")\n    case True\n    then have \"cc_invar \\<lparr>cc_list = l, use_list = u, lookup = t, \n            pending = link_to_lookup t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)#pe, proof_forest = pf,\n            pf_labels = pfl, input = insert (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) ip\\<rparr>\"\n      using cc_invar_merge2 \"2.prems\" by blast\n    with True 2 propagate_domain' show ?thesis \n      using merge.simps(2) cc_invar_propagate by (metis congruence_closure.select_convs(1))\n  next\n    case False\n    then have \"cc_invar \\<lparr>cc_list = l, \n          use_list = (u[rep_of l a\\<^sub>1 := (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)#(u ! rep_of l a\\<^sub>1)])[rep_of l a\\<^sub>2 := (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)#(u ! rep_of l a\\<^sub>2)], \n          lookup = update_lookup t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a), \n          pending = pe, proof_forest = pf, pf_labels = pfl, input = insert (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) ip\\<rparr>\"\n      using cc_invar_merge3 \"2.prems\" by blast\n    with False show ?thesis \n      by simp\n  qed\nqed\n\nsubsection \\<open>Initial cc\\<close>\n\ntheorem cc_invar_initial_cc: \"cc_invar (initial_cc n)\"\nproof(rule conjI)+\n  show \"cc_list_invar (initial_cc n)\" unfolding cc_list_invar_def \n    by (simp add: ufa_init_invar)\n  show \"use_list_invar (initial_cc n)\" unfolding use_list_invar_def\n  proof(standard, standard, standard, standard, standard)\n    fix i j \n    assume \"i < nr_vars (initial_cc n)\" \"j < length (use_list (initial_cc n) ! i)\"\n      \"cc_list (initial_cc n) ! i = i\"\n    then have \"length (use_list (initial_cc n) ! i) = 0\" \n      by fastforce\n    then have \"False\" \n      using \\<open>j < length (use_list (initial_cc n) ! i)\\<close> by presburger\n  qed simp\n  show \"lookup_invar (initial_cc n)\" unfolding lookup_invar_def\n  proof(standard, standard, standard, standard, standard, standard, standard)\n    fix i j\n    assume \"i < nr_vars (initial_cc n)\" \"j < nr_vars (initial_cc n)\"\n      \"cc_list (initial_cc n) ! i = i \\<and> cc_list (initial_cc n) ! j = j\"\n    then show \"lookup (initial_cc n) ! i ! j = None\" \n      by force\n  next\n    show \"quadratic_table (lookup (initial_cc n))\" \n      by simp\n  qed\n  show \"proof_forest_invar (initial_cc n)\" unfolding proof_forest_invar_def\n    by (simp add: ufa_init_invar)\n  have \"representativeE (initial_cc n) \\<union> pending_set (pending (initial_cc n)) = {}\" \n    unfolding representativeE_def by simp\n  moreover have \"input (initial_cc n) = {}\"  by simp\n  ultimately show \"correctness_invar (initial_cc n)\" unfolding correctness_invar_def\n    by auto\n  show \"same_eq_classes_invar (initial_cc n)\" unfolding same_eq_classes_invar_def\n  proof(standard, standard, standard, standard)\n    fix i j\n    assume \"i < length (proof_forest (initial_cc n))\"\n      \"j < length (proof_forest (initial_cc n))\"\n    then show \"(rep_of (cc_list (initial_cc n)) i =\n            rep_of (cc_list (initial_cc n)) j) =\n           (rep_of (proof_forest (initial_cc n)) i =\n            rep_of (proof_forest (initial_cc n)) j)\" \n      by force\n  qed\n  show \"same_length_invar (initial_cc n) (nr_vars (initial_cc n))\" \n    unfolding same_length_invar_def by simp\n  show \"pending_invar (initial_cc n)\" \n    unfolding pending_invar_def by simp\n  show \"lookup_invar2 (initial_cc n)\" \n    unfolding lookup_invar2_def by simp\n  show \"use_list_invar2 (initial_cc n)\" \n    unfolding use_list_invar2_def by auto\n  show \"pf_labels_invar (initial_cc n)\"\n    unfolding pf_labels_invar_def congruence_closure.select_convs by force\nqed\n\nsubsection \\<open>Correctness of merge\\<close>\n\nlemma pending_empty_after_propagate: \n  \"propagate_dom cc \\<Longrightarrow> pending (propagate cc) = []\"\n  apply(induction rule: propagate.pinduct)\n   apply simp\n  by (metis propagate_simps2 propagate_simps3)\n\nlemma pending_empty_after_merge: \n  \"cc_invar cc \\<Longrightarrow> valid_vars x (nr_vars cc) \\<Longrightarrow> pending cc = [] \\<Longrightarrow> pending (merge cc x) = []\"\nproof(induction cc x rule: merge.induct)\n  case (1 l u t pe pf pfl ip a b)\n  then show ?case using pending_empty_after_propagate cc_invar_merge1 propagate_domain' \n    using merge.simps(1) by (metis congruence_closure.select_convs(1))\nnext\n  case (2 l u t pe pf pfl ip a\\<^sub>1 a\\<^sub>2 a)\n  then show ?case using pending_empty_after_propagate apply(cases \"lookup_Some t l (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)\")\n    using pending_empty_after_propagate cc_invar_merge2 propagate_domain'\n    using merge.simps(2) apply (metis congruence_closure.select_convs(1))\n    using merge.simps(2) by simp\nqed\n\ntheorem representativeE_are_congruent: \n  assumes \"cc_invar cc\" \"valid_vars eq (nr_vars cc)\" \"eq \\<in> representativeE cc\"\n  shows \"are_congruent cc eq\"\nproof-\n  obtain l u t pe pf pfl ip where \n    cc: \"cc = \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf, pf_labels = pfl, input = ip\\<rparr>\"\n    using congruence_closure.cases by blast\n  from assms have \"ufa_invar l\" \n    unfolding cc cc_list_invar_def by auto\n  from assms cc consider\n    (rep) c where \"eq = (c \\<approx> rep_of l c)\" \"c < length l\" \"l ! c \\<noteq> c\"\n  | (lookup) a' b' c c\\<^sub>1 c\\<^sub>2 where \"eq = F a' b' \\<approx> rep_of l c\" \"a' < length l\" \"b' < length l\"\n    \"c < length l\" \"l ! a' = a'\" \"l ! b' = b'\" \"t ! a' ! b' = Some (F c\\<^sub>1 c\\<^sub>2 \\<approx> c)\"\n    unfolding representativeE_def \n    by fastforce\n  then show ?thesis \n  proof(cases)\n    case rep\n    with assms show ?thesis unfolding rep(1) cc are_congruent.simps \n      using \\<open>ufa_invar l\\<close> rep_of_idem by presburger\n  next\n    case lookup\n    with assms show ?thesis unfolding lookup(1) cc are_congruent.simps \n      using \\<open>ufa_invar l\\<close> rep_of_idem by (simp add: rep_of_refl)\n  qed\nqed\n\nsubsection \\<open>Lemmas about \\<open>are_congruent\\<close>\\<close>\n\nlemma CC_representativeE_valid_vars:\n  assumes \"eq \\<in> Congruence_Closure (representativeE cc)\" \"cc_invar cc\" \n    \"\\<nexists> a . eq = (a \\<approx> a)\"\n  shows \"valid_vars eq (nr_vars cc)\"\n  using assms proof(induction eq rule: Congruence_Closure.induct)\n  case (base eqt)\n  then consider a where \"eqt = (a \\<approx> rep_of (cc_list cc) a)\" \n    \"a < nr_vars cc\" \"(cc_list cc) ! a \\<noteq> a\" \n  | a' b' c c\\<^sub>1 c\\<^sub>2 where \"eqt = F a' b' \\<approx> rep_of (cc_list cc) c\"  \"a' < nr_vars cc\"\n    \"b' < nr_vars cc\"  \"c < nr_vars cc\"\n    \"cc_list cc ! a' = a'\" \"cc_list cc ! b' = b'\"\n    \"lookup cc ! a' ! b' = Some (F c\\<^sub>1 c\\<^sub>2 \\<approx> c)\"\n    unfolding representativeE_def by blast\n  then show ?case proof(cases)\n    case 1\n    then show ?thesis \n      using base.prems cc_list_invar_def rep_of_bound by auto\n  next\n    case 2\n    then show ?thesis \n      using base.prems cc_list_invar_def rep_of_bound valid_vars.simps(2) by blast\n  qed\nqed auto\n\nlemma are_congruent_Function: \n  assumes \"valid_vars (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) (length l)\"\n    \"are_congruent \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf, pf_labels = pfl, input = ip\\<rparr>\n(F a\\<^sub>1 a\\<^sub>2 \\<approx> a)\" \"ufa_invar l\"\n    \"lookup_invar \\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf, pf_labels = pfl, input = ip\\<rparr>\"\n  obtains b\\<^sub>1 b\\<^sub>2 b where \n    \"(t ! rep_of l a\\<^sub>1) ! rep_of l a\\<^sub>2 = Some (F b\\<^sub>1 b\\<^sub>2 \\<approx> b)\" \"rep_of l a = rep_of l b\"\nproof(cases \"(t ! rep_of l a\\<^sub>1) ! rep_of l a\\<^sub>2\")\n  case None\n  then show ?thesis \n    using assms by auto\nnext\n  case (Some a)\n  with assms obtain c c\\<^sub>1 c\\<^sub>2 where \"a = F c\\<^sub>1 c\\<^sub>2 \\<approx> c\" unfolding lookup_invar_def\n    by (metis congruence_closure.select_convs(1) congruence_closure.select_convs(3) option.discI option.inject rep_of_less_length_l rep_of_min valid_vars.simps(2))\n  show ?thesis\n    using assms that Some \\<open>a = F c\\<^sub>1 c\\<^sub>2 \\<approx> c\\<close> unfolding lookup_invar_def \n    by auto\nqed\n\nlemma are_congruent_transitive1:\n  assumes \"are_congruent cc (a \\<approx> b)\" \"are_congruent cc (b \\<approx> c)\" \n  shows \"are_congruent cc (a \\<approx> c)\"\n  using assms proof(induction cc \"a \\<approx> b\" rule: are_congruent.induct)\n  case (1 l u t pe pf pfl ip)\n  then show ?case \n    by simp\nqed\n\nlemma are_congruent_transitive2:\n  assumes \"are_congruent cc (F a\\<^sub>1 a\\<^sub>2 \\<approx> b)\" \"are_congruent cc (b \\<approx> c)\" \n    \"lookup_invar cc\" \"valid_vars (F a\\<^sub>1 a\\<^sub>2 \\<approx> b) (nr_vars cc)\" \"valid_vars (b \\<approx> c) (nr_vars cc)\"\n    \"ufa_invar (cc_list cc)\"\n  shows \"are_congruent cc (F a\\<^sub>1 a\\<^sub>2 \\<approx> c)\"\n  using assms proof(induction cc \"F a\\<^sub>1 a\\<^sub>2 \\<approx> b\" rule: are_congruent.induct)\n  case (2 l u t pe pf pfl ip)\n  with are_congruent_Function congruence_closure.cases obtain b\\<^sub>1 b\\<^sub>2 c where \n    \"(t ! rep_of l a\\<^sub>1) ! rep_of l a\\<^sub>2 = Some (F b\\<^sub>1 b\\<^sub>2 \\<approx> c)\" \"rep_of l b = rep_of l c\"\n    by (metis congruence_closure.select_convs(1))\n  with 2 show ?case \n    by force\nqed\n\nlemma are_congruent_transitive3:\n  assumes \"are_congruent cc (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)\"\n    \"are_congruent cc (a\\<^sub>1 \\<approx> b\\<^sub>1)\" \"are_congruent cc (a\\<^sub>2 \\<approx> b\\<^sub>2)\" \n    \"lookup_invar cc\" \n    \"valid_vars (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) (nr_vars cc)\" \"valid_vars (a\\<^sub>1 \\<approx> b\\<^sub>1) (nr_vars cc)\" \n    \"valid_vars (a\\<^sub>2 \\<approx> b\\<^sub>2) (nr_vars cc)\"\n    \"ufa_invar (cc_list cc)\"\n  shows \"are_congruent cc (F b\\<^sub>1 b\\<^sub>2 \\<approx> a)\"\n  using assms proof(induction cc \"F a\\<^sub>1 a\\<^sub>2 \\<approx> a\" rule: are_congruent.induct)\n  case (2 l u t pe pf pfl ip)\n  with are_congruent_Function congruence_closure.cases obtain b\\<^sub>1 b\\<^sub>2 c where \n    \"(t ! rep_of l a\\<^sub>1) ! rep_of l a\\<^sub>2 = Some (F b\\<^sub>1 b\\<^sub>2 \\<approx> c)\" \"rep_of l a = rep_of l c\"\n    by (metis congruence_closure.select_convs(1))\n  with 2 show ?case \n    by auto\nqed\n\nlemma are_congruent_monotonic:\n  assumes \"lookup_invar cc\" \n    \"are_congruent cc (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)\" \"are_congruent cc (F a\\<^sub>1 a\\<^sub>2 \\<approx> b)\"\n    \"valid_vars (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) (nr_vars cc)\" \"valid_vars (F a\\<^sub>1 a\\<^sub>2 \\<approx> b) (nr_vars cc)\"\n    \"ufa_invar (cc_list cc)\"\n  shows \"are_congruent cc (a \\<approx> b)\"\n  using assms proof(induction cc \"F a\\<^sub>1 a\\<^sub>2 \\<approx> a\" rule: are_congruent.induct)\n  case (2 l u t pe pf pfl ip)\n  with are_congruent_Function congruence_closure.cases obtain b\\<^sub>1 b\\<^sub>2 c where \n    \"(t ! rep_of l a\\<^sub>1) ! rep_of l a\\<^sub>2 = Some (F b\\<^sub>1 b\\<^sub>2 \\<approx> c)\" \"rep_of l a = rep_of l c\"\n    by (metis congruence_closure.select_convs(1))\n  with 2 show ?case \n    by auto\nqed\n\ntheorem are_congruent_correct: \n  assumes \"valid_vars eq (nr_vars cc)\" \"cc_invar cc\" \"pending cc = []\"\n  shows \"eq \\<in> Congruence_Closure ((input cc)) \\<longleftrightarrow> are_congruent cc eq\"\nproof-\n  obtain l u t pe pf pfl ip where cc: \"cc = \n\\<lparr>cc_list = l, use_list = u, lookup = t, pending = pe, proof_forest = pf, pf_labels = pfl, input = ip\\<rparr>\"\n    using congruence_closure.cases by blast\n  have \"correctness_invar cc\" \n    by (simp add: assms(2))\n  then have \"eq \\<in> Congruence_Closure (input cc) \\<longleftrightarrow> eq \\<in> Congruence_Closure (representativeE cc)\"\n    unfolding correctness_invar_def using assms \n    by simp\n  also have \"... \\<longleftrightarrow> are_congruent cc eq\"\n  proof\n    assume CC: \"eq \\<in> Congruence_Closure (representativeE cc)\"\n    from CC assms show \"are_congruent cc eq\"\n    proof(induction eq rule: Congruence_Closure.induct)\n      case (base eqt)\n      with representativeE_are_congruent show ?case \n        by blast\n    next\n      case (reflexive a)\n      then show ?case unfolding cc by simp\n    next\n      case (symmetric a b)\n      then show ?case unfolding cc by simp\n    next\n      case (transitive1 a b c)\n      then have \"valid_vars (a \\<approx> b) (nr_vars cc)\" \"valid_vars (b \\<approx> c) (nr_vars cc)\"\n        using CC_representativeE_valid_vars \n        by (metis equation.inject(1) valid_vars.simps(1))+\n      then show ?case \n        using are_congruent_transitive1 transitive1 by blast\n    next\n      case (transitive2 a\\<^sub>1 a\\<^sub>2 b c)\n      then show ?case \n        using CC_representativeE_valid_vars are_congruent_transitive2 cc_list_invar_def by blast\n    next\n      case (transitive3 a\\<^sub>1 a\\<^sub>2 a b\\<^sub>1 b\\<^sub>2)\n      then show ?case \n        using CC_representativeE_valid_vars are_congruent_transitive3 cc_list_invar_def \n        by (metis (no_types, lifting) equation.distinct(1) valid_vars.simps)\n    next\n      case (monotonic a\\<^sub>1 a\\<^sub>2 a b)\n      then have valid_vars1: \"valid_vars (a \\<approx> b) (nr_vars cc)\"  \n        \"valid_vars (F a\\<^sub>1 a\\<^sub>2 \\<approx> a) (nr_vars cc)\" \"valid_vars (F a\\<^sub>1 a\\<^sub>2 \\<approx> b) (nr_vars cc)\" \n        using monotonic CC_representativeE_valid_vars by blast+\n      with monotonic have \"are_congruent cc (F a\\<^sub>1 a\\<^sub>2 \\<approx> a)\" \n        \"are_congruent cc (F a\\<^sub>1 a\\<^sub>2 \\<approx> b)\"\n        by auto\n      with monotonic are_congruent_monotonic show ?case \n        using cc_list_invar_def valid_vars1 by blast\n    qed\n  next\n    assume are_congruent: \"are_congruent cc eq\"\n    show \"eq \\<in> Congruence_Closure (representativeE cc)\"\n    proof(cases eq)\n      case (Constants x11 x12)\n      with are_congruent have \"rep_of (cc_list cc) x11 = rep_of (cc_list cc) x12\"\n        using congruence_closure.cases\n        by (metis are_congruent.simps(1) congruence_closure.select_convs(1) mem_Collect_eq)\n      have \"(x11 \\<approx> rep_of (cc_list cc) x11) \\<in> Congruence_Closure (representativeE cc)\"\n        using Constants a_eq_rep_of_a_in_CC(1) assms(1) valid_vars.simps(1) by blast\n      moreover have \"(rep_of (cc_list cc) x12 \\<approx> x12) \\<in> Congruence_Closure (representativeE cc)\"\n        using Constants a_eq_rep_of_a_in_CC(2) assms(1) valid_vars.simps(1) by blast\n      ultimately show ?thesis \n        by (metis Constants \\<open>rep_of (cc_list cc) x11 = rep_of (cc_list cc) x12\\<close> transitive1)\n    next\n      case (Function x21 x22 x23)\n      then obtain b\\<^sub>1 b\\<^sub>2 b where \n        \"(t ! rep_of l x21) ! rep_of l x22 = Some (F b\\<^sub>1 b\\<^sub>2 \\<approx> b)\" \n        \"rep_of l x23 = rep_of l b\"\n        using are_congruent congruence_closure.cases assms\n        by (metis are_congruent_Function cc cc_list_invar_def congruence_closure.select_convs(1))\n      then have \"rep_of l x21 < nr_vars cc \\<and> rep_of l x22 < nr_vars cc \\<and> b < nr_vars cc \\<and>\n                      cc_list cc ! rep_of l x21 = rep_of l x21 \n\\<and> cc_list cc ! rep_of l x22 = rep_of l x22 \n\\<and> lookup cc ! rep_of l x21 ! rep_of l x22 = Some (F b\\<^sub>1 b\\<^sub>2 \\<approx> b)\" \n        by (metis Function assms(1) assms(2) cc cc_list_invar_def congruence_closure.select_convs(1) congruence_closure.select_convs(3) lookup_invar_less_n(3) rep_of_bound rep_of_min valid_vars.simps(2))\n      then have F_rep: \"(F (rep_of l x21) (rep_of l x22) \\<approx> (rep_of l b)) \\<in> representativeE cc\"  \n        unfolding representativeE_def \n        by (simp add: cc)\n      have \"(rep_of l x21 \\<approx> x21) \\<in> Congruence_Closure (representativeE cc)\" \n        \"(rep_of l x22 \\<approx> x22) \\<in> Congruence_Closure (representativeE cc)\" \n        by (metis Function a_eq_rep_of_a_in_CC(2) assms(1) cc congruence_closure.select_convs(1) valid_vars.simps(2))+\n      then have \"(F x21 x22 \\<approx> rep_of l b) \\<in> Congruence_Closure (representativeE cc)\" \n        by (metis F_rep base transitive3)\n      with Function show ?thesis \n        by (metis \\<open>rep_of l x23 = rep_of l b\\<close> a_eq_rep_of_a_in_CC(2) assms(1) cc congruence_closure.select_convs(1) transitive2 valid_vars.simps(2))\n    qed\n  qed\n  finally show ?thesis .\nqed\n\nend ", "meta": {"author": "reb-ddm", "repo": "congruence-closure-isabelle", "sha": "fcc4964ff2d19fbea4da76029bb0619f84bac724", "save_path": "github-repos/isabelle/reb-ddm-congruence-closure-isabelle", "path": "github-repos/isabelle/reb-ddm-congruence-closure-isabelle/congruence-closure-isabelle-fcc4964ff2d19fbea4da76029bb0619f84bac724/Congruence_Closure_Explain/CC_Correctness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.6076631698328916, "lm_q1q2_score": 0.33927475118110456}}
{"text": "theory Indep_Vars\nimports Main Refine_Util Mpat_Antiquot\nbegin\n\ndefinition [simp]: \"INDEP v \\<equiv> True\"\nlemma INDEPI: \"INDEP v\" by simp\n\nML \\<open>\n  signature INDEP_VARS = sig\n    val indep_tac: Proof.context -> tactic'\n  end\n\n  structure Indep_Vars: INDEP_VARS = struct\n\n    local\n      fun vsubterms (Abs (_,_,t)) = vsubterms t\n        | vsubterms (t as (_$_)) = let\n            val (f,args) = strip_comb t\n            val args_vsts = map vsubterms args |> flat\n          in\n            case f of\n              (Var (name,vT)) => [(name,vT,fastype_of t,args)]@args_vsts\n            | _ => vsubterms f @ args_vsts\n          end\n        | vsubterms _ = []\n\n      fun indep_vars ctxt t st = let\n        val cert = Thm.cterm_of ctxt\n\n        fun inst_of (name,vT,T,args) = let\n          val Ts = map fastype_of args |> rev\n          val t' = fold absdummy Ts (Var (name,T))\n          val inst = ((name, vT), cert t')\n        in inst end\n\n        val inst = vsubterms t\n          |> distinct ((op =) o apply2 #1)\n          |> map inst_of\n\n        val st' = Drule.instantiate_normalize (TVars.empty, Vars.make inst) st\n          |> Conv.fconv_rule (Thm.beta_conversion true)\n      in\n        Seq.single st'\n      end\n\n      fun indep_tac_aux ctxt i st = case Logic.concl_of_goal (Thm.prop_of st) i of\n        @{mpat \"Trueprop (INDEP ?v)\"}\n          => (indep_vars ctxt v THEN resolve_tac ctxt @{thms INDEPI} i) st\n      | _ => Seq.empty\n\n    in\n      (* Remove explicit parameters from schematic variable. *)\n      fun indep_tac ctxt = IF_EXGOAL\n        (CONVERSION Thm.eta_conversion THEN' indep_tac_aux ctxt)\n    end\n  end\n\\<close>\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Automatic_Refinement/Lib/Indep_Vars.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631556226292, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.33927474324713147}}
{"text": "theory flash52Bra  imports flash52Rev\n \n  begin\nlemma onInv52:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv52  iInv1  iInv2  iInv3 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX1VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_GetXVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ShWbVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX7VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak2VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX5VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_WbVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_GetVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceShrVldVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_2VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak2VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_ReplaceVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_HomeVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put2VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX11VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX6VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put2VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1_HomeVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak1VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak1VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak2VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak3VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX2VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put1VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutXVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis StoreVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_FAckVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX3VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutXVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put1VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis StoreHomeVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_NakVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_PutXVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX4VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_NakVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak1VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_ClearVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_PutXVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak3VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX9VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetXVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put3VsInv52 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash52Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056040203135, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.339268040184655}}
{"text": "theory flash45Bra  imports flash45Rev\n \n  begin\nlemma onInv45:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv45 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv45 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv45 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash45Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7549149758396752, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.33925322978949196}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* Author: Andrew Boyton, 2012\n   Maintainers: Gerwin Klein <kleing at cse.unsw.edu.au>\n                Rafal Kolanski <rafal.kolanski at nicta.com.au>\n*)\n\nchapter \"Defining some separation logic maps-to predicates on top of the instantiation.\"\n\ntheory Separation_D\nimports Abstract_Separation_D\nbegin\n\ntype_synonym sep_pred = \"sep_state \\<Rightarrow> bool\"\n\ndefinition\n  state_sep_projection :: \"cdl_state \\<Rightarrow> sep_state\"\nwhere\n  \"state_sep_projection \\<equiv> \\<lambda>s. SepState (cdl_objects s) (cdl_ghost_state s)\"\n\n(* This turns a separation logic predicate into a predicate on the capDL state. *)\nabbreviation\n  lift' :: \"(sep_state \\<Rightarrow> 'a) \\<Rightarrow> cdl_state \\<Rightarrow> 'a\" (\"<_>\")\nwhere\n  \"<P> s \\<equiv> P (state_sep_projection s)\"\n\n(* The generalisation of the maps to operator for separation logic. *)\ndefinition\n  sep_map_general :: \"cdl_object_id \\<Rightarrow> cdl_object \\<Rightarrow> cdl_components \\<Rightarrow> sep_pred\"\nwhere\n  \"sep_map_general p obj gs \\<equiv> \\<lambda>s. sep_heap s = [p \\<mapsto> obj] \\<and> sep_ghost_state s p = gs\"\n\n(* Alternate definition without the [p \\<mapsto> obj] notation. *)\nlemma sep_map_general_def2:\n  \"sep_map_general p obj gs s =\n   (dom (sep_heap s) = {p} \\<and> ko_at obj p (sep_heap s) \\<and> sep_ghost_state s p = gs)\"\n  apply (clarsimp simp: sep_map_general_def object_at_def)\n  apply (rule)\n   apply clarsimp\n  apply (clarsimp simp: fun_upd_def)\n  apply (rule ext)\n  apply (fastforce simp: dom_def split:if_split)\n  done\n\n(* There is an object there. *)\ndefinition\n  sep_map_i :: \"cdl_object_id \\<Rightarrow> cdl_object \\<Rightarrow> sep_pred\" (\"_ \\<mapsto>i _\" [76,71] 76)\nwhere\n  \"p \\<mapsto>i obj \\<equiv> sep_map_general p obj UNIV\"\n\n(* The fields are there (and there are no caps). *)\ndefinition\n  sep_map_f :: \"cdl_object_id \\<Rightarrow> cdl_object \\<Rightarrow> sep_pred\" (\"_ \\<mapsto>f _\" [76,71] 76)\nwhere\n  \"p \\<mapsto>f obj \\<equiv> sep_map_general p (update_slots Map.empty obj) {None}\"\n\n(* There is that cap there. *)\ndefinition\n  sep_map_c :: \"cdl_cap_ref \\<Rightarrow> cdl_cap \\<Rightarrow> sep_pred\" (\"_ \\<mapsto>c _\" [76,71] 76)\nwhere\n  \"p \\<mapsto>c cap \\<equiv> \\<lambda>s. let (obj_id, slot) = p; heap = sep_heap s in\n  \\<exists>obj. sep_map_general obj_id obj {Some slot} s \\<and> object_slots obj = [slot \\<mapsto> cap]\"\n\ndefinition\n  sep_any :: \"('a \\<Rightarrow> 'b \\<Rightarrow> sep_pred) \\<Rightarrow> ('a \\<Rightarrow> sep_pred)\" where\n  \"sep_any m \\<equiv> (\\<lambda>p s. \\<exists>v. (m p v) s)\"\n\nabbreviation \"sep_any_map_i \\<equiv> sep_any sep_map_i\"\nnotation sep_any_map_i (\"_ \\<mapsto>i -\" 76)\n\nabbreviation \"sep_any_map_c \\<equiv> sep_any sep_map_c\"\nnotation sep_any_map_c (\"_ \\<mapsto>c -\" 76)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/sep_algebra/ex/capDL/Separation_D.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850278370112, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.3391146571611324}}
{"text": "(*  Title:      HOL/Auth/n_mutualEx_lemma_inv__2_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_inv__2_on_rules imports n_mutualEx_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0. p__Inv0\\<le>N\\<and>f=inv__2  p__Inv0)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_TryVsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_CritVsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_ExitVsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_IdleVsinv__2) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualEx/n_mutualEx_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.7057850278370111, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.33911465716113237}}
{"text": "(*<*)\ntheory Compositional_Reasoning\nimports BD_Security_Unwinding\nbegin\n(*>*)\n\nsection \\<open>Compositional Reasoning\\<close>\n\ntext \\<open>This section formalizes the compositional unwinding method discussed in\n\\<^cite>\\<open>\\<open>Section 5.2\\<close> in \"cocon-CAV2014\"\\<close>\\<close>\n\ncontext BD_Security_IO begin\n\n\nsubsection\\<open>Preliminaries\\<close>\n\ndefinition \"disjAll \\<Delta>s s vl s1 vl1 \\<equiv> (\\<exists>\\<Delta> \\<in> \\<Delta>s. \\<Delta> s vl s1 vl1)\"\n\nlemma disjAll_simps[simp]:\n  \"disjAll {} \\<equiv> \\<lambda>_ _ _ _. False\"\n  \"disjAll (insert \\<Delta> \\<Delta>s) \\<equiv> \\<lambda>s vl s1 vl1. \\<Delta> s vl s1 vl1 \\<or> disjAll \\<Delta>s s vl s1 vl1\"\n  unfolding disjAll_def[abs_def] by auto\n\nlemma disjAll_mono:\nassumes \"disjAll \\<Delta>s s vl s1 vl1\"\nand \"\\<Delta>s \\<subseteq> \\<Delta>s'\"\nshows \"disjAll \\<Delta>s' s vl s1 vl1\"\nusing assms unfolding disjAll_def by auto\n\nlemma iaction_mono:\nassumes 1: \"iaction \\<Delta> s vl s1 vl1\" and 2: \"\\<And> s vl s1 vl1. \\<Delta> s vl s1 vl1 \\<Longrightarrow> \\<Delta>' s vl s1 vl1\"\nshows \"iaction \\<Delta>' s vl s1 vl1\"\nusing assms unfolding iaction_def by fastforce\n\nlemma match_mono:\nassumes 1: \"match \\<Delta> s s1 vl1 a ou s' vl'\" and 2: \"\\<And> s vl s1 vl1. \\<Delta> s vl s1 vl1 \\<Longrightarrow> \\<Delta>' s vl s1 vl1\"\nshows \"match \\<Delta>' s s1 vl1 a ou s' vl'\"\nusing assms unfolding match_def by fastforce\n\nlemma ignore_mono:\nassumes 1: \"ignore \\<Delta> s s1 vl1 a ou s' vl'\" and 2: \"\\<And> s vl s1 vl1. \\<Delta> s vl s1 vl1 \\<Longrightarrow> \\<Delta>' s vl s1 vl1\"\nshows \"ignore \\<Delta>' s s1 vl1 a ou s' vl'\"\nusing assms unfolding ignore_def by auto\n\nlemma reaction_mono:\nassumes 1: \"reaction \\<Delta> s vl s1 vl1\" and 2: \"\\<And> s vl s1 vl1. \\<Delta> s vl s1 vl1 \\<Longrightarrow> \\<Delta>' s vl s1 vl1\"\nshows \"reaction \\<Delta>' s vl s1 vl1\"\nproof\n  fix a ou s' vl'\n  assume \"step s a = (ou, s')\" and \"\\<not> T (Trans s a ou s')\" and \"consume (Trans s a ou s') vl vl'\"\n  hence \"match \\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore \\<Delta> s s1 vl1 a ou s' vl'\" (is \"?m \\<or> ?i\")\n  using 1 unfolding reaction_def by auto\n  thus \"match \\<Delta>' s s1 vl1 a ou s' vl' \\<or> ignore \\<Delta>' s s1 vl1 a ou s' vl'\" (is \"?m' \\<or> ?i'\")\n  proof\n    assume ?m from match_mono[OF this 2] show ?thesis by simp\n  next\n    assume ?i from ignore_mono[OF this 2] show ?thesis by simp\n  qed\nqed\n\n\nsubsection\\<open>Decomposition into an arbitrary network of components\\<close>\n\n(* Unwind not to itself, but to a disjunction of other relations: *)\ndefinition unwind_to where\n\"unwind_to \\<Delta> \\<Delta>s \\<equiv>\n \\<forall> s vl s1 vl1.\n   reachNT s \\<and> reach s1 \\<and> \\<Delta> s vl s1 vl1\n   \\<longrightarrow>\n   vl \\<noteq> [] \\<and> exit s (hd vl)\n   \\<or>\n   iaction (disjAll \\<Delta>s) s vl s1 vl1\n   \\<or>\n   (vl \\<noteq> [] \\<or> vl1 = []) \\<and> reaction (disjAll \\<Delta>s) s vl s1 vl1\"\n\nlemma unwind_toI[intro?]:\nassumes\n\"\\<And> s vl s1 vl1.\n   \\<lbrakk>reachNT s; reach s1; \\<Delta> s vl s1 vl1\\<rbrakk>\n   \\<Longrightarrow>\n   vl \\<noteq> [] \\<and> exit s (hd vl)\n   \\<or>\n   iaction (disjAll \\<Delta>s) s vl s1 vl1\n   \\<or>\n   (vl \\<noteq> [] \\<or> vl1 = []) \\<and> reaction (disjAll \\<Delta>s) s vl s1 vl1\"\nshows \"unwind_to \\<Delta> \\<Delta>s\"\nusing assms unfolding unwind_to_def by auto\n\n(* Decomposition: *)\nlemma unwind_dec:\nassumes ne: \"\\<And> \\<Delta>. \\<Delta> \\<in> \\<Delta>s \\<Longrightarrow> next \\<Delta> \\<subseteq> \\<Delta>s \\<and> unwind_to \\<Delta> (next \\<Delta>)\"\nshows \"unwind (disjAll \\<Delta>s)\" (is \"unwind ?\\<Delta>\")\nproof\n  fix s s1 :: 'state and vl vl1 :: \"'value list\"\n  assume r: \"reachNT s\" \"reach s1\" and \\<Delta>: \"?\\<Delta> s vl s1 vl1\"\n  then obtain \\<Delta> where \\<Delta>: \"\\<Delta> \\<in> \\<Delta>s\" and 2: \"\\<Delta> s vl s1 vl1\" unfolding disjAll_def by auto\n  let ?\\<Delta>s' = \"next \\<Delta>\"  let ?\\<Delta>' = \"disjAll ?\\<Delta>s'\"\n  have \"(vl \\<noteq> [] \\<and> exit s (hd vl)) \\<or>\n        iaction ?\\<Delta>' s vl s1 vl1 \\<or>\n        ((vl \\<noteq> [] \\<or> vl1 = []) \\<and> reaction ?\\<Delta>' s vl s1 vl1)\"\n  using 2 \\<Delta> ne r unfolding unwind_to_def by auto\n  moreover have \"\\<And> s vl s1 vl1. ?\\<Delta>' s vl s1 vl1 \\<Longrightarrow> ?\\<Delta> s vl s1 vl1\"\n  using ne[OF \\<Delta>] unfolding disjAll_def by auto\n  ultimately show\n       \"(vl \\<noteq> [] \\<and> exit s (hd vl)) \\<or>\n        iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl \\<noteq> [] \\<or> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\"\n  using iaction_mono[of ?\\<Delta>' _ _ _ _ ?\\<Delta>] reaction_mono[of ?\\<Delta>' _ _ _ _ ?\\<Delta>] by blast\nqed\n\nlemma init_dec:\nassumes \\<Delta>0: \"\\<Delta>0 \\<in> \\<Delta>s\"\nand i: \"\\<And> vl vl1. B vl vl1 \\<Longrightarrow> \\<Delta>0 istate vl istate vl1\"\nshows \"\\<forall> vl vl1. B vl vl1 \\<longrightarrow> disjAll \\<Delta>s istate vl istate vl1\"\nusing assms unfolding disjAll_def by auto\n\ntheorem unwind_dec_secure:\nassumes \\<Delta>0: \"\\<Delta>0 \\<in> \\<Delta>s\"\nand i: \"\\<And> vl vl1. B vl vl1 \\<Longrightarrow> \\<Delta>0 istate vl istate vl1\"\nand ne: \"\\<And> \\<Delta>. \\<Delta> \\<in> \\<Delta>s \\<Longrightarrow> next \\<Delta> \\<subseteq> \\<Delta>s \\<and> unwind_to \\<Delta> (next \\<Delta>)\"\nshows secure\nusing init_dec[OF \\<Delta>0 i] unwind_dec[OF ne] unwind_secure by metis\n\n\nsubsection\\<open>A customization for linear modular reasoning\\<close>\n\n(* The customization assumes that each component unwinds only into itself,\nits successor or an exit component.  *)\n\ndefinition unwind_cont where\n\"unwind_cont \\<Delta> \\<Delta>s \\<equiv>\n \\<forall> s vl s1 vl1.\n   reachNT s \\<and> reach s1 \\<and> \\<Delta> s vl s1 vl1\n   \\<longrightarrow>\n   iaction (disjAll \\<Delta>s) s vl s1 vl1\n   \\<or>\n   ((vl \\<noteq> [] \\<or> vl1 = []) \\<and> reaction (disjAll \\<Delta>s) s vl s1 vl1)\"\n\nlemma unwind_contI[intro?]:\nassumes\n\"\\<And> s vl s1 vl1.\n   \\<lbrakk>reachNT s; reach s1; \\<Delta> s vl s1 vl1\\<rbrakk>\n   \\<Longrightarrow>\n   iaction (disjAll \\<Delta>s) s vl s1 vl1\n   \\<or>\n   ((vl \\<noteq> [] \\<or> vl1 = []) \\<and> reaction (disjAll \\<Delta>s) s vl s1 vl1)\"\nshows \"unwind_cont \\<Delta> \\<Delta>s\"\nusing assms unfolding unwind_cont_def by auto\n\ndefinition unwind_exit where\n\"unwind_exit \\<Delta>e \\<equiv>\n \\<forall> s vl s1 vl1.\n   reachNT s \\<and> reach s1 \\<and> \\<Delta>e s vl s1 vl1\n   \\<longrightarrow>\n   vl \\<noteq> [] \\<and> exit s (hd vl)\"\n\nlemma unwind_exitI[intro?]:\nassumes\n\"\\<And> s vl s1 vl1.\n   \\<lbrakk>reachNT s; reach s1; \\<Delta>e s vl s1 vl1\\<rbrakk>\n   \\<Longrightarrow>\n   vl \\<noteq> [] \\<and> exit s (hd vl)\"\nshows \"unwind_exit \\<Delta>e\"\nusing assms unfolding unwind_exit_def by auto\n\nlemma unwind_cont_mono:\nassumes \\<Delta>s: \"unwind_cont \\<Delta> \\<Delta>s\"\nand \\<Delta>s': \"\\<Delta>s \\<subseteq> \\<Delta>s'\"\nshows \"unwind_cont \\<Delta> \\<Delta>s'\"\nusing \\<Delta>s disjAll_mono[OF _ \\<Delta>s'] unfolding unwind_cont_def\nby (auto intro!: iaction_mono[where \\<Delta> = \"disjAll \\<Delta>s\" and \\<Delta>' = \"disjAll \\<Delta>s'\"]\n                 reaction_mono[where \\<Delta> = \"disjAll \\<Delta>s\" and \\<Delta>' = \"disjAll \\<Delta>s'\"])\n\nfun allConsec :: \"'a list \\<Rightarrow> ('a * 'a) set\" where\n  \"allConsec [] = {}\"\n| \"allConsec [a] = {}\"\n| \"allConsec (a # b # as) = insert (a,b) (allConsec (b#as))\"\n\n\nlemma set_allConsec:\nassumes \"\\<Delta> \\<in> set \\<Delta>s'\" and \"\\<Delta>s = \\<Delta>s' ## \\<Delta>1\"\nshows \"\\<exists> \\<Delta>2. (\\<Delta>,\\<Delta>2) \\<in> allConsec \\<Delta>s\"\nusing assms proof (induction \\<Delta>s' arbitrary: \\<Delta>s)\n  case Nil thus ?case by auto\nnext\n  case (Cons \\<Delta>3 \\<Delta>s' \\<Delta>s)\n  show ?case proof(cases \"\\<Delta> = \\<Delta>3\")\n    case True\n    show ?thesis proof(cases \\<Delta>s')\n      case Nil\n      show ?thesis unfolding \\<open>\\<Delta>s = (\\<Delta>3 # \\<Delta>s') ## \\<Delta>1\\<close> Nil True by (rule exI[of _ \\<Delta>1]) simp\n    next\n      case (Cons \\<Delta>4 \\<Delta>s'')\n      show ?thesis unfolding \\<open>\\<Delta>s = (\\<Delta>3 # \\<Delta>s') ## \\<Delta>1\\<close> Cons True by (rule exI[of _ \\<Delta>4]) simp\n    qed\n  next\n    case False hence \"\\<Delta> \\<in> set \\<Delta>s'\" using Cons by auto\n    then obtain \\<Delta>2 where \"(\\<Delta>, \\<Delta>2) \\<in> allConsec (\\<Delta>s' ## \\<Delta>1)\" using Cons by auto\n    thus ?thesis unfolding \\<open>\\<Delta>s = (\\<Delta>3 # \\<Delta>s') ## \\<Delta>1\\<close> by (intro exI[of _ \\<Delta>2]) (cases \\<Delta>s', auto)\n  qed\nqed\n\nlemma allConsec_set:\nassumes \"(\\<Delta>1,\\<Delta>2) \\<in> allConsec \\<Delta>s\"\nshows \"\\<Delta>1 \\<in> set \\<Delta>s \\<and> \\<Delta>2 \\<in> set \\<Delta>s\"\nusing assms by (induct \\<Delta>s rule: allConsec.induct) auto\n\n(* Liniar decomposition: *)\ntheorem unwind_decomp_secure:\nassumes n: \"\\<Delta>s \\<noteq> []\"\nand i: \"\\<And> vl vl1. B vl vl1 \\<Longrightarrow> hd \\<Delta>s istate vl istate vl1\"\nand c: \"\\<And> \\<Delta>1 \\<Delta>2. (\\<Delta>1,\\<Delta>2) \\<in> allConsec \\<Delta>s \\<Longrightarrow> unwind_cont \\<Delta>1 {\\<Delta>1, \\<Delta>2, \\<Delta>e}\"\nand l: \"unwind_cont (last \\<Delta>s) {last \\<Delta>s, \\<Delta>e}\"\nand e: \"unwind_exit \\<Delta>e\"\nshows secure\nproof-\n  let ?\\<Delta>0 = \"hd \\<Delta>s\"  let ?\\<Delta>s = \"insert \\<Delta>e (set \\<Delta>s)\"\n  define \"next\" where \"next \\<Delta>1 =\n    (if \\<Delta>1 = \\<Delta>e then {}\n     else if \\<Delta>1 = last \\<Delta>s then {\\<Delta>1,\\<Delta>e}\n     else {\\<Delta>1,SOME \\<Delta>2. (\\<Delta>1,\\<Delta>2) \\<in> allConsec \\<Delta>s,\\<Delta>e})\" for \\<Delta>1\n  show ?thesis\n  proof(rule unwind_dec_secure)\n    show \"?\\<Delta>0 \\<in> ?\\<Delta>s\" using n by auto\n  next\n    fix vl vl1 assume \"B vl vl1\"\n    thus \"?\\<Delta>0 istate vl istate vl1\" by fact\n  next\n    fix \\<Delta>\n    assume 1: \"\\<Delta> \\<in> ?\\<Delta>s\" show \"next \\<Delta> \\<subseteq> ?\\<Delta>s \\<and> unwind_to \\<Delta> (next \\<Delta>)\"\n    proof-\n      {assume \"\\<Delta> = \\<Delta>e\"\n       hence ?thesis using e unfolding next_def unwind_exit_def unwind_to_def by auto\n      }\n      moreover\n      {assume \"\\<Delta> = last \\<Delta>s\" and \"\\<Delta> \\<noteq> \\<Delta>e\"\n       hence ?thesis using n l unfolding next_def unwind_cont_def unwind_to_def by simp\n      }\n      moreover\n      {assume 1: \"\\<Delta> \\<in> set \\<Delta>s\" and 2: \"\\<Delta> \\<noteq> last \\<Delta>s\" \"\\<Delta> \\<noteq> \\<Delta>e\"\n       then obtain \\<Delta>' \\<Delta>s' where \\<Delta>s: \"\\<Delta>s = \\<Delta>s' ## \\<Delta>'\" and \\<Delta>: \"\\<Delta> \\<in> set \\<Delta>s'\"\n       by (metis (no_types) append_Cons append_assoc in_set_conv_decomp last_snoc rev_exhaust)\n       have \"\\<exists> \\<Delta>2. (\\<Delta>, \\<Delta>2) \\<in> allConsec \\<Delta>s\" using set_allConsec[OF \\<Delta> \\<Delta>s] .\n       hence \"(\\<Delta>, SOME \\<Delta>2. (\\<Delta>, \\<Delta>2) \\<in> allConsec \\<Delta>s) \\<in> allConsec \\<Delta>s\" by (metis (lifting) someI_ex)\n       hence ?thesis using 1 2 c unfolding next_def unwind_cont_def unwind_to_def\n       by simp (metis (no_types) allConsec_set)\n      }\n      ultimately show ?thesis using 1 by blast\n    qed\n  qed\nqed\n\nsubsection\\<open>Instances\\<close>\n\ncorollary unwind_decomp3_secure:\nassumes\ni: \"\\<And> vl vl1. B vl vl1 \\<Longrightarrow> \\<Delta>1 istate vl istate vl1\"\nand c1: \"unwind_cont \\<Delta>1 {\\<Delta>1, \\<Delta>2, \\<Delta>e}\"\nand c2: \"unwind_cont \\<Delta>2 {\\<Delta>2, \\<Delta>3, \\<Delta>e}\"\nand l: \"unwind_cont \\<Delta>3 {\\<Delta>3, \\<Delta>e}\"\nand e: \"unwind_exit \\<Delta>e\"\nshows secure\napply(rule unwind_decomp_secure[of \"[\\<Delta>1, \\<Delta>2, \\<Delta>3]\" \\<Delta>e])\nusing assms by auto\n\ncorollary unwind_decomp4_secure:\nassumes\ni: \"\\<And> vl vl1. B vl vl1 \\<Longrightarrow> \\<Delta>1 istate vl istate vl1\"\nand c1: \"unwind_cont \\<Delta>1 {\\<Delta>1, \\<Delta>2, \\<Delta>e}\"\nand c2: \"unwind_cont \\<Delta>2 {\\<Delta>2, \\<Delta>3, \\<Delta>e}\"\nand c3: \"unwind_cont \\<Delta>3 {\\<Delta>3, \\<Delta>4, \\<Delta>e}\"\nand l: \"unwind_cont \\<Delta>4 {\\<Delta>4, \\<Delta>e}\"\nand e: \"unwind_exit \\<Delta>e\"\nshows secure\napply(rule unwind_decomp_secure[of \"[\\<Delta>1, \\<Delta>2, \\<Delta>3, \\<Delta>4]\" \\<Delta>e])\nusing assms by auto\n\ncorollary unwind_decomp5_secure:\nassumes\ni: \"\\<And> vl vl1. B vl vl1 \\<Longrightarrow> \\<Delta>1 istate vl istate vl1\"\nand c1: \"unwind_cont \\<Delta>1 {\\<Delta>1, \\<Delta>2, \\<Delta>e}\"\nand c2: \"unwind_cont \\<Delta>2 {\\<Delta>2, \\<Delta>3, \\<Delta>e}\"\nand c3: \"unwind_cont \\<Delta>3 {\\<Delta>3, \\<Delta>4, \\<Delta>e}\"\nand c4: \"unwind_cont \\<Delta>4 {\\<Delta>4, \\<Delta>5, \\<Delta>e}\"\nand l: \"unwind_cont \\<Delta>5 {\\<Delta>5, \\<Delta>e}\"\nand e: \"unwind_exit \\<Delta>e\"\nshows secure\napply(rule unwind_decomp_secure[of \"[\\<Delta>1, \\<Delta>2, \\<Delta>3, \\<Delta>4, \\<Delta>5]\" \\<Delta>e])\nusing assms by auto\n\n\n\nsubsection \\<open>A graph alternative presentation\\<close>\n\n(* This is more flexible for instantiation. *)\n\ntheorem unwind_decomp_secure_graph:\n  assumes n: \"\\<forall> \\<Delta> \\<in> Domain Gr. \\<exists> \\<Delta>s. \\<Delta>s \\<subseteq> Domain Gr \\<and> (\\<Delta>,\\<Delta>s) \\<in> Gr\"\n  and i: \"\\<Delta>0 \\<in> Domain Gr\" \"\\<And> vl vl1. B vl vl1 \\<Longrightarrow> \\<Delta>0 istate vl istate vl1\"\n  and c: \"\\<And> \\<Delta>. unwind_exit \\<Delta> \\<or> (\\<forall> \\<Delta>s. (\\<Delta>,\\<Delta>s) \\<in> Gr \\<longrightarrow> unwind_cont \\<Delta> \\<Delta>s)\"\n  shows secure\nproof -\n  let ?pr = \"\\<lambda> \\<Delta> \\<Delta>s. \\<Delta>s \\<subseteq> Domain Gr \\<and> (\\<Delta>,\\<Delta>s) \\<in> Gr\"\n  define \"next\" where \"next \\<Delta> = (SOME \\<Delta>s. ?pr \\<Delta> \\<Delta>s)\" for \\<Delta>\n  let ?\\<Delta>s = \"Domain Gr\"\n  show ?thesis\n  proof(rule unwind_dec_secure)\n    show \"\\<Delta>0 \\<in> ?\\<Delta>s\" using i by auto\n    fix vl vl1 assume \"B vl vl1\"\n    thus \"\\<Delta>0 istate vl istate vl1\" by fact\n  next\n    fix \\<Delta>\n    assume \"\\<Delta> \\<in> ?\\<Delta>s\"\n    hence \"?pr \\<Delta> (next \\<Delta>)\" using n someI_ex[of \"?pr \\<Delta>\"] unfolding next_def by auto\n    hence \"next \\<Delta> \\<subseteq> ?\\<Delta>s \\<and> (unwind_cont \\<Delta> (next \\<Delta>) \\<or> unwind_exit \\<Delta>)\" using c by auto\n    thus \"next \\<Delta> \\<subseteq> ?\\<Delta>s \\<and> unwind_to \\<Delta> (next \\<Delta>)\"\n      unfolding unwind_to_def unwind_exit_def unwind_cont_def\n      by blast\n  qed\nqed\n\n(*<*)\n\nend (* context BD_Security_IO_Aut *)\n\nend\n\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Bounded_Deducibility_Security/Compositional_Reasoning.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6477982315512489, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3390707763988884}}
{"text": "\\<^marker>\\<open>creator \"Johannes Hölzl\"\\<close>\ntheory verERT_Misc\n  imports \"Markov_Models.Markov_Models\" \"HOL-Library.Function_Algebras\"\nbegin\n\nlemma sup_continuous_apply2[order_continuous_intros]: \"sup_continuous (\\<lambda>f. f x y)\"\n  using sup_continuous_apply sup_continuous_applyD by fastforce\n\nlemma measurable_ident_subsets:\n  \"space M = space M' \\<Longrightarrow> sets M' \\<subseteq> sets M \\<Longrightarrow> (\\<lambda>x. x) \\<in> measurable M M'\"\n  by (metis measurable_id measurable_iff_sets subset_trans)\n\nlemma sets_stream_space_mono:\n  \"space N = space M \\<Longrightarrow> M \\<subseteq> N \\<Longrightarrow> sets (stream_space M) \\<subseteq> sets (stream_space N)\"\n  apply (rule sets_stream_space_in_sets)\n  apply (simp add: space_stream_space)\n  apply (rule measurable_compose[OF _ measurable_ident_subsets[of N]])\n  apply auto\n  done\n\nlemma measurable_case_stream[measurable (raw)]:\n  \"(\\<lambda>\\<omega>. f (shd \\<omega>) (stl \\<omega>)) \\<in> measurable M N \\<Longrightarrow> (\\<lambda>(x##\\<omega>) \\<Rightarrow> f x \\<omega>) \\<in> measurable M N\"\n  unfolding stream.case_eq_if .\n\nlemma measurable_cong_restrictI:\n  \"(\\<And>x. x \\<in> space (restrict_space M X) \\<Longrightarrow> f x = f' x) \\<Longrightarrow> f' \\<in> M \\<rightarrow>\\<^sub>M N \\<Longrightarrow> f \\<in> measurable (restrict_space M X) N\"\n  apply (subst measurable_cong)\n  apply (simp add: space_restrict_space)\n  apply (rule measurable_restrict_space1)\n  apply assumption\n  done\n\nlemma countable_lfp: \\<comment> \\<open>from lochbihler2016esop\\<close>\n  assumes step: \"\\<And>Y. countable Y \\<Longrightarrow> countable (F Y)\"\n  and cont: \"Order_Continuity.sup_continuous F\"\n  shows \"countable (lfp F)\"\nby(subst sup_continuous_lfp[OF cont])(simp add: countable_funpow[OF step])\n\nlemma lfp_Collect: assumes F: \"mono F\" shows \"{x. lfp F x} = lfp (\\<lambda>X. {x. F (\\<lambda>x. x \\<in> X) x})\"\nproof (subst lfp_rolling[of Collect, symmetric]; clarsimp simp: mono_def)\n  show \"X \\<subseteq> Y \\<Longrightarrow> F (\\<lambda>x. x \\<in> X) x \\<Longrightarrow> F (\\<lambda>x. x \\<in> Y) x\" for X Y x\n    using monoD[OF F, of \"\\<lambda>x. x \\<in> X\" \"\\<lambda>x. x \\<in> Y\"] by (auto simp: le_fun_def)\nqed auto\n\nlemma countable_lfp_apply:\n  assumes step: \"\\<And>Y x. (\\<And>x. countable (Y x)) \\<Longrightarrow> countable (F Y x)\"\n  and cont: \"Order_Continuity.sup_continuous F\"\n  shows \"countable (lfp F x)\"\nproof -\n  { fix n\n    have \"\\<And>x. countable ((F ^^ n) bot x)\"\n      by(induct n)(auto intro: step) }\n  thus ?thesis using cont by(simp add: sup_continuous_lfp)\nqed\n\nlemma nn_integral_enat':\n  fixes f :: \"'a \\<Rightarrow> enat\"\n  assumes [measurable]: \"f \\<in> M \\<rightarrow>\\<^sub>M count_space UNIV\"\n  shows \"(\\<integral>\\<^sup>+x. ennreal_of_enat (f x) \\<partial>M) =\n    \\<infinity> * emeasure M {\\<omega>\\<in>space M. f \\<omega> = \\<infinity>} + (\\<Sum>i. i * emeasure M {\\<omega>\\<in>space M. f \\<omega> = i})\"\nproof -\n  have \"(\\<integral>\\<^sup>+x. ennreal_of_enat (f x) \\<partial>M) =\n    (\\<integral>\\<^sup>+x. \\<infinity> * indicator {\\<omega>\\<in>space M. f \\<omega> = \\<infinity>} x + (\\<Sum>i. of_nat i * indicator {\\<omega>\\<in>space M. f \\<omega> = i} x) \\<partial>M)\"\n    apply (intro nn_integral_cong)\n    subgoal for x\n      by (auto split: split_indicator intro!: suminf_cmult_indicator[symmetric] simp: disjoint_family_on_def)\n    done\n  also have \"\\<dots> = \\<infinity> * emeasure M {\\<omega>\\<in>space M. f \\<omega> = \\<infinity>} + (\\<Sum>i. of_nat i * emeasure M {\\<omega>\\<in>space M. f \\<omega> = i})\"\n    by (simp add: nn_integral_cmult_indicator nn_integral_add nn_integral_suminf suminf_0_le\n             del: ereal_infty_mult)+\n  finally show ?thesis .\nqed\n\n(* TODO: fix proof\nlemma (in sigma_finite_measure) nn_integral_enat: \\<comment> \\<open>requirement of sigma-finite measures could be removed\\<close>\n  assumes [measurable]: \"f \\<in> M \\<rightarrow>\\<^sub>M count_space UNIV\"\n  shows \"(\\<integral>\\<^sup>+x. ennreal_of_enat (f x) \\<partial>M) = (\\<integral>\\<^sup>+x. ennreal_of_enat x * emeasure M {\\<omega>\\<in>space M. f \\<omega> = x} \\<partial>count_space UNIV)\"\nproof -\n  interpret sigma_finite_measure \"count_space (UNIV::enat set)\"\n    by (rule sigma_finite_measure_count_space)\n  interpret EM: pair_sigma_finite \"count_space (UNIV::enat set)\" M\n    proof qed\n\n  have \"(\\<integral>\\<^sup>+x. ennreal_of_enat (f x) \\<partial>M) =\n    (\\<integral>\\<^sup>+x. \\<integral>\\<^sup>+n. ennreal_of_enat n * indicator {\\<omega>\\<in>space M. f \\<omega> = n} x \\<partial>count_space UNIV \\<partial>M)\"\n    apply (intro nn_integral_cong)\n    subgoal for x\n      by (subst nn_integral_count_space'[where A=\"{f x}\"]) auto\n    done\n  also have \"\\<dots> = (\\<integral>\\<^sup>+n. \\<integral>\\<^sup>+x. ennreal_of_enat n * indicator {\\<omega>\\<in>space M. f \\<omega> = n} x \\<partial>M \\<partial>count_space UNIV)\"\n    apply (rule EM.Fubini') (* apply auto *) sorry\n  also have \"\\<dots> = (\\<integral>\\<^sup>+n. ennreal_of_enat n * emeasure M {\\<omega>\\<in>space M. f \\<omega> = n} \\<partial>count_space UNIV)\"\n    by (intro nn_integral_cong nn_integral_cmult_indicator) auto\n  finally show ?thesis .\nqed\n*)\n\nlemma sfirst_eq_infty: \"alw (not P) \\<omega> \\<Longrightarrow> sfirst P \\<omega> = \\<infinity>\"\n  by (metis (full_types) enat_ord_simps(4) not_alw_not sfirst_finite)\n\nlemma sup_continuous_sfirstF: \"sup_continuous (\\<lambda>F \\<omega>. if P \\<omega> then 0 else eSuc (F (stl \\<omega>)))\"\n  by (intro order_continuous_intros sup_continuous_eSuc)\n\nlemma sfirst_eq_lfp:\n  fixes P :: \"'a stream \\<Rightarrow> bool\"\n  defines \"F \\<equiv> \\<lambda>F \\<omega>. if P \\<omega> then 0 else eSuc (F (stl \\<omega>))\"\n  shows \"sfirst P \\<omega> = lfp F \\<omega>\"\nproof -\n  have \"mono F\"\n    by (auto simp: F_def mono_def le_fun_def)\n  have F: \"lfp F = (\\<lambda>\\<omega>. if P \\<omega> then 0 else eSuc ((lfp F) (stl \\<omega>)))\"\n    by (subst lfp_unfold[OF \\<open>mono F\\<close>]) (auto simp: F_def)\n\n  show ?thesis\n  proof cases\n    assume \"ev P \\<omega>\"\n    then show \"sfirst P \\<omega> = lfp F \\<omega>\"\n    proof (induction rule: ev_induct_strong)\n      case (base \\<omega>) then show ?case\n        by (subst F) auto\n    next\n      case (step \\<omega>) then show ?case\n        by (subst F) auto\n    qed\n  next\n    assume \"\\<not> ev P \\<omega>\"\n    then have \"alw (not P) \\<omega>\"\n      unfolding not_ev_iff .\n    moreover then have \"enat i \\<le> lfp F \\<omega>\" for i\n    proof (induction i arbitrary: \\<omega>)\n      case 0 then show ?case\n        by (simp add: enat_0)\n    next\n      case (Suc i) from Suc.IH[of \"stl \\<omega>\"] Suc.prems show ?case\n        by (subst F) (auto simp: eSuc_enat[symmetric])\n    qed\n    then have \"lfp F \\<omega> = \\<infinity>\"\n      by (metis eSuc_eq_infinity_iff enat_the_enat iless_Suc_eq less_irrefl)\n    ultimately show ?thesis\n      by (simp add: sfirst_eq_infty)\n  qed\nqed\n\nlemma sfirst_translate:\n  \"inj f \\<Longrightarrow> sfirst P (smap f \\<omega>) = sfirst (\\<lambda>x. P (smap f x)) \\<omega>\"\n  unfolding sfirst_eq_lfp\n  by (rule lfp_transfer[where \\<alpha>=\"\\<lambda>F \\<omega>. F (smap f \\<omega>)\", unfolded fun_eq_iff, rule_format])\n     (auto intro!: order_continuous_intros sup_continuous_eSuc sup_continuous_mono simp: le_fun_def)\n\nlemma sup_continuous_ennreal_of_enat[order_continuous_intros]:\n  \"sup_continuous f \\<Longrightarrow> sup_continuous (\\<lambda>i. ennreal_of_enat (f i))\"\n  by (rule sup_continuous_compose[of ennreal_of_enat])\n     (auto simp: sup_continuous_def ennreal_of_enat_Sup SUP_image)\n\nlemma (in MC_syntax) sfirst_lfp:\n  \"(\\<integral>\\<^sup>+\\<omega>. sfirst (HLD Y) \\<omega> \\<partial>T x) = lfp (\\<lambda>F x. \\<integral>\\<^sup>+y. (F y + 1) * indicator (-Y) y \\<partial>K x) x\"\n  unfolding sfirst_eq_lfp\n  apply (subst lfp_transfer[where \\<alpha>=\"\\<lambda>F \\<omega>. ennreal_of_enat (F \\<omega>)\" and g=\"\\<lambda>F \\<omega>. if HLD Y \\<omega> then 0 else F (stl \\<omega>) + 1\"])\n  apply (auto simp: bot_enat_def le_fun_def fun_eq_iff add.commute sup_absorb1\n              simp del: sup_ereal_def\n              intro!: order_continuous_intros sup_continuous_mono sup_continuous_eSuc)\n  apply (rule nn_integral_lfp[where N=S])\n  apply (auto simp del: sup_ereal_def split: split_indicator\n              intro!: order_continuous_intros sup_continuous_eSuc)\n  apply (subst nn_integral_T)\n  apply simp\n  apply (rule nn_integral_cong)\n  apply (auto simp: nn_integral_add cong del: nn_integral_cong split: split_indicator)\n  done\n\nlemma borel_measurable_ennreal_of_enat[measurable]: \"ennreal_of_enat \\<in> count_space UNIV \\<rightarrow>\\<^sub>M borel\"\n  by (rule measurable_compose_countable'[where g=ennreal_of_enat and f=\"\\<lambda>i x. i\" and I=\"ennreal_of_enat ` UNIV\"])\n     auto\n\nlemma measurable_funpow [measurable]:\n  assumes [measurable]: \"\\<And>f. f \\<in> M \\<rightarrow>\\<^sub>M N \\<Longrightarrow> F f \\<in> M \\<rightarrow>\\<^sub>M N\"\n  assumes [measurable]: \"f \\<in> M \\<rightarrow>\\<^sub>M N\"\n  shows \"(F ^^ n) f \\<in> M \\<rightarrow>\\<^sub>M N\"\n  by (induction n) auto\n\nlemma integral_map_pmf:\n  fixes g :: \"'a \\<Rightarrow> 'b::{banach, second_countable_topology}\"\n  shows \"(LINT x | map_pmf f M. g x) = (LINT x | M. g (f x))\"\n  unfolding map_pmf_rep_eq by (subst integral_distr) auto\n\nlemma sfirst_eq_enatD: \"sfirst P \\<omega> = enat n \\<Longrightarrow> P (sdrop n \\<omega>)\"\n  apply (induction n arbitrary: \\<omega>)\n  apply (auto simp: enat_0 eSuc_enat[symmetric] sfirst_eq_0)\n  subgoal for n \\<omega>\n    by (cases \\<omega>) (simp add: sfirst_Stream split: if_split_asm)\n  done\n\nlemma sfirst_eq_eSuc: \"sfirst P \\<omega> = eSuc n \\<longleftrightarrow> (\\<not> P \\<omega> \\<and> sfirst P (stl \\<omega>) = n)\"\n  by (cases \\<omega>) (simp add: sfirst_Stream)\n\nlemma eSuc_le_sfirst_iff: \"eSuc n \\<le> sfirst P \\<omega>  \\<longleftrightarrow> (\\<not> P \\<omega> \\<and> n \\<le> sfirst P (stl \\<omega>))\"\n  by (cases \\<omega>) (simp add: sfirst_Stream)\n\nend\n", "meta": {"author": "maxhaslbeck", "repo": "verERT", "sha": "193188292620a60005e528a78247323eb53084bc", "save_path": "github-repos/isabelle/maxhaslbeck-verERT", "path": "github-repos/isabelle/maxhaslbeck-verERT/verERT-193188292620a60005e528a78247323eb53084bc/verERT_Misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.33907076928082247}}
{"text": "theory Gen_Cfg_Bisim\nimports Gen_Scheduler_Refine\nbegin\n\n  (* TODO: Move? *)\n  (* TODO: we should consistenly use relations here *)\n\n  subsection \\<open>Functional Relations\\<close>\n\n  definition \"build_relp \\<alpha> I x y \\<equiv> y=\\<alpha> x \\<and> I x\"\n  abbreviation \"brp \\<equiv> build_relp\"\n\n  lemma brp_right_unique[simp, intro!]: \"right_unique (brp \\<alpha> I)\"\n    apply (rule right_uniqueI)\n    unfolding build_relp_def\n    by auto\n\n  definition \"the_brp_\\<alpha> R \\<equiv> (\\<lambda>x. SOME y. R x y)\"\n  abbreviation (input) \"the_brp_invar \\<equiv> Domainp\"\n\n  lemma the_brp[simp]: \n    assumes \"right_unique R\"  \n    shows \"brp (the_brp_\\<alpha> R) (the_brp_invar R) = R\"\n      apply (rule sym)\n      apply (intro ext)\n      unfolding build_relp_def the_brp_\\<alpha>_def\n      apply auto\n      apply (metis assms right_uniqueD someI)\n      by (blast intro: someI)\n\n  lemma obtain_brp:\n    assumes \"right_unique R\"  \n    obtains \\<alpha> I where \"R=brp \\<alpha> I\"\n    using the_brp[OF assms, THEN sym] ..\n\n  lemma the_brp_brp[simp]: \n    \"I x \\<Longrightarrow> the_brp_\\<alpha> (brp \\<alpha> I) x = \\<alpha> x\"\n    \"the_brp_invar (brp \\<alpha> I) = I\"\n    unfolding the_brp_\\<alpha>_def build_relp_def[abs_def]\n    by (auto)\n\n  lemma brp_comp[simp]: \"brp \\<alpha>1 I1 OO brp \\<alpha>2 I2 = brp (\\<alpha>2 o \\<alpha>1) (\\<lambda>x. I1 x \\<and> I2 (\\<alpha>1 x))\"\n    unfolding build_relp_def[abs_def] by auto\n\n  lemma rel_of_pred_brp[simp]: \"rel_of_pred (brp \\<alpha> invar) = br \\<alpha> invar\"\n    unfolding build_relp_def[abs_def] build_rel_def by auto\n\n\n  lemma rel_option_add_simps[simp]: \n    \"rel_option R None c \\<longleftrightarrow> c=None\"\n    \"rel_option R d None \\<longleftrightarrow> d=None\"\n    apply (cases c, auto) []\n    apply (cases d, auto) []\n    done\n\n  lemma rel_option_Some_conv: \n    \"rel_option R (Some v) d \\<longleftrightarrow> (\\<exists>w. R v w \\<and> d = Some w)\"\n    \"rel_option R c (Some w) \\<longleftrightarrow> (\\<exists>v. R v w \\<and> c = Some v)\"\n    apply (cases d, auto)\n    apply (cases c, auto)\n    done\n\n  lemma rel_mset_plus_conv:\n    \"rel_mset R ({#a#}+m') n \\<longleftrightarrow> (\\<exists>b n'. n={#b#}+n' \\<and> R a b \\<and> rel_mset R m' n')\"  \n    \"rel_mset R m ({#b#}+n') \\<longleftrightarrow> (\\<exists>a m'. m={#a#}+m' \\<and> R a b \\<and> rel_mset R m' n')\"  \n    apply (auto simp: union_mset_add_mset_left)\n    apply (metis msed_rel_invL)\n    apply (metis rel_mset_Plus)\n    apply (metis msed_rel_invR)\n    apply (metis rel_mset_Plus)\n    done      \n\n  lemma rel_mset_brp: \n    \"rel_mset (brp \\<alpha> I) = brp (image_mset \\<alpha>) (\\<lambda>m. \\<forall>x. x:#m \\<longrightarrow> I x)\"\n  proof (intro ext iffI)\n    fix m m'\n    assume \"rel_mset (brp \\<alpha> I) m m'\"\n    thus \"brp (image_mset \\<alpha>) (\\<lambda>m. \\<forall>x. x:#m \\<longrightarrow> I x) m m'\"\n      apply (induction \"(brp \\<alpha> I)\" _ _ rule: rel_mset_induct)\n      apply (auto simp: build_relp_def)\n      done\n  next\n    fix m m'\n    assume \"brp (image_mset \\<alpha>) (\\<lambda>m. \\<forall>x. x \\<in># m \\<longrightarrow> I x) m m'\"\n    hence 1: \"m' = image_mset \\<alpha> m\" \n      and \"\\<forall>x. x \\<in># m \\<longrightarrow> I x\" by (auto simp: build_relp_def)\n    from this(2) show \"rel_mset (brp \\<alpha> I) m m'\"\n      unfolding 1\n      apply (induction m)\n      apply (simp add: rel_mset_Zero)\n      apply simp\n      apply (rule rel_mset_Plus)\n      apply (simp add: build_relp_def)\n      .\n  qed\n\n  locale Gen_Cfg_Bisim_Pre =\n    s1: Gen_Scheduler' cstep1 en ex\n  + s2: Gen_Scheduler' cstep2 en ex \n    for rel_c :: \"'c \\<Rightarrow> 'd \\<Rightarrow> bool\"\n    and cstep1 :: \"'c \\<Rightarrow> 'a \\<Rightarrow> 'c \\<Rightarrow> bool\"\n    and cstep2 :: \"'d \\<Rightarrow> 'a \\<Rightarrow> 'd \\<Rightarrow> bool\"\n    and en \n    and ex :: \"('ls\\<times>'gs) \\<Rightarrow> 'a \\<Rightarrow> ('ls\\<times>'gs)\" +\n    assumes csim1: \"\\<lbrakk>cstep1 c a c'; rel_c c d \\<rbrakk> \\<Longrightarrow> \\<exists>d'. rel_c c' d' \\<and> cstep2 d a d'\"\n    assumes csim2: \"\\<lbrakk>cstep2 d a d'; rel_c c d \\<rbrakk> \\<Longrightarrow> \\<exists>c'. rel_c c' d' \\<and> cstep1 c a c'\"\n  begin\n\n    (* TODO: we should consistenly use relations here *)\n    definition rel_lc :: \"('c,'ls) local_config \\<Rightarrow> ('d,'ls) local_config \\<Rightarrow> bool\"\n    where \"rel_lc lc ld \\<equiv> \n      rel_c (local_config.command lc) (local_config.command ld) \n    \\<and> local_config.state lc = local_config.state ld\"\n\n    definition rel_gc :: \"('c,'ls,'gs)global_config \\<Rightarrow> ('d,'ls,'gs)global_config \\<Rightarrow> bool\"\n    where \"rel_gc gc gd \\<equiv> \n      rel_mset rel_lc (global_config.processes gc) (global_config.processes gd)\n    \\<and> global_config.state gc = global_config.state gd\"\n\n    lemma gstep_sim1: \"\\<lbrakk>(c, c') \\<in> s1.gstep; rel_gc c d\\<rbrakk> \\<Longrightarrow> \\<exists>d'. rel_gc c' d' \\<and> (d, d') \\<in> s2.gstep\"\n      apply (cases c, simp_all)\n      apply (erule s1.gstep_succE)\n      apply (auto \n        simp: rel_option_Some_conv rel_gc_def rel_lc_def\n        simp: rel_mset_plus_conv \n        )\n      apply (drule (1) csim1, clarsimp)\n      apply (drule (3) s2.gstep_succI, force)\n      done\n\n    lemma gstep_sim2: \"\\<lbrakk>(d, d') \\<in> s2.gstep; rel_gc c d\\<rbrakk> \\<Longrightarrow> \\<exists>c'. rel_gc c' d' \\<and> (c, c') \\<in> s1.gstep\"\n      apply (cases d, simp_all)\n      apply (erule s2.gstep_succE)\n      apply (auto \n        simp: rel_option_Some_conv rel_gc_def rel_lc_def\n        simp: rel_mset_plus_conv\n        )\n      apply (drule (1) csim2, clarsimp)\n      apply (drule (1) s1.gstep_succI, simp_all, force) \n      done\n\n    lemma left_unique_rel_lcI:\n      assumes \"left_unique rel_c\"\n      shows \"left_unique rel_lc\"\n    proof (rule left_uniqueI)\n      fix lc1 lc2 lc3\n      assume \"rel_lc lc1 lc2\" \"rel_lc lc3 lc2\"\n      thus \"lc1=lc3\"\n        apply (cases lc1, cases lc2, cases lc3, simp_all)\n        apply (auto simp: rel_lc_def left_uniqueD[OF assms])\n        done\n    qed\n\n    lemma right_unique_rel_lcI:\n      assumes \"right_unique rel_c\"\n      shows \"right_unique rel_lc\"\n    proof (rule right_uniqueI)\n      fix lc1 lc2 lc3\n      assume \"rel_lc lc2 lc1\" \"rel_lc lc2 lc3\"\n      thus \"lc1=lc3\"\n        apply (cases lc1, cases lc2, cases lc3, simp_all)\n        apply (auto simp: rel_lc_def right_uniqueD[OF assms])\n        done\n    qed\n\n    lemma bi_unique_rel_lcI:\n      assumes \"bi_unique rel_c\"\n      shows \"bi_unique rel_lc\"\n      using assms \n      by (auto simp: bi_unique_alt_def right_unique_rel_lcI left_unique_rel_lcI)\n\n    lemma left_unique_rel_gcI:\n      assumes \"left_unique rel_c\"\n      shows \"left_unique rel_gc\"\n    proof (rule left_uniqueI)\n      note A = left_unique_rel_lcI[OF assms, THEN multiset.left_unique_rel]\n\n      fix gc1 gc2 gc3\n      assume \"rel_gc gc1 gc2\" \"rel_gc gc3 gc2\"\n      thus \"gc1=gc3\"\n        apply (cases gc1, cases gc2, cases gc3, simp_all)\n        apply (auto simp: rel_gc_def left_uniqueD[OF A])\n        done\n    qed\n\n    lemma right_unique_rel_gcI:\n      assumes \"right_unique rel_c\"\n      shows \"right_unique rel_gc\"\n    proof (rule right_uniqueI)\n      note A = right_unique_rel_lcI[OF assms, THEN multiset.right_unique_rel]\n\n      fix gc1 gc2 gc3\n      assume \"rel_gc gc1 gc2\" \"rel_gc gc1 gc3\"\n      thus \"gc2=gc3\"\n        apply (cases gc1, cases gc2, cases gc3, simp_all)\n        apply (auto simp: rel_gc_def right_uniqueD[OF A])\n        done\n    qed\n\n    lemma bi_unique_rel_gcI:\n      assumes \"bi_unique rel_c\"\n      shows \"bi_unique rel_gc\"\n      using assms \n      by (auto simp: bi_unique_alt_def right_unique_rel_gcI left_unique_rel_gcI)\n\n  end\n\n\n  locale Gen_Cfg_LBisim =\n    Gen_Cfg_Bisim_Pre rel_c cstep1 cstep2 en ex\n    for rel_c :: \"'c \\<Rightarrow> 'd \\<Rightarrow> bool\"\n    and cstep1 :: \"'c \\<Rightarrow> 'a \\<Rightarrow> 'c \\<Rightarrow> bool\"\n    and init1 :: \"('c,'ls,'gs)global_config set\"\n    and label1 :: \"('c,'ls,'gs)global_config \\<Rightarrow> 'l\"\n    and cstep2 :: \"'d \\<Rightarrow> 'a \\<Rightarrow> 'd \\<Rightarrow> bool\"\n    and init2 :: \"('d,'ls,'gs)global_config set\"\n    and label2 :: \"('d,'ls,'gs)global_config \\<Rightarrow> 'l\"\n    and en \n    and ex :: \"('ls\\<times>'gs) \\<Rightarrow> 'a \\<Rightarrow> ('ls\\<times>'gs)\" +\n    assumes init_sim1: \"\\<And>a0. a0 \\<in> init1 \\<Longrightarrow> \\<exists>b0. b0 \\<in> init2 \\<and> rel_gc a0 b0\"\n    assumes init_sim2: \"\\<And>b0. b0 \\<in> init2 \\<Longrightarrow> \\<exists>a0. a0 \\<in> init1 \\<and> rel_gc a0 b0\"\n    assumes labeling_consistent: \"\\<And>a b. rel_gc a b \\<Longrightarrow> label1 a = label2 b\"\n  begin\n\n    sublocale s1: Gen_Scheduler'_linit cstep1 en ex init1 label1 by this\n    sublocale s2: Gen_Scheduler'_linit cstep2 en ex init2 label2 by this\n\n    sublocale lbisimulation \"rel_of_pred rel_gc\" s1.system_automaton s2.system_automaton\n    proof -\n      interpret bisim:\n        lbisimulation \"rel_of_pred rel_gc\" s1.system_automaton' s2.system_automaton'\n        apply unfold_locales\n        apply simp_all\n        using init_sim1 apply force\n        using gstep_sim1 apply force\n        using labeling_consistent apply force\n        using init_sim2 apply force\n        using gstep_sim2 apply force\n        using labeling_consistent apply force\n        done\n      interpret bisim:\n        lbisimulation \"rel_of_pred rel_gc\" s1.system_automaton s2.system_automaton\n        unfolding s1.system_automaton_alt_def s2.system_automaton_alt_def\n        using bisim.lstutter_extend by this\n      show \"lbisimulation (rel_of_pred rel_gc) s1.system_automaton s2.system_automaton\"\n        by unfold_locales\n    qed\n\n  end    \n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/Refine/Gen_Cfg_Bisim.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3390707621627565}}
{"text": "chapter \\<open>Pre-built \\<phi>-Types\\<close>\n\ntheory Phi_Types\n  imports IDE_CP_Reasoning2\nbegin\n\nsection \\<open>Basics\\<close>\n\nsubsection \\<open>Syntax Sugars\\<close>\n\ntext \\<open>Sometimes, we do not want to verbosely write a semantic type if it is known syntactically.\n  We use syntax translation to achieve a sugar to do this.\n\nThis is a planning feature has not been implemented\\<close>\n\nsyntax TY_of_\\<phi> :: \\<open>('a,'b) \\<phi> \\<Rightarrow> TY\\<close> (\"TY'_of'_\\<phi>\")\n\nconsts \\<phi>coercion :: \\<open>('c1,'a) \\<phi> \\<Rightarrow> ('c2,'a) \\<phi>\\<close> (\"\\<coercion> _\" [61] 60)\n  \\<comment> \\<open>A syntax sugar to be overloaded!\\<close>\n\nsubsection \\<open>Identity\\<close>\n\ndefinition Identity :: \" ('a,'a) \\<phi> \" where \"Identity x = {x}\"\n\nlemma Identity_expn[\\<phi>expns]:\n  \"p \\<in> (x \\<Ztypecolon> Identity) \\<longleftrightarrow> p = x\"\n  unfolding \\<phi>Type_def Identity_def by auto\n\nlemma Identity_inhabited[elim!,\\<phi>inhabitance_rule]:\n  \\<open>Inhabited (x \\<Ztypecolon> Identity) \\<Longrightarrow> C \\<Longrightarrow> C\\<close> .\n\nlemma Identity_functional[\\<phi>reason 1000]:\n  \\<open>is_singleton (x \\<Ztypecolon> Identity)\\<close>\n  by (rule is_singletonI''; simp add: \\<phi>expns)\n\nlemma Identity_E[\\<phi>reason 10]:\n  \\<open>\\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> v \\<in> (x \\<Ztypecolon> T) \\<Longrightarrow> v \\<Ztypecolon> Identity \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> T\\<close>\n  unfolding Imply_def Premise_def by (simp add: \\<phi>expns)\n\n(*\n\nlemma [\\<phi>reason 1200]:\n  \\<open>is_functional (v \\<Ztypecolon> Identity)\\<close>\n  by (clarsimp simp add: Identity_expn)\n\nlemma satisfication_encoding:\n  \\<open> (x \\<Ztypecolon> Identity \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> T \\<a>\\<n>\\<d> P) \\<longleftrightarrow> x \\<in> (y \\<Ztypecolon> T) \\<and> P\\<close>\n  unfolding Imply_def Identity_expn by blast\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> v = v'\n\\<Longrightarrow> v \\<Ztypecolon> Identity \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> {v'}\\<close>\n  unfolding Imply_def Identity_expn Premise_def by simp\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> v = v'\n\\<Longrightarrow> {v'} \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> v \\<Ztypecolon> Identity\\<close>\n  unfolding Imply_def Identity_expn Premise_def by simp\n\n\nsubsection \\<open>Func\\<close>\n\ndefinition \\<phi>Fun :: \\<open>('a \\<Rightarrow> 'c) \\<Rightarrow> ('c,'a) \\<phi>\\<close>\n  where [\\<phi>defs]: \\<open>\\<phi>Fun f x = { f x }\\<close>\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> v = f x\n\\<Longrightarrow> v \\<Ztypecolon> Identity \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> \\<phi>Fun f\\<close>\n  \\<medium_left_bracket> construct\\<phi> \\<open>x \\<Ztypecolon> \\<phi>Fun f\\<close> \\<medium_right_bracket>. .\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> f x = y\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>Fun f \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Identity\\<close>\n  \\<medium_left_bracket> destruct\\<phi> _ \\<medium_right_bracket>. .\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> f x = y\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>Fun f \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Identity @action to Identity\\<close> \\<medium_left_bracket> \\<medium_right_bracket>. .\n\nlemma [\\<phi>reason 1200]:\n  \\<open>is_functional (x \\<Ztypecolon> \\<phi>Fun f)\\<close>\n  \\<medium_left_bracket> to Identity \\<medium_right_bracket>. .\n\n\nsubsection \\<open>Any\\<close>\n\ndefinition \\<phi>Any :: \\<open>('x, unit) \\<phi>\\<close>\n  where \\<open>\\<phi>Any = (\\<lambda>_. UNIV)\\<close>\n\nlemma \\<phi>Any_expns[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> \\<phi>Any)\\<close>\n  unfolding \\<phi>Any_def \\<phi>Type_def by simp\n\nlemma \\<phi>Any_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> \\<phi>Any) \\<Longrightarrow> C \\<Longrightarrow> C\\<close>\n  .\n\nlemma \\<phi>Any_cast [\\<phi>reason 1200]:\n  \\<open>X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> \\<phi>Any\\<close>\n  unfolding Imply_def by (simp add: \\<phi>expns)\n\n\n\nsubsection \\<open>Black Hole\\<close>\n\ntext \\<open>The system is a Classical Separation Logic.\n  For some situation like garbage collection, Intuitionistic Separation Logic can be more convenient.\n  Therefore, we employ a `Black Hole' which can contain arbitrary resources to simulate the\n    Intuitionistic Separation Logic\\<close>\n\nabbreviation Black_Hole :: \\<open>(FIC_N \\<Rightarrow> FIC) set\\<close>\n  where \\<open>Black_Hole \\<equiv> UNIV\\<close>\n\nlemma UNIV_subty [\\<phi>reason 1000]:\n  \\<open>X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> UNIV\\<close>\n  unfolding Imply_def by simp\n\n\nsubsection \\<open>Stepwise Abstraction\\<close>\n\ndefinition \\<phi>Composition :: \\<open>('v,'a) \\<phi> \\<Rightarrow> ('a,'b) \\<phi> \\<Rightarrow> ('v,'b) \\<phi>\\<close> (infixl \"\\<Zcomp>\" 30)\n  where [\\<phi>defs]: \\<open>\\<phi>Composition T U x = (y \\<Ztypecolon> T \\<s>\\<u>\\<b>\\<j> y. y \\<in> (x \\<Ztypecolon> U))\\<close>\n\nlemma [\\<phi>reason 1200]:\n  \\<open>x \\<Ztypecolon> T \\<Zcomp> U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> T \\<s>\\<u>\\<b>\\<j> y. y \\<in> (x \\<Ztypecolon> U) @action to RAW\\<close>\n  \\<medium_left_bracket> destruct\\<phi> _ \\<medium_right_bracket>. .\n\nlemma [\\<phi>reason 1200]:\n  \\<open> y \\<Ztypecolon> Identity \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> y \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> T \\<Zcomp> U \\<a>\\<n>\\<d> P\\<close>\n  \\<medium_left_bracket> premises Y[unfolded Imply_def Identity_expn, simplified, useful]\n    construct\\<phi> \\<open>x \\<Ztypecolon> T \\<Zcomp> U\\<close> \\<medium_right_bracket>. .\n\nlemma [\\<phi>reason 1200]:\n  \\<open> is_functional (x \\<Ztypecolon> U)\n\\<Longrightarrow> y \\<Ztypecolon> Identity \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> T \\<Zcomp> U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> T \\<a>\\<n>\\<d> P\\<close>\n  \\<medium_left_bracket> premises [unfolded is_functional_def, useful] and [unfolded satisfication_encoding, useful]\n    D \\<medium_right_bracket>. .\n\nlemma \\<phi>Composition_expn:\n  \\<open>p \\<in> (x \\<Ztypecolon> T \\<Zcomp> U) \\<longleftrightarrow> (\\<exists>y. p \\<in> (y \\<Ztypecolon> T) \\<and> y \\<in> (x \\<Ztypecolon> U))\\<close>\n  unfolding \\<phi>Composition_def \\<phi>Type_def by (simp add: \\<phi>expns)\n\nlemma \\<phi>Composition_inhabited[elim,\\<phi>inhabitance_rule]:\n  \\<open>Inhabited (x \\<Ztypecolon> T \\<Zcomp> U) \\<Longrightarrow> (\\<And>y. Inhabited (x \\<Ztypecolon> U) \\<Longrightarrow> Inhabited (y \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns \\<phi>Composition_expn) blast\n\nlemma [\\<phi>reason 1200 for \\<open>(_ \\<Ztypecolon> _ \\<Zcomp> _) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (_ \\<Ztypecolon> _ \\<Zcomp> _) \\<a>\\<n>\\<d> _\\<close>]:\n  \\<open> x1 \\<Ztypecolon> U1 \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x2 \\<Ztypecolon> U2 \\<a>\\<n>\\<d> P\n\\<Longrightarrow> (x1 \\<Ztypecolon> T \\<Zcomp> U1) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x2 \\<Ztypecolon> T \\<Zcomp> U2) \\<a>\\<n>\\<d> P\\<close>\n  unfolding \\<phi>Composition_expn Imply_def by blast\n\n\nsection \\<open>Logical Connectives\\<close>\n\nsubsection \\<open>Subjection as a Type\\<close>\n\ndefinition SubjectionTY :: \\<open>('a,'b) \\<phi> \\<Rightarrow> bool \\<Rightarrow> ('a,'b) \\<phi>\\<close> (infixl \"\\<phi>\\<s>\\<u>\\<b>\\<j>\" 25)\n  where \\<open> (T \\<phi>\\<s>\\<u>\\<b>\\<j> P) = (\\<lambda>x. x \\<Ztypecolon> T \\<s>\\<u>\\<b>\\<j> P) \\<close>\n\ntranslations \"TY_of_\\<phi> (T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\" \\<rightharpoonup> \"TY_of_\\<phi> T\"\n\nlemma SubjectionTY_expn[\\<phi>programming_simps, \\<phi>expns]:\n  \\<open>(x \\<Ztypecolon> T \\<phi>\\<s>\\<u>\\<b>\\<j> P) = (x \\<Ztypecolon> T \\<s>\\<u>\\<b>\\<j> P)\\<close>\n  unfolding set_eq_iff SubjectionTY_def \\<phi>Type_def by simp\n\nlemma SubjectionTY_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> T \\<phi>\\<s>\\<u>\\<b>\\<j> P) \\<Longrightarrow> (P \\<Longrightarrow> Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding SubjectionTY_expn using Subjection_inhabited .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> Rewrite_into_\\<phi>Type S (x \\<Ztypecolon> T)\n\\<Longrightarrow> Rewrite_into_\\<phi>Type (S \\<s>\\<u>\\<b>\\<j> P) (x \\<Ztypecolon> T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  unfolding Rewrite_into_\\<phi>Type_def by (simp add: SubjectionTY_expn)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> (\\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> P \\<Longrightarrow> is_functional (x \\<Ztypecolon> T))\n\\<Longrightarrow> is_functional (x \\<Ztypecolon> T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  \\<medium_left_bracket> premises [\\<phi>reason add] ;; \\<medium_right_bracket>. .\n\nsubsection \\<open>Existential Quantification as a Type\\<close>\n\ndefinition ExTyp :: \\<open>('c \\<Rightarrow> ('a, 'b) \\<phi>) \\<Rightarrow> ('a, 'c \\<Rightarrow> 'b)\\<phi>\\<close> (binder \"\\<exists>\\<phi>\" 10)\n  where \\<open>ExTyp T = (\\<lambda>x. (\\<exists>*c. x c \\<Ztypecolon> T c))\\<close>\n\nsyntax\n  \"_SetcomprPhiTy\" :: \"'a \\<Rightarrow> idts \\<Rightarrow> bool \\<Rightarrow> 'a set\"  (\"_ \\<phi>\\<s>\\<u>\\<b>\\<j>/ _./ _ \" [2,0,2] 2)\n  \"_SetcomprPhiTy'\" :: \"logic \\<Rightarrow> idts \\<Rightarrow> logic \\<Rightarrow> logic\"\n\nparse_ast_translation \\<open>\n  let open Ast\n    fun idts_to_abs x (Appl [Constant \"_idts\", a, b]) = Appl [Constant \"_abs\", a, idts_to_abs x b]\n      | idts_to_abs x c = Appl [Constant \"_abs\", c, x]\n    fun parse_SetcomprPhiTy ctxt [Appl [Constant \\<^const_syntax>\\<open>\\<phi>Type\\<close>, x, T],idts,P] =\n          Appl [Constant \\<^const_syntax>\\<open>\\<phi>Type\\<close>,\n                idts_to_abs x idts,\n                Appl [Constant \"\\<^const>Phi_Types.ExTyp_binder\", idts,\n                      (case P of (Appl [Constant \"_constrain\", Variable \"True\", _]) => T\n                               | _ => Appl [Constant \\<^const_name>\\<open>SubjectionTY\\<close>, T, P])]]\n      | parse_SetcomprPhiTy ctxt [X,idts,P] =\n          Appl [Constant \"\\<^const>Phi_Types.ExTyp_binder\", idts,\n                (case P of (Appl [Constant \"_constrain\", Variable \"True\", _]) => X\n                         | _ => Appl [Constant \\<^const_name>\\<open>SubjectionTY\\<close>, X, P])]\n  in [(\\<^syntax_const>\\<open>_SetcomprPhiTy\\<close>, parse_SetcomprPhiTy)] end\n\\<close>\n\n(* TODO\nterm \\<open>x \\<Ztypecolon> (X a) \\<phi>\\<s>\\<u>\\<b>\\<j> a b c. P a\\<close>\n\ntranslations\n  \" _SetcomprPhiTy' x idts X\" <= \"x \\<Ztypecolon> (\\<exists>\\<phi> idts. X)\"\n\nprint_ast_translation \\<open>\n  [(\\<^syntax_const>\\<open>_SetcomprPhiTy'\\<close>, (fn _ => fn x => hd (@{print} x)))]\n\\<close>\n\nterm \\<open>x \\<Ztypecolon> (X a) \\<phi>\\<s>\\<u>\\<b>\\<j> a b c. P a\\<close>\n\n*)\n\nlemma ExTyp_expn[\\<phi>expns,\\<phi>programming_simps]:\n  \\<open>(x \\<Ztypecolon> ExTyp T) = (\\<exists>*a. x a \\<Ztypecolon> T a)\\<close>\n  unfolding set_eq_iff ExTyp_def \\<phi>Type_def by (simp add: \\<phi>expns)\n\nlemma ExTyp_inhabited[elim!, \\<phi>inhabitance_rule]:\n  \\<open>Inhabited (x \\<Ztypecolon> ExTyp T) \\<Longrightarrow> (Inhabited (\\<exists>*a. x a \\<Ztypecolon> T a) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding ExTyp_expn .\n\n(* lemma [\\<phi>reason 1000]:\n  \\<open> P @action \\<A>nap (\\<A>_structural (to Identity))\n\\<Longrightarrow> P @action \\<A>nap (to Identity)\\<close>\n  unfolding Action_Tag_def . *)\n\nlemma Action_to_Identity[\\<phi>reason 30]:\n  \\<open>X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (v \\<Ztypecolon> Identity \\<phi>\\<s>\\<u>\\<b>\\<j> v. v \\<in> X) @action to Identity\\<close>\n  unfolding Action_Tag_def Imply_def by (simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1000]:\n  \\<open> (\\<And>a. Rewrite_into_\\<phi>Type (S a) (x a \\<Ztypecolon> T a))\n\\<Longrightarrow> Rewrite_into_\\<phi>Type (ExSet S) (x \\<Ztypecolon> ExTyp T)\\<close>\n  unfolding Rewrite_into_\\<phi>Type_def by (simp add: ExTyp_expn, metis)\n\n\nsubsection \\<open>Inter\\<close>\n\ndefinition \\<phi>Inter :: \\<open>('c,'ax) \\<phi> \\<Rightarrow> ('c, 'bx) \\<phi> \\<Rightarrow> ('c, 'ax \\<times> 'bx) \\<phi>\\<close> (infixl \"\\<inter>\\<^sub>\\<phi>\" 70)\n  where \\<open>(T \\<inter>\\<^sub>\\<phi> U) = (\\<lambda>(x,y). (x \\<Ztypecolon> T) \\<inter> (y \\<Ztypecolon> U))\\<close>\n\nlemma \\<phi>Inter_expn[\\<phi>expns]:\n  \\<open>((x,y) \\<Ztypecolon> (T \\<inter>\\<^sub>\\<phi> U)) = (x \\<Ztypecolon> T) \\<inter> (y \\<Ztypecolon> U)\\<close>\n  unfolding set_eq_iff \\<phi>Type_def \\<phi>Inter_def by simp\n\nlemma \\<phi>Inter_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited ((x,y) \\<Ztypecolon> (T \\<inter>\\<^sub>\\<phi> U)) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> Inhabited (y \\<Ztypecolon> U) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (clarsimp simp add: \\<phi>expns; blast)\n\n\nsection \\<open>Structural Connectives\\<close>\n\nsubsection \\<open>None\\<close>\n\ndefinition \\<phi>None :: \\<open>('v::one, unit) \\<phi>\\<close> (\"\\<circle>\")\n  where \\<open>\\<phi>None = (\\<lambda>x. { 1 }) \\<close>\n\nlemma \\<phi>None_expn[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> \\<phi>None) \\<longleftrightarrow> p = 1\\<close>\n  unfolding \\<phi>None_def \\<phi>Type_def by simp\n\nlemma \\<phi>None_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> \\<phi>None) \\<Longrightarrow> C \\<Longrightarrow> C\\<close> .\n\nlemma \\<phi>None_itself_is_one[simp]:\n  \\<open>(() \\<Ztypecolon> \\<phi>None) = 1\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1200]:\n  \\<open>() \\<Ztypecolon> \\<phi>None \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> 1 \\<Ztypecolon> Identity\\<close>\n  unfolding Imply_def \\<phi>None_expn Identity_expn by simp\n\nsubsubsection \\<open>Actions\\<close>\n\nlemma [\\<phi>reason 1000]:\n  \\<open> x \\<Ztypecolon> \\<circle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> \\<circle> @action to Target \\<close>\n  unfolding Action_Tag_def using implies_refl .\n\nlemma [\\<phi>reason 1200]:\n  \\<open>() \\<Ztypecolon> \\<phi>None \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> 1 \\<Ztypecolon> Identity @action to Identity\\<close> \\<medium_left_bracket> \\<medium_right_bracket>. .\n\nsubsubsection \\<open>Rules\\<close>\n\nlemma [\\<phi>reason 3000]:\n  \\<open>\\<r>Clean (() \\<Ztypecolon> \\<phi>None)\\<close>\n  unfolding \\<r>Clean_def by simp\n\nlemma [\\<phi>reason 1200]:\n  \\<open>is_functional (() \\<Ztypecolon> \\<phi>None)\\<close>\n  \\<medium_left_bracket> to Identity \\<medium_right_bracket>. .\n\n(*\nlemma [\\<phi>reason 1500\n    for \\<open>(() \\<Ztypecolon> \\<phi>None) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?X \\<a>\\<n>\\<d> ?P @action (?Act::?'a::simplification action)\\<close>\n    except \\<open>(() \\<Ztypecolon> \\<phi>None) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?x \\<Ztypecolon> ?T \\<a>\\<n>\\<d> ?P @action (?Act::?'a::simplification action)\\<close>\n]:\n  \\<open>(() \\<Ztypecolon> \\<phi>None) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> 1 @action Act\\<close>\n  for Act :: \\<open>'a::simplification action\\<close>\n  unfolding Action_Tag_def by (simp add: implies_refl)\n*)\n\nsubsection \\<open>Prod\\<close>\n\ndefinition \\<phi>Prod :: \" ('concrete::sep_magma, 'abs_a) \\<phi> \\<Rightarrow> ('concrete, 'abs_b) \\<phi> \\<Rightarrow> ('concrete, 'abs_a \\<times> 'abs_b) \\<phi>\" (infixr \"\\<^emph>\" 55)\n  where \"A \\<^emph> B = (\\<lambda>(a,b). B b * A a)\"\n\nlemma \\<phi>Prod_expn[\\<phi>expns]:\n  \"concrete \\<in> ((a,b) \\<Ztypecolon> A \\<^emph> B) \\<longleftrightarrow> (\\<exists>cb ca. concrete = cb * ca \\<and> cb \\<in> (b \\<Ztypecolon> B) \\<and> ca \\<in> (a \\<Ztypecolon> A) \\<and> cb ## ca)\"\n  unfolding \\<phi>Prod_def \\<phi>Type_def times_set_def by simp\n\nlemma \\<phi>Prod_expn'[assertion_simps]:\n  \\<open>((a,b) \\<Ztypecolon> A \\<^emph> B) = (b \\<Ztypecolon> B) * (a \\<Ztypecolon> A)\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>expns)\n\nlemma \\<phi>Prod_inhabited[elim!,\\<phi>inhabitance_rule]:\n  \"Inhabited ((x1,x2) \\<Ztypecolon> T1 \\<^emph> T2) \\<Longrightarrow> (Inhabited (x1 \\<Ztypecolon> T1) \\<Longrightarrow> Inhabited (x2 \\<Ztypecolon> T2) \\<Longrightarrow> C) \\<Longrightarrow> C\"\n  unfolding Inhabited_def by (simp add: \\<phi>expns, blast)\n\n(* lemma \\<phi>Prod_inhabited_expn[\\<phi>inhabited]:\n  \\<open>Inhabited ((x1,x2) \\<Ztypecolon> T1 \\<^emph> T2) \\<longleftrightarrow> Inhabited (x1 \\<Ztypecolon> T1) \\<and> Inhabited (x2 \\<Ztypecolon> T2)\\<close>\n  unfolding Inhabited_def apply (simp add: \\<phi>expns) *)\n\nlemma \\<phi>Prod_split: \"((a,b) \\<Ztypecolon> A \\<^emph> B) = (b \\<Ztypecolon> B) * (a \\<Ztypecolon> A)\"\n  by (simp add: \\<phi>expns set_eq_iff)\n\nlemma \\<phi>Prod_\\<phi>None:\n  \\<open>((x',y) \\<Ztypecolon> \\<circle> \\<^emph> U) = ((y \\<Ztypecolon> U) :: 'a::sep_magma_1 set)\\<close>\n  \\<open>((x,y') \\<Ztypecolon> T \\<^emph> \\<circle>) = ((x \\<Ztypecolon> T) :: 'b::sep_magma_1 set)\\<close>\n  unfolding set_eq_iff\n  by (simp_all add: \\<phi>expns)\n\n(*lemma (in \\<phi>empty) SepNu_to_SepSet: \"(OBJ (a,b) \\<Ztypecolon> A \\<^emph> B) = (OBJ a \\<Ztypecolon> A) * (OBJ b \\<Ztypecolon> B)\"\n  by (simp add: \\<phi>expns set_eq_iff times_list_def) *)\n\nsubsubsection \\<open>Reasoning Rules\\<close>\n\n(* paragraph \\<open>View Shift\\<close>\n\nlemma [\\<phi>reason for \\<open>(?x,?y) \\<Ztypecolon> ?N \\<^emph> ?M \\<s>\\<h>\\<i>\\<f>\\<t>\\<s> (?x',?y') \\<Ztypecolon> ?N' \\<^emph> ?M' \\<a>\\<n>\\<d> ?P\\<close>]:\n  \" x \\<Ztypecolon> N \\<s>\\<h>\\<i>\\<f>\\<t>\\<s> x' \\<Ztypecolon> N' \\<a>\\<n>\\<d> P1\n\\<Longrightarrow> y \\<Ztypecolon> M \\<s>\\<h>\\<i>\\<f>\\<t>\\<s> y' \\<Ztypecolon> M' \\<a>\\<n>\\<d> P2\n\\<Longrightarrow> (x,y) \\<Ztypecolon> N \\<^emph> M \\<s>\\<h>\\<i>\\<f>\\<t>\\<s> (x',y') \\<Ztypecolon> N' \\<^emph> M' \\<a>\\<n>\\<d> P1 \\<and> P2\"\n  unfolding View_Shift_def \\<phi>Prod_expn'\n  by (smt (verit, best) mult.commute mult.left_commute)  *)\n\n(*do not add it to \\<phi>-LPR because we have stronger reasoning mechanisms*)\nlemma \\<phi>Prod_transformation:\n  \" x \\<Ztypecolon> N \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> N' \\<a>\\<n>\\<d> P1\n\\<Longrightarrow> y \\<Ztypecolon> M \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y' \\<Ztypecolon> M' \\<a>\\<n>\\<d> P2\n\\<Longrightarrow> (x,y) \\<Ztypecolon> N \\<^emph> M \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x',y') \\<Ztypecolon> N' \\<^emph> M' \\<a>\\<n>\\<d> P1 \\<and> P2\"\n  unfolding Imply_def by (simp add: \\<phi>expns) blast\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<r>Clean (x \\<Ztypecolon> T)\n\\<Longrightarrow> \\<r>Clean (y \\<Ztypecolon> U)\n\\<Longrightarrow> \\<r>Clean ((x,y) \\<Ztypecolon> T \\<^emph> U)\\<close>\n  for T :: \\<open>('a::sep_magma_1, 'b) \\<phi>\\<close>\n  unfolding \\<r>Clean_def \\<phi>Prod_expn' Imply_def\n  apply (simp add: \\<phi>expns)\n  using mult_1_class.mult_1_left by blast\n\nlemma [\\<phi>reason 1200]:\n  \\<open> is_functional (x \\<Ztypecolon> T)\n\\<Longrightarrow> is_functional (y \\<Ztypecolon> U)\n\\<Longrightarrow> is_functional ((x,y) \\<Ztypecolon> T \\<^emph> U)\\<close>\n  unfolding is_functional_def set_eq_iff\n  by (simp add: \\<phi>expns, blast)\n\n\nsubsubsection \\<open>Action\\<close>\n\nlemma [\\<phi>reason 1200]:\n  \\<open> A \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X \\<a>\\<n>\\<d> P @action \\<A>_structural act\n\\<Longrightarrow> B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> Q @action \\<A>_structural act\n\\<Longrightarrow> A * B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X * Y \\<a>\\<n>\\<d> P \\<and> Q @action \\<A>_structural act\\<close>\n  unfolding Action_Tag_def\n  by (meson implies_left_prod implies_right_prod implies_trans)\n\nlemma prod_transform_to1:\n  \\<open> A \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X \\<a>\\<n>\\<d> P @action to T\n\\<Longrightarrow> B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> Q @action to U\n\\<Longrightarrow> A * B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X * Y \\<a>\\<n>\\<d> P \\<and> Q @action to (T \\<^emph> U)\\<close>\n  unfolding Action_Tag_def\n  by (meson implies_left_prod implies_right_prod implies_trans)\n\nlemma prod_transform_to2:\n  \\<open> A \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X \\<a>\\<n>\\<d> P @action to U\n\\<Longrightarrow> B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> Q @action to T\n\\<Longrightarrow> A * B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X * Y \\<a>\\<n>\\<d> P \\<and> Q @action to (T \\<^emph> U)\\<close>\n  unfolding Action_Tag_def\n  by (meson implies_left_prod implies_right_prod implies_trans)\n\ndeclare [[\\<phi>reason 1200 prod_transform_to1 prod_transform_to2\n      for \\<open>?A * ?B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> _ \\<a>\\<n>\\<d> _ @action to (?T \\<^emph> ?U)\\<close>]]\n\nhide_fact prod_transform_to1 prod_transform_to2\n\nlemma [\\<phi>reason 1100]:\n  \\<open> A \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X \\<a>\\<n>\\<d> P @action to T\n\\<Longrightarrow> B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> Q @action to T\n\\<Longrightarrow> A * B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X * Y \\<a>\\<n>\\<d> P \\<and> Q @action to T\\<close>\n  unfolding Action_Tag_def\n  by (meson implies_left_prod implies_right_prod implies_trans)\n\nlemma Prod_transform_to1:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> T' \\<a>\\<n>\\<d> P @action to A\n\\<Longrightarrow> y \\<Ztypecolon> U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y' \\<Ztypecolon> U' \\<a>\\<n>\\<d> Q @action to B\n\\<Longrightarrow> (x,y) \\<Ztypecolon> (T \\<^emph> U) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x',y') \\<Ztypecolon> (T' \\<^emph> U') \\<a>\\<n>\\<d> P \\<and> Q @action to (A \\<^emph> B)\\<close>\n  unfolding Action_Tag_def\n  using \\<phi>Prod_transformation .\n\nlemma Prod_transform_to2:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> T' \\<a>\\<n>\\<d> P @action to B\n\\<Longrightarrow> y \\<Ztypecolon> U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y' \\<Ztypecolon> U' \\<a>\\<n>\\<d> Q @action to A\n\\<Longrightarrow> (x,y) \\<Ztypecolon> (T \\<^emph> U) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x',y') \\<Ztypecolon> (T' \\<^emph> U') \\<a>\\<n>\\<d> P \\<and> Q @action to (A \\<^emph> B)\\<close>\n  unfolding Action_Tag_def\n  using \\<phi>Prod_transformation .\n\ndeclare [[\\<phi>reason 1200 Prod_transform_to1 Prod_transform_to2\n      for \\<open>(?x,?y) \\<Ztypecolon> (?T \\<^emph> ?U) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> _ \\<a>\\<n>\\<d> _ @action to (?A \\<^emph> ?B)\\<close>]]\n\nhide_fact Prod_transform_to1 Prod_transform_to2\n\nlemma [\\<phi>reason 1100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> T' \\<a>\\<n>\\<d> P @action to Target\n\\<Longrightarrow> y \\<Ztypecolon> U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y' \\<Ztypecolon> U' \\<a>\\<n>\\<d> Q @action to Target\n\\<Longrightarrow> (x,y) \\<Ztypecolon> (T \\<^emph> U) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x',y') \\<Ztypecolon> (T' \\<^emph> U') \\<a>\\<n>\\<d> P \\<and> Q @action to Target\\<close>\n  unfolding Action_Tag_def\n  using \\<phi>Prod_transformation .\n\n\nlemma [\\<phi>reason 1000]:\n  \\<open> P @action as ((x \\<Ztypecolon> T) * (y \\<Ztypecolon> U))\n\\<Longrightarrow> P @action as ((x,y) \\<Ztypecolon> (T \\<^emph> U)) \\<close>\n  unfolding Action_Tag_def .\n\nlemma prod_transform_as1:\n  \\<open> A \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X \\<a>\\<n>\\<d> P @action as M\n\\<Longrightarrow> B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> Q @action as N\n\\<Longrightarrow> A * B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X * Y \\<a>\\<n>\\<d> P \\<and> Q @action as (M * N)\\<close>\n  unfolding Action_Tag_def\n  by (meson implies_left_prod implies_right_prod implies_trans)\n\nlemma prod_transform_as2:\n  \\<open> A \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X \\<a>\\<n>\\<d> P @action to N\n\\<Longrightarrow> B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> Q @action to M\n\\<Longrightarrow> A * B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X * Y \\<a>\\<n>\\<d> P \\<and> Q @action to (M * N)\\<close>\n  unfolding Action_Tag_def\n  by (meson implies_left_prod implies_right_prod implies_trans)\n\ndeclare [[\\<phi>reason 1200 prod_transform_as1 prod_transform_as2\n      for \\<open>?A * ?B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> _ \\<a>\\<n>\\<d> _ @action to (?M * ?N)\\<close>]]\n\nhide_fact prod_transform_as1 prod_transform_as2\n\nlemma [\\<phi>reason 1100]:\n  \\<open> A \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X \\<a>\\<n>\\<d> P @action as T\n\\<Longrightarrow> B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> Q @action as T\n\\<Longrightarrow> A * B \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X * Y \\<a>\\<n>\\<d> P \\<and> Q @action as T\\<close>\n  unfolding Action_Tag_def\n  by (meson implies_left_prod implies_right_prod implies_trans)\n\nlemma Prod_transform_as1:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> T' \\<a>\\<n>\\<d> P @action as A\n\\<Longrightarrow> y \\<Ztypecolon> U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y' \\<Ztypecolon> U' \\<a>\\<n>\\<d> Q @action as B\n\\<Longrightarrow> (x,y) \\<Ztypecolon> (T \\<^emph> U) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x',y') \\<Ztypecolon> (T' \\<^emph> U') \\<a>\\<n>\\<d> P \\<and> Q @action as (A * B)\\<close>\n  unfolding Action_Tag_def\n  using \\<phi>Prod_transformation .\n\nlemma Prod_transform_as2:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> T' \\<a>\\<n>\\<d> P @action as B\n\\<Longrightarrow> y \\<Ztypecolon> U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y' \\<Ztypecolon> U' \\<a>\\<n>\\<d> Q @action as A\n\\<Longrightarrow> (x,y) \\<Ztypecolon> (T \\<^emph> U) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x',y') \\<Ztypecolon> (T' \\<^emph> U') \\<a>\\<n>\\<d> P \\<and> Q @action as (A * B)\\<close>\n  unfolding Action_Tag_def\n  using \\<phi>Prod_transformation .\n\ndeclare [[\\<phi>reason 1200 Prod_transform_as1 Prod_transform_as2\n      for \\<open>(?x,?y) \\<Ztypecolon> (?T \\<^emph> ?U) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> _ \\<a>\\<n>\\<d> _ @action as (?A * ?B)\\<close>]]\n\nhide_fact Prod_transform_as1 Prod_transform_as2\n\nlemma [\\<phi>reason 1100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> T' \\<a>\\<n>\\<d> P @action as Target\n\\<Longrightarrow> y \\<Ztypecolon> U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y' \\<Ztypecolon> U' \\<a>\\<n>\\<d> Q @action as Target\n\\<Longrightarrow> (x,y) \\<Ztypecolon> (T \\<^emph> U) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x',y') \\<Ztypecolon> (T' \\<^emph> U') \\<a>\\<n>\\<d> P \\<and> Q @action as Target\\<close>\n  unfolding Action_Tag_def\n  using \\<phi>Prod_transformation .\n\n\nparagraph \\<open>Simplification\\<close>\n\nlemma \\<phi>Prod_simp_cong[folded atomize_eq]:\n  \\<open> (x \\<Ztypecolon> T) = (x' \\<Ztypecolon> T')\n\\<Longrightarrow> (y \\<Ztypecolon> U) = (y' \\<Ztypecolon> U')\n\\<Longrightarrow> ((x,y) \\<Ztypecolon> T \\<^emph> U) = ((x',y') \\<Ztypecolon> T' \\<^emph> U')\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>expns)\n\nsimproc_setup \\<phi>Prod_simp_cong (\"(x,y) \\<Ztypecolon> (T \\<^emph> U)\") = \\<open>\n  K (fn ctxt => Phi_SimpCong.simproc @{thm \\<phi>Prod_simp_cong} ctxt)\n\\<close>\n\nlemma [simp]:\n  \\<open>((x,y) \\<Ztypecolon> ExTyp T \\<^emph> U) = ((\\<lambda>c. (x c, y)) \\<Ztypecolon> (\\<exists>\\<phi> c. T c \\<^emph> U))\\<close>\n  by (clarsimp simp add: set_eq_iff \\<phi>expns; blast)\n\nlemma [simp]:\n  \\<open> NO_MATCH (ExTyp Any) T\n\\<Longrightarrow> ((x,y) \\<Ztypecolon> T \\<^emph> ExTyp U) = ((\\<lambda>c. (x, y c)) \\<Ztypecolon> (\\<exists>\\<phi> c. T \\<^emph> U c))\\<close>\n  by (clarsimp simp add: set_eq_iff \\<phi>expns; blast)\n\n\n(*lemma [simp]: \"A \\<inter> S \\<perpendicular> A \\<inter> -S\"\n  unfolding disjoint_def by auto\nlemma heap_split_id: \"P h1' h2' \\<Longrightarrow> \\<exists>h1 h2. h1' ++ h2' = h1 ++ h2 \\<and> P h1 h2\" by auto\nlemma heap_split_by_set: \"P (h |` S) (h |` (- S)) \\<Longrightarrow> \\<exists>h1 h2. h = h1 ++ h2 \\<and> dom h1 \\<perpendicular> dom h2 \\<and> P h1 h2\"\n  by (rule exI[of _ \"h |` S\"], rule exI[of _ \"h |` (- S)\"])\n    (auto simp add: map_add_def option.case_eq_if restrict_map_def disjoint_def disjoint_iff domIff)\nlemma heap_split_by_addr_set: \"P (h |` (MemAddress ` S)) (h |` (- (MemAddress ` S))) \\<Longrightarrow> \\<exists>h1 h2. h = h1 ++ h2 \\<and> dom h1 \\<perpendicular> dom h2 \\<and> P h1 h2\"\n  using heap_split_by_set .*)\n\n\nsubsection \\<open>List Item \\& Empty List\\<close>\n\nsubsubsection \\<open>List Item\\<close>\n\ndefinition List_Item :: \\<open>('v, 'a) \\<phi> \\<Rightarrow> ('v list, 'a) \\<phi>\\<close>\n  where \\<open>List_Item T = (\\<lambda>x. { [v] |v. v \\<in> (x \\<Ztypecolon> T) })\\<close>\n\nlemma List_Item_expn[\\<phi>expns]:\n \\<open>p \\<in> (x \\<Ztypecolon> List_Item T) \\<longleftrightarrow> (\\<exists>v. p = [v] \\<and> v \\<in> (x \\<Ztypecolon> T))\\<close>\n  unfolding List_Item_def \\<phi>Type_def by simp\n\nlemma List_Item_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> List_Item T) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns)\n\nlemma \\<comment> \\<open>A example for how to represent multi-elements list\\<close>\n  \\<open> v1 \\<in> (x1 \\<Ztypecolon> T1)\n\\<Longrightarrow> v2 \\<in> (x2 \\<Ztypecolon> T2)\n\\<Longrightarrow> [v1,v2] \\<in> ((x1, x2) \\<Ztypecolon> (List_Item T1 \\<^emph> List_Item T2))\\<close>\n  by (simp add: \\<phi>expns times_list_def, rule exI[where x=\\<open>[v2]\\<close>], rule exI[where x=\\<open>[v1]\\<close>], simp)\n\nsubsubsection \\<open>Empty List\\<close>\n\ndefinition Empty_List :: \\<open>('v list, unit) \\<phi>\\<close>\n  where \\<open>Empty_List = (\\<lambda>x. { [] })\\<close>\n\nlemma [\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> Empty_List) \\<longleftrightarrow> p = []\\<close>\n  unfolding Empty_List_def \\<phi>Type_def by simp\n\nlemma [\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> Empty_List) \\<Longrightarrow> C \\<Longrightarrow> C\\<close> .\n\n\nsubsection \\<open>Optional\\<close>\n\ndefinition \\<phi>Optional :: \\<open>('c,'x) \\<phi> \\<Rightarrow> bool \\<Rightarrow> ('c::one,'x) \\<phi>\\<close> (infix \"?\\<^sub>\\<phi>\" 55)\n  where \\<open>(T ?\\<^sub>\\<phi> C) = (\\<lambda>x. if C then (x \\<Ztypecolon> T) else 1)\\<close>\n\nlemma \\<phi>Optional_expn[\\<phi>expns]:\n  \\<open>(x \\<Ztypecolon> T ?\\<^sub>\\<phi> C) = (if C then x \\<Ztypecolon> T else 1)\\<close>\n  unfolding \\<phi>Type_def \\<phi>Optional_def by simp\n\nlemma \\<phi>Optional_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> T ?\\<^sub>\\<phi> C) \\<Longrightarrow> ((C \\<Longrightarrow> Inhabited (x \\<Ztypecolon> T)) \\<Longrightarrow> Z) \\<Longrightarrow> Z\\<close>\n  unfolding Inhabited_def by (cases C; clarsimp simp add: \\<phi>expns)\n\nsubsubsection \\<open>Conversion\\<close>\n\nlemma [simp]:\n  \\<open>(x \\<Ztypecolon> T ?\\<^sub>\\<phi> True) = (x \\<Ztypecolon> T)\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>Optional_expn)\n\nlemma [simp]:\n  \\<open>(x \\<Ztypecolon> T ?\\<^sub>\\<phi> False) = 1\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>Optional_expn)\n\nsubsubsection \\<open>Rules\\<close>\n\nlemma [\\<phi>reason 3000 for \\<open>\\<r>Clean (?x \\<Ztypecolon> ?T ?\\<^sub>\\<phi> ?C)\\<close>]:\n  \\<open> \\<r>Clean (x \\<Ztypecolon> T ?\\<^sub>\\<phi> False) \\<close>\n  unfolding \\<r>Clean_def by simp\n\n\n\nsubsection \\<open>Mapping\\<close>\n\ndefinition \\<phi>Mapping :: \\<open>('av,'a) \\<phi> \\<Rightarrow> ('bv,'b) \\<phi> \\<Rightarrow> ('av \\<Rightarrow> 'bv, 'a \\<Rightarrow> 'b) \\<phi>\\<close> (infixr \"\\<Rrightarrow>\" 25)\n    \\<comment> \\<open>Forward Simulation\\<close>\n  where \\<open>(T \\<Rrightarrow> U) = (\\<lambda>f. { g. \\<forall>v x. v \\<in> (x \\<Ztypecolon> T) \\<longrightarrow> g v \\<in> (f x \\<Ztypecolon> U) })\\<close>\n\nlemma \\<phi>Mapping_expn[\\<phi>expns]:\n  \\<open>g \\<in> (f \\<Ztypecolon> T \\<Rrightarrow> U) \\<longleftrightarrow> (\\<forall>v x. v \\<in> (x \\<Ztypecolon> T) \\<longrightarrow> g v \\<in> (f x \\<Ztypecolon> U))\\<close>\n  unfolding \\<phi>Mapping_def \\<phi>Type_def by simp\n\nlemma \\<phi>Mapping_inhabited[\\<phi>expns]:\n  \\<open>Inhabited (f \\<Ztypecolon> T \\<Rrightarrow> U) \\<Longrightarrow> ((\\<And>x. Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> Inhabited (f x \\<Ztypecolon> U)) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns, blast)\n\n\nsubsection \\<open>Point on a Mapping\\<close>\n\nsubsubsection \\<open>By Key\\<close>\n\ndefinition \\<phi>MapAt :: \\<open>'key \\<Rightarrow> ('v::one, 'x) \\<phi> \\<Rightarrow> ('key \\<Rightarrow> 'v, 'x) \\<phi>\\<close> (infixr \"\\<^bold>\\<rightarrow>\" 60)\n  where \\<open>\\<phi>MapAt key T x = { 1(key := v) |v. v \\<in> (x \\<Ztypecolon> T) }\\<close>\n\nlemma \\<phi>MapAt_expns[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> key \\<^bold>\\<rightarrow> T) \\<longleftrightarrow> (\\<exists>v. p = 1(key := v) \\<and> v \\<in> (x \\<Ztypecolon> T))\\<close>\n  unfolding \\<phi>MapAt_def \\<phi>Type_def by simp\n\nlemma [\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> field \\<^bold>\\<rightarrow> T) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns)\n\nparagraph \\<open>Conversions\\<close>\n\nlemma \\<phi>MapAt_\\<phi>Prod:\n  \\<open>k \\<^bold>\\<rightarrow> (T \\<^emph> U) = (k \\<^bold>\\<rightarrow> T) \\<^emph> (k \\<^bold>\\<rightarrow> U)\\<close>\n  for T :: \\<open>('a::sep_monoid,'b) \\<phi>\\<close>\n  apply (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; rule; clarsimp)\n  apply (metis fun_1upd_homo_right1 fun_sep_disj_1_fupdt(1))\n  by (metis fun_1upd_homo_right1)\n\nlemma \\<phi>MapAt_\\<phi>None:\n  \\<open>k \\<^bold>\\<rightarrow> \\<circle> = \\<circle>\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns)\n\n(*\nlemma [\\<phi>reason 1500 for \\<open>?x \\<Ztypecolon> ?k \\<^bold>\\<rightarrow> \\<circle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?Y @action (?Act::?'a::simplification action)\\<close>]:\n  \\<open>x \\<Ztypecolon> k \\<^bold>\\<rightarrow> \\<circle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> () \\<Ztypecolon> \\<circle> @action Act\\<close>\n  for Act :: \\<open>'a::simplification action\\<close>\n  unfolding Action_Tag_def\n  by (simp add: implies_refl \\<phi>MapAt_\\<phi>None) *)\n\nlemma \\<phi>MapAt_simp_cong[folded atomize_eq]:\n  \\<open> (x \\<Ztypecolon> T) = (x' \\<Ztypecolon> T')\n\\<Longrightarrow> (x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T) = (x' \\<Ztypecolon> k \\<^bold>\\<rightarrow> T')\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>expns)\n\nsimproc_setup \\<phi>MapAt_simp_cong (\"(x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T)\") = \\<open>\n  K (fn ctxt => Phi_SimpCong.simproc @{thm \\<phi>MapAt_simp_cong} ctxt)\n\\<close>\n\nparagraph \\<open>Implication \\& Action rules\\<close>\n\nlemma \\<phi>MapAt_cast:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k \\<^bold>\\<rightarrow> U \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def\n  by (clarsimp simp add: \\<phi>expns; blast)\n\nlemma [\\<phi>reason 1000]:\n  \\<open> \\<r>REQUIRE \\<s>\\<i>\\<m>\\<p>\\<r>\\<e>\\<m> k = k'\n\\<Longrightarrow> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k' \\<^bold>\\<rightarrow> U \\<a>\\<n>\\<d> P\\<close>\n  using \\<phi>MapAt_cast by (simp add: Premise_def)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k \\<^bold>\\<rightarrow> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act \\<close>\n  unfolding Action_Tag_def\n  using \\<phi>MapAt_cast .\n\nlemma [\\<phi>reason 1200]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k \\<^bold>\\<rightarrow> U \\<a>\\<n>\\<d> P @action to (k' \\<^bold>\\<rightarrow> Z) \\<close>\n  unfolding Action_Tag_def\n  using \\<phi>MapAt_cast .\n\nlemma [\\<phi>reason 100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k \\<^bold>\\<rightarrow> U \\<a>\\<n>\\<d> P @action to Z \\<close>\n  unfolding Action_Tag_def\n  using \\<phi>MapAt_cast .\n\nlemma [\\<phi>reason 1200]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> Z)\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k \\<^bold>\\<rightarrow> U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> k' \\<^bold>\\<rightarrow> Z) \\<close>\n  unfolding Action_Tag_def\n  using \\<phi>MapAt_cast .\n\nlemma [\\<phi>reason 100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action as Z\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k \\<^bold>\\<rightarrow> U \\<a>\\<n>\\<d> P @action as Z \\<close>\n  unfolding Action_Tag_def\n  using \\<phi>MapAt_cast .\n\nlemma [simp]:\n  \\<open>(k \\<^bold>\\<rightarrow> ExTyp T) = (\\<exists>\\<phi> c. k \\<^bold>\\<rightarrow> T c)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma [simp]:\n  \\<open>(k \\<^bold>\\<rightarrow> (T \\<phi>\\<s>\\<u>\\<b>\\<j> P)) = (k \\<^bold>\\<rightarrow> T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<r>Clean (x \\<Ztypecolon> T)\n\\<Longrightarrow> \\<r>Clean (x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T)\\<close>\n  unfolding \\<r>Clean_def Imply_def\n  apply (clarsimp simp add: \\<phi>expns)\n  by (metis fun_1upd1)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> k = k'\n\\<Longrightarrow> v \\<Ztypecolon> Identity \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> v' \\<Ztypecolon> T \\<a>\\<n>\\<d> P\n\\<Longrightarrow> 1(k := v) \\<Ztypecolon> Identity \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> v' \\<Ztypecolon> k' \\<^bold>\\<rightarrow> T \\<a>\\<n>\\<d> P\\<close>\n  by (clarsimp simp add: \\<phi>expns Imply_def, blast)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> is_functional (x \\<Ztypecolon> T)\n\\<Longrightarrow> is_functional (x \\<Ztypecolon> k \\<^bold>\\<rightarrow> T)\\<close>\n  by (clarsimp simp add: \\<phi>expns is_functional_def, blast)\n\n\nsubsubsection \\<open>By List of Keys\\<close>\n\ndefinition \\<phi>MapAt_L :: \\<open>'key list \\<Rightarrow> ('key list \\<Rightarrow> 'v::one, 'x) \\<phi> \\<Rightarrow> ('key list \\<Rightarrow> 'v, 'x) \\<phi>\\<close> (infixr \"\\<^bold>\\<rightarrow>\\<^sub>@\" 60)\n  where \\<open>\\<phi>MapAt_L key T x = { push_map key v |v. v \\<in> (x \\<Ztypecolon> T) }\\<close>\n\nabbreviation \\<phi>MapAt_L1 :: \\<open>'key \\<Rightarrow> ('key list \\<Rightarrow> 'v::one, 'x) \\<phi> \\<Rightarrow> ('key list \\<Rightarrow> 'v, 'x) \\<phi>\\<close> (infixr \"\\<^bold>\\<rightarrow>\\<^sub>#\" 60)\n  where \\<open>\\<phi>MapAt_L1 key \\<equiv> \\<phi>MapAt_L [key]\\<close>\n\nabbreviation \\<phi>MapAt_Lnil :: \\<open>'key \\<Rightarrow> ('v::one, 'x) \\<phi> \\<Rightarrow> ('key list \\<Rightarrow> 'v, 'x) \\<phi>\\<close> (infixr \"\\<^bold>\\<rightarrow>\\<^sub>[\\<^sub>]\" 60)\n  where \\<open>\\<phi>MapAt_Lnil key T \\<equiv> \\<phi>MapAt_L [key] (\\<phi>MapAt [] T)\\<close>\n\nlemma \\<phi>MapAt_L_expns[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T) \\<longleftrightarrow> (\\<exists>v. p = push_map k v \\<and> v \\<in> (x \\<Ztypecolon> T))\\<close>\n  unfolding \\<phi>Type_def \\<phi>MapAt_L_def by simp\n\nlemma \\<phi>MapAt_L_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns)\n\nparagraph \\<open>Conversion\\<close>\n\nlemma \\<phi>MapAt_L_\\<phi>Prod:\n  \\<open>k \\<^bold>\\<rightarrow>\\<^sub>@ (T \\<^emph> U) = (k \\<^bold>\\<rightarrow>\\<^sub>@ T) \\<^emph> (k \\<^bold>\\<rightarrow>\\<^sub>@ U)\\<close>\n  for T :: \\<open>('k list \\<Rightarrow> 'a::sep_monoid,'b) \\<phi>\\<close>\n  apply (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; rule)\n  apply (clarsimp simp add: push_map_distrib_sep_mult[symmetric])\n  using push_map_sep_disj apply blast\n  apply (clarsimp simp add: push_map_distrib_sep_mult)\n  by blast\n\nlemma \\<phi>MapAt_L_\\<phi>MapAt:\n  \\<open>k1 \\<^bold>\\<rightarrow>\\<^sub>@ k2 \\<^bold>\\<rightarrow> T = k1 @ k2 \\<^bold>\\<rightarrow> T\\<close>\n  by (rule \\<phi>Type_eqI; simp add: \\<phi>expns; force)\n\nlemma \\<phi>MapAt_L_\\<phi>MapAt_L:\n  \\<open>k1 \\<^bold>\\<rightarrow>\\<^sub>@ k2 \\<^bold>\\<rightarrow>\\<^sub>@ T = k1 @ k2 \\<^bold>\\<rightarrow>\\<^sub>@ T\\<close>\n  apply (rule \\<phi>Type_eqI; simp add: \\<phi>expns)\n  by (metis push_map_push_map)\n\nlemma \\<phi>MapAt_L_\\<phi>None:\n  \\<open>k \\<^bold>\\<rightarrow>\\<^sub>@ \\<circle> = \\<circle>\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns)\n\n(*\nlemma [\\<phi>reason for \\<open>?x \\<Ztypecolon> ?k \\<^bold>\\<rightarrow>\\<^sub># \\<circle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?X \\<a>\\<n>\\<d> ?P @action (?Act::?'a::simplification action)\\<close>]:\n  \\<open>x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub># \\<circle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> () \\<Ztypecolon> \\<circle> @action Act\\<close>\n  for Act :: \\<open>'a::simplification action\\<close>\n  unfolding Action_Tag_def by (simp add: implies_refl \\<phi>MapAt_L_\\<phi>None) *)\n\nlemma \\<phi>MapAt_L_simp_cong[folded atomize_eq]:\n  \\<open> (x \\<Ztypecolon> T) = (x' \\<Ztypecolon> T')\n\\<Longrightarrow> (x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T) = (x' \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T')\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>expns)\n\nsimproc_setup \\<phi>MapAt_L_simp_cong (\"x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T\") = \\<open>\n  K (fn ctxt => Phi_SimpCong.simproc @{thm \\<phi>MapAt_L_simp_cong} ctxt)\n\\<close>\n\nlemma \\<phi>MapAt_L_At:\n  \\<open>(ks \\<^bold>\\<rightarrow>\\<^sub>@ [] \\<^bold>\\<rightarrow> T) = (ks \\<^bold>\\<rightarrow> T)\\<close>\n  by (rule \\<phi>Type_eqI; simp add: \\<phi>expns; metis append_self_conv push_map_unit)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<r>Clean (x \\<Ztypecolon> T)\n\\<Longrightarrow> \\<r>Clean (x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T)\\<close>\n  unfolding \\<r>Clean_def Imply_def\n  apply (simp add: \\<phi>expns)\n  using push_map_1 by blast\n\n\n\nparagraph \\<open>Implication \\& Action Rules\\<close>\n\nlemma \\<phi>MapAt_L_cast:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ U \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def\n  by (clarsimp simp add: \\<phi>expns; blast)\n\nlemma [\\<phi>reason 1020]:\n  \\<open> \\<r>REQUIRE \\<s>\\<i>\\<m>\\<p>\\<r>\\<e>\\<m> k' = k\n\\<Longrightarrow> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k' \\<^bold>\\<rightarrow>\\<^sub>@ U \\<a>\\<n>\\<d> P\\<close>\n  using \\<phi>MapAt_L_cast by (simp add: Premise_def)\n\nlemma [\\<phi>reason 1017]:\n  \\<open> \\<r>REQUIRE\n    \\<s>\\<i>\\<m>\\<p>\\<r>\\<e>\\<m> length k < length k'\n&&& \\<s>\\<i>\\<m>\\<p>\\<r>\\<e>\\<m> k @ kd = k'\n\\<Longrightarrow> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> kd \\<^bold>\\<rightarrow>\\<^sub>@ U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k' \\<^bold>\\<rightarrow>\\<^sub>@ U \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def \\<r>Require_def conjunction_imp\n  apply (clarsimp simp add: \\<phi>expns)\n  using push_map_push_map by blast\n\nlemma [\\<phi>reason 1013]:\n  \\<open> \\<r>REQUIRE\n    \\<s>\\<i>\\<m>\\<p>\\<r>\\<e>\\<m> length k' < length k\n&&& \\<s>\\<i>\\<m>\\<p>\\<r>\\<e>\\<m> k @ kd = k'\n\\<Longrightarrow> x \\<Ztypecolon> kd \\<^bold>\\<rightarrow>\\<^sub>@ T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k' \\<^bold>\\<rightarrow>\\<^sub>@ U \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def \\<r>Require_def conjunction_imp\n  by (clarsimp simp add: \\<phi>expns)\n\n\nlemma [\\<phi>reason 1200]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\n\\<Longrightarrow> x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ U \\<a>\\<n>\\<d> P @action \\<A>_structural Act \\<close>\n  unfolding Action_Tag_def using \\<phi>MapAt_L_cast .\n\nlemma [simp]:\n  \\<open>(k \\<^bold>\\<rightarrow>\\<^sub>@ ExTyp T) = (\\<exists>\\<phi> c. k \\<^bold>\\<rightarrow>\\<^sub>@ T c)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma [simp]:\n  \\<open>(k \\<^bold>\\<rightarrow>\\<^sub>@ (T \\<phi>\\<s>\\<u>\\<b>\\<j> P)) = (k \\<^bold>\\<rightarrow>\\<^sub>@ T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\n(* subsection \\<open>Down Lifting\\<close> (*depreciated*)\n\ndefinition DownLift :: \"('a, 'b) \\<phi> \\<Rightarrow> ('c \\<Rightarrow> 'b) \\<Rightarrow> ('a,'c) \\<phi>\" (infixl \"<down-lift>\" 80)\n  where \"DownLift N g x = (g x \\<Ztypecolon> N)\"\n\nlemma DownLift_expn[simp]: \" p \\<in> (x \\<Ztypecolon> N <down-lift> g) \\<longleftrightarrow> p \\<in> (g x \\<Ztypecolon> N) \"\n  unfolding DownLift_def \\<phi>Type_def by simp\n\nlemma [elim!,\\<phi>inhabitance_rule]:\n  \"Inhabited (x \\<Ztypecolon> N <down-lift> g) \\<Longrightarrow> (Inhabited (g x \\<Ztypecolon> N) \\<Longrightarrow> C) \\<Longrightarrow> C\"\n  unfolding Inhabited_def by (simp add: \\<phi>expns)\n\n(* lemma [\\<phi>cast_overload E]: \" x \\<Ztypecolon> N <down-lift> g \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> g x \\<Ztypecolon> N\" unfolding Imply_def by simp *)\nlemma [\\<phi>reason]: \"\\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> g x = x' \\<Longrightarrow> x \\<Ztypecolon> N <down-lift> g \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> N\" unfolding Imply_def by (simp add: \\<phi>expns)\n\n(* lemma [\\<phi>reason]: \"\\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> (g y = x) \\<Longrightarrow> x \\<Ztypecolon> M \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> M <down-lift> g\"\n  unfolding Intro_def Imply_def by (simp add: \\<phi>expns) blast\nlemma [\\<phi>reason, \\<phi>overload D]: \"\\<^bold>d\\<^bold>e\\<^bold>s\\<^bold>t y \\<Ztypecolon> M <down-lift> g \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> g y \\<Ztypecolon> M\"\n  unfolding Dest_def Imply_def by (simp add: \\<phi>expns) *)\n\nlemma [\\<phi>reason]: \" x \\<Ztypecolon> N \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y1 \\<Ztypecolon> M \\<a>\\<n>\\<d> P \\<Longrightarrow> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> y1 = g y  \\<Longrightarrow> x \\<Ztypecolon> N \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> M <down-lift> g\"\n  unfolding Imply_def by (simp add: \\<phi>expns)\nlemma \"\\<down>lift_\\<phi>app\": \"\\<p>\\<a>\\<r>\\<a>\\<m> g \\<Longrightarrow> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> g y = x \\<Longrightarrow> x \\<Ztypecolon> N \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> N <down-lift> g\"\n  unfolding Imply_def by (simp add: \\<phi>expns)\n\n\n\nsubsection \\<open>Up Lifting\\<close> (*depreciated*)\n\ndefinition UpLift :: \"('a, 'c) \\<phi> \\<Rightarrow> ('c \\<Rightarrow> 'b) \\<Rightarrow> ('a,'b) \\<phi>\" (infixl \"<up-lift>\" 80)\n  where \"UpLift N f x = {p. (\\<exists>y. f y = x \\<and> p \\<in> (y \\<Ztypecolon> N))}\"\n\nlemma UpLift_expn[simp]:\n  \" p \\<in> (x \\<Ztypecolon> N <up-lift> f) \\<longleftrightarrow> (\\<exists>y. (f y = x) \\<and> p \\<in> (y \\<Ztypecolon> N))\"\n  unfolding UpLift_def \\<phi>Type_def by auto\n\nlemma UpLift_inhabited[elim,\\<phi>inhabitance_rule]:\n  \"Inhabited (x \\<Ztypecolon> N <up-lift> f) \\<Longrightarrow> (\\<And>y. f y = x \\<Longrightarrow> Inhabited (y \\<Ztypecolon> N) \\<Longrightarrow> C) \\<Longrightarrow> C\"\n  unfolding Inhabited_def by (simp add: \\<phi>expns) blast\n\nlemma \"\\<up>lift_\\<phi>app\":\n  \"\\<p>\\<a>\\<r>\\<a>\\<m> g \\<Longrightarrow> \\<p>\\<a>\\<r>\\<a>\\<m> y \\<Longrightarrow> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> y = g x \\<Longrightarrow> x \\<Ztypecolon> M \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> M <up-lift> g\"\n  unfolding Imply_def by (simp add: \\<phi>expns) blast\n(* lemma [\\<phi>overload D]: \"x \\<Ztypecolon> M <up-lift> g \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (\\<exists> \\<Ztypecolon> M) \"\n  unfolding Imply_def by (simp add: \\<phi>expns) blast *)\n\n(* lemma [\\<phi>reason]: \"\\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> y = g x \\<Longrightarrow> \\<i>\\<n>\\<^bold>t\\<^bold>r\\<^bold>o x \\<Ztypecolon> M \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> M <up-lift> g\"\n  unfolding Intro_def Imply_def by (simp add: \\<phi>expns) blast *)\n\nlemma [\\<phi>reason 130]:\n  \"x \\<Ztypecolon> M \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x' \\<Ztypecolon> M' \\<a>\\<n>\\<d> P \\<Longrightarrow> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> y = g x' \\<Longrightarrow> x \\<Ztypecolon> M \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> M' <up-lift> g\"\n  unfolding Imply_def by (simp add: \\<phi>expns) blast\n\nlemma [\\<phi>reason 20]:\n  \"(\\<And> x. y = g x \\<Longrightarrow> x \\<Ztypecolon> M \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> N \\<a>\\<n>\\<d> P x)\n\\<Longrightarrow> y \\<Ztypecolon> M <up-lift> g \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> N \\<a>\\<n>\\<d> (\\<exists>x. y = g x \\<and> P x)\"\n  unfolding Imply_def by (simp add: \\<phi>expns) blast\n\nlemma [\\<phi>reason 150]:\n  \"(\\<And> x. y = g x \\<Longrightarrow> x \\<Ztypecolon> M \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y' x \\<Ztypecolon> M' x \\<a>\\<n>\\<d> P x)\n    \\<Longrightarrow> y \\<Ztypecolon> M <up-lift> g \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (\\<exists>*x. y' x \\<Ztypecolon> M' x) \\<a>\\<n>\\<d> (\\<exists>x. y = g x \\<and> P x)\"\n  unfolding Imply_def by (simp add: \\<phi>expns) blast\n\n(* lemma \"\\<^bold>d\\<^bold>e\\<^bold>s\\<^bold>t y \\<Ztypecolon> M <up-lift> g \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (\\<exists>* x. (x \\<Ztypecolon> M) \\<and>\\<^sup>s g x = y)\"\n  unfolding Dest_def Imply_def by (simp add: \\<phi>expns) blast *)\n\nlemma \"x \\<Ztypecolon> N \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> f x \\<Ztypecolon> N <up-lift> f\" unfolding Imply_def by (simp add: \\<phi>expns) blast\nlemma \"x \\<Ztypecolon> N \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> f x \\<Ztypecolon> N <up-lift> f\" unfolding Imply_def by (simp add: \\<phi>expns) blast\n\n(* lemma \"\\<phi>Equal (N <up-lift> f) can_eq eq \\<longleftrightarrow> \\<phi>Equal N (inv_imagep can_eq f) (inv_imagep eq f)\"\n  unfolding \\<phi>Equal_def by (auto 0 6) *)\n*)\n\nsection \\<open>Semantics Related\\<close>\n\nsubsection \\<open>Value\\<close>\n\nsubsubsection \\<open>Syntax to fetch the latest n-th Val\\<close>\n\n(*\nsetup \\<open>let open Ast Phi_Syntax\n  fun strip_constrain (Const (\"_constrain\", _) $ x $ _) = strip_constrain x\n    | strip_constrain (Const (\"_type_constraint_\", _) $ x) = strip_constrain x\n    | strip_constrain x = x\n\n  fun name_of_Val (Const (\\<^const_name>\\<open>\\<phi>Type\\<close>, _) $ _ $ (Const (\\<^const_name>\\<open>Val\\<close>, _) $ v $ _ ))\n        = SOME v\n    | name_of_Val _ = NONE\n\n  fun get_val ctxt ind =\n    let\n      val values = Thm.prop_of (Phi_Envir.the_construction ctxt)\n                  |> dest_CurrentConstruction |> #4\n                  |> strip_separations |> rev\n                  |> map_filter name_of_Val\n    in if ind < length values\n       then List.nth (values, ind)\n       else error (\"Referring a value that does not exists.\")\n    end\n\n  fun has_get_val (Const (\\<^const_name>\\<open>\\<phi>__get_val\\<close>, _)) = true\n    | has_get_val (A $ B) = has_get_val A orelse has_get_val B\n    | has_get_val (Abs (_,_,X)) = has_get_val X\n    | has_get_val _ = false\n  fun map_get_val ctxt (Const (\\<^const_name>\\<open>\\<phi>__get_val\\<close>, _) $ X)\n        = get_val ctxt (Value.parse_nat (Term.term_name (strip_constrain X)))\n    | map_get_val ctxt (A $ B) = map_get_val ctxt A $ map_get_val ctxt B\n    | map_get_val ctxt (Abs (name,ty,X)) = Abs (name,ty, map_get_val ctxt X)\n    | map_get_val ctxt x = x\n in Context.theory_map (Syntax_Phases.term_check ~10 \"\\<phi>valiable\" (fn ctxt =>\n      map (fn x => if has_get_val x then map_get_val ctxt x else x)))\nend\\<close> *)\n\n\nsubsection \\<open>Semantic Type Annotation\\<close>\n\nparagraph \\<open>Annotation for Single One\\<close>\n\ndefinition Of_Type :: \\<open>(VAL,'a) \\<phi> \\<Rightarrow> TY \\<Rightarrow> (VAL,'a) \\<phi>\\<close> (infix \"<of-type>\" 23)\n  where \\<open>(T <of-type> TY) = (\\<lambda>x. (x \\<Ztypecolon> T) \\<inter> Well_Type TY)\\<close>\n\nlemma [\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> T <of-type> TY) \\<longleftrightarrow> p \\<in> (x \\<Ztypecolon> T) \\<and> p \\<in> Well_Type TY\\<close>\n  unfolding Of_Type_def \\<phi>Type_def by (simp add: \\<phi>expns)\n\nlemma [\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> T <of-type> TY) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C \\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns) blast\n\nlemma [\\<phi>reason 1000]:\n  \\<open>\\<phi>SemType (x \\<Ztypecolon> T <of-type> TY) TY\\<close>\n  unfolding \\<phi>SemType_def subset_iff by (simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> \\<phi>SemType (x \\<Ztypecolon> T) TY\n\\<Longrightarrow> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U <of-type> TY \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def \\<phi>SemType_def by (simp add: \\<phi>expns) blast\n\n\nparagraph \\<open>Annotation for a List\\<close>\n\ndefinition Of_Types :: \\<open>(VAL list,'a) \\<phi> \\<Rightarrow> TY list \\<Rightarrow> (VAL list,'a) \\<phi>\\<close> (infix \"<of-types>\" 23)\n  where \\<open>(T <of-types> TYs) = (\\<lambda>x. (x \\<Ztypecolon> T) \\<inter> {p. list_all2 (\\<lambda>v t. v \\<in> Well_Type t) p TYs})\\<close>\n\nlemma [\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> T <of-types> TYs) \\<longleftrightarrow> p \\<in> (x \\<Ztypecolon> T) \\<and> list_all2 (\\<lambda>v t. v \\<in> Well_Type t) p TYs\\<close>\n  unfolding Of_Types_def \\<phi>Type_def by (simp add: \\<phi>expns)\n\nlemma [\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> T <of-types> TYs) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C \\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns) blast\n\n\nsection \\<open>Permission \\& Share\\<close>\n\nsubsection \\<open>Share \\& Option\\<close>\n\nsubsubsection \\<open>Definition of Properties\\<close>\n\ndefinition \\<phi>Sep_Disj :: \\<open>('a::sep_disj,'b1) \\<phi> \\<Rightarrow> ('a::sep_disj,'b2) \\<phi> \\<Rightarrow> bool\\<close>\n  where \\<open>\\<phi>Sep_Disj T U \\<longleftrightarrow> (\\<forall>x y u v. u \\<in> (x \\<Ztypecolon> T) \\<and> v \\<in> (y \\<Ztypecolon> U) \\<longrightarrow> u ## v)\\<close>\n\ndefinition \\<phi>Sep_Disj_Identical :: \\<open>('a::share_semimodule_sep, 'b) \\<phi> \\<Rightarrow> bool\\<close>\n  where \\<open>\\<phi>Sep_Disj_Identical T\n    \\<longleftrightarrow> (\\<forall>x u v. u \\<in> (x \\<Ztypecolon> T) \\<and> v \\<in> (x \\<Ztypecolon> T) \\<and> u ## v \\<longrightarrow> u = v)\n      \\<and> (\\<forall>x u. u \\<in> (x \\<Ztypecolon> T) \\<longrightarrow> u ## u)\\<close>\n\n\nsubsubsection \\<open>Permission Functor\\<close>\n\ndefinition \\<phi>perm_ins_homo :: \\<open>('a::sep_algebra \\<Rightarrow> 'b::share_module_sep) \\<Rightarrow> ('a,'x) \\<phi> \\<Rightarrow> ('b,'x) \\<phi>\\<close>\n  where \\<open>\\<phi>perm_ins_homo \\<psi> T = (\\<lambda>x. { \\<psi> v |v. v \\<in> (x \\<Ztypecolon> T) \\<and> perm_ins_homo \\<psi>})\\<close>\n\nabbreviation (in perm_ins_homo) \\<open>\\<phi> \\<equiv> \\<phi>perm_ins_homo \\<psi>\\<close>\n\nlemma \\<phi>perm_ins_homo_expns[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T)\n    \\<longleftrightarrow> (\\<exists>v. p = \\<psi> v \\<and> v \\<in> (x \\<Ztypecolon> T) \\<and> perm_ins_homo \\<psi>)\\<close>\n  unfolding \\<phi>perm_ins_homo_def \\<phi>Type_def by (simp add: \\<phi>expns)\n\nlemma (in perm_ins_homo) [\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> \\<phi> T) \\<longleftrightarrow> (\\<exists>v. p = \\<psi> v \\<and> v \\<in> (x \\<Ztypecolon> T))\\<close>\n  unfolding \\<phi>perm_ins_homo_def \\<phi>Type_def by (simp add: \\<phi>expns perm_ins_homo_axioms)\n\nlemma \\<phi>perm_ins_homo_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns; blast)\n\nparagraph \\<open>Implication\\<close>\n\nlemma \\<phi>perm_ins_homo_cast[\\<phi>reason 2000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> U \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def by (clarsimp simp add: \\<phi>expns; blast)\n\nparagraph \\<open>Action\\<close>\n\nlemma [\\<phi>reason 1200]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\\<close>\n  unfolding Action_Tag_def using \\<phi>perm_ins_homo_cast .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> U \\<a>\\<n>\\<d> P @action to Z \\<close>\n  unfolding Action_Tag_def using \\<phi>perm_ins_homo_cast .\n\nlemma [\\<phi>reason 1100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> U \\<a>\\<n>\\<d> P @action to (\\<phi>perm_ins_homo \\<psi> Z) \\<close>\n  unfolding Action_Tag_def using \\<phi>perm_ins_homo_cast .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action as Z\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> U \\<a>\\<n>\\<d> P @action as Z \\<close>\n  unfolding Action_Tag_def using \\<phi>perm_ins_homo_cast .\n\nlemma [\\<phi>reason 1100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> Z)\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> Z) \\<close>\n  unfolding Action_Tag_def using \\<phi>perm_ins_homo_cast .\n\n\n\nparagraph \\<open>Simplification\\<close>\n\nlemma [simp]:\n  \\<open>(\\<phi>perm_ins_homo \\<psi> (ExTyp T)) = (\\<exists>\\<phi> c. \\<phi>perm_ins_homo \\<psi> (T c))\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma [simp]:\n  \\<open>(\\<phi>perm_ins_homo \\<psi> (T \\<phi>\\<s>\\<u>\\<b>\\<j> P)) = (\\<phi>perm_ins_homo \\<psi> T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma \\<phi>perm_ins_homo_simp_cong[folded atomize_eq]:\n  \\<open> (x \\<Ztypecolon> T) = (x' \\<Ztypecolon> T')\n\\<Longrightarrow> (x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T) = (x' \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T')\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>expns)\n\nsimproc_setup \\<phi>perm_ins_homo_simp_cong (\"x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> T\") = \\<open>\n  K (fn ctxt => Phi_SimpCong.simproc @{thm \\<phi>perm_ins_homo_simp_cong} ctxt)\n\\<close>\n\n\nlemma \\<phi>perm_ins_homo_\\<phi>None:\n  assumes prem: \\<open>perm_ins_homo \\<psi>\\<close>\n  shows \\<open>\\<phi>perm_ins_homo \\<psi> \\<circle> = \\<circle>\\<close>\nproof -\n  interpret perm_ins_homo \\<psi> using prem .\n  show \\<open>\\<phi> \\<circle> = \\<circle>\\<close>\n    by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns perm_ins_homo_axioms)\nqed\n\n(* lemma [\\<phi>reason 1500 for \\<open>?x \\<Ztypecolon> \\<phi>perm_ins_homo ?\\<psi> \\<circle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?X \\<a>\\<n>\\<d> ?P @action (?Act::?'a::simplification action)\\<close>]:\n  \\<open>x \\<Ztypecolon> \\<phi>perm_ins_homo \\<psi> \\<circle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> \\<circle> @action Act\\<close>\n  for Act :: \\<open>'a::simplification action\\<close>\n  unfolding Imply_def Action_Tag_def\n  apply (clarsimp simp add: \\<phi>expns)\n  using inj_at_1_def perm_ins_homo'.axioms(5) by blast *)\n\nlemma \\<phi>perm_ins_homo_MapAt:\n  \\<open>\\<phi>perm_ins_homo ((o) f) (k \\<^bold>\\<rightarrow> T) = (k \\<^bold>\\<rightarrow> \\<phi>perm_ins_homo f T)\\<close>\nproof (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns \\<phi>perm_ins_homo_expns\n            perm_ins_homo_pointwise_eq; rule; clarsimp)\n  fix x :: 'a and va :: 'd\n  assume \\<open>perm_ins_homo f\\<close>\n  then interpret perm_ins_homo f .\n  show \\<open>va \\<in> (x \\<Ztypecolon> T) \\<Longrightarrow> \\<exists>v. f \\<circ> 1(k := va) = 1(k := v) \\<and> (\\<exists>va. v = f va \\<and> va \\<in> (x \\<Ztypecolon> T))\\<close> by fastforce\n  show \\<open>va \\<in> (x \\<Ztypecolon> T) \\<Longrightarrow> \\<exists>v. 1(k := f va) = f \\<circ> v \\<and> (\\<exists>va. v = 1(k := va) \\<and> va \\<in> (x \\<Ztypecolon> T))\\<close>\n    by (metis \\<open>va \\<in> (x \\<Ztypecolon> T) \\<Longrightarrow> \\<exists>v. f \\<circ> 1(k := va) = 1(k := v) \\<and> (\\<exists>va. v = f va \\<and> va \\<in> (x \\<Ztypecolon> T))\\<close> comp_def fun_upd_same)\nqed\n\nlemma \\<phi>perm_ins_homo_MapAt_L:\n  \\<open>\\<phi>perm_ins_homo ((o) f) (k \\<^bold>\\<rightarrow>\\<^sub>@ T) = (k \\<^bold>\\<rightarrow>\\<^sub>@ \\<phi>perm_ins_homo ((o) f) T)\\<close>\nproof (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns \\<phi>perm_ins_homo_expns\n            perm_ins_homo_pointwise_eq; rule; clarsimp)\n  fix x :: 'a and va :: \\<open>'b list \\<Rightarrow> 'd\\<close>\n  assume \\<open>perm_ins_homo f\\<close>\n  then interpret perm_ins_homo f .\n  show \\<open>va \\<in> (x \\<Ztypecolon> T) \\<Longrightarrow> \\<exists>v. f \\<circ> k \\<^enum>\\<^sub>m va = k \\<^enum>\\<^sub>m v \\<and> (\\<exists>va. v = f \\<circ> va \\<and> va \\<in> (x \\<Ztypecolon> T))\\<close>\n    using push_map_homo by blast\n  show \\<open>va \\<in> (x \\<Ztypecolon> T) \\<Longrightarrow> \\<exists>v. k \\<^enum>\\<^sub>m (f \\<circ> va) = f \\<circ> v \\<and> (\\<exists>va. v = k \\<^enum>\\<^sub>m va \\<and> va \\<in> (x \\<Ztypecolon> T))\\<close>\n    by (metis push_map_homo)\nqed    \n\n\nlemma \\<phi>perm_ins_homo_Prod_imply:\n  \\<open>x \\<Ztypecolon> \\<phi>perm_ins_homo f (T \\<^emph> U) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> (\\<phi>perm_ins_homo f T) \\<^emph> (\\<phi>perm_ins_homo f U)\\<close>\n  unfolding Imply_def\n  apply (cases x; clarsimp simp add: \\<phi>expns \\<phi>Sep_Disj_def)\n  by (metis homo_sep_def homo_sep_disj_semi_def homo_sep_mult_def homo_sep_wand_1_def homo_sep_wand_def homo_sep_wand_monoid_def perm_ins_homo_def)\n\nlemma \\<phi>perm_ins_homo_Prod:\n  \\<open> \\<phi>Sep_Disj T U\n\\<Longrightarrow> \\<phi>perm_ins_homo f (T \\<^emph> U) = (\\<phi>perm_ins_homo f T) \\<^emph> (\\<phi>perm_ins_homo f U)\\<close>\n  apply (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns \\<phi>Sep_Disj_def; rule; clarsimp)\n  apply (metis homo_sep_def homo_sep_disj_semi_def homo_sep_mult_def homo_sep_wand_1_def homo_sep_wand_def homo_sep_wand_monoid_def perm_ins_homo_def)\n  by (metis homo_sep_wand.homo_sep_wand homo_sep_wand_1_def homo_sep_wand_monoid_def perm_ins_homo_def sep_disj_commute)\n\n\nsubsubsection \\<open>Permission Annotation\\<close>\n\ndefinition \\<phi>Share :: \\<open>rat \\<Rightarrow> ('v::share,'x) \\<phi> \\<Rightarrow> ('v, 'x) \\<phi>\\<close> (infixr \"\\<Znrres>\" 60)\n  where \\<open>\\<phi>Share n T = (\\<lambda>x. { share n v |v. v \\<in> (x \\<Ztypecolon> T) \\<and> 0 < n }) \\<close>\n\nlemma \\<phi>Share_expn[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> n \\<Znrres> T) \\<longleftrightarrow> (\\<exists>v. p = share n v \\<and> v \\<in> (x \\<Ztypecolon> T) \\<and> 0 < n )\\<close>\n  unfolding \\<phi>Share_def \\<phi>Type_def by simp\n\nlemma \\<phi>Share_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> n \\<Znrres> T) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> 0 < n \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns)\n\nsubparagraph \\<open>Auxiliary Tag\\<close>\n\ndefinition half :: \\<open>rat \\<Rightarrow> rat\\<close> where [iff]: \\<open>half x = x\\<close>\n\ntext \\<open>Many read-only applicable rules require only non-zero permissions.\n  It is reflected as arbitrary schematic variable in the rule, like\n    \\<^schematic_prop>\\<open> x \\<Ztypecolon> ?n \\<Znrres> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?Z\\<close>.\n  As arbitrary schematic variable, the reasoner may by mistake instantiate it to be the total\n  permission. It is not the optimal, and it is better to only assign a half of the permission\n    and to leave the remain half to be used potentially later.\n  For example, if a rule requires twice the same resource,\n    \\<^schematic_prop>\\<open> (x \\<Ztypecolon> ?n \\<Znrres> T) * (x \\<Ztypecolon> ?m \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?Z\\<close>.\n  The best solution is to assign ?n by a half of the current permission and then assign ?m\n    the half of the remaining half.\n\n  Unfortunately, the reasoner can hardly be configured to apply this conservative policy, because\n  schematic variables have a semantics of accepting any instantiation and there are many short-cut\n  reasoning rule trying to solve greedily a local problem by unification.\n\n  An approach is, if a rule may request a same object by twice, add the tag \\<^term>\\<open>half\\<close> on its\n    permission to tell explicitly the reasoner to only assign it a half of the permission.\n    \\<^schematic_prop>\\<open> (x \\<Ztypecolon> half ?n \\<Znrres> T) * (x \\<Ztypecolon> half ?m \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?Z\\<close>.\n\\<close>\n\nparagraph \\<open>Structural Conversions\\<close>\n\nlemma \\<phi>Share_1[simp]:\n  \\<open> (1 \\<Znrres> T) = T \\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns)\n\nlemma \\<phi>Share_\\<phi>Share[simp]:\n  \\<open> 0 < n \\<and> 0 < m\n\\<Longrightarrow> n \\<Znrres> m \\<Znrres> T = n*m \\<Znrres> T \\<close>\n  apply (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns)\n  by (metis share_share_not0)\n\nlemma \\<phi>Share_share:\n  \\<open> 0 < n \\<and> 0 < m\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical T\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> T) * (x \\<Ztypecolon> m \\<Znrres> T) = (x \\<Ztypecolon> n+m \\<Znrres> T)\\<close>\n  for T :: \\<open>('a::share_semimodule_sep,'b) \\<phi>\\<close>\n  unfolding \\<phi>Sep_Disj_Identical_def\n  apply (clarsimp simp add: \\<phi>expns set_eq_iff; rule; clarsimp)\n  using share_sep_left_distrib_0 apply blast\n  subgoal for v\n  apply (rule exI[where x=\\<open>share n v\\<close>], rule exI[where x=\\<open>share m v\\<close>], simp)\n    by (metis share_sep_left_distrib_0) .\n\nlemma \\<phi>Share_\\<phi>MapAt:\n  \\<open>n \\<Znrres> k \\<^bold>\\<rightarrow> T = k \\<^bold>\\<rightarrow> n \\<Znrres> T\\<close>\n  for T :: \\<open>('a::share_one,'b) \\<phi>\\<close>\n  apply (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; rule; clarsimp)\n  apply blast\n  by (metis share_fun_updt share_right_one)\n\nlemma \\<phi>Share_\\<phi>MapAt_L:\n  \\<open>n \\<Znrres> k \\<^bold>\\<rightarrow>\\<^sub>@ T = k \\<^bold>\\<rightarrow>\\<^sub>@ n \\<Znrres> T\\<close>\n  for T :: \\<open>('k list \\<Rightarrow> 'a::share_one,'b) \\<phi>\\<close>\n  apply (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; rule)\n  apply (clarsimp simp add: share_push_map) apply blast\n  apply (clarsimp simp add: share_push_map[symmetric]) by blast\n\nlemma \\<phi>Share_\\<phi>Prod:\n  \\<open>n \\<Znrres> (T \\<^emph> U) = (n \\<Znrres> T) \\<^emph> (n \\<Znrres> U)\\<close>\n  for T :: \\<open>('a::share_semimodule_sep, 'b) \\<phi>\\<close>\n  apply (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; rule; clarsimp)\n  apply (metis share_sep_disj_left share_sep_disj_right share_sep_right_distrib_0)\n  using share_sep_right_distrib_0 by blast\n\nlemma \\<phi>Share_\\<phi>None:\n  \\<open>0 < n \\<Longrightarrow> n \\<Znrres> \\<circle> = (\\<circle> :: ('a::share_one,unit) \\<phi>)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns)\n\n(*\nlemma [\\<phi>reason 1500 for \\<open>?x \\<Ztypecolon> ?n \\<Znrres> \\<circle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?Y \\<a>\\<n>\\<d> ?P @action (?Act::?'b::simplification action)\\<close>]:\n  \\<open>x \\<Ztypecolon> n \\<Znrres> \\<circle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> (\\<circle> :: ('a::share_one,unit) \\<phi>) @action Act\\<close>\n  for Act :: \\<open>'b::simplification action\\<close>\n  unfolding Imply_def Action_Tag_def\n  by (simp add: \\<phi>expns) *)\n\n\nparagraph \\<open>Implication \\& Action Rules\\<close>\n\nlemma \\<phi>Share_transformation:\n  \\<open> (x \\<Ztypecolon> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> U) \\<a>\\<n>\\<d> P\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> n \\<Znrres> U) \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def by (clarsimp simp add: \\<phi>expns; blast)\n\nlemma [\\<phi>reason 1010]:\n  \\<open> (x \\<Ztypecolon> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> U) \\<a>\\<n>\\<d> P\n\\<Longrightarrow> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> n = n'\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> n' \\<Znrres> U) \\<a>\\<n>\\<d> P\\<close>\n  using \\<phi>Share_transformation by (simp add: Premise_def)\n\nlemma [\\<phi>reason 1000]:\n  \\<open> (x \\<Ztypecolon> n * m \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> P\n\\<Longrightarrow> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> 0 < n \\<and> 0 < m\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> m \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> P\\<close>\n  unfolding Premise_def by simp\n\nlemma [\\<phi>reason 1000]:\n  \\<open> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> n * m \\<Znrres> T) \\<a>\\<n>\\<d> P\n\\<Longrightarrow> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> 0 < n \\<and> 0 < m\n\\<Longrightarrow> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> n \\<Znrres> m \\<Znrres> T) \\<a>\\<n>\\<d> P\\<close>\n  for T :: \\<open>('a::share_semimodule_sep,'b) \\<phi>\\<close>\n  unfolding Premise_def by simp\n\nlemma [\\<phi>reason 1000]:\n  \\<open> (x \\<Ztypecolon> k \\<^bold>\\<rightarrow> n \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> P\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> k \\<^bold>\\<rightarrow> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> P\\<close>\n  for T :: \\<open>('a::share_one,'b) \\<phi>\\<close>\n  unfolding \\<phi>Share_\\<phi>MapAt .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> k \\<^bold>\\<rightarrow> n \\<Znrres> T) \\<a>\\<n>\\<d> P\n\\<Longrightarrow> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> n \\<Znrres> k \\<^bold>\\<rightarrow> T) \\<a>\\<n>\\<d> P\\<close>\n  for T :: \\<open>('a::share_one,'b) \\<phi>\\<close>\n  unfolding \\<phi>Share_\\<phi>MapAt .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> (x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ n \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> P\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> k \\<^bold>\\<rightarrow>\\<^sub>@ T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> P\\<close>\n  for T :: \\<open>('k list \\<Rightarrow> 'a::share_one, 'b) \\<phi>\\<close>\n  unfolding \\<phi>Share_\\<phi>MapAt_L .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> k \\<^bold>\\<rightarrow>\\<^sub>@ n \\<Znrres> T) \\<a>\\<n>\\<d> P\n\\<Longrightarrow> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> n \\<Znrres> k \\<^bold>\\<rightarrow>\\<^sub>@ T) \\<a>\\<n>\\<d> P\\<close>\n  for T :: \\<open>('k list \\<Rightarrow> 'a::share_one, 'b) \\<phi>\\<close>\n  unfolding \\<phi>Share_\\<phi>MapAt_L .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> n \\<Znrres> T \\<^emph> n \\<Znrres> U) \\<a>\\<n>\\<d> P\n\\<Longrightarrow> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> n \\<Znrres> (T \\<^emph> U)) \\<a>\\<n>\\<d> P\\<close>\n  for T :: \\<open>('a::share_semimodule_sep,'b) \\<phi>\\<close>\n  unfolding \\<phi>Share_\\<phi>Prod .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> (x \\<Ztypecolon> n \\<Znrres> T \\<^emph> n \\<Znrres> U) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> P\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> (T \\<^emph> U)) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> P\\<close>\n  for T :: \\<open>('a::share_semimodule_sep,'b) \\<phi>\\<close>\n  unfolding \\<phi>Share_\\<phi>Prod .\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<r>Clean (x \\<Ztypecolon> T)\n\\<Longrightarrow> \\<r>Clean (x \\<Ztypecolon> n \\<Znrres> T)\\<close>\n  for T :: \\<open>('a::share_semimodule_mult, 'b) \\<phi>\\<close>\n  unfolding \\<r>Clean_def Imply_def apply (simp add: \\<phi>expns)\n  using share_right_one by blast\n\n\nparagraph \\<open>Action Rules\\<close>\n\nlemma [\\<phi>reason 1200]:\n  \\<open> (x \\<Ztypecolon> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> U) \\<a>\\<n>\\<d> P @action \\<A>_structural Act\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> n \\<Znrres> U) \\<a>\\<n>\\<d> P @action \\<A>_structural Act\\<close>\n  unfolding Action_Tag_def using \\<phi>Share_transformation .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> (x \\<Ztypecolon> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> U) \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> n \\<Znrres> U) \\<a>\\<n>\\<d> P @action to Z\\<close>\n  unfolding Action_Tag_def using \\<phi>Share_transformation .\n\nlemma [\\<phi>reason 1100]:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> n' = n\n\\<Longrightarrow> (x \\<Ztypecolon> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> U) \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> n \\<Znrres> U) \\<a>\\<n>\\<d> P @action to (n' \\<Znrres> Z)\\<close>\n  unfolding Action_Tag_def using \\<phi>Share_transformation .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> (x \\<Ztypecolon> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> U) \\<a>\\<n>\\<d> P @action as Z\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> n \\<Znrres> U) \\<a>\\<n>\\<d> P @action as Z\\<close>\n  unfolding Action_Tag_def using \\<phi>Share_transformation .\n\nlemma [\\<phi>reason 1100]:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> n' = n\n\\<Longrightarrow> (x \\<Ztypecolon> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> U) \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> Z)\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (y \\<Ztypecolon> n \\<Znrres> U) \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> n' \\<Znrres> Z)\\<close>\n  unfolding Action_Tag_def using \\<phi>Share_transformation .\n\n\nparagraph \\<open>Simplifications\\<close>\n\nlemma [simp]:\n  \\<open>(n \\<Znrres> ExTyp T) = (\\<exists>\\<phi> c. n \\<Znrres> T c)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma [simp]:\n  \\<open>(n \\<Znrres> (T \\<phi>\\<s>\\<u>\\<b>\\<j> P)) = (n \\<Znrres> T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\n\nlemma \\<phi>Share_simp_cong[folded atomize_eq]:\n  \\<open> (x \\<Ztypecolon> T) = (x' \\<Ztypecolon> T')\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> T) = (x' \\<Ztypecolon> n \\<Znrres> T')\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>expns)\n\nsimproc_setup \\<phi>Share_simp_cong (\"x \\<Ztypecolon> n \\<Znrres> T\") = \\<open>\n  K (fn ctxt => Phi_SimpCong.simproc @{thm \\<phi>Share_simp_cong} ctxt)\n\\<close>\n\n\nsubparagraph \\<open>Permission\\<close>\n\nlemma share_split_\\<phi>app:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> 0 < n \\<and> 0 < m\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical T\n\\<Longrightarrow> (x \\<Ztypecolon> n+m \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> n \\<Znrres> T) * (x \\<Ztypecolon> m \\<Znrres> T)\\<close>\n  for T :: \\<open>('a::share_semimodule_sep,'b) \\<phi>\\<close>\n  by (simp add: \\<phi>Share_share implies_refl Premise_def)\n\nlemma share_merge_\\<phi>app:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> 0 < n \\<and> 0 < m\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical T\n\\<Longrightarrow> (x \\<Ztypecolon> n \\<Znrres> T) * (x \\<Ztypecolon> m \\<Znrres> T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> n+m \\<Znrres> T)\\<close>\n  for T :: \\<open>('a::share_semimodule_sep,'b) \\<phi>\\<close>\n  by (simp add: \\<phi>Share_share implies_refl Premise_def)\n\n\nsubsubsection \\<open>\\<phi>-Some\\<close>\n\ndefinition \\<phi>Some :: \\<open>('v, 'x) \\<phi> \\<Rightarrow> ('v option, 'x) \\<phi>\\<close> (\"\\<black_circle> _\" [91] 90)\n  where \\<open>\\<phi>Some T = (\\<lambda>x. { Some v |v. v \\<in> (x \\<Ztypecolon> T) })\\<close>\n\nabbreviation \\<phi>Share_Some (\"\\<fish_eye> _\" [91] 90)\n  where \\<open>\\<phi>Share_Some T \\<equiv> \\<phi>perm_ins_homo to_share (\\<phi>Some T)\\<close>\n\nabbreviation \\<phi>Share_Some_L (\"\\<fish_eye>\\<^sub>L _\" [91] 90)\n  where \\<open>\\<phi>Share_Some_L T \\<equiv> [] \\<^bold>\\<rightarrow> \\<phi>perm_ins_homo to_share (\\<phi>Some T)\\<close>\n\n\\<phi>adhoc_overloading \\<phi>coercion \\<phi>Some \\<phi>Share_Some \\<phi>Share_Some_L\n\nlemma \\<phi>Some_expn[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> \\<phi>Some T) \\<longleftrightarrow> (\\<exists>v. p = Some v \\<and> v \\<in> (x \\<Ztypecolon> T))\\<close>\n  unfolding \\<phi>Type_def \\<phi>Some_def by simp\n\nlemma \\<phi>Some_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> \\<phi>Some T) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns)\n\nparagraph \\<open>Implication \\& Action Rules\\<close>\n\nlemma \\<phi>Some_cast[\\<phi>reason 2000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> \\<black_circle> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<black_circle> U \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def by (clarsimp simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 2000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\n\\<Longrightarrow> x \\<Ztypecolon> \\<black_circle> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<black_circle> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\\<close>\n  unfolding Action_Tag_def using \\<phi>Some_cast .\n\nlemma [\\<phi>reason 2000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> \\<black_circle> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<black_circle> U \\<a>\\<n>\\<d> P @action to Z \\<close>\n  unfolding Action_Tag_def using \\<phi>Some_cast .\n\nlemma [\\<phi>reason 1100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> \\<black_circle> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<black_circle> U \\<a>\\<n>\\<d> P @action to (\\<black_circle> Z) \\<close>\n  unfolding Action_Tag_def using \\<phi>Some_cast .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> Z)\n\\<Longrightarrow> x \\<Ztypecolon> \\<black_circle> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<black_circle> U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> Z) \\<close>\n  unfolding Action_Tag_def using \\<phi>Some_cast .\n\nlemma [\\<phi>reason 1100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> Z)\n\\<Longrightarrow> x \\<Ztypecolon> \\<black_circle> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<black_circle> U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> \\<black_circle> Z) \\<close>\n  unfolding Action_Tag_def using \\<phi>Some_cast .\n\n\nlemma [simp]:\n  \\<open>(\\<black_circle> ExTyp T) = (\\<exists>\\<phi> c. \\<black_circle> T c)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma [simp]:\n  \\<open>(\\<black_circle> (T \\<phi>\\<s>\\<u>\\<b>\\<j> P)) = (\\<black_circle> T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma \\<phi>Some_simp_cong[folded atomize_eq]:\n  \\<open> (x \\<Ztypecolon> T) = (x' \\<Ztypecolon> T')\n\\<Longrightarrow> (x \\<Ztypecolon> \\<black_circle> T) = (x' \\<Ztypecolon> \\<black_circle> T')\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>expns)\n\nsimproc_setup \\<phi>Some_simp_cong (\"x \\<Ztypecolon> \\<black_circle> T\") = \\<open>\n  K (fn ctxt => Phi_SimpCong.simproc @{thm \\<phi>Some_simp_cong} ctxt)\n\\<close>\n\nlemma [\\<phi>reason 1200]:\n  \\<open> v \\<Ztypecolon> Identity \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> v' \\<Ztypecolon> T \\<a>\\<n>\\<d> P\n\\<Longrightarrow> Some v \\<Ztypecolon> Identity \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> v' \\<Ztypecolon> \\<black_circle> T \\<a>\\<n>\\<d> P\\<close>\n  by (clarsimp simp add: \\<phi>expns Imply_def)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> is_functional (x \\<Ztypecolon> T)\n\\<Longrightarrow> is_functional (x \\<Ztypecolon> \\<black_circle> T)\\<close>\n  by (clarsimp simp add: \\<phi>expns is_functional_def)\n\n\nsubsubsection \\<open>\\<phi>Sep_Disj\\<close>\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj X Y\n\\<Longrightarrow> \\<phi>Sep_Disj X (m \\<Znrres> Y)\\<close>\n  for X :: \\<open>('a::share_sep_disj,'b) \\<phi>\\<close>\n  unfolding \\<phi>Sep_Disj_def by (clarsimp simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj Y X\n\\<Longrightarrow> \\<phi>Sep_Disj (m \\<Znrres> Y) X\\<close>\n  for X :: \\<open>('a::share_sep_disj,'b) \\<phi>\\<close>\n  unfolding \\<phi>Sep_Disj_def by (clarsimp simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1200]:\n  \\<open>\\<phi>Sep_Disj X \\<phi>None\\<close>\n  for X :: \\<open>('a::sep_magma_1, 'b) \\<phi>\\<close>\n  unfolding \\<phi>Sep_Disj_def by (simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1200]:\n  \\<open>\\<phi>Sep_Disj \\<phi>None X\\<close>\n  for X :: \\<open>('a::sep_magma_1, 'b) \\<phi>\\<close>\n  unfolding \\<phi>Sep_Disj_def by (simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<s>\\<i>\\<m>\\<p>\\<r>\\<e>\\<m> k1 \\<noteq> k2\n||| \\<phi>Sep_Disj T U\n\\<Longrightarrow> \\<phi>Sep_Disj (k1 \\<^bold>\\<rightarrow> T) (k2 \\<^bold>\\<rightarrow> U)\\<close>\n  for T :: \\<open>('a::sep_magma_1, 'b) \\<phi>\\<close>\n  unfolding \\<phi>Sep_Disj_def atomize_Branch\n  by (clarsimp simp add: \\<phi>expns sep_disj_fun_def)+\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<s>\\<i>\\<m>\\<p>\\<r>\\<e>\\<m> k1 \\<noteq> k2\n||| \\<phi>Sep_Disj T U\n\\<Longrightarrow> \\<phi>Sep_Disj (k1 \\<^bold>\\<rightarrow>\\<^sub># T) (k2 \\<^bold>\\<rightarrow>\\<^sub># U)\\<close>\n  for T :: \\<open>('k list \\<Rightarrow> 'a::sep_magma_1, 'b) \\<phi>\\<close>\n  unfolding \\<phi>Sep_Disj_def atomize_Branch\n  by (clarsimp simp add: \\<phi>expns sep_disj_fun_def push_map_def)+\n\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj X A\n\\<Longrightarrow> \\<phi>Sep_Disj X B\n\\<Longrightarrow> \\<phi>Sep_Disj X (A \\<^emph> B) \\<close>\n  for X :: \\<open>('a::sep_disj_intuitive, 'b) \\<phi>\\<close>\n  unfolding \\<phi>Sep_Disj_def\n  by (clarsimp simp add: \\<phi>expns sep_disj_fun_def)\n\nlemma [\\<phi>reason 1300]:\n  \\<open> \\<phi>Sep_Disj X Z\n\\<Longrightarrow> \\<phi>Sep_Disj Y Z\n\\<Longrightarrow> \\<phi>Sep_Disj (X \\<^emph> Y) Z \\<close>\n  for X :: \\<open>('a::sep_disj_intuitive, 'b) \\<phi>\\<close>\n  unfolding \\<phi>Sep_Disj_def\n  by (clarsimp simp add: \\<phi>expns sep_disj_fun_def)\n\n\nsubsubsection \\<open>\\<phi>Sep_Disj_Identical\\<close>\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj_Identical T\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical (n \\<Znrres> T)\\<close>\n  unfolding \\<phi>Sep_Disj_Identical_def\n  apply (clarsimp simp add: \\<phi>expns)\n  by force\n\nlemma \\<phi>Sep_Disj_Identical_\\<phi>MapAt[\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj_Identical T\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical (k \\<^bold>\\<rightarrow> T)\\<close>\n  unfolding \\<phi>Sep_Disj_Identical_def\n  apply (clarsimp simp add: \\<phi>expns)\n  by force\n\nlemma \\<phi>Sep_Disj_Identical_\\<phi>MapAt_L[\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj_Identical T\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical (k \\<^bold>\\<rightarrow>\\<^sub>@ T)\\<close>\n  unfolding \\<phi>Sep_Disj_Identical_def\n  apply (clarsimp simp add: \\<phi>expns)\n  using push_map_sep_disj by blast\n\nlemma \\<phi>Sep_Disj_Identical_Prod[\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj_Identical T\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical U\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical (T \\<^emph> U)\\<close>\n  unfolding \\<phi>Sep_Disj_Identical_def\n  apply (clarsimp simp add: \\<phi>expns)\n  by (metis self_disj_I sep_disj_commute sep_disj_multD2 sep_mult_commute)\n\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj_Identical (\\<phi>perm_ins_homo f T)\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical (\\<phi>perm_ins_homo ((o) f) (k \\<^bold>\\<rightarrow> T)) \\<close>\n  by (subst \\<phi>perm_ins_homo_MapAt; rule \\<phi>Sep_Disj_Identical_\\<phi>MapAt)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj_Identical (\\<phi>perm_ins_homo ((o) f) T)\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical (\\<phi>perm_ins_homo ((o) f) (k \\<^bold>\\<rightarrow>\\<^sub>@ T)) \\<close>\n  by (subst \\<phi>perm_ins_homo_MapAt_L; rule \\<phi>Sep_Disj_Identical_\\<phi>MapAt_L)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj_Identical (\\<phi>perm_ins_homo f T)\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical (\\<phi>perm_ins_homo f U)\n\\<Longrightarrow> \\<phi>Sep_Disj_Identical (\\<phi>perm_ins_homo f (T \\<^emph> U)) \\<close>\n  unfolding \\<phi>Sep_Disj_Identical_def\n  by (smt (verit) Imply_def \\<phi>Sep_Disj_Identical_Prod \\<phi>Sep_Disj_Identical_def \\<phi>perm_ins_homo_Prod_imply)\n\nlemma [\\<phi>reason 1200]:\n  \\<open>\\<phi>Sep_Disj_Identical (\\<phi>perm_ins_homo to_share (\\<phi>Some T))\\<close>\n  unfolding \\<phi>Sep_Disj_Identical_def\n  by (clarsimp simp add: \\<phi>expns; rule; clarsimp)\n\nlemma [\\<phi>reason 1200]:\n  \\<open>\\<phi>Sep_Disj_Identical (\\<phi>perm_ins_homo to_share \\<phi>None)\\<close>\n  unfolding \\<phi>Sep_Disj_Identical_def\n  by (clarsimp simp add: \\<phi>expns; rule; clarsimp)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<phi>Sep_Disj_Identical (\\<phi>None :: ('a::share_module_sep,unit) \\<phi>) \\<close>\n  unfolding \\<phi>Sep_Disj_Identical_def\n  by (clarsimp simp add: \\<phi>expns)\n\n\nsubsection \\<open>Agreement\\<close>\n\ndefinition Agreement :: \\<open>('T, 'x) \\<phi> \\<Rightarrow> ('T agree option, 'x) \\<phi>\\<close>\n  where \\<open>Agreement T x = { Some (agree v) |v. v \\<in> (x \\<Ztypecolon> T) }\\<close>\n\nlemma Agreement_expns[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> Agreement T) \\<longleftrightarrow> (\\<exists>v. p = Some (agree v) \\<and> v \\<in> (x \\<Ztypecolon> T))\\<close>\n  unfolding \\<phi>Type_def Agreement_def by simp\n\nlemma Agreement_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> Agreement T) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns)\n\nlemma Agreement_times:\n  \\<open>(w \\<Ztypecolon> Agreement W) * (x \\<Ztypecolon> Agreement T) = ((w,x) \\<Ztypecolon> Agreement (W \\<inter>\\<^sub>\\<phi> T))\\<close>\n  unfolding set_eq_iff\n  apply (clarsimp simp add: \\<phi>expns; rule; clarsimp)\n  subgoal for v\n    by (rule exI[where x=\\<open>Some (agree v)\\<close>]; rule exI[where x=\\<open>Some (agree v)\\<close>]; simp) .\n\nparagraph \\<open>Conversion\\<close>\n\nlemma [simp]:\n  \\<open>Agreement (T \\<phi>\\<s>\\<u>\\<b>\\<j> P) = (Agreement T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma [simp]:\n  \\<open>Agreement (ExTyp T) = (\\<exists>\\<phi>c. Agreement (T c))\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nparagraph \\<open>Rule\\<close>\n\nlemma Agreement_cast[\\<phi>reason 2000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> Agreement T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Agreement U \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def\n  by (clarsimp simp add: \\<phi>expns)\n\nlemma Agreement_dup[\n  \\<phi>reason 1200 for \\<open>?x \\<Ztypecolon> Agreement ?T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?U \\<a>\\<n>\\<d> ?P @action action_dup\\<close>,\n  unfolded Action_Tag_def,\n  \\<phi>reason for \\<open>?x \\<Ztypecolon> Agreement ?T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (?x \\<Ztypecolon> Agreement ?T) * (?x \\<Ztypecolon> Agreement ?T) \\<a>\\<n>\\<d> ?P\\<close>\n]:\n  \\<open> x \\<Ztypecolon> Agreement T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (x \\<Ztypecolon> Agreement T) * (x \\<Ztypecolon> Agreement T) @action action_dup\\<close>\n  unfolding Imply_def Action_Tag_def\n  apply (clarsimp simp add: \\<phi>expns)\n  subgoal for v by (rule exI[where x=\\<open>Some (agree v)\\<close>]; rule exI[where x=\\<open>Some (agree v)\\<close>]; simp) .\n\nlemma Agreement_shrink[\n  \\<phi>reason 1200 for \\<open>(?x \\<Ztypecolon> Agreement ?T) * (?x \\<Ztypecolon> Agreement ?T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?U \\<a>\\<n>\\<d> ?P @action action_shrink\\<close>,\n  unfolded Action_Tag_def,\n  \\<phi>reason for \\<open>(?x \\<Ztypecolon> Agreement ?T) * (?x \\<Ztypecolon> Agreement ?T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?x \\<Ztypecolon> Agreement ?T \\<a>\\<n>\\<d> ?P\\<close>\n]:\n  \\<open> (x \\<Ztypecolon> Agreement T) * (x \\<Ztypecolon> Agreement T) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> Agreement T @action action_shrink \\<close>\n  unfolding Imply_def Action_Tag_def\n  by (clarsimp simp add: \\<phi>expns)\n\n\nlemma [\\<phi>reason 1200]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\n\\<Longrightarrow> x \\<Ztypecolon> Agreement T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Agreement U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\\<close>\n  unfolding Action_Tag_def using Agreement_cast .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> Agreement T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Agreement U \\<a>\\<n>\\<d> P @action to Z\\<close>\n  unfolding Action_Tag_def using Agreement_cast .\n\nlemma [\\<phi>reason 1100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> Agreement T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Agreement U \\<a>\\<n>\\<d> P @action to (Agreement Z)\\<close>\n  unfolding Action_Tag_def using Agreement_cast .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action as Z\n\\<Longrightarrow> x \\<Ztypecolon> Agreement T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Agreement U \\<a>\\<n>\\<d> P @action as Z\\<close>\n  unfolding Action_Tag_def using Agreement_cast .\n\nlemma [\\<phi>reason 1100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> Z)\n\\<Longrightarrow> x \\<Ztypecolon> Agreement T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Agreement U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> Agreement Z)\\<close>\n  unfolding Action_Tag_def using Agreement_cast .\n\n\nsubsection \\<open>Nosep\\<close>\n\ndefinition Nosep :: \\<open>('T, 'x) \\<phi> \\<Rightarrow> ('T nosep, 'x) \\<phi>\\<close>\n  where \\<open>Nosep T x = nosep ` (x \\<Ztypecolon> T)\\<close>\n\n\\<phi>adhoc_overloading \\<phi>coercion \\<open>\\<lambda>T. \\<black_circle> Nosep T\\<close> \\<open>\\<lambda>T. \\<fish_eye> Nosep T\\<close> \\<open>\\<lambda>T. \\<fish_eye>\\<^sub>L Nosep T\\<close>\n\n(*TODO: give a configure flag to control this sugar*)\ntranslations\n  \"\\<coercion> T\" <= \"\\<fish_eye> CONST Nosep T\"\n\nlemma Nosep_expns[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> Nosep T) \\<longleftrightarrow> (\\<exists>v. p = nosep v \\<and> v \\<in> (x \\<Ztypecolon> T))\\<close>\n  unfolding \\<phi>Type_def Nosep_def by blast\n\nlemma Nosep_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> Nosep T) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns)\n\nparagraph \\<open>Conversion\\<close>\n\nlemma [simp]:\n  \\<open>Nosep (T \\<phi>\\<s>\\<u>\\<b>\\<j> P) = (Nosep T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma [simp]:\n  \\<open>Nosep (ExTyp T) = (\\<exists>\\<phi>c. Nosep (T c))\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\n\nparagraph \\<open>Rule\\<close>\n\nlemma Nosep_cast[\\<phi>reason 2000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> Nosep T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Nosep U \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def\n  by (clarsimp simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 2000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\n\\<Longrightarrow> x \\<Ztypecolon> Nosep T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Nosep U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\\<close>\n  unfolding Action_Tag_def using Nosep_cast .\n\nlemma [\\<phi>reason 2000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> Nosep T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Nosep U \\<a>\\<n>\\<d> P @action to Z\\<close>\n  unfolding Action_Tag_def using Nosep_cast .\n\nlemma [\\<phi>reason 1100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> Nosep T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Nosep U \\<a>\\<n>\\<d> P @action to (Nosep Z)\\<close>\n  unfolding Action_Tag_def using Nosep_cast .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action as Z\n\\<Longrightarrow> x \\<Ztypecolon> Nosep T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Nosep U \\<a>\\<n>\\<d> P @action as Z\\<close>\n  unfolding Action_Tag_def using Nosep_cast .\n\nlemma [\\<phi>reason 1100]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> Z)\n\\<Longrightarrow> x \\<Ztypecolon> Nosep T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Nosep U \\<a>\\<n>\\<d> P @action as (z \\<Ztypecolon> Nosep Z)\\<close>\n  unfolding Action_Tag_def using Nosep_cast .\n\nlemma [\\<phi>reason 1200 for \\<open>_ \\<Ztypecolon> Nosep _ \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> _ \\<Ztypecolon> Identity \\<a>\\<n>\\<d> _\\<close>]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> Identity \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> Nosep T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> nosep y \\<Ztypecolon> Identity \\<a>\\<n>\\<d> P \\<close>\n  unfolding Imply_def \n  by (clarsimp simp add: Nosep_expns Identity_expn)\n\n\nsection \\<open>Specifc Structures\\<close>\n\nsubsection \\<open>Potentially Uninitialized Structure\\<close>\n\ndatatype 'V uninit = initialized 'V | uninitialized\n\ninstantiation uninit :: (nonsepable_semigroup) nonsepable_semigroup begin\ndefinition \\<open>sep_disj_uninit (x::'a uninit) (y::'a uninit) \\<longleftrightarrow> False\\<close>\ninstance apply standard unfolding sep_disj_uninit_def by simp_all\nend\n\nparagraph \\<open>Definition\\<close>\n\ntext \\<open>\\<phi>MayInit T relates a value with T if the value is initialized; or if not, it relates the zero\n  value of that type with T.\\<close>\n\ndefinition \\<phi>MayInit :: \\<open>TY \\<Rightarrow> (VAL, 'x) \\<phi> \\<Rightarrow> (VAL uninit, 'x) \\<phi>\\<close>\n  where \\<open>\\<phi>MayInit TY T x = ({uninitialized} \\<s>\\<u>\\<b>\\<j> (\\<exists>z. Zero TY = Some z \\<and> z \\<in> (x \\<Ztypecolon> T))) + initialized ` (x \\<Ztypecolon> T <of-type> TY)\\<close>\n\n(* abbreviation \\<phi>Share_Some_Init (\"\\<fish_eye>\\<lbrakk>_\\<rbrakk> _\" [0, 91] 90)\n  where \\<open>\\<phi>Share_Some_Init TY T \\<equiv> \\<fish_eye> \\<phi>MayInit TY T\\<close> *)\n\nlemma \\<phi>MayInit_expn[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> \\<phi>MayInit TY T) \\<longleftrightarrow> (p = uninitialized \\<and> (\\<exists>z. Zero TY = Some z \\<and> z \\<in> (x \\<Ztypecolon> T)) \\<or> (\\<exists>v. p = initialized v \\<and> v \\<in> (x \\<Ztypecolon> T <of-type> TY)))\\<close>\n  unfolding \\<phi>Type_def \\<phi>MayInit_def by (simp add: \\<phi>expns, blast)\n\nlemma \\<phi>MayInit_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> \\<phi>MayInit TY T) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns, blast)\n\nparagraph \\<open>Conversions\\<close>\n\nlemma [simp]:\n  \\<open>\\<phi>MayInit TY (T \\<phi>\\<s>\\<u>\\<b>\\<j> P) = (\\<phi>MayInit TY T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  by (rule \\<phi>Type_eqI; simp add: \\<phi>expns; blast)\n\nlemma [simp]:\n  \\<open>\\<phi>MayInit TY (ExTyp T) = (\\<exists>\\<phi> c. \\<phi>MayInit TY (T c))\\<close>\n  by (rule \\<phi>Type_eqI; simp add: \\<phi>expns; blast)\n\nparagraph \\<open>Rules\\<close>\n\n(*TODO: improve this*)\nlemma \\<phi>MayInit_cast[\\<phi>reason for \\<open>?x \\<Ztypecolon> \\<phi>MayInit ?TY ?T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?y \\<Ztypecolon> \\<phi>MayInit ?TY' ?U \\<a>\\<n>\\<d> ?P\\<close>]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>MayInit TY T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi>MayInit TY U \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def by (clarsimp simp add: \\<phi>expns; rule; clarsimp)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>MayInit TY T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi>MayInit TY U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\\<close>\n  unfolding Action_Tag_def using \\<phi>MayInit_cast .\n\nlemma [\\<phi>reason 1000]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Z\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi>MayInit TY T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi>MayInit TY U \\<a>\\<n>\\<d> P @action to Z\\<close>\n  unfolding Action_Tag_def using \\<phi>MayInit_cast .\n\n\ndefinition \\<phi>Uninit :: \\<open>('v uninit, unit) \\<phi>\\<close>\n  where \\<open>\\<phi>Uninit x = {uninitialized}\\<close>\n\nlemma \\<phi>Uninit_expn[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> \\<phi>Uninit) \\<longleftrightarrow> p = uninitialized\\<close>\n  unfolding \\<phi>Type_def \\<phi>Uninit_def by simp\n\nlemma \\<phi>Uninit_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> \\<phi>Uninit) \\<Longrightarrow> C \\<Longrightarrow> C\\<close> .\n\n\nsection \\<open>Misc.\\<close>\n\nsubsection \\<open>Forward Simulation\\<close>\n\ndefinition \\<phi>F_simulation\n    :: \\<open>('av,'a) \\<phi> \\<Rightarrow> ('bv,'b) \\<phi> \\<Rightarrow> (('av \\<times> 'bv) set, ('a \\<times> 'b) set) \\<phi>\\<close> (infixr \"\\<Rrightarrow>\\<^sub>r\" 25)\n    \\<comment> \\<open>Forward Simulation\\<close>\n  where \\<open>(T \\<Rrightarrow>\\<^sub>r U) = (\\<lambda>f. { g. \\<forall>v x. v \\<in> (x \\<Ztypecolon> T) \\<longrightarrow> (\\<exists>u y. (v,u) \\<in> g \\<and> (x,y) \\<in> f \\<and> u \\<in> (y \\<Ztypecolon> U)) })\\<close>\n\nend\n", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_System/Phi_Types.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3389932470008315}}
{"text": "(*\n * Copyright 2023, Proofcraft Pty Ltd\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* Total correctness Hoare logic for the NonDetMonad (= valid + no_fail) *)\n\ntheory NonDetMonad_Total\n  imports No_Fail\nbegin\n\nsection \\<open>Total correctness for NonDetMonad and NonDetMonad with exceptions\\<close>\n\nsubsection Definitions\n\ntext \\<open>\n  It is often desired to prove non-failure and a Hoare triple simultaneously, as the reasoning\n  is often similar. The following definitions allow such reasoning to take place.\\<close>\n\ndefinition validNF ::\n  \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) nondet_monad \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\" (\"\\<lbrace>_\\<rbrace>/ _ /\\<lbrace>_\\<rbrace>!\") where\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>! \\<equiv> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<and> no_fail P f\"\n\nlemma validNF_alt_def:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>! = (\\<forall>s. P s \\<longrightarrow> ((\\<forall>(r', s') \\<in> fst (f s). Q r' s') \\<and> \\<not> snd (f s)))\"\n  by (fastforce simp: validNF_def valid_def no_fail_def)\n\ndefinition validE_NF ::\n  \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'a + 'b) nondet_monad \\<Rightarrow> ('b \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  (\"\\<lbrace>_\\<rbrace>/ _ /(\\<lbrace>_\\<rbrace>,/ \\<lbrace>_\\<rbrace>!)\") where\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace>! \\<equiv> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace> \\<and> no_fail P f\"\n\nlemma validE_NF_alt_def:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace>! = \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>v s. case v of Inl e \\<Rightarrow> E e s | Inr r \\<Rightarrow> Q r s\\<rbrace>!\"\n  by (clarsimp simp: validE_NF_def validE_def validNF_def)\n\n\nsubsection \\<open>@{method wpc} setup\\<close>\n\nlemma wpc_helper_validNF:\n  \"\\<lbrace>Q\\<rbrace> g \\<lbrace>S\\<rbrace>! \\<Longrightarrow> wpc_helper (P, P') (Q, Q') \\<lbrace>P\\<rbrace> g \\<lbrace>S\\<rbrace>!\"\n  unfolding wpc_helper_def\n  by clarsimp (metis hoare_vcg_precond_imp no_fail_pre validNF_def)\n\nwpc_setup \"\\<lambda>m. \\<lbrace>P\\<rbrace> m \\<lbrace>Q\\<rbrace>!\" wpc_helper_validNF\n\n\nsubsection \\<open>Basic @{const validNF} theorems\\<close>\n\nlemma validNF_make_schematic_post:\n  \"(\\<forall>s0. \\<lbrace> \\<lambda>s. P s0 s \\<rbrace> f \\<lbrace> \\<lambda>rv s. Q s0 rv s \\<rbrace>!) \\<Longrightarrow>\n   \\<lbrace> \\<lambda>s. \\<exists>s0. P s0 s \\<and> (\\<forall>rv s'. Q s0 rv s' \\<longrightarrow> Q' rv s') \\<rbrace> f \\<lbrace> Q' \\<rbrace>!\"\n  by (auto simp add: valid_def validNF_def no_fail_def split: prod.splits)\n\nlemma validE_NF_make_schematic_post:\n  \"(\\<forall>s0. \\<lbrace> \\<lambda>s. P s0 s \\<rbrace> f \\<lbrace> \\<lambda>rv s. Q s0 rv s \\<rbrace>, \\<lbrace> \\<lambda>rv s. E s0 rv s \\<rbrace>!) \\<Longrightarrow>\n   \\<lbrace> \\<lambda>s. \\<exists>s0. P s0 s \\<and> (\\<forall>rv s'. Q s0 rv s' \\<longrightarrow> Q' rv s')\n        \\<and> (\\<forall>rv s'. E s0 rv s' \\<longrightarrow> E' rv s') \\<rbrace> f \\<lbrace> Q' \\<rbrace>, \\<lbrace> E' \\<rbrace>!\"\n  by (auto simp add: validE_NF_def validE_def valid_def no_fail_def split: prod.splits sum.splits)\n\nlemma validNF_conjD1:\n  \"\\<lbrace> P \\<rbrace> f \\<lbrace> \\<lambda>rv s. Q rv s \\<and> Q' rv s \\<rbrace>! \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>!\"\n  by (fastforce simp: validNF_def valid_def no_fail_def)\n\nlemma validNF_conjD2:\n  \"\\<lbrace> P \\<rbrace> f \\<lbrace> \\<lambda>rv s. Q rv s \\<and> Q' rv s \\<rbrace>! \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q' \\<rbrace>!\"\n  by (fastforce simp: validNF_def valid_def no_fail_def)\n\nlemma validNF[intro?]: (* FIXME lib: should be validNFI *)\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>; no_fail P f \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>!\"\n  by (clarsimp simp: validNF_def)\n\nlemma validNFE:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>!; \\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>; no_fail P f \\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  by (clarsimp simp: validNF_def)\n\nlemma validNF_valid:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  by (erule validNFE)\n\nlemma validNF_no_fail:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>! \\<rbrakk> \\<Longrightarrow> no_fail P f\"\n  by (erule validNFE)\n\nlemma snd_validNF:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>!; P s \\<rbrakk> \\<Longrightarrow> \\<not> snd (f s)\"\n  by (clarsimp simp: validNF_def no_fail_def)\n\nlemma use_validNF:\n  \"\\<lbrakk> (r', s') \\<in> fst (f s); \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>!; P s \\<rbrakk> \\<Longrightarrow> Q r' s'\"\n  by (fastforce simp: validNF_def valid_def)\n\n\nsubsection \\<open>@{const validNF} weakest precondition rules\\<close>\n\nlemma validNF_return[wp]:\n  \"\\<lbrace> P x \\<rbrace> return x \\<lbrace> P \\<rbrace>!\"\n  by (wp validNF)+\n\nlemma validNF_get[wp]:\n  \"\\<lbrace> \\<lambda>s. P s s  \\<rbrace> get \\<lbrace> P \\<rbrace>!\"\n  by (wp validNF)+\n\nlemma validNF_put[wp]:\n  \"\\<lbrace> \\<lambda>s. P () x  \\<rbrace> put x \\<lbrace> P \\<rbrace>!\"\n  by (wp validNF)+\n\nlemma validNF_K_bind[wp]:\n  \"\\<lbrace> P \\<rbrace> x \\<lbrace> Q \\<rbrace>! \\<Longrightarrow> \\<lbrace> P \\<rbrace> K_bind x f \\<lbrace> Q \\<rbrace>!\"\n  by simp\n\nlemma validNF_fail[wp]:\n  \"\\<lbrace> \\<lambda>s. False \\<rbrace> fail \\<lbrace> Q \\<rbrace>!\"\n  by (clarsimp simp: validNF_def fail_def no_fail_def)\n\nlemma validNF_prop[wp_unsafe]:\n  \"\\<lbrakk> no_fail (\\<lambda>s. P) f \\<rbrakk> \\<Longrightarrow> \\<lbrace> \\<lambda>s. P \\<rbrace> f \\<lbrace> \\<lambda>rv s. P \\<rbrace>!\"\n  by (wp validNF)+\n\nlemma validNF_post_conj[intro!]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> a \\<lbrace> Q \\<rbrace>!; \\<lbrace> P \\<rbrace> a \\<lbrace> R \\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> a \\<lbrace> Q and R \\<rbrace>!\"\n  by (auto simp: validNF_def)\n\nlemma validNF_pre_disj[intro!]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> a \\<lbrace> R \\<rbrace>!; \\<lbrace> Q \\<rbrace> a \\<lbrace> R \\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace> P or Q \\<rbrace> a \\<lbrace> R \\<rbrace>!\"\n  by (rule validNF) (auto dest: validNF_valid validNF_no_fail intro: no_fail_or)\n\ntext \\<open>\n  Set up combination rules for @{method wp}, which also requires a @{text wp_trip} rule for\n  @{const validNF}.\\<close>\ndefinition validNF_property :: \"('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> 's \\<Rightarrow> ('s,'a) nondet_monad \\<Rightarrow> bool\" where\n  \"validNF_property Q s b \\<equiv> \\<not> snd (b s) \\<and> (\\<forall>(r', s') \\<in> fst (b s). Q r' s')\"\n\nlemma validNF_is_triple[wp_trip]:\n  \"validNF P f Q = triple_judgement P f (validNF_property Q)\"\n  by (auto simp: validNF_def triple_judgement_def validNF_property_def no_fail_def valid_def)\n\nlemma validNF_weaken_pre[wp_pre]:\n  \"\\<lbrakk>\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>!; \\<And>s. P s \\<Longrightarrow> Q s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>!\"\n  by (metis hoare_pre_imp no_fail_pre validNF_def)\n\nlemma validNF_post_comb_imp_conj:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>!; \\<And>s. P s \\<Longrightarrow> P' s \\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>!\"\n  by (fastforce simp: validNF_def valid_def)\n\nlemma validNF_post_comb_conj_L:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace> \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s \\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>!\"\n  by (fastforce simp: validNF_def valid_def no_fail_def)\n\nlemma validNF_post_comb_conj_R:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s \\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>!\"\n  by (fastforce simp: validNF_def valid_def no_fail_def)\n\nlemma validNF_post_comb_conj:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q'\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s \\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>!\"\n  by (fastforce simp: validNF_def valid_def no_fail_def)\n\nlemma validNF_if_split[wp_split]:\n  \"\\<lbrakk>P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> f \\<lbrace>S\\<rbrace>!; \\<not> P \\<Longrightarrow> \\<lbrace>R\\<rbrace> g \\<lbrace>S\\<rbrace>!\\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. (P \\<longrightarrow> Q s) \\<and> (\\<not> P \\<longrightarrow> R s)\\<rbrace> if P then f else g \\<lbrace>S\\<rbrace>!\"\n  by simp\n\nlemma validNF_vcg_conj_lift:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>!; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>!\"\n  by (fastforce intro!: validNF_post_conj[unfolded pred_conj_def] intro: validNF_weaken_pre)\n\nlemma validNF_vcg_disj_lift:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>!; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<or> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<or> Q' rv s\\<rbrace>!\"\n  by (auto  simp: validNF_def no_fail_def intro!: hoare_vcg_disj_lift)\n\nlemma validNF_vcg_all_lift[wp]:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>P x\\<rbrace> f \\<lbrace>Q x\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. \\<forall>x. P x s\\<rbrace> f \\<lbrace>\\<lambda>rv s. \\<forall>x. Q x rv s\\<rbrace>!\"\n  by (auto simp: validNF_def no_fail_def intro!: hoare_vcg_all_lift)\n\nlemma validNF_bind[wp_split]:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>!; \\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>A\\<rbrace> do x \\<leftarrow> f; g x od \\<lbrace>C\\<rbrace>!\"\n  unfolding validNF_def\n  by (auto intro: hoare_seq_ext no_fail_bind[where P=Q and Q=Q for Q, simplified])\n\nlemmas validNF_seq_ext = validNF_bind\n\n\nsubsection \"validNF compound rules\"\n\nlemma validNF_state_assert[wp]:\n  \"\\<lbrace> \\<lambda>s. P () s \\<and> G s  \\<rbrace> state_assert G \\<lbrace> P \\<rbrace>!\"\n  by (rule validNF; wpsimp)\n\nlemma validNF_modify[wp]:\n  \"\\<lbrace> \\<lambda>s. P () (f s) \\<rbrace> modify f \\<lbrace> P \\<rbrace>!\"\n  by (rule validNF; wpsimp)\n\nlemma validNF_gets[wp]:\n  \"\\<lbrace>\\<lambda>s. P (f s) s\\<rbrace> gets f \\<lbrace>P\\<rbrace>!\"\n  by (rule validNF; wpsimp)\n\nlemma validNF_condition[wp]:\n  \"\\<lbrakk> \\<lbrace> Q \\<rbrace> A \\<lbrace>P\\<rbrace>!; \\<lbrace> R \\<rbrace> B \\<lbrace>P\\<rbrace>!\\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. if C s then Q s else R s\\<rbrace> condition C A B \\<lbrace>P\\<rbrace>!\"\n  by (erule validNFE)+\n     (rule validNF; wpsimp wp: no_fail_condition)\n\nlemma validNF_assert[wp]:\n  \"\\<lbrace> (\\<lambda>s. P) and (R ()) \\<rbrace> assert P \\<lbrace> R \\<rbrace>!\"\n  by (rule validNF; wpsimp)\n\nlemma validNF_false_pre:\n  \"\\<lbrace> \\<lambda>_. False \\<rbrace> P \\<lbrace> Q \\<rbrace>!\"\n  by (rule validNF; wpsimp)\n\nlemma validNF_chain:\n   \"\\<lbrakk>\\<lbrace>P'\\<rbrace> a \\<lbrace>R'\\<rbrace>!; \\<And>s. P s \\<Longrightarrow> P' s; \\<And>r s. R' r s \\<Longrightarrow> R r s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>!\"\n  by (fastforce simp: validNF_def valid_def no_fail_def Ball_def)\n\nlemma validNF_case_prod[wp]:\n  \"(\\<And>x y. \\<lbrace>P x y\\<rbrace> B x y \\<lbrace>Q\\<rbrace>!) \\<Longrightarrow> \\<lbrace>case v of (x, y) \\<Rightarrow> P x y\\<rbrace> case v of (x, y) \\<Rightarrow> B x y \\<lbrace>Q\\<rbrace>!\"\n  by (metis prod.exhaust split_conv)\n\nlemma validE_NF_case_prod[wp]:\n  \"\\<lbrakk> \\<And>a b. \\<lbrace>P a b\\<rbrace> f a b \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>case x of (a, b) \\<Rightarrow> P a b\\<rbrace> case x of (a, b) \\<Rightarrow> f a b \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  unfolding validE_NF_alt_def\n  by (erule validNF_case_prod)\n\nlemma no_fail_is_validNF_True:\n  \"no_fail P s = (\\<lbrace> P \\<rbrace> s \\<lbrace> \\<lambda>_ _. True \\<rbrace>!)\"\n  by (clarsimp simp: no_fail_def validNF_def valid_def)\n\n\nsubsection \\<open>@{const validNF} reasoning in the exception monad\\<close>\n\nlemma validE_NF[intro?]: (* FIXME lib: should be validE_NFI *)\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>; no_fail P f \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>!\"\n  by (clarsimp simp: validE_NF_def)\n\nlemma validE_NFE:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>!; \\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>; no_fail P f \\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  by (clarsimp simp: validE_NF_def)\n\nlemma validE_NF_valid:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>\"\n  by (rule validE_NFE)\n\nlemma validE_NF_no_fail:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>! \\<rbrakk> \\<Longrightarrow> no_fail P f\"\n  by (rule validE_NFE)\n\nlemma validE_NF_weaken_pre[wp_pre]:\n  \"\\<lbrakk>\\<lbrace>Q\\<rbrace> a \\<lbrace>R\\<rbrace>,\\<lbrace>E\\<rbrace>!; \\<And>s. P s \\<Longrightarrow> Q s\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> a \\<lbrace>R\\<rbrace>,\\<lbrace>E\\<rbrace>!\"\n  by (simp add: validE_NF_alt_def validNF_weaken_pre)\n\nlemma validE_NF_post_comb_conj_L:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace>!; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>, \\<lbrace>\\<lambda>_ _. True\\<rbrace> \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. P s \\<and> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  unfolding validE_NF_alt_def\n  by (fastforce simp: validE_def validNF_def valid_def no_fail_def split: sum.splits)\n\nlemma validE_NF_post_comb_conj_R:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>\\<lambda>_ _. True\\<rbrace>; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>, \\<lbrace>E\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. P s \\<and> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  unfolding validE_NF_alt_def validE_def validNF_def valid_def no_fail_def\n  by (fastforce split: sum.splits)\n\nlemma validE_NF_post_comb_conj:\n  \"\\<lbrakk> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace>!; \\<lbrace>P'\\<rbrace> f \\<lbrace>Q'\\<rbrace>, \\<lbrace>E\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>\\<lambda>s. P s \\<and> P' s\\<rbrace> f \\<lbrace>\\<lambda>rv s. Q rv s \\<and> Q' rv s\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  unfolding validE_NF_alt_def validE_def validNF_def valid_def no_fail_def\n  by (fastforce split: sum.splits)\n\nlemma validE_NF_chain:\n  \"\\<lbrakk> \\<lbrace>P'\\<rbrace> a \\<lbrace>R'\\<rbrace>,\\<lbrace>E'\\<rbrace>!; \\<And>s. P s \\<Longrightarrow> P' s; \\<And>r' s'. R' r' s' \\<Longrightarrow> R r' s';\n     \\<And>r'' s''. E' r'' s'' \\<Longrightarrow> E r'' s''\\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. P s \\<rbrace> a \\<lbrace>\\<lambda>r' s'. R r' s'\\<rbrace>,\\<lbrace>\\<lambda>r'' s''. E r'' s''\\<rbrace>!\"\n  by (fastforce simp: validE_NF_def validE_def2 no_fail_def Ball_def split: sum.splits)\n\nlemma validE_NF_bind_wp[wp]:\n  \"\\<lbrakk>\\<And>x. \\<lbrace>B x\\<rbrace> g x \\<lbrace>C\\<rbrace>, \\<lbrace>E\\<rbrace>!; \\<lbrace>A\\<rbrace> f \\<lbrace>B\\<rbrace>, \\<lbrace>E\\<rbrace>!\\<rbrakk> \\<Longrightarrow> \\<lbrace>A\\<rbrace> f >>=E (\\<lambda>x. g x) \\<lbrace>C\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  by (blast intro: validE_NF hoare_vcg_seqE no_fail_pre no_fail_bindE validE_validE_R validE_weaken\n            elim!: validE_NFE)\n\nlemma validNF_catch[wp]:\n  \"\\<lbrakk>\\<And>x. \\<lbrace>E x\\<rbrace> handler x \\<lbrace>Q\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>E\\<rbrace>!\\<rbrakk> \\<Longrightarrow> \\<lbrace>P\\<rbrace> f <catch> (\\<lambda>x. handler x) \\<lbrace>Q\\<rbrace>!\"\n  unfolding validE_NF_alt_def catch_def lift_def throwError_def\n  by (clarsimp simp: validNF_return split: sum.splits elim!: validNF_bind[rotated])\n\nlemma validNF_throwError[wp]:\n  \"\\<lbrace>E e\\<rbrace> throwError e \\<lbrace>P\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  by (unfold validE_NF_alt_def throwError_def o_def) wpsimp\n\nlemma validNF_returnOk[wp]:\n  \"\\<lbrace>P e\\<rbrace> returnOk e \\<lbrace>P\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  by (clarsimp simp: validE_NF_alt_def returnOk_def) wpsimp\n\nlemma validNF_whenE[wp]:\n  \"(P \\<Longrightarrow> \\<lbrace>Q\\<rbrace> f \\<lbrace>R\\<rbrace>, \\<lbrace>E\\<rbrace>!) \\<Longrightarrow> \\<lbrace>if P then Q else R ()\\<rbrace> whenE P f \\<lbrace>R\\<rbrace>, \\<lbrace>E\\<rbrace>!\"\n  unfolding whenE_def by wpsimp\n\nlemma validNF_nobindE[wp]:\n  \"\\<lbrakk> \\<lbrace>B\\<rbrace> g \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>!; \\<lbrace>A\\<rbrace> f \\<lbrace>\\<lambda>r s. B s\\<rbrace>,\\<lbrace>E\\<rbrace>! \\<rbrakk> \\<Longrightarrow> \\<lbrace>A\\<rbrace> doE f; g odE \\<lbrace>C\\<rbrace>,\\<lbrace>E\\<rbrace>!\"\n  by wpsimp\n\ntext \\<open>\n  Set up triple rules for @{term validE_NF} so that we can use @{method wp} combinator rules.\\<close>\ndefinition validE_NF_property ::\n  \"('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('c \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> 's \\<Rightarrow> ('s, 'c+'a) nondet_monad \\<Rightarrow> bool\" where\n  \"validE_NF_property Q E s b \\<equiv>\n   \\<not> snd (b s) \\<and> (\\<forall>(r', s') \\<in> fst (b s). case r' of Inl x \\<Rightarrow> E x s' | Inr x \\<Rightarrow> Q x s')\"\n\nlemma validE_NF_is_triple[wp_trip]:\n  \"validE_NF P f Q E = triple_judgement P f (validE_NF_property Q E)\"\n  by (fastforce simp: validE_NF_def validE_def2 no_fail_def triple_judgement_def\n                      validE_NF_property_def\n                split: sum.splits)\n\nlemma validNF_cong:\n  \"\\<lbrakk> \\<And>s. P s = P' s; \\<And>s. P s \\<Longrightarrow> m s = m' s;\n     \\<And>r' s' s. \\<lbrakk> P s; (r', s') \\<in> fst (m s) \\<rbrakk> \\<Longrightarrow> Q r' s' = Q' r' s' \\<rbrakk> \\<Longrightarrow>\n   (\\<lbrace>P\\<rbrace> m \\<lbrace>Q\\<rbrace>!) = (\\<lbrace>P'\\<rbrace> m' \\<lbrace>Q'\\<rbrace>!)\"\n  by (fastforce simp: validNF_alt_def)\n\nlemma validE_NF_liftE[wp]:\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>! \\<Longrightarrow> \\<lbrace>P\\<rbrace> liftE f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>!\"\n  by (wpsimp simp: validE_NF_alt_def liftE_def)\n\nlemma validE_NF_handleE'[wp]:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>F x\\<rbrace> handler x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>F\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>P\\<rbrace> f <handle2> (\\<lambda>x. handler x) \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>!\"\n  unfolding validE_NF_alt_def handleE'_def\n  apply (erule validNF_bind[rotated])\n  apply (clarsimp split: sum.splits)\n  apply wpsimp\n  done\n\nlemma validE_NF_handleE[wp]:\n  \"\\<lbrakk> \\<And>x. \\<lbrace>F x\\<rbrace> handler x \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>!; \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>F\\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>P\\<rbrace> f <handle> handler \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace>!\"\n  unfolding handleE_def\n  by (metis validE_NF_handleE')\n\nlemma validE_NF_condition[wp]:\n  \"\\<lbrakk> \\<lbrace> Q \\<rbrace> A \\<lbrace>P\\<rbrace>,\\<lbrace> E \\<rbrace>!; \\<lbrace> R \\<rbrace> B \\<lbrace>P\\<rbrace>,\\<lbrace> E \\<rbrace>! \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. if C s then Q s else R s\\<rbrace> condition C A B \\<lbrace>P\\<rbrace>,\\<lbrace> E \\<rbrace>!\"\n  by (erule validE_NFE)+ (wpsimp wp: no_fail_condition validE_NF)\n\nlemma hoare_assume_preNF:\n  \"(\\<And>s. P s \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>!) \\<Longrightarrow> \\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>!\"\n  by (metis validNF_alt_def)\n\nend", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Monads/NonDetMonad_Total.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.6113819732941511, "lm_q1q2_score": 0.3389932470008315}}
{"text": "theory \"Lowe_fixed_Needham_Schroeder_Public_Key_cert_auto\"\nimports\n  \"ESPLogic\"\nbegin\n\n(* section:  Needham-Schroeder-Lowe Public-Key Protocol  *)\n\n(* text: \n  Modelled after SPORE.\n\n  Notable differences:\n    1. We use explicit global constants instead of implicit typing to discern\n       the different messages.\n    \n    2. We model a single certificate-authority (CA) server role, which is used\n       to answer the certificate requests from both A and B.\n\n    2. We prove non-injective synchronization, which is stronger than the\n       entity authentication property stated in SPORE as the requirement on\n       this protocol.\n\n *)\n\nrole I\nwhere \"I =\n  [ Send ''ca1'' <| sAV ''I'', sAV ''R'' |>\n  , Recv ''ca2'' <| sMV ''S'',\n                    PSign <| sC ''ca2'', sMV ''pkR'', sAV ''R'' |> ( PAsymPK ( sMV ''S'' ) )\n                 |>\n  , Send ''1'' <| sAV ''I'',\n                  PEnc <| sC ''1'', sN ''ni'', sAV ''I'' |> ( sMV ''pkR'' )\n               |>\n  , Recv ''2'' ( PEnc <| sC ''2'', sN ''ni'', sMV ''nr'', sAV ''R'' |>\n                      ( sPK ''I'' )\n               )\n  , Send ''3'' ( PEnc <| sC ''3'', sMV ''nr'' |> ( sMV ''pkR'' ) )\n  ]\"\n\nrole R\nwhere \"R =\n  [ Recv ''1'' <| sMV ''I'',\n                  PEnc <| sC ''1'', sMV ''ni'', sMV ''I'' |> ( sPK ''R'' )\n               |>\n  , Send ''ca1'' <| sAV ''R'', sMV ''I'' |>\n  , Recv ''ca2'' <| sMV ''S'',\n                    PSign <| sC ''ca2'', sMV ''pkI'', sMV ''I'' |> ( PAsymPK ( sMV ''S'' ) )\n                 |>\n  , Send ''2'' ( PEnc <| sC ''2'', sMV ''ni'', sN ''nr'', sAV ''R'' |>\n                      ( sMV ''pkI'' )\n               )\n  , Recv ''3'' ( PEnc <| sC ''3'', sN ''nr'' |> ( sPK ''R'' ) )\n  ]\"\n\nrole S\nwhere \"S =\n  [ Recv ''ca1'' <| sMV ''A'', sMV ''B'' |>\n  , Send ''ca2'' <| sAV ''S'',\n                    PSign <| sC ''ca2'', PAsymPK ( sMV ''B'' ), sMV ''B'' |> ( sPK ''S'' )\n                 |>\n  ]\"\n\nprotocol NSLPK\nwhere \"NSLPK = { I, R, S }\"\n\nlocale restricted_NSLPK_state = NSLPK_state +\n  assumes I_uncompromised_S:\n    \"!! tid1.\n       [| roleMap r tid1 = Some I |] ==> RLKR(s(MV ''S'' tid1)) ~: reveals t\"\n  assumes R_uncompromised_S:\n    \"!! tid1.\n       [| roleMap r tid1 = Some R |] ==> RLKR(s(MV ''S'' tid1)) ~: reveals t\"\n\ntype_invariant NSLPK_msc_typing for NSLPK\nwhere \"NSLPK_msc_typing = mk_typing\n  [ ((S, ''A''), (KnownT S_ca1))\n  , ((S, ''B''), (KnownT S_ca1))\n  , ((R, ''I''), (KnownT R_1))\n  , ((I, ''S''), (KnownT I_ca2))\n  , ((R, ''S''), (KnownT R_ca2))\n  , ((R, ''ni''), (SumT (KnownT R_1) (NonceT I ''ni'')))\n  , ((I, ''nr''), (SumT (KnownT I_2) (NonceT R ''nr'')))\n  , ((R, ''pkI''), (KnownT R_ca2))\n  , ((I, ''pkR''), (KnownT I_ca2))\n  ]\"\n\nsublocale NSLPK_state < NSLPK_msc_typing_state\nproof -\n  have \"(t,r,s) : approx NSLPK_msc_typing\"\n  proof(cases rule: reachable_in_approxI_ext\n        [OF NSLPK_msc_typing.monoTyp, completeness_cases_rule])\n    case (I_ca2_S t r s tid0)\n    then interpret state: NSLPK_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = I_ca2_S\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (I_ca2_pkR t r s tid0)\n    then interpret state: NSLPK_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = I_ca2_pkR\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (I_2_nr t r s tid0)\n    then interpret state: NSLPK_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = I_2_nr\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''2'', LN ''ni'' tid0, s(MV ''nr'' tid0), s(AV ''R'' tid0) |}\n            ( PK ( s(AV ''I'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (R_1_I t r s tid0)\n    then interpret state: NSLPK_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = R_1_I\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (R_1_ni t r s tid0)\n    then interpret state: NSLPK_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = R_1_ni\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''1'', s(MV ''ni'' tid0), s(MV ''I'' tid0) |}\n            ( PK ( s(AV ''R'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (R_ca2_S t r s tid0)\n    then interpret state: NSLPK_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = R_ca2_S\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (R_ca2_pkI t r s tid0)\n    then interpret state: NSLPK_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = R_ca2_pkI\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (S_ca1_A t r s tid0)\n    then interpret state: NSLPK_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = S_ca1_A\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (S_ca1_B t r s tid0)\n    then interpret state: NSLPK_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = S_ca1_B\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  qed\n  thus \"NSLPK_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext NSLPK_state begin\n\n  (* This rule is unsafe in general, but OK here, \n     as we are only reasoning about static compromise. \n  *)\n  lemma static_longterm_key_reveal[dest!]:\n    \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n    by (auto intro: compr_predOrdI)\n\n  lemma longterm_private_key_secrecy:\n    assumes facts:\n      \"SK m : knows t\"\n      \"RLKR m ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"SK m\")\n\n  lemma longterm_sym_ud_key_secrecy:\n    assumes facts:\n      \"K m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"K m1 m2\")\n\n  lemma longterm_sym_bd_key_secrecy:\n    assumes facts:\n      \"Kbd m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n      \"m1 : Agent\"\n      \"m2 : Agent\"\n    shows \"False\"\n  proof -\n    from facts \n    have \"KShr (agents {m1, m2}) : knows t\"\n      by (auto simp: Kbd_def)\n    thus ?thesis using facts\n    proof (sources \"KShr (agents {m1, m2})\")\n    qed (auto simp: agents_def Agent_def)\n  qed\n\n  lemmas ltk_secrecy =\n    longterm_sym_ud_key_secrecy\n    longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n    longterm_sym_bd_key_secrecy\n    longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n    longterm_private_key_secrecy\n    longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection:  Assumptions  *)\n\n(* text:  \n  Initiators as well as responders talk to an uncompromised server. \n *)\n\n\n\n(* subsection:  Security Properties  *)\n\nlemma (in restricted_NSLPK_state) I_pkR_auth:\n  assumes facts:\n    \"roleMap r tid1 = Some I\"\n    \"( tid1, I_ca2 ) : steps t\"\n  shows \"s(MV ''pkR'' tid1) = PK ( s(AV ''R'' tid1) )\"\nproof -\n  note_prefix_closed facts = facts\n  have f1: \"roleMap r tid1 = Some I\" using facts by (auto intro: event_predOrdI)\n  note facts = facts I_uncompromised_S[OF f1, simplified]\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''ca2'', s(MV ''pkR'' tid1), s(AV ''R'' tid1) |}\n                       ( SK ( s(MV ''S'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (S_ca2_enc tid2) note_unified facts = this facts\n    thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_NSLPK_state) R_pkI_auth:\n  assumes facts:\n    \"roleMap r tid1 = Some R\"\n    \"( tid1, R_ca2 ) : steps t\"\n  shows \"s(MV ''pkI'' tid1) = PK ( s(MV ''I'' tid1) )\"\nproof -\n  note_prefix_closed facts = facts\n  have f1: \"roleMap r tid1 = Some R\" using facts by (auto intro: event_predOrdI)\n  note facts = facts R_uncompromised_S[OF f1, simplified]\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''ca2'', s(MV ''pkI'' tid1), s(MV ''I'' tid1) |}\n                       ( SK ( s(MV ''S'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (S_ca2_enc tid2) note_unified facts = this facts\n    thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_NSLPK_state) I_ni_secrecy:\n  assumes facts:\n    \"roleMap r tid0 = Some I\"\n    \"RLKR(s(AV ''I'' tid0)) ~: reveals t\"\n    \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n    \"LN ''ni'' tid0 : knows t\"\n  shows \"False\"\nusing facts proof(sources! \" LN ''ni'' tid0 \")\n  case I_1_ni note_unified facts = this facts\n  have f1: \"roleMap r tid0 = Some I\" using facts by (auto intro: event_predOrdI)\n  have f2: \"( tid0, I_ca2\n            ) : steps t\" using facts by (auto intro: event_predOrdI)\n  note facts = facts I_pkR_auth[OF f1 f2, simplified]\n  thus ?thesis by (auto dest!: ltk_secrecy)\nnext\n  case (R_2_ni tid1) note_unified facts = this facts\n  have f1: \"roleMap r tid1 = Some R\" using facts by (auto intro: event_predOrdI)\n  have f2: \"( tid1, R_ca2\n            ) : steps t\" using facts by (auto intro: event_predOrdI)\n  note facts = facts R_pkI_auth[OF f1 f2, simplified]\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''1'', LN ''ni'' tid0, s(MV ''I'' tid1) |}\n                       ( PK ( s(AV ''R'' tid1) ) ) \")\n    case (I_1_enc tid2) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_NSLPK_state) R_nr_secrecy:\n  assumes facts:\n    \"roleMap r tid0 = Some R\"\n    \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''I'' tid0)) ~: reveals t\"\n    \"LN ''nr'' tid0 : knows t\"\n  shows \"False\"\nusing facts proof(sources! \" LN ''nr'' tid0 \")\n  case (I_3_nr tid1) note_unified facts = this facts\n  have f1: \"roleMap r tid1 = Some I\" using facts by (auto intro: event_predOrdI)\n  have f2: \"( tid1, I_ca2\n            ) : steps t\" using facts by (auto intro: event_predOrdI)\n  note facts = facts I_pkR_auth[OF f1 f2, simplified]\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''2'', LN ''ni'' tid1, LN ''nr'' tid0, s(AV ''R'' tid1) |}\n                       ( PK ( s(AV ''I'' tid1) ) ) \")\n    case (R_2_enc tid2) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nnext\n  case R_2_nr note_unified facts = this facts\n  have f1: \"roleMap r tid0 = Some R\" using facts by (auto intro: event_predOrdI)\n  have f2: \"( tid0, R_ca2\n            ) : steps t\" using facts by (auto intro: event_predOrdI)\n  note facts = facts R_pkI_auth[OF f1 f2, simplified]\n  thus ?thesis by (auto dest!: ltk_secrecy)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_NSLPK_state) I_nr_secrecy:\n  assumes facts:\n    \"roleMap r tid0 = Some I\"\n    \"RLKR(s(AV ''I'' tid0)) ~: reveals t\"\n    \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n    \"( tid0, I_2 ) : steps t\"\n    \"s(MV ''nr'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''2'', LN ''ni'' tid0, s(MV ''nr'' tid0), s(AV ''R'' tid0) |}\n                       ( PK ( s(AV ''I'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (fastforce dest: I_ni_secrecy intro: event_predOrdI)\n  next\n    case (R_2_enc tid1) note_unified facts = this facts\n    have f1: \"roleMap r tid1 = Some R\" using facts by (auto intro: event_predOrdI)\n    have f2: \"( tid1, R_ca2\n              ) : steps t\" using facts by (auto intro: event_predOrdI)\n    note facts = facts R_pkI_auth[OF f1 f2, simplified]\n    thus ?thesis by (fastforce dest: R_nr_secrecy intro: event_predOrdI)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_NSLPK_state) R_ni_secrecy:\n  assumes facts:\n    \"roleMap r tid0 = Some R\"\n    \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''I'' tid0)) ~: reveals t\"\n    \"( tid0, R_3 ) : steps t\"\n    \"s(MV ''ni'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  have f1: \"roleMap r tid0 = Some R\" using facts by (auto intro: event_predOrdI)\n  have f2: \"( tid0, R_ca2\n            ) : steps t\" using facts by (auto intro: event_predOrdI)\n  note facts = facts R_pkI_auth[OF f1 f2, simplified]\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''3'', LN ''nr'' tid0 |} ( PK ( s(AV ''R'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (fastforce dest: R_nr_secrecy intro: event_predOrdI)\n  next\n    case (I_3_enc tid1) note_unified facts = this facts\n    have f1: \"roleMap r tid1 = Some I\" using facts by (auto intro: event_predOrdI)\n    have f2: \"( tid1, I_ca2\n              ) : steps t\" using facts by (auto intro: event_predOrdI)\n    note facts = facts I_pkR_auth[OF f1 f2, simplified]\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''2'', LN ''ni'' tid1, LN ''nr'' tid0, s(AV ''R'' tid0) |}\n                         ( PK ( s(AV ''I'' tid1) ) ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (fastforce dest: R_nr_secrecy intro: event_predOrdI)\n    next\n      case (R_2_enc tid2) note_unified facts = this facts\n      thus ?thesis by (fastforce dest: I_ni_secrecy intro: event_predOrdI)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_NSLPK_state) I_noninjective_synch:\n  assumes facts:\n    \"roleMap r tid1 = Some I\"\n    \"RLKR(s(AV ''I'' tid1)) ~: reveals t\"\n    \"RLKR(s(AV ''R'' tid1)) ~: reveals t\"\n    \"( tid1, I_2 ) : steps t\"\n  shows\n    \"(?  tid2.\n        roleMap r tid2 = Some R &\n        s(AV ''I'' tid1) = s(MV ''I'' tid2) &\n        s(AV ''R'' tid1) = s(AV ''R'' tid2) &\n        LN ''ni'' tid1 = s(MV ''ni'' tid2) &\n        s(MV ''nr'' tid1) = LN ''nr'' tid2 &\n        predOrd t (St( tid1, I_1 )) (St( tid2, R_1 )) &\n        predOrd t (St( tid2, R_2 )) (St( tid1, I_2 )) &\n        predOrd t (St( tid1, I_1 )) (St( tid1, I_2 )) &\n        predOrd t (St( tid2, R_1 )) (St( tid2, R_2 )))\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''2'', LN ''ni'' tid1, s(MV ''nr'' tid1), s(AV ''R'' tid1) |}\n                       ( PK ( s(AV ''I'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (fastforce dest: I_ni_secrecy intro: event_predOrdI)\n  next\n    case (R_2_enc tid2) note_unified facts = this facts\n    have f1: \"roleMap r tid2 = Some R\" using facts by (auto intro: event_predOrdI)\n    have f2: \"( tid2, R_ca2\n              ) : steps t\" using facts by (auto intro: event_predOrdI)\n    note facts = facts R_pkI_auth[OF f1 f2, simplified]\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''1'', LN ''ni'' tid1, s(AV ''I'' tid1) |}\n                         ( PK ( s(AV ''R'' tid1) ) ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (fastforce dest: I_ni_secrecy intro: event_predOrdI)\n    next\n      case (I_1_enc tid3) note_unified facts = this facts\n      thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_NSLPK_state) R_noninjective_synch:\n  assumes facts:\n    \"roleMap r tid2 = Some R\"\n    \"RLKR(s(AV ''R'' tid2)) ~: reveals t\"\n    \"RLKR(s(MV ''I'' tid2)) ~: reveals t\"\n    \"( tid2, R_3 ) : steps t\"\n  shows\n    \"(?  tid1.\n        roleMap r tid1 = Some I &\n        s(AV ''I'' tid1) = s(MV ''I'' tid2) &\n        s(AV ''R'' tid1) = s(AV ''R'' tid2) &\n        LN ''ni'' tid1 = s(MV ''ni'' tid2) &\n        s(MV ''nr'' tid1) = LN ''nr'' tid2 &\n        predOrd t (St( tid1, I_1 )) (St( tid2, R_1 )) &\n        predOrd t (St( tid2, R_2 )) (St( tid1, I_2 )) &\n        predOrd t (St( tid1, I_3 )) (St( tid2, R_3 )) &\n        predOrd t (St( tid1, I_1 )) (St( tid1, I_2 )) &\n        predOrd t (St( tid1, I_2 )) (St( tid1, I_3 )) &\n        predOrd t (St( tid2, R_1 )) (St( tid2, R_2 )) &\n        predOrd t (St( tid2, R_2 )) (St( tid2, R_3 )))\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''1'', s(MV ''ni'' tid2), s(MV ''I'' tid2) |}\n                       ( PK ( s(AV ''R'' tid2) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (fastforce dest: R_ni_secrecy intro: event_predOrdI)\n  next\n    case (I_1_enc tid3) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''3'', LN ''nr'' tid2 |} ( PK ( s(AV ''R'' tid2) ) ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (fastforce dest: R_nr_secrecy intro: event_predOrdI)\n    next\n      case (I_3_enc tid4) note_unified facts = this facts\n      have f1: \"roleMap r tid4 = Some I\" using facts by (auto intro: event_predOrdI)\n      have f2: \"( tid4, I_ca2\n                ) : steps t\" using facts by (auto intro: event_predOrdI)\n      note facts = facts I_pkR_auth[OF f1 f2, simplified]\n      thus ?thesis proof(sources! \"\n                       Enc {| LC ''2'', LN ''ni'' tid4, LN ''nr'' tid2, s(AV ''R'' tid2) |}\n                           ( PK ( s(AV ''I'' tid4) ) ) \")\n        case fake note_unified facts = this facts\n        thus ?thesis by (fastforce dest: R_nr_secrecy intro: event_predOrdI)\n      next\n        case (R_2_enc tid5) note_unified facts = this facts\n        thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n      qed (safe?, simp_all?, insert facts, (fastforce+)?)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/spore/isabelle-proofs/Lowe_fixed_Needham_Schroeder_Public_Key_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.33899324700083144}}
{"text": "section \\<open>During-execution security\\<close> \n\ntheory During_Execution \nimports Bisim Language_Semantics begin\n\n\nsubsection \\<open>Basic setting\\<close>\n\nlocale PL_Indis = PL tval aval \n  for \n    tval :: \"'test \\<Rightarrow> 'state \\<Rightarrow> bool\" and \n    aval :: \"'atom \\<Rightarrow> 'state \\<Rightarrow> 'state\"\n  +\n  fixes \n    indis :: \"'state rel\" \n  assumes \n    equiv_indis: \"equiv UNIV indis\" \n    \n\n(*******************************************)\ncontext PL_Indis \nbegin \n\nabbreviation indisAbbrev (infix \"\\<approx>\" 50)\nwhere \"s1 \\<approx> s2 \\<equiv> (s1,s2) \\<in> indis\"\n\ndefinition indisE (infix \"\\<approx>e\" 50) where \n\"se1 \\<approx>e se2 \\<equiv> \n case (se1,se2) of \n   (Inl s1, Inl s2) \\<Rightarrow> s1 \\<approx> s2\n  |(Inr err1, Inr err2) \\<Rightarrow> err1 = err2\"\n\nlemma refl_indis: \"refl indis\"\nand trans_indis: \"trans indis\"\nand sym_indis: \"sym indis\"\nusing equiv_indis unfolding equiv_def by auto\n\nlemma indis_refl[intro]: \"s \\<approx> s\"\nusing refl_indis unfolding refl_on_def by simp\n\nlemma indis_trans: \"\\<lbrakk>s \\<approx> s'; s' \\<approx> s''\\<rbrakk> \\<Longrightarrow> s \\<approx> s''\"\nusing trans_indis unfolding trans_def by blast\n\nlemma indis_sym: \"s \\<approx> s' \\<Longrightarrow> s' \\<approx> s\"\nusing sym_indis unfolding sym_def by blast\n\n\nsubsection\\<open>Compatibility and discreetness\\<close> \n\ndefinition compatTst where \n\"compatTst tst \\<equiv> \n \\<forall> s t. s \\<approx> t \\<longrightarrow> tval tst s = tval tst t\"\n\ndefinition compatAtm where \n\"compatAtm atm \\<equiv> \n \\<forall> s t. s \\<approx> t \\<longrightarrow> aval atm s \\<approx> aval atm t\"\n\n(* \\<approx>-preservation: *)\ndefinition presAtm where \n\"presAtm atm \\<equiv> \n \\<forall> s. s \\<approx> aval atm s\"\n\ncoinductive discr where \nintro: \n\"\\<lbrakk>\\<And> s c' s'. (c,s) \\<rightarrow>c (c',s') \\<Longrightarrow> s \\<approx> s' \\<and> discr c'; \n  \\<And> s s'. (c,s) \\<rightarrow>t s' \\<Longrightarrow> s \\<approx> s'\\<rbrakk> \n  \\<Longrightarrow> discr c\"\n\nlemma presAtm_compatAtm[simp]:\nassumes \"presAtm atm\"\nshows \"compatAtm atm\"\nusing assms unfolding compatAtm_def\nby (metis presAtm_def indis_sym indis_trans)\n\ntext\\<open>Coinduction for discreetness:\\<close>\n\nlemma discr_coind:\nassumes *: \"phi c\" and \n**: \"\\<And> c s c' s'. \\<lbrakk>phi c; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> s \\<approx> s' \\<and> (phi c' \\<or> discr c')\" and \n***: \"\\<And> c s s'. \\<lbrakk>phi c; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> s \\<approx> s'\"\nshows \"discr c\"\nusing * apply - apply(erule discr.coinduct) using ** *** by auto\n\nlemma discr_raw_coind:\nassumes *: \"phi c\" and \n**: \"\\<And> c s c' s'. \\<lbrakk>phi c; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> s \\<approx> s' \\<and> phi c'\" and \n***: \"\\<And> c s s'. \\<lbrakk>phi c; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> s \\<approx> s'\"\nshows \"discr c\"\nusing * apply - apply(erule discr_coind) using ** *** by blast+\n\ntext\\<open>Discreetness versus transition:\\<close>\n\nlemma discr_transC:\nassumes *: \"discr c\" and **: \"(c,s) \\<rightarrow>c (c',s')\"\nshows \"discr c'\"\nusing * apply - apply(erule discr.cases) using ** by blast\n\nlemma discr_MtransC:\nassumes \"discr c\" and \"(c,s) \\<rightarrow>*c (c',s')\"\nshows \"discr c'\"\nproof-\n  have \"(c,s) \\<rightarrow>*c (c',s') \\<Longrightarrow> discr c \\<longrightarrow> discr c'\"\n  apply(erule MtransC_induct2) using discr_transC by blast+\n  thus ?thesis using assms by blast\nqed\n\nlemma discr_transC_indis:\nassumes *: \"discr c\" and **: \"(c,s) \\<rightarrow>c (c',s')\"\nshows \"s \\<approx> s'\"\nusing * apply - apply(erule discr.cases) using ** by blast\n\nlemma discr_MtransC_indis:\nassumes \"discr c\" and \"(c,s) \\<rightarrow>*c (c',s')\"\nshows \"s \\<approx> s'\"\nproof-\n  have \"(c,s) \\<rightarrow>*c (c',s') \\<Longrightarrow> discr c \\<longrightarrow> s \\<approx> s'\"\n  apply(erule MtransC_induct2)\n  apply (metis indis_refl)\n  by (metis discr.cases discr_MtransC indis_trans)\n  thus ?thesis using assms by blast\nqed\n\nlemma discr_transT:\nassumes *: \"discr c\" and **: \"(c,s) \\<rightarrow>t s'\"\nshows \"s \\<approx> s'\"\nusing * apply - apply(erule discr.cases) using ** by blast\n\nlemma discr_MtransT:\nassumes *: \"discr c\" and **: \"(c,s) \\<rightarrow>*t s'\"\nshows \"s \\<approx> s'\"\nproof-\n  obtain d' t' where \n  cs: \"(c,s) \\<rightarrow>*c (d',t')\" and d't': \"(d',t') \\<rightarrow>t s'\"\n  using ** by(rule MtransT_invert2)\n  hence \"s \\<approx> t'\" using * discr_MtransC_indis by blast\n  moreover \n  {have \"discr d'\" using cs * discr_MtransC by blast \n   hence \"t' \\<approx> s'\" using d't' discr_transT by blast\n  }\n  ultimately show ?thesis using indis_trans by blast\nqed \n\n\nsubsection\\<open>Terminating-interctive discreetness\\<close>\n\ncoinductive discr0 where \nintro: \n\"\\<lbrakk>\\<And> s c' s'. \\<lbrakk>mustT c s; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> s \\<approx> s' \\<and> discr0 c'; \n  \\<And> s s'. \\<lbrakk>mustT c s; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> s \\<approx> s'\\<rbrakk> \n  \\<Longrightarrow> discr0 c\" \n\ntext\\<open>Coinduction for 0-discreetness:\\<close>\n\nlemma discr0_coind[consumes 1, case_names Cont Term, induct pred: discr0]:\nassumes *: \"phi c\" and \n**: \"\\<And> c s c' s'. \n       \\<lbrakk>mustT c s; phi c; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> \n       s \\<approx> s' \\<and> (phi c' \\<or> discr0 c')\" and \n***: \"\\<And> c s s'. \\<lbrakk>mustT c s; phi c; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> s \\<approx> s'\"\nshows \"discr0 c\"\nusing * apply - apply(erule discr0.coinduct) using ** *** by auto\n\nlemma discr0_raw_coind[consumes 1, case_names Cont Term]:\nassumes *: \"phi c\" and \n**: \"\\<And> c s c' s'. \\<lbrakk>mustT c s; phi c; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> s \\<approx> s' \\<and> phi c'\" and \n***: \"\\<And> c s s'. \\<lbrakk>mustT c s; phi c; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> s \\<approx> s'\"\nshows \"discr0 c\"\nusing * apply - apply(erule discr0_coind) using ** *** by blast+\n\ntext\\<open>0-Discreetness versus transition:\\<close>\n\nlemma discr0_transC:\nassumes *: \"discr0 c\" and **: \"mustT c s\" \"(c,s) \\<rightarrow>c (c',s')\"\nshows \"discr0 c'\"\nusing * apply - apply(erule discr0.cases) using ** by blast\n\nlemma discr0_MtransC:\nassumes \"discr0 c\" and \"mustT c s\" \"(c,s) \\<rightarrow>*c (c',s')\"\nshows \"discr0 c'\"\nproof-\n  have \"(c,s) \\<rightarrow>*c (c',s') \\<Longrightarrow> mustT c s \\<and> discr0 c \\<longrightarrow> discr0 c'\"\n  apply(erule MtransC_induct2) using discr0_transC mustT_MtransC\n  by blast+\n  thus ?thesis using assms by blast\nqed\n\nlemma discr0_transC_indis:\nassumes *: \"discr0 c\" and **: \"mustT c s\" \"(c,s) \\<rightarrow>c (c',s')\"\nshows \"s \\<approx> s'\"\nusing * apply - apply(erule discr0.cases) using ** by blast\n\nlemma discr0_MtransC_indis:\nassumes \"discr0 c\" and \"mustT c s\" \"(c,s) \\<rightarrow>*c (c',s')\"\nshows \"s \\<approx> s'\"\nproof-\n  have \"(c,s) \\<rightarrow>*c (c',s') \\<Longrightarrow> mustT c s \\<and> discr0 c \\<longrightarrow> s \\<approx> s'\"\n  apply(erule MtransC_induct2)\n  apply (metis indis_refl)\n  by (metis discr0_MtransC discr0_transC_indis indis_trans mustT_MtransC)\n  thus ?thesis using assms by blast\nqed\n\nlemma discr0_transT:\nassumes *: \"discr0 c\" and **: \"mustT c s\" \"(c,s) \\<rightarrow>t s'\"\nshows \"s \\<approx> s'\"\nusing * apply - apply(erule discr0.cases) using ** by blast\n\nlemma discr0_MtransT:\nassumes *: \"discr0 c\" and ***: \"mustT c s\" and **: \"(c,s) \\<rightarrow>*t s'\"\nshows \"s \\<approx> s'\"\nproof-\n  obtain d' t' where \n  cs: \"(c,s) \\<rightarrow>*c (d',t')\" and d't': \"(d',t') \\<rightarrow>t s'\"\n  using ** by(rule MtransT_invert2)\n  hence \"s \\<approx> t'\" using * discr0_MtransC_indis *** by blast\n  moreover \n  {have \"discr0 d'\" using cs * discr0_MtransC *** by blast \n   hence \"t' \\<approx> s'\"\n   using *** by (metis mustT_MtransC cs d't' discr0_transT) \n  }\n  ultimately show ?thesis using indis_trans by blast\nqed \n\nlemma discr_discr0[simp]: \"discr c \\<Longrightarrow> discr0 c\"\n  by (induct rule: discr0_coind)\n     (metis discr_transC discr_transC_indis discr_transT)+\n\nsubsection\\<open>Self-isomorphism\\<close>  \n\ncoinductive siso where \nintro: \n\"\\<lbrakk>\\<And> s c' s'. (c,s) \\<rightarrow>c (c',s') \\<Longrightarrow> siso c'; \n  \\<And> s t c' s'. \\<lbrakk>s \\<approx> t; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>c (c',t');\n  \\<And> s t s'. \\<lbrakk>s \\<approx> t; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>t t'\\<rbrakk> \n  \\<Longrightarrow> siso c\"\n\ntext\\<open>Coinduction for self-isomorphism:\\<close>\n\nlemma siso_coind:\nassumes *: \"phi c\" and \n**: \"\\<And> c s c' s'. \\<lbrakk>phi c; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> phi c' \\<or> siso c'\" and \n***: \"\\<And> c s t c' s'. \\<lbrakk>phi c; s \\<approx> t; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>c (c',t')\" and \n****: \"\\<And> c s t s'. \\<lbrakk>phi c; s \\<approx> t; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>t t'\"\nshows \"siso c\"\nusing * apply - apply(erule siso.coinduct) using ** *** **** by auto\n\nlemma siso_raw_coind:\nassumes *: \"phi c\" and \n**: \"\\<And> c s c' s'. \\<lbrakk>phi c; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> phi c'\" and \n***: \"\\<And> c s t c' s'. \\<lbrakk>phi c; s \\<approx> t; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>c (c',t')\" and \n****: \"\\<And> c s t s'. \\<lbrakk>phi c; s \\<approx> t; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>t t'\"\nshows \"siso c\"\nusing * apply - apply(erule siso_coind) using ** *** **** by blast+\n\ntext\\<open>Self-Isomorphism versus transition:\\<close>\n\nlemma siso_transC:\nassumes *: \"siso c\" and **: \"(c,s) \\<rightarrow>c (c',s')\"\nshows \"siso c'\"\nusing * apply - apply(erule siso.cases) using ** by blast\n\nlemma siso_MtransC:\nassumes \"siso c\" and \"(c,s) \\<rightarrow>*c (c',s')\"\nshows \"siso c'\"\nproof-\n  have \"(c,s) \\<rightarrow>*c (c',s') \\<Longrightarrow> siso c \\<longrightarrow> siso c'\"\n  apply(erule MtransC_induct2) using siso_transC by blast+\n  thus ?thesis using assms by blast\nqed\n\nlemma siso_transC_indis:\nassumes *: \"siso c\" and **: \"(c,s) \\<rightarrow>c (c',s')\" and ***: \"s \\<approx> t\"\nshows \"\\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>c (c',t')\"\nusing * apply - apply(erule siso.cases) using ** *** by blast\n\nlemma siso_transT:\nassumes *: \"siso c\" and **: \"(c,s) \\<rightarrow>t s'\" and ***: \"s \\<approx> t\"\nshows \"\\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>t t'\"\nusing * apply - apply(erule siso.cases) using ** *** by blast\n\n\nsubsection\\<open>MustT-interactive self-isomorphism\\<close>  \n\ncoinductive siso0 where \nintro: \n\"\\<lbrakk>\\<And> s c' s'. \\<lbrakk>mustT c s; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> siso0 c'; \n  \\<And> s t c' s'. \n    \\<lbrakk>mustT c s; mustT c t; s \\<approx> t; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> \n    \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>c (c',t');\n  \\<And> s t s'. \n    \\<lbrakk>mustT c s; mustT c t; s \\<approx> t; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> \n    \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>t t'\\<rbrakk> \n  \\<Longrightarrow> siso0 c\"\n\ntext\\<open>Coinduction for self-isomorphism:\\<close>\n\nlemma siso0_coind[consumes 1, case_names Indef Cont Term, induct pred: discr0]:\nassumes *: \"phi c\" and \n**: \"\\<And> c s c' s'. \\<lbrakk>phi c; mustT c s; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> phi c' \\<or> siso0 c'\" and \n***: \"\\<And> c s t c' s'. \n        \\<lbrakk>phi c; mustT c s; mustT c t; s \\<approx> t; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> \n        \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>c (c',t')\" and \n****: \"\\<And> c s t s'. \n         \\<lbrakk>mustT c s; mustT c t; phi c; s \\<approx> t; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> \n         \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>t t'\"\nshows \"siso0 c\"\nusing * apply - apply(erule siso0.coinduct) using ** *** **** by auto\n\nlemma siso0_raw_coind[consumes 1, case_names Indef Cont Term]:\nassumes *: \"phi c\" and \n**: \"\\<And> c s c' s'. \\<lbrakk>phi c; mustT c s; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> phi c'\" and \n***: \"\\<And> c s t c' s'. \n        \\<lbrakk>phi c; mustT c s; mustT c t; s \\<approx> t; (c,s) \\<rightarrow>c (c',s')\\<rbrakk> \\<Longrightarrow> \n        \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>c (c',t')\" and \n****: \"\\<And> c s t s'. \n         \\<lbrakk>phi c; mustT c s; mustT c t; s \\<approx> t; (c,s) \\<rightarrow>t s'\\<rbrakk> \\<Longrightarrow> \n         \\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>t t'\"\nshows \"siso0 c\"\nusing * apply - apply(erule siso0_coind) using ** *** **** by blast+\n\ntext\\<open>Self-Isomorphism versus transition:\\<close>\n\nlemma siso0_transC:\nassumes *: \"siso0 c\" and **: \"mustT c s\" \"(c,s) \\<rightarrow>c (c',s')\"\nshows \"siso0 c'\"\nusing * apply - apply(erule siso0.cases) using ** by blast\n\nlemma siso0_MtransC:\nassumes \"siso0 c\" and \"mustT c s\" and \"(c,s) \\<rightarrow>*c (c',s')\"\nshows \"siso0 c'\"\nproof-\n  have \"(c,s) \\<rightarrow>*c (c',s') \\<Longrightarrow> mustT c s \\<and> siso0 c \\<longrightarrow> siso0 c'\"\n  apply(erule MtransC_induct2) using siso0_transC mustT_MtransC siso0_transC\n  by blast+\n  thus ?thesis using assms by blast\nqed\n\nlemma siso0_transC_indis:\nassumes *: \"siso0 c\" \nand **: \"mustT c s\" \"mustT c t\" \"(c,s) \\<rightarrow>c (c',s')\" \nand ***: \"s \\<approx> t\"\nshows \"\\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>c (c',t')\"\nusing * apply - apply(erule siso0.cases) using ** *** by blast\n\nlemma siso0_transT:\nassumes *: \"siso0 c\" \nand **: \"mustT c s\" \"mustT c t\" \"(c,s) \\<rightarrow>t s'\" \nand ***: \"s \\<approx> t\"\nshows \"\\<exists> t'. s' \\<approx> t' \\<and> (c,t) \\<rightarrow>t t'\"\nusing * apply - apply(erule siso0.cases) using ** *** by blast\n\n\nsubsection\\<open>Notions of bisimilarity\\<close> \n\ntext\\<open>Matchers:\\<close>\n\n(* Notations and conventions:\n\\\\- ``<u>_<v>\" means: ``match u by v\", where u, v can be: \nC (one continuation step), MC (multiple continuation steps), \nZOC (zero or one continuation steps), \nT (termination step), MT (multiple steps leading to termination).   *)\n\ndefinition matchC_C where \n\"matchC_C theta c d \\<equiv> \n \\<forall> s t c' s'. \n   s \\<approx> t \\<and> (c,s) \\<rightarrow>c (c',s') \n   \\<longrightarrow> \n   (\\<exists> d' t'. (d,t) \\<rightarrow>c (d',t') \\<and> s' \\<approx> t' \\<and> (c',d') \\<in> theta)\"\n\ndefinition matchC_ZOC where \n\"matchC_ZOC theta c d \\<equiv> \n \\<forall> s t c' s'. \n   s \\<approx> t \\<and> (c,s) \\<rightarrow>c (c',s') \n   \\<longrightarrow> \n   (s' \\<approx> t \\<and> (c',d) \\<in> theta)\n   \\<or> \n   (\\<exists> d' t'. (d,t) \\<rightarrow>c (d',t') \\<and> s' \\<approx> t' \\<and> (c',d') \\<in> theta)\"\n\ndefinition matchC_ZO where \n\"matchC_ZO theta c d \\<equiv> \n \\<forall> s t c' s'. \n   s \\<approx> t \\<and> (c,s) \\<rightarrow>c (c',s') \n   \\<longrightarrow> \n   (s' \\<approx> t \\<and> (c',d) \\<in> theta)\n   \\<or> \n   (\\<exists> d' t'. (d,t) \\<rightarrow>c (d',t') \\<and> s' \\<approx> t' \\<and> (c',d') \\<in> theta) \n   \\<or> \n   (\\<exists> t'. (d,t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n\ndefinition matchT_T where \n\"matchT_T c d \\<equiv> \n \\<forall> s t s'. \n   s \\<approx> t \\<and> (c,s) \\<rightarrow>t s' \n   \\<longrightarrow> \n   (\\<exists> t'. (d,t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n\ndefinition matchT_ZO where \n\"matchT_ZO c d \\<equiv> \n \\<forall> s t s'. \n   s \\<approx> t \\<and> (c,s) \\<rightarrow>t s' \n   \\<longrightarrow> \n   (s' \\<approx> t \\<and> discr d)\n   \\<or> \n   (\\<exists> d' t'. (d,t) \\<rightarrow>c (d',t') \\<and> s' \\<approx> t' \\<and> discr d')\n   \\<or> \n   (\\<exists> t'. (d,t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n\n(*  *)\n\ndefinition matchC_MC where \n\"matchC_MC theta c d \\<equiv> \n \\<forall> s t c' s'. \n   s \\<approx> t \\<and> (c,s) \\<rightarrow>c (c',s') \n   \\<longrightarrow> \n   (\\<exists> d' t'. (d,t) \\<rightarrow>*c (d',t') \\<and> s' \\<approx> t' \\<and> (c',d') \\<in> theta)\"\n\ndefinition matchC_TMC where \n\"matchC_TMC theta c d \\<equiv> \n \\<forall> s t c' s'. \n   mustT c s \\<and> mustT d t \\<and> s \\<approx> t \\<and> (c,s) \\<rightarrow>c (c',s') \n   \\<longrightarrow> \n   (\\<exists> d' t'. (d,t) \\<rightarrow>*c (d',t') \\<and> s' \\<approx> t' \\<and> (c',d') \\<in> theta)\"\n\ndefinition matchC_M where \n\"matchC_M theta c d \\<equiv> \n \\<forall> s t c' s'. \n   s \\<approx> t \\<and> (c,s) \\<rightarrow>c (c',s') \n   \\<longrightarrow> \n   (\\<exists> d' t'. (d,t) \\<rightarrow>*c (d',t') \\<and> s' \\<approx> t' \\<and> (c',d') \\<in> theta) \n   \\<or> \n   (\\<exists> t'. (d,t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n\ndefinition matchT_MT where \n\"matchT_MT c d \\<equiv> \n \\<forall> s t s'. \n   s \\<approx> t \\<and> (c,s) \\<rightarrow>t s' \n   \\<longrightarrow> \n   (\\<exists> t'. (d,t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n\ndefinition matchT_TMT where \n\"matchT_TMT c d \\<equiv> \n \\<forall> s t s'. \n   mustT c s \\<and> mustT d t \\<and> s \\<approx> t \\<and> (c,s) \\<rightarrow>t s' \n   \\<longrightarrow> \n   (\\<exists> t'. (d,t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n\ndefinition matchT_M where \n\"matchT_M c d \\<equiv> \n \\<forall> s t s'. \n   s \\<approx> t \\<and> (c,s) \\<rightarrow>t s' \n   \\<longrightarrow> \n   (\\<exists> d' t'. (d,t) \\<rightarrow>*c (d',t') \\<and> s' \\<approx> t' \\<and> discr d')\n   \\<or> \n   (\\<exists> t'. (d,t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n\nlemmas match_defs = \nmatchC_C_def \nmatchC_ZOC_def matchC_ZO_def\nmatchT_T_def matchT_ZO_def\nmatchC_MC_def matchC_M_def\nmatchT_MT_def matchT_M_def\nmatchC_TMC_def matchT_TMT_def\n\n(* For convenience, indis-symmetric variations of the above definitions: *)\n\nlemma matchC_C_def2: \n\"matchC_C theta d c =\n (\\<forall> s t d' t'. \n   s \\<approx> t \\<and> (d,t) \\<rightarrow>c (d',t') \n   \\<longrightarrow> \n   (\\<exists> c' s'. (c,s) \\<rightarrow>c (c',s') \\<and> s' \\<approx> t' \\<and> (d',c') \\<in> theta))\"\nunfolding matchC_C_def using indis_sym by blast\n\nlemma matchC_ZOC_def2:  \n\"matchC_ZOC theta d c= \n (\\<forall> s t d' t'. \n   s \\<approx> t \\<and> (d,t) \\<rightarrow>c (d',t') \n   \\<longrightarrow> \n   (s \\<approx> t' \\<and> (d',c) \\<in> theta)\n   \\<or> \n   (\\<exists> c' s'. (c,s) \\<rightarrow>c (c',s') \\<and> s' \\<approx> t' \\<and> (d',c') \\<in> theta))\"\nunfolding matchC_ZOC_def using indis_sym by blast\n\nlemma matchC_ZO_def2:\n\"matchC_ZO theta d c = \n (\\<forall> s t d' t'. \n   s \\<approx> t \\<and> (d,t) \\<rightarrow>c (d',t') \n   \\<longrightarrow> \n   (s \\<approx> t' \\<and> (d',c) \\<in> theta)\n   \\<or> \n   (\\<exists> c' s'. (c,s) \\<rightarrow>c (c',s') \\<and> s' \\<approx> t' \\<and> (d',c') \\<in> theta) \n   \\<or> \n   (\\<exists> s'. (c,s) \\<rightarrow>t s' \\<and> s' \\<approx> t' \\<and> discr d'))\"\nunfolding matchC_ZO_def using indis_sym by blast\n\nlemma matchT_T_def2:\n\"matchT_T d c = \n (\\<forall> s t t'. \n   s \\<approx> t \\<and> (d,t) \\<rightarrow>t t' \n   \\<longrightarrow> \n   (\\<exists> s'. (c,s) \\<rightarrow>t s' \\<and> s' \\<approx> t'))\"\nunfolding matchT_T_def using indis_sym by blast\n\nlemma matchT_ZO_def2:\n\"matchT_ZO d c = \n (\\<forall> s t t'. \n   s \\<approx> t \\<and> (d,t) \\<rightarrow>t t' \n   \\<longrightarrow> \n   (s \\<approx> t' \\<and> discr c)\n   \\<or> \n   (\\<exists> c' s'. (c,s) \\<rightarrow>c (c',s') \\<and> s' \\<approx> t' \\<and> discr c')\n   \\<or> \n   (\\<exists> s'. (c,s) \\<rightarrow>t s' \\<and> s' \\<approx> t'))\"    \nunfolding matchT_ZO_def using indis_sym by blast\n\n(*  *)\n\nlemma matchC_MC_def2:  \n\"matchC_MC theta d c= \n (\\<forall> s t d' t'. \n   s \\<approx> t \\<and> (d,t) \\<rightarrow>c (d',t') \n   \\<longrightarrow> \n   (\\<exists> c' s'. (c,s) \\<rightarrow>*c (c',s') \\<and> s' \\<approx> t' \\<and> (d',c') \\<in> theta))\"\nunfolding matchC_MC_def using indis_sym by blast\n\nlemma matchC_TMC_def2:  \n\"matchC_TMC theta d c= \n (\\<forall> s t d' t'. \n   mustT c s \\<and> mustT d t \\<and> s \\<approx> t \\<and> (d,t) \\<rightarrow>c (d',t') \n   \\<longrightarrow> \n   (\\<exists> c' s'. (c,s) \\<rightarrow>*c (c',s') \\<and> s' \\<approx> t' \\<and> (d',c') \\<in> theta))\"\nunfolding matchC_TMC_def using indis_sym by blast\n\nlemma matchC_M_def2:\n\"matchC_M theta d c = \n (\\<forall> s t d' t'. \n   s \\<approx> t \\<and> (d,t) \\<rightarrow>c (d',t') \n   \\<longrightarrow> \n   (\\<exists> c' s'. (c,s) \\<rightarrow>*c (c',s') \\<and> s' \\<approx> t' \\<and> (d',c') \\<in> theta) \n   \\<or> \n   (\\<exists> s'. (c,s) \\<rightarrow>*t s' \\<and> s' \\<approx> t' \\<and> discr d'))\"\nunfolding matchC_M_def using indis_sym by blast\n\nlemma matchT_MT_def2:\n\"matchT_MT d c = \n (\\<forall> s t t'. \n   s \\<approx> t \\<and> (d,t) \\<rightarrow>t t' \n   \\<longrightarrow> \n   (\\<exists> s'. (c,s) \\<rightarrow>*t s' \\<and> s' \\<approx> t'))\"\nunfolding matchT_MT_def using indis_sym by blast\n\nlemma matchT_TMT_def2:\n\"matchT_TMT d c = \n (\\<forall> s t t'. \n   mustT c s \\<and> mustT d t \\<and> s \\<approx> t \\<and> (d,t) \\<rightarrow>t t' \n   \\<longrightarrow> \n   (\\<exists> s'. (c,s) \\<rightarrow>*t s' \\<and> s' \\<approx> t'))\"\nunfolding matchT_TMT_def using indis_sym by blast\n\nlemma matchT_M_def2:\n\"matchT_M d c = \n (\\<forall> s t t'. \n   s \\<approx> t \\<and> (d,t) \\<rightarrow>t t' \n   \\<longrightarrow> \n   (\\<exists> c' s'. (c,s) \\<rightarrow>*c (c',s') \\<and> s' \\<approx> t' \\<and> discr c')\n   \\<or> \n   (\\<exists> s'. (c,s) \\<rightarrow>*t s' \\<and> s' \\<approx> t'))\"    \nunfolding matchT_M_def using indis_sym by blast\n\ntext\\<open>Retracts:\\<close>\n\n(* Strong retract: *)\ndefinition Sretr where \n\"Sretr theta \\<equiv> \n {(c,d). \n    matchC_C theta c d \\<and> \n    matchT_T c d}\"\n\n(* Zero-one retract: *)\ndefinition ZOretr where \n\"ZOretr theta \\<equiv> \n {(c,d). \n    matchC_ZO theta c d \\<and> \n    matchT_ZO c d}\"\n\n(* Zero-one termination-sensitive retract: *)\ndefinition ZOretrT where \n\"ZOretrT theta \\<equiv> \n {(c,d). \n    matchC_ZOC theta c d \\<and> \n    matchT_T c d}\"\n\n(* Weak retract: *)\ndefinition Wretr where \n\"Wretr theta \\<equiv> \n {(c,d). \n    matchC_M theta c d \\<and> \n    matchT_M c d }\"\n\n(* Weak termination-sensitive retract: *)\ndefinition WretrT where \n\"WretrT theta \\<equiv> \n {(c,d). \n    matchC_MC theta c d \\<and> \n    matchT_MT c d}\"\n\n(* Weak terminating-interactive termination-sensitive retract: *)\ndefinition RetrT where \n\"RetrT theta \\<equiv> \n {(c,d). \n    matchC_TMC theta c d \\<and> \n    matchT_TMT c d}\"\n\nlemmas Retr_defs = \nSretr_def \nZOretr_def ZOretrT_def \nWretr_def WretrT_def \nRetrT_def\n\ntext\\<open>The associated bisimilarity relations:\\<close>\n\ndefinition Sbis where \"Sbis \\<equiv> bis Sretr\"\ndefinition ZObis where \"ZObis \\<equiv> bis ZOretr\"\ndefinition ZObisT where \"ZObisT \\<equiv> bis ZOretrT\"\ndefinition Wbis where \"Wbis \\<equiv> bis Wretr\"\ndefinition WbisT where \"WbisT \\<equiv> bis WretrT\"\ndefinition BisT where \"BisT \\<equiv> bis RetrT\"\n\nlemmas bis_defs = \nSbis_def \nZObis_def ZObisT_def \nWbis_def WbisT_def \nBisT_def\n\nabbreviation Sbis_abbrev (infix \"\\<approx>s\" 55) where \"c1 \\<approx>s c2 \\<equiv> (c1,c2) \\<in> Sbis\"\nabbreviation ZObis_abbrev (infix \"\\<approx>01\" 55) where \"c1 \\<approx>01 c2 \\<equiv> (c1,c2) \\<in> ZObis\"\nabbreviation ZObisT_abbrev (infix \"\\<approx>01T\" 55) where \"c1 \\<approx>01T c2 \\<equiv> (c1,c2) \\<in> ZObisT\"\nabbreviation Wbis_abbrev (infix \"\\<approx>w\" 55) where \"c1 \\<approx>w c2 \\<equiv> (c1,c2) \\<in> Wbis\"\nabbreviation WbisT_abbrev (infix \"\\<approx>wT\" 55) where \"c1 \\<approx>wT c2 \\<equiv> (c1,c2) \\<in> WbisT\"\nabbreviation BisT_abbrev (infix \"\\<approx>T\" 55) where \"c1 \\<approx>T c2 \\<equiv> (c1,c2) \\<in> BisT\"\n\n\nlemma mono_Retr:\n\"mono Sretr\"\n\"mono ZOretr\"  \"mono ZOretrT\"\n\"mono Wretr\"  \"mono WretrT\"\n\"mono RetrT\"\nunfolding mono_def Retr_defs match_defs by blast+\n\n(* Sbis: *)\nlemma Sbis_prefix:\n\"Sbis \\<subseteq> Sretr Sbis\"\nunfolding Sbis_def using mono_Retr bis_prefix by blast\n\nlemma Sbis_sym: \"sym Sbis\"\nunfolding Sbis_def using mono_Retr sym_bis by blast\n\nlemma Sbis_Sym: \"c \\<approx>s d \\<Longrightarrow> d \\<approx>s c\"\nusing Sbis_sym unfolding sym_def by blast\n\nlemma Sbis_converse:\n\"((c,d) \\<in> theta^-1 \\<union> Sbis) = ((d,c) \\<in> theta \\<union> Sbis)\"\nby (metis Sbis_sym converseI converse_Un converse_converse sym_conv_converse_eq)\n\nlemma\nSbis_matchC_C: \"\\<And> s t. c \\<approx>s d \\<Longrightarrow> matchC_C Sbis c d\"\nand \nSbis_matchT_T: \"\\<And> c d. c \\<approx>s d \\<Longrightarrow> matchT_T c d\"\nusing Sbis_prefix unfolding Sretr_def by auto\n\nlemmas Sbis_step = Sbis_matchC_C Sbis_matchT_T\n\nlemma\nSbis_matchC_C_rev: \"\\<And> s t. s \\<approx>s t \\<Longrightarrow> matchC_C Sbis t s\"\nand \nSbis_matchT_T_rev: \"\\<And> s t. s \\<approx>s t \\<Longrightarrow> matchT_T t s\"\nusing Sbis_step Sbis_sym unfolding sym_def by blast+\n\nlemmas Sbis_step_rev = Sbis_matchC_C_rev Sbis_matchT_T_rev\n\nlemma Sbis_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> Sretr (theta \\<union> Sbis)\"\nshows \"theta \\<subseteq> Sbis\"\nusing assms mono_Retr bis_coind \nunfolding Sbis_def by blast\n\nlemma Sbis_raw_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> Sretr theta\"\nshows \"theta \\<subseteq> Sbis\"\nusing assms mono_Retr bis_raw_coind \nunfolding Sbis_def by blast\n\nlemma Sbis_coind2:\nassumes \"theta \\<subseteq> Sretr (theta \\<union> Sbis)\" and \n\"theta ^-1 \\<subseteq> Sretr ((theta ^-1) \\<union> Sbis)\"\nshows \"theta \\<subseteq> Sbis\"\nusing assms mono_Retr bis_coind2 \nunfolding Sbis_def by blast\n\nlemma Sbis_raw_coind2:\nassumes \"theta \\<subseteq> Sretr theta\" and \n\"theta ^-1 \\<subseteq> Sretr (theta ^-1)\"\nshows \"theta \\<subseteq> Sbis\"\nusing assms mono_Retr bis_raw_coind2 \nunfolding Sbis_def by blast\n\n(* ZObis: *)\nlemma ZObis_prefix:\n\"ZObis \\<subseteq> ZOretr ZObis\"\nunfolding ZObis_def using mono_Retr bis_prefix by blast\n\nlemma ZObis_sym: \"sym ZObis\"\nunfolding ZObis_def using mono_Retr sym_bis by blast\n\nlemma ZObis_converse:\n\"((c,d) \\<in> theta^-1 \\<union> ZObis) = ((d,c) \\<in> theta \\<union> ZObis)\"\nby (metis ZObis_sym converseI converse_Un converse_converse sym_conv_converse_eq)\n\nlemma ZObis_Sym: \"s \\<approx>01 t \\<Longrightarrow> t \\<approx>01 s\"\nusing ZObis_sym unfolding sym_def by blast\n\nlemma\nZObis_matchC_ZO: \"\\<And> s t. s \\<approx>01 t \\<Longrightarrow> matchC_ZO ZObis s t\"\nand \nZObis_matchT_ZO: \"\\<And> s t. s \\<approx>01 t \\<Longrightarrow> matchT_ZO s t\"\nusing ZObis_prefix unfolding ZOretr_def by auto\n\nlemmas ZObis_step = ZObis_matchC_ZO ZObis_matchT_ZO \n\nlemma\nZObis_matchC_ZO_rev: \"\\<And> s t. s \\<approx>01 t \\<Longrightarrow> matchC_ZO ZObis t s\"\nand \nZObis_matchT_ZO_rev: \"\\<And> s t. s \\<approx>01 t \\<Longrightarrow> matchT_ZO t s\"\nusing ZObis_step ZObis_sym unfolding sym_def by blast+\n\nlemmas ZObis_step_rev = ZObis_matchC_ZO_rev ZObis_matchT_ZO_rev\n\nlemma ZObis_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> ZOretr (theta \\<union> ZObis)\"\nshows \"theta \\<subseteq> ZObis\"\nusing assms mono_Retr bis_coind \nunfolding ZObis_def by blast\n\nlemma ZObis_raw_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> ZOretr theta\"\nshows \"theta \\<subseteq> ZObis\"\nusing assms mono_Retr bis_raw_coind \nunfolding ZObis_def by blast\n\nlemma ZObis_coind2:\nassumes \"theta \\<subseteq> ZOretr (theta \\<union> ZObis)\" and \n\"theta ^-1 \\<subseteq> ZOretr ((theta ^-1) \\<union> ZObis)\"\nshows \"theta \\<subseteq> ZObis\"\nusing assms mono_Retr bis_coind2 \nunfolding ZObis_def by blast\n\nlemma ZObis_raw_coind2:\nassumes \"theta \\<subseteq> ZOretr theta\" and \n\"theta ^-1 \\<subseteq> ZOretr (theta ^-1)\"\nshows \"theta \\<subseteq> ZObis\"\nusing assms mono_Retr bis_raw_coind2 \nunfolding ZObis_def by blast\n\n(* ZObisT: *)\nlemma ZObisT_prefix:\n\"ZObisT \\<subseteq> ZOretrT ZObisT\"\nunfolding ZObisT_def using mono_Retr bis_prefix by blast\n\nlemma ZObisT_sym: \"sym ZObisT\"\nunfolding ZObisT_def using mono_Retr sym_bis by blast\n\nlemma ZObisT_Sym: \"s \\<approx>01T t \\<Longrightarrow> t \\<approx>01T s\"\nusing ZObisT_sym unfolding sym_def by blast\n\nlemma ZObisT_converse:\n\"((c,d) \\<in> theta^-1 \\<union> ZObisT) = ((d,c) \\<in> theta \\<union> ZObisT)\"\nby (metis ZObisT_sym converseI converse_Un converse_converse sym_conv_converse_eq)\n\nlemma\nZObisT_matchC_ZOC: \"\\<And> s t. s \\<approx>01T t \\<Longrightarrow> matchC_ZOC ZObisT s t\"\nand \nZObisT_matchT_T: \"\\<And> s t. s \\<approx>01T t \\<Longrightarrow> matchT_T s t\"\nusing ZObisT_prefix unfolding ZOretrT_def by auto\n\nlemmas ZObisT_step = ZObisT_matchC_ZOC ZObisT_matchT_T\n\nlemma\nZObisT_matchC_ZOC_rev: \"\\<And> s t. s \\<approx>01T t \\<Longrightarrow> matchC_ZOC ZObisT t s\"\nand \nZObisT_matchT_T_rev: \"\\<And> s t. s \\<approx>01T t \\<Longrightarrow> matchT_T t s\"\nusing ZObisT_step ZObisT_sym unfolding sym_def by blast+\n\nlemmas ZObisT_step_rev = ZObisT_matchC_ZOC_rev ZObisT_matchT_T_rev \n\nlemma ZObisT_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> ZOretrT (theta \\<union> ZObisT)\"\nshows \"theta \\<subseteq> ZObisT\"\nusing assms mono_Retr bis_coind \nunfolding ZObisT_def by blast\n\nlemma ZObisT_raw_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> ZOretrT theta\"\nshows \"theta \\<subseteq> ZObisT\"\nusing assms mono_Retr bis_raw_coind \nunfolding ZObisT_def by blast\n\nlemma ZObisT_coind2:\nassumes \"theta \\<subseteq> ZOretrT (theta \\<union> ZObisT)\" and \n\"theta ^-1 \\<subseteq> ZOretrT ((theta ^-1) \\<union> ZObisT)\"\nshows \"theta \\<subseteq> ZObisT\"\nusing assms mono_Retr bis_coind2 \nunfolding ZObisT_def by blast\n\nlemma ZObisT_raw_coind2:\nassumes \"theta \\<subseteq> ZOretrT theta\" and \n\"theta ^-1 \\<subseteq> ZOretrT (theta ^-1)\"\nshows \"theta \\<subseteq> ZObisT\"\nusing assms mono_Retr bis_raw_coind2 \nunfolding ZObisT_def by blast\n\n(* Wbis: *)\nlemma Wbis_prefix:\n\"Wbis \\<subseteq> Wretr Wbis\"\nunfolding Wbis_def using mono_Retr bis_prefix by blast\n\nlemma Wbis_sym: \"sym Wbis\"\nunfolding Wbis_def using mono_Retr sym_bis by blast\n\nlemma Wbis_converse:\n\"((c,d) \\<in> theta^-1 \\<union> Wbis) = ((d,c) \\<in> theta \\<union> Wbis)\"\nby (metis Wbis_sym converseI converse_Un converse_converse sym_conv_converse_eq)\n\nlemma Wbis_Sym: \"c \\<approx>w d \\<Longrightarrow> d \\<approx>w c\"\nusing Wbis_sym unfolding sym_def by blast\n\nlemma\nWbis_matchC_M: \"\\<And> c d. c \\<approx>w d \\<Longrightarrow> matchC_M Wbis c d\"\nand \nWbis_matchT_M: \"\\<And> c d. c \\<approx>w d \\<Longrightarrow> matchT_M c d\"\nusing Wbis_prefix unfolding Wretr_def by auto\n\nlemmas Wbis_step = Wbis_matchC_M Wbis_matchT_M \n\nlemma\nWbis_matchC_M_rev: \"\\<And> s t. s \\<approx>w t \\<Longrightarrow> matchC_M Wbis t s\"\nand \nWbis_matchT_M_rev: \"\\<And> s t. s \\<approx>w t \\<Longrightarrow> matchT_M t s\"\nusing Wbis_step Wbis_sym unfolding sym_def by blast+\n\nlemmas Wbis_step_rev = Wbis_matchC_M_rev Wbis_matchT_M_rev\n\nlemma Wbis_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> Wretr (theta \\<union> Wbis)\"\nshows \"theta \\<subseteq> Wbis\"\nusing assms mono_Retr bis_coind \nunfolding Wbis_def by blast\n\nlemma Wbis_raw_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> Wretr theta\"\nshows \"theta \\<subseteq> Wbis\"\nusing assms mono_Retr bis_raw_coind \nunfolding Wbis_def by blast\n\nlemma Wbis_coind2:\nassumes \"theta \\<subseteq> Wretr (theta \\<union> Wbis)\" and \n\"theta ^-1 \\<subseteq> Wretr ((theta ^-1) \\<union> Wbis)\"\nshows \"theta \\<subseteq> Wbis\"\nusing assms mono_Retr bis_coind2 \nunfolding Wbis_def by blast\n\nlemma Wbis_raw_coind2:\nassumes \"theta \\<subseteq> Wretr theta\" and \n\"theta ^-1 \\<subseteq> Wretr (theta ^-1)\"\nshows \"theta \\<subseteq> Wbis\"\nusing assms mono_Retr bis_raw_coind2 \nunfolding Wbis_def by blast\n\n(* WbisT: *)\nlemma WbisT_prefix:\n\"WbisT \\<subseteq> WretrT WbisT\"\nunfolding WbisT_def using mono_Retr bis_prefix by blast\n\nlemma WbisT_sym: \"sym WbisT\"\nunfolding WbisT_def using mono_Retr sym_bis by blast\n\nlemma WbisT_Sym: \"c \\<approx>wT d \\<Longrightarrow> d \\<approx>wT c\"\nusing WbisT_sym unfolding sym_def by blast\n\nlemma WbisT_converse:\n\"((c,d) \\<in> theta^-1 \\<union> WbisT) = ((d,c) \\<in> theta \\<union> WbisT)\"\nby (metis WbisT_sym converseI converse_Un converse_converse sym_conv_converse_eq)\n\nlemma\nWbisT_matchC_MC: \"\\<And> c d. c \\<approx>wT d \\<Longrightarrow> matchC_MC WbisT c d\"\nand \nWbisT_matchT_MT: \"\\<And> c d. c \\<approx>wT d \\<Longrightarrow> matchT_MT c d\"\nusing WbisT_prefix unfolding WretrT_def by auto\n\nlemmas WbisT_step = WbisT_matchC_MC WbisT_matchT_MT\n\nlemma\nWbisT_matchC_MC_rev: \"\\<And> s t. s \\<approx>wT t \\<Longrightarrow> matchC_MC WbisT t s\"\nand \nWbisT_matchT_MT_rev: \"\\<And> s t. s \\<approx>wT t \\<Longrightarrow> matchT_MT t s\"\nusing WbisT_step WbisT_sym unfolding sym_def by blast+\n\nlemmas WbisT_step_rev = WbisT_matchC_MC_rev WbisT_matchT_MT_rev \n\nlemma WbisT_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> WretrT (theta \\<union> WbisT)\"\nshows \"theta \\<subseteq> WbisT\"\nusing assms mono_Retr bis_coind \nunfolding WbisT_def by blast\n\nlemma WbisT_raw_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> WretrT theta\"\nshows \"theta \\<subseteq> WbisT\"\nusing assms mono_Retr bis_raw_coind \nunfolding WbisT_def by blast\n\nlemma WbisT_coind2:\nassumes \"theta \\<subseteq> WretrT (theta \\<union> WbisT)\" and \n\"theta ^-1 \\<subseteq> WretrT ((theta ^-1) \\<union> WbisT)\"\nshows \"theta \\<subseteq> WbisT\"\nusing assms mono_Retr bis_coind2 \nunfolding WbisT_def by blast\n\nlemma WbisT_raw_coind2:\nassumes \"theta \\<subseteq> WretrT theta\" and \n\"theta ^-1 \\<subseteq> WretrT (theta ^-1)\"\nshows \"theta \\<subseteq> WbisT\"\nusing assms mono_Retr bis_raw_coind2 \nunfolding WbisT_def by blast\n\nlemma WbisT_coinduct[consumes 1, case_names sym cont termi]:\n  assumes \\<phi>: \"\\<phi> c d\"\n  assumes S: \"\\<And>c d. \\<phi> c d \\<Longrightarrow> \\<phi> d c\"\n  assumes C: \"\\<And>c s d t c' s'.\n    \\<lbrakk> \\<phi> c d ; s \\<approx> t ; (c, s) \\<rightarrow>c (c', s') \\<rbrakk> \\<Longrightarrow> \\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (\\<phi> c' d' \\<or> c' \\<approx>wT d')\"\n  assumes T: \"\\<And>c s d t s'.\n    \\<lbrakk> \\<phi> c d ; s \\<approx> t ; (c, s) \\<rightarrow>t s' \\<rbrakk> \\<Longrightarrow> \\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n  shows \"c \\<approx>wT d\"\nproof -\n  let ?\\<theta> = \"{(c, d). \\<phi> c d}\"\n  have \"sym ?\\<theta>\" by (auto intro!: symI S)\n  moreover \n  have \"?\\<theta> \\<subseteq> WretrT (?\\<theta> \\<union> WbisT)\"\n    using C T by (auto simp: WretrT_def matchC_MC_def matchT_MT_def)\n  ultimately have \"?\\<theta> \\<subseteq> WbisT\"\n    using WbisT_coind by auto\n  with \\<phi> show ?thesis\n    by auto\nqed\n\n(* BisT: *)\nlemma BisT_prefix:\n\"BisT \\<subseteq> RetrT BisT\"\nunfolding BisT_def using mono_Retr bis_prefix by blast\n\nlemma BisT_sym: \"sym BisT\"\nunfolding BisT_def using mono_Retr sym_bis by blast\n\nlemma BisT_Sym: \"c \\<approx>T d \\<Longrightarrow> d \\<approx>T c\"\nusing BisT_sym unfolding sym_def by blast\n\nlemma BisT_converse:\n\"((c,d) \\<in> theta^-1 \\<union> BisT) = ((d,c) \\<in> theta \\<union> BisT)\"\nby (metis BisT_sym converseI converse_Un converse_converse sym_conv_converse_eq)\n\nlemma\nBisT_matchC_TMC: \"\\<And> c d. c \\<approx>T d \\<Longrightarrow> matchC_TMC BisT c d\"\nand \nBisT_matchT_TMT: \"\\<And> c d. c \\<approx>T d \\<Longrightarrow> matchT_TMT c d\"\nusing BisT_prefix unfolding RetrT_def by auto\n\nlemmas BisT_step = BisT_matchC_TMC BisT_matchT_TMT\n\nlemma\nBisT_matchC_TMC_rev: \"\\<And> c d. c \\<approx>T d \\<Longrightarrow> matchC_TMC BisT d c\"\nand \nBisT_matchT_TMT_rev: \"\\<And> c d. c \\<approx>T d \\<Longrightarrow> matchT_TMT d c\"\nusing BisT_step BisT_sym unfolding sym_def by blast+\n\nlemmas BisT_step_rev = BisT_matchC_TMC_rev BisT_matchT_TMT_rev \n\nlemma BisT_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> RetrT (theta \\<union> BisT)\"\nshows \"theta \\<subseteq> BisT\"\nusing assms mono_Retr bis_coind \nunfolding BisT_def by blast\n\nlemma BisT_raw_coind:  \nassumes \"sym theta\" and \"theta \\<subseteq> RetrT theta\"\nshows \"theta \\<subseteq> BisT\"\nusing assms mono_Retr bis_raw_coind \nunfolding BisT_def by blast\n\nlemma BisT_coind2:\nassumes \"theta \\<subseteq> RetrT (theta \\<union> BisT)\" and \n\"theta ^-1 \\<subseteq> RetrT ((theta ^-1) \\<union> BisT)\"\nshows \"theta \\<subseteq> BisT\"\nusing assms mono_Retr bis_coind2 \nunfolding BisT_def by blast\n\nlemma BisT_raw_coind2:\nassumes \"theta \\<subseteq> RetrT theta\" and \n\"theta ^-1 \\<subseteq> RetrT (theta ^-1)\"\nshows \"theta \\<subseteq> BisT\"\nusing assms mono_Retr bis_raw_coind2 \nunfolding BisT_def by blast\n\ntext\\<open>Inclusions between bisimilarities:\\<close>\n\nlemma match_imp[simp]:\n\"\\<And> theta c1 c2. matchC_C theta c1 c2 \\<Longrightarrow> matchC_ZOC theta c1 c2\"\n(*  *)\n\"\\<And> theta c1 c2. matchC_ZOC theta c1 c2 \\<Longrightarrow> matchC_ZO theta c1 c2\"\n(*  *)\n\"\\<And> theta c1 c2. matchC_ZOC theta c1 c2 \\<Longrightarrow> matchC_MC theta c1 c2\"\n(*  *)\n\"\\<And> theta c1 c2. matchC_ZO theta c1 c2 \\<Longrightarrow> matchC_M theta c1 c2\"\n(*  *)\n\"\\<And> theta c1 c2. matchC_MC theta c1 c2 \\<Longrightarrow> matchC_M theta c1 c2\"\n(*  *)\n(*  *)\n\"\\<And> c1 c2. matchT_T c1 c2 \\<Longrightarrow> matchT_ZO c1 c2\"\n(*  *)\n\"\\<And> c1 c2. matchT_T c1 c2 \\<Longrightarrow> matchT_MT c1 c2\"\n(*  *)\n\"\\<And> c1 c2. matchT_ZO c1 c2 \\<Longrightarrow> matchT_M c1 c2\"\n(*  *)\n\"\\<And> c1 c2. matchT_MT c1 c2 \\<Longrightarrow> matchT_M c1 c2\"\n(*  *)\n\"\\<And> theta c1 c2. matchC_MC theta c1 c2 \\<Longrightarrow> matchC_TMC theta c1 c2\"\n(*  *)\n\"\\<And> theta c1 c2. matchT_MT c1 c2 \\<Longrightarrow> matchT_TMT c1 c2\"\nunfolding match_defs apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\napply fastforce apply fastforce\napply (metis MtransC_Refl transC_MtransC)\nby force+\n\nlemma Retr_incl:\n\"\\<And>theta. Sretr theta \\<subseteq> ZOretrT theta\"\n(*  *)\n\"\\<And>theta. ZOretrT theta \\<subseteq> ZOretr theta\"\n(*  *)\n\"\\<And>theta. ZOretrT theta \\<subseteq> WretrT theta\"\n(*  *)\n\"\\<And>theta. ZOretr theta \\<subseteq> Wretr theta\"\n(*  *)\n\"\\<And>theta. WretrT theta \\<subseteq> Wretr theta\"\n(*  *)\n\"\\<And>theta. WretrT theta \\<subseteq> RetrT theta\"\nunfolding Retr_defs by auto\n\nlemma bis_incl:\n\"Sbis \\<subseteq> ZObisT\"\n(*  *)\n\"ZObisT \\<subseteq> ZObis\"\n(*  *)\n\"ZObisT \\<subseteq> WbisT\"\n(*  *)\n\"ZObis \\<subseteq> Wbis\"\n(*  *)\n\"WbisT \\<subseteq> Wbis\"\n(*  *)\n\"WbisT \\<subseteq> BisT\"\nunfolding bis_defs \nusing Retr_incl mono_bis mono_Retr by blast+\n\nlemma bis_imp[simp]:\n\"\\<And> c1 c2. c1 \\<approx>s c2 \\<Longrightarrow> c1 \\<approx>01T c2\"\n(*  *)\n\"\\<And> c1 c2. c1 \\<approx>01T c2 \\<Longrightarrow> c1 \\<approx>01 c2\"\n(*  *)\n\"\\<And> c1 c2. c1 \\<approx>01T c2 \\<Longrightarrow> c1 \\<approx>wT c2\"\n(*  *)\n\"\\<And> c1 c2. c1 \\<approx>01 c2 \\<Longrightarrow> c1 \\<approx>w c2\"\n(*  *)\n\"\\<And> c1 c2. c1 \\<approx>wT c2 \\<Longrightarrow> c1 \\<approx>w c2\"\n(*  *)\n\"\\<And> c1 c2. c1 \\<approx>wT c2 \\<Longrightarrow> c1 \\<approx>T c2\"\nusing bis_incl rev_subsetD by auto\n\ntext\\<open>Self-isomorphism implies strong bisimilarity:\\<close>\n\n\n\ntext\\<open>0-Self-isomorphism implies weak T 0-bisimilarity:\\<close>\n\nlemma siso0_Sbis[simp]:\nassumes \"siso0 c\"\nshows \"c \\<approx>T c\"\nproof-\n  let ?theta = \"{(c,c) | c . siso0 c}\"\n  have \"?theta \\<subseteq> BisT\"\n  proof(rule BisT_raw_coind)\n    show \"sym ?theta\" unfolding sym_def by blast\n  next\n    show \"?theta \\<subseteq> RetrT ?theta\"\n    proof clarify\n      fix c assume c: \"siso0 c\"\n      show \"(c, c) \\<in> RetrT ?theta\"\n      unfolding RetrT_def proof (clarify, intro conjI)\n        show \"matchC_TMC ?theta c c\"\n        unfolding matchC_TMC_def apply simp\n        by (metis c siso0_transC siso0_transC_indis transC_MtransC)\n      next\n        show \"matchT_TMT c c\"\n        unfolding matchC_TMC_def\n        by (metis c matchT_TMT_def siso0_transT transT_MtransT)\n      qed\n    qed\n  qed\n  thus ?thesis using assms by blast\nqed\n \n\nend \n(* context PL_Indis *)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Possibilistic_Noninterference/During_Execution.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.33893683676997993}}
{"text": "section \"Invariants for Promela data structures\"\ntheory PromelaInvariants\nimports PromelaDatastructures\nbegin\n\ntext \\<open>\n  The different data structures used in the Promela implementation require different invariants,\n  which are specified in this file. As there is no (useful) way of specifying \\emph{correctness} of the implementation,\nthose invariants are tailored towards proving the finitness of the generated state-space. \n\\<close>\n\n(*<*)\n(*subsection {* Auxiliary lemmas *}*)\nlemma foldli_set:\n  \"set (foldli list (\\<lambda>_. True) (#) xs) = set xs \\<union> set list\"\n  by (induct list arbitrary: xs) simp_all\n\nlemma foldli_conj:\n  \"foldli list id (\\<lambda>kv \\<sigma>. P kv) b \\<longleftrightarrow> b \\<and> (\\<forall>x \\<in> set list. P x)\"\n  by (induct list arbitrary: b) simp_all\n\n(* Destroy the evil border of abstraction... *)\nlemma lm_ball_Assoc_List_set:\n  \"lm.ball m P \\<longleftrightarrow> (\\<forall>x \\<in> Assoc_List.set m. P x)\"\n  unfolding Assoc_List.set_def\n  by (simp add: icf_rec_unf lm_basic.g_ball_def \n    poly_map_iteratei_defs.iteratei_def it_to_it_def Assoc_List.iteratei_def\n    foldli_conj)\n\nlemma lm_to_list_Assoc_List_set:\n  \"set (lm.to_list l) = Assoc_List.set l\"\n  unfolding Assoc_List.set_def\n  by (simp add: icf_rec_unf lm_basic.g_to_list_def \n    poly_map_iteratei_defs.iteratei_def it_to_it_def Assoc_List.iteratei_def \n    foldli_set)\n\nlemma dom_lm_\\<alpha>_Assoc_List_set:\n  \"dom (lm.\\<alpha> v) = fst ` (Assoc_List.set v)\"\n  by (simp add: icf_rec_unf Assoc_List.lookup_def Assoc_List.set_def\n    dom_map_of_conv_image_fst)\n\nlemma ran_lm_\\<alpha>_Assoc_List_set:\n  \"ran (lm.\\<alpha> v) = snd ` (Assoc_List.set v)\"\n  by (simp add: icf_rec_unf Assoc_List.lookup_def Assoc_List.set_def \n    ran_distinct)\n\nlemma lm_ball_eq_ran:\n  \"lm.ball v (\\<lambda>(k,v). P v) \\<longleftrightarrow> ran (lm.\\<alpha> v) \\<subseteq> Collect P\"\n  by (auto simp add: ran_lm_\\<alpha>_Assoc_List_set lm_ball_Assoc_List_set)\n\nlemma lm_ball_lm_to_map_map_weaken:\n  \"\\<forall>x \\<in> f ` set xs. P x \\<Longrightarrow> lm.ball (lm.to_map (map f xs)) P\"\n  by (induct xs) (simp_all add: lm.correct)\n\nlemma Assoc_List_set_eq_lookup:\n  \"(k,v) \\<in> Assoc_List.set vs \\<longleftrightarrow> Assoc_List.lookup vs k = Some v\"\n  by (simp add: Assoc_List.lookup_def Assoc_List.set_def) \n\n(*>*)\n\nsubsection \\<open>Bounds\\<close>\n\ntext \\<open>\n  Finiteness requires that possible variable ranges are finite, as is the maximium number of processes.\n  Currently, they are supplied here as constants. In a perfect world, they should be able to be set dynamically. \n\\<close>\n\n(* NB! Make sure those values coincide with the bounds definied in @{const ppVarType} *)\ndefinition min_var_value :: \"integer\" where\n  \"min_var_value = -(2^31)\"\ndefinition max_var_value :: \"integer\" where\n  \"max_var_value = (2^31) - 1\"\n\nlemma min_max_var_value_simps [simp, intro!]:\n  \"min_var_value < max_var_value\"\n  \"min_var_value < 0\"\n  \"min_var_value \\<le> 0\"\n  \"max_var_value > 0\"\n  \"max_var_value \\<ge> 0\"\nby (simp_all add: min_var_value_def max_var_value_def)\n\ndefinition \"max_procs \\<equiv> 255\"\ndefinition \"max_channels \\<equiv> 65535\"\ndefinition \"max_array_size = 65535\"\n\n\nsubsection \\<open>Variables and similar\\<close>\n\nfun varType_inv :: \"varType \\<Rightarrow> bool\" where\n  \"varType_inv (VTBounded l h) \n  \\<longleftrightarrow> l \\<ge> min_var_value \\<and> h \\<le> max_var_value \\<and> l < h\"\n| \"varType_inv VTChan \\<longleftrightarrow> True\"\n\nfun variable_inv :: \"variable \\<Rightarrow> bool\" where\n  \"variable_inv (Var t val) \n  \\<longleftrightarrow> varType_inv t \\<and> val \\<in> {min_var_value..max_var_value}\"\n| \"variable_inv (VArray t sz ar) \n  \\<longleftrightarrow> varType_inv t \n    \\<and> sz \\<le> max_array_size \n    \\<and> IArray.length ar = sz \n    \\<and> set (IArray.list_of ar) \\<subseteq> {min_var_value..max_var_value}\"\n\nfun channel_inv :: \"channel \\<Rightarrow> bool\" where\n  \"channel_inv (Channel cap ts q) \n  \\<longleftrightarrow> cap \\<le> max_array_size \n    \\<and> cap \\<ge> 0 \n    \\<and> set ts \\<subseteq> Collect varType_inv \n    \\<and> length ts \\<le> max_array_size \n    \\<and> length q \\<le> max_array_size \n    \\<and> (\\<forall>x \\<in> set q. length x = length ts \n    \\<and> set x \\<subseteq> {min_var_value..max_var_value})\"\n| \"channel_inv (HSChannel ts) \n  \\<longleftrightarrow> set ts \\<subseteq> Collect varType_inv \\<and> length ts \\<le> max_array_size\"\n| \"channel_inv InvChannel \\<longleftrightarrow> True\"\n\nlemma varTypes_finite:\n  \"finite (Collect varType_inv)\"\nproof (rule finite_subset)\n  show \"Collect (varType_inv) \\<subseteq> \n      {VTChan} \n    \\<union> (\\<lambda>(l,h). VTBounded l h) \n      ` ({min_var_value..max_var_value} \\<times> {min_var_value..max_var_value})\"\n    apply (rule subsetI)\n    apply (case_tac x)\n      apply auto\n    done\n\n  show \"finite ...\" by auto\nqed\n\nlemma variables_finite:\n  \"finite (Collect variable_inv)\"\nproof (rule finite_subset)\n  let ?mm = \"{min_var_value..max_var_value}\"\n  let ?V1 = \"(\\<lambda>(t,val). Var t val) ` ({vt. varType_inv vt} \\<times> ?mm)\"\n  let ?V2 = \"(\\<lambda>(t,sz,ar). VArray t sz ar) \n    ` ({vt. varType_inv vt} \n      \\<times> {0..max_array_size} \n      \\<times> {ar. IArray.length ar \\<le> max_array_size \n           \\<and> set (IArray.list_of ar) \\<subseteq> ?mm})\"\n\n  {\n    fix A :: \"'a set\"\n    let ?LS = \"{xs. set xs \\<subseteq> A \\<and> length xs \\<le> max_array_size }\"\n    let ?AS = \"{ar. IArray.length ar \\<le> max_array_size \n      \\<and> set (IArray.list_of ar) \\<subseteq> A}\"\n\n    assume \"finite A\"\n    hence \"finite ?LS\" by (simp add: finite_lists_length_le)\n    moreover have \"?AS \\<subseteq> IArray ` ?LS\"\n      apply (auto simp: image_def)\n      apply (rule_tac x = \"IArray.list_of x\" in exI)\n      apply auto\n      apply (metis iarray.exhaust list_of.simps)\n      done\n    ultimately have \"finite ?AS\" by (auto simp add: finite_subset)\n  } note finite_arr = this\n\n  show \"Collect variable_inv \\<subseteq> (?V1 \\<union> ?V2)\"\n    apply (rule subsetI)\n    apply (case_tac x)\n      apply (auto simp add: image_def)\n    done\n\n  show \"finite ...\" by (blast intro: varTypes_finite finite_arr)\nqed\n\nlemma channels_finite:\n  \"finite (Collect channel_inv)\"\nproof (rule finite_subset)\n  let ?C1 = \n    \"(\\<lambda>(cap,ts,q). Channel cap ts q) \n     ` ({0..max_array_size} \n      \\<times> {ts. set ts \\<subseteq> Collect varType_inv \\<and> length ts \\<le> max_array_size} \n      \\<times> {q. set q \\<subseteq> {x. set x \\<subseteq> {min_var_value..max_var_value} \n                        \\<and> length x \\<le> max_array_size} \n            \\<and> length q \\<le> max_array_size})\"\n  let ?C2 = \n    \"HSChannel ` {ts. set ts \\<subseteq> Collect varType_inv \\<and> length ts \\<le> max_array_size}\"\n  let ?C3 = \"{InvChannel}\"\n\n  show \"(Collect channel_inv) \\<subseteq> ?C1 \\<union> ?C2 \\<union> ?C3\"\n    apply (rule subsetI)\n    apply (case_tac x)\n      apply (auto simp add: image_def)\n    done\n\n  show \"finite ...\" by (blast intro: finite_lists_length_le varTypes_finite)+\nqed\n\ntext \\<open>To give an upper bound of variable names, we need a way to calculate it.\\<close>\n\nprimrec procArgName :: \"procArg \\<Rightarrow> String.literal\" where\n  \"procArgName (ProcArg _ name) = name\"\n\nprimrec varDeclName :: \"varDecl \\<Rightarrow> String.literal\" where\n  \"varDeclName (VarDeclNum _ _ name _ _) = name\"\n| \"varDeclName (VarDeclChan name _ _) = name\"\n\nprimrec procVarDeclName :: \"procVarDecl \\<Rightarrow> String.literal\" where\n  \"procVarDeclName (ProcVarDeclNum _ _ name _ _) = name\"\n| \"procVarDeclName (ProcVarDeclChan name _) = name\"\n\ndefinition edgeDecls :: \"edge \\<Rightarrow> procVarDecl set\" where\n  \"edgeDecls e = (\n     case effect e of\n      EEDecl p \\<Rightarrow> {p}\n    |  _ \\<Rightarrow> {})\" \n\nlemma edgeDecls_finite:\n  \"finite (edgeDecls e)\"\nby (simp add: edgeDecls_def split: edgeEffect.split)\n\ndefinition edgeSet :: \"states \\<Rightarrow> edge set\" where\n  \"edgeSet s = set (concat (map snd (IArray.list_of s)))\"\n\nlemma edgeSet_finite:\n  \"finite (edgeSet s)\"\nby (simp add: edgeSet_def)\n\ndefinition statesDecls :: \"states \\<Rightarrow> procVarDecl set\" where\n  \"statesDecls s = \\<Union>(edgeDecls ` (edgeSet s))\"\n\ndefinition statesNames :: \"states \\<Rightarrow> String.literal set\" where\n  \"statesNames s = procVarDeclName ` statesDecls s\"\n\nlemma statesNames_finite:\n  \"finite (statesNames s)\"\nby (simp add: edgeSet_finite edgeDecls_finite statesNames_def statesDecls_def)\n\n\nfun process_names :: \"states \\<Rightarrow> process \\<Rightarrow> String.literal set\" where\n  \"process_names ss (_, _, args, decls) = \n      statesNames ss \n    \\<union> procArgName ` set args \n    \\<union> varDeclName ` set decls\n    \\<union> {STR ''_'', STR ''__assert__'', STR ''_pid''}\" (* dunno if this is ok as a fixed set ... *)\n\nlemma process_names_finite:\n  \"finite (process_names ss p)\"\nby (cases p) (simp add: statesNames_finite)\n\ndefinition vardict_inv :: \"states \\<Rightarrow> process \\<Rightarrow> var_dict \\<Rightarrow> bool\" where\n  \"vardict_inv ss p vs \n   \\<longleftrightarrow> lm.ball vs (\\<lambda>(k,v). k \\<in> process_names ss p \\<and> variable_inv v)\"\n\nlemma vardicts_finite:\n  \"finite (Collect (vardict_inv ss p))\"\nproof -\n  have \"Assoc_List.set ` Collect (vardict_inv ss p) \\<subseteq> \n           Pow (process_names ss p \\<times> {v. variable_inv v})\"\n    by (auto simp add: lm_ball_Assoc_List_set vardict_inv_def)\n\n  moreover have \"finite ...\"\n    using process_names_finite variables_finite\n    by simp\n  ultimately show ?thesis by (metis finite_Assoc_List_set_image finite_subset)\nqed\n\nlemma lm_to_map_vardict_inv:\n  assumes \"\\<forall>(k,v) \\<in> set xs. k \\<in> process_names ss proc \\<and> variable_inv v\"\n  shows \"vardict_inv ss proc (lm.to_map xs)\"\nusing assms\nunfolding vardict_inv_def\nby (auto simp add: lm.correct dest: map_of_SomeD)\n\nsubsection \\<open>Invariants of a process\\<close>\n\n(* The definition of a channel to be between -1 and max_channels definitly lacks the necessary abstraction ... *)\ndefinition pState_inv :: \"program \\<Rightarrow> pState \\<Rightarrow> bool\" where\n  \"pState_inv prog p \n  \\<longleftrightarrow> pid p \\<le> max_procs\n    \\<and> pState.idx p < IArray.length (states prog) \n    \\<and> IArray.length (states prog) = IArray.length (processes prog)\n    \\<and> pc p < IArray.length ((states prog) !! pState.idx p)\n    \\<and> set (pState.channels p) \\<subseteq> {-1..<integer_of_nat max_channels} \n    \\<and> length (pState.channels p) \\<le> max_channels\n    \\<and> vardict_inv ((states prog) !! pState.idx p) \n                  ((processes prog) !! pState.idx p) \n                  (pState.vars p)\"\n\nlemma pStates_finite:\n  \"finite (Collect (pState_inv prog))\"\nproof -\n  let ?P1 = \"{..max_procs::nat}\"\n  let ?P2 = \"{..IArray.length (states prog)}\"\n  let ?P3 = \"{..Max (IArray.length ` (set (IArray.list_of (states prog))))}\"\n  let ?P4 = \"{cs. set cs \\<subseteq> {-1..<integer_of_nat max_channels} \n                  \\<and> length cs \\<le> max_channels}\"\n  let ?P5 = \"\\<Union>x\\<in>{..IArray.length (states prog)}. \n                Collect (vardict_inv (states prog !! x) (processes prog !! x))\"\n  let ?P = \"?P1 \\<times> ?P2 \\<times> ?P3 \\<times> ?P4 \\<times> ?P5\"\n\n  have \"{p. pState_inv prog p} \\<subseteq> \n    (\\<lambda>(pid,idx,pc,channels,vars). pState.make pid vars pc channels idx) ` ?P\"\n    unfolding pState_inv_def image_def [of _ ?P]\n    apply (clarsimp simp add: pState.defs)\n    apply (tactic \\<open>Record.split_simp_tac @{context} [] (K ~1) 1\\<close>)\n    apply auto\n    apply (rule order_trans [OF less_imp_le])\n    apply (auto intro!: Max_ge)\n    done\n  moreover\n  have \"finite ?P4\" by (fastforce intro: finite_lists_length_le)\n  hence \"finite ?P\" by (auto intro: finite_cartesian_product simp: vardicts_finite)\n\n  ultimately show ?thesis by (elim finite_subset) (rule finite_imageI)\nqed\n\ntext \\<open>\n  Throughout the calculation of the semantic engine, a modified process is not necessarily part of @{term \"procs g\"}.\n  Hence we need to establish an additional constraint for the relation between a global and a process state.\\<close>\n\ndefinition cl_inv :: \"('a gState_scheme * pState) \\<Rightarrow> bool\" where\n  \"cl_inv gp = (case gp of (g,p) \\<Rightarrow> \n      length (pState.channels p) \\<le> length (gState.channels g))\"\n\nlemma cl_inv_lengthD:\n  \"cl_inv (g,p) \\<Longrightarrow> length (pState.channels p) \\<le> length (gState.channels g)\"\nunfolding cl_inv_def\nby auto\n\nlemma cl_invI:\n  \"length (pState.channels p) \\<le> length (gState.channels g) \\<Longrightarrow> cl_inv (g,p)\"\nunfolding cl_inv_def by auto\n\nlemma cl_inv_trans:\n  \"length (channels g) \\<le> length (channels g') \\<Longrightarrow> cl_inv (g,p) \\<Longrightarrow> cl_inv (g',p)\"\nby (simp add: cl_inv_def)\n\nlemma cl_inv_vars_update[intro!]:\n  \"cl_inv (g,p) \\<Longrightarrow> cl_inv (g, pState.vars_update vs p)\"\n  \"cl_inv (g,p) \\<Longrightarrow> cl_inv (gState.vars_update vs g, p)\"\nby (simp_all add: cl_inv_def)\n\nlemma cl_inv_handshake_update[intro!]:\n  \"cl_inv (g,p) \\<Longrightarrow> cl_inv (g\\<lparr>handshake := h\\<rparr>,p)\"\nby (simp add: cl_inv_def)\n\n\n\nlemma cl_inv_procs_update[intro!]:\n  \"cl_inv (g,p) \\<Longrightarrow> cl_inv (g\\<lparr>procs := ps\\<rparr>,p)\"\nby (simp add: cl_inv_def)\n\nlemma cl_inv_channels_update:\n  assumes \"cl_inv (g,p)\"\n  shows \"cl_inv (gState.channels_update (\\<lambda>cs. cs[i:=c]) g, p)\"\nusing assms unfolding cl_inv_def \nby simp\n\nsubsection \\<open>Invariants of the global state\\<close>\n\ntext \\<open>Note that @{term gState_inv} must be defined in a way to be applicable to both @{typ gState} and @{typ gState\\<^sub>I}.\\<close>\n\ndefinition gState_inv :: \"program \\<Rightarrow> 'a gState_scheme \\<Rightarrow> bool\" where\n  \"gState_inv prog g \n  \\<longleftrightarrow> length (procs g) \\<le> max_procs \n    \\<and> (\\<forall>p \\<in> set (procs g). pState_inv prog p \\<and> cl_inv (g,p))\n    \\<and> length (channels g) \\<le> max_channels\n    \\<and> set (channels g) \\<subseteq> Collect channel_inv\n    \\<and> lm.ball (vars g) (\\<lambda>(k,v). variable_inv v)\" \n\ntext \\<open>The set of global states adhering to the terms of @{const gState_inv} is not finite.\nBut the set of all global states that can be constructed by the semantic engine from one starting state is. \nThus we establish a progress relation, \\ie all successors of a state @{term g} relate to @{term g} under this specification.\\<close>\n\ndefinition gState_progress_rel :: \"program \\<Rightarrow> ('a gState_scheme) rel\" where\n  \"gState_progress_rel p = {(g,g'). gState_inv p g \\<and> gState_inv p g'\n                                  \\<and> length (channels g) \\<le> length (channels g')\n                                  \\<and> dom (lm.\\<alpha> (vars g)) = dom (lm.\\<alpha> (vars g'))}\"\n\nlemma gState_progress_rel_gState_invI1[intro]:\n  \"(g,g') \\<in> gState_progress_rel prog \\<Longrightarrow> gState_inv prog g\"\nby (simp add: gState_progress_rel_def)\n\nlemma gState_progress_rel_gState_invI2[intro]:\n  \"(g,g') \\<in> gState_progress_rel prog \\<Longrightarrow> gState_inv prog g'\"\nby (simp add: gState_progress_rel_def)\n\nlemma gState_progress_relI:\n  assumes \"gState_inv prog g\"\n  and \"gState_inv prog g'\"\n  and \"length (channels g) \\<le> length (channels g')\"\n  and \"dom (lm.\\<alpha> (vars g)) = dom (lm.\\<alpha> (vars g'))\"\n  shows \"(g,g') \\<in> gState_progress_rel prog\"\nunfolding gState_progress_rel_def\nusing assms\nby auto\n\nlemma gState_progress_refl[simp,intro!]:\n  \"gState_inv prog g \\<Longrightarrow> (g,g) \\<in> (gState_progress_rel prog)\"\nunfolding gState_progress_rel_def\nby auto\n\nlemma refl_on_gState_progress_rel:\n  \"refl_on (Collect (gState_inv prog)) (gState_progress_rel prog)\"\nby (auto intro!: refl_onI)\n\nlemma trans_gState_progress_rel[simp]:\n  \"trans (gState_progress_rel prog)\"\nby (intro transI) (simp add: gState_progress_rel_def)\n\nlemmas gState_progress_rel_trans [trans] = trans_gState_progress_rel[THEN transD]\n\nlemma gState_progress_rel_trancl_id[simp]:\n  \"(gState_progress_rel prog)\\<^sup>+ = gState_progress_rel prog\"\nby simp\n\nlemma gState_progress_rel_rtrancl_absorb:\n  assumes \"gState_inv prog g\"\n  shows \"(gState_progress_rel prog)\\<^sup>* `` {g} = gState_progress_rel prog `` {g}\"\nusing assms refl_on_gState_progress_rel\nby (intro Image_absorb_rtrancl) auto\n\ntext \\<open>\n  The main theorem: The set of all global states reachable from an initial state, is finite.\n\\<close>\nlemma gStates_finite:\n  fixes g :: \"gState\"\n  shows \"finite ((gState_progress_rel prog)\\<^sup>* `` {g})\"\nproof (cases \"gState_inv prog g\")\n  case False hence \"(gState_progress_rel prog)\\<^sup>* `` {g} = {g}\" \n    by (intro Image_empty_rtrancl_Image_id) \n       (auto simp add: gState_progress_rel_def)\n  thus ?thesis by simp\nnext\n  case True\n  let ?G1 = \"{m. dom (lm.\\<alpha> m) = dom (lm.\\<alpha> (vars g)) \n                 \\<and> ran (lm.\\<alpha> m) \\<subseteq> Collect variable_inv }\"\n  let ?G2 = \"{cs. set cs \\<subseteq> Collect channel_inv \n                  \\<and> length cs \\<le> max_channels}\"\n  let ?G3 = \"{True, False}\"\n  let ?G4 = \"{ps. set ps \\<subseteq> Collect (pState_inv prog) \n                  \\<and> length ps \\<le> max_procs}\"\n  \n  let ?G = \"?G1 \\<times> ?G2 \\<times> ?G3 \\<times> ?G4\"\n  let ?G' = \"(\\<lambda>(vars,chans,t,ps). gState.make vars chans t ps) ` ?G\"\n\n  have G1: \"finite ?G1\"\n  proof (rule finite_subset)\n    show \"?G1 \\<subseteq> {v'. fst ` Assoc_List.set v' = fst ` Assoc_List.set (vars g) \n                     \\<and> snd ` Assoc_List.set v' \\<subseteq> Collect variable_inv}\"\n      by (simp add: dom_lm_\\<alpha>_Assoc_List_set ran_lm_\\<alpha>_Assoc_List_set)\n    show \"finite ...\" (is \"finite ?X\")\n    proof (rule finite_Assoc_List_set_image, rule finite_subset)\n      show \"Assoc_List.set ` ?X \\<subseteq> \n             Pow (fst ` Assoc_List.set (vars g) \\<times> Collect variable_inv)\"\n        by auto\n      show \"finite ...\" by (auto simp add: variables_finite dom_lm_\\<alpha>_Assoc_List_set[symmetric])\n    qed\n  qed\n\n  have \"finite ((gState_progress_rel prog) `` {g})\"\n  proof (rule finite_subset)\n    show \"(gState_progress_rel prog) `` {g} \\<subseteq> \n           (\\<lambda>(vars,chans,t,ps). gState.make vars chans t ps) ` ?G\"\n      apply (clarsimp simp add: image_def gState_inv_def gState.defs gState_progress_rel_def)\n      apply (rule_tac x = \"vars x\" in exI)\n      apply (simp add: lm_ball_eq_ran)\n      apply (rule_tac x = \"channels x\" in exI)\n      apply (case_tac \"timeout x\")\n        apply clarsimp\n        apply (rule_tac x=\"procs x\" in exI)\n        apply auto\n      done\n    show \"finite ...\" using G1 \n      by (blast intro: finite_lists_length_le channels_finite pStates_finite)\n  qed\n  with gState_progress_rel_rtrancl_absorb[OF True] show ?thesis by simp\nqed\n\nlemma gState_progress_rel_channels_update:\n  assumes \"gState_inv prog g\"\n  and \"channel_inv c\"\n  and \"i < length (channels g)\"\n  shows \"(g,gState.channels_update (\\<lambda>cs. cs[i:=c]) g) \\<in> gState_progress_rel prog\"\nusing assms\nby (auto intro!: gState_progress_relI \n         simp add: gState_inv_def cl_inv_def \n         dest!: subsetD[OF set_update_subset_insert])\n\nlemma gState_progress_rel_channels_update_step:\n  assumes \"gState_inv prog g\"\n  and step: \"(g,g') \\<in> gState_progress_rel prog\"\n  and \"channel_inv c\"\n  and \"i < length (channels g')\"\n  shows \"(g,gState.channels_update (\\<lambda>cs. cs[i:=c]) g') \\<in> gState_progress_rel prog\"\nproof -\n  note step\n  also hence \"gState_inv prog g'\" by blast\n  note gState_progress_rel_channels_update[OF this assms(3,4)]\n  finally show ?thesis .\nqed\n\nsubsection \\<open>Invariants of the program\\<close>\n\ntext \\<open>\n  Naturally, we need our program to also adhere to certain invariants. Else we can't show, that\n  the generated states are correct according to the invariants above.\n\\<close>\n\ndefinition program_inv where\n  \"program_inv prog \n  \\<longleftrightarrow> IArray.length (states prog) > 0\n    \\<and> IArray.length (states prog) = IArray.length (processes prog)\n    \\<and> (\\<forall>s \\<in> set (IArray.list_of (states prog)). IArray.length s > 0)\n    \\<and> lm.ball (proc_data prog) \n              (\\<lambda>(_,sidx). \n                    sidx < IArray.length (processes prog) \n                  \\<and> fst (processes prog !! sidx) = sidx)\n    \\<and> (\\<forall>(sidx,start,procArgs,args) \\<in> set (IArray.list_of (processes prog)). \n        (\\<exists>s. start = Index s \\<and> s < IArray.length (states prog !! sidx)))\"\n\nlemma program_inv_length_states:\n  assumes \"program_inv prog\"\n  and \"n < IArray.length (states prog)\"\n  shows \"IArray.length (states prog !! n) > 0\"\nusing assms by (simp add: program_inv_def)\n\nlemma program_invI:\n  assumes \"0 < IArray.length (states prog)\"\n  and \"IArray.length (states prog) = IArray.length (processes prog)\"\n  and \"\\<And>s. s \\<in> set (IArray.list_of (states prog)) \n           \\<Longrightarrow> 0 < IArray.length s\"\n  and \"\\<And>sidx. sidx \\<in> ran (lm.\\<alpha> (proc_data prog)) \n               \\<Longrightarrow> sidx < IArray.length (processes prog) \n                  \\<and> fst (processes prog !! sidx) = sidx\"\n  and \"\\<And>sidx start procArgs args. \n         (sidx,start,procArgs,args) \\<in> set (IArray.list_of (processes prog)) \n         \\<Longrightarrow> \\<exists>s. start = Index s \\<and> s < IArray.length (states prog !! sidx)\"\n  shows \"program_inv prog\"\nunfolding program_inv_def\nusing assms\nby (auto simp add: lm_ball_eq_ran)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Promela/PromelaInvariants.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7606506526772884, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.3388923316148598}}
{"text": "theory flash85Bra  imports flash85Rev\n \n  begin\nlemma onInv85:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv85 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv85 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv85 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash85Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7606506526772883, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.33889233161485977}}
{"text": "(*  Title:      HOL/UNITY/Comp/Alloc.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1998  University of Cambridge\n\nSpecification of Chandy and Charpentier's Allocator\n*)\n\ntheory Alloc\nimports AllocBase \"../PPROD\"\nbegin\n\nsubsection{*State definitions.  OUTPUT variables are locals*}\n\nrecord clientState =\n  giv :: \"nat list\"   --{*client's INPUT history:  tokens GRANTED*}\n  ask :: \"nat list\"   --{*client's OUTPUT history: tokens REQUESTED*}\n  rel :: \"nat list\"   --{*client's OUTPUT history: tokens RELEASED*}\n\nrecord 'a clientState_d =\n  clientState +\n  dummy :: 'a       --{*dummy field for new variables*}\n\ndefinition\n  --{*DUPLICATED FROM Client.thy, but with \"tok\" removed*}\n  --{*Maybe want a special theory section to declare such maps*}\n  non_dummy :: \"'a clientState_d => clientState\"\n  where \"non_dummy s = (|giv = giv s, ask = ask s, rel = rel s|)\"\n\ndefinition\n  --{*Renaming map to put a Client into the standard form*}\n  client_map :: \"'a clientState_d => clientState*'a\"\n  where \"client_map = funPair non_dummy dummy\"\n\n\nrecord allocState =\n  allocGiv :: \"nat => nat list\"   --{*OUTPUT history: source of \"giv\" for i*}\n  allocAsk :: \"nat => nat list\"   --{*INPUT: allocator's copy of \"ask\" for i*}\n  allocRel :: \"nat => nat list\"   --{*INPUT: allocator's copy of \"rel\" for i*}\n\nrecord 'a allocState_d =\n  allocState +\n  dummy    :: 'a                --{*dummy field for new variables*}\n\nrecord 'a systemState =\n  allocState +\n  client :: \"nat => clientState\"  --{*states of all clients*}\n  dummy  :: 'a                    --{*dummy field for new variables*}\n\n\n--{** Resource allocation system specification **}\n\ndefinition\n  --{*spec (1)*}\n  system_safety :: \"'a systemState program set\"\n  where \"system_safety =\n     Always {s. (SUM i: lessThan Nclients. (tokens o giv o sub i o client)s)\n     \\<le> NbT + (SUM i: lessThan Nclients. (tokens o rel o sub i o client)s)}\"\n\ndefinition\n  --{*spec (2)*}\n  system_progress :: \"'a systemState program set\"\n  where \"system_progress = (INT i : lessThan Nclients.\n                        INT h.\n                          {s. h \\<le> (ask o sub i o client)s} LeadsTo\n                          {s. h pfixLe (giv o sub i o client) s})\"\n\ndefinition\n  system_spec :: \"'a systemState program set\"\n  where \"system_spec = system_safety Int system_progress\"\n\n--{** Client specification (required) ***}\n\ndefinition\n  --{*spec (3)*}\n  client_increasing :: \"'a clientState_d program set\"\n  where \"client_increasing = UNIV guarantees  Increasing ask Int Increasing rel\"\n\ndefinition\n  --{*spec (4)*}\n  client_bounded :: \"'a clientState_d program set\"\n  where \"client_bounded = UNIV guarantees  Always {s. ALL elt : set (ask s). elt \\<le> NbT}\"\n\ndefinition\n  --{*spec (5)*}\n  client_progress :: \"'a clientState_d program set\"\n  where \"client_progress =\n         Increasing giv  guarantees\n         (INT h. {s. h \\<le> giv s & h pfixGe ask s}\n                 LeadsTo {s. tokens h \\<le> (tokens o rel) s})\"\n\ndefinition\n  --{*spec: preserves part*}\n  client_preserves :: \"'a clientState_d program set\"\n  where \"client_preserves = preserves giv Int preserves clientState_d.dummy\"\n\ndefinition\n  --{*environmental constraints*}\n  client_allowed_acts :: \"'a clientState_d program set\"\n  where \"client_allowed_acts =\n       {F. AllowedActs F =\n            insert Id (UNION (preserves (funPair rel ask)) Acts)}\"\n\ndefinition\n  client_spec :: \"'a clientState_d program set\"\n  where \"client_spec = client_increasing Int client_bounded Int client_progress\n                    Int client_allowed_acts Int client_preserves\"\n\n--{** Allocator specification (required) **}\n\ndefinition\n  --{*spec (6)*}\n  alloc_increasing :: \"'a allocState_d program set\"\n  where \"alloc_increasing =\n         UNIV  guarantees\n         (INT i : lessThan Nclients. Increasing (sub i o allocGiv))\"\n\ndefinition\n  --{*spec (7)*}\n  alloc_safety :: \"'a allocState_d program set\"\n  where \"alloc_safety =\n         (INT i : lessThan Nclients. Increasing (sub i o allocRel))\n         guarantees\n         Always {s. (SUM i: lessThan Nclients. (tokens o sub i o allocGiv)s)\n         \\<le> NbT + (SUM i: lessThan Nclients. (tokens o sub i o allocRel)s)}\"\n\ndefinition\n  --{*spec (8)*}\n  alloc_progress :: \"'a allocState_d program set\"\n  where \"alloc_progress =\n         (INT i : lessThan Nclients. Increasing (sub i o allocAsk) Int\n                                     Increasing (sub i o allocRel))\n         Int\n         Always {s. ALL i<Nclients.\n                     ALL elt : set ((sub i o allocAsk) s). elt \\<le> NbT}\n         Int\n         (INT i : lessThan Nclients.\n          INT h. {s. h \\<le> (sub i o allocGiv)s & h pfixGe (sub i o allocAsk)s}\n                 LeadsTo\n                 {s. tokens h \\<le> (tokens o sub i o allocRel)s})\n         guarantees\n             (INT i : lessThan Nclients.\n              INT h. {s. h \\<le> (sub i o allocAsk) s}\n                     LeadsTo\n                     {s. h pfixLe (sub i o allocGiv) s})\"\n\n  (*NOTE: to follow the original paper, the formula above should have had\n        INT h. {s. h i \\<le> (sub i o allocGiv)s & h i pfixGe (sub i o allocAsk)s}\n               LeadsTo\n               {s. tokens h i \\<le> (tokens o sub i o allocRel)s})\n    thus h should have been a function variable.  However, only h i is ever\n    looked at.*)\n\ndefinition\n  --{*spec: preserves part*}\n  alloc_preserves :: \"'a allocState_d program set\"\n  where \"alloc_preserves = preserves allocRel Int preserves allocAsk Int\n                        preserves allocState_d.dummy\"\n\ndefinition\n  --{*environmental constraints*}\n  alloc_allowed_acts :: \"'a allocState_d program set\"\n  where \"alloc_allowed_acts =\n       {F. AllowedActs F =\n            insert Id (UNION (preserves allocGiv) Acts)}\"\n\ndefinition\n  alloc_spec :: \"'a allocState_d program set\"\n  where \"alloc_spec = alloc_increasing Int alloc_safety Int alloc_progress Int\n                   alloc_allowed_acts Int alloc_preserves\"\n\n--{** Network specification **}\n\ndefinition\n  --{*spec (9.1)*}\n  network_ask :: \"'a systemState program set\"\n  where \"network_ask = (INT i : lessThan Nclients.\n                        Increasing (ask o sub i o client)  guarantees\n                        ((sub i o allocAsk) Fols (ask o sub i o client)))\"\n\ndefinition\n  --{*spec (9.2)*}\n  network_giv :: \"'a systemState program set\"\n  where \"network_giv = (INT i : lessThan Nclients.\n                        Increasing (sub i o allocGiv)\n                        guarantees\n                        ((giv o sub i o client) Fols (sub i o allocGiv)))\"\n\ndefinition\n  --{*spec (9.3)*}\n  network_rel :: \"'a systemState program set\"\n  where \"network_rel = (INT i : lessThan Nclients.\n                        Increasing (rel o sub i o client)\n                        guarantees\n                        ((sub i o allocRel) Fols (rel o sub i o client)))\"\n\ndefinition\n  --{*spec: preserves part*}\n  network_preserves :: \"'a systemState program set\"\n  where \"network_preserves =\n       preserves allocGiv  Int\n       (INT i : lessThan Nclients. preserves (rel o sub i o client)  Int\n                                   preserves (ask o sub i o client))\"\n\ndefinition\n  --{*environmental constraints*}\n  network_allowed_acts :: \"'a systemState program set\"\n  where \"network_allowed_acts =\n       {F. AllowedActs F =\n           insert Id\n            (UNION (preserves allocRel Int\n                    (INT i: lessThan Nclients. preserves(giv o sub i o client)))\n                  Acts)}\"\n\ndefinition\n  network_spec :: \"'a systemState program set\"\n  where \"network_spec = network_ask Int network_giv Int\n                     network_rel Int network_allowed_acts Int\n                     network_preserves\"\n\n\n--{** State mappings **}\ndefinition\n  sysOfAlloc :: \"((nat => clientState) * 'a) allocState_d => 'a systemState\"\n  where \"sysOfAlloc = (%s. let (cl,xtr) = allocState_d.dummy s\n                       in (| allocGiv = allocGiv s,\n                             allocAsk = allocAsk s,\n                             allocRel = allocRel s,\n                             client   = cl,\n                             dummy    = xtr|))\"\n\n\ndefinition\n  sysOfClient :: \"(nat => clientState) * 'a allocState_d => 'a systemState\"\n  where \"sysOfClient = (%(cl,al). (| allocGiv = allocGiv al,\n                                 allocAsk = allocAsk al,\n                                 allocRel = allocRel al,\n                                 client   = cl,\n                                 systemState.dummy = allocState_d.dummy al|))\"\n\naxiomatization Alloc :: \"'a allocState_d program\"\n  where Alloc: \"Alloc : alloc_spec\"\n\naxiomatization Client :: \"'a clientState_d program\"\n  where Client: \"Client : client_spec\"\n\naxiomatization Network :: \"'a systemState program\"\n  where Network: \"Network : network_spec\"\n\ndefinition System  :: \"'a systemState program\"\n  where \"System = rename sysOfAlloc Alloc Join Network Join\n                 (rename sysOfClient\n                  (plam x: lessThan Nclients. rename client_map Client))\"\n\n\n(**\nlocale System =\n  fixes\n    Alloc   :: 'a allocState_d program\n    Client  :: 'a clientState_d program\n    Network :: 'a systemState program\n    System  :: 'a systemState program\n\n  assumes\n    Alloc   \"Alloc   : alloc_spec\"\n    Client  \"Client  : client_spec\"\n    Network \"Network : network_spec\"\n\n  defines\n    System_def\n      \"System == rename sysOfAlloc Alloc\n                 Join\n                 Network\n                 Join\n                 (rename sysOfClient\n                  (plam x: lessThan Nclients. rename client_map Client))\"\n**)\n\ndeclare subset_preserves_o [THEN [2] rev_subsetD, intro]\ndeclare subset_preserves_o [THEN [2] rev_subsetD, simp]\ndeclare funPair_o_distrib [simp]\ndeclare Always_INT_distrib [simp]\ndeclare o_apply [simp del]\n\n(*For rewriting of specifications related by \"guarantees\"*)\nlemmas [simp] =\n  rename_image_constrains\n  rename_image_stable\n  rename_image_increasing\n  rename_image_invariant\n  rename_image_Constrains\n  rename_image_Stable\n  rename_image_Increasing\n  rename_image_Always\n  rename_image_leadsTo\n  rename_image_LeadsTo\n  rename_preserves\n  rename_image_preserves\n  lift_image_preserves\n  bij_image_INT\n  bij_is_inj [THEN image_Int]\n  bij_image_Collect_eq\n\nML {*\n(*Splits up conjunctions & intersections: like CONJUNCTS in the HOL system*)\nfun list_of_Int th =\n    (list_of_Int (th RS conjunct1) @ list_of_Int (th RS conjunct2))\n    handle THM _ => (list_of_Int (th RS IntD1) @ list_of_Int (th RS IntD2))\n    handle THM _ => (list_of_Int (th RS @{thm INT_D}))\n    handle THM _ => (list_of_Int (th RS bspec))\n    handle THM _ => [th];\n*}\n\nlemmas lessThanBspec = lessThan_iff [THEN iffD2, THEN [2] bspec]\n\nattribute_setup normalized = {*\nlet\n  fun normalized th =\n    normalized (th RS spec\n      handle THM _ => th RS @{thm lessThanBspec}\n      handle THM _ => th RS bspec\n      handle THM _ => th RS (@{thm guarantees_INT_right_iff} RS iffD1))\n    handle THM _ => th;\nin\n  Scan.succeed (Thm.rule_attribute (K normalized))\nend\n*}\n\n(*** bijectivity of sysOfAlloc [MUST BE AUTOMATED] ***)\nML {*\nfun record_auto_tac ctxt =\n  let val ctxt' =\n    ctxt addSWrapper Record.split_wrapper\n    addsimps\n       [@{thm sysOfAlloc_def}, @{thm sysOfClient_def},\n        @{thm client_map_def}, @{thm non_dummy_def}, @{thm funPair_def},\n        @{thm o_apply}, @{thm Let_def}]\n  in auto_tac ctxt' end;\n\n*}\n\nmethod_setup record_auto = {* Scan.succeed (SIMPLE_METHOD o record_auto_tac) *}\n\nlemma inj_sysOfAlloc [iff]: \"inj sysOfAlloc\"\n  apply (unfold sysOfAlloc_def Let_def)\n  apply (rule inj_onI)\n  apply record_auto\n  done\n\ntext{*We need the inverse; also having it simplifies the proof of surjectivity*}\nlemma inv_sysOfAlloc_eq [simp]: \"!!s. inv sysOfAlloc s =\n             (| allocGiv = allocGiv s,\n                allocAsk = allocAsk s,\n                allocRel = allocRel s,\n                allocState_d.dummy = (client s, dummy s) |)\"\n  apply (rule inj_sysOfAlloc [THEN inv_f_eq])\n  apply record_auto\n  done\n\nlemma surj_sysOfAlloc [iff]: \"surj sysOfAlloc\"\n  apply (simp add: surj_iff_all)\n  apply record_auto\n  done\n\nlemma bij_sysOfAlloc [iff]: \"bij sysOfAlloc\"\n  apply (blast intro: bijI)\n  done\n\n\nsubsubsection{*bijectivity of @{term sysOfClient}*}\n\nlemma inj_sysOfClient [iff]: \"inj sysOfClient\"\n  apply (unfold sysOfClient_def)\n  apply (rule inj_onI)\n  apply record_auto\n  done\n\nlemma inv_sysOfClient_eq [simp]: \"!!s. inv sysOfClient s =\n             (client s,\n              (| allocGiv = allocGiv s,\n                 allocAsk = allocAsk s,\n                 allocRel = allocRel s,\n                 allocState_d.dummy = systemState.dummy s|) )\"\n  apply (rule inj_sysOfClient [THEN inv_f_eq])\n  apply record_auto\n  done\n\nlemma surj_sysOfClient [iff]: \"surj sysOfClient\"\n  apply (simp add: surj_iff_all)\n  apply record_auto\n  done\n\nlemma bij_sysOfClient [iff]: \"bij sysOfClient\"\n  apply (blast intro: bijI)\n  done\n\n\nsubsubsection{*bijectivity of @{term client_map}*}\n\nlemma inj_client_map [iff]: \"inj client_map\"\n  apply (unfold inj_on_def)\n  apply record_auto\n  done\n\nlemma inv_client_map_eq [simp]: \"!!s. inv client_map s =\n             (%(x,y).(|giv = giv x, ask = ask x, rel = rel x,\n                       clientState_d.dummy = y|)) s\"\n  apply (rule inj_client_map [THEN inv_f_eq])\n  apply record_auto\n  done\n\nlemma surj_client_map [iff]: \"surj client_map\"\n  apply (simp add: surj_iff_all)\n  apply record_auto\n  done\n\nlemma bij_client_map [iff]: \"bij client_map\"\n  apply (blast intro: bijI)\n  done\n\n\ntext{*o-simprules for @{term client_map}*}\n\nlemma fst_o_client_map: \"fst o client_map = non_dummy\"\n  apply (unfold client_map_def)\n  apply (rule fst_o_funPair)\n  done\n\nML {* ML_Thms.bind_thms (\"fst_o_client_map'\", make_o_equivs @{context} @{thm fst_o_client_map}) *}\ndeclare fst_o_client_map' [simp]\n\nlemma snd_o_client_map: \"snd o client_map = clientState_d.dummy\"\n  apply (unfold client_map_def)\n  apply (rule snd_o_funPair)\n  done\n\nML {* ML_Thms.bind_thms (\"snd_o_client_map'\", make_o_equivs @{context} @{thm snd_o_client_map}) *}\ndeclare snd_o_client_map' [simp]\n\n\nsubsection{*o-simprules for @{term sysOfAlloc} [MUST BE AUTOMATED]*}\n\nlemma client_o_sysOfAlloc: \"client o sysOfAlloc = fst o allocState_d.dummy \"\n  apply record_auto\n  done\n\nML {* ML_Thms.bind_thms (\"client_o_sysOfAlloc'\", make_o_equivs @{context} @{thm client_o_sysOfAlloc}) *}\ndeclare client_o_sysOfAlloc' [simp]\n\nlemma allocGiv_o_sysOfAlloc_eq: \"allocGiv o sysOfAlloc = allocGiv\"\n  apply record_auto\n  done\n\nML {* ML_Thms.bind_thms (\"allocGiv_o_sysOfAlloc_eq'\", make_o_equivs @{context} @{thm allocGiv_o_sysOfAlloc_eq}) *}\ndeclare allocGiv_o_sysOfAlloc_eq' [simp]\n\nlemma allocAsk_o_sysOfAlloc_eq: \"allocAsk o sysOfAlloc = allocAsk\"\n  apply record_auto\n  done\n\nML {* ML_Thms.bind_thms (\"allocAsk_o_sysOfAlloc_eq'\", make_o_equivs @{context} @{thm allocAsk_o_sysOfAlloc_eq}) *}\ndeclare allocAsk_o_sysOfAlloc_eq' [simp]\n\nlemma allocRel_o_sysOfAlloc_eq: \"allocRel o sysOfAlloc = allocRel\"\n  apply record_auto\n  done\n\nML {* ML_Thms.bind_thms (\"allocRel_o_sysOfAlloc_eq'\", make_o_equivs @{context} @{thm allocRel_o_sysOfAlloc_eq}) *}\ndeclare allocRel_o_sysOfAlloc_eq' [simp]\n\n\nsubsection{* o-simprules for @{term sysOfClient} [MUST BE AUTOMATED]*}\n\nlemma client_o_sysOfClient: \"client o sysOfClient = fst\"\n  apply record_auto\n  done\n\nML {* ML_Thms.bind_thms (\"client_o_sysOfClient'\", make_o_equivs @{context} @{thm client_o_sysOfClient}) *}\ndeclare client_o_sysOfClient' [simp]\n\nlemma allocGiv_o_sysOfClient_eq: \"allocGiv o sysOfClient = allocGiv o snd \"\n  apply record_auto\n  done\n\nML {* ML_Thms.bind_thms (\"allocGiv_o_sysOfClient_eq'\", make_o_equivs @{context} @{thm allocGiv_o_sysOfClient_eq}) *}\ndeclare allocGiv_o_sysOfClient_eq' [simp]\n\nlemma allocAsk_o_sysOfClient_eq: \"allocAsk o sysOfClient = allocAsk o snd \"\n  apply record_auto\n  done\n\nML {* ML_Thms.bind_thms (\"allocAsk_o_sysOfClient_eq'\", make_o_equivs @{context} @{thm allocAsk_o_sysOfClient_eq}) *}\ndeclare allocAsk_o_sysOfClient_eq' [simp]\n\nlemma allocRel_o_sysOfClient_eq: \"allocRel o sysOfClient = allocRel o snd \"\n  apply record_auto\n  done\n\nML {* ML_Thms.bind_thms (\"allocRel_o_sysOfClient_eq'\", make_o_equivs @{context} @{thm allocRel_o_sysOfClient_eq}) *}\ndeclare allocRel_o_sysOfClient_eq' [simp]\n\nlemma allocGiv_o_inv_sysOfAlloc_eq: \"allocGiv o inv sysOfAlloc = allocGiv\"\n  apply (simp add: o_def)\n  done\n\nML {* ML_Thms.bind_thms (\"allocGiv_o_inv_sysOfAlloc_eq'\", make_o_equivs @{context} @{thm allocGiv_o_inv_sysOfAlloc_eq}) *}\ndeclare allocGiv_o_inv_sysOfAlloc_eq' [simp]\n\nlemma allocAsk_o_inv_sysOfAlloc_eq: \"allocAsk o inv sysOfAlloc = allocAsk\"\n  apply (simp add: o_def)\n  done\n\nML {* ML_Thms.bind_thms (\"allocAsk_o_inv_sysOfAlloc_eq'\", make_o_equivs @{context} @{thm allocAsk_o_inv_sysOfAlloc_eq}) *}\ndeclare allocAsk_o_inv_sysOfAlloc_eq' [simp]\n\nlemma allocRel_o_inv_sysOfAlloc_eq: \"allocRel o inv sysOfAlloc = allocRel\"\n  apply (simp add: o_def)\n  done\n\nML {* ML_Thms.bind_thms (\"allocRel_o_inv_sysOfAlloc_eq'\", make_o_equivs @{context} @{thm allocRel_o_inv_sysOfAlloc_eq}) *}\ndeclare allocRel_o_inv_sysOfAlloc_eq' [simp]\n\nlemma rel_inv_client_map_drop_map: \"(rel o inv client_map o drop_map i o inv sysOfClient) =\n      rel o sub i o client\"\n  apply (simp add: o_def drop_map_def)\n  done\n\nML {* ML_Thms.bind_thms (\"rel_inv_client_map_drop_map'\", make_o_equivs @{context} @{thm rel_inv_client_map_drop_map}) *}\ndeclare rel_inv_client_map_drop_map [simp]\n\nlemma ask_inv_client_map_drop_map: \"(ask o inv client_map o drop_map i o inv sysOfClient) =\n      ask o sub i o client\"\n  apply (simp add: o_def drop_map_def)\n  done\n\nML {* ML_Thms.bind_thms (\"ask_inv_client_map_drop_map'\", make_o_equivs @{context} @{thm ask_inv_client_map_drop_map}) *}\ndeclare ask_inv_client_map_drop_map [simp]\n\n\ntext{*Client : <unfolded specification> *}\nlemmas client_spec_simps =\n  client_spec_def client_increasing_def client_bounded_def\n  client_progress_def client_allowed_acts_def client_preserves_def\n  guarantees_Int_right\n\nML {*\nval [Client_Increasing_ask, Client_Increasing_rel,\n     Client_Bounded, Client_Progress, Client_AllowedActs,\n     Client_preserves_giv, Client_preserves_dummy] =\n        @{thm Client} |> simplify (@{context} addsimps @{thms client_spec_simps})\n               |> list_of_Int;\n\nML_Thms.bind_thm (\"Client_Increasing_ask\", Client_Increasing_ask);\nML_Thms.bind_thm (\"Client_Increasing_rel\", Client_Increasing_rel);\nML_Thms.bind_thm (\"Client_Bounded\", Client_Bounded);\nML_Thms.bind_thm (\"Client_Progress\", Client_Progress);\nML_Thms.bind_thm (\"Client_AllowedActs\", Client_AllowedActs);\nML_Thms.bind_thm (\"Client_preserves_giv\", Client_preserves_giv);\nML_Thms.bind_thm (\"Client_preserves_dummy\", Client_preserves_dummy);\n*}\n\ndeclare\n  Client_Increasing_ask [iff]\n  Client_Increasing_rel [iff]\n  Client_Bounded [iff]\n  Client_preserves_giv [iff]\n  Client_preserves_dummy [iff]\n\n\ntext{*Network : <unfolded specification> *}\nlemmas network_spec_simps =\n  network_spec_def network_ask_def network_giv_def\n  network_rel_def network_allowed_acts_def network_preserves_def\n  ball_conj_distrib\n\nML {*\nval [Network_Ask, Network_Giv, Network_Rel, Network_AllowedActs,\n     Network_preserves_allocGiv, Network_preserves_rel,\n     Network_preserves_ask]  =\n        @{thm Network} |> simplify (@{context} addsimps @{thms network_spec_simps})\n                |> list_of_Int;\n\nML_Thms.bind_thm (\"Network_Ask\", Network_Ask);\nML_Thms.bind_thm (\"Network_Giv\", Network_Giv);\nML_Thms.bind_thm (\"Network_Rel\", Network_Rel);\nML_Thms.bind_thm (\"Network_AllowedActs\", Network_AllowedActs);\nML_Thms.bind_thm (\"Network_preserves_allocGiv\", Network_preserves_allocGiv);\nML_Thms.bind_thm (\"Network_preserves_rel\", Network_preserves_rel);\nML_Thms.bind_thm (\"Network_preserves_ask\", Network_preserves_ask);\n*}\n\ndeclare Network_preserves_allocGiv [iff]\n\ndeclare\n  Network_preserves_rel [simp]\n  Network_preserves_ask [simp]\n\ndeclare\n  Network_preserves_rel [simplified o_def, simp]\n  Network_preserves_ask [simplified o_def, simp]\n\ntext{*Alloc : <unfolded specification> *}\nlemmas alloc_spec_simps =\n  alloc_spec_def alloc_increasing_def alloc_safety_def\n  alloc_progress_def alloc_allowed_acts_def alloc_preserves_def\n\nML {*\nval [Alloc_Increasing_0, Alloc_Safety, Alloc_Progress, Alloc_AllowedActs,\n     Alloc_preserves_allocRel, Alloc_preserves_allocAsk,\n     Alloc_preserves_dummy] =\n        @{thm Alloc} |> simplify (@{context} addsimps @{thms alloc_spec_simps})\n              |> list_of_Int;\n\nML_Thms.bind_thm (\"Alloc_Increasing_0\", Alloc_Increasing_0);\nML_Thms.bind_thm (\"Alloc_Safety\", Alloc_Safety);\nML_Thms.bind_thm (\"Alloc_Progress\", Alloc_Progress);\nML_Thms.bind_thm (\"Alloc_AllowedActs\", Alloc_AllowedActs);\nML_Thms.bind_thm (\"Alloc_preserves_allocRel\", Alloc_preserves_allocRel);\nML_Thms.bind_thm (\"Alloc_preserves_allocAsk\", Alloc_preserves_allocAsk);\nML_Thms.bind_thm (\"Alloc_preserves_dummy\", Alloc_preserves_dummy);\n*}\n\ntext{*Strip off the INT in the guarantees postcondition*}\n\nlemmas Alloc_Increasing = Alloc_Increasing_0 [normalized]\n\ndeclare\n  Alloc_preserves_allocRel [iff]\n  Alloc_preserves_allocAsk [iff]\n  Alloc_preserves_dummy [iff]\n\n\nsubsection{*Components Lemmas [MUST BE AUTOMATED]*}\n\nlemma Network_component_System: \"Network Join\n      ((rename sysOfClient\n        (plam x: (lessThan Nclients). rename client_map Client)) Join\n       rename sysOfAlloc Alloc)\n      = System\"\n  by (simp add: System_def Join_ac)\n\nlemma Client_component_System: \"(rename sysOfClient\n       (plam x: (lessThan Nclients). rename client_map Client)) Join\n      (Network Join rename sysOfAlloc Alloc)  =  System\"\n  by (simp add: System_def Join_ac)\n\nlemma Alloc_component_System: \"rename sysOfAlloc Alloc Join\n       ((rename sysOfClient (plam x: (lessThan Nclients). rename client_map Client)) Join\n        Network)  =  System\"\n  by (simp add: System_def Join_ac)\n\ndeclare\n  Client_component_System [iff]\n  Network_component_System [iff]\n  Alloc_component_System [iff]\n\n\ntext{** These preservation laws should be generated automatically **}\n\nlemma Client_Allowed [simp]: \"Allowed Client = preserves rel Int preserves ask\"\n  by (auto simp add: Allowed_def Client_AllowedActs safety_prop_Acts_iff)\n\nlemma Network_Allowed [simp]: \"Allowed Network =\n        preserves allocRel Int\n        (INT i: lessThan Nclients. preserves(giv o sub i o client))\"\n  by (auto simp add: Allowed_def Network_AllowedActs safety_prop_Acts_iff)\n\nlemma Alloc_Allowed [simp]: \"Allowed Alloc = preserves allocGiv\"\n  by (auto simp add: Allowed_def Alloc_AllowedActs safety_prop_Acts_iff)\n\ntext{*needed in @{text rename_client_map_tac}*}\nlemma OK_lift_rename_Client [simp]: \"OK I (%i. lift i (rename client_map Client))\"\n  apply (rule OK_lift_I)\n  apply auto\n  apply (drule_tac w1 = rel in subset_preserves_o [THEN [2] rev_subsetD])\n  apply (drule_tac [2] w1 = ask in subset_preserves_o [THEN [2] rev_subsetD])\n  apply (auto simp add: o_def split_def)\n  done\n\nlemma fst_lift_map_eq_fst [simp]: \"fst (lift_map i x) i = fst x\"\napply (insert fst_o_lift_map [of i])\napply (drule fun_cong [where x=x])\napply (simp add: o_def)\ndone\n\nlemma fst_o_lift_map' [simp]:\n     \"(f \\<circ> sub i \\<circ> fst \\<circ> lift_map i \\<circ> g) = f o fst o g\"\napply (subst fst_o_lift_map [symmetric])\napply (simp only: o_assoc)\ndone\n\n\n(*The proofs of rename_Client_Increasing, rename_Client_Bounded and\n  rename_Client_Progress are similar.  All require copying out the original\n  Client property.  A forward proof can be constructed as follows:\n\n  Client_Increasing_ask RS\n      (bij_client_map RS rename_rename_guarantees_eq RS iffD2)\n  RS (lift_lift_guarantees_eq RS iffD2)\n  RS guarantees_PLam_I\n  RS (bij_sysOfClient RS rename_rename_guarantees_eq RS iffD2)\n  |> simplify (simpset() addsimps [lift_image_eq_rename, o_def, split_def,\n                                   surj_rename])\n\nHowever, the \"preserves\" property remains to be discharged, and the unfolding\nof \"o\" and \"sub\" complicates subsequent reasoning.\n\nThe following tactic works for all three proofs, though it certainly looks\nad-hoc!\n*)\nML\n{*\nfun rename_client_map_tac ctxt =\n  EVERY [\n    simp_tac (ctxt addsimps [@{thm rename_guarantees_eq_rename_inv}]) 1,\n    rtac @{thm guarantees_PLam_I} 1,\n    assume_tac ctxt 2,\n         (*preserves: routine reasoning*)\n    asm_simp_tac (ctxt addsimps [@{thm lift_preserves_sub}]) 2,\n         (*the guarantee for  \"lift i (rename client_map Client)\" *)\n    asm_simp_tac\n        (ctxt addsimps [@{thm lift_guarantees_eq_lift_inv},\n                      @{thm rename_guarantees_eq_rename_inv},\n                      @{thm bij_imp_bij_inv}, @{thm surj_rename},\n                      @{thm inv_inv_eq}]) 1,\n    asm_simp_tac\n        (ctxt addsimps [@{thm o_def}, @{thm non_dummy_def}, @{thm guarantees_Int_right}]) 1]\n*}\n\nmethod_setup rename_client_map = {*\n  Scan.succeed (fn ctxt => SIMPLE_METHOD (rename_client_map_tac ctxt))\n*}\n\ntext{*Lifting @{text Client_Increasing} to @{term systemState}*}\nlemma rename_Client_Increasing: \"i : I\n      ==> rename sysOfClient (plam x: I. rename client_map Client) :\n            UNIV  guarantees\n            Increasing (ask o sub i o client) Int\n            Increasing (rel o sub i o client)\"\n  by rename_client_map\n\nlemma preserves_sub_fst_lift_map: \"[| F : preserves w; i ~= j |]\n      ==> F : preserves (sub i o fst o lift_map j o funPair v w)\"\n  apply (auto simp add: lift_map_def split_def linorder_neq_iff o_def)\n  apply (drule_tac [!] subset_preserves_o [THEN [2] rev_subsetD])\n  apply (auto simp add: o_def)\n  done\n\nlemma client_preserves_giv_oo_client_map: \"[| i < Nclients; j < Nclients |]\n      ==> Client : preserves (giv o sub i o fst o lift_map j o client_map)\"\n  apply (cases \"i=j\")\n  apply (simp, simp add: o_def non_dummy_def)\n  apply (drule Client_preserves_dummy [THEN preserves_sub_fst_lift_map])\n  apply (drule_tac [!] subset_preserves_o [THEN [2] rev_subsetD])\n  apply (simp add: o_def client_map_def)\n  done\n\nlemma rename_sysOfClient_ok_Network:\n  \"rename sysOfClient (plam x: lessThan Nclients. rename client_map Client)\n    ok Network\"\n  by (auto simp add: ok_iff_Allowed client_preserves_giv_oo_client_map)\n\nlemma rename_sysOfClient_ok_Alloc:\n  \"rename sysOfClient (plam x: lessThan Nclients. rename client_map Client)\n    ok rename sysOfAlloc Alloc\"\n  by (simp add: ok_iff_Allowed)\n\nlemma rename_sysOfAlloc_ok_Network: \"rename sysOfAlloc Alloc ok Network\"\n  by (simp add: ok_iff_Allowed)\n\ndeclare\n  rename_sysOfClient_ok_Network [iff]\n  rename_sysOfClient_ok_Alloc [iff]\n  rename_sysOfAlloc_ok_Network [iff]\n\ntext{*The \"ok\" laws, re-oriented.\n  But not sure this works: theorem @{text ok_commute} is needed below*}\ndeclare\n  rename_sysOfClient_ok_Network [THEN ok_sym, iff]\n  rename_sysOfClient_ok_Alloc [THEN ok_sym, iff]\n  rename_sysOfAlloc_ok_Network [THEN ok_sym]\n\nlemma System_Increasing: \"i < Nclients\n      ==> System : Increasing (ask o sub i o client) Int\n                   Increasing (rel o sub i o client)\"\n  apply (rule component_guaranteesD [OF rename_Client_Increasing Client_component_System])\n  apply auto\n  done\n\nlemmas rename_guarantees_sysOfAlloc_I =\n  bij_sysOfAlloc [THEN rename_rename_guarantees_eq, THEN iffD2]\n\n\n(*Lifting Alloc_Increasing up to the level of systemState*)\nlemmas rename_Alloc_Increasing =\n  Alloc_Increasing\n    [THEN rename_guarantees_sysOfAlloc_I,\n     simplified surj_rename o_def sub_apply\n                rename_image_Increasing bij_sysOfAlloc\n                allocGiv_o_inv_sysOfAlloc_eq']\n\nlemma System_Increasing_allocGiv:\n     \"i < Nclients ==> System : Increasing (sub i o allocGiv)\"\n  apply (unfold System_def)\n  apply (simp add: o_def)\n  apply (rule rename_Alloc_Increasing [THEN guarantees_Join_I1, THEN guaranteesD])\n  apply auto\n  done\n\n\nML {*\nML_Thms.bind_thms (\"System_Increasing'\", list_of_Int @{thm System_Increasing})\n*}\n\ndeclare System_Increasing' [intro!]\n\ntext{* Follows consequences.\n    The \"Always (INT ...) formulation expresses the general safety property\n    and allows it to be combined using @{text Always_Int_rule} below. *}\n\nlemma System_Follows_rel:\n  \"i < Nclients ==> System : ((sub i o allocRel) Fols (rel o sub i o client))\"\n  apply (auto intro!: Network_Rel [THEN component_guaranteesD])\n  apply (simp add: ok_commute [of Network])\n  done\n\nlemma System_Follows_ask:\n  \"i < Nclients ==> System : ((sub i o allocAsk) Fols (ask o sub i o client))\"\n  apply (auto intro!: Network_Ask [THEN component_guaranteesD])\n  apply (simp add: ok_commute [of Network])\n  done\n\nlemma System_Follows_allocGiv:\n  \"i < Nclients ==> System : (giv o sub i o client) Fols (sub i o allocGiv)\"\n  apply (auto intro!: Network_Giv [THEN component_guaranteesD]\n    rename_Alloc_Increasing [THEN component_guaranteesD])\n  apply (simp_all add: o_def non_dummy_def ok_commute [of Network])\n  apply (auto intro!: rename_Alloc_Increasing [THEN component_guaranteesD])\n  done\n\n\nlemma Always_giv_le_allocGiv: \"System : Always (INT i: lessThan Nclients.\n                       {s. (giv o sub i o client) s \\<le> (sub i o allocGiv) s})\"\n  apply auto\n  apply (erule System_Follows_allocGiv [THEN Follows_Bounded])\n  done\n\n\nlemma Always_allocAsk_le_ask: \"System : Always (INT i: lessThan Nclients.\n                       {s. (sub i o allocAsk) s \\<le> (ask o sub i o client) s})\"\n  apply auto\n  apply (erule System_Follows_ask [THEN Follows_Bounded])\n  done\n\n\nlemma Always_allocRel_le_rel: \"System : Always (INT i: lessThan Nclients.\n                       {s. (sub i o allocRel) s \\<le> (rel o sub i o client) s})\"\n  by (auto intro!: Follows_Bounded System_Follows_rel)\n\n\nsubsection{*Proof of the safety property (1)*}\n\ntext{*safety (1), step 1 is @{text System_Follows_rel}*}\n\ntext{*safety (1), step 2*}\n(* i < Nclients ==> System : Increasing (sub i o allocRel) *)\nlemmas System_Increasing_allocRel = System_Follows_rel [THEN Follows_Increasing1]\n\n(*Lifting Alloc_safety up to the level of systemState.\n  Simplifying with o_def gets rid of the translations but it unfortunately\n  gets rid of the other \"o\"s too.*)\n\ntext{*safety (1), step 3*}\nlemma System_sum_bounded:\n    \"System : Always {s. (\\<Sum>i \\<in> lessThan Nclients. (tokens o sub i o allocGiv) s)\n            \\<le> NbT + (\\<Sum>i \\<in> lessThan Nclients. (tokens o sub i o allocRel) s)}\"\n  apply (simp add: o_apply)\n  apply (insert Alloc_Safety [THEN rename_guarantees_sysOfAlloc_I])\n  apply (simp add: o_def)\n  apply (erule component_guaranteesD)\n  apply (auto simp add: System_Increasing_allocRel [simplified sub_apply o_def])\n  done\n\ntext{* Follows reasoning*}\n\nlemma Always_tokens_giv_le_allocGiv: \"System : Always (INT i: lessThan Nclients.\n                          {s. (tokens o giv o sub i o client) s\n                           \\<le> (tokens o sub i o allocGiv) s})\"\n  apply (rule Always_giv_le_allocGiv [THEN Always_weaken])\n  apply (auto intro: tokens_mono_prefix simp add: o_apply)\n  done\n\nlemma Always_tokens_allocRel_le_rel: \"System : Always (INT i: lessThan Nclients.\n                          {s. (tokens o sub i o allocRel) s\n                           \\<le> (tokens o rel o sub i o client) s})\"\n  apply (rule Always_allocRel_le_rel [THEN Always_weaken])\n  apply (auto intro: tokens_mono_prefix simp add: o_apply)\n  done\n\ntext{*safety (1), step 4 (final result!) *}\ntheorem System_safety: \"System : system_safety\"\n  apply (unfold system_safety_def)\n  apply (tactic {* rtac (Always_Int_rule [@{thm System_sum_bounded},\n    @{thm Always_tokens_giv_le_allocGiv}, @{thm Always_tokens_allocRel_le_rel}] RS\n    @{thm Always_weaken}) 1 *})\n  apply auto\n  apply (rule setsum_fun_mono [THEN order_trans])\n  apply (drule_tac [2] order_trans)\n  apply (rule_tac [2] add_le_mono [OF order_refl setsum_fun_mono])\n  prefer 3 apply assumption\n  apply auto\n  done\n\nsubsection {* Proof of the progress property (2) *}\n\ntext{*progress (2), step 1 is @{text System_Follows_ask} and\n      @{text System_Follows_rel}*}\n\ntext{*progress (2), step 2; see also @{text System_Increasing_allocRel}*}\n(* i < Nclients ==> System : Increasing (sub i o allocAsk) *)\nlemmas System_Increasing_allocAsk =  System_Follows_ask [THEN Follows_Increasing1]\n\ntext{*progress (2), step 3: lifting @{text Client_Bounded} to systemState*}\nlemma rename_Client_Bounded: \"i : I\n    ==> rename sysOfClient (plam x: I. rename client_map Client) :\n          UNIV  guarantees\n          Always {s. ALL elt : set ((ask o sub i o client) s). elt \\<le> NbT}\"\n  by rename_client_map\n\n\nlemma System_Bounded_ask: \"i < Nclients\n      ==> System : Always\n                    {s. ALL elt : set ((ask o sub i o client) s). elt \\<le> NbT}\"\n  apply (rule component_guaranteesD [OF rename_Client_Bounded Client_component_System])\n  apply auto\n  done\n\nlemma Collect_all_imp_eq: \"{x. ALL y. P y --> Q x y} = (INT y: {y. P y}. {x. Q x y})\"\n  apply blast\n  done\n\ntext{*progress (2), step 4*}\nlemma System_Bounded_allocAsk: \"System : Always {s. ALL i<Nclients.\n                          ALL elt : set ((sub i o allocAsk) s). elt \\<le> NbT}\"\n  apply (auto simp add: Collect_all_imp_eq)\n  apply (tactic {* rtac (Always_Int_rule [@{thm Always_allocAsk_le_ask},\n    @{thm System_Bounded_ask}] RS @{thm Always_weaken}) 1 *})\n  apply (auto dest: set_mono)\n  done\n\ntext{*progress (2), step 5 is @{text System_Increasing_allocGiv}*}\n\ntext{*progress (2), step 6*}\n(* i < Nclients ==> System : Increasing (giv o sub i o client) *)\nlemmas System_Increasing_giv =  System_Follows_allocGiv [THEN Follows_Increasing1]\n\n\nlemma rename_Client_Progress: \"i: I\n   ==> rename sysOfClient (plam x: I. rename client_map Client)\n        : Increasing (giv o sub i o client)\n          guarantees\n          (INT h. {s. h \\<le> (giv o sub i o client) s &\n                            h pfixGe (ask o sub i o client) s}\n                  LeadsTo {s. tokens h \\<le> (tokens o rel o sub i o client) s})\"\n  apply rename_client_map\n  apply (simp add: Client_Progress [simplified o_def])\n  done\n\n\ntext{*progress (2), step 7*}\nlemma System_Client_Progress:\n  \"System : (INT i : (lessThan Nclients).\n            INT h. {s. h \\<le> (giv o sub i o client) s &\n                       h pfixGe (ask o sub i o client) s}\n                LeadsTo {s. tokens h \\<le> (tokens o rel o sub i o client) s})\"\n  apply (rule INT_I)\n(*Couldn't have just used Auto_tac since the \"INT h\" must be kept*)\n  apply (rule component_guaranteesD [OF rename_Client_Progress Client_component_System])\n  apply (auto simp add: System_Increasing_giv)\n  done\n\n(*Concludes\n System : {s. k \\<le> (sub i o allocGiv) s}\n          LeadsTo\n          {s. (sub i o allocAsk) s \\<le> (ask o sub i o client) s} Int\n          {s. k \\<le> (giv o sub i o client) s} *)\n\nlemmas System_lemma1 =\n  Always_LeadsToD [OF System_Follows_ask [THEN Follows_Bounded]\n                      System_Follows_allocGiv [THEN Follows_LeadsTo]]\n\nlemmas System_lemma2 =\n  PSP_Stable [OF System_lemma1\n              System_Follows_ask [THEN Follows_Increasing1, THEN IncreasingD]]\n\n\nlemma System_lemma3: \"i < Nclients\n      ==> System : {s. h \\<le> (sub i o allocGiv) s &\n                       h pfixGe (sub i o allocAsk) s}\n                   LeadsTo\n                   {s. h \\<le> (giv o sub i o client) s &\n                       h pfixGe (ask o sub i o client) s}\"\n  apply (rule single_LeadsTo_I)\n  apply (rule_tac k1 = h and x1 = \"(sub i o allocAsk) s\"\n         in System_lemma2 [THEN LeadsTo_weaken])\n  apply auto\n  apply (blast intro: trans_Ge [THEN trans_genPrefix, THEN transD] prefix_imp_pfixGe)\n  done\n\n\ntext{*progress (2), step 8: Client i's \"release\" action is visible system-wide*}\nlemma System_Alloc_Client_Progress: \"i < Nclients\n      ==> System : {s. h \\<le> (sub i o allocGiv) s &\n                       h pfixGe (sub i o allocAsk) s}\n                   LeadsTo {s. tokens h \\<le> (tokens o sub i o allocRel) s}\"\n  apply (rule LeadsTo_Trans)\n   prefer 2\n   apply (drule System_Follows_rel [THEN\n     mono_tokens [THEN mono_Follows_o, THEN [2] rev_subsetD],\n     THEN Follows_LeadsTo])\n   apply (simp add: o_assoc)\n  apply (rule LeadsTo_Trans)\n   apply (cut_tac [2] System_Client_Progress)\n   prefer 2\n   apply (blast intro: LeadsTo_Basis)\n  apply (erule System_lemma3)\n  done\n\ntext{*Lifting @{text Alloc_Progress} up to the level of systemState*}\n\ntext{*progress (2), step 9*}\nlemma System_Alloc_Progress:\n \"System : (INT i : (lessThan Nclients).\n            INT h. {s. h \\<le> (sub i o allocAsk) s}\n                   LeadsTo {s. h pfixLe (sub i o allocGiv) s})\"\n  apply (simp only: o_apply sub_def)\n  apply (insert Alloc_Progress [THEN rename_guarantees_sysOfAlloc_I])\n  apply (simp add: o_def del: INT_iff)\n  apply (erule component_guaranteesD)\n  apply (auto simp add:\n    System_Increasing_allocRel [simplified sub_apply o_def]\n    System_Increasing_allocAsk [simplified sub_apply o_def]\n    System_Bounded_allocAsk [simplified sub_apply o_def]\n    System_Alloc_Client_Progress [simplified sub_apply o_def])\n  done\n\ntext{*progress (2), step 10 (final result!) *}\nlemma System_Progress: \"System : system_progress\"\n  apply (unfold system_progress_def)\n  apply (cut_tac System_Alloc_Progress)\n  apply (blast intro: LeadsTo_Trans\n    System_Follows_allocGiv [THEN Follows_LeadsTo_pfixLe]\n    System_Follows_ask [THEN Follows_LeadsTo])\n  done\n\n\ntheorem System_correct: \"System : system_spec\"\n  apply (unfold system_spec_def)\n  apply (blast intro: System_safety System_Progress)\n  done\n\n\ntext{* Some obsolete lemmas *}\n\nlemma non_dummy_eq_o_funPair: \"non_dummy = (% (g,a,r). (| giv = g, ask = a, rel = r |)) o\n                              (funPair giv (funPair ask rel))\"\n  apply (rule ext)\n  apply (auto simp add: o_def non_dummy_def)\n  done\n\nlemma preserves_non_dummy_eq: \"(preserves non_dummy) =\n      (preserves rel Int preserves ask Int preserves giv)\"\n  apply (simp add: non_dummy_eq_o_funPair)\n  apply auto\n    apply (drule_tac w1 = rel in subset_preserves_o [THEN [2] rev_subsetD])\n    apply (drule_tac [2] w1 = ask in subset_preserves_o [THEN [2] rev_subsetD])\n    apply (drule_tac [3] w1 = giv in subset_preserves_o [THEN [2] rev_subsetD])\n    apply (auto simp add: o_def)\n  done\n\ntext{*Could go to Extend.ML*}\nlemma bij_fst_inv_inv_eq: \"bij f ==> fst (inv (%(x, u). inv f x) z) = f z\"\n  apply (rule fst_inv_equalityI)\n   apply (rule_tac f = \"%z. (f z, ?h z) \" in surjI)\n   apply (simp add: bij_is_inj inv_f_f)\n  apply (simp add: bij_is_surj surj_f_inv_f)\n  done\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/UNITY/Comp/Alloc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6723316860482762, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.33879208524194687}}
{"text": "theory Prelude_ListWithNumbers__RE1\nimports \"$HETS_ISABELLE_LIB/MainHC\"\nuses \"$HETS_ISABELLE_LIB/prelude\"\nbegin\n\nsetup \"Header.initialize\n       [\\\"ga_monotonicity\\\", \\\"ga_monotonicity_1\\\", \\\"ga_monotonicity_2\\\",\n        \\\"ga_monotonicity_3\\\", \\\"ga_monotonicity_4\\\",\n        \\\"ga_monotonicity_5\\\", \\\"ga_monotonicity_6\\\",\n        \\\"ga_monotonicity_7\\\", \\\"ga_monotonicity_8\\\",\n        \\\"ga_monotonicity_9\\\", \\\"ga_monotonicity_10\\\",\n        \\\"ga_monotonicity_11\\\", \\\"ga_monotonicity_12\\\",\n        \\\"ga_monotonicity_13\\\", \\\"ga_monotonicity_14\\\",\n        \\\"ga_monotonicity_15\\\", \\\"ga_monotonicity_16\\\",\n        \\\"ga_monotonicity_17\\\", \\\"ga_monotonicity_18\\\",\n        \\\"ga_monotonicity_19\\\", \\\"ga_monotonicity_20\\\",\n        \\\"ga_monotonicity_21\\\", \\\"ga_monotonicity_22\\\",\n        \\\"ga_monotonicity_23\\\", \\\"ga_monotonicity_24\\\",\n        \\\"ga_monotonicity_25\\\", \\\"ga_monotonicity_26\\\",\n        \\\"ga_monotonicity_27\\\", \\\"ga_monotonicity_28\\\",\n        \\\"ga_monotonicity_29\\\", \\\"ga_monotonicity_30\\\",\n        \\\"ga_monotonicity_31\\\", \\\"ga_monotonicity_32\\\",\n        \\\"ga_monotonicity_33\\\", \\\"ga_monotonicity_34\\\",\n        \\\"ga_monotonicity_35\\\", \\\"ga_monotonicity_36\\\",\n        \\\"ga_monotonicity_37\\\", \\\"ga_monotonicity_38\\\",\n        \\\"ga_monotonicity_39\\\", \\\"ga_monotonicity_40\\\",\n        \\\"ga_monotonicity_41\\\", \\\"ga_monotonicity_42\\\",\n        \\\"ga_monotonicity_43\\\", \\\"ga_monotonicity_44\\\",\n        \\\"ga_monotonicity_45\\\", \\\"ga_monotonicity_46\\\",\n        \\\"ga_monotonicity_47\\\", \\\"ga_monotonicity_48\\\",\n        \\\"ga_monotonicity_49\\\", \\\"ga_monotonicity_50\\\",\n        \\\"ga_monotonicity_51\\\", \\\"ga_monotonicity_52\\\",\n        \\\"ga_monotonicity_53\\\", \\\"ga_monotonicity_54\\\",\n        \\\"ga_monotonicity_55\\\", \\\"ga_monotonicity_56\\\",\n        \\\"ga_monotonicity_57\\\", \\\"ga_monotonicity_58\\\",\n        \\\"ga_monotonicity_59\\\", \\\"ga_monotonicity_60\\\",\n        \\\"ga_monotonicity_61\\\", \\\"ga_monotonicity_62\\\",\n        \\\"ga_monotonicity_63\\\", \\\"ga_monotonicity_64\\\",\n        \\\"ga_monotonicity_65\\\", \\\"ga_monotonicity_66\\\",\n        \\\"ga_monotonicity_67\\\", \\\"ga_monotonicity_68\\\",\n        \\\"ga_monotonicity_69\\\", \\\"ga_monotonicity_70\\\",\n        \\\"ga_monotonicity_71\\\", \\\"ga_monotonicity_72\\\",\n        \\\"ga_monotonicity_73\\\", \\\"ga_monotonicity_74\\\",\n        \\\"ga_monotonicity_75\\\", \\\"ga_monotonicity_76\\\",\n        \\\"ga_monotonicity_77\\\", \\\"ga_monotonicity_78\\\",\n        \\\"ga_monotonicity_79\\\", \\\"ga_monotonicity_80\\\",\n        \\\"ga_monotonicity_81\\\", \\\"ga_monotonicity_82\\\",\n        \\\"ga_monotonicity_83\\\", \\\"ga_monotonicity_84\\\",\n        \\\"ga_monotonicity_85\\\", \\\"ga_monotonicity_86\\\",\n        \\\"ga_monotonicity_87\\\", \\\"ga_monotonicity_88\\\",\n        \\\"ga_monotonicity_89\\\", \\\"ga_monotonicity_90\\\",\n        \\\"ga_subt_reflexive\\\", \\\"ga_subt_transitive\\\",\n        \\\"ga_subt_inj_proj\\\", \\\"ga_inj_transitive\\\",\n        \\\"ga_subt_Int_XLt_Rat\\\", \\\"ga_subt_Nat_XLt_Int\\\",\n        \\\"ga_subt_Pos_XLt_Nat\\\", \\\"Comp1\\\", \\\"IdDef\\\", \\\"FlipDef\\\",\n        \\\"FstDef\\\", \\\"SndDef\\\", \\\"CurryDef\\\", \\\"UncurryDef\\\", \\\"NotFalse\\\",\n        \\\"NotTrue\\\", \\\"AndFalse\\\", \\\"AndTrue\\\", \\\"AndSym\\\", \\\"OrDef\\\",\n        \\\"OtherwiseDef\\\", \\\"NotFalse1\\\", \\\"NotTrue1\\\", \\\"notNot1\\\",\n        \\\"notNot2\\\", \\\"EqualTDef\\\", \\\"EqualSymDef\\\", \\\"EqualReflex\\\",\n        \\\"EqualTransT\\\", \\\"DiffDef\\\", \\\"DiffSymDef\\\", \\\"DiffTDef\\\",\n        \\\"DiffFDef\\\", \\\"TE1\\\", \\\"TE2\\\", \\\"TE3\\\", \\\"TE4\\\", \\\"IBE1\\\",\n        \\\"IBE2\\\", \\\"IBE3\\\", \\\"IBE4\\\", \\\"IBE5\\\", \\\"IBE6\\\", \\\"IBE7\\\",\n        \\\"IBE8\\\", \\\"IUE1\\\", \\\"IUE2\\\", \\\"IOE01\\\", \\\"IOE02\\\", \\\"IOE03\\\",\n        \\\"IOE04\\\", \\\"IOE05\\\", \\\"IOE06\\\", \\\"IOE07\\\", \\\"IOE08\\\", \\\"IOE09\\\",\n        \\\"LeIrreflexivity\\\", \\\"LeTAsymmetry\\\", \\\"LeTTransitive\\\",\n        \\\"LeTTotal\\\", \\\"GeDef\\\", \\\"GeIrreflexivity\\\", \\\"GeTAsymmetry\\\",\n        \\\"GeTTransitive\\\", \\\"GeTTotal\\\", \\\"LeqDef\\\", \\\"LeqReflexivity\\\",\n        \\\"LeqTTransitive\\\", \\\"LeqTTotal\\\", \\\"GeqDef\\\", \\\"GeqReflexivity\\\",\n        \\\"GeqTTransitive\\\", \\\"GeqTTotal\\\", \\\"EqTSOrdRel\\\", \\\"EqFSOrdRel\\\",\n        \\\"EqTOrdRel\\\", \\\"EqFOrdRel\\\", \\\"EqTOrdTSubstE\\\", \\\"EqTOrdFSubstE\\\",\n        \\\"EqTOrdTSubstD\\\", \\\"EqTOrdFSubstD\\\", \\\"LeTGeFEqFRel\\\",\n        \\\"LeFGeTEqTRel\\\", \\\"LeTGeTRel\\\", \\\"LeFGeFRel\\\", \\\"LeqTGetTRel\\\",\n        \\\"LeqFGetFRel\\\", \\\"GeTLeTRel\\\", \\\"GeFLeFRel\\\", \\\"GeqTLeqTRel\\\",\n        \\\"GeqFLeqFRel\\\", \\\"LeqTGeFRel\\\", \\\"LeqFGeTRel\\\", \\\"GeTLeFEqFRel\\\",\n        \\\"GeFLeTEqTRel\\\", \\\"GeqTLeFRel\\\", \\\"GeqFLeTRel\\\",\n        \\\"LeqTLeTEqTRel\\\", \\\"LeqFLeFEqFRel\\\", \\\"GeqTGeTEqTRel\\\",\n        \\\"GeqFGeFEqFRel\\\", \\\"LeTGeqFRel\\\", \\\"GeTLeqFRel\\\", \\\"LeLeqDiff\\\",\n        \\\"CmpLTDef\\\", \\\"CmpEQDef\\\", \\\"CmpGTDef\\\", \\\"MaxYDef\\\", \\\"MaxXDef\\\",\n        \\\"MinXDef\\\", \\\"MinYDef\\\", \\\"MaxSym\\\", \\\"MinSym\\\", \\\"TO1\\\", \\\"TO3\\\",\n        \\\"TO4\\\", \\\"TO5\\\", \\\"IOO13\\\", \\\"IOO14\\\", \\\"IOO15\\\", \\\"IOO16\\\",\n        \\\"IOO17\\\", \\\"IOO18\\\", \\\"IOO19\\\", \\\"IOO20\\\", \\\"IOO21\\\", \\\"IOO22\\\",\n        \\\"IOO23\\\", \\\"IOO24\\\", \\\"IOO25\\\", \\\"IOO26\\\", \\\"IOO27\\\", \\\"IOO28\\\",\n        \\\"IOO29\\\", \\\"IOO30\\\", \\\"IOO31\\\", \\\"IOO32\\\", \\\"IOO33\\\", \\\"IBO5\\\",\n        \\\"IBO6\\\", \\\"IBO7\\\", \\\"IBO8\\\", \\\"IBO9\\\", \\\"IBO10\\\", \\\"IBO11\\\",\n        \\\"IBO12\\\", \\\"IUO01\\\", \\\"IUO02\\\", \\\"IUO03\\\", \\\"IUO04\\\", \\\"IUO05\\\",\n        \\\"IUO06\\\", \\\"IUO07\\\", \\\"NotDefHead\\\", \\\"HeadDef\\\", \\\"NotDefTail\\\",\n        \\\"TailDef\\\", \\\"FoldrNil\\\", \\\"FoldrCons\\\", \\\"FoldlNil\\\",\n        \\\"FoldlCons\\\", \\\"MapNil\\\", \\\"MapCons\\\", \\\"XPlusXPlusNil\\\",\n        \\\"XPlusXPlusCons\\\", \\\"FilterNil\\\", \\\"FilterConsT\\\",\n        \\\"FilterConsF\\\", \\\"ZipNil\\\", \\\"ZipConsNil\\\", \\\"ZipConsCons\\\",\n        \\\"UnzipNil\\\", \\\"UnzipCons\\\", \\\"ILE01\\\", \\\"ILE02\\\", \\\"ILO01\\\",\n        \\\"ILO02\\\", \\\"ILO03\\\", \\\"ILO04\\\", \\\"ILO05\\\", \\\"ILO06\\\", \\\"ILO07\\\",\n        \\\"ILO08\\\", \\\"ILO09\\\", \\\"ILO10\\\", \\\"ILO11\\\", \\\"ILO12\\\", \\\"ILO13\\\",\n        \\\"ILO14\\\", \\\"ILO15\\\", \\\"ILO16\\\", \\\"ILO17\\\", \\\"ILO18\\\", \\\"ILO19\\\",\n        \\\"ILO20\\\", \\\"ILO21\\\", \\\"ILO22\\\", \\\"FoldlDecomp\\\", \\\"MapDecomp\\\",\n        \\\"MapFunctor\\\", \\\"FilterProm\\\", \\\"InitNil\\\", \\\"InitConsNil\\\",\n        \\\"InitConsCons\\\", \\\"LastNil\\\", \\\"LastConsNil\\\", \\\"LastConsCons\\\",\n        \\\"NullNil\\\", \\\"NullCons\\\", \\\"ReverseNil\\\", \\\"ReverseCons\\\",\n        \\\"Foldr1Nil\\\", \\\"Foldr1ConsNil\\\", \\\"Foldr1ConsCons\\\",\n        \\\"Foldl1Nil\\\", \\\"Foldl1ConsNil\\\", \\\"Foldl1ConsCons\\\", \\\"ScanlNil\\\",\n        \\\"ScanlCons\\\", \\\"Scanl1Nil\\\", \\\"Scanl1Cons\\\", \\\"ScanrNil\\\",\n        \\\"ScanrCons\\\", \\\"Scanr1Nil\\\", \\\"Scanr1ConsNil\\\",\n        \\\"Scanr1ConsCons\\\", \\\"ScanlProperty\\\", \\\"ScanrProperty\\\",\n        \\\"AndLNil\\\", \\\"AndLCons\\\", \\\"OrLNil\\\", \\\"OrLCons\\\", \\\"AnyDef\\\",\n        \\\"AllDef\\\", \\\"ConcatDef\\\", \\\"ConcatMapDef\\\", \\\"MaximunNil\\\",\n        \\\"MaximumDef\\\", \\\"MinimunNil\\\", \\\"MinimumDef\\\", \\\"TakeWhileNil\\\",\n        \\\"TakeWhileConsT\\\", \\\"TakeWhileConsF\\\", \\\"DropWhileNil\\\",\n        \\\"DropWhileConsT\\\", \\\"DropWhileConsF\\\", \\\"SpanNil\\\", \\\"SpanConsT\\\",\n        \\\"SpanConsF\\\", \\\"SpanThm\\\", \\\"BreakDef\\\", \\\"BreakThm\\\",\n        \\\"InsertNil\\\", \\\"InsertCons1\\\", \\\"InsertCons2\\\", \\\"DeleteNil\\\",\n        \\\"DeleteConsT\\\", \\\"DeleteConsF\\\", \\\"SelectT\\\", \\\"SelectF\\\",\n        \\\"Partition\\\", \\\"PartitionProp\\\", \\\"PartialTest\\\",\n        \\\"ga_selector_pre\\\", \\\"ga_injective_suc\\\", \\\"ga_disjoint_0_suc\\\",\n        \\\"ga_selector_undef_pre_0\\\", \\\"X1_def_Nat\\\", \\\"X2_def_Nat\\\",\n        \\\"X3_def_Nat\\\", \\\"X4_def_Nat\\\", \\\"X5_def_Nat\\\", \\\"X6_def_Nat\\\",\n        \\\"X7_def_Nat\\\", \\\"X8_def_Nat\\\", \\\"X9_def_Nat\\\", \\\"decimal_def\\\",\n        \\\"ga_comm___XPlus__\\\", \\\"ga_assoc___XPlus__\\\",\n        \\\"ga_right_unit___XPlus__\\\", \\\"ga_left_unit___XPlus__\\\",\n        \\\"ga_left_comm___XPlus__\\\", \\\"ga_comm___Xx__\\\",\n        \\\"ga_assoc___Xx__\\\", \\\"ga_right_unit___Xx__\\\",\n        \\\"ga_left_unit___Xx__\\\", \\\"ga_left_comm___Xx__\\\", \\\"ga_comm_min\\\",\n        \\\"ga_assoc_min\\\", \\\"ga_left_comm_min\\\", \\\"ga_comm_max\\\",\n        \\\"ga_assoc_max\\\", \\\"ga_right_unit_max\\\", \\\"ga_left_unit_max\\\",\n        \\\"ga_left_comm_max\\\", \\\"leq_def1_Nat\\\", \\\"dvd_def_Nat\\\",\n        \\\"leq_def2_Nat\\\", \\\"leq_def3_Nat\\\", \\\"geq_def_Nat\\\",\n        \\\"less_def_Nat\\\", \\\"greater_def_Nat\\\", \\\"even_0_Nat\\\",\n        \\\"even_suc_Nat\\\", \\\"odd_def_Nat\\\", \\\"factorial_0\\\",\n        \\\"factorial_suc\\\", \\\"add_0_Nat\\\", \\\"add_suc_Nat\\\", \\\"mult_0_Nat\\\",\n        \\\"mult_suc_Nat\\\", \\\"power_0_Nat\\\", \\\"power_suc_Nat\\\",\n        \\\"min_def_Nat\\\", \\\"max_def_Nat\\\", \\\"subTotal_def1_Nat\\\",\n        \\\"subTotal_def2_Nat\\\", \\\"sub_dom_Nat\\\", \\\"sub_def_Nat\\\",\n        \\\"divide_dom_Nat\\\", \\\"divide_0_Nat\\\", \\\"divide_Pos_Nat\\\",\n        \\\"div_dom_Nat\\\", \\\"div_Nat\\\", \\\"mod_dom_Nat\\\", \\\"mod_Nat\\\",\n        \\\"distr1_Nat\\\", \\\"distr2_Nat\\\", \\\"Pos_def\\\", \\\"X1_as_Pos_def\\\",\n        \\\"min_0\\\", \\\"div_mod_Nat\\\", \\\"power_Nat\\\", \\\"ga_generated_Int\\\",\n        \\\"equality_Int\\\", \\\"Nat2Int_embedding\\\", \\\"ga_comm___XPlus___80\\\",\n        \\\"ga_assoc___XPlus___76\\\", \\\"ga_right_unit___XPlus___90\\\",\n        \\\"ga_left_unit___XPlus___88\\\", \\\"ga_left_comm___XPlus___84\\\",\n        \\\"ga_comm___Xx___79\\\", \\\"ga_assoc___Xx___75\\\",\n        \\\"ga_right_unit___Xx___89\\\", \\\"ga_left_unit___Xx___87\\\",\n        \\\"ga_left_comm___Xx___83\\\", \\\"ga_comm_min_82\\\", \\\"ga_comm_max_81\\\",\n        \\\"ga_assoc_min_78\\\", \\\"ga_assoc_max_77\\\", \\\"ga_left_comm_min_86\\\",\n        \\\"ga_left_comm_max_85\\\", \\\"leq_def_Int\\\", \\\"geq_def_Int\\\",\n        \\\"less_def_Int\\\", \\\"greater_def_Int\\\", \\\"even_def_Int\\\",\n        \\\"odd_def_Int\\\", \\\"odd_alt_Int\\\", \\\"neg_def_Int\\\",\n        \\\"sign_def_Int\\\", \\\"abs_def_Int\\\", \\\"add_def_Int\\\",\n        \\\"mult_def_Int\\\", \\\"sub_def_Int\\\", \\\"min_def_Int\\\",\n        \\\"max_def_Int\\\", \\\"power_neg1_Int\\\", \\\"power_others_Int\\\",\n        \\\"divide_dom2_Int\\\", \\\"divide_alt_Int\\\", \\\"divide_Int\\\",\n        \\\"div_dom_Int\\\", \\\"div_Int\\\", \\\"quot_dom_Int\\\", \\\"quot_neg_Int\\\",\n        \\\"quot_nonneg_Int\\\", \\\"rem_dom_Int\\\", \\\"rem_neg_Int\\\",\n        \\\"rem_nonneg_Int\\\", \\\"mod_dom_Int\\\", \\\"mod_Int\\\", \\\"distr1_Int\\\",\n        \\\"distr2_Int\\\", \\\"Int_Nat_sub_compat\\\", \\\"abs_decomp_Int\\\",\n        \\\"mod_abs_Int\\\", \\\"div_mod_Int\\\", \\\"quot_abs_Int\\\",\n        \\\"rem_abs_Int\\\", \\\"quot_rem_Int\\\", \\\"power_Int\\\",\n        \\\"ga_generated_Rat\\\", \\\"equality_Rat\\\", \\\"Int2Rat_embedding\\\",\n        \\\"ga_comm___XPlus___139\\\", \\\"ga_assoc___XPlus___135\\\",\n        \\\"ga_right_unit___XPlus___149\\\", \\\"ga_left_unit___XPlus___147\\\",\n        \\\"ga_left_comm___XPlus___143\\\", \\\"ga_comm___Xx___138\\\",\n        \\\"ga_assoc___Xx___134\\\", \\\"ga_right_unit___Xx___148\\\",\n        \\\"ga_left_unit___Xx___146\\\", \\\"ga_left_comm___Xx___142\\\",\n        \\\"ga_comm_min_141\\\", \\\"ga_comm_max_140\\\", \\\"ga_assoc_min_137\\\",\n        \\\"ga_assoc_max_136\\\", \\\"ga_left_comm_min_145\\\",\n        \\\"ga_left_comm_max_144\\\", \\\"leq_def_Rat\\\", \\\"geq_def_Rat\\\",\n        \\\"less_def_Rat\\\", \\\"greater_def_Rat\\\", \\\"minus_def_Rat\\\",\n        \\\"abs_def_Rat\\\", \\\"add_def_Rat\\\", \\\"sub_def_Rat\\\",\n        \\\"mult_def_Rat\\\", \\\"min_def_Rat\\\", \\\"max_def_Rat\\\",\n        \\\"divide_def1_Rat\\\", \\\"divide_def2_Rat\\\", \\\"power_0_Rat\\\",\n        \\\"power_suc_Rat\\\", \\\"power_neg_Rat\\\", \\\"distr1_Rat\\\",\n        \\\"distr2_Rat\\\", \\\"sub_rule_Rat\\\", \\\"divide_dom_Rat\\\",\n        \\\"divide_rule_Rat\\\", \\\"power_Rat\\\", \\\"AbsSignumLaw\\\", \\\"IPN01\\\",\n        \\\"IPN02\\\", \\\"IPN03\\\", \\\"IPN04\\\", \\\"IPN05\\\", \\\"IPN06\\\", \\\"IPN07\\\",\n        \\\"INN01\\\", \\\"INN02\\\", \\\"INN03\\\", \\\"INN04\\\", \\\"INN05\\\", \\\"INN06\\\",\n        \\\"INN07\\\", \\\"IIN01\\\", \\\"IIN02\\\", \\\"IIN03\\\", \\\"IIN04\\\", \\\"IIN05\\\",\n        \\\"IIN06\\\", \\\"IIN07\\\", \\\"IIN07_1\\\", \\\"IIN08\\\", \\\"IIN09\\\", \\\"IRN01\\\",\n        \\\"IRN02\\\", \\\"IRN03\\\", \\\"IRN04\\\", \\\"IRN05\\\", \\\"IRN06\\\", \\\"IRN07\\\",\n        \\\"IRN07_2\\\", \\\"IRN08\\\", \\\"IRN09\\\", \\\"IRI01\\\", \\\"IRI02\\\", \\\"IRI03\\\",\n        \\\"IRI04\\\", \\\"IRI05\\\", \\\"IRI06\\\", \\\"IRI01_3\\\", \\\"IRI02_4\\\",\n        \\\"IRF01\\\", \\\"IRF02\\\", \\\"LengthNil\\\", \\\"LengthCons\\\",\n        \\\"TakeNegative\\\", \\\"TakeNil\\\", \\\"TakeCons\\\", \\\"DropNegative\\\",\n        \\\"DropNil\\\", \\\"DropCons\\\", \\\"SplitAt\\\", \\\"Sum'Nil\\\", \\\"Sum'Cons\\\",\n        \\\"SumL\\\", \\\"Prod'Nil\\\", \\\"Prod'Cons\\\", \\\"ProdL\\\", \\\"LengthNil1\\\",\n        \\\"LengthEqualNil\\\", \\\"LengthEqualCons\\\", \\\"ZipSpec\\\"]\"\n\ntypedecl Pos\ntypedecl Rat\ntypedecl Unit\ntypedecl X_Int\n\ndatatype Bool = X_False (\"False''\") | X_True (\"True''\")\ndatatype Ordering = EQ | GT | LT\ndatatype 'a List = X_Cons 'a \"'a List\" | X_Nil (\"Nil''\")\ndatatype X_Nat = X0X2 (\"0''''\") |\n                 sucX1 \"X_Nat\" (\"suc''/'(_')\" [3] 999)\n\nconsts\nX0X1 :: \"X_Int\" (\"0''\")\nX0X3 :: \"Rat\" (\"0'_3\")\nX1X1 :: \"X_Int\" (\"1''\")\nX1X2 :: \"X_Nat\" (\"1''''\")\nX1X3 :: \"Pos\" (\"1'_3\")\nX1X4 :: \"Rat\" (\"1'_4\")\nX2X1 :: \"X_Int\" (\"2''\")\nX2X2 :: \"X_Nat\" (\"2''''\")\nX2X3 :: \"Rat\" (\"2'_3\")\nX3X1 :: \"X_Int\" (\"3''\")\nX3X2 :: \"X_Nat\" (\"3''''\")\nX3X3 :: \"Rat\" (\"3'_3\")\nX4X1 :: \"X_Int\" (\"4''\")\nX4X2 :: \"X_Nat\" (\"4''''\")\nX4X3 :: \"Rat\" (\"4'_3\")\nX5X1 :: \"X_Int\" (\"5''\")\nX5X2 :: \"X_Nat\" (\"5''''\")\nX5X3 :: \"Rat\" (\"5'_3\")\nX6X1 :: \"X_Int\" (\"6''\")\nX6X2 :: \"X_Nat\" (\"6''''\")\nX6X3 :: \"Rat\" (\"6'_3\")\nX7X1 :: \"X_Int\" (\"7''\")\nX7X2 :: \"X_Nat\" (\"7''''\")\nX7X3 :: \"Rat\" (\"7'_3\")\nX8X1 :: \"X_Int\" (\"8''\")\nX8X2 :: \"X_Nat\" (\"8''''\")\nX8X3 :: \"Rat\" (\"8'_3\")\nX9X1 :: \"X_Int\" (\"9''\")\nX9X2 :: \"X_Nat\" (\"9''''\")\nX9X3 :: \"Rat\" (\"9'_3\")\nXMinus__XX1 :: \"X_Int => X_Int\" (\"(-''/ _)\" [56] 56)\nXMinus__XX2 :: \"Rat => Rat\" (\"(-''''/ _)\" [56] 56)\nX__XAmpXAmp__X :: \"Bool => Bool => Bool\" (\"(_/ &&/ _)\" [54,54] 52)\nX__XAtXAt__X :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ @@/ _)\" [54,54] 52)\nX__XCaret__XX1 :: \"X_Int => X_Nat => X_Int\" (\"(_/ ^''/ _)\" [54,54] 52)\nX__XCaret__XX2 :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ ^''''/ _)\" [54,54] 52)\nX__XCaret__XX3 :: \"Rat => X_Int => Rat partial\" (\"(_/ ^'_3/ _)\" [54,54] 52)\nX__XEqXEq__X :: \"'a => 'a => Bool\" (\"(_/ ==''/ _)\" [54,54] 52)\nX__XExclam :: \"X_Nat => X_Nat\" (\"(_/ !'')\" [58] 58)\nX__XGtXEq__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ >=''/ _)\" [44,44] 42)\nX__XGtXEq__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ >=''''/ _)\" [44,44] 42)\nX__XGtXEq__XX3 :: \"Rat => Rat => bool\" (\"(_/ >='_3/ _)\" [44,44] 42)\nX__XGtXEq__XX4 :: \"'a => 'a => Bool\" (\"(_/ >='_4/ _)\" [54,54] 52)\nX__XGt__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ >''/ _)\" [44,44] 42)\nX__XGt__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ >''''/ _)\" [44,44] 42)\nX__XGt__XX3 :: \"Rat => Rat => bool\" (\"(_/ >'_3/ _)\" [44,44] 42)\nX__XGt__XX4 :: \"'a => 'a => Bool\" (\"(_/ >'_4/ _)\" [54,54] 52)\nX__XLtXEq__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ <=''/ _)\" [44,44] 42)\nX__XLtXEq__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ <=''''/ _)\" [44,44] 42)\nX__XLtXEq__XX3 :: \"Rat => Rat => bool\" (\"(_/ <='_3/ _)\" [44,44] 42)\nX__XLtXEq__XX4 :: \"'a => 'a => Bool\" (\"(_/ <='_4/ _)\" [54,54] 52)\nX__XLt__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ <''/ _)\" [44,44] 42)\nX__XLt__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ <''''/ _)\" [44,44] 42)\nX__XLt__XX3 :: \"Rat => Rat => bool\" (\"(_/ <'_3/ _)\" [44,44] 42)\nX__XLt__XX4 :: \"'a => 'a => Bool\" (\"(_/ <'_4/ _)\" [54,54] 52)\nX__XMinusXExclam__X :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ -!/ _)\" [54,54] 52)\nX__XMinusXQuest__X :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ -?/ _)\" [54,54] 52)\nX__XMinus__XX1 :: \"X_Int => X_Int => X_Int\" (\"(_/ -''/ _)\" [54,54] 52)\nX__XMinus__XX2 :: \"X_Nat => X_Nat => X_Int\" (\"(_/ -''''/ _)\" [54,54] 52)\nX__XMinus__XX3 :: \"Rat => Rat => Rat\" (\"(_/ -'_3/ _)\" [54,54] 52)\nX__XMinus__XX4 :: \"'a => 'a => 'a\" (\"(_/ -'_4/ _)\" [54,54] 52)\nX__XPlusXPlus__X :: \"'a List => 'a List => 'a List\" (\"(_/ ++''/ _)\" [54,54] 52)\nX__XPlus__XX1 :: \"X_Int => X_Int => X_Int\" (\"(_/ +''/ _)\" [54,54] 52)\nX__XPlus__XX2 :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ +''''/ _)\" [54,54] 52)\nX__XPlus__XX3 :: \"X_Nat => Pos => Pos\" (\"(_/ +'_3/ _)\" [54,54] 52)\nX__XPlus__XX4 :: \"Pos => X_Nat => Pos\" (\"(_/ +'_4/ _)\" [54,54] 52)\nX__XPlus__XX5 :: \"Rat => Rat => Rat\" (\"(_/ +'_5/ _)\" [54,54] 52)\nX__XPlus__XX6 :: \"'a => 'a => 'a\" (\"(_/ +'_6/ _)\" [54,54] 52)\nX__XSlashXEq__X :: \"'a => 'a => Bool\" (\"(_/ '/=/ _)\" [54,54] 52)\nX__XSlashXQuest__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ '/?''/ _)\" [54,54] 52)\nX__XSlashXQuest__XX2 :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ '/?''''/ _)\" [54,54] 52)\nX__XSlash__XX1 :: \"X_Int => Pos => Rat\" (\"(_/ '/''/ _)\" [54,54] 52)\nX__XSlash__XX2 :: \"Rat => Rat => Rat partial\" (\"(_/ '/''''/ _)\" [54,54] 52)\nX__XSlash__XX3 :: \"'a => 'a => 'a\" (\"(_/ '/'_3/ _)\" [54,54] 52)\nX__XVBarXVBar__X :: \"Bool => Bool => Bool\" (\"(_/ ||/ _)\" [54,54] 52)\nX__Xx__XX1 :: \"X_Int => X_Int => X_Int\" (\"(_/ *''/ _)\" [54,54] 52)\nX__Xx__XX2 :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ *''''/ _)\" [54,54] 52)\nX__Xx__XX3 :: \"Pos => Pos => Pos\" (\"(_/ *'_3/ _)\" [54,54] 52)\nX__Xx__XX4 :: \"Rat => Rat => Rat\" (\"(_/ *'_4/ _)\" [54,54] 52)\nX__Xx__XX5 :: \"'a => 'a => 'a\" (\"(_/ *'_5/ _)\" [54,54] 52)\nX__div__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ div''/ _)\" [54,54] 52)\nX__div__XX2 :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ div''''/ _)\" [54,54] 52)\nX__div__XX3 :: \"'a => 'a => 'a\" (\"(_/ div'_3/ _)\" [54,54] 52)\nX__dvd__X :: \"X_Nat => X_Nat => bool\" (\"(_/ dvd''/ _)\" [44,44] 42)\nX__mod__XX1 :: \"X_Int => X_Int => X_Nat partial\" (\"(_/ mod''/ _)\" [54,54] 52)\nX__mod__XX2 :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ mod''''/ _)\" [54,54] 52)\nX__mod__XX3 :: \"'a => 'a => 'a\" (\"(_/ mod'_3/ _)\" [54,54] 52)\nX__o__X :: \"('b => 'c) * ('a => 'b) => 'a => 'c\"\nX__quot__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ quot''/ _)\" [54,54] 52)\nX__quot__XX2 :: \"'a => 'a => 'a\" (\"(_/ quot''''/ _)\" [54,54] 52)\nX__rem__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ rem''/ _)\" [54,54] 52)\nX__rem__XX2 :: \"'a => 'a => 'a\" (\"(_/ rem''''/ _)\" [54,54] 52)\nX_absX1 :: \"X_Int => X_Nat\" (\"abs''/'(_')\" [3] 999)\nX_absX2 :: \"Rat => Rat\" (\"abs''''/'(_')\" [3] 999)\nX_absX3 :: \"'a => 'a\" (\"abs'_3/'(_')\" [3] 999)\nX_all :: \"('a => Bool) => 'a List => Bool\"\nX_andL :: \"Bool List => Bool\" (\"andL/'(_')\" [3] 999)\nX_any :: \"('a => Bool) => 'a List => Bool\"\nX_concat :: \"'a List List => 'a List\" (\"concat''/'(_')\" [3] 999)\nX_curry :: \"('a * 'b => 'c) => 'a => 'b => 'c\"\nX_drop :: \"X_Int => 'a List => 'a List\"\nX_dropWhile :: \"('a => Bool) => 'a List => 'a List\"\nX_evenX1 :: \"X_Int => bool\" (\"even''/'(_')\" [3] 999)\nX_evenX2 :: \"X_Nat => bool\" (\"even''''/'(_')\" [3] 999)\nX_filter :: \"('a => Bool) => 'a List => 'a List\"\nX_flip :: \"('a => 'b => 'c) => 'b => 'a => 'c\"\nX_foldl :: \"('a => 'b => 'a) => 'a => 'b List => 'a partial\"\nX_foldr :: \"('a => 'b => 'b) => 'b => 'a List => 'b partial\"\nX_fromInteger :: \"X_Int => 'a\" (\"fromInteger/'(_')\" [3] 999)\nX_fst :: \"'a => 'b => 'a\" (\"fst''/'(_,/ _')\" [3,3] 999)\nX_gn_inj :: \"'a => 'b\" (\"gn'_inj/'(_')\" [3] 999)\nX_gn_proj :: \"'a => 'b partial\" (\"gn'_proj/'(_')\" [3] 999)\nX_gn_subt :: \"'a => 'b => bool\" (\"gn'_subt/'(_,/ _')\" [3,3] 999)\nX_head :: \"'a List => 'a partial\" (\"head/'(_')\" [3] 999)\nX_id :: \"'a => 'a\" (\"id''/'(_')\" [3] 999)\nX_init :: \"'a List => 'a List partial\" (\"init/'(_')\" [3] 999)\nX_insert :: \"'d => 'd List => 'd List\"\nX_last :: \"'a List => 'a partial\" (\"last''/'(_')\" [3] 999)\nX_length :: \"'a List => X_Int\" (\"length''/'(_')\" [3] 999)\nX_map :: \"('a => 'b) => 'a List => 'b List\"\nX_maxX1 :: \"X_Int => X_Int => X_Int\" (\"max''/'(_,/ _')\" [3,3] 999)\nX_maxX2 :: \"X_Nat => X_Nat => X_Nat\" (\"max''''/'(_,/ _')\" [3,3] 999)\nX_maxX3 :: \"Rat => Rat => Rat\" (\"max'_3/'(_,/ _')\" [3,3] 999)\nX_maxX4 :: \"'a => 'a => 'a\"\nX_maximum :: \"'d List => 'd partial\" (\"maximum/'(_')\" [3] 999)\nX_minX1 :: \"X_Int => X_Int => X_Int\" (\"min''/'(_,/ _')\" [3,3] 999)\nX_minX2 :: \"X_Nat => X_Nat => X_Nat\" (\"min''''/'(_,/ _')\" [3,3] 999)\nX_minX3 :: \"Rat => Rat => Rat\" (\"min'_3/'(_,/ _')\" [3,3] 999)\nX_minX4 :: \"'a => 'a => 'a\"\nX_minimum :: \"'d List => 'd partial\" (\"minimum/'(_')\" [3] 999)\nX_negate :: \"'a => 'a\" (\"negate/'(_')\" [3] 999)\nX_null :: \"'a List => Bool\" (\"null''/'(_')\" [3] 999)\nX_oddX1 :: \"X_Int => bool\" (\"odd''/'(_')\" [3] 999)\nX_oddX2 :: \"X_Nat => bool\" (\"odd''''/'(_')\" [3] 999)\nX_orL :: \"Bool List => Bool\" (\"orL/'(_')\" [3] 999)\nX_pre :: \"X_Nat => X_Nat partial\" (\"pre/'(_')\" [3] 999)\nX_product :: \"'c List => 'c\" (\"product/'(_')\" [3] 999)\nX_recip :: \"'a => 'a\" (\"recip/'(_')\" [3] 999)\nX_reverse :: \"'a List => 'a List\" (\"reverse/'(_')\" [3] 999)\nX_sign :: \"X_Int => X_Int\" (\"sign/'(_')\" [3] 999)\nX_signum :: \"'a => 'a\" (\"signum/'(_')\" [3] 999)\nX_snd :: \"'a => 'b => 'b\" (\"snd''/'(_,/ _')\" [3,3] 999)\nX_sum :: \"'c List => 'c\" (\"sum/'(_')\" [3] 999)\nX_tail :: \"'a List => 'a List partial\" (\"tail/'(_')\" [3] 999)\nX_take :: \"X_Int => 'a List => 'a List\"\nX_takeWhile :: \"('a => Bool) => 'a List => 'a List\"\nX_toInteger :: \"'a => X_Int\" (\"toInteger/'(_')\" [3] 999)\nX_unzip :: \"('a * 'b) List => 'a List * 'b List\" (\"unzip/'(_')\" [3] 999)\nX_zip :: \"'a List => 'b List => ('a * 'b) List\"\nbreak :: \"('a => Bool) => 'a List => 'a List * 'a List\"\ncompare :: \"'a => 'a => Ordering\"\nconcatMap :: \"('a => 'b List) => 'a List => 'b List\"\ndelete :: \"'e => 'e List => 'e List\"\ndivMod :: \"'a => 'a => 'a * 'a\"\nfoldl1 :: \"('a => 'a => 'a) => 'a List => 'a partial\"\nfoldr1 :: \"('a => 'a => 'a) => 'a List => 'a partial\"\nnotH__X :: \"Bool => Bool\" (\"(notH/ _)\" [56] 56)\notherwiseH :: \"Bool\"\npartition :: \"('a => Bool) => 'a List => 'a List * 'a List\"\nproduct' :: \"'c List => 'c => 'c\"\nquotRem :: \"'a => 'a => 'a * 'a\"\nscanl :: \"('a => 'b => 'a) => 'a => 'b List => 'a List\"\nscanl1 :: \"('a => 'a => 'a) => 'a List => 'a List\"\nscanr :: \"('a => 'b => 'b) => 'b => 'a List => 'b List\"\nscanr1 :: \"('a => 'a => 'a) => 'a List => 'a List\"\nselect :: \"('a => Bool) => 'a => 'a List * 'a List => 'a List * 'a List\"\nspan :: \"('a => Bool) => 'a List => 'a List * 'a List\"\nsplitAt :: \"X_Int => 'a List => 'a List * 'a List\"\nsucX2 :: \"X_Nat => Pos\" (\"suc''''/'(_')\" [3] 999)\nsum' :: \"'c List => 'c => 'c\"\nuncurry :: \"('a => 'b => 'c) => 'a * 'b => 'c\"\n\naxioms\nga_monotonicity [rule_format] :\n\"(X_gn_inj :: (X_Int => X_Int) => X_Int => Rat) XMinus__XX1 =\n (X_gn_inj :: (Rat => Rat) => X_Int => Rat) XMinus__XX2\"\n\nga_monotonicity_1 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 0' =\n (X_gn_inj :: X_Nat => X_Int) 0''\"\n\nga_monotonicity_2 [rule_format] :\n\"(X_gn_inj :: X_Int => Rat) 0' = (X_gn_inj :: Rat => Rat) 0_3\"\n\nga_monotonicity_3 [rule_format] :\n\"(X_gn_inj :: X_Nat => Rat) 0'' = (X_gn_inj :: Rat => Rat) 0_3\"\n\nga_monotonicity_4 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 1' =\n (X_gn_inj :: X_Nat => X_Int) 1''\"\n\nga_monotonicity_5 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 1' = (X_gn_inj :: Pos => X_Int) 1_3\"\n\nga_monotonicity_6 [rule_format] :\n\"(X_gn_inj :: X_Int => Rat) 1' = (X_gn_inj :: Rat => Rat) 1_4\"\n\nga_monotonicity_7 [rule_format] :\n\"(X_gn_inj :: X_Nat => X_Nat) 1'' = (X_gn_inj :: Pos => X_Nat) 1_3\"\n\nga_monotonicity_8 [rule_format] :\n\"(X_gn_inj :: X_Nat => Rat) 1'' = (X_gn_inj :: Rat => Rat) 1_4\"\n\nga_monotonicity_9 [rule_format] :\n\"(X_gn_inj :: Pos => Rat) 1_3 = (X_gn_inj :: Rat => Rat) 1_4\"\n\nga_monotonicity_10 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 2' =\n (X_gn_inj :: X_Nat => X_Int) 2''\"\n\nga_monotonicity_11 [rule_format] :\n\"(X_gn_inj :: X_Int => Rat) 2' = (X_gn_inj :: Rat => Rat) 2_3\"\n\nga_monotonicity_12 [rule_format] :\n\"(X_gn_inj :: X_Nat => Rat) 2'' = (X_gn_inj :: Rat => Rat) 2_3\"\n\nga_monotonicity_13 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 3' =\n (X_gn_inj :: X_Nat => X_Int) 3''\"\n\nga_monotonicity_14 [rule_format] :\n\"(X_gn_inj :: X_Int => Rat) 3' = (X_gn_inj :: Rat => Rat) 3_3\"\n\nga_monotonicity_15 [rule_format] :\n\"(X_gn_inj :: X_Nat => Rat) 3'' = (X_gn_inj :: Rat => Rat) 3_3\"\n\nga_monotonicity_16 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 4' =\n (X_gn_inj :: X_Nat => X_Int) 4''\"\n\nga_monotonicity_17 [rule_format] :\n\"(X_gn_inj :: X_Int => Rat) 4' = (X_gn_inj :: Rat => Rat) 4_3\"\n\nga_monotonicity_18 [rule_format] :\n\"(X_gn_inj :: X_Nat => Rat) 4'' = (X_gn_inj :: Rat => Rat) 4_3\"\n\nga_monotonicity_19 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 5' =\n (X_gn_inj :: X_Nat => X_Int) 5''\"\n\nga_monotonicity_20 [rule_format] :\n\"(X_gn_inj :: X_Int => Rat) 5' = (X_gn_inj :: Rat => Rat) 5_3\"\n\nga_monotonicity_21 [rule_format] :\n\"(X_gn_inj :: X_Nat => Rat) 5'' = (X_gn_inj :: Rat => Rat) 5_3\"\n\nga_monotonicity_22 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 6' =\n (X_gn_inj :: X_Nat => X_Int) 6''\"\n\nga_monotonicity_23 [rule_format] :\n\"(X_gn_inj :: X_Int => Rat) 6' = (X_gn_inj :: Rat => Rat) 6_3\"\n\nga_monotonicity_24 [rule_format] :\n\"(X_gn_inj :: X_Nat => Rat) 6'' = (X_gn_inj :: Rat => Rat) 6_3\"\n\nga_monotonicity_25 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 7' =\n (X_gn_inj :: X_Nat => X_Int) 7''\"\n\nga_monotonicity_26 [rule_format] :\n\"(X_gn_inj :: X_Int => Rat) 7' = (X_gn_inj :: Rat => Rat) 7_3\"\n\nga_monotonicity_27 [rule_format] :\n\"(X_gn_inj :: X_Nat => Rat) 7'' = (X_gn_inj :: Rat => Rat) 7_3\"\n\nga_monotonicity_28 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 8' =\n (X_gn_inj :: X_Nat => X_Int) 8''\"\n\nga_monotonicity_29 [rule_format] :\n\"(X_gn_inj :: X_Int => Rat) 8' = (X_gn_inj :: Rat => Rat) 8_3\"\n\nga_monotonicity_30 [rule_format] :\n\"(X_gn_inj :: X_Nat => Rat) 8'' = (X_gn_inj :: Rat => Rat) 8_3\"\n\nga_monotonicity_31 [rule_format] :\n\"(X_gn_inj :: X_Int => X_Int) 9' =\n (X_gn_inj :: X_Nat => X_Int) 9''\"\n\nga_monotonicity_32 [rule_format] :\n\"(X_gn_inj :: X_Int => Rat) 9' = (X_gn_inj :: Rat => Rat) 9_3\"\n\nga_monotonicity_33 [rule_format] :\n\"(X_gn_inj :: X_Nat => Rat) 9'' = (X_gn_inj :: Rat => Rat) 9_3\"\n\nga_monotonicity_34 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Nat * X_Nat => X_Int)\n (uncurryOp X__Xx__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => X_Int)\n (uncurryOp X__Xx__XX2)\"\n\nga_monotonicity_35 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => Pos * Pos => X_Int)\n (uncurryOp X__Xx__XX1) =\n (X_gn_inj :: (Pos * Pos => Pos) => Pos * Pos => X_Int)\n (uncurryOp X__Xx__XX3)\"\n\nga_monotonicity_36 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => Rat)\n (uncurryOp X__Xx__XX1) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Int * X_Int => Rat)\n (uncurryOp X__Xx__XX4)\"\n\nga_monotonicity_37 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => X_Int)\n (uncurryOp X__Xx__XX1) =\n (X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => X_Int)\n (uncurryOp X__Xx__XX5)\"\n\nga_monotonicity_38 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Nat) => Pos * Pos => X_Nat)\n (uncurryOp X__Xx__XX2) =\n (X_gn_inj :: (Pos * Pos => Pos) => Pos * Pos => X_Nat)\n (uncurryOp X__Xx__XX3)\"\n\nga_monotonicity_39 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => Rat)\n (uncurryOp X__Xx__XX2) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Nat * X_Nat => Rat)\n (uncurryOp X__Xx__XX4)\"\n\nga_monotonicity_40 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => X_Nat)\n (uncurryOp X__Xx__XX2) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => X_Nat)\n (uncurryOp X__Xx__XX5)\"\n\nga_monotonicity_41 [rule_format] :\n\"(X_gn_inj :: (Pos * Pos => Pos) => Pos * Pos => Rat)\n (uncurryOp X__Xx__XX3) =\n (X_gn_inj :: (Rat * Rat => Rat) => Pos * Pos => Rat)\n (uncurryOp X__Xx__XX4)\"\n\nga_monotonicity_42 [rule_format] :\n\"(X_gn_inj :: (Pos * Pos => Pos) => Pos * Pos => Pos)\n (uncurryOp X__Xx__XX3) =\n (X_gn_inj :: (Pos * Pos => Pos) => Pos * Pos => Pos)\n (uncurryOp X__Xx__XX5)\"\n\nga_monotonicity_43 [rule_format] :\n\"(X_gn_inj :: (Rat * Rat => Rat) => Rat * Rat => Rat)\n (uncurryOp X__Xx__XX4) =\n (X_gn_inj :: (Rat * Rat => Rat) => Rat * Rat => Rat)\n (uncurryOp X__Xx__XX5)\"\n\nga_monotonicity_44 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Nat * X_Nat => X_Int)\n (uncurryOp X__XPlus__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => X_Int)\n (uncurryOp X__XPlus__XX2)\"\n\nga_monotonicity_45 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Nat * Pos => X_Int)\n (uncurryOp X__XPlus__XX1) =\n (X_gn_inj :: (X_Nat * Pos => Pos) => X_Nat * Pos => X_Int)\n (uncurryOp X__XPlus__XX3)\"\n\nga_monotonicity_46 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => Pos * X_Nat => X_Int)\n (uncurryOp X__XPlus__XX1) =\n (X_gn_inj :: (Pos * X_Nat => Pos) => Pos * X_Nat => X_Int)\n (uncurryOp X__XPlus__XX4)\"\n\nga_monotonicity_47 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => Rat)\n (uncurryOp X__XPlus__XX1) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Int * X_Int => Rat)\n (uncurryOp X__XPlus__XX5)\"\n\nga_monotonicity_48 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => X_Int)\n (uncurryOp X__XPlus__XX1) =\n (X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => X_Int)\n (uncurryOp X__XPlus__XX6)\"\n\nga_monotonicity_49 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * Pos => X_Nat)\n (uncurryOp X__XPlus__XX2) =\n (X_gn_inj :: (X_Nat * Pos => Pos) => X_Nat * Pos => X_Nat)\n (uncurryOp X__XPlus__XX3)\"\n\nga_monotonicity_50 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Nat) => Pos * X_Nat => X_Nat)\n (uncurryOp X__XPlus__XX2) =\n (X_gn_inj :: (Pos * X_Nat => Pos) => Pos * X_Nat => X_Nat)\n (uncurryOp X__XPlus__XX4)\"\n\nga_monotonicity_51 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => Rat)\n (uncurryOp X__XPlus__XX2) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Nat * X_Nat => Rat)\n (uncurryOp X__XPlus__XX5)\"\n\nga_monotonicity_52 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => X_Nat)\n (uncurryOp X__XPlus__XX2) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => X_Nat)\n (uncurryOp X__XPlus__XX6)\"\n\nga_monotonicity_53 [rule_format] :\n\"(X_gn_inj :: (X_Nat * Pos => Pos) => Pos * Pos => Pos)\n (uncurryOp X__XPlus__XX3) =\n (X_gn_inj :: (Pos * X_Nat => Pos) => Pos * Pos => Pos)\n (uncurryOp X__XPlus__XX4)\"\n\nga_monotonicity_54 [rule_format] :\n\"(X_gn_inj :: (X_Nat * Pos => Pos) => X_Nat * Pos => Rat)\n (uncurryOp X__XPlus__XX3) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Nat * Pos => Rat)\n (uncurryOp X__XPlus__XX5)\"\n\nga_monotonicity_55 [rule_format] :\n\"(X_gn_inj :: (Pos * X_Nat => Pos) => Pos * X_Nat => Rat)\n (uncurryOp X__XPlus__XX4) =\n (X_gn_inj :: (Rat * Rat => Rat) => Pos * X_Nat => Rat)\n (uncurryOp X__XPlus__XX5)\"\n\nga_monotonicity_56 [rule_format] :\n\"(X_gn_inj :: (Rat * Rat => Rat) => Rat * Rat => Rat)\n (uncurryOp X__XPlus__XX5) =\n (X_gn_inj :: (Rat * Rat => Rat) => Rat * Rat => Rat)\n (uncurryOp X__XPlus__XX6)\"\n\nga_monotonicity_57 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Nat * X_Nat => X_Int)\n (uncurryOp X__XMinus__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Int) => X_Nat * X_Nat => X_Int)\n (uncurryOp X__XMinus__XX2)\"\n\nga_monotonicity_58 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => Rat)\n (uncurryOp X__XMinus__XX1) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Int * X_Int => Rat)\n (uncurryOp X__XMinus__XX3)\"\n\nga_monotonicity_59 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => X_Int)\n (uncurryOp X__XMinus__XX1) =\n (X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => X_Int)\n (uncurryOp X__XMinus__XX4)\"\n\nga_monotonicity_60 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Int) => X_Nat * X_Nat => Rat)\n (uncurryOp X__XMinus__XX2) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Nat * X_Nat => Rat)\n (uncurryOp X__XMinus__XX3)\"\n\nga_monotonicity_61 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Int) => X_Nat * X_Nat => X_Int)\n (uncurryOp X__XMinus__XX2) =\n (X_gn_inj :: (X_Int * X_Int => X_Int) => X_Nat * X_Nat => X_Int)\n (uncurryOp X__XMinus__XX4)\"\n\nga_monotonicity_62 [rule_format] :\n\"(X_gn_inj :: (Rat * Rat => Rat) => Rat * Rat => Rat)\n (uncurryOp X__XMinus__XX3) =\n (X_gn_inj :: (Rat * Rat => Rat) => Rat * Rat => Rat)\n (uncurryOp X__XMinus__XX4)\"\n\nga_monotonicity_63 [rule_format] :\n\"(X_gn_inj :: (X_Int * Pos => Rat) => X_Int * Pos => Rat)\n (uncurryOp X__XSlash__XX1) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Int * Pos => Rat)\n (uncurryOp X__XSlash__XX3)\"\n\nga_monotonicity_64 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int partial) => X_Nat * X_Nat => X_Int partial)\n (uncurryOp X__XSlashXQuest__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Nat partial) => X_Nat * X_Nat => X_Int partial)\n (uncurryOp X__XSlashXQuest__XX2)\"\n\nga_monotonicity_65 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XLt__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XLt__XX2)\"\n\nga_monotonicity_66 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => bool) => X_Int * X_Int => bool)\n (uncurryOp X__XLt__XX1) =\n (X_gn_inj :: (Rat * Rat => bool) => X_Int * X_Int => bool)\n (uncurryOp X__XLt__XX3)\"\n\nga_monotonicity_67 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XLt__XX2) =\n (X_gn_inj :: (Rat * Rat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XLt__XX3)\"\n\nga_monotonicity_68 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XLtXEq__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XLtXEq__XX2)\"\n\nga_monotonicity_69 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => bool) => X_Int * X_Int => bool)\n (uncurryOp X__XLtXEq__XX1) =\n (X_gn_inj :: (Rat * Rat => bool) => X_Int * X_Int => bool)\n (uncurryOp X__XLtXEq__XX3)\"\n\nga_monotonicity_70 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XLtXEq__XX2) =\n (X_gn_inj :: (Rat * Rat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XLtXEq__XX3)\"\n\nga_monotonicity_71 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XGt__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XGt__XX2)\"\n\nga_monotonicity_72 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => bool) => X_Int * X_Int => bool)\n (uncurryOp X__XGt__XX1) =\n (X_gn_inj :: (Rat * Rat => bool) => X_Int * X_Int => bool)\n (uncurryOp X__XGt__XX3)\"\n\nga_monotonicity_73 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XGt__XX2) =\n (X_gn_inj :: (Rat * Rat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XGt__XX3)\"\n\nga_monotonicity_74 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XGtXEq__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XGtXEq__XX2)\"\n\nga_monotonicity_75 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => bool) => X_Int * X_Int => bool)\n (uncurryOp X__XGtXEq__XX1) =\n (X_gn_inj :: (Rat * Rat => bool) => X_Int * X_Int => bool)\n (uncurryOp X__XGtXEq__XX3)\"\n\nga_monotonicity_76 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XGtXEq__XX2) =\n (X_gn_inj :: (Rat * Rat => bool) => X_Nat * X_Nat => bool)\n (uncurryOp X__XGtXEq__XX3)\"\n\nga_monotonicity_77 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Nat => X_Int) => X_Nat * X_Nat => X_Int)\n (uncurryOp X__XCaret__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => X_Int)\n (uncurryOp X__XCaret__XX2)\"\n\nga_monotonicity_78 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int partial) => X_Nat * X_Nat => X_Int partial)\n (uncurryOp X__div__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Nat partial) => X_Nat * X_Nat => X_Int partial)\n (uncurryOp X__div__XX2)\"\n\nga_monotonicity_79 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Nat partial) => X_Nat * X_Nat => X_Nat partial)\n (uncurryOp X__mod__XX1) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Nat partial) => X_Nat * X_Nat => X_Nat partial)\n (uncurryOp X__mod__XX2)\"\n\nga_monotonicity_80 [rule_format] :\n\"(X_gn_inj :: (X_Int => X_Nat) => X_Int => Rat) X_absX1 =\n (X_gn_inj :: (Rat => Rat) => X_Int => Rat) X_absX2\"\n\nga_monotonicity_81 [rule_format] :\n\"(X_gn_inj :: (Rat => Rat) => Rat => Rat) X_absX2 =\n (X_gn_inj :: (Rat => Rat) => Rat => Rat) X_absX3\"\n\nga_monotonicity_82 [rule_format] :\n\"(X_gn_inj :: (X_Int => bool) => X_Nat => bool) X_evenX1 =\n (X_gn_inj :: (X_Nat => bool) => X_Nat => bool) X_evenX2\"\n\nga_monotonicity_83 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Nat * X_Nat => X_Int)\n (uncurryOp X_maxX1) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => X_Int)\n (uncurryOp X_maxX2)\"\n\nga_monotonicity_84 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => Rat)\n (uncurryOp X_maxX1) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Int * X_Int => Rat)\n (uncurryOp X_maxX3)\"\n\nga_monotonicity_85 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => Rat)\n (uncurryOp X_maxX2) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Nat * X_Nat => Rat)\n (uncurryOp X_maxX3)\"\n\nga_monotonicity_86 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Nat * X_Nat => X_Int)\n (uncurryOp X_minX1) =\n (X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => X_Int)\n (uncurryOp X_minX2)\"\n\nga_monotonicity_87 [rule_format] :\n\"(X_gn_inj :: (X_Int * X_Int => X_Int) => X_Int * X_Int => Rat)\n (uncurryOp X_minX1) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Int * X_Int => Rat)\n (uncurryOp X_minX3)\"\n\nga_monotonicity_88 [rule_format] :\n\"(X_gn_inj :: (X_Nat * X_Nat => X_Nat) => X_Nat * X_Nat => Rat)\n (uncurryOp X_minX2) =\n (X_gn_inj :: (Rat * Rat => Rat) => X_Nat * X_Nat => Rat)\n (uncurryOp X_minX3)\"\n\nga_monotonicity_89 [rule_format] :\n\"(X_gn_inj :: (X_Int => bool) => X_Nat => bool) X_oddX1 =\n (X_gn_inj :: (X_Nat => bool) => X_Nat => bool) X_oddX2\"\n\nga_monotonicity_90 [rule_format] :\n\"(X_gn_inj :: (X_Nat => X_Nat) => X_Nat => X_Nat) sucX1 =\n (X_gn_inj :: (X_Nat => Pos) => X_Nat => X_Nat) sucX2\"\n\nga_subt_reflexive [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). gn_subt(x, y)\"\n\nga_subt_transitive [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'b).\n ALL (z :: 'c). gn_subt(x, y) & gn_subt(y, z) --> gn_subt(x, z)\"\n\nga_subt_inj_proj [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'b).\n gn_subt(x, y) -->\n y = (X_gn_inj :: 'a => 'b) x =\n (makePartial x = (X_gn_proj :: 'b => 'a partial) y)\"\n\nga_inj_transitive [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'b).\n ALL (z :: 'c).\n gn_subt(x, y) & gn_subt(y, z) & y = (X_gn_inj :: 'a => 'b) x -->\n z = (X_gn_inj :: 'a => 'c) x = (z = (X_gn_inj :: 'b => 'c) y)\"\n\nga_subt_Int_XLt_Rat [rule_format] :\n\"ALL (x :: X_Int). ALL (y :: Rat). gn_subt(x, y)\"\n\nga_subt_Nat_XLt_Int [rule_format] :\n\"ALL (x :: X_Nat). ALL (y :: X_Int). gn_subt(x, y)\"\n\nga_subt_Pos_XLt_Nat [rule_format] :\n\"ALL (x :: Pos). ALL (y :: X_Nat). gn_subt(x, y)\"\n\nComp1 [rule_format] :\n\"ALL (f :: 'b => 'c).\n ALL (g :: 'a => 'b). ALL (y :: 'a). X__o__X (f, g) y = f (g y)\"\n\nIdDef [rule_format] : \"ALL (x :: 'a). id'(x) = x\"\n\nFlipDef [rule_format] :\n\"ALL (f :: 'a => 'b => 'c).\n ALL (x :: 'a). ALL (y :: 'b). X_flip f y x = f x y\"\n\nFstDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'b). fst'(x, y) = x\"\n\nSndDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'b). snd'(x, y) = y\"\n\nCurryDef [rule_format] :\n\"ALL (g :: 'a * 'b => 'c).\n ALL (x :: 'a). ALL (y :: 'b). X_curry g x y = g (x, y)\"\n\nUncurryDef [rule_format] :\n\"ALL (f :: 'a => 'b => 'c).\n ALL (x :: 'a). ALL (y :: 'b). uncurry f (x, y) = f x y\"\n\nNotFalse [rule_format] : \"notH False' = True'\"\n\nNotTrue [rule_format] : \"notH True' = False'\"\n\nAndFalse [rule_format] : \"ALL (x :: Bool). False' && x = False'\"\n\nAndTrue [rule_format] : \"ALL (x :: Bool). True' && x = x\"\n\nAndSym [rule_format] :\n\"ALL (x :: Bool). ALL (y :: Bool). x && y = y && x\"\n\nOrDef [rule_format] :\n\"ALL (x :: Bool).\n ALL (y :: Bool). x || y = notH (notH x && notH y)\"\n\nOtherwiseDef [rule_format] : \"otherwiseH = True'\"\n\nNotFalse1 [rule_format] :\n\"ALL (x :: Bool). notH x = True' = (x = False')\"\n\nNotTrue1 [rule_format] :\n\"ALL (x :: Bool). notH x = False' = (x = True')\"\n\nnotNot1 [rule_format] :\n\"ALL (x :: Bool). (~ x = True') = (notH x = True')\"\n\nnotNot2 [rule_format] :\n\"ALL (x :: Bool). (~ x = False') = (notH x = False')\"\n\nEqualTDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x = y --> x ==' y = True'\"\n\nEqualSymDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x ==' y = y ==' x\"\n\nEqualReflex [rule_format] : \"ALL (x :: 'a). x ==' x = True'\"\n\nEqualTransT [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n x ==' y = True' & y ==' z = True' --> x ==' z = True'\"\n\nDiffDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x /= y = notH (x ==' y)\"\n\nDiffSymDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x /= y = y /= x\"\n\nDiffTDef [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x /= y = True' = (notH (x ==' y) = True')\"\n\nDiffFDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x /= y = False' = (x ==' y = True')\"\n\nTE1 [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x ==' y = False' --> ~ x = y\"\n\nTE2 [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). notH (x ==' y) = True' = (x ==' y = False')\"\n\nTE3 [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). notH (x ==' y) = False' = (x ==' y = True')\"\n\nTE4 [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). (~ x ==' y = True') = (x ==' y = False')\"\n\nIBE1 [rule_format] : \"True' ==' True' = True'\"\n\nIBE2 [rule_format] : \"False' ==' False' = True'\"\n\nIBE3 [rule_format] : \"False' ==' True' = False'\"\n\nIBE4 [rule_format] : \"True' ==' False' = False'\"\n\nIBE5 [rule_format] : \"True' /= False' = True'\"\n\nIBE6 [rule_format] : \"False' /= True' = True'\"\n\nIBE7 [rule_format] : \"notH (True' ==' False') = True'\"\n\nIBE8 [rule_format] : \"notH notH (True' ==' False') = False'\"\n\nIUE1 [rule_format] : \"() ==' () = True'\"\n\nIUE2 [rule_format] : \"() /= () = False'\"\n\nIOE01 [rule_format] : \"LT ==' LT = True'\"\n\nIOE02 [rule_format] : \"EQ ==' EQ = True'\"\n\nIOE03 [rule_format] : \"GT ==' GT = True'\"\n\nIOE04 [rule_format] : \"LT ==' EQ = False'\"\n\nIOE05 [rule_format] : \"LT ==' GT = False'\"\n\nIOE06 [rule_format] : \"EQ ==' GT = False'\"\n\nIOE07 [rule_format] : \"LT /= EQ = True'\"\n\nIOE08 [rule_format] : \"LT /= GT = True'\"\n\nIOE09 [rule_format] : \"EQ /= GT = True'\"\n\nLeIrreflexivity [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x ==' y = True' --> x <_4 y = False'\"\n\nLeTAsymmetry [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x <_4 y = True' --> y <_4 x = False'\"\n\nLeTTransitive [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n x <_4 y = True' & y <_4 z = True' --> x <_4 z = True'\"\n\nLeTTotal [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n (x <_4 y = True' | y <_4 x = True') | x ==' y = True'\"\n\nGeDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x >_4 y = y <_4 x\"\n\nGeIrreflexivity [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x ==' y = True' --> x >_4 y = False'\"\n\nGeTAsymmetry [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x >_4 y = True' --> y >_4 x = False'\"\n\nGeTTransitive [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a). (x >_4 y) && (y >_4 z) = True' --> x >_4 z = True'\"\n\nGeTTotal [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). ((x >_4 y) || (y >_4 x)) || (x ==' y) = True'\"\n\nLeqDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x <=_4 y = (x <_4 y) || (x ==' y)\"\n\nLeqReflexivity [rule_format] : \"ALL (x :: 'a). x <=_4 x = True'\"\n\nLeqTTransitive [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n (x <=_4 y) && (y <=_4 z) = True' --> x <=_4 z = True'\"\n\nLeqTTotal [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). (x <=_4 y) && (y <=_4 x) = x ==' y\"\n\nGeqDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x >=_4 y = (x >_4 y) || (x ==' y)\"\n\nGeqReflexivity [rule_format] : \"ALL (x :: 'a). x >=_4 x = True'\"\n\nGeqTTransitive [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n (x >=_4 y) && (y >=_4 z) = True' --> x >=_4 z = True'\"\n\nGeqTTotal [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). (x >=_4 y) && (y >=_4 x) = x ==' y\"\n\nEqTSOrdRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x ==' y = True' = (x <_4 y = False' & x >_4 y = False')\"\n\nEqFSOrdRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x ==' y = False' = (x <_4 y = True' | x >_4 y = True')\"\n\nEqTOrdRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x ==' y = True' = (x <=_4 y = True' & x >=_4 y = True')\"\n\nEqFOrdRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x ==' y = False' = (x <=_4 y = True' | x >=_4 y = True')\"\n\nEqTOrdTSubstE [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n x ==' y = True' & y <_4 z = True' --> x <_4 z = True'\"\n\nEqTOrdFSubstE [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n x ==' y = True' & y <_4 z = False' --> x <_4 z = False'\"\n\nEqTOrdTSubstD [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n x ==' y = True' & z <_4 y = True' --> z <_4 x = True'\"\n\nEqTOrdFSubstD [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n x ==' y = True' & z <_4 y = False' --> z <_4 x = False'\"\n\nLeTGeFEqFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x <_4 y = True' = (x >_4 y = False' & x ==' y = False')\"\n\nLeFGeTEqTRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x <_4 y = False' = (x >_4 y = True' | x ==' y = True')\"\n\nLeTGeTRel [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x <_4 y = True' = (y >_4 x = True')\"\n\nLeFGeFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x <_4 y = False' = (y >_4 x = False')\"\n\nLeqTGetTRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x <=_4 y = True' = (y >=_4 x = True')\"\n\nLeqFGetFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x <=_4 y = False' = (y >=_4 x = False')\"\n\nGeTLeTRel [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x >_4 y = True' = (y <_4 x = True')\"\n\nGeFLeFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x >_4 y = False' = (y <_4 x = False')\"\n\nGeqTLeqTRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x >=_4 y = True' = (y <=_4 x = True')\"\n\nGeqFLeqFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x >=_4 y = False' = (y <=_4 x = False')\"\n\nLeqTGeFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x <=_4 y = True' = (x >_4 y = False')\"\n\nLeqFGeTRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x <=_4 y = False' = (x >_4 y = True')\"\n\nGeTLeFEqFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x >_4 y = True' = (x <_4 y = False' & x ==' y = False')\"\n\nGeFLeTEqTRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x >_4 y = False' = (x <_4 y = True' | x ==' y = True')\"\n\nGeqTLeFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x >=_4 y = True' = (x <_4 y = False')\"\n\nGeqFLeTRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x >=_4 y = False' = (x <_4 y = True')\"\n\nLeqTLeTEqTRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x <=_4 y = True' = (x <_4 y = True' | x ==' y = True')\"\n\nLeqFLeFEqFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x <=_4 y = False' = (x <_4 y = False' & x ==' y = False')\"\n\nGeqTGeTEqTRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x >=_4 y = True' = (x >_4 y = True' | x ==' y = True')\"\n\nGeqFGeFEqFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n x >=_4 y = False' = (x >_4 y = False' & x ==' y = False')\"\n\nLeTGeqFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x <_4 y = True' = (x >=_4 y = False')\"\n\nGeTLeqFRel [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x >_4 y = True' = (x <=_4 y = False')\"\n\nLeLeqDiff [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). x <_4 y = (x <=_4 y) && (x /= y)\"\n\nCmpLTDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). compare x y ==' LT = x <_4 y\"\n\nCmpEQDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). compare x y ==' EQ = x ==' y\"\n\nCmpGTDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). compare x y ==' GT = x >_4 y\"\n\nMaxYDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). X_maxX4 x y ==' y = x <=_4 y\"\n\nMaxXDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). X_maxX4 x y ==' x = y <=_4 x\"\n\nMinXDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). X_minX4 x y ==' x = x <=_4 y\"\n\nMinYDef [rule_format] :\n\"ALL (x :: 'a). ALL (y :: 'a). X_minX4 x y ==' y = y <=_4 x\"\n\nMaxSym [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). X_maxX4 x y ==' y = X_maxX4 y x ==' y\"\n\nMinSym [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). X_minX4 x y ==' y = X_minX4 y x ==' y\"\n\nTO1 [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n (x ==' y = True' | x <_4 y = True') = (x <=_4 y = True')\"\n\nTO3 [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a).\n notH notH (x <_4 y) = True' | notH (x <_4 y) = True'\"\n\nTO4 [rule_format] :\n\"ALL (x :: 'a).\n ALL (y :: 'a). x <_4 y = True' --> notH (x ==' y) = True'\"\n\nTO5 [rule_format] :\n\"ALL (w :: 'a).\n ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n (x <_4 y = True' & y <_4 z = True') & z <_4 w = True' -->\n x <_4 w = True'\"\n\nIOO13 [rule_format] : \"LT <_4 EQ = True'\"\n\nIOO14 [rule_format] : \"EQ <_4 GT = True'\"\n\nIOO15 [rule_format] : \"LT <_4 GT = True'\"\n\nIOO16 [rule_format] : \"LT <=_4 EQ = True'\"\n\nIOO17 [rule_format] : \"EQ <=_4 GT = True'\"\n\nIOO18 [rule_format] : \"LT <=_4 GT = True'\"\n\nIOO19 [rule_format] : \"EQ >=_4 LT = True'\"\n\nIOO20 [rule_format] : \"GT >=_4 EQ = True'\"\n\nIOO21 [rule_format] : \"GT >=_4 LT = True'\"\n\nIOO22 [rule_format] : \"EQ >_4 LT = True'\"\n\nIOO23 [rule_format] : \"GT >_4 EQ = True'\"\n\nIOO24 [rule_format] : \"GT >_4 LT = True'\"\n\nIOO25 [rule_format] : \"X_maxX4 LT EQ ==' EQ = True'\"\n\nIOO26 [rule_format] : \"X_maxX4 EQ GT ==' GT = True'\"\n\nIOO27 [rule_format] : \"X_maxX4 LT GT ==' GT = True'\"\n\nIOO28 [rule_format] : \"X_minX4 LT EQ ==' LT = True'\"\n\nIOO29 [rule_format] : \"X_minX4 EQ GT ==' EQ = True'\"\n\nIOO30 [rule_format] : \"X_minX4 LT GT ==' LT = True'\"\n\nIOO31 [rule_format] : \"compare LT LT ==' EQ = True'\"\n\nIOO32 [rule_format] : \"compare EQ EQ ==' EQ = True'\"\n\nIOO33 [rule_format] : \"compare GT GT ==' EQ = True'\"\n\nIBO5 [rule_format] : \"False' <_4 True' = True'\"\n\nIBO6 [rule_format] : \"False' >=_4 True' = False'\"\n\nIBO7 [rule_format] : \"True' >=_4 False' = True'\"\n\nIBO8 [rule_format] : \"True' <_4 False' = False'\"\n\nIBO9 [rule_format] : \"X_maxX4 False' True' ==' True' = True'\"\n\nIBO10 [rule_format] : \"X_minX4 False' True' ==' False' = True'\"\n\nIBO11 [rule_format] : \"compare True' True' ==' EQ = True'\"\n\nIBO12 [rule_format] : \"compare False' False' ==' EQ = True'\"\n\nIUO01 [rule_format] : \"() <=_4 () = True'\"\n\nIUO02 [rule_format] : \"() <_4 () = False'\"\n\nIUO03 [rule_format] : \"() >=_4 () = True'\"\n\nIUO04 [rule_format] : \"() >_4 () = False'\"\n\nIUO05 [rule_format] : \"X_maxX4 () () ==' () = True'\"\n\nIUO06 [rule_format] : \"X_minX4 () () ==' () = True'\"\n\nIUO07 [rule_format] : \"compare () () ==' EQ = True'\"\n\nNotDefHead [rule_format] : \"~ defOp (head(Nil'))\"\n\nHeadDef [rule_format] :\n\"ALL (x :: 'a).\n ALL (xs :: 'a List). head(X_Cons x xs) = makePartial x\"\n\nNotDefTail [rule_format] : \"~ defOp (tail(Nil'))\"\n\nTailDef [rule_format] :\n\"ALL (x :: 'a).\n ALL (xs :: 'a List). tail(X_Cons x xs) = makePartial xs\"\n\nFoldrNil [rule_format] :\n\"ALL (f :: 'a => 'b => 'b).\n ALL (s :: 'b). X_foldr f s Nil' = makePartial s\"\n\nFoldrCons [rule_format] :\n\"ALL (f :: 'a => 'b => 'b).\n ALL (s :: 'b).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n X_foldr f s (X_Cons x xs) =\n restrictOp (makePartial (f x (makeTotal (X_foldr f s xs))))\n (defOp (X_foldr f s xs))\"\n\nFoldlNil [rule_format] :\n\"ALL (g :: 'a => 'b => 'a).\n ALL (t :: 'a). X_foldl g t Nil' = makePartial t\"\n\nFoldlCons [rule_format] :\n\"ALL (g :: 'a => 'b => 'a).\n ALL (t :: 'a).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n X_foldl g t (X_Cons z zs) = X_foldl g (g t z) zs\"\n\nMapNil [rule_format] : \"ALL (h :: 'a => 'b). X_map h Nil' = Nil'\"\n\nMapCons [rule_format] :\n\"ALL (h :: 'a => 'b).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n X_map h (X_Cons x xs) = X_Cons (h x) (X_map h xs)\"\n\nXPlusXPlusNil [rule_format] : \"ALL (l :: 'a List). Nil' ++' l = l\"\n\nXPlusXPlusCons [rule_format] :\n\"ALL (l :: 'a List).\n ALL (x :: 'a).\n ALL (xs :: 'a List). X_Cons x xs ++' l = X_Cons x (xs ++' l)\"\n\nFilterNil [rule_format] :\n\"ALL (p :: 'a => Bool). X_filter p Nil' = Nil'\"\n\nFilterConsT [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n p x = True' -->\n X_filter p (X_Cons x xs) = X_Cons x (X_filter p xs)\"\n\nFilterConsF [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n p x = False' --> X_filter p (X_Cons x xs) = X_filter p xs\"\n\nZipNil [rule_format] : \"ALL (l :: 'a List). X_zip Nil' l = Nil'\"\n\nZipConsNil [rule_format] :\n\"ALL (l :: 'a List).\n ALL (x :: 'a).\n ALL (xs :: 'a List). l = Nil' --> X_zip (X_Cons x xs) l = Nil'\"\n\nZipConsCons [rule_format] :\n\"ALL (l :: 'a List).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n ALL (y :: 'a).\n ALL (ys :: 'a List).\n l = X_Cons y ys -->\n X_zip (X_Cons x xs) l = X_Cons (x, y) (X_zip xs ys)\"\n\nUnzipNil [rule_format] : \"unzip(Nil') = (Nil', Nil')\"\n\nUnzipCons [rule_format] :\n\"ALL (ps :: ('a * 'b) List).\n ALL (x :: 'a).\n ALL (z :: 'b).\n unzip(X_Cons (x, z) ps) =\n (let (ys, zs) = unzip(ps) in (X_Cons x ys, X_Cons z zs))\"\n\nILE01 [rule_format] : \"Nil' ==' Nil' = True'\"\n\nILE02 [rule_format] :\n\"ALL (x :: 'a).\n ALL (xs :: 'a List).\n ALL (y :: 'a).\n ALL (ys :: 'a List).\n X_Cons x xs ==' X_Cons y ys = (x ==' y) && (xs ==' ys)\"\n\nILO01 [rule_format] : \"Nil' <_4 Nil' = False'\"\n\nILO02 [rule_format] : \"Nil' <=_4 Nil' = True'\"\n\nILO03 [rule_format] : \"Nil' >_4 Nil' = False'\"\n\nILO04 [rule_format] : \"Nil' >=_4 Nil' = True'\"\n\nILO05 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n z <_4 w = True' --> X_Cons z zs <_4 X_Cons w ws = True'\"\n\nILO06 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n z ==' w = True' --> X_Cons z zs <_4 X_Cons w ws = zs <_4 ws\"\n\nILO07 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n z <_4 w = False' & z ==' w = False' -->\n X_Cons z zs <_4 X_Cons w ws = False'\"\n\nILO08 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n X_Cons z zs <=_4 X_Cons w ws =\n (X_Cons z zs <_4 X_Cons w ws) || (X_Cons z zs ==' X_Cons w ws)\"\n\nILO09 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n X_Cons z zs >_4 X_Cons w ws = X_Cons w ws <_4 X_Cons z zs\"\n\nILO10 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n X_Cons z zs >=_4 X_Cons w ws =\n (X_Cons z zs >_4 X_Cons w ws) || (X_Cons z zs ==' X_Cons w ws)\"\n\nILO11 [rule_format] : \"compare Nil' Nil' ==' EQ = Nil' ==' Nil'\"\n\nILO12 [rule_format] : \"compare Nil' Nil' ==' LT = Nil' <_4 Nil'\"\n\nILO13 [rule_format] : \"compare Nil' Nil' ==' GT = Nil' >_4 Nil'\"\n\nILO14 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n compare (X_Cons z zs) (X_Cons w ws) ==' EQ =\n X_Cons z zs ==' X_Cons w ws\"\n\nILO15 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n compare (X_Cons z zs) (X_Cons w ws) ==' LT =\n X_Cons z zs <_4 X_Cons w ws\"\n\nILO16 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n compare (X_Cons z zs) (X_Cons w ws) ==' GT =\n X_Cons z zs >_4 X_Cons w ws\"\n\nILO17 [rule_format] : \"X_maxX4 Nil' Nil' ==' Nil' = Nil' <=_4 Nil'\"\n\nILO18 [rule_format] : \"X_minX4 Nil' Nil' ==' Nil' = Nil' <=_4 Nil'\"\n\nILO19 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n X_Cons z zs <=_4 X_Cons w ws =\n X_maxX4 (X_Cons z zs) (X_Cons w ws) ==' X_Cons w ws\"\n\nILO20 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n X_Cons w ws <=_4 X_Cons z zs =\n X_maxX4 (X_Cons z zs) (X_Cons w ws) ==' X_Cons z zs\"\n\nILO21 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n X_Cons z zs <=_4 X_Cons w ws =\n X_minX4 (X_Cons z zs) (X_Cons w ws) ==' X_Cons z zs\"\n\nILO22 [rule_format] :\n\"ALL (w :: 'b).\n ALL (ws :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n X_Cons w ws <=_4 X_Cons z zs =\n X_minX4 (X_Cons z zs) (X_Cons w ws) ==' X_Cons w ws\"\n\nFoldlDecomp [rule_format] :\n\"ALL (e :: 'a).\n ALL (i :: 'a => 'b => 'a).\n ALL (ts :: 'b List).\n ALL (ys :: 'b List).\n X_foldl i e (ys ++' ts) =\n restrictOp (X_foldl i (makeTotal (X_foldl i e ys)) ts)\n (defOp (X_foldl i e ys))\"\n\nMapDecomp [rule_format] :\n\"ALL (f :: 'a => 'b).\n ALL (xs :: 'a List).\n ALL (zs :: 'a List).\n X_map f (xs ++' zs) = X_map f xs ++' X_map f zs\"\n\nMapFunctor [rule_format] :\n\"ALL (f :: 'a => 'b).\n ALL (g :: 'b => 'c).\n ALL (xs :: 'a List).\n X_map (X__o__X (g, f)) xs = X_map g (X_map f xs)\"\n\nFilterProm [rule_format] :\n\"ALL (f :: 'a => 'b).\n ALL (p :: 'b => Bool).\n ALL (xs :: 'a List).\n X_filter p (X_map f xs) = X_map f (X_filter (X__o__X (p, f)) xs)\"\n\nInitNil [rule_format] : \"~ defOp (init(Nil'))\"\n\nInitConsNil [rule_format] :\n\"ALL (x :: 'a). init(X_Cons x Nil') = makePartial Nil'\"\n\nInitConsCons [rule_format] :\n\"ALL (x :: 'a).\n ALL (xs :: 'a List).\n init(X_Cons x xs) =\n restrictOp (makePartial (X_Cons x (makeTotal (init(xs)))))\n (defOp (init(xs)))\"\n\nLastNil [rule_format] : \"~ defOp (last'(Nil'))\"\n\nLastConsNil [rule_format] :\n\"ALL (x :: 'a). last'(X_Cons x Nil') = makePartial x\"\n\nLastConsCons [rule_format] :\n\"ALL (x :: 'a).\n ALL (xs :: 'a List). last'(X_Cons x xs) = last'(xs)\"\n\nNullNil [rule_format] : \"null'(Nil') = True'\"\n\nNullCons [rule_format] :\n\"ALL (x :: 'a). ALL (xs :: 'a List). null'(X_Cons x xs) = False'\"\n\nReverseNil [rule_format] : \"reverse(Nil') = Nil'\"\n\nReverseCons [rule_format] :\n\"ALL (x :: 'a).\n ALL (xs :: 'a List).\n reverse(X_Cons x xs) = reverse(xs) ++' X_Cons x Nil'\"\n\nFoldr1Nil [rule_format] :\n\"ALL (f :: 'a => 'a => 'a). ~ defOp (foldr1 f Nil')\"\n\nFoldr1ConsNil [rule_format] :\n\"ALL (f :: 'a => 'a => 'a).\n ALL (x :: 'a). foldr1 f (X_Cons x Nil') = makePartial x\"\n\nFoldr1ConsCons [rule_format] :\n\"ALL (f :: 'a => 'a => 'a).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n foldr1 f (X_Cons x xs) =\n restrictOp (makePartial (f x (makeTotal (foldr1 f xs))))\n (defOp (foldr1 f xs))\"\n\nFoldl1Nil [rule_format] :\n\"ALL (f :: 'a => 'a => 'a). ~ defOp (foldl1 f Nil')\"\n\nFoldl1ConsNil [rule_format] :\n\"ALL (f :: 'a => 'a => 'a).\n ALL (x :: 'a). foldl1 f (X_Cons x Nil') = makePartial x\"\n\nFoldl1ConsCons [rule_format] :\n\"ALL (f :: 'a => 'a => 'a).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n foldl1 f (X_Cons x xs) =\n restrictOp (makePartial (f x (makeTotal (foldr1 f xs))))\n (defOp (foldr1 f xs))\"\n\nScanlNil [rule_format] :\n\"ALL (g :: 'a => 'b => 'a).\n ALL (q :: 'a).\n ALL (ys :: 'b List). ys = Nil' --> scanl g q ys = X_Cons q Nil'\"\n\nScanlCons [rule_format] :\n\"ALL (g :: 'a => 'b => 'a).\n ALL (q :: 'a).\n ALL (ys :: 'b List).\n ALL (z :: 'b).\n ALL (zs :: 'b List).\n ys = X_Cons z zs --> scanl g q ys = X_Cons q (scanl g (g q z) zs)\"\n\nScanl1Nil [rule_format] :\n\"ALL (f :: 'a => 'a => 'a). scanl1 f Nil' = Nil'\"\n\nScanl1Cons [rule_format] :\n\"ALL (f :: 'a => 'a => 'a).\n ALL (x :: 'a).\n ALL (xs :: 'a List). scanl1 f (X_Cons x xs) = scanl f x xs\"\n\nScanrNil [rule_format] :\n\"ALL (h :: 'a => 'b => 'b).\n ALL (z :: 'b). scanr h z Nil' = X_Cons z Nil'\"\n\nScanrCons [rule_format] :\n\"ALL (h :: 'a => 'b => 'b).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n ALL (y :: 'b).\n ALL (ys :: 'b List).\n ALL (z :: 'b).\n X_Cons y ys = scanr h z xs -->\n scanr h z (X_Cons x xs) = X_Cons (h x y) (X_Cons y ys)\"\n\nScanr1Nil [rule_format] :\n\"ALL (f :: 'a => 'a => 'a). scanr1 f Nil' = Nil'\"\n\nScanr1ConsNil [rule_format] :\n\"ALL (f :: 'a => 'a => 'a).\n ALL (x :: 'a). scanr1 f (X_Cons x Nil') = X_Cons x Nil'\"\n\nScanr1ConsCons [rule_format] :\n\"ALL (f :: 'a => 'a => 'a).\n ALL (q :: 'a).\n ALL (qs :: 'a List).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n X_Cons q qs = scanr1 f xs -->\n scanr1 f (X_Cons x xs) = X_Cons (f x q) (X_Cons q qs)\"\n\nScanlProperty [rule_format] :\n\"ALL (g :: 'a => 'b => 'a).\n ALL (x :: 'a).\n ALL (ys :: 'b List). last'(scanl g x ys) = X_foldl g x ys\"\n\nScanrProperty [rule_format] :\n\"ALL (h :: 'a => 'b => 'b).\n ALL (xs :: 'a List).\n ALL (y :: 'b). head(scanr h y xs) = X_foldr h y xs\"\n\nAndLNil [rule_format] : \"andL(Nil') = True'\"\n\nAndLCons [rule_format] :\n\"ALL (b1 :: Bool).\n ALL (bs :: Bool List). andL(X_Cons b1 bs) = b1 && andL(bs)\"\n\nOrLNil [rule_format] : \"orL(Nil') = False'\"\n\nOrLCons [rule_format] :\n\"ALL (b1 :: Bool).\n ALL (bs :: Bool List). orL(X_Cons b1 bs) = b1 || orL(bs)\"\n\nAnyDef [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (xs :: 'a List). X_any p xs = orL(X_map p xs)\"\n\nAllDef [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (xs :: 'a List). X_all p xs = andL(X_map p xs)\"\n\nConcatDef [rule_format] :\n\"ALL (xxs :: 'a List List).\n makePartial (concat'(xxs)) =\n X_foldr (X_curry (uncurryOp X__XPlusXPlus__X)) Nil' xxs\"\n\nConcatMapDef [rule_format] :\n\"ALL (g :: 'a => 'b List).\n ALL (xs :: 'a List). concatMap g xs = concat'(X_map g xs)\"\n\nMaximunNil [rule_format] : \"~ defOp (maximum(Nil'))\"\n\nMaximumDef [rule_format] :\n\"ALL (ds :: 'd List). maximum(ds) = foldl1 X_maxX4 ds\"\n\nMinimunNil [rule_format] : \"~ defOp (minimum(Nil'))\"\n\nMinimumDef [rule_format] :\n\"ALL (ds :: 'd List). minimum(ds) = foldl1 X_minX4 ds\"\n\nTakeWhileNil [rule_format] :\n\"ALL (p :: 'a => Bool). X_takeWhile p Nil' = Nil'\"\n\nTakeWhileConsT [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n p x = True' -->\n X_takeWhile p (X_Cons x xs) = X_Cons x (X_takeWhile p xs)\"\n\nTakeWhileConsF [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n p x = False' --> X_takeWhile p (X_Cons x xs) = Nil'\"\n\nDropWhileNil [rule_format] :\n\"ALL (p :: 'a => Bool). X_dropWhile p Nil' = Nil'\"\n\nDropWhileConsT [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n p x = True' --> X_dropWhile p (X_Cons x xs) = X_dropWhile p xs\"\n\nDropWhileConsF [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n p x = False' --> X_dropWhile p (X_Cons x xs) = X_Cons x xs\"\n\nSpanNil [rule_format] :\n\"ALL (p :: 'a => Bool). span p Nil' = (Nil', Nil')\"\n\nSpanConsT [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n p x = True' -->\n span p (X_Cons x xs) =\n (let (ys, zs) = span p xs in (X_Cons x ys, zs))\"\n\nSpanConsF [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n p x = False' -->\n span p (X_Cons x xs) =\n (let (ys, zs) = span p xs in (Nil', X_Cons x xs))\"\n\nSpanThm [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (xs :: 'a List).\n span p xs = (X_takeWhile p xs, X_dropWhile p xs)\"\n\nBreakDef [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (xs :: 'a List).\n break p xs = (let q = X__o__X (notH__X, p) in span q xs)\"\n\nBreakThm [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (xs :: 'a List). break p xs = span (X__o__X (notH__X, p)) xs\"\n\nInsertNil [rule_format] :\n\"ALL (q :: 'd). X_insert q Nil' = X_Cons q Nil'\"\n\nInsertCons1 [rule_format] :\n\"ALL (q :: 'd).\n ALL (r :: 'd).\n ALL (rs :: 'd List).\n q <=_4 r = True' -->\n X_insert q (X_Cons r rs) = X_Cons q (X_Cons r rs)\"\n\nInsertCons2 [rule_format] :\n\"ALL (q :: 'd).\n ALL (r :: 'd).\n ALL (rs :: 'd List).\n q >_4 r = True' -->\n X_insert q (X_Cons r rs) = X_Cons r (X_insert q rs)\"\n\nDeleteNil [rule_format] : \"ALL (s :: 'e). delete s Nil' = Nil'\"\n\nDeleteConsT [rule_format] :\n\"ALL (s :: 'e).\n ALL (t :: 'e).\n ALL (ts :: 'e List).\n s ==' t = True' --> delete s (X_Cons t ts) = ts\"\n\nDeleteConsF [rule_format] :\n\"ALL (s :: 'e).\n ALL (t :: 'e).\n ALL (ts :: 'e List).\n s ==' t = False' -->\n delete s (X_Cons t ts) = X_Cons t (delete s ts)\"\n\nSelectT [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n ALL (ys :: 'a List).\n p x = True' --> select p x (xs, ys) = (X_Cons x xs, ys)\"\n\nSelectF [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n ALL (ys :: 'a List).\n p x = False' --> select p x (xs, ys) = (xs, X_Cons x ys)\"\n\nPartition [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (xs :: 'a List).\n makePartial (partition p xs) = X_foldr (select p) (Nil', Nil') xs\"\n\nPartitionProp [rule_format] :\n\"ALL (p :: 'a => Bool).\n ALL (xs :: 'a List).\n partition p xs =\n (X_filter p xs, X_filter (X__o__X (notH__X, p)) xs)\"\n\nPartialTest [rule_format] :\n\"ALL (x :: 'a).\n ALL (xs :: 'a List).\n makePartial (X_Cons x xs) =\n restrictOp\n (makePartial\n  (X_Cons (makeTotal (head(X_Cons x xs)))\n   (makeTotal (tail(X_Cons x xs)))))\n (defOp (head(X_Cons x xs)) & defOp (tail(X_Cons x xs)))\"\n\nga_selector_pre [rule_format] :\n\"ALL (XX1 :: X_Nat). pre(suc'(XX1)) = makePartial XX1\"\n\nga_injective_suc [rule_format] :\n\"ALL (XX1 :: X_Nat).\n ALL (Y1 :: X_Nat). suc'(XX1) = suc'(Y1) = (XX1 = Y1)\"\n\nga_disjoint_0_suc [rule_format] :\n\"ALL (Y1 :: X_Nat). ~ 0'' = suc'(Y1)\"\n\nga_selector_undef_pre_0 [rule_format] : \"~ defOp (pre(0''))\"\n\nX1_def_Nat [rule_format] : \"1'' = suc'(0'')\"\n\nX2_def_Nat [rule_format] : \"2'' = suc'(1'')\"\n\nX3_def_Nat [rule_format] : \"3'' = suc'(2'')\"\n\nX4_def_Nat [rule_format] : \"4'' = suc'(3'')\"\n\nX5_def_Nat [rule_format] : \"5'' = suc'(4'')\"\n\nX6_def_Nat [rule_format] : \"6'' = suc'(5'')\"\n\nX7_def_Nat [rule_format] : \"7'' = suc'(6'')\"\n\nX8_def_Nat [rule_format] : \"8'' = suc'(7'')\"\n\nX9_def_Nat [rule_format] : \"9'' = suc'(8'')\"\n\ndecimal_def [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat). m @@ X_n = (m *'' suc'(9'')) +'' X_n\"\n\nga_comm___XPlus__ [rule_format] :\n\"ALL (x :: X_Nat). ALL (y :: X_Nat). x +'' y = y +'' x\"\n\nga_assoc___XPlus__ [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n ALL (z :: X_Nat). (x +'' y) +'' z = x +'' (y +'' z)\"\n\nga_right_unit___XPlus__ [rule_format] :\n\"ALL (x :: X_Nat). x +'' 0'' = x\"\n\nga_left_unit___XPlus__ [rule_format] :\n\"ALL (x :: X_Nat). 0'' +'' x = x\"\n\nga_left_comm___XPlus__ [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n ALL (z :: X_Nat). x +'' (y +'' z) = y +'' (x +'' z)\"\n\nga_comm___Xx__ [rule_format] :\n\"ALL (x :: X_Nat). ALL (y :: X_Nat). x *'' y = y *'' x\"\n\nga_assoc___Xx__ [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n ALL (z :: X_Nat). (x *'' y) *'' z = x *'' (y *'' z)\"\n\nga_right_unit___Xx__ [rule_format] :\n\"ALL (x :: X_Nat). x *'' 1'' = x\"\n\nga_left_unit___Xx__ [rule_format] :\n\"ALL (x :: X_Nat). 1'' *'' x = x\"\n\nga_left_comm___Xx__ [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n ALL (z :: X_Nat). x *'' (y *'' z) = y *'' (x *'' z)\"\n\nga_comm_min [rule_format] :\n\"ALL (x :: X_Nat). ALL (y :: X_Nat). min''(x, y) = min''(y, x)\"\n\nga_assoc_min [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n ALL (z :: X_Nat). min''(min''(x, y), z) = min''(x, min''(y, z))\"\n\nga_left_comm_min [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n ALL (z :: X_Nat). min''(x, min''(y, z)) = min''(y, min''(x, z))\"\n\nga_comm_max [rule_format] :\n\"ALL (x :: X_Nat). ALL (y :: X_Nat). max''(x, y) = max''(y, x)\"\n\nga_assoc_max [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n ALL (z :: X_Nat). max''(max''(x, y), z) = max''(x, max''(y, z))\"\n\nga_right_unit_max [rule_format] :\n\"ALL (x :: X_Nat). max''(x, 0'') = x\"\n\nga_left_unit_max [rule_format] :\n\"ALL (x :: X_Nat). max''(0'', x) = x\"\n\nga_left_comm_max [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n ALL (z :: X_Nat). max''(x, max''(y, z)) = max''(y, max''(x, z))\"\n\nleq_def1_Nat [rule_format] : \"ALL (X_n :: X_Nat). 0'' <='' X_n\"\n\ndvd_def_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat).\n (m dvd' X_n) = (EX (k :: X_Nat). X_n = m *'' k)\"\n\nleq_def2_Nat [rule_format] :\n\"ALL (X_n :: X_Nat). ~ suc'(X_n) <='' 0''\"\n\nleq_def3_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat). (suc'(m) <='' suc'(X_n)) = (m <='' X_n)\"\n\ngeq_def_Nat [rule_format] :\n\"ALL (m :: X_Nat). ALL (X_n :: X_Nat). (m >='' X_n) = (X_n <='' m)\"\n\nless_def_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat). (m <'' X_n) = (m <='' X_n & ~ m = X_n)\"\n\ngreater_def_Nat [rule_format] :\n\"ALL (m :: X_Nat). ALL (X_n :: X_Nat). (m >'' X_n) = (X_n <'' m)\"\n\neven_0_Nat [rule_format] : \"even''(0'')\"\n\neven_suc_Nat [rule_format] :\n\"ALL (m :: X_Nat). even''(suc'(m)) = odd''(m)\"\n\nodd_def_Nat [rule_format] :\n\"ALL (m :: X_Nat). odd''(m) = (~ even''(m))\"\n\nfactorial_0 [rule_format] : \"0'' !' = 1''\"\n\nfactorial_suc [rule_format] :\n\"ALL (X_n :: X_Nat). suc'(X_n) !' = suc'(X_n) *'' X_n !'\"\n\nadd_0_Nat [rule_format] : \"ALL (m :: X_Nat). 0'' +'' m = m\"\n\nadd_suc_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat). suc'(X_n) +'' m = suc'(X_n +'' m)\"\n\nmult_0_Nat [rule_format] : \"ALL (m :: X_Nat). 0'' *'' m = 0''\"\n\nmult_suc_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat). suc'(X_n) *'' m = (X_n *'' m) +'' m\"\n\npower_0_Nat [rule_format] : \"ALL (m :: X_Nat). m ^'' 0'' = 1''\"\n\npower_suc_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat). m ^'' suc'(X_n) = m *'' (m ^'' X_n)\"\n\nmin_def_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat).\n min''(m, X_n) = (if m <='' X_n then m else X_n)\"\n\nmax_def_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat).\n max''(m, X_n) = (if m <='' X_n then X_n else m)\"\n\nsubTotal_def1_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat). m >'' X_n --> X_n -! m = 0''\"\n\nsubTotal_def2_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat).\n m <='' X_n --> makePartial (X_n -! m) = X_n -? m\"\n\nsub_dom_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat). defOp (m -? X_n) = (m >='' X_n)\"\n\nsub_def_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat).\n ALL (r :: X_Nat). m -? X_n = makePartial r = (m = r +'' X_n)\"\n\ndivide_dom_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat).\n defOp (m /?'' X_n) = (~ X_n = 0'' & m mod'' X_n = makePartial 0'')\"\n\ndivide_0_Nat [rule_format] :\n\"ALL (m :: X_Nat). ~ defOp (m /?'' 0'')\"\n\ndivide_Pos_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat).\n ALL (r :: X_Nat).\n X_n >'' 0'' --> m /?'' X_n = makePartial r = (m = r *'' X_n)\"\n\ndiv_dom_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat). defOp (m div'' X_n) = (~ X_n = 0'')\"\n\ndiv_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat).\n ALL (r :: X_Nat).\n m div'' X_n = makePartial r =\n (EX (s :: X_Nat). m = (X_n *'' r) +'' s & s <'' X_n)\"\n\nmod_dom_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat). defOp (m mod'' X_n) = (~ X_n = 0'')\"\n\nmod_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat).\n ALL (s :: X_Nat).\n m mod'' X_n = makePartial s =\n (EX (r :: X_Nat). m = (X_n *'' r) +'' s & s <'' X_n)\"\n\ndistr1_Nat [rule_format] :\n\"ALL (r :: X_Nat).\n ALL (s :: X_Nat).\n ALL (t :: X_Nat). (r +'' s) *'' t = (r *'' t) +'' (s *'' t)\"\n\ndistr2_Nat [rule_format] :\n\"ALL (r :: X_Nat).\n ALL (s :: X_Nat).\n ALL (t :: X_Nat). t *'' (r +'' s) = (t *'' r) +'' (t *'' s)\"\n\nPos_def [rule_format] :\n\"ALL (p :: X_Nat).\n defOp ((X_gn_proj :: X_Nat => Pos partial) p) = (p >'' 0'')\"\n\nX1_as_Pos_def [rule_format] : \"1_3 = suc''(0'')\"\n\nmin_0 [rule_format] : \"ALL (m :: X_Nat). min''(m, 0'') = 0''\"\n\ndiv_mod_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (X_n :: X_Nat).\n ~ X_n = 0'' -->\n makePartial m =\n restrictOp\n (makePartial\n  ((makeTotal (m div'' X_n) *'' X_n) +'' makeTotal (m mod'' X_n)))\n (defOp (m div'' X_n) & defOp (m mod'' X_n))\"\n\npower_Nat [rule_format] :\n\"ALL (m :: X_Nat).\n ALL (r :: X_Nat).\n ALL (s :: X_Nat). m ^'' (r +'' s) = (m ^'' r) *'' (m ^'' s)\"\n\nga_generated_Int [rule_format] :\n\"ALL (p_Int :: X_Int => bool).\n (ALL (x_1 :: X_Nat). ALL (x_2 :: X_Nat). p_Int (x_1 -'' x_2)) -->\n (ALL (x :: X_Int). p_Int x)\"\n\nequality_Int [rule_format] :\n\"ALL (a :: X_Nat).\n ALL (b :: X_Nat).\n ALL (c :: X_Nat).\n ALL (d :: X_Nat). a -'' b = c -'' d = (a +'' d = c +'' b)\"\n\nNat2Int_embedding [rule_format] :\n\"ALL (a :: X_Nat). (X_gn_inj :: X_Nat => X_Int) a = a -'' 0''\"\n\nga_comm___XPlus___80 [rule_format] :\n\"ALL (x :: X_Int). ALL (y :: X_Int). x +' y = y +' x\"\n\nga_assoc___XPlus___76 [rule_format] :\n\"ALL (x :: X_Int).\n ALL (y :: X_Int). ALL (z :: X_Int). (x +' y) +' z = x +' (y +' z)\"\n\nga_right_unit___XPlus___90 [rule_format] :\n\"ALL (x :: X_Int). x +' (X_gn_inj :: X_Nat => X_Int) 0'' = x\"\n\nga_left_unit___XPlus___88 [rule_format] :\n\"ALL (x :: X_Int). (X_gn_inj :: X_Nat => X_Int) 0'' +' x = x\"\n\nga_left_comm___XPlus___84 [rule_format] :\n\"ALL (x :: X_Int).\n ALL (y :: X_Int). ALL (z :: X_Int). x +' (y +' z) = y +' (x +' z)\"\n\nga_comm___Xx___79 [rule_format] :\n\"ALL (x :: X_Int). ALL (y :: X_Int). x *' y = y *' x\"\n\nga_assoc___Xx___75 [rule_format] :\n\"ALL (x :: X_Int).\n ALL (y :: X_Int). ALL (z :: X_Int). (x *' y) *' z = x *' (y *' z)\"\n\nga_right_unit___Xx___89 [rule_format] :\n\"ALL (x :: X_Int). x *' (X_gn_inj :: Pos => X_Int) 1_3 = x\"\n\nga_left_unit___Xx___87 [rule_format] :\n\"ALL (x :: X_Int). (X_gn_inj :: Pos => X_Int) 1_3 *' x = x\"\n\nga_left_comm___Xx___83 [rule_format] :\n\"ALL (x :: X_Int).\n ALL (y :: X_Int). ALL (z :: X_Int). x *' (y *' z) = y *' (x *' z)\"\n\nga_comm_min_82 [rule_format] :\n\"ALL (x :: X_Int). ALL (y :: X_Int). min'(x, y) = min'(y, x)\"\n\nga_comm_max_81 [rule_format] :\n\"ALL (x :: X_Int). ALL (y :: X_Int). max'(x, y) = max'(y, x)\"\n\nga_assoc_min_78 [rule_format] :\n\"ALL (x :: X_Int).\n ALL (y :: X_Int).\n ALL (z :: X_Int). min'(min'(x, y), z) = min'(x, min'(y, z))\"\n\nga_assoc_max_77 [rule_format] :\n\"ALL (x :: X_Int).\n ALL (y :: X_Int).\n ALL (z :: X_Int). max'(max'(x, y), z) = max'(x, max'(y, z))\"\n\nga_left_comm_min_86 [rule_format] :\n\"ALL (x :: X_Int).\n ALL (y :: X_Int).\n ALL (z :: X_Int). min'(x, min'(y, z)) = min'(y, min'(x, z))\"\n\nga_left_comm_max_85 [rule_format] :\n\"ALL (x :: X_Int).\n ALL (y :: X_Int).\n ALL (z :: X_Int). max'(x, max'(y, z)) = max'(y, max'(x, z))\"\n\nleq_def_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n (m <=' X_n) =\n defOp ((X_gn_proj :: X_Int => X_Nat partial) (X_n -' m))\"\n\ngeq_def_Int [rule_format] :\n\"ALL (m :: X_Int). ALL (X_n :: X_Int). (m >=' X_n) = (X_n <=' m)\"\n\nless_def_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int). (m <' X_n) = (m <=' X_n & ~ m = X_n)\"\n\ngreater_def_Int [rule_format] :\n\"ALL (m :: X_Int). ALL (X_n :: X_Int). (m >' X_n) = (X_n <' m)\"\n\neven_def_Int [rule_format] :\n\"ALL (m :: X_Int). even'(m) = even''(abs'(m))\"\n\nodd_def_Int [rule_format] :\n\"ALL (m :: X_Int). odd'(m) = (~ even'(m))\"\n\nodd_alt_Int [rule_format] :\n\"ALL (m :: X_Int). odd'(m) = odd''(abs'(m))\"\n\nneg_def_Int [rule_format] :\n\"ALL (a :: X_Nat). ALL (b :: X_Nat). -' (a -'' b) = b -'' a\"\n\nsign_def_Int [rule_format] :\n\"ALL (m :: X_Int).\n sign(m) =\n (if m = (X_gn_inj :: X_Nat => X_Int) 0''\n     then (X_gn_inj :: X_Nat => X_Int) 0''\n     else if m >' (X_gn_inj :: X_Nat => X_Int) 0''\n             then (X_gn_inj :: Pos => X_Int) 1_3\n             else -' (X_gn_inj :: Pos => X_Int) 1_3)\"\n\nabs_def_Int [rule_format] :\n\"ALL (m :: X_Int).\n (X_gn_inj :: X_Nat => X_Int) (abs'(m)) =\n (if m <' (X_gn_inj :: X_Nat => X_Int) 0'' then -' m else m)\"\n\nadd_def_Int [rule_format] :\n\"ALL (a :: X_Nat).\n ALL (b :: X_Nat).\n ALL (c :: X_Nat).\n ALL (d :: X_Nat). (a -'' b) +' (c -'' d) = (a +'' c) -'' (b +'' d)\"\n\nmult_def_Int [rule_format] :\n\"ALL (a :: X_Nat).\n ALL (b :: X_Nat).\n ALL (c :: X_Nat).\n ALL (d :: X_Nat).\n (a -'' b) *' (c -'' d) =\n ((a *'' c) +'' (b *'' d)) -'' ((b *'' c) +'' (a *'' d))\"\n\nsub_def_Int [rule_format] :\n\"ALL (m :: X_Int). ALL (X_n :: X_Int). m -' X_n = m +' -' X_n\"\n\nmin_def_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int). min'(m, X_n) = (if m <=' X_n then m else X_n)\"\n\nmax_def_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int). max'(m, X_n) = (if m <=' X_n then X_n else m)\"\n\npower_neg1_Int [rule_format] :\n\"ALL (a :: X_Nat).\n -' (X_gn_inj :: Pos => X_Int) 1_3 ^' a =\n (if even''(a) then (X_gn_inj :: Pos => X_Int) 1_3\n     else -' (X_gn_inj :: Pos => X_Int) 1_3)\"\n\npower_others_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (a :: X_Nat).\n ~ m = -' (X_gn_inj :: Pos => X_Int) 1_3 -->\n m ^' a =\n (sign(m) ^' a) *' (X_gn_inj :: X_Nat => X_Int) (abs'(m) ^'' a)\"\n\ndivide_dom2_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n defOp (m /?' X_n) = (m mod' X_n = makePartial 0'')\"\n\ndivide_alt_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n ALL (r :: X_Int).\n m /?' X_n = makePartial r =\n (~ X_n = (X_gn_inj :: X_Nat => X_Int) 0'' & X_n *' r = m)\"\n\ndivide_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n m /?' X_n =\n restrictOp\n (makePartial\n  ((sign(m) *' sign(X_n)) *'\n   (X_gn_inj :: X_Nat => X_Int) (makeTotal (abs'(m) /?'' abs'(X_n)))))\n (defOp (abs'(m) /?'' abs'(X_n)))\"\n\ndiv_dom_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n defOp (m div' X_n) = (~ X_n = (X_gn_inj :: X_Nat => X_Int) 0'')\"\n\ndiv_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n ALL (r :: X_Int).\n m div' X_n = makePartial r =\n (EX (a :: X_Nat).\n  m = (X_n *' r) +' (X_gn_inj :: X_Nat => X_Int) a &\n  a <'' abs'(X_n))\"\n\nquot_dom_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n defOp (m quot' X_n) = (~ X_n = (X_gn_inj :: X_Nat => X_Int) 0'')\"\n\nquot_neg_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n ALL (r :: X_Int).\n m <' (X_gn_inj :: X_Nat => X_Int) 0'' -->\n m quot' X_n = makePartial r =\n (EX (s :: X_Int).\n  m = (X_n *' r) +' s &\n  (X_gn_inj :: X_Nat => X_Int) 0'' >=' s &\n  s >' -' (X_gn_inj :: X_Nat => X_Int) (abs'(X_n)))\"\n\nquot_nonneg_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n ALL (r :: X_Int).\n m >=' (X_gn_inj :: X_Nat => X_Int) 0'' -->\n m quot' X_n = makePartial r =\n (EX (s :: X_Int).\n  m = (X_n *' r) +' s &\n  (X_gn_inj :: X_Nat => X_Int) 0'' <=' s &\n  s <' (X_gn_inj :: X_Nat => X_Int) (abs'(X_n)))\"\n\nrem_dom_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n defOp (m rem' X_n) = (~ X_n = (X_gn_inj :: X_Nat => X_Int) 0'')\"\n\nrem_neg_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n ALL (s :: X_Int).\n m <' (X_gn_inj :: X_Nat => X_Int) 0'' -->\n m rem' X_n = makePartial s =\n (EX (r :: X_Int).\n  m = (X_n *' r) +' s &\n  (X_gn_inj :: X_Nat => X_Int) 0'' >=' s &\n  s >' -' (X_gn_inj :: X_Nat => X_Int) (abs'(X_n)))\"\n\nrem_nonneg_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n ALL (s :: X_Int).\n m >=' (X_gn_inj :: X_Nat => X_Int) 0'' -->\n m rem' X_n = makePartial s =\n (EX (r :: X_Int).\n  m = (X_n *' r) +' s &\n  (X_gn_inj :: X_Nat => X_Int) 0'' <=' s &\n  s <' (X_gn_inj :: X_Nat => X_Int) (abs'(X_n)))\"\n\nmod_dom_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n defOp (m mod' X_n) = (~ X_n = (X_gn_inj :: X_Nat => X_Int) 0'')\"\n\nmod_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n ALL (a :: X_Nat).\n m mod' X_n = makePartial a =\n (EX (r :: X_Int).\n  m = (X_n *' r) +' (X_gn_inj :: X_Nat => X_Int) a &\n  a <'' abs'(X_n))\"\n\ndistr1_Int [rule_format] :\n\"ALL (r :: X_Int).\n ALL (s :: X_Int).\n ALL (t :: X_Int). (r +' s) *' t = (r *' t) +' (s *' t)\"\n\ndistr2_Int [rule_format] :\n\"ALL (r :: X_Int).\n ALL (s :: X_Int).\n ALL (t :: X_Int). t *' (r +' s) = (t *' r) +' (t *' s)\"\n\nInt_Nat_sub_compat [rule_format] :\n\"ALL (a :: X_Nat).\n ALL (b :: X_Nat).\n defOp (a -? b) -->\n restrictOp\n (makePartial ((X_gn_inj :: X_Nat => X_Int) (makeTotal (a -? b))))\n (defOp (a -? b)) =\n makePartial (a -'' b)\"\n\nabs_decomp_Int [rule_format] :\n\"ALL (m :: X_Int).\n m = sign(m) *' (X_gn_inj :: X_Nat => X_Int) (abs'(m))\"\n\nmod_abs_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n m mod' X_n = m mod' (X_gn_inj :: X_Nat => X_Int) (abs'(X_n))\"\n\ndiv_mod_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n ~ X_n = (X_gn_inj :: X_Nat => X_Int) 0'' -->\n makePartial m =\n restrictOp\n (makePartial\n  ((makeTotal (m div' X_n) *' X_n) +'\n   (X_gn_inj :: X_Nat => X_Int) (makeTotal (m mod' X_n))))\n (defOp (m div' X_n) & defOp (m mod' X_n))\"\n\nquot_abs_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n restrictOp\n (makePartial\n  ((X_gn_inj :: X_Nat => X_Int) (abs'(makeTotal (m quot' X_n)))))\n (defOp (m quot' X_n)) =\n (X_gn_inj :: X_Nat => X_Int) (abs'(m)) quot'\n (X_gn_inj :: X_Nat => X_Int) (abs'(X_n))\"\n\nrem_abs_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n restrictOp\n (makePartial\n  ((X_gn_inj :: X_Nat => X_Int) (abs'(makeTotal (m rem' X_n)))))\n (defOp (m rem' X_n)) =\n (X_gn_inj :: X_Nat => X_Int) (abs'(m)) rem'\n (X_gn_inj :: X_Nat => X_Int) (abs'(X_n))\"\n\nquot_rem_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (X_n :: X_Int).\n ~ X_n = (X_gn_inj :: X_Nat => X_Int) 0'' -->\n makePartial m =\n restrictOp\n (makePartial\n  ((makeTotal (m quot' X_n) *' X_n) +' makeTotal (m rem' X_n)))\n (defOp (m quot' X_n) & defOp (m rem' X_n))\"\n\npower_Int [rule_format] :\n\"ALL (m :: X_Int).\n ALL (a :: X_Nat).\n ALL (b :: X_Nat). m ^' (a +'' b) = (m ^' a) *' (m ^' b)\"\n\nga_generated_Rat [rule_format] :\n\"ALL (p_Rat :: Rat => bool).\n (ALL (x_1 :: X_Int). ALL (x_2 :: Pos). p_Rat (x_1 /' x_2)) -->\n (ALL (x :: Rat). p_Rat x)\"\n\nequality_Rat [rule_format] :\n\"ALL (i :: X_Int).\n ALL (j :: X_Int).\n ALL (p :: Pos).\n ALL (q :: Pos).\n i /' p = j /' q =\n (i *' (X_gn_inj :: Pos => X_Int) q =\n  j *' (X_gn_inj :: Pos => X_Int) p)\"\n\nInt2Rat_embedding [rule_format] :\n\"ALL (i :: X_Int). (X_gn_inj :: X_Int => Rat) i = i /' 1_3\"\n\nga_comm___XPlus___139 [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). x +_5 y = y +_5 x\"\n\nga_assoc___XPlus___135 [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat). ALL (z :: Rat). (x +_5 y) +_5 z = x +_5 (y +_5 z)\"\n\nga_right_unit___XPlus___149 [rule_format] :\n\"ALL (x :: Rat). x +_5 (X_gn_inj :: X_Nat => Rat) 0'' = x\"\n\nga_left_unit___XPlus___147 [rule_format] :\n\"ALL (x :: Rat). (X_gn_inj :: X_Nat => Rat) 0'' +_5 x = x\"\n\nga_left_comm___XPlus___143 [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat). ALL (z :: Rat). x +_5 (y +_5 z) = y +_5 (x +_5 z)\"\n\nga_comm___Xx___138 [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). x *_4 y = y *_4 x\"\n\nga_assoc___Xx___134 [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat). ALL (z :: Rat). (x *_4 y) *_4 z = x *_4 (y *_4 z)\"\n\nga_right_unit___Xx___148 [rule_format] :\n\"ALL (x :: Rat). x *_4 (X_gn_inj :: Pos => Rat) 1_3 = x\"\n\nga_left_unit___Xx___146 [rule_format] :\n\"ALL (x :: Rat). (X_gn_inj :: Pos => Rat) 1_3 *_4 x = x\"\n\nga_left_comm___Xx___142 [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat). ALL (z :: Rat). x *_4 (y *_4 z) = y *_4 (x *_4 z)\"\n\nga_comm_min_141 [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). min_3(x, y) = min_3(y, x)\"\n\nga_comm_max_140 [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). max_3(x, y) = max_3(y, x)\"\n\nga_assoc_min_137 [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat).\n ALL (z :: Rat). min_3(min_3(x, y), z) = min_3(x, min_3(y, z))\"\n\nga_assoc_max_136 [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat).\n ALL (z :: Rat). max_3(max_3(x, y), z) = max_3(x, max_3(y, z))\"\n\nga_left_comm_min_145 [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat).\n ALL (z :: Rat). min_3(x, min_3(y, z)) = min_3(y, min_3(x, z))\"\n\nga_left_comm_max_144 [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat).\n ALL (z :: Rat). max_3(x, max_3(y, z)) = max_3(y, max_3(x, z))\"\n\nleq_def_Rat [rule_format] :\n\"ALL (p :: Pos).\n ALL (q :: Pos).\n ALL (i :: X_Int).\n ALL (j :: X_Int).\n (i /' p <=_3 j /' q) =\n (i *' (X_gn_inj :: Pos => X_Int) q <='\n  j *' (X_gn_inj :: Pos => X_Int) p)\"\n\ngeq_def_Rat [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). (x >=_3 y) = (y <=_3 x)\"\n\nless_def_Rat [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). (x <_3 y) = (x <=_3 y & ~ x = y)\"\n\ngreater_def_Rat [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). (x >_3 y) = (y <_3 x)\"\n\nminus_def_Rat [rule_format] :\n\"ALL (p :: Pos). ALL (i :: X_Int). -'' (i /' p) = -' i /' p\"\n\nabs_def_Rat [rule_format] :\n\"ALL (p :: Pos).\n ALL (i :: X_Int).\n abs''(i /' p) = (X_gn_inj :: X_Nat => X_Int) (abs'(i)) /' p\"\n\nadd_def_Rat [rule_format] :\n\"ALL (p :: Pos).\n ALL (q :: Pos).\n ALL (i :: X_Int).\n ALL (j :: X_Int).\n (i /' p) +_5 (j /' q) =\n ((i *' (X_gn_inj :: Pos => X_Int) q) +'\n  (j *' (X_gn_inj :: Pos => X_Int) p))\n /' (p *_3 q)\"\n\nsub_def_Rat [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). x -_3 y = x +_5 -'' y\"\n\nmult_def_Rat [rule_format] :\n\"ALL (p :: Pos).\n ALL (q :: Pos).\n ALL (i :: X_Int).\n ALL (j :: X_Int). (i /' p) *_4 (j /' q) = (i *' j) /' (p *_3 q)\"\n\nmin_def_Rat [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat). min_3(x, y) = (if x <=_3 y then x else y)\"\n\nmax_def_Rat [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat). max_3(x, y) = (if x <=_3 y then y else x)\"\n\ndivide_def1_Rat [rule_format] :\n\"ALL (x :: Rat). ~ defOp (x /'' (X_gn_inj :: X_Nat => Rat) 0'')\"\n\ndivide_def2_Rat [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat).\n ALL (z :: Rat).\n ~ y = (X_gn_inj :: X_Nat => Rat) 0'' -->\n x /'' y = makePartial z = (x = z *_4 y)\"\n\npower_0_Rat [rule_format] :\n\"ALL (x :: Rat).\n x ^_3 (X_gn_inj :: X_Nat => X_Int) 0'' =\n makePartial ((X_gn_inj :: Pos => Rat) 1_3)\"\n\npower_suc_Rat [rule_format] :\n\"ALL (X_n :: X_Nat).\n ALL (x :: Rat).\n x ^_3 (X_gn_inj :: Pos => X_Int) (suc''(X_n)) =\n restrictOp\n (makePartial\n  (x *_4 makeTotal (x ^_3 (X_gn_inj :: X_Nat => X_Int) X_n)))\n (defOp (x ^_3 (X_gn_inj :: X_Nat => X_Int) X_n))\"\n\npower_neg_Rat [rule_format] :\n\"ALL (p :: Pos).\n ALL (x :: Rat).\n x ^_3 -' (X_gn_inj :: Pos => X_Int) p =\n restrictOp\n ((X_gn_inj :: Pos => Rat) 1_3 /''\n  makeTotal (x ^_3 (X_gn_inj :: Pos => X_Int) p))\n (defOp (x ^_3 (X_gn_inj :: Pos => X_Int) p))\"\n\ndistr1_Rat [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat).\n ALL (z :: Rat). (x +_5 y) *_4 z = (x *_4 z) +_5 (y *_4 z)\"\n\ndistr2_Rat [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat).\n ALL (z :: Rat). z *_4 (x +_5 y) = (z *_4 x) +_5 (z *_4 y)\"\n\nsub_rule_Rat [rule_format] :\n\"ALL (i :: X_Int).\n ALL (j :: X_Int).\n ALL (p :: Pos).\n ALL (q :: Pos).\n (i /' p) -_3 (j /' q) =\n ((i *' (X_gn_inj :: Pos => X_Int) q) -'\n  (j *' (X_gn_inj :: Pos => X_Int) p))\n /' (p *_3 q)\"\n\ndivide_dom_Rat [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat).\n defOp (x /'' y) = (~ y = (X_gn_inj :: X_Nat => Rat) 0'')\"\n\ndivide_rule_Rat [rule_format] :\n\"ALL (i :: X_Int).\n ALL (j :: X_Int).\n ALL (p :: Pos).\n ALL (q :: Pos).\n ~ j = (X_gn_inj :: X_Nat => X_Int) 0'' -->\n (i /' p) /'' (j /' q) =\n (X_gn_inj :: X_Int => Rat) (i *' (X_gn_inj :: Pos => X_Int) q) /''\n (X_gn_inj :: X_Int => Rat) ((X_gn_inj :: Pos => X_Int) p *' j)\"\n\npower_Rat [rule_format] :\n\"ALL (i :: X_Int).\n ALL (j :: X_Int).\n ALL (x :: Rat).\n x ^_3 (i +' j) =\n restrictOp\n (makePartial (makeTotal (x ^_3 i) *_4 makeTotal (x ^_3 j)))\n (defOp (x ^_3 i) & defOp (x ^_3 j))\"\n\nAbsSignumLaw [rule_format] :\n\"ALL (x :: 'a). abs_3(x) *_5 signum(x) = x\"\n\nIPN01 [rule_format] :\n\"ALL (x :: Pos).\n ALL (y :: Pos).\n (X_gn_inj :: Pos => X_Int) x +' (X_gn_inj :: Pos => X_Int) y =\n (X_gn_inj :: X_Nat => X_Int)\n ((X_gn_inj :: Pos => X_Nat) x +'' (X_gn_inj :: Pos => X_Nat) y)\"\n\nIPN02 [rule_format] :\n\"ALL (x :: Pos).\n ALL (y :: Pos).\n (X_gn_inj :: Pos => X_Int) x *' (X_gn_inj :: Pos => X_Int) y =\n (X_gn_inj :: X_Nat => X_Int)\n ((X_gn_inj :: Pos => X_Nat) x *'' (X_gn_inj :: Pos => X_Nat) y)\"\n\nIPN03 [rule_format] :\n\"ALL (x :: Pos).\n ALL (y :: Pos).\n (X_gn_inj :: Pos => X_Int) x -' (X_gn_inj :: Pos => X_Int) y =\n (X_gn_inj :: X_Nat => X_Int)\n ((X_gn_inj :: Pos => X_Nat) x -! (X_gn_inj :: Pos => X_Nat) y)\"\n\nIPN04 [rule_format] :\n\"ALL (x :: Pos).\n (X_gn_inj :: Pos => X_Nat) (negate(x)) =\n 0'' -! (X_gn_inj :: Pos => X_Nat) x\"\n\nIPN05 [rule_format] : \"ALL (x :: Pos). abs_3(x) = x\"\n\nIPN06 [rule_format] : \"ALL (x :: Pos). signum(x) = 1_3\"\n\nIPN07 [rule_format] :\n\"ALL (z :: X_Int).\n makePartial (fromInteger(z)) =\n (X_gn_proj :: X_Int => Pos partial) z\"\n\nINN01 [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n (X_gn_inj :: X_Nat => X_Int) x +' (X_gn_inj :: X_Nat => X_Int) y =\n (X_gn_inj :: X_Nat => X_Int) (x +'' y)\"\n\nINN02 [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n (X_gn_inj :: X_Nat => X_Int) x *' (X_gn_inj :: X_Nat => X_Int) y =\n (X_gn_inj :: X_Nat => X_Int) (x *'' y)\"\n\nINN03 [rule_format] :\n\"ALL (x :: X_Nat).\n ALL (y :: X_Nat).\n (X_gn_inj :: X_Nat => X_Int) x -' (X_gn_inj :: X_Nat => X_Int) y =\n (X_gn_inj :: X_Nat => X_Int) (x -! y)\"\n\nINN04 [rule_format] : \"ALL (x :: X_Nat). negate(x) = 0'' -! x\"\n\nINN05 [rule_format] : \"ALL (x :: X_Nat). abs_3(x) = x\"\n\nINN06 [rule_format] :\n\"ALL (x :: X_Nat). signum(x) = (X_gn_inj :: Pos => X_Nat) 1_3\"\n\nINN07 [rule_format] :\n\"ALL (z :: X_Int).\n makePartial (fromInteger(z)) =\n (X_gn_proj :: X_Int => X_Nat partial) z\"\n\nIIN01 [rule_format] :\n\"ALL (x :: X_Int). ALL (y :: X_Int). x +' y = x +' y\"\n\nIIN02 [rule_format] :\n\"ALL (x :: X_Int). ALL (y :: X_Int). x *' y = x *' y\"\n\nIIN03 [rule_format] :\n\"ALL (x :: X_Int). ALL (y :: X_Int). x -' y = x -' y\"\n\nIIN04 [rule_format] :\n\"ALL (x :: X_Int).\n negate(x) = (X_gn_inj :: X_Nat => X_Int) 0'' -' x\"\n\nIIN05 [rule_format] :\n\"ALL (x :: X_Int).\n x >=_4 (X_gn_inj :: X_Nat => X_Int) 0'' = True' --> abs_3(x) = x\"\n\nIIN06 [rule_format] :\n\"ALL (x :: X_Int).\n x <_4 (X_gn_inj :: X_Nat => X_Int) 0'' = True' -->\n abs_3(x) = negate(x)\"\n\nIIN07 [rule_format] :\n\"ALL (x :: X_Int).\n x >_4 (X_gn_inj :: X_Nat => X_Int) 0'' = True' -->\n signum(x) = (X_gn_inj :: Pos => X_Int) 1_3\"\n\nIIN07_1 [rule_format] :\n\"ALL (x :: X_Int).\n x ==' (X_gn_inj :: X_Nat => X_Int) 0'' = True' -->\n signum(x) = (X_gn_inj :: X_Nat => X_Int) 0''\"\n\nIIN08 [rule_format] :\n\"ALL (x :: X_Int).\n x <_4 (X_gn_inj :: X_Nat => X_Int) 0'' = True' -->\n signum(x) = -' (X_gn_inj :: Pos => X_Int) 1_3\"\n\nIIN09 [rule_format] : \"ALL (x :: X_Int). fromInteger(x) = x\"\n\nIRN01 [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). x +_5 y = x +_5 y\"\n\nIRN02 [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). x *_4 y = x *_4 y\"\n\nIRN03 [rule_format] :\n\"ALL (x :: Rat). ALL (y :: Rat). x -_3 y = x -_3 y\"\n\nIRN04 [rule_format] :\n\"ALL (x :: Rat). negate(x) = (X_gn_inj :: X_Nat => Rat) 0'' -_3 x\"\n\nIRN05 [rule_format] :\n\"ALL (x :: Rat).\n x >=_4 (X_gn_inj :: X_Nat => Rat) 0'' = True' --> abs_3(x) = x\"\n\nIRN06 [rule_format] :\n\"ALL (x :: Rat).\n x <_4 (X_gn_inj :: X_Nat => Rat) 0'' = True' -->\n abs_3(x) = negate(x)\"\n\nIRN07 [rule_format] :\n\"ALL (x :: Rat).\n x >_4 (X_gn_inj :: X_Nat => Rat) 0'' = True' -->\n signum(x) = (X_gn_inj :: Pos => Rat) 1_3\"\n\nIRN07_2 [rule_format] :\n\"ALL (x :: Rat).\n x ==' (X_gn_inj :: X_Nat => Rat) 0'' = True' -->\n signum(x) = (X_gn_inj :: X_Nat => Rat) 0''\"\n\nIRN08 [rule_format] :\n\"ALL (x :: Rat).\n x <_4 (X_gn_inj :: X_Nat => Rat) 0'' = True' -->\n signum(x) =\n (X_gn_inj :: X_Int => Rat) (-' (X_gn_inj :: Pos => X_Int) 1_3)\"\n\nIRN09 [rule_format] : \"ALL (z :: X_Int). fromInteger(z) = z /' 1_3\"\n\nIRI01 [rule_format] :\n\"ALL (w :: 'a).\n ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a). (z, w) = quotRem x y --> x quot'' y = z\"\n\nIRI02 [rule_format] :\n\"ALL (w :: 'a).\n ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a). (z, w) = quotRem x y --> x rem'' y = w\"\n\nIRI03 [rule_format] :\n\"ALL (w :: 'a).\n ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a). (z, w) = divMod x y --> x div_3 y = z\"\n\nIRI04 [rule_format] :\n\"ALL (w :: 'a).\n ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a). (z, w) = divMod x y --> x mod_3 y = w\"\n\nIRI05 [rule_format] :\n\"ALL (s :: 'a).\n ALL (w :: 'a).\n ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n signum(w) = negate(signum(y)) & (z, w) = quotRem x y -->\n divMod x y =\n (z -_4 fromInteger(toInteger((X_gn_inj :: Pos => X_Nat) 1_3)),\n  w +_6 s)\"\n\nIRI06 [rule_format] :\n\"ALL (w :: 'a).\n ALL (x :: 'a).\n ALL (y :: 'a).\n ALL (z :: 'a).\n ~ signum(w) = negate(signum(y)) & (z, w) = quotRem x y -->\n divMod x y = (z, w)\"\n\nIRI01_3 [rule_format] :\n\"ALL (x :: X_Int).\n makePartial ((X_gn_inj :: X_Int => Rat) (recip(x))) =\n (X_gn_inj :: Pos => Rat) 1_3 /'' (X_gn_inj :: X_Int => Rat) x\"\n\nIRI02_4 [rule_format] :\n\"ALL (x :: X_Int).\n ALL (y :: X_Int).\n (X_gn_inj :: X_Int => Rat) x /'' (X_gn_inj :: X_Int => Rat) y =\n makePartial ((X_gn_inj :: X_Int => Rat) (x *' recip(y)))\"\n\nIRF01 [rule_format] :\n\"ALL (x :: Rat).\n makePartial (recip(x)) = (X_gn_inj :: Pos => Rat) 1_3 /'' x\"\n\nIRF02 [rule_format] :\n\"ALL (x :: Rat).\n ALL (y :: Rat). x /'' y = makePartial (x *_4 recip(y))\"\n\nLengthNil [rule_format] :\n\"length'(Nil') = (X_gn_inj :: X_Nat => X_Int) 0''\"\n\nLengthCons [rule_format] :\n\"ALL (x :: 'a).\n ALL (xs :: 'a List).\n length'(X_Cons x xs) =\n length'(xs) +' (X_gn_inj :: Pos => X_Int) 1_3\"\n\nTakeNegative [rule_format] :\n\"ALL (X_n :: X_Int).\n ALL (xs :: 'a List).\n (X_gn_inj :: X_Int => Rat) X_n <=_3\n (X_gn_inj :: X_Nat => Rat) 0'' -->\n X_take X_n xs = Nil'\"\n\nTakeNil [rule_format] :\n\"ALL (X_n :: X_Int). X_take X_n Nil' = Nil'\"\n\nTakeCons [rule_format] :\n\"ALL (X_n :: X_Int).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n X_take X_n (X_Cons x xs) =\n X_Cons x (X_take (X_n -' (X_gn_inj :: Pos => X_Int) 1_3) xs)\"\n\nDropNegative [rule_format] :\n\"ALL (X_n :: X_Int).\n ALL (xs :: 'a List).\n (X_gn_inj :: X_Int => Rat) X_n <=_3\n (X_gn_inj :: X_Nat => Rat) 0'' -->\n X_drop X_n xs = xs\"\n\nDropNil [rule_format] :\n\"ALL (X_n :: X_Int). X_drop X_n Nil' = Nil'\"\n\nDropCons [rule_format] :\n\"ALL (X_n :: X_Int).\n ALL (x :: 'a).\n ALL (xs :: 'a List).\n X_drop X_n (X_Cons x xs) =\n X_drop (X_n -' (X_gn_inj :: Pos => X_Int) 1_3) xs\"\n\nSplitAt [rule_format] :\n\"ALL (X_n :: X_Int).\n ALL (xs :: 'a List).\n splitAt X_n xs = (X_take X_n xs, X_drop X_n xs)\"\n\nSum'Nil [rule_format] : \"ALL (z :: X_Int). sum' Nil' z = z\"\n\nSum'Cons [rule_format] :\n\"ALL (w :: X_Int).\n ALL (z :: X_Int).\n ALL (zs :: X_Int List). sum' (X_Cons z zs) w = sum' zs (w +_6 z)\"\n\nSumL [rule_format] :\n\"ALL (zs :: X_Int List).\n sum(zs) = sum' zs ((X_gn_inj :: X_Nat => X_Int) 0'')\"\n\nProd'Nil [rule_format] : \"ALL (z :: X_Int). product' Nil' z = z\"\n\nProd'Cons [rule_format] :\n\"ALL (w :: X_Int).\n ALL (z :: X_Int).\n ALL (zs :: X_Int List).\n product' (X_Cons z zs) w = product' zs (w *_5 z)\"\n\nProdL [rule_format] :\n\"ALL (zs :: X_Int List).\n product(zs) = product' zs ((X_gn_inj :: Pos => X_Int) 1_3)\"\n\ndeclare ga_subt_reflexive [simp]\ndeclare ga_subt_Int_XLt_Rat [simp]\ndeclare ga_subt_Nat_XLt_Int [simp]\ndeclare ga_subt_Pos_XLt_Nat [simp]\ndeclare Comp1 [simp]\ndeclare IdDef [simp]\ndeclare FlipDef [simp]\ndeclare FstDef [simp]\ndeclare SndDef [simp]\ndeclare CurryDef [simp]\ndeclare UncurryDef [simp]\ndeclare NotFalse [simp]\ndeclare NotTrue [simp]\ndeclare AndFalse [simp]\ndeclare AndTrue [simp]\ndeclare EqualReflex [simp]\ndeclare IBE1 [simp]\ndeclare IBE2 [simp]\ndeclare IBE3 [simp]\ndeclare IBE4 [simp]\ndeclare IBE5 [simp]\ndeclare IBE6 [simp]\ndeclare IBE7 [simp]\ndeclare IBE8 [simp]\ndeclare IOE01 [simp]\ndeclare IOE02 [simp]\ndeclare IOE03 [simp]\ndeclare IOE04 [simp]\ndeclare IOE05 [simp]\ndeclare IOE06 [simp]\ndeclare IOE07 [simp]\ndeclare IOE08 [simp]\ndeclare IOE09 [simp]\ndeclare LeIrreflexivity [simp]\ndeclare LeTAsymmetry [simp]\ndeclare GeIrreflexivity [simp]\ndeclare GeTAsymmetry [simp]\ndeclare GeTTransitive [simp]\ndeclare GeTTotal [simp]\ndeclare LeqReflexivity [simp]\ndeclare LeqTTransitive [simp]\ndeclare LeqTTotal [simp]\ndeclare GeqReflexivity [simp]\ndeclare GeqTTransitive [simp]\ndeclare GeqTTotal [simp]\ndeclare CmpLTDef [simp]\ndeclare CmpEQDef [simp]\ndeclare CmpGTDef [simp]\ndeclare MaxYDef [simp]\ndeclare MaxXDef [simp]\ndeclare MinXDef [simp]\ndeclare MinYDef [simp]\ndeclare TO4 [simp]\ndeclare IOO13 [simp]\ndeclare IOO14 [simp]\ndeclare IOO15 [simp]\ndeclare IOO16 [simp]\ndeclare IOO17 [simp]\ndeclare IOO18 [simp]\ndeclare IOO19 [simp]\ndeclare IOO20 [simp]\ndeclare IOO21 [simp]\ndeclare IOO22 [simp]\ndeclare IOO23 [simp]\ndeclare IOO24 [simp]\ndeclare IOO25 [simp]\ndeclare IOO26 [simp]\ndeclare IOO27 [simp]\ndeclare IOO28 [simp]\ndeclare IOO29 [simp]\ndeclare IOO30 [simp]\ndeclare IOO31 [simp]\ndeclare IOO32 [simp]\ndeclare IOO33 [simp]\ndeclare IBO5 [simp]\ndeclare IBO6 [simp]\ndeclare IBO7 [simp]\ndeclare IBO8 [simp]\ndeclare IBO9 [simp]\ndeclare IBO10 [simp]\ndeclare IBO11 [simp]\ndeclare IBO12 [simp]\ndeclare IUO05 [simp]\ndeclare IUO06 [simp]\ndeclare IUO07 [simp]\ndeclare NotDefHead [simp]\ndeclare HeadDef [simp]\ndeclare NotDefTail [simp]\ndeclare TailDef [simp]\ndeclare FoldrNil [simp]\ndeclare FoldlNil [simp]\ndeclare MapNil [simp]\ndeclare XPlusXPlusNil [simp]\ndeclare FilterNil [simp]\ndeclare FilterConsF [simp]\ndeclare ZipNil [simp]\ndeclare ILE01 [simp]\ndeclare ILO01 [simp]\ndeclare ILO02 [simp]\ndeclare ILO03 [simp]\ndeclare ILO04 [simp]\ndeclare ILO05 [simp]\ndeclare ILO06 [simp]\ndeclare ILO11 [simp]\ndeclare ILO12 [simp]\ndeclare ILO13 [simp]\ndeclare ILO14 [simp]\ndeclare ILO15 [simp]\ndeclare ILO16 [simp]\ndeclare ILO17 [simp]\ndeclare ILO18 [simp]\ndeclare InitNil [simp]\ndeclare InitConsNil [simp]\ndeclare LastNil [simp]\ndeclare LastConsNil [simp]\ndeclare LastConsCons [simp]\ndeclare NullNil [simp]\ndeclare NullCons [simp]\ndeclare ReverseNil [simp]\ndeclare Foldr1Nil [simp]\ndeclare Foldr1ConsNil [simp]\ndeclare Foldl1Nil [simp]\ndeclare Foldl1ConsNil [simp]\ndeclare Scanl1Nil [simp]\ndeclare Scanl1Cons [simp]\ndeclare ScanrNil [simp]\ndeclare Scanr1Nil [simp]\ndeclare Scanr1ConsNil [simp]\ndeclare ScanlProperty [simp]\ndeclare ScanrProperty [simp]\ndeclare AndLNil [simp]\ndeclare OrLNil [simp]\ndeclare MaximunNil [simp]\ndeclare MinimunNil [simp]\ndeclare TakeWhileNil [simp]\ndeclare TakeWhileConsF [simp]\ndeclare DropWhileNil [simp]\ndeclare DropWhileConsT [simp]\ndeclare DropWhileConsF [simp]\ndeclare SpanNil [simp]\ndeclare DeleteNil [simp]\ndeclare DeleteConsT [simp]\ndeclare SelectT [simp]\ndeclare SelectF [simp]\ndeclare ga_selector_pre [simp]\ndeclare ga_selector_undef_pre_0 [simp]\ndeclare ga_comm___XPlus__ [simp]\ndeclare ga_assoc___XPlus__ [simp]\ndeclare ga_right_unit___XPlus__ [simp]\ndeclare ga_left_unit___XPlus__ [simp]\ndeclare ga_left_comm___XPlus__ [simp]\ndeclare ga_comm___Xx__ [simp]\ndeclare ga_assoc___Xx__ [simp]\ndeclare ga_right_unit___Xx__ [simp]\ndeclare ga_left_unit___Xx__ [simp]\ndeclare ga_left_comm___Xx__ [simp]\ndeclare ga_comm_min [simp]\ndeclare ga_assoc_min [simp]\ndeclare ga_left_comm_min [simp]\ndeclare ga_comm_max [simp]\ndeclare ga_assoc_max [simp]\ndeclare ga_right_unit_max [simp]\ndeclare ga_left_unit_max [simp]\ndeclare ga_left_comm_max [simp]\ndeclare leq_def1_Nat [simp]\ndeclare dvd_def_Nat [simp]\ndeclare leq_def2_Nat [simp]\ndeclare leq_def3_Nat [simp]\ndeclare geq_def_Nat [simp]\ndeclare less_def_Nat [simp]\ndeclare greater_def_Nat [simp]\ndeclare even_0_Nat [simp]\ndeclare even_suc_Nat [simp]\ndeclare odd_def_Nat [simp]\ndeclare factorial_0 [simp]\ndeclare factorial_suc [simp]\ndeclare add_0_Nat [simp]\ndeclare add_suc_Nat [simp]\ndeclare mult_0_Nat [simp]\ndeclare mult_suc_Nat [simp]\ndeclare power_0_Nat [simp]\ndeclare power_suc_Nat [simp]\ndeclare subTotal_def1_Nat [simp]\ndeclare subTotal_def2_Nat [simp]\ndeclare sub_dom_Nat [simp]\ndeclare divide_0_Nat [simp]\ndeclare min_0 [simp]\ndeclare ga_comm___XPlus___80 [simp]\ndeclare ga_assoc___XPlus___76 [simp]\ndeclare ga_right_unit___XPlus___90 [simp]\ndeclare ga_left_unit___XPlus___88 [simp]\ndeclare ga_left_comm___XPlus___84 [simp]\ndeclare ga_comm___Xx___79 [simp]\ndeclare ga_assoc___Xx___75 [simp]\ndeclare ga_right_unit___Xx___89 [simp]\ndeclare ga_left_unit___Xx___87 [simp]\ndeclare ga_left_comm___Xx___83 [simp]\ndeclare ga_comm_min_82 [simp]\ndeclare ga_comm_max_81 [simp]\ndeclare ga_assoc_min_78 [simp]\ndeclare ga_assoc_max_77 [simp]\ndeclare ga_left_comm_min_86 [simp]\ndeclare ga_left_comm_max_85 [simp]\ndeclare leq_def_Int [simp]\ndeclare even_def_Int [simp]\ndeclare odd_alt_Int [simp]\ndeclare neg_def_Int [simp]\ndeclare sign_def_Int [simp]\ndeclare abs_def_Int [simp]\ndeclare add_def_Int [simp]\ndeclare mult_def_Int [simp]\ndeclare sub_def_Int [simp]\ndeclare min_def_Int [simp]\ndeclare max_def_Int [simp]\ndeclare power_neg1_Int [simp]\ndeclare power_others_Int [simp]\ndeclare divide_Int [simp]\ndeclare div_Int [simp]\ndeclare quot_neg_Int [simp]\ndeclare quot_nonneg_Int [simp]\ndeclare rem_neg_Int [simp]\ndeclare rem_nonneg_Int [simp]\ndeclare mod_Int [simp]\ndeclare Int_Nat_sub_compat [simp]\ndeclare quot_abs_Int [simp]\ndeclare rem_abs_Int [simp]\ndeclare ga_comm___XPlus___139 [simp]\ndeclare ga_assoc___XPlus___135 [simp]\ndeclare ga_right_unit___XPlus___149 [simp]\ndeclare ga_left_unit___XPlus___147 [simp]\ndeclare ga_left_comm___XPlus___143 [simp]\ndeclare ga_comm___Xx___138 [simp]\ndeclare ga_assoc___Xx___134 [simp]\ndeclare ga_right_unit___Xx___148 [simp]\ndeclare ga_left_unit___Xx___146 [simp]\ndeclare ga_left_comm___Xx___142 [simp]\ndeclare ga_comm_min_141 [simp]\ndeclare ga_comm_max_140 [simp]\ndeclare ga_assoc_min_137 [simp]\ndeclare ga_assoc_max_136 [simp]\ndeclare ga_left_comm_min_145 [simp]\ndeclare ga_left_comm_max_144 [simp]\ndeclare divide_def1_Rat [simp]\ndeclare power_0_Rat [simp]\ndeclare AbsSignumLaw [simp]\ndeclare IPN05 [simp]\ndeclare IPN06 [simp]\ndeclare IPN07 [simp]\ndeclare INN01 [simp]\ndeclare INN02 [simp]\ndeclare INN03 [simp]\ndeclare INN05 [simp]\ndeclare INN07 [simp]\ndeclare IIN05 [simp]\ndeclare IIN09 [simp]\ndeclare IRN05 [simp]\ndeclare TakeNegative [simp]\ndeclare TakeNil [simp]\ndeclare DropNegative [simp]\ndeclare DropNil [simp]\ndeclare Sum'Nil [simp]\ndeclare Prod'Nil [simp]\n\ntheorem LengthNil1 :\n\"ALL (xs :: 'a List).\n length'(xs) = (X_gn_inj :: X_Nat => X_Int) 0'' = (xs = Nil')\"\napply(auto)\napply(case_tac xs)\napply(auto)\napply(simp add: LengthCons)\noops\n\nsetup \"Header.record \\\"LengthNil1\\\"\"\n\ntheorem LengthEqualNil :\n\"ALL (ys :: 'b List). length'(Nil') = length'(ys) --> ys = Nil'\"\napply(auto)\napply(simp add: LengthNil)\noops\n\nsetup \"Header.record \\\"LengthEqualNil\\\"\"\n\ntheorem LengthEqualCons :\n\"ALL (x :: 'a).\n ALL (xs :: 'a List).\n ALL (y :: 'b).\n ALL (ys :: 'b List).\n length'(X_Cons x xs) = length'(X_Cons y ys) -->\n length'(xs) = length'(ys)\"\napply(auto)\napply(simp add: LengthCons)\noops\n\nsetup \"Header.record \\\"LengthEqualCons\\\"\"\n\ntheorem ZipSpec :\n\"ALL (xs :: 'a List).\n ALL (ys :: 'b List).\n length'(xs) = length'(ys) --> unzip(X_zip xs ys) = (xs, ys)\"\napply(auto)\napply(induct_tac xs, induct_tac ys)\napply(auto)\noops\n\nsetup \"Header.record \\\"ZipSpec\\\"\"\n\nend\n", "meta": {"author": "glaubersp", "repo": "HasCASL-Library_Source", "sha": "be605b06acfc124d8e88829cc931a1148ea30460", "save_path": "github-repos/isabelle/glaubersp-HasCASL-Library_Source", "path": "github-repos/isabelle/glaubersp-HasCASL-Library_Source/HasCASL-Library_Source-be605b06acfc124d8e88829cc931a1148ea30460/Prelude.Strict/Prelude_ListWithNumbers__RE1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6619228758499941, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.33871692660597574}}
{"text": "theory Bottom_Up_Computation_Heap\n  imports \"../state_monad/Bottom_Up_Computation\" \"../heap_monad/DP_CRelVH\"\nbegin\n\ndefinition (in iterator_defs)\n  \"iter_heap f \\<equiv>\n    wfrec\n      {(nxt x, x) | x. cnt x}\n      (\\<lambda> rec x. if cnt x then do {f x; rec (nxt x)} else return ())\"\n\nlemma (in iterator) iter_heap_unfold:\n  \"iter_heap f x = (if cnt x then do {f x; iter_heap f (nxt x)} else return ())\"\n  unfolding iter_heap_def\n  by (simp add: wfrec_fixpoint[OF iterator.wellfounded,OF iterator.intro,OF terminating] adm_wf_def)\n\nlocale dp_consistency_iterator_heap =\n  dp_consistency_heap P update lookup dp + iterator cnt nxt sizef\n  for lookup :: \"'a \\<Rightarrow> ('c option) Heap\" and update and P dp\n    and cnt :: \"'a \\<Rightarrow> bool\" and nxt and sizef\nbegin\n\ncontext\n  includes lifting_syntax\nbegin\n\nterm iter_heap\n\nterm crel_vs\n\nlemma crel_vs_iterate_state:\n  \"crel_vs (=) () (iter_heap f x)\" if \"((=) ===> crel_vs R) g f\"\n  using wellfounded\nproof induction\n  case (less x)\n  have unit_expand: \"() = (\\<lambda> a f. f a) () (\\<lambda> _. ())\" ..\n  from less show ?case\n    by (subst iter_heap_unfold)\n       (auto intro:\n          bind_transfer[unfolded rel_fun_def, rule_format, unfolded unit_expand]\n          crel_vs_return_ext[unfolded Transfer.Rel_def] that[unfolded rel_fun_def, rule_format]\n       )\nqed\n\nlemma crel_vs_bind_ignore:\n  \"crel_vs R a (do {d; b})\" if \"crel_vs R a b\" \"crel_vs S c d\"\nproof -\n  have unit_expand: \"a = (\\<lambda> a f. f a) () (\\<lambda> _. a)\" ..\n  show ?thesis\n    by (subst unit_expand)\n       (rule bind_transfer[unfolded rel_fun_def, rule_format, unfolded unit_expand] that)+\nqed\n\nlemma crel_vs_iter_and_compute:\n  assumes \"((=) ===> crel_vs R) g f\"\n  shows \"crel_vs R (g x) (do {iter_heap f y; f x})\"\n  by (rule\n        crel_vs_bind_ignore crel_vs_iterate_state HOL.refl\n        assms[unfolded rel_fun_def, rule_format] assms\n     )+\n\nlemma consistent_DP_iter_and_compute:\n  assumes \"consistentDP f\"\n  shows \"consistentDP (\\<lambda> x. do {iter_heap f y; f x})\"\n  apply (rule consistentDP_intro)\n  using assms unfolding consistentDP_def Rel_def\n  by (rule crel_vs_iter_and_compute)\n\nend (* Lifting Syntax *)\n\nend (* DP Consistency Iterator Heap *)\n\nend (* Theory *)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Monad_Memo_DP/heap_monad/Bottom_Up_Computation_Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6619228625116081, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.33871691978050217}}
{"text": "section {* Soundness Theorems *}\n\ntheory Wasm_Soundness imports Main Wasm_Properties begin\n\ntheorem preservation:\n  assumes \"\\<turnstile>_i s;vs;es : ts\"\n          \"\\<lparr>s;vs;es\\<rparr> \\<leadsto>_i \\<lparr>s';vs';es'\\<rparr>\"\n  shows \"\\<turnstile>_i s';vs';es' : ts\"\nproof -\n  have \"store_typing s\" \"s\\<bullet>None \\<tturnstile>_i vs;es : ts\"\n    using assms(1) config_typing.simps\n    by blast+\n  hence \"store_typing s'\" \"s'\\<bullet>None \\<tturnstile>_i vs';es' : ts\"\n    using assms(2)\n          store_preserved\n          types_preserved_e\n    by blast+\n  thus ?thesis\n    using config_typing.intros\n    by blast\nqed\n\ntheorem progress:\n  assumes \"\\<turnstile>_i s;vs;es : ts\"\n  shows \"const_list es \\<or> es = [Trap] \\<or> (\\<exists>a s' vs' es'. \\<lparr>s;vs;es\\<rparr> \\<leadsto>_i \\<lparr>s';vs';es'\\<rparr>)\"\nproof -\n  have \"store_typing s\" \"s\\<bullet>None \\<tturnstile>_i vs;es : ts\"\n    using assms config_typing.simps\n    by blast+\n  thus ?thesis\n    using progress_e3\n    by blast\nqed\n\nend", "meta": {"author": "conrad-watt", "repo": "wasm-pl-isabelle", "sha": "265f292250c01770d50d4ecda998ed5961c6719e", "save_path": "github-repos/isabelle/conrad-watt-wasm-pl-isabelle", "path": "github-repos/isabelle/conrad-watt-wasm-pl-isabelle/wasm-pl-isabelle-265f292250c01770d50d4ecda998ed5961c6719e/WebAssembly/Wasm_Soundness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.661922862511608, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3387169197805021}}
{"text": "theory Coll_Test\nimports \n  Collections.Refine_Dflt \n  Succ_Graph\nbegin\n\ndeclare [[autoref_trace_failed_id]]\n\ncontext begin interpretation autoref_syn .\n\nschematic_goal \"(?c::?'c,\n  RETURN (({(1::nat,2::nat),(3,4)}):::(\\<langle>\\<langle>nat_rel,nat_rel\\<rangle>prod_rel\\<rangle>(map2set_rel (ahm_rel ?bhc))) )\n)\\<in>?R\"\n  apply autoref_monadic\n  done\n\nterm dflt_ahs_rel\n\nschematic_goal \"(?c::?'c, \\<lambda>(a::'a::hashable) (b::'a::hashable).\n  ({(a,b)}:::\\<langle>?Rk::(?'b::hashable\\<times>_) set\\<rangle>dflt_ahs_rel)\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nsubsection \"Foreach-Loops\"\nschematic_goal \"(?c::?'c,\n  FOREACH {1,2,3::nat} (\\<lambda>i s. RETURN (i+s)) 0\n)\\<in>?R\"\n  apply autoref_monadic\n  done\n\nschematic_goal \"(?c::?'c,\n  FOREACH (map_to_set [1::nat\\<mapsto>True, 2\\<mapsto>False]) (\\<lambda>(k,v) s. RETURN (k+s)) 0\n)\\<in>?R\"\n  apply autoref_monadic\n  done\n\n(* TODO: generic algorithm for bounded hash code of sets! *)\nschematic_goal \"(?c::?'c,\n  FOREACH \n    (map_to_set ([{1::nat}\\<mapsto>True, {2}\\<mapsto>False]:::\\<langle>\\<langle>nat_rel\\<rangle>dflt_rs_rel,bool_rel\\<rangle>(rbt_map_rel ?cmp))) \n    (\\<lambda>(k,v) s. RETURN (v\\<and>s)) False\n)\\<in>?R\"\n  apply autoref_monadic\n  done\n\nsubsection \"Array Hash Map Tests\"\n\nschematic_goal\n  \"(?f::?'c, \\<lambda>m. (m)(1::nat\\<mapsto>2::nat)) \\<in> ?R\"\n  apply (autoref (keep_goal))\n  done\n\n\nschematic_goal\n  \"(?f::?'c, \\<lambda>m. (m:::\\<langle>Id,Id\\<rangle>dflt_ahm_rel)(1::nat\\<mapsto>2::nat)) \\<in> ?R\"\napply (autoref (keep_goal))\ndone\n\nschematic_goal\n  \"(?f::?'c, Map.empty:::\\<langle>Id,Id\\<rangle>dflt_ahm_rel) \\<in> ?R\"\napply (autoref)\ndone\n\nschematic_goal\n  fixes mi m\n  (* TODO: Obviously, we cannot override the tyREL-rule for \n    \"nat\\<rightharpoonup>nat\" with this: *)\n  assumes [autoref_rules]: \"(mi,m)\\<in>\\<langle>nat_rel,nat_rel\\<rangle>dflt_ahm_rel\"\n  shows \"(?f::?'c, \n    RETURN (card (dom (m:::\\<langle>nat_rel,nat_rel\\<rangle>dflt_ahm_rel)))) \\<in> ?R\"\n  apply (autoref_monadic)\n  done\n\n(* Optimizations *)\n\nsubsection \"List Map Tests\"\n\ndefinition foo::\"(nat\\<rightharpoonup>nat) nres\" where \"foo \\<equiv>\n  do {\n    let X = Map.empty;\n    ASSERT (1 \\<notin> dom X);\n    RETURN (X(1 \\<mapsto> 2))\n  }\"\n\nschematic_goal list_map_update_dj_test:\n  \"(?f::?'c, foo ::: \\<langle>\\<langle>Id,Id\\<rangle>list_map_rel\\<rangle>nres_rel) \\<in> ?R\"\n  unfolding foo_def \n  apply autoref_monadic\n  done\n\nschematic_goal \n  \"(?f::?'c, [1::nat \\<mapsto> 2::nat, 3\\<mapsto>4] ::: \\<langle>nat_rel,nat_rel\\<rangle>list_map_rel) \\<in> ?R\"\n  apply autoref\n  done\n\nschematic_goal list_map_test:\n  \"(?f::?'c, RETURN (([1 \\<mapsto> 2, 3::nat \\<mapsto> 4::nat]\n       :::\\<langle>nat_rel,nat_rel\\<rangle>list_map_rel) |`(-{1}))) \\<in> ?R\"\napply (autoref_monadic)\ndone\nconcrete_definition list_map_test uses list_map_test\nvalue list_map_test\n\n(* Why does this work:*)\nschematic_goal\n  \"(?f::?'c, RETURN (card (dom ([1 \\<mapsto> 2, 3::nat \\<mapsto> 4::nat]\n       :::\\<langle>nat_rel,nat_rel\\<rangle>list_map_rel)))) \\<in> ?R\"\napply (autoref_monadic)\ndone\n\n(* But this doesn't? This is not specific to list_map;\n   it doesn't work with dflt_rbt_rel either.*)\n(*schematic_lemma\n  \"(?f::?'c, RETURN (dom ([1 \\<mapsto> 2, 3::nat \\<mapsto> 4::nat]\n       :::\\<langle>nat_rel,nat_rel\\<rangle>list_map_rel))) \\<in> ?R\"\napply (autoref_monadic)\ndone*)\n\n\nsubsection \"Array-Map Tests\"\n\nterm \"{1,2::nat} \\<union> {3,4}\"\n\nschematic_goal array_set_test_code:\n  \"(?f::?'c, RETURN (({1,2::nat} \\<union> {3,4} \n       ::: \\<langle>nat_rel\\<rangle>iam_set_rel )))\\<in>?R\" \nby (autoref_monadic (trace))\n\nconcrete_definition array_set_test uses array_set_test_code\nprint_theorems\nvalue [nbe] array_set_test\n\nschematic_goal\n  \"(?f::?'c, RETURN (({1} ::: \\<langle>nat_rel\\<rangle>dflt_rs_rel) = {}))\\<in>?R\" \napply (autoref_monadic (trace))\ndone\n\nschematic_goal\n  \"(?f::?'c, RETURN (card {1,2,3::nat}))\\<in>?R\" \napply (autoref_monadic (trace))\ndone\n\nschematic_goal\n  \"(?f::?'c, RETURN (\\<forall>x\\<in>{1,2,3::nat}. x<4))\\<in>?R\" \napply (autoref_monadic (trace))\ndone\n\nschematic_goal\n  \"(?f::?'c, RETURN (\\<exists>x\\<in>{1,2,3::nat}. x<4))\\<in>?R\" \napply (autoref_monadic (trace))\ndone\n\nschematic_goal\n  \"(?f::?'c, RETURN (({1} ::: \\<langle>nat_rel\\<rangle>iam_set_rel) = {}))\\<in>?R\" \n  apply (autoref_monadic (trace))\n  done\n\nschematic_goal\n  assumes [autoref_rules]: \"(f,f')\\<in>nat_rel\\<rightarrow>Rb\"\n  shows \"(?f::?'c,f' 3)\\<in>?R\"\n  by (autoref)\n\n\nschematic_goal \"(?f::?'c,\n  RETURN (({1,2::nat} \\<times> {3,4::nat}) ::: \\<langle>\\<langle>Id,Id\\<rangle>prod_rel\\<rangle>dflt_rs_rel)\n)\\<in>?R\"\n  by autoref_monadic\n\nschematic_goal \"(?f::?'c,\n  RETURN ({1,2::nat} \\<inter> ({3,4::nat}) ::: \\<langle>Id\\<rangle>list_set_rel)\n)\\<in>?R\"\n  by autoref_monadic\n\nschematic_goal \"(?f::?'c,\n  RETURN ({1,2::nat} \\<inter> ({3,4::nat}) ::: \\<langle>Id\\<rangle>dflt_rs_rel)\n)\\<in>?R\"\n  by autoref_monadic\n\nschematic_goal \"(?f::?'c,\n  RETURN (card (dom ([ 1::nat \\<mapsto> True, 2\\<mapsto>False ] ::: \\<langle>Id,Id\\<rangle>dflt_rm_rel )))\n)\\<in>?R\"\n  by autoref_monadic\n\ntext \\<open>A hairy case for the operator identification heuristics for maps:\\<close>\nschematic_goal \n  shows \"(?f::?'c,\n  \\<lambda>m (x::'a::linorder) (y::'b::linorder). case_option\n    None\n    (\\<lambda>m'. m' y)\n    (m x)\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\n\nschematic_goal \n  shows \"(?f::?'c,\n  \\<lambda>m (x::'a::hashable) (y::'b::hashable). case_option\n    None\n    (\\<lambda>m'. m' y)\n    (m x)\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\n\nschematic_goal \n  shows \"(?f::?'c,\n  \\<lambda>m (x::'a::hashable) (y::'b::linorder). case_option\n    None\n    (\\<lambda>m'. m' y)\n    (m (x:::Id))\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\n\nschematic_goal \"(?f::?'c,\n  {1,2::'a::numeral} \\<times> {3,4::'a}\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c,\n  {1,2::'a::{numeral,hashable}} \\<times> ({3,4::'a} ::: \\<langle>Id\\<rangle>dflt_ahs_rel)\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c,\n  {1,2::nat} \\<times> {3,4::nat}\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c,\n  {1,2::nat} \\<inter> {3,4::nat}\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c,\n  RETURN (({1,2::nat} \\<times> {3,4::nat}) ::: \\<langle>\\<langle>Id,Id\\<rangle>prod_rel\\<rangle>dflt_rs_rel)\n)\\<in>?R\"\n  by autoref_monadic\n\n(* TODO: ty_REL hint is ignored. Reason: Seems to not properly work with GAs! *)\nschematic_goal \n  notes [autoref_tyrel] = ty_REL[where 'a = \"(nat\\<times>nat) set\" \n    and R=\"\\<langle>\\<langle>Id,Id\\<rangle>prod_rel\\<rangle>dflt_rs_rel\"] \n  shows \"(?f::?'c,\n    RETURN (({1,2::nat} \\<times> {3,4::nat}))\n  )\\<in>?R\"\n  by autoref_monadic\n\n(* TODO: Iterator optimization does not capture \n    foldli ((map fst \\<circ> rbt_to_list) x)\npattern!\n*)\n\ntext \\<open>We have an optimized version for add on red-black trees\\<close>\nschematic_goal \"(?f::?'c,\n  [ 1::nat \\<mapsto> True, 2::nat \\<mapsto> False ] ++ [ 3::nat \\<mapsto> True, 4::nat \\<mapsto> False ]\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\ntext \\<open>The optimized version is also transfered through the map2set converter\\<close>\nschematic_goal \"(?f::?'c,\n  {1,2::nat} \\<union> {3,4}\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\ntext \\<open>For list-sets, the generic version is used\\<close>\nschematic_goal \"(?f::?'c,\n  {1,2::nat} \\<union> {3,4} ::: \\<langle>Id\\<rangle>list_set_rel\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\n\nlemma is_refgoal: \"(c,a)\\<in>R \\<Longrightarrow> (c,a)\\<in>R\" .\n\nschematic_goal \"(?f::?'c,\n  ({{1::nat}:::\\<langle>Id\\<rangle> map2set_rel dflt_rm_rel} ) \n  \\<union> ({{2,3,4,5,5,6,7,8,98,9,0}}) \n)\\<in>?R\"\n  by (autoref (keep_goal))\n\n\ntext \\<open>The next two lemmas demonstrate optimization: The insert-operation\n  is translated by @{term \"(#)\"}\\<close>\nschematic_goal \"(?f::?'c, {1,2,3,4::nat}:::\\<langle>Id\\<rangle>list_set_rel\n  )\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \n  \"(?f::?'c, {{1},{2},{3},{4::nat}}:::\\<langle>?R'::(?'d\\<times>_) set\\<rangle>list_set_rel\n  )\\<in>?R\"\n  by (autoref (keep_goal))\n\n\nschematic_goal \"(?f::?'c,\n  SPEC (\\<lambda>x. x\\<in>({1,2,3::nat}:::\\<langle>Id\\<rangle>dflt_rs_rel)) \n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nschematic_goal \"(?f::?'c,\n  \\<lambda>s::nat set. {s} \\<union> {{1,2,3}} = {{1}}\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nschematic_goal \"(?f::?'c,\n  \\<forall>(k,v)\\<in>map_to_set [1::nat\\<mapsto>2::nat]. k>v\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c, do {\n  let s = ({1,2,3::nat}:::\\<langle>Id\\<rangle>dflt_rs_rel);\n  FOREACH s (\\<lambda>n s. RETURN (n+s)) 0\n}\n)\\<in>?R\"\n  by autoref_monadic\n\nschematic_goal \"(?f::?'c, do {\n  let s = ({{1,2,3::nat}, {}, {1,2}});\n  FOREACH s (\\<lambda>n s. RETURN (n \\<union> s)) {}\n}\n)\\<in>?R\"\n  by (autoref_monadic)\n\nschematic_goal \"(?f::?'c,\n  ({{1::nat}} ) \n  \\<union> ({{2,3,4,5,5,6,7,8,98,9,0}}) \n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c,\n  SPEC (\\<lambda>x. x\\<in>({1,2,3::nat})) \n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nschematic_goal \"(?f::?'c,\n  \\<lambda>s::nat set. {s} \\<union> {{1,2,3}} = {{1}}\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nschematic_goal \"(?f::?'c,\n  \\<forall>(k,v)\\<in>map_to_set [1::nat\\<mapsto>2::nat]. k>v\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nschematic_goal \"(?f::?'c,\n  [ 1::nat \\<mapsto> [ 2::nat \\<mapsto> 3::nat, 1::nat \\<mapsto> 3::nat ] ]\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nend\n\ntext \\<open>Indirect Annotation\\<close>\nconsts \n  rel_set1 :: rel_name\n  rel_set2 :: rel_name\n\n\ncontext begin interpretation autoref_syn .\n\ndefinition \n  \"algo \\<equiv> ( {1,2,3::nat}::#rel_set1, {1,2,3::nat}::#rel_set2 )\"\n\nschematic_goal \n  notes [autoref_rel_indirect] = \n    REL_INDIRECT[of rel_set1 \"\\<langle>Rk\\<rangle>list_set_rel\" for Rk]\n    REL_INDIRECT[of rel_set2 \"\\<langle>Rk\\<rangle>dflt_rs_rel\" for Rk]\n  shows \"(?f::?'c,algo) \\<in> ?R\"\n  unfolding algo_def\n  by (autoref)\n\nschematic_goal \n  notes [autoref_rel_indirect] = \n    REL_INDIRECT[of rel_set1 \"\\<langle>Rk\\<rangle>dflt_rs_rel\" for Rk]\n    REL_INDIRECT[of rel_set2 \"\\<langle>Rk\\<rangle>dflt_rs_rel\" for Rk]\n  shows \"(?f::?'c,algo) \\<in> ?R\"\n  unfolding algo_def\n  by (autoref)\n\n\n\ntext \\<open>A witness of the red algorithm is a node on the stack and a path\n  to this node\\<close>\ntype_synonym 'v red_witness = \"('v list \\<times> 'v) option\"\ntext \\<open>Prepend node to red witness\\<close>\nfun prep_wit_red :: \"'v \\<Rightarrow> 'v red_witness \\<Rightarrow> 'v red_witness\" where\n  \"prep_wit_red v None = None\"\n| \"prep_wit_red v (Some (p,u)) = Some (v#p,u)\"\n\ntext \\<open>\n  Initial witness for node \\<open>u\\<close> with onstack successor \\<open>v\\<close> \n\\<close>\ndefinition red_init_witness :: \"'v \\<Rightarrow> 'v \\<Rightarrow> 'v red_witness\" where\n  \"red_init_witness u v = Some ([u],v)\"\n\ndefinition red_dfs where\n  \"red_dfs E onstack V u \\<equiv> \n    REC\\<^sub>T (\\<lambda>D (V,u). do {\n      let V=(insert u V);\n\n      \\<comment> \\<open>Check whether we have a successor on stack\\<close>\n      brk \\<leftarrow> FOREACH\\<^sub>C (E``{u}) (\\<lambda>brk. brk=None) \n        (\\<lambda>t _. if t\\<in>onstack then RETURN (red_init_witness u t) else RETURN None)\n        None;\n\n      \\<comment> \\<open>Recurse for successors\\<close>\n      case brk of\n        None \\<Rightarrow>\n          FOREACH\\<^sub>C ((E``{u})) (\\<lambda>(V,brk). brk=None)\n            (\\<lambda>t (V,_). \n              if t\\<notin>V then do {\n                (V,brk) \\<leftarrow> D (V,t);\n                RETURN (V,prep_wit_red u brk)\n              } else RETURN (V,None))\n            (V,None)\n      | _ \\<Rightarrow> RETURN (V,brk)\n    }) (V,u)\n  \"\n\nabbreviation \"i_red_witness \\<equiv> \\<langle>\\<langle>\\<langle>i_nat\\<rangle>\\<^sub>ii_list,i_nat\\<rangle>\\<^sub>ii_prod\\<rangle>\\<^sub>ii_option\"\nlemma [autoref_itype]:\n  \"red_init_witness ::\\<^sub>i i_nat \\<rightarrow>\\<^sub>i i_nat \\<rightarrow>\\<^sub>i i_red_witness\"\n  \"prep_wit_red ::\\<^sub>i i_nat \\<rightarrow>\\<^sub>i i_red_witness \\<rightarrow>\\<^sub>i i_red_witness\"\n  by auto\n\nabbreviation \"red_witness_rel \\<equiv> \\<langle>\\<langle>\\<langle>nat_rel\\<rangle>list_rel,nat_rel\\<rangle>prod_rel\\<rangle>option_rel\"\n\nlemma [autoref_rules_raw]:\n  \"(red_init_witness,red_init_witness) \\<in> nat_rel\\<rightarrow>nat_rel\\<rightarrow>red_witness_rel\"\n  \"(prep_wit_red,prep_wit_red) \\<in> nat_rel \\<rightarrow> red_witness_rel \\<rightarrow> red_witness_rel\"\n  by (auto)\n\n(*schematic_lemma \n  \"(?f, RECT (\\<lambda>D x. D x)) \\<in> (?R::(?'c\\<times>_) set)\"\n  apply (autoref (keep_goal))\n  done*)\n\nschematic_goal red_dfs_impl:\n  notes [[goals_limit = 1]]\n  fixes u'::\"nat\" and V'::\"nat set\"\n  assumes [autoref_rules]:\n    \"(u,u')\\<in>nat_rel\" \n    \"(V,V')\\<in>\\<langle>nat_rel\\<rangle>dflt_rs_rel\" \n    \"(onstack,onstack')\\<in>\\<langle>nat_rel\\<rangle>dflt_rs_rel\" \n    \"(E,E')\\<in>\\<langle>nat_rel\\<rangle>slg_rel\"\n  shows \"(?f, red_dfs E' onstack' V' u') \\<in> (?R::(?'c\\<times>_) set)\"\n  apply -\n  unfolding red_dfs_def\n  apply (autoref_monadic (trace))\n  done\n\nconcrete_definition red_dfs_impl for E onstack V u uses red_dfs_impl \n\nprepare_code_thms red_dfs_impl_def\n\nexport_code red_dfs_impl checking SML\n\n\nend\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/Examples/Autoref/Coll_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3386719114684195}}
{"text": "subsection \\<open>Control-flow Semantics Theorems\\<close>\n\ntheory IRStepThms\n  imports\n    IRStepObj\n    TreeToGraphThms\nbegin\n\ntext \\<open>\nWe prove that within the same graph, a configuration triple will always\ntransition to the same subsequent configuration. Therefore, our step semantics\nis deterministic.\n\\<close>\n\n(*\ndefinition stepping_nodes :: \"(IRNode \\<Rightarrow> bool) set\" where\n  \"stepping_nodes = {\n    is_sequential_node,\n    is_IfNode,\n    is_AbstractEndNode,\n    is_NewInstanceNode,\n    is_LoadFieldNode,\n    is_SignedDivNode,\n    is_SignedRemNode,\n    is_LoadFieldNode,\n    is_StoreFieldNode\n  }\"\n\ninductive_cases StepE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"g, p \\<turnstile> (nid,m,h) \\<rightarrow> next\"\n\nlemma stepping_nodes_distinct:\n  assumes \"sel \\<in> stepping_nodes \\<and> sel node\"\n  shows \"\\<forall> oth \\<in> stepping_nodes - {sel} . \\<not>(oth node)\"\n  using assms unfolding stepping_nodes_def sorry\n\n\nproof (induction arbitrary: m h rule: step.induct)\n  case (SequentialNode nid nid')\n  have \"is_sequential_node \\<in> stepping_nodes\" unfolding stepping_nodes_def by simp\n  then have distinct: \"\\<forall> oth \\<in> stepping_nodes - {is_sequential_node} . \\<not>(oth (kind g nid))\"\n    using stepping_nodes_distinct SequentialNode(1) by auto\n  obtain next' where \"g, p \\<turnstile> (nid, m, h) \\<rightarrow> next'\"\n    using SequentialNode.hyps(1) step.SequentialNode\n    by blast\n  then have \"next' = (nid', m, h)\"\n    apply (induct rule: step.induct) using SequentialNode sorry\n  show ?case apply (rule allI) (*using step.cases*) apply (induction rule: step.induct)\n    using distinct unfolding stepping_nodes_def\n    using is_IfNode_def is_NewInstanceNode_def is_LoadFieldNode_def is_SignedDivNode_def is_SignedRemNode_def\n    is_LoadFieldNode_def is_StoreFieldNode_def \n    apply (rule stepping_nodes_distinct [where sel = is_sequential_node, where node = \"kind g nid\"])\n  then show ?case apply (rule stepping_nodes_distinct [where sel = is_sequential_node, where node = \"kind g nid\"])?\nnext\n  case (IfNode nid cond tb fb condE m val nid' h)\n  then show ?case sorry\nnext\n  case (EndNodes nid merge i phis inps inpsE m vs m' h)\n  then show ?case sorry\nnext\n  case (NewInstanceNode nid f obj nid' h' ref h m' m)\n  then show ?case sorry\nnext\n  case (LoadFieldNode nid f obj nid' objE m ref h v m')\n  then show ?case sorry\nnext\n  case (SignedDivNode nid x y zero sb nxt xe ye m v1 v2 v m' h)\n  then show ?case sorry\nnext\n  case (SignedRemNode nid x y zero sb nxt xe ye m v1 v2 v m' h)\n  then show ?case sorry\nnext\n  case (StaticLoadFieldNode nid f nid' h v m' m)\n  then show ?case sorry\nnext\n  case (StoreFieldNode nid f newval uu obj nid' newvalE objE m val ref h' h m')\n  then show ?case sorry\nnext\n  case (StaticStoreFieldNode nid f newval uv nid' newvalE m val h' h m')\n  then show ?case sorry\nqed\n*)\n\nsubsubsection \\<open>Control-flow Step is Deterministic\\<close>\n\ntheorem stepDet:\n   \"(g, p \\<turnstile> (nid,m,h) \\<rightarrow> next) \\<Longrightarrow>\n   (\\<forall> next'. ((g, p \\<turnstile> (nid,m,h) \\<rightarrow> next') \\<longrightarrow> next = next'))\"\nproof (induction rule: \"step.induct\")\n  case (SequentialNode nid \"next\" m h)\n  have notif: \"\\<not>(is_IfNode (kind g nid))\"\n    using SequentialNode.hyps(1) is_sequential_node.simps \n    by (metis is_IfNode_def)\n  have notend: \"\\<not>(is_AbstractEndNode (kind g nid))\"\n    using SequentialNode.hyps(1) is_sequential_node.simps \n    by (metis is_AbstractEndNode.simps is_EndNode.elims(2) is_LoopEndNode_def)\n  have notnew: \"\\<not>(is_NewInstanceNode (kind g nid))\"\n    using SequentialNode.hyps(1) is_sequential_node.simps\n    by (metis is_NewInstanceNode_def)\n  have notload: \"\\<not>(is_LoadFieldNode (kind g nid))\"\n    using SequentialNode.hyps(1) is_sequential_node.simps\n    by (metis is_LoadFieldNode_def)\n  have notstore: \"\\<not>(is_StoreFieldNode (kind g nid))\"\n    using SequentialNode.hyps(1) is_sequential_node.simps\n    by (metis is_StoreFieldNode_def)\n  have notdivrem:  \"\\<not>(is_IntegerDivRemNode (kind g nid))\"\n    using SequentialNode.hyps(1) is_sequential_node.simps is_SignedDivNode_def is_SignedRemNode_def\n    by (metis is_IntegerDivRemNode.simps)\n  from notif notend notnew notload notstore notdivrem\n  show ?case using SequentialNode step.cases\n    by (smt (z3) IRNode.disc(1028) IRNode.disc(2270) IRNode.discI(31) Pair_inject is_sequential_node.simps(18) is_sequential_node.simps(43) is_sequential_node.simps(44))\nnext\n  case (IfNode nid cond tb fb m val \"next\" h)\n  then have notseq: \"\\<not>(is_sequential_node (kind g nid))\"\n    using is_sequential_node.simps is_AbstractMergeNode.simps\n    by (simp add: IfNode.hyps(1))\n  have notend: \"\\<not>(is_AbstractEndNode (kind g nid))\"\n    using is_AbstractEndNode.simps\n    by (simp add: IfNode.hyps(1))\n  have notdivrem: \"\\<not>(is_IntegerDivRemNode (kind g nid))\" \n    using is_AbstractEndNode.simps\n    by (simp add: IfNode.hyps(1))\n  from notseq notend notdivrem show ?case using IfNode repDet evalDet IRNode.distinct IRNode.inject(11) Pair_inject step.simps\n    by (smt (z3) IRNode.distinct IRNode.inject(12) Pair_inject step.simps)\nnext\n  case (EndNodes nid merge i phis inputs m vs m' h)\n  have notseq: \"\\<not>(is_sequential_node (kind g nid))\"\n    using EndNodes.hyps(1) is_AbstractEndNode.simps is_sequential_node.simps \n    by (metis is_EndNode.elims(2) is_LoopEndNode_def)\n  have notif: \"\\<not>(is_IfNode (kind g nid))\"\n    using EndNodes.hyps(1) is_IfNode_def is_AbstractEndNode.elims\n    by (metis IRNode.distinct_disc(1058) is_EndNode.simps(12))\n  have notref: \"\\<not>(is_RefNode (kind g nid))\"\n    using EndNodes.hyps(1) is_sequential_node.simps\n    using IRNode.disc(1899) IRNode.distinct(1473) is_AbstractEndNode.simps is_EndNode.elims(2) is_LoopEndNode_def is_RefNode_def\n    by metis\n  have notnew: \"\\<not>(is_NewInstanceNode (kind g nid))\"\n    using EndNodes.hyps(1) is_AbstractEndNode.simps\n    using IRNode.distinct_disc(1442) is_EndNode.simps(29) is_NewInstanceNode_def\n    by (metis IRNode.distinct_disc(1901) is_EndNode.simps(32))\n  have notload: \"\\<not>(is_LoadFieldNode (kind g nid))\"\n    using EndNodes.hyps(1) is_AbstractEndNode.simps\n    using is_LoadFieldNode_def\n    by (metis IRNode.distinct_disc(1706) is_EndNode.simps(21))\n  have notstore: \"\\<not>(is_StoreFieldNode (kind g nid))\"\n    using EndNodes.hyps(1) is_AbstractEndNode.simps is_StoreFieldNode_def\n    by (metis IRNode.distinct_disc(1926) is_EndNode.simps(44))\n  have notdivrem: \"\\<not>(is_IntegerDivRemNode (kind g nid))\"\n    using EndNodes.hyps(1) is_AbstractEndNode.simps is_SignedDivNode_def is_SignedRemNode_def\n    using IRNode.distinct_disc(1498) IRNode.distinct_disc(1500) is_IntegerDivRemNode.simps is_EndNode.simps(36) is_EndNode.simps(37) \n    by auto\n  from notseq notif notref notnew notload notstore notdivrem\n  show ?case using EndNodes repAllDet evalAllDet\n    by (smt (z3) is_IfNode_def is_LoadFieldNode_def is_NewInstanceNode_def is_RefNode_def is_StoreFieldNode_def is_SignedDivNode_def is_SignedRemNode_def  Pair_inject is_IntegerDivRemNode.elims(3) step.cases)\nnext\n  case (NewInstanceNode nid f obj nxt h' ref h m' m)\n  then have notseq: \"\\<not>(is_sequential_node (kind g nid))\"\n    using is_sequential_node.simps is_AbstractMergeNode.simps\n    by (simp add: NewInstanceNode.hyps(1))\n  have notend: \"\\<not>(is_AbstractEndNode (kind g nid))\"\n    using is_AbstractMergeNode.simps\n    by (simp add: NewInstanceNode.hyps(1))\n  have notif: \"\\<not>(is_IfNode (kind g nid))\"\n    using is_AbstractMergeNode.simps\n    by (simp add: NewInstanceNode.hyps(1))\n  have notref: \"\\<not>(is_RefNode (kind g nid))\"\n    using is_AbstractMergeNode.simps\n    by (simp add: NewInstanceNode.hyps(1))\n  have notload: \"\\<not>(is_LoadFieldNode (kind g nid))\"\n    using is_AbstractMergeNode.simps\n    by (simp add: NewInstanceNode.hyps(1))\n  have notstore: \"\\<not>(is_StoreFieldNode (kind g nid))\"\n    using is_AbstractMergeNode.simps\n    by (simp add: NewInstanceNode.hyps(1))\n  have notdivrem:  \"\\<not>(is_IntegerDivRemNode (kind g nid))\"\n    using is_AbstractMergeNode.simps\n    by (simp add: NewInstanceNode.hyps(1))\n  from notseq notend notif notref notload notstore notdivrem\n  show ?case using NewInstanceNode step.cases\n    by (smt (z3) IRNode.disc(1028) IRNode.disc(2270) IRNode.discI(11) IRNode.distinct(2311) IRNode.distinct(2313) IRNode.inject(31) Pair_inject)\nnext\n  case (LoadFieldNode nid f obj nxt m ref h v m')\n  then have notseq: \"\\<not>(is_sequential_node (kind g nid))\"\n    using is_sequential_node.simps is_AbstractMergeNode.simps\n    by (simp add: LoadFieldNode.hyps(1))\n  have notend: \"\\<not>(is_AbstractEndNode (kind g nid))\"\n    using is_AbstractEndNode.simps\n    by (simp add: LoadFieldNode.hyps(1))\n  have notdivrem:  \"\\<not>(is_IntegerDivRemNode (kind g nid))\"\n    using is_AbstractEndNode.simps\n    by (simp add: LoadFieldNode.hyps(1))\n  from notseq notend notdivrem\n  show ?case using LoadFieldNode step.cases repDet evalDet\n    by (smt (z3) IRNode.distinct(1051) IRNode.distinct(1721) IRNode.distinct(1739) IRNode.distinct(1741) IRNode.distinct(1745) IRNode.inject(20) Pair_inject Value.inject(2) option.distinct(1) option.inject)\nnext\n  case (StaticLoadFieldNode nid f nxt h v m' m)\n  then have notseq: \"\\<not>(is_sequential_node (kind g nid))\"\n    using is_sequential_node.simps is_AbstractMergeNode.simps\n    by (simp add: StaticLoadFieldNode.hyps(1))\n  have notend: \"\\<not>(is_AbstractEndNode (kind g nid))\"\n    using is_AbstractEndNode.simps\n    by (simp add: StaticLoadFieldNode.hyps(1))\n  have notdivrem: \"\\<not>(is_IntegerDivRemNode (kind g nid))\"\n    by (simp add: StaticLoadFieldNode.hyps(1))\n  from notseq notend notdivrem\n  show ?case using StaticLoadFieldNode step.cases\n    by (smt (z3) IRNode.distinct(1051) IRNode.distinct(1721) IRNode.distinct(1739) IRNode.distinct(1741) IRNode.distinct(1745) IRNode.inject(20) Pair_inject option.distinct(1))\nnext\n  case (StoreFieldNode nid f newval uu obj nxt m val ref h' h m')\n  then have notseq: \"\\<not>(is_sequential_node (kind g nid))\"\n    using is_sequential_node.simps is_AbstractMergeNode.simps\n    by (simp add: StoreFieldNode.hyps(1))\n  have notend: \"\\<not>(is_AbstractEndNode (kind g nid))\"\n    using is_AbstractEndNode.simps\n    by (simp add: StoreFieldNode.hyps(1))\n  have notdivrem: \"\\<not>(is_IntegerDivRemNode (kind g nid))\"\n    by (simp add: StoreFieldNode.hyps(1))\n  from notseq notend notdivrem\n  show ?case using StoreFieldNode step.cases repDet evalDet\n    by (smt (z3) IRNode.distinct(1097) IRNode.distinct(1745) IRNode.distinct(2317) IRNode.distinct(2605) IRNode.distinct(2627) IRNode.inject(43) Pair_inject Value.inject(2) option.distinct(1) option.inject)\nnext\n  case (StaticStoreFieldNode nid f newval uv nxt m val h' h m')\n  then have notseq: \"\\<not>(is_sequential_node (kind g nid))\"\n    using is_sequential_node.simps is_AbstractMergeNode.simps\n    by (simp add: StaticStoreFieldNode.hyps(1))\n  have notend: \"\\<not>(is_AbstractEndNode (kind g nid))\"\n    using is_AbstractEndNode.simps\n    by (simp add: StaticStoreFieldNode.hyps(1))\n  have notdivrem: \"\\<not>(is_IntegerDivRemNode (kind g nid))\"\n    by (simp add: StaticStoreFieldNode.hyps(1))\n  from notseq notend notdivrem\n  show ?case using StoreFieldNode step.cases repDet evalDet\n    by (smt (z3) IRNode.distinct(1097) IRNode.distinct(1745) IRNode.distinct(2317) IRNode.distinct(2605) IRNode.distinct(2627) IRNode.inject(43) Pair_inject StaticStoreFieldNode.hyps(1) StaticStoreFieldNode.hyps(2) StaticStoreFieldNode.hyps(3) StaticStoreFieldNode.hyps(4) StaticStoreFieldNode.hyps(5) option.distinct(1))\nnext\n  case (SignedDivNode nid x y zero sb nxt m v1 v2 v m' h)\n  then have notseq: \"\\<not>(is_sequential_node (kind g nid))\"\n    using is_sequential_node.simps is_AbstractMergeNode.simps\n    by (simp add: SignedDivNode.hyps(1))\n  have notend: \"\\<not>(is_AbstractEndNode (kind g nid))\"\n    using is_AbstractEndNode.simps\n    by (simp add: SignedDivNode.hyps(1))\n  from notseq notend\n  show ?case using SignedDivNode step.cases repDet evalDet\n    by (smt (z3) IRNode.distinct(1091) IRNode.distinct(1739) IRNode.distinct(2311) IRNode.distinct(2601) IRNode.distinct(2605) IRNode.inject(40) Pair_inject)\nnext\n  case (SignedRemNode nid x y zero sb nxt m v1 v2 v m' h)\n  then have notseq: \"\\<not>(is_sequential_node (kind g nid))\"\n    using is_sequential_node.simps is_AbstractMergeNode.simps\n    by (simp add: SignedRemNode.hyps(1))\n  have notend: \"\\<not>(is_AbstractEndNode (kind g nid))\"\n    using is_AbstractEndNode.simps\n    by (simp add: SignedRemNode.hyps(1))\n  from notseq notend\n  show ?case using SignedRemNode step.cases repDet evalDet\n    by (smt (z3) IRNode.distinct(1093) IRNode.distinct(1741) IRNode.distinct(2313) IRNode.distinct(2601) IRNode.distinct(2627) IRNode.inject(41) Pair_inject)\nqed\n\nlemma stepRefNode:\n  \"\\<lbrakk>kind g nid = RefNode nid'\\<rbrakk> \\<Longrightarrow> g, p \\<turnstile> (nid,m,h) \\<rightarrow> (nid',m,h)\"\n  using SequentialNode\n  by (metis IRNodes.successors_of_RefNode is_sequential_node.simps(7) nth_Cons_0)\n\nlemma IfNodeStepCases: \n  assumes \"kind g nid = IfNode cond tb fb\"\n  assumes \"g \\<turnstile> cond \\<simeq> condE\"\n  assumes \"[m, p] \\<turnstile> condE \\<mapsto> v\"\n  assumes \"g, p \\<turnstile> (nid, m, h) \\<rightarrow> (nid', m, h)\"\n  shows \"nid' \\<in> {tb, fb}\"\n  using step.IfNode repDet stepDet assms\n  by (metis insert_iff old.prod.inject)\n\nlemma IfNodeSeq:\n  shows \"kind g nid = IfNode cond tb fb \\<longrightarrow> \\<not>(is_sequential_node (kind g nid))\"\n  unfolding is_sequential_node.simps\n  using is_sequential_node.simps(18) by presburger\n  \nlemma IfNodeCond:\n  assumes \"kind g nid = IfNode cond tb fb\"\n  assumes \"g, p \\<turnstile> (nid, m, h) \\<rightarrow> (nid', m, h)\"\n  shows \"\\<exists> condE v. ((g \\<turnstile> cond \\<simeq> condE) \\<and> ([m, p] \\<turnstile> condE \\<mapsto> v))\"\n  using assms(2,1) by (induct \"(nid,m,h)\" \"(nid',m,h)\" rule: step.induct; auto)\n\nlemma step_in_ids:\n  assumes \"g, p \\<turnstile> (nid, m, h) \\<rightarrow> (nid', m', h')\"\n  shows \"nid \\<in> ids g\"\n  using assms apply (induct \"(nid, m, h)\" \"(nid', m', h')\" rule: step.induct)\n  using is_sequential_node.simps(45) not_in_g \n  apply simp\n  apply (metis is_sequential_node.simps(53))\n  using ids_some\n  using IRNode.distinct(1113) apply presburger\n  using EndNodes(1) is_AbstractEndNode.simps is_EndNode.simps(45) ids_some\n  apply (metis IRNode.disc(1218) is_EndNode.simps(52))\n  by simp+\n\nend\n", "meta": {"author": "uqcyber", "repo": "veriopt-releases", "sha": "4ffab3c91bbd699772889dbf263bb6d2582256d7", "save_path": "github-repos/isabelle/uqcyber-veriopt-releases", "path": "github-repos/isabelle/uqcyber-veriopt-releases/veriopt-releases-4ffab3c91bbd699772889dbf263bb6d2582256d7/Semantics/IRStepThms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.33867190369842193}}
{"text": "(*  Title:      HOL/Auth/Shared.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n\nTheory of Shared Keys (common to all symmetric-key protocols)\n\nShared, long-term keys; initial states of agents\n*)\n\ntheory Shared\nimports Event All_Symmetric\nbegin\n\nconsts\n  shrK    :: \"agent => key\"  (*symmetric keys*)\n\nspecification (shrK)\n  inj_shrK: \"inj shrK\"\n  \\<comment>\\<open>No two agents have the same long-term key\\<close>\n   apply (rule exI [of _ \"case_agent 0 (\\<lambda>n. n + 2) 1\"]) \n   apply (simp add: inj_on_def split: agent.split) \n   done\n\ntext\\<open>Server knows all long-term keys; other agents know only their own\\<close>\n\noverloading\n  initState \\<equiv> initState\nbegin\n\nprimrec initState where\n  initState_Server:  \"initState Server     = Key ` range shrK\"\n| initState_Friend:  \"initState (Friend i) = {Key (shrK (Friend i))}\"\n| initState_Spy:     \"initState Spy        = Key`shrK`bad\"\n\nend\n\n\nsubsection\\<open>Basic properties of shrK\\<close>\n\n(*Injectiveness: Agents' long-term keys are distinct.*)\nlemmas shrK_injective = inj_shrK [THEN inj_eq]\ndeclare shrK_injective [iff]\n\nlemma invKey_K [simp]: \"invKey K = K\"\napply (insert isSym_keys)\napply (simp add: symKeys_def) \ndone\n\n\nlemma analz_Decrypt' [dest]:\n     \"[| Crypt K X \\<in> analz H;  Key K  \\<in> analz H |] ==> X \\<in> analz H\"\nby auto\n\ntext\\<open>Now cancel the \\<open>dest\\<close> attribute given to\n \\<open>analz.Decrypt\\<close> in its declaration.\\<close>\ndeclare analz.Decrypt [rule del]\n\ntext\\<open>Rewrites should not refer to  @{term \"initState(Friend i)\"} because\n  that expression is not in normal form.\\<close>\n\nlemma keysFor_parts_initState [simp]: \"keysFor (parts (initState C)) = {}\"\napply (unfold keysFor_def)\napply (induct_tac \"C\", auto)\ndone\n\n(*Specialized to shared-key model: no @{term invKey}*)\nlemma keysFor_parts_insert:\n     \"[| K \\<in> keysFor (parts (insert X G));  X \\<in> synth (analz H) |]\n      ==> K \\<in> keysFor (parts (G \\<union> H)) | Key K \\<in> parts H\"\nby (metis invKey_K keysFor_parts_insert)\n\nlemma Crypt_imp_keysFor: \"Crypt K X \\<in> H ==> K \\<in> keysFor H\"\nby (metis Crypt_imp_invKey_keysFor invKey_K)\n\n\nsubsection\\<open>Function \"knows\"\\<close>\n\n(*Spy sees shared keys of agents!*)\nlemma Spy_knows_Spy_bad [intro!]: \"A: bad ==> Key (shrK A) \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) add: imageI knows_Cons split: event.split)\ndone\n\n(*For case analysis on whether or not an agent is compromised*)\nlemma Crypt_Spy_analz_bad: \"[| Crypt (shrK A) X \\<in> analz (knows Spy evs);  A: bad |]  \n      ==> X \\<in> analz (knows Spy evs)\"\nby (metis Spy_knows_Spy_bad analz.Inj analz_Decrypt')\n\n\n(** Fresh keys never clash with long-term shared keys **)\n\n(*Agents see their own shared keys!*)\nlemma shrK_in_initState [iff]: \"Key (shrK A) \\<in> initState A\"\nby (induct_tac \"A\", auto)\n\nlemma shrK_in_used [iff]: \"Key (shrK A) \\<in> used evs\"\nby (rule initState_into_used, blast)\n\n(*Used in parts_induct_tac and analz_Fake_tac to distinguish session keys\n  from long-term shared keys*)\nlemma Key_not_used [simp]: \"Key K \\<notin> used evs ==> K \\<notin> range shrK\"\nby blast\n\nlemma shrK_neq [simp]: \"Key K \\<notin> used evs ==> shrK B \\<noteq> K\"\nby blast\n\nlemmas shrK_sym_neq = shrK_neq [THEN not_sym]\ndeclare shrK_sym_neq [simp]\n\n\nsubsection\\<open>Fresh nonces\\<close>\n\nlemma Nonce_notin_initState [iff]: \"Nonce N \\<notin> parts (initState B)\"\nby (induct_tac \"B\", auto)\n\nlemma Nonce_notin_used_empty [simp]: \"Nonce N \\<notin> used []\"\nby (simp add: used_Nil)\n\n\nsubsection\\<open>Supply fresh nonces for possibility theorems.\\<close>\n\n(*In any trace, there is an upper bound N on the greatest nonce in use.*)\nlemma Nonce_supply_lemma: \"\\<exists>N. ALL n. N<=n --> Nonce n \\<notin> used evs\"\napply (induct_tac \"evs\")\napply (rule_tac x = 0 in exI)\napply (simp_all (no_asm_simp) add: used_Cons split: event.split)\napply (metis le_sup_iff msg_Nonce_supply)\ndone\n\nlemma Nonce_supply1: \"\\<exists>N. Nonce N \\<notin> used evs\"\nby (metis Nonce_supply_lemma order_eq_iff)\n\nlemma Nonce_supply2: \"\\<exists>N N'. Nonce N \\<notin> used evs & Nonce N' \\<notin> used evs' & N \\<noteq> N'\"\napply (cut_tac evs = evs in Nonce_supply_lemma)\napply (cut_tac evs = \"evs'\" in Nonce_supply_lemma, clarify)\napply (metis Suc_n_not_le_n nat_le_linear)\ndone\n\nlemma Nonce_supply3: \"\\<exists>N N' N''. Nonce N \\<notin> used evs & Nonce N' \\<notin> used evs' &  \n                    Nonce N'' \\<notin> used evs'' & N \\<noteq> N' & N' \\<noteq> N'' & N \\<noteq> N''\"\napply (cut_tac evs = evs in Nonce_supply_lemma)\napply (cut_tac evs = \"evs'\" in Nonce_supply_lemma)\napply (cut_tac evs = \"evs''\" in Nonce_supply_lemma, clarify)\napply (rule_tac x = N in exI)\napply (rule_tac x = \"Suc (N+Na)\" in exI)\napply (rule_tac x = \"Suc (Suc (N+Na+Nb))\" in exI)\napply (simp (no_asm_simp) add: less_not_refl3 le_add1 le_add2 less_Suc_eq_le)\ndone\n\nlemma Nonce_supply: \"Nonce (@ N. Nonce N \\<notin> used evs) \\<notin> used evs\"\napply (rule Nonce_supply_lemma [THEN exE])\napply (rule someI, blast)\ndone\n\ntext\\<open>Unlike the corresponding property of nonces, we cannot prove\n    @{term \"finite KK ==> \\<exists>K. K \\<notin> KK & Key K \\<notin> used evs\"}.\n    We have infinitely many agents and there is nothing to stop their\n    long-term keys from exhausting all the natural numbers.  Instead,\n    possibility theorems must assume the existence of a few keys.\\<close>\n\n\nsubsection\\<open>Specialized Rewriting for Theorems About @{term analz} and Image\\<close>\n\nlemma subset_Compl_range: \"A <= - (range shrK) ==> shrK x \\<notin> A\"\nby blast\n\nlemma insert_Key_singleton: \"insert (Key K) H = Key ` {K} \\<union> H\"\nby blast\n\nlemma insert_Key_image: \"insert (Key K) (Key`KK \\<union> C) = Key`(insert K KK) \\<union> C\"\nby blast\n\n(** Reverse the normal simplification of \"image\" to build up (not break down)\n    the set of keys.  Use analz_insert_eq with (Un_upper2 RS analz_mono) to\n    erase occurrences of forwarded message components (X). **)\n\nlemmas analz_image_freshK_simps =\n       simp_thms mem_simps \\<comment>\\<open>these two allow its use with \\<open>only:\\<close>\\<close>\n       disj_comms \n       image_insert [THEN sym] image_Un [THEN sym] empty_subsetI insert_subset\n       analz_insert_eq Un_upper2 [THEN analz_mono, THEN [2] rev_subsetD]\n       insert_Key_singleton subset_Compl_range\n       Key_not_used insert_Key_image Un_assoc [THEN sym]\n\n(*Lemma for the trivial direction of the if-and-only-if*)\nlemma analz_image_freshK_lemma:\n     \"(Key K \\<in> analz (Key`nE \\<union> H)) --> (K \\<in> nE | Key K \\<in> analz H)  ==>  \n         (Key K \\<in> analz (Key`nE \\<union> H)) = (K \\<in> nE | Key K \\<in> analz H)\"\nby (blast intro: analz_mono [THEN [2] rev_subsetD])\n\n\nsubsection\\<open>Tactics for possibility theorems\\<close>\n\nML\n\\<open>\nstructure Shared =\nstruct\n\n(*Omitting used_Says makes the tactic much faster: it leaves expressions\n    such as  Nonce ?N \\<notin> used evs that match Nonce_supply*)\nfun possibility_tac ctxt =\n   (REPEAT \n    (ALLGOALS (simp_tac (ctxt\n          delsimps [@{thm used_Says}, @{thm used_Notes}, @{thm used_Gets}] \n          setSolver safe_solver))\n     THEN\n     REPEAT_FIRST (eq_assume_tac ORELSE' \n                   resolve_tac ctxt [refl, conjI, @{thm Nonce_supply}])))\n\n(*For harder protocols (such as Recur) where we have to set up some\n  nonces and keys initially*)\nfun basic_possibility_tac ctxt =\n    REPEAT \n    (ALLGOALS (asm_simp_tac (ctxt setSolver safe_solver))\n     THEN\n     REPEAT_FIRST (resolve_tac ctxt [refl, conjI]))\n\n\nval analz_image_freshK_ss =\n  simpset_of\n   (@{context} delsimps [image_insert, image_Un]\n      delsimps [@{thm imp_disjL}]    (*reduces blow-up*)\n      addsimps @{thms analz_image_freshK_simps})\n\nend\n\\<close>\n\n\n\n(*Lets blast_tac perform this step without needing the simplifier*)\nlemma invKey_shrK_iff [iff]:\n     \"(Key (invKey K) \\<in> X) = (Key K \\<in> X)\"\nby auto\n\n(*Specialized methods*)\n\nmethod_setup analz_freshK = \\<open>\n    Scan.succeed (fn ctxt =>\n     (SIMPLE_METHOD\n      (EVERY [REPEAT_FIRST (resolve_tac ctxt [allI, ballI, impI]),\n          REPEAT_FIRST (resolve_tac ctxt @{thms analz_image_freshK_lemma}),\n          ALLGOALS (asm_simp_tac (put_simpset Shared.analz_image_freshK_ss ctxt))])))\\<close>\n    \"for proving the Session Key Compromise theorem\"\n\nmethod_setup possibility = \\<open>\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (Shared.possibility_tac ctxt))\\<close>\n    \"for proving possibility theorems\"\n\nmethod_setup basic_possibility = \\<open>\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (Shared.basic_possibility_tac ctxt))\\<close>\n    \"for proving possibility theorems\"\n\nlemma knows_subset_knows_Cons: \"knows A evs <= knows A (e # evs)\"\nby (cases e) (auto simp: knows_Cons)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/Shared.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.33867190369842193}}
{"text": "theory Lambda imports \"../Nominal2\" begin\n\natom_decl name\n\nnominal_datatype lam =\n  Var \"name\"\n| App \"lam\" \"lam\"\n| Lam x::\"name\" l::\"lam\"  binds x in l (\"Lam [_]. _\" [100, 100] 100)\n\nnominal_function lookup where\n  \"lookup (n :: name) m [] \\<longleftrightarrow> (n = m)\"\n| \"lookup n m ((hn, hm) # t) \\<longleftrightarrow>\n     (n, m) = (hn, hm) \\<or> (n \\<noteq> hn \\<and> m \\<noteq> hm \\<and> lookup n m t)\"\n  apply (simp add: eqvt_def lookup_graph_def)\n  apply (rule, perm_simp, rule, rule)\n  by pat_completeness auto\n\nnominal_termination (eqvt) by lexicographic_order\n\nnominal_function lam2_rec where\n  \"lam2_rec faa fll xs (Var n) (Var m) = lookup n m xs\"\n| \"lam2_rec faa fll xs (Var n) (App l r) = False\"\n| \"lam2_rec faa fll xs (Var n) (Lam [x]. t) = False\"\n| \"lam2_rec faa fll xs (App l r) (Var n) = False\"\n| \"lam2_rec faa fll xs (App l1 r1) (App l2 r2) = faa l1 r1 l2 r2\"\n| \"lam2_rec faa fll xs (App l r) (Lam [x]. t) = False\"\n| \"lam2_rec faa fll xs (Lam [x]. t) (Var n) = False\"\n| \"lam2_rec faa fll xs (Lam [x]. t) (App l1 r1) = False\"\n| \"(atom x \\<sharp> (xs, Lam [y]. s) \\<and> atom y \\<sharp> (x, xs, Lam [x]. t) \\<and>\n     (\\<forall>x' y' t' s'. atom x' \\<sharp> (xs, Lam [y']. s') \\<longrightarrow> atom y' \\<sharp> (x', xs, Lam [x']. t') \\<longrightarrow> Lam [x]. t = Lam [x']. t' \\<longrightarrow> Lam [y]. s = Lam [y']. s'\n        \\<longrightarrow> fll x t y s = fll x' t' y' s')) \\<Longrightarrow>\n     lam2_rec faa fll xs (Lam [x]. t) (Lam [y]. s) = fll x t y s\"\n| \"(atom x \\<sharp> (xs, Lam [y]. s) \\<and> atom y \\<sharp> (x, xs, Lam [x]. t) \\<and>\n     \\<not>(\\<forall>x' y' t' s'. atom x' \\<sharp> (xs, Lam [y']. s') \\<longrightarrow> atom y' \\<sharp> (x', xs, Lam [x']. t') \\<longrightarrow> Lam [x]. t = Lam [x']. t' \\<longrightarrow> Lam [y]. s = Lam [y']. s'\n        \\<longrightarrow> fll x t y s = fll x' t' y' s')) \\<Longrightarrow>\n     lam2_rec faa fll xs (Lam [x]. t) (Lam [y]. s) = False\"\n  apply (simp add: eqvt_def lam2_rec_graph_def)\n  apply (rule, perm_simp, rule, rule)\n  apply (case_tac x)\n  apply (rule_tac y=\"d\" and c=\"(c, e)\" in lam.strong_exhaust)\n  apply (rule_tac y=\"e\" and c=\"(c, d)\" in lam.strong_exhaust)\n  apply simp_all[3]  apply (metis, metis, metis)\n  apply (rule_tac y=\"e\" and c=\"(c, d)\" in lam.strong_exhaust)\n  apply simp_all[3]  apply (metis, metis, metis)\n  apply (rule_tac y=\"e\" and c=\"(name, c, d)\" in lam.strong_exhaust)\n  apply simp_all[2]  apply (metis, metis)\n  unfolding fresh_star_def\n  apply (thin_tac \"\\<And>faa fll xs n m. x = (faa, fll, xs, Var n, Var m) \\<Longrightarrow> P\")\n  apply (thin_tac \"\\<And>faa fll xs n l r. x = (faa, fll, xs, Var n, App l r) \\<Longrightarrow> P\")\n  apply (thin_tac \"\\<And>faa fll xs n xa t. x = (faa, fll, xs, Var n, Lam [xa]. t) \\<Longrightarrow> P\")\n  apply (thin_tac \"\\<And>faa fll xs l1 r1 l2 r2. x = (faa, fll, xs, App l1 r1, App l2 r2) \\<Longrightarrow> P\")\n  apply (thin_tac \"\\<And>faa fll xs l r n. x = (faa, fll, xs, App l r, Var n) \\<Longrightarrow> P\")\n  apply (thin_tac \"\\<And>faa fll xs l r xa t. x = (faa, fll, xs, App l r, Lam [xa]. t) \\<Longrightarrow> P\")\n  apply (thin_tac \"\\<And>faa fll xs xa t n. x = (faa, fll, xs, Lam [xa]. t, Var n) \\<Longrightarrow> P\")\n  apply (thin_tac \"\\<And>faa fll xs xa t l1 r1. x = (faa, fll, xs, Lam [xa]. t, App l1 r1) \\<Longrightarrow> P\")\n  apply (drule_tac x=\"name\" in meta_spec)+\n  apply (drule_tac x=\"c\" in meta_spec)+\n  apply (drule_tac x=\"namea\" in meta_spec)+\n  apply (drule_tac x=\"lama\" in meta_spec)\n  apply (drule_tac x=\"lama\" in meta_spec)\n  apply (drule_tac x=\"lam\" in meta_spec)+\n  apply (drule_tac x=\"b\" in meta_spec)+\n  apply (drule_tac x=\"a\" in meta_spec)+\n  apply (case_tac \"(\\<forall>x' y' t' s'. atom x' \\<sharp> (c, Lam [y']. s') \\<longrightarrow>\n             atom y' \\<sharp> (x', c, Lam [x']. t') \\<longrightarrow> Lam [name]. lam = Lam [x']. t' \\<longrightarrow>\n             Lam [namea]. lama = Lam [y']. s' \\<longrightarrow> b name lam namea lama = b x' t' y' s')\")\n  apply clarify\n  apply (simp)\n  apply (simp only: fresh_Pair_elim)\n  apply blast\n  apply (simp_all)[53]\n  apply clarify\n  apply metis\n  apply simp\n  done\n\nnominal_termination (eqvt) by lexicographic_order\n\nlemma lam_rec2_cong[fundef_cong]:\n  \"(\\<And>s1 s2 s3 s4. l = App s1 s2 \\<Longrightarrow> l2 = App s3 s4  \\<Longrightarrow> faa s1 s2 s3 s4 = faa' s1 s2 s3 s4) \\<Longrightarrow>\n   (\\<And>n t n' t'. l = Lam [n]. t \\<Longrightarrow> l2 = Lam [n']. t' \\<Longrightarrow> fll n t n' t' = fll' n t n' t') \\<Longrightarrow>\n  lam2_rec faa fll xs l l2 = lam2_rec faa' fll' xs l l2\"\n  apply (rule_tac y=\"l\" and c=\"(xs, l2)\" in lam.strong_exhaust)\n  apply (rule_tac y=\"l2\" and c=\"(xs, l)\" in lam.strong_exhaust) apply auto[3]\n  apply (rule_tac y=\"l2\" and c=\"(xs, l)\" in lam.strong_exhaust) apply auto[3]\n  apply (rule_tac y=\"l2\" and c=\"(name, xs, l)\" in lam.strong_exhaust)\n  apply auto[2]\n  apply clarify\n  apply (case_tac \"(\\<forall>x' y' t' s'. atom x' \\<sharp> (xs, Lam [y']. s') \\<longrightarrow>\n    atom y' \\<sharp> (x', xs, Lam [x']. t') \\<longrightarrow> Lam [name]. lam = Lam [x']. t' \\<longrightarrow>\n    Lam [namea]. lama = Lam [y']. s' \\<longrightarrow> fll name lam namea lama = fll x' t' y' s')\")\n  unfolding fresh_star_def\n  apply (subst lam2_rec.simps) apply simp\n  apply (subst lam2_rec.simps) apply simp\n  apply metis\n  apply (subst lam2_rec.simps(10)) apply (simp add: fresh_star_def)\n  apply (subst lam2_rec.simps(10)) apply (simp_all add: fresh_star_def)\n  done\n\nnominal_function aux :: \"lam \\<Rightarrow> lam \\<Rightarrow> (name \\<times> name) list \\<Rightarrow> bool\"\n  where\n[simp del]: \"aux l r xs = lam2_rec\n  (%t1 t2 t3 t4. (aux t1 t3 xs) \\<and> (aux t2 t4 xs))\n  (%x t y s. aux t s ((x, y) # xs)) xs l r\"\n  unfolding eqvt_def aux_graph_def\n  apply (rule, perm_simp, rule, rule)\n  by pat_completeness auto\n\nnominal_termination (eqvt)\n  by (relation \"measure (\\<lambda>(l, r, xs). size l + size r)\") simp_all\n\nlemma aux_simps[simp]:\n  \"aux (Var x) (Var y) xs = lookup x y xs\"\n  \"aux (App t1 t2) (App s1 s2) xs = (aux t1 s1 xs \\<and> aux t2 s2 xs)\"\n  \"aux (Var x) (App t1 t2) xs = False\"\n  \"aux (Var x) (Lam [y].t) xs = False\"\n  \"aux (App t1 t2) (Var x) xs = False\"\n  \"aux (App t1 t2) (Lam [x].t) xs = False\"\n  \"aux (Lam [x].t) (Var y) xs = False\"\n  \"aux (Lam [x].t) (App t1 t2) xs = False\"\n  \"\\<lbrakk>atom x \\<sharp> (s, xs); atom y \\<sharp> (x, t, xs)\\<rbrakk> \\<Longrightarrow> aux (Lam [x].t) (Lam [y].s) xs = aux t s ((x, y) # xs)\"\n  apply (subst aux.simps, simp)\n  apply (subst aux.simps, simp)\n  apply (subst aux.simps, simp)\n  apply (subst aux.simps, simp)\n  apply (subst aux.simps, simp)\n  apply (subst aux.simps, simp)\n  apply (subst aux.simps, simp)\n  apply (subst aux.simps, simp)\n  apply (subst aux.simps)\n  apply (subst lam2_rec.simps)\n  apply (rule, simp add: lam.fresh)\n  apply (rule, simp add: lam.fresh)\n  apply (intro allI impI)\n  apply (rule_tac x=\"(x, x', y, y', t, t', s, s', xs)\" and ?'a=\"name\" in obtain_fresh)\n  apply (rule_tac x=\"(a, x, x', y, y', t, t', s, s', xs)\" and ?'a=\"name\" in obtain_fresh)\n  apply (rule_tac s=\"aux ((atom x \\<rightleftharpoons> atom a) \\<bullet> t) s ((a, y) # xs)\" in trans)\n  apply (rule_tac s=\"(atom x \\<rightleftharpoons> atom a) \\<bullet> aux t s ((x, y) # xs)\" in trans)\n  apply (rule permute_pure[symmetric])\n  apply (simp add: eqvts swap_fresh_fresh)\n  apply (simp add: lam.fresh fresh_at_base fresh_Pair_elim)\n  apply (rename_tac b)\n  apply (rule_tac s=\"aux ((atom x \\<rightleftharpoons> atom a) \\<bullet> t) ((atom y \\<rightleftharpoons> atom b) \\<bullet> s) ((a, b) # xs)\" in trans)\n  apply (rule_tac s=\"(atom y \\<rightleftharpoons> atom b) \\<bullet> aux ((atom x \\<rightleftharpoons> atom a) \\<bullet> t) s ((a, y) # xs)\" in trans)\n  apply (rule permute_pure[symmetric])\n  apply (simp add: eqvts swap_fresh_fresh)\n  apply (simp add: lam.fresh fresh_at_base fresh_Pair_elim)\n  apply (subst permute_eqvt)\n  apply (simp add: eqvts swap_fresh_fresh)\n  apply (rule sym)\n  apply (rule_tac s=\"aux ((atom x' \\<rightleftharpoons> atom a) \\<bullet> t') s' ((a, y') # xs)\" in trans)\n  apply (rule_tac s=\"(atom x' \\<rightleftharpoons> atom a) \\<bullet> aux t' s' ((x', y') # xs)\" in trans)\n  apply (rule permute_pure[symmetric])\n  apply (simp add: eqvts swap_fresh_fresh)\n  apply (simp add: lam.fresh fresh_at_base fresh_Pair_elim swap_fresh_fresh)\n  apply (rule_tac s=\"aux ((atom x' \\<rightleftharpoons> atom a) \\<bullet> t') ((atom y' \\<rightleftharpoons> atom b) \\<bullet> s') ((a, b) # xs)\" in trans)\n  apply (rule_tac s=\"(atom y' \\<rightleftharpoons> atom b) \\<bullet> aux ((atom x' \\<rightleftharpoons> atom a) \\<bullet> t') s' ((a, y') # xs)\" in trans)\n  apply (rule permute_pure[symmetric])\n  apply (simp add: eqvts swap_fresh_fresh)\n  apply (simp add: lam.fresh fresh_at_base fresh_Pair_elim swap_fresh_fresh)\n  apply (subst permute_eqvt)\n  apply (simp add: eqvts swap_fresh_fresh)\n  apply (subgoal_tac \"(atom x' \\<rightleftharpoons> atom a) \\<bullet> t' = (atom x \\<rightleftharpoons> atom a) \\<bullet> t\")\n  apply (subgoal_tac \"(atom y' \\<rightleftharpoons> atom b) \\<bullet> s' = (atom y \\<rightleftharpoons> atom b) \\<bullet> s\")\n  apply simp\n  apply (subgoal_tac \"Lam [y]. s = Lam [b]. ((atom y \\<rightleftharpoons> atom b) \\<bullet> s)\")\n  apply (subgoal_tac \"Lam [y']. s' = Lam [b]. ((atom y' \\<rightleftharpoons> atom b) \\<bullet> s')\")\n  apply (auto simp add: fresh_Pair_elim Abs1_eq_iff)[1]\n  apply (rule sym)\n  apply (simp add: Abs1_eq_iff fresh_Pair_elim fresh_at_base swap_commute)\n  apply (rule sym)\n  apply (simp add: Abs1_eq_iff fresh_Pair_elim fresh_at_base swap_commute)\n  apply (subgoal_tac \"Lam [x]. t = Lam [a]. ((atom x \\<rightleftharpoons> atom a) \\<bullet> t)\")\n  apply (subgoal_tac \"Lam [x']. t' = Lam [a]. ((atom x' \\<rightleftharpoons> atom a) \\<bullet> t')\")\n  apply (auto simp add: fresh_Pair_elim Abs1_eq_iff)[1]\n  apply (rule sym)\n  apply (simp add: Abs1_eq_iff fresh_Pair_elim fresh_at_base swap_commute)\n  apply (rule sym)\n  apply (simp add: Abs1_eq_iff fresh_Pair_elim fresh_at_base swap_commute)\n  apply (rule refl)\n  done\n\nlemma aux_induct:  \"\\<lbrakk>\\<And>xs n m. P xs (Var n) (Var m); \\<And>xs n l r. P xs (Var n) (App l r);\n \\<And>xs n x t. P xs (Var n) (Lam [x]. t);\n \\<And>xs l r n. P xs (App l r) (Var n);\n (\\<And>xs l1 r1 l2 r2. P xs l1 l2 \\<Longrightarrow> P xs r1 r2 \\<Longrightarrow> P xs (App l1 r1) (App l2 r2));\n \\<And>xs l r x t. P xs (App l r) (Lam [x]. t);\n \\<And>xs x t n. P xs (Lam [x]. t) (Var n);\n \\<And>xs x t l1 r1. P xs (Lam [x]. t) (App l1 r1);\n \\<And>x xs y s t.\n    atom x \\<sharp> (xs, Lam [y]. s) \\<and>\n    atom y \\<sharp> (x, xs, Lam [x]. t) \\<Longrightarrow> P ((x, y) # xs) t s \\<Longrightarrow> P xs (Lam [x]. t) (Lam [y]. s)\\<rbrakk>\n\\<Longrightarrow> P (a :: (name \\<times> name) list) b c\"\n  apply (induction_schema)\n  apply (rule_tac y=\"b\" and c=\"(a, c)\" in lam.strong_exhaust)\n  apply (rule_tac y=\"c\" and c=\"(name, a, b)\" in lam.strong_exhaust)\n  apply simp_all[3] apply (metis)\n  apply (rule_tac y=\"c\" and c=\"(name, a, b)\" in lam.strong_exhaust)\n  apply simp_all[3] apply (metis, metis, metis)\n  apply (rule_tac y=\"c\" and c=\"(name, a, b)\" in lam.strong_exhaust)\n  apply simp_all[3] apply (metis)\n  apply (simp add: fresh_star_def)\n  apply metis\n  apply lexicographic_order\n  done\n\nnominal_function swapequal :: \"lam \\<Rightarrow> lam \\<Rightarrow> (name \\<times> name) list \\<Rightarrow> bool\" where\n  \"swapequal l r [] \\<longleftrightarrow> l = r\"\n| \"atom x \\<sharp> (l, r, hl, hr, t) \\<Longrightarrow>\n    swapequal l r ((hl, hr) # t) \\<longleftrightarrow> swapequal ((hl \\<leftrightarrow> x) \\<bullet> l) ((hr \\<leftrightarrow> x) \\<bullet> r) t\"\n  unfolding eqvt_def swapequal_graph_def\n  apply (rule, perm_simp, rule, rule TrueI)\n  apply (case_tac x)\n  apply (case_tac c)\n  apply metis\n  apply (case_tac aa)\n  apply (rename_tac l r lst h t hl hr)\n  apply (rule_tac x=\"(l, r, hl, hr, t)\" and ?'a=\"name\" in obtain_fresh)\n  apply simp\n  apply simp\n  apply simp\n  apply clarify\n  apply (rule_tac s=\"(x \\<leftrightarrow> xa) \\<bullet> swapequal_sumC ((hla \\<leftrightarrow> x) \\<bullet> la, (hra \\<leftrightarrow> x) \\<bullet> ra, ta)\" in trans)\n  apply (simp only: permute_pure)\n  apply (simp add: eqvt_at_def fresh_Pair_elim)\n  apply (simp add: flip_fresh_fresh)\n  apply (subgoal_tac \"(x \\<leftrightarrow> xa) \\<bullet> (hla \\<leftrightarrow> x) \\<bullet> la = (hla \\<leftrightarrow> xa) \\<bullet> la\")\n  apply (subgoal_tac \"(x \\<leftrightarrow> xa) \\<bullet> (hra \\<leftrightarrow> x) \\<bullet> ra = (hra \\<leftrightarrow> xa) \\<bullet> ra\")\n  apply simp\n  apply (subst permute_eqvt)\n  apply (simp add: flip_fresh_fresh flip_eqvt)\n  apply (subst permute_eqvt)\n  apply (simp add: flip_fresh_fresh flip_eqvt)\n  done\n\nnominal_termination (eqvt) by lexicographic_order\n\nlemma var_eq_swapequal: \"atom ab \\<sharp> xs \\<Longrightarrow> swapequal (Var ab) (Var ab) xs\"\n  apply (induct xs)\n  apply simp\n  apply (case_tac a)\n  apply (simp add: fresh_Cons)\n  apply (rule_tac x=\"(ab, aa, b, xs)\" and ?'a=\"name\" in obtain_fresh)\n  apply (subst swapequal.simps)\n  apply (simp add: fresh_Pair lam.fresh)\n  apply (simp add: fresh_Pair_elim)\n  by (metis flip_at_base_simps(3) fresh_Pair fresh_at_base(2))\n\nlemma var_neq_swapequal:\n  \"atom ab \\<sharp> xs \\<Longrightarrow> ab \\<noteq> m \\<Longrightarrow> \\<not> swapequal (Var ab) (Var m) xs\"\n  \"atom ab \\<sharp> xs \\<Longrightarrow> ab \\<noteq> m \\<Longrightarrow> \\<not> swapequal (Var m) (Var ab) xs\"\n  apply (induct xs arbitrary: m)\n  apply simp_all[2]\n  apply (case_tac [!] a)\n  apply (simp_all add: fresh_Cons)\n  apply (rule_tac [!] x=\"(ab, aa, b, m, xs)\" and ?'a=\"name\" in obtain_fresh)\n  apply (subst swapequal.simps)\n  apply (auto simp add: fresh_Pair lam.fresh)[1]\n  apply (elim conjE)\n  apply (simp add: fresh_Pair_elim fresh_at_base permute_flip_at)\n  apply (subst swapequal.simps)\n  apply (auto simp add: fresh_Pair lam.fresh)[1]\n  apply (elim conjE)\n  apply (simp add: fresh_Pair_elim fresh_at_base permute_flip_at)\n  done\n\nlemma lookup_swapequal: \"lookup n m xs = swapequal (Var n) (Var m) xs\"\n  apply (induct xs arbitrary: m n)\n  apply simp\n  apply (case_tac a)\n  apply (rule_tac x=\"(n, m, aa, b, xs)\" and ?'a=\"name\" in obtain_fresh)\n  apply simp\n  apply (subst swapequal.simps)\n  apply (simp add: fresh_Pair lam.fresh fresh_Nil)\n  by (metis (hide_lams, mono_tags) flip_at_base_simps(3) flip_at_simps(1) fresh_Pair fresh_at_base(2) lam.perm_simps(1) var_eq_swapequal var_neq_swapequal(1) var_neq_swapequal(2))\n\nlemma swapequal_reorder: \"\n  a \\<noteq> x \\<Longrightarrow> a \\<noteq> y \\<Longrightarrow> b \\<noteq> x \\<Longrightarrow> b \\<noteq> y \\<Longrightarrow>\n  swapequal t s ((x, y) # (a, b) # xs) = swapequal t s ((a, b) # (x, y) # xs)\"\n  apply (rule_tac x=\"(a, b, x, y, t, s, xs)\" and ?'a=\"name\" in obtain_fresh)\n  apply (rule_tac x=\"(a, b, x, y, t, s, xs, aa)\" and ?'a=\"name\" in obtain_fresh)\n  apply (rename_tac f g)\n  apply (simp add: fresh_Pair_elim fresh_at_base)\n  apply (subst swapequal.simps)\n  apply (auto simp add: fresh_Pair fresh_Cons fresh_at_base)[1]\n  apply (subgoal_tac \"(x \\<leftrightarrow> f) \\<bullet> atom g \\<sharp> t\")\n  apply (subst swapequal.simps)\n  apply (simp add: fresh_Pair fresh_Cons fresh_permute_left)\n  apply rule apply assumption\n  apply (simp add: flip_at_base_simps fresh_at_base flip_def)\n  apply (subst swapequal.simps)\n  apply (simp add: fresh_Pair fresh_Cons fresh_at_base)\n  apply rule apply (rotate_tac 12)\n  apply assumption\n  apply (simp add: fresh_Pair fresh_Cons fresh_at_base)\n  apply (subst swapequal.simps)\n  apply (simp add: fresh_Pair fresh_Cons fresh_at_base fresh_permute_left)\n  apply (subgoal_tac \"(a \\<leftrightarrow> g) \\<bullet> atom f \\<sharp> t\")\n  apply rule apply assumption\n  apply (simp add: flip_at_base_simps fresh_at_base flip_def)\n  apply (simp add: flip_at_base_simps fresh_at_base flip_def)\n  apply (subgoal_tac \"(a \\<leftrightarrow> g) \\<bullet> (x \\<leftrightarrow> f) \\<bullet> t = (x \\<leftrightarrow> f) \\<bullet> (a \\<leftrightarrow> g) \\<bullet> t\")\n  apply (subgoal_tac \"(b \\<leftrightarrow> g) \\<bullet> (y \\<leftrightarrow> f) \\<bullet> s = (y \\<leftrightarrow> f) \\<bullet> (b \\<leftrightarrow> g) \\<bullet> s\")\n  apply simp\n  apply (subst permute_eqvt) apply (simp add: flip_eqvt)\n  apply (subst permute_eqvt) apply (simp add: flip_eqvt)\n  apply (simp add: flip_at_base_simps fresh_at_base flip_def)\n  done\n\nlemma swapequal_lambda:\n  assumes \"distinct xs \\<and> atom x \\<sharp> xs \\<and> atom y \\<sharp> xs\"\n  shows \"swapequal (Lam [x]. t) (Lam [y]. s) xs = swapequal t s ((x, y) # xs)\"\n  using assms\n  apply (induct xs arbitrary: t s x y)\n  apply (rule_tac x=\"(x, y, t, s)\" and ?'a=\"name\" in obtain_fresh)\n  apply (simp add: fresh_Pair_elim fresh_Nil)\n  apply (subst swapequal.simps)\n  apply (simp add: fresh_Pair fresh_Nil)\n  apply auto[1]\n  apply simp\n  apply (subgoal_tac \"[[atom x]]lst. t = [[atom a]]lst. ((x \\<leftrightarrow> a) \\<bullet> t)\")\n  apply (subgoal_tac \"[[atom y]]lst. s = [[atom a]]lst. ((y \\<leftrightarrow> a) \\<bullet> s)\")\n  apply simp\n  apply (simp add: Abs1_eq_iff)\n  apply (auto simp add: Abs1_eq_iff flip_def fresh_at_base)[2]\n  apply (simp add: fresh_permute_left)\n  apply (simp add: fresh_permute_left)\n  apply clarify\n  apply (simp add: fresh_Cons fresh_Pair fresh_at_base)\n  apply clarify\n  apply (simp add: swapequal_reorder)\n  apply (rule_tac x=\"(x, y, t, s, a, b, xs)\" and ?'a=\"name\" in obtain_fresh)\n  apply (rename_tac f)\n  apply (subst (2) swapequal.simps)\n  apply (auto simp add: lam.fresh fresh_Pair fresh_at_base fresh_Cons)[1]\n  apply (subst swapequal.simps)\n  apply (auto simp add: lam.fresh fresh_Pair fresh_at_base fresh_Cons)[1]\n  apply (simp add: flip_def fresh_Pair_elim fresh_at_base)\n  done\n\nlemma distinct_swapequal: \"\\<forall>p q. p \\<bullet> l \\<noteq> q \\<bullet> r \\<Longrightarrow> \\<not>swapequal l r xs\"\n  apply (induct xs rule:swapequal.induct)\n  apply auto[1]\n  apply (simp add: fresh_Pair_elim)\n  apply (subgoal_tac \"\\<forall>(p\\<Colon>perm) q\\<Colon>perm. p \\<bullet> (hl \\<leftrightarrow> x) \\<bullet> l \\<noteq> q \\<bullet> (hr \\<leftrightarrow> x) \\<bullet> r\")\n  apply simp\n  apply (intro allI)\n  apply (drule_tac x=\"p + (hl \\<leftrightarrow> x)\" in spec)\n  apply (drule_tac x=\"q + (hr \\<leftrightarrow> x)\" in spec)\n  apply simp\n  done\n\nlemma swapequal_app: \"(swapequal l1 l2 xs \\<and> swapequal r1 r2 xs) = swapequal (App l1 r1) (App l2 r2) xs\"\n  apply (induct xs arbitrary: l1 l2 r1 r2)\n  apply simp\n  apply (case_tac a)\n  apply simp\n  apply (rule_tac x=\"(l1, l2, r1, r2, aa, b, xs)\" and ?'a=\"name\" in obtain_fresh)\n  apply (simp add: fresh_Pair_elim)\n  apply (subst swapequal.simps) apply (auto simp add: fresh_Pair)[1]\n  apply (subst swapequal.simps) apply (auto simp add: fresh_Pair lam.fresh)\n  done\n\n\n\nlemma [simp]:\n  \"atom x \\<sharp> xs \\<Longrightarrow> x \\<notin> fst ` set xs\"\n  \"atom x \\<sharp> xs \\<Longrightarrow> x \\<notin> snd ` set xs\"\n  apply (induct xs)\n  apply simp_all\n  apply (case_tac [!] a)\n  apply (simp_all add: fresh_Cons fresh_Pair fresh_at_base)\n  done\n\nlemma aux_alphaish:\n  assumes \"distinct (map fst xs @ map snd xs)\"\n  shows \"aux x y xs \\<longleftrightarrow> swapequal x y xs\"\n  using assms\n  apply (induct xs x y rule: aux_induct)\n  apply (simp add: lookup_swapequal)\n  apply (simp, rule distinct_swapequal, simp)+\n  apply (simp add: swapequal_app)\n  apply (simp, rule distinct_swapequal, simp)+\n  apply (simp add: fresh_Pair_elim lam.fresh fresh_at_base conjE)\n  apply (elim conjE)\n  apply (simp add: fresh_Pair_elim lam.fresh fresh_at_base)\n  apply (subgoal_tac \"x \\<notin> fst ` set xs \\<and>\n        x \\<notin> snd ` set xs \\<and> y \\<notin> snd ` set xs \\<and> y \\<notin> fst ` set xs\")\n  apply (subst swapequal_lambda)\n  apply auto[2]\n  apply simp\n  done\n\nlemma aux_is_alpha:\n  \"aux x y [] \\<longleftrightarrow> (x = y)\"\n  by (simp_all add: supp_Nil aux_alphaish)\n\nend\n\n\n\n", "meta": {"author": "goodlyrottenapple", "repo": "Nominal2-Isabelle", "sha": "214274ed6db74c19b8694fc5c8dd9cafa13b056a", "save_path": "github-repos/isabelle/goodlyrottenapple-Nominal2-Isabelle", "path": "github-repos/isabelle/goodlyrottenapple-Nominal2-Isabelle/Nominal2-Isabelle-214274ed6db74c19b8694fc5c8dd9cafa13b056a/Nominal/Ex/AuxNoFCB.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737473266735, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3386206242076053}}
{"text": "theory Soundness\nimports Rules\nbegin\n\nsection \\<open>Soundness\\<close>\n\nsubsection \\<open>Common lemmas that are used in multiple lemmas\\<close>\n\nlemma done_one_step:\n  \"(DONE, s) \\<rightarrow> (f', s') \\<Longrightarrow> f' = DONE \\<and> s' = s\"\n  by (erule DoneE; simp add: true_def)\n\nlemma done_star:\n  \"\\<lbrakk> (f, s) \\<rightarrow>* (f', s'); f = DONE \\<rbrakk> \\<Longrightarrow> f' = DONE \\<and> s' = s\"\n  apply (induction rule: star_induct; clarsimp)\n  by (simp add: done_one_step)\n\nlemma aborted_one_step:\n  \"(ABORTED, s) \\<rightarrow> (f', s') \\<Longrightarrow> f' = ABORTED \\<and> s' = s\"\n  by (erule AbortE; simp add: true_def)\n\nlemma aborted_star:\n  \"\\<lbrakk> (f, s) \\<rightarrow>* (f', s'); f = ABORTED \\<rbrakk> \\<Longrightarrow> f' = ABORTED \\<and> s' = s\"\n  apply (induction rule: star_induct; clarsimp)\n  by (simp add: aborted_one_step)\n\n(* if f makes a step to f', the actions of f' is a subset of the actions of f *)\nlemma actions_of_one_step:\n  \"\\<lbrakk> (f, s) \\<rightarrow> (f', s'); action \\<in> actions_of f' \\<rbrakk> \\<Longrightarrow> action \\<in> actions_of f\"\n  apply (induction rule: small_step_induct; clarsimp)\n   apply (metis actions_of.simps(8) empty_iff in_set_conv_nth length_list_update nth_list_update_eq nth_list_update_neq nth_mem)\n  using set_update_subset_insert by fastforce\n\nlemma invariant_all_reachable_sat':\n  \"\\<lbrakk> (f, s) \\<rightarrow>* (f', s'); i s; \\<forall>f' s'. (f, s) \\<rightarrow>* (f', s') \\<longrightarrow> \n  (\\<forall>f'' s''. i s' \\<and> (f', s') \\<rightarrow> (f'', s'') \\<longrightarrow> i s'') \\<rbrakk> \\<Longrightarrow> \n  i s'\"\n  apply (induction rule: star_induct, simp)\n  by (metis star.refl star.step)\n\n(* i holds at any point in the execution *)\nlemma invariant_all_reachable_sat:\n  \"invariant i f s \\<Longrightarrow> reachable_sat (\\<lambda>f' s'. i s') f s\"\n  apply (clarsimp simp: invariant_def stable_def co_def reachable_sat_def)\n  by (metis invariant_all_reachable_sat')\n\nlemma not_aborted:\n  \"\\<Turnstile> {r} f {Q | t} \\<Longrightarrow> \\<forall>s. r s \\<longrightarrow> reachable_sat (\\<lambda>f' s'. f' \\<noteq> ABORTED) f s\"\n  apply (clarsimp simp: valid_spec_def reachable_sat_def holds_def)\n  by (metis has_terminated.simps(2))\n\n\nsubsection \\<open>Sequential Programs\\<close>\n\nlemma action_sound':\n  \"\\<lbrakk> (f, s) \\<rightarrow>* (f', s'); f = \\<lbrace>pre\\<rbrace> ACTION state_rel; pre s; \n  \\<forall>s s'. (s, s') \\<in> state_rel \\<and> pre s \\<longrightarrow> t s'; has_terminated f' \\<rbrakk> \\<Longrightarrow> \n  holds t f' s'\"\n  apply (induction rule: star_induct; simp)\n  apply (erule ActionE, simp)\n   apply (metis Validity.holds_def com.distinct(1) done_star)\n  by blast\n\nlemma action_sound[simp]:\n  \"\\<lbrakk> \\<forall>s. r s \\<longrightarrow> pre s; \\<forall>s s'. (s, s') \\<in> state_rel \\<and> pre s \\<longrightarrow> t s' \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {r} \\<lbrace>pre\\<rbrace> ACTION state_rel {{} | t}\"\n  by (clarsimp simp: valid_spec_def reachable_sat_def action_sound')\n\nlemma pre_implies_annotation:\n  \"\\<lbrakk> \\<Turnstile> {r} f {{} | t}; r s \\<rbrakk> \\<Longrightarrow> com_pre f s\" \n  apply (clarsimp simp: valid_spec_def reachable_sat_def holds_def)\n  by (metis Abort has_terminated.simps(2) star.refl star.step)\n\nlemma semi_sound':\n  \"\\<lbrakk> (f, s) \\<rightarrow>* (f', s'); f = c\\<^sub>1;;c\\<^sub>2; \\<Turnstile> {r} c\\<^sub>1 {{} | m}; \\<Turnstile> {m} c\\<^sub>2 {{} | t}; r s; \n  has_terminated f' \\<rbrakk> \\<Longrightarrow> \n  holds t f' s'\"\n  apply (induction arbitrary: c\\<^sub>1 c\\<^sub>2 r rule: star_induct, simp_all)\n  apply (erule SemiE, simp add: pre_implies_annotation)\n  apply (unfold valid_spec_def reachable_sat_def)\n   apply (subgoal_tac \"m s'\", simp+)\n   apply (simp add: holds_def)\n  using has_terminated.simps(1) apply blast\n  by (clarsimp, metis curryD curryI star.step)\n\nlemma semi_sound[simp]: \n  \"\\<lbrakk> \\<Turnstile> {r} c\\<^sub>1 {{} | m}; \\<Turnstile> {m} c\\<^sub>2 {{} | t} \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r} c\\<^sub>1;;c\\<^sub>2 {{} | t}\"\n  by (auto simp: valid_spec_def reachable_sat_def semi_sound')\n\nlemma if_sound':\n  \"\\<lbrakk> (\\<lbrace>pre\\<rbrace> IF b THEN c\\<^sub>1 ELSE c\\<^sub>2, s) \\<rightarrow>* (f', s'); r s; pre s; has_terminated f'; \n  \\<Turnstile> {r and b} c\\<^sub>1 {{} | t}; \\<Turnstile> {r and not b} c\\<^sub>2 {{} | t} \\<rbrakk> \\<Longrightarrow>\n  holds t f' s'\"\n  apply (erule StarE, simp)\n  apply (erule IfE, simp)\n  by (clarsimp simp: valid_spec_def reachable_sat_def holds_def)+\n\nlemma if_sound[simp]:\n  \"\\<lbrakk> \\<forall>s. r s \\<longrightarrow> pre s; \\<Turnstile> {r and b} c\\<^sub>1 {{} | t}; \\<Turnstile> {r and not b} c\\<^sub>2 {{} | t} \\<rbrakk> \\<Longrightarrow>\n  \\<Turnstile> {r} \\<lbrace>pre\\<rbrace> IF b THEN c\\<^sub>1 ELSE c\\<^sub>2 {{} | t}\"\n  by (clarsimp simp: valid_spec_def reachable_sat_def if_sound')\n\ntext \\<open>\n  @{text \"exec c n c'\"} returns true if @{text c} can reach @{text \"c'\"} by executing small \n  step (@{text \"\\<rightarrow>\"}) n times, and return false otherwise. This is useful to prove the soundness of\n  while loop so that we can do induction on the number of steps.\n\\<close>\nprimrec exec :: \"(com \\<times> state) \\<Rightarrow> nat \\<Rightarrow> (com \\<times> state) \\<Rightarrow> bool\"  (\"_ \\<rightarrow>^_ _\" [55, 1000, 55] 55)\n  where\n  \"c \\<rightarrow>^0 c' = (c = c')\"\n| \"c \\<rightarrow>^(Suc n) c' = (\\<exists>c''. c \\<rightarrow> c'' \\<and> c'' \\<rightarrow>^n c')\"\n\nlemma star_implies_exec: \"c \\<rightarrow>* c' \\<Longrightarrow> \\<exists>n. c \\<rightarrow>^n c'\"\n  apply (induction rule: star.induct)\n  using exec.simps by blast+\n\nlemma exec_implies_star: \"c \\<rightarrow>^n c' \\<Longrightarrow> c \\<rightarrow>* c'\"\n  apply (induction n arbitrary: c, simp)\n  by (clarsimp simp: star.step)\n\nlemma exec_eq_star: \"c \\<rightarrow>* c' = (\\<exists>n. c \\<rightarrow>^n c')\"\n  by (auto simp: star_implies_exec exec_implies_star)\n\nlemma semi_exec_done:\n  \"\\<lbrakk> (c\\<^sub>1;;c\\<^sub>2, s) \\<rightarrow>^n (DONE, s') \\<rbrakk> \\<Longrightarrow>\n  \\<exists>i j s''. (c\\<^sub>1, s) \\<rightarrow>^i (DONE, s'') \\<and> j < n \\<and> (c\\<^sub>2, s'') \\<rightarrow>^j (DONE, s')\"\n  apply (induction n arbitrary: c\\<^sub>1 s, simp)\n  apply (clarsimp, erule SemiE)\n  using aborted_star exec_implies_star apply blast\n  using exec.simps apply blast\n  by (clarsimp, meson exec.simps(2) less_Suc_eq)\n\nlemma semi_exec_aborted:\n  \"\\<lbrakk> (c\\<^sub>1;;c\\<^sub>2, s) \\<rightarrow>^n (ABORTED, s') \\<rbrakk> \\<Longrightarrow>\n  (\\<exists>i. (c\\<^sub>1, s) \\<rightarrow>^i (ABORTED, s')) \\<or> \n  (\\<exists>i j s''. (c\\<^sub>1, s) \\<rightarrow>^i (DONE, s'') \\<and> j < n \\<and> (c\\<^sub>2, s'') \\<rightarrow>^j (ABORTED, s'))\"\n  apply (induct n arbitrary: c\\<^sub>1 s, simp)\n  apply (clarsimp, erule SemiE)\n    apply (simp, metis Abort exec.simps(2))\n   apply (clarsimp, erule_tac x=1 in allE, clarsimp)\n  by (clarsimp, meson exec.simps(2) less_Suc_eq)\n\nlemma not_aborted_exec:\n  \"\\<lbrakk> \\<Turnstile> {r} c {{} | i}; r s; (c, s) \\<rightarrow>^j (ABORTED, s') \\<rbrakk> \\<Longrightarrow> False\"\n  apply (frule not_aborted, clarsimp simp: reachable_sat_def exec_eq_star)\n  by blast\n\nlemma while_body_invariant:\n  \"\\<lbrakk> \\<Turnstile> {r} c {{} | i}; r s; (c, s) \\<rightarrow>^n (DONE, s') \\<rbrakk> \\<Longrightarrow> i s'\"\n  apply (simp add: valid_spec_def reachable_sat_def holds_def)\n  using exec_implies_star has_terminated.simps(1) by blast\n\nlemma has_terminated_aborted_or_done:\n  \"has_terminated f \\<Longrightarrow> f = ABORTED \\<or> f = DONE\"\n  using has_terminated.elims(2) by blast\n\nlemma action_skip_one_step:\n  \"\\<lbrakk> (f, s) \\<rightarrow> (f', s'); f = \\<lbrace>i\\<rbrace> ACTION {(x, y). x = y}; i s \\<rbrakk> \\<Longrightarrow> s = s'\"\n  by blast\n\nlemma action_skip_star:\n  \"\\<lbrakk> (f, s) \\<rightarrow>* (f', s'); f = \\<lbrace>i and not b\\<rbrace> ACTION {(x, y). x = y}; (not b) s; i s \\<rbrakk> \\<Longrightarrow> \n  f' \\<noteq> ABORTED \\<and> s = s'\"\n  apply (induction rule: star_induct; simp)\n  by (metis (no_types, lifting) ActionE action_skip_one_step com.distinct(1) com_pre.simps(3) done_star prod.inject)\n\nlemma while_sounds'':\n  \"\\<lbrakk> (f, s) \\<rightarrow>^n (f', s'); f = \\<lbrace>i\\<rbrace> \\<lbrace>local_b\\<rbrace> WHILE b i DO c; i s; \\<forall>s. (i and b) s \\<longrightarrow> com_pre c s;\n  \\<Turnstile> {com_pre c} c {{} | i}; \\<forall>s. (not b) s \\<longrightarrow> (not local_b) s; \\<forall>s. (i and not local_b) s \\<longrightarrow> t s; \n  has_terminated f' \\<rbrakk> \\<Longrightarrow>\n  holds t f' s'\"\n  apply (unfold holds_def)\n  apply (induction n arbitrary: s rule: nat_less_induct)\n  apply (case_tac n, clarsimp+)\n  apply (erule WhileE, simp add: true_def)\n   apply (frule has_terminated_aborted_or_done, erule disjE; simp)\n    apply (clarsimp, drule semi_exec_aborted)\n    apply (meson less_SucI not_aborted_exec while_body_invariant)\n   apply (metis less_SucI semi_exec_done while_body_invariant)\n  apply (frule exec_implies_star)\n  by (frule_tac i=i and b=\"local_b\" in action_skip_star; simp)\n\nlemma while_semi_sound':\n  \"\\<lbrakk> (f, s) \\<rightarrow>^n (f', s'); f = c;;\\<lbrace>i\\<rbrace> \\<lbrace>local_b\\<rbrace> WHILE b i DO c; i s; b s;\n  \\<forall>s. (i and b) s \\<longrightarrow> com_pre c s; \\<Turnstile> {com_pre c} c {{} | i};\n  \\<forall>s. (not b) s \\<longrightarrow> (not local_b) s; \\<forall>s. (i and not local_b) s \\<longrightarrow> t s; has_terminated f' \\<rbrakk> \\<Longrightarrow>\n  holds t f' s'\"\n  apply (frule has_terminated_aborted_or_done, erule disjE; simp)\n   apply (drule semi_exec_aborted, erule disjE; clarsimp?)\n  using not_aborted_exec apply blast\n  using has_terminated.simps(2) while_body_invariant while_sounds'' apply blast\n  apply (drule semi_exec_done, clarsimp)\n  using has_terminated.simps(1) while_body_invariant while_sounds'' by blast\n\nlemma while_sound':\n  \"\\<lbrakk> (f, s) \\<rightarrow>^n (f', s'); f = \\<lbrace>pre\\<rbrace> \\<lbrace>local_b\\<rbrace> WHILE b i DO c;  \\<forall>s. pre s \\<longrightarrow> i s; \n  \\<forall>s. (i and b) s \\<longrightarrow> com_pre c s; \\<Turnstile> {com_pre c} c {{} | i}; pre s;\n  \\<forall>s. (not b) s \\<longrightarrow> (not local_b) s; \\<forall>s. (i and not local_b) s \\<longrightarrow> t s; has_terminated f' \\<rbrakk> \\<Longrightarrow>\n  holds t f' s'\"\n  apply (case_tac n, clarsimp+)\n  apply (erule WhileE; simp add: while_semi_sound')\n  apply (frule exec_implies_star, unfold holds_def)\n  by (frule_tac b=\"local_b\" and i=i in action_skip_star; simp)\n \nlemma while_sound[simp]:\n  \"\\<lbrakk> \\<forall>s. pre s \\<longrightarrow> i s; \\<forall>s. (i and b) s \\<longrightarrow> com_pre c s; \\<Turnstile> {com_pre c} c {{} | i}; \n  \\<forall>s. (not b) s \\<longrightarrow> (not local_b) s; \\<forall>s. (i and not local_b) s \\<longrightarrow> t s \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {pre} \\<lbrace>pre\\<rbrace> \\<lbrace>local_b\\<rbrace> WHILE b i DO c {{} | t}\"\n  by (clarsimp simp: valid_spec_def reachable_sat_def while_sound' exec_eq_star)\n\n\nsubsection \\<open>Parallel Programs\\<close>\n\nlemma and_map_com_pre_Ps1:\n  \"And (map com_pre Ps) s \\<Longrightarrow> \\<forall>i<length Ps. com_pre (Ps!i) s\"\n  by (induction Ps; simp add: nth_Cons')\n\nlemma and_map_com_pre_Ps2:\n  \"\\<forall>i<length Ps. com_pre (Ps!i) s \\<Longrightarrow> And (map com_pre Ps) s\"\n  apply (induction Ps, simp add: true_def)\n  by fastforce\n\nlemma and_Ts:\n  \"\\<forall>i<length Ts. (Ts!i) s \\<Longrightarrow> And Ts s\"\n  apply (induction Ts, simp add: true_def)\n  by fastforce\n\n(* if p is stable in f, and f makes a step to f', then p is stable in f' *)\nlemma is_ann_stable_one_step:\n  \"\\<lbrakk> (f, s) \\<rightarrow> (f', s'); is_ann_stable p f \\<rbrakk> \\<Longrightarrow> is_ann_stable p f'\"\n  apply (unfold is_ann_stable_def)\n  by (blast dest: actions_of_one_step)\n\nlemma all_anns_post_ann:\n  \"\\<lbrakk> p \\<in> all_anns_par (map all_anns (Ps[i := \\<lbrace>Ts ! i\\<rbrace> POSTANN])) Ts; i < length Ps;\n  length Ps = length Ts \\<rbrakk> \\<Longrightarrow> \n  p \\<in> all_anns_par (map all_anns Ps) Ts\"\n  apply (induction Ps arbitrary: i p Ts; simp)\n  apply (case_tac i; simp)\n   apply (case_tac Ts; simp)\n   apply blast\n  apply (case_tac Ts; simp)\n  by auto\n\nlemma all_anns_one_step:\n  \"\\<lbrakk> Ps' = Ps[i := c']; i < length Ps; p \\<in> all_anns_par (map all_anns Ps') Ts; \n  \\<And>p. p \\<in> all_anns c' \\<Longrightarrow> p \\<in> all_anns (Ps ! i); length Ps = length Ts;\n  (Ps ! i, s) \\<rightarrow> (c', s'); c' \\<noteq> DONE \\<rbrakk> \\<Longrightarrow>\n  p \\<in> all_anns_par (map all_anns Ps) Ts\"\n  apply (induction Ps arbitrary: Ps' i p c' s s' Ts; simp)\n  apply (case_tac i; auto)\n   apply (case_tac Ts; simp)\n   apply meson\n  apply (case_tac Ts; simp)\n  by auto\n\nlemma all_anns_is_subset:     \n  \"\\<lbrakk> (g, s) \\<rightarrow> (g', s'); p \\<in> all_anns g'; com_pre g s; \\<turnstile> {com_pre g} g {t}; g' \\<noteq> DONE \\<rbrakk> \\<Longrightarrow> \n  p \\<in> all_anns g\"\n  apply (induction arbitrary: p t rule: small_step_induct; clarsimp)\n  using semi_elim apply blast\n  using all_anns_post_ann par_elim apply blast\n  apply (frule par_elim; simp; clarsimp)\n  by (metis (mono_tags, lifting) Post_annE all_anns_one_step and_map_com_pre_Ps1)\n\n(* if g is stable in h and g makes a step to g', g' is also stable in h *)\nlemma is_com_stable_one_step1:\n  \"\\<lbrakk> (g, s) \\<rightarrow> (g', s'); is_com_stable g h; com_pre g s; \\<turnstile> {com_pre g} g {t} \\<rbrakk> \\<Longrightarrow> \n  is_com_stable g' h\"\n  apply (clarsimp simp: is_com_stable_def all_anns_is_subset)\n  apply (case_tac \"g' = DONE\", clarsimp)\n   apply (simp add: is_ann_stable_def true_def)\n  by (simp add: all_anns_is_subset)\n\n(* if g is stable in h and h makes a step to h', g is also stable in h' *)\nlemma is_com_stable_one_step2:\n  \"\\<lbrakk> (h, s) \\<rightarrow> (h', s'); is_com_stable g h \\<rbrakk> \\<Longrightarrow> is_com_stable g h'\"\n  by (simp add: is_com_stable_def is_ann_stable_one_step)\n\nlemma com_pre_all_anns_par:\n  \"\\<lbrakk> \\<And>c r t. \\<lbrakk> c \\<in> set Ps; \\<turnstile> {r} c {t} \\<rbrakk> \\<Longrightarrow> com_pre c \\<in> all_anns c; length Ps = length Ts;\n  \\<forall>i<length Ts. \\<turnstile> {com_pre (Ps ! i)} Ps ! i {Ts ! i} \\<or> Ps ! i = \\<lbrace>Ts ! i\\<rbrace> POSTANN \\<rbrakk> \\<Longrightarrow> \n  com_pre (PARALLEL Ps Ts) \\<in> all_anns (PARALLEL Ps Ts)\"\n  apply (induction Ps arbitrary: Ts; auto)\n  apply (case_tac Ts; simp)\n  apply (drule_tac x=list in meta_spec)\n  apply (drule meta_mp; clarsimp)\n  by (drule meta_mp; fastforce)\n\n(* the local annotation of a component is in its set of annotations *)\nlemma com_pre_in_all_anns:\n  \"\\<turnstile> {r} f {t} \\<Longrightarrow> com_pre f \\<in> all_anns f\"\n  apply (induction f arbitrary: r t; auto)\n  using semi_elim apply blast\n  apply (rename_tac Ps Ts r t)\n  apply (frule par_elim; simp; clarsimp)\n  using com_pre_all_anns_par by auto\n\nlemma ann_stable_holds_one_step:\n  \"\\<lbrakk> (f, s) \\<rightarrow> (f', s'); is_ann_stable p f; p s \\<rbrakk> \\<Longrightarrow> p s'\"\n  apply (unfold is_ann_stable_def)\n  apply (induction rule: small_step_induct; simp)\n  by fastforce+\n\nlemma com_pre_and_derivable_done_par:\n  \"\\<lbrakk> i < length Ps; \\<forall>j<length Ps. (not (=) j) i \\<longrightarrow> Ps ! j = \\<lbrace>Ts ! j\\<rbrace> POSTANN; Ps ! i = c; \n  (c, s) \\<rightarrow> (DONE, s'); \\<And>t. \\<lbrakk>com_pre c s; \\<turnstile> {com_pre c} c {t}\\<rbrakk> \\<Longrightarrow> t s';\n  And (map com_pre Ps) s; \\<turnstile> {And (map com_pre Ps)} PARALLEL Ps Ts {t} \\<rbrakk> \\<Longrightarrow> \n  t s'\"\n  apply (frule par_elim; simp; clarsimp)\n  apply (drule_tac x=\"Ts ! i\" in meta_spec)\n  apply (drule meta_mp, simp add: and_map_com_pre_Ps1)\n  apply (subgoal_tac \"And Ts s'\"; simp?)\n  apply (rule and_Ts; clarsimp)\n  apply (case_tac \"iaa = i\", fastforce)\n  apply (erule_tac x=iaa in allE; clarsimp)\n  apply (frule and_map_com_pre_Ps1)\n  apply (erule_tac x=iaa in allE; clarsimp)+\n  apply (clarsimp simp: valid_ann_def valid_ann'_def)\n  by (frule ann_stable_holds_one_step; simp)\n\n(* a component that goes to DONE satisfies its postcondition *)\nlemma com_pre_and_derivable_done:\n  \"\\<lbrakk> (f, s) \\<rightarrow> (f', s'); com_pre f s; \\<turnstile> {com_pre f} f {t}; f' = DONE \\<rbrakk> \\<Longrightarrow> t s'\"\n  apply (induction arbitrary: t rule: small_step_induct; simp)\n       apply (metis done_elim)\n      apply (metis action_elim)\n     apply (metis semi_elim done_elim)\n    apply (metis if_elim done_elim)\n   apply (metis if_elim done_elim)\n  by (metis com_pre_and_derivable_done_par)\n\n(* the precondition of a parallel composition remains valid after making a step *)\nlemma par_done_pre_holds_one_step:\n  \"\\<lbrakk> (Ps ! i, s) \\<rightarrow> (DONE, s'); And (map com_pre Ps) s; i < length Ps; valid_ann Ps Ts;\n  length Ps = length Ts; Ps' = Ps[i := \\<lbrace>Ts ! i\\<rbrace> POSTANN];\n  \\<forall>i<length Ts. \\<turnstile> {com_pre (Ps ! i)} Ps ! i {Ts ! i} \\<or> Ps ! i = \\<lbrace>Ts ! i\\<rbrace> POSTANN \\<rbrakk> \\<Longrightarrow>\n  And (map com_pre Ps') s'\"\n  apply (rule and_map_com_pre_Ps2)\n  apply (clarsimp simp: valid_ann_def valid_ann'_def)\n  apply (case_tac \"i = ia\"; simp)\n   apply (erule_tac x=ia in allE; simp)+\n   apply (erule disjE)\n    apply (frule_tac t = \"Ts!i\" in com_pre_and_derivable_done)\n       apply (simp add: and_map_com_pre_Ps1)+\n   apply (erule Post_annE; simp)\n  apply (erule_tac x=ia in allE)+\n  apply clarsimp\n  apply (erule_tac x=i in allE; clarsimp)+\n  apply (erule disjE)\n   apply (frule_tac f=\"Ps!i\" and p=\"com_pre (Ps!ia)\" in ann_stable_holds_one_step)\n  using com_pre_in_all_anns is_com_stable_def apply blast\n    apply (simp add: and_map_com_pre_Ps1)+\n  using and_map_com_pre_Ps1 ann_stable_holds_one_step com_pre.simps(8) by fastforce\n\n(* after the parallel composition makes a step, it is still derivable *)\nlemma par_done_derivable_one_step:\n  \"\\<lbrakk> valid_ann Ps Ts; \\<forall>i<length Ts. \\<turnstile> {com_pre (Ps ! i)} Ps ! i {Ts ! i} \\<or> Ps ! i = \\<lbrace>Ts ! i\\<rbrace> POSTANN; \n  \\<forall>s. And Ts s \\<longrightarrow> t s; Ps' = Ps[i := \\<lbrace>Ts ! i\\<rbrace> POSTANN]; length Ps = length Ts; length Ps > 0;\n  j < length Ts; (not (=) j) i; (not (=) (Ps ! j)) (\\<lbrace>Ts ! j\\<rbrace> POSTANN) \\<rbrakk> \\<Longrightarrow> \n  \\<turnstile> {com_pre (PARALLEL Ps' Ts)} PARALLEL Ps' Ts {And Ts}\"\n  apply (rule b_par; simp)\n    apply (clarsimp simp: valid_ann_def valid_ann'_def)\n    apply (rule conjI)\n     apply (metis actions_of.simps(8) empty_iff is_ann_stable_def nth_list_update nth_list_update_neq)\n    apply (case_tac \"i = ia\"; simp add: is_com_stable_def)\n    apply (metis actions_of.simps(8) empty_iff is_ann_stable_def is_com_stable_def nth_list_update_eq nth_list_update_neq)\n   apply (metis nth_list_update nth_list_update_neq)\n  by auto\n\nlemma com_pre_one_step:\n  \"\\<lbrakk> (c, s) \\<rightarrow> (c', s'); com_pre c s; \\<turnstile> {com_pre c} c {t} \\<rbrakk> \\<Longrightarrow> com_pre c' s'\"\n  apply (induction arbitrary: t rule: small_step_induct; clarsimp simp: true_def)\n         apply (simp add: com_pre_and_derivable_done semi_elim)\n        apply (blast dest: semi_elim)\n       apply (simp add: if_elim)\n      apply (simp add: if_elim)\n     apply (simp add: while_elim)\n    apply (simp add: while_elim)\n  using par_done_pre_holds_one_step par_elim apply auto[1]\n  apply (frule par_elim; simp; clarsimp)\n  apply (rule and_map_com_pre_Ps2; clarsimp)\n  apply (case_tac \"i = ib\"; simp)\n  using and_map_com_pre_Ps1 apply fastforce\n  apply (clarsimp simp: valid_ann_def valid_ann'_def)\n  apply (subgoal_tac \"\\<turnstile> {com_pre (Ps!ib)} Ps!ib {Ts!ib} \\<or> Ps!ib = \\<lbrace>Ts!ib\\<rbrace> POSTANN\")\n   apply (erule disjE)\n   apply (frule_tac r=\"com_pre (Ps!ib)\" in com_pre_in_all_anns)\n    apply (simp add: and_map_com_pre_Ps1 ann_stable_holds_one_step is_com_stable_def)\n   apply (metis and_map_com_pre_Ps1 ann_stable_holds_one_step com_pre.simps(8))\n  by auto\n\nlemma par_not_done_pre_holds_one_step:\n  \"\\<lbrakk> (Ps ! i, s) \\<rightarrow> (c', s'); c' \\<noteq> DONE; And (map com_pre Ps) s; i < length Ps; valid_ann Ps Ts;\n  length Ps = length Ts; Ps' = Ps[i := c']; \n  \\<forall>i<length Ts. \\<turnstile> {com_pre (Ps ! i)} Ps ! i {Ts ! i} \\<or> Ps ! i = \\<lbrace>Ts ! i\\<rbrace> POSTANN \\<rbrakk> \\<Longrightarrow>\n  And (map com_pre Ps') s'\"\n  apply (rule and_map_com_pre_Ps2)\n  apply (clarsimp simp: valid_ann_def valid_ann'_def)\n  apply (case_tac \"i = ia\"; simp)\n   apply (erule_tac x=i in allE)+\n   apply simp\n   apply (erule disjE)\n    apply (simp add: and_map_com_pre_Ps1 com_pre_one_step)\n   apply clarsimp\n   apply (erule Post_annE; simp add: false_def)\n  using and_map_com_pre_Ps1 apply force\n  apply (subgoal_tac \"\\<turnstile> {com_pre (Ps!ia)} Ps!ia {Ts!ia} \\<or> Ps!ia = \\<lbrace>Ts!ia\\<rbrace> POSTANN\")\n   apply (erule disjE)\n    apply (frule_tac r=\"com_pre (Ps!ia)\" in com_pre_in_all_anns)\n    apply (simp add: and_map_com_pre_Ps1 ann_stable_holds_one_step is_com_stable_def)\n   apply (metis and_map_com_pre_Ps1 ann_stable_holds_one_step com_pre.simps(8))\n  by auto\n\nlemma valid_ann_step:\n  \"\\<lbrakk> (Ps!i, s) \\<rightarrow> (c', s'); i < length Ps; valid_ann Ps Ts;\n  com_pre (Ps!i) s; \\<turnstile> {com_pre (Ps ! i)} Ps!i {t} \\<rbrakk> \\<Longrightarrow>\n  valid_ann (Ps[i:=c']) Ts\"\n  apply (clarsimp simp: valid_ann_def valid_ann'_def)\n  apply (case_tac \"ia = i\")\n  by (simp add: is_ann_stable_one_step is_com_stable_one_step1 is_com_stable_one_step2 nth_list_update)+\n\nlemma par_not_done_derivable_one_step:\n  \"\\<lbrakk> i < length Ts; (Ps ! i, s) \\<rightarrow> (c', s'); And (map com_pre Ps) s; \n  \\<turnstile> {And (map com_pre Ps)} PARALLEL Ps Ts {t}; Ps' = Ps[i := c'];\n  com_pre c' s'; \\<turnstile> {com_pre c'} c' {Ts ! i} \\<rbrakk> \\<Longrightarrow>\n  \\<turnstile> {com_pre (PARALLEL Ps' Ts)} PARALLEL Ps' Ts {And Ts}\"\n  apply (frule par_elim, simp)\n  apply (rule b_par; clarsimp)\n    apply (metis Post_annE and_map_com_pre_Ps1 valid_ann_step)\n   apply (metis nth_list_update)\n  by (metis nth_list_update_eq post_ann_elim)\n\n(* derivability is preserved here. this lemma can't be proved if the rules are not stratified. *)\nlemma com_pre_and_derivable_one_step:\n  \"\\<lbrakk> (f, s) \\<rightarrow> (f', s'); com_pre f s; \\<turnstile> {com_pre f} f {t}; f' \\<noteq> DONE \\<rbrakk> \\<Longrightarrow> \n  (com_pre f') s' \\<and> \\<turnstile> {com_pre f'} f' {t}\"\n  apply (induction arbitrary: t rule: small_step_induct; simp)\n         apply (simp add: com_pre_and_derivable_done semi_elim)\n        apply (meson b_semi semi_elim)\n       apply (simp add: if_elim)\n      apply (simp add: if_elim)\n     apply (simp add: b_semi b_while while_elim)\n    apply (simp add: b_action while_elim)\n   apply (frule par_elim; simp; clarsimp)\n   apply (rule conjI)\n    apply (simp add: par_done_pre_holds_one_step)\n   apply (frule_tac Ps'=\"Ps[i := \\<lbrace>Ts ! i\\<rbrace> POSTANN]\" in par_done_derivable_one_step; simp?)\n    apply auto[1]\n   apply (blast intro: b_strengthen_weaken)\n  apply (frule par_elim; simp; clarsimp)\n  apply (rule conjI)\n   apply (simp add: par_not_done_pre_holds_one_step)\n  apply (drule_tac x=\"Ts!i\" in meta_spec)\n  apply (drule meta_mp)\n   apply (simp add: and_map_com_pre_Ps1)\n  apply (drule meta_mp)\n  using and_map_com_pre_Ps1 apply fastforce\n  apply clarsimp\n  apply (frule par_not_done_derivable_one_step; simp)\n  apply (frule par_elim; simp; clarsimp)\n  by (blast intro: b_strengthen_weaken)\n\nlemma par_post_ann_valid_ann:\n  \"\\<lbrakk> valid_ann Ps Ts; length Ps = length Ts; Ps' = Ps[i := \\<lbrace>Ts ! i\\<rbrace> POSTANN] \\<rbrakk> \\<Longrightarrow> \n  valid_ann Ps' Ts\"\n  apply (clarsimp simp: valid_ann_def valid_ann'_def)\n  apply (rule conjI)\n   apply (case_tac \"i = j\"; simp add: is_ann_stable_def)\n  apply (case_tac \"i = j\"; simp)\n   apply (simp add: is_com_stable_def is_ann_stable_def)\n  by (case_tac \"i = ia\"; simp add: is_com_stable_def)\n\n(* b_par is sound for the Par (small-step) case *)\nlemma par_Par_sound:\n  \"\\<lbrakk> \\<forall>i<length Ts. \\<turnstile> {com_pre (Ps ! i)} Ps ! i {Ts ! i} \\<or> Ps ! i = \\<lbrace>Ts ! i\\<rbrace> POSTANN; \n  valid_ann Ps Ts; And (map com_pre Ps) b; length Ps = length Ts;\n  Ps' = Ps[i := c']; i < length Ts; (Ps ! i, b) \\<rightarrow> (c', s'); c' \\<noteq> DONE \\<rbrakk> \\<Longrightarrow>\n  valid_ann Ps' Ts \\<and> length Ps' = length Ts \\<and> (And (map com_pre Ps') s') \\<and> Ts \\<noteq> [] \\<and>\n  (\\<forall>j<length Ts. \\<turnstile> {com_pre (Ps' ! j)} Ps' ! j {Ts ! j} \\<or> Ps' ! j = \\<lbrace>Ts ! j\\<rbrace> POSTANN)\"\n  apply auto\n    apply (metis Post_annE and_map_com_pre_Ps1 valid_ann_step)\n   apply (simp add: par_not_done_pre_holds_one_step)\n  by (metis Post_annE and_map_com_pre_Ps1 com_pre_and_derivable_one_step nth_list_update)\n\nlemma par_sound':\n  \"\\<lbrakk> (f, s) \\<rightarrow>* (f', s'); f = PARALLEL Ps Ts; valid_ann Ps Ts; has_terminated f';\n  length Ps = length Ts; (not (=) Ts) []; And (map com_pre Ps) s; \n  \\<forall>j<length Ts. \\<turnstile> {com_pre (Ps ! j)} Ps ! j {Ts ! j} \\<or> Ps ! j = \\<lbrace>Ts ! j\\<rbrace> POSTANN \\<rbrakk> \\<Longrightarrow> \n  (And Ts) s' \\<and> f' \\<noteq> ABORTED\"\n  apply (induction arbitrary: Ps Ts rule: star_induct; simp)\n  apply (erule ParE; simp)\n    apply (metis (no_types, lifting) ParA Post_annE b_par com.distinct(1) com_pre.simps(7) com_pre_and_derivable_done done_star length_greater_0_conv)\n   apply (simp add: par_done_pre_holds_one_step nth_list_update par_post_ann_valid_ann)\n  apply (frule par_Par_sound; simp)\n  by blast\n\nlemma par_sound[simp]:\n  \"\\<lbrakk> valid_ann Ps Ts; length Ps = length Ts; 0 < length Ps; \n  \\<forall>i. i < length Ps \\<longrightarrow> \\<turnstile> {com_pre (Ps!i)} Ps!i {Ts!i} \\<or> Ps!i = \\<lbrace>Ts!i\\<rbrace> POSTANN;\n  \\<forall>i. i < length Ps \\<longrightarrow> \\<Turnstile> {com_pre (Ps!i)} Ps!i {{} | Ts!i} \\<or> Ps!i = \\<lbrace>Ts!i\\<rbrace> POSTANN \\<rbrakk> \\<Longrightarrow>\n  \\<Turnstile> {And (map com_pre Ps)} PARALLEL Ps Ts {{} | And Ts}\"\n  by (clarsimp simp: valid_spec_def holds_def reachable_sat_def par_sound')\n\n\nsubsection \\<open>Meta Rules\\<close>\n\nlemma strengthen_weaken_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; \\<forall>s. r' s \\<longrightarrow> r s; \\<forall>s. t s \\<longrightarrow> t' s; Q' \\<subseteq> Q  \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r'} f {Q' | t'}\"\n  apply (clarsimp simp: valid_spec_def reachable_sat_def holds_def)\n  by (metis set_rev_mp)\n\nlemma conjunction_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; \\<Turnstile> {r'} f {Q' | t'} \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r and r'} f {Q \\<union> Q' | t and t'}\"\n  apply (clarsimp simp: valid_spec_def reachable_sat_def holds_def)\n  by auto\n\nlemma disjunction_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; \\<Turnstile> {r'} f {Q' | t'} \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r or r'} f {Q \\<inter> Q' | t or t'}\"\n  by (clarsimp simp: valid_spec_def reachable_sat_def holds_def)\n\nlemma conjunction_sound_empty[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {{} | t}; \\<Turnstile> {r'} f {{} | t'} \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r and r'} f {{} | t and t'}\"\n  by (clarsimp simp: valid_spec_def reachable_sat_def holds_def)\n\nlemma disjunction_sound_empty[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {{} | t}; \\<Turnstile> {r'} f {{} | t'} \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r or r'} f {{} | t or t'}\"\n  by (clarsimp simp: valid_spec_def reachable_sat_def holds_def)\n\n\nsubsection \\<open>Soundness of @{term biloof_no_perpetual_sound}\\<close>\n\nlemma biloof_no_perpetual_sound[simp]:\n  \"\\<turnstile> {r} f {t} \\<Longrightarrow> \\<Turnstile> {r} f {{} | t}\"\n  apply (induction rule: biloof_no_perpetual.induct; clarsimp?)\n  by (metis length_greater_0_conv par_sound)\n\n\nsubsection \\<open>CO\\<close>\n\nlemma actions_of_subset:\n  \"\\<lbrakk> (f, s) \\<rightarrow>* (f', s'); \\<forall>a. a \\<in> actions_of f \\<longrightarrow> X a \\<rbrakk> \\<Longrightarrow> \\<forall>a. a \\<in> actions_of f' \\<longrightarrow> X a\"\n  apply (induction rule: star_induct, simp)\n  by (simp add: actions_of_one_step)\n\nlemma co_sound':\n  \"\\<lbrakk> (f', s') \\<rightarrow> (f'', s''); p s'; \\<forall>s. p s \\<longrightarrow> q s;\n  \\<forall>a pre state_rel. a \\<in> actions_of f' \\<longrightarrow> (pre, state_rel) = action_state_rel a \\<longrightarrow> \n  (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and p) s \\<longrightarrow> q s') \\<rbrakk> \\<Longrightarrow> \n  q s''\"\n  apply (induct rule: small_step_induct; simp)\n  by fastforce+\n\nlemma co_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; \\<forall>s. p s \\<longrightarrow> q s;\n  \\<forall>a pre state_rel. a \\<in> actions_of f \\<longrightarrow> (pre, state_rel) = action_state_rel a\n  \\<longrightarrow> (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and p) s \\<longrightarrow> q s') \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {r} f {Q \\<union> {p CO q} | t}\"\n  apply (clarsimp simp: valid_spec_def)\n  apply (erule disjE; simp)\n  apply (clarsimp simp: co_def)\n  apply (erule_tac x=\"s\" in allE, simp)+\n  apply (clarsimp simp: reachable_sat_def)\n  apply (frule actions_of_subset, simp)\n  by (frule co_sound'; simp)\n\nsubsubsection \\<open>Inheritance Meta Rule\\<close>\n\nlemma co_inheritance_semi_sound[simp]:\n  \"\\<lbrakk> \\<turnstile> {r} c\\<^sub>1 {com_pre c\\<^sub>2}; \\<turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {t};\n  \\<tturnstile> {r} c\\<^sub>1 {Q | com_pre c\\<^sub>2}; \\<Turnstile> {r} c\\<^sub>1 {Q | com_pre c\\<^sub>2}; (p CO q) \\<in> Q; \n  \\<tturnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q' | t}; \\<Turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q' | t}; (p CO q) \\<in> Q' \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {r} c\\<^sub>1;;c\\<^sub>2 {{p CO q} | t}\"\n  apply (drule b_semi; simp?)\n  apply (frule_tac r=r in biloof_no_perpetual_sound)\n  apply (frule_tac f=c\\<^sub>1 in co_elim, simp)\n  apply (frule_tac f=c\\<^sub>2 in co_elim, simp)\n  by (frule co_sound; simp)\n\nlemma co_inheritance_if_sound[simp]:\n  \"\\<lbrakk> \\<forall>s. (pre and b) s \\<longrightarrow> com_pre c\\<^sub>1 s; \\<forall>s. (pre and not b) s \\<longrightarrow> com_pre c\\<^sub>2 s;\n  \\<turnstile> {com_pre c\\<^sub>1} c\\<^sub>1 {t}; \\<turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {t};\n  \\<tturnstile> {com_pre c\\<^sub>1} c\\<^sub>1 {Q | t}; \\<Turnstile> {com_pre c\\<^sub>1} c\\<^sub>1 {Q | t}; (p CO q) \\<in> Q; \n  \\<tturnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q'| t}; \\<Turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q'| t}; (p CO q) \\<in> Q' \\<rbrakk> \\<Longrightarrow>\n  \\<Turnstile> {pre} \\<lbrace>pre\\<rbrace> IF b THEN c\\<^sub>1 ELSE c\\<^sub>2 {{p CO q} | t}\"\n  apply (frule_tac b_if, simp+)\n  apply (frule_tac r=pre in biloof_no_perpetual_sound)\n  apply (frule_tac f=c\\<^sub>1 in co_elim, simp)\n  apply (frule_tac f=c\\<^sub>2 in co_elim, simp)\n  by (frule co_sound; simp)\n\nlemma co_inheritance_while_sound[simp]:\n  \"\\<lbrakk> \\<forall>s. pre s \\<longrightarrow> i s; \\<forall>s. (i and b) s \\<longrightarrow> com_pre c s; \n  \\<turnstile> {com_pre c} c {i}; \\<tturnstile> {com_pre c} c {Q | t}; \n  \\<Turnstile> {com_pre c} c {Q | t}; (p CO q) \\<in> Q;\n  \\<forall>s. (not b) s \\<longrightarrow> (not local_b) s; \\<forall>s. (i and not local_b) s \\<longrightarrow> t s \\<rbrakk> \\<Longrightarrow>\n  \\<Turnstile> {pre} \\<lbrace>pre\\<rbrace> \\<lbrace>local_b\\<rbrace> WHILE b i DO c {{p CO q} | t}\"\n  apply (frule_tac b_while, simp+)\n  apply (frule_tac r=pre in biloof_no_perpetual_sound)\n  apply (frule_tac f=c in co_elim, simp)\n  by (frule co_sound; simp)\n\nlemma co_inheritance_parallel_sound[simp]:\n  \"\\<lbrakk> valid_ann Ps Ts; length Ps = length Ts; length Ts = length Qs; 0 < length Ps;\n  \\<forall>i<length Ps. \\<turnstile> {com_pre (Ps ! i)} Ps ! i {Ts ! i};\n  \\<forall>i<length Ps. \\<tturnstile> {com_pre (Ps ! i)} Ps ! i {Qs ! i | Ts ! i};\n  \\<forall>i<length Ps. \\<Turnstile> {com_pre (Ps ! i)} Ps ! i {Qs ! i | Ts ! i};\n  \\<forall>i<length Qs. (p CO q) \\<in> Qs ! i \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {And (map com_pre Ps)} PARALLEL Ps Ts {{p CO q} | And Ts}\"\n  apply (frule b_par; simp)\n   apply (erule_tac x=0 in allE; clarsimp)\n  using post_ann_elim apply fastforce\n  apply (frule biloof_no_perpetual_sound)\n  apply (frule co_sound; simp; clarsimp)\n   apply (erule_tac x=0 in allE; clarsimp)+\n   apply (frule co_elim; simp; blast)\n  apply (simp add: in_set_conv_nth; clarsimp)\n  apply (erule_tac x=i in allE; clarsimp)+\n  by (frule co_elim; simp; blast)\n\nsubsubsection \\<open>Invariance Meta Rule\\<close>\n\nlemma invariant_sound':\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; (i CO i) \\<in> Q; \\<forall>s. r s \\<longrightarrow> i s\\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r} f {Q \\<union> {INVARIANT i} | t}\"\n  using valid_spec_def invariant_def stable_def by fastforce\n\nlemma invariant_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t};\n  \\<forall>a pre state_rel. a \\<in> actions_of f \\<longrightarrow> (pre, state_rel) = action_state_rel a\n  \\<longrightarrow> (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and i) s \\<longrightarrow> i s'); \\<forall>s. r s \\<longrightarrow> i s \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {r} f {Q \\<union> {INVARIANT i} | t}\"\n  apply (frule_tac p=i and q=i in co_sound; simp)\n  apply (frule invariant_sound'; simp?)\n  by (simp add: Un_insert_right valid_spec_def)\n\nlemma invariant_pre_post_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; (INVARIANT i) \\<in> Q \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r and i} f {Q | t and i}\"\n  apply (clarsimp simp: valid_spec_def)\n  apply (erule_tac x=s in allE, clarsimp)+\n  apply (subgoal_tac \"invariant i f s\")\n   apply (drule invariant_all_reachable_sat)\n   apply (clarsimp simp: reachable_sat_def holds_def)\n  by fastforce\n\nlemma invariant_co_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; (p CO q) \\<in> Q; (INVARIANT i) \\<in> Q \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r} f {Q \\<union> {p and i CO q and i} | t}\"\n  apply (clarsimp simp: valid_spec_def)\n  apply (erule_tac x=s in allE, clarsimp)+\n  apply (subgoal_tac \"invariant i f s \\<and> co p q f s\"; clarsimp?)\n   apply (drule invariant_all_reachable_sat)\n   apply (clarsimp simp: reachable_sat_def co_def)\n   apply (meson star_step1 star_trans)\n   apply (clarsimp simp: co_def reachable_sat_def)\n   apply (meson star_step1 star_trans)\n  by fastforce\n\n(* \n  an additional proof of the semi inheritance rule for invariants. the rule does not \n  actually exist in biloof as it is redundant.\n*)\nlemma invariant_inheritance_semi[simp]:\n  \"\\<lbrakk> \\<turnstile> {r} c\\<^sub>1 {com_pre c\\<^sub>2}; \\<tturnstile> {r} c\\<^sub>1 {Q | com_pre c\\<^sub>2}; \\<Turnstile> {r} c\\<^sub>1 {Q | com_pre c\\<^sub>2}; \n  (INVARIANT i) \\<in> Q; \\<turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {t}; \\<tturnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q' | t}; \n  \\<Turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q' | t}; (INVARIANT i) \\<in> Q' \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {r} c\\<^sub>1;;c\\<^sub>2 {{INVARIANT i} | t}\"\n  apply (drule b_semi; simp?)\n  apply (frule_tac r=r in biloof_no_perpetual_sound)\n  apply (frule_tac f=c\\<^sub>1 in invariant_elim, simp)\n  apply (frule_tac f=c\\<^sub>2 in invariant_elim, simp)\n  by (frule_tac f=\"c\\<^sub>1;;c\\<^sub>2\" in invariant_sound; simp)\n\n\nsubsection \\<open>TRANSIENT\\<close>\n\n(* overapproximates the number of steps taken at most to reach an action *)\nfun num_same_state :: \"com \\<Rightarrow> nat\" where\n  \"num_same_state DONE = 1\"\n| \"num_same_state ABORTED = 1\"\n| \"num_same_state (\\<lbrace>_\\<rbrace> ACTION _) = 0\"\n| \"num_same_state (c\\<^sub>1;;c\\<^sub>2) = num_same_state c\\<^sub>1\"\n| \"num_same_state (\\<lbrace>_\\<rbrace> IF _ THEN c\\<^sub>1 ELSE c\\<^sub>2) = 1 + max (num_same_state c\\<^sub>1) (num_same_state c\\<^sub>2)\"\n| \"num_same_state (\\<lbrace>_\\<rbrace> \\<lbrace>_\\<rbrace> WHILE b i DO c) = 1 + num_same_state c\"\n| \"num_same_state (PARALLEL Ps Ts) = sum_list (map num_same_state Ps)\"\n| \"num_same_state (\\<lbrace>_\\<rbrace> POSTANN) = 0\"\n\nlemma is_path_0:\n  \"is_path path f s \\<Longrightarrow> path 0 = (f, s)\"\n  by (simp add: is_path_def)\n\nlemma is_path_subpath:\n  \"\\<lbrakk> is_path path f s; path n = (f', s') \\<rbrakk> \\<Longrightarrow> is_path (\\<lambda>i. path (n + i)) f' s'\"\n  by (clarsimp simp: is_path_def)\n\nlemma is_path_star':\n  \"\\<lbrakk> m \\<le> n; \\<forall>n. path n \\<rightarrow> path (Suc n) \\<rbrakk> \\<Longrightarrow> path m \\<rightarrow>* path n\"\n  apply (induct n arbitrary: m; simp)\n  apply (case_tac \"m=Suc n\"; simp?)\n  by (meson le_Suc_eq star.refl star.step star_trans)\n\nlemma is_path_star: \n  \"is_path path f s \\<Longrightarrow> \\<forall>m n. n \\<ge> m \\<longrightarrow> path m \\<rightarrow>* path n\"\n  by (simp add: is_path_def is_path_star')\n\nlemma is_path_one_step:\n  \"is_path path f s \\<Longrightarrow> \\<exists>f' s'. path 1 = (f', s') \\<and> (f, s) \\<rightarrow> (f', s')\"\n  apply (simp add: is_path_def)\n  by (metis old.prod.exhaust)\n\n(* derivability is preserved or the component is DONE *)\nlemma derivable_one_step:\n  \"\\<lbrakk> (f, s) \\<rightarrow> (f', s'); \\<turnstile> {r} f {t}; r s \\<rbrakk> \\<Longrightarrow> (\\<exists>r' t'. \\<turnstile> {r'} f' {t'} \\<and> r' s') \\<or> f' = DONE\"\n  apply (case_tac \"f' = DONE\"; simp)\n  apply (frule derivable_implies_com_pre)\n  apply (drule derivable_implies_com_pre_derivable)\n  apply (frule com_pre_and_derivable_one_step; simp?)\n  by blast\n\nlemma derivable_star:\n  \"\\<lbrakk> (f, s) \\<rightarrow>* (f', s'); r s; \\<turnstile> {r} f {t} \\<rbrakk> \\<Longrightarrow> (\\<exists>r' t'. \\<turnstile> {r'} f' {t'} \\<and> r' s') \\<or> f' = DONE\"\n  apply (induction arbitrary: r t rule: star_induct)\n   apply fastforce\n  apply (case_tac \"ab = DONE\"; simp)\n  apply (frule_tac r=r and t=t in derivable_one_step; simp)\n  by (metis done_star)\n\n(* \n  if f goes to DONE (and f is not DONE), then it must be an action or\n  a parallel composition that has one action. therefore, num_same_state = 0 \n*)\nlemma done_0_num_same_state:\n  \"\\<lbrakk> (f, s) \\<rightarrow> (f', s'); f' = DONE; \\<turnstile> {r} f {t} \\<rbrakk> \\<Longrightarrow> num_same_state f = 0\"\n  apply (induction arbitrary: r t rule: small_step_induct; simp)\n      apply (blast dest: done_elim)\n     apply (blast dest: done_elim semi_elim)\n    apply (blast dest: done_elim if_elim)\n   apply (blast dest: done_elim if_elim)\n  apply (frule par_elim; simp; clarsimp)\n  by (metis in_set_conv_nth num_same_state.simps(8))\n\nlemma num_same_state_parallel_one_step:\n  \"\\<lbrakk> i < length Ps; Ps ! i = c; num_same_state c' < num_same_state c \\<rbrakk> \\<Longrightarrow> \n  num_same_state (PARALLEL Ps[i := c'] Ts) < num_same_state (PARALLEL Ps Ts)\"\n  apply (induction Ps arbitrary: i; simp)\n  by (case_tac i; simp)\n\nlemma num_same_state_one_component:\n  \"\\<lbrakk> i < length Ps; Ps ! i = c; n < num_same_state c \\<rbrakk> \\<Longrightarrow> \n  n < num_same_state (PARALLEL Ps Ts)\"\n  apply (induction Ps arbitrary: i n c; simp)\n  apply (case_tac i; simp)\n  using trans_less_add2 by blast\n\nlemma num_same_state_post_ann:\n  \"\\<lbrakk> Suc 0 < num_same_state c; i < length Ps; Ps ! i = c \\<rbrakk> \\<Longrightarrow> \n  sum_list (map num_same_state (Ps[i := \\<lbrace>Ts ! i\\<rbrace> POSTANN])) < sum_list (map num_same_state Ps)\"\n  apply (induction Ps arbitrary: i c; simp)\n  apply (case_tac i; simp)\n  by (simp add: map_update)\n\n(* whenever a component makes a step, either num_same_state decreases or (not p) holds *)\nlemma num_same_state_decreases_or_not_p:\n  \"\\<lbrakk> (f, s) \\<rightarrow> (f', s'); \\<turnstile> {r} f {t}; r s; p s;\n  \\<forall>a pre state_rel. a \\<in> actions_of f \\<longrightarrow> (pre, state_rel) = action_state_rel a \\<longrightarrow>\n  (\\<forall>s. (pre and p) s \\<longrightarrow> (\\<exists>s'. (s, s') \\<in> state_rel)) \\<and> \n  (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and p) s \\<longrightarrow> (not p) s') \\<rbrakk> \\<Longrightarrow> \n  num_same_state f > num_same_state f' \\<or> (not p) s'\"\n  apply (induction arbitrary: r t rule: small_step_induct; simp)\n         apply (simp add: derivable_implies_com_pre)\n        apply (blast dest: done_elim)\n       apply blast\n      apply (metis done_0_num_same_state not_less_zero semi_elim)\n     apply (meson semi_elim)\n    apply (drule_tac x=\"com_pre (Ps ! i)\" in meta_spec; drule_tac x=\"Ts ! i\" in meta_spec)\n    apply (drule meta_mp)\n     apply (frule par_elim; simp)\n     apply fastforce\n    apply (metis Suc_lessD Suc_lessI and_map_com_pre_Ps1 in_set_conv_nth num_same_state.simps(7) num_same_state_one_component)\n   apply (drule_tac x=\"com_pre (Ps ! i)\" in meta_spec; drule_tac x=\"Ts ! i\" in meta_spec)\n   apply (drule meta_mp)\n    apply (frule par_elim; simp)\n    apply fastforce\n   apply (metis Suc_lessD and_map_com_pre_Ps1 in_set_conv_nth num_same_state.simps(7) num_same_state.simps(8) num_same_state_parallel_one_step)\n  apply (drule_tac x=\"com_pre (Ps ! i)\" in meta_spec; drule_tac x=\"Ts ! i\" in meta_spec)\n  apply (drule meta_mp)\n   apply (frule par_elim; simp)\n   apply (metis Post_annE and_map_com_pre_Ps1 com_pre.simps(8))\n  using and_map_com_pre_Ps1 num_same_state_parallel_one_step by fastforce\n\nlemma eventually_not_p_num_same_state'':\n  \"\\<lbrakk> (f, s) \\<rightarrow> (f', s'); \n  \\<And>f r t s.\n    \\<lbrakk> num_same_state f < n; \\<turnstile> {r} f {t}; r s;\n    \\<forall>a pre state_rel. a \\<in> actions_of f \\<longrightarrow> (pre, state_rel) = action_state_rel a \\<longrightarrow>\n    (\\<forall>s. (pre and p) s \\<longrightarrow> (\\<exists>s'. (s, s') \\<in> state_rel)) \\<and> \n    (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and p) s \\<longrightarrow> (not p) s'); p s \\<rbrakk> \\<Longrightarrow> \n    \\<forall>path. is_path path f s \\<longrightarrow> (\\<exists>i f'' s''. path i = (f'', s'') \\<and> (not p) s'');\n  num_same_state f < Suc n; \\<turnstile> {r} f {t}; r s;\n  \\<forall>a pre state_rel. a \\<in> actions_of f \\<longrightarrow> (pre, state_rel) = action_state_rel a \\<longrightarrow>\n  (\\<forall>s. (pre and p) s \\<longrightarrow> (\\<exists>s'. (s, s') \\<in> state_rel)) \\<and> \n  (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and p) s \\<longrightarrow> (not p) s');\n  p s; is_path path f s; path (Suc 0) = (f', s'); (f, s) \\<rightarrow> (f', s') \\<rbrakk> \\<Longrightarrow> \n  \\<exists>i f'' s''. path i = (f'', s'') \\<and> (not p) s''\"\n  apply (frule_tac r=r and t=t in num_same_state_decreases_or_not_p; simp?)\n  apply (erule disjE)\n   prefer 2\n   apply (rule_tac x=\"Suc 0\" in exI; simp)\n  apply (drule_tac x=f' in meta_spec; simp)\n  apply (subgoal_tac \"\\<forall>path. is_path path f' s' \\<longrightarrow> (\\<exists>i f'' s''. path i = (f'', s'') \\<and> (not p) s'')\")\n   apply (erule_tac x=\"\\<lambda>i. path (Suc i)\" in allE; simp?)\n   apply (frule is_path_subpath; simp?; clarsimp)\n   apply (rule_tac x=\"Suc i\" in exI; clarsimp)\n  apply (frule_tac r=r and t=t in derivable_one_step; simp?)\n  apply (erule disjE; clarsimp)\n   apply (drule_tac x=r' in meta_spec)\n   apply (drule_tac x=t' in meta_spec)\n   apply (drule_tac x=s' in meta_spec)\n   apply (drule meta_mp; simp)\n   apply (drule meta_mp)\n    apply (rule_tac s=s and s'=s' in actions_of_subset; simp?)\n   apply (meson is_path_0)\n  by (simp add: done_0_num_same_state)\n\nlemma eventually_not_p_num_same_state':\n  \"\\<lbrakk> n > num_same_state f; \\<turnstile> {r} f {t}; r s; p s;\n  \\<forall>a pre state_rel. a \\<in> actions_of f \\<longrightarrow> (pre, state_rel) = action_state_rel a \\<longrightarrow>\n  (\\<forall>s. (pre and p) s \\<longrightarrow> (\\<exists>s'. (s, s') \\<in> state_rel)) \\<and> \n  (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and p) s \\<longrightarrow> (not p) s') \\<rbrakk> \\<Longrightarrow>\n  \\<forall>path. is_path path f s \\<longrightarrow> (\\<exists>i f'' s''. path i = (f'', s'') \\<and> (not p) s'')\"\n  apply (induction n arbitrary: f r t s; simp; clarsimp)\n  apply (subgoal_tac \"\\<exists>f' s'. path 1 = (f', s') \\<and> (f, s) \\<rightarrow> (f', s')\"; clarsimp)\n  apply (frule_tac r=r and t=t in eventually_not_p_num_same_state'')\n  using is_path_one_step by auto\n\n(* added n > num_same_state f and apply induction on n *)\nlemma eventually_not_p_num_same_state:\n  \"\\<lbrakk> n > num_same_state f; \\<turnstile> {r} f {t}; r s; p s;\n  \\<forall>a pre state_rel. a \\<in> actions_of f \\<longrightarrow> (pre, state_rel) = action_state_rel a \\<longrightarrow>\n  (\\<forall>s. (pre and p) s \\<longrightarrow> (\\<exists>s'. (s, s') \\<in> state_rel)) \\<and> \n  (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and p) s \\<longrightarrow> (not p) s'); is_path path f s \\<rbrakk> \\<Longrightarrow>\n  \\<exists>i f'' s''. path i = (f'', s'') \\<and> (not p) s''\"\n  by (simp add: eventually_not_p_num_same_state')\n\nlemma eventually_not_p:\n  \"\\<lbrakk> \\<turnstile> {r} f {t}; r s; p s;\n  \\<forall>a pre state_rel. a \\<in> actions_of f \\<longrightarrow> (pre, state_rel) = action_state_rel a \\<longrightarrow>\n  (\\<forall>s. (pre and p) s \\<longrightarrow> (\\<exists>s'. (s, s') \\<in> state_rel)) \\<and> \n  (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and p) s \\<longrightarrow> (not p) s');\n  is_path path f s \\<rbrakk> \\<Longrightarrow>\n  \\<exists>i f'' s''. path i = (f'', s'') \\<and> (not p) s''\"\n  apply (subgoal_tac \"\\<exists>n. n > num_same_state f\"; clarsimp)\n   apply (frule_tac r=r and t=t in eventually_not_p_num_same_state; simp?)\n  by auto\n\nlemma transient_basis_sound':\n  \"\\<lbrakk> \\<turnstile> {r} f {t}; r s;\n  \\<forall>a pre state_rel. a \\<in> actions_of f \\<longrightarrow> (pre, state_rel) = action_state_rel a \\<longrightarrow>\n  (\\<forall>s. (pre and p) s \\<longrightarrow> (\\<exists>s'. (s, s') \\<in> state_rel)) \\<and> \n  (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and p) s \\<longrightarrow> (not p) s') \\<rbrakk> \\<Longrightarrow> \n  transient p f s\"\n  apply (clarsimp simp: transient_def paths_def)\n  apply (frule is_path_subpath; simp?)\n  apply (subgoal_tac \"(f, s) \\<rightarrow>* (fa, sa)\")\n  apply (frule_tac s=s and f'=fa and s'=sa in derivable_star; simp)\n   apply (erule disjE; clarsimp)\n   apply (frule_tac f=fa and s=sa and p=p in eventually_not_p; simp?)\n    apply (rule_tac f=f and s=s and f'=fa and s'=sa in actions_of_subset; simp)\n   apply (meson le_add1)\n  using is_path_0 is_path_star by auto\n\nlemma transient_basis_sound[simp]:\n  \"\\<lbrakk> \\<tturnstile> {r} f {Q | t}; \\<Turnstile> {r} f {Q | t};\n  \\<forall>a pre state_rel. a \\<in> actions_of f \\<longrightarrow> (pre, state_rel) = action_state_rel a \\<longrightarrow>\n  (\\<forall>s. (pre and p) s \\<longrightarrow> (\\<exists>s'. (s, s') \\<in> state_rel)) \\<and> \n  (\\<forall>s s'. (s, s') \\<in> state_rel \\<longrightarrow> (pre and p) s \\<longrightarrow> (not p) s') \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {r} f {Q \\<union> {TRANSIENT p} | t}\"\n  apply (clarsimp simp: valid_spec_def)\n  apply (erule disjE; clarsimp)\n  apply (frule biloof_to_biloof_no_perpetual; simp)\n  by (clarsimp simp: transient_basis_sound')\n\nlemma com_semi_com[dest]: \n  \"f;;c\\<^sub>2 = c\\<^sub>2 \\<Longrightarrow> False\"\n  by (metis One_nat_def add.commute com.size_gen(4) less_Suc_eq not_add_less2 plus_1_eq_Suc)\n\nlemma one_step_semi:\n  \"\\<lbrakk> (f;;c\\<^sub>2, s) \\<rightarrow> (f';;c\\<^sub>2, s') \\<rbrakk> \\<Longrightarrow> (f, s) \\<rightarrow> (f', s')\" \n  by auto\n\n(* if you always have (f;;c\\<^sub>2), it means that c\\<^sub>1 never terminates *)\nlemma construct_path_from_semi_never_terminated:\n  \"\\<lbrakk> is_path path (c\\<^sub>1;;c\\<^sub>2) s; (\\<forall>i. \\<exists>f s. path i = (f;;c\\<^sub>2, s)) \\<rbrakk> \\<Longrightarrow>\n  is_path (\\<lambda>i. case path i of (c\\<^sub>1';;c\\<^sub>2, s) \\<Rightarrow> (c\\<^sub>1', s)) c\\<^sub>1 s\"\n  apply (clarsimp simp: is_path_def)\n  apply (frule_tac x=n in spec)\n  apply (drule_tac x=\"Suc n\" in spec; clarsimp)\n  by (metis one_step_semi)\n\nlemma one_step_semi_aborted:\n  \"\\<lbrakk> (f;;c\\<^sub>2, s) \\<rightarrow> (ABORTED, s'); c\\<^sub>2 \\<noteq> ABORTED \\<rbrakk> \\<Longrightarrow> s = s' \\<and> (f, s) \\<rightarrow> (ABORTED, s)\"\n  apply (erule SemiE; simp)\n  by (rule Abort; assumption)\n\nlemma one_step_semi_done:\n  \"\\<lbrakk> (f;;c\\<^sub>2, s) \\<rightarrow> (c\\<^sub>2, s'); c\\<^sub>2 \\<noteq> ABORTED \\<rbrakk> \\<Longrightarrow> (f, s) \\<rightarrow> (DONE, s')\"\n  by (metis (no_types, lifting) Pair_inject SemiE com_semi_com)\n\nlemma semi_path_all_possible_cases':\n  \"\\<lbrakk> is_path path (c\\<^sub>1;;c\\<^sub>2) s; \\<forall>f s. (not (=) (path i)) (f;;c\\<^sub>2, s) \\<rbrakk> \\<Longrightarrow>\n  \\<exists>n. (\\<forall>i < n. \\<exists>f s. path i = (f;;c\\<^sub>2, s)) \\<and> \\<not> (\\<exists>f' s'. path n = (f';;c\\<^sub>2, s'))\"\n  apply (induction rule: nat_less_induct; simp)\n  by blast\n\n(* \n  the path for sequential composition is either\n  - path i = (f';;c\\<^sub>2, s) for all i ---- c\\<^sub>1 never terminates\n  - path i = (ABORTED;;c\\<^sub>2, s) and path (Suc i) = (ABORTED, s) --- c\\<^sub>1 goes to ABORTED\n  - path i = (f';;c\\<^sub>2, s) and path (Suc i) = (c\\<^sub>2, s') ---- c\\<^sub>2 goes to DONE\n*)\nlemma semi_path_all_possible_cases:\n  \"\\<lbrakk> is_path path (c\\<^sub>1;;c\\<^sub>2) s; \\<not> (\\<forall>i. \\<exists>f s. path i = (f;;c\\<^sub>2, s)) \\<rbrakk> \\<Longrightarrow>\n  (\\<exists>n s'. n > 0 \\<and> (\\<forall>i < n. \\<exists>f s. path i = (f;;c\\<^sub>2, s)) \\<and> path n = (ABORTED, s')) \\<or>\n  (\\<exists>n s'. n > 0 \\<and> (\\<forall>i < n. \\<exists>f s. path i = (f;;c\\<^sub>2, s)) \\<and> path n = (c\\<^sub>2, s'))\"\n  apply clarsimp\n  apply (frule semi_path_all_possible_cases'; simp; clarsimp)\n  apply (rule_tac x=n in exI)\n  apply (erule_tac x=n in allE; clarsimp)\n  apply (subgoal_tac \"n > 0\"; simp?)\n   apply (erule disjE, blast)\n   apply (metis SemiE Suc_pred add.commute is_path_def lessI plus_1_eq_Suc)\n  using is_path_0 less_linear by blast\n\nlemma done_semi_one_step: \n  \"(DONE;;c\\<^sub>2, s) \\<rightarrow> (f;;c\\<^sub>2, s') \\<Longrightarrow> False\" \n  using done_one_step by auto\n\nlemma aborted_semi_one_step: \n  \"(ABORTED;;c\\<^sub>2, s) \\<rightarrow> (f;;c\\<^sub>2, s') \\<Longrightarrow> False\"\n  by (metis Pair_inject SemiE aborted_one_step com.distinct(17) com_pre.simps(2) com_semi_com false_def one_step_semi)\n\nlemma is_path_never_terminated:\n  \"\\<lbrakk> is_path path (c\\<^sub>1;;c\\<^sub>2) s; \\<forall>i. \\<exists>f s. path i = (f;;c\\<^sub>2, s); \n  path' = (\\<lambda>i. case path i of (c\\<^sub>1';;c\\<^sub>2, s) \\<Rightarrow> (c\\<^sub>1', s)); is_path path' c\\<^sub>1 s \\<rbrakk> \\<Longrightarrow>\n  \\<not> path_will_terminate path'\"\n  apply (clarsimp simp: is_path_def path_will_terminate_def)\n  apply (frule_tac x=i in spec)\n  apply (drule_tac x=\"Suc i\" in spec)\n  apply clarsimp\n  apply (rotate_tac 3)\n  apply (frule_tac x=i in spec; clarsimp)\n  apply (case_tac f; simp)\n   apply (blast dest: done_semi_one_step)\n  by (blast dest: aborted_semi_one_step)\n\nlemma never_terminated_case:\n  \"\\<lbrakk> transient p c\\<^sub>1 s; is_path path (c\\<^sub>1;;c\\<^sub>2) s; path i = (f, sa); p sa; (not has_terminated) f;\n   \\<forall>i. \\<exists>f s. path i = (f;;c\\<^sub>2, s) \\<rbrakk> \\<Longrightarrow> \n  \\<exists>j\\<ge>i. \\<exists>f' s'. path j = (f', s') \\<and> ((not p) s' \\<or> has_terminated f')\"\n  apply (simp add: transient_def paths_def)\n  apply (frule construct_path_from_semi_never_terminated; simp?)\n  apply (frule is_path_never_terminated; simp?)\n  apply (erule_tac x=\"\\<lambda>i. case path i of (c\\<^sub>1';;c\\<^sub>2, s) \\<Rightarrow> (c\\<^sub>1', s)\" in allE)\n  apply (clarsimp simp: path_will_terminate_def)\n  apply (frule_tac x=i in spec; rotate_tac 5)\n  apply (frule_tac x=i in spec; rotate_tac 2)\n  apply (erule_tac x=i in allE; clarsimp)\n  apply (frule_tac x=j in spec)\n  apply (erule exE)+\n  apply clarsimp\n  apply (case_tac \"(not p) s'\"; clarsimp)\n   apply blast\n  apply (erule_tac x=j in allE)+\n  by clarsimp\n\nlemma paths_won't_aborted:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; is_path path f s; r s \\<rbrakk> \\<Longrightarrow> \\<forall>i f' s'. path i = (f', s') \\<longrightarrow> f' \\<noteq> ABORTED\"\n  apply (drule not_aborted)\n  apply (erule_tac x=s in allE; clarsimp)\n  apply (clarsimp simp: is_path_def reachable_sat_def)\n  by (metis is_path_star' less_eq_nat.simps(1))\n\nlemma semi_path_star:\n  \"\\<lbrakk> n > 0; \\<forall>i<n. \\<exists>f s. path i = (f;;c\\<^sub>2, s); path 0 = (c\\<^sub>1;;c\\<^sub>2, s); \\<forall>n. path n \\<rightarrow> path (Suc n); \n  path (n - 1) = (f;;c\\<^sub>2, sa) \\<rbrakk> \\<Longrightarrow> \n  (c\\<^sub>1, s) \\<rightarrow>* (f, sa)\"\n  apply (induction n arbitrary: c\\<^sub>1 s f sa; simp)\n  apply (case_tac n; simp)\n  by (metis (no_types, lifting) lessI less_SucI one_step_semi star_step1 star_trans)\n\nlemma pre_snd_com':\n  \"\\<lbrakk> \\<Turnstile> {r} c\\<^sub>1 {Q | t}; r s; (c\\<^sub>1, s) \\<rightarrow>* (f, sa); (f, sa) \\<rightarrow> (DONE, s') \\<rbrakk> \\<Longrightarrow> t s'\"\n  apply (simp add: valid_spec_def reachable_sat_def holds_def)\n  by (meson has_terminated.simps(1) star.refl star.step star_trans)\n\n(* in sequential composition, once the first component is DONE, the postcondition holds *)\nlemma pre_snd_com:\n  \"\\<lbrakk> \\<Turnstile> {r} c\\<^sub>1 {Q | t}; r s; is_path path (c\\<^sub>1;;c\\<^sub>2) s; \n  \\<forall>i<n. \\<exists>f s. path i = (f;;c\\<^sub>2, s); n > 0; path n = (c\\<^sub>2, s'); c\\<^sub>2 \\<noteq> ABORTED \\<rbrakk> \\<Longrightarrow>\n  t s'\"\n  apply (simp add: is_path_def; clarsimp)\n  apply (frule_tac x=\"n - 1\" in spec)\n  apply (erule impE, simp)\n  apply (erule exE)+\n  apply (frule_tac n=n and path=path in semi_path_star; simp)\n  apply (frule not_aborted)\n  apply (erule_tac x=s in allE; simp add: reachable_sat_def)\n  by (metis Suc_pred one_step_semi_done pre_snd_com')\n\n(* if all the paths of c\\<^sub>1 terminate, then (c\\<^sub>1;;c\\<^sub>2, s) will get to (c\\<^sub>2, s') *)\nlemma always_terminate_path:\n  \"\\<lbrakk> \\<turnstile> {r} c\\<^sub>1;;c\\<^sub>2 {t}; r s; is_path path (c\\<^sub>1;;c\\<^sub>2) s; \n  \\<forall>path. is_path path c\\<^sub>1 s \\<longrightarrow> path_will_terminate path \\<rbrakk> \\<Longrightarrow>\n  \\<exists>n s'. n > 0 \\<and> (\\<forall>i < n. \\<exists>f s. path i = (f;;c\\<^sub>2, s)) \\<and> path n = (c\\<^sub>2, s')\"\n  apply (case_tac \"\\<forall>i. \\<exists>f s. path i = (f;;c\\<^sub>2, s)\")\n   apply (frule construct_path_from_semi_never_terminated; simp?)\n   apply (frule is_path_never_terminated; simp?)\n   apply blast\n  apply (case_tac \"\\<exists>n s'. n > 0 \\<and> (\\<forall>i < n. \\<exists>f s. path i = (f;;c\\<^sub>2, s)) \\<and> path n = (c\\<^sub>2, s')\")\n   apply simp\n  by (metis (mono_tags, hide_lams) biloof_no_perpetual_sound paths_won't_aborted semi_path_all_possible_cases)\n\nlemma terminated_case':\n  \"\\<lbrakk> \\<Turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q' | t}; c\\<^sub>2 \\<noteq> DONE; (TRANSIENT p) \\<in> Q'; \n  is_path path (c\\<^sub>1;;c\\<^sub>2) s; path i = (f, sa); p sa; (not has_terminated) f;\n  0 < n; \\<forall>i<n. \\<exists>f s. path i = (f;;c\\<^sub>2, s); path n = (c\\<^sub>2, s'); com_pre c\\<^sub>2 s' \\<rbrakk> \\<Longrightarrow> \n  \\<exists>j\\<ge>i. \\<exists>f' s'. path j = (f', s') \\<and> ((not p) s' \\<or> has_terminated f')\"\n  apply (subgoal_tac \"transient p c\\<^sub>2 s'\")\n   defer\n  using valid_spec_def apply fastforce\n  apply (simp add: transient_def paths_def)\n  apply (frule_tac n=n in is_path_subpath; simp?)\n  apply (erule_tac x=\"\\<lambda>i. path (n + i)\" in allE; simp)\n  apply (case_tac \"i < n\")\n   apply (rotate_tac -2)\n   apply (case_tac \"(not p) s'\")\n  using less_imp_le_nat apply blast\n   apply (erule_tac x=0 in allE; clarsimp)\n   apply (metis com_pre.simps(2) false_def has_terminated.elims(2) le_add1 le_trans less_imp_le_nat)\n  apply (erule_tac x=\"i - n\" in allE; clarsimp)\n  by (metis add.commute le_diff_conv)\n\nlemma terminated_case:\n  \"\\<lbrakk> \\<turnstile> {r} c\\<^sub>1;;c\\<^sub>2 {t}; r s; \\<Turnstile> {r} c\\<^sub>1 {Q | com_pre c\\<^sub>2};\n  \\<Turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q' | t}; (TRANSIENT p) \\<in> Q';\n  is_path path (c\\<^sub>1;;c\\<^sub>2) s; path i = (f, sa); p sa; (not has_terminated) f;\n  \\<exists>n s'. 0 < n \\<and> (\\<forall>i<n. \\<exists>f s. path i = (f;;c\\<^sub>2, s)) \\<and> path n = (c\\<^sub>2, s') \\<rbrakk> \\<Longrightarrow> \n  \\<exists>j\\<ge>i. \\<exists>f' s'. path j = (f', s') \\<and> ((not p) s' \\<or> has_terminated f')\"\n  apply clarsimp\n  apply (frule_tac path=path and c\\<^sub>2=c\\<^sub>2 in pre_snd_com; simp?)\n  apply (meson aborted_elim semi_elim)\n  apply (frule_tac path=path and c\\<^sub>2=c\\<^sub>2 in terminated_case'; simp?)\n  by (meson done_elim semi_elim)\n\nlemma transient_sequencing_sound[simp]:\n  \"\\<lbrakk> \\<turnstile> {r} c\\<^sub>1 {com_pre c\\<^sub>2}; \\<turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {t}; \\<Turnstile> {r} c\\<^sub>1 {Q | com_pre c\\<^sub>2}; \n  \\<forall>s. r s \\<longrightarrow> (\\<forall>path\\<in>paths c\\<^sub>1 s. path_will_terminate path);\n  \\<Turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q' | t}; (TRANSIENT p) \\<in> Q' \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {r} c\\<^sub>1;;c\\<^sub>2 {{TRANSIENT p} | t}\"\n  apply (drule b_semi; simp?)\n  apply (simp (no_asm) add: valid_spec_def; clarsimp)\n  apply (rule conjI)\n   apply (frule_tac r=r in biloof_no_perpetual_sound)\n   apply (clarsimp simp: valid_spec_def)\n  apply (simp (no_asm) add: transient_def paths_def; clarsimp)\n  apply (frule always_terminate_path; simp add: paths_def)\n   apply blast\n  by (frule terminated_case; simp)\n\nlemma transient_inheritance_semi':\n  \"\\<lbrakk> \\<turnstile> {r} c\\<^sub>1;;c\\<^sub>2 {t}; r s; \\<Turnstile> {r} c\\<^sub>1 {Q | com_pre c\\<^sub>2}; (TRANSIENT p) \\<in> Q;\n  \\<Turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q' | t}; (TRANSIENT p) \\<in> Q' \\<rbrakk> \\<Longrightarrow> \n  transient p (c\\<^sub>1;;c\\<^sub>2) s\"\n  apply (subgoal_tac \"transient p c\\<^sub>1 s\")\n   apply (simp (no_asm) add: transient_def paths_def; clarsimp)\n   apply (case_tac \"\\<forall>i. \\<exists>f s. path i = (f;;c\\<^sub>2, s)\")\n  using never_terminated_case apply blast\n   apply (case_tac \"\\<exists>n s'. n > 0 \\<and> (\\<forall>i < n. \\<exists>f s. path i = (f;;c\\<^sub>2, s)) \\<and> path n = (c\\<^sub>2, s')\")\n    apply (frule_tac Q'=Q' in terminated_case; simp)\n   apply (metis (mono_tags, hide_lams) biloof_no_perpetual_sound paths_won't_aborted semi_path_all_possible_cases)\n  using valid_spec_def by fastforce\n\nlemma transient_inheritance_semi_sound[simp]:\n  \"\\<lbrakk> \\<turnstile> {r} c\\<^sub>1 {com_pre c\\<^sub>2}; \\<turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {t}; \\<Turnstile> {r} c\\<^sub>1 {Q | com_pre c\\<^sub>2}; \n  (TRANSIENT p) \\<in> Q; \\<Turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q' | t}; (TRANSIENT p) \\<in> Q' \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {r} c\\<^sub>1;;c\\<^sub>2 {{TRANSIENT p} | t}\"\n  apply (drule b_semi; simp?)\n  apply (simp (no_asm) add: valid_spec_def; clarsimp)\n  apply (rule conjI)\n   apply (frule_tac r=r in biloof_no_perpetual_sound)\n   apply (clarsimp simp: valid_spec_def)\n  by (rule_tac r=r and t=t and Q'=Q' in transient_inheritance_semi'; simp?)\n\nlemma transient_inheritance_if_sound_if:\n  \"\\<lbrakk> pre s; b s; com_pre c\\<^sub>1 s; transient p c\\<^sub>1 s \\<rbrakk> \\<Longrightarrow> \n  transient p (\\<lbrace>pre\\<rbrace> IF b THEN c\\<^sub>1 ELSE c\\<^sub>2) s\"\n  apply (clarsimp simp: transient_def paths_def)\n  apply (subgoal_tac \"path 1 = (c\\<^sub>1, s)\")\n   apply (frule_tac n=1 in is_path_subpath; simp)\n   apply (erule_tac x=\"(\\<lambda>i. path (Suc i))\" in allE; simp)\n   apply (case_tac i; simp)\n    apply (erule_tac x=0 in allE; simp; blast)\n   apply (erule_tac x=\"i - 1\" in allE; simp; blast)\n  apply (simp add: is_path_def; clarsimp)\n  apply (erule_tac x=0 in allE; simp)\n  by (erule IfE; simp)\n\nlemma transient_inheritance_if_sound_else:\n  \"\\<lbrakk> pre s; \\<not> b s; com_pre c\\<^sub>2 s; transient p c\\<^sub>2 s \\<rbrakk> \\<Longrightarrow> \n  transient p (\\<lbrace>pre\\<rbrace> IF b THEN c\\<^sub>1 ELSE c\\<^sub>2) s\"\n  apply (clarsimp simp: transient_def paths_def)\n  apply (subgoal_tac \"path 1 = (c\\<^sub>2, s)\")\n   apply (frule_tac n=1 in is_path_subpath; simp)\n   apply (erule_tac x=\"(\\<lambda>i. path (Suc i))\" in allE; simp)\n   apply (case_tac i; simp)\n    apply (erule_tac x=0 in allE; simp; blast)\n   apply (erule_tac x=\"i - 1\" in allE; simp; blast)\n  apply (simp add: is_path_def; clarsimp)\n  apply (erule_tac x=0 in allE; simp)\n  by (erule IfE; simp)\n\nlemma transient_inheritance_if_sound[simp]:\n  \"\\<lbrakk> \\<forall>s. (pre and b) s \\<longrightarrow> com_pre c\\<^sub>1 s; \\<forall>s. (pre and not b) s \\<longrightarrow> com_pre c\\<^sub>2 s;\n  \\<turnstile> {com_pre c\\<^sub>1} c\\<^sub>1 {t}; \\<turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {t}; \n  \\<Turnstile> {com_pre c\\<^sub>1} c\\<^sub>1 {Q | t}; (TRANSIENT p) \\<in> Q; \n  \\<Turnstile> {com_pre c\\<^sub>2} c\\<^sub>2 {Q' | t}; (TRANSIENT p) \\<in> Q' \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {pre} \\<lbrace>pre\\<rbrace> IF b THEN c\\<^sub>1 ELSE c\\<^sub>2 {{TRANSIENT p} | t}\"\n  apply (frule_tac c\\<^sub>2=c\\<^sub>2 in b_if; simp?)\n  apply (simp (no_asm) add: valid_spec_def; clarsimp)\n  apply (rule conjI)\n   apply (frule_tac r=pre in biloof_no_perpetual_sound)\n   apply (clarsimp simp: valid_spec_def)\n  apply (case_tac \"b s\")\n   apply (frule_tac c\\<^sub>1=c\\<^sub>1 and b=b and pre=pre in transient_inheritance_if_sound_if; simp?)\n  using valid_spec_def apply fastforce\n  apply (frule_tac c\\<^sub>2=c\\<^sub>2 and b=b and pre=pre in transient_inheritance_if_sound_else; simp?)\n  using valid_spec_def by fastforce\n\n\nsubsection \\<open>ENSURES\\<close>\n\nlemma ensures_eventually_q_or_terminated'':\n  \"\\<lbrakk> co (p and not q) (p or q) f s; is_path path f s; path (Suc j) = (f', s'); i \\<le> j;\n  (not p) s'; path j = (fb, sb); p sb; (not q) sb; (not has_terminated) fb \\<rbrakk> \\<Longrightarrow> \n  \\<exists>j\\<ge>i. \\<exists>f' s'. path j = (f', s') \\<and> (p s' \\<and> has_terminated f' \\<or> q s')\"\n  apply (simp add: co_def reachable_sat_def holds_def)\n  apply (erule_tac x=fb in allE; erule_tac x=sb in allE)\n  apply (frule is_path_star)\n  apply (erule_tac x=0 in allE; erule_tac x=j in allE)\n  apply (simp add: is_path_0)\n  apply (clarsimp simp: is_path_def)\n  by (metis le_SucI)\n\nlemma ensures_eventually_q_or_terminated':\n  \"\\<lbrakk> co (p and not q) (p or q) f s; is_path path f s; path i = (fa, sa); p sa; (not q) sa; \n  (not has_terminated) fa; i \\<le> j; path j = (f', s'); (not p) s' \\<rbrakk> \\<Longrightarrow> \n  \\<exists>j\\<ge>i. \\<exists>f' s'. path j = (f', s') \\<and> (p s' \\<and> has_terminated f' \\<or> q s')\"\n  apply (induct j arbitrary: f' s' i fa sa; simp)\n  apply (case_tac \"i = Suc j\"; clarsimp?)\n  apply (subgoal_tac \"i \\<le> j\"; simp)\n  apply (subgoal_tac \"\\<exists>f s. path j = (f, s)\")\n  apply (erule exE)+\n   apply (case_tac \"p sb\"; simp)\n   apply (case_tac \"q sb\", blast)\n   apply (case_tac \"has_terminated fb\", blast)\n   apply (simp add: ensures_eventually_q_or_terminated'')\n  by simp\n\nlemma ensures_eventually_q_or_terminated:\n  \"\\<lbrakk> co (p and not q) (p or q) f s; transient (p and not q) f s; path \\<in> paths f s; \n  path i = (fa, sa); p sa \\<rbrakk> \\<Longrightarrow> \n  \\<exists>j\\<ge>i. \\<exists>f' s'. path j = (f', s') \\<and> (p s' \\<and> has_terminated f' \\<or> q s')\"\n  apply (simp add: transient_def paths_def)\n  apply (erule_tac x=path in allE; simp)\n  apply (erule_tac x=i in allE; simp)\n  apply (case_tac \"q sa\", blast)\n  apply (case_tac \"has_terminated fa\", blast)\n  apply clarsimp\n  apply (case_tac \"p s'\", blast)\n  by (simp add: ensures_eventually_q_or_terminated')\n\nlemma ensures_next_step_p_or_q:\n  \"\\<lbrakk> co (p and not q) (p or q) f s; transient (p and not q) f s; path \\<in> paths f s; \n  path i = (fa, sa); p sa; (not q) sa \\<rbrakk> \\<Longrightarrow> \n  \\<exists>f' s'. path (Suc i) = (f', s') \\<and> (p or q) s'\"\n  apply (simp add: co_def reachable_sat_def paths_def)\n  apply (erule_tac x=fa in allE; erule_tac x=sa in allE)\n  apply (frule is_path_star)\n  apply (erule_tac x=0 in allE; erule_tac x=i in allE)\n  apply (clarsimp simp: is_path_0)\n  apply (subgoal_tac \"\\<exists>f s. path (Suc i) = (f, s)\")\n   apply (erule exE)+\n   apply (erule_tac x=fb in allE; erule_tac x=sb in allE)\n   apply (simp add: is_path_def; clarsimp)\n   apply (erule_tac x=i in allE; simp)\n  by clarsimp\n\nlemma co_transient_implies_ensures:\n  \"\\<lbrakk> co (p and not q) (p or q) f s; transient (p and not q) f s \\<rbrakk> \\<Longrightarrow> \n  ensures p q f s\"\n  by (clarsimp simp: ensures_def ensures_next_step_p_or_q ensures_eventually_q_or_terminated)\n\nlemma ensures_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; (p and not q CO p or q) \\<in> Q; (TRANSIENT p and not q) \\<in> Q \\<rbrakk> \\<Longrightarrow> \n  \\<Turnstile> {r} f {Q \\<union> {p EN q} | t}\"\n  apply (clarsimp simp: valid_spec_def)\n  apply (erule disjE; clarsimp)\n  apply (erule_tac x=s in allE; clarsimp)\n  apply (subgoal_tac \"co (p and not q) (p or q) f s \\<and> transient (p and not q) f s\"; clarsimp?)\n   apply (simp add: co_transient_implies_ensures)\n  by auto\n\n\nsubsection \\<open>LEADS-TO\\<close>\n\nlemma leads_to_ensures_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; (p EN q) \\<in> Q \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r} f {Q \\<union> {p \\<mapsto> q} | t}\"\n  apply (clarsimp simp: valid_spec_def)\n  apply (erule disjE; simp)\n  apply (erule_tac x=s in allE; clarsimp)\n  apply (subgoal_tac \"ensures p q f s\")\n   apply (clarsimp simp: leads_to_def ensures_def)\n   apply blast\n  by auto\n\nlemma leads_to_transitive_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; (p \\<mapsto> q) \\<in> Q; (q \\<mapsto> r) \\<in> Q \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r} f {Q \\<union> {p \\<mapsto> r} | t}\"\n  apply (clarsimp simp: valid_spec_def)\n  apply (erule disjE; simp)\n  apply (erule_tac x=s in allE; clarsimp)\n  apply (subgoal_tac \"leads_to p q f s \\<and> leads_to q r f s\")\n   defer\n   apply auto[1]\n  apply (clarsimp simp: leads_to_def paths_def)\n  apply (erule_tac x=path in allE; clarsimp)+\n  apply (erule_tac x=i in allE; clarsimp)\n  apply (case_tac \"has_terminated f'\"; simp)\n   apply blast\n  apply (erule_tac x=j in allE; clarsimp)\n  using le_trans by blast\n\nlemma leads_to_disjunction':\n  \"\\<forall>p\\<in>set S. leads_to p q f s \\<Longrightarrow> leads_to (Or S) q f s\"\n  apply (induct S; clarsimp)\n   apply (simp add: leads_to_def false_def)\n  using leads_to_def false_def by auto\n\nlemma leads_to_disjunction_sound[simp]:\n  \"\\<lbrakk> \\<Turnstile> {r} f {Q | t}; \\<forall>p\\<in>set S. (p \\<mapsto> q) \\<in> Q \\<rbrakk> \\<Longrightarrow> \\<Turnstile> {r} f {Q \\<union> {(Or S) \\<mapsto> q} | t}\"\n  apply (clarsimp simp: valid_spec_def)\n  apply (erule disjE; simp)\n  apply (erule_tac x=s in allE; clarsimp)\n  apply (subgoal_tac \"\\<forall>p\\<in>set S. leads_to p q f s\")\n   apply (simp add: leads_to_disjunction')\n  by fastforce\n\nsubsection \\<open>Soundness of Everything\\<close>\n\nlemma biloof_sound:\n  \"\\<tturnstile> {r} f {Q | t} \\<Longrightarrow> \\<Turnstile> {r} f {Q | t}\"\n  by (induction rule: biloof.induct; clarsimp)\n \nend", "meta": {"author": "jessicatheodosius", "repo": "bilateral-proof", "sha": "d9b732b0be26b4ce0908d340f39c59f138f2587a", "save_path": "github-repos/isabelle/jessicatheodosius-bilateral-proof", "path": "github-repos/isabelle/jessicatheodosius-bilateral-proof/bilateral-proof-d9b732b0be26b4ce0908d340f39c59f138f2587a/Soundness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737344123242, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.33862061780087627}}
{"text": "(*  File:       Plurality_Rule_Ref.thy\n    Copyright   2023  Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\<open>creator \"Valentin Springsklee, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\nsection \\<open>Refined Plurality Rule\\<close>\ntheory Plurality_Rule_Ref\n  imports Main\n    Verified_Voting_Rule_Construction.Plurality_Rule\n     \"Compositional_Structures/Basic_Modules/Plurality_Module_Ref\"  \n          \"Compositional_Structures/Elect_Composition_Ref\"  \n\nbegin\n\nsubsection \\<open>Refinement to Imperative/HOL\\<close>\n\ntext \\<open>The basic module for plurality has been refined. We use the simplified but correct\n      elect composition to define a sythesizable definition of the plurality rule inline\n      and use the sepref-tool to synthesize the implementation\\<close>\n\nsepref_definition plurality_rule_direct_sep is \"uncurry (elector_opt (plurality_mod))\"\n  :: \"elec_mod_seprel nat_assn\"\n  unfolding elector_opt_def hs.fold_custom_empty\n  apply sepref_dbg_keep\n  done\n\ntext \\<open>Using the correctness of the elector and the refinement theorem provided by sepref we provide\n      a simplified refinement relation of the plurality implementation and the abstract\n       sepcification\\<close>\n\nlemma opt_plur_correct:\n  shows \"(uncurry plurality_rule_direct_sep, uncurry (RETURN oo (plurality_rule)))\n  \\<in> elec_mod_seprel nat_assn\"\n  unfolding plurality_rule.simps \n  using plurality_rule_direct_sep.refine unfolding elector_opt_eq .\n\ndeclare opt_plur_correct [sepref_fr_rules]\n\n\nexport_code clist convert_list_to_hash_set plurality_rule_direct_sep in Scala_imp\n\n\nend", "meta": {"author": "SpringVaS", "repo": "RefinementOfVotingRules", "sha": "a01e44b062fb43e172dff81cffbf941856c977d8", "save_path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules", "path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules/RefinementOfVotingRules-a01e44b062fb43e172dff81cffbf941856c977d8/theories/Plurality_Rule_Ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.682573734412324, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3386206178008762}}
{"text": "theory Matching_Embeddings\nimports \"Semantics_Ternary/Matching_Ternary\" Matching \"Semantics_Ternary/Unknown_Match_Tacs\"\nbegin\n\nsection\\<open>Boolean Matching vs. Ternary Matching\\<close>\n\nterm Semantics.matches\nterm Matching_Ternary.matches\n(*'a is the primitive match condition, e.g. IpSrc \\<dots>*)\n\n\ntext\\<open>The two matching semantics are related. However, due to the ternary logic, we cannot directly translate one to the other.\nThe problem are @{const MatchNot} expressions which evaluate to @{const TernaryUnknown} because \\<open>MatchNot TernaryUnknown\\<close> and\n\\<open>TernaryUnknown\\<close> are semantically equal!\\<close>\nlemma \"\\<exists>m \\<beta> \\<alpha> a. Matching_Ternary.matches (\\<beta>, \\<alpha>) m a p \\<noteq> \n  Semantics.matches (\\<lambda> atm p. case \\<beta> atm p of TernaryTrue \\<Rightarrow> True | TernaryFalse \\<Rightarrow> False | TernaryUnknown \\<Rightarrow> \\<alpha> a p) m p\"\napply(rule_tac x=\"MatchNot (Match X)\" in exI) \\<comment> \\<open>any @{term \"X::'a\"}\\<close>\nby (auto split: ternaryvalue.split ternaryvalue.split_asm simp add: matches_case_ternaryvalue_tuple)\n\ntext\\<open>the @{const the} in the next definition is always defined\\<close>\nlemma \"\\<forall>m \\<in> {m. approx m p \\<noteq> TernaryUnknown}. ternary_to_bool (approx m p) \\<noteq> None\"\n  by(simp add: ternary_to_bool_None)\n\n\ntext\\<open>\nThe Boolean and the ternary matcher agree (where the ternary matcher is defined)\n\\<close>\ndefinition matcher_agree_on_exact_matches :: \"('a, 'p) matcher \\<Rightarrow> ('a \\<Rightarrow> 'p \\<Rightarrow> ternaryvalue) \\<Rightarrow> bool\" where\n  \"matcher_agree_on_exact_matches exact approx \\<equiv> \\<forall>p m. approx m p \\<noteq> TernaryUnknown \\<longrightarrow> exact m p = the (ternary_to_bool (approx m p))\"\n\ntext\\<open>We say the Boolean and ternary matchers agree iff they return the same result or the ternary matcher returns @{const TernaryUnknown}.\\<close>\nlemma \"matcher_agree_on_exact_matches exact approx \\<longleftrightarrow> (\\<forall>p m. exact m p = the (ternary_to_bool (approx m p)) \\<or> approx m p = TernaryUnknown)\"\n  unfolding matcher_agree_on_exact_matches_def by blast\nlemma matcher_agree_on_exact_matches_alt: (*no `the`*)\n  \"matcher_agree_on_exact_matches exact approx \\<longleftrightarrow> (\\<forall>p m. approx m p \\<noteq> TernaryUnknown \\<longrightarrow> bool_to_ternary (exact m p) = approx m p)\"\n  unfolding matcher_agree_on_exact_matches_def\n  by (metis (full_types) bool_to_ternary.simps(1) bool_to_ternary.simps(2) option.sel ternary_to_bool.simps(1)\n                         ternary_to_bool.simps(2) ternaryvalue.exhaust)\n\nlemma eval_ternary_Not_TrueD: \"eval_ternary_Not m = TernaryTrue \\<Longrightarrow> m = TernaryFalse\"\n  by (metis eval_ternary_Not.simps(1) eval_ternary_idempotence_Not)\n\n\nlemma matches_comply_exact: \"ternary_ternary_eval (map_match_tac \\<beta> p m) \\<noteq> TernaryUnknown \\<Longrightarrow>\n       matcher_agree_on_exact_matches \\<gamma> \\<beta> \\<Longrightarrow>\n        Semantics.matches \\<gamma> m p = Matching_Ternary.matches (\\<beta>, \\<alpha>) m a p\"\n  proof(unfold matches_case_ternaryvalue_tuple,induction m)\n  case Match thus ?case\n       by(simp split: ternaryvalue.split add: matcher_agree_on_exact_matches_def)\n  next\n  case (MatchNot m) thus ?case\n      apply(simp split: ternaryvalue.split add: matcher_agree_on_exact_matches_def)\n      apply(case_tac \"ternary_ternary_eval (map_match_tac \\<beta> p m)\")\n        by(simp_all)\n  next\n  case (MatchAnd m1 m2)\n    thus ?case\n     apply(case_tac \"ternary_ternary_eval (map_match_tac \\<beta> p m1)\")\n       apply(case_tac [!] \"ternary_ternary_eval (map_match_tac \\<beta> p m2)\")\n                by(simp_all)\n  next\n  case MatchAny thus ?case by simp\n  qed\n\n\nlemma matcher_agree_on_exact_matches_gammaE:\n  \"matcher_agree_on_exact_matches \\<gamma> \\<beta> \\<Longrightarrow> \\<beta> X p = TernaryTrue \\<Longrightarrow> \\<gamma> X p\"\n  apply(simp add: matcher_agree_on_exact_matches_alt)\n  apply(erule_tac x=p in allE)\n  apply(erule_tac x=X in allE)\n  apply(simp add: bool_to_ternary_simps)\n  done\n\n\n\n\nlemma in_doubt_allow_allows_Accept: \"a = Accept \\<Longrightarrow> matcher_agree_on_exact_matches \\<gamma> \\<beta> \\<Longrightarrow>\n        Semantics.matches \\<gamma> m p \\<Longrightarrow> Matching_Ternary.matches (\\<beta>, in_doubt_allow) m a p\"\n  apply(case_tac \"ternary_ternary_eval (map_match_tac \\<beta> p m) \\<noteq> TernaryUnknown\")\n   using matches_comply_exact apply fast\n  apply(simp add: matches_case_ternaryvalue_tuple)\n  done\n\nlemma not_exact_match_in_doubt_allow_approx_match: \"matcher_agree_on_exact_matches \\<gamma> \\<beta> \\<Longrightarrow> a = Accept \\<or> a = Reject \\<or> a = Drop \\<Longrightarrow>\n  \\<not> Semantics.matches \\<gamma> m p \\<Longrightarrow> \n  (a = Accept \\<and> Matching_Ternary.matches (\\<beta>, in_doubt_allow) m a p) \\<or> \\<not> Matching_Ternary.matches (\\<beta>, in_doubt_allow) m a p\"\n  apply(case_tac \"ternary_ternary_eval (map_match_tac \\<beta> p m) \\<noteq> TernaryUnknown\")\n   apply(drule(1) matches_comply_exact[where \\<alpha>=in_doubt_allow and a=a])\n   apply(rule disjI2)\n   apply fast\n  apply(simp)\n  apply(clarify)\n  apply(simp add: matches_case_ternaryvalue_tuple)\n  apply(cases a)\n         apply(simp_all)\n  done\n\n\n\n\nlemma in_doubt_deny_denies_DropReject: \"a = Drop \\<or> a = Reject \\<Longrightarrow> matcher_agree_on_exact_matches \\<gamma> \\<beta> \\<Longrightarrow>\n        Semantics.matches \\<gamma> m p \\<Longrightarrow> Matching_Ternary.matches (\\<beta>, in_doubt_deny) m a p\"\n  apply(case_tac \"ternary_ternary_eval (map_match_tac \\<beta> p m) \\<noteq> TernaryUnknown\")\n   using matches_comply_exact apply fast\n   apply(simp)\n  apply(auto simp add: matches_case_ternaryvalue_tuple)\n  done\n\nlemma not_exact_match_in_doubt_deny_approx_match: \"matcher_agree_on_exact_matches \\<gamma> \\<beta> \\<Longrightarrow> a = Accept \\<or> a = Reject \\<or> a = Drop \\<Longrightarrow>\n  \\<not> Semantics.matches \\<gamma> m p \\<Longrightarrow> \n  ((a = Drop \\<or> a = Reject) \\<and> Matching_Ternary.matches (\\<beta>, in_doubt_deny) m a p) \\<or> \\<not> Matching_Ternary.matches (\\<beta>, in_doubt_deny) m a p\"\n  apply(case_tac \"ternary_ternary_eval (map_match_tac \\<beta> p m) \\<noteq> TernaryUnknown\")\n   apply(drule(1) matches_comply_exact[where \\<alpha>=in_doubt_deny and a=a])\n   apply(rule disjI2)\n   apply fast\n  apply(simp)\n  apply(clarify)\n  apply(simp add: matches_case_ternaryvalue_tuple)\n  apply(cases a)\n         apply(simp_all)\n  done\n\ntext\\<open>The ternary primitive matcher can return exactly the result of the Boolean primitive matcher\\<close>\ndefinition \\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c :: \"('a, 'p) matcher \\<Rightarrow> ('a \\<Rightarrow> 'p \\<Rightarrow> ternaryvalue)\" where\n  \"\\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c \\<gamma> \\<equiv> (\\<lambda> a p. if \\<gamma> a p then TernaryTrue else TernaryFalse)\"\n\nlemma \"matcher_agree_on_exact_matches \\<gamma> (\\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c \\<gamma>)\"\n  by(simp add: matcher_agree_on_exact_matches_def \\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c_def)\n\nlemma \\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c_not_Unknown: \"ternary_ternary_eval (map_match_tac (\\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c \\<gamma>) p m) \\<noteq> TernaryUnknown\"\n  proof(induction m)\n  case MatchNot thus ?case using eval_ternary_Not_UnknownD \\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c_def\n     by (simp) blast\n  case (MatchAnd m1 m2) thus ?case\n    apply(case_tac \"ternary_ternary_eval (map_match_tac (\\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c \\<gamma>) p m1)\")\n      apply(case_tac [!] \"ternary_ternary_eval (map_match_tac (\\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c \\<gamma>) p m2)\")\n            by(simp_all add: \\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c_def)\n  qed (simp_all add: \\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c_def)\n\nlemma \\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c_matching: \"Matching_Ternary.matches ((\\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c \\<gamma>), \\<alpha>) m a p \\<longleftrightarrow> Semantics.matches \\<gamma> m p\"\n  proof(induction m)\n  case Match thus ?case \n    by(simp add: \\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c_def matches_case_ternaryvalue_tuple)\n  case MatchNot thus ?case\n    by(simp add: matches_case_ternaryvalue_tuple \\<beta>\\<^sub>m\\<^sub>a\\<^sub>g\\<^sub>i\\<^sub>c_not_Unknown split: ternaryvalue.split_asm)\n  qed (simp_all add: matches_case_ternaryvalue_tuple split: ternaryvalue.split ternaryvalue.split_asm)\n  \n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Iptables_Semantics/Matching_Embeddings.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737214979745, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.33862061139414706}}
{"text": "theory flash68Bra  imports flash68Rev\n \n  begin\nlemma onInv68:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv68  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv68 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash68Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737214979745, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.338620611394147}}
{"text": "(*  Title:      HOL/MicroJava/BV/BVSpec.thy\n    Author:     Cornelia Pusch, Gerwin Klein\n    Copyright   1999 Technische Universitaet Muenchen\n*)\n\nsection \\<open>The Bytecode Verifier \\label{sec:BVSpec}\\<close>\n\ntheory BVSpec\nimports Effect\nbegin\n\ntext \\<open>\n  This theory contains a specification of the BV. The specification\n  describes correct typings of method bodies; it corresponds \n  to type \\emph{checking}.\n\\<close>\n\ndefinition\n  \\<comment> \\<open>The program counter will always be inside the method:\\<close>\n  check_bounded :: \"instr list \\<Rightarrow> exception_table \\<Rightarrow> bool\" where\n  \"check_bounded ins et \\<longleftrightarrow>\n  (\\<forall>pc < length ins. \\<forall>pc' \\<in> set (succs (ins!pc) pc). pc' < length ins) \\<and>\n                     (\\<forall>e \\<in> set et. fst (snd (snd e)) < length ins)\"\n\ndefinition\n  \\<comment> \\<open>The method type only contains declared classes:\\<close>\n  check_types :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> JVMType.state list \\<Rightarrow> bool\" where\n  \"check_types G mxs mxr phi \\<longleftrightarrow> set phi \\<subseteq> states G mxs mxr\"\n\ndefinition\n  \\<comment> \\<open>An instruction is welltyped if it is applicable and its effect\\<close>\n  \\<comment> \\<open>is compatible with the type at all successor instructions:\\<close>\n  wt_instr :: \"[instr,jvm_prog,ty,method_type,nat,p_count,\n                exception_table,p_count] \\<Rightarrow> bool\" where\n  \"wt_instr i G rT phi mxs max_pc et pc \\<longleftrightarrow>\n  app i G mxs rT pc et (phi!pc) \\<and>\n  (\\<forall>(pc',s') \\<in> set (eff i G pc et (phi!pc)). pc' < max_pc \\<and> G \\<turnstile> s' <=' phi!pc')\"\n\ndefinition\n  \\<comment> \\<open>The type at \\<open>pc=0\\<close> conforms to the method calling convention:\\<close>\n  wt_start :: \"[jvm_prog,cname,ty list,nat,method_type] \\<Rightarrow> bool\" where\n  \"wt_start G C pTs mxl phi \\<longleftrightarrow>\n  G \\<turnstile> Some ([],(OK (Class C))#((map OK pTs))@(replicate mxl Err)) <=' phi!0\"\n\ndefinition\n  \\<comment> \\<open>A method is welltyped if the body is not empty, if execution does not\\<close>\n  \\<comment> \\<open>leave the body, if the method type covers all instructions and mentions\\<close>\n  \\<comment> \\<open>declared classes only, if the method calling convention is respected, and\\<close>\n  \\<comment> \\<open>if all instructions are welltyped.\\<close>\n  wt_method :: \"[jvm_prog,cname,ty list,ty,nat,nat,instr list,\n                 exception_table,method_type] \\<Rightarrow> bool\" where\n  \"wt_method G C pTs rT mxs mxl ins et phi \\<longleftrightarrow>\n  (let max_pc = length ins in\n  0 < max_pc \\<and> \n  length phi = length ins \\<and>\n  check_bounded ins et \\<and> \n  check_types G mxs (1+length pTs+mxl) (map OK phi) \\<and>\n  wt_start G C pTs mxl phi \\<and>\n  (\\<forall>pc. pc<max_pc \\<longrightarrow> wt_instr (ins!pc) G rT phi mxs max_pc et pc))\"\n\ndefinition\n  \\<comment> \\<open>A program is welltyped if it is wellformed and all methods are welltyped\\<close>\n  wt_jvm_prog :: \"[jvm_prog,prog_type] \\<Rightarrow> bool\" where\n  \"wt_jvm_prog G phi \\<longleftrightarrow>\n  wf_prog (\\<lambda>G C (sig,rT,(maxs,maxl,b,et)).\n           wt_method G C (snd sig) rT maxs maxl b et (phi C sig)) G\"\n\n\nlemma check_boundedD:\n  \"\\<lbrakk> check_bounded ins et; pc < length ins; \n    (pc',s') \\<in> set (eff (ins!pc) G pc et s)  \\<rbrakk> \\<Longrightarrow> \n  pc' < length ins\"\n  apply (unfold eff_def)\n  apply simp\n  apply (unfold check_bounded_def)\n  apply clarify\n  apply (erule disjE)\n   apply blast\n  apply (erule allE, erule impE, assumption)\n  apply (unfold xcpt_eff_def)\n  apply clarsimp    \n  apply (drule xcpt_names_in_et)\n  apply clarify\n  apply (drule bspec, assumption)\n  apply simp\n  done\n\nlemma wt_jvm_progD:\n  \"wt_jvm_prog G phi \\<Longrightarrow> (\\<exists>wt. wf_prog wt G)\"\n  by (unfold wt_jvm_prog_def, blast)\n\nlemma wt_jvm_prog_impl_wt_instr:\n  \"\\<lbrakk> wt_jvm_prog G phi; is_class G C;\n      method (G,C) sig = Some (C,rT,maxs,maxl,ins,et); pc < length ins \\<rbrakk> \n  \\<Longrightarrow> wt_instr (ins!pc) G rT (phi C sig) maxs (length ins) et pc\"\n  by (unfold wt_jvm_prog_def, drule method_wf_mdecl, \n      simp, simp, simp add: wf_mdecl_def wt_method_def)\n\ntext \\<open>\n  We could leave out the check \\<^term>\\<open>pc' < max_pc\\<close> in the \n  definition of \\<^term>\\<open>wt_instr\\<close> in the context of \\<^term>\\<open>wt_method\\<close>.\n\\<close>\nlemma wt_instr_def2:\n  \"\\<lbrakk> wt_jvm_prog G Phi; is_class G C;\n      method (G,C) sig = Some (C,rT,maxs,maxl,ins,et); pc < length ins; \n      i = ins!pc; phi = Phi C sig; max_pc = length ins \\<rbrakk> \n  \\<Longrightarrow> wt_instr i G rT phi maxs max_pc et pc =\n     (app i G maxs rT pc et (phi!pc) \\<and>\n     (\\<forall>(pc',s') \\<in> set (eff i G pc et (phi!pc)). G \\<turnstile> s' <=' phi!pc'))\"\napply (simp add: wt_instr_def)\napply (unfold wt_jvm_prog_def)\napply (drule method_wf_mdecl)\napply (simp, simp, simp add: wf_mdecl_def wt_method_def)\napply (auto dest: check_boundedD)\ndone\n\nlemma wt_jvm_prog_impl_wt_start:\n  \"\\<lbrakk> wt_jvm_prog G phi; is_class G C;\n      method (G,C) sig = Some (C,rT,maxs,maxl,ins,et) \\<rbrakk> \\<Longrightarrow> \n  0 < (length ins) \\<and> wt_start G C (snd sig) maxl (phi C sig)\"\n  by (unfold wt_jvm_prog_def, drule method_wf_mdecl, \n      simp, simp, simp add: wf_mdecl_def wt_method_def)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/MicroJava/BV/BVSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7341195152660687, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.3384414145582815}}
{"text": "(*\n    File:        LBeta.thy\n    Time-stamp:  <2016-01-02T15:01:15Z>\n    Author:      JRF\n    Web:         http://jrf.cocolog-nifty.com/software/2016/01/post.html\n    Logic Image: Logics_ZF (of Isabelle2020)\n*)\n\ntheory LBeta imports LAlpha begin\n\ndefinition LBeta1 :: \"[i, i]=>o\" where\n\"LBeta1(M, N) == M: LTerm &\n    (EX u: LSub(M). EX l x A B. u = <l, LApp(LLam(x, A), B)> &\n        LFreeForIn(B, x, A) &\n        N = LOccinv(Occ_Graft1(LOcc(M), l, LOcc(Lsubst(A, x, B)))))\"\n\ndefinition LBV :: \"i=>i\" where\n\"LBV(M) == {x: LVariable. EX l. <l, TLLam(x)>: LOcc(M)}\"\n\n\n(** LBeta1 **)\nlemma LBeta1_type1:\n  \"LBeta1(M, N) ==> M: LTerm\"\napply (unfold LBeta1_def)\napply (erule conjunct1)\ndone\n\nlemma LBeta1_type2:\n  \"LBeta1(M, N) ==> N: LTerm\"\napply (unfold LBeta1_def)\napply safe\napply (rule LTerm_def_Occinv_type)\napply (rule Occ_Graft1_in_Occ_range)\napply (erule_tac [2] LFreeForInE)\napply (assumption | rule LOcc_in_Occ_range Lsubst_type)+\napply (unfold LSub_def)\napply (erule RepFunE)\napply (frule LOcc_domain [THEN subsetD])\napply assumption\napply (erule SigmaE)\napply hypsubst\napply simp\napply (erule domainI)\ndone\n\nlemmas LTerm_def_Sub_rec = def_Sub_rec [OF\n  LTerm_Occ_cons_cond LTerm_Occ_ind_cond LOccinv_def\n  LSub_def LTerm_Term_cons_inj_cond]\n\nlemmas LTerm_def_Occinv_Occ = def_Occinv_Occ [OF\n  LTerm_Occ_cons_cond LTerm_Occ_ind_cond LOccinv_def]\n\nlemma LBeta1_baseI:\n  assumes major: \"LFreeForIn(B, x, A)\"\n  shows \"LBeta1(LApp(LLam(x, A), B), Lsubst(A, x, B))\"\napply (unfold LBeta1_def)\napply (rule major [THEN LFreeForInE])\napply (assumption | rule conjI bexI exI refl major LTerm.intros)+\nprefer 2 \napply (simp add: LTerm_def_Sub_rec LTerm_cons_eqns_sym)\napply (rule Occ_consI1)\napply (simp add: Occ_Graft1_Nil LTerm_def_Occinv_Occ)\ndone\n\nlemmas LTerm_def_Sub_type = def_Sub_type [OF\n  LTerm_Occ_cons_cond LTerm_Occ_ind_cond LOccinv_def\n  LSub_def]\n\nlemmas LTerm_def_Occinv2 = def_Occinv2 [OF\n  LTerm_Occ_cons_cond LTerm_Occ_ind_cond LOccinv_def]\n\nlemma LBeta1_LLamI:\n  \"[| LBeta1(M, M');  x: LVariable |] ==> LBeta1(LLam(x, M), LLam(x, M'))\"\napply (unfold LBeta1_def)\napply safe\napply (assumption | rule bexI conjI refl exI LTerm.intros)+\nprefer 2\napply (simp add: LTerm_def_Sub_rec LTerm_cons_eqns_sym)\napply (rule_tac a=\"0\" in Occ_consI2)\napply simp\napply (simp add: LTerm_cons_eqns)\napply (subgoal_tac \"A: LTerm\" \"B: LTerm\" \"xa: LVariable\" \"l: list(nat)\"\n        \"Occ_Graft1(LOcc(LLam(x, M)), Cons(0, l), LOcc(Lsubst(A, xa, B)))\n                  : Occ_range(LTag, LArity)\")\ndefer 1\napply (rule Occ_Graft1_in_Occ_range)\napply (assumption | rule LOcc_in_Occ_range Lsubst_type LTerm.intros)+\napply (simp add: LTerm_Occ_Term_cons LTerm_cons_eqns_sym)\napply (simp only: LSub_def)\napply (erule RepFunE)\napply (frule LOcc_domain [THEN subsetD])\napply assumption\napply (erule SigmaE)\napply hypsubst\napply simp\napply (rule Occ_consI2 [THEN domainI])\napply simp\napply simp\napply (erule LTerm_def_Sub_type [THEN subsetD, THEN SigmaD1])\napply assumption\napply (erule LFreeForInE, assumption)+\napply (simp add: LTerm_Occ_Term_cons LTerm_cons_eqns_sym)\napply (rule Occ_Graft1_Occ_cons_Cons [THEN ssubst])\napply (simp_all add: LTerm_cons_eqns_sym)\napply (rule LTerm_def_Occinv2 [THEN trans, THEN sym])\napply (rule_tac P=\"%x. x: Occ_range(LTag, LArity)\" in subst)\nprefer 2 apply assumption\napply (rule Occ_Graft1_Occ_cons_Cons [THEN ssubst])\napply (simp_all add: LTerm_def_Occinv_Occ)\napply (assumption | rule Occ_Graft1_domain LOcc_domain Lsubst_type\n        PowI list.intros LTag.intros)+\ndone\n\nlemma LBeta1_LAppI1:\n  \"[| LBeta1(A, A');  B: LTerm |] ==> LBeta1(LApp(A, B), LApp(A', B))\"\napply (unfold LBeta1_def)\napply safe\napply (assumption | rule bexI conjI refl exI LTerm.intros)+\nprefer 2\napply (simp add: LTerm_def_Sub_rec LTerm_cons_eqns_sym)\napply (rule_tac a=\"0\" in Occ_consI2)\napply simp\napply simp\napply (subgoal_tac \"Aa: LTerm\" \"Ba: LTerm\" \"x: LVariable\" \"l: list(nat)\"\n         \"Occ_Graft1(LOcc(LApp(A, B)), Cons(0, l), LOcc(Lsubst(Aa, x, Ba)))\n                 : Occ_range(LTag, LArity)\")\ndefer 1\napply (rule Occ_Graft1_in_Occ_range)\napply (assumption | rule LOcc_in_Occ_range Lsubst_type LTerm.intros)+\napply (simp add: LTerm_Occ_Term_cons LTerm_cons_eqns_sym)\napply (simp only: LSub_def)\napply (erule RepFunE)\napply (rule LOcc_domain [THEN subsetD, THEN SigmaE])\nprefer 2 apply assumption\napply assumption\napply hypsubst\napply simp\napply (rule Occ_consI2 [THEN domainI])\napply simp\napply simp\napply (rule LTerm_def_Sub_type [THEN subsetD, THEN SigmaD1])\nprefer 2 apply assumption\napply assumption\napply (erule LFreeForInE, assumption)+\napply (simp add: LTerm_Occ_Term_cons LTerm_cons_eqns_sym)\napply (rule Occ_Graft1_Occ_cons_Cons [THEN ssubst])\napply (simp_all add: LTerm_cons_eqns_sym)\napply (rule LTerm_def_Occinv2 [THEN trans, THEN sym])\napply (rule_tac P=\"%x. x: Occ_range(LTag, LArity)\" in subst)\nprefer 2 apply assumption\napply (rule Occ_Graft1_Occ_cons_Cons [THEN ssubst])\napply (simp_all add: LTerm_def_Occinv_Occ)\napply (assumption | rule conjI Occ_Graft1_domain LOcc_domain Lsubst_type\n         PowI list.intros LTag.intros)+\ndone\n\nlemma LBeta1_LAppI2:\n  \"[| LBeta1(B, B');  A: LTerm |] ==> LBeta1(LApp(A, B), LApp(A, B'))\"\napply (unfold LBeta1_def)\napply safe\napply (assumption | rule bexI conjI refl exI LTerm.intros)+\nprefer 2\napply (simp add: LTerm_def_Sub_rec LTerm_cons_eqns_sym)\napply (rule_tac a=\"1\" in Occ_consI2)\napply simp\napply simp\napply (subgoal_tac \"Aa: LTerm\" \"Ba: LTerm\" \"x: LVariable\" \"l: list(nat)\"\n         \"Occ_Graft1(LOcc(LApp(A, B)), Cons(1, l), LOcc(Lsubst(Aa, x, Ba)))\n                 : Occ_range(LTag, LArity)\")\ndefer 1\napply (rule Occ_Graft1_in_Occ_range)\napply (assumption | rule LOcc_in_Occ_range Lsubst_type LTerm.intros)+\napply (simp add: LTerm_Occ_Term_cons LTerm_cons_eqns_sym)\napply (simp only: LSub_def)\napply (erule RepFunE)\napply (rule LOcc_domain [THEN subsetD, THEN SigmaE])\nprefer 2 apply assumption\napply assumption\napply hypsubst\napply simp\napply (rule Occ_consI2 [THEN domainI])\napply simp\napply simp\napply (rule LTerm_def_Sub_type [THEN subsetD, THEN SigmaD1])\nprefer 2 apply assumption\napply assumption\napply (erule LFreeForInE, assumption)+\napply (simp add: LTerm_Occ_Term_cons LTerm_cons_eqns_sym)\napply (rule Occ_Graft1_Occ_cons_Cons [THEN ssubst])\napply (simp_all add: LTerm_cons_eqns_sym)\napply (rule LTerm_def_Occinv2 [THEN trans, THEN sym])\napply (rule_tac P=\"%x. x: Occ_range(LTag, LArity)\" in subst)\nprefer 2 apply assumption\napply (rule Occ_Graft1_Occ_cons_Cons [THEN ssubst])\napply (simp_all add: LTerm_def_Occinv_Occ)\napply (assumption | rule conjI Occ_Graft1_domain LOcc_domain Lsubst_type\n         PowI list.intros LTag.intros)+\ndone\n\nlemma LBeta1_LVarE:\n  \"LBeta1(LVar(x), N) ==> R\"\napply (unfold LBeta1_def)\napply (safe elim!: LTerm_typeEs)\napply (rotate_tac 2)\napply (simp add: LTerm_def_Sub_rec LTerm_cons_eqns_sym)\napply (simp only: LTerm_cons_eqns)\napply (erule Occ_consE2)\nprefer 3 apply simp\napply (safe elim!: LTerm.free_elims)\ndone\n\nlemma LBeta1_LLamE:\n  assumes major: \"LBeta1(LLam(x, M), N)\"\n  and prem:\n   \"!!N'. [| N = LLam(x, N'); LBeta1(M, N'); x: LVariable |] ==> R\"\n  shows \"R\"\napply (insert major)\napply (unfold LBeta1_def)\napply (erule_tac conjE bexE exE LTerm_typeEs)+\napply (rotate_tac 4)\napply hypsubst\napply (simp add: LTerm_def_Sub_rec LTerm_Occ_Term_cons\n        LTerm_cons_eqns_sym)\napply (simp only: LTerm_cons_eqns)\napply (erule Occ_consE)\napply (blast elim!: LTerm.free_elims)\napply simp\napply (erule succE)\napply (erule_tac [2] emptyE)\napply (erule conjE)\napply hypsubst\napply simp\n\napply (rule prem [unfolded LBeta1_def])\napply (erule trans)\ndefer 1\napply (assumption | rule conjI refl bexI exI)+\napply (rule Occ_Graft1_Occ_cons_Cons [THEN ssubst])\napply simp_all\napply (rule LTerm_def_Sub_type [THEN subsetD, THEN SigmaD1])\nprefer 2 apply assumption\napply assumption\napply (subgoal_tac \"A: LTerm\" \"xa: LVariable\" \"B: LTerm\"\n         \"Occ_Graft1(LOcc(M), m, LOcc(Lsubst(A, xa, B))):\n             Occ_range(LTag, LArity)\"\n         \"LOccinv(Occ_Graft1(LOcc(M), m, LOcc(Lsubst(A, xa, B)))):\n                  LTerm\")\ndefer 1\napply (rule_tac [2] Occ_Graft1_in_Occ_range)\napply (assumption | rule LOcc_in_Occ_range Lsubst_type\n         LTerm_def_Occinv_type LTerm.intros)+\napply (simp only: LSub_def)\napply (erule RepFunE)\napply (rule LOcc_domain [THEN subsetD, THEN SigmaE])\nprefer 2\napply assumption\nprefer 2\napply hypsubst\napply simp\napply (erule domainI)\napply assumption\napply (erule LFreeForInE, assumption)+\napply (rule trans)\napply (rule_tac [2] LTerm_def_Occinv_Occ)\napply (rule_tac f=\"LOccinv\" in function_apply_eq)\napply (simp_all add: LTerm_Occ_Term_cons LTerm_def_Occ_Occinv\n         LTerm_cons_eqns_sym)\ndone\n\nlemma LBeta1_LAppE:\n  assumes major: \"LBeta1(LApp(A, B), N)\"\n  and prem1:\n     \"!!x N'. [| A = LLam(x, N'); N = Lsubst(N', x, B);\n              LFreeForIn(B, x, N') |] ==> R\"\n  and prem2:\n     \"!!A'. [| N = LApp(A',B); LBeta1(A, A'); B: LTerm |] ==> R\"\n  and prem3:\n     \"!!B'. [| N = LApp(A, B'); LBeta1(B, B'); A: LTerm |] ==> R\"\n  shows \"R\"\napply (insert major)\napply (unfold LBeta1_def)\napply (erule conjE bexE exE LTerm_typeEs)+\napply (rotate_tac 4)\napply hypsubst\napply (simp add: LTerm_def_Sub_rec LTerm_Occ_Term_cons\n         LTerm_cons_eqns_sym)\napply (simp only: LTerm_cons_eqns)\napply (erule Occ_consE)\nprefer 2\napply simp\ndefer 1\napply (erule_tac [2] succE)\napply (erule_tac [3] succE)\napply (rule_tac [3] prem2)\napply (rule_tac [2] prem3)\napply (rule_tac [1] prem1)\napply (unfold LBeta1_def)\napply (safe elim!: LTerm.free_elims LTerm_typeEs)\napply (rule refl)\napply (rule Occ_Graft1_Nil [THEN ssubst])\napply (rule Occ_cons_type)\napply (rule LTag.intros)\napply (assumption | rule Occ_cons_type LOcc_domain PowI\n        Lsubst_type list.intros LTerm.intros)+\napply (simp add: LTerm_def_Occinv_Occ)\napply assumption\napply simp_all\nprefer 2 apply (assumption | rule bexI exI conjI refl)+\nprefer 3 apply (assumption | rule bexI exI conjI refl)+\napply (rule_tac [2] Occ_Graft1_Occ_cons_Cons [THEN ssubst])\napply (rule_tac [1] Occ_Graft1_Occ_cons_Cons [THEN ssubst])\napply simp_all\napply (rule LTerm_def_Sub_type [THEN subsetD, THEN SigmaD1])\nprefer 2 apply assumption\napply assumption\napply (rule_tac [2] LTerm_def_Sub_type [THEN subsetD, THEN SigmaD1])\nprefer 3 apply assumption\nprefer 2 apply assumption\n\napply (subgoal_tac [2] \"Aa: LTerm\" \"x: LVariable\" \"Ba: LTerm\"\n         \"Occ_Graft1(LOcc(A), m, LOcc(Lsubst(Aa, x, Ba))):\n             Occ_range(LTag, LArity)\"\n         \"LOccinv(Occ_Graft1(LOcc(A), m, LOcc(Lsubst(Aa, x, Ba)))):\n              LTerm\")\napply (subgoal_tac [1] \"Aa: LTerm\" \"x: LVariable\" \"Ba: LTerm\"\n         \"Occ_Graft1(LOcc(B), m, LOcc(Lsubst(Aa, x, Ba))):\n             Occ_range(LTag, LArity)\"\n         \"LOccinv(Occ_Graft1(LOcc(B), m, LOcc(Lsubst(Aa, x, Ba)))):\n              LTerm\")\ndefer 1\napply (rule_tac [2] Occ_Graft1_in_Occ_range)\napply (assumption | rule LOcc_in_Occ_range Lsubst_type\n         LTerm_def_Occinv_type LTerm.intros)+\napply (simp only: LSub_def)\napply (erule RepFunE)\napply (rule LOcc_domain [THEN subsetD, THEN SigmaE])\nprefer 2 apply assumption\napply assumption\napply hypsubst\napply simp\napply (erule domainI)\napply (erule LFreeForInE, assumption)+\ndefer 1\napply (rule_tac [2] Occ_Graft1_in_Occ_range)\napply (assumption | rule LOcc_in_Occ_range Lsubst_type\n         LTerm_def_Occinv_type LTerm.intros)+\napply (simp only: LSub_def)\napply (erule RepFunE)\napply (rule LOcc_domain [THEN subsetD, THEN SigmaE])\nprefer 2 apply assumption\napply assumption\napply hypsubst\napply simp\napply (erule domainI)\napply (erule LFreeForInE, assumption)+\napply (rule_tac [2] trans)\napply (rule_tac [3] LTerm_def_Occinv_Occ)\napply (rule_tac [2] f=\"LOccinv\" in function_apply_eq)\napply (rule trans)\napply (rule_tac [2] LTerm_def_Occinv_Occ)\napply (rule_tac f=\"LOccinv\" in function_apply_eq)\napply (simp_all add: LTerm_Occ_Term_cons LTerm_def_Occ_Occinv\n         LTerm_cons_eqns_sym)\ndone\n\nlemmas LBeta1_LTermEs = LBeta1_LVarE LBeta1_LLamE LBeta1_LAppE\n\nlemma LBeta1_redex_lemma:\n  assumes infv: \"Infinite(LVariable)\"\n  and major: \"M: LTerm\"\n  and prem: \"<l, LApp(LLam(x, A),B)>: LSub(M)\"\n  shows \"EX N A'. LAlpha(M, N) & <l, LApp(LLam(x, A'), B)>: LSub(N) &\n              LFreeForIn(B, x, A')\"\napply (rule prem [THEN rev_mp])\napply (rule_tac x=\"l\" in spec)\napply (rule major [THEN LTerm.induct])\napply (simp_all add: LTerm_def_Sub_rec LTerm_cons_eqns_sym)\napply (simp_all only: LTerm_cons_eqns)\napply (rule_tac [3] impI [THEN allI], erule_tac [3] Occ_consE2)\napply (rule_tac [2] impI [THEN allI], erule_tac [2] Occ_consE2)\napply (rule_tac [1] impI [THEN allI], erule_tac [1] Occ_consE2)\nprefer 4\nprefer 7\napply (assumption | rule LTerm_def_Sub_type [THEN PowI]\n        list.intros)+\napply (simp_all add: le_succ_iff)\napply (safe elim!: LTerm.free_elims LTerm_typeEs)\napply simp_all\napply (rule_tac [2] infv [THEN Infinite_LVariable_LAlpha_lemma, THEN bexE])\napply (erule_tac [5] conjE)\napply (rule_tac [5] exI)\napply (rule_tac [5] conjI)\napply (rule_tac [6] exI)\napply (rule_tac [6] conjI)\nprefer 7 apply assumption\napply (rule_tac [5] LAlpha_LAppI)\napply (rule_tac [5] LAlpha_LLamI1)\nprefer 5 apply assumption\napply (erule_tac [2] asm_rl | rule_tac [2] LAlpha_refl)+\nprefer 2 apply (simp add: LTerm_def_Sub_rec LTerm_cons_eqns_sym)\napply (rule Occ_consI1)\n\napply (drule_tac [3] spec [THEN mp], erule_tac [3] asm_rl)\napply (drule_tac [2] spec [THEN mp], erule_tac [2] asm_rl)\napply (drule_tac [1] spec [THEN mp], erule_tac [1] asm_rl)\napply safe\n\nprefer 3\napply (intro exI conjI)\napply (assumption | rule LAlpha_LLamI1 LAlpha_LAppI LAlpha_refl)+\nprefer 2 apply assumption\napply (frule LAlphaD1 [THEN LSkeltonEqD2])\napply (simp add: LTerm_def_Sub_rec LTerm_cons_eqns_sym)\napply (rule Occ_consI2)\napply simp\napply simp\n\nprefer 2\napply (intro exI conjI)\napply (assumption | rule LAlpha_LLamI1 LAlpha_LAppI LAlpha_refl)+\nprefer 2 apply assumption\napply (frule LAlphaD1 [THEN LSkeltonEqD2])\napply (simp add: LTerm_def_Sub_rec LTerm_cons_eqns_sym)\napply (rule Occ_consI2)\napply simp\napply simp\n\napply (intro exI conjI)\napply (assumption | rule LAlpha_LLamI1 LAlpha_LAppI LAlpha_refl)+\nprefer 2 apply assumption\napply (frule LAlphaD1 [THEN LSkeltonEqD2])\napply (simp add: LTerm_def_Sub_rec LTerm_cons_eqns_sym)\napply (rule Occ_consI2)\napply simp\napply simp\ndone\n\nlemma LFreeForIn_left_LsubstD1:\n  assumes major: \"LFreeForIn(Lsubst(A, x, B), y, M)\"\n  and prem1: \"LFreeForIn(LVar(x), y, M)\"\n  and prem2: \"LFreeForIn(B, x, A)\"\n  shows \"LFreeForIn(A, y, M)\"\napply (insert prem1 [THEN LFreeForInD1] prem1 [THEN LFreeForInD2]\n              prem1 [THEN LFreeForInD3] prem2 [THEN LFreeForInD1]\n              prem2 [THEN LFreeForInD2] prem2 [THEN LFreeForInD3])\napply (erule LTerm_typeEs)\napply (insert prem2)\napply (rule LFreeForInI)\napply (erule_tac [4] LFV_E)\napply (case_tac [4] \"x = z\")\nprefer 4 apply hypsubst\ndefer 1\napply (rule_tac [4] major [THEN LFreeForInE])\napply (rule_tac [5] prem1 [THEN LFreeForInE])\napply (erule_tac [5] spec [THEN spec, THEN spec, THEN mp])\napply (erule_tac [4] spec [THEN spec, THEN spec, THEN mp])\napply safe\nprefer 5 apply simp\napply (erule_tac [2] asm_rl)+\napply (rule LFV_I)\napply (rule LFreeIn_LsubstI1)\napply assumption+\ndone\n\nlemma LFreeForIn_right_LsubstD:\n  assumes major: \"LFreeForIn(A, x, Lsubst(M, y, B))\"\n  and prem1: \"LFreeForIn(B, y, M)\"\n  and prem2: \"x: LFV(B)\"\n  shows \"LFreeForIn(A, y, M)\"\napply (insert major [THEN LFreeForInD1] major [THEN LFreeForInD2]\n              major [THEN LFreeForInD3] prem1 [THEN LFreeForInD1]\n              prem1 [THEN LFreeForInD2] prem1 [THEN LFreeForInD3])\napply (rule prem2 [THEN LFV_E])\napply (case_tac \"y: LFV(M)\")\nprefer 2\napply (rule LFreeForInI)\napply (erule_tac [4] notE, erule_tac [4] LFV_I)\napply (rule_tac [4] LFreeForInI)\napply assumption+\napply (erule LFV_E)+\napply (rule major [THEN LFreeForInE])\napply (erule spec [THEN spec, THEN spec, THEN mp])\napply safe\napply (erule LFV_I)\napply (rule_tac [2] LOcc_LsubstI1)\nprefer 3 apply assumption\nprefer 2 apply (blast elim!: LFO_E LTag.free_elims)\napply (rule LFreeIn_LsubstI2)\napply (assumption | rule prem1 LFO_I)+\napply (erule initseg_appI3)\napply (erule LFreeInE2, erule LOcc_typeD1, assumption)\ndone\n\nlemma LFreeIn_TLVar_leaf:\n  assumes prem1: \"LFreeIn(<l, T>, M)\"\n  and prem2: \"<l @ m, U>: LOcc(M)\"\n  shows \"m = [] & T = U\"\napply (rule prem1 [THEN LFreeInE])\napply (frule prem2 [THEN [2] TLVar_leaf])\napply safe\napply (rule initseg_appI1)\napply (erule_tac [3] app_Nil_eqD1)\napply (frule_tac [2] prem2 [THEN LOcc_typeD1])\napply (erule_tac [2] app_typeD)\napply (assumption | erule LOcc_typeD1)+\ndone\n\nlemma LFreeForIn_right_LsubstI1:\n  assumes prem1: \"LFreeForIn(N, x, A)\"\n  and prem2: \"B: LTerm\"\n  and prem3: \"x ~: LFV(B)\"\n  shows \"LFreeForIn(N, x, Lsubst(A, y, B))\"\napply (insert prem1 [THEN LFreeForInD1] prem1 [THEN LFreeForInD2]\n              prem1 [THEN LFreeForInD3])\napply (insert prem2)\napply (assumption | rule Lsubst_type LFreeForInI)+\napply (safe elim!: LFreeIn_LsubstE initseg_right_appE\n          initseg_left_appE LOcc_LsubstE LFV_E LFO_E2\n          dest!: sym [THEN app_Nil_eqD1])\nprefer 2\nprefer 4\nprefer 6\nprefer 8\nprefer 9\napply (erule LFreeInE2, erule LOcc_typeD1, assumption)+\nprefer 2\nprefer 3\nprefer 4\nprefer 6\napply (erule LFV_I [THEN prem3 [THEN notE]])+\napply (frule_tac [2] LFreeIn_TLVar_leaf, erule_tac [2] LFreeInE2,\n       erule_tac [2] asm_rl)\nprefer 2 apply (blast elim!: LTag.free_elims)\napply (rule prem1 [THEN LFreeForInE])\napply (erule spec [THEN spec, THEN spec, THEN mp])\napply (assumption | rule LFV_I conjI initseg_appI1)+\ndone\n\nlemma LFreeForIn_left_LsubstI:\n  assumes prem1: \"LFreeForIn(A, x, M)\"\n  and prem2: \"LFreeForIn(B, x, M)\"\n  shows \"LFreeForIn(Lsubst(A, y, B), x, M)\"\napply (insert prem1 [THEN LFreeForInD1] prem1 [THEN LFreeForInD2]\n              prem1 [THEN LFreeForInD3] prem2 [THEN LFreeForInD1]\n              prem2 [THEN LFreeForInD2] prem2 [THEN LFreeForInD3])\napply (assumption | rule Lsubst_type LFreeForInI)+\napply (safe elim!: LFreeIn_LsubstE LFV_E)\napply (rule prem1 [THEN LFreeForInE])\napply (erule spec [THEN spec, THEN spec, THEN mp])\napply (assumption | rule LFV_I conjI initseg_appI1)+\napply (rule prem2 [THEN LFreeForInE])\napply (erule spec [THEN spec, THEN spec, THEN mp])\napply (assumption | rule LFV_I conjI initseg_appI1)+\ndone\n\nlemma LBeta1_LsubstI:\n  assumes major: \"LBeta1(M, M')\"\n  and prem1: \"LFreeForIn(N, x, M)\"\n  and prem2: \"LFreeForIn(N, x, M')\"\n  shows \"LBeta1(Lsubst(M, x, N), Lsubst(M', x, N))\"\napply (rule prem2 [THEN rev_mp])\napply (rule prem1 [THEN rev_mp])\napply (rule major [THEN rev_mp])\napply (rule major [THEN LBeta1_type2, THEN [2] bspec])\napply (rule major [THEN LBeta1_type1, THEN LTerm.induct])\napply (safe elim!: LBeta1_LTermEs LFreeForIn_LTermEs)\napply (subgoal_tac [8] \"xaa ~= x\")\nprefer 9 apply blast\napply (simp_all add: Lsubst_lemma Lsubst_lemma4\n        LFreeForInD1 LFreeForInD3)\napply (rule_tac [10] LBeta1_LAppI2)\napply (rule_tac [9] LBeta1_LAppI1)\napply (rule_tac [8] LBeta1_LLamI LBeta1_baseI)\napply (rule_tac [7] LBeta1_LLamI LBeta1_baseI)\napply (rule_tac [6] LBeta1_LLamI LBeta1_baseI)\napply (rule_tac [5] LBeta1_LLamI LBeta1_baseI)\napply (rule_tac [4] LBeta1_LLamI LBeta1_baseI)\napply (rule_tac [3] LBeta1_LLamI LBeta1_baseI)\napply (rule_tac [2] LBeta1_LLamI LBeta1_baseI)\napply (rule_tac [1] LBeta1_LLamI LBeta1_baseI)\nprefer 1\nprefer 2\nprefer 4\nprefer 6\nprefer 8\nprefer 9\nprefer 10\nprefer 15\nprefer 17\napply (assumption | rule Lsubst_type \n       | erule LTerm_typeEs | erule LFreeForInD1)+\napply (simp_all add: LFreeForInD1 LFreeForInD3)\napply (drule_tac [2] bspec [THEN mp, THEN mp, THEN mp])\nprefer 3 apply assumption\napply (erule_tac [2] LFreeForInD3)\napply (rule_tac [2] LFreeForInI)\napply (erule_tac [5] notE, erule_tac [5] LFV_I)\napply (erule_tac [2] asm_rl LFreeForInD1)+\napply (drule bspec [THEN mp, THEN mp])\nprefer 2 apply assumption\napply (erule LBeta1_type2)\napply (rule LFreeForInI)\napply (erule_tac [4] notE, erule_tac [4] LFV_I)\napply (erule_tac [3] LBeta1_type2)\napply (erule_tac [1] LFreeForInD1)\napply assumption\napply (simp add: LBeta1_type2)\napply (rule_tac [2] LFreeForIn_right_LsubstI1)\napply (erule_tac [3] LFreeForInD1)\nprefer 3 apply assumption\napply (case_tac [3] \"x: LFV(Na)\")\napply (case_tac [2] \"x: LFV(Na)\")\napply (case_tac [1] \"x: LFV(Na)\")\napply (simp_all add: LFreeForInD1)\napply (safe dest!: LFreeForIn_right_LsubstD)\napply (assumption | rule LFreeForIn_left_LsubstI)+\ndone\n\n\n(** LBV **)\nlemma LBV_I:\n  \"[| <l, TLLam(x)>: LOcc(M); M: LTerm |] ==> x: LBV(M)\"\napply (unfold LBV_def)\napply (frule LOcc_typeD2)\napply assumption\napply (erule LTag_typeEs)\napply blast\ndone\n\nlemma LBV_E:\n  \"[| x: LBV(M);\n      !!l. [| <l, TLLam(x)>: LOcc(M); x: LVariable |] ==> R\n   |] ==> R\"\napply (unfold LBV_def)\napply blast\ndone\n\nlemma LBV_LVar:\n  \"x: LVariable ==> LBV(LVar(x)) = 0\"\napply (rule equalityI)\napply (blast elim!: LBV_E LOcc_LTermEs LTag.free_elims\n           intro: LBV_I intro!: LOcc_LTermIs)+\ndone\n\nlemma LBV_LLam:\n  \"[| x: LVariable; M: LTerm |] ==> LBV(LLam(x, M)) = cons(x, LBV(M))\"\napply (rule equalityI)\napply (blast elim!: LBV_E LOcc_LTermEs LTag.free_elims\n           intro: LBV_I intro!: LOcc_LTermIs)+\ndone\n\nlemma LBV_LApp:\n  \"[| M: LTerm; N: LTerm |] ==> LBV(LApp(M, N)) = LBV(M) Un LBV(N)\"\napply (rule equalityI)\napply (blast elim!: LBV_E LOcc_LTermEs LTag.free_elims\n           intro: LBV_I intro!: LOcc_LTermIs)+\ndone\n\nlemmas LBV_eqns = LBV_LVar LBV_LLam LBV_LApp\n\nlemma LAV_eq_LFV_LBV:\n  \"M: LTerm ==> LAV(M) = LFV(M) Un LBV(M)\"\napply (erule LTerm.induct)\napply (simp_all add: LBV_eqns)\napply (rule equalityI, blast, blast)+\ndone\n\nlemma LBV_Lsubst1:\n  assumes major: \"M: LTerm\"\n  and prem1: \"N: LTerm\"\n  and prem2: \"x: LFV(M)\"\n  shows \"LBV(Lsubst(M, x, N)) = LBV(M) Un LBV(N)\"\napply (insert prem1)\napply (rule prem2 [THEN rev_mp])\napply (rule major [THEN LTerm.induct])\napply (case_tac [3] \"x: LFV(M)\")\napply (case_tac [3] \"x: LFV(Na)\")\napply (simp_all add: LBV_eqns)\napply blast+\ndone\n\nlemma LBV_Lsubst2:\n  \"[| M: LTerm; N: LTerm |] ==> LBV(Lsubst(M, x, N)) <= LBV(M) Un LBV(N)\"\napply (case_tac \"x: LFV(M)\")\napply (simp_all add: LBV_Lsubst1)\napply (rule Un_upper1)\ndone\n\nlemma disjoint_LBV_LFV_imp_LFreeForIn:\n  \"[| LBV(M) Int LFV(N) = 0; M: LTerm; N: LTerm; x: LVariable |]\n       ==> LFreeForIn(N, x, M)\"\napply (assumption | rule LFreeForInI)+\napply (erule disjointE)\napply (assumption | rule LBV_I)+\ndone\n\nlemma LFV_Fin:\n  \"M: LTerm ==> LFV(M): Fin(LVariable)\"\napply (rule Fin_subset)\napply (assumption | rule LFV_subset_LAV LAV_Fin)+\ndone\n\nlemma LBV_Fin:\n  assumes major: \"M: LTerm\"\n  shows \"LBV(M): Fin(LVariable)\"\napply (rule Fin_subset)\napply (rule_tac [2] major [THEN LAV_Fin])\napply (rule major [THEN LAV_eq_LFV_LBV, THEN ssubst])\napply (rule Un_upper2)\ndone\n\nlemma Infinite_LVariable_LAlpha_lemma3:\n  assumes infv: \"Infinite(LVariable)\"\n  and major: \"M: LTerm\"\n  and prem: \"X: Fin(LVariable)\"\n  shows \"EX M'. LAlpha(M, M') & LBV(M') Int X = 0\"\napply (rule major [THEN LTerm.induct])\napply (rule exI)\napply (rule LAlpha_LVarI [THEN conjI])\napply assumption\napply (simp add: LBV_eqns)\napply safe\napply (frule LAlphaD1 [THEN LSkeltonEqD2])\napply (rule_tac F=\"X Un LAV(M') Un {x}\" in infv [THEN InfiniteE])\napply (assumption | rule Fin_UnI LAV_Fin prem Fin.intros)+\napply (simp add: LAV_eq_LFV_LBV)\napply (erule conjE)+\napply (rule conjI [THEN exI])\napply (rule LAlpha_LLamI3)\nprefer 3 apply assumption\napply (rule_tac [2] disjoint_LBV_LFV_imp_LFreeForIn)\nprefer 2\napply simp\napply (rule disjointI)\napply blast\napply (assumption | rule LTerm.intros)+\napply (case_tac \"x: LFV(M')\")\nprefer 2\napply (simp_all add: LBV_eqns LBV_Lsubst1)\napply (rule cons_eq [THEN subst])\napply (rule_tac [2] cons_eq [THEN subst])\napply (rule disjoint_UnI)\napply (rule_tac [3] disjoint_UnI)\napply (rule disjointI)\napply (rule_tac [3] disjointI)\nprefer 2\nprefer 4\napply assumption+\napply blast\napply blast\napply (rule conjI [THEN exI])\napply (assumption | rule LAlpha_LAppI)+\napply (simp add: LBV_eqns LAlphaD1 [THEN LSkeltonEqD2])\napply (assumption | rule disjoint_UnI)+\ndone\n\nlemma LBeta1_LBV_lemma:\n  assumes major: \"LBeta1(M, N)\"\n  shows \"LBV(N) <= LBV(M)\"\napply (rule major [THEN rev_mp])\napply (rule major [THEN LBeta1_type2, THEN rev_bspec])\napply (rule major [THEN LBeta1_type1, THEN LTerm.induct])\napply (safe elim!: LBeta1_LTermEs LTerm_typeEs)\napply (case_tac [2] \"xb: LFV(N')\")\napply (rotate_tac [3] 5)\napply (rotate_tac [2] 6)\napply (rotate_tac [4] 5)\napply (rotate_tac [5] 5)\napply (simp_all add: LBV_eqns LBV_Lsubst1)\napply (drule_tac [3] bspec [THEN mp], erule_tac [3] LBeta1_type2,\n       erule_tac [3] asm_rl)\napply (drule_tac [2] bspec [THEN mp], erule_tac [2] LBeta1_type2,\n       erule_tac [2] asm_rl)\napply (drule_tac [1] bspec [THEN mp], erule_tac [1] LBeta1_type2,\n       erule_tac [1] asm_rl)\napply safe\napply (erule swap, rule subsetD, assumption, assumption)\napply (erule subsetD, assumption)\napply (erule swap, rule subsetD, assumption, assumption)\ndone\n\nlemma LBeta1_LFV_lemma:\n  assumes major: \"LBeta1(M, N)\"\n  shows \"LFV(N) <= LFV(M)\"\napply (rule major [THEN rev_mp])\napply (rule major [THEN LBeta1_type2, THEN [2] bspec])\napply (rule major [THEN LBeta1_type1, THEN LTerm.induct])\napply (safe elim!: LBeta1_LTermEs LTerm_typeEs)\napply (rotate_tac [3] 5)\napply (rotate_tac [4] 5)\napply simp_all\napply (drule_tac [4] bspec [THEN mp], erule_tac [4] LBeta1_type2,\n       erule_tac [4] asm_rl)\napply (drule_tac [3] bspec [THEN mp], erule_tac [3] LBeta1_type2,\n       erule_tac [3] asm_rl)\napply (drule_tac [1] bspec [THEN mp], erule_tac [1] LBeta1_type2,\n       erule_tac [1] asm_rl)\napply (safe elim!: LFV_E LFreeIn_LsubstE LTag.free_elims)\napply (erule_tac [4] notE, erule_tac [4] LFV_I)\napply (erule_tac [3] notE, erule_tac [3] LFV_I)\napply (erule_tac [4] swap, rule_tac [4] subsetD,\n       erule_tac [4] asm_rl, erule_tac [4] LFV_I)\napply (erule_tac [3] subsetD, erule_tac [3] LFV_I)\napply (erule_tac [1] subsetD, erule_tac [1] LFV_I)\napply (erule LFV_I)\ndone\n\nlemma LBeta1_LAlpha_parallel_lemma:\n  assumes infv: \"Infinite(LVariable)\"\n  and major: \"LBeta1(M, N)\"\n  and prem1: \"X: Fin(LVariable)\"\n  shows \"EX M' N'. LAlpha(M, M') & LAlpha(N, N') &\n            LBV(M') Int X = 0  & LBeta1(M', N')\"\napply (insert prem1)\napply (rule major [THEN rev_mp])\napply (rule major [THEN LBeta1_type2, THEN [2] bspec])\napply (rule major [THEN LBeta1_type1, THEN LTerm.induct])\napply (safe elim!: LBeta1_LTermEs)\napply (frule_tac [2] LFreeForInD2)\napply (frule_tac [2] LFreeForInD3)\napply (rule_tac [2] F=\"X Un LFV(N')\" in infv [THEN InfiniteE])\napply (erule_tac [2] asm_rl | rule_tac [2] Fin_UnI prem1 LFV_Fin)+\n\napply (rule_tac [2] M1=\"N\" and X1=\"X\" in \n         infv [THEN Infinite_LVariable_LAlpha_lemma3, THEN revcut_rl])\napply (erule_tac [2] asm_rl | rule_tac [2] prem1)+\napply (erule_tac [2] exE)\napply (erule_tac [2] conjE)\napply (frule_tac [2] LAlphaD1 [THEN LSkeltonEqD2])\napply (rule_tac [2] M1=\"N'\" and X1=\"X Un {xb} Un LFV(M')\" in \n         infv [THEN Infinite_LVariable_LAlpha_lemma3, THEN revcut_rl])\napply (erule_tac [2] asm_rl | rule_tac [2] Fin.intros \n        Fin_UnI prem1 LFV_Fin)+\napply (erule_tac [2] exE)\napply (simp_all add: disjoint_Un_iff2 disjoint_cons_iff2)\napply (erule_tac [2] conjE)+\napply (frule_tac [2] N=\"M'a\" in LAlphaD1 [THEN LSkeltonEqD2])\n\napply (subgoal_tac [2] \"xb ~: LFV(M'a)\" \"LFreeForIn(M', xb, M'a)\"\n         \"LFreeForIn(LVar(xb), xa, M'a)\")\napply (rule_tac [3] disjoint_LBV_LFV_imp_LFreeForIn)\nprefer 3 apply (simp add: disjoint_Un_iff2 disjoint_cons_iff2)\napply (erule_tac [3] asm_rl | rule_tac [3] LTerm.intros)+\napply (erule_tac [3] disjoint_LBV_LFV_imp_LFreeForIn)\napply (rule_tac [6] notI)\napply (erule_tac [6] LFV_E)\napply (drule_tac [6] LAlpha_sym [THEN LAlphaD2], erule_tac [6] asm_rl)\napply (erule_tac [6] notE, erule_tac [6] LFV_I)\napply (erule_tac [3] asm_rl)+\n\napply (rule_tac [2] conjI [THEN exI])\napply (rule_tac [3] exI)\napply (rule_tac [2] LAlpha_LAppI)\napply (rule_tac [2] LAlpha_LLamI3)\napply (erule_tac [3] asm_rl)\napply (erule_tac [2] asm_rl | rule_tac [2] conjI)+\napply (rule_tac [3] conjI)\napply (rule_tac [4] LBeta1_baseI)\napply (case_tac [3] \"xa: LFV(M'a)\")\nprefer 4 apply (simp add: LBV_eqns\n                 disjoint_Un_iff disjoint_cons_iff)\nprefer 3 apply (simp add: LBV_eqns LBV_Lsubst1\n                 disjoint_Un_iff disjoint_cons_iff)\nprefer 2\napply (simp add: Lsubst_lemma2)\nprefer 2\napply (rule_tac [2] LAlpha_LsubstI)\napply (erule_tac [2] asm_rl\n       | rule_tac [2] LAlpha_LsubstI LFreeForIn_name_change\n       | erule_tac [2] disjoint_LBV_LFV_imp_LFreeForIn)+\n\napply (drule_tac [3] bspec [THEN mp], erule_tac [3] LBeta1_type2,\n       erule_tac [3] asm_rl)\napply (drule_tac [2] bspec [THEN mp], erule_tac [2] LBeta1_type2,\n       erule_tac [2] asm_rl)\napply (drule_tac [1] bspec [THEN mp], erule_tac [1] LBeta1_type2,\n       erule_tac [1] asm_rl)\napply safe\napply (frule_tac N=\"M'\" in LAlphaD1 [THEN LSkeltonEqD2])\napply (frule_tac N=\"N'a\" in LAlphaD1 [THEN LSkeltonEqD2])\napply (frule_tac M=\"N'\" in LAlphaD1 [THEN LSkeltonEqD1])\napply (rule_tac F=\"X Un LBV(M') Un LBV(N'a) Un LFV(M') Un LFV(N'a)\"\n        in infv [THEN InfiniteE])\napply (assumption | rule Fin_UnI prem1 LFV_Fin LBV_Fin)+\napply simp\napply (erule conjE)+\napply (subgoal_tac \"LFreeForIn(LVar(xa), x, M')\"\n         \"LFreeForIn(LVar(xa), x, N'a)\")\napply (rule_tac [3] disjoint_LBV_LFV_imp_LFreeForIn)\napply (rule_tac [2] disjoint_LBV_LFV_imp_LFreeForIn)\nprefer 2 apply (simp add: disjoint_Un_iff2 disjoint_cons_iff2)\nprefer 5 apply (simp add: disjoint_Un_iff2 disjoint_cons_iff2)\napply (erule_tac [2] asm_rl | rule_tac [2] LTerm.intros)+\napply (rule conjI [THEN exI])\napply (rule_tac [2] exI)\napply (assumption | rule LAlpha_LLamI3 conjI)+\napply (case_tac \"x: LFV(M')\")\napply (simp add: LBV_eqns LBV_Lsubst1\n         disjoint_Un_iff disjoint_cons_iff)\napply (simp add: LBV_eqns\n         disjoint_Un_iff disjoint_cons_iff)\napply (assumption | rule LBeta1_LLamI LBeta1_LsubstI)+\n\napply (rule_tac M1=\"N\" and X1=\"X\" in \n         infv [THEN Infinite_LVariable_LAlpha_lemma3, THEN revcut_rl])\napply (assumption | rule prem1)+\napply (erule exE)\napply (erule conjE)\napply (rule conjI [THEN exI])\napply (rule_tac [2] exI)\napply (assumption | rule LAlpha_LAppI conjI)+\napply (simp add: LAlphaD1 [THEN LSkeltonEqD2]\n           disjoint_Un_iff LBV_eqns)\napply (assumption | rule LBeta1_LAppI1)+\napply (erule LAlphaD1 [THEN LSkeltonEqD2])\n\napply (rule_tac M1=\"M\" and X1=\"X\" in \n         infv [THEN Infinite_LVariable_LAlpha_lemma3, THEN revcut_rl])\napply (assumption | rule prem1)+\napply (erule exE)\napply (erule conjE)\napply (rule conjI [THEN exI])\napply (rule_tac [2] exI)\napply (assumption | rule LAlpha_LAppI conjI)+\napply (simp add: LAlphaD1 [THEN LSkeltonEqD2]\n           disjoint_Un_iff LBV_eqns)\napply (assumption | rule LBeta1_LAppI2)+\napply (erule LAlphaD1 [THEN LSkeltonEqD2])\ndone\n\nlemma LBeta1_LAlpha_parallel:\n  assumes infv: \"Infinite(LVariable)\"\n  and major: \"LBeta1(M, N)\"\n  and prem1: \"x: LVariable\"\n  and prem2: \"X: LTerm\"\n  shows \"EX M' N'. LAlpha(M, M') & LAlpha(N, N') &\n            LFreeForIn(X, x, M') & LFreeForIn(X, x, N') & LBeta1(M', N')\"\napply (rule_tac X1=\"LFV(X)\" in LBeta1_LAlpha_parallel_lemma\n        [OF infv major, THEN revcut_rl])\napply (rule prem2 [THEN LFV_Fin])\napply (elim exE conjE)\napply (assumption | rule exI conjI)+\napply (assumption | rule disjoint_LBV_LFV_imp_LFreeForIn\n         prem1 prem2 conjI disjoint_subset\n         LBeta1_LBV_lemma subset_refl\n       | erule LAlphaD1 [THEN LSkeltonEqD2])+\ndone\n\nend\n", "meta": {"author": "JRF-2018", "repo": "isabelle_TheLambda", "sha": "e89eff1cbbf26da9bc6a3af603ae9d099d97c1ad", "save_path": "github-repos/isabelle/JRF-2018-isabelle_TheLambda", "path": "github-repos/isabelle/JRF-2018-isabelle_TheLambda/isabelle_TheLambda-e89eff1cbbf26da9bc6a3af603ae9d099d97c1ad/LBeta.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370308082623217, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3383967364768054}}
{"text": "(*<*)\n(*\n * Knowledge-based programs.\n * (C)opyright 2011, Peter Gammie, peteg42 at gmail.com.\n * License: BSD\n *)\n\ntheory Extra\nimports\n  \"HOL-Library.Option_ord\"\n  \"HOL-Library.Product_Lexorder\"\nbegin\n\n(* Extra lemmas that are not noteworthy. *)\n\nlemma relation_mono:\n  \"\\<lbrakk> A \\<subseteq> C; B \\<subseteq> D \\<rbrakk> \\<Longrightarrow> A \\<times> B \\<subseteq> C \\<times> D\"\n  by bestsimp\n\nlemma quotientI2:\n  \"\\<lbrakk> x \\<in> A; X = r `` {x} \\<rbrakk> \\<Longrightarrow> X \\<in> A // r\"\n  by (simp add: quotientI)\n\n(*\n\nConcretely enumerate all the agent action functions. Can't be too\nabstract here as we want extensionality.\n\nIntroduced in the clock view.\n\n*)\n\ndefinition\n  listToFun :: \"('a \\<times> 'b list) list \\<Rightarrow> ('a \\<Rightarrow> 'b) list\"\nwhere\n  \"listToFun xs \\<equiv> foldr (\\<lambda>(a, acts) M. [ m(a := act) . m \\<leftarrow> M, act \\<leftarrow> acts ])\n                     xs\n                     [(\\<lambda>_. undefined)]\"\n\nlemma listToFun_futz:\n  \"\\<lbrakk> M \\<in> set (listToFun xs); x \\<in> fst ` set xs \\<rbrakk>\n     \\<Longrightarrow> M x \\<in> { y |y ys. (x, ys) \\<in> set xs \\<and> y \\<in> set ys}\"\n  unfolding listToFun_def\n  apply (induct xs arbitrary: M)\n   apply (simp_all add: split_def)\n  apply (case_tac a)\n  apply clarsimp\n  apply auto\n  done\n\nlemma distinct_map_fst:\n  \"\\<lbrakk> x \\<notin> fst ` set xs; distinct (map fst xs) \\<rbrakk> \\<Longrightarrow> (x, y) \\<notin> set xs\"\n  by (induct xs) auto\n\nlemma listToFun_futz_rev:\n  \"\\<lbrakk> \\<And>x. M x \\<in> (if x \\<in> fst ` set xs then { y |y ys. (x, ys) \\<in> set xs \\<and> y \\<in> set ys} else {undefined}); distinct (map fst xs) \\<rbrakk>\n      \\<Longrightarrow> M \\<in> set (listToFun xs)\"\nproof(induct xs arbitrary: M)\n  case Nil thus ?case\n    unfolding listToFun_def by simp\nnext\n  case (Cons x xs)\n  let ?M' = \"M(fst x := undefined)\"\n  have M': \"?M' \\<in> set (listToFun xs)\"\n    apply (rule Cons.hyps)\n     prefer 2\n     using Cons(3)\n     apply simp\n    apply (case_tac \"xa = fst x\")\n     using Cons(3)\n     apply simp\n    apply (case_tac \"xa \\<in> fst ` set xs\")\n     apply (cut_tac x=xa in Cons(2))\n     apply (cases x)\n     apply auto[1]\n    apply (cut_tac x=xa in Cons(2))\n    apply simp\n    done\n  then show ?case\n    unfolding listToFun_def\n    apply (cases x)\n    apply simp\n    apply (rule bexI[where x=\"?M'\"])\n     apply simp_all\n    apply (rule_tac x=\"M a\" in image_eqI)\n     apply simp\n    apply (cut_tac x=a in Cons(2))\n    using Cons(3)\n    apply clarsimp\n    apply (erule disjE)\n     apply simp\n    apply (auto dest: distinct_map_fst)\n    done\nqed\n\ndefinition\n  listToFuns :: \"('a \\<Rightarrow> 'b list) \\<Rightarrow> 'a list \\<Rightarrow> ('a \\<Rightarrow> 'b) list\"\nwhere\n  \"listToFuns f \\<equiv> listToFun \\<circ> map (\\<lambda>x. (x, f x))\"\n\nlemma map_id_clunky:\n  \"set xs = UNIV \\<Longrightarrow> x \\<in> fst ` set (map (\\<lambda>x. (x, f x)) xs)\"\n  apply (simp only: set_map[symmetric] map_map)\n  apply simp\n  done\n\n(*\n\nThe main result is that we can freely move between representations.\n\n*)\n\nlemma listToFuns_ext:\n  assumes xs: \"set xs = UNIV\"\n  assumes d: \"distinct xs\"\n  shows \"g \\<in> set (listToFuns f xs) \\<longleftrightarrow> (\\<forall>x. g x \\<in> set (f x))\"\n  unfolding listToFuns_def\n  apply simp\n  apply rule\n   apply clarsimp\n   apply (cut_tac x=x in listToFun_futz[where M=g, OF _ map_id_clunky[OF xs]])\n    apply simp\n   apply clarsimp\n  apply (rule listToFun_futz_rev)\n   using map_id_clunky[OF xs]\n   apply auto[1]\n   apply (rule_tac x=\"f xa\" in exI)\n    apply simp\n   apply simp\n  using d\n  apply (simp add: distinct_map)\n  apply (auto intro: inj_onI)\n  done\n\nlemma listToFun_splice:\n  assumes xs: \"set xs = UNIV\"\n  assumes d: \"distinct xs\"\n  assumes g: \"g \\<in> set (listToFuns f xs)\"\n  assumes h: \"h \\<in> set (listToFuns f xs)\"\n  shows \"g(x := h x) \\<in> set (listToFuns f xs)\"\n  using g h by (auto iff: listToFuns_ext[OF xs d])\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/KBPs/Extra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.3383967291557104}}
{"text": "(*  Title:      HOL/UNITY/Comp/TimerArray.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1998  University of Cambridge\n\nA trivial example of reasoning about an array of processes\n*)\n\ntheory TimerArray imports \"../UNITY_Main\" begin\n\ntype_synonym 'a state = \"nat * 'a\"   (*second component allows new variables*)\n\ndefinition count :: \"'a state => nat\"\n  where \"count s = fst s\"\n  \ndefinition decr  :: \"('a state * 'a state) set\"\n  where \"decr = (UN n uu. {((Suc n, uu), (n,uu))})\"\n  \ndefinition Timer :: \"'a state program\"\n  where \"Timer = mk_total_program (UNIV, {decr}, UNIV)\"\n\n\ndeclare Timer_def [THEN def_prg_Init, simp]\n\ndeclare count_def [simp] decr_def [simp]\n\n(*Demonstrates induction, but not used in the following proof*)\nlemma Timer_leadsTo_zero: \"Timer : UNIV leadsTo {s. count s = 0}\"\napply (rule_tac f = count in lessThan_induct, simp)\napply (case_tac \"m\")\n apply (force intro!: subset_imp_leadsTo)\napply (unfold Timer_def, ensures_tac \"decr\")\ndone\n\nlemma Timer_preserves_snd [iff]: \"Timer : preserves snd\"\napply (rule preservesI)\napply (unfold Timer_def, safety)\ndone\n\n\ndeclare PLam_stable [simp]\n\nlemma TimerArray_leadsTo_zero:\n     \"finite I  \n      ==> (plam i: I. Timer) : UNIV leadsTo {(s,uu). ALL i:I. s i = 0}\"\napply (erule_tac A'1 = \"%i. lift_set i ({0} \\<times> UNIV)\" \n       in finite_stable_completion [THEN leadsTo_weaken])\napply auto\n(*Safety property, already reduced to the single Timer case*)\n prefer 2\n apply (simp add: Timer_def, safety) \n(*Progress property for the array of Timers*)\napply (rule_tac f = \"sub i o fst\" in lessThan_induct)\napply (case_tac \"m\")\n(*Annoying need to massage the conditions to have the form (... \\<times> UNIV)*)\napply (auto intro: subset_imp_leadsTo \n        simp add: insert_absorb \n                  lift_set_Un_distrib [symmetric] lessThan_Suc [symmetric] \n               Times_Un_distrib1 [symmetric] Times_Diff_distrib1 [symmetric])\napply (rename_tac \"n\")\napply (rule PLam_leadsTo_Basis)\napply (auto simp add: lessThan_Suc [symmetric])\napply (unfold Timer_def mk_total_program_def, safety) \napply (rule_tac act = decr in totalize_transientI, auto)\ndone\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/UNITY/Comp/TimerArray.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.33839672183461533}}
{"text": "(*\n    This file is a part of IsarMathLib - \n    a library of formalized mathematics for Isabelle/Isar.\n\n    Copyright (C) 2007  Slawomir Kolodynski\n\n    This program is free software Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED \nWARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF \nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. \nIN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, \nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, \nPROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE, DATA, OR PROFITS \nOR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, \nWHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \nOTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, \nEVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\nsection \\<open>Finite sequences\\<close>\n\ntheory FiniteSeq_ZF imports Nat_ZF_IML func1\n\nbegin\n\ntext\\<open>This theory treats finite sequences (i.e. maps $n\\rightarrow X$, where\n  $n=\\{0,1,..,n-1\\}$ is a natural number) as lists. It defines and proves\n  the properties of basic operations on lists: concatenation, appending\n  and element etc.\\<close>\n\nsubsection\\<open>Lists as finite sequences\\<close>\n\ntext\\<open>A natural way of representing (finite) lists in set theory is through \n  (finite) sequences.\n  In such view a list of elements of a set $X$ is a \n  function that maps the set $\\{0,1,..n-1\\}$ into $X$. Since natural numbers \n  in set theory are defined so that $n =\\{0,1,..n-1\\}$, a list of length $n$\n  can be understood as an element of the function space $n\\rightarrow X$.\n\\<close>\n\ntext\\<open>We define the set of lists with values in set $X$ as \\<open>Lists(X)\\<close>.\\<close>\n\ndefinition\n  \"Lists(X) \\<equiv> \\<Union>n\\<in>nat.(n\\<rightarrow>X)\"\n\ntext\\<open>The set of nonempty $X$-value listst will be called \\<open>NELists(X)\\<close>.\\<close>\n\ndefinition\n  \"NELists(X) \\<equiv> \\<Union>n\\<in>nat.(succ(n)\\<rightarrow>X)\"\n\ntext\\<open>We first define the shift that moves the second sequence\n  to the domain $\\{n,..,n+k-1\\}$, where $n,k$ are the lengths of the first \n  and the second sequence, resp.  \n  To understand the notation in the definitions below recall that in Isabelle/ZF \n  \\<open>pred(n)\\<close> is the previous natural number and  \n   denotes the difference between natural numbers $n$ and $k$.\\<close>\n\ndefinition\n  \"ShiftedSeq(b,n) \\<equiv> {\\<langle>j, b`(j #- n)\\<rangle>. j \\<in> NatInterval(n,domain(b))}\"\n\ntext\\<open>We define concatenation of two sequences as the union of the first sequence \n  with the shifted second sequence. The result of concatenating lists \n  $a$ and $b$ is called \\<open>Concat(a,b)\\<close>.\\<close>\n\ndefinition\n  \"Concat(a,b) \\<equiv> a \\<union> ShiftedSeq(b,domain(a))\"\n\ntext\\<open>For a finite sequence we define the sequence of all elements \n  except the first one. This corresponds to the \"tail\" function in Haskell.\n  We call it \\<open>Tail\\<close> here as well.\\<close>\n\ndefinition  \n  \"Tail(a) \\<equiv> {\\<langle>k, a`(succ(k))\\<rangle>. k \\<in> pred(domain(a))}\"\n\ntext\\<open>A dual notion to \\<open>Tail\\<close> is the list\n  of all elements of a list except the last one. Borrowing\n  the terminology from Haskell again, we will call this \\<open>Init\\<close>.\\<close>\n\ndefinition\n  \"Init(a) \\<equiv> restrict(a,pred(domain(a)))\"\n\ntext\\<open>Another obvious operation we can talk about is appending an element\n  at the end of a sequence. This is called \\<open>Append\\<close>.\\<close>\n\ndefinition\n  \"Append(a,x) \\<equiv> a \\<union> {\\<langle>domain(a),x\\<rangle>}\"\n\ntext\\<open>If lists are modeled as finite sequences (i.e. functions on natural \n  intervals $\\{0,1,..,n-1\\} = n$) it is easy to get the first element\n  of a list as the value of the sequence at $0$. The last element is the\n  value at $n-1$. To hide this behind a familiar name we define the \\<open>Last\\<close>\n  element of a list.\\<close> \n\ndefinition\n  \"Last(a) \\<equiv> a`(pred(domain(a)))\"\n\ntext\\<open>Shifted sequence is a function on a the interval of natural numbers.\\<close>\n\nlemma shifted_seq_props: \n  assumes A1: \"n \\<in> nat\"  \"k \\<in> nat\" and A2: \"b:k\\<rightarrow>X\"\n  shows \n  \"ShiftedSeq(b,n): NatInterval(n,k) \\<rightarrow> X\"\n  \"\\<forall>i \\<in> NatInterval(n,k). ShiftedSeq(b,n)`(i) = b`(i #- n)\"\n  \"\\<forall>j\\<in>k. ShiftedSeq(b,n)`(n #+ j) = b`(j)\"   \nproof -\n  let ?I = \"NatInterval(n,domain(b))\"\n  from A2 have Fact: \"?I = NatInterval(n,k)\" using func1_1_L1 by simp\n  with A1 A2 have \"\\<forall>j\\<in> ?I. b`(j #- n) \\<in> X\" \n    using inter_diff_in_len apply_funtype by simp\n  then have \n    \"{\\<langle>j, b`(j #- n)\\<rangle>. j \\<in> ?I} : ?I \\<rightarrow> X\" by (rule ZF_fun_from_total)\n  with Fact show thesis_1: \"ShiftedSeq(b,n): NatInterval(n,k) \\<rightarrow> X\"\n    using ShiftedSeq_def by simp\n  { fix i \n    from Fact thesis_1 have  \"ShiftedSeq(b,n): ?I \\<rightarrow> X\" by simp\n    moreover \n    assume \"i \\<in> NatInterval(n,k)\"\n    with Fact have \"i \\<in> ?I\" by simp\n    moreover from Fact have \n      \"ShiftedSeq(b,n) = {\\<langle>i, b`(i #- n)\\<rangle>. i \\<in> ?I}\"\n      using ShiftedSeq_def by simp\n    ultimately have \"ShiftedSeq(b,n)`(i) =  b`(i #- n)\"\n      by (rule ZF_fun_from_tot_val)\n  } then show thesis1: \n      \"\\<forall>i \\<in> NatInterval(n,k). ShiftedSeq(b,n)`(i) = b`(i #- n)\"\n    by simp\n  { fix j \n    let ?i = \"n #+ j\"\n    assume A3: \"j\\<in>k\"\n    with A1 have \"j \\<in> nat\" using elem_nat_is_nat by blast\n    then have \"?i #- n = j\" using diff_add_inverse by simp\n    with A3 thesis1 have \"ShiftedSeq(b,n)`(?i) = b`(j)\"\n      using NatInterval_def by auto\n  } then show \"\\<forall>j\\<in>k. ShiftedSeq(b,n)`(n #+ j) = b`(j)\"\n    by simp\nqed\n\ntext\\<open>Basis properties of the contatenation of two finite sequences.\\<close>\n\ntheorem concat_props:\n  assumes A1: \"n \\<in> nat\"  \"k \\<in> nat\" and A2: \"a:n\\<rightarrow>X\"   \"b:k\\<rightarrow>X\"\n  shows\n  \"Concat(a,b): n #+ k \\<rightarrow> X\"\n  \"\\<forall>i\\<in>n. Concat(a,b)`(i) = a`(i)\"\n  \"\\<forall>i \\<in> NatInterval(n,k). Concat(a,b)`(i) =  b`(i #- n)\"\n  \"\\<forall>j \\<in> k. Concat(a,b)`(n #+ j) = b`(j)\"\nproof -\n  from A1 A2 have\n    \"a:n\\<rightarrow>X\"  and I: \"ShiftedSeq(b,n): NatInterval(n,k) \\<rightarrow> X\"\n    and \"n \\<inter> NatInterval(n,k) = 0\"\n    using shifted_seq_props length_start_decomp by auto\n  then have \n    \"a \\<union> ShiftedSeq(b,n): n \\<union> NatInterval(n,k) \\<rightarrow> X \\<union> X\"\n    by (rule fun_disjoint_Un)\n  with A1 A2 show \"Concat(a,b): n #+ k \\<rightarrow> X\"\n    using func1_1_L1 Concat_def length_start_decomp by auto\n  { fix i assume \"i \\<in> n\"\n    with A1 I have \"i \\<notin> domain(ShiftedSeq(b,n))\"\n      using length_start_decomp func1_1_L1 by auto\n    with A2 have \"Concat(a,b)`(i) = a`(i)\"\n      using func1_1_L1 fun_disjoint_apply1 Concat_def by simp\n  } thus \"\\<forall>i\\<in>n. Concat(a,b)`(i) = a`(i)\" by simp\n  { fix i assume A3: \"i \\<in> NatInterval(n,k)\"\n    with A1 A2 have \"i \\<notin> domain(a)\" \n      using length_start_decomp func1_1_L1 by auto\n    with A1 A2 A3 have \"Concat(a,b)`(i) =  b`(i #- n)\"\n      using func1_1_L1 fun_disjoint_apply2 Concat_def shifted_seq_props\n      by simp\n  } thus II: \"\\<forall>i \\<in> NatInterval(n,k). Concat(a,b)`(i) =  b`(i #- n)\"\n    by simp\n  { fix j\n    let ?i = \"n #+ j\"\n    assume A3: \"j\\<in>k\"\n    with A1 have \"j \\<in> nat\" using elem_nat_is_nat by blast\n    then have \"?i #- n = j\" using diff_add_inverse by simp\n     with A3 II have \"Concat(a,b)`(?i) = b`(j)\"\n      using NatInterval_def by auto\n  } thus \"\\<forall>j \\<in> k. Concat(a,b)`(n #+ j) = b`(j)\"\n    by simp\nqed\n\ntext\\<open>Properties of concatenating three lists.\\<close>\n\nlemma concat_concat_list: \n  assumes A1: \"n \\<in> nat\"  \"k \\<in> nat\"  \"m \\<in> nat\" and\n  A2: \"a:n\\<rightarrow>X\"   \"b:k\\<rightarrow>X\"  \"c:m\\<rightarrow>X\" and\n  A3: \"d = Concat(Concat(a,b),c)\"\n  shows\n  \"d : n #+k #+ m \\<rightarrow> X\"\n  \"\\<forall>j \\<in> n. d`(j) = a`(j)\"\n  \"\\<forall>j \\<in> k. d`(n #+ j) = b`(j)\"\n  \"\\<forall>j \\<in> m. d`(n #+ k #+ j) = c`(j)\"\nproof -\n  from A1 A2 have I:\n    \"n #+ k \\<in> nat\"   \"m \\<in> nat\"\n    \"Concat(a,b): n #+ k \\<rightarrow> X\"   \"c:m\\<rightarrow>X\"\n    using concat_props by auto\n  with A3 show \"d: n #+k #+ m \\<rightarrow> X\"\n    using concat_props by simp\n  from I have II: \"\\<forall>i \\<in> n #+ k. \n    Concat(Concat(a,b),c)`(i) = Concat(a,b)`(i)\"\n    by (rule concat_props)\n  { fix j assume A4: \"j \\<in> n\"\n    moreover from A1 have \"n \\<subseteq> n #+ k\" using add_nat_le by simp\n    ultimately have \"j \\<in> n #+ k\" by auto\n    with A3 II have \"d`(j) =  Concat(a,b)`(j)\" by simp\n    with A1 A2 A4 have \"d`(j) = a`(j)\"\n      using concat_props by simp\n  } thus \"\\<forall>j \\<in> n. d`(j) = a`(j)\" by simp\n  { fix j assume A5: \"j \\<in> k\"\n    with A1 A3 II have \"d`(n #+ j) = Concat(a,b)`(n #+ j)\"\n      using add_lt_mono by simp\n    also from A1 A2 A5 have \"\\<dots> = b`(j)\"\n      using concat_props by simp\n    finally have \"d`(n #+ j) = b`(j)\" by simp\n  } thus \"\\<forall>j \\<in> k. d`(n #+ j) = b`(j)\" by simp\n  from I have \"\\<forall>j \\<in> m. Concat(Concat(a,b),c)`(n #+ k #+ j) = c`(j)\"\n    by (rule concat_props)\n  with A3 show \"\\<forall>j \\<in> m. d`(n #+ k #+ j) = c`(j)\"\n    by simp\nqed\n\ntext\\<open>Properties of concatenating a list with a concatenation\n  of two other lists.\\<close>\n\nlemma concat_list_concat: \n  assumes A1: \"n \\<in> nat\"  \"k \\<in> nat\"  \"m \\<in> nat\" and\n  A2: \"a:n\\<rightarrow>X\"   \"b:k\\<rightarrow>X\"  \"c:m\\<rightarrow>X\" and\n  A3: \"e = Concat(a, Concat(b,c))\"\n  shows \n  \"e : n #+k #+ m \\<rightarrow> X\"\n  \"\\<forall>j \\<in> n. e`(j) = a`(j)\"\n  \"\\<forall>j \\<in> k. e`(n #+ j) = b`(j)\"\n  \"\\<forall>j \\<in> m. e`(n #+ k #+ j) = c`(j)\"\nproof -\n  from A1 A2 have I: \n    \"n \\<in> nat\"  \"k #+ m \\<in> nat\"\n    \"a:n\\<rightarrow>X\"  \"Concat(b,c): k #+ m \\<rightarrow> X\"\n    using concat_props by auto\n  with A3 show  \"e : n #+k #+ m \\<rightarrow> X\"\n    using concat_props add_assoc by simp\n  from I have \"\\<forall>j \\<in> n. Concat(a, Concat(b,c))`(j) = a`(j)\"\n    by (rule concat_props)\n  with A3 show \"\\<forall>j \\<in> n. e`(j) = a`(j)\" by simp\n  from I have II:\n    \"\\<forall>j \\<in> k #+ m. Concat(a, Concat(b,c))`(n #+ j) = Concat(b,c)`(j)\"\n    by (rule concat_props)\n  { fix j assume A4: \"j \\<in> k\"\n    moreover from A1 have \"k \\<subseteq> k #+ m\" using add_nat_le by simp\n    ultimately have \"j \\<in> k #+ m\" by auto\n    with A3 II have \"e`(n #+ j) =  Concat(b,c)`(j)\" by simp\n    also from A1 A2 A4 have \"\\<dots> = b`(j)\"\n      using concat_props by simp\n    finally have \"e`(n #+ j) = b`(j)\" by simp\n  } thus \"\\<forall>j \\<in> k. e`(n #+ j) = b`(j)\" by simp\n  { fix j assume A5: \"j \\<in> m\"\n    with A1 II A3 have \"e`(n #+ k #+ j) = Concat(b,c)`(k #+ j)\"\n      using add_lt_mono add_assoc by simp\n    also from A1 A2 A5 have \"\\<dots> = c`(j)\"\n      using concat_props by simp\n    finally have \"e`(n #+ k #+ j) = c`(j)\" by simp\n  } then show \"\\<forall>j \\<in> m. e`(n #+ k #+ j) = c`(j)\"\n    by simp\nqed\n\ntext\\<open>Concatenation is associative.\\<close>\n\ntheorem concat_assoc: \n  assumes A1: \"n \\<in> nat\"  \"k \\<in> nat\"  \"m \\<in> nat\" and\n  A2: \"a:n\\<rightarrow>X\"   \"b:k\\<rightarrow>X\"   \"c:m\\<rightarrow>X\"\n  shows \"Concat(Concat(a,b),c) =  Concat(a, Concat(b,c))\"\nproof -\n  let ?d = \"Concat(Concat(a,b),c)\"\n  let ?e = \"Concat(a, Concat(b,c))\"\n  from A1 A2 have\n    \"?d : n #+k #+ m \\<rightarrow> X\" and \"?e : n #+k #+ m \\<rightarrow> X\"\n    using concat_concat_list concat_list_concat by auto\n  moreover have \"\\<forall>i \\<in>  n #+k #+ m. ?d`(i) = ?e`(i)\"\n  proof -\n    { fix i assume \"i \\<in> n #+k #+ m\"\n      moreover from A1 have \n\t\"n #+k #+ m = n \\<union> NatInterval(n,k) \\<union> NatInterval(n #+ k,m)\"\n\tusing adjacent_intervals3 by simp\n      ultimately have \n\t\"i \\<in> n \\<or> i \\<in> NatInterval(n,k) \\<or> i \\<in> NatInterval(n #+ k,m)\"\n\tby simp\n      moreover\n      { assume \"i \\<in> n\"\n\twith A1 A2 have \"?d`(i) = ?e`(i)\"\n\tusing concat_concat_list concat_list_concat by simp }\n      moreover\n      { assume \"i \\<in> NatInterval(n,k)\"\n\tthen obtain j where \"j\\<in>k\" and \"i = n #+ j\"\n\t  using NatInterval_def by auto\n\twith A1 A2 have \"?d`(i) = ?e`(i)\"\n\t  using concat_concat_list concat_list_concat by simp }\n      moreover\n      { assume \"i \\<in> NatInterval(n #+ k,m)\"\n\tthen obtain j where \"j \\<in> m\" and \"i = n #+ k #+ j\"\n\t  using NatInterval_def by auto\n\twith A1 A2 have \"?d`(i) = ?e`(i)\"\n\t  using concat_concat_list concat_list_concat by simp }\n      ultimately have \"?d`(i) = ?e`(i)\" by auto\n    } thus ?thesis by simp\n  qed\n  ultimately show \"?d = ?e\" by (rule func_eq)\nqed\n    \ntext\\<open>Properties of \\<open>Tail\\<close>.\\<close>\n\ntheorem tail_props: \n  assumes A1: \"n \\<in> nat\" and A2: \"a: succ(n) \\<rightarrow> X\"\n  shows\n  \"Tail(a) : n \\<rightarrow> X\"\n  \"\\<forall>k \\<in> n. Tail(a)`(k) = a`(succ(k))\"\nproof -\n  from A1 A2 have \"\\<forall>k \\<in> n. a`(succ(k)) \\<in> X\"\n    using succ_ineq apply_funtype by simp\n  then have \"{\\<langle>k, a`(succ(k))\\<rangle>. k \\<in> n} : n \\<rightarrow> X\"\n    by (rule ZF_fun_from_total)\n  with A2 show I: \"Tail(a) : n \\<rightarrow> X\"\n    using func1_1_L1 pred_succ_eq Tail_def by simp\n  moreover from A2 have \"Tail(a) = {\\<langle>k, a`(succ(k))\\<rangle>. k \\<in> n}\"\n    using func1_1_L1 pred_succ_eq Tail_def by simp\n  ultimately show \"\\<forall>k \\<in> n. Tail(a)`(k) = a`(succ(k))\"\n    by (rule ZF_fun_from_tot_val0)\nqed\n  \ntext\\<open>Properties of \\<open>Append\\<close>. It is a bit surprising that\n  the we don't need to assume that $n$ is a natural number.\\<close>\n\ntheorem append_props:\n  assumes A1: \"a: n \\<rightarrow> X\" and A2: \"x\\<in>X\" and A3: \"b = Append(a,x)\"\n  shows \n  \"b : succ(n) \\<rightarrow> X\"\n  \"\\<forall>k\\<in>n. b`(k) = a`(k)\"\n  \"b`(n) = x\"\nproof -\n  note A1\n  moreover have I: \"n \\<notin> n\" using mem_not_refl by simp\n  moreover from A1 A3 have II: \"b = a \\<union> {\\<langle>n,x\\<rangle>}\"\n    using func1_1_L1 Append_def by simp\n  ultimately have \"b : n \\<union> {n} \\<rightarrow> X \\<union> {x}\"\n    by (rule func1_1_L11D)\n  with A2 show \"b : succ(n) \\<rightarrow> X\"\n    using succ_explained set_elem_add by simp\n  from A1 I II show \"\\<forall>k\\<in>n. b`(k) = a`(k)\" and \"b`(n) = x\"\n    using func1_1_L11D by auto\nqed\n\ntext\\<open>A special case of \\<open>append_props\\<close>: appending to a nonempty\n  list does not change the head (first element) of the list.\\<close>\n\ncorollary head_of_append: \n  assumes \"n\\<in> nat\" and \"a: succ(n) \\<rightarrow> X\" and \"x\\<in>X\"\n  shows \"Append(a,x)`(0) = a`(0)\"\n  using assms append_props empty_in_every_succ by auto\n\n(*text{*A bit technical special case of @{text \"append_props\"} that tells us\n  what is the value of the appended list at the sucessor of some argument.*}\n\ncorollary append_val_succ:\n  assumes \"n \\<in> nat\" and \"a: succ(n) \\<rightarrow> X\" and \"x\\<in>X\" and \"k \\<in> n\"\n  shows \"Append(a,x)`(succ(k)) = a`(succ(k))\"\n  using assms succ_ineq append_props by simp*)\n\ntext\\<open>\\<open>Tail\\<close> commutes with \\<open>Append\\<close>.\\<close>\n\ntheorem tail_append_commute: \n  assumes A1: \"n \\<in> nat\" and A2: \"a: succ(n) \\<rightarrow> X\" and A3: \"x\\<in>X\"\n  shows \"Append(Tail(a),x) = Tail(Append(a,x))\"\nproof -\n  let ?b = \"Append(Tail(a),x)\"\n  let ?c = \"Tail(Append(a,x))\"\n  from A1 A2 have I: \"Tail(a) : n \\<rightarrow> X\" using tail_props\n    by simp\n  from A1 A2 A3 have \n    \"succ(n) \\<in> nat\" and \"Append(a,x) : succ(succ(n)) \\<rightarrow> X\"\n    using append_props by auto\n  then have II: \"\\<forall>k \\<in> succ(n). ?c`(k) = Append(a,x)`(succ(k))\"\n    by (rule tail_props)\n  from assms have \n    \"?b : succ(n) \\<rightarrow> X\" and \"?c : succ(n) \\<rightarrow> X\"\n    using tail_props append_props by auto\n  moreover have \"\\<forall>k \\<in> succ(n). ?b`(k) = ?c`(k)\"\n  proof -\n    { fix k assume \"k \\<in> succ(n)\"\n      hence \"k \\<in> n \\<or> k = n\" by auto\n      moreover\n      { assume A4: \"k \\<in> n\"\n\twith assms II have \"?c`(k) = a`(succ(k))\"\n\t  using succ_ineq append_props by simp\n\tmoreover\n\tfrom A3 I have \"\\<forall>k\\<in>n. ?b`(k) = Tail(a)`(k)\"\n\t  using append_props by simp\n\twith A1 A2 A4 have \"?b`(k) =  a`(succ(k))\"\n\t  using tail_props by simp\n\tultimately have \"?b`(k) = ?c`(k)\" by simp }\n      moreover\n      { assume A5: \"k = n\"\n\twith A2 A3 I II have \"?b`(k) = ?c`(k)\"\n\t  using append_props by auto }\n      ultimately have \"?b`(k) = ?c`(k)\" by auto\n    } thus ?thesis by simp\n  qed\n  ultimately show \"?b = ?c\" by (rule func_eq)\nqed  \n\ntext\\<open>@{term NELists} are non-empty lists\\<close>\n\nlemma non_zero_List_func_is_NEList:\n  shows \"NELists(X) = {a\\<in>Lists(X). a\\<noteq>0}\"\nproof-\n  { fix a assume as: \"a\\<in>{a\\<in>Lists(X). a\\<noteq>0}\"\n    from as obtain n where a: \"n\\<in>nat\" \"a:n\\<rightarrow> X\" unfolding Lists_def \n      by auto\n    { assume \"n=0\"\n      with a(2) have \"a=0\" unfolding Pi_def by auto\n      with as have False by auto\n    }\n    hence \"n\\<noteq>0\" by auto\n    with a(1) obtain k where \"k\\<in>nat\" \"n=succ(k)\" using Nat_ZF_1_L3 \n      by auto\n    with a(2) have \"a \\<in> NELists(X)\" unfolding NELists_def by auto\n  } moreover\n  { fix a assume as: \"a\\<in>NELists(X)\"\n    then obtain k where k: \"a:succ(k)\\<rightarrow>X\" \"k\\<in>nat\"\n      unfolding NELists_def by auto\n    { assume \"a=0\"\n      hence \"domain(a) = 0\" by auto\n      with k(1) have \"succ(k) = 0\" using domain_of_fun by auto\n      hence False by auto\n    } moreover\n    { from k(2) have \"succ(k)\\<in>nat\" using nat_succI by auto\n      with k(1) have \"a\\<in>Lists(X)\" unfolding Lists_def by auto\n    } ultimately\n    have \"a\\<in>{a\\<in>Lists(X). a\\<noteq>0}\" by auto\n  }\n  ultimately show ?thesis by auto\nqed\n\ntext\\<open>Properties of \\<open>Init\\<close>.\\<close>\n\ntheorem init_props: \n  assumes A1: \"n \\<in> nat\" and A2: \"a: succ(n) \\<rightarrow> X\"\n  shows \n  \"Init(a) : n \\<rightarrow> X\"\n  \"\\<forall>k\\<in>n. Init(a)`(k) = a`(k)\"\n  \"a = Append(Init(a), a`(n))\"\nproof -\n  have \"n \\<subseteq> succ(n)\" by auto\n  with A2 have \"restrict(a,n): n \\<rightarrow> X\"\n    using restrict_type2 by simp\n  moreover from A1 A2 have I: \"restrict(a,n) = Init(a)\"\n    using func1_1_L1 pred_succ_eq Init_def by simp\n  ultimately show thesis1: \"Init(a) : n \\<rightarrow> X\" by simp\n  { fix k assume \"k\\<in>n\"\n    then have \"restrict(a,n)`(k) = a`(k)\"\n      using restrict by simp\n    with I have \"Init(a)`(k) = a`(k)\" by simp\n  } then show thesis2: \"\\<forall>k\\<in>n. Init(a)`(k) = a`(k)\" by simp\n  let ?b = \"Append(Init(a), a`(n))\"\n  from A2 thesis1 have II:\n    \"Init(a) : n \\<rightarrow> X\"   \"a`(n) \\<in> X\"\n    \"?b = Append(Init(a), a`(n))\"\n    using apply_funtype by auto\n  note A2\n  moreover from II have \"?b : succ(n) \\<rightarrow> X\"\n    by (rule append_props)\n  moreover have \"\\<forall>k \\<in> succ(n). a`(k) = ?b`(k)\"\n  proof -\n    { fix k assume A3: \"k \\<in> n\"\n      from II have \"\\<forall>j\\<in>n. ?b`(j) = Init(a)`(j)\"\n\tby (rule append_props)\n      with thesis2 A3 have \"a`(k) = ?b`(k)\" by simp }\n    moreover \n    from II have \"?b`(n) = a`(n)\"\n      by (rule append_props)\n    hence \" a`(n) = ?b`(n)\" by simp\n    ultimately show \"\\<forall>k \\<in> succ(n). a`(k) = ?b`(k)\"\n      by simp\n  qed\n  ultimately show \"a = ?b\" by (rule func_eq)\nqed\n\ntext\\<open>The initial part of a non-empty list\n  is a list, and the domain of the original list\n  is the successor of its initial part.\\<close>\n\ntheorem init_NElist: \n  assumes \"a \\<in> NELists(X)\"\n  shows \"Init(a) \\<in> Lists(X)\" and \"succ(domain(Init(a))) = domain(a)\"\nproof -\n  from assms obtain n where n: \"n\\<in>nat\" \"a:succ(n) \\<rightarrow> X\" \n    unfolding NELists_def by auto\n  then have tailF: \"Init(a):n \\<rightarrow> X\" using init_props(1) by auto\n  with n(1) show \"Init(a) \\<in> Lists(X)\" unfolding Lists_def by auto\n  from tailF have \"domain(Init(a)) = n\" using domain_of_fun by auto\n  moreover from n(2) have \"domain(a) = succ(n)\" using domain_of_fun \n    by auto\n  ultimately show \"succ(domain(Init(a))) = domain(a)\" by auto\nqed\n\ntext\\<open>If we take init of the result of append, we get back the same list.\\<close> \n\nlemma init_append: assumes A1: \"n \\<in> nat\" and A2: \"a:n\\<rightarrow>X\" and A3: \"x \\<in> X\"\n  shows \"Init(Append(a,x)) = a\"\nproof -\n  from A2 A3 have \"Append(a,x): succ(n)\\<rightarrow>X\" using append_props by simp\n  with A1 have \"Init(Append(a,x)):n\\<rightarrow>X\" and \"\\<forall>k\\<in>n. Init(Append(a,x))`(k) = Append(a,x)`(k)\"  \n    using init_props by auto\n  with A2 A3 have \"\\<forall>k\\<in>n. Init(Append(a,x))`(k) = a`(k)\" using append_props by simp\n  with \\<open>Init(Append(a,x)):n\\<rightarrow>X\\<close> A2 show ?thesis by (rule func_eq)\nqed\n\ntext\\<open>A reformulation of definition of \\<open>Init\\<close>.\\<close>\n\nlemma init_def: assumes \"n \\<in> nat\" and \"a:succ(n)\\<rightarrow>X\"\n  shows \"Init(a) = restrict(a,n)\"\n  using assms func1_1_L1 Init_def by simp\n\ntext\\<open>Another reformulation of the definition of \\<open>Init\\<close>, starting with the\n  expression defining the list.\\<close>\n\nlemma init_def_alt: assumes \"n\\<in>nat\" and \"\\<forall>k\\<in>n #+ 1. q(k) \\<in> X\"\n  shows \"Init({\\<langle>k,q(k)\\<rangle>. k\\<in>n #+ 1}) = {\\<langle>k,q(k)\\<rangle>. k\\<in>n}\"\nproof -\n  let ?a = \"{\\<langle>k,q(k)\\<rangle>. k\\<in>n #+ 1}\"\n  from assms(2) have \"?a:n #+ 1\\<rightarrow>X\" by (rule ZF_fun_from_total)\n  moreover from assms(1) have \"n #+ 1 = succ(n)\" using succ_add_one(1)\n    by simp\n  ultimately have \"?a:succ(n)\\<rightarrow>X\" by simp\n  with assms(1) have \"Init(?a) = restrict(?a,n)\" using init_def by simp\n  moreover\n  from assms(1) have \"n \\<subseteq> n #+ 1\" by auto\n  then have \"restrict(?a,n) = {\\<langle>k,q(k)\\<rangle>. k\\<in>n}\"\n    by (rule restrict_def_alt)\n  ultimately show ?thesis by simp\nqed\n    \ntext\\<open>A lemma about extending a finite sequence by one more value. This is \n  just a more explicit version of \\<open>append_props\\<close>.\\<close>\n\nlemma finseq_extend: \n  assumes  \"a:n\\<rightarrow>X\"   \"y\\<in>X\"   \"b = a \\<union> {\\<langle>n,y\\<rangle>}\"\n  shows\n  \"b: succ(n) \\<rightarrow> X\"\n  \"\\<forall>k\\<in>n. b`(k) = a`(k)\"\n  \"b`(n) = y\"\n  using assms Append_def func1_1_L1 append_props by auto\n\ntext\\<open>The next lemma is a bit displaced as it is mainly \n  about finite sets. It is proven here because it uses\n  the notion of \\<open>Append\\<close>.\n  Suppose we have a list of element of $A$ is a bijection.\n  Then for every element that does not belong to $A$ \n  we can we can construct \n  a bijection for the set $A \\cup \\{ x\\}$ by appending $x$.\n  This is just a specialised version of lemma \\<open>bij_extend_point\\<close>\n  from \\<open>func1.thy\\<close>.\n\\<close>\n\nlemma bij_append_point: \n  assumes A1: \"n \\<in> nat\" and A2: \"b \\<in> bij(n,X)\" and A3: \"x \\<notin> X\"\n  shows \"Append(b,x) \\<in> bij(succ(n), X \\<union> {x})\"\nproof -\n  from A2 A3 have \"b \\<union> {\\<langle>n,x\\<rangle>} \\<in> bij(n \\<union> {n},X \\<union> {x})\"\n    using mem_not_refl bij_extend_point by simp\n  moreover have \"Append(b,x) = b \\<union> {\\<langle>n,x\\<rangle>}\"\n  proof -\n    from A2 have \"b:n\\<rightarrow>X\"\n      using bij_def surj_def by simp\n    then have \"b : n \\<rightarrow> X \\<union> {x}\" using func1_1_L1B\n      by blast\n    then show \"Append(b,x) = b \\<union> {\\<langle>n,x\\<rangle>}\"\n      using Append_def func1_1_L1 by simp\n  qed\n  ultimately show ?thesis using succ_explained by auto\nqed\n\ntext\\<open>The next lemma rephrases the definition of \\<open>Last\\<close>.\n  Recall that in ZF we have $\\{0,1,2,..,n\\} = n+1=$\\<open>succ\\<close>$(n)$.\\<close>\n\nlemma last_seq_elem: assumes \"a: succ(n) \\<rightarrow> X\" shows \"Last(a) = a`(n)\"\n  using assms func1_1_L1 pred_succ_eq Last_def by simp\n\ntext\\<open>The last element of a non-empty list valued in $X$ is in $X$.\\<close>\n\nlemma last_type: assumes \"a \\<in> NELists(X)\" shows \"Last(a) \\<in> X\"\n  using assms last_seq_elem apply_funtype unfolding NELists_def \n  by auto\n\ntext\\<open>If two finite sequences are the same when restricted to domain one \n  shorter than the original and have the same value on the last element, \n  then they are equal.\\<close>\n\nlemma finseq_restr_eq: assumes A1: \"n \\<in> nat\" and \n  A2: \"a: succ(n) \\<rightarrow> X\"  \"b: succ(n) \\<rightarrow> X\" and\n  A3: \"restrict(a,n) = restrict(b,n)\" and\n  A4: \"a`(n) = b`(n)\"\n  shows \"a = b\"\nproof -\n  { fix k assume \"k \\<in> succ(n)\"\n    then have \"k \\<in> n \\<or> k = n\" by auto\n    moreover\n    { assume \"k \\<in> n\"  \n      then have \n\t\"restrict(a,n)`(k) = a`(k)\" and \"restrict(b,n)`(k) = b`(k)\"\n\tusing restrict by auto\n      with A3 have \"a`(k) = b`(k)\" by simp }\n    moreover\n    { assume \"k = n\"\n      with A4 have \"a`(k) = b`(k)\" by simp }\n    ultimately have \"a`(k) = b`(k)\" by auto\n  } then have \"\\<forall> k \\<in> succ(n). a`(k) = b`(k)\" by simp\n  with A2 show \"a = b\" by (rule func_eq)\nqed\n\ntext\\<open>Concatenating a list of length $1$ is the same as appending its\n  first (and only) element. Recall that in ZF set theory \n  $1 = \\{ 0 \\} $.\\<close>\n\nlemma append_1elem: assumes A1: \"n \\<in> nat\" and \n  A2: \"a: n \\<rightarrow> X\"  and A3: \"b : 1 \\<rightarrow> X\"\n  shows \"Concat(a,b) = Append(a,b`(0))\"\nproof -\n  let ?C = \"Concat(a,b)\"\n  let ?A = \"Append(a,b`(0))\"\n  from A1 A2 A3 have I:\n    \"n \\<in> nat\"  \"1 \\<in> nat\"\n    \"a:n\\<rightarrow>X\"   \"b:1\\<rightarrow>X\" by auto\n  have \"?C : succ(n) \\<rightarrow> X\"\n  proof -\n    from I have \"?C : n #+ 1 \\<rightarrow> X\"\n      by (rule concat_props)\n    with A1 show \"?C : succ(n) \\<rightarrow> X\" by simp\n  qed\n  moreover from A2 A3 have \"?A : succ(n) \\<rightarrow> X\"\n    using apply_funtype append_props by simp\n  moreover have \"\\<forall>k \\<in> succ(n). ?C`(k) = ?A`(k)\"\n  proof\n    fix k assume \"k \\<in> succ(n)\"\n    moreover\n    { assume \"k \\<in> n\"\n      moreover from I have \"\\<forall>i \\<in> n. ?C`(i) = a`(i)\"\n\tby (rule concat_props)\n      moreover from A2 A3 have \"\\<forall>i\\<in>n. ?A`(i) = a`(i)\"\n\tusing apply_funtype append_props by simp\n      ultimately have \"?C`(k) =  ?A`(k)\" by simp }\n    moreover have \"?C`(n) = ?A`(n)\"\n    proof -\n      from I have \"\\<forall>j \\<in> 1. ?C`(n #+ j) = b`(j)\"\n\tby (rule concat_props)\n      with A1 A2 A3 show \"?C`(n) = ?A`(n)\"\n\tusing apply_funtype append_props by simp\n    qed\n    ultimately show \"?C`(k) = ?A`(k)\" by auto\n  qed\n  ultimately show \"?C = ?A\" by (rule func_eq)\nqed\n\ntext\\<open>If $x\\in X$ then the singleton set with the pair $\\langle 0,x\\rangle$\n  as the only element is a list of length 1 and hence a nonempty list. \\<close>\n\nlemma list_len1_singleton: assumes \"x\\<in>X\" \n  shows \"{\\<langle>0,x\\<rangle>} : 1 \\<rightarrow> X\" and \"{\\<langle>0,x\\<rangle>} \\<in> NELists(X)\"\nproof -\n  from assms have \"{\\<langle>0,x\\<rangle>} : {0} \\<rightarrow> X\" using pair_func_singleton\n    by simp\n  moreover have \"{0} = 1\" by auto\n  ultimately show \"{\\<langle>0,x\\<rangle>} : 1 \\<rightarrow> X\" and \"{\\<langle>0,x\\<rangle>} \\<in> NELists(X)\" \n    unfolding NELists_def by auto  \nqed\n\ntext\\<open>A singleton list is in fact a singleton set with a pair as the only element.\\<close>\n\nlemma list_singleton_pair: assumes A1: \"x:1\\<rightarrow>X\" shows \"x = {\\<langle>0,x`(0)\\<rangle>}\"\nproof -\n  from A1 have \"x = {\\<langle>t,x`(t)\\<rangle>. t\\<in>1}\" by (rule fun_is_set_of_pairs)\n  hence \"x = {\\<langle>t,x`(t)\\<rangle>. t\\<in>{0} }\" by simp\n  thus ?thesis by simp\nqed  \n \ntext\\<open>When we append an element to the empty list we get\n  a list with length $1$.\\<close>\n\nlemma empty_append1: assumes A1: \"x\\<in>X\"\n  shows \"Append(0,x): 1 \\<rightarrow> X\" and \"Append(0,x)`(0) = x\"\nproof -\n  let ?a = \"Append(0,x)\"\n  have \"?a = {\\<langle>0,x\\<rangle>}\" using Append_def by auto\n  with A1 show \"?a : 1 \\<rightarrow> X\" and \"?a`(0) = x\"\n    using list_len1_singleton pair_func_singleton\n    by auto\nqed\n  \n(*text{*Tail of a list of length 1 is a list of length 0.*}\n\nlemma list_len1_tail: assumes \"a:1\\<rightarrow>X\"\n  shows \"Tail(a) : 0 \\<rightarrow> X\"\n  using assms tail_props by blast *)\n\ntext\\<open>Appending an element is the same as concatenating\n  with certain pair.\\<close>\n\nlemma append_concat_pair: \n  assumes \"n \\<in> nat\" and \"a: n \\<rightarrow> X\" and \"x\\<in>X\"\n  shows \"Append(a,x) = Concat(a,{\\<langle>0,x\\<rangle>})\"\n  using assms list_len1_singleton append_1elem pair_val\n  by simp\n\ntext\\<open>An associativity property involving concatenation \n  and appending. For proof we just convert appending to\n  concatenation and use \\<open>concat_assoc\\<close>.\\<close>\n\nlemma concat_append_assoc: assumes A1: \"n \\<in> nat\"  \"k \\<in> nat\" and \n  A2: \"a:n\\<rightarrow>X\"   \"b:k\\<rightarrow>X\" and A3: \"x \\<in> X\"\n  shows \"Append(Concat(a,b),x) = Concat(a, Append(b,x))\"\nproof -\n  from A1 A2 A3 have \n    \"n #+ k \\<in> nat\"   \"Concat(a,b) : n #+ k \\<rightarrow> X\"   \"x \\<in> X\"\n    using concat_props by auto\n  then have \n    \"Append(Concat(a,b),x) =  Concat(Concat(a,b),{\\<langle>0,x\\<rangle>})\"\n    by (rule append_concat_pair)\n  moreover\n  from A1 A2 A3 have\n    \"n \\<in> nat\"  \"k \\<in> nat\"  \"1 \\<in> nat\"\n     \"a:n\\<rightarrow>X\"   \"b:k\\<rightarrow>X\"  \"{\\<langle>0,x\\<rangle>} :  1 \\<rightarrow> X\"\n    using list_len1_singleton by auto\n  then have\n    \"Concat(Concat(a,b),{\\<langle>0,x\\<rangle>}) = Concat(a, Concat(b,{\\<langle>0,x\\<rangle>}))\"\n    by (rule concat_assoc)\n  moreover from A1 A2 A3 have \"Concat(b,{\\<langle>0,x\\<rangle>}) =  Append(b,x)\"\n    using list_len1_singleton append_1elem pair_val by simp\n  ultimately show \"Append(Concat(a,b),x) = Concat(a, Append(b,x))\"\n    by simp\nqed\n\ntext\\<open>An identity involving concatenating with init\n  and appending the last element.\\<close>\n\nlemma concat_init_last_elem: \n  assumes \"n \\<in> nat\"  \"k \\<in> nat\" and \n  \"a: n \\<rightarrow> X\"  and \"b : succ(k) \\<rightarrow> X\"\n  shows \"Append(Concat(a,Init(b)),b`(k)) = Concat(a,b)\"\n  using assms init_props apply_funtype concat_append_assoc\n  by simp\n\ntext\\<open>A lemma about creating lists by composition and how\n  \\<open>Append\\<close> behaves in such case.\\<close>\n\nlemma list_compose_append: \n  assumes A1: \"n \\<in> nat\" and A2: \"a : n \\<rightarrow> X\" and \n  A3: \"x \\<in> X\" and A4: \"c : X \\<rightarrow> Y\"\n  shows\n  \"c O Append(a,x) : succ(n) \\<rightarrow> Y\"\n  \"c O Append(a,x) = Append(c O a, c`(x))\"\nproof -\n  let ?b = \"Append(a,x)\"\n  let ?d = \"Append(c O a, c`(x))\"\n  from A2 A4 have \"c O a : n \\<rightarrow> Y\"\n    using comp_fun by simp\n  from A2 A3 have \"?b : succ(n) \\<rightarrow> X\"\n    using append_props by simp\n  with A4 show \"c O ?b : succ(n) \\<rightarrow> Y\"\n    using comp_fun by simp\n  moreover from A3 A4 \\<open>c O a : n \\<rightarrow> Y\\<close> have \n    \"?d: succ(n) \\<rightarrow> Y\"\n    using apply_funtype append_props by simp\n  moreover have \"\\<forall>k \\<in> succ(n). (c O ?b) `(k) = ?d`(k)\"\n  proof -\n    { fix k assume \"k \\<in> succ(n)\"\n      with \\<open>?b : succ(n) \\<rightarrow> X\\<close> have \n\t\"(c O ?b) `(k) = c`(?b`(k))\"\n\tusing comp_fun_apply by simp\n      with A2 A3 A4 \\<open>c O a : n \\<rightarrow> Y\\<close> \\<open>c O a : n \\<rightarrow> Y\\<close> \\<open>k \\<in> succ(n)\\<close>\n      have \"(c O ?b) `(k) = ?d`(k)\"\n\tusing append_props comp_fun_apply apply_funtype\n\tby auto\n    } thus ?thesis by simp\n  qed\n  ultimately show \"c O ?b = ?d\" by (rule func_eq)\nqed\n\ntext\\<open>A lemma about appending an element to a list defined by set\n  comprehension.\\<close>\n\nlemma set_list_append: assumes \n  A1: \"\\<forall>i \\<in> succ(k). b(i) \\<in> X\" and\n  A2: \"a = {\\<langle>i,b(i)\\<rangle>. i \\<in> succ(k)}\"\n  shows \n  \"a: succ(k) \\<rightarrow> X\"\n  \"{\\<langle>i,b(i)\\<rangle>. i \\<in> k}: k \\<rightarrow> X\" \n  \"a = Append({\\<langle>i,b(i)\\<rangle>. i \\<in> k},b(k))\"\nproof -\n  from A1 have \"{\\<langle>i,b(i)\\<rangle>. i \\<in> succ(k)} : succ(k) \\<rightarrow> X\" \n    by (rule ZF_fun_from_total)\n  with A2 show \"a: succ(k) \\<rightarrow> X\" by simp\n  from A1 have \"\\<forall>i \\<in> k. b(i) \\<in> X\"\n    by simp\n  then show \"{\\<langle>i,b(i)\\<rangle>. i \\<in> k}: k \\<rightarrow> X\"\n    by (rule ZF_fun_from_total)\n  with A2 show \"a = Append({\\<langle>i,b(i)\\<rangle>. i \\<in> k},b(k))\"\n    using func1_1_L1 Append_def by auto\nqed\n\ntext\\<open>A version of \\<open>set_list_append\\<close> using $n+1$ instead of \\<open>succ(n)\\<close>. \\<close>\n\nlemma set_list_append1: \n  assumes \"n\\<in>nat\" and \"\\<forall>k\\<in>n #+ 1. q(k) \\<in> X\"\n  defines \"a\\<equiv>{\\<langle>k,q(k)\\<rangle>. k\\<in>n #+ 1}\"\n  shows\n  \"a: n #+ 1 \\<rightarrow> X\"\n  \"{\\<langle>k,q(k)\\<rangle>. k \\<in> n}: n \\<rightarrow> X\"\n  \"Init(a) = {\\<langle>k,q(k)\\<rangle>. k \\<in> n}\"\n  \"a = Append({\\<langle>k,q(k)\\<rangle>. k \\<in> n},q(n))\"\n  \"a = Append(Init(a), q(n))\"\n  \"a = Append(Init(a), a`(n))\"\nproof -\n  from assms(1) have I: \"n #+ 1 = succ(n)\" using succ_add_one(1) \n    by simp\n  with assms show \n    \"a: n #+ 1 \\<rightarrow> X\" and \"{\\<langle>k,q(k)\\<rangle>. k \\<in> n}: n \\<rightarrow> X\" \n    and II: \"Init(a) = {\\<langle>k,q(k)\\<rangle>. k \\<in> n}\"\n    using set_list_append(1,2) init_def_alt by simp_all\n  from assms(2,3) I have \n    \"\\<forall>k\\<in>succ(n). q(k) \\<in> X\" and \"a = {\\<langle>k,q(k)\\<rangle>. k \\<in> succ(n)}\"\n    by simp_all\n  then show \"a = Append({\\<langle>k,q(k)\\<rangle>. k \\<in> n},q(n))\"  \n    using set_list_append(3) by simp\n  with II show \"a = Append(Init(a), q(n))\" by simp\n  from I have \"n \\<in> n #+ 1\" by simp\n  then have \"{\\<langle>k,q(k)\\<rangle>. k\\<in>n #+ 1}`(n) = q(n)\"\n    by (rule ZF_fun_from_tot_val1)\n  with assms(3) \\<open>a = Append(Init(a), q(n))\\<close> show \"a = Append(Init(a), a`(n))\"\n    by simp\nqed\n\ntext\\<open>An induction theorem for lists.\\<close>\n\nlemma list_induct: assumes A1: \"\\<forall>b\\<in>1\\<rightarrow>X. P(b)\" and \n  A2: \"\\<forall>b\\<in>NELists(X). P(b) \\<longrightarrow> (\\<forall>x\\<in>X. P(Append(b,x)))\" and\n  A3: \"d \\<in> NELists(X)\"\n  shows \"P(d)\"\nproof -\n  { fix n \n    assume \"n\\<in>nat\"\n    moreover from A1 have \"\\<forall>b\\<in>succ(0)\\<rightarrow>X. P(b)\" by simp \n    moreover have \"\\<forall>k\\<in>nat. ((\\<forall>b\\<in>succ(k)\\<rightarrow>X. P(b)) \\<longrightarrow> (\\<forall>c\\<in>succ(succ(k))\\<rightarrow>X. P(c)))\"\n    proof -\n      { fix k assume \"k \\<in> nat\" assume \"\\<forall>b\\<in>succ(k)\\<rightarrow>X. P(b)\"\n        have \"\\<forall>c\\<in>succ(succ(k))\\<rightarrow>X. P(c)\"\n        proof\n          fix c assume \"c: succ(succ(k))\\<rightarrow>X\"\n          let ?b = \"Init(c)\"\n          let ?x = \"c`(succ(k))\"\n          from \\<open>k \\<in> nat\\<close> \\<open>c: succ(succ(k))\\<rightarrow>X\\<close> have \"?b:succ(k)\\<rightarrow>X\"\n            using init_props by simp\n          with A2 \\<open>k \\<in> nat\\<close> \\<open>\\<forall>b\\<in>succ(k)\\<rightarrow>X. P(b)\\<close> have \"\\<forall>x\\<in>X. P(Append(?b,x))\"\n            using NELists_def by auto \n          with \\<open>c: succ(succ(k))\\<rightarrow>X\\<close> have \"P(Append(?b,?x))\" using apply_funtype by simp \n          with \\<open>k \\<in> nat\\<close> \\<open>c: succ(succ(k))\\<rightarrow>X\\<close> show \"P(c)\"\n            using init_props by simp \n        qed\n      } thus ?thesis by simp \n    qed\n    ultimately have \"\\<forall>b\\<in>succ(n)\\<rightarrow>X. P(b)\" by (rule ind_on_nat)\n  } with A3 show ?thesis using NELists_def by auto \nqed \n\ntext\\<open>A dual notion to \\<open>Append\\<close> is \\<open>Prepend\\<close> where we add an element to the list at the beginning of the\n  list. We define the value of the list $a$ prepended by an element $x$ as \n  $x$ if index is 0 and $a(k-1)$ otherwise.\\<close>\n\ndefinition\n  \"Prepend(a,x) \\<equiv> {\\<langle>k,if k = 0 then x else a`(k #- 1)\\<rangle>. k\\<in>domain(a) #+ 1}\"\n\ntext\\<open>If $a:n\\rightarrow X$ is a list, then $a$ with prepended $x\\in X$ is a list as well and\n  its first element is $x$. \\<close>\n\nlemma prepend_props: \n  assumes \"n\\<in>nat\" \"a:n\\<rightarrow>X\" \"x\\<in>X\"\n  shows \"Prepend(a,x):(n #+ 1)\\<rightarrow>X\" and \"Prepend(a,x)`(0) = x\"\nproof -\n  let ?b = \"{\\<langle>k,if k = 0 then x else a`(k #- 1)\\<rangle>. k\\<in>n #+ 1}\"\n  have \"\\<forall>k\\<in>n #+ 1. (if k = 0 then x else a`(k #- 1)) \\<in> X\"\n  proof -\n    { fix k assume \"k \\<in> n #+ 1\"\n      let ?v = \"if k = 0 then x else a`(k #- 1)\"\n      { assume \"k\\<noteq>0\"\n        with \\<open>k \\<in> n #+ 1\\<close> have \"n\\<noteq>0\" by auto\n        from assms(1) \\<open>k \\<in> n #+ 1\\<close> have \"k \\<in> nat\" \n          using elem_nat_is_nat(2) by blast\n        from assms(1) have \"succ(n) = n #+ 1\"\n          using succ_add_one(1) by simp\n        with \\<open>k \\<in> n #+ 1\\<close> have \"k\\<in>succ(n)\" by simp\n        with assms(1) \\<open>n\\<noteq>0\\<close> have \"pred(k) \\<in> n\"\n          using pred_succ_mem by simp\n        with assms(2) \\<open>k \\<in> nat\\<close> \\<open>k\\<noteq>0\\<close> have \"?v\\<in>X\"\n          using pred_minus_one apply_funtype by simp\n      }\n      with assms(3) have \"?v \\<in> X\" by simp\n    } thus ?thesis by simp\n  qed\n  then have \"?b: (n #+ 1)\\<rightarrow>X\" by (rule ZF_fun_from_total)\n  with assms(2) show \"Prepend(a,x):(n #+ 1)\\<rightarrow>X\"\n    using func1_1_L1 unfolding Prepend_def by simp\n  from assms(1) have \"0 \\<in> n #+ 1\"\n    using succ_add_one(1) empty_in_every_succ by simp\n  then have \"?b`(0) = (if 0 = 0 then x else a`(0 #- 1))\" \n    by (rule ZF_fun_from_tot_val1)\n  with assms(2) show  \"Prepend(a,x)`(0) = x\"\n    using func1_1_L1 unfolding Prepend_def by simp\nqed\n\ntext\\<open>When prepending an element to a list the values at positive indices do not change.\\<close>\n\nlemma prepend_val: assumes \"n\\<in>nat\" \"a:n\\<rightarrow>X\" \"x\\<in>X\" \"k\\<in>n\"\n  shows \"Prepend(a,x)`(k #+ 1) = a`(k)\"\nproof -\n  let ?b = \"{\\<langle>k,if k = 0 then x else a`(k #- 1)\\<rangle>. k\\<in>n #+ 1}\"\n  from assms(1,4) have \"k\\<in>nat\"\n    using elem_nat_is_nat(2) by simp\n  with assms(1) have \"succ(n) = n #+ 1\" and \"succ(k) = k #+ 1\"\n    using succ_add_one(1) by auto\n  with assms(1,4) have \"k #+ 1 \\<in> n #+ 1\"\n    using succ_ineq by simp\n  from \\<open>k #+ 1 \\<in> n #+ 1\\<close> have \n    \"?b`(k #+ 1) = (if k #+ 1 = 0 then x else a`((k #+ 1) #- 1))\"\n    by (rule ZF_fun_from_tot_val1)\n  with assms(2) \\<open>k\\<in>nat\\<close> show ?thesis\n    using func1_1_L1 unfolding Prepend_def by simp\nqed\n\nsubsection\\<open>Lists and cartesian products\\<close>\n\ntext\\<open>Lists of length $n$ of elements of some set $X$ can be thought of as a \nmodel of the cartesian product $X^n$ which is more convenient in many applications.\\<close>\n\ntext\\<open>There is a natural bijection between the space $(n+1)\\rightarrow X$ of lists of length \n$n+1$ of elements of $X$ and the cartesian product $(n\\rightarrow X)\\times X$.\\<close>\n\nlemma lists_cart_prod: assumes \"n \\<in> nat\"\n  shows \"{\\<langle>x,\\<langle>Init(x),x`(n)\\<rangle>\\<rangle>. x \\<in> succ(n)\\<rightarrow>X} \\<in> bij(succ(n)\\<rightarrow>X,(n\\<rightarrow>X)\\<times>X)\"\nproof -\n  let ?f = \"{\\<langle>x,\\<langle>Init(x),x`(n)\\<rangle>\\<rangle>. x \\<in> succ(n)\\<rightarrow>X}\"\n  from assms have \"\\<forall>x \\<in> succ(n)\\<rightarrow>X. \\<langle>Init(x),x`(n)\\<rangle> \\<in> (n\\<rightarrow>X)\\<times>X\"\n    using init_props succ_iff apply_funtype by simp\n  then have I: \"?f: (succ(n)\\<rightarrow>X)\\<rightarrow>((n\\<rightarrow>X)\\<times>X)\" by (rule ZF_fun_from_total)\n  moreover from assms I have \"\\<forall>x\\<in>succ(n)\\<rightarrow>X.\\<forall>y\\<in>succ(n)\\<rightarrow>X. ?f`(x)=?f`(y) \\<longrightarrow> x=y\"\n    using ZF_fun_from_tot_val init_def finseq_restr_eq by auto\n  moreover have \"\\<forall>p\\<in>(n\\<rightarrow>X)\\<times>X.\\<exists>x\\<in>succ(n)\\<rightarrow>X. ?f`(x) = p\"\n  proof\n    fix p assume \"p \\<in> (n\\<rightarrow>X)\\<times>X\"\n    let ?x = \"Append(fst(p),snd(p))\"\n    from assms \\<open>p \\<in> (n\\<rightarrow>X)\\<times>X\\<close> have \"?x:succ(n)\\<rightarrow>X\" using append_props by simp\n    with I have \"?f`(?x) = \\<langle>Init(?x),?x`(n)\\<rangle>\" using succ_iff ZF_fun_from_tot_val by simp\n    moreover from assms \\<open>p \\<in> (n\\<rightarrow>X)\\<times>X\\<close> have \"Init(?x) = fst(p)\" and \"?x`(n) = snd(p)\"\n      using init_append append_props by auto\n    ultimately have \"?f`(?x) = \\<langle>fst(p),snd(p)\\<rangle>\" by auto\n    with \\<open>p \\<in> (n\\<rightarrow>X)\\<times>X\\<close> \\<open>?x:succ(n)\\<rightarrow>X\\<close> show \"\\<exists>x\\<in>succ(n)\\<rightarrow>X. ?f`(x) = p\" by auto\n  qed\n  ultimately show ?thesis using inj_def surj_def bij_def by auto\nqed\n\ntext\\<open>We can identify a set $X$ with lists of length one of elements of $X$.\\<close>\n\nlemma singleton_list_bij: shows \"{\\<langle>x,x`(0)\\<rangle>. x\\<in>1\\<rightarrow>X} \\<in> bij(1\\<rightarrow>X,X)\"\nproof -\n  let ?f = \"{\\<langle>x,x`(0)\\<rangle>. x\\<in>1\\<rightarrow>X}\"\n  have \"\\<forall>x\\<in>1\\<rightarrow>X. x`(0) \\<in> X\" using apply_funtype by simp\n  then have I: \"?f:(1\\<rightarrow>X)\\<rightarrow>X\" by (rule ZF_fun_from_total)\n  moreover have \"\\<forall>x\\<in>1\\<rightarrow>X.\\<forall>y\\<in>1\\<rightarrow>X. ?f`(x) = ?f`(y) \\<longrightarrow> x=y\"\n  proof -\n    { fix x y\n      assume \"x:1\\<rightarrow>X\" \"y:1\\<rightarrow>X\" and \"?f`(x) = ?f`(y)\"  \n      with I have \"x`(0) = y`(0)\" using ZF_fun_from_tot_val by auto\n      moreover from \\<open>x:1\\<rightarrow>X\\<close> \\<open>y:1\\<rightarrow>X\\<close> have \"x = {\\<langle>0,x`(0)\\<rangle>}\" and \"y = {\\<langle>0,y`(0)\\<rangle>}\" \n        using list_singleton_pair by auto\n      ultimately have \"x=y\" by simp \n    } thus ?thesis by auto \n  qed\n  moreover have \"\\<forall>y\\<in>X. \\<exists>x\\<in>1\\<rightarrow>X. ?f`(x)=y\"\n  proof\n    fix y assume \"y\\<in>X\"\n    let ?x = \"{\\<langle>0,y\\<rangle>}\"\n    from I \\<open>y\\<in>X\\<close> have \"?x:1\\<rightarrow>X\" and \"?f`(?x) = y\" \n      using list_len1_singleton ZF_fun_from_tot_val pair_val by auto \n    thus \"\\<exists>x\\<in>1\\<rightarrow>X. ?f`(x)=y\" by auto\n  qed\n  ultimately show ?thesis using inj_def surj_def bij_def by simp \nqed\n\ntext\\<open>We can identify a set of $X$-valued lists of length with $X$.\\<close>\n\nlemma list_singleton_bij: shows \n  \"{\\<langle>x,{\\<langle>0,x\\<rangle>}\\<rangle>.x\\<in>X} \\<in> bij(X,1\\<rightarrow>X)\" and \n  \"{\\<langle>y,y`(0)\\<rangle>. y\\<in>1\\<rightarrow>X} = converse({\\<langle>x,{\\<langle>0,x\\<rangle>}\\<rangle>.x\\<in>X})\" and\n  \"{\\<langle>x,{\\<langle>0,x\\<rangle>}\\<rangle>.x\\<in>X} = converse({\\<langle>y,y`(0)\\<rangle>. y\\<in>1\\<rightarrow>X})\"\nproof -\n  let ?f = \"{\\<langle>y,y`(0)\\<rangle>. y\\<in>1\\<rightarrow>X}\"\n  let ?g = \"{\\<langle>x,{\\<langle>0,x\\<rangle>}\\<rangle>.x\\<in>X}\"\n  have \"1 = {0}\" by auto\n  then have \"?f \\<in> bij(1\\<rightarrow>X,X)\" and \"?g:X\\<rightarrow>(1\\<rightarrow>X)\" \n    using singleton_list_bij pair_func_singleton ZF_fun_from_total  \n    by auto\n  moreover have \"\\<forall>y\\<in>1\\<rightarrow>X.?g`(?f`(y)) = y\"\n  proof\n    fix y assume \"y:1\\<rightarrow>X\"\n    have \"?f:(1\\<rightarrow>X)\\<rightarrow>X\" using singleton_list_bij bij_def inj_def by simp\n    with \\<open>1 = {0}\\<close> \\<open>y:1\\<rightarrow>X\\<close> \\<open>?g:X\\<rightarrow>(1\\<rightarrow>X)\\<close> show \"?g`(?f`(y)) = y\" \n      using ZF_fun_from_tot_val apply_funtype func_singleton_pair\n      by simp \n  qed\n  ultimately show \"?g \\<in> bij(X,1\\<rightarrow>X)\" and \"?f = converse(?g)\" and \"?g = converse(?f)\"\n    using comp_conv_id by auto\nqed \n\ntext\\<open>What is the inverse image of a set by the natural bijection between $X$-valued \n  singleton lists and $X$?\\<close>\n\nlemma singleton_vimage: assumes \"U\\<subseteq>X\" shows \"{x\\<in>1\\<rightarrow>X. x`(0) \\<in> U} = { {\\<langle>0,y\\<rangle>}. y\\<in>U}\"\nproof\n  have \"1 = {0}\" by auto \n  { fix x assume \"x \\<in> {x\\<in>1\\<rightarrow>X. x`(0) \\<in> U}\"\n    with \\<open>1 = {0}\\<close> have \"x = {\\<langle>0, x`(0)\\<rangle>}\" using func_singleton_pair by auto   \n  } thus \"{x\\<in>1\\<rightarrow>X. x`(0) \\<in> U} \\<subseteq> { {\\<langle>0,y\\<rangle>}. y\\<in>U}\" by auto\n  { fix x assume \"x \\<in> { {\\<langle>0,y\\<rangle>}. y\\<in>U}\"\n    then obtain y where \"x = {\\<langle>0,y\\<rangle>}\" and \"y\\<in>U\" by auto\n    with \\<open>1 = {0}\\<close> assms have \"x:1\\<rightarrow>X\" using pair_func_singleton by auto\n  } thus \"{ {\\<langle>0,y\\<rangle>}. y\\<in>U} \\<subseteq> {x\\<in>1\\<rightarrow>X. x`(0) \\<in> U}\" by auto\nqed\n\ntext\\<open>A technical lemma about extending a list by values from a set.\\<close> \n\nlemma list_append_from: assumes A1: \"n \\<in> nat\" and A2: \"U \\<subseteq> n\\<rightarrow>X\" and A3: \"V \\<subseteq> X\"\n  shows \n  \"{x \\<in> succ(n)\\<rightarrow>X. Init(x) \\<in> U \\<and> x`(n) \\<in> V} = (\\<Union>y\\<in>V.{Append(x,y).x\\<in>U})\"\nproof -\n  { fix x assume \"x \\<in> {x \\<in> succ(n)\\<rightarrow>X. Init(x) \\<in> U \\<and> x`(n) \\<in> V}\"\n    then have \"x \\<in> succ(n)\\<rightarrow>X\" and \"Init(x) \\<in> U\" and I: \"x`(n) \\<in> V\"\n      by auto\n    let ?y = \"x`(n)\"\n    from A1 and \\<open>x \\<in> succ(n)\\<rightarrow>X\\<close>  have \"x = Append(Init(x),?y)\"\n      using init_props by simp\n    with I and \\<open>Init(x) \\<in> U\\<close> have \"x \\<in> (\\<Union>y\\<in>V.{Append(a,y).a\\<in>U})\" by auto\n  }\n  moreover\n  { fix x assume \"x \\<in> (\\<Union>y\\<in>V.{Append(a,y).a\\<in>U})\"\n    then obtain a y where \"y\\<in>V\" and \"a\\<in>U\" and \"x = Append(a,y)\" by auto\n    with A2 A3 have \"x: succ(n)\\<rightarrow>X\" using append_props by blast \n    from A2 A3 \\<open>y\\<in>V\\<close> \\<open>a\\<in>U\\<close> have \"a:n\\<rightarrow>X\" and \"y\\<in>X\" by auto\n    with A1 \\<open>a\\<in>U\\<close>  \\<open>y\\<in>V\\<close> \\<open>x = Append(a,y)\\<close> have \"Init(x) \\<in> U\" and  \"x`(n) \\<in> V\"\n      using append_props init_append by auto    \n    with \\<open>x: succ(n)\\<rightarrow>X\\<close> have \"x \\<in> {x \\<in> succ(n)\\<rightarrow>X. Init(x) \\<in> U \\<and> x`(n) \\<in> V}\"\n      by auto\n  }\n  ultimately show ?thesis by blast\nqed\n\nend\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/FiniteSeq_ZF.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.6513548782017745, "lm_q1q2_score": 0.3383927473833304}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |               November 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2009         |\n            |                   June 2009  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_law_SKIP\nimports CSP_F_law_basic CSP_T_law_SKIP\nbegin\n\n(*****************************************************************\n\n         1. SKIP |[X]| SKIP\n         2. SKIP |[X]| P\n         3. P |[X]| SKIP\n         4. SKIP -- X\n         5. SKIP [[r]]\n         6. SKIP ;; P\n         7. P ;; SKIP\n         8. SKIP |. n\n\n *****************************************************************)\n\n(*********************************************************\n                    SKIP |[X]| SKIP\n *********************************************************)\n\nlemma cspF_Parallel_term:\n   \"SKIP |[X]| SKIP =F[M1,M2] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Parallel_term)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE)\n  apply (simp)\n  apply (fast)\n\n  apply (simp)\n  apply (fast)\ndone\n\n(*********************************************************\n                      SKIP |[X]| P\n *********************************************************)\n\nlemma cspF_Parallel_preterm_l_set1: \n  \"[| Ya - insert Tick (Ev ` X) = Z - insert Tick (Ev ` X) ; Ev ` Y Int Z = {} |]\n   ==> Ev ` (Y - X) Int (Ya Un Z) = {}\"\nby (auto)\n\nlemma cspF_Parallel_preterm_l: \n   \"SKIP |[X]| (? :Y -> Qf) =F[M,M] ? x:(Y-X) -> (SKIP |[X]| Qf x)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Parallel_preterm_l)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (elim disjE conjE exE)\n  apply (simp_all)\n\n  apply (simp add: cspF_Parallel_preterm_l_set1)\n\n  apply (drule_tac x=\"s\" in spec)\n  apply (erule disjE, simp)\n  apply (erule disjE, simp)\n  apply (elim conjE exE, simp)\n  apply (simp add: par_tr_head)\n  apply (fast)\n\n      (* automatized by \"par_tr_nil_Tick\" *)\n\n  apply (drule_tac x=\"s\" in spec)\n  apply (erule disjE, simp)\n  apply (erule disjE, simp)\n  apply (elim conjE exE, simp)\n  apply (simp add: par_tr_head)\n  apply (fast)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE, simp)\n  apply (rule_tac x=\"Xa - {Tick}\" in exI)\n  apply (rule_tac x=\"Xa - (Ev ` X)\" in exI)\n  apply (rule conjI, fast)\n  apply (rule conjI, fast)\n\n  apply (rule conjI)\n  apply (simp add: Evset_def, fast)\n  apply (fast)\n\n (* *)\n  apply (elim disjE conjE exE)\n  apply (simp_all)\n   apply (rule_tac x=\"Ya\" in exI)\n   apply (rule_tac x=\"Z\" in exI, simp)\n   apply (rule_tac x=\"<>\" in exI)\n   apply (rule_tac x=\"<Ev a> ^^^ t\" in exI, simp)\n   apply (simp add: par_tr_head)\n\n   apply (rule_tac x=\"Ya\" in exI)\n   apply (rule_tac x=\"Z\" in exI, simp)\n   apply (rule_tac x=\"<Tick>\" in exI)\n   apply (rule_tac x=\"<Ev a> ^^^ t\" in exI, simp)\n   apply (simp add: par_tr_head)\ndone\n\n(*********************************************************\n                      P |[X]| SKIP\n *********************************************************)\n\nlemma cspF_Parallel_preterm_r: \n   \"(? :Y -> Pf) |[X]| SKIP\n     =F[M,M] ? x:(Y-X) -> (Pf x |[X]| SKIP)\"\napply (rule cspF_trans)\napply (rule cspF_Parallel_commut)\napply (rule cspF_trans)\napply (rule cspF_Parallel_preterm_l)\napply (rule cspF_rm_head, simp)\napply (rule cspF_Parallel_commut)\ndone\n\nlemmas cspF_Parallel_preterm = cspF_Parallel_preterm_l cspF_Parallel_preterm_r\n\n(*********************************************************\n                      SKIP and Parallel\n *********************************************************)\n\n(* p.288 *)\n\nlemma cspF_SKIP_Parallel_Ext_choice_SKIP_l:\n  \"((? :Y -> Pf) [+] SKIP) |[X]| SKIP =F[M,M] \n   (? x:(Y - X) -> (Pf x |[X]| SKIP)) [+] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Parallel_Ext_choice_SKIP_l)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (rule disjI1)\n  apply (blast)\n\n  apply (simp add: par_tr_nil_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp)\n  apply (rule_tac x=\"sb\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n\n  apply (rule, simp add: in_traces)\n\n  apply (simp add: par_tr_Tick_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp)\n  apply (rule_tac x=\"sb\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n\n(* <= *)\n apply (rule, simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (simp add: in_traces)\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (simp)\n\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp add: par_tr_nil_right)\n  apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n  apply (simp add: image_iff)\n  apply (fast)\n\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp add: par_tr_Tick_right)\n  apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n  apply (simp add: image_iff)\n  apply (fast)\n\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (simp)\n\n  apply (simp add: in_traces)\n\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (simp)\ndone\n\nlemma cspF_SKIP_Parallel_Ext_choice_SKIP_r:\n  \"SKIP |[X]| ((? :Y -> Pf) [+] SKIP)  =F[M,M]\n    (? x:(Y - X) -> (SKIP |[X]| Pf x)) [+] SKIP\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_Parallel_Ext_choice_SKIP_l)\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_commut)\napply (rule cspF_reflex)\napply (rule cspF_reflex)\ndone\n\nlemmas cspF_SKIP_Parallel_Ext_choice_SKIP =\n       cspF_SKIP_Parallel_Ext_choice_SKIP_l\n       cspF_SKIP_Parallel_Ext_choice_SKIP_r\n\n(*********************************************************\n                      SKIP -- X\n *********************************************************)\n\nlemma cspF_SKIP_Hiding_Id: \n   \"SKIP -- X =F[M,M] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Hiding_Id)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: Evset_def)\n  apply (fast)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp)\ndone\n\n(*********************************************************\n                      SKIP and Hiding\n *********************************************************)\n\n(* p.288 version\n  \"((? :Y -> Pf) [+] SKIP) -- X =F[M,M]\n       IF (Y Int X = {}) THEN ((? x:Y -> (Pf x -- X)) [+] SKIP)\n                         ELSE (((? x:(Y-X) -> (Pf x -- X)) [+] SKIP)\n                               |~| (! x:(Y Int X) .. (Pf x -- X)))\"\n*)\n\nlemma cspF_SKIP_Hiding_step:\n  \"((? :Y -> Pf) [+] SKIP) -- X =F[M,M]\n   (((? x:(Y-X) -> (Pf x -- X)) [+] SKIP) |~| (! x:(Y Int X) .. (Pf x -- X)))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Hiding_step)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (simp_all add: in_traces)\n\n  apply (case_tac \"a : X\")\n  apply (simp)\n  apply (blast)\n  apply (force)\n\n(* <= *)\n apply (rule)\n\n  apply (simp add: in_failures)\n  apply (elim conjE exE bexE disjE)\n  apply (simp_all)\n\n   apply (rule_tac x=\"<>\" in exI)\n   apply (simp add: in_traces)\n   apply (simp add: Evset_def)\n   apply (fast)\n\n   apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n   apply (simp)\n\n   apply (rule_tac x=\"<Tick>\" in exI)\n   apply (simp)\n\n   apply (simp add: in_traces)\n\n   apply (rule_tac x=\"<>\" in exI)\n   apply (simp add: Evset_def)\n   apply (fast)\n\n   apply (rule_tac x=\"<Ev a> ^^^ sa\" in exI)\n   apply (simp)\ndone\n\n(*********************************************************\n                      SKIP [[r]]\n *********************************************************)\n\nlemma cspF_SKIP_Renaming_Id: \n   \"SKIP [[r]] =F[M1,M2] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Renaming_Id)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (force)\ndone\n\n(*********************************************************\n                       SKIP ;; P\n *********************************************************)\n\nlemma cspF_Seq_compo_unit_l: \"SKIP ;; P =F[M,M] P\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Seq_compo_unit_l)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (elim conjE disjE)\n apply (simp_all add: Evset_def)\n apply (elim conjE exE)\n apply (simp add: in_traces)\n\n(* <= *)\n apply (rule, simp add: in_failures)\n apply (rule disjI2)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"s\" in exI)\n apply (simp add: in_traces)\ndone\n\n(*********************************************************\n                       P ;; SKIP\n *********************************************************)\n\nlemma cspF_Seq_compo_unit_r: \"P ;; SKIP =F[M,M] P\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Seq_compo_unit_r)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (rule memF_F2, simp, fast)\n apply (rule domF_F2_F4, simp_all)\n apply (fold comp_def, simp)\n apply (rule domF_T3, simp_all)\n apply (fold comp_def, simp)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (insert trace_last_noTick_or_Tick)\n apply (drule_tac x=\"s\" in spec)\n apply (erule disjE)\n  apply (case_tac \"Tick : X\")\n   apply (rule disjI1, simp)\n   apply (subgoal_tac \"insert Tick X = X\", simp, fast)\n   (* Tick ~: X *)\n   apply (case_tac \"s ^^^ <Tick> ~:t [[P]]Tf (fstF o M)\")\n    apply (rule disjI1, simp)\n    apply (rule domF_F3[of \"[[P]]Tf (fstF o M)\" \"failures P M\" _ _ \"{Tick}\", simplified])\n    apply (simp_all add: semTf_def)\n    (* *)\n    apply (rule disjI2)\n    apply (rule_tac x=\"s\" in exI)\n    apply (rule_tac x=\"<>\" in exI, simp)\n    apply (simp add: Evset_def, fast)\n  (* *)\n  apply (elim conjE exE, simp)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp)\n  apply (rule domF_T2[of _ \"failures P M\"], simp_all)\ndone\n\nlemmas cspF_Seq_compo_unit = cspF_Seq_compo_unit_l cspF_Seq_compo_unit_r\n\n(*********************************************************\n               SKIP and Sequential composition\n *********************************************************)\n\n(* p.141 *)\n\nlemma cspF_SKIP_Seq_compo_step:\n  \"((? :X -> Pf) [> SKIP) ;; Q =F[M,M] (? x:X -> (Pf x ;; Q)) [> Q\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Seq_compo_step)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (simp add: Evset_def)\n apply (simp add: Evset_def)\n apply (simp add: Evset_def)\n\n apply (rule disjI2)\n apply (rule disjI1)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (drule_tac x=\"sa\" in spec)\n\n apply (elim disjE conjE exE)\n  apply (simp_all)\n  apply (simp add: appt_assoc)\n  apply (rule disjI2)\n  apply (rule disjI1)\n  apply (rule_tac x=\"sc\" in exI)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp)\n\n(* <= *)\n apply (rule, simp add: in_failures in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (rule disjI2)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp)\n\n  apply (rule disjI2)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp)\n\n  apply (rule disjI2)\n  apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp add: appt_assoc)\n\n  apply (rule disjI2)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"s\" in exI)\n  apply (simp)\n\n  apply (rule disjI2)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp)\n  apply (rule proc_F2_F4)\n  apply (simp_all)\ndone\n\n(*********************************************************\n                      SKIP |. n\n *********************************************************)\n\nlemma cspF_SKIP_Depth_rest: \n   \"SKIP |. Suc n =F[M1,M2] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Depth_rest)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE disjE)\n apply (simp)\n apply (simp)\n apply (case_tac \"0 < n\", simp)\n apply (simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\ndone\n\n(*********************************************************\n                      cspF_SKIP\n *********************************************************)\n\nlemmas cspF_SKIP =\n       cspF_Parallel_term\n       cspF_Parallel_preterm\n       cspF_SKIP_Parallel_Ext_choice_SKIP\n       cspF_SKIP_Hiding_Id\n       cspF_SKIP_Hiding_step\n       cspF_SKIP_Renaming_Id\n       cspF_Seq_compo_unit\n       cspF_SKIP_Seq_compo_step\n       cspF_SKIP_Depth_rest\n\n(*********************************************************\n                       P [+] SKIP\n *********************************************************)\n\n(* p.141 *)\n\nlemma cspF_Ext_choice_SKIP_resolve: \"P [+] SKIP =F[M,M] P [> SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Ext_choice_SKIP_resolve)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_traces in_failures)\n apply (force)\ndone\n\n(* =================================================== *\n |             addition for CSP-Prover 5               |\n * =================================================== *)\n\n\n(*********************************************************\n                    SKIP ||| P   (--> SKIP)\n *********************************************************)\n\nlemma cspF_Interleave_unit_l: \n  \"SKIP ||| P =F[M,M] P\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Interleave_unit_l)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n  apply (simp add: par_tr_nil_left) \n  apply (subgoal_tac \"Y Un Z = Z\")\n  apply (simp)\n  apply (simp add: Evset_def)\n  apply (force)\n\n  apply (simp add: par_tr_Tick_left)\n  apply (simp add: Tick_in_sett)\n  apply (elim conjE exE)\n  apply (rotate_tac -3)\n  apply (drule sym)\n  apply (simp)\n  apply (rule proc_T2_T3)\n  apply (simp_all)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (rule_tac x=\"X-{Tick}\" in exI)\n apply (rule_tac x=\"X\" in exI)\n apply (simp)\n  apply (rule conjI)\n  apply (force)\n\n apply (case_tac \"noTick s\")\n\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"s\" in exI)\n  apply (simp add: par_tr_nil_left) \n  apply (simp add: noTick_def)\n  apply (simp add: Evset_def)\n  apply (force)\n\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (rule_tac x=\"s\" in exI)\n  apply (simp)\n  apply (simp add: par_tr_Tick_left)\n  apply (simp add: noTick_def)\ndone\n\n\n(*********************************************************\n                    P ||| SKIP (SKIP)\n *********************************************************)\n\nlemma cspF_Interleave_unit_r: \n  \"P ||| SKIP =F[M,M] P\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (simp add: cspF_Interleave_unit_l)\ndone\n\nlemmas cspF_Interleave_unit =\n       cspF_Interleave_unit_l\n       cspF_Interleave_unit_r\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_law_SKIP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3383927403512352}}
{"text": "section {* Proof of the agreement property of AbstractMultiPaxos. *}\n\ntheory AbstractMultiPaxosCorrectness\nimports AbstractMultiPaxos IOA_Automation BallotArrayProperties \nbegin\n\nlocale amp_proof = quorums quorums + amp_ioa quorums for quorums +\n  fixes the_ioa\n  defines \"the_ioa \\<equiv> amp_ioa\"\n  -- {* Here we have to fix the constant @{term the_ioa} in order to fix all type variables.\n  Otherwise, there are problems in Eisbach when matching the same polymorphic constant appearing in several terms. *}\nbegin\n\ninterpretation IOA .\n\nsubsection {* Automation setup and a few lemmas *}\n\nlemmas amp_ioa_defs =\n   is_trans_def actions_def amp_trans_def amp_start_def\n   externals_def amp_ioa_def the_ioa_def paxos_asig_def\n\ndeclare amp_ioa_defs[inv_proofs_defs]\ndeclare amp_ioa_def[inv_proofs_defs]\n\ndeclare propose_def[simp] join_ballot_def[simp] do_vote_def[simp]\n  learn_def[simp] Let_def[simp] if_split[split] if_split_asm[split]\n\nsubsection {* @{term conservative_array}  is an inductive invariant *}\n\ndeclare ballot_array.conservative_array_def[inv_proofs_defs]\n\nabbreviation conservative_array where\n\"conservative_array s \\<equiv>  \\<forall> i . conservative_at s i\"\n\nlemma conservative_inductive:\n  \"invariant the_ioa conservative_array\"\n  apply (try_solve_inv2 case_thm:trans_cases inv_proofs_defs:inv_proofs_defs ballot_array.conservative_def invs:invs)\n  apply (case_tac a)\n  apply (auto simp add:inv_proofs_defs split:option.split_asm)\ndone\ndeclare conservative_inductive[invs]\n\nsubsection {* @{term safe} is inductive relative to @{term conservative_array}} *}\n\ntext {* \nWe first prove that when the algorithm takes a step, the old state is a prefix\nof the new state. With this fact, we obtain that (1) a safe value remains safe after a step using the lemma @{thm ballot_array_prefix.safe_at_mono }.\nThen we prove that (2) when a vote is cast at a ballot b from a safe state, then the voted value is safe at b.\nGiven those two facts, the inductiveness of safe follows.  *}\n\nabbreviation safe_at where \"safe_at s i \\<equiv> ballot_array.safe_at  quorums (ballot s) (vote s i)\"\n\nlemma trans_imp_prefix_order:\n  assumes \"s \\<midarrow>a\\<midarrow>the_ioa\\<longrightarrow> t\"\n  shows \"is_prefix (ballot s) (ballot t) (vote s i) (vote t i)\" using assms\nby (cases a) (auto simp add:is_prefix_def inv_proofs_defs split:option.split_asm)\n\nlemma safe_mono:\n  -- {* @{term safe_at} is monotonic. *}\n  assumes \"s \\<midarrow>a\\<midarrow>the_ioa\\<longrightarrow> t\" and \"safe_at s i v b\"\n  shows \"safe_at t i v b\" using assms ballot_array_prefix.safe_at_mono\nby (metis ballot_array_prefix_axioms.intro ballot_array_prefix_def quorums_axioms trans_imp_prefix_order)\n\nabbreviation safe where \"safe s \\<equiv> \\<forall> i . ballot_array.safe  quorums (ballot s) (vote s i)\"\n  \nlemma safe_votes:\n  assumes \"s \\<midarrow>aa\\<midarrow>the_ioa\\<longrightarrow> t\" and \"vote s i a b  \\<noteq> vote t i a b\" and \"vote t i a b = Some v\"\n    and \"conservative_array s\" and \"safe s\"\n  shows \"safe_at t i v b\" \n  using assms\n  apply (cases aa)\n    apply (auto simp add:inv_proofs_defs)\n  subgoal premises prems\n  proof -\n    have \"safe_at s i v (ballot s a)\" by (smt assms(4) ballot_array.safe_def ballot_array_props.intro ballot_array_props.proved_safe_at_abs_imp_safe_at option.case_eq_if option.distinct(1) option.sel prems(2) prems(6) quorums_axioms) \n    thus ?thesis by (metis amp_state.select_convs(2) amp_state.select_convs(3) amp_state.surjective amp_state.update_convs(3) assms(1) fun_upd_apply prems(9) safe_mono) \n  qed\n  done\n\nlemma safe_inv:\n  \"invariant the_ioa safe\"\napply (try_solve_inv2 case_thm:trans_cases inv_proofs_defs:inv_proofs_defs ballot_array.safe_def invs:invs)\nsubgoal premises prems for s t act\nproof (auto simp add:ballot_array.safe_def split:option.splits)\n  fix i b a v\n  assume \"vote t i a b = Some v\"\n  show \"safe_at t i v b\"\n  proof (cases \"vote s i a b = vote t i a b\")\n    case True\n    hence \"safe_at s i v b\" using prems(1) by (metis \\<open>vote t i a b = Some v\\<close> ballot_array.safe_def option.simps(5))\n    thus ?thesis using prems(2) safe_mono\n      by fastforce \n  next\n    case False thus ?thesis using safe_votes\n      using \\<open>vote t i a b = Some v\\<close> prems(1-3) by blast  \n  qed\nqed\ndone\ndeclare safe_inv[invs]\n\nsubsection {* Finally, the proof that agreement holds (trivial, follows immediately from safe).*}\n\ndefinition agreement where \n  \"agreement s \\<equiv> \\<forall> v w i . chosen s i v \\<and> chosen s i w \\<longrightarrow> v = w\"\n\nlemma agreement:\"invariant the_ioa agreement\"\napply(rule invariantI)\n    apply(auto simp add: inv_proofs_defs agreement_def ballot_array.chosen_def ballot_array.chosen_at_def)[1]\n  apply (metis (mono_tags, lifting) IOA.invariant_def IOA.reachable_n agreement_def amp_proof.safe_inv amp_proof_axioms ballot_array_props.intro ballot_array_props.safe_imp_agreement quorums_axioms the_ioa_def)\ndone\n\nend\n\nend", "meta": {"author": "nano-o", "repo": "dist-systems-verif", "sha": "9826370dd5f1c6df6543e64481bfafc3e164674e", "save_path": "github-repos/isabelle/nano-o-dist-systems-verif", "path": "github-repos/isabelle/nano-o-dist-systems-verif/dist-systems-verif-9826370dd5f1c6df6543e64481bfafc3e164674e/Isabelle2/AbstractMultiPaxosCorrectness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3383927403512351}}
{"text": "theory LinuxRouter_OpenFlow_Translation\nimports \"../IP_Addresses/CIDR_Split\"\n  \"../Automatic_Refinement/Lib/Misc\" (*TODO@Peter: rename and make available at better place :)*)\n\t\"../Simple_Firewall/Generic_SimpleFw\" \n\t\"Semantics_OpenFlow\"\n\t\"OpenFlow_Matches\"\n\t\"OpenFlow_Action\"\n\t\"../Routing/Linux_Router\"\nbegin\n\n(* For reference:\niiface :: \"iface\" --\"in-interface\"\noiface :: \"iface\" --\"out-interface\"\nsrc :: \"(ipv4addr \\<times> nat) \" --\"source IP address\"\ndst :: \"(ipv4addr \\<times> nat) \" --\"destination\"\nproto :: \"protocol\"\nsports :: \"(16 word \\<times> 16 word)\" --\"source-port first:last\"\ndports :: \"(16 word \\<times> 16 word)\" --\"destination-port first:last\"\n\np_iiface :: string\np_oiface :: string\np_src :: ipv4addr\np_dst :: ipv4addr\np_proto :: primitive_protocol\np_sport :: \"16 word\"\np_dport :: \"16 word\"\np_tcp_flags :: \"tcp_flag set\"\np_payload :: string\n*)\n\ndefinition \"route2match r =\n\t\\<lparr>iiface = ifaceAny, oiface = ifaceAny, \n\tsrc = (0,0), dst=(pfxm_prefix (routing_match r),pfxm_length (routing_match r)), \n\tproto=ProtoAny, sports=(0,max_word), ports=(0,max_word)\\<rparr>\"\n\ndefinition toprefixmatch where\n\"toprefixmatch m \\<equiv> (let pm = PrefixMatch (fst m) (snd m) in if pm = PrefixMatch 0 0 then None else Some pm)\"\nlemma prefix_match_semantics_simple_match: \n  assumes some: \"toprefixmatch m = Some pm\"\n\tassumes vld: \"valid_prefix pm\"\n\tshows \"prefix_match_semantics pm = simple_match_ip m\"\nusing some\n  by(cases m)\n\t  (clarsimp \n\t   simp add: toprefixmatch_def ipset_from_cidr_def pfxm_mask_def fun_eq_iff\n\t            prefix_match_semantics_ipset_from_netmask[OF vld] NOT_mask_shifted_lenword[symmetric]\n\t   split: if_splits)\n\ndefinition simple_match_to_of_match_single ::\n    \"(32, 'a) simple_match_scheme\n     \\<Rightarrow> char list option \\<Rightarrow> protocol \\<Rightarrow> (16 word \\<times> 16 word) option \\<Rightarrow> (16 word \\<times> 16 word) option \\<Rightarrow> of_match_field set\" \n    where\n\"simple_match_to_of_match_single m iif prot sport dport \\<equiv>\n\t   uncurry L4Src ` option2set sport \\<union> uncurry L4Dst ` option2set dport\n\t \\<union> IPv4Proto ` (case prot of ProtoAny \\<Rightarrow> {} | Proto p \\<Rightarrow> {p}) (* protocol is an 8 word option anyway\\<dots> *)\n\t \\<union> IngressPort ` option2set iif\n\t \\<union> IPv4Src ` option2set (toprefixmatch (src m)) \\<union> IPv4Dst ` option2set (toprefixmatch (dst m))\n\t \\<union> {EtherType 0x0800}\"\n(* okay, we need to make sure that no packets are output on the interface they were input on. So for rules that don't have an input interface, we'd need to do a product over all interfaces, if we stay naive.\n   The more smart way would be to insert a rule with the same match condition that additionally matches the input interface and drops. However, I'm afraid this is going to be very tricky to verify\\<dots> *)\ndefinition simple_match_to_of_match :: \"32 simple_match \\<Rightarrow> string list \\<Rightarrow> of_match_field set list\" where\n\"simple_match_to_of_match m ifs \\<equiv> (let\n\tnpm = (\\<lambda>p. fst p = 0 \\<and> snd p = max_word);\n\tsb = (\\<lambda>p. (if npm p then [None] else if fst p \\<le> snd p then map (Some \\<circ> (\\<lambda>pfx. (pfxm_prefix pfx, NOT pfxm_mask pfx))) (wordinterval_CIDR_split_prefixmatch (WordInterval (fst p) (snd p))) else []))\n\tin [simple_match_to_of_match_single m iif (proto m) sport dport.\n\t\tiif \\<leftarrow> (if iiface m = ifaceAny then [None] else [Some i. i \\<leftarrow> ifs, match_iface (iiface m) i]),\n\t\tsport \\<leftarrow> sb (sports m),\n\t\tdport \\<leftarrow> sb (dports m)]\n)\"\n(* I wonder\\<dots> should I check whether list_all (match_iface (iiface m)) ifs instead of iiface m = ifaceAny? It would be pretty stupid if that wasn't the same, but you know\\<dots> *)\n\nlemma smtoms_eq_hlp: \"simple_match_to_of_match_single r a b c d = simple_match_to_of_match_single r f g h i \\<longleftrightarrow> (a = f \\<and> b = g \\<and> c = h \\<and> d = i)\"\n(* In case this proof breaks: there are two alternate proofs in the repo. They are of similar quality, though. Good luck. *)\nproof(rule iffI,goal_cases)\n  case 1\n  thus ?case proof(intro conjI)\n    have *: \"\\<And>P z x. \\<lbrakk>\\<forall>x :: of_match_field. P x; z = Some x\\<rbrakk> \\<Longrightarrow> P (IngressPort x)\" by simp\n    show \"a = f\" using 1 by(cases a; cases f)\n        (simp add: option2set_None simple_match_to_of_match_single_def toprefixmatch_def option2set_def;\n        subst(asm) set_eq_iff; drule (1) *; simp split: option.splits uncurry_splits protocol.splits)+\n  next\n    have *: \"\\<And>P z x. \\<lbrakk>\\<forall>x :: of_match_field. P x; z = Proto x\\<rbrakk> \\<Longrightarrow> P (IPv4Proto x)\" by simp\n    show \"b = g\" using 1 by(cases b; cases g) \n        (simp add: option2set_None simple_match_to_of_match_single_def toprefixmatch_def option2set_def;\n        subst(asm) set_eq_iff; drule (1) *; simp split: option.splits uncurry_splits protocol.splits)+\n  next\n    have *: \"\\<And>P z x. \\<lbrakk>\\<forall>x :: of_match_field. P x; z = Some x\\<rbrakk> \\<Longrightarrow> P (uncurry L4Src x)\" by simp\n    show \"c = h\" using 1 by(cases c; cases h)\n        (simp add: option2set_None simple_match_to_of_match_single_def toprefixmatch_def option2set_def;\n        subst(asm) set_eq_iff; drule (1) *; simp split: option.splits uncurry_splits protocol.splits)+\n  next\n    have *: \"\\<And>P z x. \\<lbrakk>\\<forall>x :: of_match_field. P x; z = Some x\\<rbrakk> \\<Longrightarrow> P (uncurry L4Dst x)\" by simp\n    show \"d = i\" using 1 by(cases d; cases i)\n        (simp add: option2set_None simple_match_to_of_match_single_def toprefixmatch_def option2set_def;\n        subst(asm) set_eq_iff; drule (1) *; simp split: option.splits uncurry_splits protocol.splits)+\n  qed\nqed simp\n\nlemma simple_match_to_of_match_generates_prereqs: \"simple_match_valid m \\<Longrightarrow> r \\<in> set (simple_match_to_of_match m ifs) \\<Longrightarrow> all_prerequisites r\"\nunfolding simple_match_to_of_match_def Let_def\nproof(clarsimp, goal_cases)\n  case (1 xiface xsrcp xdstp)\n  note o = this\n  show ?case unfolding simple_match_to_of_match_single_def all_prerequisites_def\n    unfolding ball_Un\n  proof((intro conjI; ((simp;fail)| - )), goal_cases)\n    case 1\n    have e: \"(fst (sports m) = 0 \\<and> snd (sports m) = max_word) \\<or> proto m = Proto TCP \\<or> proto m = Proto UDP \\<or> proto m = Proto L4_Protocol.SCTP\"\n      using o(1)\n      unfolding simple_match_valid_alt Let_def\n      by(clarsimp split: if_splits)\n    show ?case\n      using o(3) e\n      by(elim disjE; simp add: option2set_def split: if_splits prod.splits uncurry_splits)\n  next\n    case 2\n    have e: \"(fst (dports m) = 0 \\<and> snd (dports m) = max_word) \\<or> proto m = Proto TCP \\<or> proto m = Proto UDP \\<or> proto m = Proto L4_Protocol.SCTP\"\n      using o(1)\n      unfolding simple_match_valid_alt Let_def\n      by(clarsimp split: if_splits)\n    show ?case\n      using o(4) e\n      by(elim disjE; simp add: option2set_def split: if_splits prod.splits uncurry_splits)\n  qed\nqed\n\nlemma and_assoc: \"a \\<and> b \\<and> c \\<longleftrightarrow> (a \\<and> b) \\<and> c\" by simp\n\nlemmas custom_simpset = Let_def set_concat set_map map_map comp_def concat_map_maps set_maps UN_iff fun_app_def Set.image_iff\n\nabbreviation \"simple_fw_prefix_to_wordinterval \\<equiv> prefix_to_wordinterval \\<circ> uncurry PrefixMatch\"\n\nlemma simple_match_port_alt: \"simple_match_port m p \\<longleftrightarrow> p \\<in> wordinterval_to_set (uncurry WordInterval m)\" by(simp split: uncurry_splits)\n\nlemma simple_match_src_alt: \"simple_match_valid r \\<Longrightarrow> \n\tsimple_match_ip (src r) p \\<longleftrightarrow> prefix_match_semantics (PrefixMatch (fst (src r)) (snd (src r))) p\"\nby(cases \"(src r)\") (simp add: prefix_match_semantics_ipset_from_netmask2 prefix_to_wordset_ipset_from_cidr simple_match_valid_def valid_prefix_fw_def)\nlemma simple_match_dst_alt: \"simple_match_valid r \\<Longrightarrow> \n\tsimple_match_ip (dst r) p \\<longleftrightarrow> prefix_match_semantics (PrefixMatch (fst (dst r)) (snd (dst r))) p\"\nby(cases \"(dst r)\") (simp add: prefix_match_semantics_ipset_from_netmask2 prefix_to_wordset_ipset_from_cidr simple_match_valid_def valid_prefix_fw_def)\n\nlemma \"x \\<in> set (wordinterval_CIDR_split_prefixmatch w) \\<Longrightarrow> valid_prefix x\"\nusing wordinterval_CIDR_split_prefixmatch_all_valid_Ball[THEN bspec, THEN conjunct1] .\n\nlemma simple_match_to_of_matchI: \n\tassumes mv: \"simple_match_valid r\"\n\tassumes mm: \"simple_matches r p\"\n\tassumes ii: \"p_iiface p \\<in> set ifs\"\n\tassumes ippkt: \"p_l2type p = 0x800\"\n\tshows eq: \"\\<exists>gr \\<in> set (simple_match_to_of_match r ifs). OF_match_fields gr p = Some True\"\nproof -\n\tlet ?npm = \"\\<lambda>p. fst p = 0 \\<and> snd p = max_word\"\n\tlet ?sb = \"\\<lambda>p r. (if ?npm p then None else Some r)\"\n\tobtain si where si: \"case si of Some ssi \\<Rightarrow> p_sport p \\<in> prefix_to_wordset ssi | None \\<Rightarrow> True\"\n\t\t\"case si of None \\<Rightarrow> True | Some ssi \\<Rightarrow> ssi \\<in> set (\n\t\twordinterval_CIDR_split_prefixmatch (uncurry WordInterval (sports r)))\"\n\t\t\"si = None \\<longleftrightarrow> ?npm (sports r)\"\n\tproof(cases \"?npm (sports r)\", goal_cases)\n\t\tcase 1 (* True *)\n\t\thence \"(case None of None \\<Rightarrow> True | Some ssi \\<Rightarrow> p_sport p \\<in> prefix_to_wordset ssi) \\<and>\n            (case None of None \\<Rightarrow> True\n            | Some ssi \\<Rightarrow> ssi \\<in> set (wordinterval_CIDR_split_prefixmatch (uncurry WordInterval (sports r))))\" by simp\n        with 1 show ?thesis by blast\n\tnext\n\t\tcase 2 (* False *)\n\t\tfrom mm have \"p_sport p \\<in> wordinterval_to_set (uncurry WordInterval (sports r))\"\n\t\t\tby(simp only: simple_matches.simps simple_match_port_alt)\n\t\tthen obtain ssi where ssi:\n\t\t\t\"ssi \\<in> set (wordinterval_CIDR_split_prefixmatch (uncurry WordInterval (sports r)))\"\n\t\t\t\"p_sport p \\<in> prefix_to_wordset ssi\" \n\t\t\tusing wordinterval_CIDR_split_existential by fast\n\t\thence \"(case Some ssi of None \\<Rightarrow> True | Some ssi \\<Rightarrow> p_sport p \\<in> prefix_to_wordset ssi) \\<and>\n            (case Some ssi of None \\<Rightarrow> True\n            | Some ssi \\<Rightarrow> ssi \\<in> set (wordinterval_CIDR_split_prefixmatch (uncurry WordInterval (sports r))))\" by simp\n        with 2 show ?thesis by blast\n    qed\t\t\t\t\n\tobtain di where di: \"case di of Some ddi \\<Rightarrow> p_dport p \\<in> prefix_to_wordset ddi | None \\<Rightarrow> True\"\n\t\t\"case di of None \\<Rightarrow> True | Some ddi \\<Rightarrow> ddi \\<in> set (\n\t\twordinterval_CIDR_split_prefixmatch (uncurry WordInterval (dports r)))\"\n\t\t\"di = None \\<longleftrightarrow> ?npm (dports r)\"\n\tproof(cases \"?npm (dports r)\", goal_cases)\n\t\tcase 1\n\t\thence \"(case None of None \\<Rightarrow> True | Some ssi \\<Rightarrow> p_dport p \\<in> prefix_to_wordset ssi) \\<and>\n            (case None of None \\<Rightarrow> True\n            | Some ssi \\<Rightarrow> ssi \\<in> set (wordinterval_CIDR_split_prefixmatch (uncurry WordInterval (dports r))))\" by simp\n        with 1 show ?thesis by blast\n\tnext\n\t\tcase 2\n\t\tfrom mm have \"p_dport p \\<in> wordinterval_to_set (uncurry WordInterval (dports r))\"\n\t\t\tby(simp only: simple_matches.simps simple_match_port_alt)\n\t\tthen obtain ddi where ddi:\n\t\t\t\"ddi \\<in> set (wordinterval_CIDR_split_prefixmatch (uncurry WordInterval (dports r)))\"\n\t\t\t\"p_dport p \\<in> prefix_to_wordset ddi\" \n\t\t\tusing wordinterval_CIDR_split_existential by fast\n\t\thence \"(case Some ddi of None \\<Rightarrow> True | Some ssi \\<Rightarrow> p_dport p \\<in> prefix_to_wordset ssi) \\<and>\n            (case Some ddi of None \\<Rightarrow> True\n            | Some ssi \\<Rightarrow> ssi \\<in> set (wordinterval_CIDR_split_prefixmatch (uncurry WordInterval (dports r))))\" by simp\n        with 2 show ?thesis by blast\n    qed\n    show ?thesis\n\tproof\n\t\tlet ?mf = \"map_option (apsnd (wordNOT \\<circ> mask \\<circ> op - 16) \\<circ> prefix_match_dtor)\"\n\t\tlet ?gr = \"simple_match_to_of_match_single r\n\t\t\t(if iiface r = ifaceAny then None else Some (p_iiface p)) \n\t\t\t(if proto r = ProtoAny then ProtoAny else Proto (p_proto p))\n\t\t\t(?mf si) (?mf di)\"\n\t\tnote mfu = simple_match_port.simps[of \"fst (sports r)\" \"snd (sports r)\", unfolded surjective_pairing[of \"sports r\",symmetric]]\n\t\t\t\t   simple_match_port.simps[of \"fst (dports r)\" \"snd (dports r)\", unfolded surjective_pairing[of \"dports r\",symmetric]]\n\t\tnote u = mm[unfolded simple_matches.simps mfu ord_class.atLeastAtMost_iff simple_packet_unext_def simple_packet.simps]\n\t\tnote of_safe_unsafe_match_eq[OF simple_match_to_of_match_generates_prereqs]\n\t\tfrom u have ple: \"fst (sports r) \\<le> snd (sports r)\" \"fst (dports r) \\<le> snd (dports r)\" by force+\n\t\tshow eg: \"?gr \\<in> set (simple_match_to_of_match r ifs)\"\n\t\t\tunfolding simple_match_to_of_match_def\n\t\t\tunfolding custom_simpset\n\t\t\tunfolding smtoms_eq_hlp\n\t\t\tproof(intro bexI, (intro conjI; ((rule refl)?)), goal_cases)\n\t\t\t\tcase 2 thus ?case using ple(2) di\n\t\t\t\t\tapply(simp add: pfxm_mask_def prefix_match_dtor_def Set.image_iff \n\t\t\t\t\t           split: option.splits prod.splits uncurry_splits)\n\t\t\t\t\tapply(erule bexI[rotated])\n\t\t\t\t\tapply(simp split: prefix_match.splits)\n\t\t\t\tdone\n\t\t\tnext\n\t\t\t\tcase 3 thus ?case using ple(1) si\n\t\t\t\t\tapply(simp add: pfxm_mask_def prefix_match_dtor_def Set.image_iff \n\t\t\t\t\t           split: option.splits prod.splits uncurry_splits)\n\t\t\t\t\tapply(erule bexI[rotated])\n\t\t\t\t\tapply(simp split: prefix_match.splits)\n\t\t\t\tdone\n\t\t\tnext\n\t\t\t\tcase 4 thus ?case\n\t\t\t\t  using u ii by(clarsimp simp: set_maps split: if_splits)\n\t\t\tnext\n\t\t\t\tcase 1 thus ?case using ii u by simp_all (metis match_proto.elims(2))  \n\t\t\tqed\n\t\thave dpm: \"di = Some (PrefixMatch x1 x2) \\<Longrightarrow> p_dport p && ~~ mask (16 - x2) = x1\" for x1 x2\n    proof -\n      have *: \"di = Some (PrefixMatch x1 x2) \\<Longrightarrow> prefix_match_semantics (the di) (p_dport p) \\<Longrightarrow> p_dport p && ~~ mask (16 - x2) = x1\"\n        by(clarsimp simp: prefix_match_semantics_def pfxm_mask_def word_bw_comms;fail)\n      have **: \"pfx \\<in> set (wordinterval_CIDR_split_prefixmatch ra) \\<Longrightarrow> prefix_match_semantics pfx a = (a \\<in> prefix_to_wordset pfx)\" for pfx ra and a :: \"16 word\"\n        by (fact prefix_match_semantics_wordset[OF wordinterval_CIDR_split_prefixmatch_all_valid_Ball[THEN bspec, THEN conjunct1]])\n      have \"\\<lbrakk>di = Some (PrefixMatch x1 x2); p_dport p \\<in> prefix_to_wordset (PrefixMatch x1 x2); PrefixMatch x1 x2 \\<in> set (wordinterval_CIDR_split_prefixmatch (uncurry WordInterval (dports r)))\\<rbrakk>\n             \\<Longrightarrow> p_dport p && ~~ mask (16 - x2) = x1\"\n      using di(1,2)\n        using * ** by auto\n      thus \"di = Some (PrefixMatch x1 x2) \\<Longrightarrow> p_dport p && ~~ mask (16 - x2) = x1\"  using di(1,2) by auto\n    qed\n\t\thave spm: \"si = Some (PrefixMatch x1 x2) \\<Longrightarrow> p_sport p && ~~ mask (16 - x2) = x1\" for x1 x2\n    using si\n    proof -\n      have *: \"si = Some (PrefixMatch x1 x2) \\<Longrightarrow> prefix_match_semantics (the si) (p_sport p) \\<Longrightarrow> p_sport p && ~~ mask (16 - x2) = x1\"\n        by(clarsimp simp: prefix_match_semantics_def pfxm_mask_def word_bw_comms;fail)\n      have **: \"pfx \\<in> set (wordinterval_CIDR_split_prefixmatch ra) \\<Longrightarrow> prefix_match_semantics pfx a = (a \\<in> prefix_to_wordset pfx)\" for pfx ra and a :: \"16 word\"\n        by (fact prefix_match_semantics_wordset[OF wordinterval_CIDR_split_prefixmatch_all_valid_Ball[THEN bspec, THEN conjunct1]])\n      have \"\\<lbrakk>si = Some (PrefixMatch x1 x2); p_sport p \\<in> prefix_to_wordset (PrefixMatch x1 x2); PrefixMatch x1 x2 \\<in> set (wordinterval_CIDR_split_prefixmatch (uncurry WordInterval (sports r)))\\<rbrakk>\n             \\<Longrightarrow> p_sport p && ~~ mask (16 - x2) = x1\"\n      using si(1,2)\n        using * ** by auto\n      thus \"si = Some (PrefixMatch x1 x2) \\<Longrightarrow> p_sport p && ~~ mask (16 - x2) = x1\"  using si(1,2) by auto\n    qed\n\t\tshow \"OF_match_fields ?gr p = Some True\"\n\t\tunfolding of_safe_unsafe_match_eq[OF simple_match_to_of_match_generates_prereqs[OF mv eg]]\n\t\t  by(cases si; cases di)\n        (simp_all\n\t\t\t\t\tadd: simple_match_to_of_match_single_def OF_match_fields_unsafe_def spm\n\t\t\t\t\t     option2set_def u ippkt prefix_match_dtor_def toprefixmatch_def dpm\n\t\t\t\t\t     simple_match_dst_alt[OF mv, symmetric] simple_match_src_alt[OF mv, symmetric]\n\t\t\t\t\tsplit: prefix_match.splits)\n\tqed\nqed\n\nlemma prefix_match_00[simp,intro!]: \"prefix_match_semantics (PrefixMatch 0 0) p\"\n  by (simp add: valid_prefix_def zero_prefix_match_all)\n\nlemma simple_match_to_of_matchD:\n\tassumes eg: \"gr \\<in> set (simple_match_to_of_match r ifs)\"\n\tassumes mo: \"OF_match_fields gr p = Some True\"\n\tassumes me: \"match_iface (oiface r) (p_oiface p)\"\n\tassumes mv: \"simple_match_valid r\"\n\tshows \"simple_matches r p\"\nproof -\n\tfrom mv have validpfx: \n\t\t\"valid_prefix (uncurry PrefixMatch (src r))\" \"valid_prefix (uncurry PrefixMatch (dst r))\"\n\t\t\"\\<And>pm. toprefixmatch (src r) = Some pm \\<Longrightarrow> valid_prefix pm\"\n\t\t\"\\<And>pm. toprefixmatch (dst r) = Some pm \\<Longrightarrow> valid_prefix pm\"\n\t\tunfolding simple_match_valid_def valid_prefix_fw_def toprefixmatch_def \n\t\t  by(simp_all split: uncurry_splits if_splits)\n\tfrom mo have mo: \"OF_match_fields_unsafe gr p\" \n\t\tunfolding of_safe_unsafe_match_eq[OF simple_match_to_of_match_generates_prereqs[OF mv eg]]\n\t\tby simp\n\tnote this[unfolded OF_match_fields_unsafe_def]\n\tnote eg[unfolded simple_match_to_of_match_def simple_match_to_of_match_single_def  custom_simpset option2set_def]\n\tthen guess x ..\tmoreover from this(2) guess xa ..\tmoreover from this(2) guess xb ..\n\tnote xx = calculation(1,3) this\n\n  { fix a b xc xa\n      fix pp :: \"16 word\"\n\t  have \"\\<lbrakk>pp && ~~ pfxm_mask xc = pfxm_prefix xc\\<rbrakk>\n              \\<Longrightarrow> prefix_match_semantics xc (pp)\" for xc\n      by(simp add: prefix_match_semantics_def word_bw_comms;fail)\n    moreover have \"pp \\<in> wordinterval_to_set (WordInterval a b) \\<Longrightarrow> a \\<le> pp \\<and> pp \\<le> b\" by simp\n    moreover have \"xc \\<in> set (wordinterval_CIDR_split_prefixmatch (WordInterval a b)) \\<Longrightarrow> pp \\<in> prefix_to_wordset xc  \\<Longrightarrow> pp \\<in> wordinterval_to_set (WordInterval a b)\"\n\t\t\tby(subst wordinterval_CIDR_split_prefixmatch) blast\n\t  moreover have \"\\<lbrakk>xc \\<in> set (wordinterval_CIDR_split_prefixmatch (WordInterval a b)); xa = Some (pfxm_prefix xc, ~~ pfxm_mask xc); prefix_match_semantics xc (pp)\\<rbrakk> \\<Longrightarrow> pp \\<in> prefix_to_wordset xc\"\n\t\t\tapply(subst(asm)(1) prefix_match_semantics_wordset)\n\t\t\tapply(erule wordinterval_CIDR_split_prefixmatch_all_valid_Ball[THEN bspec, THEN conjunct1];fail)\n\t\t\tapply assumption\n\t  done\n\t  ultimately have \"\\<lbrakk>xc \\<in> set (wordinterval_CIDR_split_prefixmatch (WordInterval a b)); xa = Some (pfxm_prefix xc, ~~ pfxm_mask xc);\n               pp && ~~ pfxm_mask xc = pfxm_prefix xc\\<rbrakk>\n              \\<Longrightarrow> a \\<le> pp \\<and> pp \\<le> b\"\n     by metis\n\t} note l4port_logic = this\n\n\tshow ?thesis unfolding simple_matches.simps\n\tproof(unfold and_assoc, (rule)+)\n\t\tshow \"match_iface (iiface r) (p_iiface p)\"\n\t\t\tapply(cases \"iiface r = ifaceAny\")\n\t\t\t apply (simp add: match_ifaceAny) \n\t\t\tusing xx(1) mo unfolding xx(4) OF_match_fields_unsafe_def\n\t\t\tapply(simp only: if_False set_maps UN_iff)\n\t\t\tapply(clarify)\n\t\t\tapply(rename_tac a; subgoal_tac \"match_iface (iiface r) a\")\n\t\t\t apply(clarsimp simp add: option2set_def;fail)\n\t\t\tapply(rule ccontr,simp;fail)\n\t\tdone\n\tnext\n\t\tshow \"match_iface (oiface r) (p_oiface p)\" using me .\n\tnext\n\t\tshow \"simple_match_ip (src r) (p_src p)\"\n\t\t\tusing mo unfolding xx(4) OF_match_fields_unsafe_def toprefixmatch_def\n\t\t\tby(clarsimp\n\t\t\t  simp add: simple_packet_unext_def option2set_def validpfx simple_match_src_alt[OF mv] toprefixmatch_def \n\t\t\t  split: if_splits)\n\tnext\n\t\tshow \"simple_match_ip (dst r) (p_dst p)\"\n\t\t\tusing mo unfolding xx(4) OF_match_fields_unsafe_def toprefixmatch_def\n\t\t\tby(clarsimp\n\t\t\t  simp add: simple_packet_unext_def option2set_def validpfx simple_match_dst_alt[OF mv] toprefixmatch_def \n\t\t\t  split: if_splits)\n \tnext\n\t\tshow \"match_proto (proto r) (p_proto p)\"\n\t\t\tusing mo unfolding xx(4) OF_match_fields_unsafe_def\n\t\t\tusing xx(1) by(clarsimp \n\t\t\t\tsimp add: singleton_iff simple_packet_unext_def option2set_def prefix_match_semantics_simple_match ball_Un \n\t\t\t\tsplit: if_splits protocol.splits)\n\tnext\n\t\tshow \"simple_match_port (sports r) (p_sport p)\"\n\t\t\tusing mo xx(2) unfolding xx(4) OF_match_fields_unsafe_def\n\t\t\tby(cases \"sports r\") (clarsimp simp add: l4port_logic simple_packet_unext_def option2set_def prefix_match_semantics_simple_match split: if_splits)\n\tnext\n\t\tshow \"simple_match_port (dports r) (p_dport p)\" \n\t\t  using mo xx(3) unfolding xx(4) OF_match_fields_unsafe_def\n\t\t\tby(cases \"dports r\") (clarsimp simp add: l4port_logic simple_packet_unext_def option2set_def prefix_match_semantics_simple_match split: if_splits)\n    qed\nqed\n\nprimrec annotate_rlen where\n\"annotate_rlen [] = []\" |\n\"annotate_rlen (a#as) = (length as, a) # annotate_rlen as\"\nlemma \"annotate_rlen ''asdf'' = [(3, CHR ''a''), (2, CHR ''s''), (1, CHR ''d''), (0, CHR ''f'')]\" by simp\n\nlemma fst_annotate_rlen_le: \"(k, a) \\<in> set (annotate_rlen l) \\<Longrightarrow> k < length l\"\n\tby(induction l arbitrary: k; simp; force)\n\nlemma distinct_fst_annotate_rlen: \"distinct (map fst (annotate_rlen l))\"\n\tusing fst_annotate_rlen_le by(induction l) (simp, fastforce)\nlemma distinct_annotate_rlen: \"distinct (annotate_rlen l)\"\n\tusing distinct_fst_annotate_rlen unfolding distinct_map by blast\nlemma in_annotate_rlen: \"(a,x) \\<in> set (annotate_rlen l) \\<Longrightarrow> x \\<in> set l\" \n  by(induction l) (simp_all, blast)\nlemma map_snd_annotate_rlen: \"map snd (annotate_rlen l) = l\"\n  by(induction l) simp_all\nlemma \"sorted_descending (map fst (annotate_rlen l))\"\n  by(induction l; clarsimp) (force dest: fst_annotate_rlen_le)\nlemma \"annotate_rlen l = zip (rev [0..<length l]) l\"\n  by(induction l; simp) (* It would probably have been better to just use the zip, but oh well\\<dots> *)\n\nprimrec annotate_rlen_code where\n\"annotate_rlen_code [] = (0,[])\" |\n\"annotate_rlen_code (a#as) = (case annotate_rlen_code as of (r,aas) \\<Rightarrow> (Suc r, (r, a) # aas))\"\nlemma annotate_rlen_len: \"fst (annotate_rlen_code r) = length r\"\nby(induction r) (clarsimp split: prod.splits)+\nlemma annotate_rlen_code[code]: \"annotate_rlen s = snd (annotate_rlen_code s)\"\nproof(induction s)\n  case (Cons s ss) thus ?case using annotate_rlen_len[of ss] by(clarsimp split: prod.split)\nqed simp\n\nlemma suc2plus_inj_on: \"inj_on (of_nat :: nat \\<Rightarrow> ('l :: len) word) {0..unat (max_word :: 'l word)}\"\nproof(rule inj_onI)\n   let ?mmw = \"(max_word :: 'l word)\"\n   let ?mstp = \"(of_nat :: nat \\<Rightarrow> 'l word)\"\n   fix x y :: nat\n   assume \"x \\<in> {0..unat ?mmw}\" \"y \\<in> {0..unat ?mmw}\"\n   hence se: \"x \\<le> unat ?mmw\" \"y \\<le> unat ?mmw\" by simp_all\n   assume eq: \"?mstp x = ?mstp y\"\n   note f = le_unat_uoi[OF se(1)] le_unat_uoi[OF se(2)]\n   show \"x = y\" using eq le_unat_uoi se by metis\nqed\n\nlemma distinct_of_nat_list: (* TODO: Move to CaesarWordLemmaBucket *)\n\t\"distinct l \\<Longrightarrow> \\<forall>e \\<in> set l. e \\<le> unat (max_word :: ('l::len) word) \\<Longrightarrow> distinct (map (of_nat :: nat \\<Rightarrow> 'l word) l)\"\nproof(induction l)\n\tlet ?mmw = \"(max_word :: 'l word)\"\n\tlet ?mstp = \"(of_nat :: nat \\<Rightarrow> 'l word)\"\n\tcase (Cons a as)\n\thave \"distinct as\" \"\\<forall>e\\<in>set as. e \\<le> unat ?mmw\" using Cons.prems by simp_all \n\tnote mIH = Cons.IH[OF this]\n\tmoreover have \"?mstp a \\<notin> ?mstp ` set as\"\n\tproof \n\t\thave representable_set: \"set as \\<subseteq> {0..unat ?mmw}\" using \\<open>\\<forall>e\\<in>set (a # as). e \\<le> unat max_word\\<close> by fastforce\n\t\thave a_reprbl: \"a \\<in> {0..unat ?mmw}\" using \\<open>\\<forall>e\\<in>set (a # as). e \\<le> unat max_word\\<close> by simp\n\t\tassume \"?mstp a \\<in> ?mstp ` set as\"\n\t\twith inj_on_image_mem_iff[OF suc2plus_inj_on a_reprbl representable_set]\n\t\thave \"a \\<in> set as\" by simp\n\t\twith \\<open>distinct (a # as)\\<close> show False by simp\n\tqed\n\tultimately show ?case by simp\nqed simp\n\nlemma annotate_first_le_hlp:\n\t\"length l < unat (max_word :: ('l :: len) word) \\<Longrightarrow> \\<forall>e\\<in>set (map fst (annotate_rlen l)). e \\<le> unat (max_word :: 'l word)\"\n\tby(clarsimp) (meson fst_annotate_rlen_le less_trans nat_less_le)\nlemmas distinct_of_prio_hlp = distinct_of_nat_list[OF distinct_fst_annotate_rlen annotate_first_le_hlp]\n(* don't need these right now, but maybe later? *)\n                                                  \nlemma fst_annotate_rlen: \"map fst (annotate_rlen l) = rev [0..<length l]\"\nby(induction l) (simp_all)\n\nlemma sorted_word_upt:\n  defines[simp]: \"won \\<equiv> (of_nat :: nat \\<Rightarrow> ('l :: len) word)\"\n  assumes \"length l \\<le> unat (max_word :: 'l word)\"\n  shows \"sorted_descending (map won (rev [0..<Suc (length l)]))\" \nusing assms\n  by(induction l rule: rev_induct;clarsimp)\n    (metis (mono_tags, hide_lams) le_SucI le_unat_uoi of_nat_Suc order_refl word_le_nat_alt)\n    (* This proof is kind of ugly. In case it breaks unfixably, go back to rev a9c4927 and get word_upto.\n       The lemmas on word_upto can be used to shows this trivially. *)\n\nlemma sorted_annotated:\n\tassumes \"length l \\<le> unat (max_word :: ('l :: len) word)\"\n\tshows \"sorted_descending (map fst (map (apfst (of_nat :: nat \\<Rightarrow> 'l word)) (annotate_rlen l)))\"\nproof -\n\tlet ?won = \"(of_nat :: nat \\<Rightarrow> 'l word)\"\n\thave \"sorted_descending (map ?won (rev [0..<Suc (length l)]))\" \n\t\tusing sorted_word_upt[OF assms] .\n\thence \"sorted_descending (map ?won (map fst (annotate_rlen l)))\" by(simp add: fst_annotate_rlen)\n\tthus \"sorted_descending (map fst (map (apfst ?won) (annotate_rlen l)))\" by simp\nqed\n\ntext\\<open>l3 device to l2 forwarding\\<close>\ndefinition \"lr_of_tran_s3 ifs ard = (\n\t[(p, b, case a of simple_action.Accept \\<Rightarrow> [Forward c] | simple_action.Drop \\<Rightarrow> []).\n\t\t(p,r,(c,a)) \\<leftarrow> ard, b \\<leftarrow> simple_match_to_of_match r ifs])\"\n\ndefinition \"oif_ne_iif_p1 ifs \\<equiv> [(simple_match_any\\<lparr>oiface := Iface oi, iiface := Iface i_i\\<rparr>, simple_action.Accept). oi \\<leftarrow> ifs, i_i \\<leftarrow> ifs, oi \\<noteq> i_i]\"\ndefinition \"oif_ne_iif_p2 ifs = [(simple_match_any\\<lparr>oiface := Iface i, iiface := Iface i\\<rparr>, simple_action.Drop). i \\<leftarrow> ifs]\"\ndefinition \"oif_ne_iif ifs = oif_ne_iif_p2 ifs @ oif_ne_iif_p1 ifs\" (* order irrelephant *)\n(*value \"oif_ne_iif [''a'', ''b'']\"*)\n(* I first tried something like \"oif_ne_iif ifs \\<equiv> [(simple_match_any\\<lparr>oiface := Iface oi, iiface := Iface ii\\<rparr>, if oi = ii then simple_action.Drop else simple_action.Accept). oi \\<leftarrow> ifs, ii \\<leftarrow> ifs]\", \n   but making the statement I wanted with that was really tricky. Much easier to have the second element constant and do it separately. *)\ndefinition \"lr_of_tran_s4 ard ifs \\<equiv> generalized_fw_join ard (oif_ne_iif ifs)\"\n\ndefinition \"lr_of_tran_s1 rt = [(route2match r, output_iface (routing_action r)). r \\<leftarrow> rt]\"\n\ndefinition \"lr_of_tran_fbs rt fw ifs \\<equiv> let\n\tgfw = map simple_rule_dtor fw; (* generalized simple fw, hopefully for FORWARD *)\n\tfrt = lr_of_tran_s1 rt; (* rt as fw *)\n\tprd = generalized_fw_join frt gfw\n\tin prd\n\"\n\ndefinition \"pack_OF_entries ifs ard \\<equiv> (map (split3 OFEntry) (lr_of_tran_s3 ifs ard))\"\ndefinition \"no_oif_match \\<equiv> list_all (\\<lambda>m. oiface (match_sel m) = ifaceAny)\"\n\ndefinition \"lr_of_tran rt fw ifs \\<equiv> \n  if \\<not> (no_oif_match fw \\<and> has_default_policy fw \\<and> simple_fw_valid fw\t\\<and> valid_prefixes rt \\<and> has_default_route rt \\<and> distinct ifs)\n    then Inl ''Error in creating OpenFlow table: prerequisites not satisifed''\n    else (\n  let\tnrd = lr_of_tran_fbs rt fw ifs;\n\tard = map (apfst of_nat) (annotate_rlen nrd) (* give them a priority *)\n\tin\n\tif length nrd < unat (max_word :: 16 word)\n\tthen Inr (pack_OF_entries ifs ard)\n\telse Inl ''Error in creating OpenFlow table: priority number space exhausted'')\n\"\n\ndefinition \"is_iface_name i \\<equiv> i \\<noteq> [] \\<and> \\<not>Iface.iface_name_is_wildcard i\"\ndefinition \"is_iface_list ifs \\<equiv> distinct ifs \\<and> list_all is_iface_name ifs\"\n\nlemma max_16_word_max[simp]: \"(a :: 16 word) \\<le> 0xffff\"\nproof -\n\thave ffff: \"0xffff = word_of_int (2 ^ 16 - 1)\" by fastforce\n\tshow ?thesis using max_word_max[of a] unfolding max_word_def ffff by fastforce\nqed\n\nlemma replicate_FT_hlp: \"x \\<le> 16 \\<and> y \\<le> 16 \\<Longrightarrow> replicate (16 - x) False @ replicate x True = replicate (16 - y) False @ replicate y True \\<Longrightarrow> x = y\"\nproof -\n\tlet ?ns = \"{0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16}\"\n\tassume \"x \\<le> 16 \\<and> y \\<le> 16\"\n\thence \"x \\<in> ?ns\" \"y \\<in> ?ns\" by(simp; presburger)+\n\tmoreover assume \"replicate (16 - x) False @ replicate x True = replicate (16 - y) False @ replicate y True\"\n\tultimately show \"x = y\" by simp (elim disjE; simp_all) (* that's only 289 subgoals after the elim *)\nqed\n\nlemma mask_inj_hlp1: \"inj_on (mask :: nat \\<Rightarrow> 16 word) {0..16}\"\nproof(intro inj_onI, goal_cases)\n  case (1 x y)\n  from 1(3)\n  have oe: \"of_bl (replicate (16 - x) False @ replicate x True) = (of_bl (replicate (16 - y) False @ replicate y True) :: 16 word)\"\n         unfolding mask_bl of_bl_rep_False .\n  have \"\\<And>z. z \\<le> 16 \\<Longrightarrow> length (replicate (16 - z) False @ replicate z True) = 16\" by auto\n  with 1(1,2)\n  have ps: \"replicate (16 - x) False @ replicate x True \\<in> {bl. length bl = len_of TYPE(16)}\" \" replicate (16 - y) False @ replicate y True \\<in> {bl. length bl = len_of TYPE(16)}\" by simp_all\n  from inj_onD[OF word_bl.Abs_inj_on, OF oe ps]\n  show ?case using 1(1,2) by(fastforce intro: replicate_FT_hlp)\nqed\n\nlemma distinct_simple_match_to_of_match_portlist_hlp: \n  fixes ps :: \"(16 word \\<times> 16 word)\"\n  shows \"distinct ifs \\<Longrightarrow>\n    distinct\n     (if fst ps = 0 \\<and> snd ps = max_word then [None]\n      else if fst ps \\<le> snd ps\n           then map (Some \\<circ> (\\<lambda>pfx. (pfxm_prefix pfx, ~~ pfxm_mask pfx)))\n                 (wordinterval_CIDR_split_prefixmatch (WordInterval (fst ps) (snd ps)))\n           else [])\"\nproof -\n  assume di: \"distinct ifs\"\n  { def wis \\<equiv> \"set (wordinterval_CIDR_split_prefixmatch (WordInterval (fst ps) (snd ps)))\"\n    fix x y :: \"16 prefix_match\"\n    obtain xm xn ym yn where xyd[simp]: \"x = PrefixMatch xm xn\" \"y = PrefixMatch ym yn\" by(cases x; cases y)\n    assume iw: \"x \\<in> wis\" \"y \\<in> wis\" and et: \"(pfxm_prefix x, ~~ pfxm_mask x) = (pfxm_prefix y, ~~ pfxm_mask y)\"\n    hence le16: \"xn \\<le> 16\" \"yn \\<le> 16\" unfolding wis_def using wordinterval_CIDR_split_prefixmatch_all_valid_Ball[unfolded Ball_def, THEN spec, THEN mp] by force+\n    with et have \"16 - xn = 16 - yn\" unfolding pfxm_mask_def by(auto intro: mask_inj_hlp1[THEN inj_onD])\n    hence \"x = y\" using et le16 using diff_diff_cancel by simp\n  } note * = this\n  show ?thesis \n    apply(clarsimp simp add: smtoms_eq_hlp distinct_map wordinterval_CIDR_split_distinct)\n    apply(subst comp_inj_on_iff[symmetric]; intro inj_onI)\n  using * by simp_all\nqed\n\nlemma distinct_simple_match_to_of_match: \"distinct ifs \\<Longrightarrow> distinct (simple_match_to_of_match m ifs)\"\n  apply(unfold simple_match_to_of_match_def Let_def)\n  apply(rule distinct_3lcomprI)\n  subgoal by(induction ifs; clarsimp)\n  subgoal by(fact distinct_simple_match_to_of_match_portlist_hlp)\n  subgoal by(fact distinct_simple_match_to_of_match_portlist_hlp)\n  subgoal by(simp_all add: smtoms_eq_hlp)\ndone\n\nlemma inj_inj_on: \"inj F \\<Longrightarrow> inj_on F A\" using subset_inj_on by auto (* TODO: include Word_Lib *)\n\nlemma no_overlaps_lroft_hlp2: \"distinct (map fst amr) \\<Longrightarrow> (\\<And>r. distinct (fm r)) \\<Longrightarrow>\n    distinct (concat (map (\\<lambda>(p, r, c, a). map (\\<lambda>b. (p, b, fs a c)) (fm r)) amr))\"\n  by(induction amr; force intro: injI inj_onI simp add: distinct_map split: prod.splits)\n\nlemma distinct_lroft_s3: \"\\<lbrakk>distinct (map fst amr); distinct ifs\\<rbrakk> \\<Longrightarrow> distinct (lr_of_tran_s3 ifs amr)\"\n  unfolding lr_of_tran_s3_def\n  by(erule no_overlaps_lroft_hlp2, simp add: distinct_simple_match_to_of_match)\n\nlemma no_overlaps_lroft_hlp3: \"distinct (map fst amr) \\<Longrightarrow>\n(aa, ab, ac) \\<in> set (lr_of_tran_s3 ifs amr) \\<Longrightarrow> (ba, bb, bc) \\<in> set (lr_of_tran_s3 ifs amr) \\<Longrightarrow>\nac \\<noteq> bc \\<Longrightarrow> aa \\<noteq> ba\"\n  apply(unfold lr_of_tran_s3_def)\n  apply(clarsimp)\n  apply(clarsimp split: simple_action.splits)\n    apply(metis map_of_eq_Some_iff old.prod.inject option.inject)\n   apply(metis map_of_eq_Some_iff old.prod.inject option.inject simple_action.distinct(2))+\ndone\n\nlemma no_overlaps_lroft_s3_hlp_hlp: (* I hlps *)\n  \"\\<lbrakk>distinct (map fst amr); OF_match_fields_unsafe ab p; ab \\<noteq> ad \\<or> ba \\<noteq> bb; OF_match_fields_unsafe ad p;\n        (ac, ab, ba) \\<in> set (lr_of_tran_s3 ifs amr); (ac, ad, bb) \\<in> set (lr_of_tran_s3 ifs amr)\\<rbrakk>\n       \\<Longrightarrow> False\"\nproof(elim disjE, goal_cases)\n  case 1\n  have 4: \"\\<lbrakk>distinct (map fst amr);  (ac, ab, x1, x2) \\<in> set amr; (ac, bb, x4, x5) \\<in> set amr; ab \\<noteq> bb\\<rbrakk>\n       \\<Longrightarrow> False\" for ab x1 x2 bb x4 x5\n       by (meson distinct_map_fstD old.prod.inject)\n  have conjunctSomeProtoAnyD: \"Some ProtoAny = simple_proto_conjunct a (Proto b) \\<Longrightarrow> False\" for a b\n    using conjunctProtoD by force\n  have 5:\n       \"\\<lbrakk>OF_match_fields_unsafe am p; OF_match_fields_unsafe bm p; am \\<noteq> bm; \n        am \\<in> set (simple_match_to_of_match ab ifs); bm \\<in> set (simple_match_to_of_match bb ifs); \\<not> ab \\<noteq> bb\\<rbrakk>\n       \\<Longrightarrow> False\" for ab bb am bm\n      by(clarify | unfold\n         simple_match_to_of_match_def smtoms_eq_hlp Let_def set_concat set_map de_Morgan_conj not_False_eq_True)+\n        (auto dest: conjunctSomeProtoAnyD cidrsplit_no_overlaps\n\t            simp add: OF_match_fields_unsafe_def simple_match_to_of_match_single_def option2set_def comp_def\n\t            split: if_splits\n\t            cong: smtoms_eq_hlp) (*1min*)\n  from 1 show ?case\n  using 4 5 by(clarsimp simp add: lr_of_tran_s3_def) blast\nqed(metis no_overlaps_lroft_hlp3)\n\n\nlemma no_overlaps_lroft_s3_hlp: \"distinct (map fst amr) \\<Longrightarrow> distinct ifs \\<Longrightarrow> \nno_overlaps OF_match_fields_unsafe (map (split3 OFEntry) (lr_of_tran_s3 ifs amr))\"\n  apply(rule no_overlapsI[rotated])\n  apply(subst distinct_map, rule conjI)\n  subgoal by(erule (1) distinct_lroft_s3)\n  subgoal\n    apply(rule inj_inj_on)\n    apply(rule injI)\n    apply(rename_tac x y, case_tac x, case_tac y)\n    apply(simp add: split3_def;fail)\n  done\n  subgoal\n    apply(unfold check_no_overlap_def)\n    apply(clarify)\n    apply(unfold set_map)\n    apply(clarify)\n    apply(unfold split3_def prod.simps flow_entry_match.simps flow_entry_match.sel de_Morgan_conj)\n    apply(clarsimp simp only:)\n    apply(erule (1) no_overlaps_lroft_s3_hlp_hlp)\n       apply simp\n      apply assumption\n     apply assumption\n    apply simp\n  done\ndone\n\nlemma lr_of_tran_no_overlaps: assumes \"distinct ifs\" shows \"Inr t = (lr_of_tran rt fw ifs) \\<Longrightarrow> no_overlaps OF_match_fields_unsafe t\"\n\tapply(unfold lr_of_tran_def Let_def pack_OF_entries_def)\n\tapply(simp split: if_splits)\n\tapply(thin_tac \"t = _\")\n\tapply(drule distinct_of_prio_hlp)\n\tapply(rule no_overlaps_lroft_s3_hlp[rotated])\n\tsubgoal by(simp add: assms)\n\tsubgoal by(simp add: o_assoc)\ndone\n\nlemma sorted_lr_of_tran_s3_hlp: \"\\<forall>x\\<in>set f. fst x \\<le> a \\<Longrightarrow> b \\<in> set (lr_of_tran_s3 s f) \\<Longrightarrow> fst b \\<le> a\" \n\tby(auto simp add: lr_of_tran_s3_def)\n\nlemma lr_of_tran_s3_Cons: \"lr_of_tran_s3 ifs (a#ard) = (\n\t[(p, b, case a of simple_action.Accept \\<Rightarrow> [Forward c] | simple_action.Drop \\<Rightarrow> []).\n\t\t(p,r,(c,a)) \\<leftarrow> [a], b \\<leftarrow> simple_match_to_of_match r ifs]) @ lr_of_tran_s3 ifs ard\"\n\tby(clarsimp simp: lr_of_tran_s3_def)\n\nlemma sorted_lr_of_tran_s3: \"sorted_descending (map fst f) \\<Longrightarrow> sorted_descending (map fst (lr_of_tran_s3 s f))\"\n\tapply(induction f)\n\t subgoal by(simp add: lr_of_tran_s3_def)\n\tapply(clarsimp simp: lr_of_tran_s3_Cons map_concat comp_def)\n\tapply(unfold sorted_descending_append)\n\tapply(simp add: sorted_descending_alt rev_map sorted_lr_of_tran_s3_hlp sorted_const)\ndone\n\nlemma sorted_lr_of_tran_hlp: \"(ofe_prio \\<circ> split3 OFEntry) = fst\" by(simp add: fun_eq_iff comp_def split3_def)\n\nlemma lr_of_tran_sorted_descending: \"Inr r = lr_of_tran rt fw ifs \\<Longrightarrow> sorted_descending (map ofe_prio r)\"\n\tapply(unfold lr_of_tran_def Let_def)\n\tapply(simp split: if_splits)\n\tapply(thin_tac \"r = _\")\n\tapply(unfold sorted_lr_of_tran_hlp pack_OF_entries_def split3_def[abs_def] fun_app_def map_map comp_def prod.case_distrib)\n\tapply(simp add: fst_def[symmetric])\n\tapply(rule sorted_lr_of_tran_s3)\n\tapply(drule sorted_annotated[OF less_or_eq_imp_le, OF disjI1])\n\tapply(simp add: o_assoc)\ndone\n\n\n\nlemma route2match_correct: \"valid_prefix (routing_match a) \\<Longrightarrow> prefix_match_semantics (routing_match a) (p_dst p) \\<longleftrightarrow> simple_matches (route2match a) (p)\"\nby(simp add: route2match_def simple_matches.simps match_ifaceAny match_iface_refl ipset_from_cidr_0 prefix_match_semantics_ipset_from_netmask2)\n\nlemma s1_correct: \"valid_prefixes rt \\<Longrightarrow> has_default_route (rt::('i::len) prefix_routing) \\<Longrightarrow> \n  \\<exists>rm ra. generalized_sfw (lr_of_tran_s1 rt) p = Some (rm,ra) \\<and> ra = output_iface (routing_table_semantics rt (p_dst p))\"\n\tapply(induction rt)\n\t apply(simp;fail)\n\tapply(drule valid_prefixes_split)\n\tapply(clarsimp)\n\tapply(erule disjE)\n\tsubgoal for a rt\n\t apply(case_tac a)\n\t apply(rename_tac routing_m metric routing_action)\n\t apply(case_tac routing_m)\n\t apply(simp add: valid_prefix_def pfxm_mask_def prefix_match_semantics_def generalized_sfw_def \n\t       lr_of_tran_s1_def route2match_def simple_matches.simps match_ifaceAny match_iface_refl ipset_from_cidr_0\n\t       max_word_mask[where 'a = 'i, symmetric, simplified])\n\tdone\n\tsubgoal\n    apply(rule conjI)\n     apply(simp add: generalized_sfw_def lr_of_tran_s1_def route2match_correct;fail)\n    apply(simp add: route2match_def simple_matches.simps prefix_match_semantics_ipset_from_netmask2 \n                    lr_of_tran_s1_split generalized_sfw_simps)\n  done\ndone\n\ndefinition \"to_OF_action a \\<equiv> (case a of (p,d) \\<Rightarrow> (case d of simple_action.Accept \\<Rightarrow> [Forward p] | simple_action.Drop \\<Rightarrow> []))\"\ndefinition \"from_OF_action a = (case a of [] \\<Rightarrow> ('''',simple_action.Drop) | [Forward p] \\<Rightarrow> (p, simple_action.Accept))\"\n\nlemma OF_match_linear_not_noD: \"OF_match_linear \\<gamma> oms p \\<noteq> NoAction \\<Longrightarrow> \\<exists>ome. ome \\<in> set oms \\<and> \\<gamma> (ofe_fields ome) p\"\n\tapply(induction oms)\n\t apply(simp)\n\tapply(simp split: if_splits)\n\t apply blast+\ndone\n\nlemma s3_noaction_hlp: \"\\<lbrakk>simple_match_valid ac; \\<not>simple_matches ac p; match_iface (oiface ac) (p_oiface p)\\<rbrakk> \\<Longrightarrow> \nOF_match_linear OF_match_fields_safe (map (\\<lambda>x. split3 OFEntry (x1, x, case ba of simple_action.Accept \\<Rightarrow> [Forward ad] | simple_action.Drop \\<Rightarrow> [])) (simple_match_to_of_match ac ifs)) p = NoAction\"\n  apply(rule ccontr)\n  apply(drule OF_match_linear_not_noD)\n  apply(clarsimp)\n  apply(rename_tac x)\n  apply(subgoal_tac \"all_prerequisites x\")\n   apply(drule simple_match_to_of_matchD)\n      apply(simp add: split3_def)\n      apply(subst(asm) of_match_fields_safe_eq2)\n      apply(simp;fail)+\n  using simple_match_to_of_match_generates_prereqs by blast\n\nlemma s3_correct:\n\tassumes vsfwm: \"list_all simple_match_valid (map (fst \\<circ> snd) ard)\"\n\tassumes ippkt: \"p_l2type p = 0x800\"\n\tassumes iiifs: \"p_iiface p \\<in> set ifs\"\n\tassumes oiifs: \"list_all (\\<lambda>m. oiface (fst (snd m)) = ifaceAny) ard\"\n\tshows \"OF_match_linear OF_match_fields_safe (pack_OF_entries ifs ard) p = Action ao \\<longleftrightarrow> (\\<exists>r af. generalized_sfw (map snd ard) p = (Some (r,af)) \\<and> (if snd af = simple_action.Drop then ao = [] else ao = [Forward (fst af)]))\"\nunfolding pack_OF_entries_def lr_of_tran_s3_def fun_app_def\nusing vsfwm oiifs\n  apply(induction ard)\n   subgoal by(simp add: generalized_sfw_simps)\n  apply simp\n  apply(clarsimp simp add: generalized_sfw_simps split: prod.splits)\n  apply(intro conjI) (* make two subgoals from one *)\n   subgoal for ard x1 ac ad ba\n    apply(clarsimp simp add: OF_match_linear_append split: prod.splits)\n    apply(drule simple_match_to_of_matchI[rotated])\n       apply(rule iiifs)\n      apply(rule ippkt)\n     apply blast\n    apply(clarsimp simp add: comp_def)\n    apply(drule \n       OF_match_linear_match_allsameaction[where\n         \\<gamma>=OF_match_fields_safe and pri = x1 and\n         oms = \"simple_match_to_of_match ac ifs\" and \n         act = \"case ba of simple_action.Accept \\<Rightarrow> [Forward ad] | simple_action.Drop \\<Rightarrow> []\"])\n     apply(unfold OF_match_fields_safe_def comp_def)\n     apply(erule Some_to_the[symmetric];fail)\n    apply(clarsimp)\n    apply(intro iffI)\n    subgoal\n     apply(rule exI[where x = ac])\n     apply(rule exI[where x = ad])\n     apply(rule exI[where x = ba])\n     apply(clarsimp simp: split3_def split: simple_action.splits flowtable_behavior.splits if_splits)\n    done\n    subgoal\n     apply(clarsimp)\n     apply(rename_tac b)\n     apply(case_tac b)\n     apply(simp_all)\n   done\n  done\n  subgoal for ard x1 ac ad ba\n   apply(simp add: OF_match_linear_append OF_match_fields_safe_def comp_def)\n   apply(clarify)\n   apply(subgoal_tac \"OF_match_linear OF_match_fields_safe (map (\\<lambda>x. split3 OFEntry (x1, x, case ba of simple_action.Accept \\<Rightarrow> [Forward ad] | simple_action.Drop \\<Rightarrow> [])) (simple_match_to_of_match ac ifs)) p = NoAction\")\n    apply(simp;fail)\n   apply(erule (1) s3_noaction_hlp)\n   apply(simp add: match_ifaceAny;fail)\n  done\ndone\n\ncontext\n  notes valid_prefix_00[simp, intro!]\nbegin\n  lemma lr_of_tran_s1_valid: \"valid_prefixes rt \\<Longrightarrow> gsfw_valid (lr_of_tran_s1 rt)\"\n    unfolding lr_of_tran_s1_def route2match_def gsfw_valid_def list_all_iff\n    apply(clarsimp simp: simple_match_valid_def valid_prefix_fw_def)\n    apply(intro conjI)\n     apply force\n    apply(simp add: valid_prefixes_alt_def)\n  done\nend\n\nlemma simple_match_valid_fbs_rlen: \"\\<lbrakk>valid_prefixes rt; simple_fw_valid fw; (a, aa, ab, b) \\<in> set (annotate_rlen (lr_of_tran_fbs rt fw ifs))\\<rbrakk> \\<Longrightarrow> simple_match_valid aa\"\nproof(goal_cases)\n  case 1\n  note 1[unfolded lr_of_tran_fbs_def Let_def]\n  have \"gsfw_valid (map simple_rule_dtor fw)\" using gsfw_validI 1 by blast\n  moreover have \"gsfw_valid (lr_of_tran_s1 rt)\" using 1 lr_of_tran_s1_valid by blast\n  ultimately have \"gsfw_valid (generalized_fw_join (lr_of_tran_s1 rt) (map simple_rule_dtor fw))\" using gsfw_join_valid by blast\n  moreover have \"(aa, ab, b) \\<in> set (lr_of_tran_fbs rt fw ifs)\" using 1 using in_annotate_rlen by fast\n  ultimately show ?thesis unfolding lr_of_tran_fbs_def Let_def gsfw_valid_def list_all_iff by fastforce\nqed\n\nlemma simple_match_valid_fbs: \"\\<lbrakk>valid_prefixes rt; simple_fw_valid fw\\<rbrakk> \\<Longrightarrow> list_all simple_match_valid (map fst (lr_of_tran_fbs rt fw ifs))\"\nproof(goal_cases)\n  case 1\n  note 1[unfolded lr_of_tran_fbs_def Let_def]\n  have \"gsfw_valid (map simple_rule_dtor fw)\" using gsfw_validI 1 by blast\n  moreover have \"gsfw_valid (lr_of_tran_s1 rt)\" using 1 lr_of_tran_s1_valid by blast\n  ultimately have \"gsfw_valid (generalized_fw_join (lr_of_tran_s1 rt) (map simple_rule_dtor fw))\" using gsfw_join_valid by blast\n  thus ?thesis unfolding lr_of_tran_fbs_def Let_def gsfw_valid_def list_all_iff by fastforce\nqed\n\nlemma lr_of_tran_prereqs: \"valid_prefixes rt \\<Longrightarrow> simple_fw_valid fw \\<Longrightarrow> lr_of_tran rt fw ifs = Inr oft \\<Longrightarrow>\nlist_all (all_prerequisites \\<circ> ofe_fields) oft\"\nunfolding lr_of_tran_def pack_OF_entries_def lr_of_tran_s3_def Let_def\n  apply(simp add: map_concat comp_def prod.case_distrib split3_def split: if_splits)\n  apply(simp add: list_all_iff)\n  apply(clarsimp)\n  apply(drule simple_match_valid_fbs_rlen[rotated])\n    apply(simp add: list_all_iff;fail)\n   apply(simp add: list_all_iff;fail)\n  apply(rule simple_match_to_of_match_generates_prereqs; assumption)\ndone\n\n(* TODO: move. where? *)\nlemma OF_unsafe_safe_match3_eq: \"\n  list_all (all_prerequisites \\<circ> ofe_fields) oft \\<Longrightarrow>\n  OF_priority_match OF_match_fields_unsafe oft = OF_priority_match OF_match_fields_safe oft\"\nunfolding OF_priority_match_def[abs_def]\nproof(goal_cases)\n  case 1\n  from 1 have \"\\<And>packet. [f\\<leftarrow>oft . OF_match_fields_unsafe (ofe_fields f) packet] = [f\\<leftarrow>oft . OF_match_fields_safe (ofe_fields f) packet]\"\n    apply(clarsimp simp add: list_all_iff of_match_fields_safe_eq) \n  using of_match_fields_safe_eq by(metis (mono_tags, lifting) filter_cong)\n  thus ?case by metis\nqed\n\nlemma OF_unsafe_safe_match_linear_eq: \"\n  list_all (all_prerequisites \\<circ> ofe_fields) oft \\<Longrightarrow>\n  OF_match_linear OF_match_fields_unsafe oft = OF_match_linear OF_match_fields_safe oft\"\nunfolding fun_eq_iff\nby(induction oft) (clarsimp simp add: list_all_iff of_match_fields_safe_eq)+\n\nlemma simple_action_ne[simp]: \n  \"b \\<noteq> simple_action.Accept \\<longleftrightarrow> b = simple_action.Drop\"\n  \"b \\<noteq> simple_action.Drop \\<longleftrightarrow> b = simple_action.Accept\"\nusing simple_action.exhaust by blast+\n\nlemma map_snd_apfst: \"map snd (map (apfst x) l) = map snd l\"\n  unfolding map_map comp_def snd_apfst ..\n\nlemma match_ifaceAny_eq: \"oiface m = ifaceAny \\<Longrightarrow> simple_matches m p = simple_matches m (p\\<lparr>p_oiface := any\\<rparr>)\"\nby(cases m) (simp add: simple_matches.simps match_ifaceAny)\nlemma no_oif_matchD: \"no_oif_match fw \\<Longrightarrow> simple_fw fw p = simple_fw fw (p\\<lparr>p_oiface := any\\<rparr>)\"\n  by(induction fw)\n    (auto simp add: no_oif_match_def simple_fw_alt dest: match_ifaceAny_eq)\n\nlemma lr_of_tran_fbs_acceptD:\n  assumes s1: \"valid_prefixes rt\" \"has_default_route rt\"\n  assumes s2: \"no_oif_match fw\"\n  shows \"generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, simple_action.Accept) \\<Longrightarrow>\n  simple_linux_router_nol12 rt fw p = Some (p\\<lparr>p_oiface := oif\\<rparr>)\"\nproof(goal_cases)\n  case 1\n  note 1[unfolded lr_of_tran_fbs_def Let_def, THEN generalized_fw_joinD]\n  then guess r1 .. then guess r2 .. note r12 = this\n  note s1_correct[OF s1, of p]\n  then guess rm .. then guess ra .. note rmra = this\n  from r12 rmra have oifra: \"oif = ra\" by simp\n  from r12 have sfw: \"simple_fw fw p = Decision FinalAllow\" using simple_fw_iff_generalized_fw_accept by blast\n  note ifupdateirrel = no_oif_matchD[OF s2, where any = \" output_iface (routing_table_semantics rt (p_dst p))\" and p = p, symmetric]\n  show ?case unfolding simple_linux_router_nol12_def by(simp add: Let_def ifupdateirrel sfw oifra rmra split: Option.bind_splits option.splits) \nqed\n\nlemma lr_of_tran_fbs_acceptI:\n  assumes s1: \"valid_prefixes rt\" \"has_default_route rt\"\n  assumes s2: \"no_oif_match fw\" \"has_default_policy fw\"\n  shows \"simple_linux_router_nol12 rt fw p = Some (p\\<lparr>p_oiface := oif\\<rparr>) \\<Longrightarrow>\n  \\<exists>r. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, simple_action.Accept)\"\nproof(goal_cases)\n  from s2 have nud: \"\\<And>p. simple_fw fw p \\<noteq> Undecided\" by (metis has_default_policy state.distinct(1))\n  note ifupdateirrel = no_oif_matchD[OF s2(1), symmetric]\n  case 1\n  from 1 have \"simple_fw fw p = Decision FinalAllow\" by(simp add: simple_linux_router_nol12_def Let_def nud ifupdateirrel split: Option.bind_splits state.splits final_decision.splits)\n  then obtain r where r: \"generalized_sfw (map simple_rule_dtor fw) p = Some (r, simple_action.Accept)\" using simple_fw_iff_generalized_fw_accept by blast\n  have oif_def: \"oif = output_iface (routing_table_semantics rt (p_dst p))\" using 1 by(cases p) (simp add: simple_linux_router_nol12_def Let_def nud ifupdateirrel split: Option.bind_splits state.splits final_decision.splits)\n  note s1_correct[OF s1, of p] then guess rm .. then guess ra .. note rmra = this\n  show ?case unfolding lr_of_tran_fbs_def Let_def\n    apply(rule exI)\n    apply(rule generalized_fw_joinI)\n    unfolding oif_def using rmra apply simp\n    apply(rule r)\n  done\nqed\n\nlemma lr_of_tran_fbs_dropD:\n  assumes s1: \"valid_prefixes rt\" \"has_default_route rt\"\n  assumes s2: \"no_oif_match fw\"\n  shows \"generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, simple_action.Drop) \\<Longrightarrow>\n  simple_linux_router_nol12 rt fw p = None\"\nproof(goal_cases)\n  note ifupdateirrel = no_oif_matchD[OF s2(1), symmetric]\n  case 1\n  from 1[unfolded lr_of_tran_fbs_def Let_def, THEN generalized_fw_joinD]\n  obtain rr fr where \"generalized_sfw (lr_of_tran_s1 rt) p = Some (rr, oif) \\<and>\n          generalized_sfw (map simple_rule_dtor fw) p = Some (fr, simple_action.Drop) \\<and> Some r = simple_match_and rr fr\" by presburger\n  hence fd: \"\\<And>u. simple_fw fw (p\\<lparr>p_oiface := u\\<rparr>) = Decision FinalDeny\" unfolding ifupdateirrel\n  using simple_fw_iff_generalized_fw_drop by blast\n  show ?thesis\n    by(clarsimp simp: simple_linux_router_nol12_def Let_def fd split: Option.bind_splits)\nqed\n\nlemma lr_of_tran_fbs_dropI:\n  assumes s1: \"valid_prefixes rt\" \"has_default_route rt\"\n  assumes s2: \"no_oif_match fw\" \"has_default_policy fw\"\n  shows \"simple_linux_router_nol12 rt fw p = None \\<Longrightarrow>\n  \\<exists>r oif. generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, simple_action.Drop)\"\nproof(goal_cases)\n  from s2 have nud: \"\\<And>p. simple_fw fw p \\<noteq> Undecided\" by (metis has_default_policy state.distinct(1))\n  note ifupdateirrel = no_oif_matchD[OF s2(1), symmetric]\n  case 1\n  from 1 have \"simple_fw fw p = Decision FinalDeny\" by(simp add: simple_linux_router_nol12_def Let_def nud ifupdateirrel split: Option.bind_splits state.splits final_decision.splits)\n  then obtain r where r: \"generalized_sfw (map simple_rule_dtor fw) p = Some (r, simple_action.Drop)\" using simple_fw_iff_generalized_fw_drop by blast\n  note s1_correct[OF s1, of p] then guess rm .. then guess ra .. note rmra = this\n  show ?case unfolding lr_of_tran_fbs_def Let_def\n    apply(rule exI)\n    apply(rule exI[where x = ra])\n    apply(rule generalized_fw_joinI)\n    using rmra apply simp\n    apply(rule r)\n  done\nqed\n\n\nlemma no_oif_match_fbs:\n \"no_oif_match fw \\<Longrightarrow> list_all (\\<lambda>m. oiface (fst (snd m)) = ifaceAny) (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))\"\nproof(goal_cases)\n  case 1\n  have c: \"\\<And>mr ar mf af f a. \\<lbrakk>(mr, ar) \\<in> set (lr_of_tran_s1 rt); (mf, af) \\<in> simple_rule_dtor ` set fw; simple_match_and mr mf = Some a\\<rbrakk> \\<Longrightarrow> oiface a = ifaceAny\"\n  proof(goal_cases)\n    case (1 mr ar mf af f a)\n    have \"oiface mr = ifaceAny\" using 1(1) unfolding lr_of_tran_s1_def route2match_def by(clarsimp simp add: Set.image_iff)\n    moreover have \"oiface mf = ifaceAny\" using 1(2) \\<open>no_oif_match fw\\<close> unfolding no_oif_match_def simple_rule_dtor_def[abs_def]\n      by(clarsimp simp: list_all_iff split: simple_rule.splits) fastforce \n    ultimately show ?case using 1(3) by(cases a; cases mr; cases mf) (simp add: iface_conjunct_ifaceAny split: option.splits)\n  qed\n  have la: \"list_all (\\<lambda>m. oiface (fst m) = ifaceAny) (lr_of_tran_fbs rt fw ifs)\"\n    unfolding lr_of_tran_fbs_def Let_def list_all_iff\n    apply(clarify)\n    apply(subst(asm) generalized_sfw_join_set)\n    apply(clarsimp)\n  using c by blast\n  thus ?case\n  proof(goal_cases)\n    case 1\n    have *: \"(\\<lambda>m. oiface (fst (snd m)) = ifaceAny) = (\\<lambda>m. oiface (fst m) = ifaceAny) \\<circ> snd\" unfolding comp_def ..\n    show ?case unfolding * list_all_map[symmetric] map_snd_apfst map_snd_annotate_rlen using la .\n  qed\nqed\n\n\nlemma lr_of_tran_correct:\n\tfixes p :: \"(32, 'a) simple_packet_ext_scheme\"\nassumes nerr: \"lr_of_tran rt fw ifs = Inr oft\"\n\t and ippkt: \"p_l2type p = 0x800\"\n\t and ifvld: \"p_iiface p \\<in> set ifs\"\n\tshows \"OF_priority_match OF_match_fields_safe oft p = Action [Forward oif] \\<longleftrightarrow> simple_linux_router_nol12 rt fw p = (Some (p\\<lparr>p_oiface := oif\\<rparr>))\"\n\t      \"OF_priority_match OF_match_fields_safe oft p = Action [] \\<longleftrightarrow> simple_linux_router_nol12 rt fw p = None\"\n\t      (* fun stuff: *)\n\t      \"OF_priority_match OF_match_fields_safe oft p \\<noteq> NoAction\" \"OF_priority_match OF_match_fields_safe oft p \\<noteq> Undefined\"\n\t      \"OF_priority_match OF_match_fields_safe oft p = Action ls \\<longrightarrow> length ls \\<le> 1\"\n\t      \"\\<exists>ls. length ls \\<le> 1 \\<and> OF_priority_match OF_match_fields_safe oft p = Action ls\"\nproof -\n\thave s1: \"valid_prefixes rt\" \"has_default_route rt\" \n   and s2: \"has_default_policy fw\" \"simple_fw_valid fw\" \"no_oif_match fw\"\n   and difs: \"distinct ifs\"\n\t  using nerr unfolding lr_of_tran_def by(simp_all split: if_splits)\n  have \"no_oif_match fw\" using nerr unfolding lr_of_tran_def by(simp split: if_splits)\n  note s2 = s2 this\n  have unsafe_safe_eq: \n    \"OF_priority_match OF_match_fields_unsafe oft = OF_priority_match OF_match_fields_safe oft\"\n    \"OF_match_linear OF_match_fields_unsafe oft = OF_match_linear OF_match_fields_safe oft\"\n    apply(subst OF_unsafe_safe_match3_eq; (rule lr_of_tran_prereqs s1 s2 nerr refl)+)\n    apply(subst OF_unsafe_safe_match_linear_eq; (rule lr_of_tran_prereqs s1 s2 nerr refl)+)\n  done\n  have lin: \"OF_priority_match OF_match_fields_safe oft = OF_match_linear OF_match_fields_safe oft\"\n    using OF_eq[OF lr_of_tran_no_overlaps lr_of_tran_sorted_descending, OF difs nerr[symmetric] nerr[symmetric]] unfolding fun_eq_iff unsafe_safe_eq by metis\n  let ?ard = \"map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs))\"\n  have oft_def: \"oft = pack_OF_entries ifs ?ard\" using nerr unfolding lr_of_tran_def Let_def by(simp split: if_splits)\n  have vld: \"list_all simple_match_valid (map (fst \\<circ> snd) ?ard)\"\n    unfolding fun_app_def map_map[symmetric] snd_apfst map_snd_apfst map_snd_annotate_rlen using simple_match_valid_fbs[OF s1(1) s2(2)] .\n  have *: \"list_all (\\<lambda>m. oiface (fst (snd m)) = ifaceAny) ?ard\" using no_oif_match_fbs[OF s2(3)] .\n  have not_undec: \"\\<And>p. simple_fw fw p \\<noteq> Undecided\" by (metis has_default_policy s2(1) state.simps(3))\n  have w1_1: \"\\<And>oif. OF_match_linear OF_match_fields_safe oft p = Action [Forward oif] \\<Longrightarrow> simple_linux_router_nol12 rt fw p = Some (p\\<lparr>p_oiface := oif\\<rparr>) \n    \\<and> oif = output_iface (routing_table_semantics rt (p_dst p))\"\n  proof(intro conjI, goal_cases)\n    case (1 oif)\n    note s3_correct[OF vld ippkt ifvld(1) *, THEN iffD1, unfolded oft_def[symmetric], OF 1]\n    hence \"\\<exists>r. generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, (oif, simple_action.Accept))\"\n      by(clarsimp split: if_splits)\n    then obtain r where \"generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, (oif, simple_action.Accept))\" \n      unfolding map_map comp_def snd_apfst map_snd_annotate_rlen by blast\n    thus ?case using lr_of_tran_fbs_acceptD[OF s1 s2(3)] by metis\n    thus \"oif = output_iface (routing_table_semantics rt (p_dst p))\"\n      by(cases p) (clarsimp simp: simple_linux_router_nol12_def Let_def not_undec split: Option.bind_splits state.splits final_decision.splits) \n  qed\n  have w1_2: \"\\<And>oif. simple_linux_router_nol12 rt fw p = Some (p\\<lparr>p_oiface := oif\\<rparr>) \\<Longrightarrow> OF_match_linear OF_match_fields_safe oft p = Action [Forward oif]\"\n  proof(goal_cases)\n    case (1 oif)\n    note lr_of_tran_fbs_acceptI[OF s1 s2(3) s2(1) this, of ifs] then guess r .. note r = this\n    hence \"generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, (oif, simple_action.Accept))\" \n    unfolding map_snd_apfst map_snd_annotate_rlen .\n    moreover note s3_correct[OF vld ippkt ifvld(1) *, THEN iffD2, unfolded oft_def[symmetric], of \"[Forward oif]\"]\n    ultimately show ?case by simp\n  qed\n  show w1: \"\\<And>oif. (OF_priority_match OF_match_fields_safe oft p = Action [Forward oif]) = (simple_linux_router_nol12 rt fw p = Some (p\\<lparr>p_oiface := oif\\<rparr>))\"\n    unfolding lin using w1_1 w1_2 by blast\n  show w2: \"(OF_priority_match OF_match_fields_safe oft p = Action []) = (simple_linux_router_nol12 rt fw p = None)\"\n  unfolding lin\n  proof(rule iffI, goal_cases)\n    case 1\n    note s3_correct[OF vld ippkt ifvld(1) *, THEN iffD1, unfolded oft_def[symmetric], OF 1]\n    then obtain r oif where roif: \"generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, simple_action.Drop)\"\n      unfolding map_snd_apfst map_snd_annotate_rlen by(clarsimp split: if_splits)\n    note lr_of_tran_fbs_dropD[OF s1 s2(3) this]\n    thus ?case .\n  next\n    case 2 \n    note lr_of_tran_fbs_dropI[OF s1 s2(3) s2(1) this, of ifs] then \n    obtain r oif where \"generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, oif, simple_action.Drop)\" by blast\n    hence \"generalized_sfw (map snd (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))) p = Some (r, oif, simple_action.Drop)\" \n      unfolding map_snd_apfst map_snd_annotate_rlen .\n    moreover note s3_correct[OF vld ippkt ifvld(1) *, THEN iffD2, unfolded oft_def[symmetric], of \"[]\"]\n    ultimately show ?case by force\n  qed\n  have lr_determ: \"\\<And>a. simple_linux_router_nol12 rt fw p = Some a \\<Longrightarrow> a = p\\<lparr>p_oiface := output_iface (routing_table_semantics rt (p_dst p))\\<rparr>\"\n    by(clarsimp simp: simple_linux_router_nol12_def Let_def not_undec split: Option.bind_splits state.splits final_decision.splits)\n  show notno: \"OF_priority_match OF_match_fields_safe oft p \\<noteq> NoAction\"\n    apply(cases \"simple_linux_router_nol12 rt fw p\")\n    using w2 apply(simp)\n    using w1[of \"output_iface (routing_table_semantics rt (p_dst p))\"] apply(simp)\n    apply(drule lr_determ)\n    apply(simp)\n  done\n  show notub: \"OF_priority_match OF_match_fields_safe oft p \\<noteq> Undefined\" unfolding lin using OF_match_linear_ne_Undefined .\n  show notmult: \"\\<And>ls. OF_priority_match OF_match_fields_safe oft p = Action ls \\<longrightarrow> length ls \\<le> 1\"\n  apply(cases \"simple_linux_router_nol12 rt fw p\")\n    using w2 apply(simp)\n    using w1[of \"output_iface (routing_table_semantics rt (p_dst p))\"] apply(simp)\n    apply(drule lr_determ)\n    apply(clarsimp)\n  done\n  show \"\\<exists>ls. length ls \\<le> 1 \\<and> OF_priority_match OF_match_fields_safe oft p = Action ls\"\n    apply(cases \"OF_priority_match OF_match_fields_safe oft p\")\n    using notmult apply blast\n    using notno   apply blast\n    using notub   apply blast\n  done\nqed\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/LOFT/LinuxRouter_OpenFlow_Translation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.33839274035123507}}
{"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n *  Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Decoder_Typed\n  imports VHDL_Hoare_Typed\nbegin\n\ndatatype sig = IN | OUT\n\nabbreviation dec_list :: \"(sig choices \\<times> sig seq_stmt) list\" where\n  \"dec_list \\<equiv>\n[ (Explicit (Bliteral Neu (to_bl (0b00 :: 2 word))), Bassign_trans OUT (Bliteral Neu (to_bl (0x1:: 4 word))) 1)\n, (Explicit (Bliteral Neu (to_bl (0b01 :: 2 word))), Bassign_trans OUT (Bliteral Neu (to_bl (0x2:: 4 word))) 1)\n, (Explicit (Bliteral Neu (to_bl (0b10 :: 2 word))), Bassign_trans OUT (Bliteral Neu (to_bl (0x4:: 4 word))) 1)\n, (Explicit (Bliteral Neu (to_bl (0b11 :: 2 word))), Bassign_trans OUT (Bliteral Neu (to_bl (0x8:: 4 word))) 1)\n]\"\n\ndefinition dec :: \"sig conc_stmt\" where\n  \"dec = process {IN} : Bcase (Bsig IN) dec_list\"\n\nlemma potential_tyenv:\n  assumes \"seq_wt \\<Gamma> (Bcase (Bsig IN) dec_list)\"\n  shows   \"\\<Gamma> IN = Lty Neu 2 \\<and> \\<Gamma> OUT = Lty Neu 4\"\nproof (rule seq_wt_cases_bcase[OF assms, rotated 2])\n  fix ty exp' ss choices\n  assume \"bexp_wt \\<Gamma> (Bsig IN) ty\"\n  assume \"bexp_wt \\<Gamma> exp' ty\"\n  assume \"seq_wt \\<Gamma> ss\"\n  assume \"seq_wt \\<Gamma> (Bcase (Bsig IN) choices)\"\n  assume \"dec_list = ((Explicit exp', ss) # choices)\"\n  hence \"exp' = Bliteral Neu (to_bl (0b00 :: 2 word))\" and \"choices = tl dec_list\" and\n        ss_def: \"ss = Bassign_trans OUT (Bliteral Neu (to_bl (0x1 :: 4 word))) 1\"\n    by auto\n  hence 0: \"bexp_wt \\<Gamma> (Bliteral Neu (to_bl (0b000 :: 2 word))) ty\"\n    using \\<open>bexp_wt \\<Gamma> exp' ty\\<close> by auto\n  have \"ty = Lty Neu 2\"\n    by (rule bexp_wt_cases_lit[OF 0]) auto\n  with \\<open>bexp_wt \\<Gamma> (Bsig IN) ty\\<close> have \"\\<Gamma> IN = Lty Neu 2\"\n    by (metis bexp_wt_cases_slice(2))\n  hence 1: \"seq_wt \\<Gamma> (Bassign_trans OUT (Bliteral Neu (to_bl (0x1 :: 4 word))) 1)\"\n    using \\<open>seq_wt \\<Gamma> ss\\<close> unfolding ss_def by auto\n  have \"\\<Gamma> OUT = Lty Neu 4\"\n    apply (rule seq_wt_cases(4)[OF 1])\n    apply (erule bexp_wt_cases_lit)\n    by auto\n  thus ?thesis\n    using \\<open>\\<Gamma> IN = Lty Neu 2\\<close> by auto\nqed auto\n\nabbreviation \"lof_wline tw sig t \\<equiv> lval_of (wline_of tw sig t)\"\n\nlocale decoder =\n  fixes \\<Gamma> :: \"sig tyenv\"\n  assumes tyin: \"\\<Gamma> IN =  Lty Neu 2\" and tyout: \"\\<Gamma> OUT = Lty Neu 4\"\nbegin\n\ndefinition dec_inv :: \"sig assn2\" where\n  \"dec_inv \\<equiv> \\<lambda>tw. bl_to_bin (lof_wline tw OUT (fst tw)) = 2 ^ nat (bl_to_bin (lof_wline tw IN (fst tw - 1)))\"\n\ndefinition dec_inv2 :: \"sig assn2\" where\n  \"dec_inv2 \\<equiv> \\<lambda>tw. disjnt {IN} (event_of tw) \\<longrightarrow> (\\<forall>i > fst tw.  lof_wline tw OUT i = lof_wline tw OUT (fst tw))\"\n\nabbreviation \"ntime tw \\<equiv> next_time_world tw\"\n\nlemma one_encoding:\n  \"to_bl (1 :: 2 word) = [False, True]\"\n  by eval\n\nlemma conc_stmt_wf_dec:\n  \"conc_stmt_wf dec\"\n  unfolding dec_def conc_stmt_wf_def by auto  \n\nlemma nonneg_delay_conc_dec:\n  \"nonneg_delay_conc dec\"\n  unfolding dec_def by auto\n\nlemma nonneg_delay_conc_dec':\n  \"nonneg_delay_conc (process {IN} : Bcase (Bsig IN) dec_list)\"\n  using nonneg_delay_conc_dec unfolding dec_def by auto\n\nlemma len4:\n  \"length (to_bl (n :: 4 word)) = 4\"\n  by simp\n\nlemma len2:\n  \"length (to_bl (n :: 2 word)) = 2\"\n  by simp\n\nlemma seq_wt_dec:\n  \"seq_wt \\<Gamma> (Bcase (Bsig IN) dec_list)\"\n  using tyin tyout \n  by (metis bexp_wt.intros(26) bexp_wt.intros(3) len2 len4 seq_wt.intros(4) seq_wt.intros(6)\n  seq_wt.intros(8) tyin tyout)\n\nlemma conc_wt_dec:\n  \"conc_wt \\<Gamma> dec\"\n  unfolding dec_def using seq_wt_dec conc_wt.intros(1) by blast \n  \nlemma conc_wt_dec':\n  \"conc_wt \\<Gamma> ( process {IN} : Bcase (Bsig IN) dec_list)\"\n  using conc_wt_dec unfolding dec_def by auto\n\nlemma one_encoding4:\n  \"to_bl (1 :: 4 word) = [False, False, False, True]\"\n  by eval\n\nlemma case0:\n  assumes \"eval_world_raw2 tw (Bsig IN) = eval_world_raw2 tw (Bliteral Neu (to_bl (0 :: 2 word)))\"\n  defines \"v \\<equiv> eval_world_raw2 tw (Bliteral Neu (to_bl (1 :: 4 word)))\"\n  defines \"tw' \\<equiv> tw[ OUT, 1 :=\\<^sub>2 v]\"\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  shows   \"dec_inv (fst tw' + 1, snd tw')\"\nproof -\n  have \"lof_wline tw' OUT (fst tw + 1) = lval_of v\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = [False, False, False, True]\"\n    using one_encoding4 unfolding v_def by auto\n  finally have *: \"bl_to_bin (lof_wline tw' OUT (fst tw + 1)) = 1\"\n    by simp eval\n  have \"lof_wline tw' IN (fst tw) = lof_wline tw IN (fst tw)\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = [False, False]\"\n    using assms(1) by auto\n  finally have \"bl_to_bin (lof_wline tw' IN (fst tw)) = 0\"\n    by simp \n  thus ?thesis\n    using * unfolding dec_inv_def  by (simp add: tw'_def)\nqed\n\nlemma case1:\n  assumes \"eval_world_raw2 tw (Bsig IN) = eval_world_raw2 tw (Bliteral Neu (to_bl (1 :: 2 word)))\"\n  defines \"v \\<equiv> eval_world_raw2 tw (Bliteral Neu (to_bl (2 :: 4 word)))\"\n  defines \"tw' \\<equiv> tw[ OUT, 1 :=\\<^sub>2 v]\"\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  shows   \"dec_inv (fst tw' + 1, snd tw')\"\nproof -\n  have \"lof_wline tw' OUT (fst tw + 1) = lval_of v\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = [False, False, True, False]\"\n    using one_encoding4 unfolding v_def by auto\n  finally have *: \"bl_to_bin (lof_wline tw' OUT (fst tw + 1)) = 2\"\n    by simp eval\n  have \"lof_wline tw' IN (fst tw) = lof_wline tw IN (fst tw)\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = [False, True]\"\n    using assms(1) by auto eval\n  finally have \"bl_to_bin (lof_wline tw' IN (fst tw)) = 1\"\n    by simp eval\n  thus ?thesis\n    using * unfolding dec_inv_def  by (simp add: tw'_def)\nqed\n\nlemma case2:\n  assumes \"eval_world_raw2 tw (Bsig IN) = eval_world_raw2 tw (Bliteral Neu (to_bl (2 :: 2 word)))\"\n  defines \"v \\<equiv> eval_world_raw2 tw (Bliteral Neu (to_bl (4 :: 4 word)))\"\n  defines \"tw' \\<equiv> tw[ OUT, 1 :=\\<^sub>2 v]\"\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  shows   \"dec_inv (fst tw' + 1, snd tw')\"\nproof -\n  have \"lof_wline tw' OUT (fst tw + 1) = lval_of v\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = [False, True, False, False]\"\n    using one_encoding4 unfolding v_def by auto\n  finally have *: \"bl_to_bin (lof_wline tw' OUT (fst tw + 1)) = 4\"\n    by simp eval\n  have \"lof_wline tw' IN (fst tw) = lof_wline tw IN (fst tw)\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = [True, False]\"\n    using assms(1) by auto\n  finally have \"bl_to_bin (lof_wline tw' IN (fst tw)) = 2\"\n    by simp eval\n  thus ?thesis\n    using * unfolding dec_inv_def  by (simp add: tw'_def)\nqed\n\nlemma case3:\n  assumes \"eval_world_raw2 tw (Bsig IN) = eval_world_raw2 tw (Bliteral Neu (to_bl (3 :: 2 word)))\"\n  defines \"v \\<equiv> eval_world_raw2 tw (Bliteral Neu (to_bl (8 :: 4 word)))\"\n  defines \"tw' \\<equiv> tw[ OUT, 1 :=\\<^sub>2 v]\"\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  shows   \"dec_inv (fst tw' + 1, snd tw')\"\nproof -\n  have \"lof_wline tw' OUT (fst tw + 1) = lval_of v\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = [True, False, False, False]\"\n    using one_encoding4 unfolding v_def by auto\n  finally have *: \"bl_to_bin (lof_wline tw' OUT (fst tw + 1)) = 8\"\n    by simp eval\n  have \"lof_wline tw' IN (fst tw) = lof_wline tw IN (fst tw)\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = [True, True]\"\n    using assms(1) by auto\n  finally have \"bl_to_bin (lof_wline tw' IN (fst tw)) = 3\"\n    by simp eval\n  thus ?thesis\n    using * unfolding dec_inv_def  by (simp add: tw'_def)\nqed\n\nlemma dec_inv2_next_time:\n  fixes tw v\n  defines \"tw' \\<equiv> tw[OUT, 1 :=\\<^sub>2 v]\"\n  shows   \"dec_inv2 (fst tw' + 1, snd tw')\"\n  unfolding dec_inv2_def tw'_def worldline_upd2_def worldline_upd_def by auto\n\nlemma dec_conc_hoare:\n  \"\\<And>tw. dec_inv tw \\<and> dec_inv2 tw \\<and> disjnt {IN} (event_of tw) \\<Longrightarrow> dec_inv (fst tw + 1, snd tw)\"\nproof -\n  fix tw\n  assume \"dec_inv tw \\<and> dec_inv2 tw \\<and> disjnt {IN} (event_of tw)\"\n  hence \"dec_inv tw\" and \"dec_inv2 tw\" and \"disjnt {IN} (event_of tw)\"\n    by auto\n  have \"lof_wline tw OUT (fst tw + 1) = lof_wline tw OUT (fst tw)\"\n    using `dec_inv2 tw` `disjnt {IN} (event_of tw)` unfolding dec_inv2_def by auto \n  also have \"bl_to_bin ... = 2 ^ nat (bl_to_bin (lof_wline tw IN (get_time tw - 1)))\"\n    using `dec_inv tw` unfolding dec_inv_def by auto\n  also have \"... = 2 ^ nat (bl_to_bin (lof_wline tw IN (get_time tw)))\"\n    using `disjnt {IN} (event_of tw)`  unfolding event_of_alt_def  \n    by (smt diff_0_eq_0 disjnt_insert1 mem_Collect_eq)\n  finally show \"dec_inv (fst tw + 1, snd tw)\"\n    unfolding dec_inv_def by auto\nqed\n\nlemma dec_conc_hoare2:\n  \"\\<And>tw. dec_inv2 tw \\<and> disjnt {IN} (event_of tw) \\<Longrightarrow> dec_inv2 (fst tw + 1, snd tw)\"\n  unfolding dec_inv2_def by auto\n\n\nlemma cases: \n  assumes \"wityping \\<Gamma> (snd tw)\"\n  shows \"eval_world_raw2 tw (Bsig IN) = Lv Neu [False, False] \\<or> eval_world_raw2 tw (Bsig IN) = Lv Neu [False, True]\n      \\<or> eval_world_raw2 tw (Bsig IN) = Lv Neu [True, False] \\<or> eval_world_raw2 tw (Bsig IN) = Lv Neu [True, True]\"\nproof -\n  have \"bexp_wt \\<Gamma> (Bsig IN) (Lty Neu 2)\"\n    using tyin by (metis bexp_wt.intros(3))\n  then obtain xs where *: \"eval_world_raw2 tw (Bsig IN) = Lv Neu xs\" and \"length xs = 2\"\n    using eval_world_raw_lv[OF _ assms] by blast\n  have \"xs = [False, False] \\<or> xs = [False, True] \\<or> xs = [True, False] \\<or> xs = [True, True]\"\n    using \\<open>length xs = 2\\<close>\n  proof (induction xs)\n    case Nil\n    then show ?case by auto\n  next\n    case (Cons a xs)\n    have \"a = True \\<or> a = False\"\n      by auto\n    hence \"length xs = 1\"\n      using Cons by auto\n    hence \"xs = [True] \\<or> xs = [False]\"\n      by (metis (full_types) One_nat_def length_0_conv length_Suc_conv)\n    then show ?case\n      using \\<open>a = True \\<or> a = False\\<close> by auto\n  qed\n  thus ?thesis\n    using * by auto\nqed\n\nlemma dec_sim:\n  \"\\<Gamma> \\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. dec_inv tw \\<and> dec_inv2 tw\\<rbrace> dec \\<lbrace>\\<lambda>tw. dec_inv tw \\<and> dec_inv2 tw\\<rbrace>\"\n  apply (rule While_Suc)\n  apply (rule Conseq'[where P=\"wp3_conc \\<Gamma> dec (\\<lambda>tw. dec_inv  (fst tw + 1, snd tw) \\<and> \n                                                    dec_inv2 (fst tw + 1, snd tw))\", rotated])\n    apply (rule wp3_conc_is_pre[OF conc_stmt_wf_dec nonneg_delay_conc_dec conc_wt_dec], simp)\n  unfolding dec_def  wp3_conc_single'[OF conc_wt_dec' nonneg_delay_conc_dec'] wp3_fun.simps\n  using case0 case1 case2 case3 cases dec_inv2_next_time dec_conc_hoare dec_conc_hoare2 one_encoding\n  by auto fastforce+\n\ntext \\<open>Initialisation preserves the invariant\\<close>\n\nlemma nonneg_delay_dec:\n  \"nonneg_delay (Bcase (Bsig IN) dec_list)\"\n  by auto\n\nlemma init_sat_nand_inv_comb:\n  \"init_sim2_hoare_wt \\<Gamma> (\\<lambda>tw. fst tw = 0) dec (\\<lambda>tw. dec_inv tw \\<and> dec_inv2 tw)\"\n  unfolding dec_def\n  apply (rule AssignI_suc, rule SingleI)\n  apply (rule Conseq3[where Q=\"\\<lambda>tw. dec_inv (fst tw + 1, snd tw) \\<and> dec_inv2 (fst tw + 1, snd tw)\", rotated])\n  apply (rule wp3_fun_is_pre[OF seq_wt_dec nonneg_delay_dec], simp)\n  unfolding wp3_fun.simps using one_encoding  case0 case1 case2 case3 cases dec_inv2_next_time\n  by auto fastforce+\n\nlemma nand_correctness:\n  assumes \"sim_fin2 w (i + 1) dec tw'\" and \"wityping \\<Gamma> w\"\n  shows   \"bl_to_bin (lof_wline tw' OUT (i + 1)) = 2 ^ nat (bl_to_bin (lof_wline tw' IN i))\"\n  using grand_correctness[OF assms conc_stmt_wf_dec conc_wt_dec nonneg_delay_conc_dec dec_sim init_sat_nand_inv_comb]\n  unfolding dec_inv_def  by (metis (no_types, lifting) add_diff_cancel_right' assms(1)\n  sim_fin2.cases world_maxtime_lt_fst_tres)\n\nend", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Decoder_Typed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.546738151984614, "lm_q2_score": 0.6187804337438501, "lm_q1q2_score": 0.3383108708293504}}
{"text": "theory Proof_1_5\n  imports HandDryer VCTheoryLemmas Extra\nbegin\n\n\ntheorem proof_1_5:\n\"VC5 inv1 s0 hands_value\"\n  apply(simp only: VC5_def inv1_def R1_def dryer_def)\n  apply(rule impI; rule conjI)\nproof -\n  assume VC: \" ((toEnvP s0 \\<and>\n      (\\<forall>s1 s2.\n          substate s1 s2 \\<and>\n          substate s2 s0 \\<and>\n          toEnvP s1 \\<and>\n          toEnvP s2 \\<and>\n          toEnvNum s1 s2 = hands \\<and>\n          getVarBool s1 hands = OFF \\<and>\n          getVarBool s1 (Suc (Suc 0)) = OFF \\<and>\n          getVarBool s2 hands = ON \\<longrightarrow>\n          (\\<exists>s4. toEnvP s4 \\<and>\n                substate s2 s4 \\<and>\n                substate s4 s0 \\<and>\n                toEnvNum s2 s4 \\<le> hands \\<and>\n                getVarBool s4 (Suc (Suc 0)) = ON \\<and>\n                (\\<forall>s3. toEnvP s3 \\<and>\n                      substate s2 s3 \\<and>\n                      substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                      getVarBool s3 hands = ON)))) \\<and>\n     extraInv s0) \\<and>\n    env (setVarAny s0 hands_value) hands_value \\<and>\n    getPstate (setVarAny s0 hands_value) Ctrl =\n    drying \\<and>\n    getVarBool (setVarAny s0 hands_value) hands =\n    ON \\<and>\n    \\<not> 10 \\<le> ltimeEnv\n             (reset (setVarAny s0 hands_value) Ctrl)\n             Ctrl\"\n  show \" toEnvP\n     (toEnv\n       (reset (setVarAny s0 hands_value) Ctrl)) \\<and>\n    (\\<forall>s1 s2.\n        substate s1 s2 \\<and>\n        substate s2\n         (toEnv\n           (reset (setVarAny s0 hands_value)\n             Ctrl)) \\<and>\n        toEnvP s1 \\<and>\n        toEnvP s2 \\<and>\n        toEnvNum s1 s2 = hands \\<and>\n        getVarBool s1 hands = OFF \\<and>\n        getVarBool s1 (Suc (Suc 0)) = OFF \\<and>\n        getVarBool s2 hands = ON \\<longrightarrow>\n        (\\<exists>s4. toEnvP s4 \\<and>\n              substate s2 s4 \\<and>\n              substate s4\n               (toEnv\n                 (reset (setVarAny s0 hands_value)\n                   Ctrl)) \\<and>\n              toEnvNum s2 s4 \\<le> hands \\<and>\n              getVarBool s4 (Suc (Suc 0)) = ON \\<and>\n              (\\<forall>s3. toEnvP s3 \\<and>\n                    substate s2 s3 \\<and>\n                    substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                    getVarBool s3 hands = ON)))\"\n    apply(rule conjI)\n     apply(simp)\n  proof(rule allI; rule allI; rule impI)\n    fix s1 s2\n    assume req_prems: \" substate s1 s2 \\<and>\n       substate s2\n        (toEnv\n                 (reset (setVarAny s0 hands_value)\n                   Ctrl)) \\<and>\n       toEnvP s1 \\<and>\n       toEnvP s2 \\<and>\n       toEnvNum s1 s2 = hands \\<and>\n       getVarBool s1 hands = OFF \\<and>\n       getVarBool s1 (Suc (Suc 0)) = OFF \\<and>\n       getVarBool s2 hands = ON \"\n    show \" \\<exists>s4. toEnvP s4 \\<and>\n            substate s2 s4 \\<and>\n            substate s4\n            (toEnv\n                 (reset (setVarAny s0 hands_value)\n                   Ctrl)) \\<and>\n            toEnvNum s2 s4 \\<le> hands \\<and>\n            getVarBool s4 (Suc (Suc 0)) = ON \\<and>\n            (\\<forall>s3. toEnvP s3 \\<and>\n                  substate s2 s3 \\<and>\n                  substate s3 s4 \\<and>\n                  s3 \\<noteq> s4 \\<longrightarrow>\n                  getVarBool s3 hands = ON)\"\n    proof cases\n      assume 1: \"s2 =   (toEnv\n                 (reset (setVarAny s0 hands_value)\n                   Ctrl))\"\n      from VC obtain EI: \"extraInv s0\" by auto\n      with extraInv_def VC have \"0< ltimeEnv s0 Ctrl\"\n        by auto\n      hence \"ltimeEnv s0 Ctrl > 1 \\<or> ltimeEnv s0 Ctrl = 1\"\n        by auto\n      then have 3: \"getVarBool s0 dryer = ON\"\n      proof\n        assume 2: \"hands < ltimeEnv s0 Ctrl\"\n        from EI extraInv_def VC \n        have \"\\<forall>s1. toEnvP s1 \\<and>\n       substate s1 s0 \\<and>\n       toEnvNum s1 s0 + hands < ltimeEnv s0 Ctrl \\<longrightarrow>\n       getVarBool s1 hands = OFF \\<and>\n       getVarBool s1 dryer = ON\" by auto\n        with 2 VC substate_refl toEnvNum_id \n        show ?thesis by auto\n      next\n        assume 2: \"ltimeEnv s0 Ctrl = hands\"\n        from EI VC extraInv_def have \"\\<forall>s1. toEnvP s1 \\<and>\n       substate s1 s0 \\<and>\n       toEnvNum s1 s0 + hands = ltimeEnv s0 Ctrl \\<longrightarrow>\n       getVarBool s1 hands = ON \\<and>\n       getVarBool s1 dryer = ON\" by auto\n         with 2 VC substate_refl toEnvNum_id \n         show ?thesis by auto\n       qed\n       from req_prems 1 have 4: \"substate s1 s0\"\n         by ( simp split: if_splits)\n       from req_prems 1 have \"toEnvNum s1 s0 = 0\"\n         by ( simp split: if_splits)\n       with 4 substate_toEnvNum_id req_prems VC\n       have \"s1=s0\" by blast\n       with dryer_def req_prems 3 show ?thesis \n         by auto\n    next\n       assume 1: \"s2 \\<noteq>    (toEnv\n                 (reset (setVarAny s0 hands_value)\n                   Ctrl))\"\n       with req_prems have 2: \"substate s2 s0\" \n         by (simp split: if_splits)\n       from VC req_prems 2 obtain \"\\<exists>s4. toEnvP s4 \\<and>\n           substate s2 s4 \\<and>\n           substate s4 s0 \\<and>\n           toEnvNum s2 s4 \\<le> hands \\<and>\n           getVarBool s4 (Suc (Suc 0)) = ON \\<and>\n           (\\<forall>s3. toEnvP s3 \\<and>\n                 substate s2 s3 \\<and>\n                 substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                 getVarBool s3 hands = ON)\"by auto\n       then obtain s4 where 3: \"toEnvP s4 \\<and>\n           substate s2 s4 \\<and>\n           substate s4 s0 \\<and>\n           toEnvNum s2 s4 \\<le> hands \\<and>\n           getVarBool s4 (Suc (Suc 0)) = ON \\<and>\n           (\\<forall>s3. toEnvP s3 \\<and>\n                 substate s2 s3 \\<and>\n                 substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                 getVarBool s3 hands = ON)\" ..\n       have \"toEnvP s4 \\<and>\n      substate s2 s4 \\<and>\n      substate s4\n         (toEnv\n                 (reset (setVarAny s0 hands_value)\n                   Ctrl)) \\<and>\n      toEnvNum s2 s4 \\<le> hands \\<and>\n      getVarBool s4 (Suc (Suc 0)) = ON \\<and>\n      (\\<forall>s3. toEnvP s3 \\<and>\n            substate s2 s3 \\<and>\n            substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n            getVarBool s3 hands = ON)\"\n         using 3 by auto\n       thus ?thesis ..\n     qed\n   qed\n next \n   assume VC: \"((toEnvP s0 \\<and>\n      (\\<forall>s1 s2.\n          substate s1 s2 \\<and>\n          substate s2 s0 \\<and>\n          toEnvP s1 \\<and>\n          toEnvP s2 \\<and>\n          toEnvNum s1 s2 = hands \\<and>\n          getVarBool s1 hands = OFF \\<and>\n          getVarBool s1 (Suc (Suc 0)) = OFF \\<and>\n          getVarBool s2 hands = ON \\<longrightarrow>\n          (\\<exists>s4. toEnvP s4 \\<and>\n                substate s2 s4 \\<and>\n                substate s4 s0 \\<and>\n                toEnvNum s2 s4 \\<le> hands \\<and>\n                getVarBool s4 (Suc (Suc 0)) = ON \\<and>\n                (\\<forall>s3. toEnvP s3 \\<and>\n                      substate s2 s3 \\<and>\n                      substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                      getVarBool s3 hands = ON)))) \\<and>\n     extraInv s0) \\<and>\n    env (setVarAny s0 hands_value) hands_value \\<and>\n    getPstate (setVarAny s0 hands_value) Ctrl =\n    drying \\<and>\n    getVarBool (setVarAny s0 hands_value) hands =\n    ON \\<and>\n    \\<not> 10 \\<le> ltimeEnv\n             (reset (setVarAny s0 hands_value) Ctrl)\n             Ctrl\"\n   with VC5_def extra5 show \" extraInv\n     (toEnv (reset (setVarAny s0 hands_value) Ctrl))\"\n     by auto\n qed\n       \nend", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/HandDryer/Proof_1_5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.746138993030751, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.33819633885745753}}
{"text": "theory flash8Bra  imports flash8Rev\n \n  begin\nlemma onInv8:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv8  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv8  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv8 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash8Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7461389817407017, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.33819633374010893}}
{"text": "(*\n    File:        dBeta.thy\n    Time-stamp:  <2016-01-06T09:34:59Z>\n    Author:      JRF\n    Web:         http://jrf.cocolog-nifty.com/software/2016/01/post.html\n    Logic Image: ZF (of Isabelle2015)\n*)\n\ntheory dBeta imports dLambda begin\n\nconsts\n  dBeta1Rel :: i\ninductive\n  domains \"dBeta1Rel\" <= \"dTerm * dTerm\"\n  intros\n    baseI: \"[| M: dTerm; N: dTerm |] ==>\n               <dApp(dLam(M), N), dSubst(M, 0, N)>: dBeta1Rel\"\n    dLamI: \"<M, M'>: dBeta1Rel ==> <dLam(M), dLam(M')>: dBeta1Rel\"\n  \n    dAppI1: \"[| <M, M'>: dBeta1Rel; N: dTerm |] ==>\n                 <dApp(M, N), dApp(M', N)>: dBeta1Rel\"\n    \n    dAppI2: \"[| M: dTerm; <N, N'>: dBeta1Rel |] ==>\n             <dApp(M, N), dApp(M, N')>: dBeta1Rel\"\n  type_intros dTerm.intros SigmaI nat_0I dSubst_type\n  type_elims SigmaE2\n\ndefinition dBeta1 :: \"[i, i]=>o\" where\n\"dBeta1(M, N) == <M, N>: dBeta1Rel\"\n\n\nlemma dBeta1Rel_induct:\n  assumes major: \"<M, N>: dBeta1Rel\"\n  and\n   \"!!M N. [| M : dTerm; N : dTerm |] ==>\n           P(dApp(dLam(M), N), dSubst(M, 0, N))\"\n  and\n   \"!!M M'. [| <M, M'> : dBeta1Rel; P(M, M') |] ==>\n           P(dLam(M), dLam(M'))\"\n  and\n   \"!!M M' N.  [| <M, M'> : dBeta1Rel; P(M, M'); N : dTerm |] ==>\n           P(dApp(M, N), dApp(M', N))\"\n  and\n   \"!!M N N'. [| M : dTerm; <N, N'> : dBeta1Rel; P(N, N') |] ==>\n           P(dApp(M, N), dApp(M, N'))\"\n  shows \"P(M, N)\"\napply (rule_tac P=\"%x. P(x, N)\" and b1=\"N\" in fst_conv [THEN subst])\napply (rule_tac P=\"%x. P(fst(<M, N>), x)\" and a1=\"M\" in snd_conv [THEN subst])\napply (rule major [THEN dBeta1Rel.induct])\napply simp_all\napply (blast intro: assms)+\ndone\n\nlemma dBeta1_type1:\n  \"dBeta1(M, N) ==> M: dTerm\"\napply (unfold dBeta1_def)\napply (erule subsetD [OF dBeta1Rel.dom_subset, THEN SigmaD1])\ndone\n\nlemma dBeta1_type2:\n  \"dBeta1(M, N) ==> N: dTerm\"\napply (unfold dBeta1_def)\napply (erule subsetD [OF dBeta1Rel.dom_subset, THEN SigmaD2])\ndone\n\nlemma dBeta1_baseI:\n  \"[| A: dTerm; B: dTerm |] ==>\n        dBeta1(dApp(dLam(A), B), dSubst(A, 0, B))\"\napply (unfold dBeta1_def)\napply (blast intro: dBeta1Rel.intros)\ndone\n\nlemma dBeta1_dLamI:\n  \"dBeta1(M, M') ==> dBeta1(dLam(M), dLam(M'))\"\napply (unfold dBeta1_def)\napply (blast intro: dBeta1Rel.intros)\ndone\n\nlemma dBeta1_dAppI1:\n  \"[| dBeta1(M, M'); N: dTerm |] ==>\n         dBeta1(dApp(M, N), dApp(M', N))\"\napply (unfold dBeta1_def)\napply (blast intro: dBeta1Rel.intros)\ndone\n\nlemma dBeta1_dAppI2:\n  \"[| M: dTerm; dBeta1(N, N') |] ==>\n         dBeta1(dApp(M, N), dApp(M, N'))\"\napply (unfold dBeta1_def)\napply (blast intro: dBeta1Rel.intros)\ndone\n\nlemmas dBeta1_dTermIs = dBeta1_baseI dBeta1_dLamI\n                        dBeta1_dAppI1 dBeta1_dAppI2\n\nlemma dBeta1_dVarE:\n  \"dBeta1(dVar(x), N) ==> R\"\napply (unfold dBeta1_def)\napply (erule dBeta1Rel.cases)\napply (safe elim!: dTerm.free_elims)\ndone\n\nlemma dBeta1_dBoundE:\n  \"dBeta1(dBound(n), N) ==> R\"\napply (unfold dBeta1_def)\napply (erule dBeta1Rel.cases)\napply (safe elim!: dTerm.free_elims)\ndone\n\nlemma dBeta1_dLamE:\n  \"[| dBeta1(dLam(M), N);\n      !!N'. [| dBeta1(M, N'); N = dLam(N')|] ==> R\n   |] ==> R\"\napply (unfold dBeta1_def)\napply (erule dBeta1Rel.cases)\napply (blast elim!: dTerm.free_elims)+\ndone\n\nlemma dBeta1_dAppE:\n  assumes major: \"dBeta1(dApp(A, B), N)\"\n  and prem1:\n     \"!!x N'. [| N': dTerm; B: dTerm;\n         A = dLam(N'); N = dSubst(N', 0, B) |] ==> R\"\n  and prem2:\n     \"!!A'. [| dBeta1(A, A'); B: dTerm; N = dApp(A', B) |] ==> R\"\n  and prem3:\n     \"!!B'. [| A: dTerm; dBeta1(B, B'); N = dApp(A, B') |] ==> R\"\n  shows \"R\"\napply (rule major [unfolded dBeta1_def, THEN dBeta1Rel.cases])\napply (rule_tac [4] prem3)\napply (rule_tac [3] prem2)\napply (rule_tac [1] prem1)\napply (unfold dBeta1_def)\napply (safe elim!: dTerm.free_elims)\nprefer 2\nprefer 3\nprefer 5\nprefer 7\napply (rule refl)+\napply assumption+\ndone\n\nlemmas  dBeta1_dTermEs = dBeta1_dVarE dBeta1_dBoundE\n                         dBeta1_dLamE dBeta1_dAppE\n\nlemma dBeta1_dAbst:\n  assumes major: \"dBeta1(M, M')\"\n  and prem: \"n: nat\"\n  shows \"dBeta1(dAbst(M, x, n), dAbst(M', x, n))\"\napply (rule major [THEN rev_mp])\napply (rule prem [THEN [2] bspec])\napply (rule major [THEN dBeta1_type2, THEN [2] bspec])\napply (rule major [THEN dBeta1_type1, THEN dTerm.induct])\napply (simp_all del: ball_simps)\napply (safe elim!: dBeta1_dTermEs dTerm_typeEs dTerm.free_elims)\napply (rotate_tac [2] 7)\napply (simp_all del: ball_simps add: dAbst_dSubst_lemma2)\napply (rule_tac [4] dBeta1_dAppI2)\napply (rule_tac [3] dBeta1_dAppI1)\napply (rule_tac [2] dBeta1_baseI)\napply (rule_tac [1] dBeta1_dLamI)\napply (erule_tac [7] bspec [THEN bspec, THEN mp])\napply (erule_tac [4] bspec [THEN bspec, THEN mp])\napply (erule_tac [1] bspec [THEN bspec, THEN mp])\napply (assumption | rule dAbst_type nat_succI)+\ndone\n\nlemma dBeta1_dSubst:\n  assumes major: \"dBeta1(M, M')\"\n  and prem1: \"N: dProp\"\n  and prem2: \"n: nat\"\n  shows \"dBeta1(dSubst(M, n, N), dSubst(M', n, N))\"\napply (rule prem1 [THEN dPropE])\napply (rule major [THEN rev_mp])\napply (rule prem2 [THEN [2] bspec])\napply (rule major [THEN dBeta1_type2, THEN [2] bspec])\napply (rule major [THEN dBeta1_type1, THEN dTerm.induct])\napply (simp_all del: ball_simps)\napply (safe elim!: dBeta1_dTermEs dTerm_typeEs dTerm.free_elims)\napply (rotate_tac [2] 8)\napply (simp_all del: ball_simps add: dDeg_dLift_lemma1\n         dSubst_dSubst_lemma2)\napply (rule_tac [4] dBeta1_dAppI2)\napply (rule_tac [3] dBeta1_dAppI1)\napply (rule_tac [2] dBeta1_baseI)\napply (rule_tac [1] dBeta1_dLamI)\napply (erule_tac [7] bspec [THEN bspec, THEN mp])\napply (erule_tac [4] bspec [THEN bspec, THEN mp])\napply (erule_tac [1] bspec [THEN bspec, THEN mp])\napply (assumption | rule dSubst_type nat_succI)+\ndone\n\nlemma dBeta1_dDeg_lemma:\n  assumes major: \"dBeta1(M, N)\"\n  shows \"dDeg(N) le dDeg(M)\"\napply (rule major [THEN rev_mp])\napply (rule major [THEN dBeta1_type2, THEN [2] bspec])\napply (rule major [THEN dBeta1_type1, THEN dTerm.induct])\napply (safe elim!: dBeta1_dTermEs dTerm_typeEs)\napply (simp_all del: ball_simps)\napply (rule_tac [2] M1=\"N'\" in dDeg_type [THEN natE])\nprefer 3\napply (simp del: ball_simps add: dDeg_dSubst_lemma1)\napply (rule_tac [3] dDeg_dSubst_lemma2)\nprefer 4 apply simp\napply (erule_tac [2] asm_rl | rule_tac [2] nat_0I)+\napply (drule_tac [3] bspec [THEN mp], erule_tac [3] dBeta1_type2,\n       erule_tac [3] asm_rl)\napply (drule_tac [2] bspec [THEN mp], erule_tac [2] dBeta1_type2,\n       erule_tac [2] asm_rl)\napply (drule_tac [1] bspec [THEN mp], erule_tac [1] dBeta1_type2,\n       erule_tac [1] asm_rl)\napply (rule_tac M1=\"M\" in dDeg_type [THEN natE])\napply (rotate_tac [2] 4)\napply (rotate_tac [3] 4)\nprefer 2 apply simp\nprefer 2 apply simp\napply safe\napply (erule_tac [1] le_trans)\napply (erule_tac [4] le_trans)\napply (assumption | rule Un_upper1_le Un_upper2_le\n         nat_into_Ord dDeg_type)+\ndone\n\nlemma dBeta1_dProp_lemma:\n  assumes major: \"dBeta1(M, N)\"\n  and prem: \"M: dProp\"\n  shows \"N: dProp\"\napply (rule dPropI)\napply (rule major [THEN dBeta1_type2])\napply (insert prem [THEN dPropD2] major [THEN dBeta1_dDeg_lemma])\napply simp\ndone\n\nlemma dBeta1_dFV_lemma:\n  assumes major: \"dBeta1(M, N)\"\n  shows \"dFV(N) <= dFV(M)\"\napply (rule major [THEN rev_mp])\napply (rule major [THEN dBeta1_type2, THEN [2] bspec])\napply (rule major [THEN dBeta1_type1, THEN dTerm.induct])\napply (safe elim!: dBeta1_dTermEs dTerm_typeEs)\napply (rotate_tac [3] 7)\napply (rotate_tac [4] 7)\napply simp_all\napply (drule_tac [4] bspec [THEN mp], erule_tac [5] asm_rl)\napply (drule_tac [3] bspec [THEN mp], erule_tac [4] asm_rl)\napply (drule_tac [1] bspec [THEN mp], erule_tac [2] asm_rl)\napply (erule_tac [3] dFV_dSubst_lemma)\nprefer 3\nprefer 4\nprefer 5\nprefer 6\nprefer 8\napply (erule dBeta1_type2 | assumption | rule nat_0I)+\napply safe\napply (drule_tac [3] subsetD, erule_tac [3] asm_rl)\napply (drule_tac [2] subsetD, erule_tac [2] asm_rl)\napply (drule_tac [1] subsetD, erule_tac [1] asm_rl)\napply safe\ndone\n\nend\n\n", "meta": {"author": "JRF-2018", "repo": "isabelle_TheLambda", "sha": "e89eff1cbbf26da9bc6a3af603ae9d099d97c1ad", "save_path": "github-repos/isabelle/JRF-2018-isabelle_TheLambda", "path": "github-repos/isabelle/JRF-2018-isabelle_TheLambda/isabelle_TheLambda-e89eff1cbbf26da9bc6a3af603ae9d099d97c1ad/legacy2015/dBeta.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.5813030906443134, "lm_q1q2_score": 0.33791327475957206}}
{"text": "subsection\\<open>Store and Reuse Subsumption\\<close>\ntext\\<open>This theory provides proofs of various properties of the \\emph{store and reuse} heuristic,\nincluding the preconditions necessary for the transitions it introduces to directly subsume their\nungeneralised counterparts.\\<close>\n\ntheory Store_Reuse_Subsumption\nimports Store_Reuse\nbegin\n\nlemma generalisation_of_preserves:\n  \"is_generalisation_of t' t i r \\<Longrightarrow>\n    Label t = Label t' \\<and>\n    Arity t = Arity t' \\<and>\n    (Outputs t) = (Outputs t')\"\n  apply (simp add: is_generalisation_of_def)\n  using remove_guard_add_update_preserves by auto\n\nlemma is_generalisation_of_guard_subset:\n  \"is_generalisation_of t' t i r \\<Longrightarrow> set (Guards t') \\<subseteq> set (Guards t)\"\n  by (simp add: is_generalisation_of_def remove_guard_add_update_def)\n\nlemma is_generalisation_of_medial:\n  \"is_generalisation_of t' t i r \\<Longrightarrow>\n   can_take_transition t ip rg \\<longrightarrow> can_take_transition t' ip rg\"\n  using is_generalisation_of_guard_subset can_take_subset generalisation_of_preserves\n  by (metis (no_types, lifting) can_take_def can_take_transition_def)\n\nlemma is_generalisation_of_preserves_reg:\n  \"is_generalisation_of t' t i r \\<Longrightarrow>\n   evaluate_updates t ia c $ r = c $ r\"\n  by (simp add: is_generalisation_of_def r_not_updated_stays_the_same)\n\nlemma apply_updates_foldr:\n  \"apply_updates u old = foldr (\\<lambda>h r. r(fst h $:= aval (snd h) old)) (rev u)\"\n  by (simp add: apply_updates_def foldr_conv_fold)\n\nlemma is_generalisation_of_preserves_reg_2:\n  assumes gen: \"is_generalisation_of t' t i r\"\n  and dif: \"ra \\<noteq> r\"\nshows \"evaluate_updates t ia c $ ra = apply_updates (Updates t') (join_ir ia c) c $ ra\"\n  using assms\n  apply (simp add: apply_updates_def is_generalisation_of_def remove_guard_add_update_def del: fold.simps)\n  by (simp add: apply_updates_def[symmetric] apply_updates_cons)\n\nlemma is_generalisation_of_apply_guards:\n  \"is_generalisation_of t' t i r \\<Longrightarrow>\n   apply_guards (Guards t) j \\<Longrightarrow>\n   apply_guards (Guards t') j\"\n  using is_generalisation_of_guard_subset apply_guards_subset by blast\n\ntext \\<open>If we drop the guard and add an update, and the updated register is undefined in the context,\nc, then the generalised transition subsumes the specific one.\\<close>\nlemma is_generalisation_of_subsumes_original:\n  \"is_generalisation_of t' t i r \\<Longrightarrow>\n   c $ r = None \\<Longrightarrow>\n   subsumes t' c t\"\n  apply (simp add: subsumes_def generalisation_of_preserves can_take_transition_def can_take_def posterior_separate_def)\n  by (metis is_generalisation_of_apply_guards is_generalisation_of_preserves_reg is_generalisation_of_preserves_reg_2)\n\nlemma generalise_output_posterior:\n  \"posterior (generalise_output t p r) i ra = posterior t i ra\"\n  by (simp add: can_take_def generalise_output_preserves posterior_def)\n\nlemma generalise_output_eq: \"(Outputs t) ! r = L v \\<Longrightarrow>\n   c $ p = Some v \\<Longrightarrow>\n   evaluate_outputs t i c = apply_outputs (list_update (Outputs t) r (V (R p))) (join_ir i c)\"\n  apply (rule nth_equalityI)\n   apply (simp add: apply_outputs_preserves_length)\n  subgoal for j apply (case_tac \"j = r\")\n     apply (simp add: apply_outputs_literal apply_outputs_preserves_length apply_outputs_register)\n    by (simp add: apply_outputs_preserves_length apply_outputs_unupdated)\n  done\n\ntext\\<open>This shows that if we can guarantee that the value of a particular register is the literal\noutput then the generalised output subsumes the specific output.\\<close>\nlemma generalise_output_subsumes_original:\n  \"Outputs t ! r = L v \\<Longrightarrow>\n   c $ p = Some v \\<Longrightarrow>\n   subsumes (generalise_output t p r) c t\"\n  by (simp add: can_take_transition_def generalise_output_def generalise_output_eq subsumes_def)\n\nprimrec stored_reused_aux_per_reg :: \"transition \\<Rightarrow> transition \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> (nat \\<times> nat) option\" where\n  \"stored_reused_aux_per_reg t' t 0 p = (\n    if is_generalised_output_of t' t 0 p then\n      Some (0, p)\n    else\n       None\n  )\" |\n  \"stored_reused_aux_per_reg t' t (Suc r) p = (\n    if is_generalised_output_of t' t (Suc r) p then\n      Some (Suc r, p)\n    else\n      stored_reused_aux_per_reg t' t r p\n  )\"\n\nprimrec stored_reused_aux :: \"transition \\<Rightarrow> transition \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> (nat \\<times> nat) option\" where\n  \"stored_reused_aux t' t r 0 = stored_reused_aux_per_reg t' t r 0\" |\n  \"stored_reused_aux t' t r (Suc p) = (case stored_reused_aux_per_reg t' t r (Suc p) of\n                                          Some x \\<Rightarrow> Some x |\n                                          None \\<Rightarrow> stored_reused_aux t' t r p\n                                        )\"\n\ndefinition stored_reused :: \"transition \\<Rightarrow> transition \\<Rightarrow> (nat \\<times> nat) option\" where\n  \"stored_reused t' t = stored_reused_aux t' t (max (Transition.total_max_reg t) (Transition.total_max_reg t')) (max (length (Outputs t)) (length (Outputs t')))\"\n\nlemma stored_reused_aux_is_generalised_output_of:\n\"stored_reused_aux t' t mr mp = Some (p, r) \\<Longrightarrow>\n   is_generalised_output_of t' t p r\"\nproof(induct mr)\n  case 0\n  then show ?case\n  proof(induct mp)\n    case 0\n    then show ?case\n      apply simp\n      by (metis option.distinct(1) option.inject prod.inject)\n  next\n    case (Suc mp)\n    then show ?case\n      apply (case_tac \"is_generalised_output_of t' t 0 (Suc mp)\")\n      by auto\n  qed\nnext\n  case (Suc mr)\n  then show ?case\n  proof(induct mp)\n    case 0\n    then show ?case\n      apply simp\n      by (metis option.inject prod.inject)\n  next\n    case (Suc mp)\n    then show ?case\n      apply simp\n      apply (case_tac \"stored_reused_aux_per_reg t' t mr (Suc mp)\")\n       apply simp\n       apply (case_tac \"is_generalised_output_of t' t (Suc mr) (Suc mp)\")\n        apply simp\n       apply simp\n      apply simp\n      apply (case_tac \"is_generalised_output_of t' t (Suc mr) (Suc mp)\")\n      by auto\n  qed\nqed\n\nlemma stored_reused_is_generalised_output_of:\n  \"stored_reused t' t = Some (p, r) \\<Longrightarrow>\n   is_generalised_output_of t' t p r\"\n  by (simp add: stored_reused_def stored_reused_aux_is_generalised_output_of)\n\nlemma is_generalised_output_of_subsumes:\n  \"is_generalised_output_of t' t r p \\<Longrightarrow>\n   nth (Outputs t) p = L v \\<Longrightarrow>\n   c $ r = Some v \\<Longrightarrow>\n   subsumes t' c t\"\n  apply (simp add: subsumes_def generalise_output_preserves can_take_transition_def can_take_def posterior_separate_def)\n  by (simp add: generalise_output_def generalise_output_eq is_generalised_output_of_def)\n\nlemma lists_neq_if:\n  \"\\<exists>i. l ! i \\<noteq> l' ! i \\<Longrightarrow> l \\<noteq> l'\"\n  by auto\n\nlemma is_generalised_output_of_does_not_subsume:\n  \"is_generalised_output_of t' t r p \\<Longrightarrow>\n   p < length (Outputs t) \\<Longrightarrow>\n   nth (Outputs t) p = L v \\<Longrightarrow>\n   c $ r \\<noteq> Some v \\<Longrightarrow>\n   \\<exists>i. can_take_transition t i c \\<Longrightarrow>\n   \\<not>subsumes t' c t\"\n  apply (rule bad_outputs)\n  apply clarify\n  subgoal for i \n    apply (rule_tac x=i in exI)\n    apply simp\n    apply (rule lists_neq_if)\n    apply (rule_tac x=p in exI)\n    by (simp add: is_generalised_output_of_def generalise_output_def apply_outputs_nth join_ir_def)\n  done\n\ntext\\<open>This shows that we can use the model checker to test whether the relevant register is the\ncorrect value for direct subsumption.\\<close>\nlemma generalise_output_directly_subsumes_original:\n      \"stored_reused t' t = Some (r, p) \\<Longrightarrow>\n       nth (Outputs t) p = L v \\<Longrightarrow>\n      (\\<forall>c1 c2 t. obtains s c1 e1 0 <> t \\<and> obtains s' c2 e2 0 <> t \\<longrightarrow> c2 $ r = Some v) \\<Longrightarrow>\n       directly_subsumes e1 e2 s s' t' t\"\n  apply (simp add: directly_subsumes_def)\n  apply standard\n  by (metis is_generalised_output_of_subsumes stored_reused_aux_is_generalised_output_of stored_reused_def)\n\ndefinition \"generalise_output_context_check v r s1 s2 e1 e2 =\n(\\<forall>c1 c2 t. obtains s1 c1 (tm e1) 0 <> t \\<and> obtains s2 c2 (tm e2) 0 <> t \\<longrightarrow> c2 $ r = Some v)\"\n\nlemma generalise_output_context_check_directly_subsumes_original:\n      \"stored_reused t' t = Some (r, p) \\<Longrightarrow>\n       nth (Outputs t) p = L v \\<Longrightarrow>\n       generalise_output_context_check v r s s' e1 e2 \\<Longrightarrow>\n       directly_subsumes (tm e1) (tm e2) s s' t' t \"\n  by (simp add: generalise_output_context_check_def generalise_output_directly_subsumes_original)\n\ndefinition generalise_output_direct_subsumption :: \"transition \\<Rightarrow> transition \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"generalise_output_direct_subsumption t' t e e' s s' = (case stored_reused t' t of\n    None \\<Rightarrow> False |\n    Some (r, p) \\<Rightarrow>\n      (case nth (Outputs t) p of\n        L v \\<Rightarrow> generalise_output_context_check v r s s' e e' |\n        _ \\<Rightarrow> False)\n  )\"\n\ntext\\<open>This allows us to just run the two functions for quick subsumption.\\<close>\nlemma generalise_output_directly_subsumes_original_executable:\n      \"generalise_output_direct_subsumption t' t e e' s s' \\<Longrightarrow>\n   directly_subsumes (tm e) (tm e') s s' t' t\"\n  apply (simp add: generalise_output_direct_subsumption_def)\n  apply (case_tac \"stored_reused t' t\")\n   apply simp\n  apply simp\n  subgoal for a\n    apply (case_tac a)\n    apply simp\n    subgoal for _ b\n      apply (case_tac \"Outputs t ! b\")\n          apply (simp add: generalise_output_context_check_directly_subsumes_original)\n      by auto\n    done\n  done\n\nlemma original_does_not_subsume_generalised_output:\n      \"stored_reused t' t = Some (p, r) \\<Longrightarrow>\n       r < length (Outputs t) \\<Longrightarrow>\n       nth (Outputs t) r = L v \\<Longrightarrow>\n       \\<exists>a c1 tt. obtains s c1 e1 0 <> tt \\<and> obtains s' a e 0 <> tt \\<and> a $ p \\<noteq> Some v \\<and> (\\<exists>i. can_take_transition t i a) \\<Longrightarrow>\n       \\<not>directly_subsumes e1 e s s' t' t\"\n  apply (simp add: directly_subsumes_def)\n  apply clarify\n  subgoal for a c1 tt i\n    apply (rule_tac x=c1 in exI)\n    apply (rule_tac x=a in exI)\n    using stored_reused_is_generalised_output_of[of t' t p r]\n      is_generalised_output_of_does_not_subsume[of t' t p r v]\n    by auto\n  done\n\n(* t' is the generalised transition *)\nprimrec input_i_stored_in_reg :: \"transition \\<Rightarrow> transition \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> (nat \\<times> nat) option\" where\n  \"input_i_stored_in_reg t' t i 0 = (if is_generalisation_of t' t i 0 then Some (i, 0) else None)\" |\n  \"input_i_stored_in_reg t' t i (Suc r) = (if is_generalisation_of t' t i (Suc r) then Some (i, (Suc r)) else input_i_stored_in_reg t' t i r)\"\n\n(* t' is the generalised transition *)\nprimrec input_stored_in_reg_aux :: \"transition \\<Rightarrow> transition \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> (nat \\<times> nat) option\" where\n  \"input_stored_in_reg_aux t' t 0 r = input_i_stored_in_reg t' t 0 r\" |\n  \"input_stored_in_reg_aux t' t (Suc i) r = (case input_i_stored_in_reg t' t (Suc i) r of\n                                              None \\<Rightarrow> input_i_stored_in_reg t' t i r |\n                                              Some (i, r) \\<Rightarrow> Some (i, r)\n                                            ) \"\n\n(* t' is the generalised transition *)\ndefinition input_stored_in_reg :: \"transition \\<Rightarrow> transition \\<Rightarrow> iEFSM \\<Rightarrow> (nat \\<times> nat) option\" where\n  \"input_stored_in_reg t' t e = (\n    case input_stored_in_reg_aux t' t (total_max_reg e) (max (Arity t) (Arity t')) of\n      None \\<Rightarrow> None |\n      Some (i, r) \\<Rightarrow>\n        if length (filter (\\<lambda>(r', u). r' = r) (Updates t')) = 1 then\n          Some (i, r)\n        else None\n  )\"\n\ndefinition initially_undefined_context_check :: \"transition_matrix \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"initially_undefined_context_check e r s = (\\<forall>t a. obtains s a e 0 <> t \\<longrightarrow> a $ r = None)\"\n\nlemma no_incoming_to_zero:\n  \"\\<forall>((from, to), t)|\\<in>|e. 0 < to \\<Longrightarrow>\n       (aaa, ba) |\\<in>| possible_steps e s d l i \\<Longrightarrow>\n       aaa \\<noteq> 0\"\nproof(induct e)\n  case empty\n  then show ?case\n    by (simp add: possible_steps_def)\nnext\n  case (insert x e)\n  then show ?case\n    apply (cases x)\n    subgoal for a b\n      apply (case_tac a)\n      apply (simp add: possible_steps_def ffilter_finsert)\n      subgoal for aa bb\n        apply (case_tac \"aa = s \\<and> Label b = l \\<and> length i = Arity b \\<and> apply_guards (Guards b) (join_ir i d)\")\n         apply simp\n         apply blast\n        by simp\n      done\n    done\nqed\n\nlemma no_return_to_zero:\n  \"\\<forall>((from, to), t)|\\<in>|e. 0 < to \\<Longrightarrow>\n   \\<forall>r n. \\<not> visits 0 e (Suc n) r t\"\nproof(induct t)\n  case Nil\n  then show ?case\n    by (simp add: no_further_steps)\nnext\n  case (Cons a t)\n  then show ?case\n    apply clarify\n    apply (rule visits.cases)\n       apply simp\n      apply simp\n     defer\n    apply simp\n    apply clarify\n    apply simp\n    by (metis no_incoming_to_zero not0_implies_Suc)\nqed\n\nlemma no_accepting_return_to_zero:\n  \"\\<forall>((from, to), t)|\\<in>|e. to \\<noteq> 0 \\<Longrightarrow>\n   recognises (e) (a#t) \\<Longrightarrow>\n   \\<not>visits 0 (e) 0 <> (a#t)\"\n  apply clarify\n  apply (rule visits.cases)\n     apply simp\n    apply simp\n   apply clarify\n  apply simp\n  by (metis no_incoming_to_zero no_return_to_zero old.nat.exhaust)\n\nlemma no_return_to_zero_must_be_empty:\n  \"\\<forall>((from, to), t)|\\<in>|e. to \\<noteq> 0 \\<Longrightarrow>\n   obtains 0 a e s r t \\<Longrightarrow>\n   t = []\"\nproof(induct t arbitrary: s r)\ncase Nil\n  then show ?case\n    by simp\nnext\ncase (Cons a t)\n  then show ?case\n    apply simp\n    apply (rule obtains.cases)\n      apply simp\n     apply simp\n    by (metis (no_types, lifting) case_prodE fBexE list.inject no_further_steps no_incoming_to_zero unobtainable_if)\nqed\n\ndefinition \"no_illegal_updates t r = (\\<forall>u \\<in> set (Updates t). fst u \\<noteq> r)\"\n\nlemma input_stored_in_reg_aux_is_generalisation_aux:\n  \"input_stored_in_reg_aux t' t mr mi = Some (i, r) \\<Longrightarrow>\n   is_generalisation_of t' t i r\"\nproof(induct mi)\n  case 0\n  then show ?case\n  proof(induct mr)\n    case 0\n    then show ?case\n      apply (case_tac \"is_generalisation_of t' t 0 0\")\n      by auto\n  next\n    case (Suc mr)\n    then show ?case\n      apply simp\n      apply (case_tac \"is_generalisation_of t' t (Suc mr) 0\")\n       apply simp\n      apply simp\n      apply (case_tac \"is_generalisation_of t' t mr 0\")\n      by auto\n  qed\nnext\n  case (Suc mi)\n  then show ?case\n  proof(induct mr)\n    case 0\n    then show ?case\n      apply (case_tac \"is_generalisation_of t' t 0 (Suc mi)\")\n      by auto\n  next\n    case (Suc mr)\n    then show ?case\n      apply simp\n      apply (case_tac \"is_generalisation_of t' t (Suc mr) (Suc mi)\")\n       apply simp\n      apply simp\n      apply (case_tac \"input_i_stored_in_reg t' t (Suc mr) mi\")\n       apply simp\n       apply (case_tac \"is_generalisation_of t' t mr (Suc mi)\")\n      by auto\n  qed\nqed\n\nlemma input_stored_in_reg_is_generalisation:\n  \"input_stored_in_reg t' t e = Some (i, r) \\<Longrightarrow> is_generalisation_of t' t i r\"\n  apply (simp add: input_stored_in_reg_def)\n  apply (cases \"input_stored_in_reg_aux t' t (total_max_reg e) (max (Arity t) (Arity t'))\")\n   apply simp\n  subgoal for a \n    apply (case_tac a)\n    apply simp\n    subgoal for _ b\n      apply (case_tac \"length (filter (\\<lambda>(r', u). r' = b) (Updates t')) = 1\")\n       apply (simp add: input_stored_in_reg_aux_is_generalisation_aux)\n      by simp\n    done\n  done\n\n(*\n  This allows us to call these three functions for direct subsumption of generalised\n*)\nlemma generalised_directly_subsumes_original:\n  \"input_stored_in_reg t' t e = Some (i, r) \\<Longrightarrow>\n   initially_undefined_context_check (tm e) r s' \\<Longrightarrow>\n   no_illegal_updates t r \\<Longrightarrow>\n   directly_subsumes (tm e1) (tm e) s s' t' t\"\n  apply (simp add: directly_subsumes_def)\n  apply standard\n  apply (meson finfun_const.rep_eq input_stored_in_reg_is_generalisation is_generalisation_of_subsumes_original)\n  apply (rule is_generalisation_of_subsumes_original)\n  using input_stored_in_reg_is_generalisation apply blast\n  by (simp add: initially_undefined_context_check_def)\n\ndefinition drop_guard_add_update_direct_subsumption :: \"transition \\<Rightarrow> transition \\<Rightarrow> iEFSM \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"drop_guard_add_update_direct_subsumption t' t e s' = (\n    case input_stored_in_reg t' t e of\n      None \\<Rightarrow> False |\n      Some (i, r) \\<Rightarrow>\n        if no_illegal_updates t r then\n          initially_undefined_context_check (tm e) r s'\n        else False\n    )\"\n\nlemma drop_guard_add_update_direct_subsumption_implies_direct_subsumption:\n  \"drop_guard_add_update_direct_subsumption t' t e s' \\<Longrightarrow>\n   directly_subsumes (tm e1) (tm e) s s' t' t\"\n  apply (simp add: drop_guard_add_update_direct_subsumption_def)\n  apply (case_tac \"input_stored_in_reg t' t e\")\n   apply simp+\n  subgoal for a\n    apply (case_tac a)\n    apply simp\n    subgoal for _ b\n      apply (case_tac \"no_illegal_updates t b\")\n       apply (simp add: generalised_directly_subsumes_original)\n      by simp\n    done\n  done\n\nlemma is_generalisation_of_constrains_input:\n  \"is_generalisation_of t' t i r \\<Longrightarrow>\n   \\<exists>v. gexp.Eq (V (vname.I i)) (L v) \\<in> set (Guards t)\"\n  by (simp add: is_generalisation_of_def)\n\nlemma is_generalisation_of_derestricts_input:\n  \"is_generalisation_of t' t i r \\<Longrightarrow>\n   \\<forall>g \\<in> set (Guards t'). \\<not> gexp_constrains g (V (vname.I i))\"\n  by (simp add: is_generalisation_of_def remove_guard_add_update_def)\n\nlemma is_generalisation_of_same_arity:\n  \"is_generalisation_of t' t i r \\<Longrightarrow> Arity t = Arity t'\"\n  by (simp add: is_generalisation_of_def remove_guard_add_update_def)\n\nlemma is_generalisation_of_i_lt_arity:\n  \"is_generalisation_of t' t i r \\<Longrightarrow> i < Arity t\"\n  by (simp add: is_generalisation_of_def)\n\nlemma \"\\<forall>i. \\<not> can_take_transition t i r \\<and> \\<not> can_take_transition t' i r \\<Longrightarrow>\n       Label t = Label t' \\<Longrightarrow>\n       Arity t = Arity t' \\<Longrightarrow>\n       subsumes t' r t\"\n  by (simp add: subsumes_def posterior_separate_def can_take_transition_def)\n\nlemma input_not_constrained_aval_swap_inputs:\n  \"\\<not> aexp_constrains a (V (I v)) \\<Longrightarrow> aval a (join_ir i c) = aval a (join_ir (list_update i v x) c)\"\n  apply(induct a rule: aexp_induct_separate_V_cases)\n       apply simp\n      apply (metis aexp_constrains.simps(2) aval.simps(2) input2state_nth input2state_out_of_bounds join_ir_def length_list_update not_le nth_list_update_neq vname.simps(5))\n  using join_ir_def by auto\n\nlemma aval_unconstrained:\n  \" \\<not> aexp_constrains a (V (vname.I i)) \\<Longrightarrow>\n  i < length ia \\<Longrightarrow>\n  v = ia ! i \\<Longrightarrow>\n  v' \\<noteq> v \\<Longrightarrow>\n  aval a (join_ir ia c) = aval a (join_ir (list_update ia i v') c)\"\n  apply(induct a rule: aexp_induct_separate_V_cases)\n  using input_not_constrained_aval_swap_inputs by blast+\n\nlemma input_not_constrained_gval_swap_inputs:\n  \"\\<not> gexp_constrains a (V (I v)) \\<Longrightarrow>\n   gval a (join_ir i c) = gval a (join_ir (i[v := x]) c)\"\nproof(induct a)\n  case (Bc x)\n  then show ?case\n    by (metis (full_types) gval.simps(1) gval.simps(2))\nnext\n  case (Eq x1a x2)\n  then show ?case\n    using input_not_constrained_aval_swap_inputs by auto\nnext\n  case (Gt x1a x2)\n  then show ?case\n    using input_not_constrained_aval_swap_inputs by auto\nnext\n  case (In x1a x2)\n  then show ?case\n    apply simp\n    apply (case_tac \"join_ir i c x1a\")\n     apply simp\n     apply (case_tac \"join_ir (i[v := x]) c x1a\")\n      apply simp\n     apply simp\n     apply (metis aexp.inject(2) aexp_constrains.simps(2) aval.simps(2) input_not_constrained_aval_swap_inputs option.discI)\n    apply (case_tac \"join_ir i c x1a\")\n     apply simp\n     apply (case_tac \"join_ir (i[v := x]) c x1a\")\n     apply simp\n     apply (metis aexp.inject(2) aexp_constrains.simps(2) aval.simps(2) input_not_constrained_aval_swap_inputs option.discI)\n    apply simp\n    by (metis (no_types, lifting) datastate(1) input2state_within_bounds join_ir_R join_ir_nth le_less_linear list_update_beyond nth_list_update option.inject vname.case(1) vname.exhaust)\nqed auto\n\ntext\\<open>If input $i$ is stored in register $r$ by transition $t$ then if we can take transition,\n$t^\\prime$ then for some input $ia$ then transition $t$ does not subsume $t^\\prime$.\\<close>\nlemma input_stored_in_reg_not_subsumed:\n  \"input_stored_in_reg t' t e = Some (i, r) \\<Longrightarrow>\n   \\<exists>ia. can_take_transition t' ia c \\<Longrightarrow>\n   \\<not> subsumes t c t'\"\n  using input_stored_in_reg_is_generalisation[of t' t e i r]\n  using is_generalisation_of_constrains_input[of t' t i r]\n  using is_generalisation_of_derestricts_input[of t' t i r]\n  apply simp\n  apply (rule bad_guards)\n  apply clarify\n  subgoal for ia v\n    apply (simp add: can_take_transition_def can_take_def)\n    apply clarify\n    apply (case_tac \"v\")\n    subgoal for x1\n      apply (rule_tac x=\"list_update ia i (Str _)\" in exI)\n      apply simp\n      apply standard\n       apply (simp add: apply_guards_def)\n       apply (metis input_not_constrained_gval_swap_inputs)\n      apply (simp add: apply_guards_def Bex_def)\n      apply standard\n      apply (rule_tac x=\"Eq (V (vname.I i)) (L (Num x1))\" in exI)\n      apply (simp add: join_ir_def input2state_nth is_generalisation_of_i_lt_arity str_not_num)\n      done\n    subgoal for x2\n      apply (rule_tac x=\"list_update ia i (Num _)\" in exI)\n      apply simp\n      apply standard\n       apply (simp add: apply_guards_def)\n       apply (metis input_not_constrained_gval_swap_inputs)\n      apply (simp add: apply_guards_def Bex_def)\n      apply standard\n      apply (rule_tac x=\"Eq (V (vname.I i)) (L (value.Str x2))\" in exI)\n      by (simp add: join_ir_def input2state_nth is_generalisation_of_i_lt_arity str_not_num)\n    done\n  done\n\nlemma aval_updated:\n  \"(r, u) \\<in> set U \\<Longrightarrow>\n   r \\<notin> set (map fst (removeAll (r, u) U)) \\<Longrightarrow>\n   apply_updates U s c $ r = aval u s\"\nproof(induct U rule: rev_induct)\n  case (snoc a U)\n  then show ?case\n    apply (case_tac \"(r, u) = a\")\n    using apply_updates_foldr by auto\nqed auto\n\nlemma can_take_append_subset:\n  \"set (Guards t') \\<subset> set (Guards t) \\<Longrightarrow>\ncan_take a (Guards t @ Guards t') ia c = can_take a (Guards t) ia c\"\n  by (metis apply_guards_append apply_guards_subset_append can_take_def dual_order.strict_implies_order)\n\ntext\\<open>Transitions of the form $t = \\textit{select}:1[i_0=x]$ do not subsume transitions\nof the form $t^\\prime = select:1/r_1:=i_1$.\\<close>\nlemma general_not_subsume_orig: \"Arity t' = Arity t \\<Longrightarrow>\n   set (Guards t') \\<subset> set (Guards t) \\<Longrightarrow>\n   (r, (V (I i))) \\<in> set (Updates t') \\<Longrightarrow>\n   r \\<notin> set (map fst (removeAll (r, V (I i)) (Updates t'))) \\<Longrightarrow>\n   r \\<notin> set (map fst (Updates t)) \\<Longrightarrow>\n   \\<exists>i. can_take_transition t i c \\<Longrightarrow>\n   c $ r = None \\<Longrightarrow>\n   i < Arity t \\<Longrightarrow>\n   \\<not> subsumes t c t'\"\n  apply (rule inconsistent_updates)\n  apply (erule_tac exE)\n  subgoal for ia\n    apply (rule_tac x=\"evaluate_updates t ia c\" in exI)\n    apply (rule_tac x=\"apply_updates (Updates t') (join_ir ia c) c\" in exI)\n    apply standard\n     apply (rule_tac x=ia in exI)\n     apply (metis can_take_def can_take_transition_def can_take_subset posterior_separate_def psubsetE)\n    apply (rule_tac x=r in exI)\n    apply (simp add: r_not_updated_stays_the_same)\n    apply (rule_tac x=\"\\<lambda>x. x = None\" in exI)\n    by (simp add: aval_updated can_take_transition_def can_take_def)\n  done\n\nlemma input_stored_in_reg_updates_reg:\n  \"input_stored_in_reg t2 t1 a = Some (i, r) \\<Longrightarrow>\n   (r, V (I i)) \\<in> set (Updates t2)\"\n  using input_stored_in_reg_is_generalisation[of t2 t1 a i r]\n  apply simp\n  by (simp add: is_generalisation_of_def remove_guard_add_update_def)\n\ndefinition \"diff_outputs_ctx e1 e2 s1 s2 t1 t2 =\n  (if Outputs t1 = Outputs t2 then False else\n  (\\<exists>p c1 r. obtains s1 c1 e1 0 <> p \\<and>\n       obtains s2 r e2 0 <> p \\<and>\n       (\\<exists>i. can_take_transition t1 i r \\<and> can_take_transition t2 i r \\<and>\n       evaluate_outputs t1 i r \\<noteq> evaluate_outputs t2 i r)\n  ))\"\n\nlemma diff_outputs_direct_subsumption:\n  \"diff_outputs_ctx e1 e2 s1 s2 t1 t2 \\<Longrightarrow>\n   \\<not> directly_subsumes e1 e2 s1 s2 t1 t2\"\n  apply (simp add: directly_subsumes_def diff_outputs_ctx_def)\n  apply (case_tac \"Outputs t1 = Outputs t2\")\n   apply simp\n  apply clarsimp\n  subgoal for _ c1 r\n    apply (rule_tac x=c1 in exI)\n    apply (rule_tac x=r in exI)\n    using bad_outputs by force\n  done\n\ndefinition not_updated :: \"nat \\<Rightarrow> transition \\<Rightarrow> bool\" where\n  \"not_updated r t = (filter (\\<lambda>(r', _). r' = r) (Updates t) = [])\"\n\nlemma not_updated: assumes \"not_updated r t2\"\n  shows \"apply_updates (Updates t2) s s' $ r = s' $ r\"\nproof-\n  have not_updated_aux: \"\\<And>t2. filter (\\<lambda>(r', _). r' = r) t2 = [] \\<Longrightarrow>\n   apply_updates t2 s s' $ r = s' $ r\"\n    apply (rule r_not_updated_stays_the_same)\n    by (metis (mono_tags, lifting) filter_empty_conv imageE prod.case_eq_if)\n  show ?thesis\n    using assms\n    by (simp add: not_updated_def not_updated_aux)\nqed\n\nlemma one_extra_update_subsumes: \"Label t1 = Label t2 \\<Longrightarrow>\n   Arity t1 = Arity t2 \\<Longrightarrow>\n   set (Guards t1) \\<subseteq> set (Guards t2) \\<Longrightarrow>\n   Outputs t1 = Outputs t2 \\<Longrightarrow>\n   Updates t1 = (r, u) # Updates t2 \\<Longrightarrow>\n   not_updated r t2 \\<Longrightarrow>\n   c $ r = None \\<Longrightarrow>\n   subsumes t1 c t2\"\n  apply (simp add: subsumes_def posterior_separate_def can_take_transition_def can_take_def)\n  by (metis apply_guards_subset apply_updates_cons not_updated)\n\nlemma one_extra_update_directly_subsumes:\n  \"Label t1 = Label t2 \\<Longrightarrow>\n   Arity t1 = Arity t2 \\<Longrightarrow>\n   set (Guards t1) \\<subseteq> set (Guards t2) \\<Longrightarrow>\n   Outputs t1 = Outputs t2 \\<Longrightarrow>\n   Updates t1 = (r, u)#(Updates t2) \\<Longrightarrow>\n   not_updated r t2 \\<Longrightarrow>\n   initially_undefined_context_check e2 r s2 \\<Longrightarrow>\n   directly_subsumes e1 e2 s1 s2 t1 t2\"\n  apply (simp add: directly_subsumes_def)\n  apply standard\n   apply (meson one_extra_update_subsumes finfun_const_apply)\n  apply (simp add: initially_undefined_context_check_def)\n  using obtainable_def one_extra_update_subsumes by auto\n\ndefinition \"one_extra_update t1 t2 s2 e2 = (\n  Label t1 = Label t2 \\<and>\n  Arity t1 = Arity t2 \\<and>\n  set (Guards t1) \\<subseteq> set (Guards t2) \\<and>\n  Outputs t1 = Outputs t2 \\<and>\n  Updates t1 \\<noteq> [] \\<and>\n  tl (Updates t1) = (Updates t2) \\<and>\n  (\\<exists>r \\<in> set (map fst (Updates t1)). fst (hd (Updates t1)) = r \\<and>\n  not_updated r t2 \\<and>\n  initially_undefined_context_check e2 r s2)\n)\"\n\nlemma must_be_an_update:\n  \"U1 \\<noteq> [] \\<Longrightarrow>\n   fst (hd U1) = r \\<and> tl U1 = U2 \\<Longrightarrow>\n   \\<exists>u. U1 = (r, u)#(U2)\"\n  by (metis eq_fst_iff hd_Cons_tl)\n\nlemma one_extra_update_direct_subsumption:\n  \"one_extra_update t1 t2 s2 e2 \\<Longrightarrow> directly_subsumes e1 e2 s1 s2 t1 t2\"\n  apply (insert must_be_an_update[of \"Updates t1\" r \"Updates t2\"])\n  apply (simp add: one_extra_update_def)\n  by (metis eq_fst_iff hd_Cons_tl one_extra_update_directly_subsumes)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Extended_Finite_State_Machine_Inference/heuristics/Store_Reuse_Subsumption.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3379103237816563}}
{"text": "theory RedSafeCase\n  imports WTLemma RedSafeUnpack\nbegin \n  \n  (* ###### case lemmas *)    \n\nlemma safe_app_op_case: \"\\<lbrakk> app_red_exp OpApp (s1, AppExp (OpExp xop) v) ax (s2, e2); FunTy tx tau r a = op_type xop \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e2 tau r_s1 empty_use_env\"\n  apply (case_tac v)\n       apply (auto)\n  apply (case_tac ax)\n   apply (auto)\n    (* given xop: op, x1: const, assuming tau matches the return type of xop, we want to show that e2 is well-typed.\n        now e2 can either be an op or a const.\n    *)\n  apply (case_tac \"\\<not> (\\<exists> rop. e2 = OpExp rop)\")\n   apply (case_tac \"\\<not> (\\<exists> c. e2 = ConstExp c)\")\n    apply (auto)\n        apply (case_tac xop)\n             apply (auto)\n    (* the hard part is proving that e2 will have the right type. *)\n       apply (case_tac xop)\n            apply (auto)\n         apply (simp add: pure_fun_def)\n        apply (simp add: pure_fun_def)\n       apply (simp add: pure_fun_def)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac leq_empty_use_env)\n    (* op case, same thing *)\n    apply (case_tac xop)\n         apply (auto)\n      apply (simp add: pure_fun_def)\n     apply (simp add: pure_fun_def)\n    apply (simp add: pure_fun_def)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac leq_empty_use_env)\n  done  \n        \n    \nlemma add_proper_delta: \"\\<lbrakk> proper_delta s delta; fresh_var s x \\<rbrakk> \\<Longrightarrow> proper_delta (add_env s x v) (add_delta delta x x)\"    \n  apply (simp add: proper_delta_def)\n  apply (auto)\n  apply (case_tac \"xa \\<noteq> x\")\n   apply (auto)\n   apply (simp add: add_env_def)\n   apply (case_tac \"s xa\")\n    apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (auto)\n   apply (simp add: add_delta_def)\n   apply (simp add: add_env_def)\n  apply (simp add: add_env_def)\n  apply (simp add: add_delta_def)\n  done\n    \nlemma well_typed_list_incr_perm: \"\\<lbrakk> well_typed_list env delta r_x l tau; leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> well_typed_list env delta r_s l tau\"        \n  apply (induct l arbitrary: r_x)\n   apply (auto)\n  apply (rule_tac rx=\"r_x\" in well_typed_incr_req)\n    apply (auto)\n   apply (rule_tac r_s=\"r_x\" in well_typed_incr_simul_perm)\n    apply (auto)\n  apply (rule_tac id_leq_use_env)\n  done\n  \nlemma well_typed_mv_incr_perm: \"\\<lbrakk> well_typed_mem_value env delta r_x tau v; leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> well_typed_mem_value env delta r_s tau v\"    \n  apply (case_tac v)\n    apply (auto)\n  apply (rule_tac well_typed_list_incr_perm)\n   apply (auto)\n  done\n    \n    (* the point of this lemma is to state that new values can be added *)\nlemma well_typed_state_add_vars: \"\\<lbrakk> well_typed_state s1 env delta; fresh_var s1 x; well_typed_mem_value env delta empty_use_env tau v \\<rbrakk> \\<Longrightarrow>\n  well_typed_state (add_env s1 x v) (add_env env (Loc x) tau) (add_delta delta x x)\"\n    (* starts by proving the validity of the env + res map *)\n  apply (simp add: well_typed_state_def)\n  apply (auto)\n    apply (rule_tac dist_add_sub_env)\n    apply (simp)(*\n    (* the state is still fully covered by the map *)\n      apply (simp add: full_nres_map_def)\n      apply (auto)\n       apply (simp add: add_env_def)\n       apply (auto)\n      apply (simp add: add_env_def)\n      apply (auto)\n    (* prove disjointness remains *)\n     apply (rule_tac disj_add_nres_map)\n      apply (auto)\n    (* prove containment remains *)\n    apply (rule_tac add_sub_nres_map2)\n     apply (rule_tac add_sub_nres_map1)\n      apply (simp_all)\n    apply (simp add: fresh_var_def)*)\n    (* prove properness of delta *)\n   apply (rule_tac add_proper_delta)\n     apply (auto)\n    (* now it remains to prove that all the values are still well-typed. we do the x = xa case first *)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (case_tac \"x = xa\")\n   apply (case_tac \"add_env s1 x v x\")\n    apply (simp add: add_env_def)\n   apply (auto)\n   apply (case_tac \"add_env env (Loc x) tau (Loc x)\")\n    apply (simp add: add_env_def)\n   apply (auto)\n(*\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" in nres_add_same)\n   apply (simp)*)\n   apply (case_tac \"env (Loc x) \\<noteq> None\")\n    apply (simp add: fresh_var_def)\n    apply (simp add: sub_env_def)\n    apply (erule_tac x=\"Loc x\" in allE)\n    apply (auto)\n   apply (rule_tac r_x=\"empty_use_env\" in well_typed_mv_incr_perm)\n    apply (rule_tac well_typed_mv_add_vars)\n     apply (rule_tac well_typed_mv_add_delta)\n      apply (simp add: add_env_def)\n     apply (auto)\n   apply (rule_tac leq_empty_use_env)\n    (* now we do that x \\<noteq> xa case *)\n  apply (simp add: add_env_def)\n  apply (case_tac \"s1 xa\")\n   apply (auto)\n  apply (simp add: add_env_def)\n  apply (case_tac \"env (Loc xa)\")\n   apply (auto)\n  apply (case_tac \"add_delta delta x x xa \\<noteq> delta xa\")\n   apply (simp add: add_delta_def)\n  apply (rule_tac well_typed_mv_add_vars)\n   apply (rule_tac well_typed_mv_add_delta)\n    apply (auto)\n   apply (simp add: fresh_var_def)\n   apply (simp add: sub_env_def)\n   apply (erule_tac x=\"Loc x\" in allE)\n   apply (auto)\n  apply (simp add: fresh_var_def)\n  apply (simp add: sub_env_def)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  done    \n\nlemma sacc_make_act_case: \"\n        \\<lbrakk>well_typed_state s1 env delta; app_red_exp ConstApp (s1, AppExp (ConstExp c) v) (MakeAct x) (s2, e2); sub_use_env s1 r_f;\n                well_typed env delta r_s1 v t1 r_s2 rx2; leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env rx1 (lift_use_env rx2 r))); leq_use_env rx r_s3;\n                FunTy t1 t2 r a \\<in> const_type c; c \\<noteq> FixConst; ax = MakeAct x; leq_use_env r_s1 r_f\\<rbrakk>\n               \\<Longrightarrow> well_typed (add_env env (Loc x) t2) (add_delta delta x x) (add_use_env r_s1 (Loc x) OwnPerm) e2 t2 r_s3 rx\"\n    (* e2 will always be the generated variable *)\n  apply (case_tac \"e2 \\<noteq> VarExp (LocType x)\")\n   apply (case_tac c)\n                apply (auto)\n  apply (simp add: add_env_def)\n    (* remove simple addition based reqs *)\n  apply (case_tac \"add_delta delta x x x \\<noteq> x\")\n   apply (simp add: add_delta_def)\n  apply (simp add: add_env_def)\n  apply (auto)\n   apply (case_tac c)\n               apply (auto)\n   apply (rule_tac ereq_leq_use_envx)\n   apply (simp add: add_use_env_def)\n    (* prelim: x is fresh *)\n  apply (case_tac \"\\<not> fresh_var s1 x\")\n   apply (case_tac c)\n                apply (auto)\n    (* prelim: r_s3 \\<le> r_s1 *)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"diff_use_env r_s2 (comp_use_env rx1 (lift_use_env rx2 r))\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (simp_all)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n    (* we can achieve the desired permissions by removing x from the end perms + reqs (which is okay since they dont appear anywhere else yet). *)\n  apply (rule_tac x=\"one_use_env (Loc x) OwnPerm\" in exI)\n  apply (auto)\n    (* - the end perm bound is possible since we assume r_s3 didnt already contain x2 *)\n    apply (rule_tac t=\" leq_use_env r_s3 (diff_use_env (add_use_env r_s1 (Loc x) OwnPerm) (comp_use_env (ereq_use_env (Loc x) t2) (one_use_env (Loc x) OwnPerm)))\" and\n        s=\" leq_use_env (rem_use_env r_s3 (Loc x)) (diff_use_env (add_use_env r_s1 (Loc x) OwnPerm) (comp_use_env (ereq_use_env (Loc x) t2) (one_use_env (Loc x) OwnPerm)))\" in subst)\n     apply (cut_tac r_s=\"r_s3\" and x=\"Loc x\" in ignore_rem_use_env)\n      apply (rule_tac r_s=\"r_s1\" in leq_use_none)\n       apply (auto)\n     apply (simp add: sub_use_env_def)\n     apply (simp add: fresh_var_def)\n     apply (cut_tac r_x=\"r_s1\" and r_s=\"r_f\" and x=\"Loc x\" in leq_use_none)\n       apply (auto)\n    (* - given this, we can finish proving the bound *)\n    apply (rule_tac rhs_unroll_dcl_use_env)\n    apply (rule_tac rhs_unroll_rem_use_env)\n    apply (rule_tac dist_rem_leq_use_env)\n    apply (rule_tac rhs_weak_leq_use_env)\n     apply (rule_tac weak_ereq_use_env)\n     apply (case_tac c)\n                   apply (auto)\n     apply (simp add: pure_fun_def)\n     apply (simp add: unlim_def)\n    apply (rule_tac rhs_add_leq_use_env)\n     apply (auto)\n    (* - unrolling definitions to prove the subtracter bound *)\n   apply (simp add: leq_use_env_def)\n   apply (simp add: one_use_env_def)\n   apply (simp add: add_use_env_def)\n    (* - proving the requirement bound *)\n  apply (rule_tac r_sb=\"diff_use_env (ereq_use_env (Loc x) t2) (one_use_env (Loc x) OwnPerm)\" in trans_leq_use_env)\n   apply (simp add: ereq_use_env_def)\n   apply (rule_tac diff_one_leq_use_env)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac self_diff_leq_use_env)\n  done    \n    \nlemma add_env_force_ex: \"\\<lbrakk> \\<forall> z. add_env s x v z = add_env s x w z \\<rbrakk> \\<Longrightarrow> v = w\"    \n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: add_env_def)\n  done\n    \nlemma add_env_force: \"\\<lbrakk> add_env s x v = add_env s x w \\<rbrakk> \\<Longrightarrow> v = w\"    \n  apply (rule_tac s=\"s\" and x=\"x\" and v=\"v\" and w=\"w\" in add_env_force_ex)\n  apply (auto)\n  done\n    \nlemma disj_add_use_env: \"\\<lbrakk> disj_use_env r_s r_x; r_s x = NoPerm \\<rbrakk> \\<Longrightarrow> disj_use_env r_s (add_use_env r_x x r)\"    \n  apply (simp add: disj_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  done\n    \nlemma strong_disj_add_use_env: \"\\<lbrakk> strong_disj_use_env r_s r_x; r_s x = NoPerm \\<rbrakk> \\<Longrightarrow> strong_disj_use_env r_s (add_use_env r_x x r)\"    \n  apply (simp add: strong_disj_use_env_def)\n  apply (simp add: add_use_env_def)\n  done    \n\nlemma add_valid_exp_use_env: \"\\<lbrakk> valid_nres_map s rs_map; valid_exp_use_env s rs_map r_s; fresh_var s x \\<rbrakk> \\<Longrightarrow>\n  valid_exp_use_env (add_env s x v) (add_env rs_map x empty_use_env) (add_use_env r_s (Loc x) OwnPerm)\"  \n  apply (simp add: valid_exp_use_env_def)  \n  apply (auto)\n    (* domain preservation *)\n   apply (rule_tac rhs_add_sub_use_env)\n   apply (rule_tac add_sub_use_env)\n    apply (simp)\n   apply (simp add: add_env_def)\n    (* separation *)\n  apply (simp add: sep_nres_map_def)\n  apply (auto)\n  apply (case_tac \"x = xa\")\n   apply (auto)\n   apply (simp add: nres_add_same)\n   apply (rule_tac empty_strong_disj_use_env2)\n  apply (simp add: nres_add_diff)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (rule_tac comm_strong_disj_use_env)\n  apply (rule_tac strong_disj_add_use_env)\n  apply (rule_tac comm_strong_disj_use_env)\n   apply (simp)\n  apply (simp add: valid_nres_map_def)\n  apply (simp add: sub_nres_map_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (simp add: sub_use_env_def)\n  apply (simp add: fresh_var_def)\n  apply (auto)\n  done\n\n\n  \n    (*\n      the hard part that we're dealing with right now is that at the end using pairs does NOT work for the WRITE constants,\n        since we want \"use\" permission for the array, but \"own\" permission for the value being written.\n\n      what this suggests is that we have to allow for constant + application to be a value.\n      even if we do this, we need to give them all their own unique cases, just like for unpacking.\n      - this is more complicated than it is with constants, since the contents of the first arg will generally be somewhat complex.\n\n    *)\n    \n\nlemma saccmk2_var_type: \"\\<lbrakk> env (Loc x) = Some (ChanTy t c_end); delta x = x \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta (one_use_env (Loc x) OwnPerm) (VarExp (LocType x)) (ChanTy t c_end) (one_use_env (Loc x) OwnPerm) (one_use_env (Loc x) OwnPerm)\"    \n  apply (auto)\n   apply (rule_tac ereq_leq_use_envx)\n   apply (simp add: one_use_env_def)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n     apply (rule_tac rhs_weak_leq_use_env)\n      apply (rule_tac dist_weak_comp_use_env)\n       apply (rule_tac weak_ereq_use_env)\n       apply (simp add: unlim_def)\n      apply (simp add: weak_use_env_def)\n      apply (simp add: empty_use_env_def)\n     apply (rule_tac id_leq_use_env)\n     apply (rule_tac id_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac ereq_leq_use_envx)\n  apply (simp add: one_use_env_def)\n  done\n  \nlemma saccmk2_pair_type: \"\\<lbrakk> well_typed env delta (one_use_env x1 OwnPerm) v1 t1 (one_use_env x1 OwnPerm) (one_use_env x1 OwnPerm);\n  well_typed env delta (one_use_env x2 OwnPerm) v2 t2 (one_use_env x2 OwnPerm) (one_use_env x2 OwnPerm);\n  r_s1 x1 = OwnPerm; r_s1 x2 = OwnPerm; r_s2 x1 = NoPerm; r_s2 x2 = NoPerm;\n  leq_use_env r_s2 r_s1; leq_use_env rx r_s2; is_own r; x1 \\<noteq> x2 \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta r_s1 (PairExp v1 v2) (PairTy t1 t2 r) r_s2 rx\"\n  apply (auto)\n  apply (rule_tac x=\"r_s1\" in exI)\n  apply (rule_tac x=\"r_s1\" in exI)\n  apply (rule_tac x=\"one_use_env x1 OwnPerm\" in exI)\n  apply (auto)\n   apply (rule_tac r_s=\"one_use_env x1 OwnPerm\" in well_typed_incr_simul_perm)\n    apply (simp add: leq_use_env_def)\n    apply (simp add: one_use_env_def)\n   apply (simp)\n  apply (rule_tac x=\"one_use_env x2 OwnPerm\" in exI)\n  apply (auto)\n       apply (rule_tac r_s=\"one_use_env x2 OwnPerm\" in well_typed_incr_simul_perm)\n        apply (simp add: leq_use_env_def)\n        apply (simp add: one_use_env_def)\n       apply (simp)\n      apply (simp add: is_own_def)\n      apply (simp add: leq_use_env_def)\n      apply (simp add: one_use_env_def)\n     apply (simp add: is_own_def)\n     apply (simp add: leq_use_env_def)\n     apply (simp add: one_use_env_def)\n    apply (simp add: is_own_def)\n    apply (case_tac \"max_aff (req_type t1) (req_type t2)\")\n      apply (auto)\n   apply (simp add: is_own_def)\n   apply (simp add: one_use_env_def)\n   apply (simp add: disj_use_env_def)\n   apply (simp add: mini_disj_use_env_def)\n  apply (rule_tac x=\"add_use_env (one_use_env x1 OwnPerm) x2 OwnPerm\" in exI)\n  apply (auto)\n    apply (rule_tac mini_disj_diff_leq_use_env2)\n     apply (simp)\n    apply (simp add: mini_disj_use_env_def)\n    apply (simp add: one_use_env_def)\n    apply (simp add: add_use_env_def)\n    apply (auto)\n   apply (rule_tac add_leq_use_env)\n    apply (simp add: leq_use_env_def)\n    apply (simp add: one_use_env_def)\n   apply (auto)\n  apply (simp add: pair_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: one_use_env_def)\n  apply (simp add: is_own_def)\n  done\n    \nlemma sacc_mk2_act_case: \"\n  \\<lbrakk>well_typed_state s1 env delta; sub_use_env s1 r_f; well_typed env delta r_s1 v t1 r_s2 rx2;\n                leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex));\n                leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s2; leq_use_env r_ex r_s1; leq_use_env rx r_s3;\n                leq_use_env (app_req rx1 rx2 r t2 r_ex) rx; leq_use_env r_s1 r_f; FunTy t1 t2 r a \\<in> const_type c; c \\<noteq> FixConst; ax = Mk2Act x31 x32;\n                is_value v; app_con s1 c v (Mk2Act x31 x32) (s2, e2)\\<rbrakk>\n               \\<Longrightarrow> \\<exists>g_ax. well_typed (red_env env g_ax) (red_delta delta g_ax) (exp_red_use_env r_s1 g_ax) e2 t2 (end_red_use_env r_s3 g_ax) (end_red_use_env rx g_ax) \\<and>\n                          well_typed_state s2 (red_env env g_ax) (red_delta delta g_ax) \\<and>\n                          sub_use_env s2 (exp_red_use_env r_f g_ax) \\<and>\n                          safe_act s1 (infl_use_env r_f r_s3) g_ax \\<and> corr_act (Mk2Act x31 x32) g_ax\"\n  apply (case_tac c)\n              apply (auto)\n  apply (cut_tac eq_own)\n  apply (auto)\n  apply (rule_tac x=\"Add2ResAct x31 x32 tau\" in exI)\n  apply (auto)\n       apply (cut_tac env=\"add_env (add_env env (Loc x31) (ChanTy tau SEnd)) (Loc x32) (ChanTy tau REnd)\" and delta=\"add_delta (add_delta delta x31 x31) x32 x32\" and\n        ?r_s1.0=\"add_use_env (add_use_env r_s1 (Loc x31) OwnPerm) (Loc x32) OwnPerm\" and\n        ?r_s2.0=\"r_s3\" and ?v1.0=\"VarExp (LocType x31)\" and ?v2.0=\"VarExp (LocType x32)\" and ?t1.0=\"ChanTy tau SEnd\" and ?t2.0=\"ChanTy tau REnd\"\n        and ?x1.0=\"Loc x31\" and ?x2.0=\"Loc x32\" in saccmk2_pair_type)\n                apply (rule_tac saccmk2_var_type)\n                 apply (simp add: add_env_def)\n                apply (simp add: add_delta_def)\n               apply (rule_tac saccmk2_var_type)\n                apply (simp add: add_env_def)\n               apply (simp add: add_delta_def)\n              apply (auto)\n           apply (simp add: add_use_env_def)\n          apply (simp add: add_use_env_def)\n         apply (rule_tac r_s=\"r_f\" in leq_use_none)\n          apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n           apply (simp)\n          apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n           apply (rule_tac diff_leq_use_env)\n           apply (simp_all)\n         apply (simp add: fresh_var_def)\n         apply (simp add: sub_use_env_def)\n         apply (auto)\n        apply (rule_tac r_s=\"r_f\" in leq_use_none)\n         apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n          apply (simp)\n         apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n          apply (rule_tac diff_leq_use_env)\n          apply (simp_all)\n        apply (simp add: fresh_var_def)\n        apply (simp add: sub_use_env_def)\n        apply (auto)\n       apply (rule_tac rhs_add_leq_use_env)\n        apply (rule_tac rhs_add_leq_use_env)\n         apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n          apply (rule_tac diff_leq_use_env)\n          apply (simp_all)\n      apply (rule_tac x=\"ChanTy tau REnd\" in exI)\n      apply (rule_tac x=\"ra\" in exI)\n      apply (auto)\n       apply (simp add: pure_fun_def)\n       apply (simp add: is_own_def)\n      apply (rule_tac x=\"r_s2a\" in exI)\n      apply (rule_tac x=\"r_s3a\" in exI)\n      apply (rule_tac x=\"rx1a\" in exI)\n      apply (auto)\n      apply (rule_tac x=\"rx2a\" in exI)\n      apply (auto)\n      apply (rule_tac x=\"r_exb\" in exI)\n      apply (auto)\n      apply (simp add: pure_fun_def)\n      apply (simp add: is_own_def)\n    (* proving the state remains well-typed: environment containment *)\n     apply (simp add: well_typed_state_def)\n     apply (auto)\n       apply (rule_tac dist_add_sub_env)\n       apply (rule_tac dist_add_sub_env)\n       apply (simp)\n    (* res_map validity: completeness *)(*\n      apply (simp add: valid_nres_map_def)\n      apply (auto)\n        apply (rule_tac add_full_nres_map)\n        apply (rule_tac add_full_nres_map)\n        apply (simp)\n    (* - disjointness *)\n       apply (rule_tac disj_add_nres_map)\n        apply (rule_tac disj_add_nres_map)\n         apply (simp)\n        apply (simp add: sep_nres_map_def)\n        apply (simp add: empty_strong_disj_use_env1)\n       apply (simp add: sep_nres_map_def)\n       apply (simp add: empty_strong_disj_use_env1)\n    (* - element containment *)\n      apply (rule_tac dist_add_sub_nres_map)\n       apply (rule_tac dist_add_sub_nres_map)\n        apply (simp)\n        apply (rule_tac empty_sub_use_env)\n       apply (rule_tac empty_sub_use_env)*)\n    (* proving delta remains proper *)\n      apply (rule_tac add_proper_delta)\n        apply (rule_tac add_proper_delta)\n          apply (auto)(*\n       apply (simp add: valid_nres_map_def)\n       apply (auto)\n         apply (rule_tac add_full_nres_map)\n         apply (simp)\n        apply (rule_tac disj_add_nres_map)\n         apply (simp)\n        apply (simp add: sep_nres_map_def)\n        apply (simp add: empty_strong_disj_use_env1)\n       apply (rule_tac dist_add_sub_nres_map)\n        apply (simp)\n       apply (rule_tac empty_sub_use_env)*)\n      apply (simp add: add_env_def)\n      apply (simp add: fresh_var_def)\n    (* proving that the memory is still well-typed. starting with x = x31 / x = x32 *)\n     apply (case_tac \"x = x31\")\n      apply (simp add: add_env_def)\n     apply (case_tac \"x = x32\")\n      apply (simp add: add_env_def)\n    (* - otherwise compare with the originals *)\n     apply (simp add: add_env_def)\n     apply (erule_tac x=\"x\" in allE)\n     apply (case_tac \"s1 x\")\n      apply (auto)\n     apply (simp add: add_env_def)\n     apply (case_tac \"env (Loc x)\")\n      apply (auto)\n     apply (case_tac \"add_delta (add_delta delta x31 x31) x32 x32 x \\<noteq> delta x\")\n      apply (simp add: add_delta_def)\n     apply (rule_tac well_typed_mv_add_vars)\n      apply (rule_tac well_typed_mv_add_vars)\n       apply (rule_tac well_typed_mv_add_delta)\n        apply (rule_tac well_typed_mv_add_delta)\n         apply (auto)\n(*\n         apply (simp add: nres_lookup_def)\n         apply (simp add: add_env_def)*)\n        apply (simp add: fresh_var_def)\n        apply (simp add: sub_env_def)\n        apply (auto)\n       apply (simp add: fresh_var_def)\n       apply (simp add: sub_env_def)\n       apply (auto)\n      apply (simp add: fresh_var_def)\n      apply (simp add: sub_env_def)\n      apply (auto)\n     apply (simp add: add_env_def)\n     apply (simp add: fresh_var_def)\n     apply (simp add: sub_env_def)\n     apply (auto)\n    (* proving the new res_map is still valid: expression map containment *)(*\n    apply (simp add: valid_exp_use_env_def)\n    apply (auto)*)\n    apply (rule_tac rhs_add_sub_use_env)\n     apply (rule_tac rhs_add_sub_use_env)\n      apply (rule_tac add_sub_use_env)\n      apply (rule_tac add_sub_use_env)\n      apply (simp)\n     apply (simp add: add_env_def)\n    apply (simp add: add_env_def)\n   apply (simp add: fresh_var_def)\n   apply (simp add: fresh_var_def)\n  apply (simp add: corr_act_def)\n  done\n\nlemma max_aff_leq: \"\\<lbrakk> aff_leq a1 a3; aff_leq a2 a3 \\<rbrakk> \\<Longrightarrow> aff_leq (max_aff a1 a2) a3\"    \n  apply (case_tac a1)\n    apply (auto)\n   apply (case_tac a2)\n     apply (auto)\n  apply (case_tac a2)\n    apply (auto)\n  done\n    \nlemma well_typed_new_list: \"well_typed_list env delta empty_use_env (new_arr_value n) tau\"    \n  apply (induct n)\n   apply (auto)\n  apply (rule_tac id_leq_use_env)\n  done\n\n    (* the idea is that if we added a permission, we required it to be a variable not already in the env, ie a variable free in e2.\n      so then we can remove x by default. *)\n    (* in general, this statement says that given a constant-application, the result can be typed with a certain env + perm set,\n      so that the state remains well-typed relative to the env + global perm_map, and the env + perm set remains valid *)\nlemma safe_app_con_case: \"\\<lbrakk> well_typed_state s1 env delta;\n    app_red_exp ConstApp (s1, AppExp (ConstExp c) v) ax (s2, e2); sub_use_env s1 r_f;\n    well_typed env delta r_s1 v t1 r_s2 rx2;\n    leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex));\n    leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s2; leq_use_env r_ex r_s1; disj_use_env rx1 (lift_use_env rx2 r);\n    leq_use_env rx r_s3; leq_use_env (app_req rx1 rx2 r t2 r_ex) rx; leq_use_env r_s1 r_f;\n    FunTy t1 t2 r a \\<in> const_type c; c \\<noteq> FixConst\\<rbrakk>\n       \\<Longrightarrow> \\<exists>g_ax . well_typed (red_env env g_ax) (red_delta delta g_ax) (exp_red_use_env r_s1 g_ax) e2 t2 (end_red_use_env r_s3 g_ax) (end_red_use_env rx g_ax) \\<and>\n                  well_typed_state s2 (red_env env g_ax) (red_delta delta g_ax) \\<and>\n                  sub_use_env s2 (exp_red_use_env r_f g_ax) \\<and> safe_act s1 (infl_use_env r_f r_s3) g_ax \\<and> corr_act ax g_ax\"\n  apply (case_tac ax)\n     apply (auto)\n    (* no action cases *)\n     apply (cut_tac ?r_s2.0=\"r_s2\" and ?r_s1.0=\"r_s1\" and env=\"env\" in well_typed_perm_leq)\n      apply (auto)\n     apply (case_tac c)\n                 apply (auto)\n     apply (rule_tac sares_unpack_case)\n                apply (auto)\n     apply (simp add: upc_init_abbrev_def)\n     apply (rule_tac x=\"r_s1\" in exI)\n     apply (auto)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac self_comp_leq_use_env1)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (rule_tac x=\"r_s2\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3a\" in exI)\n     apply (rule_tac x=\"rx1a\" in exI)\n     apply (auto)\n    (* new resource cases. in all cases t2 should be the correct type to add *)\n    apply (rule_tac x=\"AddResAct x2 t2\" in exI)\n    apply (auto)\n    (* - lemma for main well-typedness statement *)\n        apply (rule_tac ?s2.0=\"s2\" and ?rx1.0=\"rx1\" in sacc_make_act_case)\n                 apply (auto)\n        apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n         apply (rule_tac lhs_unroll_dcl_use_env)\n         apply (rule_tac self_diff_leq_use_env)\n        apply (simp)\n    (* - well typed state. *)\n       apply (case_tac \"\\<not> (\\<exists> v. s2 = add_env s1 x2 v)\")\n        apply (case_tac c)\n                    apply (auto)\n       apply (rule_tac well_typed_state_add_vars)\n           apply (auto)\n          apply (case_tac c)\n                      apply (auto)\n    (* - wt mem val: array case *)\n         apply (case_tac c)\n                     apply (auto)\n         apply (cut_tac s=\"s1\" and x=\"x2\" and v=\"va\" and w=\"ArrValue (new_arr_value (nat i))\" in add_env_force)\n        apply (auto)\n       apply (rule_tac x=\"tau\" in exI)\n       apply (simp add: pure_fun_def)\n       apply (rule_tac well_typed_new_list)\n(*\n    (* - valid res list *)\n         apply (rule_tac x=\"\\<lambda> x. None\" in exI)\n          apply (simp add: valid_res_list_def)\n    (* - properness *)\n         apply (case_tac c)\n                     apply (auto)\n         apply (cut_tac s=\"s1\" and x=\"x2\" and v=\"va\" and w=\"ArrValue []\" in add_env_force)\n          apply (simp)\n         apply (auto)*)\n    (* - x22 is contained in rs_map (true because x22 is the empty set)\n        apply (simp add: sub_use_env_def)\n        apply (simp add: empty_use_env_def)\n    (* - map separation + strength *)\n       apply (simp add: sep_nres_map_def)\n       apply (auto)\n       apply (rule_tac empty_strong_disj_use_env1) *)\n    (* - valid use env. *)\n      apply (case_tac \"\\<not> (\\<exists> v. s2 = add_env s1 x2 v)\")\n       apply (case_tac c)\n                   apply (auto)\n      apply (rule_tac rhs_add_sub_use_env)\n       apply (rule_tac add_sub_use_env)\n       apply (simp)\n      apply (simp add: add_env_def)\n      apply (case_tac c)\n                 apply (auto)\n     apply (simp add: fresh_var_def)\n  apply (simp add: corr_act_def)\n    (* dual new resource case. (basically only channel creation) *)\n   apply (rule_tac sacc_mk2_act_case)\n                apply (auto)\n    (* resource usage case. (currently empty) *)\n  apply (case_tac c)\n              apply (auto)\n(*\n   apply (case_tac c)\n                apply (auto)\n  apply (case_tac c)\n               apply (auto)*)\n  done    \n\n  \nlemma well_typed_empty_state: \"well_typed_state empty_env empty_env id\"\n  apply (simp add: well_typed_state_def)\n  apply (auto)\n    apply (simp add: sub_env_def)\n    apply (simp add: empty_env_def)\n   apply (simp add: proper_delta_def)\n   apply (simp add: empty_env_def)\n  apply (simp add: empty_env_def)\n  done\n\n  \nfun state_vars where\n  \"state_vars s = { x | x. s x \\<noteq> None }\"\n  \ndefinition fv_restr_env where\n  \"fv_restr_env e s = (\\<lambda> x. if x \\<in> free_vars e then s x else None)\"\n  \nlemma fv_restr_env_use: \"\\<lbrakk> x \\<in> free_vars e \\<rbrakk> \\<Longrightarrow> fv_restr_env e s x = s x\"  \n  apply (simp add: fv_restr_env_def)\n  done\n    \nlemma dist_rem_contain_env: \"\\<lbrakk> contain_env s s' \\<rbrakk> \\<Longrightarrow> contain_env (rem_env s x) (rem_env s' x)\"    \n  apply (simp add: contain_env_def)\n  apply (simp add: rem_env_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (case_tac \"s' xa\")\n   apply (auto)\n  apply (simp add: rem_env_def)\n  done\n\nlemma fv_contain_env: \"\\<lbrakk> free_vars e' \\<subseteq> free_vars e \\<rbrakk> \\<Longrightarrow> contain_env (fv_restr_env e s) (fv_restr_env e' s)\"    \n  apply (simp add: contain_env_def)\n  apply (simp add: fv_restr_env_def)\n  apply (auto)\n  apply (case_tac \"s x\")\n   apply (auto)\n  apply (simp add: fv_restr_env_def)\n  apply (auto)\n  done\n\nlemma rem_fv_contain_env: \"\\<lbrakk> free_vars e' - {x} \\<subseteq> free_vars e \\<rbrakk> \\<Longrightarrow> contain_env (fv_restr_env e (rem_env s x)) (fv_restr_env e' (rem_env s x))\"    \n  apply (simp add: contain_env_def)\n  apply (simp add: fv_restr_env_def)\n  apply (auto)\n  apply (simp add: rem_env_def)\n  apply (auto)\n  apply (case_tac \"s xa\")\n   apply (auto)\n  apply (simp add: fv_restr_env_def)\n  apply (simp add: rem_env_def)\n  apply (auto)\n  done\n    \nlemma rem_fv_restr_env: \"rem_env (fv_restr_env e s) x = fv_restr_env e (rem_env s x)\"    \n  apply (case_tac \"\\<not> (\\<forall> y. rem_env (fv_restr_env e s) x y = fv_restr_env e (rem_env s x) y)\")\n   apply (auto)\n  apply (simp add: rem_env_def)\n  apply (simp add: fv_restr_env_def)\n  apply (case_tac \"x = y\")\n   apply (auto)\n   apply (case_tac \"x \\<in> free_vars e\")\n    apply (auto)\n  apply (simp add: fv_restr_env_def)\n  apply (case_tac \"y \\<in> free_vars e\")\n   apply (auto)\n  done\n\n    \n    (* the question is, how do we allow for replicable pairs while enforcing full resource disjointness?\n        i guess the \"natural\" way to do it based on what we already have is to simply allow pairs that contain\n        values that are not unique to also be values.\n\n        - if x is in the end perms, x is in the reqs. if r is own, (lift rx r) subtracts it out.\n        - if r is not own, it means that e is replicable, in which case it is again not a var,\n        - x is not in the end perms, which is trivial\n\n        an even cleaner solution is to make a \"replicable\" pair value and type accordingly.\n        in this case e is still a var, however at the level of reduction semantics, we can keep\n        the var out of the name set.\n     *)\n    \nend", "meta": {"author": "dcco", "repo": "perm_lang_thesis", "sha": "81661c97a0c43701c9ec0a75074d9553b2dd0263", "save_path": "github-repos/isabelle/dcco-perm_lang_thesis", "path": "github-repos/isabelle/dcco-perm_lang_thesis/perm_lang_thesis-81661c97a0c43701c9ec0a75074d9553b2dd0263/isa_code/RedSafeCase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3379103161776006}}
{"text": "theory ProcHoleVars\n  imports RedSafeHoleLemma\nbegin\n\nfun hole_free_vars :: \"p_hole \\<Rightarrow> string set\" where\n  \"hole_free_vars ExpHole = {}\"\n| \"hole_free_vars (AppHole1 h e) = (hole_free_vars h \\<union> free_vars e)\"    \n| \"hole_free_vars (AppHole2 v h) = (free_vars v \\<union> hole_free_vars h)\"    \n| \"hole_free_vars (IfHole h e1 e2) = (hole_free_vars h \\<union> free_vars e1 \\<union> free_vars e2)\"\n| \"hole_free_vars (PairHole1 h e) = (hole_free_vars h \\<union> free_vars e)\"  \n| \"hole_free_vars (PairHole2 e h) = (free_vars e \\<union> hole_free_vars h)\"  \n(*| \"hole_free_vars (UnpackHole e h) = (free_vars e \\<union> hole_free_vars h)\"    *)\n\nfun hole_res_vars :: \"p_hole \\<Rightarrow> res_id set\" where\n  \"hole_res_vars ExpHole = {}\"\n| \"hole_res_vars (AppHole1 h e) = (hole_res_vars h \\<union> res_vars e)\"    \n| \"hole_res_vars (AppHole2 v h) = (res_vars v \\<union> hole_res_vars h)\"    \n| \"hole_res_vars (IfHole h e1 e2) = (hole_res_vars h \\<union> res_vars e1 \\<union> res_vars e2)\"\n| \"hole_res_vars (PairHole1 h e) = (hole_res_vars h \\<union> res_vars e)\"  \n| \"hole_res_vars (PairHole2 e h) = (res_vars e \\<union> hole_res_vars h)\"    \n  \nlemma app_hole_free_vars: \"\\<lbrakk> x \\<in> free_vars e \\<rbrakk> \\<Longrightarrow> x \\<in> free_vars (app_hole h e)\"    \n  apply (induct h)\n    apply (auto)\n  done  \n    \nlemma app_hole_free_vars2: \"\\<lbrakk> x \\<in> hole_free_vars h \\<rbrakk> \\<Longrightarrow> x \\<in> free_vars (app_hole h e)\"    \n  apply (induct h)\n    apply (auto)\n  done    \n    \nlemma app_hole_free_vars_rev: \"\\<lbrakk> x \\<in> free_vars (app_hole h e) \\<rbrakk> \\<Longrightarrow> x \\<in> hole_free_vars h \\<or> x \\<in> free_vars e\"    \n  apply (induct h)\n    apply (auto)\n  done \n\nlemma app_hole_res_vars: \"\\<lbrakk> x \\<in> res_vars e \\<rbrakk> \\<Longrightarrow> x \\<in> res_vars (app_hole h e)\"    \n  apply (induct h)\n    apply (auto)\n  done  \n    \nlemma app_hole_res_vars2: \"\\<lbrakk> x \\<in> hole_res_vars h \\<rbrakk> \\<Longrightarrow> x \\<in> res_vars (app_hole h e)\"    \n  apply (induct h)\n    apply (auto)\n  done    \n    \nlemma app_hole_res_vars_rev: \"\\<lbrakk> x \\<in> res_vars (app_hole h e) \\<rbrakk> \\<Longrightarrow> x \\<in> hole_res_vars h \\<or> x \\<in> res_vars e\"    \n  apply (induct h)\n    apply (auto)\n  done \n    \n    (* ##### states that if x is a non-prim var in 'e', it will not be a free var in 'h' if 'h (fork e)' is well-typed.  ##### *)\n  \nfun strong_fun_ty where\n  \"strong_fun_ty (FunTy t1 t2 r a) = (r = OwnPerm)\"\n| \"strong_fun_ty tau = False\"\n  \nfun strong_fun_ty2 where\n  \"strong_fun_ty2 (FunTy t1 (FunTy t2 t3 r a) rx ax) = (r = OwnPerm)\"  \n| \"strong_fun_ty2 tau = False\"  \n  \nfun strong_fun where\n  \"strong_fun (ConstExp c) = (\\<forall> tau. tau \\<in> const_type c \\<longrightarrow> strong_fun_ty tau)\"\n| \"strong_fun (AppExp (ConstExp c) v) = (\\<forall> tau. tau \\<in> const_type c \\<longrightarrow> strong_fun_ty2 tau)\"  \n| \"strong_fun e = False\"    \n  \nlemma strong_fun_own: \"\\<lbrakk>  well_typed env r_s1 f (FunTy t1 t2 r a) r_s2 rx; strong_fun f \\<rbrakk> \\<Longrightarrow> is_own r\"  \n  apply (case_tac f)\n        apply (auto)\n   apply (simp add: is_own_def)\n   apply (auto)\n  apply (simp add: is_own_def)\n  apply (case_tac x71)\n        apply (auto)\n  done\n  \nlemma safe_hole_npv_use_ih: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp f e)) tau r_s2 rx;\n  is_value f; strong_fun f; is_value e; x \\<in> non_prim_vars env e \\<rbrakk> \\<Longrightarrow> r_s2 x = NoPerm\"\n  apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n       apply (auto)\n    (* base case. x is subtracted out in the lifting of the inflected rx2 *)\n       apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"e\" and tau=\"t1\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n         apply (auto)\n        apply (rule_tac value_is_sexp)\n        apply (simp)\n    (* - r_s3 x has a value since otherwise it would be trivial *)\n       apply (case_tac \"r_s3 x = NoPerm\")\n        apply (rule_tac r_s=\"r_s3\" in leq_use_none)\n         apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n          apply (rule_tac self_diff_leq_use_env)\n         apply (auto)\n    (* - we know that rx2 has a value, because otherwise rx2 + [r_s2a - r_s3] would not have a value, altho it is the start perms of e *)\n       apply (case_tac \"rx2 x = NoPerm\")\n        apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n          apply (simp)\n         apply (simp add: infl_use_env_def)\n        apply (cut_tac env=\"env\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" and x=\"x\" in well_typed_no_npv_use)\n          apply (auto)\n    (* - by construction of strong functions, we also know that r = OwnPerm *)\n       apply (cut_tac f=\"f\" and r=\"r\" in strong_fun_own)\n         apply (auto)\n    (* - from here we can deduce EX x = Own *)\n        apply (rule_tac r_s=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in leq_use_none)\n         apply (auto)\n        apply (rule_tac diff_use_none_ex)\n        apply (rule_tac r_x=\"lift_use_env rx2 r\" in leq_use_own)\n         apply (simp add: is_own_def)\n        apply (rule_tac comp_leq_use_env1)\n        apply (rule_tac self_comp_leq_use_env2)\n    (* lhs induct. *)\n      apply (rule_tac r_s=\"r_s2a\" in leq_use_none)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n        apply (rule_tac diff_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n    (* rhs induct. *)\n     apply (rule_tac r_s=\"r_s3\" in leq_use_none)\n      apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (auto)\n    (* if case. *)\n    apply (rule_tac r_s=\"r_s2a\" in leq_use_none)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* pair case 1. *)\n   apply (rule_tac r_s=\"r_s2a\" in leq_use_none)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* pair case 2. *)\n  apply (rule_tac r_s=\"r_s3\" in leq_use_none)\n   apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (auto)\n  done        \n    \nlemma safe_hole_npv_use_st: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp f e)) tau r_s2 rx; is_value f; strong_fun f;\n wf_hole h; is_value e \\<rbrakk> \\<Longrightarrow> x \\<notin> non_prim_vars env e \\<or> x \\<notin> hole_res_vars h\"\n  apply (induct h arbitrary: env r_s1 tau r_s2 rx)\n       apply (auto)\n    (* lhs induct. since r_s2a x = None, it cannot be in e2 *)\n       apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_hole_npv_use_ih)\n            apply (auto)\n       apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x2\" and x=\"x\" in well_typed_no_npv_use)\n         apply (auto)\n       apply (simp add: non_prim_vars_def)\n    (* rhs induct. r_s2a x has a value. since x is in e2. *)\n      apply (case_tac \"r_s2a x = NoPerm\")\n       apply (cut_tac ?r_s1.0=\"r_s2a\" and x=\"x\" and e=\"app_hole h (AppExp f e)\" in well_typed_no_npv_use)\n         apply (auto)\n       apply (cut_tac h=\"h\" and e=\"AppExp f e\" and x=\"x\" in app_hole_res_vars)\n        apply (simp add: non_prim_vars_def)\n       apply (simp add: non_prim_vars_def)\n    (* - by lemma, rx1 x has a value as well. *)\n      apply (cut_tac env=\"env\" and e=\"x1\" and tau=\"FunTy t1 tau r a\" and ?r_s2.0=\"r_s2a\" and rx=\"rx1\" in wt_sexp_req_use)\n          apply (auto)\n        apply (rule_tac value_is_sexp)\n        apply (auto)\n       apply (simp add: non_prim_vars_def)\n    (* - this is a contradiction, since r_s3 x = None, and rx1 is contained by it *)\n      apply (cut_tac r_x=\"rx1\" and r_s=\"r_s3\" and x=\"x\" in leq_use_none)\n        apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n         apply (simp)\n        apply (rule_tac self_comp_leq_use_env1)\n       apply (rule_tac safe_hole_npv_use_ih)\n           apply (auto)\n    (* lhs if case. since r_s2a x = None, it cannot be in e2 *)\n     apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_hole_npv_use_ih)\n          apply (auto)\n     apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x2\" and x=\"x\" in well_typed_no_npv_use)\n       apply (auto)\n     apply (simp add: non_prim_vars_def)\n    (* rhs if case. since r_s2a x = None, it cannot be in e2 *)\n    apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_hole_npv_use_ih)\n         apply (auto)\n    apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x3\" and x=\"x\" in well_typed_no_npv_use)\n      apply (auto)\n    apply (simp add: non_prim_vars_def)\n    (* lhs pair case. same for lhs induct *)\n   apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_hole_npv_use_ih)\n        apply (auto)\n   apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x2\" and x=\"x\" in well_typed_no_npv_use)\n     apply (auto)\n   apply (simp add: non_prim_vars_def)\n    (* rhs pair case. same for rhs induct *)\n    (* - r_s2a x has a value. since x is in e2 *)\n  apply (case_tac \"r_s2a x = NoPerm\")\n   apply (cut_tac ?r_s1.0=\"r_s2a\" and x=\"x\" and e=\"app_hole h (AppExp f e)\" in well_typed_no_npv_use)\n     apply (auto)\n   apply (cut_tac h=\"h\" and e=\"AppExp f e\" and x=\"x\" in app_hole_res_vars)\n    apply (auto)\n    apply (simp add: non_prim_vars_def)\n   apply (simp add: non_prim_vars_def)\n    (* - then rx1 x has a value *)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"x1\" and tau=\"t1\" and ?r_s2.0=\"r_s2a\" and rx=\"rx1\" in wt_sexp_req_use)\n      apply (auto)\n    apply (rule_tac value_is_sexp)\n    apply (auto)\n   apply (simp add: non_prim_vars_def)\n    (* - this is a contradiction, since r_s3 x = None, and rx1 is contained by it *)\n  apply (cut_tac r_x=\"rx1\" and r_s=\"r_s3\" and x=\"x\" in leq_use_none)\n    apply (rule_tac r_sb=\"lift_use_env rx1 r\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac self_lift_leq_use_env)\n   apply (rule_tac safe_hole_npv_use_ih)\n       apply (auto)\n  done    \n    \nlemma safe_fork_hole_npv_use: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n wf_hole h; is_value e; x \\<in> non_prim_vars env e \\<rbrakk> \\<Longrightarrow> x \\<notin> hole_res_vars h\"\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and h=\"h\" and e=\"e\" and f=\"ConstExp ForkConst\" and x=\"x\" in safe_hole_npv_use_st)\n       apply (auto)\n  apply (simp add: is_own_def)\n  done        \n   \nlemma safe_send_hole_npv_use: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (AppExp (ConstExp SendConst) v) e)) tau r_s2 rx;\n wf_hole h; is_value v; is_value e; x \\<in> non_prim_vars env e \\<rbrakk> \\<Longrightarrow> x \\<notin> hole_res_vars h\"\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and h=\"h\" and e=\"e\" and f=\"AppExp (ConstExp SendConst) v\" and x=\"x\" in safe_hole_npv_use_st)\n       apply (auto)\n  apply (simp add: pure_fun_def)\n  apply (simp add: is_own_def)\n  done     \n    \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/ProcHoleVars.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.5428632831725051, "lm_q1q2_score": 0.33791031617760053}}
{"text": "section\\<open>From $M$ to $\\calV$\\<close>\n\ntheory Absolute_Versions\n  imports\n    CH\n    ZF.Cardinal_AC\nbegin\n\nhide_const (open) Order.pred\n\nsubsection\\<open>Locales of a class \\<^term>\\<open>M\\<close> hold in \\<^term>\\<open>\\<V>\\<close>\\<close>\n\ninterpretation V: M_trivial \\<V>\n  using Union_ax_absolute upair_ax_absolute\n  by unfold_locales auto\n\nlemmas bad_simps = V.nonempty V.Forall_in_M_iff V.Inl_in_M_iff V.Inr_in_M_iff\n  V.succ_in_M_iff V.singleton_in_M_iff V.Equal_in_M_iff V.Member_in_M_iff V.Nand_in_M_iff\n  V.Cons_in_M_iff V.pair_in_M_iff V.upair_in_M_iff\n\nlemmas bad_M_trivial_simps[simp del] = V.Forall_in_M_iff V.Equal_in_M_iff\n  V.nonempty\n\nlemmas bad_M_trivial_rules[rule del] =  V.pair_in_MI V.singleton_in_MI V.pair_in_MD V.nat_into_M\n  V.depth_closed V.length_closed V.nat_case_closed V.separation_closed\n  V.Un_closed V.strong_replacement_closed V.nonempty\n\ninterpretation V:M_basic \\<V>\n  using power_ax_absolute separation_absolute replacement_absolute\n  by unfold_locales auto\n\ninterpretation V:M_eclose \\<V>\n  by unfold_locales (auto intro:separation_absolute replacement_absolute\n      simp:iterates_replacement_def wfrec_replacement_def)\n\nlemmas bad_M_basic_rules[simp del, rule del] =\n  V.cartprod_closed V.finite_funspace_closed V.converse_closed\n  V.list_case'_closed V.pred_closed\n\ninterpretation V:M_cardinal_arith \\<V>\n  by unfold_locales (auto intro:separation_absolute replacement_absolute\n      simp add:iterates_replacement_def wfrec_replacement_def lam_replacement_def)\n\nlemmas bad_M_cardinals_rules[simp del, rule del] =\n  V.iterates_closed V.M_nat V.trancl_closed V.rvimage_closed\n\ninterpretation V:M_cardinal_arith_jump \\<V>\n  by unfold_locales (auto intro:separation_absolute replacement_absolute\n      simp:wfrec_replacement_def)\n\nlemma choice_ax_Universe: \"choice_ax(\\<V>)\"\nproof -\n  {\n    fix x\n    obtain f where \"f \\<in> surj(|x|,x)\"\n      using cardinal_eqpoll unfolding eqpoll_def bij_def by fast\n    moreover\n    have \"Ord(|x|)\" by simp\n    ultimately\n    have \"\\<exists>a. Ord(a) \\<and> (\\<exists>f. f \\<in> surj(a,x))\"\n      by fast\n  }\n  then\n  show ?thesis  unfolding choice_ax_def rall_def rex_def\n    by simp\nqed\n\ninterpretation V:M_master \\<V>\n  using choice_ax_Universe\n  by unfold_locales (auto intro:separation_absolute replacement_absolute\n      simp:lam_replacement_def transrec_replacement_def wfrec_replacement_def\n      is_wfrec_def M_is_recfun_def)\n\nnamed_theorems V_simps\n\n\\<comment> \\<open>To work systematically, ASCII versions of \"\\_absolute\" theorems as\n    those below are preferable.\\<close>\nlemma eqpoll_rel_absolute[V_simps]: \"x \\<approx>\\<^bsup>\\<V>\\<^esup> y \\<longleftrightarrow> x \\<approx> y\"\n  unfolding eqpoll_def using V.def_eqpoll_rel by auto\n\nlemma cardinal_rel_absolute[V_simps]: \"|x|\\<^bsup>\\<V>\\<^esup> = |x|\"\n  unfolding cardinal_def cardinal_rel_def by (simp add:V_simps)\n\nlemma Card_rel_absolute[V_simps]:\"Card\\<^bsup>\\<V>\\<^esup>(a) \\<longleftrightarrow> Card(a)\"\n  unfolding Card_rel_def Card_def by (simp only:V_simps)\n\nlemma csucc_rel_absolute[V_simps]:\"(a\\<^sup>+)\\<^bsup>\\<V>\\<^esup> = a\\<^sup>+\"\n  unfolding csucc_rel_def csucc_def by (simp add:V_simps)\n\nlemma function_space_rel_absolute[V_simps]:\"x \\<rightarrow>\\<^bsup>\\<V>\\<^esup> y = x \\<rightarrow> y\"\n  using V.function_space_rel_char by (simp add:V_simps)\n\nlemma cexp_rel_absolute[V_simps]:\"x\\<^bsup>\\<up>y,\\<V>\\<^esup> = x\\<^bsup>\\<up>y\\<^esup>\"\n  unfolding cexp_rel_def cexp_def by (simp only:V_simps)\n\nlemma HAleph_rel_absolute[V_simps]:\"HAleph_rel(\\<V>,a,b) = HAleph(a,b)\"\n  unfolding HAleph_rel_def HAleph_def by (auto simp add:V_simps)\n\nlemma Aleph_rel_absolute[V_simps]: \"Ord(x) \\<Longrightarrow> \\<aleph>\\<^bsub>x\\<^esub>\\<^bsup>\\<V>\\<^esup> = \\<aleph>\\<^bsub>x\\<^esub>\"\nproof -\n  assume \"Ord(x)\"\n  have \"\\<aleph>\\<^bsub>x\\<^esub>\\<^bsup>\\<V>\\<^esup> = transrec(x, \\<lambda>a b. HAleph_rel(\\<V>,a,b))\"\n    unfolding Aleph_rel_def by simp\n  also\n  have \"\\<dots> = transrec(x, HAleph)\"\n    by (simp only:V_simps)\n  also from \\<open>Ord(x)\\<close>\n  have \"\\<dots> = \\<aleph>\\<^bsub>x\\<^esub>\"\n    using Aleph'_eq_Aleph unfolding Aleph'_def by simp\n  finally\n  show ?thesis .\nqed\n\ntext\\<open>Example of absolute lemmas obtained from the relative versions.\n    Note the \\<^emph>\\<open>only\\<close> declarations\\<close>\nlemma Ord_cardinal_idem': \"Ord(A) \\<Longrightarrow> ||A|| = |A|\"\n  using V.Ord_cardinal_rel_idem by (simp only:V_simps)\n\nlemma Aleph_succ': \"Ord(\\<alpha>) \\<Longrightarrow> \\<aleph>\\<^bsub>succ(\\<alpha>)\\<^esub> = \\<aleph>\\<^bsub>\\<alpha>\\<^esub>\\<^sup>+\"\n  using V.Aleph_rel_succ by (simp only:V_simps)\n\ntext\\<open>These two results are new, first obtained in relative form\n    (not ported).\\<close>\nlemma csucc_cardinal:\n  assumes \"Ord(\\<kappa>)\" shows \"|\\<kappa>|\\<^sup>+ = \\<kappa>\\<^sup>+\"\n  using assms V.csucc_rel_cardinal_rel by (simp only:V_simps)\n\nlemma csucc_le_mono:\n  assumes \"\\<kappa> \\<le> \\<nu>\"  shows \"\\<kappa>\\<^sup>+ \\<le> \\<nu>\\<^sup>+\"\n  using assms V.csucc_rel_le_mono by (simp only:V_simps)\n\ntext\\<open>Example of transferring results from a transitive model to \\<^term>\\<open>\\<V>\\<close>\\<close>\nlemma (in M_Perm) eqpoll_rel_transfer_absolute:\n  assumes \"M(A)\" \"M(B)\" \"A \\<approx>\\<^bsup>M\\<^esup> B\"\n  shows \"A \\<approx> B\"\nproof -\n  interpret M_N_Perm M \\<V>\n    by (unfold_locales, simp only:V_simps)\n  from assms\n  show ?thesis using eqpoll_rel_transfer\n    by (simp only:V_simps)\nqed\n\ntext\\<open>The “relationalized” $\\CH$ with respect to \\<^term>\\<open>\\<V>\\<close> corresponds\n    to the real $\\CH$.\\<close>\nlemma is_ContHyp_iff_CH: \"is_ContHyp(\\<V>) \\<longleftrightarrow> ContHyp\"\n  using V.is_ContHyp_iff\n  by (auto simp add:ContHyp_rel_def ContHyp_def V_simps)\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Independence_CH/Absolute_Versions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593171945417, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.33791030857354476}}
{"text": "theory TLB\nimports\n  \"HOL-Word.Word\"\n  PTABLE_TLBJ.PageTable_seL4\n  L3_LIBJ.L3_Lib\nbegin\n\n\n\nrecord tlb_flags =\n  nG       :: \"1 word\"  (* nG = 0 means global *) \n  perm_APX :: \"1 word\"  (* Access permission bit 2 *)\n  perm_AP  :: \"2 word\"  (* Access permission bits 1 and 0 *)\n  perm_XN  :: \"1 word\"  (* Execute-never bit *)\n\n\ntype_synonym asid = \"8 word\"\n\n\ndatatype tlb_entry  = EntrySmall   (asid_of :\"asid option\") \"20 word\" \"20 word\"  tlb_flags \n                    | EntrySection (asid_of :\"asid option\") \"12 word\" \"12 word\"  tlb_flags \n\n\ntype_synonym tlb = \"tlb_entry set\"\n\n\n(* polymorphic lookup type   *)\n\ndatatype 'e lookup_type  =  Miss  | Incon  |  Hit 'e\n\ninstantiation lookup_type :: (_) order\nbegin\n  definition\n    less_eq_lookup_type: \"e \\<le> e' \\<equiv> e' = Incon \\<or> e' = e \\<or> e = Miss\"\n\n  definition\n    less_lookup_type: \"e < (e'::'a lookup_type) \\<equiv> e \\<le> e' \\<and> e \\<noteq> e'\"\n\n  instance\n     by intro_classes (auto simp add: less_lookup_type less_eq_lookup_type)\nend\n\nclass entry_op = \n  fixes range_of  ::  \"'a \\<Rightarrow> vaddr set\"\n\nbegin\n\n  \ndefinition\n  entry_set :: \"'a set \\<Rightarrow> vaddr \\<Rightarrow> 'a set\"\nwhere\n  \"entry_set t v \\<equiv> {e\\<in>t. v : range_of e}\"\n\nend\n\n\ndefinition\n  lookup :: \"(vaddr \\<Rightarrow> 'a set ) \\<Rightarrow> vaddr \\<Rightarrow> 'a lookup_type\"\nwhere\n   \"lookup t v \\<equiv> if t v = {} then Miss\n                       else if \\<exists>x. t v = {x} then Hit (the_elem (t v))\n                       else Incon\"\n\n(* access a lookup as \n   \"lookup' t v \\<equiv> lookup (entry_set t) v\"\n*)\n\n\n(* Address translation  *)\n\nfun\n  va_to_pa :: \"vaddr \\<Rightarrow> tlb_entry \\<Rightarrow> paddr\"\nwhere\n  \"va_to_pa va (EntrySmall a vba pba fl)   = Addr ((ucast pba << 12) OR (addr_val va AND mask 12))\"\n| \"va_to_pa va (EntrySection a vba pba fl) = Addr ((ucast pba << 20) OR (addr_val va AND mask 20))\"\n\n\n\ninstantiation tlb_entry ::  entry_op\nbegin\ndefinition\n  \"range_of (e :: tlb_entry) \\<equiv>\n                     case e of EntrySmall a vba pba fl   \\<Rightarrow> Addr ` {(ucast vba) << 12 ..\n                                                                    ((ucast vba) << 12) + (2^12 - 1)}\n                             | EntrySection a vba pba fl \\<Rightarrow>  Addr ` {(ucast vba) << 20 ..\n                                                                      ((ucast vba) << 20) + (2^20 - 1)}\"\n\ninstance ..\nend\n\n\n\n(* page table walk interface *)\n\n\ndefinition\n  to_tlb_flags :: \"arm_perm_bits \\<Rightarrow> tlb_flags\"\nwhere\n  \"to_tlb_flags perms \\<equiv> \\<lparr>nG = arm_p_nG perms, perm_APX = arm_p_APX perms,  perm_AP = arm_p_AP perms, perm_XN = arm_p_XN perms \\<rparr>\"\n\n\ndefinition \"tag_conv (a::8 word) fl \\<equiv> (if  nG fl = 0 then None else Some a)\"\n\n\ndefinition\n  pt_walk :: \"asid \\<Rightarrow> heap \\<Rightarrow> paddr \\<Rightarrow> vaddr \\<Rightarrow>  tlb_entry option\"\nwhere\n  \"pt_walk a hp rt v \\<equiv>\n      case get_pde hp rt v\n       of None                 \\<Rightarrow> None\n       | Some InvalidPDE       \\<Rightarrow> None\n       | Some ReservedPDE      \\<Rightarrow> None\n       | Some (SectionPDE bpa perms) \\<Rightarrow> Some (EntrySection (tag_conv a (to_tlb_flags perms))  (ucast (addr_val v >> 20) :: 12 word)\n                                      ((word_extract 31 20 (addr_val bpa)):: 12 word) \n                                       (to_tlb_flags perms))\n       | Some (PageTablePDE p) \\<Rightarrow>\n               (case get_pte hp p v\n                 of None                     \\<Rightarrow> None\n                 |  Some InvalidPTE          \\<Rightarrow> None\n                 |  Some (SmallPagePTE bpa perms) \\<Rightarrow> Some(EntrySmall (tag_conv a (to_tlb_flags perms)) (ucast (addr_val v >> 12) :: 20 word)\n                                                     ((word_extract 31 12 (addr_val bpa)):: 20 word) \n                                                     (to_tlb_flags perms)))\"\n\n\ndefinition\n  \"is_fault e \\<equiv> (e = None)\"\n\n\n(* Flush operations *)\n\ndatatype flush_type = FlushTLB\n                    | Flushvarange \"vaddr set\"\n                    | FlushASID asid \n                    | FlushASIDvarange  asid \"vaddr set\" \n\ndefinition\n  flush_tlb :: \"tlb  \\<Rightarrow> tlb\"\nwhere\n  \"flush_tlb t  \\<equiv> {}\"\n\ndefinition\n  flush_tlb_vset :: \"tlb \\<Rightarrow> vaddr set \\<Rightarrow> tlb\"\nwhere\n  \"flush_tlb_vset t vset =  t - (\\<Union>v\\<in>vset. {e \\<in> t. v \\<in> range_of e})\"\n\n(* consistency polymorphic defs *)\n\ndefinition\n  consistent0 :: \"(vaddr \\<Rightarrow> 'b lookup_type) \\<Rightarrow> (vaddr \\<Rightarrow> 'b option) \\<Rightarrow> vaddr \\<Rightarrow> bool\"\nwhere\n  \"consistent0  lukup ptwalk  va \\<equiv>\n            (lukup va = Hit (the (ptwalk va)) \\<and> \\<not>is_fault (ptwalk va)) \\<or>  lukup va = Miss\"\n\n\n\nlemma consistent_not_Incon_imp:\n  \"consistent0  lukup ptwalk va \\<Longrightarrow>\n     lukup va \\<noteq> Incon \\<and> (\\<forall>e. lukup va = Hit e \\<longrightarrow> e = the (ptwalk va) \\<and> ptwalk va \\<noteq> None)\"\n  apply (clarsimp simp: consistent0_def is_fault_def) \n  by force\n\nlemma consistent_not_Incon':\n  \"consistent0  lukup ptwalk va =\n  (lukup va \\<noteq> Incon \\<and> (\\<forall>e. lukup va = Hit e \\<longrightarrow> e = the (ptwalk va) \\<and> ptwalk va \\<noteq> None))\"\n  by ((cases \"lukup va\"); simp add: consistent0_def is_fault_def)\n  \n\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/TLB_No_ASID/TLB.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7090191214879992, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.3379040855162247}}
{"text": "(*\n * Copyright (c) 2020, CleanQ Project - Systems Group, ETH Zurich\n * All rights reserved.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n *\n * See \"LICENSE\" for details.\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n\n\nsection \\<open>CleanQ Abstract Concurrent Ring Buffer Model\\<close>\n\ntext \\<open>\n  This model is the concurrent version of the ring buffer. The \\verb+enqueue+ and \\verb+deqeue+\n  operations are executed in two steps and the frame condition needs to be relaxed in order\n  to allow the \"other\" side to take concurrent actions. \n\\<close>\n\ntheory CleanQ_CRBModel_Simpl\n(*<*) \n  imports CleanQ_CRBModel\n          \"../Simpl/Vcg\"\n(*>*)  \nbegin\n\n(* ==================================================================================== *)\nsubsection \\<open>CleanQ Abstract Concurrent Ring Buffer Model State\\<close>\n(* ==================================================================================== *)\n\ntext \\<open>\n  the model is exactly the same and we reuse the RB Model. \n\\<close>\n\n(*<*)\n(* Define some global variables to make Simpl/Complex proofs work *)\nrecord 'g CleanQ_CRB_State_vars = \n  RingCRB_'  :: \"nat CleanQ_RB_State\"\n  b_' :: \"nat\"\n(*>*)\n\n\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>Hoare Triples for the Enqueue Operation\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\n\ntext \\<open>\n  We now show that the \\verb+enqueue+ operation satisfies the pre and post conditions\n  for the predicates P, Q and R. \n\\<close>\n\n\nparagraph \\<open>Writing the Head Element\\<close>\n\ntext \\<open>\n  We show the Hoare triple with \\verb+{P) write_head {Q}+.\n\\<close>\n\nlemma  CleanQ_RB_write_head_x_hoare:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_x_P K \\<acute>RingCRB b \\<rbrace> \n       \\<acute>RingCRB :== (CleanQ_RB_write_head_x b \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_enq_x_Q K \\<acute> RingCRB b \\<rbrace>\"     \n  by(vcg, auto)\n\nlemma  CleanQ_RB_write_head_y_hoare:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_y_P K \\<acute>RingCRB b \\<rbrace> \n       \\<acute>RingCRB :== (CleanQ_RB_write_head_y b \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_enq_y_Q K \\<acute> RingCRB b \\<rbrace>\"                                                 \n  by(vcg, auto)\n\n\nparagraph \\<open>Incrementing the Head Pointer\\<close>\n\ntext \\<open>\n  We show the Hoare triple with \\verb+{Q) incr_head {R}+.\n\\<close>\n\nlemma  CleanQ_RB_incr_head_x_hoare:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_x_Q K \\<acute>RingCRB b \\<rbrace> \n       \\<acute>RingCRB :== (CleanQ_RB_incr_head_x b \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_enq_x_R K \\<acute> RingCRB b \\<rbrace>\"\n  apply(vcg, auto simp:CleanQ_RB_enq_x_inv_all)\n  by (simp add: CleanQ_RB_enq_x_result)\n\n\nlemma  CleanQ_RB_incr_head_y_hoare:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_y_Q K \\<acute>RingCRB b \\<rbrace> \n       \\<acute>RingCRB :== (CleanQ_RB_incr_head_y b \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_enq_y_R K \\<acute> RingCRB b \\<rbrace>\"\n  apply(vcg, auto simp:CleanQ_RB_enq_y_inv_all)\n  by (simp add: CleanQ_RB_enq_y_result)\n\n\nparagraph \\<open>Full Enqueue Operation\\<close>\n\ntext \\<open>\n  We show the Hoare triple with \\verb+{P) enq {R}+.\n\\<close>\n\nlemma CleanQ_RB_enq_x_hoare : \n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_x_P K \\<acute>RingCRB b \\<rbrace> \n       \\<acute>RingCRB :== (CleanQ_RB_write_head_x b \\<acute>RingCRB) ;;\n       \\<acute>RingCRB :== (CleanQ_RB_incr_head_x b \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_enq_x_R K \\<acute>RingCRB b \\<rbrace>\"\n  apply(vcg, auto simp:CleanQ_RB_enq_x_inv_all)\n  using CleanQ_RB_enq_x_result by fastforce\n \n\nlemma CleanQ_RB_enq_y_hoare : \n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_y_P K \\<acute>RingCRB b \\<rbrace> \n       \\<acute>RingCRB :== (CleanQ_RB_write_head_y b \\<acute>RingCRB) ;;\n       \\<acute>RingCRB :== (CleanQ_RB_incr_head_y b \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_enq_y_R K \\<acute>RingCRB b \\<rbrace>\"\n  apply(vcg, auto simp:CleanQ_RB_enq_y_inv_all)\n  using CleanQ_RB_enq_y_result by fastforce\n\n\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>Hoare Triples for the Dequeue Operation\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\n\ntext \\<open>\n  We now show that the \\verb+dequeue+ operation satisfies the pre and post conditions\n  for the predicates P, Q and R. \n\\<close>\n\n\nparagraph \\<open>Reading the Tail Element\\<close>\n\ntext \\<open>\n  We show the Hoare triple with \\verb+{P) read_tail {Q}+.\n\\<close>\n\nlemma  CleanQ_RB_read_tail_x_hoare:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_x_P K \\<acute>RingCRB \\<acute>b \\<rbrace> \n       \\<acute>b :== (CleanQ_RB_read_tail_x \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_deq_x_Q K \\<acute>RingCRB \\<acute>b \\<rbrace>\"  \n  by(vcg)\n\nlemma  CleanQ_RB_read_tail_y_hoare:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_y_P K \\<acute>RingCRB \\<acute>b \\<rbrace> \n       \\<acute>b :== (CleanQ_RB_read_tail_y \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_deq_y_Q K \\<acute>RingCRB \\<acute>b \\<rbrace>\"  \n  by(vcg)\n\n\nparagraph \\<open>Incrementing the Tail Pointer\\<close>\n\ntext \\<open>\n  We show the Hoare triple with \\verb+{Q) incr_tail {R}+.\n\\<close>\n\nlemma  CleanQ_RB_incr_tail_x_hoare:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_x_Q K \\<acute>RingCRB b \\<rbrace> \n       \\<acute>RingCRB :== (CleanQ_RB_incr_tail_x b \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_deq_x_R K \\<acute> RingCRB b \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_deq_x_all_inv)\n\nlemma  CleanQ_RB_incr_tail_y_hoare:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_y_Q K \\<acute>RingCRB b \\<rbrace> \n       \\<acute>RingCRB :== (CleanQ_RB_incr_tail_y b \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_deq_y_R K \\<acute> RingCRB b \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_deq_y_all_inv)\n\n \nparagraph \\<open>Full Dequeue Operation\\<close>\n\ntext \\<open>\n  We show the Hoare triple with \\verb+{P) deq {R}+.\n\\<close>\n\nlemma CleanQ_RB_deq_x_hoare : \n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_x_P K \\<acute>RingCRB \\<acute>b \\<rbrace> \n       \\<acute>b :== (CleanQ_RB_read_tail_x \\<acute>RingCRB) ;;\n       \\<acute>RingCRB :== (CleanQ_RB_incr_tail_x \\<acute>b \\<acute>RingCRB)\n    \\<lbrace> CleanQ_RB_deq_x_R K \\<acute>RingCRB \\<acute>b \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_deq_x_all_inv)\n  \n\nlemma CleanQ_RB_deq_y_hoare : \n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_y_P K \\<acute>RingCRB \\<acute>b \\<rbrace> \n       \\<acute>b :== (CleanQ_RB_read_tail_y \\<acute>RingCRB) ;;\n       \\<acute>RingCRB :== (CleanQ_RB_incr_tail_y \\<acute>b \\<acute>RingCRB)\n     \\<lbrace> CleanQ_RB_deq_y_R K \\<acute>RingCRB \\<acute>b \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_deq_y_all_inv)\n\n\n(* ==================================================================================== *)\nsubsection \\<open>Interference pairs\\<close>\n(* ==================================================================================== *)\n\n\ntext \\<open>\n  We are now showing the interference proofs for the different step. There are two threads\n  in the system, each of which can execute the enqueue and dequeue operations independently.\n  \n  The system looks like this:\n\n    \\verb+ (enq_x | deq_x)  ||  (enq_y | deq_y)+\n\n  While each of the four operations consists of two steps. reading/writing the buffer slot\n  and updating the head/tail pointer respectively.\n\n  We fix one side (X) and show that the other side cannot interfere with each of the\n  possible interference pairs. The correctness of the other side follows by symmetry.\n\\<close>\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>Enqueue X, Enqueue Y\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\<open> \n  The Enqueue operation has the form: \\verb+{P} write_head {Q} increment_head {R}+.\n  We show, that the predicates of the Hoare triples remain valid, regardless of the \n  operation of the other side.\n\\<close>\n\n\nparagraph \\<open>Y writes the descriptor ring\\<close>\n\nlemma CleanQ_CRB_Enqueue_X_P_write_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_x_P K \\<acute>RingCRB bx \\<rbrace> \n      \\<acute>RingCRB :== CleanQ_RB_write_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_enq_x_P K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto)  \n\nlemma CleanQ_CRB_Enqueue_X_Q_write_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_x_Q K \\<acute>RingCRB bx \\<rbrace> \n      \\<acute>RingCRB :== CleanQ_RB_write_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_enq_x_Q K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto) \n\nlemma CleanQ_CRB_Enqueue_X_R_write_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_x_R K \\<acute>RingCRB bx \\<rbrace> \n      \\<acute>RingCRB :== CleanQ_RB_write_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_enq_x_R K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto)  \n\n\nparagraph \\<open>Y increments the head\\<close>\n\nlemma CleanQ_CRB_Enqueue_X_P_incr_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_y_Q K \\<acute>RingCRB b \\<and>  CleanQ_RB_enq_x_P K \\<acute>RingCRB bx \\<rbrace> \n     \\<acute>RingCRB :== CleanQ_RB_incr_head_y b \\<acute>RingCRB\n    \\<lbrace> CleanQ_RB_enq_x_P K \\<acute>RingCRB bx  \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_enq_y_enq_x_possible CleanQ_RB_enq_y_inv_all)\n\nlemma CleanQ_CRB_Enqueue_X_Q_incr_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_y_Q K \\<acute>RingCRB b \\<and>  CleanQ_RB_enq_x_Q K \\<acute>RingCRB bx \\<rbrace> \n     \\<acute>RingCRB :== CleanQ_RB_incr_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_enq_x_Q K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto simp: CleanQ_RB_enq_y_inv_all CleanQ_RB_enq_y_enq_x_possible)\n  \nlemma CleanQ_CRB_Enqueue_X_R_incr_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_y_Q K \\<acute>RingCRB b \\<and>  CleanQ_RB_enq_x_R K \\<acute>RingCRB bx \\<rbrace> \n     \\<acute>RingCRB :== CleanQ_RB_incr_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_enq_x_R K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto simp: CleanQ_RB_enq_y_inv_all CleanQ_RB_enq_y_def)\n\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>Enqueue X, Dequeue X\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\nparagraph \\<open>Y reads the descriptor ring\\<close>\n\nlemma CleanQ_CRB_Enqueue_X_P_read_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_x_P K \\<acute>RingCRB bx  \\<rbrace> \n       \\<acute>b :== CleanQ_RB_read_tail_y \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_enq_x_P K \\<acute>RingCRB bx  \\<rbrace>\"\n  by(vcg)\n\nlemma CleanQ_CRB_Enqueue_X_Q_read_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_x_Q K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>b :== CleanQ_RB_read_tail_y \\<acute>RingCRB\n    \\<lbrace> CleanQ_RB_enq_x_Q K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg)\n\nlemma CleanQ_CRB_Enqueue_X_R_read_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_x_R K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>b :== CleanQ_RB_read_tail_y \\<acute>RingCRB\n    \\<lbrace> CleanQ_RB_enq_x_R K \\<acute>RingCRB bx \\<rbrace>\"\n   by(vcg)\n\n\nparagraph \\<open>Y increments the tail pointer\\<close>\n\nlemma CleanQ_CRB_Enqueue_X_P_incr_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_y_Q K \\<acute>RingCRB b \\<and> CleanQ_RB_enq_x_P K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>RingCRB  :== CleanQ_RB_incr_tail_y b  \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_enq_x_P K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_deq_y_all_inv CleanQ_RB_deq_y_enq_x_possible )  \n\n\nlemma CleanQ_CRB_Enqueue_X_Q_incr_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_y_Q K \\<acute>RingCRB b \\<and> CleanQ_RB_enq_x_Q K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>RingCRB  :== CleanQ_RB_incr_tail_y b  \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_enq_x_Q K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_deq_y_all_inv CleanQ_RB_deq_y_enq_x_possible)\n  \n\nlemma CleanQ_CRB_Enqueue_X_R_incr_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_y_Q K \\<acute>RingCRB b \\<and> CleanQ_RB_enq_x_R K \\<acute>RingCRB bx  \\<rbrace> \n       \\<acute>RingCRB  :== CleanQ_RB_incr_tail_y b  \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_enq_x_R K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_deq_y_all_inv CleanQ_RB_deq_y_enq_x_possible )\n\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>Dequeue X, Enqueue Y\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\nparagraph \\<open>Y writes the descriptor ring\\<close>\n\nlemma CleanQ_CRB_Dequeue_X_P_write_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_x_P K \\<acute>RingCRB bx \\<rbrace> \n     \\<acute>RingCRB :== CleanQ_RB_write_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_deq_x_P K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto)\n\nlemma CleanQ_CRB_Dequeue_X_Q_write_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_x_Q K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>RingCRB :== CleanQ_RB_write_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_deq_x_Q K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto)\n  \nlemma CleanQ_CRB_Dequeue_X_R_write_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_x_R K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>RingCRB :== CleanQ_RB_write_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_deq_x_R K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto)\n\n\nparagraph \\<open>Y increments the head pointer\\<close>\n\nlemma CleanQ_CRB_Dequeue_X_P_incr_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_y_Q K \\<acute>RingCRB b \\<and> CleanQ_RB_deq_x_P K \\<acute>RingCRB b \\<rbrace> \n       \\<acute>RingCRB :== CleanQ_RB_incr_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_deq_x_P K \\<acute>RingCRB b \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_enq_y_inv_all CleanQ_RB_enq_y_deq_x_possible)\n  \nlemma CleanQ_CRB_Dequeue_X_Q_incr_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_y_Q K \\<acute>RingCRB b \\<and> CleanQ_RB_deq_x_Q K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>RingCRB :== CleanQ_RB_incr_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_deq_x_Q K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_enq_y_inv_all CleanQ_RB_enq_y_deq_x_possible) \n  \n \nlemma CleanQ_CRB_Dequeue_X_R_incr_head:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_enq_y_Q K \\<acute>RingCRB b \\<and> CleanQ_RB_deq_x_R K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>RingCRB :== CleanQ_RB_incr_head_y b \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_deq_x_R K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_enq_y_inv_all)\n  \n  \n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>Dequeue X, Dequeue X\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\n\nparagraph \\<open>Y reads the descriptor ring\\<close>\n\nlemma CleanQ_CRB_Dequeue_X_P_read_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_x_P K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>b :== CleanQ_RB_read_tail_y \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_deq_x_P K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg)\n\nlemma CleanQ_CRB_Dequeue_X_Q_read_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_x_Q K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>b :== CleanQ_RB_read_tail_y \\<acute>RingCRB  \n    \\<lbrace> CleanQ_RB_deq_x_Q K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg)\n  \nlemma CleanQ_CRB_Dequeue_X_R_read_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_x_R K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>b :== CleanQ_RB_read_tail_y \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_deq_x_R K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg)\n\n\nparagraph \\<open>Y increments the tail pointer\\<close>\n\nlemma CleanQ_CRB_Dequeue_X_P_incr_tail:\n\"\\<Gamma>\\<turnstile>\\<lbrace> CleanQ_RB_deq_y_Q K \\<acute>RingCRB by \\<and> CleanQ_RB_deq_x_P K \\<acute>RingCRB bx \\<rbrace> \n      \\<acute>RingCRB :== CleanQ_RB_incr_tail_y by \\<acute>RingCRB \n   \\<lbrace> CleanQ_RB_deq_x_P K \\<acute>RingCRB bx  \\<rbrace>\"\n  by(vcg, auto simp: CleanQ_RB_deq_y_deq_x_possible CleanQ_RB_deq_y_all_inv)\n\nlemma CleanQ_CRB_Dequeue_X_Q_incr_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_y_Q K \\<acute>RingCRB by \\<and> CleanQ_RB_deq_x_Q K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>RingCRB :== CleanQ_RB_incr_tail_y by \\<acute>RingCRB   \n    \\<lbrace> CleanQ_RB_deq_x_Q K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_deq_y_all_inv CleanQ_RB_deq_y_deq_x_possible)\n\nlemma CleanQ_CRB_Dequeue_X_R_incr_tail:\n\"\\<Gamma>\\<turnstile> \\<lbrace> CleanQ_RB_deq_y_Q K \\<acute>RingCRB by \\<and> CleanQ_RB_deq_x_R K \\<acute>RingCRB bx \\<rbrace> \n       \\<acute>RingCRB :== CleanQ_RB_incr_tail_y by \\<acute>RingCRB \n    \\<lbrace> CleanQ_RB_deq_x_R K \\<acute>RingCRB bx \\<rbrace>\"\n  by(vcg, auto simp:CleanQ_RB_deq_y_all_inv)\n\n\nend ", "meta": {"author": "CleanQ-Project", "repo": "cleanq-proofs", "sha": "5212fcd2aceba0028bd1474e0553578a6091ca63", "save_path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs", "path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs/cleanq-proofs-5212fcd2aceba0028bd1474e0553578a6091ca63/CleanQ/CleanQ_CRBModel_Simpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.33789321322648014}}
{"text": "(*  Title:       Mutually recursive procedures\n    Author:      Tobias Nipkow, 2001/2006\n    Maintainer:  Tobias Nipkow\n*)\n\nsection \"Hoare Logics for Mutually Recursive Procedure\"\n\ntheory PsLang imports Main begin\n\nsubsection\\<open>The language\\<close>\n\ntypedecl state\ntypedecl pname\n\ntype_synonym bexp = \"state \\<Rightarrow> bool\"\n\ndatatype\n  com = Do \"state \\<Rightarrow> state set\"\n      | Semi  com com          (\"_; _\"  [60, 60] 10)\n      | Cond  bexp com com     (\"IF _ THEN _ ELSE _\"  60)\n      | While bexp com         (\"WHILE _ DO _\"  60)\n      | CALL pname\n      | Local \"(state \\<Rightarrow> state)\" com \"(state \\<Rightarrow> state \\<Rightarrow> state)\"\n               (\"LOCAL _; _; _\" [0,0,60] 60)\n\nconsts body :: \"pname \\<Rightarrow> com\"\n\ntext\\<open>We generalize from a single procedure to a whole set of\nprocedures following the ideas of von Oheimb~\\<^cite>\\<open>\"Oheimb-FSTTCS99\"\\<close>.\nThe basic setup is modified only in a few places:\n\\begin{itemize}\n\\item We introduce a new basic type @{typ pname} of procedure names.\n\\item Constant @{term body} is now of type @{typ\"pname \\<Rightarrow> com\"}.\n\\item The @{term CALL} command now has an argument of type @{typ pname},\nthe name of the procedure that is to be called.\n\\end{itemize}\n\\<close>\n\ninductive\n  exec :: \"state \\<Rightarrow> com \\<Rightarrow> state \\<Rightarrow> bool\"   (\"_/ -_\\<rightarrow>/ _\" [50,0,50] 50)\nwhere\n    Do:     \"t \\<in> f s \\<Longrightarrow> s -Do f\\<rightarrow> t\"\n\n  | Semi:   \"\\<lbrakk> s0 -c1\\<rightarrow> s1; s1 -c2\\<rightarrow> s2 \\<rbrakk> \\<Longrightarrow> s0 -c1;c2\\<rightarrow> s2\"\n\n  | IfTrue:  \"\\<lbrakk> b s;  s -c1\\<rightarrow> t \\<rbrakk> \\<Longrightarrow> s -IF b THEN c1 ELSE c2\\<rightarrow> t\"\n  | IfFalse: \"\\<lbrakk> \\<not>b s; s -c2\\<rightarrow> t \\<rbrakk> \\<Longrightarrow> s -IF b THEN c1 ELSE c2\\<rightarrow> t\"\n\n  | WhileFalse: \"\\<not>b s \\<Longrightarrow> s -WHILE b DO c\\<rightarrow> s\"\n  | WhileTrue:  \"\\<lbrakk> b s; s -c\\<rightarrow> t; t -WHILE b DO c\\<rightarrow> u \\<rbrakk>\n                \\<Longrightarrow> s -WHILE b DO c\\<rightarrow> u\"\n\n  | Call: \"s -body p\\<rightarrow> t \\<Longrightarrow> s -CALL p\\<rightarrow> t\"\n\n  | Local: \"f s -c\\<rightarrow> t \\<Longrightarrow> s -LOCAL f; c; g\\<rightarrow> g s t\"\n\n\n\nlemma [iff]: \"(s -c;d\\<rightarrow> u) = (\\<exists>t. s -c\\<rightarrow> t \\<and> t -d\\<rightarrow> u)\"\nby(auto elim: exec.cases intro:exec.intros)\n\nlemma [iff]: \"(s -IF b THEN c ELSE d\\<rightarrow> t) =\n              (s -if b s then c else d\\<rightarrow> t)\"\napply(rule iffI)\n apply(auto elim: exec.cases intro:exec.intros)\napply(auto intro:exec.intros split:if_split_asm)\ndone\n\nlemma [iff]: \"(s -CALL p\\<rightarrow> t) = (s -body p\\<rightarrow> t)\"\nby(blast elim: exec.cases intro:exec.intros)\n\nlemma [iff]: \"(s -LOCAL f; c; g\\<rightarrow> u) = (\\<exists>t. f s -c\\<rightarrow> t \\<and> u = g s t)\"\nby(fastforce elim: exec.cases intro:exec.intros)\n\ninductive\n  execn :: \"state \\<Rightarrow> com \\<Rightarrow> nat \\<Rightarrow> state \\<Rightarrow> bool\"   (\"_/ -_-_\\<rightarrow>/ _\" [50,0,0,50] 50)\nwhere\n    Do:     \"t \\<in> f s \\<Longrightarrow> s -Do f-n\\<rightarrow> t\"\n\n  | Semi:   \"\\<lbrakk> s0 -c0-n\\<rightarrow> s1; s1 -c1-n\\<rightarrow> s2 \\<rbrakk> \\<Longrightarrow> s0 -c0;c1-n\\<rightarrow> s2\"\n\n  | IfTrue: \"\\<lbrakk> b s; s -c0-n\\<rightarrow> t \\<rbrakk> \\<Longrightarrow> s -IF b THEN c0 ELSE c1-n\\<rightarrow> t\"\n\n  | IfFalse: \"\\<lbrakk> \\<not>b s; s -c1-n\\<rightarrow> t \\<rbrakk> \\<Longrightarrow> s -IF b THEN c0 ELSE c1-n\\<rightarrow> t\"\n\n  | WhileFalse: \"\\<not>b s \\<Longrightarrow> s -WHILE b DO c-n\\<rightarrow> s\"\n\n  | WhileTrue:  \"\\<lbrakk> b s; s -c-n\\<rightarrow> t; t -WHILE b DO c-n\\<rightarrow> u \\<rbrakk>\n                \\<Longrightarrow> s -WHILE b DO c-n\\<rightarrow> u\"\n\n  | Call:  \"s -body p-n\\<rightarrow> t \\<Longrightarrow> s -CALL p-Suc n\\<rightarrow> t\"\n\n  | Local: \"f s -c-n\\<rightarrow> t \\<Longrightarrow> s -LOCAL f; c; g-n\\<rightarrow> g s t\"\n\nlemma [iff]: \"(s -Do f-n\\<rightarrow> t) = (t \\<in> f s)\"\nby(auto elim: execn.cases intro:execn.intros)\n\nlemma [iff]: \"(s -c1;c2-n\\<rightarrow> u) = (\\<exists>t. s -c1-n\\<rightarrow> t \\<and> t -c2-n\\<rightarrow> u)\"\nby(best elim: execn.cases intro:execn.intros)\n\nlemma [iff]: \"(s -IF b THEN c ELSE d-n\\<rightarrow> t) =\n              (s -if b s then c else d-n\\<rightarrow> t)\"\napply auto\napply(blast elim: execn.cases intro:execn.intros)+\ndone\n\nlemma [iff]: \"(s -CALL p- 0\\<rightarrow> t) = False\"\nby(blast elim: execn.cases intro:execn.intros)\n\nlemma [iff]: \"(s -CALL p-Suc n\\<rightarrow> t) = (s -body p-n\\<rightarrow> t)\"\nby(blast elim: execn.cases intro:execn.intros)\n\nlemma [iff]: \"(s -LOCAL f; c; g-n\\<rightarrow> u) = (\\<exists>t. f s -c-n\\<rightarrow> t \\<and> u = g s t)\"\nby(auto elim: execn.cases intro:execn.intros)\n\n\nlemma exec_mono[rule_format]: \"s -c-m\\<rightarrow> t \\<Longrightarrow> \\<forall>n. m \\<le> n \\<longrightarrow> s -c-n\\<rightarrow> t\"\napply(erule execn.induct)\n       apply(blast)\n      apply(blast)\n     apply(simp)\n    apply(simp)\n   apply(simp add:execn.intros)\n  apply(blast intro:execn.intros)\n apply(clarify)\n apply(rename_tac m)\n apply(case_tac m)\n  apply simp\n apply simp\napply blast\ndone\n\nlemma exec_iff_execn: \"(s -c\\<rightarrow> t) = (\\<exists>n. s -c-n\\<rightarrow> t)\"\napply(rule iffI)\n apply(erule exec.induct)\n        apply blast\n       apply clarify\n       apply(rename_tac m n)\n       apply(rule_tac x = \"max m n\" in exI)\n       apply(fastforce intro:exec.intros exec_mono simp add:max_def)\n      apply fastforce\n     apply fastforce\n    apply(blast intro:execn.intros)\n   apply clarify\n   apply(rename_tac m n)\n   apply(rule_tac x = \"max m n\" in exI)\n   apply(fastforce elim:execn.WhileTrue exec_mono simp add:max_def)\n  apply blast\n apply blast\napply(erule exE, erule execn.induct)\n       apply blast\n      apply blast\n     apply fastforce\n    apply fastforce\n   apply(erule exec.WhileFalse)\n  apply(blast intro: exec.intros)\n apply blast\napply blast\ndone\n\nlemma while_lemma[rule_format]:\n\"s -w-n\\<rightarrow> t \\<Longrightarrow> \\<forall>b c. w = WHILE b DO c \\<and> P s \\<and>\n                    (\\<forall>s s'. P s \\<and> b s \\<and> s -c-n\\<rightarrow> s' \\<longrightarrow> P s') \\<longrightarrow> P t \\<and> \\<not>b t\"\napply(erule execn.induct)\napply clarify+\ndefer\napply clarify+\napply(subgoal_tac \"P t\")\napply blast\napply blast\ndone\n\nlemma while_rule:\n \"\\<lbrakk>s -WHILE b DO c-n\\<rightarrow> t; P s; \\<And>s s'. \\<lbrakk>P s; b s; s -c-n\\<rightarrow> s' \\<rbrakk> \\<Longrightarrow> P s'\\<rbrakk>\n  \\<Longrightarrow> P t \\<and> \\<not>b t\"\napply(drule while_lemma)\nprefer 2 apply assumption\napply blast\ndone\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Abstract-Hoare-Logics/Procs/PsLang.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.33789320471723494}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      Generalise.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2005-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\ntheory Generalise imports \"~~/src/HOL/Statespace/DistinctTreeProver\"\nbegin\n\nlemma protectRefl: \"PROP Pure.prop (PROP C) \\<Longrightarrow> PROP Pure.prop (PROP C)\"\n  by (simp add: prop_def)\n\nlemma protectImp: \n assumes i: \"PROP Pure.prop (PROP P \\<Longrightarrow> PROP Q)\" \n shows \"PROP Pure.prop (PROP Pure.prop P \\<Longrightarrow> PROP Pure.prop Q)\"\nproof -\n  {\n    assume P: \"PROP Pure.prop P\"\n    from i [unfolded prop_def, OF P [unfolded prop_def]] \n    have \"PROP Pure.prop Q\"\n      by (simp add: prop_def)\n  }\n  note i' = this\n  show \"PROP ?thesis\" \n    apply (rule protectI)\n    apply (rule i')\n    apply assumption\n    done\nqed\n\n\nlemma generaliseConj: \n  assumes i1: \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\<Longrightarrow> PROP Pure.prop (Trueprop Q))\"\n  assumes i2: \"PROP Pure.prop (PROP Pure.prop (Trueprop P') \\<Longrightarrow> PROP Pure.prop (Trueprop Q'))\"\n  shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (P \\<and> P')) \\<Longrightarrow> (PROP Pure.prop (Trueprop (Q \\<and> Q'))))\"\n  using i1 i2\n  by (auto simp add: prop_def)\n\nlemma generaliseAll: \n assumes i: \"PROP Pure.prop (\\<And>s. PROP Pure.prop (Trueprop (P s)) \\<Longrightarrow> PROP Pure.prop (Trueprop (Q s)))\" \n shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (\\<forall>s. P s)) \\<Longrightarrow> PROP Pure.prop (Trueprop (\\<forall>s. Q s)))\"\n  using i\n  by (auto simp add: prop_def)\n\nlemma generalise_all: \n assumes i: \"PROP Pure.prop (\\<And>s. PROP Pure.prop (PROP P s) \\<Longrightarrow> PROP Pure.prop (PROP Q s))\" \n shows \"PROP Pure.prop ((PROP Pure.prop (\\<And>s. PROP P s)) \\<Longrightarrow> (PROP Pure.prop (\\<And>s. PROP Q s)))\"\n  using i\n  proof (unfold prop_def)\n    assume i1: \"\\<And>s. (PROP P s) \\<Longrightarrow> (PROP Q s)\"\n    assume i2: \"\\<And>s. PROP P s\"\n    show \"\\<And>s. PROP Q s\"\n      by (rule i1) (rule i2)\n  qed\n\nlemma generaliseTrans: \n  assumes i1: \"PROP Pure.prop (PROP P \\<Longrightarrow> PROP Q)\"\n  assumes i2: \"PROP Pure.prop (PROP Q \\<Longrightarrow> PROP R)\" \n  shows \"PROP Pure.prop (PROP P \\<Longrightarrow> PROP R)\"\n  using i1 i2\n  proof (unfold prop_def)\n    assume P_Q: \"PROP P \\<Longrightarrow> PROP Q\" \n    assume Q_R: \"PROP Q \\<Longrightarrow> PROP R\" \n    assume P: \"PROP P\"\n    show \"PROP R\"\n      by (rule Q_R [OF P_Q [OF P]])\n  qed\n\nlemma meta_spec:\n  assumes \"\\<And>x. PROP P x\"\n  shows \"PROP P x\" by fact\n\nlemma meta_spec_protect:\n  assumes g: \"\\<And>x. PROP P x\"\n  shows \"PROP Pure.prop (PROP P x)\"\nusing g\nby (auto simp add: prop_def)\n\nlemma generaliseImp: \n  assumes i: \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\<Longrightarrow> PROP Pure.prop (Trueprop Q))\"\n  shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (X \\<longrightarrow> P)) \\<Longrightarrow> PROP Pure.prop (Trueprop (X \\<longrightarrow> Q)))\"\n  using i\n  by (auto simp add: prop_def)\n\nlemma generaliseEx: \n assumes i: \"PROP Pure.prop (\\<And>s. PROP Pure.prop (Trueprop (P s)) \\<Longrightarrow> PROP Pure.prop (Trueprop (Q s)))\" \n shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (\\<exists>s. P s)) \\<Longrightarrow> PROP Pure.prop (Trueprop (\\<exists>s. Q s)))\"\n  using i\n  by (auto simp add: prop_def)\n\n\nlemma generaliseRefl: \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\<Longrightarrow> PROP Pure.prop (Trueprop P))\"\n  by (auto simp add: prop_def)\n\nlemma generaliseRefl': \"PROP Pure.prop (PROP P \\<Longrightarrow> PROP P)\"\n  by (auto simp add: prop_def)\n\nlemma generaliseAllShift:\n  assumes i: \"PROP Pure.prop (\\<And>s. P \\<Longrightarrow> Q s)\"\n  shows \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\<Longrightarrow> PROP Pure.prop (Trueprop (\\<forall>s. Q s)))\"\n  using i\n  by (auto simp add: prop_def)\n\nlemma generalise_allShift:\n  assumes i: \"PROP Pure.prop (\\<And>s. PROP P \\<Longrightarrow> PROP Q s)\"\n  shows \"PROP Pure.prop (PROP Pure.prop (PROP P) \\<Longrightarrow> PROP Pure.prop (\\<And>s. PROP Q s))\"\n  using i\n  proof (unfold prop_def)\n    assume P_Q: \"\\<And>s. PROP P \\<Longrightarrow> PROP Q s\" \n    assume P: \"PROP P\"\n    show \"\\<And>s. PROP Q s\"\n      by (rule P_Q [OF P])\n  qed\n\n\nlemma generaliseImpl:\n  assumes i: \"PROP Pure.prop (PROP Pure.prop P \\<Longrightarrow> PROP Pure.prop Q)\"\n  shows \"PROP Pure.prop ((PROP Pure.prop (PROP X \\<Longrightarrow> PROP P)) \\<Longrightarrow> (PROP Pure.prop (PROP X \\<Longrightarrow> PROP Q)))\"\n  using i\n  proof (unfold prop_def)\n    assume i1: \"PROP P \\<Longrightarrow> PROP Q\"\n    assume i2: \"PROP X \\<Longrightarrow> PROP P\"\n    assume X: \"PROP X\"\n    show \"PROP Q\"\n      by (rule i1 [OF i2 [OF X]])\n  qed\n\n\nML_file \"generalise_state.ML\"\n\nend\n\n", "meta": {"author": "CompSoftVer", "repo": "CSim", "sha": "816d36b7523796ace031c429003d82e9244eff9c", "save_path": "github-repos/isabelle/CompSoftVer-CSim", "path": "github-repos/isabelle/CompSoftVer-CSim/CSim-816d36b7523796ace031c429003d82e9244eff9c/CSimpl/Generalise.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.33789320471723494}}
{"text": "(*  Title:       The Relational Method with Message Anonymity for the Verification of Cryptographic Protocols\n    Author:      Pasquale Noce\n                 Software Engineer at HID Global, Italy\n                 pasquale dot noce dot lavoro at gmail dot com\n                 pasquale dot noce at hidglobal dot com\n*)\n\nsection \"The relational method and message anonymity\"\n\ntheory Definitions\n  imports Main\nbegin\n\ntext \\<open>\n\\null\n\n\\emph{This paper is dedicated to my mother, my favourite chess opponent -- in addition to being many\nother wonderful things!}\n\\<close>\n\n\nsubsection \"Introduction\"\n\ntext \\<open>\nAs Bertrand Russell says in the last pages of \\emph{A History of Western Philosophy}, a distinctive\nfeature of science is that \"we can make successive approximations to the truth, in which each new\nstage results from an improvement, not a rejection, of what has gone before\". When dealing with a\nformal verification method for information processing systems, such as Paulson's inductive method\nfor the verification of cryptographic protocols (cf. @{cite \"Paulson98\"}, @{cite \"Paulson20\"}), a\nmore modest goal for this iterative improvement process, yet of significant practical importance, is\nto streamline the definitions and proofs needed to model such a system and verify its properties.\n\nWith this aim, specially when it comes to verifying protocols using public key cryptography, this\npaper proposes an enhancement of the inductive method, named \\emph{relational method} for reasons\nclarified in what follows, and puts it into practice by verifying a sample protocol. This new method\nis the result of some changes to the way how events, states, spy's capabilities, and the protocol\nitself are formalized in the inductive method. Here below is a description of these changes, along\nwith a rationale for them.\n\n  \\<^descr>[Events.] In the inductive method, the fundamental building blocks of cryptographic protocols are\nevents of the form @{text \"Says A B X\"}, where @{text X} is a message being exchanged, @{text A} is\nthe agent that sends it, and @{text B} is the agent to which it is addressed.\n\\\\However, any exchanged message can be intercepted by the spy and forwarded to any other agent, so\nits intended recipient is not relevant for the protocol \\emph{security} correctness -- though of\ncourse being relevant for the protocol \\emph{functional} correctness. Moreover, a legitimate agent\nmay also generate messages, e.g. ephemeral private keys, that she will never exchange with any other\nagent. To model such an event, a datatype constructor other than @{text Says} should be used. How to\nmake things simpler?\n\\\\The solution adopted in the relational method is to model events just as ordered pairs of the form\n@{text \"(A, X)\"}, where @{text A} is an agent and @{text X} is a message. If event @{text \"(A, X)\"}\nstands for @{text A}'s sending of @{text X} to another agent, where @{text A} is a legitimate agent,\nthen this event will be accompanied by event @{text \"(Spy, X)\"}, representing the spy's interception\nof @{text X}. If event @{text \"(A, X)\"} rather stands for @{text A}'s generation of private message\n@{text X}, e.g. an ephemeral private key, for her own exclusive use -- and if the spy has not hacked\n@{text A} so as to steal her private messages as well --, then no companion event @{text \"(Spy, X)\"}\nwill occur instead.\n\n  \\<^descr>[States.] In the inductive method, the possible states of a cryptographic protocol are modeled as\nevent \\emph{traces}, i.e. lists, and the protocol itself is formalized as a set of such traces.\nConsequently, the protocol rules and security properties are expressed as formulae satisfied by any\nevent trace @{text evs} belonging to this set.\n\\\\However, these formulae are such that their truth values depend only on the events contained in\n@{text evs}, rather than on the actual order in which they occur -- in fact, robust protocol rules\nand security properties cannot depend on the exact sequence of message exchanges in a scenario where\nthe spy can freely intercept and forward messages, or even generate and send her own ones. Thus, one\nlibrary function, @{const set}, and two custom recursive functions, @{text used} and @{text knows},\nare needed to convert event traces into event sets and message sets, respectively.\n\\\\In the relational method, protocol states are simply modeled as event sets, so that the occurrence\nof event @{text \"(A, X)\"} in state @{text s} can be expressed as the transition to the augmented\nstate @{term \"insert (A, X) s\"}. Hence, states consist of relations between agents and messages. As\na result, function @{const set} need not be used any longer, whereas functions @{text used} and\n@{text spied} -- the latter one being a replacement for @{text \"knows Spy\"} --, which take a state\n@{text s} as input, are mere abbreviations for @{term \"Range s\"} and @{term \"s `` {Spy}\"}.\n\n  \\<^descr>[Spy's capabilities.] In the inductive method, the spy's attack capabilities are formalized via\ntwo inductively defined functions, @{text analz} and @{text synth}, used to construct the sets of\nall the messages that the spy can learn -- @{text \"analz (knows Spy evs)\"} -- and send to legitimate\nagents -- @{text \"synth (analz (knows Spy evs))\"} -- downstream of event trace @{text evs}.\n\\\\Indeed, the introduction of these functions goes in the direction of decoupling the formalization\nof the spy's capabilities from that of the protocol itself, consistently with the fact that what the\nspy can do is independent of how the protocol works -- which only matters when it comes to verifying\nprotocol security.\n\\\\In principle, this promises to provide a relevant benefit: these functions need to be defined, and\ntheir properties to be proven, just once, whereupon such definitions and properties can be reused in\nthe formalization and verification of whatever protocol.\n\\\\In practice, since both functions are of type @{text \"msg set \\<Rightarrow> msg set\"}, where @{text msg} is\nthe datatype defining all possible message formats, this benefit only applies as long as message\nformats remain unchanged. However, when it comes to verifying a protocol making use of public key\ncryptography, some new message format, and consequently some new related spy's capability as well,\nare likely to be required. An example of this will be provided right away by the protocol considered\nin this paper.\n\\\\In the relational method, the representation of events as agent-message pairs offers a simpler way\nto model the spy's capabilities, namely as supplementary protocol rules, analogous to the inductive\nmethod's @{text Fake} rule, augmenting a state by one or more events of the form @{text \"(Spy, X)\"}.\nIn addition to eliminating the need for functions @{text analz} and @{text synth} -- which, in light\nof the above considerations, does not significantly harm reusability --, this choice also abolishes\nany distinction between what the spy can learn and what she can send. In fact, a state containing\nevent @{text \"(Spy, X)\"} is interpreted as one where the spy both knows message @{text X} and may\nhave sent it to whatever legitimate agent. Actually, this formalizes the facts that a real-world\nattacker is free to send any message she has learned to any other party, and conversely to use any\nmessage she has generated to further augment her knowledge.\n\\\\In the inductive method, the former fact is modeled by property @{term \"H \\<subseteq> synth H\"} of function\n@{text synth}, but the latter one has no formal counterpart, as in general @{term \"H \\<subset> synth H\"}.\nThis limitation on the spy's capabilities is not significant as long as the protocol makes use of\nstatic keys only, but it is if session keys or ephemeral key pairs are generated -- as happens in\nkey establishment protocols, even in those using symmetric cryptography alone. In any such case, a\nrealistic spy must also be able to learn from anything she herself has generated, such as a nonce or\nan ephemeral private key -- a result achieved without effort in the relational method.\n\\\\An additional, nontrivial problem for the inductive method is that many protocols, including key\nestablishment ones, require the spy to be able to generate \\emph{fresh} ephemeral messages only, as\notherwise the spy could succeed in breaking the protocol by just guessing the ephemeral messages\nalready generated at random by some legitimate agent -- a quite unrealistic attack pattern, provided\nthat such messages vary in a sufficiently wide range. At first glance, this need could be addressed\nby extending the inductive definition of function @{text synth} with introduction rules of the form\n@{term \"Nonce n \\<notin> H \\<Longrightarrow> Nonce n \\<in> synth H\"} or @{term \"PriKey A \\<notin> H \\<Longrightarrow> PriKey A \\<in> synth H\"}.\nHowever, private ephemeral messages are not in general included in @{text \"analz (knows Spy evs)\"},\nsince nonces may be encrypted with uncompromised keys when exchanged and private keys are usually\nnot exchanged at all, so this approach would not work. The only satisfactory alternative would be to\nchange the signature of function @{text synth}, e.g. by adding a second input message set @{text H'}\nstanding for @{text \"used evs\"}, or else by replacing @{text H} with event trace @{text evs} itself,\nbut this would render the function definition much more convoluted -- a problem easily bypassed in\nthe relational method.\n\n  \\<^descr>[Protocol.] In the inductive method, a cryptographic protocol consists of an inductively defined\nset of event traces. This enables to prove the protocol security properties by induction using the\ninduction rule automatically generated as a result of such an inductive definition, i.e. by means of\n\\emph{rule induction}. Actually, this feature is exactly what gives the method its very name. Hence,\na consistent way to name a protocol verification method using some other form of induction would be\nto replace adjective \"inductive\" with another one referring to that form of induction.\n\\\\The relational method owes its name to this consideration. In this method, the introduction rules\ndefining \\emph{protocol rules}, i.e. the possible transitions between protocol states, are replaced\nwith \\emph{relations} between states, henceforth named \\emph{protocol relations}. That is, for any\ntwo states @{text s} and @{text s'}, there exists a transition leading from @{text s} to @{text s'}\njust in case the ordered pair @{term \"(s, s')\"} is contained in at least one protocol relation --\na state of affairs denoted using infix notation @{text \"s \\<turnstile> s'\"}. Then, the inductively defined set\nitself is replaced with the \\emph{reflexive transitive closure} of the union of protocol relations.\nNamely, any state @{text s} may be reached from \\emph{initial state} @{text s\\<^sub>0}, viz. is a possible\nprotocol state, just in case pair @{term \"(s\\<^sub>0, s)\"} lies within this reflexive transitive closure --\na state of affairs denoted using infix notation @{text \"s\\<^sub>0 \\<Turnstile> s\"}. As a result, rule induction is\nreplaced with induction over reflexive transitive closures via rule @{thm [source] rtrancl_induct},\nwhich is the circumstance that originates the method name.\n\\\\These changes provide the following important benefits.\n\n    \\<^item> Inserting and modifying the formal definition of a protocol is much more comfortable. In fact,\nany change even to a single introduction rule within a monolithic inductive set definition entails a\nre-evaluation of the whole definition, whereas each protocol relation will have its own stand-alone\ndefinition, which also makes it easier to find errors. This advantage may go almost unnoticed for a\nvery simple protocol providing for just a few protocol rules, but gets evident in case of a complex\nprotocol. An example of this will be provided by the protocol considered in this paper: when looking\nat the self-contained abbreviations used to define protocol relations, the reader will easily grasp\nhow much more convoluted an equivalent inductive set definition would have been.\n\n    \\<^item> In addition to induction via rule @{thm [source] rtrancl_induct}, a further powerful reasoning\npattern turns out to be available. It is based on the following general rule applying to reflexive\ntransitive closures (indeed, a rule so general and useful that it could rightfully become part of\nthe standard library), later on proven and assigned the name @{text rtrancl_start}:\n@{prop [display] \"\\<lbrakk>(x, y) \\<in> r\\<^sup>*; P y; \\<not> P x\\<rbrakk> \\<Longrightarrow>\n\\<exists>u v. (x, u) \\<in> r\\<^sup>* \\<and> (u, v) \\<in> r \\<and> (v, y) \\<in> r\\<^sup>* \\<and> \\<not> P u \\<and> P v\"}\nIn natural language, this rule states that for any chain of elements linked by a relation, if some\npredicate is false for the first element of the chain and true for the last one, there must exist a\nlink in the chain where the predicate becomes true.\n\\\\This rule can be used to prove propositions of the form @{text \"\\<lbrakk>s \\<Turnstile> s'; P s'[; Q]\\<rbrakk> \\<Longrightarrow> R s'\"} for\nany state @{text s} and predicate @{text P} such that @{term \"\\<not> P s\"}, with an optional additional\nassumption @{text Q}, without resorting to induction. Notably, \\emph{regularity lemmas} have exactly\nthis form, where @{term \"s = s\\<^sub>0\"}, @{term \"P = (\\<lambda>s. X \\<in> parts (used s))\"} for some term @{text X} of\ntype @{text msg}, and @{text Q}, if present, puts some constraint on @{text X} or its components.\n\\\\Such a proof consists of two steps. First, lemma @{text \"\\<lbrakk>s \\<turnstile> s'; P s'; \\<not> P s[; Q]\\<rbrakk> \\<Longrightarrow> R s'\"} is\nproven by simplification, using the definitions of protocol relations. Then, the target proposition\nis proven by applying rule @{text rtrancl_start} as a destruction rule (cf. @{cite \"Paulson20\"}) and\nproving @{term \"P s'\"} by assumption, @{term \"\\<not> P s\"} by simplification, and the residual subgoal\nby means of the previous lemma.\n\nIn addition to the relational method, this paper is aimed at introducing still another enhancement:\nbesides message confidentiality and authenticity, it takes into consideration a further important\nsecurity property, \\emph{message anonymity}. Being legitimate agents identified via natural numbers,\nthe fact that in state @{text s} the spy ignores that message @{text X\\<^sub>n} is associated with agent\n@{text n}, viz. @{text X\\<^sub>n}'s property of being \\emph{anonymous} in state @{text s}, can be expressed\nas @{text \"\\<langle>n, X\\<^sub>n\\<rangle> \\<notin> spied s\"}, where notation @{text \"\\<langle>n, X\\<^sub>n\\<rangle>\"} refers to a new constructor added to\ndatatype @{text msg} precisely for this purpose.\n\nA basic constraint upon any protocol relation augmenting the spy's knowledge with @{text \"\\<langle>n, X\\<rangle>\"}\nis that the spy must know message @{text X} in the current state, as it is impossible to identify\nthe agent associated with an unknown message. There is also an additional, more subtle constraint.\nAny such protocol relation either augments a state in which the spy knows @{text \"\\<langle>n, C X\\<^sub>1 \\<dots> X\\<^sub>m\\<rangle>\"},\ni.e. containing event @{text \"(Spy, \\<langle>n, C X\\<^sub>1 \\<dots> X\\<^sub>m\\<rangle>)\"}, with event @{text \"(Spy, \\<langle>n, X\\<^sub>i\\<rangle>)\"}, where\n$1 \\leq i \\leq m$ and @{text C} is some constructor of datatype @{text msg}, or conversely augments\na state containing event @{text \"(Spy, \\<langle>n, X\\<^sub>i\\<rangle>)\"} with @{text \"(Spy, \\<langle>n, C X\\<^sub>1 \\<dots> X\\<^sub>m\\<rangle>)\"}. However, the\nlatter spy's inference is justified only if the compound message @{text \"C X\\<^sub>1 \\<dots> X\\<^sub>m\"} is part of a\nmessage generated or accepted by some legitimate agent according to the protocol rules. Otherwise,\nthat is, if @{text \"C X\\<^sub>1 \\<dots> X\\<^sub>m\"} were just a message generated at random by the spy, her inference\nwould be as sound as those of most politicians and all advertisements: even if the conclusion were\ntrue, it would be so by pure chance.\n\nThis problem can be solved as follows.\n\n  \\<^item> A further constructor @{text Log}, taking a message as input, is added to datatype @{text msg},\nand every protocol relation modeling the generation or acceptance of a message @{text X} by some\nlegitimate agent must augment the current state with event @{term \"(Spy, Log X)\"}.\n\\\\In this way, the set of all the messages that have been generated or accepted by some legitimate\nagent in state @{text s} matches @{term \"Log -` spied s\"}.\n\n  \\<^item> A function @{text crypts} is defined inductively. It takes a message set @{text H} as input, and\nreturns the least message set @{text H'} such that @{term \"H \\<subseteq> H'\"} and for any (even empty) list\nof keys @{text KS}, if the encryption of @{text \"\\<lbrace>X, Y\\<rbrace>\"}, @{text \"\\<lbrace>Y, X\\<rbrace>\"}, or @{text \"Hash X\"}\nwith @{text KS} is contained in @{text H'}, then the encryption of @{text X} with @{text KS} is\ncontained in @{text H'} as well. \n\\\\In this way, the set of all the messages that are part of messages exchanged by legitimate agents,\nviz. that may be mapped to agents, in state @{text s} matches @{term \"crypts (Log -` spied s)\"}.\n\n  \\<^item> Another function @{text key_sets} is defined, too. It takes two inputs, a message @{text X} and\na message set @{text H}, and returns the set of the sets of @{text KS}' inverse keys for any list of\nkeys @{text KS} such that the encryption of @{text X} with @{text KS} is included in @{text H}.\n\\\\In this way, the fact that in state @{text s} the spy can map a compound message @{text X} to some\nagent, provided that she knows all the keys in set @{text U}, can be expressed through conditions\n@{term \"U \\<in> key_sets X (crypts (Log -` spied s))\"} and @{term \"U \\<subseteq> spied s\"}.\n\\\\The choice to define @{text key_sets} so as to collect the inverse keys of encryption keys, viz.\ndecryption ones, depends on the fact that the sample protocol verified in this paper uses symmetric\nkeys alone -- which match their own inverse keys -- for encryption, whereas asymmetric key pairs are\nused in cryptograms only for signature generation -- so that the inverse keys are public ones. In\ncase of a protocol (also) using public keys for encryption, encryption keys themselves should (also)\nbe collected, since the corresponding decryption keys, i.e. private keys, would be unknown to the\nspy by default. This would formalize the fact that encrypted messages can be mapped to agents not\nonly by decrypting them, but also by recomputing the cryptograms (provided that the plaintexts are\nknown) and checking whether they match the exchanged ones.\n\\<close>\n\n\nsubsection \"A sample protocol\"\n\ntext \\<open>\nAs previously mentioned, this paper tries the relational method, including message anonymity, by\napplying it to the verification of a sample authentication protocol in which Password Authenticated\nConnection Establishment (PACE) with Chip Authentication Mapping (cf. @{cite \"ICAO15\"}) is first\nused by an \\emph{owner} to establish a secure channel with her own \\emph{asset} and authenticate it,\nand then the owner sends a password (other than the PACE one) to the asset over that channel so as\nto authenticate herself. This enables to achieve a reliable mutual authentication even if the PACE\nkey is shared by multiple owners or is weak, as happens in electronic passports. Although the PACE\nmechanism is specified for use in electronic documents, nothing prevents it in principle from being\nused in other kinds of smart cards or even outside of the smart card world, which is the reason why\nthis paper uses the generic names \\emph{asset} and \\emph{owner} for the card and the cardholder,\nrespectively.\n\nIn more detail, this protocol provides for the following steps. In this list, messages are specified\nusing the same syntax that will be adopted in the formal text (for further information about PACE\nwith Chip Authentication Mapping, cf. @{cite \"ICAO15\"}).\n\n  \\<^enum> \\emph{Asset n} $\\rightarrow$ \\emph{Owner n}:\n\\\\\\hspace*{1em}@{text \"Crypt (Auth_ShaKey n) (PriKey S)\"}\n\n  \\<^enum> \\emph{Owner n} $\\rightarrow$ \\emph{Asset n}:\n\\\\\\hspace*{1em}@{text \"\\<lbrace>Num 1, PubKey A\\<rbrace>\"}\n\n  \\<^enum> \\emph{Asset n} $\\rightarrow$ \\emph{Owner n}:\n\\\\\\hspace*{1em}@{text \"\\<lbrace>Num 2, PubKey B\\<rbrace>\"}\n\n  \\<^enum> \\emph{Owner n} $\\rightarrow$ \\emph{Asset n}:\n\\\\\\hspace*{1em}@{text \"\\<lbrace>Num 3, PubKey C\\<rbrace>\"}\n\n  \\<^enum> \\emph{Asset n} $\\rightarrow$ \\emph{Owner n}:\n\\\\\\hspace*{1em}@{text \"\\<lbrace>Num 4, PubKey D\\<rbrace>\"}\n\n  \\<^enum> \\emph{Owner n} $\\rightarrow$ \\emph{Asset n}:\n\\\\\\hspace*{1em}@{text \"Crypt (SesK SK) (PubKey D)\"}\n\n  \\<^enum> \\emph{Asset n} $\\rightarrow$ \\emph{Owner n}:\n\\\\\\hspace*{1em}@{text \"\\<lbrace>Crypt (SesK SK) (PubKey C),\"}\n\\\\\\hspace*{1.5em}@{text \"Crypt (SesK SK) (Auth_PriK n \\<otimes> B),\"}\n\\\\\\hspace*{1.5em}@{text \"Crypt (SesK SK) (Crypt SigK\"}\n\\\\\\hspace*{2em}@{text \"\\<lbrace>Hash (Agent n), Hash (Auth_PubKey n)\\<rbrace>)\\<rbrace>\"}\n\n  \\<^enum> \\emph{Owner n} $\\rightarrow$ \\emph{Asset n}:\n\\\\\\hspace*{1em}@{text \"Crypt (SesK SK) (Pwd n)\"}\n\n  \\<^enum> \\emph{Asset n} $\\rightarrow$ \\emph{Owner n}:\n\\\\\\hspace*{1em}@{text \"Crypt (SesK SK) (Num 0)\"}\n\nLegitimate agents consist of an infinite population of assets and owners. For each natural number\n@{text n}, @{text \"Owner n\"} is an owner and @{text \"Asset n\"} is her own asset, and these agents\nare assigned the following authentication data.\n\n  \\<^item> @{text \"Key (Auth_ShaKey n)\"}: static symmetric PACE key shared by both agents.\n\n  \\<^item> @{text \"Auth_PriKey n\"}, @{text \"Auth_PubKey n\"}: static private and public keys stored on\n@{text \"Asset n\"} and used for @{text \"Asset n\"}'s authentication via Chip Authentication Mapping.\n\n  \\<^item> @{text \"Pwd n\"}: unique password (other than the PACE one) shared by both agents and used for\n@{text \"Owner n\"}'s authentication.\n\nFunction @{text Pwd} is defined as a constructor of datatype @{text msg} and then is injective,\nwhich formalizes the assumption that each asset-owner pair has a distinct password, whereas no such\nconstraint is put on functions @{text Auth_ShaKey}, @{text Auth_PriKey}, and @{text Auth_PubKey},\nwhich allows multiple asset-owner pairs to be assigned the same keys. On the other hand, function\n@{text Auth_PriKey} is constrained to be such that the complement of its range is infinite. As each\nprotocol run requires the generation of fresh ephemeral private keys, this constraint ensures that\nan unbounded number of protocol runs can be carried out. All assumptions are formalized by applying\nthe definitional approach, viz. without introducing any axiom, and so is this constraint, expressed\nby defining function @{text Auth_PriKey} using the indefinite description operator @{text SOME}.\n\nThe protocol starts with @{text \"Asset n\"} sending an ephemeral private key encrypted with the PACE\nkey to @{text \"Owner n\"}. Actually, if @{text \"Asset n\"} is a smart card, the protocol should rather\nstart with @{text \"Owner n\"} sending a plain request for such encrypted nonce, but this preliminary\nstep is omitted here as it is irrelevant for protocol security. After that, @{text \"Owner n\"} and\n@{text \"Asset n\"} generate two ephemeral key pairs each and send the respective public keys to the\nother party.\n\nThen, both parties agree on the same session key by deriving it from the ephemeral keys generated\npreviously (actually, two distinct session keys would be derived, one for encryption and the other\none for MAC computation, but such a level of detail is unnecessary for protocol verification). The\nsession key is modeled as @{text \"Key (SesK SK)\"}, where @{text SesK} is an apposite constructor\nadded to datatype @{text key} and @{term \"SK = (Some S, {A, B}, {C, D})\"}. The adoption of type\n@{typ \"nat option\"} for the first component enables to represent as @{term \"(None, {A, B}, {C, D})\"}\nthe wrong session key derived from @{text \"Owner n\"} if @{text \"PriKey S\"} was encrypted using a key\nother than @{text \"Key (Auth_ShaKey n)\"} -- which reflects the fact that the protocol goes on even\nwithout the two parties sharing the same session key. The use of type @{typ \"nat set\"} for the other\ntwo components enables the spy to compute @{text \"Key (SesK SK)\"} if she knows \\emph{either} private\nkey and the other public key referenced by each set, as long as she also knows @{text \"PriKey S\"} --\nwhich reflects the fact that given two key pairs, Diffie-Hellman key agreement generates the same\nshared secret independently of which of the respective private keys is used for computation.\n\nThis session key is used by both parties to compute their authentication tokens. Both encrypt the\nother party's second ephemeral public key, but @{text \"Asset n\"} appends two further fields: the\nEncrypted Chip Authentication Data, as provided for by Chip Authentication Mapping, and an encrypted\nsignature of the hash values of @{text \"Agent n\"} and @{text \"Auth_PubKey n\"}. Infix notation\n@{text \"Auth_PriK n \\<otimes> B\"} refers to a constructor of datatype @{text msg} standing for plain Chip\nAuthentication Data, and @{text Agent} is another such constructor standing for agent identification\ndata. @{text \"Owner n\"} is expected to validate this signature by also checking @{text \"Agent n\"}'s\nhash value against reference identification data known by other means -- otherwise, the spy would\nnot be forced to know @{text \"Auth_PriKey n\"} to masquerade as @{text \"Asset n\"}, since she could do\nthat by just knowing @{text \"Auth_PriKey m\"} for some other @{text m}, even if @{term \"Auth_PriKey m\n\\<noteq> Auth_PriKey n\"}. If @{text \"Asset n\"} is an electronic passport, the owner, i.e. the inspection\nsystem, could get cardholder's identification data by reading her personal data on the booklet, and\nsuch a signature could be retrieved from the chip (actually through a distinct message, but this is\nirrelevant for protocol security as long as the password is sent after the signature's validation)\nby reading the Document Security Object -- provided that @{text \"Auth_PubKey n\"} is included within\nData Group 14.\n\nThe protocol ends with @{text \"Owner n\"} sending her password, encrypted with the session key, to\n@{text \"Asset n\"}, who validates it and replies with an encrypted acknowledgment.\n\nHere below are some concluding remarks about the way how this sample protocol is formalized.\n\n  \\<^item> A single signature private key, unknown to the spy, is assumed to be used for all legitimate\nagents. Similarly, the spy might have hacked some legitimate agent so as to steal her ephemeral\nprivate keys as soon as they are generated, but here all legitimate agents are assumed to be out of\nthe spy's reach in this respect. Of course, this is just the choice of one of multiple possible\nscenarios, and nothing prevents these assumptions from being dropped.\n\n  \\<^item> In the real world, a legitimate agent would use any one of her ephemeral private keys just once,\nafter which the key would be destroyed. On the contrary, no such constraint is enforced here, since\nit turns out to be unnecessary for protocol verification. There is a single exception, required for\nthe proof of a unicity lemma: after @{text \"Asset n\"} has used @{text \"PriKey B\"} to compute her\nauthentication token, she must discard @{text \"PriKey B\"} so as not to use this key any longer. The\nway how this requirement is expressed emphasizes once more the flexibility of the modeling of events\nin the relational method: @{text \"Asset n\"} may use @{text \"PriKey B\"} in this computation only if\nevent @{text \"(Asset n, PubKey B)\"} is not yet contained in the current state @{text s}, and then\n@{text s} is augmented with that event. Namely, events can also be used to model garbage collection!\n\n  \\<^item> The sets of the legitimate agents whose authentication data have been identified in advance (or\nequivalently, by means other than attacking the protocol, e.g. by social engineering) by the spy are\ndefined consistently with the constraint that known data alone can be mapped to agents, as well as\nwith the definition of initial state @{text s\\<^sub>0}. For instance, the set @{text bad_id_prikey} of the\nagents whose Chip Authentication private keys have been identified is defined as a subset of the set\n@{text bad_prikey} of the agents whose Chip Authentication private keys have been stolen. Moreover,\nall the signatures included in assets' authentication tokens are assumed to be already known to the\nspy in state @{text s\\<^sub>0}, so that @{text bad_id_prikey} includes also any agent whose identification\ndata or Chip Authentication public key have been identified in advance.\n\n  \\<^item> The protocol rules augmenting the spy's knowledge with some message of the form @{text \"\\<langle>n, X\\<rangle>\"}\ngenerally require the spy to already know some other message of the same form. There is just one\nexception: the spy can infer @{text \"\\<langle>n, Agent n\\<rangle>\"} from @{text \"Agent n\"}. This expresses the fact\nthat the detection of identification data within a message generated or accepted by some legitimate\nagent is in itself sufficient to map any known component of that message to the identified agent,\nregardless of whether any data were already mapped to that agent in advance.\n\n  \\<^item> As opposed to what happens for constructors @{text \"(\\<otimes>)\"} and @{text \"MPair\"}, there do not\nexist two protocol rules enabling the spy to infer @{text \"\\<langle>n, Crypt K X\\<rangle>\"} from @{text \"\\<langle>n, X\\<rangle>\"} or\n@{text \"\\<langle>n, Key K\\<rangle>\"} and vice versa. A single protocol rule is rather defined, which enables the spy\nto infer @{text \"\\<langle>n, X\\<rangle>\"} from @{text \"\\<langle>n, Key K\\<rangle>\"} or vice versa, provided that @{text \"Crypt K X\"}\nhas been exchanged by some legitimate agent. In fact, the protocol provides for just one compound\nmessage made up of cryptograms, i.e. the asset's authentication token, and all these cryptograms are\ngenerated using the same encryption key @{text \"Key (SesK SK)\"}. Thus, if two such cryptograms have\nplaintexts @{text X\\<^sub>1}, @{text X\\<^sub>2} and the spy knows @{text \"\\<langle>n, X\\<^sub>1\\<rangle>\"}, she can infer @{text \"\\<langle>n, X\\<^sub>2\\<rangle>\"}\nby inferring @{text \"\\<langle>n, Key (SesK SK)\\<rangle>\"}, viz. she need not know @{text \"\\<langle>n, Crypt (SesK SK) X\\<^sub>1\\<rangle>\"}\nto do that.\n\nThe formal content is split into the following sections.\n\n  \\<^item> Section \\ref{Definitions}, \\emph{Definitions}, contains all the definitions needed to formalize\nthe sample protocol by means of the relational method, including message anonymity.\n\n  \\<^item> Section \\ref{Authentication}, \\emph{Confidentiality and authenticity properties}, proves that\nthe following theorems hold under appropriate assumptions.\n\n    \\<^enum> Theorem @{text sigkey_secret}: the signature private key is secret.\n\n    \\<^enum> Theorem @{text auth_shakey_secret}: an asset-owner pair's PACE key is secret.\n\n    \\<^enum> Theorem @{text auth_prikey_secret}: an asset's Chip Authentication private key is secret.\n\n    \\<^enum> Theorem @{text owner_seskey_unique}: an owner's session key is unknown to other owners.\n\n    \\<^enum> Theorem @{text owner_seskey_secret}: an owner's session key is secret.\n\n    \\<^enum> Theorem @{text owner_num_genuine}: the encrypted acknowledgment received by an owner has been\nsent by the respective asset.\n\n    \\<^enum> Theorem @{text owner_token_genuine}: the PACE authentication token received by an owner has\nbeen generated by the respective asset, using her Chip Authentication private key and the same\nephemeral keys used to derive the session key.\n\n    \\<^enum> Theorem @{text pwd_secret}: an asset-owner pair's password is secret.\n\n    \\<^enum> Theorem @{text asset_seskey_unique}: an asset's session key is unknown to other assets, and\nmay be used by that asset to compute just one PACE authentication token.\n\n    \\<^enum> Theorem @{text asset_seskey_secret}: an asset's session key is secret.\n\n    \\<^enum> Theorem @{text asset_pwd_genuine}: the encrypted password received by an asset has been sent\nby the respective owner.\n\n    \\<^enum> Theorem @{text asset_token_genuine}: the PACE authentication token received by an asset has\nbeen generated by the respective owner, using the same ephemeral key used to derive the session key.\n\n  Particularly, these proofs confirm that the mutual authentication between an owner and her asset\nis reliable even if their PACE key is compromised, unless either their Chip Authentication private\nkey or their password also is -- namely, the protocol succeeds in implementing a two-factor mutual\nauthentication.\n\n  \\<^item> Section \\ref{Anonymity}, \\emph{Anonymity properties}, proves that the following theorems hold\nunder appropriate assumptions.\n\n    \\<^enum> Theorem @{text pwd_anonymous}: an asset-owner pair's password is anonymous.\n\n    \\<^enum> Theorem @{text auth_prikey_anonymous}: an asset's Chip Authentication private key is\nanonymous.\n\n    \\<^enum> Theorem @{text auth_shakey_anonymous}: an asset-owner pair's PACE key is anonymous.\n\n  \\<^item> Section \\ref{Possibility}, \\emph{Possibility properties}, shows how possibility properties (cf.\n@{cite \"Paulson98\"}) can be proven by constructing sample protocol runs, either ordinary or attack\nones. Two such properties are proven:\n\n    \\<^enum> Theorem @{text runs_unbounded}: for any possible protocol state @{text s} and any asset-owner\npair, there exists a state @{text s'} reachable from @{text s} in which a protocol run has been\ncompleted by those agents using an ephemeral private key @{text \"PriKey S\"} not yet exchanged in\n@{text s} -- namely, an unbounded number of protocol runs can be carried out by legitimate agents.\n\n    \\<^enum> Theorem @{text pwd_compromised}: in a scenario not satisfying the assumptions of theorem\n@{text pwd_anonymous}, the spy can steal an asset-owner pair's password and even identify those\nagents.\n\n  The latter is an example of a possibility property aimed at confirming that the assumptions of a\ngiven confidentiality, authenticity, or anonymity property are necessary for it to hold.\n\nFor further information about the formal definitions and proofs contained in these sections, see\nIsabelle documentation, particularly @{cite \"Paulson20\"}, @{cite \"Nipkow20\"}, @{cite \"Krauss20\"},\nand @{cite \"Nipkow11\"}.\n\n\\textbf{Important note.} This sample protocol was already considered in a former paper of mine (cf.\n@{cite \"Noce17\"}). For any purpose, that paper should be regarded as being obsolete and superseded\nby the present paper.\n\\<close>\n\n\nsubsection \"Definitions\"\n\ntext \\<open>\n\\label{Definitions}\n\\<close>\n\ntype_synonym agent_id = nat\n\ntype_synonym key_id = nat\n\ntype_synonym seskey_in = \"key_id option \\<times> key_id set \\<times> key_id set\"\n\ndatatype agent =\n  Asset agent_id |\n  Owner agent_id |\n  Spy\n\ndatatype key =\n  SigK |\n  VerK |\n  PriK key_id |\n  PubK key_id |\n  ShaK key_id |\n  SesK seskey_in\n\ndatatype msg =\n  Num nat |\n  Agent agent_id |\n  Pwd agent_id |\n  Key key |\n  Mult key_id key_id (infixl \"\\<otimes>\" 70) |\n  Hash msg |\n  Crypt key msg |\n  MPair msg msg |\n  IDInfo agent_id msg |\n  Log msg\n\nsyntax\n  \"_MPair\"  :: \"['a, args] \\<Rightarrow> 'a * 'b\"  (\"(2\\<lbrace>_,/ _\\<rbrace>)\")\n  \"_IDInfo\" :: \"[agent_id, msg] \\<Rightarrow> msg\"      (\"(2\\<langle>_,/ _\\<rangle>)\")\ntranslations\n  \"\\<lbrace>X, Y, Z\\<rbrace>\" \\<rightleftharpoons> \"\\<lbrace>X, \\<lbrace>Y, Z\\<rbrace>\\<rbrace>\"\n  \"\\<lbrace>X, Y\\<rbrace>\" \\<rightleftharpoons> \"CONST MPair X Y\"\n  \"\\<langle>n, X\\<rangle>\" \\<rightleftharpoons> \"CONST IDInfo n X\"\n\n\nabbreviation SigKey :: \"msg\" where\n\"SigKey \\<equiv> Key SigK\"\n\nabbreviation VerKey :: \"msg\" where\n\"VerKey \\<equiv> Key VerK\"\n\nabbreviation PriKey :: \"key_id \\<Rightarrow> msg\" where\n\"PriKey \\<equiv> Key \\<circ> PriK\"\n\nabbreviation PubKey :: \"key_id \\<Rightarrow> msg\" where\n\"PubKey \\<equiv> Key \\<circ> PubK\"\n\nabbreviation ShaKey :: \"key_id \\<Rightarrow> msg\" where\n\"ShaKey \\<equiv> Key \\<circ> ShaK\"\n\nabbreviation SesKey :: \"seskey_in \\<Rightarrow> msg\" where\n\"SesKey \\<equiv> Key \\<circ> SesK\"\n\nprimrec InvK :: \"key \\<Rightarrow> key\" where\n\"InvK SigK = VerK\" |\n\"InvK VerK = SigK\" |\n\"InvK (PriK A) = PubK A\" |\n\"InvK (PubK A) = PriK A\" |\n\"InvK (ShaK SK) = ShaK SK\" |\n\"InvK (SesK SK) = SesK SK\"\n\nabbreviation InvKey :: \"key \\<Rightarrow> msg\" where\n\"InvKey \\<equiv> Key \\<circ> InvK\"\n\n\ninductive_set parts :: \"msg set \\<Rightarrow> msg set\"\n  for H :: \"msg set\" where\n\nparts_used [intro]:\n  \"X \\<in> H \\<Longrightarrow> X \\<in> parts H\" |\n\nparts_crypt [intro]:\n  \"Crypt K X \\<in> parts H \\<Longrightarrow> X \\<in> parts H\" |\n\nparts_fst [intro]:\n  \"\\<lbrace>X, Y\\<rbrace> \\<in> parts H \\<Longrightarrow> X \\<in> parts H\" |\n\nparts_snd [intro]:\n  \"\\<lbrace>X, Y\\<rbrace> \\<in> parts H \\<Longrightarrow> Y \\<in> parts H\"\n\n\ninductive_set crypts :: \"msg set \\<Rightarrow> msg set\"\n  for H :: \"msg set\" where\n\ncrypts_used [intro]:\n  \"X \\<in> H \\<Longrightarrow> X \\<in> crypts H\" |\n\ncrypts_hash [intro]:\n  \"foldr Crypt KS (Hash X) \\<in> crypts H \\<Longrightarrow> foldr Crypt KS X \\<in> crypts H\" |\n\ncrypts_fst [intro]:\n  \"foldr Crypt KS \\<lbrace>X, Y\\<rbrace> \\<in> crypts H \\<Longrightarrow> foldr Crypt KS X \\<in> crypts H\" |\n\ncrypts_snd [intro]:\n  \"foldr Crypt KS \\<lbrace>X, Y\\<rbrace> \\<in> crypts H \\<Longrightarrow> foldr Crypt KS Y \\<in> crypts H\"\n\n\ndefinition key_sets :: \"msg \\<Rightarrow> msg set \\<Rightarrow> msg set set\" where\n\"key_sets X H \\<equiv> {InvKey ` set KS | KS. foldr Crypt KS X \\<in> H}\"\n\ndefinition parts_msg :: \"msg \\<Rightarrow> msg set\" where\n\"parts_msg X \\<equiv> parts {X}\"\n\ndefinition crypts_msg :: \"msg \\<Rightarrow> msg set\" where\n\"crypts_msg X \\<equiv> crypts {X}\"\n\ndefinition key_sets_msg :: \"msg \\<Rightarrow> msg \\<Rightarrow> msg set set\" where\n\"key_sets_msg X Y \\<equiv> key_sets X {Y}\"\n\nfun seskey_set :: \"seskey_in \\<Rightarrow> key_id set\" where\n\"seskey_set (Some S, U, V) = insert S (U \\<union> V)\" |\n\"seskey_set (None, U, V) = U \\<union> V\"\n\n\ndefinition Auth_PriK :: \"agent_id \\<Rightarrow> key_id\" where\n\"Auth_PriK \\<equiv> SOME f. infinite (- range f)\"\n\nabbreviation Auth_PriKey :: \"agent_id \\<Rightarrow> msg\" where\n\"Auth_PriKey \\<equiv> PriKey \\<circ> Auth_PriK\"\n\nabbreviation Auth_PubKey :: \"agent_id \\<Rightarrow> msg\" where\n\"Auth_PubKey \\<equiv> PubKey \\<circ> Auth_PriK\"\n\nconsts Auth_ShaK :: \"agent_id \\<Rightarrow> key_id\"\n\nabbreviation Auth_ShaKey :: \"agent_id \\<Rightarrow> key\" where\n\"Auth_ShaKey \\<equiv> ShaK \\<circ> Auth_ShaK\"\n\nabbreviation Sign :: \"agent_id \\<Rightarrow> key_id \\<Rightarrow> msg\" where\n\"Sign n A \\<equiv> Crypt SigK \\<lbrace>Hash (Agent n), Hash (PubKey A)\\<rbrace>\"\n\nabbreviation Token :: \"agent_id \\<Rightarrow> key_id \\<Rightarrow> key_id \\<Rightarrow> key_id \\<Rightarrow> seskey_in \\<Rightarrow> msg\"\nwhere \"Token n A B C SK \\<equiv> \\<lbrace>Crypt (SesK SK) (PubKey C),\n  Crypt (SesK SK) (A \\<otimes> B), Crypt (SesK SK) (Sign n A)\\<rbrace>\"\n\n\nconsts bad_agent :: \"agent_id set\"\n\nconsts bad_pwd :: \"agent_id set\"\n\nconsts bad_shak :: \"key_id set\"\n\nconsts bad_id_pwd :: \"agent_id set\"\n\nconsts bad_id_prik :: \"agent_id set\"\n\nconsts bad_id_pubk :: \"agent_id set\"\n\nconsts bad_id_shak :: \"agent_id set\"\n\ndefinition bad_prik :: \"key_id set\" where\n\"bad_prik \\<equiv> SOME U. U \\<subseteq> range Auth_PriK\"\n\nabbreviation bad_prikey :: \"agent_id set\" where\n\"bad_prikey \\<equiv> Auth_PriK -` bad_prik\"\n\nabbreviation bad_shakey :: \"agent_id set\" where\n\"bad_shakey \\<equiv> Auth_ShaK -` bad_shak\"\n\nabbreviation bad_id_password :: \"agent_id set\" where\n\"bad_id_password \\<equiv> bad_id_pwd \\<inter> bad_pwd\"\n\nabbreviation bad_id_prikey :: \"agent_id set\" where\n\"bad_id_prikey \\<equiv> (bad_agent \\<union> bad_id_pubk \\<union> bad_id_prik) \\<inter> bad_prikey\"\n\nabbreviation bad_id_pubkey :: \"agent_id set\" where\n\"bad_id_pubkey \\<equiv> bad_agent \\<union> bad_id_pubk \\<union> bad_id_prik \\<inter> bad_prikey\"\n\nabbreviation bad_id_shakey :: \"agent_id set\" where\n\"bad_id_shakey \\<equiv> bad_id_shak \\<inter> bad_shakey\"\n\n\ntype_synonym event = \"agent \\<times> msg\"\n\ntype_synonym state = \"event set\"\n\nabbreviation used :: \"state \\<Rightarrow> msg set\" where\n\"used s \\<equiv> Range s\"\n\nabbreviation spied :: \"state \\<Rightarrow> msg set\" where\n\"spied s \\<equiv> s `` {Spy}\"\n\nabbreviation s\\<^sub>0 :: state where\n\"s\\<^sub>0 \\<equiv> range (\\<lambda>n. (Asset n, Auth_PriKey n)) \\<union> {Spy} \\<times> insert VerKey\n  (range Num \\<union> range Auth_PubKey \\<union> range (\\<lambda>n. Sign n (Auth_PriK n)) \\<union>\n   Agent ` bad_agent \\<union> Pwd ` bad_pwd \\<union> PriKey ` bad_prik \\<union> ShaKey ` bad_shak \\<union>\n   (\\<lambda>n. \\<langle>n, Pwd n\\<rangle>) ` bad_id_password \\<union>\n   (\\<lambda>n. \\<langle>n, Auth_PriKey n\\<rangle>) ` bad_id_prikey \\<union>\n   (\\<lambda>n. \\<langle>n, Auth_PubKey n\\<rangle>) ` bad_id_pubkey \\<union>\n   (\\<lambda>n. \\<langle>n, Key (Auth_ShaKey n)\\<rangle>) ` bad_id_shakey)\"\n\n\nabbreviation rel_asset_i :: \"(state \\<times> state) set\" where\n\"rel_asset_i \\<equiv> {(s, s') | s s' n S.\n  s' = insert (Asset n, PriKey S) s \\<union>\n    {Asset n, Spy} \\<times> {Crypt (Auth_ShaKey n) (PriKey S)} \\<union>\n    {(Spy, Log (Crypt (Auth_ShaKey n) (PriKey S)))} \\<and>\n  PriKey S \\<notin> used s}\"\n\nabbreviation rel_owner_ii :: \"(state \\<times> state) set\" where\n\"rel_owner_ii \\<equiv> {(s, s') | s s' n S A K.\n  s' = insert (Owner n, PriKey A) s \\<union>\n    {Owner n, Spy} \\<times> {\\<lbrace>Num 1, PubKey A\\<rbrace>} \\<union>\n    {Spy} \\<times> Log ` {Crypt K (PriKey S), \\<lbrace>Num 1, PubKey A\\<rbrace>} \\<and>\n  Crypt K (PriKey S) \\<in> used s \\<and>\n  PriKey A \\<notin> used s}\"\n\nabbreviation rel_asset_ii :: \"(state \\<times> state) set\" where\n\"rel_asset_ii \\<equiv> {(s, s') | s s' n A B.\n  s' = insert (Asset n, PriKey B) s \\<union>\n    {Asset n, Spy} \\<times> {\\<lbrace>Num 2, PubKey B\\<rbrace>} \\<union>\n    {Spy} \\<times> Log ` {\\<lbrace>Num 1, PubKey A\\<rbrace>, \\<lbrace>Num 2, PubKey B\\<rbrace>} \\<and>\n  \\<lbrace>Num 1, PubKey A\\<rbrace> \\<in> used s \\<and>\n  PriKey B \\<notin> used s}\"\n\nabbreviation rel_owner_iii :: \"(state \\<times> state) set\" where\n\"rel_owner_iii \\<equiv> {(s, s') | s s' n B C.\n  s' = insert (Owner n, PriKey C) s \\<union>\n    {Owner n, Spy} \\<times> {\\<lbrace>Num 3, PubKey C\\<rbrace>} \\<union>\n    {Spy} \\<times> Log ` {\\<lbrace>Num 2, PubKey B\\<rbrace>, \\<lbrace>Num 3, PubKey C\\<rbrace>} \\<and>\n  \\<lbrace>Num 2, PubKey B\\<rbrace> \\<in> used s \\<and>\n  PriKey C \\<notin> used s}\"\n\nabbreviation rel_asset_iii :: \"(state \\<times> state) set\" where\n\"rel_asset_iii \\<equiv> {(s, s') | s s' n C D.\n  s' = insert (Asset n, PriKey D) s \\<union>\n    {Asset n, Spy} \\<times> {\\<lbrace>Num 4, PubKey D\\<rbrace>} \\<union>\n    {Spy} \\<times> Log ` {\\<lbrace>Num 3, PubKey C\\<rbrace>, \\<lbrace>Num 4, PubKey D\\<rbrace>} \\<and>\n  \\<lbrace>Num 3, PubKey C\\<rbrace> \\<in> used s \\<and>\n  PriKey D \\<notin> used s}\"\n\nabbreviation rel_owner_iv :: \"(state \\<times> state) set\" where\n\"rel_owner_iv \\<equiv> {(s, s') | s s' n S A B C D K SK.\n  s' = insert (Owner n, SesKey SK) s \\<union>\n    {Owner n, Spy} \\<times> {Crypt (SesK SK) (PubKey D)} \\<union>\n    {Spy} \\<times> Log ` {\\<lbrace>Num 4, PubKey D\\<rbrace>, Crypt (SesK SK) (PubKey D)} \\<and>\n  {Crypt K (PriKey S), \\<lbrace>Num 2, PubKey B\\<rbrace>, \\<lbrace>Num 4, PubKey D\\<rbrace>} \\<subseteq> used s \\<and>\n  {Owner n} \\<times> {\\<lbrace>Num 1, PubKey A\\<rbrace>, \\<lbrace>Num 3, PubKey C\\<rbrace>} \\<subseteq> s \\<and>\n  SK = (if K = Auth_ShaKey n then Some S else None, {A, B}, {C, D})}\"\n\nabbreviation rel_asset_iv :: \"(state \\<times> state) set\" where\n\"rel_asset_iv \\<equiv> {(s, s') | s s' n S A B C D SK.\n  s' = s \\<union> {Asset n} \\<times> {SesKey SK, PubKey B} \\<union>\n    {Asset n, Spy} \\<times> {Token n (Auth_PriK n) B C SK} \\<union>\n    {Spy} \\<times> Log ` {Crypt (SesK SK) (PubKey D),\n      Token n (Auth_PriK n) B C SK} \\<and>\n  {Asset n} \\<times> {Crypt (Auth_ShaKey n) (PriKey S),\n    \\<lbrace>Num 2, PubKey B\\<rbrace>, \\<lbrace>Num 4, PubKey D\\<rbrace>} \\<subseteq> s \\<and>\n  {\\<lbrace>Num 1, PubKey A\\<rbrace>, \\<lbrace>Num 3, PubKey C\\<rbrace>,\n    Crypt (SesK SK) (PubKey D)} \\<subseteq> used s \\<and>\n  (Asset n, PubKey B) \\<notin> s \\<and>\n  SK = (Some S, {A, B}, {C, D})}\"\n\nabbreviation rel_owner_v :: \"(state \\<times> state) set\" where\n\"rel_owner_v \\<equiv> {(s, s') | s s' n A B C SK.\n  s' = s \\<union> {Owner n, Spy} \\<times> {Crypt (SesK SK) (Pwd n)} \\<union>\n    {Spy} \\<times> Log ` {Token n A B C SK, Crypt (SesK SK) (Pwd n)} \\<and>\n  Token n A B C SK \\<in> used s \\<and>\n  (Owner n, SesKey SK) \\<in> s \\<and>\n  B \\<in> fst (snd SK)}\"\n\nabbreviation rel_asset_v :: \"(state \\<times> state) set\" where\n\"rel_asset_v \\<equiv> {(s, s') | s s' n SK.\n  s' = s \\<union> {Asset n, Spy} \\<times> {Crypt (SesK SK) (Num 0)} \\<union>\n    {Spy} \\<times> Log ` {Crypt (SesK SK) (Pwd n), Crypt (SesK SK) (Num 0)} \\<and>\n  (Asset n, SesKey SK) \\<in> s \\<and>\n  Crypt (SesK SK) (Pwd n) \\<in> used s}\"\n\n\nabbreviation rel_prik :: \"(state \\<times> state) set\" where\n\"rel_prik \\<equiv> {(s, s') | s s' A.\n  s' = insert (Spy, PriKey A) s \\<and>\n  PriKey A \\<notin> used s}\"\n\nabbreviation rel_pubk :: \"(state \\<times> state) set\" where\n\"rel_pubk \\<equiv> {(s, s') | s s' A.\n  s' = insert (Spy, PubKey A) s \\<and>\n  PriKey A \\<in> spied s}\"\n\nabbreviation rel_sesk :: \"(state \\<times> state) set\" where\n\"rel_sesk \\<equiv> {(s, s') | s s' A B C D S.\n  s' = insert (Spy, SesKey (Some S, {A, B}, {C, D})) s \\<and>\n  {PriKey S, PriKey A, PubKey B, PriKey C, PubKey D} \\<subseteq> spied s}\"\n\nabbreviation rel_fact :: \"(state \\<times> state) set\" where\n\"rel_fact \\<equiv> {(s, s') | s s' A B.\n  s' = s \\<union> {Spy} \\<times> {PriKey A, PriKey B} \\<and>\n  A \\<otimes> B \\<in> spied s \\<and>\n  (PriKey A \\<in> spied s \\<or> PriKey B \\<in> spied s)}\"\n\nabbreviation rel_mult :: \"(state \\<times> state) set\" where\n\"rel_mult \\<equiv> {(s, s') | s s' A B.\n  s' = insert (Spy, A \\<otimes> B) s \\<and>\n  {PriKey A, PriKey B} \\<subseteq> spied s}\"\n\nabbreviation rel_hash :: \"(state \\<times> state) set\" where\n\"rel_hash \\<equiv> {(s, s') | s s' X.\n  s' = insert (Spy, Hash X) s \\<and>\n  X \\<in> spied s}\"\n\nabbreviation rel_dec :: \"(state \\<times> state) set\" where\n\"rel_dec \\<equiv> {(s, s') | s s' K X.\n  s' = insert (Spy, X) s \\<and>\n  {Crypt K X, InvKey K} \\<subseteq> spied s}\"\n\nabbreviation rel_enc :: \"(state \\<times> state) set\" where\n\"rel_enc \\<equiv> {(s, s') | s s' K X.\n  s' = insert (Spy, Crypt K X) s \\<and>\n  {X, Key K} \\<subseteq> spied s}\"\n\nabbreviation rel_sep :: \"(state \\<times> state) set\" where\n\"rel_sep \\<equiv> {(s, s') | s s' X Y.\n  s' = s \\<union> {Spy} \\<times> {X, Y} \\<and>\n  \\<lbrace>X, Y\\<rbrace> \\<in> spied s}\"\n\nabbreviation rel_con :: \"(state \\<times> state) set\" where\n\"rel_con \\<equiv> {(s, s') | s s' X Y.\n  s' = insert (Spy, \\<lbrace>X, Y\\<rbrace>) s \\<and>\n  {X, Y} \\<subseteq> spied s}\"\n\n\nabbreviation rel_id_agent :: \"(state \\<times> state) set\" where\n\"rel_id_agent \\<equiv> {(s, s') | s s' n.\n  s' = insert (Spy, \\<langle>n, Agent n\\<rangle>) s \\<and>\n  Agent n \\<in> spied s}\"\n\nabbreviation rel_id_invk :: \"(state \\<times> state) set\" where\n\"rel_id_invk \\<equiv> {(s, s') | s s' n K.\n  s' = insert (Spy, \\<langle>n, InvKey K\\<rangle>) s \\<and>\n  {InvKey K, \\<langle>n, Key K\\<rangle>} \\<subseteq> spied s}\"\n\nabbreviation rel_id_sesk :: \"(state \\<times> state) set\" where\n\"rel_id_sesk \\<equiv> {(s, s') | s s' n A SK X U.\n  s' = s \\<union> {Spy} \\<times> {\\<langle>n, PubKey A\\<rangle>, \\<langle>n, SesKey SK\\<rangle>} \\<and>\n  {PubKey A, SesKey SK} \\<subseteq> spied s \\<and>\n  (\\<langle>n, PubKey A\\<rangle> \\<in> spied s \\<or> \\<langle>n, SesKey SK\\<rangle> \\<in> spied s) \\<and>\n  A \\<in> seskey_set SK \\<and>\n  SesKey SK \\<in> U \\<and>\n  U \\<in> key_sets X (crypts (Log -` spied s))}\"\n\nabbreviation rel_id_fact :: \"(state \\<times> state) set\" where\n\"rel_id_fact \\<equiv> {(s, s') | s s' n A B.\n  s' = s \\<union> {Spy} \\<times> {\\<langle>n, PriKey A\\<rangle>, \\<langle>n, PriKey B\\<rangle>} \\<and>\n  {PriKey A, PriKey B, \\<langle>n, A \\<otimes> B\\<rangle>} \\<subseteq> spied s}\"\n\nabbreviation rel_id_mult :: \"(state \\<times> state) set\" where\n\"rel_id_mult \\<equiv> {(s, s') | s s' n A B U.\n  s' = insert (Spy, \\<langle>n, A \\<otimes> B\\<rangle>) s \\<and>\n  U \\<union> {PriKey A, PriKey B, A \\<otimes> B} \\<subseteq> spied s \\<and>\n  (\\<langle>n, PriKey A\\<rangle> \\<in> spied s \\<or> \\<langle>n, PriKey B\\<rangle> \\<in> spied s) \\<and>\n  U \\<in> key_sets (A \\<otimes> B) (crypts (Log -` spied s))}\"\n\nabbreviation rel_id_hash :: \"(state \\<times> state) set\" where\n\"rel_id_hash \\<equiv> {(s, s') | s s' n X U.\n  s' = s \\<union> {Spy} \\<times> {\\<langle>n, X\\<rangle>, \\<langle>n, Hash X\\<rangle>} \\<and>\n  U \\<union> {X, Hash X} \\<subseteq> spied s \\<and>\n  (\\<langle>n, X\\<rangle> \\<in> spied s \\<or> \\<langle>n, Hash X\\<rangle> \\<in> spied s) \\<and>\n  U \\<in> key_sets (Hash X) (crypts (Log -` spied s))}\"\n\nabbreviation rel_id_crypt :: \"(state \\<times> state) set\" where\n\"rel_id_crypt \\<equiv> {(s, s') | s s' n X U.\n  s' = s \\<union> {Spy} \\<times> IDInfo n ` insert X U \\<and>\n  insert X U \\<subseteq> spied s \\<and>\n  (\\<langle>n, X\\<rangle> \\<in> spied s \\<or> (\\<exists>K \\<in> U. \\<langle>n, K\\<rangle> \\<in> spied s)) \\<and>\n  U \\<in> key_sets X (crypts (Log -` spied s))}\"\n\nabbreviation rel_id_sep :: \"(state \\<times> state) set\" where\n\"rel_id_sep \\<equiv> {(s, s') | s s' n X Y.\n  s' = s \\<union> {Spy} \\<times> {\\<langle>n, X\\<rangle>, \\<langle>n, Y\\<rangle>} \\<and>\n  {X, Y, \\<langle>n, \\<lbrace>X, Y\\<rbrace>\\<rangle>} \\<subseteq> spied s}\"\n\nabbreviation rel_id_con :: \"(state \\<times> state) set\" where\n\"rel_id_con \\<equiv> {(s, s') | s s' n X Y U.\n  s' = insert (Spy, \\<langle>n, \\<lbrace>X, Y\\<rbrace>\\<rangle>) s \\<and>\n  U \\<union> {X, Y, \\<lbrace>X, Y\\<rbrace>} \\<subseteq> spied s \\<and>\n  (\\<langle>n, X\\<rangle> \\<in> spied s \\<or> \\<langle>n, Y\\<rangle> \\<in> spied s) \\<and>\n  U \\<in> key_sets \\<lbrace>X, Y\\<rbrace> (crypts (Log -` spied s))}\"\n\n\ndefinition rel :: \"(state \\<times> state) set\" where\n\"rel \\<equiv> rel_asset_i \\<union> rel_owner_ii \\<union> rel_asset_ii \\<union> rel_owner_iii \\<union>\n  rel_asset_iii \\<union> rel_owner_iv \\<union> rel_asset_iv \\<union> rel_owner_v \\<union> rel_asset_v \\<union>\n  rel_prik \\<union> rel_pubk \\<union> rel_sesk \\<union> rel_fact \\<union> rel_mult \\<union> rel_hash \\<union> rel_dec \\<union>\n  rel_enc \\<union> rel_sep \\<union> rel_con \\<union> rel_id_agent \\<union> rel_id_invk \\<union> rel_id_sesk \\<union>\n  rel_id_fact \\<union> rel_id_mult \\<union> rel_id_hash \\<union> rel_id_crypt \\<union> rel_id_sep \\<union> rel_id_con\"\n\nabbreviation in_rel :: \"state \\<Rightarrow> state \\<Rightarrow> bool\" (infix \"\\<turnstile>\" 60) where\n\"s \\<turnstile> s' \\<equiv> (s, s') \\<in> rel\"\n\nabbreviation in_rel_rtrancl :: \"state \\<Rightarrow> state \\<Rightarrow> bool\" (infix \"\\<Turnstile>\" 60) where\n\"s \\<Turnstile> s' \\<equiv> (s, s') \\<in> rel\\<^sup>*\"\n\n\nend", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/Relational_Method/Definitions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.33789319620798963}}
{"text": "theory flash56Bra  imports flash56Rev\n \n  begin\nlemma onInv56:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv56  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv56  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv56 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash56Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646140788307, "lm_q2_score": 0.5, "lm_q1q2_score": 0.33788230703941535}}
{"text": "theory flash70Bra  imports flash70Rev\n \n  begin\nlemma onInv70:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv70  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv70  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv70 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash70Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190475, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3378823005095237}}
{"text": "(******************************************************************************)\n(* Project: Isabelle/UTP: Unifying Theories of Programming in Isabelle/HOL    *)\n(* File: uval.thy                                                             *)\n(* Authors: Frank Zeyda and Simon Foster (University of York, UK)             *)\n(* Emails: frank.zeyda@gmail.com and simon.foster@york.ac.uk                  *)\n(******************************************************************************)\n(* LAST REVIEWED: 09 Jun 2022 *)\n\nsection \\<open>Universal Values\\<close>\n\ntheory uval\nimports utype \"../utils/Typedep\"\nkeywords \"inject_type\" :: thy_decl\nbegin\n\ntext \\<open>We are going to use the colon for model typing.\\<close>\n\nno_notation (ASCII)\n  Set.member  (\"'(:')\") and\n  Set.member  (\"(_/ : _)\" [51, 51] 50)\n\ndefault_sort typedep\n\nsubsection \\<open>Value Type\\<close>\n\ntext \\<open>The universal value type is introduced by a type declaration.\\<close>\n\ntypedecl uval\n\nsubsection \\<open>Instantiations\\<close>\n\ntext \\<open>Instantiation of @{class typerep}\\<close>\n\ninstantiation uval :: typerep\nbegin\ndefinition typerep_uval :: \"uval itself \\<Rightarrow> typerep\" where\n[typing]: \"typerep_uval (t :: uval itself) =\n  typerep.Typerep (STR ''uval.uval'') []\"\ninstance ..\nend\n\ntext \\<open>Instantiation of @{class typedep}\\<close>\n\ninstantiation uval :: typedep\nbegin\ndefinition typedep_uval :: \"uval itself \\<Rightarrow> typerep set\" where\n[typing]: \"typedep_uval (t :: uval itself) = {TYPEREP(uval)}\"\ninstance ..\nend\n\nsubsection \\<open>Injectability\\<close>\n\ntext \\<open>\n  We introduce a class @{text injectable} to tag types that we permit to be\n  injected into the unified value type @{type uval}. This is to ensure that\n  @{type uval} does not occur \\emph{itself} in such types, as this leads to\n  unsoundness in conjunction with set and function types. A sufficient caveat\n  for soundness is that neither @{type uval} nor any type depending on type\n  @{type uval} must be a member of @{text injectable}. The assumptions of\n  the @{text injectable} class guarantee that this is the case. Soundness is,\n  however, contingent on correct instantiation of the class @{class typedep}.\n  As the latter is done automatically upon defining new types, the user has\n  no way of interfering with it. This justifies our claim that the axiomatic\n  value model is definitionally sound.\n\\<close>\n\nclass injectable = typedep +\n  assumes utype_is_not_uval : \"TYPEREP('a) \\<noteq> TYPEREP(uval)\"\n  assumes utype_not_dep_uval : \"TYPEREP(uval) \\<notin> TYPEDEP('a)\"\nbegin\ntheorem  utype_is_not_uval_simp [simp]:\n\"TYPEREP('a) = TYPEREP(uval) \\<longleftrightarrow> False\"\napply (simp add: utype_is_not_uval)\ndone\n\ntheorem  utype_not_dep_uval_simp [simp]:\n\"TYPEREP(uval) \\<in> TYPEDEP('a) \\<longleftrightarrow> False\"\napply (simp add: utype_not_dep_uval)\ndone\nend\n\nsubsection \\<open>Command @{text \"inject_type\"}\\<close>\n\ntext \\<open>\n  We next configure a command to inject a HOL type into @{type uval}. This\n  automatically performs instantiation of the class @{class injectable} for\n  the type to be injected, and attempts to discharge the proof obligations\n  thus arising. If the proof of the latter fails, an error is displayed to\n  the user; in that case, the type is most likely not injectable due to some\n  dependency on the type @{type uval}.\n\\<close>\n\nML_file \"uval.ML\"\n\nML \\<open>\n  Outer_Syntax.command @{command_keyword \"inject_type\"} \"inject type\"\n    (Parse.type_const >> (Toplevel.theory o Inject_Type.inject_type));\n\\<close>\n\nsubsection \\<open>Axiomatisation\\<close>\n\ntext \\<open>\n  We next axiomatise the universal abstraction and representation functions.\n  The axioms are guarded by membership to the sort @{class injectable}. This\n  is to ensure that they only hold for injectable values and types. A special\n  case is the axiom for non-emptiness of types: it implicitly also constrains\n  non-injectable model types to have at least one value. This is important to\n  ensure the existence of a well-typed total binding and should not raise any\n  concerns of soundness, as we know nothing else about such types and their\n  values.\n\\<close>\n\naxiomatization\n\\<comment> \\<open>Universal Abstraction Function\\<close>\n  InjU :: \"'a::injectable \\<Rightarrow> uval\" and\n\\<comment> \\<open>Universal Representation Function\\<close>\n  ProjU :: \"uval \\<Rightarrow> 'a::injectable\" and\n\\<comment> \\<open>Model Typing Relation\\<close>\n  utype_rel :: \"uval \\<Rightarrow> utype \\<Rightarrow> bool\" (infix \":\\<^sub>u\" 50) where\n\\<comment> \\<open>Injection Inverse\\<close>\n  InjU_inverse [simp]: \"ProjU (InjU x) = x\" and\n\\<comment> \\<open>Projection Inverse\\<close>\n  ProjU_inverse [simp]: \"y :\\<^sub>u UTYPE('a) \\<Longrightarrow> InjU (ProjU y) = y\" and\n\\<comment> \\<open>Definition of Model Typing\\<close>\n  utype_rel_def [simp]: \"(InjU x) :\\<^sub>u t \\<longleftrightarrow> x : t\" and\n\\<comment> \\<open>Non-emptiness of all model types, even non-injectable ones!\\<close>\n  utypes_non_empty : \"\\<exists> y. y :\\<^sub>u t\"\n\nsubsection \\<open>Derived Laws\\<close>\n\ntheorem InjU_inject :\n\"InjU x = InjU y \\<Longrightarrow> x = y\"\napply (metis InjU_inverse)\ndone\n\ntheorem InjU_eq [simp]:\n\"(InjU x) = (InjU y) \\<longleftrightarrow> (x = y)\"\napply (rule iffI)\napply (erule InjU_inject)\napply (clarsimp)\ndone\n\ntheorem ProjU_inject :\n\"\\<lbrakk>x :\\<^sub>u UTYPE('a); y :\\<^sub>u UTYPE('a)\\<rbrakk> \\<Longrightarrow>\n (ProjU :: uval \\<Rightarrow> 'a::injectable) x =\n (ProjU :: uval \\<Rightarrow> 'a::injectable) y \\<Longrightarrow> x = y\"\napply (metis ProjU_inverse)\ndone\n\nsubsection \\<open>Definitions\\<close>\n\ntext \\<open>We includes several useful derived operators in this section.\\<close>\n\nsubsubsection \\<open>Some Value\\<close>\n\ndefinition some_uval :: \"utype \\<Rightarrow> uval\" where\n\"some_uval t = (SOME x. x :\\<^sub>u t)\"\n\ntheorem some_uval_typed [typing]:\n\"(some_uval t) :\\<^sub>u t\"\napply (unfold some_uval_def)\napply (rule someI_ex)\napply (rule utypes_non_empty)\ndone\n\nsubsubsection \\<open>Carrier Set\\<close>\n\ndefinition ucarrier :: \"utype \\<Rightarrow> uval set\" where\n\"ucarrier t = {x. x :\\<^sub>u t}\"\n\nsyntax \"_UVAL\" :: \"type \\<Rightarrow> uval set\" (\"UVAL'(_')\")\n\ntranslations \"UVAL('t)\" \\<rightleftharpoons> \"(CONST ucarrier) TYPEREP('t)\"\n\ntheorem ucarrier_member [iff]:\n\"(x \\<in> ucarrier t) \\<longleftrightarrow> x :\\<^sub>u t\"\napply (unfold ucarrier_def)\napply (clarsimp)\ndone\n\ntheorem InjU_ucarrier_member :\nfixes x :: \"'a::injectable\"\nshows \"(InjU x) \\<in> UVAL('a)\"\napply (unfold ucarrier_member)\napply (unfold utype_rel_def)\napply (unfold p_type_rel_def)\napply (rule refl)\ndone\n\nsubsection \\<open>Type Definition\\<close>\n\ntext \\<open>\n  For a particular value type @{typ 'a}, @{const InjU} and @{const ProjU}\n  fulfil the axioms of a type definition. Hence, we can think of any\n  injectable HOL type @{typ 'a} as a subtype of @{type uval}. Note that I\n  previously had am interpretation of the @{text type_definition} locale\n  here but this caused some strange behaviours in proofs due to additional\n  cases and induct rules being implicitly used after the interpretation.\n\\<close>\n\ntheorem type_definition_uval:\n\"type_definition (InjU :: 'a::injectable \\<Rightarrow> uval) ProjU UVAL('a)\"\napply (unfold_locales)\napply (simp add: typing)\napply (rule InjU_inverse)\napply (rule ProjU_inverse)\napply (clarsimp)\ndone\n\nsubsection \\<open>Experiments\\<close>\n\ninject_type nat\ninject_type bool\n\ntheorem \"ProjU (InjU (1::nat)) = (1::nat)\"\napply (simp)\ndone\n\ntheorem \"InjU (1::nat) :\\<^sub>u UTYPE(nat)\"\napply (simp add: typing)\ndone\n\ntheorem \"\\<not> InjU (1::nat) :\\<^sub>u UTYPE(int)\"\napply (simp add: typing)\ndone\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/axiomatic/theories/core/uval.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.3378329787049826}}
{"text": "section \\<open>Definitions\\<close>\n\ntext \\<open>\nThis section contains all necessary definitions of this development. Section~\\ref{sec:pm} contains \nthe structural definition of our program model which includes the security specification as well \nas abstractions of control flow and data.  Executions of our program model are defined in \nsection~\\ref{sec:ex}.  Additional well-formedness properties are defined in section~\\ref{sec:wf}. \nOur security property is defined in section~\\ref{sec:sec}.  Our characterisation of how information\nis propagated by executions of our program model is defined in section~\\ref{sec:char-cp}, for which\nthe correctness result can be found in section~\\ref{sec:cor-cp}.  Section~\\ref{sec:char-scp} contains\nan additional approximation of this characterisation whose correctness result can be found in \nsection~\\ref{sec:cor-scp}.\n\\<close>\n\n\ntheory IFC\nimports Main\nbegin\n\nsubsection \\<open>Program Model\\<close>\ntext_raw \\<open>\\label{sec:pm}\\<close>\n\ntext \\<open>Our program model contains all necessary components for the remaining development and consists of:\\<close>\n\nrecord ('n, 'var, 'val, 'obs) ifc_problem =  \n\\<comment> \\<open>A set of nodes representing program locations:\\<close>\n  nodes :: \\<open>'n set\\<close>\n\\<comment> \\<open>An initial node where all executions start:\\<close>\n  entry :: \\<open>'n\\<close>\n\\<comment> \\<open>A final node where executions can terminate:\\<close>\n  return :: \\<open>'n\\<close>\n\\<comment> \\<open>An abstraction of control flow in the form of an edge relation:\\<close>\n  edges :: \\<open>('n \\<times> 'n) set\\<close>\n\\<comment> \\<open>An abstraction of variables written at program locations:\\<close>\n  writes :: \\<open>'n \\<Rightarrow> 'var set\\<close>\n\\<comment> \\<open>An abstraction of variables read at program locations:\\<close>\n  reads :: \\<open>'n \\<Rightarrow> 'var set\\<close>\n\\<comment> \\<open>A set of variables containing the confidential information in the initial state:\\<close>\n  hvars :: \\<open>'var set\\<close>\n\\<comment> \\<open>A step function on location state pairs:\\<close>\n  step :: \\<open>('n \\<times> ('var \\<Rightarrow> 'val)) \\<Rightarrow> ('n \\<times> ('var \\<Rightarrow> 'val))\\<close>\n\\<comment> \\<open>An attacker model producing observations based on the reached state at certain locations:\\<close>\n  att :: \\<open>'n \\<rightharpoonup> (('var \\<Rightarrow> 'val) \\<Rightarrow> 'obs)\\<close>\n\ntext \\<open>We fix a program in the following in order to define the central concepts.  \nThe necessary well-formedness assumptions will be made in section~\\ref{sec:wf}.\\<close>\nlocale IFC_def =\nfixes prob :: \\<open>('n, 'var, 'val, 'obs) ifc_problem\\<close>\nbegin  \n\ntext \\<open>Some short hands to the components of the program which we will utilise exclusively in the following.\\<close>\ndefinition nodes where \\<open>nodes = ifc_problem.nodes prob\\<close>\ndefinition entry where \\<open>entry = ifc_problem.entry prob\\<close>\ndefinition return where \\<open>return = ifc_problem.return prob\\<close>\ndefinition edges where \\<open>edges = ifc_problem.edges prob\\<close>\ndefinition writes where \\<open>writes = ifc_problem.writes prob\\<close>\ndefinition reads where \\<open>reads = ifc_problem.reads prob\\<close>\ndefinition hvars where \\<open>hvars = ifc_problem.hvars prob\\<close>\ndefinition step where \\<open>step = ifc_problem.step prob\\<close>\ndefinition att where \\<open>att = ifc_problem.att prob\\<close>\n\ntext \\<open>The components of the step function for convenience.\\<close>\ndefinition suc where \\<open>suc n \\<sigma> = fst (step (n, \\<sigma>))\\<close>\ndefinition sem where \\<open>sem n \\<sigma> = snd (step (n, \\<sigma>))\\<close>\n\nlemma step_suc_sem: \\<open>step (n,\\<sigma>) = (suc n \\<sigma>, sem n \\<sigma>)\\<close> unfolding suc_def sem_def by auto\n\n\nsubsubsection \\<open>Executions\\<close>\ntext \\<open>\\label{sec:ex}\\<close>\ntext \\<open>In order to define what it means for a program to be well-formed, we first require concepts \nof executions and program paths.\\<close>\n\ntext \\<open>The sequence of nodes visited by the execution corresponding to an input state.\\<close>\ndefinition path where\n\\<open>path \\<sigma> k= fst ((step^^k) (entry,\\<sigma>))\\<close>\n\ntext \\<open>The sequence of states visited by the execution corresponding to an input state.\\<close>\ndefinition kth_state ( \\<open>_\\<^bsup>_\\<^esup>\\<close> [111,111] 110) where \n\\<open>\\<sigma>\\<^bsup>k\\<^esup> = snd ((step^^k) (entry,\\<sigma>))\\<close>\n\ntext \\<open>A predicate asserting that a sequence of nodes is a valid program path according to the\ncontrol flow graph.\\<close>\n\ndefinition is_path where\n\\<open>is_path \\<pi> = (\\<forall> n. (\\<pi> n, \\<pi> (Suc n)) \\<in> edges)\\<close> \nend\n\nsubsubsection \\<open>Well-formed Programs\\<close>\ntext_raw \\<open>\\label{sec:wf}\\<close>\n\ntext \\<open>The following assumptions define our notion of valid programs.\\<close>\nlocale IFC = IFC_def \\<open>prob\\<close> for prob:: \\<open>('n, 'var, 'val, 'out) ifc_problem\\<close> +\nassumes ret_is_node[simp,intro]: \\<open>return \\<in> nodes\\<close>\nand entry_is_node[simp,intro]: \\<open>entry \\<in> nodes\\<close>\nand writes: \\<open>\\<And> v n. (\\<exists>\\<sigma>. \\<sigma> v \\<noteq> sem n \\<sigma> v) \\<Longrightarrow> v \\<in> writes n\\<close>\nand writes_return: \\<open>writes return = {}\\<close>\nand uses_writes: \\<open>\\<And> n \\<sigma> \\<sigma>'. (\\<forall> v \\<in> reads n. \\<sigma> v = \\<sigma>' v) \\<Longrightarrow> \\<forall> v \\<in> writes n. sem n \\<sigma> v = sem n \\<sigma>' v\\<close>\nand uses_suc: \\<open>\\<And> n \\<sigma> \\<sigma>'. (\\<forall> v \\<in> reads n. \\<sigma> v = \\<sigma>' v) \\<Longrightarrow> suc n \\<sigma> = suc n \\<sigma>'\\<close>\nand uses_att: \\<open>\\<And> n f \\<sigma> \\<sigma>'. att n = Some f \\<Longrightarrow> (\\<forall> v \\<in> reads n. \\<sigma> v = \\<sigma>' v) \\<Longrightarrow> f \\<sigma> = f \\<sigma>'\\<close>\nand edges_complete[intro,simp]: \\<open>\\<And>m \\<sigma>. m \\<in> nodes \\<Longrightarrow> (m,suc m \\<sigma>) \\<in> edges\\<close>\nand edges_return : \\<open>\\<And>x. (return,x) \\<in> edges \\<Longrightarrow> x = return \\<close>\nand edges_nodes: \\<open>edges \\<subseteq> nodes \\<times> nodes\\<close>    \nand reaching_ret: \\<open>\\<And> x. x \\<in> nodes \\<Longrightarrow> \\<exists> \\<pi> n. is_path \\<pi> \\<and> \\<pi> 0 = x \\<and> \\<pi> n = return\\<close>\n\n\nsubsection \\<open>Security\\<close>\ntext_raw \\<open>\\label{sec:sec}\\<close>\n\ntext \\<open>We define our notion of security, which corresponds to what Bohannon et al.~\\cite{Bohannon:2009:RN:1653662.1653673} \nrefer to as indistinguishable security.  In order to do so we require notions of observations made\nby the attacker, termination and equivalence of input states.\\<close>\n\ncontext IFC_def\nbegin\n\nsubsubsection \\<open>Observations\\<close>\ntext_raw \\<open>\\label{sec:obs}\\<close>\n\ntext \\<open>The observation made at a given index within an execution.\\<close>\ndefinition obsp where\n\\<open>obsp \\<sigma> k = (case att(path \\<sigma> k) of Some f \\<Rightarrow> Some (f (\\<sigma>\\<^bsup>k\\<^esup>)) | None \\<Rightarrow> None)\\<close>\n\ntext \\<open>The indices within a path where an observation is made.\\<close>\ndefinition obs_ids :: \\<open>(nat \\<Rightarrow> 'n) \\<Rightarrow> nat set\\<close> where\n\\<open>obs_ids \\<pi> = {k. att (\\<pi> k) \\<noteq> None}\\<close>\n\ntext \\<open>A predicate relating an observable index to the number of observations made before.\\<close>\ndefinition is_kth_obs :: \\<open>(nat \\<Rightarrow> 'n) \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool\\<close>where\n\\<open>is_kth_obs \\<pi> k i = (card (obs_ids \\<pi> \\<inter> {..<i}) = k \\<and> att (\\<pi> i) \\<noteq>  None)\\<close>\n\ntext \\<open>The final sequence of observations made for an execution.\\<close>\ndefinition obs where\n\\<open>obs \\<sigma> k = (if (\\<exists>i. is_kth_obs (path \\<sigma>) k i) then obsp \\<sigma> (THE i. is_kth_obs (path \\<sigma>) k i) else None)\\<close>\n\ntext \\<open>Comparability of observations.\\<close>\ndefinition obs_prefix :: \\<open>(nat \\<Rightarrow> 'obs option) \\<Rightarrow> (nat \\<Rightarrow> 'obs option) \\<Rightarrow> bool\\<close> (infix \\<open>\\<lesssim>\\<close> 50) where\n\\<open>a \\<lesssim> b \\<equiv> \\<forall> i. a i \\<noteq> None \\<longrightarrow> a i = b i\\<close>\n\ndefinition obs_comp (infix \\<open>\\<approx>\\<close> 50) where\n\\<open>a \\<approx> b \\<equiv> a \\<lesssim> b \\<or> b \\<lesssim> a\\<close>\n\nsubsubsection \\<open>Low equivalence of input states\\<close>\n\ndefinition restrict (infix \\<open>\\<restriction>\\<close> 100 ) where\n\\<open>f\\<restriction>U = (\\<lambda> n. if n \\<in> U then f n else undefined)\\<close>\n\ntext \\<open>Two input states are low equivalent if they coincide on the non high variables.\\<close>\ndefinition loweq (infix \\<open>=\\<^sub>L\\<close> 50) \nwhere \\<open>\\<sigma> =\\<^sub>L \\<sigma>' = (\\<sigma>\\<restriction>(-hvars) = \\<sigma>'\\<restriction>(-hvars))\\<close>\n\nsubsubsection \\<open>Termination\\<close>\n\ntext \\<open>An execution terminates iff it reaches the terminal node at any point.\\<close>\ndefinition terminates where\n\\<open>terminates \\<sigma> \\<equiv> \\<exists> i. path \\<sigma> i = return\\<close>\n\n\nsubsubsection \\<open>Security Property\\<close>\ntext \\<open>The fixed program is secure if and only if for all pairs of low equivalent inputs the observation\nsequences are comparable and if the execution for an input state terminates then the observation sequence \nis not missing any observations.\\<close>\n\ndefinition secure where\n\\<open>secure \\<equiv> \\<forall> \\<sigma> \\<sigma>'. \\<sigma> =\\<^sub>L \\<sigma>' \\<longrightarrow> (obs \\<sigma> \\<approx> obs \\<sigma>' \\<and> (terminates \\<sigma> \\<longrightarrow> obs \\<sigma>' \\<lesssim> obs \\<sigma>))\\<close>\n\n\n\nsubsection \\<open>Characterisation of Information Flows\\<close>\ntext \\<open>We now define our characterisation of information flows which tracks data and control dependencies \nwithin executions. To do so we first require some additional concepts.\\<close>\n\nsubsubsection \\<open>Post Dominance\\<close>\ntext \\<open>We utilise the post dominance relation in order to define control dependence.\\<close>\n\ntext \\<open>The basic post dominance relation.\\<close>\ndefinition is_pd (infix \\<open>pd\\<rightarrow>\\<close> 50) where \n\\<open>y pd\\<rightarrow> x \\<longleftrightarrow> x \\<in> nodes \\<and> (\\<forall> \\<pi> n. is_path \\<pi> \\<and> \\<pi> (0::nat) = x \\<and> \\<pi> n = return \\<longrightarrow> (\\<exists>k\\<le>n. \\<pi> k = y))\\<close>\n\ntext \\<open>The immediate post dominance relation.\\<close>\ndefinition is_ipd (infix \\<open>ipd\\<rightarrow>\\<close> 50)where\n\\<open>y ipd\\<rightarrow> x \\<longleftrightarrow> x \\<noteq> y \\<and> y pd\\<rightarrow> x \\<and> (\\<forall> z. z\\<noteq>x \\<and> z pd\\<rightarrow> x \\<longrightarrow> z pd\\<rightarrow> y)\\<close>\n\ndefinition ipd where \n\\<open>ipd x = (THE y. y ipd\\<rightarrow> x)\\<close>\n\ntext \\<open>The post dominance tree.\\<close>\ndefinition pdt where\n\\<open>pdt = {(x,y). x\\<noteq>y \\<and> y pd\\<rightarrow> x}\\<close>\n\n\nsubsubsection \\<open>Control Dependence\\<close>\n\ntext \\<open>An index on an execution path is control dependent upon another if the path does not visit\nthe immediate post domiator of the node reached by the smaller index.\\<close>\ndefinition is_cdi (\\<open>_ cd\\<^bsup>_\\<^esup>\\<rightarrow> _\\<close> [51,51,51]50) where\n\\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<longleftrightarrow> is_path \\<pi> \\<and> k < i \\<and> \\<pi> i \\<noteq> return \\<and> (\\<forall> j \\<in> {k..i}. \\<pi> j \\<noteq> ipd (\\<pi> k))\\<close> \n\ntext \\<open>The largest control dependency of an index is the immediate control dependency.\\<close>\ndefinition is_icdi (\\<open>_ icd\\<^bsup>_\\<^esup>\\<rightarrow> _\\<close> [51,51,51]50) where\n\\<open>n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n' \\<longleftrightarrow> is_path \\<pi> \\<and> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n' \\<and> (\\<forall> m \\<in> {n'<..<n}.\\<not> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m)\\<close>\n\ntext \\<open>For the definition of the control slice, which we will define next, we require the uniqueness \nof the immediate control dependency.\\<close>\n\nlemma icd_uniq: assumes  \\<open>m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> \\<open> m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n'\\<close> shows \\<open>n = n'\\<close>\nproof - \n  {\n    fix n n' assume *: \\<open>m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> \\<open> m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n'\\<close> \\<open>n < n'\\<close>\n    have \\<open>n'<m\\<close> using * unfolding is_icdi_def is_cdi_def by auto    \n    hence \\<open>\\<not> m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n'\\<close> using * unfolding is_icdi_def by auto\n    with *(2) have \\<open>False\\<close> unfolding is_icdi_def by auto\n  }\n  thus ?thesis using assms by (metis linorder_neqE_nat)\nqed\n\n\nsubsubsection \\<open>Control Slice\\<close>\ntext \\<open>We utilise the control slice, that is the sequence of nodes visited by the control dependencies \nof an index, to match indices between executions.\\<close>\n\nfunction cs:: \\<open>(nat \\<Rightarrow> 'n) \\<Rightarrow> nat \\<Rightarrow> 'n list\\<close> (\\<open>cs\\<^bsup>_\\<^esup> _\\<close> [51,70] 71) where\n\\<open>cs\\<^bsup>\\<pi>\\<^esup> n = (if (\\<exists> m. n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m) then (cs \\<pi> (THE m. n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m))@[\\<pi> n] else [\\<pi> n])\\<close> \nby pat_completeness auto  \ntermination \\<open>cs\\<close> proof\n  show \\<open>wf (measure snd)\\<close> by simp\n  fix \\<pi> n  \n  define m where \\<open>m == (The (is_icdi n \\<pi>))\\<close>\n  assume \\<open>Ex (is_icdi n \\<pi>)\\<close> \n  hence \\<open>n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> unfolding m_def by (metis (full_types) icd_uniq theI')\n  hence \\<open>m < n\\<close> unfolding is_icdi_def is_cdi_def by simp\n  thus \\<open>((\\<pi>, The (is_icdi n \\<pi>)), \\<pi>, n) \\<in> measure snd\\<close> by (metis in_measure m_def snd_conv)\nqed\n\ninductive cs_less (infix \\<open>\\<prec>\\<close> 50) where\n\\<open>length xs < length ys \\<Longrightarrow> take (length xs) ys = xs  \\<Longrightarrow> xs \\<prec> ys\\<close>     \n\ndefinition cs_select (infix \\<open>\\<exclamdown>\\<close> 50) where\n\\<open>\\<pi>\\<exclamdown>xs = (THE k. cs\\<^bsup>\\<pi>\\<^esup> k = xs)\\<close>\n\n\nsubsubsection \\<open>Data Dependence\\<close>\n\ntext \\<open>Data dependence is defined straight forward. An index is data dependent upon another, \nif the index reads a variable written by the earlier index and the variable in question has not \nbeen written by any index in between.\\<close>\ndefinition is_ddi (\\<open>_ dd\\<^bsup>_,_\\<^esup>\\<rightarrow> _\\<close> [51,51,51,51] 50) where\n\\<open>n dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> m \\<longleftrightarrow> is_path \\<pi> \\<and> m < n \\<and> v \\<in> reads (\\<pi> n) \\<inter> (writes (\\<pi> m)) \\<and> (\\<forall> l \\<in> {m<..<n}. v \\<notin> writes (\\<pi> l))\\<close>\n\n\n\nsubsubsection \\<open>Characterisation via Critical Paths\\<close>\ntext_raw \\<open>\\label{sec:char-cp}\\<close>\ntext \\<open>With the above we define the set of critical paths which as we will prove characterise the matching\npoints in executions where diverging data is read.\\<close>\n\ninductive_set cp where\n\n\\<comment> \\<open>Any pair of low equivalent input states and indices where a diverging high variable is first\nread is critical.\\<close>\n\n\\<open>\\<lbrakk>\\<sigma> =\\<^sub>L \\<sigma>'; \n  cs\\<^bsup>path \\<sigma>\\<^esup> n = cs\\<^bsup>path \\<sigma>'\\<^esup> n'; \n  h \\<in> reads(path \\<sigma> n); \n  (\\<sigma>\\<^bsup>n\\<^esup>) h \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) h; \n  \\<forall> k<n. h\\<notin>writes(path \\<sigma> k); \n  \\<forall> k'<n'. h\\<notin>writes(path \\<sigma>' k')\n \\<rbrakk> \\<Longrightarrow> ((\\<sigma>,n),(\\<sigma>',n')) \\<in> cp\\<close> |\n\n\\<comment> \\<open>If from a pair of critical indices in two executions there exist data dependencies from both\nindices to a pair of matching indices where the variable diverges, the later pair of indices is critical.\\<close>\n\n\\<open>\\<lbrakk>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp; \n  n dd\\<^bsup>path \\<sigma>,v\\<^esup>\\<rightarrow> k;\n  n' dd\\<^bsup>path \\<sigma>',v\\<^esup>\\<rightarrow> k'; \n  cs\\<^bsup>path \\<sigma>\\<^esup> n = cs\\<^bsup>path \\<sigma>'\\<^esup> n'; \n  (\\<sigma>\\<^bsup>n\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v\n \\<rbrakk> \\<Longrightarrow> ((\\<sigma>,n),(\\<sigma>',n')) \\<in> cp\\<close> |\n\n\\<comment> \\<open>If from a pair of critical indices the executions take different branches and one of the critical \nindices is a control dependency of an index that is data dependency of a matched index where diverging \ndata is read and the variable in question is not written by the other execution after the executions\nfirst reached matching indices again, then the later matching pair of indices is critical.\\<close>\n\n\\<open>\\<lbrakk>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp; \n  n dd\\<^bsup>path \\<sigma>,v\\<^esup>\\<rightarrow> l; \n  l cd\\<^bsup>path \\<sigma>\\<^esup>\\<rightarrow> k; \n  cs\\<^bsup>path \\<sigma>\\<^esup> n = cs\\<^bsup>path \\<sigma>'\\<^esup> n'; \n  path \\<sigma> (Suc k) \\<noteq> path \\<sigma>' (Suc k'); \n  (\\<sigma>\\<^bsup>n\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v; \n  \\<forall>j'\\<in>{(LEAST i'. k' < i' \\<and> (\\<exists>i. cs\\<^bsup>path \\<sigma>\\<^esup> i = cs\\<^bsup>path \\<sigma>'\\<^esup> i'))..<n'}. v\\<notin>writes (path \\<sigma>' j')\n \\<rbrakk> \\<Longrightarrow> ((\\<sigma>,n),(\\<sigma>',n')) \\<in> cp\\<close> | \n\n\\<comment> \\<open>The relation is symmetric.\\<close>\n\n\\<open>\\<lbrakk>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp\\<rbrakk> \\<Longrightarrow> ((\\<sigma>',k'),(\\<sigma>,k)) \\<in> cp\\<close>\n\n\ntext \\<open>Based on the set of critical paths, the critical observable paths are those that either directly \nreach observable nodes or are diverging control dependencies of an observable index.\\<close>\n\ninductive_set cop where\n\\<open>\\<lbrakk>((\\<sigma>,n),(\\<sigma>',n')) \\<in> cp;\n  path \\<sigma> n \\<in> dom att\n \\<rbrakk> \\<Longrightarrow> ((\\<sigma>,n),(\\<sigma>',n')) \\<in> cop\\<close> |\n\n\\<open>\\<lbrakk>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp; \n  n cd\\<^bsup>path \\<sigma>\\<^esup>\\<rightarrow> k; \n  path \\<sigma> (Suc k) \\<noteq> path \\<sigma>' (Suc k'); \n  path \\<sigma> n \\<in> dom att\n \\<rbrakk> \\<Longrightarrow> ((\\<sigma>,n),(\\<sigma>',k')) \\<in> cop\\<close>\n\n\n\nsubsubsection \\<open>Approximation via Single Critical Paths\\<close>\ntext_raw \\<open>\\label{sec:char-scp}\\<close>\n\ntext \\<open>For applications we also define a single execution approximation.\\<close>\n\ndefinition is_dcdi_via (\\<open>_ dcd\\<^bsup>_,_\\<^esup>\\<rightarrow> _ via _ _\\<close> [51,51,51,51,51,51] 50) where\n\\<open>n dcd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> m via \\<pi>' m' = (is_path \\<pi> \\<and> m < n \\<and> (\\<exists> l' n'. cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m' \\<and> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n' \\<and> n' dd\\<^bsup>\\<pi>',v\\<^esup>\\<rightarrow> l' \\<and> l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m') \\<and> (\\<forall> l \\<in> {m..<n}. v\\<notin> writes(\\<pi> l)))\\<close>\n\ninductive_set scp where\n\\<open>\\<lbrakk>h \\<in> hvars; h \\<in> reads (path \\<sigma> n); (\\<forall> k<n. h\\<notin> writes(path \\<sigma> k))\\<rbrakk> \\<Longrightarrow> (path \\<sigma>,n) \\<in> scp\\<close> |\n\\<open>\\<lbrakk>(\\<pi>,m) \\<in> scp; n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<rbrakk> \\<Longrightarrow> (\\<pi>,n) \\<in> scp\\<close>|\n\\<open>\\<lbrakk>(\\<pi>,m) \\<in> scp; n dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> m\\<rbrakk> \\<Longrightarrow> (\\<pi>,n) \\<in> scp\\<close>|\n\\<open>\\<lbrakk>(\\<pi>,m) \\<in> scp; (\\<pi>',m') \\<in> scp; n dcd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> m via \\<pi>' m'\\<rbrakk> \\<Longrightarrow> (\\<pi>,n) \\<in> scp\\<close>\n\ninductive_set scop where\n\\<open>\\<lbrakk>(\\<pi>,n) \\<in> scp; \\<pi> n \\<in> dom att\\<rbrakk> \\<Longrightarrow> (\\<pi>,n) \\<in> scop\\<close>\n\n\n\nsubsubsection \\<open>Further Definitions\\<close>\ntext \\<open>The following concepts are utilised by the proofs.\\<close>\n\ninductive contradicts (infix \\<open>\\<cc>\\<close> 50) where\n\\<open>\\<lbrakk>cs\\<^bsup>\\<pi>'\\<^esup> k' \\<prec> cs\\<^bsup>\\<pi>\\<^esup> k ; \\<pi> = path \\<sigma>;  \\<pi>' = path \\<sigma>' ; \\<pi> (Suc (\\<pi>\\<exclamdown>cs\\<^bsup>\\<pi>'\\<^esup> k')) \\<noteq> \\<pi>' (Suc k')\\<rbrakk> \\<Longrightarrow> (\\<sigma>', k') \\<cc> (\\<sigma>, k)\\<close>|\n\\<open>\\<lbrakk>cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>\\<^esup> k ; \\<pi> = path \\<sigma>;  \\<pi>' = path \\<sigma>' ; \\<sigma>\\<^bsup>k\\<^esup> \\<restriction> (reads (\\<pi> k)) \\<noteq> \\<sigma>'\\<^bsup>k'\\<^esup> \\<restriction> (reads (\\<pi> k))\\<rbrakk> \\<Longrightarrow> (\\<sigma>',k') \\<cc> (\\<sigma>,k)\\<close>\n\ndefinition path_shift (infixl \\<open>\\<guillemotleft>\\<close> 51) where \n[simp]: \\<open>\\<pi>\\<guillemotleft>m = (\\<lambda> n. \\<pi> (m+n))\\<close> \n\ndefinition path_append :: \\<open>(nat \\<Rightarrow> 'n) \\<Rightarrow> nat \\<Rightarrow> (nat \\<Rightarrow> 'n) \\<Rightarrow> (nat \\<Rightarrow> 'n)\\<close> (\\<open>_ @\\<^bsup>_\\<^esup> _\\<close> [0,0,999] 51) where\n[simp]: \\<open>\\<pi> @\\<^bsup>m\\<^esup> \\<pi>' = (\\<lambda>n.(if n \\<le> m then \\<pi> n else \\<pi>' (n-m)))\\<close> \n\ndefinition eq_up_to :: \\<open>(nat \\<Rightarrow> 'n) \\<Rightarrow> nat \\<Rightarrow> (nat \\<Rightarrow> 'n) \\<Rightarrow> bool\\<close> (\\<open>_ =\\<^bsub>_\\<^esub> _\\<close> [55,55,55] 50) where\n\\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>' = (\\<forall> i \\<le> k. \\<pi> i = \\<pi>' i)\\<close>\n\nend (* End of locale IFC_def *)\n\n\n\n\nsection \\<open>Proofs\\<close>\ntext_raw \\<open>\\label{sec:proofs}\\<close>\n\nsubsection \\<open>Miscellaneous Facts\\<close>\n\nlemma option_neq_cases: assumes \\<open>x \\<noteq> y\\<close> obtains (none1) a where \\<open>x = None\\<close> \\<open>y = Some a\\<close> | (none2) a where \\<open>x = Some a\\<close> \\<open>y = None\\<close> | (some) a b where \\<open>x = Some a\\<close> \\<open>y = Some b\\<close> \\<open>a \\<noteq> b\\<close> using assms by fastforce\n\nlemmas nat_sym_cases[case_names less sym eq] = linorder_less_wlog\n\nlemma mod_bound_instance: assumes \\<open>j < (i::nat)\\<close> obtains j' where \\<open>k < j'\\<close> and \\<open>j' mod i = j\\<close>  proof -\n  have \\<open>k < Suc k * i + j\\<close> using assms less_imp_Suc_add by fastforce\n  moreover\n  have \\<open>(Suc k * i + j) mod i = j\\<close> by (metis assms mod_less mod_mult_self3) \n  ultimately show \\<open>thesis\\<close> using that by auto\nqed\n\nlemma list_neq_prefix_cases: assumes \\<open>ls \\<noteq> ls'\\<close> and \\<open>ls \\<noteq> Nil\\<close> and \\<open>ls' \\<noteq> Nil\\<close>\n  obtains (diverge) xs x x' ys ys' where \\<open>ls = xs@[x]@ys\\<close> \\<open>ls' = xs@[x']@ys'\\<close> \\<open>x \\<noteq> x'\\<close> |\n   (prefix1) xs where \\<open>ls = ls'@xs\\<close> and \\<open>xs \\<noteq> Nil\\<close> |\n   (prefix2) xs where \\<open>ls@xs = ls'\\<close> and \\<open>xs \\<noteq> Nil\\<close> \nusing assms proof (induct \\<open>length ls\\<close> arbitrary: \\<open>ls\\<close> \\<open>ls'\\<close> rule: less_induct)\n  case (less ls ls')\n  obtain z zs z' zs' where\n  lz: \\<open>ls = z#zs\\<close> \\<open>ls' = z'#zs'\\<close> by (metis list.exhaust less(6,7))\n  show \\<open>?case\\<close> proof cases\n    assume zz: \\<open>z = z'\\<close>\n    hence zsz: \\<open>zs \\<noteq> zs'\\<close> using less(5) lz by auto\n    have lenz: \\<open>length zs < length ls\\<close> using lz by auto    \n    show \\<open>?case\\<close> proof(cases \\<open>zs = Nil\\<close>)\n      assume zs: \\<open>zs = Nil\\<close>\n      hence \\<open>zs' \\<noteq> Nil\\<close> using zsz by auto\n      moreover\n      have \\<open>ls@zs' = ls'\\<close> using zs lz zz by auto\n      ultimately\n      show \\<open>thesis\\<close> using less(4) by blast\n    next\n      assume zs: \\<open>zs \\<noteq> Nil\\<close>\n      show \\<open>thesis\\<close> proof (cases \\<open>zs' = Nil\\<close>)\n        assume \\<open>zs' = Nil\\<close>\n        hence \\<open>ls = ls'@zs\\<close> using lz zz by auto\n        thus \\<open>thesis\\<close> using zs less(3) by blast\n      next\n        assume zs': \\<open>zs' \\<noteq> Nil\\<close>\n        { fix xs x ys x' ys' \n          assume \\<open>zs = xs @ [x] @ ys\\<close> \\<open>zs' = xs @ [x'] @ ys'\\<close> and xx: \\<open>x \\<noteq> x'\\<close>\n          hence \\<open>ls = (z#xs) @ [x] @ ys\\<close> \\<open>ls' = (z#xs) @ [x'] @ ys'\\<close> using lz zz by auto\n          hence \\<open>thesis\\<close> using less(2) xx by blast\n        } note * = this\n        { fix xs \n          assume \\<open>zs = zs' @ xs\\<close> and xs: \\<open>xs \\<noteq> []\\<close>\n          hence \\<open>ls = ls' @ xs\\<close> using lz zz by auto\n          hence \\<open>thesis\\<close> using xs less(3) by blast\n        } note ** = this\n        { fix xs \n          assume \\<open>zs@xs = zs'\\<close> and xs: \\<open>xs \\<noteq> []\\<close>\n          hence \\<open>ls@xs = ls'\\<close> using lz zz by auto\n          hence \\<open>thesis\\<close> using xs less(4) by blast\n        } note *** = this\n        have \\<open>(\\<And>xs x ys x' ys'. zs = xs @ [x] @ ys \\<Longrightarrow> zs' = xs @ [x'] @ ys' \\<Longrightarrow> x \\<noteq> x' \\<Longrightarrow> thesis) \\<Longrightarrow> \n              (\\<And>xs. zs = zs' @ xs \\<Longrightarrow> xs \\<noteq> [] \\<Longrightarrow> thesis) \\<Longrightarrow> \n              (\\<And>xs. zs @ xs = zs' \\<Longrightarrow> xs \\<noteq> [] \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close> \n        using less(1)[OF lenz _ _ _ zsz zs zs' ] .\n        thus \\<open>thesis\\<close> using * ** *** by blast\n      qed\n    qed \n  next\n    assume \\<open>z \\<noteq> z'\\<close>\n    moreover\n    have \\<open>ls = []@[z]@zs\\<close> \\<open>ls' = []@[z']@zs'\\<close> using lz by auto\n    ultimately show \\<open>thesis\\<close> using less(2) by blast\n  qed\nqed\n\nlemma three_cases: assumes \\<open>A \\<or> B \\<or> C\\<close> obtains \\<open>A\\<close> | \\<open>B\\<close> | \\<open>C\\<close> using assms by auto\n\nlemma insort_greater: \\<open>\\<forall> x \\<in> set ls. x < y \\<Longrightarrow> insort y ls = ls@[y]\\<close> by (induction \\<open>ls\\<close>,auto) \n\nlemma insort_append_first: assumes \\<open>\\<forall> y \\<in> set ys. x \\<le> y\\<close> shows \\<open>insort x (xs@ys) = insort x xs @ ys\\<close> using assms by (induction \\<open>xs\\<close>,auto,metis insort_is_Cons)\n\nlemma sorted_list_of_set_append: assumes \\<open>finite xs\\<close> \\<open>finite ys\\<close> \\<open>\\<forall> x \\<in> xs. \\<forall> y \\<in> ys. x < y\\<close> shows \\<open>sorted_list_of_set (xs \\<union> ys) = sorted_list_of_set xs @ (sorted_list_of_set ys)\\<close>\nusing assms(1,3) proof (induction \\<open>xs\\<close>)\n  case empty thus \\<open>?case\\<close> by simp\nnext\n  case (insert x xs)\n  hence iv: \\<open>sorted_list_of_set (xs \\<union> ys) = sorted_list_of_set xs @ sorted_list_of_set ys\\<close> by blast\n  have le: \\<open>\\<forall> y \\<in> set (sorted_list_of_set ys). x < y\\<close> using insert(4) assms(2) sorted_list_of_set by auto\n  have \\<open>sorted_list_of_set (insert x xs \\<union> ys) = sorted_list_of_set (insert x (xs \\<union> ys))\\<close> by auto\n  also \n  have \\<open>\\<dots> = insort x (sorted_list_of_set (xs \\<union> ys))\\<close> by (metis Un_iff assms(2) finite_Un insert.hyps(1) insert.hyps(2) insert.prems insertI1 less_irrefl sorted_list_of_set_insert)\n  also \n  have \\<open>\\<dots> = insort x (sorted_list_of_set xs @ sorted_list_of_set ys)\\<close> using iv by simp\n  also\n  have \\<open>\\<dots> = insort x (sorted_list_of_set xs) @ sorted_list_of_set ys\\<close>  by (metis le insort_append_first less_le_not_le)\n  also \n  have \\<open>\\<dots> = sorted_list_of_set (insert x xs) @ sorted_list_of_set ys\\<close> using sorted_list_of_set_insert[OF insert(1),of \\<open>x\\<close>] insert(2) by auto\n  finally  \n  show \\<open>?case\\<close> .\nqed\n\nlemma filter_insort: \\<open>sorted xs \\<Longrightarrow> filter P (insort x xs) = (if P x then insort x (filter P xs) else filter P xs)\\<close> by (induction \\<open>xs\\<close>, simp) (metis filter_insort filter_insort_triv map_ident) \n\nlemma filter_sorted_list_of_set: assumes \\<open>finite xs\\<close> shows \\<open>filter P (sorted_list_of_set xs) = sorted_list_of_set {x \\<in> xs. P x}\\<close> using assms proof(induction \\<open>xs\\<close>)\n  case empty thus \\<open>?case\\<close> by simp\nnext  \n  case (insert x xs)\n  have *: \\<open>set (sorted_list_of_set xs) = xs\\<close> \\<open>sorted (sorted_list_of_set xs)\\<close> \\<open>distinct (sorted_list_of_set xs)\\<close> by (auto simp add: insert.hyps(1))\n  have **: \\<open>P x \\<Longrightarrow> {y \\<in> insert x xs. P y} = insert x {y \\<in> xs. P y}\\<close> by auto\n  have ***: \\<open>\\<not> P x \\<Longrightarrow> {y \\<in> insert x xs. P y} = {y \\<in> xs. P y}\\<close> by auto\n  note filter_insort[OF *(2),of \\<open>P\\<close> \\<open>x\\<close>] sorted_list_of_set_insert[OF insert(1), of \\<open>x\\<close>] insert(2,3) ** ***  \n  thus \\<open>?case\\<close> by (metis (mono_tags) \"*\"(1) List.finite_set distinct_filter distinct_insort distinct_sorted_list_of_set set_filter sorted_list_of_set_insert)\nqed\n\nlemma unbounded_nat_set_infinite: assumes \\<open>\\<forall> (i::nat). \\<exists> j\\<ge>i. j \\<in> A\\<close> shows \\<open>\\<not> finite A\\<close> using assms\nby (metis finite_nat_set_iff_bounded_le not_less_eq_eq)\n\nlemma infinite_ascending: assumes nf: \\<open>\\<not> finite (A::nat set)\\<close> obtains f where \\<open>range f = A\\<close> \\<open>\\<forall> i. f i < f (Suc i)\\<close> proof \n  let \\<open>?f\\<close> = \\<open>\\<lambda> i. (LEAST a. a \\<in> A \\<and> card (A \\<inter> {..<a}) = i)\\<close>\n  { fix i \n    obtain a where \\<open>a \\<in> A\\<close> \\<open>card (A \\<inter> {..<a}) = i\\<close> \n    proof (induction \\<open>i\\<close> arbitrary: \\<open>thesis\\<close>)\n      case 0\n      let \\<open>?a0\\<close> = \\<open>(LEAST a. a \\<in> A)\\<close>\n      have \\<open>?a0 \\<in> A\\<close> by (metis LeastI empty_iff finite.emptyI nf set_eq_iff)      \n      moreover\n      have \\<open>\\<And>b. b \\<in> A \\<Longrightarrow> ?a0 \\<le> b\\<close> by (metis Least_le)\n      hence \\<open>card (A \\<inter> {..<?a}) = 0\\<close> by force\n      ultimately\n      show \\<open>?case\\<close> using 0 by blast\n    next\n      case (Suc i)\n      obtain a where aa: \\<open>a \\<in> A\\<close> and card: \\<open>card (A \\<inter> {..<a}) = i\\<close> using Suc.IH by metis\n      have nf': \\<open>~ finite (A - {..a})\\<close> using nf by auto\n      let \\<open>?b\\<close> = \\<open>LEAST b. b \\<in> A - {..a}\\<close>\n      have bin: \\<open>?b \\<in> A-{..a}\\<close> by (metis LeastI empty_iff finite.emptyI nf' set_eq_iff)\n      have le: \\<open>\\<And>c. c \\<in> A-{..a} \\<Longrightarrow> ?b \\<le> c\\<close> by (metis Least_le)\n      have ab: \\<open>a < ?b\\<close> using bin by auto\n      have \\<open>\\<And> c. c \\<in> A \\<Longrightarrow> c < ?b \\<Longrightarrow> c \\<le> a\\<close> using le by force\n      hence \\<open>A \\<inter> {..<?b} = insert a (A \\<inter> {..<a})\\<close> using bin ab aa by force \n      hence \\<open>card (A \\<inter>{..<?b}) = Suc i\\<close> using card by auto\n      thus \\<open>?case\\<close> using Suc.prems bin by auto\n    qed\n    note \\<open>\\<And> thesis. ((\\<And>a. a \\<in> A \\<Longrightarrow> card (A \\<inter> {..<a}) = i \\<Longrightarrow> thesis) \\<Longrightarrow> thesis)\\<close>\n  }\n  note ex = this\n    \n  {\n    fix i\n    obtain a where a: \\<open>a \\<in> A \\<and> card (A \\<inter>{..<a}) = i\\<close>  using ex by blast\n    have ina: \\<open>?f i \\<in> A\\<close> and card: \\<open>card (A \\<inter>{..<?f i}) = i\\<close> using LeastI[of \\<open>\\<lambda> a. a \\<in> A \\<and> card (A \\<inter>{..<a}) = i\\<close> \\<open>a\\<close>, OF a] by auto    \n    obtain b where b: \\<open>b \\<in> A \\<and> card (A \\<inter>{..<b}) = Suc i\\<close>  using ex by blast\n    have inab: \\<open>?f (Suc i) \\<in> A\\<close> and cardb: \\<open>card (A \\<inter>{..<?f (Suc i)}) = Suc i\\<close> using LeastI[of \\<open>\\<lambda> a. a \\<in> A \\<and> card (A \\<inter>{..<a}) = Suc i\\<close> \\<open>b\\<close>, OF b] by auto\n    have \\<open>?f i < ?f (Suc i)\\<close> proof (rule ccontr)\n      assume \\<open>\\<not> ?f i < ?f (Suc i)\\<close>\n      hence \\<open>A \\<inter>{..<?f (Suc i)} \\<subseteq> A \\<inter>{..<?f i}\\<close> by auto\n      moreover have \\<open>finite (A \\<inter>{..<?f i})\\<close> by auto\n      ultimately have \\<open>card(A \\<inter>{..<?f (Suc i)}) \\<le> card (A \\<inter>{..<?f i})\\<close> by (metis (erased, lifting) card_mono)\n      thus \\<open>False\\<close> using card cardb by auto \n    qed\n    note this ina\n  }\n  note b = this\n  thus \\<open>\\<forall> i. ?f i < ?f (Suc i)\\<close> by auto\n  have *: \\<open>range ?f \\<subseteq> A\\<close> using b by auto\n  moreover\n  { \n    fix a assume ina: \\<open>a \\<in> A\\<close>\n    let \\<open>?i\\<close> = \\<open>card (A \\<inter> {..<a})\\<close>\n    obtain b where b: \\<open>b \\<in> A \\<and> card (A \\<inter>{..<b}) = ?i\\<close>  using ex by blast\n    have inab: \\<open>?f ?i \\<in> A\\<close> and cardb: \\<open>card (A \\<inter>{..<?f ?i}) = ?i\\<close> using LeastI[of \\<open>\\<lambda> a. a \\<in> A \\<and> card (A \\<inter>{..<a}) = ?i\\<close> \\<open>b\\<close>, OF b] by auto\n    have le: \\<open>?f ?i \\<le> a\\<close> using Least_le[of \\<open>\\<lambda> a. a \\<in> A \\<and> card (A \\<inter>{..<a}) = ?i\\<close> \\<open>a\\<close>] ina by auto    \n    have \\<open>a = ?f ?i\\<close> proof (rule ccontr)\n      have fin: \\<open>finite (A \\<inter> {..<a})\\<close> by auto\n      assume \\<open>a \\<noteq> ?f ?i\\<close>\n      hence \\<open>?f ?i < a\\<close> using le by simp\n      hence \\<open>?f ?i \\<in> A \\<inter> {..<a}\\<close> using inab by auto\n      moreover\n      have \\<open>A \\<inter> {..<?f ?i} \\<subseteq> A \\<inter> {..<a}\\<close> using le by auto\n      hence \\<open>A \\<inter> {..<?f ?i} = A \\<inter> {..<a}\\<close> using cardb card_subset_eq[OF fin] by auto\n      ultimately      \n      show \\<open>False\\<close> by auto\n    qed\n    hence \\<open>a \\<in> range ?f\\<close> by auto\n  }\n  hence \\<open>A \\<subseteq> range ?f\\<close> by auto \n  ultimately show \\<open>range ?f = A\\<close> by auto\nqed\n\nlemma mono_ge_id: \\<open>\\<forall> i. f i < f (Suc i) \\<Longrightarrow> i \\<le> f i\\<close> \n  apply (induction \\<open>i\\<close>,auto) \n  by (metis not_le not_less_eq_eq order_trans)\n\nlemma insort_map_mono: assumes mono: \\<open>\\<forall> n m. n < m \\<longrightarrow> f n < f m\\<close> shows \\<open>map f (insort n ns) = insort (f n) (map f ns)\\<close>\n  apply (induction \\<open>ns\\<close>)\n   apply auto\n     apply (metis not_less not_less_iff_gr_or_eq mono)\n    apply (metis antisym_conv1 less_imp_le mono)\n   apply (metis mono not_less)\n  by (metis mono not_less)  \n\nlemma sorted_list_of_set_map_mono: assumes mono: \\<open>\\<forall> n m. n < m \\<longrightarrow> f n < f m\\<close> and fin: \\<open>finite A\\<close>\nshows \\<open>map f (sorted_list_of_set A) = sorted_list_of_set (f`A)\\<close>\nusing fin proof (induction)\n  case empty thus \\<open>?case\\<close> by simp\nnext\n  case (insert x A)\n  have [simp]:\\<open>sorted_list_of_set (insert x A) = insort x (sorted_list_of_set A)\\<close> using insert sorted_list_of_set_insert by simp\n  have \\<open>f ` insert x A = insert (f x) (f ` A)\\<close> by auto\n  moreover\n  have \\<open>f x \\<notin> f`A\\<close> apply (rule ccontr) using insert(2) mono apply auto by (metis insert.hyps(2) mono neq_iff)\n  ultimately\n  have \\<open>sorted_list_of_set (f ` insert x A) = insort (f x) (sorted_list_of_set (f`A))\\<close> using insert(1) sorted_list_of_set_insert by simp\n  also\n  have \\<open>\\<dots> = insort (f x) (map f (sorted_list_of_set A))\\<close> using insert.IH by auto\n  also have \\<open>\\<dots> = map f (insort x (sorted_list_of_set A))\\<close> using insort_map_mono[OF mono] by auto\n  finally  \n  show \\<open>map f (sorted_list_of_set (insert x A)) = sorted_list_of_set (f ` insert x A)\\<close> by simp\nqed\n\nlemma GreatestIB:\nfixes n :: \\<open>nat\\<close> and P\nassumes a:\\<open>\\<exists>k\\<le>n. P k\\<close>\nshows GreatestBI: \\<open>P (GREATEST k. k\\<le>n \\<and> P k)\\<close> and GreatestB: \\<open>(GREATEST k. k\\<le>n \\<and> P k) \\<le> n\\<close> \nproof -\n  show \\<open>P (GREATEST k. k\\<le>n \\<and> P k)\\<close> using GreatestI_ex_nat[OF assms] by auto  \n  show \\<open>(GREATEST k. k\\<le>n \\<and> P k) \\<le> n\\<close> using GreatestI_ex_nat[OF assms] by auto\nqed\n\nlemma GreatestB_le:\nfixes n :: \\<open>nat\\<close>\nassumes \\<open>x\\<le>n\\<close> and \\<open>P x\\<close>\nshows \\<open>x \\<le> (GREATEST k. k\\<le>n \\<and> P k)\\<close> \nproof -\n  have *: \\<open>\\<forall> y. y\\<le>n \\<and> P y \\<longrightarrow> y<Suc n\\<close> by auto\n  then show \\<open>x \\<le> (GREATEST k. k\\<le>n \\<and> P k)\\<close> using assms by (blast intro: Greatest_le_nat)\nqed\n\nlemma LeastBI_ex: assumes \\<open>\\<exists>k \\<le> n. P k\\<close> shows \\<open>P (LEAST k::'c::wellorder. P k)\\<close> and \\<open>(LEAST k. P k) \\<le> n\\<close> \nproof -\n  from assms guess k .. \n  hence k: \\<open>k \\<le> n\\<close> \\<open>P k\\<close> by auto     \n  thus \\<open>P (LEAST k. P k)\\<close> using LeastI[of \\<open>P\\<close> \\<open>k\\<close>] by simp\n  show \\<open>(LEAST k. P k) \\<le> n\\<close> using Least_le[of \\<open>P\\<close> \\<open>k\\<close>] k by auto\nqed\n\nlemma allB_atLeastLessThan_lower:  assumes \\<open>(i::nat) \\<le> j\\<close> \\<open>\\<forall> x\\<in>{i..<n}. P x\\<close> shows \\<open>\\<forall> x\\<in>{j..<n}. P x\\<close> proof \n  fix x assume \\<open>x\\<in>{j..<n}\\<close> hence \\<open>x\\<in>{i..<n}\\<close> using assms(1) by simp\n  thus \\<open>P x\\<close> using assms(2) by auto\nqed\n\n\nsubsection \\<open>Facts about Paths\\<close>\n\ncontext IFC\nbegin\n\nlemma path0: \\<open>path \\<sigma> 0 = entry\\<close> unfolding path_def by auto\n\nlemma path_in_nodes[intro]: \\<open>path \\<sigma> k \\<in> nodes\\<close> proof (induction \\<open>k\\<close>)\n  case (Suc k)\n  hence \\<open>\\<And> \\<sigma>'. (path \\<sigma> k, suc (path \\<sigma> k) \\<sigma>') \\<in> edges\\<close> by auto\n  hence \\<open>(path \\<sigma> k, path \\<sigma> (Suc k)) \\<in> edges\\<close> unfolding path_def \n    by (metis suc_def comp_apply funpow.simps(2) prod.collapse) \n  thus \\<open>?case\\<close> using edges_nodes by force\nqed (auto simp add: path_def)\n\nlemma path_is_path[simp]: \\<open>is_path (path \\<sigma>)\\<close> unfolding is_path_def path_def using step_suc_sem apply auto\nby (metis path_def suc_def edges_complete path_in_nodes prod.collapse)\n\nlemma term_path_stable: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> i = return\\<close> and le: \\<open>i \\<le> j\\<close> shows \\<open>\\<pi> j = return\\<close> \nusing le proof (induction \\<open>j\\<close>)\n  case (Suc j) \n  show \\<open>?case\\<close> proof cases\n    assume \\<open>i\\<le>j\\<close>\n    hence \\<open>\\<pi> j = return\\<close> using Suc by simp\n    hence \\<open>(return, \\<pi> (Suc j)) \\<in> edges\\<close> using assms(1) unfolding is_path_def by metis\n    thus \\<open>\\<pi> (Suc j) = return\\<close> using edges_return by auto\n  next\n    assume \\<open>\\<not> i \\<le> j\\<close>\n    hence \\<open>Suc j = i\\<close> using Suc by auto\n    thus \\<open>?thesis\\<close> using assms(2) by auto\n  qed\nnext\n  case 0 thus \\<open>?case\\<close> using assms by simp\nqed \n\nlemma path_path_shift: assumes \\<open>is_path \\<pi>\\<close> shows \\<open>is_path (\\<pi>\\<guillemotleft>m)\\<close> \nusing assms unfolding is_path_def by simp\n\nlemma path_cons: assumes \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi> m = \\<pi>' 0\\<close> shows \\<open>is_path (\\<pi> @\\<^bsup>m\\<^esup> \\<pi>')\\<close> \nunfolding is_path_def proof(rule,cases)\n  fix n assume \\<open>m < n\\<close> thus \\<open>((\\<pi> @\\<^bsup>m\\<^esup> \\<pi>') n, (\\<pi> @\\<^bsup>m\\<^esup>  \\<pi>') (Suc n)) \\<in> edges\\<close> \n    using assms(2) unfolding is_path_def path_append_def\n    by (auto,metis Suc_diff_Suc diff_Suc_Suc less_SucI) \nnext\n  fix n assume *: \\<open>\\<not> m < n\\<close>  thus \\<open>((\\<pi> @\\<^bsup>m\\<^esup>  \\<pi>') n, (\\<pi> @\\<^bsup>m\\<^esup>  \\<pi>') (Suc n)) \\<in> edges\\<close> proof cases\n    assume [simp]: \\<open>n = m\\<close>\n    thus \\<open>?thesis\\<close> using assms unfolding is_path_def path_append_def by force\n  next\n    assume \\<open>n \\<noteq> m\\<close>\n    hence \\<open>Suc n \\<le> m\\<close> \\<open>n\\<le> m\\<close> using * by auto\n    with assms(1) show \\<open>?thesis\\<close> unfolding is_path_def by auto\n  qed\nqed\n\nlemma is_path_loop: assumes \\<open>is_path \\<pi>\\<close> \\<open>0 < i\\<close> \\<open>\\<pi> i = \\<pi> 0\\<close> shows \\<open>is_path (\\<lambda> n. \\<pi> (n mod i))\\<close> unfolding is_path_def proof (rule,cases)\n  fix n\n  assume \\<open>0 < Suc n mod i\\<close>\n  hence \\<open>Suc n mod i = Suc (n mod i)\\<close> by (metis mod_Suc neq0_conv)\n  moreover \n  have \\<open>(\\<pi> (n mod i), \\<pi> (Suc (n mod i))) \\<in> edges\\<close> using assms(1) unfolding is_path_def by auto\n  ultimately\n  show \\<open>(\\<pi> (n mod i), \\<pi> (Suc n mod i)) \\<in> edges\\<close> by simp\n  next\n  fix n\n  assume \\<open>\\<not> 0 < Suc n mod i\\<close>\n  hence \\<open>Suc n mod i = 0\\<close> by auto\n  moreover \n  hence \\<open>n mod i = i - 1\\<close> using assms(2) by (metis Zero_neq_Suc diff_Suc_1 mod_Suc)\n  ultimately\n  show \\<open>(\\<pi>(n mod i), \\<pi> (Suc n mod i)) \\<in> edges\\<close> using assms(1) unfolding is_path_def by (metis assms(3) mod_Suc)\nqed\n\nlemma path_nodes: \\<open>is_path \\<pi> \\<Longrightarrow> \\<pi> k \\<in> nodes\\<close> unfolding is_path_def using edges_nodes by force \n\nlemma direct_path_return': assumes \\<open>is_path \\<pi> \\<close> \\<open>\\<pi> 0 = x\\<close> \\<open>x \\<noteq> return\\<close> \\<open>\\<pi> n = return\\<close>\nobtains \\<pi>' n' where \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi>' 0 = x\\<close> \\<open>\\<pi>' n' = return\\<close> \\<open>\\<forall> i> 0. \\<pi>' i \\<noteq> x\\<close>\nusing assms proof (induction \\<open>n\\<close> arbitrary: \\<open>\\<pi>\\<close>  rule: less_induct)\n  case (less n \\<pi>) \n  hence ih: \\<open>\\<And> n' \\<pi>'. n' < n \\<Longrightarrow> is_path \\<pi>' \\<Longrightarrow> \\<pi>' 0 = x \\<Longrightarrow> \\<pi>' n' = return \\<Longrightarrow> thesis\\<close> using assms by auto\n  show \\<open>thesis\\<close> proof cases\n    assume \\<open>\\<forall> i>0. \\<pi> i \\<noteq> x\\<close> thus \\<open>thesis\\<close> using less by auto\n  next\n    assume \\<open>\\<not> (\\<forall> i>0. \\<pi> i \\<noteq> x)\\<close>\n    then obtain i where \\<open>0<i\\<close> \\<open>\\<pi> i = x\\<close> by auto\n    hence \\<open>(\\<pi>\\<guillemotleft>i) 0 = x\\<close> by auto\n    moreover\n    have \\<open>i < n\\<close> using less(3,5,6) \\<open>\\<pi> i = x\\<close> by (metis linorder_neqE_nat term_path_stable less_imp_le)    \n    hence \\<open>(\\<pi>\\<guillemotleft>i) (n-i) = return\\<close> using less(6) by auto\n    moreover\n    have \\<open>is_path (\\<pi>\\<guillemotleft>i)\\<close> using less(3) by (metis path_path_shift)\n    moreover\n    have \\<open>n - i < n\\<close> using \\<open>0<i\\<close> \\<open>i < n\\<close> by auto    \n    ultimately show \\<open>thesis\\<close> using ih by auto\n  qed\nqed\n\nlemma direct_path_return: assumes  \\<open>x \\<in> nodes\\<close> \\<open>x \\<noteq> return\\<close>\nobtains \\<pi> n where \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> 0 = x\\<close> \\<open>\\<pi> n = return\\<close> \\<open>\\<forall> i> 0. \\<pi> i \\<noteq> x\\<close>\nusing direct_path_return'[of _ \\<open>x\\<close>] reaching_ret[OF assms(1)] assms(2) by blast\n\nlemma path_append_eq_up_to: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') =\\<^bsub>k\\<^esub> \\<pi>\\<close>  unfolding eq_up_to_def by auto\n\nlemma eq_up_to_le: assumes \\<open>k \\<le> n\\<close> \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>'\\<close> shows \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>'\\<close> using assms unfolding eq_up_to_def by auto \n\nlemma eq_up_to_refl: shows \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>\\<close> unfolding eq_up_to_def by auto \n\nlemma eq_up_to_sym: assumes \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>'\\<close> shows \\<open>\\<pi>' =\\<^bsub>k\\<^esub> \\<pi>\\<close> using assms unfolding eq_up_to_def by auto\n\nlemma eq_up_to_apply: assumes \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>'\\<close> \\<open>j \\<le> k\\<close> shows \\<open>\\<pi> j = \\<pi>' j\\<close> using assms unfolding eq_up_to_def by auto\n\nlemma path_swap_ret: assumes \\<open>is_path \\<pi>\\<close> obtains \\<pi>' n where \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>'\\<close> \\<open>\\<pi>' n = return\\<close>\nproof -\n  have nd: \\<open>\\<pi> k \\<in> nodes\\<close> using assms path_nodes by simp\n  obtain \\<pi>' n where *: \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi>' 0 = \\<pi> k\\<close> \\<open>\\<pi>' n = return\\<close> using reaching_ret[OF nd] by blast\n  have \\<open>\\<pi> =\\<^bsub>k\\<^esub> (\\<pi>@\\<^bsup>k\\<^esup> \\<pi>')\\<close> by (metis eq_up_to_sym path_append_eq_up_to)\n  moreover\n  have \\<open>is_path (\\<pi>@\\<^bsup>k\\<^esup> \\<pi>')\\<close> using assms * path_cons by metis\n  moreover\n  have \\<open>(\\<pi>@\\<^bsup>k\\<^esup> \\<pi>') (k + n) = return\\<close> using * by auto\n  ultimately\n  show \\<open>thesis\\<close> using that by blast\nqed\n\nlemma path_suc: \\<open>path \\<sigma> (Suc k) = fst (step (path \\<sigma> k, \\<sigma>\\<^bsup>k\\<^esup>))\\<close> by (induction \\<open>k\\<close>, auto simp: path_def kth_state_def)\n\nlemma kth_state_suc: \\<open>\\<sigma>\\<^bsup>Suc k\\<^esup>  = snd (step (path \\<sigma> k, \\<sigma>\\<^bsup>k\\<^esup>))\\<close> by (induction \\<open>k\\<close>, auto simp: path_def kth_state_def)\n\n\nsubsection \\<open>Facts about Post Dominators\\<close>\n\nlemma pd_trans: assumes 1: \\<open>y pd\\<rightarrow> x\\<close> and 2: \\<open>z pd\\<rightarrow>y\\<close> shows \\<open>z pd\\<rightarrow>x\\<close> \nproof -\n  {\n    fix \\<pi> n\n    assume 3[simp]: \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> 0 = x\\<close> \\<open>\\<pi> n = return\\<close>\n    then obtain k where \\<open>\\<pi> k = y\\<close> and 7: \\<open>k \\<le> n\\<close> using 1 unfolding is_pd_def by blast\n    then have \\<open>(\\<pi>\\<guillemotleft>k) 0 = y\\<close> and \\<open>(\\<pi>\\<guillemotleft>k) (n-k) = return\\<close> by auto\n    moreover have \\<open>is_path (\\<pi>\\<guillemotleft>k)\\<close> by(metis 3(1) path_path_shift)\n    ultimately obtain k' where 8: \\<open>(\\<pi>\\<guillemotleft>k) k' = z\\<close> and \\<open>k' \\<le> n-k\\<close> using 2 unfolding is_pd_def by blast\n    hence \\<open>k+k'\\<le>n\\<close> and \\<open>\\<pi> (k+ k') = z\\<close> using 7 by auto\n    hence \\<open>\\<exists>k\\<le>n. \\<pi> k = z\\<close> using path_nodes by auto    \n  }\n  thus \\<open>?thesis\\<close> using 1 unfolding is_pd_def by blast\nqed\n\nlemma pd_path: assumes \\<open>y pd\\<rightarrow> x\\<close>\nobtains \\<pi> n k where \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> 0 = x\\<close> and \\<open>\\<pi> n = return\\<close> and \\<open>\\<pi> k = y\\<close> and \\<open>k \\<le> n\\<close>   \nusing assms unfolding is_pd_def using reaching_ret[of \\<open>x\\<close>] by blast\n\nlemma pd_antisym: assumes xpdy: \\<open>x pd\\<rightarrow> y\\<close> and ypdx: \\<open>y pd\\<rightarrow> x\\<close> shows \\<open>x = y\\<close>\nproof -\n  obtain \\<pi> n where path: \\<open>is_path \\<pi>\\<close> and \\<pi>0: \\<open>\\<pi> 0 = x\\<close> and \\<pi>n: \\<open>\\<pi> n = return\\<close> using pd_path[OF ypdx] by metis\n  hence kex: \\<open>\\<exists>k\\<le>n. \\<pi> k = y\\<close> using ypdx unfolding is_pd_def by auto\n  obtain k where k: \\<open>k = (GREATEST k. k\\<le>n \\<and> \\<pi> k = y)\\<close> by simp\n  have \\<pi>k: \\<open>\\<pi> k = y\\<close> and kn: \\<open>k \\<le> n\\<close> using k kex by (auto intro: GreatestIB)\n  \n  have kpath: \\<open>is_path (\\<pi>\\<guillemotleft>k)\\<close> by (metis path_path_shift path)\n  moreover have k0: \\<open>(\\<pi>\\<guillemotleft>k) 0 = y\\<close> using \\<pi>k by simp\n  moreover have kreturn: \\<open>(\\<pi>\\<guillemotleft>k) (n-k) = return\\<close> using kn \\<pi>n by simp\n  ultimately have ky': \\<open>\\<exists>k'\\<le>(n-k).(\\<pi>\\<guillemotleft>k) k' = x\\<close> using xpdy unfolding is_pd_def by simp      \n\n  obtain k' where k': \\<open>k' = (GREATEST k'. k'\\<le>(n-k) \\<and> (\\<pi>\\<guillemotleft>k) k' = x)\\<close> by simp\n\n  with ky' have \\<pi>k': \\<open>(\\<pi>\\<guillemotleft>k) k' = x\\<close> and kn': \\<open>k' \\<le> (n-k)\\<close>  by (auto intro: GreatestIB)\n  have k'path: \\<open>is_path (\\<pi>\\<guillemotleft>k\\<guillemotleft>k')\\<close> using kpath by(metis path_path_shift)\n  moreover have k'0: \\<open>(\\<pi>\\<guillemotleft>k\\<guillemotleft>k') 0 = x\\<close> using \\<pi>k' by simp\n  moreover have k'return: \\<open>(\\<pi>\\<guillemotleft>k\\<guillemotleft>k') (n-k-k') = return\\<close> using kn' kreturn by (metis path_shift_def le_add_diff_inverse)\n  ultimately have ky'': \\<open>\\<exists>k''\\<le>(n-k-k').(\\<pi>\\<guillemotleft>k\\<guillemotleft>k') k'' = y\\<close> using ypdx unfolding is_pd_def by blast\n\n  obtain k'' where k'': \\<open>k''= (GREATEST k''. k''\\<le>(n-k-k') \\<and> (\\<pi>\\<guillemotleft>k\\<guillemotleft>k') k'' = y)\\<close> by simp\n  with ky'' have \\<pi>k'': \\<open>(\\<pi>\\<guillemotleft>k\\<guillemotleft>k') k'' = y\\<close> and kn'': \\<open>k'' \\<le> (n-k-k')\\<close>  by (auto intro: GreatestIB)\n\n  from this(1) have  \\<open>\\<pi> (k + k' + k'') = y\\<close> by (metis path_shift_def add.commute add.left_commute)\n  moreover\n  have \\<open>k + k' +k'' \\<le> n\\<close> using kn'' kn' kn by simp\n  ultimately have \\<open>k + k' + k''\\<le> k\\<close> using k by(auto simp: GreatestB_le)\n  hence \\<open>k' = 0\\<close> by simp\n  with k0 \\<pi>k' show \\<open>x = y\\<close> by simp\nqed\n\nlemma pd_refl[simp]: \\<open>x \\<in> nodes \\<Longrightarrow> x pd\\<rightarrow> x\\<close> unfolding is_pd_def by blast\n\nlemma pdt_trans_in_pdt: \\<open>(x,y) \\<in> pdt\\<^sup>+ \\<Longrightarrow> (x,y) \\<in> pdt\\<close> \nproof (induction rule: trancl_induct)\n  case base thus \\<open>?case\\<close> by simp\nnext\n  case (step y z) show \\<open>?case\\<close> unfolding pdt_def proof (simp)\n    have *: \\<open>y pd\\<rightarrow> x\\<close> \\<open>z pd\\<rightarrow> y\\<close> using step unfolding pdt_def by auto\n    hence [simp]: \\<open>z pd\\<rightarrow> x\\<close> using pd_trans[where x=\\<open>x\\<close> and y=\\<open>y\\<close> and z=\\<open>z\\<close>] by simp\n    have \\<open>x\\<noteq>z\\<close> proof \n      assume \\<open>x = z\\<close>\n      hence \\<open>z pd\\<rightarrow> y\\<close> \\<open>y pd\\<rightarrow> z\\<close> using * by auto\n      hence \\<open>z = y\\<close> using pd_antisym by auto\n      thus \\<open>False\\<close> using step(2) unfolding pdt_def by simp\n    qed\n    thus \\<open>x \\<noteq> z \\<and> z pd\\<rightarrow> x\\<close> by auto\n  qed\nqed\n\nlemma pdt_trancl_pdt: \\<open>pdt\\<^sup>+ = pdt\\<close> using pdt_trans_in_pdt by fast\n\nlemma trans_pdt: \\<open>trans pdt\\<close> by (metis pdt_trancl_pdt trans_trancl)\n\ndefinition [simp]: \\<open>pdt_inv = pdt\\<inverse>\\<close>\n\nlemma wf_pdt_inv: \\<open>wf (pdt_inv)\\<close> proof (rule ccontr)\n  assume \\<open>\\<not> wf (pdt_inv)\\<close>\n  then obtain f where  \\<open>\\<forall>i. (f (Suc i), f i) \\<in> pdt\\<inverse>\\<close> using wf_iff_no_infinite_down_chain by force\n  hence *: \\<open>\\<forall> i. (f i, f (Suc i)) \\<in> pdt\\<close> by simp\n  have **:\\<open>\\<forall> i. \\<forall> j>i. (f i, f j) \\<in> pdt\\<close> proof(rule,rule,rule)\n    fix i j assume  \\<open>i < (j::nat)\\<close> thus \\<open>(f i, f j) \\<in> pdt\\<close> proof (induction \\<open>j\\<close> rule: less_induct)\n      case (less k)\n      show \\<open>?case\\<close> proof (cases \\<open>Suc i < k\\<close>)\n        case True\n        hence k:\\<open>k-1 < k\\<close> \\<open>i < k-1\\<close> and sk: \\<open>Suc (k-1) = k\\<close> by auto\n        show \\<open>?thesis\\<close> using less(1)[OF k] *[rule_format,of \\<open>k-1\\<close>,unfolded sk] trans_pdt[unfolded trans_def] by blast\n      next\n        case False\n        hence \\<open>Suc i = k\\<close> using less(2) by auto\n        then show \\<open>?thesis\\<close> using * by auto\n      qed\n    qed\n  qed\n  hence ***:\\<open>\\<forall> i. \\<forall> j > i. f j pd\\<rightarrow> f i\\<close> \\<open>\\<forall> i. \\<forall> j > i. f i \\<noteq>  f j\\<close> unfolding pdt_def by auto\n  hence ****:\\<open>\\<forall> i>0. f i pd\\<rightarrow> f 0\\<close> by simp\n  hence \\<open>f 0 \\<in> nodes\\<close>  using * is_pd_def by fastforce\n  then obtain \\<pi> n where \\<pi>:\\<open>is_path \\<pi>\\<close> \\<open>\\<pi> 0 = f 0\\<close> \\<open>\\<pi> n = return\\<close> using reaching_ret by blast  \n  hence \\<open>\\<forall> i>0. \\<exists> k\\<le>n. \\<pi> k = f i\\<close> using ***(1) \\<open>f 0 \\<in> nodes\\<close> unfolding is_pd_def by blast\n  hence \\<pi>f:\\<open>\\<forall> i. \\<exists> k\\<le>n. \\<pi> k = f i\\<close> using \\<pi>(2) by (metis le0 not_gr_zero)\n  have \\<open>range f \\<subseteq> \\<pi> ` {..n}\\<close> proof(rule subsetI)\n    fix x assume \\<open>x \\<in> range f\\<close>\n    then obtain i where \\<open>x = f i\\<close> by auto\n    then obtain k where \\<open>x = \\<pi> k\\<close> \\<open>k \\<le> n\\<close> using \\<pi>f by metis\n    thus \\<open>x \\<in> \\<pi> ` {..n}\\<close> by simp\n  qed\n  hence f:\\<open>finite (range f)\\<close> using finite_surj by auto\n  hence fi:\\<open>\\<exists> i. infinite {j. f j = f i}\\<close>  using pigeonhole_infinite[OF _ f] by auto\n  obtain i where \\<open>infinite {j. f j = f i}\\<close> using fi ..    \n  thus \\<open>False\\<close> \n    by (metis (mono_tags, lifting) \"***\"(2) bounded_nat_set_is_finite gt_ex mem_Collect_eq nat_neq_iff)\nqed\n\nlemma return_pd: assumes \\<open>x \\<in> nodes\\<close> shows \\<open>return pd\\<rightarrow> x\\<close> unfolding is_pd_def using assms by blast\n\nlemma pd_total: assumes xz: \\<open>x pd\\<rightarrow> z\\<close> and yz: \\<open>y pd\\<rightarrow> z\\<close> shows \\<open>x pd\\<rightarrow> y \\<or> y pd\\<rightarrow>x\\<close> \nproof -\n  obtain \\<pi> n where path: \\<open>is_path \\<pi>\\<close> and \\<pi>0: \\<open>\\<pi> 0 = z\\<close> and \\<pi>n: \\<open>\\<pi> n = return\\<close> using xz reaching_ret unfolding is_pd_def by force\n  have *: \\<open>\\<exists> k\\<le>n. (\\<pi> k = x \\<or> \\<pi> k = y)\\<close> (is \\<open>\\<exists> k\\<le>n. ?P k\\<close>) using path \\<pi>0 \\<pi>n xz yz unfolding is_pd_def by auto\n  obtain k where k: \\<open>k = (LEAST k. \\<pi> k = x \\<or> \\<pi> k = y)\\<close> by simp\n  hence kn: \\<open>k\\<le>n\\<close> and \\<pi>k: \\<open>\\<pi> k = x \\<or> \\<pi> k = y\\<close> using LeastBI_ex[OF *] by auto \n  note k_le = Least_le[where P = \\<open>?P\\<close>] \n  show \\<open>?thesis\\<close> proof (cases)\n    assume kx: \\<open>\\<pi> k = x\\<close>\n    have k_min: \\<open>\\<And> k'. \\<pi> k' = y \\<Longrightarrow> k \\<le> k'\\<close> using k_le unfolding k by auto\n    {\n      fix \\<pi>' \n      and n' :: \\<open>nat\\<close>\n      assume path': \\<open>is_path \\<pi>'\\<close> and \\<pi>'0: \\<open>\\<pi>' 0 = x\\<close> and \\<pi>'n': \\<open>\\<pi>' n' = return\\<close>\n      have path'': \\<open>is_path (\\<pi> @\\<^bsup>k\\<^esup> \\<pi>')\\<close> using path_cons[OF path path'] kx \\<pi>'0 by auto\n      have \\<pi>''0: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') 0 = z\\<close> using \\<pi>0 by simp\n      have \\<pi>''n: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') (k+n') = return\\<close> using \\<pi>'n' kx \\<pi>'0 by auto\n      obtain k' where k': \\<open>k' \\<le> k + n'\\<close> \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') k' = y\\<close> using yz path'' \\<pi>''0 \\<pi>''n unfolding is_pd_def by blast\n      have **: \\<open>k \\<le> k'\\<close> proof (rule ccontr)\n        assume \\<open>\\<not> k \\<le> k'\\<close>\n        hence \\<open>k' < k\\<close> by simp\n        moreover \n        hence \\<open>\\<pi> k' = y\\<close> using k' by auto\n        ultimately\n        show \\<open>False\\<close> using k_min by force\n     qed\n     hence \\<open>\\<pi>' (k' - k) = y\\<close> using k' \\<pi>'0 kx  by auto\n     moreover\n     have \\<open>(k' - k) \\<le> n'\\<close> using k' by auto\n     ultimately \n     have \\<open>\\<exists> k\\<le> n'. \\<pi>' k = y\\<close> by auto\n   }\n   hence \\<open>y pd\\<rightarrow> x\\<close> using kx path_nodes path unfolding is_pd_def by auto\n   thus \\<open>?thesis\\<close> ..\n next \\<comment> \\<open>This is analogous argument\\<close>\n   assume kx: \\<open>\\<pi> k \\<noteq> x\\<close>\n   hence ky: \\<open>\\<pi> k = y\\<close> using \\<pi>k by auto\n   have k_min: \\<open>\\<And> k'. \\<pi> k' = x \\<Longrightarrow> k \\<le> k'\\<close> using k_le unfolding k by auto\n    {\n      fix \\<pi>' \n      and n' :: \\<open>nat\\<close>\n      assume path': \\<open>is_path \\<pi>'\\<close> and \\<pi>'0: \\<open>\\<pi>' 0 = y\\<close> and \\<pi>'n': \\<open>\\<pi>' n' = return\\<close>\n      have path'': \\<open>is_path (\\<pi> @\\<^bsup>k\\<^esup> \\<pi>')\\<close> using path_cons[OF path path'] ky \\<pi>'0 by auto\n      have \\<pi>''0: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') 0 = z\\<close> using \\<pi>0 by simp\n      have \\<pi>''n: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') (k+n') = return\\<close> using \\<pi>'n' ky \\<pi>'0 by auto\n      obtain k' where k': \\<open>k' \\<le> k + n'\\<close> \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') k' = x\\<close> using xz path'' \\<pi>''0 \\<pi>''n unfolding is_pd_def by blast\n      have **: \\<open>k \\<le> k'\\<close> proof (rule ccontr)\n        assume \\<open>\\<not> k \\<le> k'\\<close>\n        hence \\<open>k' < k\\<close> by simp\n        moreover \n        hence \\<open>\\<pi> k' = x\\<close> using k' by auto\n        ultimately\n        show \\<open>False\\<close> using k_min by force\n     qed\n     hence \\<open>\\<pi>' (k' - k) = x\\<close> using k' \\<pi>'0 ky  by auto\n     moreover\n     have \\<open>(k' - k) \\<le> n'\\<close> using k' by auto\n     ultimately \n     have \\<open>\\<exists> k\\<le> n'. \\<pi>' k = x\\<close> by auto\n   }\n   hence \\<open>x pd\\<rightarrow> y\\<close> using ky path_nodes path unfolding is_pd_def by auto\n   thus \\<open>?thesis\\<close> ..\n  qed\nqed    \n\nlemma pds_finite: \\<open>finite {y . (x,y) \\<in> pdt}\\<close> proof cases \n  assume \\<open>x \\<in> nodes\\<close>\n  then obtain \\<pi> n where \\<pi>:\\<open>is_path \\<pi>\\<close> \\<open>\\<pi> 0 = x\\<close> \\<open>\\<pi> n = return\\<close> using reaching_ret by blast\n  have *: \\<open>\\<forall> y \\<in> {y. (x,y)\\<in> pdt}. y pd\\<rightarrow> x\\<close> using pdt_def by auto\n  have \\<open>\\<forall> y \\<in> {y. (x,y)\\<in> pdt}. \\<exists> k \\<le> n. \\<pi> k = y\\<close>  using * \\<pi> is_pd_def by blast\n  hence \\<open>{y. (x,y)\\<in> pdt} \\<subseteq> \\<pi> ` {..n}\\<close>  by auto\n  then show \\<open>?thesis\\<close> using finite_surj by blast\nnext\n  assume \\<open>\\<not> x\\<in> nodes\\<close>\n  hence \\<open>{y. (x,y)\\<in>pdt} = {}\\<close> unfolding pdt_def is_pd_def using path_nodes reaching_ret by fastforce\n  then show \\<open>?thesis\\<close> by simp\nqed\n\nlemma ipd_exists: assumes node: \\<open>x \\<in> nodes\\<close> and not_ret: \\<open>x\\<noteq>return\\<close> shows \\<open>\\<exists>y. y ipd\\<rightarrow> x\\<close> \nproof -\n  let \\<open>?Q\\<close> = \\<open>{y. x\\<noteq>y \\<and> y pd\\<rightarrow> x}\\<close>\n  have *: \\<open>return \\<in> ?Q\\<close> using assms return_pd by simp    \n  hence **: \\<open>\\<exists> x. x\\<in> ?Q\\<close> by auto\n  have fin: \\<open>finite ?Q\\<close> using pds_finite unfolding pdt_def by auto\n  have tot: \\<open>\\<forall> y z. y\\<in>?Q \\<and> z \\<in> ?Q \\<longrightarrow> z pd\\<rightarrow> y \\<or> y pd\\<rightarrow> z\\<close> using pd_total by auto\n  obtain y where ymax: \\<open>y\\<in> ?Q\\<close> \\<open>\\<forall> z\\<in>?Q. z = y \\<or> z pd\\<rightarrow> y\\<close> using fin ** tot proof (induct)\n    case empty\n    then show \\<open>?case\\<close> by auto\n  next\n    case (insert x F) show \\<open>thesis\\<close> proof (cases \\<open>F = {}\\<close>)\n      assume \\<open>F = {}\\<close>\n      thus \\<open>thesis\\<close> using insert(4)[of \\<open>x\\<close>] by auto\n    next  \n      assume \\<open>F \\<noteq> {}\\<close>\n      hence \\<open>\\<exists> x. x\\<in> F\\<close> by auto\n      have \\<open>\\<And>y. y \\<in> F \\<Longrightarrow> \\<forall>z\\<in>F. z = y \\<or> z pd\\<rightarrow> y \\<Longrightarrow> thesis\\<close> proof -\n        fix y assume a: \\<open>y \\<in> F\\<close> \\<open>\\<forall>z\\<in>F. z = y \\<or> z pd\\<rightarrow> y\\<close>\n        have \\<open>x \\<noteq> y\\<close> using insert a by auto\n        have \\<open>x pd\\<rightarrow> y \\<or> y pd\\<rightarrow> x\\<close> using insert(6) a(1) by auto\n        thus \\<open>thesis\\<close> proof \n          assume \\<open>x pd\\<rightarrow> y\\<close>\n          hence \\<open>\\<forall>z\\<in>insert x F. z = y \\<or> z pd\\<rightarrow> y\\<close> using a(2) by blast\n          thus \\<open>thesis\\<close> using a(1) insert(4) by blast\n        next\n          assume \\<open>y pd\\<rightarrow> x\\<close>\n          have \\<open>\\<forall>z\\<in>insert x F. z = x \\<or> z pd\\<rightarrow> x\\<close> proof\n            fix z assume \\<open>z\\<in> insert x F\\<close> thus \\<open>z = x \\<or> z pd\\<rightarrow> x\\<close> proof(rule,simp)\n              assume \\<open>z\\<in>F\\<close>\n              hence \\<open>z = y \\<or> z pd\\<rightarrow> y\\<close> using a(2) by auto\n              thus \\<open>z = x \\<or> z pd\\<rightarrow> x\\<close> proof(rule,simp add: \\<open>y pd\\<rightarrow> x\\<close>)\n                assume \\<open>z pd\\<rightarrow> y\\<close>\n                show \\<open>z = x \\<or> z pd\\<rightarrow> x\\<close> using \\<open>y pd\\<rightarrow> x\\<close> \\<open>z pd\\<rightarrow> y\\<close> pd_trans by blast\n              qed \n            qed\n          qed \n          then show \\<open>thesis\\<close> using insert by blast\n        qed\n      qed\n      then show \\<open>thesis\\<close> using insert by blast\n    qed\n  qed    \n  hence ***: \\<open>y pd\\<rightarrow> x\\<close> \\<open>x\\<noteq>y\\<close> by auto\n  have \\<open>\\<forall> z. z \\<noteq> x \\<and> z pd\\<rightarrow> x \\<longrightarrow> z pd\\<rightarrow> y\\<close> proof (rule,rule)\n    fix z \n    assume a: \\<open> z \\<noteq> x \\<and> z pd\\<rightarrow> x\\<close>\n    hence b: \\<open>z \\<in> ?Q\\<close> by auto\n    have \\<open>y pd\\<rightarrow> z \\<or> z pd\\<rightarrow> y\\<close> using pd_total ***(1) a by auto\n    thus \\<open>z pd\\<rightarrow> y\\<close> proof\n      assume c: \\<open>y pd\\<rightarrow> z\\<close>\n      hence \\<open>y = z\\<close> using b ymax pdt_def pd_antisym by auto\n      thus \\<open>z pd\\<rightarrow> y\\<close> using c by simp\n    qed simp\n  qed\n  with *** have  \\<open>y ipd\\<rightarrow> x\\<close> unfolding is_ipd_def by simp\n  thus \\<open>?thesis\\<close> by blast\nqed\n\nlemma ipd_unique: assumes yipd: \\<open>y ipd\\<rightarrow> x\\<close> and y'ipd: \\<open>y' ipd\\<rightarrow> x\\<close> shows \\<open>y = y'\\<close> \nproof -  \n  have 1: \\<open>y pd\\<rightarrow> y'\\<close> and  2: \\<open>y' pd\\<rightarrow> y\\<close> using yipd y'ipd unfolding is_ipd_def by auto\n  show \\<open>?thesis\\<close> using pd_antisym[OF 1 2] .\nqed\n\nlemma ipd_is_ipd: assumes \\<open>x \\<in> nodes\\<close> and \\<open>x\\<noteq>return\\<close> shows \\<open>ipd x ipd\\<rightarrow> x\\<close> proof -\n  from assms obtain y where \\<open>y ipd\\<rightarrow> x\\<close> using ipd_exists by auto\n  moreover\n  hence \\<open>\\<And> z. z ipd\\<rightarrow>x \\<Longrightarrow> z = y\\<close> using ipd_unique by simp\n  ultimately show \\<open>?thesis\\<close> unfolding ipd_def by (auto intro: theI2)\nqed\n\nlemma is_ipd_in_pdt: \\<open>y ipd\\<rightarrow> x \\<Longrightarrow> (x,y) \\<in> pdt\\<close> unfolding is_ipd_def pdt_def by auto\n\nlemma ipd_in_pdt: \\<open>x \\<in> nodes \\<Longrightarrow> x\\<noteq>return \\<Longrightarrow> (x,ipd x) \\<in> pdt\\<close> by (metis ipd_is_ipd is_ipd_in_pdt)\n\nlemma no_pd_path: assumes \\<open>x \\<in> nodes\\<close> and \\<open>\\<not> y pd\\<rightarrow> x\\<close>\nobtains \\<pi> n where \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> 0 = x\\<close> and \\<open>\\<pi> n = return\\<close> and \\<open>\\<forall> k \\<le> n. \\<pi> k \\<noteq> y\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> thesis\\<close>\n  hence \\<open>\\<forall> \\<pi> n.  is_path \\<pi> \\<and> \\<pi> 0 = x \\<and> \\<pi> n = return \\<longrightarrow> (\\<exists> k\\<le>n . \\<pi> k = y)\\<close> using that by force\n  thus \\<open>False\\<close> using assms unfolding is_pd_def by auto\nqed\n\nlemma pd_pd_ipd: assumes \\<open>x \\<in> nodes\\<close> \\<open>x\\<noteq>return\\<close> \\<open>y\\<noteq>x\\<close> \\<open>y pd\\<rightarrow> x\\<close> shows \\<open>y pd\\<rightarrow> ipd x\\<close> \nproof -\n  have \\<open>ipd x pd\\<rightarrow> x\\<close> by (metis assms(1,2) ipd_is_ipd is_ipd_def)\n  hence \\<open>y pd\\<rightarrow> ipd x \\<or> ipd x pd\\<rightarrow> y\\<close> by (metis assms(4) pd_total)\n  thus \\<open>?thesis\\<close> proof\n    have 1: \\<open>ipd x ipd\\<rightarrow> x\\<close> by (metis assms(1,2) ipd_is_ipd)\n    moreover\n    assume \\<open>ipd x pd\\<rightarrow> y\\<close>\n    ultimately\n    show \\<open>y pd\\<rightarrow> ipd x\\<close> unfolding is_ipd_def using assms(3,4) by auto\n  qed auto\nqed\n\nlemma pd_nodes: assumes \\<open>y pd\\<rightarrow> x\\<close> shows pd_node1: \\<open>y \\<in> nodes\\<close> and pd_node2: \\<open>x \\<in> nodes\\<close>\nproof -\n  obtain \\<pi> k where \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> k = y\\<close> using assms unfolding is_pd_def using reaching_ret by force\n  thus \\<open>y \\<in> nodes\\<close> using path_nodes by auto\n  show \\<open>x \\<in> nodes\\<close> using assms unfolding is_pd_def by simp\nqed\n\nlemma pd_ret_is_ret: \\<open>x pd\\<rightarrow> return \\<Longrightarrow> x = return\\<close> by (metis pd_antisym pd_node1 return_pd)\n\nlemma ret_path_none_pd: assumes \\<open>x \\<in> nodes\\<close> \\<open>x\\<noteq>return\\<close> \nobtains \\<pi> n where \\<open>is_path \\<pi>\\<close>  \\<open>\\<pi> 0 = x\\<close> \\<open>\\<pi> n = return\\<close>  \\<open>\\<forall> i>0. \\<not> x pd\\<rightarrow> \\<pi> i\\<close>\nproof(rule ccontr)\n  assume \\<open>\\<not>thesis\\<close>\n  hence *: \\<open>\\<And> \\<pi> n. \\<lbrakk>is_path \\<pi>; \\<pi> 0 = x; \\<pi> n = return\\<rbrakk> \\<Longrightarrow> \\<exists>i>0. x pd\\<rightarrow> \\<pi> i\\<close> using that by blast\n  obtain \\<pi> n where **: \\<open>is_path \\<pi>\\<close>  \\<open>\\<pi> 0 = x\\<close> \\<open>\\<pi> n = return\\<close> \\<open>\\<forall> i>0. \\<pi> i \\<noteq> x\\<close> using direct_path_return[OF assms] by metis\n  then obtain i where ***: \\<open>i>0\\<close> \\<open>x pd\\<rightarrow> \\<pi> i\\<close> using * by blast\n  hence \\<open>\\<pi> i \\<noteq> return\\<close> using pd_ret_is_ret assms(2) by auto\n  hence \\<open>i < n\\<close> using assms(2) term_path_stable ** by (metis linorder_neqE_nat less_imp_le)\n  hence \\<open>(\\<pi>\\<guillemotleft>i)(n-i) = return\\<close> using **(3) by auto\n  moreover\n  have \\<open>(\\<pi>\\<guillemotleft>i) (0) = \\<pi> i\\<close> by simp\n  moreover \n  have \\<open>is_path (\\<pi>\\<guillemotleft>i)\\<close> using **(1) path_path_shift by metis\n  ultimately\n  obtain k where \\<open>(\\<pi>\\<guillemotleft>i) k = x\\<close> using ***(2) unfolding is_pd_def by metis\n  hence \\<open>\\<pi> (i + k) = x\\<close> by auto\n  thus \\<open>False\\<close> using **(4) \\<open>i>0\\<close> by auto\nqed\n\nlemma path_pd_ipd0': assumes \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> n \\<noteq> return\\<close> \\<open>\\<pi> n \\<noteq> \\<pi> 0\\<close> and \\<open>\\<pi> n pd\\<rightarrow> \\<pi> 0\\<close> \nobtains k where \\<open>k \\<le> n\\<close> and \\<open>\\<pi> k = ipd(\\<pi> 0)\\<close> \nproof(rule ccontr)  \n  have *: \\<open>\\<pi> n pd\\<rightarrow> ipd (\\<pi> 0)\\<close> by (metis is_pd_def assms(3,4) pd_pd_ipd pd_ret_is_ret)  \n  obtain \\<pi>' n' where **: \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi>' 0 = \\<pi> n\\<close> \\<open>\\<pi>' n' = return\\<close> \\<open>\\<forall> i>0. \\<not> \\<pi> n pd\\<rightarrow> \\<pi>' i\\<close>  by (metis assms(2) assms(4) pd_node1 ret_path_none_pd)\n  hence \\<open>\\<forall> i>0. \\<pi>' i \\<noteq> ipd (\\<pi> 0)\\<close> using * by metis\n  moreover\n  assume \\<open>\\<not> thesis\\<close>\n  hence \\<open>\\<forall> k\\<le>n. \\<pi> k \\<noteq> ipd (\\<pi> 0)\\<close> using that by blast\n  ultimately\n  have \\<open>\\<forall> i. (\\<pi>@\\<^bsup>n\\<^esup>  \\<pi>') i \\<noteq> ipd (\\<pi> 0)\\<close> by (metis diff_is_0_eq neq0_conv path_append_def)\n  moreover\n  have \\<open>(\\<pi>@\\<^bsup>n\\<^esup>  \\<pi>') (n + n') = return\\<close> \n    by (metis \\<open>\\<pi>' 0 = \\<pi> n\\<close> \\<open>\\<pi>' n' = return\\<close> add_diff_cancel_left' assms(2) diff_is_0_eq path_append_def)\n  moreover\n  have \\<open>(\\<pi>@\\<^bsup>n\\<^esup>  \\<pi>') 0 = \\<pi> 0\\<close> by (metis le0 path_append_def)\n  moreover\n  have \\<open>is_path (\\<pi>@\\<^bsup>n\\<^esup>  \\<pi>')\\<close> by (metis \\<open>\\<pi>' 0 = \\<pi> n\\<close> \\<open>is_path \\<pi>'\\<close> assms(1) path_cons)\n  moreover  \n  have \\<open>ipd (\\<pi> 0) pd\\<rightarrow> \\<pi> 0\\<close> by (metis **(2,3,4) assms(2) assms(4) ipd_is_ipd is_ipd_def neq0_conv pd_node2)\n  moreover\n  have \\<open>\\<pi> 0 \\<in> nodes\\<close> by (metis assms(1) path_nodes)\n  ultimately\n  show \\<open>False\\<close> unfolding is_pd_def by blast\nqed\n\nlemma path_pd_ipd0: assumes \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> 0 \\<noteq> return\\<close> \\<open>\\<pi> n \\<noteq> \\<pi> 0\\<close> and \\<open>\\<pi> n pd\\<rightarrow> \\<pi> 0\\<close> \nobtains k where \\<open>k \\<le> n\\<close> and \\<open>\\<pi> k = ipd(\\<pi> 0)\\<close> \nproof cases \n  assume *: \\<open>\\<pi> n = return\\<close>\n  have \\<open>ipd (\\<pi> 0) pd\\<rightarrow> (\\<pi> 0)\\<close> by (metis is_ipd_def is_pd_def assms(2,4) ipd_is_ipd)\n  with assms(1,2,3) * show \\<open>thesis\\<close> unfolding is_pd_def by (metis that)\nnext\n  assume \\<open>\\<pi> n \\<noteq> return\\<close> \n  from path_pd_ipd0' [OF assms(1) this assms(3,4)] that show \\<open>thesis\\<close> by auto\nqed\n\nlemma path_pd_ipd: assumes \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> k \\<noteq> return\\<close> \\<open>\\<pi> n \\<noteq> \\<pi> k\\<close> and \\<open>\\<pi> n pd\\<rightarrow> \\<pi> k\\<close> and kn: \\<open>k < n\\<close> \nobtains l where \\<open>k < l\\<close> and \\<open>l \\<le> n\\<close> and \\<open>\\<pi> l = ipd(\\<pi> k)\\<close> \nproof -\n  have \\<open>is_path (\\<pi> \\<guillemotleft> k)\\<close> \\<open>(\\<pi> \\<guillemotleft> k) 0 \\<noteq> return\\<close> \\<open>(\\<pi> \\<guillemotleft> k) (n - k) \\<noteq> (\\<pi> \\<guillemotleft> k) 0\\<close> \\<open>(\\<pi> \\<guillemotleft> k) (n - k) pd\\<rightarrow> (\\<pi> \\<guillemotleft> k) 0\\<close> \n  using assms path_path_shift by auto \n  with path_pd_ipd0[of \\<open>\\<pi>\\<guillemotleft>k\\<close> \\<open>n-k\\<close>]\n  obtain ka where \\<open>ka \\<le> n - k\\<close> \\<open>(\\<pi> \\<guillemotleft> k) ka = ipd ((\\<pi> \\<guillemotleft> k) 0)\\<close> .\n  hence \\<open>k + ka \\<le> n\\<close> \\<open>\\<pi> (k + ka) = ipd (\\<pi> k)\\<close> using kn by auto\n  moreover \n  hence \\<open>\\<pi> (k + ka) ipd\\<rightarrow> \\<pi> k\\<close> by (metis assms(1) assms(2) ipd_is_ipd path_nodes)\n  hence \\<open>k < k + ka\\<close> unfolding is_ipd_def by (metis nat_neq_iff not_add_less1)\n  ultimately\n  show \\<open>thesis\\<close> using that[of \\<open>k+ka\\<close>] by auto\nqed\n\nlemma path_ret_ipd: assumes \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> k \\<noteq> return\\<close> \\<open>\\<pi> n = return\\<close> \nobtains l where \\<open>k < l\\<close> and \\<open>l \\<le> n\\<close> and \\<open>\\<pi> l = ipd(\\<pi> k)\\<close> \nproof -\n  have \\<open>\\<pi> n \\<noteq> \\<pi> k\\<close> using assms by auto\n  moreover\n  have \\<open>k \\<le> n\\<close> apply (rule ccontr) using term_path_stable assms by auto\n  hence \\<open>k < n\\<close> by (metis assms(2,3) dual_order.order_iff_strict)\n  moreover\n  have \\<open>\\<pi> n pd\\<rightarrow> \\<pi> k\\<close> by (metis assms(1,3) path_nodes return_pd)\n  ultimately\n  obtain l where \\<open>k < l\\<close> \\<open>l \\<le> n\\<close> \\<open>\\<pi> l = ipd (\\<pi> k)\\<close> using assms path_pd_ipd by blast\n  thus \\<open>thesis\\<close> using that by auto\nqed\n\nlemma pd_intro: assumes \\<open>l pd\\<rightarrow> k\\<close> \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> 0 = k\\<close> \\<open>\\<pi> n = return\\<close> \nobtains i where \\<open>i \\<le> n\\<close> \\<open>\\<pi> i = l\\<close> using assms unfolding is_pd_def by metis\n\nlemma path_pd_pd0: assumes path:  \\<open>is_path \\<pi>\\<close> and lpdn: \\<open>\\<pi> l pd\\<rightarrow> n\\<close> and npd0: \\<open>n pd\\<rightarrow> \\<pi> 0\\<close> \nobtains k where \\<open>k \\<le> l\\<close> \\<open>\\<pi> k = n\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> thesis\\<close>\n  hence notn: \\<open>\\<And> k. k \\<le> l \\<Longrightarrow> \\<pi> k \\<noteq> n\\<close> using that by blast\n  have nret: \\<open>\\<pi> l \\<noteq> return\\<close> by (metis is_pd_def assms(1,3) notn)\n  \n  obtain \\<pi>' n' where path': \\<open>is_path \\<pi>'\\<close> and \\<pi>0': \\<open>\\<pi>' 0 = \\<pi> l\\<close> and \\<pi>n': \\<open>\\<pi>' n' = return\\<close> and nonepd: \\<open>\\<forall> i>0. \\<not> \\<pi> l pd\\<rightarrow> \\<pi>' i\\<close>\n  using nret path path_nodes ret_path_none_pd by metis\n  \n  have \\<open>\\<pi> l \\<noteq> n\\<close> using notn by simp\n  hence \\<open>\\<forall> i. \\<pi>' i \\<noteq> n\\<close> using nonepd \\<pi>0' lpdn by (metis neq0_conv)\n  \n  hence notn': \\<open>\\<forall> i. (\\<pi>@\\<^bsup>l\\<^esup> \\<pi>') i \\<noteq> n\\<close> using notn \\<pi>0' by auto\n\n  have \\<open>is_path (\\<pi>@\\<^bsup>l\\<^esup> \\<pi>')\\<close> using path path' by (metis \\<pi>0' path_cons)\n  moreover\n  have \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>') 0 = \\<pi> 0\\<close> by simp\n  moreover\n  have \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>') (n' + l) = return\\<close> using \\<pi>0' \\<pi>n' by auto\n  ultimately\n  show \\<open>False\\<close> using notn' npd0 unfolding is_pd_def by blast\nqed\n\n\nsubsection \\<open>Facts about Control Dependencies\\<close>\n\nlemma icd_imp_cd: \\<open>n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<Longrightarrow> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis is_icdi_def)\n\nlemma ipd_impl_not_cd:  assumes \\<open>j \\<in> {k..i}\\<close> and \\<open>\\<pi> j = ipd (\\<pi> k)\\<close> shows \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \n  by (metis assms(1) assms(2) is_cdi_def)\n\nlemma cd_not_ret: assumes \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<close> shows \\<open>\\<pi> k \\<noteq> return\\<close> by (metis is_cdi_def assms nat_less_le term_path_stable)\n\nlemma cd_path_shift: assumes \\<open>j \\<le> k\\<close> \\<open>is_path \\<pi> \\<close> shows \\<open>(i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = (i - j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow> k-j)\\<close> proof \n  assume a: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  hence b: \\<open>k < i\\<close> by (metis is_cdi_def)\n  hence \\<open>is_path (\\<pi> \\<guillemotleft> j)\\<close> \\<open>k - j < i - j\\<close> using assms apply (metis path_path_shift) \n  by (metis assms(1) b diff_less_mono)  \n  moreover \n  have c: \\<open>\\<forall> j \\<in> {k..i}. \\<pi> j \\<noteq> ipd (\\<pi> k)\\<close> by (metis a ipd_impl_not_cd)\n  hence \\<open>\\<forall> ja \\<in> {k - j..i - j}. (\\<pi> \\<guillemotleft> j) ja \\<noteq> ipd ((\\<pi> \\<guillemotleft> j) (k - j))\\<close> using b assms by auto fastforce\n  moreover \n  have \\<open>j < i\\<close> using assms(1) b by auto\n  hence \\<open>(\\<pi>\\<guillemotleft>j) (i - j) \\<noteq> return\\<close> using a unfolding is_cdi_def by auto \n  ultimately\n  show \\<open>i - j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow> k-j\\<close> unfolding is_cdi_def by simp\nnext\n  assume a: \\<open>i - j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow> k-j\\<close>\n  hence b: \\<open>k - j < i-j\\<close> by (metis is_cdi_def)\n  moreover\n  have c: \\<open>\\<forall> ja \\<in> {k - j..i - j}. (\\<pi> \\<guillemotleft> j) ja \\<noteq> ipd ((\\<pi> \\<guillemotleft> j) (k - j))\\<close> by (metis a ipd_impl_not_cd)\n  have \\<open>\\<forall> j \\<in> {k..i}. \\<pi> j \\<noteq> ipd (\\<pi> k)\\<close> proof (rule,goal_cases) case (1 n)\n    hence \\<open>n-j \\<in> {k-j..i-j}\\<close> using assms by auto\n    hence \\<open>\\<pi> (j + (n-j)) \\<noteq> ipd(\\<pi> (j + (k-j)))\\<close> by (metis c path_shift_def)\n    thus \\<open>?case\\<close> using 1 assms(1) by auto\n  qed\n  moreover\n  have \\<open>j < i\\<close> using assms(1) b by auto\n  hence \\<open>\\<pi> i \\<noteq> return\\<close> using a unfolding is_cdi_def by auto\n  ultimately\n  show \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> unfolding is_cdi_def by (metis assms(1) assms(2) diff_is_0_eq' le_diff_iff nat_le_linear nat_less_le)\nqed \n\nlemma cd_path_shift0: assumes \\<open>is_path \\<pi>\\<close> shows \\<open>(i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = (i-k cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow>0)\\<close>\n  using cd_path_shift[OF _ assms] by (metis diff_self_eq_0 le_refl)\n\nlemma icd_path_shift: assumes \\<open>l \\<le> k\\<close> \\<open>is_path \\<pi>\\<close> shows \\<open>(i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = (i - l icd\\<^bsup>\\<pi>\\<guillemotleft>l\\<^esup>\\<rightarrow> k - l)\\<close> \nproof -\n  have \\<open>is_path (\\<pi>\\<guillemotleft>l)\\<close> using path_path_shift assms(2) by auto\n  moreover\n  have \\<open>(i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = (i - l cd\\<^bsup>\\<pi>\\<guillemotleft>l\\<^esup>\\<rightarrow> k - l)\\<close> using assms cd_path_shift by auto\n  moreover \n  have \\<open>(\\<forall> m \\<in> {k<..<i}. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m) = (\\<forall> m \\<in> {k - l<..<i - l}. \\<not> i - l cd\\<^bsup>\\<pi> \\<guillemotleft> l\\<^esup>\\<rightarrow> m)\\<close> \n  proof -\n    {fix m assume *: \\<open>\\<forall> m \\<in> {k - l<..<i - l}. \\<not> i - l cd\\<^bsup>\\<pi> \\<guillemotleft> l\\<^esup>\\<rightarrow> m\\<close> \\<open>m \\<in> {k<..<i}\\<close> \n      hence \\<open>m-l \\<in> {k-l<..<i-l}\\<close> using assms(1) by auto\n      hence \\<open>\\<not> i - l cd\\<^bsup>\\<pi>\\<guillemotleft>l\\<^esup>\\<rightarrow>(m-l)\\<close> using * by blast\n      moreover\n      have \\<open>l \\<le> m\\<close> using * assms by auto\n      ultimately have \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>m\\<close> using assms(2) cd_path_shift by blast\n    }\n    moreover\n    {fix m assume *: \\<open>\\<forall> m \\<in> {k<..<i}. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> \\<open>m-l \\<in> {k-l<..<i-l}\\<close> \n      hence \\<open>m \\<in> {k<..<i}\\<close> using assms(1) by auto\n      hence \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>m\\<close> using * by blast\n      moreover\n      have \\<open>l \\<le> m\\<close> using * assms by auto\n      ultimately have \\<open>\\<not> i - l cd\\<^bsup>\\<pi>\\<guillemotleft>l\\<^esup>\\<rightarrow>(m-l)\\<close> using assms(2) cd_path_shift by blast\n    }\n    ultimately show \\<open>?thesis\\<close> by auto (metis diff_add_inverse)\n  qed\n  ultimately\n  show \\<open>?thesis\\<close> unfolding is_icdi_def using assms by blast\nqed\n\nlemma icd_path_shift0: assumes \\<open>is_path \\<pi>\\<close> shows \\<open>(i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = (i-k icd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow>0)\\<close>\n  using icd_path_shift[OF _ assms] by (metis diff_self_eq_0 le_refl)\n\nlemma cdi_path_swap: assumes \\<open>is_path \\<pi>'\\<close> \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> \\<open>\\<pi> =\\<^bsub>j\\<^esub>  \\<pi>'\\<close> shows \\<open>j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow>k\\<close> using assms unfolding eq_up_to_def is_cdi_def by auto\n\nlemma cdi_path_swap_le: assumes \\<open>is_path \\<pi>'\\<close> \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>'\\<close> \\<open>j \\<le> n\\<close> shows \\<open>j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow>k\\<close> by (metis assms cdi_path_swap eq_up_to_le)\n\nlemma not_cd_impl_ipd:  assumes \\<open>is_path \\<pi>\\<close> and \\<open>k < i\\<close> and \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and \\<open>\\<pi> i \\<noteq> return\\<close> obtains j where \\<open>j \\<in> {k..i}\\<close> and \\<open>\\<pi> j = ipd (\\<pi> k)\\<close>\nby (metis assms(1) assms(2) assms(3) assms(4) is_cdi_def)\n\nlemma icd_is_the_icd: assumes \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> shows \\<open>k = (THE k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> using assms icd_uniq \n  by (metis the1_equality)\n\nlemma all_ipd_imp_ret: assumes \\<open>is_path \\<pi>\\<close> and \\<open>\\<forall> i. \\<pi> i \\<noteq> return \\<longrightarrow> (\\<exists> j>i. \\<pi> j = ipd (\\<pi> i))\\<close> shows \\<open>\\<exists>j. \\<pi> j = return\\<close>\nproof - \n  { fix x assume *: \\<open>\\<pi> 0 = x\\<close>\n    have \\<open>?thesis\\<close> using wf_pdt_inv * assms  \n    proof(induction \\<open>x\\<close> arbitrary: \\<open>\\<pi>\\<close> rule: wf_induct_rule )\n    case (less x \\<pi>) show \\<open>?case\\<close> proof (cases \\<open>x = return\\<close>)\n      case True thus \\<open>?thesis\\<close> using less(2) by auto\n    next\n      assume not_ret: \\<open>x \\<noteq> return\\<close>\n      moreover\n      then obtain k where k_ipd: \\<open>\\<pi> k = ipd x\\<close> using less(2,4) by auto\n      moreover  \n      have \\<open>x \\<in> nodes\\<close> using less(2,3) by (metis path_nodes)\n      ultimately \n      have \\<open>(x, \\<pi> k) \\<in> pdt\\<close> by (metis ipd_in_pdt)\n      hence a: \\<open>(\\<pi> k, x) \\<in> pdt_inv\\<close> unfolding pdt_inv_def by simp     \n      have b: \\<open>is_path (\\<pi> \\<guillemotleft> k)\\<close> by (metis less.prems(2) path_path_shift)    \n      have c: \\<open>\\<forall> i. (\\<pi>\\<guillemotleft>k) i \\<noteq> return \\<longrightarrow> (\\<exists>j>i. (\\<pi>\\<guillemotleft>k) j = ipd ((\\<pi>\\<guillemotleft>k) i))\\<close> using less(4) apply auto\n        by (metis (full_types) ab_semigroup_add_class.add_ac(1) less_add_same_cancel1 less_imp_add_positive)\n      from less(1)[OF a _ b c]\n      have \\<open>\\<exists>j. (\\<pi>\\<guillemotleft>k) j = return\\<close> by auto    \n      thus \\<open>\\<exists>j. \\<pi> j = return\\<close> by auto\n    qed\n    qed\n  }\n  thus \\<open>?thesis\\<close> by simp\nqed\n\nlemma loop_has_cd: assumes \\<open>is_path \\<pi>\\<close> \\<open>0 < i\\<close> \\<open>\\<pi> i = \\<pi> 0\\<close> \\<open>\\<pi> 0 \\<noteq> return\\<close> shows \\<open>\\<exists> k < i. i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> proof (rule ccontr)\n  let \\<open>?\\<pi>\\<close> = \\<open>(\\<lambda> n. \\<pi> (n mod i))\\<close>  \n  assume \\<open>\\<not> (\\<exists>k<i. i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close>\n  hence \\<open>\\<forall> k <i. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by blast\n  hence *: \\<open>\\<forall> k<i. (\\<exists>j \\<in> {k..i}. \\<pi> j = ipd (\\<pi> k))\\<close> using assms(1,3,4) not_cd_impl_ipd by metis\n  have \\<open>\\<forall> k. (\\<exists> j > k. ?\\<pi> j = ipd (?\\<pi> k))\\<close> proof \n    fix k\n    have \\<open>k mod i < i\\<close> using assms(2) by auto\n    with * obtain j where \\<open>j \\<in> {(k mod i)..i}\\<close> \\<open>\\<pi> j = ipd (\\<pi> (k mod i))\\<close> by auto\n    then obtain j' where 1: \\<open>j' < i\\<close> \\<open>\\<pi> j' = ipd (\\<pi> (k mod i))\\<close> \n      by (cases \\<open>j = i\\<close>, auto ,metis assms(2) assms(3),metis le_neq_implies_less)\n    then obtain j'' where 2: \\<open>j'' > k\\<close> \\<open>j'' mod i = j'\\<close> by (metis mod_bound_instance)\n    hence \\<open>?\\<pi> j'' = ipd (?\\<pi> k)\\<close> using 1 by auto\n    with 2(1)\n    show \\<open>\\<exists> j > k. ?\\<pi> j = ipd (?\\<pi> k)\\<close> by auto\n  qed\n  moreover \n  have \\<open>is_path ?\\<pi>\\<close> by (metis assms(1) assms(2) assms(3) is_path_loop)\n  ultimately \n  obtain k where \\<open>?\\<pi> k = return\\<close> by (metis (lifting) all_ipd_imp_ret)\n  moreover \n  have \\<open>k mod i < i\\<close> by (simp add: assms(2)) \n  ultimately\n  have \\<open>\\<pi> i = return\\<close> by (metis assms(1) term_path_stable less_imp_le)\n  thus \\<open>False\\<close> by (metis assms(3) assms(4))\nqed\n\nlemma loop_has_cd': assumes \\<open>is_path \\<pi>\\<close> \\<open>j < i\\<close> \\<open>\\<pi> i = \\<pi> j\\<close> \\<open>\\<pi> j \\<noteq> return\\<close> shows \\<open>\\<exists> k \\<in> {j..<i}. i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \nproof -\n  have \\<open>\\<exists> k'< i-j. i-j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow>k'\\<close> \n    apply(rule loop_has_cd) \n    apply (metis assms(1) path_path_shift)\n    apply (auto simp add: assms less_imp_le)\n    done\n  then obtain k where k: \\<open>k<i-j\\<close> \\<open>i-j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow>k\\<close> by auto\n  hence k': \\<open>(k+j) < i\\<close>  \\<open>i-j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow> (k+j)-j\\<close>  by auto\n  note cd_path_shift[OF _ assms(1)]\n  hence \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k+j\\<close> using k'(2) by (metis le_add1 add.commute)\n  with k'(1) show \\<open>?thesis\\<close> by force\nqed  \n\nlemma claim'': assumes path\\<pi>: \\<open>is_path \\<pi>\\<close> and path\\<pi>': \\<open>is_path \\<pi>'\\<close> \nand \\<pi>i: \\<open>\\<pi> i = \\<pi>' i'\\<close> and \\<pi>j: \\<open>\\<pi> j = \\<pi>' j'\\<close> \nand not_cd:  \\<open>\\<forall> k. \\<not> j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>  \\<open>\\<forall> k. \\<not> i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k\\<close> \nand nret: \\<open>\\<pi> i \\<noteq> return\\<close>\nand ilj: \\<open>i < j\\<close>\nshows \\<open>i' < j'\\<close> proof (rule ccontr)\n  assume \\<open>\\<not> i' < j'\\<close>  \n  hence jlei: \\<open>j' \\<le> i'\\<close> by auto\n  show \\<open>False\\<close> proof (cases)\n  assume j'li': \\<open>j' < i'\\<close> \n  define \\<pi>'' where \\<open>\\<pi>'' \\<equiv> (\\<pi>@\\<^bsup>j\\<^esup>(\\<pi>'\\<guillemotleft>j'))\\<guillemotleft>i\\<close>\n  note \\<pi>''_def[simp]\n  have \\<open>\\<pi> j = (\\<pi>' \\<guillemotleft> j') 0\\<close> by (metis path_shift_def Nat.add_0_right \\<pi>j)\n  hence \\<open>is_path \\<pi>''\\<close> using path\\<pi> path\\<pi>' \\<pi>''_def path_path_shift path_cons by presburger\n  moreover \n  have \\<open>\\<pi>'' (j-i+(i'-j')) = \\<pi>'' 0\\<close>  using ilj jlei \\<pi>i \\<pi>j \n    by (auto, metis add_diff_cancel_left' le_antisym le_diff_conv le_eq_less_or_eq)\n  moreover\n  have \\<open>\\<pi>'' 0 \\<noteq> return\\<close> by (simp add: ilj less_or_eq_imp_le nret)\n  moreover\n  have \\<open>0 < j-i+(i'-j')\\<close> by (metis add_is_0 ilj neq0_conv zero_less_diff)\n  ultimately obtain k where k: \\<open>k < j-i+(i'-j')\\<close> \\<open>j-i+(i'-j') cd\\<^bsup>\\<pi>''\\<^esup>\\<rightarrow> k\\<close>   by (metis loop_has_cd)\n  hence *: \\<open>\\<forall> l \\<in> {k..j-i+(i'-j')}. \\<pi>'' l \\<noteq> ipd (\\<pi>'' k)\\<close> by (metis is_cdi_def)\n  show \\<open>False\\<close> proof (cases \\<open>k < j-i\\<close>)\n    assume a: \\<open>k < j - i\\<close>\n    hence b: \\<open>\\<pi>'' k = \\<pi> (i + k)\\<close> by auto\n    have \\<open>\\<forall> l \\<in> {i+k..j}. \\<pi> l \\<noteq> ipd (\\<pi> (i+k))\\<close> proof\n      fix l assume l: \\<open>l \\<in> {i + k..j}\\<close>\n      hence \\<open>\\<pi> l = \\<pi>'' (l - i)\\<close> by auto\n      moreover \n      from a l have \\<open>l-i \\<in> {k .. j-i + (i'-j')}\\<close> by force\n      ultimately show \\<open>\\<pi> l \\<noteq> ipd (\\<pi> (i + k))\\<close> using * b by auto\n    qed\n    moreover \n    have \\<open>i + k < j\\<close> using a by simp\n    moreover\n    have \\<open>\\<pi> j \\<noteq> return\\<close> by (metis \\<pi>i \\<pi>j j'li' nret path\\<pi>' term_path_stable less_imp_le) \n    ultimately\n    have \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i+k\\<close>  by (metis not_cd_impl_ipd path\\<pi>)\n    thus \\<open>False\\<close> by (metis not_cd(1))\n  next\n    assume \\<open>\\<not> k < j - i\\<close>\n    hence a: \\<open>j - i \\<le> k\\<close> by simp\n    hence b: \\<open>\\<pi>'' k = \\<pi>' (j' + (i + k) - j)\\<close> unfolding \\<pi>''_def path_shift_def path_append_def using ilj \n      by(auto,metis \\<pi>j add_diff_cancel_left' le_antisym le_diff_conv add.commute)\n    have \\<open>\\<forall> l \\<in> {j' + (i+k) - j..i'}. \\<pi>' l \\<noteq> ipd (\\<pi>' (j' + (i+k) - j))\\<close> proof\n      fix l assume l: \\<open>l \\<in> {j' + (i+k) - j..i'}\\<close>\n      hence \\<open>\\<pi>' l = \\<pi>'' (j + l - i - j')\\<close> unfolding \\<pi>''_def path_shift_def path_append_def using ilj\n        by (auto, metis Nat.diff_add_assoc \\<pi>j a add.commute add_diff_cancel_left' add_leD1 le_antisym le_diff_conv)\n      moreover \n      from a l have \\<open>j + l - i - j' \\<in> {k .. j-i + (i'-j')}\\<close> by force\n      ultimately show \\<open>\\<pi>' l \\<noteq> ipd (\\<pi>' (j' + (i + k) - j))\\<close> using * b by auto\n    qed\n    moreover \n    have \\<open>j' + (i+k) - j < i'\\<close> using a  j'li' ilj k(1) by linarith      \n    moreover \n    have \\<open>\\<pi>' i' \\<noteq> return\\<close> by (metis \\<pi>i nret)\n    ultimately    \n    have \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' + (i+k) - j\\<close> by (metis not_cd_impl_ipd path\\<pi>')\n    thus \\<open>False\\<close> by (metis not_cd(2))\n  qed\n  next\n  assume \\<open>\\<not> j' < i'\\<close>\n  hence \\<open>j' = i'\\<close> by (metis \\<open>\\<not> i' < j'\\<close> linorder_cases)\n  hence \\<open>\\<pi> i = \\<pi> j\\<close> by (metis \\<pi>i \\<pi>j)\n  thus \\<open>False\\<close> by (metis ilj loop_has_cd' not_cd(1) nret path\\<pi>)\nqed\nqed\n\nlemma other_claim': assumes path: \\<open>is_path \\<pi>\\<close> and eq: \\<open>\\<pi> i = \\<pi> j\\<close> and \\<open>\\<pi> i \\<noteq> return\\<close> \nand icd: \\<open>\\<forall> k. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and \\<open>\\<forall> k. \\<not> j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> shows \\<open>i = j\\<close>  \nproof (rule ccontr,cases)\n  assume \\<open>i < j\\<close> thus \\<open>False\\<close> using assms claim'' by blast\nnext\n  assume \\<open>\\<not> i < j\\<close> \\<open>i \\<noteq> j\\<close> \n  hence \\<open>j < i\\<close> by auto\n  thus \\<open>False\\<close> using assms claim'' by (metis loop_has_cd')\nqed  \n\nlemma icd_no_cd_path_shift: assumes \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> shows \\<open>(\\<forall> k. \\<not> i - 1 cd\\<^bsup>\\<pi>\\<guillemotleft>1\\<^esup>\\<rightarrow> k)\\<close> \nproof (rule,rule ccontr,goal_cases)\n  case (1 k)\n  hence *: \\<open>i - 1 cd\\<^bsup>\\<pi> \\<guillemotleft> 1\\<^esup>\\<rightarrow> k\\<close> by simp\n  have **: \\<open>1 \\<le> k + 1\\<close> by simp\n  have ***: \\<open>is_path \\<pi>\\<close> by (metis assms is_icdi_def)\n  hence \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k+1\\<close> using cd_path_shift[OF ** ***] * by auto\n  moreover \n  hence \\<open>k+1 < i\\<close> unfolding is_cdi_def by simp\n  moreover\n  have \\<open>0 < k + 1\\<close> by simp\n  ultimately show \\<open>False\\<close> using assms[unfolded is_icdi_def] by auto\nqed\n\nlemma claim': assumes path\\<pi>: \\<open>is_path \\<pi>\\<close> and path\\<pi>': \\<open>is_path \\<pi>'\\<close> and\n  \\<pi>i: \\<open>\\<pi> i = \\<pi>' i'\\<close> and \\<pi>j: \\<open>\\<pi> j = \\<pi>' j'\\<close> and not_cd:\n  \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> \\<open>j icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close>\n  \\<open>i' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> 0\\<close> \\<open>j' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> 0\\<close>\n   and ilj: \\<open>i < j\\<close>\n   and nret: \\<open>\\<pi> i \\<noteq> return\\<close>\n  shows \\<open>i' < j'\\<close> \nproof -\n  have g0: \\<open>0 < i\\<close> \\<open>0 < j\\<close> \\<open>0 < i'\\<close> \\<open>0 < j'\\<close>using not_cd[unfolded is_icdi_def is_cdi_def] by auto\n  have  \\<open>(\\<pi> \\<guillemotleft> 1) (i - 1) = (\\<pi>' \\<guillemotleft> 1) (i' - 1)\\<close> \\<open>(\\<pi> \\<guillemotleft> 1) (j - 1) = (\\<pi>' \\<guillemotleft> 1) (j' - 1)\\<close> using \\<pi>i \\<pi>j g0 by auto\n  moreover\n  have \\<open>\\<forall> k. \\<not> (j - 1) cd\\<^bsup>\\<pi>\\<guillemotleft>1\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<forall> k. \\<not> (i' - 1) cd\\<^bsup>\\<pi>'\\<guillemotleft>1\\<^esup>\\<rightarrow> k\\<close> \n    by (metis icd_no_cd_path_shift not_cd(2)) (metis icd_no_cd_path_shift not_cd(3))\n  moreover\n  have \\<open>is_path (\\<pi>\\<guillemotleft>1)\\<close> \\<open>is_path (\\<pi>'\\<guillemotleft>1)\\<close> using path\\<pi> path\\<pi>' path_path_shift by blast+\n  moreover \n  have \\<open>(\\<pi>\\<guillemotleft>1) (i - 1) \\<noteq> return\\<close> using g0 nret by auto\n  moreover \n  have \\<open>i - 1 < j - 1\\<close> using g0 ilj by auto\n  ultimately have \\<open>i' - 1 < j' - 1\\<close> using claim'' by blast\n  thus \\<open>i'<j'\\<close> by auto\nqed\n\nlemma other_claim: assumes path: \\<open>is_path \\<pi>\\<close> and eq: \\<open>\\<pi> i = \\<pi> j\\<close> and \\<open>\\<pi> i \\<noteq> return\\<close> \nand icd: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> and \\<open>j icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> shows \\<open>i = j\\<close>  proof (rule ccontr,cases)\n  assume \\<open>i < j\\<close> thus \\<open>False\\<close> using assms claim' by blast\nnext\n  assume \\<open>\\<not> i < j\\<close> \\<open>i \\<noteq> j\\<close> \n  hence \\<open>j < i\\<close> by auto\n  thus \\<open>False\\<close> using assms claim' by (metis less_not_refl)\nqed\n\nlemma cd_trans0: assumes \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> and \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>j\\<close> shows \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> proof (rule ccontr)    \n  have path: \\<open>is_path \\<pi>\\<close> and ij: \\<open>0 < j\\<close> and jk: \\<open>j < k\\<close> \n  and nret: \\<open>\\<pi> j \\<noteq> return\\<close> \\<open>\\<pi> k \\<noteq> return\\<close>\n  and noipdi: \\<open>\\<forall> l \\<in> {0..j}. \\<pi> l \\<noteq> ipd (\\<pi> 0)\\<close>\n  and noipdj: \\<open>\\<forall> l \\<in> {j..k}. \\<pi> l \\<noteq> ipd (\\<pi> j)\\<close>\n  using assms unfolding is_cdi_def by auto\n  assume \\<open>\\<not> k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close>\n  hence \\<open>\\<exists>l \\<in> {0..k}. \\<pi> l = ipd (\\<pi> 0)\\<close> unfolding is_cdi_def using path ij jk nret by force\n  then obtain l where \\<open>l \\<in> {0..k}\\<close> and l: \\<open>\\<pi> l = ipd (\\<pi> 0)\\<close> by auto\n  hence jl: \\<open>j<l\\<close> and lk: \\<open>l\\<le>k\\<close> using noipdi ij by auto\n  have pdj: \\<open>ipd (\\<pi> 0) pd\\<rightarrow> \\<pi> j\\<close> proof (rule ccontr)    \n    have \\<open>\\<pi> j \\<in> nodes\\<close> using path by (metis path_nodes)\n    moreover \n    assume \\<open>\\<not> ipd (\\<pi> 0) pd\\<rightarrow> \\<pi> j\\<close>\n    ultimately\n    obtain \\<pi>' n where *: \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi>' 0 = \\<pi> j\\<close> \\<open>\\<pi>' n = return\\<close> \\<open>\\<forall> k\\<le>n. \\<pi>' k \\<noteq> ipd(\\<pi> 0)\\<close> using no_pd_path by metis\n    hence path': \\<open>is_path (\\<pi> @\\<^bsup>j\\<^esup>  \\<pi>')\\<close> by (metis path path_cons) \n    moreover\n    have \\<open>\\<forall> k \\<le> j + n. (\\<pi>@\\<^bsup>j\\<^esup>  \\<pi>') k \\<noteq> ipd (\\<pi> 0)\\<close> using noipdi *(4) by auto\n    moreover \n    have \\<open>(\\<pi>@\\<^bsup>j\\<^esup>  \\<pi>') 0 = \\<pi> 0\\<close> by auto\n    moreover\n    have \\<open>(\\<pi>@\\<^bsup>j\\<^esup>  \\<pi>') (j + n) = return\\<close> using *(2,3) by auto\n    ultimately\n    have \\<open>\\<not> ipd (\\<pi> 0) pd\\<rightarrow> \\<pi> 0\\<close> unfolding is_pd_def by metis\n    thus \\<open>False\\<close> by (metis is_ipd_def ij ipd_is_ipd nret(1) path path_nodes term_path_stable less_imp_le)\n  qed\n  hence \\<open>(\\<pi>\\<guillemotleft>j) (l-j) pd\\<rightarrow> (\\<pi>\\<guillemotleft>j) 0\\<close> using jl l by auto\n  moreover\n  have \\<open>is_path (\\<pi>\\<guillemotleft>j)\\<close> by (metis path path_path_shift)\n  moreover\n  have \\<open>\\<pi> l \\<noteq> return\\<close> by (metis lk nret(2) path term_path_stable)\n  hence \\<open>(\\<pi>\\<guillemotleft>j) (l-j) \\<noteq> return\\<close> using jl by auto\n  moreover \n  have \\<open>\\<pi> j \\<noteq> ipd (\\<pi> 0)\\<close> using noipdi by force\n  hence \\<open>(\\<pi>\\<guillemotleft>j) (l-j) \\<noteq> (\\<pi>\\<guillemotleft>j) 0\\<close> using jl l by auto\n  ultimately\n  obtain k' where \\<open>k' \\<le> l-j\\<close> and \\<open>(\\<pi>\\<guillemotleft>j) k' = ipd ((\\<pi>\\<guillemotleft>j) 0)\\<close> using path_pd_ipd0' by blast\n  hence \\<open>j + k' \\<in> {j..k}\\<close> \\<open>\\<pi> (j+k') = ipd (\\<pi> j)\\<close> using jl lk by auto\n  thus \\<open>False\\<close> using noipdj by auto\nqed\n\nlemma cd_trans: assumes \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> and \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>j\\<close> shows \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> proof -\n  have path: \\<open>is_path \\<pi>\\<close> using assms is_cdi_def by auto\n  have ij: \\<open>i<j\\<close> using assms is_cdi_def by auto\n  let \\<open>?\\<pi>\\<close> = \\<open>\\<pi>\\<guillemotleft>i\\<close>\n  have \\<open>j-i cd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow> 0\\<close> using assms(1) cd_path_shift0 path by auto\n  moreover\n  have \\<open>k-i cd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow>j-i\\<close> by (metis assms(2) cd_path_shift is_cdi_def ij less_imp_le_nat)\n  ultimately\n  have \\<open>k-i cd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow> 0\\<close> using cd_trans0 by auto\n  thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> using path cd_path_shift0 by auto\nqed\n\nlemma excd_impl_exicd: assumes \\<open>\\<exists> k. i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> shows \\<open>\\<exists> k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> \nusing assms proof(induction \\<open>i\\<close> arbitrary: \\<open>\\<pi>\\<close> rule: less_induct)\n  case (less i) \n  then obtain k where k: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> by auto\n  hence ip: \\<open>is_path \\<pi>\\<close> unfolding is_cdi_def by auto\n  show \\<open>?case\\<close> proof (cases)\n    assume *: \\<open>\\<forall> m \\<in> {k<..<i}. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close>\n    hence \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> using k ip unfolding is_icdi_def by auto\n    thus \\<open>?case\\<close> by auto\n  next\n    assume \\<open>\\<not> (\\<forall> m \\<in> {k<..<i}. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m)\\<close>\n    then obtain m where m: \\<open>m \\<in> {k<..<i}\\<close> \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> by blast\n    hence \\<open>i - m cd\\<^bsup>\\<pi>\\<guillemotleft>m\\<^esup>\\<rightarrow> 0\\<close> by (metis cd_path_shift0 is_cdi_def)\n    moreover \n    have \\<open>i - m < i\\<close> using m by auto\n    ultimately\n    obtain k' where k': \\<open>i - m icd\\<^bsup>\\<pi>\\<guillemotleft>m\\<^esup>\\<rightarrow> k'\\<close> using less(1) by blast\n    hence \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k' + m\\<close> using ip \n    by (metis add.commute add_diff_cancel_right' icd_path_shift le_add1)\n    thus \\<open>?case\\<close> by auto\n  qed\nqed\n\nlemma cd_split: assumes \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and \\<open>\\<not> i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> obtains m where \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> and \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \nproof -\n  have ki: \\<open>k < i\\<close> using assms is_cdi_def by auto\n  obtain m where m: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using assms(1) by (metis excd_impl_exicd)\n  hence \\<open>k \\<le> m\\<close> unfolding is_icdi_def using ki assms(1) by force\n  hence km: \\<open>k < m\\<close>using m assms(2) by (metis le_eq_less_or_eq)\n  moreover have \\<open>\\<pi> m \\<noteq> return\\<close> using m unfolding is_icdi_def is_cdi_def by (simp, metis term_path_stable less_imp_le)\n  moreover have \\<open>m<i\\<close> using m unfolding is_cdi_def is_icdi_def by auto\n  ultimately \n  have \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using assms(1) unfolding is_cdi_def by auto\n  with m that show \\<open>thesis\\<close> by auto\nqed\n\nlemma cd_induct[consumes 1, case_names base IS]: assumes prem: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and base: \\<open>\\<And> i. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k \\<Longrightarrow> P i\\<close> \nand IH: \\<open>\\<And> k' i'. k' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<Longrightarrow> P k' \\<Longrightarrow> i' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k' \\<Longrightarrow> P i'\\<close> shows \\<open>P i\\<close> \nusing prem IH proof (induction \\<open>i\\<close> rule: less_induct,cases)\n  case (less i) \n  assume \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  thus \\<open>P i\\<close> using base by simp\nnext\n  case (less i')\n  assume \\<open>\\<not> i' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  then obtain k' where k': \\<open> i' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k'\\<close> \\<open>k' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using less cd_split by blast\n  hence icdk: \\<open>i' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k'\\<close> using is_icdi_def by auto\n  note ih=less(3)[OF k'(2)  _ k'(1)]\n  have ki: \\<open>k' < i'\\<close> using k' is_icdi_def is_cdi_def by auto\n  have \\<open>P k'\\<close> using less(1)[OF ki k'(2) ] less(3) by auto\n  thus \\<open>P i'\\<close> using ih by simp\nqed\n\nlemma cdi_prefix: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m \\<Longrightarrow> m < n' \\<Longrightarrow> n' \\<le> n \\<Longrightarrow> n' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close>  unfolding is_cdi_def \n  by (simp, metis term_path_stable)\n\nlemma cr_wn': assumes 1: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> and nc: \\<open>\\<not> m' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> and 3: \\<open>m < m'\\<close> shows \\<open>n < m'\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> n < m'\\<close>\n  hence \\<open>m' \\<le> n\\<close> by simp  \n  hence \\<open>m' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> by (metis 1 3 cdi_prefix)\n  thus \\<open>False\\<close> using nc by simp\nqed\n\nlemma cr_wn'': assumes \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> and \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> and \\<open>\\<not> m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> and  \\<open>i \\<le> j\\<close> shows \\<open>m \\<le> n\\<close> proof (rule ccontr) \n  assume \\<open>\\<not>m\\<le>n\\<close>\n  hence nm: \\<open>n < m\\<close> by auto\n  moreover \n  have \\<open>m<j\\<close> using assms(1) assms(4) unfolding is_cdi_def by auto\n  ultimately \n  have \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> using assms(2) cdi_prefix by auto\n  thus \\<open>False\\<close> using assms(3) by auto\nqed\n\nlemma ret_no_cd: assumes \\<open>\\<pi> n = return\\<close> shows \\<open>\\<not> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis assms is_cdi_def)\n\nlemma ipd_not_self: assumes \\<open>x \\<in> nodes\\<close> \\<open>x\\<noteq> return\\<close> shows \\<open>x \\<noteq> ipd x\\<close> by (metis is_ipd_def assms ipd_is_ipd)\n\nlemma icd_cs: assumes \\<open>l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>\\<^esup> k @ [\\<pi> l]\\<close>\nproof -\n  from assms have \\<open>k = (THE k. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> by (metis icd_is_the_icd)\n  with assms show \\<open>?thesis\\<close> by auto\nqed\n\nlemma cd_not_pd: assumes \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<pi> l \\<noteq> \\<pi> k\\<close> shows \\<open>\\<not> \\<pi> l pd\\<rightarrow> \\<pi> k\\<close> proof\n  assume pd: \\<open>\\<pi> l pd\\<rightarrow> \\<pi> k\\<close>\n  have nret: \\<open>\\<pi> k \\<noteq> return\\<close> by (metis assms(1) pd pd_ret_is_ret ret_no_cd)\n  have kl: \\<open>k < l\\<close> by (metis is_cdi_def assms(1))\n  have path: \\<open>is_path \\<pi>\\<close> by (metis is_cdi_def assms(1))\n  from path_pd_ipd[OF path nret assms(2) pd kl]\n  obtain n where \\<open>k < n\\<close> \\<open>n \\<le> l\\<close> \\<open>\\<pi> n = ipd (\\<pi> k)\\<close> .\n  thus \\<open>False\\<close> using assms(1) unfolding is_cdi_def by auto\nqed\n\nlemma cd_ipd_is_cd: assumes \\<open>k<m\\<close> \\<open>\\<pi> m = ipd (\\<pi> k)\\<close> \\<open>\\<forall> n \\<in> {k..<m}. \\<pi> n \\<noteq> ipd (\\<pi> k)\\<close> and mcdj: \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> shows \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> proof cases\n  assume \\<open>j < k\\<close> thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> by (metis mcdj assms(1) cdi_prefix less_imp_le_nat)\nnext\n  assume \\<open>\\<not> j < k\\<close>\n  hence kj: \\<open>k \\<le> j\\<close> by simp \n  have \\<open>k < j\\<close> apply (rule ccontr) using kj assms mcdj by (auto, metis is_cdi_def is_ipd_def cd_not_pd ipd_is_ipd path_nodes term_path_stable less_imp_le)\n  moreover \n  have \\<open>j < m\\<close> using mcdj is_cdi_def by auto\n  hence \\<open>\\<forall> n \\<in> {k..j}. \\<pi> n \\<noteq> ipd(\\<pi> k)\\<close> using assms(3) by force\n  ultimately\n  have \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis mcdj is_cdi_def term_path_stable less_imp_le)\n  hence \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis mcdj cd_trans)\n  hence \\<open>False\\<close> by (metis is_cdi_def is_ipd_def assms(2) cd_not_pd ipd_is_ipd path_nodes term_path_stable less_imp_le)\n  thus \\<open>?thesis\\<close> by simp\nqed\n\nlemma ipd_pd_cd0: assumes lcd: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> shows \\<open>ipd (\\<pi> 0) pd\\<rightarrow> (\\<pi> n)\\<close> \nproof -\n  obtain k l where \\<pi>0: \\<open>\\<pi> 0 = k\\<close> and \\<pi>n: \\<open>\\<pi> n = l\\<close> and cdi: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> using lcd unfolding is_cdi_def by blast\n  have nret: \\<open>k \\<noteq> return\\<close> by (metis is_cdi_def \\<pi>0 cdi term_path_stable less_imp_le)\n  have  path: \\<open>is_path \\<pi>\\<close> and ipd: \\<open>\\<forall> i\\<le>n. \\<pi> i \\<noteq> ipd k\\<close> using cdi unfolding is_cdi_def \\<pi>0 by auto\n  {\n    fix \\<pi>' n'\n    assume path': \\<open>is_path \\<pi>'\\<close>\n    and \\<pi>'0: \\<open>\\<pi>' 0 = l\\<close>\n    and ret: \\<open>\\<pi>' n' = return\\<close>\n    have \\<open>is_path (\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>')\\<close> using path path' \\<pi>n \\<pi>'0 by (metis path_cons)\n    moreover\n    have \\<open>(\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>') (n+n') = return\\<close> using ret \\<pi>n \\<pi>'0 by auto\n    moreover\n    have \\<open>(\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>') 0 = k\\<close> using \\<pi>0 by auto\n    moreover    \n    have \\<open>ipd k pd\\<rightarrow> k\\<close> by (metis is_ipd_def path \\<pi>0 ipd_is_ipd nret path_nodes)\n    ultimately\n    obtain k' where k': \\<open>k' \\<le> n+n'\\<close> \\<open>(\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>') k' = ipd k\\<close> by (metis pd_intro)\n    have \\<open>\\<not> k'\\<le> n\\<close> proof \n      assume \\<open>k' \\<le> n\\<close> \n      hence \\<open>(\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>') k' = \\<pi> k'\\<close> by auto\n      thus \\<open>False\\<close> using k'(2) ipd by (metis \\<open>k' \\<le> n\\<close>)\n    qed\n    hence \\<open>(\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>') k' = \\<pi>' (k' - n)\\<close> by auto\n    moreover \n    have \\<open>(k' - n) \\<le> n'\\<close> using k' by simp\n    ultimately\n    have \\<open>\\<exists> k'\\<le>n'. \\<pi>' k' = ipd k\\<close> unfolding k' by auto\n  }\n  moreover\n  have \\<open>l \\<in> nodes\\<close> by (metis \\<pi>n path path_nodes)\n  ultimately show \\<open>ipd (\\<pi> 0) pd\\<rightarrow> (\\<pi> n)\\<close> unfolding is_pd_def  by (simp add: \\<pi>0 \\<pi>n) \nqed\n\nlemma ipd_pd_cd: assumes lcd: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> shows \\<open>ipd (\\<pi> k) pd\\<rightarrow> (\\<pi> l)\\<close> \nproof - \n  have \\<open>l-k cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow>0\\<close> using lcd cd_path_shift0 is_cdi_def by blast \n  moreover\n  note ipd_pd_cd0[OF this]\n  moreover \n  have \\<open>(\\<pi> \\<guillemotleft> k) 0 = \\<pi> k\\<close> by auto\n  moreover\n  have \\<open>k < l\\<close> using lcd unfolding is_cdi_def by simp\n  then have \\<open>(\\<pi> \\<guillemotleft> k) (l - k) = \\<pi> l\\<close> by simp \n  ultimately show \\<open>?thesis\\<close> by simp\nqed\n\nlemma cd_is_cd_ipd: assumes km: \\<open>k<m\\<close> and ipd: \\<open>\\<pi> m = ipd (\\<pi> k)\\<close> \\<open>\\<forall> n \\<in> {k..<m}. \\<pi> n \\<noteq> ipd (\\<pi> k)\\<close> and cdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and nipdj: \\<open>ipd (\\<pi> j) \\<noteq> \\<pi> m\\<close> shows \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> proof -\n  have path: \\<open>is_path \\<pi>\\<close> \n  and jk: \\<open>j < k\\<close> \n  and nretj: \\<open>\\<pi> k \\<noteq> return\\<close> \n  and nipd: \\<open>\\<forall> l \\<in> {j..k}. \\<pi> l \\<noteq> ipd (\\<pi> j)\\<close> using  cdj is_cdi_def by auto\n  have pd: \\<open>ipd (\\<pi> j) pd\\<rightarrow> \\<pi> m\\<close> by (metis atLeastAtMost_iff cdj ipd(1) ipd_pd_cd jk le_refl less_imp_le nipd nretj path path_nodes pd_pd_ipd)  \n  have nretm: \\<open>\\<pi> m \\<noteq> return\\<close> by (metis nipdj pd pd_ret_is_ret)\n  have jm: \\<open>j < m\\<close> using jk km by simp\n  show \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> proof (rule ccontr)\n    assume ncdj: \\<open>\\<not> m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close>     \n    hence \\<open>\\<exists> l \\<in> {j..m}. \\<pi> l = ipd (\\<pi> j)\\<close> unfolding is_cdi_def by (metis jm nretm path)\n    then obtain l \n    where jl: \\<open>j \\<le> l\\<close> and \\<open>l \\<le> m\\<close> \n    and lipd: \\<open>\\<pi> l = ipd (\\<pi> j)\\<close> by force\n    hence lm: \\<open>l < m\\<close> using nipdj by (metis le_eq_less_or_eq)\n    have npd: \\<open>\\<not> ipd (\\<pi> k) pd\\<rightarrow> \\<pi> l\\<close> by (metis ipd(1) lipd nipdj pd pd_antisym)\n    have nd: \\<open>\\<pi> l \\<in> nodes\\<close> using path path_nodes by simp\n    from no_pd_path[OF nd npd]\n    obtain \\<pi>' n where path': \\<open>is_path \\<pi>'\\<close> and \\<pi>'0: \\<open>\\<pi>' 0 = \\<pi> l\\<close> and \\<pi>'n: \\<open>\\<pi>' n = return\\<close> and nipd: \\<open>\\<forall> ka\\<le>n. \\<pi>' ka \\<noteq> ipd (\\<pi> k)\\<close> .\n    let \\<open>?\\<pi>\\<close> = \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>') \\<guillemotleft> k\\<close>\n    have path'': \\<open>is_path ?\\<pi>\\<close> by (metis \\<pi>'0 path path' path_cons path_path_shift)\n    moreover\n    have kl: \\<open>k < l\\<close> using lipd cdj jl unfolding is_cdi_def by fastforce    \n    have \\<open>?\\<pi> 0 = \\<pi> k\\<close> using kl by auto\n    moreover\n    have \\<open>?\\<pi> (l + n - k) = return\\<close> using \\<pi>'n \\<pi>'0 kl by auto\n    moreover\n    have \\<open>ipd (\\<pi> k) pd\\<rightarrow> \\<pi> k\\<close> by (metis is_ipd_def ipd_is_ipd nretj path path_nodes)\n    ultimately\n    obtain l' where l': \\<open>l' \\<le> (l + n - k)\\<close> \\<open>?\\<pi> l' = ipd (\\<pi> k)\\<close> unfolding is_pd_def by blast\n    show \\<open>False\\<close> proof (cases )\n      assume *: \\<open>k + l' \\<le> l\\<close>\n      hence \\<open>\\<pi> (k + l') = ipd (\\<pi> k)\\<close> using l' by auto\n      moreover \n      have \\<open>k + l' < m\\<close> by (metis \"*\" dual_order.strict_trans2 lm)\n      ultimately\n      show \\<open>False\\<close> using ipd(2) by simp\n    next\n      assume \\<open>\\<not> k + l' \\<le> l\\<close>\n      hence \\<open>\\<pi>' (k + l' - l) = ipd (\\<pi> k)\\<close> using l' by auto\n      moreover\n      have \\<open>k + l' - l \\<le> n\\<close> using l' kl by linarith  \n      ultimately \n      show \\<open>False\\<close> using nipd by auto\n    qed\n  qed\nqed\n\nlemma ipd_icd_greatest_cd_not_ipd: assumes ipd: \\<open>\\<pi> m = ipd (\\<pi> k)\\<close> \\<open>\\<forall> n \\<in> {k..<m}. \\<pi> n \\<noteq> ipd (\\<pi> k)\\<close>\nand km: \\<open>k < m\\<close> and icdj: \\<open>m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> shows \\<open>j = (GREATEST j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> \\<pi> m)\\<close>\nproof -\n  let \\<open>?j\\<close> = \\<open>GREATEST j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> \\<pi> m\\<close>\n  have kcdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using assms cd_ipd_is_cd is_icdi_def by blast   \n  have nipd: \\<open>ipd (\\<pi> j) \\<noteq> \\<pi> m\\<close> using icdj unfolding is_icdi_def is_cdi_def by auto\n  have bound: \\<open>\\<And> j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> \\<pi> m \\<Longrightarrow> j \\<le> k\\<close> unfolding is_cdi_def by simp\n  have exists: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> \\<pi> m\\<close> (is \\<open>?P j\\<close>) using kcdj nipd by auto\n  note GreatestI_nat[of \\<open>?P\\<close> _ \\<open>k\\<close>, OF exists] Greatest_le_nat[of \\<open>?P\\<close> \\<open>j\\<close> \\<open>k\\<close>, OF exists]\n  hence kcdj': \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?j\\<close> and ipd': \\<open>ipd (\\<pi> ?j) \\<noteq> \\<pi> m\\<close> and jj: \\<open>j \\<le> ?j\\<close> using bound by auto\n  hence mcdj': \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?j\\<close> using ipd km cd_is_cd_ipd by auto\n  show \\<open>j = ?j\\<close> proof (rule ccontr)\n    assume \\<open>j \\<noteq> ?j\\<close>\n    hence jlj: \\<open>j < ?j\\<close> using jj by simp\n    moreover \n    have \\<open>?j < m\\<close> using kcdj' km unfolding is_cdi_def by auto\n    ultimately\n    show \\<open>False\\<close> using icdj mcdj' unfolding is_icdi_def by auto\n  qed\nqed\n\nlemma cd_impl_icd_cd: assumes \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> and \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and \\<open>\\<not> i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> shows \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close>\n  using assms cd_split icd_uniq by metis\n\nlemma cdi_is_cd_icdi: assumes \\<open>k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> shows \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<longleftrightarrow> j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<or> i = j\\<close> \n  by (metis assms cd_impl_icd_cd cd_trans icd_imp_cd icd_uniq)\n\nlemma same_ipd_stable: assumes \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> \\<open>i<j\\<close> \\<open>ipd (\\<pi> i) = ipd (\\<pi> k)\\<close> shows \\<open>ipd (\\<pi> j) = ipd (\\<pi> k)\\<close>\nproof -\n  have jcdi: \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> by (metis is_cdi_def assms(1,2,3) cr_wn' le_antisym less_imp_le_nat)\n  have 1: \\<open>ipd (\\<pi> j) pd\\<rightarrow> \\<pi> k \\<close> by (metis assms(2) ipd_pd_cd)\n  have 2: \\<open>ipd (\\<pi> k) pd\\<rightarrow> \\<pi> j \\<close> by (metis assms(4) ipd_pd_cd jcdi)\n  have 3: \\<open>ipd (\\<pi> k) pd\\<rightarrow> (ipd (\\<pi> j))\\<close>  by (metis 2 IFC_def.is_cdi_def assms(1,2,4) atLeastAtMost_iff jcdi less_imp_le pd_node2 pd_pd_ipd) \n  have 4: \\<open>ipd (\\<pi> j) pd\\<rightarrow> (ipd (\\<pi> k))\\<close> by (metis 1 2 IFC_def.is_ipd_def assms(2) cd_not_pd ipd_is_ipd jcdi pd_node2 ret_no_cd) \n  show \\<open>?thesis\\<close> using 3 4 pd_antisym by simp\nqed\n\nlemma icd_pd_intermediate': assumes icd: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>  and j: \\<open>k < j\\<close> \\<open>j < i\\<close> shows \\<open>\\<pi> i pd\\<rightarrow> (\\<pi> j)\\<close>\nusing j proof (induction \\<open>i - j\\<close> arbitrary: \\<open>j\\<close> rule: less_induct)\n  case (less j)\n  have \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using less.prems icd unfolding is_icdi_def by force\n  moreover \n  have \\<open>is_path \\<pi>\\<close> using icd by (metis is_icdi_def)\n  moreover \n  have \\<open>\\<pi> i \\<noteq> return\\<close> using icd by (metis is_icdi_def ret_no_cd)\n  ultimately\n  have \\<open>\\<exists> l. j \\<le> l \\<and> l \\<le> i \\<and> \\<pi> l = ipd (\\<pi> j)\\<close> unfolding is_cdi_def using less.prems by auto\n  then obtain l where l: \\<open>j \\<le> l\\<close> \\<open>l \\<le> i\\<close> \\<open>\\<pi> l = ipd (\\<pi> j)\\<close> by blast\n  hence lpd: \\<open>\\<pi> l pd\\<rightarrow> (\\<pi> j)\\<close> by (metis is_ipd_def \\<open>\\<pi> i \\<noteq> return\\<close> \\<open>is_path \\<pi>\\<close> ipd_is_ipd path_nodes term_path_stable)\n  show \\<open>?case\\<close> proof (cases)\n    assume \\<open>l = i\\<close>\n    thus \\<open>?case\\<close> using lpd by auto\n  next\n    assume \\<open>l \\<noteq> i\\<close>\n    hence \\<open>l < i\\<close> using l by simp\n    moreover\n    have \\<open>j \\<noteq> l\\<close> using l by (metis is_ipd_def \\<open>\\<pi> i \\<noteq> return\\<close> \\<open>is_path \\<pi>\\<close> ipd_is_ipd path_nodes term_path_stable)\n    hence \\<open>j < l\\<close> using l by simp\n    moreover \n    hence \\<open>i - l < i - j\\<close> by (metis diff_less_mono2 less.prems(2))\n    moreover\n    have \\<open>k < l\\<close> by (metis l(1) less.prems(1) linorder_neqE_nat not_le order.strict_trans)\n    ultimately\n    have \\<open>\\<pi> i pd\\<rightarrow> (\\<pi> l)\\<close> using less.hyps by auto\n    thus \\<open>?case\\<close> using lpd by (metis pd_trans)\n  qed\nqed\n\nlemma icd_pd_intermediate: assumes icd: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>  and j: \\<open>k < j\\<close> \\<open>j \\<le> i\\<close> shows \\<open>\\<pi> i pd\\<rightarrow> (\\<pi> j)\\<close> \nusing assms icd_pd_intermediate'[OF assms(1,2)] apply (cases \\<open>j < i\\<close>,metis) by (metis is_icdi_def le_neq_trans path_nodes pd_refl)\n\nlemma no_icd_pd: assumes path: \\<open>is_path \\<pi>\\<close> and noicd: \\<open>\\<forall> l\\<ge>n. \\<not> k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> and nk: \\<open>n \\<le> k\\<close> shows \\<open>\\<pi> k pd\\<rightarrow> \\<pi> n\\<close>\nproof cases\n  assume \\<open>\\<pi> k = return\\<close> thus \\<open>?thesis\\<close> by (metis path path_nodes return_pd)  \nnext\n  assume nret: \\<open>\\<pi> k \\<noteq> return\\<close>\n  have nocd: \\<open>\\<And> l. n\\<le>l \\<Longrightarrow> \\<not> k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> proof \n    fix l assume kcd: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> and nl: \\<open>n \\<le> l\\<close>\n    hence \\<open>(k - n) cd\\<^bsup>\\<pi>\\<guillemotleft>n\\<^esup>\\<rightarrow> (l - n)\\<close> using cd_path_shift[OF nl path] by simp\n    hence \\<open>\\<exists> l. (k - n) icd\\<^bsup>\\<pi>\\<guillemotleft>n\\<^esup>\\<rightarrow> l\\<close> using excd_impl_exicd by blast\n    then guess l' ..\n    hence \\<open>k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> (l' + n)\\<close> using icd_path_shift[of \\<open>n\\<close> \\<open>l' + n\\<close> \\<open>\\<pi>\\<close> \\<open>k\\<close>] path by auto\n    thus \\<open>False\\<close> using noicd by auto\n  qed    \n  hence \\<open>\\<And>l. n \\<le> l \\<Longrightarrow> l<k \\<Longrightarrow> \\<exists> j \\<in> {l..k}. \\<pi> j = ipd (\\<pi> l)\\<close> using path nret unfolding is_cdi_def by auto \n  thus \\<open>?thesis\\<close> using nk proof (induction \\<open>k - n\\<close> arbitrary: \\<open>n\\<close> rule: less_induct,cases)\n    case (less n) \n    assume \\<open>n = k\\<close>\n    thus \\<open>?case\\<close> using pd_refl path path_nodes by auto\n  next\n    case (less n)\n    assume \\<open>n \\<noteq> k\\<close>\n    hence nk: \\<open>n < k\\<close> using less(3) by auto\n    with less(2) obtain j where jnk: \\<open>j \\<in> {n..k}\\<close> and ipdj: \\<open>\\<pi> j = ipd (\\<pi> n)\\<close> by blast\n    have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> using nk nret term_path_stable path by auto\n    with ipd_is_ipd path path_nodes is_ipd_def ipdj\n    have jpdn: \\<open>\\<pi> j pd\\<rightarrow> \\<pi> n\\<close> by auto\n    show \\<open>?case\\<close> proof cases\n      assume \\<open>j = k\\<close> thus \\<open>?case\\<close> using jpdn by simp\n    next\n      assume \\<open>j \\<noteq> k\\<close>\n      hence jk: \\<open>j < k\\<close> using jnk by auto\n      have \\<open>j \\<noteq> n\\<close> using ipdj by (metis ipd_not_self nretn path path_nodes)\n      hence nj: \\<open>n < j\\<close> using jnk by auto\n      have *: \\<open>k - j < k - n\\<close> using jk nj by auto\n      \n      with less(1)[OF *] less(2) jk nj\n      have \\<open>\\<pi> k pd\\<rightarrow> \\<pi> j\\<close> by auto\n\n      thus \\<open>?thesis\\<close> using jpdn pd_trans by metis\n    qed\n  qed\nqed\n\n\nlemma first_pd_no_cd: assumes path: \\<open>is_path \\<pi>\\<close> and pd: \\<open>\\<pi> n pd\\<rightarrow> \\<pi> 0\\<close> and first: \\<open>\\<forall> l < n. \\<pi> l \\<noteq> \\<pi> n\\<close> shows \\<open>\\<forall> l. \\<not> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> \nproof (rule ccontr, goal_cases)\n  case 1\n  then obtain l where ncdl: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> by blast\n  hence ln: \\<open>l < n\\<close> using is_cdi_def by auto\n  have \\<open>\\<not> \\<pi> n pd\\<rightarrow> \\<pi> l\\<close> using ncdl cd_not_pd by (metis ln first)\n  then obtain \\<pi>' n' where path': \\<open>is_path \\<pi>'\\<close> and \\<pi>0: \\<open>\\<pi>' 0 = \\<pi> l\\<close> and \\<pi>n: \\<open>\\<pi>' n' = return\\<close> and not\\<pi>n: \\<open>\\<forall> j\\<le> n'. \\<pi>' j \\<noteq> \\<pi> n\\<close> unfolding is_pd_def using path path_nodes by auto\n  let \\<open>?\\<pi>\\<close> = \\<open>\\<pi>@\\<^bsup>l\\<^esup> \\<pi>'\\<close>\n  \n  have \\<open>is_path ?\\<pi>\\<close> by (metis \\<pi>0 path path' path_cons)\n  moreover\n  have \\<open>?\\<pi> 0 = \\<pi> 0\\<close> by auto\n  moreover\n  have \\<open>?\\<pi> (n' + l) = return\\<close> using \\<pi>0 \\<pi>n by auto\n  ultimately\n  obtain j where j: \\<open>j \\<le> n' + l\\<close> and jn: \\<open>?\\<pi> j = \\<pi> n\\<close> using pd unfolding is_pd_def by blast\n  show \\<open>False\\<close> proof cases\n    assume \\<open>j \\<le> l\\<close> thus \\<open>False\\<close> using jn first ln by auto\n  next\n    assume \\<open>\\<not> j \\<le> l\\<close> thus \\<open>False\\<close> using j jn not\\<pi>n by auto\n  qed\nqed\n\nlemma first_pd_no_icd: assumes path: \\<open>is_path \\<pi>\\<close> and pd: \\<open>\\<pi> n pd\\<rightarrow> \\<pi> 0\\<close> and first: \\<open>\\<forall> l < n. \\<pi> l \\<noteq> \\<pi> n\\<close> shows \\<open>\\<forall> l. \\<not> n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close>\n  by (metis first first_pd_no_cd icd_imp_cd path pd)\n\nlemma path_nret_ex_nipd: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<forall> i. \\<pi> i \\<noteq> return\\<close> shows \\<open>\\<forall> i. (\\<exists> j\\<ge>i. (\\<forall> k>j. \\<pi> k \\<noteq> ipd (\\<pi> j)))\\<close> proof(rule, rule ccontr)\n  fix i\n  assume \\<open>\\<not> (\\<exists>j\\<ge>i. \\<forall> k>j. \\<pi> k \\<noteq> ipd (\\<pi> j))\\<close>\n  hence *: \\<open>\\<forall> j\\<ge>i. (\\<exists>k>j. \\<pi> k = ipd (\\<pi> j))\\<close> by blast\n  have \\<open>\\<forall> j. (\\<exists>k>j. (\\<pi>\\<guillemotleft>i) k = ipd ((\\<pi>\\<guillemotleft>i) j))\\<close> proof\n    fix j\n    have \\<open>i + j \\<ge> i\\<close> by auto\n    then obtain k where k: \\<open>k>i+j\\<close> \\<open>\\<pi> k = ipd (\\<pi> (i+j))\\<close> using * by blast\n    hence \\<open>(\\<pi>\\<guillemotleft>i) (k - i) = ipd ((\\<pi>\\<guillemotleft>i) j)\\<close> by auto\n    moreover  \n    have \\<open>k - i > j\\<close> using k by auto\n    ultimately\n    show \\<open>\\<exists>k>j. (\\<pi>\\<guillemotleft>i) k = ipd ((\\<pi>\\<guillemotleft>i) j)\\<close> by auto\n  qed\n  moreover\n  have \\<open>is_path (\\<pi>\\<guillemotleft>i)\\<close> using assms(1) path_path_shift by simp\n  ultimately\n  obtain k where \\<open>(\\<pi>\\<guillemotleft>i) k = return\\<close> using all_ipd_imp_ret by blast\n  thus \\<open>False\\<close> using assms(2) by auto\nqed\n\nlemma path_nret_ex_all_cd: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<forall> i. \\<pi> i \\<noteq> return\\<close> shows \\<open>\\<forall> i. (\\<exists> j\\<ge>i. (\\<forall> k>j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j))\\<close>\nunfolding is_cdi_def using assms path_nret_ex_nipd[OF assms] by (metis atLeastAtMost_iff ipd_not_self linorder_neqE_nat not_le path_nodes)\n\n\nlemma path_nret_inf_all_cd: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<forall> i. \\<pi> i \\<noteq> return\\<close> shows \\<open>\\<not> finite {j. \\<forall> k>j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j}\\<close> \nusing unbounded_nat_set_infinite path_nret_ex_all_cd[OF assms] by auto\n\nlemma path_nret_inf_icd_seq: assumes path: \\<open>is_path \\<pi>\\<close> and nret: \\<open>\\<forall> i. \\<pi> i \\<noteq> return\\<close> \nobtains f where \\<open>\\<forall> i. f (Suc i) icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f i\\<close> \\<open>range f = {i. \\<forall> j>i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}\\<close> \\<open>\\<not> (\\<exists>i. f 0 cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i)\\<close>\nproof -\n  note path_nret_inf_all_cd[OF assms]\n  then obtain f where ran: \\<open>range f = {j. \\<forall> k>j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j}\\<close> and asc: \\<open>\\<forall> i. f i < f (Suc i)\\<close> using infinite_ascending by blast\n  have mono: \\<open>\\<forall> i j. i < j \\<longrightarrow> f i < f j\\<close> using asc by (metis lift_Suc_mono_less)\n  {\n    fix i\n    have cd: \\<open>f (Suc i) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f i\\<close> using ran asc by auto\n    have \\<open>f (Suc i) icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f i\\<close> proof (rule ccontr)\n      assume \\<open>\\<not> f (Suc i) icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f i\\<close>\n      then obtain m where  im: \\<open>f i < m\\<close> and mi: \\<open> m < f (Suc i)\\<close> and cdm: \\<open>f (Suc i) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> unfolding is_icdi_def using assms(1) cd by auto\n      have \\<open>\\<forall> k>m. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>m\\<close> proof (rule,rule,cases)\n        fix k assume \\<open>f (Suc i) < k\\<close>\n        hence \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f (Suc i)\\<close> using ran by auto\n        thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cdm cd_trans by metis\n      next\n        fix k assume mk: \\<open>m < k\\<close> and \\<open>\\<not> f (Suc i) < k\\<close>\n        hence ik: \\<open>k \\<le> f (Suc i)\\<close> by simp\n        thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cdm by (metis cdi_prefix mk)\n      qed\n      hence \\<open>m \\<in> range f\\<close> using ran by blast\n      then obtain j where m: \\<open>m = f j\\<close> by blast\n      show \\<open>False\\<close> using im mi mono unfolding m by (metis Suc_lessI le_less not_le)\n    qed\n  }\n  moreover  \n  {\n    fix m\n    assume cdm: \\<open>f 0 cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close>\n    have \\<open>\\<forall> k>m. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>m\\<close> proof (rule,rule,cases)\n      fix k assume \\<open>f 0 < k\\<close>\n      hence \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f 0\\<close> using ran by auto\n      thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cdm cd_trans by metis\n    next\n      fix k assume mk: \\<open>m < k\\<close> and \\<open>\\<not> f 0 < k\\<close>\n      hence ik: \\<open>k \\<le> f 0\\<close> by simp\n      thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cdm by (metis cdi_prefix mk)\n    qed\n    hence \\<open>m \\<in> range f\\<close> using ran by blast\n    then obtain j where m: \\<open>m = f j\\<close> by blast\n    hence fj0: \\<open>f j < f 0\\<close>  using cdm m is_cdi_def by auto\n    hence \\<open>0 < j\\<close> by (metis less_irrefl neq0_conv)\n    hence \\<open>False\\<close> using fj0 mono by fastforce\n  }\n  ultimately show \\<open>thesis\\<close> using that ran by blast\nqed\n\nlemma cdi_iff_no_strict_pd: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<longleftrightarrow> is_path \\<pi> \\<and> k < i \\<and> \\<pi> i \\<noteq> return \\<and> (\\<forall> j \\<in> {k..i}. \\<not> (\\<pi> k, \\<pi> j) \\<in> pdt)\\<close>\nproof\n  assume cd:\\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  have 1: \\<open>is_path \\<pi> \\<and> k < i \\<and> \\<pi> i \\<noteq> return\\<close> using cd unfolding is_cdi_def by auto\n  have 2: \\<open>\\<forall> j \\<in> {k..i}. \\<not> (\\<pi> k, \\<pi> j) \\<in> pdt\\<close> proof (rule ccontr)\n    assume \\<open> \\<not> (\\<forall>j\\<in>{k..i}. (\\<pi> k, \\<pi> j) \\<notin> pdt)\\<close>\n    then obtain j where \\<open>j \\<in> {k..i}\\<close> and \\<open>(\\<pi> k, \\<pi> j) \\<in> pdt\\<close> by auto\n    hence \\<open>\\<pi> j \\<noteq> \\<pi> k\\<close> and \\<open>\\<pi> j pd\\<rightarrow> \\<pi> k\\<close> unfolding pdt_def by auto\n    thus \\<open>False\\<close> using path_pd_ipd by (metis \\<open>j \\<in> {k..i}\\<close> atLeastAtMost_iff cd cd_not_pd cdi_prefix le_eq_less_or_eq) \n  qed\n  show \\<open>is_path \\<pi> \\<and> k < i \\<and> \\<pi> i \\<noteq> return \\<and> (\\<forall> j \\<in> {k..i}. \\<not> (\\<pi> k, \\<pi> j) \\<in> pdt)\\<close> using 1 2 by simp\nnext\n  assume \\<open>is_path \\<pi> \\<and> k < i \\<and> \\<pi> i \\<noteq> return \\<and> (\\<forall> j \\<in> {k..i}. \\<not> (\\<pi> k, \\<pi> j) \\<in> pdt)\\<close>\n  thus \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis ipd_in_pdt term_path_stable less_or_eq_imp_le not_cd_impl_ipd path_nodes)\nqed\n\n\nsubsection \\<open>Facts about Control Slices\\<close>\n\nlemma last_cs: \\<open>last (cs\\<^bsup>\\<pi>\\<^esup> i) = \\<pi> i\\<close> by auto\n\nlemma cs_not_nil: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n \\<noteq> []\\<close> by (auto)\n\nlemma cs_return: assumes \\<open>\\<pi> n = return\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = [\\<pi> n]\\<close> by (metis assms cs.elims icd_imp_cd ret_no_cd)\n\nlemma cs_0[simp]: \\<open>cs\\<^bsup>\\<pi>\\<^esup> 0 = [\\<pi> 0]\\<close> using is_icdi_def is_cdi_def by auto\n\nlemma cs_inj: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> n \\<noteq> return\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>\\<^esup> n'\\<close> shows \\<open>n = n'\\<close> \nusing assms proof (induction \\<open>cs\\<^bsup>\\<pi>\\<^esup> n\\<close> arbitrary: \\<open>\\<pi>\\<close> \\<open>n\\<close> \\<open>n'\\<close> rule:rev_induct)\n  case Nil hence \\<open>False\\<close> using cs_not_nil by metis thus \\<open>?case\\<close> by simp\nnext\n  case (snoc x xs \\<pi> n n') show \\<open>?case\\<close> proof (cases \\<open>xs\\<close>)\n  case Nil \n  hence *: \\<open>\\<not> (\\<exists> k. n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k)\\<close> using snoc(2) cs_not_nil \n    by (auto,metis append1_eq_conv append_Nil cs_not_nil)\n  moreover\n  have \\<open>[x] = cs\\<^bsup>\\<pi>\\<^esup> n'\\<close> using Nil snoc by auto\n  hence **: \\<open>\\<not> (\\<exists> k. n' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k)\\<close> using cs_not_nil\n    by (auto,metis append1_eq_conv append_Nil cs_not_nil)\n  ultimately\n  have \\<open>\\<forall> k. \\<not> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<forall> k. \\<not> n' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using excd_impl_exicd by auto blast+\n  moreover \n  hence  \\<open>\\<pi> n = \\<pi> n'\\<close> using snoc(5,2) by auto (metis * ** list.inject)\n  ultimately\n  show \\<open>n = n'\\<close> using other_claim' snoc by blast\nnext\n  case (Cons y ys)\n  hence *: \\<open>\\<exists> k. n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> using snoc(2) by auto (metis append_is_Nil_conv list.distinct(1) list.inject)\n  then obtain k where k: \\<open>n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> by auto\n  have \\<open>k = (THE k . n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> using k by (metis icd_is_the_icd)\n  hence xsk: \\<open>xs = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using * k snoc(2) unfolding cs.simps[of \\<open>\\<pi>\\<close> \\<open>n\\<close>] by auto\n  have **: \\<open>\\<exists> k. n' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> using snoc(2)[unfolded snoc(5)] by auto (metis Cons append1_eq_conv append_Nil list.distinct(1))\n  then obtain k' where k': \\<open>n' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k'\\<close> by auto\n  hence \\<open>k' = (THE k . n' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> using k' by (metis icd_is_the_icd)\n  hence xsk': \\<open>xs = cs\\<^bsup>\\<pi>\\<^esup> k'\\<close> using ** k' snoc(5,2) unfolding cs.simps[of \\<open>\\<pi>\\<close> \\<open>n'\\<close>] by auto\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>\\<^esup> k'\\<close> using xsk by simp\n  moreover\n  have kn: \\<open>k < n\\<close> using k by (metis is_icdi_def is_cdi_def)\n  hence \\<open>\\<pi> k \\<noteq> return\\<close> using snoc by (metis term_path_stable less_imp_le)\n  ultimately\n  have kk'[simp]: \\<open>k' = k\\<close> using snoc(1) xsk snoc(3) by metis\n  have nk0: \\<open>n - k icd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> 0\\<close> \\<open>n' - k icd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> 0\\<close> using k k' icd_path_shift0 snoc(3) by auto\n  moreover \n  have nkr: \\<open>(\\<pi>\\<guillemotleft>k)(n-k) \\<noteq> return\\<close> using snoc(4) kn by auto\n  moreover \n  have \\<open>is_path (\\<pi>\\<guillemotleft>k)\\<close> by (metis path_path_shift snoc.prems(1))\n  moreover \n  have kn': \\<open>k < n'\\<close> using k' kk' by (metis is_icdi_def is_cdi_def)\n  have \\<open>\\<pi> n = \\<pi> n'\\<close> using snoc(5) * ** by auto\n  hence \\<open>(\\<pi>\\<guillemotleft>k)(n-k) = (\\<pi>\\<guillemotleft>k)(n'-k)\\<close> using kn kn' by auto \n  ultimately  \n  have \\<open>n - k = n' - k\\<close> using other_claim  by auto\n  thus \\<open>n = n'\\<close> using kn kn' by auto\nqed\nqed\n\nlemma cs_cases: fixes \\<pi> i \nobtains (base) \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = [\\<pi> i]\\<close> and \\<open>\\<forall> k. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> | \n(depend) k where  \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> k)@[\\<pi> i]\\<close> and \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \nproof cases\n  assume *: \\<open>\\<exists> k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  then obtain k where k: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> ..\n  hence \\<open>k = (THE k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close>  by (metis icd_is_the_icd)\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> k)@[\\<pi> i]\\<close> using * by auto\n  with k that show \\<open>thesis\\<close> by simp\nnext\n  assume *: \\<open>\\<not> (\\<exists> k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close>\n  hence \\<open>\\<forall> k. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis excd_impl_exicd)\n  moreover \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = [\\<pi> i]\\<close> using * by auto\n  ultimately\n  show \\<open>thesis\\<close> using that by simp\nqed\n\nlemma cs_length_one: assumes \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) = 1\\<close> shows  \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = [\\<pi> i]\\<close> and \\<open>\\<forall> k. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  apply (cases \\<open>i\\<close> \\<open>\\<pi>\\<close> rule: cs_cases)\n  using assms cs_not_nil \n    apply auto \n  apply (cases \\<open>i\\<close> \\<open>\\<pi>\\<close> rule: cs_cases) \n  using assms cs_not_nil \n  by auto\n\nlemma cs_length_g_one: assumes \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) \\<noteq> 1\\<close> obtains k where  \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> k)@[\\<pi> i]\\<close> and \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \n  apply (cases \\<open>i\\<close> \\<open>\\<pi>\\<close> rule: cs_cases) \n  using assms cs_not_nil by auto\n\nlemma claim: assumes  path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and  ii: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> and jj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> \nand bl: \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> i) = butlast (cs\\<^bsup>\\<pi>\\<^esup> j)\\<close> and nret: \\<open>\\<pi> i \\<noteq> return\\<close> and ilj: \\<open>i < j\\<close> \nshows \\<open>i' < j'\\<close>\nproof (cases )\n  assume *: \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) = 1\\<close>\n  hence **: \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) = 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> j) = 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>'\\<^esup> i') = 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>'\\<^esup> j') = 1\\<close>  \n    apply metis\n    apply (metis \"*\" bl butlast.simps(2) butlast_snoc cs_length_g_one cs_length_one(1) cs_not_nil) \n    apply (metis \"*\" ii)\n    by (metis \"*\" bl butlast.simps(2) butlast_snoc cs_length_g_one cs_length_one(1) cs_not_nil jj)\n  then obtain \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = [\\<pi> i]\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = [\\<pi> j]\\<close> \\<open>cs\\<^bsup>\\<pi>'\\<^esup> j' = [\\<pi>' j']\\<close> \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i'= [\\<pi>' i']\\<close> \n    \\<open>\\<forall> k. \\<not> j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<forall> k. \\<not> i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<forall> k. \\<not> j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k\\<close>\n  by (metis cs_length_one ** )\n  moreover \n  hence \\<open>\\<pi> i = \\<pi>' i'\\<close> \\<open>\\<pi> j = \\<pi>' j'\\<close> using  assms by auto\n  ultimately\n  show \\<open>i' < j'\\<close> using nret ilj path claim'' by blast\nnext\n  assume *: \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) \\<noteq> 1\\<close>\n  hence **: \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) \\<noteq> 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> j) \\<noteq> 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>'\\<^esup> i') \\<noteq> 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>'\\<^esup> j') \\<noteq> 1\\<close>  \n    apply metis\n    apply (metis \"*\" bl butlast.simps(2) butlast_snoc cs_length_g_one cs_length_one(1) cs_not_nil)\n    apply (metis \"*\" ii)\n    by (metis \"*\" bl butlast.simps(2) butlast_snoc cs_length_g_one cs_length_one(1) cs_not_nil jj)\n  obtain k l k' l' where ***:\n    \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> k)@[\\<pi> i]\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = (cs\\<^bsup>\\<pi>\\<^esup> l)@[\\<pi> j]\\<close>  \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' = (cs\\<^bsup>\\<pi>'\\<^esup> k')@[\\<pi>' i']\\<close> \\<open>cs\\<^bsup>\\<pi>'\\<^esup> j' = (cs\\<^bsup>\\<pi>'\\<^esup> l')@[\\<pi>' j']\\<close> and\n    icds: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>j icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> \\<open>i' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> \\<open>j' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> l'\\<close>\n    by (metis ** cs_length_g_one)\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>\\<^esup> l\\<close> \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> using assms by auto\n  moreover\n  have \\<open>\\<pi> k \\<noteq> return\\<close> \\<open>\\<pi>' k' \\<noteq> return\\<close> using nret \n    apply (metis is_icdi_def icds(1) is_cdi_def term_path_stable less_imp_le) \n    by (metis is_cdi_def is_icdi_def icds(3) term_path_stable less_imp_le)\n  ultimately  \n  have lk[simp]: \\<open>l = k\\<close> \\<open>l' = k'\\<close> using path cs_inj by auto\n  let \\<open>?\\<pi>\\<close> = \\<open>\\<pi> \\<guillemotleft> k\\<close> \n  let \\<open>?\\<pi>'\\<close> = \\<open>\\<pi>'\\<guillemotleft>k'\\<close>\n  have \\<open>i-k icd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow> 0\\<close> \\<open>j-k icd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow> 0\\<close> \\<open>i'-k' icd\\<^bsup>?\\<pi>'\\<^esup>\\<rightarrow> 0\\<close> \\<open>j'-k' icd\\<^bsup>?\\<pi>'\\<^esup>\\<rightarrow> 0\\<close> using icd_path_shift0 path icds by auto\n  moreover\n  have ki: \\<open>k < i\\<close> using icds by (metis is_icdi_def is_cdi_def)\n  hence \\<open>i-k < j-k\\<close> by (metis diff_is_0_eq diff_less_mono ilj nat_le_linear order.strict_trans)\n  moreover\n  have \\<pi>i: \\<open>\\<pi> i = \\<pi>' i'\\<close> \\<open>\\<pi> j = \\<pi>' j'\\<close> using assms *** by auto\n  have \\<open>k' < i'\\<close> \\<open>k' < j'\\<close> using icds unfolding lk by (metis is_cdi_def is_icdi_def)+ \n  hence \\<open>?\\<pi> (i-k) = ?\\<pi>' (i'-k')\\<close> \\<open>?\\<pi> (j-k) = ?\\<pi>' (j'-k')\\<close> using \\<pi>i ki ilj by auto\n  moreover \n  have \\<open>?\\<pi> (i-k) \\<noteq> return\\<close> using nret ki by auto\n  moreover\n  have \\<open>is_path ?\\<pi>\\<close> \\<open>is_path ?\\<pi>'\\<close> using path path_path_shift by auto\n  ultimately\n  have \\<open>i'-k' < j' - k'\\<close> using claim' by blast\n  thus \\<open>i' < j'\\<close> by (metis diff_is_0_eq diff_less_mono less_nat_zero_code linorder_neqE_nat nat_le_linear)\nqed\n\nlemma cs_split': assumes \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs@[x,x']@ys\\<close>  shows \\<open>\\<exists> m. cs\\<^bsup>\\<pi>\\<^esup> m = xs@[x] \\<and> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> \nusing assms proof (induction \\<open>ys\\<close> arbitrary: \\<open>i\\<close> rule:rev_induct ) \n  case (snoc y ys)\n  hence \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) \\<noteq> 1\\<close> by auto\n  then obtain i' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> i') @ [\\<pi> i]\\<close> and *: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i'\\<close> using cs_length_g_one[of \\<open>\\<pi>\\<close> \\<open>i\\<close>] by metis\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> i' = xs@[x,x']@ys\\<close> using snoc(2) by (metis append1_eq_conv append_assoc)\n  then obtain m where **: \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = xs @ [x]\\<close> and \\<open>i' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using snoc(1) by blast\n  hence \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using * cd_trans by (metis is_icdi_def)\n  with ** show \\<open>?case\\<close> by blast\nnext\n  case Nil\n  hence \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) \\<noteq> 1\\<close> by auto\n  then obtain i' where a: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> i') @ [\\<pi> i]\\<close> and *: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i'\\<close> using cs_length_g_one[of \\<open>\\<pi>\\<close> \\<open>i\\<close>] by metis\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (xs@[x])@[x']\\<close> using Nil by auto\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> i' = xs@[x]\\<close> using append1_eq_conv a by metis  \n  thus \\<open>?case\\<close> using * unfolding is_icdi_def by blast\nqed\n\nlemma cs_split: assumes \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs@[x]@ys@[\\<pi> i]\\<close>  shows \\<open>\\<exists> m. cs\\<^bsup>\\<pi>\\<^esup> m = xs@[x] \\<and> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> proof -\n  obtain x' ys' where \\<open>ys@[\\<pi> i] = [x']@ys'\\<close> by (metis append_Cons append_Nil neq_Nil_conv)\n  thus \\<open>?thesis\\<close> using cs_split'[of \\<open>\\<pi>\\<close> \\<open>i\\<close> \\<open>xs\\<close> \\<open>x\\<close> \\<open>x'\\<close> \\<open>ys'\\<close>] assms by auto\nqed\n\nlemma cs_less_split: assumes \\<open>xs \\<prec> ys\\<close> obtains a as where \\<open>ys = xs@a#as\\<close>\n  using assms unfolding cs_less.simps apply auto\nby (metis Cons_nth_drop_Suc append_take_drop_id)\n\nlemma cs_select_is_cs: assumes \\<open>is_path \\<pi>\\<close> \\<open>xs \\<noteq> Nil\\<close> \\<open>xs \\<prec> cs\\<^bsup>\\<pi>\\<^esup> k\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> (\\<pi>\\<exclamdown>xs) = xs\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> (\\<pi>\\<exclamdown>xs)\\<close>proof -\n  obtain b bs where b: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = xs@b#bs\\<close> using assms cs_less_split by blast\n  obtain a as where a: \\<open>xs = as@[a]\\<close> using assms by (metis rev_exhaust)\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = as@[a,b]@bs\\<close> using a b by auto\n  then obtain k' where csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k' = xs\\<close> and is_cd: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k'\\<close> using cs_split' a by blast\n  hence nret: \\<open>\\<pi> k' \\<noteq> return\\<close> by (metis is_cdi_def term_path_stable less_imp_le)\n  show a: \\<open>cs\\<^bsup>\\<pi>\\<^esup> (\\<pi>\\<exclamdown>xs) = xs\\<close> unfolding cs_select_def using cs_inj[OF assms(1) nret] csk the_equality[of _ \\<open>k'\\<close>]\n    by (metis (mono_tags))\n  show \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> (\\<pi>\\<exclamdown>xs)\\<close> unfolding cs_select_def by (metis a assms(1) cs_inj cs_select_def csk is_cd nret)\nqed\n\nlemma cd_in_cs: assumes \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> shows \\<open>\\<exists> ns. cs\\<^bsup>\\<pi>\\<^esup> n = (cs\\<^bsup>\\<pi>\\<^esup> m) @ ns @[\\<pi> n]\\<close> \nusing assms proof (induction rule: cd_induct)\n  case (base  n) thus \\<open>?case\\<close> by (metis append_Nil cs.simps icd_is_the_icd)\nnext\n  case (IS k n)\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>\\<^esup> k @ [\\<pi> n]\\<close> by (metis cs.simps icd_is_the_icd)  \n  thus \\<open>?case\\<close> using IS by force\nqed\n\nlemma butlast_cs_not_cd: assumes \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> m) = butlast (cs\\<^bsup>\\<pi>\\<^esup> n)\\<close> shows \\<open>\\<not> m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>n\\<close>\nby (metis append_Cons append_Nil append_assoc assms cd_in_cs cs_not_nil list.distinct(1) self_append_conv snoc_eq_iff_butlast)\n\nlemma wn_cs_butlast: assumes \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> m) = butlast (cs\\<^bsup>\\<pi>\\<^esup> n)\\<close> \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> \\<open>m<n\\<close> shows \\<open>i<j\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> i < j\\<close>\n  moreover\n  have \\<open>\\<not> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> by (metis assms(1) butlast_cs_not_cd)\n  ultimately\n  have \\<open>n \\<le> m\\<close> using assms(2,3) cr_wn'' by auto\n  thus \\<open>False\\<close> using assms(4) by auto\nqed\n\n\ntext \\<open>This is the central theorem making the control slice suitable for matching indices between executions.\\<close>\n\ntheorem cs_order: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> \nand csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> and nret: \\<open>\\<pi> i \\<noteq> return\\<close> and ilj: \\<open>i < j\\<close>   \nshows \\<open>i'<j'\\<close>\nproof -\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>\\<^esup> j\\<close> using cs_inj[OF path(1) nret] ilj by blast\n  moreover \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> Nil\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j \\<noteq> Nil\\<close> by (metis cs_not_nil)+\n  ultimately show \\<open>?thesis\\<close> proof (cases rule: list_neq_prefix_cases)\n    case (diverge xs x x' ys ys')\n    note csx = \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs @ [x] @ ys\\<close>\n    note csx' = \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = xs @ [x'] @ ys'\\<close>\n    note xx = \\<open>x \\<noteq> x'\\<close>\n    show \\<open>i' < j'\\<close> proof (cases \\<open>ys\\<close>) \n      assume ys: \\<open>ys = Nil\\<close>\n      show \\<open>?thesis\\<close> proof (cases \\<open>ys'\\<close>)\n        assume ys': \\<open>ys' = Nil\\<close>\n        have cs: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs @ [x]\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = xs @ [x']\\<close> by (metis append_Nil2 csx ys, metis append_Nil2 csx' ys')\n        hence bl: \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> i) = butlast (cs\\<^bsup>\\<pi>\\<^esup> j)\\<close> by auto        \n        show \\<open>i' < j'\\<close> using claim[OF path csi csj bl nret ilj] .\n      next\n        fix y' zs'\n        assume ys': \\<open>ys' = y'#zs'\\<close>\n        have cs: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs @ [x]\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = xs @ [x',y']@ zs'\\<close> by (metis append_Nil2 csx ys, metis append_Cons append_Nil csx' ys')         \n        obtain n where n: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = xs@[x']\\<close> and jn: \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> using cs cs_split' by blast\n        obtain n' where n': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n' = xs@[x']\\<close> and jn': \\<open>j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> using cs cs_split' unfolding csj by blast\n        have csn : \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and bl: \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> i) = butlast (cs\\<^bsup>\\<pi>\\<^esup> n)\\<close> using n n' cs by auto\n        hence bl': \\<open>butlast (cs\\<^bsup>\\<pi>'\\<^esup> i') = butlast (cs\\<^bsup>\\<pi>'\\<^esup> n')\\<close> using csi by auto\n        have notcd: \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> by (metis butlast_cs_not_cd bl)\n        have nin: \\<open>i \\<noteq> n\\<close> using cs n xx by auto\n        have iln: \\<open>i < n\\<close> apply (rule ccontr) using cr_wn'[OF jn notcd] nin ilj by auto\n        note claim[OF path csi csn bl nret iln]\n        hence \\<open>i' < n'\\<close> .\n        thus \\<open>i' < j'\\<close> using jn' unfolding is_cdi_def by auto\n      qed\n    next\n      fix y zs\n      assume ys: \\<open>ys = y#zs\\<close>\n      show \\<open>?thesis\\<close> proof (cases \\<open>ys'\\<close>)\n        assume ys' : \\<open>ys' = Nil\\<close>\n        have cs: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs @ [x,y]@zs\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = xs @ [x']\\<close> by (metis append_Cons append_Nil csx ys, metis append_Nil2 csx' ys')\n        obtain n where n: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = xs@[x]\\<close> and jn: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> using cs cs_split' by blast\n        obtain n' where n': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n' = xs@[x]\\<close> and jn': \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> using cs cs_split' unfolding csi by blast\n        have csn : \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and bl: \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> n) = butlast (cs\\<^bsup>\\<pi>\\<^esup> j)\\<close> using n n' cs by auto\n        hence bl': \\<open>butlast (cs\\<^bsup>\\<pi>'\\<^esup> j') = butlast (cs\\<^bsup>\\<pi>'\\<^esup> n')\\<close> using csj by auto\n        have notcd: \\<open>\\<not> j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> by (metis butlast_cs_not_cd bl')\n        have nin: \\<open>n < i\\<close> using jn unfolding is_cdi_def by auto\n        have nlj: \\<open>n < j\\<close> using nin ilj by auto\n        note claim[OF path csn csj bl _ nlj]\n        hence nj': \\<open>n' < j'\\<close> using term_path_stable[OF path(1) _] less_imp_le nin nret by auto\n        show \\<open>i' < j'\\<close> apply(rule ccontr) using cdi_prefix[OF jn' nj'] notcd by auto\n      next\n        fix y' zs'\n        assume ys' : \\<open>ys' = y'#zs'\\<close>\n        have cs: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs@[x,y]@zs\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = xs@[x',y']@zs'\\<close> by (metis append_Cons append_Nil csx ys,metis append_Cons append_Nil csx' ys')\n        have neq: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>\\<^esup> j\\<close> using cs_inj path nret ilj by blast\n        obtain m where m: \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = xs@[x]\\<close> and im: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cs cs_split' by blast\n        obtain n where n: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = xs@[x']\\<close> and jn: \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> using cs cs_split' by blast\n        obtain m' where m': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> m' = xs@[x]\\<close> and im': \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m'\\<close> using cs cs_split' unfolding csi by blast\n        obtain n' where n': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n' = xs@[x']\\<close> and jn': \\<open>j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> using cs cs_split' unfolding csj by blast\n        have \\<open>m \\<le> n\\<close> using ilj m n wn_cs_butlast[OF _ jn im] by force\n        moreover\n        have \\<open>m \\<noteq> n\\<close> using m n xx by (metis last_snoc)\n        ultimately \n        have mn: \\<open>m < n\\<close> by auto\n        moreover \n        have \\<open>\\<pi> m \\<noteq> return\\<close> by (metis last_cs last_snoc m mn n path(1) term_path_stable xx less_imp_le)\n        moreover  \n        have \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> m) = butlast (cs\\<^bsup>\\<pi>\\<^esup> n)\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> using m n n' m' by auto\n        ultimately\n        have \\<open>m' < n'\\<close> using claim path by blast\n        thus \\<open>i' < j'\\<close> using m' n' im' jn' wn_cs_butlast by (metis butlast_snoc)        \n      qed\n    qed\n  next\n    case (prefix1 xs)\n    note pfx = \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> j @ xs\\<close>\n    note xs = \\<open>xs \\<noteq> []\\<close>\n    obtain a as where \\<open>xs = a#as\\<close> using xs by (metis list.exhaust)\n    moreover\n    obtain bs b where bj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = bs@[b]\\<close> using cs_not_nil by (metis rev_exhaust)\n    ultimately\n    have \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = bs@[b,a]@as\\<close> using pfx by auto\n    then obtain m where \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = bs@[b]\\<close> and cdep:  \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cs_split' by blast\n    hence mi: \\<open>m = j\\<close> using bj cs_inj by (metis is_cdi_def term_path_stable less_imp_le)\n    hence \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using cdep by auto\n    hence \\<open>False\\<close> using ilj unfolding is_cdi_def by auto\n    thus \\<open>i' < j'\\<close> ..\n  next\n    case (prefix2 xs)\n    have pfx : \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' @ xs = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using prefix2 csi csj by auto\n    note xs = \\<open>xs \\<noteq> []\\<close>\n     obtain a as where \\<open>xs = a#as\\<close> using xs by (metis list.exhaust)\n    moreover\n    obtain bs b where bj: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i'  = bs@[b]\\<close> using cs_not_nil by (metis rev_exhaust)\n    ultimately\n    have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> j' = bs@[b,a]@as\\<close> using pfx by auto\n    then obtain m where \\<open>cs\\<^bsup>\\<pi>'\\<^esup> m = bs@[b]\\<close> and cdep:  \\<open>j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m\\<close> using cs_split' by blast\n    hence mi: \\<open>m = i'\\<close> using bj cs_inj by (metis is_cdi_def term_path_stable less_imp_le)\n    hence \\<open>j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'\\<close> using cdep by auto\n    thus \\<open>i' < j'\\<close> unfolding is_cdi_def by auto  \n  qed\nqed\n\nlemma cs_order_le: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> \nand csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> and nret: \\<open>\\<pi> i \\<noteq> return\\<close> and ilj: \\<open>i \\<le> j\\<close>   \nshows \\<open>i'\\<le>j'\\<close> proof cases\n  assume \\<open>i < j\\<close> with cs_order[OF assms(1,2,3,4,5)] show \\<open>?thesis\\<close> by simp\nnext\n  assume \\<open>\\<not> i < j\\<close>\n  hence \\<open>i = j\\<close> using ilj by simp\n  hence csij: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using csi csj by simp  \n  have nret': \\<open>\\<pi>' i' \\<noteq> return\\<close> using nret last_cs csi by metis\n  show \\<open>?thesis\\<close> using cs_inj[OF path(2) nret' csij] by simp\nqed\n\nlemmas cs_induct[case_names cs] = cs.induct\n\nlemma icdi_path_swap: assumes \\<open>is_path \\<pi>'\\<close> \\<open>j icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> \\<open>\\<pi> =\\<^bsub>j\\<^esub>  \\<pi>'\\<close> shows \\<open>j icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow>k\\<close> using assms unfolding eq_up_to_def is_icdi_def is_cdi_def by auto\n\nlemma icdi_path_swap_le: assumes \\<open>is_path \\<pi>'\\<close> \\<open>j icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>'\\<close> \\<open>j \\<le> n\\<close> shows \\<open>j icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow>k\\<close> by (metis assms icdi_path_swap eq_up_to_le)\n\nlemma cs_path_swap: assumes \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>'\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k\\<close> using assms(1,3) proof (induction \\<open>\\<pi>\\<close> \\<open>k\\<close> rule:cs_induct,cases)\n  case (cs \\<pi> k)     \n  let \\<open>?l\\<close> = \\<open>(THE l. k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l)\\<close>\n  assume *: \\<open>\\<exists>l. k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close>\n  have kicd: \\<open>k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?l\\<close> by (metis \"*\" icd_is_the_icd)\n  hence \\<open>?l < k\\<close> unfolding is_cdi_def[of \\<open>k\\<close> \\<open>\\<pi>\\<close> \\<open>?l\\<close>] is_icdi_def[of \\<open>k\\<close> \\<open>\\<pi>\\<close> \\<open>?l\\<close>] by auto\n  hence \\<open>\\<forall> i\\<le>?l. \\<pi> i = \\<pi>' i\\<close> using cs(2,3) unfolding eq_up_to_def by auto\n  hence csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?l = cs\\<^bsup>\\<pi>'\\<^esup> ?l\\<close> using cs(1,2) * unfolding eq_up_to_def by auto \n  have kicd: \\<open>k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?l\\<close> by (metis \"*\" icd_is_the_icd)\n  hence csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>\\<^esup> ?l @ [\\<pi> k]\\<close> using kicd by auto\n  have kicd': \\<open>k icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> ?l\\<close> using kicd icdi_path_swap[OF assms(2) _ cs(3)] by simp\n  hence \\<open>?l = (THE l. k icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> l)\\<close> by (metis icd_is_the_icd)\n  hence csk': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> ?l @ [\\<pi>' k]\\<close> using kicd' by auto\n  have \\<open>\\<pi>' k = \\<pi> k\\<close> using cs(3) unfolding eq_up_to_def by auto\n  with csl csk csk'  \n  show \\<open>?case\\<close> by auto\nnext\n  case (cs \\<pi> k)\n  assume *: \\<open>\\<not> (\\<exists>l. k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l)\\<close>\n  hence csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = [\\<pi> k]\\<close> by auto\n  have \\<open>\\<not> (\\<exists>l. k icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> l)\\<close> apply (rule ccontr) using * icdi_path_swap_le[OF cs(2) _, of \\<open>k\\<close> \\<open>\\<pi>'\\<close>] cs(3) by (metis eq_up_to_sym le_refl)\n  hence csk': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k = [\\<pi>' k]\\<close> by auto\n  with csk show \\<open>?case\\<close> using cs(3) eq_up_to_apply by auto\nqed\n\nlemma cs_path_swap_le: assumes \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>'\\<close> \\<open>k \\<le> n\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k\\<close> by (metis assms cs_path_swap eq_up_to_le)\n\nlemma cs_path_swap_cd: assumes \\<open>is_path \\<pi>\\<close> and \\<open>is_path \\<pi>'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \nobtains k' where \\<open>n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close>\nproof -\n  from cd_in_cs[OF assms(4)]\n  obtain ns where *: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>\\<^esup> k @ ns @ [\\<pi> n]\\<close> by blast\n  obtain xs x where csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = xs @ [x]\\<close> by (metis cs_not_nil rev_exhaust)\n  have \\<open>\\<pi> n = \\<pi>' n'\\<close> using assms(3) last_cs by metis\n  hence **: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n' = xs@[x]@ns@[\\<pi>' n']\\<close> using * assms(3) csk by auto\n  from cs_split[OF **]\n  obtain k' where \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k' = xs @ [x]\\<close> \\<open>n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> by blast\n  thus \\<open>thesis\\<close> using that csk by auto\nqed\n\nlemma path_ipd_swap: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> k \\<noteq> return\\<close> \\<open>k < n\\<close> \nobtains \\<pi>' m where \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>'\\<close> \\<open>k < m\\<close> \\<open>\\<pi>' m = ipd (\\<pi>' k)\\<close> \\<open>\\<forall> l \\<in> {k..<m}. \\<pi>' l \\<noteq> ipd (\\<pi>' k)\\<close>\nproof -\n  obtain \\<pi>' r where *: \\<open>\\<pi>' 0 = \\<pi> n\\<close> \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi>' r = return\\<close> by (metis assms(1) path_nodes reaching_ret)\n  let \\<open>?\\<pi>\\<close> = \\<open>\\<pi>@\\<^bsup>n\\<^esup>  \\<pi>'\\<close>\n  have path: \\<open>is_path ?\\<pi>\\<close> and ret: \\<open>?\\<pi> (n + r) = return\\<close> and equpto:  \\<open>?\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>\\<close> using assms path_cons * path_append_eq_up_to by auto\n  have \\<pi>k: \\<open>?\\<pi> k = \\<pi> k\\<close> by (metis assms(3) less_imp_le_nat path_append_def)\n  obtain j where j: \\<open>k < j \\<and> j \\<le> (n + r) \\<and> ?\\<pi> j = ipd (\\<pi> k)\\<close> (is \\<open>?P j\\<close> )by (metis \\<pi>k assms(2) path path_ret_ipd ret)\n  define m where m: \\<open>m \\<equiv> LEAST m . ?P m\\<close>\n  have Pm: \\<open>?P m\\<close> using LeastI[of \\<open>?P\\<close> \\<open>j\\<close>] j m by auto\n  hence km: \\<open>k < m\\<close> \\<open>m \\<le> (n + r)\\<close> \\<open>?\\<pi> m = ipd (\\<pi> k)\\<close> by auto\n  have le: \\<open>\\<And>l. ?P l \\<Longrightarrow> m \\<le> l\\<close> using Least_le[of \\<open>?P\\<close>] m by blast\n  have \\<pi>knipd: \\<open>?\\<pi> k \\<noteq> ipd (\\<pi> k)\\<close> by (metis \\<pi>k assms(1) assms(2) ipd_not_self path_nodes)\n  have nipd': \\<open>\\<And>l. k < l \\<Longrightarrow> l < m \\<Longrightarrow> ?\\<pi> l \\<noteq> ipd (\\<pi> k)\\<close> apply (rule ccontr) using le km(2) by force\n  have \\<open>\\<forall> l \\<in> {k..<m}. ?\\<pi> l \\<noteq> ipd(\\<pi> k)\\<close> using \\<pi>knipd nipd' by(auto, metis le_eq_less_or_eq,metis le_eq_less_or_eq)\n  thus \\<open>thesis\\<close> using that by (metis \\<pi>k eq_up_to_sym km(1) km(3) path path_append_eq_up_to)\nqed\n\nlemma cs_sorted_list_of_cd': \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = map \\<pi> (sorted_list_of_set { i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}) @ [\\<pi> k]\\<close> \nproof (induction \\<open>\\<pi>\\<close> \\<open>k\\<close> rule: cs.induct, cases)\n  case (1 \\<pi> k)\n  assume \\<open>\\<exists> j. k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close>\n  then guess j ..\n  note j = this\n  hence csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = map \\<pi> (sorted_list_of_set {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}) @ [\\<pi> j]\\<close> by (metis \"1.IH\" icd_is_the_icd)\n  have \\<open>{i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = insert j {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}\\<close> using cdi_is_cd_icdi[OF j] by auto\n  moreover\n  have f: \\<open>finite {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}\\<close> unfolding is_cdi_def by auto\n  moreover\n  have \\<open>j \\<notin> {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}\\<close> unfolding is_cdi_def by auto\n  ultimately\n  have \\<open>sorted_list_of_set { i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = insort j (sorted_list_of_set { i . j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i})\\<close> using sorted_list_of_set_insert by auto\n  moreover\n  have \\<open>\\<forall> x \\<in>  {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}. x < j\\<close> unfolding is_cdi_def by auto\n  hence \\<open>\\<forall> x \\<in> set (sorted_list_of_set {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}). x < j\\<close> by (simp add: f) \n  ultimately\n  have \\<open>sorted_list_of_set { i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = (sorted_list_of_set { i . j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i})@[j]\\<close>  using insort_greater by auto\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = map \\<pi> (sorted_list_of_set { i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i})\\<close> using csj by auto\n  thus \\<open>?case\\<close> by (metis icd_cs j)\nnext\n  case (1 \\<pi> k)\n  assume *: \\<open>\\<not> (\\<exists> j. k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j)\\<close>\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = [\\<pi> k]\\<close> by (metis cs_cases)\n  moreover \n  have \\<open>{ i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = {}\\<close> by (auto, metis * excd_impl_exicd)\n  ultimately \n  show \\<open>?case\\<close> by (metis append_Nil list.simps(8) sorted_list_of_set_empty)\nqed\n\nlemma cs_sorted_list_of_cd: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = map \\<pi> (sorted_list_of_set ({ i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k}))\\<close> proof -\n  have le: \\<open>\\<forall> x \\<in> {i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>i}.\\<forall> y \\<in> {k}. x < y\\<close> unfolding is_cdi_def by auto\n  have fin: \\<open>finite {i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>i}\\<close> \\<open>finite {k}\\<close> unfolding is_cdi_def by auto  \n  show \\<open>?thesis\\<close> unfolding cs_sorted_list_of_cd'[of \\<open>\\<pi>\\<close> \\<open>k\\<close>] sorted_list_of_set_append[OF fin le] by auto\nqed\n\nlemma cs_not_ipd: assumes \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k)\\<close> (is \\<open>?Q j\\<close>)\nshows \\<open>cs\\<^bsup>\\<pi>\\<^esup> (GREATEST j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k)) = [n\\<leftarrow>cs\\<^bsup>\\<pi>\\<^esup> k . ipd n \\<noteq> ipd (\\<pi> k)]\\<close>\n(is \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?j = filter ?P _\\<close>) \nproof -  \n  have csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = map \\<pi> (sorted_list_of_set ({ i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i } \\<union> {k}))\\<close> by (metis cs_sorted_list_of_cd)\n  have csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?j = map \\<pi> (sorted_list_of_set ({i. ?j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i } \\<union> {?j}))\\<close> by (metis cs_sorted_list_of_cd)\n  \n  have bound: \\<open>\\<forall> j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> ipd(\\<pi> k) \\<longrightarrow> j \\<le> k\\<close> unfolding is_cdi_def by simp\n    \n  have kcdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?j\\<close> and ipd': \\<open>ipd (\\<pi> ?j) \\<noteq> ipd(\\<pi> k)\\<close> using GreatestI_nat[of \\<open>?Q\\<close> \\<open>j\\<close> \\<open>k\\<close>, OF assms] bound by auto\n   \n  have greatest: \\<open>\\<And> j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<Longrightarrow> ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k) \\<Longrightarrow> j \\<le> ?j\\<close> using Greatest_le_nat[of \\<open>?Q\\<close>  _ \\<open>k\\<close>] bound by auto\n  have less_not_ipdk: \\<open>\\<And> j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<Longrightarrow> j < ?j \\<Longrightarrow> ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k)\\<close>   by (metis (lifting) ipd' kcdj same_ipd_stable)\n  hence le_not_ipdk: \\<open>\\<And> j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<Longrightarrow> j \\<le> ?j \\<Longrightarrow> ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k)\\<close> using kcdj ipd' by (case_tac \\<open>j = ?j\\<close>,auto)\n  have *: \\<open>{j \\<in> {i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>i} \\<union> {k}. ?P (\\<pi> j)} = insert ?j { i . ?j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<close> \n    apply auto  \n    apply (metis (lifting, no_types) greatest cr_wn'' kcdj le_antisym le_refl)\n    apply (metis kcdj)\n    apply (metis ipd')\n    apply (metis (full_types) cd_trans kcdj)\n    apply (subgoal_tac \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> x\\<close>)\n    apply (metis (lifting, no_types) is_cdi_def less_not_ipdk)\n    by (metis (full_types) cd_trans kcdj)\n  have \\<open>finite ({i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k})\\<close> unfolding is_cdi_def by auto\n  note filter_sorted_list_of_set[OF this, of \\<open>?P o \\<pi>\\<close>]\n  hence \\<open>[n\\<leftarrow>cs\\<^bsup>\\<pi>\\<^esup> k . ipd n \\<noteq> ipd(\\<pi> k)] = map \\<pi> (sorted_list_of_set {j \\<in> {i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>i} \\<union> {k}. ?P (\\<pi> j)})\\<close> unfolding csk filter_map by auto \n  also \n  have \\<open>\\<dots> =  map \\<pi> (sorted_list_of_set (insert ?j { i . ?j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}))\\<close> unfolding * by auto\n  also \n  have \\<open>\\<dots> = cs\\<^bsup>\\<pi>\\<^esup> ?j\\<close> using csj by auto\n  finally \n  show \\<open>?thesis\\<close> by metis\nqed\n\nlemma cs_ipd: assumes ipd: \\<open>\\<pi> m = ipd (\\<pi> k)\\<close> \\<open>\\<forall> n \\<in> {k..<m}. \\<pi> n \\<noteq> ipd (\\<pi> k)\\<close>\nand km: \\<open>k < m\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = [n\\<leftarrow>cs\\<^bsup>\\<pi>\\<^esup> k . ipd n \\<noteq> \\<pi> m] @ [\\<pi> m]\\<close>\nproof cases\n  assume \\<open>\\<exists> j. m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close>  \n  then obtain j where jicd: \\<open>m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> by blast\n  hence *: \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>\\<^esup> j @ [\\<pi> m]\\<close> by (metis icd_cs)\n  have j: \\<open>j = (GREATEST j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> \\<pi> m)\\<close> using jicd assms ipd_icd_greatest_cd_not_ipd by blast\n  moreover\n  have \\<open>ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k)\\<close> by (metis is_cdi_def is_icdi_def is_ipd_def cd_not_pd ipd(1) ipd_is_ipd jicd path_nodes less_imp_le term_path_stable)\n  moreover\n  have \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> unfolding j by (metis (lifting, no_types) assms(3) cd_ipd_is_cd icd_imp_cd ipd(1) ipd(2) j jicd)\n  ultimately\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = [n\\<leftarrow>cs\\<^bsup>\\<pi>\\<^esup> k . ipd n \\<noteq> \\<pi> m]\\<close> using cs_not_ipd[of \\<open>k\\<close> \\<open>\\<pi>\\<close> \\<open>j\\<close>] ipd(1) by metis\n  thus \\<open>?thesis\\<close> using * by metis\nnext\n  assume noicd: \\<open>\\<not> (\\<exists> j. m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j)\\<close>  \n  hence csm: \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = [\\<pi> m]\\<close> by auto\n  have \\<open>\\<And>j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>j \\<Longrightarrow> ipd(\\<pi> j) = \\<pi> m\\<close> using cd_is_cd_ipd[OF km ipd] by (metis excd_impl_exicd noicd)\n  hence *: \\<open>{j \\<in> {i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k}. ipd (\\<pi> j) \\<noteq> \\<pi> m} = {}\\<close> using ipd(1) by auto\n  have **: \\<open>((\\<lambda>n. ipd n \\<noteq> \\<pi> m) o \\<pi>) = (\\<lambda>n. ipd (\\<pi> n) \\<noteq> \\<pi> m)\\<close> by auto\n  have fin: \\<open>finite ({i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k})\\<close> unfolding is_cdi_def by auto\n  note csk = cs_sorted_list_of_cd[of \\<open>\\<pi>\\<close> \\<open>k\\<close>]\n  hence \\<open>[n\\<leftarrow>cs\\<^bsup>\\<pi>\\<^esup> k . ipd n \\<noteq> \\<pi> m] = [n\\<leftarrow> (map \\<pi> (sorted_list_of_set ({i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k}))) . ipd n \\<noteq> \\<pi> m]\\<close> by simp\n  also\n  have \\<open>\\<dots> = map \\<pi> [n <- sorted_list_of_set ({i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k}). ipd (\\<pi> n) \\<noteq> \\<pi> m]\\<close>  by (auto simp add: filter_map **) \n  also \n  have \\<open>\\<dots> = []\\<close> unfolding * filter_sorted_list_of_set[OF fin, of \\<open>\\<lambda>n. ipd (\\<pi> n) \\<noteq> \\<pi> m\\<close>] by auto\n  finally\n  show \\<open>?thesis\\<close> using csm by (metis append_Nil)\nqed\n\nlemma converged_ipd_same_icd: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and  converge: \\<open>l < m\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \nand csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and icd: \\<open>l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and suc: \\<open>\\<pi> (Suc k) = \\<pi>' (Suc k')\\<close>\nand ipd: \\<open>\\<pi>' m' = ipd (\\<pi> k)\\<close> \\<open>\\<forall> n \\<in> {k'..<m'}. \\<pi>' n \\<noteq> ipd (\\<pi> k)\\<close>\nshows \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\nproof cases\n  assume l: \\<open>l = Suc k\\<close>\n  hence \\<open>Suc k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using icd by (metis is_icdi_def)\n  hence \\<open>\\<pi> (Suc k) \\<noteq> ipd (\\<pi> k)\\<close> unfolding is_cdi_def by auto\n  hence \\<open>\\<pi>' (Suc k') \\<noteq> ipd (\\<pi>' k')\\<close> by (metis csk last_cs suc)\n  moreover \n  have \\<open>\\<pi>' (Suc k') \\<noteq> return\\<close> by (metis \\<open>Suc k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> ret_no_cd suc)\n  ultimately\n  have \\<open>Suc k' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> unfolding is_cdi_def using path(2) apply auto \n  by (metis ipd_not_self le_Suc_eq le_antisym path_nodes term_path_stable)\n  hence \\<open>Suc k' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> unfolding is_icdi_def using path(2) by fastforce  \n  hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (Suc k') = cs\\<^bsup>\\<pi>'\\<^esup> k' @[\\<pi>' (Suc k')]\\<close> using icd_cs by auto \n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>\\<^esup> k @ [\\<pi> l]\\<close> using icd icd_cs by auto\n  ultimately \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> (Suc k')\\<close> by (metis csk l suc)\n  thus \\<open>?thesis\\<close> by blast\nnext\n  assume nsuck: \\<open>l \\<noteq> Suc k\\<close>\n  have kk'[simp]: \\<open>\\<pi>' k' = \\<pi> k\\<close> by (metis csk last_cs)\n  have kl: \\<open>k < l\\<close> using icd unfolding is_icdi_def is_cdi_def by auto\n  hence skl: \\<open>Suc k < l\\<close> by (metis Suc_lessI nsuck)\n  hence lpd: \\<open>\\<pi> l pd\\<rightarrow> \\<pi> (Suc k)\\<close> using icd icd_pd_intermediate by auto\n  have km: \\<open>k < m\\<close> by (metis converge(1) kl order.strict_trans)  \n  have lcd: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using icd is_icdi_def by auto\n  hence ipdk_pdl: \\<open>ipd (\\<pi> k) pd\\<rightarrow> (\\<pi> l)\\<close> by (metis ipd_pd_cd)\n  have *: \\<open>ipd (\\<pi> k) \\<in> nodes\\<close> by (metis ipdk_pdl pd_node1)\n  have nretk: \\<open>\\<pi> k \\<noteq> return\\<close> by (metis kl lcd path(1) ret_no_cd term_path_stable less_imp_le)\n  have **: \\<open>\\<not> (\\<pi> l) pd\\<rightarrow> ipd (\\<pi> k)\\<close> proof \n    assume a: \\<open>\\<pi> l pd\\<rightarrow> ipd (\\<pi> k)\\<close>\n    hence \\<open>\\<pi> l pd\\<rightarrow> (\\<pi> k)\\<close> by (metis is_ipd_def \\<open>k < l\\<close> ipd_is_ipd ipdk_pdl path(1) path_nodes pd_antisym term_path_stable less_imp_le)\n    moreover \n    have \\<open>\\<pi> l \\<noteq> (\\<pi> k)\\<close> by (metis \"*\" a ipd_not_self ipdk_pdl lcd pd_antisym ret_no_cd)\n    ultimately\n    show \\<open>False\\<close> using lcd cd_not_pd by auto\n  qed\n\n  have km': \\<open>k' < m'\\<close> using cs_order[OF path csk converge(2) nretk km] . \n\n  obtain \\<pi>'' n'' where path'': \\<open>is_path \\<pi>''\\<close>  and \\<pi>''0: \\<open>\\<pi>'' 0 = ipd (\\<pi> k)\\<close> and \\<pi>''n: \\<open>\\<pi>'' n'' = return\\<close> and not\\<pi>l: \\<open>\\<forall> i\\<le>n''. \\<pi>'' i \\<noteq> \\<pi> l\\<close> using no_pd_path[OF * **] .\n  let \\<open>?\\<pi>'\\<close> = \\<open>(\\<pi>' @\\<^bsup>m'\\<^esup> \\<pi>'') \\<guillemotleft> Suc k'\\<close>\n  have \\<open>is_path ?\\<pi>'\\<close> by (metis \\<pi>''0 ipd(1) path'' path(2) path_cons path_path_shift)\n  moreover \n  have \\<open>?\\<pi>' 0 = \\<pi> (Suc k)\\<close> using km' suc by auto\n  moreover\n  have \\<open>?\\<pi>' (m' - Suc k' + n'') = return\\<close> using \\<pi>''n km' \\<pi>''0 ipd(1) by auto  \n  ultimately\n  obtain l'' where l'': \\<open>l'' \\<le> m' - Suc k' + n''\\<close> \\<open>?\\<pi>' l'' = \\<pi> l\\<close> using lpd unfolding is_pd_def by blast\n  have l''m: \\<open>l'' \\<le> m' - Suc k'\\<close> apply (rule ccontr) using l'' not\\<pi>l km' by (cases \\<open>Suc (k' + l'') \\<le> m'\\<close>, auto)\n  let \\<open>?l'\\<close> = \\<open>Suc ( k' + l'')\\<close>\n  have lm': \\<open>?l' \\<le> m'\\<close> using l''m km' by auto\n  \n  \\<comment> \\<open>Now we have found our desired l'\\<close>\n  have 1: \\<open>\\<pi>' ?l' = \\<pi> l\\<close> using  l'' l''m lm' by auto\n  have 2: \\<open>k' < ?l'\\<close> by simp  \n  have 3: \\<open>?l' < m'\\<close> apply (rule ccontr) using lm' by (simp, metis \"**\" 1 ipd(1) ipdk_pdl)  \n  \n  \\<comment> \\<open>Need the least such l'\\<close>\n\n  let \\<open>?P\\<close> = \\<open>\\<lambda> l'. \\<pi>' l' = \\<pi> l \\<and> k' < l' \\<and> l' < m'\\<close>\n\n  have *: \\<open>?P ?l'\\<close> using 1 2 3 by blast\n\n  define l' where l': \\<open>l' == LEAST l'. ?P l'\\<close>\n  \n  have \\<pi>l': \\<open>\\<pi>' l' = \\<pi> l\\<close> using l' 1 2 3 LeastI[of \\<open>?P\\<close>] by blast  \n  have kl': \\<open>k' < l'\\<close> using l' 1 2 3 LeastI[of \\<open>?P\\<close>] by blast\n  have lm': \\<open>l' < m'\\<close> using l' 1 2 3 LeastI[of \\<open>?P\\<close>] by blast  \n\n  have nretl': \\<open>\\<pi>' l' \\<noteq> return\\<close> by (metis \\<pi>''n \\<pi>l' le_refl not\\<pi>l)\n \n  have nipd': \\<open>\\<forall> j \\<in> {k'..l'}. \\<pi>' j \\<noteq> ipd (\\<pi>' k')\\<close> using lm' kk' ipd(2) kl' by force\n \n  have lcd': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> by (metis is_cdi_def kl' nipd' nretl' path(2))\n\n  have licd: \\<open>l' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> proof -\n    have \\<open>\\<forall> m \\<in> {k'<..<l'}. \\<not> l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m\\<close> proof (rule ccontr)\n      assume \\<open>\\<not> (\\<forall> m \\<in> {k'<..<l'}. \\<not> l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m)\\<close>\n      then obtain j' where kj': \\<open>k' < j'\\<close> and jl': \\<open>j' < l'\\<close> and lcdj': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> by force\n      have jm': \\<open>j'<m'\\<close> by (metis jl' lm' order.strict_trans)\n      have \\<open>\\<pi>' j' \\<noteq> \\<pi> l\\<close> apply (rule ccontr) using l' kj' jm' jl' Least_le[of \\<open>?P\\<close> \\<open>j'\\<close>] by auto       \n      hence \\<open>\\<not> \\<pi>' l' pd\\<rightarrow> \\<pi>' j'\\<close> using cd_not_pd lcdj' \\<pi>l' by metis\n      moreover have \\<open>\\<pi>' j' \\<in> nodes\\<close> using path(2) path_nodes by auto\n      ultimately\n      obtain \\<pi>\\<^sub>1 n\\<^sub>1 where path\\<^sub>1: \\<open>is_path \\<pi>\\<^sub>1\\<close> and \\<pi>0\\<^sub>1: \\<open>\\<pi>\\<^sub>1 0 = \\<pi>' j'\\<close> and \\<pi>n\\<^sub>1: \\<open>\\<pi>\\<^sub>1 n\\<^sub>1 = return\\<close> and nl': \\<open>\\<forall> l \\<le>n\\<^sub>1. \\<pi>\\<^sub>1 l \\<noteq> \\<pi>' l'\\<close> unfolding is_pd_def by blast\n      let \\<open>?\\<pi>''\\<close> = \\<open>(\\<pi>'@\\<^bsup>j'\\<^esup> \\<pi>\\<^sub>1) \\<guillemotleft> Suc k'\\<close>\n      have \\<open>is_path ?\\<pi>''\\<close> by (metis \\<pi>0\\<^sub>1 path(2) path\\<^sub>1 path_cons path_path_shift)\n      moreover\n      have \\<open>?\\<pi>'' 0 = \\<pi> (Suc k)\\<close> by (simp, metis kj' less_eq_Suc_le suc)\n      moreover\n      have kj': \\<open>Suc k' \\<le> j'\\<close> by (metis kj' less_eq_Suc_le)\n      hence \\<open>?\\<pi>'' (j' - Suc k' + n\\<^sub>1) = return\\<close> by (simp, metis \\<pi>0\\<^sub>1 \\<pi>n\\<^sub>1)\n      ultimately\n      obtain l'' where *: \\<open>?\\<pi>'' l'' = \\<pi> l\\<close> and **: \\<open>l'' \\<le>j' - Suc k' + n\\<^sub>1\\<close> using lpd is_pd_def by blast      \n      show \\<open>False\\<close> proof (cases)\n        assume a: \\<open>l'' \\<le> j' - Suc k'\\<close>        \n        hence \\<open>\\<pi>' (l'' + Suc k') = \\<pi> l\\<close> using * kj' by(simp, metis Nat.le_diff_conv2 add_Suc diff_add_inverse le_add1 le_add_diff_inverse2)\n        moreover \n        have \\<open>l'' + Suc k' < l'\\<close> by (metis a jl' add_diff_cancel_right' kj' le_add_diff_inverse less_imp_diff_less ordered_cancel_comm_monoid_diff_class.le_diff_conv2)\n        moreover\n        have \\<open>l'' + Suc k' < m'\\<close> by (metis Suc_lessD calculation(2) less_trans_Suc lm')\n        moreover \n        have \\<open>k' < l'' + Suc k'\\<close> by simp\n        ultimately\n        show \\<open>False\\<close> using Least_le[of \\<open>?P\\<close> \\<open>l'' + Suc k'\\<close>] l' by auto\n      next\n        assume a: \\<open>\\<not> l'' \\<le> j' - Suc k'\\<close>\n        hence \\<open>\\<not> Suc (k' + l'') \\<le> j'\\<close> by simp\n        hence \\<open>\\<pi>\\<^sub>1 (Suc (k' + l'') - j') = \\<pi> l\\<close> using * kj' by simp \n        moreover \n        have \\<open>Suc (k' + l'') - j' \\<le> n\\<^sub>1\\<close> using ** kj' by simp\n        ultimately\n        show \\<open>False\\<close> using nl' by (metis \\<pi>l')\n      qed\n    qed\n    thus \\<open>?thesis\\<close> unfolding is_icdi_def using lcd' path(2) by simp\n  qed\n  hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>'\\<^esup> k' @ [\\<pi>' l']\\<close> by (metis icd_cs)\n  hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> l\\<close> by (metis \\<pi>l' csk icd icd_cs)\n  thus \\<open>?thesis\\<close> by metis\nqed\n\nlemma converged_same_icd: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and converge: \\<open>l < n\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> \nand csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and icd: \\<open>l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and suc: \\<open>\\<pi> (Suc k) = \\<pi>' (Suc k')\\<close>\nshows \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> proof -\n  \n  have nret: \\<open>\\<pi> k \\<noteq> return\\<close> using icd unfolding is_icdi_def is_cdi_def using term_path_stable less_imp_le by metis \n  have kl: \\<open>k < l\\<close> using icd unfolding is_icdi_def is_cdi_def by auto\n  have kn: \\<open>k < n\\<close> using converge kl by simp\n  from path_ipd_swap[OF path(1) nret kn]\n  obtain \\<rho> m where path\\<rho>: \\<open>is_path \\<rho>\\<close> and \\<pi>\\<rho>: \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<rho>\\<close> and km: \\<open>k < m\\<close> and ipd: \\<open>\\<rho> m = ipd (\\<rho> k)\\<close> \\<open>\\<forall> l \\<in> {k..<m}. \\<rho> l \\<noteq> ipd (\\<rho> k)\\<close> .\n  have csk1: \\<open>cs\\<^bsup>\\<rho>\\<^esup> k = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using cs_path_swap_le path path\\<rho> \\<pi>\\<rho> kn by auto\n  have suc\\<rho>: \\<open>\\<rho> (Suc k) = \\<pi> (Suc k)\\<close> by (metis \\<pi>\\<rho> eq_up_to_def kn less_eq_Suc_le)\n\n  have nret': \\<open>\\<pi>' k' \\<noteq> return\\<close> by (metis csk last_cs nret)\n  have kn': \\<open>k' < n'\\<close> using cs_order[OF path csk converge(2) nret kn] .\n  from path_ipd_swap[OF path(2) nret' kn']\n  obtain \\<rho>' m' where path\\<rho>': \\<open>is_path \\<rho>'\\<close> and \\<pi>\\<rho>': \\<open>\\<pi>' =\\<^bsub>n'\\<^esub> \\<rho>'\\<close> and km': \\<open>k' < m'\\<close> and ipd': \\<open>\\<rho>' m' = ipd (\\<rho>' k')\\<close> \\<open>\\<forall> l \\<in> {k'..<m'}. \\<rho>' l \\<noteq> ipd (\\<rho>' k')\\<close> .\n  have csk1': \\<open>cs\\<^bsup>\\<rho>'\\<^esup> k' = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> using cs_path_swap_le path path\\<rho>' \\<pi>\\<rho>' kn' by auto\n  have suc\\<rho>': \\<open>\\<rho>' (Suc k') = \\<pi>' (Suc k')\\<close> by (metis \\<pi>\\<rho>' eq_up_to_def kn' less_eq_Suc_le)\n  \n  have icd\\<rho>: \\<open>l icd\\<^bsup>\\<rho>\\<^esup>\\<rightarrow> k\\<close> using icdi_path_swap_le[OF path\\<rho> icd \\<pi>\\<rho>] converge by simp\n\n  have lm: \\<open>l < m\\<close> using ipd(1) icd\\<rho> km unfolding is_icdi_def is_cdi_def by auto\n\n  have csk': \\<open>cs\\<^bsup>\\<rho>\\<^esup> k = cs\\<^bsup>\\<rho>'\\<^esup> k'\\<close> using csk1 csk1' csk by auto\n\n  hence kk': \\<open>\\<rho>' k' = \\<rho> k\\<close> using last_cs by metis\n\n  have suc': \\<open>\\<rho> (Suc k) = \\<rho>' (Suc k')\\<close> using suc suc\\<rho> suc\\<rho>' by auto\n\n  have mm': \\<open>\\<rho>' m' = \\<rho> m\\<close> using ipd(1) ipd'(1) kk' by auto\n\n  from cs_ipd[OF ipd km] cs_ipd[OF ipd' km',unfolded mm', folded csk']  \n  have csm: \\<open>cs\\<^bsup>\\<rho>\\<^esup> m = cs\\<^bsup>\\<rho>'\\<^esup> m'\\<close> by metis\n\n  from converged_ipd_same_icd[OF path\\<rho> path\\<rho>' lm  csm csk' icd\\<rho> suc' ipd'[unfolded kk']]\n  obtain l' where csl: \\<open>cs\\<^bsup>\\<rho>\\<^esup> l = cs\\<^bsup>\\<rho>'\\<^esup> l'\\<close> by blast\n  \n  have csl\\<rho>: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<rho>\\<^esup> l\\<close> using \\<pi>\\<rho> converge(1) cs_path_swap_le less_imp_le_nat path(1) path\\<rho> by blast \n\n  have nretl: \\<open>\\<rho> l \\<noteq> return\\<close> by (metis icd\\<rho> icd_imp_cd ret_no_cd)\n\n  have csn': \\<open>cs\\<^bsup>\\<rho>\\<^esup> n = cs\\<^bsup>\\<rho>'\\<^esup> n'\\<close> using converge(2) cs_path_swap path path\\<rho> path\\<rho>' \\<pi>\\<rho> \\<pi>\\<rho>' by auto\n  \n  have ln': \\<open>l' < n'\\<close> using cs_order[OF path\\<rho> path\\<rho>' csl csn' nretl converge(1)] .\n    \n  have csl\\<rho>': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<rho>'\\<^esup> l'\\<close> using cs_path_swap_le[OF path(2) path\\<rho>' \\<pi>\\<rho>'] ln' by auto\n\n  have csl': \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> using csl\\<rho> csl\\<rho>' csl by auto\n  thus \\<open>?thesis\\<close> by blast\nqed\n\nlemma cd_is_cs_less: assumes \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> k \\<prec> cs\\<^bsup>\\<pi>\\<^esup> l\\<close> proof -\n  obtain xs where csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>\\<^esup> k @ xs @[\\<pi> l]\\<close> using cd_in_cs[OF assms] by blast\n  hence len: \\<open>length(cs\\<^bsup>\\<pi>\\<^esup> k) < length (cs\\<^bsup>\\<pi>\\<^esup> l)\\<close> by auto\n  have take: \\<open>take (length (cs\\<^bsup>\\<pi>\\<^esup> k)) (cs\\<^bsup>\\<pi>\\<^esup> l) = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using csl by auto\n  show \\<open>?thesis\\<close> using cs_less.intros[OF len take] . \nqed\n\nlemma cs_select_id: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> k \\<noteq> return\\<close> shows \\<open>\\<pi>\\<exclamdown>cs\\<^bsup>\\<pi>\\<^esup> k = k\\<close> (is \\<open>?k = k\\<close>) proof -\n  have *: \\<open>\\<And> i . cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> k  \\<Longrightarrow> i = k\\<close> using cs_inj[OF assms] by metis  \n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?k = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> unfolding cs_select_def using theI[of \\<open>\\<lambda> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> \\<open>k\\<close>] by auto\n  thus \\<open>?k = k\\<close> using * by auto\nqed\n\nlemma cs_single_nocd: assumes \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = [x]\\<close> shows \\<open>\\<forall> k. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> proof -\n  have \\<open>\\<not> (\\<exists> k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> apply (rule ccontr) using assms cs_not_nil by auto\n  hence \\<open>\\<not> (\\<exists> k. i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> by (metis excd_impl_exicd)\n  thus \\<open>?thesis\\<close> by blast\nqed\n\nlemma cs_single_pd_intermed: assumes \\<open>is_path \\<pi>\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = [\\<pi> n]\\<close> \\<open>k \\<le> n\\<close> shows \\<open>\\<pi> n pd\\<rightarrow> \\<pi> k\\<close> proof -\n  have \\<open>\\<forall> l. \\<not> n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> by (metis assms(2) cs_single_nocd icd_imp_cd)\n  thus \\<open>?thesis\\<close> by (metis assms(1) assms(3) no_icd_pd)\nqed\n\n\nlemma cs_first_pd:  assumes path: \\<open>is_path \\<pi>\\<close> and pd: \\<open>\\<pi> n pd\\<rightarrow> \\<pi> 0\\<close> and first: \\<open>\\<forall> l < n. \\<pi> l \\<noteq> \\<pi> n\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = [\\<pi> n]\\<close> \nby (metis cs_cases first first_pd_no_cd icd_imp_cd path pd)\n\nlemma converged_pd_cs_single: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and  converge: \\<open>l < m\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \nand \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> and mpdl: \\<open>\\<pi> m pd\\<rightarrow> \\<pi> l\\<close> and csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = [\\<pi> l]\\<close>\nshows \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> proof -\n  have *: \\<open>\\<pi> l pd\\<rightarrow> \\<pi>' 0\\<close> using cs_single_pd_intermed[OF path(1) csl] \\<pi>0[symmetric] by auto\n  have \\<pi>m: \\<open>\\<pi> m = \\<pi>' m'\\<close> by (metis converge(2) last_cs)\n  hence **: \\<open>\\<pi>' m' pd\\<rightarrow> \\<pi> l\\<close> using mpdl by metis\n  \n  obtain l' where lm': \\<open>l' \\<le> m'\\<close> and \\<pi>l:  \\<open>\\<pi>' l' = \\<pi> l\\<close> (is \\<open>?P l'\\<close>) using path_pd_pd0[OF path(2) ** *] .\n  \n  let \\<open>?l\\<close> = \\<open>(LEAST l'. \\<pi>' l' = \\<pi> l)\\<close>\n  \n  have \\<pi>l': \\<open>\\<pi>' ?l = \\<pi> l\\<close> using LeastI[of \\<open>?P\\<close>,OF \\<pi>l] .\n  moreover\n  have \\<open>\\<forall> i <?l. \\<pi>' i \\<noteq> \\<pi> l\\<close> using Least_le[of \\<open>?P\\<close>] by (metis not_less)\n  hence \\<open>\\<forall> i <?l. \\<pi>' i \\<noteq> \\<pi>' ?l\\<close> using \\<pi>l' by metis\n  moreover\n  have \\<open>\\<pi>' ?l pd\\<rightarrow> \\<pi>' 0\\<close> using * \\<pi>l' by metis\n  ultimately\n  have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> ?l = [\\<pi>' ?l]\\<close> using cs_first_pd[OF path(2)] by metis\n  thus \\<open>?thesis\\<close> using csl \\<pi>l' by metis\nqed\n\nlemma converged_cs_single: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and  converge: \\<open>l < m\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \nand \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> and csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = [\\<pi> l]\\<close>\nshows \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> proof cases\n  assume *: \\<open>\\<pi> l = return\\<close>  \n  hence \\<open>\\<pi> m = return\\<close> by (metis converge(1) path(1) term_path_stable less_imp_le)\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = [return]\\<close> using cs_return by auto\n  hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> m' = [return]\\<close> using converge by simp\n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = [return]\\<close> using * cs_return by auto\n  ultimately show \\<open>?thesis\\<close> by metis\nnext\n  assume nret: \\<open>\\<pi> l \\<noteq> return\\<close>\n  have \\<pi>m: \\<open>\\<pi> m = \\<pi>' m'\\<close> by (metis converge(2) last_cs)\n  \n  obtain \\<pi>\\<^sub>1 n where path1: \\<open>is_path \\<pi>\\<^sub>1\\<close> and upto: \\<open>\\<pi> =\\<^bsub>m\\<^esub> \\<pi>\\<^sub>1\\<close> and \\<pi>n: \\<open>\\<pi>\\<^sub>1 n = return\\<close> using path(1) path_swap_ret by blast\n\n  obtain \\<pi>\\<^sub>1' n' where path1': \\<open>is_path \\<pi>\\<^sub>1'\\<close> and upto': \\<open>\\<pi>' =\\<^bsub>m'\\<^esub>  \\<pi>\\<^sub>1'\\<close> and \\<pi>n': \\<open>\\<pi>\\<^sub>1' n' = return\\<close> using path(2) path_swap_ret by blast\n\n  have \\<pi>1l: \\<open>\\<pi>\\<^sub>1 l = \\<pi> l\\<close> using upto converge(1) by (metis eq_up_to_def nat_less_le)\n\n  have cs1l: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> l = cs\\<^bsup>\\<pi>\\<^esup> l\\<close> using cs_path_swap_le upto path1 path(1) converge(1) by auto\n\n  have csl1: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> l = [\\<pi>\\<^sub>1 l]\\<close> by (metis \\<pi>1l cs1l csl)\n  \n  have converge1: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> n = cs\\<^bsup>\\<pi>\\<^sub>1'\\<^esup> n'\\<close> using \\<pi>n \\<pi>n' cs_return by auto\n  \n  have ln: \\<open>l < n\\<close> using nret \\<pi>n \\<pi>1l term_path_stable[OF path1 \\<pi>n] by (auto, metis linorder_neqE_nat less_imp_le)\n\n  have \\<pi>01: \\<open>\\<pi>\\<^sub>1 0 = \\<pi>\\<^sub>1' 0\\<close> using \\<pi>0 eq_up_to_apply[OF upto] eq_up_to_apply[OF upto'] by auto\n\n  have pd: \\<open>\\<pi>\\<^sub>1 n pd\\<rightarrow> \\<pi>\\<^sub>1 l\\<close> using \\<pi>n by (metis path1 path_nodes return_pd)\n  \n  obtain l' where csl: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> l = cs\\<^bsup>\\<pi>\\<^sub>1'\\<^esup> l'\\<close> using converged_pd_cs_single[OF path1 path1' ln converge1 \\<pi>01 pd csl1] by blast\n\n  have cs1m: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> m = cs\\<^bsup>\\<pi>\\<^esup> m\\<close> using cs_path_swap upto path1 path(1) by auto\n  have cs1m': \\<open>cs\\<^bsup>\\<pi>\\<^sub>1'\\<^esup> m' = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> using cs_path_swap upto' path1' path(2) by auto\n  hence converge1: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> m = cs\\<^bsup>\\<pi>\\<^sub>1'\\<^esup> m'\\<close> using converge(2) cs1m by metis\n  \n  have nret1: \\<open>\\<pi>\\<^sub>1 l \\<noteq> return\\<close> using nret \\<pi>1l by auto\n  \n  have lm': \\<open>l' < m'\\<close> using cs_order[OF path1 path1' csl converge1 nret1 converge(1)] .\n  \n  have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^sub>1'\\<^esup> l'\\<close> using cs_path_swap_le[OF path(2) path1' upto'] lm' by auto\n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> l\\<close> using cs_path_swap_le[OF path(1) path1 upto] converge(1) by auto\n  ultimately\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> using csl by auto\n  thus \\<open>?thesis\\<close> by blast\nqed\n\nlemma converged_cd_same_suc: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and init: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> \nand cd_suc: \\<open>\\<forall> k k'. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k' \\<and> l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<longrightarrow> \\<pi> (Suc k) = \\<pi>' (Suc k')\\<close> and converge: \\<open>l < m\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \nshows  \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\nusing path init cd_suc converge proof (induction \\<open>\\<pi>\\<close> \\<open>l\\<close> rule: cs_induct,cases)\n  case (cs \\<pi> l)\n  assume *: \\<open>\\<exists>k. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  let \\<open>?k\\<close> = \\<open>THE k. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  have icd: \\<open>l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?k\\<close> by (metis \"*\" icd_is_the_icd)\n  hence lcdk: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?k\\<close> by (metis is_icdi_def)\n  hence kl: \\<open>?k<l\\<close> using is_cdi_def by metis\n  \n  have \\<open>\\<And> j. ?k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<Longrightarrow> l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using icd cd_trans is_icdi_def by fast\n  hence suc': \\<open>\\<forall> j j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j' \\<and> ?k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<longrightarrow> \\<pi> (Suc j) = \\<pi>' (Suc j')\\<close> using cs.prems(4) by blast\n\n  from cs.IH[OF * cs(2) path(2) cs(4) suc'] cs.prems kl \n  have \\<open>\\<exists>k'. cs\\<^bsup>\\<pi>\\<^esup> (THE k. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> by (metis Suc_lessD less_trans_Suc)\n  then obtain k' where csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> by blast\n  \n  have suc2: \\<open>\\<pi> (Suc ?k) = \\<pi>' (Suc k')\\<close> using cs.prems(4) lcdk csk by auto\n\n  have km: \\<open>?k < m\\<close> using kl cs.prems(5) by simp\n  \n  from converged_same_icd[OF cs(2) path(2) cs.prems(5) cs.prems(6) csk icd suc2]  \n  show \\<open>?case\\<close> .\nnext\n  case (cs \\<pi> l)\n  assume \\<open>\\<not> (\\<exists>k. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close>\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = [\\<pi> l]\\<close> by auto\n  with cs converged_cs_single\n  show \\<open>?case\\<close> by metis\nqed\n\nlemma converged_cd_diverge: \nassumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and init: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> and notin: \\<open>\\<not> (\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l')\\<close> and converge: \\<open>l < m\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \nobtains k k' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<pi> (Suc k) \\<noteq> \\<pi>' (Suc k')\\<close>\nusing assms converged_cd_same_suc by blast\n\n\n\nlemma converged_cd_same_suc_return: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> \nand cd_suc: \\<open>\\<forall> k k'. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k' \\<and> l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<longrightarrow> \\<pi> (Suc k) = \\<pi>' (Suc k')\\<close> and ret: \\<open>\\<pi>' n' = return\\<close> \nshows  \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>proof cases\n  assume \\<open>\\<pi> l = return\\<close>\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> using ret cs_return by presburger\n  thus \\<open>?thesis\\<close> by blast\nnext\n  assume nretl: \\<open>\\<pi> l \\<noteq> return\\<close>\n  have \\<open>\\<pi> l \\<in> nodes\\<close> using path path_nodes by auto\n  then obtain \\<pi>l n where ipl: \\<open>is_path \\<pi>l\\<close> and \\<pi>l:  \\<open>\\<pi> l = \\<pi>l 0\\<close> and retn: \\<open>\\<pi>l n = return\\<close> and notl: \\<open>\\<forall> i>0. \\<pi>l i \\<noteq> \\<pi> l\\<close> by (metis direct_path_return nretl)\n  hence ip: \\<open>is_path (\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l)\\<close> and l: \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l) l = \\<pi> l\\<close> and retl: \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l) (l + n) = return\\<close> and nl: \\<open>\\<forall> i>l. (\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l) i \\<noteq> \\<pi> l\\<close> using path_cons[OF path(1) ipl \\<pi>l] by auto\n  \n  have \\<pi>0': \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l) 0 = \\<pi>' 0\\<close>  unfolding cs_0 using  \\<pi>l \\<pi>0  by auto\n\n  have csn: \\<open>cs\\<^bsup>\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  (l+n) = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> using ret retl cs_return by metis\n\n  have eql: \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l) =\\<^bsub>l\\<^esub> \\<pi>\\<close> by (metis path_append_eq_up_to)    \n\n  have csl': \\<open>cs\\<^bsup>\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  l = cs\\<^bsup>\\<pi>\\<^esup> l\\<close> using eql cs_path_swap ip path(1) by metis\n  \n  have \\<open>0 < n\\<close> using nretl[unfolded \\<pi>l] retn by (metis neq0_conv)\n  hence ln: \\<open>l < l + n\\<close> by simp\n\n  have *: \\<open>\\<forall> k k'. cs\\<^bsup>\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  k = cs\\<^bsup>\\<pi>'\\<^esup> k' \\<and> l cd\\<^bsup>\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>\\<rightarrow> k \\<longrightarrow> (\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l) (Suc k) = \\<pi>' (Suc k')\\<close> proof (rule,rule,rule)  \n    fix k k' assume *: \\<open>cs\\<^bsup>\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  k = cs\\<^bsup>\\<pi>'\\<^esup> k' \\<and> l cd\\<^bsup>\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>\\<rightarrow> k\\<close>\n    hence kl: \\<open>k < l\\<close> using is_cdi_def by auto\n    hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k' \\<and> l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using eql * cs_path_swap_le[OF ip path(1) eql,of \\<open>k\\<close>] cdi_path_swap_le[OF path(1) _ eql,of \\<open>l\\<close> \\<open>k\\<close>] by auto\n    hence \\<open>\\<pi> (Suc k) = \\<pi>' (Suc k')\\<close> using cd_suc by blast\n    then show \\<open>(\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l) (Suc k) = \\<pi>' (Suc k')\\<close> using cs_path_swap_le[OF ip path(1) eql,of \\<open>Suc k\\<close>] kl by auto\n  qed \n  obtain l' where \\<open>cs\\<^bsup>\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> using converged_cd_same_suc[OF ip path(2) \\<pi>0' * ln csn]  by blast\n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  l = cs\\<^bsup>\\<pi>\\<^esup> l\\<close> using eql by (metis cs_path_swap ip path(1))\n  ultimately\n  show \\<open>?thesis\\<close> by metis\nqed\n\nlemma converged_cd_diverge_return: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and init: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> \nand notin: \\<open>\\<not> (\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l')\\<close> and ret: \\<open>\\<pi>' m' = return\\<close> \nobtains k k' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<pi> (Suc k) \\<noteq> \\<pi>' (Suc k')\\<close> using converged_cd_same_suc_return[OF path init _ ret, of \\<open>l\\<close>] notin by blast\n\nlemma returned_missing_cd_or_loop: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> \nand notin': \\<open>\\<not>(\\<exists> k'. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close> and nret: \\<open>\\<forall> n'. \\<pi>' n' \\<noteq> return\\<close> and ret: \\<open>\\<pi> n = return\\<close> \nobtains i i' where \\<open>i<k\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> \\<open>\\<pi> (Suc i) \\<noteq> \\<pi>' (Suc i')\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<or> (\\<forall> j'> i'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i')\\<close>\nproof -  \n  obtain f where icdf: \\<open>\\<forall> i'. f (Suc i') icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> f i'\\<close> and ran: \\<open>range f = {i'. \\<forall> j'>i'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'}\\<close> and icdf0: \\<open>\\<not> (\\<exists>i'. f 0 cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i')\\<close> using path(2) path_nret_inf_icd_seq nret by blast\n  show \\<open>thesis\\<close> proof cases\n    assume \\<open>\\<exists> j. \\<not> (\\<exists> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> (f j))\\<close>\n    then obtain j where ni\\<pi>: \\<open>\\<not> (\\<exists> i. cs\\<^bsup>\\<pi>'\\<^esup> (f j) = cs\\<^bsup>\\<pi>\\<^esup> i)\\<close> by metis\n    note converged_cd_diverge_return[OF path(2,1) \\<pi>0[symmetric] ni\\<pi> ret] that\n    then obtain i k' where csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and cdj: \\<open>f j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> and div:  \\<open>\\<pi> (Suc i) \\<noteq> \\<pi>' (Suc k')\\<close> by metis\n    have \\<open>k' \\<in> range f\\<close> using cdj proof (induction \\<open>j\\<close>)\n      case 0 thus \\<open>?case\\<close> using icdf0 by blast\n    next\n      case (Suc j)\n      have icdfj: \\<open>f (Suc j) icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> f j\\<close> using icdf by auto\n      show \\<open>?case\\<close> proof cases\n        assume \\<open>f (Suc j) icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close>\n        hence \\<open>k' = f j\\<close> using icdfj  by (metis icd_uniq)\n        thus \\<open>?case\\<close> by auto\n      next\n        assume \\<open>\\<not> f (Suc j) icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close>\n        hence \\<open>f j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> using cd_impl_icd_cd[OF Suc.prems icdfj] by auto\n        thus \\<open>?case\\<close> using Suc.IH by auto\n      qed\n    qed\n    hence alldep: \\<open>\\<forall> i'>k'. i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> using ran by auto\n    show \\<open>thesis\\<close> proof cases\n      assume \\<open>i < k\\<close> with alldep that[OF _ csk div] show \\<open>thesis\\<close> by blast\n    next\n      assume \\<open>\\<not> i < k\\<close>\n      hence ki: \\<open>k\\<le>i\\<close> by auto\n      have \\<open>k \\<noteq> i\\<close> using notin' csk by auto\n      hence ki': \\<open>k<i\\<close> using ki by auto\n      obtain ka k' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> ka = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ka\\<close> \\<open>\\<pi> (Suc ka) \\<noteq> \\<pi>' (Suc k')\\<close>\n      using converged_cd_diverge[OF path \\<pi>0 notin' ki' csk] by blast\n      moreover\n      hence \\<open>ka < k\\<close> unfolding is_cdi_def by auto\n      ultimately\n      show \\<open>?thesis\\<close> using that by blast\n    qed\n  next\n    assume \\<open>\\<not>(\\<exists> j. \\<not> (\\<exists> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> (f j)))\\<close>\n    hence allin: \\<open>\\<forall> j. (\\<exists> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> (f j))\\<close> by blast\n    define f' where f': \\<open>f' \\<equiv> \\<lambda> j. (SOME i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> (f j))\\<close>\n    have \\<open>\\<forall> i. f' i < f' (Suc i)\\<close> proof\n      fix i\n      have csi: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (f i) = cs\\<^bsup>\\<pi>\\<^esup> (f' i)\\<close> unfolding f' using allin by (metis (mono_tags) someI_ex)\n      have cssuci: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (f (Suc i)) = cs\\<^bsup>\\<pi>\\<^esup> (f' (Suc i))\\<close> unfolding f' using allin by (metis (mono_tags) someI_ex)\n      have fi: \\<open>f i < f (Suc i)\\<close> using icdf unfolding is_icdi_def is_cdi_def by auto\n      have \\<open>f (Suc i) cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> f i\\<close> using icdf unfolding is_icdi_def by blast\n      hence nreti: \\<open>\\<pi>' (f i) \\<noteq> return\\<close> by (metis cd_not_ret)\n      show \\<open>f' i < f' (Suc i)\\<close> using cs_order[OF path(2,1) csi cssuci nreti fi] .\n    qed\n    hence kle: \\<open>k < f' (Suc k)\\<close> using mono_ge_id[of \\<open>f'\\<close> \\<open>Suc k\\<close>] by auto\n    have cssk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> (f' (Suc k)) = cs\\<^bsup>\\<pi>'\\<^esup> (f (Suc k))\\<close> unfolding f' using allin by (metis (mono_tags) someI_ex)\n    obtain ka k' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> ka = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ka\\<close> \\<open>\\<pi> (Suc ka) \\<noteq> \\<pi>' (Suc k')\\<close>\n    using converged_cd_diverge[OF path \\<pi>0 notin' kle cssk] by blast\n    moreover\n    hence \\<open>ka < k\\<close> unfolding is_cdi_def by auto\n    ultimately\n    show \\<open>?thesis\\<close> using that by blast\n  qed\nqed\n\nlemma missing_cd_or_loop: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> and notin': \\<open>\\<not>(\\<exists> k'. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close>  \nobtains i i' where \\<open>i < k\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> \\<open>\\<pi> (Suc i) \\<noteq> \\<pi>' (Suc i')\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<or> (\\<forall> j'> i'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i')\\<close>\nproof cases\n  assume \\<open>\\<exists> n'. \\<pi>' n' = return\\<close>\n  then obtain n' where retn: \\<open>\\<pi>' n' = return\\<close> by blast\n  note converged_cd_diverge_return[OF path \\<pi>0 notin' retn]\n  then obtain ka k' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> ka = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ka\\<close> \\<open>\\<pi> (Suc ka) \\<noteq> \\<pi>' (Suc k')\\<close> by blast\n  moreover\n  hence \\<open>ka < k\\<close> unfolding is_cdi_def by auto\n  ultimately show \\<open>thesis\\<close> using that by simp\nnext\n  assume \\<open>\\<not> (\\<exists> n'. \\<pi>' n' = return)\\<close>\n  hence notret: \\<open>\\<forall> n'. \\<pi>' n' \\<noteq> return\\<close> by auto\n  then obtain \\<pi>l n where ipl: \\<open>is_path \\<pi>l\\<close> and \\<pi>l:  \\<open>\\<pi> k = \\<pi>l 0\\<close> and retn: \\<open>\\<pi>l n = return\\<close> using reaching_ret path(1) path_nodes by metis\n  hence ip: \\<open>is_path (\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l)\\<close> and l: \\<open>(\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l) k = \\<pi> k\\<close> and retl: \\<open>(\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l) (k + n) = return\\<close> using path_cons[OF path(1) ipl \\<pi>l] by auto\n  \n  have \\<pi>0': \\<open>(\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l) 0 = \\<pi>' 0\\<close>  unfolding cs_0 using  \\<pi>l \\<pi>0  by auto\n\n  have eql: \\<open>(\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l) =\\<^bsub>k\\<^esub> \\<pi>\\<close> by (metis path_append_eq_up_to)    \n\n  have csl': \\<open>cs\\<^bsup>\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l\\<^esup>  k = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using eql cs_path_swap ip path(1) by metis\n  \n  hence notin: \\<open>\\<not>(\\<exists> k'. cs\\<^bsup>\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l\\<^esup>  k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close> using notin' by auto\n\n  obtain i i' where *: \\<open>i < k\\<close> and csi: \\<open>cs\\<^bsup>\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l\\<^esup>  i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> and suci: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>l) (Suc i) \\<noteq> \\<pi>' (Suc i')\\<close>  and cdloop: \\<open>k cd\\<^bsup>\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l\\<^esup>\\<rightarrow> i \\<or> (\\<forall> j'>i'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i')\\<close>\n  using returned_missing_cd_or_loop[OF ip path(2) \\<pi>0' notin notret retl] by blast\n\n  have \\<open>i \\<noteq> k\\<close> using notin csi by auto\n  hence ik: \\<open>i < k\\<close> using * by auto\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using csi cs_path_swap_le[OF ip path(1) eql] by auto\n  moreover\n  have \\<open>\\<pi> (Suc i) \\<noteq> \\<pi>' (Suc i')\\<close> using ik eq_up_to_apply[OF eql, of \\<open>Suc i\\<close>] suci by auto\n  moreover\n  have \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<or> (\\<forall> j'>i'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i')\\<close> using cdloop cdi_path_swap_le[OF path(1) _ eql, of \\<open>k\\<close> \\<open>i\\<close>] by auto\n  ultimately\n  show \\<open>thesis\\<close> using that[OF *] by blast\nqed\n\n\nlemma path_shift_set_cd: assumes \\<open>is_path \\<pi>\\<close> shows \\<open>{k + j| j . n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> j } = {i. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i }\\<close>\nproof -\n  { fix i\n    assume \\<open>i\\<in>{k+j | j . n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> j }\\<close>\n    then obtain j where \\<open>i = k+j\\<close> \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> j\\<close> by auto\n    hence \\<open>k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i\\<close> using cd_path_shift[OF _ assms, of \\<open>k\\<close> \\<open>k+j\\<close> \\<open>k+n\\<close>] by simp\n    hence \\<open>i\\<in>{ i. k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i }\\<close> by blast\n  }\n  moreover\n  { fix i\n    assume \\<open>i\\<in>{ i. k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i }\\<close>\n    hence *: \\<open>k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i\\<close> by blast\n    then obtain j where i: \\<open>i = k+j\\<close> by (metis le_Suc_ex)\n    hence \\<open>k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k+j\\<close> using * by auto\n    hence \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> j\\<close> using cd_path_shift[OF _ assms, of \\<open>k\\<close> \\<open>k+j\\<close> \\<open>k+n\\<close>] by simp\n    hence \\<open>i\\<in>{k+j | j . n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> j }\\<close> using i by simp\n  }\n  ultimately show \\<open>?thesis\\<close> by blast\nqed\n\nlemma cs_path_shift_set_cd: assumes path: \\<open>is_path \\<pi>\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = map \\<pi> (sorted_list_of_set {i. k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i }) @ [\\<pi> (k+n)]\\<close>\nproof -\n  have mono:\\<open>\\<forall>n m. n < m \\<longrightarrow> k + n < k + m\\<close> by auto\n  have fin: \\<open>finite {i. n cd\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup>\\<rightarrow> i}\\<close> unfolding is_cdi_def by auto\n  have *: \\<open>(\\<lambda> x. k+x)`{i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i} = {k + i | i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i}\\<close> by auto\n  have \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = map (\\<pi>\\<guillemotleft>k) (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i}) @ [(\\<pi>\\<guillemotleft>k) n]\\<close> using cs_sorted_list_of_cd' by blast\n  also \n  have \\<open>\\<dots> = map \\<pi> (map (\\<lambda> x. k+x) (sorted_list_of_set{i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i})) @ [\\<pi> (k+n)]\\<close> by auto\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set ((\\<lambda> x. k+x)`{i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i})) @ [\\<pi> (k+n)]\\<close> using sorted_list_of_set_map_mono[OF mono fin] by auto\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set ({k + i | i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i})) @ [\\<pi> (k+n)]\\<close> using * by auto\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set ({i. k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> (k+n)]\\<close> using path_shift_set_cd[OF path] by auto\n  finally\n  show \\<open>?thesis\\<close> .\nqed\n\nlemma cs_split_shift_cd: assumes \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and \\<open>j < k\\<close> and \\<open>k < n\\<close> and \\<open>\\<forall>j'<k. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j' \\<longrightarrow> j' \\<le> j\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>\\<^esup> j @ cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> (n-k)\\<close>\nproof -\n  have path: \\<open>is_path \\<pi>\\<close> using assms unfolding is_cdi_def by auto\n  have 1: \\<open>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} \\<union> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i}\\<close> by auto\n  have le: \\<open>\\<forall> i\\<in> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k}. \\<forall> j\\<in> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i}. i < j\\<close> by auto\n  \n  have 2: \\<open>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} = {i . j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {j}\\<close> proof - \n    { fix i assume \\<open>i\\<in>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k}\\<close> \n      hence cd: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> and ik:\\<open>i < k\\<close> by auto\n      have \\<open>i\\<in>{i . j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {j}\\<close> proof cases\n        assume \\<open>i < j\\<close> hence \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> by (metis is_cdi_def assms(1) cd cdi_prefix nat_less_le)\n        thus \\<open>?thesis\\<close> by simp\n      next\n        assume \\<open>\\<not> i < j\\<close>\n        moreover\n        have \\<open>i \\<le> j\\<close> using assms(4) ik cd by auto\n        ultimately\n        show \\<open>?thesis\\<close> by auto\n      qed\n    }\n    moreover\n    { fix i assume \\<open>i\\<in>{i . j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {j}\\<close>\n      hence \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<or> i = j\\<close> by auto\n      hence \\<open>i\\<in>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k}\\<close> using assms(1,2) cd_trans[OF _ assms(1)] apply auto unfolding is_cdi_def \n      by (metis (poly_guards_query) diff_diff_cancel diff_is_0_eq le_refl le_trans nat_less_le)\n    }\n    ultimately show \\<open>?thesis\\<close> by blast\n  qed\n  \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}) @ [\\<pi> n]\\<close> using cs_sorted_list_of_cd' by simp\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set ({i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} \\<union> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> n]\\<close> using 1 by metis\n  also \n  have \\<open>\\<dots> = map \\<pi> ((sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k}) @ (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> n]\\<close>\n    using sorted_list_of_set_append[OF _ _ le] is_cdi_def by auto\n  also \n  have \\<open>\\<dots> = (map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k})) @ (map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> n]\\<close> by auto\n  also\n  have \\<open>\\<dots> = cs\\<^bsup>\\<pi>\\<^esup> j @ (map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> n]\\<close> unfolding 2 using cs_sorted_list_of_cd by auto\n  also \n  have \\<open>\\<dots> = cs\\<^bsup>\\<pi>\\<^esup> j @ cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> (n-k)\\<close> using cs_path_shift_set_cd[OF path, of \\<open>k\\<close> \\<open>n-k\\<close>] assms(3) by auto\n  finally\n  show \\<open>?thesis\\<close> .\nqed\n\nlemma cs_split_shift_nocd: assumes \\<open>is_path \\<pi>\\<close> and \\<open>k < n\\<close> and \\<open>\\<forall>j. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<longrightarrow> k \\<le> j\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> (n-k)\\<close>\nproof -\n  have path: \\<open>is_path \\<pi>\\<close> using assms by auto\n  have 1: \\<open>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} \\<union> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i}\\<close> by auto\n  have le: \\<open>\\<forall> i\\<in> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k}. \\<forall> j\\<in> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i}. i < j\\<close> by auto\n  have 2: \\<open>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} = {}\\<close> using assms by auto\n  \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}) @ [\\<pi> n]\\<close> using cs_sorted_list_of_cd' by simp\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set ({i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} \\<union> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> n]\\<close> using 1 by metis\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i}) @ [\\<pi> n]\\<close>\n    unfolding 2 by auto\n  also \n  have \\<open>\\<dots> = cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> (n-k)\\<close> using cs_path_shift_set_cd[OF path, of \\<open>k\\<close> \\<open>n-k\\<close>] assms(2)  by auto\n  finally show \\<open>?thesis\\<close> .\nqed\n\nlemma shifted_cs_eq_is_eq: assumes \\<open>is_path \\<pi>\\<close> and \\<open>is_path \\<pi>'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n'\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k+n) = cs\\<^bsup>\\<pi>'\\<^esup> (k'+n')\\<close>\nproof (rule ccontr)\n  note path = assms(1,2)\n  note csk = assms(3)\n  note csn = assms(4)\n  assume ne: \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k+n) \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> (k'+n')\\<close>\n  have nretkn:\\<open>\\<pi> (k+n) \\<noteq> return\\<close> proof \n    assume 1:\\<open>\\<pi> (k+n) = return\\<close>\n    hence \\<open>(\\<pi>\\<guillemotleft>k) n = return\\<close> by auto\n    hence \\<open>(\\<pi>'\\<guillemotleft>k') n' = return\\<close> using last_cs assms(4) by metis\n    hence \\<open>\\<pi>' (k' + n') = return\\<close> by auto\n    thus \\<open>False\\<close> using ne 1 cs_return by auto\n  qed\n  hence nretk: \\<open>\\<pi> k \\<noteq> return\\<close> using term_path_stable[OF assms(1), of \\<open>k\\<close> \\<open>k +n\\<close>] by auto\n  have nretkn': \\<open>\\<pi>' (k'+n') \\<noteq> return\\<close> proof \n    assume 1:\\<open>\\<pi>' (k'+n') = return\\<close>\n    hence \\<open>(\\<pi>'\\<guillemotleft>k') n' = return\\<close> by auto\n    hence \\<open>(\\<pi>\\<guillemotleft>k) n = return\\<close> using last_cs assms(4) by metis\n    hence \\<open>\\<pi> (k + n) = return\\<close> by auto\n    thus \\<open>False\\<close> using ne 1 cs_return by auto\n  qed\n  hence nretk': \\<open>\\<pi>' k' \\<noteq> return\\<close> using term_path_stable[OF assms(2), of \\<open>k'\\<close> \\<open>k' +n'\\<close>] by auto\n  have n0:\\<open>n > 0\\<close> proof (rule ccontr)\n    assume *: \\<open>\\<not> 0 < n\\<close>    \n    hence 1:\\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> 0 = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n'\\<close> using assms(3,4) by auto\n    have \\<open>(\\<pi>\\<guillemotleft>k) 0 = (\\<pi>'\\<guillemotleft>k') 0\\<close> using assms(3) last_cs path_shift_def by (metis monoid_add_class.add.right_neutral)\n    hence \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> 0 = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n'\\<close> using 1 cs_0 by metis\n    hence n0': \\<open>n' = 0\\<close> using cs_inj[of \\<open>\\<pi>'\\<guillemotleft>k'\\<close> \\<open>0\\<close> \\<open>n'\\<close> ] * assms(2) by (metis path_shift_def assms(4) last_cs nretkn path_path_shift)\n    thus \\<open>False\\<close> using ne * assms(3) by fastforce\n  qed\n  have n0':\\<open>n' > 0\\<close> proof (rule ccontr)\n    assume *: \\<open>\\<not> 0 < n'\\<close>    \n    hence 1:\\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> 0 = cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n\\<close> using assms(3,4) by auto\n    have \\<open>(\\<pi>'\\<guillemotleft>k') 0 = (\\<pi>\\<guillemotleft>k) 0\\<close> using assms(3) last_cs path_shift_def by (metis monoid_add_class.add.right_neutral)\n    hence \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> 0 = cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n\\<close> using 1 cs_0 by metis\n    hence n0: \\<open>n = 0\\<close> using cs_inj[of \\<open>\\<pi>\\<guillemotleft>k\\<close> \\<open>0\\<close> \\<open>n\\<close> ] * assms(1) by (metis path_shift_def assms(4) last_cs nretkn path_path_shift)\n    thus \\<open>False\\<close> using ne * assms(3) by fastforce\n  qed\n  have cdleswap': \\<open>\\<forall> j'<k'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' \\<longrightarrow> (\\<exists>j<k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> proof (rule,rule,rule, rule ccontr)\n    fix j' assume jk': \\<open>j'<k'\\<close> and ncdj': \\<open>(k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> and ne: \\<open>\\<not> (\\<exists>j<k. k + n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\n    hence kcdj': \\<open>k' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> using cr_wn' by blast \n      \n      then obtain j where kcdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using csk cs_path_swap_cd path by metis\n      hence jk: \\<open>j < k\\<close> unfolding is_cdi_def by auto\n      \n      have ncdn: \\<open>\\<not> (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using ne csj jk by blast \n      \n      obtain l' where lnocd': \\<open>l' = n' \\<or> n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l'\\<close> and cslsing': \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l' = [(\\<pi>'\\<guillemotleft>k') l']\\<close>        \n        proof cases\n          assume \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n' = [(\\<pi>'\\<guillemotleft>k') n']\\<close> thus \\<open>thesis\\<close> using that[of \\<open>n'\\<close>] by auto\n        next\n          assume *: \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n' \\<noteq> [(\\<pi>'\\<guillemotleft>k') n']\\<close>\n          then obtain x ys where \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n' = [x]@ys@[(\\<pi>'\\<guillemotleft>k') n']\\<close> by (metis append_Cons append_Nil cs_length_g_one cs_length_one(1) neq_Nil_conv) \n          then obtain l' where \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l' = [x]\\<close> and cdl': \\<open>n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l'\\<close> using cs_split[of \\<open>\\<pi>'\\<guillemotleft>k'\\<close> \\<open>n'\\<close> \\<open>Nil\\<close> \\<open>x\\<close> \\<open>ys\\<close>] by auto\n          hence \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l' = [(\\<pi>'\\<guillemotleft>k') l']\\<close> using last_cs by (metis last.simps) \n          thus \\<open>thesis\\<close> using that cdl' by auto\n      qed\n      hence ln': \\<open>l'\\<le>n'\\<close> unfolding is_cdi_def by auto\n      hence lcdj': \\<open>k'+l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> using jk' ncdj'  by (metis add_le_cancel_left cdi_prefix trans_less_add1)\n            \n      obtain l where lnocd: \\<open>l = n \\<or> n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l\\<close> and csl: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l'\\<close> using lnocd' proof\n        assume \\<open>l' = n'\\<close> thus \\<open>thesis\\<close> using csn that[of \\<open>n\\<close>] by auto\n        next\n        assume \\<open>n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l'\\<close>\n        then obtain l where \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l\\<close> \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l'\\<close> using cs_path_swap_cd path csn by (metis path_path_shift)\n        thus \\<open>thesis\\<close> using that by auto\n      qed\n      \n      have cslsing: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = [(\\<pi>\\<guillemotleft>k) l]\\<close> using cslsing' last_cs csl last.simps by metis\n      \n      have ln: \\<open>l\\<le>n\\<close> using lnocd unfolding is_cdi_def by auto\n      hence nretkl: \\<open>\\<pi> (k + l) \\<noteq> return\\<close> using term_path_stable[of \\<open>\\<pi>\\<close> \\<open>k+l\\<close> \\<open>k+n\\<close>] nretkn path(1) by auto  \n      \n      have *: \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l \\<Longrightarrow> k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k+l\\<close> using cd_path_shift[of \\<open>k\\<close> \\<open>k+l\\<close> \\<open>\\<pi>\\<close> \\<open>k+n\\<close>] path(1) by auto\n      \n      have ncdl: \\<open>\\<not> (k+l) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> apply rule using lnocd apply rule using ncdn apply blast using cd_trans ncdn * by blast      \n      \n      hence \\<open>\\<exists> i\\<in> {j..k+l}. \\<pi> i = ipd (\\<pi> j)\\<close> unfolding is_cdi_def using path(1) jk nretkl by auto\n      hence \\<open>\\<exists> i\\<in> {k<..k+l}. \\<pi> i = ipd (\\<pi> j)\\<close> using kcdj unfolding is_cdi_def by force\n      \n      then obtain i where ki: \\<open>k < i\\<close> and il: \\<open>i \\<le> k+l\\<close> and ipdi: \\<open>\\<pi> i = ipd (\\<pi> j)\\<close> by force\n      \n      hence \\<open>(\\<pi>\\<guillemotleft>k) (i-k) = ipd (\\<pi> j)\\<close> \\<open>i-k \\<le> l\\<close> by auto\n      hence pd: \\<open>(\\<pi>\\<guillemotleft>k) l pd\\<rightarrow> ipd (\\<pi> j)\\<close> using cs_single_pd_intermed[OF _ cslsing] path(1) path_path_shift by metis\n      moreover\n      have \\<open>(\\<pi>\\<guillemotleft>k) l = \\<pi>' (k' + l')\\<close> using csl last_cs by (metis path_shift_def)\n      moreover\n      have \\<open>\\<pi> j = \\<pi>' j'\\<close> using csj last_cs by metis\n      ultimately\n      have \\<open>\\<pi>' (k'+l') pd\\<rightarrow> ipd (\\<pi>' j')\\<close> by simp\n      moreover\n      have \\<open>ipd (\\<pi>' j') pd\\<rightarrow> \\<pi>' (k'+l')\\<close> using ipd_pd_cd[OF lcdj'] .\n      ultimately\n      have \\<open>\\<pi>' (k'+l') = ipd (\\<pi>' j')\\<close> using pd_antisym by auto\n      thus \\<open>False\\<close> using lcdj' unfolding is_cdi_def by force\n  qed\n  \n  \\<comment> \\<open>Symmetric version of the above statement\\<close>\n  have cdleswap: \\<open>\\<forall> j<k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<longrightarrow> (\\<exists>j'<k'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' \\<and> cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> proof (rule,rule,rule, rule ccontr)\n    fix j assume jk: \\<open>j<k\\<close> and ncdj: \\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and ne: \\<open>\\<not> (\\<exists>j'<k'. k' + n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' \\<and> cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\n    hence kcdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using cr_wn' by blast\n      \n      then obtain j' where kcdj': \\<open>k' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> and csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using csk cs_path_swap_cd path by metis\n      hence jk': \\<open>j' < k'\\<close> unfolding is_cdi_def by auto\n      \n      have ncdn': \\<open>\\<not> (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> using ne csj jk' by blast \n      \n      obtain l where lnocd: \\<open>l = n \\<or> n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l\\<close> and cslsing: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = [(\\<pi>\\<guillemotleft>k) l]\\<close>        \n        proof cases\n          assume \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = [(\\<pi>\\<guillemotleft>k) n]\\<close> thus \\<open>thesis\\<close> using that[of \\<open>n\\<close>] by auto\n        next\n          assume *: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n \\<noteq> [(\\<pi>\\<guillemotleft>k) n]\\<close>\n          then obtain x ys where \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = [x]@ys@[(\\<pi>\\<guillemotleft>k) n]\\<close> by (metis append_Cons append_Nil cs_length_g_one cs_length_one(1) neq_Nil_conv) \n          then obtain l where \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = [x]\\<close> and cdl: \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l\\<close> using cs_split[of \\<open>\\<pi>\\<guillemotleft>k\\<close> \\<open>n\\<close> \\<open>Nil\\<close> \\<open>x\\<close> \\<open>ys\\<close>] by auto\n          hence \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = [(\\<pi>\\<guillemotleft>k) l]\\<close> using last_cs by (metis last.simps) \n          thus \\<open>thesis\\<close> using that cdl by auto\n      qed\n      hence ln: \\<open>l\\<le>n\\<close> unfolding is_cdi_def by auto\n      hence lcdj: \\<open>k+l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using jk ncdj  by (metis add_le_cancel_left cdi_prefix trans_less_add1)\n            \n      obtain l' where lnocd': \\<open>l' = n' \\<or> n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l'\\<close> and csl: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l'\\<close> using lnocd proof\n        assume \\<open>l = n\\<close> thus \\<open>thesis\\<close> using csn that[of \\<open>n'\\<close>] by auto\n        next\n        assume \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l\\<close>\n        then obtain l' where \\<open>n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l'\\<close> \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l'\\<close> using cs_path_swap_cd path csn by (metis path_path_shift)\n        thus \\<open>thesis\\<close> using that by auto\n      qed\n      \n      have cslsing': \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l' = [(\\<pi>'\\<guillemotleft>k') l']\\<close> using cslsing last_cs csl last.simps by metis\n      \n      have ln': \\<open>l'\\<le>n'\\<close> using lnocd' unfolding is_cdi_def by auto\n      hence nretkl': \\<open>\\<pi>' (k' + l') \\<noteq> return\\<close> using term_path_stable[of \\<open>\\<pi>'\\<close> \\<open>k'+l'\\<close> \\<open>k'+n'\\<close>] nretkn' path(2) by auto  \n      \n      have *: \\<open>n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l' \\<Longrightarrow> k'+n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'+l'\\<close> using cd_path_shift[of \\<open>k'\\<close> \\<open>k'+l'\\<close> \\<open>\\<pi>'\\<close> \\<open>k'+n'\\<close>] path(2) by auto\n      \n      have ncdl': \\<open>\\<not> (k'+l') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> apply rule using lnocd' apply rule using ncdn' apply blast using cd_trans ncdn' * by blast      \n      \n      hence \\<open>\\<exists> i'\\<in> {j'..k'+l'}. \\<pi>' i' = ipd (\\<pi>' j')\\<close> unfolding is_cdi_def using path(2) jk' nretkl' by auto\n      hence \\<open>\\<exists> i'\\<in> {k'<..k'+l'}. \\<pi>' i' = ipd (\\<pi>' j')\\<close> using kcdj' unfolding is_cdi_def by force\n      \n      then obtain i' where ki': \\<open>k' < i'\\<close> and il': \\<open>i' \\<le> k'+l'\\<close> and ipdi: \\<open>\\<pi>' i' = ipd (\\<pi>' j')\\<close> by force\n      \n      hence \\<open>(\\<pi>'\\<guillemotleft>k') (i'-k') = ipd (\\<pi>' j')\\<close> \\<open>i'-k' \\<le> l'\\<close> by auto\n      hence pd: \\<open>(\\<pi>'\\<guillemotleft>k') l' pd\\<rightarrow> ipd (\\<pi>' j')\\<close> using cs_single_pd_intermed[OF _ cslsing'] path(2) path_path_shift by metis\n      moreover\n      have \\<open>(\\<pi>'\\<guillemotleft>k') l' = \\<pi> (k + l)\\<close> using csl last_cs by (metis path_shift_def)\n      moreover\n      have \\<open>\\<pi>' j' = \\<pi> j\\<close> using csj last_cs by metis\n      ultimately\n      have \\<open>\\<pi> (k+l) pd\\<rightarrow> ipd (\\<pi> j)\\<close> by simp\n      moreover\n      have \\<open>ipd (\\<pi> j) pd\\<rightarrow> \\<pi> (k+l)\\<close> using ipd_pd_cd[OF lcdj] .\n      ultimately\n      have \\<open>\\<pi> (k+l) = ipd (\\<pi> j)\\<close> using pd_antisym by auto\n      thus \\<open>False\\<close> using lcdj unfolding is_cdi_def by force\n  qed\n  \n  have cdle: \\<open>\\<exists>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k\\<close> (is \\<open>\\<exists> j. ?P j\\<close>) proof (rule ccontr)\n    assume \\<open>\\<not> (\\<exists>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k)\\<close>\n    hence allge: \\<open>\\<forall>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<longrightarrow> k \\<le> j\\<close> by auto\n    have allge': \\<open>\\<forall>j'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' \\<longrightarrow> k' \\<le> j'\\<close> proof (rule, rule, rule ccontr)\n      fix j' \n      assume *: \\<open>k' + n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> and \\<open>\\<not> k' \\<le> j'\\<close>\n      then obtain j where \\<open>j<k\\<close> \\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using cdleswap' by (metis le_neq_implies_less nat_le_linear)\n      thus \\<open>False\\<close> using allge by auto\n    qed\n    have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k + n) = cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n\\<close> using cs_split_shift_nocd[OF assms(1) _ allge] n0 by auto\n    moreover\n    have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (k' + n') = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using cs_split_shift_nocd[OF assms(2) _ allge'] n0' by auto\n    ultimately\n    show \\<open>False\\<close> using ne assms(4) by auto\n  qed\n  \n  define j where  \\<open>j == GREATEST j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k\\<close>  \n  have cdj:\\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and jk: \\<open>j < k\\<close> and jge:\\<open>\\<forall> j'< k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j' \\<longrightarrow> j' \\<le> j\\<close> proof -\n    have bound: \\<open>\\<forall> y. ?P y \\<longrightarrow> y \\<le> k\\<close> by auto\n    show \\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using GreatestI_nat[of \\<open>?P\\<close>] j_def bound cdle by blast\n    show \\<open>j < k\\<close> using GreatestI_nat[of \\<open>?P\\<close>] bound j_def cdle by blast\n    show \\<open>\\<forall> j'< k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j' \\<longrightarrow> j' \\<le> j\\<close> using Greatest_le_nat[of \\<open>?P\\<close>] bound j_def by blast\n  qed\n    \n  obtain j' where cdj':\\<open>(k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> and csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close>  and jk': \\<open>j' < k'\\<close> using cdleswap cdj jk by blast\n  have jge':\\<open>\\<forall> i'< k'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i' \\<longrightarrow> i' \\<le> j'\\<close> proof(rule,rule,rule)\n    fix i'\n    assume ik': \\<open>i' < k'\\<close> and cdi': \\<open>k' + n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'\\<close>\n    then obtain i where cdi:\\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> and csi: \\<open> cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i\\<close> and ik: \\<open>i<k\\<close> using cdleswap' by force \n    have ij: \\<open>i \\<le> j\\<close> using jge cdi ik by auto\n    show \\<open>i' \\<le> j'\\<close> using cs_order_le[OF assms(1,2) csi[symmetric] csj _ ij] cd_not_ret[OF cdi] by simp\n  qed\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k + n) = cs\\<^bsup>\\<pi>\\<^esup> j @ cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n\\<close> using  cs_split_shift_cd[OF cdj jk _ jge] n0 by auto\n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (k' + n') = cs\\<^bsup>\\<pi>'\\<^esup> j' @ cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using  cs_split_shift_cd[OF cdj' jk' _ jge'] n0' by auto\n  ultimately\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k+n) = cs\\<^bsup>\\<pi>'\\<^esup> (k'+n')\\<close> using csj assms(4) by auto\n  thus \\<open>False\\<close> using ne by simp\nqed\n\nlemma cs_eq_is_eq_shifted: assumes \\<open>is_path \\<pi>\\<close> and \\<open>is_path \\<pi>'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k+n) = cs\\<^bsup>\\<pi>'\\<^esup> (k'+n')\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n'\\<close>\nproof (rule ccontr)\n  assume ne: \\<open>cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n \\<noteq> cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close>\n  have nretkn:\\<open>\\<pi> (k+n) \\<noteq> return\\<close> proof \n    assume 1:\\<open>\\<pi> (k+n) = return\\<close>\n    hence 2:\\<open>\\<pi>' (k'+n') = return\\<close> using assms(4) last_cs by metis\n    hence \\<open>(\\<pi>\\<guillemotleft>k) n = return\\<close> \\<open>(\\<pi>'\\<guillemotleft>k') n' = return\\<close> using 1 by auto\n    hence \\<open>cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using cs_return by metis \n    thus \\<open>False\\<close> using ne by simp\n  qed\n  hence nretk: \\<open>\\<pi> k \\<noteq> return\\<close> using term_path_stable[OF assms(1), of \\<open>k\\<close> \\<open>k +n\\<close>] by auto\n  have nretkn': \\<open>\\<pi>' (k'+n') \\<noteq> return\\<close> proof \n    assume 1:\\<open>\\<pi>' (k'+n') = return\\<close>\n    hence 2:\\<open>\\<pi> (k+n) = return\\<close> using assms(4) last_cs by metis\n    hence \\<open>(\\<pi>\\<guillemotleft>k) n = return\\<close> \\<open>(\\<pi>'\\<guillemotleft>k') n' = return\\<close> using 1 by auto\n    hence \\<open>cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using cs_return by metis \n    thus \\<open>False\\<close> using ne by simp\n  qed\n  hence nretk': \\<open>\\<pi>' k' \\<noteq> return\\<close> using term_path_stable[OF assms(2), of \\<open>k'\\<close> \\<open>k' +n'\\<close>] by auto\n  have n0:\\<open>n > 0\\<close> proof (rule ccontr)\n    assume *: \\<open>\\<not> 0 < n\\<close>    \n    hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>'\\<^esup> (k'+ n')\\<close> using assms(3,4) by auto\n    hence n0: \\<open>n = 0\\<close> \\<open>n' = 0\\<close> using cs_inj[OF assms(2) nretkn', of \\<open>k'\\<close>] * by auto\n    have \\<open>cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> unfolding n0 cs_0 by (auto , metis last_cs assms(3))\n    thus \\<open>False\\<close> using ne by simp\n  qed\n  have n0':\\<open>n' > 0\\<close> proof (rule ccontr)\n    assume *: \\<open>\\<not> 0 < n'\\<close>    \n    hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>\\<^esup> (k+ n)\\<close> using assms(3,4) by auto\n    hence n0: \\<open>n = 0\\<close> \\<open>n' = 0\\<close> using cs_inj[OF assms(1) nretkn, of \\<open>k\\<close>] * by auto\n    have \\<open>cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> unfolding n0 cs_0 by (auto , metis last_cs assms(3))\n    thus \\<open>False\\<close> using ne by simp\n  qed\n  have cdle: \\<open>\\<exists>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k\\<close> (is \\<open>\\<exists> j. ?P j\\<close>) proof (rule ccontr)\n    assume \\<open>\\<not> (\\<exists>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k)\\<close>\n    hence allge: \\<open>\\<forall>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<longrightarrow> k \\<le> j\\<close> by auto\n    have allge': \\<open>\\<forall>j'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' \\<longrightarrow> k' \\<le> j'\\<close> proof (rule, rule)\n      fix j' \n      assume *: \\<open>k' + n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close>\n      obtain j where cdj: \\<open>k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using cs_path_swap_cd[OF assms(2,1) assms(4)[symmetric] *] by metis\n      hence kj:\\<open>k \\<le> j\\<close> using allge by auto\n      thus kj': \\<open>k' \\<le> j'\\<close> using cs_order_le[OF assms(1,2,3) csj nretk] by simp\n    qed\n    have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k + n) = cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n\\<close> using cs_split_shift_nocd[OF assms(1) _ allge] n0 by auto\n    moreover\n    have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (k' + n') = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using cs_split_shift_nocd[OF assms(2) _ allge'] n0' by auto\n    ultimately\n    show \\<open>False\\<close> using ne assms(4) by auto\n  qed\n  define j where  \\<open>j == GREATEST j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k\\<close>  \n  have cdj:\\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and jk: \\<open>j < k\\<close> and jge:\\<open>\\<forall> j'< k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j' \\<longrightarrow> j' \\<le> j\\<close> proof -\n    have bound: \\<open>\\<forall> y. ?P y \\<longrightarrow> y \\<le> k\\<close> by auto\n    show \\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using GreatestI_nat[of \\<open>?P\\<close>] bound j_def cdle by blast\n    show \\<open>j < k\\<close> using GreatestI_nat[of \\<open>?P\\<close>] bound j_def cdle by blast\n    show \\<open>\\<forall> j'< k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j' \\<longrightarrow> j' \\<le> j\\<close> using Greatest_le_nat[of \\<open>?P\\<close>] bound j_def by blast\n  qed\n  obtain j' where cdj':\\<open>(k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> and csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using cs_path_swap_cd assms cdj by blast\n  have jge':\\<open>\\<forall> i'< k'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i' \\<longrightarrow> i' \\<le> j'\\<close> proof(rule,rule,rule)\n    fix i'\n    assume ik': \\<open>i' < k'\\<close> and cdi': \\<open>k' + n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'\\<close>\n    then obtain i where cdi:\\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> and csi: \\<open> cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i\\<close> using cs_path_swap_cd[OF assms(2,1) assms(4)[symmetric]] by blast\n    have nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close> by (metis cd_not_ret cdi')\n    have ik: \\<open>i < k\\<close> using cs_order[OF assms(2,1) csi _ nreti' ik'] assms(3) by auto\n    have ij: \\<open>i \\<le> j\\<close> using jge cdi ik by auto\n    show \\<open>i' \\<le> j'\\<close> using cs_order_le[OF assms(1,2) csi[symmetric] csj _ ij] cd_not_ret[OF cdi] by simp\n  qed\n  have jk': \\<open>j' < k'\\<close> using cs_order[OF assms(1,2) csj assms(3) cd_not_ret[OF cdj] jk] .\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k + n) = cs\\<^bsup>\\<pi>\\<^esup> j @ cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n\\<close> using  cs_split_shift_cd[OF cdj jk _ jge] n0 by auto\n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (k' + n') = cs\\<^bsup>\\<pi>'\\<^esup> j' @ cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using  cs_split_shift_cd[OF cdj' jk' _ jge'] n0' by auto\n  ultimately\n  have \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n'\\<close> using csj assms(4) by auto\n  thus \\<open>False\\<close> using ne by simp\nqed\n\nlemma converged_cd_diverge_cs: assumes \\<open>is_path \\<pi>\\<close> and \\<open>is_path \\<pi>'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> j  = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> and \\<open>j<l\\<close> and \\<open>\\<not> (\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l')\\<close> and \\<open>l < m\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close>\nobtains k k' where \\<open>j\\<le>k\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and \\<open>\\<pi> (Suc k) \\<noteq> \\<pi>' (Suc k')\\<close>\n  proof -  \n  have \\<open>is_path (\\<pi>\\<guillemotleft>j)\\<close> \\<open>is_path (\\<pi>'\\<guillemotleft>j')\\<close> using assms(1,2) path_path_shift by auto\n  moreover\n  have \\<open>(\\<pi>\\<guillemotleft>j) 0 = (\\<pi>'\\<guillemotleft>j') 0\\<close> using assms(3) last_cs by (metis path_shift_def add.right_neutral)\n  moreover\n  have \\<open>\\<not>(\\<exists>l'. cs\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup> (l-j) = cs\\<^bsup>\\<pi>'\\<guillemotleft>j'\\<^esup> l')\\<close> proof \n    assume \\<open>\\<exists>l'. cs\\<^bsup>\\<pi> \\<guillemotleft> j\\<^esup> (l - j) = cs\\<^bsup>\\<pi>' \\<guillemotleft> j'\\<^esup> l'\\<close>\n    then obtain l' where csl: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup> (l - j) = cs\\<^bsup>\\<pi>'\\<guillemotleft>j'\\<^esup> l'\\<close> by blast\n      \n    have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> (j' + l')\\<close> using shifted_cs_eq_is_eq[OF assms(1,2,3) csl] assms(4) by auto\n    thus \\<open>False\\<close> using assms(5) by blast\n  qed\n  moreover\n  have \\<open>l-j < m-j\\<close> using assms by auto\n  moreover\n  have \\<open>\\<pi> j \\<noteq> return\\<close> using cs_return assms(1-5) term_path_stable by (metis nat_less_le) \n  hence \\<open>j'<m'\\<close> using cs_order[OF assms(1,2,3,7)] assms by auto\n  hence \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup> (m-j) = cs\\<^bsup>\\<pi>'\\<guillemotleft>j'\\<^esup> (m'-j')\\<close> using cs_eq_is_eq_shifted[OF assms(1,2,3),of \\<open>m-j\\<close> \\<open>m'-j'\\<close>] assms(4,6,7) by auto\n  ultimately\n  obtain k k' where csk: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup> k = cs\\<^bsup>\\<pi>'\\<guillemotleft>j'\\<^esup> k'\\<close> and lcdk: \\<open>l-j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow> k\\<close> and suc:\\<open>(\\<pi>\\<guillemotleft>j) (Suc k) \\<noteq> (\\<pi>'\\<guillemotleft>j') (Suc k')\\<close> using converged_cd_diverge by blast\n  \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (j+k) = cs\\<^bsup>\\<pi>'\\<^esup> (j'+k')\\<close> using shifted_cs_eq_is_eq[OF assms(1-3) csk] .\n  moreover\n  have \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j+k\\<close> using lcdk assms(1,2,4) by (metis add.commute add_diff_cancel_right' cd_path_shift le_add1)\n  moreover\n  have \\<open>\\<pi> (Suc (j+k)) \\<noteq> \\<pi>' (Suc (j'+ k'))\\<close> using suc by auto\n  moreover\n  have \\<open>j \\<le> j+k\\<close> by auto\n  ultimately\n  show \\<open>thesis\\<close> using that[of \\<open>j+k\\<close> \\<open>j'+k'\\<close>] by auto\nqed\n\n\nlemma cs_ipd_conv: assumes csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and ipd: \\<open>\\<pi> l = ipd (\\<pi> k)\\<close> \\<open>\\<pi>' l' = ipd(\\<pi>' k')\\<close> \n  and nipd: \\<open>\\<forall>n\\<in>{k..<l}. \\<pi> n \\<noteq> ipd (\\<pi> k)\\<close> \\<open>\\<forall>n'\\<in>{k'..<l'}. \\<pi>' n' \\<noteq> ipd (\\<pi>' k')\\<close> and kl: \\<open>k < l\\<close> \\<open>k' < l'\\<close> \nshows \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> using cs_ipd[OF ipd(1) nipd(1) kl(1)] cs_ipd[OF ipd(2) nipd(2) kl(2)] csk ipd by (metis (no_types) last_cs)\n\nlemma cp_eq_cs: assumes \\<open>((\\<sigma>,k),(\\<sigma>',k'))\\<in>cp\\<close> shows \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close> \n  using assms \n  apply(induction rule: cp.induct) \n     apply blast+ \n  apply simp \n  done \n\nlemma cd_cs_swap: assumes \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> shows \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> proof -\n  have \\<open>\\<exists> i. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> using assms(1) excd_impl_exicd by blast\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> l \\<noteq> [\\<pi> l]\\<close> by auto\n  hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' \\<noteq> [\\<pi>' l']\\<close> using assms last_cs by metis\n  hence \\<open>\\<exists> i'. l' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'\\<close> by (metis cs_cases)\n  hence path': \\<open>is_path \\<pi>'\\<close> unfolding is_icdi_def is_cdi_def by auto\n  from cd_in_cs[OF assms(1)]\n  obtain ys where csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>\\<^esup> k @ ys @ [\\<pi> l]\\<close> by blast\n  obtain xs where csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = xs@[\\<pi> k]\\<close> by (metis append_butlast_last_id cs_not_nil last_cs)\n  have \\<pi>l: \\<open>\\<pi> l = \\<pi>' l'\\<close> using assms last_cs by metis\n  have csl': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = xs@[\\<pi> k]@ys@[\\<pi>' l']\\<close> by (metis \\<pi>l append_eq_appendI assms(2) csk csl)\n  from cs_split[of \\<open>\\<pi>'\\<close> \\<open>l'\\<close> \\<open>xs\\<close> \\<open>\\<pi> k\\<close> \\<open>ys\\<close>]\n  obtain m where csm: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> m = xs @ [\\<pi> k]\\<close> and lcdm: \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m\\<close> using csl' by metis \n  have csm': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> by (metis assms(3) csk csm)\n  have \\<open>\\<pi>' m \\<noteq> return\\<close> using lcdm unfolding is_cdi_def using term_path_stable by (metis nat_less_le)\n  hence \\<open>m = k'\\<close> using cs_inj path' csm' by auto\n  thus \\<open>?thesis\\<close> using lcdm by auto\nqed\n\n\nsubsection \\<open>Facts about Observations\\<close>\nlemma kth_obs_not_none: assumes \\<open>is_kth_obs (path \\<sigma>) k i\\<close> obtains a where \\<open>obsp \\<sigma> i = Some a\\<close> using assms unfolding is_kth_obs_def obsp_def by auto\n\nlemma kth_obs_unique: \\<open>is_kth_obs \\<pi> k i \\<Longrightarrow> is_kth_obs \\<pi> k j \\<Longrightarrow> i = j\\<close> proof (induction \\<open>i\\<close> \\<open>j\\<close> rule: nat_sym_cases)\n  case sym thus \\<open>?case\\<close> by simp\nnext\n  case eq thus \\<open>?case\\<close> by simp\nnext\n  case (less i j) \n  have \\<open>obs_ids \\<pi> \\<inter> {..<i} \\<subseteq> obs_ids \\<pi> \\<inter> {..<j}\\<close> using less(1) by auto\n  moreover\n  have \\<open>i \\<in> obs_ids \\<pi> \\<inter> {..<j}\\<close> using less unfolding is_kth_obs_def obs_ids_def by auto\n  moreover  \n  have \\<open>i \\<notin> obs_ids \\<pi> \\<inter> {..<i}\\<close> by auto\n  moreover \n  have \\<open>card (obs_ids \\<pi> \\<inter> {..<i}) = card (obs_ids \\<pi> \\<inter> {..<j})\\<close> using less.prems unfolding is_kth_obs_def by auto\n  moreover\n  have \\<open>finite (obs_ids \\<pi> \\<inter> {..<i})\\<close> \\<open>finite (obs_ids \\<pi> \\<inter> {..<j})\\<close> by auto\n  ultimately \n  have \\<open>False\\<close> by (metis card_subset_eq)\n  thus \\<open>?case\\<close> ..\nqed\n\nlemma obs_none_no_kth_obs: assumes \\<open>obs \\<sigma> k = None\\<close> shows \\<open>\\<not> (\\<exists> i. is_kth_obs (path \\<sigma>) k i)\\<close> \n  apply rule\n  using assms \n  unfolding obs_def obsp_def \n  apply (auto split: option.split_asm)  \n  by (metis assms kth_obs_not_none kth_obs_unique obs_def option.distinct(2) the_equality)\n\nlemma obs_some_kth_obs : assumes \\<open>obs \\<sigma> k \\<noteq> None\\<close> obtains i where \\<open>is_kth_obs (path \\<sigma>) k i\\<close> by (metis obs_def assms)\n\nlemma not_none_is_obs: assumes \\<open>att(\\<pi> i) \\<noteq> None\\<close> shows \\<open>is_kth_obs \\<pi> (card (obs_ids \\<pi> \\<inter> {..<i})) i\\<close>  unfolding is_kth_obs_def using assms by auto\n\nlemma in_obs_ids_is_kth_obs: assumes \\<open>i \\<in> obs_ids \\<pi>\\<close> obtains k where \\<open>is_kth_obs \\<pi> k i\\<close> proof \n  have \\<open>att (\\<pi> i) \\<noteq> None\\<close> using assms obs_ids_def by auto \n  thus \\<open>is_kth_obs \\<pi> (card (obs_ids \\<pi> \\<inter> {..<i})) i\\<close> using not_none_is_obs by auto\nqed\n\nlemma kth_obs_stable: assumes \\<open>is_kth_obs \\<pi> l j\\<close> \\<open>k < l\\<close> shows \\<open>\\<exists> i. is_kth_obs \\<pi> k i\\<close> using assms proof (induction \\<open>l\\<close> arbitrary: \\<open>j\\<close> rule: less_induct )\n  case (less l j)\n  have cardl: \\<open>card (obs_ids \\<pi> \\<inter> {..<j}) = l\\<close> using less is_kth_obs_def by auto\n  then obtain i where  ex: \\<open>i \\<in> obs_ids \\<pi> \\<inter> {..<j}\\<close> (is \\<open>?P i\\<close>) using less(3) by (metis card.empty empty_iff less_irrefl subsetI subset_antisym zero_diff zero_less_diff)\n  have bound: \\<open>\\<forall> i. i \\<in> obs_ids \\<pi> \\<inter> {..<j} \\<longrightarrow> i \\<le> j\\<close> by auto\n  let \\<open>?i\\<close> = \\<open>GREATEST i. i \\<in> obs_ids \\<pi> \\<inter> {..<j}\\<close>\n  have *: \\<open>?i < j\\<close> \\<open>?i \\<in> obs_ids \\<pi>\\<close> using GreatestI_nat[of \\<open>?P\\<close> \\<open>i\\<close> \\<open>j\\<close>] ex bound by auto\n  have **: \\<open>\\<forall> i. i \\<in> obs_ids \\<pi> \\<and> i<j \\<longrightarrow> i \\<le> ?i\\<close> using Greatest_le_nat[of \\<open>?P\\<close> _ \\<open>j\\<close>] ex bound by auto\n  have \\<open>(obs_ids \\<pi> \\<inter> {..<?i}) \\<union> {?i} = obs_ids \\<pi> \\<inter> {..<j}\\<close> apply rule apply auto using *[simplified] apply simp+ using **[simplified] by auto\n  moreover\n  have \\<open>?i \\<notin> (obs_ids \\<pi> \\<inter> {..<?i})\\<close> by auto\n  ultimately\n  have \\<open>Suc (card (obs_ids \\<pi> \\<inter> {..<?i})) = l\\<close> using cardl by (metis Un_empty_right Un_insert_right card_insert_disjoint finite_Int finite_lessThan)\n  hence \\<open>card (obs_ids \\<pi> \\<inter> {..<?i}) = l - 1\\<close> by auto\n  hence iko: \\<open>is_kth_obs \\<pi> (l - 1) ?i\\<close> using *(2) unfolding is_kth_obs_def obs_ids_def by auto\n  have ll: \\<open>l - 1 < l\\<close> by (metis One_nat_def diff_Suc_less less.prems(2) not_gr0 not_less0)\n  note IV=less(1)[OF ll iko]\n  show \\<open>?thesis\\<close> proof cases\n    assume \\<open>k < l - 1\\<close> thus \\<open>?thesis\\<close> using IV by simp\n  next\n    assume \\<open>\\<not> k < l - 1\\<close>\n    hence \\<open>k = l - 1\\<close> using less by auto\n    thus \\<open>?thesis\\<close> using iko by blast\n  qed\nqed\n\nlemma kth_obs_mono: assumes \\<open>is_kth_obs \\<pi> k i\\<close> \\<open>is_kth_obs \\<pi> l j\\<close> \\<open>k < l\\<close> shows \\<open>i < j\\<close> proof (rule ccontr)\n  assume \\<open>\\<not> i < j\\<close>\n  hence \\<open>{..<j} \\<subseteq> {..<i}\\<close> by auto\n  hence \\<open>obs_ids \\<pi> \\<inter> {..<j} \\<subseteq> obs_ids \\<pi> \\<inter> {..<i}\\<close> by auto\n  moreover \n  have \\<open>finite (obs_ids \\<pi> \\<inter> {..<i})\\<close> by auto\n  ultimately\n  have \\<open>card (obs_ids \\<pi> \\<inter> {..<j}) \\<le> card (obs_ids \\<pi> \\<inter> {..<i})\\<close> by (metis card_mono)\n  thus \\<open>False\\<close> using assms unfolding is_kth_obs_def by auto\nqed\n\nlemma kth_obs_le_iff: assumes \\<open>is_kth_obs \\<pi> k i\\<close> \\<open>is_kth_obs \\<pi> l j\\<close>  shows \\<open>k < l \\<longleftrightarrow> i < j\\<close> by (metis assms kth_obs_unique kth_obs_mono not_less_iff_gr_or_eq)\n\nlemma ret_obs_all_obs: assumes path: \\<open>is_path \\<pi>\\<close> and iki: \\<open>is_kth_obs \\<pi> k i\\<close> and ret: \\<open>\\<pi> i = return\\<close> and kl: \\<open>k < l\\<close> obtains j where \\<open>is_kth_obs \\<pi> l j\\<close>\nproof-\n  show \\<open>thesis\\<close>\n  using kl iki ret proof (induction \\<open>l - k\\<close> arbitrary: \\<open>k\\<close> \\<open>i\\<close> rule: less_induct)\n    case (less k i)\n    note kl = \\<open>k < l\\<close>\n    note iki = \\<open>is_kth_obs \\<pi> k i\\<close>\n    note ret = \\<open>\\<pi> i = return\\<close>  \n    have card: \\<open>card (obs_ids \\<pi> \\<inter> {..<i}) = k\\<close> and att_ret: \\<open>att return \\<noteq> None\\<close>using iki ret unfolding is_kth_obs_def by auto\n    have rets: \\<open>\\<pi> (Suc i) = return\\<close> using path ret term_path_stable by auto\n    hence attsuc: \\<open>att (\\<pi> (Suc i)) \\<noteq> None\\<close> using att_ret by auto\n    hence *: \\<open>i \\<in> obs_ids \\<pi>\\<close> using att_ret ret unfolding obs_ids_def by auto\n    have \\<open>{..< Suc i} = insert i {..<i}\\<close> by auto\n    hence a: \\<open>obs_ids \\<pi> \\<inter> {..< Suc i} = insert i (obs_ids \\<pi> \\<inter> {..<i})\\<close> using * by auto\n    have b: \\<open>i \\<notin> obs_ids \\<pi> \\<inter> {..<i}\\<close> by auto\n    have \\<open>finite (obs_ids \\<pi> \\<inter> {..<i})\\<close> by auto\n    hence \\<open>card (obs_ids \\<pi> \\<inter> {..<Suc i}) = Suc k\\<close> by (metis card card_insert_disjoint a b)\n    hence iksuc: \\<open>is_kth_obs \\<pi> (Suc k) (Suc i)\\<close> using attsuc unfolding is_kth_obs_def by auto\n    have suckl: \\<open>Suc k \\<le> l\\<close> using kl by auto\n    note less\n    thus \\<open>thesis\\<close> proof (cases \\<open>Suc k < l\\<close>) \n      assume skl: \\<open>Suc k < l\\<close> \n      from less(1)[OF _ skl iksuc rets] skl\n      show \\<open>thesis\\<close> by auto\n    next\n      assume \\<open>\\<not> Suc k < l\\<close>\n      hence \\<open>Suc k = l\\<close> using suckl by auto\n      thus \\<open>thesis\\<close> using iksuc that by auto\n    qed\n  qed\nqed\n\nlemma no_kth_obs_missing_cs: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and iki: \\<open>is_kth_obs \\<pi> k i\\<close> and not_in_\\<pi>': \\<open>\\<not>(\\<exists>i'. is_kth_obs \\<pi>' k i')\\<close>  obtains  l j where \\<open>is_kth_obs \\<pi> l j\\<close> \\<open>\\<not> (\\<exists> j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> thesis\\<close>\n  hence all_in_\\<pi>': \\<open>\\<forall> l j. is_kth_obs \\<pi> l j \\<longrightarrow> (\\<exists> j' . cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> using that by blast\n  then obtain i' where csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using assms by blast    \n  hence \\<open>att(\\<pi>' i') \\<noteq> None\\<close> using iki by (metis is_kth_obs_def last_cs)\n  then obtain k' where ik': \\<open>is_kth_obs \\<pi>' k' i'\\<close> by (metis not_none_is_obs)\n  hence kk': \\<open>k' < k\\<close> using not_in_\\<pi>' kth_obs_stable by (auto, metis not_less_iff_gr_or_eq)\n  show \\<open>False\\<close> proof (cases \\<open>\\<pi> i = return\\<close>)\n    assume \\<open>\\<pi> i \\<noteq> return\\<close>\n    thus \\<open>False\\<close> using kk' ik' csi iki proof (induction \\<open>k\\<close> arbitrary: \\<open>i\\<close> \\<open>i'\\<close> \\<open>k'\\<close> )\n      case 0 thus \\<open>?case\\<close> by simp\n    next\n      case (Suc k i i' k')      \n      then obtain j where ikj: \\<open>is_kth_obs \\<pi> k j\\<close> by (metis kth_obs_stable lessI)\n      then obtain j' where csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using all_in_\\<pi>' by blast    \n      hence \\<open>att(\\<pi>' j') \\<noteq> None\\<close> using ikj by (metis is_kth_obs_def last_cs)\n      then obtain k2 where ik2: \\<open>is_kth_obs \\<pi>' k2 j'\\<close> by (metis not_none_is_obs)\n      have ji: \\<open>j < i\\<close> using kth_obs_mono [OF ikj \\<open>is_kth_obs \\<pi> (Suc k) i\\<close>] by auto\n      hence nretj: \\<open>\\<pi> j \\<noteq> return\\<close> using Suc(2) term_path_stable less_imp_le path(1) by metis    \n      have ji': \\<open>j' < i'\\<close> using cs_order[OF path _ _ nretj, of \\<open>j'\\<close> \\<open>i\\<close> \\<open>i'\\<close>] csj \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>  ji by auto\n      have \\<open>k2 \\<noteq> k'\\<close> using ik2 Suc(4) ji' kth_obs_unique[of \\<open>\\<pi>'\\<close> \\<open>k'\\<close> \\<open>i'\\<close> \\<open>j'\\<close>] by (metis less_irrefl)\n      hence k2k': \\<open>k2 < k'\\<close> using kth_obs_mono[OF \\<open>is_kth_obs \\<pi>' k' i'\\<close> ik2] ji' by (metis not_less_iff_gr_or_eq)\n      hence k2k: \\<open>k2 < k\\<close> using Suc by auto\n      from Suc.IH[OF nretj k2k ik2 csj ikj] show \\<open>False\\<close> .\n    qed\n  next\n    assume \\<open>\\<pi> i = return\\<close>\n    hence reti': \\<open>\\<pi>' i' = return\\<close> by (metis csi last_cs)\n    from ret_obs_all_obs[OF path(2) ik' reti' kk', of \\<open>False\\<close>] not_in_\\<pi>'\n    show \\<open>False\\<close> by blast\n  qed\nqed\n\nlemma kth_obs_cs_missing_cs:  assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and iki: \\<open>is_kth_obs \\<pi> k i\\<close> and iki': \\<open>is_kth_obs \\<pi>' k i'\\<close> and csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> \nobtains l j where \\<open>j \\<le> i\\<close> \\<open>is_kth_obs \\<pi> l j\\<close> \\<open>\\<not> (\\<exists> j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> | l' j' where \\<open>j' \\<le> i'\\<close> \\<open>is_kth_obs \\<pi>' l' j'\\<close> \\<open>\\<not> (\\<exists> j. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\nproof (rule ccontr)\n  assume nt: \\<open>\\<not> thesis\\<close> \n  show \\<open>False\\<close> using iki iki' csi that proof (induction \\<open>k\\<close> arbitrary: \\<open>i\\<close> \\<open>i'\\<close> rule: less_induct)\n    case (less k i i')\n    hence all_in_\\<pi>': \\<open>\\<forall> l j. j\\<le>i \\<and> is_kth_obs \\<pi> l j \\<longrightarrow> (\\<exists> j' . cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> \n    and all_in_\\<pi>: \\<open>\\<forall> l' j'. j' \\<le> i' \\<and> is_kth_obs \\<pi>' l' j' \\<longrightarrow> (\\<exists> j . cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> by (metis nt) (metis nt less(6))\n    obtain j j' where csji: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> and csij: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using all_in_\\<pi> all_in_\\<pi>' less by blast \n    then obtain l l' where ilj: \\<open>is_kth_obs \\<pi> l j\\<close> and ilj': \\<open>is_kth_obs \\<pi>' l' j'\\<close> by (metis is_kth_obs_def last_cs less.prems(1,2))\n    have lnk: \\<open>l \\<noteq> k\\<close> using ilj csji less(2) less(4) kth_obs_unique by auto\n    have lnk': \\<open>l' \\<noteq> k\\<close> using ilj' csij less(3) less(4) kth_obs_unique by auto\n    have cseq: \\<open>\\<forall> l j j'. l < k \\<and>  is_kth_obs \\<pi> l j \\<and> is_kth_obs \\<pi>' l j' \\<longrightarrow> cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> proof - \n      { fix t p p' assume tk: \\<open>t < k\\<close> and ikp: \\<open>is_kth_obs \\<pi> t p\\<close> and ikp': \\<open>is_kth_obs \\<pi>' t p'\\<close> \n        hence pi: \\<open>p < i\\<close> and pi': \\<open>p' < i'\\<close> by (metis kth_obs_mono less.prems(1)) (metis kth_obs_mono less.prems(2) tk ikp') \n        have *: \\<open>\\<And>j l. j \\<le> p \\<Longrightarrow> is_kth_obs \\<pi> l j \\<Longrightarrow> \\<exists>j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using pi all_in_\\<pi>' by auto\n        have **: \\<open>\\<And>j' l'. j' \\<le> p' \\<Longrightarrow> is_kth_obs \\<pi>' l' j' \\<Longrightarrow> \\<exists>j. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using pi' all_in_\\<pi> by auto\n        have \\<open>cs\\<^bsup>\\<pi>\\<^esup> p = cs\\<^bsup>\\<pi>'\\<^esup> p'\\<close> apply(rule ccontr) using less(1)[OF tk ikp ikp'] * ** by blast\n      }\n      thus \\<open>?thesis\\<close> by blast\n    qed\n    have ii'nret: \\<open>\\<pi> i \\<noteq> return \\<or> \\<pi>' i' \\<noteq> return\\<close> using less cs_return by auto\n    have a: \\<open>k < l \\<or> k < l'\\<close> proof (rule ccontr)\n      assume \\<open>\\<not>(k < l \\<or> k < l')\\<close> \n      hence *: \\<open>l < k\\<close> \\<open>l' < k\\<close> using lnk lnk' by auto\n      hence ji: \\<open>j < i\\<close> and ji': \\<open>j' < i'\\<close> using ilj ilj' less(2,3) kth_obs_mono by auto      \n      show \\<open>False\\<close> using ii'nret proof\n        assume nreti: \\<open>\\<pi> i \\<noteq> return\\<close>\n        hence nretj': \\<open>\\<pi>' j' \\<noteq> return\\<close> using last_cs csij by metis\n        show \\<open>False\\<close> using cs_order[OF path(2,1) csij[symmetric] csji[symmetric] nretj' ji'] ji by simp\n      next\n        assume nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close>\n        hence nretj': \\<open>\\<pi> j \\<noteq> return\\<close> using last_cs csji by metis\n        show \\<open>False\\<close> using cs_order[OF path csji csij nretj' ji] ji' by simp\n      qed\n    qed\n    have \\<open>l < k \\<or> l' < k\\<close> proof (rule ccontr)\n      assume \\<open>\\<not> (l< k \\<or> l' < k)\\<close>\n      hence \\<open>k < l\\<close> \\<open>k < l'\\<close> using lnk lnk' by auto\n      hence ji: \\<open>i < j\\<close> and ji': \\<open>i' < j'\\<close> using ilj ilj' less(2,3) kth_obs_mono by auto\n      show \\<open>False\\<close> using ii'nret proof\n        assume nreti: \\<open>\\<pi> i \\<noteq> return\\<close>\n        show \\<open>False\\<close> using cs_order[OF path csij csji nreti ji]  ji' by simp\n      next\n        assume nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close>\n        show \\<open>False\\<close> using cs_order[OF path(2,1) csji[symmetric] csij[symmetric] nreti' ji'] ji by simp\n      qed\n    qed    \n    hence \\<open>k < l \\<and> l' < k \\<or> k < l' \\<and> l < k\\<close> using a by auto\n    thus \\<open>False\\<close> proof\n      assume \\<open>k < l \\<and> l' < k\\<close>\n      hence kl: \\<open>k < l\\<close> and lk': \\<open>l' < k\\<close> by auto    \n      hence ij: \\<open>i < j\\<close> and ji': \\<open>j' < i'\\<close> using less(2,3) ilj ilj' kth_obs_mono by auto      \n      have nreti: \\<open>\\<pi> i \\<noteq> return\\<close> by (metis csji ii'nret ij last_cs path(1) term_path_stable less_imp_le)\n      obtain h where ilh: \\<open>is_kth_obs \\<pi> l' h\\<close> using ji' all_in_\\<pi> ilj' no_kth_obs_missing_cs path(1) path(2) by (metis kl lk' ilj kth_obs_stable)\n      hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> h = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using cseq lk' ilj' by blast\n      hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> h\\<close> using csij by auto\n      hence hi: \\<open>h = i\\<close> using cs_inj nreti path(1) by metis      \n      have \\<open>l' = k\\<close> using less(2) ilh unfolding hi by (metis is_kth_obs_def)      \n      thus \\<open>False\\<close> using lk' by simp\n    next\n      assume \\<open>k < l' \\<and> l < k\\<close>\n      hence kl': \\<open>k < l'\\<close> and lk: \\<open>l < k\\<close> by auto    \n      hence ij': \\<open>i' < j'\\<close> and ji: \\<open>j < i\\<close> using less(2,3) ilj ilj' kth_obs_mono by auto      \n      have nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close> by (metis csij ii'nret ij' last_cs path(2) term_path_stable less_imp_le)\n      obtain h' where ilh': \\<open>is_kth_obs \\<pi>' l h'\\<close> using all_in_\\<pi>' ilj no_kth_obs_missing_cs path(1) path(2) kl' lk ilj' kth_obs_stable by metis\n      hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> h'\\<close> using cseq lk ilj by blast\n      hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>'\\<^esup> h'\\<close> using csji by auto\n      hence hi: \\<open>h' = i'\\<close> using cs_inj nreti' path(2) by metis      \n      have \\<open>l = k\\<close> using less(3) ilh' unfolding hi by (metis is_kth_obs_def)      \n      thus \\<open>False\\<close> using lk by simp\n    qed\n  qed\nqed\n\n\nsubsection \\<open>Facts about Data\\<close>\n\nlemma reads_restrict1: \\<open>\\<sigma> \\<restriction> (reads n) = \\<sigma>' \\<restriction> (reads n) \\<Longrightarrow> \\<forall> x \\<in> reads n. \\<sigma> x = \\<sigma>' x\\<close> by (metis restrict_def)\n\nlemma reads_restrict2: \\<open>\\<forall> x \\<in> reads n. \\<sigma> x = \\<sigma>' x \\<Longrightarrow> \\<sigma> \\<restriction> (reads n) = \\<sigma>' \\<restriction> (reads n)\\<close>  unfolding restrict_def by auto\n\nlemma reads_restrict: \\<open>(\\<sigma> \\<restriction> (reads n) = \\<sigma>' \\<restriction> (reads n)) = (\\<forall> x \\<in> reads n. \\<sigma> x = \\<sigma>' x)\\<close> using reads_restrict1 reads_restrict2 by metis\n\nlemma reads_restr_suc: \\<open>\\<sigma> \\<restriction> (reads n) = \\<sigma>' \\<restriction> (reads n) \\<Longrightarrow> suc n \\<sigma> = suc n \\<sigma>'\\<close> by (metis reads_restrict uses_suc)\n\nlemma reads_restr_sem: \\<open>\\<sigma> \\<restriction> (reads n) = \\<sigma>' \\<restriction> (reads n) \\<Longrightarrow> \\<forall> v \\<in> writes n. sem n \\<sigma> v = sem n \\<sigma>' v\\<close> by (metis reads_restrict1 uses_writes)\n\nlemma reads_obsp: assumes \\<open>path \\<sigma> k = path \\<sigma>' k'\\<close> \\<open>\\<sigma>\\<^bsup>k\\<^esup> \\<restriction> (reads (path \\<sigma> k)) = \\<sigma>'\\<^bsup>k'\\<^esup> \\<restriction> (reads (path \\<sigma> k))\\<close> shows \\<open>obsp \\<sigma> k = obsp \\<sigma>' k'\\<close> \n  using assms(2) uses_att \n  unfolding obsp_def assms(1) reads_restrict \n  apply (cases \\<open>att (path \\<sigma>' k')\\<close>)  \n  by auto\n\nlemma no_writes_unchanged0: assumes \\<open>\\<forall> l<k. v\\<notin> writes(path \\<sigma> l)\\<close> shows \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v = \\<sigma> v\\<close> using assms \nproof (induction \\<open>k\\<close>)\n  case 0 thus \\<open>?case\\<close> by(auto simp add: kth_state_def) \nnext\n  case (Suc k)\n  hence \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v = \\<sigma> v\\<close> by auto\n  moreover \n  have \\<open>\\<sigma>\\<^bsup>Suc k\\<^esup>  = snd ( step (path \\<sigma> k,\\<sigma>\\<^bsup>k\\<^esup>))\\<close> by (metis kth_state_suc)\n  hence \\<open>\\<sigma>\\<^bsup>Suc k\\<^esup>  = sem (path \\<sigma> k) (\\<sigma>\\<^bsup>k\\<^esup>)\\<close> by (metis step_suc_sem snd_conv)\n  moreover\n  have \\<open>v \\<notin> writes (path \\<sigma> k)\\<close> using Suc.prems by blast\n  ultimately \n  show \\<open>?case\\<close> using writes by metis\nqed\n\nlemma written_read_dd: assumes \\<open>is_path \\<pi>\\<close> \\<open>v \\<in> reads (\\<pi> k) \\<close> \\<open>v \\<in> writes (\\<pi> j)\\<close> \\<open>j<k\\<close> obtains l where \\<open>k dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> l\\<close> \nproof -\n  let \\<open>?l\\<close> = \\<open>GREATEST l. l < k \\<and> v \\<in> writes (\\<pi> l)\\<close>\n  have \\<open>?l < k\\<close> by (metis (no_types, lifting) GreatestI_ex_nat assms(3) assms(4) less_or_eq_imp_le)\n  moreover\n  have \\<open>v \\<in> writes (\\<pi> ?l)\\<close> by (metis (no_types, lifting) GreatestI_nat assms(3) assms(4) less_or_eq_imp_le) \n  hence \\<open>v \\<in> reads (\\<pi> k) \\<inter> writes (\\<pi> ?l)\\<close> using assms(2) by auto\n  moreover\n  note is_ddi_def\n  have \\<open>\\<forall> l \\<in> {?l<..<k}. v \\<notin> writes (\\<pi> l)\\<close> by (auto, metis (lifting, no_types) Greatest_le_nat le_antisym nat_less_le)\n  ultimately \n  have \\<open>k dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> ?l\\<close> using assms(1) unfolding is_ddi_def by blast\n  thus \\<open>thesis\\<close> using that by simp\nqed\n\nlemma no_writes_unchanged: assumes \\<open>k \\<le> l\\<close> \\<open>\\<forall> j \\<in> {k..<l}. v\\<notin> writes(path \\<sigma> j)\\<close> shows \\<open>(\\<sigma>\\<^bsup>l\\<^esup>) v = (\\<sigma>\\<^bsup>k\\<^esup>) v\\<close> using assms\nproof (induction \\<open>l - k\\<close> arbitrary: \\<open>l\\<close>)\n  case 0 thus \\<open>?case\\<close> by(auto) \nnext\n  case (Suc lk l)\n  hence kl: \\<open>k < l\\<close> by auto\n  then obtain l' where lsuc: \\<open>l = Suc l'\\<close> using lessE by blast\n  hence \\<open>lk = l' - k\\<close> using Suc by auto\n  moreover \n  have \\<open>\\<forall> j \\<in> {k..<l'}. v \\<notin> writes (path \\<sigma> j)\\<close> using Suc(4) lsuc by auto\n  ultimately  \n  have \\<open>(\\<sigma>\\<^bsup>l'\\<^esup>) v = (\\<sigma>\\<^bsup>k\\<^esup>) v\\<close> using Suc(1)[of \\<open>l'\\<close>] lsuc kl by fastforce\n  moreover \n  have \\<open>\\<sigma>\\<^bsup>l\\<^esup> = snd ( step (path \\<sigma> l',\\<sigma>\\<^bsup>l'\\<^esup>))\\<close> by (metis kth_state_suc lsuc)\n  hence \\<open>\\<sigma>\\<^bsup>l\\<^esup> = sem (path \\<sigma> l') (\\<sigma>\\<^bsup>l'\\<^esup>)\\<close> by (metis step_suc_sem snd_conv)\n  moreover\n  have \\<open>l' < l\\<close> \\<open>k \\<le> l'\\<close> using kl lsuc by auto\n  hence \\<open>v \\<notin> writes (path \\<sigma> l')\\<close> using Suc.prems(2) by auto\n  ultimately \n  show \\<open>?case\\<close> using writes by metis\nqed\n\nlemma ddi_value: assumes \\<open>l dd\\<^bsup>(path \\<sigma>),v\\<^esup>\\<rightarrow> k\\<close> shows \\<open>(\\<sigma>\\<^bsup>l\\<^esup>) v = (\\<sigma>\\<^bsup>Suc k\\<^esup> ) v\\<close>\nusing assms no_writes_unchanged[of \\<open>Suc k\\<close> \\<open>l\\<close> \\<open>v\\<close> \\<open>\\<sigma>\\<close>] unfolding is_ddi_def by auto\n\nlemma written_value: assumes \\<open>path \\<sigma> l = path \\<sigma>' l'\\<close> \\<open>\\<sigma>\\<^bsup>l\\<^esup> \\<restriction> reads (path \\<sigma> l) = \\<sigma>'\\<^bsup>l'\\<^esup> \\<restriction> reads (path \\<sigma> l)\\<close> \\<open>v \\<in> writes (path \\<sigma> l)\\<close> \nshows \\<open>(\\<sigma>\\<^bsup>Suc l\\<^esup> ) v = (\\<sigma>'\\<^bsup>Suc l'\\<^esup> ) v\\<close> \nby (metis assms reads_restr_sem snd_conv step_suc_sem kth_state_suc) \n\n\nsubsection \\<open>Facts about Contradicting Paths\\<close>\n\nlemma obsp_contradict: assumes csk: \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close> and obs: \\<open>obsp \\<sigma> k \\<noteq> obsp \\<sigma>' k'\\<close> shows \\<open>(\\<sigma>', k') \\<cc> (\\<sigma>, k)\\<close>\nproof -\n  have pk: \\<open>path \\<sigma> k = path \\<sigma>' k'\\<close> using assms last_cs by metis\n  hence \\<open>\\<sigma>\\<^bsup>k\\<^esup>\\<restriction>(reads (path \\<sigma> k)) \\<noteq> \\<sigma>'\\<^bsup>k'\\<^esup>\\<restriction>(reads (path \\<sigma> k))\\<close> using obs reads_obsp[OF pk] by auto\n  thus \\<open>(\\<sigma>',k') \\<cc> (\\<sigma>,k)\\<close> using contradicts.intros(2)[OF csk[symmetric]] by auto\nqed\n\nlemma missing_cs_contradicts: assumes notin: \\<open>\\<not>(\\<exists> k'. cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k')\\<close> and converge: \\<open>k<n\\<close> \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> n = cs\\<^bsup>path \\<sigma>'\\<^esup> n'\\<close> shows \\<open>\\<exists> j'. (\\<sigma>', j') \\<cc> (\\<sigma>, k)\\<close>\nproof -\n  let \\<open>?\\<pi>\\<close> = \\<open>path \\<sigma>\\<close>\n  let \\<open>?\\<pi>'\\<close> = \\<open>path \\<sigma>'\\<close>\n  have init: \\<open>?\\<pi> 0 = ?\\<pi>' 0\\<close> unfolding path_def by auto\n  have path: \\<open>is_path ?\\<pi>\\<close> \\<open>is_path ?\\<pi>'\\<close> using path_is_path by auto\n  obtain j j' where csj: \\<open>cs\\<^bsup>?\\<pi>\\<^esup> j = cs\\<^bsup>?\\<pi>'\\<^esup> j'\\<close> and cd: \\<open>k cd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow>j\\<close> and suc: \\<open>?\\<pi> (Suc j) \\<noteq> ?\\<pi>' (Suc j')\\<close> using converged_cd_diverge[OF path init notin converge] .\n  have less: \\<open>cs\\<^bsup>?\\<pi>\\<^esup> j \\<prec> cs\\<^bsup>?\\<pi>\\<^esup> k\\<close> using cd cd_is_cs_less by auto\n  have nretj: \\<open>?\\<pi> j \\<noteq> return\\<close> by (metis cd is_cdi_def term_path_stable less_imp_le)\n  have cs: \\<open>?\\<pi> \\<exclamdown> cs\\<^bsup>?\\<pi>'\\<^esup> j' = j\\<close> using csj cs_select_id nretj path_is_path by metis\n  have \\<open>(\\<sigma>',j') \\<cc> (\\<sigma>,k)\\<close> using contradicts.intros(1)[of \\<open>?\\<pi>'\\<close> \\<open>j'\\<close> \\<open>?\\<pi>\\<close> \\<open>k\\<close> \\<open>\\<sigma>\\<close> \\<open>\\<sigma>'\\<close>,unfolded cs] less suc csj by metis\n  thus \\<open>?thesis\\<close> by blast\nqed\n\ntheorem obs_neq_contradicts_term: fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> assumes ret: \\<open>\\<pi> n = return\\<close> \\<open>\\<pi>' n' = return\\<close> and obsne: \\<open>obs \\<sigma> \\<noteq> obs \\<sigma>'\\<close> \nshows \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom (att)) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom (att))\\<close>\nproof - \n  have path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> using \\<pi> \\<pi>' path_is_path by auto\n  obtain k1 where neq: \\<open>obs \\<sigma> k1 \\<noteq> obs \\<sigma>' k1\\<close> using obsne ext[of \\<open>obs \\<sigma>\\<close> \\<open>obs \\<sigma>'\\<close>] by blast  \n  hence \\<open>(\\<exists>k i i'. is_kth_obs \\<pi> k i \\<and> is_kth_obs \\<pi>' k i' \\<and> obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i' \\<and> cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i') \n  \\<or> (\\<exists> k i. is_kth_obs \\<pi> k i \\<and> \\<not> (\\<exists> i'. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')) \n  \\<or> (\\<exists> k i'. is_kth_obs \\<pi>' k i' \\<and> \\<not> (\\<exists> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))\\<close>\n  proof(cases rule: option_neq_cases)\n    case (none2 x)\n    have notin\\<pi>': \\<open>\\<not> (\\<exists> l. is_kth_obs \\<pi>' k1 l)\\<close> using none2(2) \\<pi>' obs_none_no_kth_obs by auto\n    obtain i where in\\<pi>: \\<open>is_kth_obs \\<pi> k1 i\\<close> using obs_some_kth_obs[of \\<open>\\<sigma>\\<close> \\<open>k1\\<close>] none2(1) \\<pi> by auto            \n    obtain l j where \\<open>is_kth_obs \\<pi> l j\\<close> \\<open>\\<not> (\\<exists> j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> using path in\\<pi> notin\\<pi>' by (metis no_kth_obs_missing_cs)\n    thus \\<open>?thesis\\<close> by blast\n  next\n    case (none1 x)\n    have notin\\<pi>: \\<open>\\<not> (\\<exists> l. is_kth_obs \\<pi> k1 l)\\<close> using none1(1) \\<pi> obs_none_no_kth_obs by auto\n    obtain i' where in\\<pi>': \\<open>is_kth_obs \\<pi>' k1 i'\\<close> using obs_some_kth_obs[of \\<open>\\<sigma>'\\<close> \\<open>k1\\<close>] none1(2) \\<pi>' by auto            \n    obtain l j where \\<open>is_kth_obs \\<pi>' l j\\<close> \\<open>\\<not> (\\<exists> j'. cs\\<^bsup>\\<pi>\\<^esup> j' = cs\\<^bsup>\\<pi>'\\<^esup> j)\\<close> using path in\\<pi>' notin\\<pi> by (metis no_kth_obs_missing_cs)\n    thus \\<open>?thesis\\<close> by blast\n  next  \n    case (some x y)\n    obtain i where in\\<pi>: \\<open>is_kth_obs \\<pi> k1 i\\<close> using obs_some_kth_obs[of \\<open>\\<sigma>\\<close> \\<open>k1\\<close>] some \\<pi> by auto\n    obtain i' where in\\<pi>': \\<open>is_kth_obs \\<pi>' k1 i'\\<close> using obs_some_kth_obs[of \\<open>\\<sigma>'\\<close> \\<open>k1\\<close>] some \\<pi>' by auto\n    show \\<open>?thesis\\<close> proof (cases)\n      assume *: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>\n      have \\<open>obsp \\<sigma> i = obs \\<sigma> k1\\<close> by (metis obs_def \\<pi> in\\<pi> kth_obs_unique the_equality)\n      moreover\n      have \\<open>obsp \\<sigma>' i' = obs \\<sigma>' k1\\<close> by (metis obs_def \\<pi>' in\\<pi>' kth_obs_unique the_equality)\n      ultimately\n      have \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i'\\<close> using neq by auto\n      thus \\<open>?thesis\\<close> using * in\\<pi> in\\<pi>' by blast\n    next\n      assume *: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>\n      note kth_obs_cs_missing_cs[OF path in\\<pi> in\\<pi>' *]\n      thus \\<open>?thesis\\<close> by metis\n    qed\n  qed\n  thus \\<open>?thesis\\<close> proof (cases rule: three_cases)\n    case 1\n    then obtain k i i' where iki: \\<open>is_kth_obs \\<pi> k i\\<close> \\<open>is_kth_obs \\<pi>' k i'\\<close> and obsne: \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i'\\<close> and csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> by auto\n    note obsp_contradict[OF csi[unfolded \\<pi> \\<pi>'] obsne]\n    moreover\n    have \\<open>\\<pi> i \\<in> dom att\\<close> using iki unfolding is_kth_obs_def by auto\n    ultimately\n    show \\<open>?thesis\\<close> by blast\n  next\n    case 2\n    then obtain k i where iki: \\<open>is_kth_obs \\<pi> k i\\<close> and notin\\<pi>': \\<open>\\<not> (\\<exists>i'. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')\\<close> by auto\n    let \\<open>?n\\<close> = \\<open>Suc (max n i)\\<close>\n    have nn: \\<open>n < ?n\\<close> by auto\n    have iln: \\<open>i < ?n\\<close> by auto\n    have retn: \\<open>\\<pi> ?n = return\\<close> using ret term_path_stable path by auto\n    hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> using ret(2) cs_return by auto\n    then obtain i' where \\<open>(\\<sigma>',i') \\<cc> (\\<sigma>,i)\\<close> using missing_cs_contradicts[OF notin\\<pi>'[unfolded \\<pi> \\<pi>'] iln] \\<pi> \\<pi>' by auto\n    moreover\n    have \\<open>\\<pi> i \\<in> dom att\\<close> using iki is_kth_obs_def by auto\n    ultimately\n    show \\<open>?thesis\\<close> by blast\n  next\n    case 3\n    then obtain k i' where iki: \\<open>is_kth_obs \\<pi>' k i'\\<close> and notin\\<pi>': \\<open>\\<not> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')\\<close> by auto\n    let \\<open>?n\\<close> = \\<open>Suc (max n' i')\\<close>\n    have nn: \\<open>n' < ?n\\<close> by auto\n    have iln: \\<open>i' < ?n\\<close> by auto\n    have retn: \\<open>\\<pi>' ?n = return\\<close> using ret term_path_stable path by auto\n    hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> ?n\\<close> using ret(1) cs_return by auto\n    then obtain i where \\<open>(\\<sigma>,i) \\<cc> (\\<sigma>',i')\\<close> using missing_cs_contradicts notin\\<pi>' iln \\<pi> \\<pi>' by metis\n    moreover\n    have \\<open>\\<pi>' i' \\<in> dom att\\<close> using iki is_kth_obs_def by auto\n    ultimately\n    show \\<open>?thesis\\<close> by blast\n  qed\nqed\n\nlemma obs_neq_some_contradicts': fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \nassumes obsnecs: \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i' \\<or> cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>\nand iki: \\<open>is_kth_obs \\<pi> k i\\<close> and iki': \\<open>is_kth_obs \\<pi>' k i'\\<close>\nshows \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom att) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom att)\\<close>\nusing obsnecs iki iki' proof (induction \\<open>k\\<close> arbitrary: \\<open>i\\<close> \\<open>i'\\<close> rule: less_induct )\n  case (less k i i')  \n  note iki = \\<open>is_kth_obs \\<pi> k i\\<close>\n  and iki' = \\<open>is_kth_obs \\<pi>' k i'\\<close>\n  have domi: \\<open>\\<pi> i \\<in> dom att\\<close> by (metis is_kth_obs_def domIff iki)\n  have domi': \\<open>\\<pi>' i' \\<in> dom att\\<close> by (metis is_kth_obs_def domIff iki')\n  note obsnecs = \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i' \\<or> cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>  \n  show \\<open>?thesis\\<close> proof cases\n    assume csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>\n    hence *: \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i'\\<close> using obsnecs by auto\n    note obsp_contradict[OF _ *] csi domi \\<pi> \\<pi>'\n    thus \\<open>?thesis\\<close> by blast    \n  next      \n    assume ncsi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>  \n    have path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> using \\<pi> \\<pi>' path_is_path by auto\n    have \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> unfolding \\<pi> \\<pi>' path_def by auto\n    note kth_obs_cs_missing_cs[of \\<open>\\<pi>\\<close> \\<open>\\<pi>'\\<close> \\<open>k\\<close> \\<open>i\\<close> \\<open>i'\\<close>] \\<pi> \\<pi>' path_is_path iki iki' ncsi \n    hence \\<open>(\\<exists> l j .j \\<le> i \\<and> is_kth_obs \\<pi> l j \\<and> \\<not> (\\<exists> j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')) \\<or> (\\<exists> l' j'. j' \\<le> i' \\<and> is_kth_obs \\<pi>' l' j' \\<and> \\<not> (\\<exists> j. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'))\\<close> by metis\n    thus \\<open>?thesis\\<close> proof\n      assume \\<open>\\<exists>l j. j \\<le> i \\<and> is_kth_obs \\<pi> l j \\<and> \\<not> (\\<exists>j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\n      then obtain l j where ji: \\<open>j\\<le>i\\<close> and iobs: \\<open>is_kth_obs \\<pi> l j\\<close> and notin: \\<open>\\<not> (\\<exists>j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> by blast\n      have dom: \\<open>\\<pi> j \\<in> dom att\\<close> using iobs is_kth_obs_def by auto\n      obtain n n' where nj: \\<open>n < j\\<close> and csn: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and sucn:  \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close> and cdloop: \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n \\<or> (\\<forall> j'> n'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n')\\<close>\n      using missing_cd_or_loop[OF path \\<pi>0 notin] by blast\n      show \\<open>?thesis\\<close> using cdloop proof\n        assume cdjn: \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close>\n        hence csnj: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n' \\<prec> cs\\<^bsup>\\<pi>\\<^esup> j\\<close> using csn by (metis cd_is_cs_less)\n        have cssel: \\<open>\\<pi> (Suc (\\<pi> \\<exclamdown> cs\\<^bsup>\\<pi>'\\<^esup> n')) = \\<pi> (Suc n)\\<close> using csn by (metis cdjn cd_not_ret cs_select_id path(1))\n        have \\<open>(\\<sigma>',n') \\<cc> (\\<sigma>,j)\\<close> using csnj apply(rule contradicts.intros(1)) using cssel \\<pi> \\<pi>' sucn by auto \n        thus \\<open>?thesis\\<close> using dom by auto\n      next\n        assume loop: \\<open>\\<forall> j'>n'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close>\n        show \\<open>?thesis\\<close> proof cases\n          assume in': \\<open>i' \\<le> n'\\<close>\n          have nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close> by( metis le_eq_less_or_eq lessI loop not_le path(2) ret_no_cd term_path_stable)\n          show \\<open>?thesis\\<close> proof cases\n            assume \\<open>\\<exists> \\<iota>. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> \\<iota>\\<close>\n            then obtain \\<iota> where cs\\<iota>: \\<open>cs\\<^bsup>\\<pi>\\<^esup> \\<iota> = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> by metis            \n            have \\<iota>n: \\<open>\\<iota> \\<le> n\\<close> using cs_order_le[OF path(2,1) cs\\<iota>[symmetric] csn[symmetric] nreti' in'] .\n            hence \\<iota>i: \\<open>\\<iota> < i\\<close> using nj ji by auto \n            have dom\\<iota>: \\<open>\\<pi> \\<iota> \\<in> dom att\\<close> using domi' cs\\<iota> last_cs by metis\n            obtain \\<kappa> where i\\<kappa>\\<iota>: \\<open>is_kth_obs \\<pi> \\<kappa> \\<iota>\\<close> using dom\\<iota> by (metis is_kth_obs_def domIff)\n            hence \\<kappa>k: \\<open>\\<kappa> < k\\<close> using \\<iota>i iki by (metis kth_obs_le_iff)\n            obtain \\<iota>' where i\\<kappa>\\<iota>': \\<open>is_kth_obs \\<pi>' \\<kappa> \\<iota>'\\<close> using \\<kappa>k iki' by (metis kth_obs_stable)\n            have \\<open>\\<iota>' < i'\\<close> using \\<kappa>k iki' i\\<kappa>\\<iota>' by (metis kth_obs_le_iff)\n            hence cs\\<iota>': \\<open>cs\\<^bsup>\\<pi>\\<^esup> \\<iota> \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>'\\<close> unfolding cs\\<iota> using cs_inj[OF path(2) nreti', of \\<open>\\<iota>'\\<close>] by blast           \n            thus \\<open>?thesis\\<close> using less(1)[OF \\<kappa>k _ i\\<kappa>\\<iota> i\\<kappa>\\<iota>'] by auto\n          next\n            assume notin'': \\<open>\\<not>(\\<exists> \\<iota>. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> \\<iota>)\\<close>\n            obtain \\<iota> \\<iota>' where \\<iota>i': \\<open>\\<iota>' < i'\\<close> and cs\\<iota>: \\<open>cs\\<^bsup>\\<pi>\\<^esup> \\<iota> = cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>'\\<close> and suc\\<iota>: \\<open>\\<pi> (Suc \\<iota>) \\<noteq> \\<pi>' (Suc \\<iota>')\\<close> and cdloop': \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> \\<iota>' \\<or> (\\<forall> j>\\<iota>. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> \\<iota>)\\<close>\n            using missing_cd_or_loop[OF path(2,1) \\<pi>0[symmetric] notin''] by metis\n            show \\<open>?thesis\\<close> using cdloop' proof\n              assume cdjn: \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> \\<iota>'\\<close>\n              hence csnj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> \\<iota> \\<prec> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using cs\\<iota> by (metis cd_is_cs_less)\n              have cssel: \\<open>\\<pi>' (Suc (\\<pi>' \\<exclamdown> cs\\<^bsup>\\<pi>\\<^esup> \\<iota>)) = \\<pi>' (Suc \\<iota>')\\<close> using cs\\<iota> by (metis cdjn cd_not_ret cs_select_id path(2))\n              have \\<open>(\\<sigma>,\\<iota>) \\<cc> (\\<sigma>',i')\\<close> using csnj apply(rule contradicts.intros(1)) using cssel \\<pi> \\<pi>' suc\\<iota> by auto \n              thus \\<open>?thesis\\<close> using domi' by auto\n            next\n              assume loop': \\<open>\\<forall> j>\\<iota>. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> \\<iota>\\<close>\n              have \\<iota>n': \\<open>\\<iota>' < n'\\<close> using in' \\<iota>i' by auto\n              have nret\\<iota>': \\<open>\\<pi>' \\<iota>' \\<noteq> return\\<close> by (metis cs\\<iota> last_cs le_eq_less_or_eq lessI path(1) path(2) suc\\<iota> term_path_stable)\n              have \\<open>\\<iota> < n\\<close> using cs_order[OF path(2,1) cs\\<iota>[symmetric] csn[symmetric] nret\\<iota>' \\<iota>n'] .\n              hence \\<open>\\<iota> < i\\<close> using nj ji by auto\n              hence cdi\\<iota>: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> \\<iota>\\<close> using loop' by auto\n              hence cs\\<iota>i: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>' \\<prec> cs\\<^bsup>\\<pi>\\<^esup> i\\<close> using cs\\<iota> by (metis cd_is_cs_less)\n              have cssel: \\<open>\\<pi> (Suc (\\<pi> \\<exclamdown> cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>')) = \\<pi> (Suc \\<iota>)\\<close> using cs\\<iota> by (metis cdi\\<iota> cd_not_ret cs_select_id path(1))\n              have \\<open>(\\<sigma>',\\<iota>') \\<cc> (\\<sigma>,i)\\<close> using cs\\<iota>i apply(rule contradicts.intros(1)) using cssel \\<pi> \\<pi>' suc\\<iota> by auto \n              thus \\<open>?thesis\\<close> using domi by auto\n            qed\n          qed\n        next\n          assume \\<open>\\<not> i' \\<le> n'\\<close>\n          hence ni': \\<open>n'< i'\\<close> by simp\n          hence cdin: \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> using loop by auto\n          hence csni: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n \\<prec> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using csn by (metis cd_is_cs_less)\n          have cssel: \\<open>\\<pi>' (Suc (\\<pi>' \\<exclamdown> cs\\<^bsup>\\<pi>\\<^esup> n)) = \\<pi>' (Suc n')\\<close> using csn by (metis cdin cd_not_ret cs_select_id path(2))\n          have \\<open>(\\<sigma>,n) \\<cc> (\\<sigma>',i')\\<close> using csni apply(rule contradicts.intros(1)) using cssel \\<pi> \\<pi>' sucn by auto \n          thus \\<open>?thesis\\<close> using domi' by auto\n        qed\n      qed\n    next\n      \\<comment> \\<open>Symmetric case as above, indices might be messy.\\<close>\n      assume \\<open>\\<exists>l j. j \\<le> i' \\<and> is_kth_obs \\<pi>' l j \\<and> \\<not> (\\<exists>j'. cs\\<^bsup>\\<pi>\\<^esup> j' = cs\\<^bsup>\\<pi>'\\<^esup> j)\\<close>\n      then obtain l j where ji': \\<open>j\\<le>i'\\<close> and iobs: \\<open>is_kth_obs \\<pi>' l j\\<close> and notin: \\<open>\\<not> (\\<exists>j'. cs\\<^bsup>\\<pi>'\\<^esup> j = cs\\<^bsup>\\<pi>\\<^esup> j')\\<close> by metis\n      have dom: \\<open>\\<pi>' j \\<in> dom att\\<close> using iobs is_kth_obs_def by auto\n      obtain n n' where nj: \\<open>n < j\\<close> and csn: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n = cs\\<^bsup>\\<pi>\\<^esup> n'\\<close> and sucn:  \\<open>\\<pi>' (Suc n) \\<noteq> \\<pi> (Suc n')\\<close> and cdloop: \\<open>j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n \\<or> (\\<forall> j'> n'. j' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n')\\<close>\n      using missing_cd_or_loop[OF path(2,1) \\<pi>0[symmetric] ] notin by metis\n      show \\<open>?thesis\\<close> using cdloop proof\n        assume cdjn: \\<open>j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n\\<close>\n        hence csnj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n' \\<prec> cs\\<^bsup>\\<pi>'\\<^esup> j\\<close> using csn by (metis cd_is_cs_less)\n        have cssel: \\<open>\\<pi>' (Suc (\\<pi>' \\<exclamdown> cs\\<^bsup>\\<pi>\\<^esup> n')) = \\<pi>' (Suc n)\\<close> using csn by (metis cdjn cd_not_ret cs_select_id path(2))\n        have \\<open>(\\<sigma>,n') \\<cc> (\\<sigma>',j)\\<close> using csnj apply(rule contradicts.intros(1)) using cssel \\<pi>' \\<pi> sucn by auto \n        thus \\<open>?thesis\\<close> using dom by auto\n      next\n        assume loop: \\<open>\\<forall> j'>n'. j' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n'\\<close>\n        show \\<open>?thesis\\<close> proof cases\n          assume in': \\<open>i \\<le> n'\\<close>\n          have nreti: \\<open>\\<pi> i \\<noteq> return\\<close> by (metis le_eq_less_or_eq lessI loop not_le path(1) ret_no_cd term_path_stable)\n          show \\<open>?thesis\\<close> proof cases\n            assume \\<open>\\<exists> \\<iota>. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>\\<close>\n            then obtain \\<iota> where cs\\<iota>: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> \\<iota> = cs\\<^bsup>\\<pi>\\<^esup> i\\<close> by metis            \n            have \\<iota>n: \\<open>\\<iota> \\<le> n\\<close> using cs_order_le[OF path cs\\<iota>[symmetric] csn[symmetric] nreti in'] .\n            hence \\<iota>i': \\<open>\\<iota> < i'\\<close> using nj ji' by auto \n            have dom\\<iota>: \\<open>\\<pi>' \\<iota> \\<in> dom att\\<close> using domi cs\\<iota> last_cs by metis\n            obtain \\<kappa> where i\\<kappa>\\<iota>: \\<open>is_kth_obs \\<pi>' \\<kappa> \\<iota>\\<close> using dom\\<iota> by (metis is_kth_obs_def domIff)\n            hence \\<kappa>k: \\<open>\\<kappa> < k\\<close> using \\<iota>i' iki' by (metis kth_obs_le_iff)\n            obtain \\<iota>' where i\\<kappa>\\<iota>': \\<open>is_kth_obs \\<pi> \\<kappa> \\<iota>'\\<close> using \\<kappa>k iki by (metis kth_obs_stable)\n            have \\<open>\\<iota>' < i\\<close> using \\<kappa>k iki i\\<kappa>\\<iota>' by (metis kth_obs_le_iff)\n            hence cs\\<iota>': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> \\<iota> \\<noteq> cs\\<^bsup>\\<pi>\\<^esup> \\<iota>'\\<close> unfolding cs\\<iota> using cs_inj[OF path(1) nreti, of \\<open>\\<iota>'\\<close>] by blast           \n            thus \\<open>?thesis\\<close> using less(1)[OF \\<kappa>k _ i\\<kappa>\\<iota>' i\\<kappa>\\<iota>] by auto\n          next\n            assume notin'': \\<open>\\<not>(\\<exists> \\<iota>. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>)\\<close>\n            obtain \\<iota> \\<iota>' where \\<iota>i: \\<open>\\<iota>' < i\\<close> and cs\\<iota>: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> \\<iota> = cs\\<^bsup>\\<pi>\\<^esup> \\<iota>'\\<close> and suc\\<iota>: \\<open>\\<pi>' (Suc \\<iota>) \\<noteq> \\<pi> (Suc \\<iota>')\\<close> and cdloop': \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> \\<iota>' \\<or> (\\<forall> j>\\<iota>. j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> \\<iota>)\\<close>\n            using missing_cd_or_loop[OF path \\<pi>0 notin''] by metis\n            show \\<open>?thesis\\<close> using cdloop' proof\n              assume cdjn: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> \\<iota>'\\<close>\n              hence csnj: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> \\<iota> \\<prec> cs\\<^bsup>\\<pi>\\<^esup> i\\<close> using cs\\<iota> by (metis cd_is_cs_less)\n              have cssel: \\<open>\\<pi> (Suc (\\<pi> \\<exclamdown> cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>)) = \\<pi> (Suc \\<iota>')\\<close> using cs\\<iota> by (metis cdjn cd_not_ret cs_select_id path(1))\n              have \\<open>(\\<sigma>',\\<iota>) \\<cc> (\\<sigma>,i)\\<close> using csnj apply(rule contradicts.intros(1)) using cssel \\<pi>' \\<pi> suc\\<iota> by auto \n              thus \\<open>?thesis\\<close> using domi by auto\n            next\n              assume loop': \\<open>\\<forall> j>\\<iota>. j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> \\<iota>\\<close>\n              have \\<iota>n': \\<open>\\<iota>' < n'\\<close> using in' \\<iota>i by auto\n              have nret\\<iota>': \\<open>\\<pi> \\<iota>' \\<noteq> return\\<close> by (metis cs\\<iota> last_cs le_eq_less_or_eq lessI path(1) path(2) suc\\<iota> term_path_stable)\n              have \\<open>\\<iota> < n\\<close> using cs_order[OF path cs\\<iota>[symmetric] csn[symmetric] nret\\<iota>' \\<iota>n'] .\n              hence \\<open>\\<iota> < i'\\<close> using nj ji' by auto\n              hence cdi\\<iota>: \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> \\<iota>\\<close> using loop' by auto\n              hence cs\\<iota>i': \\<open>cs\\<^bsup>\\<pi>\\<^esup> \\<iota>' \\<prec> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using cs\\<iota> by (metis cd_is_cs_less)\n              have cssel: \\<open>\\<pi>' (Suc (\\<pi>' \\<exclamdown> cs\\<^bsup>\\<pi>\\<^esup> \\<iota>')) = \\<pi>' (Suc \\<iota>)\\<close> using cs\\<iota> by (metis cdi\\<iota> cd_not_ret cs_select_id path(2))\n              have \\<open>(\\<sigma>,\\<iota>') \\<cc> (\\<sigma>',i')\\<close> using cs\\<iota>i' apply(rule contradicts.intros(1)) using cssel \\<pi>' \\<pi> suc\\<iota> by auto \n              thus \\<open>?thesis\\<close> using domi' by auto\n            qed\n          qed\n        next\n          assume \\<open>\\<not> i \\<le> n'\\<close>\n          hence ni: \\<open>n'< i\\<close> by simp\n          hence cdin: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n'\\<close> using loop by auto\n          hence csni': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n \\<prec> cs\\<^bsup>\\<pi>\\<^esup> i\\<close> using csn by (metis cd_is_cs_less)\n          have cssel: \\<open>\\<pi> (Suc (\\<pi> \\<exclamdown> cs\\<^bsup>\\<pi>'\\<^esup> n)) = \\<pi> (Suc n')\\<close> using csn by (metis cdin cd_not_ret cs_select_id path(1))\n          have \\<open>(\\<sigma>',n) \\<cc> (\\<sigma>,i)\\<close> using csni' apply(rule contradicts.intros(1)) using cssel \\<pi>' \\<pi> sucn by auto \n          thus \\<open>?thesis\\<close> using domi by auto\n        qed\n      qed\n    qed\n  qed\nqed\n\ntheorem obs_neq_some_contradicts: fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \nassumes obsne: \\<open>obs \\<sigma> k \\<noteq> obs \\<sigma>' k\\<close> and not_none: \\<open>obs \\<sigma> k \\<noteq> None\\<close> \\<open>obs \\<sigma>' k \\<noteq> None\\<close> \nshows \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom att) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom att)\\<close>\nproof -\n  obtain i where iki: \\<open>is_kth_obs \\<pi> k i\\<close> using not_none(1) by (metis \\<pi> obs_some_kth_obs)\n  obtain i' where iki': \\<open>is_kth_obs \\<pi>' k i'\\<close> using not_none(2) by (metis \\<pi>' obs_some_kth_obs)\n  have \\<open>obsp \\<sigma> i = obs \\<sigma> k\\<close> by (metis \\<pi> iki kth_obs_unique obs_def the_equality)\n  moreover\n  have \\<open>obsp \\<sigma>' i' = obs \\<sigma>' k\\<close> by (metis \\<pi>' iki' kth_obs_unique obs_def the_equality)\n  ultimately\n  have obspne: \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i'\\<close> using obsne by auto\n  show \\<open>?thesis\\<close> using obs_neq_some_contradicts'[OF _ iki[unfolded \\<pi>] iki'[unfolded \\<pi>']] using obspne \\<pi> \\<pi>' by metis\nqed\n\ntheorem obs_neq_ret_contradicts: fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \nassumes ret: \\<open>\\<pi> n = return\\<close> and obsne: \\<open>obs \\<sigma>' i \\<noteq> obs \\<sigma> i\\<close> and obs:\\<open>obs \\<sigma>' i \\<noteq> None\\<close>\nshows \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom (att)) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom (att))\\<close>\nproof (cases \\<open>\\<exists> j k'. is_kth_obs \\<pi>' j k' \\<and> (\\<nexists> k. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close>)\n  case True\n  obtain l k' where jk': \\<open>is_kth_obs \\<pi>' l k'\\<close> and unmatched: \\<open>(\\<nexists> k. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close> using True by blast\n  have \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> using \\<pi> \\<pi>' path0 by auto\n  obtain j j' where csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> and cd: \\<open>k' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow>j'\\<close> and suc: \\<open>\\<pi> (Suc j) \\<noteq> \\<pi>' (Suc j')\\<close>\n    using converged_cd_diverge_return[of \\<open>\\<pi>'\\<close> \\<open>\\<pi>\\<close> \\<open>k'\\<close> \\<open>n\\<close>] ret unmatched path_is_path \\<pi> \\<pi>' \\<pi>0 by metis \n  hence *: \\<open>(\\<sigma>, j) \\<cc> (\\<sigma>' ,k')\\<close> using contradicts.intros(1)[of \\<open>\\<pi>\\<close> \\<open>j\\<close> \\<open>\\<pi>'\\<close> \\<open>k'\\<close> \\<open>\\<sigma>'\\<close> \\<open>\\<sigma>\\<close>, unfolded csj] \\<pi> \\<pi>'\n    using cd_is_cs_less cd_not_ret cs_select_id by auto \n  have \\<open>\\<pi>' k' \\<in> dom(att)\\<close> using jk' by (meson domIff is_kth_obs_def) \n  thus \\<open>?thesis\\<close> using * by blast\nnext\n  case False\n  hence *: \\<open>\\<And> j k'. is_kth_obs \\<pi>' j k' \\<Longrightarrow> \\<exists> k. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> by auto\n  obtain k' where k': \\<open>is_kth_obs \\<pi>' i k'\\<close> using obs \\<pi>' obs_some_kth_obs by blast\n  obtain l where \\<open>is_kth_obs \\<pi> i l\\<close> using * \\<pi> \\<pi>' k' no_kth_obs_missing_cs path_is_path by metis\n  thus \\<open>?thesis\\<close> using \\<pi> \\<pi>' obs obs_neq_some_contradicts obs_none_no_kth_obs obsne by metis\nqed\n\n\nsubsection \\<open>Facts about Critical Observable Paths\\<close>\n\nlemma contradicting_in_cp: assumes leq:\\<open>\\<sigma> =\\<^sub>L \\<sigma>'\\<close> and cseq: \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close> \nand readv: \\<open>v\\<in>reads(path \\<sigma> k)\\<close> and vneq: \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v\\<close> shows \\<open>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp\\<close>\n  using cseq readv vneq proof(induction \\<open>k+k'\\<close> arbitrary: \\<open>k\\<close> \\<open>k'\\<close> \\<open>v\\<close> rule: less_induct)\n  fix k k' v     \n  assume csk: \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close>\n  assume vread: \\<open>v \\<in> reads (path \\<sigma> k)\\<close>\n  assume vneq: \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v\\<close>\n  assume IH: \\<open>\\<And>ka k'a v. ka + k'a < k + k' \\<Longrightarrow> cs\\<^bsup>path \\<sigma>\\<^esup> ka = cs\\<^bsup>path \\<sigma>'\\<^esup> k'a \\<Longrightarrow> v \\<in> reads (path \\<sigma> ka) \\<Longrightarrow> (\\<sigma>\\<^bsup>ka\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'a\\<^esup>) v \\<Longrightarrow> ((\\<sigma>, ka), \\<sigma>', k'a) \\<in> cp\\<close> \n  \n  define \\<pi> where  \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> \n  define \\<pi>' where \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \n  have path: \\<open>\\<pi> = path \\<sigma>\\<close> \\<open>\\<pi>' = path \\<sigma>'\\<close> using \\<pi>_def \\<pi>'_def path_is_path by auto  \n  have ip: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> using path path_is_path by auto\n            \n  have \\<pi>0: \\<open>\\<pi>' 0 = \\<pi> 0\\<close> unfolding path path_def by auto\n  have vread': \\<open>v \\<in> reads (path \\<sigma>' k')\\<close> using csk vread by (metis last_cs)\n  have cseq: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using csk path by simp\n  \n  show \\<open>((\\<sigma>, k), \\<sigma>', k') \\<in> cp\\<close> proof cases\n    assume vnw: \\<open>\\<forall> l < k. v\\<notin>writes (\\<pi> l)\\<close>\n    hence \\<sigma>v: \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v = \\<sigma> v\\<close> by (metis no_writes_unchanged0 path(1))\n    show \\<open>?thesis\\<close> proof cases\n      assume vnw': \\<open>\\<forall> l < k'. v\\<notin>writes (\\<pi>' l)\\<close>\n      hence \\<sigma>v': \\<open>(\\<sigma>'\\<^bsup>k'\\<^esup>) v = \\<sigma>' v\\<close> by (metis no_writes_unchanged0 path(2))\n      with \\<sigma>v vneq have \\<open>\\<sigma> v \\<noteq> \\<sigma>' v\\<close> by auto\n      hence vhigh: \\<open>v \\<in> hvars\\<close> using leq unfolding loweq_def restrict_def by (auto,metis)\n      thus \\<open>?thesis\\<close> using cp.intros(1)[OF leq csk vread vneq] vnw vnw' path by simp\n    next\n      assume \\<open>\\<not>(\\<forall> l < k'. v\\<notin>writes (\\<pi>' l))\\<close>\n      then obtain l' where kddl': \\<open>k' dd\\<^bsup>\\<pi>',v\\<^esup>\\<rightarrow> l'\\<close> using path(2) path_is_path written_read_dd vread' by blast\n      hence lv': \\<open>v \\<in> writes (\\<pi>' l')\\<close> unfolding is_ddi_def by auto\n      have lk': \\<open>l' < k'\\<close> by (metis is_ddi_def kddl')\n      have nret: \\<open>\\<pi>' l' \\<noteq> return\\<close> using lv' writes_return by auto\n      \n      have notin\\<pi>: \\<open>\\<not> (\\<exists>l. cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> l)\\<close> proof\n        assume \\<open>\\<exists>l. cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> l\\<close>\n        then guess l ..\n        note csl = \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> l\\<close>\n        have lk: \\<open>l < k\\<close> using lk' cseq ip cs_order[of \\<open>\\<pi>'\\<close> \\<open>\\<pi>\\<close> \\<open>l'\\<close> \\<open>l\\<close> \\<open>k'\\<close> \\<open>k\\<close>] csl nret path by force\n                  \n        have \\<open>v \\<in> writes (\\<pi> l)\\<close> using csl lv' last_cs by metis\n        thus \\<open>False\\<close> using lk vnw by blast\n      qed\n\n      from converged_cd_diverge[OF ip(2,1) \\<pi>0 notin\\<pi> lk' cseq]\n      obtain i i' where  csi: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i\\<close> and lcdi: \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'\\<close>  and div: \\<open>\\<pi>' (Suc i') \\<noteq> \\<pi> (Suc i)\\<close> .\n      \n      have 1: \\<open>\\<pi> (Suc i) = suc (\\<pi> i) (\\<sigma>\\<^bsup>i\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n      have 2: \\<open>\\<pi>' (Suc i') = suc (\\<pi>' i') (\\<sigma>'\\<^bsup>i'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n      have 3: \\<open>\\<pi>' i' = \\<pi> i\\<close> using csi last_cs by metis\n      have nreads: \\<open>\\<sigma>\\<^bsup>i\\<^esup> \\<restriction> reads (\\<pi> i) \\<noteq> \\<sigma>'\\<^bsup>i'\\<^esup> \\<restriction> reads (\\<pi> i)\\<close> by (metis 1 2 3 div reads_restr_suc)\n      then obtain v' where v'read: \\<open>v'\\<in> reads(path \\<sigma> i)\\<close> \\<open>(\\<sigma>\\<^bsup>i\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>i'\\<^esup>) v'\\<close> unfolding path by (metis reads_restrict)\n      \n      have nreti: \\<open>\\<pi>' i' \\<noteq> return\\<close> by (metis csi div ip(1) ip(2) last_cs lessI term_path_stable less_imp_le)\n      have ik': \\<open>i' < k'\\<close> using lcdi lk' is_cdi_def by auto            \n      have ik: \\<open>i < k\\<close> using cs_order[OF ip(2,1) csi cseq nreti ik'] .\n      \n      have cpi: \\<open>((\\<sigma>, i), (\\<sigma>', i')) \\<in> cp\\<close> using IH[of \\<open>i\\<close> \\<open>i'\\<close>] v'read csi ik ik' path by auto \n      hence cpi': \\<open>((\\<sigma>', i'), (\\<sigma>, i)) \\<in> cp\\<close> using cp.intros(4) by blast\n      \n      have nwvi: \\<open>\\<forall>j'\\<in>{LEAST i'. i < i' \\<and> (\\<exists>i. cs\\<^bsup>path \\<sigma>'\\<^esup> i = cs\\<^bsup>path \\<sigma>\\<^esup> i')..<k}. v \\<notin> writes (path \\<sigma> j')\\<close> using vnw[unfolded path] \n        by (metis (poly_guards_query) atLeastLessThan_iff)\n      \n      from cp.intros(3)[OF cpi' kddl'[unfolded path] lcdi[unfolded path] csk[symmetric] div[unfolded path] vneq[symmetric] nwvi] \n      \n      show \\<open>?thesis\\<close> using cp.intros(4) by simp \n    qed\n  next\n    assume wv: \\<open>\\<not> (\\<forall> l<k. v \\<notin> writes (\\<pi> l))\\<close> \n    then obtain l where kddl: \\<open>k dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> l\\<close> using path(1) path_is_path written_read_dd vread by blast\n    hence lv: \\<open>v \\<in> writes (\\<pi> l)\\<close> unfolding is_ddi_def by auto\n    have lk: \\<open>l < k\\<close> by (metis is_ddi_def kddl)\n    have nret: \\<open>\\<pi> l \\<noteq> return\\<close> using lv writes_return by auto\n    have nwb: \\<open>\\<forall> i \\<in> {Suc l..< k}. v\\<notin>writes(\\<pi> i)\\<close> using kddl unfolding is_ddi_def by auto\n    have \\<sigma>vk: \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v = (\\<sigma>\\<^bsup>Suc l\\<^esup> ) v\\<close> using kddl ddi_value path(1) by auto\n\n    show \\<open>?thesis\\<close> proof cases\n      assume vnw': \\<open>\\<forall> l < k'. v\\<notin>writes (\\<pi>' l)\\<close>\n      hence \\<sigma>v': \\<open>(\\<sigma>'\\<^bsup>k'\\<^esup>) v = \\<sigma>' v\\<close> by (metis no_writes_unchanged0 path(2))\n\n      have notin\\<pi>': \\<open>\\<not> (\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l')\\<close> proof\n        assume \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\n        then guess l' ..\n        note csl = \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\n        have lk: \\<open>l' < k'\\<close> using lk cseq ip cs_order[of \\<open>\\<pi>\\<close> \\<open>\\<pi>'\\<close> \\<open>l\\<close> \\<open>l'\\<close> \\<open>k\\<close> \\<open>k'\\<close>] csl nret by metis\n                  \n        have \\<open>v \\<in> writes (\\<pi>' l')\\<close> using csl lv last_cs by metis\n        thus \\<open>False\\<close> using lk vnw' by blast\n      qed\n\n      from converged_cd_diverge[OF ip(1,2) \\<pi>0[symmetric] notin\\<pi>' lk cseq[symmetric]]\n      obtain i i' where  csi: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i\\<close> and lcdi: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close>  and div: \\<open>\\<pi> (Suc i) \\<noteq> \\<pi>' (Suc i')\\<close> by metis\n      \n      have 1: \\<open>\\<pi> (Suc i) = suc (\\<pi> i) (\\<sigma>\\<^bsup>i\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n      have 2: \\<open>\\<pi>' (Suc i') = suc (\\<pi>' i') (\\<sigma>'\\<^bsup>i'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n      have 3: \\<open>\\<pi>' i' = \\<pi> i\\<close> using csi last_cs by metis\n      have nreads: \\<open>\\<sigma>\\<^bsup>i\\<^esup> \\<restriction> reads (\\<pi> i) \\<noteq> \\<sigma>'\\<^bsup>i'\\<^esup> \\<restriction> reads (\\<pi> i)\\<close> by (metis 1 2 3 div reads_restr_suc)\n      have contri: \\<open>(\\<sigma>',i') \\<cc> (\\<sigma>,i)\\<close> using contradicts.intros(2)[OF csi path nreads] .\n      \n      have nreti: \\<open>\\<pi> i \\<noteq> return\\<close> by (metis csi div ip(1) ip(2) last_cs lessI term_path_stable less_imp_le)\n      have ik: \\<open>i < k\\<close> using lcdi lk is_cdi_def by auto            \n      have ik': \\<open>i' < k'\\<close> using cs_order[OF ip(1,2) csi[symmetric] cseq[symmetric] nreti ik] .\n      have nreads: \\<open>\\<sigma>\\<^bsup>i\\<^esup> \\<restriction> reads (\\<pi> i) \\<noteq> \\<sigma>'\\<^bsup>i'\\<^esup> \\<restriction> reads (\\<pi> i)\\<close> by (metis 1 2 3 div reads_restr_suc)\n      then obtain v' where v'read: \\<open>v'\\<in> reads(path \\<sigma> i)\\<close> \\<open>(\\<sigma>\\<^bsup>i\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>i'\\<^esup>) v'\\<close> unfolding path by (metis reads_restrict)\n      \n      \n      have cpi: \\<open>((\\<sigma>, i), (\\<sigma>', i')) \\<in> cp\\<close> using IH[of \\<open>i\\<close> \\<open>i'\\<close>] v'read csi ik ik' path by auto \n      hence cpi': \\<open>((\\<sigma>', i'), (\\<sigma>, i)) \\<in> cp\\<close> using cp.intros(4) by blast\n      \n      have vnwi: \\<open>\\<forall>j'\\<in>{LEAST i'a. i' < i'a \\<and> (\\<exists>i. cs\\<^bsup>path \\<sigma>\\<^esup> i = cs\\<^bsup>path \\<sigma>'\\<^esup> i'a)..<k'}. v \\<notin> writes (path \\<sigma>' j')\\<close> using vnw'[unfolded path]\n        by (metis (poly_guards_query) atLeastLessThan_iff)\n        \n      from cp.intros(3)[OF cpi kddl[unfolded path] lcdi[unfolded path] csk div[unfolded path] vneq vnwi]   \n      \n      show \\<open>?thesis\\<close> using cp.intros(4) by simp\n    next\n      assume \\<open>\\<not> (\\<forall> l<k'. v \\<notin> writes (\\<pi>' l))\\<close>\n      then obtain l' where kddl': \\<open>k' dd\\<^bsup>\\<pi>',v\\<^esup>\\<rightarrow> l'\\<close> using path(2) path_is_path written_read_dd vread' by blast\n      hence lv': \\<open>v \\<in> writes (\\<pi>' l')\\<close> unfolding is_ddi_def by auto\n      have lk': \\<open>l' < k'\\<close> by (metis is_ddi_def kddl')            \n      have nretl': \\<open>\\<pi>' l' \\<noteq> return\\<close> using lv' writes_return by auto\n      have nwb': \\<open>\\<forall> i' \\<in> {Suc l'..< k'}. v\\<notin>writes(\\<pi>' i')\\<close> using kddl' unfolding is_ddi_def by auto\n      have \\<sigma>vk': \\<open>(\\<sigma>'\\<^bsup>k'\\<^esup>) v = (\\<sigma>'\\<^bsup>Suc l'\\<^esup> ) v\\<close> using kddl' ddi_value path(2) by auto\n\n      show \\<open>?thesis\\<close> proof cases \n        assume csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\n        hence \\<pi>l: \\<open>\\<pi> l = \\<pi>' l'\\<close> by (metis last_cs)\n        have \\<sigma>vls: \\<open>(\\<sigma>\\<^bsup>Suc l\\<^esup> ) v \\<noteq> (\\<sigma>'\\<^bsup>Suc l'\\<^esup> ) v\\<close> by (metis \\<sigma>vk \\<sigma>vk' vneq)\n        have r\\<sigma>: \\<open>\\<sigma>\\<^bsup>l\\<^esup> \\<restriction> reads (\\<pi> l) \\<noteq> \\<sigma>'\\<^bsup>l'\\<^esup> \\<restriction> reads (\\<pi> l)\\<close> using path \\<pi>l \\<sigma>vls written_value lv by blast\n        then obtain v' where v'read: \\<open>v'\\<in> reads(path \\<sigma> l)\\<close> \\<open>(\\<sigma>\\<^bsup>l\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>l'\\<^esup>) v'\\<close> unfolding path by (metis reads_restrict)\n      \n      \n        have cpl: \\<open>((\\<sigma>, l), (\\<sigma>', l')) \\<in> cp\\<close> using IH[of \\<open>l\\<close> \\<open>l'\\<close>] v'read csl lk lk' path by auto \n        show \\<open>((\\<sigma>, k), (\\<sigma>', k')) \\<in> cp\\<close> using cp.intros(2)[OF cpl kddl[unfolded path] kddl'[unfolded path] csk vneq] .        \n      next\n        assume csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\n        show \\<open>?thesis\\<close> proof cases\n          assume \\<open>\\<exists> i'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>\n          then obtain i' where csli': \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> by blast\n          have ilne': \\<open>i' \\<noteq> l'\\<close> using csl csli' by auto\n          have ij': \\<open>i' < k'\\<close> using cs_order[OF ip csli' cseq[symmetric] nret lk] .\n          have iv': \\<open>v \\<in> writes(\\<pi>' i')\\<close> using lv csli' last_cs by metis\n          have il': \\<open>i' < l'\\<close> using kddl' ilne' ij' iv' unfolding is_ddi_def by auto\n          have nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close> using csli' nret last_cs by metis\n\n          have l'notin\\<pi>: \\<open>\\<not>(\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> i )\\<close> proof\n            assume \\<open>\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> i\\<close>\n            then obtain i where csil: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> by metis\n            have ik: \\<open>i < k\\<close> using cs_order[OF ip(2,1) csil[symmetric] cseq nretl' lk'] .\n            have li: \\<open>l < i\\<close> using cs_order[OF ip(2,1) csli'[symmetric] csil[symmetric] nreti' il'] .\n            have iv: \\<open>v \\<in> writes(\\<pi> i)\\<close> using lv' csil last_cs by metis\n            show \\<open>False\\<close> using kddl ik li iv is_ddi_def by auto\n          qed\n          \n          obtain n n' where csn: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close>  and sucn: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close> and in': \\<open>i' \\<le> n'\\<close>\n          using converged_cd_diverge_cs [OF ip(2,1) csli'[symmetric] il' l'notin\\<pi> lk' cseq] by metis \n          \n          \\<comment> \\<open>Can apply the IH to n and n'\\<close>\n          \n          have 1: \\<open>\\<pi> (Suc n) = suc (\\<pi> n) (\\<sigma>\\<^bsup>n\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n          have 2: \\<open>\\<pi>' (Suc n') = suc (\\<pi>' n') (\\<sigma>'\\<^bsup>n'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n          have 3: \\<open>\\<pi>' n' = \\<pi> n\\<close> using csn last_cs by metis\n          have nreads: \\<open>\\<sigma>\\<^bsup>n\\<^esup> \\<restriction> reads (\\<pi> n) \\<noteq> \\<sigma>'\\<^bsup>n'\\<^esup> \\<restriction> reads (\\<pi> n)\\<close> by (metis 1 2 3 sucn reads_restr_suc)\n          then obtain v' where v'read: \\<open>v'\\<in>reads (path \\<sigma> n)\\<close> \\<open>(\\<sigma>\\<^bsup>n\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v'\\<close> by (metis path(1) reads_restrict)\n          moreover\n          have nl': \\<open>n' < l'\\<close> using lcdn' is_cdi_def by auto\n          have nk': \\<open>n' < k'\\<close> using nl' lk' by simp\n          have nretn': \\<open>\\<pi>' n' \\<noteq> return\\<close> by (metis ip(2) nl' nretl' term_path_stable less_imp_le)\n          have nk: \\<open>n < k\\<close> using cs_order[OF ip(2,1) csn[symmetric] cseq nretn' nk'] .\n          hence lenn: \\<open>n+n' < k+k'\\<close> using nk' by auto\n          ultimately  \n          have \\<open>((\\<sigma>, n), (\\<sigma>', n')) \\<in> cp\\<close> using IH csn path by auto\n          hence ncp: \\<open>((\\<sigma>', n'), (\\<sigma>, n)) \\<in> cp\\<close> using cp.intros(4) by auto\n          \n          have nles: \\<open>n < (LEAST i'. n < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> i'))\\<close> (is \\<open>_ < (LEAST i. ?P i)\\<close>) using nk cseq LeastI[of \\<open>?P\\<close> \\<open>k\\<close>] by metis\n          moreover\n          have ln: \\<open>l \\<le> n\\<close> using cs_order_le[OF ip(2,1) csli'[symmetric] csn[symmetric] nreti' in'] .\n          ultimately \n          have lles: \\<open>Suc l \\<le> (LEAST i'. n < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> i'))\\<close> by auto\n          \n          have nwcseq: \\<open>\\<forall>j'\\<in>{LEAST i'. n < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> i')..<k}. v \\<notin> writes (\\<pi> j')\\<close> proof \n            fix j' assume *: \\<open>j' \\<in> {LEAST i'. n < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> i')..<k}\\<close>\n            hence \\<open>(LEAST i'. n < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> i')) \\<le> j'\\<close> by (metis (poly_guards_query) atLeastLessThan_iff)\n            hence \\<open>Suc l \\<le> j'\\<close> using lles by auto\n            moreover\n            have \\<open>j' < k\\<close> using * by (metis (poly_guards_query) atLeastLessThan_iff) \n            ultimately have \\<open>j'\\<in> {Suc l..<k}\\<close> by (metis (poly_guards_query) atLeastLessThan_iff)\n            thus \\<open>v\\<notin>writes (\\<pi> j')\\<close> using nwb by auto\n          qed\n          \n          from cp.intros(3)[OF ncp,folded path,OF kddl' lcdn' cseq sucn[symmetric] vneq[symmetric] nwcseq]\n          have \\<open>((\\<sigma>', k'), \\<sigma>, k) \\<in> cp\\<close> .\n          thus \\<open>((\\<sigma>, k), (\\<sigma>', k')) \\<in> cp\\<close> using cp.intros(4) by auto\n        next\n          assume lnotin\\<pi>': \\<open>\\<not> (\\<exists>i'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> i')\\<close>\n          show \\<open>?thesis\\<close> proof cases\n            assume \\<open>\\<exists> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\n            then obtain i where csli: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> by blast\n            have ilne: \\<open>i \\<noteq> l\\<close> using csl csli by auto\n            have ij: \\<open>i < k\\<close> using cs_order[OF ip(2,1) csli[symmetric] cseq nretl' lk'] .\n            have iv: \\<open>v \\<in> writes(\\<pi> i)\\<close> using lv' csli last_cs by metis\n            have il: \\<open>i < l\\<close> using kddl ilne ij iv unfolding is_ddi_def by auto\n            have nreti: \\<open>\\<pi> i \\<noteq> return\\<close> using csli nretl' last_cs by metis\n\n            obtain n n' where csn: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close>  and sucn: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close> and ilen: \\<open>i \\<le> n\\<close>\n            using converged_cd_diverge_cs [OF ip csli il lnotin\\<pi>' lk cseq[symmetric]] by metis \n          \n            \\<comment> \\<open>Can apply the IH to n and n'\\<close>\n          \n            have 1: \\<open>\\<pi> (Suc n) = suc (\\<pi> n) (\\<sigma>\\<^bsup>n\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n            have 2: \\<open>\\<pi>' (Suc n') = suc (\\<pi>' n') (\\<sigma>'\\<^bsup>n'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n            have 3: \\<open>\\<pi>' n' = \\<pi> n\\<close> using csn last_cs by metis\n            have nreads: \\<open>\\<sigma>\\<^bsup>n\\<^esup> \\<restriction> reads (\\<pi> n) \\<noteq> \\<sigma>'\\<^bsup>n'\\<^esup> \\<restriction> reads (\\<pi> n)\\<close> by (metis 1 2 3 sucn reads_restr_suc)\n            then obtain v' where v'read: \\<open>v'\\<in>reads (path \\<sigma> n)\\<close> \\<open>(\\<sigma>\\<^bsup>n\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v'\\<close> by (metis path(1) reads_restrict)\n            moreover  \n            have nl: \\<open>n < l\\<close> using lcdn is_cdi_def by auto\n            have nk: \\<open>n < k\\<close> using nl lk by simp\n            have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> by (metis ip(1) nl nret term_path_stable less_imp_le)\n            have nk': \\<open>n' < k'\\<close> using cs_order[OF ip csn cseq[symmetric] nretn nk] .\n            hence lenn: \\<open>n+n' < k+k'\\<close> using nk by auto\n            ultimately  \n            have ncp: \\<open>((\\<sigma>, n), (\\<sigma>', n')) \\<in> cp\\<close> using IH csn path by auto\n            \n            have nles': \\<open>n' < (LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))\\<close> (is \\<open>_ < (LEAST i. ?P i)\\<close>) using nk' cseq LeastI[of \\<open>?P\\<close> \\<open>k'\\<close>] by metis\n            moreover\n            have ln': \\<open>l' \\<le> n'\\<close> using cs_order_le[OF ip csli csn nreti ilen] .\n            ultimately \n            have lles': \\<open>Suc l' \\<le> (LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))\\<close> by auto\n          \n            have nwcseq': \\<open>\\<forall>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}. v \\<notin> writes (\\<pi>' j')\\<close> proof \n              fix j' assume *: \\<open>j' \\<in> {(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}\\<close>\n              hence \\<open>(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')) \\<le> j'\\<close> by (metis (poly_guards_query) atLeastLessThan_iff)\n              hence \\<open>Suc l' \\<le> j'\\<close> using lles' by auto\n              moreover\n              have \\<open>j' < k'\\<close> using * by (metis (poly_guards_query) atLeastLessThan_iff) \n              ultimately have \\<open>j'\\<in> {Suc l'..<k'}\\<close> by (metis (poly_guards_query) atLeastLessThan_iff)\n              thus \\<open>v\\<notin>writes (\\<pi>' j')\\<close> using nwb' by auto\n              qed\n            \n            from cp.intros(3)[OF ncp,folded path, OF kddl lcdn cseq[symmetric] sucn vneq nwcseq']\n            \n            show \\<open>((\\<sigma>, k), (\\<sigma>', k')) \\<in> cp\\<close> .\n          next\n            assume l'notin\\<pi>: \\<open>\\<not> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> l')\\<close>\n            define m where \\<open>m \\<equiv> 0::nat\\<close>\n            define m' where \\<open>m' \\<equiv> 0::nat\\<close>\n            have csm: \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> unfolding m_def m'_def cs_0 by (metis \\<pi>0)\n            have ml: \\<open>m<l \\<or> m'<l'\\<close> using csm csl unfolding m_def m'_def by (metis neq0_conv)\n            have \\<open>\\<exists> n n'. cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n' \\<and> \\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n') \\<and> \n            (l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n \\<and> (\\<forall>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}. v\\<notin>writes (\\<pi>' j'))\n            \\<or> l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n' \\<and> (\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j)))\\<close>\n            using csm ml proof (induction \\<open>k+k'-(m+m')\\<close> arbitrary: \\<open>m\\<close> \\<open>m'\\<close> rule: less_induct)\n              case (less m m')\n              note csm = \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close>\n              note lm = \\<open>m < l \\<or> m' < l'\\<close>\n              note IH = \\<open>\\<And> n n'. \n                k + k' - (n + n') < k + k' - (m + m') \\<Longrightarrow>\n                cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n' \\<Longrightarrow>\n                n < l \\<or> n' < l' \\<Longrightarrow> ?thesis\\<close>\n              show \\<open>?thesis\\<close> using lm proof\n                assume ml: \\<open>m < l\\<close>\n                obtain n n' where mn: \\<open>m \\<le> n\\<close> and csn: \\<open> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> and suc: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close>\n                  using  converged_cd_diverge_cs[OF ip csm ml lnotin\\<pi>' lk cseq[symmetric]] .\n                have nl: \\<open>n < l\\<close> using lcdn is_cdi_def by auto\n                hence nk: \\<open>n<k\\<close> using lk by auto\n                have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> using lcdn by (metis cd_not_ret)\n                have nk': \\<open>n'<k'\\<close> using cs_order[OF ip csn cseq[symmetric] nretn nk] .\n                show \\<open>?thesis\\<close> proof cases\n                  assume \\<open>\\<forall>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}. v\\<notin>writes (\\<pi>' j')\\<close>\n                  thus \\<open>?thesis\\<close> using lcdn csn suc by blast\n                next\n                  assume \\<open>\\<not>(\\<forall>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}. v\\<notin>writes (\\<pi>' j'))\\<close>\n                  then obtain j' where jin': \\<open>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}\\<close> and vwrite: \\<open>v\\<in>writes (\\<pi>' j')\\<close> by blast\n                  define i' where \\<open>i' \\<equiv> LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')\\<close>\n                  have Pk': \\<open>n' < k' \\<and> (\\<exists> k. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close> (is \\<open>?P k'\\<close>) using nk' cseq[symmetric] by blast\n                  have ni': \\<open>n' < i'\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk'] i'_def by auto\n                  obtain i where csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk'] i'_def by blast\n                  have ij': \\<open>i'\\<le>j'\\<close> using jin'[folded i'_def] by auto\n                  have jk': \\<open>j'<k'\\<close> using jin'[folded i'_def] by auto\n                  have jl': \\<open>j' \\<le> l'\\<close> using kddl' jk' vwrite unfolding is_ddi_def by auto\n                  have nretn': \\<open>\\<pi>' n' \\<noteq> return\\<close> using nretn csn last_cs by metis\n                  have iln: \\<open>n<i\\<close> using cs_order[OF ip(2,1) csn[symmetric] csi[symmetric] nretn' ni'] .\n                  hence mi: \\<open>m < i\\<close> using mn by auto\n                  have nretm: \\<open>\\<pi> m \\<noteq> return\\<close> by (metis ip(1) mn nretn term_path_stable)\n                  have mi': \\<open>m'<i'\\<close> using cs_order[OF ip csm csi nretm mi] .\n                  have ik': \\<open>i' < k'\\<close> using ij' jk' by auto\n                  have nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close> by (metis ij' jl' nretl' ip(2) term_path_stable)\n                  have ik: \\<open>i < k\\<close> using cs_order[OF ip(2,1) csi[symmetric] cseq nreti' ik'] .\n                  show \\<open>?thesis\\<close> proof cases\n                    assume il:\\<open>i < l\\<close>\n                    have le: \\<open>k + k' - (i +i') < k+k' - (m+m')\\<close> using mi mi' ik ik' by auto\n                    show \\<open>?thesis\\<close> using IH[OF le] using csi il by blast\n                  next\n                    assume \\<open>\\<not> i < l\\<close>\n                    hence li: \\<open>l \\<le> i\\<close> by auto\n                    have \\<open>i' \\<le> l'\\<close> using ij' jl' by auto\n                    hence il': \\<open>i' < l'\\<close> using  csi l'notin\\<pi> by fastforce \n                    obtain n n' where in': \\<open>i' \\<le> n'\\<close> and csn: \\<open> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> and suc: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close>\n                      using  converged_cd_diverge_cs[OF ip(2,1) csi[symmetric] il' _ lk' cseq] l'notin\\<pi> by metis\n                    have nk': \\<open>n' < k'\\<close> using lcdn' is_cdi_def lk' by auto\n                    have nretn': \\<open>\\<pi>' n' \\<noteq> return\\<close> by (metis cd_not_ret lcdn')\n                    have nk: \\<open>n < k\\<close> using cs_order[OF ip(2,1) csn[symmetric] cseq nretn' nk'] . \n                    define j where \\<open>j \\<equiv> LEAST j. n < j \\<and> (\\<exists>j'. cs\\<^bsup>\\<pi>'\\<^esup> j' = cs\\<^bsup>\\<pi>\\<^esup> j)\\<close>\n                    have Pk: \\<open>n < k \\<and> (\\<exists>j'. cs\\<^bsup>\\<pi>'\\<^esup> j' = cs\\<^bsup>\\<pi>\\<^esup> k)\\<close> (is \\<open>?P k\\<close>) using nk cseq by blast\n                    have nj: \\<open>n<j\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk] j_def by auto\n                    have ilen: \\<open>i \\<le> n\\<close> using cs_order_le[OF ip(2,1) csi[symmetric] csn[symmetric] nreti' in'] . \n                    hence lj: \\<open>l<j\\<close> using li nj by simp\n                    have \\<open>\\<forall>l\\<in>{l<..<k}. v \\<notin> writes (\\<pi> l)\\<close> using  kddl unfolding is_ddi_def by simp\n                    hence nw: \\<open>\\<forall>l\\<in>{j..<k}. v \\<notin> writes (\\<pi> l)\\<close> using lj by auto\n                    show \\<open>?thesis\\<close> using csn lcdn' suc nw[unfolded j_def] by blast\n                  qed\n                qed\n              next\n                assume ml': \\<open>m' < l'\\<close>\n                obtain n n' where mn': \\<open>m' \\<le> n'\\<close> and csn: \\<open> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> and suc: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close>\n                  using  converged_cd_diverge_cs[OF ip(2,1) csm[symmetric] ml' _ lk' cseq] l'notin\\<pi> by metis\n                have nl': \\<open>n' < l'\\<close> using lcdn' is_cdi_def by auto\n                hence nk': \\<open>n'<k'\\<close> using lk' by auto\n                have nretn': \\<open>\\<pi>' n' \\<noteq> return\\<close> using lcdn' by (metis cd_not_ret)\n                have nk: \\<open>n<k\\<close> using cs_order[OF ip(2,1) csn[symmetric] cseq nretn' nk'] .\n                show \\<open>?thesis\\<close> proof cases\n                  assume \\<open>\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j)\\<close>\n                  thus \\<open>?thesis\\<close> using lcdn' csn suc by blast\n                next\n                  assume \\<open>\\<not>(\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j))\\<close>\n                  then obtain j where jin: \\<open>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}\\<close> and vwrite: \\<open>v\\<in>writes (\\<pi> j)\\<close> by blast\n                  define i where \\<open>i \\<equiv> LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i)\\<close>\n                  have Pk: \\<open>n < k \\<and> (\\<exists> k'. cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>\\<^esup> k)\\<close> (is \\<open>?P k\\<close>) using nk cseq by blast\n                  have ni: \\<open>n < i\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk] i_def by auto\n                  obtain i' where csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk] i_def by metis\n                  have ij: \\<open>i\\<le>j\\<close> using jin[folded i_def] by auto\n                  have jk: \\<open>j<k\\<close> using jin[folded i_def] by auto\n                  have jl: \\<open>j \\<le> l\\<close> using kddl jk vwrite unfolding is_ddi_def by auto\n                  have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> using nretn' csn last_cs by metis\n                  have iln': \\<open>n'<i'\\<close> using cs_order[OF ip csn csi nretn ni] .\n                  hence mi': \\<open>m' < i'\\<close> using mn' by auto\n                  have nretm': \\<open>\\<pi>' m' \\<noteq> return\\<close> by (metis ip(2) mn' nretn' term_path_stable)\n                  have mi: \\<open>m<i\\<close> using cs_order[OF ip(2,1) csm[symmetric] csi[symmetric] nretm' mi'] .\n                  have ik: \\<open>i < k\\<close> using ij jk by auto\n                  have nreti: \\<open>\\<pi> i \\<noteq> return\\<close> by (metis ij ip(1) jl nret term_path_stable)\n                  have ik': \\<open>i' < k'\\<close> using cs_order[OF ip csi cseq[symmetric] nreti ik] .\n                  show \\<open>?thesis\\<close> proof cases\n                    assume il':\\<open>i' < l'\\<close>\n                    have le: \\<open>k + k' - (i +i') < k+k' - (m+m')\\<close> using mi mi' ik ik' by auto\n                    show \\<open>?thesis\\<close> using IH[OF le] using csi il' by blast\n                  next\n                    assume \\<open>\\<not> i' < l'\\<close>\n                    hence li': \\<open>l' \\<le> i'\\<close> by auto\n                    have \\<open>i \\<le> l\\<close> using ij jl by auto\n                    hence il: \\<open>i < l\\<close> using  csi lnotin\\<pi>' by fastforce \n                    obtain n n' where ilen: \\<open>i \\<le> n\\<close> and csn: \\<open> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> and suc: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close>\n                      using  converged_cd_diverge_cs[OF ip csi il _ lk cseq[symmetric]] lnotin\\<pi>' by metis\n                    have nk: \\<open>n < k\\<close> using lcdn is_cdi_def lk by auto\n                    have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> by (metis cd_not_ret lcdn)\n                    have nk': \\<open>n' < k'\\<close> using cs_order[OF ip csn cseq[symmetric] nretn nk] . \n                    define j' where \\<open>j' \\<equiv> LEAST j'. n' < j' \\<and> (\\<exists>j. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\n                    have Pk': \\<open>n' < k' \\<and> (\\<exists>j. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close> (is \\<open>?P k'\\<close>) using nk' cseq[symmetric] by blast\n                    have nj': \\<open>n'<j'\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk'] j'_def by auto\n                    have in': \\<open>i' \\<le> n'\\<close> using cs_order_le[OF ip csi csn nreti ilen] . \n                    hence lj': \\<open>l'<j'\\<close> using li' nj' by simp\n                    have \\<open>\\<forall>l\\<in>{l'<..<k'}. v \\<notin> writes (\\<pi>' l)\\<close> using  kddl' unfolding is_ddi_def by simp\n                    hence nw': \\<open>\\<forall>l\\<in>{j'..<k'}. v \\<notin> writes (\\<pi>' l)\\<close> using lj' by auto\n                    show \\<open>?thesis\\<close> using csn lcdn suc nw'[unfolded j'_def] by blast\n                  qed\n                qed\n              qed\n            qed\n            then obtain n n' where csn: \\<open> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and suc: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close>\n            and cdor: \n            \\<open>(l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n \\<and> (\\<forall>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}. v\\<notin>writes (\\<pi>' j'))\n            \\<or> l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n' \\<and> (\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j)))\\<close> \n            by blast\n            show \\<open>?thesis\\<close> using cdor proof\n              assume *: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n \\<and> (\\<forall>j'\\<in>{LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')..<k'}. v \\<notin> local.writes (\\<pi>' j'))\\<close>\n              hence lcdn: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> by blast \n              have nowrite: \\<open>\\<forall>j'\\<in>{LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')..<k'}. v \\<notin> local.writes (\\<pi>' j')\\<close> using * by blast\n              show \\<open>?thesis\\<close> proof (rule cp.intros(3)[of \\<open>\\<sigma>\\<close> \\<open>n\\<close> \\<open>\\<sigma>'\\<close> \\<open>n'\\<close>,folded path])\n                show \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> using lcdn .\n                show \\<open>k dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> l\\<close> using kddl .\n                show \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> using cseq by simp\n                show \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close> using suc by simp\n                show \\<open>\\<forall>j'\\<in>{LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')..<k'}. v \\<notin> local.writes (\\<pi>' j')\\<close> using nowrite .\n                show \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v\\<close> using vneq .\n                have nk: \\<open>n < k\\<close> using lcdn lk is_cdi_def by auto\n                have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> using cd_not_ret lcdn by metis\n                have nk': \\<open>n' < k'\\<close> using cs_order[OF ip csn cseq[symmetric] nretn nk] .\n                hence le: \\<open>n + n' < k + k'\\<close> using nk by auto\n                moreover\n                have 1: \\<open>\\<pi> (Suc n) = suc (\\<pi> n) (\\<sigma>\\<^bsup>n\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n                have 2: \\<open>\\<pi>' (Suc n') = suc (\\<pi>' n') (\\<sigma>'\\<^bsup>n'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n                have 3: \\<open>\\<pi>' n' = \\<pi> n\\<close> using csn last_cs by metis\n                have nreads: \\<open>\\<sigma>\\<^bsup>n\\<^esup> \\<restriction> reads (\\<pi> n) \\<noteq> \\<sigma>'\\<^bsup>n'\\<^esup> \\<restriction> reads (\\<pi> n)\\<close> by (metis 1 2 3 suc reads_restr_suc)\n                then obtain v' where v'read: \\<open>v'\\<in>reads (path \\<sigma> n)\\<close> \\<open>(\\<sigma>\\<^bsup>n\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v'\\<close> by (metis path(1) reads_restrict)\n                ultimately  \n                show \\<open>((\\<sigma>, n), (\\<sigma>', n')) \\<in> cp\\<close> using IH csn path by auto\n              qed\n            next\n              assume *: \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n' \\<and> (\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j))\\<close>\n              hence lcdn': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> by blast \n              have nowrite: \\<open>\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j)\\<close> using * by blast\n              show \\<open>?thesis\\<close> proof (rule cp.intros(4), rule cp.intros(3)[of \\<open>\\<sigma>'\\<close> \\<open>n'\\<close> \\<open>\\<sigma>\\<close> \\<open>n\\<close>,folded path])\n                show \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> using lcdn' .\n                show \\<open>k' dd\\<^bsup>\\<pi>',v\\<^esup>\\<rightarrow> l'\\<close> using kddl' .\n                show \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using cseq .\n                show \\<open>\\<pi>' (Suc n') \\<noteq> \\<pi> (Suc n)\\<close> using suc by simp\n                show \\<open>\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j)\\<close> using nowrite .\n                show \\<open>(\\<sigma>'\\<^bsup>k'\\<^esup>) v \\<noteq> (\\<sigma>\\<^bsup>k\\<^esup>) v\\<close> using vneq by simp\n                have nk': \\<open>n' < k'\\<close> using lcdn' lk' is_cdi_def by auto\n                have nretn': \\<open>\\<pi>' n' \\<noteq> return\\<close> using cd_not_ret lcdn' by metis\n                have nk: \\<open>n < k\\<close> using cs_order[OF ip(2,1) csn[symmetric] cseq nretn' nk'] .\n                hence le: \\<open>n + n' < k + k'\\<close> using nk' by auto\n                moreover\n                have 1: \\<open>\\<pi> (Suc n) = suc (\\<pi> n) (\\<sigma>\\<^bsup>n\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n                have 2: \\<open>\\<pi>' (Suc n') = suc (\\<pi>' n') (\\<sigma>'\\<^bsup>n'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n                have 3: \\<open>\\<pi>' n' = \\<pi> n\\<close> using csn last_cs by metis\n                have nreads: \\<open>\\<sigma>\\<^bsup>n\\<^esup> \\<restriction> reads (\\<pi> n) \\<noteq> \\<sigma>'\\<^bsup>n'\\<^esup> \\<restriction> reads (\\<pi> n)\\<close> by (metis 1 2 3 suc reads_restr_suc)\n                then obtain v' where v'read: \\<open>v'\\<in>reads (path \\<sigma> n)\\<close> \\<open>(\\<sigma>\\<^bsup>n\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v'\\<close> by (metis path(1) reads_restrict)\n                ultimately  \n                have \\<open>((\\<sigma>, n), (\\<sigma>', n')) \\<in> cp\\<close> using IH csn path by auto\n                thus \\<open>((\\<sigma>', n'), \\<sigma>, n) \\<in> cp\\<close> using cp.intros(4) by simp                \n              qed\n            qed\n          qed\n        qed\n      qed\n    qed\n  qed\nqed\n\n\ntheorem contradicting_in_cop: assumes \\<open>\\<sigma> =\\<^sub>L \\<sigma>'\\<close> and \\<open>(\\<sigma>',k') \\<cc> (\\<sigma>,k)\\<close> and \\<open>path \\<sigma> k \\<in> dom att\\<close> \nshows \\<open>((\\<sigma>,k),\\<sigma>',k') \\<in> cop\\<close> using assms(2) proof(cases) \n  case (1 \\<pi>' \\<pi>) \n  define j where \\<open>j \\<equiv> \\<pi> \\<exclamdown> cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close>\n  have csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> unfolding j_def using 1 by (metis cs_not_nil cs_select_is_cs(1) path_is_path)\n  have suc: \\<open>\\<pi> (Suc j) \\<noteq> \\<pi>' (Suc k')\\<close> using 1 j_def by simp\n  have kcdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> by (metis cs_not_nil cs_select_is_cs(2) 1(1,2) j_def path_is_path)\n  obtain v where readv: \\<open>v\\<in>reads(path \\<sigma> j)\\<close> and vneq: \\<open>(\\<sigma>\\<^bsup>j\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v\\<close> using suc csj unfolding 1 by (metis IFC_def.suc_def 1(2) 1(3) last_cs path_suc reads_restr_suc reads_restrict)\n  have \\<open>((\\<sigma>,j),\\<sigma>',k') \\<in> cp\\<close> apply (rule contradicting_in_cp[OF assms(1)]) using readv vneq csj 1 by auto\n  thus \\<open>((\\<sigma>,k),\\<sigma>',k') \\<in> cop\\<close> using kcdj suc assms(3) cop.intros(2) unfolding 1 by auto\n  next\n  case (2 \\<pi>' \\<pi>)\n  obtain v where readv: \\<open>v\\<in>reads(path \\<sigma> k)\\<close> and vneq: \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v\\<close> using 2(2-4) by (metis reads_restrict)\n  have \\<open>((\\<sigma>,k),\\<sigma>',k') \\<in> cp\\<close> apply (rule contradicting_in_cp[OF assms(1)]) using readv vneq 2 by auto\n  thus \\<open>((\\<sigma>,k),\\<sigma>',k') \\<in> cop\\<close> using assms(3) cop.intros(1) unfolding 2 by auto\nqed\n\n\ntheorem cop_correct_term: fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \nassumes ret: \\<open>\\<pi> n = return\\<close> \\<open>\\<pi>' n' = return\\<close> and obsne: \\<open>obs \\<sigma> \\<noteq> obs \\<sigma>'\\<close> and leq: \\<open>\\<sigma> =\\<^sub>L \\<sigma>'\\<close>\nshows \\<open>\\<exists> k k'. ((\\<sigma>,k),\\<sigma>',k')\\<in> cop \\<or> ((\\<sigma>',k'),\\<sigma>,k)\\<in> cop\\<close>\nproof -\n  have *: \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom (att)) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom (att))\\<close> using  obs_neq_contradicts_term ret obsne \\<pi> \\<pi>' by auto\n  have leq' :\\<open>\\<sigma>' =\\<^sub>L \\<sigma>\\<close> using leq unfolding loweq_def by auto\n  from * contradicting_in_cop[OF leq] contradicting_in_cop[OF leq'] show \\<open>?thesis\\<close> unfolding \\<pi> \\<pi>' by metis\nqed\n\n\ntheorem cop_correct_ret: fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \nassumes ret: \\<open>\\<pi> n = return\\<close> and obsne: \\<open>obs \\<sigma> i \\<noteq> obs \\<sigma>' i\\<close> and obs: \\<open>obs \\<sigma>' i \\<noteq> None\\<close> and leq: \\<open>\\<sigma> =\\<^sub>L \\<sigma>'\\<close>\nshows \\<open>\\<exists> k k'. ((\\<sigma>,k),\\<sigma>',k')\\<in> cop \\<or> ((\\<sigma>',k'),\\<sigma>,k)\\<in> cop\\<close>\nproof -\n  have *: \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom (att)) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom (att))\\<close>\n    by (metis (no_types, lifting) \\<pi> \\<pi>' obs obs_neq_ret_contradicts obsne ret) \n  have leq' :\\<open>\\<sigma>' =\\<^sub>L \\<sigma>\\<close> using leq unfolding loweq_def by auto\n  from * contradicting_in_cop[OF leq] contradicting_in_cop[OF leq'] show \\<open>?thesis\\<close> unfolding \\<pi> \\<pi>' by metis\nqed\n\n\ntheorem cop_correct_nterm: assumes obsne: \\<open>obs \\<sigma> k \\<noteq> obs \\<sigma>' k\\<close> \\<open>obs \\<sigma> k \\<noteq> None\\<close> \\<open>obs \\<sigma>' k \\<noteq> None\\<close> \nand leq: \\<open>\\<sigma> =\\<^sub>L \\<sigma>'\\<close>\nshows \\<open>\\<exists> k k'. ((\\<sigma>,k),\\<sigma>',k')\\<in> cop \\<or> ((\\<sigma>',k'),\\<sigma>,k)\\<in> cop\\<close>\nproof -\n  obtain k k' where \\<open>((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> path \\<sigma> k \\<in> dom att) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> path \\<sigma>' k' \\<in> dom att)\\<close> \n  using obs_neq_some_contradicts[OF obsne] by metis\n  thus \\<open>?thesis\\<close> proof\n    assume *: \\<open>(\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> path \\<sigma> k \\<in> dom att\\<close>\n    hence \\<open>((\\<sigma>,k),\\<sigma>',k') \\<in> cop\\<close> using leq by (metis contradicting_in_cop)\n    thus \\<open>?thesis\\<close> using * by blast\n  next \n    assume *: \\<open>(\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> path \\<sigma>' k' \\<in> dom att\\<close>\n    hence \\<open>((\\<sigma>',k'),\\<sigma>,k) \\<in> cop\\<close> using leq by (metis contradicting_in_cop loweq_def)\n    thus \\<open>?thesis\\<close> using * by blast\n  qed\nqed\n\n\nsubsection \\<open>Correctness of the Characterisation\\<close>\ntext_raw \\<open>\\label{sec:cor-cp}\\<close>\n\ntext \\<open>The following is our main correctness result. If there exist no critical observable paths,\nthen the program is secure.\\<close>\n\ntheorem cop_correct: assumes \\<open>cop = empty\\<close> shows \\<open>secure\\<close> proof (rule ccontr)\n  assume \\<open>\\<not> secure\\<close>\n  then obtain \\<sigma> \\<sigma>' where leq: \\<open> \\<sigma> =\\<^sub>L \\<sigma>'\\<close> \n    and **: \\<open>\\<not> obs \\<sigma> \\<approx> obs \\<sigma>' \\<or> (terminates \\<sigma> \\<and> \\<not> obs \\<sigma>' \\<lesssim> obs \\<sigma>)\\<close>\n    unfolding secure_def by blast\n  show \\<open>False\\<close> using ** proof\n    assume \\<open>\\<not> obs \\<sigma> \\<approx> obs \\<sigma>'\\<close>\n    then obtain k where \\<open>obs \\<sigma> k \\<noteq> obs \\<sigma>' k \\<and> obs \\<sigma> k \\<noteq> None \\<and> obs \\<sigma>' k \\<noteq> None\\<close> \n      unfolding obs_comp_def obs_prefix_def\n      by (metis kth_obs_stable linorder_neqE_nat obs_none_no_kth_obs obs_some_kth_obs) \n    thus \\<open>False\\<close> using cop_correct_nterm leq assms by auto\n  next\n    assume *: \\<open>terminates \\<sigma> \\<and> \\<not> obs \\<sigma>' \\<lesssim> obs \\<sigma>\\<close>\n    then obtain n where ret: \\<open>path \\<sigma> n = return\\<close>  \n      unfolding terminates_def by auto\n    obtain k where \\<open>obs \\<sigma> k \\<noteq> obs \\<sigma>' k \\<and> obs \\<sigma>' k \\<noteq> None\\<close> using * unfolding obs_prefix_def by metis \n    thus \\<open>False\\<close> using cop_correct_ret ret leq assms by (metis empty_iff) \n  qed\nqed\n\n\ntext \\<open>Our characterisation is not only correct, it is also precise in the way that \\<open>cp\\<close> characterises \nexactly the matching indices in executions for low equivalent input states where diverging data is read. \nThis follows easily as the inverse implication to lemma \\<open>contradicting_in_cp\\<close> can be shown by simple induction.\\<close>\n\ntheorem cp_iff_reads_contradict: \\<open>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp \\<longleftrightarrow> \\<sigma> =\\<^sub>L \\<sigma>' \\<and> cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k' \\<and> (\\<exists> v\\<in>reads(path \\<sigma> k). (\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v)\\<close> \nproof\n  assume \\<open>\\<sigma> =\\<^sub>L \\<sigma>' \\<and> cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k' \\<and> (\\<exists>v\\<in>reads (path \\<sigma> k). (\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v)\\<close>\n  thus \\<open>((\\<sigma>, k), \\<sigma>', k') \\<in> cp\\<close> using contradicting_in_cp by blast \nnext\n  assume \\<open>((\\<sigma>, k), \\<sigma>', k') \\<in> cp\\<close> \n  thus \\<open>\\<sigma> =\\<^sub>L \\<sigma>' \\<and> cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k' \\<and> (\\<exists>v\\<in>reads (path \\<sigma> k). (\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v)\\<close>\n  proof (induction)\n    case (1 \\<sigma> \\<sigma>' n n' h)\n    then show \\<open>?case\\<close> by blast \n  next\n    case (2 \\<sigma> k \\<sigma>' k' n v n')\n    have \\<open>v\\<in>reads (path \\<sigma> n)\\<close> using 2(2) unfolding is_ddi_def by auto\n    then show \\<open>?case\\<close> using 2 by auto\n  next\n    case (3 \\<sigma> k \\<sigma>' k' n v l n')\n    have \\<open>v\\<in>reads (path \\<sigma> n)\\<close> using 3(2) unfolding is_ddi_def by auto\n    then show \\<open>?case\\<close> using 3(4,6,8) by auto\n  next\n    case (4 \\<sigma> k \\<sigma>' k')\n    hence \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close> by simp\n    hence \\<open>path \\<sigma>' k' = path \\<sigma> k\\<close> by (metis last_cs) \n    moreover have \\<open>\\<sigma>' =\\<^sub>L \\<sigma>\\<close> using 4(2) unfolding loweq_def by simp\n    ultimately show \\<open>?case\\<close> using 4 by metis\n  qed\nqed\n\n\ntext \\<open>In the same way the inverse implication to \\<open>contradicting_in_cop\\<close> follows easily \nsuch that we obtain the following characterisation of \\<open>cop\\<close>.\\<close>\n\ntheorem cop_iff_contradicting: \\<open>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cop \\<longleftrightarrow> \\<sigma> =\\<^sub>L \\<sigma>' \\<and> (\\<sigma>',k') \\<cc> (\\<sigma>,k) \\<and> path \\<sigma> k \\<in> dom att\\<close> \nproof\n  assume \\<open>\\<sigma> =\\<^sub>L \\<sigma>' \\<and> (\\<sigma>', k') \\<cc> (\\<sigma>, k) \\<and> path \\<sigma> k \\<in> dom att\\<close> thus \\<open>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cop\\<close> using contradicting_in_cop by simp\nnext\n  assume \\<open>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cop\\<close> \n  thus \\<open> \\<sigma> =\\<^sub>L \\<sigma>' \\<and> (\\<sigma>',k') \\<cc> (\\<sigma>,k) \\<and> path \\<sigma> k \\<in> dom att\\<close> proof (cases rule: cop.cases)\n    case 1\n    then show \\<open>?thesis\\<close> using cp_iff_reads_contradict contradicts.simps by (metis (full_types) reads_restrict1)\n  next\n    case (2 k)\n    then show \\<open>?thesis\\<close> using cp_iff_reads_contradict contradicts.simps\n      by (metis cd_is_cs_less cd_not_ret contradicts.intros(1) cs_select_id path_is_path) \n  qed\nqed\n\n\nsubsection \\<open>Correctness of the Single Path Approximation\\<close>\ntext_raw \\<open>\\label{sec:cor-scp}\\<close>\n\ntheorem cp_in_scp: assumes \\<open>((\\<sigma>,k),(\\<sigma>',k'))\\<in>cp\\<close> shows \\<open>(path \\<sigma>,k)\\<in>scp \\<and> (path \\<sigma>',k')\\<in>scp\\<close> \nusing assms proof(induction \\<open>\\<sigma>\\<close> \\<open>k\\<close> \\<open>\\<sigma>'\\<close> \\<open>k'\\<close> rule:cp.induct[case_names read_high dd dcd sym])\n  case (read_high \\<sigma> \\<sigma>' k k' h) \n  have \\<open>\\<sigma> h = (\\<sigma>\\<^bsup>k\\<^esup>) h\\<close> using read_high(5) by (simp add: no_writes_unchanged0)\n  moreover have \\<open>\\<sigma>' h = (\\<sigma>'\\<^bsup>k'\\<^esup>) h\\<close> using read_high(6) by (simp add: no_writes_unchanged0)\n  ultimately have \\<open>\\<sigma> h \\<noteq> \\<sigma>' h\\<close> using read_high(4) by simp \n  hence *: \\<open>h\\<in>hvars\\<close> using read_high(1) unfolding loweq_def by (metis Compl_iff IFC_def.restrict_def)\n  have 1: \\<open>(path \\<sigma>,k)\\<in>scp\\<close> using scp.intros(1) read_high(3,5) * by auto\n  have \\<open>path \\<sigma> k = path \\<sigma>' k'\\<close> using read_high(2) by (metis last_cs)\n  hence \\<open>(path \\<sigma>',k')\\<in>scp\\<close> using scp.intros(1) read_high(3,6) * by auto\n  thus \\<open>?case\\<close> using 1 by auto\nnext\n  case dd show \\<open>?case\\<close> using scp.intros(3) dd by auto  \nnext \n  case sym thus \\<open>?case\\<close> by blast\nnext\n  case (dcd \\<sigma> k \\<sigma>' k' n v l n')   \n  note scp.intros(4) is_dcdi_via_def cd_cs_swap cs_ipd\n  have 1: \\<open>(path \\<sigma>, n)\\<in>scp\\<close> using dcd.IH dcd.hyps(2) dcd.hyps(3) scp.intros(2) scp.intros(3) by blast \n  have csk: \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close> using cp_eq_cs[OF dcd(1)] .\n  have kn: \\<open>k<n\\<close> and kl: \\<open>k<l\\<close> and ln: \\<open>l<n\\<close> using dcd(2,3) unfolding is_ddi_def is_cdi_def by auto\n  have nret: \\<open>path \\<sigma> k \\<noteq> return\\<close> using cd_not_ret dcd.hyps(3) by auto\n  have \\<open>k' < n'\\<close> using kn csk dcd(4) cs_order nret path_is_path last_cs by blast\n  have 2: \\<open>(path \\<sigma>', n')\\<in>scp\\<close> proof cases    \n    assume j'ex: \\<open>\\<exists>j'\\<in>{k'..<n'}. v \\<in> writes (path \\<sigma>' j')\\<close>\n    hence \\<open>\\<exists>j'. j'\\<in>{k'..<n'} \\<and> v \\<in> writes (path \\<sigma>' j')\\<close> by auto\n    note * = GreatestI_ex_nat[OF this]\n    define j' where \\<open>j' == GREATEST j'. j'\\<in>{k'..<n'} \\<and> v \\<in> writes (path \\<sigma>' j')\\<close>\n    note ** = *[of \\<open>j'\\<close>,folded j'_def]  \n    have \\<open>k' \\<le> j'\\<close> \\<open>j'<n'\\<close> and j'write: \\<open>v \\<in> writes (path \\<sigma>' j')\\<close>\n      using \"*\" atLeastLessThan_iff j'_def nat_less_le by auto\n    have nowrite: \\<open>\\<forall> i'\\<in>{j'<..<n'}. v \\<notin> writes(path \\<sigma>' i')\\<close> proof (rule, rule ccontr)\n      fix i' assume \\<open>i' \\<in> {j'<..<n'}\\<close> \\<open>\\<not> v \\<notin> local.writes (path \\<sigma>' i')\\<close>\n      hence \\<open>i' \\<in> {k'..<n'} \\<and> v \\<in> local.writes (path \\<sigma>' i')\\<close> using \\<open>k' \\<le> j'\\<close> by auto\n      hence \\<open>i' \\<le> j'\\<close> using Greatest_le_nat\n        by (metis (no_types, lifting) atLeastLessThan_iff j'_def nat_less_le)\n      thus \\<open>False\\<close> using \\<open>i' \\<in> {j'<..<n'}\\<close> by auto\n    qed\n    have \\<open>path \\<sigma>' n' = path \\<sigma> n\\<close> using dcd(4) last_cs by metis\n    hence \\<open>v\\<in>reads(path \\<sigma>' n')\\<close> using dcd(2) unfolding is_ddi_def by auto    \n    hence nddj': \\<open>n' dd\\<^bsup>path \\<sigma>',v\\<^esup>\\<rightarrow> j'\\<close> using dcd(2) unfolding is_ddi_def using nowrite \\<open>j'<n'\\<close> j'write by auto \n    show \\<open>?thesis\\<close> proof cases\n      assume \\<open>j' cd\\<^bsup>path \\<sigma>'\\<^esup>\\<rightarrow> k'\\<close>\n      thus \\<open>(path \\<sigma>',n') \\<in> scp\\<close> using scp.intros(2) scp.intros(3) dcd.IH nddj' by fast\n    next\n      assume jcdk': \\<open>\\<not> j' cd\\<^bsup>path \\<sigma>'\\<^esup>\\<rightarrow> k'\\<close>\n      show \\<open>?thesis\\<close> proof cases\n        assume \\<open>j' = k'\\<close>\n        thus \\<open>?thesis\\<close> using scp.intros(3) dcd.IH nddj' by fastforce \n      next\n        assume \\<open>j' \\<noteq> k'\\<close> hence \\<open>k' < j'\\<close> using \\<open>k' \\<le> j'\\<close> by auto\n        have \\<open>path \\<sigma>' j' \\<noteq> return\\<close> using j'write writes_return by auto\n        hence ipdex':\\<open>\\<exists>j. j \\<in>{k'..j'} \\<and> path \\<sigma>' j = ipd (path \\<sigma>' k') \\<close> using path_is_path \\<open>k' < j'\\<close> jcdk' is_cdi_def by blast\n        define i' where \\<open>i' == LEAST j. j\\<in> {k'..j'} \\<and> path \\<sigma>' j = ipd (path \\<sigma>' k')\\<close>        \n        have iipd': \\<open>i'\\<in> {k'..j'}\\<close> \\<open>path \\<sigma>' i' = ipd (path \\<sigma>' k')\\<close> unfolding i'_def using LeastI_ex[OF ipdex'] by simp_all\n        have *:\\<open>\\<forall> i \\<in> {k'..<i'}. path \\<sigma>' i \\<noteq> ipd (path \\<sigma>' k')\\<close> proof (rule, rule ccontr)\n          fix i assume  *: \\<open>i \\<in> {k'..<i'}\\<close> \\<open>\\<not> path \\<sigma>' i \\<noteq> ipd (path \\<sigma>' k')\\<close>\n          hence **: \\<open>i \\<in>{k'..j'} \\<and> path \\<sigma>' i = ipd (path \\<sigma>' k')\\<close> (is \\<open>?P i\\<close>) using iipd'(1) by auto\n          thus \\<open>False\\<close> using Least_le[of \\<open>?P\\<close> \\<open>i\\<close>] i'_def * by auto\n        qed\n        have \\<open>i' \\<noteq> k'\\<close> using iipd'(2) by (metis csk last_cs nret path_in_nodes ipd_not_self)\n        hence \\<open>k'<i'\\<close> using iipd'(1) by simp\n        hence csi': \\<open>cs\\<^bsup>path \\<sigma>'\\<^esup> i' = [n\\<leftarrow>cs\\<^bsup>path \\<sigma>'\\<^esup> k' . ipd n \\<noteq> path \\<sigma>' i'] @ [path \\<sigma>' i']\\<close>using cs_ipd[OF iipd'(2) *] by fast \n        \n        have ncdk': \\<open>\\<not> n' cd\\<^bsup>path \\<sigma>'\\<^esup>\\<rightarrow> k'\\<close> using \\<open>j' < n'\\<close> \\<open>k' < j'\\<close> cdi_prefix jcdk' less_imp_le_nat by blast\n        hence ncdk: \\<open>\\<not> n cd\\<^bsup>path \\<sigma>\\<^esup>\\<rightarrow> k\\<close> using cd_cs_swap csk dcd(4) by blast        \n        have ipdex: \\<open>\\<exists>i. i\\<in>{k..n} \\<and> path \\<sigma> i = ipd (path \\<sigma> k)\\<close> (is \\<open>\\<exists>i. ?P i\\<close>) proof cases\n          assume *:\\<open>path \\<sigma> n = return\\<close> \n          from path_ret_ipd[of \\<open>path \\<sigma>\\<close> \\<open>k\\<close> \\<open>n\\<close>,OF path_is_path nret *]          \n          obtain i where \\<open>?P i\\<close> by fastforce thus \\<open>?thesis\\<close> by auto\n        next\n          assume *:\\<open>path \\<sigma> n \\<noteq> return\\<close>           \n          show \\<open>?thesis\\<close> using not_cd_impl_ipd [of \\<open>path \\<sigma>\\<close> \\<open>k\\<close> \\<open>n\\<close>, OF path_is_path \\<open>k<n\\<close> ncdk *] by auto\n        qed\n        \n        define i where  \\<open>i == LEAST j. j\\<in> {k..n} \\<and> path \\<sigma> j = ipd (path \\<sigma> k)\\<close>        \n        have iipd: \\<open>i\\<in> {k..n}\\<close> \\<open>path \\<sigma> i = ipd (path \\<sigma> k)\\<close> unfolding i_def using LeastI_ex[OF ipdex] by simp_all\n        have **:\\<open>\\<forall> i' \\<in> {k..<i}. path \\<sigma> i' \\<noteq> ipd (path \\<sigma> k)\\<close> proof (rule, rule ccontr)\n          fix i' assume  *: \\<open>i' \\<in> {k..<i}\\<close> \\<open>\\<not> path \\<sigma> i' \\<noteq> ipd (path \\<sigma> k)\\<close>\n          hence **: \\<open>i' \\<in>{k..n} \\<and> path \\<sigma> i' = ipd (path \\<sigma> k)\\<close> (is \\<open>?P i'\\<close>) using iipd(1) by auto\n          thus \\<open>False\\<close> using Least_le[of \\<open>?P\\<close> \\<open>i'\\<close>] i_def * by auto\n        qed\n        have \\<open>i \\<noteq> k\\<close> using iipd(2) by (metis nret path_in_nodes ipd_not_self)\n        hence \\<open>k<i\\<close> using iipd(1) by simp\n        hence \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> i = [n\\<leftarrow>cs\\<^bsup>path \\<sigma>\\<^esup> k . ipd n \\<noteq> path \\<sigma> i] @ [path \\<sigma> i]\\<close>using cs_ipd[OF iipd(2) **] by fast \n        hence csi: \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> i = cs\\<^bsup>path \\<sigma>'\\<^esup> i'\\<close> using csi' csk unfolding iipd'(2) iipd(2) by (metis last_cs)\n        hence \\<open>(LEAST i'. k' < i' \\<and> (\\<exists>i. cs\\<^bsup>path \\<sigma>\\<^esup> i = cs\\<^bsup>path \\<sigma>'\\<^esup> i')) \\<le> i'\\<close> (is \\<open>(LEAST x. ?P x) \\<le> _\\<close>) \n          using \\<open>k' < i'\\<close> Least_le[of \\<open>?P\\<close> \\<open>i'\\<close>] by blast\n        hence nw: \\<open>\\<forall>j'\\<in>{i'..<n'}. v \\<notin> writes (path \\<sigma>' j')\\<close> using dcd(7) allB_atLeastLessThan_lower by blast  \n        moreover have \\<open>v \\<in> writes (path \\<sigma>' j')\\<close> using nddj' unfolding is_ddi_def by auto\n        moreover have \\<open>i' \\<le> j'\\<close> using iipd'(1) by auto\n        ultimately have \\<open>False\\<close>  using \\<open>j' < n'\\<close> by auto\n        thus \\<open>?thesis\\<close> ..\n      qed\n    qed\n  next\n    assume \\<open>\\<not> (\\<exists>j'\\<in>{k'..<n'}. v \\<in> writes (path \\<sigma>' j'))\\<close>\n    \n    hence \\<open>n' dcd\\<^bsup>path \\<sigma>',v\\<^esup>\\<rightarrow> k' via (path \\<sigma>) k\\<close> unfolding is_dcdi_via_def using dcd(2-4) csk \\<open>k'<n'\\<close> path_is_path by metis    \n    thus \\<open>?thesis\\<close> using dcd.IH scp.intros(4) by blast \n  qed\n  with 1 show \\<open>?case\\<close> ..\nqed   \n\n\ntheorem cop_in_scop: assumes \\<open>((\\<sigma>,k),(\\<sigma>',k'))\\<in>cop\\<close> shows \\<open>(path \\<sigma>,k)\\<in>scop \\<and> (path \\<sigma>',k')\\<in>scp\\<close>\n  using assms \n  apply (induct rule: cop.induct)\n   apply (simp add: cp_in_scp)\n  using cp_in_scp scop.intros scp.intros(2)\n   apply blast\n  using cp_in_scp scop.intros scp.intros(2)\n  apply blast\n  done\n\ntext \\<open>The main correctness result for out single execution approximation follows directly.\\<close>\n\ntheorem scop_correct: assumes \\<open>scop = empty\\<close> shows \\<open>secure\\<close> \n  using cop_correct assms cop_in_scop by fast \n\nend\n\nend", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/IFC_Tracking/IFC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.3378329787049826}}
{"text": "\\<^marker>\\<open>creator \"Kevin Kappelmann\"\\<close>\nsubsubsection \\<open>Generic Compositions\\<close>\ntheory Transport_Compositions_Generic\n  imports\n    Transport_Compositions_Generic_Galois_Equivalence\n    Transport_Compositions_Generic_Galois_Relator\n    Transport_Compositions_Generic_Order_Base\n    Transport_Compositions_Generic_Order_Equivalence\nbegin\n\nparagraph \\<open>Summary of Main Results\\<close>\n\nsubparagraph \\<open>Closure of Order and Galois Concepts\\<close>\n\ncontext transport_comp\nbegin\n\ninterpretation flip : transport_comp R2 L2 r2 l2 R1 L1 r1 l1 .\n\nlemma preorder_galois_connection_if_galois_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^sub>G (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"preorder_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<equiv>\\<^sub>G (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"preorder_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R2\\<^esub>)) (\\<le>\\<^bsub>R2\\<^esub>)\"\n  and \"middle_compatible_codom\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<stileturn>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro preorder_galois_connectionI)\n  (auto elim!: t1.galois_equivalenceE t2.galois_equivalenceE\n    intro!: galois_connection_left_right_if_galois_equivalenceI\n      preorder_on_in_field_leftI flip.preorder_on_in_field_leftI\n      mono_in_codom_left_rel_left1_if_in_codom_rel_comp_le\n      flip.mono_in_codom_left_rel_left1_if_in_codom_rel_comp_le\n      in_codom_eq_in_dom_if_reflexive_on_in_field)\n\ntheorem preorder_galois_connection_if_preorder_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"middle_compatible_codom\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<stileturn>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro preorder_galois_connection_if_galois_equivalenceI)\n  auto\n\nlemma preorder_equivalence_if_galois_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^sub>G (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"preorder_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<equiv>\\<^sub>G (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"preorder_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R2\\<^esub>)) (\\<le>\\<^bsub>R2\\<^esub>)\"\n  and \"middle_compatible_codom\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\nproof -\n  from assms have \"((\\<le>\\<^bsub>L\\<^esub>) \\<stileturn>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n    by (intro preorder_galois_connection_if_galois_equivalenceI) auto\n  with assms show ?thesis by (intro preorder_equivalence_if_galois_equivalenceI)\n    (auto intro!: galois_equivalence_if_galois_equivalenceI\n      preorder_galois_connection_if_galois_equivalenceI)\nqed\n\ntheorem preorder_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"middle_compatible_codom\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro preorder_equivalence_if_galois_equivalenceI) auto\n\ntheorem partial_equivalence_rel_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>PER\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<equiv>\\<^bsub>PER\\<^esub> (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"middle_compatible_codom\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^bsub>PER\\<^esub> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro partial_equivalence_rel_equivalence_if_galois_equivalenceI\n    galois_equivalence_if_galois_equivalenceI\n    partial_equivalence_rel_leftI flip.partial_equivalence_rel_leftI\n    in_codom_eq_in_dom_if_partial_equivalence_rel)\n  auto\n\n\nsubparagraph \\<open>Simplification of GaloisGalois relator\\<close>\n\ntheorem Galois_eq_Galois_rel_compI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"((\\<le>\\<^bsub>R2\\<^esub>) \\<stileturn>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>L2\\<^esub>)) r2 l2\"\n  and \"middle_compatible_codom\"\n  shows \"(\\<^bsub>L\\<^esub>\\<lessapprox>) = ((\\<^bsub>L1\\<^esub>\\<lessapprox>) \\<circ>\\<circ> (\\<^bsub>L2\\<^esub>\\<lessapprox>))\"\n  using assms by (intro\n    Galois_eq_Galois_rel_comp_if_galois_connection_if_galois_equivalenceI)\n  auto\n\ntext \\<open>For theorems with weaker assumptions, see\n@{thm \"Galois_eq_Galois_rel_compI'\"\n\"Galois_eq_Galois_rel_comp_if_galois_connection_if_galois_equivalenceI\"}.\\<close>\n\n\nsubparagraph \\<open>Simplification of Compatibility Assumption\\<close>\n\ntext \\<open>See @{theory \"Transport.Transport_Compositions_Generic_Base\"}.\\<close>\n\nend\n\n\nend", "meta": {"author": "kappelmann", "repo": "transport-isabelle", "sha": "b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff", "save_path": "github-repos/isabelle/kappelmann-transport-isabelle", "path": "github-repos/isabelle/kappelmann-transport-isabelle/transport-isabelle-b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff/Transport/Compositions/Generic/Transport_Compositions_Generic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3378178717264721}}
{"text": "(* \n   Title: Psi-calculi   \n   Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Bisim_Subst\n  imports Weak_Bisim_Struct_Cong Weak_Bisim_Pres Bisim_Subst\nbegin\n\ncontext env begin\n\nabbreviation\n  weakBisimSubstJudge (\"_ \\<rhd> _ \\<approx>\\<^sub>s _\" [70, 70, 70] 65) where \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>s Q \\<equiv> (\\<Psi>, P, Q) \\<in> close_subst weakBisim\"\nabbreviation\n  weakBisimSubstNilJudge (\"_ \\<approx>\\<^sub>s _\" [70, 70] 65) where \"P \\<approx>\\<^sub>s Q \\<equiv> \\<one> \\<rhd> P \\<approx>\\<^sub>s Q\"\n\nlemmas weakBisimSubstClosed[eqvt] = close_subst_closed[OF weakBisimEqvt]\nlemmas weakBisimEqvt[simp] = close_subst_eqvt[OF weakBisimEqvt]\n\nlemma strongBisimSubstWeakBisimSubst:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n\n  shows \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>s Q\"\nusing assms\nby(metis close_substI close_substE strongBisimWeakBisim)\n\nlemma weakBisimSubstOutputPres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   M :: 'a\n  and   N :: 'a\n  \n  assumes \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>s Q\"\n\n  shows \"\\<Psi> \\<rhd> M\\<langle>N\\<rangle>.P \\<approx>\\<^sub>s M\\<langle>N\\<rangle>.Q\"\nusing assms\nby(fastforce intro: close_substI close_substE weakBisimOutputPres)\n\nlemma bisimSubstInputPres:\n  fixes \\<Psi>    :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n\n  assumes \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>s Q\"\n  and     \"xvec \\<sharp>* \\<Psi>\"\n  and     \"distinct xvec\"\n\n  shows \"\\<Psi> \\<rhd> M\\<lparr>\\<lambda>*xvec N\\<rparr>.P \\<approx>\\<^sub>s M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q\"\nproof(rule_tac close_substI)\n  fix \\<sigma> :: \"(name list \\<times> 'a list) list\"\n  assume \"well_formed_subst \\<sigma>\"\n  obtain p where \"(p \\<bullet> xvec) \\<sharp>* \\<sigma>\"\n           and \"(p \\<bullet> xvec) \\<sharp>* P\" and \"(p \\<bullet> xvec) \\<sharp>* Q\" and \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>\" and \"(p \\<bullet> xvec) \\<sharp>* N\"\n           and S: \"set p \\<subseteq> set xvec \\<times> set (p \\<bullet> xvec)\"\n    by(rule_tac c=\"(\\<sigma>, P, Q, \\<Psi>, N)\" in name_list_avoiding) auto\n    \n  from `\\<Psi> \\<rhd> P \\<approx>\\<^sub>s Q` have \"(p \\<bullet> \\<Psi>) \\<rhd> (p \\<bullet> P) \\<approx>\\<^sub>s (p \\<bullet> Q)\"\n    by(rule weakBisimSubstClosed)\n  with `xvec \\<sharp>* \\<Psi>` `(p \\<bullet> xvec) \\<sharp>* \\<Psi>` S have \"\\<Psi> \\<rhd> (p \\<bullet> P) \\<approx>\\<^sub>s (p \\<bullet> Q)\"\n    by simp\n\n  {\n    fix Tvec' :: \"'a list\"\n    assume \"length (p \\<bullet> xvec) = length Tvec'\"\n    with `well_formed_subst \\<sigma>` `distinct xvec` have \"well_formed_subst (\\<sigma> @ [(p \\<bullet> xvec,Tvec')])\"\n      by simp\n    with `\\<Psi> \\<rhd> (p \\<bullet> P) \\<approx>\\<^sub>s (p \\<bullet> Q)` have \"\\<Psi> \\<rhd> (p \\<bullet> P)[<(\\<sigma> @ [(p \\<bullet> xvec,Tvec')])>] \\<approx> (p \\<bullet> Q)[<(\\<sigma> @ [(p \\<bullet> xvec,Tvec')])>]\"\n      by (rule close_substE)\n    then have \"\\<Psi> \\<rhd> ((p \\<bullet> P)[<\\<sigma>>])[(p \\<bullet> xvec)::=Tvec'] \\<approx> ((p \\<bullet> Q)[<\\<sigma>>])[(p \\<bullet> xvec)::=Tvec']\"\n      by (metis seq_subs_cons seq_subs_nil seq_subs_term_append)\n  }\n\n  then have \"\\<Psi> \\<rhd> M[<\\<sigma>>]\\<lparr>\\<lambda>*(p \\<bullet> xvec) (p \\<bullet> N)[<\\<sigma>>]\\<rparr>.((p \\<bullet> P)[<\\<sigma>>]) \\<approx> M[<\\<sigma>>]\\<lparr>\\<lambda>*(p \\<bullet> xvec) (p \\<bullet> N)[<\\<sigma>>]\\<rparr>.((p \\<bullet> Q)[<\\<sigma>>])\"\n    using weakBisimInputPres by metis\n  with `(p \\<bullet> xvec) \\<sharp>* \\<sigma>` have \"\\<Psi> \\<rhd> (M\\<lparr>\\<lambda>*(p \\<bullet> xvec) (p \\<bullet> N)\\<rparr>.(p \\<bullet> P))[<\\<sigma>>] \\<approx> (M\\<lparr>\\<lambda>*(p \\<bullet> xvec) (p \\<bullet> N)\\<rparr>.(p \\<bullet> Q))[<\\<sigma>>]\"\n    by (metis seq_subst_input_chain seq_subst_simps(3))\n  moreover from `(p \\<bullet> xvec) \\<sharp>* N` `(p \\<bullet> xvec) \\<sharp>* P` S have \"M\\<lparr>\\<lambda>*(p \\<bullet> xvec) (p \\<bullet> N)\\<rparr>.(p \\<bullet> P) = M\\<lparr>\\<lambda>*xvec N\\<rparr>.P\"\n    apply (simp add: psi.inject) by (rule input_chain_alpha[symmetric]) auto\n  moreover from `(p \\<bullet> xvec) \\<sharp>* N` `(p \\<bullet> xvec) \\<sharp>* Q` S have \"M\\<lparr>\\<lambda>*(p \\<bullet> xvec) (p \\<bullet> N)\\<rparr>.(p \\<bullet> Q) = M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q\"\n    apply (simp add: psi.inject) by (rule input_chain_alpha[symmetric]) auto\n  ultimately show \"\\<Psi> \\<rhd> (M\\<lparr>\\<lambda>*xvec N\\<rparr>.P)[<\\<sigma>>] \\<approx> (M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q)[<\\<sigma>>]\"\n    by force\nqed\n(*\nlemma bisimSubstCasePresAux:\n  fixes \\<Psi>   :: 'b\n  and   CsP :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n  and   CsQ :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n  \n  assumes C1: \"\\<And>\\<phi> P. (\\<phi>, P) mem CsP \\<Longrightarrow> \\<exists>Q. (\\<phi>, Q) mem CsQ \\<and> guarded Q \\<and> \\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n  and     C2: \"\\<And>\\<phi> Q. (\\<phi>, Q) mem CsQ \\<Longrightarrow> \\<exists>P. (\\<phi>, P) mem CsP \\<and> guarded P \\<and> \\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n\n  shows \"\\<Psi> \\<rhd> Cases CsP \\<sim>\\<^sub>s Cases CsQ\"\nproof -\n  {\n    fix xvec :: \"name list\"\n    and Tvec :: \"'a list\"\n\n    assume \"length xvec = length Tvec\"\n    and    \"distinct xvec\"\n\n    have \"\\<Psi> \\<rhd> Cases(caseListSubst CsP xvec Tvec) \\<sim> Cases(caseListSubst CsQ xvec Tvec)\"\n    proof(rule bisimCasePres)\n      fix \\<phi> P\n      assume \"(\\<phi>, P) mem (caseListSubst CsP xvec Tvec)\"\n      then obtain \\<phi>' P' where \"(\\<phi>', P') mem CsP\" and \"\\<phi> = substCond \\<phi>' xvec Tvec\" and PeqP': \"P = (P'[xvec::=Tvec])\"\n        by(induct CsP) force+\n      from `(\\<phi>', P') mem CsP` obtain Q' where \"(\\<phi>', Q') mem CsQ\" and \"guarded Q'\" and \"\\<Psi> \\<rhd> P' \\<sim>\\<^sub>s Q'\" by(blast dest: C1)\n      from `(\\<phi>', Q') mem CsQ` `\\<phi> = substCond \\<phi>' xvec Tvec` obtain Q where \"(\\<phi>, Q) mem (caseListSubst CsQ xvec Tvec)\" and \"Q = Q'[xvec::=Tvec]\"\n        by(induct CsQ) auto\n      with PeqP' `guarded Q'` `\\<Psi> \\<rhd> P' \\<sim>\\<^sub>s Q'` `length xvec = length Tvec` `distinct xvec` show \"\\<exists>Q. (\\<phi>, Q) mem (caseListSubst CsQ xvec Tvec) \\<and> guarded Q \\<and> \\<Psi> \\<rhd> P \\<sim> Q\"\n        by(blast dest: bisimSubstE guardedSubst)\n    next\n      fix \\<phi> Q\n      assume \"(\\<phi>, Q) mem (caseListSubst CsQ xvec Tvec)\"\n      then obtain \\<phi>' Q' where \"(\\<phi>', Q') mem CsQ\" and \"\\<phi> = substCond \\<phi>' xvec Tvec\" and QeqQ': \"Q = Q'[xvec::=Tvec]\"\n        by(induct CsQ) force+\n      from `(\\<phi>', Q') mem CsQ` obtain P' where \"(\\<phi>', P') mem CsP\" and \"guarded P'\" and \"\\<Psi> \\<rhd> P' \\<sim>\\<^sub>s Q'\" by(blast dest: C2)\n      from `(\\<phi>', P') mem CsP` `\\<phi> = substCond \\<phi>' xvec Tvec` obtain P where \"(\\<phi>, P) mem (caseListSubst CsP xvec Tvec)\" and \"P = P'[xvec::=Tvec]\"\n        by(induct CsP) auto\n      with QeqQ' `guarded P'` `\\<Psi> \\<rhd> P' \\<sim>\\<^sub>s Q'` `length xvec = length Tvec` `distinct xvec` show \"\\<exists>P. (\\<phi>, P) mem (caseListSubst CsP xvec Tvec) \\<and> guarded P \\<and> \\<Psi> \\<rhd> P \\<sim> Q\"\n        by(blast dest: bisimSubstE guardedSubst)\n    qed\n  }\n  thus ?thesis\n    by(rule_tac bisimSubstI) auto\nqed\n*)\nlemma weakBisimSubstReflexive:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>s P\"\nby(auto intro: close_substI weakBisimReflexive)\n\nlemma bisimSubstTransitive:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>s Q\"\n  and     \"\\<Psi> \\<rhd> Q \\<approx>\\<^sub>s R\"\n\n  shows \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>s R\"\nusing assms\nby(auto intro: close_substI close_substE weakBisimTransitive)\n\nlemma weakBisimSubstSymmetric:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>s Q\"\n\n  shows \"\\<Psi> \\<rhd> Q \\<approx>\\<^sub>s P\"\nusing assms\nby(auto intro: close_substI close_substE weakBisimE)\n(*\nlemma bisimSubstCasePres:\n  fixes \\<Psi>   :: 'b\n  and   CsP :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n  and   CsQ :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n  \n  assumes \"length CsP = length CsQ\"\n  and     C: \"\\<And>(i::nat) \\<phi> P \\<phi>' Q. \\<lbrakk>i <= length CsP; (\\<phi>, P) = nth CsP i; (\\<phi>', Q) = nth CsQ i\\<rbrakk> \\<Longrightarrow> \\<phi> = \\<phi>' \\<and> \\<Psi> \\<rhd> P \\<sim> Q\"\n\n  shows \"\\<Psi> \\<rhd> Cases CsP \\<sim>\\<^sub>s Cases CsQ\"\nproof -\n  {\n    fix \\<phi> \n    and P\n\n    assume \"(\\<phi>, P) mem CsP\"\n\n    with `length CsP = length CsQ` have \"\\<exists>Q. (\\<phi>, Q) mem CsQ \\<and> \\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n      apply(induct n==\"length CsP\" arbitrary: CsP CsQ rule: nat.induct)\n      apply simp\n      apply simp\n      apply auto\n\n  }\nusing `length CsP = length CsQ`\nproof(induct n==\"length CsP\" rule: nat.induct)\n  case zero\n  thus ?case by(fastforce intro: bisimSubstReflexive)\nnext\n  case(Suc n)\nnext\napply auto\napply(blast intro: bisimSubstReflexive)\napply auto\napply(simp add: nth.simps)\napply(auto simp add: nth.simps)\napply blast\napply(rule_tac bisimSubstCasePresAux)\napply auto\n*)\nlemma weakBisimSubstParPres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>s Q\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> R \\<approx>\\<^sub>s Q \\<parallel> R\"\nusing assms\nby(fastforce intro: close_substI close_substE weakBisimParPres)\n\nlemma weakBisimSubstResPres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   x :: name\n\n  assumes \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>s Q\"\n  and     \"x \\<sharp> \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>P \\<approx>\\<^sub>s \\<lparr>\\<nu>x\\<rparr>Q\"\nproof(rule close_substI)\n  fix \\<sigma> :: \"(name list \\<times> 'a list) list\"\n  assume \"well_formed_subst \\<sigma>\"\n  obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> P\" and \"y \\<sharp> Q\" and \"y \\<sharp> \\<sigma>\"\n    by (generate_fresh \"name\") auto\n\n  from `\\<Psi> \\<rhd> P \\<approx>\\<^sub>s Q` have \"([(x, y)] \\<bullet> \\<Psi>) \\<rhd> ([(x, y)] \\<bullet> P) \\<approx>\\<^sub>s ([(x, y)] \\<bullet> Q)\"\n    by (rule weakBisimSubstClosed)\n  with `x \\<sharp> \\<Psi>` `y \\<sharp> \\<Psi>` have \"\\<Psi> \\<rhd> ([(x, y)] \\<bullet> P) \\<approx>\\<^sub>s ([(x, y)] \\<bullet> Q)\"\n    by simp\n  hence \"\\<Psi> \\<rhd> ([(x, y)] \\<bullet> P)[<\\<sigma>>] \\<approx> ([(x, y)] \\<bullet> Q)[<\\<sigma>>]\"\n    using `well_formed_subst \\<sigma>` by (rule close_substE)\n  hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>(([(x, y)] \\<bullet> P)[<\\<sigma>>]) \\<approx> \\<lparr>\\<nu>y\\<rparr>(([(x, y)] \\<bullet> Q)[<\\<sigma>>])\"\n    using `y \\<sharp> \\<Psi>` by (rule weakBisimResPres)\n  with `y \\<sharp> P` `y \\<sharp> Q` `y \\<sharp> \\<sigma>` show \"\\<Psi> \\<rhd> (\\<lparr>\\<nu>x\\<rparr>P)[<\\<sigma>>] \\<approx> (\\<lparr>\\<nu>x\\<rparr>Q)[<\\<sigma>>]\"\n    by (simp add: alpha_res)\nqed\n\n(*\nlemma bisimSubstBangPres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n \n  assumes \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n  and     \"guarded P\"\n  and     \"guarded Q\"\n\n  shows \"\\<Psi> \\<rhd> !P \\<sim>\\<^sub>s !Q\"\nusing assms\nby(fastforce intro: bisimSubstI bisimSubstE bisimBangPres)\n*)\n\nlemma weakBisimSubstParNil:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> \\<zero> \\<approx>\\<^sub>s P\"\nby(metis strongBisimSubstWeakBisimSubst bisim_subst_par_nil) \n\nlemma weakBisimSubstParComm:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> Q \\<approx>\\<^sub>s Q \\<parallel> P\"\nby(metis strongBisimSubstWeakBisimSubst bisim_subst_par_comm) \n\nlemma weakBisimSubstParAssoc:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> (P \\<parallel> Q) \\<parallel> R \\<approx>\\<^sub>s P \\<parallel> (Q \\<parallel> R)\"\nby(metis strongBisimSubstWeakBisimSubst bisim_subst_par_assoc) \n\nlemma weakBisimSubstResNil:\n  fixes \\<Psi> :: 'b\n  and   x :: name\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>\\<zero> \\<sim>\\<^sub>s \\<zero>\"\nby(metis strongBisimSubstWeakBisimSubst bisim_subst_res_nil) \n\nlemma weakBisimSubstScopeExt:\n  fixes \\<Psi> :: 'b\n  and   x :: name\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> P\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q) \\<approx>\\<^sub>s P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q\" \nusing assms\nby(metis strongBisimSubstWeakBisimSubst bisim_subst_scope_ext) \n\nlemma weakBisimSubstCasePushRes:\n  fixes x  :: name\n  and   \\<Psi>  :: 'b\n  and   Cs :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n\n  assumes \"x \\<sharp> map fst Cs\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(Cases Cs) \\<approx>\\<^sub>s Cases map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs\"\nusing assms\nby(metis strongBisimSubstWeakBisimSubst bisim_subst_case_push_res) \n\nlemma weakBisimSubstOutputPushRes:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   M :: 'a\n  and   N :: 'a\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> M\"\n  and     \"x \\<sharp> N\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P) \\<approx>\\<^sub>s M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P\"\nusing assms\nby(metis strongBisimSubstWeakBisimSubst bisim_subst_output_push_res) \n\nlemma weakBisimSubstInputPushRes:\n  fixes x    :: name\n  and   \\<Psi>    :: 'b\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n\n  assumes \"x \\<sharp> M\"\n  and     \"x \\<sharp> xvec\"\n  and     \"x \\<sharp> N\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P) \\<approx>\\<^sub>s M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P\"\nusing assms\nby(metis strongBisimSubstWeakBisimSubst bisim_subst_input_push_res) \n\nlemma weakBisimSubstResComm:\n  fixes x :: name\n  and   y :: name\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P) \\<approx>\\<^sub>s \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\"\nby(metis strongBisimSubstWeakBisimSubst bisim_subst_res_comm) \n\nlemma weakBisimSubstExtBang:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"guarded P\"\n\n  shows \"\\<Psi> \\<rhd> !P \\<approx>\\<^sub>s P \\<parallel> !P\"\nusing assms\nby(metis strongBisimSubstWeakBisimSubst bisim_subst_ext_bang) \n\nend\n\nend\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Weak_Bisim_Subst.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926666143433998, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3377326415882381}}
{"text": "section \\<open>Entry Point for the Automatic Refinement Tool\\<close>\ntheory Automatic_Refinement\nimports \n  \"Tool/Autoref_Tool\"\n  Autoref_Bindings_HOL\nbegin\n  text \\<open>The automatic refinement tool should be used by \n    importing this theory\\<close>\n\nsubsection \\<open>Convenience\\<close>\n\ntext \\<open>The following lemmas can be used to add tags to theorems\\<close>\nlemma PREFER_I: \"P x \\<Longrightarrow> PREFER P x\" by simp\nlemma PREFER_D: \"PREFER P x \\<Longrightarrow> P x\" by simp\n\nlemmas PREFER_sv_D = PREFER_D[of single_valued]\nlemma PREFER_id_D: \"PREFER_id R \\<Longrightarrow> R=Id\" by simp\n\nabbreviation \"PREFER_RUNIV \\<equiv> PREFER (\\<lambda>R. Range R = UNIV)\"\nlemmas PREFER_RUNIV_D = PREFER_D[of \"(\\<lambda>R. Range R = UNIV)\"]\n\nlemma SIDE_GEN_ALGO_D: \"SIDE_GEN_ALGO P \\<Longrightarrow> P\" by simp\n\nlemma GEN_OP_D: \"GEN_OP c a R \\<Longrightarrow> (c,a)\\<in>R\"\n  by simp\n\nlemma MINOR_PRIO_TAG_I: \"P \\<Longrightarrow> (MINOR_PRIO_TAG p \\<Longrightarrow> P)\" by auto\nlemma MAJOR_PRIO_TAG_I: \"P \\<Longrightarrow> (MAJOR_PRIO_TAG p \\<Longrightarrow> P)\" by auto\nlemma PRIO_TAG_I: \"P \\<Longrightarrow> (PRIO_TAG ma mi \\<Longrightarrow> P)\" by auto\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Automatic_Refinement/Automatic_Refinement.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.3377326333884403}}
{"text": "theory SafeProof\n  imports ProcLangX\nbegin\n  \ntype_synonym state = \"string \\<Rightarrow> p_exp option\"  \n  \ndefinition invalid_state where\n  \"invalid_state e S = (\\<exists> a. a \\<in> free_vars e \\<and> a \\<notin> dom S)\"  \n  \ndefinition valid_perm_env where\n  \"valid_perm_env r_s S = (use_env_vars r_s \\<subseteq> dom S)\"  \n  \n", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/SafeProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665855647395, "lm_q2_score": 0.5698526514141572, "lm_q1q2_score": 0.3377326251886423}}
{"text": "theory Values imports\nMain Archi AST BinNums Integers Floats\nbegin\n\n(** This module defines the type of values that is used in the dynamic\n  semantics of all our intermediate languages. *)\n\ntype_synonym block = positive\n\n(** A value is either:\n- a machine integer;\n- a floating-point number;\n- a pointer: a pair of a memory address and an integer offset with respect\n  to this address;\n- the [Vundef] value denoting an arbitrary bit pattern, such as the\n  value of an uninitialized variable.\n*)\n\ndatatype val =\n    Vundef\n  | Vint m_int\n  | Vlong m_int64\n  | Vfloat float64\n  | Vsingle float32\n  | Vptr block m_ptrofs\n\ndefinition \"Vtrue \\<equiv> Vint 1\"\ndefinition \"Vfalse \\<equiv> Vint 0\"\n\ndefinition \"Vnullptr \\<equiv> Vlong 0\"  (* only valid on 64-bit arch *)\n\ndefinition Vptrofs :: \"m_ptrofs \\<Rightarrow> val\" where\n  \"Vptrofs n \\<equiv> Vlong n\" (* only valid on 64-bit arch *)\n\nlemma vptrofs_equ[iff]: \"Vptrofs n = Vptrofs n' \\<longleftrightarrow> n = n'\"\n  unfolding Vptrofs_def by simp\n\nsection \\<open>Operations over values\\<close>\n\n(** The module [Val] defines a number of arithmetic and logical operations\n  over type [val].  Most of these operations are straightforward extensions\n  of the corresponding integer or floating-point operations. *)\n\nlocale Val'\nbegin\n\nfun has_type :: \"val \\<Rightarrow> type \\<Rightarrow> bool\" where\n  \"has_type v t =\n  (case (v, t) of\n    (Vundef, _) \\<Rightarrow> True\n  | (Vint _, Tint) \\<Rightarrow> True\n  | (Vlong _, Tlong) \\<Rightarrow> True\n  | (Vfloat _, Tfloat) \\<Rightarrow> True\n  | (Vsingle _, Tsingle) \\<Rightarrow> True\n  | (Vptr _ _, Tint) \\<Rightarrow> Archi.ptr64 = False\n  | (Vptr _ _, Tlong) \\<Rightarrow> Archi.ptr64 = True\n  | (Vint _, Tany32) \\<Rightarrow> True\n  | (Vsingle _, Tany32) \\<Rightarrow> True\n  | (Vptr _ _, Tany32) \\<Rightarrow> Archi.ptr64 = False\n  | (_, Tany64) \\<Rightarrow> True\n  | (_, _) \\<Rightarrow> False\n  )\"\n\nfun has_rettype :: \"val \\<Rightarrow> rettype \\<Rightarrow> bool\" where\n  \"has_rettype v (Tret t) = has_type v t\"\n| \"has_rettype (Vint n) Tint8signed = (n = Int.sign_ext TYPE(8) n)\"\n| \"has_rettype (Vint n) Tint8unsigned = (n = Int.zero_ext TYPE(8) n)\"\n| \"has_rettype (Vint n) Tint16signed = (n = Int.sign_ext TYPE(16) n)\"\n| \"has_rettype (Vint n) Tint16unsigned = (n = Int.zero_ext TYPE(16) n)\"\n| \"has_rettype Vundef _ = True\"\n| \"has_rettype _ _ = False\"\n\n(** Truth values.  Non-zero integers are treated as [True].\n  The integer 0 (also used to represent the null pointer) is [False].\n  Other values are neither true nor false. *)\n\nfun bool_to_val where\n  \"bool_to_val False = Vfalse\"\n| \"bool_to_val True = Vtrue\"\n\ninductive bool_of_val :: \"val \\<Rightarrow> bool \\<Rightarrow> bool\" where\n  bool_of_val_int: \"(n \\<noteq> 0) = b \\<Longrightarrow> bool_of_val (Vint n) b\"\n\nlemma bool_of_val_one: \"bool_of_val v False \\<Longrightarrow> bool_of_val v True \\<Longrightarrow> P\"\n  by (metis bool_of_val.cases val.inject(1))\n\nfun bool_of_val_func :: \"val \\<Rightarrow> bool option\" where\n  \"bool_of_val_func (Vint n) = (if n = 0 then Some False else Some True)\"\n| \"bool_of_val_func _ = None\"\n\n(** Arithmetic operations *)\n\nfun neg :: \"val \\<Rightarrow> val\" where\n  \"neg (Vint n) = Vint (- n)\"\n| \"neg _ = Vundef\"\n\nfun negf :: \"val \\<Rightarrow> val\" where\n  \"negf (Vfloat f) = Vfloat (- f)\"\n| \"negf _ = Vundef\"\n\nfun absf :: \"val \\<Rightarrow> val\" where\n  \"absf (Vfloat f) = Vfloat (abs f)\"\n| \"absf _ = Vundef\"\n\nfun negfs :: \"val \\<Rightarrow> val\" where\n  \"negfs (Vsingle f) = Vsingle (- f)\"\n| \"negfs _ = Vundef\"\n\nfun absfs :: \"val \\<Rightarrow> val\" where\n  \"absfs (Vsingle f) = Vsingle (abs f)\"\n| \"absfs _ = Vundef\"\n\n(* fun intoffloat :: \"val \\<Rightarrow> (val option)\" where\n  \"intoffloat (Vfloat f) = map_option Vint (Float.to_int f)\"\n| \"intoffloat _ = None\"\n\nfun intuoffloat :: \"val \\<Rightarrow> (val option)\" where\n  \"intuoffloat (Vfloat f) = map_option Vint (Float.to_intu f)\"\n| \"intuoffloat _ = None\"\n\nfun floatofint :: \"val \\<Rightarrow> (val option)\" where\n  \"floatofint (Vint n) = Some (Vfloat (Float.of_int n))\"\n| \"floatofint _ = None\"\n\nfun floatofintu :: \"val \\<Rightarrow> (val option)\" where\n  \"floatofintu (Vint n) = Some (Vfloat (Float.of_intu n))\"\n| \"floatofintu _ = None\"\n\nfun intofsingle :: \"val \\<Rightarrow> (val option)\" where\n  \"intofsingle (Vsingle f) = map_option Vint (Float32.to_int f)\"\n| \"intofsingle _ = None\"\n\nfun intuofsingle :: \"val \\<Rightarrow> (val option)\" where\n  \"intuofsingle (Vsingle f) = map_option Vint (Float32.to_intu f)\"\n| \"intuofsingle _ = None\"\n\nfun singleofint :: \"val \\<Rightarrow> (val option)\" where\n  \"singleofint (Vint n) = Some (Vsingle (Float32.of_int n))\"\n| \"singleofint _ = None\"\n\nfun singleofintu :: \"val \\<Rightarrow> (val option)\" where\n  \"singleofintu (Vint n) = Some (Vsingle (Float32.of_intu n))\"\n| \"singleofintu _ = None\" *)\n\nfun negint :: \"val \\<Rightarrow> val\" where\n  \"negint (Vint n) = Vint (- n)\"\n| \"negint _ = Vundef\"\n\nfun notint :: \"val \\<Rightarrow> val\" where\n  \"notint (Vint n) = Vint (not n)\"\n| \"notint _ = Vundef\"\n\nfun of_bool :: \"bool \\<Rightarrow> val\"  where\n  \"of_bool True = Vtrue\"\n| \"of_bool False = Vfalse\"\n\nfun boolval :: \"val \\<Rightarrow> val\" where\n  \"boolval (Vint n) = of_bool (n \\<noteq> 0)\"\n| \"boolval (Vptr b ofs) = Vtrue\"\n| \"boolval _ = Vundef\"\n\nfun notbool :: \"val \\<Rightarrow> val\" where\n  \"notbool (Vint n) = of_bool (n = 0)\"\n| \"notbool (Vptr b ofs) = Vfalse\"\n| \"notbool _ = Vundef\"\n\nfun zero_ext :: \"'l::len itself \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"zero_ext nbits (Vint n) = Vint(Int.zero_ext nbits n)\"\n| \"zero_ext nbits _ = Vundef\"\n\nfun sign_ext :: \"'l::len itself \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"sign_ext nbits (Vint n) = Vint(Int.sign_ext nbits n)\"\n| \"sign_ext nbits _ = Vundef\"\n\n(* fun singleoffloat :: \"val \\<Rightarrow> val\" where\n  \"singleoffloat (Vfloat f) = Vsingle (Float.to_single f)\"\n| \"singleoffloat _ = Vundef\"\n\nfun floatofsingle :: \"val \\<Rightarrow> val\" where\n  \"floatofsingle (Vsingle f) = Vfloat (Float.of_single f)\"\n| \"floatofsingle _ = Vundef\" *)\n\nfun add :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"add (Vint n1) (Vint n2) = Vint(Int.add n1 n2)\"\n| \"add (Vptr b1 ofs1) (Vint n2) = (if Archi.ptr64 then Vundef else Vptr b1 (Ptrofs.add ofs1 (Ptrofs.of_int n2)))\"\n| \"add (Vint n1) (Vptr b2 ofs2) = (if Archi.ptr64 then Vundef else Vptr b2 (Ptrofs.add ofs2 (Ptrofs.of_int n1)))\"\n| \"add _ _ = Vundef\"\n\nfun sub :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"sub v1 v2 =\n  (case (v1, v2) of\n    (Vint n1, Vint n2) \\<Rightarrow> Vint (Int.sub n1 n2)\n  | (Vptr b1 ofs1, Vint n2) \\<Rightarrow> if Archi.ptr64 then Vundef else Vptr b1 (Ptrofs.sub ofs1 (Ptrofs.of_int n2))\n  | (Vptr b1 ofs1, Vptr b2 ofs2) \\<Rightarrow>\n      if Archi.ptr64 then Vundef else\n      if b1 = b2 then Vint(Ptrofs.to_int (Ptrofs.sub ofs1 ofs2)) else Vundef\n  | (_, _) \\<Rightarrow> Vundef\n  )\"\n\nfun mul :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"mul (Vint n1) (Vint n2) = Vint(Int.mul n1 n2)\"\n| \"mul _ _ = Vundef\"\n\n(* fun mulhs :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"mulhs (Vint n1) (Vint n2) = Vint(Int.mulhs n1 n2)\"\n| \"mulhs _ _ = Vundef\"\n\nfun mulhu :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"mulhu (Vint n1) (Vint n2) = Vint(Int.mulhu n1 n2)\"\n| \"mulhu _ _ = Vundef\" *)\n\nfun divs :: \"val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"divs v1 v2 =\n  (case (v1, v2) of\n    (Vint n1, Vint n2) \\<Rightarrow>\n      if n2 = 0\n      \\<or> n1 = (Int.repr Int.min_signed) \\<and> n2 = Int.mone\n      then None\n      else Some(Vint(Int.divs n1 n2))\n  | (_, _) \\<Rightarrow> None\n  )\"\n\nfun mods :: \"val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"mods v1 v2 =\n  (case (v1, v2) of\n    (Vint n1, Vint n2) \\<Rightarrow>\n      if n2 = 0\n      \\<or> n1 = (Int.repr Int.min_signed) \\<and> n2 = Int.mone\n      then None\n      else Some(Vint(Int.mods n1 n2))\n  | (_, _) \\<Rightarrow> None\n  )\"\n\nfun divu :: \"val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"divu (Vint n1) (Vint n2) = (if n2 = 0 then None else Some(Vint(Int.divu n1 n2)))\"\n| \"divu _ _ = None\"\n\nfun modu :: \"val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"modu (Vint n1) (Vint n2) = (if n2 = 0 then None else Some(Vint(Int.modu n1 n2)))\"\n| \"modu _ _ = None\"\n\n(* fun add_carry :: \"val \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"add_carry (Vint n1) (Vint n2) (Vint c) = Vint(Int.add_carry n1 n2 c)\"\n| \"add_carry _ _ _ = Vundef\"\n\nfun sub_overflow :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"sub_overflow (Vint n1) (Vint n2) = Vint(Int.sub_overflow n1 n2 Int.zero)\"\n| \"sub_overflow _ _ = Vundef\"\n\nfun negative :: \"val \\<Rightarrow> val\" where\n  \"negative (Vint n) = Vint (Int.negative n)\"\n| \"negative _ = Vundef\" *)\n\nfun and' :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"and' (Vint n1) (Vint n2) = Vint(Int.and' n1 n2)\"\n| \"and' _ _ = Vundef\"\n\nfun or :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"or (Vint n1) (Vint n2) = Vint(Int.or n1 n2)\"\n| \"or _ _ = Vundef\"\n\nfun xor' :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"xor' (Vint n1) (Vint n2) = Vint(Int.xor n1 n2)\"\n| \"xor' _ _ = Vundef\"\n\nfun shl :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"shl v1 v2 =\n  (case (v1, v2) of\n    (Vint n1, Vint n2) \\<Rightarrow>\n     if Int.ltu n2 Int.iwordsize\n     then Vint(Int.shl n1 n2)\n     else Vundef\n  | (_, _) \\<Rightarrow> Vundef\n  )\"\n\nfun shr :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"shr v1 v2 =\n  (case (v1, v2) of\n    (Vint n1, Vint n2) \\<Rightarrow>\n     if Int.ltu n2 Int.iwordsize\n     then Vint(Int.shr n1 n2)\n     else Vundef\n  | (_, _) \\<Rightarrow> Vundef\n  )\"\n\n(* fun shr_carry :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"shr_carry v1 v2 =\n  (case v1, v2 of\n    Vint n1, Vint n2 \\<Rightarrow>\n     if Int.ltu n2 Int.iwordsize\n     then Vint(Int.shr_carry n1 n2)\n     else Vundef\n  | _, _ \\<Rightarrow> Vundef\n  )\" *)\n\n(* fun shrx :: \"val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"shrx v1 v2 =\n  (case v1, v2 of\n    Vint n1, Vint n2 \\<Rightarrow>\n     if Int.ltu n2 (Int.repr 31)\n     then Some(Vint(Int.shrx n1 n2))\n     else None\n  | _, _ \\<Rightarrow> None\n  )\" *)\n\nfun shru :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"shru v1 v2 =\n  (case (v1, v2) of\n    (Vint n1, Vint n2) \\<Rightarrow>\n     if Int.ltu n2 Int.iwordsize\n     then Vint(Int.shru n1 n2)\n     else Vundef\n  | (_, _) \\<Rightarrow> Vundef\n  )\"\n\nfun rol :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"rol (Vint n1) (Vint n2) = Vint(Int.rol n1 n2)\"\n| \"rol _ _ = Vundef\"\n\n(* fun rolm :: \"val \\<Rightarrow> int \\<Rightarrow> int \\<Rightarrow> val\" where\n  \"rolm (Vint n) amount mask = Vint(Int.rolm n amount mask)\"\n| \"rolm _ amount mask = Vundef\" *)\n\nfun ror :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"ror (Vint n1) (Vint n2) = Vint(Int.ror n1 n2)\"\n| \"ror _ _ = Vundef\"\n\nfun addf :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"addf (Vfloat f1) (Vfloat f2) = Vfloat(Float.add f1 f2)\"\n| \"addf _ _ = Vundef\"\n\nfun subf :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"subf (Vfloat f1) (Vfloat f2) = Vfloat(Float.sub f1 f2)\"\n| \"subf _ _ = Vundef\"\n\nfun mulf :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"mulf (Vfloat f1) (Vfloat f2) = Vfloat(Float.mul f1 f2)\"\n| \"mulf _ _ = Vundef\"\n\nfun divf :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"divf (Vfloat f1) (Vfloat f2) = Vfloat(Float.div' f1 f2)\"\n| \"divf _ _ = Vundef\"\n\n(* fun floatofwords :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"floatofwords (Vint n1) (Vint n2) = Vfloat (Float.from_words n1 n2)\"\n| \"floatofwords _ _ = Vundef\" *)\n\nfun addfs :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"addfs (Vsingle f1) (Vsingle f2) = Vsingle(Float32.add f1 f2)\"\n| \"addfs _ _ = Vundef\"\n\nfun subfs :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"subfs (Vsingle f1) (Vsingle f2) = Vsingle(Float32.sub f1 f2)\"\n| \"subfs _ _ = Vundef\"\n\nfun mulfs :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"mulfs (Vsingle f1) (Vsingle f2) = Vsingle(Float32.mul f1 f2)\"\n| \"mulfs _ _ = Vundef\"\n\nfun divfs :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"divfs (Vsingle f1) (Vsingle f2) = Vsingle(Float32.div' f1 f2)\"\n| \"divfs _ _ = Vundef\"\n\n(** Operations on 64-bit integers *)\n\nfun longofwords :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"longofwords (Vint n1) (Vint n2) = Vlong (Int64.ofwords n1 n2)\"\n| \"longofwords _ _ = Vundef\"\n\nfun loword :: \"val \\<Rightarrow> val\" where\n  \"loword (Vlong n) = Vint (Int64.loword n)\"\n| \"loword _ = Vundef\"\n\nfun hiword :: \"val \\<Rightarrow> val\" where\n  \"hiword (Vlong n) = Vint (Int64.hiword n)\"\n| \"hiword _ = Vundef\"\n\nfun negl :: \"val \\<Rightarrow> val\" where\n  \"negl (Vlong n) = Vlong (Int64.neg n)\"\n| \"negl _ = Vundef\"\n\nfun notl :: \"val \\<Rightarrow> val\" where\n  \"notl (Vlong n) = Vlong (Int64.not n)\"\n| \"notl _ = Vundef\"\n\nfun longofint :: \"val \\<Rightarrow> val\" where\n  \"longofint (Vint n) = Vlong (Int64.repr (Int.signed n))\"\n| \"longofint _ = Vundef\"\n\nfun longofintu :: \"val \\<Rightarrow> val\" where\n  \"longofintu (Vint n) = Vlong (Int64.repr (Int.unsigned n))\"\n| \"longofintu _ = Vundef\"\n\n(* fun longoffloat :: \"val \\<Rightarrow> (val option)\" where\n  \"longoffloat (Vfloat f) = map_option Vlong (Float.to_long f)\"\n| \"longoffloat _ = None\"\n\nfun longuoffloat :: \"val \\<Rightarrow> (val option)\" where\n  \"longuoffloat (Vfloat f) = map_option Vlong (Float.to_longu f)\"\n| \"longuoffloat _ = None\"\n\nfun longofsingle :: \"val \\<Rightarrow> (val option)\" where\n  \"longofsingle (Vsingle f) = map_option Vlong (Float32.to_long f)\"\n| \"longofsingle _ = None\"\n\nfun longuofsingle :: \"val \\<Rightarrow> (val option)\" where\n  \"longuofsingle (Vsingle f) = map_option Vlong (Float32.to_longu f)\"\n| \"longuofsingle _ = None\"\n\nfun floatoflong :: \"val \\<Rightarrow> (val option)\" where\n  \"floatoflong (Vlong n) = Some (Vfloat (Float.of_long n))\"\n| \"floatoflong _ = None\"\n\nfun floatoflongu :: \"val \\<Rightarrow> (val option)\" where\n  \"floatoflongu (Vlong n) = Some (Vfloat (Float.of_longu n))\"\n| \"floatoflongu _ = None\"\n\nfun singleoflong :: \"val \\<Rightarrow> (val option)\" where\n  \"singleoflong (Vlong n) = Some (Vsingle (Float32.of_long n))\"\n| \"singleoflong _ = None\"\n\nfun singleoflongu :: \"val \\<Rightarrow> (val option)\" where\n  \"singleoflongu (Vlong n) = Some (Vsingle (Float32.of_longu n))\"\n| \"singleoflongu _ = None\" *)\n\nfun addl :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"addl (Vlong n1) (Vlong n2) = Vlong(Int64.add n1 n2)\"\n| \"addl (Vptr b1 ofs1) (Vlong n2) = (if Archi.ptr64 then Vptr b1 (Ptrofs.add ofs1 (Ptrofs.of_int64 n2)) else Vundef)\"\n| \"addl (Vlong n1) (Vptr b2 ofs2) = (if Archi.ptr64 then Vptr b2 (Ptrofs.add ofs2 (Ptrofs.of_int64 n1)) else Vundef)\"\n| \"addl _ _ = Vundef\"\n\nfun subl :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"subl v1 v2 =\n  (case (v1, v2) of\n    (Vlong n1, Vlong n2) \\<Rightarrow> Vlong(Int64.sub n1 n2)\n  | (Vptr b1 ofs1, Vlong n2) \\<Rightarrow>\n      if Archi.ptr64 then Vptr b1 (Ptrofs.sub ofs1 (Ptrofs.of_int64 n2)) else Vundef\n  | (Vptr b1 ofs1, Vptr b2 ofs2) \\<Rightarrow>\n      if \\<not>Archi.ptr64 then Vundef else\n      if b1 = b2 then Vlong(Ptrofs.to_int64 (Ptrofs.sub ofs1 ofs2)) else Vundef\n  | (_, _) \\<Rightarrow> Vundef\n  )\"\n\nfun mull :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"mull (Vlong n1) (Vlong n2) = Vlong(Int64.mul n1 n2)\"\n| \"mull _ _ = Vundef\"\n\n(* fun mull' :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"mull' (Vint n1) (Vint n2) = Vlong(Int64.mul' n1 n2)\"\n| \"mull' _ _ = Vundef\"\n\nfun mullhs :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"mullhs (Vlong n1) (Vlong n2) = Vlong(Int64.mulhs n1 n2)\"\n| \"mullhs _ _ = Vundef\"\n\nfun mullhu :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"mullhu (Vlong n1) (Vlong n2) = Vlong(Int64.mulhu n1 n2)\"\n| \"mullhu _ _ = Vundef\" *)\n\nfun divls :: \"val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"divls v1 v2 =\n  (case (v1, v2) of\n    (Vlong n1, Vlong n2) \\<Rightarrow>\n      if Int64.eq n2 Int64.zero\n      \\<or> Int64.eq n1 (Int64.repr Int64.min_signed) \\<and> Int64.eq n2 Int64.mone\n      then None\n      else Some(Vlong(Int64.divs n1 n2))\n  | (_, _) \\<Rightarrow> None\n  )\"\n\nfun modls :: \"val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"modls v1 v2 =\n  (case (v1, v2) of\n    (Vlong n1, Vlong n2) \\<Rightarrow>\n      if Int64.eq n2 Int64.zero\n      \\<or> Int64.eq n1 (Int64.repr Int64.min_signed) \\<and> Int64.eq n2 Int64.mone\n      then None\n      else Some(Vlong(Int64.mods n1 n2))\n  | (_, _) \\<Rightarrow> None\n  )\"\n\nfun divlu :: \"val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"divlu (Vlong n1) (Vlong n2) = (if Int64.eq n2 Int64.zero then None else Some(Vlong(Int64.divu n1 n2)))\"\n| \"divlu _ _ = None\"\n\nfun modlu :: \"val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"modlu (Vlong n1) (Vlong n2) = (if Int64.eq n2 Int64.zero then None else Some(Vlong(Int64.modu n1 n2)))\"\n| \"modlu _ _ = None\"\n\n(* fun addl_carry :: \"val \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"addl_carry (Vlong n1) (Vlong n2) (Vlong c) = Vlong(Int64.add_carry n1 n2 c)\"\n| \"addl_carry _ _ _ = Vundef\"\n\nfun subl_overflow :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"subl_overflow (Vlong n1) (Vlong n2) = Vint (Int.repr (Int64.unsigned (Int64.sub_overflow n1 n2 Int64.zero)))\"\n| \"subl_overflow _ _ = Vundef\"\n\nfun negativel :: \"val \\<Rightarrow> val\" where\n  \"negativel (Vlong n) = Vint (Int.repr (Int64.unsigned (Int64.negative n)))\"\n| \"negativel _ = Vundef\" *)\n\nfun andl :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"andl (Vlong n1) (Vlong n2) = Vlong(Int64.and' n1 n2)\"\n| \"andl _ _ = Vundef\"\n\nfun orl :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"orl (Vlong n1) (Vlong n2) = Vlong(Int64.or n1 n2)\"\n| \"orl _ _ = Vundef\"\n\nfun xorl :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"xorl (Vlong n1) (Vlong n2) = Vlong(Int64.xor n1 n2)\"\n| \"xorl _ _ = Vundef\"\n\nfun shll :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"shll v1 v2 =\n  (case (v1, v2) of\n    (Vlong n1, Vint n2) \\<Rightarrow>\n     if Int.ltu n2 Int64.iwordsize'\n     then Vlong(Int64.shl' n1 n2)\n     else Vundef\n  | (_, _) \\<Rightarrow> Vundef\n  )\"\n\nfun shrl :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"shrl v1 v2 =\n  (case (v1, v2) of\n    (Vlong n1, Vint n2) \\<Rightarrow>\n     if Int.ltu n2 Int64.iwordsize'\n     then Vlong(Int64.shr' n1 n2)\n     else Vundef\n  | (_, _) \\<Rightarrow> Vundef\n  )\"\n\nfun shrlu :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"shrlu v1 v2 =\n  (case (v1, v2) of\n    (Vlong n1, Vint n2) \\<Rightarrow>\n     if Int.ltu n2 Int64.iwordsize'\n     then Vlong(Int64.shru' n1 n2)\n     else Vundef\n  | (_, _) \\<Rightarrow> Vundef\n  )\"\n\n(* fun shrxl :: \"val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"shrxl v1 v2 =\n  (case v1, v2 of\n    Vlong n1, Vint n2 \\<Rightarrow>\n     if Int.ltu n2 (Int.repr 63)\n     then Some(Vlong(Int64.shrx' n1 n2))\n     else None\n  | _, _ \\<Rightarrow> None\n  )\"\n\nfun shrl_carry :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"shrl_carry v1 v2 =\n  (case v1, v2 of\n    Vlong n1, Vint n2 \\<Rightarrow>\n     if Int.ltu n2 Int64.iwordsize'\n     then Vlong(Int64.shr_carry' n1 n2)\n     else Vundef\n  | _, _ \\<Rightarrow> Vundef\n  )\" *)\n\nfun roll :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"roll (Vlong n1) (Vint n2) = Vlong(Int64.rol n1 (Int64.repr (Int.unsigned n2)))\"\n| \"roll _ _ = Vundef\"\n\nfun rorl :: \"val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"rorl (Vlong n1) (Vint n2) = Vlong(Int64.ror n1 (Int64.repr (Int.unsigned n2)))\"\n| \"rorl _ _ = Vundef\"\n\n(* fun rolml :: \"val \\<Rightarrow> int \\<Rightarrow> int64 \\<Rightarrow> val\" where\n  \"rolml (Vlong n) amount mask = Vlong(Int64.rolm n (Int64.repr (Int.unsigned amount)) mask)\"\n| \"rolml _ amount mask = Vundef\" *)\n\nfun zero_ext_l :: \"'l::len itself \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"zero_ext_l nbits (Vlong n) = Vlong(Int64.zero_ext nbits n)\"\n| \"zero_ext_l nbits _ = Vundef\"\n\nfun sign_ext_l :: \"'l::len itself \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"sign_ext_l nbits (Vlong n) = Vlong(Int64.sign_ext nbits n)\"\n| \"sign_ext_l nbits _ = Vundef\"\n\nsection \\<open>Comparisons\\<close>\n\nfun cmp_bool :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> (bool option)\" where\n  \"cmp_bool c (Vint n1) (Vint n2) = Some (Int.cmp c n1 n2)\"\n| \"cmp_bool c _ _ = None\"\n\nfun cmp_different_blocks :: \"comparison \\<Rightarrow> (bool option)\" where\n  \"cmp_different_blocks Ceq = Some False\"\n| \"cmp_different_blocks Cne = Some True\"\n| \"cmp_different_blocks _ = None\"\n\nfun cmpf_bool :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> (bool option)\" where\n  \"cmpf_bool c (Vfloat f1) (Vfloat f2) = Some (Float.cmp c f1 f2)\"\n| \"cmpf_bool c _ _ = None\"\n\nfun cmpfs_bool :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> (bool option)\" where\n  \"cmpfs_bool c (Vsingle f1) (Vsingle f2) = Some (Float32.cmp c f1 f2)\"\n| \"cmpfs_bool c _ _ = None\"\n\nfun cmpl_bool :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> (bool option)\" where\n  \"cmpl_bool c (Vlong n1) (Vlong n2) = Some (Int64.cmp c n1 n2)\"\n| \"cmpl_bool c _ _ = None\"\n\nfun of_optbool :: \"(bool option) \\<Rightarrow> val\" where\n  \"of_optbool (Some True) = Vtrue\"\n| \"of_optbool (Some False) = Vfalse\"\n| \"of_optbool None = Vundef\"\n\nfun cmp :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"cmp c v1 v2 = of_optbool (cmp_bool c v1 v2)\"\n\nfun cmpf :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"cmpf c v1 v2 = of_optbool (cmpf_bool c v1 v2)\"\n\nfun cmpfs :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"cmpfs c v1 v2 = of_optbool (cmpfs_bool c v1 v2)\"\n\nfun cmpl :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"cmpl c v1 v2 = map_option of_bool (cmpl_bool c v1 v2)\"\n\ncontext\n  fixes valid_ptr :: \"block \\<Rightarrow> Z \\<Rightarrow> bool\"\nbegin\n\ndefinition \"weak_valid_ptr b ofs \\<equiv> valid_ptr b ofs \\<or> valid_ptr b (ofs - 1)\"\n\nfun cmpu_bool :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> (bool option)\" where\n  \"cmpu_bool c v1 v2 =\n  (case (v1, v2) of\n    (Vint n1, Vint n2) \\<Rightarrow>\n      Some (Int.cmpu c n1 n2)\n  | (Vint n1, Vptr b2 ofs2) \\<Rightarrow>\n      if Archi.ptr64 then None else\n      if Int.eq n1 Int.zero \\<and> weak_valid_ptr b2 (Ptrofs.unsigned ofs2)\n      then cmp_different_blocks c\n      else None\n  | (Vptr b1 ofs1, Vptr b2 ofs2) \\<Rightarrow>\n      if Archi.ptr64 then None else\n      if b1 = b2 then\n        if weak_valid_ptr b1 (Ptrofs.unsigned ofs1)\n           \\<and> weak_valid_ptr b2 (Ptrofs.unsigned ofs2)\n        then Some (Ptrofs.cmpu c ofs1 ofs2)\n        else None\n      else\n        if valid_ptr b1 (Ptrofs.unsigned ofs1)\n           \\<and> valid_ptr b2 (Ptrofs.unsigned ofs2)\n        then cmp_different_blocks c\n        else None\n  | (Vptr b1 ofs1, Vint n2) \\<Rightarrow>\n      if Archi.ptr64 then None else\n      if Int.eq n2 Int.zero \\<and> weak_valid_ptr b1 (Ptrofs.unsigned ofs1)\n      then cmp_different_blocks c\n      else None\n  | (_, _) \\<Rightarrow> None\n  )\"\n\nfun cmpu :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"cmpu c v1 v2 = of_optbool (cmpu_bool c v1 v2)\"\n\nfun cmplu_bool :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> (bool option)\" where\n  \"cmplu_bool c v1 v2 =\n  (case (v1, v2) of\n    (Vlong n1, Vlong n2) \\<Rightarrow> Some (Int64.cmpu c n1 n2)\n  | (Vlong n1, Vptr b2 ofs2) \\<Rightarrow>\n      if \\<not>Archi.ptr64 then None else\n      if Int64.eq n1 Int64.zero \\<and> weak_valid_ptr b2 (Ptrofs.unsigned ofs2)\n      then cmp_different_blocks c\n      else None\n  | (Vptr b1 ofs1, Vptr b2 ofs2) \\<Rightarrow>\n      if \\<not>Archi.ptr64 then None else\n      if b1 = b2 then\n        if weak_valid_ptr b1 (Ptrofs.unsigned ofs1)\n           \\<and> weak_valid_ptr b2 (Ptrofs.unsigned ofs2)\n        then Some (Ptrofs.cmpu c ofs1 ofs2)\n        else None\n      else\n        if valid_ptr b1 (Ptrofs.unsigned ofs1)\n           \\<and> valid_ptr b2 (Ptrofs.unsigned ofs2)\n        then cmp_different_blocks c\n        else None\n  | (Vptr b1 ofs1, Vlong n2) \\<Rightarrow>\n      if \\<not>Archi.ptr64 then None else\n      if Int64.eq n2 Int64.zero \\<and> weak_valid_ptr b1 (Ptrofs.unsigned ofs1)\n      then cmp_different_blocks c\n      else None\n  | (_, _) \\<Rightarrow> None\n  )\"\n\nfun cmplu :: \"comparison \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> (val option)\" where\n  \"cmplu c v1 v2 = map_option of_bool (cmplu_bool c v1 v2)\"\nend\n\n(** Add the given offset to the given pointer. *)\n\nfun offset_ptr :: \"val \\<Rightarrow> m_ptrofs \\<Rightarrow> val\" where\n  \"offset_ptr (Vptr b ofs) delta = Vptr b (ofs + delta)\"\n| \"offset_ptr _ delta = Vundef\"\n\n(** [load_result] reflects the effect of storing a value with a given\n  memory chunk, then reading it back with the same chunk.  Depending\n  on the chunk and the type of the value, some normalization occurs.\n  For instance, consider storing the integer value [0xFFF] on 1 byte\n  at a given address, and reading it back.  If it is read back with\n  chunk [Mint8unsigned], zero-extension must be performed, resulting\n  in [0xFF].  If it is read back as a [Mint8signed], sign-extension is\n  performed and [0xFFFFFFFF] is returned. *)\n\nfun load_result :: \"memory_chunk \\<Rightarrow> val \\<Rightarrow> val\" where\n  \"load_result Mint8signed (Vint n) = Vint (Int.sign_ext TYPE(8) n)\"\n| \"load_result Mint8unsigned (Vint n) = Vint (Int.zero_ext TYPE(8) n)\"\n| \"load_result Mint16signed (Vint n) = Vint (Int.sign_ext TYPE(16) n)\"\n| \"load_result Mint16unsigned (Vint n) = Vint (Int.zero_ext TYPE(16) n)\"\n| \"load_result Mint32 (Vint n) = Vint n\"\n| \"load_result Mint32 (Vptr b ofs) = (if Archi.ptr64 then Vundef else Vptr b ofs)\"\n| \"load_result Mint64 (Vlong n) = Vlong n\"\n| \"load_result Mint64 (Vptr b ofs) = (if Archi.ptr64 then Vptr b ofs else Vundef)\"\n| \"load_result Mfloat32 (Vsingle f) = Vsingle f\"\n| \"load_result Mfloat64 (Vfloat f) = Vfloat f\"\n| \"load_result Many32 (Vint n) = Vint n\"\n| \"load_result Many32 (Vsingle f) = Vsingle f\"\n| \"load_result Many32 (Vptr b ofs) = (if Archi.ptr64 then Vundef else Vptr b ofs)\"\n| \"load_result Many64 v = v\"\n| \"load_result _ _ = Vundef\"\n\n(** The ``is less defined'' relation between values.\n    A value is less defined than itself, and [Vundef] is\n    less defined than any value. *)\n\ninductive lessdef :: \"val \\<Rightarrow> val \\<Rightarrow> bool\" where\n    lessdef_refl: \"lessdef v v\"\n  | lessdef_undef: \"lessdef Vundef v\"\n\ninductive lessdef_list :: \"val list \\<Rightarrow> val list \\<Rightarrow> bool\" where\n    lessdef_list_nil:\n      \"lessdef_list [] []\"\n  | lessdef_list_cons:\n      \"lessdef v1 v2 \\<Longrightarrow> lessdef_list vl1 vl2 \\<Longrightarrow>\n      lessdef_list (v1 # vl1) (v2 # vl2)\"\n\nsection \\<open>Values and memory injections\\<close>\n\n(** A memory injection [f] is a function from addresses to either [None]\n  or [Some] of an address and an offset.  It defines a correspondence\n  between the blocks of two memory states [m1] and [m2]:\n- if [f b = None], the block [b] of [m1] has no equivalent in [m2];\n- if [f b = Some(b', ofs)], the block [b] of [m2] corresponds to\n  a sub-block at offset [ofs] of the block [b'] in [m2].\n*)\n\ntype_synonym meminj = \"block \\<Rightarrow> (block * Z) option\"\n\n(** A memory injection defines a relation between values that is the\n  identity relation, except for pointer values which are shifted\n  as prescribed by the memory injection.  Moreover, [Vundef] values\n  inject into any other value. *)\n\ninductive inject :: \"meminj \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> bool\" where\n    inject_int:\n      \"inject mi (Vint i) (Vint i)\"\n  | inject_long:\n      \"inject mi (Vlong i) (Vlong i)\"\n  | inject_float:\n      \"inject mi (Vfloat f) (Vfloat f)\"\n  | inject_single:\n      \"inject mi (Vsingle f) (Vsingle f)\"\n  | inject_ptr:\n      \"mi b1 = Some (b2, delta) \\<Longrightarrow>\n      ofs2 = ofs1 + (Int64.repr delta) \\<Longrightarrow>\n      inject mi (Vptr b1 ofs1) (Vptr b2 ofs2)\"\n  | val_inject_undef:\n      \"inject mi Vundef v\"\n\ninductive inject_list :: \"meminj \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> bool\" where\n    inject_list_nil:\n      \"inject_list mi [] []\"\n  | inject_list_cons:\n      \"inject mi v v' \\<Longrightarrow> inject_list mi vl vl' \\<Longrightarrow>\n      inject_list mi (v # vl) (v' # vl')\"\n\nend (* locale Val' *)\n\ninterpretation Val: Val' .\n\ntype_synonym meminj = Val.meminj\n\n(** Monotone evolution of a memory injection. *)\n\ndefinition inject_incr :: \"meminj \\<Rightarrow> meminj \\<Rightarrow> bool\" where\n  \"inject_incr f1 f2 \\<equiv> \\<forall> b b' delta. f1 b = Some(b', delta) \\<longrightarrow> f2 b = Some(b', delta)\"\n\n(** The identity injection gives rise to the \"less defined than\" relation. *)\n\ndefinition inject_id :: meminj where\n  \"inject_id b \\<equiv> Some (b, 0)\"\n\n\nend", "meta": {"author": "mckirk", "repo": "Isabelle_Cminor", "sha": "76ae3d8bb8f84fefdf67f028f2db08020a79ceb1", "save_path": "github-repos/isabelle/mckirk-Isabelle_Cminor", "path": "github-repos/isabelle/mckirk-Isabelle_Cminor/Isabelle_Cminor-76ae3d8bb8f84fefdf67f028f2db08020a79ceb1/theory/compcert/Values.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494550081926, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.3376161834591781}}
{"text": "(* Author: Rene Thiemann, License: LGPL *)\n\ntheory Partial_Function_MR\nimports Main\nkeywords \"partial_function_mr\" :: thy_decl\nbegin\n\nsubsection  \\<open>Register the \\isa{partial-function-mr} command\\<close>\nML_file \\<open>partial_function_mr.ML\\<close>\n              \nsubsection \\<open>Register the \"option\"-monad\\<close>\n\ntext \\<open>Obviously, the map-function for the @{type option}-monad is @{term map_option}.\\<close>\n\ntext \\<open>First, derive the required identity lemma.\\<close>\n\nlemma option_map_id: \"map_option (\\<lambda> x. x) x = x\" \n  by (cases x, auto)\n\ntext \\<open>Second, register @{term map_option} as being monotone.\\<close>\nlemma option_map_mono[partial_function_mono]:\n  assumes mf: \"mono_option B\"\n  shows \"mono_option (\\<lambda>f. map_option h (B f))\"\nproof (rule monotoneI)\n  fix f g :: \"'a \\<Rightarrow> 'b option\" assume fg: \"fun_ord option_ord f g\"\n  with mf\n  have \"option_ord (B f) (B g)\" by (rule monotoneD[of _ _ _ f g])\n  then show \"option_ord (map_option h (B f)) (map_option h (B g))\"\n    unfolding flat_ord_def by auto    \nqed\n\ntext \\<open>And finally perform the registration. We need \n\\begin{itemize}\n\\item a constructor for map: it takes a monadic term $mt$ of type \\isa{mtT},\n  a list of functions \\isa{t-to-ss} with corresponding types in \\isa{t-to-sTs},\n  a resulting monadic type \\isa{msT}, and it should return a monad term \\isa{ms} of\n  type \\isa{msT} which\n  is obtained by applying the functions on \\isa{mt}. Although for the @{type option}-monad,\n  the lengths of the lists will always be one, there might be more elements for monads having\n  more than one type-parameter.\n\\item a function to perform type-construction for monads: it takes a list of fixed parameters\n  and a list of flexible parameters and has to construct a monadic type out of these parameters.\n  The user can freely choose which parameters should be fixed, and which are flexible.\n  Only flexible parameters can be changes in the return type of each set of mutual recursive functions.\n  Since in the @{type option}-monad we would like to be able to change the type-parameter, we ignore\n  the fixed parameters here.\n\\item a function to deconstruct monadic types into fixed and flexible type arguments.\n\\item a compositionality theorem of the form @{term \"map f (map g x) = map (f o g) x\"} \n\\item an identity theorem of the form @{term \"map (\\<lambda> x. x) m = m\"} \n\\end{itemize}\n\\<close>\ndeclaration \\<open>Partial_Function_MR.init \n  \"option\" \n  (fn (mt, t_to_ss, mtT, msT, t_to_sTs) =>\n      list_comb (Const (@{const_name map_option}, t_to_sTs ---> mtT --> msT), t_to_ss) $ mt)\n  (fn (_,argTs) => Type (@{type_name option}, argTs))\n  (fn mT => ([],Term.dest_Type mT |> #2)) \n  @{thms option.map_comp} \n  @{thms option_map_id}\n\\<close>\n\nsubsection \\<open>Register the \"tailrec\"-monad\\<close>\n\ntext \\<open>For the \"tailrec\"-monad (which is the identity monad) we take the identity\n  function as map, there are no flexible parameters, and the monadic type itself is\n  the (only) fixed argument. As a consequence, we can only define tail-recursive and \n  mutual recursive functions which share the same return type.\\<close>\n\ndeclaration \\<open>Partial_Function_MR.init \n  \"tailrec\" \n  (fn (mt, t_to_ss, mtT, msT, t_to_sTs) => mt)\n  (fn (commonT,_) => hd commonT)\n  (fn mT => ([mT],[])) \n  [] \n  []\n\\<close>\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Partial_Function_MR/Partial_Function_MR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3375922076705073}}
{"text": "(*  Title:      HOL/Auth/OtwayReesBella.thy\n    Author:     Giampaolo Bella, Catania University\n*)\n\nsection{*Bella's version of the Otway-Rees protocol*}\n\n\ntheory OtwayReesBella imports Public begin\n\ntext{*Bella's modifications to a version of the Otway-Rees protocol taken from\nthe BAN paper only concern message 7. The updated protocol makes the goal of\nkey distribution of the session key available to A. Investigating the\nprinciple of Goal Availability undermines the BAN claim about the original\nprotocol, that \"this protocol does not make use of Kab as an encryption key,\nso neither principal can know whether the key is known to the other\". The\nupdated protocol makes no use of the session key to encrypt but informs A that\nB knows it.*}\n\ninductive_set orb :: \"event list set\"\n where\n\n  Nil:  \"[]\\<in> orb\"\n\n| Fake: \"\\<lbrakk>evsa\\<in> orb;  X\\<in> synth (analz (knows Spy evsa))\\<rbrakk>\n         \\<Longrightarrow> Says Spy B X  # evsa \\<in> orb\"\n\n| Reception: \"\\<lbrakk>evsr\\<in> orb;  Says A B X \\<in> set evsr\\<rbrakk>\n              \\<Longrightarrow> Gets B X # evsr \\<in> orb\"\n\n| OR1:  \"\\<lbrakk>evs1\\<in> orb;  Nonce NA \\<notin> used evs1\\<rbrakk>\n         \\<Longrightarrow> Says A B \\<lbrace>Nonce M, Agent A, Agent B, \n                   Crypt (shrK A) \\<lbrace>Nonce NA, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \n               # evs1 \\<in> orb\"\n\n| OR2:  \"\\<lbrakk>evs2\\<in> orb;  Nonce NB \\<notin> used evs2;\n           Gets B \\<lbrace>Nonce M, Agent A, Agent B, X\\<rbrace> \\<in> set evs2\\<rbrakk>\n        \\<Longrightarrow> Says B Server \n                \\<lbrace>Nonce M, Agent A, Agent B, X, \n           Crypt (shrK B) \\<lbrace>Nonce NB, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace>\n               # evs2 \\<in> orb\"\n\n| OR3:  \"\\<lbrakk>evs3\\<in> orb;  Key KAB \\<notin> used evs3;\n          Gets Server \n             \\<lbrace>Nonce M, Agent A, Agent B, \n               Crypt (shrK A) \\<lbrace>Nonce NA, Nonce M, Agent A, Agent B\\<rbrace>, \n               Crypt (shrK B) \\<lbrace>Nonce NB, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace>\n          \\<in> set evs3\\<rbrakk>\n        \\<Longrightarrow> Says Server B \\<lbrace>Nonce M,\n                    Crypt (shrK B) \\<lbrace>Crypt (shrK A) \\<lbrace>Nonce NA, Key KAB\\<rbrace>,\n                                      Nonce NB, Key KAB\\<rbrace>\\<rbrace>\n               # evs3 \\<in> orb\"\n\n  (*B can only check that the message he is bouncing is a ciphertext*)\n  (*Sending M back is omitted*)   \n| OR4:  \"\\<lbrakk>evs4\\<in> orb; B \\<noteq> Server; \\<forall> p q. X \\<noteq> \\<lbrace>p, q\\<rbrace>; \n          Says B Server \\<lbrace>Nonce M, Agent A, Agent B, X', \n                Crypt (shrK B) \\<lbrace>Nonce NB, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace>\n            \\<in> set evs4;\n          Gets B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce NB, Key KAB\\<rbrace>\\<rbrace>\n            \\<in> set evs4\\<rbrakk>\n        \\<Longrightarrow> Says B A \\<lbrace>Nonce M, X\\<rbrace> # evs4 \\<in> orb\"\n\n\n| Oops: \"\\<lbrakk>evso\\<in> orb;  \n           Says Server B \\<lbrace>Nonce M,\n                    Crypt (shrK B) \\<lbrace>Crypt (shrK A) \\<lbrace>Nonce NA, Key KAB\\<rbrace>,\n                                      Nonce NB, Key KAB\\<rbrace>\\<rbrace> \n             \\<in> set evso\\<rbrakk>\n \\<Longrightarrow> Notes Spy \\<lbrace>Agent A, Agent B, Nonce NA, Nonce NB, Key KAB\\<rbrace> # evso \n     \\<in> orb\"\n\n\n\ndeclare knows_Spy_partsEs [elim]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\n\n\ntext{*Fragile proof, with backtracking in the possibility call.*}\nlemma possibility_thm: \"\\<lbrakk>A \\<noteq> Server; B \\<noteq> Server; Key K \\<notin> used[]\\<rbrakk>    \n      \\<Longrightarrow>   \\<exists> evs \\<in> orb.           \n     Says B A \\<lbrace>Nonce M, Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>\\<rbrace> \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] orb.Nil\n                    [THEN orb.OR1, THEN orb.Reception,\n                     THEN orb.OR2, THEN orb.Reception,\n                     THEN orb.OR3, THEN orb.Reception, THEN orb.OR4]) \napply (possibility, simp add: used_Cons)  \ndone\n\n\nlemma Gets_imp_Says :\n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> orb\\<rbrakk> \\<Longrightarrow> \\<exists>A. Says A B X \\<in> set evs\"\napply (erule rev_mp)\napply (erule orb.induct)\napply auto\ndone\n\nlemma Gets_imp_knows_Spy: \n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> orb\\<rbrakk>  \\<Longrightarrow> X \\<in> knows Spy evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\ndeclare Gets_imp_knows_Spy [THEN parts.Inj, dest]\n\nlemma Gets_imp_knows:\n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> orb\\<rbrakk>  \\<Longrightarrow> X \\<in> knows B evs\"\nby (metis Gets_imp_knows_Spy Gets_imp_knows_agents)\n\nlemma OR2_analz_knows_Spy: \n   \"\\<lbrakk>Gets B \\<lbrace>Nonce M, Agent A, Agent B, X\\<rbrace> \\<in> set evs; evs \\<in> orb\\<rbrakk>   \n    \\<Longrightarrow> X \\<in> analz (knows Spy evs)\"\nby (blast dest!: Gets_imp_knows_Spy [THEN analz.Inj])\n\nlemma OR4_parts_knows_Spy: \n   \"\\<lbrakk>Gets B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key Kab\\<rbrace>\\<rbrace>  \\<in> set evs; \n      evs \\<in> orb\\<rbrakk>   \\<Longrightarrow> X \\<in> parts (knows Spy evs)\"\nby blast\n\nlemma Oops_parts_knows_Spy: \n    \"Says Server B \\<lbrace>Nonce M, Crypt K' \\<lbrace>X, Nonce Nb, K\\<rbrace>\\<rbrace> \\<in> set evs  \n     \\<Longrightarrow> K \\<in> parts (knows Spy evs)\"\nby blast\n\nlemmas OR2_parts_knows_Spy =\n    OR2_analz_knows_Spy [THEN analz_into_parts]\n\nML\n{*\nfun parts_explicit_tac i = \n    forward_tac [@{thm Oops_parts_knows_Spy}] (i+7) THEN\n    forward_tac [@{thm OR4_parts_knows_Spy}]  (i+6) THEN\n    forward_tac [@{thm OR2_parts_knows_Spy}]  (i+4)\n*}\n \nmethod_setup parts_explicit = {*\n    Scan.succeed (K (SIMPLE_METHOD' parts_explicit_tac)) *}\n  \"to explicitly state that some message components belong to parts knows Spy\"\n\n\nlemma Spy_see_shrK [simp]: \n    \"evs \\<in> orb \\<Longrightarrow> (Key (shrK A) \\<in> parts (knows Spy evs)) = (A \\<in> bad)\"\nby (erule orb.induct, parts_explicit, simp_all, blast+)\n\nlemma Spy_analz_shrK [simp]: \n\"evs \\<in> orb \\<Longrightarrow> (Key (shrK A) \\<in> analz (knows Spy evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"[|Key (shrK A) \\<in> parts (knows Spy evs);  evs \\<in> orb|] ==> A \\<in> bad\"\nby (blast dest: Spy_see_shrK)\n\nlemma new_keys_not_used [simp]:\n   \"\\<lbrakk>Key K \\<notin> used evs; K \\<in> symKeys; evs \\<in> orb\\<rbrakk>  \\<Longrightarrow> K \\<notin> keysFor (parts (knows Spy evs))\"\napply (erule rev_mp)\napply (erule orb.induct, parts_explicit, simp_all)\napply (force dest!: keysFor_parts_insert)\napply (blast+)\ndone\n\n\n\nsubsection{* Proofs involving analz *}\n\ntext{*Describes the form of K and NA when the Server sends this message.  Also\n  for Oops case.*}\nlemma Says_Server_message_form: \n\"\\<lbrakk>Says Server B  \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key K\\<rbrace>\\<rbrace> \\<in> set evs;  \n     evs \\<in> orb\\<rbrakk>                                            \n \\<Longrightarrow> K \\<notin> range shrK & (\\<exists> A Na. X=(Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>))\"\nby (erule rev_mp, erule orb.induct, simp_all)\n\nlemma Says_Server_imp_Gets: \n \"\\<lbrakk>Says Server B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>,\n                                             Nonce Nb, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n    evs \\<in> orb\\<rbrakk>\n  \\<Longrightarrow>  Gets Server \\<lbrace>Nonce M, Agent A, Agent B, \n                   Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace>, \n               Crypt (shrK B) \\<lbrace>Nonce Nb, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace>\n         \\<in> set evs\"\nby (erule rev_mp, erule orb.induct, simp_all)\n\n\nlemma A_trusts_OR1: \n\"\\<lbrakk>Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace> \\<in> parts (knows Spy evs);  \n    A \\<notin> bad; evs \\<in> orb\\<rbrakk>                   \n \\<Longrightarrow> Says A B \\<lbrace>Nonce M, Agent A, Agent B, Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule orb.induct, parts_explicit, simp_all)\napply (blast)\ndone\n\n\nlemma B_trusts_OR2:\n \"\\<lbrakk>Crypt (shrK B) \\<lbrace>Nonce Nb, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>  \n      \\<in> parts (knows Spy evs);  B \\<notin> bad; evs \\<in> orb\\<rbrakk>                   \n  \\<Longrightarrow> (\\<exists> X. Says B Server \\<lbrace>Nonce M, Agent A, Agent B, X,  \n              Crypt (shrK B) \\<lbrace>Nonce Nb, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \n          \\<in> set evs)\"\napply (erule rev_mp, erule orb.induct, parts_explicit, simp_all)\napply (blast+)\ndone\n\n\nlemma B_trusts_OR3: \n\"\\<lbrakk>Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key K\\<rbrace> \\<in> parts (knows Spy evs);  \n   B \\<notin> bad; evs \\<in> orb\\<rbrakk>                   \n\\<Longrightarrow> \\<exists> M. Says Server B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key K\\<rbrace>\\<rbrace> \n         \\<in> set evs\"\napply (erule rev_mp, erule orb.induct, parts_explicit, simp_all)\napply (blast+)\ndone\n\nlemma Gets_Server_message_form: \n\"\\<lbrakk>Gets B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key K\\<rbrace>\\<rbrace> \\<in> set evs;  \n    evs \\<in> orb\\<rbrakk>                                              \n \\<Longrightarrow> (K \\<notin> range shrK & (\\<exists> A Na. X = (Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>)))    \n             | X \\<in> analz (knows Spy evs)\"\nby (metis B_trusts_OR3 Crypt_Spy_analz_bad Gets_imp_Says MPair_analz MPair_parts\n          Says_Server_message_form Says_imp_analz_Spy Says_imp_parts_knows_Spy)\n\nlemma unique_Na: \"\\<lbrakk>Says A B  \\<lbrace>Nonce M, Agent A, Agent B, Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs;   \n         Says A B' \\<lbrace>Nonce M', Agent A, Agent B', Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M', Agent A, Agent B'\\<rbrace>\\<rbrace> \\<in> set evs;  \n    A \\<notin> bad; evs \\<in> orb\\<rbrakk> \\<Longrightarrow> B=B' & M=M'\"\nby (erule rev_mp, erule rev_mp, erule orb.induct, simp_all, blast+)\n\nlemma unique_Nb: \"\\<lbrakk>Says B Server \\<lbrace>Nonce M, Agent A, Agent B, X, Crypt (shrK B) \\<lbrace>Nonce Nb, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs;   \n         Says B Server \\<lbrace>Nonce M', Agent A', Agent B, X', Crypt (shrK B) \\<lbrace>Nonce Nb,Nonce M', Nonce M', Agent A', Agent B\\<rbrace>\\<rbrace> \\<in> set evs;   \n    B \\<notin> bad; evs \\<in> orb\\<rbrakk> \\<Longrightarrow>   M=M' & A=A' & X=X'\"\nby (erule rev_mp, erule rev_mp, erule orb.induct, simp_all, blast+)\n\nlemma analz_image_freshCryptK_lemma:\n\"(Crypt K X \\<in> analz (Key`nE \\<union> H)) \\<longrightarrow> (Crypt K X \\<in> analz H) \\<Longrightarrow>  \n        (Crypt K X \\<in> analz (Key`nE \\<union> H)) = (Crypt K X \\<in> analz H)\"\nby (blast intro: analz_mono [THEN [2] rev_subsetD])\n\nML\n{*\nstructure OtwayReesBella =\nstruct\n\nval analz_image_freshK_ss =\n  simpset_of\n   (@{context} delsimps [image_insert, image_Un]\n      delsimps [@{thm imp_disjL}]    (*reduces blow-up*)\n      addsimps @{thms analz_image_freshK_simps})\n\nend\n*}\n\nmethod_setup analz_freshCryptK = {*\n    Scan.succeed (fn ctxt =>\n     (SIMPLE_METHOD\n      (EVERY [REPEAT_FIRST (resolve_tac [allI, ballI, impI]),\n          REPEAT_FIRST (rtac @{thm analz_image_freshCryptK_lemma}),\n          ALLGOALS (asm_simp_tac\n            (put_simpset OtwayReesBella.analz_image_freshK_ss ctxt))]))) *}\n  \"for proving useful rewrite rule\"\n\n\nmethod_setup disentangle = {*\n    Scan.succeed\n     (fn ctxt => SIMPLE_METHOD\n      (REPEAT_FIRST (eresolve_tac [asm_rl, conjE, disjE] \n                   ORELSE' hyp_subst_tac ctxt))) *}\n  \"for eliminating conjunctions, disjunctions and the like\"\n\n\n\nlemma analz_image_freshCryptK [rule_format]: \n\"evs \\<in> orb \\<Longrightarrow>                              \n     Key K \\<notin> analz (knows Spy evs) \\<longrightarrow>  \n       (\\<forall> KK. KK \\<subseteq> - (range shrK) \\<longrightarrow>                  \n             (Crypt K X \\<in> analz (Key`KK \\<union> (knows Spy evs))) =   \n             (Crypt K X \\<in> analz (knows Spy evs)))\"\napply (erule orb.induct)\napply (analz_mono_contra)\napply (frule_tac [7] Gets_Server_message_form)\napply (frule_tac [9] Says_Server_message_form)\napply disentangle\napply (drule_tac [5] Gets_imp_knows_Spy [THEN analz.Inj, THEN analz.Snd, THEN analz.Snd, THEN  analz.Snd])\nprefer 8 apply clarify\napply (analz_freshCryptK, spy_analz, fastforce)\ndone\n\n\n\nlemma analz_insert_freshCryptK: \n\"\\<lbrakk>evs \\<in> orb;  Key K \\<notin> analz (knows Spy evs);  \n         Seskey \\<notin> range shrK\\<rbrakk> \\<Longrightarrow>   \n         (Crypt K X \\<in> analz (insert (Key Seskey) (knows Spy evs))) =  \n         (Crypt K X \\<in> analz (knows Spy evs))\"\nby (simp only: analz_image_freshCryptK analz_image_freshK_simps)\n\n\nlemma analz_hard: \n\"\\<lbrakk>Says A B \\<lbrace>Nonce M, Agent A, Agent B,  \n             Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in>set evs; \n   Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace> \\<in> analz (knows Spy evs);  \n   A \\<notin> bad; B \\<notin> bad; evs \\<in> orb\\<rbrakk>                   \n \\<Longrightarrow>  Says B A \\<lbrace>Nonce M, Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule orb.induct)\napply (frule_tac [7] Gets_Server_message_form)\napply (frule_tac [9] Says_Server_message_form)\napply disentangle\ntxt{*letting the simplifier solve OR2*}\napply (drule_tac [5] Gets_imp_knows_Spy [THEN analz.Inj, THEN analz.Snd, THEN analz.Snd, THEN analz.Snd])\napply (simp_all (no_asm_simp) add: analz_insert_eq pushes split_ifs)\napply (spy_analz)\ntxt{*OR1*}\napply blast\ntxt{*Oops*}\nprefer 4 apply (blast dest: analz_insert_freshCryptK)\ntxt{*OR4 - ii*}\nprefer 3 apply (blast)\ntxt{*OR3*}\n(*adding Gets_imp_ and Says_imp_ for efficiency*)\napply (blast dest: \n       A_trusts_OR1 unique_Na Key_not_used analz_insert_freshCryptK)\ntxt{*OR4 - i *}\napply clarify\napply (simp add: pushes split_ifs)\napply (case_tac \"Aaa\\<in>bad\")\napply (blast dest: analz_insert_freshCryptK)\napply clarify\napply simp\napply (case_tac \"Ba\\<in>bad\")\napply (frule Gets_imp_knows_Spy [THEN analz.Inj, THEN analz.Snd, THEN analz.Decrypt, THEN analz.Fst] , assumption)\napply (simp (no_asm_simp))\napply clarify\napply (frule Gets_imp_knows_Spy \n             [THEN parts.Inj, THEN parts.Snd, THEN B_trusts_OR3],  \n       assumption, assumption, assumption, erule exE)\napply (frule Says_Server_imp_Gets \n            [THEN Gets_imp_knows_Spy, THEN parts.Inj, THEN parts.Snd, \n            THEN parts.Snd, THEN parts.Snd, THEN parts.Fst, THEN A_trusts_OR1],\n       assumption, assumption, assumption, assumption)\napply (blast dest: Says_Server_imp_Gets B_trusts_OR2 unique_Na unique_Nb)\ndone\n\n\nlemma Gets_Server_message_form': \n\"\\<lbrakk>Gets B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key K\\<rbrace>\\<rbrace>  \\<in> set evs;  \n   B \\<notin> bad; evs \\<in> orb\\<rbrakk>                              \n  \\<Longrightarrow> K \\<notin> range shrK & (\\<exists> A Na. X = (Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>))\"\nby (blast dest!: B_trusts_OR3 Says_Server_message_form)\n\n\nlemma OR4_imp_Gets: \n\"\\<lbrakk>Says B A \\<lbrace>Nonce M, Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>\\<rbrace> \\<in> set evs;   \n   B \\<notin> bad; evs \\<in> orb\\<rbrakk>  \n \\<Longrightarrow> (\\<exists> Nb. Gets B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>,\n                                             Nonce Nb, Key K\\<rbrace>\\<rbrace> \\<in> set evs)\"\napply (erule rev_mp, erule orb.induct, parts_explicit, simp_all)\nprefer 3 apply (blast dest: Gets_Server_message_form')\napply blast+\ndone\n\n\nlemma A_keydist_to_B: \n\"\\<lbrakk>Says A B \\<lbrace>Nonce M, Agent A, Agent B,  \n            Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in>set evs; \n   Gets A \\<lbrace>Nonce M, Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>\\<rbrace> \\<in> set evs;    \n   A \\<notin> bad; B \\<notin> bad; evs \\<in> orb\\<rbrakk>  \n  \\<Longrightarrow> Key K \\<in> analz (knows B evs)\"\napply (drule Gets_imp_knows_Spy [THEN analz.Inj, THEN analz.Snd], assumption)\napply (drule analz_hard, assumption, assumption, assumption, assumption)\napply (drule OR4_imp_Gets, assumption, assumption)\napply (fastforce dest!: Gets_imp_knows [THEN analz.Inj] analz.Decrypt)\ndone\n\n\ntext{*Other properties as for the original protocol*}\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/OtwayReesBella.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.5964331462646254, "lm_q1q2_score": 0.3375922070585025}}
{"text": "\\<^marker>\\<open>creator Bernhard Pöttinger\\<close>\n\nchapter \\<open>Pip: Acquire\\<close>\ntheory Pip_Acquire\nimports Pip_Shared\nbegin\n\nparagraph \\<open>Verification of PIP acquire operation\\<close>\n\nlemma search23:\n  fixes i1 i2 i3 :: \"('a,'b :: cancel_comm_monoid_add) fi\"\n  assumes \"i1 + i2 + i3 \\<noteq> bot\"\n  shows \"i1 + i2 \\<noteq> bot\" \"i1 + i3 \\<noteq> bot\" \"i2 + i3 \\<noteq> bot\"\nproof -\n  show \"i1 + i2 \\<noteq> bot\" using plus_fi_ops_exist(1)[of \"i1 + i2\" i3] using assms by simp\n  have \"i1 + i3 + i2 \\<noteq> bot\" using assms  by (simp add: algebra_simps)\n  then show \"i1 + i3 \\<noteq> bot\" using plus_fi_ops_exist(1)[of \"i1 + i3\" i2] by (simp add: algebra_simps)\n  have \"i2 + i3 + i1 \\<noteq> bot\" using assms  by (simp add: algebra_simps)\n  then show \"i2 + i3 \\<noteq> bot\" using plus_fi_ops_exist(1)[of \"i2 + i3\" i1] by (simp add: algebra_simps)\nqed\n\nlemma Max_sup_in:\n  assumes \"finite B\" \"A \\<subseteq> B\" \"Max B \\<in> A\"\n  shows \"Max A = Max B\"\n  using assms\n  by (meson Max.coboundedI Max_eqI in_mono infinite_super)\n\nlemma XD1:\n  assumes \"ixs + fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = xa then {#} else edge xa (Fields (\\<eta> xa) (max q0 (Max (insert t (set_mset (m - {#f#}))))) q0 m) n m) \\<noteq> bot\"\n    and \"\\<eta> xa \\<noteq> Some xa\" \"Max (insert q0 (set_mset m)) = max q0 (Max (insert t (set_mset (m - {#f#}))))\"\n  shows \"fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>y. if Some y = \\<eta> xa then {#Max_mset (add_mset t (m - {#f#}) + {#q0#})#} else {#}) + ixs \\<noteq> bot\"\nproof -\n  have \"fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>y. if Some y = \\<eta> xa then {#Max_mset (add_mset t (m - {#f#}) + {#q0#})#} else {#}) =\n        fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = xa then {#} else edge xa (Fields (\\<eta> xa) (max q0 (Max (insert t (set_mset (m - {#f#}))))) q0 m) n m)\"\n    apply (rule fi_cong)\n    using assms by (simp_all split: fields.splits)\n  then show ?thesis\n    using assms by (simp add: algebra_simps)\nqed\n\nlemma XD2:\n  assumes \"ixs + fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = xa then {#} else edge xa (Fields None (Max (insert x3 (set_mset m))) x3 m) n m) \\<noteq> bot\"\n  shows \"fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>y. {#}) + ixs \\<noteq> bot\"\nproof -\n  have \"fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = xa then {#} else edge xa (Fields None (Max (insert x3 (set_mset m))) x3 m) n m) =\n        fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>y. {#})\"\n    by (rule fi_cong, simp_all)\n  then show ?thesis\n    using assms by (simp add: algebra_simps)\nqed\n\nlemma XD3:\n  assumes \"N1 = N2\" \"\\<forall>n \\<in> N1. i1 n = i2 n\" \"\\<forall>n \\<in> -N1. o1 n = o2 n\"\n  shows \"if1 + fi N1 i1 o1 = fi N2 i2 o2 + if1\"\n  using assms\n  apply (simp add: algebra_simps)\n  apply (rule arg_cong[OF fi_cong])\n  by (simp_all add: algebra_simps)\n\nlemma XD4:\n  assumes \"fi {xb} (\\<lambda>_. mm) (\\<lambda>y. edge xb (Fs xb) y mm) + i' +\n       fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = xa then {#} else edge xa (Fields (Some xb) (Max (insert q0 (set_mset m))) q0 m) n m) \\<noteq>\n       bot\" and \"xa \\<noteq> xb\"\n  shows \"fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>y. if y = xb then {#Max_mset (add_mset t (m - {#f#}) + {#q0#})#} else {#}) + i' \\<noteq> bot\"\nproof -\n  let ?f = \"Max (insert q0 (set_mset m))\"\n  let ?t = \"max q0 (Max (insert t (set_mset (m - {#f#}))))\"\n\n  let ?ia = \"fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = xa then {#} else edge xa (Fields (Some xb) (Max (insert q0 (set_mset m))) q0 m) n m)\"\n  let ?ia' = \"fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>y. if y = xb then {#Max_mset (add_mset t (m - {#f#}) + {#q0#})#} else outf_fi (fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = xa then {#} else edge xa (Fields (Some xb) (Max (insert q0 (set_mset m))) q0 m) n m)) y)\"\n  let ?ia'' = \"fi {xa} (\\<lambda>n. if n = xa then add_mset t (m - {#f#}) else {#}) (\\<lambda>n. if n = xb then {#max q0 (Max (insert t (set_mset (m - {#f#}))))#} else outf_fi (fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = xa then {#} else edge xa (Fields (Some xb) (Max (insert q0 (set_mset m))) q0 m) n m)) n)\"\n\n  let ?ia4 = \"fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>y. if y = xb then {#Max_mset (add_mset t (m - {#f#}) + {#q0#})#} else {#})\"\n  have ia4_ia': \"?ia4 = ?ia'\"\n    by (rule fi_cong, auto)\n\n  let ?ib = \"fi {xb} (\\<lambda>_. mm) (\\<lambda>y. edge xb (Fs xb) y mm)\"\n  let ?ib'' = \"fi {xb}\n   (\\<lambda>n. add_mset (max q0 (Max (insert t (set_mset (m - {#f#})))))\n        (inf_fi (fi {xa} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = xa then {#} else edge xa (Fields (Some xb) (Max (insert q0 (set_mset m))) q0 m) n m) + fi {xb} (\\<lambda>_. mm) (\\<lambda>y. edge xb (Fs xb) y mm)) n))\n   (\\<lambda>n. if n = xb then {#} else edge xb (Fs xb) n mm)\"\n\n  have X: \"?ia' = ?ia''\"\n    by (rule fi_cong, auto)\n  have XX: \"(?ia + ?ib) + i' \\<noteq> bot\"\n    using assms by (simp add: algebra_simps)\n  have Y: \"?ia + ?ib = ?ia'' + ?ib''\"\n    apply (rule adjust_interface'[of ?ia ?ib xa xb \"{#?t#}\", symmetric, simplified])\n     apply (fact plus_fi_ops_exist(1)[OF XX]) using assms by simp\n  then have Z: \"(?ia'' + i') + ?ib'' \\<noteq> bot\"\n    using XX by (simp add: algebra_simps)\n  then have \"?ia'' + i' \\<noteq> bot\"\n    using plus_fi_ops_exist(1) by auto\n  then show ?thesis\n    using X assms by (simp add: ia4_ia')\nqed\n\nlemma onI:\n  assumes \"\\<And>x. x \\<in> X \\<Longrightarrow> f x = g x\"\n  shows \"f = g on X\"\n  using assms by blast\n\nlemma plus_fi_cancel_left:\n  assumes \"i2 = i2'\"\n  shows \"i1 + i2 = i1 + i2'\"\n  using assms by simp\n\nlemma plus_fi_cancel_rigtht:\n  assumes \"i1 = i1'\"\n  shows \"i1 + i2 = i1' + i2\"\n  using assms by simp\n\nlemmas plus_fi_cancel = plus_fi_cancel_left plus_fi_cancel_right\n\n\n\nlemma update_correct:\n  fixes i ix ixs :: \"(fields ref, int multiset) fi\"\n  assumes \"finite (dom_fi i)\" \"V \\<subseteq> dom_fi i\" \"x \\<notin> xs\"\n    and \"i = ixs + fi {x}\n      (\\<lambda>_. inf_fi ix x - {# f #} + (if t \\<ge>0 then {# t #} else {#})) (outf_fi ix)\"\n    and \"i \\<noteq> bot\" \"f < t\"\n    and \"\\<forall>x \\<in> V. t \\<in># fields_qs (Fs x)\"\n    and \"\\<forall>x' \\<in> dom_fi i. case \\<eta> x' of Some y \\<Rightarrow> y \\<in> {x} \\<union> xs | _ \\<Rightarrow> True\"\n    and \"t \\<ge> 0\"\n  shows \"<ff.NI (\\<eta> x) x (Fs x) m ix * ff.GrI \\<eta> Fs xs ixs>\n    update x f t\n    <\\<lambda>_. \\<exists>\\<^sub>AFs'. ff.GrI \\<eta> Fs' ({x} \\<union> xs) i>\"\n  using assms\n  apply (induction V arbitrary: f Fs m ix ixs xs \\<eta> rule: finite_induct_reverse[where F=\"dom_fi i\" and a=x])\n\n  (* base case*)\n    apply (rule cons_pre_rule[OF ent_frame_fwd[OF ff.peek_NI]])\n      apply frame_inference+\n\n  subgoal for a F f Fs m ix ixs xs \\<eta>\n    apply (rule cons_pre_rule[OF ent_frame_fwd[OF ff.GrI_dom]])\n      apply frame_inference+\n    apply clarsimp\n\n    apply (subst update.simps)\n    apply (sep_auto simp: pip_simps heap: ll_simps ff.fold_GrI_rule[where g=\"\\<eta> a\"] split: fields.splits if_splits dest: in_diffD XD1)\n    apply (intro ff.GrI_cong[of \"insert a (dom_fi ixs)\"] onI)\n         apply simp\n    apply simp\n       apply auto[1]\n      apply (rule XD3[symmetric])\n        apply simp\n       apply simp\n    apply simp\n   apply (sep_auto simp: pip_simps heap: ll_simps ff.fold_GrI_rule[where g=\"\\<eta> a\"] split: fields.splits dest: XD2)\n   apply (rule ff.GrI_cong[OF _ eq_on_refl])\n      apply simp\n    apply simp\n    apply (simp add: algebra_simps, rule arg_cong[OF fi_cong], simp, simp, simp)\n\n  subgoal premises prems for q0 ia x\n  proof -\n    have \"t \\<in># m\" \"f < t\"\n      using prems by auto\n    then have \"Max (insert q0 (set_mset m)) = max q0 (Max (insert t (set_mset (m - {#f#}))))\"\n      apply (cases \"m = {#}\", simp, simp)\n      by (smt Max.insert_remove Max.remove at_most_one_mset_mset_diff diff_single_trivial finite_set_mset max_def more_than_one_mset_mset_diff)\n    then show ?thesis\n      using prems by simp\n  qed\n  done\n\n  (* Step case! *)\n  subgoal for a F' f Fs m ix ixs xs \\<eta>\n\n    apply (rule cons_pre_rule[OF ent_frame_fwd[OF ff.GrI_dom]])\n      apply frame_inference+\n\n    apply (subst update.simps)\n    apply (sep_auto simp: pip_simps heap: ll_simps ff.fold_GrI_rule split: fields.splits if_splits dest: in_diffD XD1)\n    apply (intro ff.GrI_cong[of \"insert a (dom_fi ixs)\"] onI)\n         apply simp\n    apply simp\n       apply auto[1]\n      apply (rule XD3[symmetric])\n        apply simp\n       apply simp\n    apply simp\n   apply (sep_auto simp: pip_simps heap: ll_simps ff.fold_GrI_rule[where g=\"\\<eta> a\"] split: fields.splits dest: XD2)\n   apply (rule ff.GrI_cong[OF _ eq_on_refl])\n      apply simp\n    apply simp\n    apply (simp add: algebra_simps, rule arg_cong[OF fi_cong], simp, simp, simp)\n\n   apply (case_tac \"a \\<in> F'\")\n   (* re-encounter some node *)\n  subgoal premises prems for q0 xb\n  proof -\n    have \"t \\<in># m\" \"f < t\"\n      using prems by auto\n    then have \"Max (insert q0 (set_mset m)) = max q0 (Max (insert t (set_mset (m - {#f#}))))\"\n      apply (cases \"m = {#}\", simp, simp)\n      by (smt Max.insert_remove Max.remove at_most_one_mset_mset_diff diff_single_trivial finite_set_mset max_def more_than_one_mset_mset_diff)\n    then show ?thesis\n      using prems by simp\n  qed\n\n  (* an actual step *)\n  apply (sep_auto simp: pip_simps heap: ll_simps ff.fold_GrI_rule[where g=\"\\<eta> a\"] split: fields.splits dest: XD4)\n  subgoal premises prems for q0 xb i' mm\n  proof -\n    let ?i1 = \"fi {xb} (\\<lambda>_. mm) (\\<lambda>y. edge x (Fs x) y mm)\"\n\n    let ?f = \"Max (insert q0 (set_mset m))\"\n    let ?t = \"max q0 (Max (insert t (set_mset (m - {#f#}))))\"\n\n    have S: \"?t = t\"\n      by (smt prems Max.insert_not_elem Max.insert_remove Max.remove Max_singleton at_most_one_mset_mset_diff finite_set_mset max_def more_than_one_mset_mset_diff)\n\n    have \"Max (insert q0 (set_mset m)) \\<noteq> t\"\n      using prems S by simp\n    then have SS: \"Max (insert q0 (set_mset m)) < t\"\n      by (smt Max.insert_remove Max_in Max_insert S at_most_one_mset_mset_diff empty_not_insert finite_set_mset max_def more_than_one_mset_mset_diff prems set_mset_add_mset_insert singletonD)\n\n    have tge0: \"?t \\<ge> 0\" using prems by auto\n\n    let ?ia = \"fi {a} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = a then {#} else edge a (Fields (Some xb) (Max (insert q0 (set_mset m))) q0 m) n m)\"\n    let ?ia2 = \"fi {a} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>y. if y = xb then {#Max_mset (add_mset t (m - {#f#}) + {#q0#})#} else {#})\"\n    let ?ia3 = \" fi {a} (\\<lambda>n. if n = a then add_mset t (m - {#f#}) else {#})\n      (\\<lambda>n. if n = xb then {#max q0 (Max (insert t (set_mset (m - {#f#}))))#} else outf_fi (fi {a} (\\<lambda>_. add_mset t (m - {#f#})) (\\<lambda>n. if n = a then {#} else edge a (Fields (Some xb) (Max (insert q0 (set_mset m))) q0 m) n m)) n)\"\n\n    have ia2_ia3: \"?ia2 = ?ia3\" by (rule fi_cong, auto)\n\n    let ?ib = \"fi {xb} (\\<lambda>_. mm) (\\<lambda>y. edge xb (Fs xb) y mm)\"\n    let ?ib2 = \"fi {xb} (\\<lambda>_. inf_fi (fi {xb} (\\<lambda>_. mm) (\\<lambda>y. edge xb (Fs xb) y mm)) xb + (if 0 \\<le> max q0 (Max (insert t (set_mset (m - {#f#})))) then {#max q0 (Max (insert t (set_mset (m - {#f#}))))#} else {#}) - {#Max (insert q0 (set_mset m))#}) (outf_fi (fi {xb} (\\<lambda>_. mm) (\\<lambda>y. edge xb (Fs xb) y mm)))\"\n    let ?ib3 = \"fi {xb} (\\<lambda>n. add_mset (max q0 (Max (insert t (set_mset (m - {#f#}))))) ((if n = xb then mm else {#}) - (if n = a then {#} else if n = a then {#} else edge a (Fields (Some xb) (Max (insert q0 (set_mset m))) q0 m) n m)))\n      (\\<lambda>n. if n = xb then {#} else edge xb (Fs xb) n mm)\"\n\n    have ib2_ib3: \"?ib2 = ?ib3\" apply (rule fi_cong) using tge0 S prems by (auto simp: algebra_simps)\n\n    have nbot_iaibi': \"(?ia + ?ib) + i' \\<noteq> bot\"\n      using prems by (simp add: algebra_simps)\n    have nbot_iaib: \"?ia + ?ib \\<noteq> bot\"\n      using plus_fi_ops_exist(1)[OF nbot_iaibi'] by simp\n\n    have nbot_ia_ibi': \"?ia + (?ib + i') \\<noteq> bot\"\n      using prems by (simp add: algebra_simps)\n\n    have nbot_ib_iai': \"?ib + (?ia + i') \\<noteq> bot\"\n      using prems by (simp add: algebra_simps)\n\n    have nbot_ib_i'ia: \"?ib + (i' + ?ia) \\<noteq> bot\"\n      using prems by (simp add: algebra_simps)\n\n    have iaib_ia2ib2: \"?ia + ?ib = ?ia2 + ?ib2\"\n      using adjust_interface_mset'[of ?ia ?ib a xb \"{#?t#}\", OF nbot_iaib] ib2_ib3 ia2_ia3 prems\n      by (simp add: algebra_simps)\n    then have nbot_ia2ib2: \"?ia2 + ?ib2 + i' \\<noteq> bot\"\n      using nbot_iaibi' by (simp add: algebra_simps)\n\n    have nbot_ib_i'ia2: \"?ib2 + (i'  + ?ia2) \\<noteq> bot\"\n      using prems iaib_ia2ib2 by (simp add: algebra_simps)\n\n    have nbot: \"?i1 \\<noteq> bot\" \"i' \\<noteq> bot\" \"?ib + i' \\<noteq> bot\" \"i' + ?ia \\<noteq> bot\" \"i' + ?ia2 \\<noteq> bot\"\n      using plus_fi_ops_exist(1)[OF nbot_iaib] plus_fi_ops_exist(2)[OF nbot_iaib]\n        plus_fi_ops_exist(2)[OF nbot_ia_ibi'] plus_fi_ops_exist(2)[OF nbot_ib_i'ia]\n        plus_fi_ops_exist(2)[OF nbot_ib_i'ia2] \n      by auto\n\n    have *: \"(?ib + ?ia) + i' \\<noteq> bot\"\n      using prems by (simp add: algebra_simps)\n    then have \"?ib + ?ia \\<noteq> bot\"\n      using plus_fi_ops_exist[OF *] by simp\n    then have \"inf_fi ?ib xb = inf_fi (?ib + ?ia) xb + outf_fi ?ia xb\"\n      using unfold_inf_fi[of ?ib ?ia xb] by simp\n\n    have \"{xb} \\<union> insert a (dom_fi ixs - {xb}) = dom_fi i\"\n      using prems nbot by simp\n\n    show ?thesis\n      apply (subst S)+\n      using prems iaib_ia2ib2 tge0 nbot\n      apply (sep_auto heap: ent_star_mono[OF _ ff.GrI_cong] cons_rule[OF _ _\n       prems(1)[of xb \"insert a (dom_fi ixs - {xb})\" _ _ _ \"\\<lambda>y. if y = a then Fields (Some xb) t q0 (add_mset t (m - {#f#})) else Fs y\"]]\n        simp: tge0 algebra_simps iaib_ia2ib2 nbot intro!: fi_cong ff.GrI_cong split: fields.splits)\n      using S apply (simp add: algebra_simps)\n      apply simp\n      using S apply (simp add: algebra_simps)\n      using S apply (simp add: algebra_simps)\n      using SS apply simp\n       apply (auto split: fields.splits)[1]\n      apply (simp split: option.splits)\n      apply (smt Un_iff dom_fi_fi dom_fi_plus_fi(1) fiI finite.emptyI finite_insert nbot(5) option.inject prems(9) singletonD)\n      using nbot by simp\n  qed\n  done\n\n  using assms apply simp\n  done\n\n\n\nlemma inf_fi_plus_fi1:\n  assumes \"x \\<in> N1\" \"fi N1 i1 o1 + fi N2 i2 o2 \\<noteq> bot\"\n  shows \"inf_fi (fi N1 i1 o1 + fi N2 i2 o2) x = i1 x - o2 x\"\nproof -\n  let ?i1 = \"fi N1 i1 o1\"\n  let ?i2 = \"fi N2 i2 o2\"\n\n  have \"is_sum_fi ?i1 ?i2 (?i1 + ?i2)\"\n    using assms by (simp add: plus_fi_to_is_sum_fi)\n  then have \"inf_fi ?i1 = \\<lambda>n. inf_fi (?i1 + ?i2) n + outf_fi ?i2 n on dom_fi ?i1\"\n    unfolding is_sum_fi_def by auto\n  then have \"i1 x = inf_fi (?i1 + ?i2) x + o2 x\"\n    using assms plus_fi_ops_exist[of ?i1 ?i2] dom_fi_plus_fi[of ?i1 ?i2] by auto\n  then show ?thesis by simp\nqed\n\nlemma inf_fi_plus_fi2:\n  assumes \"x \\<in> N2\" \"fi N1 i1 o1 + fi N2 i2 o2 \\<noteq> bot\"\n  shows \"inf_fi (fi N1 i1 o1 + fi N2 i2 o2) x = i2 x - o1 x\"\nproof -\n  let ?i1 = \"fi N1 i1 o1\"\n  let ?i2 = \"fi N2 i2 o2\"\n\n  have \"is_sum_fi ?i1 ?i2 (?i1 + ?i2)\"\n    using assms by (simp add: plus_fi_to_is_sum_fi)\n  then have \"inf_fi ?i2 = \\<lambda>n. inf_fi (?i1 + ?i2) n + outf_fi ?i1 n on dom_fi ?i2\"\n    unfolding is_sum_fi_def by auto\n  then have \"i2 x = inf_fi (?i1 + ?i2) x + o1 x\"\n    using assms plus_fi_ops_exist[of ?i1 ?i2] dom_fi_plus_fi[of ?i1 ?i2] by auto\n  then show ?thesis by simp\nqed\n\n\nlemmas pip_simps' = pip_simps fields_y'_def\n\nlemma acquire_correct:\n  assumes \"p \\<in> X\" \"r \\<in> X\" \"p \\<noteq> r\" \" \\<eta> r = None\" \"i \\<noteq> bot\" \"\\<forall>x \\<in> X. case \\<eta> x of Some y \\<Rightarrow> y \\<in> X | _ \\<Rightarrow> True\"\n  shows \"<ff.GrI \\<eta> Fs X i> acquire p r <\\<lambda>_. \\<exists>\\<^sub>AFs'. ff.GrI (case \\<eta> r of None \\<Rightarrow> \\<eta>(r := Some p) | _ \\<Rightarrow> \\<eta>(p := Some r)) Fs' X i>\"\n  unfolding acquire_def\n  apply (rule cons_pre_rule[OF ent_frame_fwd[OF ff.GrI_dom]], frame_inference+)\n  apply (sep_auto simp: pip_simps' heap: ll_simps split: fields.splits)\n  using assms apply simp\n  using assms apply simp\n  apply (sep_auto simp: pip_simps' heap: ll_simps split: fields.splits)\n  using assms apply simp\n  using assms apply simp\n  using assms dom_fi_plus_fi(2) apply fastforce\n  apply (sep_auto simp: pip_simps' heap: ll_simps split: fields.splits)\n  using assms apply simp\n    apply (sep_auto simp: pip_simps' heap: ll_simps ff.fold_GrI_rule[where g=\"Some p\"] split: fields.splits)\n  subgoal premises prems for m i'a x3 x4\n  proof -\n    let ?ir = \"fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#})\"\n    let ?ir' = \"fi {r} (inf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#}))) (\\<lambda>n. if n = p then {#Max_mset (x4 + {#x3#})#} else outf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#})) n)\"\n    let ?ir2 = \"fi {r} (\\<lambda>_. x4) (\\<lambda>y. if y = p then {#Max_mset (x4 + {#x3#})#} else {#})\"\n    let ?ip = \"fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)\"\n    let ?ip' = \"fi {p} (\\<lambda>n. inf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#}) + fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)) n + {#Max_mset (x4 + {#x3#})#}) (outf_fi (fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)))\"\n\n    have ir'_ir2: \"?ir' = ?ir2\"\n      by (rule fi_cong, auto)\n\n    have \"(?ir + ?ip) + i'a \\<noteq> bot\" using assms prems by (simp add: algebra_simps)\n    then have nbot: \"?ir + ?ip \\<noteq> bot\" using plus_fi_ops_exist(1) by blast\n    have \"?ir' + ?ip' = ?ir + ?ip\" using assms adjust_interface'[of ?ir ?ip r p \"{#Max_mset (x4 + {#x3#})#}\", OF nbot] by simp\n    then have \"?ir' + (?ip' + i'a) \\<noteq> bot\" using prems assms by (simp add: algebra_simps)\n    then have \"?ip' + (?ir' + i'a) \\<noteq> bot\" by (simp add: algebra_simps)\n    then have \"?ir' + i'a \\<noteq> bot\" using plus_fi_ops_exist(2) by blast\n    with prems ir'_ir2 show False by simp\n  qed\n     apply (cases \"Fs r\", simp)\n    apply (cases \"Fs r\", simp)\n   apply simp\n\n  subgoal for m i'a x3 x4 ia\n\n    apply (rule cons_rule[OF _ _ update_correct[where V=\"{}\"], of _ \"\\<lambda>y. if y = r then Some p else \\<eta> y\"_ \"\\<lambda>x. if x = r then Fields (Some p) (Max (insert x3 (set_mset x4))) x3 x4 else Fs x\"])\n    using assms apply (simp add: algebra_simps)\n              apply (rule ent_star_mono[OF ent_refl])\n              apply (rule ff.GrI_cong)\n                 apply simp\n    apply (simp add: assms)\n               apply simp\n    apply simp\n                 apply (rule ent_ex_preI)\n                 apply (rule_tac x=Fs' in ent_ex_postI)\n             apply (rule ff.GrI_cong _ eq_on_refl)\n    apply (intro onI)\n                    apply simp\n               apply simp\n    using assms search23 apply (auto simp: algebra_simps)[1]\n             apply simp\n            apply simp\n           apply simp\n    using assms apply simp\n    subgoal premises prems\n    proof -\n      let ?ip = \"fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)\"\n      let ?ip' = \"fi {p} (\\<lambda>_. inf_fi (fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)) p - {#- 1#} + (if 0 \\<le> Max (insert x3 (set_mset x4)) then {#Max (insert x3 (set_mset x4))#} else {#})) (outf_fi (fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)))\"\n      let ?ip2 = \"fi {p} (\\<lambda>n. inf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#}) + fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)) n + {#Max_mset (x4 + {#x3#})#}) (outf_fi (fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)))\"\n\n      let ?ir = \"fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#})\"\n      let ?ir' = \"fi {r} (\\<lambda>_. x4) (\\<lambda>y. if y = p then {#Max_mset (x4 + {#x3#})#} else {#})\"\n      let ?ir2 = \"fi {r} (inf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#}))) (\\<lambda>n. if n = p then {#Max_mset (x4 + {#x3#})#} else outf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#})) n)\"\n\n      have \"(?ir + ?ip) + i'a \\<noteq> bot\" using assms prems by (simp add: algebra_simps)\n      then have nbot: \"?ir + ?ip \\<noteq> bot\" using plus_fi_ops_exist(1) by blast\n\n      have B: \"-1 \\<notin># m\"\n        using assms prems by (cases \"Fs p\", auto)\n\n      have A1: \"?ip' = ?ip2\"\n        apply (rule fi_cong)\n        apply simp\n        using assms prems apply simp\n         apply (intro conjI)\n        apply clarsimp\n          apply (subst inf_fi_plus_fi2, simp)\n        using nbot apply blast\n          apply (simp add: B diff_single_trivial)\n         apply (smt Max_ge finite_insert finite_set_mset insertI1)\n        by blast\n\n      have A2: \"?ir' = ?ir2\"\n        by (rule fi_cong, auto)\n    \n      have \"?ir2 + ?ip2 = ?ir + ?ip\"\n        using assms adjust_interface'[of ?ir ?ip r p \"{#Max_mset (x4 + {#x3#})#}\", OF nbot]\n        by simp\n      then show ?thesis\n        using A1 A2 by (simp add: algebra_simps)\n    qed\n    subgoal premises prems\n    proof -\n      let ?ip = \"fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)\"\n      let ?ip' = \"fi {p} (\\<lambda>_. inf_fi (fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)) p - {#- 1#} + (if 0 \\<le> Max (insert x3 (set_mset x4)) then {#Max (insert x3 (set_mset x4))#} else {#})) (outf_fi (fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)))\"\n      let ?ip2 = \"fi {p} (\\<lambda>n. inf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#}) + fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)) n + {#Max_mset (x4 + {#x3#})#}) (outf_fi (fi {p} (\\<lambda>_. m) (\\<lambda>y. edge p (Fs p) y m)))\"\n\n      let ?ir = \"fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#})\"\n      let ?ir' = \"fi {r} (\\<lambda>_. x4) (\\<lambda>y. if y = p then {#Max_mset (x4 + {#x3#})#} else {#})\"\n      let ?ir2 = \"fi {r} (inf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#}))) (\\<lambda>n. if n = p then {#Max_mset (x4 + {#x3#})#} else outf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>y. {#})) n)\"\n\n      have \"(?ir + ?ip) + i'a \\<noteq> bot\" using assms prems by (simp add: algebra_simps)\n      then have nbot: \"?ir + ?ip \\<noteq> bot\" using plus_fi_ops_exist(1) by blast\n\n      have B: \"-1 \\<notin># m\"\n        using assms prems by (cases \"Fs p\", auto)\n\n      have A1: \"?ip' = ?ip2\"\n        using assms prems\n        by (smt B Max_ge add_mset_add_single diff_empty diff_single_trivial fiI fi_cong finite.emptyI finite_insert finite_set_mset inf_fi_fi inf_fi_plus_fi2 insertI1 nbot set_mset_add_mset_insert)\n\n      have A2: \"?ir' = ?ir2\"\n        by (rule fi_cong, auto)\n    \n      have \"?ir2 + ?ip2 = ?ir + ?ip\"\n        using assms adjust_interface'[of ?ir ?ip r p \"{#Max_mset (x4 + {#x3#})#}\", OF nbot]\n        by simp\n      then show ?thesis\n        using A1 A2 prems assms by (auto simp: algebra_simps)\n    qed\n       apply (case_tac x4, simp, simp)\n      apply simp\n    using assms apply (auto split: option.splits)[1]\n    by (case_tac x4, simp, simp)\n\n\n\n\n\n\n\n  apply (sep_auto simp: pip_simps' heap: ll_simps split: fields.splits)\n  using assms apply simp\n    apply (sep_auto simp: pip_simps' heap: ll_simps ff.fold_GrI_rule[where g=\"Some r\"] split: fields.splits)\n  subgoal premises prems for i'a x3 x4 y x3a x4a\n  proof -\n    let ?ir = \"fi {r} (\\<lambda>_. x4) (\\<lambda>ya. if ya = y then {#Max_mset (x4 + {#x3#})#} else {#})\"\n    let ?ir2 = \"fi {r} (inf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>ya. if ya = y then {#Max_mset (x4 + {#x3#})#} else {#})))\n     (\\<lambda>n. if n = p then {#Max_mset (x4 + {#x3#})#} else outf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>ya. if ya = y then {#Max_mset (x4 + {#x3#})#} else {#})) n)\"\n    let ?ip = \"fi {p} (\\<lambda>_. x4a) (\\<lambda>y. if Some y = \\<eta> p then {#Max_mset (x4a + {#x3a#})#} else {#})\"\n    let ?ip' = \"fi {p} (\\<lambda>_. x4a) (\\<lambda>y. if y = r then {#Max_mset (x4a + {#x3a#})#} else {#})\"\n    let ?ip2 = \"fi {p} (\\<lambda>n. inf_fi (fi {r} (\\<lambda>_. x4) (\\<lambda>ya. if ya = y then {#Max_mset (x4 + {#x3#})#} else {#}) + fi {p} (\\<lambda>_. x4a) (\\<lambda>y. if Some y = \\<eta> p then {#Max_mset (x4a + {#x3a#})#} else {#})) n + {#Max_mset (x4 + {#x3#})#})\n     (outf_fi (fi {p} (\\<lambda>_. x4a) (\\<lambda>y. if Some y = \\<eta> p then {#Max_mset (x4a + {#x3a#})#} else {#})))\"\n\n    have ir'_ir2: \"?ip' = ?ip2\"\n      apply (rule fi_cong)\n      using prems assms by auto\n\n    have \"(?ir + ?ip) + i'a \\<noteq> bot\" using assms prems by (simp add: algebra_simps)\n    then have nbot: \"?ir + ?ip \\<noteq> bot\" using plus_fi_ops_exist(1) by blast\n    have \"?ir2 + ?ip2 = ?ir + ?ip\" using assms adjust_interface'[of ?ir ?ip r p \"{#Max_mset (x4 + {#x3#})#}\", OF nbot] by simp\n    then have \"?ir2 + (?ip' + i'a) \\<noteq> bot\" using prems assms by (simp add: algebra_simps)\n    then have \"?ip' + i'a \\<noteq> bot\" using plus_fi_ops_exist(2) by blast\n    with prems ir'_ir2 show False by simp\n  qed\n     apply (cases \"Fs r\", simp)\n    apply (cases \"Fs r\", simp)\n   apply simp\n\n  subgoal for i'a x3 x4 y x3a x4a ia\n\n    apply (rule cons_rule[OF _ _ update_correct[where V=\"{}\"], of _ \"\\<lambda>y. if y = p then Some r else \\<eta> y\"_ \"\\<lambda>x. if x = p then Fields (Some r) (Max (insert x3 (set_mset x4))) x3 x4 else Fs x\" _ \n        \"fi {r} (\\<lambda>_. x4) (\\<lambda>ya. if ya = y then {#Max_mset (x4 + {#x3#})#} else {#})\" _\n        \"fi {p} (\\<lambda>_. x4a) (\\<lambda>y. if y = r then {#Max_mset (x4a + {#x3a#})#} else {#}) + i'a\"])\n    using assms apply (simp add: algebra_simps)\n                 apply (rule ent_ex_preI)\n                 apply (rule_tac x=Fs' in ent_ex_postI)\n             apply (rule ff.GrI_cong _ eq_on_refl)\n    apply (intro onI)\n                    apply simp\n               apply simp\n    using assms search23 apply (auto simp: algebra_simps)[1]\n    using assms by (auto simp: algebra_simps)\n  done\n\nend\n", "meta": {"author": "bpoettinger", "repo": "Flow", "sha": "c95ea5f88a0a3d39e44421e0cc36139a3c3687de", "save_path": "github-repos/isabelle/bpoettinger-Flow", "path": "github-repos/isabelle/bpoettinger-Flow/Flow-c95ea5f88a0a3d39e44421e0cc36139a3c3687de/Pip_Acquire.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241911813151, "lm_q2_score": 0.538983220687684, "lm_q1q2_score": 0.33747043311337643}}
{"text": "(* Author: Joshua Schneider, ETH Zurich *)\n\nsection \\<open>Regression tests for applicative lifting\\<close>\n\ntheory Applicative_Test imports\n  Stream_Algebra\n  Applicative_Environment\n  Applicative_List\n  Applicative_Option\n  Applicative_Set\n  Applicative_Sum\n  Abstract_AF\nbegin\n\nunbundle applicative_syntax\n\nsubsection \\<open>Normal form conversion\\<close>\n\nnotepad\nbegin\n  have \"\\<forall>x. x = af_pure (\\<lambda>x. x) \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>x. af_pure x = af_pure x\" by applicative_nf rule\n  have \"\\<forall>f x. af_pure f \\<diamondop> x = af_pure f \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x y. af_pure f \\<diamondop> x \\<diamondop> y = af_pure f \\<diamondop> x \\<diamondop> y\" by applicative_nf rule\n  have \"\\<forall>g f x. af_pure g \\<diamondop> (f \\<diamondop> x) = af_pure (\\<lambda>f x. g (f x)) \\<diamondop> f \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x y. f \\<diamondop> x \\<diamondop> y = af_pure (\\<lambda>f x y. f x y) \\<diamondop> f \\<diamondop> x \\<diamondop> y\" by applicative_nf rule\n  have \"\\<forall>g f x. g \\<diamondop> (f \\<diamondop> x) = af_pure (\\<lambda>g f x. g (f x)) \\<diamondop> g \\<diamondop> f \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x. f \\<diamondop> af_pure x = af_pure (\\<lambda>f. f x) \\<diamondop> f\" by applicative_nf rule\n  have \"\\<forall>x y. af_pure x \\<diamondop> af_pure y = af_pure (x y)\" by applicative_nf rule\n  have \"\\<forall>f x y. f \\<diamondop> x \\<diamondop> af_pure y = af_pure (\\<lambda>f x. f x y) \\<diamondop> f \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x y. af_pure f \\<diamondop> x \\<diamondop> af_pure y = af_pure (\\<lambda>x. f x y) \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x y z. af_pure f \\<diamondop> x \\<diamondop> af_pure y \\<diamondop> z = af_pure (\\<lambda>x z. f x y z) \\<diamondop> x \\<diamondop> z\" by applicative_nf rule\n  have \"\\<forall>f x g y. af_pure f \\<diamondop> x \\<diamondop> (af_pure g \\<diamondop> y) = af_pure (\\<lambda>x y. f x (g y)) \\<diamondop> x \\<diamondop> y\" by applicative_nf rule\n  have \"\\<forall>f g x y. f \\<diamondop> (g \\<diamondop> x) \\<diamondop> y = af_pure (\\<lambda>f g x y. f (g x) y) \\<diamondop> f \\<diamondop> g \\<diamondop> x \\<diamondop> y\" by applicative_nf rule\n  have \"\\<forall>f g x y z. f \\<diamondop> (g \\<diamondop> x \\<diamondop> y) \\<diamondop> z = af_pure (\\<lambda>f g x y z. f (g x y) z) \\<diamondop> f \\<diamondop> g \\<diamondop> x \\<diamondop> y \\<diamondop> z\" by applicative_nf rule\n  have \"\\<forall>f g x y z. f \\<diamondop> (g \\<diamondop> (x \\<diamondop> af_pure y)) \\<diamondop> z = af_pure (\\<lambda>f g x z. f (g (x y)) z) \\<diamondop> f \\<diamondop> g \\<diamondop> x \\<diamondop> z\" by applicative_nf rule\n  have \"\\<forall>f g x. f \\<diamondop> (g \\<diamondop> x \\<diamondop> x) = af_pure (\\<lambda>f g x x'. f (g x x')) \\<diamondop> f \\<diamondop> g \\<diamondop> x \\<diamondop> x\" by applicative_nf rule\n  have \"\\<forall>f x y. f x \\<diamondop> y = af_pure (\\<lambda>f x. f x) \\<diamondop> f x \\<diamondop> y\" by applicative_nf rule\nnext\n  fix f :: \"('a \\<Rightarrow> 'b) af\" and g :: \"('b \\<Rightarrow> 'c) af\" and x\n  have \"g \\<diamondop> (f \\<diamondop> x) = af_pure (\\<lambda>g f x. g (f x)) \\<diamondop> g \\<diamondop> f \\<diamondop> x\" by applicative_nf rule\nend\n(* TODO automatic test for names of new variables *)\n\nlemma \"\\<And>f x::'a af. f \\<diamondop> x = x\"\napply applicative_nf\noops\n\nsubsection \\<open>Sets\\<close>\n\ninstantiation set :: (plus) plus\nbegin\n  definition set_plus_def[applicative_unfold]: \"(X::('a::plus)set) + Y = {plus} \\<diamondop> X \\<diamondop> Y\"\n  instance ..\nend\n\nlemma \"(X :: _ :: semigroup_add set) + Y + Z = X + (Y + Z)\"\nby (fact add.assoc[applicative_lifted set])\n\ninstantiation set :: (semigroup_add) semigroup_add begin\ninstance proof\n  fix X Y Z :: \"'a set\"\n  from add.assoc\n  show \"X + Y + Z = X + (Y + Z)\" by applicative_lifting\nqed\nend\n\ninstantiation set :: (ab_semigroup_add) ab_semigroup_add begin\ninstance proof\n  fix X Y :: \"'a set\"\n  from add.commute\n  show \"X + Y = Y + X\" by applicative_lifting\nqed\nend\n\nsubsection \\<open>Sum type (a.k.a. either)\\<close>\n\nlemma \"Inl plus \\<diamondop> (x :: nat + 'e list) \\<diamondop> x = Inl (\\<lambda>x. 2 * x) \\<diamondop> x\"\nby applicative_lifting simp\n\nlemma \"rel_sum (\\<le>) (\\<le>) (x :: nat + nat) (Inl Suc \\<diamondop> x)\"\nproof -\n  interpret either_af \"(\\<le>) :: nat \\<Rightarrow> _\" by unfold_locales (rule reflpI, simp)\n  show ?thesis by applicative_lifting simp\nqed\n\n\nsubsection \\<open>Streams\\<close>\n\nlemma \"(x::int stream) * sconst 0 = sconst 0\"\nby applicative_lifting simp\n\nlemma \"(x::int stream) * (y + z) = x * y + x * z\"\nby applicative_lifting algebra\n\n\ndefinition \"lift_streams xs = foldr (smap2 Cons) xs (sconst [])\"\n\nlemma lift_streams_Nil[applicative_unfold]: \"lift_streams [] = sconst []\"\nunfolding lift_streams_def\nby simp\n\nlemma lift_streams_Cons[applicative_unfold]:\n  \"lift_streams (x # xs) = smap2 Cons x (lift_streams xs)\"\nunfolding lift_streams_def\nby applicative_unfold\n\nlemma stream_append_Cons: \"smap2 append (smap2 Cons x ys) zs = smap2 Cons x (smap2 append ys zs)\"\nby applicative_lifting simp\n\nlemma lift_streams_append[applicative_unfold]:\n  \"lift_streams (xs @ ys) = smap2 append (lift_streams xs) (lift_streams ys)\"\nproof (induction xs)\n  case Nil\n  (*\n    case could be proved directly if \"lift_streams ([] @ ys) = lift_streams ys\" is solved\n    in head_cong_tac (invoke simplifier?) -- but only with applicative_nf\n  *)\n  have \"lift_streams ys = sconst append \\<diamondop> lift_streams [] \\<diamondop> lift_streams ys\"\n    by applicative_lifting simp\n  thus ?case by applicative_unfold\nnext\n  case (Cons x xs)\n  with stream_append_Cons  (* the actual lifted fact *)\n  show ?case by applicative_unfold (rule sym)\nqed\n\nlemma \"lift_streams (rev x) = smap rev (lift_streams x)\"\nproof (induction x)\n  case Nil\n  have \"lift_streams [] = smap rev (lift_streams [])\"\n    by applicative_lifting simp\n  thus ?case by simp\nnext\n  case (Cons x xs)\n  have \"\\<forall>y ys. rev ys @ [y] = rev (y # ys)\" by simp\n  hence \"\\<forall>y ys. smap2 append (smap rev ys) (smap2 Cons y (sconst [])) = smap rev (smap2 Cons y ys)\"\n    by applicative_lifting simp\n  with Cons.IH show ?case by applicative_unfold blast\nqed\n\ndefinition [applicative_unfold]: \"sconcat xs = smap concat xs\"\n\nlemma \"sconcat (lift_streams [sconst ''Hello '', sconst ''world!'']) = sconst ''Hello world!''\"\nby applicative_lifting simp\n\n\nsubsection \\<open>Relators\\<close>\n\nlemma \"rel_fun (=) (\\<le>) (const (0::nat)) x\"\nby applicative_lifting simp\n\nlemma \"list_all2 (\\<subseteq>) (map (\\<lambda>_. {}) x) (map set x)\"\nby applicative_nf simp\n\nlemma \"x = Some a \\<Longrightarrow> rel_option (\\<le>) (map_option (\\<lambda>_. a) x) (map_option Suc x)\"\nby applicative_lifting simp\n\nschematic_goal \"\\<forall>g f x. rel_sum ?R (=) (ap_either f x) (ap_either (ap_either (Inl g) f) x)\"\napply applicative_lifting\noops\n\nschematic_goal \"stream_all2 ?R (?f \\<diamondop> (pure ?g \\<diamondop> ?x + ?y)) (?x + ?z)\"\napply applicative_lifting\noops\n\n\nprint_applicative\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Applicative_Lifting/Applicative_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.626124191181315, "lm_q1q2_score": 0.33747043311337643}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n   Decompose a meta-conjunction as a proper fact (list of theorems)\n*)\n\ntheory Conjuncts\nimports Main\nbegin\n\nML\\<open>\n\nstructure Conjuncts =\nstruct\n\nlocal\n\n  structure Data = Generic_Data\n  (\n    type T = thm;\n    val empty: T = Drule.dummy_thm;\n    val extend = I;\n    val merge : T * T -> T = (K Drule.dummy_thm);\n  );\n\n  fun elim_conjuncts thm =\n    case try Conjunction.elim thm of\n    SOME (thm', thm'') => elim_conjuncts thm' @ elim_conjuncts thm''\n    | NONE => if Thm.prop_of thm = Thm.prop_of (Drule.dummy_thm) then [] else [thm]\n\n  in\n\n  val _ = Context.>> (Context.map_theory (\n    (Attrib.setup @{binding \"conjuncts\"}\n      (Scan.lift (Args.mode \"accumulate\") >> (fn acc =>\n        if acc then\n        Thm.declaration_attribute (Data.map o (fn x => fn y => Conjunction.intr y x))\n        else\n        Thm.declaration_attribute Data.put))\n      \"add meta_conjuncts to \\\"conjuncts\\\" named theorem\") #>\n    Global_Theory.add_thms_dynamic (@{binding \"conjuncts\"}, elim_conjuncts o Data.get)))\n\nend\n\nend\n\n\\<close>\n\nnotepad begin\n\n  fix A B C D\n  assume ABC[conjuncts]: \"(A &&& B) &&& (B &&& C)\"\n  note ABC' = conjuncts\n\n  have \"A\" by (rule ABC')\n  have \"B\" by (rule \\<open>B\\<close>)\n  have \"C\" by (rule ABC'(4))\n\n  (* Disclaimer: only the last declared lemma is stored *)\n  assume ABCD[conjuncts]: \"A &&& B\" \"C &&& D\"\n  note CD = conjuncts\n\n  have \"A\" by ((rule CD)?,rule ABC')\n  have \"C\" by (rule CD)\n\n\n\n  note ABCD(1)[conjuncts]\n  note AB = conjuncts\n\n  note ABCD(2)[conjuncts]\n  note CD = conjuncts\n\n  (* We can accumulate multi-thms, we just need to clear conjuncts first *)\n  note [[conjuncts]]\n\n  note ABCD[conjuncts (accumulate)]\n  note ABCD' = conjuncts\n\nend\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/Conjuncts.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5389832058771036, "lm_q2_score": 0.6261241842048092, "lm_q1q2_score": 0.3374704200798942}}
{"text": "(*  Title:      JinjaThreads/J/DefAssPreservation.thy\n    Author:     Andreas Lochbihler, Tobias Nipkow\n*)\nheader {* \\isaheader{Preservation of definite assignment} *}\n\ntheory DefAssPreservation\nimports\n  DefAss\n  JWellForm\n  SmallStep\nbegin\n\ntext{* Preservation of definite assignment more complex and requires a\nfew lemmas first. *}\n\nlemma D_extRetJ [intro!]: \"\\<D> e A \\<Longrightarrow> \\<D> (extRet2J e va) A\"\nby(cases va) simp_all\n\nlemma blocks_defass [iff]: \"\\<And>A. \\<lbrakk> length Vs = length Ts; length vs = length Ts\\<rbrakk> \\<Longrightarrow>\n \\<D> (blocks Vs Ts vs e) A = \\<D> e (A \\<squnion> \\<lfloor>set Vs\\<rfloor>)\"\n(*<*)\napply(induct Vs Ts vs e rule:blocks.induct)\napply(simp_all add:hyperset_defs)\ndone\n(*>*)\n\ncontext J_heap_base begin\n\nlemma red_lA_incr: \"extTA,P,t \\<turnstile> \\<langle>e,s\\<rangle> -ta\\<rightarrow> \\<langle>e',s'\\<rangle> \\<Longrightarrow> \\<lfloor>dom (lcl s)\\<rfloor> \\<squnion> \\<A> e \\<sqsubseteq>  \\<lfloor>dom (lcl s')\\<rfloor> \\<squnion> \\<A> e'\"\n  and reds_lA_incr: \"extTA,P,t \\<turnstile> \\<langle>es,s\\<rangle> [-ta\\<rightarrow>] \\<langle>es',s'\\<rangle> \\<Longrightarrow> \\<lfloor>dom (lcl s)\\<rfloor> \\<squnion> \\<A>s es \\<sqsubseteq>  \\<lfloor>dom (lcl s')\\<rfloor> \\<squnion> \\<A>s es'\"\napply(induct rule:red_reds.inducts)\napply(simp_all del:fun_upd_apply add:hyperset_defs)\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply(force split: split_if_asm)\napply blast\napply blast\napply blast\napply blast\napply blast\napply(blast dest: red_lcl_incr)\napply(blast dest: red_lcl_incr)\nby blast+\n\nend\n\ntext{* Now preservation of definite assignment. *}\n\ndeclare hyperUn_comm [simp del]\ndeclare hyperUn_leftComm [simp del]\n\ncontext J_heap_base begin\n\nlemma assumes wf: \"wf_J_prog P\"\n  shows red_preserves_defass: \"extTA,P,t \\<turnstile> \\<langle>e,s\\<rangle> -ta\\<rightarrow> \\<langle>e',s'\\<rangle> \\<Longrightarrow> \\<D> e \\<lfloor>dom (lcl s)\\<rfloor> \\<Longrightarrow> \\<D> e' \\<lfloor>dom (lcl s')\\<rfloor>\"\n  and reds_preserves_defass: \"extTA,P,t \\<turnstile> \\<langle>es,s\\<rangle> [-ta\\<rightarrow>] \\<langle>es',s'\\<rangle> \\<Longrightarrow> \\<D>s es \\<lfloor>dom (lcl s)\\<rfloor> \\<Longrightarrow> \\<D>s es' \\<lfloor>dom (lcl s')\\<rfloor>\"\nproof (induct rule:red_reds.inducts)\n  case BinOpRed1 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case AAccRed1 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case (AAssRed1 a s ta a' s' i e)\n  have ss: \"extTA,P,t \\<turnstile> \\<langle>a,s\\<rangle> -ta\\<rightarrow> \\<langle>a',s'\\<rangle>\"\n    and IH: \"\\<D> a \\<lfloor>dom (lcl s)\\<rfloor> \\<Longrightarrow> \\<D> a' \\<lfloor>dom (lcl s')\\<rfloor>\"\n    and D: \"\\<D> (a\\<lfloor>i\\<rceil> := e) \\<lfloor>dom (lcl s)\\<rfloor>\" by fact+\n  from D have \"\\<D> a \\<lfloor>dom (lcl s)\\<rfloor>\" by simp\n  with IH have Da: \"\\<D> a' \\<lfloor>dom (lcl s')\\<rfloor>\" by simp\n  from ss have domgrow: \"\\<lfloor>dom (lcl s)\\<rfloor> \\<squnion> \\<A> a \\<sqsubseteq>  \\<lfloor>dom (lcl s')\\<rfloor> \\<squnion> \\<A> a'\" by - (erule red_lA_incr)\n  from D have \"\\<D> i (\\<lfloor>dom (lcl s)\\<rfloor> \\<squnion> \\<A> a)\" by simp\n  with domgrow have Di: \"\\<D> i (\\<lfloor>dom (lcl s')\\<rfloor> \\<squnion> \\<A> a')\" by - (erule D_mono)\n  from domgrow have domgrow2: \"\\<lfloor>dom (lcl s)\\<rfloor> \\<squnion> \\<A> a \\<squnion> \\<A> i \\<sqsubseteq> \\<lfloor>dom (lcl s')\\<rfloor> \\<squnion> \\<A> a' \\<squnion> \\<A> i\" by - (rule sqUn_lem)\n  from D have \"\\<D> e (\\<lfloor>dom (lcl s)\\<rfloor> \\<squnion> \\<A> a \\<squnion> \\<A> i)\" by simp\n  with domgrow2 have De: \"\\<D> e (\\<lfloor>dom (lcl s')\\<rfloor> \\<squnion> \\<A> a' \\<squnion> \\<A> i)\" by - (erule D_mono)\n  from Da Di De show ?case by simp\nnext\n  case AAssRed2 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case FAssRed1 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case CallObj thus ?case by (auto elim!: Ds_mono[OF red_lA_incr])\nnext\n  case CallParams thus ?case by(auto elim!: Ds_mono[OF red_lA_incr])\nnext\n  case RedCall thus ?case by(auto dest!:sees_wf_mdecl[OF wf] simp:wf_mdecl_def elim!:D_mono')\nnext\n  case BlockRed thus ?case\n    by(auto simp:hyperset_defs elim!:D_mono' simp del:fun_upd_apply split: split_if_asm)\nnext\n  case SynchronizedRed1 thus ?case by(auto elim!: D_mono[OF red_lA_incr])\nnext\n  case SeqRed thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case CondRed thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case TryRed thus ?case\n    by (fastforce dest:red_lcl_incr intro:D_mono' simp:hyperset_defs)\nnext\n  case RedWhile thus ?case by(auto simp:hyperset_defs elim!:D_mono')\nnext\n  case ListRed1 thus ?case by (auto elim!: Ds_mono[OF red_lA_incr])\nqed (auto simp:hyperset_defs)\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/J/DefAssPreservation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6261241632752915, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.337470418072498}}
{"text": "(*\n  File:   SDS_Impossibility.thy\n  Author: Manuel Eberl <eberlm@in.tum.de>\n\n  The proof that there exists no anonymous and neutral SDS for at least \n  four voters and alternatives that satisfies SD-Efficiency and \n  SD-Strategy-Proofness.\n*)\n\nsection \\<open>Incompatibility of SD-Efficiency and SD-Strategy-Proofness\\<close>\n\ntheory SDS_Impossibility\nimports\n  \"../Randomised_Social_Choice/Automation/SDS_Automation\"\n  \"../Randomised_Social_Choice/Randomised_Social_Choice\"\nbegin\n\nsubsection \\<open>Preliminary Definitions\\<close>\n\nlocale sds_impossibility = \n  anonymous_sds agents alts sds +\n  neutral_sds agents alts sds +\n  sd_efficient_sds agents alts sds +\n  strategyproof_sds agents alts sds\n  for agents :: \"'agent set\" and alts :: \"'alt set\" and sds +\n  assumes agents_ge_4: \"card agents \\<ge> 4\"\n      and alts_ge_4:   \"card alts \\<ge> 4\"\n\nlocale sds_impossibility_4_4 = sds_impossibility agents alts sds\n  for agents :: \"'agent set\" and alts :: \"'alt set\" and sds +\n  fixes A1 A2 A3 A4 :: 'agent and a b c d :: 'alt\n  assumes distinct_agents: \"distinct [A1, A2, A3, A4]\"\n      and distinct_alts: \"distinct [a, b, c, d]\"\n      and agents: \"agents = {A1, A2, A3, A4}\"\n      and alts:   \"alts   = {a, b, c, d}\"\nbegin\n\nlemma an_sds: \"an_sds agents alts sds\" by unfold_locales\nlemma ex_post_efficient_sds: \"ex_post_efficient_sds agents alts sds\" by unfold_locales\nlemma sd_efficient_sds: \"sd_efficient_sds agents alts sds\" by unfold_locales\nlemma strategyproof_an_sds: \"strategyproof_an_sds agents alts sds\" by unfold_locales\n\nlemma distinct_agents' [simp]: \n  \"A1 \\<noteq> A2\" \"A1 \\<noteq> A3\" \"A1 \\<noteq> A4\" \"A2 \\<noteq> A1\" \"A2 \\<noteq> A3\" \"A2 \\<noteq> A4\" \n  \"A3 \\<noteq> A1\" \"A3 \\<noteq> A2\" \"A3 \\<noteq> A4\" \"A4 \\<noteq> A1\" \"A4 \\<noteq> A2\" \"A4 \\<noteq> A3\"\n  using distinct_agents by auto\n  \nlemma distinct_alts' [simp]:\n  \"a \\<noteq> b\" \"a \\<noteq> c\" \"a \\<noteq> d\" \"b \\<noteq> a\" \"b \\<noteq> c\" \"b \\<noteq> d\" \n  \"c \\<noteq> a\" \"c \\<noteq> b\" \"c \\<noteq> d\" \"d \\<noteq> a\" \"d \\<noteq> b\" \"d \\<noteq> c\"\n  using distinct_alts by auto\n\nlemma card_agents [simp]: \"card agents = 4\" and card_alts [simp]: \"card alts = 4\"\n  using distinct_agents distinct_alts by (simp_all add: agents alts)\n\nlemma in_agents [simp]: \"A1 \\<in> agents\" \"A2 \\<in> agents\" \"A3 \\<in> agents\" \"A4 \\<in> agents\"\n  by (simp_all add: agents)\n\nlemma in_alts [simp]: \"a \\<in> alts\" \"b \\<in> alts\" \"c \\<in> alts\" \"d \\<in> alts\"\n  by (simp_all add: alts)\n  \nlemma agent_iff: \"x \\<in> agents \\<longleftrightarrow> x \\<in> {A1, A2, A3, A4}\"\n                 \"(\\<forall>x\\<in>agents. P x) \\<longleftrightarrow> P A1 \\<and> P A2 \\<and> P A3 \\<and> P A4\"\n                 \"(\\<exists>x\\<in>agents. P x) \\<longleftrightarrow> P A1 \\<or> P A2 \\<or> P A3 \\<or> P A4\"\n  by (auto simp add: agents)\n\nlemma alt_iff: \"x \\<in> alts \\<longleftrightarrow> x \\<in> {a,b,c,d}\"\n               \"(\\<forall>x\\<in>alts. P x) \\<longleftrightarrow> P a \\<and> P b \\<and> P c \\<and> P d\"\n               \"(\\<exists>x\\<in>alts. P x) \\<longleftrightarrow> P a \\<or> P b \\<or> P c \\<or> P d\"\n  by (auto simp add: alts)\n\n\n\n\nsubsection \\<open>Definition of Preference Profiles and Fact Gathering\\<close>\n\npreference_profile \n  agents: agents\n  alts:   alts\nwhere R1  = A1: [c, d], [a, b]    A2: [b, d], a, c      A3: a, b, [c, d]      A4: [a, c], [b, d]\n  and R2  = A1: [a, c], [b, d]    A2: [c, d], a, b      A3: [b, d], a, c      A4: a, b, [c, d]\n  and R3  = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: d, [a, b], c      A4: c, a, [b, d]\n  and R4  = A1: [a, b], [c, d]    A2: [a, d], [b, c]    A3: c, [a, b], d      A4: d, c, [a, b]\n  and R5  = A1: [c, d], [a, b]    A2: [a, b], [c, d]    A3: [a, c], d, b      A4: d, [a, b], c\n  and R6  = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], [b, d]    A4: d, b, a, c\n  and R7  = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: a, c, d, b        A4: d, [a, b], c\n  and R8  = A1: [a, b], [c, d]    A2: [a, c], [b, d]    A3: d, [a, b], c      A4: d, c, [a, b]\n  and R9  = A1: [a, b], [c, d]    A2: [a, d], c, b      A3: d, c, [a, b]      A4: [a, b, c], d\n  and R10 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], d, b      A4: [b, d], a, c\n  and R11 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: d, [a, b], c      A4: c, a, b, d\n  and R12 = A1: [c, d], [a, b]    A2: [a, b], [c, d]    A3: [a, c], d, b      A4: [a, b, d], c\n  and R13 = A1: [a, c], [b, d]    A2: [c, d], a, b      A3: [b, d], a, c      A4: a, b, d, c\n  and R14 = A1: [a, b], [c, d]    A2: d, c, [a, b]      A3: [a, b, c], d      A4: a, d, c, b\n  and R15 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [b, d], a, c      A4: a, c, d, b\n  and R16 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: a, c, d, b        A4: [a, b, d], c\n  and R17 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], [b, d]    A4: d, [a, b], c\n  and R18 = A1: [a, b], [c, d]    A2: [a, d], [b, c]    A3: [a, b, c], d      A4: d, c, [a, b]\n  and R19 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [b, d], a, c      A4: [a, c], [b, d]\n  and R20 = A1: [b, d], a, c      A2: b, a, [c, d]      A3: a, c, [b, d]      A4: d, c, [a, b]\n  and R21 = A1: [a, d], c, b      A2: d, c, [a, b]      A3: c, [a, b], d      A4: a, b, [c, d]\n  and R22 = A1: [a, c], d, b      A2: d, c, [a, b]      A3: d, [a, b], c      A4: a, b, [c, d]\n  and R23 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], [b, d]    A4: [a, b, d], c\n  and R24 = A1: [c, d], [a, b]    A2: d, b, a, c        A3: c, a, [b, d]      A4: b, a, [c, d]\n  and R25 = A1: [c, d], [a, b]    A2: [b, d], a, c      A3: a, b, [c, d]      A4: a, c, [b, d]\n  and R26 = A1: [b, d], [a, c]    A2: [c, d], [a, b]    A3: a, b, [c, d]      A4: a, c, [b, d]\n  and R27 = A1: [a, b], [c, d]    A2: [b, d], a, c      A3: [a, c], [b, d]    A4: [c, d], a, b\n  and R28 = A1: [c, d], a, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: a, c, [b, d]\n  and R29 = A1: [a, c], d, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: d, c, [a, b]\n  and R30 = A1: [a, d], c, b      A2: d, c, [a, b]      A3: c, [a, b], d      A4: [a, b], d, c\n  and R31 = A1: [b, d], a, c      A2: [a, c], d, b      A3: c, d, [a, b]      A4: [a, b], c, d\n  and R32 = A1: [a, c], d, b      A2: d, c, [a, b]      A3: d, [a, b], c      A4: [a, b], d, c\n  and R33 = A1: [c, d], [a, b]    A2: [a, c], d, b      A3: a, b, [c, d]      A4: d, [a, b], c\n  and R34 = A1: [a, b], [c, d]    A2: a, c, d, b        A3: b, [a, d], c      A4: c, d, [a, b]\n  and R35 = A1: [a, d], c, b      A2: a, b, [c, d]      A3: [a, b, c], d      A4: d, c, [a, b]\n  and R36 = A1: [c, d], [a, b]    A2: [a, c], d, b      A3: [b, d], a, c      A4: a, b, [c, d]\n  and R37 = A1: [a, c], [b, d]    A2: [b, d], [a, c]    A3: a, b, [c, d]      A4: c, d, [a, b]\n  and R38 = A1: [c, d], a, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: [a, c], b, d\n  and R39 = A1: [a, c], d, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: [c, d], a, b\n  and R40 = A1: [a, d], c, b      A2: [a, b], c, d      A3: [a, b, c], d      A4: d, c, [a, b]\n  and R41 = A1: [a, d], c, b      A2: [a, b], d, c      A3: [a, b, c], d      A4: d, c, [a, b]\n  and R42 = A1: [c, d], [a, b]    A2: [a, b], [c, d]    A3: d, b, a, c        A4: c, a, [b, d]\n  and R43 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: d, [a, b], c      A4: a, [c, d], b\n  and R44 = A1: [c, d], [a, b]    A2: [a, c], d, b      A3: [a, b], d, c      A4: [a, b, d], c\n  and R45 = A1: [a, c], d, b      A2: [b, d], a, c      A3: [a, b], c, d      A4: [c, d], b, a\n  and R46 = A1: [b, d], a, c      A2: d, c, [a, b]      A3: [a, c], [b, d]    A4: b, a, [c, d]\n  and R47 = A1: [a, b], [c, d]    A2: [a, d], c, b      A3: d, c, [a, b]      A4: c, [a, b], d\n  by (simp_all add: agents alts)\n\nderive_orbit_equations (an_sds)\n  R10 R26 R27 R28 R29 R43 R45\n  by simp_all\n\nprove_inefficient_supports (ex_post_efficient_sds sd_efficient_sds)\n  R3 [b] and R4 [b] and R5 [b] and R7 [b] and R8 [b] and\n  R9 [b] and R11 [b] and R12 [b] and R14 [b] and R16 [b] and\n  R17 [b] and R18 [b] and R21 [b] and R22 [b] and R23 [b] and\n  R30 [b] and R32 [b] and R33 [b] and R35 [b] and R40 [b] and\n  R41 [b] and R43 [b] and R44 [b] and R47 [b] and\n  R10 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R15 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R19 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R25 [b, c] witness: [c: 0, d: 1 / 2, a: 1 / 2, b: 0] and\n  R26 [c, b] witness: [b: 0, d: 1 / 2, a: 1 / 2, c: 0] and\n  R27 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R28 [b, c] witness: [c: 0, d: 1 / 2, a: 1 / 2, b: 0] and\n  R29 [b, c] witness: [a: 1 / 2, c: 0, d: 1 / 2, b: 0] and\n  R39 [b, c] witness: [a: 1 / 2, c: 0, d: 1 / 2, b: 0]\n  by (simp_all add: agent_iff alt_iff)\n\nderive_strategyproofness_conditions (strategyproof_an_sds)\n  distance: 2\n  R1 R2 R3 R4 R5 R6 R7 R8 R9 R10 R11 R12 R13 R14 R15 R16 R17 R18 R19 R20\n  R21 R22 R23 R24 R25 R26 R27 R28 R29 R30 R31 R32 R33 R34 R35 R36 R37 R38 R39 R40\n  R41 R42 R43 R44 R45 R46 R47\n  by (simp_all add: agent_iff alt_iff)\n\nlemma lottery_conditions:\n  assumes \"is_pref_profile R\"\n  shows   \"pmf (sds R) a \\<ge> 0\" \"pmf (sds R) b \\<ge> 0\" \"pmf (sds R) c \\<ge> 0\" \"pmf (sds R) d \\<ge> 0\"\n          \"pmf (sds R) a + pmf (sds R) b + pmf (sds R) c + pmf (sds R) d = 1\"\n  using lottery_prob_alts[OF sds_wf[OF assms]]\n  by (simp_all add: alts pmf_nonneg measure_measure_pmf_finite)\n\n\nsubsection \\<open>Main Proof\\<close>\n\nlemma R45 [simp]: \"pmf (sds R45) a = 1/4\" \"pmf (sds R45) b = 1/4\" \n           \"pmf (sds R45) c = 1/4\" \"pmf (sds R45) d = 1/4\"\n  using R45.orbits lottery_conditions[OF R45.wf] by simp_all\n\nlemma R10_bc [simp]: \"pmf (sds R10) b = 0\" \"pmf (sds R10) c = 0\"\n  using R10.support R10.orbits by auto\n\nlemma R10_ad [simp]: \"pmf (sds R10) a = 1/2\" \"pmf (sds R10) d = 1/2\"\n  using lottery_conditions[OF R10.wf] R10_bc R10.orbits by simp_all\n\n\nlemma R26_bc [simp]: \"pmf (sds R26) b = 0\" \"pmf (sds R26) c = 0\"\n  using R26.support R26.orbits by auto\n\nlemma R26_d [simp]: \"pmf (sds R26) d = 1 - pmf (sds R26) a\"\n  using lottery_conditions[OF R26.wf] R26_bc by simp\n\n\nlemma R27_bc [simp]: \"pmf (sds R27) b = 0\" \"pmf (sds R27) c = 0\"\n  using R27.support R27.orbits by auto\n\nlemma R27_d [simp]: \"pmf (sds R27) d = 1 - pmf (sds R27) a\"\n  using lottery_conditions[OF R27.wf] R27_bc by simp\n\n\nlemma R28_bc [simp]: \"pmf (sds R28) b = 0\" \"pmf (sds R28) c = 0\"\n  using R28.support R28.orbits by auto\n\nlemma R28_d [simp]: \"pmf (sds R28) d = 1 - pmf (sds R28) a\"\n  using lottery_conditions[OF R28.wf] R28_bc by simp\n\n\n\n\nlemma R29_ac [simp]: \"pmf (sds R29) a = 1/2\" \"pmf (sds R29) d = 1/2\"\n  using lottery_conditions[OF R29.wf] R29_bc R29.orbits by simp_all\n\n\nlemmas R43_bc [simp] = R43.support\n\nlemma R43_ad [simp]: \"pmf (sds R43) a = 1/2\" \"pmf (sds R43) d = 1/2\"\n  using lottery_conditions[OF R43.wf] R43_bc R43.orbits by simp_all\n\n\nlemma R39_b [simp]: \"pmf (sds R39) b = 0\"\nproof -\n  {\n    assume [simp]: \"pmf (sds R39) c = 0\"\n    with R29_R39.strategyproofness(1)\n      have \"pmf (sds R39) d \\<le> 1/2\" by auto\n    with R39_R29.strategyproofness(1) lottery_conditions[OF R39.wf] \n      have \"pmf (sds R39) b = 0\" by auto\n  }\n  with R39.support show ?thesis by blast\nqed\n\nlemma R36_a [simp]: \"pmf (sds R36) a = 1/2\" and R36_b [simp]: \"pmf (sds R36) b = 0\"\nproof -\n  from R10_R36.strategyproofness(1) lottery_conditions[OF R36.wf] \n    have \"pmf (sds R36) a + pmf (sds R36) b \\<le> 1/2\" by auto\n  with R36_R10.strategyproofness(1) lottery_conditions[OF R36.wf]\n    show \"pmf (sds R36) a = 1/2\" \"pmf (sds R36) b = 0\" by auto\nqed\n\nlemma R36_d [simp]: \"pmf (sds R36) d = 1/2 - pmf (sds R36) c\"\n  using lottery_conditions[OF R36.wf] by simp\n\nlemma R39_a [simp]: \"pmf (sds R39) a = 1/2\"\nproof -\n  from R36_R39.strategyproofness(1) lottery_conditions[OF R39.wf]\n    have \"pmf (sds R39) a \\<ge> 1/2\" by auto\n  with R39_R36.strategyproofness(1) lottery_conditions[OF R39.wf]\n    show ?thesis by auto\nqed\n\nlemma R39_d [simp]: \"pmf (sds R39) d = 1/2 - pmf (sds R39) c\"\n  using lottery_conditions[OF R39.wf] by simp\n\n\n\nlemmas R12_b [simp] = R12.support\n\nlemma R12_c [simp]: \"pmf (sds R12) c = 0\"\n  using R12_R10.strategyproofness(1) lottery_conditions[OF R12.wf] by auto\n\nlemma R12_d [simp]: \"pmf (sds R12) d = 1 - pmf (sds R12) a\"\n  using lottery_conditions[OF R12.wf] by simp\n\nlemma R12_a_ge_one_half: \"pmf (sds R12) a \\<ge> 1/2\"\n  using R10_R12.strategyproofness(1) lottery_conditions[OF R12.wf]\n  by auto\n\n\nlemma R44 [simp]: \n  \"pmf (sds R44) a = pmf (sds R12) a\" \"pmf (sds R44) d = 1 - pmf (sds R12) a\"\n  \"pmf (sds R44) b = 0\" \"pmf (sds R44) c = 0\"\nproof -\n  from R12_R44.strategyproofness(1) R44.support have \"pmf (sds R44) a \\<le> pmf (sds R12) a\" by simp\n  with R44_R12.strategyproofness(1) R44.support lottery_conditions[OF R44.wf]\n    show \"pmf (sds R44) a = pmf (sds R12) a\" \"pmf (sds R44) c = 0\"\n         \"pmf (sds R44) d = 1 - pmf (sds R12) a\" by auto\nqed (insert R44.support, simp_all)\n\nlemma R9_a [simp]: \"pmf (sds R9) a = pmf (sds R35) a\"\nproof -\n  from R9_R35.strategyproofness(1) R35.support R9.support \n    have \"pmf (sds R35) a \\<le> pmf (sds R9) a\" by simp\n  with R35_R9.strategyproofness(1) R9.support R35.support show ?thesis by simp\nqed\n\nlemma R18_c [simp]: \"pmf (sds R18) c = pmf (sds R9) c\"\nproof -\n  from R18_R9.strategyproofness(1) R18.support R9.support\n    have \"pmf (sds R18) d + pmf (sds R18) a \\<ge> pmf (sds R9) d + pmf (sds R9) a\" by auto\n  with R9_R18.strategyproofness(1) R18.support R9.support\n        lottery_conditions[OF R9.wf] lottery_conditions[OF R18.wf]\n    show ?thesis by auto\nqed\n\nlemma R5_d_ge_one_half: \"pmf (sds R5) d \\<ge> 1/2\"\n  using R5_R10.strategyproofness(1) R5.support lottery_conditions[OF R5.wf] by auto\n\nlemma R7 [simp]: \"pmf (sds R7) a = 1/2\" \"pmf (sds R7) b = 0\" \"pmf (sds R7) c = 0\" \"pmf (sds R7) d = 1/2\"\nproof -\n  from R5_d_ge_one_half have \"1/2 \\<le> pmf (sds R5) d\" by simp\n  also from R5_R17.strategyproofness(1) R17.support lottery_conditions[OF R5.wf] lottery_conditions[OF R17.wf] \n    have \"\\<dots> \\<le> pmf (sds R17) d\" by auto\n  also from R17_R7.strategyproofness(1) lottery_conditions[OF R7.wf] lottery_conditions[OF R17.wf] R7.support\n    have \"pmf (sds R17) d \\<le> pmf (sds R7) d\" by auto\n  finally have \"pmf (sds R7) d \\<ge> 1/2\" .\n  with R7_R43.strategyproofness(1) lottery_conditions[OF R7.wf] R7.support\n    show \"pmf (sds R7) a = 1/2\" \"pmf (sds R7) b = 0\" \"pmf (sds R7) c = 0\" \"pmf (sds R7) d = 1/2\"\n    by auto\nqed\n\nlemma R5 [simp]: \"pmf (sds R5) a = 1/2\" \"pmf (sds R5) b = 0\" \"pmf (sds R5) c = 0\" \"pmf (sds R5) d = 1/2\"\nproof -\n  from R5_R7.strategyproofness(1) lottery_conditions[OF R5.wf] R5.support \n    have \"pmf (sds R5) d \\<le> 1/2\" by auto\n  with R5_d_ge_one_half show d: \"pmf (sds R5) d = 1 / 2\" by simp\n  with R5_R10.strategyproofness(1) lottery_conditions[OF R5.wf] R5.support\n    show \"pmf (sds R5) c = 0\" \"pmf (sds R5) a = 1/2\" by simp_all\nqed (simp_all add: R5.support)\n\nlemma R15 [simp]: \"pmf (sds R15) a = 1/2\" \"pmf (sds R15) b = 0\" \"pmf (sds R15) c = 0\" \"pmf (sds R15) d = 1/2\"\nproof -\n  {\n    assume \"pmf (sds R15) b = 0\"\n    with R10_R15.strategyproofness(1) lottery_conditions[OF R15.wf]\n      have \"pmf (sds R15) a + pmf (sds R15) c \\<le> 1/2\" by auto\n    with R15_R10.strategyproofness(1) lottery_conditions[OF R15.wf] \n      have \"pmf (sds R15) c = 0\" by auto\n  }\n  with R15.support show [simp]: \"pmf (sds R15) c = 0\" by blast\n  with R15_R5.strategyproofness(1) lottery_conditions[OF R15.wf] \n    have \"pmf (sds R15) a \\<ge> 1/2\" by auto\n  moreover from R15_R7.strategyproofness(1) lottery_conditions[OF R15.wf]\n    have \"pmf (sds R15) b + pmf (sds R15) d \\<ge> 1/2\" by auto\n  ultimately show \"pmf (sds R15) a = 1/2\" using lottery_conditions[OF R15.wf] by auto\n  with R15_R5.strategyproofness(1) lottery_conditions[OF R15.wf]\n    show \"pmf (sds R15) d = 1/2\" \"pmf (sds R15) b = 0\" by auto\nqed\n\nlemma R13_aux: \"pmf (sds R13) b = 0\" \"pmf (sds R13) c = 0\" \"pmf (sds R13) d = 1 - pmf (sds R13) a\"\n  and R27_R13 [simp]: \"pmf (sds R27) a = pmf (sds R13) a\" \n  using R27_R13.strategyproofness(1) R13_R27.strategyproofness(1) lottery_conditions[OF R13.wf] by auto\n\nlemma R13 [simp]: \"pmf (sds R13) a = 1/2\" \"pmf (sds R13) b = 0\" \"pmf (sds R13) c = 0\" \"pmf (sds R13) d = 1/2\"\n  using R15_R13.strategyproofness(1) R13_R15.strategyproofness(1) R13_aux by simp_all\n\nlemma R27 [simp]: \"pmf (sds R27) a = 1/2\" \"pmf (sds R27) b = 0\" \"pmf (sds R27) c = 0\" \"pmf (sds R27) d = 1/2\"\n  by simp_all\n\nlemma R19 [simp]: \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) b = 0\" \"pmf (sds R19) c = 0\" \"pmf (sds R19) d = 1/2\"\nproof -\n  have \"pmf (sds R19) a = 1/2 \\<and> pmf (sds R19) b = 0 \\<and> pmf (sds R19) c = 0 \\<and> pmf (sds R19) d = 1/2\"\n  proof (rule disjE[OF R19.support]; safe)\n    assume [simp]: \"pmf (sds R19) b = 0\"\n    from R10_R19.strategyproofness(1) lottery_conditions[OF R19.wf] \n      have \"pmf (sds R19) a + pmf (sds R19) c \\<le> 1/2\" by auto\n    moreover from R19_R10.strategyproofness(1) \n      have \"pmf (sds R19) a + pmf (sds R19) c \\<ge> 1/2\" by simp\n    ultimately show \"pmf (sds R19) d = 1/2\" using lottery_conditions[OF R19.wf] by simp\n    with R27_R19.strategyproofness(1) lottery_conditions[OF R19.wf] \n      show \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) c = 0\" by auto\n  next\n    assume [simp]: \"pmf (sds R19) c = 0\"\n    from R19_R10.strategyproofness(1) have \"pmf (sds R19) a \\<ge> 1/2\" by auto\n    moreover from R19_R27.strategyproofness(1) have \"pmf (sds R19) d \\<ge> 1/2\" by auto\n    ultimately show \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) d = 1/2\" \"pmf (sds R19) b = 0\"\n      using lottery_conditions[OF R19.wf] by auto\n  qed\n  thus \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) b = 0\" \"pmf (sds R19) c = 0\" \"pmf (sds R19) d = 1/2\" \n    by blast+\nqed\n\nlemma R1 [simp]: \"pmf (sds R1) a = 1/2\" \"pmf (sds R1) b = 0\"\nproof -\n  from R19_R1.strategyproofness(1) lottery_conditions[OF R1.wf]\n    have \"pmf (sds R1) a + pmf (sds R1) b \\<le> 1/2\" by simp\n  with R1_R19.strategyproofness(1) lottery_conditions[OF R1.wf]\n    show \"pmf (sds R1) a = 1/2\" \"pmf (sds R1) b = 0\" by auto\nqed\n\nlemma R22 [simp]: \"pmf (sds R22) a = 1/2\" \"pmf (sds R22) b = 0\" \"pmf (sds R22) c = 0\" \"pmf (sds R22) d = 1/2\"\nproof -\n  from R33_R5.strategyproofness(1) R33.support\n    have \"1/2 \\<le> pmf (sds R33) a\" by auto\n  also from R33_R22.strategyproofness(1) R22.support R33.support \n    lottery_conditions[OF R22.wf] lottery_conditions[OF R33.wf]\n    have \"\\<dots> \\<le> pmf (sds R22) a\" by simp\n  finally show \"pmf (sds R22) a = 1/2\" \"pmf (sds R22) b = 0\" \"pmf (sds R22) c = 0\" \"pmf (sds R22) d = 1/2\"\n    using R22_R29.strategyproofness(1) lottery_conditions[OF R22.wf] by auto\nqed\n\nlemma R28 [simp]: \"pmf (sds R28) a = 1/2\" \"pmf (sds R28) b = 0\" \"pmf (sds R28) c = 0\" \"pmf (sds R28) d = 1/2\"\nproof -\n  have \"pmf (sds R28) a \\<le> pmf (sds R32) d\"\n    using R32_R28.strategyproofness(1) lottery_conditions[OF R32.wf] by auto\n  hence R32_d: \"pmf (sds R32) d = pmf (sds R28) a\"\n    using R28_R32.strategyproofness(1) lottery_conditions[OF R32.wf] by auto\n\n  from R22_R32.strategyproofness(1) lottery_conditions[OF R32.wf] R32.support \n    have \"pmf (sds R32) a \\<le> 1/2\" by auto\n  with R32_R22.strategyproofness(1) lottery_conditions[OF R32.wf] R32.support \n    show \"pmf (sds R28) a = 1/2\" \"pmf (sds R28) b = 0\" \"pmf (sds R28) c = 0\" \"pmf (sds R28) d = 1/2\"\n    by (auto simp: R32_d)\nqed\n\nlemma R39 [simp]: \"pmf (sds R39) a = 1/2\" \"pmf (sds R39) b = 0\" \"pmf (sds R39) c = 0\" \"pmf (sds R39) d = 1/2\"\nproof -\n  from R28_R39.strategyproofness(1) show \"pmf (sds R39) c = 0\" by simp\n  thus \"pmf (sds R39) a = 1/2\" \"pmf (sds R39) b = 0\" \"pmf (sds R39) d = 1/2\"\n    by simp_all\nqed\n\nlemma R2 [simp]: \"pmf (sds R2) a = 1/2\" \"pmf (sds R2) b = 0\" \"pmf (sds R2) c = 0\" \"pmf (sds R2) d = 1/2\"\nproof -\n  from R1_R2.strategyproofness(1) R2_R1.strategyproofness(1) lottery_conditions[OF R2.wf] lottery_conditions[OF R1.wf]\n    have \"pmf (sds R2) a = 1/2\" \"pmf (sds R2) c + pmf (sds R2) d = 1/2\" by (auto simp: algebra_simps)\n  with R39_R2.strategyproofness(1) lottery_conditions[OF R2.wf]\n    show \"pmf (sds R2) a = 1/2\" \"pmf (sds R2) b = 0\" \"pmf (sds R2) c = 0\" \"pmf (sds R2) d = 1/2\"\n    by auto\nqed\n\nlemma R42 [simp]: \"pmf (sds R42) a = 0\" \"pmf (sds R42) b = 0\" \"pmf (sds R42) c = 1/2\" \"pmf (sds R42) d = 1/2\"\nproof -\n  from R17_R5.strategyproofness(1) lottery_conditions[OF R17.wf] R17.support \n    have \"pmf (sds R17) d \\<le> 1/2\" by auto\n  moreover from R5_R17.strategyproofness(1) R17.support lottery_conditions[OF R17.wf] \n    have \"pmf (sds R17) d \\<ge> 1/2\" by auto\n  ultimately have R17_d: \"pmf (sds R17) d = 1/2\" by simp\n\n  from R6_R42.strategyproofness(1) \n    have \"pmf (sds R42) a + pmf (sds R42) c \\<le> pmf (sds R6) a + pmf (sds R6) c\" by simp\n  also from R6_R19.strategyproofness(1) lottery_conditions[OF R6.wf] \n    have \"pmf (sds R6) a + pmf (sds R6) c \\<le> 1/2\" by auto\n  finally have \"pmf (sds R42) a + pmf (sds R42) c \\<le> 1 / 2\" .\n  moreover from R17_R11.strategyproofness(1) R11.support R17.support\n       lottery_conditions[OF R11.wf] lottery_conditions[OF R17.wf]\n    have \"pmf (sds R11) d \\<ge> 1/2\" by (auto simp: R17_d)\n  ultimately have \"pmf (sds R42) a + pmf (sds R42) c \\<le> pmf (sds R11) d\" by simp\n  with R42_R11.strategyproofness(1) R11.support\n    have E: \"pmf (sds R11) d \\<le> pmf (sds R42) c\" by auto\n  with \\<open>pmf (sds R11) d \\<ge> 1/2\\<close> have \"pmf (sds R42) c \\<ge> 1/2\" by simp\n  moreover from R17_R3.strategyproofness(1) R3.support R17.support\n       lottery_conditions[OF R17.wf] lottery_conditions[OF R3.wf] \n    have \"pmf (sds R3) d \\<ge> 1/2\" by (auto simp: R17_d)\n  ultimately show \"pmf (sds R42) a = 0\" \"pmf (sds R42) b = 0\" \"pmf (sds R42) c = 1/2\" \"pmf (sds R42) d = 1/2\"\n    using R42_R3.strategyproofness(1) lottery_conditions[OF R3.wf] lottery_conditions[OF R42.wf]\n    by auto\nqed\n\nlemma R37 [simp]: \"pmf (sds R37) a = 1/2\" \"pmf (sds R37) b = 0\" \"pmf (sds R37) c = 1/2\" \"pmf (sds R37) d = 0\"\nproof -\n  from R37_R42.strategyproofness(1) lottery_conditions[OF R37.wf]\n    have \"pmf (sds R37) a = 1/2 \\<or> pmf (sds R37) a + pmf (sds R37) b > 1/2\" by auto\n  moreover from R37_R42.strategyproofness(2) lottery_conditions[OF R37.wf]\n    have \"pmf (sds R37) c = 1/2 \\<or> pmf (sds R37) c + pmf (sds R37) d > 1/2\" by auto\n  ultimately show \"pmf (sds R37) a = 1/2\" \"pmf (sds R37) b = 0\" \"pmf (sds R37) c = 1/2\" \"pmf (sds R37) d = 0\"\n    using lottery_conditions[OF R37.wf] by auto\nqed\n\nlemma R24 [simp]: \"pmf (sds R24) a = 0\" \"pmf (sds R24) b = 0\" \"pmf (sds R24) d = 1 - pmf (sds R24) c\"\n  using R42_R24.strategyproofness(1) lottery_conditions[OF R24.wf] by auto\n\nlemma R34 [simp]:\n  \"pmf (sds R34) a = 1 - pmf (sds R24) c\" \"pmf (sds R34) b = pmf (sds R24) c\"\n  \"pmf (sds R34) c = 0\" \"pmf (sds R34) d = 0\"\nproof -\n  from R24_R34.strategyproofness(1) lottery_conditions[OF R34.wf] \n    have \"pmf (sds R34) b \\<le> pmf (sds R24) c\" by auto\n  moreover from R34_R24.strategyproofness(1) lottery_conditions[OF R34.wf] \n    have \"pmf (sds R34) b \\<ge> pmf (sds R24) c\" by auto\n  ultimately show bc: \"pmf (sds R34) b = pmf (sds R24) c\" by simp\n  from R34_R24.strategyproofness(1) bc lottery_conditions[OF R34.wf] \n    show \"pmf (sds R34) c = 0\" by auto\n  moreover from R24_R34.strategyproofness(1) bc show \"pmf (sds R34) d = 0\" by simp\n  ultimately show \"pmf (sds R34) a = 1 - pmf (sds R24) c\"\n    using bc lottery_conditions[OF R34.wf] by auto\nqed\n\nlemma R14 [simp]: \"pmf (sds R14) b = 0\" \"pmf (sds R14) d = 0\" \"pmf (sds R14) c = 1 - pmf (sds R14) a\"\n  using R14_R34.strategyproofness(1) R14.support lottery_conditions[OF R14.wf] by auto\n\nlemma R46 [simp]: \"pmf (sds R46) a = 0\" \"pmf (sds R46) c = 0\" \"pmf (sds R46) d = 1 - pmf (sds R46) b\"\n  using R46_R37.strategyproofness(1) lottery_conditions[OF R46.wf] by auto\n\nlemma R20 [simp]: \"pmf (sds R20) a = 0\" \"pmf (sds R20) c = 0\" \"pmf (sds R20) d = 1 - pmf (sds R20) b\" \n  using R46_R20.strategyproofness(1) lottery_conditions[OF R20.wf] by auto\n\nlemma R21 [simp]: \"pmf (sds R21) d = 1 - pmf (sds R21) a\" \"pmf (sds R21) b = 0\" \"pmf (sds R21) c = 0\"\n  using R20_R21.strategyproofness(1) lottery_conditions[OF R21.wf] by auto\n\n\nlemma R16_R12: \"pmf (sds R16) c + pmf (sds R16) a \\<le> pmf (sds R12) a\"\n  using R12_R16.strategyproofness(1) R16.support lottery_conditions[OF R16.wf] by auto\n\nlemma R16 [simp]: \"pmf (sds R16) b = 0\" \"pmf (sds R16) c = 0\" \"pmf (sds R16) d = 1 - pmf (sds R16) a\"\nproof -\n  from R16_R12 have \"pmf (sds R16) c + pmf (sds R16) a \\<le> pmf (sds R12) a\" by simp\n  also from R44_R40.strategyproofness(1) lottery_conditions[OF R40.wf] R40.support\n    have \"pmf (sds R12) a \\<le> pmf (sds R40) a\" by auto\n  also from R9_R40.strategyproofness(1) R9.support R40.support \n    have \"pmf (sds R40) a \\<le> pmf (sds R9) a\" by auto\n  finally have \"pmf (sds R16) c + pmf (sds R16) a \\<le> pmf (sds R9) a\" by simp\n  moreover from R14_R16.strategyproofness(1) R16.support lottery_conditions[OF R16.wf] \n    have \"pmf (sds R16) a \\<ge> pmf (sds R14) a\" by auto\n  ultimately have \"pmf (sds R16) c \\<le> pmf (sds R9) a - pmf (sds R14) a\" by simp\n  also from R14_R9.strategyproofness(1) R9.support lottery_conditions[OF R9.wf]\n    have \"pmf (sds R9) a - pmf (sds R14) a \\<le> 0\" by auto\n  finally show \"pmf (sds R16) b = 0\" \"pmf (sds R16) c = 0\" \"pmf (sds R16) d = 1 - pmf (sds R16) a\"\n    using lottery_conditions[OF R16.wf] R16.support by auto\nqed\n\nlemma R12_R14: \"pmf (sds R14) a \\<le> pmf (sds R12) a\"\n  using R14_R16.strategyproofness(1) R16_R12 by auto\n\nlemma R12_a [simp]: \"pmf (sds R12) a = pmf (sds R9) a\"\nproof -\n  from R44_R40.strategyproofness(1) R40.support lottery_conditions[OF R40.wf] \n    have \"pmf (sds R12) a \\<le> pmf (sds R40) a\" by auto\n  also from R9_R40.strategyproofness(1) R9.support R40.support \n    have \"pmf (sds R40) a \\<le> pmf (sds R9) a\" by auto\n  finally have B: \"pmf (sds R12) a \\<le> pmf (sds R9) a\" by simp\n  moreover from R14_R9.strategyproofness(1) lottery_conditions[OF R9.wf] R9.support \n    have \"pmf (sds R9) a \\<le> pmf (sds R14) a\" by auto\n  with R12_R14 have \"pmf (sds R9) a \\<le> pmf (sds R12) a\" by simp\n  ultimately show \"pmf (sds R12) a = pmf (sds R9) a\" by simp\nqed\n\nlemma R9 [simp]: \"pmf (sds R9) b = 0\" \"pmf (sds R9) d = 0\" \"pmf (sds R14) a = pmf (sds R35) a\" \"pmf (sds R9) c = 1 - pmf (sds R35) a\"\n  using R12_R14 R14_R9.strategyproofness(1) lottery_conditions[OF R9.wf] R9.support\n  by auto\n\nlemma R23 [simp]: \"pmf (sds R23) b = 0\" \"pmf (sds R23) c = 0\" \"pmf (sds R23) d = 1 - pmf (sds R23) a\"\n  using R23_R19.strategyproofness(1) lottery_conditions[OF R23.wf] R23.support by auto\n\nlemma R35 [simp]: \"pmf (sds R35) a = pmf (sds R21) a\" \"pmf (sds R35) b = 0\" \"pmf (sds R35) c = 0\" \"pmf (sds R35) d = 1 - pmf (sds R21) a\"\nproof -\n  from R35_R21.strategyproofness(1) R35.support\n    have \"pmf (sds R21) a \\<le> pmf (sds R35) a + pmf (sds R35) c\" by auto\n  with R21_R35.strategyproofness(1) R35.support lottery_conditions[OF R35.wf]\n    show \"pmf (sds R35) a = pmf (sds R21) a\" \"pmf (sds R35) b = 0\" \n         \"pmf (sds R35) c = 0\" \"pmf (sds R35) d = 1 - pmf (sds R21) a\" by simp_all\nqed\n\nlemma R18 [simp]: \"pmf (sds R18) a = pmf (sds R14) a\" \"pmf (sds R18) b = 0\"\n                  \"pmf (sds R18) d = 0\" \"pmf (sds R18) c = 1 - pmf (sds R14) a\"\nproof -\n from R23_R12.strategyproofness(1)\n    have R21_R23: \"pmf (sds R21) a \\<le> pmf (sds R23) a\" by simp\n\n  from R23_R18.strategyproofness(1) \n    have \"pmf (sds R18) d \\<le> pmf (sds R21) a - pmf (sds R23) a\" by simp\n  also from R21_R23 have \"\\<dots> \\<le> 0\" by simp\n  finally show \"pmf (sds R18) d = 0\" by simp\n  with lottery_conditions[OF R18.wf] R18.support\n    show \"pmf (sds R18) a = pmf (sds R14) a\"\n         \"pmf (sds R18) c = 1 - pmf (sds R14) a\" by auto\nqed (insert R18.support, simp_all)\n\nlemma R4 [simp]: \"pmf (sds R4) a = pmf (sds R21) a\" \"pmf (sds R4) b = 0\"\n                 \"pmf (sds R4) c = 1 - pmf (sds R4) a\" \"pmf (sds R4) d = 0\"\nproof -\n  from R30_R21.strategyproofness(1) R30.support lottery_conditions[OF R30.wf] \n    have \"pmf (sds R4) c + pmf (sds R21) a \\<le> pmf (sds R4) c + pmf (sds R30) a\" by auto\n  also {\n    have \"pmf (sds R30) a \\<le> pmf (sds R47) a\"\n      using R47_R30.strategyproofness(1) R30.support R47.support \n             lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf] by auto\n    moreover from R4_R47.strategyproofness(1) R4.support R47.support\n           lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf]\n      have \"pmf (sds R4) c \\<le> pmf (sds R47) c\" by simp\n    ultimately have \"pmf (sds R4) c + pmf (sds R30) a \\<le> 1 - pmf (sds R47) d\" \n      using lottery_conditions[OF R47.wf] R47.support by simp\n  }\n  finally have \"pmf (sds R4) c + pmf (sds R14) a \\<le> 1\"\n    using lottery_conditions[OF R47.wf] by simp\n  with R4_R18.strategyproofness(1) lottery_conditions[OF R4.wf] R4.support\n    show \"pmf (sds R4) a = pmf (sds R21) a\" \"pmf (sds R4) b = 0\"\n         \"pmf (sds R4) c = 1 - pmf (sds R4) a\" \"pmf (sds R4) d = 0\" by auto\nqed\n\nlemma R8_d [simp]: \"pmf (sds R8) d = 1 - pmf (sds R8) a\"\n  and R8_c [simp]: \"pmf (sds R8) c = 0\"\n  and R26_a [simp]: \"pmf (sds R26) a = 1 - pmf (sds R8) a\"\nproof -\n  from R8_R26.strategyproofness(2) R8.support lottery_conditions[OF R8.wf] \n    have \"pmf (sds R26) a \\<le> pmf (sds R8) d\" by auto\n  with R26_R8.strategyproofness(2) R8.support lottery_conditions[OF R8.wf] \n    have \"pmf (sds R26) a = pmf (sds R8) d\" by auto\n  with R8_R26.strategyproofness(2) R8.support lottery_conditions[OF R8.wf]\n    show \"pmf (sds R8) c = 0\" \"pmf (sds R8) d = 1 - pmf (sds R8) a\" \n         \"pmf (sds R26) a = 1 - pmf (sds R8) a\" by auto\nqed\n\nlemma R21_R47: \"pmf (sds R21) d \\<le> pmf (sds R47) c\"\n  using R4_R47.strategyproofness(1) R4.support R47.support\n         lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf] \n  by auto\n\nlemma R30 [simp]: \"pmf (sds R30) a = pmf (sds R47) a\" \"pmf (sds R30) b = 0\" \n  \"pmf (sds R30) c = 0\" \"pmf (sds R30) d = 1 - pmf (sds R47) a\"\nproof -\n  have A: \"pmf (sds R30) a \\<le> pmf (sds R47) a\"\n    using R47_R30.strategyproofness(1) R30.support R47.support \n           lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf] by auto\n  with R21_R47 R30_R21.strategyproofness(1) \n    lottery_conditions[OF R30.wf] lottery_conditions[OF R47.wf]\n    show \"pmf (sds R30) a = pmf (sds R47) a\" \"pmf (sds R30) b = 0\" \n         \"pmf (sds R30) c = 0\" \"pmf (sds R30) d = 1 - pmf (sds R47) a\"\n      by (auto simp: R30.support R47.support) (* tricky step! *)\nqed\n\nlemma R31_c_ge_one_half: \"pmf (sds R31) c \\<ge> 1/2\"\nproof -\n  from R25.support have \"pmf (sds R25) a \\<ge> 1/2\"\n  proof\n    assume \"pmf (sds R25) c = 0\"\n    with R25_R36.strategyproofness(1) lottery_conditions[OF R36.wf]\n       show \"pmf (sds R25) a \\<ge> 1/2\" by auto\n  next\n    assume [simp]: \"pmf (sds R25) b = 0\"\n    from R36_R25.strategyproofness(1) lottery_conditions[OF R25.wf]\n      have \"pmf (sds R25) c + pmf (sds R25) a \\<le> pmf (sds R36) c + 1 / 2\" by auto\n    with R25_R36.strategyproofness(1) show \"pmf (sds R25) a \\<ge> 1/2\" by auto\n  qed\n  hence \"pmf (sds R26) a \\<ge> 1/2\"\n    using R25_R26.strategyproofness(1) lottery_conditions[OF R25.wf] by auto\n  with lottery_conditions[OF R47.wf]\n    have \"1/2 \\<le> pmf (sds R26) a + pmf (sds R47) d\" by simp\n  also have \"\\<dots> = 1 - pmf (sds R8) a + pmf (sds R47) d\" by simp\n  also from R4_R8.strategyproofness(1) \n    have \"1 - pmf (sds R8) a \\<le> pmf (sds R21) d\" by auto\n  also note R21_R47\n  also from R30_R41.strategyproofness(1) R41.support \n            lottery_conditions[OF R41.wf] lottery_conditions[OF R47.wf] \n    have \"pmf (sds R47) c + pmf (sds R47) d \\<le> pmf (sds R41) d\" by auto\n  also from R41_R31.strategyproofness(1) R41.support lottery_conditions[OF R31.wf] \n       lottery_conditions[OF R41.wf]  \n    have \"pmf (sds R41) d \\<le> pmf (sds R31) c\" by auto\n  finally show \"pmf (sds R31) c \\<ge> 1/2\" by simp\nqed\n\nlemma R31: \"pmf (sds R31) a = 0\" \"pmf (sds R31) c = 1/2\" \"pmf (sds R31) b + pmf (sds R31) d = 1/2\"\nproof -\n  from R2_R38.strategyproofness(1) lottery_conditions[OF R38.wf] \n    have A: \"pmf (sds R38) b + pmf (sds R38) d \\<ge> 1/2\" by auto\n  with R31_c_ge_one_half R31_R38.strategyproofness(1) \n        lottery_conditions[OF R31.wf] lottery_conditions[OF R38.wf]\n  have \"pmf (sds R38) b + pmf (sds R38) d = pmf (sds R31) d + pmf (sds R31) b\" by auto\n  with R31_c_ge_one_half A lottery_conditions[OF R31.wf] lottery_conditions[OF R38.wf]\n    show \"pmf (sds R31) a = 0\" \"pmf (sds R31) c = 1/2\" \"pmf (sds R31) b + pmf (sds R31) d = 1/2\"\n    by auto\nqed\n\nlemma absurd: False\n  using R31 R45_R31.strategyproofness(2) by simp\n\n\n(* TODO (Re-)move *)\nML_val \\<open>\nlet\nval thms = @{thms\nR1_R2.strategyproofness(1)\nR1_R19.strategyproofness(1)\nR2_R1.strategyproofness(1)\nR2_R38.strategyproofness(1)\nR4_R8.strategyproofness(1)\nR4_R18.strategyproofness(1)\nR4_R47.strategyproofness(1)\nR5_R7.strategyproofness(1)\nR5_R10.strategyproofness(1)\nR5_R17.strategyproofness(1)\nR6_R19.strategyproofness(1)\nR6_R42.strategyproofness(1)\nR7_R43.strategyproofness(1)\nR8_R26.strategyproofness(2)\nR9_R18.strategyproofness(1)\nR9_R35.strategyproofness(1)\nR9_R40.strategyproofness(1)\nR10_R12.strategyproofness(1)\nR10_R15.strategyproofness(1)\nR10_R19.strategyproofness(1)\nR10_R36.strategyproofness(1)\nR12_R10.strategyproofness(1)\nR12_R16.strategyproofness(1)\nR12_R44.strategyproofness(1)\nR13_R15.strategyproofness(1)\nR13_R27.strategyproofness(1)\nR14_R9.strategyproofness(1)\nR14_R16.strategyproofness(1)\nR14_R34.strategyproofness(1)\nR15_R5.strategyproofness(1)\nR15_R7.strategyproofness(1)\nR15_R10.strategyproofness(1)\nR15_R13.strategyproofness(1)\nR17_R3.strategyproofness(1)\nR17_R5.strategyproofness(1)\nR17_R7.strategyproofness(1)\nR17_R11.strategyproofness(1)\nR18_R9.strategyproofness(1)\nR19_R1.strategyproofness(1)\nR19_R10.strategyproofness(1)\nR19_R27.strategyproofness(1)\nR20_R21.strategyproofness(1)\nR21_R35.strategyproofness(1)\nR22_R29.strategyproofness(1)\nR22_R32.strategyproofness(1)\nR23_R12.strategyproofness(1)\nR23_R18.strategyproofness(1)\nR23_R19.strategyproofness(1)\nR24_R34.strategyproofness(1)\nR25_R26.strategyproofness(1)\nR25_R36.strategyproofness(1)\nR26_R8.strategyproofness(2)\nR27_R13.strategyproofness(1)\nR27_R19.strategyproofness(1)\nR28_R32.strategyproofness(1)\nR28_R39.strategyproofness(1)\nR29_R39.strategyproofness(1)\nR30_R21.strategyproofness(1)\nR30_R41.strategyproofness(1)\nR31_R38.strategyproofness(1)\nR32_R22.strategyproofness(1)\nR32_R28.strategyproofness(1)\nR33_R5.strategyproofness(1)\nR33_R22.strategyproofness(1)\nR34_R24.strategyproofness(1)\nR35_R9.strategyproofness(1)\nR35_R21.strategyproofness(1)\nR36_R10.strategyproofness(1)\nR36_R25.strategyproofness(1)\nR36_R39.strategyproofness(1)\nR37_R42.strategyproofness(1)\nR37_R42.strategyproofness(2)\nR39_R2.strategyproofness(1)\nR39_R29.strategyproofness(1)\nR39_R36.strategyproofness(1)\nR41_R31.strategyproofness(1)\nR42_R3.strategyproofness(1)\nR42_R11.strategyproofness(1)\nR42_R24.strategyproofness(1)\nR44_R12.strategyproofness(1)\nR44_R40.strategyproofness(1)\nR45_R31.strategyproofness(2)\nR46_R20.strategyproofness(1)\nR46_R37.strategyproofness(1)\nR47_R30.strategyproofness(1)\n};\nin\n thms\n |> map (Pretty.quote o Pretty.str o Pretty.unformatted_string_of o Syntax.pretty_term @{context} o Thm.prop_of)\n |> Pretty.list \"[\" \"]\"\n |> (fn x => Pretty.block [Pretty.str \"thms = \", x])\n |> Pretty.string_of\n |> writeln\nend\n\\<close>\n\nend\n\n\nsubsection \\<open>Lifting to more than 4 agents and alternatives\\<close>\n\n(* TODO: Move? *)\nlemma finite_list':\n  assumes \"finite A\"\n  obtains xs where \"A = set xs\" \"distinct xs\" \"length xs = card A\"\nproof -\n  from assms obtain xs where \"set xs = A\" using finite_list by blast\n  thus ?thesis using distinct_card[of \"remdups xs\"]\n    by (intro that[of \"remdups xs\"]) simp_all\nqed\n\nlemma finite_list_subset:\n  assumes \"finite A\" \"card A \\<ge> n\"\n  obtains xs where \"set xs \\<subseteq> A\" \"distinct xs\" \"length xs = n\"\nproof -\n  obtain xs where \"A = set xs\" \"distinct xs\" \"length xs = card A\"\n    using finite_list'[OF assms(1)] by blast\n  with assms show ?thesis\n    by (intro that[of \"take n xs\"]) (simp_all add: set_take_subset)\nqed\n\nlemma card_ge_4E:\n  assumes \"finite A\" \"card A \\<ge> 4\"\n  obtains a b c d where \"distinct [a,b,c,d]\" \"{a,b,c,d} \\<subseteq> A\"\nproof -\n  from finite_list_subset[OF assms] guess xs .\n  moreover then obtain a b c d where \"xs = [a, b, c, d]\" \n    by (auto simp: eval_nat_numeral length_Suc_conv)\n  ultimately show ?thesis by (intro that[of a b c d]) simp_all\nqed\n\n\ncontext sds_impossibility\nbegin\n\nlemma absurd: False\nproof -\n  from card_ge_4E[OF finite_agents agents_ge_4] guess A1 A2 A3 A4 .\n  note agents = this\n  from card_ge_4E[OF finite_alts alts_ge_4] guess a b c d .\n  note alts = this\n  def agents' \\<equiv> \"{A1,A2,A3,A4}\" and alts' \\<equiv> \"{a,b,c,d}\"\n  from agents alts \n    interpret sds_lowering_anonymous_neutral_sdeff_stratproof agents alts sds agents' alts'\n    unfolding agents'_def alts'_def by unfold_locales simp_all\n  from agents alts \n    interpret sds_impossibility_4_4 agents' alts' lowered A1 A2 A3 A4 a b c d\n    by unfold_locales (simp_all add: agents'_def alts'_def)\n  from absurd show False .\nqed\n\nend\n\nend\n", "meta": {"author": "pruvisto", "repo": "SDS", "sha": "e0b280bff615c917314285b374d77416c51ed39c", "save_path": "github-repos/isabelle/pruvisto-SDS", "path": "github-repos/isabelle/pruvisto-SDS/SDS-e0b280bff615c917314285b374d77416c51ed39c/thys/SDS_Impossibility/SDS_Impossibility.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.3374117916812904}}
{"text": "header {* \\isaheader{Partial Function Package Setup} *}\ntheory Refine_Pfun\nimports Refine_Basic Refine_Det\nbegin\n\ntext {*\n  In this theory, we set up the partial function package to be used \n  with our refinement framework.\n*}\n\nsubsection {* Nondeterministic Result Monad *}\n\ninterpretation nrec!:\n  partial_function_definitions \"op \\<le>\" \"Sup::'a nres set \\<Rightarrow> 'a nres\"\n  by unfold_locales (auto simp add: Sup_upper Sup_least)\n\nlemma nrec_admissible: \"nrec.admissible (\\<lambda>(f::'a \\<Rightarrow> 'b nres).\n  (\\<forall>x0. f x0 \\<le> SPEC (P x0)))\"\n  apply (rule ccpo.admissibleI)\n  apply (unfold fun_lub_def)\n  apply (intro allI impI)\n  apply (rule Sup_least)\n  apply auto\n  done\n\n(*\nlemma fixp_induct_nrec:\n  fixes F :: \"'c \\<Rightarrow> 'c\" and\n    U :: \"'c \\<Rightarrow> 'b \\<Rightarrow> 'a nres\" and\n    C :: \"('b \\<Rightarrow> 'a nres) \\<Rightarrow> 'c\" and\n    P :: \"'b \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  assumes mono: \"\\<And>x. nrec_mono (\\<lambda>f. U (F (C f)) x)\"\n  assumes eq: \"f \\<equiv> C (nrec_ffix (\\<lambda>f. U (F (C f))))\"\n  assumes inverse2: \"\\<And>f. U (C f) = f\"\n  assumes step: \"\\<And>f x. (\\<And>x. U f x \\<le> SPEC (P x)) \\<Longrightarrow> U (F f) x \\<le> SPEC (P x)\"\n  assumes defined: \"RETURN y \\<le> U f x\"\n  shows \"U f x \\<le> SPEC (P x)\"\n  using step defined \n    nrec.fixp_induct_uc[of U F C, OF mono eq inverse2 nrec_admissible]\n  by blast\n\nlemma fixp_induct_nrec':\n  fixes F :: \"'c \\<Rightarrow> 'c\" and\n    U :: \"'c \\<Rightarrow> 'b \\<Rightarrow> 'a nres\" and\n    C :: \"('b \\<Rightarrow> 'a nres) \\<Rightarrow> 'c\" and\n    P :: \"'b \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  assumes mono: \"\\<And>x. nrec_mono (\\<lambda>f. U (F (C f)) x)\"\n  assumes eq: \"f \\<equiv> C (nrec_ffix (\\<lambda>f. U (F (C f))))\"\n  assumes inverse2: \"\\<And>f. U (C f) = f\"\n  assumes step: \"\\<And>f x0. (\\<And>x0. U f x0 \\<le> SPEC (P x0)) \n    \\<Longrightarrow> U (F f) x0 \\<le> SPEC (P x0)\"\n  assumes defined: \"RETURN y \\<le> U f x\"\n  shows \"P x y\"\nproof -\n  note defined\n  also have \"\\<forall>x0. U f x0 \\<le> SPEC (P x0)\"\n    apply (rule nrec.fixp_induct_uc[of U F C, OF mono eq inverse2 \n      nrec_admissible])\n    using step by blast\n  hence \"U f x \\<le> SPEC (P x)\" by simp\n  finally show \"P x y\" by auto\nqed\n*)    \n(* TODO/FIXME: Induction rule seems not to work here ! \n    Function package expects induction rule where conclusion is a binary \n    predicate as free variable.\n*)\n\ndeclaration {* Partial_Function.init \"nrec\" @{term nrec.fixp_fun}\n  @{term nrec.mono_body} @{thm nrec.fixp_rule_uc} @{thm nrec.fixp_induct_uc}\n  (*SOME @{thm fixp_induct_nrec'}*) NONE *}\n\nlemma bind_mono_pfun[partial_function_mono]:\n  fixes C :: \"'a \\<Rightarrow> ('b \\<Rightarrow> 'c nres) \\<Rightarrow> ('d nres)\"\n  shows\n  \"\\<lbrakk> monotone (fun_ord op \\<le>) op \\<le> B; \n    \\<And>y. monotone (fun_ord op \\<le>) op \\<le> (\\<lambda>f. C y f) \\<rbrakk> \\<Longrightarrow> \n     monotone (fun_ord op \\<le>) op \\<le> (\\<lambda>f. bind (B f) (\\<lambda>y. C y f))\"\n  apply rule\n  apply (rule Refine_Basic.bind_mono)\n  apply (blast dest: monotoneD)+\n  done\n\n\n\nsubsection {* Deterministic Result Monad *}\n\ninterpretation drec!:\n  partial_function_definitions \"op \\<le>\" \"Sup::'a dres set \\<Rightarrow> 'a dres\"\n  by unfold_locales (auto simp add: Sup_upper Sup_least)\n\nlemma drec_admissible: \"drec.admissible (\\<lambda>(f::'a \\<Rightarrow> 'b dres).\n  (\\<forall>x. P x \\<longrightarrow> \n    (f x \\<noteq> dFAIL \\<and> \n    (\\<forall>r. f x = dRETURN r \\<longrightarrow> Q x r))))\"\nproof -\n  have [simp]: \"fun_ord (op \\<le>::'b dres \\<Rightarrow> _ \\<Rightarrow> _) = op \\<le>\"\n    apply (intro ext)\n    unfolding fun_ord_def le_fun_def\n    by (rule refl)\n\n  have [simp]: \"\\<And>A x. {y. \\<exists>f\\<in>A. y = f x} = (\\<lambda>f. f x)`A\" by auto\n\n  show ?thesis\n    apply (rule ccpo.admissibleI)\n    apply (unfold fun_lub_def)\n    apply clarsimp\n    apply (drule_tac x=x in point_chainI)\n    apply (erule dres_Sup_chain_cases)\n    apply (simp only: SUP_def)\n    apply simp\n    apply (simp only: SUP_def)\n    apply auto []\n    apply (simp only: SUP_def)\n    apply force\n    done\nqed\n\ndeclaration {* Partial_Function.init \"drec\" @{term drec.fixp_fun}\n  @{term drec.mono_body} @{thm drec.fixp_rule_uc} @{thm drec.fixp_induct_uc} \n  NONE *}\n\nlemma drec_bind_mono_pfun[partial_function_mono]:\n  fixes C :: \"'a \\<Rightarrow> ('b \\<Rightarrow> 'c dres) \\<Rightarrow> ('d dres)\"\n  shows\n  \"\\<lbrakk> monotone (fun_ord op \\<le>) op \\<le> B; \n    \\<And>y. monotone (fun_ord op \\<le>) op \\<le> (\\<lambda>f. C y f) \\<rbrakk> \\<Longrightarrow> \n     monotone (fun_ord op \\<le>) op \\<le> (\\<lambda>f. dbind (B f) (\\<lambda>y. C y f))\"\n  apply rule\n  apply (rule dbind_mono)\n  apply (blast dest: monotoneD)+\n  done\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Refine_Monadic/Refine_Pfun.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883592602049, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.3374117916812903}}
{"text": "theory ContinuousSyntax\n  imports DiscreteSyntax\nbegin\n\n\\<comment> \\<open>a continuous can be a general calculation block or a integrator block\nit also defined as a block while sample_time = 0.\nnote: In continuous blocks, offset list has other meanings which deciding the corresponding\noutupd is a math operation, integrator or derivative\noffset = 0: math operation\noffset = 1: integrator\nnote: In a block b, offsets is a list which may contain both math operation and integrator.\nSo we limit \"set (get_offsets b) = {0}\" for math operations and \"set (get_offsets b) = {1}\" \nfor integrator\\<close>\n\ntype_synonym DisBlk = block\ntype_synonym ConBlk = block\n\n\\<comment> \\<open>return the computational blocks in the continuous blocks\\<close>\nfun getCalBlks :: \"ConBlk list \\<Rightarrow> ConBlk list\" where\n  \"getCalBlks [] = []\" |\n  \"getCalBlks (b#bl) = (if (set (get_offsets b)) = {0} then b#getCalBlks bl\n  else getCalBlks bl)\"\n\nlemma getCalBlks_last: \"getCalBlks (bl@[b]) = \n(if (set (get_offsets b)) = {0} then getCalBlks bl@[b] else getCalBlks bl)\"\nproof(induction bl)\n  case Nil\n  then show ?case unfolding getCalBlks.simps by auto\nnext\n  case (Cons a bl)\n  then show ?case\n  proof(cases \"(set (get_offsets a)) = {0}\")\n    case True\n    then show ?thesis unfolding getCalBlks.simps using Cons by auto\n  next\n    case False\n    then show ?thesis unfolding getCalBlks.simps using Cons by auto\n  qed\nqed\n\nlemma getCalBlks_rev: \"getCalBlks (rev bl) = \nrev (getCalBlks bl)\"\nproof(induction bl)\n  case Nil\n  then show ?case unfolding getCalBlks.simps by auto\nnext\n  case (Cons a bl)\n  then show ?case using getCalBlks_last by simp\nqed\n\nlemma getCalBlksSubset : \"Outputs (getCalBlks bl) \\<subseteq> Outputs bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case by auto\nqed\n\nlemma getCalBlksSubset2 : \"set (getCalBlks bl) \\<subseteq> set bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case by auto\nqed\n\nlemma getCalBlksSubset3 : \"Inputs (getCalBlks bl) \\<subseteq> Inputs bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case by auto\nqed\n\nlemma getCalBlksPerm : \"bl1 <~~> bl2 \\<Longrightarrow> \n(getCalBlks bl1) <~~> (getCalBlks bl2)\"\nproof(induction bl1 arbitrary:bl2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b1 bl1)\n  have 1: \"b1 \\<in> set bl2\"\n    using Cons(2) by (simp add: prem_seteq)\n  have 2: \"bl1 <~~> remove1 b1 bl2\"\n    using Cons(2) 1 by (metis perm_remove_perm remove_hd)\n  have 3: \"getCalBlks bl1 <~~> getCalBlks (remove1 b1 bl2)\"\n    using Cons 2 by simp\n  then show ?case\n  proof(cases \"set (get_offsets b1) = {0}\")\n    case True\n    have 4: \"getCalBlks (remove1 b1 bl2) = remove1 b1 (getCalBlks bl2)\"\n    using True proof(induction bl2)\n      case Nil\n      then show ?case by simp\n    next\n      case (Cons a bl2)\n      then show ?case\n      proof(cases \"a = b1\")\n        case True\n        then show ?thesis unfolding getCalBlks.simps using Cons(2) by simp\n      next\n        case False\n        then show ?thesis unfolding getCalBlks.simps using Cons by simp\n      qed\n    qed\n    have 5: \"b1 \\<in> set (getCalBlks bl2)\"\n      using 1 True\n    proof(induction bl2)\n      case Nil\n      then show ?case by simp\n    next\n      case (Cons a bl2)\n      then show ?case by auto\n    qed\n    then show ?thesis unfolding getCalBlks.simps using True 3 4 perm_remove2 by fastforce\n  next\n    case False\n    have 5: \"getCalBlks (remove1 b1 bl2) = getCalBlks bl2\"\n    using False proof(induction bl2)\n      case Nil\n      then show ?case by simp\n    next\n      case (Cons b2 bl2)\n      then show ?case\n      proof(cases \"b1 = b2\")\n        case True\n        then show ?thesis unfolding getCalBlks.simps using Cons(2) by simp\n      next\n        case False\n        then show ?thesis unfolding getCalBlks.simps using Cons by simp\n      qed\n    qed\n    then show ?thesis unfolding getCalBlks.simps using Cons 3 False by presburger\n  qed\nqed\n\nlemma getCalBlks_distinct: \"distinct bl \\<Longrightarrow> \ndistinct (getCalBlks bl)\"\nproof(induction bl)\n  case Nil\n  then show ?case unfolding getCalBlks.simps by auto\nnext\n  case (Cons a bl)\n  then show ?case\n  proof(cases \"(set (get_offsets a)) = {0}\")\n    case True\n    then show ?thesis unfolding getCalBlks.simps using Cons\n      using getCalBlksSubset2 by auto\n  next\n    case False\n    then show ?thesis unfolding getCalBlks.simps using Cons by auto\n  qed\nqed\n\n\\<comment> \\<open>limitation for a continuous block;\n1. length outputs = length offsets = length outupds;\n2. Outputs uniqueness in a block\n3. \"set (get_offsets b) = {0}\" for math operations and \"set (get_offsets b) = {1}\" for integrator\n4. no loop for a computational block\\<close>\ndefinition \"Available' b = ((length (get_offsets b)) = (length (get_outputs b))\n    \\<and> ((length (get_outputs b)) = (length (get_outupd b)))\n    \\<and> (\\<forall>i j. i < j \\<and> j < (length (get_outputs b)) \\<and> j \\<ge> 0 \n  \\<longrightarrow> (nth (get_outputs b) i) \\<noteq> (nth (get_outputs b) j))  \\<and> \n  ({0} = set (get_offsets b) \\<or> {1} = set (get_offsets b) \\<or> {} = set (get_offsets b)) \n  \\<and> (get_sample_time b = 0) \\<and>\n  (1 \\<notin> set (get_offsets b) \\<longrightarrow> (set (get_outputs b) \\<inter> set (get_inputs b) = {})))\"\n\ndefinition \"wf2 bl = ((Unique bl) \\<and> (Graph (set bl)) \\<and> (\\<forall>b \\<in> set bl. \nAvailable' b))\"\n\nlemma wf2_lemma : \"wf2 (b#bl) \\<Longrightarrow> wf2 bl\"\n  unfolding wf2_def Unique_def Graph_def by (smt (verit, best) Suc_leI le_imp_less_Suc \n      length_Cons less_imp_le_nat nth_Cons_Suc set_subset_Cons subsetD)\n\nlemma wf2_lemma2: \"wf2 bl1 \\<Longrightarrow> bl1 <~~> bl2 \\<Longrightarrow> wf2 bl2\"\n  subgoal premises pre\nproof -\n  have 1: \"Unique bl2\"\n    using pre Unique_Permutation unfolding wf2_def by auto\n  have 2: \"set bl1 = set bl2\"\n    using pre(2) by (meson perm_sym prem_seteq subsetI subset_antisym)\n  show ?thesis using 1 2 unfolding wf2_def using wf2_def pre(1) by presburger\nqed\n  done\n\nlemma wf2_remove: \"b \\<in> set bl \\<Longrightarrow> wf2 bl \\<Longrightarrow> wf2 (remove1 b bl)\"\n  subgoal premises pre\nproof -\n  have 1: \"Unique (remove1 b bl)\"\n    using pre by (simp add: wf2_def Unique_remove)\n  show ?thesis using 1 unfolding wf2_def using wf2_def pre(1)\n    by (metis wf2_lemma wf2_lemma2 perm_remove pre(2))\nqed\n  done\n\nlemma wf2_rev: \"wf2 bl \\<Longrightarrow> wf2 (rev bl)\"\n  subgoal premises pre\nproof -\n  have 1: \"Unique (rev bl)\"\n    using pre by (simp add: wf2_def Unique_rev)\n  show ?thesis using 1 pre unfolding wf2_def using wf2_def by simp\nqed\n  done\n\n\n\\<comment> \\<open>besorted for continuous blocks(and only for computational blocks);\nunlike the \"besorted\" for discrete blocks, offsets here is always 0(vs Unit Delay)\\<close>\nfun besorted2 :: \"block list \\<Rightarrow> bool\" where\n\"besorted2 [] = True\" |\n\"besorted2 (b # bl) = (besorted2 bl \\<and> (\\<forall> a. a \\<in> set bl \\<longrightarrow> \n            (set (get_outputs a) \\<inter> set (get_inputs b) = {})))\"\n\n\nlemma besorted2_is_besorted : \"besorted2 bl \\<Longrightarrow> besorted bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a bl)\n  then show ?case unfolding besorted2.simps besorted.simps\n    by (metis check_offset.elims(2))\nqed\n\nlemma besorted2_last : \"besorted2 (bl@[a]) \\<Longrightarrow> besorted2 bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case unfolding besorted2.simps by simp\nqed\n\nlemma besorted2_remove: \"Unique bl \\<Longrightarrow>besorted2 bl \\<Longrightarrow> besorted2 (remove1 a bl)\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case\n  proof(cases \"a = b\")\n    case True\n    then show ?thesis using Cons(3) by simp\n  next\n    case False\n    have tmp1: \"besorted2 (remove1 a bl)\"\n      using Cons unfolding Unique_def\n      by (meson Cons.IH Cons.prems(1) Unique_lemma besorted2.simps(2))\n    then show ?thesis using Cons(3) \n      by (metis besorted2.simps(2) notin_set_remove1 remove1.simps(2))\n  qed\nqed\n\nlemma besorted2_remove2: \"besorted2 (al@bl) \\<Longrightarrow> besorted bl\"\nproof(induction al)\n  case Nil\n  then show ?case by (simp add: besorted2_is_besorted)\nnext\n  case (Cons a al)\n  then show ?case by simp\nqed\n\nlemma besorted2_lemma: \"besorted2 (bl@[a]@[b]) \\<Longrightarrow> set (get_outputs b) \\<inter> set (get_inputs a) = {}\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a bl)\n  then show ?case by simp\nqed\n\nlemma besortedTobesorted2 : \"besorted bl \\<Longrightarrow> \\<forall>b \\<in> set bl. (set (get_offsets b) = {0})\n  \\<Longrightarrow> besorted2 bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  have 1: \"besorted2 bl\"\n    using Cons(2) unfolding besorted.simps using Cons(1,3) by auto\n  have 2: \"\\<forall>a. a \\<in> set bl \\<longrightarrow> set (get_outputs a) \\<inter> set (get_inputs b) = {}\"\n    using Cons(2) unfolding besorted.simps using Cons(3)\n    by (smt (verit) Int_commute boolean_algebra.conj_zero_right check_offset.elims(1) \n        disjoint_insert(2) insertI1 list.set(1) list.set_intros(1))\n  then show ?case unfolding besorted2.simps using 1 by simp\nqed\n\nlemma sort_is_sorted2 : \"cl = (getCalBlks bl) \\<Longrightarrow> sortDiag (rev cl) = rev cl  \n\\<Longrightarrow> wf2 bl \\<Longrightarrow> besorted2 (rev cl)\"\n  subgoal premises pre\nproof -\n  have 1: \"set cl \\<subseteq> set bl\"\n    using pre(1)\n  proof(induction bl arbitrary:cl)\n    case Nil\n    then show ?case by simp\n  next\n    case (Cons b bl)\n    then show ?case unfolding getCalBlks.simps \n    proof(cases \"set (get_offsets b) = {0}\")\n      case True\n      then show ?thesis using Cons(1)[of \"getCalBlks bl\"] Cons(2)\n        unfolding getCalBlks.simps by auto\n    next\n      case False\n      then show ?thesis using Cons(1)[of \"getCalBlks bl\"] Cons(2)\n        unfolding getCalBlks.simps by auto\n    qed\n  qed\n  have 2: \"(\\<forall>i j. i < j \\<and> j < length bl \\<and> 0 \\<le> i \\<longrightarrow> bl ! i \\<noteq> bl ! j)\"\n    using 1 pre(3) unfolding wf2_def Unique_def by simp\n  have 3: \"Unique cl\"\n    using pre(1) 2 unfolding Unique_def\n  proof(induction bl arbitrary:cl)\n    case Nil\n    then show ?case by simp\n  next\n    case (Cons b bl)\n    then show ?case unfolding getCalBlks.simps\n    proof(cases \"set (get_offsets b) = {0}\")\n      case True\n      have tmp1: \"\\<forall>i j. i < j \\<and> j < length (getCalBlks bl) \\<and> 0 \\<le> i \n        \\<longrightarrow> getCalBlks bl ! i \\<noteq> getCalBlks bl ! j\"\n        using Cons(1,3) by (metis Unique_def Unique_lemma)\n      have tmp2: \"\\<exists>c. c \\<in> set (getCalBlks bl) \\<and> c = b \\<Longrightarrow> \n  \\<forall>i j. i < j \\<and> j < length (b # bl) \\<and> 0 \\<le> i \\<longrightarrow> (b # bl) ! i \\<noteq> (b # bl) ! j \\<Longrightarrow> False\"\n        apply clarify subgoal premises pre for c\n      proof -\n        have tmp2_1: \"\\<forall>c. c \\<in> set (getCalBlks bl) \\<longrightarrow> c \\<in> set bl\"\n          apply clarify subgoal for c\n        proof(induction bl)\n          case Nil\n          then show ?case by simp\n        next\n          case (Cons d dl)\n          then show ?case unfolding getCalBlks.simps\n            by (smt (verit, best) list.set_intros(1) list.set_intros(2) set_ConsD)\n        qed\n        done\n      have tmp2_2 : \"b \\<in> set bl\"\n        using tmp2_1 pre(2) by simp \n      show ?thesis using tmp2_2 pre(1) by (metis Suc_leI bot_nat_0.extremum in_set_conv_nth \n            le_imp_less_Suc length_Cons nth_Cons_0 nth_Cons_Suc)\n      qed\n      done\n    have tmp3: \"\\<forall>i. i < length (getCalBlks bl) \\<and> 0 \\<le> i \\<longrightarrow> \n          (getCalBlks bl) ! i \\<noteq> b\"\n      using tmp2 Cons(3) using nth_mem by blast\n    then show ?thesis using Cons(2) True unfolding getCalBlks.simps apply simp\n        using tmp1 using less_Suc_eq_0_disj by fastforce\n    next\n      case False\n      then show ?thesis using Cons unfolding getCalBlks.simps\n        by (metis Unique_def Unique_lemma)\n    qed\n  qed\n  have 4: \"Unique (rev cl)\"\n    using 3 Unique_rev by blast\n  have 5: \"Graph (set (rev cl))\"\n  proof -\n    have tmp: \"set (rev cl) \\<subseteq> set bl\"\n      using 1 by simp\n    show ?thesis using pre(3) tmp unfolding wf2_def Graph_def by (meson subsetD)\n  qed\n  have 6: \"besorted (rev cl)\"\n    using 4 5 pre(2) sort_is_sorted by force\n  have 7: \"\\<forall>b \\<in> set (rev cl). (set (get_offsets b) = {0})\"\n    using pre(1)\n  proof(induction bl arbitrary:cl)\n    case Nil\n    then show ?case by simp\n  next\n    case (Cons b bl)\n    then show ?case unfolding getCalBlks.simps\n    proof(cases \"set (get_offsets b) = {0}\")\n      case True\n      then show ?thesis using Cons unfolding getCalBlks.simps by simp\n    next\n      case False\n      then show ?thesis using Cons(1)[of cl] Cons(2) \n        unfolding getCalBlks.simps by presburger\n    qed\n    \n  qed\n  show ?thesis using 6 7 besortedTobesorted2 by presburger\nqed\n  done\n\ntext \\<open>Delete those discrete blocks in a Simulink graph.\\<close>\nfun deleteDisBlks :: \"block list \\<Rightarrow> block list\" where\n  \"deleteDisBlks [] = []\" |  \n  \"deleteDisBlks (a#al) = (if (get_sample_time a > 0) then deleteDisBlks al\n  else (a#(deleteDisBlks al)))\"\n\n\\<comment> \\<open>return the integrator blocks in the continuous blocks\\<close>\nfun findIntegBlks :: \"block list \\<Rightarrow> block list\" where\n  \"findIntegBlks [] = []\" |\n  \"findIntegBlks (b#bl) = (if (set (get_offsets b) = {1}) then \nb#(findIntegBlks bl) else findIntegBlks bl)\"\n\nlemma findIntegBlks_last: \"findIntegBlks (bl@[b]) = \n(if (set (get_offsets b)) = {1} then findIntegBlks bl@[b] else findIntegBlks bl)\"\nproof(induction bl)\n  case Nil\n  then show ?case unfolding findIntegBlks.simps by auto\nnext\n  case (Cons a bl)\n  then show ?case\n  proof(cases \"(set (get_offsets a)) = {1}\")\n    case True\n    then show ?thesis unfolding findIntegBlks.simps using Cons by auto\n  next\n    case False\n    then show ?thesis unfolding findIntegBlks.simps using Cons by auto\n  qed\nqed\n\nlemma findIntegBlks_rev: \"findIntegBlks (rev bl) = \nrev (findIntegBlks bl)\"\nproof(induction bl)\n  case Nil\n  then show ?case unfolding findIntegBlks.simps by auto\nnext\n  case (Cons a bl)\n  then show ?case using findIntegBlks_last by simp\nqed\n\nlemma findIntegBlksSubset : \"Outputs (findIntegBlks bl) \\<subseteq> Outputs bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case unfolding findIntegBlks.simps by auto\nqed\n\n\nlemma findIntegBlksSubset2 : \"set bl1 \\<subseteq> set bl2 \\<Longrightarrow>\nOutputs (findIntegBlks bl1) \\<subseteq> Outputs (findIntegBlks bl2)\"\nproof(induction bl1 arbitrary: bl2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case\n  proof(cases \"set (get_offsets b) = {1}\")\n    case True\n    have 1: \"set (get_offsets b) = {1} \\<Longrightarrow> b \\<in> set bl2 \\<Longrightarrow> set (get_outputs b) \\<subseteq> \n        Outputs (findIntegBlks bl2)\"\n    proof(induction bl2)\n      case Nil\n      then show ?case by simp\n    next\n      case (Cons a bl2)\n      then show ?case\n      proof(cases \"b = a\")\n        case True\n        then show ?thesis unfolding findIntegBlks.simps using Cons(2) by auto\n      next\n        case False\n        have tmp1: \"set (get_outputs b) \\<subseteq> Outputs (findIntegBlks bl2)\"\n          using Cons False by simp\n        then show ?thesis unfolding findIntegBlks.simps by auto\n      qed\n    qed\n    then show ?thesis unfolding findIntegBlks.simps using Cons True by simp\n  next\n    case False\n    then show ?thesis unfolding findIntegBlks.simps using Cons by simp\n  qed\nqed\n\nlemma findIntegBlksSubset3 : \"set (findIntegBlks bl) \\<subseteq> set bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case unfolding findIntegBlks.simps by auto\nqed\n\nlemma findIntegBlkswf : \"wf2 bl \\<Longrightarrow> wf2 (findIntegBlks bl)\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a bl)\n  then show ?case\n  proof(cases \"set (get_offsets a) = {0}\")\n    case True\n    then show ?thesis unfolding getCalBlks.simps using Cons\n      by (simp add: wf2_lemma)\n  next\n    case False\n    have tmp1: \"\\<forall>j. j < (length bl) \\<and> j \\<ge> 0 \\<longrightarrow> a \\<noteq> (nth bl j) \"\n      using Cons(2) unfolding wf2_def Unique_def\n      by (metis wf2_def Cons.prems Unique_k list.set_intros(1) remove_hd)\n    have tmp2: \"\\<forall>j. j < (length (findIntegBlks bl)) \\<and> j \\<ge> 0 \n      \\<longrightarrow> a \\<noteq> (nth (findIntegBlks bl) j)\"\n      using tmp1 findIntegBlksSubset3\n      by (metis in_set_conv_nth less_eq_nat.simps(1) subset_code(1))\n    have tmp3: \"Unique (a # findIntegBlks bl)\"\n      using Cons Unique_add unfolding wf2_def tmp2 by (metis wf2_def wf2_lemma tmp2)\n    have tmp4: \"Graph (set (a # findIntegBlks bl))\"\n    proof -\n      have tmp1: \"set (a # findIntegBlks bl) \\<subseteq> set (a#bl)\"\n        using findIntegBlksSubset3 by auto\n    show ?thesis using tmp1 Cons(2) unfolding wf2_def by (meson Graph_def subsetD)\n    qed\n    have tmp5: \"Ball (set (a # findIntegBlks bl)) Available' \"\n    proof -\n      have tmp1: \"set (a # findIntegBlks bl) \\<subseteq> set (a#bl)\"\n        using findIntegBlksSubset3 by auto\n      show ?thesis using tmp1 Cons(2) unfolding wf2_def by blast\n    qed\n    show ?thesis using False unfolding findIntegBlks.simps wf2_def apply simp \n      using tmp3 tmp4 tmp5 by (metis wf2_def wf2_lemma list.set_intros(1) list.simps(15))\n    qed\nqed\n\n\nlemma IntegInterComputationalBlocks : \"wf2 bl \\<Longrightarrow>\nOutputs (findIntegBlks bl) \\<inter> Outputs (getCalBlks bl) = {}\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  have 1: \"Outputs (findIntegBlks bl) \\<inter> Outputs (getCalBlks bl) = {}\"\n    using Cons wf2_lemma by auto\n  have 2: \"set (get_outputs b) \\<inter> Outputs bl = {}\"\n    using Cons(2) unfolding wf2_def Unique_def Graph_def \n    by (meson wf2_def Cons.prems Graph_lemma2 disjoint_iff)\n  then show ?case\n  proof(cases \"set (get_offsets b) = {1}\")\n    case True\n    have 3: \"set (get_outputs b) \\<inter> Outputs (getCalBlks bl) = {}\"\n      using getCalBlksSubset 2 by auto\n    show ?thesis using True unfolding findIntegBlks.simps getCalBlks.simps apply simp\n      using 1 3 by (simp add: Int_Un_distrib2)\n  next\n    case False\n    then show ?thesis  unfolding findIntegBlks.simps getCalBlks.simps apply simp\n      using 1 findIntegBlksSubset 2 by auto\n  qed\nqed\n\nlemma findIntegBlksPerm : \"bl1 <~~> bl2 \\<Longrightarrow> (findIntegBlks bl1) <~~> (findIntegBlks bl2)\"\nproof(induction bl1 arbitrary:bl2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b1 bl1)\n  have 1: \"b1 \\<in> set bl2\"\n    using Cons(2) by (simp add: prem_seteq)\n  have 2: \"bl1 <~~> remove1 b1 bl2\"\n    using Cons(2) 1 by (metis perm_remove_perm remove_hd)\n  have 3: \"findIntegBlks bl1 <~~> findIntegBlks (remove1 b1 bl2)\"\n    using Cons 2 by simp\n  then show ?case\n  proof(cases \"set (get_offsets b1) = {1}\")\n    case True\n    have 4: \"findIntegBlks (remove1 b1 bl2) = remove1 b1 (findIntegBlks bl2)\"\n    using True proof(induction bl2)\n      case Nil\n      then show ?case by simp\n    next\n      case (Cons a bl2)\n      then show ?case\n      proof(cases \"a = b1\")\n        case True\n        then show ?thesis unfolding findIntegBlks.simps using Cons(2) by simp\n      next\n        case False\n        then show ?thesis unfolding findIntegBlks.simps using Cons by simp\n      qed\n    qed\n    have 5: \"b1 \\<in> set (findIntegBlks bl2)\"\n      using 1 True\n    proof(induction bl2)\n      case Nil\n      then show ?case by simp\n    next\n      case (Cons a bl2)\n      then show ?case by auto\n    qed\n    then show ?thesis unfolding findIntegBlks.simps using True 3 4 perm_remove2 by fastforce\n  next\n    case False\n    have 5: \"findIntegBlks (remove1 b1 bl2) = findIntegBlks bl2\"\n    using False proof(induction bl2)\n      case Nil\n      then show ?case by simp\n    next\n      case (Cons b2 bl2)\n      then show ?case\n      proof(cases \"b1 = b2\")\n        case True\n        then show ?thesis unfolding findIntegBlks.simps using Cons(2) by simp\n      next\n        case False\n        then show ?thesis unfolding findIntegBlks.simps using Cons by simp\n      qed\n    qed\n    then show ?thesis unfolding findIntegBlks.simps using Cons 3 False by presburger\n  qed\nqed\n\n\\<comment> \\<open>we classify those blocks by calling function \"compute_st_forward\" and \"compute_st_backward\"\\<close>\n\ntext \\<open>Then check the blocks(no blocks whose sample_time = -1) and split them\\<close>\nfun checkType :: \"block list \\<Rightarrow> bool\" where\n  \"checkType [] = True\" |\n  \"checkType (b#bl) = (if (get_sample_time b = -1) then False else checkType bl)\"\n\nfun classifyBlocks :: \"block list \\<Rightarrow> DisBlk list \\<times> ConBlk list\" where\n  \"classifyBlocks [] = ([],[])\" |\n  \"classifyBlocks (b#bl) = (let x = classifyBlocks bl in \n      (if (get_sample_time b = 0) then (fst x, b#(snd x)) else (b#(fst x), snd x)))\"\n\ntext \\<open>The following functions are for the combination.\nnote: combine block \"a\" into block \"b\"\nwe call block \"b\" the basic block and block \"a\" the additional block\\<close>\n(*combine the inputs, basic inputs vl1; additional inputs vl2; additional output v\nwe remain the inputs in vl2 and delete those same inputs and produced inputs for vl1.\nnote: when calling this function, we have already validated the additional block produces\noutputs for the basic block inputs.*)\nfun combineInputs :: \"var list \\<Rightarrow> var list \\<Rightarrow> var \\<Rightarrow> var list\" where\n  \"combineInputs [] vl2 v = vl2\" |\n  \"combineInputs (v1#vl1) vl2 v = (if v = v1 \\<or> v1 \\<in> set vl2 then (combineInputs vl1 vl2 v)\n  else v1#(combineInputs vl1 vl2 v))\"\n\n\\<comment> \\<open>for ODE\\<close>\nfun combineInputs2 :: \"var list \\<Rightarrow> var list \\<Rightarrow> var list\" where\n  \"combineInputs2 [] vl2 = vl2\" |\n  \"combineInputs2 (v1#vl1) vl2 = (if v1 \\<in> set vl2 then (combineInputs2 vl1 vl2)\n  else v1#(combineInputs2 vl1 vl2))\"\n\n\ntext\\<open>Return the position of \"a\" in a list bl\\<close>\nfun findPos :: \"'a list \\<Rightarrow> 'a \\<Rightarrow> int \\<Rightarrow> int\" where\n  \"findPos [] a i = -1\" |\n  \"findPos (b#bl) a i = (if a = b then i else (findPos bl a (i+1)))\"\n\ntext\\<open>f: real list \\<Rightarrow> real;\nso this function is to update real list in combination(the new real list is for the basic block).\nbasic inputs vl1; additional inputs vl2; additional output v; basic real list xl1;\nadditional real list xl2; additional outupd f.\nAnd the result list length = length vl1\\<close>\nfun replaceInputs :: \"var list \\<Rightarrow> var list \\<Rightarrow> var \\<Rightarrow>\nreal list \\<Rightarrow> real list \\<Rightarrow> outupd \\<Rightarrow> real list\" where\n  \"replaceInputs [] vl2 v xl1 xl2 f = []\" |\n  \"replaceInputs (v1#vl1) vl2 v xl1 xl2 f = (if v1 = v then \n  (f xl2)#(replaceInputs vl1 vl2 v xl1 xl2 f)\n  else (if (findPos vl2 v1 0) = -1 then (hd xl1)#(replaceInputs vl1 vl2 v (tl xl2) xl2 f) else \n  (xl2 ! nat (findPos vl2 v1 0))#(replaceInputs vl1 vl2 v xl1 xl2 f)))\"\n\n(*from the final real list to the final list for the basic outupd function,\nhere f is the additional function*)\nfun splitInputs :: \"var list \\<Rightarrow> var list \\<Rightarrow> var \\<Rightarrow> real list \\<Rightarrow> outupd \\<Rightarrow> real list\" where\n  \"splitInputs vl1 vl2 v xl f = replaceInputs vl1 vl2 v (take (length xl - length vl2) xl) \n  (drop (length xl - length vl2) xl) f\"\n\n\ntext\\<open>when combination happens in two ODEs, we don't delete those produced inputs\nand just combine those ODEs. So this function is for updating basic outupds when\ncombination happens in two ODEs.\n\"combineInputs a1 a2 (CHR '' '')\" means that we don't delete those produced inputs and only\ndelete those same inputs, (CHR '' '') means a useless output not in basic inputs a1.\n\"(splitInputs a1 a2 (CHR '' '') s (\\<lambda>x.0))\" return the real list for f which only find the \ninputs for a1, so outupd \"(\\<lambda>x.0)\" is useless.\\<close>\nfun reviseFun :: \"outupd list \\<Rightarrow> var list \\<Rightarrow> var list \\<Rightarrow> outupd list\" where\n  \"reviseFun [] a1 a2 = []\" |\n  \"reviseFun (f#fl) a1 a2 = (\\<lambda>s. (if length s = length (combineInputs2 a2 a1) then\n  (f (splitInputs a1 a2 (CHR '' '') s (\\<lambda>x.0))) else 0))#(reviseFun fl a1 a2)\"\n\nlemma reviseFunEq: \"length (reviseFun fl a1 a2) = length fl\"\nproof(induction fl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a fl)\n  then show ?case unfolding reviseFun.simps by simp\nqed\n\n(*combine the function f1(calculation function) into the function list (f#f2), \na1 is the initial input list, a2 is the additional input list, v is the output*)\nfun updateFunc :: \"outupd list \\<Rightarrow> var list \\<Rightarrow> var \\<Rightarrow> outupd \\<Rightarrow> var list \\<Rightarrow> outupd list\" where\n  \"updateFunc [] a1 v f1 a2 = []\" |\n  \"updateFunc (f#f2) a1 v f1 a2 = (\\<lambda>xl. (if length xl = length (combineInputs a1 a2 v)\n  then (f (splitInputs a1 a2 v xl f1)) else 0))#(updateFunc f2 a1 v f1 a2)\"\n\nlemma updateFuncEq: \"length (updateFunc fl a1 v f1 a2) = length fl\"\nproof(induction fl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a fl)\n  then show ?case unfolding reviseFun.simps by simp\nqed\n\n(*combine the function f1(ODE) into the function list (f#f2), \na1 is the initial input list, a2 is the additional input list*)\nfun updateFunc2 :: \"outupd list \\<Rightarrow> var list \\<Rightarrow> outupd \\<Rightarrow> var list \\<Rightarrow> outupd list\" where\n  \"updateFunc2 fl a1 f1 a2 = reviseFun fl a1 a2 @[(\\<lambda>s. (if length s = length (combineInputs2 a2 a1)\n   then (f1 (drop (length a2) s)) else 0))]\"\n\nvalue \"combineInputs [CHR ''x'', CHR ''c''] [CHR ''a'', CHR ''b''] (CHR ''c'')\"\nvalue \"splitInputs [CHR ''x'', CHR ''c''] [CHR ''a'', CHR ''b''] (CHR ''c'') [1,2,3] \n(\\<lambda>s.(if length s = 2 then (s ! 0) * (s ! 1) else 0) )\"\n\nvalue \"hd (updateFunc [\\<lambda>s.(if length s = 2 then (s ! 0) + (s ! 1) else 0)] \n[CHR ''x'', CHR ''c''] (CHR ''c'') \n(\\<lambda>s.(if length s = 2 then (s ! 0) * (s ! 1) else 0) ) [CHR ''a'', CHR ''b'']) [1,2,3] \"\n\n(*Combine the outputs when additional block is a computational block;\nc is always 0 in this situation *)\nfun combineOneOutput :: \"var list \\<Rightarrow> var \\<Rightarrow> offset \\<Rightarrow> outupd \\<Rightarrow> \n  ConBlk \\<Rightarrow> ConBlk\" where\n  \"combineOneOutput a1 b c f (Block a2 b2 c2 d2 f2) = (if b \\<in> set b2 then (Block a2 b2 c2 d2 f2)\nelse (Block (combineInputs a2 a1 b) b2 c2 0 (updateFunc f2 a2 b f a1)))\"\n\nlemma combineOneOutputSubset : \"set (get_outputs (combineOneOutput \na1 b c f (Block a2 b2 c2 d2 f2))) = set b2\"\n  unfolding combineOneOutput.simps by auto\n\nlemma combineOneOutputSubset2 : \"set b2 \\<subseteq>set (get_outputs (combineOneOutput \na1 b c f (Block a2 b2 c2 d2 f2)))\"\n  unfolding combineOneOutput.simps by auto\n\nlemma combineOneOutputOffsetsEq : \"set c2 = {1} \\<Longrightarrow> set (get_offsets (combineOneOutput \na1 b c f (Block a2 b2 c2 d2 f2))) = {1}\"\n  unfolding combineOneOutput.simps by auto\n\nlemma combineOneOutputEq : \"length b2 = length c2 \\<and> length b2 = length f2 \\<Longrightarrow>\nlength (get_offsets (combineOneOutput a1 b c f (Block a2 b2 c2 d2 f2))) =\nlength (get_outputs (combineOneOutput a1 b c f (Block a2 b2 c2 d2 f2))) \\<and>\nlength (get_offsets (combineOneOutput a1 b c f (Block a2 b2 c2 d2 f2))) =\nlength (get_outupd (combineOneOutput a1 b c f (Block a2 b2 c2 d2 f2)))\"\n  unfolding combineOneOutput.simps updateFunc.simps using updateFuncEq by force\n\n(*Combine the outputs when additional block is a integrator block;\nc is always 1 in this situation, means type integrator*)\nfun combineOneOutput2 :: \"var list \\<Rightarrow> var \\<Rightarrow> offset \\<Rightarrow> outupd \\<Rightarrow> \n  ConBlk \\<Rightarrow> ConBlk\" where\n  \"combineOneOutput2 a1 b c f (Block a2 b2 c2 d2 f2) = (if b \\<in> set b2 then (Block a2 b2 c2 d2 f2)\nelse (Block (combineInputs2 a2 a1) (b2@[b]) (c2@[c]) 0 (updateFunc2 f2 a1 f a2)))\"\n\nlemma combineOneOutput2Subset : \"set (get_outputs (combineOneOutput2 \na1 b c f (Block a2 b2 c2 d2 f2))) = set (b#b2)\"\n  unfolding combineOneOutput.simps by auto\n\nlemma combineOneOutput2Subset2 : \"set b2 \\<subseteq> set (get_outputs (combineOneOutput2 \na1 b c f (Block a2 b2 c2 d2 f2)))\"\n  unfolding combineOneOutput.simps by auto\n\nlemma combineOneOutput2Eq : \"length b2 = length c2 \\<and> length b2 = length f2 \\<Longrightarrow>\nlength (get_offsets (combineOneOutput2 a1 b c f (Block a2 b2 c2 d2 f2))) =\nlength (get_outputs (combineOneOutput2 a1 b c f (Block a2 b2 c2 d2 f2))) \\<and>\nlength (get_offsets (combineOneOutput2 a1 b c f (Block a2 b2 c2 d2 f2))) =\nlength (get_outupd (combineOneOutput2 a1 b c f (Block a2 b2 c2 d2 f2)))\"\n  unfolding combineOneOutput2.simps updateFunc2.simps using reviseFunEq by force\n\n(*Combine additional block \"(Block a1 b1 c1 d1 f1)\"\ninto the basic block \"(Block a2 b2 c2 d2 f2)\",\nnote: d1 = d2 = 0*)\nfun combineOneBlock :: \"var list \\<Rightarrow> var list \\<Rightarrow> offset list \\<Rightarrow> outupd list \\<Rightarrow> \n  ConBlk \\<Rightarrow> ConBlk\" where\n  \"combineOneBlock a1 [] c1 f1 (Block a2 b2 c2 d2 f2) = (Block a2 b2 c2 0 f2)\" |\n  \"combineOneBlock a1 b1 [] f1 (Block a2 b2 c2 d2 f2) = (Block a2 b2 c2 0 f2)\" |\n  \"combineOneBlock a1 b1 c1 [] (Block a2 b2 c2 d2 f2) = (Block a2 b2 c2 0 f2)\" |\n  \"combineOneBlock a1 (b#b1) (c#c1) (f#f1) (Block a2 b2 c2 d2 f2) = (if c = 1 then\n  (combineOneBlock a1 b1 c1 f1 (combineOneOutput2 a1 b c f (Block a2 b2 c2 d2 f2))) \n  else combineOneBlock a1 b1 c1 f1 (combineOneOutput a1 b c f (Block a2 b2 c2 d2 f2)))\"\n\nlemma combineOneBlockSubset : \"set (get_outputs (combineOneBlock a1 b1 c1 f1 \n(Block a2 b2 c2 d2 f2))) \\<subseteq> set b1 \\<union> set b2\"\nproof(induction b1 arbitrary:c1 f1 a2 b2 c2 d2 f2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b b1)\n  then show ?case\n  proof(cases \"c1 = []\")\n    case True\n    then show ?thesis by auto\n  next\n    case False\n    have 1: \"c1 = hd c1 # tl c1\"\n      using False by simp\n    then show ?thesis\n    proof(cases \"f1 = []\")\n      case True\n      then show ?thesis by (metis \"1\" combineOneBlock.simps(3) get_outputs.simps \n            subset_refl sup.coboundedI2)\n    next\n      case False\n      have 2: \"f1 = hd f1 # tl f1\"\n        using False by simp\n      then show ?thesis\n      proof(cases \"hd c1 = 1\")\n        case True\n        then show ?thesis using 1 2 combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] Cons[of \"tl c1\" \"tl f1\" \"get_inputs \n              ((combineOneOutput2 a1 b (hd c1) (hd f1) (Block a2 b2 c2 d2 f2)))\"\n              \"get_outputs (combineOneOutput2 a1 b (hd c1) (hd f1) (Block a2 b2 c2 d2 f2))\"] \n            combineOneOutput2Subset by (smt (verit, del_insts) UnE UnI2 Un_commute \n              combineOneOutput2.simps dual_order.trans get_outputs.simps hd_in_set list.discI \n              list.sel(1) local.Cons set_ConsD set_subset_Cons subset_iff sup.orderE sup_mono)\n          \n      next\n        case False\n        then show ?thesis using 1 2 combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] Cons[of \"tl c1\" \"tl f1\" \"get_inputs \n              ((combineOneOutput a1 b (hd c1) (hd f1) (Block a2 b2 c2 d2 f2)))\"\n              \"get_outputs (combineOneOutput a1 b (hd c1) (hd f1) (Block a2 b2 c2 d2 f2))\"] \n            combineOneOutputSubset by (metis Un_mono combineOneOutput.simps \n              equalityE local.Cons order_trans set_subset_Cons)\n      qed\n    qed\n  qed\nqed\n\nlemma combineOneBlockSubset2 : \"set b2 \\<subseteq> set (get_outputs (combineOneBlock a1 b1 c1 f1 \n(Block a2 b2 c2 d2 f2)))\"\nproof(induction b1 arbitrary:c1 f1 a2 b2 c2 d2 f2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b b1)\n  then show ?case\n  proof(cases \"c1 = []\")\n    case True\n    then show ?thesis by auto\n  next\n    case False\n    have 1: \"c1 = hd c1 # tl c1\"\n      using False by simp\n    then show ?thesis\n    proof(cases \"f1 = []\")\n      case True\n      then show ?thesis by (metis \"1\" combineOneBlock.simps(3) get_outputs.simps subset_refl)\n    next\n      case False\n      have 2: \"f1 = hd f1 # tl f1\"\n        using False by simp\n      then show ?thesis\n      proof(cases \"hd c1 = 1\")\n        case True\n        then show ?thesis using 1 2 combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] Cons combineOneOutput2Subset2 by force\n      next\n        case False\n        then show ?thesis using 1 2 combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] Cons combineOneOutputSubset2 by force \n      qed\n    qed\n  qed\nqed\n\nlemma combineOneBlockSubset3 : \"set c1 = {0} \\<Longrightarrow>\n set (get_outputs (combineOneBlock a1 b1 c1 f1 (Block a2 b2 c2 d2 f2))) = set b2\"\nproof(induction b1 arbitrary:c1 f1 a2 b2 c2 d2 f2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b b1)\n  then show ?case\n  proof(cases \"c1 = []\")\n    case True\n    then show ?thesis by auto\n  next\n    case False\n    have 1: \"c1 = hd c1 # tl c1\"\n      using False by simp\n    then show ?thesis\n    proof(cases \"f1 = []\")\n      case True\n      then show ?thesis by (metis \"1\" combineOneBlock.simps(3) get_outputs.simps)\n    next\n      case False\n      have 2: \"f1 = hd f1 # tl f1\"\n        using False by simp\n      have 3: \"hd c1 = 0\"\n        using Cons(2) by (metis \"1\" list.set_intros(1) singleton_iff)\n      have 4: \"set (get_outputs (combineOneOutput a1 b (hd c1) (hd f1) \n    (Block a2 b2 c2 d2 f2))) = set b2\"\n        using combineOneOutputSubset by simp\n      then show ?thesis\n      proof(cases \"tl c1 = []\")\n        case True\n        note T = True\n        then show ?thesis\n        proof(cases \"b1 = []\")\n          case True\n          then show ?thesis using 1 2 3 4 combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] by simp\n        next\n          case False\n          then show ?thesis using 1 2 3 4 T combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] by (metis combineOneBlock.simps(2) combineOneOutput.simps \n                get_outputs.simps le_zero_eq list.collapse not_one_le_zero)\n        qed\n      next\n        case False\n        have 5: \"set (tl c1) = {0}\"\n          using False Cons(2) by (metis \"1\" set_empty2 set_subset_Cons subset_singletonD)\n        then show ?thesis using 1 2 3 4 combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] Cons by simp\n      qed\n    qed\n  qed\nqed\n\nlemma combineOneBlockSubset4 : \"set c1 = {} \\<Longrightarrow>\n set (get_outputs (combineOneBlock a1 b1 c1 f1 (Block a2 b2 c2 d2 f2))) = set b2\"\nproof(induction b1)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a b1)\n  then show ?case using Cons(2) by simp\nqed\n\nlemma combineOneBlockSubset5 : \"Available' (Block a1 b1 c1 d1 f1) \\<Longrightarrow> set c1 = {1} \\<Longrightarrow>\n set (get_outputs (combineOneBlock a1 b1 c1 f1 (Block a2 b2 c2 d2 f2))) = set b1 \\<union> set b2\"\nproof(induction b1 arbitrary:c1 f1 a2 b2 c2 d2 f2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b b1)\n  then show ?case\n  proof(cases \"c1 = []\")\n    case True\n    then show ?thesis using Cons by auto\n  next\n    case False\n    have 1: \"c1 = hd c1 # tl c1\"\n      using False by simp\n    then show ?thesis\n    proof(cases \"f1 = []\")\n      case True\n      then show ?thesis using Cons(2) unfolding Available'_def by simp\n    next\n      case False\n      have 2: \"f1 = hd f1 # tl f1\"\n        using False by simp\n      have 3: \"hd c1 = 1\"\n        using Cons(3) by (metis \"1\" list.set_intros(1) singleton_iff)\n      have 4: \"set (get_outputs (combineOneOutput2 a1 b (hd c1) (hd f1) \n    (Block a2 b2 c2 d2 f2))) = set (b#b2)\"\n        using combineOneOutput2Subset by simp\n      then show ?thesis\n      proof(cases \"tl c1 = []\")\n        case True\n        note T = True\n        then show ?thesis\n        proof(cases \"b1 = []\")\n          case True\n          then show ?thesis using 1 2 3 4 combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] by auto\n        next\n          case False                       \n          then show ?thesis using 1 2 3 4 T Cons(2) unfolding Available'_def by force\n        qed\n      next\n        case False\n        note F1 = False\n        have 5: \"set (tl c1) = {1}\"\n          using False Cons(3) by (metis \"1\" set_empty2 set_subset_Cons subset_singletonD)\n        then show ?thesis\n        proof(cases \"b1 = []\")\n          case True\n          then show ?thesis using 1 2 3 4 False Cons(2) unfolding Available'_def by (metis \n                get_offsets.simps get_outputs.simps length_greater_0_conv length_tl list.sel(3))\n        next\n          case False\n          note F2 = False\n          then show ?thesis\n          proof(cases \"tl f1 = []\")\n            case True\n            then show ?thesis using 1 2 3 4 False Cons(2) unfolding Available'_def\n              by (metis get_outputs.simps get_outupd.simps length_0_conv length_tl list.sel(3))\n          next\n            case False\n            have 6: \"Available' (Block a1 b1 (tl c1) d1 (tl f1))\"\n              using Cons(2) 1 2 F1 F2 False unfolding Available'_def by (metis \"5\" Suc_less_eq \n                  bot_nat_0.extremum get_offsets.simps get_outputs.simps get_outupd.simps \n                  get_sample_time.simps insert_iff length_Cons length_tl list.sel(3) nth_Cons_Suc)\n            have 7: \"set (get_outputs (combineOneBlock a1 b1 (tl c1) (tl f1) \n            (Block a2 b2 c2 d2 f2))) = set b1 \\<union> set b2\"\n              using Cons(1) 5 6 by presburger\n            then show ?thesis using 1 2 3 4 combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] \"5\" \"6\" Cons.IH by auto\n          qed\n        qed\n      qed\n    qed\n  qed\nqed\n\nlemma combineOneBlockEq : \"length c1 = length b1 \\<and> length c1 = length f1  \\<Longrightarrow> set c1 = {1} \\<Longrightarrow>\n set (get_outputs (combineOneBlock a1 b1 c1 f1 (Block a2 b2 c2 d2 f2))) = set b1 \\<union> set b2\"\nproof(induction b1 arbitrary:c1 f1 a2 b2 c2 d2 f2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b b1)\n  then show ?case\n  proof(cases \"c1 = []\")\n    case True\n    then show ?thesis using Cons by auto\n  next\n    case False\n    have 1: \"c1 = hd c1 # tl c1\"\n      using False by simp\n    then show ?thesis\n    proof(cases \"f1 = []\")\n      case True\n      then show ?thesis using Cons(2) by force\n    next\n      case False\n      have 2: \"f1 = hd f1 # tl f1\"\n        using False by simp\n      have 3: \"hd c1 = 1\"\n        using Cons(3) by (metis \"1\" list.set_intros(1) singleton_iff)\n      have 4: \"set (get_outputs (combineOneOutput2 a1 b (hd c1) (hd f1) \n    (Block a2 b2 c2 d2 f2))) = set (b#b2)\"\n        using combineOneOutput2Subset by simp\n      then show ?thesis\n      proof(cases \"tl c1 = []\")\n        case True\n        note T = True\n        then show ?thesis\n        proof(cases \"b1 = []\")\n          case True\n          then show ?thesis using 1 2 3 4 combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] by auto\n        next\n          case False                       \n          then show ?thesis using 1 2 3 4 T Cons(2) unfolding Available'_def by force\n        qed\n      next\n        case False\n        note F1 = False\n        have 5: \"set (tl c1) = {1}\"\n          using False Cons(3) by (metis \"1\" set_empty2 set_subset_Cons subset_singletonD)\n        then show ?thesis\n        proof(cases \"b1 = []\")\n          case True\n          then show ?thesis using 1 2 3 4 False Cons(2) unfolding Available'_def by (metis \n                length_greater_0_conv length_tl list.sel(3))\n        next\n          case False\n          note F2 = False\n          then show ?thesis\n          proof(cases \"tl f1 = []\")\n            case True\n            then show ?thesis using 1 2 3 4 False Cons(2) unfolding Available'_def\n              by (metis length_0_conv length_tl list.sel(3))\n          next\n            case False\n            have 6: \"length b1 = length (tl c1) \\<and> length b1 = length (tl f1)\"\n              using Cons(2) 1 2 F1 F2 False by force\n            have 7: \"set (get_outputs (combineOneBlock a1 b1 (tl c1) (tl f1) \n            (Block a2 b2 c2 d2 f2))) = set b1 \\<union> set b2\"\n              using Cons(1) 5 6 by simp\n            then show ?thesis using 1 2 3 4 combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] \"5\" \"6\" Cons.IH by auto\n          qed\n        qed\n      qed\n    qed\n  qed\nqed\n\nlemma combineOneBlockEq2: \"length b1 = length c1 \\<and> length b1 = length f1 \\<Longrightarrow>\nlength b2 = length c2 \\<and> length b2 = length f2 \\<Longrightarrow>\nlength (get_offsets (combineOneBlock a1 b1 c1 f1 (Block a2 b2 c2 d2 f2))) = \nlength (get_outputs (combineOneBlock a1 b1 c1 f1 (Block a2 b2 c2 d2 f2))) \\<and>\nlength (get_offsets (combineOneBlock a1 b1 c1 f1 (Block a2 b2 c2 d2 f2))) = \nlength (get_outupd (combineOneBlock a1 b1 c1 f1 (Block a2 b2 c2 d2 f2)))\"\nproof(induction b1 arbitrary:c1 f1 a2 b2 c2 d2 f2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b b1)\n  then show ?case\n  proof(cases \"c1 = []\")\n    case True\n    then show ?thesis using Cons(2) by simp\n  next\n    case False\n    have 1: \"c1 = hd c1 # tl c1\"\n      using False by simp\n    then show ?thesis\n    proof(cases \"f1 = []\")\n      case True\n      then show ?thesis using Cons(2) by simp\n    next\n      case False\n      have 2: \"f1 = hd f1 # tl f1\"\n        using False by simp\n      then show ?thesis\n      proof(cases \"hd c1 = 1\")\n        case True\n        then show ?thesis using combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] Cons 1 2 combineOneOutput2Eq by (smt (verit, best) \n              combineOneOutput2.simps get_offsets.simps get_outputs.simps get_outupd.simps \n              length_tl list.sel(3))\n      next\n        case False\n        then show ?thesis using combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] Cons combineOneOutputEq \"1\" \"2\" by (metis (no_types, lifting) \n              combineOneOutput.simps length_tl list.sel(3) updateFuncEq)\n      qed\n    qed\n  qed\nqed\n\nlemma combineOneBlockOffsetsEq : \"set c2 = {1} \\<Longrightarrow>\nset (get_offsets (combineOneBlock a1 b1 c1 f1 (Block a2 b2 c2 d2 f2))) = {1}\"\nproof(induction b1 arbitrary:c1 f1 a2 b2 c2 d2 f2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b b1)\n  then show ?case\n  proof(cases \"c1 = []\")\n    case True\n    then show ?thesis using Cons(2) by simp\n  next\n    case False\n    have 1: \"c1 = hd c1 # tl c1\"\n      using False by simp\n    then show ?thesis\n    proof(cases \"f1 = []\")\n      case True\n      then show ?thesis using Cons(2) 1 by (metis combineOneBlock.simps(3) get_offsets.simps)\n    next\n      case False\n      have 2: \"f1 = hd f1 # tl f1\"\n        using False by simp\n      then show ?thesis \n      proof(cases \"hd c1 = 1\")\n        case True\n        then show ?thesis using combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] Cons 1 2 by auto\n      next\n        case False\n        then show ?thesis using combineOneBlock.simps(4)[of a1 b b1 \"hd c1\" \"tl c1\" \"hd f1\"\n              \"tl f1\" a2 b2 c2 d2 f2] Cons combineOneOutputOffsetsEq \"1\" \"2\" by auto\n      qed\n    qed\n  qed\nqed\n\n(*Combine additional block list \"al\" into a basic block \"b\"*)\nfun combineBlocks :: \"ConBlk list \\<Rightarrow> ConBlk \\<Rightarrow> ConBlk\" where\n  \"combineBlocks [] b = b\" |\n  \"combineBlocks (a#al) b = combineBlocks al (combineOneBlock (get_inputs a) \n  (get_outputs a) (get_offsets a) (get_outupd a) b)\"\n\nlemma combineBlocksSubset : \"set (get_outputs (combineBlocks al b)) \\<subseteq> Outputs (b#al)\"\nproof(induction al arbitrary:b)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a al)\n  have 1: \"b = Block (get_inputs b) (get_outputs b) (get_offsets b) (get_sample_time b) (get_outupd b)\"\n    by (metis block.exhaust get_inputs.simps get_offsets.simps get_outputs.simps \n        get_outupd.simps get_sample_time.simps)\n  then show ?case unfolding combineBlocks.simps using combineOneBlockSubset[of \"(get_inputs a)\"\n        \"(get_outputs a)\" \"(get_offsets a)\" \"(get_outupd a)\" \"(get_inputs b)\" \"(get_outputs b)\" \n        \"(get_offsets b)\" \"(get_sample_time b)\" \"(get_outupd b)\"] Cons[of \n        \"(combineOneBlock (get_inputs a) (get_outputs a) (get_offsets a) (get_outupd a) b)\"]\n    by auto\nqed\n\nlemma combineBlocksSubset2 : \"\\<forall>b \\<in> set al. set (get_offsets b) = {0} \\<or>\n set (get_offsets b) = {1} \\<or> set (get_offsets b) = {} \\<Longrightarrow>\nset (get_outputs (combineBlocks al b)) \\<subseteq> Outputs (b#(findIntegBlks al))\"\nproof(induction al arbitrary:b)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a al)\n  have 1: \"b = Block (get_inputs b) (get_outputs b) (get_offsets b) (get_sample_time b) (get_outupd b)\"\n    by (metis block.exhaust get_inputs.simps get_offsets.simps get_outputs.simps \n        get_outupd.simps get_sample_time.simps)\n  then show ?case \n    proof(cases \"set (get_offsets a) = {1}\")\n      case True\n      have 2: \"a \\<in> set (findIntegBlks (a # al))\"\n        unfolding findIntegBlks.simps True by simp\n      then show ?thesis using 1 unfolding combineBlocks.simps using Cons combineOneBlockSubset\n        by (smt (verit, ccfv_SIG) Outputs.simps(2) True dual_order.trans \n            findIntegBlks.simps(2) le_sup_iff list.set_intros(2) set_eq_subset)\n    next\n      case False\n      note F = False\n      then show ?thesis\n      proof(cases \"set (get_offsets a) = {0}\")\n        case True\n        then show ?thesis using 1 unfolding combineBlocks.simps using Cons combineOneBlockSubset3\n        by (smt (verit, best) False Outputs.elims findIntegBlks.simps(2) list.distinct(1) \n            list.inject list.set_intros(2))\n      next\n        case False\n        have 3: \"(get_offsets a) = []\"\n          using Cons(2) False F by auto\n        then show ?thesis using 1 unfolding combineBlocks.simps using Cons combineOneBlockSubset4\n  by (smt (verit, best) F Outputs.simps(2) findIntegBlks.simps(2) list.set_intros(2) set_empty)\n      qed\n    qed\nqed\n\nlemma combineBlocksSubset3 : \"set (get_outputs b) \\<subseteq> set (get_outputs (combineBlocks al b))\"\nproof(induction al arbitrary:b)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a al)\n  have 1: \"b = Block (get_inputs b) (get_outputs b) (get_offsets b) (get_sample_time b) (get_outupd b)\"\n    by (metis block.exhaust get_inputs.simps get_offsets.simps get_outputs.simps \n        get_outupd.simps get_sample_time.simps)\n  then show ?case unfolding combineBlocks.simps using combineOneBlockSubset2\n    by (metis local.Cons subset_trans)\nqed\n\nlemma combineBlocksSubset4 : \"\\<forall>b \\<in> set al. set (get_offsets b) = {0} \\<or>\n set (get_offsets b) = {1} \\<or> set (get_offsets b) = {} \\<Longrightarrow> wf2 al \\<Longrightarrow>\nset (get_outputs (combineBlocks al b)) = Outputs (b#(findIntegBlks al))\"\nproof(induction al arbitrary:b)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a al)\n  have 1: \"b = Block (get_inputs b) (get_outputs b) (get_offsets b) (get_sample_time b) (get_outupd b)\"\n    by (metis block.exhaust get_inputs.simps get_offsets.simps get_outputs.simps \n        get_outupd.simps get_sample_time.simps)\n  then show ?case \n    proof(cases \"set (get_offsets a) = {1}\")\n      case True\n      have 2: \"a \\<in> set (findIntegBlks (a # al))\"\n        unfolding findIntegBlks.simps True by simp\n      have 3: \"Available' (Block (get_inputs a) (get_outputs a) \n        (get_offsets a) (get_sample_time a) (get_outupd a))\"\n        using Cons(3) unfolding wf2_def by (simp add: Available'_def)\n      have 4: \"set (get_outputs\n          (combineOneBlock (get_inputs a) (get_outputs a) (get_offsets a) (get_outupd a) \n      b)) = set (get_outputs a) \\<union> set (get_outputs b)\"\n        using combineOneBlockSubset5 True 1 3 by metis\n      then show ?thesis using 1 unfolding combineBlocks.simps using Cons \n        wf2_lemma True by auto\n    next\n      case False\n      note F = False\n      then show ?thesis\n      proof(cases \"set (get_offsets a) = {0}\")\n        case True\n        then show ?thesis using 1 unfolding combineBlocks.simps using Cons combineOneBlockSubset3\n          by (metis wf2_lemma False Outputs.simps(2) findIntegBlks.simps(2) list.set_intros(2))\n      next\n        case False\n        have 3: \"(get_offsets a) = []\"\n          using Cons(2) False F by auto\n        then show ?thesis using 1 unfolding combineBlocks.simps using Cons combineOneBlockSubset4\n   by (metis wf2_lemma F Outputs.simps(2) findIntegBlks.simps(2) list.set_intros(2) set_empty)\n      qed\n    qed\n  qed\n\nlemma combineBlocksEq : \"\\<forall>b \\<in> set al. set (get_offsets b) = {1} \\<and> \nlength (get_offsets b) = length (get_outputs b) \\<and>\nlength (get_offsets b) = length (get_outupd b) \\<Longrightarrow>\nset (get_outputs (combineBlocks al b)) = Outputs (b#al)\"\nproof(induction al arbitrary:b)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a al)\n  have 1: \"b = Block (get_inputs b) (get_outputs b) (get_offsets b) (get_sample_time b) (get_outupd b)\"\n    by (metis block.exhaust get_inputs.simps get_offsets.simps get_outputs.simps \n        get_outupd.simps get_sample_time.simps)\n  then show ?case unfolding combineBlocks.simps using combineOneBlockEq Cons by (smt (verit, best) \n        Outputs.simps(2) list.set_intros(1) list.set_intros(2) sup.assoc sup_commute)\nqed\n\nlemma combineBlockEq2 : \"\\<forall>b \\<in> set(b#al). length (get_offsets b) = length (get_outputs b) \\<and>\nlength (get_offsets b) = length (get_outupd b) \\<Longrightarrow> length (get_offsets \n(combineBlocks al b)) = length (get_outputs (combineBlocks al b)) \\<and> length (get_offsets \n(combineBlocks al b)) = length (get_outupd (combineBlocks al b))\"\nproof(induction al arbitrary: b)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a al)\n  have 1: \"b = Block (get_inputs b) (get_outputs b) (get_offsets b) (get_sample_time b) (get_outupd b)\"\n    by (metis block.exhaust get_inputs.simps get_offsets.simps get_outputs.simps \n        get_outupd.simps get_sample_time.simps)\n  then show ?case unfolding combineBlocks.simps using combineOneBlockEq2 Cons\n    by (metis list.set_intros(1) list.set_intros(2) set_ConsD)\nqed\n\nlemma combineBlocksOffsetEq : \"set (get_offsets b) = {1} \\<Longrightarrow>\nset (get_offsets (combineBlocks al b)) = {1}\"\nproof(induction al arbitrary:b)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a al)\n  then show ?case unfolding combineBlocks.simps using combineOneBlockOffsetsEq\n    by (metis get_offsets.elims)\nqed\n\ntext\\<open>bl: all continuous blocks; c: basic integrator block;\ncl: those related blocks of c which have been found before\\<close>\nfun getOneRelatedBlock :: \"ConBlk list \\<Rightarrow> ConBlk \\<Rightarrow> \n  ConBlk list \\<Rightarrow> ConBlk option\" where\n  \"getOneRelatedBlock [] c cl = None\" |\n  \"getOneRelatedBlock (b#bl) c cl = (if (set (get_outputs b) \\<inter> set (get_inputs c) \\<noteq> {} \\<or>\n  set (get_outputs b) \\<inter> (Inputs cl) \\<noteq> {}) then (Some b) else \n  getOneRelatedBlock bl c cl)\"\n\nlemma getOneRelatedBlockSubset: \"getOneRelatedBlock bl c cl = Some y \\<Longrightarrow> y \\<in> set bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case unfolding getOneRelatedBlock.simps\n    by (metis list.set_intros(1) list.set_intros(2) option.inject)\nqed\n\n(*give the block list bl, return the related blocks of the integrator block c;\nhere cl are those related blocks of c which have been found before(initialized to [])*)\nfunction getRelatedBlocks :: \"ConBlk list \\<Rightarrow> ConBlk \\<Rightarrow> \n  ConBlk list \\<Rightarrow> ConBlk list\" where\n  \"getRelatedBlocks bl c cl = (if getOneRelatedBlock bl c cl = None \n  then cl else getRelatedBlocks (remove1 (the (getOneRelatedBlock bl c cl)) bl) c \n  (cl@[(the (getOneRelatedBlock bl c cl))]))\"\n  by pat_completeness auto\ntermination \n  apply (relation \"measures[(\\<lambda>(bl::ConBlk list , c::ConBlk,\ncl::ConBlk list). length bl)]\", auto)\n  subgoal premises pre for bl c cl y\n  proof -\n    show ?thesis using pre getOneRelatedBlockSubset\n      by (metis length_Cons lessI perm_length perm_remove)\n  qed\n  done\n\nlemma getRelatedBlocksSubset : \"Outputs (getRelatedBlocks bl c cl) \\<subseteq> Outputs bl \\<union> Outputs cl\"\nproof(induction bl arbitrary: cl rule: wf_induct[of \"{(x, y). length x < length y}\"])\n  case 1\n  then show ?case unfolding wf_def using length_induct by auto\nnext\n  case (2 bl)\n  then show ?case \n  proof(cases \"getOneRelatedBlock bl c cl = None\")\n    case True\n    then show ?thesis using getRelatedBlocks.simps[of bl c cl] by auto\n  next\n    case False\n    have 3: \"length (remove1 (the (getOneRelatedBlock bl c cl)) bl) < length bl\"\n      using False getOneRelatedBlockSubset by (metis One_nat_def Suc_pred length_pos_if_in_set \n          length_remove1 lessI option.collapse)\n    have 4: \"Outputs (remove1 (the (getOneRelatedBlock bl c cl)) bl) \\<union>\n    Outputs (cl@[the (getOneRelatedBlock bl c cl)]) = Outputs bl \\<union> Outputs cl\"\n      using False getOneRelatedBlockSubset by (metis (no_types, lifting) \"3\" Outputs_base \n          Outputs_base2 length_remove1 nat_neq_iff sup.commute sup.left_commute)\n    have 5: \"Outputs (getRelatedBlocks (remove1 (the (getOneRelatedBlock bl c cl)) bl) c \n    (cl@[the (getOneRelatedBlock bl c cl)])) \\<subseteq> Outputs (remove1 (the \n    (getOneRelatedBlock bl c cl)) bl) \\<union> Outputs (cl@[the (getOneRelatedBlock bl c cl)])\"\n      using 2 3 by blast\n    then show ?thesis using 4 5 by simp\n  qed\nqed\n\nlemma getRelatedBlocksSubset2 : \"set (getRelatedBlocks bl c cl) \\<subseteq> set bl \\<union> set cl\"\nproof(induction bl arbitrary: cl rule: wf_induct[of \"{(x, y). length x < length y}\"])\n  case 1\n  then show ?case unfolding wf_def using length_induct by auto\nnext\n  case (2 bl)\n  then show ?case \n  proof(cases \"getOneRelatedBlock bl c cl = None\")\n    case True\n    then show ?thesis using getRelatedBlocks.simps[of bl c cl] by auto\n  next\n    case False\n    have 3: \"length (remove1 (the (getOneRelatedBlock bl c cl)) bl) < length bl\"\n      using False getOneRelatedBlockSubset by (metis One_nat_def Suc_pred length_pos_if_in_set \n          length_remove1 lessI option.collapse)\n    have 4: \"set (remove1 (the (getOneRelatedBlock bl c cl)) bl) \\<union>\n    set (cl@[the (getOneRelatedBlock bl c cl)]) \\<subseteq> set bl \\<union> set cl\"\n      using False getOneRelatedBlockSubset using \"3\" set_remove1_subset by fastforce\n    have 5: \"set (getRelatedBlocks (remove1 (the (getOneRelatedBlock bl c cl)) bl) c \n    (cl@[the (getOneRelatedBlock bl c cl)])) \\<subseteq> set (remove1 (the \n    (getOneRelatedBlock bl c cl)) bl) \\<union> set (cl@[the (getOneRelatedBlock bl c cl)])\"\n      using 2 3 by blast\n    then show ?thesis using 4 5 using False by fastforce\n  qed\nqed\n\nlemma getRelatedBlocksUnique: \"Unique (bl@cl) \\<Longrightarrow> Unique (getRelatedBlocks bl c cl)\"\nproof(induction bl arbitrary: cl rule: wf_induct[of \"{(x, y). length x < length y}\"])\n  case 1\n  then show ?case unfolding wf_def using length_induct by auto\nnext\n  case (2 bl)\n  then show ?case\n  proof(cases \"getOneRelatedBlock bl c cl = None\")\n    case True\n    then show ?thesis using 2(2) using getRelatedBlocks.simps[of bl c cl]\n      using Unique_Cons by auto\n  next\n    case False\n    have 3: \"length (remove1 (the (getOneRelatedBlock bl c cl)) bl) < length bl\"\n      using False getOneRelatedBlockSubset by (metis One_nat_def Suc_pred length_pos_if_in_set \n          length_remove1 lessI option.collapse)\n    have 4: \"Unique ((remove1 (the (getOneRelatedBlock bl c cl)) bl)\n        @(cl @ [the (getOneRelatedBlock bl c cl)]))\"\n    proof -\n      have tmp1: \"\\<forall>j. j < (length (remove1 (the (getOneRelatedBlock bl c cl)) \n        ((remove1 (the (getOneRelatedBlock bl c cl)) bl)@cl))) \\<and> j \\<ge> 0 \\<longrightarrow> \n      (the (getOneRelatedBlock bl c cl)) \\<noteq> (nth (remove1 (the (getOneRelatedBlock bl c cl)) \n      ((remove1 (the (getOneRelatedBlock bl c cl)) bl) @cl)) j)\"      \n        using Unique_k 2(2) by (metis Unique_remove nth_mem remove1_append remove1_idem)\n      have tmp2: \"(remove1 (the (getOneRelatedBlock bl c cl)) bl)@cl = \n            (remove1 (the (getOneRelatedBlock bl c cl)) (bl@cl))\"\n        using getOneRelatedBlockSubset by (metis \"3\" nat_less_le remove1_append remove1_idem)\n      show ?thesis using tmp1 tmp2 Unique_remove getOneRelatedBlockSubset Unique_add2\n        by (metis \"2.prems\" Unique_k append.assoc remove1_idem)\n    qed\n    have 5: \"Unique (getRelatedBlocks (remove1 (the (getOneRelatedBlock bl c cl)) bl) c\n           (cl @ [the (getOneRelatedBlock bl c cl)]))\"\n      using 2 3 4 by blast\n    then show ?thesis using getRelatedBlocks.simps[of bl c cl] 5 False by presburger\n  qed\nqed\n\n\n(*outputs_sorted block list; Integ blocks, Integ outputs vars return the blocks after combination*)\nfun combination :: \"ConBlk list \\<Rightarrow> ConBlk list \\<Rightarrow> ConBlk list\" where\n  \"combination bl [] = []\" |\n  \"combination bl (c#cl) = ((combineBlocks (getRelatedBlocks bl c []) c)#\n  combination (remove1 c bl) cl)\"\n\nlemma combinationEq : \"wf2 bl \\<Longrightarrow> wf2 cl \\<Longrightarrow>\n\\<forall>b \\<in> set bl. (set (get_offsets b) = {1}) \\<longrightarrow> set (get_outputs b) \\<subseteq> Outputs cl \\<Longrightarrow>\n\\<forall>c \\<in> set cl. (set (get_offsets c) = {1}) \\<Longrightarrow> set cl \\<subseteq> set bl \\<Longrightarrow>\nOutputs (combination bl cl) = Outputs cl\"\nproof(induction cl arbitrary: bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons c cl)\n  have 1: \"Outputs (findIntegBlks (getRelatedBlocks bl c [])) \\<subseteq> Outputs (c#cl)\"\n  proof -\n    have tmp1: \"Outputs (findIntegBlks bl) \\<subseteq> Outputs (c#cl)\"\n    using Cons(4) proof(induction bl)\n      case Nil\n      then show ?case by simp\n    next\n      case (Cons b bl)\n      then show ?case\n      proof(cases \"set (get_offsets b) = {1}\")\n        case True\n        then show ?thesis using Cons unfolding findIntegBlks.simps\n          using Cons.IH by auto\n      next\n        case False\n        then show ?thesis unfolding findIntegBlks.simps using Cons by auto\n      qed\n    qed\n    have tmp2: \"Outputs (findIntegBlks (c#cl)) \\<subseteq> Outputs (c#cl)\"\n      using findIntegBlksSubset by auto\n    show ?thesis using getRelatedBlocksSubset2 tmp1 tmp2 by (metis empty_set \n          findIntegBlksSubset2 subset_eq sup_bot.right_neutral)\n  qed\n  have 2: \"Outputs (combination (remove1 c bl) cl) = Outputs cl\"\n  proof -\n    have tmp1: \"c \\<in> set bl\"\n      using Cons(6) by auto\n    have tmp2: \"wf2 (remove1 c bl)\"\n      using Cons(2) wf2_remove by (metis remove1_idem)\n    have tmp3: \"\\<forall>b\\<in>set (remove1 c bl). set (get_offsets b) = {1} \\<longrightarrow> \n      set (get_outputs b) \\<inter> (set (get_outputs c)) = {}\"\n      using Cons(2,3) tmp1 unfolding wf2_def Unique_def Graph_def by (metis wf2_def \n          Cons.prems(1) Unique_k in_set_conv_nth linorder_not_le not_less0 notin_set_remove1)\n    have tmp4: \"\\<forall>b\\<in>set (remove1 c bl). set (get_offsets b) = {1} \\<longrightarrow> \n      set (get_outputs b) \\<subseteq> Outputs cl\"\n      using Cons(2,4) tmp1 by (smt (verit) Outputs.simps(2) Un_iff disjoint_iff_not_equal \n          in_mono notin_set_remove1 subsetI tmp3)\n    have tmp5: \"\\<forall>c\\<in>set cl. set (get_offsets c) = {1}\"\n      using Cons(5) by auto\n    have tmp6: \"set cl \\<subseteq> set (remove1 c bl)\"\n      using Cons(3,5) unfolding wf2_def Unique_def Graph_def by (smt (verit, ccfv_threshold) \n          wf2_def Cons.prems(2) Cons.prems(5) Set.set_insert Unique_k in_set_conv_nth \n          in_set_remove1 insert_subset less_nat_zero_code linorder_not_le remove_hd set_subset_Cons subsetI)\n    show ?thesis using Cons(1,3) tmp4 tmp2 tmp5 tmp6 using wf2_lemma by presburger\n  qed\n  have 3: \"set (get_outputs (combineBlocks (getRelatedBlocks bl c []) c)) \n      = Outputs (c # findIntegBlks (getRelatedBlocks bl c []))\"\n  proof -\n    have tmp1: \"\\<forall>b\\<in>set (getRelatedBlocks bl c []). \n    set (get_offsets b) = {0} \\<or> set (get_offsets b) = {1} \\<or> set (get_offsets b) = {}\"\n      using Cons(2) unfolding wf2_def Available'_def using getRelatedBlocksSubset2\n      by (metis empty_set in_mono sup_bot.right_neutral)\n    have tmp2: \"wf2 (getRelatedBlocks bl c [])\"\n    proof -\n      have tmp1: \"Unique (getRelatedBlocks bl c [])\"\n        using getRelatedBlocksUnique Cons(2) unfolding wf2_def by simp\n      show ?thesis using getRelatedBlocksSubset2 tmp1 Cons(2) unfolding wf2_def\n        by (smt (verit) Graph_def empty_set subset_code(1) sup_bot.right_neutral)\n    qed\n    show ?thesis using combineBlocksSubset4 getRelatedBlocksSubset2 tmp2 Cons(2) Cons(2) \n      unfolding wf2_def Available'_def by (metis combineBlocksSubset4 tmp2)\n  qed\n  then show ?case unfolding combination.simps using 3 by (smt (verit, best) \"1\" \"2\" Outputs.simps(2) Outputs_base2 Un_assoc le_iff_sup list.set_intros(1) remove_hd)\nqed\n\nlemma combinationOffsetsEq : \"\n\\<forall>c \\<in> set cl. (set (get_offsets c) = {1}) \\<Longrightarrow> \n\\<forall>c \\<in> set (combination bl cl). (set (get_offsets c) = {1})\"\nproof(induction cl arbitrary: bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons c cl)\n  then show ?case unfolding combination.simps using combineBlocksOffsetEq \n    by (metis list.set_intros(1) list.set_intros(2) set_ConsD)\nqed\n\nlemma combinationEq2 : \"wf2 bl \\<Longrightarrow> wf2 cl \\<Longrightarrow> set cl \\<subseteq> set bl \\<Longrightarrow> \\<forall>c \\<in> set (combination bl cl).\nlength (get_outputs c) = length (get_offsets c) \\<and> length (get_offsets c) = length (get_outupd c)\"\nproof(induction cl arbitrary: bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a cl)\n  have 1: \"wf2 (remove1 a bl)\"\n    using Cons(2) wf2_remove by (metis remove1_idem)\n  have 2: \"wf2 cl\"\n    using Cons(3) wf2_lemma by simp\n  have 3: \"set cl \\<subseteq> set (remove1 a bl)\"\n    using Cons(2,3,4) unfolding wf2_def Unique_def by (metis wf2_def Cons.prems(2) Unique_k \n        in_set_conv_nth in_set_remove1 less_nat_zero_code linorder_not_less remove_hd \n        set_subset_Cons subset_code(1))\n  have 4: \"\\<forall>c\\<in>set (combination (remove1 a bl) cl).\n       length (get_outputs c) = length (get_offsets c) \\<and>\n       length (get_offsets c) = length (get_outupd c)\"\n    using Cons(1) 1 2 3 by presburger\n  have 5: \"\\<forall>b\\<in>set (a#bl).\n       length (get_offsets b) = length (get_outputs b) \\<and>\n       length (get_offsets b) = length (get_outupd b)\"\n    using Cons(2,3,4) unfolding wf2_def Available'_def\n    by (metis list.set_intros(1) set_ConsD)\n  then show ?case unfolding combination.simps using combineBlockEq2 4 getRelatedBlocksSubset2 \n    by (smt (verit, ccfv_SIG) empty_set empty_subsetI le_supI list.set_intros(1) set_ConsD \n        set_subset_Cons subset_eq)\nqed\n\ntext\\<open>Combine all block list; used for combine all Integrator blocks\\<close>\nfun Combine :: \"ConBlk list \\<Rightarrow> ConBlk\" where\n  \"Combine [] = (Block [] [] [] 0 [])\" |\n  \"Combine (b#bl) = combineBlocks bl b\"\n                             \nlemma CombineSubset : \"set (get_outputs (Combine bl)) \\<subseteq> Outputs bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case unfolding Combine.simps using combineBlocksSubset by auto\nqed\n\nlemma CombineEq : \"\\<forall>b \\<in> set bl. (set (get_offsets b) = {1}) \\<and> length (get_offsets b) \n= length (get_outputs b) \\<and> length (get_offsets b) = length (get_outupd b) \\<Longrightarrow>\nset (get_outputs (Combine bl)) = Outputs bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b bl)\n  then show ?case unfolding Combine.simps using combineBlocksEq by auto\nqed\n\ntext \\<open>sorted by outputs; get the smallest block\\<close>\nfun get_first_block :: \"ConBlk list \\<Rightarrow> ConBlk\" where\n  \"get_first_block [] = undefined\" |\n  \"get_first_block [b] = b\" |\n  \"get_first_block (b#bl) = (if (integer_of_char (hd (get_outputs (get_first_block bl))) \\<ge> \n  integer_of_char (hd (get_outputs b))) then b else (get_first_block bl))\"\n\nlemma get_first_block_in : \"get_first_block (a # cl) \\<in> set (a#cl)\"\nproof(induction cl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons c cl)\n  then show ?case unfolding get_first_block.simps using Cons by (smt (verit, ccfv_SIG) \n  getCalBlks.cases get_first_block.simps(2) get_first_block.simps(3) \n  insert_iff list.simps(15))\nqed\n\nlemma get_first_block_add: \"get_first_block (b#bl) = b \\<Longrightarrow>\n(integer_of_char (hd (get_outputs c)) \\<ge> integer_of_char (hd (get_outputs b))) \\<Longrightarrow>\nget_first_block (b#c#bl) = b\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a bl)\n  have 1: \"(integer_of_char (hd (get_outputs (get_first_block (a#bl)))) \\<ge> \n  integer_of_char (hd (get_outputs b)))\"\n    using Cons(2) unfolding get_first_block.simps by (metis nle_le)\n  then show ?case using Cons(3) unfolding get_first_block.simps by presburger\nqed\n\nlemma get_first_block_noteq: \"get_first_block (b#bl) \\<noteq> b \\<Longrightarrow>\n(integer_of_char (hd (get_outputs c)) > integer_of_char (hd (get_outputs (get_first_block bl)))) \\<Longrightarrow>\nget_first_block (b#c#bl) = get_first_block bl\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a bl)\n  then show ?case  unfolding get_first_block.simps \n    by (smt (verit, best) linorder_not_less)\nqed\n\nlemma get_first_block_reomve1: \"get_first_block (b#c#bl) = b \\<Longrightarrow>\nget_first_block (b#bl) = b\"\n  subgoal premises pre\nproof(cases \"bl = []\")\n  case True\n  then show ?thesis by simp\nnext\n  case False\n  then show ?thesis using pre unfolding get_first_block.simps\n    by (smt (verit, ccfv_threshold) dual_order.trans get_first_block.simps(3) list.exhaust)\n  qed\n  done\n\nlemma get_first_block_reomve2: \"get_first_block (b#bl) = b \\<Longrightarrow>\nget_first_block (b#(remove1 c bl)) = b\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a bl)\n  have 1: \"get_first_block (b # remove1 c bl) = b\"\n    using Cons get_first_block_reomve1 by blast\n  have 2: \"(integer_of_char (hd (get_outputs a)) \\<ge> integer_of_char (hd (get_outputs b)))\"\n    using Cons(2) unfolding get_first_block.simps\n    by (metis get_first_block.simps(3) get_first_block_reomve1 nle_le)\n  then show ?case\n  proof(cases \"c = a\")\n    case True\n    then show ?thesis using Cons by (metis get_first_block_reomve1 remove_hd)\n  next\n    case False\n    have 3: \"get_first_block (b # remove1 c (a # bl)) = get_first_block (b # a # remove1 c bl)\"\n      using False by auto\n    then show ?thesis using 1 2 get_first_block_add by presburger\n  qed\nqed\n\n\nlemma get_first_block_lemma : \"get_first_block (b#bl) = b \\<Longrightarrow> \\<forall>c \\<in> set bl. (integer_of_char \n(hd (get_outputs c)) \\<ge> integer_of_char (hd (get_outputs b)))\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a bl)\n  then show ?case using get_first_block_reomve1 unfolding get_first_block.simps\n    by (metis nle_le set_ConsD)\nqed\n\nlemma get_first_block_remove3 : \"wf2 bl \\<Longrightarrow> b \\<in> set bl \\<Longrightarrow> get_first_block bl =\nget_first_block (b#remove1 b bl)\"\nproof(induction bl)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a bl)\n  then show ?case\n  proof(cases \"b = a\")\n    case True\n    then show ?thesis by auto\n  next\n    case False\n    note F1 = False\n    have 0 : \"wf2 bl\"\n      using Cons(2) wf2_lemma by simp\n    have 1: \"get_first_block bl = get_first_block (b # remove1 b bl)\"\n      using False Cons 0 by simp\n    have 2: \"bl = hd bl # tl bl\"\n      using Cons(3) False by (metis hd_Cons_tl in_set_member member_rec(2) set_ConsD)\n    have 3: \"b \\<in> set bl\"\n      using False Cons by simp\n    then show ?thesis\n    proof(cases \"get_first_block (a # bl) = a\")\n      case True\n      have tmp1: \"integer_of_char (hd (get_outputs b))\n        \\<ge> integer_of_char (hd (get_outputs a))\"\n        using True get_first_block.simps(3)[of a \"hd bl\" \"tl bl\"] get_first_block_lemma \n        3 by presburger\n      have tmp2: \"get_first_block (b # remove1 b (a # bl)) = get_first_block (b # a # remove1 b bl)\"\n        using F1 by auto\n      have tmp3: \"get_first_block (a # remove1 b bl) = a\"\n        using True get_first_block_reomve2 by presburger\n      have tmp4: \"set (get_outputs b) \\<inter> set (get_outputs a) = {}\"\n        using Cons(2,3) unfolding wf2_def Graph_def by (metis False True get_first_block_in)\n      have tmp5: \"(get_outputs b) \\<noteq> [] \\<and> (get_outputs a) \\<noteq> []\"\n        using Cons(2,3) unfolding wf2_def Available'_def by (metis Graph_def \n            list.set_intros(1) list.size(3) not_gr_zero)\n      have tmp6: \"hd (get_outputs b) \\<noteq> hd (get_outputs a)\"\n        using tmp4 tmp5 by (simp add: disjoint_iff_not_equal)\n      have tmp7: \"integer_of_char (hd (get_outputs b))\n        \\<noteq> integer_of_char (hd (get_outputs a))\"\n        using tmp6 by (simp add: integer_of_char_def)\n      have tmp8: \"integer_of_char (hd (get_outputs b))\n        > integer_of_char (hd (get_outputs a))\"\n        using tmp1 tmp7 by simp\n      have tmp9: \"get_first_block (b # a # remove1 b bl) = a\"\n        using tmp8 tmp3 unfolding get_first_block.simps by simp\n      then show ?thesis using tmp2 tmp9 True by simp\n    next\n      case False\n      note F2 = False\n      have tmp1: \"get_first_block (a # bl) = get_first_block (b # remove1 b bl)\"\n        using False 1 2 get_first_block.simps(3)[of a \"hd bl\" \"tl bl\"] by presburger\n      then show ?thesis\n      proof(cases \"get_first_block (b # remove1 b bl) = b\")\n        case True\n        then show ?thesis using tmp1 False\n          using get_first_block.simps(3) get_first_block_reomve2 by presburger\n      next\n        case False\n        have tmp2: \"(integer_of_char (hd (get_outputs a)) > \n          integer_of_char (hd (get_outputs (get_first_block bl))))\"\n          using F2 2 get_first_block.simps(3)[of a \"hd bl\" \"tl bl\"] by (metis linorder_not_le) \n        then show ?thesis using get_first_block_noteq False by (smt (verit, del_insts) \n              get_first_block.elims list.discI list.inject remove1.simps(2) tmp1)\n      qed\n    qed\n  qed\nqed\n\nlemma get_first_block_same : \"wf2 bl1 \\<Longrightarrow> bl1 \\<noteq> [] \\<Longrightarrow> bl1 <~~> bl2 \\<Longrightarrow>\nget_first_block bl1 = get_first_block bl2\"\nproof(induction bl1 arbitrary:bl2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons b1 bl1)\n  have 0: \"wf2 bl1\"\n    using Cons(2) wf2_lemma by simp\n  then show ?case\n  proof(cases \"bl1 = []\")\n    case True\n    then show ?thesis using Cons by auto\n  next\n    case False\n    have 1: \"bl1 <~~> remove1 b1 bl2\"\n      using Cons(4) by (metis perm_remove_perm remove_hd)\n    have 2: \"get_first_block bl1 = get_first_block (remove1 b1 bl2)\"\n      using Cons(1) 0 1 False by simp\n    have 3: \"wf2 bl2\"\n      using wf2_lemma2 Cons(2,4) by auto\n    have 4: \"get_first_block bl2 = get_first_block (b1#(remove1 b1 bl2))\"\n      using get_first_block_remove3 3 by (meson Cons.prems(3) list.set_intros(1) prem_seteq)\n    then show ?thesis using Cons 2 False unfolding get_first_block.simps\n      by (smt (verit, best) \"1\" get_first_block.elims list.inject perm.Cons perm_sing_eq)\n  qed\nqed\n\ntext \\<open>sorted by outputs\\<close>\nfunction sort_by_outputs :: \"ConBlk list \\<Rightarrow> ConBlk list\" where\n  \"sort_by_outputs [] = []\" |\n  \"sort_by_outputs (c#cl) = (let b = get_first_block (c#cl) in \n  b # (sort_by_outputs (remove1 b (c#cl)) ))\"\n  by pat_completeness auto\ntermination \n  apply (relation \"measures[(\\<lambda>(cl::ConBlk list). length cl)]\", auto)\n  subgoal premises pre for a cl\n  proof -\n    show ?thesis using get_first_block_in pre using perm_length perm_remove\n      by (metis impossible_Cons linorder_not_le set_ConsD)\n  qed\n  done\n\nlemma sort_by_outputs_Outputs : \"Outputs (sort_by_outputs bl) = Outputs bl\"\nproof(induction bl rule: wf_induct[of \"{(x, y). length x < length y}\"])\n  case 1\n  then show ?case unfolding wf_def using length_induct by auto\nnext\n  case (2 bl)\n  then show ?case\n  proof(cases \"bl = []\")\n    case True\n    then show ?thesis by simp\n  next\n    case False\n    have 3: \"bl = hd bl # tl bl\"\n      using False by simp\n    have 4: \"length (remove1 (get_first_block bl) bl) < length bl\"\n      using 3 get_first_block_in by (metis length_Cons lessI perm_length perm_remove)\n    have 5: \"Outputs bl = Outputs ((get_first_block bl)#(remove1 (get_first_block bl) bl))\"\n      using Outputs_remove 3 get_first_block_in by metis\n    have 6: \"Outputs (sort_by_outputs bl) = \n    Outputs ((get_first_block bl)#(sort_by_outputs (remove1 (get_first_block bl) bl)))\"\n      using 3 sort_by_outputs.simps(2)[of \"hd bl\" \"tl bl\"] by metis\n    have 7: \"Outputs (sort_by_outputs (remove1 (get_first_block bl) bl)) \n    = Outputs (remove1 (get_first_block bl) bl)\"\n      using 4 2 by blast\n    then show ?thesis using 5 6 7 by auto\n  qed\nqed\n\nlemma sort_by_outputs_perm1 : \"(sort_by_outputs bl) <~~> bl\"\nproof(induction bl rule: wf_induct[of \"{(x, y). length x < length y}\"])\n  case 1\n  then show ?case unfolding wf_def using length_induct by auto\nnext\n  case (2 bl)\n  then show ?case\n  proof(cases \"bl = []\")\n    case True\n    then show ?thesis by simp\n  next\n    case False\n    have 3: \"bl = hd bl # tl bl\"\n      using False by simp\n    have 4: \"length (remove1 (get_first_block bl) bl) < length bl\"\n      using 3 get_first_block_in by (metis length_Cons lessI perm_length perm_remove)\n    then show ?thesis by (metis \"2\" \"3\" case_prodI get_first_block_in mem_Collect_eq perm_remove2 \n          sort_by_outputs.simps(2))\n  qed\nqed\n\nlemma sort_by_outputs_perm2 : \"wf2 bl1 \\<Longrightarrow>\nbl1 <~~> bl2 \\<Longrightarrow> sort_by_outputs bl1 = sort_by_outputs bl2\"\nproof(induction bl1 arbitrary: bl2 rule: wf_induct[of \"{(x, y). length x < length y}\"])\n  case 1\n  then show ?case unfolding wf_def\n    using length_induct by auto\nnext\n  case (2 bl1)\n  then show ?case\n  proof(cases \"bl1 = []\")\n    case True\n    then show ?thesis using \"2.prems\" by blast\n  next\n    case False\n    have 3: \"bl1 = hd bl1 # tl bl1\"\n      using False by simp\n    have 4: \"bl2 = hd bl2 # tl bl2\"\n      using False 2(3) using list.exhaust_sel by blast\n    have tmp1: \"get_first_block bl1 = get_first_block bl2\"\n      using 3 4 2(2,3) False get_first_block_same by presburger\n    have tmp2: \"remove1 (get_first_block bl1) bl1 <~~> remove1 (get_first_block bl2) bl2\"\n      using tmp1 2(3) by (simp add: perm_remove_perm)\n    have tmp3: \"wf2 (remove1 (get_first_block bl1) bl1)\"\n      using 2(2) get_first_block_in wf2_remove by (metis remove1_idem)\n    have tmp4: \"length (remove1 (get_first_block bl1) bl1) < length bl1\"\n      using get_first_block_in by (metis \"3\" length_Cons lessI perm_length perm_remove)\n    then show ?thesis using 2 tmp2 tmp3 tmp4\n      by (metis \"3\" \"4\" case_prod_conv mem_Collect_eq sort_by_outputs.simps(2) tmp1)\n  qed\nqed\n\n\n(*all continuousBlocks; Integ blocks, return the combined block after combination*)\nfun updateIntegBlks :: \"ConBlk list \\<Rightarrow> ConBlk list \\<Rightarrow> ConBlk\" where\n  \"updateIntegBlks bl cl = Combine (combination (sort_by_outputs bl) (sort_by_outputs cl))\"\n\nlemma updateIntegBlksSubset : \"wf2 bl \\<Longrightarrow> wf2 cl \\<Longrightarrow>\n\\<forall>b \\<in> set bl. (set (get_offsets b) = {1}) \\<longrightarrow> set (get_outputs b) \\<subseteq> Outputs cl \\<Longrightarrow>\n\\<forall>c \\<in> set cl. (set (get_offsets c) = {1}) \\<Longrightarrow> set cl \\<subseteq> set bl \\<Longrightarrow>\nset (get_outputs (updateIntegBlks bl cl)) \\<subseteq> Outputs cl\"\n  subgoal premises pre\nproof -\n  have 1: \"wf2 (sort_by_outputs bl)\"\n    using pre(1) sort_by_outputs_perm1 wf2_lemma2 by (meson perm_sym)\n  have 2: \"wf2 (sort_by_outputs cl)\"\n    using pre(2) sort_by_outputs_perm1 wf2_lemma2 by (meson perm_sym)\n  then show ?thesis unfolding updateIntegBlks.simps using sort_by_outputs_Outputs\ncombinationEq[of \"sort_by_outputs bl\" \"sort_by_outputs cl\" ] CombineSubset by (smt (verit, best) \n    \"1\" perm_sym pre(3) pre(4) pre(5) prem_seteq sort_by_outputs_perm1 subset_eq)\nqed\n  done\n\n\\<comment> \\<open>Combination doesn't add or delete the outputs\\<close>\nlemma updateIntegBlksSubset2 : \"wf2 bl \\<Longrightarrow> wf2 cl \\<Longrightarrow>\n\\<forall>b \\<in> set bl. (set (get_offsets b) = {1}) \\<longrightarrow> set (get_outputs b) \\<subseteq> Outputs cl \\<Longrightarrow>\n\\<forall>c \\<in> set cl. (set (get_offsets c) = {1}) \\<Longrightarrow> set cl \\<subseteq> set bl \\<Longrightarrow>\nset (get_outputs (updateIntegBlks bl cl)) = Outputs cl\"\n  subgoal premises pre\nproof -\n  have 1: \"wf2 (sort_by_outputs bl)\"\n    using pre(1) sort_by_outputs_perm1 wf2_lemma2 by (meson perm_sym)\n  have 2: \"wf2 (sort_by_outputs cl)\"\n    using pre(2) sort_by_outputs_perm1 wf2_lemma2 by (meson perm_sym)\n  have 3: \"\\<forall>b\\<in>set (sort_by_outputs bl).\n       set (get_offsets b) = {1} \\<longrightarrow> set (get_outputs b) \\<subseteq> Outputs (sort_by_outputs cl)\"\n    using pre(3) by (metis prem_seteq sort_by_outputs_Outputs sort_by_outputs_perm1)\n  have 4: \"\\<forall>c\\<in>set (sort_by_outputs cl). set (get_offsets c) = {1}\"\n    using pre(4) by (meson prem_seteq sort_by_outputs_perm1)\n  have 5: \"set (sort_by_outputs cl) \\<subseteq> set (sort_by_outputs bl)\"\n    using pre(5) by (meson in_mono perm_sym prem_seteq sort_by_outputs_perm1 subsetI)\n  have 6: \"\\<forall>b\\<in>set (combination (sort_by_outputs bl) (sort_by_outputs cl)). \n    set (get_offsets b) = {1}\"\n    using combinationOffsetsEq 4 by blast\n  have 7: \"\\<forall>b\\<in>set (combination (sort_by_outputs bl) (sort_by_outputs cl)).\n       set (get_offsets b) = {1} \\<and>\n       length (get_offsets b) = length (get_outputs b) \\<and>\n       length (get_offsets b) = length (get_outupd b)\"\n    using 6 pre(1) combinationEq2 1 2 5 by presburger\n  then show ?thesis unfolding updateIntegBlks.simps using sort_by_outputs_Outputs\ncombinationEq[of \"sort_by_outputs bl\" \"sort_by_outputs cl\" ] CombineEq 1 2 3 4 5 6 7 by presburger\nqed\n  done\n\nlemma updateIntegBlksPerm : \"wf2 bl1 \\<Longrightarrow> wf2 cl1 \\<Longrightarrow> bl1 <~~> bl2 \\<Longrightarrow> cl1 <~~> cl2 \\<Longrightarrow>\nupdateIntegBlks bl1 cl1 = updateIntegBlks bl2 cl2\"\n  unfolding updateIntegBlks.simps using sort_by_outputs_perm2 by presburger\n\n\ntext \\<open>Before calculation, we get the min time step based on the discrete \nblocks(greatest common divisor)\\<close>\nfun commonDivisor:: \"int \\<Rightarrow> DisBlk list \\<Rightarrow> int\" where\n  \"commonDivisor x [] = x\" |\n  \"commonDivisor x (a#al) = commonDivisor (gcd x (get_sample_time a)) al\"\nfun getTimeStep:: \"DisBlk list \\<Rightarrow> int\" where\n  \"getTimeStep [] = 1\" | \n  \"getTimeStep (a#al) = commonDivisor (get_sample_time a) al\"\n\nvalue \"getTimeStep [Block ''za'' ''a'' [1] 12 [(\\<lambda>s.(if length s = 2 then (s ! 0) + (s ! 1) else 0))]\n, Block ''za'' ''a'' [1] 18 [(\\<lambda>s.(if length s = 2 then (s ! 0) + (s ! 1) else 0))],\nBlock ''za'' ''a'' [1] 30 [(\\<lambda>s.(if length s = 2 then (s ! 0) + (s ! 1) else 0))]]\"\n\ntext \\<open>State\\<close>\ntype_synonym state = \"var \\<Rightarrow> real\"\n\ntext \\<open>Expressions\\<close>\ntype_synonym exp = \"state \\<Rightarrow> real\"\n\ndefinition zeroExp :: \"exp\" where \"zeroExp = (\\<lambda>s.0)\"\n\ntext \\<open>States as a vector\\<close>\ntype_synonym vec = \"real^(var)\"\n\ntext \\<open>Conversion between state and vector\\<close>\ndefinition state2vec :: \"state \\<Rightarrow> vec\" where\n  \"state2vec s = (\\<chi> x. s x)\"\n\ndefinition vec2state :: \"vec \\<Rightarrow> state\" where\n  \"(vec2state v) x = v $ x\"\n\nlemma transform_eq1: \"s1 = s2 \\<Longrightarrow> state2vec s1 = state2vec s2\"\n  by simp\n\nlemma transform_eq2: \"v1 = v2 \\<Longrightarrow> vec2state v1 = vec2state v2\"\n  by simp\n\nsubsection \\<open>Definition of ODEs\\<close>\n\ntype_synonym ODE = \"var \\<Rightarrow> exp\"\n\n(*time; values; derivatives*)\ntype_synonym ODE' = \"real \\<Rightarrow> vec \\<Rightarrow> vec\"\n\nlemma vec_state_map1[simp]: \"vec2state (state2vec s) = s\"\n  unfolding vec2state_def state2vec_def by auto\n\nlemma vec_state_map2[simp]: \"state2vec (vec2state s) = s\"\n  unfolding vec2state_def state2vec_def by auto\n\nlemma vec_eq: \"\\<forall>x. (v1::vec) $ x = v2 $ x \\<Longrightarrow> v1 = v2\"\n  subgoal premises pre\nproof -\n  have 1: \"\\<forall>x. (vec2state v1) x = (vec2state v2) x\"\n    unfolding vec2state_def using pre by simp\n  have 2: \"(vec2state v1) = (vec2state v2)\"\n    using 1 by blast\n  show ?thesis using 2 transform_eq1 vec_state_map2 by metis\nqed\n  done\n\ntext \\<open>transformation between timed_vars and state\\<close>\ndefinition timedVar2timedState :: \"timed_vars \\<Rightarrow> (real \\<Rightarrow> state)\" where\n  \"timedVar2timedState h = (\\<lambda>t. (\\<lambda>v. (h v t)))\"\n                                                                  \ndefinition timedVar2State :: \"timed_vars \\<Rightarrow> real \\<Rightarrow> state\" where\n  \"timedVar2State h t = (\\<lambda>v. h v t)\"\n\ndefinition timedState2timedVar :: \"(real \\<Rightarrow> state) \\<Rightarrow> timed_vars\" where\n  \"timedState2timedVar p = (\\<lambda>v. (\\<lambda>t. p t v))\"\n\nlemma timedVar_state_map1[simp]: \"timedState2timedVar (timedVar2timedState h) = h\"\n  unfolding timedVar2timedState_def timedState2timedVar_def by simp\n\nlemma timedVar_state_map2[simp]: \"timedVar2timedState (timedState2timedVar p) = p\"\n  unfolding timedVar2timedState_def timedState2timedVar_def by simp\n\n\nfun exp2ODE :: \"var list \\<Rightarrow> exp list \\<Rightarrow> ODE\" where\n  \"exp2ODE [] Exps s = zeroExp\" |\n  \"exp2ODE xs [] s = zeroExp\" |\n  \"exp2ODE (x#xs) (Exp#Exps) s =(if x = s then Exp else (exp2ODE xs Exps s))\"\n\ntext \\<open>transformation between outupd and expression\\<close>\ndefinition outupd2exp :: \"outupd \\<Rightarrow> var list \\<Rightarrow> exp\" where\n  \"outupd2exp f il = (\\<lambda>s. (f (map (\\<lambda> a. s a) il)) )\"\n\nlemma ToExpEq : \"\\<forall>s. (f1 (map (\\<lambda> a. s a) il1)) = (f2 (map (\\<lambda> a. s a) il2))\n\\<Longrightarrow> outupd2exp f1 il1 = outupd2exp f2 il2\"\n  unfolding outupd2exp_def by simp\n\nvalue \"integer_of_char CHR ''a'' < integer_of_char CHR ''b''\"\n\ndefinition exp2outupd :: \"exp \\<Rightarrow> var list \\<Rightarrow> outupd\" where\n  \"exp2outupd Exp il = undefined\"\n\n(*outupd list to expression list*)\nfun getExps :: \"outupd list \\<Rightarrow> var list \\<Rightarrow> exp list\" where\n  \"getExps [] il = []\" |\n  \"getExps (f#fl) il = outupd2exp f il # (getExps fl il)\"\n\nlemma getExpsPerm : \"\\<forall>i. i \\<ge> 0 \\<and> i < length fl1 \\<longrightarrow> (\\<forall>s. ((fl1 ! i) (map (\\<lambda> a. s a) il1)) = \n((fl2 ! i) (map (\\<lambda> a. s a) il2))) \\<Longrightarrow> length fl1 = length fl2\n\\<Longrightarrow> getExps fl1 il1 = getExps fl2 il2\"\nproof(induction fl1 arbitrary:fl2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons f1 fl1)\n  have 1: \"fl2 = hd fl2 # tl fl2\"\n    using Cons(3) by (metis length_0_conv list.exhaust_sel neq_Nil_conv)\n  have 2: \"outupd2exp f1 il1 = outupd2exp (hd fl2) il2\"\n    using Cons(2) by (metis \"1\" ToExpEq length_Cons nth_Cons_0 of_nat_0 of_nat_0_le_iff zero_less_Suc)\n  have 3: \"getExps fl1 il1 = getExps (tl fl2) il2\"\n    using Cons 1 by (metis (no_types, lifting) Suc_mono length_Cons length_tl linorder_le_cases \n        list.sel(3) not_less_eq_eq nth_tl)\n  then show ?case using 1 2 3 getExps.simps(2)[of \"hd fl2\" \"tl fl2\" il2] unfolding getExps.simps \n    using \\<open>getExps (hd fl2 # tl fl2) il2 = outupd2exp (hd fl2) il2 # getExps (tl fl2) il2\\<close> by presburger\nqed\n\n\nfun ODE2vec :: \"ODE \\<Rightarrow> var list \\<Rightarrow> (vec \\<Rightarrow> vec)\" where\n  \"ODE2vec ode vl v1 = state2vec (\\<lambda>x.(ode x (vec2state v1)))\"\n\nfun realvec2realstate :: \"(real \\<Rightarrow> vec) \\<Rightarrow> (real \\<Rightarrow> state)\" where\n  \"realvec2realstate p t = vec2state (p t)\"\n\nfun realstate2realvec :: \"(real \\<Rightarrow> state) \\<Rightarrow> (real \\<Rightarrow> vec)\" where\n  \"realstate2realvec p t = state2vec (p t)\"\n\nlemma timedVar_state_map3[simp]: \"timedState2timedVar (realvec2realstate\n(realstate2realvec (timedVar2timedState h))) = h\"\n  unfolding timedVar2timedState_def timedState2timedVar_def by simp\n\nlemma timedVar_state_map4[simp]: \"(realstate2realvec (timedVar2timedState\n          (timedState2timedVar (realvec2realstate p)))) = p\"\n  unfolding timedVar2timedState_def timedState2timedVar_def realstate2realvec.simps by simp\n\nlemma trans_eq3: \"\\<forall>x t. (h1::timed_vars) x t = h2 x t \\<longrightarrow> \n(realstate2realvec (timedVar2timedState h1)) t $ x =\n  (realstate2realvec (timedVar2timedState h2)) t $ x\"\n  unfolding realstate2realvec.simps timedVar2timedState_def\n  using state2vec_def by force\n\nlemma trans_eq4: \"\\<forall>x t. (h1::timed_vars) x t = v2 t $ x \\<longrightarrow> \n(realstate2realvec (timedVar2timedState h1)) t $ x = v2 t $ x\"\n  unfolding realstate2realvec.simps timedVar2timedState_def\n  using state2vec_def by force\n\nlemma trans_eq5: \"(realstate2realvec (timedVar2timedState h)) t = \n  state2vec (\\<lambda>v. h v t)\"\n  unfolding realstate2realvec.simps timedVar2timedState_def\n  using timedVar2State_def by force\n\n(*update h for the outputs and time interval (t0, t0+t]*)\nfun updTimedVar :: \"(real \\<Rightarrow> vec) \\<Rightarrow> var list \\<Rightarrow> timed_vars \\<Rightarrow> real \\<Rightarrow> real \\<Rightarrow> timed_vars\" where\n  \"updTimedVar p vl h t0 t v tt =(if v \\<in> set vl \\<and> (tt > t0 \\<and> tt \\<le> t0+t) \n    then (p tt $ v) else h v tt)\"\n\nlemma updTimedVar_eq1 : \"\\<forall> v tt. v  \\<notin> set vl \\<or> (tt \\<le> t0 \\<or> tt > t0 + t) \\<longrightarrow> \n      updTimedVar p vl h t0 t v tt = h v tt\"\n  unfolding updTimedVar.simps by simp\n\nlemma updTimedVar_eq2 : \"\\<forall> v tt. v  \\<in> set vl \\<and> (tt > t0 \\<and> tt \\<le> t0 + t) \\<longrightarrow> \n      updTimedVar p vl h t0 t v tt = (p tt $ v)\"\n  unfolding updTimedVar.simps by simp\n\nlemma updTimedVar_eq3: \"updTimedVar p vl h t0 t = (\\<lambda>vv tt. (if vv \\<in> set vl \\<and> (tt > t0 \\<and> tt \\<le> t0 + t)\n  then (p tt $ vv) else h vv tt))\"\n  using updTimedVar_eq1 updTimedVar_eq2 by fastforce\n\n\n\ntext \\<open>give a block including ODE, return a function(real => ODE => ODE)\n) required by the definition of \"fixed_point\"\\<close>\nfun block2ODE :: \"block \\<Rightarrow> ODE'\" where\n  \"block2ODE (Block il vl ol st fl) t v1 = ODE2vec (exp2ODE vl (getExps fl il)) vl v1\"\n\nend", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/Semantics_Simulink/ContinuousSyntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.3374117916812903}}
{"text": "header {*\\isaheader{Verified BFS Implementation in ML}*}\ntheory Bfs_Impl\nimports \n  \"../../../Refine_Monadic/examples/Breadth_First_Search\"\n  \"../../Refine_Dflt_Only_ICF\"\nbegin\n  text {*\n    Originally, this was part of our submission to the \n    VSTTE 2010 Verification Competition. Some slight changes have been applied\n    since the submitted version.\n    *}\n\n\n  text {*\n    In the @{text \"Breadth_First_Search\"}-theory, we verified an abstract \n    version of the algorithm. This abstract version tried to reflect the\n    given pseudocode specification as precisely as possible.\n\n    However, it was not executable, as it was nondeterministic. Hence,\n    we now refine our algorithm to an executable specification, and use\n    Isabelle/HOLs code generator to generate ML-code.\n\n    The implementation uses the Isabelle Collection Framework (ICF)\n    (Available at @{url \"http://afp.sourceforge.net/entries/Collections.shtml\"}),\n    to provide efficient set implementations. We choose a hashset \n    (backed by a Red Black Tree) for the visited set, and lists for\n    all other sets. Moreover, we fix the node type to natural numbers.\n    *}\n\n  text {*\n    The following algorithm is a straightforward rewriting of the \n    original algorithm. We only exchanged the abstract set operations by\n    concrete operations on the data structures provided by the ICF.\n\n    The operations of the list-set implementation are named\n    @{text \"ls_xxx\"}, the ones of the hashset are named @{text \"hs_xxx\"}.\n    *}\n\n  definition bfs_impl :: \"(nat \\<Rightarrow> nat ls) \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> (nat option nres)\"\n    where \"bfs_impl succ src dst \\<equiv> do {\n    (f,_,_,_,d) \\<leftarrow> WHILE\n      (\\<lambda>(f,V,C,N,d). f=False \\<and> \\<not> ls.isEmpty C)\n      (\\<lambda>(f,V,C,N,d). do {\n        v \\<leftarrow> RETURN (the (ls.sel C (\\<lambda>_. True))); let C = ls.delete v C;\n        if v=dst then RETURN (True,hs.empty (),ls.empty (),ls.empty (),d)\n        else do {\n          (V,N) \\<leftarrow> FOREACH (ls.\\<alpha> (succ v)) (\\<lambda>w (V,N). \n            if (\\<not> hs.memb w V) then \n               RETURN (hs.ins w V, ls.ins_dj w N) \n            else RETURN (V,N)\n          ) (V,N);\n          if (ls.isEmpty C) then do {\n            let C=N; \n            let N=ls.empty (); \n            let d=d+1;\n            RETURN (f,V,C,N,d)\n          } else RETURN (f,V,C,N,d)\n        }\n      })\n      (False,hs.sng src,ls.sng src, ls.empty (),0::nat);\n    if f then RETURN (Some d) else RETURN None\n    }\"\n\n  text {* Auxilliary lemma to initialize the refinement prover. *}\n  (*lemma [refine]: \"(ls.\\<alpha> \\<circ> succ) v = ls.\\<alpha> (succ v)\"\n    by auto*)\n\n  (* TODO/FIXME:\n    There is too much redundancy in the xx_correct - lemmas.\n    They do not include the automtically instantiated generic algorithms,\n    and they are independent of adding new operations to the interface or to\n    the rb-interface\n    *)\n\n  text {*\n    It is quite easy to show that the implementation respects the \n    specification, as most work is done by the refinement framework. *}\n  theorem bfs_impl_correct:\n    shows \"bfs_impl succ src dst \\<le> Graph.bfs_spec (ls.\\<alpha>\\<circ>succ) src dst\"\n  proof -\n    txt {* As list-sets are always finite, our setting satisfies the\n      finitely-branching assumption made about graphs *}\n    interpret Graph \"ls.\\<alpha>\\<circ>succ\"\n      by unfold_locales simp\n\n    txt {* The refinement framework can prove automatically that\n      the implementation refines the abstract algorithm.\n\n      The notation @{text \"S \\<le> \\<Down>R S'\"} means, that the program @{text \"S\"}\n      refines the program @{text \"S'\"} w.r.t.\\ the refinement relation \n      (also called coupling invariant occasionally) @{text \"R\"}.\n\n      In our case, the refinement relation is the identity, as\n      the result type was not refined.\n      *}\n\n    have \"bfs_impl succ src dst \\<le> \\<Down>Id (Graph.bfs (ls.\\<alpha>\\<circ>succ) src dst)\"\n      unfolding bfs_impl_def bfs_def\n\n      apply (refine_rcg)\n      apply (refine_dref_type)\n\n      apply (simp_all add: refine_hsimp refine_rel_defs\n        hs.correct hs.sng_correct ls.correct ls.sng_correct\n        split: prod.split prod.split_asm)\n      apply (rule inj_on_id)\n      apply (simp_all add: refine_hsimp refine_rel_defs\n        hs.correct hs.sng_correct ls.correct ls.sng_correct\n        split: prod.split prod.split_asm)\n      done\n    txt {* The result then follows due to transitivity of refinement. *}\n    also have \"\\<dots> \\<le> bfs_spec src dst\"\n      by (simp add: bfs_correct)\n    finally show ?thesis .\n  qed\n\n  text {* The last step is to actually generate executable ML-code.\n    *}\n\n  text {*\n    We first use the partial-correctness code generator of our framework\n    to automatically turn the algorithm described in our framework into\n    a function that is independent from our framework. This step also\n    removes the last nondeterminism, that has remained in the iteration order\n    of the inner loop.\n\n    The result of the function is an option type, returning @{text \"None\"}\n    for nontermination. Inside this option-type, there is the option type\n    that encodes whether we return with failure or a distance.\n    *}\n  schematic_lemma bfs_code_refine_aux: \n    \"nres_of ?bfs_code \\<le> bfs_impl succ src dst\"\n    unfolding bfs_impl_def\n    apply (refine_transfer)\n    done\n\n  concrete_definition bfs_code for succ src dst uses bfs_code_refine_aux\n\n  text {*\n    As a last step, we make the correctness property independent of our \n    refinement framework. This step drastically decreases the trusted code \n    base, as it completely eliminates the specifications made in the\n    refinement framework from the trusted code base.\n\n    The following theorem solves both verification tasks, without depending\n    on any concepts of the refinement framework, except the deterministic result\n    monad.\n    *}\n  theorem bfs_code_correct:\n    \"bfs_code succ src dst = dRETURN None \n      \\<Longrightarrow> \\<not>(Graph.conn (ls.\\<alpha> \\<circ> succ) src dst)\" \n    \"bfs_code succ src dst = dRETURN (Some d) \n      \\<Longrightarrow> Graph.conn (ls.\\<alpha> \\<circ> succ) src dst \n          \\<and> Graph.min_dist (ls.\\<alpha> \\<circ> succ) src dst = d\"\n    \"bfs_code succ src dst \\<noteq> dFAIL\"\n  proof -\n    interpret Graph \"ls.\\<alpha>\\<circ>succ\"\n      by unfold_locales simp\n    \n    from order_trans[OF bfs_code.refine bfs_impl_correct, of succ src dst]\n    show \"bfs_code succ src dst = dRETURN None \n      \\<Longrightarrow> \\<not>(Graph.conn (ls.\\<alpha> \\<circ> succ) src dst)\" \n      \"bfs_code succ src dst = dRETURN (Some d) \n      \\<Longrightarrow> Graph.conn (ls.\\<alpha> \\<circ> succ) src dst \n          \\<and> Graph.min_dist (ls.\\<alpha> \\<circ> succ) src dst = d\"\n      \"bfs_code succ src dst \\<noteq> dFAIL\"\n      apply (unfold bfs_spec_def)\n      apply (auto split: option.split_asm)\n      done\n  qed\n      \n  text {* Now we can use the code-generator of Isabelle/HOL to generate\n    code into various target languages: *}\n  export_code bfs_code in SML\n  export_code bfs_code in OCaml\n  export_code bfs_code in Haskell\n  export_code bfs_code in Scala\n\n  text {* The generated code is most conveniently executed within \n    Isabelle/HOL itself. We use a small test graph here: *}\n\n  definition nat_list:: \"nat list \\<Rightarrow> _\" where \"nat_list \\<equiv> dlist_of_list\"\n  ML_val {*\n    fun il l = @{code nat_list} (map @{code nat_of_integer} l)\n    fun bfs succ s d = \n      @{code bfs_code} (succ o @{code integer_of_nat})\n        (@{code nat_of_integer} s) (@{code nat_of_integer} d)\n\n    (* Define a test graph. *)\n    fun succ 1 = il [2,3]\n        | succ 2 = il [4]\n        | succ 4 = il [5]\n        | succ 5 = il [2]\n        | succ 3 = il [6]\n        | succ _ = il [];\n\n    (* Execute algorithm for some node pairs. *)\n    bfs succ 1 1;\n    bfs succ 1 2;\n    bfs succ 1 5;\n    bfs succ 1 7;\n    *}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/examples/Refine_Monadic/Bfs_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.3374117916812903}}
{"text": "theory PF_Ternary_Translation\n  imports \"../PF_Ruleset_Transformations\"\n          \"../PF_Primitive_Matchers\"\n          PF_Semantics_Ternary\n          PF_Unknown_Match_Tacs\n          PF_Predicates\nbegin\n\nlemma filter_approx'_to_pf_approx:\n  assumes \"\\<forall> d. (filter_approx' l1 \\<gamma> p d = filter_approx' l2 \\<gamma> p d)\"\n  shows \"pf_approx l1 \\<gamma> p = pf_approx l2 \\<gamma> p\" unfolding pf_approx_def using assms by simp\n\n\nlemma and_each_false[simp]:\n  assumes \"(ternary_ternary_eval (map_match_tac (fst \\<gamma>) p m)) = TernaryFalse\"\n  shows \"filter_approx' (and_each m l) \\<gamma> p d = d\"\n  using assms\n  by (induction l)\n     (auto split:line.splits decision_wrap.splits\n           simp:filter_approx'_cases and_line_cases matches_def eval_ternary_simps_simple(3))\n\nlemma and_each_true[simp]:\n  assumes \"(ternary_ternary_eval (map_match_tac (fst \\<gamma>) p m)) = TernaryTrue\"\n  shows \"filter_approx' (and_each m l) \\<gamma> p d = filter_approx' l \\<gamma> p d\"\n  using assms\nproof(induction l arbitrary: d)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a l)\n  then show ?case\n    by (cases d;cases a) \n       (auto simp:matches_def eval_ternary_simps_simple(1))\nqed\n\n\n(* remove anchors *)\n\n(* remove_anchors implementation and remove_anchors_ok in Pf_To_SimpleFirewall *)\n\nlemma remove_anchors_preserves_semantics :\n  assumes \"no_match_quick rs\"\n      and \"no_unknown_anchors \\<gamma> rs\"\n    shows \"pf_approx (remove_anchors rs) \\<gamma> p =\n           pf_approx rs \\<gamma> p\"\nproof(-)\n  have \"filter_approx' rs \\<gamma> p d =\n        filter_approx' (remove_anchors rs) \\<gamma> p d\" for d \n    using assms\n  proof(induction rs arbitrary:d rule:remove_anchors.induct)\n    case 1\n    then show ?case by simp\n  next\n    case (2 r l rs)\n    then show ?case\n    proof(cases \"(ternary_ternary_eval (map_match_tac (fst \\<gamma>) p (anchor_rule.get_match r)))\")\n      case TernaryTrue\n      then show ?thesis using 2 apply (auto simp add: filter_approx'_chain)\n        by (cases d;auto simp add:matches_def no_match_quick_def no_unknown_anchors_def)\n    next\n      case TernaryFalse\n      then show ?thesis using 2 apply (auto simp add: filter_approx'_chain)\n        by (cases d;auto simp add:matches_def no_match_quick_def no_unknown_anchors_def)\n    next\n      case TernaryUnknown\n      then show ?thesis using 2(4) by (auto simp:no_unknown_anchors_def)\n    qed\n  next\n    case (3 v rs)\n    then show ?case apply (simp add:no_match_quick_def no_unknown_anchors_def)\n      by (metis (no_types, hide_lams) append_Cons append_Nil filter_approx'_chain)\n  qed\n  then show ?thesis by (simp add: filter_approx'_to_pf_approx)\nqed\n\n(* lemma and_each_preserves_action_and_quick[simp,intro]:\n  assumes \"all_PfRules_P (\\<lambda>r. P (pf_rule.get_action r) (pf_rule.get_quick r)) ls\"\n  shows \"all_PfRules_P (\\<lambda>r. P (pf_rule.get_action r) (pf_rule.get_quick r)) (and_each m ls)\"\n  using assms proof(induction ls)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons l ls)\n  then show ?case by(cases l;auto)\nqed *)\n\nlemma and_each_preserves_no_match_quick[simp,intro]:\n  assumes \"no_match_quick l\"\n  shows \"no_match_quick (and_each m l)\"\n  using assms\nproof(induction l)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a l)\n  then show ?case by (cases a) (auto simp:no_match_quick_def)\nqed\n\nlemma no_match_quick_append[simp]:\n  \"no_match_quick (l1@l2) \\<longleftrightarrow> no_match_quick l1 \\<and> no_match_quick l2\"\n  by (auto simp:no_match_quick_def)\n\nlemma remove_anchors_preserves_no_match_quick:\n  assumes \"no_match_quick l\"\n  shows \"no_match_quick (remove_anchors l)\"\n  using assms\nproof(induction l rule:remove_anchors.induct)\n  case 1\n  then show ?case by simp\nnext\n  case (2 r l rs)\n  have \"no_match_quick (remove_anchors l)\" using 2(1) 2(3) by (simp add:no_match_quick_def)\n  then have *:\"no_match_quick (and_each (anchor_rule.get_match r) (remove_anchors l))\" by simp\n  have \"no_match_quick (remove_anchors rs)\" using 2(2) 2(3) by (simp add:no_match_quick_def)\n  then show ?case using * by simp\nnext\n  case (3 v rs)\n  then show ?case by (simp add:no_match_quick_def)\nqed\n\nlemma and_each_preserves_good_match_expr:\n  assumes \"good_match_expr ctx m\"\n      and \"wf_ruleset ctx rs\"\n    shows \"wf_ruleset ctx (and_each m rs)\"\n  using assms\nproof(induction m rs rule:and_each.induct)\n  case (1 uu)\n  then show ?case by simp\nnext\n  case (2 m l ls)\n  have \"wf_ruleset ctx [l]\" using 2(3) unfolding wf_ruleset_def by simp\n  then have \"wf_ruleset ctx [and_line m l]\" apply(cases l) using 2(2) unfolding wf_ruleset_def by (simp add:good_match_expr_def)+\n  moreover have \"wf_ruleset ctx ls\" using 2(3) unfolding wf_ruleset_def by simp\n  ultimately show ?case using 2 unfolding wf_ruleset_def by simp\nqed\n\n\nlemma remove_anchors_preserves_wf_ruleset:\n  assumes \"wf_ruleset ctx rs\"\n  shows \"wf_ruleset ctx (remove_anchors rs)\"\n  using assms\nproof(induction rs rule:remove_anchors.induct)\ncase 1\nthen show ?case by simp\nnext\n  case (2 r l rs)\n  have \"good_match_expr ctx (anchor_rule.get_match r)\" using 2(3) unfolding wf_ruleset_def by simp\n  moreover have \"wf_ruleset ctx l\" using 2(3) unfolding wf_ruleset_def by simp\n  moreover have \"wf_ruleset ctx rs\" using 2(3) unfolding wf_ruleset_def by simp\n  ultimately show ?case using 2 by (simp add:and_each_preserves_good_match_expr)\nnext\n  case (3 v rs)\n  have \"good_match_expr ctx (pf_rule.get_match v)\" using 3(2) unfolding wf_ruleset_def by simp\n  moreover have \"wf_ruleset ctx rs\" using 3(2) unfolding wf_ruleset_def by simp\n  ultimately show ?case unfolding wf_ruleset_def\n    using \"3.IH\" wf_ruleset_def by auto\nqed\n\n\n  \n(* helpers for remove quick *)\n\nlemma remove_suffix[simp]:\n  assumes \"\\<not>matches \\<gamma> (pf_rule.get_match r) (pf_rule.get_action r) (unwrap_decision (filter_approx' l \\<gamma> p d)) p\"\n  shows \"filter_approx' (l@[(PfRule r)]) \\<gamma> p d = filter_approx' l \\<gamma> p d\"\n  using assms by (cases \"filter_approx' l \\<gamma> p d\") (simp add: filter_approx'_chain)+\n\nlemma no_quick_preliminary:\n  assumes \"no_quick rules\"\n      and \"no_anchors rules\" (* not necessary but makes things easier *)\n    shows \"is_Preliminary (filter_approx' rules \\<gamma> p (Preliminary d))\"\n  using assms by (induction rules arbitrary: d) (auto split:line.splits simp:filter_approx'_cases)\n\n(* remove quick *)\n\nfun remove_quick_approx :: \"'a ruleset \\<Rightarrow> 'a ruleset\" where\n\"remove_quick_approx [] = []\" |\n\"remove_quick_approx ((PfRule r)#ls) =\n(if (get_quick r)\n  then (remove_quick_approx ls) @ [PfRule (r\\<lparr>get_quick := False\\<rparr>)]\n  else (PfRule r)#(remove_quick_approx ls))\"\n\nlemma remove_quick_approx_ok:\n  assumes \"no_anchors rs\"\n  shows \"no_quick (remove_quick_approx rs)\"\n    using assms by (induction rs rule:remove_quick_approx.induct) auto\n\nlemma remove_quick_approx_preserves_no_anchors:\n  assumes \"no_anchors rs\"\n  shows \"no_anchors (remove_quick_approx rs)\"\n  using assms by (induction rs rule:remove_quick_approx.induct) simp+\n\nlemma remove_quick_approx_preserves_no_match:\n  assumes \"no_anchors rs\"\n      and \"no_match rs\"\n    shows \"no_match (remove_quick_approx rs)\"\n  using assms\n  by (induction rs rule:remove_quick_approx.induct) simp+\n\nlemma remove_quick_approx_preserves_semantics:\n  assumes \"no_anchors rs\"\n      and \"no_match rs\"\n      and \"good_matcher \\<gamma>\"\n    shows \"pf_approx rs \\<gamma> p = pf_approx (remove_quick_approx rs) \\<gamma> p\"\nproof(-)\n  from assms have \"(unwrap_decision (filter_approx' rs \\<gamma> p d) =\n                    unwrap_decision (filter_approx' (remove_quick_approx rs) \\<gamma> p d))\" for d\n  proof(induction rs arbitrary:d rule:remove_quick_approx.induct)\n  case 1\n  then show ?case by simp\n  next\n    case (2 r ls)\n    then show ?case\n    proof(cases d)\n      case (Final x1)\n      then show ?thesis by auto\n    next\n      case (Preliminary x2)\n      have \"no_anchors (remove_quick_approx ls)\"\n        using 2 by (simp add:remove_quick_approx_preserves_no_anchors)\n      moreover have \"no_quick (remove_quick_approx ls)\"\n        using 2 by (simp add:remove_quick_approx_ok)\n      ultimately have prem:\"is_Preliminary(filter_approx' (remove_quick_approx ls) \\<gamma> p (Preliminary x2))\"\n        using no_quick_preliminary by metis\n      show ?thesis\n      proof(cases \"get_quick r\")\n        case quick:True\n        then show ?thesis\n        proof(cases \"(ternary_ternary_eval (map_match_tac (fst \\<gamma>) p (pf_rule.get_match r)))\")\n          case TernaryTrue\n          then have \"(filter_approx' (PfRule r # ls) \\<gamma> p (Preliminary x2)) =\n                      Final (action_to_decision (pf_rule.get_action r) x2)\"\n            (is \"?dw = Final ?d\")\n            using quick TernaryTrue by (simp add:matches_def)\n          then have res1: \"unwrap_decision ?dw = ?d\" by simp\n          have \"filter_approx' (remove_quick_approx (PfRule r # ls)) \\<gamma> p (Preliminary x2) = \n                filter_approx' [PfRule (r\\<lparr>get_quick := False\\<rparr>)] \\<gamma> p (filter_approx' (remove_quick_approx ls) \\<gamma> p (Preliminary x2))\"\n            using quick by (simp add:filter_approx'_chain)\n          then have \"\\<exists> d. filter_approx' (remove_quick_approx (PfRule r # ls)) \\<gamma> p (Preliminary x2) = \n                          filter_approx' [PfRule (r\\<lparr>get_quick := False\\<rparr>)] \\<gamma> p (Preliminary d)\" using prem is_Preliminary_def by auto\n          then obtain d' where \"filter_approx' (remove_quick_approx (PfRule r # ls)) \\<gamma> p (Preliminary x2) = \n                               filter_approx' [PfRule (r\\<lparr>get_quick := False\\<rparr>)] \\<gamma> p (Preliminary d')\" by blast\n          then have \"filter_approx' (remove_quick_approx (PfRule r # ls)) \\<gamma> p (Preliminary x2) =\n                     Preliminary (action_to_decision (pf_rule.get_action r) d')\"\n            (is \"?dw = Preliminary ?d\")\n            using TernaryTrue by (simp add:matches_def)\n          then have res2:\"unwrap_decision ?dw = ?d\" by simp\n          show ?thesis using Preliminary quick TernaryTrue res1 res2 2(4)\n            by (auto split:action.splits simp:matches_def action_to_decision_cases)\n        next\n          case TernaryFalse\n          then have res1:\"filter_approx' (PfRule r # ls) \\<gamma> p (Preliminary x2) =\n                     filter_approx' ls \\<gamma> p (Preliminary x2)\" by (simp add:matches_def)\n          have res2:\"filter_approx' ((remove_quick_approx ls)@[PfRule (r\\<lparr>get_quick := False\\<rparr>)]) \\<gamma> p (Preliminary x2) =\n                     filter_approx' (remove_quick_approx ls) \\<gamma> p (Preliminary x2)\"\n            using TernaryFalse by (simp add:matches_def)\n          show ?thesis using Preliminary TernaryFalse res1 res2 2\n            by (auto split:action.splits simp:matches_def action_to_decision_cases)\n        next\n          case TernaryUnknown\n          then show ?thesis\n          proof(cases \"(snd \\<gamma>) (pf_rule.get_action r) x2 p\")\n            case True\n            then have \"(filter_approx' (PfRule r # ls) \\<gamma> p (Preliminary x2)) = Final (action_to_decision (pf_rule.get_action r) x2)\" (is \"?dw = Final ?d\")\n              using quick TernaryUnknown by (simp add:matches_def)\n            then have res1: \"unwrap_decision ?dw = ?d\" by simp\n            have \"filter_approx' (remove_quick_approx (PfRule r # ls)) \\<gamma> p (Preliminary x2) = \n                  filter_approx' [PfRule (r\\<lparr>get_quick := False\\<rparr>)] \\<gamma> p (filter_approx' (remove_quick_approx ls) \\<gamma> p (Preliminary x2))\"\n              using quick by (simp add:filter_approx'_chain)\n            then have \"\\<exists> d. filter_approx' (remove_quick_approx (PfRule r # ls)) \\<gamma> p (Preliminary x2) = \n                          filter_approx' [PfRule (r\\<lparr>get_quick := False\\<rparr>)] \\<gamma> p (Preliminary d)\" using prem is_Preliminary_def by auto\n            then obtain d' where \"filter_approx' (remove_quick_approx (PfRule r # ls)) \\<gamma> p (Preliminary x2) = \n                                  filter_approx' [PfRule (r\\<lparr>get_quick := False\\<rparr>)] \\<gamma> p (Preliminary d')\" by blast\n            moreover have \"(snd \\<gamma>) (pf_rule.get_action r) d' p\"\n              using True 2(4) 2(5) unfolding good_matcher_def apply(auto split:action.splits) by metis\n            ultimately have \"filter_approx' (remove_quick_approx (PfRule r # ls)) \\<gamma> p (Preliminary x2) =\n                       Preliminary (action_to_decision (pf_rule.get_action r) d')\" (is \"?dw = Preliminary ?d\")\n            using TernaryUnknown True 2 by (simp add:matches_def)\n          then have res2:\"unwrap_decision ?dw = ?d\" by simp\n          show ?thesis using Preliminary True TernaryUnknown res1 res2 2(4) by (auto split:action.splits simp:matches_def action_to_decision_cases)\n          next\n            case False\n            then have res1: \"unwrap_decision (filter_approx' (PfRule r # ls) \\<gamma> p (Preliminary x2)) =\n                             unwrap_decision (filter_approx' ls \\<gamma> p (Preliminary x2))\"\n              using TernaryUnknown by (simp add:matches_def)\n            obtain d' where *:\"filter_approx' (remove_quick_approx ls) \\<gamma> p (Preliminary x2) = \n                             (Preliminary d')\" using prem is_Preliminary_def by blast\n            then have \"filter_approx' ((remove_quick_approx ls)@[PfRule (r\\<lparr>get_quick := False\\<rparr>)]) \\<gamma> p (Preliminary x2) =\n                       filter_approx' [PfRule (r\\<lparr>get_quick := False\\<rparr>)] \\<gamma> p (Preliminary d')\"\n              by(simp add:filter_approx'_chain)\n            moreover have \"\\<not>(snd \\<gamma>) (pf_rule.get_action r) d' p\"\n              using False 2(4) 2(5) unfolding good_matcher_def apply(auto split:action.splits) by metis\n            ultimately have \"(filter_approx' (remove_quick_approx (PfRule r # ls)) \\<gamma> p (Preliminary x2)) = (Preliminary d')\" (is \"?dw = (Preliminary ?d)\")\n              using TernaryUnknown quick by (simp add:matches_def)\n            then have res2:\"unwrap_decision ?dw = ?d\" by auto\n            have a:\"unwrap_decision (filter_approx' (remove_quick_approx ls) \\<gamma> p (Preliminary x2)) = d'\" using * by simp\n            then have \"unwrap_decision (filter_approx' ls \\<gamma> p (Preliminary x2)) = d'\" using a 2 by auto\n            then have \"unwrap_decision (filter_approx' (PfRule r # ls) \\<gamma> p (Preliminary x2)) = d'\" using res1 TernaryUnknown False quick by simp\n            then show ?thesis using Preliminary res2 by simp\n          qed\n        qed\n      next\n        case False\n        then show ?thesis using 2 Preliminary by auto\n      qed\n    qed\n  next\n  case (3 vb vc va)\n    then show ?case by auto\n  qed\n  then show ?thesis by (simp add:pf_approx_def)\nqed\n\nlemma remove_quick_approx_preserves_wf_ruleset:\n  assumes \"wf_ruleset ctx rs\"\n      and \"no_anchors rs\"\n  shows \"wf_ruleset ctx (remove_quick_approx rs)\"\n  using assms\nproof(induction rs rule:remove_quick_approx.induct)\n  case 1\n  then show ?case by simp\nnext\n  case (2 r ls)\n  have r_gm:\"good_match_expr ctx (pf_rule.get_match r)\" using 2(3) unfolding wf_ruleset_def by simp\n  have ls_wf:\"wf_ruleset ctx ls\" using 2(3) unfolding wf_ruleset_def by simp\n  then show ?case\n  proof(cases \"get_quick r\")\n    case True\n    have \"wf_ruleset ctx [PfRule (r\\<lparr>get_quick := False\\<rparr>)]\" using r_gm  wf_ruleset_def \n      by (simp add:ls_wf r_gm good_match_expr_def)\n    then show ?thesis using 2 True by (simp add:ls_wf r_gm good_match_expr_def)\n  next\n    case False\n    then have \"wf_ruleset ctx (remove_quick_approx ls)\" using \"2.IH\" 2(4) ls_wf by simp\n    then show ?thesis unfolding wf_ruleset_def using r_gm by simp\n  qed\nnext\n  case (3 vb vc va)\n  then show ?case by simp\nqed\n\n\n(* remove matches *)\n\nfun remove_matches :: \"'a ruleset \\<Rightarrow> 'a ruleset\" where\n\"remove_matches [] = []\"\n|\"remove_matches ((PfRule r)#ls) =\n(if ((pf_rule.get_action r) = ActionMatch)\n  then remove_matches ls\n  else (PfRule r)#remove_matches ls)\"\n|\"remove_matches (l#ls) = l#(remove_matches ls)\"\n\nlemma remove_matches_preserves_filter_semantics:\n  assumes \"no_match_quick rs\"\n      and \"no_anchors rs\"\n    shows \"filter_approx' rs \\<gamma> p (Preliminary d) =\n           filter_approx' (remove_matches rs) \\<gamma> p (Preliminary d)\"\n  using assms\n  by (induction rs arbitrary:d rule: remove_matches.induct; (simp add:no_match_quick_def))\n\nlemma remove_matches_preserves_semantics:\n  assumes \"no_match_quick rs\"\n      and \"no_anchors rs\"\n    shows \"pf_approx rs \\<gamma> p = pf_approx (remove_matches rs) \\<gamma> p\"\n  using assms unfolding pf_approx_def by (simp add:remove_matches_preserves_filter_semantics)\n\nlemma remove_matches_ok:\n  assumes \"no_match_quick rs\"\n      and \"no_anchors rs\"\n    shows \"no_match (remove_matches rs)\"\n  using assms by (induction rs rule: remove_matches.induct) (simp add:no_match_quick_def)+\n\nlemma remove_matches_preserves_no_anchors:\n  assumes \"no_anchors rs\"\n    shows \"no_anchors (remove_matches rs)\"\n  using assms by (induction rs rule: remove_matches.induct) simp+\n\nlemma remove_matches_preserves_wf_ruleset:\n  assumes \"wf_ruleset ctx rs\"\n      and \"no_anchors rs\"\n  shows \"wf_ruleset ctx (remove_matches rs)\"\n  using assms \nproof (induction rs rule:remove_matches.induct)\n  case (2 r ls)\n  have \"good_match_expr ctx (pf_rule.get_match r)\" using 2 unfolding wf_ruleset_def by simp\n  moreover have \"wf_ruleset ctx ls\" using 2 unfolding wf_ruleset_def by simp\n  ultimately show ?case using 2 unfolding wf_ruleset_def by (cases \"pf_rule.get_action r = ActionMatch\") simp+\nqed simp+\n\n\n\n(* to_simple_ruleset *)\n\ndefinition to_simple_ruleset :: \"'a line list \\<Rightarrow> 'a line list\" where\n\"to_simple_ruleset rs = remove_quick_approx (remove_matches (remove_anchors rs))\"\n\nlemma to_simple_ruleset:\n  assumes \"no_match_quick rs\"\n      and \"good_matcher \\<gamma>\"\n      and \"no_unknown_anchors \\<gamma> rs\"\n  shows\n \"pf_approx rs \\<gamma> p =\n  pf_approx (to_simple_ruleset rs) \\<gamma> p\"\n  and \"simple_ruleset (to_simple_ruleset rs)\"\nproof(-)\n  have *: \"(pf_approx rs \\<gamma> p) =\n        (pf_approx (remove_anchors rs) \\<gamma> p)\"\n    (is \"?original = pf_approx (?anchors_removed) ?m ?p\")\n    using assms by (simp add:remove_anchors_preserves_semantics)\n  have na:\"no_anchors ?anchors_removed\"\n    by (simp add:remove_anchors_ok)\n  have nmq:\"no_match_quick ?anchors_removed\"\n    using assms remove_anchors_preserves_no_match_quick by blast\n  have *: \"?original = pf_approx (remove_matches ?anchors_removed) ?m ?p\"\n(is \"?original = pf_approx (?matches_removed) ?m ?p\")\n    using * na nmq assms by(auto simp add:remove_matches_preserves_semantics)\n  have nm:\"no_match ?matches_removed\"\n    using na nmq remove_matches_ok by blast\n  have na:\"no_anchors ?matches_removed\"\n    using na using remove_matches_preserves_no_anchors by blast\n  have *: \"?original = pf_approx (remove_quick_approx ?matches_removed) ?m ?p\"\n    (is \"?original = pf_approx (?quick_removed) ?m ?p\")\n    using * na nm assms by(simp add:remove_quick_approx_preserves_semantics)\n  then show \"pf_approx rs \\<gamma> p =\n  pf_approx (to_simple_ruleset rs) \\<gamma> p\" \n    unfolding to_simple_ruleset_def by simp\n  have nq:\"no_quick ?quick_removed\"\n    using na remove_quick_approx_ok by blast\n  have nm:\"no_match ?quick_removed\"\n    using na nm remove_quick_approx_preserves_no_match by blast\n  have na:\"no_anchors ?quick_removed\"\n    using na remove_quick_approx_preserves_no_anchors by blast\n  from nq nm na show \"simple_ruleset (to_simple_ruleset rs)\"\n    unfolding to_simple_ruleset_def by (simp add:simple_ruleset_def)\nqed\n\nlemma to_simple_ruleset_preserves_wf_ruleset:\n  assumes \"wf_ruleset ctx rs\"\n  shows \"wf_ruleset ctx (to_simple_ruleset rs)\"\n  unfolding to_simple_ruleset_def\n  using assms\nremove_anchors_ok remove_anchors_preserves_wf_ruleset\nremove_matches_preserves_no_anchors remove_matches_preserves_wf_ruleset\nremove_quick_approx_preserves_wf_ruleset\n  by metis\n\n\n(* simple ruleset reverse *)\n\n(* Accept is arbitrary here, \\<gamma> should be independent of d *)\nfun match_pf_rule :: \"'a line \\<Rightarrow> ('a,'p) match_tac \\<Rightarrow> 'p \\<Rightarrow> bool\" where\n\"match_pf_rule (PfRule r) \\<gamma> p = matches \\<gamma> (pf_rule.get_match r) (pf_rule.get_action r) decision.Accept p\"\n\nlemma rev_preserves_no_match[simp]:\n  assumes \"no_match rs\"\n  shows \"no_match (rev rs)\"\n  using assms by (induction rs) auto\n\nlemma rev_preserves_no_quick[simp]:\n  assumes \"no_quick rs\"\n  shows \"no_quick (rev rs)\"\n  using assms by (induction rs) auto\n\nlemma rev_preserves_no_anchors[simp]:\n  assumes \"no_anchors rs\"\n  shows \"no_anchors (rev rs)\"\n  using assms by (induction rs) auto\n\nlemma good_matcher_match:\n  assumes \"good_matcher \\<gamma>\"\n      and \"matches \\<gamma> m a d p\"\n      and \"a \\<noteq> ActionMatch\"\n    shows \"\\<And>d. matches \\<gamma> m a d p\"\n  using assms\n  apply(cases \"(ternary_ternary_eval (map_match_tac (fst \\<gamma>) p m))\")\n    apply (auto simp:matches_def good_matcher_def) by metis\n\nlemma good_matcher_match_not:\n  assumes \"good_matcher \\<gamma>\"\n      and \"\\<not>matches \\<gamma> m a d p\"\n      and \"a \\<noteq> ActionMatch\"\n    shows \"\\<And>d. \\<not>matches \\<gamma> m a d p\"\n  using assms\n  apply(cases \"(ternary_ternary_eval (map_match_tac (fst \\<gamma>) p m))\")\n  apply (auto simp:matches_def good_matcher_def) by metis\n\nlemma pf_reverse_semantics:\n  assumes \"simple_ruleset rs\"\n      and \"good_matcher \\<gamma>\"\n    shows \"pf_approx (rev rs) \\<gamma> p = (case (find (\\<lambda>r. match_pf_rule r \\<gamma> p) rs) of\n(Some (PfRule r)) \\<Rightarrow> (action_to_decision (pf_rule.get_action r) decision.Accept)\n| None \\<Rightarrow> decision.Accept)\"\n    using assms unfolding pf_approx_def simple_ruleset_def\nproof(induction rs)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a ls)\n  then show ?case\n  proof(cases a)\n    case (PfRule r)\n    then show ?thesis\n    proof(cases \"matches \\<gamma> (pf_rule.get_match r) (pf_rule.get_action r) decision.Accept p\")\n      have \"is_Preliminary (filter_approx' (rev ls) \\<gamma> p (Preliminary decision.Accept))\"\n        using Cons by (simp add:no_quick_preliminary[of \"(rev ls)\"])\n      then obtain d where *:\"(filter_approx' (rev ls) \\<gamma> p (Preliminary decision.Accept)) = (Preliminary d)\"\n        using is_Preliminary_def by blast\n      case True\n      then have \"matches \\<gamma> (pf_rule.get_match r) (pf_rule.get_action r) d p\"\n        using Cons PfRule by(auto simp:good_matcher_match)\n      then have \"(filter_approx' (rev ls @ [PfRule r]) \\<gamma> p (Preliminary decision.Accept)) =\n                        Preliminary (action_to_decision (pf_rule.get_action r) d)\"\n        using Cons PfRule * by (simp add:filter_approx'_chain)\n      then show ?thesis using Cons PfRule True by (cases \"pf_rule.get_action r\") auto\n    next\n      case False\n      then have \"\\<not>matches \\<gamma> (pf_rule.get_match r) (pf_rule.get_action r)\n                    (unwrap_decision (filter_approx' (rev ls) \\<gamma> p (Preliminary decision.Accept))) p\"\n        using Cons PfRule by(auto simp:good_matcher_match_not)\n      then have \"filter_approx' (rev ls @ [PfRule r]) \\<gamma> p (Preliminary decision.Accept) =\n                 filter_approx' (rev ls) \\<gamma> p (Preliminary decision.Accept)\" by simp\n      then show ?thesis using Cons PfRule False by auto\n    qed\n  next\n    case (Anchor x21 x22)\n    then show ?thesis using Cons by auto\n  qed\nqed\n\nlemma pf_reverse_semantics':\n  assumes \"simple_ruleset rs\"\n      and \"good_matcher \\<gamma>\"\n    shows \"pf_approx rs \\<gamma> p = (case (find (\\<lambda>r. match_pf_rule r \\<gamma> p) (rev rs)) of\n(Some (PfRule r)) \\<Rightarrow> (action_to_decision (pf_rule.get_action r) decision.Accept)\n| None \\<Rightarrow> decision.Accept)\"\nproof(-)\n  have \"simple_ruleset (rev rs)\" using assms by (induction rs) (auto simp add:simple_ruleset_def)\n  then show ?thesis using assms pf_reverse_semantics[where rs=\"(rev rs)\"] by simp\nqed\n\nend", "meta": {"author": "Sohalt", "repo": "pf-verification", "sha": "328f850913723dee6c9f6be069fbbc22a3762354", "save_path": "github-repos/isabelle/Sohalt-pf-verification", "path": "github-repos/isabelle/Sohalt-pf-verification/pf-verification-328f850913723dee6c9f6be069fbbc22a3762354/SemanticsTernary/PF_Ternary_Translation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442251201477016, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.33720053718125526}}
{"text": "(*  Title:      ZF/Constructible/Separation.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n*)\n\nsection\\<open>Early Instances of Separation and Strong Replacement\\<close>\n\ntheory Separation imports L_axioms WF_absolute begin\n\ntext\\<open>This theory proves all instances needed for locale \\<open>M_basic\\<close>\\<close>\n\ntext\\<open>Helps us solve for de Bruijn indices!\\<close>\nlemma nth_ConsI: \"[|nth(n,l) = x; n \\<in> nat|] ==> nth(succ(n), Cons(a,l)) = x\"\nby simp\n\nlemmas nth_rules = nth_0 nth_ConsI nat_0I nat_succI\nlemmas sep_rules = nth_0 nth_ConsI FOL_iff_sats function_iff_sats\n                   fun_plus_iff_sats\n\nlemma Collect_conj_in_DPow:\n     \"[| {x\\<in>A. P(x)} \\<in> DPow(A);  {x\\<in>A. Q(x)} \\<in> DPow(A) |]\n      ==> {x\\<in>A. P(x) & Q(x)} \\<in> DPow(A)\"\nby (simp add: Int_in_DPow Collect_Int_Collect_eq [symmetric])\n\nlemma Collect_conj_in_DPow_Lset:\n     \"[|z \\<in> Lset(j); {x \\<in> Lset(j). P(x)} \\<in> DPow(Lset(j))|]\n      ==> {x \\<in> Lset(j). x \\<in> z & P(x)} \\<in> DPow(Lset(j))\"\napply (frule mem_Lset_imp_subset_Lset)\napply (simp add: Collect_conj_in_DPow Collect_mem_eq\n                 subset_Int_iff2 elem_subset_in_DPow)\ndone\n\nlemma separation_CollectI:\n     \"(\\<And>z. L(z) ==> L({x \\<in> z . P(x)})) ==> separation(L, \\<lambda>x. P(x))\"\napply (unfold separation_def, clarify)\napply (rule_tac x=\"{x\\<in>z. P(x)}\" in rexI)\napply simp_all\ndone\n\ntext\\<open>Reduces the original comprehension to the reflected one\\<close>\nlemma reflection_imp_L_separation:\n      \"[| \\<forall>x\\<in>Lset(j). P(x) \\<longleftrightarrow> Q(x);\n          {x \\<in> Lset(j) . Q(x)} \\<in> DPow(Lset(j));\n          Ord(j);  z \\<in> Lset(j)|] ==> L({x \\<in> z . P(x)})\"\napply (rule_tac i = \"succ(j)\" in L_I)\n prefer 2 apply simp\napply (subgoal_tac \"{x \\<in> z. P(x)} = {x \\<in> Lset(j). x \\<in> z & (Q(x))}\")\n prefer 2\n apply (blast dest: mem_Lset_imp_subset_Lset)\napply (simp add: Lset_succ Collect_conj_in_DPow_Lset)\ndone\n\ntext\\<open>Encapsulates the standard proof script for proving instances of \n      Separation.\\<close>\nlemma gen_separation:\n assumes reflection: \"REFLECTS [P,Q]\"\n     and Lu:         \"L(u)\"\n     and collI: \"!!j. u \\<in> Lset(j)\n                \\<Longrightarrow> Collect(Lset(j), Q(j)) \\<in> DPow(Lset(j))\"\n shows \"separation(L,P)\"\napply (rule separation_CollectI)\napply (rule_tac A=\"{u,z}\" in subset_LsetE, blast intro: Lu)\napply (rule ReflectsE [OF reflection], assumption)\napply (drule subset_Lset_ltD, assumption)\napply (erule reflection_imp_L_separation)\n  apply (simp_all add: lt_Ord2, clarify)\napply (rule collI, assumption)\ndone\n\ntext\\<open>As above, but typically @{term u} is a finite enumeration such as\n  @{term \"{a,b}\"}; thus the new subgoal gets the assumption\n  @{term \"{a,b} \\<subseteq> Lset(i)\"}, which is logically equivalent to \n  @{term \"a \\<in> Lset(i)\"} and @{term \"b \\<in> Lset(i)\"}.\\<close>\nlemma gen_separation_multi:\n assumes reflection: \"REFLECTS [P,Q]\"\n     and Lu:         \"L(u)\"\n     and collI: \"!!j. u \\<subseteq> Lset(j)\n                \\<Longrightarrow> Collect(Lset(j), Q(j)) \\<in> DPow(Lset(j))\"\n shows \"separation(L,P)\"\napply (rule gen_separation [OF reflection Lu])\napply (drule mem_Lset_imp_subset_Lset)\napply (erule collI) \ndone\n\n\nsubsection\\<open>Separation for Intersection\\<close>\n\nlemma Inter_Reflects:\n     \"REFLECTS[\\<lambda>x. \\<forall>y[L]. y\\<in>A \\<longrightarrow> x \\<in> y,\n               \\<lambda>i x. \\<forall>y\\<in>Lset(i). y\\<in>A \\<longrightarrow> x \\<in> y]\"\nby (intro FOL_reflections)\n\nlemma Inter_separation:\n     \"L(A) ==> separation(L, \\<lambda>x. \\<forall>y[L]. y\\<in>A \\<longrightarrow> x\\<in>y)\"\napply (rule gen_separation [OF Inter_Reflects], simp)\napply (rule DPow_LsetI)\n txt\\<open>I leave this one example of a manual proof.  The tedium of manually\n      instantiating @{term i}, @{term j} and @{term env} is obvious.\\<close>\napply (rule ball_iff_sats)\napply (rule imp_iff_sats)\napply (rule_tac [2] i=1 and j=0 and env=\"[y,x,A]\" in mem_iff_sats)\napply (rule_tac i=0 and j=2 in mem_iff_sats)\napply (simp_all add: succ_Un_distrib [symmetric])\ndone\n\nsubsection\\<open>Separation for Set Difference\\<close>\n\nlemma Diff_Reflects:\n     \"REFLECTS[\\<lambda>x. x \\<notin> B, \\<lambda>i x. x \\<notin> B]\"\nby (intro FOL_reflections)  \n\nlemma Diff_separation:\n     \"L(B) ==> separation(L, \\<lambda>x. x \\<notin> B)\"\napply (rule gen_separation [OF Diff_Reflects], simp)\napply (rule_tac env=\"[B]\" in DPow_LsetI)\napply (rule sep_rules | simp)+\ndone\n\nsubsection\\<open>Separation for Cartesian Product\\<close>\n\nlemma cartprod_Reflects:\n     \"REFLECTS[\\<lambda>z. \\<exists>x[L]. x\\<in>A & (\\<exists>y[L]. y\\<in>B & pair(L,x,y,z)),\n                \\<lambda>i z. \\<exists>x\\<in>Lset(i). x\\<in>A & (\\<exists>y\\<in>Lset(i). y\\<in>B &\n                                   pair(##Lset(i),x,y,z))]\"\nby (intro FOL_reflections function_reflections)\n\nlemma cartprod_separation:\n     \"[| L(A); L(B) |]\n      ==> separation(L, \\<lambda>z. \\<exists>x[L]. x\\<in>A & (\\<exists>y[L]. y\\<in>B & pair(L,x,y,z)))\"\napply (rule gen_separation_multi [OF cartprod_Reflects, of \"{A,B}\"], auto)\napply (rule_tac env=\"[A,B]\" in DPow_LsetI)\napply (rule sep_rules | simp)+\ndone\n\nsubsection\\<open>Separation for Image\\<close>\n\nlemma image_Reflects:\n     \"REFLECTS[\\<lambda>y. \\<exists>p[L]. p\\<in>r & (\\<exists>x[L]. x\\<in>A & pair(L,x,y,p)),\n           \\<lambda>i y. \\<exists>p\\<in>Lset(i). p\\<in>r & (\\<exists>x\\<in>Lset(i). x\\<in>A & pair(##Lset(i),x,y,p))]\"\nby (intro FOL_reflections function_reflections)\n\nlemma image_separation:\n     \"[| L(A); L(r) |]\n      ==> separation(L, \\<lambda>y. \\<exists>p[L]. p\\<in>r & (\\<exists>x[L]. x\\<in>A & pair(L,x,y,p)))\"\napply (rule gen_separation_multi [OF image_Reflects, of \"{A,r}\"], auto)\napply (rule_tac env=\"[A,r]\" in DPow_LsetI)\napply (rule sep_rules | simp)+\ndone\n\n\nsubsection\\<open>Separation for Converse\\<close>\n\nlemma converse_Reflects:\n  \"REFLECTS[\\<lambda>z. \\<exists>p[L]. p\\<in>r & (\\<exists>x[L]. \\<exists>y[L]. pair(L,x,y,p) & pair(L,y,x,z)),\n     \\<lambda>i z. \\<exists>p\\<in>Lset(i). p\\<in>r & (\\<exists>x\\<in>Lset(i). \\<exists>y\\<in>Lset(i).\n                     pair(##Lset(i),x,y,p) & pair(##Lset(i),y,x,z))]\"\nby (intro FOL_reflections function_reflections)\n\nlemma converse_separation:\n     \"L(r) ==> separation(L,\n         \\<lambda>z. \\<exists>p[L]. p\\<in>r & (\\<exists>x[L]. \\<exists>y[L]. pair(L,x,y,p) & pair(L,y,x,z)))\"\napply (rule gen_separation [OF converse_Reflects], simp)\napply (rule_tac env=\"[r]\" in DPow_LsetI)\napply (rule sep_rules | simp)+\ndone\n\n\nsubsection\\<open>Separation for Restriction\\<close>\n\nlemma restrict_Reflects:\n     \"REFLECTS[\\<lambda>z. \\<exists>x[L]. x\\<in>A & (\\<exists>y[L]. pair(L,x,y,z)),\n        \\<lambda>i z. \\<exists>x\\<in>Lset(i). x\\<in>A & (\\<exists>y\\<in>Lset(i). pair(##Lset(i),x,y,z))]\"\nby (intro FOL_reflections function_reflections)\n\nlemma restrict_separation:\n   \"L(A) ==> separation(L, \\<lambda>z. \\<exists>x[L]. x\\<in>A & (\\<exists>y[L]. pair(L,x,y,z)))\"\napply (rule gen_separation [OF restrict_Reflects], simp)\napply (rule_tac env=\"[A]\" in DPow_LsetI)\napply (rule sep_rules | simp)+\ndone\n\n\nsubsection\\<open>Separation for Composition\\<close>\n\nlemma comp_Reflects:\n     \"REFLECTS[\\<lambda>xz. \\<exists>x[L]. \\<exists>y[L]. \\<exists>z[L]. \\<exists>xy[L]. \\<exists>yz[L].\n                  pair(L,x,z,xz) & pair(L,x,y,xy) & pair(L,y,z,yz) &\n                  xy\\<in>s & yz\\<in>r,\n        \\<lambda>i xz. \\<exists>x\\<in>Lset(i). \\<exists>y\\<in>Lset(i). \\<exists>z\\<in>Lset(i). \\<exists>xy\\<in>Lset(i). \\<exists>yz\\<in>Lset(i).\n                  pair(##Lset(i),x,z,xz) & pair(##Lset(i),x,y,xy) &\n                  pair(##Lset(i),y,z,yz) & xy\\<in>s & yz\\<in>r]\"\nby (intro FOL_reflections function_reflections)\n\nlemma comp_separation:\n     \"[| L(r); L(s) |]\n      ==> separation(L, \\<lambda>xz. \\<exists>x[L]. \\<exists>y[L]. \\<exists>z[L]. \\<exists>xy[L]. \\<exists>yz[L].\n                  pair(L,x,z,xz) & pair(L,x,y,xy) & pair(L,y,z,yz) &\n                  xy\\<in>s & yz\\<in>r)\"\napply (rule gen_separation_multi [OF comp_Reflects, of \"{r,s}\"], auto)\ntxt\\<open>Subgoals after applying general ``separation'' rule:\n     @{subgoals[display,indent=0,margin=65]}\\<close>\napply (rule_tac env=\"[r,s]\" in DPow_LsetI)\ntxt\\<open>Subgoals ready for automatic synthesis of a formula:\n     @{subgoals[display,indent=0,margin=65]}\\<close>\napply (rule sep_rules | simp)+\ndone\n\n\nsubsection\\<open>Separation for Predecessors in an Order\\<close>\n\nlemma pred_Reflects:\n     \"REFLECTS[\\<lambda>y. \\<exists>p[L]. p\\<in>r & pair(L,y,x,p),\n                    \\<lambda>i y. \\<exists>p \\<in> Lset(i). p\\<in>r & pair(##Lset(i),y,x,p)]\"\nby (intro FOL_reflections function_reflections)\n\nlemma pred_separation:\n     \"[| L(r); L(x) |] ==> separation(L, \\<lambda>y. \\<exists>p[L]. p\\<in>r & pair(L,y,x,p))\"\napply (rule gen_separation_multi [OF pred_Reflects, of \"{r,x}\"], auto)\napply (rule_tac env=\"[r,x]\" in DPow_LsetI)\napply (rule sep_rules | simp)+\ndone\n\n\nsubsection\\<open>Separation for the Membership Relation\\<close>\n\nlemma Memrel_Reflects:\n     \"REFLECTS[\\<lambda>z. \\<exists>x[L]. \\<exists>y[L]. pair(L,x,y,z) & x \\<in> y,\n            \\<lambda>i z. \\<exists>x \\<in> Lset(i). \\<exists>y \\<in> Lset(i). pair(##Lset(i),x,y,z) & x \\<in> y]\"\nby (intro FOL_reflections function_reflections)\n\nlemma Memrel_separation:\n     \"separation(L, \\<lambda>z. \\<exists>x[L]. \\<exists>y[L]. pair(L,x,y,z) & x \\<in> y)\"\napply (rule gen_separation [OF Memrel_Reflects nonempty])\napply (rule_tac env=\"[]\" in DPow_LsetI)\napply (rule sep_rules | simp)+\ndone\n\n\nsubsection\\<open>Replacement for FunSpace\\<close>\n\nlemma funspace_succ_Reflects:\n \"REFLECTS[\\<lambda>z. \\<exists>p[L]. p\\<in>A & (\\<exists>f[L]. \\<exists>b[L]. \\<exists>nb[L]. \\<exists>cnbf[L].\n            pair(L,f,b,p) & pair(L,n,b,nb) & is_cons(L,nb,f,cnbf) &\n            upair(L,cnbf,cnbf,z)),\n        \\<lambda>i z. \\<exists>p \\<in> Lset(i). p\\<in>A & (\\<exists>f \\<in> Lset(i). \\<exists>b \\<in> Lset(i).\n              \\<exists>nb \\<in> Lset(i). \\<exists>cnbf \\<in> Lset(i).\n                pair(##Lset(i),f,b,p) & pair(##Lset(i),n,b,nb) &\n                is_cons(##Lset(i),nb,f,cnbf) & upair(##Lset(i),cnbf,cnbf,z))]\"\nby (intro FOL_reflections function_reflections)\n\nlemma funspace_succ_replacement:\n     \"L(n) ==>\n      strong_replacement(L, \\<lambda>p z. \\<exists>f[L]. \\<exists>b[L]. \\<exists>nb[L]. \\<exists>cnbf[L].\n                pair(L,f,b,p) & pair(L,n,b,nb) & is_cons(L,nb,f,cnbf) &\n                upair(L,cnbf,cnbf,z))\"\napply (rule strong_replacementI)\napply (rule_tac u=\"{n,B}\" in gen_separation_multi [OF funspace_succ_Reflects], \n       auto)\napply (rule_tac env=\"[n,B]\" in DPow_LsetI)\napply (rule sep_rules | simp)+\ndone\n\n\nsubsection\\<open>Separation for a Theorem about @{term \"is_recfun\"}\\<close>\n\nlemma is_recfun_reflects:\n  \"REFLECTS[\\<lambda>x. \\<exists>xa[L]. \\<exists>xb[L].\n                pair(L,x,a,xa) & xa \\<in> r & pair(L,x,b,xb) & xb \\<in> r &\n                (\\<exists>fx[L]. \\<exists>gx[L]. fun_apply(L,f,x,fx) & fun_apply(L,g,x,gx) &\n                                   fx \\<noteq> gx),\n   \\<lambda>i x. \\<exists>xa \\<in> Lset(i). \\<exists>xb \\<in> Lset(i).\n          pair(##Lset(i),x,a,xa) & xa \\<in> r & pair(##Lset(i),x,b,xb) & xb \\<in> r &\n                (\\<exists>fx \\<in> Lset(i). \\<exists>gx \\<in> Lset(i). fun_apply(##Lset(i),f,x,fx) &\n                  fun_apply(##Lset(i),g,x,gx) & fx \\<noteq> gx)]\"\nby (intro FOL_reflections function_reflections fun_plus_reflections)\n\nlemma is_recfun_separation:\n     \\<comment>\\<open>for well-founded recursion\\<close>\n     \"[| L(r); L(f); L(g); L(a); L(b) |]\n     ==> separation(L,\n            \\<lambda>x. \\<exists>xa[L]. \\<exists>xb[L].\n                pair(L,x,a,xa) & xa \\<in> r & pair(L,x,b,xb) & xb \\<in> r &\n                (\\<exists>fx[L]. \\<exists>gx[L]. fun_apply(L,f,x,fx) & fun_apply(L,g,x,gx) &\n                                   fx \\<noteq> gx))\"\napply (rule gen_separation_multi [OF is_recfun_reflects, of \"{r,f,g,a,b}\"], \n            auto)\napply (rule_tac env=\"[r,f,g,a,b]\" in DPow_LsetI)\napply (rule sep_rules | simp)+\ndone\n\n\nsubsection\\<open>Instantiating the locale \\<open>M_basic\\<close>\\<close>\ntext\\<open>Separation (and Strong Replacement) for basic set-theoretic constructions\nsuch as intersection, Cartesian Product and image.\\<close>\n\nlemma M_basic_axioms_L: \"M_basic_axioms(L)\"\n  apply (rule M_basic_axioms.intro)\n       apply (assumption | rule\n         Inter_separation Diff_separation cartprod_separation image_separation\n         converse_separation restrict_separation\n         comp_separation pred_separation Memrel_separation\n         funspace_succ_replacement is_recfun_separation)+\n  done\n\ntheorem M_basic_L: \"PROP M_basic(L)\"\nby (rule M_basic.intro [OF M_trivial_L M_basic_axioms_L])\n\ninterpretation L?: M_basic L by (rule M_basic_L)\n\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/ZF/Constructible/Separation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442251201477015, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3372005371812552}}
{"text": "theory Array_Map_Impl\nimports \n  \"../Sep_Main\" Imp_Map_Spec Array_Blit\n  \"~~/src/HOL/Library/Code_Target_Numeral\"\nbegin\n  subsection \"Array Map\"\n\n  type_synonym 'v array_map = \"'v option array\"\n  definition \"iam_initial_size \\<equiv> 8::nat\"\n\n  definition \"iam_of_list l i \\<equiv> if i<length l then l!i else None\"\n\n  definition is_iam :: \"(nat\\<rightharpoonup>'a) \\<Rightarrow> ('a::heap) array_map \\<Rightarrow> assn\" where\n    \"is_iam m a \\<equiv> \\<exists>\\<^sub>Al. a\\<mapsto>\\<^sub>al * \\<up>(m=iam_of_list l)\"\n\n  definition iam_new_sz :: \"nat \\<Rightarrow> ('v::heap) array_map Heap\"\n    where \"iam_new_sz sz \\<equiv> Array.new sz None\"\n\n  definition iam_new :: \"('v::heap) array_map Heap\"\n    where \"iam_new \\<equiv> iam_new_sz iam_initial_size\"\n\n  definition iam_lookup \n    :: \"nat \\<Rightarrow> ('v::heap) array_map \\<Rightarrow> 'v option Heap\"\n    where \"iam_lookup k a = do {\n      l\\<leftarrow>Array.len a;\n      if k < l then Array.nth a k else return None\n    }\"\n\n  \n\n  definition iam_delete\n    :: \"nat \\<Rightarrow> ('v::heap) array_map \\<Rightarrow> ('v::heap) array_map Heap\"\n  where \"iam_delete k a = do {\n      l\\<leftarrow>Array.len a;\n      if k < l then Array.upd k None a else return a\n    }\"\n\n  lemma [code]: \"iam_delete k a \\<equiv> upd_oo (return a) k None a\"\n    unfolding upd_oo_def iam_delete_def .\n\n  definition iam_update\n    :: \"nat \\<Rightarrow> 'v::heap \\<Rightarrow> 'v array_map \\<Rightarrow> 'v array_map Heap\"\n    where \"iam_update k v a = do {\n      l\\<leftarrow>Array.len a;\n      a\\<leftarrow>if k>=l then do {\n          let newsz = max (k+1) (2 * l + 3);\n          array_grow a newsz None\n        } else return a;\n\n      Array.upd k (Some v) a\n    }\"\n\n  lemma [code]: \"iam_update k v a = upd_oo \n    (do {\n      l\\<leftarrow>Array.len a;\n      let newsz = max (k+1) (2 * l + 3);\n      a\\<leftarrow>array_grow a newsz None;\n      Array.upd k (Some v) a\n    })\n    k (Some v) a\"\n  proof -\n    have [simp]: \n      \"\\<And>x t e. do {\n        l\\<leftarrow>Array.len a;\n        if x l then \n          t l \n        else do {\n          l'\\<leftarrow>Array.len a;\n          e l l'\n        } \n      }\n      =\n      do {\n        l\\<leftarrow>Array.len a;\n        if x l then t l else e l l\n      }\"\n      apply (auto \n        simp: bind_def execute_len \n        split: option.split\n        intro!: ext\n      )\n      done\n  \n    show ?thesis\n      unfolding upd_oo_def iam_update_def\n      apply simp\n      apply (rule cong[OF arg_cong, where f1=bind])\n      apply simp\n      apply (rule ext)\n      apply auto\n      done\n  qed\n\n  lemma precise_iam: \"precise is_iam\"\n    apply rule\n    by (auto simp add: is_iam_def dest: preciseD[OF snga_prec])\n\n  lemma iam_new_abs: \"iam_of_list (replicate n None) = Map.empty\"\n    unfolding iam_of_list_def[abs_def]\n    by auto\n\n  lemma iam_new_sz_rule: \"<emp> iam_new_sz n < is_iam Map.empty >\"\n    unfolding iam_new_sz_def is_iam_def[abs_def]\n    by (sep_auto simp: iam_new_abs)\n\n  lemma iam_new_rule: \"<emp> iam_new < is_iam Map.empty >\"\n    unfolding iam_new_def by (sep_auto heap: iam_new_sz_rule)\n\n  \n\n  lemma iam_lookup_rule: \"< is_iam m p > \n    iam_lookup k p \n    <\\<lambda>r. is_iam m p * \\<up>(r=m k) >\"\n    unfolding iam_lookup_def is_iam_def\n    by (sep_auto simp: iam_lookup_abs1 iam_lookup_abs2)\n\n  lemma iam_delete_abs1: \"k<length l \n    \\<Longrightarrow> iam_of_list (l[k := None]) = iam_of_list l |` (- {k})\"\n    unfolding iam_of_list_def[abs_def]\n    by (auto intro!: ext simp: restrict_map_def)\n\n  lemma iam_delete_abs2: \"\\<not>k<length l \n    \\<Longrightarrow> iam_of_list l |` (- {k}) = iam_of_list l\"\n    unfolding iam_of_list_def[abs_def]\n    by (auto intro!: ext simp: restrict_map_def)\n\n  lemma iam_delete_rule: \"< is_iam m p >\n    iam_delete k p\n    <\\<lambda>r. is_iam (m|`(-{k})) r>\"\n    unfolding is_iam_def iam_delete_def\n    by (sep_auto simp: iam_delete_abs1 iam_delete_abs2)\n    \n\n  lemma iam_update_abs1: \"iam_of_list (l@replicate n None) = iam_of_list l\"\n    unfolding iam_of_list_def[abs_def]\n    by (auto intro!: ext simp: nth_append)\n\n  lemma iam_update_abs2: \"\\<not> length l \\<le> k \n    \\<Longrightarrow> iam_of_list (l[k := Some v]) = iam_of_list l(k \\<mapsto> v)\"\n    unfolding iam_of_list_def[abs_def]\n    by auto\n\n  lemma iam_update_rule:\n    \"< is_iam m p > iam_update k v p <\\<lambda>r. is_iam (m(k\\<mapsto>v)) r>\\<^sub>t\"\n    unfolding is_iam_def iam_update_def\n    by (sep_auto \n      decon: decon_split_if \n      simp: iam_update_abs1 iam_update_abs2)\n  \n  interpretation iam: imp_map is_iam\n    apply unfold_locales\n    by (rule precise_iam)\n  interpretation iam: imp_map_empty is_iam iam_new\n    apply unfold_locales\n    by (sep_auto heap: iam_new_rule)\n  interpretation iam_sz: imp_map_empty is_iam \"iam_new_sz sz\"\n    apply unfold_locales\n    by (sep_auto heap: iam_new_sz_rule)\n \n  interpretation iam: imp_map_lookup is_iam iam_lookup\n    apply unfold_locales\n    by (sep_auto heap: iam_lookup_rule)\n  interpretation iam: imp_map_delete is_iam iam_delete\n    apply unfold_locales\n    by (sep_auto heap: iam_delete_rule)\n  interpretation iam: imp_map_update is_iam iam_update\n    apply unfold_locales\n    by (sep_auto heap: iam_update_rule)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Separation_Logic_Imperative_HOL/Examples/Array_Map_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3372005300306361}}
{"text": "(*\n  File:      Epistemic_Logic_CK.thy\n  Author of Epistemic_Logic.thy:    Asta Halkjær From\n  Modified to Epistemic_Logic_CK.thy by: Simon Tobias Lund & Jakub Eugeniusz Janaszkiewicz\n\n  This is a reworking of Epistemic_Logic.thy by Asta Halkjær From to \n  epistemic logic with common knowledge. \n  The general structure remains the same, and so do many of the proofs.\n  The canonical models have been restricted to finite sets of formulas like they do when\n  introducing common knowledge in Reasoning About Knowledge by Fagin, Halpern, Moses, and Vardi.\n  The part of truth_lemma concerned with the Co operator also follows the same lines as this book.\n*)\n\ntheory Epistemic_Logic_CK imports \"HOL-Library.Countable\" begin\n\nsection \\<open>Auxiliary\\<close>\n\nlemma list_of_lists_if_finite_set_of_sets: \\<open>finite W \\<Longrightarrow> \\<forall> V \\<in> W. finite V \\<Longrightarrow> \\<exists> xs. set (map set xs) = W\\<close>\n  by (induct W rule: finite.induct) (simp, metis finite_list insertCI list.simps(15) list.simps(9))\n\nsection \\<open>Syntax\\<close>\n\ntype_synonym id = string\n\ndatatype 'i fm\n  = FF (\\<open>\\<^bold>\\<bottom>\\<close>)\n  | Pro id\n  | Dis \\<open>'i fm\\<close> \\<open>'i fm\\<close> (infixr \\<open>\\<^bold>\\<or>\\<close> 60)\n  | Con \\<open>'i fm\\<close> \\<open>'i fm\\<close> (infixr \\<open>\\<^bold>\\<and>\\<close> 65)\n  | Imp \\<open>'i fm\\<close> \\<open>'i fm\\<close> (infixr \\<open>\\<^bold>\\<longrightarrow>\\<close> 55)\n  | K 'i \\<open>'i fm\\<close>\n  | Ev \\<open>'i list\\<close> \\<open>'i fm\\<close>\n  | Co \\<open>'i list\\<close> \\<open>'i fm\\<close>\n\nabbreviation TT (\\<open>\\<^bold>\\<top>\\<close>) where\n  \\<open>TT \\<equiv> \\<^bold>\\<bottom> \\<^bold>\\<longrightarrow> \\<^bold>\\<bottom>\\<close>\n\nabbreviation Neg (\\<open>\\<^bold>\\<not> _\\<close> [70] 70) where\n  \\<open>Neg p \\<equiv> p \\<^bold>\\<longrightarrow> \\<^bold>\\<bottom>\\<close>\n\nabbreviation \\<open>L i p \\<equiv> \\<^bold>\\<not> K i (\\<^bold>\\<not> p)\\<close>\n\nsection \\<open>Semantics\\<close>\n\nrecord ('i, 'w) frame =\n  \\<W> :: \\<open>'w set\\<close>\n  \\<K> :: \\<open>'i \\<Rightarrow> 'w \\<Rightarrow> 'w set\\<close>\n\nrecord ('i, 'w) kripke =\n  \\<open>('i, 'w) frame\\<close> +\n  \\<pi> :: \\<open>'w \\<Rightarrow> id \\<Rightarrow> bool\\<close>\n\nprimrec f_size where\n  \\<open>f_size \\<^bold>\\<bottom> = 1\\<close> |\n  \\<open>f_size (Pro x) = 1\\<close> |\n  \\<open>f_size (p \\<^bold>\\<or> q) = f_size p + f_size q + 1\\<close> |\n  \\<open>f_size (p \\<^bold>\\<and> q) = f_size p + f_size q + 1\\<close> |\n  \\<open>f_size (p \\<^bold>\\<longrightarrow> q) = f_size p + f_size q + 1\\<close> |\n  \\<open>f_size (K i p) = f_size p + 1\\<close> |\n  \\<open>f_size (Ev g p) = f_size p + 2\\<close> |\n  \\<open>f_size (Co g p) = f_size p + 1\\<close>\n\nprimrec common_count where \n  \\<open>common_count \\<^bold>\\<bottom> = 0\\<close> |\n  \\<open>common_count (Pro x) = 0\\<close> |\n  \\<open>common_count (p \\<^bold>\\<or> q) = common_count p + common_count q\\<close> |\n  \\<open>common_count (p \\<^bold>\\<and> q) = common_count p + common_count q\\<close> |\n  \\<open>common_count (p \\<^bold>\\<longrightarrow> q) = common_count p + common_count q\\<close> |\n  \\<open>common_count (K i p) = common_count p\\<close> |\n  \\<open>common_count (Ev g p) = common_count p\\<close> |\n  \\<open>common_count (Co g p) = common_count p + 1\\<close>\n\nprimrec Ev_n where\n  \\<open>Ev_n g p 0 = p\\<close> |\n  \\<open>Ev_n g p (Suc n) = Ev g (Ev_n g p n)\\<close>\n\nlemma common_count_EV_n: \\<open>common_count (Ev_n g p n) < Suc (common_count p)\\<close>\n  by (induct n) auto\n\nfunction semantics :: \\<open>('i, 'w) kripke \\<Rightarrow> 'w \\<Rightarrow> 'i fm \\<Rightarrow> bool\\<close> (\\<open>_, _ \\<Turnstile> _\\<close> [50, 50, 50] 50) where\n  \\<open>M, w \\<Turnstile> \\<^bold>\\<bottom> \\<longleftrightarrow> False\\<close>\n| \\<open>M, w \\<Turnstile> Pro x \\<longleftrightarrow> \\<pi> M w x\\<close>\n| \\<open>M, w \\<Turnstile> p \\<^bold>\\<or> q \\<longleftrightarrow> M, w \\<Turnstile> p \\<or> M, w \\<Turnstile> q\\<close>\n| \\<open>M, w \\<Turnstile> p \\<^bold>\\<and> q \\<longleftrightarrow> M, w \\<Turnstile> p \\<and> M, w \\<Turnstile> q\\<close>\n| \\<open>M, w \\<Turnstile> p \\<^bold>\\<longrightarrow> q \\<longleftrightarrow> M, w \\<Turnstile> p \\<longrightarrow> M, w \\<Turnstile> q\\<close>\n| \\<open>M, w \\<Turnstile> K i p \\<longleftrightarrow> (\\<forall>v \\<in> \\<W> M \\<inter> \\<K> M i w. M, v \\<Turnstile> p)\\<close>\n| \\<open>M, w \\<Turnstile> Ev g p \\<longleftrightarrow> (\\<forall> i \\<in> set g. M, w \\<Turnstile> K i p)\\<close>\n| \\<open>M, w \\<Turnstile> Co g p \\<longleftrightarrow> (\\<forall> n \\<ge> 1. M, w \\<Turnstile> Ev_n g p n)\\<close>\n  by pat_completeness auto\ntermination \nproof (relation \\<open>measures [\\<lambda> (_,_,p). common_count p, \\<lambda> (_,_,p).f_size p]\\<close>) \n  show \\<open>\\<And>M w is p x. ((M, w, Ev_n is p x), M, w, Co is p) \\<in> measures [\\<lambda>(_, _, p). common_count p, \\<lambda>(_, _, p). f_size p]\\<close>\n    using common_count_EV_n by auto\nqed auto\n\nabbreviation validStar :: \\<open>(('i, 'w) kripke \\<Rightarrow> bool) \\<Rightarrow> 'i fm set \\<Rightarrow> 'i fm \\<Rightarrow> bool\\<close>\n  (\\<open>_; _ \\<TTurnstile>\\<star> _\\<close> [50, 50, 50] 50) where\n  \\<open>P; G \\<TTurnstile>\\<star> p \\<equiv> \\<forall>M. P M \\<longrightarrow>\n    (\\<forall>w \\<in> \\<W> M. (\\<forall>q \\<in> G. M, w \\<Turnstile> q) \\<longrightarrow> M, w \\<Turnstile> p)\\<close>\n\nsection \\<open>S5 Axioms\\<close>\n\ndefinition reflexive :: \\<open>('i, 'w, 'c) frame_scheme \\<Rightarrow> bool\\<close> where\n  \\<open>reflexive M \\<equiv> \\<forall>i. \\<forall>w \\<in> \\<W> M. w \\<in> \\<K> M i w\\<close>\n \ndefinition symmetric :: \\<open>('i, 'w, 'c) frame_scheme \\<Rightarrow> bool\\<close> where\n  \\<open>symmetric M \\<equiv> \\<forall>i. \\<forall>v \\<in> \\<W> M. \\<forall>w \\<in> \\<W> M. v \\<in> \\<K> M i w \\<longleftrightarrow> w \\<in> \\<K> M i v\\<close>\n\ndefinition transitive :: \\<open>('i, 'w, 'c) frame_scheme \\<Rightarrow> bool\\<close> where\n  \\<open>transitive M \\<equiv> \\<forall>i. \\<forall>u \\<in> \\<W> M. \\<forall>v \\<in> \\<W> M. \\<forall>w \\<in> \\<W> M.\n    w \\<in> \\<K> M i v \\<and> u \\<in> \\<K> M i w \\<longrightarrow> u \\<in> \\<K> M i v\\<close>\n\nabbreviation refltrans :: \\<open>('i, 'w, 'c) frame_scheme \\<Rightarrow> bool\\<close> where\n  \\<open>refltrans M \\<equiv> reflexive M \\<and> transitive M\\<close>\n\nabbreviation equivalence :: \\<open>('i, 'w, 'c) frame_scheme \\<Rightarrow> bool\\<close> where\n  \\<open>equivalence M \\<equiv> reflexive M \\<and> symmetric M \\<and> transitive M\\<close>\n\ndefinition Euclidean :: \\<open>('i, 'w, 'c) frame_scheme \\<Rightarrow> bool\\<close> where\n  \\<open>Euclidean M \\<equiv> \\<forall>i. \\<forall>u \\<in> \\<W> M. \\<forall>v \\<in> \\<W> M. \\<forall>w \\<in> \\<W> M.\n    v \\<in> \\<K> M i u \\<longrightarrow> w \\<in> \\<K> M i u \\<longrightarrow> w \\<in> \\<K> M i v\\<close>\n\nlemma Imp_intro [intro]: \\<open>(M, w \\<Turnstile> p \\<Longrightarrow> M, w \\<Turnstile> q) \\<Longrightarrow> M, w \\<Turnstile> p \\<^bold>\\<longrightarrow> q\\<close>\n  by simp\n\ntheorem distribution: \\<open>M, w \\<Turnstile> K i p \\<^bold>\\<and> K i (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> K i q\\<close>\nproof\n  assume \\<open>M, w \\<Turnstile> K i p \\<^bold>\\<and> K i (p \\<^bold>\\<longrightarrow> q)\\<close>\n  then have \\<open>M, w \\<Turnstile> K i p\\<close> \\<open>M, w \\<Turnstile> K i (p \\<^bold>\\<longrightarrow> q)\\<close>\n    by simp_all\n  then have \\<open>\\<forall>v \\<in> \\<W> M \\<inter> \\<K> M i w. M, v \\<Turnstile> p\\<close> \\<open>\\<forall>v \\<in> \\<W> M \\<inter> \\<K> M i w. M, v \\<Turnstile> p \\<^bold>\\<longrightarrow> q\\<close>\n    by simp_all\n  then have \\<open>\\<forall>v \\<in> \\<W> M \\<inter> \\<K> M i w. M, v \\<Turnstile> q\\<close>\n    by simp\n  then show \\<open>M, w \\<Turnstile> K i q\\<close>\n    by simp\nqed\n\ntheorem generalization:\n  fixes M :: \\<open>('i, 'w) kripke\\<close>\n  assumes \\<open>\\<forall>(M :: ('i, 'w) kripke). \\<forall>w \\<in> \\<W> M. M, w \\<Turnstile> p\\<close> \\<open>w \\<in> \\<W> M\\<close>\n  shows \\<open>M, w \\<Turnstile> K i p\\<close>\nproof -\n  have \\<open>\\<forall>w' \\<in> \\<W> M \\<inter> \\<K> M i w. M, w' \\<Turnstile> p\\<close>\n    using assms by blast\n  then show \\<open>M, w \\<Turnstile> K i p\\<close>\n    by simp\nqed\n\ntheorem truth:\n  assumes \\<open>reflexive M\\<close> \\<open>w \\<in> \\<W> M\\<close>\n  shows \\<open>M, w \\<Turnstile> K i p \\<^bold>\\<longrightarrow> p\\<close>\nproof\n  assume \\<open>M, w \\<Turnstile> K i p\\<close>\n  then have \\<open>\\<forall>v \\<in> \\<W> M \\<inter> \\<K> M i w. M, v \\<Turnstile> p\\<close>\n    by simp\n  moreover have \\<open>w \\<in> \\<K> M i w\\<close>\n    using \\<open>reflexive M\\<close> \\<open>w \\<in> \\<W> M\\<close> unfolding reflexive_def by blast\n  ultimately show \\<open>M, w \\<Turnstile> p\\<close>\n    using \\<open>w \\<in> \\<W> M\\<close> by simp\nqed\n\ntheorem pos_introspection:\n  assumes \\<open>transitive M\\<close> \\<open>w \\<in> \\<W> M\\<close>\n  shows \\<open>M, w \\<Turnstile> K i p \\<^bold>\\<longrightarrow> K i (K i p)\\<close>\nproof\n  assume \\<open>M, w \\<Turnstile> K i p\\<close>\n  then have \\<open>\\<forall>v \\<in> \\<W> M \\<inter> \\<K> M i w. M, v \\<Turnstile> p\\<close>\n    by simp\n  then have \\<open>\\<forall>v \\<in> \\<W> M \\<inter> \\<K> M i w. \\<forall>u \\<in> \\<W> M \\<inter> \\<K> M i v. M, u \\<Turnstile> p\\<close>\n    using \\<open>transitive M\\<close> \\<open>w \\<in> \\<W> M\\<close> unfolding transitive_def by blast\n  then have \\<open>\\<forall>v \\<in> \\<W> M \\<inter> \\<K> M i w. M, v \\<Turnstile> K i p\\<close>\n    by simp\n  then show \\<open>M, w \\<Turnstile> K i (K i p)\\<close>\n    by simp\nqed\n\ntheorem neg_introspection:\n  assumes \\<open>symmetric M\\<close> \\<open>transitive M\\<close> \\<open>w \\<in> \\<W> M\\<close>\n  shows \\<open>M, w \\<Turnstile> \\<^bold>\\<not> K i p \\<^bold>\\<longrightarrow> K i (\\<^bold>\\<not> K i p)\\<close>\nproof\n  assume \\<open>M, w \\<Turnstile> \\<^bold>\\<not> (K i p)\\<close>\n  then obtain u where \\<open>u \\<in> \\<K> M i w\\<close> \\<open>\\<not> (M, u \\<Turnstile> p)\\<close> \\<open>u \\<in> \\<W> M\\<close>\n    by auto\n  moreover have \\<open>\\<forall>v \\<in> \\<W> M \\<inter> \\<K> M i w. u \\<in> \\<W> M \\<inter> \\<K> M i v\\<close>\n    using \\<open>u \\<in> \\<K> M i w\\<close> \\<open>symmetric M\\<close> \\<open>transitive M\\<close> \\<open>u \\<in> \\<W> M\\<close> \\<open>w \\<in> \\<W> M\\<close>\n    unfolding symmetric_def transitive_def by blast\n  ultimately have \\<open>\\<forall>v \\<in> \\<W> M \\<inter> \\<K> M i w. M, v \\<Turnstile> \\<^bold>\\<not> K i p\\<close>\n    by auto\n  then show \\<open>M, w \\<Turnstile> K i (\\<^bold>\\<not> K i p)\\<close>\n    by simp\nqed\n\nsection \\<open>Normal Modal Logic\\<close>\n\nprimrec eval :: \\<open>(id \\<Rightarrow> bool) \\<Rightarrow> ('i fm \\<Rightarrow> bool) \\<Rightarrow> 'i fm \\<Rightarrow> bool\\<close> where\n  \\<open>eval _ _ \\<^bold>\\<bottom> = False\\<close>\n| \\<open>eval g _ (Pro x) = g x\\<close>\n| \\<open>eval g h (p \\<^bold>\\<or> q) = (eval g h p \\<or> eval g h q)\\<close>\n| \\<open>eval g h (p \\<^bold>\\<and> q) = (eval g h p \\<and> eval g h q)\\<close>\n| \\<open>eval g h (p \\<^bold>\\<longrightarrow> q) = (eval g h p \\<longrightarrow> eval g h q)\\<close>\n| \\<open>eval _ h (K i p) = h (K i p)\\<close>\n| \\<open>eval _ h (Ev g p) = h (Ev g p)\\<close>\n| \\<open>eval _ h (Co g p) = h (Co g p)\\<close>\n\nabbreviation \\<open>tautology p \\<equiv> \\<forall>g h. eval g h p\\<close>\n\nabbreviation \\<open>unfold_Ev g p \\<equiv> foldr (\\<lambda> i. (\\<^bold>\\<and>) (K i p)) g \\<^bold>\\<top>\\<close>\n\ninductive AK :: \\<open>('i fm \\<Rightarrow> bool) \\<Rightarrow> 'i fm \\<Rightarrow> bool\\<close> (\\<open>_ \\<turnstile> _\\<close> [50, 50] 50)\n  for A :: \\<open>'i fm \\<Rightarrow> bool\\<close> where\n    A1: \\<open>tautology p \\<Longrightarrow> A \\<turnstile> p\\<close>\n  | A2: \\<open>A \\<turnstile> K i p \\<^bold>\\<and> K i (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> K i q\\<close>\n  | Ax: \\<open>A p \\<Longrightarrow> A \\<turnstile> p\\<close>\n  | R1: \\<open>A \\<turnstile> p \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<Longrightarrow> A \\<turnstile> q\\<close>\n  | R2: \\<open>A \\<turnstile> p \\<Longrightarrow> A \\<turnstile> K i p\\<close>\n(*group operator axioms*)\n  | C1a: \\<open>A \\<turnstile> Ev g p \\<^bold>\\<longrightarrow> unfold_Ev g p\\<close>\n  | C1b: \\<open>A \\<turnstile> unfold_Ev g p \\<^bold>\\<longrightarrow> Ev g p\\<close>\n  | C2: \\<open>A \\<turnstile> Co g p \\<^bold>\\<longrightarrow> Ev g (p \\<^bold>\\<and> Co g p)\\<close>\n  | RC1: \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> Ev g (q \\<^bold>\\<and> p) \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<longrightarrow> Co g q\\<close>\n\nprimrec imply :: \\<open>'i fm list \\<Rightarrow> 'i fm \\<Rightarrow> 'i fm\\<close> (infixr \\<open>\\<^bold>\\<leadsto>\\<close> 56) where\n  \\<open>([] \\<^bold>\\<leadsto> q) = q\\<close>\n| \\<open>(p # ps \\<^bold>\\<leadsto> q) = (p \\<^bold>\\<longrightarrow> ps \\<^bold>\\<leadsto> q)\\<close>\n\nprimrec disjunct (\\<open>\\<^bold>\\<Or> _\\<close> [59] 60) where\n  \\<open>\\<^bold>\\<Or>[] = \\<^bold>\\<bottom>\\<close> |\n  \\<open>\\<^bold>\\<Or>x # xs = x \\<^bold>\\<or> \\<^bold>\\<Or>xs\\<close>\n\nprimrec conjunct (\\<open>\\<^bold>\\<And> _\\<close> [64] 65) where\n  \\<open>\\<^bold>\\<And>[] = \\<^bold>\\<top>\\<close> |\n  \\<open>\\<^bold>\\<And>x # xs = x \\<^bold>\\<and> \\<^bold>\\<And>xs\\<close>\n\nfun comp where\n  \\<open>comp (\\<^bold>\\<not>p) = p\\<close> |\n  \\<open>comp p = \\<^bold>\\<not>p\\<close>\n\nabbreviation AK_assms (\\<open>_; _ \\<turnstile> _\\<close> [50, 50, 50] 50) where\n  \\<open>A; G \\<turnstile> p \\<equiv> \\<exists>qs. set qs \\<subseteq> G \\<and> (A \\<turnstile> qs \\<^bold>\\<leadsto> p)\\<close>\n\nsection \\<open>Soundness\\<close>\n\nlemma eval_semantics:\n  \\<open>eval (pi w) (\\<lambda>q. \\<lparr>\\<W> = W, \\<K> = r, \\<pi> = pi\\<rparr>, w \\<Turnstile> q) p = (\\<lparr>\\<W> = W, \\<K> = r, \\<pi> = pi\\<rparr>, w \\<Turnstile> p)\\<close>\n  by (induct p) simp_all\n\nlemma tautology:\n  assumes \\<open>tautology p\\<close>\n  shows \\<open>M, w \\<Turnstile> p\\<close>\nproof -\n  from assms have \\<open>eval (g w) (\\<lambda>q. \\<lparr>\\<W> = W, \\<K> = r, \\<pi> = g\\<rparr>, w \\<Turnstile> q) p\\<close> for W g r\n    by simp\n  then have \\<open>\\<lparr>\\<W> = W, \\<K> = r, \\<pi> = g\\<rparr>, w \\<Turnstile> p\\<close> for W g r\n    using eval_semantics by fast\n  then show \\<open>M, w \\<Turnstile> p\\<close>\n    by (metis kripke.cases)\nqed\n\nlemma Ev_n_conE1: \\<open>M, w \\<Turnstile> Ev_n g (p \\<^bold>\\<and> q) n \\<Longrightarrow> M, w \\<Turnstile> Ev_n g p n\\<close>\n  by (induct n arbitrary: w) auto\n\ntheorem soundness:\n  assumes \\<open>\\<And>M w p. A p \\<Longrightarrow> P M \\<Longrightarrow> w \\<in> \\<W> M \\<Longrightarrow> M, w \\<Turnstile> p\\<close>\n  shows \\<open>A \\<turnstile> p \\<Longrightarrow> P M \\<Longrightarrow> w \\<in> \\<W> M \\<Longrightarrow> M, w \\<Turnstile> p\\<close>\nproof (induct p arbitrary: w rule: AK.induct)\n  case (C1a g p)\n  have \\<open>M, w \\<Turnstile> unfold_Ev g p\\<close> if 1: \\<open>M, w \\<Turnstile> Ev g p\\<close>\n  proof -\n    from 1 have \\<open>\\<forall>i \\<in> set g. M, w \\<Turnstile> K i p\\<close> by auto \n    thus ?thesis\n    proof (induct g)\n      case (Cons a as)\n      have \\<open>M, w \\<Turnstile> K a p\\<close>\n        by (meson Cons.prems list.set_intros(1))\n      moreover have \\<open>M, w \\<Turnstile> foldr (\\<lambda> i. (\\<^bold>\\<and>) (K i p)) as \\<^bold>\\<top>\\<close>\n        using Cons.hyps Cons.prems by auto\n      ultimately show ?case by auto \n    qed simp\n  qed\n  thus ?case by simp\nnext\n  case (C1b g p)\n  have \\<open>(M, w \\<Turnstile> unfold_Ev g p) \\<Longrightarrow> (M, w \\<Turnstile> Ev g p)\\<close>\n  proof (induct g)\n    case (Cons a as)\n    have \\<open>M, w \\<Turnstile> K a p\\<close>\n      using Cons.prems by fastforce \n    thus ?case\n      using Cons.hyps Cons.prems by auto \n  qed simp\n  thus ?case by simp\nnext\n  case (C2 g p)\n  then show ?case\n    by fastforce\nnext\n  case (RC1 p g q)\n  then have fix_point: \\<open>\\<forall> v. v \\<in> \\<W> M \\<longrightarrow> M, v \\<Turnstile> p \\<longrightarrow> M, v \\<Turnstile> Ev g (q \\<^bold>\\<and> p)\\<close> \n    by (metis semantics.simps(5))\n  have \\<open>n \\<ge> 1 \\<Longrightarrow> w \\<in> \\<W> M \\<Longrightarrow>  M, w \\<Turnstile> p \\<Longrightarrow> M, w \\<Turnstile> Ev_n g (q \\<^bold>\\<and> p) n\\<close> for n\n  proof (induct n arbitrary: w)\n    case (Suc n)\n    consider (n_0) \\<open>n = 0\\<close> | (n_Suc) \\<open>1 \\<le> n\\<close> \n      by linarith\n    then show ?case \n      using Suc fix_point by cases auto\n  qed simp\n  then show ?case \n    using RC1(4) Ev_n_conE1 by fastforce\nqed (auto simp: assms tautology) \n\n\nsection \\<open>Derived rules\\<close>\n\nlemma imp_chain: \\<open>A \\<turnstile> a \\<^bold>\\<longrightarrow> b \\<Longrightarrow> A \\<turnstile> b \\<^bold>\\<longrightarrow> c \\<Longrightarrow> A \\<turnstile> a \\<^bold>\\<longrightarrow> c\\<close>\nproof-\n  assume \\<open>A \\<turnstile> a \\<^bold>\\<longrightarrow> b\\<close>\n  moreover assume \\<open>A \\<turnstile> b \\<^bold>\\<longrightarrow> c\\<close>\n  moreover have \\<open>A \\<turnstile> (a \\<^bold>\\<longrightarrow> b) \\<^bold>\\<longrightarrow> (b \\<^bold>\\<longrightarrow> c) \\<^bold>\\<longrightarrow> (a \\<^bold>\\<longrightarrow> c)\\<close>\n    using A1 by force\n  ultimately show \\<open>A \\<turnstile> a \\<^bold>\\<longrightarrow> c\\<close>\n    using R1 by metis\nqed\n\nlemma con_imp: \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<Longrightarrow> A \\<turnstile> a \\<^bold>\\<longrightarrow> b \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<and> a \\<^bold>\\<longrightarrow> q \\<^bold>\\<and> b\\<close> \nproof-\n  assume a1: \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q\\<close>\n  moreover assume a2: \\<open>A \\<turnstile> a \\<^bold>\\<longrightarrow> b\\<close>\n  moreover have \\<open>A \\<turnstile> (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> (a \\<^bold>\\<longrightarrow> b) \\<^bold>\\<longrightarrow> p \\<^bold>\\<and> a \\<^bold>\\<longrightarrow> q \\<^bold>\\<and> b\\<close>\n    using A1 by force \n  ultimately show ?thesis\n    using R1 by blast\nqed\n  \nlemma Ev_n_eval: \\<open>i \\<in> set g \\<Longrightarrow> eval f h (unfold_Ev g p) \\<Longrightarrow> eval f h (K i p)\\<close>\n  by (induct g) auto\n\nlemma EvExt: \\<open>set g \\<subseteq> set g' \\<Longrightarrow> A \\<turnstile> Ev g' p \\<^bold>\\<longrightarrow> Ev g p\\<close>\nproof-\n  assume a:\\<open>set g \\<subseteq> set g'\\<close>\n  have \\<open>set g \\<subseteq> set g' \\<Longrightarrow> tautology (unfold_Ev g' p \\<^bold>\\<longrightarrow> unfold_Ev g p)\\<close> \n  proof (rule allI, rule allI)\n    fix f h\n    assume \\<open>set g \\<subseteq> set g'\\<close>\n    moreover have \\<open>set g \\<subseteq> set g' \\<Longrightarrow> eval f h (unfold_Ev g' p) \\<Longrightarrow> eval f h (unfold_Ev g p)\\<close>\n    proof (induct g)\n      case (Cons i g)\n      then show ?case \n        using Cons Ev_n_eval by auto\n    qed simp\n    ultimately show \\<open>eval f h (unfold_Ev g' p \\<^bold>\\<longrightarrow> unfold_Ev g p)\\<close>\n      by simp\n  qed\n  then show ?thesis\n    by (metis a A1 C1a C1b imp_chain)\nqed\n\nlemma CoExt: \\<open>A \\<turnstile> Co g' p \\<^bold>\\<longrightarrow> Co g p\\<close> if a: \\<open>set g \\<subseteq> set g'\\<close>\nproof-\n  have \\<open>A \\<turnstile> Co g' p \\<^bold>\\<longrightarrow> Ev g' (p \\<^bold>\\<and> Co g' p)\\<close> ..\n  moreover have \\<open>A \\<turnstile> Ev g' (p \\<^bold>\\<and> Co g' p) \\<^bold>\\<longrightarrow> Ev g (p \\<^bold>\\<and> Co g' p)\\<close>\n    using a EvExt by fast\n  ultimately have \\<open>A \\<turnstile> Co g' p \\<^bold>\\<longrightarrow> Ev g (p \\<^bold>\\<and> Co g' p)\\<close>\n    using imp_chain by auto\n  then show ?thesis ..\nqed\n\nlemma empty_fold: \\<open>foldr (\\<lambda>i. (\\<^bold>\\<and>) (K i p)) [] \\<^bold>\\<top> = \\<^bold>\\<top>\\<close> \n  by simp\n\nlemma Ev_empty_group: \\<open>A \\<turnstile> Ev [] p\\<close> \nproof-\n  have \\<open>A \\<turnstile> \\<^bold>\\<top> \\<^bold>\\<longrightarrow> Ev [] p\\<close>\n    using C1b empty_fold by metis\n  then show ?thesis\n    using A1 R1 C1b eval.simps(5) by blast\nqed\n\nlemma con_rule: \\<open>A \\<turnstile> p \\<Longrightarrow> A \\<turnstile> q \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<and> q\\<close>\nproof-\n  assume \\<open>A \\<turnstile> p\\<close>\n  moreover assume \\<open>A \\<turnstile> q\\<close>\n  moreover have \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<^bold>\\<longrightarrow> p \\<^bold>\\<and> q\\<close>\n    using A1 by force\n  ultimately show ?thesis\n    using R1 by blast\nqed\n\nlemma Ev_R2: \\<open>A \\<turnstile> p \\<Longrightarrow> A \\<turnstile> Ev g p\\<close>\nproof (induct g)\n  case Nil\n  then show ?case \n    using Ev_empty_group by fast\nnext\n  case (Cons i g)\n  then have \\<open>A \\<turnstile> K i p\\<close> \n    using R2 by simp\n  moreover have \\<open>A \\<turnstile> unfold_Ev g p\\<close>\n    using Cons C1a R1 by blast\n  ultimately have \\<open>A \\<turnstile> unfold_Ev (i # g) p\\<close>\n    using con_rule by auto\n  then show ?case \n    using C1b R1 by blast\nqed\n\nlemma conE1: \\<open>A \\<turnstile> p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> p\\<close>\n  using A1 R1 by force\n\nlemma conE2: \\<open>A \\<turnstile> p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> q\\<close>\n  using A1 R1 by force\n\nlemma con_imp2: \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<longrightarrow> r \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<^bold>\\<and> r\\<close>\n  by (metis A1 con_imp eval.simps(4) eval.simps(5) imp_chain)\n\nlemma Ev_A2: \\<open>A \\<turnstile> Ev g p \\<^bold>\\<and> Ev g (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> Ev g q\\<close>\nproof (induct g)\n  case Nil\n  then show ?case \n    using Ev_empty_group A1 R1 by force\nnext\n  case (Cons i g)\n  have 1: \\<open>A \\<turnstile> Ev (i # g) p \\<^bold>\\<and> Ev (i # g) (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> unfold_Ev (i # g) p \\<^bold>\\<and> unfold_Ev (i # g) (p \\<^bold>\\<longrightarrow> q)\\<close>\n    using C1a con_imp by blast\n  moreover have \\<open>A \\<turnstile> unfold_Ev (i # g) p \\<^bold>\\<and> unfold_Ev (i # g) (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> unfold_Ev g p \\<^bold>\\<and> unfold_Ev g (p \\<^bold>\\<longrightarrow> q)\\<close>\n    using conE2 con_imp by fastforce\n  moreover have \\<open>A \\<turnstile> unfold_Ev g p \\<^bold>\\<and> unfold_Ev g (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> Ev g p \\<^bold>\\<and> Ev g (p \\<^bold>\\<longrightarrow> q)\\<close>\n    using C1b con_imp by blast\n  moreover have \\<open>A \\<turnstile> Ev g q \\<^bold>\\<longrightarrow> unfold_Ev g q\\<close>\n    using C1a .\n  ultimately have 2: \\<open>A \\<turnstile> Ev (i # g) p \\<^bold>\\<and> Ev (i # g) (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> unfold_Ev g q\\<close>\n    using Cons imp_chain by blast\n  have \\<open>A \\<turnstile> unfold_Ev (i # g) p \\<^bold>\\<and> unfold_Ev (i # g) (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> K i p \\<^bold>\\<and> K i (p \\<^bold>\\<longrightarrow> q)\\<close>\n    using conE1 con_imp by fastforce\n  moreover have \\<open>A \\<turnstile> K i p \\<^bold>\\<and> K i (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> K i q\\<close> \n    using A2 .\n  ultimately have \\<open>A \\<turnstile> Ev (i # g) p \\<^bold>\\<and> Ev (i # g) (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> K i q\\<close>\n    using 1 A2 imp_chain by blast\n  from this 2 have \\<open>A \\<turnstile> Ev (i # g) p \\<^bold>\\<and> Ev (i # g) (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> unfold_Ev (i # g) q\\<close> \n    using con_imp2 by auto\n  then show ?case \n    using imp_chain C1b by blast\nqed\n\nlemma con_imp_antecedents: \\<open>(A \\<turnstile> p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> r) = (A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<^bold>\\<longrightarrow> r)\\<close>\nproof (rule iffI)\n  assume \\<open>A \\<turnstile> p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> r\\<close>\n  moreover have \\<open>A \\<turnstile> (p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> r) \\<^bold>\\<longrightarrow> p \\<^bold>\\<longrightarrow> q \\<^bold>\\<longrightarrow> r\\<close>\n    using A1 by force\n  ultimately show \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<^bold>\\<longrightarrow> r\\<close>\n    using R1 by auto\nnext\n  assume \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<^bold>\\<longrightarrow> r\\<close>\n  moreover have \\<open>A \\<turnstile> (p \\<^bold>\\<longrightarrow> q \\<^bold>\\<longrightarrow> r) \\<^bold>\\<longrightarrow> p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> r\\<close>\n    using A1 by force\n  ultimately show \\<open>A \\<turnstile> p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> r\\<close>\n    using R1 by auto\nqed\n\nlemma swap_antecedents: \\<open>(A \\<turnstile> p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> r) = (A \\<turnstile> q \\<^bold>\\<and> p \\<^bold>\\<longrightarrow> r)\\<close>\n  using conE1 conE2 con_imp2 imp_chain by blast\n\nlemma Ev_conE1: \\<open>A \\<turnstile> Ev g (p \\<^bold>\\<and> q) \\<^bold>\\<longrightarrow> Ev g p\\<close> \nproof-\n  have \\<open>A \\<turnstile> Ev g (p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> p)\\<close>\n    using conE1 Ev_R2 by fast\n  moreover have \\<open>A \\<turnstile> Ev g (p \\<^bold>\\<and> q) \\<^bold>\\<and> Ev g (p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> p) \\<^bold>\\<longrightarrow> Ev g p\\<close>\n    using Ev_A2 by auto\n  ultimately show ?thesis\n    using con_imp_antecedents swap_antecedents R1 by fast\nqed\n\nlemma Ev_conE2: \\<open>A \\<turnstile> Ev g (p \\<^bold>\\<and> q) \\<^bold>\\<longrightarrow> Ev g q\\<close> \nproof-\n  have \\<open>A \\<turnstile> Ev g (p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> q)\\<close>\n    using conE2 Ev_R2 by fast\n  moreover have \\<open>A \\<turnstile> Ev g (p \\<^bold>\\<and> q) \\<^bold>\\<and> Ev g (p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> Ev g q\\<close>\n    using Ev_A2 by auto\n  ultimately show ?thesis\n    using con_imp_antecedents swap_antecedents R1 by fast\nqed\n\nlemma Co_imp_Ev_n: \\<open>n \\<ge> 1 \\<Longrightarrow> A \\<turnstile> Co g p \\<^bold>\\<longrightarrow> Ev_n g p n\\<close> \nproof (induct n rule: less_induct)\n  case (less n')\n  then consider (n'_eq_1)\\<open>n' = 1\\<close> | (n'_geq_2)\\<open>n' > 1\\<close>\n    by linarith\n  then show ?case\n  proof cases\n    case n'_eq_1\n    have \\<open>A \\<turnstile> Co g p \\<^bold>\\<longrightarrow> Ev g (p \\<^bold>\\<and> Co g p)\\<close>\n      using C2 by auto\n    moreover have \\<open>A \\<turnstile> Ev g (p \\<^bold>\\<and> Co g p) \\<^bold>\\<longrightarrow> Ev g p\\<close>\n      using Ev_conE1 by auto\n    ultimately show ?thesis\n      using n'_eq_1 imp_chain by auto\n  next\n    case n'_geq_2\n    then have \\<open>A \\<turnstile> Co g p \\<^bold>\\<longrightarrow> Ev_n g p (n' - 1)\\<close> \n      using less by simp\n    then have 1: \\<open>A \\<turnstile> Ev g (Co g p \\<^bold>\\<longrightarrow> Ev_n g p (n' - 1))\\<close>\n      by (simp add: Ev_R2)\n    have \\<open>A \\<turnstile> Co g p \\<^bold>\\<longrightarrow> Ev g (p \\<^bold>\\<and> Co g p)\\<close> ..\n    then have 2:\\<open>A \\<turnstile> Co g p \\<^bold>\\<longrightarrow> Ev g (Co g p)\\<close> \n      using imp_chain Ev_conE2 by blast\n    have \\<open>A \\<turnstile> \n      Ev g (Co g p) \\<^bold>\\<and> Ev g (Co g p \\<^bold>\\<longrightarrow> Ev_n g p (n' - 1)) \\<^bold>\\<longrightarrow> Ev g (Ev_n g p (n' - 1))\\<close>\n      using Ev_A2 by auto\n    then have \\<open>A \\<turnstile> Ev g (Co g p) \\<^bold>\\<longrightarrow> Ev g (Ev_n g p (n' - 1))\\<close>\n      using 1 R1 swap_antecedents con_imp_antecedents by blast\n    moreover have \\<open>Ev g (Ev_n g p (n' - 1)) = Ev_n g p n'\\<close> \n      by (metis Ev_n.simps(2) Suc_eq_plus1 add.commute le_add_diff_inverse less.prems)\n    ultimately show ?thesis \n      using 2 imp_chain by auto\n  qed\nqed\n\nlemma K_A2': \\<open>A \\<turnstile> K i (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> K i p \\<^bold>\\<longrightarrow> K i q\\<close>\nproof -\n  have \\<open>A \\<turnstile> K i p \\<^bold>\\<and> K i (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> K i q\\<close>\n    using A2 by fast\n  moreover have \\<open>A \\<turnstile> (P \\<^bold>\\<and> Q \\<^bold>\\<longrightarrow> R) \\<^bold>\\<longrightarrow> (Q \\<^bold>\\<longrightarrow> P \\<^bold>\\<longrightarrow> R)\\<close> for P Q R\n    by (simp add: A1)\n  ultimately show ?thesis\n    using R1 by fast\nqed\n\nlemma K_map:\n  assumes \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q\\<close>\n  shows \\<open>A \\<turnstile> K i p \\<^bold>\\<longrightarrow> K i q\\<close>\nproof -\n  note \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q\\<close>\n  then have \\<open>A \\<turnstile> K i (p \\<^bold>\\<longrightarrow> q)\\<close>\n    using R2 by fast\n  moreover have \\<open>A \\<turnstile> K i (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> K i p \\<^bold>\\<longrightarrow> K i q\\<close>\n    using K_A2' by fast\n  ultimately show ?thesis\n    using R1 by fast\nqed\n\nlemma K_LK: \\<open>A \\<turnstile> (L i (\\<^bold>\\<not> p) \\<^bold>\\<longrightarrow> \\<^bold>\\<not> K i p)\\<close>\nproof -\n  have \\<open>A \\<turnstile> (p \\<^bold>\\<longrightarrow> \\<^bold>\\<not> \\<^bold>\\<not> p)\\<close>\n    by (simp add: A1)\n  moreover have \\<open>A \\<turnstile> ((P \\<^bold>\\<longrightarrow> Q) \\<^bold>\\<longrightarrow> (\\<^bold>\\<not> Q \\<^bold>\\<longrightarrow> \\<^bold>\\<not> P))\\<close> for P Q\n    using A1 by force\n  ultimately show ?thesis\n    using K_map R1 by fast\nqed\n\nlemma K_imply_head: \\<open>A \\<turnstile> (p # ps \\<^bold>\\<leadsto> p)\\<close>\nproof -\n  have \\<open>tautology (p # ps \\<^bold>\\<leadsto> p)\\<close>\n    by (induct ps) simp_all\n  then show ?thesis\n    using A1 by blast\nqed\n\nlemma K_imply_Cons:\n  assumes \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> q\\<close>\n  shows \\<open>A \\<turnstile> p # ps \\<^bold>\\<leadsto> q\\<close>\nproof -\n  have \\<open>A \\<turnstile> (ps \\<^bold>\\<leadsto> q \\<^bold>\\<longrightarrow> p # ps \\<^bold>\\<leadsto> q)\\<close>\n    by (simp add: A1)\n  with R1 assms show ?thesis .\nqed\n\nlemma K_right_mp:\n  assumes \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> p\\<close> \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> (p \\<^bold>\\<longrightarrow> q)\\<close>\n  shows \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> q\\<close>\nproof -\n  have \\<open>tautology (ps \\<^bold>\\<leadsto> p \\<^bold>\\<longrightarrow> ps \\<^bold>\\<leadsto> (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> ps \\<^bold>\\<leadsto> q)\\<close>\n    by (induct ps) simp_all\n  with A1 have \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> p \\<^bold>\\<longrightarrow> ps \\<^bold>\\<leadsto> (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> ps \\<^bold>\\<leadsto> q\\<close> .\n  then show ?thesis\n    using assms R1 by blast\nqed\n\nlemma tautology_imply_superset:\n  assumes \\<open>set ps \\<subseteq> set qs\\<close>\n  shows \\<open>tautology (ps \\<^bold>\\<leadsto> r \\<^bold>\\<longrightarrow> qs \\<^bold>\\<leadsto> r)\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> tautology (ps \\<^bold>\\<leadsto> r \\<^bold>\\<longrightarrow> qs \\<^bold>\\<leadsto> r)\\<close>\n  then obtain g h where \\<open>\\<not> eval g h (ps \\<^bold>\\<leadsto> r \\<^bold>\\<longrightarrow> qs \\<^bold>\\<leadsto> r)\\<close>\n    by blast\n  then have \\<open>eval g h (ps \\<^bold>\\<leadsto> r)\\<close> \\<open>\\<not> eval g h (qs \\<^bold>\\<leadsto> r)\\<close>\n    by simp_all\n  then consider (np) \\<open>\\<exists>p \\<in> set ps. \\<not> eval g h p\\<close> | (r) \\<open>\\<forall>p \\<in> set ps. eval g h p\\<close> \\<open>eval g h r\\<close>\n    by (induct ps) auto\n  then show False\n  proof cases\n    case np\n    then have \\<open>\\<exists>p \\<in> set qs. \\<not> eval g h p\\<close>\n      using \\<open>set ps \\<subseteq> set qs\\<close> by blast\n    then have \\<open>eval g h (qs \\<^bold>\\<leadsto> r)\\<close>\n      by (induct qs) simp_all\n    then show ?thesis\n      using \\<open>\\<not> eval g h (qs \\<^bold>\\<leadsto> r)\\<close> by blast\n  next\n    case r\n    then have \\<open>eval g h (qs \\<^bold>\\<leadsto> r)\\<close>\n      by (induct qs) simp_all\n    then show ?thesis\n      using \\<open>\\<not> eval g h (qs \\<^bold>\\<leadsto> r)\\<close> by blast\n  qed\nqed\n\nlemma K_imply_weaken:\n  assumes \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> q\\<close> \\<open>set ps \\<subseteq> set ps'\\<close>\n  shows \\<open>A \\<turnstile> ps' \\<^bold>\\<leadsto> q\\<close>\nproof -\n  have \\<open>tautology (ps \\<^bold>\\<leadsto> q \\<^bold>\\<longrightarrow> ps' \\<^bold>\\<leadsto> q)\\<close>\n    using \\<open>set ps \\<subseteq> set ps'\\<close> tautology_imply_superset by blast\n  then have \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> q \\<^bold>\\<longrightarrow> ps' \\<^bold>\\<leadsto> q\\<close>\n    using A1 by blast\n  then show ?thesis\n    using \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> q\\<close> R1 by blast\nqed\n\nlemma imply_append: \\<open>(ps @ ps' \\<^bold>\\<leadsto> q) = (ps \\<^bold>\\<leadsto> ps' \\<^bold>\\<leadsto> q)\\<close>\n  by (induct ps) simp_all\n\nlemma K_ImpI:\n  assumes \\<open>A \\<turnstile> p # G \\<^bold>\\<leadsto> q\\<close>\n  shows \\<open>A \\<turnstile> G \\<^bold>\\<leadsto> (p \\<^bold>\\<longrightarrow> q)\\<close>\nproof -\n  have \\<open>set (p # G) \\<subseteq> set (G @ [p])\\<close>\n    by simp\n  then have \\<open>A \\<turnstile> G @ [p] \\<^bold>\\<leadsto> q\\<close>\n    using assms K_imply_weaken by blast\n  then have \\<open>A \\<turnstile> G \\<^bold>\\<leadsto> [p] \\<^bold>\\<leadsto> q\\<close>\n    using imply_append by metis\n  then show ?thesis\n    by simp\nqed\n\nlemma K_Boole:\n  assumes \\<open>A \\<turnstile> (\\<^bold>\\<not> p) # G \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n  shows \\<open>A \\<turnstile> G \\<^bold>\\<leadsto> p\\<close>\nproof -\n  have \\<open>A \\<turnstile> G \\<^bold>\\<leadsto> \\<^bold>\\<not> \\<^bold>\\<not> p\\<close>\n    using assms K_ImpI by blast\n  moreover have \\<open>tautology (G \\<^bold>\\<leadsto> \\<^bold>\\<not> \\<^bold>\\<not> p \\<^bold>\\<longrightarrow> G \\<^bold>\\<leadsto> p)\\<close>\n    by (induct G) simp_all\n  then have \\<open>A \\<turnstile> (G \\<^bold>\\<leadsto> \\<^bold>\\<not> \\<^bold>\\<not> p \\<^bold>\\<longrightarrow> G \\<^bold>\\<leadsto> p)\\<close>\n    using A1 by blast\n  ultimately show ?thesis\n    using R1 by blast\nqed\n\nlemma K_DisE:\n  assumes \\<open>A \\<turnstile> p # G \\<^bold>\\<leadsto> r\\<close> \\<open>A \\<turnstile> q # G \\<^bold>\\<leadsto> r\\<close> \\<open>A \\<turnstile> G \\<^bold>\\<leadsto> p \\<^bold>\\<or> q\\<close>\n  shows \\<open>A \\<turnstile> G \\<^bold>\\<leadsto> r\\<close>\nproof -\n  have \\<open>tautology (p # G \\<^bold>\\<leadsto> r \\<^bold>\\<longrightarrow> q # G \\<^bold>\\<leadsto> r \\<^bold>\\<longrightarrow> G \\<^bold>\\<leadsto> p \\<^bold>\\<or> q \\<^bold>\\<longrightarrow> G \\<^bold>\\<leadsto> r)\\<close>\n    by (induct G) auto\n  then have \\<open>A \\<turnstile> p # G \\<^bold>\\<leadsto> r \\<^bold>\\<longrightarrow> q # G \\<^bold>\\<leadsto> r \\<^bold>\\<longrightarrow> G \\<^bold>\\<leadsto> p \\<^bold>\\<or> q \\<^bold>\\<longrightarrow> G \\<^bold>\\<leadsto> r\\<close>\n    using A1 by blast\n  then show ?thesis\n    using assms R1 by blast\nqed\n\nlemma K_mp: \\<open>A \\<turnstile> p # (p \\<^bold>\\<longrightarrow> q) # G \\<^bold>\\<leadsto> q\\<close>\n  by (meson K_imply_head K_imply_weaken K_right_mp set_subset_Cons)\n\nlemma K_swap:\n  assumes \\<open>A \\<turnstile> p # q # G \\<^bold>\\<leadsto> r\\<close>\n  shows \\<open>A \\<turnstile> q # p # G \\<^bold>\\<leadsto> r\\<close>\n  using assms K_ImpI by (metis imply.simps(1-2))\n\nlemma K_DisL:\n  assumes \\<open>A \\<turnstile> p # ps \\<^bold>\\<leadsto> q\\<close> \\<open>A \\<turnstile> p' # ps \\<^bold>\\<leadsto> q\\<close>\n  shows \\<open>A \\<turnstile> (p \\<^bold>\\<or> p') # ps \\<^bold>\\<leadsto> q\\<close>\nproof -\n  have \\<open>A \\<turnstile> p # (p \\<^bold>\\<or> p') # ps \\<^bold>\\<leadsto> q\\<close> \\<open>A \\<turnstile> p' # (p \\<^bold>\\<or> p') # ps \\<^bold>\\<leadsto> q\\<close>\n    using assms K_swap K_imply_Cons by blast+\n  moreover have \\<open>A \\<turnstile> (p \\<^bold>\\<or> p') # ps \\<^bold>\\<leadsto> p \\<^bold>\\<or> p'\\<close>\n    using K_imply_head by blast\n  ultimately show ?thesis\n    using K_DisE by blast\nqed\n\nlemma K_distrib_K_imp:\n  assumes \\<open>A \\<turnstile> K i (G \\<^bold>\\<leadsto> q)\\<close>\n  shows \\<open>A \\<turnstile> map (K i) G \\<^bold>\\<leadsto> K i q\\<close>\nproof -\n  have \\<open>A \\<turnstile> (K i (G \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> map (K i) G \\<^bold>\\<leadsto> K i q)\\<close>\n  proof (induct G)\n    case Nil\n    then show ?case\n      by (simp add: A1)\n  next\n    case (Cons a G)\n    have \\<open>A \\<turnstile> K i a \\<^bold>\\<and> K i (a # G \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> K i (G \\<^bold>\\<leadsto> q)\\<close>\n      by (simp add: A2)\n    moreover have\n      \\<open>A \\<turnstile> ((K i a \\<^bold>\\<and> K i (a # G \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> K i (G \\<^bold>\\<leadsto> q)) \\<^bold>\\<longrightarrow>\n        (K i (G \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> map (K i) G \\<^bold>\\<leadsto> K i q) \\<^bold>\\<longrightarrow>\n        (K i a \\<^bold>\\<and> K i (a # G \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> map (K i) G \\<^bold>\\<leadsto> K i q))\\<close>\n      by (simp add: A1)\n    ultimately have \\<open>A \\<turnstile> K i a \\<^bold>\\<and> K i (a # G \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> map (K i) G \\<^bold>\\<leadsto> K i q\\<close>\n      using Cons R1 by blast\n    moreover have\n      \\<open>A \\<turnstile> ((K i a \\<^bold>\\<and> K i (a # G \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> map (K i) G \\<^bold>\\<leadsto> K i q) \\<^bold>\\<longrightarrow>\n        (K i (a # G \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> K i a \\<^bold>\\<longrightarrow> map (K i) G \\<^bold>\\<leadsto> K i q))\\<close>\n      by (simp add: A1)\n    ultimately have \\<open>A \\<turnstile> (K i (a # G \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> K i a \\<^bold>\\<longrightarrow> map (K i) G \\<^bold>\\<leadsto> K i q)\\<close>\n      using R1 by blast\n    then show ?case\n      by simp\n  qed\n  then show ?thesis\n    using assms R1 by blast\nqed\n\nlemma K_trans: \\<open>A \\<turnstile> (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> (q \\<^bold>\\<longrightarrow> r) \\<^bold>\\<longrightarrow> p \\<^bold>\\<longrightarrow> r\\<close>\n  by (auto intro: A1)\n\nlemma K_L_comp: \\<open>A \\<turnstile> \\<^bold>\\<not> L i (\\<^bold>\\<not> p) \\<^bold>\\<longrightarrow> K i p\\<close>\nproof -\n  have \\<open>A \\<turnstile> K i p \\<^bold>\\<longrightarrow> K i p\\<close> \\<open>A \\<turnstile> \\<^bold>\\<not> \\<^bold>\\<not> p \\<^bold>\\<longrightarrow> p\\<close>\n    by (auto intro: A1)\n  then have \\<open>A \\<turnstile> K i (\\<^bold>\\<not> \\<^bold>\\<not> p) \\<^bold>\\<longrightarrow> K i p\\<close>\n    by (auto intro: K_map)\n  moreover have \\<open>A \\<turnstile> (P \\<^bold>\\<longrightarrow> Q) \\<^bold>\\<longrightarrow> (\\<^bold>\\<not> \\<^bold>\\<not> P \\<^bold>\\<longrightarrow> Q)\\<close> for P Q\n    by (auto intro: A1)\n  ultimately show \\<open>A \\<turnstile> \\<^bold>\\<not> \\<^bold>\\<not> K i (\\<^bold>\\<not> \\<^bold>\\<not> p) \\<^bold>\\<longrightarrow> K i p\\<close>\n    by (auto intro: R1)\nqed\n\nlemma con_to_imp_assm: \\<open>A \\<turnstile> (p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> r) \\<^bold>\\<longrightarrow> (p \\<^bold>\\<longrightarrow> q \\<^bold>\\<longrightarrow> r)\\<close> \n  by (simp add: A1)\n\nlemma imp_to_con_assm: \\<open>A \\<turnstile> (p \\<^bold>\\<longrightarrow> q \\<^bold>\\<longrightarrow> r) \\<^bold>\\<longrightarrow> (p \\<^bold>\\<and> q \\<^bold>\\<longrightarrow> r)\\<close> \n  by (simp add: A1)\n\nlemma imply_chain: \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> q \\<Longrightarrow> A \\<turnstile> q \\<^bold>\\<longrightarrow> r \\<Longrightarrow> A \\<turnstile> ps \\<^bold>\\<leadsto> r\\<close>\nproof (induct ps)\n  case Nil\n  then show ?case \n    using R1 by auto\nnext\n  case (Cons a ps)\n  then show ?case\n    by (metis K_imply_head K_right_mp R1 imply.simps(2))\nqed\n\nlemma Ev_add_i: \\<open>A \\<turnstile> K i p \\<^bold>\\<longrightarrow> Ev g p \\<^bold>\\<longrightarrow> Ev (i # g) p\\<close> \nproof-\n  have \\<open>A \\<turnstile> Ev g p \\<^bold>\\<longrightarrow> unfold_Ev g p\\<close>\n    by (simp add: C1a)\n  then have \\<open>A \\<turnstile> K i p \\<^bold>\\<longrightarrow> Ev g p \\<^bold>\\<longrightarrow> unfold_Ev g p\\<close>\n    by (meson R1 conE1 con_imp_antecedents imp_chain)\n  then have 1:\\<open>A \\<turnstile> [K i p, Ev g p] \\<^bold>\\<leadsto> unfold_Ev g p\\<close>\n    by simp\n  then have \\<open>A \\<turnstile> [K i p, Ev g p] \\<^bold>\\<leadsto> (K i p \\<^bold>\\<and> unfold_Ev g p)\\<close>\n    by (metis C1a K_imply_head con_imp con_imp_antecedents imply.simps(1) imply.simps(2))\n  then have \\<open>A \\<turnstile> [K i p, Ev g p] \\<^bold>\\<leadsto> (unfold_Ev (i # g) p)\\<close> \n    by simp\n  moreover have \\<open>A \\<turnstile> unfold_Ev (i # g) p \\<^bold>\\<longrightarrow> Ev (i # g) p\\<close> \n    using C1b by blast\n  ultimately have \\<open>A \\<turnstile> [K i p, Ev g p] \\<^bold>\\<leadsto> Ev (i # g) p\\<close> \n    using imply_chain by blast\n  then show ?thesis \n    by simp\nqed\n\nlemma elem_implies_disjunct: \\<open>p \\<in> set ps \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<longrightarrow> \\<^bold>\\<Or>ps\\<close>\nproof (induct ps)\n  case (Cons a ps)\n  then show ?case\n    by (metis A1 disjunct.simps(2) eval.simps(3) eval.simps(5) imp_chain set_ConsD)\nqed simp\n\n\nlemma conjunct_implies_imply: \\<open>A \\<turnstile> (\\<^bold>\\<And> ps \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> (ps \\<^bold>\\<leadsto> q)\\<close> \nproof (induct ps)\n  case Nil\n  then show ?case \n    by (simp add: A1)\nnext\n  case (Cons a ps)\n  then show ?case\n    using con_to_imp_assm imp_chain \n    by (metis con_imp_antecedents conjunct.simps(2) imply.simps(2))\nqed \n\nlemma imply_implies_conjunct: \\<open>A \\<turnstile> (ps \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> (\\<^bold>\\<And>ps \\<^bold>\\<longrightarrow> q)\\<close>\nproof (induct ps)\n  case Nil\n  then show ?case \n    by (simp add: A1)\nnext\n  case (Cons p ps)\n  then have \\<open>A \\<turnstile> (p # ps \\<^bold>\\<leadsto> q) \\<^bold>\\<longrightarrow> (p \\<^bold>\\<longrightarrow> (\\<^bold>\\<And> ps \\<^bold>\\<longrightarrow> q))\\<close>\n    by (metis (mono_tags, opaque_lifting) K_imply_head con_imp_antecedents imp_chain imply.simps(1) imply.simps(2))\n  moreover have \\<open>A \\<turnstile> (p \\<^bold>\\<longrightarrow> (\\<^bold>\\<And> ps \\<^bold>\\<longrightarrow> q)) \\<^bold>\\<longrightarrow> (\\<^bold>\\<And> p # ps \\<^bold>\\<longrightarrow> q)\\<close>\n    by (simp add: imp_to_con_assm)\n  ultimately show ?case \n    using imp_chain by auto\nqed\n\nlemma imply_implies_itself: \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> \\<^bold>\\<And>ps\\<close>\nproof (induct ps)\n  case Nil\n  then show ?case \n    by (simp add: A1)\nnext\n  case (Cons a ps)\n  then show ?case\n    by (metis K_Boole conjunct_implies_imply imply.simps(2))\nqed\n\nlemma unfold_Ev_implies_K: \\<open>i \\<in> set g \\<Longrightarrow> A \\<turnstile> unfold_Ev g p \\<^bold>\\<longrightarrow> K i p\\<close>\nproof (induct g)\n  case (Cons a g)\n  then show ?case \n  by (smt (verit, del_insts) A1 Ev_n_eval eval.simps(5) foldr_cong)\nqed simp\n\nlemma Ev_implies_K: \\<open>i \\<in> set g \\<Longrightarrow> A \\<turnstile> Ev g p \\<^bold>\\<longrightarrow> K i p\\<close>\n  using unfold_Ev_implies_K by (metis C1a imp_chain)\n\nlemma K_implies_combine: \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> q \\<Longrightarrow> A \\<turnstile> ps \\<^bold>\\<leadsto> r \\<Longrightarrow> A \\<turnstile> ps \\<^bold>\\<leadsto> (q \\<^bold>\\<and> r)\\<close>\n  by (metis K_ImpI K_imply_head K_right_mp con_imp_antecedents imply.simps(2))\n\nlemma comp_imp1: \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> \\<^bold>\\<not>(comp p)\\<close> \nproof (cases \\<open>\\<exists> p'. p = \\<^bold>\\<not> p'\\<close>)\n  case True\n  then obtain p' where \\<open>p = \\<^bold>\\<not>p'\\<close> ..\n  then have \\<open>comp p = p'\\<close>\n    by simp\n  then show ?thesis\n    by (simp add: A1 \\<open>p = \\<^bold>\\<not> p'\\<close>)\nnext\n  case False\n  then have \\<open>comp p = \\<^bold>\\<not>p\\<close>\n  proof (cases p)\n    case (Imp p q)\n    then show ?thesis \n      using False by (cases q) auto\n  qed auto\n  then show ?thesis \n    by (simp add: A1)\nqed\n\nlemma comp_imp2: \\<open>A \\<turnstile> \\<^bold>\\<not>(comp p) \\<^bold>\\<longrightarrow> p\\<close> \nproof (cases \\<open>\\<exists> p'. p = \\<^bold>\\<not> p'\\<close>)\n  case True\n  then obtain p' where \\<open>p = \\<^bold>\\<not>p'\\<close> ..\n  then have \\<open>comp p = p'\\<close>\n    by simp\n  then show ?thesis\n    by (metis \\<open>p = \\<^bold>\\<not> p'\\<close> comp_imp1)\nnext\n  case False\n  then have \\<open>comp p = \\<^bold>\\<not>p\\<close>\n  proof (cases p)\n    case (Imp p q)\n    then show ?thesis \n      using False by (cases q) auto\n  qed auto\n  then show ?thesis \n    by (simp add: A1)\nqed\n\nlemma conjunct_implies_elem: \\<open>p \\<in> set ps \\<Longrightarrow> A \\<turnstile> \\<^bold>\\<And> ps \\<^bold>\\<longrightarrow> p\\<close> \n  by (metis K_imply_head R1 imply.simps(2) imply_append imply_implies_conjunct split_list)\n\nlemma conjunction_in_K: \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> K i q \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<longrightarrow> K i r \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<longrightarrow> K i (q \\<^bold>\\<and> r)\\<close> \nproof-\n  have \\<open>A \\<turnstile> K i q \\<^bold>\\<longrightarrow> K i r \\<^bold>\\<longrightarrow> K i (q \\<^bold>\\<and> r)\\<close> \n    by (metis K_A2' K_imply_head K_map con_imp_antecedents imp_chain imply.simps(1) imply.simps(2))\n  then show \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> K i q \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<longrightarrow> K i r \\<Longrightarrow> A \\<turnstile> p \\<^bold>\\<longrightarrow> K i (q \\<^bold>\\<and> r)\\<close>  \n    using con_imp2 con_imp_antecedents imp_chain by blast\nqed\n\nlemma dis_to_imp: \\<open>A \\<turnstile> p \\<^bold>\\<or> q \\<Longrightarrow> A \\<turnstile> \\<^bold>\\<not>q \\<^bold>\\<longrightarrow> p\\<close>\nproof-\n  assume \\<open>A \\<turnstile> p \\<^bold>\\<or> q\\<close>\n  moreover have \\<open>A \\<turnstile> (p \\<^bold>\\<or> q) \\<^bold>\\<longrightarrow> \\<^bold>\\<not>q \\<^bold>\\<longrightarrow> p\\<close>\n    using A1 by force\n  ultimately show ?thesis \n    using R1 by auto\nqed\n\nlemma extract_neg_conjunct: \\<open>A \\<turnstile> (\\<^bold>\\<And> (map (Neg) ps)) \\<^bold>\\<longrightarrow> \\<^bold>\\<not>(\\<^bold>\\<Or> ps)\\<close>\nproof (induct ps)\n  case Nil\n  then show ?case \n    by (metis comp.simps(1) comp_imp2 conjunct.simps(1) disjunct.simps(1) list.simps(8))\nnext\n  case (Cons p ps)\n  then have \\<open>A \\<turnstile> \\<^bold>\\<not>p \\<^bold>\\<and> \\<^bold>\\<And> map Neg ps \\<^bold>\\<longrightarrow> \\<^bold>\\<not>p \\<^bold>\\<and> \\<^bold>\\<not> (\\<^bold>\\<Or> ps)\\<close>\n    by (metis comp.simps(1) comp_imp2 con_imp)\n  moreover have \\<open>A \\<turnstile> \\<^bold>\\<not>p \\<^bold>\\<and> \\<^bold>\\<not> (\\<^bold>\\<Or> ps) \\<^bold>\\<longrightarrow> \\<^bold>\\<not> (p \\<^bold>\\<or> \\<^bold>\\<Or> ps)\\<close>\n    by (simp add: A1)\n  ultimately show ?case \n    using imp_chain by auto\nqed\n\nlemma disjunct_split: \\<open>A \\<turnstile> \\<^bold>\\<Or> (ps @ qs) \\<^bold>\\<longrightarrow> (\\<^bold>\\<Or> (ps)) \\<^bold>\\<or> (\\<^bold>\\<Or> (qs))\\<close>\nproof (induct ps)\n  case Nil\n  then show ?case \n    by (simp add: A1)\nnext\n  case (Cons p ps)\n  moreover have \\<open>A \\<turnstile> (\\<^bold>\\<Or> ps @ qs \\<^bold>\\<longrightarrow> (\\<^bold>\\<Or> ps) \\<^bold>\\<or> \\<^bold>\\<Or> qs) \\<^bold>\\<longrightarrow> p \\<^bold>\\<or> \\<^bold>\\<Or> ps @ qs \\<^bold>\\<longrightarrow> p \\<^bold>\\<or> ((\\<^bold>\\<Or> ps) \\<^bold>\\<or> \\<^bold>\\<Or> qs)\\<close>\n    using A1 by force\n  ultimately have \\<open>A \\<turnstile> p \\<^bold>\\<or> \\<^bold>\\<Or> ps @ qs \\<^bold>\\<longrightarrow> p \\<^bold>\\<or> ((\\<^bold>\\<Or> ps) \\<^bold>\\<or> \\<^bold>\\<Or> qs)\\<close>\n    using R1 by auto\n  then show ?case \n    by (smt (z3) A1 append_Cons disjunct.simps(2) eval.simps(3) eval.simps(5) imp_chain)\nqed\n\nlemma add_assm_and_concl: \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<Longrightarrow> A \\<turnstile> ps \\<^bold>\\<leadsto> \\<^bold>\\<And>qs \\<Longrightarrow> A \\<turnstile> (p # ps) \\<^bold>\\<leadsto> \\<^bold>\\<And>(q # qs)\\<close>\nproof-\n  assume 1:\\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q\\<close>\n  assume 2:\\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> \\<^bold>\\<And>qs\\<close>\n  from 1 have \\<open>A \\<turnstile> \\<^bold>\\<And>qs \\<^bold>\\<longrightarrow> p \\<^bold>\\<longrightarrow> q \\<^bold>\\<and> \\<^bold>\\<And>qs\\<close> \n    by (meson conE1 conE2 con_imp2 con_imp_antecedents imp_chain)\n  then have \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> (p \\<^bold>\\<longrightarrow> q \\<^bold>\\<and> \\<^bold>\\<And>qs)\\<close>\n    using 2 imply_chain by auto\n  then show ?thesis \n    by (metis K_imply_Cons K_imply_head K_right_mp conjunct.simps(2))\nqed\n\nlemma de_morgan_conjunct: \\<open>A \\<turnstile> \\<^bold>\\<not>(\\<^bold>\\<Or>ps) \\<^bold>\\<longrightarrow> \\<^bold>\\<And> map Neg ps\\<close> \nproof (induct ps)\n  case Nil\n  then show ?case \n    by (metis conjunct.simps(1) disjunct.simps(1) extract_neg_conjunct list.simps(8))\nnext\n  case (Cons p ps)\n  moreover have \\<open>A \\<turnstile> (\\<^bold>\\<not> (\\<^bold>\\<Or> ps) \\<^bold>\\<longrightarrow> \\<^bold>\\<And> map Neg ps) \\<^bold>\\<longrightarrow> (\\<^bold>\\<not> (p \\<^bold>\\<or> \\<^bold>\\<Or> ps) \\<^bold>\\<longrightarrow> (\\<^bold>\\<not>p \\<^bold>\\<and> \\<^bold>\\<And> map Neg ps))\\<close>\n    using A1 by force\n  ultimately show ?case \n    using R1 by auto\nqed \n\nlemma R1_leads_to: \\<open>\\<forall> p \\<in> set ps. A \\<turnstile> p \\<Longrightarrow> A \\<turnstile> ps \\<^bold>\\<leadsto> q \\<Longrightarrow> A \\<turnstile> q\\<close> \n  using R1 by (induct ps) auto\n\nlemma leads_to_evalI: \\<open>((\\<forall> p \\<in> set ps. eval g h p) \\<Longrightarrow> eval g h w) \\<Longrightarrow> eval g h (ps \\<^bold>\\<leadsto> w)\\<close> \n  by (induct ps) auto\n\nlemma disjunct_evalI: \\<open>\\<exists> p \\<in> set ps. eval g h p \\<Longrightarrow> eval g h (\\<^bold>\\<Or>ps)\\<close>\n  by (induct ps) auto\n\nlemma disjunct_evalE: \\<open>eval g h (\\<^bold>\\<Or>ps) \\<Longrightarrow> \\<exists> p \\<in> set ps. eval g h p\\<close>\n  by (induct ps) auto\n\nlemma conjunct_evalI: \\<open>\\<forall> p \\<in> set ps. eval g h p \\<Longrightarrow> eval g h (\\<^bold>\\<And>ps)\\<close>\n  by (induct ps) auto\n\nlemma conjunct_evalE: \\<open>eval g h (\\<^bold>\\<And>ps) \\<Longrightarrow> \\<forall> p \\<in> set ps. eval g h p\\<close>\n  by (induct ps) auto\n\nlemma combine_disjunct: \n  assumes \\<open>\\<forall> w'. (\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. p \\<in> set w') \\<longrightarrow> A \\<turnstile> \\<^bold>\\<Or>w'\\<close> \n  shows \\<open>A \\<turnstile> \\<^bold>\\<Or> (map conjunct W)\\<close> \nproof-\n  let ?U = \\<open>\\<Union> (set (map set W))\\<close>\n  let \\<open>?P\\<close> = \\<open>\\<lambda> w'. (\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. p \\<in> w')\\<close>\n  have \\<open>finite {w'. ?P w' \\<and> w' \\<subseteq> ?U}\\<close> \\<open>\\<forall> w' \\<in> {w'. ?P w' \\<and> w' \\<subseteq> ?U}. finite w'\\<close>\n    using finite_subset by fastforce+\n  then obtain W' where W'_def: \\<open>set (map set W') = {w'. ?P w' \\<and> w' \\<subseteq> ?U}\\<close>\n    by (meson list_of_lists_if_finite_set_of_sets)\n  have \\<open>\\<forall> p \\<in> set W'. A \\<turnstile> \\<^bold>\\<Or>p\\<close>\n  proof\n    fix p\n    assume \\<open>p \\<in> set W'\\<close>\n    then have \\<open>?P (set p)\\<close>\n      using W'_def by auto\n    then show \\<open>A \\<turnstile> \\<^bold>\\<Or>p\\<close>\n      using assms by simp\n  qed\n  then have \\<open>\\<forall> p \\<in> set (map disjunct W'). A \\<turnstile> p\\<close> \n    by simp\n  moreover have \\<open>A \\<turnstile> map disjunct W' \\<^bold>\\<leadsto> \\<^bold>\\<Or> (map conjunct W)\\<close>\n  proof (rule A1,rule,rule,rule leads_to_evalI, rule ccontr)\n    fix g h\n    assume a1:\\<open>\\<forall>p\\<in>set (map disjunct W'). eval g h p\\<close>\n    assume \\<open>\\<not>eval g h (\\<^bold>\\<Or> map conjunct W)\\<close>\n    then have \\<open>\\<forall> p \\<in> set (map conjunct W). \\<not>eval g h p\\<close>\n      using disjunct_evalI by blast\n    then have \\<open>\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. \\<not>eval g h p\\<close>\n      using conjunct_evalI by fastforce\n    then have \\<open>\\<exists> w'. (\\<forall> p \\<in> set w'. \\<not>eval g h p) \\<and> ?P (set w') \\<and> set w' \\<subseteq> ?U\\<close>\n    proof (induct W)\n      case Nil\n      then show ?case\n        by simp\n    next\n      case (Cons w W)\n      then obtain w' where \n        \\<open>(\\<forall>p\\<in>set w'. \\<not> eval g h p) \\<and> (\\<forall>w\\<in>set W. \\<exists>p\\<in>set w. p \\<in> set w') \\<and> set w' \\<subseteq> \\<Union> (set (map set W))\\<close> \n        by auto\n      moreover obtain p where \\<open>p \\<in> set w \\<and> \\<not>eval g h p\\<close>\n        using Cons by auto\n      ultimately have \\<open>\n        (\\<forall>p\\<in>set (p # w'). \\<not> eval g h p) \\<and> \n        (\\<forall>w\\<in>set (w # W). \\<exists> p'\\<in>set w. p' \\<in> set (p # w')) \\<and> \n        set (p # w') \\<subseteq> \\<Union> (set (map set (w # W)))\\<close> \n        by auto \n      then show ?case \n        by fast\n    qed\n    then obtain w' where w'_def: \\<open>(\\<forall> p \\<in> set w'. \\<not>eval g h p)\\<close> \\<open>?P (set w') \\<and> set w' \\<subseteq> ?U\\<close>\n      by auto\n    then have \\<open>set w' \\<in> {w'. ?P w' \\<and> w' \\<subseteq> ?U}\\<close> \n      by simp\n    then have \\<open>\\<exists> w'' \\<in> set W'. set w' = set w''\\<close>\n      using W'_def image_iff list.set_map by fastforce\n    then have \\<open>\\<exists> w'' \\<in> set W'. \\<not>eval g h (\\<^bold>\\<Or>w'')\\<close> \n      by (metis disjunct_evalE w'_def(1))\n    then show \\<open>False\\<close> \n      using a1 by simp\n  qed\n  ultimately show ?thesis \n    using R1_leads_to by fast\nqed\n\nsection \\<open>Strong Soundness\\<close>\n\ncorollary soundness_imply:\n  assumes \\<open>\\<And>M w p. A p \\<Longrightarrow> P M \\<Longrightarrow> w \\<in> \\<W> M \\<Longrightarrow> M, w \\<Turnstile> p\\<close>\n  shows \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> p \\<Longrightarrow> P; set ps \\<TTurnstile>\\<star> p\\<close>\nproof (induct ps arbitrary: p)\n  case Nil\n  then show ?case\n    using soundness[of A P p] assms by simp\nnext\n  case (Cons a ps)\n  then show ?case\n    using K_ImpI by fastforce\nqed\n\ntheorem strong_soundness:\n  assumes \\<open>\\<And>M w p. A p \\<Longrightarrow> P M \\<Longrightarrow> w \\<in> \\<W> M \\<Longrightarrow> M, w \\<Turnstile> p\\<close>\n  shows \\<open>A; G \\<turnstile> p \\<Longrightarrow> P; G \\<TTurnstile>\\<star> p\\<close>\nproof safe\n  fix qs w and M :: \\<open>('a, 'b) kripke\\<close>\n  assume \\<open>A \\<turnstile> qs \\<^bold>\\<leadsto> p\\<close>\n  moreover assume \\<open>set qs \\<subseteq> G\\<close> \\<open>\\<forall>q \\<in> G. M, w \\<Turnstile> q\\<close>\n  then have \\<open>\\<forall>q \\<in> set qs. M, w \\<Turnstile> q\\<close>\n    using \\<open>set qs \\<subseteq> G\\<close> by blast\n  moreover assume \\<open>P M\\<close> \\<open>w \\<in> \\<W> M\\<close>\n  ultimately show \\<open>M, w \\<Turnstile> p\\<close>\n    using soundness_imply[of A P qs p] assms by blast\nqed\n\nsection \\<open>Completeness\\<close>\n\nsubsection \\<open>Consistent sets\\<close>\n\ndefinition consistent :: \\<open>('i fm \\<Rightarrow> bool) \\<Rightarrow> 'i fm set \\<Rightarrow> bool\\<close> where\n  \\<open>consistent A S \\<equiv> \\<not> (A; S \\<turnstile> \\<^bold>\\<bottom>)\\<close>\n\nlemma inconsistent_subset:\n  assumes \\<open>consistent A V\\<close> \\<open>\\<not> consistent A ({p} \\<union> V)\\<close>\n  obtains V' where \\<open>set V' \\<subseteq> V\\<close> \\<open>A \\<turnstile> p # V' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\nproof -\n  obtain V' where V': \\<open>set V' \\<subseteq> ({p} \\<union> V)\\<close> \\<open>p \\<in> set V'\\<close> \\<open>A \\<turnstile> V' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    using assms unfolding consistent_def by blast\n  then have *: \\<open>A \\<turnstile> p # V' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    using K_imply_Cons by blast\n\n  let ?S = \\<open>removeAll p V'\\<close>\n  have \\<open>set (p # V') \\<subseteq> set (p # ?S)\\<close>\n    by auto\n  then have \\<open>A \\<turnstile> p # ?S \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    using * K_imply_weaken by blast\n  moreover have \\<open>set ?S \\<subseteq> V\\<close>\n    using V'(1) by (metis Diff_subset_conv set_removeAll)\n  ultimately show ?thesis\n    using that by blast\nqed\n\nlemma consistent_consequent:\n  assumes \\<open>consistent A V\\<close> \\<open>p \\<in> V\\<close> \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q\\<close>\n  shows \\<open>consistent A ({q} \\<union> V)\\<close>\nproof -\n  have \\<open>\\<forall>V'. set V' \\<subseteq> V \\<longrightarrow> \\<not> (A \\<turnstile> p # V' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>)\\<close>\n    using \\<open>consistent A V\\<close> \\<open>p \\<in> V\\<close> unfolding consistent_def\n    by (metis insert_subset list.simps(15))\n  then have \\<open>\\<forall>V'. set V' \\<subseteq> V \\<longrightarrow> \\<not> (A \\<turnstile> q # V' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>)\\<close>\n    using \\<open>A \\<turnstile> (p \\<^bold>\\<longrightarrow> q)\\<close> K_imply_head K_right_mp by (metis imply.simps(1-2))\n  then show ?thesis\n    using \\<open>consistent A V\\<close> inconsistent_subset by metis\nqed\n\nlemma consistent_consequent':\n  assumes \\<open>consistent A V\\<close> \\<open>p \\<in> V\\<close> \\<open>tautology (p \\<^bold>\\<longrightarrow> q)\\<close>\n  shows \\<open>consistent A ({q} \\<union> V)\\<close>\n  using assms consistent_consequent A1 by blast\n\nlemma consistent_disjuncts:\n  assumes \\<open>consistent A V\\<close> \\<open>(p \\<^bold>\\<or> q) \\<in> V\\<close>\n  shows \\<open>consistent A ({p} \\<union> V) \\<or> consistent A ({q} \\<union> V)\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> ?thesis\\<close>\n  then have \\<open>\\<not> consistent A ({p} \\<union> V)\\<close> \\<open>\\<not> consistent A ({q} \\<union> V)\\<close>\n    by blast+\n\n  then obtain S' T' where\n    S': \\<open>set S' \\<subseteq> V\\<close> \\<open>A \\<turnstile> p # S' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> and\n    T': \\<open>set T' \\<subseteq> V\\<close> \\<open>A \\<turnstile> q # T' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    using \\<open>consistent A V\\<close> inconsistent_subset by metis\n\n  from S' have p: \\<open>A \\<turnstile> p # S' @ T' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    by (metis K_imply_weaken Un_upper1 append_Cons set_append)\n  moreover from T' have q: \\<open>A \\<turnstile> q # S' @ T' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    by (metis K_imply_head K_right_mp R1 imply.simps(2) imply_append)\n  ultimately have \\<open>A \\<turnstile> (p \\<^bold>\\<or> q) # S' @ T' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    using K_DisL by blast\n  then have \\<open>A \\<turnstile> S' @ T' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    using S'(1) T'(1) p q \\<open>consistent A V\\<close> \\<open>(p \\<^bold>\\<or> q) \\<in> V\\<close> unfolding consistent_def\n    by (metis Un_subset_iff insert_subset list.simps(15) set_append)\n  moreover have \\<open>set (S' @ T') \\<subseteq> V\\<close>\n    by (simp add: S'(1) T'(1))\n  ultimately show False\n    using \\<open>consistent A V\\<close> unfolding consistent_def by blast\nqed\n\nlemma exists_finite_inconsistent:\n  assumes \\<open>\\<not> consistent A ({\\<^bold>\\<not> p} \\<union> V)\\<close>\n  obtains W where \\<open>{\\<^bold>\\<not> p} \\<union> W \\<subseteq> {\\<^bold>\\<not> p} \\<union> V\\<close> \\<open>(\\<^bold>\\<not> p) \\<notin> W\\<close> \\<open>finite W\\<close> \\<open>\\<not> consistent A ({\\<^bold>\\<not> p} \\<union> W)\\<close>\nproof -\n  obtain W' where W': \\<open>set W' \\<subseteq> {\\<^bold>\\<not> p} \\<union> V\\<close> \\<open>A \\<turnstile> W' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    using assms unfolding consistent_def by blast\n  let ?S = \\<open>removeAll (\\<^bold>\\<not> p) W'\\<close>\n  have \\<open>\\<not> consistent A ({\\<^bold>\\<not> p} \\<union> set ?S)\\<close>\n    unfolding consistent_def using W'(2) by auto\n  moreover have \\<open>finite (set ?S)\\<close>\n    by blast\n  moreover have \\<open>{\\<^bold>\\<not> p} \\<union> set ?S \\<subseteq> {\\<^bold>\\<not> p} \\<union> V\\<close>\n    using W'(1) by auto\n  moreover have \\<open>(\\<^bold>\\<not> p) \\<notin> set ?S\\<close>\n    by simp\n  ultimately show ?thesis\n    by (meson that)\nqed\n\nlemma inconsistent_imply:\n  assumes \\<open>\\<not> consistent A ({\\<^bold>\\<not> p} \\<union> set G)\\<close>\n  shows \\<open>A \\<turnstile> G \\<^bold>\\<leadsto> p\\<close>\n  using assms K_Boole K_imply_weaken unfolding consistent_def\n  by (metis insert_is_Un list.simps(15))\n\nsubsection \\<open>the set of all subformulas++\\<close>\n\nprimrec sub_C where\n  \\<open>sub_C \\<^bold>\\<bottom> = {\\<^bold>\\<bottom>}\\<close> |\n  \\<open>sub_C (Pro a) = {Pro a}\\<close> |\n  \\<open>sub_C (p \\<^bold>\\<or> q) = insert (p \\<^bold>\\<or> q) (sub_C p \\<union> sub_C q)\\<close> |\n  \\<open>sub_C (p \\<^bold>\\<and> q) = insert (p \\<^bold>\\<and> q) (sub_C p \\<union> sub_C q)\\<close> |\n  \\<open>sub_C (p \\<^bold>\\<longrightarrow> q) = insert (p \\<^bold>\\<longrightarrow> q) (sub_C p \\<union> sub_C q)\\<close> |\n  \\<open>sub_C (K i p) = insert (K i p) (sub_C p)\\<close> |\n  \\<open>sub_C (Ev g p) = {K i p | i. i \\<in> set g} \\<union> insert (Ev g p) (sub_C p)\\<close> |\n  \\<open>sub_C (Co g p) = \n    {K i p | i. i \\<in> set g} \\<union>\n    {K i (p \\<^bold>\\<and> Co g p) | i. i \\<in> set g} \\<union> \n    {Ev g (p \\<^bold>\\<and> Co g p), p \\<^bold>\\<and> Co g p, Co g p} \\<union> sub_C p\\<close>\n\nlemma sub_C_finite: \\<open>finite (sub_C p)\\<close>\n  by (induct p) auto\n\nlemma p_in_sub_C_p: \\<open>p \\<in> sub_C p\\<close>\n  by (induct p) auto\n\nabbreviation sub_C' where \\<open>sub_C' p \\<equiv> sub_C p \\<union> (image Neg (sub_C p))\\<close>\n\nlemma sub_C'_finite: \\<open>finite (sub_C' p)\\<close> \n  by (simp add: sub_C_finite)\n\nlemma sub_C_transitive: \\<open>p \\<in> sub_C q \\<Longrightarrow> q \\<in> sub_C r \\<Longrightarrow> p \\<in> sub_C r\\<close>\n  by (induct r, induct q, auto)\n\nlemma sub_sub_C': \\<open>p \\<in> sub_C' \\<phi> \\<Longrightarrow> q \\<in> sub_C p \\<Longrightarrow> q = \\<^bold>\\<bottom> \\<or> q \\<in> sub_C' \\<phi>\\<close>\nproof-\n  assume \\<open>q \\<in> sub_C p\\<close>\n  assume \\<open>p \\<in> sub_C' \\<phi>\\<close>\n  then consider \\<open>p \\<in> sub_C \\<phi>\\<close> | \\<open>p \\<in> image Neg (sub_C \\<phi>)\\<close>\n    by auto\n  then show ?thesis\n  proof cases\n    case 1\n    from this \\<open>q \\<in> sub_C p\\<close> have \\<open>q \\<in> sub_C \\<phi>\\<close>\n      using sub_C_transitive by auto\n    then show ?thesis\n      by simp\n  next\n    case 2\n    then obtain p' where \\<open>p = \\<^bold>\\<not>p'\\<close> \\<open>p' \\<in> sub_C \\<phi>\\<close>\n      by auto\n    moreover have \\<open>q \\<in> sub_C p \\<longrightarrow> p = \\<^bold>\\<not>p' \\<longrightarrow> q \\<in> sub_C p' \\<or> q = p \\<or> q = \\<^bold>\\<bottom>\\<close> \n      by (cases p) auto\n    ultimately show ?thesis \n      by (metis UnI1 \\<open>p \\<in> sub_C' \\<phi>\\<close> \\<open>q \\<in> sub_C p\\<close> sub_C_transitive)\n  qed \nqed\n\nlemma comp_in_sub_C: \\<open>comp p \\<in> sub_C' \\<phi>\\<close> if \\<open>p \\<in> sub_C' \\<phi>\\<close>\nproof (cases \\<open>\\<exists> p'. p = \\<^bold>\\<not> p'\\<close>)\n  case True\n  then obtain p' where \\<open>p = \\<^bold>\\<not>p'\\<close> ..\n  then have \\<open>comp p = p'\\<close>\n    by simp\n  have \\<open>p' \\<in> sub_C' \\<phi>\\<close>\n  proof (cases \\<open>p \\<in> sub_C \\<phi>\\<close>)\n    case True\n    from this \\<open>p = \\<^bold>\\<not>p'\\<close> have \\<open>p' \\<in> sub_C \\<phi>\\<close>\n    proof (induct \\<phi>)\n      case (Imp \\<phi>1 \\<phi>2)\n      then show ?case \n        using p_in_sub_C_p by (cases \\<open>\\<phi>2 = \\<^bold>\\<bottom>\\<close>,force,auto)\n    qed auto\n    then show ?thesis \n      by simp\n  next\n    case False\n    then show ?thesis\n      using \\<open>comp p = p'\\<close> \\<open>p \\<in> sub_C' \\<phi>\\<close> by fastforce\n  qed\n  then show ?thesis \n    by (simp add: \\<open>comp p = p'\\<close>)\nnext\n  case False\n  then have \\<open>comp p = \\<^bold>\\<not>p\\<close>\n  proof (cases p)\n    case (Imp p q)\n    then show ?thesis \n      using False by (cases q) auto\n  qed auto\n  then show ?thesis \n    using False that by auto\nqed\n\nsubsection \\<open>Maximal consistent sets\\<close>\n\ndefinition maximal' where\n  \\<open>maximal' A \\<phi> S \\<equiv> \\<forall> p \\<in> sub_C' \\<phi>. p \\<notin> S \\<longrightarrow> \\<not> consistent A ({p} \\<union> S)\\<close>\n\nlemma extract_from_list: \\<open>x \\<in> set xs \\<Longrightarrow> \\<exists> ys. set (x # ys) = set xs \\<and> x \\<notin> set ys\\<close>\n  by (metis Diff_insert_absorb list.simps(15) mk_disjoint_insert set_removeAll)\n\nlemma consistent_extend_by_p: \\<open>consistent A V \\<Longrightarrow> consistent A ({p} \\<union> V) \\<or> consistent A ({\\<^bold>\\<not>p} \\<union> V)\\<close>\nproof (rule ccontr)\n  assume \\<open>consistent A V\\<close>\n  assume \\<open>\\<not> ?thesis\\<close>\n  then have \\<open>A; ({p} \\<union> V) \\<turnstile> \\<^bold>\\<bottom>\\<close> \\<open>A; ({\\<^bold>\\<not>p} \\<union> V) \\<turnstile> \\<^bold>\\<bottom>\\<close>\n    unfolding consistent_def by simp_all\n  then obtain qs rs where qs_rs_def:\n    \\<open>set qs \\<subseteq> {p} \\<union> V\\<close> \\<open>set rs \\<subseteq> {\\<^bold>\\<not>p} \\<union> V\\<close> \\<open>A \\<turnstile> qs \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> \\<open>A \\<turnstile> rs \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    by auto\n  then consider \\<open>set qs \\<subseteq> V \\<or> set rs \\<subseteq> V\\<close> | \\<open>p \\<in> set qs \\<and> \\<^bold>\\<not>p \\<in> set rs\\<close> \n    by auto\n  then show False\n  proof cases\n    case 1\n    then have \\<open>\\<not> consistent A V\\<close>\n      using qs_rs_def consistent_def by blast\n    then show ?thesis \n      using \\<open>consistent A V\\<close> ..\n  next\n    case 2\n    then obtain qs' rs' where \n      \\<open>set (p # qs') = set qs\\<close> \\<open>set (\\<^bold>\\<not>p # rs') = set rs\\<close> \\<open>p \\<notin> set qs'\\<close> \\<open>\\<^bold>\\<not>p \\<notin> set rs'\\<close>\n      using extract_from_list by meson\n    then have \\<open>set qs' \\<subseteq> V \\<and> set rs' \\<subseteq> V\\<close> \n      using qs_rs_def by auto\n    have \\<open>A \\<turnstile> p # qs' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> \\<open>A \\<turnstile> \\<^bold>\\<not>p # rs' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n      using \\<open>set (p # qs') = set qs\\<close> \\<open>set (\\<^bold>\\<not>p # rs') = set rs\\<close> qs_rs_def(3,4)\n      by (metis K_imply_weaken order_refl)+\n    then have \\<open>A \\<turnstile> qs' @ rs' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n      by (metis K_ImpI K_imply_head K_right_mp R1 imply.simps(2) imply_append)\n    then have \\<open>\\<not> consistent A V\\<close>\n      using \\<open>set qs' \\<subseteq> V \\<and> set rs' \\<subseteq> V\\<close> consistent_def\n      by (metis Un_subset_iff set_append)\n    then show ?thesis \n      using \\<open>consistent A V\\<close> ..\n  qed\nqed\n\nlemma deriv_in_maximal': \n  assumes \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close> \\<open>p \\<in> sub_C' \\<phi>\\<close> \\<open>A \\<turnstile> p\\<close>\n  shows \\<open>p \\<in> V\\<close>\n  using assms R1 inconsistent_subset unfolding consistent_def maximal'_def\n  by (metis imply.simps(2))\n\nlemma consequent_in_maximal':\n  assumes \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close> \\<open>set ps \\<subseteq> sub_C' \\<phi>\\<close> \\<open>q \\<in> sub_C' \\<phi>\\<close> \\<open>set ps \\<subseteq> V\\<close>\n    \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> q\\<close>\n  shows \\<open>q \\<in> V\\<close>\nproof-\n  have \\<open>\\<forall>V'. set V' \\<subseteq> V \\<longrightarrow> \\<not> (A \\<turnstile> ps @ V' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>)\\<close>\n    using \\<open>consistent A V\\<close> \\<open>set ps \\<subseteq> V\\<close> unfolding consistent_def \n    by simp\n  have \\<open>\\<forall>V'. set V' \\<subseteq> V \\<longrightarrow> \\<not> (A \\<turnstile> ps @ (ps \\<^bold>\\<leadsto> q) # V' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>)\\<close>\n    by (metis K_imply_weaken K_right_mp \\<open>\\<forall>V'. set V' \\<subseteq> V \\<longrightarrow> \\<not> A \\<turnstile> ps @ V' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> assms(6) imply.simps(2) imply_append inf_sup_ord(4) set_append)\n  then have \\<open>\\<forall>V'. set V' \\<subseteq> V \\<longrightarrow> \\<not> (A \\<turnstile> q # V' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>)\\<close> \n    by (metis K_imply_head K_right_mp R1 \\<open>\\<forall>V'. set V' \\<subseteq> V \\<longrightarrow> \\<not> A \\<turnstile> ps @ V' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> assms(6) imply.simps(2) imply_append)\n  then have \\<open>consistent A ({q} \\<union> V)\\<close>\n    using \\<open>consistent A V\\<close> inconsistent_subset by metis\n  then show ?thesis\n    using \\<open>maximal' A \\<phi> V\\<close> \\<open>q \\<in> sub_C' \\<phi>\\<close> maximal'_def by blast\nqed\n\nlemma exactly_one_in_maximal': \n  assumes \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close> \\<open>p \\<in> sub_C' \\<phi>\\<close> \\<open>V \\<subseteq> sub_C' \\<phi>\\<close>\n  shows \\<open>p \\<in> V \\<longleftrightarrow> comp p \\<notin> V\\<close> \nproof\n  assume \\<open>p \\<in> V\\<close>\n  have \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> \\<^bold>\\<not>(comp p)\\<close>\n    by (simp add: comp_imp1)\n  then have \\<open>A \\<turnstile> [comp p,p] \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    by (metis K_swap imply.simps(1) imply.simps(2))\n  then show \\<open>comp p \\<notin> V\\<close>\n    using \\<open>consistent A V\\<close> \\<open>p \\<in> sub_C' \\<phi>\\<close> \\<open>p \\<in> V\\<close> \n    by (metis Un_insert_right consistent_def empty_set inf_sup_ord(4) insert_absorb list.simps(15) sup_bot.right_neutral)\nnext\n  assume \\<open>comp p \\<notin> V\\<close>\n  then have \\<open>\\<not> consistent A ({comp p} \\<union> V)\\<close>\n    using comp_in_sub_C assms unfolding maximal'_def by auto\n  then obtain qs where qs_def: \\<open>set qs \\<subseteq> V\\<close> \\<open>A \\<turnstile> (comp p) # qs \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n    by (meson assms(1) inconsistent_subset)\n  then have \\<open>A \\<turnstile> qs \\<^bold>\\<leadsto> \\<^bold>\\<not>(comp p)\\<close>\n    by (simp add: K_ImpI)\n  then have \\<open>A \\<turnstile> qs \\<^bold>\\<leadsto> p\\<close> \n    by (simp add: comp_imp2 imply_chain)\n  then show \\<open>p \\<in> V\\<close>\n    using assms \\<open>set qs \\<subseteq> V\\<close> deriv_in_maximal' comp_in_sub_C \n    by (smt (verit) consequent_in_maximal' dual_order.trans)\nqed\n\nsubsection \\<open>Lindenbaum extension\\<close>\n(*the countable stuff is probably not needed, as you can just look at all formulas in sub_C' \\<phi>*)\ninstantiation fm :: (countable) countable begin\ninstance by countable_datatype\nend\n\nlemma UN_finite_bound:\n  assumes \\<open>finite A\\<close> \\<open>A \\<subseteq> (\\<Union>n. f n)\\<close>\n  shows \\<open>\\<exists>m :: nat. A \\<subseteq> (\\<Union>n \\<le> m. f n)\\<close>\n  using assms\nproof (induct rule: finite_induct)\n  case (insert x A)\n  then obtain m where \\<open>A \\<subseteq> (\\<Union>n \\<le> m. f n)\\<close>\n    by fast\n  then have \\<open>A \\<subseteq> (\\<Union>n \\<le> (m + k). f n)\\<close> for k\n    by fastforce\n  moreover obtain m' where \\<open>x \\<in> f m'\\<close>\n    using insert(4) by blast\n  ultimately have \\<open>{x} \\<union> A \\<subseteq> (\\<Union>n \\<le> m + m'. f n)\\<close>\n    by auto\n  then show ?case\n    by blast\nqed simp\n\nprimrec extend' :: \\<open>('i fm \\<Rightarrow> bool) \\<Rightarrow> 'i fm \\<Rightarrow> 'i fm set \\<Rightarrow> (nat \\<Rightarrow> 'i fm) \\<Rightarrow> nat \\<Rightarrow> 'i fm set\\<close> where\n  \\<open>extend' A \\<phi> S f 0 = S\\<close>\n| \\<open>extend' A \\<phi> S f (Suc n) =\n    (if f n \\<in> sub_C' \\<phi> \\<and> consistent A ({f n} \\<union> extend' A \\<phi> S f n)\n     then {f n} \\<union> extend' A \\<phi> S f n\n     else extend' A \\<phi> S f n)\\<close>\n\ndefinition Extend' :: \\<open>('i fm \\<Rightarrow> bool) \\<Rightarrow> 'i fm \\<Rightarrow> 'i fm set \\<Rightarrow> (nat \\<Rightarrow> 'i fm) \\<Rightarrow> 'i fm set\\<close> where\n  \\<open>Extend' A \\<phi> S f \\<equiv> \\<Union>n. extend' A \\<phi> S f n\\<close>\n\nlemma extend'_subset_sub_C: \\<open>S \\<subseteq> sub_C' \\<phi> \\<Longrightarrow> extend' A \\<phi> S f n \\<subseteq> sub_C' \\<phi>\\<close>\n  by (induct n) auto\n\nlemma Extend'_subset_sub_C: \\<open>S \\<subseteq> sub_C' \\<phi> \\<Longrightarrow> Extend' A \\<phi> S f \\<subseteq> sub_C' \\<phi>\\<close>\n  using extend'_subset_sub_C unfolding Extend'_def by blast\n\nlemma Extend'_subset: \\<open>S \\<subseteq> Extend' A \\<phi> S f\\<close>\n  unfolding Extend'_def using Union_upper extend'.simps(1) range_eqI\n  by metis\n\nlemma extend'_bound: \\<open>(\\<Union>n \\<le> m. extend' A \\<phi> S f n) = extend' A \\<phi> S f m\\<close>\n  by (induct m) (simp_all add: atMost_Suc)\n\nlemma consistent_extend': \\<open>consistent A S \\<Longrightarrow> consistent A (extend' A \\<phi> S f n)\\<close>\n  by (induct n) simp_all\n\nlemma consistent_Extend':\n  assumes \\<open>consistent A S\\<close>\n  shows \\<open>consistent A (Extend' A \\<phi> S f)\\<close>\n  unfolding Extend'_def\nproof (rule ccontr)\n  assume \\<open>\\<not> consistent A (\\<Union>n. extend' A \\<phi> S f n)\\<close>\n  then obtain S' where \\<open>A \\<turnstile> S' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> \\<open>set S' \\<subseteq> (\\<Union>n. extend' A \\<phi> S f n)\\<close>\n    unfolding consistent_def by blast\n  then obtain m where \\<open>set S' \\<subseteq> (\\<Union>n \\<le> m. extend' A \\<phi> S f n)\\<close>\n    using UN_finite_bound by (metis List.finite_set)\n  then have \\<open>set S' \\<subseteq> extend' A \\<phi> S f m\\<close>\n    using extend'_bound by blast\n  moreover have \\<open>consistent A (extend' A \\<phi> S f m)\\<close>\n    using assms consistent_extend' by blast\n  ultimately show False\n    unfolding consistent_def using \\<open>A \\<turnstile> S' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> by blast\nqed\n\nlemma maximal_Extend':\n  assumes \\<open>surj f\\<close>\n  shows \\<open>maximal' A \\<phi> (Extend' A \\<phi> S f)\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> maximal' A \\<phi> (Extend' A \\<phi> S f)\\<close>\n  then obtain p where \\<open>p \\<in> sub_C' \\<phi>\\<close> \\<open>p \\<notin> Extend' A \\<phi> S f\\<close> \\<open>consistent A ({p} \\<union> Extend' A \\<phi> S f)\\<close>\n    unfolding maximal'_def using assms by blast\n  obtain k where n: \\<open>f k = p\\<close>\n    using \\<open>surj f\\<close> unfolding surj_def by metis\n  then have \\<open>p \\<notin> extend' A \\<phi> S f (Suc k)\\<close>\n    using \\<open>p \\<notin> Extend' A \\<phi> S f\\<close> unfolding Extend'_def by blast\n  then have \\<open>\\<not> consistent A ({p} \\<union> extend' A \\<phi> S f k)\\<close>\n    using n \\<open>p \\<in> sub_C' \\<phi>\\<close> by auto\n  moreover have \\<open>{p} \\<union> extend' A \\<phi> S f k \\<subseteq> {p} \\<union> Extend' A \\<phi> S f\\<close>\n    unfolding Extend'_def by blast\n  ultimately have \\<open>\\<not> consistent A ({p} \\<union> Extend' A \\<phi> S f)\\<close>\n    unfolding consistent_def by fastforce\n  then show False\n    using \\<open>consistent A ({p} \\<union> Extend' A \\<phi> S f)\\<close> by blast\nqed\n\nlemma maximal_extension':\n  fixes V :: \\<open>('i :: countable) fm set\\<close>\n  assumes \\<open>V \\<subseteq> sub_C' \\<phi>\\<close> \\<open>consistent A V\\<close>\n  obtains W where \\<open>V \\<subseteq> W\\<close> \\<open>W \\<subseteq> sub_C' \\<phi>\\<close> \\<open>consistent A W\\<close> \\<open>maximal' A \\<phi> W\\<close>\nproof -\n  let ?W = \\<open>Extend' A \\<phi> V from_nat\\<close>\n  have \\<open>V \\<subseteq> ?W\\<close>\n    using Extend'_subset by blast\n  moreover have \\<open>consistent A ?W\\<close>\n    using assms consistent_Extend' by blast\n  moreover have \\<open>maximal' A \\<phi> ?W\\<close>\n    using assms maximal_Extend' surj_from_nat by blast\n  moreover have \\<open>?W \\<subseteq> sub_C' \\<phi>\\<close> \n    using assms Extend'_subset_sub_C by blast\n  ultimately show ?thesis\n    using that by blast\nqed\n\nsubsection \\<open>Canonical model\\<close>\n\nabbreviation pi :: \\<open>'i fm set \\<Rightarrow> id \\<Rightarrow> bool\\<close> where\n  \\<open>pi V x \\<equiv> Pro x \\<in> V\\<close>\n\nabbreviation known :: \\<open>'i fm set \\<Rightarrow> 'i \\<Rightarrow> 'i fm set\\<close> where\n  \\<open>known V i \\<equiv> {p. K i p \\<in> V}\\<close>\n\nabbreviation reach :: \\<open>('i fm \\<Rightarrow> bool) \\<Rightarrow> 'i \\<Rightarrow> 'i fm set \\<Rightarrow> 'i fm set set\\<close> where\n  \\<open>reach A i V \\<equiv> {W. known V i \\<subseteq> W}\\<close> \n\nabbreviation mcss :: \\<open>('i fm \\<Rightarrow> bool) \\<Rightarrow> 'i fm \\<Rightarrow> 'i fm set set\\<close> where\n  \\<open>mcss A \\<phi> \\<equiv> {W. W \\<subseteq> sub_C' \\<phi> \\<and> consistent A W \\<and> maximal' A \\<phi> W}\\<close>\n\nabbreviation canonical :: \\<open>('i fm \\<Rightarrow> bool) \\<Rightarrow> 'i fm \\<Rightarrow> ('i, 'i fm set) kripke\\<close> where\n  \\<open>canonical A \\<phi> \\<equiv> \\<lparr>\\<W> = mcss A \\<phi>, \\<K> = reach A, \\<pi> = pi\\<rparr>\\<close>\n\nlemma truth_lemma_Ka: \n  fixes p :: \\<open>('i :: countable) fm\\<close>\n  assumes prems: \\<open>V \\<in> mcss A \\<phi>\\<close> \\<open>K i p \\<in> sub_C' \\<phi>\\<close>\n  assumes hyp: \\<open>\\<And> V. V \\<in> mcss A \\<phi> \\<Longrightarrow> p \\<in> V \\<longleftrightarrow> canonical A \\<phi>, V \\<Turnstile> p\\<close>\n  assumes \\<open>canonical A \\<phi>, V \\<Turnstile> K i p\\<close> \n  shows \\<open>K i p \\<in> V\\<close>\nproof-\n  from \\<open>K i p \\<in> sub_C' \\<phi>\\<close> have \\<open>p \\<in> sub_C \\<phi>\\<close>  \n    by (metis (no_types, lifting) Un_iff fm.distinct(45) image_iff insert_iff p_in_sub_C_p sub_C.simps(6) sub_C_transitive)\n  then have \\<open>\\<^bold>\\<not> p \\<in> sub_C' \\<phi>\\<close> \n    by simp\n  moreover have \\<open>\\<forall> p. K i p \\<in> V \\<longrightarrow> p \\<in> sub_C' \\<phi>\\<close>\n    using \\<open>V \\<in> mcss A \\<phi>\\<close>\n    by (smt (verit, ccfv_SIG) Un_iff fm.distinct(45) image_iff insertCI insert_absorb insert_subset mem_Collect_eq p_in_sub_C_p sub_C.simps(6) sub_C_transitive)\n  ultimately have \\<open>{\\<^bold>\\<not> p} \\<union> known V i \\<subseteq> sub_C' \\<phi>\\<close>\n    by auto\n\n  have \\<open>\\<not> consistent A ({\\<^bold>\\<not> p} \\<union> known V i)\\<close>\n  proof\n    assume \\<open>consistent A ({\\<^bold>\\<not> p} \\<union> known V i)\\<close>\n    then obtain W where W: \\<open>{\\<^bold>\\<not> p} \\<union> known V i \\<subseteq> W\\<close> \\<open>W \\<subseteq> sub_C' \\<phi>\\<close> \\<open>consistent A W\\<close> \\<open>maximal' A \\<phi> W\\<close>\n      using \\<open>{\\<^bold>\\<not> p} \\<union> known V i \\<subseteq> sub_C' \\<phi>\\<close> \\<open>V \\<in> mcss A \\<phi>\\<close> maximal_extension' by (smt (verit, best))\n    then have \\<open>canonical A \\<phi>, W \\<Turnstile> \\<^bold>\\<not> p\\<close>\n      using \\<open>V \\<in> mcss A \\<phi>\\<close> exactly_one_in_maximal' \n      by (smt (verit) Imp_intro comp.simps(1) hyp insertCI mem_Collect_eq subset_iff sup.boundedE)\n    moreover have \\<open>W \\<in> reach A i V\\<close> \\<open>W \\<in> mcss A \\<phi>\\<close>\n      using W by simp_all\n    ultimately have \\<open>canonical A \\<phi>, V \\<Turnstile> \\<^bold>\\<not> K i p\\<close>\n      by auto\n    then show False\n      using \\<open>canonical A \\<phi>, V \\<Turnstile> K i p\\<close> by auto\n  qed\n\n  then obtain W where W:\n    \\<open>{\\<^bold>\\<not> p} \\<union> W \\<subseteq> {\\<^bold>\\<not> p} \\<union> known V i\\<close> \\<open>(\\<^bold>\\<not> p) \\<notin> W\\<close> \\<open>finite W\\<close> \\<open>\\<not> consistent A ({\\<^bold>\\<not> p} \\<union> W)\\<close>\n    using exists_finite_inconsistent by metis\n\n  obtain L where L: \\<open>set L = W\\<close>\n    using \\<open>finite W\\<close> finite_list by blast\n\n  then have \\<open>A \\<turnstile> L \\<^bold>\\<leadsto> p\\<close>\n    using W(4) inconsistent_imply by blast\n  then have \\<open>A \\<turnstile> K i (L \\<^bold>\\<leadsto> p)\\<close>\n    using R2 by fast\n  then have \\<open>A \\<turnstile> map (K i) L \\<^bold>\\<leadsto> K i p\\<close>\n    using K_distrib_K_imp by fast\n  moreover have \\<open>set (map (K i) L) \\<subseteq> V\\<close> \n    using L W(1,2) by auto\n  moreover have \\<open>set (map (K i) L) \\<subseteq> sub_C' \\<phi>\\<close> \n    using calculation(2) prems(1) by blast\n  ultimately show \\<open>K i p \\<in> V\\<close>\n    using \\<open>K i p \\<in> sub_C' \\<phi>\\<close> consequent_in_maximal' prems(1) by blast\nqed\n\nlemma consistent_implies: \\<open>\\<forall> q \\<in> w'. \\<exists> p \\<in> w.  A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<Longrightarrow> consistent A w \\<Longrightarrow> consistent A w'\\<close> \nproof (rule ccontr)\n  assume 1: \\<open>\\<forall> q \\<in> w'. \\<exists> p \\<in> w.  A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<close>\n  assume 2: \\<open>consistent A w\\<close>\n  assume \\<open>\\<not> consistent A w'\\<close>\n  then obtain qs where ps_def: \\<open>A \\<turnstile> qs \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> \\<open>set qs \\<subseteq> w'\\<close> \n    unfolding consistent_def by fastforce\n  then have \\<open>\\<forall> q \\<in> set qs. \\<exists> p \\<in> w. A \\<turnstile> p \\<^bold>\\<longrightarrow> q\\<close> \n    using 1 by auto\n  then have \\<open>\\<exists> ps. (\\<forall> q \\<in> set qs. \\<exists> p \\<in> set ps. A \\<turnstile> p \\<^bold>\\<longrightarrow> q) \\<and> set ps \\<subseteq> w\\<close>\n  proof (induct qs)\n    case Nil\n    then show ?case \n      by fastforce\n  next\n    case (Cons q qs)\n    then obtain ps where \\<open>(\\<forall>q\\<in>set qs. \\<exists>p\\<in>set ps. A \\<turnstile> p \\<^bold>\\<longrightarrow> q) \\<and> set ps \\<subseteq> w\\<close>\n      by auto\n    moreover obtain p where \\<open>p \\<in> w \\<and> A \\<turnstile> p \\<^bold>\\<longrightarrow> q\\<close>\n      using Cons by auto\n    ultimately have \\<open>(\\<forall>q\\<in>set (q # qs). \\<exists>p\\<in>set (p # ps). A \\<turnstile> p \\<^bold>\\<longrightarrow> q) \\<and> set (p # ps) \\<subseteq> w\\<close> \n      by simp\n    then show ?case \n      by fast\n  qed  \n  then obtain ps where \\<open>\\<forall> q \\<in> set qs. \\<exists> p \\<in> set ps. A \\<turnstile> p \\<^bold>\\<longrightarrow> q\\<close> \\<open>set ps \\<subseteq> w\\<close>\n    by auto\n  then have \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> \\<^bold>\\<And>qs\\<close> \n  proof (induct qs)\n    case Nil\n    then show ?case \n      using K_ImpI K_imply_head by fastforce\n  next\n    case (Cons q qs)\n    then obtain p where \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q\\<close> \\<open>p \\<in> set ps\\<close>\n      by auto\n    moreover have \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> \\<^bold>\\<And> qs\\<close> \n      using Cons by simp\n    ultimately have \\<open>A \\<turnstile> p # ps \\<^bold>\\<leadsto>  \\<^bold>\\<And>q # qs\\<close> \n      using add_assm_and_concl by fastforce\n    then show ?case\n      using \\<open>p \\<in> set ps\\<close> K_ImpI K_right_mp conjunct_implies_elem imply_chain imply_implies_itself by blast\n  qed\n  from ps_def(1) this have \\<open>A \\<turnstile> ps \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> \n    by (meson R1 imply_chain imply_implies_conjunct)\n  then show False\n    using \\<open>consistent A w\\<close> \\<open>set ps \\<subseteq> w\\<close> consistent_def by blast\nqed\n\n\n(*exercise 3.28 from Reasoning About Knowledge*)\nlemma Co_lemma:\n  fixes A \\<phi> g \n  fixes p :: \\<open>('i :: countable) fm\\<close>\n  defines \\<open>WCo \\<equiv> {W. W \\<in> mcss A \\<phi> \\<and> canonical A \\<phi>, W \\<Turnstile> Co g p}\\<close>\n  assumes \\<open>Co g p \\<in> sub_C' \\<phi>\\<close>\n  assumes \\<open>set (map set \\<w>) = WCo\\<close>\n  assumes \\<open>\\<phi>\\<^sub>\\<w> = disjunct (map conjunct \\<w>)\\<close>\n  assumes \\<open>V \\<in> mcss A \\<phi>\\<close>\n  assumes hyp: \\<open>\\<And> V. V \\<in> mcss A \\<phi> \\<Longrightarrow> p \\<in> V \\<longleftrightarrow> canonical A \\<phi>, V \\<Turnstile> p\\<close>\n  shows \\<open>A \\<turnstile> \\<phi>\\<^sub>\\<w> \\<^bold>\\<longrightarrow> Ev g (p \\<^bold>\\<and> \\<phi>\\<^sub>\\<w>)\\<close>\nproof -\n  (*formulas named after the tasks in the exercise*)\n  have \\<open>Co g p \\<in> sub_C \\<phi>\\<close> \n    using assms(2) by auto\n  have a: \\<open>i \\<in> set g \\<Longrightarrow> w \\<in> set \\<w> \\<Longrightarrow> A \\<turnstile> \\<^bold>\\<And> w \\<^bold>\\<longrightarrow> K i p\\<close> for w i\n  proof-\n    assume \\<open>i \\<in> set g\\<close>\n    assume \\<open>w \\<in> set \\<w>\\<close>\n    then have \\<open>set w \\<in> WCo\\<close>\n      using \\<open>set (map set \\<w>) = WCo\\<close> by auto\n    then have \\<open>set w \\<in> mcss A \\<phi>\\<close> \\<open>canonical A \\<phi>, set w \\<Turnstile> Co g p\\<close>\n      unfolding WCo_def by simp_all\n    then have \\<open>canonical A \\<phi>, set w \\<Turnstile> K i p\\<close> \n      using \\<open>i \\<in> set g\\<close> by auto\n    moreover have \\<open>K i p \\<in> sub_C \\<phi>\\<close> \n      using \\<open>Co g p \\<in> sub_C \\<phi>\\<close> \\<open>i \\<in> set g\\<close> \n      by (induct \\<phi>) auto\n    ultimately have \\<open>K i p \\<in> set w\\<close>\n      using hyp \\<open>set w \\<in> mcss A \\<phi>\\<close>  truth_lemma_Ka by blast\n    then show ?thesis \n    proof (induct w)\n      case Nil\n      then show ?case \n        by auto\n    next\n      case (Cons a w)\n      then show ?case \n        by (metis K_imply_Cons K_imply_head R1 conjunct_implies_imply imply_implies_conjunct set_ConsD)\n    qed \n  qed\n  define WNCo where \\<open>WNCo \\<equiv> {W \\<in> mcss A \\<phi>. \\<not> canonical A \\<phi>, W \\<Turnstile> Co g p}\\<close>\n  have b: \\<open>i \\<in> set g \\<Longrightarrow> w \\<in> set \\<w> \\<Longrightarrow> set w' \\<in> WNCo \\<Longrightarrow> A \\<turnstile> \\<^bold>\\<And> w \\<^bold>\\<longrightarrow> K i (\\<^bold>\\<not> (\\<^bold>\\<And> w'))\\<close> for w' w i\n  proof-\n    assume \\<open>i \\<in> set g\\<close> \\<open>w \\<in> set \\<w>\\<close> \\<open>set w' \\<in> WNCo\\<close>\n    then have \\<open>set w \\<in> WCo\\<close>\n      using \\<open>set (map set \\<w>) = WCo\\<close> by auto\n    then have E: \\<open>set w \\<in> mcss A \\<phi>\\<close> \\<open>set w' \\<in> mcss A \\<phi>\\<close> \\<open>canonical A \\<phi>, set w \\<Turnstile> Co g p\\<close>  \\<open>\\<not> canonical A \\<phi>, set w' \\<Turnstile> Co g p\\<close>\n      using \\<open>set w' \\<in> WNCo\\<close> unfolding WNCo_def WCo_def by simp_all\n    have \\<open>set w' \\<notin> reach A i (set w)\\<close> \n    proof (rule ccontr)\n      assume \\<open>\\<not> set w' \\<notin> reach A i (set w)\\<close>\n      then have 1: \\<open>set w' \\<in> \\<K> (canonical A \\<phi>) i (set w)\\<close>\n        by simp\n      from E(4) obtain k where 2: \\<open>\\<not> canonical A \\<phi>, set w' \\<Turnstile> Ev_n g p k\\<close> \n        by auto\n      have \\<open>canonical A \\<phi>, set w \\<Turnstile> Ev_n g p (k + 1)\\<close> \n        using E(3) by fastforce\n      then have \\<open>canonical A \\<phi>, set w \\<Turnstile> K i (Ev_n g p k)\\<close>\n        using \\<open>i \\<in> set g\\<close> by simp\n      then have \\<open>canonical A \\<phi>, set w' \\<Turnstile> Ev_n g p k\\<close>\n        using 1 \\<open>set w' \\<in> mcss A \\<phi>\\<close> by simp\n      then show False \n        using 2 by simp\n    qed\n    then obtain q where q_def: \\<open>K i q \\<in> set w \\<and> q \\<notin> set w'\\<close> \n      by auto\n    then have \\<open>K i q \\<in> sub_C' \\<phi>\\<close> \n      using E(1) by blast\n    then have \\<open>K i q \\<in> sub_C \\<phi>\\<close> \n      by blast\n    then have \\<open>q \\<in> sub_C \\<phi>\\<close>\n      by (metis insertI2 p_in_sub_C_p sub_C.simps(6) sub_C_transitive)\n    then have \\<open>\\<not> consistent A (insert q (set w'))\\<close>\n      using E(2) insert_is_Un maximal'_def mem_Collect_eq q_def by fastforce\n    then have \\<open>A \\<turnstile> q # w' \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> \n      by (metis K_imply_weaken consistent_def list.simps(15))\n    then have \\<open>A \\<turnstile> q \\<^bold>\\<longrightarrow> \\<^bold>\\<not>(\\<^bold>\\<And>w')\\<close>\n      by (metis imp_chain imply.simps(2) imply_implies_conjunct)\n    then have \\<open>A \\<turnstile> K i q \\<^bold>\\<longrightarrow> K i (\\<^bold>\\<not>(\\<^bold>\\<And>w'))\\<close>\n      by (simp add: K_map)\n    then show ?thesis \n      using q_def conjunct_implies_elem imp_chain by blast\n  qed\n  obtain \\<w>' where \\<open>set (map set \\<w>') = WNCo\\<close> \n  proof-\n    have \\<open>finite (mcss A \\<phi>)\\<close>\n      using sub_C'_finite by fast\n    then have \\<open>finite WNCo\\<close> \n      unfolding WNCo_def by fastforce\n    moreover have \\<open>\\<forall> w' \\<in> WNCo. finite w'\\<close> \n      unfolding WNCo_def \n      by (smt (verit) mem_Collect_eq rev_finite_subset sub_C'_finite)\n    ultimately show \\<open>(\\<And>\\<w>'. set (map set \\<w>') = WNCo \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close>\n      using list_of_lists_if_finite_set_of_sets by blast\n  qed\n  have c: \\<open>i \\<in> set g \\<Longrightarrow> w \\<in> set \\<w> \\<Longrightarrow> A \\<turnstile> \\<^bold>\\<And> w \\<^bold>\\<longrightarrow> K i (p \\<^bold>\\<and> (\\<^bold>\\<And> map (\\<lambda> w'. \\<^bold>\\<not> (\\<^bold>\\<And> w')) \\<w>'))\\<close> for w i \n  proof-\n    assume \\<open>i \\<in> set g\\<close> \\<open>w \\<in> set \\<w>\\<close>\n    then have \\<open>\\<forall> w' \\<in> set \\<w>'. A \\<turnstile> \\<^bold>\\<And> w \\<^bold>\\<longrightarrow> K i (\\<^bold>\\<not>(\\<^bold>\\<And> w'))\\<close>\n      using b \\<open>set (map set \\<w>') = WNCo\\<close> by auto\n    then have \\<open>A \\<turnstile> \\<^bold>\\<And> w \\<^bold>\\<longrightarrow> K i (\\<^bold>\\<And> map (\\<lambda> w'. \\<^bold>\\<not> (\\<^bold>\\<And> w')) \\<w>')\\<close>\n    proof (induct \\<w>')\n      case Nil\n      then show ?case \n        by (metis R1 R2 conE1 conE2 con_imp_antecedents conjunct.simps(1) list.simps(8))\n    next\n      case (Cons w' \\<w>')\n      then have \\<open>A \\<turnstile> \\<^bold>\\<And> w \\<^bold>\\<longrightarrow> K i (\\<^bold>\\<And> map (\\<lambda>w'. \\<^bold>\\<not> (\\<^bold>\\<And> w')) \\<w>')\\<close> \n        by simp\n      moreover have \\<open>A \\<turnstile> \\<^bold>\\<And> w \\<^bold>\\<longrightarrow> K i (\\<^bold>\\<not> (\\<^bold>\\<And> w'))\\<close>\n        using Cons.prems by simp\n      ultimately have \\<open>A \\<turnstile> \\<^bold>\\<And> w \\<^bold>\\<longrightarrow> K i (\\<^bold>\\<not> (\\<^bold>\\<And> w') \\<^bold>\\<and> (\\<^bold>\\<And> map (\\<lambda>w'. \\<^bold>\\<not> (\\<^bold>\\<And> w')) \\<w>'))\\<close> \n        using conjunction_in_K by fast\n      then show ?case\n        by simp\n    qed\n    then show ?thesis\n      using a \\<open>i \\<in> set g\\<close> \\<open>w \\<in> set \\<w>\\<close> conjunction_in_K by fast\n  qed\n  have d_hint: \\<open>A \\<turnstile> (\\<^bold>\\<Or> (map conjunct \\<w>)) \\<^bold>\\<or> (\\<^bold>\\<Or> (map conjunct \\<w>'))\\<close>\n  proof-\n    have \\<open>(set (map set \\<w>) \\<union> set (map set \\<w>')) = mcss A \\<phi>\\<close>\n      using \\<open>set (map set \\<w>) = WCo\\<close> \\<open>set (map set \\<w>') = WNCo\\<close> unfolding WCo_def WNCo_def \n      using Collect_cong Collect_disj_eq mem_Collect_eq by auto\n    then have \\<open>set (map set (\\<w> @ \\<w>')) = mcss A \\<phi>\\<close> \n      by simp\n    moreover have \\<open>set (map set W) = mcss A \\<phi> \\<Longrightarrow> A \\<turnstile> \\<^bold>\\<Or> map conjunct W\\<close> for W \n    proof (rule ccontr)\n      assume a: \\<open>set (map set W) = mcss A \\<phi>\\<close> \\<open>\\<not>A \\<turnstile> \\<^bold>\\<Or> map conjunct W\\<close> \n      {\n        from a(2) have \\<open>\\<exists> w'. (\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. p \\<in> set w') \\<and> \\<not>A \\<turnstile> \\<^bold>\\<Or> w'\\<close> \n          using combine_disjunct by blast\n        then obtain w' where w'_def: \\<open>(\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. p \\<in> set w')\\<close> \\<open>\\<not>A \\<turnstile> \\<^bold>\\<Or> w'\\<close>\n          by auto\n        then have \\<open>\\<not>A \\<turnstile> \\<^bold>\\<not>(\\<^bold>\\<And> map Neg w')\\<close>\n          by (metis K_Boole de_morgan_conjunct imp_chain imply.simps(1) imply.simps(2))\n        have \\<open>consistent A {\\<^bold>\\<And> map Neg w'}\\<close> \n        proof (rule ccontr)\n          assume \\<open>\\<not>consistent A {\\<^bold>\\<And> map Neg w'}\\<close>\n          then have \\<open>A \\<turnstile> [\\<^bold>\\<And> map Neg w'] \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> \n            unfolding consistent_def \n            by (metis (mono_tags, lifting) K_imply_weaken empty_set list.simps(15))\n          then have \\<open>A \\<turnstile> \\<^bold>\\<not>(\\<^bold>\\<And> map Neg w')\\<close>\n            by simp\n          from \\<open>\\<not>A \\<turnstile> \\<^bold>\\<not>(\\<^bold>\\<And> map Neg w')\\<close> this show False ..\n        qed\n        moreover have \\<open>\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. \\<^bold>\\<not>p \\<in> set (map Neg w')\\<close>\n          using w'_def(1) by fastforce\n        ultimately have \\<open>\\<exists> w'. consistent A {\\<^bold>\\<And>w'} \\<and> (\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. \\<^bold>\\<not>p \\<in> set w')\\<close> \n          by fast\n      }\n      then have \\<open>\\<exists> w'. consistent A (set w') \\<and> (\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. \\<^bold>\\<not>p \\<in> set w')\\<close>\n        by (metis conjunct_implies_elem consistent_implies insertI1)\n      then have \\<open>\\<exists> w'. consistent A w' \\<and> (\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. comp p \\<in> w') \\<and> w' \\<subseteq> sub_C' \\<phi>\\<close> \n      proof\n        fix w'\n        assume a': \\<open>consistent A w' \\<and> (\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. \\<^bold>\\<not>p \\<in> w')\\<close>\n        define wp where \\<open>wp \\<equiv> {p. (\\<exists> w \\<in> set W. p \\<in> set w) \\<and> (\\<^bold>\\<not>p \\<in> w')}\\<close>\n        then have \\<open>\\<forall> p \\<in> wp. p \\<in> sub_C' \\<phi>\\<close>\n          using a(1) by auto\n        then have 1:\\<open>\\<forall> p \\<in> wp. comp p \\<in> sub_C' \\<phi>\\<close> \n          by (metis comp_in_sub_C)\n        have \\<open>finite (mcss A \\<phi>)\\<close>\n          by (metis List.finite_set a(1))\n        moreover have \\<open>\\<forall> w \\<in> mcss A \\<phi>. finite w\\<close> \n          by (metis List.finite_set a(1) ex_map_conv)\n        ultimately have f: \\<open>finite wp\\<close> \n          unfolding wp_def using a by simp\n        have 2: \\<open>\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. comp p \\<in> image comp wp\\<close>\n          using wp_def a' by blast\n        have \\<open>image Neg wp \\<subseteq> w'\\<close>\n          using wp_def by auto\n        then have \\<open>consistent A (image Neg wp)\\<close>\n          using a'(1) unfolding consistent_def by simp\n        moreover have \\<open>\\<forall> p. A \\<turnstile> \\<^bold>\\<not>p \\<^bold>\\<longrightarrow> comp p\\<close> \n          by (metis K_trans R1 comp_imp1 comp_imp2 con_imp_antecedents swap_antecedents)\n        ultimately have \\<open>consistent A (image comp wp)\\<close>\n          using consistent_implies by (smt (verit, ccfv_SIG) imageE image_eqI)\n        from 1 2 this show ?thesis\n          by blast\n      qed\n      then obtain w' where w'_def: \n        \\<open>consistent A w'\\<close> \\<open>\\<forall> w \\<in> set W. \\<exists> p \\<in> set w. comp p \\<in> w'\\<close> \\<open>w' \\<subseteq> sub_C' \\<phi>\\<close>\n        by auto\n      then obtain mw' where mw'_def: \\<open>consistent A mw'\\<close> \\<open>maximal' A \\<phi> mw'\\<close> \\<open>w' \\<subseteq> mw'\\<close> \\<open>mw' \\<subseteq> sub_C' \\<phi>\\<close>\n        using maximal_extension' by metis\n      moreover have \\<open>mw' \\<notin> mcss A \\<phi>\\<close> \n      proof-\n        have \\<open>\\<forall> w. w \\<in> mcss A \\<phi> \\<longrightarrow> w \\<in> set (map set W)\\<close>\n          using a(1) by simp\n        then have \\<open>\\<forall> w \\<in> mcss A \\<phi>. \\<exists> ps \\<in> set W. set ps = w\\<close> \n          by (metis (no_types, lifting) image_iff list.set_map)\n        then have \\<open>\\<forall> w \\<in> mcss A \\<phi>. \\<exists> p \\<in> w. comp p \\<in> mw'\\<close> \n          using \\<open>w' \\<subseteq> mw'\\<close> w'_def(2) by (metis a(1) subset_iff)\n        moreover have \\<open>\\<forall> p. A \\<turnstile> [p,comp p] \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n          by (simp add: comp_imp1)\n        ultimately have \\<open>\\<forall> w \\<in> mcss A \\<phi>. w \\<noteq> mw'\\<close>\n          unfolding consistent_def \n          by (smt (verit, best) exactly_one_in_maximal' mw'_def(1) mw'_def(2) mw'_def(4) subset_iff)\n        then show ?thesis \n          by blast\n      qed\n      ultimately show False\n        by simp\n    qed\n    ultimately have \\<open>A \\<turnstile> \\<^bold>\\<Or> map conjunct (\\<w> @ \\<w>')\\<close> \n      by presburger\n    then show ?thesis \n        by (metis R1 disjunct_split map_append)\n  qed\n  have d: \\<open>A \\<turnstile> (\\<^bold>\\<And> map (\\<lambda> w'. \\<^bold>\\<not> (\\<^bold>\\<And> w')) \\<w>') \\<^bold>\\<longrightarrow> \\<phi>\\<^sub>\\<w>\\<close>\n  proof-\n    have \\<open>A \\<turnstile> (\\<^bold>\\<And> map (\\<lambda> w'. \\<^bold>\\<not> (\\<^bold>\\<And> w')) \\<w>') \\<^bold>\\<longrightarrow> \\<^bold>\\<not>(\\<^bold>\\<Or> (map conjunct \\<w>'))\\<close>\n    proof-\n      have \\<open>(\\<^bold>\\<And> map (\\<lambda> w'. \\<^bold>\\<not> (\\<^bold>\\<And> w')) \\<w>') = (\\<^bold>\\<And> map Neg (map conjunct \\<w>'))\\<close>\n        by (induct \\<w>') auto\n      then show ?thesis\n        using extract_neg_conjunct by metis\n    qed\n    moreover have \\<open>A \\<turnstile> \\<^bold>\\<not>(\\<^bold>\\<Or> (map conjunct \\<w>')) \\<^bold>\\<longrightarrow> (\\<^bold>\\<Or> (map conjunct \\<w>))\\<close>\n      using d_hint dis_to_imp by auto\n    ultimately show ?thesis\n      using imp_chain assms(4) by auto\n    qed\n  have e: \\<open>i \\<in> set g \\<Longrightarrow> w \\<in> set \\<w> \\<Longrightarrow> A \\<turnstile> \\<^bold>\\<And> w \\<^bold>\\<longrightarrow> K i (p \\<^bold>\\<and> \\<phi>\\<^sub>\\<w>)\\<close> for w i \n  proof- \n    assume \\<open>i \\<in> set g\\<close>\n    moreover assume \\<open>w \\<in> set \\<w>\\<close>\n    ultimately have \\<open>A \\<turnstile>  K i (p \\<^bold>\\<and> (\\<^bold>\\<And> map (\\<lambda> w'. \\<^bold>\\<not> (\\<^bold>\\<And> w')) \\<w>')) \\<^bold>\\<longrightarrow> K i (p \\<^bold>\\<and> \\<phi>\\<^sub>\\<w>)\\<close>\n      using d R1 by (metis K_map conE1 con_imp2 con_imp_antecedents)\n    then show ?thesis\n      using \\<open>i \\<in> set g\\<close> \\<open>w \\<in> set \\<w>\\<close> c d imp_chain by fast\n  qed\n  then show f: ?thesis \n  proof -\n    have *:\\<open>\\<forall> p \\<in> set ps. A \\<turnstile> p \\<^bold>\\<longrightarrow> q \\<Longrightarrow> A \\<turnstile> \\<^bold>\\<Or> ps \\<^bold>\\<longrightarrow> q\\<close> for ps q\n    proof (induct ps)\n      case Nil\n      then show ?case \n        by (simp add: A1)\n    next\n      case (Cons p ps)\n      then have \\<open>A \\<turnstile> \\<^bold>\\<Or> ps \\<^bold>\\<longrightarrow> q\\<close>\n        by simp\n      moreover have \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> q\\<close> \n        using Cons by simp\n      moreover have \\<open>A \\<turnstile> (p \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> (\\<^bold>\\<Or> ps \\<^bold>\\<longrightarrow> q) \\<^bold>\\<longrightarrow> p \\<^bold>\\<or> (\\<^bold>\\<Or> ps) \\<^bold>\\<longrightarrow> q\\<close>\n        using A1 by force\n      ultimately have \\<open>A \\<turnstile> p \\<^bold>\\<or> (\\<^bold>\\<Or> ps) \\<^bold>\\<longrightarrow> q\\<close> \n        using R1 by blast\n      then show ?case \n        by simp\n    qed\n    have \\<open>i \\<in> set g \\<Longrightarrow> \\<forall> \\<phi>\\<^sub>w \\<in> set (map conjunct \\<w>). A \\<turnstile> \\<phi>\\<^sub>w \\<^bold>\\<longrightarrow> K i (p \\<^bold>\\<and> \\<phi>\\<^sub>\\<w>)\\<close> for i\n      using e by simp\n    then have \\<open>\\<forall> \\<phi>\\<^sub>w \\<in> set (map conjunct \\<w>). A \\<turnstile> \\<phi>\\<^sub>w \\<^bold>\\<longrightarrow> unfold_Ev g (p \\<^bold>\\<and> \\<phi>\\<^sub>\\<w>)\\<close> \n    proof (induct g)\n      case Nil\n      then show ?case \n        by (metis conE2 con_imp_antecedents empty_fold)\n    next\n      case (Cons i g)\n      show ?case \n      proof\n        fix \\<phi>\\<^sub>w \n        assume \\<open>\\<phi>\\<^sub>w\\<in>set (map conjunct \\<w>)\\<close>\n        then have \\<open>A \\<turnstile> \\<phi>\\<^sub>w \\<^bold>\\<longrightarrow> unfold_Ev g (p \\<^bold>\\<and> \\<phi>\\<^sub>\\<w>)\\<close>\n          using Cons by auto\n        moreover have \\<open>A \\<turnstile> \\<phi>\\<^sub>w \\<^bold>\\<longrightarrow> K i (p \\<^bold>\\<and> \\<phi>\\<^sub>\\<w>)\\<close>\n          using Cons.prems \\<open>\\<phi>\\<^sub>w \\<in> set (map conjunct \\<w>)\\<close> by auto\n        ultimately  show \\<open>A \\<turnstile> \\<phi>\\<^sub>w \\<^bold>\\<longrightarrow> unfold_Ev (i # g) (p \\<^bold>\\<and> \\<phi>\\<^sub>\\<w>)\\<close>  \n          by (simp add: con_imp2)\n      qed\n    qed\n    then have \\<open>\\<forall> \\<phi>\\<^sub>w \\<in> set (map conjunct \\<w>). A \\<turnstile> \\<phi>\\<^sub>w \\<^bold>\\<longrightarrow> Ev g (p \\<^bold>\\<and> \\<phi>\\<^sub>\\<w>)\\<close> \n      using C1b imp_chain by blast\n    then show ?thesis\n      using assms(4) * by simp\n  qed\nqed\n\nlemma truth_lemma_K: \n  fixes p :: \\<open>('i :: countable) fm\\<close>\n  assumes prems: \\<open>V \\<in> mcss A \\<phi>\\<close> \\<open>K i p \\<in> sub_C' \\<phi>\\<close>\n  assumes hyp: \\<open>\\<And> V. V \\<in> mcss A \\<phi> \\<Longrightarrow> p \\<in> V \\<longleftrightarrow> canonical A \\<phi>, V \\<Turnstile> p\\<close>\n  shows \\<open>K i p \\<in> V \\<longleftrightarrow> canonical A \\<phi>, V \\<Turnstile> K i p\\<close>\nproof-\n  from \\<open>K i p \\<in> sub_C' \\<phi>\\<close> have \\<open>K i p \\<in> sub_C \\<phi>\\<close>\n    by (simp add: image_iff)\n  hence \\<open>p \\<in> sub_C \\<phi>\\<close>\n    by (metis insertI2 p_in_sub_C_p sub_C.simps(6) sub_C_transitive)\n  hence \\<open>p \\<in> sub_C' \\<phi>\\<close>\n    by simp\n  show ?thesis\n  proof (safe)\n    assume \\<open>K i p \\<in> V\\<close>\n    then have \\<open>W \\<in> reach A i V \\<Longrightarrow> W \\<in> mcss A \\<phi> \\<Longrightarrow> canonical A \\<phi>, W \\<Turnstile> p\\<close> for W\n      using hyp by auto\n    then show \\<open>canonical A \\<phi>, V \\<Turnstile> K i p\\<close> \n      by simp\n  next \n    assume \\<open>canonical A \\<phi>, V \\<Turnstile> K i p\\<close> \n    then show \\<open>K i p \\<in> V\\<close>\n      using truth_lemma_Ka prems hyp by blast\n  qed\nqed\n\nlemma truth_lemma_Ev: \n  fixes p :: \\<open>('i :: countable) fm\\<close>\n  assumes prems: \\<open>V \\<in> mcss A \\<phi>\\<close> \\<open>Ev g p \\<in> sub_C' \\<phi>\\<close>\n  assumes hyp: \\<open>\\<And> V. V \\<in> mcss A \\<phi> \\<Longrightarrow> p \\<in> V \\<longleftrightarrow> canonical A \\<phi>, V \\<Turnstile> p\\<close>\n  shows \\<open>Ev g p \\<in> V \\<longleftrightarrow> canonical A \\<phi>, V \\<Turnstile> Ev g p\\<close>\nproof-\n  from \\<open>Ev g p \\<in> sub_C' \\<phi> \\<close> have \\<open>Ev g p \\<in> sub_C \\<phi>\\<close>\n    by (simp add: image_iff)\n  then have \\<open>\\<forall> i \\<in> set g. K i p \\<in> sub_C \\<phi>\\<close>\n    by (induct \\<phi>) auto\n  then have \\<open>\\<forall> i \\<in> set g. K i p \\<in> sub_C' \\<phi>\\<close>\n    by simp\n  then have \\<open>(Ev g p \\<in> V) = (\\<forall> i \\<in> set g. K i p \\<in> V)\\<close> \n  proof (safe)\n    fix i\n    assume \\<open>Ev g p \\<in> V\\<close> \\<open>i \\<in> set g\\<close>\n    moreover have \\<open>A \\<turnstile> Ev g p \\<^bold>\\<longrightarrow> K i p\\<close>\n      using \\<open>i \\<in> set g\\<close> by (simp add: Ev_implies_K)\n    ultimately show \\<open>K i p \\<in> V\\<close>\n      using \\<open>\\<forall> i \\<in> set g. K i p \\<in> sub_C' \\<phi>\\<close> consistent_consequent maximal'_def prems(1) by blast\n  next\n    assume \\<open>\\<forall> i \\<in> set g. K i p \\<in> V\\<close>\n    then have *: \\<open>set (map (\\<lambda> i. K i p) g) \\<subseteq> V\\<close>\n      by (simp add: image_subset_iff)\n    have \\<open>A \\<turnstile> map (\\<lambda> i. K i p) g \\<^bold>\\<leadsto> unfold_Ev g p\\<close>\n    proof (induct g)\n      case Nil\n      then show ?case \n        by (metis conjunct.simps(1) empty_fold imply_implies_itself list.simps(8))\n    next\n      case (Cons i g)\n      then have \\<open>A \\<turnstile> map (\\<lambda>i. K i p) (i # g) \\<^bold>\\<leadsto> unfold_Ev g p\\<close>\n        using K_imply_Cons by auto\n      moreover have \\<open>A \\<turnstile> map (\\<lambda>i. K i p) (i # g) \\<^bold>\\<leadsto> K i p\\<close>\n        using K_imply_head by auto\n      ultimately have \\<open>A \\<turnstile> map (\\<lambda>i. K i p) (i # g) \\<^bold>\\<leadsto> (K i p \\<^bold>\\<and> unfold_Ev (g) p)\\<close>\n        using K_implies_combine by fast\n      then show ?case\n        by simp\n    qed\n    then have \\<open>A \\<turnstile> map (\\<lambda> i. K i p) g \\<^bold>\\<leadsto> Ev g p\\<close> \n      by (metis C1b K_imply_head K_right_mp R1 imply.simps(2))\n    then show \\<open>Ev g p \\<in> V\\<close> \n      using consequent_in_maximal' \\<open>\\<forall> i \\<in> set g. K i p \\<in> sub_C' \\<phi>\\<close> prems * by blast\n  qed\n  moreover have \\<open>(\\<forall> i \\<in> set g. (K i p \\<in> V) = (canonical A \\<phi>, V \\<Turnstile> K i p))\\<close> \n  proof\n    fix i\n    assume \\<open>i \\<in> set g\\<close>\n    then show \\<open>(K i p \\<in> V) = (canonical A \\<phi>, V \\<Turnstile> K i p)\\<close> \n      using truth_lemma_K \\<open>\\<forall>i\\<in>set g. K i p \\<in> sub_C' \\<phi>\\<close> hyp prems(1) by blast\n  qed\n  moreover have \\<open>(\\<forall> i \\<in> set g. canonical A \\<phi>, V \\<Turnstile> K i p) = (canonical A \\<phi>, V \\<Turnstile> Ev g p)\\<close> \n    by simp\n  ultimately show ?thesis \n    by simp\nqed\n\n\nlemma truth_lemma:\n  fixes p :: \\<open>('i :: countable) fm\\<close>\n  assumes \\<open>p \\<in> sub_C' \\<phi>\\<close> and \\<open>V \\<in> mcss A \\<phi>\\<close>\n  shows \\<open>p \\<in> V \\<longleftrightarrow> canonical A \\<phi>, V \\<Turnstile> p\\<close>\n  using assms\nproof (induct p arbitrary: V)\n  case FF\n  have \\<open>V \\<subseteq> sub_C' \\<phi>\\<close> \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close>\n    using \\<open>V \\<in> mcss A \\<phi>\\<close> by simp_all\n  show ?case\n  proof safe\n    assume \\<open>\\<^bold>\\<bottom> \\<in> V\\<close>\n    then have False\n      using \\<open>consistent A V\\<close> K_imply_head unfolding consistent_def \n      by (metis bot.extremum insert_subset list.set(1) list.simps(15))\n    then show \\<open>canonical A \\<phi>, V \\<Turnstile> \\<^bold>\\<bottom>\\<close> ..\n  next\n    assume \\<open>canonical A \\<phi>, V \\<Turnstile> \\<^bold>\\<bottom>\\<close>\n    then show \\<open>\\<^bold>\\<bottom> \\<in> V\\<close>\n      by simp\n  qed\nnext\n  case (Pro x)\n  then show ?case\n    by simp\nnext\n  case (Dis p q)\n  have \\<open>V \\<subseteq> sub_C' \\<phi>\\<close> \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close>\n    using \\<open>V \\<in> mcss A \\<phi>\\<close> by simp_all\n  from Dis have \\<open>p \\<^bold>\\<or> q \\<in> sub_C \\<phi>\\<close> \n    by auto\n  moreover have \\<open>p \\<in> sub_C (p \\<^bold>\\<or> q) \\<and> q \\<in> sub_C (p \\<^bold>\\<or> q)\\<close> \n    by (simp add: p_in_sub_C_p)\n  ultimately have \\<open>p \\<in> sub_C \\<phi> \\<and> q \\<in> sub_C \\<phi>\\<close>\n    using sub_C_transitive by blast\n  then have p_q_in_phi: \\<open>p \\<in> sub_C' \\<phi> \\<and> q \\<in> sub_C' \\<phi>\\<close>\n    by simp\n  from Dis show ?case\n  proof safe\n    assume \\<open>p \\<^bold>\\<or> q \\<in> V\\<close>\n    then have p_or_q_cons: \\<open>consistent A ({p} \\<union> V) \\<or> consistent A ({q} \\<union> V)\\<close>\n      using \\<open>consistent A V\\<close> consistent_disjuncts by blast\n    have \\<open>p \\<in> V \\<or> q \\<in> V\\<close>\n    proof (rule ccontr)\n      assume \\<open>\\<not> (p \\<in> V \\<or> q \\<in> V)\\<close>\n      from \\<open>\\<not> (p \\<in> V \\<or> q \\<in> V)\\<close> p_q_in_phi have \\<open>\\<not>(consistent A ({p} \\<union> V) \\<or> consistent A ({q} \\<union> V))\\<close>\n        using \\<open>maximal' A \\<phi> V\\<close> unfolding maximal'_def by meson\n      then show False\n        using p_or_q_cons ..\n    qed\n    then have \\<open>p \\<in> sub_C' \\<phi> \\<or> q \\<in> sub_C' \\<phi>\\<close> \n      using Dis.prems by blast\n    then show \\<open>canonical A \\<phi>, V \\<Turnstile> (p \\<^bold>\\<or> q)\\<close> \n      using Dis by (smt (verit, best) \\<open>p \\<in> V \\<or> q \\<in> V\\<close> p_q_in_phi semantics.simps(3))\n  next\n    assume a: \\<open>canonical A \\<phi>, V \\<Turnstile> (p \\<^bold>\\<or> q)\\<close> \n    consider \\<open>canonical A \\<phi>, V \\<Turnstile> p\\<close> | \\<open>canonical A \\<phi>, V \\<Turnstile> q\\<close>\n      using a by auto\n    then have \\<open>p \\<in> V \\<or> q \\<in> V\\<close>\n      using p_q_in_phi Dis by meson\n    moreover have \\<open>A \\<turnstile> p \\<^bold>\\<longrightarrow> p \\<^bold>\\<or> q\\<close> \\<open>A \\<turnstile> q \\<^bold>\\<longrightarrow> p \\<^bold>\\<or> q\\<close>\n      by (auto simp: A1)\n    ultimately show \\<open>(p \\<^bold>\\<or> q) \\<in> V\\<close>\n      using Dis.prems consistent_consequent maximal'_def by fast\n  qed\nnext\n  case (Con p q)\n  have \\<open>V \\<subseteq> sub_C' \\<phi>\\<close> \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close>\n    using \\<open>V \\<in> mcss A \\<phi>\\<close> by simp_all\n  from Con have \\<open>p \\<^bold>\\<and> q \\<in> sub_C \\<phi>\\<close> \n    by auto\n  moreover have \\<open>p \\<in> sub_C (p \\<^bold>\\<and> q) \\<and> q \\<in> sub_C (p \\<^bold>\\<and> q)\\<close> \n    by (simp add: p_in_sub_C_p)\n  ultimately have \\<open>p \\<in> sub_C \\<phi> \\<and> q \\<in> sub_C \\<phi>\\<close>\n    using sub_C_transitive by blast\n  then have p_q_in_phi: \\<open>p \\<in> sub_C' \\<phi> \\<and> q \\<in> sub_C' \\<phi>\\<close>\n    by simp\n  from Con show ?case\n  proof safe\n    assume \\<open>(p \\<^bold>\\<and> q) \\<in> V\\<close>\n    then have \\<open>consistent A ({p} \\<union> V)\\<close> \\<open>consistent A ({q} \\<union> V)\\<close>\n      using \\<open>consistent A V\\<close> consistent_consequent' by fastforce+\n    then have \\<open>p \\<in> V\\<close> \\<open>q \\<in> V\\<close>\n      using p_q_in_phi \\<open>maximal' A \\<phi> V\\<close> unfolding maximal'_def by fast+\n    then show \\<open>canonical A \\<phi>, V \\<Turnstile> (p \\<^bold>\\<and> q)\\<close>\n      using Con p_q_in_phi by fastforce\n  next\n    assume \\<open>canonical A  \\<phi>, V \\<Turnstile> (p \\<^bold>\\<and> q)\\<close>\n    then have \\<open>canonical A \\<phi>, V \\<Turnstile> p\\<close> \\<open>canonical A \\<phi>, V \\<Turnstile> q\\<close>\n      by auto\n    then have \\<open>p \\<in> V\\<close> \\<open>q \\<in> V\\<close>\n      using Con p_q_in_phi by blast+\n    then have \\<open>set [p, q] \\<subseteq> V\\<close> \n      by simp\n    moreover have \\<open>A \\<turnstile> [p, q] \\<^bold>\\<leadsto> p \\<^bold>\\<and> q\\<close>\n      by (auto simp: A1)\n    moreover have \\<open>set [p, q] \\<subseteq> sub_C' \\<phi>\\<close>\n      using \\<open>p \\<in> sub_C \\<phi> \\<and> q \\<in> sub_C \\<phi>\\<close> by auto\n    ultimately show \\<open>(p \\<^bold>\\<and> q) \\<in> V\\<close>\n      using Con.prems consequent_in_maximal' by blast\n  qed\nnext\n  case (Imp p q)\n  have \\<open>V \\<subseteq> sub_C' \\<phi>\\<close> \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close>\n    using \\<open>V \\<in> mcss A \\<phi>\\<close> by simp_all\n  from Imp have \\<open>p \\<^bold>\\<longrightarrow> q \\<in> sub_C \\<phi> \\<or> q = \\<^bold>\\<bottom>\\<close> \n    by auto\n  moreover have \\<open>p \\<in> sub_C (p \\<^bold>\\<longrightarrow> q) \\<and> q \\<in> sub_C (p \\<^bold>\\<longrightarrow> q)\\<close> \n    by (simp add: p_in_sub_C_p)\n  ultimately have \\<open>p \\<in> sub_C \\<phi> \\<and> (q \\<in> sub_C \\<phi> \\<or> q = \\<^bold>\\<bottom>)\\<close>\n    using sub_C_transitive Imp.prems(1) by blast\n  then have p_q_in_phi: \\<open>p \\<in> sub_C' \\<phi> \\<and> (q \\<in> sub_C' \\<phi> \\<or> q = \\<^bold>\\<bottom>)\\<close>\n    by auto\n  show ?case\n  proof (rule iffI)\n    assume \\<open>(p \\<^bold>\\<longrightarrow> q) \\<in> V\\<close>\n    from p_q_in_phi have \\<open>p \\<in> V \\<or> \\<^bold>\\<not>p \\<in> V\\<close>\n      using \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close> p_q_in_phi\n      by (metis UnI2 \\<open>p \\<in> sub_C \\<phi> \\<and> (q \\<in> sub_C \\<phi> \\<or> q = \\<^bold>\\<bottom>)\\<close> consistent_extend_by_p maximal'_def rev_image_eqI)\n    then consider \\<open>p \\<in> V\\<close> | \\<open>\\<^bold>\\<not>p \\<in> V\\<close> \n      by fast\n    then show \\<open>canonical A \\<phi>, V \\<Turnstile> (p \\<^bold>\\<longrightarrow> q)\\<close>\n    proof cases\n      case 1\n      then have \\<open>q \\<in> V \\<or> \\<^bold>\\<not>q \\<in> V \\<or> q = \\<^bold>\\<bottom>\\<close> \n        using \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close> p_q_in_phi \n        by (metis UnI2 \\<open>p \\<in> sub_C \\<phi> \\<and> (q \\<in> sub_C \\<phi> \\<or> q = \\<^bold>\\<bottom>)\\<close> consistent_extend_by_p maximal'_def rev_image_eqI)\n      then consider (a)\\<open>q \\<in> V\\<close> | (b)\\<open>\\<^bold>\\<not>q \\<in> V \\<or> q = \\<^bold>\\<bottom>\\<close>\n        by fast\n      then show ?thesis \n      proof cases\n        case a\n        then show ?thesis\n          using Imp p_q_in_phi by blast\n      next\n        case b\n        then consider (x)\\<open>\\<^bold>\\<not> q \\<in> V\\<close> | (y)\\<open>q = \\<^bold>\\<bottom>\\<close>\n          by auto\n        then have \\<open>\\<not> consistent A V\\<close>\n        proof cases\n          case x\n          moreover have \\<open>A \\<turnstile> [p,p \\<^bold>\\<longrightarrow> q,\\<^bold>\\<not>q] \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> \n            using A1 by force\n          ultimately show ?thesis \n            using 1 \\<open>(p \\<^bold>\\<longrightarrow> q) \\<in> V\\<close> unfolding consistent_def\n            by (metis Un_Diff_cancel empty_set insert_Diff insert_is_Un insert_subsetI le_iff_sup list.simps(15))\n        next\n          case y\n          then have \\<open>A \\<turnstile> [p,p \\<^bold>\\<longrightarrow> q] \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close>\n            using A1 by force\n          then show ?thesis \n            using 1 \\<open>(p \\<^bold>\\<longrightarrow> q) \\<in> V\\<close> unfolding consistent_def \n            by (metis bot.extremum empty_set insert_subsetI list.simps(15))\n        qed\n        then show ?thesis \n          by (simp add: \\<open>consistent A V\\<close>)\n      qed\n    next\n      case 2\n      then have \\<open>p \\<notin> V\\<close> \n        using Imp.prems exactly_one_in_maximal' p_q_in_phi comp.simps(1)\n        by (smt (verit, del_insts) mem_Collect_eq subset_iff)\n      then show ?thesis \n        using Imp p_q_in_phi by blast\n    qed\n  next\n    assume \\<open>canonical A \\<phi>, V \\<Turnstile> (p \\<^bold>\\<longrightarrow> q)\\<close>\n    then consider \\<open>\\<not> canonical A \\<phi>, V \\<Turnstile> p\\<close> | \\<open>canonical A \\<phi>, V \\<Turnstile> q\\<close>\n      by auto\n    then have \\<open>p \\<notin> V \\<or> q \\<in> V\\<close>\n      using Imp by (metis (mono_tags, lifting) p_q_in_phi semantics.simps(1))\n    moreover have \\<open>p \\<in> sub_C' \\<phi>\\<close> \n      using p_q_in_phi by auto\n    ultimately have \\<open>(\\<^bold>\\<not> p) \\<in> V \\<or> q \\<in> V\\<close>\n      using \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close> \\<open>p \\<in> sub_C \\<phi> \\<and> (q \\<in> sub_C \\<phi> \\<or> q = \\<^bold>\\<bottom>)\\<close> consistent_extend_by_p imageI maximal'_def \n      by (smt (verit) Un_iff)\n    moreover have \\<open>A \\<turnstile> \\<^bold>\\<not> p \\<^bold>\\<longrightarrow> p \\<^bold>\\<longrightarrow> q\\<close> \\<open>A \\<turnstile> q \\<^bold>\\<longrightarrow> p \\<^bold>\\<longrightarrow> q\\<close>\n      by (auto simp: A1)             \n    ultimately show \\<open>(p \\<^bold>\\<longrightarrow> q) \\<in> V\\<close>\n      using Imp.prems consistent_consequent maximal'_def by fast\n  qed\nnext\n  case (K i p)\n  have \\<open>K i p \\<in> sub_C \\<phi>\\<close>\n    using K.prems(1) Un_iff fm.distinct(53) image_iff by auto\n  then have \\<open>p \\<in> sub_C' \\<phi>\\<close> \n    by (metis UnI1 insertI2 p_in_sub_C_p sub_C.simps(6) sub_C_transitive)\n  then have \\<open>\\<And> V. V \\<in> mcss A \\<phi> \\<Longrightarrow> p \\<in> V \\<longleftrightarrow> canonical A \\<phi>, V \\<Turnstile> p\\<close>\n    using K.hyps by blast\n  moreover have \\<open>V \\<in> mcss A \\<phi>\\<close> \n    using K by simp\n  ultimately show ?case \n    using truth_lemma_K \\<open>K i p \\<in> sub_C' \\<phi>\\<close> by blast\nnext\n  case (Ev g p)\n  have \\<open>p \\<in> sub_C' \\<phi>\\<close> \n    using \\<open>Ev g p \\<in> sub_C' \\<phi>\\<close> p_in_sub_C_p sub_C.simps(7) sub_C_transitive \n    by (smt (verit, ccfv_threshold) Un_iff Un_insert_right fm.distinct(47) image_iff sup_commute)\n  then have \\<open>\\<And> V. V \\<in> mcss A \\<phi> \\<Longrightarrow> p \\<in> V \\<longleftrightarrow> canonical A \\<phi>, V \\<Turnstile> p\\<close>\n    using Ev.hyps by blast\n  moreover have \\<open>V \\<in> mcss A \\<phi>\\<close>\n    using Ev by simp\n  ultimately show ?case \n    using truth_lemma_Ev \\<open>Ev g p \\<in> sub_C' \\<phi>\\<close> by blast\nnext\n  case (Co g p) \n  from \\<open>Co g p \\<in> sub_C' \\<phi>\\<close> have \\<open>Co g p \\<in> sub_C \\<phi>\\<close> \n    by (simp add: image_iff)\n  then have \\<open>p \\<in> sub_C \\<phi>\\<close>\n  proof (induct \\<phi>)\n    case (Co g \\<phi>)\n    then show ?case\n      using p_in_sub_C_p by fastforce\n  qed auto \n  then have \\<open>p \\<in> sub_C' \\<phi>\\<close> \n    by simp\n  have \\<open>Co g p \\<in> sub_C \\<phi>\\<close> \n    using Co.prems(1) by auto\n  then have \\<open>Ev g (p \\<^bold>\\<and> Co g p) \\<in> sub_C \\<phi>\\<close> \\<open>\\<forall> i \\<in> set g. K i (p \\<^bold>\\<and> Co g p) \\<in> sub_C \\<phi>\\<close>\n    by (induct \\<phi>) auto\n  then have \\<open>Ev g (p \\<^bold>\\<and> Co g p) \\<in> sub_C' \\<phi>\\<close> \\<open>\\<forall> i \\<in> set g. K i (p \\<^bold>\\<and> Co g p) \\<in> sub_C' \\<phi>\\<close>\n    by simp_all\n  show ?case \n  proof safe\n    assume \\<open>Co g p \\<in> V\\<close>\n    moreover have \\<open>\\<And> W. n \\<ge> 1 \\<Longrightarrow> W \\<in> mcss A \\<phi> \\<Longrightarrow> Co g p \\<in> W \\<Longrightarrow> canonical A \\<phi>, W \\<Turnstile> Ev_n g p n\\<close> for n\n    proof (induct n rule: less_induct)\n      case (less n)\n      moreover have \\<open>A \\<turnstile> Co g p \\<^bold>\\<longrightarrow> Ev g (p \\<^bold>\\<and> Co g p)\\<close> \n        by (simp add: C2)\n      ultimately have \\<open>Ev g (p \\<^bold>\\<and> Co g p) \\<in> W\\<close>\n        using Co.prems consistent_consequent maximal'_def \\<open>Ev g (p \\<^bold>\\<and> Co g p) \\<in> sub_C' \\<phi>\\<close> by blast\n      then have \\<open>set [Ev g (p \\<^bold>\\<and> Co g p)] \\<subseteq> W\\<close>\n        by simp\n      moreover have \\<open>set [Ev g (p \\<^bold>\\<and> Co g p)] \\<subseteq> sub_C' \\<phi>\\<close>\n        using \\<open>Ev g (p \\<^bold>\\<and> Co g p) \\<in> sub_C' \\<phi>\\<close> by auto\n      moreover have \\<open>\\<forall> i \\<in> set g. A \\<turnstile> [Ev g (p \\<^bold>\\<and> Co g p)] \\<^bold>\\<leadsto> K i (p \\<^bold>\\<and> Co g p)\\<close>\n        by (simp add: Ev_implies_K)\n      moreover have \\<open>maximal' A \\<phi> W\\<close> \\<open>consistent A W\\<close>\n        using \\<open>W \\<in> mcss A \\<phi>\\<close> by simp_all\n      ultimately have \\<open>\\<forall> i \\<in> set g. K i (p \\<^bold>\\<and> Co g p) \\<in> W\\<close>\n        using \\<open>\\<forall> i \\<in> set g. K i (p \\<^bold>\\<and> Co g p) \\<in> sub_C' \\<phi>\\<close> consequent_in_maximal' by blast \n      consider \\<open>n = 1\\<close> | \\<open>n > 1\\<close>\n        using less by linarith\n      then show ?case \n      proof cases\n        case 1\n        have \\<open>i \\<in> set g \\<Longrightarrow> W' \\<in> reach A i W \\<Longrightarrow> W' \\<in> mcss A \\<phi> \\<Longrightarrow> canonical A \\<phi>, W' \\<Turnstile> p\\<close> for i W'\n        proof-\n          assume \\<open>i \\<in> set g\\<close> \\<open>W' \\<in> reach A i W\\<close> \\<open>W' \\<in> mcss A \\<phi>\\<close>\n          have \\<open>K i (p \\<^bold>\\<and> Co g p) \\<in> W\\<close> \n            using \\<open>\\<forall> i \\<in> set g. K i (p \\<^bold>\\<and> Co g p) \\<in> W\\<close> \\<open>i \\<in> set g\\<close>  by simp\n          then have \\<open>p \\<^bold>\\<and> Co g p \\<in> W'\\<close> \n            using \\<open>W' \\<in> reach A i W\\<close> by auto\n          moreover have \\<open>A \\<turnstile> p \\<^bold>\\<and> Co g p \\<^bold>\\<longrightarrow> p\\<close>\n            by (simp add: conE1)\n          ultimately have \\<open>p \\<in> W'\\<close> \n            using \\<open>p \\<in> sub_C' \\<phi>\\<close> \\<open>W' \\<in> mcss A \\<phi>\\<close> consistent_consequent maximal'_def by blast\n          moreover have \\<open>consistent A W'\\<close> \\<open>maximal' A \\<phi> W'\\<close> \\<open>W' \\<subseteq> sub_C' \\<phi>\\<close>\n            using \\<open>W' \\<in> mcss A \\<phi>\\<close> by simp_all\n          ultimately show ?thesis \n            using Co.hyps by blast\n        qed\n        then show ?thesis \n          using 1 by simp\n      next\n        case 2\n        then have *: \\<open>\\<And> W'. W' \\<in> mcss A \\<phi> \\<Longrightarrow> Co g p \\<in> W' \\<Longrightarrow> canonical A \\<phi>, W' \\<Turnstile> Ev_n g p (n - 1)\\<close>\n          using less by simp\n        then have \\<open>i \\<in> set g \\<Longrightarrow> W' \\<in> reach A i W \\<Longrightarrow> W' \\<in> mcss A \\<phi> \\<Longrightarrow> canonical A \\<phi>, W' \\<Turnstile> Ev_n g p (n - 1)\\<close> for i W' \n        proof-\n          assume \\<open>i \\<in> set g\\<close> \\<open>W' \\<in> reach A i W\\<close> \\<open>W' \\<in> mcss A \\<phi>\\<close>\n          have \\<open>K i (p \\<^bold>\\<and> Co g p) \\<in> W\\<close> \n            using \\<open>\\<forall> i \\<in> set g. K i (p \\<^bold>\\<and> Co g p) \\<in> W\\<close> \\<open>i \\<in> set g\\<close>  by simp\n          then have \\<open>p \\<^bold>\\<and> Co g p \\<in> W'\\<close> \n            using \\<open>W' \\<in> reach A i W\\<close> by auto\n          moreover have \\<open>A \\<turnstile> p \\<^bold>\\<and> Co g p \\<^bold>\\<longrightarrow> Co g p\\<close>\n            by (simp add: conE2)\n          ultimately have \\<open>Co g p \\<in> W'\\<close> \n            using \\<open>Co g p \\<in> sub_C' \\<phi>\\<close> \\<open>W' \\<in> mcss A \\<phi>\\<close> consistent_consequent maximal'_def by blast\n          then show ?thesis \n            using  \\<open>W' \\<in> mcss A \\<phi>\\<close> * by simp\n        qed\n        moreover have \\<open>Ev_n g p n = Ev g (Ev_n g p (n - 1))\\<close> \n          by (metis Ev_n.simps(2) Suc_diff_le diff_Suc_1 less.prems(1))\n        ultimately show ?thesis \n          by simp\n      qed\n    qed\n    ultimately show \\<open>canonical A \\<phi>, V \\<Turnstile> Co g p\\<close>\n      using Co.prems(2) by auto\n  next\n    have \\<open>finite (mcss A \\<phi>)\\<close> \n      using finite_Collect_subsets sub_C'_finite by fastforce\n    then have \\<open>finite {W. W \\<in> mcss A \\<phi> \\<and> canonical A \\<phi>, W \\<Turnstile> Co g p}\\<close> \n      by (simp add: Collect_mono_iff rev_finite_subset)\n    moreover have \\<open>\\<forall> W \\<in> {W. W \\<in> mcss A \\<phi> \\<and> canonical A \\<phi>, W \\<Turnstile> Co g p}. finite W\\<close>\n      by (smt (verit, del_insts) mem_Collect_eq rev_finite_subset sub_C'_finite) \n    ultimately obtain \\<w> where \\<w>_def:\n      \\<open>set (map set \\<w>) = {W. W \\<in> mcss A \\<phi> \\<and> canonical A \\<phi>, W \\<Turnstile> Co g p}\\<close> \n      using list_of_lists_if_finite_set_of_sets by meson\n    moreover obtain \\<phi>\\<^sub>\\<w> where \\<phi>\\<^sub>\\<w>_def:\n      \\<open>\\<phi>\\<^sub>\\<w> = disjunct (map conjunct \\<w>)\\<close>\n      by simp\n    moreover have \\<open>\\<And>V. V \\<in> mcss A \\<phi> \\<Longrightarrow> (p \\<in> V) = (\\<lparr>\\<W> = mcss A \\<phi>, \\<K> = \\<lambda>i V. {W. known V i \\<subseteq> W}, \\<pi> = pi\\<rparr>, V \\<Turnstile> p)\\<close>\n      using Co.hyps \\<open>p \\<in> sub_C' \\<phi>\\<close> by blast\n    moreover have \\<open>Co g p \\<in> sub_C' \\<phi>\\<close> \n      using Co.prems(1) by auto\n    moreover have \\<open>V \\<in> mcss A \\<phi>\\<close> \n      using Co.prems(2) by auto\n    ultimately have \\<open>A \\<turnstile> \\<phi>\\<^sub>\\<w> \\<^bold>\\<longrightarrow> Ev g (p \\<^bold>\\<and> \\<phi>\\<^sub>\\<w>)\\<close>\n      using Co_lemma[where g = g and p = p and \\<phi> = \\<phi> and \\<w> = \\<w> and \\<phi>\\<^sub>\\<w> = \\<phi>\\<^sub>\\<w> and V = V and A = A] by blast\n    then have *:\\<open>A \\<turnstile> \\<phi>\\<^sub>\\<w> \\<^bold>\\<longrightarrow> Co g p\\<close>\n      by (simp add: RC1)\n\n    from Co have \\<open>V \\<in> mcss A \\<phi>\\<close> \n      by blast\n    moreover assume \\<open>canonical A \\<phi>, V \\<Turnstile> Co g p\\<close>\n    ultimately have \\<open>V \\<in> {W. W \\<in> mcss A \\<phi> \\<and> canonical A \\<phi>, W \\<Turnstile> Co g p}\\<close> \n      by simp\n    then have \\<open>\\<exists> \\<v>. set \\<v> = V \\<and> \\<v> \\<in> set \\<w>\\<close>\n      using \\<w>_def by (metis (no_types, lifting) image_iff list.set_map)\n    then obtain \\<v> where \\<v>_def: \\<open>set \\<v> = V \\<and> \\<v> \\<in> set \\<w>\\<close> ..\n    then obtain \\<phi>\\<^sub>\\<v> where \\<phi>\\<^sub>\\<v>_def: \\<open>\\<phi>\\<^sub>\\<v> = \\<^bold>\\<And>\\<v>\\<close> \n      by simp\n    have \\<open>A \\<turnstile> \\<phi>\\<^sub>\\<v> \\<^bold>\\<longrightarrow> \\<phi>\\<^sub>\\<w>\\<close> \n      using \\<v>_def \\<phi>\\<^sub>\\<v>_def \\<phi>\\<^sub>\\<w>_def elem_implies_disjunct by (metis imageI image_set)\n    then have \\<open>A \\<turnstile> \\<phi>\\<^sub>\\<v> \\<^bold>\\<longrightarrow> Co g p\\<close>\n      using * imp_chain by auto\n    then have **:\\<open>A \\<turnstile> \\<^bold>\\<not>Co g p \\<^bold>\\<longrightarrow> \\<^bold>\\<not>\\<phi>\\<^sub>\\<v>\\<close> \n      using K_trans R1 by blast\n    show \\<open>Co g p \\<in> V\\<close> \n    proof (rule ccontr)\n      assume \\<open>Co g p \\<notin> V\\<close>\n      then have \\<open>\\<^bold>\\<not>Co g p \\<in> V\\<close>\n        using Co.prems comp.simps(15) exactly_one_in_maximal' \n        by (smt (verit, best) mem_Collect_eq)\n      then have \\<open>A; V \\<turnstile> \\<^bold>\\<not>Co g p\\<close>\n        by (metis K_imply_head \\<v>_def extract_from_list subset_refl)\n      from this ** have \\<open>A; V \\<turnstile> \\<^bold>\\<not>\\<phi>\\<^sub>\\<v>\\<close>\n        by (metis K_ImpI K_mp \\<open>\\<^bold>\\<not> Co g p \\<in> V\\<close> imp_chain imply.simps(2) insert_subsetI list.simps(15))\n      moreover have \\<open>A; V \\<turnstile> \\<phi>\\<^sub>\\<v>\\<close> \n        using imply_implies_itself \\<v>_def \\<phi>\\<^sub>\\<v>_def by auto\n      ultimately have \\<open>A; V \\<turnstile> \\<^bold>\\<bottom>\\<close> \n        by (metis K_imply_weaken K_right_mp \\<v>_def order_refl)\n      then show False\n        using Co consistent_def by blast\n      qed\n  qed\nqed\n\nlemma canonical_model:\n  fixes \\<phi> :: \\<open>('i :: countable) fm\\<close>\n  assumes \\<open>consistent A S\\<close> and \\<open>p \\<in> S\\<close> and \\<open>S \\<subseteq> sub_C' \\<phi>\\<close>\n  defines \\<open>V \\<equiv> Extend' A \\<phi> S from_nat\\<close> and \\<open>M \\<equiv> canonical A \\<phi>\\<close>\n  shows \\<open>M, V \\<Turnstile> p\\<close> and \\<open>consistent A V\\<close> and \\<open>maximal' A \\<phi> V\\<close>\nproof -\n  have \\<open>consistent A V\\<close>\n    using \\<open>consistent A S\\<close> unfolding V_def using consistent_Extend' by blast\n  have \\<open>maximal' A \\<phi> V\\<close>\n    unfolding V_def using maximal_Extend' surj_from_nat by blast\n  { fix x :: \\<open>('i :: countable) fm\\<close>\n    assume \\<open>x \\<in> S\\<close> \\<open>x \\<in> sub_C' \\<phi>\\<close>\n    then have \\<open>x \\<in> V\\<close>\n      unfolding V_def using Extend'_subset by blast\n    moreover have \\<open>V \\<subseteq> sub_C' \\<phi>\\<close> \n      unfolding V_def using \\<open>S \\<subseteq> sub_C' \\<phi>\\<close> by (simp add: Extend'_subset_sub_C)\n    ultimately have \\<open>M, V \\<Turnstile> x\\<close>\n      unfolding M_def using truth_lemma \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close> \\<open>x \\<in> sub_C' \\<phi>\\<close> by blast }\n  then show \\<open>M, V \\<Turnstile> p\\<close>\n    using \\<open>p \\<in> S\\<close> \\<open>S \\<subseteq> sub_C' \\<phi>\\<close> by blast+\n  show \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close>\n    by fact+\nqed\n\nsubsection \\<open>Completeness\\<close>\n\nabbreviation valid :: \\<open>(('i :: countable, 'i fm set) kripke \\<Rightarrow> bool) \\<Rightarrow> 'i fm set \\<Rightarrow> 'i fm \\<Rightarrow> bool\\<close>\n  (\\<open>_; _ \\<TTurnstile> _\\<close> [50, 50, 50] 50)\n  where \\<open>P; G \\<TTurnstile> p \\<equiv> P; G \\<TTurnstile>\\<star> p\\<close>\n\nabbreviation P_canonical where\n  \\<open>P_canonical P A qs p \\<equiv> P (canonical A ((\\<^bold>\\<not> p) # qs \\<^bold>\\<leadsto> \\<^bold>\\<bottom>))\\<close>\n\ntheorem completeness:\n  assumes \\<open>finite G\\<close> and \\<open>P; G \\<TTurnstile> (p :: ('i :: countable) fm)\\<close> and \n    \\<open>\\<forall> qs. set qs = G \\<longrightarrow> P_canonical P A qs p\\<close>\n  shows \\<open>A; G \\<turnstile> p\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<nexists>qs. set qs \\<subseteq> G \\<and> (A \\<turnstile> qs \\<^bold>\\<leadsto> p)\\<close>\n  then have *: \\<open>\\<forall>qs. set qs \\<subseteq> G \\<longrightarrow> \\<not> (A \\<turnstile> (\\<^bold>\\<not> p) # qs \\<^bold>\\<leadsto> \\<^bold>\\<bottom>)\\<close>\n    using K_Boole by blast\n\n  obtain qs where \\<open>set qs = G\\<close>\n    using assms(1) finite_list by auto\n  let ?\\<phi> = \\<open>(\\<^bold>\\<not> p) # qs \\<^bold>\\<leadsto> \\<^bold>\\<bottom>\\<close> \n  let ?S = \\<open>set (\\<^bold>\\<not>p # qs)\\<close>\n  let ?V = \\<open>Extend' A ?\\<phi> ?S from_nat\\<close>\n  let ?M = \\<open>canonical A ?\\<phi>\\<close>\n\n  have  \\<open>set (xs :: 'i fm list) \\<subseteq> sub_C (xs \\<^bold>\\<leadsto> \\<^bold>\\<bottom>)\\<close> for xs \n  proof (induct xs)\n    case (Cons a xs)\n    then show ?case \n      using Un_insert_right insert_subsetI list.simps(15) p_in_sub_C_p sub_C.simps(5) verit_comp_simplify1(2) by fastforce\n  qed auto\n  then have 1:\\<open>?S \\<subseteq> sub_C' ?\\<phi>\\<close> \n    by (meson sup.coboundedI1)\n  moreover have \\<open>consistent A ?S\\<close>\n    using * \\<open>set qs = G\\<close> consistent_def K_imply_weaken by blast\n  ultimately have \\<open>\\<forall>q \\<in> set (\\<^bold>\\<not>p # qs). ?M, ?V \\<Turnstile> q\\<close>\n    using canonical_model by blast\n  then have \\<open>?M, ?V \\<Turnstile> (\\<^bold>\\<not> p)\\<close> \\<open>\\<forall>q \\<in> set qs. ?M, ?V \\<Turnstile> q\\<close>\n    by auto\n  moreover have \\<open>?V \\<in> mcss A ?\\<phi>\\<close>\n    using \\<open>consistent A ?S\\<close> consistent_Extend' maximal_Extend' surj_from_nat Extend'_subset_sub_C mem_Collect_eq 1 \n    by (smt (verit))\n  ultimately have \\<open>?M, ?V \\<Turnstile> p\\<close> \n    using \\<open>set qs = G\\<close> assms(2) assms(3) frame.select_convs(1) by auto\n  then show False \n    using \\<open>?M, ?V \\<Turnstile> (\\<^bold>\\<not> p)\\<close> by simp\nqed\n\ncorollary completeness':\n  assumes \\<open>P; {} \\<TTurnstile> p\\<close> and \\<open>P_canonical P A [] p\\<close>\n  shows \\<open>A \\<turnstile> p\\<close>\nproof-\n  have \\<open>A; {} \\<turnstile> p\\<close>\n    using assms completeness[where G=\\<open>{}\\<close>] by blast\n  then show \\<open>A \\<turnstile> p\\<close> \n    by simp\nqed\n\ncorollary completeness\\<^sub>A:\n  assumes \\<open>(\\<lambda>_. True); {} \\<TTurnstile> p\\<close>\n  shows \\<open>A \\<turnstile> p\\<close>\n  using assms completeness' by blast\n\nsection \\<open>System K\\<close>\n\nabbreviation SystemK (\\<open>_ \\<turnstile>\\<^sub>K _\\<close> [50] 50) where\n  \\<open>G \\<turnstile>\\<^sub>K p \\<equiv> (\\<lambda>_. False); G \\<turnstile> p\\<close>\n\nlemma strong_soundness\\<^sub>K: \\<open>G \\<turnstile>\\<^sub>K p \\<Longrightarrow> P; G \\<TTurnstile>\\<star> p\\<close>\n  using strong_soundness[of \\<open>\\<lambda>_. False\\<close> \\<open>\\<lambda>_. True\\<close>] by fast\n\nabbreviation validK (\\<open>_ \\<TTurnstile>\\<^sub>K _\\<close> [50, 50] 50) where\n  \\<open>G \\<TTurnstile>\\<^sub>K p \\<equiv> (\\<lambda>_. True); G \\<TTurnstile> p\\<close>\n\nlemma completeness\\<^sub>K: \\<open>G \\<TTurnstile>\\<^sub>K p \\<Longrightarrow> G \\<turnstile>\\<^sub>K p\\<close> if \\<open>finite G\\<close>\n  using completeness[of G \\<open>\\<lambda>_. True\\<close>] that by auto\n\ntheorem main\\<^sub>K: \\<open>G \\<TTurnstile>\\<^sub>K p \\<longleftrightarrow> G \\<turnstile>\\<^sub>K p\\<close> if \\<open>finite G\\<close>\n  using strong_soundness\\<^sub>K[of G p] completeness\\<^sub>K[of G p] that by fast\n\ncorollary \\<open>G \\<TTurnstile>\\<^sub>K p \\<Longrightarrow> (\\<lambda>_. True); G \\<TTurnstile>\\<star> p\\<close> if \\<open>finite G\\<close>\n  using strong_soundness\\<^sub>K[of G p] completeness\\<^sub>K[of G p] that by fast\n\nsection \\<open>System T\\<close>\n\ntext \\<open>Also known as System M\\<close>\n\ninductive AxT :: \\<open>'i fm \\<Rightarrow> bool\\<close> where\n  \\<open>AxT (K i p \\<^bold>\\<longrightarrow> p)\\<close>\n\nabbreviation SystemT (\\<open>_ \\<turnstile>\\<^sub>T _\\<close> [50, 50] 50) where\n  \\<open>G \\<turnstile>\\<^sub>T p \\<equiv> AxT; G \\<turnstile> p\\<close>\n\nlemma soundness_AxT: \\<open>AxT p \\<Longrightarrow> reflexive M \\<Longrightarrow> w \\<in> \\<W> M \\<Longrightarrow> M, w \\<Turnstile> p\\<close>\n  by (induct p rule: AxT.induct) (meson truth)\n\nlemma strong_soundness\\<^sub>T: \\<open>G \\<turnstile>\\<^sub>T p \\<Longrightarrow> reflexive; G \\<TTurnstile>\\<star> p\\<close>\n  using strong_soundness soundness_AxT .\n\nlemma AxT_reflexive:\n  assumes \\<open>AxT \\<le> A\\<close> and \\<open>consistent A V\\<close> and \\<open>maximal' A \\<phi> V\\<close> and \\<open>V \\<subseteq> sub_C' \\<phi>\\<close>\n  shows \\<open>V \\<in> reach A i V\\<close>\nproof (safe)\n  fix p\n  assume \\<open>K i p \\<in> V\\<close>\n  moreover have \\<open>p \\<in> sub_C (K i p)\\<close> \n    by (simp add: p_in_sub_C_p)\n  ultimately have \\<open>p \\<in> sub_C' \\<phi>\\<close> \n    using \\<open>V \\<subseteq> sub_C' \\<phi>\\<close>  \n    by (smt (verit, del_insts) Un_iff fm.distinct(45) image_iff in_mono sub_C_transitive) \n  moreover have \\<open>A \\<turnstile> K i p \\<^bold>\\<longrightarrow> p\\<close>\n    by (metis Ax AxT.simps assms(1) rev_predicate1D)\n  ultimately show \\<open>p \\<in> V\\<close> \n    using \\<open>maximal' A \\<phi> V\\<close> \\<open>K i p \\<in> V\\<close> assms(2) consistent_consequent maximal'_def by blast\nqed\n\nlemma reflexive\\<^sub>T:\n  assumes \\<open>AxT \\<le> A\\<close>\n  shows \\<open>\\<forall> (\\<phi> :: ('i :: countable) fm). reflexive (canonical A \\<phi>)\\<close>\n  unfolding reflexive_def \nproof safe\n  fix i V \\<phi>\n  assume \\<open>V \\<in> \\<W> (canonical A \\<phi>)\\<close>\n  then have \\<open>consistent A V\\<close> \\<open>maximal' A \\<phi> V\\<close> \\<open>V \\<subseteq> sub_C' \\<phi>\\<close>\n    by simp_all\n  with AxT_reflexive assms have \\<open>V \\<in> reach A i V\\<close> .\n  then show \\<open>V \\<in> \\<K> (canonical A \\<phi>) i V\\<close>\n    by simp\nqed\n\nabbreviation validT (\\<open>_ \\<TTurnstile>\\<^sub>T _\\<close> [50, 50] 50) where\n  \\<open>G \\<TTurnstile>\\<^sub>T p \\<equiv> reflexive; G \\<TTurnstile> p\\<close>\n\nlemma completeness\\<^sub>T: \\<open>G \\<TTurnstile>\\<^sub>T p \\<Longrightarrow> G \\<turnstile>\\<^sub>T p\\<close> if \\<open>finite G\\<close>\nproof-\n  have \\<open>\\<forall>(\\<phi> :: ('i :: countable) fm). reflexive (canonical AxT \\<phi>)\\<close> \n    using reflexive\\<^sub>T by auto\n  then have \\<open>\\<forall> qs. set qs \\<subseteq> G \\<longrightarrow> P_canonical reflexive AxT qs p\\<close> \n    by fast\n  moreover assume \\<open>G \\<TTurnstile>\\<^sub>T p\\<close>\n  ultimately show ?thesis\n    using completeness \\<open>finite G\\<close> by blast\nqed\n\ntheorem main\\<^sub>T: \\<open>G \\<TTurnstile>\\<^sub>T p \\<longleftrightarrow> G \\<turnstile>\\<^sub>T p\\<close> if \\<open>finite G\\<close>\n  using strong_soundness\\<^sub>T[of G p] completeness\\<^sub>T[of G p] that by fast\n\ncorollary \\<open>G \\<TTurnstile>\\<^sub>T p \\<longrightarrow> reflexive; G \\<TTurnstile>\\<star> p\\<close> if \\<open>finite G\\<close>\n  using strong_soundness\\<^sub>T[of G p] completeness\\<^sub>T[of G p] that by fast\n\n(*\n  We cannot easily continue to more complex frame conditions for the following reason:\n  Take symmetric frames an example. For this we could add the axiom p \\<^bold>\\<longrightarrow> K i (L i p).\n  Because of the restriction to finite canonical models we cannot guarantee that if p \\<in> V then\n  K i (L i p) \\<in> V, even with this axiom. This is because K i (L i p) might not be in sub_C' \\<phi>,\n  even though p is. Thus, a canonical model for this axiom is not necessarily symmetric. \n*)\n\nend\n", "meta": {"author": "Barrikad", "repo": "epistemic_project", "sha": "657c2165e1dbc9e3efecaf1ef7c1c3569e5edd87", "save_path": "github-repos/isabelle/Barrikad-epistemic_project", "path": "github-repos/isabelle/Barrikad-epistemic_project/epistemic_project-657c2165e1dbc9e3efecaf1ef7c1c3569e5edd87/Epistemic_Logic_CK.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5234203489363239, "lm_q1q2_score": 0.33720053003063605}}
{"text": "theory Unboxed_lemmas\n  imports Unboxed\nbegin\n\nlemma cast_Dyn_eq_Some_imp_typeof: \"cast_Dyn u = Some d \\<Longrightarrow> typeof u = None\"\n  by (auto elim: cast_Dyn.elims)\n\nlemma typeof_bind_OpDyn[simp]: \"typeof \\<circ> OpDyn = (\\<lambda>_. None)\"\n  by auto\n\nlemma is_dyn_operand_eq_typeof: \"is_dyn_operand = (\\<lambda>x. typeof x = None)\"\nproof (intro ext)\n  fix x\n  show \"is_dyn_operand x = (typeof x = None)\"\n    by (cases x; simp)\nqed\n\nlemma is_dyn_operand_eq_typeof_Dyn[simp]: \"is_dyn_operand x \\<longleftrightarrow> typeof x = None\"\n  by (cases x; simp)\n\nlemma typeof_unboxed_eq_const:\n  fixes x\n  shows\n    \"typeof x = None \\<longleftrightarrow> (\\<exists>d. x = OpDyn d)\"\n    \"typeof x = Some Ubx1 \\<longleftrightarrow> (\\<exists>n. x = OpUbx1 n)\"\n    \"typeof x = Some Ubx2 \\<longleftrightarrow> (\\<exists>b. x = OpUbx2 b)\"\n  by (cases x; simp)+\n\nlemmas typeof_unboxed_inversion = typeof_unboxed_eq_const[THEN iffD1]\n\nlemma cast_inversions:\n  \"cast_Dyn x = Some d \\<Longrightarrow> x = OpDyn d\"\n  \"cast_Ubx1 x = Some n \\<Longrightarrow> x = OpUbx1 n\"\n  \"cast_Ubx2 x = Some b \\<Longrightarrow> x = OpUbx2 b\"\n  by (cases x; simp)+\n\nlemma ap_map_list_cast_Dyn_replicate:\n  assumes \"ap_map_list cast_Dyn xs = Some ys\"\n  shows \"map typeof xs = replicate (length xs) None\"\n  using assms\nproof (induction xs arbitrary: ys)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons x xs)\n  from Cons.prems show ?case\n    by (auto intro: Cons.IH dest: cast_inversions(1) simp: ap_option_eq_Some_conv)\nqed\n\ncontext unboxedval begin\n\nlemma unbox_typeof[simp]: \"unbox \\<tau> d = Some blob \\<Longrightarrow> typeof blob = Some \\<tau>\"\n  by (cases \\<tau>; auto)\n\nlemma cast_and_box_imp_typeof[simp]: \"cast_and_box \\<tau> blob = Some d \\<Longrightarrow> typeof blob = Some \\<tau>\"\n  using cast_inversions[of blob]\n  by (induction \\<tau>; auto dest: cast_inversions[of blob])\n\nlemma norm_unbox_inverse[simp]: \"unbox \\<tau> d = Some blob \\<Longrightarrow> norm_unboxed blob = d\"\n  using box_unbox_inverse\n  by (cases \\<tau>; auto)\n\nlemma norm_cast_and_box_inverse[simp]:\n  \"cast_and_box \\<tau> blob = Some d \\<Longrightarrow> norm_unboxed blob = d\"\n  by (induction \\<tau>; auto elim: cast_Dyn.elims cast_Ubx1.elims cast_Ubx2.elims)\n\nlemma typeof_and_norm_unboxed_imp_cast_Dyn:\n  assumes \"typeof x' = None\" \"norm_unboxed x' = x\"\n  shows \"cast_Dyn x' = Some x\"\n  using assms\n  unfolding typeof_unboxed_eq_const\n  by auto\n\nlemma typeof_and_norm_unboxed_imp_cast_and_box:\n  assumes \"typeof x' = Some \\<tau>\" \"norm_unboxed x' = x\"\n  shows \"cast_and_box \\<tau> x' = Some x\"\n  using assms\n  by (induction \\<tau>; induction x'; simp)\n\nlemma norm_unboxed_bind_OpDyn[simp]: \"norm_unboxed \\<circ> OpDyn = id\"\n  by auto\n\nlemmas box_stack_Nil[simp] = list.map(1)[of \"box_frame f\" for f, folded box_stack_def]\nlemmas box_stack_Cons[simp] = list.map(2)[of \"box_frame f\" for f, folded box_stack_def]\n\nlemma typeof_box_operand[simp]: \"typeof (box_operand u) = None\"\n  by (cases u) simp_all\n\nlemma typeof_box_operand_comp[simp]:  \"typeof \\<circ> box_operand = (\\<lambda>_. None)\"\n  by auto\n\nlemma is_dyn_box_operand: \"is_dyn_operand (box_operand x)\"\n  by (cases x) simp_all\n\nlemma is_dyn_operand_comp_box_operand[simp]: \"is_dyn_operand \\<circ> box_operand = (\\<lambda>_. True)\"\n  using is_dyn_box_operand by auto\n\nlemma norm_box_operand[simp]: \"norm_unboxed (box_operand x) = norm_unboxed x\"\n  by (cases x) simp_all\n\nend\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Interpreter_Optimizations/Unboxed_lemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.3371914455076655}}
{"text": "(*<*)\n\n(* Author: Kyndylan Nienhuis *)\n\ntheory CheriProofMethods\n\nimports \n  \"CHERI-alt.CheriAltDefs\"\nbegin\n\n(*>*)\nsection \\<open>Commutativity\\<close>\n\nsubsection \\<open>Definition of commutativity\\<close>\n\ndefinition Commute where\n  \"Commute m n \\<equiv>\n   \\<forall>s. StatePart m (StatePart n s) = StatePart n (StatePart m s) \\<and>\n       ValuePart m (StatePart n s) = ValuePart m s \\<and>\n       ValuePart n (StatePart m s) = ValuePart n s\"\n\nlemma CommuteI [intro]:\n  assumes \"\\<And>s. StatePart m (StatePart n s) = StatePart n (StatePart m s)\"\n      and \"\\<And>s. ValuePart m (StatePart n s) = ValuePart m s\"\n      and \"\\<And>s. ValuePart n (StatePart m s) = ValuePart n s\"\n  shows \"Commute m n\"\nusing assms\nunfolding Commute_def\nby simp\n\nlemma CommuteE [elim!]:\n  assumes \"Commute m n\"\n  shows \"StatePart m (StatePart n s) = StatePart n (StatePart m s)\"\n    and \"ValuePart m (StatePart n s) = ValuePart m s\"\n    and \"ValuePart n (StatePart m s) = ValuePart n s\"\nusing assms\nunfolding Commute_def\nby simp_all\n\ntext \\<open>Lemmas with the attribute \\<open>Commute_compositeI\\<close> that we define below are lemmas that reduce\n@{term \"Commute m n\"} to @{term \"Commute m\\<^sub>i n\"} where \\<open>m\\<^sub>i\\<close> are components of \\<open>m\\<close>. Examples are\nlemmas that decompose @{const bind} and @{const foreach_loop} into their arguments, or CHERI\ndefinitions into their dependencies.\\<close>\n\nnamed_theorems Commute_compositeI\n\nlemma Commute_is_symmetric:\n  shows \"Commute m n = Commute n m\"\nunfolding Commute_def \nby auto\n\nlemma Commute_returnI [intro!, Commute_compositeI, simp]:\n  shows \"Commute (return x) m\"\nunfolding Commute_def\nby auto\n\nlemma Commute_read_stateI [intro]:\n  assumes \"\\<And>s. f (StatePart m s) = f s\"\n  shows \"Commute (read_state f) m\"\nusing assms\nunfolding Commute_def\nby auto\n\nlemma Commute_read_stateE [elim!]:\n  assumes \"Commute (read_state f) m\"\n  shows \"f (StatePart m s) = f s\"\nusing assms\nunfolding Commute_def\nby auto\n\nlemma Commute_read_state_read_stateI [intro!, simp]:\n  shows \"Commute (read_state f) (read_state g)\"\nunfolding Commute_def\nby auto\n\nlemma Commute_read_state_update_stateI [intro]:\n  assumes \"\\<And>s. f (g s) = f s\"\n  shows \"Commute (read_state f) (update_state g)\"\nusing assms\nunfolding Commute_def\nby auto\n\nlemma Commute_read_state_update_stateE [elim!]:\n  assumes \"Commute (read_state f) (update_state g)\"\n  shows \"f (g s) = f s\"\nusing assms\nunfolding Commute_def\nby simp\n\nlemma Commute_update_state_read_stateI [intro]:\n  assumes \"\\<And>s. g (f s) = g s\"\n  shows \"Commute (update_state f) (read_state g)\"\nusing assms\nunfolding Commute_def\nby auto\n\nlemma Commute_update_state_read_stateE [elim!]:\n  assumes \"Commute (update_state f) (read_state g)\"\n  shows \"g (f s) = g s\"\nusing assms\nunfolding Commute_def\nby simp\n\nlemma Commute_update_state_update_stateI [intro]:\n  assumes \"\\<And>s. f (g s) = g (f s)\"\n  shows \"Commute (update_state f) (update_state g)\"\nusing assms\nunfolding Commute_def\nby auto\n\nlemma Commute_update_state_update_stateE [elim!]:\n  assumes \"Commute (update_state f) (update_state g)\"\n  shows \"f (g s) = g (f s)\"\nusing assms\nunfolding Commute_def\nby simp\n\nlemma Commute_read_state_ValuePart [elim!]:\n  assumes \"Commute m n\"\n  shows \"Commute (read_state (ValuePart m)) n\"\nusing assms\nunfolding Commute_def\nby auto\n\nlemma Commute_update_state_StatePart [elim!]:\n  assumes \"Commute m n\"\n  shows \"Commute (update_state (StatePart m)) n\"\nusing assms\nunfolding Commute_def\nby auto\n\nlemma Commute_bindI [intro, Commute_compositeI]:\n  assumes \"\\<And>a. Commute (n a) k\"\n      and \"Commute m k\"\n  shows \"Commute (bind m n) k\"\nusing assms\nunfolding Commute_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma Commute_foreach_loopI [intro, Commute_compositeI]:\n  assumes \"\\<And>a. Commute (m a) n\"\n  shows \"Commute (foreach_loop (l, m)) n\"\nusing assms\nby (induct l) auto\n\nlemma Commute_foreach_loop_aggI [intro, Commute_compositeI]:\n  assumes \"\\<And>a v. Commute (m a v) n\"\n  shows \"Commute (foreach_loop_agg l v m) n\"\nusing assms\nby (induct l arbitrary: v) auto\n\nlemmas common_split = \n  if_splits(1)\n  let_split\n  Option.option.split\n  List.list.split\n  Product_Type.prod.split\n  bool.split\n  DataType.split\n\nlemmas Commute_casesI [intro, Commute_compositeI] =\n  all_split[where P=\"\\<lambda>x. Commute x n\", THEN iffD2] for n\n\nlemma Commute_equals [intro, Commute_compositeI]:\n  assumes \"Commute m k\"\n      and \"Commute m' k\"\n  shows \"Commute (m =\\<^sub>b m') k\"\nusing assms\nunfolding Commute_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma Commute_not [intro, Commute_compositeI]:\n  assumes \"Commute m k\"\n  shows \"Commute (\\<not>\\<^sub>b m) k\"\nusing assms\nunfolding Commute_def\nby simp\n\nlemma Commute_conj [intro, Commute_compositeI]:\n  assumes \"Commute m k\"\n      and \"Commute m' k\"\n  shows \"Commute (m \\<and>\\<^sub>b m') k\"\nusing assms\nunfolding Commute_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma Commute_disj [intro, Commute_compositeI]:\n  assumes \"Commute m k\"\n      and \"Commute m' k\"\n  shows \"Commute (m \\<or>\\<^sub>b m') k\"\nusing assms\nunfolding Commute_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma Commute_All [intro, Commute_compositeI]:\n  assumes \"\\<And>x. Commute (m x) k\"\n  shows \"Commute (\\<forall>\\<^sub>bx. m x) k\"\nusing assms\nunfolding Commute_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma Commute_Ex [intro, Commute_compositeI]:\n  assumes \"\\<And>x. Commute (m x) k\"\n  shows \"Commute (\\<exists>\\<^sub>bx. m x) k\"\nusing assms\nunfolding Commute_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma Commute_read_state_func [intro, Commute_compositeI]:\n  assumes \"\\<And>x. Commute (read_state (f x)) k\"\n  shows \"Commute (read_state (\\<lambda>s x. f x s)) k\"\nusing assms\nunfolding Commute_def\nby (simp add: ValueAndStatePart_simp)\n\nsubsection \\<open>Proving commutativity\\<close>\n\nlemmas Commute_swap = \n  Commute_is_symmetric[THEN iffD1]\n\nmethod Commute uses intro = \n  assumption |\n  solves \\<open>simp\\<close> |\n  (rule Commute_compositeI intro; \n      (intro conjI impI allI)?; \n      Commute intro: intro) |\n  (rule Commute_swap, \n      rule Commute_compositeI intro; \n      (intro conjI impI allI)?; \n      Commute intro: intro) |\n  (rule Commute_read_state_ValuePart; \n      Commute intro: intro) |\n  (rule Commute_swap, \n      rule Commute_read_state_ValuePart; \n      Commute intro: intro) |\n  (rule Commute_update_state_StatePart; \n      Commute intro: intro) |\n  (rule Commute_swap, \n      rule Commute_update_state_StatePart; \n      Commute intro: intro) |\n  (rule Commute_read_state_read_stateI) |\n  (rule Commute_read_state_update_stateI; \n      solves \\<open>assumption | simp\\<close>) |\n  (rule Commute_update_state_read_stateI; \n      solves \\<open>assumption | simp\\<close>) |\n  (rule Commute_update_state_update_stateI; \n      solves \\<open>assumption | simp\\<close>)\n\ntext \\<open>Consider a lemma of the form @{term \"Commute (update_state f) (update_state g)\"} where \\<open>f\\<close> and\n\\<open>g\\<close> update different fields of the state record. The @{method Commute} method proves this lemma by\ninvoking the simplifier on the goal @{term \"f (g s) = g (f s)\"}. The simplifier in turn proves that\nstatement by replacing it with @{term \"h\\<^sub>i (f (g s)) = h\\<^sub>i (g (f s))\"} where \\<open>h\\<^sub>i\\<close> ranges over all\nthe ~50 record fields, which take a non-neglectable amount of time to simplify.\n\nTo speed up the @{method Commute} method we `cache' some of these lemmas by adding them to\n\\<open>Commute_compositeI\\<close>. We chose the most used occurrences of \\<open>f\\<close> and \\<open>g\\<close>.\\<close>\n\nlemma Commute_BranchDelayPCC_update [Commute_compositeI]:\n  shows \"Commute (update_state (BranchDelayPCC_update v)) (update_state (BranchToPCC_update v1))\"\n    and \"Commute (update_state (BranchDelayPCC_update v)) (update_state (c_capr_update v2))\"\n    and \"Commute (update_state (BranchDelayPCC_update v)) (update_state (c_gpr_update v3))\"\n    and \"Commute (update_state (BranchDelayPCC_update v)) (update_state (c_pcc_update v4))\"\n    and \"Commute (update_state (BranchDelayPCC_update v)) (update_state (c_state_update v5))\"\n    and \"Commute (update_state (BranchDelayPCC_update v)) (update_state (exception_update v6))\"\n    and \"Commute (update_state (BranchDelayPCC_update v)) (update_state (the_MEM_update v7))\"\n    and \"Commute (update_state (BranchDelayPCC_update v)) (update_state (unknown_counters_update v8))\"\nby Commute+\n\nlemma Commute_BranchToPCC_update [Commute_compositeI]:\n  shows \"Commute (update_state (BranchToPCC_update v)) (update_state (c_capr_update v2))\"\n    and \"Commute (update_state (BranchToPCC_update v)) (update_state (c_gpr_update v3))\"\n    and \"Commute (update_state (BranchToPCC_update v)) (update_state (c_pcc_update v4))\"\n    and \"Commute (update_state (BranchToPCC_update v)) (update_state (c_state_update v5))\"\n    and \"Commute (update_state (BranchToPCC_update v)) (update_state (exception_update v6))\"\n    and \"Commute (update_state (BranchToPCC_update v)) (update_state (the_MEM_update v7))\"\n    and \"Commute (update_state (BranchToPCC_update v)) (update_state (unknown_counters_update v8))\"\nby Commute+\n\nlemma Commute_c_capr_update [Commute_compositeI]:\n  shows \"Commute (update_state (c_capr_update v)) (update_state (c_gpr_update v3))\"\n    and \"Commute (update_state (c_capr_update v)) (update_state (c_pcc_update v4))\"\n    and \"Commute (update_state (c_capr_update v)) (update_state (c_state_update v5))\"\n    and \"Commute (update_state (c_capr_update v)) (update_state (exception_update v6))\"\n    and \"Commute (update_state (c_capr_update v)) (update_state (the_MEM_update v7))\"\n    and \"Commute (update_state (c_capr_update v)) (update_state (unknown_counters_update v8))\"\nby Commute+\n\nlemma Commute_c_gpr_update [Commute_compositeI]:\n  shows \"Commute (update_state (c_gpr_update v)) (update_state (c_pcc_update v4))\"\n    and \"Commute (update_state (c_gpr_update v)) (update_state (c_state_update v5))\"\n    and \"Commute (update_state (c_gpr_update v)) (update_state (exception_update v6))\"\n    and \"Commute (update_state (c_gpr_update v)) (update_state (the_MEM_update v7))\"\n    and \"Commute (update_state (c_gpr_update v)) (update_state (unknown_counters_update v8))\"\nby Commute+\n\nlemma Commute_c_pcc_update [Commute_compositeI]:\n  shows \"Commute (update_state (c_pcc_update v)) (update_state (c_state_update v5))\"\n    and \"Commute (update_state (c_pcc_update v)) (update_state (exception_update v6))\"\n    and \"Commute (update_state (c_pcc_update v)) (update_state (the_MEM_update v7))\"\n    and \"Commute (update_state (c_pcc_update v)) (update_state (unknown_counters_update v8))\"\nby Commute+\n\nlemma Commute_c_state_update [Commute_compositeI]:\n  shows \"Commute (update_state (c_state_update v)) (update_state (exception_update v6))\"\n    and \"Commute (update_state (c_state_update v)) (update_state (the_MEM_update v7))\"\n    and \"Commute (update_state (c_state_update v)) (update_state (unknown_counters_update v8))\"\nby Commute+\n\nlemma Commute_exception_update [Commute_compositeI]:\n  shows \"Commute (update_state (exception_update v)) (update_state (the_MEM_update v7))\"\n    and \"Commute (update_state (exception_update v)) (update_state (unknown_counters_update v8))\"\nby Commute+\n\nlemma Commute_the_MEM_update [Commute_compositeI]:\n  shows \"Commute (update_state (the_MEM_update v)) (update_state (unknown_counters_update v8))\"\nby Commute+\n\nlemma Commute_c_BranchDelay_update [Commute_compositeI]:\n  shows \"Commute (update_state (c_state_update (c_BranchDelay_update v))) (update_state (c_state_update (c_BranchTo_update v1)))\"\n    and \"Commute (update_state (c_state_update (c_BranchDelay_update v))) (update_state (c_state_update (c_CP0_update v2)))\"\n    and \"Commute (update_state (c_state_update (c_BranchDelay_update v))) (update_state (c_state_update (c_PC_update v3)))\"\n    and \"Commute (update_state (c_state_update (c_BranchDelay_update v))) (update_state (c_state_update (c_exceptionSignalled_update v4)))\"\nby Commute+\n\nlemma Commute_c_BranchTo_update [Commute_compositeI]:\n  shows \"Commute (update_state (c_state_update (c_BranchTo_update v))) (update_state (c_state_update (c_CP0_update v2)))\"\n    and \"Commute (update_state (c_state_update (c_BranchTo_update v))) (update_state (c_state_update (c_PC_update v3)))\"\n    and \"Commute (update_state (c_state_update (c_BranchTo_update v))) (update_state (c_state_update (c_exceptionSignalled_update v4)))\"\nby Commute+\n\nlemma Commute_c_CP0_update [Commute_compositeI]:\n  shows \"Commute (update_state (c_state_update (c_CP0_update v))) (update_state (c_state_update (c_PC_update v3)))\"\n    and \"Commute (update_state (c_state_update (c_CP0_update v))) (update_state (c_state_update (c_exceptionSignalled_update v4)))\"\nby Commute+\n\nlemma Commute_c_PC_update [Commute_compositeI]:\n  shows \"Commute (update_state (c_state_update (c_PC_update v))) (update_state (c_state_update (c_exceptionSignalled_update v4)))\"\nby Commute+\n\nsubsubsection \\<open>Tests\\<close>\n\ntext \\<open>The purpose of the lemmas below is testing the proof method.\\<close>\n\nlemma\n  assumes \"\\<And>a. Commute p (m a)\"\n      and \"Commute p n\"\n      and \"\\<And>a. Commute p (n' a)\"\n  shows \"Commute (if b then foreach_loop (l, m) else bind n n') p\"\nby (Commute intro: assms)\n\nlemma\n  assumes \"\\<And>a. Commute p (m a)\"\n      and \"\\<And>a. Commute p (n a)\"\n  shows \"Commute (\\<forall>\\<^sub>bx. \\<exists>\\<^sub>by. m x =\\<^sub>b n y) p\"\nby (Commute intro: assms)\n\nsubsection \\<open>Finding dependencies\\<close>\n\ntext \\<open>Nested state components do not work very well with @{const read_state}. The following lemma\nfixes that.\\<close>\n\nlemma Commute_read_state_nested [elim!]:\n  assumes \"Commute (read_state f) m\"\n  shows \"Commute (read_state (\\<lambda>s. g (f s))) m\"\nproof -\n  have \"Commute (bind (read_state f) (\\<lambda>a. return (g a))) m\"\n    using assms by auto\n  thus ?thesis\n    unfolding monad_def Let_def\n    by simp\nqed\n\nmethod Commute_find_dependencies_step uses intro elim =\n  assumption |\n  rule intro\n       Commute_returnI\n       impI\n       conjI\n       allI |\n  rule Commute_bindI\n       Commute_foreach_loopI\n       Commute_foreach_loop_aggI\n       Commute_casesI |\n  erule elim\n        Commute_read_state_nested\n\nmethod Commute_find_dependencies uses intro elim = \n  (Commute_find_dependencies_step intro: intro elim: elim)+\n\nsubsection \\<open>Commutativity lemmas\\<close>\n\n(* Code generation - start - commutativity *)\n\nsubsubsection \\<open>@{const raise'exception}\\<close>\n\nlemma Commute_raise'exception [Commute_compositeI]:\n  assumes \"Commute (read_state exception) m\"\n      and \"\\<And>x. Commute (update_state (exception_update x)) m\"\n  shows \"Commute (raise'exception v) m\"\nunfolding raise'exception_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const PIC_update}\\<close>\n\nlemma Commute_PIC_update [Commute_compositeI]:\n  assumes \"Commute (read_state PIC_config_regs) m\"\n      and \"Commute (read_state PIC_ip_bits) m\"\n      and \"Commute (read_state PIC_external_intrs) m\"\n      and \"Commute (read_state (\\<lambda>s. IP (Cause (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state all_state) m\"\n      and \"Commute (read_state procID) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (Cause_update (IP_update x))))) m\"\n      and \"\\<And>x. Commute (update_state (all_state_update x)) m\"\n  shows \"Commute (PIC_update v) m\"\nunfolding PIC_update_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const PIC_initialise}\\<close>\n\nlemma Commute_PIC_initialise [Commute_compositeI]:\n  assumes \"Commute (read_state PIC_base_address) m\"\n      and \"Commute (read_state PIC_config_regs) m\"\n      and \"Commute (read_state PIC_ip_bits) m\"\n      and \"Commute (read_state PIC_external_intrs) m\"\n      and \"Commute (read_state procID) m\"\n      and \"\\<And>x. Commute (update_state (PIC_base_address_update x)) m\"\n      and \"\\<And>x. Commute (update_state (PIC_config_regs_update x)) m\"\n      and \"\\<And>x. Commute (update_state (PIC_ip_bits_update x)) m\"\n      and \"\\<And>x. Commute (update_state (PIC_external_intrs_update x)) m\"\n      and \"\\<And>x. Commute (PIC_update x) m\"\n  shows \"Commute (PIC_initialise v) m\"\nunfolding PIC_initialise_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const PIC_load}\\<close>\n\nlemma Commute_PIC_load [Commute_compositeI]:\n  assumes \"Commute (read_state PIC_base_address) m\"\n      and \"Commute (read_state PIC_config_regs) m\"\n      and \"Commute (read_state PIC_ip_bits) m\"\n      and \"Commute (read_state PIC_external_intrs) m\"\n      and \"Commute (next_unknown ''pic-data'') m\"\n  shows \"Commute (PIC_load v) m\"\nunfolding PIC_load_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const PIC_store}\\<close>\n\nlemma Commute_PIC_store [Commute_compositeI]:\n  assumes \"Commute (read_state PIC_config_regs) m\"\n      and \"Commute (read_state PIC_ip_bits) m\"\n      and \"Commute (read_state PIC_base_address) m\"\n      and \"\\<And>x. Commute (update_state (PIC_config_regs_update x)) m\"\n      and \"\\<And>x. Commute (update_state (PIC_ip_bits_update x)) m\"\n      and \"\\<And>x. Commute (PIC_update x) m\"\n  shows \"Commute (PIC_store v) m\"\nunfolding PIC_store_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const JTAG_UART_update_interrupt_bit}\\<close>\n\nlemma Commute_JTAG_UART_update_interrupt_bit [Commute_compositeI]:\n  assumes \"Commute (read_state JTAG_UART) m\"\n      and \"Commute (read_state PIC_external_intrs) m\"\n      and \"\\<And>x. Commute (update_state (JTAG_UART_update x)) m\"\n      and \"\\<And>x. Commute (update_state (PIC_external_intrs_update x)) m\"\n      and \"\\<And>x. Commute (PIC_update x) m\"\n  shows \"Commute (JTAG_UART_update_interrupt_bit v) m\"\nunfolding JTAG_UART_update_interrupt_bit_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const JTAG_UART_load}\\<close>\n\nlemma Commute_JTAG_UART_load [Commute_compositeI]:\n  assumes \"Commute (read_state JTAG_UART) m\"\n      and \"\\<And>x. Commute (update_state (JTAG_UART_update x)) m\"\n      and \"\\<And>x. Commute (JTAG_UART_update_interrupt_bit x) m\"\n  shows \"Commute JTAG_UART_load m\"\nunfolding JTAG_UART_load_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const JTAG_UART_input}\\<close>\n\nlemma Commute_JTAG_UART_input [Commute_compositeI]:\n  assumes \"Commute (read_state JTAG_UART) m\"\n      and \"\\<And>x. Commute (update_state (JTAG_UART_update x)) m\"\n      and \"\\<And>x. Commute (JTAG_UART_update_interrupt_bit x) m\"\n      and \"Commute JTAG_UART_load m\"\n  shows \"Commute (JTAG_UART_input v) m\"\nunfolding JTAG_UART_input_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const JTAG_UART_store}\\<close>\n\nlemma Commute_JTAG_UART_store [Commute_compositeI]:\n  assumes \"Commute (read_state JTAG_UART) m\"\n      and \"\\<And>x. Commute (update_state (JTAG_UART_update x)) m\"\n      and \"\\<And>x. Commute (JTAG_UART_update_interrupt_bit x) m\"\n  shows \"Commute (JTAG_UART_store v) m\"\nunfolding JTAG_UART_store_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const JTAG_UART_output}\\<close>\n\nlemma Commute_JTAG_UART_output [Commute_compositeI]:\n  assumes \"Commute (read_state JTAG_UART) m\"\n      and \"\\<And>x. Commute (update_state (JTAG_UART_update x)) m\"\n      and \"\\<And>x. Commute (JTAG_UART_update_interrupt_bit x) m\"\n  shows \"Commute JTAG_UART_output m\"\nunfolding JTAG_UART_output_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const JTAG_UART_initialise}\\<close>\n\nlemma Commute_JTAG_UART_initialise [Commute_compositeI]:\n  assumes \"Commute (read_state JTAG_UART) m\"\n      and \"\\<And>x. Commute (update_state (JTAG_UART_update x)) m\"\n  shows \"Commute (JTAG_UART_initialise v) m\"\nunfolding JTAG_UART_initialise_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const gpr}\\<close>\n\nlemma Commute_gpr [Commute_compositeI]:\n  assumes \"Commute (read_state c_gpr) m\"\n  shows \"Commute (gpr v) m\"\nunfolding gpr_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'gpr}\\<close>\n\nlemma Commute_write'gpr [Commute_compositeI]:\n  assumes \"Commute (read_state c_gpr) m\"\n      and \"\\<And>x. Commute (update_state (c_gpr_update x)) m\"\n  shows \"Commute (write'gpr v) m\"\nunfolding write'gpr_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const GPR}\\<close>\n\nlemma Commute_GPR [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (gpr x) m\"\n  shows \"Commute (GPR v) m\"\nunfolding GPR_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'GPR}\\<close>\n\nlemma Commute_write'GPR [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (write'gpr x) m\"\n  shows \"Commute (write'GPR v) m\"\nunfolding write'GPR_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const UserMode}\\<close>\n\nlemma Commute_UserMode [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. KSU (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. EXL (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. ERL (Status (c_CP0 (c_state s))))) m\"\n  shows \"Commute UserMode m\"\nunfolding UserMode_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const SupervisorMode}\\<close>\n\nlemma Commute_SupervisorMode [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. KSU (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. EXL (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. ERL (Status (c_CP0 (c_state s))))) m\"\n  shows \"Commute SupervisorMode m\"\nunfolding SupervisorMode_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const KernelMode}\\<close>\n\nlemma Commute_KernelMode [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. KSU (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. EXL (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. ERL (Status (c_CP0 (c_state s))))) m\"\n  shows \"Commute KernelMode m\"\nunfolding KernelMode_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const BigEndianMem}\\<close>\n\nlemma Commute_BigEndianMem [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. BE (Config (c_CP0 (c_state s))))) m\"\n  shows \"Commute BigEndianMem m\"\nunfolding BigEndianMem_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const ReverseEndian}\\<close>\n\nlemma Commute_ReverseEndian [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. StatusRegister.RE (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute UserMode m\"\n  shows \"Commute ReverseEndian m\"\nunfolding ReverseEndian_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const BigEndianCPU}\\<close>\n\nlemma Commute_BigEndianCPU [Commute_compositeI]:\n  assumes \"Commute BigEndianMem m\"\n      and \"Commute ReverseEndian m\"\n  shows \"Commute BigEndianCPU m\"\nunfolding BigEndianCPU_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const CheckBranch}\\<close>\n\nlemma Commute_CheckBranch [Commute_compositeI]:\n  assumes \"Commute (read_state BranchDelayPCC) m\"\n      and \"Commute (read_state (\\<lambda>s. c_BranchDelay (c_state s))) m\"\n      and \"\\<And>x. Commute (raise'exception x) m\"\n  shows \"Commute CheckBranch m\"\nunfolding CheckBranch_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const BranchNotTaken}\\<close>\n\nlemma Commute_BranchNotTaken [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. c_PC (c_state s))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_BranchTo_update x))) m\"\n      and \"Commute CheckBranch m\"\n  shows \"Commute BranchNotTaken m\"\nunfolding BranchNotTaken_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const BranchLikelyNotTaken}\\<close>\n\nlemma Commute_BranchLikelyNotTaken [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. c_PC (c_state s))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_PC_update x))) m\"\n      and \"Commute CheckBranch m\"\n  shows \"Commute BranchLikelyNotTaken m\"\nunfolding BranchLikelyNotTaken_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const initCoreStats}\\<close>\n\nlemma Commute_initCoreStats [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (update_state (c_state_update (c_CoreStats_update x))) m\"\n  shows \"Commute initCoreStats m\"\nunfolding initCoreStats_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const printCoreStats}\\<close>\n\nlemma Commute_printCoreStats [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. c_CoreStats (c_state s))) m\"\n  shows \"Commute printCoreStats m\"\nunfolding printCoreStats_alt_def\nusing assms\nby - Commute_find_dependencies\n\n(* Code generation - override - next_unknown *)\n\nsubsubsection \\<open>@{const next_unknown}\\<close>\n\nlemma unknown_counter_update_Commutes [simp]:\n  shows \"(\\<lambda>c. c(x := Suc (c x))) \\<circ> (\\<lambda>c. c(y := Suc (c y))) =\n         (\\<lambda>c. c(y := Suc (c y))) \\<circ> (\\<lambda>c. c(x := Suc (c x)))\"\nby force\n\nlemma Commute_next_unknown [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. unknown_counters s v)) m\"\n      and \"Commute (update_state (unknown_counters_update (\\<lambda>c. c(v := Suc (c v))))) m\"\n  shows \"Commute (next_unknown v) m\"\nproof -\n  have \"next_unknown v = \n        bind (read_state (\\<lambda>s. (unknown_counters s v, v)))\n             (\\<lambda>a. bind (update_state (unknown_counters_update (\\<lambda>c. c(v := Suc (c v))))) \n             (\\<lambda>_. return a))\"\n    unfolding next_unknown_alt_def monad_def\n    by auto\n  thus ?thesis\n    using assms\n    by auto\nqed\n\ntext \\<open>The lemma below tests the proof method @{method Commute}.\\<close>\n\nlemma \"Commute (next_unknown ''a'') (next_unknown ''b'')\"\nby Commute\n\n(* Code generation - end override *)\n\nsubsubsection \\<open>@{const PCC}\\<close>\n\nlemma Commute_PCC [Commute_compositeI]:\n  assumes \"Commute (read_state c_pcc) m\"\n      and \"Commute (read_state procID) m\"\n  shows \"Commute PCC m\"\nunfolding PCC_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'PCC}\\<close>\n\nlemma Commute_write'PCC [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (update_state (c_pcc_update x)) m\"\n  shows \"Commute (write'PCC v) m\"\nunfolding write'PCC_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const CAPR}\\<close>\n\nlemma Commute_CAPR [Commute_compositeI]:\n  assumes \"Commute (read_state c_capr) m\"\n      and \"Commute (read_state procID) m\"\n  shows \"Commute (CAPR v) m\"\nunfolding CAPR_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'CAPR}\\<close>\n\nlemma Commute_write'CAPR [Commute_compositeI]:\n  assumes \"Commute (read_state c_capr) m\"\n      and \"\\<And>x. Commute (update_state (c_capr_update x)) m\"\n  shows \"Commute (write'CAPR v) m\"\nunfolding write'CAPR_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const SCAPR}\\<close>\n\nlemma Commute_SCAPR [Commute_compositeI]:\n  assumes \"Commute (read_state c_scapr) m\"\n      and \"Commute (read_state procID) m\"\n  shows \"Commute (SCAPR v) m\"\nunfolding SCAPR_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'SCAPR}\\<close>\n\nlemma Commute_write'SCAPR [Commute_compositeI]:\n  assumes \"Commute (read_state c_scapr) m\"\n      and \"\\<And>x. Commute (update_state (c_scapr_update x)) m\"\n  shows \"Commute (write'SCAPR v) m\"\nunfolding write'SCAPR_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const SignalException}\\<close>\n\nlemma Commute_SignalException [Commute_compositeI]:\n  assumes \"Commute (read_state currentInst) m\"\n      and \"Commute (read_state lastInst) m\"\n      and \"Commute (read_state BranchDelayPCC) m\"\n      and \"Commute (read_state capcause) m\"\n      and \"Commute (read_state (\\<lambda>s. c_BranchDelay (c_state s))) m\"\n      and \"Commute (read_state (\\<lambda>s. c_PC (c_state s))) m\"\n      and \"Commute (read_state (\\<lambda>s. EXL (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. BEV (Status (c_CP0 (c_state s))))) m\"\n      and \"\\<And>x. Commute (update_state (BranchDelayPCC_update x)) m\"\n      and \"\\<And>x. Commute (update_state (BranchToPCC_update x)) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_BranchDelay_update x))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_BranchTo_update x))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_PC_update x))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_exceptionSignalled_update x))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (Status_update (EXL_update x))))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (EPC_update x)))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (BadInstr_update x)))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (BadInstrP_update x)))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (Cause_update (BD_update x))))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (Cause_update (CauseRegister.ExcCode_update x))))) m\"\n      and \"Commute PCC m\"\n      and \"\\<And>x. Commute (write'PCC x) m\"\n      and \"\\<And>x. Commute (SCAPR x) m\"\n      and \"\\<And>x. Commute (write'SCAPR x) m\"\n      and \"Commute (next_unknown ''BadInstrP'') m\"\n  shows \"Commute (SignalException v) m\"\nunfolding SignalException_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const SignalCP2UnusableException}\\<close>\n\nlemma Commute_SignalCP2UnusableException [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (Cause_update (CE_update x))))) m\"\n      and \"\\<And>x. Commute (SignalException x) m\"\n  shows \"Commute SignalCP2UnusableException m\"\nunfolding SignalCP2UnusableException_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const SignalCapException_internal}\\<close>\n\nlemma Commute_SignalCapException_internal [Commute_compositeI]:\n  assumes \"Commute (read_state capcause) m\"\n      and \"\\<And>x. Commute (update_state (capcause_update x)) m\"\n      and \"\\<And>x. Commute (SignalException x) m\"\n  shows \"Commute (SignalCapException_internal v) m\"\nunfolding SignalCapException_internal_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const SignalCapException}\\<close>\n\nlemma Commute_SignalCapException [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (SignalCapException_internal x) m\"\n  shows \"Commute (SignalCapException v) m\"\nunfolding SignalCapException_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const SignalCapException_noReg}\\<close>\n\nlemma Commute_SignalCapException_noReg [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (SignalCapException_internal x) m\"\n  shows \"Commute (SignalCapException_noReg v) m\"\nunfolding SignalCapException_noReg_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const TLB_direct}\\<close>\n\nlemma Commute_TLB_direct [Commute_compositeI]:\n  assumes \"Commute (read_state c_TLB_direct) m\"\n      and \"Commute (read_state procID) m\"\n  shows \"Commute (TLB_direct v) m\"\nunfolding TLB_direct_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'TLB_direct}\\<close>\n\nlemma Commute_write'TLB_direct [Commute_compositeI]:\n  assumes \"Commute (read_state c_TLB_direct) m\"\n      and \"\\<And>x. Commute (update_state (c_TLB_direct_update x)) m\"\n  shows \"Commute (write'TLB_direct v) m\"\nunfolding write'TLB_direct_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const TLB_assoc}\\<close>\n\nlemma Commute_TLB_assoc [Commute_compositeI]:\n  assumes \"Commute (read_state c_TLB_assoc) m\"\n      and \"Commute (read_state procID) m\"\n  shows \"Commute (TLB_assoc v) m\"\nunfolding TLB_assoc_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'TLB_assoc}\\<close>\n\nlemma Commute_write'TLB_assoc [Commute_compositeI]:\n  assumes \"Commute (read_state c_TLB_assoc) m\"\n      and \"\\<And>x. Commute (update_state (c_TLB_assoc_update x)) m\"\n  shows \"Commute (write'TLB_assoc v) m\"\nunfolding write'TLB_assoc_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const LookupTLB}\\<close>\n\nlemma Commute_LookupTLB [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. Config6 (c_CP0 (c_state s)))) m\"\n      and \"Commute (read_state (\\<lambda>s. EntryHi (c_CP0 (c_state s)))) m\"\n      and \"\\<And>x. Commute (TLB_assoc x) m\"\n      and \"\\<And>x. Commute (TLB_direct x) m\"\n  shows \"Commute (LookupTLB v) m\"\nunfolding LookupTLB_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const SignalTLBException_internal}\\<close>\n\nlemma Commute_SignalTLBException_internal [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (BadVAddr_update x)))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (EntryHi_update x)))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (Context_update x)))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (XContext_update x)))) m\"\n  shows \"Commute (SignalTLBException_internal v) m\"\nunfolding SignalTLBException_internal_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const SignalTLBException}\\<close>\n\nlemma Commute_SignalTLBException [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (SignalException x) m\"\n      and \"\\<And>x. Commute (SignalTLBException_internal x) m\"\n  shows \"Commute (SignalTLBException v) m\"\nunfolding SignalTLBException_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const CheckSegment}\\<close>\n\nlemma Commute_CheckSegment [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. K0 (Config (c_CP0 (c_state s))))) m\"\n      and \"Commute UserMode m\"\n      and \"Commute SupervisorMode m\"\n  shows \"Commute (CheckSegment v) m\"\nunfolding CheckSegment_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const check_cca}\\<close>\n\nlemma Commute_check_cca [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (raise'exception x) m\"\n  shows \"Commute (check_cca v) m\"\nunfolding check_cca_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const TLB_next_random}\\<close>\n\nlemma Commute_TLB_next_random [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. Random.Random (Random (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. Wired.Wired (Wired (c_CP0 (c_state s))))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (Random_update (Random.Random_update x))))) m\"\n  shows \"Commute (TLB_next_random v) m\"\nunfolding TLB_next_random_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const AddressTranslation}\\<close>\n\nlemma Commute_AddressTranslation [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. EntryHi (c_CP0 (c_state s)))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (BadVAddr_update x)))) m\"\n      and \"\\<And>x. Commute (CheckSegment x) m\"\n      and \"\\<And>x. Commute (LookupTLB x) m\"\n      and \"Commute PCC m\"\n      and \"\\<And>x. Commute (SignalTLBException x) m\"\n      and \"\\<And>x. Commute (raise'exception x) m\"\n      and \"\\<And>x. Commute (check_cca x) m\"\n      and \"\\<And>x. Commute (SignalException x) m\"\n      and \"Commute (next_unknown ''tlb-translation'') m\"\n  shows \"Commute (AddressTranslation v) m\"\nunfolding AddressTranslation_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const CP0TLBEntry}\\<close>\n\nlemma Commute_CP0TLBEntry [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. c_CP0 (c_state s))) m\"\n  shows \"Commute (CP0TLBEntry v) m\"\nunfolding CP0TLBEntry_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const SignalTLBCapException}\\<close>\n\nlemma Commute_SignalTLBCapException [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (SignalTLBException_internal x) m\"\n      and \"\\<And>x. Commute (SignalCapException_noReg x) m\"\n      and \"Commute (next_unknown ''tlb-cap-exception'') m\"\n  shows \"Commute (SignalTLBCapException v) m\"\nunfolding SignalTLBCapException_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const printMemStats}\\<close>\n\nlemma Commute_printMemStats [Commute_compositeI]:\n  assumes \"Commute (read_state staticMemStats) m\"\n      and \"Commute (read_state dynamicMemStats) m\"\n  shows \"Commute printMemStats m\"\nunfolding printMemStats_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const initMemStats}\\<close>\n\nlemma Commute_initMemStats [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (update_state (staticMemStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamicMemStats_update x)) m\"\n  shows \"Commute initMemStats m\"\nunfolding initMemStats_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const stats_data_reads_updt}\\<close>\n\nlemma Commute_stats_data_reads_updt [Commute_compositeI]:\n  assumes \"Commute (read_state staticMemStats) m\"\n      and \"Commute (read_state dynamicMemStats) m\"\n      and \"\\<And>x. Commute (update_state (staticMemStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamicMemStats_update x)) m\"\n  shows \"Commute (stats_data_reads_updt v) m\"\nunfolding stats_data_reads_updt_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const stats_data_writes_updt}\\<close>\n\nlemma Commute_stats_data_writes_updt [Commute_compositeI]:\n  assumes \"Commute (read_state staticMemStats) m\"\n      and \"Commute (read_state dynamicMemStats) m\"\n      and \"\\<And>x. Commute (update_state (staticMemStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamicMemStats_update x)) m\"\n  shows \"Commute (stats_data_writes_updt v) m\"\nunfolding stats_data_writes_updt_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const stats_inst_reads_updt}\\<close>\n\nlemma Commute_stats_inst_reads_updt [Commute_compositeI]:\n  assumes \"Commute (read_state staticMemStats) m\"\n      and \"Commute (read_state dynamicMemStats) m\"\n      and \"\\<And>x. Commute (update_state (staticMemStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamicMemStats_update x)) m\"\n  shows \"Commute (stats_inst_reads_updt v) m\"\nunfolding stats_inst_reads_updt_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const stats_valid_cap_reads_updt}\\<close>\n\nlemma Commute_stats_valid_cap_reads_updt [Commute_compositeI]:\n  assumes \"Commute (read_state staticMemStats) m\"\n      and \"Commute (read_state dynamicMemStats) m\"\n      and \"\\<And>x. Commute (update_state (staticMemStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamicMemStats_update x)) m\"\n  shows \"Commute (stats_valid_cap_reads_updt v) m\"\nunfolding stats_valid_cap_reads_updt_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const stats_valid_cap_writes_updt}\\<close>\n\nlemma Commute_stats_valid_cap_writes_updt [Commute_compositeI]:\n  assumes \"Commute (read_state staticMemStats) m\"\n      and \"Commute (read_state dynamicMemStats) m\"\n      and \"\\<And>x. Commute (update_state (staticMemStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamicMemStats_update x)) m\"\n  shows \"Commute (stats_valid_cap_writes_updt v) m\"\nunfolding stats_valid_cap_writes_updt_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const stats_invalid_cap_reads_updt}\\<close>\n\nlemma Commute_stats_invalid_cap_reads_updt [Commute_compositeI]:\n  assumes \"Commute (read_state staticMemStats) m\"\n      and \"Commute (read_state dynamicMemStats) m\"\n      and \"\\<And>x. Commute (update_state (staticMemStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamicMemStats_update x)) m\"\n  shows \"Commute (stats_invalid_cap_reads_updt v) m\"\nunfolding stats_invalid_cap_reads_updt_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const stats_invalid_cap_writes_updt}\\<close>\n\nlemma Commute_stats_invalid_cap_writes_updt [Commute_compositeI]:\n  assumes \"Commute (read_state staticMemStats) m\"\n      and \"Commute (read_state dynamicMemStats) m\"\n      and \"\\<And>x. Commute (update_state (staticMemStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamicMemStats_update x)) m\"\n  shows \"Commute (stats_invalid_cap_writes_updt v) m\"\nunfolding stats_invalid_cap_writes_updt_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const MEM}\\<close>\n\nlemma Commute_MEM [Commute_compositeI]:\n  assumes \"Commute (read_state the_MEM) m\"\n  shows \"Commute (MEM v) m\"\nunfolding MEM_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'MEM}\\<close>\n\nlemma Commute_write'MEM [Commute_compositeI]:\n  assumes \"Commute (read_state the_MEM) m\"\n      and \"\\<And>x. Commute (update_state (the_MEM_update x)) m\"\n  shows \"Commute (write'MEM v) m\"\nunfolding write'MEM_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const InitMEM}\\<close>\n\nlemma Commute_InitMEM [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (update_state (static_shadow_MEM_update x)) m\"\n      and \"\\<And>x. Commute (update_state (static_shadow_TAGS_update x)) m\"\n      and \"\\<And>x. Commute (update_state (static_shadow_4K_TAGS_update x)) m\"\n      and \"\\<And>x. Commute (update_state (static_shadow_16K_TAGS_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamic_shadow_MEM_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamic_shadow_TAGS_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamic_shadow_4K_TAGS_update x)) m\"\n      and \"\\<And>x. Commute (update_state (dynamic_shadow_16K_TAGS_update x)) m\"\n      and \"\\<And>x. Commute (update_state (the_MEM_update x)) m\"\n      and \"Commute (next_unknown ''mem-data'') m\"\n  shows \"Commute InitMEM m\"\nunfolding InitMEM_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const ReadData}\\<close>\n\nlemma Commute_ReadData [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (MEM x) m\"\n      and \"\\<And>x. Commute (stats_data_reads_updt x) m\"\n  shows \"Commute (ReadData v) m\"\nunfolding ReadData_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const WriteData}\\<close>\n\nlemma Commute_WriteData [Commute_compositeI]:\n  assumes \"Commute (read_state the_MEM) m\"\n      and \"\\<And>x. Commute (write'MEM x) m\"\n      and \"\\<And>x. Commute (stats_data_writes_updt x) m\"\n  shows \"Commute (WriteData v) m\"\nunfolding WriteData_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const ReadInst}\\<close>\n\nlemma Commute_ReadInst [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (MEM x) m\"\n      and \"\\<And>x. Commute (stats_inst_reads_updt x) m\"\n  shows \"Commute (ReadInst v) m\"\nunfolding ReadInst_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const ReadCap}\\<close>\n\nlemma Commute_ReadCap [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (MEM x) m\"\n      and \"\\<And>x. Commute (stats_valid_cap_reads_updt x) m\"\n      and \"\\<And>x. Commute (stats_invalid_cap_reads_updt x) m\"\n  shows \"Commute (ReadCap v) m\"\nunfolding ReadCap_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const WriteCap}\\<close>\n\nlemma Commute_WriteCap [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (write'MEM x) m\"\n      and \"\\<And>x. Commute (stats_valid_cap_writes_updt x) m\"\n      and \"\\<And>x. Commute (stats_invalid_cap_writes_updt x) m\"\n  shows \"Commute (WriteCap v) m\"\nunfolding WriteCap_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const AdjustEndian}\\<close>\n\nlemma Commute_AdjustEndian [Commute_compositeI]:\n  assumes \"Commute ReverseEndian m\"\n      and \"\\<And>x. Commute (raise'exception x) m\"\n  shows \"Commute (AdjustEndian v) m\"\nunfolding AdjustEndian_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const initMemAccessStats}\\<close>\n\nlemma Commute_initMemAccessStats [Commute_compositeI]:\n  assumes \"Commute (read_state memAccessStats) m\"\n      and \"\\<And>x. Commute (update_state (memAccessStats_update x)) m\"\n  shows \"Commute initMemAccessStats m\"\nunfolding initMemAccessStats_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const printMemAccessStats}\\<close>\n\nlemma Commute_printMemAccessStats [Commute_compositeI]:\n  assumes \"Commute (read_state memAccessStats) m\"\n  shows \"Commute printMemAccessStats m\"\nunfolding printMemAccessStats_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const getVirtualAddress}\\<close>\n\nlemma Commute_getVirtualAddress [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (SCAPR x) m\"\n  shows \"Commute (getVirtualAddress v) m\"\nunfolding getVirtualAddress_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const LoadMemoryCap}\\<close>\n\nlemma Commute_LoadMemoryCap [Commute_compositeI]:\n  assumes \"Commute (read_state JTAG_UART) m\"\n      and \"Commute (read_state totalCore) m\"\n      and \"Commute (read_state PIC_base_address) m\"\n      and \"Commute (read_state memAccessStats) m\"\n      and \"Commute (read_state (\\<lambda>s. c_exceptionSignalled (c_state s))) m\"\n      and \"\\<And>x. Commute (update_state (memAccessStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_LLbit_update x))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (BadVAddr_update x)))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (LLAddr_update x)))) m\"\n      and \"\\<And>x. Commute (AdjustEndian x) m\"\n      and \"\\<And>x. Commute (ReadData x) m\"\n      and \"\\<And>x. Commute (PIC_load x) m\"\n      and \"\\<And>x. Commute (SignalException x) m\"\n      and \"\\<And>x. Commute (AddressTranslation x) m\"\n      and \"\\<And>x. Commute (raise'exception x) m\"\n      and \"Commute JTAG_UART_load m\"\n      and \"\\<And>x. Commute (stats_data_reads_updt x) m\"\n      and \"Commute (next_unknown ''mem-data'') m\"\n  shows \"Commute (LoadMemoryCap v) m\"\nunfolding LoadMemoryCap_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const LoadMemory}\\<close>\n\nlemma Commute_LoadMemory [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (SCAPR x) m\"\n      and \"\\<And>x. Commute (SignalCapException x) m\"\n      and \"\\<And>x. Commute (LoadMemoryCap x) m\"\n      and \"Commute (next_unknown ''mem-data'') m\"\n  shows \"Commute (LoadMemory v) m\"\nunfolding LoadMemory_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const LoadCap}\\<close>\n\nlemma Commute_LoadCap [Commute_compositeI]:\n  assumes \"Commute (read_state JTAG_UART) m\"\n      and \"Commute (read_state totalCore) m\"\n      and \"Commute (read_state PIC_base_address) m\"\n      and \"Commute (read_state memAccessStats) m\"\n      and \"Commute (read_state (\\<lambda>s. c_exceptionSignalled (c_state s))) m\"\n      and \"\\<And>x. Commute (update_state (memAccessStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_LLbit_update x))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (LLAddr_update x)))) m\"\n      and \"\\<And>x. Commute (AddressTranslation x) m\"\n      and \"\\<And>x. Commute (raise'exception x) m\"\n      and \"\\<And>x. Commute (ReadCap x) m\"\n      and \"Commute (next_unknown ''capability'') m\"\n  shows \"Commute (LoadCap v) m\"\nunfolding LoadCap_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const StoreMemoryCap}\\<close>\n\nlemma Commute_StoreMemoryCap [Commute_compositeI]:\n  assumes \"Commute (read_state JTAG_UART) m\"\n      and \"Commute (read_state totalCore) m\"\n      and \"Commute (read_state PIC_base_address) m\"\n      and \"Commute (read_state memAccessStats) m\"\n      and \"Commute (read_state (\\<lambda>s. c_LLbit (c_state s))) m\"\n      and \"Commute (read_state (\\<lambda>s. c_exceptionSignalled (c_state s))) m\"\n      and \"Commute (read_state (\\<lambda>s. LLAddr (c_CP0 (c_state s)))) m\"\n      and \"Commute (read_state all_state) m\"\n      and \"Commute (read_state procID) m\"\n      and \"\\<And>x. Commute (update_state (all_state_update x)) m\"\n      and \"\\<And>x. Commute (update_state (memAccessStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_LLbit_update x))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (BadVAddr_update x)))) m\"\n      and \"\\<And>x. Commute (AdjustEndian x) m\"\n      and \"\\<And>x. Commute (SignalException x) m\"\n      and \"\\<And>x. Commute (AddressTranslation x) m\"\n      and \"\\<And>x. Commute (raise'exception x) m\"\n      and \"\\<And>x. Commute (JTAG_UART_store x) m\"\n      and \"\\<And>x. Commute (PIC_store x) m\"\n      and \"\\<And>x. Commute (WriteData x) m\"\n      and \"Commute (next_unknown ''sc-success'') m\"\n  shows \"Commute (StoreMemoryCap v) m\"\nunfolding StoreMemoryCap_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const StoreMemory}\\<close>\n\nlemma Commute_StoreMemory [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (SCAPR x) m\"\n      and \"\\<And>x. Commute (SignalCapException x) m\"\n      and \"\\<And>x. Commute (StoreMemoryCap x) m\"\n      and \"Commute (next_unknown ''sc-success'') m\"\n  shows \"Commute (StoreMemory v) m\"\nunfolding StoreMemory_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const StoreCap}\\<close>\n\nlemma Commute_StoreCap [Commute_compositeI]:\n  assumes \"Commute (read_state JTAG_UART) m\"\n      and \"Commute (read_state totalCore) m\"\n      and \"Commute (read_state PIC_base_address) m\"\n      and \"Commute (read_state memAccessStats) m\"\n      and \"Commute (read_state (\\<lambda>s. c_LLbit (c_state s))) m\"\n      and \"Commute (read_state (\\<lambda>s. c_exceptionSignalled (c_state s))) m\"\n      and \"Commute (read_state (\\<lambda>s. LLAddr (c_CP0 (c_state s)))) m\"\n      and \"Commute (read_state (\\<lambda>s. ASID (EntryHi (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state all_state) m\"\n      and \"Commute (read_state procID) m\"\n      and \"\\<And>x. Commute (update_state (all_state_update x)) m\"\n      and \"\\<And>x. Commute (update_state (memAccessStats_update x)) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_LLbit_update x))) m\"\n      and \"\\<And>x. Commute (AddressTranslation x) m\"\n      and \"\\<And>x. Commute (raise'exception x) m\"\n      and \"\\<And>x. Commute (SignalTLBCapException x) m\"\n      and \"\\<And>x. Commute (WriteCap x) m\"\n  shows \"Commute (StoreCap v) m\"\nunfolding StoreCap_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const Fetch}\\<close>\n\nlemma Commute_Fetch [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. c_exceptionSignalled (c_state s))) m\"\n      and \"Commute (read_state (\\<lambda>s. c_PC (c_state s))) m\"\n      and \"Commute (read_state (\\<lambda>s. Compare (c_CP0 (c_state s)))) m\"\n      and \"Commute (read_state (\\<lambda>s. Count (c_CP0 (c_state s)))) m\"\n      and \"Commute (read_state (\\<lambda>s. IE (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. EXL (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. ERL (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. IM (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute (read_state (\\<lambda>s. IP (Cause (c_CP0 (c_state s))))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (Cause_update x)))) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update (BadVAddr_update x)))) m\"\n      and \"\\<And>x. Commute (SignalException x) m\"\n      and \"\\<And>x. Commute (SignalCapException_noReg x) m\"\n      and \"Commute PCC m\"\n      and \"\\<And>x. Commute (ReadInst x) m\"\n      and \"\\<And>x. Commute (AddressTranslation x) m\"\n  shows \"Commute Fetch m\"\nunfolding Fetch_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const CP0R}\\<close>\n\nlemma Commute_CP0R [Commute_compositeI]:\n  assumes \"Commute (read_state procID) m\"\n      and \"Commute (read_state totalCore) m\"\n      and \"Commute (read_state (\\<lambda>s. c_CP0 (c_state s))) m\"\n      and \"Commute (next_unknown ''cop-reg'') m\"\n  shows \"Commute (CP0R v) m\"\nunfolding CP0R_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'CP0R}\\<close>\n\nlemma Commute_write'CP0R [Commute_compositeI]:\n  assumes \"Commute (read_state hasCP1) m\"\n      and \"Commute (read_state hasCP2) m\"\n      and \"Commute (read_state (\\<lambda>s. c_CP0 (c_state s))) m\"\n      and \"\\<And>x. Commute (update_state (done_update x)) m\"\n      and \"\\<And>x. Commute (update_state (c_state_update (c_CP0_update x))) m\"\n      and \"\\<And>x. Commute (raise'exception x) m\"\n  shows \"Commute (write'CP0R v) m\"\nunfolding write'CP0R_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const resetStats}\\<close>\n\nlemma Commute_resetStats [Commute_compositeI]:\n  assumes \"Commute initMemStats m\"\n      and \"Commute initMemAccessStats m\"\n      and \"Commute initCoreStats m\"\n  shows \"Commute resetStats m\"\nunfolding resetStats_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const HI}\\<close>\n\nlemma Commute_HI [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. c_hi (c_state s))) m\"\n      and \"Commute (next_unknown ''hi-reg'') m\"\n  shows \"Commute HI m\"\nunfolding HI_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'HI}\\<close>\n\nlemma Commute_write'HI [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (update_state (c_state_update (c_hi_update x))) m\"\n  shows \"Commute (write'HI v) m\"\nunfolding write'HI_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const LO}\\<close>\n\nlemma Commute_LO [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. c_lo (c_state s))) m\"\n      and \"Commute (next_unknown ''lo-reg'') m\"\n  shows \"Commute LO m\"\nunfolding LO_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const write'LO}\\<close>\n\nlemma Commute_write'LO [Commute_compositeI]:\n  assumes \"\\<And>x. Commute (update_state (c_state_update (c_lo_update x))) m\"\n  shows \"Commute (write'LO v) m\"\nunfolding write'LO_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const special_register_accessible}\\<close>\n\nlemma Commute_special_register_accessible [Commute_compositeI]:\n  assumes \"Commute (read_state (\\<lambda>s. CU0 (Status (c_CP0 (c_state s))))) m\"\n      and \"Commute PCC m\"\n      and \"Commute KernelMode m\"\n  shows \"Commute (special_register_accessible v) m\"\nunfolding special_register_accessible_alt_def\nusing assms\nby - Commute_find_dependencies\n\nsubsubsection \\<open>@{const log_instruction}\\<close>\n\nlemma Commute_log_instruction [Commute_compositeI]:\n  assumes \"Commute (read_state procID) m\"\n      and \"Commute (read_state instCnt) m\"\n      and \"Commute (read_state (\\<lambda>s. c_PC (c_state s))) m\"\n      and \"Commute PCC m\"\n  shows \"Commute (log_instruction v) m\"\nunfolding log_instruction_alt_def\nusing assms\nby - Commute_find_dependencies\n\n(* Code generation - override - Next *)\n\nlemma Commute_TakeBranch [Commute_compositeI]:\n  assumes \"Commute (read_state BranchDelayPCC) m\"\n      and \"Commute (read_state BranchToPCC) m\"\n      and \"Commute (read_state getBranchDelay) m\"\n      and \"Commute (read_state getBranchTo) m\"\n      and \"Commute (read_state getExceptionSignalled) m\"\n      and \"Commute (read_state getPC) m\"\n      and \"Commute (read_state CCallBranch) m\"\n      and \"\\<And>v. Commute (update_state (BranchDelayPCC_update v)) m\"\n      and \"\\<And>v. Commute (update_state (BranchToPCC_update v)) m\"\n      and \"\\<And>v. Commute (update_state (setBranchDelay v)) m\"\n      and \"\\<And>v. Commute (update_state (setBranchTo v)) m\"\n      and \"\\<And>v. Commute (update_state (setPC v)) m\"\n      and \"\\<And>v. Commute (update_state (CCallBranch_update v)) m\"\n      and \"\\<And>v. Commute (update_state (CCallBranchDelay_update v)) m\"\n      and \"\\<And>v. Commute (write'PCC v) m\"\n      and \"\\<And>ex. Commute (raise'exception (UNPREDICTABLE ex)) m\"\n  shows \"Commute TakeBranch m\"\nunfolding TakeBranch_def\nusing assms\nby - Commute_find_dependencies\n\n(* Code generation - end override *)\n\n(* Code generation - end *)\n\nsubsubsection \\<open>Tests\\<close>\n\ntext \\<open>The purpose of the lemma below is testing the proof method.\\<close>\n\nlemma\n  \"Commute (bind UserMode (\\<lambda>a. update_state (setPC (f a))))\n           (bind (write'GPR v) (\\<lambda>_. foreach_loop (l, \\<lambda>x. update_state (setExceptionSignalled x))))\"\nby Commute\n\nsubsection \\<open>Changing the order of steps\\<close>\n\ndefinition SwappingGives :: \n  \"(state \\<Rightarrow> 'a \\<times> state) \\<Rightarrow> \n   (state \\<Rightarrow> 'b \\<times> state) \\<Rightarrow> \n   (state \\<Rightarrow> 'a \\<times> state) \\<Rightarrow> \n   (state \\<Rightarrow> 'b \\<times> state) \\<Rightarrow> \n   bool\" \nwhere\n  \"SwappingGives m n m' n' \\<equiv>\n   bind m (\\<lambda>_. n) = bind n' (\\<lambda>a. bind m' (\\<lambda>_. return a))\"\n\nlemma SwappingGivesE_ValuePart [elim!]:\n  assumes \"SwappingGives m n m' n'\"\n  shows \"ValuePart n (StatePart m s) = ValuePart n' s\"\nproof -\n  have \"bind m (\\<lambda>_. n) = bind n' (\\<lambda>a. bind m' (\\<lambda>_. return a))\"\n    using assms\n    unfolding SwappingGives_def \n    by simp\n  from arg_cong[OF this, where f=\"\\<lambda>m. ValuePart m s\"]\n  show ?thesis\n    by (auto simp: ValueAndStatePart_simp)\nqed\n\nlemma SwappingGivesE_StatePart [elim!]:\n  assumes \"SwappingGives m n m' n'\"\n  shows \"StatePart n (StatePart m s) = StatePart m' (StatePart n' s)\"\nproof -\n  have \"bind m (\\<lambda>_. n) = bind n' (\\<lambda>a. bind m' (\\<lambda>_. return a))\"\n    using assms\n    unfolding SwappingGives_def \n    by simp\n  from arg_cong[OF this, where f=\"\\<lambda>m. StatePart m s\"]\n  show ?thesis\n    by (auto simp: ValueAndStatePart_simp)\nqed\n\nlemma SwappingGives_left_return:\n  shows \"SwappingGives (return x) m (return undefined) m\"\nunfolding SwappingGives_def\nby simp\n\nlemma SwappingGives_left_read_state:\n  shows \"SwappingGives (read_state f) m (return undefined) m\"\nunfolding SwappingGives_def\nby simp\n\nlemma SwappingGives_right_bind:\n  assumes \"SwappingGives m n\\<^sub>1 m' n\\<^sub>1'\"\n      and \"\\<And>a. SwappingGives m' (n\\<^sub>2 a) m'' (n\\<^sub>2' a)\"\n  shows \"SwappingGives m (bind n\\<^sub>1 n\\<^sub>2) m'' (bind n\\<^sub>1' n\\<^sub>2')\"\nproof -\n  have \"bind m (\\<lambda>_. bind n\\<^sub>1 n\\<^sub>2) = \n        bind (bind n\\<^sub>1' (\\<lambda>a. bind m' (\\<lambda>_. return a))) n\\<^sub>2\"\n    using assms(1)\n    unfolding SwappingGives_def\n    by (simp add: bind_associativity[THEN sym])\n  also have \"... = bind (bind n\\<^sub>1' n\\<^sub>2') (\\<lambda>a. bind m'' (\\<lambda>_. return a))\"\n    using assms(2)\n    unfolding SwappingGives_def\n    by (simp add: bind_associativity)\n  finally show ?thesis\n    unfolding SwappingGives_def\n    by simp\nqed\n\ntext \\<open>Note that the two assumptions below require that \\<open>m\\<close> stays the same when it is swapped with\n\\<open>n\\<^sub>1\\<close> or with \\<open>n\\<^sub>2\\<close>, because this prevents duplicating \\<open>m\\<close>. However, it also means that the lemma\nwill not always be applicable.\\<close>\n\nlemma SwappingGives_right_if:\n  assumes \"SwappingGives m n\\<^sub>1 m n\\<^sub>1'\"\n      and \"SwappingGives m n\\<^sub>2 m n\\<^sub>2'\"\n  shows \"SwappingGives m (if b then n\\<^sub>1 else n\\<^sub>2) m (if b then n\\<^sub>1' else n\\<^sub>2')\"\nusing assms\nby auto\n\nlemma SwappingGives_right_option:\n  assumes \"SwappingGives m n\\<^sub>1 m n\\<^sub>1'\"\n      and \"\\<And>y. SwappingGives m (n\\<^sub>2 y) m (n\\<^sub>2' y)\"\n  shows \"SwappingGives m (case x of None \\<Rightarrow> n\\<^sub>1 | Some y \\<Rightarrow> n\\<^sub>2 y) \n                       m (case x of None \\<Rightarrow> n\\<^sub>1' | Some y \\<Rightarrow> n\\<^sub>2' y)\"\nusing assms\nby (cases x) auto\n\nlemma SwappingGives_right_conj:\n  assumes \"SwappingGives m n\\<^sub>1 m n\\<^sub>1'\"\n      and \"SwappingGives m n\\<^sub>2 m n\\<^sub>2'\"\n  shows \"SwappingGives m (n\\<^sub>1 \\<and>\\<^sub>b n\\<^sub>2) m (n\\<^sub>1' \\<and>\\<^sub>b n\\<^sub>2')\"\nusing SwappingGivesE_ValuePart[OF assms(1)]\nusing SwappingGivesE_ValuePart[OF assms(2)]\nunfolding SwappingGives_def\nby (intro monad_eqI) (auto simp: ValueAndStatePart_simp)\n\nlemma SwappingGives_right_disj:\n  assumes \"SwappingGives m n\\<^sub>1 m n\\<^sub>1'\"\n      and \"SwappingGives m n\\<^sub>2 m n\\<^sub>2'\"\n  shows \"SwappingGives m (n\\<^sub>1 \\<or>\\<^sub>b n\\<^sub>2) m (n\\<^sub>1' \\<or>\\<^sub>b n\\<^sub>2')\"\nusing SwappingGivesE_ValuePart[OF assms(1)]\nusing SwappingGivesE_ValuePart[OF assms(2)]\nunfolding SwappingGives_def\nby (intro monad_eqI) (auto simp: ValueAndStatePart_simp)\n\nlemma SwappingGives_right_equals:\n  assumes \"SwappingGives m n\\<^sub>1 m n\\<^sub>1'\"\n      and \"SwappingGives m n\\<^sub>2 m n\\<^sub>2'\"\n  shows \"SwappingGives m (n\\<^sub>1 =\\<^sub>b n\\<^sub>2) m (n\\<^sub>1' =\\<^sub>b n\\<^sub>2')\"\nusing SwappingGivesE_ValuePart[OF assms(1)]\nusing SwappingGivesE_ValuePart[OF assms(2)]\nunfolding SwappingGives_def\nby (intro monad_eqI) (auto simp: ValueAndStatePart_simp)\n\nlemma SwappingGives_right_bind_read_if_heuristic:\n  assumes \"SwappingGives m (read_state f) m (return b)\"\n      and \"if_simp = (if b then n else n')\"\n      and \"SwappingGives m if_simp m' if_simp'\"\n  shows \"SwappingGives m (bind (read_state f) (\\<lambda>x. if x then n else n')) m' if_simp'\"\nusing SwappingGivesE_ValuePart[OF assms(1)]\nusing SwappingGivesE_StatePart[OF assms(1)]\nusing SwappingGivesE_ValuePart[OF assms(3)]\nusing SwappingGivesE_StatePart[OF assms(3)]\nusing assms(2)\nunfolding SwappingGives_def\nby (intro monad_eqI) (auto simp: ValueAndStatePart_simp)\n\nlemma SwappingGives_Commute:\n  assumes \"Commute m n\"\n  shows \"SwappingGives m n m n\"\nusing assms\nunfolding Commute_def SwappingGives_def \nby (simp add: monad_eqI ValuePart_bind StatePart_bind)\n\nlemma SwappingGives_merge_setter_getter:\n  assumes \"\\<And>s. StatePart n s = s\"\n      and \"\\<And>s. ValuePart n (StatePart m s) = x\"\n  shows \"SwappingGives m n m (return x)\"\nusing assms\nunfolding SwappingGives_def\nby (intro monad_eqI) (simp_all add: ValuePart_bind StatePart_bind)\n\nlemma SwappingGives_stuck:\n  shows \"SwappingGives m n (return undefined) (bind m (\\<lambda>_. n))\"\nunfolding SwappingGives_def\nby simp\n\nmethod PushBackwards uses intro simp =\n  (rule SwappingGives_left_return \n        SwappingGives_left_read_state) |\n  (rule SwappingGives_right_bind_read_if_heuristic,\n     PushBackwards intro: intro simp: simp,\n     solves \\<open>simp add: simp\\<close>,\n     PushBackwards intro: intro simp: simp) |\n  (rule SwappingGives_right_bind,\n     PushBackwards intro: intro simp: simp,\n     PushBackwards intro: intro simp: simp) |\n  (rule SwappingGives_right_if \n        SwappingGives_right_option\n        SwappingGives_right_conj\n        SwappingGives_right_disj\n        SwappingGives_right_equals,\n     PushBackwards intro: intro simp: simp,\n     PushBackwards intro: intro simp: simp) |\n  -- \\<open>The following rule is an optimisation: if \\<open>SwappingGives_right_xxx\\<close> does not work, then\n  \\<open>SwappingGives_Commute\\<close> also won't work.\\<close>\n  (rule SwappingGives_stuck[where n=\"if _ then _ else _\"]\n        SwappingGives_stuck[where n=\"case _ of None \\<Rightarrow> _ | Some y \\<Rightarrow> _ y\"]\n        SwappingGives_stuck[where n=\"_ \\<and>\\<^sub>b _\"]\n        SwappingGives_stuck[where n=\"_ \\<or>\\<^sub>b _\"]\n        SwappingGives_stuck[where n=\"_ =\\<^sub>b _\"]) |\n  (rule SwappingGives_Commute,\n     solves \\<open>Commute intro: intro\\<close>) |\n  (rule SwappingGives_merge_setter_getter;\n     solves \\<open>simp add: simp\\<close>) |\n  (rule SwappingGives_stuck)\n\nsubsubsection \\<open>Tests\\<close>\n\ntext \\<open>The purpose of the lemmas below is testing the proof method.\\<close>\n\nlemma \"SwappingGives (write'CAPR x) (write'PCC y) (write'CAPR x) (write'PCC y)\"\nby PushBackwards\n\nlemma \"SwappingGives (write'CAPR x) \n                     (bind (write'PCC y) (\\<lambda>_. write'MEM z))\n                     (write'CAPR x)\n                     (bind (write'PCC y) (\\<lambda>_. write'MEM z))\"\nby PushBackwards\n\nlemma \"SwappingGives (write'CAPR x) \n                     (bind (GPR i) (\\<lambda>a. write'GPR (a, j)))\n                     (write'CAPR x)\n                     (bind (GPR i) (\\<lambda>a. write'GPR (a, j)))\"\nby PushBackwards\n\nlemma \"SwappingGives (write'CAPR x) \n                     (foreach_loop (l, \\<lambda>a. write'MEM (y, a)))\n                     (write'CAPR x)\n                     (foreach_loop (l, \\<lambda>a. write'MEM (y, a)))\"\nby PushBackwards\n\nlemma \"SwappingGives (foreach_loop (l, \\<lambda>a. write'CAPR (y, a)))\n                     (write'MEM x) \n                     (foreach_loop (l, \\<lambda>a. write'CAPR (y, a)))\n                     (write'MEM x)\"\nby PushBackwards\n\nlemma \n  assumes \"\\<And>cap cd s. ValuePart (CAPR cd) (StatePart (write'CAPR (cap, cd)) s) = cap\"\n      and \"\\<And>cd s. StatePart (CAPR cd) s = s\"\n  shows \"SwappingGives (write'CAPR (cap, cd)) \n                       (bind (CAPR cd) (\\<lambda>a. write'PCC a))\n                       (write'CAPR (cap, cd))\n                       (bind (return cap) write'PCC)\"\nby (PushBackwards simp: assms)\n\nlemma \n  assumes \"\\<And>cap cd s. ValuePart (CAPR cd) (StatePart (write'CAPR (cap, cd)) s) = cap\"\n      and \"\\<And>cd s. StatePart (CAPR cd) s = s\"\n  shows \"SwappingGives (write'CAPR (cap, cd)) \n                       (bind (CAPR cd) (\\<lambda>a. write'CAPR (a, cb)))\n                       (return undefined)\n                       (bind (return cap) \n                             (\\<lambda>a. bind (write'CAPR (cap, cd)) \n                             (\\<lambda>_. write'CAPR (a, cb))))\"\nby (PushBackwards simp: assms)\n\nlemma \n  assumes \"\\<And>cap cd s. ValuePart (CAPR cd) (StatePart (write'CAPR (cap, cd)) s) = cap\"\n      and \"\\<And>cd s. StatePart (CAPR cd) s = s\"\n  shows \"SwappingGives (write'CAPR (cap, cd)) \n                       (if b then CAPR cd else PCC)\n                       (write'CAPR (cap, cd))\n                       (if b then return cap else PCC)\"\nby (PushBackwards simp: assms)\n\nlemma \n  assumes \"\\<And>cap cd s. ValuePart (CAPR cd) (StatePart (write'CAPR (cap, cd)) s) = cap\"\n      and \"\\<And>cd s. StatePart (CAPR cd) s = s\"\n  shows \"SwappingGives (write'CAPR (cap, cd)) \n                       (case b of None \\<Rightarrow> CAPR cd | Some y \\<Rightarrow> return y)\n                       (write'CAPR (cap, cd))\n                       (case b of None \\<Rightarrow> return cap | Some y \\<Rightarrow> return y)\"\nby (PushBackwards simp: assms)\n\nlemma \n  assumes \"\\<And>cap cd s. ValuePart (CAPR cd) (StatePart (write'CAPR (cap, cd)) s) = cap\"\n      and \"\\<And>cd s. StatePart (CAPR cd) s = s\"\n  shows \"SwappingGives (write'CAPR (cap, cd)) \n                       (CAPR cd =\\<^sub>b return cap')\n                       (write'CAPR (cap, cd))\n                       (return cap =\\<^sub>b return cap')\"\nby (PushBackwards simp: assms)\n\nlemma \n  assumes \"\\<And>s. getExceptionSignalled (StatePart (SignalException ex) s) = True\"\n  shows \"SwappingGives (SignalException ex)\n                       (bind (read_state getExceptionSignalled)\n                             (\\<lambda>b. if b then return 0 else read_state getPC))\n                       (SignalException ex)\n                       (return 0)\"\nby (PushBackwards simp: assms)\n\nlemma \n  assumes \"Commute p n\"\n  shows \"SwappingGives n p n p\"\nby (PushBackwards intro: assms)\n\nsection \\<open>Hoare triples\\<close>\n\nsubsection \\<open>Hoare triples\\<close>\n\ndefinition HoareTriple where\n  \"HoareTriple p m q \\<equiv> \n   \\<forall>s. ValuePart p s \\<longrightarrow> ValuePart (bind m q) s\"\n\nlemma HoareTripleI:\n  assumes \"\\<And>s. ValuePart p s \\<Longrightarrow> ValuePart (bind m q) s\"\n  shows \"HoareTriple p m q\"\nusing assms\nunfolding HoareTriple_def\nby auto\n\nlemma HoareTripleE:\n  assumes \"HoareTriple p m q\"\n      and \"ValuePart p s\"\n  shows \"ValuePart (bind m q) s\"\nusing assms\nunfolding HoareTriple_def\nby auto\n\nlemma HoareTriple_pre_strengthening:\n  assumes \"HoareTriple p' m q\"\n      and \"\\<And>s. ValuePart p s \\<Longrightarrow> ValuePart p' s\"\n  shows   \"HoareTriple p m q\"\nusing assms\nunfolding HoareTriple_def\nby simp\n\nlemma HoareTriple_post_weakening:\n  assumes \"HoareTriple p m q'\"\n      and \"\\<And>a s. ValuePart (q' a) s \\<Longrightarrow> ValuePart (q a) s\"\n  shows   \"HoareTriple p m q\"\nusing assms\nunfolding HoareTriple_def\nby (simp add: ValuePart_bind)\n\nlemma HoareTripleIE:\n  assumes \"HoareTriple p' m q'\"\n      and \"\\<And>s. ValuePart p s \\<Longrightarrow> ValuePart p' s\"\n      and \"\\<And>a s. ValuePart (q' a) s \\<Longrightarrow> ValuePart (q a) s\"\n  shows   \"HoareTriple p m q\"\nusing HoareTriple_pre_strengthening\n  HoareTriple_post_weakening\n  assms\nby metis\n\nlemma HoareTriple_weakest_pre_any:\n  shows \"HoareTriple (bind m q) m q\"\nunfolding HoareTriple_def\nby simp\n\nlemma HoareTriple_weakest_pre_return:\n  shows \"HoareTriple (q x) (return x) q\"\nunfolding HoareTriple_def\nby simp\n\nlemmas HoareTriple_weakest_pre_read_state =\n  HoareTriple_weakest_pre_any[where m=\"read_state f\"] for f\n\nlemma HoareTriple_weakest_pre_read_only:\n  assumes \"\\<And>s. StatePart m s = s\"\n  shows \"HoareTriple (bind (read_state (ValuePart m)) q) m q\"\nusing assms\nunfolding HoareTriple_def\nby (simp add: ValuePart_bind)\n\nlemmas HoareTriple_weakest_pre_update_state =\n  HoareTriple_weakest_pre_any[where m=\"update_state f\"] for f\n\ntext \\<open>Introducing \\<open>p'_simp\\<close> in the lemma below might seem redundant, but it allows the proof method\nto simplify \\<open>p'_simp\\<close> before using it.\\<close>\n\nlemma HoareTriple_weakest_pre_bind:\n  assumes \"\\<And>a. HoareTriple (p' a) (n a) q\"\n      and \"p'_simp = p'\"\n      and \"HoareTriple p m p'_simp\"\n  shows   \"HoareTriple p (bind m n) q\"\nusing assms\nunfolding HoareTriple_def\nby (simp add: ValuePart_bind StatePart_bind)\n\nlemma HoareTriple_weakest_pre_if:\n  assumes \"HoareTriple p m q\"\n      and \"HoareTriple p' n q\"\n  shows   \"HoareTriple (if b then p else p') \n                   (if b then m else n) \n                   q\"\nusing assms\nunfolding HoareTriple_def\nby auto\n\nlemma HoareTriple_weakest_pre_let:\n  assumes \"\\<And>y. HoareTriple (p y) (m y) q\"\n  shows   \"HoareTriple (let x = y in p x) \n                   (let x = y in m x) \n                   q\"\nusing assms\nby auto\n\nlemma HoareTriple_weakest_pre_prod:\n  assumes \"\\<And>y z. HoareTriple (p y z) (m y z) q\"\n  shows   \"HoareTriple (case x of (y, z) \\<Rightarrow> p y z) \n                   (case x of (y, z) \\<Rightarrow> m y z) \n                   q\"\nusing assms\nby (cases x) simp\n\nlemma HoareTriple_weakest_pre_option:\n  assumes \"HoareTriple p1 m1 q\"\n      and \"\\<And>y. HoareTriple (p2 y) (m2 y) q\"\n  shows   \"HoareTriple (case x of None \\<Rightarrow> p1 | Some y \\<Rightarrow> p2 y)\n                   (case x of None \\<Rightarrow> m1 | Some y \\<Rightarrow> m2 y)\n                   q\"\nusing assms\nby (cases x) auto\n\nlemma HoareTriple_weakest_pre_list:\n  assumes \"HoareTriple p1 m1 q\"\n      and \"\\<And>h t. HoareTriple (p2 h t) (m2 h t) q\"\n  shows   \"HoareTriple (case l of [] \\<Rightarrow> p1 | h # t \\<Rightarrow> p2 h t)\n                   (case l of [] \\<Rightarrow> m1 | h # t \\<Rightarrow> m2 h t)\n                   q\"\nusing assms\nby (cases l) auto\n\nlemma HoareTriple_weakest_pre_DataType:\n  assumes \"\\<And>cap. HoareTriple (p1 cap) (m1 cap) q\"\n      and \"\\<And>v. HoareTriple (p2 v) (m2 v) q\"\n  shows   \"HoareTriple (case t of Cap cap \\<Rightarrow> p1 cap | Raw v \\<Rightarrow> p2 v) \n                   (case t of Cap cap \\<Rightarrow> m1 cap | Raw v \\<Rightarrow> m2 v) \n                   q\"\nusing assms\nby (cases t) auto\n\nlemma HoareTriple_weakest_pre_RegSet:\n  assumes \"HoareTriple p1 m1 q\"\n      and \"HoareTriple p2 m2 q\"\n      and \"HoareTriple p3 m3 q\"\n      and \"HoareTriple p4 m4 q\"\n  shows   \"HoareTriple (case x of Lo_rs \\<Rightarrow> p1\n                            | Hi_rs \\<Rightarrow> p2\n                            | CLo_rs \\<Rightarrow> p3\n                            | CHi_rs \\<Rightarrow> p4) \n                   (case x of Lo_rs \\<Rightarrow> m1\n                            | Hi_rs \\<Rightarrow> m2\n                            | CLo_rs \\<Rightarrow> m3\n                            | CHi_rs \\<Rightarrow> m4) \n                   q\"\nusing assms\nby (cases x) auto\n\nlemma HoareTriple_weakest_pre_CmpType:\n  assumes \"HoareTriple p1 m1 q\"\n      and \"HoareTriple p2 m2 q\"\n      and \"HoareTriple p3 m3 q\"\n      and \"HoareTriple p4 m4 q\"\n      and \"HoareTriple p5 m5 q\"\n      and \"HoareTriple p6 m6 q\"\n      and \"HoareTriple p7 m7 q\"\n      and \"HoareTriple p8 m8 q\"\n  shows   \"HoareTriple (case x of EQ \\<Rightarrow> p1\n                            | NE \\<Rightarrow> p2\n                            | LT \\<Rightarrow> p3\n                            | LE \\<Rightarrow> p4\n                            | LTU \\<Rightarrow> p5\n                            | LEU \\<Rightarrow> p6\n                            | EXEQ \\<Rightarrow> p7\n                            | NEXEQ \\<Rightarrow> p8) \n                   (case x of EQ \\<Rightarrow> m1\n                            | NE \\<Rightarrow> m2\n                            | LT \\<Rightarrow> m3\n                            | LE \\<Rightarrow> m4\n                            | LTU \\<Rightarrow> m5\n                            | LEU \\<Rightarrow> m6\n                            | EXEQ \\<Rightarrow> m7\n                            | NEXEQ \\<Rightarrow> m8) \n                   q\"\nusing assms\nby (cases x) auto\n\nlemmas HoareTriple_weakest_pre_cases_arity_1 =\n  HoareTriple_weakest_pre_let\n  HoareTriple_weakest_pre_prod\n\nlemmas HoareTriple_weakest_pre_cases_arity_2 =\n  HoareTriple_weakest_pre_if\n  HoareTriple_weakest_pre_option\n  HoareTriple_weakest_pre_list\n  HoareTriple_weakest_pre_DataType\n\nlemmas HoareTriple_weakest_pre_cases =\n  HoareTriple_weakest_pre_cases_arity_1\n  HoareTriple_weakest_pre_cases_arity_2\n  HoareTriple_weakest_pre_RegSet\n  HoareTriple_weakest_pre_CmpType\n\nlemmas HoareTriple_weakest_pre_foreach_loop =\n  HoareTriple_weakest_pre_any[where m=\"foreach_loop (l, m)\"] for l m\n\nlemmas HoareTriple_weakest_pre_foreach_loop_agg =\n  HoareTriple_weakest_pre_any[where m=\"foreach_loop_agg l v m\"] for l v m\n\nlemma HoareTriple_splitValueAndStatePart:\n  assumes \"\\<And>a. HoareTriple (p a) m (\\<lambda>_. q a)\"\n  shows \"HoareTriple (bind (read_state (ValuePart m)) p) m q\"\nusing assms\nunfolding HoareTriple_def\nby (auto simp: ValuePart_bind)\n\nlemmas HoareTriple_splitValueAndStatePart_foreach_loop_agg =\n  HoareTriple_splitValueAndStatePart[where m=\"foreach_loop_agg l v m\"] for l v m\n\nlemma HoareTriple_weakest_pre_conj:\n  assumes \"HoareTriple p\\<^sub>1 m q\\<^sub>1\"\n      and \"HoareTriple p\\<^sub>2 m q\\<^sub>2\"\n  shows \"HoareTriple (p\\<^sub>1 \\<and>\\<^sub>b p\\<^sub>2) m (\\<lambda>a. (q\\<^sub>1 a) \\<and>\\<^sub>b (q\\<^sub>2 a))\"\nusing assms\nunfolding HoareTriple_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma HoareTriple_weakest_pre_disj:\n  assumes \"HoareTriple p\\<^sub>1 m q\\<^sub>1\"\n      and \"HoareTriple p\\<^sub>2 m q\\<^sub>2\"\n  shows \"HoareTriple (p\\<^sub>1 \\<or>\\<^sub>b p\\<^sub>2) m (\\<lambda>a. (q\\<^sub>1 a) \\<or>\\<^sub>b (q\\<^sub>2 a))\"\nusing assms\nunfolding HoareTriple_def\nby (simp add: ValueAndStatePart_simp)\n\ntext \\<open>Negation and equality does not decompose in their parts. To compute the weakest precondition\nwe just unfold those definitions.\\<close>\n\nlemma HoareTriple_weakest_pre_not:\n  assumes \"q' = (\\<lambda>a. bind (read_state (ValuePart (q a))) \n                          (\\<lambda>x. return (\\<not> x)))\"\n      and \"HoareTriple p m q'\"\n  shows \"HoareTriple p m (\\<lambda>a. \\<not>\\<^sub>b (q a))\"\nusing assms\nunfolding NotMonadic_def UnaryLift_def\nby simp\n\nlemma HoareTriple_weakest_pre_equals:\n  assumes \"q' = (\\<lambda>a. bind (read_state (ValuePart (q\\<^sub>1 a))) \n                          (\\<lambda>x. bind (read_state (ValuePart (q\\<^sub>2 a))) \n                          (\\<lambda>x'. return (x = x'))))\"\n      and \"HoareTriple p m q'\"\n  shows \"HoareTriple p m (\\<lambda>a. (q\\<^sub>1 a) =\\<^sub>b (q\\<^sub>2 a))\"\nusing assms\nunfolding EqMonadic_def BinaryLift_def\nby simp\n\nlemma HoareTripleE_read_states [elim]:\n  assumes \"HoareTriple (read_state f) m (\\<lambda>a. read_state (g a))\"\n      and \"f s\"\n  shows \"g (ValuePart m s) (StatePart m s)\"\nusing assms\nunfolding HoareTriple_def\nby (simp add: ValuePart_bind)\n\nsubsection \\<open>Invariants\\<close>\n\nabbreviation \"IsInvariant p f \\<equiv> HoareTriple p f (\\<lambda>_. p)\"\n\nlemma IsInvariant_def:\n  shows \"IsInvariant p f = (\\<forall>s. ValuePart p s \\<longrightarrow> ValuePart (bind f (\\<lambda>_. p)) s)\"\nunfolding HoareTriple_def ..\n\nlemma IsInvariant_constant [intro!, simp]:\n  shows \"IsInvariant (return x) m\"\nunfolding IsInvariant_def\nby simp\n\nlemma IsInvariant_return [intro!, simp]:\n  shows \"IsInvariant p (return x)\"\nunfolding IsInvariant_def\nby simp\n\nlemma IsInvariant_read_state [intro!, simp]:\n  shows \"IsInvariant p (read_state f)\"\nunfolding IsInvariant_def\nby simp\n\nlemma IsInvariant_bind [intro]:\n  assumes \"IsInvariant p m\"\n      and \"\\<And>a. IsInvariant p (n a)\"\n  shows \"IsInvariant p (bind m n)\"\nusing assms\nunfolding IsInvariant_def\nby (simp add: ValueAndStatePart_simp)\n\nlemma IsInvariant_foreach_loop [intro]:\n  assumes \"\\<And>a. IsInvariant p (m a)\"\n  shows \"IsInvariant p (foreach_loop (l, m))\"\nusing assms\nby (induct l) auto\n\nlemma IsInvariant_foreach_loop_agg [intro]:\n  assumes \"\\<And>a b. IsInvariant p (m a b)\"\n  shows \"IsInvariant p (foreach_loop_agg l b m)\"\nusing assms\nby (induct l arbitrary: b) auto\n\nlemmas IsInvariant_cases [intro] =\n  all_split[where P=\"IsInvariant p\", THEN iffD2] for p\n\nlemma IsInvariant_update_state_StatePart [simp]:\n  shows \"IsInvariant p (update_state (StatePart m)) = IsInvariant p m\"\nunfolding IsInvariant_def\nby (simp add: ValueAndStatePart_simp)\n\nlemmas IsInvariant_update_state_StatePartE =\n  IsInvariant_update_state_StatePart[THEN iffD2]\n\nlemma IsInvariant_Commute [elim!]:\n  assumes \"Commute p m\"\n  shows \"IsInvariant p m\"\nusing assms\nunfolding Commute_def IsInvariant_def\nby (simp add: ValuePart_bind)\n\nlemmas IsInvariant_Commute_swapped [elim!] = \n  IsInvariant_Commute[OF Commute_is_symmetric[THEN iffD1]]\n\nlemmas IsInvariant_conj = \n  HoareTriple_weakest_pre_conj[where p\\<^sub>1=p and q\\<^sub>1=\"\\<lambda>_. p\" and p\\<^sub>2=q and q\\<^sub>2=\"\\<lambda>_. q\"] for p q\n\nlemmas IsInvariant_disj = \n  HoareTriple_weakest_pre_disj[where p\\<^sub>1=p and q\\<^sub>1=\"\\<lambda>_. p\" and p\\<^sub>2=q and q\\<^sub>2=\"\\<lambda>_. q\"] for p q\n\nmethod Invariant uses intro =\n  assumption |\n  (rule intro \n        IsInvariant_return\n        IsInvariant_read_state\n        IsInvariant_update_state_StatePartE\n        IsInvariant_bind\n        IsInvariant_foreach_loop\n        IsInvariant_foreach_loop_agg\n        IsInvariant_cases\n        IsInvariant_conj\n        IsInvariant_disj;\n      (intro allI conjI impI)?;\n      Invariant intro: intro) |\n  (rule IsInvariant_Commute,\n      solves \\<open>Commute intro: intro\\<close>)\n\nsubsubsection \\<open>Tests\\<close>\n\ntext \\<open>The purpose of the lemmas below is testing the proof method.\\<close>\n\nlemma \"IsInvariant (read_state getCP0StatusEXL) (return cap)\"\nby Invariant\n\nlemma \"IsInvariant (read_state getCP0StatusEXL) (read_state getPC)\"\nby Invariant\n\nlemma \"IsInvariant (read_state getCP0StatusEXL) (write'CAPR x)\"\nby Invariant\n\nlemma \"IsInvariant (read_state getCP0StatusEXL) (update_state (StatePart (write'CAPR x)))\"\nby Invariant\n\nlemma \"IsInvariant (read_state getCP0StatusEXL) (bind PCC (\\<lambda>cap. write'CAPR (cap, cd)))\"\nby Invariant\n\nlemma \"IsInvariant (read_state getCP0StatusEXL) (foreach_loop (l, \\<lambda>cd. write'CAPR (nullCap, cd)))\"\nby Invariant\n\nlemma \"IsInvariant (read_state getCP0StatusEXL) (if b then write'CAPR x else write'CAPR y)\"\nby Invariant\n\nsubsection \\<open>Strengthening prefixes\\<close>\n\ndefinition StrengthenedPrefix where\n  \"StrengthenedPrefix p q m \\<equiv>\n   \\<forall>s. ValuePart (bind q m) s \\<longrightarrow> ValuePart (bind p m) s\"\n\nlemma StrengthenedPrefix_same_prefix:\n  shows \"StrengthenedPrefix p p m\"\nunfolding StrengthenedPrefix_def \nby simp\n\ntext \\<open>Introducing \\<open>m'\\<close> in the lemma below might seem redundant, but it allows the proof method to\nsimplify \\<open>m'\\<close> before using it. This speeds up the proof method considerably. \\<close>\n\nlemma StrengthenedPrefix_bindI:\n  assumes \"\\<And>a. StrengthenedPrefix (p' a) (q' a) m\"\n      and \"m' = (\\<lambda>a. bind (q' a) m)\"\n      and \"StrengthenedPrefix p q m'\"\n  shows \"StrengthenedPrefix (bind p p') (bind q q') m\"\nusing assms\nunfolding StrengthenedPrefix_def ValuePart_def\nunfolding monad_def Let_def\nby auto\n\nlemma StrengthenedPrefix_ifI:\n  assumes \"StrengthenedPrefix p\\<^sub>1 q\\<^sub>1 m\"\n      and \"StrengthenedPrefix p\\<^sub>2 q\\<^sub>2 m\"\n  shows   \"StrengthenedPrefix (if b then p\\<^sub>1 else p\\<^sub>2) \n                              (if b then q\\<^sub>1 else q\\<^sub>2) \n                              m\"\nusing assms\nby auto\n\nlemma StrengthenedPrefix_letI:\n  assumes \"\\<And>y. StrengthenedPrefix (p y) (q y) m\"\n  shows   \"StrengthenedPrefix (let x = y in p x) \n                              (let x = y in q x) \n                              m\"\nusing assms\nby auto\n\nlemma StrengthenedPrefix_prodI:\n  assumes \"\\<And>y z. StrengthenedPrefix (p y z) (q y z) m\"\n  shows   \"StrengthenedPrefix (case x of (y, z) \\<Rightarrow> p y z) \n                              (case x of (y, z) \\<Rightarrow> q y z) \n                              m\"\nusing assms\nby (cases x) simp\n\nlemma StrengthenedPrefix_optionI:\n  assumes \"StrengthenedPrefix p\\<^sub>1 q\\<^sub>1 m\"\n      and \"\\<And>y. StrengthenedPrefix (p\\<^sub>2 y) (q\\<^sub>2 y) m\"\n  shows   \"StrengthenedPrefix (case x of None \\<Rightarrow> p\\<^sub>1 | Some y \\<Rightarrow> p\\<^sub>2 y)\n                              (case x of None \\<Rightarrow> q\\<^sub>1 | Some y \\<Rightarrow> q\\<^sub>2 y)\n                              m\"\nusing assms\nby (cases x) auto\n\nlemma StrengthenedPrefix_listI:\n  assumes \"StrengthenedPrefix p\\<^sub>1 q\\<^sub>1 m\"\n      and \"\\<And>h t. StrengthenedPrefix (p\\<^sub>2 h t) (q\\<^sub>2 h t) m\"\n  shows   \"StrengthenedPrefix (case l of [] \\<Rightarrow> p\\<^sub>1 | h # t \\<Rightarrow> p\\<^sub>2 h t)\n                              (case l of [] \\<Rightarrow> q\\<^sub>1 | h # t \\<Rightarrow> q\\<^sub>2 h t)\n                              m\"\nusing assms\nby (cases l) auto\n\nlemma StrengthenedPrefix_DataTypeI:\n  assumes \"\\<And>cap. StrengthenedPrefix (p\\<^sub>1 cap) (q\\<^sub>1 cap) m\"\n      and \"\\<And>v. StrengthenedPrefix (p\\<^sub>2 v) (q\\<^sub>2 v) m\"\n  shows   \"StrengthenedPrefix (case t of Cap cap \\<Rightarrow> p\\<^sub>1 cap | Raw v \\<Rightarrow> p\\<^sub>2 v) \n                              (case t of Cap cap \\<Rightarrow> q\\<^sub>1 cap | Raw v \\<Rightarrow> q\\<^sub>2 v) \n                              m\"\nusing assms\nby (cases t) auto\n\nlemmas StrengthenedPrefix_casesI =\n  StrengthenedPrefix_ifI\n  StrengthenedPrefix_letI\n  StrengthenedPrefix_prodI\n  StrengthenedPrefix_optionI\n  StrengthenedPrefix_listI\n  StrengthenedPrefix_DataTypeI\n\nlemma StrengthenedPrefix_IsInvariant:\n  assumes \"\\<And>a. IsInvariant (m a) (update_state (StatePart p))\"\n  shows \"StrengthenedPrefix p (read_state (ValuePart p)) m\"\nusing assms\nunfolding StrengthenedPrefix_def\nunfolding IsInvariant_def ValuePart_def StatePart_def\nunfolding monad_def Let_def\nby simp\n\nlemma StrengthenedPrefix_IsInvariant_no_ValuePart:\n  assumes \"\\<And>a. m a = m undefined\"\n      and \"\\<And>a. IsInvariant (m a) (update_state (StatePart p))\"\n  shows \"StrengthenedPrefix p (return undefined) m\"\nunfolding StrengthenedPrefix_def\nproof clarsimp\n  fix s\n  assume \"ValuePart (m undefined) s\"\n  thus \"ValuePart (bind p m) s\"\n    using assms(1)[of \"ValuePart p s\"]\n    using assms(2)\n    unfolding IsInvariant_def ValuePart_def StatePart_def\n    unfolding monad_def Let_def\n    by simp\nqed\n\nlemma StrengthenedPrefix_IsInvariant_update_state:\n  assumes \"IsInvariant (m ()) (update_state f)\"\n  shows \"StrengthenedPrefix (update_state f) (return undefined) m\"\nusing assms\nby - (rule StrengthenedPrefix_IsInvariant_no_ValuePart, simp_all) \n\ntext \\<open>The rule \\<open>StrengthenedPrefix_bindI\\<close> doesn't play nicely with structural composition ``;'' (the\nreason is the combination of instantiating schematic variables and sub-goal scoping). Therefore we\nuse repeated sequential composition ``,'' in the method below.\\<close>\n\nmethod StrengthenPrefix uses intro = \n  assumption | \n  (rule StrengthenedPrefix_bindI, \n      StrengthenPrefix intro: intro, \n      solves \\<open>strong_cong_simp\\<close>,\n      StrengthenPrefix intro: intro) |\n  (rule StrengthenedPrefix_casesI; \n      StrengthenPrefix intro: intro) |\n  (rule StrengthenedPrefix_IsInvariant_no_ValuePart, \n      solves \\<open>simp\\<close>, \n      solves \\<open>Invariant intro: intro\\<close>) |\n  (rule StrengthenedPrefix_IsInvariant, \n      solves \\<open>Invariant intro: intro\\<close>) |\n  (rule StrengthenedPrefix_same_prefix)\n\nsubsubsection \\<open>Tests\\<close>\n\ntext \\<open>The purpose of the lemmas below is testing the proof method.\\<close>\n\nlemma\n  \"StrengthenedPrefix (write'CAPR x) \n                      (write'CAPR x) \n                      (\\<lambda>_. bind (CAPR cd) (\\<lambda>a. return (a = cap)))\"\nby StrengthenPrefix\n\nlemma\n  \"StrengthenedPrefix (update_state (setPC x))\n                      (return undefined) \n                      (\\<lambda>_. bind (CAPR cd) (\\<lambda>a. return (a = cap)))\"\nby StrengthenPrefix\n\nlemma\n  \"StrengthenedPrefix (bind (write'CAPR x) (\\<lambda>_. update_state (setPC y))) \n                      (bind (write'CAPR x) (\\<lambda>a. return undefined)) \n                      (\\<lambda>_. bind (CAPR cd) (\\<lambda>a. return (a = cap)))\"\nby StrengthenPrefix\n\nlemma\n  \"StrengthenedPrefix (if b then (write'CAPR x) else update_state (setPC y)) \n                      (if b then (write'CAPR x) else return undefined) \n                      (\\<lambda>_. bind (CAPR cd) (\\<lambda>a. return (a = cap)))\"\nby StrengthenPrefix\n\nlemma\n  assumes \"IsInvariant m p\"\n  shows \"StrengthenedPrefix p (return undefined) (\\<lambda>_. m)\"\nusing assms\nby - StrengthenPrefix\n\nlemma\n  assumes \"\\<And>a. IsInvariant m (p a)\"\n  shows \"StrengthenedPrefix (foreach_loop (l, p))\n                            (return undefined) \n                            (\\<lambda>_. m)\"\nusing assms\nby - StrengthenPrefix\n\nsubsection \\<open>Proving Hoare triples\\<close>\n\ntext \\<open>Introducing \\<open>q'_simp\\<close> in the lemma below might seem redundant, but it allows the proof method\nto simplify \\<open>q'_simp\\<close> before using it.\\<close>\n\nlemma HoareTriple_from_pushingBack:\n  assumes \"\\<And>a. SwappingGives (update_state (StatePart m)) (q a) x (q' a)\"\n      and \"q'_simp = (bind (read_state (ValuePart m)) q')\"\n  shows \"HoareTriple q'_simp m q\"\nunfolding HoareTriple_def assms(2)\nproof (intro allI impI)\n  fix s\n  assume *: \"ValuePart (bind (read_state (ValuePart m)) q') s\"\n  have \"ValuePart (bind m q) s = \n        ValuePart (bind (read_state (ValuePart m)) \n                        (\\<lambda>a. bind (update_state (StatePart m))\n                        (\\<lambda>_. q a)))\n                  s\"\n    by (simp add: ValuePart_bind StatePart_bind)\n  also have \"... = ValuePart (bind (read_state (ValuePart m)) q') s\"\n    using assms\n    unfolding SwappingGives_def\n    by (simp add: ValuePart_bind StatePart_bind)\n  finally show \"ValuePart (bind m q) s\"\n    using * by simp\nqed\n\nlemma HoareTriple_update_state_from_pushingBack:\n  assumes \"SwappingGives (update_state f) q x q'\"\n  shows \"HoareTriple q' (update_state f) (\\<lambda>_. q)\"\nusing assms\nunfolding SwappingGives_def HoareTriple_def\nby (simp add: ValuePart_bind StatePart_bind)\n\nlemma HoareTriple_from_StrengthenedPrefix:\n  assumes \"StrengthenedPrefix m m' q\"\n  shows \"HoareTriple (bind m' q) m q\"\nusing assms\nunfolding StrengthenedPrefix_def HoareTriple_def .\n\nlemmas HoareTriple_from_StrengthenedPrefix_cases_arity_2 =\n  HoareTriple_from_StrengthenedPrefix[where m=\"If _ _ _\"]\n  HoareTriple_from_StrengthenedPrefix[where m=\"case_option _ _ _\"]\n  HoareTriple_from_StrengthenedPrefix[where m=\"case_list _ _ _\"]\n  HoareTriple_from_StrengthenedPrefix[where m=\"case_DataType _ _ _\"]\n\nlemmas HoareTriple_casesI = \n  all_split[where P=\"\\<lambda>x. HoareTriple p x q\", THEN iffD2] for p q\n\nmethod HoareTriple_cases =\n  rule HoareTriple_casesI; \n  (intro conjI impI allI)?;\n  HoareTriple_cases?\n     \nmethod ParametricHoareTriple methods f uses simp =\n  HoareTriple_cases?;\n  rule HoareTriple_pre_strengthening,\n  f, \n  strong_cong_simp_all add: ValueAndStatePart_simp simp\n\nmethod ComputePreAuto uses simp =\n  auto simp: ValueAndStatePart_simp simp \n       cong del: weak_cong cong: cong\n       split: option.splits\n\nmethod ComputePre methods compositeI atomI uses intro simp = \n\n  -- \\<open>If the post condition is @{term \"return True\"} then we use the following rule.\\<close>\n  (rule IsInvariant_constant[where x=True]) |\n\n  -- \\<open>We try the supplied method for composites (@{const bind}, cases, loops and the empty\n      composite @{const return}).\\<close>\n  solves \\<open>compositeI\\<close> |\n  -- \\<open>If that did not work, we handle composites in a general way.\\<close>\n  (rule HoareTriple_weakest_pre_return) |\n  (rule HoareTriple_weakest_pre_bind,\n      ComputePre compositeI atomI intro: intro simp: simp,\n      solves \\<open>strong_cong_simp add: simp\\<close>,\n      ComputePre compositeI atomI intro: intro simp: simp) |\n  (rule HoareTriple_weakest_pre_cases;\n      ComputePre compositeI atomI intro: intro simp: simp) |\n  -- \\<open>If the loop is IsInvariant under the post condition we can remove the loop.\\<close>\n  (rule IsInvariant_foreach_loop,\n      ParametricHoareTriple \\<open>ComputePre compositeI atomI intro: intro simp: simp\\<close> simp: simp;\n      solves \\<open>ComputePreAuto simp: simp\\<close>) |\n  (rule HoareTriple_splitValueAndStatePart_foreach_loop_agg,\n      rule IsInvariant_foreach_loop_agg,\n      ParametricHoareTriple \\<open>ComputePre compositeI atomI intro: intro simp: simp\\<close> simp: simp;\n      solves \\<open>ComputePreAuto simp: simp\\<close>) |\n  -- \\<open>Otherwise, we append the loop to the precondition.\\<close>\n  (rule HoareTriple_weakest_pre_foreach_loop\n        HoareTriple_weakest_pre_foreach_loop_agg) |\n\n  -- \\<open>Then we try the supplied method for atoms (@{const read_state}, @{const update_state} and\n      CHERI functions).\\<close>\n  solves \\<open>atomI\\<close> |\n  -- \\<open>We decompose the monadic connectives.\\<close>\n  (rule HoareTriple_weakest_pre_conj HoareTriple_weakest_pre_disj;\n      ComputePre compositeI atomI intro: intro simp: simp) |\n  (rule HoareTriple_weakest_pre_not HoareTriple_weakest_pre_equals,\n      solves \\<open>strong_cong_simp add: simp\\<close>,\n      ComputePre compositeI atomI intro: intro simp: simp) |\n  -- \\<open>If that did not work, we handle atoms in a general way.\\<close>\n  (rule HoareTriple_weakest_pre_read_state) |\n  (rule HoareTriple_update_state_from_pushingBack,\n      solves \\<open>PushBackwards intro: intro simp: simp\\<close>) | \n  (rule HoareTriple_from_pushingBack,\n      solves \\<open>PushBackwards intro: intro simp: simp\\<close>,\n      solves \\<open>strong_cong_simp add: simp\\<close>)\n\ntext \\<open>The following method corresponds to @\\<open>method ComputePre\\<close> without any recursive calls. The\npurpose is to step through the method when debugging.\\<close>\n\nmethod ComputePre_debug_step methods compositeI atomI uses intro simp = \n  (rule IsInvariant_constant[where x=True]) |\n  solves \\<open>compositeI\\<close> |\n  (rule HoareTriple_weakest_pre_return) |\n  (rule HoareTriple_weakest_pre_bind) |\n  (rule HoareTriple_weakest_pre_cases) |\n  (rule IsInvariant_foreach_loop,\n      ParametricHoareTriple \\<open>ComputePre compositeI atomI intro: intro simp: simp\\<close> simp: simp;\n      solves \\<open>ComputePreAuto simp: simp\\<close>) |\n  (rule HoareTriple_splitValueAndStatePart_foreach_loop_agg,\n      rule IsInvariant_foreach_loop_agg,\n      ParametricHoareTriple \\<open>ComputePre compositeI atomI intro: intro simp: simp\\<close> simp: simp;\n      solves \\<open>ComputePreAuto simp: simp\\<close>) |\n  solves \\<open>atomI\\<close> |\n  (rule HoareTriple_weakest_pre_conj HoareTriple_weakest_pre_disj) |\n  (rule HoareTriple_weakest_pre_not HoareTriple_weakest_pre_equals) |\n  (rule HoareTriple_weakest_pre_read_state) |\n  (rule HoareTriple_update_state_from_pushingBack,\n      solves \\<open>PushBackwards intro: intro\\<close>) | \n  (rule HoareTriple_from_pushingBack,\n      solves \\<open>PushBackwards intro: intro\\<close>,\n      solves \\<open>strong_cong_simp add: simp\\<close>) | \n  solves \\<open>strong_cong_simp add: simp\\<close>\n\nmethod ComputePreDefault uses intro simp =\n  ComputePre \\<open>rule TrueI intro;\n              solves \\<open>ComputePreAuto simp: simp\\<close>\\<close> \n             fail \n             intro: intro simp: simp\n\nmethod ComputePreDefault_debug_step uses intro simp =\n  ComputePre_debug_step \\<open>rule TrueI intro;\n                         solves \\<open>ComputePreAuto simp: simp\\<close>\\<close> \n                        fail \n                        intro: intro simp: simp\n\nmethod ComputePreNoExplosion methods compositeI atomI uses intro simp =\n  ComputePre \\<open>compositeI |\n              (rule HoareTriple_weakest_pre_cases_arity_1, \n                  ComputePreNoExplosion compositeI atomI intro: intro simp: simp) |\n              (rule HoareTriple_from_StrengthenedPrefix_cases_arity_2,\n                  solves \\<open>StrengthenPrefix\\<close>)\\<close> \n              atomI\n              intro: intro simp: simp\n\nmethod ComputePreNoExplosionDefault uses intro simp =\n  ComputePreNoExplosion \\<open>rule TrueI intro;\n                          solves \\<open>ComputePreAuto simp: simp\\<close>\\<close> \n                         fail \n                         intro: intro simp: simp\n\nmethod HoareTriple uses intro simp = \n  ParametricHoareTriple \\<open>ComputePreDefault intro: intro simp: simp\\<close> simp: simp\n\nmethod HoareTripleNoExplosion uses intro simp =\n  ParametricHoareTriple \\<open>ComputePreNoExplosionDefault intro: intro simp: simp\\<close> simp: simp\n\nsubsubsection \\<open>Tests\\<close>\n\ntext \\<open>The purpose of the lemmas below is testing the proof method.\\<close>\n\nlemma \"HoareTriple (return True)\n               (bind (write'CAPR (cap, cd)) (\\<lambda>_. write'PCC y)) \n               (\\<lambda>_. bind (CAPR cd) (\\<lambda>a. return (a = (if cd = 0 then nullCap else cap))))\"\nproof -\n  have [simp]: \"bind (update_state (StatePart (write'CAPR (cap, cd)))) \n                     (\\<lambda>_. CAPR cd) =\n                bind (update_state (StatePart (write'CAPR (cap, cd)))) \n                     (\\<lambda>_. return (if cd = 0 then nullCap else cap))\" for cap cd\n    unfolding write'CAPR_alt_def CAPR_alt_def StatePart_def\n    unfolding monad_def Let_def\n    by simp\n  show ?thesis\n    by HoareTriple\nqed\n\nlemma \"IsInvariant (bind (CAPR cd) (\\<lambda>a. return (a = cap))) (write'PCC x)\"\nby HoareTriple\n\nlemma \"IsInvariant (bind (read_state getPC) (\\<lambda>a. return (a = pc))) (write'PCC x)\"\nby HoareTriple\n\nlemma \"IsInvariant (bind (CAPR cd) (\\<lambda>a. return (a = cap)) \\<and>\\<^sub>b\n                  bind (read_state getPC) (\\<lambda>a. return (a = pc))) \n                 (write'PCC x)\"\nby HoareTriple\n\nlemma \n  assumes \"\\<And>a. IsInvariant p (m a)\"\n  shows \"IsInvariant p (foreach_loop (l, m))\"\nby (HoareTriple intro: assms)\n\nlemma \"HoareTriple (bind (CAPR cd) (\\<lambda>a. return (a = cap))) \n               (write'PCC x)\n               (\\<lambda>_. return True)\"\nby HoareTriple \n\nlemma \"HoareTriple (return False) \n               (write'PCC x)\n               (\\<lambda>_. bind (CAPR cd) (\\<lambda>a. return (a = cap))) \"\nby HoareTriple \n\n(*<*)\nend\n(*>*)", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/core/CheriProofMethods.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.6039318337259584, "lm_q1q2_score": 0.3371914455076655}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(*\n * This file introduces an experimental \"distinct\" command that takes\n * a list of 'n' terms, and generates O(n^2) lemmas for you to prove\n * that the 'n' terms are all distinct. These proofs can typically be\n * carried out by an \"apply auto\" command, giving you O(n^2)\n * distinctness theorems relatively easily. These new theorems can then\n * be thrown into a simpset to avoid having to constantly unfold\n * definitions merely to prove distinctness.\n *\n * This may significantly simplify certain proofs where inequality of\n * defined terms is frequently relied upon.\n *\n * The \"distinct\" command is not really scalable, due to its O(n^2)\n * proof terms generated. If we wanted to use this in a larger example,\n * we would probably want a \"ordered\" command, which forces you to show\n * that 'n' terms have some ordering, and then automatically derive the\n * O(n^2) possible proof terms on-the-fly in a simproc (possibly using\n * Isabelle's existing \"order_tac\").\n *)\ntheory Distinct_Cmd\nimports Main\n  keywords \"distinct\" :: thy_goal\nbegin\n\nML \\<open>\nlocal\n\n(*\n * Process a parsed binding, converting it from raw tokens (which\n * can't be passed into Local_Theory.note) into its semantic meaning\n * (which can).\n *)\nfun process_binding lthy binding =\n  apsnd (map (Attrib.check_src lthy)) binding\n\n(* Parse the parameters to \"distinct\". *)\nval distinct_parser =\n  (Scan.optional (Parse_Spec.opt_thm_name \":\") Binding.empty_atts\n         -- Scan.repeat1 Parse.term)\n\n(* Generate a prop of the form \"a ~= b\". *)\nfun mk_inequality_pair a b =\n  HOLogic.mk_eq (a, b)\n  |> HOLogic.mk_not\n  |> HOLogic.mk_Trueprop\n\n(* Generate O(n^2) distinctness goals. *)\nfun gen_distinct_goals terms =\n  map_product\n    (fn a => fn b =>\n        if a = b then NONE\n        else SOME (mk_inequality_pair a b))\n    terms terms\n  |> map_filter I\n  |> map (fn t => (t, []))\n\n(* Given a list of terms, coerce them all into the same type. *)\nfun coerce_terms_to_same_type lthy terms =\n  HOLogic.mk_list dummyT terms\n  |> Syntax.check_term lthy\n  |> HOLogic.dest_list\n\n(* We save the theorems to the context afterwards. *)\nfun after_qed thm_name thms lthy =\n  Local_Theory.note (thm_name, (flat thms)) lthy |> snd\n\nin\n\nval _ =\n   Outer_Syntax.local_theory_to_proof @{command_keyword \"distinct\"}\n      \"prove distinctness of a list of terms\"\n      (distinct_parser\n        >> (fn (thm_name, terms) => fn lthy =>\n              Proof.theorem NONE (after_qed (process_binding lthy thm_name)) [\n                  map (Syntax.parse_term lthy) terms\n                  |> coerce_terms_to_same_type lthy\n                  |> gen_distinct_goals\n              ] lthy\n            ))\n\nend\n\\<close>\n\n(* Test. *)\ncontext\n  fixes A :: nat\n  fixes B :: nat\n  fixes C :: nat\n  assumes x: \"A = 1 \\<and> B = 2 \\<and> C = 3\"\nbegin\n\ndistinct A B C \"5\" \"6\" \"2 + 11\"\n  by (auto simp: x)\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Distinct_Cmd.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.33719144550766544}}
{"text": "(*  Author:  Tobias Nipkow  *)\n\nheader \"Comparing Enumeration and Archive\"\n\ntheory ArchComp\nimports ArchCompProps \"~~/src/HOL/Library/Code_Target_Numeral\"\nbegin\n\nmethod_setup cond_eval = {*\n  let\n    fun eval_tac ctxt =\n      let val conv = Code_Runtime.dynamic_holds_conv ctxt\n      in CONVERSION (Conv.params_conv ~1 (K (Conv.concl_conv ~1 conv)) ctxt) THEN' rtac TrueI end\n  in\n    Scan.succeed (fn ctxt =>\n      SIMPLE_METHOD'\n       (if getenv \"ISABELLE_FULL_TEST\" = \"true\" then eval_tac ctxt\n        else Skip_Proof.cheat_tac))\n  end\n*} \"solve goal by evaluation if ISABELLE_FULL_TEST=true)\"\n\n\nsubsection {* Proofs by evaluation using generated code *}\n\nlemma pre_iso_test3: \"\\<forall>g \\<in> set Tri. pre_iso_test g\"\nby eval\n\nlemma pre_iso_test4: \"\\<forall>g \\<in> set Quad. pre_iso_test g\"\nby eval\n\nlemma pre_iso_test5: \"\\<forall>g \\<in> set Pent. pre_iso_test g\"\nby eval\n\nlemma pre_iso_test6: \"\\<forall>g \\<in> set Hex. pre_iso_test g\"\nby eval\n\nlemma same3: \"samet (tameEnumFilter 0) Tri\"\nby eval\n\nlemma same4: \"samet (tameEnumFilter 1) Quad\"\nby cond_eval\n\nlemma same5: \"samet (tameEnumFilter 2) Pent\"\nby cond_eval\n\nlemma same6: \"samet (tameEnumFilter 3) Hex\"\nby cond_eval\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Flyspeck-Tame/ArchComp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.6039318337259583, "lm_q1q2_score": 0.33719144550766544}}
{"text": "theory Sorting_Ex_Array_Idxs\nimports Sorting_Introsort\nbegin\n\nsubsection \\<open>Compare Indexes into Value Array\\<close>\n\ndefinition idx_less :: \"'a::linorder list \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool\" where \"idx_less vs i j \\<equiv> vs!i < vs!j\"\ndefinition idx_cdom :: \"'a::linorder list \\<Rightarrow> nat set\" where \"idx_cdom vs \\<equiv> {0..<length vs}\"\n\ndefinition \"idx_pcmp vs i j \\<equiv> do {\n  ASSERT (i<length vs \\<and> j<length vs);\n  RETURN (vs!i < vs!j)\n}\"\n\nsepref_def idx_pcmp_impl is \"uncurry2 idx_pcmp\" :: \n  \"(al_assn snat_assn)\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  unfolding idx_pcmp_def\n  by sepref\n  \n\ninterpretation IDXO: weak_ordering_on_lt \"idx_cdom vs\" \"idx_less vs\"\n  apply unfold_locales\n  unfolding idx_less_def by auto\n\ninterpretation IDXO: parameterized_weak_ordering idx_cdom idx_less idx_pcmp\n  apply unfold_locales\n  unfolding idx_pcmp_def\n  apply refine_vcg\n  apply (auto simp: idx_less_def idx_cdom_def)\n  done\n\n  \nlemma \"random_access_iterator (woarray_assn snat_assn) (eoarray_assn snat_assn) snat_assn \n  return return\n  eo_extract_impl\n  array_upd\"  \n  apply unfold_locales\n  apply (rule eo_hnr_dep)+\n  done\n  \n  \n  \nlocale pure_eo_adapter =\n  fixes elem_assn :: \"'a \\<Rightarrow> 'ai::llvm_rep \\<Rightarrow> assn\"  \n    and wo_assn :: \"'a list \\<Rightarrow> 'oi::llvm_rep \\<Rightarrow> assn\"\n    and wo_get_impl :: \"'oi \\<Rightarrow> 'size::len2 word \\<Rightarrow> 'ai llM\"\n    and wo_set_impl :: \"'oi \\<Rightarrow> 'size::len2 word \\<Rightarrow> 'ai \\<Rightarrow> 'oi llM\"\n  assumes pure[safe_constraint_rules]: \"is_pure elem_assn\" \n      and get_hnr: \"(uncurry wo_get_impl,uncurry mop_list_get) \\<in> wo_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow>\\<^sub>a elem_assn\"\n      and set_hnr: \"(uncurry2 wo_set_impl,uncurry2 mop_list_set) \\<in> wo_assn\\<^sup>d *\\<^sub>a snat_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>k \\<rightarrow>\\<^sub>a\\<^sub>d (\\<lambda>_ ((ai,_),_). cnc_assn (\\<lambda>x. x=ai) wo_assn)\"\nbegin      \n  \n  lemmas [sepref_fr_rules] = get_hnr set_hnr\n\n\n  definition \"only_some_rel \\<equiv> {(a, Some a) | a. True} \\<union> {(x, None) | x. True}\"\n\n  definition \"eo_assn \\<equiv> hr_comp wo_assn (\\<langle>only_some_rel\\<rangle>list_rel)\"\n  \n  definition \"eo_extract1 p i \\<equiv> doN { r \\<leftarrow> mop_list_get p i; RETURN (r,p) }\"\n  sepref_definition eo_extract_impl is \"uncurry eo_extract1\" \n    :: \"wo_assn\\<^sup>d *\\<^sub>a (snat_assn' TYPE('size))\\<^sup>k \\<rightarrow>\\<^sub>a elem_assn \\<times>\\<^sub>a wo_assn\"\n    unfolding eo_extract1_def\n    by sepref\n     \n  lemma mop_eo_extract_aux: \"mop_eo_extract p i = doN { r \\<leftarrow> mop_list_get p i; ASSERT (r\\<noteq>None \\<and> i<length p); RETURN (the r, p[i:=None]) }\"  \n    by (auto simp: pw_eq_iff refine_pw_simps)\n\n  lemma assign_none_only_some_list_rel:\n    assumes SR[param]: \"(a, a') \\<in> \\<langle>only_some_rel\\<rangle>list_rel\" and L: \"i < length a'\"\n      shows \"(a, a'[i := None]) \\<in> \\<langle>only_some_rel\\<rangle>list_rel\"\n  proof -\n    have \"(a[i := a!i], a'[i := None]) \\<in> \\<langle>only_some_rel\\<rangle>list_rel\"\n      apply (parametricity)\n      by (auto simp: only_some_rel_def)\n    also from L list_rel_imp_same_length[OF SR] have \"a[i := a!i] = a\" by auto\n    finally show ?thesis .  \n  qed     \n        \n    \n  lemma eo_extract1_refine: \"(eo_extract1, mop_eo_extract) \\<in> \\<langle>only_some_rel\\<rangle>list_rel \\<rightarrow> nat_rel \\<rightarrow> \\<langle>Id \\<times>\\<^sub>r \\<langle>only_some_rel\\<rangle>list_rel\\<rangle>nres_rel\"\n    unfolding eo_extract1_def mop_eo_extract_aux\n    supply R = mop_list_get.fref[THEN frefD, OF TrueI prod_relI, unfolded uncurry_apply, THEN nres_relD]\n    apply (refine_rcg R)\n    apply assumption\n    apply (clarsimp simp: assign_none_only_some_list_rel)\n    by (auto simp: only_some_rel_def)\n\n  lemma eo_list_set_refine: \"(mop_list_set, mop_eo_set) \\<in> \\<langle>only_some_rel\\<rangle>list_rel \\<rightarrow> Id \\<rightarrow> Id \\<rightarrow> \\<langle>\\<langle>only_some_rel\\<rangle>list_rel\\<rangle>nres_rel\"\n    unfolding mop_list_set_alt mop_eo_set_alt \n    apply refine_rcg\n    apply (simp add: list_rel_imp_same_length)\n    apply simp\n    apply parametricity\n    apply (auto simp: only_some_rel_def)\n    done\n  \n  \n  lemma set_hnr': \"(uncurry2 wo_set_impl,uncurry2 mop_list_set) \\<in> wo_assn\\<^sup>d *\\<^sub>a snat_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>k \\<rightarrow>\\<^sub>a wo_assn\"\n    apply (rule hfref_cons[OF set_hnr])\n    apply (auto simp: cnc_assn_def entails_lift_extract_simps sep_algebra_simps)\n    done\n  \n    \n    \n  context\n    notes [fcomp_norm_unfold] = eo_assn_def[symmetric]\n  begin  \n    lemmas eo_extract_refine_aux = eo_extract_impl.refine[FCOMP eo_extract1_refine]  \n\n    lemma eo_extract_refine: \"(uncurry eo_extract_impl, uncurry mop_eo_extract) \\<in> eo_assn\\<^sup>d *\\<^sub>a snat_assn\\<^sup>k \n      \\<rightarrow>\\<^sub>a\\<^sub>d (\\<lambda>_ (ai,_). elem_assn \\<times>\\<^sub>a cnc_assn (\\<lambda>x. x=ai) eo_assn)\"\n      apply (sepref_to_hnr)\n      apply (rule hn_refine_nofailI)\n      unfolding cnc_assn_prod_conv\n      apply (rule hnr_ceq_assnI)  \n      subgoal \n        supply R = eo_extract_refine_aux[to_hnr, unfolded APP_def]\n        apply (rule hn_refine_cons[OF _ R])\n        apply (auto simp: sep_algebra_simps entails_lift_extract_simps hn_ctxt_def pure_def invalid_assn_def)\n        done\n      subgoal\n        unfolding eo_extract_impl_def mop_eo_extract_def hn_ctxt_def eo_assn_def hr_comp_def\n        supply R = get_hnr[to_hnr, THEN hn_refineD, unfolded APP_def hn_ctxt_def]\n        thm R\n        supply [vcg_rules] = R\n        supply [simp] = refine_pw_simps list_rel_imp_same_length\n        apply (vcg)\n        done\n      done\n    \n      \n    lemmas eo_set_refine_aux = set_hnr'[FCOMP eo_list_set_refine]  \n    \n    lemma pure_part_cnc_imp_eq: \"pure_part (cnc_assn (\\<lambda>x. x = cc) wo_assn a c) \\<Longrightarrow> c=cc\"\n      by (auto simp: pure_part_def cnc_assn_def pred_lift_extract_simps)\n    \n    (* TODO: Move *)  \n    lemma pure_entails_empty: \"is_pure A \\<Longrightarrow> A a c \\<turnstile> \\<box>\"  \n      by (auto simp: is_pure_def sep_algebra_simps entails_lift_extract_simps)\n    \n      \n    lemma eo_set_refine: \"(uncurry2 wo_set_impl, uncurry2 mop_eo_set) \\<in> eo_assn\\<^sup>d *\\<^sub>a snat_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>d \\<rightarrow>\\<^sub>a\\<^sub>d (\\<lambda>_ ((ai, _), _). cnc_assn (\\<lambda>x. x = ai) eo_assn)\"\n      apply (sepref_to_hnr)\n      apply (rule hn_refine_nofailI)\n      apply (rule hnr_ceq_assnI)  \n      subgoal\n        supply R = eo_set_refine_aux[to_hnr, unfolded APP_def]\n        apply (rule hn_refine_cons[OF _ R])\n        apply (auto simp: sep_algebra_simps entails_lift_extract_simps hn_ctxt_def pure_def invalid_assn_def pure_entails_empty[OF pure])\n        done\n      subgoal  \n        unfolding hn_ctxt_def eo_assn_def hr_comp_def\n        supply R = set_hnr[to_hnr, THEN hn_refineD, unfolded APP_def hn_ctxt_def]\n        supply [vcg_rules] = R\n        supply [simp] = refine_pw_simps list_rel_imp_same_length pure_part_cnc_imp_eq\n        apply (vcg')\n        done\n      done \n      \n  end\n  thm mop_eo_extract_def\n\n  \n  find_theorems mop_eo_set mop_list_set\n  \n  thm mop_eo_set_alt\n  \n  lemma id_Some_only_some_rel: \"(id, Some) \\<in> Id \\<rightarrow> only_some_rel\"\n    by (auto simp: only_some_rel_def)\n  \n  lemma map_some_only_some_rel_iff: \"(xs, map Some ys) \\<in> \\<langle>only_some_rel\\<rangle>list_rel \\<longleftrightarrow> xs=ys\"  \n    apply (rule iffI)\n    subgoal\n      apply (induction xs \"map Some ys\" arbitrary: ys rule: list_rel_induct)\n      apply (auto simp: only_some_rel_def)\n      done\n    subgoal\n      apply (rewrite in \"(\\<hole>,_)\" list.map_id[symmetric])\n      apply (parametricity add: id_Some_only_some_rel)\n      by simp\n    done      \n  \n    \n  lemma wo_assn_conv: \"wo_assn xs ys = eo_assn (map Some xs) ys\"\n    unfolding eo_assn_def hr_comp_def\n    by (auto simp: pred_lift_extract_simps sep_algebra_simps fun_eq_iff map_some_only_some_rel_iff)\n  \n  lemma to_eo_conv_refine: \"(return, mop_to_eo_conv) \\<in> wo_assn\\<^sup>d \\<rightarrow>\\<^sub>a\\<^sub>d (\\<lambda>_ ai. cnc_assn (\\<lambda>x. x = ai) eo_assn)\"\n    unfolding mop_to_eo_conv_def cnc_assn_def \n    apply sepref_to_hoare\n    apply (rewrite wo_assn_conv)\n    apply vcg\n    done\n  \n  lemma \"None \\<notin> set xs \\<longleftrightarrow> (\\<exists>ys. xs = map Some ys)\"  \n    using None_not_in_set_conv by auto\n    \n  lemma to_wo_conv_refine: \"(return, mop_to_wo_conv) \\<in> eo_assn\\<^sup>d \\<rightarrow>\\<^sub>a\\<^sub>d (\\<lambda>_ ai. cnc_assn (\\<lambda>x. x = ai) wo_assn)\"  \n    unfolding mop_to_wo_conv_def cnc_assn_def eo_assn_def hr_comp_def\n    apply sepref_to_hoare\n    apply (auto simp add: refine_pw_simps map_some_only_some_rel_iff elim!: None_not_in_set_conv)\n    by vcg\n      \n  lemma random_access_iterator: \"random_access_iterator wo_assn eo_assn elem_assn \n    return return\n    eo_extract_impl\n    wo_set_impl\"  \n    apply unfold_locales\n    using to_eo_conv_refine to_wo_conv_refine eo_extract_refine eo_set_refine\n    apply blast+\n    done\n    \n  sublocale random_access_iterator wo_assn eo_assn elem_assn \n    return return\n    eo_extract_impl\n    wo_set_impl\n    by (rule random_access_iterator)        \n  \n    \n  find_theorems \"?a = UNPROTECT ?a\"\n    \nend\n\n  \n\n(*global_interpretation IDXO: random_access_iterator \n  \"woarray_assn snat_assn\" \"eoarray_assn snat_assn\" snat_assn \n  return return\n  eo_extract_impl\n  array_upd\n  defines IDXO_swap_eo_impl = IDXO.swap_eo_impl\n  apply unfold_locales\n  apply (rule eo_hnr_dep)+\n  done\n*)  \n  \nprint_named_simpset llvm_inline  \n  \n  \nglobal_interpretation IDXO: parameterized_sort_impl_context \n  \"woarray_assn snat_assn\" \"eoarray_assn snat_assn\" snat_assn \n  return return\n  eo_extract_impl\n  array_upd\n  idx_cdom idx_less idx_pcmp idx_pcmp_impl \"al_assn snat_assn\"\n  defines \n          IDXO_is_guarded_insert_impl = IDXO.is_guarded_param_insert_impl\n      and IDXO_is_unguarded_insert_impl = IDXO.is_unguarded_param_insert_impl\n      and IDXO_unguarded_insertion_sort_impl = IDXO.unguarded_insertion_sort_param_impl\n      and IDXO_guarded_insertion_sort_impl = IDXO.guarded_insertion_sort_param_impl\n      and IDXO_final_insertion_sort_impl = IDXO.final_insertion_sort_param_impl\n      (*and IDXO_mop_lchild_impl  = IDXO.mop_lchild_impl \n      and IDXO_mop_rchild_impl  = IDXO.mop_rchild_impl \n      and IDXO_has_rchild_impl  = IDXO.has_rchild_impl \n      and IDXO_has_lchild_impl  = IDXO.has_lchild_impl *)\n      \n      and IDXO_pcmpo_idxs_impl  = IDXO.pcmpo_idxs_impl\n      and IDXO_pcmpo_v_idx_impl  = IDXO.pcmpo_v_idx_impl\n      and IDXO_pcmpo_idx_v_impl  = IDXO.pcmpo_idx_v_impl\n      and IDXO_pcmp_idxs_impl  = IDXO.pcmp_idxs_impl\n      \n      and IDXO_mop_geth_impl    = IDXO.mop_geth_impl  \n      and IDXO_mop_seth_impl    = IDXO.mop_seth_impl  \n      and IDXO_sift_down_impl   = IDXO.sift_down_impl\n      and IDXO_heapify_btu_impl = IDXO.heapify_btu_impl\n      and IDXO_heapsort_impl    = IDXO.heapsort_param_impl\n      and IDXO_qsp_next_l_impl       = IDXO.qsp_next_l_impl\n      and IDXO_qsp_next_h_impl       = IDXO.qsp_next_h_impl\n      and IDXO_qs_partition_impl     = IDXO.qs_partition_impl\n(*      and IDXO_qs_partitionXXX_impl     = IDXO.qs_partitionXXX_impl *)\n      and IDXO_partition_pivot_impl  = IDXO.partition_pivot_impl \n      and IDXO_introsort_aux_impl = IDXO.introsort_aux_param_impl\n      and IDXO_introsort_impl        = IDXO.introsort_param_impl\n      and IDXO_move_median_to_first_impl = IDXO.move_median_to_first_param_impl\n  \n  apply unfold_locales\n  apply (rule eo_hnr_dep)+\n  unfolding GEN_ALGO_def refines_param_relp_def (* TODO: thm gen_refines_param_relpI *)\n  by (rule idx_pcmp_impl.refine)\n  \n\n(* TODO: This seems to be a quirk in llvm monadify and inline! FIXME! *)  \nlemmas [abs_def,llvm_inline] = array_upd_def eo_extract_impl_def\n  \n(*llvm_deps \"IDXO_heapsort_impl :: 32 word ptr \\<Rightarrow> _\" *)\n  \n\n\n\n  \nlemma al_pure_eo: \"is_pure A \\<Longrightarrow> pure_eo_adapter A (al_assn A) arl_nth arl_upd\"\n  apply unfold_locales\n  apply assumption\n  apply (rule al_nth_hnr_mop; simp)\n  subgoal\n    apply (sepref_to_hnr)\n    apply (rule hn_refine_nofailI)\n    apply (rule hnr_ceq_assnI)  \n    subgoal\n      supply R = al_upd_hnr_mop[to_hnr, unfolded APP_def, of A]\n      apply (rule hn_refine_cons[OF _ R])\n      apply (auto simp: hn_ctxt_def pure_def invalid_assn_def sep_algebra_simps entails_lift_extract_simps)\n      done\n    subgoal\n      unfolding hn_ctxt_def al_assn_def hr_comp_def pure_def in_snat_rel_conv_assn\n      apply (erule is_pureE)\n      apply (simp add: refine_pw_simps)\n      supply [simp] = list_rel_imp_same_length\n      by vcg\n    done  \n  done\n  \n\nglobal_interpretation \n  ALO: pure_eo_adapter snat_assn \"al_assn snat_assn\" arl_nth arl_upd  \n  defines ALO_eo_extract_impl = ALO.eo_extract_impl\n  apply (rule al_pure_eo)\n  by simp\n\n  \nglobal_interpretation ALO: parameterized_sort_impl_context \n  \"al_assn snat_assn\" \"ALO.eo_assn\" snat_assn \n  return return\n  ALO_eo_extract_impl\n  arl_upd\n  idx_cdom idx_less idx_pcmp idx_pcmp_impl \"al_assn snat_assn\"\n  defines \n          ALO_is_guarded_insert_impl = ALO.is_guarded_param_insert_impl\n      and ALO_is_unguarded_insert_impl = ALO.is_unguarded_param_insert_impl\n      and ALO_unguarded_insertion_sort_impl = ALO.unguarded_insertion_sort_param_impl\n      and ALO_guarded_insertion_sort_impl = ALO.guarded_insertion_sort_param_impl\n      and ALO_final_insertion_sort_impl = ALO.final_insertion_sort_param_impl\n      (*and ALO_mop_lchild_impl  = ALO.mop_lchild_impl \n      and ALO_mop_rchild_impl  = ALO.mop_rchild_impl \n      and ALO_has_rchild_impl  = ALO.has_rchild_impl \n      and ALO_has_lchild_impl  = ALO.has_lchild_impl *)\n      \n      and ALO_pcmpo_idxs_impl  = ALO.pcmpo_idxs_impl\n      and ALO_pcmpo_v_idx_impl  = ALO.pcmpo_v_idx_impl\n      and ALO_pcmpo_idx_v_impl  = ALO.pcmpo_idx_v_impl\n      and ALO_pcmp_idxs_impl  = ALO.pcmp_idxs_impl\n      \n      and ALO_mop_geth_impl    = ALO.mop_geth_impl  \n      and ALO_mop_seth_impl    = ALO.mop_seth_impl  \n      and ALO_sift_down_impl   = ALO.sift_down_impl\n      and ALO_heapify_btu_impl = ALO.heapify_btu_impl\n      and ALO_heapsort_impl    = ALO.heapsort_param_impl\n      and ALO_qsp_next_l_impl       = ALO.qsp_next_l_impl\n      and ALO_qsp_next_h_impl       = ALO.qsp_next_h_impl\n      and ALO_qs_partition_impl     = ALO.qs_partition_impl\n(*      and ALO_qs_partitionXXX_impl     = ALO.qs_partitionXXX_impl *)\n      and ALO_partition_pivot_impl  = ALO.partition_pivot_impl \n      and ALO_introsort_aux_impl = ALO.introsort_aux_param_impl\n      and ALO_introsort_impl        = ALO.introsort_param_impl\n      and ALO_move_median_to_first_impl = ALO.move_median_to_first_param_impl\n  \n  apply unfold_locales\n  unfolding GEN_ALGO_def refines_param_relp_def (* TODO: thm gen_refines_param_relpI *)\n  apply (rule idx_pcmp_impl.refine)\n  done\n\n\nlemmas [llvm_inline] = ALO.eo_extract_impl_def[THEN meta_fun_cong, THEN meta_fun_cong]  \n  \nprint_named_simpset llvm_inline\n\nfind_in_thms ALO_partition_pivot_impl in llvm_code\n\n\n(*oops llvm_deps \"ALO_heapsort_impl :: (32 word,64) array_list \\<Rightarrow> (64 word,64) array_list \\<Rightarrow> _\"*)\n\n(*export_llvm \"ALO_heapsort_impl :: (32 word,64) array_list \\<Rightarrow> (64 word,64) array_list \\<Rightarrow> _\"*)\n\nexport_llvm \n  \"ALO_heapsort_impl :: (32 word,64) array_list \\<Rightarrow> (64 word,64) array_list \\<Rightarrow> _\"\n  \"ALO_introsort_impl :: (32 word,64) array_list \\<Rightarrow> (64 word,64) array_list \\<Rightarrow> _\"\n\n\n\n\n\nexport_llvm\n  \"ALO_heapsort_impl :: (32 word,64) array_list \\<Rightarrow> (64 word,64) array_list \\<Rightarrow> _\"\n  \"ALO_introsort_impl :: (32 word,64) array_list \\<Rightarrow> (64 word,64) array_list \\<Rightarrow> _\"\n  \"IDXO_heapsort_impl :: (32 word,64) array_list \\<Rightarrow> _\" is \"uint64_t* heapsort_idxs(array_list_32_64, uint64_t*, int64_t, int64_t)\"\n  \"IDXO_introsort_impl :: (32 word,64) array_list \\<Rightarrow> _\" is \"uint64_t* introsort_idxs(array_list_32_64, uint64_t*, int64_t, int64_t)\"\n  defines \\<open>\n    typedef struct {int64_t size; struct {int64_t capacity; int32_t *data;};} array_list_32_64;\n    typedef struct {int64_t size; struct {int64_t capacity; int64_t *data;};} array_list_64_64;\n    \n    \\<close>\n  file \"../code/introsort_param.ll\"\n\n  \n  thm ALO.introsort_param_impl_correct\n  \n  \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/examples/sorting/Sorting_Ex_Array_Idxs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.33719143754741754}}
{"text": "           (*-------------------------------------------*\n            |       Uniform Candy Distribution          |\n            |                                           |\n            |           November 2007 for Isabelle 2005 |\n            |           November 2008 for Isabelle 2008 |\n            |           November 2012 for Isabelle 2012 |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory UCD_proc2\nimports UCD_proc1\nbegin\n\n(*****************************************************************\n\n         1. \n\n *****************************************************************)\n\n(* ======================= Circ ======================= *)\n\ndatatype PNRC = PreCircSpecC \"(nat * (Att list))\"\n              | PreCircSpecL \"(nat * (Att list))\" \n              | PreCircSpecR \"(nat * (Att list))\"\n\nfun\n  PNRCdef :: \"PNRC => (PNRC, Event) proc\"\nwhere\n \"PNRCdef (PreCircSpecC (n,s)) = \n   IF (ChkLCR s & s~=[] & guardL s & guardR s) THEN\n   ((left ! (n div 2) -> $PreCircSpecR(n div 2,s)) [+]\n    (right ! (getNat (hd s) div 2) -> $PreCircSpecL(n,s)))\n   ELSE STOP\"\n\n|\"PNRCdef (PreCircSpecL (n,s)) = \n   IF (ChkLCR s & s~=[] & guardL s & guardR s) THEN\n   (left ! (n div 2) ->\n      $PreCircSpecC (fill(n div 2 + getNat (hd s) div 2),nextR(nextL s, (n div 2))))\n   ELSE STOP\"\n\n|\"PNRCdef (PreCircSpecR (n,s)) = \n   IF (ChkLCR s & s~=[] & guardL s & guardR s) THEN\n   (right ! (getNat (hd s) div 2) ->\n      $PreCircSpecC (fill(n + (getNat (hd s) div 2)),nextL(nextR(s,n))))\n   ELSE STOP\"\n(*\ndefs (overloaded) Set_PNRCfun_def [simp]: \"PNfun == PNRCdef\"\n*)\noverloading Set_PNRCdef == \n  \"PNfun :: (PNRC, Event) pnfun\"\nbegin\n  definition \"PNfun == PNRCdef\"\nend\n  \ndeclare Set_PNRCdef_def [simp]\n\n(* ------------------ *\n      guardedness\n * ------------------ *)\n\nlemma guardedfun_PNRC[simp]:\n      \"guardedfun PNRCdef\"\napply (simp add: guardedfun_def)\napply (rule allI)\napply (induct_tac p)\napply (auto)\ndone\n\n\n(* -----------------------DF---------------------------------- *)\n\ndatatype DFtickName = DFtick\n\nprimrec\n  DFtickfun ::\n    \"DFtickName => (DFtickName, 'a) proc\"\nwhere\n  \"DFtickfun (DFtick) = (! x ->  $(DFtick)) |~| SKIP \"\n\n(*\ndefs (overloaded)\nSet_DFtickfun_def [simp]: \"PNfun == DFtickfun\"\n*)\n\noverloading Set_DFtickfun == \n  \"PNfun :: (DFtickName, Event) pnfun\"\nbegin\n  definition \"(PNfun :: (DFtickName, Event) pnfun) == DFtickfun\"\nend\n  \ndeclare Set_DFtickfun_def [simp]\n\n\nlemma guardedfun_DFtick[simp]:\n      \"guardedfun DFtickfun\"\nby (simp add: guardedfun_def, rule allI, induct_tac p, simp_all)\n\n\nprimrec\n  DF_to_PreCircSpecC :: \"DFtickName => (PNRC, Event) proc\"\nwhere\n  \"DF_to_PreCircSpecC (DFtick) = \n     (!nat n .. !<stlist> s:{s. ChkLCR s & s~=[] & guardL s & guardR s} .. \n           $PreCircSpecC (n,s))\n     |~|\n     (!nat n .. !<stlist> s:{s. ChkLCR s & s~=[] & guardL s & guardR s} .. \n           $(PreCircSpecL (n,s)))\n     |~|\n     (!nat n .. !<stlist> s:{s. ChkLCR s & s~=[] & guardL s & guardR s} .. \n           $PreCircSpecR (n,s))\"\n\n(* --------------------------------------- *\n            deadlock freeness\n * --------------------------------------- *)\n\ntheorem PreCircSpecC_DF: \n  \"[| ChkLCR s ; s~=[] ; guardL s ; guardR s |]\n   ==> (($DFtick)::(DFtickName, Event) proc) <=F $PreCircSpecC (n,s)\"\napply (rule cspF_fp_induct_left[of _ \"DF_to_PreCircSpecC\"])\napply (auto)\n\n(* base *)\n apply (rule cspF_Int_choice_left1)\n apply (rule cspF_Int_choice_left1)\n apply (rule cspF_Rep_int_choice_left)\n apply (rule_tac x=\"n\" in exI)\n apply (simp)\n apply (rule cspF_Rep_int_choice_left)\n apply (simp)\n apply (rule_tac x=\"s\" in exI)\n apply (simp)\n\n(* step *)\n apply (induct_tac p, auto)\n\n (* 1 *)\n apply (rule cspF_Int_choice_left1)\n apply (simp add: Int_pre_choice_def)\n apply (cspF_unwind_right | cspF_hsf_right)+\n apply (rule cspF_decompo_ref)\n apply (simp_all)\n  apply (elim disjE conjE exE)  (* right | left *)\n  (* 1/2 *)(* right *)\n  apply (simp)\n  apply (cspF_simp)+\n  apply (rule cspF_Int_choice_left1)\n  apply (rule cspF_Int_choice_left2)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (rule_tac x=\"n\" in exI)\n  apply (simp)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (simp)\n  apply (rule_tac x=\"a\" in exI)\n  apply (simp)\n\n   (* 1/2 *)(* left *)\n  apply (cspF_simp)+\n  apply (rule cspF_Int_choice_left2)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (rule_tac x=\"n div 2\" in exI)\n  apply (simp)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (simp)\n  apply (rule_tac x=\"a\" in exI)\n  apply (simp)\n\n (* 2 *)\n apply (rule cspF_Int_choice_left1)\n apply (simp add: Int_pre_choice_def)\n apply (cspF_unwind_right | cspF_hsf_right)+\n apply (rule cspF_decompo_ref)\n apply (simp_all)\n  (* left *)\n  apply (rule cspF_Int_choice_left1)\n  apply (rule cspF_Int_choice_left1)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (rule_tac x=\"fill (n div 2 + getNat (hd a) div 2)\" in exI)\n  apply (simp)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (simp)\n  apply (rule_tac x=\"nextR (nextL a, n div 2)\" in exI)\n  apply (simp)\n  apply (simp add: guardR_nextR_nextL)\n\n (* 3 *)\n apply (rule cspF_Int_choice_left1)\n apply (simp add: Int_pre_choice_def)\n apply (cspF_unwind_right | cspF_hsf_right)+\n apply (rule cspF_decompo_ref)\n apply (simp_all)\n  (* right *)\n  apply (rule cspF_Int_choice_left1)\n  apply (rule cspF_Int_choice_left1)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (rule_tac x=\"fill (n + getNat (hd a) div 2)\" in exI)\n  apply (simp)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (simp)\n  apply (rule_tac x=\"nextL (nextR (a, n))\" in exI)\n  apply (simp)\n  apply (simp add: guardL_nextL_nextR)\ndone\n\n\n(* ------------------------------------------------------------ *)\n\nfun\n  PreCircSpecC_to_Step :: \"PNRC => (PN, Event) proc\"\nwhere\n  \"PreCircSpecC_to_Step (PreCircSpecC (n,s)) = \n     IF (ChkLCR s & s~=[] & guardL s & guardR s) \n     THEN ($Child n <=-=> $LineSpec s) ELSE STOP\"\n\n |\"PreCircSpecC_to_Step (PreCircSpecL (n,s)) = \n     IF (ChkLCR s & s~=[] & guardL s & guardR s)\n     THEN ($ChildL (n, getNat (hd s) div 2) <=-=> $LineSpec (nextL s)) ELSE STOP\"\n\n |\"PreCircSpecC_to_Step (PreCircSpecR (n,s)) = \n     IF (ChkLCR s & s~=[] & guardL s & guardR s)\n     THEN ($ChildR n <=-=> $LineSpec (nextR (s, n))) ELSE STOP\"\n\n(* ----------------------------------- *\n                 Circ\n * ----------------------------------- *)\n\nlemma PreCircSpecC_Step_lm:\n \"$PreCircSpecC (n,s) <=F PreCircSpecC_to_Step (PreCircSpecC (n,s))\"\napply (rule cspF_fp_induct_left[of _ \"PreCircSpecC_to_Step\"])\napply (simp)+\n\n apply (induct_tac p)\n apply (auto)\n\n(* PreCircSpecC *)\n apply (case_tac \"~(ChkLCR b & b ~= [] & guardL b & guardR b)\")\n apply (simp (no_asm_simp))\n apply (cspF_simp)+\n\n (* ChkLCR b & b ~= [] *)\n  apply (simp add: not_nil_EX)\n  apply (elim exE conjE)\n  apply (simp)\n  apply (elim conjE disjE exE)\n  apply (simp_all)\n\n  (* AttL *)\n  apply (cspF_unwind | cspF_hsf)+\n   (* rem head *)\n   apply (rule)\n   apply (simp)\n   apply (simp)\n    apply (elim disjE conjE exE)  (* left | right *)\n   (* 1/2 *)(* left *)\n    apply (simp)\n    apply (cspF_simp)+\n   (* 1/2 *)(* right  done *)\n\n\n  (* AttC *)\n  apply (cspF_unwind | cspF_hsf)+\n   (* rem head *)\n   apply (rule)\n   apply (simp)\n   apply (simp)\n    apply (elim disjE conjE exE)  (* left | right *)\n   (* 1/2 *)(* left *)\n    apply (simp)\n    apply (cspF_simp)+\n\n(* PreCircSpecL *)\n apply (case_tac \"~(ChkLCR b & b ~= [] & guardL b & guardR b)\")\n apply (simp (no_asm_simp))\n apply (cspF_simp)+\n\n (* ChkLCR b & b ~= [] *)\n  apply (simp add: not_nil_EX)\n  apply (elim exE conjE)\n  apply (simp)\n  apply (elim conjE disjE exE)\n  apply (simp_all)\n\n  (* AttL *)\n  apply (cspF_unwind | cspF_hsf)+\n   (* rem head *)\n   apply (rule)\n   apply (simp)\n   apply (simp)\n    (* left *)\n    apply (cspF_simp)+\n    apply (simp add: guardR_nextR_nextL)\n    apply (cspF_simp)+\n\n  (* AttC *)\n  apply (cspF_unwind | cspF_hsf)+\n   (* rem head *)\n   apply (rule)\n   apply (simp)\n   apply (simp)\n   (* left *)\n    apply (cspF_simp)+\n    apply (simp add: ChkR_ChkCR guardR_nextR_AttR)\n    apply (cspF_simp)+\n\n(* PreCircSpecR *)\n apply (case_tac \"~(ChkLCR b & b ~= [] & guardL b & guardR b)\")\n apply (simp (no_asm_simp))\n apply (cspF_simp)+\n\n (* ChkLCR b & b ~= [] *)\n  apply (simp add: not_nil_EX)\n  apply (elim exE conjE)\n  apply (simp)\n  apply (elim conjE disjE exE)\n  apply (simp_all)\n\n  (* AttL *)\n  apply (cspF_unwind | cspF_hsf)+\n  apply (case_tac \"guardR (nextR (t, a))\")\n  apply (cspF_hsf)+\n   (* rem head *)\n   apply (rule)\n   apply (simp)\n   apply (simp)\n    (* right *)\n    apply (cspF_simp)+\n\n  (* ~guardR (nextR (t, a) *)\n  apply (cspF_hsf)+\n   (* rem head *)\n   apply (rule)\n   apply (simp)\n   apply (simp)\n    (* right *)\n    apply (cspF_simp)+\n\n  (* AttC *)\n  apply (cspF_unwind | cspF_hsf)+\n  apply (case_tac \"guardR (nextR (AttC n # t, a))\")\n  apply (cspF_hsf)+\n   (* rem head *)\n   apply (rule)\n   apply (simp)\n   apply (simp add: getNat_hd_nextR_AttC)\n   apply (simp add: guardL_nextL_nextR)\n   apply (cspF_simp)+\n   apply (simp add: getNat_hd_nextR_AttC)\n\n  apply (cspF_hsf)+\n   (* rem head *)\n   apply (rule)\n   apply (simp)\n   apply (simp add: getNat_hd_nextR_AttC)\n   apply (simp add: guardL_nextL_nextR)\n   apply (cspF_simp)+\n   apply (simp add: getNat_hd_nextR_AttC)\ndone\n\n(* --------------------------------- *\n          PreCircSpecC (step main)\n * --------------------------------- *)\n\nlemma cspF_tr_left_ref2:\n   \"[| P1 <=F[M1,M2] P2 ; P2 <=F[M2,M3] P3 |] ==> P1 <=F[M1,M3] P3\"\nby (simp add: refF_def eqF_def)\n\nlemma PreCircSpecC_Step:\n \"[| ChkLCR s ; s ~= [] ; guardL s ; guardR s |]\n  ==> ($PreCircSpecC (n, s)::(PNRC,Event) proc) <=F $Child n <=-=> $LineSpec s\"\napply (rule cspF_tr_left_ref2)\napply (rule PreCircSpecC_Step_lm)\napply (simp)\napply (cspF_simp)+\ndone\n\n(* --------------------------------- *\n               lemmas\n * --------------------------------- *)\n\n(*\nlemma PreCircChild_not_nil [simp]: \n  \"s ~= [] ==> PreCircChild (n # s) = ($Child n) <=-=> (LineChild s)\"\napply (simp add: not_nil_EX)\napply (elim conjE exE)\nby (simp)\n\nlemma CircChild_not_nil [simp]: \n  \"s ~= [] ==> CircChild (n # s) = ($Child n) <===> (LineChild s)\"\napply (simp add: not_nil_EX)\napply (elim conjE exE)\nby (simp)\n*)\n\n(* ---------------------------------------------------- *\n |                                                      |\n |           Sequentialising PreCircChild s             |\n |                                                      |\n * ---------------------------------------------------- *)\n\ntheorem PreCircSpecC_PreCircChild:\n \"s~=[] ==> $PreCircSpecC (n, toStb (map AttC s)) <=F PreCircChild (n#s)\"\napply (rule cspF_tr_left_ref2)\napply (rule PreCircSpecC_Step)\napply (simp_all)\napply (simp add: ChkLCR_toStb)\napply (simp add: guardL_toStb_AttC)\napply (simp add: guardR_toStb_AttC)\napply (rule cspF_decompo | simp)+\napply (simp add: LineSpec_LineChild)\ndone\n\n(* --------------------------------- *\n |       DF <= PreCircSpecC          |\n * --------------------------------- *)\n\nlemma DF_PreCircSpecC_toStb:\n \"s~=[] ==> (($DFtick)::(DFtickName, Event) proc) \n            <=F $PreCircSpecC (n, toStb (map AttC s))\"\napply (rule PreCircSpecC_DF)\napply (simp add: ChkLCR_toStb)\napply (simp)\napply (simp add: guardL_toStb_AttC)\napply (simp add: guardR_toStb_AttC)\ndone\n\n(* ---------------------------------------------------- *\n |                                                      |\n |          PreCircChild s is dealock-free.             |\n |                                                      |\n * ---------------------------------------------------- *)\n\ntheorem DF_PreCircChild:\n \"s~=[] ==> $DFtick <=F PreCircChild (n#s)\"\napply (rule cspF_tr_left_ref2)\napply (rule DF_PreCircSpecC_toStb)\napply (simp)\napply (rule PreCircSpecC_PreCircChild)\napply (simp)\ndone\n\n(* ======================= CircSpec ======================= *)\n\ndatatype PNR = CircSpec \"(nat list)\"\n\nprimrec\n  PNRdef :: \"PNR => (PNR, Event) proc\"\nwhere\n \"PNRdef (CircSpec s) = \n    IF (tl s~=[]) THEN \n    (left ! ((hd s) div 2) -> $(CircSpec (circNext s)))\n    ELSE STOP\"\n(*\ndefs (overloaded) Set_PNRfun_def [simp]: \"PNfun == PNRdef\"\n*)\noverloading Set_PNRdef == \n  \"PNfun :: (PNR, Event) pnfun\"\nbegin\n  definition \"PNfun == PNRdef\"\nend\n  \ndeclare Set_PNRdef_def [simp]\n\n(* ------------------ *\n      guardedness\n * ------------------ *)\n\nlemma guardedfun_PNR[simp]:\n      \"guardedfun PNRdef\"\napply (simp add: guardedfun_def)\napply (rule allI)\napply (induct_tac p)\napply (auto)\ndone\n\n(* ------------------------------------------------------------ *)\n\ndeclare toStb_simp [simp]\n\nfun\n  CircSpec_to_PreCircSpecC :: \"PNR => (PNRC, Event) proc\"\nwhere\n  \"CircSpec_to_PreCircSpecC (CircSpec s) = \n     IF (tl s~=[]) THEN\n        ($PreCircSpecC (hd s, toStb (map AttC (tl s))) -- range right)\n     ELSE STOP\"\n\n(* ------------- lemma ------------- *)\n\nlemma CircSpec_PreCircSpecC_lm:\n \"tl s ~= [] ==> $CircSpec s <=F CircSpec_to_PreCircSpecC (CircSpec s)\"\napply (rule cspF_fp_induct_left[of _ \"CircSpec_to_PreCircSpecC\"])\napply (simp)+\n\n apply (induct_tac p)\n apply (auto)\n\n apply (case_tac \"(tl xa = [])\")\n apply (simp)\n apply (cspF_simp)+\n\n (* tl list ~= [] *)\n\n  apply (cspF_unwind)\n  apply (cspF_hsf)+\n\n  apply (rule)  (* 1i |~| 2i *)\n\n  (* 1i *)\n   apply (cspF_unwind)\n   apply (simp add: nextR_nextL_toStb_nextR_nextL_toStb)\n   apply (cspF_hsf)+\n   (* rem head *)\n   apply (rule)\n   apply (simp)\n   apply (simp)\n    (* left *)\n    apply (cspF_simp)+\n    apply (rule)  (* 1ii |~| 2ii *)\n\n     (* 1ii *)\n     apply (cspF_unwind_right)\n     apply (cspF_hsf)+\n     apply (simp add: nextL_nextR_toStb_lineNext)\n     apply (simp add: tl_lineNext)\n     apply (simp add: getNat_hd_toStb_map_AttC)\n     apply (simp add: hd_circNext)\n     apply (simp add: circNext_def)\n\n     (* 2ii *)\n     apply (simp add: nextL_nextR_toStb_lineNext)\n     apply (simp add: tl_lineNext)\n     apply (simp add: getNat_hd_toStb_map_AttC)\n     apply (simp add: hd_circNext)\n     apply (simp add: circNext_def)\n\n  (* 2i *)\n   apply (cspF_unwind)\n   apply (simp add: nextR_nextL_toStb_nextR_nextL_toStb)\n   apply (cspF_hsf)+\n   (* rem head *)\n   apply (rule)\n   apply (simp)\n   apply (simp)\n    (* left *)\n    apply (cspF_simp)+\n\n     apply (simp add: nextL_nextR_toStb_lineNext)\n     apply (simp add: tl_lineNext)\n     apply (simp add: getNat_hd_toStb_map_AttC)\n     apply (simp add: hd_circNext)\n     apply (simp add: circNext_def)\ndone\n\n(* ---------------------------------------------------- *\n |                                                      |\n |     CircSpec s <=F PreCircSpecC s -- range right     |\n |                                                      |\n * ---------------------------------------------------- *)\n\nlemma CircSpec_PreCircSpecC:\n \"tl s ~= [] ==> $CircSpec s <=F $PreCircSpecC (hd s, toStb (map AttC (tl s))) -- range right\"\napply (rule cspF_tr_left_ref2)\napply (rule CircSpec_PreCircSpecC_lm)\napply (simp)\napply (simp)\napply (cspF_simp)+\ndone\n\n(* ---------------------------------------------------- *\n |                                                      |\n |               CircSpec s <=F CircChild s             |\n |                                                      |\n * ---------------------------------------------------- *)\n\ntheorem CircSpec_CircChild:\n \"tl s ~= [] ==> $CircSpec s <=F CircChild s\"\napply (insert list_nil_or_unnil)\napply (drule_tac x=\"s\" in spec)\napply (elim disjE exE)\napply (simp)\napply (simp)\napply (rule cspF_tr_left_ref2)\napply (rule CircSpec_PreCircSpecC)\napply (simp)\napply (simp)\n\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_tr_left_ref2)\napply (rule PreCircSpecC_PreCircChild)\napply (simp)\napply (simp)\ndone\n\n(*********************************************************\n               Eventually Stable spec\n *********************************************************)\n\ndatatype PNS = Stable \"nat\"\n\nprimrec\n  PNSdef :: \"PNS => (PNS, Event) proc\"\nwhere\n \"PNSdef (Stable n) = left ! n -> $Stable n\"\n(*\ndefs (overloaded) Set_PNSfun_def [simp]: \"PNfun == PNSdef\"\n*)\n\noverloading Set_PNSdef == \n  \"PNfun :: (PNS, Event) pnfun\"\nbegin\n  definition \"PNfun == PNSdef\"\nend\n  \ndeclare Set_PNSdef_def [simp]\n\n(* ------------------ *\n      guardedness\n * ------------------ *)\n\nlemma guardedfun_PNS[simp]:\n      \"guardedfun PNSdef\"\nby (simp add: guardedfun_def, rule allI, induct_tac p, auto)\n\nprimrec\n  Unstable     :: \"nat => (nat list) => (PNS, Event) proc\"\nwhere\n  \"Unstable      0  = (%s. SKIP)\"\n |\"Unstable (Suc n) = (%s. left ! (hd s div 2) -> Unstable n (circNext s))\"\n\ndefinition\n  EventuallyStable :: \"(nat list) => (PNS, Event) proc\"\nwhere\n  EventuallyStable_def:\n   \"EventuallyStable s == (!nat N .. Unstable N s) ;; \n                          (!nat n .. $Stable n)\"\n\n(* ----------------------------------------------- *\n          eventually stable specification\n * ----------------------------------------------- *)\n\nprimrec\n  EventuallyStable_to_CircSpec :: \"nat => PNS => (PNR, Event) proc\"\nwhere\n  \"EventuallyStable_to_CircSpec l (Stable n)   =  $CircSpec (makeStableList l (2 * n))\"\n\n(* ---------- lemmas ---------- *)\n\nlemma Unstable_CircSpec_lm:\n  \"ALL s. (tl s ~= [] & P <=F $CircSpec (circNexts N s))\n     --> Unstable N s ;; P <=F $CircSpec s\"\napply (induct_tac N)\napply (auto | cspF_auto)+\ndone\n\nlemma Unstable_CircSpec:\n  \"[| tl s ~= [] ; P <=F $CircSpec (circNexts N s) |]\n   ==> Unstable N s ;; P <=F $CircSpec s\"\nby (simp add: Unstable_CircSpec_lm)\n\n\nlemma Stable_CircSpec:\n \"[| Suc 0 < l ; s=makeStableList l (2*n) |] ==> \n  $Stable n <=F (($CircSpec s)::(PNR, Event) proc)\"\napply (rule cspF_fp_induct_left[of _ \"EventuallyStable_to_CircSpec l\"])\napply (simp)+\n\n apply (induct_tac p)\n apply (auto | cspF_auto)+\n apply (simp_all add: stable_circNext)\ndone\n\nlemma EventuallyStable_CircSpec:\n \"[| Suc 0 < length s ; allEven s |] ==> EventuallyStable s <=F $CircSpec s\"\napply (subgoal_tac \"s~=[] & tl s ~= []\")\napply (simp add: EventuallyStable_def)\napply (cspF_hsf)+\napply (rule cspF_Rep_int_choice_left)\napply (insert circNexts_eventually_stable[of s], simp)\napply (erule exE)\napply (rule_tac x=\"N\" in exI)\napply (rule Unstable_CircSpec)\napply (simp_all)\n\napply (rule cspF_Rep_int_choice_left)\napply (rule_tac x=\"hd (circNexts N s) div 2\" in exI)\napply (simp)\napply (rule Stable_CircSpec[of \"length s\"])\napply (simp_all)\napply (simp add: makeStableList_hd_stableList)\napply (simp add: list_length_more_one)\ndone\n\n(* -------------------------------------------- *\n\n                  Finally ...\n\n     for any number of children more than two \n     and any initial number of candies,\n\n * -------------------------------------------- *)\n\ntheorem EventuallyStable_CircChild:\n \"[| 1 < length s ; allEven s |] \n  ==> EventuallyStable s <=F CircChild s\"\napply (rule cspF_tr_left_ref2)\napply (rule EventuallyStable_CircSpec)\napply (simp_all)\napply (rule CircSpec_CircChild)\napply (simp add: list_length_more_one)\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/UCD/UCD_proc2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6959583376458153, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.33710835824214996}}
{"text": "(*  Title:      RTS/JinjaSuppl/ClassesAbove.thy\n    Author:    Susannah Mansky, UIUC 2020\n*)\n\nsection \"@{term classes_above} theory\"\n\ntext \"This section contains theory around the classes above\n (superclasses of) a class in the class structure, in particular\n noting that if their contents have not changed, then much of what\n that class sees (methods, fields) stays the same.\"\n\ntheory ClassesAbove\nimports ClassesChanged Subcls JinjaDCI.Exceptions\nbegin\n\nabbreviation classes_above :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> cname set\" where\n\"classes_above P c \\<equiv> { cn. P \\<turnstile> c \\<preceq>\\<^sup>* cn }\"\n\nabbreviation classes_between :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> cname set\" where\n\"classes_between P c d \\<equiv> { cn. (P \\<turnstile> c \\<preceq>\\<^sup>* cn \\<and> P \\<turnstile> cn \\<preceq>\\<^sup>* d) }\"\n\nabbreviation classes_above_xcpts :: \"'m prog \\<Rightarrow> cname set\" where\n\"classes_above_xcpts P \\<equiv> \\<Union>x\\<in>sys_xcpts. classes_above P x\"\n\n(******************************************************************************)\n\nlemma classes_above_def2:\n \"P \\<turnstile> C \\<prec>\\<^sup>1 D \\<Longrightarrow> classes_above P C = {C} \\<union> classes_above P D\"\nusing subcls1_confluent by auto\n\nlemma classes_above_class:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {}; P \\<turnstile> C \\<preceq>\\<^sup>* C' \\<rbrakk>\n  \\<Longrightarrow> class P C' = class P' C'\"\n by (drule classes_changed_class_set, simp)\n\nlemma classes_above_subset:\nassumes \"classes_above P C \\<inter> classes_changed P P' = {}\"\nshows \"classes_above P C \\<subseteq> classes_above P' C\"\nproof -\n  have ind: \"\\<And>x. P \\<turnstile> C \\<preceq>\\<^sup>* x \\<Longrightarrow> P' \\<turnstile> C \\<preceq>\\<^sup>* x\"\n  proof -\n    fix x assume sub: \"P \\<turnstile> C \\<preceq>\\<^sup>* x\"\n    then show \"P' \\<turnstile> C \\<preceq>\\<^sup>* x\"\n    proof(induct rule: rtrancl_induct)\n      case base then show ?case by simp\n    next\n      case (step y z)\n      have \"P' \\<turnstile> y \\<prec>\\<^sup>1 z\" by(rule class_subcls1[OF classes_above_class[OF assms step(1)] step(2)])\n      then show ?case using step(3) by simp\n    qed\n  qed\n  with classes_changed_class_set[OF assms] show ?thesis by clarsimp\nqed\n\nlemma classes_above_subcls:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {}; P \\<turnstile> C \\<preceq>\\<^sup>* C' \\<rbrakk>\n   \\<Longrightarrow> P' \\<turnstile> C \\<preceq>\\<^sup>* C'\"\n by (fastforce dest: classes_above_subset)\n\nlemma classes_above_subset2:\nassumes \"classes_above P C \\<inter> classes_changed P P' = {}\"\nshows \"classes_above P' C \\<subseteq> classes_above P C\"\nproof -\n  have ind: \"\\<And>x. P' \\<turnstile> C \\<preceq>\\<^sup>* x \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* x\"\n  proof -\n    fix x assume sub: \"P' \\<turnstile> C \\<preceq>\\<^sup>* x\"\n    then show \"P \\<turnstile> C \\<preceq>\\<^sup>* x\"\n    proof(induct rule: rtrancl_induct)\n      case base then show ?case by simp\n    next\n      case (step y z)\n      with class_subcls1 classes_above_class[OF assms] rtrancl_into_rtrancl show ?case by metis\n    qed\n  qed\n  with classes_changed_class_set[OF assms] show ?thesis by clarsimp\nqed\n\nlemma classes_above_subcls2:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {}; P' \\<turnstile> C \\<preceq>\\<^sup>* C' \\<rbrakk>\n   \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* C'\"\n by (fastforce dest: classes_above_subset2)\n\nlemma classes_above_set:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {} \\<rbrakk>\n  \\<Longrightarrow> classes_above P C = classes_above P' C\"\n by(fastforce dest: classes_above_subset classes_above_subset2)\n\nlemma classes_above_classes_changed_sym:\nassumes \"classes_above P C \\<inter> classes_changed P P' = {}\"\nshows \"classes_above P' C \\<inter> classes_changed P' P = {}\"\nproof -\n  have \"classes_above P C = classes_above P' C\" by(rule classes_above_set[OF assms])\n  with classes_changed_sym[where P=P] assms show ?thesis by simp\nqed\n\nlemma classes_above_sub_classes_between_eq:\n \"P \\<turnstile> C \\<preceq>\\<^sup>* D \\<Longrightarrow> classes_above P C = (classes_between P C D - {D}) \\<union> classes_above P D\"\nusing subcls_confluent by auto\n\nlemma classes_above_subcls_subset:\n \"\\<lbrakk> P \\<turnstile> C \\<preceq>\\<^sup>* C' \\<rbrakk> \\<Longrightarrow> classes_above P C' \\<subseteq> classes_above P C\"\n by auto\n\n(************************************************************)\nsubsection \"Methods\"\n\nlemma classes_above_sees_methods:\nassumes int: \"classes_above P C \\<inter> classes_changed P P' = {}\" and ms: \"P \\<turnstile> C sees_methods Mm\"\nshows \"P' \\<turnstile> C sees_methods Mm\"\nproof -\n  have cls: \"\\<forall>C'\\<in>classes_above P C. class P C' = class P' C'\"\n   by(rule classes_changed_class_set[OF int])\n\n  have \"\\<And>C Mm. P \\<turnstile> C sees_methods Mm \\<Longrightarrow>\n               \\<forall>C'\\<in>classes_above P C. class P C' = class P' C' \\<Longrightarrow> P' \\<turnstile> C sees_methods Mm\"\n  proof -\n    fix C Mm assume \"P \\<turnstile> C sees_methods Mm\" and \"\\<forall>C'\\<in>classes_above P C. class P C' = class P' C'\"\n    then show \"P' \\<turnstile> C sees_methods Mm\"\n    proof(induct rule: Methods.induct)\n      case Obj: (sees_methods_Object D fs ms Mm)\n      with cls have \"class P' Object = \\<lfloor>(D, fs, ms)\\<rfloor>\" by simp\n      with Obj show ?case by(auto intro!: sees_methods_Object)\n    next\n      case rec: (sees_methods_rec C D fs ms Mm Mm')\n      then have \"P \\<turnstile> C \\<preceq>\\<^sup>* D\" by (simp add: r_into_rtrancl[OF subcls1I])\n      with converse_rtrancl_into_rtrancl have \"\\<And>x. P \\<turnstile> D \\<preceq>\\<^sup>* x \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* x\" by simp\n      with rec.prems(1) have \"\\<forall>C'\\<in>classes_above P D. class P C' = class P' C'\" by simp\n      with rec show ?case by(auto intro: sees_methods_rec)\n    qed\n  qed\n  with ms cls show ?thesis by simp\nqed\n\nlemma classes_above_sees_method:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {};\n     P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = m in C' \\<rbrakk>\n  \\<Longrightarrow> P' \\<turnstile> C sees M,b: Ts\\<rightarrow>T = m in C'\"\n by (auto dest: classes_above_sees_methods simp: Method_def)\n\nlemma classes_above_sees_method2:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {};\n     P' \\<turnstile> C sees M,b: Ts\\<rightarrow>T = m in C' \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = m in C'\"\n by (auto dest: classes_above_classes_changed_sym intro: classes_above_sees_method)\n\nlemma classes_above_method:\nassumes \"classes_above P C \\<inter> classes_changed P P' = {}\"\nshows \"method P C M = method P' C M\"\nproof(cases \"\\<exists>Ts T m D b. P \\<turnstile> C sees M,b :  Ts\\<rightarrow>T = m in D\")\n  case True\n  with assms show ?thesis by (auto dest: classes_above_sees_method)\nnext\n  case False\n  with assms have \"\\<not>(\\<exists>Ts T m D b. P' \\<turnstile> C sees M,b :  Ts\\<rightarrow>T = m in D)\"\n    by (auto dest: classes_above_sees_method2)\n  with False show ?thesis by(simp add: method_def)\nqed\n\n(*********************************************)\nsubsection \"Fields\"\n\nlemma classes_above_has_fields:\nassumes int: \"classes_above P C \\<inter> classes_changed P P' = {}\" and fs: \"P \\<turnstile> C has_fields FDTs\"\nshows \"P' \\<turnstile> C has_fields FDTs\"\nproof -\n  have cls: \"\\<forall>C'\\<in>classes_above P C. class P C' = class P' C'\"\n   by(rule classes_changed_class_set[OF int])\n\n  have \"\\<And>C Mm. P \\<turnstile> C has_fields FDTs \\<Longrightarrow>\n               \\<forall>C'\\<in>classes_above P C. class P C' = class P' C' \\<Longrightarrow> P' \\<turnstile> C has_fields FDTs\"\n  proof -\n    fix C Mm assume \"P \\<turnstile> C has_fields FDTs\" and \"\\<forall>C'\\<in>classes_above P C. class P C' = class P' C'\"\n    then show \"P' \\<turnstile> C has_fields FDTs\"\n    proof(induct rule: Fields.induct)\n      case Obj: (has_fields_Object D fs ms FDTs)\n      with cls have \"class P' Object = \\<lfloor>(D, fs, ms)\\<rfloor>\" by simp\n      with Obj show ?case by(auto intro!: has_fields_Object)\n    next\n      case rec: (has_fields_rec C D fs ms FDTs FDTs')\n      then have \"P \\<turnstile> C \\<preceq>\\<^sup>* D\" by (simp add: r_into_rtrancl[OF subcls1I])\n      with converse_rtrancl_into_rtrancl have \"\\<And>x. P \\<turnstile> D \\<preceq>\\<^sup>* x \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* x\" by simp\n      with rec.prems(1) have \"\\<forall>x. P \\<turnstile> D \\<preceq>\\<^sup>* x \\<longrightarrow> class P x = class P' x\" by simp\n      with rec show ?case by(auto intro: has_fields_rec)\n    qed\n  qed\n  with fs cls show ?thesis by simp\nqed\n\nlemma classes_above_has_fields_dne:\nassumes \"classes_above P C \\<inter> classes_changed P P' = {}\"\nshows \"(\\<forall>FDTs. \\<not> P \\<turnstile> C has_fields FDTs) = (\\<forall>FDTs. \\<not> P' \\<turnstile> C has_fields FDTs)\"\nproof(rule iffI)\n  assume asm: \"\\<forall>FDTs. \\<not> P \\<turnstile> C has_fields FDTs\"\n  from assms classes_changed_sym[where P=P] classes_above_set[OF assms]\n   have int': \"classes_above P' C \\<inter> classes_changed P' P = {}\" by simp\n  from asm classes_above_has_fields[OF int'] show \"\\<forall>FDTs. \\<not> P' \\<turnstile> C has_fields FDTs\" by auto\nnext\n  assume \"\\<forall>FDTs. \\<not> P' \\<turnstile> C has_fields FDTs\"\n  with assms show \"\\<forall>FDTs. \\<not> P \\<turnstile> C has_fields FDTs\" by(auto dest: classes_above_has_fields)\nqed\n\nlemma classes_above_has_field:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {};\n    P \\<turnstile> C has F,b:t in C' \\<rbrakk>\n   \\<Longrightarrow> P' \\<turnstile> C has F,b:t in C'\"\n by(auto dest: classes_above_has_fields simp: has_field_def)\n\nlemma classes_above_has_field2:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {};\n     P' \\<turnstile> C has F,b:t in C' \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> C has F,b:t in C'\"\n by(auto intro: classes_above_has_field dest: classes_above_classes_changed_sym)\n\nlemma classes_above_sees_field:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {};\n    P \\<turnstile> C sees F,b:t in C' \\<rbrakk>\n   \\<Longrightarrow> P' \\<turnstile> C sees F,b:t in C'\"\n by(auto dest: classes_above_has_fields simp: sees_field_def)\n\nlemma classes_above_sees_field2:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {};\n     P' \\<turnstile> C sees F,b:t in C' \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> C sees F,b:t in C'\"\n by (auto intro: classes_above_sees_field dest: classes_above_classes_changed_sym)\n\nlemma classes_above_field:\nassumes \"classes_above P C \\<inter> classes_changed P P' = {}\"\nshows \"field P C F = field P' C F\"\nproof(cases \"\\<exists>T D b. P \\<turnstile> C sees F,b : T in D\")\n  case True\n  with assms show ?thesis by (auto dest: classes_above_sees_field)\nnext\n  case False\n  with assms have \"\\<not>(\\<exists>T D b. P' \\<turnstile> C sees F,b : T in D)\"\n    by (auto dest: classes_above_sees_field2)\n  with False show ?thesis by(simp add: field_def)\nqed\n\nlemma classes_above_fields:\nassumes \"classes_above P C \\<inter> classes_changed P P' = {}\"\nshows \"fields P C = fields P' C\"\nproof(cases \"\\<exists>FDTs. P \\<turnstile> C has_fields FDTs\")\n  case True\n  with assms show ?thesis by(auto dest: classes_above_has_fields)\nnext\n  case False\n  with assms show ?thesis by (auto dest: classes_above_has_fields_dne simp: fields_def)\nqed\n\nlemma classes_above_ifields:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {} \\<rbrakk>\n \\<Longrightarrow>\n  ifields P C = ifields P' C\"\n by (simp add: ifields_def classes_above_fields)\n\n\nlemma classes_above_blank:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {} \\<rbrakk>\n \\<Longrightarrow>\n  blank P C = blank P' C\"\n by (simp add: blank_def classes_above_ifields)\n\nlemma classes_above_isfields:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {} \\<rbrakk>\n \\<Longrightarrow>\n  isfields P C = isfields P' C\"\n by (simp add: isfields_def classes_above_fields)\n\nlemma classes_above_sblank:\n \"\\<lbrakk> classes_above P C \\<inter> classes_changed P P' = {} \\<rbrakk>\n \\<Longrightarrow>\n  sblank P C = sblank P' C\"\n by (simp add: sblank_def classes_above_isfields)\n\n(******************************************)\nsubsection \"Other\"\n\nlemma classes_above_start_heap:\nassumes \"classes_above_xcpts P \\<inter> classes_changed P P' = {}\"\nshows \"start_heap P = start_heap P'\"\nproof -\n  from assms have \"\\<forall>C \\<in> sys_xcpts. blank P C = blank P' C\" by (auto intro: classes_above_blank)\n  then show ?thesis by(simp add: start_heap_def)\nqed\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Regression_Test_Selection/JinjaSuppl/ClassesAbove.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3370528905460492}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |                 August 2005 (modified)    |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_surj\nimports CSP_F_domain CSP_T.CSP_T_surj\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*********************************************************\n            inverse function : DomT => proc\n *********************************************************)\n\ndefinition\n  head_failures :: \"'a setF => 'a set\"\n  where\n  head_failures_def :\n  \"head_failures F == {a. EX t X. (<Ev a> ^^^ t, X) :f F}\"\n  \ndefinition  \n  tail_failures :: \"'a setF => 'a => 'a setF\"\n  where\n  tail_failures_def :\n  \"tail_failures F == (%a. {(t,X). (<Ev a> ^^^ t, X) :f F}f)\"\n\nprimrec\n  Proc_F_rec   :: \"nat => 'a domF => ('p,'a) proc\"\nwhere\n  \"Proc_F_rec 0 = (%SF. !set X:{X. EX Y. (<>,Y) :f sndF SF & \n                                  Ev ` X = Evset - Y & Tick : Y &\n                                  (ALL a:X. <Ev a> :t fstF SF)} .. \n                        (? x:X -> DIV))\"\n |\"Proc_F_rec (Suc n)\n     = (%SF. (! a:(head_failures (sndF SF)) .. a -> \n              Proc_F_rec n (tail_traces (fstF SF) a ,,\n                           tail_failures (sndF SF) a)) [+] DIV)\"\ndefinition\n  Proc_F    :: \"'a domF => ('p,'a) proc\"\n  where\n  Proc_F_def :\n   \"Proc_F SF == Proc_T (fstF SF) |~| (!nat n .. Proc_F_rec n SF)\"\n\n(*********************************************************\n                     lemmas\n *********************************************************)\n\n(* tail in setF *)\n\nlemma tail_failures_setF: \"{(t,X). (<Ev a> ^^^ t, X) :f F} : setF\"\napply (simp add: setF_def)\napply (simp add: HC_F2_def)\napply (intro allI impI)\napply (rule memF_F2)\nby (auto)\n\n(* tail *)\n\nlemma in_tail_failures: \n  \"((s,X) :f tail_failures F a) = ((<Ev a> ^^^ s, X) :f F)\"\napply (simp add: tail_failures_def)\napply (simp add: tail_failures_setF CollectF_open_memF)\ndone\n\n(* head & tail *)\n\nlemma head_tail_failures_only_if:\n   \"(<Ev a> ^^^ s, X) :f F ==> a : head_failures F & (s,X) :f tail_failures F a\"\napply (simp add: in_tail_failures)\napply (auto simp add: head_failures_def)\ndone\n\n(* iff *)\n\nlemma head_tail_failures:\n   \"(<Ev a> ^^^ s, X) :f F = (a : head_failures F & (s,X) :f tail_failures F a)\"\napply (rule iffI)\napply (simp add: head_tail_failures_only_if)\napply (simp add: in_tail_failures)\ndone\n\n(*** domF ***)\n\n(* head *)\n\nlemma head_failures_traces: \n  \"a : head_failures (sndF SF) ==> a : head_traces (fstF SF)\"\napply (simp add: head_failures_def)\napply (simp add: head_traces_def)\napply (elim exE)\napply (rule_tac x=\"t\" in exI)\napply (simp add: pairF_domF_T2)\ndone\n\n(* T2 *)\n\nlemma tail_traces_failures_T2: \n  \"HC_T2 (tail_traces (fstF SF) a , tail_failures (sndF SF) a)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim exE)\napply (simp add: in_tail_failures)\napply (subgoal_tac \"a : head_traces (fstF SF)\")\napply (simp add: in_tail_traces)\napply (simp add: pairF_domF_T2)\n\napply (simp add: head_tail_failures)\napply (simp add: head_failures_traces)\ndone\n\n(* F3 *)\n\nlemma tail_traces_failures_F3: \n  \"a : head_traces (fstF SF) ==>\n   HC_F3 (tail_traces (fstF SF) a , tail_failures (sndF SF) a)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE)\n\napply (simp add: in_tail_failures)\napply (simp add: in_tail_traces)\napply (rule pairF_domF_F3)\napply (simp)\napply (simp)\napply (simp add: appt_assoc_sym)\ndone\n\n(* T3_F4 *)\n\nlemma tail_traces_failures_T3_F4: \n  \"a : head_traces (fstF SF) ==>\n   HC_T3_F4 (tail_traces (fstF SF) a , tail_failures (sndF SF) a)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE)\n\napply (simp add: in_tail_failures)\napply (simp add: in_tail_traces)\napply (simp add: appt_assoc_sym)\napply (simp add: pairF_domF_F4)\napply (simp add: pairF_domF_T3)\ndone\n\nlemma tail_traces_failures_domF: \n  \"a : head_traces (fstF SF) | a : head_failures (sndF SF) \n   ==> (tail_traces (fstF SF) a , tail_failures (sndF SF) a) : domF\"\napply (simp add: domF_iff)\napply (subgoal_tac \"a : head_traces (fstF SF)\")\napply (simp add: tail_traces_failures_T2)\napply (simp add: tail_traces_failures_F3)\napply (simp add: tail_traces_failures_T3_F4)\napply (auto simp add: head_failures_traces)\ndone\n\n(*-------------------------------------*\n |   failures (Proc_T_rec n) --> Tick  |\n *-------------------------------------*)\n\nlemma failures_Proc_T_rec_noTick_lm: \n  \"ALL s T. ((s, X) :f failures (Proc_T_rec n T) M & noTick s)\n   --> (EX t. s ^^^ t ^^^ <Tick> :t T & noTick t)\"\napply (induct_tac n)\n\n(* base *)\n apply (simp add: in_traces)\n apply (simp add: in_failures)\n\n(* step *)\n apply (intro allI impI)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE bexE)\n apply (simp_all)\n\n  apply (drule_tac x=\"sa\" in spec)\n  apply (drule_tac x=\"(tail_traces T a)\" in spec)\n  apply (simp)\n  apply (elim conjE exE)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp add: appt_assoc)\n  apply (simp add: head_tail_traces)\n\n  apply (simp add: in_traces)\n  apply (simp add: in_traces)\n\n  apply (case_tac \"<Tick> :t T\")\n\n   apply (simp add: in_failures)\n   apply (erule disjE)\n    apply (rule_tac x=\"<>\" in exI)\n    apply (simp)\n    apply (simp)\n\n   apply (simp add: in_failures)\ndone\n\nlemma failures_Proc_T_rec_noTick: \n  \"[| (s, X) :f failures (Proc_T_rec n T) M ; noTick s|]\n   ==> (EX t. s ^^^ t ^^^ <Tick> :t T & noTick t)\"\nby (simp add: failures_Proc_T_rec_noTick_lm)\n\nlemma failures_Proc_T_rec_lm: \n  \"ALL s T. ((s, X) :f failures (Proc_T_rec n T) M)\n   --> s :t T\"\napply (induct_tac n)\n\n(* base *)\n apply (simp add: in_traces)\n apply (simp add: in_failures)\n\n(* step *)\n apply (intro allI impI)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE bexE)\n apply (simp_all)\n\n  apply (drule_tac x=\"sa\" in spec)\n  apply (drule_tac x=\"(tail_traces T a)\" in spec)\n  apply (simp add: head_tail_traces)\n\n  apply (case_tac \"<Tick> :t T\")\n  apply (auto simp add: in_failures)\ndone\n\nlemma failures_Proc_T_rec: \n  \"(s, X) :f failures (Proc_T_rec n T) M ==> s :t T\"\nby (simp add: failures_Proc_T_rec_lm)\n\nlemma failures_Proc_T_rec_T3: \n  \"[| (s, X) :f failures (Proc_T_rec n (fstF SF)) M ; noTick s |]\n   ==> (EX t. (s ^^^ t ^^^ <Tick>,Y) :f (sndF SF) & noTick t)\"\napply (insert failures_Proc_T_rec_noTick_lm[of X n M])\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"fstF SF\" in spec)\napply (simp)\napply (elim conjE exE)\napply (rule_tac x=\"t\" in exI)\napply (simp)\napply (simp add: appt_assoc_sym)\napply (simp add: pairF_domF_T3)\ndone\n\n(*** head T --> head F **)\n\nlemma head_traces_failures_noTick:\n  \"[| a : head_traces (fstF SF);\n     (s, X) :f failures (Proc_T_rec n (tail_traces (fstF SF) a)) M; noTick s|]\n   ==> a : head_failures (sndF SF)\"\napply (insert failures_Proc_T_rec_noTick_lm[of X n M])\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"tail_traces (fstF SF) a\" in spec)\napply (simp)\napply (elim conjE exE)\napply (simp add: in_tail_traces)\n\napply (simp add: head_failures_def)\napply (rule_tac x=\"s ^^^ t ^^^ <Tick>\" in exI)\napply (rule_tac x=\"X\" in exI)\napply (simp add: appt_assoc_sym)\napply (simp add: pairF_domF_T3)\ndone\n\n(*** head_traces_failures ***)\n\nlemma head_traces_failures:  (* not used *)\n  \"[| a : head_traces (fstF SF);\n     (s, X) :f failures (Proc_T_rec n (tail_traces (fstF SF) a)) M |]\n   ==> a : head_failures (sndF SF)\"\napply (case_tac \"noTick s\")\napply (simp add: head_traces_failures_noTick)\napply (simp add: noTick_def)\n\napply (simp add: Tick_in_sett)\napply (elim conjE exE)\n\napply (insert failures_Proc_T_rec_lm[of X n M])\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"tail_traces (fstF SF) a\" in spec)\n\napply (simp add: in_tail_traces)\napply (simp add: appt_assoc_sym)\n\napply (simp add: head_failures_def)\napply (rule_tac x=\"t ^^^ <Tick>\" in exI)\napply (rule_tac x=\"X\" in exI)\napply (simp add: appt_assoc_sym)\napply (simp add: pairF_domF_T3)\ndone\n\n(*----------------------------*\n |         Proc_T lemma       |\n *----------------------------*)\n\n(* traces(Proc_F_rec) => fst SF (lm) *)\n\nlemma Proc_F_to_T_lm:\n   \"ALL SF t. t :t traces (Proc_F_rec n SF) M --> t :t fstF SF\"\napply (induct_tac n)\n\n(* base *)\n apply (simp add: in_traces)\n apply (intro allI impI)\n apply (elim conjE exE)\n\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (simp)\n\n(* step *)\n apply (intro allI impI)\n apply (simp add: in_traces)\n apply (elim conjE exE disjE bexE)\n apply (simp_all)\n apply (drule_tac x=\"(tail_traces (fstF SF) a ,, tail_failures (sndF SF) a)\" in spec)\n apply (drule_tac x=\"s\" in spec)\n apply (simp)\n apply (simp add: tail_traces_failures_domF pairF_fstF)\n apply (simp add: in_tail_traces head_failures_traces)\ndone\n\n(* traces(Proc_F_rec) => fst SF *)\n\nlemma Proc_F_to_T:\n   \"t :t traces (Proc_F_rec n SF) M ==> t :t fstF SF\"\nby (simp add: Proc_F_to_T_lm)\n\n(* traces(Proc_F_rec) => fst SF (lm) *)\n\nlemma Proc_T_to_F_lm:\n   \"ALL SF s X.\n    (s, X) :f failures (Proc_T_rec n (fstF SF)) M --> (s, X) :f sndF SF\"\napply (induct_tac n)\n\n(* base *)\n apply (simp add: in_failures)\n\n(* step *)\n apply (intro allI impI)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE bexE)\n apply (simp_all)\n\n  apply (drule_tac x=\"(tail_traces (fstF SF) a ,, tail_failures (sndF SF) a)\" in spec)\n  apply (drule_tac x=\"sa\" in spec)\n  apply (drule_tac x=\"X\" in spec)\n  apply (simp add: tail_traces_failures_domF pairF_fstF)\n  apply (simp add: tail_traces_failures_domF pairF_sndF)\n  apply (simp add: in_tail_failures)\n\n  apply (simp add: in_traces)\n  apply (simp add: in_traces)\n\n  apply (case_tac \"<Tick> :t fstF SF\")\n   apply (simp add: in_failures)\n   apply (erule disjE)\n    apply (simp add: pairF_domF_F2_F4)\n    apply (simp add: pairF_domF_T3_Tick)\n\n  apply (simp add: in_failures)\ndone\n\n(* traces(Proc_F_rec) => fst SF *)\n\nlemma Proc_T_to_F:\n  \"(s, X) :f failures (Proc_T_rec n (fstF SF)) M ==> (s, X) :f sndF SF\"\nby (simp add: Proc_T_to_F_lm)\n\n(* failures(Proc_F_rec) => snd SF (lm) *)\n\nlemma Proc_F_to_F_lm:\n   \"ALL SF s X. (s, X) :f failures (Proc_F_rec n SF) M --> (s, X) :f sndF SF\"\napply (induct_tac n)\n\n(* base *)\n apply (simp add: in_failures)\n apply (intro allI impI)\n apply (elim conjE exE)\n apply (rule memF_F2)\n apply (simp)\n apply (simp add: Evset_def)\n apply (blast)\n\n(* step *)\n apply (intro allI impI)\n apply (simp add: in_failures)\n\n apply (elim conjE exE bexE disjE)\n apply (simp_all)\n\n  apply (drule_tac x=\"(tail_traces (fstF SF) a ,, tail_failures (sndF SF) a)\" in spec)\n  apply (drule_tac x=\"sa\" in spec)\n  apply (drule_tac x=\"X\" in spec)\n  apply (simp add: tail_traces_failures_domF pairF_fstF)\n  apply (simp add: tail_traces_failures_domF pairF_sndF)\n  apply (simp add: head_tail_failures)\n\n  apply (simp add: in_traces)\n  apply (simp add: in_traces)\ndone\n\nlemma Proc_F_to_F:\n   \"(s, X) :f failures (Proc_F_rec n SF) M ==> (s, X) :f sndF SF\"\nby (simp add: Proc_F_to_F_lm)\n\n(* sndF SF => failures (Proc_F_rec) lm *)\n\nlemma F_Proc_F_lm:\n   \"ALL SF X. ((s, X) :f sndF SF & noTick s & (Tick : X | s ^^^ <Tick> ~:t fstF SF))\n             --> (s, X) :f failures (Proc_F_rec (lengtht s) SF) M\"\napply (induct_tac s rule: induct_trace)\n\n (* <> *)\n apply (intro allI impI)\n apply (simp add: in_failures)\n apply (rule_tac x=\"{a. Ev a ~: X & <Ev a> :t fstF SF}\" in exI)\n apply (rule)\n\n  apply (elim conjE)\n  apply (erule disjE)\n\n   (* Tick : X *)\n   apply (rule_tac x=\"X Un {(Ev a)|a. <Ev a> ~:t fstF SF}\" in exI)\n   apply (simp)\n   apply (rule)\n\n    apply (rule pairF_domF_F3)\n     apply (simp)\n     apply (simp)\n     apply (force)\n    apply (simp add: Evset_def not_Tick_to_Ev)\n    apply (force)\n\n   (* <Tick> ~:t fstF SF *)\n   apply (rule_tac x=\"X Un ({Tick} Un {(Ev a)|a. <Ev a> ~:t fstF SF})\" in exI)\n   apply (rule)\n\n    apply (rule pairF_domF_F3)\n     apply (simp)\n     apply (simp)\n     apply (force)\n\n    apply (simp add: Evset_def not_Tick_to_Ev)\n    apply (force)\n    apply (force)\n\n (* <Tick> *)\n apply (simp)\n\n (* <Ev a> ^^^ s *)\n apply (intro allI impI)\n apply (simp add: in_failures)\n apply (simp add: head_tail_failures)\n\n apply (drule_tac x=\"(tail_traces (fstF SF) a ,, tail_failures (sndF SF) a)\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp add: tail_traces_failures_domF pairF_fstF pairF_sndF)\n apply (elim conjE exE disjE)\n apply (simp)\n\n apply (simp add: appt_assoc)\n apply (simp add: head_failures_traces head_tail_traces)\ndone\n\n(* sndF SF => failures (Proc_F_rec) *)\n\nlemma F_Proc_F:\n   \"[| (s, X) :f sndF SF ; noTick s ; Tick : X | s ^^^ <Tick> ~:t fstF SF |]\n    ==> (s, X) :f failures (Proc_F_rec (lengtht s) SF) M\"\nby (simp add: F_Proc_F_lm)\n\n(* sndF SF => failures (Proc_T_rec) (noTick) lm *)\n\ndeclare lengtht_app_event_Suc_head [simp del]\ndeclare lengtht_app_decompo1       [simp del]\ndeclare lengtht_app_decompo2       [simp del]\ndeclare Proc_T_rec.simps            [simp del]\n\nlemma F_Proc_T_noTick_lm:\n   \"ALL SF X. (s, X) :f sndF SF & noTick s & Tick ~: X & s ^^^ <Tick> :t fstF SF\n    --> (s, X) :f failures (Proc_T_rec (Suc (lengtht s)) (fstF SF)) M\"\napply (induct_tac s rule: induct_trace)\n\n (* <> *)\n apply (intro allI impI)\n apply (simp add: Proc_T_rec.simps in_failures)\n apply (simp add: Evset_def)\n apply (fast)\n\n (* <Tick> *)\n apply (intro allI impI)\n apply (simp add: Proc_T_rec.simps in_failures)\n\n (* <Ev a> ^^^ s *)\n apply (intro allI impI)\n apply (simp (no_asm) add: Proc_T_rec.simps)\n apply (simp add: in_failures)\n apply (elim conjE)\n apply (simp add: appt_assoc)\n apply (simp add: head_tail_traces)\n\n apply (drule_tac x=\"(tail_traces (fstF SF) a ,, tail_failures (sndF SF) a)\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp)\n apply (elim conjE)\n apply (simp add: tail_traces_failures_domF pairF_fstF pairF_sndF)\n apply (simp add: head_tail_failures)\n apply (simp add: lengtht_app_event_Suc_head)\ndone\n\n(* sndF SF => failures (Proc_T_rec) noTick *)\n\nlemma F_Proc_T_noTick:\n   \"[| (s, X) :f sndF SF ; noTick s ; Tick ~: X ; s ^^^ <Tick> :t fstF SF |]\n    ==> (s, X) :f failures (Proc_T_rec (Suc (lengtht s)) (fstF SF)) M\"\nby (simp add: F_Proc_T_noTick_lm)\n\ndeclare lengtht_app_event_Suc_head [simp]\ndeclare lengtht_app_decompo1       [simp]\ndeclare lengtht_app_decompo2       [simp]\ndeclare Proc_T_rec.simps            [simp]\n\n(* sndF SF => failures (Proc_T_rec) (Tick) lm *)\n\nlemma F_Proc_T_Tick_lm:\n   \"ALL SF X. ((s, X) :f sndF SF & ~ noTick s)\n    --> (s, X) :f failures (Proc_T_rec (lengtht s) (fstF SF)) M\"\napply (induct_tac s rule: induct_trace)\n\n (* <> *)\n apply (intro allI impI)\n apply (simp add: in_failures)\n\n (* <Tick> *)\n apply (intro allI impI)\n apply (simp add: in_failures)\n apply (simp add: pairF_domF_T2)\n\n (* <Ev a> ^^^ s *)\n apply (intro allI impI)\n apply (simp add: in_failures)\n apply (elim conjE)\n apply (simp add: head_tail_failures)\n\n apply (drule_tac x=\"(tail_traces (fstF SF) a ,, tail_failures (sndF SF) a)\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp add: tail_traces_failures_domF pairF_fstF pairF_sndF)\n apply (elim conjE)\n apply (simp add: head_failures_traces)\ndone\n\n(* sndF SF => failures (Proc_T_rec) noTick *)\n\nlemma F_Proc_T_Tick:\n   \"[| (s, X) :f sndF SF; ~ noTick s |]\n           ==> (s, X) :f failures (Proc_T_rec (lengtht s) (fstF SF)) M\"\nby (simp add: F_Proc_T_Tick_lm)\n\n(*==================================================*\n |                Proc_F lemma (main)               |\n *==================================================*)\n\nlemma semF_Proc_F: \"[[ Proc_F SF ]]Ff M = SF\"\napply (simp add: Proc_F_def)\napply (rule order_antisym)\n\n (* <= *)\n apply (simp add: subdomF_decompo)\n apply (rule conjI)\n\n  (* Proc <= fstF SF *)\n  apply (rule)\n  apply (simp add: in_traces)\n  apply (simp add: semT_Proc_T[simplified semTf_def])\n  apply (erule disjE, simp)\n  apply (erule disjE, simp)\n  apply (elim conjE exE)\n  apply (simp add: Proc_F_to_T)\n\n  (* Proc <= sndF SF *)\n  apply (rule)\n  apply (simp add: in_failures)\n  apply (erule disjE)\n\n   (* Proc T <= sndF SF *)\n   apply (simp add: Proc_T_def)\n   apply (simp add: in_failures)\n   apply (erule exE)\n   apply (simp add: Proc_T_to_F)\n\n   (* Proc F <= sndF SF *)\n   apply (erule exE)\n   apply (simp add: Proc_F_to_F)\n\n (* <= *)\n apply (simp add: subdomF_decompo)\n apply (rule conjI)\n\n  (* fstF SF <= Proc *)\n  apply (rule)\n  apply (simp add: in_traces)\n  apply (simp add: semT_Proc_T[simplified semTf_def])\n\n  (* sndF SF <= Proc *)\n  apply (rule)\n  apply (simp add: in_failures)\n  apply (case_tac \"noTick s & (Tick : X | s ^^^ <Tick> ~:t fstF SF)\")\n   apply (rule disjI2)\n   apply (rule_tac x=\"lengtht s\" in exI)\n   apply (simp add: F_Proc_F)\n\n   apply (simp)\n   apply (rule disjI1)\n   apply (simp add: Proc_T_def)\n   apply (simp add: in_failures)\n   apply (case_tac \"noTick s\")\n\n    (* noTick s & s ^^^ <Tick> :t fstF SF *)\n    apply (simp)\n    apply (rule_tac x=\"Suc (lengtht s)\" in exI)\n    apply (simp add: F_Proc_T_noTick del: Proc_T_rec.simps)\n\n    (* ~ noTick s *)\n    apply (rule_tac x=\"lengtht s\" in exI)\n    apply (simp add: F_Proc_T_Tick)\ndone\n\n(*----------------------------*\n |   [[ ]]F is surjective     |\n *----------------------------*)\n\ntheorem EX_proc_domF: \"ALL SF. EX P::('p,'a) proc. [[P]]F = SF\"\napply (rule allI)\napply (rule_tac x=\"Proc_F SF\" in exI)\napply (simp add: semF_def semF_Proc_F)\ndone\n\ntheorem surj_domF: \"surj (%P::('p,'a) proc. [[P]]F)\"\napply (simp add: surj_def)\napply (rule allI)\napply (rule_tac x=\"Proc_F y\" in exI)\napply (simp add: semF_def semF_Proc_F)\ndone\n\n(*----------------------------*\n |   failures and Proc_F SF   |\n *----------------------------*)\n\nlemma failures_Proc_F: \"failures (Proc_F SF) M = sndF SF\"\napply (insert semF_Proc_F[of SF M])\napply (simp add: semFf_def)\napply (simp add: eqF_decompo)\ndone\n\n(*----------------------------*\n |    traces and Proc_F SF    |\n *----------------------------*)\n\nlemma make_failures_from_T:\n  \"(T , failures (Proc_T T) M) : domF\"\napply (subgoal_tac\n  \"(traces (Proc_T T) (fstF o M) , failures (Proc_T T) M) : domF\")\napply (simp only: traces_Proc_T)\napply (simp)\ndone\n\nlemma traces_Proc_F: \"traces ((Proc_F SF)::('p,'a) proc) M = fstF SF\"\napply (insert semF_Proc_F[of SF \n  \"(%p. (traces ((Proc_T (M p))::('p,'a) proc) (fstF o M'),,failures(Proc_T (M p)) M'))\"])\napply (simp add: semFf_def)\napply (simp add: eqF_decompo)\napply (simp add: fstF_proc_domF_fun)\napply (simp add: traces_Proc_T)\ndone\n\nlemma traces_Proc_T_F:\n  \"traces (Proc_T (fstF SF)) M = traces (Proc_F SF) M\"\napply (simp add: traces_Proc_T)\napply (simp add: traces_Proc_F)\ndone\n\n(*==========================================================*\n |                                                          |\n |              Generic Internal Choice                     |\n |                                                          |\n *==========================================================*)\n\ndefinition\n  Gen_int_choice_F_plus ::\n    \"('p,'a) proc set => ('p,'a) proc\"    (\"(1|~~|F _)\" [900] 68) \n  where\n  Gen_int_choice_F_plus_def:\n        \"|~~|F Ps == Proc_F( (UnionT {(traces(P) (fstF o MF))|P. P:Ps},,\n                              UnionF {(failures(P) MF) |P. P:Ps}))\"\n\n(* lemmas *)\n\nlemma traces_Gen_int_choice_F_plus:\n   \"Ps ~= {} ==> traces ( |~~|F Ps ) M = (UnionT {(traces(P) (fstF o MF)) |P. P:Ps})\"\napply (simp add: Gen_int_choice_F_plus_def)\napply (simp add: traces_Proc_F)\napply (simp add: pairF non_empty_UnionT_UnionF_domF)\ndone\n\nlemma failures_Gen_int_choice_F_plus:\n   \"Ps ~= {} ==> failures ( |~~|F Ps ) M = (UnionF {(failures(P) MF) |P. P:Ps})\"\napply (simp add: Gen_int_choice_F_plus_def)\napply (simp add: failures_Proc_F)\napply (simp add: pairF non_empty_UnionT_UnionF_domF)\ndone\n\nlemma semF_Gen_int_choice_F_plus:\n   \"Ps ~= {} ==> [[ |~~|F Ps ]]F = \n                 (UnionT {(traces(P) (fstF o MF)) |P. P:Ps}  ,, \n                 (UnionF {(failures(P) MF) |P. P:Ps}))\"\napply (simp add: semF_def semFf_def)\napply (simp add: traces_Gen_int_choice_F_plus failures_Gen_int_choice_F_plus)\ndone\n\nlemma in_traces_Gen_int_choice_F_plus:\n   \"Ps ~= {} ==> t :t traces ( |~~|F Ps ) M = (EX P:Ps. t :t traces(P) (fstF o MF))\"\napply (simp add: traces_Gen_int_choice_F_plus)\napply (subgoal_tac \"{(traces P) |P. P : Ps} ~= {}\")\napply (auto)\ndone\n\nlemma in_failures_Gen_int_choice_F_plus:\n   \"Ps ~= {} ==> f :f failures ( |~~|F Ps ) M = (EX P:Ps. f :f failures(P) MF)\"\napply (simp add: failures_Gen_int_choice_F_plus)\napply (subgoal_tac \"{(traces P) |P. P : Ps} ~= {}\")\napply (auto)\ndone\n\n(****************** to add them again ******************)\n\ndeclare disj_not1   [simp]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_surj.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3370528905460492}}
{"text": "(*  Title:       Jive Data and Store Model\n    Author:      Norbert Schirmer <schirmer at informatik.tu-muenchen.de>  and  \n                 Nicole Rauch <rauch at informatik.uni-kl.de>, 2005\n    Maintainer:  Nicole Rauch <rauch at informatik.uni-kl.de>\n    License:     LGPL\n*)\n\nheader {* The Direct Subtype Relation of Java Types *}\n\ntheory DirectSubtypes\nimports \"../Isabelle/JavaType\"\nbegin\n\ntext {*\nIn this theory, we formalize the direct subtype relations of the Java types (as defined\nin Sec. \\ref{java_typeid_definitions}) that appear in the program to be verified. Thus, this\ntheory has to be generated for each program.\n\\label{direct_subtype_relations}\n*}\n\ntext {* We have the following type hierarchy:\n\\begin{center}\n\\includegraphics[width=13cm]{TypeHierarchy}\n\\end{center}\nWe need to describe all direct subtype relations of this  type hierarchy.\nAs you can see in the picture, all unnecessary direct subtype relations can be\nignored, e.g. the subclass relation between CounterImpl and Object, because it is \nadded\ntransitively by the widening relation of types (see Sec. \\ref{widening_subtypes}).\n*}\n\ntext {*\nWe have to specify the direct subtype relation between\n\\begin{itemize}\n\\item each ``leaf'' class or interface and its subtype \\texttt{NullT}\n\\item each ``root'' class or interface and its supertype \\texttt{Object}\n\\item each two types that are direct subtypes as specified in the code by\n\\texttt{extends} or \\texttt{implements}\n\\item each array type of a primitive type and its subtype \\texttt{NullT}\n\\item each array type of a primitive type and its supertype \\texttt{Object}\n\\item each array type of a ``leaf'' class or interface and its subtype \\texttt{NullT}\n\\item the array type \\texttt{Object[]} and its supertype \\texttt{Object}\n\\item two array types if their element types are in a subtype hierarchy\n\\end{itemize}\n*}\n\ndefinition direct_subtype :: \"(Javatype * Javatype) set\" where\n\"direct_subtype =\n{ (NullT, AClassT Dummy),\n  (NullT, CClassT UndoCounter), \n  (NullT, CClassT NullPointerException),\n  (NullT, CClassT ClassCastException),\n\n  (AClassT Dummy, CClassT Object),\n  (InterfaceT Counter, CClassT Object),\n  (CClassT Exception, CClassT Object), \n\n  (CClassT UndoCounter, CClassT CounterImpl), \n  (CClassT CounterImpl, InterfaceT Counter),\n  (CClassT NullPointerException, CClassT Exception),\n  (CClassT ClassCastException, CClassT Exception),\n\n  (NullT, ArrT BoolAT),\n  (NullT, ArrT IntgAT),\n  (NullT, ArrT ShortAT),\n  (NullT, ArrT ByteAT),\n  (ArrT BoolAT,  CClassT Object),\n  (ArrT IntgAT,  CClassT Object),\n  (ArrT ShortAT, CClassT Object),\n  (ArrT ByteAT,  CClassT Object),\n\n  (NullT, ArrT (AClassAT Dummy)),\n  (NullT, ArrT (CClassAT UndoCounter)),\n  (NullT, ArrT (CClassAT NullPointerException)),\n  (NullT, ArrT (CClassAT ClassCastException)),\n\n  (ArrT (CClassAT Object),      CClassT Object),\n\n  (ArrT (AClassAT Dummy),       ArrT (CClassAT Object)),\n  (ArrT (CClassAT CounterImpl), ArrT (InterfaceAT Counter)), \n  (ArrT (InterfaceAT Counter),  ArrT (CClassAT Object)),\n  (ArrT (CClassAT Exception),   ArrT (CClassAT Object)), \n  (ArrT (CClassAT UndoCounter), ArrT (CClassAT CounterImpl)), \n  (ArrT (CClassAT NullPointerException), ArrT (CClassAT Exception)),\n  (ArrT (CClassAT ClassCastException),   ArrT (CClassAT Exception))\n}\"\n\ntext {* This lemma is used later in the Simplifier. *}\n\nlemma direct_subtype:\n  \"(NullT, AClassT Dummy) \\<in> direct_subtype\"\n  \"(NullT, CClassT UndoCounter) \\<in> direct_subtype\" \n  \"(NullT, CClassT NullPointerException) \\<in> direct_subtype\"\n  \"(NullT, CClassT ClassCastException) \\<in> direct_subtype\"\n\n  \"(AClassT Dummy, CClassT Object) \\<in> direct_subtype\"\n  \"(InterfaceT Counter, CClassT Object) \\<in> direct_subtype\"\n  \"(CClassT Exception, CClassT Object) \\<in> direct_subtype\" \n\n  \"(CClassT UndoCounter, CClassT CounterImpl) \\<in> direct_subtype\" \n  \"(CClassT CounterImpl, InterfaceT Counter) \\<in> direct_subtype\"\n  \"(CClassT NullPointerException, CClassT Exception) \\<in> direct_subtype\"\n  \"(CClassT ClassCastException, CClassT Exception) \\<in> direct_subtype\"\n\n  \"(NullT, ArrT BoolAT) \\<in> direct_subtype\"\n  \"(NullT, ArrT IntgAT) \\<in> direct_subtype\"\n  \"(NullT, ArrT ShortAT) \\<in> direct_subtype\"\n  \"(NullT, ArrT ByteAT) \\<in> direct_subtype\"\n  \"(ArrT BoolAT,  CClassT Object) \\<in> direct_subtype\"\n  \"(ArrT IntgAT,  CClassT Object) \\<in> direct_subtype\"\n  \"(ArrT ShortAT, CClassT Object) \\<in> direct_subtype\"\n  \"(ArrT ByteAT,  CClassT Object) \\<in> direct_subtype\"\n\n  \"(NullT, ArrT (AClassAT Dummy)) \\<in> direct_subtype\"\n  \"(NullT, ArrT (CClassAT UndoCounter)) \\<in> direct_subtype\"\n  \"(NullT, ArrT (CClassAT NullPointerException)) \\<in> direct_subtype\"\n  \"(NullT, ArrT (CClassAT ClassCastException)) \\<in> direct_subtype\"\n\n  \"(ArrT (CClassAT Object),      CClassT Object) \\<in> direct_subtype\"\n\n  \"(ArrT (AClassAT Dummy),       ArrT (CClassAT Object)) \\<in> direct_subtype\"\n  \"(ArrT (CClassAT CounterImpl), ArrT (InterfaceAT Counter)) \\<in> direct_subtype\" \n  \"(ArrT (InterfaceAT Counter),  ArrT (CClassAT Object)) \\<in> direct_subtype\"\n  \"(ArrT (CClassAT Exception),   ArrT (CClassAT Object)) \\<in> direct_subtype\" \n  \"(ArrT (CClassAT UndoCounter), ArrT (CClassAT CounterImpl)) \\<in> direct_subtype\" \n  \"(ArrT (CClassAT NullPointerException), ArrT (CClassAT Exception)) \\<in> direct_subtype\"\n  \"(ArrT (CClassAT ClassCastException),   ArrT (CClassAT Exception)) \\<in> direct_subtype\"\n  by (simp_all add: direct_subtype_def)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JiveDataStoreModel/Isa_Counter/DirectSubtypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3370528905460492}}
{"text": "section {*FUNCTION\\_\\_F\\_DPDA\\_EB\\_STD\\_\\_F\\_DPDA\\_ENFORCE\\_NONBLOCKINGNESS\\_STD*}\ntheory\n  FUNCTION__F_DPDA_EB_STD__F_DPDA_ENFORCE_NONBLOCKINGNESS_STD\n\nimports\n  PRJ_12_09__ENTRY\n\nbegin\n\ndefinition F_SDPDA_TO_LR1_STD__SpecInput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_TO_LR1_STD__SpecInput2 G \\<equiv>\n  valid_simple_dpda G\n  \\<and> \\<not> duplicate_marking G\"\n\ndefinition F_SDPDA_TO_LR1_STD__SpecOutput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> (('state, 'stack) DT_l2_l3_nonterminals, 'event) cfg option\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_TO_LR1_STD__SpecOutput2 Gi Go \\<equiv>\n  case Go of\n  None \\<Rightarrow> epdaS.marked_language Gi = {}\n  | Some Go' \\<Rightarrow>\n      valid_cfg Go'\n      \\<and> cfg_LRk Go' (Suc 0)\n      \\<and> epdaS.marked_language Gi = cfgSTD.marked_language Go'\n      \\<and> cfgSTD.Nonblockingness_branching Go'\n      \\<and> cfg_nonterminals Go' \\<subseteq> cfgSTD_Nonblockingness_nonterminals Go'\"\n\ndefinition F_CFG_EB__SpecInput2 :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> bool\"\n  where\n    \"F_CFG_EB__SpecInput2 G \\<equiv>\n  valid_cfg G\"\n\ndefinition F_CFG_EB__SpecOutput2 :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('nonterminal, 'event) cfg option\n  \\<Rightarrow> bool\"\n  where\n    \"F_CFG_EB__SpecOutput2 Gi Go \\<equiv>\n  case Go of\n  None \\<Rightarrow> cfgSTD.marked_language Gi = {}\n  | Some Go' \\<Rightarrow>\n      valid_cfg Go'\n      \\<and> cfg_nonterminals Go' = cfgSTD_Nonblockingness_nonterminals Go'\n      \\<and> cfgSTD.marked_language Gi = cfgSTD.marked_language Go'\n      \\<and> cfg_sub Go' Gi\n      \\<and> nonblockingness_language (cfgSTD.unmarked_language Go') (cfgSTD.marked_language Go')\n      \\<and> cfgSTD.Nonblockingness_branching Go'\"\n\ndefinition F_SDPDA_TO_CFG_STD__SpecInput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_TO_CFG_STD__SpecInput2 G \\<equiv>\n  valid_simple_dpda G\n  \\<and> \\<not> duplicate_marking G\"\n\ndefinition F_SDPDA_TO_CFG_STD__SpecOutput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> (('state, 'stack) DT_l2_l3_nonterminals, 'event) cfg\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_TO_CFG_STD__SpecOutput2 Gi Go \\<equiv>\n  valid_cfg Go\n  \\<and> Go = F_SDPDA_TO_CFG_STD Gi\n  \\<and> epdaS.marked_language Gi = cfgSTD.marked_language Go\"\n\ntheorem F_SDPDA_TO_CFG_STD__SOUND2_STD: \"\n  F_SDPDA_TO_CFG_STD__SpecInput2 G\n  \\<Longrightarrow> F_SDPDA_TO_CFG_STD__SpecOutput2 G (F_SDPDA_TO_CFG_STD G)\"\n  apply(simp add: F_SDPDA_TO_CFG_STD__SpecOutput2_def F_SDPDA_TO_CFG_STD__SpecInput2_def)\n  apply(rule conjI)\n   apply(rule F_SDPDA_TO_CFG_STD__makes_CFG)\n   apply(force)\n  apply(rule_tac\n      t=\"cfgSTD.marked_language (F_SDPDA_TO_CFG_STD G)\"\n      and s=\"cfgRM.marked_language (F_SDPDA_TO_CFG_STD G)\"\n      in ssubst)\n   prefer 2\n   apply(rule F_SDPDA_TO_CFG_STD__preserves_lang)\n   apply(force)\n  apply(rule CFG_lang_rm_lang_equal)\n  apply(rule F_SDPDA_TO_CFG_STD__makes_CFG)\n  apply(force)\n  done\n\ntheorem F_CFG_EB__SOUND2_STD: \"\n  F_CFG_EB__SpecInput2 G\n  \\<Longrightarrow> F_CFG_EB__SpecOutput2 G (F_CFG_EB G)\"\n  apply(simp add: F_CFG_EB__SpecInput2_def F_CFG_EB__SpecOutput2_def)\n  apply(case_tac \"F_CFG_EB G\")\n   apply(clarsimp)\n   apply (metis F_CFG_EB_None_implies_empty_lang)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(rule context_conjI)\n   apply(rename_tac a)(*strict*)\n   apply (metis F_CFG_EBSound3)\n  apply(rename_tac a)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule context_conjI)\n    apply(rename_tac a)(*strict*)\n    apply (metis F_CFG_EB_lang_eq)\n   apply(rename_tac a)(*strict*)\n   apply(subgoal_tac \"Nonblockingness (cfgSTD.unmarked_language a) (cfgSTD.marked_language a)\")\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(rule F_CFG_EB_makes_Nonblockingness)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac a)(*strict*)\n    apply(rule F_CFG_EB_makes_cfg_sub)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(rule context_conjI)\n    apply(rename_tac a)(*strict*)\n    apply(simp add: nonblockingness_language_def Nonblockingness_def)\n   apply(rename_tac a)(*strict*)\n   apply(rule F_CFG_EB_makes_Nonblockingness_id)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule F_CFG_EBSoundA)\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule F_CFG_EB_idemp1)\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(force)\n  done\n\ntheorem F_SDPDA_TO_LR1_STD__SOUND2_with_no_duplicate_marking: \"\n  F_SDPDA_TO_LR1_STD__SpecInput2 G\n  \\<Longrightarrow> F_SDPDA_TO_LR1_STD__SpecOutput2 G (F_SDPDA_TO_LR1_STD G)\"\n  apply(unfold F_SDPDA_TO_LR1_STD_def)\n  apply(simp add: F_CFG_TRIM_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      in F_SDPDA_TO_CFG_STD__SOUND2_STD)\n   apply(simp add: F_SDPDA_TO_CFG_STD__SpecInput2_def F_SDPDA_TO_LR1_STD__SpecInput2_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      G=\"F_SDPDA_TO_CFG_STD G\"\n      in F_CFG_EB__SOUND2_STD)\n   apply(simp add: F_CFG_EB__SpecInput2_def)\n   apply(simp add: F_SDPDA_TO_CFG_STD__SpecOutput2_def)\n  apply(simp add: F_SDPDA_TO_CFG_STD__SpecOutput2_def F_CFG_EB__SpecOutput2_def)\n  apply(case_tac \"F_CFG_EB (F_SDPDA_TO_CFG_STD G)\")\n   apply(clarsimp)\n   apply(simp add: F_SDPDA_TO_LR1_STD__SpecOutput2_def F_SDPDA_TO_LR1_STD__SpecInput2_def)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"a\"\n      in SOUND_FUN_CFGLMACX_STD)\n   apply(simp add: F_CFG_EASTD__SpecInput_def)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"a\"\n      in SOUND_FUN_CFGLMACX_STD)\n   apply(simp add: F_CFG_EASTD__SpecInput_def)\n  apply(rename_tac a)(*strict*)\n  apply(simp add: F_CFG_EASTD__SpecOutput_def F_SDPDA_TO_LR1_STD__SpecOutput2_def)\n  apply(rule conjI)\n   apply(rename_tac a)(*strict*)\n   apply(simp add: F_SDPDA_TO_LR1_STD__SpecInput2_def)\n   apply(rule_tac\n      G=\"G\"\n      in F_SDPDA_TO_CFG_STD__enforces_cfg_LRk)\n       apply(rename_tac a)(*strict*)\n       apply(force)\n      apply(rename_tac a)(*strict*)\n      apply(force)\n     apply(rename_tac a)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(rule_tac\n      b=\"a\"\n      in cfg_sub_trans)\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac a)(*strict*)\n   apply(rule_tac\n      t=\"cfgSTD.marked_language a\"\n      and s=\"cfgLM.marked_language a\"\n      in ssubst)\n    apply(rename_tac a)(*strict*)\n    apply (metis CFG_lang_lm_lang_equal)\n   apply(rename_tac a)(*strict*)\n   apply(rule_tac\n      t=\"cfgLM.marked_language a\"\n      and s=\"cfgLM.marked_language (F_CFG_EASTD a)\"\n      in ssubst)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(rule_tac\n      t=\"cfgLM.marked_language (F_CFG_EASTD a)\"\n      and s=\"cfgSTD.marked_language (F_CFG_EASTD a)\"\n      in ssubst)\n    apply(rename_tac a)(*strict*)\n    apply (metis CFG_lang_lm_lang_equal)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(rule CFG_Nonblockingness_intro)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply (metis reachable_and_eliminiable_implies_eliminable2 reachable_and_eliminiable_implies_reachable)\n  done\n\ndefinition F_DPDA_EB_STD__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__SpecInput G \\<equiv>\n  valid_dpda G\"\n\ndefinition F_DPDA_EB_STD__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda option\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__SpecOutput Gi Go \\<equiv>\n  case Go of\n  None \\<Rightarrow> epdaS.marked_language Gi = {}\n  | Some Go' \\<Rightarrow>\n      valid_dpda Go'\n      \\<and> epdaS.marked_language Gi = epdaS.marked_language Go'\n      \\<and> nonblockingness_language (epdaS.unmarked_language Go') (epdaS.marked_language Go')\n      \\<and> epdaS.accessible Go'\n      \\<and> \\<not> epdaH_livelock Go'\"\n\ndefinition F_DPDA_TO_SDPDA__SpecInput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_TO_SDPDA__SpecInput2 G \\<equiv>\n  valid_dpda G\"\n\ndefinition F_DPDA_TO_SDPDA__SpecOutput2 :: \"\n  ('stateA, 'event, 'stack) epda\n  \\<Rightarrow> ('stateB, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_TO_SDPDA__SpecOutput2 Gi Go \\<equiv>\n  valid_simple_dpda Go\n  \\<and> epdaS.marked_language Gi = epdaS.marked_language Go\"\n\ntheorem F_DPDA_TO_SDPDA__SOUND2_STD: \"\n  F_DPDA_TO_SDPDA__SpecInput2 G\n  \\<Longrightarrow> F_DPDA_TO_SDPDA__SpecOutput2 G (F_DPDA_TO_SDPDA G)\"\n  apply(simp add: F_DPDA_TO_SDPDA__SpecInput2_def F_DPDA_TO_SDPDA__SpecOutput2_def)\n  apply(rule conjI)\n   apply (metis F_DPDA_TO_SDPDA_makes_SDPDA)\n  apply (metis F_DPDA_TO_SDPDA_preserves_language)\n  done\n\ndefinition F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecInput G \\<equiv>\n  valid_simple_dpda G\"\n\ndefinition F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecOutput :: \"\n  ('stateA, 'event, 'stack) epda\n  \\<Rightarrow> ('stateB, 'event, 'stack) epda option\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecOutput G1 G2 \\<equiv>\n  F_DPDA_EB_STD__SpecOutput G1 G2\"\n\ndefinition F_SDPDA_EUME__SpecInput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_EUME__SpecInput2 G \\<equiv>\n  valid_simple_dpda G\"\n\ndefinition F_SDPDA_EUME__SpecOutput2 :: \"\n  ('stateA, 'event, 'stack) epda\n  \\<Rightarrow> ('stateB, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_EUME__SpecOutput2 Gi Go \\<equiv>\n  valid_simple_dpda Go\n  \\<and> epdaS.marked_language Gi = epdaS.marked_language Go\n  \\<and> \\<not> duplicate_marking Go\"\n\ndefinition F_DPDA_EB_STD__F_SDPDA_EUME__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_SDPDA_EUME__SpecInput G \\<equiv>\n  valid_simple_dpda G\n  \\<and> \\<not> duplicate_marking G\"\n\ndefinition F_DPDA_EB_STD__F_SDPDA_EUME__SpecOutput :: \"\n  ('stateA, 'event, 'stack) epda\n  \\<Rightarrow> ('stateB, 'event, 'stack) epda option\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_SDPDA_EUME__SpecOutput G1 G2 \\<equiv>\n  F_DPDA_EB_STD__SpecOutput G1 G2\"\n\ntheorem F_SDPDA_EUME__SOUND2_STD: \"\n  F_SDPDA_EUME__SpecInput2 G\n  \\<Longrightarrow> F_SDPDA_EUME__SpecOutput2 G (F_SDPDA_EUME G)\"\n  apply(simp add: F_SDPDA_EUME__SpecInput2_def F_SDPDA_EUME__SpecOutput2_def)\n  apply(rule conjI)\n   apply (metis F_SDPDA_EUME__preserves_SDPDA)\n  apply(rule conjI)\n   apply(rule F_SDPDA_EUME__preserves_lang)\n   apply(force)\n  apply (metis F_SDPDA_EUME__no_duplicate_marking)\n  done\n\ndefinition F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecInput :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecInput G \\<equiv>\n  valid_cfg G\n  \\<and> cfg_LRk G (Suc 0)\n  \\<and> cfgSTD.Nonblockingness_branching G\n  \\<and> cfg_nonterminals G \\<subseteq> cfgSTD_Nonblockingness_nonterminals G\"\n\ndefinition F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecOutput :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecOutput Gi Go \\<equiv>\n  valid_dpda Go\n  \\<and> cfgSTD.marked_language Gi = epdaS.marked_language Go\n  \\<and> nonblockingness_language (epdaS.unmarked_language Go) (epdaS.marked_language Go)\n  \\<and> epdaS.accessible Go\n  \\<and> \\<not> epdaH_livelock Go\"\n\ndefinition F_DPDA_EB_STD__F_CFG_TC__SpecInput :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_CFG_TC__SpecInput G \\<equiv>\n  valid_cfg G\n  \\<and> cfgSTD.Nonblockingness_branching G\n  \\<and> cfg_nonterminals G \\<subseteq> cfgSTD_Nonblockingness_nonterminals G\n  \\<and> cfg_LRk G (Suc 0)\"\n\ndefinition F_DPDA_EB_STD__F_CFG_TC__SpecOutput :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_CFG_TC__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecOutput Gi Go\"\n\ndefinition F_DPDA_EB_STD__F_LR_PARSER__SpecInput :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_LR_PARSER__SpecInput G \\<equiv>\n  valid_bounded_parser G (Suc 0)\n  \\<and> parserFS.is_forward_edge_deterministic_accessible G\n  \\<and> nonblockingness_language (parserS.unmarked_language G) (parserS.marked_language G)\n  \\<and> (\\<forall>r\\<in> parser_rules G. rule_rpop r \\<noteq> [])\n  \\<and> parser_no_access_final_with_read G\n  \\<and> can_detect_parser_bottom_only_in_Nonblockingness_configurations G\n  \\<and> parser_initial G \\<notin> parser_marking G\"\n\ndefinition F_DPDA_EB_STD__F_LR_PARSER__SpecOutput :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('state, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_LR_PARSER__SpecOutput Gi Go \\<equiv>\n  valid_dpda Go\n  \\<and> parserS.marked_language Gi = epdaS.marked_language Go\n  \\<and> nonblockingness_language (epdaS.unmarked_language Go) (epdaS.marked_language Go)\n  \\<and> epdaS.accessible Go\n  \\<and> \\<not> epdaH_livelock Go\"\n\ndefinition F_DPDA_EB_STD__F_PARSER_RITU__SpecInput :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_PARSER_RITU__SpecInput G \\<equiv>\n  valid_bounded_parser G (Suc 0)\n  \\<and> parserFS.is_forward_edge_deterministic_accessible G\n  \\<and> nonblockingness_language (parserS.unmarked_language G) (parserS.marked_language G)\n  \\<and> parser_not_observes_input_terminator G\n  \\<and> (\\<forall>r\\<in> parser_rules G. rule_rpop r \\<noteq> [])\"\n\ndefinition F_DPDA_EB_STD__F_PARSER_RITU__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) parser\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_PARSER_RITU__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_STD__F_LR_PARSER__SpecOutput Gi Go\"\n\ndefinition F_DPDA_EB_STD__F_PARSER_RTR__SpecInput :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_PARSER_RTR__SpecInput G \\<equiv>\n  valid_bounded_parser G (Suc 0)\n  \\<and> parserFS.is_forward_edge_deterministic_accessible G\n  \\<and> nonblockingness_language (parserS.unmarked_language G) (parserS.marked_language G)\n  \\<and> parser_not_observes_input_terminator G\n  \\<and> parser_no_top_rules G\n  \\<and> parser_no_empty_steps_from_marking_states G\"\n\ndefinition F_DPDA_EB_STD__F_PARSER_RTR__SpecOutput :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('state, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_PARSER_RTR__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_STD__F_LR_PARSER__SpecOutput Gi Go\"\n\ndefinition F_DPDA_EB_STD__F_PARSER_TC__SpecInput :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_PARSER_TC__SpecInput G \\<equiv>\n  valid_bounded_parser G (Suc 0)\n  \\<and> parserFS.is_forward_edge_deterministic_accessible G\n  \\<and> parser_not_observes_input_terminator G\n  \\<and> nonblockingness_language (parserS.unmarked_language G) (parserS.marked_language G)\n  \\<and> parser_no_top_rules G\n  \\<and> parser_no_empty_steps_from_marking_states G\"\n\ndefinition F_DPDA_EB_STD__F_PARSER_TC__SpecOutput :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('state, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_PARSER_TC__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_STD__F_LR_PARSER__SpecOutput Gi Go\"\n\ndefinition F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecInput G \\<equiv>\n  valid_epda G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epdaS.is_forward_edge_deterministic_accessible G\n  \\<and> epda_no_empty_steps_from_marking_states G\"\n\ndefinition F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecOutput :: \"\n  ('state, 'event, 'stackA) epda\n  \\<Rightarrow> ('state, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_STD__SpecOutput Gi (Some Go)\"\n\ndefinition F_EDPDA_TO_DPDA__SpecInput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_EDPDA_TO_DPDA__SpecInput2 G \\<equiv>\n  valid_epda G\n  \\<and> epdaS.is_forward_edge_deterministic_accessible G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epda_no_empty_steps_from_marking_states G\"\n\ndefinition F_EDPDA_TO_DPDA__SpecOutput2 :: \"\n  ('stateA, 'event, 'stack) epda\n  \\<Rightarrow> ('stateB, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_EDPDA_TO_DPDA__SpecOutput2 Gi Go \\<equiv>\n  valid_dpda Go\n  \\<and> epdaS.marked_language Gi = epdaS.marked_language Go\n  \\<and> nonblockingness_language (epdaS.unmarked_language Go) (epdaS.marked_language Go)\n  \\<and> epdaH_no_livelocks_from_marking_states Go\"\n\ndefinition F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecInput G \\<equiv>\n  valid_dpda G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epdaH_no_livelocks_from_marking_states G\"\n\ndefinition F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_STD__SpecOutput Gi (Some Go)\"\n\ntheorem F_EDPDA_TO_DPDA__SOUND2_STD: \"\n  F_EDPDA_TO_DPDA__SpecInput2 G\n  \\<Longrightarrow> F_EDPDA_TO_DPDA__SpecOutput2 G (F_EDPDA_TO_DPDA G)\"\n  apply(simp add: F_EDPDA_TO_DPDA__SpecOutput2_def F_EDPDA_TO_DPDA__SpecInput2_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply (metis F_EDPDA_TO_DPDA_makesDPDA)\n  apply(rule context_conjI)\n   apply (metis F_EDPDA_TO_DPDA_preservesLang)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(subgoal_tac \"epdaS.unmarked_language G = epdaS.unmarked_language (F_EDPDA_TO_DPDA G)\")\n    apply(force)\n   apply(rule F_EDPDA_TO_DPDA_preservesULang)\n    apply(force)\n   apply(force)\n  apply(rule F_EDPDA_TO_DPDA_generates_epdaH_no_livelocks_from_marking_states)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\ndefinition F_DPDA_EB_STD__F_DPDA_EA_OPT__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_DPDA_EA_OPT__SpecInput G \\<equiv>\n  valid_dpda G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epdaS.accessible G\n  \\<and> epdaH_no_livelocks_from_marking_states G\"\n\ndefinition F_DPDA_EB_STD__F_F_DPDA_EA_OPT__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_F_DPDA_EA_OPT__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_STD__SpecOutput Gi (Some Go)\"\n\ndefinition F_DPDA_EB_STD__F_EPDA_TC__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_EPDA_TC__SpecInput G \\<equiv>\n  valid_dpda G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epdaS.accessible G\n  \\<and> epdaH_no_livelocks_from_marking_states G\"\n\ndefinition F_DPDA_EB_STD__F_EPDA_TC__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_STD__F_EPDA_TC__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_STD__SpecOutput Gi (Some Go)\"\n\ndefinition F_LR_PARSER__SpecInput2 :: \"\n  ('nonterminal DT_symbol, 'event DT_symbol) cfg\n  \\<Rightarrow> ('nonterminal DT_symbol, 'event DT_symbol) cfg\n    \\<times> ('nonterminal DT_symbol, 'event DT_symbol) DT_first_function\n    \\<times> (('nonterminal DT_symbol, 'event DT_symbol) DT_cfg_item set,\n        ('nonterminal DT_symbol, 'event DT_symbol) DT_two_elements,\n        nat) epda\n    \\<times> nat\n    \\<times> 'event DT_symbol\n  \\<Rightarrow> bool\"\n  where\n    \"F_LR_PARSER__SpecInput2 G X \\<equiv>\n  case X of\n  (G', F, M, n, Do) \\<Rightarrow>\n    \\<exists>S'.\n      valid_cfg G\n      \\<and> cfgSTD_first_compatible F n\n      \\<and> cfg_nonterminals G \\<subseteq> cfgSTD_Nonblockingness_nonterminals G\n      \\<and> cfgSTD.Nonblockingness_branching G\n      \\<and> Do = F_FRESH (cfg_events G)\n      \\<and> S' = F_FRESH (cfg_nonterminals G)\n      \\<and> G' = F_CFG_AUGMENT G S' Do\n      \\<and> n = 1\n      \\<and> M = F_LR_MACHINE G' F n\n      \\<and> cfg_LRk G n\"\n\ndefinition F_LR_PARSER__SpecOutput2 :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_LR_PARSER__SpecOutput2 Gi Go \\<equiv>\n  valid_parser Go\n  \\<and> parserFS.is_forward_edge_deterministic_accessible Go\n  \\<and> cfgSTD.marked_language Gi = parserS.marked_language Go\n  \\<and> parser_initial Go \\<notin> parser_marking Go\n  \\<and> valid_bounded_parser Go 1\n  \\<and> nonblockingness_language (parserS.unmarked_language Go) (parserS.marked_language Go)\n  \\<and> (\\<forall>r \\<in> parser_rules Go. rule_rpop r \\<noteq> [])\n  \\<and> parser_no_access_final_with_read Go\n  \\<and> can_detect_parser_bottom_only_in_Nonblockingness_configurations Go\"\n\ntheorem F_LR_PARSER__SOUND2_STD: \"\n  F_LR_PARSER__SpecInput2 G (G', F, M, Suc 0, Do)\n  \\<Longrightarrow> F_LR_PARSER__SpecOutput2 G ((\\<lambda>G (G', F, M, k, Do). F_LR_PARSER G G' M Do) G (G', F, M, Suc 0, Do))\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule F_LR_PARSER__SOUND)\n   apply(simp add: F_LR_PARSER__SpecInput2_def F_LR_PARSER__SpecInput_def)\n  apply(simp add: F_LR_PARSER__SpecOutput2_def F_LR_PARSER__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_STD__SOUND: \"\n  F_DPDA_EB_STD__SpecInput G\n  \\<Longrightarrow> F_DPDA_EB_STD__SpecOutput G (F_DPDA_EB_STD G)\"\n  apply(simp add: F_DPDA_EB_STD_def)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__SpecOutput\"\n      and SPi_H=\"F_DPDA_TO_SDPDA__SpecInput2\"\n      and SPo_H=\"F_DPDA_TO_SDPDA__SpecOutput2\"\n      and H=\"F_DPDA_TO_SDPDA\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(force)\n      apply(simp add: F_DPDA_EB_STD__SpecInput_def F_DPDA_TO_SDPDA__SpecInput2_def)\n     apply(rule F_DPDA_TO_SDPDA__SOUND2_STD)\n     apply(force)\n    apply(simp add: F_DPDA_TO_SDPDA__SpecOutput2_def F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecInput_def)\n   apply(rename_tac P)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecOutput_def F_DPDA_EB_STD__SpecOutput_def F_DPDA_TO_SDPDA__SpecOutput2_def)\n   apply(clarsimp)\n   apply(case_tac \"P\")\n    apply(rename_tac P)(*strict*)\n    apply(force)\n   apply(rename_tac P a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_SDPDA_EUME__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_SDPDA_EUME__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecOutput\"\n      and SPi_H=\"F_SDPDA_EUME__SpecInput2\"\n      and SPo_H=\"F_SDPDA_EUME__SpecOutput2\"\n      and H=\"F_SDPDA_EUME\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac G)(*strict*)\n       apply(force)\n      apply(rename_tac G)(*strict*)\n      apply(simp add: F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecInput_def F_SDPDA_EUME__SpecInput2_def)\n     apply(rename_tac G)(*strict*)\n     apply(rule F_SDPDA_EUME__SOUND2_STD)\n     apply(force)\n    apply(rename_tac G)(*strict*)\n    apply(simp add: F_SDPDA_EUME__SpecOutput2_def F_DPDA_EB_STD__F_SDPDA_EUME__SpecInput_def)\n   apply(rename_tac G P)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__SpecOutput_def F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecOutput_def F_SDPDA_EUME__SpecOutput2_def F_DPDA_EB_STD__F_SDPDA_EUME__SpecOutput_def)\n   apply(clarsimp)\n   apply(case_tac \"P\")\n    apply(rename_tac G P)(*strict*)\n    apply(force)\n   apply(rename_tac G P a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_DPDA_TO_SDPDA__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga G)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac Ga G)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      in F_SDPDA_TO_LR1_STD__SOUND2_with_no_duplicate_marking)\n   apply(simp add: F_SDPDA_TO_LR1_STD__SpecInput2_def)\n   apply(rename_tac G)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__F_SDPDA_EUME__SpecInput_def)\n  apply(rename_tac Ga G)(*strict*)\n  apply(case_tac \"F_SDPDA_TO_LR1_STD G\")\n   apply(rename_tac Ga G)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__F_SDPDA_EUME__SpecOutput_def F_DPDA_EB_STD__SpecOutput_def F_DPDA_EB_STD__F_SDPDA_EUME__SpecInput_def)\n   apply(simp add: F_SDPDA_TO_LR1_STD__SpecOutput2_def)\n  apply(rename_tac Ga G a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G a)(*strict*)\n  apply(subgoal_tac \"F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecInput a\")\n   apply(rename_tac G a)(*strict*)\n   prefer 2\n   apply(simp add: F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecInput_def F_SDPDA_TO_LR1_STD__SpecOutput2_def F_DPDA_EB_STD__F_SDPDA_EUME__SpecInput_def)\n  apply(rename_tac G a)(*strict*)\n  apply(rule_tac\n      ?I1.0=\"F_DPDA_EB_STD__F_SDPDA_EUME__SpecInput\"\n      and a=\"a\"\n      and ?O1.0=\"F_DPDA_EB_STD__F_SDPDA_EUME__SpecOutput\"\n      and ?O2.0=\"F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecOutput\"\n      and ?O3.0=\"F_SDPDA_TO_LR1_STD__SpecOutput2\"\n      in decompose_simp)\n      apply(rename_tac G a)(*strict*)\n      prefer 5\n      apply(simp add: Let_def)\n     apply(rename_tac G a)(*strict*)\n     apply(force)\n    apply(rename_tac G a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac G a)(*strict*)\n   prefer 2\n   apply(rename_tac G a aa Ga F)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__SpecOutput_def F_DPDA_EB_STD__F_SDPDA_EUME__SpecOutput_def F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecOutput_def Let_def F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecInput_def F_DPDA_EB_STD__F_SDPDA_EUME__SpecInput_def F_SDPDA_TO_LR1_STD__SpecOutput2_def)\n  apply(rename_tac G a)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_SDPDA_EUME__SpecInput G\")\n  apply(thin_tac \"F_SDPDA_TO_LR1_STD__SpecOutput2 G (Some a)\")\n  apply(thin_tac \"F_SDPDA_TO_LR1_STD G = Some a\")\n  apply(rename_tac G)\n  apply(rename_tac Ga G)(*strict*)\n  apply(simp add: Let_def)\n  apply(rename_tac G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_CFG_TC__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_CFG_TC__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecOutput\"\n      and SPi_H=\"F_CFG_TC__SpecInput2\"\n      and SPo_H=\"F_CFG_TC__SpecOutput2\"\n      and H=\"F_CFG_TC\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac G)(*strict*)\n       apply(force)\n      apply(rename_tac G)(*strict*)\n      apply(simp add: F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecInput_def F_CFG_TC__SpecInput2_def)\n     apply(rename_tac G)(*strict*)\n     apply(rule F_CFG_TC__SOUND2)\n     apply(force)\n    apply(rename_tac G)(*strict*)\n    apply(simp add: F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecOutput_def F_DPDA_EB_STD__F_CFG_TC__SpecInput_def F_CFG_TC__SpecOutput2_def)\n   apply(rename_tac G P)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecOutput_def F_DPDA_EB_STD__F_CFG_TC__SpecInput_def F_CFG_TC__SpecOutput2_def F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecInput_def F_DPDA_EB_STD__F_CFG_TC__SpecOutput_def)\n  apply(rename_tac G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga G)(*strict*)\n  apply(rule_tac\n      t=\"F_LR_PARSER G (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F_CFG_FIRST (Suc 0)) (F_FRESH (cfg_events G))\"\n      and s=\" (\\<lambda>(G', F, M, n, Do). F_LR_PARSER G G' M Do) ((F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))), F_CFG_FIRST, (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F_CFG_FIRST (Suc 0)), (Suc 0), (F_FRESH (cfg_events G)))\"\n      in ssubst)\n   apply(rename_tac Ga G)(*strict*)\n   apply(force)\n  apply(rename_tac Ga G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and Y=\"((F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))), F_CFG_FIRST, (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F_CFG_FIRST (Suc 0)), (Suc 0), (F_FRESH (cfg_events G)))\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_LR_PARSER__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_LR_PARSER__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__F_CFG_TC__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__F_CFG_TC__SpecOutput\"\n      and SPi_H=\"F_LR_PARSER__SpecInput2\"\n      and SPo_H=\"F_LR_PARSER__SpecOutput2\"\n      and H=\"\\<lambda>G (G', F, M, n, Do). F_LR_PARSER G G' M Do\"\n      in decompose_sequential_execution_input_output_specification2_simp3)\n       apply(rename_tac Ga G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga G)(*strict*)\n      apply(simp add: F_DPDA_EB_STD__F_CFG_TC__SpecInput_def F_LR_PARSER__SpecInput2_def)\n      apply(simp add: cfgSTD_first_compatible_def)\n      apply(clarsimp)\n      apply(rule sym)\n      apply(rule F_CFG_FIRST__SOUND)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(rename_tac Ga G)(*strict*)\n     apply(rule F_LR_PARSER__SOUND2_STD)\n     apply(force)\n    apply(rename_tac Ga G)(*strict*)\n    apply(simp add: F_DPDA_EB_STD__F_LR_PARSER__SpecInput_def F_LR_PARSER__SpecOutput2_def)\n   apply(rename_tac Ga G P)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__F_CFG_TC__SpecOutput_def F_DPDA_EB_STD__F_SDPDA_TO_LR1_STD__SpecOutput_def)\n   apply(rename_tac G P)(*strict*)\n   apply(case_tac \"P\")\n   apply(rename_tac G P epda_states epda_events epda_gamma epda_delta epda_initial epda_box epda_marking)(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_DPDA_EB_STD__F_LR_PARSER__SpecOutput_def F_LR_PARSER__SpecOutput2_def F_DPDA_EB_STD__F_CFG_TC__SpecInput_def)\n  apply(rename_tac Ga G X)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_CFG_TC__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_PARSER_RITU__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_PARSER_RITU__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__F_LR_PARSER__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__F_LR_PARSER__SpecOutput\"\n      and SPi_H=\"F_PARSERRITU__SpecInput\"\n      and SPo_H=\"F_PARSERRITU__SpecOutput\"\n      and H=\"F_PARSER_RITU\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga G)(*strict*)\n      apply(simp add: F_DPDA_EB_STD__F_LR_PARSER__SpecInput_def F_PARSERRITU__SpecInput_def)\n     apply(rename_tac Ga G)(*strict*)\n     apply(rule F_PARSERRITU__SOUND)\n     apply(force)\n    apply(rename_tac Ga G)(*strict*)\n    apply(simp add: F_PARSERRITU__SpecOutput_def F_DPDA_EB_STD__F_PARSER_RITU__SpecInput_def)\n   apply(rename_tac Ga G P)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__F_LR_PARSER__SpecOutput_def F_DPDA_EB_STD__F_PARSER_RITU__SpecOutput_def F_PARSERRITU__SpecOutput_def)\n  apply(rename_tac Ga G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_LR_PARSER__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_PARSER_RTR__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_PARSER_RTR__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__F_PARSER_RITU__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__F_PARSER_RITU__SpecOutput\"\n      and SPi_H=\"F_PARSER_RTR__SpecInput\"\n      and SPo_H=\"F_PARSER_RTR__SpecOutput\"\n      and H=\"F_PARSER_RTR\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga Gb G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga Gb G)(*strict*)\n      apply(simp add: F_DPDA_EB_STD__F_PARSER_RITU__SpecInput_def F_PARSER_RTR__SpecInput_def)\n     apply(rename_tac Ga Gb G)(*strict*)\n     apply(rule F_PARSER_RTR__SOUND)\n     apply(force)\n    apply(rename_tac Ga Gb G)(*strict*)\n    apply(simp add: F_DPDA_EB_STD__F_PARSER_RTR__SpecInput_def F_PARSER_RTR__SpecOutput_def)\n   apply(rename_tac Ga Gb G P)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__F_PARSER_RITU__SpecOutput_def F_DPDA_EB_STD__F_LR_PARSER__SpecOutput_def F_DPDA_EB_STD__F_PARSER_RTR__SpecOutput_def F_PARSER_RTR__SpecOutput_def)\n  apply(rename_tac Ga Gb G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_PARSER_RITU__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb Gc G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_PARSER_TC__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_PARSER_TC__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__F_PARSER_RTR__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__F_PARSER_RTR__SpecOutput\"\n      and SPi_H=\"F_PARSER_TC__SpecInput\"\n      and SPo_H=\"F_PARSER_TC__SpecOutput\"\n      and H=\"F_PARSER_TC\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga Gb Gc G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga Gb Gc G)(*strict*)\n      apply(simp add: F_DPDA_EB_STD__F_PARSER_RTR__SpecInput_def F_PARSER_TC__SpecInput_def)\n     apply(rename_tac Ga Gb Gc G)(*strict*)\n     apply(rule F_PARSER_TC__SOUND)\n     apply(force)\n    apply(rename_tac Ga Gb Gc G)(*strict*)\n    apply(simp add: F_DPDA_EB_STD__F_PARSER_TC__SpecInput_def F_PARSER_TC__SpecOutput_def)\n   apply(rename_tac Ga Gb Gc G P)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__F_PARSER_RTR__SpecInput_def F_PARSER_TC__SpecOutput_def F_DPDA_EB_STD__F_LR_PARSER__SpecOutput_def F_DPDA_EB_STD__F_PARSER_RTR__SpecOutput_def F_DPDA_EB_STD__F_PARSER_TC__SpecOutput_def)\n  apply(rename_tac Ga Gb Gc G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_PARSER_RTR__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb Gc Gd G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__F_PARSER_TC__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__F_PARSER_TC__SpecOutput\"\n      and SPi_H=\"F_PARSER_TO_EDPDA__SpecInput\"\n      and SPo_H=\"F_PARSER_TO_EDPDA__SpecOutput\"\n      and H=\"F_PARSER_TO_EDPDA\"\n      in decompose_sequential_execution_input_output_specification2_simp3)\n       apply(rename_tac Ga Gb Gc Gd G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga Gb Gc Gd G)(*strict*)\n      apply(simp add: F_DPDA_EB_STD__F_PARSER_TC__SpecInput_def F_PARSER_TO_EDPDA__SpecInput_def)\n      apply(rename_tac G)(*strict*)\n      apply(rule F_FRESH_is_fresh)\n      apply(simp add: valid_bounded_parser_def valid_parser_def)\n     apply(rename_tac Ga Gb Gc Gd G)(*strict*)\n     apply(rule F_PARSER_TO_EDPDA__SOUND)\n     apply(force)\n    apply(rename_tac Ga Gb Gc Gd G)(*strict*)\n    apply(simp add: F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecInput_def F_PARSER_TO_EDPDA__SpecOutput_def)\n   apply(rename_tac Ga Gb Gc Gd G P)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecOutput_def F_DPDA_EB_STD__F_PARSER_RTR__SpecInput_def F_PARSER_TC__SpecOutput_def F_DPDA_EB_STD__F_LR_PARSER__SpecOutput_def F_DPDA_EB_STD__F_PARSER_RTR__SpecOutput_def F_DPDA_EB_STD__F_PARSER_TC__SpecOutput_def)\n   apply(rename_tac G P)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__SpecOutput_def F_PARSER_TO_EDPDA__SpecOutput_def)\n  apply(rename_tac Ga Gb Gc Gd G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_PARSER_TC__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb Gc Gd Ge G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecOutput\"\n      and SPi_H=\"F_EDPDA_TO_DPDA__SpecInput2\"\n      and SPo_H=\"F_EDPDA_TO_DPDA__SpecOutput2\"\n      and H=\"F_EDPDA_TO_DPDA\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga Gb Gc Gd Ge G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga Gb Gc Gd Ge G)(*strict*)\n      apply(simp add: F_EDPDA_TO_DPDA__SpecInput2_def F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecInput_def)\n     apply(rename_tac Ga Gb Gc Gd Ge G)(*strict*)\n     apply(rule F_EDPDA_TO_DPDA__SOUND2_STD)\n     apply(force)\n    apply(rename_tac Ga Gb Gc Gd Ge G)(*strict*)\n    apply(simp add: F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecInput_def F_EDPDA_TO_DPDA__SpecOutput2_def)\n   apply(rename_tac Ga Gb Gc Gd Ge G P)(*strict*)\n   apply(simp add: F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecOutput_def F_DPDA_EB_STD__SpecOutput_def F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecOutput_def F_EDPDA_TO_DPDA__SpecOutput2_def F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecInput_def)\n  apply(rename_tac Ga Gb Gc Gd Ge G X)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_PARSER_TO_EDPDA__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_DPDA_EA_OPT__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_F_DPDA_EA_OPT__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecOutput\"\n      and SPi_H=\"F_DPDA_EA_STD__SpecInput\"\n      and SPo_H=\"F_DPDA_EA_STD__SpecOutput\"\n      and H=\"F_DPDA_EA_STD\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga G)(*strict*)\n      apply(simp add: F_DPDA_EA_STD__SpecInput_def F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecInput_def)\n     apply(rename_tac Ga G)(*strict*)\n     apply(rule F_DPDA_EA_STD__SOUND)\n     apply(force)\n    apply(rename_tac Ga G)(*strict*)\n    apply(simp add: F_DPDA_EB_STD__F_DPDA_EA_OPT__SpecInput_def F_DPDA_EA_STD__SpecOutput_def)\n   apply(rename_tac Ga G P)(*strict*)\n   apply(simp add: F_DPDA_EA_OPT__SpecOutput_def F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecInput_def F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecOutput_def F_DPDA_EB_STD__SpecOutput_def F_DPDA_EB_STD__F_F_DPDA_EA_OPT__SpecOutput_def F_DPDA_EA_STD__SpecOutput_def)\n  apply(rename_tac Ga G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_STD__F_EPDA_TC__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_STD__F_EPDA_TC__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_STD__F_DPDA_EA_OPT__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_STD__F_F_DPDA_EA_OPT__SpecOutput\"\n      and SPi_H=\"F_EPDA_TC__SpecInput2\"\n      and SPo_H=\"F_EPDA_TC__SpecOutput2\"\n      and H=\"F_EPDA_TC\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga Gb G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga Gb G)(*strict*)\n      apply(simp add: F_EPDA_TC__SpecInput2_def F_DPDA_EB_STD__F_DPDA_EA_OPT__SpecInput_def)\n     apply(rename_tac Ga Gb G)(*strict*)\n     apply(rule F_EPDA_TC__SOUND2)\n     apply(force)\n    apply(rename_tac Ga Gb G)(*strict*)\n    apply(simp add: F_DPDA_EB_STD__F_EPDA_TC__SpecInput_def F_EPDA_TC__SpecOutput2_def F_DPDA_EB_STD__F_DPDA_EA_OPT__SpecInput_def)\n   apply(rename_tac Ga Gb G P)(*strict*)\n   apply(simp add: F_DPDA_EA_STD__SpecOutput_def F_EPDA_TC__SpecOutput2_def F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecInput_def F_DPDA_EB_STD__F_EDPDA_TO_DPDA__SpecOutput_def F_DPDA_EB_STD__SpecOutput_def F_DPDA_EB_STD__F_F_DPDA_EA_OPT__SpecOutput_def F_DPDA_EB_STD__F_EPDA_TC__SpecOutput_def F_DPDA_EB_STD__F_DPDA_EA_OPT__SpecInput_def)\n  apply(rename_tac Ga Gb G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_STD__F_DPDA_EA_OPT__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb Gc G)(*strict*)\n  apply(simp add: F_DPDA_EB_STD__F_EPDA_TC__SpecInput_def F_DPDA_EB_STD__F_EPDA_TC__SpecOutput_def F_DPDA_EB_STD__SpecOutput_def)\n  apply(rename_tac G)(*strict*)\n  apply(rule Nonblockingness_DPDA_without_empty_steps_from_final_states_is_Livelock_free)\n    apply(rename_tac G)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac G)(*strict*)\n  apply(rule F_DPDA_EB_Nonblockingness_branching_restricted_hlp)\n    apply(rename_tac G)(*strict*)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\ntheorem F_DPDA_EB_STD_preserves_DPDA: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_STD G = Some G'\n  \\<Longrightarrow> valid_dpda G'\"\n  apply(subgoal_tac \"F_DPDA_EB_STD__SpecInput G \\<Longrightarrow> F_DPDA_EB_STD__SpecOutput G (F_DPDA_EB_STD G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_STD__SOUND)\n   apply(simp add: F_DPDA_EB_STD__SpecInput_def)\n  apply(simp add: F_DPDA_EB_STD__SpecInput_def F_DPDA_EB_STD__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_STD_preservesLang: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_STD G = Some G'\n  \\<Longrightarrow> epdaS.marked_language G = epdaS.marked_language G'\"\n  apply(subgoal_tac \"F_DPDA_EB_STD__SpecInput G \\<Longrightarrow> F_DPDA_EB_STD__SpecOutput G (F_DPDA_EB_STD G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_STD__SOUND)\n   apply(simp add: F_DPDA_EB_STD__SpecInput_def)\n  apply(simp add: F_DPDA_EB_STD__SpecInput_def F_DPDA_EB_STD__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_STD_enforces_langBF: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_STD G = Some G'\n  \\<Longrightarrow> nonblockingness_language (epdaS.unmarked_language G') (epdaS.marked_language G')\"\n  apply(subgoal_tac \"F_DPDA_EB_STD__SpecInput G \\<Longrightarrow> F_DPDA_EB_STD__SpecOutput G (F_DPDA_EB_STD G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_STD__SOUND)\n   apply(simp add: F_DPDA_EB_STD__SpecInput_def)\n  apply(simp add: F_DPDA_EB_STD__SpecInput_def F_DPDA_EB_STD__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_STD_enforces_accessible: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_STD G = Some G'\n  \\<Longrightarrow> epdaS.accessible G'\"\n  apply(subgoal_tac \"F_DPDA_EB_STD__SpecInput G \\<Longrightarrow> F_DPDA_EB_STD__SpecOutput G (F_DPDA_EB_STD G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_STD__SOUND)\n   apply(simp add: F_DPDA_EB_STD__SpecInput_def)\n  apply(simp add: F_DPDA_EB_STD__SpecInput_def F_DPDA_EB_STD__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_STD_non_on_empty_lang: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_STD G = None\n  \\<Longrightarrow> epdaS.marked_language G = {}\"\n  apply(subgoal_tac \"F_DPDA_EB_STD__SpecInput G \\<Longrightarrow> F_DPDA_EB_STD__SpecOutput G (F_DPDA_EB_STD G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_STD__SOUND)\n   apply(simp add: F_DPDA_EB_STD__SpecInput_def)\n  apply(simp add: F_DPDA_EB_STD__SpecInput_def F_DPDA_EB_STD__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_STD_Nonblockingness_branching_restricted: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_STD G = Some G'\n  \\<Longrightarrow> epdaH.Nonblockingness_branching_restricted G'\"\n  apply(subgoal_tac \"valid_dpda G'\")\n   prefer 2\n   apply(rule F_DPDA_EB_STD_preserves_DPDA)\n    apply(force)\n   apply(force)\n  apply(rule epdaH.AX_BF_BraSBRest_DetHDB_LaOp)\n    apply(simp add: valid_dpda_def valid_pda_def)\n   apply(simp add: epdaH.is_forward_deterministicHist_DB_def)\n   apply(rule conjI)\n    apply(simp add: epdaH.is_forward_target_deterministicHist_DB_long_def)\n    apply(clarsimp)\n    apply(rename_tac c d c1 c2 n e w1 w2)(*strict*)\n    apply(simp add: epdaH_step_relation_def)\n    apply(clarsimp)\n   apply (metis DPDA_to_epdaH_determinism)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      in epdaH_vs_epdaHS_Nonblockingness_and_lang_transfer)\n   apply(simp add: valid_dpda_def valid_pda_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      in epdaH_vs_epdaHS_Nonblockingness_and_lang_transfer)\n   apply(simp add: valid_dpda_def valid_pda_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      in epdaS_vs_epdaHS_Nonblockingness_and_lang_transfer)\n   apply(simp add: valid_dpda_def valid_pda_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule F_DPDA_EB_STD_enforces_langBF)\n    apply(force)\n   apply(force)\n  apply(simp add: nonblockingness_language_def)\n  done\n\ntheorem F_DPDA_EB_STD_enforces_not_livelock: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_STD G = Some G'\n  \\<Longrightarrow> \\<not> epdaH_livelock G'\"\n  apply(subgoal_tac \"F_DPDA_EB_STD__SpecInput G \\<Longrightarrow> F_DPDA_EB_STD__SpecOutput G (F_DPDA_EB_STD G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_STD__SOUND)\n   apply(simp add: F_DPDA_EB_STD__SpecInput_def)\n  apply(simp add: F_DPDA_EB_STD__SpecInput_def F_DPDA_EB_STD__SpecOutput_def)\n  done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_09/FUNCTION__F_DPDA_EB_STD__F_DPDA_ENFORCE_NONBLOCKINGNESS_STD.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7310585903489891, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.33703027681129266}}
{"text": "theory Flasher\n\nimports AndAutomat NotAutomat inFlashData outFlashData spf.SPFcomp\nbegin                             \n\n\n(* Es fehlen noch die Wrapper um die sub-componenten. Aber erstmal das so fertig haben *)\n\n\n(*Composition of And and Not SPFs*)\ndefinition flasherComp::\"((inAnd \\<union> inNot) - outAnd \\<union> outNot)\\<^sup>\\<Omega> \\<rightarrow> (outAnd \\<union> outNot)\\<^sup>\\<Omega>\"where\n\"flasherComp = (andSpf \\<otimes> notSpf)\"\n\ndefinition convflasherComp::\"(inFlash)\\<^sup>\\<Omega> \\<rightarrow>(outFlash)\\<^sup>\\<Omega>\"where\n\"convflasherComp = spfConvert\\<cdot>flasherComp\"\n\n(* TODO: verwende \"chDom\" *)\nlemma rangeinunion:\"range(Rep::(inAnd \\<union> inNot) \\<Rightarrow> channel) = {cin1,cin2,cout}\"\n  sorry\n\n(* TODO: verwende \"chDom\" *)\nlemma rangeoutunion:\"range(Rep::outAnd \\<union> outNot \\<Rightarrow> channel) = {cout,cin2}\"\n  sorry\n\n(* TODO: verwende \"chDom\" *)\nlemma rangecompin:\"range(Rep::(inAnd \\<union> inNot) - outAnd \\<union> outNot \\<Rightarrow> channel) = {cin1}\"\n  sorry\n\nlemma compin2flashin:\"range(Rep::(inAnd \\<union> inNot) - outAnd \\<union> outNot \\<Rightarrow> channel) = range(Rep::inFlash\\<Rightarrow> channel)\"\n  by(simp add: rangecompin)\n\nlemma compout2flashout:\"range(Rep::outAnd \\<union> outNot \\<Rightarrow> channel) = range(Rep::outFlash\\<Rightarrow> channel)\"\n  by(simp add: rangeoutunion)\n\n(* TODO: verwende \"chDom\" *)\nlemma sbconvert_sbeq:assumes\"range (Rep::'a::chan\\<Rightarrow>channel) = range(Rep::'b::chan\\<Rightarrow>channel)\"\n      and \"\\<And>c d. Rep c = Rep d \\<Longrightarrow> (Rep_sb sb1) c = (Rep_sb sb2) d\"\n    shows\"sbConvert\\<cdot>(sb2::'b\\<^sup>\\<Omega>) = (sb1::'a\\<^sup>\\<Omega>) \"\n  sorry\n\n\nlemma assumes \"\\<And>c. input1 \\<^enum>\\<^sub>\\<star> c = input2 \\<^enum>\\<^sub>\\<star> c\" \n  shows\"\\<And>c. flasherComp\\<cdot>input1 \\<^enum>\\<^sub>\\<star> c= convflasherComp\\<cdot>input2 \\<^enum>\\<^sub>\\<star> c\"\n  oops(*\n  apply(simp add: sbgetch_insert convflasherComp_def spfConvert_def,auto)\n  apply(subst sbconvert_sbeq,simp_all)\n  apply (metis (mono_tags, hide_lams) Abs_inFlash_cases Flashin1_rep Rep_inFlash_def UNIV_eq_I image_insert image_is_empty insertI1 rangecompin singletonD)\n  apply(insert assms)\n  apply(simp add:  sbgetch_insert)\n  apply(subgoal_tac \"\\<And>c::inFlash. Rep c \\<in> range (Rep::(inAnd \\<union> inNot) - outAnd \\<union> outNot \\<Rightarrow> channel)\",simp_all)\n  apply (metis chan_inj inv_f_f)\n  by (simp add: compin2flashin)\n*)\n\n\nend", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/demo/flasher/Flasher.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7310585786300049, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.33703027140864433}}
{"text": "section {*FUNCTION\\_\\_F\\_DPDA\\_EB\\_OPT\\_\\_F\\_DPDA\\_ENFORCE\\_NONBLOCKINGNESS\\_OPT*}\ntheory\n  FUNCTION__F_DPDA_EB_OPT__F_DPDA_ENFORCE_NONBLOCKINGNESS_OPT\n\nimports\n  PRJ_12_10__ENTRY\n\nbegin\n\ndefinition F_SDPDA_TO_LR1_OPT__SpecInput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_TO_LR1_OPT__SpecInput2 G \\<equiv>\n  valid_simple_dpda G\n  \\<and> \\<not> duplicate_marking G\"\n\ndefinition F_SDPDA_TO_LR1_OPT__SpecOutput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> (('state, 'stack) DT_l2_l3_nonterminals, 'event) cfg option\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_TO_LR1_OPT__SpecOutput2 Gi Go \\<equiv>\n  case Go of\n  None \\<Rightarrow> epdaS.marked_language Gi = {}\n  | Some Go' \\<Rightarrow>\n      valid_cfg Go'\n      \\<and> cfg_LRk Go' (Suc 0)\n      \\<and> epdaS.marked_language Gi = cfgSTD.marked_language Go'\n      \\<and> cfgSTD.Nonblockingness_branching Go'\n      \\<and> cfg_nonterminals Go' \\<subseteq> cfgSTD_Nonblockingness_nonterminals Go'\"\n\ndefinition F_CFG_EB__SpecInput2 :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> bool\"\n  where\n    \"F_CFG_EB__SpecInput2 G \\<equiv>\n  valid_cfg G\"\n\ndefinition F_CFG_EB__SpecOutput2 :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('nonterminal, 'event) cfg option\n  \\<Rightarrow> bool\"\n  where\n    \"F_CFG_EB__SpecOutput2 Gi Go \\<equiv>\n  case Go of\n  None \\<Rightarrow> cfgSTD.marked_language Gi = {}\n  | Some Go' \\<Rightarrow>\n      valid_cfg Go'\n      \\<and> cfg_nonterminals Go' = cfgSTD_Nonblockingness_nonterminals Go'\n      \\<and> cfgSTD.marked_language Gi = cfgSTD.marked_language Go'\n      \\<and> cfg_sub Go' Gi\n      \\<and> nonblockingness_language (cfgSTD.unmarked_language Go') (cfgSTD.marked_language Go')\n      \\<and> cfgSTD.Nonblockingness_branching Go'\"\n\ndefinition F_SDPDA_TO_CFG_STD__SpecInput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_TO_CFG_STD__SpecInput2 G \\<equiv>\n  valid_simple_dpda G\n  \\<and> \\<not> duplicate_marking G\"\n\ndefinition F_SDPDA_TO_CFG_STD__SpecOutput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> (('state, 'stack) DT_l2_l3_nonterminals, 'event) cfg\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_TO_CFG_STD__SpecOutput2 Gi Go \\<equiv>\n  valid_cfg Go\n  \\<and> Go = F_SDPDA_TO_CFG_STD Gi\n  \\<and> epdaS.marked_language Gi = cfgSTD.marked_language Go\"\n\ntheorem F_SDPDA_TO_CFG_STD__SOUND2_OPT: \"\n  F_SDPDA_TO_CFG_STD__SpecInput2 G\n  \\<Longrightarrow> F_SDPDA_TO_CFG_STD__SpecOutput2 G (F_SDPDA_TO_CFG_STD G)\"\n  apply(simp add: F_SDPDA_TO_CFG_STD__SpecOutput2_def F_SDPDA_TO_CFG_STD__SpecInput2_def)\n  apply(rule conjI)\n   apply(rule F_SDPDA_TO_CFG_STD__makes_CFG)\n   apply(force)\n  apply(rule_tac\n      t=\"cfgSTD.marked_language (F_SDPDA_TO_CFG_STD G)\"\n      and s=\"cfgRM.marked_language (F_SDPDA_TO_CFG_STD G)\"\n      in ssubst)\n   prefer 2\n   apply(rule F_SDPDA_TO_CFG_STD__preserves_lang)\n   apply(force)\n  apply(rule CFG_lang_rm_lang_equal)\n  apply(rule F_SDPDA_TO_CFG_STD__makes_CFG)\n  apply(force)\n  done\n\ntheorem F_CFG_EB__SOUND2_OPT: \"\n  F_CFG_EB__SpecInput2 G\n  \\<Longrightarrow> F_CFG_EB__SpecOutput2 G (F_CFG_EB G)\"\n  apply(simp add: F_CFG_EB__SpecInput2_def F_CFG_EB__SpecOutput2_def)\n  apply(case_tac \"F_CFG_EB G\")\n   apply(clarsimp)\n   apply (metis F_CFG_EB_None_implies_empty_lang)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(rule context_conjI)\n   apply(rename_tac a)(*strict*)\n   apply (metis F_CFG_EBSound3)\n  apply(rename_tac a)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule context_conjI)\n    apply(rename_tac a)(*strict*)\n    apply (metis F_CFG_EB_lang_eq)\n   apply(rename_tac a)(*strict*)\n   apply(subgoal_tac \"Nonblockingness (cfgSTD.unmarked_language a) (cfgSTD.marked_language a)\")\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(rule F_CFG_EB_makes_Nonblockingness)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac a)(*strict*)\n    apply(rule F_CFG_EB_makes_cfg_sub)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(rule context_conjI)\n    apply(rename_tac a)(*strict*)\n    apply(simp add: nonblockingness_language_def Nonblockingness_def)\n   apply(rename_tac a)(*strict*)\n   apply(rule F_CFG_EB_makes_Nonblockingness_id)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule F_CFG_EBSoundA)\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule F_CFG_EB_idemp1)\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(force)\n  done\n\ntheorem F_SDPDA_TO_LR1_STD__SOUND2_with_no_duplicate_marking_for_OPT_spec: \"\n  F_SDPDA_TO_LR1_OPT__SpecInput2 G\n  \\<Longrightarrow> F_SDPDA_TO_LR1_OPT__SpecOutput2 G (F_SDPDA_TO_LR1_STD G)\"\n  apply(unfold F_SDPDA_TO_LR1_STD_def)\n  apply(simp add: F_CFG_TRIM_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      in F_SDPDA_TO_CFG_STD__SOUND2_OPT)\n   apply(simp add: F_SDPDA_TO_CFG_STD__SpecInput2_def F_SDPDA_TO_LR1_OPT__SpecInput2_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      G=\"F_SDPDA_TO_CFG_STD G\"\n      in F_CFG_EB__SOUND2_OPT)\n   apply(simp add: F_CFG_EB__SpecInput2_def)\n   apply(simp add: F_SDPDA_TO_CFG_STD__SpecOutput2_def)\n  apply(simp add: F_SDPDA_TO_CFG_STD__SpecOutput2_def F_CFG_EB__SpecOutput2_def)\n  apply(case_tac \"F_CFG_EB (F_SDPDA_TO_CFG_STD G)\")\n   apply(clarsimp)\n   apply(simp add: F_SDPDA_TO_LR1_OPT__SpecOutput2_def F_SDPDA_TO_LR1_OPT__SpecInput2_def)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"a\"\n      in SOUND_FUN_CFGLMACX_STD)\n   apply(simp add: F_CFG_EASTD__SpecInput_def)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"a\"\n      in SOUND_FUN_CFGLMACX_STD)\n   apply(simp add: F_CFG_EASTD__SpecInput_def)\n  apply(rename_tac a)(*strict*)\n  apply(simp add: F_CFG_EASTD__SpecOutput_def F_SDPDA_TO_LR1_OPT__SpecOutput2_def)\n  apply(rule conjI)\n   apply(rename_tac a)(*strict*)\n   apply(simp add: F_SDPDA_TO_LR1_OPT__SpecInput2_def)\n   apply(rule_tac\n      G=\"G\"\n      in F_SDPDA_TO_CFG_STD__enforces_cfg_LRk)\n       apply(rename_tac a)(*strict*)\n       apply(force)\n      apply(rename_tac a)(*strict*)\n      apply(force)\n     apply(rename_tac a)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(rule_tac\n      b=\"a\"\n      in cfg_sub_trans)\n    apply(rename_tac a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac a)(*strict*)\n   apply(rule_tac\n      t=\"cfgSTD.marked_language a\"\n      and s=\"cfgLM.marked_language a\"\n      in ssubst)\n    apply(rename_tac a)(*strict*)\n    apply (metis CFG_lang_lm_lang_equal)\n   apply(rename_tac a)(*strict*)\n   apply(rule_tac\n      t=\"cfgLM.marked_language a\"\n      and s=\"cfgLM.marked_language (F_CFG_EASTD a)\"\n      in ssubst)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(rule_tac\n      t=\"cfgLM.marked_language (F_CFG_EASTD a)\"\n      and s=\"cfgSTD.marked_language (F_CFG_EASTD a)\"\n      in ssubst)\n    apply(rename_tac a)(*strict*)\n    apply (metis CFG_lang_lm_lang_equal)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(rule CFG_Nonblockingness_intro)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply (metis reachable_and_eliminiable_implies_eliminable2 reachable_and_eliminiable_implies_reachable)\n  done\n\ntheorem F_SDPDA_TO_LR1_OPT__SOUND2: \"\n  F_SDPDA_TO_LR1_OPT__SpecInput2 G\n  \\<Longrightarrow> F_SDPDA_TO_LR1_OPT__SpecOutput2 G (F_SDPDA_TO_LR1_OPT G (Suc 0))\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac k=\"Suc 0\" and G=\"G\" in F_SDPDA_TO_LR1_OPT__SOUND)\n    apply(simp add: F_SDPDA_TO_LR1_OPT__SpecInput2_def F_SDPDA_TO_LR1_STD__SpecInput_def)\n   apply(force)\n  apply(simp add: F_SDPDA_TO_LR1_STD__SpecOutput_def F_SDPDA_TO_LR1_OPT__SpecOutput2_def)\n  apply(case_tac \"F_SDPDA_TO_LR1_OPT G (Suc 0)\")\n   apply(clarsimp)\n  apply(clarsimp)\n  apply(rename_tac GX)\n  apply(rule conjI)\n   apply (metis CFG_lang_lm_lang_equal)\n  apply(rule conjI)\n   apply (metis (no_types, lifting) F_SDPDA_TO_LR1_OPT__vs__F_SDPDA_TO_LR1_STD F_SDPDA_TO_LR1_STD__SpecInput_def F_SDPDA_TO_LR1_STD__SOUND2_with_no_duplicate_marking_for_OPT_spec F_SDPDA_TO_LR1_OPT__SpecInput2_def F_SDPDA_TO_LR1_OPT__SpecOutput2_def option.simps(5) zero_less_Suc)\n  apply (metis (no_types, lifting) F_SDPDA_TO_LR1_OPT__vs__F_SDPDA_TO_LR1_STD F_SDPDA_TO_LR1_STD__SpecInput_def F_SDPDA_TO_LR1_STD__SOUND2_with_no_duplicate_marking_for_OPT_spec F_SDPDA_TO_LR1_OPT__SpecInput2_def F_SDPDA_TO_LR1_OPT__SpecOutput2_def option.simps(5) zero_less_Suc)\n  done\n\ndefinition F_DPDA_EB_OPT__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__SpecInput G \\<equiv>\n  valid_dpda G\"\n\ndefinition F_DPDA_EB_OPT__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda option\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__SpecOutput Gi Go \\<equiv>\n  case Go of\n  None \\<Rightarrow> epdaS.marked_language Gi = {}\n  | Some Go' \\<Rightarrow>\n      valid_dpda Go'\n      \\<and> epdaS.marked_language Gi = epdaS.marked_language Go'\n      \\<and> nonblockingness_language (epdaS.unmarked_language Go') (epdaS.marked_language Go')\n      \\<and> epdaS.accessible Go'\n      \\<and> \\<not> epdaH_livelock Go'\"\n\ndefinition F_DPDA_TO_SDPDA__SpecInput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_TO_SDPDA__SpecInput2 G \\<equiv>\n  valid_dpda G\"\n\ndefinition F_DPDA_TO_SDPDA__SpecOutput2 :: \"\n  ('stateA, 'event, 'stack) epda\n  \\<Rightarrow> ('stateB, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_TO_SDPDA__SpecOutput2 Gi Go \\<equiv>\n  valid_simple_dpda Go\n  \\<and> epdaS.marked_language Gi = epdaS.marked_language Go\"\n\ntheorem F_DPDA_TO_SDPDA__SOUND2_OPT: \"\n  F_DPDA_TO_SDPDA__SpecInput2 G\n  \\<Longrightarrow> F_DPDA_TO_SDPDA__SpecOutput2 G (F_DPDA_TO_SDPDA G)\"\n  apply(simp add: F_DPDA_TO_SDPDA__SpecInput2_def F_DPDA_TO_SDPDA__SpecOutput2_def)\n  apply(rule conjI)\n   apply (metis F_DPDA_TO_SDPDA_makes_SDPDA)\n  apply (metis F_DPDA_TO_SDPDA_preserves_language)\n  done\n\ndefinition F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecInput G \\<equiv>\n  valid_simple_dpda G\"\n\ndefinition F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecOutput :: \"\n  ('stateA, 'event, 'stack) epda\n  \\<Rightarrow> ('stateB, 'event, 'stack) epda option\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecOutput G1 G2 \\<equiv>\n  F_DPDA_EB_OPT__SpecOutput G1 G2\"\n\ndefinition F_SDPDA_EUME__SpecInput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_EUME__SpecInput2 G \\<equiv>\n  valid_simple_dpda G\"\n\ndefinition F_SDPDA_EUME__SpecOutput2 :: \"\n  ('stateA, 'event, 'stack) epda\n  \\<Rightarrow> ('stateB, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_SDPDA_EUME__SpecOutput2 Gi Go \\<equiv>\n  valid_simple_dpda Go\n  \\<and> epdaS.marked_language Gi = epdaS.marked_language Go\n  \\<and> \\<not> duplicate_marking Go\"\n\ndefinition F_DPDA_EB_OPT__F_SDPDA_EUME__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_SDPDA_EUME__SpecInput G \\<equiv>\n  valid_simple_dpda G\n  \\<and> \\<not> duplicate_marking G\"\n\ndefinition F_DPDA_EB_OPT__F_SDPDA_EUME__SpecOutput :: \"\n  ('stateA, 'event, 'stack) epda\n  \\<Rightarrow> ('stateB, 'event, 'stack) epda option\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_SDPDA_EUME__SpecOutput G1 G2 \\<equiv>\n  F_DPDA_EB_OPT__SpecOutput G1 G2\"\n\ntheorem F_SDPDA_EUME__SOUND2_OPT: \"\n  F_SDPDA_EUME__SpecInput2 G\n  \\<Longrightarrow> F_SDPDA_EUME__SpecOutput2 G (F_SDPDA_EUME G)\"\n  apply(simp add: F_SDPDA_EUME__SpecInput2_def F_SDPDA_EUME__SpecOutput2_def)\n  apply(rule conjI)\n   apply (metis F_SDPDA_EUME__preserves_SDPDA)\n  apply(rule conjI)\n   apply(rule F_SDPDA_EUME__preserves_lang)\n   apply(force)\n  apply (metis F_SDPDA_EUME__no_duplicate_marking)\n  done\n\ndefinition F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecInput :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecInput G \\<equiv>\n  valid_cfg G\n  \\<and> cfg_LRk G (Suc 0)\n  \\<and> cfgSTD.Nonblockingness_branching G\n  \\<and> cfg_nonterminals G \\<subseteq> cfgSTD_Nonblockingness_nonterminals G\"\n\ndefinition F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecOutput :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecOutput Gi Go \\<equiv>\n  valid_dpda Go\n  \\<and> cfgSTD.marked_language Gi = epdaS.marked_language Go\n  \\<and> nonblockingness_language (epdaS.unmarked_language Go) (epdaS.marked_language Go)\n  \\<and> epdaS.accessible Go\n  \\<and> \\<not> epdaH_livelock Go\"\n\ndefinition F_DPDA_EB_OPT__F_CFG_TC__SpecInput :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_CFG_TC__SpecInput G \\<equiv>\n  valid_cfg G\n  \\<and> cfgSTD.Nonblockingness_branching G\n  \\<and> cfg_nonterminals G \\<subseteq> cfgSTD_Nonblockingness_nonterminals G\n  \\<and> cfg_LRk G (Suc 0)\"\n\ndefinition F_DPDA_EB_OPT__F_CFG_TC__SpecOutput :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_CFG_TC__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecOutput Gi Go\"\n\ndefinition F_DPDA_EB_OPT__F_LR_PARSER__SpecInput :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_LR_PARSER__SpecInput G \\<equiv>\n  valid_bounded_parser G (Suc 0)\n  \\<and> parserFS.is_forward_edge_deterministic_accessible G\n  \\<and> nonblockingness_language (parserS.unmarked_language G) (parserS.marked_language G)\n  \\<and> (\\<forall>r\\<in> parser_rules G. rule_rpop r \\<noteq> [])\n  \\<and> parser_no_access_final_with_read G\n  \\<and> can_detect_parser_bottom_only_in_Nonblockingness_configurations G\n  \\<and> parser_initial G \\<notin> parser_marking G\"\n\ndefinition F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('state, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput Gi Go \\<equiv>\n  valid_dpda Go\n  \\<and> parserS.marked_language Gi = epdaS.marked_language Go\n  \\<and> nonblockingness_language (epdaS.unmarked_language Go) (epdaS.marked_language Go)\n  \\<and> epdaS.accessible Go\n  \\<and> \\<not> epdaH_livelock Go\"\n\ndefinition F_DPDA_EB_OPT__F_PARSER_RITU__SpecInput :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_PARSER_RITU__SpecInput G \\<equiv>\n  valid_bounded_parser G (Suc 0)\n  \\<and> parserFS.is_forward_edge_deterministic_accessible G\n  \\<and> nonblockingness_language (parserS.unmarked_language G) (parserS.marked_language G)\n  \\<and> parser_not_observes_input_terminator G\n  \\<and> (\\<forall>r\\<in> parser_rules G. rule_rpop r \\<noteq> [])\"\n\ndefinition F_DPDA_EB_OPT__F_PARSER_RITU__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) parser\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_PARSER_RITU__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput Gi Go\"\n\ndefinition F_DPDA_EB_OPT__F_PARSER_RTR__SpecInput :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_PARSER_RTR__SpecInput G \\<equiv>\n  valid_bounded_parser G (Suc 0)\n  \\<and> parserFS.is_forward_edge_deterministic_accessible G\n  \\<and> nonblockingness_language (parserS.unmarked_language G) (parserS.marked_language G)\n  \\<and> parser_not_observes_input_terminator G\n  \\<and> parser_no_top_rules G\n  \\<and> parser_no_empty_steps_from_marking_states G\"\n\ndefinition F_DPDA_EB_OPT__F_PARSER_RTR__SpecOutput :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('state, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_PARSER_RTR__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput Gi Go\"\n\ndefinition F_DPDA_EB_OPT__F_PARSER_TC__SpecInput :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_PARSER_TC__SpecInput G \\<equiv>\n  valid_bounded_parser G (Suc 0)\n  \\<and> parserFS.is_forward_edge_deterministic_accessible G\n  \\<and> parser_not_observes_input_terminator G\n  \\<and> nonblockingness_language (parserS.unmarked_language G) (parserS.marked_language G)\n  \\<and> parser_no_top_rules G\n  \\<and> parser_no_empty_steps_from_marking_states G\"\n\ndefinition F_DPDA_EB_OPT__F_PARSER_TC__SpecOutput :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('state, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_PARSER_TC__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput Gi Go\"\n\ndefinition F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecInput G \\<equiv>\n  valid_epda G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epdaS.is_forward_edge_deterministic_accessible G\n  \\<and> epda_no_empty_steps_from_marking_states G\"\n\ndefinition F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecOutput :: \"\n  ('state, 'event, 'stackA) epda\n  \\<Rightarrow> ('state, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_OPT__SpecOutput Gi (Some Go)\"\n\ndefinition F_EDPDA_TO_DPDA__SpecInput2 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_EDPDA_TO_DPDA__SpecInput2 G \\<equiv>\n  valid_epda G\n  \\<and> epdaS.is_forward_edge_deterministic_accessible G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epda_no_empty_steps_from_marking_states G\"\n\ndefinition F_EDPDA_TO_DPDA__SpecOutput2 :: \"\n  ('stateA, 'event, 'stack) epda\n  \\<Rightarrow> ('stateB, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_EDPDA_TO_DPDA__SpecOutput2 Gi Go \\<equiv>\n  valid_dpda Go\n  \\<and> epdaS.marked_language Gi = epdaS.marked_language Go\n  \\<and> nonblockingness_language (epdaS.unmarked_language Go) (epdaS.marked_language Go)\n  \\<and> epdaH_no_livelocks_from_marking_states Go\"\n\ndefinition F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecInput G \\<equiv>\n  valid_dpda G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epdaH_no_livelocks_from_marking_states G\"\n\ndefinition F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_OPT__SpecOutput Gi (Some Go)\"\n\ntheorem F_EDPDA_TO_DPDA__SOUND2_OPT: \"\n  F_EDPDA_TO_DPDA__SpecInput2 G\n  \\<Longrightarrow> F_EDPDA_TO_DPDA__SpecOutput2 G (F_EDPDA_TO_DPDA G)\"\n  apply(simp add: F_EDPDA_TO_DPDA__SpecOutput2_def F_EDPDA_TO_DPDA__SpecInput2_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply (metis F_EDPDA_TO_DPDA_makesDPDA)\n  apply(rule context_conjI)\n   apply (metis F_EDPDA_TO_DPDA_preservesLang)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(subgoal_tac \"epdaS.unmarked_language G = epdaS.unmarked_language (F_EDPDA_TO_DPDA G)\")\n    apply(force)\n   apply(rule F_EDPDA_TO_DPDA_preservesULang)\n    apply(force)\n   apply(force)\n  apply(rule F_EDPDA_TO_DPDA_generates_epdaH_no_livelocks_from_marking_states)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\ndefinition F_DPDA_EB_OPT__F_DPDA_EA_OPT__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_DPDA_EA_OPT__SpecInput G \\<equiv>\n  valid_dpda G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epdaS.accessible G\n  \\<and> epdaH_no_livelocks_from_marking_states G\"\n\ndefinition F_DPDA_EB_OPT__F_F_DPDA_EA_OPT__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_F_DPDA_EA_OPT__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_OPT__SpecOutput Gi (Some Go)\"\n\ndefinition F_DPDA_EB_OPT__F_EPDA_TC__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_EPDA_TC__SpecInput G \\<equiv>\n  valid_dpda G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epdaS.accessible G\n  \\<and> epdaH_no_livelocks_from_marking_states G\"\n\ndefinition F_DPDA_EB_OPT__F_EPDA_TC__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EB_OPT__F_EPDA_TC__SpecOutput Gi Go \\<equiv>\n  F_DPDA_EB_OPT__SpecOutput Gi (Some Go)\"\n\ndefinition F_LR_PARSER__SpecInput2 :: \"\n  ('nonterminal DT_symbol, 'event DT_symbol) cfg\n  \\<Rightarrow> ('nonterminal DT_symbol, 'event DT_symbol) cfg\n    \\<times> ('nonterminal DT_symbol, 'event DT_symbol) DT_first_function\n    \\<times> (('nonterminal DT_symbol, 'event DT_symbol) DT_cfg_item set,\n        ('nonterminal DT_symbol, 'event DT_symbol) DT_two_elements,\n        nat) epda\n    \\<times> nat\n    \\<times> 'event DT_symbol\n  \\<Rightarrow> bool\"\n  where\n    \"F_LR_PARSER__SpecInput2 G X \\<equiv>\n  case X of\n  (G', F, M, n, Do) \\<Rightarrow>\n    \\<exists>S'.\n      valid_cfg G\n      \\<and> cfgSTD_first_compatible F n\n      \\<and> cfg_nonterminals G \\<subseteq> cfgSTD_Nonblockingness_nonterminals G\n      \\<and> cfgSTD.Nonblockingness_branching G\n      \\<and> Do = F_FRESH (cfg_events G)\n      \\<and> S' = F_FRESH (cfg_nonterminals G)\n      \\<and> G' = F_CFG_AUGMENT G S' Do\n      \\<and> n = 1\n      \\<and> M = F_LR_MACHINE G' F n\n      \\<and> cfg_LRk G n\"\n\ndefinition F_LR_PARSER__SpecOutput2 :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_LR_PARSER__SpecOutput2 Gi Go \\<equiv>\n  valid_parser Go\n  \\<and> parserFS.is_forward_edge_deterministic_accessible Go\n  \\<and> cfgSTD.marked_language Gi = parserS.marked_language Go\n  \\<and> parser_initial Go \\<notin> parser_marking Go\n  \\<and> valid_bounded_parser Go 1\n  \\<and> nonblockingness_language (parserS.unmarked_language Go) (parserS.marked_language Go)\n  \\<and> (\\<forall>r \\<in> parser_rules Go. rule_rpop r \\<noteq> [])\n  \\<and> parser_no_access_final_with_read Go\n  \\<and> can_detect_parser_bottom_only_in_Nonblockingness_configurations Go\"\n\ntheorem F_LR_PARSER__SOUND2_OPT: \"\n  F_LR_PARSER__SpecInput2 G (G', F, M, Suc 0, Do)\n  \\<Longrightarrow> F_LR_PARSER__SpecOutput2 G ((\\<lambda>G (G', F, M, k, Do). F_LR_PARSER G G' M Do) G (G', F, M, Suc 0, Do))\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule F_LR_PARSER__SOUND)\n   apply(simp add: F_LR_PARSER__SpecInput2_def F_LR_PARSER__SpecInput_def)\n  apply(simp add: F_LR_PARSER__SpecOutput2_def F_LR_PARSER__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_OPT__SOUND: \"\n  F_DPDA_EB_OPT__SpecInput G\n  \\<Longrightarrow> F_DPDA_EB_OPT__SpecOutput G (F_DPDA_EB_OPT G)\"\n  apply(simp add: F_DPDA_EB_OPT_def)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__SpecOutput\"\n      and SPi_H=\"F_DPDA_TO_SDPDA__SpecInput2\"\n      and SPo_H=\"F_DPDA_TO_SDPDA__SpecOutput2\"\n      and H=\"F_DPDA_TO_SDPDA\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(force)\n      apply(simp add: F_DPDA_EB_OPT__SpecInput_def F_DPDA_TO_SDPDA__SpecInput2_def)\n     apply(rule F_DPDA_TO_SDPDA__SOUND2_OPT)\n     apply(force)\n    apply(simp add: F_DPDA_TO_SDPDA__SpecOutput2_def F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecInput_def)\n   apply(rename_tac P)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecOutput_def F_DPDA_EB_OPT__SpecOutput_def F_DPDA_TO_SDPDA__SpecOutput2_def)\n   apply(clarsimp)\n   apply(case_tac \"P\")\n    apply(rename_tac P)(*strict*)\n    apply(force)\n   apply(rename_tac P a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_SDPDA_EUME__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_SDPDA_EUME__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecOutput\"\n      and SPi_H=\"F_SDPDA_EUME__SpecInput2\"\n      and SPo_H=\"F_SDPDA_EUME__SpecOutput2\"\n      and H=\"F_SDPDA_EUME\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac G)(*strict*)\n       apply(force)\n      apply(rename_tac G)(*strict*)\n      apply(simp add: F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecInput_def F_SDPDA_EUME__SpecInput2_def)\n     apply(rename_tac G)(*strict*)\n     apply(rule F_SDPDA_EUME__SOUND2_OPT)\n     apply(force)\n    apply(rename_tac G)(*strict*)\n    apply(simp add: F_SDPDA_EUME__SpecOutput2_def F_DPDA_EB_OPT__F_SDPDA_EUME__SpecInput_def)\n   apply(rename_tac G P)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__SpecOutput_def F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecOutput_def F_SDPDA_EUME__SpecOutput2_def F_DPDA_EB_OPT__F_SDPDA_EUME__SpecOutput_def)\n   apply(clarsimp)\n   apply(case_tac \"P\")\n    apply(rename_tac G P)(*strict*)\n    apply(force)\n   apply(rename_tac G P a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_DPDA_TO_SDPDA__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga G)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac Ga G)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      in F_SDPDA_TO_LR1_OPT__SOUND2)\n   apply(simp add: F_SDPDA_TO_LR1_OPT__SpecInput2_def)\n   apply(rename_tac G)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__F_SDPDA_EUME__SpecInput_def)\n  apply(rename_tac Ga G)(*strict*)\n  apply(case_tac \"F_SDPDA_TO_LR1_OPT G (Suc 0)\")\n   apply(rename_tac Ga G)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__F_SDPDA_EUME__SpecOutput_def F_DPDA_EB_OPT__SpecOutput_def F_DPDA_EB_OPT__F_SDPDA_EUME__SpecInput_def)\n   apply(simp add: F_SDPDA_TO_LR1_OPT__SpecOutput2_def)\n  apply(rename_tac Ga G a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G a)(*strict*)\n  apply(subgoal_tac \"F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecInput a\")\n   apply(rename_tac G a)(*strict*)\n   prefer 2\n   apply(simp add: F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecInput_def F_SDPDA_TO_LR1_OPT__SpecOutput2_def F_DPDA_EB_OPT__F_SDPDA_EUME__SpecInput_def)\n  apply(rename_tac G a)(*strict*)\n  apply(rule_tac\n      ?I1.0=\"F_DPDA_EB_OPT__F_SDPDA_EUME__SpecInput\"\n      and a=\"a\"\n      and ?O1.0=\"F_DPDA_EB_OPT__F_SDPDA_EUME__SpecOutput\"\n      and ?O2.0=\"F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecOutput\"\n      and ?O3.0=\"F_SDPDA_TO_LR1_OPT__SpecOutput2\"\n      in decompose_simp)\n      apply(rename_tac G a)(*strict*)\n      prefer 5\n      apply(simp add: Let_def)\n     apply(rename_tac G a)(*strict*)\n     apply(force)\n    apply(rename_tac G a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac G a)(*strict*)\n   prefer 2\n   apply(rename_tac G a aa Ga F)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__SpecOutput_def F_DPDA_EB_OPT__F_SDPDA_EUME__SpecOutput_def F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecOutput_def Let_def F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecInput_def F_DPDA_EB_OPT__F_SDPDA_EUME__SpecInput_def F_SDPDA_TO_LR1_OPT__SpecOutput2_def)\n  apply(rename_tac G a)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_SDPDA_EUME__SpecInput G\")\n  apply(thin_tac \"F_SDPDA_TO_LR1_OPT__SpecOutput2 G (Some a)\")\n  apply(thin_tac \"F_SDPDA_TO_LR1_OPT G (Suc 0) = Some a\")\n  apply(rename_tac G)\n  apply(rename_tac Ga G)(*strict*)\n  apply(simp add: Let_def)\n  apply(rename_tac G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_CFG_TC__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_CFG_TC__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecOutput\"\n      and SPi_H=\"F_CFG_TC__SpecInput2\"\n      and SPo_H=\"F_CFG_TC__SpecOutput2\"\n      and H=\"F_CFG_TC\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac G)(*strict*)\n       apply(force)\n      apply(rename_tac G)(*strict*)\n      apply(simp add: F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecInput_def F_CFG_TC__SpecInput2_def)\n     apply(rename_tac G)(*strict*)\n     apply(rule F_CFG_TC__SOUND2)\n     apply(force)\n    apply(rename_tac G)(*strict*)\n    apply(simp add: F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecOutput_def F_DPDA_EB_OPT__F_CFG_TC__SpecInput_def F_CFG_TC__SpecOutput2_def)\n   apply(rename_tac G P)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecOutput_def F_DPDA_EB_OPT__F_CFG_TC__SpecInput_def F_CFG_TC__SpecOutput2_def F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecInput_def F_DPDA_EB_OPT__F_CFG_TC__SpecOutput_def)\n  apply(rename_tac G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga G)(*strict*)\n  apply(rule_tac\n      t=\"F_LR_PARSER G (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F_CFG_FIRST (Suc 0)) (F_FRESH (cfg_events G))\"\n      and s=\" (\\<lambda>(G', F, M, n, Do). F_LR_PARSER G G' M Do) ((F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))), F_CFG_FIRST, (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F_CFG_FIRST (Suc 0)), (Suc 0), (F_FRESH (cfg_events G)))\"\n      in ssubst)\n   apply(rename_tac Ga G)(*strict*)\n   apply(force)\n  apply(rename_tac Ga G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and Y=\"((F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))), F_CFG_FIRST, (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F_CFG_FIRST (Suc 0)), (Suc 0), (F_FRESH (cfg_events G)))\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_LR_PARSER__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__F_CFG_TC__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__F_CFG_TC__SpecOutput\"\n      and SPi_H=\"F_LR_PARSER__SpecInput2\"\n      and SPo_H=\"F_LR_PARSER__SpecOutput2\"\n      and H=\"\\<lambda>G (G', F, M, n, Do). F_LR_PARSER G G' M Do\"\n      in decompose_sequential_execution_input_output_specification2_simp3)\n       apply(rename_tac Ga G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga G)(*strict*)\n      apply(simp add: F_DPDA_EB_OPT__F_CFG_TC__SpecInput_def F_LR_PARSER__SpecInput2_def)\n      apply(simp add: cfgSTD_first_compatible_def)\n      apply(clarsimp)\n      apply(rule sym)\n      apply(rule F_CFG_FIRST__SOUND)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(rename_tac Ga G)(*strict*)\n     apply(rule F_LR_PARSER__SOUND2_OPT)\n     apply(force)\n    apply(rename_tac Ga G)(*strict*)\n    apply(simp add: F_DPDA_EB_OPT__F_LR_PARSER__SpecInput_def F_LR_PARSER__SpecOutput2_def)\n   apply(rename_tac Ga G P)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__F_CFG_TC__SpecOutput_def F_DPDA_EB_OPT__F_SDPDA_TO_LR1_OPT__SpecOutput_def)\n   apply(rename_tac G P)(*strict*)\n   apply(case_tac \"P\")\n   apply(rename_tac G P epda_states epda_events epda_gamma epda_delta epda_initial epda_box epda_marking)(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput_def F_LR_PARSER__SpecOutput2_def F_DPDA_EB_OPT__F_CFG_TC__SpecInput_def)\n  apply(rename_tac Ga G X)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_CFG_TC__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_PARSER_RITU__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_PARSER_RITU__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__F_LR_PARSER__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput\"\n      and SPi_H=\"F_PARSERRITU__SpecInput\"\n      and SPo_H=\"F_PARSERRITU__SpecOutput\"\n      and H=\"F_PARSER_RITU\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga G)(*strict*)\n      apply(simp add: F_DPDA_EB_OPT__F_LR_PARSER__SpecInput_def F_PARSERRITU__SpecInput_def)\n     apply(rename_tac Ga G)(*strict*)\n     apply(rule F_PARSERRITU__SOUND)\n     apply(force)\n    apply(rename_tac Ga G)(*strict*)\n    apply(simp add: F_PARSERRITU__SpecOutput_def F_DPDA_EB_OPT__F_PARSER_RITU__SpecInput_def)\n   apply(rename_tac Ga G P)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput_def F_DPDA_EB_OPT__F_PARSER_RITU__SpecOutput_def F_PARSERRITU__SpecOutput_def)\n  apply(rename_tac Ga G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_LR_PARSER__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_PARSER_RTR__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_PARSER_RTR__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__F_PARSER_RITU__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__F_PARSER_RITU__SpecOutput\"\n      and SPi_H=\"F_PARSER_RTR__SpecInput\"\n      and SPo_H=\"F_PARSER_RTR__SpecOutput\"\n      and H=\"F_PARSER_RTR\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga Gb G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga Gb G)(*strict*)\n      apply(simp add: F_DPDA_EB_OPT__F_PARSER_RITU__SpecInput_def F_PARSER_RTR__SpecInput_def)\n     apply(rename_tac Ga Gb G)(*strict*)\n     apply(rule F_PARSER_RTR__SOUND)\n     apply(force)\n    apply(rename_tac Ga Gb G)(*strict*)\n    apply(simp add: F_DPDA_EB_OPT__F_PARSER_RTR__SpecInput_def F_PARSER_RTR__SpecOutput_def)\n   apply(rename_tac Ga Gb G P)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__F_PARSER_RITU__SpecOutput_def F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput_def F_DPDA_EB_OPT__F_PARSER_RTR__SpecOutput_def F_PARSER_RTR__SpecOutput_def)\n  apply(rename_tac Ga Gb G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_PARSER_RITU__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb Gc G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_PARSER_TC__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_PARSER_TC__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__F_PARSER_RTR__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__F_PARSER_RTR__SpecOutput\"\n      and SPi_H=\"F_PARSER_TC__SpecInput\"\n      and SPo_H=\"F_PARSER_TC__SpecOutput\"\n      and H=\"F_PARSER_TC\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga Gb Gc G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga Gb Gc G)(*strict*)\n      apply(simp add: F_DPDA_EB_OPT__F_PARSER_RTR__SpecInput_def F_PARSER_TC__SpecInput_def)\n     apply(rename_tac Ga Gb Gc G)(*strict*)\n     apply(rule F_PARSER_TC__SOUND)\n     apply(force)\n    apply(rename_tac Ga Gb Gc G)(*strict*)\n    apply(simp add: F_DPDA_EB_OPT__F_PARSER_TC__SpecInput_def F_PARSER_TC__SpecOutput_def)\n   apply(rename_tac Ga Gb Gc G P)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__F_PARSER_RTR__SpecInput_def F_PARSER_TC__SpecOutput_def F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput_def F_DPDA_EB_OPT__F_PARSER_RTR__SpecOutput_def F_DPDA_EB_OPT__F_PARSER_TC__SpecOutput_def)\n  apply(rename_tac Ga Gb Gc G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_PARSER_RTR__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb Gc Gd G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__F_PARSER_TC__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__F_PARSER_TC__SpecOutput\"\n      and SPi_H=\"F_PARSER_TO_EDPDA__SpecInput\"\n      and SPo_H=\"F_PARSER_TO_EDPDA__SpecOutput\"\n      and H=\"F_PARSER_TO_EDPDA\"\n      in decompose_sequential_execution_input_output_specification2_simp3)\n       apply(rename_tac Ga Gb Gc Gd G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga Gb Gc Gd G)(*strict*)\n      apply(simp add: F_DPDA_EB_OPT__F_PARSER_TC__SpecInput_def F_PARSER_TO_EDPDA__SpecInput_def)\n      apply(rename_tac G)(*strict*)\n      apply(rule F_FRESH_is_fresh)\n      apply(simp add: valid_bounded_parser_def valid_parser_def)\n     apply(rename_tac Ga Gb Gc Gd G)(*strict*)\n     apply(rule F_PARSER_TO_EDPDA__SOUND)\n     apply(force)\n    apply(rename_tac Ga Gb Gc Gd G)(*strict*)\n    apply(simp add: F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecInput_def F_PARSER_TO_EDPDA__SpecOutput_def)\n   apply(rename_tac Ga Gb Gc Gd G P)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecOutput_def F_DPDA_EB_OPT__F_PARSER_RTR__SpecInput_def F_PARSER_TC__SpecOutput_def F_DPDA_EB_OPT__F_LR_PARSER__SpecOutput_def F_DPDA_EB_OPT__F_PARSER_RTR__SpecOutput_def F_DPDA_EB_OPT__F_PARSER_TC__SpecOutput_def)\n   apply(rename_tac G P)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__SpecOutput_def F_PARSER_TO_EDPDA__SpecOutput_def)\n  apply(rename_tac Ga Gb Gc Gd G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_PARSER_TC__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb Gc Gd Ge G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecOutput\"\n      and SPi_H=\"F_EDPDA_TO_DPDA__SpecInput2\"\n      and SPo_H=\"F_EDPDA_TO_DPDA__SpecOutput2\"\n      and H=\"F_EDPDA_TO_DPDA\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga Gb Gc Gd Ge G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga Gb Gc Gd Ge G)(*strict*)\n      apply(simp add: F_EDPDA_TO_DPDA__SpecInput2_def F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecInput_def)\n     apply(rename_tac Ga Gb Gc Gd Ge G)(*strict*)\n     apply(rule F_EDPDA_TO_DPDA__SOUND2_OPT)\n     apply(force)\n    apply(rename_tac Ga Gb Gc Gd Ge G)(*strict*)\n    apply(simp add: F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecInput_def F_EDPDA_TO_DPDA__SpecOutput2_def)\n   apply(rename_tac Ga Gb Gc Gd Ge G P)(*strict*)\n   apply(simp add: F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecOutput_def F_DPDA_EB_OPT__SpecOutput_def F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecOutput_def F_EDPDA_TO_DPDA__SpecOutput2_def F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecInput_def)\n  apply(rename_tac Ga Gb Gc Gd Ge G X)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_PARSER_TO_EDPDA__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_DPDA_EA_OPT__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_F_DPDA_EA_OPT__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecOutput\"\n      and SPi_H=\"F_DPDA_EA_OPT__SpecInput\"\n      and SPo_H=\"F_DPDA_EA_OPT__SpecOutput\"\n      and H=\"F_DPDA_EA_OPT\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga G)(*strict*)\n      apply(simp add: F_DPDA_EA_OPT__SpecInput_def F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecInput_def)\n     apply(rename_tac Ga G)(*strict*)\n     apply(rule F_DPDA_EA_OPT__SOUND)\n     apply(force)\n    apply(rename_tac Ga G)(*strict*)\n    apply(simp add: F_DPDA_EB_OPT__F_DPDA_EA_OPT__SpecInput_def F_DPDA_EA_OPT__SpecOutput_def)\n   apply(rename_tac Ga G P)(*strict*)\n   apply(simp add: F_DPDA_EA_OPT__SpecOutput_def F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecInput_def F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecOutput_def F_DPDA_EB_OPT__SpecOutput_def F_DPDA_EB_OPT__F_F_DPDA_EA_OPT__SpecOutput_def)\n  apply(rename_tac Ga G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb G)(*strict*)\n  apply(rule_tac\n      X=\"G\"\n      and SPi_FH=\"F_DPDA_EB_OPT__F_EPDA_TC__SpecInput\"\n      and SPo_FH=\"F_DPDA_EB_OPT__F_EPDA_TC__SpecOutput\"\n      and SPi_F=\"F_DPDA_EB_OPT__F_DPDA_EA_OPT__SpecInput\"\n      and SPo_F=\"F_DPDA_EB_OPT__F_F_DPDA_EA_OPT__SpecOutput\"\n      and SPi_H=\"F_EPDA_TC__SpecInput2\"\n      and SPo_H=\"F_EPDA_TC__SpecOutput2\"\n      and H=\"F_EPDA_TC\"\n      in decompose_sequential_execution_input_output_specification_simp3)\n       apply(rename_tac Ga Gb G)(*strict*)\n       apply(force)\n      apply(rename_tac Ga Gb G)(*strict*)\n      apply(simp add: F_EPDA_TC__SpecInput2_def F_DPDA_EB_OPT__F_DPDA_EA_OPT__SpecInput_def)\n     apply(rename_tac Ga Gb G)(*strict*)\n     apply(rule F_EPDA_TC__SOUND2)\n     apply(force)\n    apply(rename_tac Ga Gb G)(*strict*)\n    apply(simp add: F_DPDA_EB_OPT__F_EPDA_TC__SpecInput_def F_EPDA_TC__SpecOutput2_def F_DPDA_EB_OPT__F_DPDA_EA_OPT__SpecInput_def)\n   apply(rename_tac Ga Gb G P)(*strict*)\n   apply(simp add: F_DPDA_EA_STD__SpecOutput_def F_EPDA_TC__SpecOutput2_def F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecInput_def F_DPDA_EB_OPT__F_EDPDA_TO_DPDA__SpecOutput_def F_DPDA_EB_OPT__SpecOutput_def F_DPDA_EB_OPT__F_F_DPDA_EA_OPT__SpecOutput_def F_DPDA_EB_OPT__F_EPDA_TC__SpecOutput_def F_DPDA_EB_OPT__F_DPDA_EA_OPT__SpecInput_def)\n  apply(rename_tac Ga Gb G X)(*strict*)\n  apply(thin_tac \"F_DPDA_EB_OPT__F_DPDA_EA_OPT__SpecInput G\")\n  apply(rename_tac G)\n  apply(rename_tac Ga Gb Gc G)(*strict*)\n  apply(simp add: F_DPDA_EB_OPT__F_EPDA_TC__SpecInput_def F_DPDA_EB_OPT__F_EPDA_TC__SpecOutput_def F_DPDA_EB_OPT__SpecOutput_def)\n  apply(rename_tac G)(*strict*)\n  apply(rule Nonblockingness_DPDA_without_empty_steps_from_final_states_is_Livelock_free)\n    apply(rename_tac G)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac G)(*strict*)\n  apply(rule F_DPDA_EB_Nonblockingness_branching_restricted_hlp)\n    apply(rename_tac G)(*strict*)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\ntheorem F_DPDA_EB_OPT_preserves_DPDA: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_OPT G = Some G'\n  \\<Longrightarrow> valid_dpda G'\"\n  apply(subgoal_tac \"F_DPDA_EB_OPT__SpecInput G \\<Longrightarrow> F_DPDA_EB_OPT__SpecOutput G (F_DPDA_EB_OPT G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_OPT__SOUND)\n   apply(simp add: F_DPDA_EB_OPT__SpecInput_def)\n  apply(simp add: F_DPDA_EB_OPT__SpecInput_def F_DPDA_EB_OPT__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_OPT_preservesLang: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_OPT G = Some G'\n  \\<Longrightarrow> epdaS.marked_language G = epdaS.marked_language G'\"\n  apply(subgoal_tac \"F_DPDA_EB_OPT__SpecInput G \\<Longrightarrow> F_DPDA_EB_OPT__SpecOutput G (F_DPDA_EB_OPT G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_OPT__SOUND)\n   apply(simp add: F_DPDA_EB_OPT__SpecInput_def)\n  apply(simp add: F_DPDA_EB_OPT__SpecInput_def F_DPDA_EB_OPT__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_OPT_enforces_langBF: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_OPT G = Some G'\n  \\<Longrightarrow> nonblockingness_language (epdaS.unmarked_language G') (epdaS.marked_language G')\"\n  apply(subgoal_tac \"F_DPDA_EB_OPT__SpecInput G \\<Longrightarrow> F_DPDA_EB_OPT__SpecOutput G (F_DPDA_EB_OPT G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_OPT__SOUND)\n   apply(simp add: F_DPDA_EB_OPT__SpecInput_def)\n  apply(simp add: F_DPDA_EB_OPT__SpecInput_def F_DPDA_EB_OPT__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_OPT_enforces_accessible: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_OPT G = Some G'\n  \\<Longrightarrow> epdaS.accessible G'\"\n  apply(subgoal_tac \"F_DPDA_EB_OPT__SpecInput G \\<Longrightarrow> F_DPDA_EB_OPT__SpecOutput G (F_DPDA_EB_OPT G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_OPT__SOUND)\n   apply(simp add: F_DPDA_EB_OPT__SpecInput_def)\n  apply(simp add: F_DPDA_EB_OPT__SpecInput_def F_DPDA_EB_OPT__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_OPT_non_on_empty_lang: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_OPT G = None\n  \\<Longrightarrow> epdaS.marked_language G = {}\"\n  apply(subgoal_tac \"F_DPDA_EB_OPT__SpecInput G \\<Longrightarrow> F_DPDA_EB_OPT__SpecOutput G (F_DPDA_EB_OPT G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_OPT__SOUND)\n   apply(simp add: F_DPDA_EB_OPT__SpecInput_def)\n  apply(simp add: F_DPDA_EB_OPT__SpecInput_def F_DPDA_EB_OPT__SpecOutput_def)\n  done\n\ntheorem F_DPDA_EB_OPT_Nonblockingness_branching_restricted: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_OPT G = Some G'\n  \\<Longrightarrow> epdaH.Nonblockingness_branching_restricted G'\"\n  apply(subgoal_tac \"valid_dpda G'\")\n   prefer 2\n   apply(rule F_DPDA_EB_OPT_preserves_DPDA)\n    apply(force)\n   apply(force)\n  apply(rule epdaH.AX_BF_BraSBRest_DetHDB_LaOp)\n    apply(simp add: valid_dpda_def valid_pda_def)\n   apply(simp add: epdaH.is_forward_deterministicHist_DB_def)\n   apply(rule conjI)\n    apply(simp add: epdaH.is_forward_target_deterministicHist_DB_long_def)\n    apply(clarsimp)\n    apply(rename_tac c d c1 c2 n e w1 w2)(*strict*)\n    apply(simp add: epdaH_step_relation_def)\n    apply(clarsimp)\n   apply (metis DPDA_to_epdaH_determinism)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      in epdaH_vs_epdaHS_Nonblockingness_and_lang_transfer)\n   apply(simp add: valid_dpda_def valid_pda_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      in epdaH_vs_epdaHS_Nonblockingness_and_lang_transfer)\n   apply(simp add: valid_dpda_def valid_pda_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      in epdaS_vs_epdaHS_Nonblockingness_and_lang_transfer)\n   apply(simp add: valid_dpda_def valid_pda_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule F_DPDA_EB_OPT_enforces_langBF)\n    apply(force)\n   apply(force)\n  apply(simp add: nonblockingness_language_def)\n  done\n\ntheorem F_DPDA_EB_OPT_enforces_not_livelock: \"\n  valid_dpda G\n  \\<Longrightarrow> F_DPDA_EB_OPT G = Some G'\n  \\<Longrightarrow> \\<not> epdaH_livelock G'\"\n  apply(subgoal_tac \"F_DPDA_EB_OPT__SpecInput G \\<Longrightarrow> F_DPDA_EB_OPT__SpecOutput G (F_DPDA_EB_OPT G)\")\n   prefer 2\n   apply(rule F_DPDA_EB_OPT__SOUND)\n   apply(simp add: F_DPDA_EB_OPT__SpecInput_def)\n  apply(simp add: F_DPDA_EB_OPT__SpecInput_def F_DPDA_EB_OPT__SpecOutput_def)\n  done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_10/FUNCTION__F_DPDA_EB_OPT__F_DPDA_ENFORCE_NONBLOCKINGNESS_OPT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702880639791, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.33699333596282466}}
{"text": "theory flash2Bra  imports flash2Rev\n \n  begin\nlemma onInv2:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv2  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv2  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv2 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash2Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702761768249, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.33699333043646795}}
{"text": "(*  Title:      HOL/Auth/Guard/Guard_Shared.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2002  University of Cambridge\n*)\n\nsection{*lemmas on guarded messages for protocols with symmetric keys*}\n\ntheory Guard_Shared imports Guard GuardK \"../Shared\" begin\n\nsubsection{*Extensions to Theory @{text Shared}*}\n\ndeclare initState.simps [simp del]\n\nsubsubsection{*a little abbreviation*}\n\nabbreviation\n  Ciph :: \"agent => msg => msg\" where\n  \"Ciph A X == Crypt (shrK A) X\"\n\nsubsubsection{*agent associated to a key*}\n\ndefinition agt :: \"key => agent\" where\n\"agt K == @A. K = shrK A\"\n\nlemma agt_shrK [simp]: \"agt (shrK A) = A\"\nby (simp add: agt_def)\n\nsubsubsection{*basic facts about @{term initState}*}\n\nlemma no_Crypt_in_parts_init [simp]: \"Crypt K X ~:parts (initState A)\"\nby (cases A, auto simp: initState.simps)\n\nlemma no_Crypt_in_analz_init [simp]: \"Crypt K X ~:analz (initState A)\"\nby auto\n\nlemma no_shrK_in_analz_init [simp]: \"A ~:bad\n==> Key (shrK A) ~:analz (initState Spy)\"\nby (auto simp: initState.simps)\n\nlemma shrK_notin_initState_Friend [simp]: \"A ~= Friend C\n==> Key (shrK A) ~: parts (initState (Friend C))\"\nby (auto simp: initState.simps)\n\nlemma keyset_init [iff]: \"keyset (initState A)\"\nby (cases A, auto simp: keyset_def initState.simps)\n\nsubsubsection{*sets of symmetric keys*}\n\ndefinition shrK_set :: \"key set => bool\" where\n\"shrK_set Ks == ALL K. K:Ks --> (EX A. K = shrK A)\"\n\nlemma in_shrK_set: \"[| shrK_set Ks; K:Ks |] ==> EX A. K = shrK A\"\nby (simp add: shrK_set_def)\n\nlemma shrK_set1 [iff]: \"shrK_set {shrK A}\"\nby (simp add: shrK_set_def)\n\nlemma shrK_set2 [iff]: \"shrK_set {shrK A, shrK B}\"\nby (simp add: shrK_set_def)\n\nsubsubsection{*sets of good keys*}\n\ndefinition good :: \"key set => bool\" where\n\"good Ks == ALL K. K:Ks --> agt K ~:bad\"\n\nlemma in_good: \"[| good Ks; K:Ks |] ==> agt K ~:bad\"\nby (simp add: good_def)\n\nlemma good1 [simp]: \"A ~:bad ==> good {shrK A}\"\nby (simp add: good_def)\n\nlemma good2 [simp]: \"[| A ~:bad; B ~:bad |] ==> good {shrK A, shrK B}\"\nby (simp add: good_def)\n\n\nsubsection{*Proofs About Guarded Messages*}\n\nsubsubsection{*small hack*}\n\nlemma shrK_is_invKey_shrK: \"shrK A = invKey (shrK A)\"\nby simp\n\nlemmas shrK_is_invKey_shrK_substI = shrK_is_invKey_shrK [THEN ssubst]\n\nlemmas invKey_invKey_substI = invKey [THEN ssubst]\n\nlemma \"Nonce n:parts {X} ==> Crypt (shrK A) X:guard n {shrK A}\"\napply (rule shrK_is_invKey_shrK_substI, rule invKey_invKey_substI)\nby (rule Guard_Nonce, simp+)\n\nsubsubsection{*guardedness results on nonces*}\n\nlemma guard_ciph [simp]: \"shrK A:Ks ==> Ciph A X:guard n Ks\"\nby (rule Guard_Nonce, simp)\n\nlemma guardK_ciph [simp]: \"shrK A:Ks ==> Ciph A X:guardK n Ks\"\nby (rule Guard_Key, simp)\n\nlemma Guard_init [iff]: \"Guard n Ks (initState B)\"\nby (induct B, auto simp: Guard_def initState.simps)\n\nlemma Guard_knows_max': \"Guard n Ks (knows_max' C evs)\n==> Guard n Ks (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Nonce_not_used_Guard_spies [dest]: \"Nonce n ~:used evs\n==> Guard n Ks (spies evs)\"\nby (auto simp: Guard_def dest: not_used_not_known parts_sub)\n\nlemma Nonce_not_used_Guard [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_used parts_trans)\n\nlemma Nonce_not_used_Guard_max [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_max_used parts_trans)\n\nlemma Nonce_not_used_Guard_max' [dest]: \"[| evs:p; Nonce n ~:used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in Guard_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection{*guardedness results on keys*}\n\nlemma GuardK_init [simp]: \"n ~:range shrK ==> GuardK n Ks (initState B)\"\nby (induct B, auto simp: GuardK_def initState.simps)\n\nlemma GuardK_knows_max': \"[| GuardK n A (knows_max' C evs); n ~:range shrK |]\n==> GuardK n A (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Key_not_used_GuardK_spies [dest]: \"Key n ~:used evs\n==> GuardK n A (spies evs)\"\nby (auto simp: GuardK_def dest: not_used_not_known parts_sub)\n\nlemma Key_not_used_GuardK [dest]: \"[| evs:p; Key n ~:used evs;\nGets_correct p; one_step p |] ==> GuardK n A (knows (Friend C) evs)\"\nby (auto simp: GuardK_def dest: known_used parts_trans)\n\nlemma Key_not_used_GuardK_max [dest]: \"[| evs:p; Key n ~:used evs;\nGets_correct p; one_step p |] ==> GuardK n A (knows_max (Friend C) evs)\"\nby (auto simp: GuardK_def dest: known_max_used parts_trans)\n\nlemma Key_not_used_GuardK_max' [dest]: \"[| evs:p; Key n ~:used evs;\nGets_correct p; one_step p |] ==> GuardK n A (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in GuardK_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection{*regular protocols*}\n\ndefinition regular :: \"event list set => bool\" where\n\"regular p == ALL evs A. evs:p --> (Key (shrK A):parts (spies evs)) = (A:bad)\"\n\nlemma shrK_parts_iff_bad [simp]: \"[| evs:p; regular p |] ==>\n(Key (shrK A):parts (spies evs)) = (A:bad)\"\nby (auto simp: regular_def)\n\nlemma shrK_analz_iff_bad [simp]: \"[| evs:p; regular p |] ==>\n(Key (shrK A):analz (spies evs)) = (A:bad)\"\nby auto\n\nlemma Guard_Nonce_analz: \"[| Guard n Ks (spies evs); evs:p;\nshrK_set Ks; good Ks; regular p |] ==> Nonce n ~:analz (spies evs)\"\napply (clarify, simp only: knows_decomp)\napply (drule Guard_invKey_keyset, simp+, safe)\napply (drule in_good, simp)\napply (drule in_shrK_set, simp+, clarify)\napply (frule_tac A=A in shrK_analz_iff_bad)\nby (simp add: knows_decomp)+\n\nlemma GuardK_Key_analz: \"[| GuardK n Ks (spies evs); evs:p;\nshrK_set Ks; good Ks; regular p; n ~:range shrK |] ==> Key n ~:analz (spies evs)\"\napply (clarify, simp only: knows_decomp)\napply (drule GuardK_invKey_keyset, clarify, simp+, simp add: initState.simps image_eq_UN)\napply clarify\napply (drule in_good, simp)\napply (drule in_shrK_set, simp+, clarify)\napply (frule_tac A=A in shrK_analz_iff_bad)\nby (simp add: knows_decomp)+\n\nend", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/Guard/Guard_Shared.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3369914102474836}}
{"text": "theory CorrectnessOriginal\nimports Denotational Launchbury\nbegin\n\ntext \\<open>\nThis is the main correctness theorem, Theorem 2 from \\<^cite>\\<open>\"launchbury\"\\<close>.\n\\<close>\n\n(* Another possible invariant seems to be: \"edom \\<rho> - domA \\<Gamma> \\<subseteq> set L\" *)\n\ntheorem correctness:\n  assumes \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : v\"\n  and     \"fv (\\<Gamma>, e) \\<subseteq> set L \\<union> domA \\<Gamma>\"\n  shows   \"\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> = \\<lbrakk>v\\<rbrakk>\\<^bsub>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>\"\n  and     \"(\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` domA \\<Gamma> = (\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>\"\n  using assms\nproof(nominal_induct arbitrary: \\<rho> rule:reds.strong_induct)\ncase Lambda\n  case 1 show ?case..\n  case 2 show ?case..\nnext\ncase (Application y \\<Gamma> e x L \\<Delta> \\<Theta> v e')\n  have Gamma_subset: \"domA \\<Gamma> \\<subseteq> domA \\<Delta>\"\n    by (rule reds_doesnt_forget[OF Application.hyps(8)])\n\n  case 1\n  hence prem1: \"fv (\\<Gamma>, e) \\<subseteq> set L \\<union> domA \\<Gamma>\" and  \"x \\<in> set L \\<union> domA \\<Gamma>\" by auto\n  moreover\n  note reds_pres_closed[OF Application.hyps(8) prem1]\n  moreover\n  note reds_doesnt_forget[OF Application.hyps(8)] \n  moreover\n  have \"fv (e'[y::=x]) \\<subseteq> fv (Lam [y]. e') \\<union> {x}\"\n    by (auto simp add: fv_subst_eq)\n  ultimately\n  have prem2: \"fv (\\<Delta>, e'[y::=x]) \\<subseteq> set L \\<union> domA \\<Delta>\" by auto\n  \n  have *: \"(\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x = (\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x\"\n  proof(cases \"x \\<in> domA \\<Gamma>\")\n    case True\n    from Application.hyps(10)[OF prem1, where \\<rho> = \\<rho>]\n    have \"((\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` domA \\<Gamma>) x  = ((\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>) x\" by simp\n    with True show ?thesis by simp\n  next\n    case False\n    from False \\<open>x \\<in> set L \\<union> domA \\<Gamma>\\<close> reds_avoids_live[OF Application.hyps(8)] \n    show ?thesis by (auto simp add: lookup_HSem_other)\n  qed\n\n  text_raw \\<open>% nice proof start\\<close>\n  have \"\\<lbrakk> App e x \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> = (\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>) \\<down>Fn (\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x\"\n    by simp\n  also have \"\\<dots> = (\\<lbrakk> Lam [y]. e' \\<rbrakk>\\<^bsub>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>) \\<down>Fn (\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x\"\n    using Application.hyps(9)[OF prem1] by simp\n  also have \"\\<dots> = (\\<lbrakk> Lam [y]. e' \\<rbrakk>\\<^bsub>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>) \\<down>Fn (\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x\"\n    unfolding *..\n  also have \"\\<dots> = (Fn\\<cdot>(\\<Lambda> z. \\<lbrakk> e' \\<rbrakk>\\<^bsub>(\\<lbrace>\\<Delta>\\<rbrace>\\<rho>)(y := z)\\<^esub>)) \\<down>Fn (\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x\"\n    by simp\n  also have \"\\<dots> = \\<lbrakk> e' \\<rbrakk>\\<^bsub>(\\<lbrace>\\<Delta>\\<rbrace>\\<rho>)(y := (\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x)\\<^esub>\"\n    by simp\n  also have \"\\<dots> = \\<lbrakk> e'[y ::= x] \\<rbrakk>\\<^bsub>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>\"\n    unfolding ESem_subst..\n  also have \"\\<dots> = \\<lbrakk> v \\<rbrakk>\\<^bsub>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>\\<^esub>\"\n    by (rule Application.hyps(12)[OF prem2])\n  finally\n  show \"\\<lbrakk> App e x \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> = \\<lbrakk> v \\<rbrakk>\\<^bsub>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>\\<^esub>\".\n  text_raw \\<open>% nice proof end\\<close>\n  \n  show \"(\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` domA \\<Gamma> = (\\<lbrace>\\<Theta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>\"\n    using Application.hyps(10)[OF prem1]\n          env_restr_eq_subset[OF Gamma_subset Application.hyps(13)[OF prem2]]\n    by (rule trans)\nnext\ncase (Variable \\<Gamma> x e L \\<Delta> v)\n  hence [simp]:\"x \\<in> domA \\<Gamma>\" by (metis domA_from_set map_of_SomeD)\n\n  let ?\\<Gamma> = \"delete x \\<Gamma>\"\n\n  case 2\n  have \"x \\<notin> domA \\<Delta>\"\n    by (rule reds_avoids_live[OF Variable.hyps(2)], simp_all)\n\n  have subset: \"domA ?\\<Gamma> \\<subseteq> domA \\<Delta>\"\n    by (rule reds_doesnt_forget[OF Variable.hyps(2)])\n\n  let \"?new\" = \"domA \\<Delta> - domA \\<Gamma>\"\n  have \"fv (?\\<Gamma>, e) \\<union> {x} \\<subseteq> fv (\\<Gamma>, Var x)\"\n    by (rule fv_delete_heap[OF \\<open>map_of \\<Gamma> x = Some e\\<close>])\n  hence prem: \"fv (?\\<Gamma>, e) \\<subseteq> set (x # L) \\<union> domA ?\\<Gamma>\" using 2 by auto\n  hence fv_subset: \"fv (?\\<Gamma>, e) - domA ?\\<Gamma> \\<subseteq> - ?new\"\n    using reds_avoids_live'[OF Variable.hyps(2)] by auto\n\n  have \"domA \\<Gamma> \\<subseteq> (-?new)\" by auto\n\n  have \"\\<lbrace>\\<Gamma>\\<rbrace>\\<rho> = \\<lbrace>(x,e) # ?\\<Gamma>\\<rbrace>\\<rho>\"\n    by (rule HSem_reorder[OF map_of_delete_insert[symmetric, OF Variable(1)]])\n  also have \"\\<dots> = (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>(domA ?\\<Gamma>)\\<^esub> (\\<lbrace>?\\<Gamma>\\<rbrace>\\<rho>'))( x := \\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>))\"\n    by (rule iterative_HSem, simp)\n  also have \"\\<dots> = (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>(domA ?\\<Gamma>)\\<^esub> (\\<lbrace>?\\<Gamma>\\<rbrace>\\<rho>'))( x := \\<lbrakk> e \\<rbrakk>\\<^bsub>\\<lbrace>?\\<Gamma>\\<rbrace>\\<rho>'\\<^esub>))\"\n    by (rule iterative_HSem', simp)\n  finally\n  have \"(\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>)f|` (- ?new) = (...) f|` (- ?new)\" by simp\n  also have \"\\<dots> = (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>domA \\<Delta>\\<^esub> (\\<lbrace>\\<Delta>\\<rbrace>\\<rho>'))( x := \\<lbrakk> v \\<rbrakk>\\<^bsub>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>'\\<^esub>)) f|` (- ?new)\"\n  proof (induction rule: parallel_fix_ind[where P =\"\\<lambda> x y. x f|` (- ?new) = y f|` (- ?new)\"])\n    case 1 show ?case by simp\n  next\n    case 2 show ?case ..\n  next\n    case (3 \\<sigma> \\<sigma>')\n    hence \"\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<lbrace>?\\<Gamma>\\<rbrace>\\<sigma>\\<^esub> = \\<lbrakk> e \\<rbrakk>\\<^bsub>\\<lbrace>?\\<Gamma>\\<rbrace>\\<sigma>'\\<^esub>\"\n      and \"(\\<lbrace>?\\<Gamma>\\<rbrace>\\<sigma>) f|` domA ?\\<Gamma> = (\\<lbrace>?\\<Gamma>\\<rbrace>\\<sigma>') f|` domA ?\\<Gamma>\"\n      using fv_subset by (auto intro: ESem_fresh_cong HSem_fresh_cong  env_restr_eq_subset[OF _ 3])\n    from trans[OF this(1) Variable(3)[OF prem]] trans[OF this(2) Variable(4)[OF prem]]\n    have  \"\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<lbrace>?\\<Gamma>\\<rbrace>\\<sigma>\\<^esub> = \\<lbrakk> v \\<rbrakk>\\<^bsub>\\<lbrace>\\<Delta>\\<rbrace>\\<sigma>'\\<^esub>\"\n       and \"(\\<lbrace>?\\<Gamma>\\<rbrace>\\<sigma>) f|` domA ?\\<Gamma> = (\\<lbrace>\\<Delta>\\<rbrace>\\<sigma>') f|` domA ?\\<Gamma>\".\n    thus ?case\n      using subset\n      by (fastforce simp add: lookup_override_on_eq  lookup_env_restr_eq dest: env_restr_eqD )\n  qed\n  also have \"\\<dots> = (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>domA \\<Delta>\\<^esub> (\\<lbrace>\\<Delta>\\<rbrace>\\<rho>'))( x := \\<lbrakk> v \\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>)) f|` (-?new)\"\n    by (rule arg_cong[OF iterative_HSem'[symmetric], OF \\<open>x \\<notin> domA \\<Delta>\\<close>])\n  also have \"\\<dots> = (\\<lbrace>(x,v) # \\<Delta>\\<rbrace>\\<rho>)  f|` (-?new)\"\n    by (rule arg_cong[OF iterative_HSem[symmetric], OF \\<open>x \\<notin> domA \\<Delta>\\<close>])\n  finally\n  show le: ?case by (rule env_restr_eq_subset[OF \\<open>domA \\<Gamma> \\<subseteq> (-?new)\\<close>])\n\n  have \"\\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> = \\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<lbrace>(x, v) # \\<Delta>\\<rbrace>\\<rho>\\<^esub>\"\n    using env_restr_eqD[OF le, where x = x]\n    by simp\n  also have \"\\<dots> = \\<lbrakk> v \\<rbrakk>\\<^bsub>\\<lbrace>(x, v) # \\<Delta>\\<rbrace>\\<rho>\\<^esub>\"\n    by (auto simp add: lookup_HSem_heap)\n  finally\n  show \"\\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> = \\<lbrakk> v \\<rbrakk>\\<^bsub>\\<lbrace>(x, v) # \\<Delta>\\<rbrace>\\<rho>\\<^esub>\".\nnext\ncase (Bool b)\n  case 1\n  show ?case by simp\n  case 2\n  show ?case by simp\nnext\ncase (IfThenElse \\<Gamma> scrut L \\<Delta> b e\\<^sub>1 e\\<^sub>2 \\<Theta> v)\n  have Gamma_subset: \"domA \\<Gamma> \\<subseteq> domA \\<Delta>\"\n    by (rule reds_doesnt_forget[OF IfThenElse.hyps(1)])\n\n  let ?e = \"if b then e\\<^sub>1 else e\\<^sub>2\"\n\n  case 1\n\n  hence prem1: \"fv (\\<Gamma>, scrut) \\<subseteq> set L \\<union> domA \\<Gamma>\"\n    and prem2: \"fv (\\<Delta>, ?e) \\<subseteq> set L \\<union> domA \\<Delta>\"\n    and \"fv ?e \\<subseteq> domA \\<Gamma> \\<union> set L\"\n    using new_free_vars_on_heap[OF IfThenElse.hyps(1)] Gamma_subset by auto\n\n  have \"\\<lbrakk> (scrut ? e\\<^sub>1 : e\\<^sub>2) \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> = B_project\\<cdot>(\\<lbrakk> scrut \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>(\\<lbrakk> e\\<^sub>1 \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>(\\<lbrakk> e\\<^sub>2 \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\" by simp\n  also have \"\\<dots> = B_project\\<cdot>(\\<lbrakk> Bool b \\<rbrakk>\\<^bsub>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>(\\<lbrakk> e\\<^sub>1 \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>(\\<lbrakk> e\\<^sub>2 \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\"\n    unfolding IfThenElse.hyps(2)[OF prem1]..\n  also have \"\\<dots> = \\<lbrakk> ?e \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>\" by simp\n  also have \"\\<dots> = \\<lbrakk> ?e \\<rbrakk>\\<^bsub>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>\"\n    proof(rule ESem_fresh_cong_subset[OF  \\<open>fv ?e \\<subseteq> domA \\<Gamma> \\<union> set L\\<close> env_restr_eqI])\n      fix x\n      assume \"x \\<in> domA \\<Gamma> \\<union> set L\"\n      thus \"(\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x = (\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x\"\n      proof(cases \"x \\<in> domA \\<Gamma>\")\n        assume \"x \\<in> domA \\<Gamma>\"\n        from IfThenElse.hyps(3)[OF prem1]\n        have \"((\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` domA \\<Gamma>) x  = ((\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>) x\" by simp\n        with \\<open>x \\<in> domA \\<Gamma>\\<close> show ?thesis by simp\n      next\n        assume \"x \\<notin> domA \\<Gamma>\"\n        from this \\<open>x \\<in> domA \\<Gamma> \\<union> set L\\<close> reds_avoids_live[OF IfThenElse.hyps(1)]\n        show ?thesis\n          by (simp add: lookup_HSem_other)\n      qed\n    qed\n  also have \"\\<dots> = \\<lbrakk> v \\<rbrakk>\\<^bsub>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>\\<^esub>\"\n    unfolding IfThenElse.hyps(5)[OF prem2]..\n  finally\n  show ?case.\n  thm env_restr_eq_subset\n  show \"(\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` domA \\<Gamma> = (\\<lbrace>\\<Theta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>\"\n    using IfThenElse.hyps(3)[OF prem1]\n          env_restr_eq_subset[OF Gamma_subset IfThenElse.hyps(6)[OF prem2]]\n    by (rule trans)\nnext\ncase (Let as \\<Gamma> L body \\<Delta> v)\n  case 1\n  { fix a\n    assume a: \"a \\<in> domA  as\"\n    have \"atom a \\<sharp> \\<Gamma>\" \n      by (rule Let(1)[unfolded fresh_star_def, rule_format, OF imageI[OF a]])\n    hence \"a \\<notin> domA \\<Gamma>\"\n      by (metis domA_not_fresh)\n  }\n  note * = this\n\n  \n  have \"fv (as @ \\<Gamma>, body) - domA (as @ \\<Gamma>) \\<subseteq>  fv (\\<Gamma>, Let as body) - domA \\<Gamma>\"\n    by auto\n  with 1 have prem: \"fv (as @ \\<Gamma>, body) \\<subseteq> set L \\<union> domA (as @ \\<Gamma>)\" by auto\n  \n  have f1: \"atom ` domA as \\<sharp>* \\<Gamma>\"\n    using Let(1) by (simp add: set_bn_to_atom_domA)\n\n  have \"\\<lbrakk> Let as body \\<rbrakk>\\<^bsub>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> = \\<lbrakk> body \\<rbrakk>\\<^bsub>\\<lbrace>as\\<rbrace>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>\"\n    by (simp)\n  also have \"\\<dots> = \\<lbrakk> body \\<rbrakk>\\<^bsub>\\<lbrace>as @ \\<Gamma>\\<rbrace>\\<rho>\\<^esub>\"\n    by (rule arg_cong[OF HSem_merge[OF f1]])\n  also have \"\\<dots> = \\<lbrakk> v \\<rbrakk>\\<^bsub>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>\"\n    by (rule Let.hyps(4)[OF prem])\n  finally\n  show ?case.\n\n  have \"(\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` (domA \\<Gamma>) = (\\<lbrace>as\\<rbrace>(\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>)) f|` (domA \\<Gamma>)\"\n    apply (rule ext)\n    apply (case_tac \"x \\<in> domA as\")\n    apply (auto simp add: lookup_HSem_other lookup_env_restr_eq *)\n    done\n  also have \"\\<dots> = (\\<lbrace>as @ \\<Gamma>\\<rbrace>\\<rho>) f|` (domA \\<Gamma>)\"\n    by (rule arg_cong[OF HSem_merge[OF f1]])\n  also have \"\\<dots> = (\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` (domA \\<Gamma>)\"\n    by (rule env_restr_eq_subset[OF _ Let.hyps(5)[OF prem]]) simp\n  finally\n  show \"(\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` domA \\<Gamma> = (\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>\".\nqed\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Launchbury/CorrectnessOriginal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3369914028110428}}
{"text": "theory PF_Unknown_Match_Tacs\nimports PF_Matching_Ternary\nbegin\n\n(* adapted from Iptables_Semantics.Unknown_Match_Tacs *)\n\nsection\\<open>Approximate Matching Tactics\\<close>\ntext\\<open>in-doubt-tactics\\<close>\n\nfun in_doubt_allow :: \"'packet unknown_match_tac\" where\n  \"in_doubt_allow Pass _ _ = True\" |\n  \"in_doubt_allow Block _ _ = False\" |\n  \"in_doubt_allow ActionMatch Accept _ = True\" |\n  \"in_doubt_allow ActionMatch Reject _ = False\"\n\nfun in_doubt_deny :: \"'packet unknown_match_tac\" where\n  \"in_doubt_deny Pass _ _ = False\" |\n  \"in_doubt_deny Block _ _ = True\" |\n  \"in_doubt_deny ActionMatch Accept _ = False\" |\n  \"in_doubt_deny ActionMatch Reject _ = True\"\n\n(* a good matcher decides independent of the decision for actions other than Match *)\ndefinition good_matcher :: \"('a, 'p) match_tac \\<Rightarrow> bool\" where\n\"good_matcher \\<gamma> \\<longleftrightarrow> (\\<forall>a. a \\<noteq> ActionMatch \\<longrightarrow> (\\<forall>d1 d2. (snd \\<gamma>) a d1 = (snd \\<gamma>) a d2))\"\n\nlemma in_doubt_allow_good_matcher:\n \"good_matcher (\\<alpha>,in_doubt_allow)\"\n  unfolding good_matcher_def\nproof\n  fix a \n  show \"a \\<noteq> ActionMatch \\<longrightarrow> (\\<forall>d1 d2. snd (\\<alpha>, in_doubt_allow) a d1 = snd (\\<alpha>, in_doubt_allow) a d2)\"\n    by (cases a) auto\nqed\n\nlemma in_doubt_deny_good_matcher:\n  \"good_matcher (\\<alpha>,in_doubt_deny)\"\n  unfolding good_matcher_def\nproof\n  fix a \n  show \"a \\<noteq> ActionMatch \\<longrightarrow> (\\<forall>d1 d2. snd (\\<alpha>, in_doubt_deny) a d1 = snd (\\<alpha>, in_doubt_deny) a d2)\"\n    by (cases a) auto\nqed\n\nlemma packet_independent_unknown_match_tacs:\n    \"packet_independent_\\<alpha> in_doubt_allow\"\n    \"packet_independent_\\<alpha> in_doubt_deny\"\n  using in_doubt_allow.elims(3) packet_independent_\\<alpha>_def apply fastforce\n  using in_doubt_deny.elims(3) packet_independent_\\<alpha>_def by fastforce\n\n\nlemma Block_neq_Pass_unknown_match_tacs:\n      \"in_doubt_allow Block d \\<noteq> in_doubt_allow Pass d\"\n      \"in_doubt_deny Block d \\<noteq> in_doubt_deny Pass d\"\n  by(simp_all add: fun_eq_iff)\n\n\n\n(* use this more often to simplify existing proofs? *)\ncorollary matches_induction_case_MatchNot_in_doubt_allow:\n      \"\\<forall> a. matches (\\<beta>,in_doubt_allow) m' a d p = matches (\\<beta>,in_doubt_allow) m a d p \\<Longrightarrow>\n      matches (\\<beta>,in_doubt_allow) (MatchNot m') a d p = matches (\\<beta>,in_doubt_allow) (MatchNot m) a d p\"\n  by(rule  matches_induction_case_MatchNot) (simp_all add: Block_neq_Pass_unknown_match_tacs packet_independent_unknown_match_tacs)\n\ncorollary matches_induction_case_MatchNot_in_doubt_deny:\n      \"\\<forall> a. matches (\\<beta>,in_doubt_deny) m' a d p = matches (\\<beta>,in_doubt_deny) m a d p \\<Longrightarrow>\n      matches (\\<beta>,in_doubt_deny) (MatchNot m') a d p = matches (\\<beta>,in_doubt_deny) (MatchNot m) a d p\"\n  by(rule  matches_induction_case_MatchNot) (simp_all add: Block_neq_Pass_unknown_match_tacs packet_independent_unknown_match_tacs)\n\nend", "meta": {"author": "Sohalt", "repo": "pf-verification", "sha": "328f850913723dee6c9f6be069fbbc22a3762354", "save_path": "github-repos/isabelle/Sohalt-pf-verification", "path": "github-repos/isabelle/Sohalt-pf-verification/pf-verification-328f850913723dee6c9f6be069fbbc22a3762354/SemanticsTernary/PF_Unknown_Match_Tacs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3369913953746019}}
{"text": "theory PhiSem_Formalization_Tools\n  imports IDE_CP\nbegin\n\nsection \\<open>Tools for Formalizing Instructions\\<close>\n\nnamed_theorems discharging_semantic_debt\n  \\<open>Theorems that discharges or helps to discharge the debt axioms for semantic formalization.\\<close>\n\nsubsection \\<open>Elementary Constructions for Formalizing Instructions\\<close>\n\ndefinition \\<phi>M_assert :: \\<open>bool \\<Rightarrow> unit proc\\<close>\n  where \\<open>\\<phi>M_assert P = (\\<lambda>s. if P then Return \\<phi>V_none s else {Invalid})\\<close>\n\ndefinition \\<phi>M_assume :: \\<open>bool \\<Rightarrow> unit proc\\<close>\n  where \\<open>\\<phi>M_assume P = (\\<lambda>s. if P then Return \\<phi>V_none s else {AssumptionBroken})\\<close>\n\ndefinition \\<phi>M_getV_raw :: \\<open>(VAL \\<Rightarrow> 'v) \\<Rightarrow> VAL \\<phi>arg \\<Rightarrow> ('v \\<Rightarrow> 'y proc) \\<Rightarrow> 'y proc\\<close>\n  where \\<open>\\<phi>M_getV_raw VDT_dest v F = F (VDT_dest (\\<phi>arg.dest v))\\<close>\n\ndefinition \\<phi>M_getV :: \\<open>TY \\<Rightarrow> (VAL \\<Rightarrow> 'v) \\<Rightarrow> VAL \\<phi>arg \\<Rightarrow> ('v \\<Rightarrow> 'y proc) \\<Rightarrow> 'y::VALs proc\\<close>\n  where \\<open>\\<phi>M_getV TY VDT_dest v F =\n    (\\<phi>M_assert (\\<phi>arg.dest v \\<in> Well_Type TY) \\<ggreater> F (VDT_dest (\\<phi>arg.dest v)))\\<close>\n\ndefinition \\<phi>M_caseV :: \\<open>(VAL \\<phi>arg \\<Rightarrow> ('vr,'ret) proc') \\<Rightarrow> (VAL \\<times> 'vr::FIX_ARITY_VALs,'ret) proc'\\<close>\n  where \\<open>\\<phi>M_caseV F = (\\<lambda>arg. case arg of \\<phi>arg (a1,a2) \\<Rightarrow> F (\\<phi>arg a1) (\\<phi>arg a2))\\<close>\n\nsubsection \\<open>Reasoning for Elementary Constructions\\<close>\n\ndeclare \\<phi>SEQ[intro!]\n\nlemma \\<phi>M_assert[intro!]:\n  \\<open>(Inhabited X \\<Longrightarrow> P) \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> \\<phi>M_assert P \\<lbrace> X \\<longmapsto> \\<lambda>_. X \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> Any\\<close>\n  unfolding \\<phi>M_assert_def\n  by (rule \\<phi>Inhabited; simp; rule)\n\nlemma \\<phi>M_assert_True[simp]:\n  \\<open>\\<phi>M_assert True = Return \\<phi>V_none\\<close>\n  unfolding \\<phi>M_assert_def by simp\n\nlemma \\<phi>M_assert':\n  \\<open>P \\<Longrightarrow> Q (F args) \\<Longrightarrow> Q ((\\<phi>M_assert P \\<ggreater> F) args)\\<close>\n  unfolding \\<phi>M_assert_def bind_def Return_def det_lift_def by simp\n\nlemma \\<phi>M_assume[intro!]:\n  \\<open>(P \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> F \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E) \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> (\\<phi>M_assume P \\<ggreater> F) \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n  unfolding \\<phi>Procedure_def \\<phi>M_assume_def bind_def Return_def det_lift_def\n  by clarsimp\n\nlemma \\<phi>M_tail_left:  \\<open>\\<p>\\<r>\\<o>\\<c> F \\<lbrace> 1\\<heavy_comma> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> F \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close> by simp\nlemma \\<phi>M_tail_right: \\<open>\\<p>\\<r>\\<o>\\<c> F \\<lbrace> X \\<longmapsto> \\<lambda>v. 1 \\<heavy_comma> Y v \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> F \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close> by simp\nlemma \\<phi>M_tail_right_right: \\<open>\\<p>\\<r>\\<o>\\<c> F \\<lbrace> X \\<longmapsto> \\<lambda>v. Y v\\<heavy_comma> 1 \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> F \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close> by simp\nlemma \\<phi>M_shrink_left:  \\<open>\\<p>\\<r>\\<o>\\<c> F \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> F \\<lbrace> 1\\<heavy_comma> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close> by simp\nlemma \\<phi>M_shrink_right[intro!]: \\<open>\\<p>\\<r>\\<o>\\<c> F \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> F \\<lbrace> X \\<longmapsto> \\<lambda>v. 1\\<heavy_comma> Y v \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close> by simp\n\nlemma \\<phi>M_getV_raw[intro!]:\n   \\<open>(v \\<in> (x \\<Ztypecolon> A) \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> F (VDT_dest v) \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E  )\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> \\<phi>M_getV_raw VDT_dest (\\<phi>arg v) F \\<lbrace> X\\<heavy_comma> x \\<Ztypecolon> Val (\\<phi>arg v) A \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<close>\n  unfolding \\<phi>M_getV_raw_def Premise_def\n  by (clarsimp simp add: \\<phi>expns norm_precond_conj)\n\ndeclare \\<phi>M_getV_raw[where X=1, simplified, intro!]\n\nlemma \\<phi>M_getV[intro!]:\n   \\<open>(v \\<in> (x \\<Ztypecolon> A) \\<Longrightarrow> <\\<phi>expn> v \\<in> Well_Type TY)\n\\<Longrightarrow> (v \\<in> (x \\<Ztypecolon> A) \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> F (VDT_dest v) \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E  )\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> \\<phi>M_getV TY VDT_dest (\\<phi>arg v) F \\<lbrace> X\\<heavy_comma> x \\<Ztypecolon> Val (\\<phi>arg v) A \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<close>\n  unfolding \\<phi>M_getV_def Premise_def\n  by (clarsimp simp add: \\<phi>expns norm_precond_conj)\n\ndeclare \\<phi>M_getV[where X=1, simplified, intro!]\n\nlemma \\<phi>M_caseV[intro!]:\n  \\<open> \\<p>\\<r>\\<o>\\<c> F va vb \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> \\<phi>M_caseV F (\\<phi>V_pair va vb) \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<close>\n  unfolding \\<phi>M_caseV_def \\<phi>V_pair_def by simp\n\n\nsubsection \\<open>Elementary Constructions for Reasoning Fictions\\<close>\n\ntext \\<open>It is a Hybrid Dynamic Logic\\<close>\n\ndefinition \\<phi>Res_Spec :: \\<open>rassn \\<Rightarrow> rassn\\<close>\n  where \\<open>\\<phi>Res_Spec S = RES.SPACE \\<inter> S\\<close>\n\ndefinition \\<phi>Res_Sat  :: \\<open>resource \\<Rightarrow> rassn \\<Rightarrow> bool\\<close>\n  where \\<open>\\<phi>Res_Sat s P \\<longleftrightarrow> s \\<in> P\\<close>\n\nabbreviation \\<phi>Res_Sat'  :: \\<open>resource \\<Rightarrow> rassn \\<Rightarrow> bool\\<close> (\"\\<s>\\<t>\\<a>\\<t>\\<e> _ \\<i>\\<s> _\" [11,11] 10)\n  where \\<open>\\<phi>Res_Sat' s P \\<equiv> \\<phi>Res_Sat s (\\<phi>Res_Spec P)\\<close>\n\ndefinition \\<phi>Comp_Sat :: \\<open>'ret comp set \\<Rightarrow> ('ret::VALs \\<phi>arg \\<Rightarrow> rassn) \\<Rightarrow> (ABNM \\<Rightarrow> rassn) \\<Rightarrow> bool\\<close>\n  where \\<open>\\<phi>Comp_Sat c S E \\<longleftrightarrow> c \\<subseteq> \\<S> S E\\<close>\n\nabbreviation \\<phi>Comp_Sat' :: \\<open>'ret comp set \\<Rightarrow> ('ret::VALs \\<phi>arg \\<Rightarrow> rassn) \\<Rightarrow> (ABNM \\<Rightarrow> rassn) \\<Rightarrow> bool\\<close>\n                          (\"_ \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> _ \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> _\" [11,11,11] 10)\n  where \\<open>\\<phi>Comp_Sat' c S E \\<equiv> \\<phi>Comp_Sat c (\\<lambda>r. \\<phi>Res_Spec (S r)) (\\<lambda>e. \\<phi>Res_Spec (E e))\\<close>\n\nlemma \\<phi>Comp_Sat_success[simp]:\n  \\<open> ({Success ret res} \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E)\n\\<longleftrightarrow> (\\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> Y ret)\\<close>\n  unfolding \\<phi>Comp_Sat_def \\<phi>Res_Sat_def by simp\n\nlemma \\<phi>Res_Sat_0[iff]:\n  \\<open>\\<not> (\\<s>\\<t>\\<a>\\<t>\\<e> x \\<i>\\<s> {})\\<close> \\<open>\\<not> (\\<s>\\<t>\\<a>\\<t>\\<e> x \\<i>\\<s> 0)\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def by (simp add: zero_set_def)+\n\n(*lemma \\<phi>Res_Sat_0[iff]:\n  \\<open>(\\<s>\\<t>\\<a>\\<t>\\<e> x \\<i>\\<s> {})\\<close> \\<open>\\<not> (\\<s>\\<t>\\<a>\\<t>\\<e> x \\<i>\\<s> 0)\\<close>\n  unfolding \\<phi>Res_Sat_def by (simp add: zero_set_def)+\n\nlemma \\<phi>Res_Spec_1[iff]:\n  \\<open>\\<phi>Res_Spec 1 = 1\\<close>\n  unfolding \\<phi>Res_Spec_def by (simp add: set_eq_iff; blast) *)\n\n(*lemma \\<phi>Res_Spec_mult_homo:\n  \\<open>\\<phi>Res_Spec (A * B) = \\<phi>Res_Spec A * \\<phi>Res_Spec B\\<close>\n  unfolding \\<phi>Res_Spec_def\n  by (clarsimp simp add: set_eq_iff times_set_def; rule; clarsimp simp add: RES.SPACE_mult_homo; blast) *)\n\nlemma \\<phi>Res_Sat_subj[iff]:\n  \\<open>(\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> S \\<s>\\<u>\\<b>\\<j> P) \\<longleftrightarrow> (\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> S) \\<and> P\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def by (simp add: \\<phi>expns set_eq_iff)\n\nlemma \\<phi>Comp_Sat_subj:\n  \\<open> P\n\\<Longrightarrow> c \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> S \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> c \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> (\\<lambda>v. S v \\<s>\\<u>\\<b>\\<j> P) \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n  by (clarsimp simp add: \\<phi>expns set_eq_iff)\n\nlemma \\<phi>Res_Sat_ex[iff]:\n  \\<open>(\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> ExSet S) \\<longleftrightarrow> (\\<exists>x. \\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> S x)\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def by (simp add: \\<phi>expns set_eq_iff)\n\nlemma \\<phi>Res_Sat_ex_ret:\n  \\<open> c \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> S x \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> c \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> (\\<lambda>v. \\<exists>*x. S x v) \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n  unfolding \\<phi>Comp_Sat_def \\<phi>Res_Spec_def\n  apply (clarsimp simp add: \\<phi>expns set_eq_iff subset_iff)\n  subgoal for x by (cases x; clarsimp simp add: \\<phi>expns set_eq_iff subset_iff; blast) .\n\nlemma \\<phi>Res_Sat_ex_abn:\n  \\<open> c \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> S \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E x\n\\<Longrightarrow> c \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> S \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> (\\<lambda>v. \\<exists>*x. E x v)\\<close>\n  unfolding \\<phi>Comp_Sat_def \\<phi>Res_Spec_def\n  apply (clarsimp simp add: \\<phi>expns set_eq_iff subset_iff)\n  subgoal for x by (cases x; clarsimp simp add: \\<phi>expns set_eq_iff subset_iff; blast) .\n\n(*lemma \\<phi>INTERP_RES_\\<phi>Res_Spec:\n  \\<open>res \\<in> INTERP_RES fic \\<longleftrightarrow> res \\<in> \\<phi>Res_Spec (\\<I> FIC.INTERP fic) \\<and> fic \\<in> FIC.SPACE\\<close>\n  unfolding In_INTERP_RES \\<phi>Res_Spec_def by simp blast *)\n\nterm \\<open>\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> \\<I> FIC.INTERP (r * p) \\<s>\\<u>\\<b>\\<j> p. p \\<in> P \\<and> r \\<in> FIC.SPACE \\<and> p \\<in> FIC.SPACE \\<and> r ## p\\<close>\n\nlemma \\<phi>Procedure_Hybrid_DL:\n  \\<open> \\<p>\\<r>\\<o>\\<c> f \\<lbrace> P \\<longmapsto> Q \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<longleftrightarrow> (\\<forall>r s. (\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> \\<I> FIC.INTERP (r * p) \\<s>\\<u>\\<b>\\<j> p. p \\<in> P \\<and> r \\<in> FIC.SPACE \\<and> p \\<in> FIC.SPACE \\<and> r ## p)\n       \\<longrightarrow> (f s \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> (\\<lambda>v. \\<I> FIC.INTERP (r * q) \\<s>\\<u>\\<b>\\<j> q. q \\<in> Q v \\<and> r \\<in> FIC.SPACE \\<and> q \\<in> FIC.SPACE \\<and> r ## q)\n                \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> (\\<lambda>v. \\<I> FIC.INTERP (r * e) \\<s>\\<u>\\<b>\\<j> e. e \\<in> E v \\<and> r \\<in> FIC.SPACE \\<and> e \\<in> FIC.SPACE \\<and> r ## e)))\\<close>\n  apply rule\n   apply (unfold \\<phi>Procedure_alt INTERP_SPEC \\<phi>Res_Sat_def \\<phi>Comp_Sat_def \\<phi>Res_Spec_def subset_iff)\n   apply (clarsimp simp add: times_set_def \\<phi>expns In_INTERP_RES)\n  thm In_INTERP_RES\n  subgoal premises prems for r res s c proof-\n    have t1: \\<open>(\\<exists>fic. (\\<exists>y. fic = r * y \\<and> y \\<in> P \\<and> r ## y) \\<and> res \\<in> RES.SPACE \\<and> fic \\<in> FIC.SPACE \\<and> res \\<in> \\<I> FIC.INTERP fic)\\<close>\n      using FIC.SPACE_mult_homo prems by blast\n    show ?thesis\n      apply (insert prems(1)[THEN spec[where x=res], THEN spec[where x=r], THEN mp, OF t1,\n              THEN spec[where x=s], THEN mp, OF \\<open>s \\<in> f res\\<close>])\n      apply (cases s; clarsimp simp add: \\<phi>expns In_INTERP_RES FIC.SPACE_mult_homo)\n      apply force\n      using FIC.SPACE_mult_homo by blast\n  qed\n  apply (clarsimp simp add: times_set_def \\<phi>expns In_INTERP_RES)\n  subgoal premises prems for res r s c proof-\n    have t1: \\<open>res \\<in> RES.SPACE \\<and> (\\<exists>c. res \\<in> \\<I> FIC.INTERP (r * c) \\<and> c \\<in> P \\<and> r \\<in> FIC.SPACE \\<and> c \\<in> FIC.SPACE \\<and> r ## c)\\<close>\n      using prems FIC.SPACE_mult_homo by blast\n    show ?thesis\n      apply (insert prems(1)[THEN spec[where x=r], THEN spec[where x=res], THEN mp, OF t1,\n              THEN spec[where x=s], THEN mp, OF \\<open>s \\<in> _\\<close>])\n      apply (cases s; simp add: \\<phi>expns In_INTERP_RES)\n      using FIC.SPACE_mult_homo apply blast\n      using FIC.SPACE_mult_homo by blast\n  qed .\n\nlemma \\<phi>Res_Spec_expn_R:\n  \\<open>\\<phi>Res_Spec (\\<I> FIC.INTERP (r * p) \\<s>\\<u>\\<b>\\<j> p. p \\<in> (R \\<heavy_comma> X) \\<and> r \\<in> FIC.SPACE \\<and> p \\<in> FIC.SPACE \\<and> r ## p)\n = \\<phi>Res_Spec (\\<I> FIC.INTERP (r * u * x) \\<s>\\<u>\\<b>\\<j> u x. u \\<in> R \\<and> x \\<in> X \\<and> (r * u) \\<in> FIC.SPACE \\<and> x \\<in> FIC.SPACE\n                                           \\<and> r ## u \\<and> (r * u) ## x)\\<close>\n  unfolding set_eq_iff \\<phi>Res_Spec_def\n  apply (clarsimp simp add: \\<phi>expns; rule; clarify)\n  apply (metis FIC.SPACE_mult_homo sep_disj_multD1 sep_disj_multI1 sep_mult_assoc')\n  by (metis FIC.SPACE_mult_homo sep_disj_multD2 sep_disj_multI2 sep_mult_assoc)\n\n(*\nlemma \\<phi>Res_Sat_expn_R:\n  \\<open> (\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> \\<I> FIC.INTERP (r * p) \\<s>\\<u>\\<b>\\<j> p. p \\<in> (R \\<heavy_comma> X) \\<and> r \\<in> FIC.SPACE \\<and> p \\<in> FIC.SPACE \\<and> r ## p)\n\\<longleftrightarrow> (\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> \\<I> FIC.INTERP (r * u * x) \\<s>\\<u>\\<b>\\<j> u x. u \\<in> R \\<and> x \\<in> X \\<and> (r * u) \\<in> FIC.SPACE \\<and> x \\<in> FIC.SPACE\n                                           \\<and> r ## u \\<and> (r * u) ## x)\\<close>\n  unfolding \\<phi>Res_Sat_def using \\<phi>Res_Spec_expn_R by simp *)\n\n(*lemma \\<phi>Res_Comp_expn_R:\n  \\<open> (c \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> \\<I> FIC.INTERP (r * p) \\<s>\\<u>\\<b>\\<j> p. p \\<in> (R \\<heavy_comma> X) \\<and> r \\<in> FIC.SPACE \\<and> p \\<in> FIC.SPACE \\<and> r ## p)\n\\<longleftrightarrow> (c \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> \\<I> FIC.INTERP (r * u * x) \\<s>\\<u>\\<b>\\<j> u x. u \\<in> R \\<and> x \\<in> X \\<and> (r * u) \\<in> FIC.SPACE \\<and> x \\<in> FIC.SPACE\n                                           \\<and> r ## u \\<and> (r * u) ## x)\\<close>\n  unfolding \\<phi>Res_Sat_def using \\<phi>Res_Spec_expn_R by simp *)\n\n\nlemma \\<phi>Res_Sat_expn_impEx:\n  \\<open>((\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> (ExSet A)) \\<longrightarrow> P) \\<longleftrightarrow> (\\<forall>a. (\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> A a) \\<longrightarrow> P)\\<close>\n  by (simp add: ExSet_def \\<phi>Res_Sat_def \\<phi>Res_Spec_def)\n\nlemma \\<phi>Res_Sat_expn_impSubj:\n  \\<open>((\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> A \\<s>\\<u>\\<b>\\<j> B) \\<longrightarrow> P) \\<longleftrightarrow> (B \\<longrightarrow> (\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> A) \\<longrightarrow> P)\\<close>\n  by (simp add: Subjection_expn \\<phi>Res_Sat_def \\<phi>Res_Spec_def; blast)\n\n\nparagraph \\<open>Weakest Precondition Transformer for \\<phi>Res_Spec\\<close>\n\nlemma \\<phi>M_RS_WP_SEQ[intro!]:\n  \\<open> F s \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> P \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> (\\<And>v s. \\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> P v \\<Longrightarrow> G v s \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Q \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E)\n\\<Longrightarrow> (F \\<bind> G) s \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Q \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n  unfolding bind_def subset_iff \\<phi>Res_Sat_def \\<phi>Comp_Sat_def\n  apply clarsimp subgoal for s s'\n    by (cases s'; simp; cases s; clarsimp ; blast) .\n\n\nsection \\<open>Predefined Resource Snippet\\<close>\n\nsubsection \\<open>Minimal Resource\\<close>\n\nlocale resource =\n  resource_kind RES.DOMAIN Res\n  for Res :: \"'T::sep_algebra resource_entry\"\nbegin\n\nlemma get_res_valid_raw:\n  \\<open> res \\<in> RES.SPACE\n\\<Longrightarrow> get res \\<in>\\<^sub>S domain\\<close>\n  unfolding RES.SPACE_def\n  apply simp\n  by (metis in_image_sep_closed inj_Sep_Closed proj_inj raw_domain)\n\nlemma get_res_Valid:\n  \\<open> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> S\n\\<Longrightarrow> get res \\<in>\\<^sub>S domain\\<close>\n  unfolding \\<phi>Res_Spec_def \\<phi>Res_Sat_def by (clarsimp simp add: \\<r>_valid_split')\n\n\ndefinition \\<open>basic_fiction I = Interp (\\<lambda>x. { 1(Res #= y) |y. y \\<in> \\<I> I x })\\<close>\nlemma basic_fiction_\\<I>:\n  \"\\<I> (basic_fiction I) = (\\<lambda>x. { 1(Res #= y) |y. y \\<in> \\<I> I x})\"\n  unfolding basic_fiction_def\n  by (rule Interp_inverse) (clarsimp simp add: Interpretation_def one_set_def)\n\nlemma \\<F>_itself_expn[\\<phi>expns]:\n  \\<open>R2 ## x\n\\<Longrightarrow> \\<phi>Res_Spec (\\<I> (basic_fiction \\<F>_it) (R2 * x))\n  = \\<phi>Res_Spec (\\<I> (basic_fiction \\<F>_it) R2 * {mk x})\\<close>\n  unfolding \\<phi>Res_Spec_def set_eq_iff\n  apply (clarsimp simp add: \\<phi>expns basic_fiction_\\<I> prj.homo_mult)\n  apply (rule; clarify)\n   apply (simp add: mk_homo_mult sep_mult_assoc')\n  using SPACE_mult_homo inj.homo_mult by force\n\nlemma implies_part:\n  \\<open> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * {mk x}\n\\<Longrightarrow> x \\<preceq>\\<^sub>S\\<^sub>L get res\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def join_sub_def times_set_def apply clarsimp\n  using get_homo_mult sep_disj_get_name by fastforce\n\nend\n\n\nsubsection \\<open>Fictions\\<close>\n\nsubsubsection \\<open>Basic Fiction\\<close>\n\nlocale basic_fiction =\n   R: resource Res\n+  fiction_kind FIC.DOMAIN INTERPRET Fic \\<open>R.basic_fiction I\\<close>\nfor Res :: \"'T::sep_algebra resource_entry\"\nand I :: \"('U::sep_algebra, 'T) interp\"\nand Fic :: \"'U fiction_entry\"\nbegin\n\nparagraph \\<open>\\<phi>-Type\\<close>\n\ndefinition \\<phi> :: \\<open>('U, 'x) \\<phi> \\<Rightarrow> (fiction, 'x) \\<phi>\\<close>\n    \\<comment> \\<open>\\<phi>Type for level-1 mapping\\<close>\n  where \\<open>\\<phi> T = (\\<lambda>x. { mk v |v. v \\<in> (x \\<Ztypecolon> T) })\\<close>\n\nlemma \\<phi>_expn[\\<phi>expns]:\n  \\<open>p \\<in> (x \\<Ztypecolon> \\<phi> T) \\<longleftrightarrow> (\\<exists>v. p = mk v \\<and> v \\<in> (x \\<Ztypecolon> T))\\<close>\n  unfolding \\<phi>Type_def \\<phi>_def by simp\n\nlemma \\<phi>_inhabited[\\<phi>inhabitance_rule, elim!]:\n  \\<open>Inhabited (x \\<Ztypecolon> \\<phi> T) \\<Longrightarrow> (Inhabited (x \\<Ztypecolon> T) \\<Longrightarrow> C) \\<Longrightarrow> C\\<close>\n  unfolding Inhabited_def by (simp add: \\<phi>expns)\n\nlemma \\<phi>_Prod:\n  \\<open> \\<phi> T \\<^emph> \\<phi> U = \\<phi> (T \\<^emph> U)\\<close>\n  apply (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; rule; clarsimp)\n  apply (metis mk_homo_mult)\n  by (metis fun_1upd_homo inj.homo_mult sep_disj_mk)\n\nlemma \\<phi>_\\<phi>None:\n  \\<open>\\<phi> \\<circle> = \\<circle>\\<close>\n  by (rule \\<phi>Type_eqI; simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1200 for \\<open>(?x \\<Ztypecolon> \\<phi> \\<circle>) = ?Z @action clean_automation_waste\\<close>]:\n  \\<open>(x \\<Ztypecolon> \\<phi> \\<circle>) = (() \\<Ztypecolon> \\<circle>) @action clean_automation_waste\\<close>\n  unfolding Action_Tag_def \\<phi>_\\<phi>None by simp\n\nlemma [\\<phi>reason 1300 for \\<open>(?x \\<Ztypecolon> \\<phi> \\<circle>) = ?Z @action clean_automation_waste\\<close>]:\n  \\<open>(x \\<Ztypecolon> \\<phi> \\<circle>) = 1 @action clean_automation_waste\\<close>\n  unfolding Action_Tag_def \\<phi>_\\<phi>None by simp\n\n\n(*\nlemma [\\<phi>reason 1500 for \\<open>(x \\<Ztypecolon> \\<phi> \\<circle>) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?Y \\<a>\\<n>\\<d> ?P @action (?Act::?'act::simplification action)\\<close>]:\n  \\<open>(x \\<Ztypecolon> \\<phi> \\<circle>) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (() \\<Ztypecolon> \\<circle>) @action Act\\<close>\n  for Act :: \\<open>'act::simplification action\\<close>\n  unfolding Action_Tag_def \\<phi>_\\<phi>None\n  by (simp add: implies_refl) *)\n\nparagraph \\<open>Reasoning Rules\\<close>\n\nlemma \\<phi>_cast:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi> U \\<a>\\<n>\\<d> P\\<close>\n  unfolding Imply_def by (clarsimp simp add: \\<phi>expns)\n\nlemma \\<phi>_Structural_Extract:\n  \\<open> Structural_Extract (x \\<Ztypecolon> T) (r \\<Ztypecolon> R) (y \\<Ztypecolon> U) (w \\<Ztypecolon> W) P\n\\<Longrightarrow> Structural_Extract (x \\<Ztypecolon> \\<phi> T) (r \\<Ztypecolon> \\<phi> R) (y \\<Ztypecolon> \\<phi> U) (w \\<Ztypecolon> \\<phi> W) P\\<close>\n  unfolding Structural_Extract_def\n  by (simp add: \\<phi>Prod_expn'[symmetric] \\<phi>_Prod \\<phi>_cast)\n\ndeclare \\<phi>_Structural_Extract[THEN SE_clean_waste, \\<phi>reason 1200]\n\nlemma [THEN SE_clean_waste', \\<phi>reason 1211]:\n  \\<open> Structural_Extract (x \\<Ztypecolon> T) (r \\<Ztypecolon> R) (y \\<Ztypecolon> U) (w \\<Ztypecolon> W)\n      (Automatic_Morphism RP (Structural_Extract (y' \\<Ztypecolon> U') (w' \\<Ztypecolon> W') (x' \\<Ztypecolon> T') (r' \\<Ztypecolon> R') P') \\<and> P)\n\\<Longrightarrow> Structural_Extract (x \\<Ztypecolon> \\<phi> T) (r \\<Ztypecolon> \\<phi> R) (y \\<Ztypecolon> \\<phi> U) (w \\<Ztypecolon> \\<phi> W)\n      (Automatic_Morphism RP (Structural_Extract (y' \\<Ztypecolon> \\<phi> U') (w' \\<Ztypecolon> \\<phi> W') (x' \\<Ztypecolon> \\<phi> T') (r' \\<Ztypecolon> \\<phi> R') P') \\<and> P)\\<close>\n  unfolding Morphism_def Action_Tag_def\n  by (blast intro: \\<phi>_Structural_Extract[unfolded Action_Tag_def]\n                   Structural_Extract_imply_P)\n\nlemma ToSA_by_structural_extraction:\n  \" Structure_Info U Q\n\\<Longrightarrow> \\<s>\\<i>\\<m>\\<p>\\<l>\\<i>\\<f>\\<y> Q' : Q\n\\<Longrightarrow> (Q' \\<Longrightarrow> \\<r>CALL Try Any (Structural_Extract (y \\<Ztypecolon> \\<phi> U) R1 (x \\<Ztypecolon> \\<phi> T) W P2))\n\\<Longrightarrow> A \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> R2 \\<heavy_comma> \\<blangle> W \\<brangle> \\<a>\\<n>\\<d> P1\n\\<Longrightarrow> A \\<heavy_comma> y \\<Ztypecolon> \\<phi> U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> R2\\<heavy_comma> R1\\<heavy_comma> \\<blangle> x \\<Ztypecolon> \\<phi> T \\<brangle> \\<a>\\<n>\\<d> P1 \\<and> P2\"\n  unfolding Premise_def FOCUS_TAG_def Structural_Extract_def Simplify_def Try_def \\<r>Call_def\n  \\<medium_left_bracket> premises SI and Q and SE and A\n  have \\<open>Q'\\<close> using \\<phi> SI[unfolded Structure_Info_def] Q by blast\n  ;;  A[THEN implies_right_prod]\n     SE[OF \\<open>Q'\\<close>]\n  \\<medium_right_bracket> using \\<phi> by simp .\n\nlemma ToSA_by_structural_extraction__reverse_morphism:\n  \" Structure_Info U Q\n\\<Longrightarrow> \\<s>\\<i>\\<m>\\<p>\\<l>\\<i>\\<f>\\<y> Q' : Q\n\\<Longrightarrow> (Q' \\<Longrightarrow> \\<r>CALL Try Any (Structural_Extract (y \\<Ztypecolon> \\<phi> U) R1 (x \\<Ztypecolon> \\<phi> T) W\n             (Automatic_Morphism RP2 (Structural_Extract (x' \\<Ztypecolon> \\<phi> T') W' (y' \\<Ztypecolon> \\<phi> U') R1' P2') \\<and> P2)))\n\\<Longrightarrow> A \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> R2 \\<heavy_comma> \\<blangle> W \\<brangle> \\<a>\\<n>\\<d> (Automatic_Morphism RP1 (R2'\\<heavy_comma> \\<blangle> W' \\<brangle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> A' \\<a>\\<n>\\<d> P1') \\<and> P1)\n\\<Longrightarrow> A \\<heavy_comma> y \\<Ztypecolon> \\<phi> U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> R2\\<heavy_comma> R1\\<heavy_comma> \\<blangle> x \\<Ztypecolon> \\<phi> T \\<brangle> \\<a>\\<n>\\<d>\n      (Automatic_Morphism (RP2 \\<and>\\<^sub>\\<r> RP1) (R2'\\<heavy_comma> R1'\\<heavy_comma> \\<blangle> x' \\<Ztypecolon> \\<phi> T' \\<brangle> \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> A'\\<heavy_comma> y' \\<Ztypecolon> \\<phi> U' \\<a>\\<n>\\<d> P1' \\<and> P2')\n          \\<and> P1 \\<and> P2)\"\n  unfolding Premise_def FOCUS_TAG_def Structural_Extract_def Simplify_def\n            Morphism_def Compact_Antecedent_def Try_def \\<r>Call_def\n  \\<medium_left_bracket> premises SI and Q and SE and A\n  have \\<open>Q'\\<close> using \\<phi> SI[unfolded Structure_Info_def] Q by blast\n  ;; A[THEN implies_right_prod]\n     SE[OF \\<open>Q'\\<close>]\n  \\<medium_right_bracket> apply (simp add: \\<phi>)\n    \\<medium_left_bracket>\n    have A : \\<open>R2' \\<heavy_comma> W' \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> A' \\<a>\\<n>\\<d> P1'\\<close> using \\<phi>_previous \\<open>RP2 \\<and> RP1\\<close> by simp\n    have SE: \\<open>(R1' \\<heavy_comma> x' \\<Ztypecolon> \\<phi> T' \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> W' \\<heavy_comma> y' \\<Ztypecolon> \\<phi> U' \\<a>\\<n>\\<d> P2')\\<close> using \\<phi>_previous \\<open>RP2 \\<and> RP1\\<close> by simp\n    ;; SE A[THEN implies_right_prod]\n  \\<medium_right_bracket>. . .\n\n\nlemma ToSA_skip [\\<phi>reason 1200 except \\<open> _ \\<heavy_comma> ?y \\<Ztypecolon> \\<phi> ?U \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> _ \\<heavy_comma> \\<blangle> ?x \\<Ztypecolon> \\<phi> ?T \\<brangle> \\<a>\\<n>\\<d> _\\<close> ]:\n  \" R \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> R'\\<heavy_comma> \\<blangle> x \\<Ztypecolon> \\<phi> T \\<brangle> \\<a>\\<n>\\<d> P\n\\<Longrightarrow> R \\<heavy_comma> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> R'\\<heavy_comma> X\\<heavy_comma> \\<blangle> x \\<Ztypecolon> \\<phi> T \\<brangle> \\<a>\\<n>\\<d> P\"\n  unfolding Action_Tag_def FOCUS_TAG_def split_paired_All Action_Tag_def\n  by (metis ab_semigroup_mult_class.mult_ac(1) implies_left_prod mult.commute)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi> U \\<a>\\<n>\\<d> P @action \\<A>_structural Act \\<close>\n  unfolding Action_Tag_def using \\<phi>_cast .\n\nlemma [\\<phi>reason 1200]:\n  \\<open> x \\<Ztypecolon> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> U \\<a>\\<n>\\<d> P @action to Target\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi> T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> y \\<Ztypecolon> \\<phi> U \\<a>\\<n>\\<d> P @action to Target \\<close>\n  unfolding Action_Tag_def using \\<phi>_cast .\n\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<r>Clean (x \\<Ztypecolon> T)\n\\<Longrightarrow> \\<r>Clean (x \\<Ztypecolon> \\<phi> T) \\<close>\n  unfolding \\<r>Clean_def Imply_def apply (simp add: \\<phi>expns)\n  using mk_homo_one by blast\n\nlemma [\\<phi>reason 1200 for \\<open>If ?P (\\<phi> ?T) (\\<phi> ?U) = (\\<phi> ?Z) @action branch_convergence\\<close>]:\n  \\<open> If P T U = Z @action branch_convergence\n\\<Longrightarrow> If P (\\<phi> T) (\\<phi> U) = (\\<phi> Z) @action branch_convergence\\<close>\n  unfolding Action_Tag_def by fastforce\n\nparagraph \\<open>Conversion\\<close>\n\n\n\nlemma [simp]:\n  \\<open>(\\<phi> (T \\<phi>\\<s>\\<u>\\<b>\\<j> P)) = (\\<phi> T \\<phi>\\<s>\\<u>\\<b>\\<j> P)\\<close>\n  by (rule \\<phi>Type_eqI; clarsimp simp add: \\<phi>expns; blast)\n\nlemma \\<phi>_simp_cong[folded atomize_eq]:\n  \\<open> (x \\<Ztypecolon> T) = (x' \\<Ztypecolon> T')\n\\<Longrightarrow> (x \\<Ztypecolon> \\<phi> T) = (x' \\<Ztypecolon> \\<phi> T')\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>expns)\n\nsimproc_setup \\<phi>\\<phi>_simp_cong (\"x \\<Ztypecolon> \\<phi> T\") = \\<open>\n  K (fn ctxt => Phi_SimpCong.simproc @{thm \\<phi>_simp_cong} ctxt)\n\\<close>\n\nparagraph \\<open>Synthesis for moving\\<close>\n\nlemma [\\<phi>reason 1200 for\n  \\<open>Synthesis_Parse (\\<phi> ?T) (?Y::?'ret \\<Rightarrow> assn)\\<close>\n]:\n  \\<open>Synthesis_Parse (\\<phi> T) (\\<lambda>_. x \\<Ztypecolon> \\<phi> T :: assn)\\<close>\n  unfolding Synthesis_Parse_def ..\n\n(* lemma [\\<phi>reason for \\<open>\\<p>\\<r>\\<o>\\<c> ?f \\<lbrace> ?S1 \\<longmapsto> \\<lambda>ret. ?S2\\<heavy_comma>  \\<blangle> ?x \\<Ztypecolon> \\<phi> ?T \\<brangle> \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> ?E\\<close>]:\n  \\<open> SUBGOAL G G'\n\\<Longrightarrow> S1 \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> S2\\<heavy_comma> \\<blangle> x \\<Ztypecolon> \\<phi> T \\<brangle>\n\\<Longrightarrow> SOLVE_SUBGOAL G'\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> Return \\<phi>V_none \\<lbrace> S1 \\<longmapsto> \\<lambda>_. S2\\<heavy_comma> \\<blangle> x \\<Ztypecolon> \\<phi> T \\<brangle> \\<rbrace>\\<close>\n  unfolding FOCUS_TAG_def Synthesis_def Action_Tag_def\n  using \\<phi>__Return_rule__ view_shift_by_implication by blast *)\n\nend\n\n\nsubsubsection \\<open>Permission Fiction\\<close>\n\nlocale permission_fiction =\n   R: resource Res\n+  share: perm_ins_homo_L \\<psi>\n+  fiction_kind FIC.DOMAIN INTERPRET Fic\n      \\<open>R.basic_fiction (\\<F>_functional \\<psi>)\\<close>\nfor Res :: \"'T::sep_algebra resource_entry\"\nand \\<psi> :: \\<open>'T \\<Rightarrow> 'U::{share_sep_disj,share_module_sep,sep_algebra}\\<close>\nand Fic :: \"'U fiction_entry\"\nbegin\n\nsublocale basic_fiction Res \\<open>\\<F>_functional \\<psi>\\<close> ..\n\nlemma sep_disj_fiction:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> \\<I> INTERP r * { R.mk x }\n\\<Longrightarrow> r ## mk (\\<psi> x)\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def set_eq_iff\n  apply (clarsimp simp add: R.basic_fiction_\\<I> \\<phi>expns\n            \\<phi>Res_Spec_def R.\\<r>_valid_split'\n            R.inject_wand_homo interp_split'\n            sep_disj_get_name_eq[symmetric]\n            simp del: sep_disj_get_name_eq)\n  using sep_disj_multD2 by force\n\nlemma expand_subj:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> \\<phi>Res_Spec (\\<I> INTERP (r * mk (\\<psi> x)) \\<s>\\<u>\\<b>\\<j> r ## mk (\\<psi> x))\n  = \\<phi>Res_Spec (\\<I> INTERP r * { R.mk x })\\<close>\n  unfolding \\<phi>Res_Spec_def set_eq_iff\n  apply (clarify, rule)\n  apply (clarsimp simp add: R.basic_fiction_\\<I> \\<phi>expns\n            share.homo_sep_wand \\<phi>Res_Spec_def R.\\<r>_valid_split'\n            R.inject_wand_homo interp_split' prj.homo_mult)\n  thm interp_split'\n  subgoal for res_r a r'\n    apply (rule exI[where x=\\<open>res_r * R.mk a\\<close>]; rule)\n    apply (metis R.inj.homo_mult R.sep_disj_mk fun_1upd_homo_right1 sep_mult_assoc')\n    by (metis R.mk_homo_mult R.sep_disj_mk sep_disj_multD1 sep_disj_multI1)\n\n  apply (clarsimp simp add: R.basic_fiction_\\<I> \\<phi>expns \\<phi>Res_Spec_def R.\\<r>_valid_split'\n        R.inject_wand_homo interp_split' sep_mult_assoc prj.homo_mult)\n  subgoal premises prems for res_r a y proof -\n    have t1[simp]: \\<open>y ## x\\<close>\n      using prems(5) prems(7) sep_disj_multD2 by force\n\n    show ?thesis\n      apply rule\n      apply (rule exI[where x=\\<open>a\\<close>], rule exI[where x=\\<open>R.mk (y * x)\\<close>])\n      apply (metis R.inj.homo_mult fun_1upd_homo prems(5) prems(6) prems(7) sep_disj_multI2 share.homo_mult t1)\n      by (metis prems(1) prems(8) sep_disj_get_name_eq share.sep_disj_homo_semi t1)\n\n  qed .\n\nlemma expand:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> r ## mk (\\<psi> x)\n\\<Longrightarrow> \\<phi>Res_Spec (\\<I> INTERP (r * mk (\\<psi> x))) =\n    \\<phi>Res_Spec (\\<I> INTERP r * {R.mk x})\\<close>\n  subgoal premises prems\n    using expand_subj[where r=r and x=x, simplified prems(2) Subjection_True, OF prems(1)] . .\n\n(*lemma expand_conj:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> (\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> \\<I> INTERP (r * mk (perm_ins_homo x))) \\<and> r ## mk (perm_ins_homo x)\n\\<longleftrightarrow> (\\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> \\<I> INTERP r * { R.mk x })\\<close>\n  unfolding \\<phi>Res_Sat_def\n  subgoal premises prems\n    using expand_subj[where r=r and x=x, OF prems(1)]\n      by (simp add: \\<phi>expns) . *)\n\n\nlemma partial_implies_raw:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> 0 < n\n\\<Longrightarrow> r ## mk (share n (\\<psi> x))\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP (r * mk (share n (\\<psi> x)))\n\\<Longrightarrow> x \\<preceq>\\<^sub>S\\<^sub>L R.get res\\<close>\n  unfolding \\<phi>Res_Spec_def \\<phi>Res_Sat_def\n  apply (clarsimp simp add: R.basic_fiction_\\<I> \\<phi>expns\n            \\<phi>Res_Spec_def R.\\<r>_valid_split' R.inject_wand_homo\n            R.prj.homo_mult interp_split' prj.homo_mult)\n  apply (cases \\<open>n \\<le> 1\\<close>)\n  apply (metis join_sub_def join_sub_ext_left sep_disj_get_name share.join_sub_share_join_sub_whole)\n  subgoal premises prems for u y a proof -\n    have t0: \\<open>1 / n * n = 1\\<close>\n      by (metis nonzero_eq_divide_eq order_less_irrefl prems(2))\n    have t1: \\<open>1 / n \\<le> 1 \\<and> 0 < 1 / n\\<close>\n      using prems(12) by force\n    have t2: \\<open>share (1/n) (share n (\\<psi> x)) \\<preceq>\\<^sub>S\\<^sub>L share n (\\<psi> x)\\<close>\n      by (simp add: order_less_imp_le prems(2) share.\\<psi>_self_disj share_sub t1)\n    then have t3: \\<open>\\<psi> x \\<preceq>\\<^sub>S\\<^sub>L share n (\\<psi> x)\\<close>\n      using share_share_not0\n      by (metis prems(2) share_left_one t0 t1)\n    then show ?thesis\n      by (metis join_sub_ext_left prems(11) prems(3) prems(9) sep_disj_get_name share.homo_join_sub)\n  qed .\n\nparagraph \\<open>Reasoning Rules\\<close>\n\ndeclare ToSA_by_structural_extraction\n    [\\<phi>reason 1210 if \\<open>PLPR_Env.boolean_flag \\<^const_name>\\<open>ToA_flag_deep\\<close> true o fst\\<close>]\ndeclare ToSA_by_structural_extraction__reverse_morphism\n    [\\<phi>reason 1213 if \\<open>PLPR_Env.boolean_flag \\<^const_name>\\<open>ToA_flag_deep\\<close> true o fst\\<close>]\n\nend\n\n\n\n\n\nsubsubsection \\<open>Identity Fiction\\<close>\n\nlocale identity_fiction =\n   R: resource Res\n+  fiction_kind FIC.DOMAIN INTERPRET Fic \\<open>R.basic_fiction \\<F>_it\\<close>\nfor Res :: \"'T::sep_algebra resource_entry\"\nand Fic :: \"'T fiction_entry\"\nbegin\n\nsublocale basic_fiction where I = \\<open>\\<F>_it\\<close> ..\n\nlemma sep_disj_fiction:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> s \\<i>\\<s> \\<I> INTERP r * { R.mk x }\n\\<Longrightarrow> r ## mk x\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def set_eq_iff\n  apply (clarsimp simp add: R.basic_fiction_\\<I> \\<phi>expns\n            \\<phi>Res_Spec_def R.\\<r>_valid_split'\n            R.inject_wand_homo interp_split'\n            sep_disj_get_name_eq[symmetric]\n            simp del: sep_disj_get_name_eq)\n  using sep_disj_multD2 by force\n\nlemma expand_subj:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> (\\<phi>Res_Spec (\\<I> INTERP (r * mk x) \\<s>\\<u>\\<b>\\<j> r ## mk x)) = \\<phi>Res_Spec (\\<I> INTERP r * {R.mk x}) \\<close>\n  unfolding \\<phi>Res_Spec_def set_eq_iff\n  apply (clarify; rule; clarsimp simp add: \\<phi>expns R.basic_fiction_\\<I> interp_split' prj.homo_mult)\n  apply (simp add: R.mk_homo_mult)\n  using R.sep_disj_mk sep_disj_get_name_eq sep_disj_multD1 sep_disj_multI1 sep_mult_assoc' apply blast\n  apply (simp add: R.mk_homo_mult[symmetric] sep_mult_assoc)\n  by (metis R.mk_homo_mult R.sep_disj_mk sep_disj_get_name_eq sep_disj_multD2 sep_disj_multI2)\n\nlemma expand:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> r ## mk x\n\\<Longrightarrow> \\<phi>Res_Spec (\\<I> INTERP (r * mk x)) = \\<phi>Res_Spec (\\<I> INTERP r * {R.mk x})\\<close>\n  subgoal premises prems\n    using expand_subj[where r=r and x=x, simplified prems(2) Subjection_True, OF prems(1)] . .\n\ndeclare ToSA_by_structural_extraction\n   [\\<phi>reason 1210 if \\<open>PLPR_Env.boolean_flag \\<^const_name>\\<open>ToA_flag_deep\\<close> true o fst\\<close>]\ndeclare ToSA_by_structural_extraction__reverse_morphism\n   [\\<phi>reason 1213 if \\<open>PLPR_Env.boolean_flag \\<^const_name>\\<open>ToA_flag_deep\\<close> true o fst\\<close>]\n\nend\n\n\nsubsection \\<open>Nosep Monolithic Resource\\<close>\n  \\<comment> \\<open>The resource non-sepable and having type shape \\<^typ>\\<open>'a::nonsepable_semigroup option\\<close>\\<close>\n\nlocale nonsepable_mono_resource =\n  resource Res\nfor Res :: \"'T nosep option resource_entry\"\nbegin\n\ndefinition fiction_agree\n  where \\<open>fiction_agree = basic_fiction (\\<F>_optionwise \\<F>_agree)\\<close>\n\nend\n\n\nsubsubsection \\<open>Interp Agreement\\<close>\n\n(*TODO: ('k \\<Rightarrow> 'v) nosep option ----> ('k \\<Rightarrow> 'v share option)\n  total to that\n  none to none\n *)\n\nlocale agreement_fiction_for_nosepable_mono_resource =\n   R: nonsepable_mono_resource Res\n+  fiction_kind FIC.DOMAIN INTERPRET Fic \\<open>R.fiction_agree\\<close>\nfor Res :: \"'T nosep option resource_entry\"\nand Fic :: \"'T nosep agree option fiction_entry\"\nbegin\n\nsublocale basic_fiction Res \\<open>\\<F>_optionwise \\<F>_agree\\<close> Fic\n  by (standard; simp add: R.fiction_agree_def raw_domain)\n\nlemma partial_implies:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> r ## mk (Some (agree (nosep x)))\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP (r * mk (Some (agree (nosep x))))\n\\<Longrightarrow> R.get res = Some (nosep x)\\<close>\n  unfolding \\<phi>Res_Spec_def \\<phi>Res_Sat_def\n  apply (clarsimp simp add: interp_split'\n     R.fiction_agree_def R.basic_fiction_\\<I> \\<phi>expns R.\\<r>_valid_split'\n     R.inject_wand_homo R.prj.homo_mult \\<F>_optionwise_\\<I> image_iff Bex_def\n     \\<F>_agree_def prj.homo_mult)\n  apply (cases \\<open>get r\\<close>; simp)\n  subgoal for u y a aa\n    apply (cases aa; simp)\n    subgoal premises prems for xa proof -\n      have \\<open>get r ## Some (agree (nosep x))\\<close>\n        by (metis prems(2) sep_disj_get_name)\n      from this [unfolded \\<open>get r = _\\<close>, simplified]\n      show ?thesis .\n    qed . .\n\nlemma double:\n  \\<open>{mk x |x. P x} \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> {mk x |x. P x} * {mk x |x. P x}\\<close>\n  unfolding Imply_def\n  apply (clarsimp simp add: \\<phi>expns mk_homo_mult[symmetric])\n  subgoal for x'\n    apply (rule exI[where x=\\<open>mk x'\\<close>], rule exI[where x=\\<open>mk x'\\<close>])\n    by (cases x'; simp add: mk_homo_mult[symmetric]) .\n\nlemma contract:\n  \\<open>{mk x |x. P x} * {mk x |x. P x} \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> {mk x |x. P x} \\<close>\n  unfolding Imply_def\n  apply (clarsimp simp add: \\<phi>expns)\n  subgoal for x y by (cases x; cases y; simp add: mk_homo_mult[symmetric]) .\n\nparagraph \\<open>\\<phi>-Type\\<close>\n\nabbreviation \\<open>\\<phi>_ag T \\<equiv> \\<phi> (Agreement (Nosep T))\\<close>\n\ndeclare ToSA_by_structural_extraction\n    [\\<phi>reason 1210 if \\<open>PLPR_Env.boolean_flag \\<^const_name>\\<open>ToA_flag_deep\\<close> true o fst\\<close>]\ndeclare ToSA_by_structural_extraction__reverse_morphism\n    [\\<phi>reason 1213 if \\<open>PLPR_Env.boolean_flag \\<^const_name>\\<open>ToA_flag_deep\\<close> true o fst\\<close>]\n\nlemma \\<phi>_double_\\<phi>app:\n  \\<open>x \\<Ztypecolon> \\<phi>_ag T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> \\<phi>_ag T \\<heavy_comma> x \\<Ztypecolon> \\<phi>_ag T\\<close>\nproof -\n  have \\<open>\\<exists>P. (x \\<Ztypecolon> \\<phi>_ag T) = {mk x |x. P x}\\<close>\n    unfolding set_eq_iff apply (simp add: \\<phi>expns)\n    apply (rule exI[where x=\\<open>\\<lambda>y. \\<exists>v. y = Some (agree (nosep v)) \\<and> v \\<in> (x \\<Ztypecolon> T)\\<close>])\n    by blast\n  then obtain P where [simp]: \\<open>(x \\<Ztypecolon> \\<phi>_ag T) = {mk x |x. P x}\\<close> by blast\n  show ?thesis by (simp add: double)\nqed\n\nlemma \\<phi>_contract_\\<phi>app:\n  \\<open>x \\<Ztypecolon> \\<phi>_ag T \\<heavy_comma> x \\<Ztypecolon> \\<phi>_ag T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> \\<phi>_ag T\\<close>\nproof -\n  have \\<open>\\<exists>P. (x \\<Ztypecolon> \\<phi>_ag T) = {mk x |x. P x}\\<close>\n    unfolding set_eq_iff apply (simp add: \\<phi>expns)\n    apply (rule exI[where x=\\<open>\\<lambda>y. \\<exists>v. y = Some (agree (nosep v)) \\<and> v \\<in> (x \\<Ztypecolon> T)\\<close>])\n    by blast\n  then obtain P where [simp]: \\<open>(x \\<Ztypecolon> \\<phi>_ag T) = {mk x |x. P x}\\<close> by blast\n  show ?thesis by (simp add: contract)\nqed\n\nend\n\n\n\nsubsection \\<open>Resources based on Mapping\\<close>\n\nlocale mapping_resource =\n  resource Res\nfor Res :: \"('key \\<Rightarrow> 'val::sep_algebra) resource_entry\"\nbegin\n\nlemma \"__allocation_rule__\":\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> m(k := u) \\<in>\\<^sub>S domain)\n\\<Longrightarrow> k \\<notin> dom1 (get res)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> updt (\\<lambda>f. f(k := u)) res \\<i>\\<s> R * {mk (1(k := u))}\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def\n  apply (clarsimp simp add: \\<r>_valid_split' times_set_def inject_wand_homo\n          prj.homo_mult times_fun_upd)\n  subgoal premises prems for m proof -\n    {\n      assume A: \\<open>k \\<notin> dom1 m\\<close>\n      have t2: \\<open>m ## 1(k := u)\\<close>\n        using A dom1_def sep_disj_fun_def by fastforce\n      have t3: \\<open>res(name := inject m) = res\\<close>\n        by (simp add: fun_upd_idem prems(5))\n      have t1: \\<open>res(name := inject (m(k := u))) = res * mk (1(k := u)) \\<and> res ## mk (1(k := u))\\<close>\n        thm fun_split_1_not_dom1[where f=m]\n        apply (subst fun_split_1_not_dom1[where k=k]) using A apply this\n        apply (simp add: t2 inj.homo_mult split)\n        by (metis fun_1upd_homo_right1 fun_sep_disj_1_fupdt(1) inj.sep_disj_homo_semi t2 t3)\n    }\n    then show ?thesis\n      using prems(2) prems(4) by blast\n  qed .\n\nend\n\nsubsection \\<open>One Level Parital Mapping\\<close>\n\nsubsubsection \\<open>Locale for Resource\\<close>\n\nlocale partial_map_resource =\n  mapping_resource Res\nfor Res :: \"('key \\<Rightarrow> 'val::nonsepable_semigroup option) resource_entry\"\nbegin\n\nlemma \"__updt_rule__\":\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> P m \\<longrightarrow> m(k := u) \\<in>\\<^sub>S domain)\n\\<Longrightarrow> P (get res)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * {mk (1(k \\<mapsto> any))}\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> updt (\\<lambda>f. f(k := u)) res \\<i>\\<s> R * {mk (1(k := u))}\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def\n  apply (clarsimp simp add: \\<r>_valid_split' times_set_def inject_wand_homo\n          prj.homo_mult times_fun_upd )\n  apply (clarsimp simp add: sep_disj_partial_map_upd\n          nonsepable_semigroup_sepdisj_fun mk_homo_mult)\n  subgoal premises prems for x aa proof -\n    have t1: \\<open>clean x * mk aa = x\\<close>\n      by (metis fun_split_1 prems(8))\n    have t2: \\<open>clean x ## (mk aa * mk (1(k := u)))\\<close>\n      by (simp add: fun_1upd_homo)\n    show ?thesis\n      by (metis nonsepable_semigroup_sepdisj_fun prems(6) prems(9) sep_disj_mk sep_disj_multI1 sep_mult_assoc' t1 t2)\n  qed .\n\nlemma \"__dispose_rule__\":\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> P m \\<longrightarrow> m(k := None) \\<in>\\<^sub>S domain)\n\\<Longrightarrow> P (get res)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * {mk (1(k \\<mapsto> any))}\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> updt (\\<lambda>f. f(k := None)) res \\<i>\\<s> R\\<close>\n  using \"__updt_rule__\"[where u=None, simplified, simplified,\n            simplified, simplified one_set_def[symmetric], simplified] .\n\nabbreviation perm_ins_homo :: \\<open>('key \\<Rightarrow> 'val option) \\<Rightarrow> ('key \\<Rightarrow> 'val share option)\\<close>\n  where \\<open>perm_ins_homo \\<equiv> (o) to_share\\<close>\nabbreviation \\<open>share_fiction \\<equiv> basic_fiction (\\<F>_functional perm_ins_homo)\\<close>\n\n(* lemma share_fiction_expn_full:\n  \\<open>\\<phi>Res_Spec (R * \\<I> share_fiction (R2 * Fine (1(k \\<mapsto> 1 \\<Znrres> v))))\n = \\<phi>Res_Spec (R * \\<I> share_fiction R2 * { mk (Fine (1(k \\<mapsto> v)))})\\<close>\n  unfolding set_eq_iff\n  apply (clarify, rule;\n         clarsimp simp add: share_fiction_def basic_fine_fiction_\\<I> \\<phi>expns fiction_to_share_\\<I>\n            mult_strip_fine_011 \\<phi>Res_Spec_def \\<r>_valid_split' inject_wand_homo)\n  subgoal premises prems for res_r y a r\n    apply (insert \\<open>a * _ = _\\<close>[unfolded to_share_wand_homo[where b=\\<open>1(k \\<mapsto> v)\\<close>, simplified, OF \\<open>a ## _\\<close>]])\n    apply (clarsimp simp add: times_fine'[symmetric] mk_homo_mult mult.assoc[symmetric])\n    using prems(3) by blast\n  subgoal premises prems for res_r a r proof -\n    have t1[simp]: \\<open>a ## 1(k \\<mapsto> v)\\<close>\n      by (metis prems(6) prems(7) sep_disj_commuteI sep_disj_multD1 sep_mult_commute)\n    show ?thesis\n    apply (clarsimp simp add: mult.assoc mk_homo_mult[symmetric] times_fine')\n      apply (rule exI[where x=res_r], rule exI[where x=\"mk (Fine (a * 1(k \\<mapsto> v)))\"], simp add: prems)\n      by (metis (no_types, lifting) map_option_o_map_upd t1 to_share_funcomp_1 to_share_funcomp_sep_disj_I to_share_wand_homo)\n  qed .\n\n\nlemma share_fiction_partially_implies:\n  \\<open> res \\<in> \\<phi>Res_Spec (R * \\<I> share_fiction (R2 * Fine (1(k \\<mapsto> n \\<Znrres> v))))\n\\<Longrightarrow> \\<exists>objs. get res = Fine objs \\<and> objs k = Some v\\<close>\n  apply (clarsimp simp add: share_fiction_def basic_fine_fiction_\\<I> \\<phi>expns fiction_to_share_\\<I>\n            mult_strip_fine_011 \\<phi>Res_Spec_def \\<r>_valid_split' inject_wand_homo\n            proj_homo_mult)\n  subgoal premises prems for res_r y a r proof -\n    from \\<open>a * _ = _\\<close>[THEN fun_cong[where x=k], simplified times_fun, simplified]\n    have t1: \\<open>y k = Some v\\<close>\n      using prems(6) prems(7) strip_share_fun_mult by force\n    then show ?thesis apply (simp add: t1 times_fun)\n      using prems(9) sep_disj_partial_map_some_none t1 by fastforce\n  qed .\n\nlemma\n  assumes A: \\<open> res \\<in> \\<phi>Res_Spec (R * \\<I> share_fiction (R2 * Fine (1(k \\<mapsto> n \\<Znrres> v))))\\<close>\n  shows share_fiction_partially_implies'[simp]: \\<open>!!( get res) k = Some v\\<close>\nproof -\n  from A[THEN share_fiction_partially_implies]\n  show ?thesis by fastforce\nqed\n*)\nlemma raw_unit_assertion_implies[simp]:\n  \\<open> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * { mk (1(k \\<mapsto> v))}\n\\<Longrightarrow> get res k = Some v\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def\n  apply (clarsimp simp add: times_set_def \\<r>_valid_split' inject_wand_homo\n      prj.homo_mult sep_disj_fun_def times_fun)\n  by (metis (mono_tags, lifting) sep_disj_option_nonsepable(1) sep_mult_commute times_option(2))\n\n\nend\n\nsubsubsection \\<open>Identity Fiction\\<close>\n\nlocale identity_fiction_for_partial_mapping_resource =\n   R: partial_map_resource Res\n+  fiction_kind FIC.DOMAIN INTERPRET Fic \\<open>R.basic_fiction \\<F>_it\\<close>\nfor Res :: \"('key \\<Rightarrow> 'val::nonsepable_semigroup option) resource_entry\"\nand Fic :: \"('key \\<Rightarrow> 'val option) fiction_entry\"\nbegin\n\nsublocale identity_fiction Res Fic ..\n\nend\n\n\nsubsubsection \\<open>Permission Fiction\\<close>\n\nlocale share_fiction_for_partial_mapping_resource =\n   R: partial_map_resource Res\n+  fiction_kind FIC.DOMAIN INTERPRET Fic \\<open>R.share_fiction\\<close>\nfor Res :: \"('key \\<Rightarrow> 'val::nonsepable_semigroup option) resource_entry\"\nand Fic :: \"('key \\<Rightarrow> 'val share option) fiction_entry\"\nbegin\n\nsublocale permission_fiction Res \\<open>R.perm_ins_homo\\<close> by standard simp\n\nlemma expand:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> r ## mk (R.perm_ins_homo x)\n\\<Longrightarrow> \\<phi>Res_Spec (\\<I> INTERP (r * mk (R.perm_ins_homo x))) =\n    \\<phi>Res_Spec (\\<I> INTERP r * {R.mk x} )\\<close>\n  subgoal premises prems\n    using expand_subj[where r=r and x=x, simplified prems(2) Subjection_True, OF prems(1)] . .\n\nlemma partial_implies:\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> 0 < n\n\\<Longrightarrow> r ## mk (1(k \\<mapsto> Share n v))\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP (r * mk (1(k \\<mapsto> Share n v)))\n\\<Longrightarrow> R.get res k = Some v\\<close>\n  using partial_implies_raw[where x=\\<open>1(k \\<mapsto> v)\\<close> and n=n, simplified]\n    nonsepable_partial_map_subsumption\n  by (smt (verit, ccfv_threshold) fun_split_1 fun_upd_same join_sub_def one_option_def sep_disj_fun_def sep_disj_option_nonsepable(1) times_fupdt_1_apply_sep)\n\nlemma partial_implies'[simp]:\n  assumes FS: \\<open>r \\<in> FIC.SPACE\\<close>\n    and N: \\<open>0 < n\\<close>\n    and S: \\<open>r ## mk (1(k \\<mapsto> Share n v))\\<close>\n    and A: \\<open>\\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP (r * mk (1(k \\<mapsto> Share n v)))\\<close>\n  shows \\<open>R.get res k = Some v\\<close>\nproof -\n  from partial_implies[OF FS, OF N, OF S, OF A]\n  show ?thesis by fastforce\nqed\n\n(* lemma VS_merge_ownership_identity:\n  \\<open> na + nb \\<le> 1\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi> (share.\\<phi> na Identity) \\<heavy_comma> x \\<Ztypecolon> \\<phi> (share.\\<phi> nb Identity) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> \\<phi> (share.\\<phi> (na + nb) Identity)\\<close>\n  by (rule VS_merge_ownership; simp add: \\<phi>expns)\n\nlemma VS_split_ownership_identity:\n  \\<open> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> (0 < n \\<longrightarrow> na + nb = n \\<and> 0 < na \\<and> 0 < nb)\n\\<Longrightarrow> x \\<Ztypecolon> \\<phi> (share.\\<phi> n Identity) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> \\<phi> (share.\\<phi> na Identity) \\<heavy_comma> x \\<Ztypecolon> \\<phi> (share.\\<phi> nb Identity)\\<close>\n  by (rule VS_split_ownership; simp add: \\<phi>expns sep_disj_fun_def share_fun_def; clarify)\n  (* subgoal premises prems for a\n    by (insert \\<open>\\<forall>_. _\\<close>[THEN spec[where x=a]], cases \\<open>x a\\<close>; simp add: share_All prems) . *)\n\n\nlemma VS_divide_ownership:\n  \\<open>FIX x \\<Ztypecolon> \\<phi> (share.\\<phi> n Identity) \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> \\<phi> (share.\\<phi> (1/2*n) Identity) \\<heavy_comma> x \\<Ztypecolon> \\<phi> (share.\\<phi> (1/2*n) Identity)\\<close>\n  unfolding Fix_def\n  by (rule VS_split_ownership_identity; simp add: Premise_def)\n*)\nend\n\nlocale share_fiction_for_partial_mapping_resource_nonsepable =\n  share_fiction_for_partial_mapping_resource Res Fic\nfor Res :: \"('key \\<Rightarrow> 'val nosep option) resource_entry\"\nand Fic :: \"('key \\<Rightarrow> 'val nosep share option) fiction_entry\"\nbegin\n\nlemma \\<phi>nonsepable_normalize:\n  \\<open>(x \\<Ztypecolon> \\<phi> (share.\\<phi> (\\<phi>MapAt addr (\\<phi>Some (Nosep Identity)))))\n = (nosep x \\<Ztypecolon> \\<phi> (share.\\<phi> (\\<phi>MapAt addr (\\<phi>Some Identity))))\\<close>\n  unfolding set_eq_iff by (simp add: \\<phi>expns)\n\nend\n\n\n\nsubsection \\<open>Two Level Parital Mapping\\<close>\n\ndefinition \\<open>map_fun_at g k f = (\\<lambda>x. if x = k then g (f x) else f x)\\<close>\n\nlemma map_fun_at_1[simp]: \\<open>map_fun_at g k 1 = 1(k := g 1)\\<close>\n  unfolding map_fun_at_def fun_eq_iff by simp\n\nlemma map_fun_at_const[simp]:\n  \\<open>map_fun_at (\\<lambda>_. u) k f = f(k := u)\\<close>\n  unfolding map_fun_at_def fun_eq_iff by simp\n\n\nsubsubsection \\<open>Locale of Resources\\<close>\n\nlocale partial_map_resource2 =\n  mapping_resource Res\nfor Res :: \"('key \\<Rightarrow> 'key2 \\<Rightarrow> 'val::nonsepable_semigroup option) resource_entry\"\nbegin\n\nlemma \"__updt_rule__\":\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> P m \\<longrightarrow> map_fun_at (map_fun_at (\\<lambda>_. u) k2) k m \\<in>\\<^sub>S domain)\n\\<Longrightarrow> P (get res)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * {mk (1(k := 1(k2 \\<mapsto> any)))}\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> updt (map_fun_at (map_fun_at (\\<lambda>_. u) k2) k) res\n      \\<i>\\<s> R * {mk (1(k := 1(k2 := u)))} \\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def\n  apply (clarsimp simp add: \\<r>_valid_split' times_set_def inject_wand_homo\n          prj.homo_mult times_fun_upd)\n  subgoal premises prems for x aa proof -\n    have [simp]: \\<open>aa k k2 = None\\<close>\n      by (metis (mono_tags, opaque_lifting) fun_upd_same prems(9) sep_disj_fun_def sep_disj_fun_nonsepable(2))\n    then have [simp]:\n        \\<open>map_fun_at (map_fun_at (\\<lambda>_. u) k2) k (aa * 1(k := 1(k2 \\<mapsto> any)))\n            = aa * 1(k := 1(k2 := u))\\<close>\n      unfolding map_fun_at_def fun_eq_iff times_fun_def\n      by simp\n    have t1[simp]: \\<open>clean x * mk aa = x\\<close>\n      by (metis fun_split_1 prems(8))\n    have t2[simp]: \\<open>aa ## 1(k := 1(k2 := u))\\<close>\n      by (simp add: sep_disj_fun_def)\n    have t3[simp]:\n      \\<open>clean x ## (mk aa * mk (1(k := 1(k2 := u))))\\<close>\n      by (simp add: fun_1upd_homo)\n    have t4:\n      \\<open>x ## mk (1(k := 1(k2 := u)))\\<close>\n      by (metis sep_disj_mk sep_disj_multI1 t1 t2 t3)\n\n    show ?thesis\n      apply (simp add: prems mk_homo_mult sep_mult_assoc')\n      using prems(6) t4\n      by (metis prems(5))\n  qed .\n\n\nlemma \"__dispose_rule__\":\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> P m \\<longrightarrow> m(k:=1) \\<in>\\<^sub>S domain)\n\\<Longrightarrow> dom (get res k) = dom any\n\\<Longrightarrow> P (get res)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * {mk (1(k := any))}\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> updt (\\<lambda>f. f(k := 1)) res \\<i>\\<s> R\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def\n  apply (clarsimp simp add: \\<r>_valid_split' times_set_def inject_wand_homo\n          prj.homo_mult times_fun_upd )\n  subgoal premises prems for x aa proof -\n    have \\<open>dom (aa k) = {}\\<close>\n    proof -\n      obtain kk :: \"('key2 \\<Rightarrow> 'val option) \\<Rightarrow> 'key2\" where\n        f1: \"\\<forall>f. 1 \\<noteq> f (kk f) \\<or> dom f = {}\"\n        by (metis dom_eq_empty_conv one_option_def)\n      have \"aa k ## any\"\n        by (metis fun_upd_same prems(10) sep_disj_fun_def)\n      then have \"\\<forall>ka. 1 = aa k ka \\<or> 1 = any ka\"\n        by (metis one_option_def option.exhaust sep_disj_fun_nonsepable(2))\n      then show ?thesis\n        by (metis domIff f1 mult_1_class.mult_1_right one_option_def prems(2) times_fun)\n    qed\n    then have t1[simp]: \\<open>(aa * 1(k := any))(k := 1) = aa\\<close>\n      by (smt (verit, del_insts) Diff_iff dom1_upd dom_1 dom_eq_empty_conv fun_split_1_not_dom1 fun_upd_triv fun_upd_upd insertCI)\n    have t2[simp]: \\<open>clean x * mk aa = x\\<close>\n      by (metis fun_split_1 prems(9))\n    show ?thesis\n      using prems(1) prems(3) prems(5) prems(7) t1 by force\n  qed .\n\nabbreviation perm_ins_homo :: \\<open>('key \\<Rightarrow> 'key2 \\<Rightarrow> 'val option) \\<Rightarrow> ('key \\<Rightarrow> 'key2 \\<Rightarrow> 'val share option)\\<close>\n  where \\<open>perm_ins_homo \\<equiv> (o) ((o) to_share)\\<close>\nabbreviation \\<open>share_fiction \\<equiv> basic_fiction (\\<F>_functional perm_ins_homo)\\<close>\n\n(*depreciated!*)\n(*lemma share_fiction_expn_full':\n  \\<open>\\<phi>Res_Spec (R * \\<I> share_fiction (R2 * Fine (1(k := to_share o f))))\n = \\<phi>Res_Spec (R * \\<I> share_fiction R2 * { mk (Fine (1(k := f)))})\\<close>\n  unfolding set_eq_iff\n  apply (clarify, rule;\n         clarsimp simp add: share_fiction_def basic_fine_fiction_\\<I> \\<phi>expns fiction_to_share_\\<I>\n            mult_strip_fine_011 \\<phi>Res_Spec_def \\<r>_valid_split' inject_wand_homo times_fun)\n  subgoal premises prems for res_r y a r\n    apply (insert \\<open>\\<forall>x. a x * _ = _\\<close>[THEN spec[where x=k], simplified,\n          unfolded to_share_wand_homo[where b=f, simplified,\n                      OF sep_disj_fun[where x=k, OF \\<open>a ## _\\<close>, simplified]]])\n      apply (clarify)\n      subgoal premises prems2 for a' proof -\n        have t1: \\<open>y = y(k := a') * 1(k := f)\\<close>\n          unfolding fun_eq_iff times_fun\n          apply simp\n          by (metis fun_upd_apply mult_1_class.mult_1_right prems2(2) times_fun_def)\n        have t2: \\<open>y(k := a') ## 1(k := f)\\<close>\n          using prems2(3) sep_disj_fun_def by fastforce\n        show ?thesis\n          apply (subst t1)\n          apply (clarsimp simp add: times_fine'[OF t2, symmetric] mk_homo_mult mult.assoc[symmetric])\n          apply (rule exI[where x=\"res_r * mk (Fine (y(k := a')))\"], simp)\n          apply (rule exI[where x=res_r], rule exI[where x=\"mk (Fine (y(k := a')))\"], simp add: prems)\n          by (smt (verit, del_insts) mult_1_class.mult_1_right one_fun prems(4) prems2(1))\n      qed .\n    subgoal premises prems for res_r a fic_r r proof -\n      have t1: \\<open>a ## 1(k := f)\\<close>\n        by (metis prems(7) prems(8) sep_disj_commuteI sep_disj_multD1 sep_mult_commute)\n      have t2: \\<open>fic_r ## 1(k := to_share o f)\\<close>\n        unfolding sep_disj_fun_def\n        apply (clarsimp)\n        by (metis comp_apply fun_upd_same prems(4) sep_disj_fun_def t1 to_share_funcomp_sep_disj_I)\n\n      show ?thesis\n        apply (clarsimp simp add: mult.assoc mk_homo_mult[symmetric] times_fine'[OF t1])\n        apply (rule exI[where x=res_r], rule exI[where x=\"mk (Fine (a * 1(k := f))) \"],\n                simp add: prems t2)\n        by (smt (verit, best) fun_split_1 fun_upd_def fun_upd_same map_option_o_map_upd prems(4) sep_disj_fun t1 t2 times_fun to_share_funcomp_1 to_share_wand_homo)\n    qed .\n\nlemma share_fiction_expn_full:\n  \\<open>\\<phi>Res_Spec (R * \\<I> share_fiction (R2 * Fine (1(k := 1(k2 \\<mapsto> 1 \\<Znrres> v)))))\n = \\<phi>Res_Spec (R * \\<I> share_fiction R2 * { mk (Fine (1(k := 1(k2 \\<mapsto> v))))})\\<close>\n  using share_fiction_expn_full'[where f=\\<open>1(k2 \\<mapsto> v)\\<close>, simplified] .\n\n(*depreciated!*)\nlemma share_fiction_partially_implies:\n  \\<open> res \\<in> \\<phi>Res_Spec (R * \\<I> share_fiction (R2 * Fine (1(k := 1(k2 \\<mapsto> n \\<Znrres> v)))))\n\\<Longrightarrow> \\<exists>objs. get res = Fine objs \\<and> objs k k2 = Some v\\<close>\n  apply (clarsimp simp add: share_fiction_def basic_fine_fiction_\\<I> \\<phi>expns fiction_to_share_\\<I>\n            mult_strip_fine_011 \\<phi>Res_Spec_def \\<r>_valid_split' inject_wand_homo\n            proj_homo_mult)\n  subgoal premises prems for res_r y a r proof -\n    note t1 = \\<open>a ## _\\<close>[THEN sep_disj_fun[where x=k], simplified,\n                 THEN sep_disj_fun[where x=k2], simplified]\n    from \\<open>\\<forall>_. (a * _) _ = _\\<close>[THEN spec[where x=k], simplified times_fun, simplified,\n          THEN fun_cong[where x=k2],\n          simplified times_fun, simplified]\n    have t2: \\<open>y k k2 = Some v\\<close>\n      using t1 apply (cases \\<open>a k k2\\<close>; cases \\<open>y k k2\\<close>; simp)\n      by (metis sep_disj_share share.collapse share.inject times_share)\n\n    then show ?thesis apply (simp add: t2 times_fun)\n      by (metis mult_1_class.mult_1_left one_option_def prems(9) sep_disj_fun sep_disj_option_nonsepable(1) t2)\n  qed .\n\nlemma\n  assumes A: \\<open> res \\<in> \\<phi>Res_Spec (R * \\<I> share_fiction (R2 * Fine (1(k := 1(k2 \\<mapsto> n \\<Znrres> v)))))\\<close>\n  shows share_fiction_partially_implies'[simp]: \\<open>!!( get res) k k2 = Some v\\<close>\nproof -\n  from A[THEN share_fiction_partially_implies]\n  show ?thesis by fastforce\nqed\n*)\n\nlemma raw_unit_assertion_implies[simp]:\n  \\<open> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * { mk (1(k := 1(k2 \\<mapsto> v)))}\n\\<Longrightarrow> get res k k2 = Some v\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def\n  apply (clarsimp simp add: times_set_def \\<r>_valid_split' inject_wand_homo\n      prj.homo_mult sep_disj_fun_def times_fun)\n  by (metis (full_types) fun_upd_same sep_disj_option_nonsepable(1) times_option(3))\n\nlemma raw_unit_assertion_implies':\n  \\<open> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * { mk (1(k := f))}\n\\<Longrightarrow> f \\<subseteq>\\<^sub>m get res k\\<close>\n  unfolding \\<phi>Res_Sat_def \\<phi>Res_Spec_def\n  apply (clarsimp simp add: times_set_def \\<r>_valid_split' inject_wand_homo)\n  subgoal premises prems for x a proof -\n    have t1[simp]: \\<open>inject a ## inject (1(k := f))\\<close>\n      using prems(7) by blast\n    show ?thesis apply (clarsimp simp add: prj.homo_mult[OF t1] sep_disj_fun_def times_fun map_le_def)\n      by (metis fun_sep_disj_imply_v fun_upd_triv mult_1_class.mult_1_left one_option_def prems(7) sep_disj_option_nonsepable(1))\n  qed .\n\nlemma raw_unit_assertion_implies''[simp]:\n  \\<open> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * { mk (1(k := f))}\n\\<Longrightarrow> k2 \\<in> dom f\n\\<Longrightarrow> get res k k2 = f k2\\<close>\n  using raw_unit_assertion_implies'[unfolded map_le_def]\n  by simp\n\nend\n\nsubsubsection \\<open>Permission Fiction\\<close>\n\nlocale share_fiction_for_partial_mapping_resource2 =\n  R: partial_map_resource2 Res\n  +  fiction_kind FIC.DOMAIN INTERPRET Fic \\<open>R.share_fiction\\<close>\n  for Res :: \"('key \\<Rightarrow> 'key2 \\<Rightarrow> 'val::nonsepable_semigroup option) resource_entry\"\n    and Fic :: \"('key \\<Rightarrow> 'key2 \\<Rightarrow> 'val share option) fiction_entry\"\nbegin\n\nsublocale permission_fiction Res \\<open>R.perm_ins_homo\\<close> by standard simp\n\nlemma [simp]:\n  \\<open>R.perm_ins_homo (1(k := f)) = 1(k := to_share o f)\\<close>\n  unfolding fun_eq_iff by simp\n\nlemmas partial_implies = partial_implies_raw\n\nlemma partial_implies':\n  \\<open> r \\<in> FIC.SPACE\n\\<Longrightarrow> 0 < n\n\\<Longrightarrow> r ## mk (1(k := 1(k2 \\<mapsto> Share n v)))\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP (r * mk (1(k := 1(k2 \\<mapsto> Share n v))))\n\\<Longrightarrow> R.get res k k2 = Some v\\<close>\n  using partial_implies_raw[where x=\\<open>1(k := 1(k2 \\<mapsto> v))\\<close> and n=n, simplified]\n    nonsepable_partial_map_subsumption\n  by (smt (verit, del_insts) fun_upd_same join_sub_def sep_disj_fun_def sep_disj_option_nonsepable(1) times_fupdt_1_apply_sep times_option(3))\n\nlemma partial_implies'':\n  assumes FS: \\<open>r \\<in> FIC.SPACE\\<close>\n    and N: \\<open>0 < n\\<close>\n    and S: \\<open>r ## mk (1(k := 1(k2 \\<mapsto> Share n v)))\\<close>\n    and A: \\<open> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP (r * mk (1(k := 1(k2 \\<mapsto> Share n v)))) \\<close>\n  shows [simp]: \\<open>R.get res k k2 = Some v\\<close>\nproof -\n  from partial_implies'[OF FS, OF N, OF S, OF A]\n  show ?thesis by fastforce\nqed\n\nend\n\n\nsection \\<open>Common Instructions\\<close>\n\nsubsection \\<open>Drop & Duplicate Value\\<close>\n\nlemma [\\<phi>reason 1200 for \\<open>?x \\<Ztypecolon> Val ?raw ?T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?Y \\<a>\\<n>\\<d> ?P @action action_dup\\<close>]:\n  \\<open>x \\<Ztypecolon> Val raw T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> Val raw T \\<heavy_comma> x \\<Ztypecolon> Val raw T @action action_dup\\<close>\n  unfolding Imply_def Action_Tag_def\n  by (clarsimp simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1200 for \\<open>?R \\<heavy_comma> ?x \\<Ztypecolon> Val ?raw ?T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?Y \\<a>\\<n>\\<d> ?P @action action_drop\\<close>]:\n  \\<open>Void \\<heavy_comma> x \\<Ztypecolon> Val raw T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Void @action action_drop\\<close>\n  unfolding Imply_def Action_Tag_def\n  by (clarsimp simp add: \\<phi>expns)\n\n\nsubsection \\<open>Abnormality\\<close>\n\ndefinition throw :: \\<open>ABNM \\<Rightarrow> 'ret::VALs proc\\<close>\n  where \\<open>throw raw = det_lift (Abnormality raw)\\<close>\n\nlemma throw_reduce_tail[procedure_simps,simp]:\n  \\<open>(throw any \\<ggreater> f) = throw any\\<close>\n  unfolding throw_def bind_def det_lift_def by simp\n\nlemma \"__throw_rule__\"[intro!]:\n  \\<open> (\\<And>a. X a \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X' a)\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> (throw excep :: 'ret::VALs proc) \\<lbrace> X excep \\<longmapsto> Any \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> X'\\<close>\n  unfolding \\<phi>Procedure_def subset_iff det_lift_def throw_def Imply_def\n  apply clarsimp\n  by (meson Imply_def View_Shift_def view_shift_by_implication)\n\nlemma throw_\\<phi>app:\n  \\<open> (\\<And>v. Remove_Values (X v) (X' v))\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> throw excep \\<lbrace> X excep \\<longmapsto> 0 \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> X' \\<close>\n  unfolding \\<phi>Procedure_def subset_iff det_lift_def throw_def Remove_Values_def Imply_def\n  apply clarsimp\n  by (meson Imply_def View_Shift_def view_shift_by_implication)\n\ndefinition op_try :: \"'ret proc \\<Rightarrow> (ABNM \\<Rightarrow> 'ret proc) \\<Rightarrow> 'ret::VALs proc\"\n  where \\<open>op_try f g s = \\<Union>((\\<lambda>y. case y of Success x s' \\<Rightarrow> {Success x s'}\n                                       | Abnormality v s' \\<Rightarrow> g v s'\n                                       | AssumptionBroken \\<Rightarrow> {AssumptionBroken}\n                                       | NonTerm \\<Rightarrow> {NonTerm}\n                                       | Invalid \\<Rightarrow> {Invalid}) ` f s)\\<close>\n\nlemma \"__op_try__\"[intro!]:\n  \\<open> \\<p>\\<r>\\<o>\\<c> f \\<lbrace> X \\<longmapsto> Y1 \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> (\\<lambda>v. E v)\n\\<Longrightarrow> (\\<And>v. \\<p>\\<r>\\<o>\\<c> g v \\<lbrace> E v \\<longmapsto> Y2 \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E2 )\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> op_try f g \\<lbrace> X \\<longmapsto> \\<lambda>v. Y1 v + Y2 v \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E2  \\<close>\n  unfolding op_try_def \\<phi>Procedure_def subset_iff\n  apply clarsimp subgoal for comp R x s\n    apply (cases s; simp; cases x; clarsimp simp add: \\<phi>expns ring_distribs)\n    subgoal premises prems for a b u v\n      using prems(1)[THEN spec[where x=comp], THEN spec[where x=R]]\n      by (metis (no_types, lifting) INTERP_SPEC LooseStateSpec_expn(1) prems(3) prems(6) prems(7) prems(8) prems(9) set_mult_expn)\n    subgoal premises prems for a b c d u v2 proof -\n      have \\<open>Abnormality a b \\<in> \\<S> (\\<lambda>v. INTERP_SPEC (R \\<heavy_comma> Y1 v)) (\\<lambda>v. INTERP_SPEC (R \\<heavy_comma> E v))\\<close>\n        using prems(1)[THEN spec[where x=comp], THEN spec[where x=R]]\n        using prems(10) prems(3) prems(7) prems(8) prems(9) by blast\n      note this[simplified]\n      then have \\<open>Success c d \\<in> \\<S> (\\<lambda>v. INTERP_SPEC (R \\<heavy_comma> Y2 v)) (\\<lambda>v. INTERP_SPEC (R \\<heavy_comma> E2 v))\\<close>\n        using prems(2)[of a, THEN spec[where x=b], THEN spec[where x=R]]\n        by (meson INTERP_SPEC prems(4) set_mult_expn)\n      note this[simplified]\n      then show ?thesis\n        by (metis INTERP_SPEC prems(11) set_mult_expn)\n    qed\n    subgoal premises prems for a b c d u v proof -\n      have \\<open>Abnormality a b \\<in> \\<S> (\\<lambda>v. INTERP_SPEC (R \\<heavy_comma> Y1 v)) (\\<lambda>v. INTERP_SPEC (R \\<heavy_comma> E v))\\<close>\n        using prems(1)[THEN spec[where x=comp], THEN spec[where x=R]]\n        using prems(10) prems(3) prems(7) prems(8) prems(9) by blast\n      note this[simplified]\n      then have \\<open>Abnormality c d \\<in> \\<S> (\\<lambda>v. INTERP_SPEC (R \\<heavy_comma> Y2 v)) (\\<lambda>v. INTERP_SPEC (R \\<heavy_comma> E2 v))\\<close>\n        using prems(2)[THEN spec[where x=b], THEN spec[where x=R]]\n        by (meson INTERP_SPEC prems(4) set_mult_expn)\n      note this[simplified]\n      then show ?thesis\n        by (simp add: INTERP_SPEC set_mult_expn)\n    qed\n     apply (smt (z3) INTERP_SPEC LooseStateSpec_expn(2) LooseStateSpec_expn(3) set_mult_expn)\n    by blast .\n\ndefinition \"Union_the_Same_Or_Arbitrary_when_Var Z X Y \\<longleftrightarrow> (\\<forall>v. (Z::'v \\<Rightarrow> 'a set) v = X v + Y v)\"\n\nlemma Union_the_Same_Or_Arbitrary_when_Var__the_Same:\n  \\<open>Union_the_Same_Or_Arbitrary_when_Var Z Z Z\\<close>\n  unfolding Union_the_Same_Or_Arbitrary_when_Var_def by simp\n\nlemma Union_the_Same_Or_Arbitrary_when_Var__Arbitrary:\n  \\<open>Union_the_Same_Or_Arbitrary_when_Var (\\<lambda>v. X v + Y v) X Y\\<close>\n  unfolding Union_the_Same_Or_Arbitrary_when_Var_def by blast\n\n\\<phi>reasoner_ML Union_the_Same_Or_Arbitrary_when_Var 1200\n  (\\<open>Union_the_Same_Or_Arbitrary_when_Var ?Z ?X ?Y\\<close>) = \\<open>\nfn (ctxt,sequent) =>\n  let\n    val \\<^const>\\<open>Trueprop\\<close> $ (Const (\\<^const_name>\\<open>Union_the_Same_Or_Arbitrary_when_Var\\<close>, _)\n          $ Z $ _ $ _) = Thm.major_prem_of sequent\n  in (ctxt,\n        (if is_Var (Envir.beta_eta_contract Z)\n         then @{thm Union_the_Same_Or_Arbitrary_when_Var__Arbitrary}\n         else @{thm Union_the_Same_Or_Arbitrary_when_Var__the_Same})\n        RS sequent) |> Seq.single\n  end\n\\<close>\n\nproc (nodef) try'':\n  assumes F: \\<open>\\<p>\\<r>\\<o>\\<c> f \\<lbrace> X \\<longmapsto> YY \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<close>\n  assumes G: \\<open>(\\<And>v. \\<p>\\<r>\\<o>\\<c> g v \\<lbrace> E v \\<longmapsto> YY \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> EE2 )\\<close>\n  input  X\n    output YY\n  throws EE2\n  \\<medium_left_bracket> \"__op_try__\"\n    F\n    G\n  \\<medium_right_bracket> .. .\n\nproc (nodef) try':\n  assumes A: \\<open>Union_the_Same_Or_Arbitrary_when_Var Z Y1 Y2\\<close>\n  assumes F: \\<open>\\<p>\\<r>\\<o>\\<c> f \\<lbrace> X \\<longmapsto> Y1 \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<close>\n  assumes G: \\<open>\\<And>v. \\<p>\\<r>\\<o>\\<c> g v \\<lbrace> E v \\<longmapsto> Y2 \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E2 \\<close>\n  input  X\n    output Z\n  throws E2\n  \\<medium_left_bracket> \"__op_try__\" F G\n    unfold A[unfolded Union_the_Same_Or_Arbitrary_when_Var_def, THEN spec, symmetric]\n  \\<medium_right_bracket>. .\n\n\nsubsection \\<open>Access the Resource\\<close>\n\nsubsubsection \\<open>Legacy\\<close>\n\ndefinition \\<phi>M_get_res :: \\<open>(resource \\<Rightarrow> 'a) \\<Rightarrow> ('a \\<Rightarrow> 'ret proc) \\<Rightarrow> 'ret proc\\<close>\n  where \\<open>\\<phi>M_get_res R F = (\\<lambda>res. F (R res) res)\\<close>\n\ndefinition \\<phi>M_get_res_entry :: \\<open>(resource \\<Rightarrow> ('k \\<rightharpoonup> 'a)) \\<Rightarrow> 'k \\<Rightarrow> ('a \\<Rightarrow> 'ret proc) \\<Rightarrow> 'ret::VALs proc\\<close>\n  where \\<open>\\<phi>M_get_res_entry R k F =\n    \\<phi>M_get_res R (\\<lambda>res. case res k of Some v \\<Rightarrow> F v | _ \\<Rightarrow> (\\<lambda>_. {Invalid}))\\<close>\n\ndefinition \\<phi>M_set_res :: \\<open> (('x \\<Rightarrow> 'x) \\<Rightarrow> resource \\<Rightarrow> resource) \\<Rightarrow> ('x \\<Rightarrow> 'x) \\<Rightarrow> unit proc \\<close>\n  where \\<open>\\<phi>M_set_res Updt F = (\\<lambda>res. {Success (\\<phi>arg ()) (Updt F res)})\\<close>\n\nsubsubsection \\<open>Getters\\<close>\n\nparagraph \\<open>basic resource\\<close>\n\ndefinition (in resource) \\<phi>R_get_res :: \\<open>('T \\<Rightarrow> 'ret proc) \\<Rightarrow> 'ret proc\\<close>\n  where \\<open>\\<phi>R_get_res F = (\\<lambda>res. F (get res) res)\\<close>\n\nlemma (in resource) \\<phi>R_get_res[intro!]:\n  \\<open> get res = v\n\\<Longrightarrow> F v res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> \\<phi>R_get_res F res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n  unfolding \\<phi>R_get_res_def subset_iff by simp\n\nparagraph \\<open>nonsepable_mono_resource\\<close>\n\ndefinition (in nonsepable_mono_resource) \\<phi>R_get_res_entry :: \\<open>('T \\<Rightarrow> 'ret proc) \\<Rightarrow> 'ret::VALs proc\\<close>\n  where \\<open>\\<phi>R_get_res_entry F = \\<phi>R_get_res (\\<lambda>v. case v of Some v' \\<Rightarrow> F (nosep.dest v')\n                                                      | _ \\<Rightarrow> (\\<lambda>_. {Invalid}))\\<close>\n\nlemma (in nonsepable_mono_resource) \\<phi>R_get_res_entry:\n  \\<open> get res = Some (nosep v)\n\\<Longrightarrow> F v res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> \\<phi>R_get_res_entry F res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n  unfolding \\<phi>R_get_res_entry_def \\<phi>R_get_res_def by simp\n\nparagraph \\<open>partial_map_resource\\<close>\n\ndefinition (in partial_map_resource)\n  \\<phi>R_get_res_entry :: \\<open>'key \\<Rightarrow> ('val \\<Rightarrow> 'ret proc) \\<Rightarrow> 'ret::VALs proc\\<close>\n  where \\<open>\\<phi>R_get_res_entry k F =\n    \\<phi>R_get_res (\\<lambda>res. case res k of Some v \\<Rightarrow> F v | _ \\<Rightarrow> (\\<lambda>_. {Invalid}))\\<close>\n\nlemma (in partial_map_resource) \\<phi>R_get_res_entry[intro!]:\n  \\<open> get res k = Some v\n\\<Longrightarrow> F v res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> \\<phi>R_get_res_entry k F res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n  unfolding \\<phi>R_get_res_entry_def \\<phi>R_get_res_def by simp\n\nsubparagraph \\<open>identity_fiction_for_partial_mapping_resource\\<close>\n\ncontext identity_fiction_for_partial_mapping_resource begin\n\nlemma \\<phi>R_get_res_entry_frm[intro!]:\n  \\<open>\\<p>\\<r>\\<o>\\<c> F v\n      \\<lbrace> R\\<heavy_comma> v \\<Ztypecolon> \\<phi> (key \\<^bold>\\<rightarrow> \\<black_circle> Identity) \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_get_res_entry key F\n      \\<lbrace> R\\<heavy_comma> v \\<Ztypecolon> \\<phi> (key \\<^bold>\\<rightarrow> \\<black_circle> Identity) \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<close>\n  unfolding \\<phi>Procedure_Hybrid_DL \\<phi>Res_Spec_expn_R imp_conjL\n            \\<phi>Res_Sat_expn_impEx \\<phi>Res_Sat_expn_impSubj\n  by (clarsimp simp add: \\<phi>expns expand; rule R.\\<phi>R_get_res_entry[where v=v]; simp)\n\nlemmas \\<phi>R_get_res_entry[intro!] = \\<phi>R_get_res_entry_frm[where R=1, simplified]\n\nend\n\nsubparagraph \\<open>share_fiction_for_partial_mapping_resource\\<close>\n\ncontext share_fiction_for_partial_mapping_resource begin\n\nlemma \\<phi>R_get_res_entry_frm[intro!]:\n  \\<open>\\<p>\\<r>\\<o>\\<c> F v\n      \\<lbrace> R\\<heavy_comma> v \\<Ztypecolon> \\<phi> (key \\<^bold>\\<rightarrow> n \\<Znrres> \\<fish_eye> Identity) \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_get_res_entry key F\n      \\<lbrace> R\\<heavy_comma> v \\<Ztypecolon> \\<phi> (key \\<^bold>\\<rightarrow> n \\<Znrres> \\<fish_eye> Identity) \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<close>\n  unfolding \\<phi>Procedure_Hybrid_DL\n    \\<phi>Res_Spec_expn_R \\<phi>Res_Sat_expn_impEx \\<phi>Res_Sat_expn_impSubj imp_conjL\n  apply (clarsimp simp add: \\<phi>expns zero_set_def)\n  apply (rule R.\\<phi>R_get_res_entry[where v=v])\n  apply simp\n  by blast\n\nlemmas \\<phi>R_get_res_entry[intro!] = \\<phi>R_get_res_entry_frm[where R=1, simplified]\n\nend\n\nparagraph \\<open>partial_map_resource2\\<close>\n\ndefinition (in partial_map_resource2)\n    \\<phi>R_get_res_entry :: \\<open>'key \\<Rightarrow> 'key2 \\<Rightarrow> ('val \\<Rightarrow> 'ret proc) \\<Rightarrow> 'ret::VALs proc\\<close>\n  where \\<open>\\<phi>R_get_res_entry k k2 F = \\<phi>R_get_res (\\<lambda>res.\n    case res k k2 of Some v \\<Rightarrow> F v | _ \\<Rightarrow> (\\<lambda>_. {Invalid}))\\<close>\n\nlemma (in partial_map_resource2) \\<phi>R_get_res_entry[intro!]:\n  \\<open> get res k k2 = Some v\n\\<Longrightarrow> F v res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> \\<phi>R_get_res_entry k k2 F res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n  unfolding \\<phi>R_get_res_entry_def \\<phi>R_get_res_def by simp\n\nlemma (in share_fiction_for_partial_mapping_resource2) \\<phi>R_get_res_entry[intro!]:\n  \\<open>\\<p>\\<r>\\<o>\\<c> F v\n      \\<lbrace> v \\<Ztypecolon> \\<phi> (k1 \\<^bold>\\<rightarrow> k2 \\<^bold>\\<rightarrow> n \\<Znrres> \\<fish_eye> Identity) \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_get_res_entry k1 k2 F\n      \\<lbrace> v \\<Ztypecolon> \\<phi> (k1 \\<^bold>\\<rightarrow> k2 \\<^bold>\\<rightarrow> n \\<Znrres> \\<fish_eye> Identity) \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<close>\n  unfolding \\<phi>Procedure_Hybrid_DL\n  apply (clarsimp simp add: \\<phi>expns zero_set_def)\n  apply (rule R.\\<phi>R_get_res_entry[where v=v])\n  apply simp\n  by blast\n\nlemma (in share_fiction_for_partial_mapping_resource2) \\<phi>R_get_res_entry1[intro!]:\n  \\<open>\\<p>\\<r>\\<o>\\<c> F v\n      \\<lbrace> v \\<Ztypecolon> \\<phi> (k1 \\<^bold>\\<rightarrow> k2 \\<^bold>\\<rightarrow> \\<fish_eye> Identity) \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_get_res_entry k1 k2 F\n      \\<lbrace> v \\<Ztypecolon> \\<phi> (k1 \\<^bold>\\<rightarrow> k2 \\<^bold>\\<rightarrow> \\<fish_eye> Identity) \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E \\<close>\n  using \\<phi>R_get_res_entry[where n=1, simplified] .\n\n\nsubsubsection \\<open>Setters\\<close>\n\nparagraph \\<open>fine_resource\\<close>\n\ndefinition (in resource) \\<phi>R_set_res :: \\<open>('T \\<Rightarrow> 'T) \\<Rightarrow> unit proc\\<close>\n  where \\<open>\\<phi>R_set_res F = (\\<lambda>res. {Success (\\<phi>arg ()) (updt F res)})\\<close>\n\nparagraph \\<open>partial_map_resource\\<close>\n\nlemma (in partial_map_resource) \\<phi>R_set_res:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> P m \\<longrightarrow> m(k := u) \\<in>\\<^sub>S domain)\n\\<Longrightarrow> P (get res)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * {mk (1(k \\<mapsto> any))}\n\\<Longrightarrow> \\<phi>R_set_res (\\<lambda>f. f(k := u)) res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> (\\<lambda>_. R * {mk (1(k := u))}) \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> Any\\<close>\n  unfolding \\<phi>R_set_res_def\n  by (simp add: \\<phi>expns \"__updt_rule__\")\n\ncontext identity_fiction_for_partial_mapping_resource begin\n\nlemma \\<phi>R_set_res:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S R.domain \\<longrightarrow> P m \\<longrightarrow> m(k \\<mapsto> u) \\<in>\\<^sub>S R.domain)\n\\<Longrightarrow> (\\<And>res r. (\\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP r * {R.mk (1(k \\<mapsto> v))}) \\<Longrightarrow> P (R.get res))\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_set_res (\\<lambda>f. f(k \\<mapsto> u))\n         \\<lbrace> v \\<Ztypecolon> \\<phi> (k \\<^bold>\\<rightarrow> \\<black_circle> Identity) \\<longmapsto> \\<lambda>\\<r>\\<e>\\<t>. u \\<Ztypecolon> \\<phi> (k \\<^bold>\\<rightarrow> \\<black_circle> Identity) \\<rbrace>\\<close>\n  unfolding \\<phi>Procedure_Hybrid_DL\n  apply (clarsimp simp add: \\<phi>expns zero_set_def\n          expand[where x=\\<open>1(k \\<mapsto> v)\\<close>, simplified]\n          expand_subj[where x=\\<open>1(k \\<mapsto> u)\\<close>, simplified])\n  subgoal for r res\n    thm R.\\<phi>R_set_res[where k=k and res=res]\n    by (rule R.\\<phi>R_set_res[where k=k and res=res], assumption, simp, assumption) .\n\ndeclare \\<phi>R_set_res[THEN \\<phi>CONSEQ'E0, intro!]\nlemmas \\<phi>R_set_res_frm[intro!] = \\<phi>R_set_res[THEN \\<phi>frame, simplified, THEN \\<phi>CONSEQ'E0]\nend\n\ncontext share_fiction_for_partial_mapping_resource begin\n\nlemma \\<phi>R_set_res:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S R.domain \\<longrightarrow> P m \\<longrightarrow> m(k \\<mapsto> u) \\<in>\\<^sub>S R.domain)\n\\<Longrightarrow> (\\<And>res r. \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP r * {R.mk (1(k \\<mapsto> v))} \\<Longrightarrow> P (R.get res))\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_set_res (\\<lambda>f. f(k \\<mapsto> u))\n         \\<lbrace> v \\<Ztypecolon> \\<phi> (k \\<^bold>\\<rightarrow> \\<fish_eye> Identity) \\<longmapsto> \\<lambda>\\<r>\\<e>\\<t>. u \\<Ztypecolon> \\<phi> (k \\<^bold>\\<rightarrow> \\<fish_eye> Identity) \\<rbrace>\\<close>\n  unfolding \\<phi>Procedure_Hybrid_DL\n  apply (clarsimp simp add: \\<phi>expns zero_set_def\n          expand[where x=\\<open>1(k \\<mapsto> v)\\<close>, simplified]\n          expand_subj[where x=\\<open>1(k \\<mapsto> u)\\<close>, simplified])\n  subgoal for r res\n    by (rule R.\\<phi>R_set_res[where k=k and res=res], assumption, simp, assumption) .\n\ndeclare \\<phi>R_set_res[THEN \\<phi>CONSEQ'E0, intro!]\nlemmas \\<phi>R_set_res_frm[intro!] = \\<phi>R_set_res[THEN \\<phi>frame, simplified, THEN \\<phi>CONSEQ'E0]\n\nend\n\n\nparagraph \\<open>partial_map_resource2\\<close>\n\nlemma (in partial_map_resource2) \\<phi>R_set_res[intro!]:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> P m \\<longrightarrow> map_fun_at (map_fun_at (\\<lambda>_. u) k2) k m \\<in>\\<^sub>S domain)\n\\<Longrightarrow> P (get res)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * {mk (1(k := 1(k2 \\<mapsto> any)))}\n\\<Longrightarrow> \\<phi>R_set_res (map_fun_at (map_fun_at (\\<lambda>_. u) k2) k) res\n      \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> (\\<lambda>_. R * {mk (1(k := 1(k2 := u)))}) \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> Any\\<close>\n  unfolding \\<phi>R_set_res_def by (simp add: \\<phi>expns \"__updt_rule__\")\n\nlemma (in share_fiction_for_partial_mapping_resource2) \"\\<phi>R_set_res\"[THEN \\<phi>CONSEQ'E0, intro!]:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S R.domain \\<longrightarrow> P m \\<longrightarrow> (map_fun_at (map_fun_at (\\<lambda>_. Some u) k2) k) m \\<in>\\<^sub>S R.domain)\n\\<Longrightarrow> (\\<And>res r. \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP r * {R.mk (1(k := 1(k2 \\<mapsto> v)))} \\<Longrightarrow> P (R.get res))\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_set_res (map_fun_at (map_fun_at (\\<lambda>_. Some u) k2) k)\n         \\<lbrace> v \\<Ztypecolon> \\<phi> (k \\<^bold>\\<rightarrow> k2 \\<^bold>\\<rightarrow> \\<fish_eye> Identity) \\<longmapsto> \\<lambda>\\<r>\\<e>\\<t>. u \\<Ztypecolon> \\<phi> (k \\<^bold>\\<rightarrow> k2 \\<^bold>\\<rightarrow> \\<fish_eye> Identity) \\<rbrace>\\<close>\n  unfolding \\<phi>Procedure_Hybrid_DL\n  apply (clarsimp simp add: \\<phi>expns zero_set_def\n                            expand[where x=\\<open>1(k := 1(k2 \\<mapsto> v))\\<close>, simplified]\n                            expand_subj[where x=\\<open>1(k := 1(k2 \\<mapsto> u))\\<close>, simplified])\n  subgoal for r res\n    by (rule R.\\<phi>R_set_res, assumption, simp, assumption) .\n\n\nsubsubsection \\<open>Dispose\\<close>\n\nparagraph \\<open>partial_map_resource\\<close>\n\nlemma (in partial_map_resource) \\<phi>R_dispose_res[intro!]:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> P m \\<longrightarrow> m(k := None) \\<in>\\<^sub>S domain)\n\\<Longrightarrow> P (get res)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * {mk (1(k \\<mapsto> any))}\n\\<Longrightarrow> \\<phi>R_set_res (\\<lambda>f. f(k := None)) res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> (\\<lambda>_. R) \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> Any\\<close>\n  unfolding \\<phi>R_set_res_def by (simp add: \\<phi>expns \"__dispose_rule__\")\n\ncontext identity_fiction_for_partial_mapping_resource begin\n\nlemma \\<phi>R_dispose_res:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S R.domain \\<longrightarrow> P m \\<longrightarrow> m(k := None) \\<in>\\<^sub>S R.domain)\n\\<Longrightarrow> (\\<And>res r. \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP r * {R.mk (1(k \\<mapsto> v))} \\<Longrightarrow> P (R.get res))\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_set_res (\\<lambda>f. f(k := None))\n         \\<lbrace> v \\<Ztypecolon> \\<phi> (k \\<^bold>\\<rightarrow> \\<black_circle> Identity) \\<longmapsto> \\<lambda>_. Void \\<rbrace>\\<close>\n  unfolding \\<phi>Procedure_Hybrid_DL\n  apply (clarsimp simp add: \\<phi>expns zero_set_def expand[where x=\\<open>1(k \\<mapsto> v)\\<close>, simplified])\n  subgoal for r res\n    by (rule R.\\<phi>R_dispose_res, assumption, simp, simp) .\n\ndeclare \\<phi>R_dispose_res[THEN \\<phi>CONSEQ'E0, intro!]\nlemmas \\<phi>R_dispose_res_frm[intro!] = \\<phi>R_dispose_res[THEN \\<phi>frame, simplified, THEN \\<phi>CONSEQ'E0]\n\nend\n\ncontext share_fiction_for_partial_mapping_resource begin\n\nlemma \\<phi>R_dispose_res:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S R.domain \\<longrightarrow> P m \\<longrightarrow> m(k := None) \\<in>\\<^sub>S R.domain)\n\\<Longrightarrow> (\\<And>res r. \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP r * {R.mk (1(k \\<mapsto> v))} \\<Longrightarrow> P (R.get res))\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_set_res (\\<lambda>f. f(k := None))\n         \\<lbrace> v \\<Ztypecolon> \\<phi> (k \\<^bold>\\<rightarrow> \\<fish_eye> Identity) \\<longmapsto> \\<lambda>_. Void \\<rbrace>\\<close>\n  unfolding \\<phi>Procedure_Hybrid_DL\n  apply (clarsimp simp add: \\<phi>expns zero_set_def expand[where x=\\<open>1(k \\<mapsto> v)\\<close>, simplified])\n  subgoal for r res by (rule R.\\<phi>R_dispose_res, assumption, simp, simp) .\n\ndeclare \\<phi>R_dispose_res[THEN \\<phi>CONSEQ'E0, intro!]\nlemmas \\<phi>R_dispose_res_frm[intro!] = \\<phi>R_dispose_res[THEN \\<phi>frame, simplified, THEN \\<phi>CONSEQ'E0]\n\nend\n\nparagraph \\<open>partial_map_resource2\\<close>\n\nlemma (in partial_map_resource2) \\<phi>R_dispose_res[intro!]:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> P m \\<longrightarrow> m(k:=1) \\<in>\\<^sub>S domain)\n\\<Longrightarrow> dom (get res k) = dom any\n\\<Longrightarrow> P (get res)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * {mk (1(k := any))}\n\\<Longrightarrow> \\<phi>R_set_res (\\<lambda>f. f(k := 1)) res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> (\\<lambda>_. R) \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> Any\\<close>\n  unfolding \\<phi>R_set_res_def by (simp add: \\<phi>expns \"__dispose_rule__\")\n\nlemma (in share_fiction_for_partial_mapping_resource2) \"\\<phi>R_dispose_res\"[THEN \\<phi>CONSEQ'E0, intro!]:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S R.domain \\<longrightarrow> P m \\<longrightarrow> m(k := 1) \\<in>\\<^sub>S R.domain)\n\\<Longrightarrow> (\\<And>res r. \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> \\<I> INTERP r * {R.mk (1(k := f))}\n      \\<Longrightarrow> P (R.get res) \\<and> dom f = dom (R.get res k))\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_set_res (\\<lambda>f. f(k := 1))\n         \\<lbrace> to_share o f \\<Ztypecolon> \\<phi> (k \\<^bold>\\<rightarrow> Identity) \\<longmapsto> \\<lambda>_. Void \\<rbrace>\\<close>\n  unfolding \\<phi>Procedure_Hybrid_DL\n  apply (clarsimp simp add: \\<phi>expns zero_set_def expand[where x=\\<open>1(k := f)\\<close>, simplified])\n  subgoal for r res\n    apply (rule R.\\<phi>R_dispose_res, assumption, standard, simp)\n    subgoal premises prems proof -\n      have t1: \\<open>dom f = dom (R.get res k)\\<close>\n        using prems(2) prems(3) by blast\n      have t2: \\<open>f \\<subseteq>\\<^sub>m R.get res k\\<close>\n        using R.raw_unit_assertion_implies' prems(3) by blast\n      have t3: \\<open>R.get res k = f\\<close>\n        by (metis (no_types, lifting) map_le_antisym map_le_def t1 t2)\n      show ?thesis\n        using prems(3) t3 by blast\n    qed . .\n\nsubsubsection \\<open>Allocate\\<close>\n\ndefinition (in mapping_resource)\n    \\<phi>R_allocate_res_entry :: \\<open>('key \\<Rightarrow> bool)\n                           \\<Rightarrow> 'val\n                           \\<Rightarrow> ('key \\<Rightarrow> 'ret proc)\n                           \\<Rightarrow> 'ret::VALs proc\\<close>\n  where \\<open>\\<phi>R_allocate_res_entry P init F =\n    \\<phi>R_get_res (\\<lambda>res.\n    let k = (@k. res k = 1 \\<and> P k)\n     in \\<phi>R_set_res (\\<lambda>f. f(k := init))\n        \\<ggreater> F k\n)\\<close>\n\nlemma (in mapping_resource) \\<phi>R_set_res_new[intro!]:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> m(k := u) \\<in>\\<^sub>S domain)\n\\<Longrightarrow> k \\<notin> dom1 (get res)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R\n\\<Longrightarrow> \\<phi>R_set_res (\\<lambda>f. f(k := u)) res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> (\\<lambda>_. R * {mk (1(k := u))}) \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> Any\\<close>\n  unfolding \\<phi>R_set_res_def\n  by (simp add: \\<phi>expns \"__allocation_rule__\")\n\nlemma (in mapping_resource) \\<phi>R_allocate_res_entry[intro!]:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S domain \\<longrightarrow> (\\<exists>k. m k = 1 \\<and> P k))\n\\<Longrightarrow> (\\<forall>k m. P k \\<longrightarrow> m \\<in>\\<^sub>S domain \\<longrightarrow> m(k := init) \\<in>\\<^sub>S domain)\n\\<Longrightarrow> (\\<And>k res. \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R * {mk (1(k := init))} \\<s>\\<u>\\<b>\\<j> P k\n      \\<Longrightarrow> F k res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E)\n\\<Longrightarrow> \\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> R\n\\<Longrightarrow> \\<phi>R_allocate_res_entry P init F res \\<r>\\<e>\\<s>\\<u>\\<l>\\<t>\\<s> \\<i>\\<n> Y \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n  unfolding \\<phi>R_allocate_res_entry_def \\<phi>R_get_res_def\n  subgoal premises prems proof -\n    let ?m = \\<open>get res\\<close>\n    define k' where \\<open>k' = (SOME k. ?m k = 1 \\<and> P k)\\<close>\n    have \\<open>\\<exists>k'. ?m k' = 1 \\<and> P k'\\<close>\n      using get_res_Valid prems(1) prems(4) by blast\n    note this[THEN someI_ex]\n    then have t1[simp]: \\<open>?m k' = 1 \\<and> P k'\\<close> unfolding k'_def by blast\n    show ?thesis\n      unfolding k'_def[symmetric]\n      apply (simp, rule \\<phi>M_RS_WP_SEQ, rule \\<phi>R_set_res_new)\n      using prems(2) t1 apply blast\n      apply (simp add: dom1_def)\n      using \\<open>\\<s>\\<t>\\<a>\\<t>\\<e> res \\<i>\\<s> _\\<close> apply this\n      by (simp add: prems(3))\n  qed .\n\nlemma (in identity_fiction_for_partial_mapping_resource) \"\\<phi>R_allocate_res_entry\"[intro!]:\n  \\<open> (\\<forall>m. m \\<in>\\<^sub>S R.domain \\<longrightarrow> (\\<exists>k. m k = 1 \\<and> P k))\n\\<Longrightarrow> (\\<forall>k m. P k \\<longrightarrow> m \\<in>\\<^sub>S R.domain \\<longrightarrow> m(k \\<mapsto> init) \\<in>\\<^sub>S R.domain)\n\\<Longrightarrow> (\\<And>new. P new \\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> F new \\<lbrace> X \\<heavy_comma> init \\<Ztypecolon> \\<phi> (new \\<^bold>\\<rightarrow> \\<black_circle> Identity) \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E)\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> R.\\<phi>R_allocate_res_entry P (Some init) F \\<lbrace> X \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n apply (clarsimp simp add: \\<phi>expns \\<phi>Procedure_Hybrid_DL)\n  subgoal for r res c\n  apply (rule R.\\<phi>R_allocate_res_entry[where R=\"(\\<I> INTERP (r * c))\"])\n  apply (clarsimp)\n  apply (clarsimp)\n  apply (clarsimp)\n  subgoal premises prems for k res'\n  apply (rule prems(3)[OF \\<open>P _\\<close>, THEN spec[where x=r], THEN spec[where x=res'],\n              simplified prems, simplified, THEN mp])\n    apply (rule exI[where x=\\<open>c * mk (1(k \\<mapsto> init))\\<close>])\n    apply rule\n    apply (smt (verit, ccfv_threshold) SPACE_mult_homo expand prems(6) prems(7) prems(8) prems(9) sep_disj_commute sep_disj_fiction sep_disj_multD2 sep_mult_commute sep_mult_left_commute)\n    apply rule\n    using FIC.SPACE_mult_homo prems(5) prems(6) prems(7) prems(8) prems(9) sep_disj_fiction sep_disj_multD2 apply blast\n    by (metis Fic_Space_m SPACE_mult_homo identity_fiction.sep_disj_fiction identity_fiction_axioms prems(6) prems(7) prems(8) prems(9) sep_disj_multD2 sep_disj_multI2)\n  . .\n\n\n\n(*\n\n\n(*\nsubsection \\<open>Tuple Operations\\<close>\n\n\n\nsubsubsection \\<open>Construct Tuple\\<close>\n\ndefinition cons_tup :: \"TY list \\<Rightarrow> VAL list \\<Rightarrow> (VAL,'RES_N,'RES) proc\"\n  where \"cons_tup tys vs = (\n    let N = length tys in\n    \\<phi>M_assert (N \\<le> length vs \\<and> list_all2 (\\<lambda>v t. v \\<in> Well_Type t) (rev (take N vs)) tys)\n    \\<ggreater> Success (V_tup.mk (rev (take N vs))))\"\n\nlemma cons_tup_nil:\n  \\<open>cons_tup [] = \\<phi>M_put_Val (V_tup.mk [])\\<close>\n  unfolding cons_tup_def \\<phi>M_put_Val_def\n  by simp\n\nlemma cons_tup_cons:\n  \\<open>cons_tup (TY#TYs) =\n    cons_tup TYs \\<ggreater>\n    \\<phi>M_get_Val (\\<lambda>tup.\n    \\<phi>M_get_Val (\\<lambda>v.\n    \\<phi>M_assert (v \\<in> Well_Type TY) \\<ggreater>\n    \\<phi>M_put_Val (V_tup.mk [v] * tup)\n    ))\\<close>\n  apply (auto split: list.split\n    simp add: cons_tup_def fun_eq_iff pair_forall instr_comp_def bind_def\n    \\<phi>M_get_Val_def \\<phi>M_assert_def \\<phi>M_put_Val_def Let_def V_tup_mult)\n  apply (metis Suc_le_eq list.sel(1) take_hd_drop)\n  apply (metis Cons_nth_drop_Suc Suc_le_eq list.sel(3))\n  apply (metis Suc_le_eq drop_all leI list.simps(3))\n  apply (metis (no_types, lifting) drop_all leI list.ctr_transfer(1) list.sel(1) list.simps(3) list_all2_Cons2 list_all2_appendI list_all2_rev1 rev.simps(2) take_hd_drop)\n  apply (smt (verit, del_insts) Suc_le_eq append1_eq_conv list.sel(1) list_all2_Cons2 rev_eq_Cons_iff take_hd_drop)\n  by (simp add: take_Suc_conv_app_nth)\n\nlemma (in \\<phi>empty) op_cons_tup_nil:\n  \\<open> \\<p>\\<r>\\<o>\\<c> cons_tup [] \\<lbrace> Void \\<longmapsto> () \\<Ztypecolon> EmptyTuple \\<rbrace>\\<close>\n  unfolding cons_tup_nil by \\<phi>reason\n\nlemma (in \\<phi>empty) op_cons_tup_cons:\n  \\<open> \\<p>\\<r>\\<o>\\<c> cons_tup TYs \\<lbrace> X \\<longmapsto> VAL y \\<Ztypecolon> Y \\<rbrace>\n\\<Longrightarrow> \\<phi>SemType (a \\<Ztypecolon> A) TY\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> cons_tup (TY#TYs) \\<lbrace> VAL a \\<Ztypecolon> A\\<heavy_comma> X \\<longmapsto> VAL (a,y) \\<Ztypecolon> (\\<clubsuit> A \\<^emph> Y) \\<rbrace>\\<close>\n  unfolding cons_tup_cons\n  apply \\<phi>reason apply (rule \\<phi>frame0, assumption)\n  apply \\<phi>reason apply (simp add: \\<phi>SemType_def subset_iff)\n  apply \\<phi>reason apply (simp add: \\<phi>expns) by blast\n\n\nsubsubsection \\<open>Destruct Tuple\\<close>\n\n\ndefinition op_dest_tup :: \"TY list \\<Rightarrow> (VAL,'RES_N,'RES) proc\"\n  where \"op_dest_tup tys =\n    \\<phi>M_getV (\\<tau>Tuple tys) V_tup.dest (\\<lambda>tup.\n    \\<lambda>(vs, res). Success (rev tup@vs, res))\"\n\nlemma op_dest_tup_nil_expn:\n  \\<open>op_dest_tup [] = \\<phi>M_getV (\\<tau>Tuple []) V_tup.dest (\\<lambda>_. SKIP)\\<close>\n  by (auto split: list.split\n    simp add: op_dest_tup_def \\<phi>M_get_Val_def \\<phi>M_put_Val_def \\<phi>M_getV_def Let_def fun_eq_iff \\<phi>M_assert_def\n      instr_comp_def bind_def)\n\nlemma op_dest_tup_cons_expn:\n  \\<open>op_dest_tup (TY#TYs) =\n    \\<phi>M_get_Val (\\<lambda>tup.\n    \\<phi>M_assert (\\<exists>h tup'. tup = V_tup.mk (h#tup') \\<and> h \\<in> Well_Type TY) \\<ggreater>\n    \\<phi>M_put_Val (hd (V_tup.dest tup)) \\<ggreater>\n    \\<phi>M_put_Val (V_tup.mk (tl (V_tup.dest tup))) \\<ggreater>\n    op_dest_tup TYs)\\<close>\n  apply (auto split: list.split\n    simp add: op_dest_tup_def \\<phi>M_get_Val_def \\<phi>M_put_Val_def \\<phi>M_getV_def Let_def fun_eq_iff \\<phi>M_assert_def\n      instr_comp_def bind_def)\n  by (metis list.discI list.exhaust_sel list.rel_sel list.sel(1))\n\nlemma (in \\<phi>empty) op_dest_tup_nil:\n  \\<open>\\<p>\\<r>\\<o>\\<c> op_dest_tup [] \\<lbrace> () \\<Ztypecolon> EmptyTuple \\<longmapsto> Void \\<rbrace> \\<close>\n  unfolding op_dest_tup_nil_expn by \\<phi>reason\n\nlemma (in \\<phi>empty) op_dest_tup_cons:\n  \\<open> \\<p>\\<r>\\<o>\\<c> op_dest_tup TYs \\<lbrace> VAL y \\<Ztypecolon> Y \\<longmapsto> X \\<rbrace>\n\\<Longrightarrow> \\<phi>SemType (a \\<Ztypecolon> A) TY\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> op_dest_tup (TY#TYs) \\<lbrace> VAL (a,y) \\<Ztypecolon> (\\<clubsuit> A \\<^emph> \\<phi>Is_Tuple Y) \\<longmapsto> VAL a \\<Ztypecolon> A\\<heavy_comma> X \\<rbrace>\\<close>\n  unfolding op_dest_tup_cons_expn\n  apply \\<phi>reason apply (clarsimp simp add: \\<phi>SemType_def subset_iff V_tup_mult \\<phi>expns)\n  apply \\<phi>reason apply (clarsimp simp add: \\<phi>SemType_def subset_iff V_tup_mult \\<phi>expns, assumption)\n  apply \\<phi>reason apply (clarsimp simp add: \\<phi>SemType_def subset_iff V_tup_mult \\<phi>expns, assumption)\n  by (rule \\<phi>frame0, assumption)\n\n\n\nsubsubsection \\<open>Accessing Elements\\<close>\n\n\ndefinition op_get_element :: \"nat list \\<Rightarrow> TY \\<Rightarrow> (VAL,'RES_N,'RES) proc\"\n  where \"op_get_element idx TY =\n    \\<phi>M_get_Val (\\<lambda>v.\n    \\<phi>M_assert (v \\<in> Well_Type TY \\<and> valid_index TY idx) \\<ggreater>\n    \\<phi>M_put_Val (index_value idx v))\"\n\ndefinition op_set_element :: \"nat list \\<Rightarrow> TY \\<Rightarrow> (VAL,'RES_N,'RES) proc\"\n  where \"op_set_element idx TY =\n    \\<phi>M_get_Val (\\<lambda>u.\n    \\<phi>M_get_Val (\\<lambda>v.\n    \\<phi>M_assert (v \\<in> Well_Type TY \\<and> valid_index TY idx \\<and> u \\<in> Well_Type (index_type idx TY)) \\<ggreater>\n    \\<phi>M_put_Val (index_mod_value idx (\\<lambda>_. u) v)\n  ))\"\n\nlemma (in \\<phi>empty) op_get_element:\n  \\<open> \\<s>\\<i>\\<m>\\<p>\\<r>\\<e>\\<m> valid_index TY idx\n\\<Longrightarrow> \\<phi>SemType (x \\<Ztypecolon> X) TY\n\\<Longrightarrow> \\<phi>Index_getter idx X Y f\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> op_get_element idx TY \\<lbrace> VAL x \\<Ztypecolon> X \\<longmapsto> VAL f x \\<Ztypecolon> Y \\<rbrace> \\<close>\n  unfolding op_get_element_def \\<phi>Index_getter_def Premise_def\n  apply \\<phi>reason apply (simp add: \\<phi>SemType_def subset_iff)\n  by \\<phi>reason\n\nlemma (in \\<phi>empty) op_set_element:\n  \\<open> \\<s>\\<i>\\<m>\\<p>\\<r>\\<e>\\<m> valid_index TY idx\n\\<Longrightarrow> \\<phi>Index_mapper idx X Y f\n\\<Longrightarrow> \\<phi>SemType (x \\<Ztypecolon> X) TY\n\\<Longrightarrow> \\<phi>SemType (y \\<Ztypecolon> Y) (index_type idx TY)\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> op_set_element idx TY \\<lbrace> VAL x \\<Ztypecolon> X\\<heavy_comma> VAL y \\<Ztypecolon> Y \\<longmapsto> f (\\<lambda>_. y) x \\<Ztypecolon> X \\<rbrace>\\<close>\n  unfolding op_set_element_def \\<phi>Index_mapper_def Premise_def\n  apply \\<phi>reason apply (simp add: \\<phi>SemType_def subset_iff)\n   apply (simp add: \\<phi>SemType_def subset_iff)\n  by \\<phi>reason\n\n\n*)\n\n*)\n\nend\n", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_System/PhiSem_Formalization_Tools.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.607663184043154, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3369312881957413}}
{"text": "theory GenSubEnv\n  imports GenEnv PermEnv\nbegin\n  \n    (* ##### sub env lemmas *)\n\ndefinition sub_env :: \"'a state_env \\<Rightarrow> 'b res_env \\<Rightarrow> bool\" where\n  \"sub_env s env = (\\<forall> x. env x \\<noteq> None \\<longrightarrow> (\\<exists> y. x = Loc y \\<and> s y \\<noteq> None))\"  \n  \ndefinition sub_use_env :: \"'a state_env \\<Rightarrow> perm_use_env \\<Rightarrow> bool\" where\n  \"sub_use_env s r_s = (\\<forall> x. r_s x \\<noteq>  NoPerm \\<longrightarrow> (\\<exists> y. x = Loc y \\<and> s y \\<noteq> None))\"\n\ndefinition contain_env :: \"('a, 'b) gen_env \\<Rightarrow> ('a, 'b) gen_env \\<Rightarrow> bool\" where\n  \"contain_env env env' = (\\<forall> x. case env' x of None \\<Rightarrow> True | Some tau \\<Rightarrow> env x = Some tau)\"  \n  \n    (* - sub env lemmas *)\n\nlemma add_sub_env: \"\\<lbrakk> sub_env s env \\<rbrakk> \\<Longrightarrow> sub_env (add_env s x v) env\"   \n  apply (simp add: sub_env_def)\n  apply (simp add: add_env_def)\n  apply (auto)\n  done  \n\nlemma dist_add_sub_env: \"\\<lbrakk> sub_env s env \\<rbrakk> \\<Longrightarrow> sub_env (add_env s x v) (add_env env (Loc x) tau)\"    \n  apply (simp add: sub_env_def)\n  apply (simp add: add_env_def)\n  apply (auto)\n  done  \n\nlemma rhs_add_sub_env: \"\\<lbrakk> sub_env s env; s x \\<noteq> None \\<rbrakk> \\<Longrightarrow> sub_env s (add_env env (Loc x) tau)\"        \n  apply (simp add: sub_env_def)\n  apply (simp add: add_env_def)\n  done  \n    \nlemma rem_sub_env: \"\\<lbrakk> sub_env s env \\<rbrakk> \\<Longrightarrow> sub_env s (rem_env env x)\"\n  apply (simp add: sub_env_def)\n  apply (simp add: rem_env_def)\n  done\n\nlemma add_rem_sub_env: \"\\<lbrakk> sub_env (add_env s x v) env \\<rbrakk> \\<Longrightarrow> sub_env s (rem_env env (Loc x))\"    \n  apply (simp add: sub_env_def)\n  apply (simp add: add_env_def)\n  apply (simp add: rem_env_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (auto)\n  done\n\n    (* - sub use env lemmas *)\n  \nlemma add_sub_use_env: \"\\<lbrakk> sub_use_env s r_s \\<rbrakk> \\<Longrightarrow> sub_use_env (add_env s x v) r_s\"    \n  apply (simp add: sub_use_env_def)\n  apply (simp add: add_env_def)\n  apply (auto)\n  done\n    \nlemma rhs_add_sub_use_env: \"\\<lbrakk> sub_use_env s r_s; s x \\<noteq> None \\<rbrakk> \\<Longrightarrow> sub_use_env s (add_use_env r_s (Loc x) r)\"    \n  apply (simp add: sub_use_env_def)\n  apply (simp add: add_use_env_def)\n  done\n\nlemma rem_sub_use_env: \"\\<lbrakk> sub_use_env s r_s \\<rbrakk> \\<Longrightarrow> sub_use_env s (rem_use_env r_s x)\"\n  apply (simp add: sub_use_env_def)\n  apply (simp add: rem_use_env_def)\n  done\n\nlemma add_rem_sub_use_env: \"\\<lbrakk> sub_use_env (add_env s x v) r_s \\<rbrakk> \\<Longrightarrow> sub_use_env s (rem_use_env r_s (Loc x))\"    \n  apply (simp add: sub_use_env_def)\n  apply (simp add: add_env_def)\n  apply (simp add: rem_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (auto)\n  done\n    \nlemma contain_sub_use_env: \"\\<lbrakk> sub_use_env s r_s; contain_env s' s \\<rbrakk> \\<Longrightarrow> sub_use_env s' r_s\"    \n  apply (simp add: sub_use_env_def)  \n  apply (simp add: contain_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (erule_tac x=\"y\" in allE)\n  apply (auto)\n  done\n    \nlemma empty_sub_use_env: \"sub_use_env s empty_use_env\"\n  apply (simp add: sub_use_env_def)\n  apply (simp add: empty_use_env_def)\n  done  \n  \nlemma comp_sub_use_env: \"\\<lbrakk> sub_use_env s r_x; sub_use_env s r_s \\<rbrakk> \\<Longrightarrow> sub_use_env s (comp_use_env r_x r_s)\"    \n  apply (simp add: sub_use_env_def)\n  apply (simp add: comp_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  done   \n\n    (* contain lemmas *)    \n    \nlemma trans_contain_env: \"\\<lbrakk> contain_env env_a env_b; contain_env env_b env_c \\<rbrakk> \\<Longrightarrow> contain_env env_a env_c\"\n  apply (simp add: contain_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"env_c x\")\n   apply (auto)\n  done\n        \nlemma id_contain_env: \"contain_env r_s r_s\"    \n  apply (simp add: contain_env_def)\n  apply (auto)\n  apply (case_tac \"r_s x\")\n   apply (auto)\n  done\n  \nlemma self_rem_contain_env: \"contain_env env (rem_env env x)\"    \n  apply (simp add: contain_env_def)\n  apply (simp add: rem_env_def)\n  apply (auto)\n  apply (case_tac \"env xa\")\n   apply (auto)\n  done\n    \nlemma rem_contain_env: \"\\<lbrakk> contain_env env' env \\<rbrakk> \\<Longrightarrow> contain_env env' (rem_env env x)\"    \n  apply (rule_tac env_b=\"env\" in trans_contain_env)\n   apply (simp)\n  apply (rule_tac self_rem_contain_env)\n  done\n  \nlemma add_contain_env: \"\\<lbrakk> env x = None \\<rbrakk> \\<Longrightarrow> contain_env (add_env env x tau) env\"    \n  apply (simp add: contain_env_def)\n  apply (auto)\n  apply (case_tac \"env xa\")\n   apply (auto)\n  apply (simp add: add_env_def)\n  apply (auto)\n  done    \n    \nlemma dist_add_contain_env: \"\\<lbrakk> contain_env r_s r_x \\<rbrakk> \\<Longrightarrow> contain_env (add_env r_s x t) (add_env r_x x t)\"    \n  apply (simp add: add_env_def)\n  apply (simp add: contain_env_def)\n  done    \n  \nlemma rem_add_contain_env: \"\\<lbrakk> contain_env r_s r_x \\<rbrakk> \\<Longrightarrow> contain_env (add_env r_s x t) (rem_env r_x x)\"        \n  apply (simp add: contain_env_def)\n  apply (auto)\n  apply (simp add: rem_env_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (case_tac \"r_x xa\")\n   apply (auto)\n  apply (simp add: add_env_def)\n  done        \n    \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/GenSubEnv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3369312803165705}}
{"text": "header{* Guard-Based Encodings  *}\ntheory G\nimports T_G_Prelim Mcalc2C\nbegin\n\n\nsubsection{* The guard translation *}\n\ntext{* The extension of the function symbols with type witnesses: *}\n\ndatatype ('fsym,'tp) efsym = Oldf 'fsym | Wit 'tp\n\ntext{* The extension of the predicate symbols with type guards: *}\n\ndatatype ('psym,'tp) epsym = Oldp 'psym | Guard 'tp\n\ntext{* Extension of the partitioned infinitely augmented problem\nfor dealing with guards: *}\n\nlocale ProblemIkTpartG =\nIk : ProblemIkTpart wtFsym wtPsym arOf resOf parOf \\<Phi> infTp prot protFw\nfor wtFsym :: \"'fsym \\<Rightarrow> bool\"\nand wtPsym :: \"'psym \\<Rightarrow> bool\"\nand arOf :: \"'fsym \\<Rightarrow> 'tp list\"\nand resOf and parOf and \\<Phi> and infTp and prot and protFw +\nfixes (* Further refinement of prot: *)\n    protCl :: \"'tp \\<Rightarrow> bool\" (* types aimed to be classically protected *)\nassumes\n    protCl_prot[simp]: \"\\<And> \\<sigma>. protCl \\<sigma> \\<Longrightarrow> prot \\<sigma>\"\n    (* In order to add classical (implicational) guards, one needs\n      backwards closure on the ranks of function symbols*)\nand protCl_fsym: \"\\<And> f. protCl (resPf f) \\<Longrightarrow> list_all protCl (arOf f)\"\n\nlocale ModelIkTpartG =\nIk : ProblemIkTpartG wtFsym wtPsym arOf resOf parOf \\<Phi> infTp prot protFw protCl +\nIk : ModelIkTpart wtFsym wtPsym arOf resOf parOf \\<Phi> infTp prot protFw intT intF intP\nfor wtFsym :: \"'fsym \\<Rightarrow> bool\"\nand wtPsym :: \"'psym \\<Rightarrow> bool\"\nand arOf :: \"'fsym \\<Rightarrow> 'tp list\"\nand resOf and parOf and \\<Phi> and infTp and prot and protFw and protCl\nand intT and intF and intP\n\n\ncontext ProblemIkTpartG\nbegin\n\nlemma protCl_resOf_arOf[simp]:\nassumes \"protCl (resOf f)\" and \"i < length (arOf f)\"\nshows \"protCl (arOf f ! i)\"\nusing assms protCl_fsym unfolding list_all_length by auto\n\ntext{* ``GE'' stands for ``guard encoding'': *}\n\nfun GE_wtFsym where\n \"GE_wtFsym (Oldf f) \\<longleftrightarrow> wtFsym f\"\n|\"GE_wtFsym (Wit \\<sigma>) \\<longleftrightarrow> \\<not> isRes \\<sigma> \\<or> protCl \\<sigma>\"\n\nfun GE_arOf where\n \"GE_arOf (Oldf f) = arOf f\"\n|\"GE_arOf (Wit \\<sigma>) = []\"\n\nfun GE_resOf where\n \"GE_resOf (Oldf f) = resOf f\"\n|\"GE_resOf (Wit \\<sigma>) = \\<sigma>\"\n\nfun GE_wtPsym where\n \"GE_wtPsym (Oldp p) \\<longleftrightarrow> wtPsym p\"\n|\"GE_wtPsym (Guard \\<sigma>) \\<longleftrightarrow> \\<not> unprot \\<sigma>\"\n\nfun GE_parOf where\n \"GE_parOf (Oldp p) = parOf p\"\n|\"GE_parOf (Guard \\<sigma>) = [\\<sigma>]\"\n\n\nlemma countable_GE_wtFsym: \"countable (Collect GE_wtFsym)\" (is \"countable ?K\")\nproof-\n  let ?F = \"\\<lambda> ef. case ef of Oldf f \\<Rightarrow> Inl f | Wit \\<sigma> \\<Rightarrow> Inr \\<sigma>\"\n  let ?U = \"UNIV::'tp set\"  let ?L = \"(Collect wtFsym) <+> ?U\"\n  have \"inj_on ?F ?K\" unfolding inj_on_def apply clarify\n  apply(case_tac x, simp_all) by (case_tac y, simp_all)+\n  moreover have \"?F ` ?K \\<subseteq> ?L\" apply clarify by (case_tac ef, auto)\n  ultimately have \"|?K| \\<le>o |?L|\" unfolding card_of_ordLeq[symmetric] by auto\n  moreover have \"countable ?L\" using countable_wtFsym countable_tp\n  by (metis countable_Plus)\n  ultimately show ?thesis by(rule countable_ordLeq)\nqed\n\n\n\nend (* context ProblemIkTpartG *)\n\nsublocale ProblemIkTpartG < GE : Signature\nwhere wtFsym = GE_wtFsym and wtPsym = GE_wtPsym\nand arOf = GE_arOf and resOf = GE_resOf and parOf = GE_parOf\napply default\nusing countable_tp countable_GE_wtFsym countable_GE_wtPsym by auto\n\n\ncontext ProblemIkTpartG\nbegin\n\ntext{* The guarding literal of a variable: *}\n\ndefinition grdLit :: \"var \\<Rightarrow> (('fsym, 'tp) efsym, ('psym, 'tp) epsym) lit\"\nwhere \"grdLit x \\<equiv> Neg (Pr (Guard (tpOfV x)) [Var x])\"\n\ntext{* The (set of) guarding literals of a literal and of a clause: *}\n\n(* of a literal: *)\nfun glitOfL ::\n\"('fsym, 'psym) lit \\<Rightarrow> (('fsym, 'tp) efsym, ('psym, 'tp) epsym) lit set\"\nwhere\n\"glitOfL (Pos at) =\n {grdLit x | x. x \\<in> varsA at \\<and> (prot (tpOfV x) \\<or> (protFw (tpOfV x) \\<and> x \\<in> nvA at))}\"\n|\n\"glitOfL (Neg at) = {grdLit x | x. x \\<in> varsA at \\<and> prot (tpOfV x)}\"\n\n(* of a clause: *)\ndefinition \"glitOfC c \\<equiv> \\<Union> set (map glitOfL c)\"\n\nlemma finite_glitOfL[simp]: \"finite (glitOfL l)\"\nproof-\n  have \"glitOfL l \\<subseteq> grdLit ` {x . x \\<in> varsL l}\" by (cases l, auto)\n  thus ?thesis by (metis Collect_mem_eq finite_surj finite_varsL)\nqed\n\nlemma finite_glitOfC[simp]: \"finite (glitOfC c)\"\nunfolding glitOfC_def apply(rule finite_Union) using finite_glitOfL by auto\n\nfun gT where\n\"gT (Var x) = Var x\"\n|\n\"gT (Fn f Tl) = Fn (Oldf f) (map gT Tl)\"\n\nfun gA where\n\"gA (Eq T1 T2) = Eq (gT T1) (gT T2)\"\n|\n\"gA (Pr p Tl) = Pr (Oldp p) (map gT Tl)\"\n\nfun gL where\n\"gL (Pos at) = Pos (gA at)\"\n|\n\"gL (Neg at) = Neg (gA at)\"\n\ndefinition \"gC c \\<equiv> (map gL c) @ (list (glitOfC c))\"\n\nlemma set_gC[simp]: \"set (gC c) = gL ` (set c) \\<union> glitOfC c\"\nunfolding gC_def by simp\n\n\ntext{* The extra axioms: *}\n\ntext{* The function axioms: *}\n\n(* conclusion (atom): *)\ndefinition \"cOfFax f = Pr (Guard (resOf f)) [Fn (Oldf f) (getTvars (arOf f))]\"\n(* hypotheses (list of atoms): *)\ndefinition \"hOfFax f = map2 (Pr o Guard) (arOf f) (map singl (getTvars (arOf f)))\"\n(* The axiom (clause) for non-classically-decorated (lightweight and featherweigh) types: *)\ndefinition \"fax f \\<equiv> [Pos (cOfFax f)]\"\n(* The axiom (clause) for classically-decorated types: *)\ndefinition \"faxCD f \\<equiv> map Neg (hOfFax f) @ fax f\"\n(* The set of axioms: *)\ndefinition\n\"Fax \\<equiv> {fax f | f. wtFsym f \\<and> \\<not> unprot (resOf f) \\<and> \\<not> protCl (resOf f)} \\<union>\n       {faxCD f | f. wtFsym f \\<and> protCl (resOf f)}\"\n\ntext{* The witness axioms: *}\n\n(* The axiom (clause): *)\ndefinition \"wax \\<sigma> \\<equiv> [Pos (Pr (Guard \\<sigma>) [Fn (Wit \\<sigma>) []])]\"\n(* The set of axioms: *)\ndefinition \"Wax \\<equiv> {wax \\<sigma> | \\<sigma>. \\<not> unprot \\<sigma> \\<and> (\\<not> isRes \\<sigma> \\<or> protCl \\<sigma>)}\"\n\ndefinition \"gPB = gC ` \\<Phi> \\<union> Fax \\<union> Wax\"\n\ntext{* Well-typedness of the translation: *}\n\nlemma tpOf_g[simp]: \"GE.tpOf (gT T) = Ik.tpOf T\"\nby (cases T) auto\n\nlemma wt_g[simp]: \"Ik.wt T \\<Longrightarrow> GE.wt (gT T)\"\nby (induct T, auto simp add: list_all_iff)\n\nlemma wtA_gA[simp]: \"Ik.wtA at \\<Longrightarrow> GE.wtA (gA at)\"\nby (cases at, auto simp add: list_all_iff)\n\nlemma wtL_gL[simp]: \"Ik.wtL l \\<Longrightarrow> GE.wtL (gL l)\"\nby (cases l, auto)\n\nlemma wtC_map_gL[simp]: \"Ik.wtC c \\<Longrightarrow> GE.wtC (map gL c)\"\nunfolding Ik.wtC_def GE.wtC_def by (induct c, auto)\n\nlemma wtL_grdLit_unprot[simp]: \"\\<not> unprot (tpOfV x) \\<Longrightarrow> GE.wtL (grdLit x)\"\nunfolding grdLit_def by auto\n\nlemma wtL_grdLit[simp]: \"prot (tpOfV x) \\<or> protFw (tpOfV x) \\<Longrightarrow> GE.wtL (grdLit x)\"\napply(rule wtL_grdLit_unprot) unfolding unprot_def by auto\n\nlemma wtL_glitOfL[simp]: \"l' \\<in> glitOfL l \\<Longrightarrow> GE.wtL l'\"\nby (cases l, auto)\n\nlemma wtL_glitOfC[simp]: \"l' \\<in> glitOfC c \\<Longrightarrow> GE.wtL l'\"\nunfolding glitOfC_def GE.wtC_def by (induct c, auto)\n\nlemma wtC_list_glitOfC[simp]: \"GE.wtC (list (glitOfC c))\"\nunfolding glitOfC_def GE.wtC_def by auto\n\nlemma wtC_gC[simp]: \"Ik.wtC c \\<Longrightarrow> GE.wtC (gC c)\"\nunfolding gC_def by simp\n\nlemma wtA_cOfFax_unprot[simp]: \"\\<lbrakk>wtFsym f; \\<not> unprot (resOf f)\\<rbrakk> \\<Longrightarrow> GE.wtA (cOfFax f)\"\nunfolding cOfFax_def by simp\n\nlemma wtA_cOfFax[simp]:\n\"\\<lbrakk>wtFsym f; prot (resOf f) \\<or> protFw (resOf f)\\<rbrakk> \\<Longrightarrow> GE.wtA (cOfFax f)\"\napply(rule wtA_cOfFax_unprot) unfolding unprot_def by auto\n\nlemma wtA_hOfFax[simp]:\n\"\\<lbrakk>wtFsym f; protCl (resOf f)\\<rbrakk> \\<Longrightarrow> list_all GE.wtA (hOfFax f)\"\nunfolding hOfFax_def unfolding list_all_length\nby (auto simp add: singl_def unprot_def)\n\nlemma wtC_fax_unprot[simp]: \"\\<lbrakk>wtFsym f; \\<not> unprot (resOf f)\\<rbrakk> \\<Longrightarrow> GE.wtC (fax f)\"\nunfolding fax_def GE.wtC_def by auto\n\nlemma wtC_fax[simp]: \"\\<lbrakk>wtFsym f; prot (resOf f) \\<or> protFw (resOf f)\\<rbrakk> \\<Longrightarrow> GE.wtC (fax f)\"\napply(rule wtC_fax_unprot) unfolding unprot_def by auto\n\nlemma wtC_faxCD[simp]: \"\\<lbrakk>wtFsym f; protCl (resOf f)\\<rbrakk> \\<Longrightarrow> GE.wtC (faxCD f)\"\nunfolding faxCD_def GE.wtC_append apply(rule conjI)\n  using wtA_hOfFax[unfolded list_all_length] apply(simp add: GE.wtC_def list_all_length)\n  by simp\n\nlemma wtPB_Fax[simp]: \"GE.wtPB Fax\"\nunfolding Fax_def GE.wtPB_def by auto\n\nlemma wtC_wax_unprot[simp]: \"\\<lbrakk>\\<not> unprot \\<sigma>; \\<not> isRes \\<sigma> \\<or> protCl \\<sigma>\\<rbrakk> \\<Longrightarrow> GE.wtC (wax \\<sigma>)\"\nunfolding wax_def GE.wtC_def by simp\n\nlemma wtC_wax[simp]: \"\\<lbrakk>prot \\<sigma> \\<or> protFw \\<sigma>; \\<not> isRes \\<sigma> \\<or> protCl \\<sigma>\\<rbrakk> \\<Longrightarrow> GE.wtC (wax \\<sigma>)\"\napply(rule wtC_wax_unprot) unfolding unprot_def by auto\n\nlemma wtPB_Wax[simp]: \"GE.wtPB Wax\"\nunfolding Wax_def GE.wtPB_def by auto\n\nlemma wtPB_gC_\\<Phi>[simp]: \"GE.wtPB (gC ` \\<Phi>)\"\nusing Ik.wt_\\<Phi> unfolding Ik.wtPB_def GE.wtPB_def by auto\n\n\n\nlemma wtA_Guard:\nassumes \"GE.wtA (Pr (Guard \\<sigma>) Tl)\"\nshows \"\\<exists> T. Tl = [T] \\<and> GE.wt T \\<and> tpOf T = \\<sigma>\"\nusing assms by simp (metis (hide_lams, no_types) list.inject map_eq_Cons_conv \n                           list_all_simps map_is_Nil_conv neq_Nil_conv)\n\n\n\nlemma tpOf_Wit: \"GE.tpOf (Fn (Wit \\<sigma>) Tl) = \\<sigma>\" by simp\n\nend (* context ProblemIkTpartG *)\n\n\nsubsection{* Soundness *}\n\ncontext ModelIkTpartG begin\n\n(* The identity-guard extension of a given structure of the original signature *)\nfun GE_intF where\n \"GE_intF (Oldf f) al = intF f al\"\n|\"GE_intF (Wit \\<sigma>) al = pickT \\<sigma>\"\n(* note: for witnesses, we only care about al being [] *)\n\nfun GE_intP where\n \"GE_intP (Oldp p) al = intP p al\"\n|\"GE_intP (Guard \\<sigma>) al = True\"\n(* note: for guards, we only care about al being a singleton *)\n\nend (* context ModelIkTpartG *)\n\nsublocale ModelIkTpartG < GE : Struct\nwhere wtFsym = GE_wtFsym and wtPsym = GE_wtPsym and\narOf = GE_arOf and resOf = GE_resOf and parOf = GE_parOf\nand intF = GE_intF and intP = GE_intP\nproof default\n  fix ef al assume \"GE_wtFsym ef\" and \"list_all2 intT (GE_arOf ef) al\"\n  thus \"intT (GE_resOf ef) (GE_intF ef al)\"\n  using intF by (cases ef, auto)\nqed auto\n\ncontext ModelIkTpartG begin\n\nlemma g_int[simp]: \"GE.int \\<xi> (gT T) = Ik.int \\<xi> T\"\nproof (induct T)\n  case (Fn f Tl)\n  hence 0: \"map (GE.int \\<xi> \\<circ> gT) Tl = map (Ik.int \\<xi>) Tl\"\n  unfolding list_eq_iff list_all_iff by auto\n  show ?case by (simp add: 0)\nqed auto\n\nlemma map_g_int[simp]: \"map (GE.int \\<xi> \\<circ> gT) Tl = map (Ik.int \\<xi>) Tl\"\nunfolding list_eq_iff list_all_iff by auto\n\nlemma gA_satA[simp]: \"GE.satA \\<xi> (gA at) \\<longleftrightarrow> Ik.satA \\<xi> at\"\napply(cases at) by auto\n\nlemma gL_satL[simp]: \"GE.satL \\<xi> (gL l) \\<longleftrightarrow> Ik.satL \\<xi> l\"\napply(cases l) by auto\n\nlemma map_gL_satC[simp]: \"GE.satC \\<xi> (map gL c) \\<longleftrightarrow> Ik.satC \\<xi> c\"\nunfolding GE.satC_def Ik.satC_def by (induct c, auto)\n\nlemma gC_satC[simp]:\nassumes \"Ik.satC \\<xi> c\"  shows \"GE.satC \\<xi> (gC c)\"\nusing assms unfolding gC_def by simp\n\nlemma gC_\\<Phi>_satPB[simp]:\nassumes \"Ik.satPB \\<xi> \\<Phi>\"  shows \"GE.satPB \\<xi> (gC ` \\<Phi>)\"\nusing assms unfolding GE.satPB_def Ik.satPB_def by auto\n\nlemma Fax_Wax_satPB:\n\"GE.satPB \\<xi> (Fax) \\<and> GE.satPB \\<xi> (Wax)\"\nunfolding GE.satPB_def GE.satC_def Fax_def Wax_def\nby (auto simp add: cOfFax_def hOfFax_def fax_def faxCD_def wax_def)\n\nlemmas Fax_satPB[simp] = Fax_Wax_satPB[THEN conjunct1]\nlemmas Wax_satPB[simp] = Fax_Wax_satPB[THEN conjunct2]\n\n\n\n\n\nend (* context ModelIkTpartG *)\n\n(* Soundness theorem in sublocale form: Given a problem (with indicated\ntype partition) and a model for it, we obtain a model of the tag-extended (GE)\nproblem: *)\nsublocale ModelIkTpartG < GE : Model\nwhere wtFsym = GE_wtFsym and wtPsym = GE_wtPsym and\narOf = GE_arOf and resOf = GE_resOf and parOf = GE_parOf\nand \\<Phi> = gPB and intF = GE_intF and intP = GE_intP\nusing G_soundness .\n\n\nsubsection{* Completeness  *}\n\n(* Problem with type partition and model of its guard-encoding translation: *)\nlocale ProblemIkTpartG_GEModel =\nIk : ProblemIkTpartG wtFsym wtPsym arOf resOf parOf \\<Phi> infTp prot protFw protCl +\nGE : Model \"ProblemIkTpartG.GE_wtFsym wtFsym resOf protCl\"\n           \"ProblemIkTpartG.GE_wtPsym wtPsym prot protFw\"\n           \"ProblemIkTpartG.GE_arOf arOf\" \"ProblemIkTpartG.GE_resOf resOf\"\n           \"ProblemIkTpartG.GE_parOf parOf\"\n           gPB eintT eintF eintP\nfor wtFsym :: \"'fsym \\<Rightarrow> bool\"\nand wtPsym :: \"'psym \\<Rightarrow> bool\"\nand arOf :: \"'fsym \\<Rightarrow> 'tp list\"\nand resOf and parOf and \\<Phi> and infTp and prot and protFw and protCl\nand eintT and eintF and eintP\n\ncontext ProblemIkTpartG_GEModel begin\n\ntext{* The reduct structure of a given structure in the guard-extended signature: *}\ndefinition\n\"intT \\<sigma> a \\<equiv>\n if unprot \\<sigma> then eintT \\<sigma> a\n else eintT \\<sigma> a \\<and> eintP (Guard \\<sigma>) [a]\"\ndefinition\n\"intF f al \\<equiv> eintF (Oldf f) al\"\ndefinition\n\"intP p al \\<equiv> eintP (Oldp p) al\"\n\n(* Semantic rephrasings of the fact that the (guarded problem) model satisfies\n   Fax and Wax *)\nlemma GE_Guard_all: (* fixme: messy proof *)\nassumes f: \"wtFsym f\"\nand al: \"list_all2 eintT (arOf f) al\"\nshows\n\"(\\<not> unprot (resOf f) \\<and> \\<not> protCl (resOf f)\n  \\<longrightarrow> eintP (Guard (resOf f)) [eintF (Oldf f) al])\n \\<and>\n (protCl (resOf f) \\<longrightarrow>\n  list_all2 (eintP \\<circ> Guard) (arOf f) (map singl al)\n  \\<longrightarrow> eintP (Guard (resOf f)) [eintF (Oldf f) al])\"\n(is \"(?A1 \\<longrightarrow> ?C) \\<and>\n     (?A2 \\<longrightarrow> ?H2 \\<longrightarrow> ?C)\")\nproof(intro conjI impI)\n  def xl \\<equiv> \"getVars (arOf f)\"\n  have l[simp]: \"length xl = length al\" \"length al = length (arOf f)\"\n                \"length (getTvars (arOf f)) = length (arOf f)\"\n  unfolding xl_def using al unfolding list_all2_iff by auto\n  have 1[simp]: \"\\<And> i. i < length (arOf f) \\<Longrightarrow> tpOfV (xl!i) = (arOf f)!i\"\n  unfolding xl_def by auto\n  have xl[simp]: \"distinct xl\" unfolding xl_def using distinct_getVars by auto\n  def \\<xi> \\<equiv> \"pickE xl al\"\n  have \\<xi>: \"GE.wtE \\<xi>\" unfolding \\<xi>_def apply(rule wtE_pickE) using al list_all2_nthD by auto\n  have [simp]: \"\\<And> i. i < length (arOf f) \\<Longrightarrow> \\<xi> (xl ! i) = al ! i\"\n  using al unfolding \\<xi>_def by (auto simp: list_all2_length intro: pickE)\n  have 0: \"map (GE.int \\<xi>) (getTvars (arOf f)) = al\"\n  apply(rule nth_equalityI)\n  using al by (auto simp: list_all2_length getTvars_def xl_def[symmetric])\n  have 1:\n  \"GE.satC \\<xi> (map Neg (map2 (Pr \\<circ> Guard) (arOf f) (map singl (getTvars (arOf f))))) \\<longleftrightarrow>\n   \\<not> list_all2 (eintP \\<circ> Guard) (arOf f) (map singl al)\"\n  unfolding GE.satC_def list_ex_length list_all2_map2 singl_def\n  unfolding list_all2_length\n  by (auto simp add: map2_def map_zip_map2 singl_def getTvars_def xl_def[symmetric])\n  have Fax: \"GE.satPB \\<xi> Fax\" using GE.sat_\\<Phi>[OF \\<xi>] unfolding gPB_def by simp\n  {assume ?A1\n   hence \"GE.satC \\<xi> (fax f)\" using f Fax unfolding GE.satPB_def Fax_def by auto\n   thus ?C unfolding fax_def cOfFax_def GE.satC_def by (simp add: 0)\n  }\n  {assume ?A2 and ?H2\n   hence \"GE.satC \\<xi> (faxCD f)\" using f Fax unfolding GE.satPB_def Fax_def by auto\n   thus ?C using `?H2`\n   unfolding faxCD_def fax_def cOfFax_def hOfFax_def\n   unfolding GE.satC_append 1 unfolding GE.satC_def by (simp add: 0)\n  }\nqed\n\nlemma GE_Guard_not_unprot_protCl:\nassumes f: \"wtFsym f\" and f2: \"\\<not> unprot (resOf f)\" \"\\<not> protCl (resOf f)\"\nand al: \"list_all2 eintT (arOf f) al\"\nshows \"eintP (Guard (resOf f)) [intF f al]\"\nusing GE_Guard_all[OF f al] f2 unfolding intF_def by auto\n\nlemma GE_Guard_protCl:\nassumes f: \"wtFsym f\" and f2: \"protCl (resOf f)\" and al: \"list_all2 eintT (arOf f) al\"\nand H: \"list_all2 (eintP \\<circ> Guard) (arOf f) (map singl al)\"\nshows \"eintP (Guard (resOf f)) [intF f al]\"\nusing GE_Guard_all[OF f al] f2 H unfolding intF_def by auto\n\nlemma GE_Guard_not_unprot:\nassumes f: \"wtFsym f\" and f2: \"\\<not> unprot (resOf f)\" and al: \"list_all2 eintT (arOf f) al\"\nand H: \"list_all2 (eintP \\<circ> Guard) (arOf f) (map singl al)\"\nshows \"eintP (Guard (resOf f)) [intF f al]\"\napply(cases \"protCl (resOf f)\")\n  using GE_Guard_protCl[OF f _ al H] apply fastforce\n  using GE_Guard_not_unprot_protCl[OF f f2 _ al] by simp\n\nlemma GE_Wit:\nassumes \\<sigma>: \"\\<not> unprot \\<sigma>\" \"\\<not> isRes \\<sigma> \\<or> protCl \\<sigma>\"\nshows \"eintP (Guard \\<sigma>) [eintF (Wit \\<sigma>) []]\"\nproof-\n  def \\<xi> \\<equiv> \"pickE [] []\"\n  have \\<xi>: \"GE.wtE \\<xi>\" unfolding \\<xi>_def apply(rule wtE_pickE) by auto\n  have \"GE.satPB \\<xi> Wax\" using GE.sat_\\<Phi>[OF \\<xi>] unfolding gPB_def by simp\n  hence \"GE.satC \\<xi> (wax \\<sigma>)\" unfolding Wax_def GE.satPB_def using \\<sigma> by auto\n  thus ?thesis unfolding satC_def wax_def by simp\nqed\n\nlemma NE_intT_forget: \"NE (intT \\<sigma>)\"\nproof-\n  obtain a where a: \"eintT \\<sigma> a\" using GE.NE_intT by blast\n  show ?thesis proof(cases \"unprot \\<sigma>\")\n    case True thus ?thesis using a unfolding intT_def by auto\n  next\n    case False note unprot = False show ?thesis proof(cases \"isRes \\<sigma>\")\n      case True then obtain f where f: \"wtFsym f\" and \\<sigma>: \"\\<sigma> = resOf f\"\n      unfolding isRes_def by auto\n      def al \\<equiv> \"map pickT (arOf f)\"  have al: \"list_all2 eintT (arOf f) al\"\n      unfolding al_def list_all2_map2 unfolding list_all2_length by auto\n      def a \\<equiv> \"intF f al\"\n      have a: \"eintT \\<sigma> a\" unfolding a_def \\<sigma> intF_def using f al\n      by (metis GE_arOf.simps GE_resOf.simps GE_wtFsym.simps GE.intF)\n      show ?thesis proof (cases \"protCl \\<sigma>\")\n        case True def a \\<equiv> \"eintF (Wit \\<sigma>) []\"\n        have \"eintT \\<sigma> a\" unfolding a_def\n        by (metis True GE_arOf.simps GE_resOf.simps GE_wtFsym.simps intF list_all2_Nil)\n        moreover have \"eintP (Guard \\<sigma>) [a]\"\n        unfolding a_def using GE_Wit[OF unprot] True by simp\n        ultimately show ?thesis using unprot unfolding intT_def by auto\n      next\n        case False\n        hence \"eintP (Guard \\<sigma>) [a]\"\n        using unprot GE_Guard_not_unprot_protCl[OF f _ _ al] unfolding \\<sigma> a_def by simp\n        thus ?thesis using unprot a unfolding intT_def by auto\n      qed\n    next\n      case False def a \\<equiv> \"eintF (Wit \\<sigma>) []\"\n      have \"eintT \\<sigma> a\" unfolding a_def\n      by (metis False GE_arOf.simps GE_resOf.simps GE_wtFsym.simps intF list_all2_Nil)\n      moreover have \"eintP (Guard \\<sigma>) [a]\"\n      unfolding a_def using GE_Wit[OF unprot] False by simp\n      ultimately show ?thesis using unprot unfolding intT_def by auto\n    qed\n  qed\nqed\n\nlemma wt_intF:\nassumes f: \"wtFsym f\" and al: \"list_all2 intT (arOf f) al\"\nshows \"intT (resOf f) (intF f al)\"\nproof-\n  have 0: \"list_all2 eintT (arOf f) al\"\n  using al unfolding intT_def[abs_def] list_all2_length by metis\n  hence \"eintT (resOf f) (eintF (Oldf f) al)\"\n  by (metis GE_arOf.simps GE_resOf.simps GE_wtFsym.simps f al GE.intF)\n  hence 1: \"eintT (resOf f) (intF f al)\" unfolding intF_def by simp\n  show ?thesis  proof(cases \"unprot (resOf f)\")\n    case True thus ?thesis unfolding intT_def by (simp add: 1)\n  next\n    case False note unprot = False\n    have \"eintP (Guard (resOf f)) [intF f al]\"\n    proof(cases \"protCl (resOf f)\")\n      case False show ?thesis using GE_Guard_not_unprot_protCl[OF f unprot False 0] .\n    next\n      case True\n      hence \"list_all protCl (arOf f)\" using protCl_fsym by simp\n      hence \"list_all (\\<lambda> \\<sigma>. \\<not> unprot \\<sigma>) (arOf f)\"\n      unfolding list_all_length unprot_def by auto\n      hence 2: \"list_all2 (eintP \\<circ> Guard) (arOf f) (map singl al)\"\n      using al unfolding intT_def[abs_def] list_all2_length list_all_length\n      singl_def[abs_def] by auto\n      show ?thesis using GE_Guard_protCl[OF f True 0 2] .\n    qed\n    thus ?thesis using unprot unfolding intT_def by (simp add: 1)\n  qed\nqed\n\nlemma Struct: \"Struct wtFsym wtPsym arOf resOf intT intF intP\"\napply default using NE_intT_forget wt_intF by auto\n\nend (* context ProblemIkTpartG_GEModel *)\n\nsublocale ProblemIkTpartG_GEModel < Ik : Struct\nwhere intT = intT and intF = intF and intP = intP\nusing Struct .\n\n\ncontext ProblemIkTpartG_GEModel begin\n\nlemma wtE[simp]: \"Ik.wtE \\<xi> \\<Longrightarrow> GE.wtE \\<xi>\"\nunfolding Ik.wtE_def GE.wtE_def intT_def by metis\n\nlemma int_g[simp]: \"GE.int \\<xi> (gT T) = Ik.int \\<xi> T\"\nproof (induct T)\n  case (Fn f Tl)\n  let ?ar = \"arOf f\" let ?r = \"resOf f\"\n  have 0: \"map (Ik.int \\<xi>) Tl = map (GE.int \\<xi> \\<circ> gT) Tl\"\n  apply(rule nth_equalityI) using Fn unfolding list_all_length by auto\n  show ?case\n  unfolding Ik.int.simps GE.int.simps gT.simps unfolding intF_def\n  using Fn by (simp add: 0)\nqed auto\n\nlemma map_int_g[simp]:\n\"map (Ik.int \\<xi>) Tl = map (GE.int \\<xi> \\<circ> gT) Tl\"\napply(rule nth_equalityI) unfolding list_all_length by auto\n\nlemma satA_gA[simp]: \"GE.satA \\<xi> (gA at) \\<longleftrightarrow> Ik.satA \\<xi> at\"\nusing assms by (cases at) (auto simp add: intP_def)\n\nlemma satL_gL[simp]: \"GE.satL \\<xi> (gL l) \\<longleftrightarrow> Ik.satL \\<xi> l\"\nusing assms apply(cases l) by auto\n\nlemma satC_map_gL[simp]: \"GE.satC \\<xi> (map gL c) \\<longleftrightarrow> Ik.satC \\<xi> c\"\nunfolding GE.satC_def Ik.satC_def using assms by (induct c, auto)\n\nlemma wtE_not_grdLit_unprot[simp]: (* crucial: *)\nassumes \"Ik.wtE \\<xi>\" and \"\\<not> unprot (tpOfV x)\"\nshows \"\\<not> GE.satL \\<xi> (grdLit x)\"\nusing assms unfolding Ik.wtE_def intT_def grdLit_def by simp\n\nlemma wtE_not_grdLit[simp]:\nassumes \"Ik.wtE \\<xi>\" and \"prot (tpOfV x) \\<or> protFw (tpOfV x)\"\nshows \"\\<not> GE.satL \\<xi> (grdLit x)\"\napply(rule wtE_not_grdLit_unprot) using assms unfolding unprot_def by auto\n\nlemma wtE_not_glitOfL[simp]:\nassumes \"Ik.wtE \\<xi>\"\nshows \"\\<not> GE.satC \\<xi> (list (glitOfL l))\"\nusing assms unfolding GE.satC_def list_ex_list[OF finite_glitOfL]\nby (cases l, auto)\n\nlemma wtE_not_glitOfC[simp]:\nassumes \"Ik.wtE \\<xi>\"\nshows \"\\<not> GE.satC \\<xi> (list (glitOfC c))\"\nusing wtE_not_glitOfL[OF assms]\nunfolding GE.satC_def list_ex_list[OF finite_glitOfC] list_ex_list[OF finite_glitOfL]\nunfolding glitOfC_def by auto\n\nlemma satC_gC[simp]:\nassumes \"Ik.wtE \\<xi>\" and \"GE.satC \\<xi> (gC c)\"\nshows \"Ik.satC \\<xi> c\"\nusing assms unfolding gC_def by simp\n\nlemma satPB_gPB[simp]:\nassumes \"Ik.wtE \\<xi>\" and \"GE.satPB \\<xi> (gC ` \\<Phi>)\"\nshows \"Ik.satPB \\<xi> \\<Phi>\"\nusing Ik.wt_\\<Phi> assms unfolding GE.satPB_def Ik.satPB_def by (auto simp add: Ik.wtPB_def)\n\nlemma completeness: \"Ik.SAT \\<Phi>\"\nunfolding Ik.SAT_def proof safe\n  fix \\<xi> assume \\<xi>: \"Ik.wtE \\<xi>\" hence \"GE.wtE \\<xi>\" by simp\n  hence \"GE.satPB \\<xi> gPB\" by (rule GE.sat_\\<Phi>)\n  hence \"GE.satPB \\<xi> (gC ` \\<Phi>)\" unfolding gPB_def by simp\n  thus \"Ik.satPB \\<xi> \\<Phi>\" using \\<xi> by simp\nqed\n\nlemma G_completeness: \"Model wtFsym wtPsym arOf resOf parOf \\<Phi> intT intF intP\"\napply default using completeness .\n\nend (* context ProblemIkTpartG_GEModel *)\n\n(* Completeness theorem in sublocale form: Given a problem (with indicated\ntype partition) and a model for its guard-translated problem,\nwe obtain a model of the original problem: *)\n\nsublocale ProblemIkTpartG_GEModel < Ik : Model\nwhere intT = intT and intF = intF and intP = intP\nusing G_completeness .\n\n\nsubsection{* The result of the guard translation is an infiniteness-augmented problem *}\n\n(* An observation similar to the corresponding one for tags applies here.  *)\n\nsublocale ProblemIkTpartG < GE : Problem\nwhere wtFsym = GE_wtFsym and wtPsym = GE_wtPsym\nand arOf = GE_arOf and resOf = GE_resOf and parOf = GE_parOf\nand \\<Phi> = gPB\napply default by auto\n\nsublocale ProblemIkTpartG < GE : ProblemIk\nwhere wtFsym = GE_wtFsym and wtPsym = GE_wtPsym\nand arOf = GE_arOf and resOf = GE_resOf and parOf = GE_parOf\nand \\<Phi> = gPB\nproof default\n  fix \\<sigma> eintT eintF eintP a  assume \\<sigma>: \"infTp \\<sigma>\"\n  assume M: \"Model GE_wtFsym GE_wtPsym GE_arOf GE_resOf GE_parOf gPB eintT eintF eintP\"\n  let ?GE_intT = \"ProblemIkTpartG_GEModel.intT prot protFw eintT eintP\"\n  let ?GE_intF = \"ProblemIkTpartG_GEModel.intF eintF\"\n  let ?GE_intP = \"ProblemIkTpartG_GEModel.intP eintP\"\n  have 0: \"ProblemIkTpartG_GEModel wtFsym wtPsym arOf resOf parOf\n                                   \\<Phi> infTp prot protFw protCl eintT eintF eintP\"\n  using M unfolding ProblemIkTpartG_GEModel_def apply safe by default\n  hence MM: \"Ik.MModel ?GE_intT ?GE_intF ?GE_intP\"\n  by (rule ProblemIkTpartG_GEModel.G_completeness)\n  have \"infinite {a. ?GE_intT \\<sigma> a}\" using infTp[OF \\<sigma> MM] .\n  moreover have \"{a. ?GE_intT \\<sigma> a} \\<subseteq> {a. eintT \\<sigma> a}\"\n  using ProblemIkTpartG_GEModel.intT_def[OF 0] by auto\n  ultimately show \"infinite {a. eintT \\<sigma> a}\" using infinite_super by blast\nqed\n\n\nsubsection{* The verification of the second monotonicity calculus criterion\nfor the guarded problem  *}\n\ncontext ProblemIkTpartG begin\n\nfun pol where\n\"pol _ (Oldp p) = Cext\"\n|\n\"pol _ (Guard \\<sigma>) = Fext\"\n\nlemma pol_ct: \"pol \\<sigma>1 p = pol \\<sigma>2 p\"\nby(cases p, auto)\n\ndefinition \"grdOf c l x = grdLit x\"\nend\n\nsublocale ProblemIkTpartG < GE: ProblemIkPol\nwhere wtFsym = GE_wtFsym and wtPsym = GE_wtPsym\nand arOf = GE_arOf and resOf = GE_resOf and parOf = GE_parOf\nand \\<Phi> = gPB and pol = pol and grdOf = grdOf by default\n\ncontext ProblemIkTpartG begin\n\nlemma nv2_nv[simp]: \"GE.nv2T (gT T) = GE.nvT T\"\napply (induct T) by auto\n\nlemma nv2L_nvL[simp]: \"GE.nv2L (gL l) = GE.nvL l\"\nproof(cases l)\n  case (Pos at) thus ?thesis by (cases at, simp_all)\nnext\n  case (Neg at) thus ?thesis by (cases at, auto)\nqed\n\nlemma nv2L:\nassumes \"l \\<in> set c\" and mc: \"GE.mcalc \\<sigma> c\"\nshows \"infTp \\<sigma> \\<or> (\\<forall> x \\<in> GE.nv2L (gL l). tpOfV x \\<noteq> \\<sigma>)\"\nusing assms mc nv2L_nvL unfolding GE.mcalc_iff GE.nvC_def apply simp\nusing nv2L_nvL[of l]\nby (metis empty_subsetI equalityI nv2L_nvL)\n\n(* The guarding literals are guarded: *)\nlemma isGuard_grdLit[simp]: \"GE.isGuard x (grdLit x)\"\nunfolding grdLit_def by auto\n\nlemma nv2L_grdLit[simp]: \"GE.nv2L (grdLit x) = {}\"\nunfolding grdLit_def by auto\n\nlemma mcalc_mcalc2: \"GE.mcalc \\<sigma> c \\<Longrightarrow> GE.mcalc2 \\<sigma> (gC c)\"\nusing nv2L unfolding GE.mcalc2_iff gC_def glitOfC_def grdOf_def by auto\n\nlemma nv2L_wax[simp]: \"l' \\<in> set (wax \\<sigma>) \\<Longrightarrow> GE.nv2L l' = {}\"\nunfolding wax_def by auto\n\nlemma nv2L_Wax:\nassumes \"c' \\<in> Wax\" and \"l' \\<in> set c'\"\nshows \"GE.nv2L l' = {}\"\nusing assms unfolding Wax_def by auto\n\nlemma nv2L_cOfFax[simp]: \"GE.nv2L (Pos (cOfFax \\<sigma>)) = {}\"\nunfolding cOfFax_def by auto\n\nlemma nv2L_hOfFax[simp]:\nassumes \"at \\<in> set (hOfFax \\<sigma>)\"\nshows \"GE.nv2L (Neg at) = {}\"\nusing assms unfolding hOfFax_def map2_def by auto\n\nlemma nv2L_fax[simp]: \"l \\<in> set (fax \\<sigma>) \\<Longrightarrow> GE.nv2L l = {}\"\nunfolding fax_def by auto\n\nlemma nv2L_faxCD[simp]: \"l \\<in> set (faxCD \\<sigma>) \\<Longrightarrow> GE.nv2L l = {}\"\nunfolding faxCD_def by auto\n\nlemma nv2L_Fax:\nassumes \"c' \\<in> Fax\" and \"l' \\<in> set c'\"\nshows \"GE.nv2L l' = {}\"\nusing assms unfolding Fax_def by auto\n\n\n\nlemma mcalc2:\nassumes c': \"c' \\<in> gPB\"\nshows \"GE.mcalc2 \\<sigma> c'\"\nproof(cases \"c' \\<in> Fax \\<union> Wax\")\n  case True thus ?thesis using nv2L_Wax nv2L_Fax\n  unfolding GE.mcalc2_iff by fastforce\nnext\n  case False hence c': \"c' \\<in> gPB\" using c' unfolding gPB_def by auto\n  show ?thesis unfolding GE.mcalc2_iff using grdOf[OF c'] by auto\nqed\n\n\nend (* context ProblemIkTpartG *)\n\n\nsublocale ProblemIkTpartG < GE: ProblemIkPolMcalc2C\nwhere wtFsym = GE_wtFsym and wtPsym = GE_wtPsym\nand arOf = GE_arOf and resOf = GE_resOf and parOf = GE_parOf\nand \\<Phi> = gPB and pol = pol and grdOf = grdOf\napply default using grdOf mcalc2 by (auto simp: pol_ct)\n\n(* We already know that ProblemIkMcalc < MonotProblem, so by transitivity we obtain\nthe following main theorem, stating that the guard translation yields a monotonic\nproblem *)\n\ncontext ProblemIkTpartG begin\n\ntheorem G_monotonic:\n\"MonotProblem GE_wtFsym GE_wtPsym GE_arOf GE_resOf GE_parOf gPB\"\nby default\n\nend (* context ProblemIkTpartG *)\n\n\n(* Also in sublocale form: *)\n\nsublocale ProblemIkTpartG < GE: MonotProblem\nwhere wtFsym = GE_wtFsym and wtPsym = GE_wtPsym\nand arOf = GE_arOf and resOf = GE_resOf and parOf = GE_parOf\nand \\<Phi> = gPB\nusing G_monotonic .\n\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Sort_Encodings/G.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6584175139669997, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3369231747249504}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2005         |\n            |               February 2006               |\n            |                  April 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                  May 2016  (modified)     |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory FNF_F_nf_def\nimports CSP_F_Main\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*  The following simplification rules are deleted in this theory file *)\n(*       P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y))        *)\n\ndeclare split_if  [split del]\n\n(*****************************************************************\n\n         1. definition of full normalisation\n         2. \n         3. \n\n *****************************************************************)\n\n(*----------------------------------------------------------------------*\n |                         full normal form                             |\n *----------------------------------------------------------------------*)\n\ndefinition\n  fnfF_set_condition  :: \"'a set => 'a set set => bool\"\n  where\n  fnfF_set_condition_def :\n   \"fnfF_set_condition A Ys == \n    (ALL Y. ((EX Y0:Ys. Y0 <= Y) & Y <= A Un Union Ys) --> Y:Ys)\"\n  \ndefinition  \n  fnfF_set_completion :: \"'a set => 'a set set => 'a set set\"\n  where\n  fnfF_set_completion_def :\n   \"fnfF_set_completion A Ys == {Y. (EX Y0:Ys. Y0 <= Y) & Y <= (A Un Union Ys)}\"\n\n   \n(* Isabelle 2005\nconsts\n  fnfF_proc      :: \"('p,'a) proc set\"\n\ninductive \"fnfF_proc\"\nintros\nfnfF_proc_rule:\n  \"[| (ALL a. if a:A then Pf a : fnfF_proc else Pf a = DIV) ;\n      fnfF_set_condition A Ys ; Union Ys <= A ;\n      Q = SKIP | Q = DIV |]\n   ==> ((? :A -> Pf) [+] Q) |~| (!set Y:Ys .. (? a:Y -> DIV))\n        : fnfF_proc\"\n*)\n\ninductive_set\n  fnfF_proc      :: \"('p,'a) proc set\"\nwhere\nfnfF_proc_rule:\n  \"[| (ALL a. if a:A then Pf a : fnfF_proc else Pf a = DIV) ;\n      fnfF_set_condition A Ys ; Union Ys <= A ;\n      Q = SKIP | Q = DIV |]\n   ==> ((? :A -> Pf) [+] Q) |~| (!set Y:Ys .. (? a:Y -> DIV))\n        : fnfF_proc\"\n\n(* .elims ---> .cases *)\n\n\ndefinition  \n  XfnfF_proc           :: \"('p,'a) proc set\"\n  where\n  XfnfF_proc_def :\n   \"XfnfF_proc == {!nat n .. Pf n |Pf.\n                  (ALL n. Pf n =F (!nat n .. Pf n) |. n) &\n                  (ALL n. Pf n : fnfF_proc) }\"\n\n(*** convenient lemmas ***)\n\nlemma fnfF_set_completion_sat_condition[simp]:\n  \"fnfF_set_condition A (fnfF_set_completion A Ys)\"\napply (simp add: fnfF_set_condition_def)\napply (intro allI impI)\napply (elim conjE bexE)\n\napply (simp add: fnfF_set_completion_def)\napply (elim conjE bexE)\napply (rule conjI)\napply (rule_tac x=\"Y0a\" in bexI)\napply (simp)\napply (simp)\n\napply (rule subsetI)\napply (erule subsetE)\napply (drule_tac x=\"x\" in bspec, simp)\napply (simp)\napply (elim disjE conjE exE bexE)\napply (simp)\n\napply (rotate_tac 5)\napply (erule subsetE)\napply (simp)\ndone\n\nlemma fnfF_set_completion_subset:\n  \"Ys <= fnfF_set_completion A Ys\"\nby (auto simp add: fnfF_set_completion_def)\n\nlemma fnfF_set_completion_Union_subset:\n  \"Union Ys <= A ==>\n   Union (fnfF_set_completion A Ys) <= A\"\napply (auto simp add: fnfF_set_completion_def)\napply (subgoal_tac \"x : A Un Union Ys\")\napply (simp)\napply (erule disjE)\napply (auto)\ndone\n\n(*----------------------------------------------------------*\n |                   intro, elim, simp                      |\n *----------------------------------------------------------*)\n\nlemma fnfF_proc_iff:\n  \"(NP : fnfF_proc) = \n     (EX A Ys Pf Q.\n      NP = ((? :A -> Pf) [+] Q) |~| (!set Y:Ys .. (? a:Y -> DIV)) &\n      (ALL a. if a:A then Pf a : fnfF_proc else Pf a = DIV) &\n       fnfF_set_condition A Ys & Union Ys <= A &\n       (Q = SKIP | Q = DIV))\"\napply (rule iffI)\n\n(* => *)\n(* apply (erule fnfF_proc.elims) *)\n apply (erule fnfF_proc.cases)\n apply (force)\n\n(* <= *)\n apply (elim conjE exE)\n apply (simp add: fnfF_proc.intros)\ndone\n\nlemma fnfF_proc_EX_I:\n     \"(EX A Ys Pf Q.\n      NP = ((? :A -> Pf) [+] Q) |~| (!set Y:Ys .. (? a:Y -> DIV)) &\n      (ALL a. if a:A then Pf a : fnfF_proc else Pf a = DIV) &\n       fnfF_set_condition A Ys & Union Ys <= A &\n       (Q = SKIP | Q = DIV))\n    ==> NP : fnfF_proc\"\napply (simp add: fnfF_proc_iff[of NP])\ndone\n\nlemma fnfF_proc_EX_E:\n  \"[| NP : fnfF_proc ;\n     (EX A Ys Pf Q.\n      NP = ((? :A -> Pf) [+] Q) |~| (!set Y:Ys .. (? a:Y -> DIV)) &\n      (ALL a. if a:A then Pf a : fnfF_proc else Pf a = DIV) &\n       fnfF_set_condition A Ys & Union Ys <= A &\n       (Q = SKIP | Q = DIV))\n      ==> S |]\n    ==> S\"\napply (simp add: fnfF_proc_iff[of NP])\ndone\n\n(*----------------------------------------------------------*\n |                 ALL fnfF_proc_iff                   |\n *----------------------------------------------------------*)\n\nlemma ALL_fnfF_proc_only_if:\n  \"ALL x:X. NPf x : fnfF_proc\n   ==>\n     (EX Af Ysf Pff Qf.\n      NPf = (%x. if x:X then (((? :(Af x) -> (Pff x)) [+] Qf x) |~| \n                             (!set Y:(Ysf x) .. (? a:Y -> DIV)))\n                        else NPf x) &\n      (ALL x:X. ALL a. if a:(Af x) then (Pff x a) : fnfF_proc \n                       else (Pff x a) = DIV) &\n      (ALL x:X. fnfF_set_condition (Af x) (Ysf x)) &\n      (ALL x:X. Union (Ysf x) <= Af x) &\n      (ALL x:X. Qf x = SKIP | Qf x = DIV))\"\napply (simp add: fnfF_proc_iff)\napply (simp add: choice_BALL_EX)\napply (elim exE)\napply (rule_tac x=\"f\" in exI)\napply (rule_tac x=\"fa\" in exI)\napply (rule_tac x=\"fb\" in exI)\napply (rule_tac x=\"fc\" in exI)\n\n(* NPf *)\napply (rule conjI)\napply (simp add: fun_eq_iff)\napply (rule allI)\napply (case_tac \"x:X\")\napply (simp_all)\n\napply (intro allI ballI)\napply (drule_tac x=\"x\" in bspec, simp)\napply (elim conjE)\napply (drule_tac x=\"a\" in spec)\napply (simp)\ndone\n\nlemma ALL_fnfF_proc_iff:\n  \"(ALL x:X. NPf x : fnfF_proc)\n   =\n     (EX Af Ysf Pff Qf.\n      NPf = (%x. if x:X then (((? :(Af x) -> (Pff x)) [+] Qf x) |~| \n                             (!set Y:(Ysf x) .. (? a:Y -> DIV)))\n                        else NPf x) &\n      (ALL x:X. ALL a. if a:(Af x) then (Pff x a) : fnfF_proc \n                       else (Pff x a) = DIV) &\n      (ALL x:X. fnfF_set_condition (Af x) (Ysf x)) &\n      (ALL x:X. Union (Ysf x) <= Af x) &\n      (ALL x:X. Qf x = SKIP | Qf x = DIV))\"\napply (rule)\napply (simp add: ALL_fnfF_proc_only_if)\n\napply (elim conjE exE)\napply (intro ballI)\napply (simp add: fun_eq_iff)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in bspec, simp)+\napply (simp)\napply (simp add: fnfF_proc.intros)\ndone\n\nlemma ALL_fnfF_procI:\n  \"(EX Af Ysf Pff Qf.\n      NPf = (%x. if x:X then (((? :(Af x) -> (Pff x)) [+] Qf x) |~| \n                             (!set Y:(Ysf x) .. (? a:Y -> DIV)))\n                        else NPf x) &\n      (ALL x:X. ALL a. if a:(Af x) then (Pff x a) : fnfF_proc \n                       else (Pff x a) = DIV) &\n      (ALL x:X. fnfF_set_condition (Af x) (Ysf x)) &\n      (ALL x:X. Union (Ysf x) <= Af x) &\n      (ALL x:X. Qf x = SKIP | Qf x = DIV))\n   ==> ALL x:X. NPf x : fnfF_proc\"\napply (simp add: ALL_fnfF_proc_iff)\ndone\n\nlemma ALL_fnfF_procE:\n  \"[| ALL x:X. NPf x : fnfF_proc ;\n      (EX Af Ysf Pff Qf.\n      NPf = (%x. if x:X then (((? :(Af x) -> (Pff x)) [+] Qf x) |~| \n                             (!set Y:(Ysf x) .. (? a:Y -> DIV)))\n                        else NPf x) &\n      (ALL x:X. ALL a. if a:(Af x) then (Pff x a) : fnfF_proc \n                       else (Pff x a) = DIV) &\n      (ALL x:X. fnfF_set_condition (Af x) (Ysf x)) &\n      (ALL x:X. Union (Ysf x) <= Af x) &\n      (ALL x:X. Qf x = SKIP | Qf x = DIV))\n   ==> S |] ==> S\"\napply (simp add: ALL_fnfF_proc_iff)\ndone\n\n(*======================================================*\n |         function to decompose : fnfF_decompo         |\n *======================================================*)\n(* \nisabelle 2011\n\nconsts\n  fnfF_A ::\n     \"('p,'a) proc => ('a set)\"\n  fnfF_Ys ::\n     \"('p,'a) proc => ('a set set)\"\n  fnfF_Pf ::\n     \"('p,'a) proc => ('a => ('p,'a) proc)\"\n  fnfF_Q ::\n     \"('p,'a) proc => ('p,'a) proc\"\n\n(* they are partial functions *)\n\nrecdef fnfF_A \"{}\"\n  \"fnfF_A (((? :A -> Pf) [+] Q) |~| R) = A\"\n\nrecdef fnfF_Ys \"{}\"\n  \"fnfF_Ys (P |~| !! : type1 Ys .. Pf) = Ys\"\n\nrecdef fnfF_Pf \"{}\"\n  \"fnfF_Pf (((? :A -> Pf) [+] Q) |~| R) = Pf\"\n\nrecdef fnfF_Q \"{}\"\n  \"fnfF_Q (((? :A -> Pf) [+] Q) |~| R) = Q\"\n*)\n\n(* they are partial functions *)\n\nfun\n  fnfF_A ::\n     \"('p,'a) proc => ('a set)\"\nwhere\n  \"fnfF_A (((? :A -> Pf) [+] Q) |~| R) = A\"\n\nfun\n  fnfF_Ys ::\n     \"('p,'a) proc => ('a set set)\"\nwhere\n  \"fnfF_Ys (P |~| !! : type1 Ys .. Pf) = Ys\"\n\nfun\n  fnfF_Pf ::\n     \"('p,'a) proc => ('a => ('p,'a) proc)\"\nwhere\n  \"fnfF_Pf (((? :A -> Pf) [+] Q) |~| R) = Pf\"\n\nfun\n  fnfF_Q ::\n     \"('p,'a) proc => ('p,'a) proc\"\nwhere\n  \"fnfF_Q (((? :A -> Pf) [+] Q) |~| R) = Q\"\n\nlemma fnfF_Ys_get[simp]:\n  \"fnfF_Ys (P |~| !set :Ys .. Pf) = Ys\"\nby (simp add: Rep_int_choice_ss_def)\n\n(*------------------------*\n |     decomposition      |\n *------------------------*)\n\nlemma cspF_fnfF_nat_decompo:\n   \"P : fnfF_proc ==>\n    P =F ((? : (fnfF_A P) -> (fnfF_Pf P)) [+] fnfF_Q P) \n         |~| (!set Y: fnfF_Ys P .. (? a:Y -> DIV))\"\n(* apply (erule fnfF_proc.elims) *)\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\n(*--------------------------------------*\n |   properties of fnfF decomposition   |\n *--------------------------------------*)\n\nlemma fnfF_Pf_A:\n   \"[| P : fnfF_proc ; a : (fnfF_A P) |]\n    ==> (fnfF_Pf P) a : fnfF_proc\"\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\nlemma fnfF_Pf_DIV:\n   \"[| P : fnfF_proc ; a ~: (fnfF_A P) |]\n    ==> (fnfF_Pf P) a = DIV\"\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\nlemma fnfF_Q_range:\n   \"P : fnfF_proc\n    ==> (fnfF_Q P) = SKIP | (fnfF_Q P) = DIV\"\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\nlemma fnfF_condition_A_Ys:\n   \"P : fnfF_proc ==>\n    fnfF_set_condition (fnfF_A P) (fnfF_Ys P)\"\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\nlemma fnfF_Union_Ys_A:\n   \"P : fnfF_proc ==>\n    Union (fnfF_Ys P)  <= (fnfF_A P)\"\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\n(*-----------------------*\n |    DIV, SKIP, STOP    |\n *-----------------------*)\n\ndefinition\n  NSKIP     :: \"('p,'a) proc\"\n  where\n  NSKIP_def : \"NSKIP == ((? a:{} -> DIV) [+] SKIP) |~| (!set Y:{} .. (? a:Y -> DIV))\"\n  \ndefinition\n  NDIV      :: \"('p,'a) proc\"\n  where\n  NDIV_def  : \"NDIV  == ((? a:{} -> DIV) [+] DIV)  |~| (!set Y:{} .. (? a:Y -> DIV))\"\n\ndefinition  \n  NSTOP     :: \"('p,'a) proc\"\n  where\n  NSTOP_def : \"NSTOP == ((? a:{} -> DIV) [+] DIV)  |~| (!set Y:{{}} .. (? a:Y -> DIV))\"\n\n(*** in fnfF ***)\n\nlemma fnfF_NSKIP[simp]: \"NSKIP : fnfF_proc\"\napply (simp add: NSKIP_def)\napply (rule fnfF_proc.intros)\napply (simp_all add: fnfF_set_condition_def)\ndone\n\nlemma fnfF_NDIV[simp]: \"NDIV : fnfF_proc\"\napply (simp add: NDIV_def)\napply (rule fnfF_proc.intros)\napply (simp_all add: fnfF_set_condition_def)\ndone\n\nlemma fnfF_NSTOP[simp]: \"NSTOP : fnfF_proc\"\napply (simp add: NSTOP_def)\napply (rule fnfF_proc.intros)\napply (simp_all add: fnfF_set_condition_def)\ndone\n\n(*** eqF ***)\n\nlemma cspF_NSKIP_eqF: \"SKIP =F NSKIP\"\napply (simp add: NSKIP_def)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (rule cspF_choice_rule)\napply (rule cspF_Rep_int_choice_DIV)\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_reflex)\ndone\n\nlemma cspF_NDIV_eqF: \"DIV =F NDIV\"\napply (simp add: NDIV_def)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (rule cspF_choice_rule)\napply (rule cspF_Rep_int_choice_DIV)\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_reflex)\ndone\n\nlemma cspF_NSTOP_eqF: \"STOP =F NSTOP\"\napply (simp add: NSTOP_def)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (rule cspF_choice_rule)\napply (rule cspF_Rep_int_choice_singleton)\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_step)\ndone\n\n(*==============================================================*\n |               convenient rules for fnfF                      |\n *==============================================================*)\n\nlemma cspF_fnfF_Depth_rest_dist:\n  \"Q = SKIP | Q = DIV ==>\n   (? :A -> Pf [+] Q\n   |~| !set Y:Ys .. ? a:Y -> DIV) |. Suc n\n  =F \n   (? a:A -> (Pf a |. n) [+] Q\n   |~| !set Y:Ys .. ? a:Y -> DIV)\"\napply (rule cspF_rw_left)\napply (rule cspF_dist)\napply (rule cspF_decompo)\napply (rule cspF_rw_left)\napply (rule cspF_Ext_dist)\napply (rule cspF_decompo)\napply (rule cspF_rw_left)\napply (rule cspF_step)\napply (rule cspF_reflex)\napply (erule disjE)\napply (simp_all)\n\napply (rule cspF_rw_left)\napply (rule cspF_Dist)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_step)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_DIV_Depth_rest)\ndone\n\n(* left DIV *)\n\nlemma cspF_fsfF_left_DIV:\n  \"(? a:{} -> DIV [+] DIV) |~| P =F P\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_Ext_choice_rule)\napply (rule cspF_reflex)\napply (rule cspF_unit)\ndone\n\nlemma cspF_fsfF_right_DIV:\n  \"P |~| (!set :{} .. Pf) =F P\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_reflex)\napply (rule cspF_Rep_int_choice_DIV)\napply (rule cspF_unit)\ndone\n\n(****************** to add them again ******************)\n\ndeclare split_if    [split]\ndeclare disj_not1   [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/FNF_F/FNF_F_nf_def.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6584174871563662, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.33692316100550407}}
{"text": "section {* Host Properties *}\n\ntheory Wasm_Axioms imports Wasm begin\n\n(* these were originally axioms, but memory now has a concrete representation in the model *)\nlemma mem_grow_size:\n  assumes \"mem_grow m n = m'\"\n  shows \"(mem_size m + (64000 * n)) = mem_size m'\"\n  using assms Abs_mem_inverse Abs_bytes_inverse\n  unfolding mem_grow_def mem_size_def mem_append_def bytes_replicate_def\n  by auto\n\nlemma load_size:\n  \"(load m n off l = None) = (mem_size m < (off + n + l))\"\n  unfolding load_def\n  by (cases \"n + off + l \\<le> mem_size m\") auto\n\nlemma load_packed_size:\n  \"(load_packed sx m n off lp l = None) = (mem_size m < (off + n + lp))\"\n  using load_size\n  unfolding load_packed_def\n  by (cases \"n + off + l \\<le> mem_size m\") auto  \n\nlemma store_size1:\n  \"(store m n off v l = None) = (mem_size m < (off + n + l))\"\n  unfolding store_def\n  by (cases \"n + off + l \\<le> mem_size m\") auto\n\nlemma store_size:\n  assumes \"(store m n off v l = Some m')\"\n  shows \"mem_size m = mem_size m'\"\n  using assms Abs_mem_inverse Abs_bytes_inverse\n  unfolding store_def write_bytes_def bytes_takefill_def\n  by (cases \"n + off + l \\<le> mem_size m\") (auto simp add: mem_size_def)\n\nlemma store_packed_size1:\n  \"(store_packed m n off v l = None) = (mem_size m < (off + n + l))\"\n  using store_size1\n  unfolding store_packed_def\n  by simp\n\nlemma store_packed_size:\n  assumes \"(store_packed m n off v l = Some m')\"\n  shows \"mem_size m = mem_size m'\"\n  using assms store_size\n  unfolding store_packed_def\n  by simp\n\naxiomatization where\n  wasm_deserialise_type:\"typeof (wasm_deserialise bs t) = t\"\n\naxiomatization where\n    host_apply_preserve_store:\" list_all2 types_agree t1s vs \\<Longrightarrow> host_apply s (t1s _> t2s) f vs hs = Some (s', vs') \\<Longrightarrow> store_extension s s'\"\nand host_apply_respect_type:\"list_all2 types_agree t1s vs \\<Longrightarrow> host_apply s (t1s _> t2s) f vs hs = Some (s', vs') \\<Longrightarrow> list_all2 types_agree t2s vs'\"\nand host_trust_security_Some:\"store_public_agree s s' \\<Longrightarrow> publics_agree vs vs' \\<Longrightarrow> host_apply s (t1s _> t2s) f vs hs = Some (s_a, vs_a) \\<Longrightarrow>\n                                \\<exists>s'_a vs'_a. host_apply s' (t1s _> t2s) f vs' hs' = Some (s'_a, vs'_a) \\<and>\n                                             store_public_agree s_a s'_a \\<and>\n                                             publics_agree vs_a vs'_a\"\nand host_trust_security_None:\"store_public_agree s s' \\<Longrightarrow> publics_agree vs vs' \\<Longrightarrow> host_apply s (t1s _> t2s) f vs hs = None \\<Longrightarrow>\n                                       host_apply s' (t1s _> t2s) f vs' hs' = None\"\nend", "meta": {"author": "PLSysSec", "repo": "ct-wasm-proofs", "sha": "3fa5c38ecda3d05c351096ba5e6d7ba1df793c21", "save_path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs", "path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs/ct-wasm-proofs-3fa5c38ecda3d05c351096ba5e6d7ba1df793c21/CT-WASM_model/Wasm_Axioms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7185943925708562, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.33687031558339664}}
{"text": "theory EventSystemSwitch\n  imports EventSystemSwitchScheduler EventSystemWatchdog\nbegin\n\ntext \\<open>This file combines verification of the full scheduler with switching\n  between time tables.\n\n  Both scheduler and watchdog sides have been verified independently.\n  We now combine them together using the event system.\n\\<close>\n\ncontext global_state\nbegin\n\nsubsection \\<open>Event system\\<close>\n\ndefinition tick :: \"(cstate \\<times> watchdog_chain, event, unit) event_monad\" where\n  \"tick =\n    apply_fst get_next_mode \\<bind> (\\<lambda>nmode.\n    if nmode = NEXT_TICK then\n      apply_fst (set_next_mode NEXT_WINDOW) \\<bind> (\\<lambda>_.\n      signal (WATCHDOG_REMOVE 0) \\<bind> (\\<lambda>_.\n      signal WATCHDOG_TICK \\<bind> (\\<lambda>_.\n      signal (DISPATCH 0))))\n    else\n      signal WATCHDOG_TICK)\"\n\nfun system :: \"(event, cstate \\<times> watchdog_chain) event_system\" where\n  \"system (DISPATCH 0) = Some (apply_fst dispatch_all)\"\n| \"system (WATCHDOG_ADD (ev, n)) = Some (apply_snd (watchdog_add_impl ev n))\"\n| \"system WATCHDOG_TICK = Some (apply_snd watchdog_tick_impl)\"\n| \"system (WATCHDOG_REMOVE ev) = Some (apply_snd (watchdog_remove_impl ev))\"\n| \"system TICK = Some tick\"\n| \"system _ = None\"\n\nlemma system_eval:\n  \"system (PARTITION n) = None\"\n  \"system (DISPATCH 0) = Some (apply_fst dispatch_all)\"\n  \"ev > 0 \\<Longrightarrow> system (DISPATCH ev) = None\"\n  \"system (WATCHDOG_ADD (ev, n)) = Some (apply_snd (watchdog_add_impl ev n))\"\n  \"system WATCHDOG_TICK = Some (apply_snd watchdog_tick_impl)\"\n  \"system (WATCHDOG_REMOVE ev) = Some (apply_snd (watchdog_remove_impl ev))\"\n  \"system TICK = Some tick\"\n  unfolding system.simps apply auto\n  apply (cases ev) by auto\n\nfun rel_total :: \"astate_scheduler \\<times> astate_watchdog \\<Rightarrow> cstate \\<times> watchdog_chain \\<Rightarrow> bool\" where\n  \"rel_total (as, aw) p \\<longleftrightarrow> rel_scheduler as (fst p) \\<and> rel_watchdog aw (snd p)\"\ndeclare rel_total.simps[simp del]\n\nlemma get_next_mode_sp:\n  \"\\<lbrace>\\<lambda>s es. rel_scheduler as s \\<and> nil\\<^sub>e es\\<rbrace>\n    get_next_mode\n   \\<lbrace>\\<lambda>r s es. r = astate_scheduler.next_mode as \\<and> rel_scheduler as s \\<and> nil\\<^sub>e es\\<rbrace>!\"\n  apply wp by (auto simp add: rel_scheduler_def rel_def)\n\nlemma set_next_mode_sp:\n  \"\\<lbrace>\\<lambda>s es. rel_scheduler as s \\<and> nil\\<^sub>e es\\<rbrace>\n    set_next_mode mode\n   \\<lbrace>\\<lambda>_ s es. rel_scheduler (as\\<lparr>astate_scheduler.next_mode := mode\\<rparr>) s \\<and> nil\\<^sub>e es\\<rbrace>!\"\n  apply wp apply (auto simp add: rel_scheduler_def rel_def ainv_def cur_ttbl_def)\n  by (auto simp add: cinv_def c_cur_ttbl_def)\n\nlemma tick_rule1:\n  assumes \"astate_scheduler.next_mode as = NEXT_TICK\"\n  shows\n  \"\\<lbrace> \\<lambda>p es. rel_total (as, aw) p \\<and> nil\\<^sub>e es \\<rbrace>\n     tick\n   \\<lbrace> \\<lambda>_ p es. rel_total (as\\<lparr>astate_scheduler.next_mode := NEXT_WINDOW\\<rparr>, aw) p \\<and>\n              es = [WATCHDOG_REMOVE 0, WATCHDOG_TICK, DISPATCH 0] \\<rbrace>!\"\n  unfolding tick_def\n  apply (rule validNF_bind)\n   apply (simp add: rel_total.simps)\n  apply (rule validNF_weaken_pre[where Q=\"\\<lambda>p es. (rel_scheduler as (fst p) \\<and> nil\\<^sub>e es) \\<and> rel_watchdog aw (snd p)\"])\n    apply (rule validNF_apply_fst)\n    apply (rule get_next_mode_sp)\n  subgoal by auto\n  subgoal for nmode\n    apply (rule validNF_weaken_pre)\n     apply (rule validNF_if_split[where Q=\"\\<lambda>p es. rel_total (as, aw) p \\<and> nil\\<^sub>e es\"])\n      apply (rule validNF_bind)\n       apply (rule validNF_weaken_pre[where Q=\"\\<lambda>p es. (rel_scheduler as (fst p) \\<and> nil\\<^sub>e es) \\<and> rel_watchdog aw (snd p)\"])\n        apply (rule validNF_apply_fst[OF set_next_mode_sp])\n    apply (auto simp add: rel_total.simps)\n     apply wp apply (auto simp add: nil_event_def)\n    apply wp using assms by auto\n  done\n\nlemma tick_rule2:\n  assumes \"astate_scheduler.next_mode as \\<noteq> NEXT_TICK\"\n  shows\n  \"\\<lbrace> \\<lambda>p es. rel_total (as, aw) p \\<and> nil\\<^sub>e es \\<rbrace>\n     tick\n   \\<lbrace> \\<lambda>_ p es. rel_total (as, aw) p \\<and> es = [WATCHDOG_TICK] \\<rbrace>!\"\n  unfolding tick_def\n  apply (rule validNF_bind)\n     apply (simp add: rel_total.simps)\n  apply (rule validNF_weaken_pre[where Q=\"\\<lambda>p es. (rel_scheduler as (fst p) \\<and> nil\\<^sub>e es) \\<and> rel_watchdog aw (snd p)\"])\n    apply (rule validNF_apply_fst)\n    apply (rule get_next_mode_sp)\n  subgoal by auto\n  subgoal for nmode\n    apply (rule validNF_weaken_pre)\n    apply (rule validNF_if_split[where R=\"\\<lambda>p es. rel_total (as, aw) p \\<and> nil\\<^sub>e es\"])\n      apply wp apply (rule validNF_apply_fst[OF set_next_mode_sp])\n      apply auto apply wp using assms apply auto\n    apply wp apply (auto simp add: nil_event_def)\n  using assms by (auto simp add: rel_total.simps)\n  done\n\ntheorem sValidNF_watchdog_add:\n  assumes \"w0 ev = None\"\n    and \"n > 0\"\n  shows\n    \"sValidNF system\n      (\\<lambda>p es. rel_total (s0, w0) p \\<and> nil\\<^sub>e es)\n      (WATCHDOG_ADD (ev, n))\n      (\\<lambda>p es. rel_total (s0, w0(ev \\<mapsto> n)) p \\<and> nil\\<^sub>e es)\"\n  apply (rule sValidNF_Some)\n    apply (rule system_eval)\n  apply (simp add: rel_total.simps)\n   apply (rule validNF_apply_snd)\n   apply (rule watchdog_add_rule)\n    apply (rule assms(2)) apply (rule assms(1))\n  unfolding nil_event_def apply auto\n  apply (rule sValidNF_list_weaken_pre)\n   prefer 2 apply (rule sValidNF_list_null)\n  by (auto simp add: rel_total.simps)\n\ntheorem sValidNF_watchdog_add':\n  assumes \"w0 ev = None\"\n    and \"n > 0\"\n  shows\n    \"sValidNF system\n      (\\<lambda>p es. rel_total (s0, w0) p \\<and> Q es)\n      (WATCHDOG_ADD (ev, n))\n      (\\<lambda>p es. rel_total (s0, w0(ev \\<mapsto> n)) p \\<and> Q es)\"\n  apply (rule sValidNF_frame_nil)\n  apply (rule sValidNF_watchdog_add)\n  using assms by auto\n\ntheorem sValidNF_watchdog_remove:\n  assumes \"w0 ev \\<noteq> None\"\n  shows\n    \"sValidNF system\n      (\\<lambda>p es. rel_total (s0, w0) p \\<and> nil\\<^sub>e es)\n      (WATCHDOG_REMOVE ev)\n      (\\<lambda>p es. rel_total (s0, w0(ev := None)) p \\<and> nil\\<^sub>e es)\"\n  apply (rule sValidNF_Some)\n    apply (rule system_eval)\n   apply (simp add: rel_total.simps)\n  apply (rule validNF_apply_snd)\n   apply (rule watchdog_remove_rule)\n  unfolding nil_event_def apply auto\n  apply (rule sValidNF_list_weaken_pre)\n   prefer 2 apply (rule sValidNF_list_null)\n  by (auto simp add: rel_total.simps)\n\ndefinition next_pair :: \"astate_scheduler \\<Rightarrow> partition \\<times> nat\" where\n  \"next_pair st =\n    (if astate_scheduler.next_mode st = NEXT_WINDOW then\n       next_ttbl st ! 0\n     else if window_id st = length (cur_ttbl st) - 1 \\<and> astate_scheduler.next_mode st = NEXT_FRAME then\n       next_ttbl st ! 0\n     else if window_id st = length (cur_ttbl st) - 1 \\<and> astate_scheduler.next_mode st = ONGOING then\n       cur_ttbl st ! 0\n     else\n       cur_ttbl st ! ((window_id st + 1) mod length (cur_ttbl st)))\"\n\nlemma spec_dispatch_is_next_pair:\n  \"snd (spec_dispatch as) = [PARTITION (fst (next_pair as)), WATCHDOG_ADD (0, snd (next_pair as))]\"\n  unfolding spec_dispatch_def next_pair_def by auto\n\nlemma next_pair_positive:\n  \"ainv as \\<Longrightarrow> snd (next_pair as) > 0\"\n  unfolding ainv_def next_pair_def\n  apply (cases \"astate_scheduler.next_mode as = NEXT_WINDOW\")\n  using is_valid_time_table.elims(2) next_ttbl_def valid_time_table window_time_pos apply fastforce\n  apply (cases \"window_id as = length (cur_ttbl as) - 1 \\<and> astate_scheduler.next_mode as = NEXT_FRAME\")\n  using is_valid_time_table.elims(2) next_ttbl_def valid_time_table window_time_pos apply fastforce\n  apply (cases \"window_id as = length (cur_ttbl as) - 1 \\<and> astate_scheduler.next_mode as = ONGOING\")\n  using cur_ttbl_def valid_time_table window_time_pos apply fastforce\n  by (smt cur_ttbl_def window_time_pos global_state_axioms length_greater_0_conv\n          length_ineq_not_Nil(1) mod_less_divisor valid_time_table)\n\ntheorem sValidNF_dispatch':\n  assumes \"w0 0 = None\"\n    and \"astate_scheduler.next_mode s0 \\<noteq> NEXT_TICK\"\n  shows\n    \"sValidNF system\n      (\\<lambda>p es. ainv s0 \\<and> rel_total (s0, w0) p \\<and> nil\\<^sub>e es)\n      (DISPATCH 0)\n      (\\<lambda>p es. rel_total (fst (spec_dispatch s0), w0(0 \\<mapsto> snd (next_pair s0))) p \\<and>\n              es = [PARTITION (fst (next_pair s0))])\"\n  apply (subst sValidNF_conj_pre) apply auto\n  apply (rule sValidNF_Some)\n    apply (rule system_eval)\n  apply (rule validNF_weaken_pre[where Q=\"\\<lambda>p es. (rel_scheduler s0 (fst p) \\<and> nil\\<^sub>e es) \\<and> rel_watchdog w0 (snd p)\"])\n    apply (rule validNF_apply_fst)\n    apply (rule dispatch_all_rule[OF assms(2)])\n   apply (auto simp add: rel_total.simps)[1]\n  subgoal for p es\n    apply (auto simp add: spec_dispatch_is_next_pair)\n    apply (rule sValidNF_list_cons)\n     prefer 2\n     apply (rule sValidNF_list_single)\n     apply (rule sValidNF_watchdog_add')\n      apply (rule assms(1)) apply (rule next_pair_positive) apply auto[1]\n    apply (rule sValidNF_weaken_pre)\n     prefer 2 apply (rule sValidNF_None)\n     apply (rule system_eval)\n    by (auto simp add: nil_event_def rel_total.simps)\n  done\n\ntheorem sValidNF_dispatch:\n  assumes \"w0 0 = None\"\n    and \"astate_scheduler.next_mode s0 \\<noteq> NEXT_TICK\"\n  shows\n    \"sValidNF system\n      (\\<lambda>p es. rel_total (s0, w0) p \\<and> nil\\<^sub>e es)\n      (DISPATCH 0)\n      (\\<lambda>p es. rel_total (fst (spec_dispatch s0), w0(0 \\<mapsto> snd (next_pair s0))) p \\<and>\n              es = [PARTITION (fst (next_pair s0))])\"\n  apply (rule sValidNF_weaken_pre)\n   prefer 2 apply (rule sValidNF_dispatch')\n  using assms by (auto simp add: rel_scheduler_def rel_total.simps)\n\ntext \\<open>Specification for watchdog tick in the event system\\<close>\nfun spec_watchdog_tick_system ::\n  \"astate_scheduler \\<times> astate_watchdog \\<Rightarrow> (astate_scheduler \\<times> astate_watchdog) \\<times> event set\" where\n  \"spec_watchdog_tick_system (s0, w0) =\n   (if w0 0 = Some 1 then\n      ((fst (spec_dispatch s0),\n        (spec_watchdog_tick w0)(0 \\<mapsto> snd (next_pair s0))),\n       (DISPATCH ` spec_watchdog_tick_ev w0) - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair s0))})\n    else\n      ((s0, spec_watchdog_tick w0),\n       DISPATCH ` spec_watchdog_tick_ev w0))\"\n\ntheorem sValidNF_watchdog_tick:\n  assumes \"w0 0 = Some 1 \\<longrightarrow> astate_scheduler.next_mode s0 \\<noteq> NEXT_TICK\"\n  shows\n  \"sValidNF system\n    (\\<lambda>p es. rel_total (s0, w0) p \\<and> nil\\<^sub>e es)\n    WATCHDOG_TICK\n    (\\<lambda>p es. rel_total (fst (spec_watchdog_tick_system (s0, w0))) p \\<and>\n            distinct es \\<and>\n            set es = snd (spec_watchdog_tick_system (s0, w0)))\"\nproof -\n  have pre1:\n    \"DISPATCH 0 \\<notin> set es \\<Longrightarrow>\n     \\<forall>e\\<in>set es. \\<exists>i. e = DISPATCH i \\<Longrightarrow>\n     sValidNF_list system (\\<lambda>s' es'. P s' \\<and> es' = es0) es (\\<lambda>s' es'. P s' \\<and> es' = es0 @ es)\"\n    for P es es0\n    apply (rule sValidNF_list_weaken_pre)\n    prefer 2 apply (rule sValidNF_list_all_None)\n    apply (auto simp add: nil_event_def)\n    apply (induction es) apply auto\n    using system_eval(3) by fastforce\n  have pre2:\n    \"DISPATCH 0 \\<in> set es \\<Longrightarrow>\n     distinct es \\<Longrightarrow>\n     \\<forall>e\\<in>set es. \\<exists>i. e = DISPATCH i \\<Longrightarrow>\n     w0 0 = None \\<Longrightarrow>\n     astate_scheduler.next_mode s0 \\<noteq> NEXT_TICK \\<Longrightarrow>\n     rel_scheduler s0 cs0 \\<Longrightarrow>\n     rel_watchdog w0 cw0 \\<Longrightarrow>\n     sValidNF_list system (\\<lambda>s' es'. s' = (cs0, cw0) \\<and> nil\\<^sub>e es') es\n       (\\<lambda>s' es'. rel_total (fst (spec_dispatch s0), w0(0 \\<mapsto> snd (next_pair s0))) s' \\<and>\n                 distinct es' \\<and> set es' = set es - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair s0))})\"\n    for cs0 cw0 s0 w0 es\n  proof (induction es)\n    case Nil\n    then show ?case by auto\n  next\n    case (Cons e es)\n    show ?case\n    proof (cases \"e = DISPATCH 0\")\n      case True\n      have a1: \"DISPATCH 0 \\<notin> set es\"\n        using Cons(2,3) True by auto\n      have a2: \"\\<forall>e\\<in>set es. \\<exists>i. e = DISPATCH i\"\n        using Cons(4) by auto\n      let ?s0'=\"fst (spec_dispatch s0)\"\n      let ?w0'=\"w0(0 \\<mapsto> snd (next_pair s0))\"\n      let ?es0=\"[PARTITION (fst (next_pair s0))]\"\n      have a3: \"sValidNF_list system (\\<lambda>s' es'. rel_total (?s0', ?w0') s' \\<and> es' = ?es0) es\n                  (\\<lambda>s' es'. rel_total (?s0', ?w0') s' \\<and> es' = ?es0 @ es)\"\n        by (rule pre1[OF a1 a2])\n      have a4: \"distinct ([PARTITION (fst (next_pair s0))] @ es)\"\n        using Cons(3) a2 by auto\n      show ?thesis\n        apply (subst True)\n        apply (rule sValidNF_list_cons)\n         apply (rule sValidNF_weaken_pre)\n        prefer 2 apply (rule sValidNF_dispatch) apply (rule Cons(5))\n          prefer 2 using Cons(7,8) apply (auto simp add: rel_total.simps)[1]\n        using Cons(6) apply auto[1]\n         apply (rule sValidNF_list_strengthen_post)\n          prefer 2 apply (rule a3)\n        using a1 a4 True by auto\n    next\n      case False\n      have b1: \"DISPATCH 0 \\<in> set es\"\n        using Cons(2) False by auto\n      have b2: \"distinct es\"\n        using Cons(3) by auto\n      have b3: \"\\<forall>e\\<in>set es. \\<exists>i. e = DISPATCH i\"\n        using Cons(4) by auto\n      have b4: \"system e = None\"\n        using False Cons.prems(3) system_eval(3) by force\n      have b5: \"sValidNF_list system\n                 (\\<lambda>s' es'. s' = (cs0, cw0) \\<and> nil\\<^sub>e es') es\n                 (\\<lambda>s' es'. rel_total (fst (spec_dispatch s0), w0(0 \\<mapsto> snd (next_pair s0))) s' \\<and>\n                           distinct es' \\<and> set es' = set es - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair s0))})\"\n        by (rule Cons(1)[OF b1 b2 b3 Cons(5-8)])\n      have b6: \"distinct t\" \"set t = set (e # es) - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair s0))}\"\n        if assm_b6: \"((\\<lambda>t. t = [e]) ^\\<^sub>e (\\<lambda>es'. distinct es' \\<and> set es' = set es - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair s0))})) t\" for t\n      proof -\n        obtain es' where c1: \"distinct es'\" \"set es' = set es - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair s0))}\" \"t = [e] @ es'\"\n          using assm_b6 unfolding chop_event_def by auto\n        have c2: \"set t = insert e (set es')\"\n          using c1(3) by auto\n        show \"distinct t\"\n          using Cons(3,4) c1 event.distinct(9) by auto\n        show \"set t = set (e # es) - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair s0))}\"\n          using False c1(2) c2 by auto\n      qed\n      show ?thesis\n        apply (rule sValidNF_list_cons)\n         apply (rule sValidNF_None_sp)\n         apply (rule b4)\n        apply (rule sValidNF_list_strengthen_post)\n         prefer 2 apply (rule sValidNF_list_frame)\n         apply (rule b5)\n        using b6(1) b6(2) by blast\n    qed\n  qed\n  have a: \"sValidNF_list system\n     (\\<lambda>s' es'. s' = (cs0, cw0) \\<and> nil\\<^sub>e es')\n      es\n     (\\<lambda>p es. rel_total (fst (spec_watchdog_tick_system (s0, w0))) p \\<and>\n             distinct es \\<and>\n             set es = snd (spec_watchdog_tick_system (s0, w0)))\"\n    if \"rel_scheduler s0 cs0\"\n       \"rel_watchdog (spec_watchdog_tick w0) cw0\"\n       \"distinct es\"\n       \"set es = DISPATCH ` spec_watchdog_tick_ev w0\" for cs0 cw0 es\n  proof -\n    have a1: \"\\<forall>e\\<in>set es. \\<exists>i. e = DISPATCH i\"\n      unfolding that spec_watchdog_tick_def by auto\n    show ?thesis\n    proof (cases \"w0 0 = Some 1\")\n      case True\n      have b1: \"DISPATCH 0 \\<in> set es\"\n        using True spec_watchdog_tick_ev_def that by auto\n      have b2: \"spec_watchdog_tick w0 0 = None\"\n        by (auto simp add: spec_watchdog_tick_def True)\n      show ?thesis\n        apply (rule sValidNF_list_strengthen_post)\n         prefer 2 apply (rule pre2[OF b1 that(3) a1 b2 _ that(1) that(2)])\n        using True that assms by auto\n    next\n      case False\n      have c1: \"DISPATCH 0 \\<notin> set es\"\n        using False spec_watchdog_tick_ev_def that by auto\n      show ?thesis\n        unfolding nil_event_def\n        apply (rule sValidNF_list_strengthen_post)\n         prefer 2 apply (rule pre1[OF c1 a1])\n        using False that by (auto simp add: rel_total.simps)\n    qed\n  qed\n  show ?thesis\n    apply (rule sValidNF_Some)\n      apply (rule system_eval)\n    apply (simp add: rel_total.simps)\n     apply (rule validNF_apply_snd)\n     apply (rule watchdog_tick_rule)\n    using a by auto\nqed\n\ntheorem sValidNF_watchdog_tick':\n  assumes \"w0 0 = None\"\n  shows\n  \"sValidNF system\n    (\\<lambda>p es. rel_total (s0, w0) p \\<and> nil\\<^sub>e es)\n    WATCHDOG_TICK\n    (\\<lambda>p es. rel_total (s0, spec_watchdog_tick w0) p \\<and>\n            distinct es \\<and>\n            set es = DISPATCH ` spec_watchdog_tick_ev w0)\"\n  apply (rule sValidNF_strengthen_post)\n   prefer 2\n   apply (rule sValidNF_watchdog_tick)\n  using assms by auto\n\ntheorem sValidNF_dispatch_frame:\n  assumes \"w0 0 = None\"\n    and \"astate_scheduler.next_mode s0 \\<noteq> NEXT_TICK\"\n  shows\n    \"sValidNF system\n      (\\<lambda>p es. rel_total (s0, w0) p \\<and> P es)\n      (DISPATCH 0)\n      (\\<lambda>p es. rel_total (fst (spec_dispatch s0), w0(0 \\<mapsto> snd (next_pair s0))) p \\<and>\n              (P ^\\<^sub>e (\\<lambda>e. e = [PARTITION (fst (next_pair s0))])) es)\"\n  apply (rule sValidNF_frame)\n  apply (rule sValidNF_dispatch)\n  using assms by auto\n\ntheorem sValidNF_tick1:\n  assumes \"astate_scheduler.next_mode s0 = NEXT_TICK\"\n    and \"w0 0 \\<noteq> None\"\n  shows\n  \"sValidNF system\n    (\\<lambda>p es. rel_total (s0, w0) p \\<and> nil\\<^sub>e es)\n    TICK\n    (\\<lambda>p es. rel_total\n        (fst (spec_dispatch (s0\\<lparr>astate_scheduler.next_mode := NEXT_WINDOW\\<rparr>)),\n        (spec_watchdog_tick (w0(0 := None)))(0 \\<mapsto> snd (next_ttbl s0 ! 0))) p \\<and>\n        ((\\<lambda>t. distinct t \\<and> set t = DISPATCH ` spec_watchdog_tick_ev (w0(0 := None))) ^\\<^sub>e\n         (\\<lambda>t. t = [PARTITION (fst (next_ttbl s0 ! 0))])) es)\"\n  apply (rule sValidNF_Some)\n  apply (rule system_eval)\n  apply (rule tick_rule1[OF assms(1)])\n  subgoal for p es\n    apply auto\n    apply (rule sValidNF_list_cons)\n    apply (rule sValidNF_weaken_pre)\n      prefer 2 apply (rule sValidNF_watchdog_remove)\n      apply (rule assms(2))\n    apply auto\n    apply (rule sValidNF_list_cons)\n     apply (rule sValidNF_watchdog_tick')\n     apply auto\n    apply (rule sValidNF_list_single)\n    apply (rule sValidNF_strengthen_post)\n     prefer 2 apply (rule sValidNF_dispatch_frame)\n      apply auto\n    by (auto simp add: spec_watchdog_tick_def next_pair_def next_ttbl_def)\n  done\n\ntheorem sValidNF_tick2:\n  assumes \"astate_scheduler.next_mode s0 \\<noteq> NEXT_TICK\"\n  shows\n  \"sValidNF system\n    (\\<lambda>p es. rel_total (s0, w0) p \\<and> nil\\<^sub>e es)\n    TICK\n    (\\<lambda>p es. rel_total (fst (spec_watchdog_tick_system (s0, w0))) p \\<and>\n            distinct es \\<and>\n            set es = snd (spec_watchdog_tick_system (s0, w0)))\"\n  apply (rule sValidNF_Some)\n  apply (rule system_eval)\n   apply (rule tick_rule2[OF assms])\n  subgoal for p es\n    apply (auto simp del: spec_watchdog_tick_system.simps)\n    apply (rule sValidNF_list_single)\n    apply (rule sValidNF_weaken_pre)\n     prefer 2 apply (rule sValidNF_watchdog_tick)\n    using assms by auto\n  done\n\ntext \\<open>Specification of overall tick in the event system\\<close>\nfun spec_tick_system ::\n  \"astate_scheduler \\<times> astate_watchdog \\<Rightarrow> (astate_scheduler \\<times> astate_watchdog) \\<times> event set\" where\n  \"spec_tick_system (s0, w0) =\n   (if astate_scheduler.next_mode s0 = NEXT_TICK then\n      ((fst (spec_dispatch (s0\\<lparr>astate_scheduler.next_mode := NEXT_WINDOW\\<rparr>)),\n       (spec_watchdog_tick (w0(0 := None)))(0 \\<mapsto> snd (next_ttbl s0 ! 0))),\n       (DISPATCH ` spec_watchdog_tick_ev w0) - {DISPATCH 0} \\<union> {PARTITION (fst (next_ttbl s0 ! 0))})\n    else\n      spec_watchdog_tick_system (s0, w0))\"\n\ntheorem sValidNF_tick:\n  assumes \"w0 0 \\<noteq> None\"\n  shows\n  \"sValidNF system\n    (\\<lambda>p es. rel_total (s0, w0) p \\<and> nil\\<^sub>e es)\n    TICK\n    (\\<lambda>p es. rel_total (fst (spec_tick_system (s0, w0))) p \\<and>\n            distinct es \\<and>\n            set es = snd (spec_tick_system (s0, w0)))\"\nproof (cases \"astate_scheduler.next_mode s0 = NEXT_TICK\")\n  case True\n  have a: \"distinct t\" \"set t = snd (spec_tick_system (s0, w0))\"\n    if assm_a: \"((\\<lambda>t. distinct t \\<and> set t = DISPATCH ` spec_watchdog_tick_ev (w0(0 := None))) ^\\<^sub>e\n                (\\<lambda>t. t = [PARTITION (fst (next_ttbl s0 ! 0))])) t\"\n      \"astate_scheduler.next_mode s0 = NEXT_TICK\"\n    for t\n  proof -\n    obtain t1 where a1: \"t = t1 @ [PARTITION (fst (next_ttbl s0 ! 0))]\"\n      \"distinct t1\" \"set t1 = DISPATCH ` spec_watchdog_tick_ev (w0(0 := None))\"\n      using assm_a(1) unfolding chop_event_def by auto\n    show \"distinct t\"\n      using a1 by auto\n    have a2: \"snd (spec_tick_system (s0, w0)) =\n      (DISPATCH ` spec_watchdog_tick_ev w0) - {DISPATCH 0} \\<union> {PARTITION (fst (next_ttbl s0 ! 0))}\"\n      using assm_a(2) by auto\n    have a3: \"spec_watchdog_tick_ev (w0(0 := None)) = spec_watchdog_tick_ev w0 - {0}\"\n      by (auto simp add: spec_watchdog_tick_ev_def)\n    have a4: \"set t = set t1 \\<union> {PARTITION (fst (next_ttbl s0 ! 0))}\"\n      unfolding a1(1) by auto\n    show \"set t = snd (spec_tick_system (s0, w0))\"\n      unfolding a2 a1(3) a4 a3 by auto\n  qed\n  show ?thesis\n    apply (rule sValidNF_strengthen_post)\n     prefer 2 apply (rule sValidNF_tick1)\n    using True apply auto[1]\n    using assms apply auto[1]\n    by (metis (no_types, lifting) True a fst_conv spec_tick_system.simps)\nnext\n  case False\n  show ?thesis\n    apply (rule sValidNF_strengthen_post)\n     prefer 2 apply (rule sValidNF_tick2)\n    using False by auto\nqed\n\nend\n\nsubsection \\<open>Refinement for the combined system\\<close>\n\nrecord astate =\n  a_cur_ttbl_id :: ttbl_id   \\<comment> \\<open>ID of current table\\<close>\n  frame_time :: nat          \\<comment> \\<open>Current time within the frame\\<close>\n  a_next_ttbl_id :: ttbl_id  \\<comment> \\<open>ID of next table (0 when not switching)\\<close>\n  a_next_mode :: switch_mode  \\<comment> \\<open>Switch mode\\<close>\n  wchain :: astate_watchdog  \\<comment> \\<open>Watchdog info (excluding 0)\\<close>\n\ncontext global_state\nbegin\n\ndefinition a_cur_ttbl :: \"astate \\<Rightarrow> time_table\" where\n  \"a_cur_ttbl a = time_tables (a_cur_ttbl_id a)\"\n\ndefinition a_next_ttbl :: \"astate \\<Rightarrow> time_table\" where\n  \"a_next_ttbl a = time_tables (a_next_ttbl_id a)\"\n\ntext \\<open>Detect whether switching should occur at the next tick.\\<close>\ndefinition to_switch :: \"astate \\<Rightarrow> bool\" where\n  \"to_switch a =\n    (case a_next_mode a of\n        NO_SWITCH \\<Rightarrow> False\n      | ONGOING \\<Rightarrow> False\n      | NEXT_TICK \\<Rightarrow> True\n      | NEXT_WINDOW \\<Rightarrow> at_window_boundary (a_cur_ttbl a) (frame_time a)\n      | NEXT_FRAME \\<Rightarrow> frame_time a = (frame_length (a_cur_ttbl a) - 1))\"\n\ntext \\<open>Specification of the overall system\\<close>\ndefinition spec_atick :: \"astate \\<Rightarrow> astate \\<times> event set\" where\n  \"spec_atick a =\n    (if to_switch a then\n      (\\<lparr>a_cur_ttbl_id = a_next_ttbl_id a, frame_time = 0, a_next_ttbl_id = 0, a_next_mode = ONGOING,\n        wchain = spec_watchdog_tick (wchain a)\\<rparr>,\n       DISPATCH ` spec_watchdog_tick_ev (wchain a) \\<union>\n       {PARTITION (fst (a_next_ttbl a ! 0))})\n     else if frame_time a = frame_length (a_cur_ttbl a) - 1 \\<and> a_next_mode a = ONGOING then\n      (a\\<lparr>frame_time := 0, a_next_mode := NO_SWITCH,\n       wchain := spec_watchdog_tick (wchain a)\\<rparr>,\n       DISPATCH ` spec_watchdog_tick_ev (wchain a) \\<union>\n       {PARTITION (fst (a_cur_ttbl a ! 0))})\n     else if at_window_boundary (a_cur_ttbl a) (frame_time a) then\n      (a\\<lparr>frame_time := (frame_time a + 1) mod frame_length (a_cur_ttbl a),\n       wchain := spec_watchdog_tick (wchain a)\\<rparr>,\n       DISPATCH ` spec_watchdog_tick_ev (wchain a) \\<union>\n       {PARTITION (partition_at_time (a_cur_ttbl a) ((frame_time a + 1) mod frame_length (a_cur_ttbl a)))})\n     else\n      (a\\<lparr>frame_time := (frame_time a + 1) mod frame_length (a_cur_ttbl a),\n       wchain := spec_watchdog_tick (wchain a)\\<rparr>,\n       DISPATCH ` spec_watchdog_tick_ev (wchain a)))\"\n\nfun arel :: \"astate \\<Rightarrow> astate_scheduler \\<times> astate_watchdog \\<Rightarrow> bool\" where\n  \"arel a (as, aw) \\<longleftrightarrow>\n   (case aw 0 of\n      None \\<Rightarrow> False\n    | Some wpos \\<Rightarrow>\n        a_cur_ttbl_id a = astate_scheduler.cur_ttbl_id as \\<and>\n        frame_time a = frame_time_to_window (cur_ttbl as) (window_id as + 1) - wpos \\<and>\n        a_next_ttbl_id a = astate_scheduler.next_ttbl_id as \\<and>\n        a_next_mode a = astate_scheduler.next_mode as \\<and>\n        wchain a 0 = None \\<and> (\\<forall>i>0. wchain a i = aw i))\"\ndeclare arel.simps [simp del]\n\nfun as_inv :: \"astate_scheduler \\<times> astate_watchdog \\<Rightarrow> bool\" where\n  \"as_inv (as, aw) \\<longleftrightarrow>\n    ainv as \\<and>\n    (case aw 0 of\n       None \\<Rightarrow> False\n     | Some wpos \\<Rightarrow> wpos > 0 \\<and> wpos \\<le> snd (cur_ttbl as ! window_id as))\"\ndeclare as_inv.simps [simp del]\n\ntheorem spec_atick_refines1:\n  assumes \"arel a (as, aw)\"\n    and \"as_inv (as, aw)\"\n    and \"astate_scheduler.next_mode as \\<noteq> NEXT_TICK\"\n  shows \"arel (fst (spec_atick a)) (fst (spec_watchdog_tick_system (as, aw)))\"\nproof -\n  have g1: \"length (cur_ttbl as) > 0\"\n    using assms(2) by (auto simp add: ainv_def as_inv.simps)\n  have g2: \"frame_length (cur_ttbl as) > 0\"\n    using assms(2) valid_time_table_frame_length\n    using cur_ttbl_def global_state.ainv_def global_state_axioms valid_time_table as_inv.simps by auto\n  have g3: \"Suc (frame_length (cur_ttbl as) - 1) = frame_length (cur_ttbl as)\"\n    using g2 by auto\n  have g4: \"window_id as < length (cur_ttbl as)\"\n    using assms(2) by (simp add: ainv_def as_inv.simps)\n  have a: \"Suc (frame_time_to_window (cur_ttbl as) (Suc (window_id as)) - Suc 0) mod frame_length (cur_ttbl as) =\n           frame_time_to_window (cur_ttbl as) (Suc (Suc (window_id as) mod length (cur_ttbl as))) -\n           snd (cur_ttbl as ! (Suc (window_id as) mod length (cur_ttbl as)))\"\n    if \"frame_time a = frame_time_to_window (cur_ttbl as) (Suc (window_id as)) - 1\"\n       \"a_cur_ttbl a = cur_ttbl as\"\n  proof (cases \"window_id as = length (cur_ttbl as) - 1\")\n    case True\n    have a1: \"Suc (window_id as) = length (cur_ttbl as)\"\n      using g1 True by auto\n    have a2: \"Suc (window_id as) mod length (cur_ttbl as) = 0\"\n      using a1 by auto\n    show ?thesis\n      unfolding a1 a2 g1 g2 g3 frame_time_to_window_total\n      apply (cases \"cur_ttbl as\")\n      using g2 apply auto[1]\n      by (metis One_nat_def a1 add_eq_if diff_self_eq_0 frame_time_to_window_next\n                frame_time_to_window_zero g1 g3 mod_self nth_Cons_0)\n  next\n    case False\n    have a1: \"window_id as < length (cur_ttbl as) - 1\"\n      using g1 g4 False by auto\n    have a2: \"frame_time_to_window (cur_ttbl as) (Suc (window_id as)) > 0\"\n      using assms(2) frame_time_to_window_next window_time_pos\n      using ainv_def cur_ttbl_def valid_time_table as_inv.simps by auto\n    have a3: \"Suc (frame_time_to_window (cur_ttbl as) (Suc (window_id as)) - 1) =\n              frame_time_to_window (cur_ttbl as) (Suc (window_id as))\"\n      using a2 by auto\n    have a4: \"Suc (window_id as) mod length (cur_ttbl as) = Suc (window_id as)\"\n      using One_nat_def a1 by auto\n    have a5: \"frame_time_to_window (cur_ttbl as) (Suc (window_id as)) < frame_length (cur_ttbl as)\"\n      by (metis (no_types, lifting) Suc_pred' a1 as_inv.simps assms(2) cur_ttbl_def\n                frame_time_to_window_mono_strict frame_time_to_window_total g1 global_state.ainv_def\n                global_state_axioms not_less_eq valid_time_table)\n    have a6: \"frame_time_to_window (cur_ttbl as) (Suc (window_id as)) mod frame_length (cur_ttbl as) =\n              frame_time_to_window (cur_ttbl as) (Suc (window_id as))\"\n      using a5 by auto\n    show ?thesis\n      unfolding g1 g2 g3 a3 a4 a6\n      using a4 frame_time_to_window_next g1 nat_mod_lem\n      by (metis One_nat_def a3 a6 add_diff_cancel_right')\n  qed\n  show ?thesis\n  proof (cases \"aw 0\")\n    case None\n    then show ?thesis using assms as_inv.simps by auto\n  next\n    case (Some wpos)\n    have b1: \"wpos > 0\" \"wpos \\<le> snd (cur_ttbl as ! window_id as)\"\n      using assms(2) Some as_inv.simps by auto\n    have b2: \"a_cur_ttbl a = cur_ttbl as\"\n      using assms(1) Some by (auto simp add: arel.simps cur_ttbl_def a_cur_ttbl_def)\n    have b3: \"frame_time a = frame_time_to_window (cur_ttbl as) (window_id as + 1) - wpos\"\n      using assms(1) Some by (auto simp add: arel.simps)\n    have b4: \"at_window_boundary (a_cur_ttbl a) (frame_time a) \\<longleftrightarrow> wpos = 1\"\n      unfolding b2 b3 apply (rule at_window_boundary_wpos)\n      using assms(2) b1 apply (auto simp add: ainv_def as_inv.simps)\n      using cur_ttbl_def valid_time_table by auto\n    have b5: \"a_next_mode a = astate_scheduler.next_mode as\"\n      using assms(1) Some by (auto simp add: arel.simps)\n    have b6: \"is_valid_time_table (a_cur_ttbl a)\"\n      using assms ainv_def b2 cur_ttbl_def valid_time_table as_inv.simps by auto\n    have b7: \"window_id as < length (cur_ttbl as)\"\n      using ainv_def assms(2) as_inv.simps by auto\n    have b8: \"a_next_ttbl a = next_ttbl as\"\n      using assms(1) Some by (auto simp add: arel.simps next_ttbl_def a_next_ttbl_def)\n    have b9: \"is_valid_time_table (next_ttbl as)\"\n      using ainv_def assms(2) next_ttbl_def valid_time_table as_inv.simps by auto\n    have b10: \"frame_time_to_window (next_ttbl as) 1 \\<le> snd (next_ttbl as ! 0)\"\n      apply (cases \"next_ttbl as\") using b9 by auto\n    show ?thesis\n    proof (cases \"wpos = 1\")\n      case True\n      note wpos = True\n      have c1: \"at_window_boundary (a_cur_ttbl a) (frame_time a)\"\n        using b4 True by auto\n      show ?thesis\n      proof (cases \"a_next_mode a\")\n        case NO_SWITCH\n        have e1: \"\\<not>to_switch a\"\n          unfolding to_switch_def using NO_SWITCH by auto\n        have e2: \"fst (spec_atick a) =\n                    a\\<lparr>frame_time := (frame_time a + 1) mod frame_length (a_cur_ttbl a),\n                      wchain := spec_watchdog_tick (wchain a)\\<rparr>\"\n          by (auto simp add: spec_atick_def e1 NO_SWITCH)\n        have e3: \"fst (spec_watchdog_tick_system (as, aw)) =\n          (as\\<lparr>window_id := (window_id as + 1) mod length (cur_ttbl as)\\<rparr>,\n           (spec_watchdog_tick aw)(0 \\<mapsto> snd (next_pair as)))\"\n          using b5 by (auto simp add: Some wpos spec_dispatch_def NO_SWITCH)\n        have e4: \"next_pair as = cur_ttbl as ! ((window_id as + 1) mod length (cur_ttbl as))\"\n          using b5 by (auto simp add: next_pair_def NO_SWITCH)\n        have e5: \"cur_ttbl (as\\<lparr>window_id := Suc (window_id as) mod length (cur_ttbl as)\\<rparr>) = cur_ttbl as\"\n          unfolding cur_ttbl_def by auto\n        show ?thesis\n          unfolding e2 e3 e4 using arel.simps apply auto\n          subgoal using Some assms(1) by auto\n          subgoal unfolding b3 wpos e5 b2 apply auto apply (rule a)\n            using b3 wpos b2 by auto\n          subgoal using Some assms(1) by auto\n          subgoal using Some assms(1) by auto\n          subgoal using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n          subgoal using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n          done\n      next\n        case NEXT_TICK\n        then show ?thesis using assms(3) b5 by auto\n      next\n        case NEXT_WINDOW\n        have e1: \"to_switch a\"\n          unfolding to_switch_def using NEXT_WINDOW c1 by auto\n        have e2: \"fst (spec_atick a) = \\<lparr>a_cur_ttbl_id = a_next_ttbl_id a, frame_time = 0,\n                                        a_next_ttbl_id = 0, a_next_mode = ONGOING,\n                                        wchain = spec_watchdog_tick (wchain a)\\<rparr>\"\n          unfolding spec_atick_def using e1 by auto\n        have e3: \"fst (spec_watchdog_tick_system (as, aw)) =\n            (\\<lparr>astate_scheduler.cur_ttbl_id = astate_scheduler.next_ttbl_id as, window_id = 0,\n              reset = False, next_ttbl_id = 0, next_mode = ONGOING\\<rparr>,\n             (spec_watchdog_tick aw)(0 \\<mapsto> snd (next_pair as)))\"\n          using Some True NEXT_WINDOW b5 by (auto simp add: spec_dispatch_def)\n        have e4: \"next_pair as = next_ttbl as ! 0\"\n          using next_pair_def NEXT_WINDOW b5 by auto\n        show ?thesis\n          unfolding e2 e3 e4 using arel.simps apply (auto simp add: cur_ttbl_def)\n          using assms(1) Some apply auto[1]\n          using b10 next_ttbl_def apply auto[1]\n          using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n      next\n        case NEXT_FRAME\n        show ?thesis\n        proof (cases \"window_id as = length (cur_ttbl as) - 1\")\n          case True\n          have e1: \"frame_time a = frame_length (a_cur_ttbl a) - 1\"\n            unfolding b3 True wpos apply auto\n            by (metis One_nat_def Suc_diff_1 b2 b7 frame_time_to_window_total gr_zeroI not_less_zero)\n          have e2: \"fst (spec_atick a) = \\<lparr>a_cur_ttbl_id = a_next_ttbl_id a, frame_time = 0,\n                                          a_next_ttbl_id = 0, a_next_mode = ONGOING,\n                                          wchain = spec_watchdog_tick (wchain a)\\<rparr>\"\n            unfolding spec_atick_def to_switch_def e1 NEXT_FRAME b5 by auto\n          have e3: \"fst (spec_watchdog_tick_system (as, aw)) =\n            (\\<lparr>astate_scheduler.cur_ttbl_id = astate_scheduler.next_ttbl_id as, window_id = 0,\n              reset = False, next_ttbl_id = 0, next_mode = ONGOING\\<rparr>,\n             (spec_watchdog_tick aw)(0 \\<mapsto> snd (next_pair as)))\"\n            using b5 by (auto simp add: Some wpos spec_dispatch_def NEXT_FRAME True)\n          have e4: \"next_pair as = next_ttbl as ! 0\"\n            using b5 by (auto simp add: next_pair_def NEXT_FRAME True)\n          show ?thesis\n            unfolding e2 e3 e4 using arel.simps apply (auto simp add: cur_ttbl_def)\n            using assms(1) Some apply auto[1]\n            using b10 next_ttbl_def apply auto[1]\n            using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n        next\n          case False\n          have e1: \"window_id as + 1 < length (cur_ttbl as)\"\n            using False b7 by linarith\n          have e2: \"frame_time_to_window (cur_ttbl as) (window_id as + 1) < frame_length (cur_ttbl as)\"\n            by (metis b2 b6 e1 frame_time_to_window_mono_strict frame_time_to_window_total)\n          have e3: \"frame_time a < frame_length (a_cur_ttbl a) - 1\"\n            unfolding b3\n            by (metis add_gr_0 b2 b6 e2 frame_length.simps(1) frame_time_to_window_mono_strict\n                      frame_time_to_window_zero length_greater_0_conv less_imp_diff_less\n                      less_numeral_extra(1) minus_eq nat_less_cases' wpos)\n          have e4: \"frame_time a \\<noteq> frame_length (a_cur_ttbl a) - 1\"\n            using e3 by auto\n          have e5: \"fst (spec_atick a) = a\\<lparr>frame_time := (frame_time a + 1) mod frame_length (a_cur_ttbl a),\n                                           wchain := spec_watchdog_tick (wchain a)\\<rparr>\"\n            using b5 e4 by (auto simp add: spec_atick_def to_switch_def NEXT_FRAME)\n          have e6: \"fst (spec_watchdog_tick_system (as, aw)) =\n            (as\\<lparr>window_id := Suc (window_id as) mod length (cur_ttbl as)\\<rparr>,\n             (spec_watchdog_tick aw)(0 \\<mapsto> snd (next_pair as)))\"\n            using b5 False by (auto simp add: NEXT_FRAME Some wpos spec_dispatch_def)\n          have e7: \"next_pair as = cur_ttbl as ! (Suc (window_id as) mod length (cur_ttbl as))\"\n            using b5 False by (auto simp add: next_pair_def NEXT_FRAME)\n          have e8: \"cur_ttbl (as\\<lparr>window_id := Suc (window_id as) mod length (cur_ttbl as)\\<rparr>) = cur_ttbl as\"\n            unfolding cur_ttbl_def by auto\n          show ?thesis\n            unfolding e5 e6 e7 using arel.simps apply auto\n            subgoal using Some assms(1) by auto\n            subgoal unfolding b3 wpos e8 b2 apply auto apply (rule a)\n              using b3 wpos b2 by auto\n            subgoal using Some assms(1) by auto\n            subgoal using Some assms(1) by auto\n            subgoal using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n            subgoal using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n            done\n        qed\n      next\n        case ONGOING\n        show ?thesis\n        proof (cases \"window_id as = length (cur_ttbl as) - 1\")\n          case True\n          have e1: \"frame_time a = frame_length (a_cur_ttbl a) - 1\"\n            unfolding b3 True wpos apply auto\n            by (metis One_nat_def Suc_diff_1 b2 b7 frame_time_to_window_total gr_zeroI not_less_zero)\n          have e2: \"fst (spec_atick a) = a\\<lparr>frame_time := 0, a_next_mode := NO_SWITCH,\n                                           wchain := spec_watchdog_tick (wchain a)\\<rparr>\"\n            unfolding spec_atick_def to_switch_def e1 ONGOING b5 by auto\n          have e3: \"fst (spec_watchdog_tick_system (as, aw)) =\n            (as\\<lparr>window_id := 0, astate_scheduler.next_mode := NO_SWITCH\\<rparr>,\n             (spec_watchdog_tick aw)(0 \\<mapsto> snd (next_pair as)))\"\n            using b5 by (auto simp add: Some wpos spec_dispatch_def ONGOING True)\n          have e4: \"next_pair as = cur_ttbl as ! 0\"\n            using b5 by (auto simp add: next_pair_def ONGOING True)\n          show ?thesis\n            unfolding e2 e3 e4 using arel.simps apply (auto simp add: cur_ttbl_def)\n            using assms(1) Some apply auto[1]\n            using b10 cur_ttbl_def\n             apply (metis (no_types, lifting) One_nat_def Suc_diff_1 Suc_eq_plus1 True a b2 b3\n                diff_is_0_eq e1 g1 g3 mod_self wpos)\n            using Some assms(1) apply auto[1]\n            using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n        next\n          case False\n          have e1: \"window_id as + 1 < length (cur_ttbl as)\"\n            using False b7 by linarith\n          have e2: \"frame_time_to_window (cur_ttbl as) (window_id as + 1) < frame_length (cur_ttbl as)\"\n            by (metis b2 b6 e1 frame_time_to_window_mono_strict frame_time_to_window_total)\n          have e3: \"frame_time a < frame_length (a_cur_ttbl a) - 1\"\n            unfolding b3\n            by (metis add_gr_0 b2 b6 e2 frame_length.simps(1) frame_time_to_window_mono_strict\n                      frame_time_to_window_zero length_greater_0_conv less_imp_diff_less\n                      less_numeral_extra(1) minus_eq nat_less_cases' wpos)\n          have e4: \"frame_time a \\<noteq> frame_length (a_cur_ttbl a) - 1\"\n            using e3 by auto\n          have e5: \"fst (spec_atick a) = a\\<lparr>frame_time := (frame_time a + 1) mod frame_length (a_cur_ttbl a),\n                                           wchain := spec_watchdog_tick (wchain a)\\<rparr>\"\n            using b5 e4 by (auto simp add: spec_atick_def to_switch_def ONGOING)\n          have e6: \"fst (spec_watchdog_tick_system (as, aw)) =\n            (as\\<lparr>window_id := Suc (window_id as) mod length (cur_ttbl as)\\<rparr>,\n             (spec_watchdog_tick aw)(0 \\<mapsto> snd (next_pair as)))\"\n            using b5 False by (auto simp add: ONGOING Some wpos spec_dispatch_def)\n          have e7: \"next_pair as = cur_ttbl as ! (Suc (window_id as) mod length (cur_ttbl as))\"\n            using b5 False by (auto simp add: next_pair_def ONGOING)\n          have e8: \"cur_ttbl (as\\<lparr>window_id := Suc (window_id as) mod length (cur_ttbl as)\\<rparr>) = cur_ttbl as\"\n            unfolding cur_ttbl_def by auto\n          show ?thesis\n            unfolding e5 e6 e7 using arel.simps apply auto\n            subgoal using Some assms(1) by auto\n            subgoal unfolding b3 wpos e8 b2 apply auto apply (rule a)\n              using b3 wpos b2 by auto\n            subgoal using Some assms(1) by auto\n            subgoal using Some assms(1) by auto\n            subgoal using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n            subgoal using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n            done\n        qed\n      qed\n    next\n      case False\n      have d1: \"\\<not>at_window_boundary (a_cur_ttbl a) (frame_time a)\"\n        using b4 False by auto\n      have d2: \"at_window_boundary (a_cur_ttbl a) (frame_length (a_cur_ttbl a) - 1)\"\n        apply (rule at_frame_boundary_also_window_boundary)\n        by (rule b6)\n      have d3: \"frame_time a \\<noteq> frame_length (a_cur_ttbl a) - 1\"\n        using d1 d2 by auto\n      have d4: \"\\<not>to_switch a\"\n        unfolding to_switch_def apply (cases \"a_next_mode a\")\n        using False d3 by (auto simp add: assms(3) b4 b5)\n      have d5: \"fst (spec_atick a) = a\\<lparr>frame_time := (frame_time a + 1) mod frame_length (a_cur_ttbl a),\n                                       wchain := spec_watchdog_tick (wchain a)\\<rparr>\"\n        unfolding spec_atick_def using d3 d4 by auto\n      have d6: \"fst (spec_watchdog_tick_system (as, aw)) = (as, spec_watchdog_tick aw)\"\n        using Some False by auto\n      have d7: \"wpos > 1\"\n        using False b1(1) nat_neq_iff by blast\n      have d8: \"spec_watchdog_tick aw 0 = Some (wpos - 1)\"\n        unfolding spec_watchdog_tick_def using Some d7 by auto\n      have d9: \"frame_time_to_window (cur_ttbl as) (Suc (window_id as)) \\<ge> wpos\"\n        apply (auto simp add: frame_time_to_window_next b7)\n        using b1(2) by auto\n      have d10: \"frame_time_to_window (cur_ttbl as) (Suc (window_id as)) \\<le> frame_length (cur_ttbl as)\"\n        by (metis Suc_leI b7 frame_time_to_window_mono frame_time_to_window_total)\n      show ?thesis\n        unfolding d5 d6 using arel.simps\n        apply (auto simp add: d8)\n        subgoal using Some assms(1) by auto\n        subgoal unfolding b3 using b2 d10 d7 d9 by auto\n        subgoal using Some assms(1) by auto\n        subgoal using Some assms(1) by auto\n        subgoal using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n        subgoal using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n        done\n    qed\n  qed\nqed\n\ntheorem spec_atick_refines:\n  assumes \"arel a (as, aw)\"\n    and \"as_inv (as, aw)\"\n  shows \"arel (fst (spec_atick a)) (fst (spec_tick_system (as, aw)))\"\nproof (cases \"astate_scheduler.next_mode as = NEXT_TICK\")\n  case True\n  show ?thesis\n  proof (cases \"aw 0\")\n    case None\n    then show ?thesis using assms as_inv.simps by auto\n  next\n    case (Some wpos)\n    have a1: \"a_next_mode a = NEXT_TICK\"\n      using Some True assms(1) by (auto simp add: arel.simps)\n    have a2: \"to_switch a\"\n      by (auto simp add: to_switch_def a1)\n    have a3: \"fst (spec_atick a) =\n      \\<lparr>a_cur_ttbl_id = a_next_ttbl_id a, frame_time = 0, a_next_ttbl_id = 0, a_next_mode = ONGOING,\n       wchain = spec_watchdog_tick (wchain a)\\<rparr>\"\n      unfolding spec_atick_def using a2 by auto\n    have a4: \"fst (spec_tick_system (as, aw)) =\n      (\\<lparr>astate_scheduler.cur_ttbl_id = astate_scheduler.next_ttbl_id as, window_id = 0, reset = False, next_ttbl_id = 0, next_mode = ONGOING\\<rparr>,\n       (spec_watchdog_tick (aw(0 := None)))(0 \\<mapsto> snd (next_ttbl as ! 0)))\"\n      by (auto simp add: True spec_dispatch_def)\n    show ?thesis\n      unfolding a3 a4 using arel.simps\n      apply (auto simp add: cur_ttbl_def)\n      using Some assms(1) apply auto[1]\n      unfolding next_ttbl_def[symmetric]\n        apply (cases \"next_ttbl as\") apply auto\n        subgoal using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n        subgoal using Some assms(1) by (auto simp add: spec_watchdog_tick_def)\n        done\n  qed\nnext\n  case False\n  show ?thesis\n    using False assms spec_atick_refines1 by auto\nqed\n\ntheorem spec_atick_ainv1:\n  assumes \"arel a (as, aw)\"\n    and \"as_inv (as, aw)\"\n    and \"astate_scheduler.next_mode as \\<noteq> NEXT_TICK\"\n  shows \"as_inv (fst (spec_watchdog_tick_system (as, aw)))\"\nproof (cases \"aw 0\")\n  case None\n  then show ?thesis\n    using assms(2) by (auto simp add: as_inv.simps ainv_def)\nnext\n  case (Some wpos)\n  have g1: \"0 < snd (cur_ttbl as ! (Suc (window_id as) mod length (cur_ttbl as)))\"\n    by (metis (no_types, lifting) as_inv.simps assms(2) cur_ttbl_def global_state.ainv_def\n        window_time_pos global_state_axioms le_less_trans nat_Suc_less_le_imp\n        unique_euclidean_semiring_numeral_class.pos_mod_bound valid_time_table zero_less_Suc)\n  have g2: \"0 < snd (next_ttbl as ! 0)\"\n    by (metis One_nat_def Suc_lessD as_inv.simps assms(2) global_state.ainv_def global_state_axioms\n              is_valid_time_table.elims(2) next_ttbl_def valid_time_table window_time_pos)\n  have g3: \"0 < snd (cur_ttbl as ! 0)\"\n    using ainv_def assms(2) cur_ttbl_def valid_time_table window_time_pos as_inv.simps by fastforce\n  show ?thesis\n  proof (cases \"wpos = 1\")\n    case True\n    note wpos = True\n    show ?thesis\n    proof (cases \"astate_scheduler.next_mode as\")\n      case NO_SWITCH\n      then show ?thesis\n        using assms apply (auto simp add: spec_dispatch_def ainv_def cur_ttbl_def as_inv.simps)\n        subgoal by (simp add: length_ineq_not_Nil(1))\n        subgoal unfolding next_pair_def using g1 by auto\n        subgoal unfolding next_pair_def by (auto simp add: cur_ttbl_def)\n        subgoal by (simp add: Some wpos)\n        done\n    next\n      case NEXT_TICK\n      then show ?thesis\n        using assms(3) by blast\n    next\n      case NEXT_WINDOW\n      then show ?thesis\n        using assms apply (auto simp add: spec_dispatch_def ainv_def cur_ttbl_def as_inv.simps)\n        subgoal using True length_ineq_not_Nil(1) valid_time_table by auto\n        subgoal unfolding next_pair_def using g2 by auto\n        subgoal unfolding next_pair_def by (auto simp add: next_ttbl_def)\n        by (simp add: Some wpos)\n    next\n      case NEXT_FRAME\n      show ?thesis\n      proof (cases \"window_id as = length (cur_ttbl as) - 1\")\n        case True\n        then show ?thesis\n          using NEXT_FRAME assms apply (auto simp add: spec_dispatch_def ainv_def cur_ttbl_def as_inv.simps)\n          subgoal using valid_time_table by force\n          subgoal unfolding next_pair_def True using g2 by auto\n          subgoal unfolding next_pair_def True by (auto simp add: next_ttbl_def)\n          by (simp add: Some wpos)\n      next\n        case False\n        then show ?thesis\n          using NEXT_FRAME assms apply (auto simp add: spec_dispatch_def ainv_def cur_ttbl_def as_inv.simps)\n          subgoal unfolding next_pair_def using False g1 by auto\n          subgoal unfolding next_pair_def using False by (auto simp add: cur_ttbl_def)\n          by (simp add: Some wpos)\n      qed\n    next\n      case ONGOING\n      show ?thesis\n      proof (cases \"window_id as = length (cur_ttbl as) - 1\")\n        case True\n        then show ?thesis\n          using ONGOING assms apply (auto simp add: spec_dispatch_def ainv_def cur_ttbl_def as_inv.simps)\n          subgoal unfolding next_pair_def True using g3 by auto\n          subgoal unfolding next_pair_def True by (auto simp add: cur_ttbl_def)\n          by (simp add: Some wpos)\n      next\n        case False\n        then show ?thesis\n          using ONGOING assms apply (auto simp add: spec_dispatch_def ainv_def cur_ttbl_def as_inv.simps)\n          subgoal unfolding next_pair_def using False g1 by auto\n          subgoal unfolding next_pair_def using False by (auto simp add: cur_ttbl_def)\n          by (simp add: Some wpos)\n      qed\n    qed\n  next\n    case False\n    have a1: \"wpos > 1\"\n      using False assms(2) Some as_inv.simps by auto\n    have a2: \"spec_watchdog_tick aw 0 = Some (wpos - 1)\"\n      unfolding spec_watchdog_tick_def using Some a1 by auto\n    show ?thesis\n      using Some assms(2) False a2 by (auto simp add: ainv_def as_inv.simps)\n  qed\nqed\n\ntheorem spec_atick_ainv:\n  assumes \"arel a (as, aw)\"\n    and \"as_inv (as, aw)\"\n  shows \"as_inv (fst (spec_tick_system (as, aw)))\"\nproof (cases \"astate_scheduler.next_mode as = NEXT_TICK\")\n  case True\n  show ?thesis\n  proof (cases \"aw 0\")\n    case None\n    then show ?thesis using assms as_inv.simps by auto\n  next\n    case (Some wpos)\n    have a1: \"a_next_mode a = NEXT_TICK\"\n      using Some True assms(1) by (auto simp add: arel.simps)\n    have a2: \"to_switch a\"\n      by (auto simp add: to_switch_def a1)\n    have a4: \"fst (spec_tick_system (as, aw)) =\n      (\\<lparr>astate_scheduler.cur_ttbl_id = astate_scheduler.next_ttbl_id as, window_id = 0, reset = False, next_ttbl_id = 0, next_mode = ONGOING\\<rparr>,\n       (spec_watchdog_tick (aw(0 := None)))(0 \\<mapsto> snd (next_ttbl as ! 0)))\"\n      by (auto simp add: True spec_dispatch_def)\n    show ?thesis\n      unfolding a4 using assms Some apply (auto simp add: ainv_def next_ttbl_def cur_ttbl_def as_inv.simps)\n      using valid_time_table apply force\n      by (metis One_nat_def Suc_lessD is_valid_time_table.elims(2) valid_time_table window_time_pos)\n  qed\nnext\n  case False\n  then show ?thesis\n    using assms spec_atick_ainv1 by auto\nqed\n\ntheorem spec_atick_output1:\n  assumes \"arel a (as, aw)\"\n    and \"as_inv (as, aw)\"\n    and \"astate_scheduler.next_mode as \\<noteq> NEXT_TICK\"\n  shows \"snd (spec_atick a) = snd (spec_watchdog_tick_system (as, aw))\"\nproof (cases \"aw 0\")\n  case None\n  then show ?thesis using assms as_inv.simps by auto\nnext\n  case (Some wpos)\n  have b1: \"wpos > 0\" \"wpos \\<le> snd (cur_ttbl as ! window_id as)\"\n    using assms(2) Some as_inv.simps by auto\n  have b2: \"a_cur_ttbl a = cur_ttbl as\"\n    using assms(1) Some by (auto simp add: arel.simps cur_ttbl_def a_cur_ttbl_def)\n  have b3: \"frame_time a = frame_time_to_window (cur_ttbl as) (window_id as + 1) - wpos\"\n    using assms(1) Some by (auto simp add: arel.simps)\n  have b4: \"at_window_boundary (a_cur_ttbl a) (frame_time a) \\<longleftrightarrow> wpos = 1\"\n    unfolding b2 b3 apply (rule at_window_boundary_wpos)\n    using assms(2) b1 apply (auto simp add: ainv_def as_inv.simps)\n    using cur_ttbl_def valid_time_table by auto\n  have b5: \"a_next_mode a = astate_scheduler.next_mode as\"\n    using assms(1) Some by (auto simp add: arel.simps)\n  have b6: \"is_valid_time_table (a_cur_ttbl a)\"\n    using assms ainv_def b2 cur_ttbl_def valid_time_table as_inv.simps by auto\n  have b7: \"window_id as < length (cur_ttbl as)\"\n    using ainv_def assms(2) as_inv.simps by auto\n  show ?thesis\n  proof (cases \"wpos = 1\")\n    case True\n    note wpos = True\n    have c1: \"at_window_boundary (a_cur_ttbl a) (frame_time a)\"\n      using b4 True by auto\n    have c2: \"frame_time_to_window (cur_ttbl as) (window_id as + 1) - wpos + 1 =\n              frame_time_to_window (cur_ttbl as) (window_id as + 1)\"\n      apply simp unfolding frame_time_to_window_next\n      using True assms(2) frame_time_to_window_next window_time_pos\n            ainv_def b1(2) as_inv.simps by auto\n    have c2: \"length (cur_ttbl as) > 0\"\n      using assms(2) ainv_def b1(2) as_inv.simps by fastforce\n    have c3: \"partition_at_time (a_cur_ttbl a) ((frame_time a + 1) mod frame_length (a_cur_ttbl a)) =\n              fst (cur_ttbl as ! ((window_id as + 1) mod length (cur_ttbl as)))\"\n    proof (cases \"window_id as = length (cur_ttbl as) - 1\")\n      case True\n      have d1: \"(window_id as + 1) mod length (cur_ttbl as) = 0\"\n        using True\n        by (metis Suc_diff_1 Suc_eq_plus1 c2 mod_self)\n      have d2: \"frame_time_to_window (cur_ttbl as) (window_id as + 1) = frame_length (cur_ttbl as)\"\n        by (metis Suc_diff_1 Suc_eq_plus1 True c2 frame_time_to_window_total)\n      show ?thesis\n        unfolding b3 c1 d1\n        unfolding d2 b2\n        apply auto\n        using b2 b6 partition_at_time_frame_time_to_window valid_time_table_frame_length wpos by fastforce\n    next\n      case False\n      have d1: \"window_id as + 1 < length (cur_ttbl as)\"\n        using False assms(2)\n        using as_inv.simps global_state.ainv_def global_state_axioms less_diff_conv nat_less_cases' by blast\n      have d2: \"frame_time_to_window (cur_ttbl as) (window_id as + 1) < frame_length (cur_ttbl as)\"\n        by (metis b2 b6 d1 frame_time_to_window_mono_strict frame_time_to_window_total)\n      have d3: \"(window_id as + 1) mod length (cur_ttbl as) = window_id as + 1\"\n        using d1 by auto\n      have d4: \"frame_time_to_window (cur_ttbl as) (window_id as + 1) mod frame_length (cur_ttbl as) =\n                frame_time_to_window (cur_ttbl as) (window_id as + 1)\"\n        using d2 by auto\n      show ?thesis\n        unfolding b2 b3 c1 d3 d4\n        by (metis Suc_eq_plus1 add_diff_inverse_nat add_gr_0 b2 b6 c2 d1 d4\n                  frame_time_to_window_mono_strict frame_time_to_window_zero is_valid_time_table.elims(2)\n                  less_numeral_extra(3) less_one partition_at_time_frame_time_to_window plus_1_eq_Suc wpos)\n    qed\n    show ?thesis\n    proof (cases \"a_next_mode a\")\n      case NO_SWITCH\n      have e1: \"\\<not>to_switch a\"\n        unfolding to_switch_def using NO_SWITCH by auto\n      have e2: \"snd (spec_atick a) =\n        DISPATCH ` spec_watchdog_tick_ev (wchain a) \\<union>\n        {PARTITION (partition_at_time (a_cur_ttbl a) ((frame_time a + 1) mod frame_length (a_cur_ttbl a)))}\"\n        using NO_SWITCH c1 e1 by (auto simp add: spec_atick_def)\n      have e4: \"next_pair as = cur_ttbl as ! ((window_id as + 1) mod length (cur_ttbl as))\"\n        using b5 by (auto simp add: next_pair_def NO_SWITCH)\n      have e5: \"snd (spec_watchdog_tick_system (as, aw)) =\n        DISPATCH ` spec_watchdog_tick_ev aw - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair as))}\"\n        unfolding spec_watchdog_tick_system.simps Some wpos by auto\n      have e6: \"wchain a 0 = None\" \"(\\<forall>i>0. wchain a i = aw i)\"\n        using assms(1) unfolding arel.simps Some by auto\n      show ?thesis\n        unfolding e2 Some wpos e5 e4\n        using c3 apply auto\n        unfolding spec_watchdog_tick_ev_def using e6 apply auto\n        subgoal for x\n          apply (rule image_eqI[where x=x]) apply auto\n          by (metis One_nat_def Some neq0_conv wpos)\n        done\n    next\n      case NEXT_TICK\n      then show ?thesis\n        using assms(3) b5 by auto\n    next\n      case NEXT_WINDOW\n      have e1: \"to_switch a\"\n        unfolding to_switch_def using NEXT_WINDOW c1 by auto\n      have e2: \"snd (spec_atick a) =\n        DISPATCH ` spec_watchdog_tick_ev (wchain a) \\<union> {PARTITION (fst (a_next_ttbl a ! 0))}\"\n        unfolding spec_atick_def using e1 by auto\n      have e3: \"next_pair as = next_ttbl as ! 0\"\n        using NEXT_WINDOW b5 next_pair_def by auto\n      have e4: \"snd (spec_watchdog_tick_system (as, aw)) =\n        DISPATCH ` spec_watchdog_tick_ev aw - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair as))}\"\n        unfolding spec_watchdog_tick_system.simps Some wpos by auto\n      have e5: \"wchain a 0 = None\" \"(\\<forall>i>0. wchain a i = aw i)\"\n        using assms(1) unfolding arel.simps Some by auto\n      show ?thesis\n        unfolding e2 e3 e4\n        using Some a_next_ttbl_def assms(1) next_ttbl_def wpos apply (auto simp add: arel.simps)\n        unfolding spec_watchdog_tick_ev_def using e5 by auto\n    next\n      case NEXT_FRAME\n      show ?thesis\n      proof (cases \"window_id as = length (cur_ttbl as) - 1\")\n        case True\n        have e1: \"frame_time a = frame_length (a_cur_ttbl a) - 1\"\n          unfolding b3 True wpos apply auto\n          by (metis One_nat_def Suc_diff_1 b2 b7 frame_time_to_window_total gr_zeroI not_less_zero)\n        have e2: \"to_switch a\"\n          unfolding to_switch_def using NEXT_FRAME e1 by auto\n        have e3: \"snd (spec_atick a) =\n          DISPATCH ` spec_watchdog_tick_ev (wchain a) \\<union> {PARTITION (fst (a_next_ttbl a ! 0))}\"\n          unfolding spec_atick_def using e1 e2 by auto\n        have e4: \"next_pair as = next_ttbl as ! 0\"\n          using NEXT_FRAME b5 next_pair_def True by auto\n        have e5: \"snd (spec_watchdog_tick_system (as, aw)) =\n          DISPATCH ` spec_watchdog_tick_ev aw - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair as))}\"\n          unfolding spec_watchdog_tick_system.simps Some wpos by auto\n        have e6: \"wchain a 0 = None\" \"(\\<forall>i>0. wchain a i = aw i)\"\n          using assms(1) unfolding arel.simps Some by auto\n        show ?thesis\n          unfolding e3 e4 e5 Some wpos\n          using Some a_next_ttbl_def assms(1) next_ttbl_def apply (auto simp add: arel.simps)\n          unfolding spec_watchdog_tick_ev_def using e6 apply auto\n          subgoal for x\n            apply (rule image_eqI[where x=x]) apply auto\n            by (metis One_nat_def Some neq0_conv wpos)\n          done\n      next\n        case False\n        have e1: \"window_id as + 1 < length (cur_ttbl as)\"\n          using False b7 by linarith\n        have e2: \"frame_time_to_window (cur_ttbl as) (window_id as + 1) < frame_length (cur_ttbl as)\"\n          by (metis b2 b6 e1 frame_time_to_window_mono_strict frame_time_to_window_total)\n        have e3: \"frame_time a < frame_length (a_cur_ttbl a) - 1\"\n          unfolding b3\n          by (metis add_gr_0 b2 b6 e2 frame_length.simps(1) frame_time_to_window_mono_strict\n                    frame_time_to_window_zero length_greater_0_conv less_imp_diff_less\n                    less_numeral_extra(1) minus_eq nat_less_cases' wpos)\n        have e4: \"frame_time a \\<noteq> frame_length (a_cur_ttbl a) - 1\"\n          using e3 by auto\n        have e5: \"\\<not>to_switch a\"\n          unfolding to_switch_def using NEXT_FRAME e4 by auto\n        have e6: \"snd (spec_atick a) =\n          DISPATCH ` spec_watchdog_tick_ev (wchain a) \\<union>\n          {PARTITION (partition_at_time (a_cur_ttbl a) (Suc (frame_time a) mod frame_length (a_cur_ttbl a)))}\"\n          using NEXT_FRAME e5 c1 by (auto simp add: spec_atick_def)\n        have e7: \"next_pair as = cur_ttbl as ! ((window_id as + 1) mod length (cur_ttbl as))\"\n          using NEXT_FRAME b5 False by (auto simp add: next_pair_def)\n        have e8: \"snd (spec_watchdog_tick_system (as, aw)) =\n          DISPATCH ` spec_watchdog_tick_ev aw - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair as))}\"\n          unfolding spec_watchdog_tick_system.simps Some wpos by auto\n        have e9: \"wchain a 0 = None\" \"(\\<forall>i>0. wchain a i = aw i)\"\n          using assms(1) unfolding arel.simps Some by auto\n        show ?thesis\n          unfolding e6 e7 e8 Some wpos\n          using c3 apply auto\n          using assms(1) e9 apply (auto simp add: spec_watchdog_tick_ev_def arel.simps)\n          subgoal for x\n            apply (rule image_eqI[where x=x]) apply auto\n            by (metis One_nat_def Some neq0_conv wpos)\n          done\n      qed\n    next\n      case ONGOING\n      show ?thesis\n      proof (cases \"window_id as = length (cur_ttbl as) - 1\")\n        case True\n        have e1: \"frame_time a = frame_length (a_cur_ttbl a) - 1\"\n          unfolding b3 True wpos apply auto\n          by (metis One_nat_def Suc_diff_1 b2 b7 frame_time_to_window_total gr_zeroI not_less_zero)\n        have e2: \"\\<not>to_switch a\"\n          unfolding to_switch_def using ONGOING e1 by auto\n        have e3: \"snd (spec_atick a) =\n          DISPATCH ` spec_watchdog_tick_ev (wchain a) \\<union> {PARTITION (fst (a_cur_ttbl a ! 0))}\"\n          unfolding spec_atick_def using e1 e2 ONGOING by auto\n        have e4: \"next_pair as = cur_ttbl as ! 0\"\n          using ONGOING b5 next_pair_def True by auto\n        have e5: \"snd (spec_watchdog_tick_system (as, aw)) =\n          DISPATCH ` spec_watchdog_tick_ev aw - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair as))}\"\n          unfolding spec_watchdog_tick_system.simps Some wpos by auto\n        have e6: \"wchain a 0 = None\" \"(\\<forall>i>0. wchain a i = aw i)\"\n          using assms(1) unfolding arel.simps Some by auto\n        show ?thesis\n          unfolding e3 e4 e5 Some wpos\n          using Some a_cur_ttbl_def assms(1) cur_ttbl_def apply (auto simp add: arel.simps)\n          unfolding spec_watchdog_tick_ev_def using e6 apply auto\n          subgoal for x\n            apply (rule image_eqI[where x=x]) apply auto\n            by (metis One_nat_def Some neq0_conv wpos)\n          done\n      next\n        case False\n        have e1: \"window_id as + 1 < length (cur_ttbl as)\"\n          using False b7 by linarith\n        have e2: \"frame_time_to_window (cur_ttbl as) (window_id as + 1) < frame_length (cur_ttbl as)\"\n          by (metis b2 b6 e1 frame_time_to_window_mono_strict frame_time_to_window_total)\n        have e3: \"frame_time a < frame_length (a_cur_ttbl a) - 1\"\n          unfolding b3\n          by (metis add_gr_0 b2 b6 e2 frame_length.simps(1) frame_time_to_window_mono_strict\n                    frame_time_to_window_zero length_greater_0_conv less_imp_diff_less\n                    less_numeral_extra(1) minus_eq nat_less_cases' wpos)\n        have e4: \"frame_time a \\<noteq> frame_length (a_cur_ttbl a) - 1\"\n          using e3 by auto\n        have e5: \"\\<not>to_switch a\"\n          unfolding to_switch_def using ONGOING e4 by auto\n        have e6: \"snd (spec_atick a) =\n          DISPATCH ` spec_watchdog_tick_ev (wchain a) \\<union>\n          {PARTITION (partition_at_time (a_cur_ttbl a) (Suc (frame_time a) mod frame_length (a_cur_ttbl a)))}\"\n          using ONGOING e5 e4 c1 by (auto simp add: spec_atick_def)\n        have e7: \"next_pair as = cur_ttbl as ! ((window_id as + 1) mod length (cur_ttbl as))\"\n          using ONGOING b5 False by (auto simp add: next_pair_def)\n        have e8: \"snd (spec_watchdog_tick_system (as, aw)) =\n          DISPATCH ` spec_watchdog_tick_ev aw - {DISPATCH 0} \\<union> {PARTITION (fst (next_pair as))}\"\n          unfolding spec_watchdog_tick_system.simps Some wpos by auto\n        have e9: \"wchain a 0 = None\" \"(\\<forall>i>0. wchain a i = aw i)\"\n          using assms(1) unfolding arel.simps Some by auto\n        show ?thesis\n          unfolding e6 e7 e8 Some wpos\n          using c3 apply auto\n          using assms(1) e9 apply (auto simp add: spec_watchdog_tick_ev_def arel.simps)\n          subgoal for x\n            apply (rule image_eqI[where x=x]) apply auto\n            by (metis One_nat_def Some neq0_conv wpos)\n          done\n      qed\n    qed\n  next\n    case False\n    have d1: \"\\<not>at_window_boundary (a_cur_ttbl a) (frame_time a)\"\n      using b4 False by auto\n    have d2: \"at_window_boundary (a_cur_ttbl a) (frame_length (a_cur_ttbl a) - 1)\"\n      apply (rule at_frame_boundary_also_window_boundary)\n      by (rule b6)\n    have d3: \"frame_time a \\<noteq> frame_length (a_cur_ttbl a) - 1\"\n      using d1 d2 by auto\n    have d4: \"wchain a 0 = None\" \"(\\<forall>i>0. wchain a i = aw i)\"\n      using assms(1) unfolding arel.simps Some by auto\n    show ?thesis\n      using False d3 apply (auto simp add: Some spec_atick_def d1 d3 to_switch_def)\n          apply (cases \"a_next_mode a\") apply (auto simp add: d1 b5 assms(3))\n      unfolding spec_watchdog_tick_ev_def using d4 apply auto\n      subgoal for x\n        apply (rule image_eqI[where x=x]) apply auto\n        by (metis neq0_conv option.distinct(1))\n      subgoal for x\n        by (metis (full_types, lifting) Some imageI mem_Collect_eq not_gr_zero option.inject)\n      subgoal for x\n        apply (rule image_eqI[where x=x]) apply auto\n        by (metis neq0_conv option.distinct(1))\n      subgoal for x\n        apply (rule image_eqI[where x=x]) apply auto\n        by (metis Some neq0_conv option.inject)\n      done\n  qed\nqed\n\ntheorem spec_atick_output:\n  assumes \"arel a (as, aw)\"\n    and \"as_inv (as, aw)\"\n  shows \"snd (spec_atick a) = snd (spec_tick_system (as, aw))\"\nproof (cases \"astate_scheduler.next_mode as = NEXT_TICK\")\n  case True\n  show ?thesis\n  proof (cases \"aw 0\")\n    case None\n    then show ?thesis using assms(1) unfolding arel.simps by auto\n  next\n    case (Some wpos)\n    have a1: \"a_next_mode a = NEXT_TICK\"\n      using Some True assms(1) by (auto simp add: arel.simps)\n    have a2: \"to_switch a\"\n      by (auto simp add: to_switch_def a1)\n    have a3: \"snd (spec_atick a) =\n      DISPATCH ` spec_watchdog_tick_ev (wchain a) \\<union> {PARTITION (fst (a_next_ttbl a ! 0))}\"\n      by (auto simp add: spec_atick_def a2)\n    have a4: \"snd (spec_tick_system (as, aw)) =\n      (DISPATCH ` spec_watchdog_tick_ev aw) - {DISPATCH 0} \\<union> {PARTITION (fst (next_ttbl as ! 0))}\"\n      by (auto simp add: True)\n    have a5: \"wchain a 0 = None\" \"(\\<forall>i>0. wchain a i = aw i)\"\n      using assms(1) unfolding arel.simps Some by auto\n    have a6: \"a_next_ttbl a = next_ttbl as\"\n      using Some a_next_ttbl_def arel.simps assms(1) next_ttbl_def by auto\n    show ?thesis\n      unfolding a3 a4 using a5 a6 apply (auto simp add: spec_watchdog_tick_ev_def)\n      subgoal for x\n        apply (rule image_eqI[where x=x])\n         apply auto by (metis gt_or_eq_0 option.simps(3))\n      done\n  qed\nnext\n  case False\n  then show ?thesis\n    using assms(1) assms(2) spec_atick_output1 by auto\nqed\n\nfun arel_full :: \"astate \\<Rightarrow> cstate \\<times> watchdog_chain \\<Rightarrow> bool\" where\n  \"arel_full a p \\<longleftrightarrow> (\\<exists>as aw. arel a (as, aw) \\<and> as_inv (as, aw) \\<and> rel_total (as, aw) p)\"\n\ntheorem sValidNF_watchdog_tick_full:\n  \"sValidNF system\n    (\\<lambda>p es. arel_full a p \\<and> nil\\<^sub>e es)\n      TICK\n    (\\<lambda>p es. arel_full (fst (spec_atick a)) p \\<and> distinct es \\<and> set es = snd (spec_atick a))\"\n  unfolding arel_full.simps\n  apply (auto simp only: sValidNF_exists_pre)\n  subgoal for as aw\n    apply (auto simp add: sValidNF_conj_pre)\n    apply (rule sValidNF_strengthen_post)\n    prefer 2\n     apply (rule sValidNF_tick)\n     apply (auto simp add: as_inv.simps)[1] apply (cases \"aw 0\") apply auto[1] apply auto[1]\n    subgoal for p es\n      apply (intro conjI)\n      subgoal  \n      apply (rule exI[where x=\"fst (fst (spec_tick_system (as, aw)))\"])\n        apply (rule exI[where x=\"snd (fst (spec_tick_system (as, aw)))\"])\n        using spec_atick_ainv spec_atick_refines by auto\n      using spec_atick_output by auto\n    done\n  done\n\nend\n\nend\n", "meta": {"author": "bzhan", "repo": "EventSystem", "sha": "3499867fd8fbf9b8d6acf80a0791f279b553ce15", "save_path": "github-repos/isabelle/bzhan-EventSystem", "path": "github-repos/isabelle/bzhan-EventSystem/EventSystem-3499867fd8fbf9b8d6acf80a0791f279b553ce15/EventSystemSwitch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7490872131147275, "lm_q2_score": 0.4493926344647597, "lm_q1q2_score": 0.33663427614549224}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      ProcParEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Examples for Procedures as Parameters\"\n\ntheory ProcParEx imports \"../Vcg\" begin\n\n\n\n\n\nlemma conseq_exploit_pre':\n             \"\\<lbrakk>\\<forall>s \\<in> S. \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile> (P \\<inter> S)c Q,A\"\n  apply (rule HoarePartialDef.Conseq)\n  apply clarify\n  by (metis IntI insertI1 subset_refl)\n\n\nlemma conseq_exploit_pre'':\n             \"\\<lbrakk>\\<forall>Z. \\<forall>s \\<in> S Z.  \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P Z) c (Q Z),(A Z)\\<rbrakk>\n              \\<Longrightarrow>\n              \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile> (P Z \\<inter> S Z)c (Q Z),(A Z)\"\n  apply (rule allI)\n  apply (rule conseq_exploit_pre')\n  apply blast\n  done\n\nlemma conseq_exploit_pre''':\n             \"\\<lbrakk>\\<forall>s \\<in> S. \\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P Z) c (Q Z),(A Z)\\<rbrakk>\n              \\<Longrightarrow>\n              \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile> (P Z \\<inter> S)c (Q Z),(A Z)\"\n  apply (rule allI)\n  apply (rule conseq_exploit_pre')\n  apply blast\n  done\n\n\n\nrecord 'g vars = \"'g state\" +\n  compare_' :: string\n  n_'   :: nat\n  m_'   :: nat\n  b_'   :: bool\n  k_'  :: nat\n\n\n\nprocedures compare(n,m|b) = \"NoBody\"\nprint_locale! compare_signature\n\n\ncontext compare_signature\nbegin\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\<acute>b :== CALL compare(\\<acute>n,\\<acute>m)\"\nterm \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m)\"\ndeclare [[hoare_use_call_tr' = true]]\nterm \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m)\"\nend\n\n\nprocedures\n  LEQ (n,m | b) = \"\\<acute>b :== \\<acute>n \\<le> \\<acute>m\"\n  LEQ_spec: \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>}  PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) \\<lbrace>\\<acute>b = (\\<^bsup>\\<sigma>\\<^esup>n \\<le> \\<^bsup>\\<sigma>\\<^esup>m)\\<rbrace>\"\n  LEQ_modifies: \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) {t. t may_only_modify_globals \\<sigma> in []}\"\n\n\n\ndefinition mx:: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  where \"mx leq a b = (if leq a b then a else b)\"\n\nprocedures\n  Max (compare, n, m | k) =\n  \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m);;\n   IF \\<acute>b THEN \\<acute>k :== \\<acute>n ELSE \\<acute>k :== \\<acute>m FI\"\n\n  Max_spec: \"\\<And>leq. \\<forall>\\<sigma>. \\<Gamma>\\<turnstile>\n  ({\\<sigma>} \\<inter> {s. (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and>\n              (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})})\n    PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m,\\<acute>k)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\n\n\nlemma (in Max_impl ) Max_spec1:\nshows\n\"\\<forall>\\<sigma> leq. \\<Gamma>\\<turnstile>\n  ({\\<sigma>} \\<inter> \\<lbrace> (\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and>\n      (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\nproof -\n  fix \\<sigma>:: \"('a,'b) vars_scheme\" and s::\"('a,'b) vars_scheme\" and leq\n   assume compare_spec:\n       \"\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m\\<rbrace>\"\n\n  assume compare_modifies:\n        \"\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m)\n                {t. t may_only_modify_globals \\<tau> in []}\"\n\n   show \"\\<Gamma>\\<turnstile>({s} \\<inter> {\\<sigma>})\n            \\<acute>b :== DYNCALL \\<acute>compare (\\<acute>n,\\<acute>m);;\n            IF \\<acute>b THEN \\<acute>k :== \\<acute>n ELSE \\<acute>k :== \\<acute>m FI\n            \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\n     apply vcg\n     apply (clarsimp simp add: mx_def)\n     done\n qed\n\n\nlemma (in Max_impl) Max_spec2:\nshows\n\"\\<forall>\\<sigma> leq. \\<Gamma>\\<turnstile>\n  ({\\<sigma>} \\<inter> \\<lbrace>(\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and>\n      (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in Max_impl) Max_spec3:\nshows\n\"\\<forall>n m leq. \\<Gamma>\\<turnstile>\n  (\\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace>  \\<inter>\n   \\<lbrace>(\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and>\n     (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq n m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\n\n\nlocale Max_test = Max_spec + LEQ_spec + LEQ_modifies\nlemma (in Max_test)\n\n  shows\n  \"\\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>k :== CALL Max(LEQ_'proc,\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>k = mx (\\<le>) \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\nproof -\n  note Max_spec = Max_spec [where leq=\"(\\<le>)\"]\n  show ?thesis\n    apply vcg\n    apply (clarsimp)\n    apply (rule conjI)\n    apply (rule LEQ_spec [simplified])\n    apply (rule LEQ_modifies [simplified])\n    done\nqed\n\n\nlemma (in Max_impl) Max_spec5:\nshows\n\"\\<forall>n m leq. \\<Gamma>\\<turnstile>\n  (\\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace> \\<inter> \\<lbrace>\\<forall>n' m'. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n' \\<and> \\<acute>m=m'\\<rbrace> \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq n' m')\\<rbrace>\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq n m\\<rbrace>\"\nterm \"\\<lbrace>{s. \\<^bsup>s\\<^esup>n = n' \\<and> \\<^bsup>s\\<^esup>m = m'} = X\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply clarsimp\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in LEQ_impl)\n LEQ_spec: \"\\<forall>n m. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace>  PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) \\<lbrace>\\<acute>b = (n \\<le> m)\\<rbrace>\"\n  apply vcg\n  done\n\n\nlocale Max_test' = Max_impl + LEQ_impl\nlemma (in Max_test')\n  shows\n  \"\\<forall>n m. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace> \\<acute>k :== CALL Max(LEQ_'proc,\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>k = mx (\\<le>) n m\\<rbrace>\"\nproof -\n  note Max_spec = Max_spec5\n  show ?thesis\n    apply vcg\n    apply (rule_tac x=\"(\\<le>)\" in exI)\n    apply clarsimp\n    apply (rule LEQ_spec [rule_format])\n    done\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/ex/ProcParEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3366314176512292}}
{"text": "theory Pattern\n  imports OperatorAmbiguity DerivationTrees1 DerivationTrees_Ambiguity\n\nbegin\ntype_synonym ('a, 'b) pattern = \"(('a, 'b) symbol \\<times> ('a, 'b) symbol list \\<times> ('a, 'b) symbol list \\<times> ('a, 'b) symbol list)\"\n\nlocale Pattern  = OperatorAmbiguity +\n  fixes \\<P> :: \"('a, 'b) pattern set\"\n  assumes Pattern_valid: \"\\<forall>(s, r1, r1' , r2) \\<in> \\<P> . (s, r2) \\<in> \\<RR> \\<and> (s, r1@r1') \\<in> \\<RR>\"\n  assumes Pattern_safety:\"\\<forall>(s, r1, r1', r2) \\<in> \\<P> . ((s, r2), (s, r1@r1')) \\<in> (Priority \\<union> Left \\<union> Right)\" (*possibly stronger specification needed*)\n  assumes Pattern_right_left:\"\\<forall>(s, r1, r1', r2) \\<in> \\<P> . r1 = [] \\<or> r1' = [s]\"\n  assumes Pattern_nonempty:\"\\<P> \\<noteq> {}\" (*seemed necessary*)\nbegin \n(*should prove for pattern that this is equivalent to either the disambiguation system in either Derivation Trees or LeftDerivations*)\n(*prove validity of tree accoording to pattern*)\nfun containsRule::\"('a, 'b) derivtree \\<Rightarrow> ('a, 'b) rule \\<Rightarrow> bool\" where\n\"containsRule (DT r' b) r = (if r' = r then True else (\\<exists> t \\<in> set b . containsRule t r))\"|\n\"containsRule _ _= False\"\nfun filtered::\"('a, 'b) derivtree \\<Rightarrow> ('a, 'b)rule \\<Rightarrow> bool\" where\n\"filtered T r= (\\<not>(containsRule T r))\"\n\nfun patterns::\"('a, 'b) rule \\<Rightarrow> ('a, 'b) pattern set\" where\n\"patterns r = {(s, r1, r1', r2) \\<in> \\<P> . (s, r1@r1') = r}\"\n\n(*definition via all patterns?*)\n\nfun valid_root_pattern::\"('a, 'b) pattern \\<Rightarrow> ('a, 'b) derivtree \\<Rightarrow> bool\" where\n\"valid_root_pattern (s, r1, r1', r2)  (DT r b) = (if (s, r1@r1') = r then \n  (filtered (b ! (length r1)) (s, r2)) else True)\" |\n\"valid_root_pattern _ _ = True\"\n\nfun valid_tree_pattern::\"('a, 'b) pattern \\<Rightarrow> ('a, 'b) derivtree \\<Rightarrow> bool\" where\n\"valid_tree_pattern p (DT r b) = (valid_root_pattern p (DT r b) \\<and> list_all (valid_tree_pattern p) b) \"|\n\"valid_tree_pattern p _ = True\"\n\nfun valid_tree1::\"('a, 'b) derivtree \\<Rightarrow> bool\" where \n\"valid_tree1 T = (\\<forall> p \\<in> \\<P> . valid_tree_pattern p T)\"\n\nfun valid_tree::\"('a, 'b) derivtree \\<Rightarrow> bool\" where\n\"valid_tree (DT r b)  = (\\<forall> p \\<in> \\<P> . valid_root_pattern p (DT r b) \\<and> (\\<forall> t \\<in> set b . valid_tree t))\"|\n\"valid_tree _ = True\"\n\n(*have to add tree wellformed to ensure that there actually exist the needed values*)\nlemma  exclusion_implies_patterns:\"Tree_wf x \\<Longrightarrow> \\<not> valid_tree x \\<Longrightarrow> \\<exists>a aa ab b. (a, aa, ab, b) \\<in> \\<P>\"\nproof(induction x)\n  case (Leaf x)\n  then show ?case by auto\nnext\n  case (Inner x)\n  then show ?case by auto\nnext\n  case (DT r b)\n  from DT.prems have \"\\<exists> p \\<in> \\<P> . \\<not> valid_root_pattern p (DT r b) \\<or> (\\<exists> t \\<in> set b . \\<not> valid_tree t)\" by auto\n  {\n    assume \"\\<exists> p \\<in> \\<P> . \\<not> valid_root_pattern p (DT r b)\"\n    then obtain p where \"\\<not> valid_root_pattern p (DT r  b)\" by blast\n    then have \" \\<exists>a aa ab b. (a, aa, ab, b) \\<in> \\<P>\" sorry (*probably has to be based on wellformedness*)\n  }\n   show ?case sorry\nqed\nsection \"leftrecursive Ea \\<Longrightarrow> rightrecursive bE \\<Longrightarrow> valid_pattern Ea bE \\<Longrightarrow> if a d\nerivation is banned by this pattern, it is also banned by the operator ambiguity scheme\"\nlemma caseDT:\"\\<not> (leftconflictfree r s) \\<Longrightarrow> s = (DT r' b')\"\n  sorry  \nlemma soundness_root:\"\\<forall> p \\<in> \\<P>. valid_root_pattern p T \\<Longrightarrow> conflictfree_root T\" \nproof (induction T)\n  case (Leaf x)\n  then show ?case by auto\nnext\n  case (Inner x)\n  then show ?case by auto\nnext\n  case (DT r b)\n  {assume L1:\"\\<not> conflictfree_root (DT r b)\"\n  then have \"(\\<exists> s \\<in> set (leftspine1 (DT r b)) .  \\<not> (leftconflictfree r s)) \\<or> \n             (\\<exists> s \\<in> set (rightspine1 (DT r b)) .  \\<not> (rightconflictfree r s))\" by auto\n  (*assume \"(\\<exists> s \\<in> set (leftspine1 (DT r b)) .  \\<not> (leftconflictfree r s))\"\n  then obtain s where child:\"s \\<in> set (leftspine1 (DT r b))\" and conflict:\"(\\<not> (leftconflictfree r s))\" by blast\n  from conflict obtain r' where \"s = (DT r' b')\" using caseDT by blast\n  with conflict have \"(r, r') \\<in> (Priority \\<union> Left)\" by simp\n  *) (*need additional case distinction on rightspine/leftspine*)\n  have \"(\\<exists> p \\<in> \\<P> . \\<not> valid_root_pattern p (DT r b))\" sorry\n}\n  from this have \"\\<forall> p \\<in> \\<P>. valid_root_pattern p (DT r b) \\<Longrightarrow> conflictfree_root (DT r b)\" by fast\n  (*need to construct that r' is contained in subtree under pattern and therefore a violation*)\n  with DT.prems show ?case by blast\nqed\n  \n\nsubsection \"Equivalence proof with regards to rotation system\"\nlemma pattern_soundness:\"valid_tree T \\<Longrightarrow> conflict_free T\"\nproof (induction T)\n  case (Leaf x)\n  then show ?case by auto\nnext\n  case (Inner x)\n  then show ?case by auto\nnext\n  case (DT r b)\n  {assume L1:\"\\<not> conflict_free (DT r b)\"\n  then have assms:\"\\<not> (conflictfree_root (DT r b) \\<or> (\\<exists> subtree \\<in> set b . \\<not> conflict_free subtree))\" sorry\n  {assume \"\\<not> (conflictfree_root (DT r b))\"\n    with soundness_root have \"(\\<exists> p \\<in> \\<P> . \\<not> valid_root_pattern p (DT r b))\" by blast\n      then have \"\\<not> (valid_tree (DT r b))\" by auto\n  } \n  from this have 1:\"\\<not> (conflictfree_root (DT r b)) \\<Longrightarrow>  \\<not>(valid_tree (DT r b))\" by blast\n  {\n    assume \"(\\<exists> subtree \\<in> set b . \\<not> conflict_free subtree)\"\n    then obtain s where s:\"s \\<in> set b \\<and> \\<not> conflict_free s\" by blast\n    with DT.IH have \"\\<not> valid_tree s\" by blast\n    with s have \" (\\<exists> s \\<in> set b . \\<not> valid_tree s)\" by blast\n    from this have \"\\<not> (\\<forall> s \\<in> set b. valid_tree s)\" by blast\n    from this have \"\\<not> (valid_tree (DT r b))\"  apply(auto) using exclusion_implies_patterns sorry\n  }\n  with assms 1 have \"\\<not> (valid_tree (DT r b))\" by blast\n  }\n  with DT.prems show ?case by blast \nqed\n  \n(*proof by contradiction, assume a tree is not conflict free, then the conflict will also hurt the filtering assumption*)\n(*hat this is equivalent to either the disambiguation system in either Derivation Trees or LeftDerivations*)\nlemma pattern_completeness_root:\"conflictfree_root T \\<Longrightarrow> \\<forall> p \\<in> \\<P> . valid_root_pattern p T\"\nproof (induction T)\n  case (Leaf x)\n  then show ?case by auto\nnext\n  case (Inner x)\n  then show ?case by auto\nnext\n  case (DT r b)\n  {\n    assume \"\\<exists> p \\<in> \\<P> . \\<not> valid_root_pattern p T\" \n    then obtain p where \"\\<not> valid_root_pattern p T\" by blast\n    then have \"\\<not> conflictfree_root T\" sorry\n  }\n  then show ?case sorry\nqed\n\n\n(*? are the pattern definitions even correct*)\nlemma pattern_completeness:\"conflict_free T \\<Longrightarrow> valid_tree T\"\nproof (induction T)\n  case (Leaf x)\n  then show ?case by auto\nnext\n  case (Inner x)\n  then show ?case by auto\nnext\n  case (DT r b)\n  {\n    assume \"\\<not> valid_tree (DT r b)\"\n    from this have \"(\\<exists> p \\<in> \\<P> . \\<not> valid_root_pattern p (DT r b) \\<or> (\\<exists> t \\<in> set b . \\<not> valid_tree t))\" by simp\n    {\n      assume \"\\<exists> p \\<in> \\<P> . \\<not> valid_root_pattern p (DT r b)\" \n      then obtain p where \" \\<not> valid_root_pattern p (DT r b)\" by auto\n      then have \"\\<not> valid_tree (DT r b)\" sorry\n    }\n    then have \"\\<not> valid_tree (DT r b)\" sorry\n  }\n  show ?case sorry\nqed\n\n  subsection \"if banned by operator precedence ambiguity, patterns also ban this\"\nend\n", "meta": {"author": "LocalLexingParser", "repo": "LocalLexingParser", "sha": "243c0257ba20c9f9ec389a1883c640ace77d1bbc", "save_path": "github-repos/isabelle/LocalLexingParser-LocalLexingParser", "path": "github-repos/isabelle/LocalLexingParser-LocalLexingParser/LocalLexingParser-243c0257ba20c9f9ec389a1883c640ace77d1bbc/thys/Pattern.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3366314176512292}}
{"text": "(*  Title:      HOL/Imperative_HOL/Heap.thy\n    Author:     John Matthews, Galois Connections; Alexander Krauss, TU Muenchen\n*)\n\nsection \\<open>A polymorphic heap based on cantor encodings\\<close>\n\ntheory Heap\nimports Main \"HOL-Library.Countable\"\nbegin\n\nsubsection \\<open>Representable types\\<close>\n\ntext \\<open>The type class of representable types\\<close>\n\nclass heap = typerep + countable\n\ninstance unit :: heap ..\n\ninstance bool :: heap ..\n\ninstance nat :: heap ..\n\ninstance prod :: (heap, heap) heap ..\n\ninstance sum :: (heap, heap) heap ..\n\ninstance list :: (heap) heap ..\n\ninstance option :: (heap) heap ..\n\ninstance int :: heap ..\n\ninstance String.literal :: heap ..\n\ninstance char :: heap ..\n\ninstance typerep :: heap ..\n\n\nsubsection \\<open>A polymorphic heap with dynamic arrays and references\\<close>\n\ntext \\<open>\n  References and arrays are developed in parallel,\n  but keeping them separate makes some later proofs simpler.\n\\<close>\n\ntype_synonym addr = nat \\<comment> \\<open>untyped heap references\\<close>\ntype_synonym heap_rep = nat \\<comment> \\<open>representable values\\<close>\n\nrecord heap =\n  arrays :: \"typerep \\<Rightarrow> addr \\<Rightarrow> heap_rep list\"\n  refs :: \"typerep \\<Rightarrow> addr \\<Rightarrow> heap_rep\"\n  lim  :: addr\n\ndefinition empty :: heap where\n  \"empty = \\<lparr>arrays = (\\<lambda>_ _. []), refs = (\\<lambda>_ _. 0), lim = 0\\<rparr>\"\n\ndatatype 'a array = Array addr \\<comment> \\<open>note the phantom type 'a\\<close>\ndatatype 'a ref = Ref addr \\<comment> \\<open>note the phantom type 'a\\<close>\n\nprimrec addr_of_array :: \"'a array \\<Rightarrow> addr\" where\n  \"addr_of_array (Array x) = x\"\n\nprimrec addr_of_ref :: \"'a ref \\<Rightarrow> addr\" where\n  \"addr_of_ref (Ref x) = x\"\n\nlemma addr_of_array_inj [simp]:\n  \"addr_of_array a = addr_of_array a' \\<longleftrightarrow> a = a'\"\n  by (cases a, cases a') simp_all\n\nlemma addr_of_ref_inj [simp]:\n  \"addr_of_ref r = addr_of_ref r' \\<longleftrightarrow> r = r'\"\n  by (cases r, cases r') simp_all\n\ninstance array :: (type) countable\n  by (rule countable_classI [of addr_of_array]) simp\n\ninstance ref :: (type) countable\n  by (rule countable_classI [of addr_of_ref]) simp\n\ninstance array :: (type) heap ..\n\ninstance ref :: (type) heap ..\n\n\ntext \\<open>Syntactic convenience\\<close>\n\nsetup \\<open>\n  Sign.add_const_constraint (\\<^const_name>\\<open>Array\\<close>, SOME \\<^typ>\\<open>nat \\<Rightarrow> 'a::heap array\\<close>)\n  #> Sign.add_const_constraint (\\<^const_name>\\<open>Ref\\<close>, SOME \\<^typ>\\<open>nat \\<Rightarrow> 'a::heap ref\\<close>)\n  #> Sign.add_const_constraint (\\<^const_name>\\<open>addr_of_array\\<close>, SOME \\<^typ>\\<open>'a::heap array \\<Rightarrow> nat\\<close>)\n  #> Sign.add_const_constraint (\\<^const_name>\\<open>addr_of_ref\\<close>, SOME \\<^typ>\\<open>'a::heap ref \\<Rightarrow> nat\\<close>)\n\\<close>\n\nhide_const (open) empty\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Imperative_HOL/Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6477982315512489, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3365449936137329}}
{"text": "theory BPlusTree_SplitCE\n  imports \n  BPlusTree_Set\n  BPlusTree_Range\nbegin\n\nglobal_interpretation bplustree_linear_search_list: split_list linear_split_list\n  defines bplustree_ls_isin_list = bplustree_linear_search_list.isin_list\n  and bplustree_ls_insert_list = bplustree_linear_search_list.insert_list\n  and bplustree_ls_delete_list = bplustree_linear_search_list.delete_list\n  and bplustree_ls_lrange_list = bplustree_linear_search_list.lrange_split\n  apply unfold_locales\n  unfolding linear_split.simps\n    apply (auto split: list.splits)\n  subgoal\n    by (metis (no_types, lifting) case_prodD in_set_conv_decomp takeWhile_eq_all_conv takeWhile_idem)\n  subgoal\n    by (metis case_prod_conv hd_dropWhile le_less_linear list.sel(1) list.simps(3))\n  done\n\ndeclare bplustree_linear_search_list.isin_list.simps[code]\ndeclare bplustree_linear_search_list.insert_list.simps[code]\ndeclare bplustree_linear_search_list.delete_list.simps[code]\n\n(* interpretation bplustree_linear_search: split_tree linear_split\n  apply unfold_locales\n  unfolding linear_split.simps\n    apply (auto split: list.splits)\n  subgoal\n    by (metis (no_types, lifting) case_prodD in_set_conv_decomp takeWhile_eq_all_conv takeWhile_idem)\n  subgoal\n    by (metis case_prod_conv hd_dropWhile le_less_linear list.sel(1) list.simps(3))\n  done *)\n\nglobal_interpretation bplustree_linear_search:\n    split_full linear_split linear_split_list \n  (* the below definitions are required to be set here for evaluating example code... *)\n  defines bplustree_ls_isin = bplustree_linear_search.isin \n    and bplustree_ls_ins = bplustree_linear_search.ins\n    and bplustree_ls_insert = bplustree_linear_search.insert\n    and bplustree_ls_del = bplustree_linear_search.del\n    and bplustree_ls_delete = bplustree_linear_search.delete\n    and bplustree_ls_lrange = bplustree_linear_search.lrange\n  apply unfold_locales\n  unfolding linear_split.simps\n  subgoal by (auto split: list.splits)\n  subgoal\n    apply (auto split: list.splits)\n    by (metis (no_types, lifting) case_prodD in_set_conv_decomp takeWhile_eq_all_conv takeWhile_idem)\n  subgoal by (metis case_prod_conv hd_dropWhile le_less_linear list.sel(1) list.simps(3))\n  done\n\n\n\nlemma [code]: \"bplustree_ls_ins k x (Leaf ks) =\nbplustree_linear_search.Lnode\\<^sub>i k (bplustree_ls_insert_list x ks)\"\n  by (simp add: bplustree_ls_insert_list_def)\ndeclare bplustree_linear_search.ins.simps(2)[code]\n\nlemma [code]: \"bplustree_ls_del k x (Leaf ks) =\nLeaf (bplustree_ls_delete_list x ks)\"\n  by (simp add: bplustree_ls_delete_list_def)\ndeclare bplustree_linear_search.del.simps(2)[code]\n\nfind_theorems bplustree_ls_isin\n\ntext \"Some examples follow to show that the implementation works\n      and the above lemmas make sense. The examples are visualized in the thesis.\"\n\nabbreviation \"bplustree\\<^sub>q \\<equiv> bplustree_ls_isin\"\nabbreviation \"bplustree\\<^sub>i \\<equiv> bplustree_ls_insert\"\nabbreviation \"bplustree\\<^sub>d \\<equiv> bplustree_ls_delete\"\n\ndefinition \"uint8_max \\<equiv> 2^8-1::nat\"\ndeclare uint8_max_def[simp]\n\ntypedef uint8 = \"{n::nat. n \\<le> uint8_max}\" \n  by auto\n\nsetup_lifting type_definition_uint8\n\ninstantiation uint8 :: linorder\nbegin\n\nlift_definition less_eq_uint8 :: \"uint8 \\<Rightarrow> uint8 \\<Rightarrow> bool\"\n  is \"(less_eq::nat \\<Rightarrow> nat \\<Rightarrow> bool)\" .\n\nlift_definition less_uint8 :: \"uint8 \\<Rightarrow> uint8 \\<Rightarrow> bool\"\n  is \"(less::nat \\<Rightarrow> nat \\<Rightarrow> bool)\" .\n\ninstance\n  by standard (transfer; auto)+\nend\n\ninstantiation uint8 :: order_top\nbegin\n\nlift_definition top_uint8 :: uint8 is \"uint8_max::nat\"\n  by simp\n\n\ninstance \n  by standard (transfer; simp)\nend\n\n\ninstantiation uint8 :: numeral\nbegin\n\nlift_definition one_uint8 :: uint8 is \"1::nat\"\n  by auto\n\nlift_definition plus_uint8 :: \"uint8 \\<Rightarrow> uint8 \\<Rightarrow> uint8\"\n  is \"\\<lambda>a b. min (a + b) uint8_max\"\n  by simp\n\ninstance by standard (transfer; auto)\nend\n\ninstantiation uint8 :: equal\nbegin\n\nlift_definition equal_uint8 :: \"uint8 \\<Rightarrow> uint8 \\<Rightarrow> bool\"\n  is \"(=)\" .\n\ninstance by standard (transfer; auto)\nend\n\n\nvalue \"uint8_max\"\n\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [21,22,23]))) in\n      root_order k x\"\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [21,22,23]))) in\n      bal x\"\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [50,55,56]))) in\n      sorted_less (leaves x)\"\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [50,55,56]))) in\n      Laligned x top\"\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [50,55,56]))) in\n      x\"\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [50,55,56]))) in\n      bplustree\\<^sub>q x 4\"\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [50,55,56]))) in\n      bplustree\\<^sub>q x 20\"\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [50,55,56]))) in\n      bplustree\\<^sub>i k 9 x\"\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [50,55,56]))) in\n      bplustree\\<^sub>i k 1 (bplustree\\<^sub>i k 9 x)\"\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [50,55,56]))) in\n      bplustree\\<^sub>d k 10 (bplustree\\<^sub>i k 1 (bplustree\\<^sub>i k 9 x))\"\nvalue \"let k=2::nat; x::uint8 bplustree = (Node [(Node [(Leaf [1,2], 2),(Leaf [3,4], 4),(Leaf [5,6,7], 8)] (Leaf [9,10]), 10)] (Node [(Leaf [11,12,13,14], 14), (Leaf [15,17], 20)] (Leaf [50,55,56]))) in\n      bplustree\\<^sub>d k 3 (bplustree\\<^sub>d k 10 (bplustree\\<^sub>i k 1 (bplustree\\<^sub>i k 9 x)))\"\n\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/BTree/BPlusTree_SplitCE.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6477982179521105, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3365449865486905}}
{"text": "section \\<open>HOL Setup\\<close>\ntheory Sepref_HOL_Bindings\nimports Sepref_Tool\nbegin\n\nsubsection \\<open>Assertion Annotation\\<close>\ntext \\<open>Annotate an assertion to a term. The term must then be refined with this assertion.\\<close>\n(* TODO: Version for monadic expressions.*)\ndefinition ASSN_ANNOT :: \"('a \\<Rightarrow> 'ai \\<Rightarrow> assn) \\<Rightarrow> 'a \\<Rightarrow> 'a\" where [simp]: \"ASSN_ANNOT A x \\<equiv> x\"\ncontext fixes A :: \"'a \\<Rightarrow> 'ai \\<Rightarrow> assn\" begin\n  sepref_register \"PR_CONST (ASSN_ANNOT A)\"\n  \n\nend  \n\nlemma annotate_assn: \"x \\<equiv> ASSN_ANNOT A x\" by simp\n\n\nsubsection \\<open>Identity Relations\\<close>\ndefinition \"IS_ID R \\<equiv> R=Id\"\ndefinition \"IS_BELOW_ID R \\<equiv> R\\<subseteq>Id\"\n\nlemma [safe_constraint_rules]: \n  \"IS_ID Id\"\n  \"IS_ID R1 \\<Longrightarrow> IS_ID R2 \\<Longrightarrow> IS_ID (R1 \\<rightarrow> R2)\"\n  \"IS_ID R \\<Longrightarrow> IS_ID (\\<langle>R\\<rangle>option_rel)\"\n  \"IS_ID R \\<Longrightarrow> IS_ID (\\<langle>R\\<rangle>list_rel)\"\n  \"IS_ID R1 \\<Longrightarrow> IS_ID R2 \\<Longrightarrow> IS_ID (R1 \\<times>\\<^sub>r R2)\"\n  \"IS_ID R1 \\<Longrightarrow> IS_ID R2 \\<Longrightarrow> IS_ID (\\<langle>R1,R2\\<rangle>sum_rel)\"\n  by (auto simp: IS_ID_def)\n\nlemma [safe_constraint_rules]: \n  \"IS_BELOW_ID Id\"\n  \"IS_BELOW_ID R \\<Longrightarrow> IS_BELOW_ID (\\<langle>R\\<rangle>option_rel)\"\n  \"IS_BELOW_ID R1 \\<Longrightarrow> IS_BELOW_ID R2 \\<Longrightarrow> IS_BELOW_ID (R1 \\<times>\\<^sub>r R2)\"\n  \"IS_BELOW_ID R1 \\<Longrightarrow> IS_BELOW_ID R2 \\<Longrightarrow> IS_BELOW_ID (\\<langle>R1,R2\\<rangle>sum_rel)\"\n  by (auto simp: IS_ID_def IS_BELOW_ID_def option_rel_def sum_rel_def list_rel_def)\n\nlemma IS_BELOW_ID_fun_rel_aux: \"R1\\<supseteq>Id \\<Longrightarrow> IS_BELOW_ID R2 \\<Longrightarrow> IS_BELOW_ID (R1 \\<rightarrow> R2)\"\n  by (auto simp: IS_BELOW_ID_def dest: fun_relD)\n\ncorollary IS_BELOW_ID_fun_rel[safe_constraint_rules]: \n  \"IS_ID R1 \\<Longrightarrow> IS_BELOW_ID R2 \\<Longrightarrow> IS_BELOW_ID (R1 \\<rightarrow> R2)\"\n  using IS_BELOW_ID_fun_rel_aux[of Id R2]\n  by (auto simp: IS_ID_def)\n\n\nlemma IS_BELOW_ID_list_rel[safe_constraint_rules]: \n  \"IS_BELOW_ID R \\<Longrightarrow> IS_BELOW_ID (\\<langle>R\\<rangle>list_rel)\"\n  unfolding IS_BELOW_ID_def\nproof safe\n  fix l l'\n  assume A: \"R\\<subseteq>Id\" \n  assume \"(l,l')\\<in>\\<langle>R\\<rangle>list_rel\"\n  thus \"l=l'\"\n    apply induction\n    using A by auto\nqed\n\nlemma IS_ID_imp_BELOW_ID[constraint_rules]: \n  \"IS_ID R \\<Longrightarrow> IS_BELOW_ID R\"\n  by (auto simp: IS_ID_def IS_BELOW_ID_def )\n\n\n\nsubsection \\<open>Inverse Relation\\<close>\n\nlemma inv_fun_rel_eq[simp]: \"(A\\<rightarrow>B)\\<inverse> = A\\<inverse>\\<rightarrow>B\\<inverse>\"\n  by (auto dest: fun_relD)\n\nlemma inv_option_rel_eq[simp]: \"(\\<langle>K\\<rangle>option_rel)\\<inverse> = \\<langle>K\\<inverse>\\<rangle>option_rel\"\n  by (auto simp: option_rel_def)\n\nlemma inv_prod_rel_eq[simp]: \"(P \\<times>\\<^sub>r Q)\\<inverse> = P\\<inverse> \\<times>\\<^sub>r Q\\<inverse>\"\n  by (auto)\n\nlemma inv_sum_rel_eq[simp]: \"(\\<langle>P,Q\\<rangle>sum_rel)\\<inverse> = \\<langle>P\\<inverse>,Q\\<inverse>\\<rangle>sum_rel\"\n  by (auto simp: sum_rel_def)\n\nlemma inv_list_rel_eq[simp]: \"(\\<langle>R\\<rangle>list_rel)\\<inverse> = \\<langle>R\\<inverse>\\<rangle>list_rel\"\n  unfolding list_rel_def\n  apply safe\n  apply (subst list.rel_flip[symmetric])\n  apply (simp add: conversep_iff[abs_def])\n  apply (subst list.rel_flip[symmetric])\n  apply (simp add: conversep_iff[abs_def])\n  done\n\nlemmas [constraint_simps] =\n  Relation.converse_Id\n  inv_fun_rel_eq\n  inv_option_rel_eq\n  inv_prod_rel_eq\n  inv_sum_rel_eq\n  inv_list_rel_eq\n\n\nsubsection \\<open>Single Valued and Total Relations\\<close>\n\n(* TODO: Link to other such theories: Transfer, Autoref *)\ndefinition \"IS_LEFT_UNIQUE R \\<equiv> single_valued (R\\<inverse>)\"\ndefinition \"IS_LEFT_TOTAL R \\<equiv> Domain R = UNIV\"\ndefinition \"IS_RIGHT_TOTAL R \\<equiv> Range R = UNIV\"\nabbreviation (input) \"IS_RIGHT_UNIQUE \\<equiv> single_valued\"\n\nlemmas IS_RIGHT_UNIQUED = single_valuedD\nlemma IS_LEFT_UNIQUED: \"\\<lbrakk>IS_LEFT_UNIQUE r; (y, x) \\<in> r; (z, x) \\<in> r\\<rbrakk> \\<Longrightarrow> y = z\"\n  by (auto simp: IS_LEFT_UNIQUE_def dest: single_valuedD)\n\nlemma prop2p:\n  \"IS_LEFT_UNIQUE R = left_unique (rel2p R)\"\n  \"IS_RIGHT_UNIQUE R = right_unique (rel2p R)\"\n  \"right_unique (rel2p (R\\<inverse>)) = left_unique (rel2p R)\"\n  \"IS_LEFT_TOTAL R = left_total (rel2p R)\"\n  \"IS_RIGHT_TOTAL R = right_total (rel2p R)\"\n  by (auto \n    simp: IS_LEFT_UNIQUE_def left_unique_def single_valued_def\n    simp: right_unique_def\n    simp: IS_LEFT_TOTAL_def left_total_def\n    simp: IS_RIGHT_TOTAL_def right_total_def\n    simp: rel2p_def\n    )\n\nlemma p2prop:\n  \"left_unique P = IS_LEFT_UNIQUE (p2rel P)\"\n  \"right_unique P = IS_RIGHT_UNIQUE (p2rel P)\"\n  \"left_total P = IS_LEFT_TOTAL (p2rel P)\"\n  \"right_total P = IS_RIGHT_TOTAL (p2rel P)\"\n  \"bi_unique P \\<longleftrightarrow> left_unique P \\<and> right_unique P\"\n  by (auto \n    simp: IS_LEFT_UNIQUE_def left_unique_def single_valued_def\n    simp: right_unique_def bi_unique_alt_def\n    simp: IS_LEFT_TOTAL_def left_total_def\n    simp: IS_RIGHT_TOTAL_def right_total_def\n    simp: p2rel_def\n    )\n\nlemmas [safe_constraint_rules] = \n  single_valued_Id  \n  prod_rel_sv \n  list_rel_sv \n  option_rel_sv \n  sum_rel_sv\n\nlemma [safe_constraint_rules]:\n  \"IS_LEFT_UNIQUE Id\"\n  \"IS_LEFT_UNIQUE R1 \\<Longrightarrow> IS_LEFT_UNIQUE R2 \\<Longrightarrow> IS_LEFT_UNIQUE (R1\\<times>\\<^sub>rR2)\"\n  \"IS_LEFT_UNIQUE R1 \\<Longrightarrow> IS_LEFT_UNIQUE R2 \\<Longrightarrow> IS_LEFT_UNIQUE (\\<langle>R1,R2\\<rangle>sum_rel)\"\n  \"IS_LEFT_UNIQUE R \\<Longrightarrow> IS_LEFT_UNIQUE (\\<langle>R\\<rangle>option_rel)\"\n  \"IS_LEFT_UNIQUE R \\<Longrightarrow> IS_LEFT_UNIQUE (\\<langle>R\\<rangle>list_rel)\"\n  by (auto simp: IS_LEFT_UNIQUE_def prod_rel_sv sum_rel_sv option_rel_sv list_rel_sv)\n\nlemma IS_LEFT_TOTAL_alt: \"IS_LEFT_TOTAL R \\<longleftrightarrow> (\\<forall>x. \\<exists>y. (x,y)\\<in>R)\"\n  by (auto simp: IS_LEFT_TOTAL_def)\n\nlemma IS_RIGHT_TOTAL_alt: \"IS_RIGHT_TOTAL R \\<longleftrightarrow> (\\<forall>x. \\<exists>y. (y,x)\\<in>R)\"\n  by (auto simp: IS_RIGHT_TOTAL_def)\n\nlemma [safe_constraint_rules]:\n  \"IS_LEFT_TOTAL Id\"\n  \"IS_LEFT_TOTAL R1 \\<Longrightarrow> IS_LEFT_TOTAL R2 \\<Longrightarrow> IS_LEFT_TOTAL (R1\\<times>\\<^sub>rR2)\"\n  \"IS_LEFT_TOTAL R1 \\<Longrightarrow> IS_LEFT_TOTAL R2 \\<Longrightarrow> IS_LEFT_TOTAL (\\<langle>R1,R2\\<rangle>sum_rel)\"\n  \"IS_LEFT_TOTAL R \\<Longrightarrow> IS_LEFT_TOTAL (\\<langle>R\\<rangle>option_rel)\"\n  apply (auto simp: IS_LEFT_TOTAL_alt sum_rel_def option_rel_def list_rel_def)\n  apply (rename_tac x; case_tac x; auto)\n  apply (rename_tac x; case_tac x; auto)\n  done\n\nlemma [safe_constraint_rules]: \"IS_LEFT_TOTAL R \\<Longrightarrow> IS_LEFT_TOTAL (\\<langle>R\\<rangle>list_rel)\"\n  unfolding IS_LEFT_TOTAL_alt\nproof safe\n  assume A: \"\\<forall>x.\\<exists>y. (x,y)\\<in>R\"\n  fix l\n  show \"\\<exists>l'. (l,l')\\<in>\\<langle>R\\<rangle>list_rel\"\n    apply (induction l)\n    using A\n    by (auto simp: list_rel_split_right_iff)\nqed\n\nlemma [safe_constraint_rules]:\n  \"IS_RIGHT_TOTAL Id\"\n  \"IS_RIGHT_TOTAL R1 \\<Longrightarrow> IS_RIGHT_TOTAL R2 \\<Longrightarrow> IS_RIGHT_TOTAL (R1\\<times>\\<^sub>rR2)\"\n  \"IS_RIGHT_TOTAL R1 \\<Longrightarrow> IS_RIGHT_TOTAL R2 \\<Longrightarrow> IS_RIGHT_TOTAL (\\<langle>R1,R2\\<rangle>sum_rel)\"\n  \"IS_RIGHT_TOTAL R \\<Longrightarrow> IS_RIGHT_TOTAL (\\<langle>R\\<rangle>option_rel)\"\n  apply (auto simp: IS_RIGHT_TOTAL_alt sum_rel_def option_rel_def) []\n  apply (auto simp: IS_RIGHT_TOTAL_alt sum_rel_def option_rel_def) []\n  apply (auto simp: IS_RIGHT_TOTAL_alt sum_rel_def option_rel_def) []\n  apply (rename_tac x; case_tac x; auto)\n  apply (clarsimp simp: IS_RIGHT_TOTAL_alt option_rel_def)\n  apply (rename_tac x; case_tac x; auto)\n  done\n\nlemma [safe_constraint_rules]: \"IS_RIGHT_TOTAL R \\<Longrightarrow> IS_RIGHT_TOTAL (\\<langle>R\\<rangle>list_rel)\"\n  unfolding IS_RIGHT_TOTAL_alt\nproof safe\n  assume A: \"\\<forall>x.\\<exists>y. (y,x)\\<in>R\"\n  fix l\n  show \"\\<exists>l'. (l',l)\\<in>\\<langle>R\\<rangle>list_rel\"\n    apply (induction l)\n    using A\n    by (auto simp: list_rel_split_left_iff)\nqed\n  \nlemma [constraint_simps]:\n  \"IS_LEFT_TOTAL (R\\<inverse>) \\<longleftrightarrow> IS_RIGHT_TOTAL R \"\n  \"IS_RIGHT_TOTAL (R\\<inverse>) \\<longleftrightarrow> IS_LEFT_TOTAL R  \"\n  \"IS_LEFT_UNIQUE (R\\<inverse>) \\<longleftrightarrow> IS_RIGHT_UNIQUE R\"\n  \"IS_RIGHT_UNIQUE (R\\<inverse>) \\<longleftrightarrow> IS_LEFT_UNIQUE R \"\n  by (auto simp: IS_RIGHT_TOTAL_alt IS_LEFT_TOTAL_alt IS_LEFT_UNIQUE_def)\n\nlemma [safe_constraint_rules]:\n  \"IS_RIGHT_UNIQUE A \\<Longrightarrow> IS_RIGHT_TOTAL B \\<Longrightarrow> IS_RIGHT_TOTAL (A\\<rightarrow>B)\"\n  \"IS_RIGHT_TOTAL A \\<Longrightarrow> IS_RIGHT_UNIQUE B \\<Longrightarrow> IS_RIGHT_UNIQUE (A\\<rightarrow>B)\"\n  \"IS_LEFT_UNIQUE A \\<Longrightarrow> IS_LEFT_TOTAL B \\<Longrightarrow> IS_LEFT_TOTAL (A\\<rightarrow>B)\"\n  \"IS_LEFT_TOTAL A \\<Longrightarrow> IS_LEFT_UNIQUE B \\<Longrightarrow> IS_LEFT_UNIQUE (A\\<rightarrow>B)\"\n  apply (simp_all add: prop2p rel2p)\n  (*apply transfer_step TODO: Isabelle 2016 *)\n  apply (blast intro!: transfer_raw)+\n  done\n\nlemma [constraint_rules]: \n  \"IS_BELOW_ID R \\<Longrightarrow> IS_RIGHT_UNIQUE R\"\n  \"IS_BELOW_ID R \\<Longrightarrow> IS_LEFT_UNIQUE R\"\n  \"IS_ID R \\<Longrightarrow> IS_RIGHT_TOTAL R\"\n  \"IS_ID R \\<Longrightarrow> IS_LEFT_TOTAL R\"\n  by (auto simp: IS_BELOW_ID_def IS_ID_def IS_LEFT_UNIQUE_def IS_RIGHT_TOTAL_def IS_LEFT_TOTAL_def\n    intro: single_valuedI)\n\nthm constraint_rules\n\nsubsubsection \\<open>Additional Parametricity Lemmas\\<close>\n(* TODO: Move. Problem: Depend on IS_LEFT_UNIQUE, which has to be moved to!*)\n\nlemma param_distinct[param]: \"\\<lbrakk>IS_LEFT_UNIQUE A; IS_RIGHT_UNIQUE A\\<rbrakk> \\<Longrightarrow> (distinct, distinct) \\<in> \\<langle>A\\<rangle>list_rel \\<rightarrow> bool_rel\"  \n  apply (fold rel2p_def)\n  apply (simp add: rel2p)\n  apply (rule distinct_transfer)\n  apply (simp add: p2prop)\n  done\n\nlemma param_Image[param]: \n  assumes \"IS_LEFT_UNIQUE A\" \"IS_RIGHT_UNIQUE A\"\n  shows \"((``), (``)) \\<in> \\<langle>A\\<times>\\<^sub>rB\\<rangle>set_rel \\<rightarrow> \\<langle>A\\<rangle>set_rel \\<rightarrow> \\<langle>B\\<rangle>set_rel\"\n  apply (clarsimp simp: set_rel_def; intro conjI)  \n  apply (fastforce dest: IS_RIGHT_UNIQUED[OF assms(2)])\n  apply (fastforce dest: IS_LEFT_UNIQUED[OF assms(1)])\n  done\n\nlemma pres_eq_iff_svb: \"((=),(=))\\<in>K\\<rightarrow>K\\<rightarrow>bool_rel \\<longleftrightarrow> (single_valued K \\<and> single_valued (K\\<inverse>))\"\n  apply (safe intro!: single_valuedI)\n  apply (metis (full_types) IdD fun_relD1)\n  apply (metis (full_types) IdD fun_relD1)\n  by (auto dest: single_valuedD)\n\ndefinition \"IS_PRES_EQ R \\<equiv> ((=), (=))\\<in>R\\<rightarrow>R\\<rightarrow>bool_rel\"\nlemma [constraint_rules]: \"\\<lbrakk>single_valued R; single_valued (R\\<inverse>)\\<rbrakk> \\<Longrightarrow> IS_PRES_EQ R\"\n  by (simp add: pres_eq_iff_svb IS_PRES_EQ_def)\n\n\nsubsection \\<open>Bounded Assertions\\<close>\ndefinition \"b_rel R P \\<equiv> R \\<inter> UNIV\\<times>Collect P\"\ndefinition \"b_assn A P \\<equiv> \\<lambda>x y. \\<up>(P x) ** A x y\"\n\nlemma b_assn_pure_conv[constraint_simps]: \"b_assn (pure R) P = pure (b_rel R P)\"\n  by (auto del: ext intro!: ext simp: b_rel_def b_assn_def pure_def pred_lift_extract_simps)\nlemmas [sepref_import_rewrite, named_ss sepref_frame_normrel, fcomp_norm_unfold] \n  = b_assn_pure_conv[symmetric]\n\nlemma b_rel_nesting[simp]: \n  \"b_rel (b_rel R P1) P2 = b_rel R (\\<lambda>x. P1 x \\<and> P2 x)\"\n  by (auto simp: b_rel_def)\nlemma b_rel_triv[simp]: \n  \"b_rel R (\\<lambda>_. True) = R\"\n  by (auto simp: b_rel_def)\nlemma b_assn_nesting[simp]: \n  \"b_assn (b_assn A P1) P2 = b_assn A (\\<lambda>x. P1 x \\<and> P2 x)\"\n  by (auto simp: b_assn_def pure_def pred_lift_extract_simps del: ext intro!: ext)\nlemma b_assn_triv[simp]: \n  \"b_assn A (\\<lambda>_. True) = A\"\n  by (auto simp: b_assn_def pure_def pred_lift_extract_simps del: ext intro!: ext)\n\nlemmas [constraint_simps,sepref_import_rewrite, named_ss sepref_frame_normrel, fcomp_norm_unfold]\n  = b_rel_nesting b_assn_nesting\n\nlemma b_rel_simp[simp]: \"(x,y)\\<in>b_rel R P \\<longleftrightarrow> (x,y)\\<in>R \\<and> P y\"\n  by (auto simp: b_rel_def)\n\nlemma b_assn_simp[simp]: \"b_assn A P x y = (\\<up>(P x) ** A x y)\"\n  by (auto simp: b_assn_def)\n\nlemma b_rel_Range[simp]: \"Range (b_rel R P) = Range R \\<inter> Collect P\" by auto\nlemma b_assn_rdom[simp]: \"rdomp (b_assn R P) x \\<longleftrightarrow> rdomp R x \\<and> P x\"\n  by (auto simp: rdomp_def pred_lift_extract_simps)\n\n\nlemma b_rel_below_id[constraint_rules,relator_props]: \n  \"IS_BELOW_ID R \\<Longrightarrow> IS_BELOW_ID (b_rel R P)\"\n  by (auto simp: IS_BELOW_ID_def)\n\nlemma b_rel_left_unique[constraint_rules,relator_props]: \n  \"IS_LEFT_UNIQUE R \\<Longrightarrow> IS_LEFT_UNIQUE (b_rel R P)\"\n  by (auto simp: IS_LEFT_UNIQUE_def single_valued_def)\n  \nlemma b_rel_right_unique[constraint_rules,relator_props]: \n  \"IS_RIGHT_UNIQUE R \\<Longrightarrow> IS_RIGHT_UNIQUE (b_rel R P)\"\n  by (auto simp: single_valued_def)\n\n\\<comment> \\<open>Registered as safe rule, although may loose information in the \n    odd case that purity depends condition.\\<close>\nlemma b_assn_is_pure[safe_constraint_rules, simp]:\n  \"is_pure A \\<Longrightarrow> is_pure (b_assn A P)\"\n  by (auto simp: is_pure_conv b_assn_pure_conv)\n\nlemma R_comp_brel_id_conv[fcomp_norm_simps]: \"R O b_rel Id P = b_rel R P\" by auto\n  \n  \n\\<comment> \\<open>Most general form\\<close>\nlemma b_assn_subtyping_match[sepref_frame_match_rules]:\n  assumes \"hn_ctxt (b_assn A P) x y \\<turnstile> hn_ctxt A' x y\"\n  assumes \"\\<lbrakk>vassn_tag (hn_ctxt A x y); vassn_tag (hn_ctxt A' x y); P x\\<rbrakk> \\<Longrightarrow> P' x\"\n  shows \"hn_ctxt (b_assn A P) x y \\<turnstile> hn_ctxt (b_assn A' P') x y\"\n  using assms\n  unfolding hn_ctxt_def b_assn_def entails_def vassn_tag_def\n  by (auto simp: pred_lift_extract_simps)\n  \n\\<comment> \\<open>Simplified forms:\\<close>\nlemma b_assn_subtyping_match_eqA[sepref_frame_match_rules]:\n  assumes \"\\<lbrakk>vassn_tag (hn_ctxt A x y); P x\\<rbrakk> \\<Longrightarrow> P' x\"\n  shows \"hn_ctxt (b_assn A P) x y \\<turnstile> hn_ctxt (b_assn A P') x y\"\n  apply (rule b_assn_subtyping_match)\n  subgoal \n    unfolding hn_ctxt_def b_assn_def entails_def vassn_tag_def\n    by (auto simp: pred_lift_extract_simps)\n  subgoal\n    using assms .\n  done  \n\nlemma b_assn_subtyping_match_tR[sepref_frame_match_rules]:\n  assumes \"\\<lbrakk>P x\\<rbrakk> \\<Longrightarrow> hn_ctxt A x y \\<turnstile> hn_ctxt A' x y\"\n  shows \"hn_ctxt (b_assn A P) x y \\<turnstile> hn_ctxt A' x y\"\n  using assms\n  unfolding hn_ctxt_def b_assn_def entails_def\n  by (auto simp: pred_lift_extract_simps)\n\nlemma b_assn_subtyping_match_tL[sepref_frame_match_rules]:\n  assumes \"hn_ctxt A x y \\<turnstile> hn_ctxt A' x y\"\n  assumes \"\\<lbrakk>vassn_tag (hn_ctxt A x y)\\<rbrakk> \\<Longrightarrow> P' x\"\n  shows \"hn_ctxt A x y \\<turnstile> hn_ctxt (b_assn A' P') x y\"\n  using assms\n  unfolding hn_ctxt_def b_assn_def entails_def vassn_tag_def\n  by (auto simp: pred_lift_extract_simps)\n\n\nlemma b_assn_subtyping_match_eqA_tR[sepref_frame_match_rules]: \n  \"hn_ctxt (b_assn A P) x y \\<turnstile> hn_ctxt A x y\"\n  unfolding hn_ctxt_def b_assn_def entails_def\n  by (auto simp: pred_lift_extract_simps)\n\nlemma b_assn_subtyping_match_eqA_tL[sepref_frame_match_rules]:\n  assumes \"\\<lbrakk>vassn_tag (hn_ctxt A x y)\\<rbrakk> \\<Longrightarrow> P' x\"\n  shows \"hn_ctxt A x y \\<turnstile> hn_ctxt (b_assn A P') x y\"\n  using assms\n  unfolding hn_ctxt_def b_assn_def entails_def vassn_tag_def\n  by (auto simp: pred_lift_extract_simps)\n\n  \nlemma b_rel_gen_merge:\n  assumes A: \"MERGE1 A f B g C\"  \n  shows \"MERGE1 (b_assn A P) f (b_assn B Q) g (b_assn C (\\<lambda>x. P x \\<or> Q x))\"  \n  supply [vcg_rules] = MERGE1D[OF A]\n  apply rule\n  by vcg\n  \nlemmas b_rel_merge_eq[sepref_frame_merge_rules] = b_rel_gen_merge[where P=P and Q=P for P, simplified]\nlemmas [sepref_frame_merge_rules] = b_rel_gen_merge\nlemmas b_rel_merge_left[sepref_frame_merge_rules] = b_rel_gen_merge[where Q=\"\\<lambda>_. True\", simplified]\nlemmas b_rel_merge_right[sepref_frame_merge_rules] = b_rel_gen_merge[where P=\"\\<lambda>_. True\", simplified]\n  \n(*  \n\\<comment> \\<open>General form\\<close>\nlemma b_rel_subtyping_merge[sepref_frame_merge_rules]:\n  assumes \"hn_ctxt A x y \\<or>\\<^sub>A hn_ctxt A' x y \\<Longrightarrow>\\<^sub>t hn_ctxt Am x y\"\n  shows \"hn_ctxt (b_assn A P) x y \\<or>\\<^sub>A hn_ctxt (b_assn A' P') x y \\<Longrightarrow>\\<^sub>t hn_ctxt (b_assn Am (\\<lambda>x. P x \\<or> P' x)) x y\"\n  using assms\n  unfolding hn_ctxt_def b_assn_def entailst_def entails_def\n  by (fastforce simp: vassn_tag_def)\n  \n\\<comment> \\<open>Simplified forms\\<close>\nlemma b_rel_subtyping_merge_eqA[sepref_frame_merge_rules]:\n  shows \"hn_ctxt (b_assn A P) x y \\<or>\\<^sub>A hn_ctxt (b_assn A P') x y \\<Longrightarrow>\\<^sub>t hn_ctxt (b_assn A (\\<lambda>x. P x \\<or> P' x)) x y\"\n  apply (rule b_rel_subtyping_merge)\n  by simp\n\nlemma b_rel_subtyping_merge_tL[sepref_frame_merge_rules]:\n  assumes \"hn_ctxt A x y \\<or>\\<^sub>A hn_ctxt A' x y \\<Longrightarrow>\\<^sub>t hn_ctxt Am x y\"\n  shows \"hn_ctxt A x y \\<or>\\<^sub>A hn_ctxt (b_assn A' P') x y \\<Longrightarrow>\\<^sub>t hn_ctxt Am x y\"\n  using b_rel_subtyping_merge[of A x y A' Am \"\\<lambda>_. True\" P', simplified] assms .\n\nlemma b_rel_subtyping_merge_tR[sepref_frame_merge_rules]:\n  assumes \"hn_ctxt A x y \\<or>\\<^sub>A hn_ctxt A' x y \\<Longrightarrow>\\<^sub>t hn_ctxt Am x y\"\n  shows \"hn_ctxt (b_assn A P) x y \\<or>\\<^sub>A hn_ctxt A' x y \\<Longrightarrow>\\<^sub>t hn_ctxt Am x y\"\n  using b_rel_subtyping_merge[of A x y A' Am P \"\\<lambda>_. True\", simplified] assms .\n\nlemma b_rel_subtyping_merge_eqA_tL[sepref_frame_merge_rules]:\n  shows \"hn_ctxt A x y \\<or>\\<^sub>A hn_ctxt (b_assn A P') x y \\<Longrightarrow>\\<^sub>t hn_ctxt A x y\"\n  using b_rel_subtyping_merge_eqA[of A \"\\<lambda>_. True\" x y P', simplified] .\n\nlemma b_rel_subtyping_merge_eqA_tR[sepref_frame_merge_rules]:\n  shows \"hn_ctxt (b_assn A P) x y \\<or>\\<^sub>A hn_ctxt A x y \\<Longrightarrow>\\<^sub>t hn_ctxt A x y\"\n  using b_rel_subtyping_merge_eqA[of A P x y \"\\<lambda>_. True\", simplified] .\n\n(* TODO: Combinatorial explosion :( *)\nlemma b_assn_invalid_merge1: \"hn_invalid (b_assn A P) x y \\<or>\\<^sub>A hn_invalid (b_assn A P') x y\n  \\<Longrightarrow>\\<^sub>t hn_invalid (b_assn A (\\<lambda>x. P x \\<or> P' x)) x y\"\n  by (sep_auto simp: hn_ctxt_def invalid_assn_def entailst_def)\n\nlemma b_assn_invalid_merge2: \"hn_invalid (b_assn A P) x y \\<or>\\<^sub>A hn_invalid A x y\n  \\<Longrightarrow>\\<^sub>t hn_invalid A x y\"\n  by (sep_auto simp: hn_ctxt_def invalid_assn_def entailst_def)\nlemma b_assn_invalid_merge3: \"hn_invalid A x y \\<or>\\<^sub>A hn_invalid (b_assn A P) x y\n  \\<Longrightarrow>\\<^sub>t hn_invalid A x y\"\n  by (sep_auto simp: hn_ctxt_def invalid_assn_def entailst_def)\n\nlemma b_assn_invalid_merge4: \"hn_invalid (b_assn A P) x y \\<or>\\<^sub>A hn_ctxt (b_assn A P') x y\n  \\<Longrightarrow>\\<^sub>t hn_invalid (b_assn A (\\<lambda>x. P x \\<or> P' x)) x y\"\n  by (sep_auto simp: hn_ctxt_def invalid_assn_def entailst_def)\nlemma b_assn_invalid_merge5: \"hn_ctxt (b_assn A P') x y \\<or>\\<^sub>A hn_invalid (b_assn A P) x y\n  \\<Longrightarrow>\\<^sub>t hn_invalid (b_assn A (\\<lambda>x. P x \\<or> P' x)) x y\"\n  by (sep_auto simp: hn_ctxt_def invalid_assn_def entailst_def)\n\nlemma b_assn_invalid_merge6: \"hn_invalid (b_assn A P) x y \\<or>\\<^sub>A hn_ctxt A x y\n  \\<Longrightarrow>\\<^sub>t hn_invalid A x y\"\n  by (sep_auto simp: hn_ctxt_def invalid_assn_def entailst_def)\nlemma b_assn_invalid_merge7: \"hn_ctxt A x y \\<or>\\<^sub>A hn_invalid (b_assn A P) x y\n  \\<Longrightarrow>\\<^sub>t hn_invalid A x y\"\n  by (sep_auto simp: hn_ctxt_def invalid_assn_def entailst_def)\n\nlemma b_assn_invalid_merge8: \"hn_ctxt (b_assn A P) x y \\<or>\\<^sub>A hn_invalid A x y\n  \\<Longrightarrow>\\<^sub>t hn_invalid A x y\"\n  by (sep_auto simp: hn_ctxt_def invalid_assn_def entailst_def)\nlemma b_assn_invalid_merge9: \"hn_invalid A x y \\<or>\\<^sub>A hn_ctxt (b_assn A P) x y\n  \\<Longrightarrow>\\<^sub>t hn_invalid A x y\"\n  by (sep_auto simp: hn_ctxt_def invalid_assn_def entailst_def)\n\nlemmas b_assn_invalid_merge[sepref_frame_merge_rules] = \n  b_assn_invalid_merge1\n  b_assn_invalid_merge2\n  b_assn_invalid_merge3\n  b_assn_invalid_merge4\n  b_assn_invalid_merge5\n  b_assn_invalid_merge6\n  b_assn_invalid_merge7\n  b_assn_invalid_merge8\n  b_assn_invalid_merge9\n\n*)\n\n\n\nabbreviation nbn_rel :: \"nat \\<Rightarrow> (nat \\<times> nat) set\" \n  \\<comment> \\<open>Natural numbers with upper bound.\\<close>\n  where \"nbn_rel n \\<equiv> b_rel nat_rel (\\<lambda>x::nat. x<n)\"  \n\n\nlemma in_R_comp_nbn_conv: \"(a,b)\\<in>(R O nbn_rel N) \\<longleftrightarrow> (a,b)\\<in>R \\<and> b<N\" by auto\nlemma range_comp_nbn_conv: \"Range (R O nbn_rel N) = Range R \\<inter> {0..<N}\"\n  by (auto 0 3 simp: b_rel_def)\n\nlemma mk_free_b_assn[sepref_frame_free_rules]:\n  assumes \"MK_FREE A f\"  \n  shows \"MK_FREE (b_assn A P) f\"  \nproof -\n  note [vcg_rules] = assms[THEN MK_FREED]\n  show ?thesis by rule vcg\nqed\n\nlemma intf_of_b_rel[synth_rules]: \"INTF_OF_REL R I \\<Longrightarrow> INTF_OF_REL (b_rel R P) I\" by simp\n\nlemma b_assn_intf[intf_of_assn]: \"intf_of_assn V I \\<Longrightarrow> intf_of_assn (b_assn V P) I\"\n  by simp\n\n\ntext \\<open>Introduce extra goal for bounded result\\<close>\nlemma hfref_bassn_resI:\n  assumes \"\\<And>xs. \\<lbrakk>rdomp (fst As) xs; C xs\\<rbrakk> \\<Longrightarrow> a xs \\<le>\\<^sub>n SPEC P t\"\n  assumes \"(c,a)\\<in>[C]\\<^sub>a As \\<rightarrow> R\"\n  shows \"(c,a)\\<in>[C]\\<^sub>a As \\<rightarrow> b_assn R P\"\n  apply rule\n  apply (rule hn_refine_preI)\n  apply (rule hn_refine_cons)\n  apply (rule hn_refine_augment_res)\n  apply (rule assms(2)[to_hnr, unfolded hn_ctxt_def autoref_tag_defs])\n  apply simp\n  apply (rule assms(1))\n  apply (auto simp: rdomp_def sep_algebra_simps)\n  done\n\n  \n  \nsubsection \\<open>Tool Setup\\<close>\nlemmas [sepref_relprops] = \n  sepref_relpropI[of IS_LEFT_UNIQUE]\n  sepref_relpropI[of IS_RIGHT_UNIQUE]\n  sepref_relpropI[of IS_LEFT_TOTAL]\n  sepref_relpropI[of IS_RIGHT_TOTAL]\n  sepref_relpropI[of is_pure]\n  sepref_relpropI[of \"IS_PURE \\<Phi>\" for \\<Phi>]\n  sepref_relpropI[of IS_ID]\n  sepref_relpropI[of IS_BELOW_ID]\n \n\n\nlemma [sepref_relprops_simps]:\n  \"CONSTRAINT (IS_PURE IS_ID) A \\<Longrightarrow> CONSTRAINT (IS_PURE IS_BELOW_ID) A\"\n  \"CONSTRAINT (IS_PURE IS_ID) A \\<Longrightarrow> CONSTRAINT (IS_PURE IS_LEFT_TOTAL) A\"\n  \"CONSTRAINT (IS_PURE IS_ID) A \\<Longrightarrow> CONSTRAINT (IS_PURE IS_RIGHT_TOTAL) A\"\n  \"CONSTRAINT (IS_PURE IS_BELOW_ID) A \\<Longrightarrow> CONSTRAINT (IS_PURE IS_LEFT_UNIQUE) A\"\n  \"CONSTRAINT (IS_PURE IS_BELOW_ID) A \\<Longrightarrow> CONSTRAINT (IS_PURE IS_RIGHT_UNIQUE) A\"\n  by (auto \n    simp: IS_ID_def IS_BELOW_ID_def IS_PURE_def IS_LEFT_UNIQUE_def\n    simp: IS_LEFT_TOTAL_def IS_RIGHT_TOTAL_def\n    simp: single_valued_below_Id)\n\ndeclare True_implies_equals[sepref_relprops_simps]\n\nlemma [sepref_relprops_transform]: \"single_valued (R\\<inverse>) = IS_LEFT_UNIQUE R\"\n  by (auto simp: IS_LEFT_UNIQUE_def)\n\n  \nsubsection \\<open>Default Initializers\\<close>  \ntext \\<open>We define a generic algorithm scheme to determine the abstract counterpart of\n  the \\<^term>\\<open>init::'a::llvm_rep\\<close> value wrt. an assertion. This is important for \n  initializing container data structures directly from zero-initializing \\<open>calloc\\<close>, \n  rather than having to \\<open>memset\\<close> each array.\\<close>\n\ndefinition is_init :: \"('a \\<Rightarrow> 'c::llvm_rep \\<Rightarrow> assn) \\<Rightarrow> 'a \\<Rightarrow> bool\" \n  where \"is_init A i \\<equiv> is_pure A \\<and> (init,i) \\<in> the_pure A\"\n  \nlemma is_init_id_assn[sepref_gen_algo_rules]: \"GEN_ALGO init (is_init id_assn)\"\n  by (auto simp: GEN_ALGO_def is_init_def)\n  \n  \nsubsection \\<open>Arithmetics\\<close>\n\n\n\n\n\ncontext \n  fixes name :: ecost and g:: \"('a \\<Rightarrow> 'c)\"\nbegin\n  sepref_register timed_unop': \"SPECc1' name g\"\nend\n\ncontext \n  fixes name :: string and g:: \"('a \\<Rightarrow> 'c)\"\nbegin\n  sepref_register timed_unop: \"SPECc1 name g\"\nend\n\ncontext \n  fixes name :: string and f:: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'c)\"\nbegin\n  sepref_register timed_binop: \"SPECc2 name f\"\nend\n\n\nsubsubsection \\<open>Connecting to Standard Operation Abstraction from LLVM-RS\\<close>\n\ntext \\<open>We will hide the connection behind an additional abstraction layer, \n  introduced by definitions. So, the definitions from this locale should not \n  be used by the end-user.\n\\<close>\ncontext standard_opr_abstraction begin\n  definition \"rel \\<equiv> br \\<alpha> I\"\n\n  lemma assn_is_rel: \"\\<upharpoonleft>assn = pure rel\"\n    unfolding pure_def rel_def in_br_conv assn_def\n    apply (intro ext)\n    apply (auto simp: pred_lift_extract_simps)\n    done\n    \n  abbreviation (input) sepref_assn where \"sepref_assn \\<equiv> pure rel\"  \n\n \n  lemma hn_un_op:\n    assumes \"is_un_op name PRE cop xmop aop\"  \n    shows \"(cop,SPECc1 name aop) \\<in> [\\<lambda>a. PRE TYPE('c) a]\\<^sub>a sepref_assn\\<^sup>k \\<rightarrow> sepref_assn\"\n    unfolding assn_is_rel[symmetric] SPECc1_def\n    apply sepref_to_hoare\n    supply [vcg_rules] = un_op_tmpl[OF assms, unfolded one_enat_def lift_acost_cost, folded one_enat_def] \n    by vcg\n\n  lemma hn_bin_op:\n    assumes \"is_bin_op name PRE cop xmop aop\"  \n    shows \"(uncurry cop,uncurry (SPECc2 name aop)) \\<in> [\\<lambda>(a,b). PRE TYPE('c) a b]\\<^sub>a sepref_assn\\<^sup>k *\\<^sub>a sepref_assn\\<^sup>k \\<rightarrow> sepref_assn\"\n    unfolding assn_is_rel[symmetric] SPECc2_def\n    apply sepref_to_hoare\n    supply [vcg_rules] = bin_op_tmpl[OF assms, unfolded one_enat_def lift_acost_cost, folded one_enat_def]\n    by vcg\n    \n  lemma hn_cmp_op:  \n    assumes \"is_cmp_op name cop xmop aop\"\n    shows \"(uncurry cop,uncurry (SPECc2 name aop)) \\<in> sepref_assn\\<^sup>k *\\<^sub>a sepref_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool.sepref_assn\"\n    unfolding assn_is_rel[symmetric] bool.assn_is_rel[symmetric] SPECc2_def\n    apply sepref_to_hoare\n    supply [vcg_rules] = cmp_op_tmpl[OF assms, unfolded one_enat_def lift_acost_cost, folded one_enat_def]\n    by vcg\n    \n\nend\nsubsubsection \\<open>Operator Setup\\<close>\n\ntext \\<open>Not-Equals is an operator in LLVM, but not in HOL\\<close>\ndefinition [simp]: \"op_neq a b \\<equiv> a\\<noteq>b\"  \n(* TODO: Maybe have this pattern rule only for certain types.\n  Otherwise, op_neq has to be implemented by every type that has custom eq-operator!\n\n  The best solution would, or course, be to have a generic algorithm!\n*)\nlemma op_neq_pat[def_pat_rules]: \"Not$((=)$a$b) \\<equiv> op_neq$a$b\" by simp\nsepref_register op_neq_word: \"op_neq :: _ word \\<Rightarrow> _\"\n\n\ntext \\<open>For technical reasons, we need the operands as parameters to the operators \n  on the concrete side of refinement theorems. Thus, we define the following shortcut\n  for comparison operators. \\<close>    \n(* TODO/FIXME: This, in turn, relies on LLVM-inlining of from_bool (comparison)! \n  Perhaps we should directly generate the ll_icmp instructions\n*)  \ndefinition [llvm_inline]: \"lift_cmp_op c a b \\<equiv> from_bool (c a b)\"  \n  \n\n\n   \nsubsubsection \\<open>Boolean\\<close>\n\ndefinition \"bool1_rel \\<equiv> bool.rel\"\nabbreviation \"bool1_assn \\<equiv> (pure bool1_rel)\"\n\nlemma bool_const_refine[sepref_import_param]:\n  \"(0,False)\\<in>bool1_rel\"  \n  \"(1,True)\\<in>bool1_rel\"  \n  by (auto simp: bool1_rel_def bool.rel_def in_br_conv)\n  \n\n\nlemma hn_bool_ops:\n  \"(uncurry ll_and, uncurry (PR_CONST (SPECc2 ''and'' (\\<and>)))) \\<in> bool1_assn\\<^sup>k *\\<^sub>a bool1_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n   \"(uncurry ll_or, uncurry (PR_CONST (SPECc2 ''or'' (\\<or>)))) \\<in> bool1_assn\\<^sup>k *\\<^sub>a bool1_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry ll_xor, uncurry (PR_CONST (SPECc2 ''xor'' (op_neq)))) \\<in> bool1_assn\\<^sup>k *\\<^sub>a bool1_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"  \n  \"(ll_not1, PR_CONST (SPECc1 ''add'' Not)) \\<in> bool1_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\" (* TODO: this is strange, but LLVM seems to implement Not, with an add opration *)\n  using bool_bin_ops[THEN bool.hn_bin_op, folded bool1_rel_def, unfolded to_hfref_post]\n    and bool_un_ops[THEN bool.hn_un_op, folded bool1_rel_def]\n  unfolding op_neq_def\n  by simp_all\n\nlemmas f = hn_bool_ops[to_hnr]\nlemmas hn_bool_ops[sepref_fr_rules] (* TODO: strange error *)\nthm f[to_hfref]\nthm sepref_fr_rules\n\nthm hnr_bind\nthm app_rule app'_rule\nthm id_rules pat_rules\ndefinition \"mop_impl x y = do { nx \\<leftarrow> SPECc1 ''add'' Not x; SPECc2 ''and'' (\\<and>) nx y }\"\n\ntext \\<open>We define an implies connective, using sepref\\<close>\nsepref_definition ll_implies is \"uncurry mop_impl\" :: \"bool1_assn\\<^sup>k *\\<^sub>a bool1_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  unfolding imp_conv_disj mop_impl_def\n  by sepref  \n\n\ndeclare ll_implies_def[llvm_inline]\ndeclare ll_implies.refine[sepref_fr_rules]\n\nlemma is_init_bool[sepref_gen_algo_rules]:\n  \"GEN_ALGO False (is_init bool1_assn)\"\n  unfolding GEN_ALGO_def is_init_def\n  unfolding bool1_rel_def bool.rel_def\n  by (simp add: in_br_conv)\n\nsubsubsection \\<open>Direct Word Arithmetic\\<close>\n\nabbreviation \"word_rel \\<equiv> (Id::(_::len word \\<times> _) set)\"\nabbreviation \"word_assn \\<equiv> (id_assn::_::len word \\<Rightarrow> _)\"\nabbreviation word_assn' :: \"'a::len itself \\<Rightarrow> 'a word \\<Rightarrow> 'a word \\<Rightarrow> (llvm_amemory*_) \\<Rightarrow> bool\" \n  where \"word_assn' _ \\<equiv> word_assn\"\n\n(* TODO: Move *)  \ndefinition ll_not :: \"'a::len word \\<Rightarrow> 'a word llM\" where \n  [llvm_inline]: \"ll_not a \\<equiv> doM { a \\<leftarrow> ll_sub 0 a; ll_sub a 1 }\"\n  \n(* plain wrong with time\ncontext llvm_prim_arith_setup begin\n  \n  lemma ll_not_normalize[vcg_normalize_simps]: \"ll_not a = return (~~a)\"\n    unfolding ll_not_def\n    supply [simp] = NOT_eq\n    by vcg_normalize\n  \nend *)\n\n\ncontext begin  \n  interpretation llvm_prim_arith_setup .  \n\ncontext fixes a::num begin  \n  sepref_register \n    \"numeral a :: _ word\"  \n    \"0 :: _ word\"\n    \"1 :: _ word\"\n\n  lemma word_numeral_param[sepref_import_param]:\n    \"(numeral a,PR_CONST (numeral a)) \\<in> word_rel\"  \n    \"(0,0)\\<in>word_rel\"\n    \"(1,1)\\<in>word_rel\"\n    by auto\n        \nend\n  \n   \nsepref_register \n  plus_word: \"(+):: _ word \\<Rightarrow> _\"  \n  minus_word: \"(-):: _ word \\<Rightarrow> _\"  \n  times_word: \"(*):: _ word \\<Rightarrow> _\"  \n  and_word: \"(AND):: _ word \\<Rightarrow> _\"  \n  or_word: \"(OR):: _ word \\<Rightarrow> _\"  \n  xor_word: \"(XOR):: _ word \\<Rightarrow> _\"  \n  \nlemma word_param_imports[sepref_import_param]:\n  \"((+),(+)) \\<in> word_rel \\<rightarrow> word_rel \\<rightarrow> word_rel\"\n  \"((-),(-)) \\<in> word_rel \\<rightarrow> word_rel \\<rightarrow> word_rel\"\n  \"((*),(*)) \\<in> word_rel \\<rightarrow> word_rel \\<rightarrow> word_rel\"\n  \"((AND),(AND)) \\<in> word_rel \\<rightarrow> word_rel \\<rightarrow> word_rel\"\n  \"((OR),(OR)) \\<in> word_rel \\<rightarrow> word_rel \\<rightarrow> word_rel\"\n  \"((XOR),(XOR)) \\<in> word_rel \\<rightarrow> word_rel \\<rightarrow> word_rel\"\n  by simp_all\n\nsepref_register \n  not_word: \"bitNOT:: _ word \\<Rightarrow> _\"  \n\nlemma hn_word_NOT_aux: \"cost ''sub'' 2 = cost ''sub'' 1 + cost ''sub'' 1\"\n  by (auto simp add: cost_same_curr_add) \n\nlemma lift_acost_add: \"lift_acost t + lift_acost t' = lift_acost (t+t')\"\n  unfolding lift_acost_def by (cases t; cases t'; auto)\n\nlemma hn_word_NOT_aux2: \"$(lift_acost (t + t')) = ($(lift_acost t) ** $(lift_acost t'))\"\n  by (simp add: time_credits_add lift_acost_add)\n\nlemma hn_word_NOT[sepref_fr_rules]: \"(ll_not,PR_CONST (SPECc1' (cost ''sub'' (enat 2)) bitNOT)) \\<in> word_assn\\<^sup>k \\<rightarrow>\\<^sub>a word_assn\"\n  unfolding SPECc1'_def ll_not_def hn_word_NOT_aux PR_CONST_def\n  unfolding hn_word_NOT_aux one_enat_def lift_acost_cost[symmetric]\n  apply sepref_to_hoare\n  apply(simp only: hn_word_NOT_aux2)\n  supply [simp] = NOT_eq\n  by vcg\n\n\n\nsepref_register \n  div_word: \"(div):: _ word \\<Rightarrow> _\"  \n  mod_word: \"(mod):: _ word \\<Rightarrow> _\"  \n  sdiv_word: \"(sdiv):: _ word \\<Rightarrow> _\"  \n  smod_word: \"(smod):: _ word \\<Rightarrow> _\"  \nthm vcg_rules\nlemma hn_word_div_op[sepref_fr_rules]:\n  \"(uncurry (ll_udiv),uncurry (PR_CONST (SPECc2 ''udiv'' (div)))) \\<in> [\\<lambda>(_,d). d\\<noteq>0]\\<^sub>a word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow> word_assn\"  \n  \"(uncurry (ll_urem),uncurry (PR_CONST (SPECc2 ''urem'' (mod)))) \\<in> [\\<lambda>(_,d). d\\<noteq>0]\\<^sub>a word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow> word_assn\"  \n  \"(uncurry (ll_sdiv),uncurry (PR_CONST (SPECc2 ''sdiv'' (sdiv)))) \\<in> [\\<lambda>(c,d). d\\<noteq>0 \\<and> in_srange (sdiv) c d]\\<^sub>a word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow> word_assn\"  \n  \"(uncurry (ll_srem),uncurry (PR_CONST (SPECc2 ''srem'' (smod)))) \\<in> [\\<lambda>(c,d). d\\<noteq>0 \\<and> in_srange (sdiv) c d]\\<^sub>a word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow> word_assn\"  \n  unfolding SPECc2_def PR_CONST_def\n      unfolding one_enat_def lift_acost_cost[symmetric]\n      by (sepref_to_hoare, vcg')+\n\nsepref_register \n  eq_word: \"(=):: _ word \\<Rightarrow> _\"  \n  neq_word: \"op_neq:: _ word \\<Rightarrow> _\"  \n  ult_word: \"(<):: _ word \\<Rightarrow> _\"  \n  ule_word: \"(\\<le>):: _ word \\<Rightarrow> _\"  \n  slt_word: \"(<s):: _ word \\<Rightarrow> _\"  \n  sle_word: \"(<=s):: _ word \\<Rightarrow> _\"  \n    \nlemma hn_word_icmp_op[sepref_fr_rules]:\n  \"(uncurry (ll_icmp_eq), uncurry (PR_CONST (SPECc2 ''icmp_eq'' (=)))) \\<in> word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry (ll_icmp_ne), uncurry (PR_CONST (SPECc2 ''icmp_ne'' (op_neq)))) \\<in> word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry (ll_icmp_ult), uncurry (PR_CONST (SPECc2 ''icmp_ult'' (<)))) \\<in> word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry (ll_icmp_ule), uncurry (PR_CONST (SPECc2 ''icmp_ule'' (\\<le>)))) \\<in> word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry (ll_icmp_slt), uncurry (PR_CONST (SPECc2 ''icmp_slt'' (\\<lambda>a b. a <s b)))) \\<in> word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry (ll_icmp_sle), uncurry (PR_CONST (SPECc2 ''icmp_sle'' (\\<lambda>a b. a <=s b)))) \\<in> word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  unfolding bool1_rel_def bool.rel_def PR_CONST_def SPECc2_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n       supply [simp] = in_br_conv\n  by (sepref_to_hoare, vcg)+\n  \n  \nlemma is_init_word[sepref_gen_algo_rules]:\n  \"GEN_ALGO 0 (is_init word_assn)\"\n  unfolding GEN_ALGO_def is_init_def\n  by (simp)\n  \nend  \n      \n\nsubsubsection \\<open>Integer by Word\\<close>\n  \ndefinition \"sint_rel \\<equiv> sint.rel\"\nabbreviation \"sint_assn \\<equiv> pure sint_rel\"  \n\nabbreviation (input) \"sint_rel' TYPE('a::len) \\<equiv> sint_rel :: ('a word \\<times> _) set\"\nabbreviation (input) \"sint_assn' TYPE('a::len) \\<equiv> sint_assn :: _ \\<Rightarrow> 'a word \\<Rightarrow> _\"\n\n\ndefinition [simp]: \"sint_const TYPE('a::len) c \\<equiv> (c::int)\"\ncontext fixes c::int begin\n  sepref_register \"sint_const TYPE('a::len) c\" :: \"int\"\nend\n\n\nlemma fold_sint:\n  \"0 = sint_const TYPE('a::len) 0\"  \n  \"1 = sint_const TYPE('a::len) 1\"  \n  \"-1 \\<equiv> (sint_const TYPE('a::len) (-1))\"  \n  \"numeral n \\<equiv> (sint_const TYPE('a::len) (numeral n))\"\n  \"-(numeral n) \\<equiv> (sint_const TYPE('a::len) (-numeral n))\"\n  by simp_all\n\n\nlemma hn_sint_0[sepref_import_param]:\n  \"(0,sint_const TYPE('a) 0) \\<in> sint_rel' TYPE('a::len)\"\n  by (auto simp: sint_rel_def sint.rel_def in_br_conv)\n\nlemma hn_sint_1[sepref_fr_rules]:\n  \"LENGTH('a)\\<noteq>1 \\<Longrightarrow> hn_refine \\<box> (return 1::_ llM) \\<box> (sint_assn' TYPE('a::len)) (RETURNTecost$PR_CONST (sint_const TYPE('a) 1))\"\n  unfolding APP_def\n  apply sepref_to_hoare unfolding sint_rel_def sint.rel_def in_br_conv by vcg\n\nlemma hn_sint_minus_1[sepref_fr_rules]:\n  \"hn_refine \\<box> (return (-1)::_ llM) \\<box> (sint_assn' TYPE('a::len)) (RETURN$PR_CONST (sint_const TYPE('a) (-1)))\"\n  unfolding APP_def\n  apply sepref_to_hoare unfolding sint_rel_def sint.rel_def in_br_conv by vcg\n  \nlemma hn_sint_numeral[sepref_fr_rules]:\n  \"\\<lbrakk>numeral n \\<in> sints LENGTH('a)\\<rbrakk> \\<Longrightarrow> \n    hn_refine \\<box> (return (numeral n)::_ llM) \\<box> (sint_assn' TYPE('a::len)) (RETURN$(PR_CONST (sint_const TYPE('a) (numeral n))))\"\n  unfolding APP_def\n  apply sepref_to_hoare unfolding sint_rel_def sint.rel_def in_br_conv \n  apply vcg'\n  by (auto simp: sbintrunc_mod2p min_sint_def max_sint_def ll_const_signed_aux)\n\nlemma hn_sint_minus_numeral[sepref_fr_rules]:\n  \"\\<lbrakk>-numeral n \\<in> sints LENGTH('a)\\<rbrakk> \\<Longrightarrow> \n    hn_refine \\<box> (return (-numeral n)::_ llM) \\<box> (sint_assn' TYPE('a::len)) (RETURN$(PR_CONST (sint_const TYPE('a) (-numeral n))))\"\n  unfolding APP_def\n  apply sepref_to_hoare unfolding sint_rel_def sint.rel_def in_br_conv \n  apply vcg'\n  apply (auto simp: sbintrunc_mod2p min_sint_def max_sint_def ll_const_signed_aux)\n  by (smt diff_Suc_less int_mod_eq' len_gt_0 neg_numeral_le_numeral power_strict_increasing_iff)\n\n  \nsepref_register \n  plus_int: \"(+)::int\\<Rightarrow>_\"    :: \"int \\<Rightarrow> int \\<Rightarrow> int\"\n  minus_int: \"(-)::int\\<Rightarrow>_\"   :: \"int \\<Rightarrow> int \\<Rightarrow> int\"\n  times_int: \"(*)::int\\<Rightarrow>_\"  :: \"int \\<Rightarrow> int \\<Rightarrow> int\"\n  sdiv_int: \"(sdiv)::int\\<Rightarrow>_\" :: \"int \\<Rightarrow> int \\<Rightarrow> int\"\n  smod_int: \"(smod)::int\\<Rightarrow>_\" :: \"int \\<Rightarrow> int \\<Rightarrow> int\"\n  \nsepref_register \n  eq_int: \"(=)::int\\<Rightarrow>_\"        :: \"int \\<Rightarrow> int \\<Rightarrow> bool\"\n  op_neq_int: \"op_neq::int\\<Rightarrow>_\" :: \"int \\<Rightarrow> int \\<Rightarrow> bool\"\n  lt_int: \"(<)::int\\<Rightarrow>_\"        :: \"int \\<Rightarrow> int \\<Rightarrow> bool\"\n  le_int: \"(\\<le>)::int\\<Rightarrow>_\"        :: \"int \\<Rightarrow> int \\<Rightarrow> bool\"\n  \nsepref_register    \n  and_int: \"(AND):: int \\<Rightarrow> _\"  \n  or_int: \"(OR):: int \\<Rightarrow> _\"  \n  xor_int: \"(XOR):: int \\<Rightarrow> _\"\n  shiftr_int: \"(<<) :: int \\<Rightarrow> nat \\<Rightarrow> int\"\n  shiftl_int: \"(>>) :: int \\<Rightarrow> nat \\<Rightarrow> int\"\n\n\nthm sint_cmp_ops[THEN sint.hn_cmp_op, folded sint_rel_def, unfolded to_hfref_post]  \nthm sint_bin_ops[THEN sint.hn_bin_op, folded sint_rel_def, unfolded to_hfref_post]  \n  \nlemma hn_sint_ops[sepref_fr_rules]:\n  \"(uncurry ll_add, uncurry (PR_CONST (SPECc2 ''add'' (+))))\n    \\<in> [\\<lambda>(a, b). a + b \\<in> sints LENGTH('a)]\\<^sub>a sint_assn\\<^sup>k *\\<^sub>a sint_assn\\<^sup>k \\<rightarrow> sint_assn' TYPE('a::len)\"\n  \"(uncurry ll_sub, uncurry (PR_CONST (SPECc2 ''sub'' (-))))\n    \\<in> [\\<lambda>(a, b). a - b \\<in> sints LENGTH('a)]\\<^sub>a sint_assn\\<^sup>k *\\<^sub>a sint_assn\\<^sup>k \\<rightarrow> sint_assn' TYPE('a::len)\"\n  \"(uncurry ll_mul, uncurry (PR_CONST (SPECc2 ''mul'' (*))))\n    \\<in> [\\<lambda>(a, b). a * b \\<in> sints LENGTH('a)]\\<^sub>a sint_assn\\<^sup>k *\\<^sub>a sint_assn\\<^sup>k \\<rightarrow> sint_assn' TYPE('a::len)\"\n  \"(uncurry ll_sdiv, uncurry (PR_CONST (SPECc2 ''sdiv'' (sdiv))))\n    \\<in> [\\<lambda>(a, b). b \\<noteq> 0 \\<and> a sdiv b \\<in> sints LENGTH('a)]\\<^sub>a sint_assn\\<^sup>k *\\<^sub>a sint_assn\\<^sup>k \\<rightarrow> sint_assn' TYPE('a::len)\"\n  \"(uncurry ll_srem, uncurry (PR_CONST (SPECc2 ''srem'' (smod))))\n    \\<in> [\\<lambda>(a, b). b \\<noteq> 0 \\<and> a sdiv b \\<in> sints LENGTH('a)]\\<^sub>a sint_assn\\<^sup>k *\\<^sub>a sint_assn\\<^sup>k \\<rightarrow> sint_assn' TYPE('a::len)\"\n    \n  \"(uncurry ll_icmp_eq, uncurry (PR_CONST (SPECc2 ''icmp_eq''  (=)))) \\<in> sint_assn\\<^sup>k *\\<^sub>a sint_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry ll_icmp_ne, uncurry (PR_CONST (SPECc2 ''icmp_ne''  (op_neq)))) \\<in> sint_assn\\<^sup>k *\\<^sub>a sint_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry ll_icmp_sle, uncurry (PR_CONST (SPECc2 ''icmp_sle'' (\\<le>)))) \\<in> sint_assn\\<^sup>k *\\<^sub>a sint_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry ll_icmp_slt, uncurry (PR_CONST (SPECc2 ''icmp_slt'' (<)))) \\<in> sint_assn\\<^sup>k *\\<^sub>a sint_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  unfolding op_neq_def PR_CONST_def\n  using sint_bin_ops[THEN sint.hn_bin_op, folded sint_rel_def, unfolded to_hfref_post]\n    and sint_cmp_ops[THEN sint.hn_cmp_op, folded sint_rel_def bool1_rel_def, unfolded to_hfref_post]\n  apply simp_all\n  done\n\n\n      \ndefinition [simp]: \"sint_init TYPE('a::len) \\<equiv> 0::int\"\n\n(* TODO: Add rule for 0 *)\nlemma is_init_sint[sepref_gen_algo_rules]:\n  \"GEN_ALGO (sint_init TYPE('a::len)) (is_init (sint_assn' TYPE('a)))\"\n  unfolding GEN_ALGO_def sint_init_def is_init_def\n  unfolding sint_rel_def sint.rel_def\n  by (simp add: in_br_conv)\n  \nlemma is_init_sint0[sepref_gen_algo_rules]: \n  \"GEN_ALGO (sint_const TYPE('a::len) 0) (is_init (sint_assn' TYPE('a)))\"\n  using is_init_sint[where 'a='a]\n  by simp\n  \n\nsubsubsection \\<open>Natural Numbers by Unsigned Word\\<close>\n\nsepref_register \n  plus_nat: \"(+)::nat\\<Rightarrow>_\"    :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\"\n  minus_nat: \"(-)::nat\\<Rightarrow>_\"   :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\"\n  times_nat: \"(*)::nat\\<Rightarrow>_\"  :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\"\n  div_nat: \"(div)::nat\\<Rightarrow>_\"   :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\"\n  mod_nat: \"(mod)::nat\\<Rightarrow>_\"   :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\"\n  \nsepref_register \n  eq_nat: \"(=)::nat\\<Rightarrow>_\"        :: \"nat \\<Rightarrow> nat \\<Rightarrow> bool\"\n  op_neq_nat: \"op_neq::nat\\<Rightarrow>_\" :: \"nat \\<Rightarrow> nat \\<Rightarrow> bool\"\n  lt_nat: \"(<)::nat\\<Rightarrow>_\"        :: \"nat \\<Rightarrow> nat \\<Rightarrow> bool\"\n  le_nat: \"(\\<le>)::nat\\<Rightarrow>_\"        :: \"nat \\<Rightarrow> nat \\<Rightarrow> bool\"\n  \nsepref_register    \n  and_nat: \"(AND):: nat \\<Rightarrow> _\"  \n  or_nat: \"(OR):: nat \\<Rightarrow> _\"  \n  xor_nat: \"(XOR):: nat \\<Rightarrow> _\"  \n  shiftr_nat: \"(<<) :: nat \\<Rightarrow> _ \\<Rightarrow> _\"\n  shiftl_nat: \"(>>) :: nat \\<Rightarrow> _ \\<Rightarrow> _\"\n\n\ndefinition unat_rel :: \"('a::len word \\<times> nat) set\" where \"unat_rel \\<equiv> unat.rel\"\nabbreviation \"unat_assn \\<equiv> pure unat_rel\"  \n\nabbreviation (input) \"unat_rel' TYPE('a::len) \\<equiv> unat_rel :: ('a word \\<times> _) set\"\nabbreviation (input) \"unat_assn' TYPE('a::len) \\<equiv> unat_assn :: _ \\<Rightarrow> 'a word \\<Rightarrow> _\"\n\n\ndefinition [simp]: \"unat_const TYPE('a::len) c \\<equiv> (c::nat)\"\ncontext fixes c::nat begin\n  sepref_register \"unat_const TYPE('a::len) c\" :: \"nat\"\nend\n\nlemma fold_unat:\n  \"0 = unat_const TYPE('a::len) 0\"  \n  \"1 = unat_const TYPE('a::len) 1\"  \n  \"numeral n \\<equiv> (unat_const TYPE('a::len) (numeral n))\"\n  by simp_all\n\n  \nlemma hn_unat_0[sepref_fr_rules]:\n  \"hn_refine \\<box> (return 0::_ llM) \\<box> (unat_assn' TYPE('a::len)) (RETURN$PR_CONST (unat_const TYPE('a) 0))\"\n  unfolding APP_def\n  apply sepref_to_hoare\n  unfolding unat_rel_def unat.rel_def in_br_conv\n  apply vcg\n  done\n  \nlemma hn_unat_1[sepref_fr_rules]:\n  \"hn_refine \\<box> (return 1::_ llM) \\<box> (unat_assn' TYPE('a::len)) (RETURN$PR_CONST (unat_const TYPE('a) 1))\"\n  unfolding APP_def\n  apply sepref_to_hoare\n  unfolding unat_rel_def unat.rel_def in_br_conv\n  apply vcg\n  done\n  \n  \nlemma hn_unat_numeral[sepref_fr_rules]:\n  \"\\<lbrakk>numeral n \\<in> unats LENGTH('a)\\<rbrakk> \\<Longrightarrow> \n    hn_refine \\<box> (return (numeral n)::_ llM) \\<box> (unat_assn' TYPE('a::len)) (RETURN$(PR_CONST (unat_const TYPE('a) (numeral n))))\"\n  unfolding APP_def\n  apply sepref_to_hoare unfolding unat_rel_def unat.rel_def in_br_conv \n  apply vcg'\n  by (metis in_unats_conv int_nat_eq of_nat_numeral uint_nonnegative unat_bintrunc unat_def word_of_int_numeral word_uint.Rep_inverse' word_unat.Rep_cases)\n\n  \nlemma hn_unat_ops[sepref_fr_rules]:\n  \"(uncurry ll_add, uncurry (PR_CONST (SPECc2 ''add'' (+)))) \\<in> [\\<lambda>(a, b). a + b < max_unat LENGTH('a)]\\<^sub>a unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow> unat_assn' TYPE('a::len)\"\n  \"(\\<lambda>x. ll_add x 1, (PR_CONST (SPECc1 ''add'' Suc))) \\<in> [\\<lambda>a. Suc a < max_unat LENGTH('a)]\\<^sub>a unat_assn\\<^sup>k \\<rightarrow> unat_assn' TYPE('a)\"\n  \"(uncurry ll_sub, uncurry (PR_CONST (SPECc2 ''sub'' (-)))) \\<in> [\\<lambda>(a, b). b \\<le> a]\\<^sub>a unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow> unat_assn\"\n  \"(uncurry ll_mul, uncurry (PR_CONST (SPECc2 ''mul'' (*)))) \\<in> [\\<lambda>(a, b). a * b < max_unat LENGTH('a)]\\<^sub>a unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow> unat_assn' TYPE('a::len)\"\n  \"(uncurry ll_udiv, uncurry (PR_CONST (SPECc2 ''udiv'' (div)))) \\<in> [\\<lambda>(a, b). b \\<noteq> 0]\\<^sub>a unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow> unat_assn\"\n  \"(uncurry ll_urem, uncurry (PR_CONST (SPECc2 ''urem'' (mod)))) \\<in> [\\<lambda>(a, b). b \\<noteq> 0]\\<^sub>a unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow> unat_assn\"\n  \n  \"(uncurry ll_and, uncurry (PR_CONST (SPECc2 ''and'' (AND)))) \\<in> unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow>\\<^sub>a unat_assn\"\n  \"(uncurry ll_or, uncurry (PR_CONST (SPECc2 ''or'' (OR)))) \\<in> unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow>\\<^sub>a unat_assn\"\n  \"(uncurry ll_xor, uncurry (PR_CONST (SPECc2 ''xor'' (XOR)))) \\<in> unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow>\\<^sub>a unat_assn\"\n  \n  \"(uncurry ll_icmp_eq, uncurry (PR_CONST (SPECc2 ''icmp_eq'' (=)))) \\<in> unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry ll_icmp_ne, uncurry (PR_CONST (SPECc2 ''icmp_ne'' (op_neq)))) \\<in> unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry ll_icmp_ule, uncurry (PR_CONST (SPECc2 ''icmp_ule'' (\\<le>)))) \\<in> unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry ll_icmp_ult, uncurry (PR_CONST (SPECc2 ''icmp_ult'' (<)))) \\<in> unat_assn\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"  \n  unfolding op_neq_def PR_CONST_def\n  \n  using unat_bin_ops[THEN unat.hn_bin_op, folded unat_rel_def]\n    and unat_un_ops[THEN unat.hn_un_op, folded unat_rel_def]\n    and unat_bin_ops_bitwise[THEN unat.hn_bin_op, folded unat_rel_def]\n    and unat_cmp_ops[THEN unat.hn_cmp_op, folded unat_rel_def bool1_rel_def]\n  by (simp_all add: prod_casesK)\n  \ndefinition [simp]: \"unat_init TYPE('a::len) \\<equiv> 0::nat\"\n\nlemma is_init_unat[sepref_gen_algo_rules]:\n  \"GEN_ALGO (unat_init TYPE('a::len)) (is_init (unat_assn' TYPE('a)))\"\n  unfolding GEN_ALGO_def unat_init_def is_init_def\n  unfolding unat_rel_def unat.rel_def\n  by (simp add: in_br_conv)\n  \nlemma is_init_unat0[sepref_gen_algo_rules]: \n  \"GEN_ALGO (unat_const TYPE('a::len2) 0) (is_init (unat_assn' TYPE('a)))\"\n  using is_init_unat[where 'a='a]\n  by simp\n\nlemma exists_pure_conv:\n  \\<open>(\\<exists>x. (\\<up>(x = a)) s) = \\<box>s\\<close>\n  by (auto intro!: exI[of _ a] simp: pure_true_conv pred_lift_def)\n\nlemma bit_lshift_unat_assn[sepref_fr_rules]:\n  \\<open>(uncurry ll_lshr, uncurry (PR_CONST (SPECc2 ''lshr'' (>>)))) \\<in> [\\<lambda>(a,b). b < LENGTH('a)]\\<^sub>a\n    (unat_assn' TYPE('a::len2))\\<^sup>k *\\<^sub>a (unat_assn)\\<^sup>k \\<rightarrow> (unat_assn)\\<close>\n  unfolding PR_CONST_def SPECc2_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n  apply sepref_to_hoare\n  apply (vcg)\n  subgoal for b  bi a ai F aa ba\n  apply(rule wp_monoI[OF llvm_prim_arith_setup.ll_lshr_rule[THEN htripleD, where F=F]])\n  unfolding WBOUNDS_def STATE_def\n  apply (auto simp: unat_rel_def unat.rel_def br_def unat_def ll_lshr_def wp_return\n     op_lift_arith2_def Let_def fcheck_def shift_ovf_def word_to_lint_to_uint_conv bitLSHR'_def\n     nat_div_distrib nat_power_eq pred_lift_merge_simps\n     cnv_snat_to_uint(1) in_br_conv snat.rel_def snat_invar_def\n   simp flip: word_to_lint_lshr)\n  apply (simp_all add: POSTCOND_def STATE_def STATE_extract(2) shiftr_div_2n shiftr_nat_def exists_pure_conv)\n  by (simp add: pred_lift_extract_simps(2) shiftr_div_2n)  \n  (* TODO: problem with Suc 0 and 1 *)\n  done\n\nlemma bit_shiftl_unat_assn[sepref_fr_rules]:\n  \\<open>(uncurry ll_shl, uncurry (PR_CONST (SPECc2 ''shl'' (<<)))) \\<in> [\\<lambda>(a,b). b < LENGTH('a) \\<and> (a << b) < max_unat LENGTH('a)]\\<^sub>a\n    (unat_assn' TYPE('a::len2))\\<^sup>k *\\<^sub>a (unat_assn)\\<^sup>k \\<rightarrow> (unat_assn)\\<close>\nproof -\n  have [simp]: \\<open>nat (bi) < LENGTH('a :: len2) \\<Longrightarrow>\n       nat (uint (ai :: 'a word) * 2 ^ nat (bi)) < max_unat LENGTH('a) \\<Longrightarrow>\n       nat (bintrunc (size ai) (uint ai << nat (bi))) = nat (uint ai * 2 ^ nat (bi))\\<close> for bi ai\n    by (metis (full_types) max_unat_def nat_less_numeral_power_cancel_iff shiftl_int_def uint_mult_lem\n      uint_power_lower uint_word_arith_bintrs(3) word_size)\n  show ?thesis\n  unfolding PR_CONST_def SPECc2_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n    apply sepref_to_hoare\n    apply (vcg) (* TODO: same problem as above *)\n  subgoal for b  bi a ai F aa ba\n    apply(rule wp_monoI[OF llvm_prim_arith_setup.ll_shl_rule[THEN htripleD, where F=F]])\n    unfolding WBOUNDS_def STATE_def\n      apply (auto simp: unat_rel_def unat.rel_def br_def unat_def ll_shl_def wp_return\n        op_lift_arith2_def Let_def fcheck_def shift_ovf_def word_to_lint_to_uint_conv bitSHL'_def\n        nat_div_distrib nat_power_eq pred_lift_merge_simps\n        cnv_snat_to_uint(1) in_br_conv snat.rel_def snat_invar_def\n        simp flip: word_to_lint_shl) (* TODO: problem with Suc *)\n    apply (simp_all add: POSTCOND_def STATE_extract(2) shiftr_div_2n shiftl_nat_def\n        uint_shiftl exists_pure_conv STATE_def)\n    by (smt \\<open>\\<And>bi ai. \\<lbrakk>nat bi < LENGTH('a); nat (uint ai * 2 ^ nat bi) < max_unat LENGTH('a)\\<rbrakk> \\<Longrightarrow> nat (bintrunc (size ai) (uint ai << nat bi)) = nat (uint ai * 2 ^ nat bi)\\<close> mult.commute pred_lift_extract_simps(2) shiftl_int_def shiftl_t2n uint_power_lower uint_word_arith_bintrs(3) wsst_TYs(3))\n  done\nqed\n\nsubsubsection \\<open>Natural Numbers by Signed Word\\<close>\n\ndefinition snat_rel :: \"('a::len2 word \\<times> nat) set\" where \"snat_rel \\<equiv> snat.rel\"\nabbreviation \"snat_assn \\<equiv> pure snat_rel\"  \n\nabbreviation (input) \"snat_rel' TYPE('a::len2) \\<equiv> snat_rel :: ('a word \\<times> _) set\"\nabbreviation (input) \"snat_assn' TYPE('a::len2) \\<equiv> snat_assn :: _ \\<Rightarrow> 'a word \\<Rightarrow> _\"\n\n(* TODO: Too many snat_rel_ < max_snat lemma variants! *)\nlemma snat_rel_range: \"Range (snat_rel' TYPE('l)) = {0..<max_snat LENGTH('l::len2)}\"\n  (* TODO: Clean up proof! *)\n  apply (auto simp: Range_iff snat_rel_def snat.rel_def in_br_conv)\n  subgoal for x\n    apply (rule exI[where x=\"word_of_int (int x)\"])\n    apply (auto simp: max_snat_def snat_invar_def)\n    subgoal\n      by (metis One_nat_def snat_eq_unat(1) snat_in_bounds_aux unat_of_nat_eq word_of_nat) \n    subgoal\n      by (metis One_nat_def Word_Lemmas.of_nat_power diff_less len_gt_0 max_unat_def n_less_equal_power_2 not_msb_from_less power_0 word_of_nat)\n    done\n  done\n\n\ndefinition [simp]: \"snat_const TYPE('a::len2) c \\<equiv> (c::nat)\"\ncontext fixes c::nat begin\n  sepref_register \"snat_const TYPE('a::len2) c\" :: \"nat\"\nend\n\n\nlemma fold_snat:\n  \"0 = snat_const TYPE('a::len2) 0\"  \n  \"1 = snat_const TYPE('a::len2) 1\"  \n  \"numeral n \\<equiv> (snat_const TYPE('a::len2) (numeral n))\"\n  by simp_all\n\n(* TODO: Move, and use for proofs about snat in LLVM_Shallow_RS *)  \nlemma snat_invar_0: \"snat_invar (0)\"  \n  by (simp add: snat_invar_def)\n\nlemma snat_invar_1: \"snat_invar (1)\"  \n  by (simp add: snat_invar_def)\n  \nlemma snat_invar_numeral: \"\\<lbrakk> numeral a < max_snat LENGTH('a::len2) \\<rbrakk> \\<Longrightarrow>\n  snat_invar (numeral a::'a word)\"\n  by (metis (full_types) One_nat_def ll_const_signed_nat_aux2 max_snat_def snat_invar_def)\n  \n  \nlemma hn_snat_0[sepref_fr_rules]:\n  \"hn_refine \\<box> (return 0::_ llM) \\<box> (snat_assn' TYPE('a::len2)) (RETURN$PR_CONST (snat_const TYPE('a) 0))\"\n  unfolding APP_def\n  apply sepref_to_hoare\n  unfolding snat_rel_def snat.rel_def in_br_conv\n  supply [simp] = snat_invar_0\n  apply vcg\n  done\n  \nlemma hn_snat_1[sepref_fr_rules]:\n  \"hn_refine \\<box> (return 1::_ llM) \\<box> (snat_assn' TYPE('a::len2)) (RETURN$PR_CONST (snat_const TYPE('a) 1))\"\n  unfolding APP_def\n  apply sepref_to_hoare\n  unfolding snat_rel_def snat.rel_def in_br_conv\n  supply [simp] = snat_invar_1\n  apply vcg\n  done\n  \n  \nlemma hn_snat_numeral[sepref_fr_rules]:\n  \"\\<lbrakk>numeral n \\<in> snats LENGTH('a)\\<rbrakk> \\<Longrightarrow> \n    hn_refine \\<box> (return (numeral n)::_ llM) \\<box> (snat_assn' TYPE('a::len2)) (RETURN$(PR_CONST (snat_const TYPE('a) (numeral n))))\"\n  unfolding APP_def\n  apply sepref_to_hoare unfolding snat_rel_def snat.rel_def in_br_conv \n  supply [simp] = snat_invar_numeral\n  apply vcg'\n  done\n  \nlemma hn_snat_ops[sepref_fr_rules]:\n  \"(uncurry ll_add, uncurry (PR_CONST (SPECc2 ''add'' (+)))) \\<in> [\\<lambda>(a, b). a + b < max_snat LENGTH('a)]\\<^sub>a snat_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow> snat_assn' TYPE('a::len2)\"\n  \"(\\<lambda>x. ll_add x 1, (PR_CONST (SPECc1 ''add'' Suc))) \\<in> [\\<lambda>a. Suc a < max_snat LENGTH('a)]\\<^sub>a snat_assn\\<^sup>k \\<rightarrow> snat_assn' TYPE('a::len2)\"\n  \"(uncurry ll_sub, uncurry (PR_CONST (SPECc2 ''sub'' (-)))) \\<in> [\\<lambda>(a, b). b \\<le> a]\\<^sub>a snat_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow> snat_assn\"\n  \"(uncurry ll_mul, uncurry (PR_CONST (SPECc2 ''mul'' (*)))) \\<in> [\\<lambda>(a, b). a * b < max_snat LENGTH('a)]\\<^sub>a snat_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow> snat_assn' TYPE('a::len2)\"\n  \"(uncurry ll_udiv, uncurry (PR_CONST (SPECc2 ''udiv'' (div)))) \\<in> [\\<lambda>(a, b). b \\<noteq> 0]\\<^sub>a snat_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow> snat_assn\"\n  \"(uncurry ll_urem, uncurry (PR_CONST (SPECc2  ''urem'' (mod)))) \\<in> [\\<lambda>(a, b). b \\<noteq> 0]\\<^sub>a snat_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow> snat_assn\"\n  \n  \"(uncurry ll_icmp_eq, uncurry (PR_CONST (SPECc2 ''icmp_eq'' (=)))) \\<in> snat_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry ll_icmp_ne, uncurry (PR_CONST (SPECc2 ''icmp_ne'' (op_neq)))) \\<in> snat_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry ll_icmp_sle, uncurry (PR_CONST (SPECc2 ''icmp_sle'' (\\<le>)))) \\<in> snat_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n  \"(uncurry ll_icmp_slt, uncurry (PR_CONST (SPECc2 ''icmp_slt'' (<)))) \\<in> snat_assn\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"  \n  unfolding op_neq_def\n  using snat_bin_ops[THEN snat.hn_bin_op, folded snat_rel_def]\n    and snat_un_ops[THEN snat.hn_un_op, folded snat_rel_def]\n    and snat_cmp_ops[THEN snat.hn_cmp_op, folded snat_rel_def bool1_rel_def]\n  by simp_all\n  \n\nlemma bit_lshift_snat_assn[sepref_fr_rules]:\n  \\<open>(uncurry ll_lshr, uncurry (PR_CONST (SPECc2 ''lshr'' (>>)))) \\<in> [\\<lambda>(a,b). b < LENGTH('a)]\\<^sub>a\n    (snat_assn' TYPE('a::len2))\\<^sup>k *\\<^sub>a (snat_assn)\\<^sup>k \\<rightarrow> (snat_assn)\\<close>\n  unfolding PR_CONST_def SPECc2_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n  apply sepref_to_hoare\n  apply (vcg)\n  subgoal for b  bi a ai F aa ba\n    apply(rule wp_monoI[OF llvm_prim_arith_setup.ll_lshr_rule[THEN htripleD, where F=F]])\n    unfolding WBOUNDS_def STATE_def\n      apply (auto simp: unat_rel_def unat.rel_def br_def unat_def ll_lshr_def wp_return\n        op_lift_arith2_def Let_def fcheck_def shift_ovf_def word_to_lint_to_uint_conv bitLSHR'_def\n        nat_div_distrib nat_power_eq pred_lift_merge_simps snat_rel_def\n        cnv_snat_to_uint(1) in_br_conv snat.rel_def snat_invar_def\n        simp flip: word_to_lint_lshr)\n    apply (simp_all add: POSTCOND_def STATE_def STATE_extract(2) shiftr_div_2n shiftr_nat_def exists_pure_conv)\n    by (simp add: cnv_snat_to_uint(1) pred_lift_extract_simps(2) shiftr_div_2n snat_invar_def) \n  done\n\nlemma bit_shiftl_snat_assn[sepref_fr_rules]:\n  \\<open>(uncurry ll_shl, uncurry (PR_CONST (SPECc2 ''shl'' (<<)))) \\<in> [\\<lambda>(a,b). b < LENGTH('a) \\<and> (a << b) < max_snat LENGTH('a)]\\<^sub>a\n    (snat_assn' TYPE('a::len2))\\<^sup>k *\\<^sub>a (snat_assn)\\<^sup>k \\<rightarrow> (snat_assn)\\<close>\nproof -\n  have H: \\<open>nat (bi) < LENGTH('a :: len2) \\<Longrightarrow>\n       nat (uint (ai :: 'a word) * 2 ^ nat (bi)) < max_unat LENGTH('a) \\<Longrightarrow>\n       nat (bintrunc (size ai) (uint ai << nat (bi))) = nat (uint ai * 2 ^ nat (bi))\\<close> for bi ai\n    by (metis max_unat_def nat_less_numeral_power_cancel_iff shiftl_int_def uint_mult_lem\n      uint_power_lower uint_word_arith_bintrs(3) word_size)\n  have H': \\<open>nat (bi) < LENGTH('a :: len2) \\<Longrightarrow>\n       nat (uint (ai :: 'a word) * 2 ^ nat (bi)) < max_snat LENGTH('a) \\<Longrightarrow>\n       nat (bintrunc (size ai) (uint ai << nat (bi))) = nat (uint ai * 2 ^ nat (bi))\\<close> for bi ai\n    using H[of bi ai] apply (auto simp: max_snat_def max_unat_def)\n    using nat_less_numeral_power_cancel_iff snat_in_bounds_aux by blast\n\n  show ?thesis\n  unfolding PR_CONST_def SPECc2_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n  proof (sepref_to_hoare, vcg)\n    fix bi ai :: \\<open>'a word\\<close> and  a b F s\n    assume\n       le: \\<open>b < LENGTH('a)\\<close>  \\<open>a << b < max_snat LENGTH('a)\\<close> and\n       a: \\<open>(ai, a) \\<in> snat_rel\\<close> and\n       b: \\<open>(bi, b) \\<in> snat_rel\\<close> and\n       state: \\<open>llSTATE ($lift_acost (cost ''shl'' (Suc 0)) \\<and>* F) s\\<close>\n   have \\<open>nat (uint ai) << nat (uint bi) < 2 ^ (LENGTH('a) - Suc 0)\\<close>\n     using le a b\n     by (auto simp: sint_uint word_size uint_shiftl br_def nat_shiftr_div\n       shiftl_int_def max_snat_def max_unat_def snat_rel_def snat.rel_def cnv_snat_to_uint\n       nat_mult_distrib nat_power_eq)\n   then have \\<open>(uint ai) << nat (uint bi) < 2 ^ (LENGTH('a) - Suc 0)\\<close>\n     using le a b unfolding shiftr_int_def\n     using int_nat_eq nat_2 nat_shiftr_div numeral_2_eq_2 of_nat_less_iff of_nat_mult\n       semiring_1_class.of_nat_power shiftl_int_def uint_nonnegative\n     by (smt br_def cnv_snat_to_uint(1) diff_less len_gt_0 lessI mem_Collect_eq prod.simps(2) snat.rel_def snat_rel_def uint_power_lower unat_def unat_power_lower)\n   then have le': \\<open>ai << nat (uint bi) < 2 ^ (LENGTH('a) - Suc 0)\\<close>\n     using le apply (auto simp: max_snat_def)\n     apply (subst (asm) nat_less_eq_zless[symmetric], simp, subst word_less_alt)\n     apply (subst nat_less_eq_zless[symmetric])\n     using le a b\n     apply (auto simp: sint_uint word_size br_def uint_power_lower\n        max_snat_def max_unat_def snat_rel_def snat.rel_def cnv_snat_to_uint)[]\n     apply (auto simp flip:  numeral_2_eq_2 simp: uint_shiftl word_size nat_power_eq uint_power_lower\n        intro!: bintrunc_le)\n     done\n\n    have [simp]: \\<open>nat (bintrunc (size ai) (uint ai << nat (uint bi))) = nat (uint ai * 2 ^ nat (uint bi))\\<close>\n      using le a b by (auto simp: max_snat_def max_unat_def snat_rel_def snat.rel_def H'\n       br_def cnv_snat_to_uint(1) nat_mult_distrib nat_power_eq nat_shiftr_div)\n   have \\<open>- (3 * 2 ^ (LENGTH('a) - Suc 0)) \\<le> uint ai * 2 ^ nat (uint bi)\\<close>\n     by (smt int_nat_eq nat_mult_distrib of_nat_mult uint_add_ge0 zero_le_power)\n   moreover have \\<open>uint ai * 2 ^ nat (uint bi) < 3 * 2 ^ (LENGTH('a) - Suc 0)\\<close>\n     apply (subst nat_less_eq_zless[symmetric], simp, subst nat_mult_distrib)\n     using le a b\n     by (auto simp: sint_uint word_size uint_shiftl br_def nat_shiftr_div\n       shiftl_int_def max_snat_def max_unat_def snat_rel_def snat.rel_def cnv_snat_to_uint\n       nat_mult_distrib nat_power_eq)\n   moreover have \\<open>\\<not>2 ^ (LENGTH('a) - Suc 0) \\<le> uint ai * 2 ^ nat (uint bi)\\<close>\n     using le\n     apply (subst nat_le_eq_zle[symmetric], simp, subst nat_mult_distrib)\n     using H'[of \\<open>uint bi\\<close> ai]  le a b\n     by (auto simp del: H' simp: sint_uint word_size uint_shiftl sbintrunc_If\n      shiftl_int_def max_snat_def max_unat_def snat_rel_def snat.rel_def br_def\n      cnv_snat_to_uint(1) nat_power_eq nat_shiftr_div)\n   moreover have \\<open>\\<not>uint ai * 2 ^ nat (uint bi) < - (2 ^ (LENGTH('a) - Suc 0))\\<close>\n     apply (subst nat_less_eq_zless[symmetric], simp, subst nat_mult_distrib)\n     using le a b\n     by (auto simp: sint_uint word_size uint_shiftl br_def nat_shiftr_div\n       shiftl_int_def max_snat_def max_unat_def snat_rel_def snat.rel_def cnv_snat_to_uint\n       nat_mult_distrib nat_power_eq)\n   ultimately have \\<open>nat (sint (ai << nat (uint bi))) = nat (uint ai * 2 ^ nat (uint bi))\\<close>\n     using H'[of \\<open>uint bi\\<close> ai]  le a b\n     by (auto simp: sint_uint word_size uint_shiftl sbintrunc_If\n      shiftl_int_def max_snat_def max_unat_def snat_rel_def snat.rel_def)\n   have [simp]: \\<open>\\<not> msb (ai << nat (uint bi))\\<close>\n     apply (subst msb_shiftl_word[OF _])\n     using le le' a b state\n     unfolding snat_rel_def snat.rel_def br_def\n     by (auto simp: br_def snat_def ll_shl_def wp_return\n        op_lift_arith2_def Let_def fcheck_def shift_ovf_def word_to_lint_to_uint_conv bitSHL'_def\n        nat_div_distrib nat_power_eq pred_lift_merge_simps sint_eq_uint max_snat_def\n          cnv_snat_to_uint(1) in_br_conv snat.rel_def snat_invar_def\n          POSTCOND_def STATE_extract(2) shiftr_div_2n shiftl_nat_def\n       uint_shiftl exists_pure_conv)\n   show \\<open>wp (ll_shl ai bi)\n         (\\<lambda>r. llPOST\n               ((\\<up>((ai, a) \\<in> snat_rel) \\<and>*\n                 \\<up>((bi, b) \\<in> snat_rel) \\<and>*\n                 \\<up>((r, a << b) \\<in> snat_rel) \\<and>* GC) \\<and>*\n                F))\n         s\\<close>\n     apply(rule wp_monoI[OF llvm_prim_arith_setup.ll_shl_rule[THEN htripleD, where F=F]])\n     using le a b state\n     unfolding snat_rel_def snat.rel_def br_def WBOUNDS_def STATE_def\n     apply (auto simp: br_def snat_def ll_shl_def wp_return\n        op_lift_arith2_def Let_def fcheck_def shift_ovf_def word_to_lint_to_uint_conv bitSHL'_def\n        nat_div_distrib nat_power_eq pred_lift_merge_simps sint_eq_uint max_snat_def\n        cnv_snat_to_uint(1) in_br_conv snat.rel_def snat_invar_def\n      simp flip: word_to_lint_shl)\n     apply (simp_all add: POSTCOND_def STATE_extract(2) shiftr_div_2n shiftl_nat_def\n       uint_shiftl exists_pure_conv)\n     subgoal by (simp add: unat_def)\n     subgoal by (simp add: STATE_alt \\<open>nat (sint (ai << nat (uint bi))) = nat (uint ai * 2 ^ nat (uint bi))\\<close> pred_lift_extract_simps(2) unat_def)\n    done\n  qed\nqed\n\ndefinition [simp]: \"snat_init TYPE('a::len) \\<equiv> 0::nat\"\n\nlemma is_init_snat[sepref_gen_algo_rules]:\n  \"GEN_ALGO (snat_init TYPE('a::len2)) (is_init (snat_assn' TYPE('a)))\"\n  unfolding GEN_ALGO_def snat_init_def is_init_def\n  unfolding snat_rel_def snat.rel_def\n  by (simp add: snat_invar_0 in_br_conv)\n  \nlemma is_init_snat0[sepref_gen_algo_rules]: \n  \"GEN_ALGO (snat_const TYPE('a::len2) 0) (is_init (snat_assn' TYPE('a)))\"\n  using is_init_snat[where 'a='a]\n  by simp\n\nsubsubsection \\<open>Ad-Hoc Method to Annotate Number Constructors\\<close>  \nlemma annot_num_const_cong: \n  \"\\<And>a b. snat_const a b = snat_const a b\" \n  \"\\<And>a b. sint_const a b = sint_const a b\" \n  \"\\<And>a b. unat_const a b = unat_const a b\" \n  \"ASSERT \\<Phi> = ASSERT \\<Phi>\"\n (* \"WHILEIT I = WHILEIT I\"  TODO *)\n  by simp_all\n  \nlemma unat_const_fold: \n  \"0 = unat_const TYPE('a::len) 0\"\n  \"1 = unat_const TYPE('a::len) 1\"\n  \"numeral n = unat_const TYPE('a::len) (numeral n)\"\n  by simp_all\n  \nlemma snat_const_fold: \n  \"0 = snat_const TYPE('a::len2) 0\"\n  \"1 = snat_const TYPE('a::len2) 1\"\n  \"numeral n = snat_const TYPE('a::len2) (numeral n)\"\n  by simp_all\n\nlemma sint_const_fold: \n  \"0 = sint_const TYPE('a::len) 0\"\n  \"1 = sint_const TYPE('a::len) 1\"\n  \"numeral n = sint_const TYPE('a::len) (numeral n)\"\n  \"-sint_const TYPE('a::len) c = sint_const TYPE('a::len) (-c)\"\n  by simp_all\n  \n    \nlemma hfref_absfun_convI: \"CNV g g' \\<Longrightarrow> (f,g') \\<in> hfref P A R \\<Longrightarrow> (f,g) \\<in> hfref P A R\" by simp\n\nmethod annot_sint_const for T::\"'a::len itself\" = \n  (rule hfref_absfun_convI),\n  (simp only: sint_const_fold[where 'a='a] cong: annot_num_const_cong),\n  (rule CNV_I)\n  \nmethod annot_snat_const for T::\"'a::len2 itself\" = \n  (rule hfref_absfun_convI),\n  (simp only: snat_const_fold[where 'a='a] cong: annot_num_const_cong),\n  (rule CNV_I)\n  \nmethod annot_unat_const for T::\"'a::len itself\" = \n  (rule hfref_absfun_convI),\n  (simp only: unat_const_fold[where 'a='a] cong: annot_num_const_cong),\n  (rule CNV_I)\n  \n\\<^cancel>\\<open>  \nsubsubsection \\<open>Casting\\<close>  \n(* TODO: Add other casts *)\n  \ncontext fixes T :: \"'a::len2 itself\" begin\n  definition [simp]: \"unat_snat_upcast_aux \\<equiv> let _=TYPE('a) in id::nat\\<Rightarrow>nat\"\n\n  sepref_decl_op unat_snat_upcast: \"unat_snat_upcast_aux\" :: \"nat_rel \\<rightarrow> nat_rel\" .\nend  \n\ncontext fixes T :: \"'a::len itself\" begin\n  definition [simp]: \"snat_unat_downcast_aux \\<equiv> let _=TYPE('a) in id::nat\\<Rightarrow>nat\"\n\n  sepref_decl_op snat_unat_downcast: \"snat_unat_downcast_aux\" :: \"nat_rel \\<rightarrow> nat_rel\" .\nend  \n\ncontext fixes T :: \"'a::len2 itself\" begin\n  definition [simp]: \"snat_snat_upcast_aux \\<equiv> let _=TYPE('a) in id::nat\\<Rightarrow>nat\"\n\n  sepref_decl_op snat_snat_upcast: \"snat_snat_upcast_aux\" :: \"nat_rel \\<rightarrow> nat_rel\" .\n\n  definition [simp]: \"snat_snat_downcast_aux \\<equiv> let _=TYPE('a) in id::nat\\<Rightarrow>nat\"\n\n  sepref_decl_op snat_snat_downcast: \"snat_snat_downcast_aux\" :: \"nat_rel \\<rightarrow> nat_rel\" .\n  \nend\n\ncontext fixes T :: \"'a::len itself\" begin\n  definition [simp]: \"unat_unat_upcast_aux \\<equiv> let _=TYPE('a) in id::nat\\<Rightarrow>nat\"\n  definition [simp]: \"unat_unat_downcast_aux \\<equiv> let _=TYPE('a) in id::nat\\<Rightarrow>nat\"\n\n  sepref_decl_op unat_unat_upcast: \"unat_unat_upcast_aux\" :: \"nat_rel \\<rightarrow> nat_rel\" .\n  sepref_decl_op unat_unat_downcast: \"unat_unat_downcast_aux\" :: \"nat_rel \\<rightarrow> nat_rel\" .\nend\n\nsepref_decl_op unat_snat_conv: \"id::nat\\<Rightarrow>_\" :: \"nat_rel \\<rightarrow> nat_rel\" .\nsepref_decl_op snat_unat_conv: \"id::nat\\<Rightarrow>_\" :: \"nat_rel \\<rightarrow> nat_rel\" .\n\n\nlemma annot_unat_snat_upcast: \"x = op_unat_snat_upcast TYPE('l::len2) x\" by simp \nlemma annot_snat_unat_downcast: \"x = op_snat_unat_downcast TYPE('l::len) x\" by simp \nlemma annot_snat_snat_upcast: \"x = op_snat_snat_upcast TYPE('l::len2) x\" by simp \nlemma annot_snat_snat_downcast: \"x = op_snat_snat_downcast TYPE('l::len2) x\" by simp \nlemma annot_unat_snat_conv: \"x = op_unat_snat_conv x\" by simp \nlemma annot_unat_unat_upcast: \"x = op_unat_unat_upcast TYPE('l::len) x\" by simp \nlemma annot_unat_unat_downcast: \"x = op_unat_unat_downcast TYPE('l::len) x\" by simp \nlemma annot_snat_unat_conv: \"x = op_snat_unat_conv x\" by simp  \n\nlemma in_unat_rel_conv_assn: \"\\<up>((xi, x) \\<in> unat_rel) = \\<upharpoonleft>unat.assn x xi\"\n  by (auto simp: unat_rel_def unat.assn_is_rel pure_app_eq)\n\nlemma in_snat_rel_conv_assn: \"\\<up>((xi, x) \\<in> snat_rel) = \\<upharpoonleft>snat.assn x xi\"\n  by (auto simp: snat_rel_def snat.assn_is_rel pure_app_eq)\n\ncontext fixes BIG :: \"'big::len2\" and SMALL :: \"'small::len\" begin  \n  lemma unat_snat_upcast_refine: \n    \"(unat_snat_upcast TYPE('big::len2), PR_CONST (mop_unat_snat_upcast TYPE('big::len2))) \\<in> [\\<lambda>_. is_up' UCAST('small \\<rightarrow> 'big)]\\<^sub>a (unat_assn' TYPE('small::len))\\<^sup>k \\<rightarrow> snat_assn\"\n    supply [simp] = in_unat_rel_conv_assn in_snat_rel_conv_assn\n    apply sepref_to_hoare\n    apply simp\n    by vcg'\n  \n  sepref_decl_impl (ismop) unat_snat_upcast_refine fixes 'big 'small by simp\n  \n  \n  lemma snat_unat_downcast_refine: \n    \"(snat_unat_downcast TYPE('small), PR_CONST (mop_snat_unat_downcast TYPE('small))) \n      \\<in> [\\<lambda>x. is_down' UCAST('big \\<rightarrow> 'small) \\<and> x<max_unat LENGTH('small)]\\<^sub>a (snat_assn' TYPE('big))\\<^sup>k \\<rightarrow> unat_assn\"\n    supply [simp] = in_unat_rel_conv_assn in_snat_rel_conv_assn\n    apply sepref_to_hoare\n    apply simp\n    by vcg'\n  \n  sepref_decl_impl (ismop) snat_unat_downcast_refine fixes 'big 'small by simp\nend\n\ncontext fixes BIG :: \"'big::len2\" and SMALL :: \"'small::len2\" begin  \n  lemma snat_snat_upcast_refine: \n    \"(snat_snat_upcast TYPE('big::len2), PR_CONST (mop_snat_snat_upcast TYPE('big::len2))) \\<in> [\\<lambda>_. is_up' UCAST('small \\<rightarrow> 'big)]\\<^sub>a (snat_assn' TYPE('small::len2))\\<^sup>k \\<rightarrow> snat_assn\"\n    supply [simp] = in_unat_rel_conv_assn in_snat_rel_conv_assn\n    apply sepref_to_hoare\n    apply simp\n    by vcg'\n  \n  sepref_decl_impl (ismop) snat_snat_upcast_refine fixes 'big 'small by simp\n  \n  lemma snat_snat_downcast_refine: \n    \"(snat_snat_downcast TYPE('small), PR_CONST (mop_snat_snat_downcast TYPE('small))) \n      \\<in> [\\<lambda>x. is_down' UCAST('big \\<rightarrow> 'small) \\<and> x<max_snat LENGTH('small)]\\<^sub>a (snat_assn' TYPE('big))\\<^sup>k \\<rightarrow> snat_assn\"\n    supply [simp] = in_unat_rel_conv_assn in_snat_rel_conv_assn\n    apply sepref_to_hoare\n    apply simp\n    by vcg'\n  \n  sepref_decl_impl (ismop) snat_snat_downcast_refine fixes 'big 'small by simp\n  \nend\n\ncontext fixes BIG :: \"'big::len\" and SMALL :: \"'small::len\" begin  \n  lemma unat_unat_upcast_refine: \n    \"(unat_unat_upcast TYPE('big), PR_CONST (mop_unat_unat_upcast TYPE('big))) \\<in> [\\<lambda>_. is_up' UCAST('small \\<rightarrow> 'big)]\\<^sub>a (unat_assn' TYPE('small::len))\\<^sup>k \\<rightarrow> unat_assn\"\n    supply [simp] = in_unat_rel_conv_assn\n    apply sepref_to_hoare\n    apply simp\n    by vcg'\n  \n  sepref_decl_impl (ismop) unat_unat_upcast_refine fixes 'big 'small by simp\n  \n  lemma unat_unat_downcast_refine: \n    \"(unat_unat_downcast TYPE('small), PR_CONST (mop_unat_unat_downcast TYPE('small))) \n      \\<in> [\\<lambda>x. is_down' UCAST('big \\<rightarrow> 'small) \\<and> x<max_unat LENGTH('small)]\\<^sub>a (unat_assn' TYPE('big::len))\\<^sup>k \\<rightarrow> unat_assn\"\n    supply [simp] = in_unat_rel_conv_assn\n    apply sepref_to_hoare\n    apply simp\n    by vcg'\n  \n  sepref_decl_impl (ismop) unat_unat_downcast_refine fixes 'big 'small by simp\nend\n\n  \ncontext fixes T::\"'l::len2\" begin\n  lemma unat_snat_conv_refine: \"(\\<lambda>x. x, op_unat_snat_conv) \n    \\<in> [\\<lambda>x. x<max_snat LENGTH('l::len2)]\\<^sub>f unat_rel' TYPE('l) \\<rightarrow> snat_rel' TYPE('l)\"\n    by (force \n      intro!: frefI \n      simp: snat_rel_def unat_rel_def snat.rel_def unat.rel_def\n      simp: in_br_conv max_snat_def snat_invar_alt\n      simp: snat_eq_unat(1)\n      )\n      \n  sepref_decl_impl unat_snat_conv_refine[sepref_param] fixes 'l by auto\n  \n  lemma snat_unat_conv_refine: \"(\\<lambda>x. x, op_snat_unat_conv)\n    \\<in> snat_rel' TYPE('l) \\<rightarrow> unat_rel' TYPE('l)\"\n    by (force\n      intro!: frefI\n      simp: snat_rel_def unat_rel_def snat.rel_def unat.rel_def\n      simp: in_br_conv max_snat_def snat_invar_alt\n      simp: snat_eq_unat(1)\n      )\n\n  sepref_decl_impl snat_unat_conv_refine[sepref_param] fixes 'l .\nend\n\n\ntext \\<open>Converting to Word\\<close>\nsepref_register \"of_nat :: _ \\<Rightarrow> _ word \"\nlemma of_nat_word_refine[sepref_import_param]: \n  \"(id,of_nat) \\<in> unat_rel' TYPE('a::len) \\<rightarrow> word_rel\"\n  by (auto simp: unat_rel_def unat.rel_def in_br_conv)\n\n\\<close>\n\n\nsubsubsection \\<open>Bit-Shifting\\<close>\n\nsepref_register \n  shl_word: \"(<<):: _ word \\<Rightarrow> _\"  \n  lshr_word: \"(>>):: _ word \\<Rightarrow> _\"  \n  ashr_word: \"(>>>):: _ word \\<Rightarrow> _\"  \n\ncontext begin\n\ninterpretation llvm_prim_arith_setup .\n  \n\nlemma shl_hnr_unat[sepref_fr_rules]: \"(uncurry ll_shl,uncurry (PR_CONST (SPECc2 ''shl'' (<<)))) \\<in> [\\<lambda>(a,b). b < LENGTH('a)]\\<^sub>a (word_assn :: 'a::len word \\<Rightarrow> _)\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow> word_assn\"\n  unfolding unat_rel_def unat.assn_is_rel[symmetric] unat.assn_def\n  unfolding SPECc2_def PR_CONST_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n  apply sepref_to_hoare\n  by vcg'\n\nlemma lshr_hnr_unat[sepref_fr_rules]: \"(uncurry ll_lshr,uncurry (PR_CONST (SPECc2 ''lshr'' (>>)))) \\<in> [\\<lambda>(a,b). b < LENGTH('a)]\\<^sub>a (word_assn :: 'a::len word \\<Rightarrow> _)\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow> word_assn\"\n  unfolding unat_rel_def unat.assn_is_rel[symmetric] unat.assn_def\n  unfolding SPECc2_def PR_CONST_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n  apply sepref_to_hoare\n  by vcg'\n\nlemma ashr_hnr_unat[sepref_fr_rules]: \"(uncurry ll_ashr,uncurry (PR_CONST (SPECc2 ''ashr'' (>>>)))) \\<in> [\\<lambda>(a,b). b < LENGTH('a)]\\<^sub>a (word_assn :: 'a::len word \\<Rightarrow> _)\\<^sup>k *\\<^sub>a unat_assn\\<^sup>k \\<rightarrow> word_assn\"\n  unfolding unat_rel_def unat.assn_is_rel[symmetric] unat.assn_def\n  unfolding SPECc2_def PR_CONST_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n  apply sepref_to_hoare\n  by vcg'\n\nlemma shl_hnr_snat[sepref_fr_rules]: \"(uncurry ll_shl,uncurry (PR_CONST (SPECc2 ''shl'' (<<)))) \\<in> [\\<lambda>(a,b). b < LENGTH('a)]\\<^sub>a (word_assn :: 'a::len2 word \\<Rightarrow> _)\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow> word_assn\"\n  unfolding snat_rel_def snat.assn_is_rel[symmetric] snat.assn_def\n  unfolding SPECc2_def PR_CONST_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n  supply [simp] = snat_eq_unat\n  apply sepref_to_hoare\n  by vcg'\n  \nlemma lshr_hnr_snat[sepref_fr_rules]: \"(uncurry ll_lshr,uncurry (PR_CONST (SPECc2 ''lshr'' (>>)))) \\<in> [\\<lambda>(a,b). b < LENGTH('a)]\\<^sub>a (word_assn :: 'a::len2 word \\<Rightarrow> _)\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow> word_assn\"\n  unfolding snat_rel_def snat.assn_is_rel[symmetric] snat.assn_def\n  unfolding SPECc2_def PR_CONST_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n  supply [simp] = snat_eq_unat\n  apply sepref_to_hoare\n  by vcg'\n\nlemma ashr_hnr_snat[sepref_fr_rules]: \"(uncurry ll_ashr,uncurry (PR_CONST (SPECc2 ''ashr'' (>>>)))) \\<in> [\\<lambda>(a,b). b < LENGTH('a)]\\<^sub>a (word_assn :: 'a::len2 word \\<Rightarrow> _)\\<^sup>k *\\<^sub>a snat_assn\\<^sup>k \\<rightarrow> word_assn\"\n  unfolding snat_rel_def snat.assn_is_rel[symmetric] snat.assn_def\n  unfolding SPECc2_def PR_CONST_def\n  unfolding one_enat_def lift_acost_cost[symmetric]\n  supply [simp] = snat_eq_unat\n  apply sepref_to_hoare\n  by vcg'\n  \n      \nend\n\nsubsubsection \\<open>Bounds Solver Setup\\<close>\n\n\nlemma in_unat_rel_boundsD[sepref_bounds_dest]: \"(w, n) \\<in> unat_rel' TYPE('l) \\<Longrightarrow> n < max_unat LENGTH('l::len)\"\n  by (simp add: unat_rel_def unat.rel_def in_br_conv)\n\n(*lemma snat_rel_imp_less_max_snat: \n  \"\\<lbrakk>(x,n)\\<in>snat_rel' TYPE('l::len2); L = LENGTH('l)\\<rbrakk> \\<Longrightarrow> n<max_snat L\"\n  by (auto simp: snat_rel_def snat.rel_def in_br_conv)\n*)\n  \nlemma in_snat_rel_boundsD[sepref_bounds_dest]: \n  \"(w, n) \\<in> snat_rel' TYPE('l) \\<Longrightarrow> n < max_snat LENGTH('l::len2)\"\n  by (auto simp: snat_rel_def snat.rel_def in_br_conv)\n  \nlemma in_sint_rel_boundsD[sepref_bounds_dest]: \n  \"(w,i)\\<in>sint_rel' TYPE('l::len) \\<Longrightarrow> min_sint LENGTH('l) \\<le> i \\<and> i < max_sint LENGTH('l)\"\n  by (auto simp: sint_rel_def sint.rel_def in_br_conv)\n  \nlemmas [sepref_bounds_simps] = max_snat_def max_unat_def max_sint_def min_sint_def\n  \nsubsection \\<open>Default Inlinings\\<close>\nlemmas [llvm_inline] = id_def\n\nsubsection \\<open>HOL Combinators\\<close>\n\nsubsubsection \\<open>If\\<close>\n\nthm htripleD\n  lemma htripleD2:  \n    assumes q': \"\\<And>r. Q' r = (Q r ** F)\"\n    assumes \"(P**F) (\\<alpha> s)\"\n    assumes \"htriple \\<alpha> P c Q\"\n    shows \"wp c (\\<lambda>r s'. (Q' r) (\\<alpha> s')) s\"\n    unfolding q' apply(rule htripleD) \n    using assms by auto\n\nlemma consume_two_steps: \"NREST.consume m t' = doN { SPECT [()\\<mapsto>t']; m}\"\n  by (auto simp: bindT_def consume_def split: nrest.splits)\n\nlemma hnr_consume_aux: \"t' = lift_acost t \\<Longrightarrow> hn_refine \\<Gamma> (ll_consume t) \\<Gamma> (unit_assn) (SPECT [() \\<mapsto> t'])\"\n  apply(rule hn_refineI_SPECT) unfolding pure_def by vcg\n\nlemma hnr_consume: \"hn_refine \\<Gamma> c \\<Gamma>' R m \\<Longrightarrow> t' = lift_acost t \\<Longrightarrow> hn_refine \\<Gamma> (doM { ll_consume t; c }) \\<Gamma>' R (NREST.consume m t')\"\n  unfolding consume_two_steps\n  apply(rule hnr_bind_manual_free)\n   apply(rule hnr_consume_aux) apply simp\n  by(simp add: hn_refine_extract_pre_val)  \n\nlemma hn_refine_extract_pre_val': \n  \"((xc,xa)\\<in>S \\<longrightarrow> hn_refine (hn_val S xa xc ** \\<Gamma>) c \\<Gamma>' R m) \\<Longrightarrow> hn_refine (hn_val S xa xc ** \\<Gamma>) c \\<Gamma>' R m\"\n  unfolding hn_refine_def hn_ctxt_def pure_def\n  by (auto simp: STATE_def sep_algebra_simps pred_lift_extract_simps htriple_extract_pre_pure)\n\nlemma hnr_postprocess:\n  assumes hnr: \"hn_refine \\<Gamma>1 b' \\<Gamma>2b R b\"\n  assumes ht: \"llvm_htriple \\<Gamma>2b fb (\\<lambda>r. \\<Gamma>')\"\n  shows \"hn_refine \\<Gamma>1 (doM { r \\<leftarrow> b'; fb; return r }) \\<Gamma>' R b\"\nproof (rule)\n  fix F s cr M\n  assume \"b = SPECT M\" \"(\\<Gamma>1 \\<and>* F) (ll_\\<alpha> (s, cr))\"\n  from hnr[THEN hn_refineD, OF this] obtain ra Ca\n    where \"Some Ca \\<le> M ra\" and wpb: \"wp b' (\\<lambda>r s. (\\<Gamma>2b \\<and>* R ra r \\<and>* F \\<and>* GC) (ll_\\<alpha> s)) (s, cr + Ca)\" \n    by blast\n\n  show \"\\<exists>ra Ca. Some Ca \\<le> M ra \\<and> wp (doM { r \\<leftarrow> b'; fb; return r })\n                                      (\\<lambda>r s. (\\<Gamma>' \\<and>* R ra r \\<and>* F \\<and>* GC) (ll_\\<alpha> s)) (s, cr + Ca)\"\n    apply(rule exI[where x=ra])\n    apply(rule exI[where x=Ca])\n    apply safe apply fact\n    apply(simp add: wp_bind)\n    apply(rule wp_monoI[OF wpb])\n    apply(simp add: wp_bind)\n    apply(rule wp_monoI[OF ht[THEN htripleD]])\n     apply(simp)\n    apply (simp add: wp_return) \n    by (simp add: GC_move_left(4) sep_conj_commute sep_conj_left_commute)  \nqed\n\nlemma hn_if_aux:\n  assumes P: \"\\<Gamma> \\<turnstile> hn_val bool1_rel a a' ** \\<Gamma>1\"\n  assumes RT: \"a \\<Longrightarrow> hn_refine (hn_val bool1_rel a a' ** \\<Gamma>1) b' \\<Gamma>2b R b\"\n  assumes RE: \"\\<not>a \\<Longrightarrow> hn_refine (hn_val bool1_rel a a' ** \\<Gamma>1) c' \\<Gamma>2c R c\"\n  assumes MERGE: \"MERGE \\<Gamma>2b fb \\<Gamma>2c fc \\<Gamma>'\"\n  shows \"hn_refine \\<Gamma> \n    (llc_if a' (doM {r\\<leftarrow>b'; fb; return r}) (doM {r\\<leftarrow>c'; fc; return r})) \n    \\<Gamma>' R (consume (if a then b else c) (cost ''if'' 1))\"\n  apply (rule hn_refine_nofailI)  \n  apply (rule hn_refine_cons_pre[OF _ P])\n  apply(rule hn_refine_extract_pre_val') \nproof (rule, cases a, goal_cases)\n  assume \"nofailT (NREST.consume (if a then b else c) (cost ''if'' 1))\"\n  then have NF: \"nofailT (if a then b else c)\"\n    by (simp add: refine_pw_simps)\n  \n  have [vcg_normalize_simps, named_ss fri_prepare_simps]: \"hn_val bool1_rel = \\<upharpoonleft>bool.assn\"\n    unfolding bool1_rel_def bool.assn_is_rel hn_ctxt_def ..\n  \n  note me[vcg_rules] = MERGED[OF MERGE]  \n\n  {\n    case 1\n    from 1 NF have [simp]: \"nofailT b\" by simp\n    then obtain Mb where Mb: \"b = SPECT Mb\" apply(cases b) by auto\n\n    from 1(2,3) have a': \"to_bool a'\"  \n      by (simp add: bool.rel_def bool1_rel_def in_br_conv)  \n\n    show ?case\n      unfolding llc_if_def\n      apply(subst (2) 1(3)) apply(subst a')\n      apply simp\n      apply(rule hnr_consume)\n      apply(rule hnr_postprocess)\n      apply(rule RT[OF 1(3)])\n       apply(rule me(1))\n      apply(subst lift_acost_cost)\n      by(simp add:  one_enat_def)  \n  }\n  {\n    case 2\n    from 2 NF have [simp]: \"nofailT c\" by simp\n    then obtain Mc where Mc: \"c = SPECT Mc\" apply(cases c) by auto\n\n    from 2(2,3) have a': \"\\<not> to_bool a'\"  \n      by (simp add: bool.rel_def bool1_rel_def in_br_conv)  \n\n    show ?case\n      unfolding llc_if_def\n      apply(subst (2) 2(3)) apply(subst a')\n      apply simp\n      apply(rule hnr_consume)\n      apply(rule hnr_postprocess)\n      apply(rule RE[OF 2(3)])\n       apply(rule me(2))\n      apply(subst lift_acost_cost)\n      by(simp add:  one_enat_def)  \n  }\nqed    \n\n\n\nlemma hn_refine_call[sepref_comb_rules]:\n  assumes \"hn_refine \\<Gamma> mi \\<Gamma>' R m\"\n  shows  \"hn_refine \\<Gamma> (ll_call mi) \\<Gamma>' R (mop_call $ m)\"\n  unfolding mop_call_def ll_call_def APP_def\n  apply(rule hnr_consume) apply(fact assms)\n  by (simp add: lift_acost_cost one_enat_def) \n\n\n\nlemma hn_if[sepref_comb_rules]:\n  assumes P: \"\\<Gamma> \\<turnstile> hn_val bool1_rel a a' ** \\<Gamma>1\"\n  assumes RT: \"a \\<Longrightarrow> hn_refine (hn_val bool1_rel a a' ** \\<Gamma>1) b' \\<Gamma>2b R b\"\n  assumes RE: \"\\<not>a \\<Longrightarrow> hn_refine (hn_val bool1_rel a a' ** \\<Gamma>1) c' \\<Gamma>2c R c\"\n  assumes MERGE: \"TERM If \\<Longrightarrow> MERGE \\<Gamma>2b fb \\<Gamma>2c fc \\<Gamma>'\"\n  shows \"hn_refine \\<Gamma> \n    (llc_if a' (doM {r\\<leftarrow>b'; fb; return r}) (doM {r\\<leftarrow>c'; fc; return r})) \n    \\<Gamma>' R (MIf$a$b$c)\"\n  using P RT RE MERGE[OF TERMI]\n  unfolding APP_def PROTECT2_def MIf_def\n  by (rule hn_if_aux)\n\n\nterm whileT\nsubsubsection \\<open>While\\<close>  \n(* TODO: Move WHILE-stuff to HOL-Bindings Theory *)\nlemma WHILEIT_pat[def_pat_rules]:\n  \"whileIET$I \\<equiv> UNPROTECT (whileIET I)\"\n(*  \"whileT \\<equiv> PR_CONST (whileIET (\\<lambda>_. True) undefined)\" *)\n  by (simp_all add: whileIET_def)\n\\<^cancel>\\<open>\nlemma id_WHILEIT[id_rules]: \n  \"PR_CONST (WHILEIT I) ::\\<^sub>i TYPE(('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'a nres) \\<Rightarrow> 'a \\<Rightarrow> 'a nres)\"\n  by simp\n\nlemma WHILE_arities[sepref_monadify_arity]:\n  (*\"WHILET \\<equiv> WHILEIT$(\\<lambda>\\<^sub>2_. True)\"*)\n  \"PR_CONST (WHILEIT I) \\<equiv> \\<lambda>\\<^sub>2b f s. SP (PR_CONST (WHILEIT I))$(\\<lambda>\\<^sub>2s. b$s)$(\\<lambda>\\<^sub>2s. f$s)$s\"\n  by (simp_all add: WHILET_def)\n\nlemma WHILEIT_comb[sepref_monadify_comb]:\n  \"PR_CONST (WHILEIT I)$(\\<lambda>\\<^sub>2x. b x)$f$s \\<equiv> \n    Refine_Basic.bind$(EVAL$s)$(\\<lambda>\\<^sub>2s. \n      SP (PR_CONST (monadic_WHILEIT I))$(\\<lambda>\\<^sub>2x. (EVAL$(b x)))$f$s\n    )\"\n  by (simp_all add: WHILEIT_to_monadic)\n  \\<close>\n\n\nlemma monadic_WHILEIT_pat[def_pat_rules]:\n  \"monadic_WHILEIT$I \\<equiv> UNPROTECT (monadic_WHILEIT I)\"\n  by auto  \n    \nlemma id_monadic_WHILEIT[id_rules]: \n  \"PR_CONST (monadic_WHILEIT I) ::\\<^sub>i TYPE(('a \\<Rightarrow> (bool,_) nrest) \\<Rightarrow> ('a \\<Rightarrow> ('a,_) nrest) \\<Rightarrow> 'a \\<Rightarrow> ('a,_) nrest)\"\n  by simp\n    \nlemma monadic_WHILEIT_arities[sepref_monadify_arity]:\n  \"PR_CONST (monadic_WHILEIT I) \\<equiv> \\<lambda>\\<^sub>2b f s. SP (PR_CONST (monadic_WHILEIT I))$(\\<lambda>\\<^sub>2s. b$s)$(\\<lambda>\\<^sub>2s. f$s)$s\"\n  by (simp)\n\nlemma monadic_WHILEIT_comb[sepref_monadify_comb]:\n  \"PR_CONST (monadic_WHILEIT I)$b$f$s \\<equiv> \n    NREST.bindT$(EVAL$s)$(\\<lambda>\\<^sub>2s. \n      SP (PR_CONST (monadic_WHILEIT I))$b$f$s\n    )\"\n  by (simp)\n\n\n(* TODO: Move *)\nlemma addcost_NTERM_iff: \"addcost c m = NTERM \\<longleftrightarrow> m = NTERM\"\n  apply(cases m) by auto\n\n\n(* TODO: clean up this mess and MOVE! *)\nlemma mono_body_consume:\n  assumes \"M.mono_body (\\<lambda>f. cB f x)\"\n  shows \"M.mono_body (\\<lambda>f. cB (\\<lambda>x. ll_call (f x)) x)\"\n  apply(rule)\n  subgoal for a b\n    using assms\n    apply -\n    apply(erule monotoneD[of _ _ _ \"(\\<lambda>x. ll_call (a x))\" \"(\\<lambda>x. ll_call (b x))\"])\n    unfolding fun_ord_def\n    unfolding img_ord_def  flat_ord_def\n    unfolding ll_call_def\n    apply (force simp: run_simps addcost_NTERM_iff) \n    done\n  done\n\nlemma hnr_RECT_aux:\n  assumes S: \"\\<And>cf af ax px. \\<lbrakk>\n    \\<And>ax px. hn_refine (hn_ctxt Rx ax px ** F) (cf px) (F' ax px) Ry (af ax)\\<rbrakk> \n    \\<Longrightarrow> hn_refine (hn_ctxt Rx ax px ** F) (cB cf px) (F' ax px) Ry (aB af ax)\"\n  assumes M: \"(\\<And>x. M.mono_body (\\<lambda>f. cB f x))\"\n  shows \"hn_refine \n    (hn_ctxt Rx ax px ** F) (ll_call (REC' cB px)) (F' ax px) Ry (RECT' aB ax)\"\n  unfolding REC'_def RECT'_def\n  apply(subst ll_call_def)\n  apply(rule hnr_consume)\n  apply(rule hnr_RECT)\n   apply(rule S)\n  apply(subst ll_call_def)\n  apply(rule hnr_consume) \n   apply assumption\n  subgoal unfolding one_enat_def lift_acost_cost by simp\n  subgoal apply(rule mono_body_consume) by(fact M)\n  subgoal unfolding one_enat_def lift_acost_cost by simp\n  done\n\nlemma hn_RECT_wiewirshabenwollen[sepref_comb_rules]:\n  assumes \"INDEP Ry\" \"INDEP Rx\" \"INDEP Rx'\"\n  assumes FR: \"P \\<turnstile> hn_ctxt Rx ax px ** F\"\n  assumes S: \"\\<And>cf af ax px. \\<lbrakk>\n    \\<And>ax px. hn_refine (hn_ctxt Rx ax px ** F) (cf px) (hn_ctxt Rx' ax px ** F) Ry \n      (RCALL$af$ax)\\<rbrakk> \n    \\<Longrightarrow> hn_refine (hn_ctxt Rx ax px ** F) (cB cf px) (F' ax px) Ry \n          (aB af ax)\"\n  assumes FR': \"\\<And>ax px. F' ax px \\<turnstile> hn_ctxt Rx' ax px ** F\"\n  assumes M: \"(\\<And>x. M.mono_body (\\<lambda>f. cB f x))\"\n  (*assumes PREC[unfolded CONSTRAINT_def]: \"CONSTRAINT precise Ry\"*)\n  shows \"hn_refine \n    (P) (ll_call (REC' cB px)) (hn_ctxt Rx' ax px ** F) Ry \n        (RECT'$(\\<lambda>\\<^sub>2D x. aB D x)$ax)\"\n  unfolding APP_def PROTECT2_def\n  apply (rule hn_refine_cons_pre[OF _ FR])\n  apply (rule hnr_RECT_aux)\n\n  apply (rule hn_refine_cons_post[OF _ FR'])\n  apply (rule S[unfolded RCALL_def APP_def])\n  apply assumption\n  apply fact+\n  done\n\n\nlemma hn_refine_add_invalid: (* Very customized rule for manual derivation of while *)\n  \"hn_refine (hn_ctxt Rs a b ** \\<Gamma>) c \\<Gamma>' R m \\<Longrightarrow> hn_refine (hn_ctxt Rs a b ** \\<Gamma>) c (hn_invalid Rs a b ** \\<Gamma>') R m\"\n  by (smt hn_refine_frame' invalidate_clone' sep_conj_commute sep_conj_left_commute)\n\nlemma hn_monadic_WHILE_aux:\n  assumes FR: \"P \\<turnstile> hn_ctxt Rs s' s ** \\<Gamma>\"\n  assumes b_ref: \"\\<And>s s'. I s' \\<Longrightarrow> hn_refine \n    (hn_ctxt Rs s' s ** \\<Gamma>)\n    (b s)\n    (\\<Gamma>b s' s)\n    (pure bool1_rel)\n    (b' s')\"\n  assumes b_fr: \"\\<And>s' s. \\<Gamma>b s' s \\<turnstile> hn_ctxt Rs s' s ** \\<Gamma>\"\n\n  assumes f_ref: \"\\<And>s' s. \\<lbrakk>I s'\\<rbrakk> \\<Longrightarrow> hn_refine\n    (hn_ctxt Rs s' s ** \\<Gamma>)\n    (f s)\n    (\\<Gamma>f s' s)\n    Rs\n    (f' s')\"\n  assumes f_fr: \"\\<And>s' s. \\<Gamma>f s' s \\<turnstile> hn_ctxt Rsf s' s ** \\<Gamma>\"\n  assumes free: \"MK_FREE Rsf fr\"\n  (*assumes PREC: \"precise Rs\"*)\n  shows \"hn_refine (P) (llc_while b (\\<lambda>s. doM {r \\<leftarrow> f s; fr s; return r}) s) (hn_invalid Rs s' s ** \\<Gamma>) Rs (monadic_WHILEIT I b' f' s')\"\n  apply1 (rule hn_refine_cons_pre[rotated, OF FR])\n  apply (rule hn_refine_add_invalid)\n  \n  apply (rule hn_refine_synthI)\n  unfolding monadic_WHILEIT_RECT'_conv\n  focus (rule hnr_RECT_aux[where F'=\"\\<lambda>s' s. \\<Gamma>\" and Ry=Rs])\n    apply1 (rule hnr_ASSERT)\n    focus (rule hnr_bind_manual_free)\n      applyS (rule b_ref; simp)\n  apply1 (rule hn_refine_cons_pre[rotated], sep_drule b_fr, rule entails_refl)\n  unfolding MIf_def\n      focus (rule hn_if_aux[OF _ _ _ MERGE_triv])\n        apply (fri_rotate entails_pre_cong :-1) apply (rule conj_entails_mono[OF entails_refl]) apply (rule entails_refl)\n        focus (* Then-Part *)\n          apply1 (rule hn_refine_cons_pre[rotated], sep_drule drop_hn_val, simp, rule entails_refl)\n          apply (rule hnr_bind_manual_free)\n          applyS (rule f_ref, simp)\n          apply1 (rule hn_refine_cons_pre[rotated], sep_drule f_fr, simp, rule entails_refl)\n          apply (rule hnr_freeI[OF free])\n          apply (rule hn_refine_cons_pre, assumption)\n          applyS (simp add: sep_conj_ac; rule entails_refl)\n          solved\n        focus (* Else-Part *)  \n          apply (rule hn_refine_cons_post)\n          apply (rule hn_refine_frame[OF hnr_RETURN_pass])\n          apply (fri_rotate entails_pre_cong :1) apply (rule entails_refl)\n          apply1 (sep_drule drop_hn_invalid)\n          apply1 (sep_drule drop_hn_val)\n          apply (simp)\n          solved\n        solved\n      solved\n    focus apply pf_mono_prover solved\n    solved\n  subgoal by (simp add: llc_while_def mwhile_def llc_if_def cong: if_cong)\n  subgoal ..\n  subgoal ..\n  done\n\nlemma hn_monadic_WHILE_lin[sepref_comb_rules]:\n  assumes \"INDEP Rs\"\n  assumes FR: \"P \\<turnstile> hn_ctxt Rs s' s ** \\<Gamma>\"\n  assumes b_ref: \"\\<And>s s'. I s' \\<Longrightarrow> hn_refine \n    (hn_ctxt Rs s' s ** \\<Gamma>)\n    (b s)\n    (\\<Gamma>b s' s)\n    (pure bool1_rel)\n    (b' s')\"\n  assumes b_fr: \"\\<And>s' s. TERM (monadic_WHILEIT,''cond'')\n       \\<Longrightarrow> \\<Gamma>b s' s \\<turnstile> hn_ctxt Rs s' s ** \\<Gamma>\"\n\n  assumes f_ref: \"\\<And>s' s. I s' \\<Longrightarrow> hn_refine\n    (hn_ctxt Rs s' s ** \\<Gamma>)\n    (f s)\n    (\\<Gamma>f s' s)\n    Rs\n    (f' s')\"\n  assumes f_fr: \"\\<And>s' s. TERM (monadic_WHILEIT,''body'')\n                   \\<Longrightarrow> \\<Gamma>f s' s \\<turnstile> hn_ctxt Rsf s' s ** \\<Gamma>\"\n  assumes free: \"TERM (monadic_WHILEIT,''free-old-state'')\n                   \\<Longrightarrow> MK_FREE Rsf fr\"\n  shows \"hn_refine \n    P \n    (llc_while b (\\<lambda>s. doM {r \\<leftarrow> f s; fr s; return r}) s) \n    (hn_invalid Rs s' s ** \\<Gamma>)\n    Rs \n    (PR_CONST (monadic_WHILEIT I)$(\\<lambda>\\<^sub>2s'. b' s')$(\\<lambda>\\<^sub>2s'. f' s')$(s'))\"\n  using assms(2-)\n  unfolding APP_def PROTECT2_def CONSTRAINT_def PR_CONST_def\n  by (rule hn_monadic_WHILE_aux)\n\n\n  \nsubsubsection \\<open>Let\\<close>\nlemma hn_let[sepref_comb_rules]:\n  \"hn_refine \\<Gamma> c \\<Gamma>' R (NREST.bindT$(PASS$v)$(\\<lambda>\\<^sub>2x. f x)) \\<Longrightarrow> hn_refine \\<Gamma> c \\<Gamma>' R (Let$v$(\\<lambda>\\<^sub>2x. f x))\" \n  by simp\n\n\nsubsection \\<open>Unit\\<close>\n\nlemma unit_hnr[sepref_import_param]: \"((),())\\<in>unit_rel\" by auto\n  \n  \nsubsection \"Product\"\n\n\nlemmas [sepref_import_rewrite, named_ss sepref_frame_normrel, fcomp_norm_unfold] = prod_assn_pure_conv[symmetric]\n\n\n(* TODO Add corresponding rules for other types and add to datatype snippet *)\nlemma intf_of_prod_assn[intf_of_assn]:\n  assumes \"intf_of_assn A TYPE('a)\" \"intf_of_assn B TYPE('b)\"\n  shows \"intf_of_assn (prod_assn A B) TYPE('a * 'b)\"\n  by simp\n\nlemma pure_prod[constraint_rules]: \n  assumes P1: \"is_pure P1\" and P2: \"is_pure P2\"\n  shows \"is_pure (prod_assn P1 P2)\"\nproof -\n  from P1 obtain P1' where P1': \"\\<And>x x'. P1 x x' = \\<up>(P1' x x')\"\n    using is_pureE by blast\n  from P2 obtain P2' where P2': \"\\<And>x x'. P2 x x' = \\<up>(P2' x x')\"\n    using is_pureE by blast\n\n  show ?thesis proof\n    fix x x'\n    show \"prod_assn P1 P2 x x' =\n         \\<up> (case (x, x') of ((a1, a2), c1, c2) \\<Rightarrow> P1' a1 c1 \\<and> P2' a2 c2)\"\n      unfolding prod_assn_def\n      apply (simp add: P1' P2' sep_algebra_simps split: prod.split)\n      done\n  qed\nqed\n\nlemma prod_frame_match[sepref_frame_match_rules]:\n  assumes \"hn_ctxt A (fst x) (fst y) \\<turnstile> hn_ctxt A' (fst x) (fst y)\"\n  assumes \"hn_ctxt B (snd x) (snd y) \\<turnstile> hn_ctxt B' (snd x) (snd y)\"\n  shows \"hn_ctxt (prod_assn A B) x y \\<turnstile> hn_ctxt (prod_assn A' B') x y\"\n  apply (cases x; cases y; simp)\n  apply (simp add: hn_ctxt_def)\n  apply (rule conj_entails_mono)\n  using assms apply (auto simp: hn_ctxt_def)\n  done\n\nlemma prod_frame_merge[sepref_frame_merge_rules]:\n  assumes \"MERGE1 A frl1 A' frr1 Am\"  \n  assumes \"MERGE1 B frl2 B' frr2 Bm\"  \n  shows \"MERGE1 \n    (prod_assn A B) (\\<lambda>(a,b). doM {frl1 a; frl2 b}) \n    (prod_assn A' B') (\\<lambda>(a,b). doM {frr1 a; frr2 b}) \n    (prod_assn Am Bm)\"\n  supply [vcg_rules] = MERGE1D[OF assms(1)] MERGE1D[OF assms(2)]\n  by rule vcg\n    \n  \n\nlemma entt_invalid_prod: \"hn_invalid (prod_assn A B) p p' \\<turnstile> hn_ctxt (prod_assn (invalid_assn A) (invalid_assn B)) p p'\"\n  unfolding hn_ctxt_def invalid_assn_def prod_assn_def\n  by (auto split: prod.splits simp: entails_def pred_lift_extract_simps dest: pure_part_split_conj)\n\nlemma gen_merge_cons_left: \"L\\<turnstile>L' \\<Longrightarrow> MERGE L' fl R fr M \\<Longrightarrow> MERGE L fl R fr M\"  \n  unfolding MERGE_def\n  by (metis (mono_tags, lifting) cons_rule[where Q=Q and Q'=Q for Q] entails_def)\n  \nlemma gen_merge_cons_right: \"R\\<turnstile>R' \\<Longrightarrow> MERGE L fl R' fr M \\<Longrightarrow> MERGE L fl R fr M\"  \n  unfolding MERGE_def\n  by (metis (mono_tags, lifting) cons_rule[where Q=Q and Q'=Q for Q] entails_def)\n  \nlemmas gen_merge_cons = gen_merge_cons_left gen_merge_cons_right\n\nlemmas invalid_prod_merge[sepref_frame_merge_rules] = gen_merge_cons[OF entt_invalid_prod]\n\nlemma prod_assn_ctxt: \"prod_assn A1 A2 x y = z \\<Longrightarrow> hn_ctxt (prod_assn A1 A2) x y = z\"\n  by (simp add: hn_ctxt_def)\n\n(* TODO: Move *)  \nlemma drop_pureD: \"is_pure A \\<Longrightarrow> hn_ctxt A a b \\<turnstile> \\<box>\"\n  by (auto simp: is_pure_def entails_def pred_lift_extract_simps hn_ctxt_def)\n  \nlemma hn_case_prod_aux:\n  assumes FR: \"\\<Gamma> \\<turnstile> hn_ctxt (prod_assn P1 P2) p' p ** \\<Gamma>1\"\n  assumes Pair: \"\\<And>a1 a2 a1' a2'. \\<lbrakk>p'=(a1',a2'); p=(a1,a2)\\<rbrakk> \n    \\<Longrightarrow> hn_refine (hn_ctxt P1 a1' a1 ** hn_ctxt P2 a2' a2 ** \\<Gamma>1 ** hn_invalid (prod_assn P1 P2) p' p) (f a1 a2) \n          (hn_ctxt P1' a1' a1 ** hn_ctxt P2' a2' a2 ** hn_ctxt XX1 p' p ** \\<Gamma>1') (R a1' a2' a1 a2) (f' a1' a2')\"\n  assumes PURE: \"Sepref_Basic.is_pure XX1\"\n  shows \"hn_refine \\<Gamma> (case_prod f p) (hn_ctxt (prod_assn P1' P2') p' p ** \\<Gamma>1')\n    (R (fst p') (snd p') (fst p) (snd p)) (case_prod f' p')\" (is \"?G \\<Gamma>\")\n    apply1 (rule hn_refine_cons_pre[OF _ FR])\n    apply1 extract_hnr_invalids\n  apply1 (cases p; cases p'; simp add: prod_assn_pair_conv[THEN prod_assn_ctxt]) \n    apply (rule hn_refine_cons[OF Pair _ _ entails_refl])\n    applyS simp\n    applyS simp\n    applyS (simp add: hn_ctxt_def)\n    using PURE apply (sep_drule drop_pureD[OF PURE])\n    by (simp add: hn_ctxt_def sep_conj_ac)\n  \n    \n(* TODO: This has caused \"ENTER MATCH\" unifier problems with flex-flex pairs. So disabled by default,\n  and hn_case_prod_simple' is enabled, where the result cannot depend on the elements of the pair. *)    \nlemma hn_case_prod':\n  assumes FR: \"\\<Gamma> \\<turnstile> hn_ctxt (prod_assn P1 P2) p' p ** \\<Gamma>1\"\n  assumes Pair: \"\\<And>a1 a2 a1' a2'. \\<lbrakk>p'=(a1',a2'); p=(a1,a2)\\<rbrakk> \n    \\<Longrightarrow> hn_refine (hn_ctxt P1 a1' a1 ** hn_ctxt P2 a2' a2 ** \\<Gamma>1 ** hn_invalid (prod_assn P1 P2) p' p) (f a1 a2) \n          (\\<Gamma>2 a1 a2 a1' a2') (R a1' a2' a1 a2) (f' a1' a2')\"\n  assumes FR2: \"\\<And>a1 a2 a1' a2'. \\<Gamma>2 a1 a2 a1' a2' \\<turnstile> hn_ctxt P1' a1' a1 ** hn_ctxt P2' a2' a2 ** hn_ctxt XX1 p' p ** \\<Gamma>1'\"        \n  assumes PURE: \"CONSTRAINT Sepref_Basic.is_pure XX1\"\n  shows \"hn_refine \\<Gamma> (case_prod f p) (hn_ctxt (prod_assn P1' P2') p' p ** \\<Gamma>1')\n    (R (fst p') (snd p') (fst p) (snd p)) (case_prod$(\\<lambda>\\<^sub>2a b. f' a b)$p')\" (is \"?G \\<Gamma>\")\n    unfolding autoref_tag_defs PROTECT2_def\n    apply (rule hn_case_prod_aux[OF _ hn_refine_cons_post])\n    apply fact\n    apply fact\n    using FR2 apply blast\n    using PURE by simp\n\nlemma hn_case_prod_simple'[sepref_comb_rules]:\n  assumes FR: \"\\<Gamma> \\<turnstile> hn_ctxt (prod_assn P1 P2) p' p ** \\<Gamma>1\"\n  assumes Pair: \"\\<And>a1 a2 a1' a2'. \\<lbrakk>p'=(a1',a2'); p=(a1,a2)\\<rbrakk> \n    \\<Longrightarrow> hn_refine (hn_ctxt P1 a1' a1 ** hn_ctxt P2 a2' a2 ** \\<Gamma>1 ** hn_invalid (prod_assn P1 P2) p' p) (f a1 a2) \n          (\\<Gamma>2 a1 a2 a1' a2') R (f' a1' a2')\"\n  assumes FR2: \"\\<And>a1 a2 a1' a2'. \\<Gamma>2 a1 a2 a1' a2' \\<turnstile> hn_ctxt P1' a1' a1 ** hn_ctxt P2' a2' a2 ** hn_ctxt XX1 p' p ** \\<Gamma>1'\"        \n  assumes PURE: \"CONSTRAINT Sepref_Basic.is_pure XX1\"\n  shows \"hn_refine \\<Gamma> (case_prod f p) (hn_ctxt (prod_assn P1' P2') p' p ** \\<Gamma>1')\n    R (case_prod$(\\<lambda>\\<^sub>2a b. f' a b)$p')\" (is \"?G \\<Gamma>\")\n    unfolding autoref_tag_defs PROTECT2_def\n    apply (rule hn_case_prod_aux[OF _ hn_refine_cons_post])\n    apply fact\n    apply fact\n    using FR2 apply blast\n    using PURE by simp\n    \n    \nlemma hn_Pair[sepref_fr_rules]: \"(uncurry (return oo Pair), uncurry (RETURN oo Pair)) \\<in> A\\<^sup>d *\\<^sub>a B\\<^sup>d \\<rightarrow>\\<^sub>a A\\<times>\\<^sub>aB\"    \n  by sepref_to_hoare vcg\n    \n\nlemma fst_hnr[sepref_fr_rules]: \"(return o fst,RETURN o fst) \\<in> (prod_assn A B)\\<^sup>d \\<rightarrow>\\<^sub>a A\"\n  apply sepref_to_hoare\n  apply vcg\n  oops (* TODO *)\nlemma snd_hnr[sepref_fr_rules]: \"(return o snd,RETURN o snd) \\<in> (prod_assn A B)\\<^sup>d \\<rightarrow>\\<^sub>a B\"\n  apply sepref_to_hoare\n  apply vcg\n  oops (* TODO *)\n\n\nlemmas [constraint_simps] = prod_assn_pure_conv\nlemmas [sepref_import_param] = param_prod_swap\n\nlemma rdomp_prodD[dest!]: \"rdomp (prod_assn A B) (a,b) \\<Longrightarrow> rdomp A a \\<and> rdomp B b\"\n  unfolding rdomp_def prod_assn_def\n  by (auto simp: sep_conj_def)\n\nsubsection \\<open>Option\\<close>  \n\n   \nlemma option_patterns[def_pat_rules]: \n  \"(=)$x$None \\<equiv> is_None$x\"\n  \"(=)$None$x \\<equiv> is_None$x\"\n  \"op_neq$x$None \\<equiv> Not$(is_None$x)\"\n  \"op_neq$None$x \\<equiv> Not$(is_None$x)\"\n  apply (all \\<open>rule eq_reflection\\<close>)\n  by (auto split: option.splits)\n\n  \\<^cancel>\\<open>\ntext \\<open>Option type via unused implementation value\\<close>  \nlocale dflt_option =   \n  fixes dflt and A :: \"'a \\<Rightarrow> 'c::llvm_rep \\<Rightarrow> assn\" and is_dflt\n  assumes UU: \"A a dflt = sep_false\"\n  assumes CMP: \"llvm_htriple \\<box> (is_dflt k) (\\<lambda>r. \\<upharpoonleft>bool.assn (k=dflt) r)\"\nbegin\n  \n  definition \"option_assn a c \\<equiv> if c=dflt then \\<up>(a=None) else EXS aa. \\<up>(a=Some aa) ** A aa c\"\n  \n  lemma hn_None[sepref_fr_rules]: \"(uncurry0 (return dflt), uncurry0 (RETURN None)) \\<in> unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a option_assn\"  \n    apply sepref_to_hoare unfolding option_assn_def \n    apply vcg'\n    done\n  \n  lemma hn_Some[sepref_fr_rules]: \"(return, RETURN o Some) \\<in> A\\<^sup>d \\<rightarrow>\\<^sub>a option_assn\"  \n    apply sepref_to_hoare\n    subgoal for a c\n      apply (cases \"c=dflt\")\n      using UU apply simp\n      unfolding option_assn_def\n      apply vcg\n      done\n    done\n  \n  lemma hn_the[sepref_fr_rules]: \"(return, RETURN o the) \\<in> [\\<lambda>x. x \\<noteq> None]\\<^sub>a option_assn\\<^sup>d \\<rightarrow> A\"\n    apply sepref_to_hoare\n    unfolding option_assn_def \n    apply clarsimp\n    apply vcg'\n    done\n    \n  lemma hn_is_None[sepref_fr_rules]: \"(is_dflt, RETURN o is_None) \\<in> option_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n    unfolding bool1_rel_def bool.assn_is_rel[symmetric]\n    apply sepref_to_hoare\n    unfolding option_assn_def \n    apply clarsimp\n    supply CMP[vcg_rules]\n    apply vcg'\n    done\n    \n  definition [llvm_inline]: \"free_option fr c \\<equiv> doM { d\\<leftarrow>is_dflt c; llc_if d (return ()) (fr c) }\"\n    \n  lemma mk_free_option[sepref_frame_free_rules]:\n    assumes [THEN MK_FREED, vcg_rules]: \"MK_FREE A fr\"  \n    shows \"MK_FREE option_assn (free_option fr)\"\n    apply rule\n    unfolding free_option_def option_assn_def\n    apply clarsimp\n    supply CMP[vcg_rules]\n    apply vcg\n    done\n    \n  lemma option_assn_pure[safe_constraint_rules]:\n    assumes \"is_pure A\" \n    shows \"is_pure option_assn\"  \n  proof -\n    from assms obtain P where [simp]: \"A = (\\<lambda>a c. \\<up>(P a c))\"\n      unfolding is_pure_def by blast\n  \n    show ?thesis  \n      apply (rule is_pureI[where P'=\"\\<lambda>a c. if c=dflt then a=None else \\<exists>aa. a=Some aa \\<and> P aa c\"])\n      unfolding option_assn_def\n      by (auto simp: sep_algebra_simps pred_lift_extract_simps)\n      \n  qed    \n    \n    \nend    \n\nlemmas [named_ss llvm_inline cong] = refl[of \"dflt_option.free_option _\"]\n\n\nlocale dflt_pure_option = dflt_option +\n  assumes A_pure[safe_constraint_rules]: \"is_pure A\"\nbegin\n  find_theorems MK_FREE is_pure\n\n  lemma A_free[sepref_frame_free_rules]: \"MK_FREE A (\\<lambda>_. return ())\"\n    by (rule mk_free_is_pure[OF A_pure])\n\nend  \n\n(* TODO: Redundancies with dflt_option *)\n(* TODO: Setup id-op phase to identify those operations *)\ntext \\<open>Option type via unused implementation value, own set of operations.\\<close>  \nlocale dflt_option_private =   \n  fixes dflt and A :: \"'a \\<Rightarrow> 'c::llvm_rep \\<Rightarrow> assn\" and is_dflt\n  assumes UU: \"A a dflt = sep_false\"\n  assumes CMP: \"llvm_htriple \\<box> (is_dflt k) (\\<lambda>r. \\<upharpoonleft>bool.assn (k=dflt) r)\"\nbegin\n  \n  definition \"option_assn a c \\<equiv> if c=dflt then \\<up>(a=None) else EXS aa. \\<up>(a=Some aa) ** A aa c\"\n\n  definition None where [simp]: \"None \\<equiv> Option.None\"\n  definition Some where [simp]: \"Some \\<equiv> Option.Some\"\n  definition the where [simp]: \"the \\<equiv> Option.the\"\n  definition is_None where [simp]: \"is_None \\<equiv> Autoref_Bindings_HOL.is_None\"\n  \n  lemmas fold_None = None_def[symmetric]\n  lemmas fold_Some = Some_def[symmetric]\n  lemmas fold_the = the_def[symmetric]\n  lemmas fold_is_None = is_None_def[symmetric]\n  \n  lemma fold_is_None2: \n    \"a = None \\<longleftrightarrow> is_None a\"\n    \"None = a \\<longleftrightarrow> is_None a\"\n    by (auto simp: is_None_def None_def split: option.split)\n  \n  lemmas fold_option = fold_None fold_Some fold_the fold_is_None fold_is_None2\n  \n  sepref_register None Some the is_None\n  \n    \n  lemma hn_None[sepref_fr_rules]: \"(uncurry0 (return dflt), uncurry0 (RETURN None)) \\<in> unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a option_assn\"  \n    apply sepref_to_hoare unfolding option_assn_def None_def\n    apply vcg'\n    done\n  \n  lemma hn_Some[sepref_fr_rules]: \"(return, RETURN o Some) \\<in> A\\<^sup>d \\<rightarrow>\\<^sub>a option_assn\"  \n    apply sepref_to_hoare\n    subgoal for a c\n      apply (cases \"c=dflt\")\n      using UU apply simp\n      unfolding option_assn_def Some_def\n      apply vcg\n      done\n    done\n  \n  lemma hn_the[sepref_fr_rules]: \"(return, RETURN o the) \\<in> [\\<lambda>x. x \\<noteq> Option.None]\\<^sub>a option_assn\\<^sup>d \\<rightarrow> A\"\n    apply sepref_to_hoare\n    unfolding option_assn_def the_def\n    apply clarsimp\n    apply vcg'\n    done\n    \n  lemma hn_is_None[sepref_fr_rules]: \"(is_dflt, RETURN o is_None) \\<in> option_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n    unfolding bool1_rel_def bool.assn_is_rel[symmetric]\n    apply sepref_to_hoare\n    unfolding option_assn_def is_None_def\n    apply clarsimp\n    supply CMP[vcg_rules]\n    apply vcg'\n    done\n    \n  definition [llvm_inline]: \"free_option fr c \\<equiv> doM { d\\<leftarrow>is_dflt c; llc_if d (return ()) (fr c) }\"\n    \n  lemma mk_free_option[sepref_frame_free_rules]:\n    assumes [THEN MK_FREED, vcg_rules]: \"MK_FREE A fr\"  \n    shows \"MK_FREE option_assn (free_option fr)\"\n    apply rule\n    unfolding free_option_def option_assn_def\n    apply clarsimp\n    supply CMP[vcg_rules]\n    apply vcg\n    done\n    \n  lemma option_assn_pure[safe_constraint_rules]:\n    assumes \"is_pure A\" \n    shows \"is_pure option_assn\"  \n  proof -\n    from assms obtain P where [simp]: \"A = (\\<lambda>a c. \\<up>(P a c))\"\n      unfolding is_pure_def by blast\n  \n    show ?thesis  \n      apply (rule is_pureI[where P'=\"\\<lambda>a c. if c=dflt then a=Option.None else \\<exists>aa. a=Option.Some aa \\<and> P aa c\"])\n      unfolding option_assn_def\n      by (auto simp: sep_algebra_simps pred_lift_extract_simps)\n      \n  qed    \n    \n    \nend    \n\nlemmas [named_ss llvm_inline cong] = refl[of \"dflt_option_private.free_option _\"]\n\n\nlocale dflt_pure_option_private = dflt_option_private +\n  assumes A_pure[safe_constraint_rules]: \"is_pure A\"\nbegin\n  lemma A_free[sepref_frame_free_rules]: \"MK_FREE A (\\<lambda>_. return ())\"\n    by (rule mk_free_is_pure[OF A_pure])\n\nend  \n\n\n\ninterpretation snat: dflt_pure_option \"-1\" snat_assn \"ll_icmp_eq (-1)\"\n  apply unfold_locales\n  subgoal\n    apply (auto simp: snat_rel_def pure_def pred_lift_extract_simps del: ext intro!: ext)\n    apply (auto simp: snat.rel_def in_br_conv snat_invar_def)\n    done\n  subgoal proof goal_cases\n    case 1\n    interpret llvm_prim_arith_setup .\n    show ?case\n      unfolding bool.assn_def\n      apply vcg'\n      done\n    qed\n  subgoal by simp  \n  done\n\nabbreviation snat_option_assn' :: \"'a itself \\<Rightarrow> nat option \\<Rightarrow> 'a::len2 word \\<Rightarrow> llvm_amemory \\<Rightarrow> bool\" where\n  \"snat_option_assn' _ \\<equiv> snat.option_assn\"\n  \\<close>\n  \n\\<^cancel>\\<open>\nsubsection \\<open>Additional Operations\\<close>  \n\ntext \\<open>Additional operations, for which we need the basic framework already set up.\\<close>\n  \nsubsubsection \\<open>Subtraction that Saturates at 0 on Underflow\\<close>  \n  \ndefinition op_nat_sub_ovf :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \"op_nat_sub_ovf a b \\<equiv> if a\\<le>b then 0 else a-b\"\nlemma op_nat_sub_ovf_is_sub[simp]: \"op_nat_sub_ovf = (-)\"\n  unfolding op_nat_sub_ovf_def by (auto split: if_split del: ext intro!: ext)\n\nlemma fold_nat_sub_ovf: \"(-) = op_nat_sub_ovf\" by simp\n  \nsepref_definition snat_sub_ovf_impl [llvm_inline] is \"uncurry (RETURN oo op_nat_sub_ovf)\" \n  :: \"(snat_assn' TYPE('l::len2))\\<^sup>k *\\<^sub>a (snat_assn' TYPE('l::len2))\\<^sup>k \\<rightarrow>\\<^sub>a snat_assn' TYPE('l::len2)\"\n  unfolding op_nat_sub_ovf_def \n  apply (annot_snat_const \"TYPE('l)\")\n  by sepref\n  \ndeclare snat_sub_ovf_impl.refine[sepref_fr_rules]\n  \n  \\<close>\n  \n  \n  \n    \n\\<^cancel>\\<open>\n\nsubsection \\<open>Ad-Hoc Regression Tests\\<close>  \n  \nsepref_definition example1 is \"\\<lambda>x. doN {ASSERT (x\\<in>{-10..10});\n    RETURN (x<5 \\<and> x\\<noteq>2 \\<longrightarrow> x-2 \\<noteq> 0)}\" :: \"(sint_assn' TYPE(7))\\<^sup>k \\<rightarrow>\\<^sub>a (bool1_assn)\" \n  apply (annot_sint_const \"TYPE(7)\")\n  apply sepref\n  done\n\nsepref_definition example2 is \"\\<lambda>x. doN {ASSERT (x\\<in>{-10..10}); RETURN (x+(-1) * (7 smod 15) - 3 sdiv 2)}\" :: \"(sint_assn' TYPE(7))\\<^sup>k \\<rightarrow>\\<^sub>a (sint_assn' TYPE(7))\" \n  apply (annot_sint_const \"TYPE(7)\")\n  apply sepref\n  done\n\nsepref_definition example1n is \"\\<lambda>x. doN {ASSERT (x\\<in>{2..10});\n    RETURN (x<5 \\<and> x\\<noteq>2 \\<longrightarrow> x-2 \\<noteq> 0)}\" :: \"(snat_assn' TYPE(7))\\<^sup>k \\<rightarrow>\\<^sub>a (bool1_assn)\" \n  apply (annot_snat_const \"TYPE(7)\")\n  apply sepref\n  done\n\nsepref_definition example2n is \"\\<lambda>x. doN {ASSERT (x\\<in>{5..10}); RETURN ((x-1) * (7 mod 15) - 3 div 2)}\" \n  :: \"(snat_assn' TYPE(7))\\<^sup>k \\<rightarrow>\\<^sub>a (snat_assn' TYPE(7))\" \n  apply (annot_snat_const \"TYPE(7)\")\n  apply sepref\n  done\n  \n      \nlemmas [llvm_code] = example1_def example2_def example1n_def example2n_def  \n  \nllvm_deps example1 example2 example1n example2n\n\nexport_llvm example1 example2 example1n example2n\n  \n\ndefinition example3_abs :: \"'a::len word \\<Rightarrow> 'a word \\<Rightarrow> 'a word nres\" where \"example3_abs a b \\<equiv> do {\n    (a,b) \\<leftarrow> WHILET (\\<lambda>(a,b). a\\<noteq>b) (\\<lambda>(a,b). if a<b then RETURN (a,b-a) else RETURN (a-b,b)) (a,b);\n    RETURN a\n  }\"\n\nsepref_definition example3 is \"uncurry example3_abs\" :: \"word_assn\\<^sup>k *\\<^sub>a word_assn\\<^sup>k \\<rightarrow>\\<^sub>a word_assn\"\n  unfolding example3_abs_def\n  apply sepref_dbg_keep\n  done\n\ndefinition example3n_abs :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat nres\" where \"example3n_abs a b \\<equiv> do {\n    (a,b) \\<leftarrow> WHILET (\\<lambda>(a,b). a\\<noteq>b) (\\<lambda>(a,b). if a<b then RETURN (a,b-a) else RETURN (a-b,b)) (a,b);\n    RETURN a\n  }\"\n\nsepref_definition example3n is \"uncurry example3n_abs\" :: \"(snat_assn' TYPE(32))\\<^sup>k *\\<^sub>a (snat_assn' TYPE(32))\\<^sup>k \\<rightarrow>\\<^sub>a (snat_assn' TYPE(32))\"\n  unfolding example3n_abs_def\n  apply sepref_dbg_keep\n  done\n  \n  \n    \nlemmas [llvm_code] = example3_def example3n_def  \nexport_llvm\n  \"example3 :: 32 word \\<Rightarrow> _\"\n  \"example3 :: 64 word \\<Rightarrow> _\"\n  \"example3n\"\n\n\nsepref_definition example4n is \"\\<lambda>x. do {\n       x \\<leftarrow> RETURN (x >> 1);\n       ASSERT ((x << 1) < max_snat 7);\n       RETURN ((x << 1) > x)\n   }\" :: \"(snat_assn' TYPE(7))\\<^sup>k \\<rightarrow>\\<^sub>a (bool1_assn)\" \n  apply (annot_snat_const \"TYPE(7)\")\n  apply sepref\n  done\n\nlemmas [llvm_code] = example4n_def\n\nllvm_deps example4n\n\nexport_llvm example4n\n \n(* TODO: Characters as i8 *)  \n  *)\n\\<close>\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm_time", "sha": "42dd7f59998d76047bb4b6bce76d8f67b53a08b6", "save_path": "github-repos/isabelle/lammich-isabelle_llvm_time", "path": "github-repos/isabelle/lammich-isabelle_llvm_time/isabelle_llvm_time-42dd7f59998d76047bb4b6bce76d8f67b53a08b6/thys/sepref/Sepref_HOL_Bindings.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3365449865486904}}
{"text": "theory TheoremD14\nimports TheoremD13\nbegin\n\ncontext LocalLexing begin\n\nlemma empty_tokens_of_empty[simp]: \"empty_tokens {} = {}\"\n  using empty_tokens_is_filter by blast\n\nlemma items_le_split_via_eq: \"items_le (Suc k) J = items_le k J \\<union> items_eq (Suc k) J\"\n  by (auto simp add: items_le_def items_eq_def)\n\nlemma paths_le_split_via_eq: \"paths_le (Suc k) P = paths_le k P \\<union> paths_eq (Suc k) P\"\n  by (auto simp add: paths_le_def paths_eq_def)\n\nlemma natUnion_superset:\n  shows \"g i \\<subseteq> natUnion g\"\nby (meson assms natUnion_elem subset_eq)\n\ndefinition indexle :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"indexle k' u' k u = ((indexlt k' u' k u) \\<or> (k' = k \\<and> u' = u))\"\n\ndefinition produced_by_scan_step :: \"item \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"produced_by_scan_step x k u = (\\<exists> k' u' y X. indexle k' u' k u \\<and> y \\<in> \\<J> k' u' \\<and> \n   item_end y = k' \\<and> X \\<in> (\\<T> k' u') \\<and> x = inc_item y (k' + length (chars_of_token X)) \\<and> \n   next_symbol y = Some (terminal_of_token X))\"\n\nlemma indexle_trans: \"indexle k'' u'' k' u' \\<Longrightarrow> indexle k' u' k u \\<Longrightarrow> indexle k'' u'' k u\"\n  using indexle_def indexlt_trans\nproof -\n  assume a1: \"indexle k'' u'' k' u'\"\n  assume a2: \"indexle k' u' k u\"\n  then have f3: \"\\<And>n na. u' = u \\<or> indexlt n na k u \\<or> \\<not> indexlt n na k' u'\"\n    by (meson indexle_def indexlt_trans)\n  have \"\\<And>n na. k' = k \\<or> indexlt n na k u \\<or> \\<not> indexlt n na k' u'\"\n    using a2 by (meson indexle_def indexlt_trans)\n  then show ?thesis\n    using f3 a2 a1 indexle_def by auto\nqed \n\nlemma produced_by_scan_step_trans:\n  assumes \"indexle k' u' k u\"\n  assumes \"produced_by_scan_step x k' u'\"\n  shows \"produced_by_scan_step x k u\"\nproof -\n  from iffD1[OF produced_by_scan_step_def assms(2)] obtain k'a u'a y X where produced_k'_u':\n    \"indexle k'a u'a k' u' \\<and>\n     y \\<in> \\<J> k'a u'a \\<and>\n     item_end y = k'a \\<and>\n     X \\<in> \\<T> k'a u'a \\<and>\n     x = inc_item y (k'a + length (chars_of_token X)) \\<and> next_symbol y = Some (terminal_of_token X)\"\n     by blast\n  then show ?thesis using indexle_trans assms(1) produced_by_scan_step_def by blast \nqed\n\nlemma \\<J>_induct[consumes 1, case_names Induct]:\n  assumes \"x \\<in> \\<J> k u\"\n  assumes induct: \"\\<And> x k u . (\\<And> x' k' u'. x' \\<in> \\<J> k' u' \\<Longrightarrow> indexlt k' u' k u \\<Longrightarrow> P x' k' u') \n                     \\<Longrightarrow> x \\<in> \\<J> k u \\<Longrightarrow> P x k u\"\n  shows \"P x k u\"\nproof -\n  let ?R = \"indexlt_rel <*lex*> {}\"\n  have wf_R: \"wf ?R\" by (auto simp add: wf_indexlt_rel)\n  let ?P = \"\\<lambda> a. snd a \\<in> \\<J> (fst (fst a)) (snd (fst a)) \\<longrightarrow> P (snd a) (fst (fst a)) (snd (fst a))\"\n  have \"x \\<in> \\<J> k u \\<longrightarrow> P x k u\"\n    apply (rule wf_induct[OF wf_R, where P = ?P and a = \"((k, u), x)\", simplified])\n    apply (auto simp add: indexlt_def[symmetric])\n    apply (rule_tac x=ba and k=a and u=b in induct)\n    by auto\n  thus ?thesis using assms by auto \nqed\n\nlemma \\<pi>_no_tokens_item_end: \n  assumes x_in_\\<pi>: \"x \\<in> \\<pi> k {} I\"\n  shows \"item_end x = k \\<or> x \\<in> I\"\nproof -\n  have x_in_limit: \"x \\<in> limit (\\<lambda>I. Complete k (Predict k I)) I\"\n    using x_in_\\<pi> \\<pi>_no_tokens by auto  \n  then show ?thesis\n  proof (induct rule: limit_induct)\n    case (Init x) then show ?case by auto\n  next\n    case (Iterate x J)\n      from Iterate(2) have \"item_end x = k \\<or> x \\<in> Predict k J\"\n        using Complete_item_end by auto\n      then show ?case \n      proof (induct rule: disjCases2)\n        case 1 then show ?case by blast\n      next\n        case 2 \n          then have \"item_end x = k \\<or> x \\<in> J\" \n            using Predict_item_end by auto\n          then show ?case\n          proof (induct rule: disjCases2)\n            case 1 then show ?case by blast\n          next\n            case 2 then show ?case using Iterate(1)[OF 2] by blast\n          qed\n      qed \n  qed\nqed \n\nlemma natUnion_ex: \"x \\<in> natUnion f \\<Longrightarrow> \\<exists> i. x \\<in> f i\"\n  by (metis (no_types, hide_lams) mk_disjoint_insert natUnion_superset natUnion_upperbound \n    subsetCE subset_insert)\n\nlemma locate_in_limit:\n  assumes x_in_limit: \"x \\<in> limit f X\"\n  assumes x_notin_X: \"x \\<notin> X\"\n  shows \"\\<exists> n. x \\<in> funpower f (Suc n) X \\<and> x \\<notin> funpower f n X\"\nproof -\n  have \"\\<exists> N. x \\<in> funpower f N X\" using x_in_limit limit_def natUnion_ex by fastforce\n  then obtain N where N: \"x \\<in> funpower f N X\" by blast\n  {\n    fix n :: nat\n    have \"x \\<in> funpower f n X \\<Longrightarrow> \\<exists> m < n. x \\<in> funpower f (Suc m) X \\<and> x \\<notin> funpower f m X\"\n    proof (induct n)\n      case 0 \n        with x_notin_X show ?case by auto\n    next\n      case (Suc n)\n        have \"x \\<notin> funpower f n X \\<or> x \\<in> funpower f n X\" by blast\n        then show ?case\n        proof (induct rule: disjCases2)\n          case 1     \n            then show ?case using Suc by fastforce\n        next\n          case 2\n            from Suc(1)[OF 2] show ?case using less_SucI by blast \n        qed \n    qed\n  }\n  with N show ?thesis by auto\nqed\n\nlemma produced_by_scan_step: \n  \"x \\<in> \\<J> k u \\<Longrightarrow> item_end x > k \\<Longrightarrow> produced_by_scan_step x k u\"\nproof (induct rule: \\<J>_induct)\n  case (Induct x k u)\n    have \"(k = 0 \\<and> u = 0) \\<or> (k > 0 \\<and> u = 0) \\<or> (u > 0)\" by arith\n    then show ?case\n    proof (induct rule: disjCases3)\n      case 1\n        with Induct have \"item_end x = 0\" using \\<J>_0_0_item_end by blast  \n        with Induct have \"False\" by arith\n        then show ?case by  blast\n    next\n      case 2\n        then obtain k' where k': \"k = Suc k'\" using Suc_pred' by blast \n        with Induct 2 have \"x \\<in> \\<J> (Suc k') 0\" by auto\n        then have \"x \\<in> \\<pi> k {} (\\<I> k')\" by (simp add: k') \n        then have \"item_end x = k \\<or> x \\<in> \\<I> k'\" using \\<pi>_no_tokens_item_end by blast\n        then show ?case\n        proof (induct rule: disjCases2)\n          case 1\n            with Induct have \"False\" by auto\n            then show ?case by blast\n        next\n          case 2\n            then have \"\\<exists> u'. x \\<in> \\<J> k' u'\" using \\<I>.simps natUnion_ex by fastforce\n            then obtain u' where u': \"x \\<in> \\<J> k' u'\" by blast\n            have k'_bound: \"k' < item_end x\" using k' Induct by arith\n            have indexlt: \"indexlt k' u' k u\" by (simp add: indexlt_simp k') \n            from Induct(1)[OF u' this k'_bound] \n            have pred_produced: \"produced_by_scan_step x k' u'\" .\n            then show ?case using indexlt produced_by_scan_step_trans indexle_def by blast \n        qed\n    next\n      case 3\n        then have ex_u': \"\\<exists> u'. u = Suc u'\" by arith\n        then obtain u' where u': \"u = Suc u'\" by blast\n        with Induct have \"x \\<in> \\<J> k (Suc u')\" by metis\n        then have x_in_\\<pi>: \"x \\<in> \\<pi> k (\\<T> k u) (\\<J> k u')\" using u' \\<J>.simps by metis\n        have \"x \\<in> \\<J> k u' \\<or> x \\<notin> \\<J> k u'\" by blast\n        then show ?case\n        proof (induct rule: disjCases2)\n          case 1\n            have indexlt: \"indexlt k u' k u\" by (simp add: indexlt_simp u')             \n            with Induct(1)[OF 1 indexlt Induct(3)] show ?case\n              using indexle_def produced_by_scan_step_trans by blast\n        next\n          case 2\n            have item_end_x: \"k < item_end x\" using Induct by auto\n            obtain f where f: \"f = Scan (\\<T> k u) k \\<circ> Complete k \\<circ> Predict k\" by blast\n            have \"x \\<in> limit f (\\<J> k u')\"\n              using x_in_\\<pi> \\<pi>_functional f by simp\n            from locate_in_limit[OF this 2] obtain n where n:\n              \"x \\<in> funpower f (Suc n) (\\<J> k u') \\<and>\n               x \\<notin> funpower f n (\\<J> k u')\" by blast\n            obtain Y where Y: \"Y = funpower f n (\\<J> k u')\"\n              by blast\n            have x_f_Y: \"x \\<in> f Y \\<and> x \\<notin> Y\" using Y n by auto\n            then have \"x \\<in> Scan (\\<T> k u) k (Complete k (Predict k Y))\" using comp_apply f by simp\n            then have \"x \\<in> (Complete k (Predict k Y)) \\<or>\n              x \\<in> { inc_item x' (k + length c) | x' t c. x' \\<in> bin (Complete k (Predict k Y)) k \\<and> \n                    (t, c) \\<in> (\\<T> k u) \\<and> next_symbol x' = Some t }\" using Scan_def by simp\n            then show ?case\n            proof (induct rule: disjCases2)\n              case 1\n                then have \"False\" using item_end_x x_f_Y Complete_item_end Predict_item_end\n                  using less_not_refl3 by blast\n                then show ?case by auto\n            next\n              case 2\n                have \"Y \\<subseteq> limit f (\\<J> k u')\" using Y limit_def natUnion_superset by fastforce\n                then have \"Y \\<subseteq> \\<pi> k (\\<T> k u) (\\<J> k u')\" using f by (simp add: \\<pi>_functional)  \n                then have Y_in_\\<J>: \"Y \\<subseteq> \\<J> k u\" using u' by simp\n                then have in_\\<J>: \"Complete k (Predict k Y) \\<subseteq> \\<J> k u\"\n                proof - (* automatically generated *)\n                  have f1: \"\\<forall>f I Ia i. (\\<not> mono f \\<or> \\<not> (I::item set) \\<subseteq> Ia \\<or> (i::item) \\<notin> f I) \\<or> i \\<in> f Ia\"\n                    by (meson mono_subset_elem)\n                  obtain ii :: \"item set \\<Rightarrow> item set \\<Rightarrow> item\" where\n                    \"\\<forall>x0 x1. (\\<exists>v2. v2 \\<in> x1 \\<and> v2 \\<notin> x0) = (ii x0 x1 \\<in> x1 \\<and> ii x0 x1 \\<notin> x0)\"\n                    by moura\n                  then have f2: \"\\<forall>I Ia. ii Ia I \\<in> I \\<and> ii Ia I \\<notin> Ia \\<or> I \\<subseteq> Ia\"\n                    by blast\n                  obtain nn :: nat where\n                    f3: \"u = Suc nn\"\n                    using ex_u' by presburger\n                  moreover\n                  { assume \"ii (\\<J> k u) (Complete k (Predict k Y)) \\<in> Complete k (\\<pi> k (\\<T> k (Suc nn)) (\\<J> k nn))\"\n                    then have ?thesis\n                      using f3 f2 Complete_\\<pi>_fix by auto }\n                  ultimately show ?thesis\n                    using f2 f1 by (metis (full_types) Complete_regular Predict_\\<pi>_fix Predict_regular \n                      \\<J>.simps(2) Y_in_\\<J> regular_implies_mono)\n                qed \n                from 2 obtain  x' t c where x'_t_c:\n                  \"x = inc_item x' (k + length c) \\<and> x' \\<in> bin (Complete k (Predict k Y)) k \\<and> \n                    (t, c) \\<in> \\<T> k u \\<and> next_symbol x' = Some t\" by blast\n                show ?case\n                  apply (simp add: produced_by_scan_step_def)\n                  apply (rule_tac x=k in exI)\n                  apply (rule_tac x=u in exI)\n                  apply (simp add: indexle_def)\n                  apply (rule_tac x=x' in exI)\n                  apply auto\n                  using x'_t_c bin_def in_\\<J> apply auto[1]\n                  using x'_t_c bin_def apply blast\n                  apply (rule_tac x=t in exI)\n                  apply (rule_tac x=c in exI)\n                  using x'_t_c by auto\n            qed      \n        qed\n    qed  \nqed\n\nlemma limit_single_step:\n  assumes \"x \\<in> f X\"\n  shows \"x \\<in> limit f X\"\nby (metis assms elem_limit_simp funpower.simps(1) funpower.simps(2))\n\nlemma Gen_union: \"Gen (A \\<union> B) = Gen A \\<union> Gen B\"\n  by (simp add: Gen_def, blast)\n\nlemma is_prefix_Prefixes_subset:\n  assumes \"is_prefix q p\"\n  shows \"Prefixes q \\<subseteq> Prefixes p\"\nproof -\n  show ?thesis\n    apply (auto simp add: Prefixes_def)\n    using assms by (metis is_prefix_append is_prefix_def) \nqed\n\nlemma Prefixes_subset_\\<P>:\n  assumes \"p \\<in> \\<P> k u\"\n  shows \"Prefixes p \\<subseteq> \\<P> k u\"\nusing Prefixes_is_prefix assms prefixes_are_paths by blast\n\nlemma Prefixes_subset_paths_le:\n  assumes \"Prefixes p \\<subseteq> P\"\n  shows \"Prefixes p \\<subseteq> paths_le (charslength p) P\"\nusing Prefixes_is_prefix assms charslength_of_prefix paths_le_def by auto\n\nlemma Scan_\\<J>_subset_\\<J>:\n  \"Scan (\\<T> k (Suc u)) k (\\<J> k u) \\<subseteq> \\<J> k (Suc u)\"\nby (metis (no_types, lifting) Scan_\\<pi>_fix \\<J>.simps(2) \\<J>_subset_Suc_u monoD mono_Scan)\n\nlemma subset_\\<J>k: \"u \\<le> v \\<Longrightarrow> \\<J> k u \\<subseteq> \\<J> k v\"\n  thm \\<J>_subset_Suc_u\n  by (rule subset_fSuc, rule \\<J>_subset_Suc_u) \n\nlemma subset_\\<J>\\<I>k: \"\\<J> k u \\<subseteq> \\<I> k\" by (auto simp add: natUnion_def)\n\nlemma subset_\\<I>\\<J>Suc: \"\\<I> k \\<subseteq> \\<J> (Suc k) u\" \nproof -\n  have a: \"\\<I> k \\<subseteq> \\<J> (Suc k) 0\" \n    apply (simp only: \\<J>.simps)\n    using \\<pi>_apply_setmonotone by blast    \n  show ?thesis \n    apply (case_tac \"u = 0\")\n    apply (simp only: a)\n    apply (rule subset_trans[OF a subset_\\<J>k])\n    by auto\nqed\n\nlemma subset_\\<I>Suc: \"\\<I> k \\<subseteq> \\<I> (Suc k)\"\n  by (rule subset_trans[OF subset_\\<I>\\<J>Suc subset_\\<J>\\<I>k])\n\nlemma subset_\\<I>: \"i \\<le> j \\<Longrightarrow> \\<I> i \\<subseteq> \\<I> j\"\n  by (rule subset_fSuc[where u=i and v=j and f = \\<I>, OF subset_\\<I>Suc])\n\nlemma subset_\\<J> :\n  assumes leq: \"k' < k \\<or> (k' = k \\<and> u' \\<le> u)\"\n  shows \"\\<J> k' u' \\<subseteq> \\<J> k u\"\nproof -\n  from leq show ?thesis\n  proof (induct rule: disjCases2)\n    case 1\n    have s1: \"\\<J> k' u' \\<subseteq> \\<I> k'\" by (rule_tac subset_\\<J>\\<I>k) \n    have s2: \"\\<I> k' \\<subseteq> \\<I> (k - 1)\" \n      apply (rule_tac subset_\\<I>)\n      using 1 by arith\n    from subset_\\<I>\\<J>Suc[where k=\"k - 1\"] 1 have s3: \"\\<I> (k - 1) \\<subseteq> \\<J> k 0\"\n      by simp\n    have s4: \"\\<J> k 0 \\<subseteq> \\<J> k u\" by (rule_tac subset_\\<J>k, simp)\n    from s1 s2 s3 s4 subset_trans show ?case by blast\n  next\n    case 2 thus ?case by (simp add : subset_\\<J>k)\n  qed\nqed  \n\nlemma \\<J>_subset:\n  assumes \"indexle k' u' k u\"\n  shows \"\\<J> k' u' \\<subseteq> \\<J> k u\"\nusing subset_\\<J> indexle_def indexlt_simp\nby (metis assms less_imp_le_nat order_refl) \n\nlemma Scan_items_le:\n  assumes bounded_T: \"\\<And> t . t \\<in> T \\<Longrightarrow> length (chars_of_token t) \\<le> l\"\n  shows \"Scan T k (items_le k P) \\<subseteq> items_le (k + l) (Scan T k P)\"\nproof -\n  {\n    fix x :: item\n    assume x_dom: \"x \\<in> Scan T k (items_le k P)\"\n    then have x_dom': \"x \\<in> Scan T k P\"\n      by (meson items_le_is_filter mono_Scan mono_subset_elem)\n    from x_dom have \"x \\<in> items_le k P \\<or> \n      (\\<exists> y t c. x = inc_item y (k + length c) \\<and> y \\<in> bin (items_le k P) k \\<and> (t, c) \\<in> T\n       \\<and> next_symbol y = Some t)\" \n      using Scan_def using UnE mem_Collect_eq by auto \n    then have \"item_end x \\<le> k + l\"\n    proof (induct rule: disjCases2)\n      case 1 then show ?case\n        by (meson items_le_fix_D items_le_idempotent trans_le_add1)\n    next\n      case 2 \n        then obtain y t c where y: \"x = inc_item y (k + length c) \\<and> y \\<in> bin (items_le k P) k \\<and> \n          (t, c) \\<in> T \\<and> next_symbol y = Some t\" by blast\n        then have item_end_x: \"item_end x = (k + length c)\" by simp\n        from bounded_T y have \"length c \\<le> l\"\n          using chars_of_token_simp by auto \n        with item_end_x show ?case by arith\n    qed\n    with x_dom' have \"x \\<in> items_le (k + l) (Scan T k P)\"\n      using items_le_def mem_Collect_eq by blast\n  }\n  then show ?thesis by blast      \nqed\n\nlemma Scan_mono_tokens:\n  \"P \\<subseteq> Q \\<Longrightarrow> Scan P k I \\<subseteq> Scan Q k I\"\nby (auto simp add: Scan_def)\n\ntheorem thmD14: \"k \\<le> length Doc \\<Longrightarrow> items_le k (\\<J> k u) = Gen (paths_le k (\\<P> k u)) \\<and> \\<T> k u = \\<Z> k u \n    \\<and> items_le k (\\<I> k) = Gen (paths_le k (\\<Q> k))\"\nproof (induct k arbitrary: u rule: less_induct)\n  case (less k)\n    have \"k = 0 \\<or> k \\<noteq> 0\" by arith\n    then show ?case \n    proof (induct rule: disjCases2)\n      case 1\n        have \\<J>_eq_\\<P>: \"items_le k (\\<J> k 0) = Gen (paths_le k (\\<P> k 0))\" \n          by (simp only: 1 thmD8 items_le_paths_le)\n        show ?case using thmD13[OF \\<J>_eq_\\<P> less.prems] by blast\n    next\n      case 2\n        have \"\\<exists> k'. k = Suc k'\" using 2 by arith\n        then obtain k' where k': \"k = Suc k'\" by blast\n        have k'_less_k: \"k' < k\" using k' by arith\n        have \"items_le k (\\<J> k 0) = Gen (paths_le k (\\<P> k 0))\"          \n        proof -\n          have simp_left: \"items_le k (\\<J> k 0) = \\<pi> k {} (items_le k (\\<I> k'))\"\n            using items_le_\\<pi>_swap k' wellformed_items_\\<I> by auto \n          have simp_right: \"Gen (paths_le k (\\<P> k 0)) = natUnion (\\<lambda> v. Gen (paths_le k (\\<P> k' v)))\"\n            by (simp add: k' paths_le_pointwise pointwise_Gen pointwise_natUnion_swap)            \n          {\n            fix v :: nat\n            have split_\\<J>: \"items_le k (\\<J> k' v) = items_le k' (\\<J> k' v) \\<union> items_eq k (\\<J> k' v)\" \n              using k'  items_le_split_via_eq by blast\n            have sub1: \"items_le k' (\\<J> k' v) \\<subseteq> natUnion (\\<lambda> v. Gen (paths_le k (\\<P> k' v)))\"\n            proof -\n              have h: \"items_le k' (\\<J> k' v) \\<subseteq> Gen (paths_le k (\\<P> k' v))\"\n              proof - (* automatically generated *)\n                have f1: \"items_le k' (Gen (\\<P> k' v)) \\<union> items_eq (Suc k') (Gen (\\<P> k' v)) = \n                  Gen (paths_le k (\\<P> k' v))\"\n                  using LocalLexing.items_le_split_via_eq LocalLexing_axioms items_le_paths_le k' \n                  by blast\n                have \"k' \\<le> length Doc\"\n                  by (metis (no_types) dual_order.trans k' less.prems lessI less_imp_le_nat)\n                then have \"items_le k' (\\<J> k' v) = items_le k' (Gen (\\<P> k' v))\"\n                  by (simp add: items_le_paths_le k' less.hyps)\n                then show ?thesis\n                  using f1 by blast\n              qed\n              have \"Gen (paths_le k (\\<P> k' v)) \\<subseteq> natUnion (\\<lambda> v. Gen (paths_le k (\\<P> k' v)))\"\n                using natUnion_superset by fastforce\n              then show ?thesis using h by blast\n            qed\n            {\n              fix x :: item\n              assume x_dom: \"x \\<in> items_eq k (\\<J> k' v)\"\n              have x_in_\\<J>: \"x \\<in> \\<J> k' v\" using x_dom items_eq_def by auto\n              have item_end_x: \"item_end x = k\" using x_dom items_eq_def by auto\n              then have k'_bound: \"k' < item_end x\" using k' by arith\n              from produced_by_scan_step[OF x_in_\\<J> k'_bound]\n              have \"produced_by_scan_step x k' v\" .\n              from iffD1[OF produced_by_scan_step_def this] obtain k'' v'' y X where scan_step:\n                \"indexle k'' v'' k' v \\<and> y \\<in> \\<J> k'' v'' \\<and> item_end y = k'' \\<and> X \\<in> \\<T> k'' v'' \\<and>\n                 x = inc_item y (k'' + length (chars_of_token X)) \\<and> \n                 next_symbol y = Some (terminal_of_token X)\" by blast\n              then have y_in_items_le: \"y \\<in> items_le k'' (\\<J> k'' v'')\"\n                using items_le_def LocalLexing_axioms le_refl mem_Collect_eq by blast \n              have y_in_Gen: \"y \\<in> Gen(paths_le k'' (\\<P> k'' v''))\"\n              proof - (* automatically generated *)\n                have f1: \"\\<And>n. k' < n \\<or> \\<not> k < n\"\n                  using Suc_lessD k' by blast\n                have f2: \"k'' = k' \\<or> k'' < k'\"\n                  using indexle_def indexlt_simp scan_step by force\n                have f3: \"k' < k\"\n                  using k' by blast\n                have f4: \"k' \\<le> length Doc\"\n                  using f1 by (meson less.prems less_Suc_eq_le)\n                have \"k'' \\<le> length Doc \\<or> k' = k''\"\n                  using f2 f1 by (meson Suc_lessD less.prems less_Suc_eq_le less_trans_Suc)\n                then show ?thesis\n                  using f4 f3 f2 Suc_lessD y_in_items_le less.hyps less_trans_Suc by blast\n              qed\n              then have \"\\<exists> p. p \\<in> \\<P> k'' v'' \\<and> pvalid p y\"\n                by (meson Gen_implies_pvalid paths_le_is_filter set_rev_mp)\n              then obtain p where p: \"p \\<in> \\<P> k'' v'' \\<and> pvalid p y\" by blast\n              then have charslength_p: \"charslength p = k''\" using pvalid_item_end scan_step by auto \n              have pvalid_p_y: \"pvalid p y\" using p by blast\n              have \"admissible (p@[(fst X, snd X)])\"\n                apply (rule pvalid_next_terminal_admissible)\n                apply (rule pvalid_p_y)\n                using scan_step apply (simp add: terminal_of_token_def) \n                using scan_step by (metis TokensAt_subset_\\<X> \\<T>_subset_TokensAt \\<X>_are_terminals \n                  set_rev_mp terminal_of_token_def) \n              then have admissible_p_X: \"admissible (p@[X])\" by simp\n              have X_in_\\<Z>: \"X \\<in> \\<Z> k'' (Suc v'')\" by (metis (no_types, lifting) Suc_lessD \\<Z>_subset_Suc \n                k'_bound dual_order.trans indexle_def indexlt_simp item_end_of_inc_item item_end_x \n                le_add1 le_neq_implies_less less.hyps less.prems not_less_eq scan_step subsetCE) \n              have pX_in_\\<P>_k''_v'': \"p@[X] \\<in> \\<P> k'' (Suc v'')\"   \n                apply (simp only: \\<P>.simps)\n                apply (rule limit_single_step)\n                apply (auto simp only: Append_def)\n                apply (rule_tac x=p in exI)\n                apply (rule_tac x=X in exI)\n                apply (simp only: admissible_p_X X_in_\\<Z>)\n                using charslength_p p by auto\n              have \"indexle k'' v'' k' v\" using scan_step by simp\n              then have \"indexle k'' (Suc v'') k' (Suc v)\"\n                by (simp add: indexle_def indexlt_simp)               \n              then have \"\\<P> k'' (Suc v'') \\<subseteq> \\<P> k' (Suc v)\"\n                by (metis indexle_def indexlt_simp less_or_eq_imp_le subset_\\<P>) \n              with pX_in_\\<P>_k''_v'' have pX_in_\\<P>_k': \"p@[X] \\<in> \\<P> k' (Suc v)\" by blast\n              have \"charslength (p@[X]) = k'' +  length (chars_of_token X)\"\n                using charslength_p by auto\n              then have \"charslength (p@[X]) = item_end x\" using scan_step by simp\n              then have charslength_p_X: \"charslength (p@[X]) = k\" using item_end_x by simp\n              then have pX_dom: \"p@[X] \\<in> paths_le k (\\<P> k' (Suc v))\"\n                using lessI less_Suc_eq_le mem_Collect_eq pX_in_\\<P>_k' paths_le_def by auto\n              have wellformed_x: \"wellformed_item x\"\n                using item_end_x less.prems scan_step wellformed_inc_item wellformed_items_\\<J> \n                  wellformed_items_def by auto\n              have wellformed_p_X: \"wellformed_tokens (p@[X])\"\n                using \\<P>_wellformed pX_in_\\<P>_k''_v'' by blast\n              from iffD1[OF pvalid_def pvalid_p_y] obtain r \\<gamma> where r_\\<gamma>:\n                \"wellformed_tokens p \\<and>\n                 wellformed_item y \\<and>\n                 r \\<le> length p \\<and>\n                 charslength p = item_end y \\<and>\n                 charslength (take r p) = item_origin y \\<and>\n                 is_derivation (terminals (take r p) @ [item_nonterminal y] @ \\<gamma>) \\<and>\n                 derives (item_\\<alpha> y) (terminals (drop r p))\" by blast\n              have r_le_p: \"r \\<le> length p\" by (simp add: r_\\<gamma>)\n              have item_nonterminal_x: \"item_nonterminal x = item_nonterminal y\" \n                by (simp add: scan_step)\n              have item_\\<alpha>_x: \"item_\\<alpha> x = (item_\\<alpha> y) @ [terminal_of_token X]\"\n                by (simp add: item_\\<alpha>_of_inc_item r_\\<gamma> scan_step)              \n              have pvalid_x: \"pvalid (p@[X]) x\"                \n                apply (auto simp add: pvalid_def wellformed_x wellformed_p_X)\n                apply (rule_tac x=r in exI)\n                apply auto\n                apply (simp add: le_SucI r_\\<gamma>)\n                using r_\\<gamma> scan_step apply auto[1]\n                using r_\\<gamma> scan_step apply auto[1]\n                apply (rule_tac x=\\<gamma> in exI)\n                apply (simp add: r_le_p item_nonterminal_x)\n                using r_\\<gamma> apply simp\n                apply (simp add: r_le_p item_\\<alpha>_x)\n                by (metis terminals_singleton append_Nil2 \n                  derives_implies_leftderives derives_is_sentence is_sentence_concat \n                  is_sentence_cons is_symbol_def is_word_append is_word_cons is_word_terminals \n                  is_word_terminals_drop leftderives_implies_derives leftderives_padback \n                  leftderives_refl r_\\<gamma> terminals_append terminals_drop wellformed_p_X)\n              then have \"x \\<in> Gen (paths_le k (\\<P> k' (Suc v)))\" using pX_dom Gen_def \n                LocalLexing_axioms mem_Collect_eq by auto \n            }\n            then have sub2: \"items_eq k (\\<J> k' v) \\<subseteq> natUnion (\\<lambda> v. Gen (paths_le k (\\<P> k' v)))\"\n              by (meson dual_order.trans natUnion_superset subsetI)                                       \n            have suffices3: \"items_le k (\\<J> k' v) \\<subseteq> natUnion (\\<lambda> v. Gen (paths_le k (\\<P> k' v)))\"\n              using split_\\<J> sub1 sub2 by blast\n            have \"items_le k (\\<J> k' v) \\<subseteq> Gen (paths_le k (\\<P> k 0))\"\n              using suffices3 simp_right by blast\n          }\n          note suffices2 = this\n          have items_le_natUnion_swap: \"items_le k (\\<I> k') = natUnion(\\<lambda> v. items_le k (\\<J> k' v))\"\n            by (simp add: items_le_pointwise pointwise_natUnion_swap)            \n          then have suffices1: \"items_le k (\\<I> k') \\<subseteq> Gen (paths_le k (\\<P> k 0))\"\n            using suffices2 natUnion_upperbound by metis    \n          have sub_lemma: \"items_le k (\\<J> k 0) \\<subseteq> Gen (paths_le k (\\<P> k 0))\"\n          proof -\n            have \"items_le k (\\<J> k 0) \\<subseteq> Gen (\\<P> k 0)\"\n              apply (subst simp_left)\n              apply (rule thmD5)\n              apply (auto simp only: less)\n              using suffices1 items_le_is_filter items_le_paths_le subsetCE by blast \n            then show ?thesis\n              by (simp add: items_le_idempotent remove_paths_le_in_subset_Gen)\n          qed          \n          have eq1: \"\\<pi> k {} (items_le k (\\<I> k')) = \\<pi> k {} (items_le k (natUnion (\\<J> k')))\" by simp\n          then have eq2: \"\\<pi> k {} (items_le k (natUnion (\\<J> k'))) = \n            \\<pi> k {} (natUnion (\\<lambda> v. items_le k (\\<J> k' v)))\"\n            using items_le_natUnion_swap by auto\n          from simp_left eq1 eq2 \n          have simp_left': \"items_le k (\\<J> k 0) = \\<pi> k {} (natUnion (\\<lambda> v. items_le k (\\<J> k' v)))\"\n            by metis\n          {\n            fix v :: nat\n            fix q :: \"token list\"\n            fix x :: item\n            assume q_dom: \"q \\<in> paths_eq k (\\<P> k' v)\"\n            assume pvalid_q_x: \"pvalid q x\"\n            have q_in_\\<P>: \"q \\<in> \\<P> k' v\" using q_dom paths_eq_def by auto\n            have charslength_q: \"charslength q = k\" using q_dom paths_eq_def by auto\n            with k'_less_k have q_nonempty: \"q \\<noteq> []\"\n              using \"2.hyps\" chars.simps(1) charslength.simps list.size(3) by auto \n            then have \"\\<exists> p X. q = p @ [X]\" by (metis append_butlast_last_id) \n            then obtain p X where pX: \"q = p @ [X]\" by blast\n            from last_step_of_path[OF q_in_\\<P> pX] obtain k'' v'' where k'':\n              \"indexlt k'' v'' k' v \\<and> q \\<in> \\<P> k'' (Suc v'') \\<and> charslength p = k'' \\<and> \n               X \\<in> \\<Z> k'' (Suc v'')\" by blast\n            have h1: \"p \\<in> \\<PP>\"\n              by (metis (no_types, lifting) LocalLexing.\\<PP>_covers_\\<P> LocalLexing_axioms \n                append_Nil2 is_prefix_cancel is_prefix_empty pX prefixes_are_paths q_in_\\<P> subsetCE) \n            have h2: \"charslength p = k''\" using k'' by blast\n            obtain T where T: \"T = {X}\" by blast\n            have h3: \"X \\<in> T\" using T by blast\n            have h4: \"T \\<subseteq> \\<X> k''\" using \\<Z>_subset_\\<X> T k'' by blast \n            obtain N where N: \"N = item_nonterminal x\" by blast\n            obtain \\<alpha> where \\<alpha>: \"\\<alpha> = item_\\<alpha> x\" by blast\n            obtain \\<beta> where \\<beta>: \"\\<beta> = item_\\<beta> x\" by blast\n            have wellformed_x: \"wellformed_item x\" using pvalid_def pvalid_q_x by blast \n            then have h5: \"(N, \\<alpha> @ \\<beta>) \\<in> \\<RR>\"\n              using N \\<alpha> \\<beta> item_nonterminal_def item_rhs_def item_rhs_split prod.collapse \n                wellformed_item_def by auto \n            have pvalid_left_q_x: \"pvalid_left q x\" using pvalid_q_x by (simp add: pvalid_left) \n            from iffD1[OF pvalid_left_def pvalid_left_q_x] obtain r \\<gamma> where r_\\<gamma>: \n              \"wellformed_tokens q \\<and>\n               wellformed_item x \\<and>\n               r \\<le> length q \\<and>\n               charslength q = item_end x \\<and>\n               charslength (take r q) = item_origin x \\<and>\n               is_leftderivation (terminals (take r q) @ [item_nonterminal x] @ \\<gamma>) \\<and>\n               leftderives (item_\\<alpha> x) (terminals (drop r q))\" by blast\n            have h6: \"r \\<le> length q\" using r_\\<gamma> by blast\n            have h7: \"leftderives [\\<SS>] (terminals (take r q) @ [N] @ \\<gamma>)\"\n              using r_\\<gamma> N is_leftderivation_def by blast \n            have h8: \"leftderives \\<alpha> (terminals (drop r q))\" using r_\\<gamma> \\<alpha> by metis\n            have h9: \"k = k'' + length (chars_of_token X)\" using r_\\<gamma>\n              using charslength_q h2 pX by auto \n            have h10: \"x = Item (N, \\<alpha> @ \\<beta>) (length \\<alpha>) (charslength (take r q)) k\"\n              by (metis N \\<alpha> \\<beta> charslength_q item.collapse item_dot_is_\\<alpha>_length item_nonterminal_def \n                item_rhs_def item_rhs_split prod.collapse r_\\<gamma>)             \n            from thmD11[OF h1 h2 h3 h4 pX h5 h6 h7 h8 h9 h10] \n            have \"x \\<in> items_le k (\\<pi> k {} (Scan T k'' (Gen (Prefixes p))))\" \n              by blast\n            then have x_in: \"x \\<in> \\<pi> k {} (Scan T k'' (Gen (Prefixes p)))\"\n              using items_le_is_filter by blast             \n            have subset1: \"Prefixes p \\<subseteq> Prefixes q\"\n              apply (rule is_prefix_Prefixes_subset)\n              by (simp add: pX is_prefix_def)\n            have subset2: \"Prefixes q \\<subseteq> \\<P> k'' (Suc v'')\" \n              apply (rule Prefixes_subset_\\<P>)\n              using k'' by blast\n            thm less\n            from subset1 subset2 have \"Prefixes p \\<subseteq> \\<P> k'' (Suc v'')\" by blast\n            then have \"Prefixes p \\<subseteq> paths_le k'' (\\<P> k'' (Suc v''))\" \n              using k'' Prefixes_subset_paths_le by blast            \n            then have subset3: \"Gen (Prefixes p) \\<subseteq> Gen (paths_le k'' (\\<P> k'' (Suc v'')))\"\n              using Gen_def LocalLexing_axioms by auto\n            have k''_less_k: \"k'' < k\" using k'' k' using indexlt_simp less_Suc_eq by auto \n            then have k''_Doc_bound: \"k'' \\<le> length Doc\" using less by auto\n            from less(1)[OF k''_less_k k''_Doc_bound, of \"Suc v''\"]\n            have induct1: \"items_le k'' (\\<J> k'' (Suc v'')) = Gen (paths_le k'' (\\<P> k'' (Suc v'')))\"\n              by blast\n            from less(1)[OF k''_less_k k''_Doc_bound, of \"Suc(Suc v'')\"]\n            have induct2: \"\\<T> k'' (Suc (Suc v'')) = \\<Z> k'' (Suc (Suc v''))\" by blast\n            have subset4: \"Gen (Prefixes p) \\<subseteq> items_le k'' (\\<J> k'' (Suc v''))\"\n              using subset3 induct1 by auto\n            from induct1 subset4\n            have subset6: \"Scan T k'' (Gen (Prefixes p)) \\<subseteq> \n              Scan T k'' (items_le k'' (\\<J> k'' (Suc v'')))\"\n              apply (rule_tac monoD[OF mono_Scan])\n              by blast\n            have \"k'' + length (chars_of_token X) = k\"\n              by (simp add: h9)\n            have \"\\<And> t. t \\<in> T \\<Longrightarrow> length (chars_of_token t) \\<le> length (chars_of_token X)\"\n              using T by auto\n            from Scan_items_le[of T, OF this, simplified, of k'' \"\\<J> k'' (Suc v'')\"] h9\n            have subset7: \"Scan T k'' (items_le k'' (\\<J> k'' (Suc v'')))\n              \\<subseteq> items_le k (Scan T k'' (\\<J> k'' (Suc v'')))\" by simp\n            have \"T \\<subseteq> \\<Z> k'' (Suc (Suc v''))\" using T k''\n              using \\<Z>_subset_Suc set_rev_mp singletonD subsetI by blast \n            then have T_subset_\\<T>: \"T \\<subseteq> \\<T> k'' (Suc (Suc v''))\" using induct2 by auto\n            have subset8: \"Scan T k'' (\\<J> k'' (Suc v'')) \\<subseteq>\n              Scan (\\<T> k'' (Suc (Suc v''))) k'' (\\<J> k'' (Suc v''))\" \n              using T_subset_\\<T> Scan_mono_tokens by blast\n            have subset9: \"Scan (\\<T> k'' (Suc (Suc v''))) k'' (\\<J> k'' (Suc v'')) \\<subseteq> \\<J> k'' (Suc (Suc v''))\"\n              by (rule Scan_\\<J>_subset_\\<J>)\n            have subset10: \"(Scan T k'' (\\<J> k'' (Suc v''))) \\<subseteq> \\<J> k'' (Suc (Suc v''))\"\n              using subset8 subset9 by blast\n            have \"k'' \\<le> k'\" using k'' indexlt_simp by auto\n            then have \"indexle k'' (Suc (Suc v'')) k' (Suc (Suc v''))\" using indexlt_simp\n              using indexle_def le_neq_implies_less by auto\n            then have subset11: \"\\<J> k'' (Suc (Suc v'')) \\<subseteq> \\<J> k' (Suc (Suc v''))\"\n              using \\<J>_subset by blast\n            have subset12: \"Scan T k'' (\\<J> k'' (Suc v'')) \\<subseteq> \\<J> k' (Suc (Suc v''))\"\n              using subset8 subset9 subset10 subset11 by blast\n            then have subset13: \"items_le k (Scan T k'' (\\<J> k'' (Suc v''))) \\<subseteq>\n              items_le k (\\<J> k' (Suc (Suc v'')))\"\n              using items_le_def mem_Collect_eq rev_subsetD subsetI by auto \n            have subset14: \"Scan T k'' (Gen (Prefixes p)) \\<subseteq> items_le k (\\<J> k' (Suc (Suc v'')))\"\n              using subset6 subset7 subset13 by blast\n            then have x_in': \"x \\<in> \\<pi> k {} (items_le k (\\<J> k' (Suc (Suc v''))))\"\n              using x_in\n              by (meson \\<pi>_apply_setmonotone \\<pi>_subset_elem_trans subsetCE subsetI)\n            from x_in' have \"x \\<in> \\<pi> k {} (natUnion (\\<lambda> v. items_le k (\\<J> k' v)))\"\n              by (meson k' mono_\\<pi> mono_subset_elem natUnion_superset)\n          }\n          note suffices6 = this\n          {\n            fix v :: nat\n            have \"Gen (paths_eq k (\\<P> k' v)) \\<subseteq> \\<pi> k {} (natUnion (\\<lambda> v. items_le k (\\<J> k' v)))\"\n              using suffices6 by (meson Gen_implies_pvalid subsetI) \n          }\n          note suffices5 = this\n          {\n            fix v :: nat\n            have \"paths_le k (\\<P> k' v) = paths_le k' (\\<P> k' v) \\<union> paths_eq k (\\<P> k' v)\"\n              using  paths_le_split_via_eq k' by metis\n            then have Gen_split: \"Gen (paths_le k (\\<P> k' v)) = \n              Gen (paths_le k' (\\<P> k' v)) \\<union> Gen(paths_eq k (\\<P> k' v))\" using Gen_union by metis\n            have case_le: \"Gen (paths_le k' (\\<P> k' v)) \\<subseteq>  \\<pi> k {} (natUnion (\\<lambda> v. items_le k (\\<J> k' v)))\"\n            proof -\n              from less k'_less_k have \"k' \\<le> length Doc\" by arith\n              from less(1)[OF k'_less_k this]\n              have \"items_le k' (\\<J> k' v) = Gen (paths_le k' (\\<P> k' v))\" by blast\n              then have \"Gen (paths_le k' (\\<P> k' v)) \\<subseteq> natUnion (\\<lambda> v. items_le k (\\<J> k' v))\"\n                using items_le_def LocalLexing_axioms k'_less_k natUnion_superset by fastforce\n              then show ?thesis using \\<pi>_apply_setmonotone by blast\n            qed\n            have \"Gen (paths_le k (\\<P> k' v)) \\<subseteq> \\<pi> k {} (natUnion (\\<lambda> v. items_le k (\\<J> k' v)))\"\n              using Gen_split case_le suffices5 UnE set_rev_mp subsetI by blast \n          }\n          note suffices4 = this\n          have super_lemma: \"Gen (paths_le k (\\<P> k 0)) \\<subseteq> items_le k (\\<J> k 0)\"\n            apply (subst simp_right)\n            apply (subst simp_left')\n            using suffices4 by (meson natUnion_ex set_rev_mp subsetI) \n          from super_lemma sub_lemma show ?thesis by blast\n        qed             \n        then show ?case using thmD13 less.prems by blast   \n    qed\nqed\n\nend\n\nend\n", "meta": {"author": "proofpeer", "repo": "local-lexing-isabelle-theories", "sha": "3cb0609723e087b40405b149226e4115dfac44fc", "save_path": "github-repos/isabelle/proofpeer-local-lexing-isabelle-theories", "path": "github-repos/isabelle/proofpeer-local-lexing-isabelle-theories/local-lexing-isabelle-theories-3cb0609723e087b40405b149226e4115dfac44fc/TheoremD14.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6334102636778403, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.33647346925681126}}
{"text": "subsection \\<open>Instantiation for IO automata\\<close>\n\n(*<*)\ntheory BD_Security_IO\nimports Abstract_BD_Security BD_Security_TS IO_Automaton Filtermap\nbegin\n(*>*)\n\n\nno_notation relcomp (infixr \"O\" 75)\n\nabbreviation never :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> bool\" where \"never U \\<equiv> list_all (\\<lambda> a. \\<not> U a)\"\n\nlocale BD_Security_IO = IO_Automaton istate step\n for istate :: 'state and step :: \"'state \\<Rightarrow> 'act \\<Rightarrow> 'out \\<times> 'state\"\n+\nfixes (* value filtering and production:  *)\n   \\<phi> :: \"('state,'act,'out) trans \\<Rightarrow> bool\" and f :: \"('state,'act,'out) trans \\<Rightarrow> 'value\"\n and (* observation filtering and production: *)\n   \\<gamma> :: \"('state,'act,'out) trans \\<Rightarrow> bool\" and g :: \"('state,'act,'out) trans \\<Rightarrow> 'obs\"\n and (* declassification trigger:  *)\n   T :: \"('state,'act,'out) trans \\<Rightarrow> bool\"\n and (* declassification bound: *)\n   B :: \"'value list \\<Rightarrow> 'value list \\<Rightarrow> bool\"\nbegin\n\nsublocale BD_Security_TS where validTrans = validTrans and srcOf = srcOf and tgtOf = tgtOf .\n\nlemma reachNT_step_induct[consumes 1, case_names Istate Step]:\n  assumes \"reachNT s\"\n    and \"P istate\"\n    and \"\\<And>s a ou s'. reachNT s \\<Longrightarrow> step s a = (ou, s') \\<Longrightarrow> \\<not>T (Trans s a ou s') \\<Longrightarrow> P s \\<Longrightarrow> P s'\"\n  shows \"P s\"\n  using assms\n  by (induction rule: reachNT.induct) (auto elim: validTrans.elims)\n\nlemma reachNT_PairI:\n  assumes \"reachNT s\" and \"step s a = (ou, s')\" and \"\\<not> T (Trans s a ou s')\"\n  shows \"reachNT s'\"\n  using assms reachNT.simps[of s']\n  by auto\n\nlemma reachNT_state_cases[cases set, consumes 1, case_names init step]:\n  assumes \"reachNT s\"\n  obtains \"s = istate\"\n  | sh a ou where \"reach sh\" \"step sh a = (ou,s)\" \"\\<not>T (Trans sh a ou s)\"\n  using assms\n  unfolding reachNT.simps[of s]\n  by (fastforce intro: reachNT_reach elim: validTrans.elims)\n\n(* This is assumed to be an invariant only modulo non T  *)\ndefinition invarNT where\n\"invarNT Inv \\<equiv> \\<forall> s a ou s'. reachNT s \\<and> Inv s \\<and> \\<not> T (Trans s a ou s') \\<and> step s a = (ou,s') \\<longrightarrow> Inv s'\"\n\nlemma invarNT_disj:\nassumes \"invarNT Inv1\" and \"invarNT Inv2\"\nshows \"invarNT (\\<lambda> s. Inv1 s \\<or> Inv2 s)\"\nusing assms unfolding invarNT_def by blast\n\nlemma invarNT_conj:\nassumes \"invarNT Inv1\" and \"invarNT Inv2\"\nshows \"invarNT (\\<lambda> s. Inv1 s \\<and> Inv2 s)\"\nusing assms unfolding invarNT_def by blast\n\nlemma holdsIstate_invarNT:\n  assumes h: \"holdsIstate Inv\" and i: \"invarNT Inv\" and a: \"reachNT s\"\n  shows \"Inv s\"\n  using a using h i unfolding holdsIstate_def invarNT_def\n  by (induction rule: reachNT_step_induct) auto\n\nend (* context BD_Security_IO *)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Bounded_Deducibility_Security/BD_Security_IO.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3364734692568112}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                 August 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2008         |\n            |                   June 2008  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_semantics\nimports CSP_T.CSP_T_semantics Domain_F_cms\nbegin\n\n(*****************************************************************\n\n         1. semantic clause\n         2. \n         3. \n         4. \n\n *****************************************************************)\n\n(*********************************************************\n                    semantic clause\n *********************************************************)\n\nprimrec\n  failures :: \"('p,'a) proc =>  ('p => 'a domF) => 'a setF\"\nwhere\n  \"failures(STOP)    = (%M. {f. EX X. f = (<>, X) }f)\"\n\n |\"failures(SKIP)    = (%M. {f. (EX X. f = (<>, X) & X <= Evset) |\n                                (EX X. f = (<Tick>, X)) }f)\"\n |\"failures(DIV)     = (%M. {}f)\"\n\n |\"failures(a -> P)  = (%M. {f. (EX X.   f = (<>,X) & Ev a ~: X) |\n                         (EX s X. f = (<Ev a> ^^^ s, X) & (s,X) :f failures(P) M ) }f)\"\n\n |\"failures(? :X -> Pf) = (%M. {f. (EX Y.     f = (<>,Y) & Ev`X Int Y = {}) |\n                         (EX a s Y. f = (<Ev a> ^^^ s, Y) & \n                                   (s,Y) :f failures(Pf a) M & a : X) }f)\"\n\n |\"failures(P [+] Q) = (%M. {f. \n       (EX   X. f = (<>,X) & f :f failures(P) M IntF failures(Q) M) |\n       (EX s X. f = (s,X)  & f :f failures(P) M UnF  failures(Q) M & s ~= <>) |\n       (EX   X. f = (<>,X) & <Tick> :t traces(P) (fstF o M) UnT \n                                       traces(Q) (fstF o M) & X <= Evset) }f)\"\n\n |\"failures(P |~| Q) = (%M. failures(P) M UnF failures(Q) M)\"\n\n |\"failures(!! :C .. Pf) = (%M. {f. EX c: sumset C. f :f failures(Pf c) M}f)\"\n\n |\"failures(IF b THEN P ELSE Q) = (%M. if b then failures(P) M else failures(Q) M)\"\n\n |\"failures(P |[X]| Q)  = (%M. {f. \n      EX u Y Z. f = (u, Y Un Z) & Y-((Ev`X) Un {Tick})= Z-((Ev`X) Un {Tick}) &\n     (EX s t. u : s |[X]|tr t & (s,Y) :f failures(P) M & (t,Z) :f failures(Q) M) }f)\"\n\n |\"failures(P -- X)  = (%M. {f. \n      EX s Y. f = (s --tr X, Y) & (s,(Ev`X) Un Y) :f failures(P) M}f)\"\n\n |\"failures(P [[r]]) = (%M. {f. \n      EX s t X. f = (t,X) & s [[r]]* t & (s, [[r]]inv X) :f failures(P) M }f)\" \n\n |\"failures(P ;; Q) = (%M. {f. \n     (EX t X. f = (t,X) & (t, X Un {Tick}) :f failures(P) M & noTick t) |\n     (EX s t X. f = (s ^^^ t,X) & s ^^^ <Tick> :t traces(P) (fstF o M) & \n                                    (t, X) :f failures(Q) M & noTick s) }f)\"\n\n |\"failures(P |. n) = (%M. failures(P) M .|. n)\"\n\n |\"failures($p)     = (%M. sndF (M p))\"\n\ndeclare failures.simps [simp del]\n\n(*** for dealing with both !nat and !set ***)\n\nlemma failures_inv_inj[simp]:\n   \"inj g ==> (EX c. (EX n. c = g n & n : N) & f :f failures (Pf (inv g c)) x)\n            = (EX z:N. f :f failures (Pf z) x)\"\nby (auto)\n\nlemma Rep_int_choice_failures_nat:\n  \"failures(!nat :N .. Pf) = (%M. {f. EX n:N. f :f failures(Pf n) M}f)\"\napply (simp add: Rep_int_choice_ss_def)\napply (simp add: failures.simps)\ndone\n\nlemma Rep_int_choice_failures_set:\n  \"failures(!set :Xs .. Pf) = (%M. {f. EX X:Xs. f :f failures(Pf X) M}f)\"\napply (simp add: Rep_int_choice_ss_def)\napply (simp add: failures.simps)\ndone\n\nlemma Rep_int_choice_failures_com_lm:\n   \"(EX z. (EX a. z = {a} & a : X) & f :f failures (Pf (the_elem z)) M)\n  = (EX a:X. f :f failures (Pf a) M)\"\napply (auto)\napply (rule_tac x=\"{a}\" in exI)\napply (auto)\ndone\n\nlemma Rep_int_choice_failures_com: \n  \"failures(! :X .. Pf) = (%M. {f. EX a:X. f :f failures(Pf a) M}f)\"\napply (simp add: Rep_int_choice_com_def)\napply (simp add: Rep_int_choice_failures_set)\napply (simp add: Rep_int_choice_failures_com_lm)\ndone\n\nlemma Rep_int_choice_failures_f: \n  \"inj g ==> failures(!<g> :X .. Pf) = \n             (%M. {f. EX a:X. f :f failures(Pf a) M}f)\"\napply (simp add: Rep_int_choice_f_def)\napply (simp add: Rep_int_choice_failures_com)\ndone\n\nlemmas Rep_int_choice_failures =\n       Rep_int_choice_failures_nat\n       Rep_int_choice_failures_set\n       Rep_int_choice_failures_com\n       Rep_int_choice_failures_f\n\n(*\nlemmas failures_def = failures.simps Rep_int_choice_failures\n*)\nlemmas failures_iff = failures.simps Rep_int_choice_failures\n\n(*********************************************************\n                     semantics\n *********************************************************)\n\ndefinition\n  semFf   :: \"('p,'a) proc => ('p => 'a domF) => 'a domF\" (\"[[_]]Ff\")\n  where\n  semFf_def  : \"[[P]]Ff == (%M. (traces(P) (fstF o M) ,, failures(P) M))\"\n  \ndefinition  \n  semFfun :: \"('p => ('p,'a) proc) => ('p => 'a domF) => ('p => 'a domF)\" \n                                                         (\"[[_]]Ffun\")\n  where                                                         \n  semFfun_def: \"[[Pf]]Ffun == (%M. %p. [[Pf p]]Ff M)\"\n\n(*\nnotation (xsymbols) semFf   (\"\\<lbrakk>_\\<rbrakk>Ff\")\nnotation (xsymbols) semFfun (\"\\<lbrakk>_\\<rbrakk>Ffun\")\n*)\n\n(*** relation ***)\n\nlemma semFf_semFfun:\n  \"(%p. [[Pf p]]Ff M) = [[Pf]]Ffun M\"\nby (simp add: semFfun_def semFf_def)\n\n(*------------------------------------------------------------------*\n        M such that [[p]]Ff M = [[PNfun(p)]]Ff M\n   such M is the fixed point of the function [[PNfun(p)]]Ffun\n *------------------------------------------------------------------*)\n\ndefinition\n  semFfix  :: \"('p => ('p,'a) proc) => ('p => 'a domF)\"      (\"[[_]]Ffix\")\n  where\n  semFfix_def : \n   \"[[Pf]]Ffix == (if (FPmode = CMSmode) then (UFP ([[Pf]]Ffun))\n                                         else (LFP ([[Pf]]Ffun)))\"\n\n(*\nnotation (xsymbols) semFfix (\"\\<lbrakk>_\\<rbrakk>Ffix\")\n*)\n\ndefinition\n MF :: \"('p => 'a domF)\"\n where\n MF_def : \"MF == [[PNfun]]Ffix\"\n\n(*** semantics ***)\n\ndefinition\n  semF  :: \"('p,'a) proc => 'a domF\"      (\"[[_]]F\")\n  where\n  semF_def : \"[[P]]F == [[P]]Ff MF\"\n(*\nnotation (xsymbols) semF (\"\\<lbrakk>_\\<rbrakk>F\")\n*)\n\n(*********************************************************\n              relations over processes\n *********************************************************)\n\ndefinition\n  refF :: \"('p,'a) proc => ('p => 'a domF) => \n           ('q => 'a domF) => ('q,'a) proc => bool\"\n                               (\"(0_ /<=F[_,_] /_)\" [51,0,0,50] 50)\n  where\n  refF_def : \"P1 <=F[M1,M2] P2 == [[P2]]Ff M2 <= [[P1]]Ff M1\"\n  \ndefinition  \n  eqF :: \"('p,'a) proc => ('p => 'a domF) => \n           ('q => 'a domF) => ('q,'a) proc => bool\"\n                               (\"(0_ /=F[_,_] /_)\"[51,0,0,50] 50)\n  where\n  eqF_def  : \"P1  =F[M1,M2] P2 == [[P1]]Ff M1  = [[P2]]Ff M2\"\n\n(*------------------------------------*\n |              X-Symbols             |\n *------------------------------------*)\n\n(*\nnotation (xsymbols) refF (\"(0_ /\\<sqsubseteq>F[_,_] /_)\" [51,100,100,50] 50)\n*)\n\n(*********************************************************\n        relations over processes (fixed point)\n *********************************************************)\n\nabbreviation\n refFfix :: \"('p,'a) proc => ('q,'a) proc => bool\" (\"(0_ /<=F /_)\" [51,50] 50)\n where \"P1 <=F P2 == P1 <=F[MF,MF] P2\"\n\nabbreviation\n eqFfix :: \"('p,'a) proc => ('q,'a) proc => bool\"  (\"(0_ /=F /_)\" [51,50] 50)\n where \"P1  =F P2 == P1  =F[MF,MF] P2\"\n\n(* =F and <=F *)\n\nlemma refF_semF: \"(P1 <=F P2) = ([[P2]]F <= [[P1]]F)\"\napply (simp add: refF_def)\napply (simp add: semF_def)\ndone\n\nlemma eqF_semF: \"(P1 =F P2) = ([[P1]]F = [[P2]]F)\"\napply (simp add: eqF_def)\napply (simp add: semF_def)\ndone\n\n(*------------------------------------*\n |              X-Symbols             |\n *------------------------------------*)\n(*\nnotation (xsymbols) refFfix (\"(0_ /\\<sqsubseteq>F /_)\" [51,50] 50)\n*)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\n(*** eq and ref ***)\n\nlemma cspF_eq_ref_iff:\n \"(P1 =F[M1,M2] P2) = (P1 <=F[M1,M2] P2 & P2 <=F[M2,M1] P1)\"\nby (auto simp add: refF_def eqF_def)\n\nlemma cspF_eq_ref:\n  \"P1 =F[M1,M2] P2 ==> P1 <=F[M1,M2] P2\"\nby (simp add: cspF_eq_ref_iff)\n\nlemma cspF_ref_eq:\n  \"[| P1 <=F[M1,M2] P2 ; P2 <=F[M2,M1] P1 |] ==> P1 =F[M1,M2] P2\"\nby (simp add: cspF_eq_ref_iff)\n\n(*** reflexivity ***)\n\nlemma cspF_reflex_eq_P[simp]: \"P =F[M,M] P\"\nby (simp add: eqF_def)\n\nlemma cspF_reflex_eq_STOP[simp]: \"STOP =F[M1,M2] STOP\"   \nby (simp add: eqF_def semFf_def traces_iff failures_iff)\n\nlemma cspF_reflex_eq_SKIP[simp]: \"SKIP =F[M1,M2] SKIP\"   \nby (simp add: eqF_def semFf_def traces_iff failures_iff)\n\nlemma cspF_reflex_eq_DIV[simp]: \"DIV =F[M1,M2] DIV\"   \nby (simp add: eqF_def semFf_def traces_iff failures_iff)\n\nlemmas cspF_reflex_eq = cspF_reflex_eq_P\n                        cspF_reflex_eq_STOP\n                        cspF_reflex_eq_SKIP\n                        cspF_reflex_eq_DIV\n\nlemma cspF_reflex_ref_P[simp]: \"P <=F[M,M] P\"\nby (simp add: refF_def)\n\nlemma cspF_reflex_ref_STOP[simp]: \"STOP <=F[M1,M2] STOP\"   \nby (simp add: refF_def semFf_def traces_iff failures_iff)\n\nlemma cspF_reflex_ref_SKIP[simp]: \"SKIP <=F[M1,M2] SKIP\"   \nby (simp add: refF_def semFf_def traces_iff failures_iff)\n\nlemma cspF_reflex_ref_DIV[simp]: \"DIV <=F[M1,M2] DIV\"   \nby (simp add: refF_def semFf_def traces_iff failures_iff)\n\nlemmas cspF_reflex_ref = cspF_reflex_ref_P\n                         cspF_reflex_ref_STOP\n                         cspF_reflex_ref_SKIP\n                         cspF_reflex_ref_DIV\n\nlemmas cspF_reflex = cspF_reflex_eq cspF_reflex_ref\n\n(*** symmetry ***)\n\nlemma cspF_sym: \"P1 =F[M1,M2] P2 ==> P2 =F[M2,M1] P1\"\nby (simp add: eqF_def)\n\nlemma cspF_symE:\n  \"[| P1 =F[M1,M2] P2 ; P2 =F[M2,M1] P1 ==> Z |] ==> Z\"\nby (simp add: eqF_def)\n\n(*** transitivity ***)\n\nlemma cspF_trans_left_eq: \n  \"[| P1 =F[M1,M2] P2 ; P2 =F[M2,M3] P3 |] ==> P1 =F[M1,M3] P3\"\nby (simp add: eqF_def)\n\nlemma cspF_trans_left_ref: \n  \"[| P1 <=F[M1,M2] P2 ; P2 <=F[M2,M3] P3 |] ==> P1 <=F[M1,M3] P3\"\nby (simp add: refF_def)\n\nlemmas cspF_trans_left = cspF_trans_left_eq cspF_trans_left_ref\nlemmas cspF_trans = cspF_trans_left\n\nlemma cspF_trans_right_eq: \n  \"[| P2 =F[M2,M3] P3 ; P1 =F[M1,M2] P2 |] ==> P1 =F[M1,M3] P3\"\nby (simp add: eqF_def)\n\nlemma cspF_trans_right_ref: \n  \"[| P2 <=F[M2,M3] P3 ;  P1 <=F[M1,M2] P2 |] ==> P1 <=F[M1,M3] P3\"\nby (simp add: refF_def)\n\nlemmas cspF_trans_rught = cspF_trans_right_eq cspF_trans_right_ref\n\n(*** rewrite (eq) ***)\n\nlemma cspF_rw_left_eq_MF:\n  \"[| P1 =F P2 ; P2 =F P3 |] ==> P1 =F P3\"\nby (simp add: eqF_def)\n\nlemma cspF_rw_left_eq:\n  \"[| P1 =F[M1,M1] P2 ; P2 =F[M1,M3] P3 |] ==> P1 =F[M1,M3] P3\"\nby (simp add: eqF_def)\n\nlemma cspF_rw_left_ref_MF:\n  \"[| P1 =F P2 ; P2 <=F P3 |] ==> P1 <=F P3\"\nby (simp add: refF_def eqF_def)\n\nlemma cspF_rw_left_ref:\n  \"[| P1 =F[M1,M1] P2 ; P2 <=F[M1,M3] P3 |] ==> P1 <=F[M1,M3] P3\"\nby (simp add: refF_def eqF_def)\n\nlemmas cspF_rw_left = \n   cspF_rw_left_eq_MF cspF_rw_left_ref_MF\n   cspF_rw_left_eq cspF_rw_left_ref\n\nlemma cspF_rw_right_eq:\n  \"[| P3 =F[M3,M3] P2 ; P1 =F[M1,M3] P2 |] ==> P1 =F[M1,M3] P3\"\nby (simp add: eqF_def)\n\nlemma cspF_rw_right_eq_MF:\n  \"[| P3 =F P2 ; P1 =F P2 |] ==> P1 =F P3\"\nby (simp add: eqF_def)\n\nlemma cspF_rw_right_ref:\n  \"[| P3 =F[M3,M3] P2 ; P1 <=F[M1,M3] P2 |] ==> P1 <=F[M1,M3] P3\"\nby (simp add: refF_def eqF_def)\n\nlemma cspF_rw_right_ref_MF:\n  \"[| P3 =F P2 ; P1 <=F P2 |] ==> P1 <=F P3\"\nby (simp add: refF_def eqF_def)\n\nlemmas cspF_rw_right =\n   cspF_rw_right_eq_MF cspF_rw_right_ref_MF\n   cspF_rw_right_eq cspF_rw_right_ref\n\n(*** rewrite (ref) ***)\n\nlemma cspF_tr_left_eq:\n   \"[| P1 =F[M1,M1] P2 ; P2 =F[M1,M3] P3 |] ==> P1 =F[M1,M3] P3\"\nby (simp add: eqF_def)\n\nlemma cspF_tr_left_ref:\n   \"[| P1 <=F[M1,M1] P2 ; P2 <=F[M1,M3] P3 |] ==> P1 <=F[M1,M3] P3\"\nby (simp add: refF_def eqF_def)\n\nlemmas cspF_tr_left = cspF_tr_left_eq cspF_tr_left_ref\n\nlemma cspF_tr_right_eq:\n   \"[| P2 =F[M3,M3] P3 ; P1 =F[M1,M3] P2 |] ==> P1 =F[M1,M3] P3\"\nby (simp add: eqF_def)\n\nlemma cspF_tr_right_ref:\n  \"[| P2 <=F[M3,M3] P3 ; P1 <=F[M1,M3] P2 |] ==> P1 <=F[M1,M3] P3\"\nby (simp add: refF_def eqF_def)\n\nlemmas cspF_tr_right = cspF_tr_right_eq cspF_tr_right_ref\n\n\n(*----------------------------------------*\n |   rewriting processes in assumptions   |\n *----------------------------------------*)\n\n(*** rewrite (eq) ***)\n\nlemma cspF_rw_left_eqE_MF:\n  \"[| P1 =F P3 ; P1 =F P2 ; [| P2 =F P3 |] ==> R |] ==> R\"\napply (subgoal_tac \"P2 =F P3\")\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_sym)\napply (simp)\napply (simp)\ndone\n\nlemma cspF_rw_left_eqE:\n  \"[| P1 =F[M1,M3] P3 ; P1 =F[M1,M1] P2 ; \n      [| P2 =F[M1,M3] P3 |] ==> R |] ==> R\"\napply (subgoal_tac \"P2 =F[M1,M3] P3\")\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_sym)\napply (simp)\napply (simp)\ndone\n\nlemma cspF_rw_left_refE_MF:\n  \"[| P1 <=F P3 ; P1 =F P2 ; [| P2 <=F P3 |] ==> R |] ==> R\"\napply (subgoal_tac \"P2 <=F P3\")\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_sym)\napply (simp)\napply (simp)\ndone\n\nlemma cspF_rw_left_refE:\n  \"[| P1 <=F[M1,M3] P3 ; P1 =F[M1,M1] P2 ; \n      [| P2 <=F[M1,M3] P3 |] ==> R |] ==> R\"\napply (subgoal_tac \"P2 <=F[M1,M3] P3\")\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_sym)\napply (simp)\napply (simp)\ndone\n\nlemmas cspF_rw_leftE = \n   cspF_rw_left_eqE_MF cspF_rw_left_refE_MF\n   cspF_rw_left_eqE    cspF_rw_left_refE\n\n(* right *)\n\nlemma cspF_rw_right_eqE_MF:\n  \"[| P1 =F P3 ; P3 =F P2 ; [| P1 =F P2 |] ==> R |] ==> R\"\napply (subgoal_tac \"P1 =F P2\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_sym)\napply (simp)\napply (simp)\ndone\n\nlemma cspF_rw_right_eqE:\n  \"[| P1 =F[M1,M3] P3 ; P3 =F[M3,M3] P2 ;\n      [| P1 =F[M1,M3] P2 |] ==> R |] ==> R\"\napply (subgoal_tac \"P1 =F[M1,M3] P2\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_sym)\napply (simp)\napply (simp)\ndone\n\nlemma cspF_rw_right_refE_MF:\n  \"[| P1 <=F P3 ; P3 =F P2 ; [| P1 <=F P2 |] ==> R |] ==> R\"\napply (subgoal_tac \"P1 <=F P2\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_sym)\napply (simp)\napply (simp)\ndone\n\nlemma cspF_rw_right_refE:\n  \"[| P1 <=F[M1,M3] P3 ; P3 =F[M3,M3] P2 ;\n      [| P1 <=F[M1,M3] P2 |] ==> R |] ==> R\"\napply (subgoal_tac \"P1 <=F[M1,M3] P2\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_sym)\napply (simp)\napply (simp)\ndone\n\nlemmas cspF_rw_rightE = \n   cspF_rw_right_eqE_MF cspF_rw_right_refE_MF\n   cspF_rw_right_eqE    cspF_rw_right_refE\n\n\n(*-----------------------------------------*\n |                   noPN                  |\n *-----------------------------------------*)\n\nlemma failures_noPN_Constant_lm_EC: \n  \"[| ALL P:range Pf. (EX F. failures P = (%M. F)) |]\n       ==> (EX F2. failures (? :X -> Pf) = (%M. F2))\"\napply (auto simp add: failures_iff)\napply (simp add: choice_ALL_EX)\napply (erule exE)\napply (auto)\ndone\n\nlemma failures_noPN_Constant_lm_RIC: \n  \"[| ALL P:range Pf. (EX F. failures P = (%M. F)) |]\n       ==> (EX F2. failures (!! :X .. Pf) = (%M. F2))\"\napply (auto simp add: failures_iff)\napply (simp add: choice_ALL_EX)\napply (erule exE)\napply (auto)\ndone\n\nlemma failures_noPN_Constant_lm:\n  \"noPN P --> (EX F. failures P = (%M. F))\"\napply (induct_tac P)\napply (simp add: failures_iff, force)\napply (simp add: failures_iff, force)\napply (simp add: failures_iff, force)\napply (simp add: failures_iff, force)\n\n(* Ext_pre_choice *)\n apply (intro impI)\n apply (simp add: failures_noPN_Constant_lm_EC)\n\n(* Ext_choice *)\n apply (intro impI)\n apply (simp add: failures_iff)\n apply (elim exE)\n apply (simp add: failures_iff)\n apply (subgoal_tac \"ALL P. noPN P --> (EX T. traces P = (%M. T))\")\n apply (frule_tac x=\"x1\" in spec)\n apply (drule_tac x=\"x2\" in spec)\n apply (simp)\n apply (elim exE)\n apply (simp)\n apply (force)\n apply (simp add: traces_noPN_Constant)\n\napply (simp add: failures_iff, force)\n\n(* Rep_int_choice_nat *)\n apply (intro impI)\n apply (simp add: failures_noPN_Constant_lm_RIC)\n\n(* IF *)\n apply (simp add: failures_iff)\n apply (case_tac \"x1\")\n apply (simp)\n apply (simp)\n\napply (simp add: failures_iff, force)\napply (simp add: failures_iff, force)\napply (simp add: failures_iff, force)\n\n(* Seq_comp *)\n apply (intro impI)\n apply (simp)\n apply (elim exE)\n apply (simp add: failures_iff)\n apply (subgoal_tac \"ALL P. noPN P --> (EX T. traces P = (%M. T))\")\n apply (drule_tac x=\"x1\" in spec)\n apply (simp)\n apply (elim exE)\n apply (simp)\n apply (force)\n apply (simp add: traces_noPN_Constant)\n\napply (simp add: failures_iff, force)\napply (simp add: failures_iff)\ndone\n\nlemma failures_noPN_Constant:\n  \"noPN P ==> (EX F. failures P = (%M. F))\"\napply (simp add: failures_noPN_Constant_lm)\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3364734692568112}}
{"text": "(*  Title:       CoreC++\n\n    Author:      Daniel Wasserrab\n    Maintainer:  Daniel Wasserrab <wasserra at fmi.uni-passau.de>\n\n    Based on the Jinja theory Common/TypeRel.thy by Tobias Nipkow\n*)\n\nsection \\<open>The subclass relation\\<close>\n\ntheory ClassRel imports Decl begin\n\n\n\\<comment> \\<open>direct repeated subclass\\<close>\ninductive_set\n  subclsR :: \"prog \\<Rightarrow> (cname \\<times> cname) set\"\n  and subclsR' :: \"prog \\<Rightarrow> [cname, cname] \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<prec>\\<^sub>R _\" [71,71,71] 70)\n  for P :: prog\nwhere\n  \"P \\<turnstile> C \\<prec>\\<^sub>R D \\<equiv> (C,D) \\<in> subclsR P\"\n| subclsRI: \"\\<lbrakk>class P C = Some (Bs,rest); Repeats(D) \\<in> set Bs\\<rbrakk> \\<Longrightarrow> P \\<turnstile> C \\<prec>\\<^sub>R D\"\n\n\\<comment> \\<open>direct shared subclass\\<close>\ninductive_set\n  subclsS :: \"prog \\<Rightarrow> (cname \\<times> cname) set\"\n  and subclsS' :: \"prog \\<Rightarrow> [cname, cname] \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<prec>\\<^sub>S _\" [71,71,71] 70)\n  for P :: prog\nwhere\n  \"P \\<turnstile> C \\<prec>\\<^sub>S D \\<equiv> (C,D) \\<in> subclsS P\"\n| subclsSI: \"\\<lbrakk>class P C = Some (Bs,rest); Shares(D) \\<in> set Bs\\<rbrakk> \\<Longrightarrow> P \\<turnstile> C \\<prec>\\<^sub>S D\"\n\n \\<comment> \\<open>direct subclass\\<close>\ninductive_set\n  subcls1 :: \"prog \\<Rightarrow> (cname \\<times> cname) set\"\n  and subcls1' :: \"prog \\<Rightarrow> [cname, cname] \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<prec>\\<^sup>1 _\" [71,71,71] 70)\n  for P :: prog\nwhere\n  \"P \\<turnstile> C \\<prec>\\<^sup>1 D \\<equiv> (C,D) \\<in> subcls1 P\"\n| subcls1I: \"\\<lbrakk>class P C = Some (Bs,rest); D \\<in>  baseClasses Bs\\<rbrakk> \\<Longrightarrow> P \\<turnstile> C \\<prec>\\<^sup>1 D\"\n\nabbreviation\n  subcls    :: \"prog \\<Rightarrow> [cname, cname] \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<preceq>\\<^sup>* _\"  [71,71,71] 70) where\n  \"P \\<turnstile> C \\<preceq>\\<^sup>* D \\<equiv> (C,D) \\<in> (subcls1 P)\\<^sup>*\"\n \n\nlemma subclsRD:\n  \"P \\<turnstile> C \\<prec>\\<^sub>R D \\<Longrightarrow> \\<exists>fs ms Bs. (class P C = Some (Bs,fs,ms)) \\<and> (Repeats(D) \\<in> set Bs)\"\nby(auto elim: subclsR.cases)\n\nlemma subclsSD:\n  \"P \\<turnstile> C \\<prec>\\<^sub>S D \\<Longrightarrow> \\<exists>fs ms Bs. (class P C = Some (Bs,fs,ms)) \\<and> (Shares(D) \\<in> set Bs)\"\nby(auto elim: subclsS.cases)\n\nlemma subcls1D:\n  \"P \\<turnstile> C \\<prec>\\<^sup>1 D \\<Longrightarrow> \\<exists>fs ms Bs. (class P C = Some (Bs,fs,ms)) \\<and> (D \\<in> baseClasses Bs)\"\nby(auto elim: subcls1.cases)\n\n\nlemma subclsR_subcls1:\n  \"P \\<turnstile> C \\<prec>\\<^sub>R D \\<Longrightarrow> P \\<turnstile> C \\<prec>\\<^sup>1 D\"\nby (auto elim!:subclsR.cases intro:subcls1I simp:RepBaseclass_isBaseclass)\n\nlemma subclsS_subcls1:\n  \"P \\<turnstile> C \\<prec>\\<^sub>S D \\<Longrightarrow> P \\<turnstile> C \\<prec>\\<^sup>1 D\"\nby (auto elim!:subclsS.cases intro:subcls1I simp:ShBaseclass_isBaseclass)\n\nlemma subcls1_subclsR_or_subclsS:\n  \"P \\<turnstile> C \\<prec>\\<^sup>1 D \\<Longrightarrow> P \\<turnstile> C \\<prec>\\<^sub>R D \\<or> P \\<turnstile> C \\<prec>\\<^sub>S D\"\nby (auto dest!:subcls1D intro:subclsRI \n  dest:baseClasses_repeats_or_shares subclsSI)\n\nlemma finite_subcls1: \"finite (subcls1 P)\"\n\napply(subgoal_tac \"subcls1 P = (SIGMA C: {C. is_class P C} . \n                     {D. D \\<in> baseClasses (fst(the(class P C)))})\")\n prefer 2\n apply(fastforce simp:is_class_def dest: subcls1D elim: subcls1I)\napply simp\napply(rule finite_SigmaI [OF finite_is_class])\napply(rule_tac B = \"baseClasses (fst (the (class P C)))\" in finite_subset)\napply (auto intro:finite_baseClasses simp:is_class_def)\ndone\n\n\nlemma finite_subclsR: \"finite (subclsR P)\"\nby(rule_tac B = \"subcls1 P\" in finite_subset, \n  auto simp:subclsR_subcls1 finite_subcls1)\n\nlemma finite_subclsS: \"finite (subclsS P)\"\nby(rule_tac B = \"subcls1 P\" in finite_subset, \n  auto simp:subclsS_subcls1 finite_subcls1)\n\nlemma subcls1_class:\n  \"P \\<turnstile> C \\<prec>\\<^sup>1 D \\<Longrightarrow> is_class P C\"\nby (auto dest:subcls1D simp:is_class_def)\n\nlemma subcls_is_class:\n\"\\<lbrakk>P \\<turnstile> D \\<preceq>\\<^sup>* C; is_class P C\\<rbrakk> \\<Longrightarrow> is_class P D\"\nby (induct rule:rtrancl_induct,auto dest:subcls1_class)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/CoreC++/ClassRel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102498375401, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3364734619047141}}
{"text": "(*  Title:      HOL/Auth/n_mutualExFsm_lemma_inv__1_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExFsm Protocol Case Study*} \n\ntheory n_mutualExFsm_lemma_inv__1_on_rules imports n_mutualExFsm_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0 p__Inv1. p__Inv0\\<le>N\\<and>p__Inv1\\<le>N\\<and>p__Inv0~=p__Inv1\\<and>f=inv__1  p__Inv0 p__Inv1)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_fsm  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_fsm  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_fsmVsinv__1) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExFsm/n_mutualExFsm_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850402140659, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.33636278819118204}}
{"text": "theory flash84Bra  imports flash84Rev\n \n  begin\nlemma onInv84:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv84 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv84 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv84 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash84Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7549149868676284, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.33633692309353963}}
{"text": "theory flash52Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_InvVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_InvAck_1VsInv52:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_InvAck_1_HomeVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_InvAck_2VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Local_GetX_GetXVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv3) )  ( Const UNI_Get ))     (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv1)) )  )    ( eqn ( IVar ( Para ''UniMsg_proc'' iInv3) )   (Const iInv1))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv52:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv52:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_GetVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv3) )  ( Const UNI_GetX ))     (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv1)) )  )    ( eqn ( IVar ( Para ''UniMsg_proc'' iInv3) )   (Const iInv1))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))     (neg ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2)) )  )    ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) )   (Const iInv2))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak1VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put1VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put2VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put3VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_PutVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Local_PutXAcksDoneVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_NakVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Nak_ClearVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Nak_HomeVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_GetX_NakVsInv52:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_GetX_PutXVsInv52:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_Get_Nak1VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_Get_Nak2VsInv52:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_Get_Put2VsInv52:  \n    (*newRule2VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv3 \\<le> N\" and  a6:\"iInv1~=iInv2  \" and  a7:\"iInv1~=iInv3  \" and  a8:\"iInv2~=iInv3  \" and  a9:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>iRule2=iInv3)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1=iInv3\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv3\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))   \\<or>(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv3)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 \\<and>iRule2~=iInv3 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 )\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  a8  a9  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutXVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_ReplaceVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ReplaceHomeVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ReplaceHomeShrVldVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ReplaceShrVldVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ShWbVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_WbVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_GetX1VsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_GetX2VsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX1VsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX2VsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX3VsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX4VsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_Get_GetVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_Get_PutVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_PutXVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_ReplaceVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Remote_GetVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_GetXVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>(iRule1=iInv3)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  a7  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv3)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 \\<and>iRule1~=iInv3 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  a7  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_PutXVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Remote_ReplaceVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma StoreVsInv52:  \n    (*Rule1VsPInv3*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv3 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iInv1~=iInv3  \" and  a7:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma StoreHomeVsInv52:  \n    (*Rule0VsPInv3*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" \n\n  shows  \"invHoldForRule' s (inv52  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     \n     by (cut_tac a1 a2 a3 a4 a5, auto  ) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash52Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.33629200514842983}}
{"text": "(* trans_sim.thy *)\n(* William Mansky *)\n(* The basics of simulation relations on tCFGs. *)\n\ntheory trans_sim\nimports trans_semantics \"$AFP/JinjaThreads/Framework/Bisimulation\"\nbegin\n\nlemmas zero_enat_def [simp del] option.splits [split del]\n\ndefinition trsys_of_tCFG where \n\"trsys_of_tCFG       CFGs     step_rel      obs       get_mem C l C' \\<equiv> \nstep_rel CFGs C C' \\<and> l = get_mem C' |` obs\" \n(* This needs to reflect the actual changes made! *)\n\nabbreviation \"trsys_of_tCFG_full CFGs step_rel \\<equiv> trsys_of_tCFG CFGs step_rel UNIV\"\nlemma dom_UNIV [simp]: \"dom l = UNIV \\<Longrightarrow> m ++ l = l\"\nby (rule ext, case_tac \"l x\", auto)\n\n(* One-directional simulation, modified from the bisimulation theory of JinjaThreads *)\nlocale simulation = bisimulation_base +\n  constrains trsys1 :: \"('s1, 'tl1) trsys\"\n  and trsys2 :: \"('s2, 'tl2) trsys\"\n  and bisim :: \"('s1, 's2) bisim\"\n  and tlsim :: \"('tl1, 'tl2) bisim\"\nassumes simulation: \"\\<lbrakk>sa \\<approx> sb; sa -1-tl1\\<rightarrow> sa'\\<rbrakk> \\<Longrightarrow> \\<exists>sb' tl2. sb -2-tl2\\<rightarrow> sb' \\<and> sa' \\<approx> sb' \\<and> tl1 \\<sim> tl2\"\nbegin\n\nlemma simulation_rtrancl:\n  \"[|s1 -1-tls1\\<rightarrow>* s1'; s1 \\<approx> s2|]\n  ==> \\<exists>s2' tls2. s2 -2-tls2\\<rightarrow>* s2' \\<and> s1' \\<approx> s2' \\<and> tls1 [\\<sim>] tls2\"\nproof(induct rule: rtrancl3p.induct)\n  case rtrancl3p_refl thus ?case by(auto intro: rtrancl3p.rtrancl3p_refl)\nnext\n  case (rtrancl3p_step s1 tls1 s1' tl1 s1'')\n  from `s1 \\<approx> s2 ==> \\<exists>s2' tls2. s2 -2-tls2\\<rightarrow>* s2' \\<and> s1' \\<approx> s2' \\<and> tls1 [\\<sim>] tls2` `s1 \\<approx> s2`\n  obtain s2' tls2 where \"s2 -2-tls2\\<rightarrow>* s2'\" \"s1' \\<approx> s2'\" \"tls1 [\\<sim>] tls2\" by blast\n  moreover from `s1' -1-tl1\\<rightarrow> s1''` `s1' \\<approx> s2'`\n  obtain s2'' tl2 where \"s2' -2-tl2\\<rightarrow> s2''\" \"s1'' \\<approx> s2''\" \"tl1 \\<sim> tl2\" by(auto dest: simulation)\n  ultimately have \"s2 -2-tls2 @ [tl2]\\<rightarrow>* s2''\" \"tls1 @ [tl1] [\\<sim>] tls2 @ [tl2]\"\n    by(auto intro: rtrancl3p.rtrancl3p_step list_all2_appendI)\n  with `s1'' \\<approx> s2''` show ?case by(blast)\nqed\n\ndefinition tl1_to_tl2 where\n\"tl1_to_tl2 = (\\<lambda>(s2 :: 's2) (stls1 :: ('s1 \\<times> 'tl1 \\<times> 's1) llist). unfold_llist\n     (\\<lambda>(s2, stls1). lnull stls1)\n     (\\<lambda>(s2, stls1). let (s1, tl1, s1') = lhd stls1;\n                        (tl2, s2') = SOME (tl2, s2'). trsys2 s2 tl2 s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2\n                    in (s2, tl2, s2'))\n     (\\<lambda>(s2, stls1). let (s1, tl1, s1') = lhd stls1;\n                        (tl2, s2') = SOME (tl2, s2'). trsys2 s2 tl2 s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2\n                    in (s2', ltl stls1))\n     (s2, stls1))\"\n\nlemma simulation_inf_step:\n  assumes red1: \"s1 -1-tls1\\<rightarrow>* \\<infinity>\" and bisim: \"s1 \\<approx> s2\"\n  shows \"\\<exists>tls2. s2 -2-tls2\\<rightarrow>* \\<infinity> \\<and> tls1 [[\\<sim>]] tls2\"\nproof -\n  from r1.inf_step_imp_inf_step_table[OF red1]\n  obtain stls1 where red1': \"s1 -1-stls1\\<rightarrow>*t \\<infinity>\" \n    and tls1: \"tls1 = lmap (fst \\<circ> snd) stls1\" by blast\n  have tl1_to_tl2_simps [simp]:\n    \"\\<And>s2 stls1. lnull (tl1_to_tl2 s2 stls1) \\<longleftrightarrow> lnull stls1\"\n    \"\\<And>s2 stls1. \\<not> lnull stls1 \\<Longrightarrow> lhd (tl1_to_tl2 s2 stls1) =\n    (let (s1, tl1, s1') = lhd stls1;\n         (tl2, s2') = SOME (tl2, s2'). trsys2 s2 tl2 s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2\n     in (s2, tl2, s2'))\"\n    \"\\<And>s2 stls1. \\<not> lnull stls1 \\<Longrightarrow> ltl (tl1_to_tl2 s2 stls1) =\n    (let (s1, tl1, s1') = lhd stls1;\n         (tl2, s2') = SOME (tl2, s2'). trsys2 s2 tl2 s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2\n     in tl1_to_tl2 s2' (ltl stls1))\"\n    \"\\<And>s2. tl1_to_tl2 s2 LNil = LNil\"\n    \"\\<And>s2 s1 tl1 s1' stls1'. tl1_to_tl2 s2 (LCons (s1, tl1, s1') stls1') =\n        LCons (s2, SOME (tl2, s2'). trsys2 s2 tl2 s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2) \n              (tl1_to_tl2 (snd (SOME (tl2, s2'). trsys2 s2 tl2 s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2)) stls1')\"\n    by(simp_all add: tl1_to_tl2_def split_beta)\n\n  have [simp]: \"llength (tl1_to_tl2 s2 stls1) = llength stls1\"\n    by(coinduction arbitrary: s2 stls1 rule: enat_coinduct)(auto simp add: epred_llength split_beta)\n\n  from red1' bisim have \"s2 -2-tl1_to_tl2 s2 stls1\\<rightarrow>*t \\<infinity>\"\n  proof(coinduction arbitrary: s2 s1 stls1)\n    case (inf_step_table s2 s1 stls1)\n    note red1' = `s1 -1-stls1\\<rightarrow>*t \\<infinity>` and bisim = `s1 \\<approx> s2`\n    from red1' show ?case\n    proof(cases)\n      case (inf_step_tableI s1' stls1' tl1)\n      hence stls1: \"stls1 = LCons (s1, tl1, s1') stls1'\"\n        and r: \"s1 -1-tl1\\<rightarrow> s1'\" and reds1: \"s1' -1-stls1'\\<rightarrow>*t \\<infinity>\" by simp_all\n      let ?tl2s2' = \"SOME (tl2, s2'). s2 -2-tl2\\<rightarrow> s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2\"\n      let ?tl2 = \"fst ?tl2s2'\" let ?s2' = \"snd ?tl2s2'\"\n      from simulation[OF bisim r] obtain s2' tl2\n        where \"s2 -2-tl2\\<rightarrow> s2'\" \"s1' \\<approx> s2'\" \"tl1 \\<sim> tl2\" by blast\n      hence \"(\\<lambda>(tl2, s2'). s2 -2-tl2\\<rightarrow> s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2) (tl2, s2')\" by simp\n      hence \"(\\<lambda>(tl2, s2'). s2 -2-tl2\\<rightarrow> s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2) ?tl2s2'\" by(rule someI)\n      hence \"s2 -2-?tl2\\<rightarrow> ?s2'\" \"s1' \\<approx> ?s2'\" \"tl1 \\<sim> ?tl2\" by(simp_all add: split_beta)\n      then show ?thesis using reds1 stls1 by(fastforce intro: prod_eqI)\n    qed\n  qed\n  hence \"s2 -2-lmap (fst \\<circ> snd) (tl1_to_tl2 s2 stls1)\\<rightarrow>* \\<infinity>\"\n    by(rule r2.inf_step_table_imp_inf_step)\n  moreover have \"tls1 [[\\<sim>]] lmap (fst \\<circ> snd) (tl1_to_tl2 s2 stls1)\"\n  proof(rule llist_all2_all_lnthI)\n    show \"llength tls1 = llength (lmap (fst \\<circ> snd) (tl1_to_tl2 s2 stls1))\"\n      using tls1 by simp\n  next\n    fix n\n    assume \"enat n < llength tls1\"\n    thus \"lnth tls1 n \\<sim> lnth (lmap (fst \\<circ> snd) (tl1_to_tl2 s2 stls1)) n\"\n      using red1' bisim unfolding tls1\n    proof(induct n arbitrary: s1 s2 stls1 rule: nat_less_induct)\n      case (1 n)\n      hence IH: \"\\<And>m s1 s2 stls1. \\<lbrakk> m < n; enat m < llength (lmap (fst \\<circ> snd) stls1);\n                                   s1 -1-stls1\\<rightarrow>*t \\<infinity>; s1 \\<approx> s2 \\<rbrakk>\n                 \\<Longrightarrow> lnth (lmap (fst \\<circ> snd) stls1) m \\<sim> lnth (lmap (fst \\<circ> snd) (tl1_to_tl2 s2 stls1)) m\"\n        by blast\n      from `s1 -1-stls1\\<rightarrow>*t \\<infinity>` show ?case\n      proof cases\n        case (inf_step_tableI s1' stls1' tl1)\n        hence  stls1: \"stls1 = LCons (s1, tl1, s1') stls1'\"\n          and r: \"s1 -1-tl1\\<rightarrow> s1'\" and reds: \"s1' -1-stls1'\\<rightarrow>*t \\<infinity>\" by simp_all\n        let ?tl2s2' = \"SOME (tl2, s2').  s2 -2-tl2\\<rightarrow> s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2\"\n        let ?tl2 = \"fst ?tl2s2'\" let ?s2' = \"snd ?tl2s2'\"\n        from simulation[OF `s1 \\<approx> s2` r] obtain s2' tl2\n          where \"s2 -2-tl2\\<rightarrow> s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2\" by blast\n        hence \"(\\<lambda>(tl2, s2'). s2 -2-tl2\\<rightarrow> s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2) (tl2, s2')\" by simp\n        hence \"(\\<lambda>(tl2, s2'). s2 -2-tl2\\<rightarrow> s2' \\<and> s1' \\<approx> s2' \\<and> tl1 \\<sim> tl2) ?tl2s2'\" by(rule someI)\n        hence bisim': \"s1' \\<approx> ?s2'\" and tlsim: \"tl1 \\<sim> ?tl2\" by(simp_all add: split_beta)\n        show ?thesis\n        proof(cases n)\n          case 0\n          with stls1 tlsim show ?thesis by simp\n        next\n          case (Suc m)\n          hence \"m < n\" by simp\n          moreover have \"enat m < llength (lmap (fst \\<circ> snd) stls1')\"\n            using stls1 `enat n < llength (lmap (fst \\<circ> snd) stls1)` Suc by(simp add: Suc_ile_eq)\n          ultimately have \"lnth (lmap (fst \\<circ> snd) stls1') m \\<sim> lnth (lmap (fst \\<circ> snd) (tl1_to_tl2 ?s2' stls1')) m\"\n            using reds bisim' by(rule IH)\n          with Suc stls1 show ?thesis by(simp del: o_apply)\n        qed\n      qed\n    qed\n  qed\n  ultimately show ?thesis by blast\nqed\n\nend\n\nsublocale bisimulation \\<subseteq> simulation\nby (unfold_locales, simp add: simulation1)\n\nlocale tCFG_bisim = bisimulation where trsys1 = \"trsys_of_tCFG CFGs step_rel obs get_mem\"\n and trsys2 = \"trsys_of_tCFG CFGs' step_rel obs get_mem\" for CFGs CFGs' step_rel obs get_mem\n\nlocale tCFG_sim = simulation where\n trsys1 = \"trsys_of_tCFG CFGs step_rel obs get_mem\" and \n trsys2 = \"trsys_of_tCFG CFGs' step_rel obs get_mem\"\n for CFGs CFGs' step_rel obs get_mem\n\ndefinition (in TRANS_basics) \"opt_sim T sim tlsim step_rel obs get_mem \\<equiv> \n  \\<forall>\\<tau> CFGs. tCFG CFGs instr_edges Seq \\<longrightarrow> (\\<forall>CFGs' \\<in> trans_sf T \\<tau> CFGs. tCFG CFGs' instr_edges Seq \\<and>\n    tCFG_sim sim tlsim CFGs' CFGs step_rel obs get_mem)\"\n\n(* composition *)\nlemma sim_comp: \"\\<lbrakk>tCFG_sim sim tlsim CFGs CFGs' step_rel obs get_mem; \n  tCFG_sim sim' tlsim' CFGs' CFGs'' step_rel obs get_mem\\<rbrakk> \\<Longrightarrow>\ntCFG_sim (sim \\<circ>\\<^sub>B sim') (tlsim \\<circ>\\<^sub>B tlsim') CFGs CFGs'' step_rel obs get_mem\"\napply (clarsimp simp add: tCFG_sim_def simulation_def bisim_compose_def trsys_of_tCFG_def)\nby (metis (hide_lams, mono_tags))\n\ncontext TRANS_basics begin\n\nlemma then_sim [intro]: \"\\<lbrakk>opt_sim T1 sim1 tlsim1 step_rel obs get_mem; opt_sim T2 sim2 tlsim2 step_rel obs get_mem\\<rbrakk> \\<Longrightarrow>\n  opt_sim (TThen T1 T2) (sim2 \\<circ>\\<^sub>B sim1) (tlsim2 \\<circ>\\<^sub>B tlsim1) step_rel obs get_mem\"\nunfolding opt_sim_def\napply clarify\napply (erule_tac x=\\<tau> in allE, erule_tac x=CFGs in allE, erule impE, simp, clarsimp)\napply (erule_tac x=CFGs'a in ballE, simp_all)\napply (erule_tac x=\\<tau> in allE, erule_tac x=CFGs'a in allE, erule impE, simp, \n  erule_tac x=CFGs' in ballE, simp_all, clarsimp)\napply (rule sim_comp, simp_all)\ndone\n\nlemma applysome_sim: \"\\<lbrakk>opt_sim T sim tlsim step_rel obs get_mem; apply_some (trans_sf T) \\<tau> CFGs CFGs';\n  tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n  tCFG CFGs' instr_edges Seq \\<and> (\\<exists>sim' tlsim'. tCFG_sim sim' tlsim' CFGs' CFGs step_rel obs get_mem)\"\napply (clarsimp simp add: opt_sim_def, drule_tac P=\"\\<lambda>t \\<tau> G G'. t = trans_sf T \\<and> tCFG G instr_edges Seq \\<longrightarrow> \n  (tCFG G' instr_edges Seq \\<and> (\\<exists>sim' tlsim'. tCFG_sim sim' tlsim' G' G step_rel obs get_mem))\" \n  in apply_some.induct, auto)\napply (rule_tac x=\"(=)\" in exI, rule_tac x=\"(=)\" in exI, unfold_locales, force)\napply (erule_tac x=\\<tau> in allE, erule_tac x=G in allE, simp, erule_tac x=G' in ballE, simp_all, clarsimp)\napply (rule exI, rule exI, rule sim_comp, simp+)\ndone\n\n(* is this sufficient? *)\ndefinition \"trans_sim T step_rel obs get_mem \\<equiv> \n  \\<forall>\\<tau> CFGs. tCFG CFGs instr_edges Seq \\<longrightarrow> (\\<forall>CFGs' \\<in> trans_sf T \\<tau> CFGs. tCFG CFGs' instr_edges Seq \\<and>\n    (\\<exists>sim tlsim. tCFG_sim sim tlsim CFGs' CFGs step_rel obs get_mem))\"\n\nlemma opt_sim_trans [intro]: \"opt_sim T sim tlsim step_rel obs get_mem \\<Longrightarrow> trans_sim T step_rel obs get_mem\"\nby (force simp add: opt_sim_def trans_sim_def)\n\ndefinition \"cond_sim P T step_rel obs get_mem \\<equiv> \\<forall>\\<tau> CFGs. P \\<tau> CFGs \\<and> tCFG CFGs instr_edges Seq \\<longrightarrow> \n  (\\<forall>CFGs' \\<in> trans_sf T \\<tau> CFGs. tCFG CFGs' instr_edges Seq \\<and> \n    (\\<exists>sim tlsim. tCFG_sim sim tlsim CFGs' CFGs step_rel obs get_mem))\"\n\nlemma cond_simI [intro]: \"(\\<And>\\<tau> CFGs CFGs'. \\<lbrakk>P \\<tau> CFGs; tCFG CFGs instr_edges Seq; CFGs' \\<in> trans_sf T \\<tau> CFGs\\<rbrakk> \\<Longrightarrow>\n  tCFG CFGs' instr_edges Seq \\<and> (\\<exists>sim tlsim. tCFG_sim sim tlsim CFGs' CFGs step_rel obs get_mem))\n  \\<Longrightarrow> cond_sim P T step_rel obs get_mem\"\nby (force simp add: cond_sim_def)\n\nlemma applyall_sim [intro]: \"opt_sim T sim tlsim step_rel obs get_mem \\<Longrightarrow> trans_sim (TApplyAll T) step_rel obs get_mem\"\napply (clarsimp simp add: trans_sim_def)\nby (metis applysome_sim)\n\nlemma match_cond_sim [intro]: \"cond_sim (\\<lambda>\\<tau> CFGs. \\<exists>\\<sigma> \\<tau>'. side_cond_sf \\<phi> \\<sigma> CFGs \\<and> part_matches \\<sigma> \\<tau>' \\<and> \n  \\<tau> = part_extend \\<tau>' (cond_fv pred_fv \\<phi>) \\<sigma>) T step_rel obs get_mem \\<Longrightarrow>\n  trans_sim (TMatch \\<phi> T) step_rel obs get_mem\"\napply (clarsimp simp add: trans_sim_def cond_sim_def)\nby metis\n\nlemma then_cond_sim [intro]: \"\\<lbrakk>cond_sim P T1 step_rel obs get_mem; cond_sim P T2 step_rel obs get_mem;\n  \\<forall>\\<tau> CFGs CFGs'. P \\<tau> CFGs \\<and> CFGs' \\<in> trans_sf T1 \\<tau> CFGs \\<longrightarrow> P \\<tau> CFGs'\\<rbrakk> \\<Longrightarrow>\n  cond_sim P (TThen T1 T2) step_rel obs get_mem\"\nunfolding cond_sim_def proof clarify\n  fix CFGs \\<tau> CFGs' assume \"CFGs' \\<in> trans_sf (TThen T1 T2) \\<tau> CFGs\"\n  hence \"\\<exists>CFGs''. CFGs'' \\<in> trans_sf T1 \\<tau> CFGs \\<and> CFGs' \\<in> trans_sf T2 \\<tau> CFGs''\" by simp\n  then obtain CFGs'' where A: \"CFGs'' \\<in> trans_sf T1 \\<tau> CFGs \\<and> CFGs' \\<in> trans_sf T2 \\<tau> CFGs''\" ..\n  assume P: \"P \\<tau> CFGs\" \"tCFG CFGs instr_edges Seq\" \"\\<forall>\\<tau> CFGs. P \\<tau> CFGs \\<and> tCFG CFGs instr_edges Seq \\<longrightarrow> \n  (\\<forall>CFGs'\\<in>trans_sf T1 \\<tau> CFGs. tCFG CFGs' instr_edges Seq \\<and> (\\<exists>sim tlsim. tCFG_sim sim tlsim CFGs' CFGs step_rel obs get_mem))\"\n  from this A have tCFG'': \"tCFG CFGs'' instr_edges Seq\" \"\\<exists>sim tlsim. tCFG_sim sim tlsim CFGs'' CFGs step_rel obs get_mem\" by auto\n  then obtain sim tlsim where sim: \"tCFG_sim sim tlsim CFGs'' CFGs step_rel obs get_mem\" by auto\n  assume \"\\<forall>\\<tau> CFGs CFGs'. P \\<tau> CFGs \\<and> CFGs' \\<in> trans_sf T1 \\<tau> CFGs \\<longrightarrow> P \\<tau> CFGs'\"\n  from this P A have P'': \"P \\<tau> CFGs''\" by metis\n  assume \"\\<forall>\\<tau> CFGs. P \\<tau> CFGs \\<and> tCFG CFGs instr_edges Seq \\<longrightarrow> (\\<forall>CFGs'\\<in>trans_sf T2 \\<tau> CFGs. tCFG CFGs' \n  instr_edges Seq \\<and> (\\<exists>sim tlsim. tCFG_sim sim tlsim CFGs' CFGs step_rel obs get_mem))\"\n  from this P'' tCFG'' A have tCFG': \"tCFG CFGs' instr_edges Seq\" \n    \"\\<exists>sim tlsim. tCFG_sim sim tlsim CFGs' CFGs'' step_rel obs get_mem\" by auto\n  then obtain sim' tlsim' where sim': \"tCFG_sim sim' tlsim' CFGs' CFGs'' step_rel obs get_mem\" by auto\n  show \"tCFG CFGs' instr_edges Seq \\<and> (\\<exists>sim tlsim. tCFG_sim sim tlsim CFGs' CFGs step_rel obs get_mem)\"\n  proof\n    from tCFG' show \"tCFG CFGs' instr_edges Seq\" by simp\n    next show \"\\<exists>sim tlsim. tCFG_sim sim tlsim CFGs' CFGs step_rel obs get_mem\"\n    proof ((rule exI)+, rule sim_comp)\n      from sim show \"tCFG_sim sim tlsim CFGs'' CFGs step_rel obs get_mem\" .\n      from sim' show \"tCFG_sim sim' tlsim' CFGs' CFGs'' step_rel obs get_mem\" .\n    qed\n  qed\nqed\n\n(* Why is this so slow in apply-style? *)\n\nlemma applysome_cond_sim: \"\\<lbrakk>apply_some (trans_sf T) \\<tau> CFGs CFGs'; cond_sim P T step_rel obs get_mem;\n  \\<forall>\\<tau> CFGs CFGs'. (P \\<tau> CFGs \\<and> CFGs' \\<in> trans_sf T \\<tau> CFGs) \\<longrightarrow> P \\<tau> CFGs'; P \\<tau> CFGs; tCFG CFGs instr_edges Seq\\<rbrakk> \\<Longrightarrow> \n  tCFG CFGs' instr_edges Seq \\<and> (\\<exists>sim' tlsim'. tCFG_sim sim' tlsim' CFGs' CFGs step_rel obs get_mem)\"\nunfolding cond_sim_def proof (induct rule: apply_some.induct)\n  fix G::\"'thread \\<Rightarrow> ('node, 'edge_type, 'instr) flowgraph option\" assume \"tCFG G instr_edges Seq\"\n  thus \"tCFG G instr_edges Seq \\<and> (\\<exists>sim' tlsim'. tCFG_sim sim' tlsim' G G step_rel obs get_mem)\"\n  proof\n    have \"tCFG_sim (=) (=) G G step_rel obs get_mem\" by (unfold_locales, simp)\n    thus \"\\<exists>sim' tlsim'. tCFG_sim sim' tlsim' G G step_rel obs get_mem\" by force\n  qed\nnext\n  case (apply_more G' T \\<tau> G G'') hence G'': \"tCFG G'' instr_edges Seq \\<and> \n  (\\<exists>sim' tlsim'. tCFG_sim sim' tlsim' G'' G' step_rel obs get_mem)\" by metis\n  then obtain sim' tlsim' where sim': \"tCFG_sim sim' tlsim' G'' G' step_rel obs get_mem\" by force\n  moreover assume \"G' \\<in> T \\<tau> G\" \"P \\<tau> G\" \"tCFG G instr_edges Seq\" \n  \"\\<forall>\\<tau> CFGs. P \\<tau> CFGs \\<and> tCFG CFGs instr_edges Seq \\<longrightarrow> (\\<forall>CFGs'\\<in>T \\<tau> CFGs. tCFG CFGs' instr_edges Seq \\<and> \n  (\\<exists>sim tlsim. tCFG_sim sim tlsim CFGs' CFGs step_rel obs get_mem))\"\n  then obtain sim tlsim where sim: \"tCFG_sim sim tlsim G' G step_rel obs get_mem\" by force\n  have \"\\<exists>sim' tlsim'. tCFG_sim sim' tlsim' G'' G step_rel obs get_mem\"\n    proof ((rule exI)+, rule sim_comp)\n      show \"tCFG_sim sim' tlsim' G'' G' step_rel obs get_mem\" by (rule sim')\n      next show \"tCFG_sim sim tlsim G' G step_rel obs get_mem\" by (rule sim)\n    qed\n  from this G'' show ?case by simp\nqed\n\nlemma applyall_cond_sim [intro]: \"\\<lbrakk>cond_sim P T step_rel obs get_mem; \n  \\<forall>\\<tau> CFGs CFGs'. P \\<tau> CFGs \\<and> CFGs' \\<in> trans_sf T \\<tau> CFGs \\<longrightarrow> P \\<tau> CFGs'\\<rbrakk> \\<Longrightarrow>\n  cond_sim P (TApplyAll T) step_rel obs get_mem\"\nby (clarsimp intro!: cond_simI simp add: applysome_cond_sim)\n\nend\n\n(* stuttering bisimulation *)\nlocale delay_bisimulation_base =\n  bisimulation_base +\n  trsys1: \\<tau>trsys trsys1 \\<tau>move1 +\n  trsys2: \\<tau>trsys trsys2 \\<tau>move2 \n  for \\<tau>move1 \\<tau>move2 +\n  constrains trsys1 :: \"('s1, 'tl1) trsys\"\n  and trsys2 :: \"('s2, 'tl2) trsys\"\n  and bisim :: \"('s1, 's2) bisim\"\n  and tlsim :: \"('tl1, 'tl2) bisim\"\n  and \\<tau>move1 :: \"('s1, 'tl1) trsys\"\n  and \\<tau>move2 :: \"('s2, 'tl2) trsys\"\nbegin\n\nnotation\n  trsys1.silent_move (\"_/ -\\<tau>1\\<rightarrow> _\" [50, 50] 60) and\n  trsys2.silent_move (\"_/ -\\<tau>2\\<rightarrow> _\" [50, 50] 60)\n\nnotation\n  trsys1.silent_moves (\"_/ -\\<tau>1\\<rightarrow>* _\" [50, 50] 60) and\n  trsys2.silent_moves (\"_/ -\\<tau>2\\<rightarrow>* _\" [50, 50] 60)\n\nnotation\n  trsys1.silent_movet (\"_/ -\\<tau>1\\<rightarrow>+ _\" [50, 50] 60) and\n  trsys2.silent_movet (\"_/ -\\<tau>2\\<rightarrow>+ _\" [50, 50] 60)\n\nnotation\n  trsys1.\\<tau>rtrancl3p (\"_ -\\<tau>1-_\\<rightarrow>* _\" [50, 0, 50] 60) and\n  trsys2.\\<tau>rtrancl3p (\"_ -\\<tau>2-_\\<rightarrow>* _\" [50, 0, 50] 60)\n\nnotation\n  trsys1.\\<tau>inf_step (\"_ -\\<tau>1-_\\<rightarrow>* \\<infinity>\" [50, 0] 80) and\n  trsys2.\\<tau>inf_step (\"_ -\\<tau>2-_\\<rightarrow>* \\<infinity>\" [50, 0] 80)\n\nnotation\n  trsys1.\\<tau>diverge (\"_ -\\<tau>1\\<rightarrow> \\<infinity>\" [50] 80) and\n  trsys2.\\<tau>diverge (\"_ -\\<tau>2\\<rightarrow> \\<infinity>\" [50] 80)\n\nnotation\n  trsys1.\\<tau>inf_step_table (\"_ -\\<tau>1-_\\<rightarrow>*t \\<infinity>\" [50, 0] 80) and\n  trsys2.\\<tau>inf_step_table (\"_ -\\<tau>2-_\\<rightarrow>*t \\<infinity>\" [50, 0] 80)\n\nnotation\n  trsys1.\\<tau>Runs (\"_ \\<Down>1 _\" [50, 50] 51) and\n  trsys2.\\<tau>Runs (\"_ \\<Down>2 _\" [50, 50] 51)\n\nlemma simulation_silent1I':\n  assumes \"\\<exists>s2'. (if \\<mu>1 s1' s1 then trsys2.silent_moves else trsys2.silent_movet) s2 s2' \\<and> s1' \\<approx> s2'\"\n  shows \"s1' \\<approx> s2 \\<and> \\<mu>1^++ s1' s1 \\<or> (\\<exists>s2'. s2 -\\<tau>2\\<rightarrow>+ s2' \\<and> s1' \\<approx> s2')\"\nproof -\n  from assms obtain s2' where red: \"(if \\<mu>1 s1' s1 then trsys2.silent_moves else trsys2.silent_movet) s2 s2'\" \n    and bisim: \"s1' \\<approx> s2'\" by blast\n  show ?thesis\n  proof(cases \"\\<mu>1 s1' s1\")\n    case True\n    with red have \"s2 -\\<tau>2\\<rightarrow>* s2'\" by simp\n    thus ?thesis using bisim True by cases(blast intro: rtranclp_into_tranclp1)+\n  next\n    case False\n    with red bisim show ?thesis by auto\n  qed\nqed\n\nlemma simulation_silent2I':\n  assumes \"\\<exists>s1'. (if \\<mu>2 s2' s2 then trsys1.silent_moves else trsys1.silent_movet) s1 s1' \\<and> s1' \\<approx> s2'\"\n  shows \"s1 \\<approx> s2' \\<and> \\<mu>2^++ s2' s2 \\<or> (\\<exists>s1'. s1 -\\<tau>1\\<rightarrow>+ s1' \\<and> s1' \\<approx> s2')\"\nusing assms\nby(rule delay_bisimulation_base.simulation_silent1I')\n\nend\n\nlocale delay_simulation_obs = delay_bisimulation_base _ _ _ _ \\<tau>move1 \\<tau>move2\n  for \\<tau>move1 :: \"'s1 => 'tl1 => 's1 => bool\"\n  and \\<tau>move2 :: \"'s2 => 'tl2 => 's2 => bool\" +\n  assumes simulation:\n  \"\\<lbrakk> s1 \\<approx> s2; s1 -1-tl1\\<rightarrow> s1'; \\<not> \\<tau>move1 s1 tl1 s1' \\<rbrakk>\n  \\<Longrightarrow> \\<exists>s2' s2'' tl2. s2 -\\<tau>2\\<rightarrow>* s2' \\<and> s2' -2-tl2\\<rightarrow> s2'' \\<and> \\<not> \\<tau>move2 s2' tl2 s2'' \\<and> s1' \\<approx> s2'' \\<and> tl1 \\<sim> tl2\"\n\nlocale delay_simulation_diverge = delay_simulation_obs _ _ _ _ \\<tau>move1 \\<tau>move2\n  for \\<tau>move1 :: \"'s1 => 'tl1 => 's1 => bool\"\n  and \\<tau>move2 :: \"'s2 => 'tl2 => 's2 => bool\" +\n  assumes simulation_silent:\n  \"[| s1 \\<approx> s2; s1 -\\<tau>1\\<rightarrow> s1' |] ==> \\<exists>s2'. s2 -\\<tau>2\\<rightarrow>* s2' \\<and> s1' \\<approx> s2'\"\n  and \\<tau>diverge_sim_inv: \"s1 \\<approx> s2 ==> s1 -\\<tau>1\\<rightarrow> \\<infinity> ==> s2 -\\<tau>2\\<rightarrow> \\<infinity>\"\nbegin\n\nlemma simulation_silents:\n  assumes bisim: \"s1 \\<approx> s2\" and moves: \"s1 -\\<tau>1\\<rightarrow>* s1'\"\n  shows \"\\<exists>s2'. s2 -\\<tau>2\\<rightarrow>* s2' \\<and> s1' \\<approx> s2'\"\nusing moves bisim\nproof induct\n  case base thus ?case by(blast)\nnext\n  case (step s1' s1'')\n  from `s1 \\<approx> s2 ==> \\<exists>s2'. s2 -\\<tau>2\\<rightarrow>* s2' \\<and> s1' \\<approx> s2'` `s1 \\<approx> s2`\n  obtain s2' where \"s2 -\\<tau>2\\<rightarrow>* s2'\" \"s1' \\<approx> s2'\" by blast\n  from simulation_silent[OF `s1' \\<approx> s2'` `s1' -\\<tau>1\\<rightarrow> s1''`]\n  obtain s2'' where \"s2' -\\<tau>2\\<rightarrow>* s2''\" \"s1'' \\<approx> s2''\" by blast\n  from `s2 -\\<tau>2\\<rightarrow>* s2'` `s2' -\\<tau>2\\<rightarrow>* s2''` have \"s2 -\\<tau>2\\<rightarrow>* s2''\" by(rule rtranclp_trans)\n  with `s1'' \\<approx> s2''` show ?case by blast\nqed\n\nlemma simulation_\\<tau>rtrancl3p:\n  \"[| s1 -\\<tau>1-tls1\\<rightarrow>* s1'; s1 \\<approx> s2 |]\n  ==> \\<exists>tls2 s2'. s2 -\\<tau>2-tls2\\<rightarrow>* s2' \\<and> s1' \\<approx> s2' \\<and> tls1 [\\<sim>] tls2\"\nproof(induct arbitrary: s2 rule: trsys1.\\<tau>rtrancl3p.induct)\n  case (\\<tau>rtrancl3p_refl s)\n  thus ?case by(auto intro: \\<tau>trsys.\\<tau>rtrancl3p.intros)\nnext\n  case (\\<tau>rtrancl3p_step s1 s1' tls1 s1'' tl1)\n  from simulation[OF `s1 \\<approx> s2` `s1 -1-tl1\\<rightarrow> s1'` `\\<not> \\<tau>move1 s1 tl1 s1'`]\n  obtain s2' s2'' tl2 where \\<tau>red: \"s2 -\\<tau>2\\<rightarrow>* s2'\"\n    and red: \"s2' -2-tl2\\<rightarrow> s2''\" and n\\<tau>: \"\\<not> \\<tau>move2 s2' tl2 s2''\"\n    and bisim': \"s1' \\<approx> s2''\" and tlsim: \"tl1 \\<sim> tl2\" by blast\n  from bisim' `s1' \\<approx> s2'' ==> \\<exists>tls2 s2'. s2'' -\\<tau>2-tls2\\<rightarrow>* s2' \\<and> s1'' \\<approx> s2' \\<and> tls1 [\\<sim>] tls2`\n  obtain tls2 s2''' where IH: \"s2'' -\\<tau>2-tls2\\<rightarrow>* s2'''\" \"s1'' \\<approx> s2'''\" \"tls1 [\\<sim>] tls2\" by blast\n  from \\<tau>red have \"s2 -\\<tau>2-[]\\<rightarrow>* s2'\" by(rule trsys2.silent_moves_into_\\<tau>rtrancl3p)\n  also from red n\\<tau> IH(1) have \"s2' -\\<tau>2-tl2 # tls2\\<rightarrow>* s2'''\"\n    using trsys2.\\<tau>rtrancl3p_step by auto\n  finally show ?case using IH tlsim by fastforce\nnext\n  case (\\<tau>rtrancl3p_\\<tau>step s1 s1' tls1 s1'' tl1)\n  from `s1 -1-tl1\\<rightarrow> s1'` `\\<tau>move1 s1 tl1 s1'` have \"s1 -\\<tau>1\\<rightarrow> s1'\" .. \n  from simulation_silent[OF `s1 \\<approx> s2` this]\n  obtain s2' where \\<tau>red: \"s2 -\\<tau>2\\<rightarrow>* s2'\" and bisim': \"s1' \\<approx> s2'\" by blast\n  from \\<tau>red have \"s2 -\\<tau>2-[]\\<rightarrow>* s2'\" by(rule trsys2.silent_moves_into_\\<tau>rtrancl3p)\n  also from bisim' `s1' \\<approx> s2' ==> \\<exists>tls2 s2''. s2' -\\<tau>2-tls2\\<rightarrow>* s2'' \\<and> s1'' \\<approx> s2'' \\<and> tls1 [\\<sim>] tls2`\n  obtain tls2 s2'' where IH: \"s2' -\\<tau>2-tls2\\<rightarrow>* s2''\" \"s1'' \\<approx> s2''\" \"tls1 [\\<sim>] tls2\" by blast\n  note `s2' -\\<tau>2-tls2\\<rightarrow>* s2''`\n  finally show ?case using IH by auto\nqed\n\ndefinition tl1_to_tl2 where\n\"tl1_to_tl2 = (\\<lambda>(s2 :: 's2) (sstls1 :: ('s1 \\<times> 's1 \\<times> 'tl1 \\<times> 's1) llist). unfold_llist\n     (\\<lambda>(s2, sstls1). lnull sstls1)\n     (\\<lambda>(s2, sstls1).\n        let (s1, s1', tl1, s1'') = lhd sstls1;\n            (s2', tl2, s2'') = SOME (s2', tl2, s2''). s2 -\\<tau>2\\<rightarrow>* s2' \\<and> trsys2 s2' tl2 s2'' \\<and>\n                                     \\<not> \\<tau>move2 s2' tl2 s2'' \\<and>  s1'' \\<approx> s2'' \\<and> tl1 \\<sim> tl2\n        in (s2, s2', tl2, s2''))\n     (\\<lambda>(s2, sstls1). \n        let (s1, s1', tl1, s1'') = lhd sstls1;\n            (s2', tl2, s2'') = SOME (s2', tl2, s2''). s2 -\\<tau>2\\<rightarrow>* s2' \\<and> trsys2 s2' tl2 s2'' \\<and>\n                                     \\<not> \\<tau>move2 s2' tl2 s2'' \\<and>  s1'' \\<approx> s2'' \\<and> tl1 \\<sim> tl2\n        in (s2'', ltl sstls1))\n     (s2, sstls1))\"\n\nlemma simulation_\\<tau>inf_step:\n  assumes \\<tau>inf1: \"s1 -\\<tau>1-tls1\\<rightarrow>* \\<infinity>\" and bisim: \"s1 \\<approx> s2\"\n  shows \"\\<exists>tls2. s2 -\\<tau>2-tls2\\<rightarrow>* \\<infinity> \\<and> tls1 [[\\<sim>]] tls2\"\nproof -\n  from trsys1.\\<tau>inf_step_imp_\\<tau>inf_step_table[OF \\<tau>inf1]\n  obtain sstls1 where \\<tau>inf1': \"s1 -\\<tau>1-sstls1\\<rightarrow>*t \\<infinity>\" \n    and tls1: \"tls1 = lmap (fst \\<circ> snd \\<circ> snd) sstls1\" by blast\n  have [simp]:\n    \"\\<And>s2 sstls1. lnull (tl1_to_tl2 s2 sstls1) \\<longleftrightarrow> lnull sstls1\"\n    \"\\<And>s2 sstls1. \\<not> lnull sstls1 \\<Longrightarrow> lhd (tl1_to_tl2 s2 sstls1) =\n        (let (s1, s1', tl1, s1'') = lhd sstls1;\n            (s2', tl2, s2'') = SOME (s2', tl2, s2''). s2 -\\<tau>2\\<rightarrow>* s2' \\<and> trsys2 s2' tl2 s2'' \\<and>\n                                     \\<not> \\<tau>move2 s2' tl2 s2'' \\<and>  s1'' \\<approx> s2'' \\<and> tl1 \\<sim> tl2\n        in (s2, s2', tl2, s2''))\"\n    \"\\<And>s2 sstls1. \\<not> lnull sstls1 \\<Longrightarrow> ltl (tl1_to_tl2 s2 sstls1) =\n        (let (s1, s1', tl1, s1'') = lhd sstls1;\n            (s2', tl2, s2'') = SOME (s2', tl2, s2''). s2 -\\<tau>2\\<rightarrow>* s2' \\<and> trsys2 s2' tl2 s2'' \\<and>\n                                     \\<not> \\<tau>move2 s2' tl2 s2'' \\<and>  s1'' \\<approx> s2'' \\<and> tl1 \\<sim> tl2\n        in tl1_to_tl2 s2'' (ltl sstls1))\"\n    \"\\<And>s2. tl1_to_tl2 s2 LNil = LNil\"\n    \"\\<And>s2 s1 s1' tl1 s1'' stls1'. tl1_to_tl2 s2 (LCons (s1, s1', tl1, s1'') stls1') =\n        LCons (s2, SOME (s2', tl2, s2''). s2 -\\<tau>2\\<rightarrow>* s2' \\<and> trsys2 s2' tl2 s2'' \\<and> \n                                          \\<not> \\<tau>move2 s2' tl2 s2'' \\<and> s1'' \\<approx> s2'' \\<and> tl1 \\<sim> tl2) \n              (tl1_to_tl2 (snd (snd (SOME (s2', tl2, s2''). s2 -\\<tau>2\\<rightarrow>* s2' \\<and> trsys2 s2' tl2 s2'' \\<and>\n                                                            \\<not> \\<tau>move2 s2' tl2 s2'' \\<and> s1'' \\<approx> s2'' \\<and> tl1 \\<sim> tl2)))\n                           stls1')\"\n    by(simp_all add: tl1_to_tl2_def split_beta)\n\n  have [simp]: \"llength (tl1_to_tl2 s2 sstls1) = llength sstls1\"\n    by(coinduction arbitrary: s2 sstls1 rule: enat_coinduct)(auto simp add: epred_llength split_beta)\n  define sstls2 where \"sstls2 = tl1_to_tl2 s2 sstls1\"\n  with \\<tau>inf1' bisim have \"\\<exists>s1 sstls1. s1 -\\<tau>1-sstls1\\<rightarrow>*t \\<infinity> \\<and> sstls2 = tl1_to_tl2 s2 sstls1 \\<and> s1 \\<approx> s2\" by blast\n  from \\<tau>inf1' bisim have \"s2 -\\<tau>2-tl1_to_tl2 s2 sstls1\\<rightarrow>*t \\<infinity>\"\n  proof(coinduction arbitrary: s2 s1 sstls1)\n    case (\\<tau>inf_step_table s2 s1 sstls1)\n    note \\<tau>inf' = `s1 -\\<tau>1-sstls1\\<rightarrow>*t \\<infinity>` and bisim = `s1 \\<approx> s2`\n    from \\<tau>inf' show ?case\n    proof(cases)\n      case (\\<tau>inf_step_table_Cons s1' s1'' sstls1' tl1)\n      hence sstls1: \"sstls1 = LCons (s1, s1', tl1, s1'') sstls1'\"\n        and \\<tau>s: \"s1 -\\<tau>1\\<rightarrow>* s1'\" and r: \"s1' -1-tl1\\<rightarrow> s1''\" and n\\<tau>: \"\\<not> \\<tau>move1 s1' tl1 s1''\"\n        and reds1: \"s1'' -\\<tau>1-sstls1'\\<rightarrow>*t \\<infinity>\" by simp_all\n      let ?P = \"\\<lambda>(s2', tl2, s2''). s2 -\\<tau>2\\<rightarrow>* s2' \\<and> trsys2 s2' tl2 s2'' \\<and> \\<not> \\<tau>move2 s2' tl2 s2'' \\<and>  s1'' \\<approx> s2'' \\<and> tl1 \\<sim> tl2\"\n      let ?s2tl2s2' = \"Eps ?P\"\n      let ?s2'' = \"snd (snd ?s2tl2s2')\"\n      from simulation_silents[OF `s1 \\<approx> s2` \\<tau>s]\n      obtain s2' where \"s2 -\\<tau>2\\<rightarrow>* s2'\" \"s1' \\<approx> s2'\" by blast\n      from simulation[OF `s1' \\<approx> s2'` r n\\<tau>] obtain s2'' s2''' tl2\n        where \"s2' -\\<tau>2\\<rightarrow>* s2''\" \n        and rest: \"s2'' -2-tl2\\<rightarrow> s2'''\" \"\\<not> \\<tau>move2 s2'' tl2 s2'''\" \"s1'' \\<approx> s2'''\" \"tl1 \\<sim> tl2\" by blast\n      from `s2 -\\<tau>2\\<rightarrow>* s2'` `s2' -\\<tau>2\\<rightarrow>* s2''` have \"s2 -\\<tau>2\\<rightarrow>* s2''\" by(rule rtranclp_trans)\n      with rest have \"?P (s2'', tl2, s2''')\" by simp\n      hence \"?P ?s2tl2s2'\" by(rule someI)\n      then show ?thesis using reds1 sstls1 by fastforce\n    next\n      case \\<tau>inf_step_table_Nil\n      hence [simp]: \"sstls1 = LNil\" and \"s1 -\\<tau>1\\<rightarrow> \\<infinity>\" by simp_all\n      from `s1 -\\<tau>1\\<rightarrow> \\<infinity>` `s1 \\<approx> s2` have \"s2 -\\<tau>2\\<rightarrow> \\<infinity>\" by(simp add: \\<tau>diverge_sim_inv)\n      thus ?thesis by simp\n    qed\n  qed\n  hence \"s2 -\\<tau>2-lmap (fst \\<circ> snd \\<circ> snd) (tl1_to_tl2 s2 sstls1)\\<rightarrow>* \\<infinity>\"\n    by(rule trsys2.\\<tau>inf_step_table_into_\\<tau>inf_step)\n  moreover have \"tls1 [[\\<sim>]] lmap (fst \\<circ> snd \\<circ> snd) (tl1_to_tl2 s2 sstls1)\"\n  proof(rule llist_all2_all_lnthI)\n    show \"llength tls1 = llength (lmap (fst \\<circ> snd \\<circ> snd) (tl1_to_tl2 s2 sstls1))\"\n      using tls1 by simp\n  next\n    fix n\n    assume \"enat n < llength tls1\"\n    thus \"lnth tls1 n \\<sim> lnth (lmap (fst \\<circ> snd \\<circ> snd) (tl1_to_tl2 s2 sstls1)) n\"\n      using \\<tau>inf1' bisim unfolding tls1\n    proof(induct n arbitrary: s1 s2 sstls1 rule: less_induct)\n      case (less n)\n      note IH = `\\<And>m s1 s2 sstls1. \\<lbrakk> m < n; enat m < llength (lmap (fst \\<circ> snd \\<circ> snd) sstls1);\n                                   s1 -\\<tau>1-sstls1\\<rightarrow>*t \\<infinity>; s1 \\<approx> s2 \\<rbrakk>\n                 \\<Longrightarrow> lnth (lmap (fst \\<circ> snd \\<circ> snd) sstls1) m \\<sim> lnth (lmap (fst \\<circ> snd \\<circ> snd) (tl1_to_tl2 s2 sstls1)) m`\n      from `s1 -\\<tau>1-sstls1\\<rightarrow>*t \\<infinity>` show ?case\n      proof cases\n        case (\\<tau>inf_step_table_Cons s1' s1'' sstls1' tl1)\n        hence sstls1: \"sstls1 = LCons (s1, s1', tl1, s1'') sstls1'\"\n          and \\<tau>s: \"s1 -\\<tau>1\\<rightarrow>* s1'\" and r: \"s1' -1-tl1\\<rightarrow> s1''\"\n          and n\\<tau>: \"\\<not> \\<tau>move1 s1' tl1 s1''\" and reds: \"s1'' -\\<tau>1-sstls1'\\<rightarrow>*t \\<infinity>\" by simp_all\n        let ?P = \"\\<lambda>(s2', tl2, s2''). s2 -\\<tau>2\\<rightarrow>* s2' \\<and> trsys2 s2' tl2 s2'' \\<and> \\<not> \\<tau>move2 s2' tl2 s2'' \\<and>  s1'' \\<approx> s2'' \\<and> tl1 \\<sim> tl2\"\n        let ?s2tl2s2' = \"Eps ?P\" let ?tl2 = \"fst (snd ?s2tl2s2')\" let ?s2'' = \"snd (snd ?s2tl2s2')\"\n        from simulation_silents[OF `s1 \\<approx> s2` \\<tau>s] obtain s2'\n          where \"s2 -\\<tau>2\\<rightarrow>* s2'\" \"s1' \\<approx> s2'\" by blast\n        from simulation[OF `s1' \\<approx> s2'` r n\\<tau>] obtain s2'' s2''' tl2\n          where \"s2' -\\<tau>2\\<rightarrow>* s2''\"\n          and rest: \"s2'' -2-tl2\\<rightarrow> s2'''\" \"\\<not> \\<tau>move2 s2'' tl2 s2'''\" \"s1'' \\<approx> s2'''\" \"tl1 \\<sim> tl2\" by blast\n        from `s2 -\\<tau>2\\<rightarrow>* s2'` `s2' -\\<tau>2\\<rightarrow>* s2''` have \"s2 -\\<tau>2\\<rightarrow>* s2''\" by(rule rtranclp_trans)\n        with rest have \"?P (s2'', tl2, s2''')\" by auto\n        hence \"?P ?s2tl2s2'\" by(rule someI)\n        hence \"s1'' \\<approx> ?s2''\" \"tl1 \\<sim> ?tl2\" by(simp_all add: split_beta)\n        show ?thesis\n        proof(cases n)\n          case 0\n          with sstls1 `tl1 \\<sim> ?tl2` show ?thesis by simp\n        next\n          case (Suc m)\n          hence \"m < n\" by simp\n          moreover have \"enat m < llength (lmap (fst \\<circ> snd \\<circ> snd) sstls1')\"\n            using sstls1 `enat n < llength (lmap (fst \\<circ> snd \\<circ> snd) sstls1)` Suc by(simp add: Suc_ile_eq)\n          ultimately have \"lnth (lmap (fst \\<circ> snd \\<circ> snd) sstls1') m \\<sim> lnth (lmap (fst \\<circ> snd \\<circ> snd) (tl1_to_tl2 ?s2'' sstls1')) m\"\n            using reds `s1'' \\<approx> ?s2''` by(rule IH)\n          with Suc sstls1 show ?thesis by(simp del: o_apply)\n        qed\n      next\n        case \\<tau>inf_step_table_Nil\n        with `enat n < llength (lmap (fst \\<circ> snd \\<circ> snd) sstls1)` have False by simp\n        thus ?thesis ..\n      qed\n    qed\n  qed\n  ultimately show ?thesis by blast\nqed\n\n(* is this enough? *)\nend\n\nsublocale delay_bisimulation_diverge \\<subseteq> delay_simulation_diverge\nby (unfold_locales, rule simulation1, auto simp add: simulation1 simulation_silent1 \\<tau>diverge_bisim_inv)\n\ndefinition \\<tau>moves_of_tCFG where \n\"\\<tau>moves_of_tCFG CFGs step_rel obs get_mem C l C' \\<equiv> step_rel CFGs C C' \\<and> get_mem C' |` obs = l\n  \\<and> get_mem C |` obs = l\" \n\nlocale tCFG_delay_bisim = delay_bisimulation_diverge where trsys1 = \"trsys_of_tCFG CFGs step_rel obs get_mem\"\n and trsys2 = \"trsys_of_tCFG CFGs' step_rel obs get_mem\" \n and \\<tau>move1 = \"\\<tau>moves_of_tCFG CFGs step_rel obs get_mem\" \n and \\<tau>move2 = \"\\<tau>moves_of_tCFG CFGs' step_rel obs get_mem\" for CFGs CFGs' step_rel obs get_mem\n\nlocale tCFG_delay_sim = delay_simulation_diverge where trsys1 = \"trsys_of_tCFG CFGs step_rel obs get_mem\"\n and trsys2 = \"trsys_of_tCFG CFGs' step_rel obs get_mem\" \n and \\<tau>move1 = \"\\<tau>moves_of_tCFG CFGs step_rel obs get_mem\" \n and \\<tau>move2 = \"\\<tau>moves_of_tCFG CFGs' step_rel obs get_mem\" for CFGs CFGs' step_rel obs get_mem\n\nlemma delay_sim_comp: \"\\<lbrakk>tCFG_delay_sim sim tlsim CFGs CFGs' step_rel obs get_mem; \n  tCFG_delay_sim sim' tlsim' CFGs' CFGs'' step_rel obs get_mem\\<rbrakk> \\<Longrightarrow>\ntCFG_delay_sim (sim \\<circ>\\<^sub>B sim') (tlsim \\<circ>\\<^sub>B tlsim') CFGs CFGs'' step_rel obs get_mem\"\napply (clarsimp simp add: tCFG_delay_sim_def, unfold_locales)\napply (clarsimp simp add: bisim_compose_def)\napply (drule delay_simulation_diverge.simulation_\\<tau>rtrancl3p)\napply (rule \\<tau>trsys.\\<tau>rtrancl3p_step, simp+)\napply (rule \\<tau>trsys.\\<tau>rtrancl3p_refl, simp+)\napply clarsimp\napply (drule delay_simulation_diverge.simulation_\\<tau>rtrancl3p, simp+, clarsimp)\n(* overshot? *)\noops\n\nlemma delay_bisim_comp: \"\\<lbrakk>tCFG_delay_bisim sim tlsim CFGs CFGs' step_rel obs get_mem; \n  tCFG_delay_bisim sim' tlsim' CFGs' CFGs'' step_rel obs get_mem\\<rbrakk> \\<Longrightarrow>\ntCFG_delay_bisim (sim \\<circ>\\<^sub>B sim') (tlsim \\<circ>\\<^sub>B tlsim') CFGs CFGs'' step_rel obs get_mem\"\nby (simp add: tCFG_delay_bisim_def delay_bisimulation_diverge_compose)\n\ncontext TRANS_basics begin\n\ndefinition (in TRANS_basics) \"opt_delay_bisim T sim tlsim step_rel obs get_mem \\<equiv> \n  \\<forall>\\<tau> CFGs. tCFG CFGs instr_edges Seq \\<longrightarrow> (\\<forall>CFGs'\\<in>trans_sf T \\<tau> CFGs. tCFG CFGs' instr_edges Seq \\<and> \n  tCFG_delay_bisim sim tlsim CFGs' CFGs step_rel obs get_mem)\"\n\nlemma opt_delay_bisimI [intro]: \"(\\<And>\\<tau> CFGs CFGs'. \\<lbrakk>tCFG CFGs instr_edges Seq; CFGs' \\<in> trans_sf T \\<tau> CFGs\\<rbrakk> \\<Longrightarrow>\n  tCFG CFGs' instr_edges Seq \\<and> tCFG_delay_bisim sim tlsim CFGs' CFGs step_rel obs get_mem) \\<Longrightarrow>\n  opt_delay_bisim T sim tlsim step_rel obs get_mem\"\nby (simp add: opt_delay_bisim_def)\n\nlemma opt_delay_bisimD [dest]: \"\\<lbrakk>opt_delay_bisim T sim tlsim step_rel obs get_mem; \n  tCFG CFGs instr_edges Seq; CFGs' \\<in> trans_sf T \\<tau> CFGs\\<rbrakk> \\<Longrightarrow> tCFG CFGs' instr_edges Seq \\<and>\n  tCFG_delay_bisim sim tlsim CFGs' CFGs step_rel obs get_mem\"\nby (simp add: opt_delay_bisim_def)\n\nlemma then_delay_bisim [intro]: \"\\<lbrakk>opt_delay_bisim T1 sim1 tlsim1 step_rel obs get_mem; \n  opt_delay_bisim T2 sim2 tlsim2 step_rel obs get_mem\\<rbrakk> \\<Longrightarrow>\n  opt_delay_bisim (TThen T1 T2) (sim2 \\<circ>\\<^sub>B sim1) (tlsim2 \\<circ>\\<^sub>B tlsim1) step_rel obs get_mem\"\napply (clarsimp intro!: opt_delay_bisimI)\napply (drule opt_delay_bisimD, simp+, clarsimp)+\napply (rule delay_bisim_comp, simp_all)\ndone\n(* These work much better than just unfolding the definition. *)\n\nlemma applysome_delay_bisim: \"\\<lbrakk>opt_delay_bisim T sim tlsim step_rel obs get_mem; \n  tCFG CFGs instr_edges Seq; apply_some (trans_sf T) \\<tau> CFGs CFGs'\\<rbrakk> \\<Longrightarrow> \n  tCFG CFGs' instr_edges Seq \\<and> (\\<exists>sim' tlsim'. tCFG_delay_bisim sim' tlsim' CFGs' CFGs step_rel obs get_mem)\"\napply (drule_tac P=\"\\<lambda>t \\<tau> G G'. t = trans_sf T \\<and> tCFG G instr_edges Seq \\<longrightarrow> \n  (tCFG G' instr_edges Seq \\<and> (\\<exists>sim' tlsim'. tCFG_delay_bisim sim' tlsim' G' G step_rel obs get_mem))\" \n  in apply_some.induct, auto)\napply (rule_tac x=\"(=)\" in exI, rule_tac x=\"(=)\" in exI, unfold_locales, force+)\napply (drule opt_delay_bisimD, simp+, clarsimp)\napply (rule exI, rule exI, rule delay_bisim_comp, simp+)\ndone\n\ndefinition \"trans_delay_bisim T step_rel obs get_mem \\<equiv> \n  \\<forall>\\<tau> CFGs. tCFG CFGs instr_edges Seq \\<longrightarrow> (\\<forall>CFGs' \\<in> trans_sf T \\<tau> CFGs. tCFG CFGs' instr_edges Seq \\<and> \n  (\\<exists>sim tlsim. tCFG_delay_bisim sim tlsim CFGs' CFGs step_rel obs get_mem))\"\n\nlemma trans_delay_bisimI [intro]: \"(\\<And>\\<tau> CFGs CFGs'. \\<lbrakk>tCFG CFGs instr_edges Seq; CFGs' \\<in> trans_sf T \\<tau> CFGs\\<rbrakk> \\<Longrightarrow>\n  tCFG CFGs' instr_edges Seq \\<and> (\\<exists>sim tlsim. tCFG_delay_bisim sim tlsim CFGs' CFGs step_rel obs get_mem)) \\<Longrightarrow>\n  trans_delay_bisim T step_rel obs get_mem\"\nby (simp add: trans_delay_bisim_def)\n\nlemma trans_delay_bisimD [dest]: \"\\<lbrakk>trans_delay_bisim T step_rel obs get_mem; \n  tCFG CFGs instr_edges Seq; CFGs' \\<in> trans_sf T \\<tau> CFGs\\<rbrakk> \\<Longrightarrow> tCFG CFGs' instr_edges Seq \\<and>\n  (\\<exists>sim tlsim. tCFG_delay_bisim sim tlsim CFGs' CFGs step_rel obs get_mem)\"\nby (simp add: trans_delay_bisim_def)\n\nlemma opt_delay_bisim_trans [intro]: \"opt_delay_bisim T sim tlsim step_rel obs get_mem \\<Longrightarrow> \n  trans_delay_bisim T step_rel obs get_mem\"\nby (force simp add: opt_delay_bisim_def trans_delay_bisim_def)\n\ndefinition \"cond_delay_bisim P T step_rel obs get_mem \\<equiv> \\<forall>\\<tau> CFGs. P \\<tau> CFGs \\<and> tCFG CFGs instr_edges Seq \\<longrightarrow> \n  (\\<forall>CFGs' \\<in> trans_sf T \\<tau> CFGs. tCFG CFGs' instr_edges Seq \\<and> \n  (\\<exists>sim tlsim. tCFG_delay_bisim sim tlsim CFGs' CFGs step_rel obs get_mem))\"\n\nlemma cond_delay_bisimI [intro]: \"(\\<And>\\<tau> CFGs CFGs'. \\<lbrakk>P \\<tau> CFGs; tCFG CFGs instr_edges Seq; \n  CFGs' \\<in> trans_sf T \\<tau> CFGs\\<rbrakk> \\<Longrightarrow> tCFG CFGs' instr_edges Seq \\<and> \n  (\\<exists>sim tlsim. tCFG_delay_bisim sim tlsim CFGs' CFGs step_rel obs get_mem)) \\<Longrightarrow>\n  cond_delay_bisim P T step_rel obs get_mem\"\nby (force simp add: cond_delay_bisim_def)\n\nlemma cond_delay_bisimD [dest]: \"\\<lbrakk>cond_delay_bisim P T step_rel obs get_mem; P \\<tau> CFGs;\n  tCFG CFGs instr_edges Seq; CFGs' \\<in> trans_sf T \\<tau> CFGs\\<rbrakk> \\<Longrightarrow> tCFG CFGs' instr_edges Seq \\<and>\n  (\\<exists>sim tlsim. tCFG_delay_bisim sim tlsim CFGs' CFGs step_rel obs get_mem)\"\nby (force simp add: cond_delay_bisim_def)\n\nlemma applyall_delay_bisim [intro]: \"opt_delay_bisim T sim tlsim step_rel obs get_mem \\<Longrightarrow> \n  trans_delay_bisim (TApplyAll T) step_rel obs get_mem\"\napply (clarsimp simp add: trans_delay_bisim_def)\nby (metis applysome_delay_bisim)\n\nlemma match_cond_delay_bisim [intro]: \"cond_delay_bisim (\\<lambda>\\<tau> CFGs. \\<exists>\\<sigma> \\<tau>'. side_cond_sf \\<phi> \\<sigma> CFGs \\<and> \n  part_matches \\<sigma> \\<tau>' \\<and> \\<tau> = part_extend \\<tau>' (cond_fv pred_fv \\<phi>) \\<sigma>) T step_rel obs get_mem \\<Longrightarrow>\n  trans_delay_bisim (TMatch \\<phi> T) step_rel obs get_mem\"\napply (clarsimp simp add: trans_delay_bisim_def cond_delay_bisim_def)\nby metis\n\nlemma then_cond_delay_bisim [intro]: \"\\<lbrakk>cond_delay_bisim P T1 step_rel obs get_mem; \n  cond_delay_bisim P T2 step_rel obs get_mem;\n  \\<forall>\\<tau> CFGs CFGs'. P \\<tau> CFGs \\<and> CFGs' \\<in> trans_sf T1 \\<tau> CFGs \\<longrightarrow> P \\<tau> CFGs'\\<rbrakk> \\<Longrightarrow>\n  cond_delay_bisim P (TThen T1 T2) step_rel obs get_mem\"\napply (clarsimp intro!: cond_delay_bisimI)\napply (drule cond_delay_bisimD, simp+, clarsimp)\napply (erule_tac x=\\<tau> in allE, erule_tac x=CFGs in allE, erule_tac x=CFGs'a in allE, simp)\napply (drule cond_delay_bisimD, simp+, clarsimp)\napply (rule exI, rule exI, rule delay_bisim_comp, simp+)\ndone\n\nlemma applysome_cond_delay_bisim: \"\\<lbrakk>apply_some (trans_sf T) \\<tau> CFGs CFGs'; \n  tCFG CFGs instr_edges Seq; cond_delay_bisim P T step_rel obs get_mem;\n  \\<forall>\\<tau> CFGs CFGs'. P \\<tau> CFGs \\<and> CFGs' \\<in> trans_sf T \\<tau> CFGs \\<longrightarrow> P \\<tau> CFGs'; P \\<tau> CFGs\\<rbrakk> \\<Longrightarrow> \n  tCFG CFGs' instr_edges Seq \\<and> (\\<exists>sim' tlsim'. tCFG_delay_bisim sim' tlsim' CFGs' CFGs step_rel obs get_mem)\"\napply (drule_tac P=\"\\<lambda>t \\<tau> G G'. t = trans_sf T \\<and> P \\<tau> G \\<and> tCFG G instr_edges Seq \\<longrightarrow> \n  (tCFG G' instr_edges Seq \\<and> (\\<exists>sim' tlsim'. tCFG_delay_bisim sim' tlsim' G' G step_rel obs get_mem))\" \n  in apply_some.induct, simp_all)\napply clarsimp\napply (rule_tac x=\"(=)\" in exI, rule_tac x=\"(=)\" in exI, unfold_locales, force, force, force, force,\n  force)\napply clarsimp\napply (erule_tac x=\\<tau>' in allE, erule_tac x=G in allE, erule_tac x=G' in allE, simp)\napply (drule_tac CFGs=G in cond_delay_bisimD, simp+, clarsimp)\napply (rule exI, rule exI, rule delay_bisim_comp, simp+)\ndone\n\nlemma applyall_cond_delay_bisim [intro]: \"\\<lbrakk>cond_delay_bisim P T step_rel obs get_mem; \n  \\<forall>\\<tau> CFGs CFGs'. P \\<tau> CFGs \\<and> CFGs' \\<in> trans_sf T \\<tau> CFGs \\<longrightarrow> P \\<tau> CFGs'\\<rbrakk> \\<Longrightarrow>\n  cond_delay_bisim P (TApplyAll T) step_rel obs get_mem\"\napply (clarsimp intro!: cond_delay_bisimI)\napply (drule applysome_cond_delay_bisim, force simp add: cond_delay_bisim_def)\napply simp+\ndone\n\nend\n\nend\n", "meta": {"author": "liyili2", "repo": "timed-relaxed-memory-model", "sha": "6d85bc75d8b04228b3e581b945e3f672395f0c66", "save_path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model", "path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model/timed-relaxed-memory-model-6d85bc75d8b04228b3e581b945e3f672395f0c66/trans_sim.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.33629200514842983}}
{"text": "theory Impl_List_Set_Ndj\nimports\n  \"$AFP/Collections/Refine_Dflt_ICF\"\n  \"$AFP/Refine_Imperative_HOL/IICF/IICF\"\n  \"$AFP/Refine_Imperative_HOL/Sepref_ICF_Bindings\"\nbegin\n\n  definition [simp]: \"ndls_rel \\<equiv> br set (\\<lambda>_. True)\" \n  definition \"nd_list_set_assn A \\<equiv> pure (ndls_rel O \\<langle>the_pure A\\<rangle>set_rel)\"\n  \n  context\n    notes [fcomp_norm_unfold] = nd_list_set_assn_def[symmetric]\n    notes [fcomp_norm_unfold] = list_set_assn_def[symmetric]\n  begin    \n  \n    lemma ndls_empty_hnr_aux: \"([],op_set_empty) \\<in> ndls_rel\" by (auto simp: in_br_conv)\n    sepref_decl_impl (no_register) ndls_empty: ndls_empty_hnr_aux[sepref_param] .\n\n    lemma ndls_is_empty_hnr_aux: \"(op= [], op_set_is_empty) \\<in> ndls_rel \\<rightarrow> bool_rel\" \n      by (auto simp: in_br_conv)   \n    sepref_decl_impl ndls_is_empty: ndls_is_empty_hnr_aux[sepref_param] .   \n\n    lemma ndls_insert_hnr_aux: \"(op #, op_set_insert) \\<in> Id \\<rightarrow> ndls_rel \\<rightarrow> ndls_rel\"\n      by (auto simp: in_br_conv)   \n      \n    sepref_decl_impl ndls_insert: ndls_insert_hnr_aux[sepref_param] .    \n\n        \n    sepref_decl_op ndls_ls_copy: \"\\<lambda>x::'a set. x\" :: \"\\<langle>A\\<rangle>set_rel \\<rightarrow> \\<langle>A\\<rangle>set_rel\" .\n    lemma op_ndls_ls_copy_hnr_aux: \n      \"(remdups, op_ndls_ls_copy)\\<in>ndls_rel \\<rightarrow> \\<langle>Id\\<rangle>list_set_rel\"  \n      by (auto simp: in_br_conv list_set_rel_def)\n      \n    sepref_decl_impl op_ndls_ls_copy_hnr_aux[sepref_param] .   \n  end      \n\n  definition [simp]: \"op_ndls_empty = op_set_empty\"\n  interpretation ndls: set_custom_empty \"return []\" op_ndls_empty\n    by unfold_locales simp\n  sepref_register op_ndls_empty\n  lemmas [sepref_fr_rules] = ndls_empty_hnr[folded op_ndls_empty_def]\n\n  lemma fold_ndls_ls_copy: \"x = op_ndls_ls_copy x\" by simp  \n    \n\nend\n", "meta": {"author": "wimmers", "repo": "verifythis", "sha": "985e51621f3a21d8376c99e9c9233f7193eeaffe", "save_path": "github-repos/isabelle/wimmers-verifythis", "path": "github-repos/isabelle/wimmers-verifythis/verifythis-985e51621f3a21d8376c99e9c9233f7193eeaffe/Impl_List_Set_Ndj.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878555160666, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3362919974330334}}
{"text": "chapter\\<open>EFSM Inference\\<close>\ntext\\<open>This chapter presents the definitions necessary for EFSM inference by state-merging.\\<close>\n\nsection\\<open>Inference by State-Merging\\<close>\ntext\\<open>This theory sets out the key definitions for the inference of EFSMs from system traces.\\<close>\n\ntheory Inference\n  imports\n    Subsumption\n    \"Extended_Finite_State_Machines.Transition_Lexorder\"\n    \"HOL-Library.Product_Lexorder\"\nbegin\n\ndeclare One_nat_def [simp del]\n\nsubsection\\<open>Transition Identifiers\\<close>\n\ntext\\<open>We first need to define the \\texttt{iEFSM} data type which assigns each transition a unique identity.\nThis is necessary because transitions may not occur uniquely in an EFSM. Assigning transitions a unique\nidentifier enables us to look up the origin and destination states of transitions without having to\npass them around in the inference functions.\\<close>\n\ntype_synonym tid = nat\ntype_synonym tids = \"tid list\"\ntype_synonym iEFSM = \"(tids \\<times> (cfstate \\<times> cfstate) \\<times> transition) fset\"\n\ndefinition origin :: \"tids \\<Rightarrow> iEFSM \\<Rightarrow> nat\" where\n  \"origin uid t = fst (fst (snd (fthe_elem (ffilter (\\<lambda>x. set uid \\<subseteq> set (fst x)) t))))\"\n\ndefinition dest :: \"tids \\<Rightarrow> iEFSM \\<Rightarrow> nat\" where\n  \"dest uid t = snd (fst (snd (fthe_elem (ffilter (\\<lambda>x. set uid \\<subseteq> set (fst x)) t))))\"\n\ndefinition get_by_id :: \"iEFSM \\<Rightarrow> tid \\<Rightarrow> transition\" where\n  \"get_by_id e uid = (snd \\<circ> snd) (fthe_elem (ffilter (\\<lambda>(tids, _). uid \\<in> set tids) e))\"\n\ndefinition get_by_ids :: \"iEFSM \\<Rightarrow> tids \\<Rightarrow> transition\" where\n  \"get_by_ids e uid = (snd \\<circ> snd) (fthe_elem (ffilter (\\<lambda>(tids, _). set uid \\<subseteq> set tids) e))\"\n\ndefinition uids :: \"iEFSM \\<Rightarrow> nat fset\" where\n  \"uids e = ffUnion (fimage (fset_of_list \\<circ> fst) e)\"\n\ndefinition max_uid :: \"iEFSM \\<Rightarrow> nat option\" where\n  \"max_uid e = (let uids = uids e in if uids = {||} then None else Some (fMax uids))\"\n\ndefinition tm :: \"iEFSM \\<Rightarrow> transition_matrix\" where\n  \"tm e = fimage snd e\"\n\ndefinition all_regs :: \"iEFSM \\<Rightarrow> nat set\" where\n  \"all_regs e = EFSM.all_regs (tm e)\"\n\ndefinition max_reg :: \"iEFSM \\<Rightarrow> nat option\" where\n  \"max_reg e = EFSM.max_reg (tm e)\"\n\ndefinition \"max_reg_total e = (case max_reg e of None \\<Rightarrow> 0 | Some r \\<Rightarrow> r)\"\n\ndefinition max_output :: \"iEFSM \\<Rightarrow> nat\" where\n  \"max_output e = EFSM.max_output (tm e)\"\n\ndefinition max_int :: \"iEFSM \\<Rightarrow> int\" where\n  \"max_int e = EFSM.max_int (tm e)\"\n\ndefinition S :: \"iEFSM \\<Rightarrow> nat fset\" where\n  \"S m = (fimage (\\<lambda>(uid, (s, s'), t). s) m) |\\<union>| fimage (\\<lambda>(uid, (s, s'), t). s') m\"\n\nlemma S_alt: \"S t = EFSM.S (tm t)\"\n  apply (simp add: S_def EFSM.S_def tm_def)\n  by force\n\nlemma to_in_S:\n  \"(\\<exists>to from uid. (uid, (from, to), t) |\\<in>| xb \\<longrightarrow> to |\\<in>| S xb)\"\n  apply (simp add: S_def)\n  by blast\n\nlemma from_in_S:\n  \"(\\<exists>to from uid. (uid, (from, to), t) |\\<in>| xb \\<longrightarrow> from |\\<in>| S xb)\"\n  apply (simp add: S_def)\n  by blast\n\nsubsection\\<open>Building the PTA\\<close>\ntext\\<open>The first step in EFSM inference is to construct a PTA from the observed traces in the same way\nas for classical FSM inference. Beginning with the empty EFSM, we iteratively attempt to walk each\nobserved trace in the model. When we reach a point where there is no available transition, one is\nadded. For classical FSMs, this is simply an atomic label. EFSMs deal with data, so we need to add\nguards which test for the observed input values and outputs which produce the observed values.\\<close>\n\nprimrec make_guard :: \"value list \\<Rightarrow> nat \\<Rightarrow> vname gexp list\" where\n\"make_guard [] _ = []\" |\n\"make_guard (h#t) n = (gexp.Eq (V (vname.I n)) (L h))#(make_guard t (n+1))\"\n\nprimrec make_outputs :: \"value list \\<Rightarrow> output_function list\" where\n  \"make_outputs [] = []\" |\n  \"make_outputs (h#t) = (L h)#(make_outputs t)\"\n\ndefinition max_uid_total :: \"iEFSM \\<Rightarrow> nat\" where\n  \"max_uid_total e = (case max_uid e of None \\<Rightarrow> 0 | Some u \\<Rightarrow> u)\"\n\ndefinition add_transition :: \"iEFSM \\<Rightarrow> cfstate \\<Rightarrow> label \\<Rightarrow> value list \\<Rightarrow> value list \\<Rightarrow> iEFSM\" where\n  \"add_transition e s label inputs outputs = finsert ([max_uid_total e + 1], (s, (maxS (tm e))+1), \\<lparr>Label=label, Arity=length inputs, Guards=(make_guard inputs 0), Outputs=(make_outputs outputs), Updates=[]\\<rparr>) e\"\n\nfun make_branch :: \"iEFSM \\<Rightarrow> cfstate \\<Rightarrow> registers \\<Rightarrow> trace \\<Rightarrow> iEFSM\" where\n  \"make_branch e _ _ [] = e\" |\n  \"make_branch e s r ((label, inputs, outputs)#t) =\n    (case (step (tm e) s r label inputs) of\n      Some (transition, s', outputs', updated) \\<Rightarrow>\n        if outputs' = (map Some outputs) then\n          make_branch e s' updated t\n        else\n          make_branch (add_transition e s label inputs outputs) ((maxS (tm e))+1) r t  |\n      None \\<Rightarrow>\n          make_branch (add_transition e s label inputs outputs) ((maxS (tm e))+1) r t\n    )\"\n\nprimrec make_pta_aux :: \"log \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM\" where\n  \"make_pta_aux [] e = e\" |\n  \"make_pta_aux (h#t) e = make_pta_aux t (make_branch e 0 <> h)\"\n\ndefinition \"make_pta log = make_pta_aux log {||}\"\n\nlemma make_pta_aux_fold [code]:\n  \"make_pta_aux l e = fold (\\<lambda>h e. make_branch e 0 <> h) l e\"\n  by(induct l arbitrary: e, auto)\n\nsubsection\\<open>Integrating Heuristics\\<close>\ntext\\<open>A key contribution of the inference technique presented in \\<^cite>\\<open>\"foster2019\"\\<close> is the ability to\nintroduce \\emph{internal variables} to the model to generalise behaviours and allow transitions to\nbe merged. This is done by providing the inference technique with a set of \\emph{heuristics}. The\naim here is not to create a ``one size fits all'' magic oracle, rather to recognise particular\n\\emph{data usage patterns} which can be abstracted.\\<close>\n\ntype_synonym update_modifier = \"tids \\<Rightarrow> tids \\<Rightarrow> cfstate \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM \\<Rightarrow> (transition_matrix \\<Rightarrow> bool) \\<Rightarrow> iEFSM option\"\n\ndefinition null_modifier :: update_modifier where\n  \"null_modifier f _ _ _ _ _ _ = None\"\n\ndefinition replace_transition :: \"iEFSM \\<Rightarrow> tids \\<Rightarrow> transition \\<Rightarrow> iEFSM\" where\n  \"replace_transition e uid new = (fimage (\\<lambda>(uids, (from, to), t). if set uid \\<subseteq> set uids then (uids, (from, to), new) else (uids, (from, to), t)) e)\"\n\ndefinition replace_all :: \"iEFSM \\<Rightarrow> tids list \\<Rightarrow> transition \\<Rightarrow> iEFSM\" where\n  \"replace_all e ids new = fold (\\<lambda>id acc. replace_transition acc id new) ids e\"\n\ndefinition replace_transitions :: \"iEFSM \\<Rightarrow> (tids \\<times> transition) list \\<Rightarrow> iEFSM\" where\n  \"replace_transitions e ts = fold (\\<lambda>(uid, new) acc. replace_transition acc uid new) ts e\"\n\nprimrec try_heuristics_check :: \"(transition_matrix \\<Rightarrow> bool) \\<Rightarrow> update_modifier list \\<Rightarrow> update_modifier\" where\n  \"try_heuristics_check _ [] = null_modifier\" |\n  \"try_heuristics_check check (h#t) = (\\<lambda>a b c d e f ch.\n    case h a b c d e f ch of\n      Some e' \\<Rightarrow> Some e' |\n      None \\<Rightarrow> (try_heuristics_check check t) a b c d e f ch\n    )\"\n\nsubsection\\<open>Scoring State Merges\\<close>\ntext\\<open>To tackle the state merging challenge, we need some means of determining which states are\ncompatible for merging. Because states are merged pairwise, we additionally require a way of\nordering the state merges. The potential merges are then sorted highest to lowest according to this\nscore such that we can merge states in order of their merge score.\n\nWe want to sort first by score (highest to lowest) and then by state pairs (lowest to highest) so we\nendup merging the states with the highest scores first and then break ties by those state pairs\nwhich are closest to the origin.\\<close>\n\nrecord score =\n  Score :: nat\n  S1 :: cfstate\n  S2 :: cfstate\n\ninstantiation score_ext :: (linorder) linorder begin\ndefinition less_score_ext :: \"'a::linorder score_ext \\<Rightarrow> 'a score_ext \\<Rightarrow> bool\" where\n\"less_score_ext t1 t2 = ((Score t2, S1 t1, S2 t1, more t1) < (Score t1, S1 t2, S2 t2, more t2) )\"\n\ndefinition less_eq_score_ext :: \"'a::linorder score_ext \\<Rightarrow> 'a::linorder score_ext \\<Rightarrow> bool\" where\n \"less_eq_score_ext s1 s2 = (s1 < s2 \\<or> s1 = s2)\"\n\ninstance\n  apply standard prefer 5\n  unfolding less_score_ext_def less_eq_score_ext_def\n  using score.equality apply fastforce\n  by auto\nend\n\ntype_synonym scoreboard = \"score fset\"\ntype_synonym strategy = \"tids \\<Rightarrow> tids \\<Rightarrow> iEFSM \\<Rightarrow> nat\"\n\ndefinition outgoing_transitions :: \"cfstate \\<Rightarrow> iEFSM \\<Rightarrow> (cfstate \\<times> transition \\<times> tids) fset\" where\n  \"outgoing_transitions s e = fimage (\\<lambda>(uid, (from, to), t'). (to, t', uid)) ((ffilter (\\<lambda>(uid, (origin, dest), t). origin = s)) e)\"\n\nprimrec paths_of_length :: \"nat \\<Rightarrow> iEFSM \\<Rightarrow> cfstate \\<Rightarrow> tids list fset\" where\n  \"paths_of_length 0 _ _ = {|[]|}\" |\n  \"paths_of_length (Suc m) e s = (\n    let\n      outgoing = outgoing_transitions s e;\n      paths = ffUnion (fimage (\\<lambda>(d, t, id). fimage (\\<lambda>p. id#p) (paths_of_length m e d)) outgoing)\n    in\n      ffilter (\\<lambda>l. length l = Suc m) paths\n  )\"\n\nlemma paths_of_length_1: \"paths_of_length 1 e s = fimage (\\<lambda>(d, t, id). [id]) (outgoing_transitions s e)\"\n  apply (simp add: One_nat_def)\n  apply (simp add: outgoing_transitions_def comp_def One_nat_def[symmetric])\n  apply (rule fBall_ffilter2)\n   defer\n   apply (simp add: ffilter_def ffUnion_def fBall_def Abs_fset_inverse)\n   apply auto[1]\n  apply (simp add: ffilter_def ffUnion_def fBall_def Abs_fset_inverse fset_both_sides)\n  by force\n\nfun step_score :: \"(tids \\<times> tids) list \\<Rightarrow> iEFSM \\<Rightarrow> strategy \\<Rightarrow> nat\" where\n  \"step_score [] _ _ = 0\" |\n  \"step_score ((id1, id2)#t) e s = (\n    let score = s id1 id2 e in\n    if score = 0 then\n      0\n    else\n      score + (step_score t e s)\n  )\"\n\nlemma step_score_foldr [code]:\n  \"step_score xs e s = foldr (\\<lambda>(id1, id2) acc. let score = s id1 id2 e in\n    if score = 0 then\n      0\n    else\n      score + acc) xs 0\"\nproof(induct xs)\ncase Nil\n  then show ?case\n    by simp\nnext\n  case (Cons a xs)\n  then show ?case\n    apply (cases a, clarify)\n    by (simp add: Let_def)\nqed\n\ndefinition score_from_list :: \"tids list fset \\<Rightarrow> tids list fset \\<Rightarrow> iEFSM \\<Rightarrow> strategy \\<Rightarrow> nat\" where\n  \"score_from_list P1 P2 e s = (\n    let\n      pairs = fimage (\\<lambda>(l1, l2). zip l1 l2) (P1 |\\<times>| P2);\n      scored_pairs = fimage (\\<lambda>l. step_score l e s) pairs\n    in\n    fSum scored_pairs\n  )\"\n\ndefinition k_score :: \"nat \\<Rightarrow> iEFSM \\<Rightarrow> strategy \\<Rightarrow> scoreboard\" where\n  \"k_score k e strat = (\n    let\n      states = S e;\n      pairs_to_score = (ffilter (\\<lambda>(x, y). x < y) (states |\\<times>| states));\n      paths = fimage (\\<lambda>(s1, s2). (s1, s2, paths_of_length k e s1, paths_of_length k e s2)) pairs_to_score;\n      scores = fimage (\\<lambda>(s1, s2, p1, p2). \\<lparr>Score = score_from_list p1 p2 e strat, S1 = s1, S2 = s2\\<rparr>) paths\n    in\n    ffilter (\\<lambda>x. Score x > 0) scores\n)\"\n\ndefinition score_state_pair :: \"strategy \\<Rightarrow> iEFSM \\<Rightarrow> cfstate \\<Rightarrow> cfstate \\<Rightarrow> nat\" where\n  \"score_state_pair strat e s1 s2 = (\n    let\n      T1 = outgoing_transitions s1 e;\n      T2 = outgoing_transitions s2 e\n    in\n      fSum (fimage (\\<lambda>((_, _, t1), (_, _, t2)). strat t1 t2 e) (T1 |\\<times>| T2))\n  )\"\n\ndefinition score_1 :: \"iEFSM \\<Rightarrow> strategy \\<Rightarrow> scoreboard\" where\n  \"score_1 e strat = (\n    let\n      states = S e;\n      pairs_to_score = (ffilter (\\<lambda>(x, y). x < y) (states |\\<times>| states));\n      scores = fimage (\\<lambda>(s1, s2). \\<lparr>Score = score_state_pair strat e s1 s2, S1 = s1, S2 = s2\\<rparr>) pairs_to_score\n    in\n      ffilter (\\<lambda>x. Score x > 0) scores\n  )\"\n\nlemma score_1: \"score_1 e s = k_score 1 e s\"\nproof-\n  have fprod_fimage:\n    \"\\<And>a b. ((\\<lambda>(_, _, id). [id]) |`| a |\\<times>| (\\<lambda>(_, _, id). [id]) |`| b) =\n       fimage (\\<lambda>((_, _, id1), (_, _, id2)). ([id1], [id2])) (a |\\<times>| b)\"\n    apply (simp add: fimage_def fprod_def Abs_fset_inverse fset_both_sides)\n    by force\n  show ?thesis\n    apply (simp add: score_1_def k_score_def Let_def comp_def)\n    apply (rule arg_cong[of _ _ \"ffilter (\\<lambda>x. 0 < Score x)\"])\n    apply (rule fun_cong[of _ _ \"(Inference.S e |\\<times>| Inference.S e)\"])\n    apply (rule ext)\n    subgoal for x\n      apply (rule fun_cong[of _ _ \"ffilter (\\<lambda>a. case a of (a, b) \\<Rightarrow> a < b) x\"])\n      apply (rule arg_cong[of _ _ fimage])\n      apply (rule ext)\n      subgoal for x\n        apply (case_tac x)\n        apply simp\n        apply (simp add: paths_of_length_1)\n        apply (simp add: score_state_pair_def Let_def score_from_list_def comp_def)\n        subgoal for a b\n          apply (rule arg_cong[of _ _ fSum])\n          apply (simp add: fprod_fimage)\n          apply (rule fun_cong[of _ _ \"(outgoing_transitions a e |\\<times>| outgoing_transitions b e)\"])\n          apply (rule arg_cong[of _ _ fimage])\n          apply (rule ext)\n          apply clarify\n          by (simp add: Let_def)\n        done\n      done\n    done\nqed\n\nfun bool2nat :: \"bool \\<Rightarrow> nat\" where\n  \"bool2nat True = 1\" |\n  \"bool2nat False = 0\"\n\ndefinition score_transitions :: \"transition \\<Rightarrow> transition \\<Rightarrow> nat\" where\n  \"score_transitions t1 t2 = (\n    if Label t1 = Label t2 \\<and> Arity t1 = Arity t2 \\<and> length (Outputs t1) = length (Outputs t2) then\n      1 + bool2nat (t1 = t2) + card ((set (Guards t2)) \\<inter> (set (Guards t2))) + card ((set (Updates t2)) \\<inter> (set (Updates t2))) + card ((set (Outputs t2)) \\<inter> (set (Outputs t2)))\n    else\n      0\n  )\"\n\nsubsection\\<open>Merging States\\<close>\ndefinition merge_states_aux :: \"nat \\<Rightarrow> nat \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM\" where\n  \"merge_states_aux s1 s2 e = fimage (\\<lambda>(uid, (origin, dest), t). (uid, (if origin = s1 then s2 else origin , if dest = s1 then s2 else dest), t)) e\"\n\ndefinition merge_states :: \"nat \\<Rightarrow> nat \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM\" where\n  \"merge_states x y t = (if x > y then merge_states_aux x y t else merge_states_aux y x t)\"\n\nlemma merge_states_symmetry: \"merge_states x y t = merge_states y x t\"\n  by (simp add: merge_states_def)\n\nlemma merge_state_self: \"merge_states s s t = t\"\n  apply (simp add: merge_states_def merge_states_aux_def)\n  by force\n\nlemma merge_states_self_simp [code]:\n  \"merge_states x y t = (if x = y then t else if x > y then merge_states_aux x y t else merge_states_aux y x t)\"\n  apply (simp add: merge_states_def merge_states_aux_def)\n  by force\n\nsubsection\\<open>Resolving Nondeterminism\\<close>\ntext\\<open>Because EFSM transitions are not simply atomic actions, duplicated behaviours cannot be\nresolved into a single transition by simply merging destination states, as it can in classical FSM\ninference. It is now possible for attempts to resolve the nondeterminism introduced by merging\nstates to fail, meaning that two states which initially seemed compatible cannot actually be merged.\nThis is not the case in classical FSM inference.\\<close>\n\ntype_synonym nondeterministic_pair = \"(cfstate \\<times> (cfstate \\<times> cfstate) \\<times> ((transition \\<times> tids) \\<times> (transition \\<times> tids)))\"\n\ndefinition state_nondeterminism :: \"nat \\<Rightarrow> (cfstate \\<times> transition \\<times> tids) fset \\<Rightarrow> nondeterministic_pair fset\" where\n  \"state_nondeterminism og nt = (if size nt < 2 then {||} else ffUnion (fimage (\\<lambda>x. let (dest, t) = x in fimage (\\<lambda>y. let (dest', t') = y in (og, (dest, dest'), (t, t'))) (nt - {|x|})) nt))\"\n\nlemma state_nondeterminism_empty [simp]: \"state_nondeterminism a {||} = {||}\"\n  by (simp add: state_nondeterminism_def ffilter_def Set.filter_def)\n\nlemma state_nondeterminism_singledestn [simp]: \"state_nondeterminism a {|x|} = {||}\"\n  by (simp add: state_nondeterminism_def ffilter_def Set.filter_def)\n\n(* For each state, get its outgoing transitions and see if there's any nondeterminism there *)\ndefinition nondeterministic_pairs :: \"iEFSM \\<Rightarrow> nondeterministic_pair fset\" where\n  \"nondeterministic_pairs t = ffilter (\\<lambda>(_, _, (t, _), (t', _)). Label t = Label t' \\<and> Arity t = Arity t' \\<and> choice t t') (ffUnion (fimage (\\<lambda>s. state_nondeterminism s (outgoing_transitions s t)) (S t)))\"\n\ndefinition nondeterministic_pairs_labar_dest :: \"iEFSM \\<Rightarrow> nondeterministic_pair fset\" where\n  \"nondeterministic_pairs_labar_dest t = ffilter\n     (\\<lambda>(_, (d, d'), (t, _), (t', _)).\n      Label t = Label t' \\<and> Arity t = Arity t' \\<and> (choice t t' \\<or> (Outputs t = Outputs t' \\<and> d = d')))\n     (ffUnion (fimage (\\<lambda>s. state_nondeterminism s (outgoing_transitions s t)) (S t)))\"\n\ndefinition nondeterministic_pairs_labar :: \"iEFSM \\<Rightarrow> nondeterministic_pair fset\" where\n  \"nondeterministic_pairs_labar t = ffilter\n     (\\<lambda>(_, (d, d'), (t, _), (t', _)).\n      Label t = Label t' \\<and> Arity t = Arity t' \\<and> (choice t t' \\<or> Outputs t = Outputs t'))\n     (ffUnion (fimage (\\<lambda>s. state_nondeterminism s (outgoing_transitions s t)) (S t)))\"\n\ndefinition deterministic :: \"iEFSM \\<Rightarrow> (iEFSM \\<Rightarrow> nondeterministic_pair fset) \\<Rightarrow> bool\" where\n  \"deterministic t np = (np t = {||})\"\n\ndefinition nondeterministic :: \"iEFSM \\<Rightarrow> (iEFSM \\<Rightarrow> nondeterministic_pair fset) \\<Rightarrow> bool\" where\n  \"nondeterministic t np = (\\<not> deterministic t np)\"\n\ndefinition insert_transition :: \"tids \\<Rightarrow> cfstate \\<Rightarrow> cfstate \\<Rightarrow> transition \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM\" where\n  \"insert_transition uid from to t e = (\n    if \\<nexists>(uid, (from', to'), t') |\\<in>| e. from = from' \\<and> to = to' \\<and> t = t' then\n      finsert (uid, (from, to), t) e\n    else\n      fimage (\\<lambda>(uid', (from', to'), t').\n        if from = from' \\<and> to = to' \\<and> t = t' then\n          (List.union uid' uid, (from', to'), t')\n        else\n          (uid', (from', to'), t')\n      ) e\n  )\"\n\ndefinition make_distinct :: \"iEFSM \\<Rightarrow> iEFSM\" where\n  \"make_distinct e = ffold_ord (\\<lambda>(uid, (from, to), t) acc. insert_transition uid from to t acc) e {||}\"\n\n\\<comment> \\<open>When we replace one transition with another, we need to merge their uids to keep track of which\\<close>\n\\<comment> \\<open>transition accounts for which action in the original traces                                     \\<close>\ndefinition merge_transitions_aux :: \"iEFSM \\<Rightarrow> tids \\<Rightarrow> tids \\<Rightarrow> iEFSM\" where\n  \"merge_transitions_aux e oldID newID = (let\n    (uids1, (origin, dest), old) = fthe_elem (ffilter (\\<lambda>(uids, _). oldID = uids) e);\n    (uids2, (origin, dest), new) = fthe_elem (ffilter (\\<lambda>(uids, _). newID = uids) e) in\n    make_distinct (finsert (List.union uids1 uids2, (origin, dest), new) (e - {|(uids1, (origin, dest), old), (uids2, (origin, dest), new)|}))\n  )\"\n\n(* merge_transitions - Try dest merge transitions t1 and t2 dest help resolve nondeterminism in\n                       newEFSM. If either subsumes the other directly then the subsumed transition\n                       can simply be replaced with the subsuming one, else we try dest apply the\n                       modifier function dest resolve nondeterminism that way.                    *)\n(* @param oldEFSM   - the EFSM before merging the states which caused the nondeterminism          *)\n(* @param preDestMerge   - the EFSM after merging the states which caused the nondeterminism      *)\n(* @param newEFSM   - the current EFSM with nondeterminism                                        *)\n(* @param t1        - a transition dest be merged with t2                                         *)\n(* @param u1        - the unique identifier of t1                                                 *)\n(* @param t2        - a transition dest be merged with t1                                         *)\n(* @param u2        - the unique identifier of t2                                                 *)\n(* @param modifier  - an update modifier function which tries dest generalise transitions         *)\ndefinition merge_transitions :: \"(cfstate \\<times> cfstate) set \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM \\<Rightarrow> transition \\<Rightarrow> tids \\<Rightarrow> transition \\<Rightarrow> tids \\<Rightarrow> update_modifier \\<Rightarrow> (transition_matrix \\<Rightarrow> bool) \\<Rightarrow> iEFSM option\" where\n  \"merge_transitions failedMerges oldEFSM preDestMerge destMerge t1 u1 t2 u2 modifier check = (\n     if \\<forall>id \\<in> set u1. directly_subsumes (tm oldEFSM) (tm destMerge) (origin [id] oldEFSM) (origin u1 destMerge) t2 t1 then\n       \\<comment> \\<open>Replace t1 with t2\\<close>\n       Some (merge_transitions_aux destMerge u1 u2)\n     else if \\<forall>id \\<in> set u2. directly_subsumes (tm oldEFSM) (tm destMerge) (origin [id] oldEFSM) (origin u2 destMerge) t1 t2 then\n       \\<comment> \\<open>Replace t2 with t1\\<close>\n       Some (merge_transitions_aux destMerge u2 u1)\n     else\n        case modifier u1 u2 (origin u1 destMerge) destMerge preDestMerge oldEFSM check of\n          None \\<Rightarrow> None |\n          Some e \\<Rightarrow> Some (make_distinct e)\n   )\"\n\ndefinition outgoing_transitions_from :: \"iEFSM \\<Rightarrow> cfstate \\<Rightarrow> transition fset\" where\n  \"outgoing_transitions_from e s = fimage (\\<lambda>(_, _, t). t) (ffilter (\\<lambda>(_, (orig, _), _). orig = s) e)\"\n\ndefinition order_nondeterministic_pairs :: \"nondeterministic_pair fset \\<Rightarrow> nondeterministic_pair list\" where\n  \"order_nondeterministic_pairs s = map snd (sorted_list_of_fset (fimage (\\<lambda>s. let (_, _, (t1, _), (t2, _)) = s in (score_transitions t1 t2, s)) s))\"\n\n(* resolve_nondeterminism - tries dest resolve nondeterminism in a given iEFSM                      *)\n(* @param ((from, (dest1, dest2), ((t1, u1), (t2, u2)))#ss) - a list of nondeterministic pairs where\n          from - nat - the state from which t1 and t2 eminate\n          dest1  - nat - the destination state of t1\n          dest2  - nat - the destination state of t2\n          t1   - transition - a transition dest be merged with t2\n          t2   - transition - a transition dest be merged with t1\n          u1   - nat - the unique identifier of t1\n          u2   - nat - the unique identifier of t2\n          ss   - list - the rest of the list                                                      *)\n(* @param oldEFSM - the EFSM before merging the states which caused the nondeterminism            *)\n(* @param newEFSM - the current EFSM with nondeterminism                                          *)\n(* @param m       - an update modifier function which tries dest generalise transitions             *)\n(* @param check - a function which takes an EFSM and returns a bool dest ensure that certain\n                  properties hold in the new iEFSM                                                *)\nfunction resolve_nondeterminism :: \"(cfstate \\<times> cfstate) set \\<Rightarrow> nondeterministic_pair list \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM \\<Rightarrow> update_modifier \\<Rightarrow> (transition_matrix \\<Rightarrow> bool) \\<Rightarrow> (iEFSM \\<Rightarrow> nondeterministic_pair fset) \\<Rightarrow> (iEFSM option \\<times> (cfstate \\<times> cfstate) set)\" where\n  \"resolve_nondeterminism failedMerges [] _ newEFSM _ check np = (\n      if deterministic newEFSM np \\<and> check (tm newEFSM) then Some newEFSM else None, failedMerges\n  )\" |\n  \"resolve_nondeterminism failedMerges ((from, (dest1, dest2), ((t1, u1), (t2, u2)))#ss) oldEFSM newEFSM m check np = (\n    if (dest1, dest2) \\<in> failedMerges \\<or> (dest2, dest1) \\<in> failedMerges then\n      (None, failedMerges)\n    else\n    let destMerge = merge_states dest1 dest2 newEFSM in\n    case merge_transitions failedMerges oldEFSM newEFSM destMerge t1 u1 t2 u2 m check of\n      None \\<Rightarrow> resolve_nondeterminism (insert (dest1, dest2) failedMerges) ss oldEFSM newEFSM m check np |\n      Some new \\<Rightarrow> (\n        let newScores = order_nondeterministic_pairs (np new) in\n        if (size new, size (S new), size (newScores)) < (size newEFSM, size (S newEFSM), size ss) then\n          case resolve_nondeterminism failedMerges newScores oldEFSM new m check np of\n            (Some new', failedMerges) \\<Rightarrow> (Some new', failedMerges) |\n            (None, failedMerges) \\<Rightarrow> resolve_nondeterminism (insert (dest1, dest2) failedMerges) ss oldEFSM newEFSM m check np\n        else\n          (None, failedMerges)\n      )\n  )\"\n     apply (clarify, metis neq_Nil_conv prod_cases3 surj_pair)\n  by auto\ntermination\n  by (relation \"measures [\\<lambda>(_, _, _, newEFSM, _). size newEFSM,\n                          \\<lambda>(_, _, _, newEFSM, _). size (S newEFSM),\n                          \\<lambda>(_, ss, _, _, _). size ss]\", auto)\n\nsubsection\\<open>EFSM Inference\\<close>\n\n(* Merge - tries dest merge two states in a given iEFSM and resolve the resulting nondeterminism  *)\n(* @param e     - an iEFSM                                                                        *)\n(* @param s1    - a state dest be merged with s2                                                  *)\n(* @param s2    - a state dest be merged with s1                                                  *)\n(* @param m     - an update modifier function which tries dest generalise transitions             *)\n(* @param check - a function which takes an EFSM and returns a bool dest ensure that certain\n                  properties hold in the new iEFSM                                                *)\ndefinition merge :: \"(cfstate \\<times> cfstate) set \\<Rightarrow> iEFSM \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> update_modifier \\<Rightarrow> (transition_matrix \\<Rightarrow> bool) \\<Rightarrow> (iEFSM \\<Rightarrow> nondeterministic_pair fset) \\<Rightarrow> (iEFSM option \\<times> (cfstate \\<times> cfstate) set)\" where\n  \"merge failedMerges e s1 s2 m check np = (\n    if s1 = s2 \\<or> (s1, s2) \\<in> failedMerges \\<or> (s2, s1) \\<in> failedMerges then\n      (None, failedMerges)\n    else\n      let e' = make_distinct (merge_states s1 s2 e) in\n      resolve_nondeterminism failedMerges (order_nondeterministic_pairs (np e')) e e' m check np\n  )\"\n\n(* inference_step - attempt dest carry out a single step of the inference process by merging the  *)\n(* @param e - an iEFSM dest be generalised                                                        *)\n(* @param ((s, s1, s2)#t) - a list of triples of the form (score, state, state) dest be merged    *)\n(* @param m     - an update modifier function which tries dest generalise transitions             *)\n(* @param check - a function which takes an EFSM and returns a bool dest ensure that certain\n                  properties hold in the new iEFSM                                                *)\nfunction inference_step :: \"(cfstate \\<times> cfstate) set \\<Rightarrow> iEFSM \\<Rightarrow> score fset \\<Rightarrow> update_modifier \\<Rightarrow> (transition_matrix \\<Rightarrow> bool) \\<Rightarrow> (iEFSM \\<Rightarrow> nondeterministic_pair fset) \\<Rightarrow> (iEFSM option \\<times> (cfstate \\<times> cfstate) set)\" where\n  \"inference_step failedMerges e s m check np = (\n     if s = {||} then (None, failedMerges) else\n     let\n      h = fMin s;\n      t = s - {|h|}\n    in\n    case merge failedMerges e (S1 h) (S2 h) m check np of\n      (Some new, failedMerges) \\<Rightarrow> (Some new, failedMerges) |\n      (None, failedMerges) \\<Rightarrow> inference_step (insert ((S1 h), (S2 h)) failedMerges) e t m check np\n  )\"\n  by auto\ntermination\n  apply (relation \"measures [\\<lambda>(_, _, s, _, _, _). size s]\")\n   apply simp\n  by (simp add: card_minus_fMin)\n\n(* Takes an iEFSM and iterates inference_step until no further states can be successfully merged  *)\n(* @param e - an iEFSM dest be generalised                                                        *)\n(* @param r - a strategy dest identify and prioritise pairs of states dest merge                  *)\n(* @param m     - an update modifier function which tries dest generalise transitions             *)\n(* @param check - a function which takes an EFSM and returns a bool dest ensure that certain\n                  properties hold in the new iEFSM                                                *)\nfunction infer :: \"(cfstate \\<times> cfstate) set \\<Rightarrow> nat \\<Rightarrow> iEFSM \\<Rightarrow> strategy \\<Rightarrow> update_modifier \\<Rightarrow> (transition_matrix \\<Rightarrow> bool) \\<Rightarrow> (iEFSM \\<Rightarrow> nondeterministic_pair fset) \\<Rightarrow> iEFSM\" where\n  \"infer failedMerges k e r m check np = (\n    let scores = if k = 1 then score_1 e r else (k_score k e r) in\n    case inference_step failedMerges e (ffilter (\\<lambda>s. (S1 s, S2 s) \\<notin> failedMerges \\<and> (S2 s, S1 s) \\<notin> failedMerges) scores) m check np of\n      (None, _) \\<Rightarrow> e |\n      (Some new, failedMerges) \\<Rightarrow> if (S new) |\\<subset>| (S e) then infer failedMerges k new r m check np else e\n  )\"\n  by auto\ntermination\n  apply (relation \"measures [\\<lambda>(_, _, e, _). size (S e)]\")\n   apply simp\n  by (metis (no_types, lifting) case_prod_conv measures_less size_fsubset)\n\nfun get_ints :: \"trace \\<Rightarrow> int list\" where\n  \"get_ints [] = []\" |\n  \"get_ints ((_, inputs, outputs)#t) = (map (\\<lambda>x. case x of Num n \\<Rightarrow> n) (filter is_Num (inputs@outputs)))\"\n\ndefinition learn :: \"nat \\<Rightarrow> iEFSM \\<Rightarrow> log \\<Rightarrow> strategy \\<Rightarrow> update_modifier \\<Rightarrow> (iEFSM \\<Rightarrow> nondeterministic_pair fset) \\<Rightarrow> iEFSM\" where\n  \"learn n pta l r m np = (\n     let check = accepts_log (set l) in\n         (infer {} n pta r m check np)\n   )\"\n\nsubsection\\<open>Evaluating Inferred Models\\<close>\ntext\\<open>We need a function to test the EFSMs we infer. The \\texttt{test\\_trace} function executes a\ntrace in the model and outputs a more comprehensive trace such that the expected outputs and actual\noutputs can be compared. If a point is reached where the model does not recognise an action, the\nremainder of the trace forms the second element of the output pair such that we know the exact point\nat which the model stopped processing.\\<close>\n\ndefinition i_possible_steps :: \"iEFSM \\<Rightarrow> cfstate \\<Rightarrow> registers \\<Rightarrow> label \\<Rightarrow> inputs \\<Rightarrow> (tids \\<times> cfstate \\<times> transition) fset\" where\n  \"i_possible_steps e s r l i = fimage (\\<lambda>(uid, (origin, dest), t). (uid, dest, t))\n  (ffilter (\\<lambda>(uid, (origin, dest::nat), t::transition).\n      origin = s\n      \\<and> (Label t) = l\n      \\<and> (length i) = (Arity t)\n      \\<and> apply_guards (Guards t) (join_ir i r)\n     )\n    e)\"\n\nfun test_trace :: \"trace \\<Rightarrow> iEFSM \\<Rightarrow> cfstate \\<Rightarrow> registers \\<Rightarrow> ((label \\<times> inputs \\<times> cfstate \\<times> cfstate \\<times> registers \\<times> tids \\<times> value list \\<times> outputs) list \\<times> trace)\" where\n  \"test_trace [] _ _ _ = ([], [])\" |\n  \"test_trace ((l, i, expected)#es) e s r = (\n    let\n      ps = i_possible_steps e s r l i\n    in\n      if fis_singleton ps then\n        let\n          (id, s', t) = fthe_elem ps;\n          r' = evaluate_updates t i r;\n          actual = evaluate_outputs t i r;\n          (est, fail) = (test_trace es e s' r')\n        in\n        ((l, i, s, s', r, id, expected, actual)#est, fail)\n      else\n        ([], (l, i, expected)#es)\n  )\"\n\ntext\\<open>The \\texttt{test\\_log} function executes the \\texttt{test\\_trace} function on a collection of\ntraces known as the \\emph{test set.}\\<close>\ndefinition test_log :: \"log \\<Rightarrow> iEFSM \\<Rightarrow> ((label \\<times> inputs \\<times> cfstate \\<times> cfstate \\<times> registers \\<times> tids \\<times> value list \\<times> outputs) list \\<times> trace) list\" where\n  \"test_log l e = map (\\<lambda>t. test_trace t e 0 <>) l\"\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Extended_Finite_State_Machine_Inference/Inference.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.33629199743303334}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Sep_Cancel\nimports Sep_Provers Sep_Tactic_Helpers Sep_Cancel_Set\nbegin\n\n(* Sep_Cancel performs cancellative elimination of conjuncts *)\n\n\nlemma sep_curry': \"\\<lbrakk>(P \\<and>* F) s; \\<And>s. (Q \\<and>* P \\<and>* F) s \\<Longrightarrow> R s\\<rbrakk> \\<Longrightarrow> (Q \\<longrightarrow>* R) s\"\n  by (metis (full_types) sep.mult_commute sep_curry)\n\nlemma sep_conj_sep_impl_safe: \n  \"(P \\<longrightarrow>* P') s \\<Longrightarrow> (\\<And>s. ((P \\<longrightarrow>* P') \\<and>* Q) s \\<Longrightarrow> (Q') s) \\<Longrightarrow> (Q \\<longrightarrow>* Q') s\" \n  by (rule sep_curry)\n\nlemma  sep_conj_sep_impl_safe': \"P s \\<Longrightarrow> (\\<And>s. (P \\<and>* Q) s \\<Longrightarrow> (P \\<and>* R) s) \\<Longrightarrow> (Q \\<longrightarrow>* P \\<and>* R) s\" \n  by (rule sep_curry)\n\nlemma sep_wand_lens_simple: \"(\\<And>s. T s = (Q \\<and>* R) s) \\<Longrightarrow> (P \\<longrightarrow>* T) s \\<Longrightarrow> (P \\<longrightarrow>* Q \\<and>* R) s\"\n  by (clarsimp simp: sep_impl_def)\n\nschematic_goal schem_impAny: \" (?C \\<and>* B) s \\<Longrightarrow> A s\" by (erule sep_mp)\n\nML {* \n  fun sep_cancel_tactic ctxt concl  = \n    let val thms = rev (SepCancel_Rules.get ctxt)\n        val tac  = assume_tac ctxt ORELSE'\n                   eresolve_tac ctxt [@{thm sep_mp}, @{thm sep_conj_empty}, @{thm sep_empty_conj}] ORELSE'\n                   sep_erule_tactic ctxt thms\n        val direct_tac = eresolve_tac ctxt thms\n        val safe_sep_wand_tac = rotator' ctxt (resolve0_tac [@{thm sep_wand_lens_simple}]) (eresolve0_tac [@{thm sep_conj_sep_impl_safe'}])\n        fun sep_cancel_tactic_inner true   = sep_erule_full_tac' tac ctxt\n          | sep_cancel_tactic_inner false  = sep_erule_full_tac tac ctxt\n  in sep_cancel_tactic_inner concl ORELSE'\n      eresolve_tac ctxt [@{thm sep_curry'}, @{thm sep_conj_sep_impl_safe}, @{thm sep_imp_empty}, @{thm sep_empty_imp'}] ORELSE'\n      safe_sep_wand_tac ORELSE'\n      direct_tac\n  end\n\n  fun sep_cancel_tactic' ctxt concl =\n    let\n      val sep_cancel = sep_cancel_tactic ctxt\n    in \n      (sep_flatten ctxt THEN_ALL_NEW sep_cancel concl) ORELSE' sep_cancel concl\n    end\n\n  fun sep_cancel_method (concl,_) ctxt = SIMPLE_METHOD' (sep_cancel_tactic' ctxt concl)\n  \n  val sep_cancel_syntax =\n    Method.sections [Args.add -- Args.colon >> K (Method.modifier SepCancel_Rules.add @{here})];\n  \n  val sep_cancel_syntax' =\n    Scan.lift (Args.mode \"concl\") -- sep_cancel_syntax  \n*}\n\nmethod_setup sep_cancel = \n  {* sep_cancel_syntax' >> sep_cancel_method *}  {* Simple elimination of conjuncts *}\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/sep_algebra/Sep_Cancel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.33629199743303334}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      Compose.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Experiments on State Composition\"\n\n\ntheory Compose imports \"../HoareTotalProps\" begin\n\ntext \\<open>\nWe develop some theory to support state-space modular development of programs.\nThese experiments aim at the representation of state-spaces with records.\nIf we use \\<open>statespaces\\<close> instead we get this kind of compositionality for free.\n\\<close>\n\n\nsubsection \\<open>Changing the State-Space\\<close>\n\n(* Lift a command on statespace 'b to work on statespace 'a *)\n\ndefinition lift\\<^sub>f:: \"('S \\<Rightarrow> 's) \\<Rightarrow> ('S \\<Rightarrow> 's \\<Rightarrow> 'S) \\<Rightarrow> ('s \\<Rightarrow> 's) \\<Rightarrow> ('S \\<Rightarrow> 'S)\"\n  where \"lift\\<^sub>f prj inject f = (\\<lambda>S. inject S (f (prj S)))\"\n\ndefinition lift\\<^sub>s:: \"('S \\<Rightarrow> 's) \\<Rightarrow> 's set \\<Rightarrow> 'S set\"\n  where \"lift\\<^sub>s prj A = {S. prj S \\<in> A}\"\n\ndefinition lift\\<^sub>r:: \"('S \\<Rightarrow> 's) \\<Rightarrow> ('S \\<Rightarrow> 's \\<Rightarrow> 'S) \\<Rightarrow> ('s \\<times> 's) set\n                       \\<Rightarrow> ('S \\<times> 'S) set\"\nwhere\n\"lift\\<^sub>r prj inject R = {(S,T). (prj S,prj T) \\<in> R \\<and> T=inject S (prj T)}\"\n\n\nprimrec lift\\<^sub>c:: \"('S \\<Rightarrow> 's) \\<Rightarrow> ('S \\<Rightarrow> 's \\<Rightarrow> 'S) \\<Rightarrow> ('s,'p,'f) com \\<Rightarrow> ('S,'p,'f) com\"\nwhere\n\"lift\\<^sub>c prj inject Skip = Skip\" |\n\"lift\\<^sub>c prj inject (Basic f) = Basic (lift\\<^sub>f prj inject f)\" |\n\"lift\\<^sub>c prj inject (Spec r) = Spec (lift\\<^sub>r prj inject r)\" |\n\"lift\\<^sub>c prj inject (Seq c\\<^sub>1 c\\<^sub>2)  =\n  (Seq (lift\\<^sub>c prj inject c\\<^sub>1) (lift\\<^sub>c prj inject c\\<^sub>2))\" |\n\"lift\\<^sub>c prj inject (Cond b c\\<^sub>1 c\\<^sub>2) =\n  Cond (lift\\<^sub>s prj b) (lift\\<^sub>c prj inject c\\<^sub>1) (lift\\<^sub>c prj inject c\\<^sub>2)\" |\n\"lift\\<^sub>c prj inject (While b c) =\n  While (lift\\<^sub>s prj b) (lift\\<^sub>c prj inject c)\" |\n\"lift\\<^sub>c prj inject (Call p) = Call p\" |\n\"lift\\<^sub>c prj inject (DynCom c) = DynCom (\\<lambda>s. lift\\<^sub>c prj inject (c (prj s)))\" |\n\"lift\\<^sub>c prj inject (Guard f g c) = Guard f (lift\\<^sub>s prj g) (lift\\<^sub>c prj inject c)\" |\n\"lift\\<^sub>c prj inject Throw = Throw\" |\n\"lift\\<^sub>c prj inject (Catch c\\<^sub>1 c\\<^sub>2) =\n  Catch (lift\\<^sub>c prj inject c\\<^sub>1) (lift\\<^sub>c prj inject c\\<^sub>2)\"\n\n\n\nlemma lift\\<^sub>c_Skip: \"(lift\\<^sub>c prj inject c = Skip) = (c = Skip)\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Basic:\n  \"(lift\\<^sub>c prj inject c = Basic lf) = (\\<exists>f. c = Basic f \\<and> lf = lift\\<^sub>f prj inject f)\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Spec:\n  \"(lift\\<^sub>c prj inject c = Spec lr) = (\\<exists>r. c = Spec r \\<and> lr = lift\\<^sub>r prj inject r)\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Seq:\n  \"(lift\\<^sub>c prj inject c = Seq lc\\<^sub>1 lc\\<^sub>2) =\n     (\\<exists> c\\<^sub>1 c\\<^sub>2. c = Seq c\\<^sub>1 c\\<^sub>2 \\<and>\n               lc\\<^sub>1 = lift\\<^sub>c prj inject c\\<^sub>1 \\<and> lc\\<^sub>2 = lift\\<^sub>c prj inject c\\<^sub>2 )\"\n    by (cases c) auto\n\nlemma lift\\<^sub>c_Cond:\n  \"(lift\\<^sub>c prj inject c = Cond lb lc\\<^sub>1 lc\\<^sub>2) =\n     (\\<exists>b c\\<^sub>1 c\\<^sub>2. c = Cond b c\\<^sub>1 c\\<^sub>2 \\<and> lb = lift\\<^sub>s prj b \\<and>\n                lc\\<^sub>1 = lift\\<^sub>c prj inject c\\<^sub>1 \\<and> lc\\<^sub>2 = lift\\<^sub>c prj inject c\\<^sub>2 )\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_While:\n  \"(lift\\<^sub>c prj inject c = While lb lc') =\n     (\\<exists>b c'. c = While b c' \\<and> lb = lift\\<^sub>s prj b \\<and>\n               lc' = lift\\<^sub>c prj inject c')\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Call:\n  \"(lift\\<^sub>c prj inject c = Call p) = (c = Call p)\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_DynCom:\n  \"(lift\\<^sub>c prj inject c = DynCom lc) =\n     (\\<exists>C. c=DynCom C \\<and> lc = (\\<lambda>s. lift\\<^sub>c prj inject (C (prj s))))\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Guard:\n  \"(lift\\<^sub>c prj inject c = Guard f lg lc') =\n     (\\<exists>g c'. c = Guard f g c' \\<and> lg = lift\\<^sub>s prj g \\<and>\n             lc' = lift\\<^sub>c prj inject c')\"\n   by (cases c) auto\n\nlemma lift\\<^sub>c_Throw:\n  \"(lift\\<^sub>c prj inject c = Throw) = (c = Throw)\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Catch:\n  \"(lift\\<^sub>c prj inject c = Catch lc\\<^sub>1 lc\\<^sub>2) =\n     (\\<exists> c\\<^sub>1 c\\<^sub>2. c = Catch c\\<^sub>1 c\\<^sub>2 \\<and>\n               lc\\<^sub>1 = lift\\<^sub>c prj inject c\\<^sub>1 \\<and> lc\\<^sub>2 = lift\\<^sub>c prj inject c\\<^sub>2 )\"\n    by (cases c) auto\n\n\n\ndefinition xstate_map:: \"('S \\<Rightarrow> 's) \\<Rightarrow> ('S,'f) xstate \\<Rightarrow> ('s,'f) xstate\"\nwhere\n\"xstate_map g x = (case x of\n                      Normal s \\<Rightarrow> Normal (g s)\n                    | Abrupt s \\<Rightarrow> Abrupt (g s)\n                    | Fault f \\<Rightarrow> Fault f\n                    | Stuck \\<Rightarrow> Stuck)\"\n\nlemma xstate_map_simps [simp]:\n\"xstate_map g (Normal s) = Normal (g s)\"\n\"xstate_map g (Abrupt s) = Abrupt (g s)\"\n\"xstate_map g (Fault f) = (Fault f)\"\n\"xstate_map g Stuck = Stuck\"\n  by (auto simp add: xstate_map_def)\n\nlemma xstate_map_Normal_conv:\n  \"xstate_map g S = Normal s = (\\<exists>s'. S=Normal s' \\<and> s = g s')\"\n  by (cases S) auto\n\nlemma xstate_map_Abrupt_conv:\n  \"xstate_map g S = Abrupt s = (\\<exists>s'. S=Abrupt s' \\<and> s = g s')\"\n  by (cases S) auto\n\nlemma xstate_map_Fault_conv:\n  \"xstate_map g S = Fault f = (S=Fault f)\"\n  by (cases S) auto\n\nlemma xstate_map_Stuck_conv:\n  \"xstate_map g S = Stuck = (S=Stuck)\"\n  by (cases S) auto\n\nlemmas xstate_map_convs = xstate_map_Normal_conv xstate_map_Abrupt_conv\n xstate_map_Fault_conv xstate_map_Stuck_conv\n\ndefinition state:: \"('s,'f) xstate \\<Rightarrow> 's\"\nwhere\n\"state x = (case x of\n               Normal s \\<Rightarrow> s\n             | Abrupt s \\<Rightarrow> s\n             | Fault g \\<Rightarrow> undefined\n             | Stuck \\<Rightarrow> undefined)\"\n\nlemma state_simps [simp]:\n\"state (Normal s) = s\"\n\"state (Abrupt s) = s\"\n  by (auto simp add: state_def )\n\n\nlocale lift_state_space =\n  fixes project::\"'S \\<Rightarrow> 's\"\n  fixes \"inject\"::\"'S \\<Rightarrow> 's \\<Rightarrow> 'S\"\n  fixes \"project\\<^sub>x\"::\"('S,'f) xstate \\<Rightarrow> ('s,'f) xstate\"\n  fixes \"lift\\<^sub>e\"::\"('s,'p,'f) body \\<Rightarrow> ('S,'p,'f) body\"\n  fixes lift\\<^sub>c:: \"('s,'p,'f) com \\<Rightarrow> ('S,'p,'f) com\"\n  fixes lift\\<^sub>f:: \"('s \\<Rightarrow> 's) \\<Rightarrow> ('S \\<Rightarrow> 'S)\"\n  fixes lift\\<^sub>s:: \"'s set \\<Rightarrow> 'S set\"\n  fixes lift\\<^sub>r:: \"('s \\<times> 's) set \\<Rightarrow> ('S \\<times> 'S) set\"\n  assumes proj_inj_commute: \"\\<And>S s.  project (inject S s) = s\"\n  defines \"lift\\<^sub>c \\<equiv> Compose.lift\\<^sub>c project inject\"\n  defines \"project\\<^sub>x \\<equiv> xstate_map project\"\n  defines \"lift\\<^sub>e \\<equiv> (\\<lambda>\\<Gamma> p. map_option lift\\<^sub>c (\\<Gamma> p))\"\n  defines \"lift\\<^sub>f \\<equiv> Compose.lift\\<^sub>f project inject\"\n  defines \"lift\\<^sub>s \\<equiv> Compose.lift\\<^sub>s project\"\n  defines \"lift\\<^sub>r \\<equiv> Compose.lift\\<^sub>r project inject\"\n\n\nlemma (in lift_state_space) lift\\<^sub>f_simp:\n \"lift\\<^sub>f f \\<equiv> \\<lambda>S. inject S (f (project S))\"\n  by (simp add: lift\\<^sub>f_def Compose.lift\\<^sub>f_def)\n\nlemma (in lift_state_space) lift\\<^sub>s_simp:\n  \"lift\\<^sub>s A \\<equiv> {S. project S \\<in> A}\"\n  by  (simp add: lift\\<^sub>s_def Compose.lift\\<^sub>s_def)\n\nlemma (in lift_state_space) lift\\<^sub>r_simp:\n\"lift\\<^sub>r R \\<equiv> {(S,T). (project S,project T) \\<in> R \\<and> T=inject S (project T)}\"\n  by  (simp add: lift\\<^sub>r_def Compose.lift\\<^sub>r_def)\n\n(* Causes loop when instantiating locale\nlemmas (in lift_state_space) lift\\<^sub>f_simp  = Compose.lift\\<^sub>f_def\n [of project \"inject\", folded lift\\<^sub>f_def]\nlemmas (in lift_state_space) lift\\<^sub>s_simp  = Compose.lift\\<^sub>s_def\n [of project, folded lift\\<^sub>s_def]\nlemmas (in lift_state_space) lift\\<^sub>r_simp  = Compose.lift\\<^sub>r_def\n [of project \"inject\", folded lift\\<^sub>r_def]\n*)\nlemma (in lift_state_space) lift\\<^sub>c_Skip_simp [simp]:\n \"lift\\<^sub>c Skip = Skip\"\n  by (simp add: lift\\<^sub>c_def)\nlemma (in lift_state_space) lift\\<^sub>c_Basic_simp [simp]:\n\"lift\\<^sub>c (Basic f) = Basic (lift\\<^sub>f f)\"\n  by (simp add: lift\\<^sub>c_def lift\\<^sub>f_def)\nlemma (in lift_state_space) lift\\<^sub>c_Spec_simp [simp]:\n\"lift\\<^sub>c (Spec r) = Spec (lift\\<^sub>r r)\"\n  by (simp add: lift\\<^sub>c_def lift\\<^sub>r_def)\nlemma (in lift_state_space) lift\\<^sub>c_Seq_simp [simp]:\n\"lift\\<^sub>c (Seq c\\<^sub>1 c\\<^sub>2)  =\n  (Seq (lift\\<^sub>c c\\<^sub>1) (lift\\<^sub>c c\\<^sub>2))\"\n  by (simp add: lift\\<^sub>c_def)\nlemma (in lift_state_space) lift\\<^sub>c_Cond_simp [simp]:\n\"lift\\<^sub>c (Cond b c\\<^sub>1 c\\<^sub>2) =\n  Cond (lift\\<^sub>s b) (lift\\<^sub>c c\\<^sub>1) (lift\\<^sub>c c\\<^sub>2)\"\n  by (simp add: lift\\<^sub>c_def lift\\<^sub>s_def)\nlemma (in lift_state_space) lift\\<^sub>c_While_simp [simp]:\n\"lift\\<^sub>c (While b c) =\n  While (lift\\<^sub>s b) (lift\\<^sub>c c)\"\n  by (simp add: lift\\<^sub>c_def lift\\<^sub>s_def)\nlemma (in lift_state_space) lift\\<^sub>c_Call_simp [simp]:\n\"lift\\<^sub>c (Call p) = Call p\"\n  by (simp add: lift\\<^sub>c_def)\nlemma (in lift_state_space) lift\\<^sub>c_DynCom_simp [simp]:\n\"lift\\<^sub>c (DynCom c) = DynCom (\\<lambda>s. lift\\<^sub>c (c (project s)))\"\n  by (simp add: lift\\<^sub>c_def)\nlemma (in lift_state_space) lift\\<^sub>c_Guard_simp [simp]:\n\"lift\\<^sub>c (Guard f g c) = Guard f (lift\\<^sub>s g) (lift\\<^sub>c c)\"\n  by (simp add: lift\\<^sub>c_def lift\\<^sub>s_def)\nlemma (in lift_state_space) lift\\<^sub>c_Throw_simp [simp]:\n\"lift\\<^sub>c Throw = Throw\"\n  by (simp add: lift\\<^sub>c_def)\nlemma (in lift_state_space) lift\\<^sub>c_Catch_simp [simp]:\n\"lift\\<^sub>c (Catch c\\<^sub>1 c\\<^sub>2) =\n  Catch (lift\\<^sub>c c\\<^sub>1) (lift\\<^sub>c c\\<^sub>2)\"\n  by (simp add: lift\\<^sub>c_def)\n\nlemma (in lift_state_space) project\\<^sub>x_def':\n\"project\\<^sub>x s \\<equiv> (case s of\n                 Normal s \\<Rightarrow> Normal (project s)\n                | Abrupt s \\<Rightarrow> Abrupt (project s)\n                | Fault f \\<Rightarrow> Fault f\n                | Stuck \\<Rightarrow> Stuck)\"\n  by (simp add: xstate_map_def project\\<^sub>x_def)\n\nlemma (in lift_state_space) lift\\<^sub>e_def':\n  \"lift\\<^sub>e \\<Gamma> p \\<equiv> (case \\<Gamma> p of Some bdy \\<Rightarrow> Some (lift\\<^sub>c bdy) | None \\<Rightarrow> None)\"\n  by (simp add: lift\\<^sub>e_def map_option_case)\n\n\n\n\ntext \\<open>\nThe problem is that @{term \"(lift\\<^sub>c project inject \\<circ> \\<Gamma>)\"} is quite\na strong premise. The problem is that @{term \"\\<Gamma>\"} is a function here.\nA map would be better. We only have to lift those procedures in the domain\nof @{term \"\\<Gamma>\"}:\n\\<open>\\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' p = Some lift\\<^sub>c project inject bdy\\<close>.\nWe then can com up with theorems that allow us to extend the domains\nof @{term \\<Gamma>} and preserve validity.\n\\<close>\n\n\nlemma (in lift_state_space)\n\"{(S,T). \\<exists>t. (project S,t) \\<in> r \\<and> T=inject S t}\n \\<subseteq> {(S,T). (project S,project T) \\<in> r \\<and> T=inject S (project T)}\"\n  apply clarsimp\n  apply (rename_tac S t)\n  apply (simp add: proj_inj_commute)\n  done\n\nlemma (in lift_state_space)\n\"{(S,T). (project S,project T) \\<in> r \\<and> T=inject S (project T)}\n \\<subseteq> {(S,T). \\<exists>t. (project S,t) \\<in> r \\<and> T=inject S t}\"\n  apply clarsimp\n  apply (rename_tac S T)\n  apply (rule_tac x=\"project T\" in exI)\n  apply simp\n  done\n\n\nlemma (in lift_state_space) lift_exec:\nassumes exec_lc: \"(lift\\<^sub>e \\<Gamma>)\\<turnstile>\\<langle>lc,s\\<rangle> \\<Rightarrow> t\"\nshows \"\\<And>c. \\<lbrakk> lift\\<^sub>c c = lc\\<rbrakk> \\<Longrightarrow>\n              \\<Gamma>\\<turnstile>\\<langle>c,project\\<^sub>x s\\<rangle> \\<Rightarrow>  project\\<^sub>x t\"\nusing exec_lc\nproof (induct)\n  case Skip thus ?case\n    by (auto simp add: project\\<^sub>x_def lift\\<^sub>c_Skip lift\\<^sub>c_def intro: exec.Skip)\nnext\n  case Guard thus ?case\n    by (auto simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def lift\\<^sub>c_Guard lift\\<^sub>c_def\n      intro: exec.Guard)\nnext\n  case GuardFault thus ?case\n    by (auto simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def lift\\<^sub>c_Guard lift\\<^sub>c_def\n      intro: exec.GuardFault)\nnext\n  case FaultProp thus ?case\n    by (fastforce simp add: project\\<^sub>x_def)\nnext\n  case Basic\n  thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Basic lift\\<^sub>f_def Compose.lift\\<^sub>f_def\n      lift\\<^sub>c_def\n        proj_inj_commute\n        intro: exec.Basic)\nnext\n  case Spec\n  thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Spec lift\\<^sub>f_def Compose.lift\\<^sub>f_def\n        lift\\<^sub>r_def Compose.lift\\<^sub>r_def lift\\<^sub>c_def\n        proj_inj_commute\n        intro: exec.Spec)\nnext\n  case (SpecStuck s r)\n  thus ?case\n    apply (simp add: project\\<^sub>x_def)\n    apply (clarsimp simp add: lift\\<^sub>c_Spec lift\\<^sub>c_def)\n    apply (unfold lift\\<^sub>r_def Compose.lift\\<^sub>r_def)\n    apply (rule exec.SpecStuck)\n    apply (rule allI)\n    apply (erule_tac x=\"inject s t\" in allE)\n    apply clarsimp\n    apply (simp add: proj_inj_commute)\n    done\nnext\n  case Seq\n  thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Seq lift\\<^sub>c_def intro: exec.intros)\nnext\n  case CondTrue\n  thus ?case\n     by (auto simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def lift\\<^sub>c_Cond lift\\<^sub>c_def\n         intro: exec.CondTrue)\nnext\n  case CondFalse\n  thus ?case\n     by (auto simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def lift\\<^sub>c_Cond lift\\<^sub>c_def\n         intro: exec.CondFalse)\nnext\n  case WhileTrue\n  thus ?case\n     by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def\n         lift\\<^sub>c_While lift\\<^sub>c_def\n         intro: exec.WhileTrue)\nnext\n  case WhileFalse\n  thus ?case\n     by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def\n         lift\\<^sub>c_While lift\\<^sub>c_def\n         intro: exec.WhileFalse)\nnext\n  case Call\n  thus ?case\n    by (fastforce simp add:\n               project\\<^sub>x_def lift\\<^sub>c_Call lift\\<^sub>f_def Compose.lift\\<^sub>f_def lift\\<^sub>c_def\n               lift\\<^sub>e_def\n          intro: exec.Call)\nnext\n  case CallUndefined\n  thus ?case\n    by (fastforce simp add:\n               project\\<^sub>x_def lift\\<^sub>c_Call lift\\<^sub>f_def Compose.lift\\<^sub>f_def lift\\<^sub>c_def\n               lift\\<^sub>e_def\n          intro: exec.CallUndefined)\nnext\n  case StuckProp thus ?case\n    by (fastforce simp add: project\\<^sub>x_def)\nnext\n  case DynCom\n  thus ?case\n    by (fastforce simp add:\n               project\\<^sub>x_def lift\\<^sub>c_DynCom lift\\<^sub>f_def Compose.lift\\<^sub>f_def lift\\<^sub>c_def\n          intro: exec.DynCom)\nnext\n  case Throw thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Throw lift\\<^sub>c_def intro: exec.Throw)\nnext\n  case AbruptProp thus ?case\n    by (fastforce simp add: project\\<^sub>x_def)\nnext\n  case CatchMatch\n  thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Catch lift\\<^sub>c_def intro: exec.CatchMatch)\nnext\n  case (CatchMiss c\\<^sub>1 s t c\\<^sub>2 c)\n  thus ?case\n    by (cases t)\n       (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Catch lift\\<^sub>c_def intro: exec.CatchMiss)+\nqed\n\nlemma (in lift_state_space) lift_exec':\nassumes exec_lc: \"(lift\\<^sub>e \\<Gamma>)\\<turnstile>\\<langle>lift\\<^sub>c c,s\\<rangle> \\<Rightarrow> t\"\nshows \"\\<Gamma>\\<turnstile>\\<langle>c,project\\<^sub>x s\\<rangle> \\<Rightarrow> project\\<^sub>x t\"\n  using lift_exec [OF exec_lc]\n  by simp\n\n\n\nlemma (in lift_state_space) lift_valid:\n  assumes valid: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows\n   \"(lift\\<^sub>e \\<Gamma>)\\<Turnstile>\\<^bsub>/F\\<^esub> (lift\\<^sub>s P) (lift\\<^sub>c c) (lift\\<^sub>s Q),(lift\\<^sub>s A)\"\nproof (rule validI)\n  fix s t\n  assume lexec:\n    \"(lift\\<^sub>e \\<Gamma>)\\<turnstile>\\<langle>lift\\<^sub>c c,Normal s\\<rangle> \\<Rightarrow> t\"\n  assume lP: \"s \\<in> lift\\<^sub>s P\"\n  assume noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` lift\\<^sub>s Q \\<union> Abrupt ` lift\\<^sub>s A\"\n  proof -\n    from lexec\n    have \"\\<Gamma>\\<turnstile> \\<langle>c,project\\<^sub>x (Normal s)\\<rangle> \\<Rightarrow> (project\\<^sub>x t)\"\n      by (rule lift_exec) (simp_all)\n    moreover\n    from lP have \"project s \\<in> P\"\n      by (simp add: lift\\<^sub>s_def Compose.lift\\<^sub>s_def project\\<^sub>x_def)\n    ultimately\n    have \"project\\<^sub>x t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      using valid noFault\n      apply (clarsimp simp add: valid_def project\\<^sub>x_def)\n      apply (cases t)\n      apply auto\n      done\n    thus ?thesis\n      apply (simp add: lift\\<^sub>s_def Compose.lift\\<^sub>s_def)\n      apply (cases t)\n      apply (auto simp add: project\\<^sub>x_def)\n      done\n  qed\nqed\n\nlemma (in lift_state_space) lift_hoarep:\n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows\n   \"(lift\\<^sub>e \\<Gamma>),{}\\<turnstile>\\<^bsub>/F\\<^esub> (lift\\<^sub>s P) (lift\\<^sub>c c) (lift\\<^sub>s Q),(lift\\<^sub>s A)\"\napply (rule hoare_complete)\napply (insert hoare_sound [OF deriv])\napply (rule lift_valid)\napply (simp add: cvalid_def)\ndone\n\nlemma (in lift_state_space) lift_hoarep':\n  \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) c (Q Z),(A Z) \\<Longrightarrow>\n    \\<forall>Z. (lift\\<^sub>e \\<Gamma>),{}\\<turnstile>\\<^bsub>/F\\<^esub> (lift\\<^sub>s (P Z)) (lift\\<^sub>c c)\n                                  (lift\\<^sub>s (Q Z)),(lift\\<^sub>s (A Z))\"\napply (iprover intro: lift_hoarep)\ndone\n\n\n\nlemma (in lift_state_space) lift_termination:\nassumes termi: \"\\<Gamma>\\<turnstile>c\\<down>s\"\nshows \"\\<And>S. project\\<^sub>x S = s \\<Longrightarrow>\n  lift\\<^sub>e \\<Gamma> \\<turnstile>(lift\\<^sub>c c)\\<down>S\"\n  using termi\nproof (induct)\n  case Skip thus ?case\n    by (clarsimp simp add: terminates.Skip project\\<^sub>x_def xstate_map_convs)\nnext\n  case Basic thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs intro: terminates.intros)\nnext\n  case Spec thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs intro: terminates.intros)\nnext\n  case Guard thus ?case\n    by (auto simp add: project\\<^sub>x_def xstate_map_convs intro: terminates.intros)\nnext\n  case GuardFault thus ?case\n    by (auto simp add: project\\<^sub>x_def xstate_map_convs lift\\<^sub>s_def Compose.lift\\<^sub>s_def\n           intro: terminates.intros)\nnext\n  case Fault thus ?case by (clarsimp simp add: project\\<^sub>x_def xstate_map_convs)\nnext\n  case (Seq c1 s c2)\n  have \"project\\<^sub>x S = Normal s\" by fact\n  then obtain s' where S: \"S=Normal s'\" and s: \"s = project s'\"\n    by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n  from Seq have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c1 \\<down> S\"\n    by simp\n  moreover\n  {\n    fix w\n    assume exec_lc1: \"lift\\<^sub>e \\<Gamma>\\<turnstile>\\<langle>lift\\<^sub>c c1,Normal s'\\<rangle> \\<Rightarrow> w\"\n    have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c2 \\<down> w\"\n    proof (cases w)\n      case (Normal w')\n      with lift_exec [where c=c1, OF exec_lc1] s\n      have \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow> Normal (project w')\"\n        by (simp add: project\\<^sub>x_def)\n      from Seq.hyps (3) [rule_format, OF this] Normal\n      show \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c2 \\<down> w\"\n        by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n    qed (auto)\n  }\n  ultimately show ?case\n    using S s\n    by (auto intro: terminates.intros)\nnext\n  case CondTrue thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def xstate_map_convs\n      intro: terminates.intros)\nnext\n  case CondFalse thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def xstate_map_convs\n      intro: terminates.intros)\nnext\n  case (WhileTrue s b c)\n  have \"project\\<^sub>x S = Normal s\" by fact\n  then obtain s' where S: \"S=Normal s'\" and s: \"s = project s'\"\n    by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n  from WhileTrue have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c \\<down> S\"\n    by simp\n  moreover\n  {\n    fix w\n    assume exec_lc: \"lift\\<^sub>e \\<Gamma>\\<turnstile>\\<langle>lift\\<^sub>c c,Normal s'\\<rangle> \\<Rightarrow> w\"\n    have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c (While b c) \\<down> w\"\n    proof (cases w)\n      case (Normal w')\n      with lift_exec [where c=c, OF exec_lc] s\n      have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal (project w')\"\n        by (simp add: project\\<^sub>x_def)\n      from WhileTrue.hyps (4) [rule_format, OF this] Normal\n      show \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c (While b c) \\<down> w\"\n        by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n    qed (auto)\n  }\n  ultimately show ?case\n    using S s\n    by (auto intro: terminates.intros)\nnext\n  case WhileFalse thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def xstate_map_convs\n      intro: terminates.intros)\nnext\n  case Call thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs lift\\<^sub>e_def\n      intro: terminates.intros)\nnext\n  case CallUndefined thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs lift\\<^sub>e_def\n      intro: terminates.intros)\nnext\n  case Stuck thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs)\nnext\n  case DynCom thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs\n      intro: terminates.intros)\nnext\n  case Throw thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs\n      intro: terminates.intros)\nnext\n  case Abrupt thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs\n      intro: terminates.intros)\nnext\n  case (Catch c1 s c2)\n  have \"project\\<^sub>x S = Normal s\" by fact\n  then obtain s' where S: \"S=Normal s'\" and s: \"s = project s'\"\n    by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n  from Catch have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c1 \\<down> S\"\n    by simp\n  moreover\n  {\n    fix w\n    assume exec_lc1: \"lift\\<^sub>e \\<Gamma>\\<turnstile>\\<langle>lift\\<^sub>c c1,Normal s'\\<rangle> \\<Rightarrow> Abrupt w\"\n    have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c2 \\<down> Normal w\"\n    proof -\n      from lift_exec [where c=c1, OF exec_lc1] s\n      have \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow> Abrupt (project w)\"\n        by (simp add: project\\<^sub>x_def)\n      from Catch.hyps (3) [rule_format, OF this]\n      show \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c2 \\<down> Normal w\"\n        by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n    qed\n  }\n  ultimately show ?case\n    using S s\n    by (auto intro: terminates.intros)\nqed\n\nlemma (in lift_state_space) lift_termination':\nassumes termi: \"\\<Gamma>\\<turnstile>c\\<down>project\\<^sub>x S\"\nshows \"lift\\<^sub>e \\<Gamma> \\<turnstile>(lift\\<^sub>c c)\\<down>S\"\n  using lift_termination [OF termi]\n  by iprover\n\n\nlemma (in lift_state_space) lift_validt:\n  assumes valid: \"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"(lift\\<^sub>e \\<Gamma>)\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (lift\\<^sub>s P) (lift\\<^sub>c c) (lift\\<^sub>s Q),(lift\\<^sub>s A)\"\nproof -\n  from valid\n  have \"(lift\\<^sub>e \\<Gamma>)\\<Turnstile>\\<^bsub>/F\\<^esub> (lift\\<^sub>s P) (lift\\<^sub>c c) (lift\\<^sub>s Q),(lift\\<^sub>s A)\"\n    by (auto intro: lift_valid simp add: validt_def)\n  moreover\n  {\n    fix S\n    assume \"S \\<in> lift\\<^sub>s P\"\n    hence \"project S \\<in> P\"\n      by (simp add: lift\\<^sub>s_def Compose.lift\\<^sub>s_def)\n    with valid have \"\\<Gamma>\\<turnstile>c \\<down> project\\<^sub>x (Normal S)\"\n      by (simp add: validt_def project\\<^sub>x_def)\n    hence \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c \\<down> Normal S\"\n      by (rule lift_termination')\n  }\n  ultimately show ?thesis\n    by (simp add: validt_def)\nqed\n\nlemma (in lift_state_space) lift_hoaret:\n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows\n   \"(lift\\<^sub>e \\<Gamma>),{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (lift\\<^sub>s P) (lift\\<^sub>c c) (lift\\<^sub>s Q),(lift\\<^sub>s A)\"\napply (rule hoaret_complete)\napply (insert hoaret_sound [OF deriv])\napply (rule lift_validt)\napply (simp add: cvalidt_def)\ndone\n\n\nlocale lift_state_space_ext = lift_state_space +\n  assumes inj_proj_commute: \"\\<And>S. inject S (project S) = S\"\n  assumes inject_last: \"\\<And>S s t. inject (inject S s) t = inject S t\"\n\n\n(* \\<exists>x. state t = inject (state s) x *)\nlemma (in lift_state_space_ext) lift_exec_inject_same:\nassumes exec_lc: \"(lift\\<^sub>e \\<Gamma>)\\<turnstile>\\<langle>lc,s\\<rangle> \\<Rightarrow> t\"\nshows \"\\<And>c. \\<lbrakk>lift\\<^sub>c c = lc; t \\<notin> (Fault ` UNIV) \\<union> {Stuck}\\<rbrakk> \\<Longrightarrow>\n              state t = inject (state s) (project (state t))\"\nusing exec_lc\nproof (induct)\n  case Skip thus ?case\n    by (clarsimp simp add: inj_proj_commute)\nnext\n  case Guard thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_Guard lift\\<^sub>c_def)\nnext\n  case GuardFault thus ?case\n    by simp\nnext\n  case FaultProp thus ?case by simp\nnext\n  case Basic thus ?case\n    by (clarsimp simp add: lift\\<^sub>f_def Compose.lift\\<^sub>f_def\n        proj_inj_commute lift\\<^sub>c_Basic lift\\<^sub>c_def)\nnext\n  case (Spec r) thus ?case\n    by (clarsimp simp add: Compose.lift\\<^sub>r_def lift\\<^sub>c_Spec lift\\<^sub>c_def)\nnext\n  case SpecStuck\n  thus ?case by simp\nnext\n  case (Seq lc1 s s' lc2 t c)\n  have t: \"t \\<notin> Fault ` UNIV \\<union> {Stuck}\" by fact\n  have \"lift\\<^sub>c c = Seq lc1 lc2\" by fact\n  then obtain c1 c2 where\n    c: \"c = Seq c1 c2\" and\n    lc1: \"lc1 = lift\\<^sub>c c1\" and\n    lc2: \"lc2 = lift\\<^sub>c c2\"\n    by (auto simp add: lift\\<^sub>c_Seq lift\\<^sub>c_def)\n  show ?case\n  proof (cases s')\n    case (Normal s'')\n    from Seq.hyps (2) [OF lc1 [symmetric]] this\n    have \"s'' = inject s (project s'')\"\n      by auto\n    moreover from Seq.hyps (4) [OF lc2 [symmetric]] Normal t\n    have \"state t = inject s'' (project (state t))\"\n      by auto\n    ultimately have \"state t = inject (inject s (project s'')) (project (state t))\"\n      by simp\n    then show ?thesis\n      by (simp add: inject_last)\n  next\n    case (Abrupt s'')\n    from Seq.hyps (2) [OF lc1 [symmetric]] this\n    have \"s'' = inject s (project s'')\"\n      by auto\n    moreover from Seq.hyps (4) [OF lc2 [symmetric]] Abrupt t\n    have \"state t = inject s'' (project (state t))\"\n      by auto\n    ultimately have \"state t = inject (inject s (project s'')) (project (state t))\"\n      by simp\n    then show ?thesis\n      by (simp add: inject_last)\n  next\n    case (Fault f)\n    with Seq\n    have \"t = Fault f\"\n      by (auto dest: Fault_end)\n    with t have False by simp\n    thus ?thesis ..\n  next\n    case Stuck\n    with Seq\n    have \"t = Stuck\"\n      by (auto dest: Stuck_end)\n    with t have False by simp\n    thus ?thesis ..\n  qed\nnext\n  case CondTrue thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_Cond lift\\<^sub>c_def)\nnext\n  case CondFalse thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_Cond lift\\<^sub>c_def)\nnext\n  case (WhileTrue s lb lc' s' t c)\n  have t: \"t \\<notin> Fault ` UNIV \\<union> {Stuck}\" by fact\n  have lw: \"lift\\<^sub>c c = While lb lc'\" by fact\n  then obtain b c' where\n    c: \"c = While b c'\" and\n    lb: \"lb = lift\\<^sub>s b\" and\n    lc: \"lc' = lift\\<^sub>c c'\"\n    by (auto simp add: lift\\<^sub>c_While lift\\<^sub>s_def lift\\<^sub>c_def)\n  show ?case\n  proof (cases s')\n    case (Normal s'')\n    from WhileTrue.hyps (3) [OF lc [symmetric]] this\n    have \"s'' = inject s (project s'')\"\n      by auto\n    moreover from WhileTrue.hyps (5) [OF lw] Normal t\n    have \"state t = inject s'' (project (state t))\"\n      by auto\n    ultimately have \"state t = inject (inject s (project s'')) (project (state t))\"\n      by simp\n    then show ?thesis\n      by (simp add: inject_last)\n  next\n    case (Abrupt s'')\n    from WhileTrue.hyps (3) [OF lc [symmetric]] this\n    have \"s'' = inject s (project s'')\"\n      by auto\n    moreover from WhileTrue.hyps (5) [OF lw] Abrupt t\n    have \"state t = inject s'' (project (state t))\"\n      by auto\n    ultimately have \"state t = inject (inject s (project s'')) (project (state t))\"\n      by simp\n    then show ?thesis\n      by (simp add: inject_last)\n  next\n    case (Fault f)\n    with WhileTrue\n    have \"t = Fault f\"\n      by (auto dest: Fault_end)\n    with t have False by simp\n    thus ?thesis ..\n  next\n    case Stuck\n    with WhileTrue\n    have \"t = Stuck\"\n      by (auto dest: Stuck_end)\n    with t have False by simp\n    thus ?thesis ..\n  qed\nnext\n  case WhileFalse thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_While inj_proj_commute)\nnext\n  case Call thus ?case\n    by (clarsimp simp add: inject_last lift\\<^sub>c_Call lift\\<^sub>e_def lift\\<^sub>c_def)\nnext\n  case CallUndefined thus ?case by simp\nnext\n  case StuckProp thus ?case by simp\nnext\n  case DynCom\n  thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_DynCom lift\\<^sub>c_def)\nnext\n  case Throw thus ?case\n    by (simp add: inj_proj_commute)\nnext\n  case AbruptProp thus ?case by (simp add: inj_proj_commute)\nnext\n  case (CatchMatch lc1 s s' lc2 t c)\n  have t: \"t \\<notin> Fault ` UNIV \\<union> {Stuck}\" by fact\n  have \"lift\\<^sub>c c = Catch lc1 lc2\" by fact\n  then obtain c1 c2 where\n    c: \"c = Catch c1 c2\" and\n    lc1: \"lc1 = lift\\<^sub>c c1\" and\n    lc2: \"lc2 = lift\\<^sub>c c2\"\n    by (auto simp add: lift\\<^sub>c_Catch lift\\<^sub>c_def)\n  from CatchMatch.hyps (2) [OF lc1 [symmetric]] this\n  have \"s' = inject s (project s')\"\n    by auto\n  moreover\n  from CatchMatch.hyps (4) [OF lc2 [symmetric]] t\n  have \"state t = inject s' (project (state t))\"\n    by auto\n  ultimately have \"state t = inject (inject s (project s')) (project (state t))\"\n    by simp\n  then show ?case\n    by (simp add: inject_last)\nnext\n  case CatchMiss\n  thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_Catch lift\\<^sub>c_def)\nqed\n\nlemma (in lift_state_space_ext) valid_inject_project:\n assumes noFaultStuck:\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Normal (project \\<sigma>)\\<rangle> \\<Rightarrow>\\<notin>(Fault ` UNIV \\<union> {Stuck})\"\n shows \"lift\\<^sub>e \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} lift\\<^sub>c c\n                {t. t=inject \\<sigma> (project t)}, {t. t=inject \\<sigma> (project t)}\"\nproof (rule validI)\n  fix s t\n  assume exec: \"lift\\<^sub>e \\<Gamma>\\<turnstile>\\<langle>lift\\<^sub>c c,Normal s\\<rangle> \\<Rightarrow> t\"\n  assume P: \"s \\<in> {\\<sigma>}\"\n  assume noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` {t. t = inject \\<sigma> (project t)} \\<union>\n        Abrupt ` {t. t = inject \\<sigma> (project t)}\"\n  proof -\n    from lift_exec [OF exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c,project\\<^sub>x (Normal s)\\<rangle> \\<Rightarrow> project\\<^sub>x t\"\n      by simp\n    with noFaultStuck P have t: \"t \\<notin> Fault ` UNIV \\<union> {Stuck}\"\n      by (auto simp add: final_notin_def project\\<^sub>x_def)\n    from lift_exec_inject_same [OF exec refl this] P\n    have \"state t = inject \\<sigma> (project (state t))\"\n      by simp\n    with t show ?thesis\n      by (cases t) auto\n  qed\nqed\n\nlemma (in lift_state_space_ext) lift_exec_inject_same':\nassumes exec_lc: \"(lift\\<^sub>e \\<Gamma>)\\<turnstile>\\<langle>lift\\<^sub>c c,S\\<rangle> \\<Rightarrow> T\"\nshows \"\\<And>c. \\<lbrakk>T \\<notin> (Fault ` UNIV) \\<union> {Stuck}\\<rbrakk> \\<Longrightarrow>\n              state T = inject (state S) (project (state T))\"\n  using lift_exec_inject_same [OF exec_lc]\n  by simp\n\nlemma (in lift_state_space_ext) valid_lift_modifies:\n  assumes valid: \"\\<forall>s. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {s} c (Modif s),(ModifAbr s)\"\n  shows \"(lift\\<^sub>e \\<Gamma>)\\<Turnstile>\\<^bsub>/F\\<^esub> {S} (lift\\<^sub>c c)\n           {T. T \\<in> lift\\<^sub>s (Modif (project S)) \\<and> T=inject S (project T)},\n           {T. T \\<in> lift\\<^sub>s (ModifAbr (project S)) \\<and> T=inject S (project T)}\"\nproof (rule validI)\n  fix s t\n  assume exec: \"lift\\<^sub>e \\<Gamma>\\<turnstile>\\<langle>lift\\<^sub>c c,Normal s\\<rangle> \\<Rightarrow> t\"\n  assume P: \"s \\<in> {S}\"\n  assume noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal `\n                 {t \\<in> lift\\<^sub>s (Modif (project S)).\n                  t = inject S (project t)} \\<union>\n                 Abrupt `\n                 {t \\<in> lift\\<^sub>s (ModifAbr (project S)).\n                  t = inject S (project t)}\"\n  proof -\n    from lift_exec [OF exec]\n    have \"\\<Gamma>\\<turnstile> \\<langle>c,project\\<^sub>x (Normal s)\\<rangle> \\<Rightarrow> project\\<^sub>x t\"\n      by auto\n    moreover\n    from noFault have \"project\\<^sub>x t \\<notin> Fault ` F\"\n      by (cases \"t\") (auto simp add: project\\<^sub>x_def)\n    ultimately\n    have \"project\\<^sub>x t \\<in>\n            Normal ` (Modif (project s)) \\<union> Abrupt ` (ModifAbr (project s))\"\n      using valid [rule_format, of \"(project s)\"]\n      by (auto simp add: valid_def project\\<^sub>x_def)\n    hence t: \"t \\<in> Normal ` lift\\<^sub>s (Modif (project s)) \\<union>\n               Abrupt ` lift\\<^sub>s (ModifAbr (project s))\"\n      by (cases t) (auto simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def)\n    then have \"t \\<notin> Fault ` UNIV \\<union> {Stuck}\"\n      by (cases t) auto\n    from lift_exec_inject_same [OF exec _ this]\n    have \"state t = inject (state (Normal s)) (project (state t))\"\n      by simp\n    with t show ?thesis\n      using P by auto\n  qed\nqed\n\nlemma (in lift_state_space_ext) hoare_lift_modifies:\n  assumes deriv: \"\\<forall>\\<sigma>. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} c (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<forall>\\<sigma>. (lift\\<^sub>e \\<Gamma>),{}\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} (lift\\<^sub>c c)\n           {T. T \\<in> lift\\<^sub>s (Modif (project \\<sigma>)) \\<and> T=inject \\<sigma> (project T)},\n           {T. T \\<in> lift\\<^sub>s (ModifAbr (project \\<sigma>)) \\<and> T=inject \\<sigma> (project T)}\"\napply (rule allI)\napply (rule hoare_complete)\napply (rule valid_lift_modifies)\napply (rule allI)\napply (insert hoare_sound [OF deriv [rule_format]])\napply (simp add: cvalid_def)\ndone\n\nlemma (in lift_state_space_ext) hoare_lift_modifies':\n  assumes deriv: \"\\<forall>\\<sigma>. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} c (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<forall>\\<sigma>. (lift\\<^sub>e \\<Gamma>),{}\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} (lift\\<^sub>c c)\n           {T. T \\<in> lift\\<^sub>s (Modif (project \\<sigma>)) \\<and>\n                   (\\<exists>T'. T=inject \\<sigma> T')},\n           {T. T \\<in> lift\\<^sub>s (ModifAbr (project \\<sigma>)) \\<and>\n                   (\\<exists>T'. T=inject \\<sigma> T')}\"\napply (rule allI)\napply (rule HoarePartialDef.conseq [OF hoare_lift_modifies [OF deriv]])\napply blast\ndone\n\nsubsection \\<open>Renaming Procedures\\<close>\n\nprimrec rename:: \"('p \\<Rightarrow> 'q) \\<Rightarrow> ('s,'p,'f) com \\<Rightarrow> ('s,'q,'f) com\"\nwhere\n\"rename N Skip = Skip\" |\n\"rename N (Basic f) = Basic f\" |\n\"rename N (Spec r) = Spec r\" |\n\"rename N (Seq c\\<^sub>1 c\\<^sub>2)  = (Seq (rename N c\\<^sub>1) (rename N c\\<^sub>2))\" |\n\"rename N (Cond b c\\<^sub>1 c\\<^sub>2) = Cond b (rename N c\\<^sub>1) (rename N c\\<^sub>2)\" |\n\"rename N (While b c) = While b (rename N c)\" |\n\"rename N (Call p) = Call (N p)\" |\n\"rename N (DynCom c) = DynCom (\\<lambda>s. rename N (c s))\" |\n\"rename N (Guard f g c) = Guard f g (rename N c)\" |\n\"rename N Throw = Throw\" |\n\"rename N (Catch c\\<^sub>1 c\\<^sub>2) = Catch (rename N c\\<^sub>1) (rename N c\\<^sub>2)\"\n\nlemma rename_Skip: \"rename h c = Skip = (c=Skip)\"\n  by (cases c) auto\n\nlemma rename_Basic:\n  \"(rename h c = Basic f) = (c=Basic f)\"\n  by (cases c) auto\n\nlemma rename_Spec:\n  \"(rename h c = Spec r) = (c=Spec r)\"\n  by (cases c) auto\n\nlemma rename_Seq:\n  \"(rename h c = Seq rc\\<^sub>1 rc\\<^sub>2) =\n     (\\<exists> c\\<^sub>1 c\\<^sub>2. c = Seq c\\<^sub>1 c\\<^sub>2 \\<and>\n               rc\\<^sub>1 = rename h c\\<^sub>1 \\<and> rc\\<^sub>2 = rename h c\\<^sub>2 )\"\n    by (cases c) auto\n\nlemma rename_Cond:\n  \"(rename h c = Cond b rc\\<^sub>1 rc\\<^sub>2) =\n     (\\<exists>c\\<^sub>1 c\\<^sub>2. c = Cond b c\\<^sub>1 c\\<^sub>2  \\<and> rc\\<^sub>1 = rename h c\\<^sub>1 \\<and> rc\\<^sub>2 = rename h c\\<^sub>2 )\"\n  by (cases c) auto\n\nlemma rename_While:\n  \"(rename h c = While b rc') = (\\<exists>c'. c = While b c' \\<and> rc' = rename h c')\"\n  by (cases c) auto\n\nlemma rename_Call:\n  \"(rename h c = Call q) = (\\<exists>p. c = Call p \\<and> q=h p)\"\n  by (cases c) auto\n\n\n\nlemma rename_Guard:\n  \"(rename h c = Guard f g rc') =\n     (\\<exists>c'. c = Guard f g c' \\<and> rc' = rename h c')\"\n   by (cases c) auto\n\nlemma rename_Throw:\n  \"(rename h c = Throw) = (c = Throw)\"\n  by (cases c) auto\n\nlemma rename_Catch:\n  \"(rename h c = Catch rc\\<^sub>1 rc\\<^sub>2) =\n     (\\<exists>c\\<^sub>1 c\\<^sub>2. c = Catch c\\<^sub>1 c\\<^sub>2 \\<and> rc\\<^sub>1 = rename h c\\<^sub>1 \\<and> rc\\<^sub>2 = rename h c\\<^sub>2 )\"\n    by (cases c) auto\n\nlemma exec_rename_to_exec:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (h p) = Some (rename h bdy)\"\n  assumes exec: \"\\<Gamma>'\\<turnstile>\\<langle>rc,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<And>c. rename h c = rc\\<Longrightarrow>  \\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and> (t'=Stuck \\<or> t'=t)\"\nusing exec\nproof (induct)\n  case Skip thus ?case by (fastforce intro: exec.intros simp add: rename_Skip)\nnext\n  case Guard thus ?case by (fastforce intro: exec.intros simp add: rename_Guard)\nnext\n  case GuardFault thus ?case by (fastforce intro: exec.intros simp add: rename_Guard)\nnext\n  case FaultProp thus ?case by (fastforce intro: exec.intros)\nnext\n  case Basic thus ?case by (fastforce intro: exec.intros simp add: rename_Basic)\nnext\n  case Spec thus ?case by (fastforce intro: exec.intros simp add: rename_Spec)\nnext\n  case SpecStuck thus ?case by (fastforce intro: exec.intros simp add: rename_Spec)\nnext\n  case Seq thus ?case by (fastforce intro: exec.intros simp add: rename_Seq)\nnext\n  case CondTrue thus ?case by (fastforce intro: exec.intros simp add: rename_Cond)\nnext\n  case CondFalse thus ?case by (fastforce intro: exec.intros simp add: rename_Cond)\nnext\n  case WhileTrue thus ?case by (fastforce intro: exec.intros simp add: rename_While)\nnext\n  case WhileFalse thus ?case by (fastforce intro: exec.intros simp add: rename_While)\nnext\n  case (Call p rbdy s t)\n  have rbdy: \"\\<Gamma>' p = Some rbdy\" by fact\n  have \"rename h c = Call p\" by fact\n  then obtain q where c: \"c=Call q\" and p: \"p=h q\"\n    by (auto simp add: rename_Call)\n  show ?case\n  proof (cases \"\\<Gamma> q\")\n    case None\n    with c show ?thesis by (auto intro: exec.CallUndefined)\n  next\n    case (Some bdy)\n    from \\<Gamma> [rule_format, OF this] p rbdy\n    have \"rename h bdy = rbdy\" by simp\n    with Call.hyps c Some\n    show ?thesis\n      by (fastforce intro: exec.intros)\n  qed\nnext\n  case (CallUndefined p s)\n  have undef: \"\\<Gamma>' p = None\" by fact\n  have \"rename h c = Call p\" by fact\n  then obtain q where c: \"c=Call q\" and p: \"p=h q\"\n    by (auto simp add: rename_Call)\n  from undef p \\<Gamma> have \"\\<Gamma> q = None\"\n    by (cases \"\\<Gamma> q\") auto\n  with p c show ?case\n    by (auto intro: exec.intros)\nnext\n  case StuckProp thus ?case by (fastforce intro: exec.intros)\nnext\n  case DynCom thus ?case by (fastforce intro: exec.intros simp add: rename_DynCom)\nnext\n  case Throw thus ?case by (fastforce intro: exec.intros simp add: rename_Throw)\nnext\n  case AbruptProp thus ?case by (fastforce intro: exec.intros)\nnext\n  case CatchMatch thus ?case by (fastforce intro: exec.intros simp add: rename_Catch)\nnext\n  case CatchMiss thus ?case by (fastforce intro: exec.intros simp add: rename_Catch)\nqed\n\n\n\nlemma exec_rename_to_exec':\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes exec: \"\\<Gamma>'\\<turnstile>\\<langle>rename N c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and> (t'=Stuck \\<or> t'=t)\"\n  using exec_rename_to_exec [OF \\<Gamma> exec]\n  by  auto\n\n\n\nlemma valid_to_valid_rename:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes valid: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>'\\<Turnstile>\\<^bsub>/F\\<^esub> P (rename N c) Q,A\"\nproof (rule validI)\n  fix s t\n  assume execr: \"\\<Gamma>'\\<turnstile> \\<langle>rename N c,Normal s\\<rangle> \\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from exec_rename_to_exec [OF \\<Gamma> execr]\n    obtain t' where\n      exec: \"\\<Gamma>\\<turnstile> \\<langle>c,Normal s\\<rangle> \\<Rightarrow> t'\"  and t': \"(t' = Stuck \\<or> t' = t)\"\n      by auto\n    with valid noFault P show ?thesis\n      by (auto simp add: valid_def)\n  qed\nqed\n\nlemma hoare_to_hoare_rename:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>',{}\\<turnstile>\\<^bsub>/F\\<^esub> P (rename N c) Q,A\"\napply (rule hoare_complete)\napply (insert hoare_sound [OF deriv])\napply (rule valid_to_valid_rename)\napply  (rule \\<Gamma>)\napply (simp add: cvalid_def)\ndone\n\nlemma hoare_to_hoare_rename':\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes deriv: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) c (Q Z),(A Z)\"\n  shows \"\\<forall>Z. \\<Gamma>',{}\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) (rename N c) (Q Z),(A Z)\"\napply rule\napply (rule hoare_to_hoare_rename [OF \\<Gamma>])\napply (rule deriv[rule_format])\ndone\n\nlemma terminates_to_terminates_rename:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes termi: \"\\<Gamma>\\<turnstile> c \\<down> s\"\n  assumes noStuck: \"\\<Gamma>\\<turnstile> \\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  shows \"\\<Gamma>'\\<turnstile> rename N c \\<down> s\"\nusing termi noStuck\nproof (induct)\n  case Skip thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Basic thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Spec thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Guard thus ?case by (fastforce intro: terminates.intros\n    simp add: final_notin_def exec.intros)\nnext\n  case GuardFault thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Fault thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Seq\n  thus ?case\n    by (force intro!: terminates.intros exec.intros dest: exec_rename_to_exec [OF \\<Gamma>]\n         simp add: final_notin_def)\nnext\n  case CondTrue thus ?case by (fastforce intro: terminates.intros\n    simp add: final_notin_def exec.intros)\nnext\n  case CondFalse thus ?case by (fastforce intro: terminates.intros\n    simp add: final_notin_def exec.intros)\nnext\n  case (WhileTrue s b c)\n  have s_in_b: \"s \\<in> b\" by fact\n  have noStuck: \"\\<Gamma>\\<turnstile> \\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\" by fact\n  with s_in_b have \"\\<Gamma>\\<turnstile> \\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n    by (auto simp add: final_notin_def intro: exec.intros)\n  with WhileTrue.hyps have \"\\<Gamma>'\\<turnstile>rename N c \\<down> Normal s\"\n    by simp\n  moreover\n  {\n    fix t\n    assume exec_rc: \"\\<Gamma>'\\<turnstile> \\<langle>rename N c,Normal s\\<rangle> \\<Rightarrow> t\"\n    have \"\\<Gamma>'\\<turnstile> While b (rename N c) \\<down> t\"\n    proof -\n      from exec_rename_to_exec [OF \\<Gamma> exec_rc] obtain t'\n        where exec_c: \"\\<Gamma>\\<turnstile> \\<langle>c,Normal s\\<rangle> \\<Rightarrow> t'\" and t': \"(t' = Stuck \\<or> t' = t)\"\n        by auto\n      with s_in_b noStuck obtain \"t'=t\" and \"\\<Gamma>\\<turnstile> \\<langle>While b c,t\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n        by (auto simp add: final_notin_def intro: exec.intros)\n      with exec_c WhileTrue.hyps\n      show ?thesis\n        by auto\n    qed\n  }\n  ultimately show ?case\n    using s_in_b\n    by (auto intro: terminates.intros)\nnext\n  case WhileFalse thus ?case by (fastforce intro: terminates.intros)\nnext\n  case (Call p bdy s)\n  have \"\\<Gamma> p = Some bdy\" by fact\n  from \\<Gamma> [rule_format, OF this]\n  have bdy': \"\\<Gamma>' (N p) = Some (rename N bdy)\".\n  from Call have \"\\<Gamma>'\\<turnstile>rename N bdy \\<down> Normal s\"\n    by (auto simp add: final_notin_def intro: exec.intros)\n  with bdy' have \"\\<Gamma>'\\<turnstile>Call (N p) \\<down> Normal s\"\n    by (auto intro: terminates.intros)\n  thus ?case by simp\nnext\n  case (CallUndefined p s)\n  have \"\\<Gamma> p = None\" \"\\<Gamma>\\<turnstile> \\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\" by fact+\n  hence False by (auto simp add: final_notin_def intro: exec.intros)\n  thus ?case ..\nnext\n  case Stuck thus ?case by (fastforce intro: terminates.intros)\nnext\n  case DynCom thus ?case by (fastforce intro: terminates.intros\n    simp add: final_notin_def exec.intros)\nnext\n  case Throw thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Abrupt thus ?case by (fastforce intro: terminates.intros)\nnext\n  case (Catch c1 s c2)\n  have noStuck: \"\\<Gamma>\\<turnstile> \\<langle>Catch c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\" by fact\n  hence \"\\<Gamma>\\<turnstile> \\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n    by (fastforce simp add: final_notin_def intro: exec.intros)\n  with Catch.hyps have \"\\<Gamma>'\\<turnstile>rename N c1 \\<down> Normal s\"\n    by auto\n  moreover\n  {\n    fix t\n    assume exec_rc1:\"\\<Gamma>'\\<turnstile> \\<langle>rename N c1,Normal s\\<rangle> \\<Rightarrow> Abrupt t\"\n    have \"\\<Gamma>'\\<turnstile>rename N c2 \\<down> Normal t\"\n    proof -\n      from exec_rename_to_exec [OF \\<Gamma> exec_rc1] obtain t'\n        where exec_c: \"\\<Gamma>\\<turnstile> \\<langle>c1,Normal s\\<rangle> \\<Rightarrow> t'\" and \"(t' = Stuck \\<or> t' = Abrupt t)\"\n        by auto\n      with noStuck have t': \"t'=Abrupt t\"\n        by (fastforce simp add: final_notin_def intro: exec.intros)\n      with exec_c noStuck have \"\\<Gamma>\\<turnstile> \\<langle>c2,Normal t\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n        by (auto simp add: final_notin_def intro: exec.intros)\n      with exec_c t' Catch.hyps\n      show ?thesis\n        by auto\n    qed\n  }\n  ultimately show ?case\n    by (auto intro: terminates.intros)\nqed\n\nlemma validt_to_validt_rename:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes valid: \"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>'\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (rename N c) Q,A\"\nproof -\n  from valid\n  have \"\\<Gamma>'\\<Turnstile>\\<^bsub>/F\\<^esub> P (rename N c) Q,A\"\n    by (auto intro: valid_to_valid_rename [OF \\<Gamma>] simp add: validt_def)\n  moreover\n  {\n    fix s\n    assume \"s \\<in> P\"\n    with valid obtain \"\\<Gamma>\\<turnstile>c \\<down> (Normal s)\" \"\\<Gamma>\\<turnstile> \\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n      by (auto simp add: validt_def valid_def final_notin_def)\n    from terminates_to_terminates_rename [OF \\<Gamma> this]\n    have \"\\<Gamma>'\\<turnstile>rename N c \\<down> Normal s\"\n      .\n  }\n  ultimately show ?thesis\n    by (simp add: validt_def)\nqed\n\nlemma hoaret_to_hoaret_rename:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>',{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (rename N c) Q,A\"\napply (rule hoaret_complete)\napply (insert hoaret_sound [OF deriv])\napply (rule validt_to_validt_rename)\napply  (rule \\<Gamma>)\napply (simp add: cvalidt_def)\ndone\n\nlemma hoaret_to_hoaret_rename':\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes deriv: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) c (Q Z),(A Z)\"\n  shows \"\\<forall>Z. \\<Gamma>',{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) (rename N c) (Q Z),(A Z)\"\napply rule\napply (rule hoaret_to_hoaret_rename [OF \\<Gamma>])\napply (rule deriv[rule_format])\ndone\n\nlemma lift\\<^sub>c_whileAnno [simp]: \"lift\\<^sub>c prj inject (whileAnno b I V c) =\n    whileAnno (lift\\<^sub>s prj b)\n              (lift\\<^sub>s prj I) (lift\\<^sub>r prj inject V) (lift\\<^sub>c prj inject c)\"\n  by (simp add: whileAnno_def)\n\nlemma lift\\<^sub>c_block [simp]: \"lift\\<^sub>c prj inject (block init bdy return c) =\n  block (lift\\<^sub>f prj inject init) (lift\\<^sub>c prj inject bdy)\n        (\\<lambda>s. (lift\\<^sub>f prj inject (return (prj s))))\n        (\\<lambda>s t. lift\\<^sub>c prj inject (c (prj s) (prj t)))\"\n  by (simp add: block_def)\n\n(*\nlemma lift\\<^sub>c_block [simp]: \"lift\\<^sub>c prj inject (block init bdy return c) =\n  block (lift\\<^sub>f prj inject init) (lift\\<^sub>c prj inject bdy)\n        (\\<lambda>s t. inject s (return (prj s) (prj t)))\n        (\\<lambda>s t. lift\\<^sub>c prj inject (c (prj s) (prj t)))\"\n  apply (simp add: block_def)\n  apply (simp add: lift\\<^sub>f_def)\n*)\nlemma lift\\<^sub>c_call [simp]: \"lift\\<^sub>c prj inject (call init p return c) =\n  call (lift\\<^sub>f prj inject init) p\n        (\\<lambda>s. (lift\\<^sub>f prj inject (return (prj s))))\n        (\\<lambda>s t. lift\\<^sub>c prj inject (c (prj s) (prj t)))\"\n  by (simp add: call_def lift\\<^sub>c_block)\n\nlemma rename_whileAnno [simp]: \"rename h (whileAnno b I V c) =\n   whileAnno b I V (rename h c)\"\n  by (simp add: whileAnno_def)\n\nlemma rename_block [simp]: \"rename h (block init bdy return c) =\n  block init (rename h bdy) return (\\<lambda>s t. rename h (c s t))\"\n  by (simp add: block_def)\n\nlemma rename_call [simp]: \"rename h (call init p return c) =\n  call init (h p) return (\\<lambda>s t. rename h (c s t))\"\n  by (simp add: call_def)\n\n\nend\n\n\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/ex/Compose.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.5, "lm_q1q2_score": 0.336165849589643}}
{"text": "(*  Title:      Native_Cast.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nheader {* Conversions between unsigned words and between char *}\n\ntheory Native_Cast imports\n  \"~~/src/HOL/Library/Code_Char\"\n  Uint8\n  Uint16\n  Uint32\nbegin\n\ntext {* Auxiliary stuff *}\n\ncontext begin interpretation lifting_syntax .\n\nlemma char_of_integer_transfer [transfer_rule]:\n  \"(pcr_integer ===> op =) (\\<lambda>n. char_of_nat (nat n)) char_of_integer\"\nby(simp add: integer.pcr_cr_eq cr_integer_def rel_fun_def char_of_integer_def nat_of_integer_def)\n\nlemma integer_of_char_transfer [transfer_rule]:\n  \"(op = ===> pcr_integer) (\\<lambda>n. int (nat_of_char n)) integer_of_char\"\nby(simp add: integer.pcr_cr_eq cr_integer_def rel_fun_def integer_of_char_def)\n\nend\n\nlemma integer_of_char_char_of_integer [simp]:\n  \"0 \\<le> x \\<Longrightarrow> integer_of_char (char_of_integer x) = x mod 256\"\nunfolding integer_of_char_def char_of_integer_def o_apply nat_of_char_of_nat\nincluding integer.lifting by transfer(auto dest: nat_mod_distrib[of _ 256, symmetric])\n\nlemma char_of_integer_integer_of_char [simp]:\n  \"char_of_integer (integer_of_char x) = x\"\nby(simp add: integer_of_char_def char_of_integer_def)\n\nlemma int_lt_numeral [simp]: \"int x < numeral n \\<longleftrightarrow> x < numeral n\"\nby (metis nat_numeral zless_nat_eq_int_zless)\n\nlemma int_of_integer_ge_0: \"0 \\<le> int_of_integer x \\<longleftrightarrow> 0 \\<le> x\"\nincluding integer.lifting by transfer simp\n\nlemma integer_of_char_ge_0 [simp]: \"0 \\<le> integer_of_char x\"\nincluding integer.lifting by transfer simp\n\n\nsection {* Conversions between @{typ uint8} and @{typ char} *}\n\ndefinition uint8_of_char :: \"char \\<Rightarrow> uint8\"\nwhere \"uint8_of_char = Uint8 \\<circ> integer_of_char\"\n\ndefinition char_of_uint8 :: \"uint8 \\<Rightarrow> char\"\nwhere \"char_of_uint8 = char_of_integer \\<circ> integer_of_int \\<circ> uint \\<circ> Rep_uint8'\"\n\nlemma uint8_of_char_char_of_uint8 [simp]:\n  \"uint8_of_char (char_of_uint8 x) = x\"\napply(simp add: uint8_of_char_def char_of_uint8_def)\nincluding integer.lifting apply transfer\napply(simp add: mod_pos_pos_trivial uint_bounded[where ?'a=8, simplified])\ndone\n\nlemma char_of_uint8_uint8_of_char [simp]:\n  \"char_of_uint8 (uint8_of_char x) = x\"\nproof -\n  have \"char_of_uint8 (uint8_of_char x) = \n    char_of_integer (of_int (int_of_integer (integer_of_char x) mod 256))\"\n    by(simp add: uint8_of_char_def char_of_uint8_def Uint8.rep_eq uint_word_of_int)\n  also { have \"int_of_integer (integer_of_char x) < 256\"\n      including integer.lifting by transfer(simp add: nat_of_char_less_256) }\n  hence \"\\<dots> = x\"\n    by(simp add: semiring_numeral_div_class.mod_less int_of_integer_ge_0)\n  finally show ?thesis .\nqed\n\ncode_printing code_module Native_Casts \\<rightharpoonup> (Haskell)\n{*import qualified Data.Char;\n\nord :: Char -> Int;\nord = Data.Char.ord;\n\nchr :: Int -> Char;\nchr = Data.Char.chr;\n*}\ncode_reserved Haskell Native_Casts\n\ncode_printing constant uint8_of_char \\<rightharpoonup>\n  (SML) \"Word8.fromInt (Char.ord _)\" and\n  (Haskell) \"(Prelude.fromIntegral (Native'_Casts.ord _) :: Uint8.Word8)\" and\n  (Scala) \"_.toByte\"\n| constant char_of_uint8 \\<rightharpoonup>\n  (SML) \"Char.chr (Word8.toInt _)\" and\n  (Haskell) \"Native'_Casts.chr (Prelude.fromIntegral _)\" and\n  (Scala) \"((_).toInt & 0xFF).toChar\"\n\nsection {* Conversion between native words *}\n\nlift_definition uint8_of_uint32 :: \"uint32 \\<Rightarrow> uint8\" is ucast .\nlift_definition uint8_of_uint16 :: \"uint16 \\<Rightarrow> uint8\" is ucast .\n\nlift_definition uint16_of_uint8 :: \"uint8 \\<Rightarrow> uint16\" is ucast .\nlift_definition uint16_of_uint32 :: \"uint32 \\<Rightarrow> uint16\" is ucast .\n\nlift_definition uint32_of_uint8 :: \"uint8 \\<Rightarrow> uint32\" is ucast .\nlift_definition uint32_of_uint16 :: \"uint16 \\<Rightarrow> uint32\" is ucast .\n\ncode_printing\n  constant uint8_of_uint16 \\<rightharpoonup>\n  (SML_word) \"Word8.fromLarge (Word16.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint8.Word8)\" and\n  (Scala) \"_.toByte\"\n| constant uint8_of_uint32 \\<rightharpoonup>\n  (SML) \"Word8.fromLarge (Word32.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint8.Word8)\" and\n  (Scala) \"_.toByte\"\n| constant uint16_of_uint8 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLarge (Word8.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint16.Word16)\" and\n  (Scala) \"((_).toInt & 0xFF).toChar\"\n| constant uint16_of_uint32 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLarge (Word32.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint16.Word16)\" and\n  (Scala) \"_.toChar\"\n| constant uint32_of_uint8 \\<rightharpoonup>\n  (SML) \"Word32.fromLarge (Word8.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint32.Word32)\" and\n  (Scala) \"((_).toInt & 0xFF)\"\n| constant uint32_of_uint16 \\<rightharpoonup>\n  (SML_word) \"Word32.fromLarge (Word16.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint32.Word32)\" and\n  (Scala) \"(_).toInt\"\n\ntext {* \n  Use @{const Abs_uint8'} etc. instead of @{const Rep_uint8} in code equations\n  for conversion functions to avoid exceptions during code generation when the\n  target language provides only some of the uint types.\n*}\n\nlemma uint8_of_uint16_code [code]:\n  \"uint8_of_uint16 x = Abs_uint8' (ucast (Rep_uint16' x))\"\nby transfer simp\n\nlemma uint8_of_uint32_code [code]:\n  \"uint8_of_uint32 x = Abs_uint8' (ucast (Rep_uint32' x))\"\nby transfer simp\n\nlemma uint16_of_uint8_code [code]:\n  \"uint16_of_uint8 x = Abs_uint16' (ucast (Rep_uint8' x))\"\nby transfer simp\n\nlemma uint16_of_uint32_code [code]:\n  \"uint16_of_uint32 x = Abs_uint16' (ucast (Rep_uint32' x))\"\nby transfer simp\n\nlemma uint32_of_uint8_code [code]:\n  \"uint32_of_uint8 x = Abs_uint32' (ucast (Rep_uint8' x))\"\nby transfer simp\n\nlemma uint32_of_uint16_code [code]:\n  \"uint32_of_uint16 x = Abs_uint32' (ucast (Rep_uint16' x))\"\nby transfer simp\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Native_Word/Native_Cast.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6619228891883799, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3361322963678285}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      Semantic.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\<open>Big-Step Semantics for Simpl\\<close>\ntheory Semantic imports Language begin\n\nnotation\nrestrict_map  (\"_|\\<^bsub>_\\<^esub>\" [90, 91] 90)\n\n\ndatatype ('s,'f) xstate = Normal 's | Abrupt 's | Fault 'f | Stuck\n\ndefinition isAbr::\"('s,'f) xstate \\<Rightarrow> bool\"\n  where \"isAbr S = (\\<exists>s. S=Abrupt s)\"\n\nlemma isAbr_simps [simp]:\n\"isAbr (Normal s) = False\"\n\"isAbr (Abrupt s) = True\"\n\"isAbr (Fault f) = False\"\n\"isAbr Stuck = False\"\nby (auto simp add: isAbr_def)\n\nlemma isAbrE [consumes 1, elim?]: \"\\<lbrakk>isAbr S; \\<And>s. S=Abrupt s \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp add: isAbr_def)\n\nlemma not_isAbrD:\n\"\\<not> isAbr s \\<Longrightarrow> (\\<exists>s'. s=Normal s') \\<or> s = Stuck \\<or> (\\<exists>f. s=Fault f)\"\n  by (cases s) auto\n\ndefinition isFault:: \"('s,'f) xstate \\<Rightarrow> bool\"\n  where \"isFault S = (\\<exists>f. S=Fault f)\"\n\nlemma isFault_simps [simp]:\n\"isFault (Normal s) = False\"\n\"isFault (Abrupt s) = False\"\n\"isFault (Fault f) = True\"\n\"isFault Stuck = False\"\nby (auto simp add: isFault_def)\n\nlemma isFaultE [consumes 1, elim?]: \"\\<lbrakk>isFault s; \\<And>f. s=Fault f \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp add: isFault_def)\n\nlemma not_isFault_iff: \"(\\<not> isFault t) = (\\<forall>f. t \\<noteq> Fault f)\"\n  by (auto elim: isFaultE)\n\n(* ************************************************************************* *)\nsubsection \\<open>Big-Step Execution: \\<open>\\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> \\<Rightarrow> t\\<close>\\<close>\n(* ************************************************************************* *)\n\ntext \\<open>The procedure environment\\<close>\ntype_synonym ('s,'p,'f) body = \"'p \\<Rightarrow> ('s,'p,'f) com option\"\n\ninductive\n  \"exec\"::\"[('s,'p,'f) body,('s,'p,'f) com,('s,'f) xstate,('s,'f) xstate]\n                    \\<Rightarrow> bool\" (\"_\\<turnstile> \\<langle>_,_\\<rangle> \\<Rightarrow> _\"  [60,20,98,98] 89)\n  for \\<Gamma>::\"('s,'p,'f) body\"\nwhere\n  Skip: \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> \\<Rightarrow> Normal s\"\n\n| Guard: \"\\<lbrakk>s\\<in>g; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n          \\<Longrightarrow>\n          \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| GuardFault: \"s\\<notin>g \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>  Fault f\"\n\n| FaultProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> \\<Rightarrow>  Fault f\"\n\n| Basic: \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> \\<Rightarrow>  Normal (f s)\"\n\n| Spec: \"(s,t) \\<in> r\n         \\<Longrightarrow>\n         \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> \\<Rightarrow>  Normal t\"\n\n| SpecStuck: \"\\<forall>t. (s,t) \\<notin> r\n              \\<Longrightarrow>\n              \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> \\<Rightarrow>  Stuck\"\n\n| Seq: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>  s'; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,s'\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>\\<turnstile>\\<langle>Seq c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| CondTrue: \"\\<lbrakk>s \\<in> b; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n             \\<Longrightarrow>\n             \\<Gamma>\\<turnstile>\\<langle>Cond b c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| CondFalse: \"\\<lbrakk>s \\<notin> b; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>\\<turnstile>\\<langle>Cond b c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| WhileTrue: \"\\<lbrakk>s \\<in> b; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>  s'; \\<Gamma>\\<turnstile>\\<langle>While b c,s'\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| WhileFalse: \"\\<lbrakk>s \\<notin> b\\<rbrakk>\n               \\<Longrightarrow>\n               \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>  Normal s\"\n\n| Call:  \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n          \\<Longrightarrow>\n          \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| CallUndefined: \"\\<lbrakk>\\<Gamma> p=None\\<rbrakk>\n                  \\<Longrightarrow>\n                  \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>  Stuck\"\n\n| StuckProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> \\<Rightarrow>  Stuck\"\n\n| DynCom:  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>(c s),Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n             \\<Longrightarrow>\n             \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| Throw: \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> \\<Rightarrow>  Abrupt s\"\n\n| AbruptProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> \\<Rightarrow>  Abrupt s\"\n\n| CatchMatch: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>  Abrupt s'; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s'\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n               \\<Longrightarrow>\n               \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\"\n| CatchMiss: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>  t; \\<not>isAbr t\\<rbrakk>\n               \\<Longrightarrow>\n               \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\"\n\ninductive_cases exec_elim_cases [cases set]:\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Skip,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Basic f,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Spec r,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>While b c,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Call p,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Throw,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,s\\<rangle> \\<Rightarrow>  t\"\n\n\ninductive_cases exec_Normal_elim_cases [cases set]:\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s\\<rangle> \\<Rightarrow>  t\"\n\nlemma exec_block:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Normal t; \\<Gamma>\\<turnstile>\\<langle>c s t,Normal (return s t)\\<rangle> \\<Rightarrow>  u\\<rbrakk>\n  \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> \\<Rightarrow>  u\"\napply (unfold block_def)\nby (fastforce intro: exec.intros)\n\nlemma exec_blockAbrupt:\n     \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Abrupt t\\<rbrakk>\n       \\<Longrightarrow>\n       \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> \\<Rightarrow>  Abrupt (return s t)\"\napply (unfold block_def)\nby (fastforce intro: exec.intros)\n\nlemma exec_blockFault:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Fault f\\<rbrakk>\n   \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> \\<Rightarrow>  Fault f\"\napply (unfold block_def)\nby (fastforce intro: exec.intros)\n\nlemma exec_blockStuck:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Stuck\\<rbrakk>\n  \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> \\<Rightarrow>  Stuck\"\napply (unfold block_def)\nby (fastforce intro: exec.intros)\n\nlemma exec_call:\n \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Normal t; \\<Gamma>\\<turnstile>\\<langle>c s t,Normal (return s t)\\<rangle> \\<Rightarrow>  u\\<rbrakk>\n  \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  u\"\napply (simp add: call_def)\napply (rule exec_block)\napply  (erule (1) Call)\napply assumption\ndone\n\n\nlemma exec_callAbrupt:\n \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Abrupt t\\<rbrakk>\n  \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  Abrupt (return s t)\"\napply (simp add: call_def)\napply (rule exec_blockAbrupt)\napply (erule (1) Call)\ndone\n\nlemma exec_callFault:\n             \"\\<lbrakk>\\<Gamma> p=Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Fault f\\<rbrakk>\n               \\<Longrightarrow>\n              \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  Fault f\"\napply (simp add: call_def)\napply (rule exec_blockFault)\napply (erule (1) Call)\ndone\n\nlemma exec_callStuck:\n          \"\\<lbrakk>\\<Gamma> p=Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Stuck\\<rbrakk>\n           \\<Longrightarrow>\n           \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  Stuck\"\napply (simp add: call_def)\napply (rule exec_blockStuck)\napply (erule (1) Call)\ndone\n\nlemma  exec_callUndefined:\n       \"\\<lbrakk>\\<Gamma> p=None\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  Stuck\"\napply (simp add: call_def)\napply (rule exec_blockStuck)\napply (erule CallUndefined)\ndone\n\n\nlemma Fault_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>  t\" and s: \"s=Fault f\"\n  shows \"t=Fault f\"\nusing exec s by (induct) auto\n\nlemma Stuck_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>  t\" and s: \"s=Stuck\"\n  shows \"t=Stuck\"\nusing exec s by (induct) auto\n\nlemma Abrupt_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>  t\" and s: \"s=Abrupt s'\"\n  shows \"t=Abrupt s'\"\nusing exec s by (induct) auto\n\nlemma exec_Call_body_aux:\n  \"\\<Gamma> p=Some bdy \\<Longrightarrow>\n   \\<Gamma>\\<turnstile>\\<langle>Call p,s\\<rangle> \\<Rightarrow> t = \\<Gamma>\\<turnstile>\\<langle>bdy,s\\<rangle> \\<Rightarrow> t\"\napply (rule)\napply (fastforce elim: exec_elim_cases )\napply (cases s)\napply   (cases t)\napply (auto intro: exec.intros dest: Fault_end Stuck_end Abrupt_end)\ndone\n\nlemma exec_Call_body':\n  \"p \\<in> dom \\<Gamma> \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>Call p,s\\<rangle> \\<Rightarrow> t = \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),s\\<rangle> \\<Rightarrow> t\"\n  apply clarsimp\n  by (rule exec_Call_body_aux)\n\n\n\nlemma exec_block_Normal_elim [consumes 1]:\nassumes exec_block: \"\\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> \\<Rightarrow>  t\"\nassumes Normal:\n \"\\<And>t'.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Normal t';\n     \\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Abrupt:\n \"\\<And>t'.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Abrupt t';\n     t = Abrupt (return s t')\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Fault:\n \"\\<And>f.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Fault f;\n     t = Fault f\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Stuck:\n \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Stuck;\n     t = Stuck\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes\n \"\\<lbrakk>\\<Gamma> p = None; t = Stuck\\<rbrakk> \\<Longrightarrow> P\"\nshows \"P\"\n  using exec_block\napply (unfold block_def)\napply (elim exec_Normal_elim_cases)\napply simp_all\napply  (case_tac s')\napply     simp_all\napply     (elim exec_Normal_elim_cases)\napply     simp\napply    (drule Abrupt_end) apply simp\napply    (erule exec_Normal_elim_cases)\napply    simp\napply    (rule Abrupt,assumption+)\napply   (drule Fault_end) apply simp\napply   (erule exec_Normal_elim_cases)\napply   simp\napply  (drule Stuck_end) apply simp\napply  (erule exec_Normal_elim_cases)\napply  simp\napply (case_tac s')\napply    simp_all\napply   (elim exec_Normal_elim_cases)\napply   simp\napply   (rule Normal, assumption+)\napply  (drule Fault_end) apply simp\napply  (rule Fault,assumption+)\napply (drule Stuck_end) apply simp\napply (rule Stuck,assumption+)\ndone\n\nlemma exec_call_Normal_elim [consumes 1]:\nassumes exec_call: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  t\"\nassumes Normal:\n \"\\<And>bdy t'.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Normal t';\n     \\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Abrupt:\n \"\\<And>bdy t'.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Abrupt t';\n     t = Abrupt (return s t')\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Fault:\n \"\\<And>bdy f.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Fault f;\n     t = Fault f\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Stuck:\n \"\\<And>bdy.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Stuck;\n     t = Stuck\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Undef:\n \"\\<lbrakk>\\<Gamma> p = None; t = Stuck\\<rbrakk> \\<Longrightarrow> P\"\nshows \"P\"\n  using exec_call\n  apply (unfold call_def)\n  apply (cases \"\\<Gamma> p\")\n  apply  (erule exec_block_Normal_elim)\n  apply      (elim exec_Normal_elim_cases)\n  apply       simp\n  apply      simp\n  apply     (elim exec_Normal_elim_cases)\n  apply      simp\n  apply     simp\n  apply    (elim exec_Normal_elim_cases)\n  apply     simp\n  apply    simp\n  apply   (elim exec_Normal_elim_cases)\n  apply    simp\n  apply   (rule Undef,assumption,assumption)\n  apply  (rule Undef,assumption+)\n  apply (erule exec_block_Normal_elim)\n  apply     (elim exec_Normal_elim_cases)\n  apply      simp\n  apply      (rule Normal,assumption+)\n  apply     simp\n  apply    (elim exec_Normal_elim_cases)\n  apply     simp\n  apply     (rule Abrupt,assumption+)\n  apply    simp\n  apply   (elim exec_Normal_elim_cases)\n  apply    simp\n  apply   (rule Fault, assumption+)\n  apply   simp\n  apply  (elim exec_Normal_elim_cases)\n  apply   simp\n  apply  (rule Stuck,assumption,assumption,assumption)\n  apply  simp\n  apply (rule Undef,assumption+)\n  done\n\n\nlemma exec_dynCall:\n          \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n           \\<Longrightarrow>\n           \\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> \\<Rightarrow>  t\"\napply (simp add: dynCall_def)\nby (rule DynCom)\n\nlemma exec_dynCall_Normal_elim:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> \\<Rightarrow>  t\"\n  assumes call: \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> \\<Rightarrow>  t \\<Longrightarrow> P\"\n  shows \"P\"\n  using exec\n  apply (simp add: dynCall_def)\n  apply (erule exec_Normal_elim_cases)\n  apply (rule call,assumption)\n  done\n\n\n\n\nlemma exec_Seq': \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow>  s'; \\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> \\<Rightarrow>  s''\\<rbrakk>\n             \\<Longrightarrow>\n             \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>  s''\"\n  apply (cases s)\n  apply    (fastforce intro: exec.intros)\n  apply   (fastforce dest: Abrupt_end)\n  apply  (fastforce dest: Fault_end)\n  apply (fastforce dest: Stuck_end)\n  done\n\n\nlemma exec_assoc: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 (Seq c2 c3),s\\<rangle> \\<Rightarrow>  t = \\<Gamma>\\<turnstile>\\<langle>Seq (Seq c1 c2) c3,s\\<rangle> \\<Rightarrow>  t\"\n  by (blast elim!: exec_elim_cases intro: exec_Seq' )\n\n\n(* ************************************************************************* *)\nsubsection \\<open>Big-Step Execution with Recursion Limit: \\<open>\\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> =n\\<Rightarrow> t\\<close>\\<close>\n(* ************************************************************************* *)\n\ninductive \"execn\"::\"[('s,'p,'f) body,('s,'p,'f) com,('s,'f) xstate,nat,('s,'f) xstate]\n                      \\<Rightarrow> bool\" (\"_\\<turnstile> \\<langle>_,_\\<rangle> =_\\<Rightarrow> _\"  [60,20,98,65,98] 89)\n  for \\<Gamma>::\"('s,'p,'f) body\"\nwhere\n  Skip: \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> =n\\<Rightarrow>  Normal s\"\n| Guard: \"\\<lbrakk>s\\<in>g; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n          \\<Longrightarrow>\n          \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| GuardFault: \"s\\<notin>g \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow>  Fault f\"\n\n| FaultProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> =n\\<Rightarrow>  Fault f\"\n\n| Basic: \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> =n\\<Rightarrow>  Normal (f s)\"\n\n| Spec: \"(s,t) \\<in> r\n         \\<Longrightarrow>\n         \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow>  Normal t\"\n\n| SpecStuck: \"\\<forall>t. (s,t) \\<notin> r\n              \\<Longrightarrow>\n              \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow>  Stuck\"\n\n| Seq: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow>  s'; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,s'\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>\\<turnstile>\\<langle>Seq c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| CondTrue: \"\\<lbrakk>s \\<in> b; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n             \\<Longrightarrow>\n             \\<Gamma>\\<turnstile>\\<langle>Cond b c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| CondFalse: \"\\<lbrakk>s \\<notin> b; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>\\<turnstile>\\<langle>Cond b c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| WhileTrue: \"\\<lbrakk>s \\<in> b; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow>  s';\n              \\<Gamma>\\<turnstile>\\<langle>While b c,s'\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| WhileFalse: \"\\<lbrakk>s \\<notin> b\\<rbrakk>\n               \\<Longrightarrow>\n               \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow>  Normal s\"\n\n| Call:  \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n          \\<Longrightarrow>\n          \\<Gamma>\\<turnstile>\\<langle>Call p ,Normal s\\<rangle> =Suc n\\<Rightarrow>  t\"\n\n| CallUndefined: \"\\<lbrakk>\\<Gamma> p=None\\<rbrakk>\n                 \\<Longrightarrow>\n                 \\<Gamma>\\<turnstile>\\<langle>Call p ,Normal s\\<rangle> =Suc n\\<Rightarrow>  Stuck\"\n\n| StuckProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> =n\\<Rightarrow>  Stuck\"\n\n| DynCom:  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>(c s),Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n             \\<Longrightarrow>\n             \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| Throw: \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> =n\\<Rightarrow>  Abrupt s\"\n\n| AbruptProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> =n\\<Rightarrow>  Abrupt s\"\n\n| CatchMatch: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow>  Abrupt s'; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s'\\<rangle> =n\\<Rightarrow> t\\<rbrakk>\n               \\<Longrightarrow>\n               \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n| CatchMiss: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow>  t; \\<not>isAbr t\\<rbrakk>\n               \\<Longrightarrow>\n               \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\ninductive_cases execn_elim_cases [cases set]:\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Skip,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Basic f,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Spec r,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>While b c,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Call p ,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Throw,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,s\\<rangle> =n\\<Rightarrow>  t\"\n\n\ninductive_cases execn_Normal_elim_cases [cases set]:\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\nlemma execn_Skip': \"\\<Gamma>\\<turnstile>\\<langle>Skip,t\\<rangle> =n\\<Rightarrow> t\"\n  by (cases t) (auto intro: execn.intros)\n\nlemma execn_Fault_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\" and s: \"s=Fault f\"\n  shows \"t=Fault f\"\nusing exec s by (induct) auto\n\nlemma execn_Stuck_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\" and s: \"s=Stuck\"\n  shows \"t=Stuck\"\nusing exec s by (induct) auto\n\nlemma execn_Abrupt_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\" and s: \"s=Abrupt s'\"\n  shows \"t=Abrupt s'\"\nusing exec s by (induct) auto\n\nlemma execn_block:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Normal t; \\<Gamma>\\<turnstile>\\<langle>c s t,Normal (return s t)\\<rangle> =n\\<Rightarrow>  u\\<rbrakk>\n  \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> =n\\<Rightarrow>  u\"\napply (unfold block_def)\nby (fastforce intro: execn.intros)\n\nlemma execn_blockAbrupt:\n     \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Abrupt t\\<rbrakk>\n       \\<Longrightarrow>\n       \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> =n\\<Rightarrow>  Abrupt (return s t)\"\napply (unfold block_def)\nby (fastforce intro: execn.intros)\n\nlemma execn_blockFault:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Fault f\\<rbrakk>\n   \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> =n\\<Rightarrow>  Fault f\"\napply (unfold block_def)\nby (fastforce intro: execn.intros)\n\nlemma execn_blockStuck:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Stuck\\<rbrakk>\n  \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> =n\\<Rightarrow>  Stuck\"\napply (unfold block_def)\nby (fastforce intro: execn.intros)\n\n\nlemma execn_call:\n \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Normal t;\n   \\<Gamma>\\<turnstile>\\<langle>c s t,Normal (return s t)\\<rangle> =Suc n\\<Rightarrow>  u\\<rbrakk>\n  \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =Suc n\\<Rightarrow>  u\"\napply (simp add: call_def)\napply (rule execn_block)\napply  (erule (1) Call)\napply assumption\ndone\n\n\nlemma execn_callAbrupt:\n \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Abrupt t\\<rbrakk>\n  \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =Suc n\\<Rightarrow>  Abrupt (return s t)\"\napply (simp add: call_def)\napply (rule execn_blockAbrupt)\napply (erule (1) Call)\ndone\n\nlemma execn_callFault:\n             \"\\<lbrakk>\\<Gamma> p=Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Fault f\\<rbrakk>\n               \\<Longrightarrow>\n              \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =Suc n\\<Rightarrow>  Fault f\"\napply (simp add: call_def)\napply (rule execn_blockFault)\napply (erule (1) Call)\ndone\n\nlemma execn_callStuck:\n          \"\\<lbrakk>\\<Gamma> p=Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Stuck\\<rbrakk>\n           \\<Longrightarrow>\n           \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =Suc n\\<Rightarrow>  Stuck\"\napply (simp add: call_def)\napply (rule execn_blockStuck)\napply (erule (1) Call)\ndone\n\nlemma  execn_callUndefined:\n       \"\\<lbrakk>\\<Gamma> p=None\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =Suc n\\<Rightarrow>  Stuck\"\napply (simp add: call_def)\napply (rule execn_blockStuck)\napply (erule CallUndefined)\ndone\n\nlemma execn_block_Normal_elim [consumes 1]:\nassumes execn_block: \"\\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\nassumes Normal:\n \"\\<And>t'.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Normal t';\n     \\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Abrupt:\n \"\\<And>t'.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Abrupt t';\n     t = Abrupt (return s t')\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Fault:\n \"\\<And>f.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Fault f;\n     t = Fault f\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Stuck:\n \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Stuck;\n     t = Stuck\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Undef:\n \"\\<lbrakk>\\<Gamma> p = None; t = Stuck\\<rbrakk> \\<Longrightarrow> P\"\nshows \"P\"\n  using execn_block\napply (unfold block_def)\napply (elim execn_Normal_elim_cases)\napply simp_all\napply  (case_tac s')\napply     simp_all\napply     (elim execn_Normal_elim_cases)\napply     simp\napply    (drule execn_Abrupt_end) apply simp\napply    (erule execn_Normal_elim_cases)\napply    simp\napply    (rule Abrupt,assumption+)\napply   (drule execn_Fault_end) apply simp\napply   (erule execn_Normal_elim_cases)\napply   simp\napply  (drule execn_Stuck_end) apply simp\napply  (erule execn_Normal_elim_cases)\napply  simp\napply (case_tac s')\napply    simp_all\napply   (elim execn_Normal_elim_cases)\napply   simp\napply   (rule Normal,assumption+)\napply  (drule execn_Fault_end) apply simp\napply  (rule Fault,assumption+)\napply (drule execn_Stuck_end) apply simp\napply (rule Stuck,assumption+)\ndone\n\nlemma execn_call_Normal_elim [consumes 1]:\nassumes exec_call: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\nassumes Normal:\n \"\\<And>bdy i t'.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =i\\<Rightarrow>  Normal t';\n     \\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc i\\<Rightarrow>  t; n = Suc i\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Abrupt:\n \"\\<And>bdy i t'.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =i\\<Rightarrow>  Abrupt t'; n = Suc i;\n     t = Abrupt (return s t')\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Fault:\n \"\\<And>bdy i f.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =i\\<Rightarrow>  Fault f; n = Suc i;\n     t = Fault f\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Stuck:\n \"\\<And>bdy i.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =i\\<Rightarrow>  Stuck; n = Suc i;\n     t = Stuck\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Undef:\n \"\\<And>i. \\<lbrakk>\\<Gamma> p = None; n = Suc i; t = Stuck\\<rbrakk> \\<Longrightarrow> P\"\nshows \"P\"\n  using exec_call\n  apply (unfold call_def)\n  apply (cases n)\n  apply  (simp only: block_def)\n  apply  (fastforce elim: execn_Normal_elim_cases)\n  apply (cases \"\\<Gamma> p\")\n  apply  (erule execn_block_Normal_elim)\n  apply      (elim execn_Normal_elim_cases)\n  apply       simp\n  apply      simp\n  apply     (elim execn_Normal_elim_cases)\n  apply      simp\n  apply     simp\n  apply    (elim execn_Normal_elim_cases)\n  apply     simp\n  apply    simp\n  apply   (elim execn_Normal_elim_cases)\n  apply    simp\n  apply   (rule Undef,assumption,assumption,assumption)\n  apply  (rule Undef,assumption+)\n  apply (erule execn_block_Normal_elim)\n  apply     (elim execn_Normal_elim_cases)\n  apply      simp\n  apply      (rule Normal,assumption+)\n  apply     simp\n  apply    (elim execn_Normal_elim_cases)\n  apply     simp\n  apply     (rule Abrupt,assumption+)\n  apply    simp\n  apply   (elim execn_Normal_elim_cases)\n  apply    simp\n  apply   (rule Fault,assumption+)\n  apply   simp\n  apply  (elim execn_Normal_elim_cases)\n  apply   simp\n  apply  (rule Stuck,assumption,assumption,assumption,assumption)\n  apply  (rule Undef,assumption,assumption,assumption)\n  apply (rule Undef,assumption+)\n  done\n\nlemma execn_dynCall:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n  \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\napply (simp add: dynCall_def)\nby (rule DynCom)\n\n\n\n\n\n\n\nlemma  execn_Seq':\n       \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow>  s'; \\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> =n\\<Rightarrow>  s''\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> =n\\<Rightarrow>  s''\"\n  apply (cases s)\n  apply    (fastforce intro: execn.intros)\n  apply   (fastforce dest: execn_Abrupt_end)\n  apply  (fastforce dest: execn_Fault_end)\n  apply (fastforce dest: execn_Stuck_end)\n  done\n\nlemma execn_mono:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\"\n  shows \"\\<And> m. n \\<le> m \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =m\\<Rightarrow>  t\"\nusing exec\nby (induct) (auto intro: execn.intros dest: Suc_le_D)\n\n\nlemma execn_Suc:\n  \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =Suc n\\<Rightarrow>  t\"\n  by (rule execn_mono [OF _ le_refl [THEN le_SucI]])\n\nlemma execn_assoc:\n \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 (Seq c2 c3),s\\<rangle> =n\\<Rightarrow>  t = \\<Gamma>\\<turnstile>\\<langle>Seq (Seq c1 c2) c3,s\\<rangle> =n\\<Rightarrow>  t\"\n  by (auto elim!: execn_elim_cases intro: execn_Seq')\n\n\nlemma execn_to_exec:\n  assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nusing execn\nby induct (auto intro: exec.intros)\n\nlemma exec_to_execn:\n  assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>n. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\"\nusing execn\nproof (induct)\n  case Skip thus ?case by (iprover intro: execn.intros)\nnext\n  case Guard thus ?case by (iprover intro: execn.intros)\nnext\n  case GuardFault thus ?case by (iprover intro: execn.intros)\nnext\n case FaultProp thus ?case by (iprover intro: execn.intros)\nnext\n  case Basic thus ?case by (iprover intro: execn.intros)\nnext\n  case Spec thus ?case by (iprover intro: execn.intros)\nnext\n  case SpecStuck thus ?case by (iprover intro: execn.intros)\nnext\n  case (Seq c1 s s' c2 s'')\n  then obtain n m where\n    \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow>  s'\" \"\\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> =m\\<Rightarrow>  s''\"\n    by blast\n  then have\n    \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =max n m\\<Rightarrow>  s'\"\n    \"\\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> =max n m\\<Rightarrow>  s''\"\n    by (auto elim!: execn_mono intro: max.cobounded1 max.cobounded2)\n  thus ?case\n    by (iprover intro: execn.intros)\nnext\n  case CondTrue thus ?case by (iprover intro: execn.intros)\nnext\n  case CondFalse thus ?case by (iprover intro: execn.intros)\nnext\n  case (WhileTrue s b c s' s'')\n  then obtain n m where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow>  s'\" \"\\<Gamma>\\<turnstile>\\<langle>While b c,s'\\<rangle> =m\\<Rightarrow>  s''\"\n    by blast\n  then have\n    \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =max n m\\<Rightarrow>  s'\" \"\\<Gamma>\\<turnstile>\\<langle>While b c,s'\\<rangle> =max n m\\<Rightarrow>  s''\"\n    by (auto elim!: execn_mono intro: max.cobounded1 max.cobounded2)\n  with WhileTrue\n  show ?case\n    by (iprover intro: execn.intros)\nnext\n  case WhileFalse thus ?case by (iprover intro: execn.intros)\nnext\n  case Call thus ?case by (iprover intro: execn.intros)\nnext\n  case CallUndefined thus ?case by (iprover intro: execn.intros)\nnext\n  case StuckProp thus ?case by (iprover intro: execn.intros)\nnext\n  case DynCom thus ?case by (iprover intro: execn.intros)\nnext\n  case Throw thus ?case by (iprover intro: execn.intros)\nnext\n  case AbruptProp thus ?case by (iprover intro: execn.intros)\nnext\n  case (CatchMatch c1 s s' c2 s'')\n  then obtain n m where\n    \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow>  Abrupt s'\" \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> =m\\<Rightarrow>  s''\"\n    by blast\n  then have\n    \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =max n m\\<Rightarrow>  Abrupt s'\"\n    \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> =max n m\\<Rightarrow>  s''\"\n    by (auto elim!: execn_mono intro: max.cobounded1 max.cobounded2)\n  with CatchMatch.hyps show ?case\n    by (iprover intro: execn.intros)\nnext\n  case CatchMiss thus ?case by (iprover intro: execn.intros)\nqed\n\ntheorem exec_iff_execn: \"(\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t) = (\\<exists>n. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t)\"\n  by (iprover intro: exec_to_execn execn_to_exec)\n\n\ndefinition nfinal_notin:: \"('s,'p,'f) body \\<Rightarrow> ('s,'p,'f) com \\<Rightarrow> ('s,'f) xstate \\<Rightarrow>  nat\n                       \\<Rightarrow> ('s,'f) xstate set \\<Rightarrow> bool\"\n  (\"_\\<turnstile> \\<langle>_,_\\<rangle> =_\\<Rightarrow>\\<notin>_\"  [60,20,98,65,60] 89) where\n\"\\<Gamma>\\<turnstile> \\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>T = (\\<forall>t. \\<Gamma>\\<turnstile> \\<langle>c,s\\<rangle> =n\\<Rightarrow> t \\<longrightarrow> t\\<notin>T)\"\n\ndefinition final_notin:: \"('s,'p,'f) body \\<Rightarrow> ('s,'p,'f) com \\<Rightarrow> ('s,'f) xstate\n                       \\<Rightarrow> ('s,'f) xstate set \\<Rightarrow> bool\"\n  (\"_\\<turnstile> \\<langle>_,_\\<rangle> \\<Rightarrow>\\<notin>_\"  [60,20,98,60] 89) where\n\"\\<Gamma>\\<turnstile> \\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T = (\\<forall>t. \\<Gamma>\\<turnstile> \\<langle>c,s\\<rangle> \\<Rightarrow>t \\<longrightarrow> t\\<notin>T)\"\n\nlemma final_notinI: \"\\<lbrakk>\\<And>t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> t \\<notin> T\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T\"\n  by (simp add: final_notin_def)\n\nlemma noFaultStuck_Call_body': \"p \\<in> dom \\<Gamma> \\<Longrightarrow>\n\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) =\n\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n  by (clarsimp simp add: final_notin_def exec_Call_body)\n\nlemma noFault_startn:\n  assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" and t: \"t\\<noteq>Fault f\"\n  shows \"s\\<noteq>Fault f\"\nusing execn t by (induct) auto\n\nlemma noFault_start:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" and t: \"t\\<noteq>Fault f\"\n  shows \"s\\<noteq>Fault f\"\nusing exec t by (induct) auto\n\nlemma noStuck_startn:\n  assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" and t: \"t\\<noteq>Stuck\"\n  shows \"s\\<noteq>Stuck\"\nusing execn t by (induct) auto\n\nlemma noStuck_start:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" and t: \"t\\<noteq>Stuck\"\n  shows \"s\\<noteq>Stuck\"\nusing exec t by (induct) auto\n\nlemma noAbrupt_startn:\n  assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" and t: \"\\<forall>t'. t\\<noteq>Abrupt t'\"\n  shows \"s\\<noteq>Abrupt s'\"\nusing execn t by (induct) auto\n\nlemma noAbrupt_start:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" and t: \"\\<forall>t'. t\\<noteq>Abrupt t'\"\n  shows \"s\\<noteq>Abrupt s'\"\nusing exec t by (induct) auto\n\nlemma noFaultn_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Fault f\"\n  by (auto dest: noFault_startn)\n\nlemma noFaultn_startD': \"t\\<noteq>Fault f \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> s \\<noteq> Fault f\"\n  by (auto dest: noFault_startn)\n\nlemma noFault_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Fault f\"\n  by (auto dest: noFault_start)\n\nlemma noFault_startD': \"t\\<noteq>Fault f\\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> s \\<noteq> Fault f\"\n  by (auto dest: noFault_start)\n\nlemma noStuckn_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Stuck\"\n  by (auto dest: noStuck_startn)\n\nlemma noStuckn_startD': \"t\\<noteq>Stuck \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> s \\<noteq> Stuck\"\n  by (auto dest: noStuck_startn)\n\nlemma noStuck_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Stuck\"\n  by (auto dest: noStuck_start)\n\nlemma noStuck_startD': \"t\\<noteq>Stuck \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> s \\<noteq> Stuck\"\n  by (auto dest: noStuck_start)\n\nlemma noAbruptn_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Abrupt s'\"\n  by (auto dest: noAbrupt_startn)\n\nlemma noAbrupt_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Abrupt s'\"\n  by (auto dest: noAbrupt_start)\n\nlemma noFaultnI: \"\\<lbrakk>\\<And>t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t \\<Longrightarrow> t\\<noteq>Fault f\\<rbrakk> \\<Longrightarrow>  \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault f}\"\n  by (simp add: nfinal_notin_def)\n\nlemma noFaultnI':\n  assumes contr: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Fault f \\<Longrightarrow> False\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault f}\"\n  proof (rule noFaultnI)\n    fix t assume \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    with contr show \"t \\<noteq> Fault f\"\n      by (cases \"t=Fault f\") auto\n  qed\n\nlemma noFaultn_def': \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault f} = (\\<not>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Fault f)\"\n  apply rule\n  apply  (fastforce simp add: nfinal_notin_def)\n  apply (fastforce intro: noFaultnI')\n  done\n\n\n\nlemma noStucknI':\n  assumes contr: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Stuck \\<Longrightarrow> False\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Stuck}\"\n  proof (rule noStucknI)\n    fix t assume \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    with contr show \"t \\<noteq> Stuck\"\n      by (cases t) auto\n  qed\n\nlemma noStuckn_def': \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Stuck} = (\\<not>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Stuck)\"\n  apply rule\n  apply  (fastforce simp add: nfinal_notin_def)\n  apply (fastforce intro: noStucknI')\n  done\n\n\nlemma noFaultI: \"\\<lbrakk>\\<And>t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t \\<Longrightarrow> t\\<noteq>Fault f\\<rbrakk> \\<Longrightarrow>  \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}\"\n  by (simp add: final_notin_def)\n\nlemma noFaultI':\n  assumes contr: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Fault f\\<Longrightarrow> False\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}\"\n  proof (rule noFaultI)\n    fix t assume \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n    with contr show \"t \\<noteq> Fault f\"\n      by (cases \"t=Fault f\") auto\n  qed\n\nlemma noFaultE:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Fault f\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp add: final_notin_def)\n\n\n\n\nlemma noStuckI: \"\\<lbrakk>\\<And>t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t \\<Longrightarrow> t\\<noteq>Stuck\\<rbrakk> \\<Longrightarrow>  \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (simp add: final_notin_def)\n\nlemma noStuckI':\n  assumes contr: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Stuck \\<Longrightarrow> False\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  proof (rule noStuckI)\n    fix t assume \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n    with contr show \"t \\<noteq> Stuck\"\n      by (cases t) auto\n  qed\n\nlemma noStuckE:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Stuck\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp add: final_notin_def)\n\nlemma noStuck_def': \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck} = (\\<not>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Stuck)\"\n  apply rule\n  apply  (fastforce simp add: final_notin_def)\n  apply (fastforce intro: noStuckI')\n  done\n\n\nlemma noFaultn_execD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault f}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> t\\<noteq>Fault f\"\n  by (simp add: nfinal_notin_def)\n\nlemma noFault_execD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> t\\<noteq>Fault f\"\n  by (simp add: final_notin_def)\n\nlemma noFaultn_exec_startD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault f}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> s\\<noteq>Fault f\"\n  by (auto simp add: nfinal_notin_def dest: noFaultn_startD)\n\nlemma noFault_exec_startD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> s\\<noteq>Fault f\"\n  by (auto simp add: final_notin_def dest: noFault_startD)\n\nlemma noStuckn_execD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> t\\<noteq>Stuck\"\n  by (simp add: nfinal_notin_def)\n\nlemma noStuck_execD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> t\\<noteq>Stuck\"\n  by (simp add: final_notin_def)\n\nlemma noStuckn_exec_startD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> s\\<noteq>Stuck\"\n  by (auto simp add: nfinal_notin_def dest: noStuckn_startD)\n\nlemma noStuck_exec_startD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> s\\<noteq>Stuck\"\n  by (auto simp add: final_notin_def dest: noStuck_startD)\n\nlemma noFaultStuckn_execD:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault True,Fault False,Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \\<Longrightarrow>\n       t\\<notin>{Fault True,Fault False,Stuck}\"\n  by (simp add: nfinal_notin_def)\n\nlemma noFaultStuck_execD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault True,Fault False,Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk>\n \\<Longrightarrow> t\\<notin>{Fault True,Fault False,Stuck}\"\n  by (simp add: final_notin_def)\n\nlemma noFaultStuckn_exec_startD:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault True, Fault False,Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk>\n   \\<Longrightarrow> s\\<notin>{Fault True,Fault False,Stuck}\"\n  by (auto simp add: nfinal_notin_def )\n\nlemma noFaultStuck_exec_startD:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault True, Fault False,Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk>\n  \\<Longrightarrow> s\\<notin>{Fault True,Fault False,Stuck}\"\n  by (auto simp add: final_notin_def )\n\nlemma noStuck_Call:\n  assumes noStuck: \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  shows \"p \\<in> dom \\<Gamma>\"\nproof (cases \"p \\<in> dom \\<Gamma>\")\n  case True thus ?thesis by simp\nnext\n  case False\n  hence \"\\<Gamma> p = None\" by auto\n  hence \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>Stuck\"\n    by (rule exec.CallUndefined)\n  with noStuck show ?thesis\n    by (auto simp add: final_notin_def)\nqed\n\n\nlemma Guard_noFaultStuckD:\n  assumes \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n  assumes \"f \\<notin> F\"\n  shows \"s \\<in> g\"\n  using assms\n  by (auto simp add: final_notin_def intro: exec.intros)\n\n\nlemma final_notin_to_finaln:\n  assumes notin: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>T\"\nproof (clarsimp simp add: nfinal_notin_def)\n  fix t assume \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" and \"t\\<in>T\"\n  with notin show \"False\"\n    by (auto intro: execn_to_exec simp add: final_notin_def)\nqed\n\nlemma noFault_Call_body:\n\"\\<Gamma> p=Some bdy\\<Longrightarrow>\n \\<Gamma>\\<turnstile>\\<langle>Call p ,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Fault f} =\n \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}\"\n  by (simp add: noFault_def' exec_Call_body)\n\nlemma noStuck_Call_body:\n\"\\<Gamma> p=Some bdy\\<Longrightarrow>\n \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck} =\n \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (simp add: noStuck_def' exec_Call_body)\n\nlemma exec_final_notin_to_execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>T\"\n  by (auto simp add: final_notin_def nfinal_notin_def dest: execn_to_exec)\n\nlemma execn_final_notin_to_exec: \"\\<forall>n. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>T \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T\"\n  by (auto simp add: final_notin_def nfinal_notin_def dest: exec_to_execn)\n\nlemma exec_final_notin_iff_execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T = (\\<forall>n. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>T)\"\n  by (auto intro: exec_final_notin_to_execn execn_final_notin_to_exec)\n\nlemma Seq_NoFaultStuckD2:\n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<forall>t. \\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> t\\<notin> ({Stuck} \\<union> Fault `  F) \\<longrightarrow>\n             \\<Gamma>\\<turnstile>\\<langle>c2,t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nusing noabort\nby (auto simp add: final_notin_def intro: exec_Seq') lemma Seq_NoFaultStuckD1:\n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nproof (rule final_notinI)\n  fix t\n  assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t\"\n  show \"t \\<notin> {Stuck} \\<union> Fault `  F\"\n  proof\n    assume \"t \\<in> {Stuck} \\<union> Fault `  F\"\n    moreover\n    {\n      assume \"t = Stuck\"\n      with exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Stuck\"\n        by (auto intro: exec_Seq')\n      with noabort have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    moreover\n    {\n      assume \"t \\<in> Fault ` F\"\n      then obtain f where\n      t: \"t=Fault f\" and f: \"f \\<in> F\"\n        by auto\n      from t exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Fault f\"\n        by (auto intro: exec_Seq')\n      with noabort f have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    ultimately show False by auto\n  qed\nqed\n\nlemma Seq_NoFaultStuckD2':\n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<forall>t. \\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> t\\<notin> ({Stuck} \\<union> Fault `  F) \\<longrightarrow>\n             \\<Gamma>\\<turnstile>\\<langle>c2,t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nusing noabort\nby (auto simp add: final_notin_def intro: exec_Seq')\n\n\n(* ************************************************************************* *)\nsubsection \\<open>Lemmas about @{const \"sequence\"}, @{const \"flatten\"} and\n @{const \"normalize\"}\\<close>\n(* ************************************************************************ *)\n\nlemma execn_sequence_app: \"\\<And>s s' t.\n \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> =n\\<Rightarrow> s'; \\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =n\\<Rightarrow> t\\<rbrakk>\n \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs@ys),Normal s\\<rangle> =n\\<Rightarrow> t\"\nproof (induct xs)\n  case Nil\n  thus ?case by (auto elim: execn_Normal_elim_cases)\nnext\n  case (Cons x xs)\n  have exec_x_xs: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (x # xs),Normal s\\<rangle> =n\\<Rightarrow> s'\" by fact\n  have exec_ys: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases xs)\n    case Nil\n    with exec_x_xs have \"\\<Gamma>\\<turnstile>\\<langle>x,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n      by (auto elim: execn_Normal_elim_cases )\n    with Nil exec_ys show ?thesis\n      by (cases ys) (auto intro: execn.intros elim: execn_elim_cases)\n  next\n    case Cons\n    with exec_x_xs\n    obtain s'' where\n      exec_x: \"\\<Gamma>\\<turnstile>\\<langle>x,Normal s\\<rangle> =n\\<Rightarrow> s''\" and\n      exec_xs: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,s''\\<rangle> =n\\<Rightarrow> s'\"\n      by (auto elim: execn_Normal_elim_cases )\n    show ?thesis\n    proof (cases s'')\n      case (Normal s''')\n      from Cons.hyps [OF exec_xs [simplified Normal] exec_ys]\n      have \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s'''\\<rangle> =n\\<Rightarrow> t\" .\n      with Cons exec_x Normal\n      show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case (Abrupt s''')\n      with exec_xs have \"s'=Abrupt s'''\"\n        by (auto dest: execn_Abrupt_end)\n      with exec_ys have \"t=Abrupt s'''\"\n        by (auto dest: execn_Abrupt_end)\n      with exec_x Abrupt Cons show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case (Fault f)\n      with exec_xs have \"s'=Fault f\"\n        by (auto dest: execn_Fault_end)\n      with exec_ys have \"t=Fault f\"\n        by (auto dest: execn_Fault_end)\n      with exec_x Fault Cons show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case Stuck\n      with exec_xs have \"s'=Stuck\"\n        by (auto dest: execn_Stuck_end)\n      with exec_ys have \"t=Stuck\"\n        by (auto dest: execn_Stuck_end)\n      with exec_x Stuck Cons show ?thesis\n        by (auto intro: execn.intros)\n    qed\n  qed\nqed\n\nlemma execn_sequence_appD: \"\\<And>s t. \\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow>\n         \\<exists>s'. \\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> =n\\<Rightarrow> s' \\<and> \\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =n\\<Rightarrow> t\"\nproof (induct xs)\n  case Nil\n  thus ?case\n    by (auto intro: execn.intros)\nnext\n  case (Cons x xs)\n  have exec_app: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq ((x # xs) @ ys),Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases xs)\n    case Nil\n    with exec_app show ?thesis\n      by (cases ys) (auto elim: execn_Normal_elim_cases intro: execn_Skip')\n  next\n    case Cons\n    with exec_app obtain s' where\n      exec_x: \"\\<Gamma>\\<turnstile>\\<langle>x,Normal s\\<rangle> =n\\<Rightarrow> s'\" and\n      exec_xs_ys: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),s'\\<rangle> =n\\<Rightarrow> t\"\n      by (auto elim: execn_Normal_elim_cases)\n    show ?thesis\n    proof (cases s')\n      case (Normal s'')\n      from Cons.hyps [OF exec_xs_ys [simplified Normal]] Normal exec_x Cons\n      show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case (Abrupt s'')\n      with exec_xs_ys have \"t=Abrupt s''\"\n        by (auto dest: execn_Abrupt_end)\n      with Abrupt exec_x Cons\n      show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case (Fault f)\n      with exec_xs_ys have \"t=Fault f\"\n        by (auto dest: execn_Fault_end)\n      with Fault exec_x Cons\n      show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case Stuck\n      with exec_xs_ys have \"t=Stuck\"\n        by (auto dest: execn_Stuck_end)\n      with Stuck exec_x Cons\n      show ?thesis\n        by (auto intro: execn.intros)\n    qed\n  qed\nqed\n\nlemma execn_sequence_appE [consumes 1]:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> =n\\<Rightarrow> t;\n   \\<And>s'. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> =n\\<Rightarrow> s';\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =n\\<Rightarrow> t\\<rbrakk> \\<Longrightarrow> P\n   \\<rbrakk> \\<Longrightarrow> P\"\n  by (auto dest: execn_sequence_appD)\n\nlemma execn_to_execn_sequence_flatten:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c),s\\<rangle> =n\\<Rightarrow> t\"\nusing exec\nproof induct\n  case (Seq c1 c2 n s s' s'') thus ?case\n    by (auto intro: execn.intros execn_sequence_app)\nqed (auto intro: execn.intros)\n\nlemma execn_to_execn_normalize:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> =n\\<Rightarrow> t\"\nusing exec\nproof induct\n  case (Seq c1 c2 n s s' s'') thus ?case\n    by (auto intro: execn_to_execn_sequence_flatten  execn_sequence_app )\nqed (auto intro: execn.intros)\n\n\n\nlemma execn_sequence_flatten_to_execn:\n  shows \"\\<And>s t. \\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c),s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\nproof (induct c)\n  case (Seq c1 c2)\n  have exec_seq: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten (Seq c1 c2)),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Normal s')\n    with exec_seq obtain s'' where\n      \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c1),Normal s'\\<rangle> =n\\<Rightarrow> s''\" and\n      \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c2),s''\\<rangle> =n\\<Rightarrow> t\"\n      by (auto elim: execn_sequence_appE)\n    with Seq.hyps Normal\n    show ?thesis\n      by (fastforce intro: execn.intros)\n  next\n    case Abrupt\n    with exec_seq\n    show ?thesis by (auto intro: execn.intros dest: execn_Abrupt_end)\n  next\n    case Fault\n    with exec_seq\n    show ?thesis by (auto intro: execn.intros dest: execn_Fault_end)\n  next\n    case Stuck\n    with exec_seq\n    show ?thesis by (auto intro: execn.intros dest: execn_Stuck_end)\n  qed\nqed auto\n\nlemma execn_normalize_to_execn:\n  shows \"\\<And>s t n. \\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\nproof (induct c)\n  case Skip thus ?case by simp\nnext\n  case Basic thus ?case by simp\nnext\n  case Spec thus ?case by simp\nnext\n  case (Seq c1 c2)\n  have \"\\<Gamma>\\<turnstile>\\<langle>normalize (Seq c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  hence exec_norm_seq:\n    \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten (normalize c1) @ flatten (normalize c2)),s\\<rangle> =n\\<Rightarrow> t\"\n    by simp\n  show ?case\n  proof (cases s)\n    case (Normal s')\n    with exec_norm_seq obtain s'' where\n      exec_norm_c1: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten (normalize c1)),Normal s'\\<rangle> =n\\<Rightarrow> s''\" and\n      exec_norm_c2: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten (normalize c2)),s''\\<rangle> =n\\<Rightarrow> t\"\n      by (auto elim: execn_sequence_appE)\n    from execn_sequence_flatten_to_execn [OF exec_norm_c1]\n      execn_sequence_flatten_to_execn [OF exec_norm_c2] Seq.hyps Normal\n    show ?thesis\n      by (fastforce intro: execn.intros)\n  next\n    case (Abrupt s')\n    with exec_norm_seq have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Fault f)\n    with exec_norm_seq have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_norm_seq have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by (auto intro: execn.intros)\n  qed\nnext\n  case Cond thus ?case\n    by (auto intro: execn.intros elim!: execn_elim_cases)\nnext\n  case (While b c)\n  have \"\\<Gamma>\\<turnstile>\\<langle>normalize (While b c),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  hence exec_norm_w: \"\\<Gamma>\\<turnstile>\\<langle>While b (normalize c),s\\<rangle> =n\\<Rightarrow> t\"\n    by simp\n  {\n    fix s t w\n    assume exec_w: \"\\<Gamma>\\<turnstile>\\<langle>w,s\\<rangle> =n\\<Rightarrow> t\"\n    have \"w=While b (normalize c) \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>While b c,s\\<rangle> =n\\<Rightarrow> t\"\n      using exec_w\n    proof (induct)\n      case (WhileTrue s b' c' n w t)\n      from WhileTrue obtain\n        s_in_b: \"s \\<in> b\" and\n        exec_c: \"\\<Gamma>\\<turnstile>\\<langle>normalize c,Normal s\\<rangle> =n\\<Rightarrow> w\" and\n        hyp_w: \"\\<Gamma>\\<turnstile>\\<langle>While b c,w\\<rangle> =n\\<Rightarrow> t\"\n        by simp\n      from While.hyps [OF exec_c]\n      have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> w\"\n        by simp\n      with hyp_w s_in_b\n      have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by (auto intro: execn.intros)\n      with WhileTrue show ?case by simp\n    qed (auto intro: execn.intros)\n  }\n  from this [OF exec_norm_w]\n  show ?case\n    by simp\nnext\n  case Call thus ?case by simp\nnext\n  case DynCom thus ?case by (auto intro: execn.intros elim!: execn_elim_cases)\nnext\n  case Guard thus ?case by (auto intro: execn.intros elim!: execn_elim_cases)\nnext\n  case Throw thus ?case by simp\nnext\n  case Catch thus ?case by (fastforce intro: execn.intros elim!: execn_elim_cases)\nqed\n\nlemma execn_normalize_iff_execn:\n \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> =n\\<Rightarrow> t = \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n  by (auto intro: execn_to_execn_normalize execn_normalize_to_execn)\n\nlemma exec_sequence_app:\n  assumes exec_xs: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> \\<Rightarrow> s'\"\n  assumes exec_ys: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs@ys),Normal s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec_xs]\n  obtain n where\n    execn_xs: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> =n\\<Rightarrow> s'\"..\n  from exec_to_execn [OF exec_ys]\n  obtain m where\n    execn_ys: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =m\\<Rightarrow> t\"..\n  with execn_xs obtain\n    \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> =max n m\\<Rightarrow> s'\"\n    \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =max n m\\<Rightarrow> t\"\n    by (auto intro: execn_mono max.cobounded1 max.cobounded2)\n  from execn_sequence_app [OF this]\n  have \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> =max n m\\<Rightarrow> t\" .\n  thus ?thesis\n    by (rule execn_to_exec)\nqed\n\nlemma exec_sequence_appD:\n  assumes exec_xs_ys: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>s'. \\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> \\<Rightarrow> s' \\<and> \\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec_xs_ys]\n  obtain n where \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> =n\\<Rightarrow> t\"..\n  thus ?thesis\n    by (cases rule: execn_sequence_appE) (auto intro: execn_to_exec)\nqed\n\n\nlemma exec_sequence_appE [consumes 1]:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> \\<Rightarrow> t;\n   \\<And>s'. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> \\<Rightarrow> s';\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> \\<Rightarrow> t\\<rbrakk> \\<Longrightarrow> P\n   \\<rbrakk> \\<Longrightarrow> P\"\n  by (auto dest: exec_sequence_appD)\n\nlemma exec_to_exec_sequence_flatten:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c),s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec]\n  obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"..\n  from execn_to_execn_sequence_flatten [OF this]\n  show ?thesis\n    by (rule execn_to_exec)\nqed\n\nlemma exec_sequence_flatten_to_exec:\n  assumes exec_seq: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c),s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec_seq]\n  obtain n where \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c),s\\<rangle> =n\\<Rightarrow> t\"..\n  from execn_sequence_flatten_to_execn [OF this]\n  show ?thesis\n    by (rule execn_to_exec)\nqed\n\nlemma exec_to_exec_normalize:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec] obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"..\n  hence \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_to_execn_normalize)\n  thus ?thesis\n    by (rule execn_to_exec)\nqed\n\nlemma exec_normalize_to_exec:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec] obtain n where \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> =n\\<Rightarrow> t\"..\n  hence \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_normalize_to_execn)\n  thus ?thesis\n    by (rule execn_to_exec)\nqed\n\n\n\n(* ************************************************************************* *)\nsubsection \\<open>Lemmas about @{term \"c\\<^sub>1 \\<subseteq>\\<^sub>g c\\<^sub>2\"}\\<close>\n(* ************************************************************************ *)\n\nlemma execn_to_execn_subseteq_guards: \"\\<And>c s t n. \\<lbrakk>c \\<subseteq>\\<^sub>g c'; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\\<rbrakk>\n    \\<Longrightarrow> \\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c',s\\<rangle> =n\\<Rightarrow> t' \\<and>\n            (isFault t \\<longrightarrow> isFault t') \\<and> (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof (induct c')\n  case Skip thus ?case\n    by (fastforce dest: subseteq_guardsD elim: execn_elim_cases)\nnext\n  case Basic thus ?case\n    by (fastforce dest: subseteq_guardsD elim: execn_elim_cases)\nnext\n  case Spec thus ?case\n    by (fastforce dest: subseteq_guardsD elim: execn_elim_cases)\nnext\n  case (Seq c1' c2')\n  have \"c \\<subseteq>\\<^sub>g Seq c1' c2'\" by fact\n  from subseteq_guards_Seq [OF this]\n  obtain c1 c2 where\n    c: \"c = Seq c1 c2\" and\n    c1_c1': \"c1 \\<subseteq>\\<^sub>g c1'\" and\n    c2_c2': \"c2 \\<subseteq>\\<^sub>g c2'\"\n    by blast\n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c obtain w where\n    exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> w\" and\n    exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,w\\<rangle> =n\\<Rightarrow> t\"\n    by (auto elim: execn_elim_cases)\n  from exec_c1 Seq.hyps c1_c1'\n  obtain w' where\n    exec_c1': \"\\<Gamma>\\<turnstile>\\<langle>c1',s\\<rangle> =n\\<Rightarrow> w'\" and\n    w_Fault: \"isFault w \\<longrightarrow> isFault w'\" and\n    w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w'=w\"\n    by blast\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"isFault w\")\n      case True\n      then obtain f where w': \"w=Fault f\"..\n      moreover with exec_c2\n      have t: \"t=Fault f\"\n        by (auto dest: execn_Fault_end)\n      ultimately show ?thesis\n        using Normal w_Fault exec_c1'\n        by (fastforce intro: execn.intros elim: isFaultE)\n    next\n      case False\n      note noFault_w = this\n      show ?thesis\n      proof (cases \"isFault w'\")\n        case True\n        then obtain f' where w': \"w'=Fault f'\"..\n        with Normal exec_c1'\n        have exec: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1' c2',s\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        then show ?thesis\n          by auto\n      next\n        case False\n        with w'_noFault have w': \"w'=w\" by simp\n        from Seq.hyps exec_c2 c2_c2'\n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c2',w\\<rangle> =n\\<Rightarrow> t'\" and\n          \"isFault t \\<longrightarrow> isFault t'\" and\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with Normal exec_c1' w'\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    qed\n  qed\nnext\n  case (Cond b c1' c2')\n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  have \"c \\<subseteq>\\<^sub>g Cond b c1' c2'\" by fact\n  from subseteq_guards_Cond [OF this]\n  obtain c1 c2 where\n    c: \"c = Cond b c1 c2\" and\n    c1_c1': \"c1 \\<subseteq>\\<^sub>g c1'\" and\n    c2_c2': \"c2 \\<subseteq>\\<^sub>g c2'\"\n    by blast\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    from exec [simplified c Normal]\n    show ?thesis\n    proof (cases)\n      assume s'_in_b: \"s' \\<in> b\"\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      with c1_c1' Normal Cond.hyps obtain t' where\n        \"\\<Gamma>\\<turnstile>\\<langle>c1',Normal s'\\<rangle> =n\\<Rightarrow> t'\"\n        \"isFault t \\<longrightarrow> isFault t'\"\n        \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with s'_in_b Normal show ?thesis\n        by (fastforce intro: execn.intros)\n    next\n      assume s'_notin_b: \"s' \\<notin> b\"\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      with c2_c2' Normal Cond.hyps obtain t' where\n        \"\\<Gamma>\\<turnstile>\\<langle>c2',Normal s'\\<rangle> =n\\<Rightarrow> t'\"\n        \"isFault t \\<longrightarrow> isFault t'\"\n        \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with s'_notin_b Normal show ?thesis\n        by (fastforce intro: execn.intros)\n    qed\n  qed\nnext\n  case (While b c')\n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  have \"c \\<subseteq>\\<^sub>g While b c'\" by fact\n  from subseteq_guards_While [OF this]\n  obtain c'' where\n    c: \"c = While b c''\" and\n    c''_c': \"c'' \\<subseteq>\\<^sub>g c'\"\n    by blast\n  {\n    fix c r w\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,r\\<rangle> =n\\<Rightarrow> w\"\n    assume c: \"c=While b c''\"\n    have \"\\<exists>w'. \\<Gamma>\\<turnstile>\\<langle>While b c',r\\<rangle> =n\\<Rightarrow> w' \\<and>\n                 (isFault w \\<longrightarrow> isFault w') \\<and> (\\<not> isFault w' \\<longrightarrow> w'=w)\"\n    using exec c\n    proof (induct)\n      case (WhileTrue r b' ca n u w)\n      have eqs: \"While b' ca = While b c''\" by fact\n      from WhileTrue have r_in_b: \"r \\<in> b\" by simp\n      from WhileTrue have exec_c'': \"\\<Gamma>\\<turnstile>\\<langle>c'',Normal r\\<rangle> =n\\<Rightarrow> u\" by simp\n      from While.hyps [OF c''_c' exec_c''] obtain u' where\n        exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',Normal r\\<rangle> =n\\<Rightarrow> u'\" and\n        u_Fault: \"isFault u \\<longrightarrow> isFault u' \"and\n        u'_noFault: \"\\<not> isFault u' \\<longrightarrow> u' = u\"\n        by blast\n      from WhileTrue obtain w' where\n        exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b c',u\\<rangle> =n\\<Rightarrow> w'\" and\n        w_Fault: \"isFault w \\<longrightarrow> isFault w'\" and\n        w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w' = w\"\n        by blast\n      show ?case\n      proof (cases \"isFault u'\")\n        case True\n        with exec_c' r_in_b\n        show ?thesis\n          by (fastforce intro: execn.intros elim: isFaultE)\n      next\n        case False\n        with exec_c' r_in_b u'_noFault exec_w w_Fault w'_noFault\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    next\n      case WhileFalse thus ?case by (fastforce intro: execn.intros)\n    qed auto\n  }\n  from this [OF exec c]\n  show ?case .\nnext\n  case Call thus ?case\n    by (fastforce dest: subseteq_guardsD elim: execn_elim_cases)\nnext\n  case (DynCom C')\n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  have \"c \\<subseteq>\\<^sub>g DynCom C'\" by fact\n  from subseteq_guards_DynCom [OF this] obtain C where\n    c: \"c = DynCom C\" and\n    C_C': \"\\<forall>s. C s \\<subseteq>\\<^sub>g C' s\"\n    by blast\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    from exec [simplified c Normal]\n    have \"\\<Gamma>\\<turnstile>\\<langle>C s',Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      by cases\n    from DynCom.hyps C_C' [rule_format] this obtain t' where\n      \"\\<Gamma>\\<turnstile>\\<langle>C' s',Normal s'\\<rangle> =n\\<Rightarrow> t'\"\n      \"isFault t \\<longrightarrow> isFault t'\"\n      \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n      by blast\n    with Normal show ?thesis\n      by (fastforce intro: execn.intros)\n  qed\nnext\n  case (Guard f' g' c')\n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  have \"c \\<subseteq>\\<^sub>g Guard f' g' c'\" by fact\n  hence subset_cases: \"(c \\<subseteq>\\<^sub>g c') \\<or> (\\<exists>c''. c = Guard f' g' c'' \\<and> (c'' \\<subseteq>\\<^sub>g c'))\"\n    by (rule subseteq_guards_Guard)\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    from subset_cases show ?thesis\n    proof\n      assume c_c': \"c \\<subseteq>\\<^sub>g c'\"\n      from Guard.hyps [OF this exec] Normal obtain t' where\n        exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n        t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and\n        t_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with Normal\n      show ?thesis\n        by (cases \"s' \\<in> g'\") (fastforce intro: execn.intros)+\n    next\n      assume \"\\<exists>c''. c = Guard f' g' c'' \\<and> (c'' \\<subseteq>\\<^sub>g c')\"\n      then obtain c'' where\n        c: \"c = Guard f' g' c''\" and\n        c''_c': \"c'' \\<subseteq>\\<^sub>g c'\"\n        by blast\n      from c exec Normal\n      have exec_Guard': \"\\<Gamma>\\<turnstile>\\<langle>Guard f' g' c'',Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by simp\n      thus ?thesis\n      proof (cases)\n        assume s'_in_g': \"s' \\<in> g'\"\n        assume exec_c'': \"\\<Gamma>\\<turnstile>\\<langle>c'',Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        from Guard.hyps [OF c''_c' exec_c'']  obtain t' where\n          exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n          t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and\n          t_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n          by blast\n        with Normal s'_in_g'\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      next\n        assume \"s' \\<notin> g'\" \"t=Fault f'\"\n        with Normal show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    qed\n  qed\nnext\n  case Throw thus ?case\n    by (fastforce dest: subseteq_guardsD intro: execn.intros\n         elim: execn_elim_cases)\nnext\n  case (Catch c1' c2')\n  have \"c \\<subseteq>\\<^sub>g Catch c1' c2'\" by fact\n  from subseteq_guards_Catch [OF this]\n  obtain c1 c2 where\n    c: \"c = Catch c1 c2\" and\n    c1_c1': \"c1 \\<subseteq>\\<^sub>g c1'\" and\n    c2_c2': \"c2 \\<subseteq>\\<^sub>g c2'\"\n    by blast\n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    from exec [simplified c Normal]\n    show ?thesis\n    proof (cases)\n      fix w\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> Abrupt w\"\n      assume exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal w\\<rangle> =n\\<Rightarrow> t\"\n      from Normal exec_c1 c1_c1' Catch.hyps obtain w' where\n        exec_c1': \"\\<Gamma>\\<turnstile>\\<langle>c1',Normal s'\\<rangle> =n\\<Rightarrow> w'\" and\n        w'_noFault:  \"\\<not> isFault w' \\<longrightarrow> w' = Abrupt w\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault w'\")\n        case True\n        with exec_c1' Normal show ?thesis\n          by (fastforce intro: execn.intros elim: isFaultE)\n      next\n        case False\n        with w'_noFault have w': \"w'=Abrupt w\" by simp\n        from Normal exec_c2 c2_c2' Catch.hyps obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c2',Normal w\\<rangle> =n\\<Rightarrow> t'\"\n          \"isFault t \\<longrightarrow> isFault t'\"\n          \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n          by blast\n        with exec_c1' w' Normal\n        show ?thesis\n          by (fastforce intro: execn.intros )\n      qed\n    next\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      assume t: \"\\<not> isAbr t\"\n      from Normal exec_c1 c1_c1' Catch.hyps obtain t' where\n        exec_c1': \"\\<Gamma>\\<turnstile>\\<langle>c1',Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n        t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and\n        t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault t'\")\n        case True\n        with exec_c1' Normal show ?thesis\n          by (fastforce intro: execn.intros elim: isFaultE)\n      next\n        case False\n        with exec_c1' Normal t_Fault t'_noFault t\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    qed\n  qed\nqed\n\nlemma exec_to_exec_subseteq_guards:\n  assumes c_c': \"c \\<subseteq>\\<^sub>g c'\"\n  assumes  exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c',s\\<rangle> \\<Rightarrow> t' \\<and>\n             (isFault t \\<longrightarrow> isFault t') \\<and> (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof -\n  from exec_to_execn [OF exec] obtain n where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" ..\n  from execn_to_execn_subseteq_guards [OF c_c' this]\n  show ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\n\n(* ************************************************************************* *)\nsubsection \\<open>Lemmas about @{const \"merge_guards\"}\\<close>\n(* ************************************************************************ *)\n\n\ntheorem execn_to_execn_merge_guards:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> =n\\<Rightarrow> t \"\nusing exec_c\nproof (induct)\n  case (Guard s g c n t f)\n  have s_in_g: \"s \\<in> g\"  by fact\n  have exec_merge_c: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases \"\\<exists>f' g' c'. merge_guards c = Guard f' g' c'\")\n    case False\n    with exec_merge_c s_in_g\n    show ?thesis\n      by (cases \"merge_guards c\") (auto intro: execn.intros simp add: Let_def)\n  next\n    case True\n    then obtain f' g' c' where\n      merge_guards_c: \"merge_guards c = Guard f' g' c'\"\n      by iprover\n    show ?thesis\n    proof (cases \"f=f'\")\n      case False\n      from exec_merge_c s_in_g merge_guards_c False show ?thesis\n        by (auto intro: execn.intros simp add: Let_def)\n    next\n      case True\n      from exec_merge_c s_in_g merge_guards_c True show ?thesis\n        by (fastforce intro: execn.intros elim: execn.cases)\n    qed\n  qed\nnext\n  case (GuardFault s g f c n)\n  have s_notin_g: \"s \\<notin> g\"  by fact\n  show ?case\n  proof (cases \"\\<exists>f' g' c'. merge_guards c = Guard f' g' c'\")\n    case False\n    with s_notin_g\n    show ?thesis\n      by (cases \"merge_guards c\") (auto intro: execn.intros simp add: Let_def)\n  next\n    case True\n    then obtain f' g' c' where\n      merge_guards_c: \"merge_guards c = Guard f' g' c'\"\n      by iprover\n    show ?thesis\n    proof (cases \"f=f'\")\n      case False\n      from s_notin_g merge_guards_c False show ?thesis\n        by (auto intro: execn.intros simp add: Let_def)\n    next\n      case True\n      from  s_notin_g merge_guards_c True show ?thesis\n        by (fastforce intro: execn.intros)\n    qed\n  qed\nqed (fastforce intro: execn.intros)+\n\nlemma execn_merge_guards_to_execn_Normal:\n  \"\\<And>s n t. \\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\nproof (induct c)\n  case Skip thus ?case by auto\nnext\n  case Basic thus ?case by auto\nnext\n  case Spec thus ?case by auto\nnext\n  case (Seq c1 c2)\n  have \"\\<Gamma>\\<turnstile>\\<langle>merge_guards (Seq c1 c2),Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  hence exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>Seq (merge_guards c1) (merge_guards c2),Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by simp\n  then obtain s' where\n    exec_merge_c1: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c1,Normal s\\<rangle> =n\\<Rightarrow> s'\" and\n    exec_merge_c2: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c2,s'\\<rangle> =n\\<Rightarrow> t\"\n    by cases\n  from exec_merge_c1\n  have exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n    by (rule Seq.hyps)\n  show ?case\n  proof (cases s')\n    case (Normal s'')\n    with exec_merge_c2\n    have \"\\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: Seq.hyps)\n    with exec_c1 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Abrupt s'')\n    with exec_merge_c2 have \"t=Abrupt s''\"\n      by (auto dest: execn_Abrupt_end)\n    with exec_c1 Abrupt\n    show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Fault f)\n    with exec_merge_c2 have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with exec_c1 Fault\n    show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_merge_c2 have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with exec_c1 Stuck\n    show ?thesis\n      by (auto intro: execn.intros)\n  qed\nnext\n  case Cond thus ?case\n    by (fastforce intro: execn.intros elim: execn_Normal_elim_cases)\nnext\n  case (While b c)\n  {\n    fix c' r w\n    assume exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',r\\<rangle> =n\\<Rightarrow> w\"\n    assume c': \"c'=While b (merge_guards c)\"\n    have \"\\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> w\"\n      using exec_c' c'\n    proof (induct)\n      case (WhileTrue r b' c'' n u w)\n      have eqs: \"While b' c'' = While b (merge_guards c)\" by fact\n      from WhileTrue\n      have r_in_b: \"r \\<in> b\"\n        by simp\n      from WhileTrue While.hyps have exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal r\\<rangle> =n\\<Rightarrow> u\"\n        by simp\n      from WhileTrue have exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b c,u\\<rangle> =n\\<Rightarrow> w\"\n        by simp\n      from r_in_b exec_c exec_w\n      show ?case\n        by (rule execn.WhileTrue)\n    next\n      case WhileFalse thus ?case by (auto intro: execn.WhileFalse)\n    qed auto\n  }\n  with While.prems show ?case\n    by (auto)\nnext\n  case Call thus ?case by simp\nnext\n  case DynCom thus ?case\n    by (fastforce intro: execn.intros elim: execn_Normal_elim_cases)\nnext\n  case (Guard f g c)\n  have exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards (Guard f g c),Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases \"s \\<in> g\")\n    case False\n    with exec_merge have \"t=Fault f\"\n      by (auto split: com.splits if_split_asm elim: execn_Normal_elim_cases\n        simp add: Let_def is_Guard_def)\n    with False show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case True\n    note s_in_g = this\n    show ?thesis\n    proof (cases \"\\<exists>f' g' c'. merge_guards c = Guard f' g' c'\")\n      case False\n      then\n      have \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n        by (cases \"merge_guards c\") (auto simp add: Let_def)\n      with exec_merge s_in_g\n      obtain \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      from Guard.hyps [OF this] s_in_g\n      show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case True\n      then obtain f' g' c' where\n        merge_guards_c: \"merge_guards c = Guard f' g' c'\"\n        by iprover\n      show ?thesis\n      proof (cases \"f=f'\")\n        case False\n        with merge_guards_c\n        have \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n          by (simp add: Let_def)\n        with exec_merge s_in_g\n        obtain \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n          by (auto elim: execn_Normal_elim_cases)\n        from Guard.hyps [OF this] s_in_g\n        show ?thesis\n          by (auto intro: execn.intros)\n      next\n        case True\n        note f_eq_f' = this\n        with merge_guards_c have\n          merge_guards_Guard: \"merge_guards (Guard f g c) = Guard f (g \\<inter> g') c'\"\n          by simp\n        show ?thesis\n        proof (cases \"s \\<in> g'\")\n          case True\n          with exec_merge merge_guards_Guard merge_guards_c s_in_g\n          have \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n            by (auto intro: execn.intros elim: execn_Normal_elim_cases)\n          with Guard.hyps [OF this] s_in_g\n          show ?thesis\n            by (auto intro: execn.intros)\n        next\n          case False\n          with exec_merge merge_guards_Guard\n          have \"t=Fault f\"\n            by (auto elim: execn_Normal_elim_cases)\n          with merge_guards_c f_eq_f' False\n          have \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n            by (auto intro: execn.intros)\n          from Guard.hyps [OF this] s_in_g\n          show ?thesis\n            by (auto intro: execn.intros)\n        qed\n      qed\n    qed\n  qed\nnext\n  case Throw thus ?case by simp\nnext\n  case (Catch c1 c2)\n  have \"\\<Gamma>\\<turnstile>\\<langle>merge_guards (Catch c1 c2),Normal s\\<rangle> =n\\<Rightarrow> t\"  by fact\n  hence \"\\<Gamma>\\<turnstile>\\<langle>Catch (merge_guards c1) (merge_guards c2),Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n  thus ?case\n    by cases (auto intro: execn.intros Catch.hyps)\nqed\n\ntheorem execn_merge_guards_to_execn:\n  \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> =n\\<Rightarrow> t\"\napply (cases s)\napply    (fastforce intro: execn_merge_guards_to_execn_Normal)\napply   (fastforce dest: execn_Abrupt_end)\napply  (fastforce dest: execn_Fault_end)\napply (fastforce dest: execn_Stuck_end)\ndone\n\ncorollary execn_iff_execn_merge_guards:\n \"\\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> =n\\<Rightarrow> t = \\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> =n\\<Rightarrow> t\"\n  by (blast intro: execn_merge_guards_to_execn execn_to_execn_merge_guards)\n\ntheorem exec_iff_exec_merge_guards:\n \"\\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> \\<Rightarrow> t = \\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> \\<Rightarrow> t\"\n  by (blast dest: exec_to_execn intro: execn_to_exec\n            intro: execn_to_execn_merge_guards\n                   execn_merge_guards_to_execn)\n\ncorollary exec_to_exec_merge_guards:\n \"\\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> \\<Rightarrow> t\"\n  by (rule iffD1 [OF exec_iff_exec_merge_guards])\n\ncorollary exec_merge_guards_to_exec:\n \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> \\<Rightarrow> t\"\n  by (rule iffD2 [OF exec_iff_exec_merge_guards])\n\n(* ************************************************************************* *)\nsubsection \\<open>Lemmas about @{const \"mark_guards\"}\\<close>\n(* ************************************************************************ *)\n\nlemma execn_to_execn_mark_guards:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,s\\<rangle> =n\\<Rightarrow> t \"\nusing exec_c t_not_Fault [simplified not_isFault_iff]\nby (induct) (auto intro: execn.intros dest: noFaultn_startD')\n\nlemma execn_to_execn_mark_guards_Fault:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n shows \"\\<And>f. \\<lbrakk>t=Fault f\\<rbrakk> \\<Longrightarrow> \\<exists>f'. \\<Gamma>\\<turnstile>\\<langle>mark_guards x c,s\\<rangle> =n\\<Rightarrow> Fault f'\"\nusing exec_c\nproof (induct)\n  case Skip thus ?case by auto\nnext\n  case Guard thus ?case by (fastforce intro: execn.intros)\nnext\n  case GuardFault thus ?case by (fastforce intro: execn.intros)\nnext\n  case FaultProp thus ?case by auto\nnext\n case Basic thus ?case by auto\nnext\n case Spec thus ?case by auto\nnext\n case SpecStuck thus ?case by auto\nnext\n  case (Seq c1 s n w c2 t)\n  have exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> w\" by fact\n  have exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t=Fault f\" by fact\n  show ?case\n  proof (cases w)\n    case (Fault f')\n    with exec_c2 t have \"f'=f\"\n      by (auto dest: execn_Fault_end)\n    with Fault Seq.hyps obtain f'' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c1,Normal s\\<rangle> =n\\<Rightarrow> Fault f''\"\n      by auto\n    moreover have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c2,Fault f''\\<rangle> =n\\<Rightarrow> Fault f''\"\n      by auto\n    ultimately show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Normal s')\n    with execn_to_execn_mark_guards [OF exec_c1]\n    have exec_mark_c1: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c1,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with Seq.hyps t obtain f' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c2,w\\<rangle> =n\\<Rightarrow> Fault f'\"\n      by blast\n    with exec_mark_c1 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Abrupt s')\n    with execn_to_execn_mark_guards [OF exec_c1]\n    have exec_mark_c1: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c1,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with Seq.hyps t obtain f' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c2,w\\<rangle> =n\\<Rightarrow> Fault f'\"\n      by (auto intro: execn.intros)\n    with exec_mark_c1 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_c2 have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with t show ?thesis by simp\n  qed\nnext\n  case CondTrue thus ?case by (fastforce intro: execn.intros)\nnext\n  case CondFalse thus ?case by (fastforce intro: execn.intros)\nnext\n  case (WhileTrue s b c n w t)\n  have exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> w\" by fact\n  have exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b c,w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t = Fault f\" by fact\n  have s_in_b: \"s \\<in> b\" by fact\n  show ?case\n  proof (cases w)\n    case (Fault f')\n    with exec_w t have \"f'=f\"\n      by (auto dest: execn_Fault_end)\n    with Fault WhileTrue.hyps obtain f'' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c,Normal s\\<rangle> =n\\<Rightarrow> Fault f''\"\n      by auto\n    moreover have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x (While b c),Fault f''\\<rangle> =n\\<Rightarrow> Fault f''\"\n      by auto\n    ultimately show ?thesis\n      using s_in_b by (auto intro: execn.intros)\n  next\n    case (Normal s')\n    with execn_to_execn_mark_guards [OF exec_c]\n    have exec_mark_c: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with WhileTrue.hyps t obtain f' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x (While b c),w\\<rangle> =n\\<Rightarrow> Fault f'\"\n      by blast\n    with exec_mark_c s_in_b show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Abrupt s')\n    with execn_to_execn_mark_guards [OF exec_c]\n    have exec_mark_c: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with WhileTrue.hyps t obtain f' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x (While b c),w\\<rangle> =n\\<Rightarrow> Fault f'\"\n      by (auto intro: execn.intros)\n    with exec_mark_c s_in_b show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_w have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with t show ?thesis by simp\n  qed\nnext\n  case WhileFalse thus ?case by (fastforce intro: execn.intros)\nnext\n  case Call thus ?case by (fastforce intro: execn.intros)\nnext\n  case CallUndefined thus ?case by simp\nnext\n  case StuckProp thus ?case by simp\nnext\n  case DynCom thus ?case by (fastforce intro: execn.intros)\nnext\n  case Throw thus ?case by simp\nnext\n  case AbruptProp thus ?case by simp\nnext\n  case (CatchMatch c1 s n w c2 t)\n  have exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt w\" by fact\n  have exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t = Fault f\" by fact\n  from execn_to_execn_mark_guards [OF exec_c1]\n  have exec_mark_c1: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt w\"\n    by simp\n  with CatchMatch.hyps t obtain f' where\n    \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c2,Normal w\\<rangle> =n\\<Rightarrow> Fault f'\"\n    by blast\n  with exec_mark_c1 show ?case\n    by (auto intro: execn.intros)\nnext\n  case CatchMiss thus ?case by (fastforce intro: execn.intros)\nqed\n\nlemma execn_mark_guards_to_execn:\n  \"\\<And>s n t. \\<Gamma>\\<turnstile>\\<langle>mark_guards f c,s\\<rangle> =n\\<Rightarrow> t\n  \\<Longrightarrow> \\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t' \\<and>\n            (isFault t \\<longrightarrow> isFault t') \\<and>\n            (t' = Fault f \\<longrightarrow> t'=t) \\<and>\n            (isFault t' \\<longrightarrow> isFault t) \\<and>\n            (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof (induct c)\n  case Skip thus ?case by auto\nnext\n  case Basic thus ?case by auto\nnext\n  case Spec thus ?case by auto\nnext\n  case (Seq c1 c2 s n t)\n  have exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f (Seq c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  then obtain w where\n    exec_mark_c1: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c1,s\\<rangle> =n\\<Rightarrow> w\" and\n    exec_mark_c2: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c2,w\\<rangle> =n\\<Rightarrow> t\"\n    by (auto elim: execn_elim_cases)\n  from Seq.hyps exec_mark_c1\n  obtain w' where\n    exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> w'\" and\n    w_Fault: \"isFault w \\<longrightarrow> isFault w'\" and\n    w'_Fault_f: \"w' = Fault f \\<longrightarrow> w'=w\" and\n    w'_Fault: \"isFault w' \\<longrightarrow> isFault w\" and\n    w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w'=w\"\n    by blast\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec_mark have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_mark have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_mark have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"isFault w\")\n      case True\n      then obtain f where w': \"w=Fault f\"..\n      moreover with exec_mark_c2\n      have t: \"t=Fault f\"\n        by (auto dest: execn_Fault_end)\n      ultimately show ?thesis\n        using Normal w_Fault w'_Fault_f exec_c1\n        by (fastforce intro: execn.intros elim: isFaultE)\n    next\n      case False\n      note noFault_w = this\n      show ?thesis\n      proof (cases \"isFault w'\")\n        case True\n        then obtain f' where w': \"w'=Fault f'\"..\n        with Normal exec_c1\n        have exec: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        from w'_Fault_f w' noFault_w\n        have \"f' \\<noteq> f\"\n          by (cases w) auto\n        moreover\n        from w' w'_Fault exec_mark_c2 have \"isFault t\"\n          by (auto dest: execn_Fault_end elim: isFaultE)\n        ultimately\n        show ?thesis\n          using exec\n          by auto\n      next\n        case False\n        with w'_noFault have w': \"w'=w\" by simp\n        from Seq.hyps exec_mark_c2\n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c2,w\\<rangle> =n\\<Rightarrow> t'\" and\n          \"isFault t \\<longrightarrow> isFault t'\" and\n          \"t' = Fault f \\<longrightarrow> t'=t\" and\n          \"isFault t' \\<longrightarrow> isFault t\" and\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with Normal exec_c1 w'\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    qed\n  qed\nnext\n  case (Cond b c1 c2 s n t)\n  have exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f (Cond b c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_mark have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_mark have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_mark have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"s'\\<in> b\")\n      case True\n      with Normal exec_mark\n      have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c1 ,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal True Cond.hyps obtain t'\n        where \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t'\"\n            \"isFault t \\<longrightarrow> isFault t'\"\n            \"t' = Fault f \\<longrightarrow> t'=t\"\n            \"isFault t' \\<longrightarrow> isFault t\"\n            \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with Normal True\n      show ?thesis\n        by (blast intro: execn.intros)\n    next\n      case False\n      with Normal exec_mark\n      have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c2 ,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal False Cond.hyps obtain t'\n        where \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> =n\\<Rightarrow> t'\"\n            \"isFault t  \\<longrightarrow> isFault t'\"\n            \"t' = Fault f  \\<longrightarrow> t'=t\"\n            \"isFault t' \\<longrightarrow> isFault t\"\n            \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with Normal False\n      show ?thesis\n        by (blast intro: execn.intros)\n    qed\n  qed\nnext\n  case (While b c s n t)\n  have exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f (While b c),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_mark have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_mark have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_mark have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    {\n      fix c' r w\n      assume exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',r\\<rangle> =n\\<Rightarrow> w\"\n      assume c': \"c'=While b (mark_guards f c)\"\n      have \"\\<exists>w'. \\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> w' \\<and> (isFault w \\<longrightarrow> isFault w') \\<and>\n                   (w' = Fault f \\<longrightarrow> w'=w) \\<and> (isFault w' \\<longrightarrow> isFault w) \\<and>\n                   (\\<not> isFault w' \\<longrightarrow> w'=w)\"\n        using exec_c' c'\n      proof (induct)\n        case (WhileTrue r b' c'' n u w)\n        have eqs: \"While b' c'' = While b (mark_guards f c)\" by fact\n        from WhileTrue.hyps eqs\n        have r_in_b: \"r\\<in>b\" by simp\n        from WhileTrue.hyps eqs\n        have exec_mark_c: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal r\\<rangle> =n\\<Rightarrow> u\" by simp\n        from WhileTrue.hyps eqs\n        have exec_mark_w: \"\\<Gamma>\\<turnstile>\\<langle>While b (mark_guards f c),u\\<rangle> =n\\<Rightarrow> w\"\n          by simp\n        show ?case\n        proof -\n          from WhileTrue.hyps eqs have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal r\\<rangle> =n\\<Rightarrow> u\"\n            by simp\n          with While.hyps\n          obtain u' where\n            exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal r\\<rangle> =n\\<Rightarrow> u'\" and\n            u_Fault: \"isFault u \\<longrightarrow> isFault u'\" and\n            u'_Fault_f: \"u' = Fault f \\<longrightarrow> u'=u\" and\n            u'_Fault: \"isFault u' \\<longrightarrow> isFault u\" and\n            u'_noFault: \"\\<not> isFault u' \\<longrightarrow> u'=u\"\n            by blast\n          show ?thesis\n          proof (cases \"isFault u'\")\n            case False\n            with u'_noFault have u': \"u'=u\" by simp\n            from WhileTrue.hyps eqs obtain w' where\n              \"\\<Gamma>\\<turnstile>\\<langle>While b c,u\\<rangle> =n\\<Rightarrow> w'\"\n              \"isFault w  \\<longrightarrow> isFault w'\"\n              \"w' = Fault f \\<longrightarrow> w'=w\"\n              \"isFault w' \\<longrightarrow> isFault w\"\n              \"\\<not> isFault w' \\<longrightarrow> w' = w\"\n              by blast\n            with u' exec_c r_in_b\n            show ?thesis\n              by (blast intro: execn.WhileTrue)\n          next\n            case True\n            then obtain f' where u': \"u'=Fault f'\"..\n            with exec_c r_in_b\n            have exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> =n\\<Rightarrow> Fault f'\"\n              by (blast intro: execn.intros)\n            from True u'_Fault have \"isFault u\"\n              by simp\n            then obtain f where u: \"u=Fault f\"..\n            with exec_mark_w have \"w=Fault f\"\n              by (auto dest: execn_Fault_end)\n            with exec u' u u'_Fault_f\n            show ?thesis\n              by auto\n          qed\n        qed\n      next\n        case (WhileFalse r b' c'' n)\n        have eqs: \"While b'  c'' = While b (mark_guards f c)\" by fact\n        from WhileFalse.hyps eqs\n        have r_not_in_b: \"r\\<notin>b\" by simp\n        show ?case\n        proof -\n          from r_not_in_b\n          have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> =n\\<Rightarrow> Normal r\"\n            by (rule execn.WhileFalse)\n          thus ?thesis\n            by blast\n        qed\n      qed auto\n    } note hyp_while = this\n    show ?thesis\n    proof (cases \"s'\\<in>b\")\n      case False\n      with Normal exec_mark\n      have \"t=s\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal False show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case True note s'_in_b = this\n      with Normal exec_mark obtain r where\n        exec_mark_c: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s'\\<rangle> =n\\<Rightarrow> r\" and\n        exec_mark_w: \"\\<Gamma>\\<turnstile>\\<langle>While b (mark_guards f c),r\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      from While.hyps exec_mark_c obtain r' where\n        exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s'\\<rangle> =n\\<Rightarrow> r'\" and\n        r_Fault: \"isFault r \\<longrightarrow> isFault r'\" and\n        r'_Fault_f: \"r' = Fault f \\<longrightarrow> r'=r\" and\n        r'_Fault: \"isFault r' \\<longrightarrow> isFault r\" and\n        r'_noFault: \"\\<not> isFault r' \\<longrightarrow> r'=r\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault r'\")\n        case False\n        with r'_noFault have r': \"r'=r\" by simp\n        from hyp_while exec_mark_w\n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> t'\"\n          \"isFault t \\<longrightarrow> isFault t'\"\n          \"t' = Fault f \\<longrightarrow> t'=t\"\n          \"isFault t' \\<longrightarrow> isFault t\"\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with r' exec_c Normal s'_in_b\n        show ?thesis\n          by (blast intro: execn.intros)\n      next\n        case True\n        then obtain f' where r': \"r'=Fault f'\"..\n        hence \"\\<Gamma>\\<turnstile>\\<langle>While b c,r'\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by auto\n        with Normal s'_in_b exec_c\n        have exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s'\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        from True r'_Fault\n        have \"isFault r\"\n          by simp\n        then obtain f where r: \"r=Fault f\"..\n        with exec_mark_w have \"t=Fault f\"\n          by (auto dest: execn_Fault_end)\n        with Normal exec r' r r'_Fault_f\n        show ?thesis\n          by auto\n      qed\n    qed\n  qed\nnext\n  case Call thus ?case by auto\nnext\n  case DynCom thus ?case\n    by (fastforce elim!: execn_elim_cases intro: execn.intros)\nnext\n  case (Guard f' g c s n t)\n  have exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f (Guard f' g c),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_mark have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_mark have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_mark have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"s'\\<in>g\")\n      case False\n      with Normal exec_mark have t: \"t=Fault f\"\n        by (auto elim: execn_Normal_elim_cases)\n      from False\n      have \"\\<Gamma>\\<turnstile>\\<langle>Guard f' g c,Normal s'\\<rangle> =n\\<Rightarrow> Fault f'\"\n        by (blast intro: execn.intros)\n      with Normal t show ?thesis\n        by auto\n    next\n      case True\n      with exec_mark Normal\n      have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Guard.hyps obtain t' where\n        \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n        \"isFault t \\<longrightarrow> isFault t'\" and\n        \"t' = Fault f \\<longrightarrow> t'=t\" and\n        \"isFault t' \\<longrightarrow> isFault t\" and\n        \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n        by blast\n      with Normal True\n      show ?thesis\n        by (blast intro: execn.intros)\n    qed\n  qed\nnext\n  case Throw thus ?case by auto\nnext\n  case (Catch c1 c2 s n t)\n  have exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f (Catch c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec_mark have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_mark have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_mark have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s') note s=this\n    with exec_mark have\n      \"\\<Gamma>\\<turnstile>\\<langle>Catch (mark_guards f c1) (mark_guards f c2),Normal s'\\<rangle> =n\\<Rightarrow> t\" by simp\n    thus ?thesis\n    proof (cases)\n      fix w\n      assume exec_mark_c1: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c1,Normal s'\\<rangle> =n\\<Rightarrow> Abrupt w\"\n      assume exec_mark_c2: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c2,Normal w\\<rangle> =n\\<Rightarrow> t\"\n      from exec_mark_c1 Catch.hyps\n      obtain w' where\n        exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> w'\" and\n        w'_Fault_f: \"w' = Fault f \\<longrightarrow> w'=Abrupt w\" and\n        w'_Fault: \"isFault w' \\<longrightarrow> isFault (Abrupt w)\" and\n        w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w'=Abrupt w\"\n        by fastforce\n      show ?thesis\n      proof (cases \"w'\")\n        case (Fault f')\n        with Normal exec_c1 have \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,s\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        with w'_Fault Fault show ?thesis\n          by auto\n      next\n        case Stuck\n        with w'_noFault have False\n          by simp\n        thus ?thesis ..\n      next\n        case (Normal w'')\n        with w'_noFault have False by simp thus ?thesis ..\n      next\n        case (Abrupt w'')\n        with w'_noFault have w'': \"w''=w\" by simp\n        from  exec_mark_c2 Catch.hyps\n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal w\\<rangle> =n\\<Rightarrow> t'\"\n          \"isFault t \\<longrightarrow> isFault t'\"\n          \"t' = Fault f \\<longrightarrow> t'=t\"\n          \"isFault t' \\<longrightarrow> isFault t\"\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with w'' Abrupt s exec_c1\n        show ?thesis\n          by (blast intro: execn.intros)\n      qed\n    next\n      assume t: \"\\<not> isAbr t\"\n      assume \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c1,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      with Catch.hyps\n      obtain t' where\n        exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t'\"  and\n        t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and\n        t'_Fault_f: \"t' = Fault f \\<longrightarrow> t'=t\" and\n        t'_Fault: \"isFault t' \\<longrightarrow> isFault t\" and\n        t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault t'\")\n        case True\n        then obtain f' where t': \"t'=Fault f'\"..\n        with exec_c1 have \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s'\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        with t'_Fault_f t'_Fault t' s show ?thesis\n          by auto\n      next\n        case False\n        with t'_noFault have \"t'=t\" by simp\n        with t exec_c1 s show ?thesis\n          by (blast intro: execn.intros)\n      qed\n    qed\n  qed\nqed\n\nlemma exec_to_exec_mark_guards:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,s\\<rangle> \\<Rightarrow> t \"\nproof -\n  from exec_to_execn [OF exec_c] obtain n where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" ..\n  from execn_to_execn_mark_guards [OF this t_not_Fault]\n  show ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\nlemma exec_to_exec_mark_guards_Fault:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Fault f\"\n shows \"\\<exists>f'. \\<Gamma>\\<turnstile>\\<langle>mark_guards x c,s\\<rangle> \\<Rightarrow> Fault f'\"\nproof -\n  from exec_to_execn [OF exec_c] obtain n where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Fault f\" ..\n  from execn_to_execn_mark_guards_Fault [OF this]\n  show ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\n\nlemma exec_mark_guards_to_exec:\n  assumes exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and>\n            (isFault t \\<longrightarrow> isFault t') \\<and>\n            (t' = Fault f \\<longrightarrow> t'=t) \\<and>\n            (isFault t' \\<longrightarrow> isFault t) \\<and>\n            (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof -\n  from exec_to_execn [OF exec_mark] obtain n where\n    \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,s\\<rangle> =n\\<Rightarrow> t\" ..\n  from execn_mark_guards_to_execn [OF this]\n  show ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\n(* ************************************************************************* *)\nsubsection \\<open>Lemmas about @{const \"strip_guards\"}\\<close>\n(* ************************************************************************* *)\n\nlemma execn_to_execn_strip_guards:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t \"\nusing exec_c t_not_Fault [simplified not_isFault_iff]\nby (induct) (auto intro: execn.intros dest: noFaultn_startD')\n\n\nlemma execn_to_execn_strip_guards_Fault:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n shows \"\\<And>f. \\<lbrakk>t=Fault f; f \\<notin> F\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> Fault f\"\nusing exec_c\nproof (induct)\n  case Skip thus ?case by auto\nnext\n  case Guard thus ?case by (fastforce intro: execn.intros)\nnext\n  case GuardFault thus ?case by (fastforce intro: execn.intros)\nnext\n  case FaultProp thus ?case by auto\nnext\n case Basic thus ?case by auto\nnext\n case Spec thus ?case by auto\nnext\n case SpecStuck thus ?case by auto\nnext\n  case (Seq c1 s n w c2 t)\n  have exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> w\" by fact\n  have exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t=Fault f\" by fact\n  have notinF: \"f \\<notin> F\" by fact\n  show ?case\n  proof (cases w)\n    case (Fault f')\n    with exec_c2 t have \"f'=f\"\n      by (auto dest: execn_Fault_end)\n    with Fault notinF Seq.hyps\n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    moreover have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,Fault f\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    ultimately show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Normal s')\n    with execn_to_execn_strip_guards [OF exec_c1]\n    have exec_strip_c1: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with Seq.hyps t notinF\n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,w\\<rangle> =n\\<Rightarrow> Fault f\"\n      by blast\n    with exec_strip_c1 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Abrupt s')\n    with execn_to_execn_strip_guards [OF exec_c1]\n    have exec_strip_c1: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with Seq.hyps t notinF\n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,w\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (auto intro: execn.intros)\n    with exec_strip_c1 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_c2 have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with t show ?thesis by simp\n  qed\nnext\n  case CondTrue thus ?case by (fastforce intro: execn.intros)\nnext\n  case CondFalse thus ?case by (fastforce intro: execn.intros)\nnext\n  case (WhileTrue s b c n w t)\n  have exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> w\" by fact\n  have exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b c,w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t = Fault f\" by fact\n  have notinF: \"f \\<notin> F\" by fact\n  have s_in_b: \"s \\<in> b\" by fact\n  show ?case\n  proof (cases w)\n    case (Fault f')\n    with exec_w t have \"f'=f\"\n      by (auto dest: execn_Fault_end)\n    with Fault notinF WhileTrue.hyps\n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    moreover have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (While b c),Fault f\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    ultimately show ?thesis\n      using s_in_b by (auto intro: execn.intros)\n  next\n    case (Normal s')\n    with execn_to_execn_strip_guards [OF exec_c]\n    have exec_strip_c: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with WhileTrue.hyps t notinF\n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (While b c),w\\<rangle> =n\\<Rightarrow> Fault f\"\n      by blast\n    with exec_strip_c s_in_b show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Abrupt s')\n    with execn_to_execn_strip_guards [OF exec_c]\n    have exec_strip_c: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with WhileTrue.hyps t notinF\n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (While b c),w\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (auto intro: execn.intros)\n    with exec_strip_c s_in_b show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_w have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with t show ?thesis by simp\n  qed\nnext\n  case WhileFalse thus ?case by (fastforce intro: execn.intros)\nnext\n  case Call thus ?case by (fastforce intro: execn.intros)\nnext\n  case CallUndefined thus ?case by simp\nnext\n  case StuckProp thus ?case by simp\nnext\n  case DynCom thus ?case by (fastforce intro: execn.intros)\nnext\n  case Throw thus ?case by simp\nnext\n  case AbruptProp thus ?case by simp\nnext\n  case (CatchMatch c1 s n w c2 t)\n  have exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt w\" by fact\n  have exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t = Fault f\" by fact\n  have notinF: \"f \\<notin> F\" by fact\n  from execn_to_execn_strip_guards [OF exec_c1]\n  have exec_strip_c1: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt w\"\n    by simp\n  with CatchMatch.hyps t notinF\n  have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,Normal w\\<rangle> =n\\<Rightarrow> Fault f\"\n    by blast\n  with exec_strip_c1 show ?case\n    by (auto intro: execn.intros)\nnext\n  case CatchMiss thus ?case by (fastforce intro: execn.intros)\nqed\n\nlemma execn_to_execn_strip_guards':\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes t_not_Fault: \"t \\<notin> Fault ` F\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t\"\nproof (cases t)\n  case (Fault f)\n  with t_not_Fault exec_c show ?thesis\n    by (auto intro: execn_to_execn_strip_guards_Fault)\nqed (insert exec_c, auto intro: execn_to_execn_strip_guards)\n\nlemma execn_strip_guards_to_execn:\n  \"\\<And>s n t. \\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t\n  \\<Longrightarrow> \\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t' \\<and>\n            (isFault t \\<longrightarrow> isFault t') \\<and>\n            (t' \\<in> Fault ` (- F) \\<longrightarrow> t'=t) \\<and>\n            (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof (induct c)\n  case Skip thus ?case by auto\nnext\n  case Basic thus ?case by auto\nnext\n  case Spec thus ?case by auto\nnext\n  case (Seq c1 c2 s n t)\n  have exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (Seq c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  then obtain w where\n    exec_strip_c1: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,s\\<rangle> =n\\<Rightarrow> w\" and\n    exec_strip_c2: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,w\\<rangle> =n\\<Rightarrow> t\"\n    by (auto elim: execn_elim_cases)\n  from Seq.hyps exec_strip_c1\n  obtain w' where\n    exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> w'\" and\n    w_Fault: \"isFault w \\<longrightarrow> isFault w'\" and\n    w'_Fault: \"w' \\<in> Fault ` (- F) \\<longrightarrow> w'=w\" and\n    w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w'=w\"\n    by blast\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec_strip have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_strip have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_strip have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"isFault w\")\n      case True\n      then obtain f where w': \"w=Fault f\"..\n      moreover with exec_strip_c2\n      have t: \"t=Fault f\"\n        by (auto dest: execn_Fault_end)\n      ultimately show ?thesis\n        using Normal w_Fault w'_Fault exec_c1\n        by (fastforce intro: execn.intros elim: isFaultE)\n    next\n      case False\n      note noFault_w = this\n      show ?thesis\n      proof (cases \"isFault w'\")\n        case True\n        then obtain f' where w': \"w'=Fault f'\"..\n        with Normal exec_c1\n        have exec: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        from w'_Fault w' noFault_w\n        have \"f' \\<in> F\"\n          by (cases w) auto\n        with exec\n        show ?thesis\n          by auto\n      next\n        case False\n        with w'_noFault have w': \"w'=w\" by simp\n        from Seq.hyps exec_strip_c2\n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c2,w\\<rangle> =n\\<Rightarrow> t'\" and\n          \"isFault t \\<longrightarrow> isFault t'\" and\n          \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" and\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with Normal exec_c1 w'\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    qed\n  qed\nnext\nnext\n  case (Cond b c1 c2 s n t)\n  have exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (Cond b c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_strip have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_strip have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_strip have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"s'\\<in> b\")\n      case True\n      with Normal exec_strip\n      have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1 ,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal True Cond.hyps obtain t'\n        where \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t'\"\n            \"isFault t \\<longrightarrow> isFault t'\"\n            \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\"\n            \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with Normal True\n      show ?thesis\n        by (blast intro: execn.intros)\n    next\n      case False\n      with Normal exec_strip\n      have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2 ,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal False Cond.hyps obtain t'\n        where \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> =n\\<Rightarrow> t'\"\n            \"isFault t  \\<longrightarrow> isFault t'\"\n            \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\"\n            \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with Normal False\n      show ?thesis\n        by (blast intro: execn.intros)\n    qed\n  qed\nnext\n  case (While b c s n t)\n  have exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (While b c),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_strip have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_strip have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_strip have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    {\n      fix c' r w\n      assume exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',r\\<rangle> =n\\<Rightarrow> w\"\n      assume c': \"c'=While b (strip_guards F c)\"\n      have \"\\<exists>w'. \\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> w' \\<and> (isFault w \\<longrightarrow> isFault w') \\<and>\n                   (w' \\<in> Fault ` (-F) \\<longrightarrow> w'=w) \\<and>\n                   (\\<not> isFault w' \\<longrightarrow> w'=w)\"\n        using exec_c' c'\n      proof (induct)\n        case (WhileTrue r b' c'' n u w)\n        have eqs: \"While b' c'' = While b (strip_guards F c)\" by fact\n        from WhileTrue.hyps eqs\n        have r_in_b: \"r\\<in>b\" by simp\n        from WhileTrue.hyps eqs\n        have exec_strip_c: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal r\\<rangle> =n\\<Rightarrow> u\" by simp\n        from WhileTrue.hyps eqs\n        have exec_strip_w: \"\\<Gamma>\\<turnstile>\\<langle>While b (strip_guards F c),u\\<rangle> =n\\<Rightarrow> w\"\n          by simp\n        show ?case\n        proof -\n          from WhileTrue.hyps eqs have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal r\\<rangle> =n\\<Rightarrow> u\"\n            by simp\n          with While.hyps\n          obtain u' where\n            exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal r\\<rangle> =n\\<Rightarrow> u'\" and\n            u_Fault: \"isFault u \\<longrightarrow> isFault u'\" and\n            u'_Fault: \"u' \\<in> Fault ` (-F) \\<longrightarrow> u'=u\" and\n            u'_noFault: \"\\<not> isFault u' \\<longrightarrow> u'=u\"\n            by blast\n          show ?thesis\n          proof (cases \"isFault u'\")\n            case False\n            with u'_noFault have u': \"u'=u\" by simp\n            from WhileTrue.hyps eqs obtain w' where\n              \"\\<Gamma>\\<turnstile>\\<langle>While b c,u\\<rangle> =n\\<Rightarrow> w'\"\n              \"isFault w  \\<longrightarrow> isFault w'\"\n              \"w' \\<in> Fault ` (-F) \\<longrightarrow> w'=w\"\n              \"\\<not> isFault w' \\<longrightarrow> w' = w\"\n              by blast\n            with u' exec_c r_in_b\n            show ?thesis\n              by (blast intro: execn.WhileTrue)\n          next\n            case True\n            then obtain f' where u': \"u'=Fault f'\"..\n            with exec_c r_in_b\n            have exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> =n\\<Rightarrow> Fault f'\"\n              by (blast intro: execn.intros)\n            show ?thesis\n            proof (cases \"isFault u\")\n              case True\n              then obtain f where u: \"u=Fault f\"..\n              with exec_strip_w have \"w=Fault f\"\n                by (auto dest: execn_Fault_end)\n              with exec u' u u'_Fault\n              show ?thesis\n                by auto\n            next\n              case False\n              with u'_Fault u' have \"f' \\<in> F\"\n                by (cases u) auto\n              with exec show ?thesis\n                by auto\n            qed\n          qed\n        qed\n      next\n        case (WhileFalse r b' c'' n)\n        have eqs: \"While b'  c'' = While b (strip_guards F c)\" by fact\n        from WhileFalse.hyps eqs\n        have r_not_in_b: \"r\\<notin>b\" by simp\n        show ?case\n        proof -\n          from r_not_in_b\n          have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> =n\\<Rightarrow> Normal r\"\n            by (rule execn.WhileFalse)\n          thus ?thesis\n            by blast\n        qed\n      qed auto\n    } note hyp_while = this\n    show ?thesis\n    proof (cases \"s'\\<in>b\")\n      case False\n      with Normal exec_strip\n      have \"t=s\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal False show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case True note s'_in_b = this\n      with Normal exec_strip obtain r where\n        exec_strip_c: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s'\\<rangle> =n\\<Rightarrow> r\" and\n        exec_strip_w: \"\\<Gamma>\\<turnstile>\\<langle>While b (strip_guards F c),r\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      from While.hyps exec_strip_c obtain r' where\n        exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s'\\<rangle> =n\\<Rightarrow> r'\" and\n        r_Fault: \"isFault r \\<longrightarrow> isFault r'\" and\n        r'_Fault: \"r' \\<in> Fault ` (-F) \\<longrightarrow> r'=r\" and\n        r'_noFault: \"\\<not> isFault r' \\<longrightarrow> r'=r\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault r'\")\n        case False\n        with r'_noFault have r': \"r'=r\" by simp\n        from hyp_while exec_strip_w\n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> t'\"\n          \"isFault t \\<longrightarrow> isFault t'\"\n          \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\"\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with r' exec_c Normal s'_in_b\n        show ?thesis\n          by (blast intro: execn.intros)\n      next\n        case True\n        then obtain f' where r': \"r'=Fault f'\"..\n        hence \"\\<Gamma>\\<turnstile>\\<langle>While b c,r'\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by auto\n        with Normal s'_in_b exec_c\n        have exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s'\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        show ?thesis\n        proof (cases \"isFault r\")\n          case True\n          then obtain f where r: \"r=Fault f\"..\n          with exec_strip_w have \"t=Fault f\"\n            by (auto dest: execn_Fault_end)\n          with Normal exec r' r r'_Fault\n          show ?thesis\n            by auto\n        next\n          case False\n          with r'_Fault r' have \"f' \\<in> F\"\n            by (cases r) auto\n          with Normal exec show ?thesis\n            by auto\n        qed\n      qed\n    qed\n  qed\nnext\n  case Call thus ?case by auto\nnext\n  case DynCom thus ?case\n    by (fastforce elim!: execn_elim_cases intro: execn.intros)\nnext\n  case (Guard f g c s n t)\n  have exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (Guard f g c),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_strip have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_strip have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_strip have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"f\\<in>F\")\n      case True\n      with exec_strip Normal\n      have exec_strip_c: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by simp\n      with Guard.hyps obtain t' where\n        \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n        \"isFault t \\<longrightarrow> isFault t'\" and\n        \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" and\n        \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n        by blast\n      with Normal True\n      show ?thesis\n        by (cases \"s'\\<in> g\") (fastforce intro: execn.intros)+\n    next\n      case False\n      note f_notin_F = this\n      show ?thesis\n      proof (cases \"s'\\<in>g\")\n        case False\n        with Normal exec_strip f_notin_F have t: \"t=Fault f\"\n          by (auto elim: execn_Normal_elim_cases)\n        from False\n        have \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s'\\<rangle> =n\\<Rightarrow> Fault f\"\n          by (blast intro: execn.intros)\n        with False Normal t show ?thesis\n          by auto\n      next\n        case True\n        with exec_strip Normal f_notin_F\n        have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n          by (auto elim: execn_Normal_elim_cases)\n        with Guard.hyps obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n          \"isFault t \\<longrightarrow> isFault t'\" and\n          \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" and\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with Normal True\n        show ?thesis\n          by (blast intro: execn.intros)\n      qed\n    qed\n  qed\nnext\n  case Throw thus ?case by auto\nnext\n  case (Catch c1 c2 s n t)\n  have exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (Catch c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec_strip have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_strip have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_strip have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s') note s=this\n    with exec_strip have\n      \"\\<Gamma>\\<turnstile>\\<langle>Catch (strip_guards F c1) (strip_guards F c2),Normal s'\\<rangle> =n\\<Rightarrow> t\" by simp\n    thus ?thesis\n    proof (cases)\n      fix w\n      assume exec_strip_c1: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s'\\<rangle> =n\\<Rightarrow> Abrupt w\"\n      assume exec_strip_c2: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,Normal w\\<rangle> =n\\<Rightarrow> t\"\n      from exec_strip_c1 Catch.hyps\n      obtain w' where\n        exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> w'\" and\n        w'_Fault: \"w' \\<in> Fault ` (-F) \\<longrightarrow> w'=Abrupt w\" and\n        w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w'=Abrupt w\"\n        by blast\n      show ?thesis\n      proof (cases \"w'\")\n        case (Fault f')\n        with Normal exec_c1 have \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,s\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        with w'_Fault Fault show ?thesis\n          by auto\n      next\n        case Stuck\n        with w'_noFault have False\n          by simp\n        thus ?thesis ..\n      next\n        case (Normal w'')\n        with w'_noFault have False by simp thus ?thesis ..\n      next\n        case (Abrupt w'')\n        with w'_noFault have w'': \"w''=w\" by simp\n        from  exec_strip_c2 Catch.hyps\n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal w\\<rangle> =n\\<Rightarrow> t'\"\n          \"isFault t \\<longrightarrow> isFault t'\"\n          \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\"\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with w'' Abrupt s exec_c1\n        show ?thesis\n          by (blast intro: execn.intros)\n      qed\n    next\n      assume t: \"\\<not> isAbr t\"\n      assume \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      with Catch.hyps\n      obtain t' where\n        exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t'\"  and\n        t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and\n        t'_Fault: \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" and\n        t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault t'\")\n        case True\n        then obtain f' where t': \"t'=Fault f'\"..\n        with exec_c1 have \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s'\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        with t'_Fault t' s show ?thesis\n          by auto\n      next\n        case False\n        with t'_noFault have \"t'=t\" by simp\n        with t exec_c1 s show ?thesis\n          by (blast intro: execn.intros)\n      qed\n    qed\n  qed\nqed\n\n\nlemma execn_strip_to_execn:\n  assumes exec_strip: \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t' \\<and>\n                 (isFault t \\<longrightarrow> isFault t') \\<and>\n                 (t' \\<in> Fault ` (- F) \\<longrightarrow> t'=t) \\<and>\n                 (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nusing exec_strip\nproof (induct)\n  case Skip thus ?case by (blast intro: execn.intros)\nnext\n  case Guard thus ?case by (blast intro: execn.intros)\nnext\n  case GuardFault thus ?case by (blast intro: execn.intros)\nnext\n  case FaultProp thus ?case by (blast intro: execn.intros)\nnext\n  case Basic thus ?case by (blast intro: execn.intros)\nnext\n  case Spec thus ?case by (blast intro: execn.intros)\nnext\n  case SpecStuck thus ?case by (blast intro: execn.intros)\nnext\n  case Seq thus ?case by (blast intro: execn.intros elim: isFaultE)\nnext\n  case CondTrue thus ?case by (blast intro: execn.intros)\nnext\n  case CondFalse thus ?case by (blast intro: execn.intros)\nnext\n  case WhileTrue thus ?case by (blast intro: execn.intros elim: isFaultE)\nnext\n  case WhileFalse thus ?case by (blast intro: execn.intros)\nnext\n  case Call thus ?case\n    by simp (blast intro: execn.intros dest: execn_strip_guards_to_execn)\nnext\n  case CallUndefined thus ?case\n    by simp (blast intro: execn.intros)\nnext\n  case StuckProp thus ?case\n    by blast\nnext\n  case DynCom thus ?case by (blast intro: execn.intros)\nnext\n  case Throw thus ?case by (blast intro: execn.intros)\nnext\n  case AbruptProp thus ?case by (blast intro: execn.intros)\nnext\n  case (CatchMatch c1 s n r c2 t)\n  then obtain r' t' where\n    exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> r'\"  and\n    r'_Fault: \"r' \\<in> Fault ` (-F) \\<longrightarrow> r' = Abrupt r\" and\n    r'_noFault: \"\\<not> isFault r' \\<longrightarrow> r' = Abrupt r\" and\n    exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal r\\<rangle> =n\\<Rightarrow> t'\" and\n    t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and\n    t'_Fault: \"t' \\<in> Fault ` (-F) \\<longrightarrow> t' = t\" and\n    t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n    by blast\n  show ?case\n  proof (cases \"isFault r'\")\n    case True\n    then obtain f' where r': \"r'=Fault f'\"..\n    with exec_c1 have \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s\\<rangle> =n\\<Rightarrow> Fault f'\"\n      by (auto intro: execn.intros)\n    with r' r'_Fault show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case False\n    with r'_noFault have \"r'=Abrupt r\" by simp\n    with exec_c1 exec_c2 t_Fault t'_noFault t'_Fault\n    show ?thesis\n      by (blast intro: execn.intros)\n  qed\nnext\n  case CatchMiss thus ?case by (fastforce intro: execn.intros elim: isFaultE)\nqed\n\nlemma exec_strip_guards_to_exec:\n  assumes exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and>\n              (isFault t \\<longrightarrow> isFault t') \\<and>\n              (t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t) \\<and>\n              (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof -\n  from exec_strip obtain n where\n    execn_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (auto simp add: exec_iff_execn)\n  then obtain t' where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t'\"\n    \"isFault t \\<longrightarrow> isFault t'\" \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: execn_strip_guards_to_execn)\n  thus ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\nlemma exec_strip_to_exec:\n  assumes exec_strip: \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and>\n              (isFault t \\<longrightarrow> isFault t') \\<and>\n              (t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t) \\<and>\n              (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof -\n  from exec_strip obtain n where\n    execn_strip: \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (auto simp add: exec_iff_execn)\n  then obtain t' where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t'\"\n    \"isFault t \\<longrightarrow> isFault t'\" \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: execn_strip_to_execn)\n  thus ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\n\nlemma exec_to_exec_strip_guards:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\"\n    by (auto simp add: exec_iff_execn)\n  from this t_not_Fault\n  have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_to_execn_strip_guards )\n  thus \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> t\"\n    by (rule execn_to_exec)\nqed\n\nlemma exec_to_exec_strip_guards':\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes t_not_Fault: \"t \\<notin> Fault ` F\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\"\n    by (auto simp add: exec_iff_execn)\n  from this t_not_Fault\n  have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_to_execn_strip_guards' )\n  thus \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> t\"\n    by (rule execn_to_exec)\nqed\n\nlemma execn_to_execn_strip:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\nusing exec_c t_not_Fault\nproof (induct)\n  case (Call p bdy s n  s')\n  have bdy: \"\\<Gamma> p = Some bdy\" by fact\n  from Call have \"strip F \\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n    by blast\n  from execn_to_execn_strip_guards [OF this] Call\n  have \"strip F \\<Gamma>\\<turnstile>\\<langle>strip_guards F bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n    by simp\n  moreover from bdy have \"(strip F \\<Gamma>) p = Some (strip_guards F bdy)\"\n    by simp\n  ultimately\n  show ?case\n    by (blast intro: execn.intros)\nnext\n  case CallUndefined thus ?case by (auto intro: execn.CallUndefined)\nqed (auto intro: execn.intros dest: noFaultn_startD' simp add: not_isFault_iff)\n\nlemma execn_to_execn_strip':\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes t_not_Fault: \"t \\<notin> Fault ` F\"\n shows \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\nusing exec_c t_not_Fault\nproof (induct)\n  case (Call p bdy s n s')\n  have bdy: \"\\<Gamma> p = Some bdy\" by fact\n  from Call have \"strip F \\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n    by blast\n  from execn_to_execn_strip_guards' [OF this] Call\n  have \"strip F \\<Gamma>\\<turnstile>\\<langle>strip_guards F bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n    by simp\n  moreover from bdy have \"(strip F \\<Gamma>) p = Some (strip_guards F bdy)\"\n    by simp\n  ultimately\n  show ?case\n    by (blast intro: execn.intros)\nnext\n  case CallUndefined thus ?case by (auto intro: execn.CallUndefined)\nnext\n  case (Seq c1 s n s' c2 t)\n  show ?case\n  proof (cases \"isFault s'\")\n    case False\n    with Seq show ?thesis\n      by (auto intro: execn.intros simp add: not_isFault_iff)\n  next\n    case True\n    then obtain f' where s': \"s'=Fault f'\" by (auto simp add: isFault_def)\n    with Seq obtain \"t=Fault f'\" and \"f' \\<notin> F\"\n      by (force dest: execn_Fault_end)\n    with Seq s' show ?thesis\n      by (auto intro: execn.intros)\n  qed\nnext\n  case (WhileTrue b c s n s' t)\n  show ?case\n  proof (cases \"isFault s'\")\n    case False\n    with WhileTrue show ?thesis\n      by (auto intro: execn.intros simp add: not_isFault_iff)\n  next\n    case True\n    then obtain f' where s': \"s'=Fault f'\" by (auto simp add: isFault_def)\n    with WhileTrue obtain \"t=Fault f'\" and \"f' \\<notin> F\"\n      by (force dest: execn_Fault_end)\n    with WhileTrue s' show ?thesis\n      by (auto intro: execn.intros)\n  qed\nqed (auto intro: execn.intros)\n\nlemma exec_to_exec_strip:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\"\n    by (auto simp add: exec_iff_execn)\n  from this t_not_Fault\n  have \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_to_execn_strip)\n  thus \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n    by (rule execn_to_exec)\nqed\n\nlemma exec_to_exec_strip':\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes t_not_Fault: \"t \\<notin> Fault ` F\"\n shows \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\"\n    by (auto simp add: exec_iff_execn)\n  from this t_not_Fault\n  have \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_to_execn_strip' )\n  thus \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n    by (rule execn_to_exec)\nqed\n\nlemma exec_to_exec_strip_guards_Fault:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Fault f\"\n assumes f_notin_F: \"f \\<notin> F\"\n shows\"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> Fault f\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>Fault f\"\n    by (auto simp add: exec_iff_execn)\n  from execn_to_execn_strip_guards_Fault [OF this _ f_notin_F]\n  have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> Fault f\"\n    by simp\n  thus \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> Fault f\"\n    by (rule execn_to_exec)\nqed\n\n(* ************************************************************************* *)\nsubsection \\<open>Lemmas about @{term \"c\\<^sub>1 \\<inter>\\<^sub>g c\\<^sub>2\"}\\<close>\n(* ************************************************************************* *)\n\nlemma inter_guards_execn_Normal_noFault:\n  \"\\<And>c c2 s t n. \\<lbrakk>(c1 \\<inter>\\<^sub>g c2) = Some c; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t; \\<not> isFault t\\<rbrakk>\n        \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> t \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\nproof (induct c1)\n  case Skip\n  have \"(Skip \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain c2: \"c2=Skip\" and c: \"c=Skip\"\n    by (simp add: inter_guards_Skip)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"t=Normal s\"\n    by (auto elim: execn_Normal_elim_cases)\n  with Skip c2\n  show ?case\n    by (auto intro: execn.intros)\nnext\n  case (Basic f)\n  have \"(Basic f \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain c2: \"c2=Basic f\" and c: \"c=Basic f\"\n    by (simp add: inter_guards_Basic)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"t=Normal (f s)\"\n    by (auto elim: execn_Normal_elim_cases)\n  with Basic c2\n  show ?case\n    by (auto intro: execn.intros)\nnext\n  case (Spec r)\n  have \"(Spec r \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain c2: \"c2=Spec r\" and c: \"c=Spec r\"\n    by (simp add: inter_guards_Spec)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n  from this Spec c2 show ?case\n    by (cases) (auto intro: execn.intros)\nnext\n  case (Seq a1 a2)\n  have noFault: \"\\<not> isFault t\" by fact\n  have \"(Seq a1 a2 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain b1 b2 d1 d2 where\n    c2: \"c2=Seq b1 b2\" and\n    d1: \"(a1 \\<inter>\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\<inter>\\<^sub>g b2) = Some d2\" and\n    c: \"c=Seq d1 d2\"\n    by (auto simp add: inter_guards_Seq)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c obtain s' where\n    exec_d1: \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> s'\" and\n    exec_d2: \"\\<Gamma>\\<turnstile>\\<langle>d2,s'\\<rangle> =n\\<Rightarrow> t\"\n    by (auto elim: execn_Normal_elim_cases)\n  show ?case\n  proof (cases s')\n    case (Fault f')\n    with exec_d2 have \"t=Fault f'\"\n      by (auto intro: execn_Fault_end)\n    with noFault show  ?thesis by simp\n  next\n    case (Normal s'')\n    with d1 exec_d1 Seq.hyps\n    obtain\n      \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Normal s''\" and \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Normal s''\"\n      by auto\n    moreover\n    from Normal d2 exec_d2 noFault Seq.hyps\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a2,Normal s''\\<rangle> =n\\<Rightarrow> t\" and \"\\<Gamma>\\<turnstile>\\<langle>b2,Normal s''\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    ultimately\n    show ?thesis\n      using Normal c2 by (auto intro: execn.intros)\n  next\n    case (Abrupt s'')\n    with exec_d2 have \"t=Abrupt s''\"\n      by (auto simp add: execn_Abrupt_end)\n    moreover\n    from Abrupt d1 exec_d1 Seq.hyps\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s''\" and \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s''\"\n      by auto\n    moreover\n    obtain\n      \"\\<Gamma>\\<turnstile>\\<langle>a2,Abrupt s''\\<rangle> =n\\<Rightarrow> Abrupt s''\" and \"\\<Gamma>\\<turnstile>\\<langle>b2,Abrupt s''\\<rangle> =n\\<Rightarrow> Abrupt s''\"\n      by auto\n    ultimately\n    show ?thesis\n      using Abrupt c2 by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_d2 have \"t=Stuck\"\n      by (auto simp add: execn_Stuck_end)\n    moreover\n    from Stuck d1 exec_d1 Seq.hyps\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Stuck\" and \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Stuck\"\n      by auto\n    moreover\n    obtain\n      \"\\<Gamma>\\<turnstile>\\<langle>a2,Stuck\\<rangle> =n\\<Rightarrow> Stuck\" and \"\\<Gamma>\\<turnstile>\\<langle>b2,Stuck\\<rangle> =n\\<Rightarrow> Stuck\"\n      by auto\n    ultimately\n    show ?thesis\n      using Stuck c2 by (auto intro: execn.intros)\n  qed\nnext\n  case (Cond b t1 e1)\n  have noFault: \"\\<not> isFault t\" by fact\n  have \"(Cond b t1 e1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain t2 e2 t3 e3 where\n    c2: \"c2=Cond b t2 e2\" and\n    t3: \"(t1 \\<inter>\\<^sub>g t2) = Some t3\" and\n    e3: \"(e1 \\<inter>\\<^sub>g e2) = Some e3\" and\n    c: \"c=Cond b t3 e3\"\n    by (auto simp add: inter_guards_Cond)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Cond b t3 e3,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by simp\n  then show ?case\n  proof (cases)\n    assume s_in_b: \"s\\<in>b\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>t3,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    with Cond.hyps t3 noFault\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>t1,Normal s\\<rangle> =n\\<Rightarrow> t\" \"\\<Gamma>\\<turnstile>\\<langle>t2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    with s_in_b c2 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    assume s_notin_b: \"s\\<notin>b\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>e3,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    with Cond.hyps e3 noFault\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>e1,Normal s\\<rangle> =n\\<Rightarrow> t\" \"\\<Gamma>\\<turnstile>\\<langle>e2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    with s_notin_b c2 show ?thesis\n      by (auto intro: execn.intros)\n  qed\nnext\n  case (While b bdy1)\n  have noFault: \"\\<not> isFault t\" by fact\n  have \"(While b bdy1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain bdy2 bdy where\n    c2: \"c2=While b bdy2\" and\n    bdy: \"(bdy1 \\<inter>\\<^sub>g bdy2) = Some bdy\" and\n    c: \"c=While b bdy\"\n    by (auto simp add: inter_guards_While)\n  have exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  {\n    fix s t n w w1 w2\n    assume exec_w: \"\\<Gamma>\\<turnstile>\\<langle>w,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume w: \"w=While b bdy\"\n    assume noFault: \"\\<not> isFault t\"\n    from exec_w w noFault\n    have \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Normal s\\<rangle> =n\\<Rightarrow> t \\<and>\n          \\<Gamma>\\<turnstile>\\<langle>While b bdy2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    proof (induct)\n      prefer 10\n      case (WhileTrue s b' bdy' n s' s'')\n      have eqs: \"While b'  bdy' = While b bdy\" by fact\n      from WhileTrue have s_in_b: \"s \\<in> b\" by simp\n      have noFault_s'': \"\\<not> isFault s''\"  by fact\n      from WhileTrue\n      have exec_bdy: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\" by simp\n      from WhileTrue\n      have exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b bdy,s'\\<rangle> =n\\<Rightarrow> s''\" by simp\n      show ?case\n      proof (cases s')\n        case (Fault f)\n        with exec_w have \"s''=Fault f\"\n          by (auto intro: execn_Fault_end)\n        with noFault_s'' show ?thesis by simp\n      next\n        case (Normal s''')\n        with exec_bdy bdy While.hyps\n        obtain \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Normal s'''\"\n               \"\\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Normal s'''\"\n          by auto\n        moreover\n        from Normal WhileTrue\n        obtain\n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Normal s'''\\<rangle> =n\\<Rightarrow> s''\"\n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy2,Normal s'''\\<rangle> =n\\<Rightarrow> s''\"\n          by simp\n        ultimately show ?thesis\n          using s_in_b Normal\n          by (auto intro: execn.intros)\n      next\n        case (Abrupt s''')\n        with exec_bdy bdy While.hyps\n        obtain \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'''\"\n               \"\\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'''\"\n          by auto\n        moreover\n        from Abrupt WhileTrue\n        obtain\n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Abrupt s'''\\<rangle> =n\\<Rightarrow> s''\"\n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy2,Abrupt s'''\\<rangle> =n\\<Rightarrow> s''\"\n          by simp\n        ultimately show ?thesis\n          using s_in_b Abrupt\n          by (auto intro: execn.intros)\n      next\n        case Stuck\n        with exec_bdy bdy While.hyps\n        obtain \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Stuck\"\n               \"\\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Stuck\"\n          by auto\n        moreover\n        from Stuck WhileTrue\n        obtain\n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Stuck\\<rangle> =n\\<Rightarrow> s''\"\n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy2,Stuck\\<rangle> =n\\<Rightarrow> s''\"\n          by simp\n        ultimately show ?thesis\n          using s_in_b Stuck\n          by (auto intro: execn.intros)\n      qed\n    next\n      case WhileFalse thus ?case by (auto intro: execn.intros)\n    qed (simp_all)\n  }\n  with this [OF exec_c c noFault] c2\n  show ?case\n    by auto\nnext\n  case Call thus ?case by (simp add: inter_guards_Call)\nnext\n  case (DynCom f1)\n  have noFault: \"\\<not> isFault t\" by fact\n  have \"(DynCom f1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain f2 f where\n    c2: \"c2=DynCom f2\" and\n    f_defined: \"\\<forall>s. ((f1 s) \\<inter>\\<^sub>g (f2 s)) \\<noteq> None\" and\n    c: \"c=DynCom (\\<lambda>s. the ((f1 s) \\<inter>\\<^sub>g (f2 s)))\"\n    by (auto simp add: inter_guards_DynCom)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>DynCom (\\<lambda>s. the ((f1 s) \\<inter>\\<^sub>g (f2 s))),Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n  then show ?case\n  proof (cases)\n    assume exec_f: \"\\<Gamma>\\<turnstile>\\<langle>the (f1 s \\<inter>\\<^sub>g f2 s),Normal s\\<rangle> =n\\<Rightarrow> t\"\n    from f_defined obtain f where \"(f1 s \\<inter>\\<^sub>g f2 s) = Some f\"\n      by auto\n    with DynCom.hyps this exec_f c2 noFault\n    show ?thesis\n      using execn.DynCom by fastforce\n  qed\nnext\n  case Guard thus ?case\n    by (fastforce elim: execn_Normal_elim_cases intro: execn.intros\n        simp add: inter_guards_Guard)\nnext\n  case Throw thus ?case\n    by (fastforce elim: execn_Normal_elim_cases\n        simp add: inter_guards_Throw)\nnext\n  case (Catch a1 a2)\n  have noFault: \"\\<not> isFault t\" by fact\n  have \"(Catch a1 a2 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain b1 b2 d1 d2 where\n    c2: \"c2=Catch b1 b2\" and\n    d1: \"(a1 \\<inter>\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\<inter>\\<^sub>g b2) = Some d2\" and\n    c: \"c=Catch d1 d2\"\n    by (auto simp add: inter_guards_Catch)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Catch d1 d2,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n  then show ?case\n  proof (cases)\n    fix s'\n    assume \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\"\n    with d1 Catch.hyps\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\" and \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\"\n      by auto\n    moreover\n    assume \"\\<Gamma>\\<turnstile>\\<langle>d2,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n    with d2 Catch.hyps noFault\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a2,Normal s'\\<rangle> =n\\<Rightarrow> t\" and \"\\<Gamma>\\<turnstile>\\<langle>b2,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    ultimately\n    show ?thesis\n      using c2 by (auto intro: execn.intros)\n  next\n    assume \"\\<not> isAbr t\"\n    moreover\n    assume \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    with d1 Catch.hyps noFault\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> t\" and \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    ultimately\n    show ?thesis\n      using c2 by (auto intro: execn.intros)\n  qed\nqed\n\n\nlemma inter_guards_execn_noFault:\n  assumes c: \"(c1 \\<inter>\\<^sub>g c2) = Some c\"\n  assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n  assumes noFault: \"\\<not> isFault t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> t \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> =n\\<Rightarrow> t\"\nproof (cases s)\n  case (Fault f)\n  with exec_c have \"t = Fault f\"\n    by (auto intro: execn_Fault_end)\n    with noFault show ?thesis\n    by simp\nnext\n  case (Abrupt s')\n  with exec_c have \"t=Abrupt s'\"\n    by (simp add: execn_Abrupt_end)\n  with Abrupt show ?thesis by auto\nnext\n  case Stuck\n  with exec_c have \"t=Stuck\"\n    by (simp add: execn_Stuck_end)\n  with Stuck show ?thesis by auto\nnext\n  case (Normal s')\n  with exec_c noFault inter_guards_execn_Normal_noFault [OF c]\n  show ?thesis\n    by blast\nqed\n\nlemma inter_guards_exec_noFault:\n  assumes c: \"(c1 \\<inter>\\<^sub>g c2) = Some c\"\n  assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  assumes noFault: \"\\<not> isFault t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (auto simp add: exec_iff_execn)\n  from c this noFault\n  have \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> t \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule inter_guards_execn_noFault)\n  thus ?thesis\n    by (auto intro: execn_to_exec)\nqed\n\n\nlemma inter_guards_execn_Normal_Fault:\n  \"\\<And>c c2 s n. \\<lbrakk>(c1 \\<inter>\\<^sub>g c2) = Some c; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\\<rbrakk>\n        \\<Longrightarrow> (\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> =n\\<Rightarrow> Fault f)\"\nproof (induct c1)\n  case Skip thus ?case by (fastforce simp add: inter_guards_Skip)\nnext\n  case (Basic f) thus ?case by (fastforce simp add: inter_guards_Basic)\nnext\n  case (Spec r) thus ?case by (fastforce simp add: inter_guards_Spec)\nnext\n  case (Seq a1 a2)\n  have \"(Seq a1 a2 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain b1 b2 d1 d2 where\n    c2: \"c2=Seq b1 b2\" and\n    d1: \"(a1 \\<inter>\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\<inter>\\<^sub>g b2) = Some d2\" and\n    c: \"c=Seq d1 d2\"\n    by (auto simp add: inter_guards_Seq)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  with c obtain s' where\n    exec_d1: \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> s'\" and\n    exec_d2: \"\\<Gamma>\\<turnstile>\\<langle>d2,s'\\<rangle> =n\\<Rightarrow> Fault f\"\n    by (auto elim: execn_Normal_elim_cases)\n  show ?case\n  proof (cases s')\n    case (Fault f')\n    with exec_d2 have \"f'=f\"\n      by (auto dest: execn_Fault_end)\n    with Fault d1 exec_d1\n    have \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (auto dest: Seq.hyps)\n    thus ?thesis\n    proof (cases rule: disjE [consumes 1])\n      assume \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      hence \"\\<Gamma>\\<turnstile>\\<langle>Seq a1 a2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n        by (auto intro: execn.intros)\n      thus ?thesis\n        by simp\n    next\n      assume \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      hence \"\\<Gamma>\\<turnstile>\\<langle>Seq b1 b2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n        by (auto intro: execn.intros)\n      with c2 show ?thesis\n        by simp\n    qed\n  next\n    case Abrupt with exec_d2 show ?thesis by (auto dest: execn_Abrupt_end)\n  next\n    case Stuck with exec_d2 show ?thesis by (auto dest: execn_Stuck_end)\n  next\n    case (Normal s'')\n    with inter_guards_execn_noFault [OF d1 exec_d1] obtain\n      exec_a1: \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Normal s''\" and\n      exec_b1: \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Normal s''\"\n      by simp\n    moreover from d2 exec_d2 Normal\n    have \"\\<Gamma>\\<turnstile>\\<langle>a2,Normal s''\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>b2,Normal s''\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (auto dest: Seq.hyps)\n    ultimately show ?thesis\n      using c2 by (auto intro: execn.intros)\n  qed\nnext\n  case (Cond b t1 e1)\n  have \"(Cond b t1 e1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain t2 e2 t e where\n    c2: \"c2=Cond b t2 e2\" and\n    t: \"(t1 \\<inter>\\<^sub>g t2) = Some t\" and\n    e: \"(e1 \\<inter>\\<^sub>g e2) = Some e\" and\n    c: \"c=Cond b t e\"\n    by (auto simp add: inter_guards_Cond)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Cond b t e,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by simp\n  thus ?case\n  proof (cases)\n    assume \"s \\<in> b\"\n    moreover assume \"\\<Gamma>\\<turnstile>\\<langle>t,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    with t have \"\\<Gamma>\\<turnstile>\\<langle>t1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>t2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (auto dest: Cond.hyps)\n    ultimately show ?thesis using c2 c by (fastforce intro: execn.intros)\n  next\n    assume \"s \\<notin> b\"\n    moreover assume \"\\<Gamma>\\<turnstile>\\<langle>e,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    with e have \"\\<Gamma>\\<turnstile>\\<langle>e1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>e2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (auto dest: Cond.hyps)\n    ultimately show ?thesis using c2 c by (fastforce intro: execn.intros)\n  qed\nnext\n  case (While b bdy1)\n  have \"(While b bdy1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain bdy2 bdy where\n    c2: \"c2=While b bdy2\" and\n    bdy: \"(bdy1 \\<inter>\\<^sub>g bdy2) = Some bdy\" and\n    c: \"c=While b bdy\"\n    by (auto simp add: inter_guards_While)\n  have exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  {\n    fix s t n w w1 w2\n    assume exec_w: \"\\<Gamma>\\<turnstile>\\<langle>w,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume w: \"w=While b bdy\"\n    assume Fault: \"t=Fault f\"\n    from exec_w w Fault\n    have \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\\<or>\n          \\<Gamma>\\<turnstile>\\<langle>While b bdy2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    proof (induct)\n      case (WhileTrue s b' bdy' n  s' s'')\n      have eqs: \"While b' bdy' = While b bdy\" by fact\n      from WhileTrue have s_in_b: \"s \\<in> b\" by simp\n      have Fault_s'': \"s''=Fault f\"  by fact\n      from WhileTrue\n      have exec_bdy: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\" by simp\n      from WhileTrue\n      have exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b bdy,s'\\<rangle> =n\\<Rightarrow> s''\" by simp\n      show ?case\n      proof (cases s')\n        case (Fault f')\n        with exec_w Fault_s'' have \"f'=f\"\n          by (auto dest: execn_Fault_end)\n        with Fault exec_bdy bdy While.hyps\n        have \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n          by auto\n        with s_in_b show ?thesis\n          by (fastforce intro: execn.intros)\n      next\n        case (Normal s''')\n        with inter_guards_execn_noFault [OF bdy exec_bdy]\n        obtain \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Normal s'''\"\n               \"\\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Normal s'''\"\n          by auto\n        moreover\n        from Normal WhileTrue\n        have \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Normal s'''\\<rangle> =n\\<Rightarrow> Fault f \\<or>\n              \\<Gamma>\\<turnstile>\\<langle>While b bdy2,Normal s'''\\<rangle> =n\\<Rightarrow> Fault f\"\n          by simp\n        ultimately show ?thesis\n          using s_in_b by (fastforce intro: execn.intros)\n      next\n        case (Abrupt s''')\n        with exec_w Fault_s'' show ?thesis by (fastforce dest: execn_Abrupt_end)\n      next\n        case Stuck\n        with exec_w Fault_s'' show ?thesis by (fastforce dest: execn_Stuck_end)\n      qed\n    next\n      case WhileFalse thus ?case by (auto intro: execn.intros)\n    qed (simp_all)\n  }\n  with this [OF exec_c c] c2\n  show ?case\n    by auto\nnext\n  case Call thus ?case by (fastforce simp add: inter_guards_Call)\nnext\n  case (DynCom f1)\n  have \"(DynCom f1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain f2  where\n    c2: \"c2=DynCom f2\" and\n    F_defined: \"\\<forall>s. ((f1 s) \\<inter>\\<^sub>g (f2 s)) \\<noteq> None\" and\n    c: \"c=DynCom (\\<lambda>s. the ((f1 s) \\<inter>\\<^sub>g (f2 s)))\"\n    by (auto simp add: inter_guards_DynCom)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>DynCom (\\<lambda>s. the ((f1 s) \\<inter>\\<^sub>g (f2 s))),Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by simp\n  then show ?case\n  proof (cases)\n    assume exec_F: \"\\<Gamma>\\<turnstile>\\<langle>the (f1 s \\<inter>\\<^sub>g f2 s),Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    from F_defined obtain F where \"(f1 s \\<inter>\\<^sub>g f2 s) = Some F\"\n      by auto\n    with DynCom.hyps this exec_F c2\n    show ?thesis\n      by (fastforce intro: execn.intros)\n  qed\nnext\n  case (Guard m g1 bdy1)\n  have \"(Guard m g1 bdy1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain g2 bdy2 bdy where\n    c2: \"c2=Guard m g2 bdy2\" and\n    bdy: \"(bdy1 \\<inter>\\<^sub>g bdy2) = Some bdy\" and\n    c: \"c=Guard m (g1 \\<inter> g2) bdy\"\n    by (auto simp add: inter_guards_Guard)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Guard m (g1 \\<inter> g2) bdy,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    by simp\n  thus ?case\n  proof (cases)\n    assume f_m: \"Fault f = Fault m\"\n    assume \"s \\<notin> g1 \\<inter> g2\"\n    hence \"s\\<notin>g1 \\<or> s\\<notin>g2\"\n      by blast\n    with c2 f_m show ?thesis\n      by (auto intro: execn.intros)\n  next\n    assume \"s \\<in> g1 \\<inter> g2\"\n    moreover\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (rule Guard.hyps)\n    ultimately show ?thesis\n      using c2\n      by (auto intro: execn.intros)\n  qed\nnext\n  case Throw thus ?case by (fastforce simp add: inter_guards_Throw)\nnext\n  case (Catch a1 a2)\n  have \"(Catch a1 a2 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain b1 b2 d1 d2 where\n    c2: \"c2=Catch b1 b2\" and\n    d1: \"(a1 \\<inter>\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\<inter>\\<^sub>g b2) = Some d2\" and\n    c: \"c=Catch d1 d2\"\n    by (auto simp add: inter_guards_Catch)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Catch d1 d2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by simp\n  thus ?case\n  proof (cases)\n    fix s'\n    assume \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\"\n    from inter_guards_execn_noFault [OF d1 this] obtain\n      exec_a1: \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\" and\n      exec_b1: \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\"\n      by simp\n    moreover assume  \"\\<Gamma>\\<turnstile>\\<langle>d2,Normal s'\\<rangle> =n\\<Rightarrow> Fault f\"\n    with d2\n    have \"\\<Gamma>\\<turnstile>\\<langle>a2,Normal s'\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>b2,Normal s'\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (auto dest: Catch.hyps)\n    ultimately show ?thesis\n      using c2 by (fastforce intro: execn.intros)\n  next\n    assume \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    with d1 have \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (auto dest: Catch.hyps)\n    with c2 show ?thesis\n      by (fastforce intro: execn.intros)\n  qed\nqed\n\n\nlemma inter_guards_execn_Fault:\n  assumes c: \"(c1 \\<inter>\\<^sub>g c2) = Some c\"\n  assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Fault f\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> =n\\<Rightarrow> Fault f\"\nproof (cases s)\n  case (Fault f)\n  with exec_c show ?thesis\n    by (auto dest: execn_Fault_end)\nnext\n  case (Abrupt s')\n  with exec_c show ?thesis\n    by (fastforce dest: execn_Abrupt_end)\nnext\n  case Stuck\n  with exec_c show ?thesis\n    by (fastforce dest: execn_Stuck_end)\nnext\n  case (Normal s')\n  with exec_c inter_guards_execn_Normal_Fault [OF c]\n  show ?thesis\n    by blast\nqed\n\nlemma inter_guards_exec_Fault:\n  assumes c: \"(c1 \\<inter>\\<^sub>g c2) = Some c\"\n  assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Fault f\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> \\<Rightarrow> Fault f\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Fault f\"\n    by (auto simp add: exec_iff_execn)\n  from c this\n  have \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> =n\\<Rightarrow> Fault f\"\n    by (rule inter_guards_execn_Fault)\n  thus ?thesis\n    by (auto intro: execn_to_exec)\nqed\n\n\n(* ************************************************************************* *)\nsubsection \"Restriction of Procedure Environment\"\n(* ************************************************************************* *)\n\nlemma restrict_SomeD: \"(m|\\<^bsub>A\\<^esub>) x = Some y \\<Longrightarrow> m x = Some y\"\n  by (auto simp add: restrict_map_def split: if_split_asm)\n\n(* FIXME: To Map *)\nlemma restrict_dom_same [simp]: \"m|\\<^bsub>dom m\\<^esub> = m\"\n  apply (rule ext)\n  apply (clarsimp simp add: restrict_map_def)\n  apply (simp only: not_None_eq [symmetric])\n  apply rule\n  apply (drule sym)\n  apply blast\n  done\n\nlemma restrict_in_dom: \"x \\<in> A \\<Longrightarrow> (m|\\<^bsub>A\\<^esub>) x = m x\"\n  by (auto simp add: restrict_map_def)\n\n\nlemma exec_restrict_to_exec:\n  assumes exec_restrict: \"\\<Gamma>|\\<^bsub>A\\<^esub>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  assumes notStuck: \"t\\<noteq>Stuck\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nusing exec_restrict notStuck\nby (induct) (auto intro: exec.intros dest: restrict_SomeD Stuck_end)\n\nlemma execn_restrict_to_execn:\n  assumes exec_restrict: \"\\<Gamma>|\\<^bsub>A\\<^esub>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n  assumes notStuck: \"t\\<noteq>Stuck\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\nusing exec_restrict notStuck\nby (induct) (auto intro: execn.intros dest: restrict_SomeD execn_Stuck_end)\n\nlemma restrict_NoneD: \"m x = None \\<Longrightarrow>  (m|\\<^bsub>A\\<^esub>) x = None\"\n  by (auto simp add: restrict_map_def split: if_split_asm)\n\n\n\n\nlemma exec_to_exec_restrict:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>|\\<^bsub>P\\<^esub>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and> (t=Stuck \\<longrightarrow> t'=Stuck) \\<and>\n                (\\<forall>f. t=Fault f\\<longrightarrow> t'\\<in>{Fault f,Stuck}) \\<and> (t'\\<noteq>Stuck \\<longrightarrow> t'=t)\"\nproof -\n  from exec obtain n where\n    execn_strip: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (auto simp add: exec_iff_execn)\n  from execn_to_execn_restrict [where P=P,OF this]\n  obtain t' where\n    \"\\<Gamma>|\\<^bsub>P\\<^esub>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t'\"\n    \"t=Stuck \\<longrightarrow> t'=Stuck\" \"\\<forall>f. t=Fault f\\<longrightarrow> t'\\<in>{Fault f,Stuck}\" \"t'\\<noteq>Stuck \\<longrightarrow> t'=t\"\n    by blast\n  thus ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\nlemma notStuck_GuardD:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Guard m g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; s \\<in> g\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.Guard )\n\nlemma notStuck_SeqD1:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.Seq )\n\n\nlemma notStuck_SeqD2:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>s'\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.Seq )\n\nlemma notStuck_SeqD:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\\<rbrakk> \\<Longrightarrow>\n     \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck} \\<and> (\\<forall>s'. \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>s' \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> \\<Rightarrow>\\<notin>{Stuck})\"\n  by (auto simp add: final_notin_def dest: exec.Seq )\n\nlemma notStuck_CondTrueD:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; s \\<in> b\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.CondTrue)\n\nlemma notStuck_CondFalseD:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; s \\<notin> b\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.CondFalse)\n\nlemma notStuck_WhileTrueD1:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; s \\<in> b\\<rbrakk>\n   \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.WhileTrue)\n\nlemma notStuck_WhileTrueD2:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>s'; s \\<in> b\\<rbrakk>\n   \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>While b c,s'\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.WhileTrue)\n\nlemma notStuck_CallD:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Call p ,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma> p = Some bdy\\<rbrakk>\n   \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.Call)\n\nlemma notStuck_CallDefinedD:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\\<rbrakk>\n   \\<Longrightarrow> \\<Gamma> p \\<noteq> None\"\n  by (cases \"\\<Gamma> p\")\n     (auto simp add: final_notin_def dest:  exec.CallUndefined)\n\nlemma notStuck_DynComD:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\\<rbrakk>\n   \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>(c s),Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.DynCom)\n\nlemma notStuck_CatchD1:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.CatchMatch exec.CatchMiss )\n\nlemma notStuck_CatchD2:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>Abrupt s'\\<rbrakk>\n   \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.CatchMatch)\n\n\n(* ************************************************************************* *)\nsubsection \"Miscellaneous\"\n(* ************************************************************************* *)\n\nlemma execn_noguards_no_Fault:\n assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes noguards_c: \"noguards c\"\n assumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\n assumes s_no_Fault: \"\\<not> isFault s\"\n shows \"\\<not> isFault t\"\n  using execn noguards_c s_no_Fault\n  proof (induct)\n    case (Call p bdy n s t) with noguards_\\<Gamma> show ?case\n      apply -\n      apply (drule bspec [where x=p])\n      apply auto\n      done\n  qed (auto)\n\nlemma exec_noguards_no_Fault:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes noguards_c: \"noguards c\"\n assumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\n assumes s_no_Fault: \"\\<not> isFault s\"\n shows \"\\<not> isFault t\"\n  using exec noguards_c s_no_Fault\n  proof (induct)\n    case (Call p bdy s t) with noguards_\\<Gamma> show ?case\n      apply -\n      apply (drule bspec [where x=p])\n      apply auto\n      done\n  qed auto\n\nlemma execn_nothrows_no_Abrupt:\n assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes nothrows_c: \"nothrows c\"\n assumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\n assumes s_no_Abrupt: \"\\<not>(isAbr s)\"\n shows \"\\<not>(isAbr t)\"\n  using execn nothrows_c s_no_Abrupt\n  proof (induct)\n    case (Call p bdy n s t) with nothrows_\\<Gamma> show ?case\n      apply -\n      apply (drule bspec [where x=p])\n      apply auto\n      done\n  qed (auto)\n\nlemma exec_nothrows_no_Abrupt:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes nothrows_c: \"nothrows c\"\n assumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\n assumes s_no_Abrupt: \"\\<not>(isAbr s)\"\n shows \"\\<not>(isAbr t)\"\n  using exec nothrows_c s_no_Abrupt\n  proof (induct)\n    case (Call p bdy s t) with nothrows_\\<Gamma> show ?case\n      apply -\n      apply (drule bspec [where x=p])\n      apply auto\n      done\n  qed (auto)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/Semantic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544335934766, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.33597684587213167}}
{"text": "theory flash51Bra  imports flash51Rev\n \n  begin\nlemma onInv51:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv51  iInv1  iInv2  iInv3 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX1VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_GetXVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ShWbVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX7VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak2VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX5VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_WbVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_GetVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceShrVldVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_2VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak2VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_ReplaceVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_HomeVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put2VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX11VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX6VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put2VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1_HomeVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak1VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak1VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak2VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak3VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX2VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put1VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutXVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis StoreVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_FAckVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX3VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutXVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put1VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis StoreHomeVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_NakVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_PutXVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX4VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_NakVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak1VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_ClearVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_PutXVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak3VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX9VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetXVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv51  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put3VsInv51 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash51Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737344123242, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.33595469383238324}}
{"text": "theory Proof_5_2\n  imports Proofs_5\nbegin\n\nabbreviation s where \"s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value \\<equiv>\n (toEnv\n       (setPstate (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) ERROR\n         Ctrl'emergency))\"\n\ntheorem proof_5_2 \"VC2 inv5 env s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\"\n  apply(simp only: VC2_def inv5_def R5_def extraInv_def)\n  apply(rule impI)\n  apply(rule conjI)\n   apply(rule conjI)\n    apply simp\n   apply((rule allI)+)\n   apply(rule impI)\n   apply((drule conjE)+)\n                     prefer 30\n                      apply assumption\n                      prefer 29\n                      apply assumption\n                      prefer 28\n                      apply assumption\n                      prefer 27\n                      apply assumption\n                      prefer 26\n                      apply assumption\n                      prefer 25\n                      apply assumption\n                      prefer 24\n                      apply assumption\n                      prefer 23\n                      apply assumption\n                      prefer 22\n                      apply assumption\n                      prefer 21\n                      apply assumption\n                      prefer 20\n                      apply assumption\n                     prefer 19\n                     apply assumption\n                    prefer 18\n                    apply assumption\n                   prefer 17\n                   apply assumption\n                  prefer 16\n                  apply assumption\n                 prefer 15\n                 apply assumption\n                prefer 14\n                apply assumption\n               prefer 13\n               apply assumption\n              prefer 12\n              apply assumption\n             prefer 11\n             apply assumption\n            prefer 10\n            apply assumption\n           prefer 9\n           apply assumption\n          prefer 8\n          apply assumption\n         prefer 7\n         apply assumption\n        prefer 6\n        apply assumption\n       prefer 5\n       apply assumption\n      prefer 4\n      apply assumption\n     prefer 3\n     apply assumption\n    prefer 2\n    apply assumption\n  subgoal premises prems for s1 s2\n    apply(rule disjE[OF le_imp_less_or_eq[OF prems(13)]])\n    apply(rule cut_rl[of \" \\<exists>s4. toEnvP s4 \\<and>\n         substate s2 s4 \\<and>\n         substate s4  s0 \\<and>\n         toEnvNum s2 s4 \\<le> ERROR \\<and>\n         getVarBool s4 up' = DOWN' \\<and>\n         getVarBool s4 down' = DOWN' \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow> getVarBool s3 up' = UP' \\<or> getVarBool s3 down' = UP')\"])\n      apply(drule exE)\n       prefer 2\n       apply assumption\n    subgoal for s4\n      apply(rule exI[of _ s4])\n      by simp\n    using prems(2) prems(4) prems(6) prems(7) prems(9) prems(11) prems(15) prems(16) apply -[1]\n     apply(drule allE[of _ s1])\n      prefer 2\n      apply assumption\n     apply(drule allE[of _ s2])\n      prefer 2\n      apply assumption\n     apply(simp split: if_splits)\n    apply(rule cut_rl[of \"\\<forall> s5. toEnvP s5 \\<and> substate s2 s5 \\<and> substate s5\n (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \\<longrightarrow>\n pred5 s1 s2\n (s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) s5\"])\n     apply(drule allE[of _ s2])\n      prefer 2\n      apply assumption\n     apply(drule impE)\n       prefer 3\n       apply assumption\n    using prems(4,7) substate_refl apply fast\n     apply(simp only: pred5_def)\n     apply(drule impE)\n       prefer 3\n       apply assumption\n    using prems(2)  prems(4) prems(6) prems(7) prems(11) prems(15) prems(16) substate_refl substate_trans substate_antisym\n      apply blast\n     apply fast\n      apply(rule allI)\n    subgoal premises toEnvNums2s for s5\n      apply(induction rule: state_down_ind)\n      using prems(7) apply simp\n      apply(simp only: pred5_def)\n       apply(rule impI)\n       apply((drule conjE)+)\n                  prefer 12\n                  apply assumption\n                 prefer 11\n                 apply assumption\n                prefer 10\n                apply assumption\n               prefer 9\n               apply assumption\n              prefer 8\n              apply assumption\n             prefer 7\n             apply assumption\n            prefer 6\n            apply assumption\n           prefer 5\n           apply assumption\n          prefer 4\n          apply assumption\n         prefer 3\n         apply assumption\n        prefer 2\n        apply assumption\n\n       apply(rule cut_rl[of \"getVarBool s0 up' = False \\<and> getVarBool s0 down' = False\"])\n        apply(drule allE[of _ s0])\n      prefer 2\n         apply assumption\n        apply(drule impE)\n          prefer 3\n          apply assumption\n      using prems(8) substate_refl apply (simp split: if_splits)\n        apply fast\n      using prems(3) apply (simp split: if_splits)\n      using prems\n       apply (metis substate_refl)\n\n      subgoal for s5\n        apply(simp only: pred5_def)\n        apply(rule impI)\n        apply(cases \"getVarBool (predEnv s5) up' = False  \\<and> getVarBool (predEnv s5) down' = False\")\n       apply(rule exI[of _ \"predEnv s5\"])\n       apply(rule conjI)\n        apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n        apply blast\n       apply(rule conjI)\n      using substate_refl apply simp\n       apply(rule conjI)\n      using predEnv_substate substate_trans apply blast\n       apply(rule conjI)\n      using toEnvNum3[of s2 \"predEnv s5\"\n \"(s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value) \"]\n        apply force\n       apply(rule conjI)\n        apply fast\n       apply(rule conjI)\n        apply fast\n      using substate_antisym apply fast\n      apply(drule impE)\n        apply(((rule conjI),blast)+)\n      using substate_eq_or_predEnv apply blast\n      prefer 2\n       apply assumption\n      apply(drule exE)\n       prefer 2\n       apply assumption\n      subgoal for s4\n        apply(rule exI[of _ s4])\n       apply(rule conjI)\n         apply blast\n        apply(rule conjI)\n        using predEnv_substate substate_trans apply blast\n        apply(((rule conjI),blast)+)\n        apply((drule conjE)+)\n                          prefer 20\n                           apply assumption\n                          prefer 19\n                          apply assumption\n                         prefer 18\n                         apply assumption\n                        prefer 17\n                        apply assumption\n                       prefer 16\n                       apply assumption\n                      prefer 15\n                      apply assumption\n                     prefer 14\n                     apply assumption\n                    prefer 13\n                    apply assumption\n                   prefer 12\n                   apply assumption\n                  prefer 11\n                  apply assumption\n                 prefer 10\n                 apply assumption\n                prefer 9\n                apply assumption\n               prefer 8\n               apply assumption\n              prefer 7\n              apply assumption\n             prefer 6\n             apply assumption\n            prefer 5\n            apply assumption\n           prefer 4\n           apply assumption\n          prefer 3\n          apply assumption\n         prefer 2\n         apply assumption\n        using predEnv_substate_imp_eq_or_substate by blast\n      done\n    done\n  done\n     ", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/escalator/Proof_5_2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370308082623217, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3359168710985631}}
{"text": "theory Linked_List_Insert imports\n \"/home/dacosta/development/rockwellcollins/l4v/tools/autocorres/AutoCorres\"\n \"/home/dacosta/development/rockwellcollins/l4v/tools/autocorres/DataStructures\"\nbegin\n\ntext{* \n\nAuthor: Dan DaCosta\nDescription: Work towards a correctness proof of an order preserving linked list insert. Insertion\nrelies on a function, find_insertion, to find the correct placement for the new node. Currently,\nthere is a proof that find_insertion finds the insertion point according to the following \nstatements:\n\n  - find_insertion does not alter the heap\n\n  - if find_insertion returns a non-null node n, then all ancestors of n and n have values less than\n  or equal to value find_insertion was called with.\n\n  - if find_insertion returns a non-null node n and n's direct descendant is not null than n's \n  direct descendant has a value greater than that of what find_insertion was called with.\n\n  - if find_insertion returns null then either the list find_insertion was called with was null or\n  the first element of the list is greater than the value find_insertion was called with.\n\nTODO:\n \n - Requires significant cleanup.\n\n - A proof that insert uses find_insertion to insert a new element into a linked list preserving\n ascending order must be given.\n\n*}\n\ninstall_C_file linked_list.c\nautocorres [ heap_abs_syntax, ts_rules = nondet] linked_list.c\ncontext linked_list begin\n\ninterpretation DataStructures.linked_list next_C NULL\ndone\n\ndeclare list_split [simp del]\ndeclare path_split [simp del]\n\nfun lkup :: \"lifted_globals \\<Rightarrow> ll_C ptr \\<Rightarrow> ll_C option\" where \n\"lkup s a = (if is_valid_ll_C s a then Some (s[a]) else None)\"\n\ndeclare lkup.simps [simp del]\n\nlemma list_no_null:\"list (lkup s') xs i \\<Longrightarrow> NULL \\<notin> set xs\"\n apply (induction xs arbitrary: i) by auto\n\nlemma list_next:\"\\<lbrakk>list (lkup s) xs i; j \\<in> set xs; s[j]\\<rightarrow>next \\<noteq> NULL\\<rbrakk> \\<Longrightarrow> s[j]\\<rightarrow>next \\<in> set xs\"\n apply (induction xs arbitrary: i j)\n apply auto\n by (metis linked_list.get_ll_next_def linked_list.lkup.simps list_mem option.distinct(1) option.sel)\n\nlemma list_all_valid:\"\\<lbrakk>list (lkup s) xs i; j \\<in> set xs\\<rbrakk> \\<Longrightarrow> is_valid_ll_C s j\"\n apply (induction xs arbitrary: i j)\n apply auto\n by (metis linked_list.lkup.simps option.distinct(1))\n\nlemma the_list_next_is_smaller:\"\\<lbrakk>list (lkup s) xs i; j \\<in> set xs\\<rbrakk>\n       \\<Longrightarrow> length (the_list (lkup s) s[j]\\<rightarrow>next) < length (the_list (lkup s) j)\"\n apply (induction xs arbitrary: i j)\n apply auto\n by (metis (no_types, hide_lams) add.right_neutral add_Suc_right is_list_non_NULL lessI \n    linked_list.get_ll_next_def linked_list.list_is_list list.size(4) lkup.simps option.distinct(1) \n    option.sel the_list_non_NULL)\n\n\nlemma the_list_absurd:\n  \"\\<lbrakk>is_valid_ll_C s x; x \\<noteq> NULL; s[x]\\<rightarrow>next = NULL; the_list (lkup s) x = []\\<rbrakk> \\<Longrightarrow> False\"\n by (metis lkup.simps is_list_non_NULL linked_list.is_list_empty linked_list.get_ll_next_def \n    the_list_empty')\n\nlemma path_null_list_imp: \"list s xs i \\<Longrightarrow> path s i xs NULL\"\n using path_null_list by auto\n\nlemma list_singleton:\"\\<lbrakk>list (lkup s) xs a; a \\<noteq> NULL; s[a]\\<rightarrow>next = NULL\\<rbrakk> \\<Longrightarrow> xs = [a]\"\n apply (cases xs, auto) \n by (metis linked_list.list_empty linked_list.get_ll_next_def linked_list.lkup.simps \n    option.distinct(1) option.sel)\n\nlemma list_non_empty:\"list (lkup s) (x # xs) i \\<Longrightarrow> i \\<noteq> NULL \\<and> x = i \\<and> is_valid_ll_C s i \\<and> list (lkup s) xs s[i]\\<rightarrow>next\"\n by (metis linked_list.get_ll_next_def linked_list.list_all_valid linked_list.lkup.simps \n    list.set_intros(1) local.list.simps(2) option.sel)\n\nlemma list_path_no_cycles:\"\\<lbrakk>list (lkup s) xs i; a \\<in> set xs; path (lkup s) a ys a\\<rbrakk> \\<Longrightarrow> ys = []\"\nproof (induction xs arbitrary: i)\n  case Nil\n  thus ?case by auto\nnext\n  case (Cons x xs)\n  have \"a = i \\<or> a \\<noteq> i\" using Cons by auto\n  thus ?case\n  proof\n    assume \"a = i\"\n    thus ?case using Cons by (meson append_self_conv2 list_split list_unique)\n  next\n    assume a:\"a \\<noteq> i\"\n    then have \"x = i \\<and> list (lkup s) xs (s[i]\\<rightarrow>next)\" using Cons list_non_empty by blast\n    then have h1:\"x = i\" and h2:\"list (lkup s) xs (s[i]\\<rightarrow>next)\" by auto\n    thus ?case using Cons Cons(1)[OF h2 _ Cons(4)] a by auto\n  qed\nqed\n\nlemma paths_preserve_list:\n\"\\<lbrakk>list (lkup s) xs i; a \\<in> set xs; path (lkup s) i xs1 a; path (lkup s) a xs2 NULL\\<rbrakk> \n \\<Longrightarrow> xs = xs1 @ xs2\"\nproof (induction xs arbitrary: i)\n  case Nil\n  thus ?case by auto\nnext\n  case (Cons x xs)\n  have \"a = i \\<or> a \\<noteq> i\" using Cons by auto\n  thus ?case\n  proof\n    assume \"a = i\"\n    thus ?case using Cons list_path_no_cycles \n      by (metis append_self_conv2 list_unique path_null_list)\n  next\n    assume a:\"a \\<noteq> i\"\n    then have \"x = i \\<and> list (lkup s) xs (s[i]\\<rightarrow>next)\" using list_non_empty Cons by blast\n    then have h1:\"x = i\" and h2:\"list (lkup s) xs (s[i]\\<rightarrow>next)\" by auto\n    thus ?case \n      using Cons(1)[OF h2 _ _ Cons(5)] Cons a by (meson list_split list_unique path_null_list) \n  qed\nqed\n\nlemma path_extend:\n\"\\<lbrakk>path (lkup s) i xs a; a \\<noteq> NULL; is_valid_ll_C s a\\<rbrakk> \\<Longrightarrow> path (lkup s) i (xs@[a]) s[a]\\<rightarrow>next\"\nproof(induction xs arbitrary:i)\n  case Nil\n  thus ?case by (simp add: linked_list.get_ll_next_def linked_list.lkup.simps)\nnext\n  case (Cons x xs)\n  then have \"i \\<noteq> NULL \\<and> is_valid_ll_C s a \\<and> i = x \\<and> path (lkup s) s[i]\\<rightarrow>next xs a\" \n    using lkup.simps \n    by (metis linked_list.get_ll_next_def option.distinct(1) option.sel path.simps(2))\n  then have h1:\"i = x\" and h2:\"path (lkup s) s[i]\\<rightarrow>next xs a\" and h3:\"i \\<noteq> NULL\" and h4:\"is_valid_ll_C s a\" by auto\n  then have \"path (lkup s) s[i]\\<rightarrow>next (xs @ [a]) s[a]\\<rightarrow>next\" using Cons(1)[OF h2 Cons(3) Cons(4)] by auto\n  thus ?case \n    using h3 h4 h1 Cons.prems(1) append_Cons linked_list.get_ll_next_def \n    by (metis lkup.simps option.simps(3) path.simps(2))\nqed\n\nlemma path_shorten:\"\\<lbrakk>path (lkup s) i xs NULL; i \\<noteq> NULL\\<rbrakk> \\<Longrightarrow> path (lkup s) s[i]\\<rightarrow>next (tl xs) NULL\"\nproof -\n  assume a1:\"path (lkup s) i xs NULL\"\n  and a2:\"i \\<noteq> NULL\"\n  have \"s[i]\\<rightarrow>next = NULL \\<or> s[i]\\<rightarrow>next \\<noteq> NULL\" by simp\n  thus ?thesis\n  proof \n    assume \"s[i]\\<rightarrow>next = NULL\"\n    thus ?thesis \n      using a1 a2 linked_list.path.simps(1) linked_list.path_null_list \n            linked_list.list_singleton list.sel(3) \n      by fastforce\n  next\n    assume \"s[i]\\<rightarrow>next \\<noteq> NULL\"\n    thus ?thesis by (metis a1 a2 linked_list.path_null_list list.sel(3) list_non_empty path_next)\n  qed\nqed\n\nlemma find_insertion_1_loop_step:\nassumes a1:\"list (lkup s) xs i\"\nand a2:\"path (lkup s) i xs1 a\"\nand a3:\"\\<forall>x\\<in>set xs1. sint s[x]\\<rightarrow>val \\<le> v\"\nand a4:\"path (lkup s) a xs2 NULL\"\nand a5:\"a \\<noteq> NULL\"\nand a6:\"sint s[a]\\<rightarrow>val \\<le> v\"\nand a7:\"a \\<in> set xs\"\nshows \"\\<exists>xs1. path (lkup s) i xs1 s[a]\\<rightarrow>next \n       \\<and> (\\<exists>xs2. path (lkup s) s[a]\\<rightarrow>next xs2 NULL) \n       \\<and> (\\<forall>x\\<in>set xs1. sint s[x]\\<rightarrow>val \\<le> v)\"\nproof - \n  have h1:\"path (lkup s) i (xs1 @ [a]) s[a]\\<rightarrow>next\" using path_extend[OF a2 a5 list_all_valid[OF a1 a7]] by simp\n  then have h2:\"path (lkup s) s[a]\\<rightarrow>next (tl xs2) NULL\" using path_shorten[OF a4 a5] by simp\n  then have h3:\"\\<forall>x\\<in>set (xs1@[a]). sint s[x]\\<rightarrow>val \\<le> v\" using a3 a6 by simp\n  thus ?thesis using h1 h2 h3 by metis\nqed\n\nlemma find_insertion_1:\n\"\\<lbrace> \\<lambda> (s::lifted_globals). \n  s' = s\n  \\<and> i \\<noteq> NULL\n  \\<and> sint s'[i]\\<rightarrow>val \\<le> v\n  \\<and> list (lkup s) xs i \\<rbrace>\n  find_insertion' v i\n\\<lbrace> \\<lambda> r s.\n  s' = s\n  \\<and> r \\<noteq> NULL\n  \\<and> (s[r]\\<rightarrow>next = NULL \\<or> (s[r]\\<rightarrow>next \\<noteq> NULL \\<and>  v < sint s[s[r]\\<rightarrow>next]\\<rightarrow>val))\n  \\<and> (\\<exists> xs1 xs2.\n       path (lkup s) i xs1 s[r]\\<rightarrow>next \n       \\<and> path (lkup s) s[r]\\<rightarrow>next xs2 NULL\n       \\<and> (\\<forall> x \\<in> set xs1. sint s[x]\\<rightarrow>val \\<le> v))\n\\<rbrace>!\"\n apply (rule validNF_assume_pre)\n apply (unfold find_insertion'_def)\n apply (subst whileLoop_add_inv [where \n  I = \" \\<lambda> (it,last,cond) s. \n       s = s'\n       \\<and> (cond \\<noteq> 0 \\<longrightarrow> it \\<noteq> NULL \\<and> sint s[it]\\<rightarrow>val \\<le> v \\<and> it \\<in> set xs)\n       \\<and> (cond = 0 \\<longrightarrow> last \\<noteq> NULL \\<and> (it = NULL \\<or> v < sint s[it]\\<rightarrow>val))\n       \\<and> (last \\<noteq> NULL \\<longrightarrow> s[last]\\<rightarrow>next = it \\<and> last \\<in> set xs)\n       \\<and> (\\<exists> xs1 xs2. path (lkup s) i xs1 it \\<and> path (lkup s) it xs2 NULL \\<and> (\\<forall> x \\<in> set xs1. sint s[x]\\<rightarrow>val \\<le> v))\n\" \n  and M = \"\\<lambda>((it,r,_),s). length (the_list (lkup s) it)\"])\n apply wp\n    apply (clarsimp,auto intro: list_all_valid list_next list_mem the_list_next_is_smaller path_null_list_imp the_list_absurd find_insertion_1_loop_step)[1]\n   apply (clarsimp, auto)\n  apply wp\n apply (auto intro: list_mem list_all_valid) \n apply (metis empty_iff linked_list.path.simps(1) linked_list.path_null_list list.set(1))\ndone\n\nlemma find_insertion_2:\n\"\\<lbrace> \\<lambda> (s::lifted_globals). \n  s' = s\n  \\<and> i = NULL\n  \\<and> list (lkup s) xs i \\<rbrace>\n  find_insertion' v i\n\\<lbrace> \\<lambda> r s.\n  s' = s\n  \\<and> r = NULL\n\\<rbrace>!\"\n apply (unfold find_insertion'_def)\n apply (subst whileLoop_unroll)\n apply wp\n    apply (rule validNF_false_pre)\n   apply (rule validNF_false_pre)\n  apply wp\n apply auto\ndone\n\nlemma find_insertion_3:\n\"\\<lbrace> \\<lambda> (s::lifted_globals). \n  s' = s\n  \\<and> i \\<noteq> NULL\n  \\<and> v < sint s'[i]\\<rightarrow>val\n  \\<and> list (lkup s) xs i \\<rbrace>\n  find_insertion' v i\n\\<lbrace> \\<lambda> r s.\n  s' = s\n  \\<and> r = NULL\n  \\<and> v < sint s'[i]\\<rightarrow>val\n\\<rbrace>!\"\n apply (unfold find_insertion'_def)\n apply (subst whileLoop_unroll)\n apply wp\n    apply (rule validNF_false_pre)\n   apply (rule validNF_false_pre)\n  apply wp\n apply (auto intro: list_all_valid list_mem) \ndone\n\n\nlemma separate_cases:\"(\\<And>s. s' = s \\<and> list (lkup s) xs i \\<Longrightarrow>\n        (s' = s \\<and> i \\<noteq> NULL \\<and> sint s'[i]\\<rightarrow>val \\<le> v \\<and> list (lkup s) xs i \n        \\<or> s' = s \\<and> i = NULL \\<and> list (lkup s) xs i) \n        \\<or> s' = s \\<and> i \\<noteq> NULL \\<and> v < sint s'[i]\\<rightarrow>val \\<and> list (lkup s) xs i) \"\nby auto\n\nlemma find_insertion:\n\"\n\\<lbrace> \\<lambda> (s::lifted_globals). \n  s' = s\n  \\<and> list (lkup s) xs i \\<rbrace>\n  find_insertion' v i\n\\<lbrace> \\<lambda> r s.\n  (s' = s \\<and> r \\<noteq> NULL \\<and>\n                     (s[r]\\<rightarrow>next = NULL \\<or> s[r]\\<rightarrow>next \\<noteq> NULL \\<and> v < sint s[s[r]\\<rightarrow>next]\\<rightarrow>val) \\<and>\n                     (\\<exists>xs1 xs2. path (lkup s) i xs1 s[r]\\<rightarrow>next \\<and> path (lkup s) s[r]\\<rightarrow>next xs2 NULL \\<and> (\\<forall>x\\<in>set xs1. sint s[x]\\<rightarrow>val \\<le> v)) \\<or>\n            s' = s \\<and> r = NULL) \\<or>\n           s' = s \\<and> r = NULL \\<and> v < sint s'[i]\\<rightarrow>val\n\\<rbrace>!\"\nusing validNF_weaken_pre[OF \n        validNF_vcg_disj_lift[OF \n          validNF_vcg_disj_lift[OF find_insertion_1 find_insertion_2]  \n          find_insertion_3, \n          of s' i v xs s' xs s' xs],\n        of \"\\<lambda> s . s' = s \\<and> list (lkup s) xs i\", \n      OF separate_cases] by simp\n\nlemma \"\\<lbrace> \\<lambda> (s::lifted_globals). \n  s' = s\n  \\<and> n \\<noteq> NULL\n  \\<and> is_valid_ll_C s n\n  \\<and> s[n]\\<rightarrow>next = NULL\n  \\<and> list (lkup s) xs' i \n  \\<and> sorted xs\n  \\<and> (\\<forall> x \\<in> set xs. n \\<noteq> x)\\<rbrace>\n  insert' n i\n\\<lbrace> \\<lambda> r s. (\\<exists> xs. list (lkup s) xs' r \\<and> n \\<in> set xs' \\<and> sorted xs')\\<rbrace>!\"\noops\n\nend", "meta": {"author": "chaosape", "repo": "autocorresexperiments", "sha": "096f5ebbc56d10a785fe90e68011fe1e6669cf30", "save_path": "github-repos/isabelle/chaosape-autocorresexperiments", "path": "github-repos/isabelle/chaosape-autocorresexperiments/autocorresexperiments-096f5ebbc56d10a785fe90e68011fe1e6669cf30/linked_list/Linked_List_Insert.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3359168565636752}}
{"text": "section \\<open>Prim's Algorithm\\<close>\ntheory Prim_Abstract\nimports \n  Main \n  Undirected_Graph_Impl\n  \"../../sepref/IICF/IICF\"\n  \"../../sepref/IICF/Impl/IICF_Array_of_Array_List\"\n  \"../../sepref/IICF/Impl/Heaps/IICF_Impl_Heapmap\"\nbegin\n  (* TODO: Move! *)\n  definition \"combf X f\\<^sub>1 f\\<^sub>2 x \\<equiv> if x\\<in>X then f\\<^sub>1 x else f\\<^sub>2 x\"\n  \n  lemma combf_left[simp]: \"x\\<in>X \\<Longrightarrow> combf X f\\<^sub>1 f\\<^sub>2 x = f\\<^sub>1 x\" by (auto simp: combf_def)\n  lemma combf_right[simp]: \"x\\<notin>X \\<Longrightarrow> combf X f\\<^sub>1 f\\<^sub>2 x = f\\<^sub>2 x\" by (auto simp: combf_def)\n  \n  lemma combf_empty[simp]: \"combf {} f\\<^sub>1 f\\<^sub>2 = f\\<^sub>2\" by (auto simp: combf_def)\n  lemma combf_insert[simp]: \"combf (insert x X) f\\<^sub>1 f\\<^sub>2 = (combf X f\\<^sub>1 f\\<^sub>2)(x:=f\\<^sub>1 x)\"\n    by (auto simp: combf_def)\n  \n  lemma fun_upd_idem_iff': \"f = f(x:=y) \\<longleftrightarrow> f x = y\"\n    using fun_upd_idem_iff by fastforce\n    \n  lemma f_upd_same_eq_iff[simp]: \"f(x:=y) = f(x:=y') \\<longleftrightarrow> y=y'\" by (auto simp: fun_eq_iff)\n  lemma ins_eq_set_memD:  \"insert x S = S' \\<Longrightarrow> x\\<in>S'\" by blast\n\n\ntext \\<open>Restructuring refinement of a while loop: The concrete \n  loop does an initial iteration, which is invisible on the abstract level.\n\n  This restructuring naturally arises in our refinement of Prim's algorithm.\n\\<close>\nlemma WHILEIT_add_init_step:\n  assumes [simp]: \"cb cs\" \n  assumes [refine]: \"cf cs \\<le> SPEC (\\<lambda>c. (c, as) \\<in> R)\"\n  assumes [simp]: \"\\<And>s s'. \\<lbrakk>(s, s') \\<in> R; I s'\\<rbrakk> \\<Longrightarrow> cb s = ab s'\"\n  assumes [simp]: \"\\<And>s s'. \\<lbrakk>(s, s') \\<in> R; cb s; ab s'; I s'\\<rbrakk> \\<Longrightarrow> cf s \\<le> \\<Down> R (af s')\"\n  shows \"WHILET cb cf cs \\<le>\\<Down>R (WHILEIT I ab af as)\" (is \"?C \\<le>\\<Down>_ ?A\")\nproof -\n  have \"?C = do { s \\<leftarrow> cf cs; WHILET cb cf s }\"\n    by (rewrite in \"\\<hole>=_\" WHILET_unfold) simp\n  also have \"\\<dots> \\<le>\\<Down>R (do { s \\<leftarrow> RETURN as; WHILEIT I ab af s})\" (is \"_ \\<le> \\<Down>_ \\<dots>\") \n    by refine_rcg simp_all\n  also have \"\\<dots> = ?A\" by simp\n  finally show ?thesis .\nqed\n  \n  \n\n\n\ndeclare [[coercion_enabled = false]]\n\nsubsection \\<open>Miscellaneous\\<close>\n\nlemma least_antimono: \"X\\<noteq>{} \\<Longrightarrow> X\\<subseteq>Y \\<Longrightarrow> (LEAST y::_::wellorder. y\\<in>Y) \\<le> (LEAST x. x\\<in>X)\"\n  by (metis LeastI_ex Least_le equals0I rev_subsetD)\n\nlemma map_add_apply: \"(m\\<^sub>1 ++ m\\<^sub>2) k = (case m\\<^sub>2 k of None \\<Rightarrow> m\\<^sub>1 k | Some x \\<Rightarrow> Some x)\"\n  by (auto simp: map_add_def)\n\nlemma Inf_in:\n  fixes A :: \"'a::{linorder,complete_lattice} set\"\n  assumes \"finite A\" \"A\\<noteq>{}\" \n  shows \"Inf A \\<in> A\" \n  using assms \n  proof (induction A rule: finite_induct)\n    case empty\n    then show ?case by simp\n  next\n    have [simp]: \"inf a b = (if a\\<le>b then a else b)\" for a b :: 'a\n      by (meson inf_absorb2 le_iff_inf linear)\n  \n    case (insert x F)\n    show ?case proof cases\n      assume \"F={}\" thus ?thesis by auto\n    next\n      assume \"F\\<noteq>{}\"\n      with insert.IH have \"Inf F \\<in> F\" .\n      then show ?thesis\n        using le_less_linear[of x \"Inf F\"]\n        by auto \n    \n  qed\nqed  \n  \nlemma finite_inf_linorder_ne_ex:\n  fixes f :: \"_ \\<Rightarrow> _::{complete_lattice,linorder}\"\n  assumes \"finite S\"\n  assumes \"S\\<noteq>{}\"\n  shows \"\\<exists>x\\<in>S. (INF x:S. f x) = f x\"\n  using assms\n  by (meson Inf_in finite_imageI imageE image_is_empty)\n  \n  \n\nlemma finite_linorder_eq_INF_conv: \"finite S \n  \\<Longrightarrow> a = (INF x:S. f x) \\<longleftrightarrow> (if S={} then a=top else \\<exists>x\\<in>S. a=f x \\<and> (\\<forall>y\\<in>S. a \\<le> f y))\"\n  for a :: \"_::{complete_lattice,linorder}\"\n  by (auto \n    simp: INF_greatest INF_lower  \n    intro: finite_inf_linorder_ne_ex antisym)\n  \n\nsubsection \\<open>Graph Theory for Prim\\<close>  \n  \n  definition \"is_subset_MST w g A \\<equiv> \\<exists>t. is_MST w g t \\<and> A \\<subseteq> edges t\"  \n  \n  lemma is_subset_MST_empty[simp]: \"connected g \\<Longrightarrow> is_subset_MST w g {}\"\n    using exists_MST unfolding is_subset_MST_def by blast\n  \n    \nsubsection \\<open>Generic Algorithm: Light Edges\\<close>  \ntext \\<open>We fix a start node and a weighted graph\\<close>\nlocale Prim =\n  fixes w :: \"'v set \\<Rightarrow> nat\" and g :: \"'v ugraph\" and r :: 'v\nbegin\n  text \\<open>Reachable part of the graph\\<close>\n  definition \"rg \\<equiv> component_of g r\"\n\n  lemma reachable_connected[simp, intro!]: \"connected rg\" unfolding rg_def by auto\n  lemma reachable_edges_subset: \"edges rg \\<subseteq> edges g\" unfolding rg_def by (rule component_edges_subset)\n\n\n  definition \"light_edge C A u v \n    \\<equiv>   A \\<subseteq> C\\<times>C \n      \\<and> u\\<in>C \\<and> v\\<notin>C \\<and> (u,v)\\<in>edges rg \n      \\<and> (\\<forall>(u',v')\\<in>edges rg \\<inter> C\\<times>-C. w {u,v} \\<le> w {u',v'})\"  \n    \n  lemma light_edge_is_safe:\n    fixes A :: \"('v\\<times>'v) set\" and S :: \"'v set\"\n    assumes subset_MST: \"is_subset_MST w rg A\"\n    assumes light_edge: \"light_edge S A u v\"\n    shows \"is_subset_MST w rg ({(v,u)} \\<union> A)\"\n  proof -\n    have  respects_cut: \"A \\<subseteq> S\\<times>S\"\n      and crossing_edge: \"u\\<in>S\" \"v\\<notin>S\" \"(u,v)\\<in>edges rg\"\n      and min_edge: \"\\<forall>(u',v')\\<in>edges rg \\<inter> S\\<times>-S. w {u,v} \\<le> w {u',v'}\"\n      using light_edge unfolding light_edge_def by auto\n  \n    from subset_MST obtain T where T: \"is_MST w rg T\" \"A \\<subseteq> edges T\" unfolding is_subset_MST_def by auto\n    hence \"tree T\" \"edges T \\<subseteq> edges rg\" \"nodes T = nodes rg\" by(simp_all add: is_MST_def is_spanning_tree_def)\n    hence \"connected T\" by(simp_all add: tree_def)\n    show ?thesis\n    proof cases\n      assume \"(u,v) \\<in> edges T\"\n      thus ?thesis unfolding is_subset_MST_def using T by (auto simp: edges_sym')\n    next\n      assume \"(u,v) \\<notin> edges T\" hence \"(v,u)\\<notin>edges T\" by (auto simp: edges_sym')\n      from \\<open>(u,v)\\<in>edges rg\\<close> obtain p where p: \"path T u p v\" \"simple p\"\n        by (metis connectedD \\<open>connected T\\<close> \\<open>nodes T = nodes rg\\<close> nodesI rtrancl_edges_iff_path simplify_pathE)\n        \n      have [simp]: \"u\\<noteq>v\" using crossing_edge by blast\n        \n      from find_crossing_edge_on_path[OF p(1), where P=\"\\<lambda>x. x\\<notin>S\"] crossing_edge(1,2)\n      obtain x y p1 p2 where xy: \"(x,y) \\<in> set p\" \"x \\<in> S\" \"y \\<notin> S\"\n        and ux: \"path (restrict_edges T (-{(x,y),(y,x)})) u p1 x\" \n        and yv: \"path (restrict_edges T (-{(x,y),(y,x)})) y p2 v\"\n        using path_change[OF crossing_edge(1,2) p] by blast\n      have \"(x,y) \\<in> edges T\" \n        by (meson contra_subsetD p(1) path_edges xy(1))\n\n      let ?E' = \"edges T - {(x,y),(y,x)}\"\n        \n      from split_tree[OF \\<open>tree T\\<close> \\<open>(x,y)\\<in>edges T\\<close>]\n        obtain T1 T2 where T12: \n          \"tree T1\" \"tree T2\" \n          and \"nodes T1 \\<inter> nodes T2 = {}\" \n          and \"nodes T = nodes T1 \\<union> nodes T2\"\n          and \"edges T1 \\<union> edges T2 = ?E'\"\n          and \"nodes T1 = { u . (x,u)\\<in>?E'\\<^sup>*}\"\n          and \"nodes T2 = { u . (y,u)\\<in>?E'\\<^sup>*}\"\n          and \"x\\<in>nodes T1\" \"y\\<in>nodes T2\" .\n      \n      let ?T' = \"ins_edge (u,v) (graph_join T1 T2)\"    \n\n      have \"is_spanning_tree rg ?T'\" proof -\n        \n        have E'_sym: \"sym (?E'\\<^sup>*)\" \n          by (meson edgesT_diff_sng_inv_eq sym_conv_converse_eq sym_rtrancl)\n        \n        have \"u\\<in>nodes T1\" \n          unfolding \\<open>nodes T1 = _\\<close>\n          using path_rtrancl_edgesD[OF ux] by (auto dest: symD[OF E'_sym])\n          \n        have \"v\\<in>nodes T2\" \n          unfolding \\<open>nodes T2 = _\\<close>\n          using path_rtrancl_edgesD[OF yv] by auto\n                \n        have \"tree ?T'\" by (rule join_trees) fact+\n  \n        show \"is_spanning_tree rg ?T'\"\n          unfolding is_spanning_tree_def\n          using \\<open>nodes T = nodes rg\\<close> \\<open>nodes T = nodes T1 \\<union> nodes T2\\<close>[symmetric] \\<open>tree ?T'\\<close> \\<open>u\\<noteq>v\\<close>\n          using \\<open>edges T \\<subseteq> edges rg\\<close> \\<open>edges T1 \\<union> edges T2 = ?E'\\<close>\n          apply simp\n          by (metis Diff_subset crossing_edge(3) edges_sym' insert_absorb nodesI(2) subset_trans)\n      qed\n      moreover \n        \n      have \"weight w ?T' \\<le> weight w T'\" if \"is_spanning_tree rg T'\" for T'\n      proof -\n        have ww: \"w {u,v} \\<le> w{x,y}\" \n          using min_edge \\<open>(x,y)\\<in>edges T\\<close> \\<open>edges T \\<subseteq> edges rg\\<close> \\<open>x\\<in>S\\<close> \\<open>y\\<notin>S\\<close>\n          by blast\n          \n        have \"weight w ?T' = weight w T - w {x,y} + w{u,v}\"\n          using \\<open>(u, v) \\<notin> edges T\\<close> \\<open>(x, y) \\<in> edges T\\<close> \\<open>edges T1 \\<union> edges T2 = edges T - {(x, y), (y, x)}\\<close> \\<open>u \\<noteq> v\\<close>\n          by (smt Diff_eq Diff_subset add.commute contra_subsetD edges_join edges_restrict_edges minus_inv_sym_aux sup.idem weight_cong weight_del_edge weight_ins_edge)\n        also have \"\\<dots> \\<le> weight w T\" \n          using weight_ge_edge[OF \\<open>(x,y)\\<in>edges T\\<close>, of w] ww by auto\n        also have \"weight w T \\<le> weight w T'\" using T(1) \\<open>is_spanning_tree rg T'\\<close>\n          unfolding is_MST_def by simp\n        finally show ?thesis . \n      qed\n      ultimately have \"is_MST w rg ?T'\" using is_MST_def by blast\n      have \"{(u,v),(v,u)} \\<union> A \\<subseteq> edges ?T'\" using T(2) respects_cut xy(3) \\<open>edges T1 \\<union> edges T2 = ?E'\\<close>\n        by (auto)\n      with \\<open>is_MST w rg ?T'\\<close> show ?thesis unfolding is_subset_MST_def by force\n    qed\n  qed        \nend    \n   \nsubsection \\<open>Abstract Prim: Growing a Tree\\<close>\ncontext Prim begin \n  text \\<open>The current nodes\\<close> \n  definition \"S A \\<equiv> {r} \\<union> fst`A\"\n  \n  text \\<open>Refined invariant: Adds connectedness of \\<open>A\\<close>\\<close>\n  definition \"prim_invar1 A \\<equiv> is_subset_MST w rg A \\<and> (\\<forall>(u,v)\\<in>A. (v,r)\\<in>A\\<^sup>*)\"\n  \n  text \\<open>Measure: Number of nodes not in tree\\<close>\n  definition \"T_measure1 A = card (nodes rg - S A)\"\nend\n\ntext \\<open>We use a locale that fixes a state and assumes the invariant\\<close>\nlocale Prim_Invar1_loc = \n  Prim w g r for w g and r :: 'v +\n  fixes A :: \"('v\\<times>'v) set\"\n  assumes invar1: \"prim_invar1 A\"\nbegin  \n  lemma subset_MST: \"is_subset_MST w rg A\" using invar1 unfolding prim_invar1_def by auto\n  lemma A_connected: \"(u,v)\\<in>A \\<Longrightarrow> (v,r)\\<in>A\\<^sup>*\" using invar1 unfolding prim_invar1_def by auto\n\n  lemma S_alt_def: \"S A = {r} \\<union> fst`A \\<union> snd`A\" \n    apply auto\n    apply (auto simp: S_def rev_image_eqI)\n    by (metis A_connected Domain_fst Not_Domain_rtrancl)\n \n  lemma finite_rem_nodes[simp,intro!]: \"finite (nodes rg - S A)\" by auto\n  \n  lemma respects_cut: \"A \\<subseteq> S A \\<times> S A\"\n    unfolding S_alt_def\n    by (smt Range.RangeI Range_snd Un_iff fst_conv image_subset_iff mem_Sigma_iff subrelI sup_ge2)\n\n  lemma A_edges: \"A \\<subseteq> edges g\"  \n    using subset_MST\n    by (meson is_MST_def is_spanning_tree_def is_subset_MST_def reachable_edges_subset subset_eq)\n\n  lemma S_reachable: \"S A \\<subseteq> nodes rg\"  \n    unfolding S_def\n    by (smt DomainE Un_insert_left fst_eq_Domain insert_subset is_MST_def is_spanning_tree_def is_subset_MST_def nodesI(1) nodes_of_component reachable_nodes_refl rg_def subset_MST subset_iff sup_bot.left_neutral)\n    \n  lemma S_edge_reachable: \"\\<lbrakk>u\\<in>S A; (u,v)\\<in>edges g \\<rbrakk> \\<Longrightarrow> (u,v)\\<in>edges rg\"  \n    using S_reachable unfolding rg_def\n    using reachable_nodes_step'(2) by fastforce\n      \n  lemma edges_S_rg_edges: \"edges g \\<inter> S A\\<times>-S A = edges rg \\<inter> S A\\<times>-S A\"\n    using S_edge_reachable reachable_edges_subset by auto\n        \n  lemma T_measure1_less: \"T_measure1 A < card (nodes rg)\"\n    unfolding T_measure1_def S_def\n    by (metis Diff_subset S_def S_reachable Un_insert_left le_supE nodes_finite psubsetI psubset_card_mono singletonI subset_Diff_insert)\n\n\n  lemma finite_A[simp, intro!]: \"finite A\"\n    using A_edges finite_subset by auto\n  \n  lemma finite_S[simp, intro!]: \"finite (S A)\" \n    using S_reachable rev_finite_subset by blast\n  \n  (* TODO: Used? *)\n  lemma S_A_consistent[simp, intro!]: \"nodes_edges_consistent (S A) (A\\<union>A\\<inverse>)\"\n    unfolding nodes_edges_consistent_def\n    apply (intro conjI)\n    subgoal by simp\n    subgoal using A_edges irrefl_def by fastforce\n    subgoal by (simp add: sym_Un_converse)\n    using respects_cut by auto\n    \n      \nend\n\ncontext Prim begin\n\n  lemma invar1_initial: \"prim_invar1 {}\"\n    apply (auto simp: is_subset_MST_def prim_invar1_def)\n    by (simp add: Prim.reachable_connected exists_MST)\n\n  lemma maintain_invar1:\n    assumes invar: \"prim_invar1 A\"\n    assumes light_edge: \"light_edge (S A) A u v\"\n    shows \"prim_invar1 ({(v,u)}\\<union>A) \n         \\<and> T_measure1 ({(v,u)}\\<union>A) < T_measure1 A\" (is \"?G1 \\<and> ?G2\")\n  proof\n\n    from invar interpret Prim_Invar1_loc w g r A by unfold_locales\n\n    from light_edge have \"u\\<in>S A\" \"v\\<notin>S A\" by (simp_all add: light_edge_def)\n        \n    show ?G1\n      unfolding prim_invar1_def\n    proof (intro conjI)\n      show \"is_subset_MST w rg ({(v, u)} \\<union> A)\"\n        by (rule light_edge_is_safe[OF subset_MST light_edge])\n        \n    next\n      show \"\\<forall>(ua, va)\\<in>{(v, u)} \\<union> A. (va, r) \\<in> ({(v, u)} \\<union> A)\\<^sup>*\"\n        apply safe\n        using A_connected      \n        apply (auto simp: rtrancl_insert)\n        apply (metis DomainE S_def converse_rtrancl_into_rtrancl \\<open>u\\<in>S A\\<close> fst_eq_Domain insertE insert_is_Un rtrancl_eq_or_trancl)\n        by (metis DomainE Domain_fst S_def converse_rtrancl_into_rtrancl \\<open>u\\<in>S A\\<close> insertE insert_is_Un rtrancl.rtrancl_refl)\n    qed\n    then interpret N: Prim_Invar1_loc w g r \"{(v,u)}\\<union>A\" by unfold_locales\n    \n    have \"S A \\<subset> S ({(v,u)}\\<union>A)\" using \\<open>v\\<notin>S A\\<close>\n      unfolding S_def by auto\n    then show \"?G2\" unfolding T_measure1_def\n      using S_reachable N.S_reachable\n      by (auto intro!: psubset_card_mono)\n  \n  qed  \n\n  lemma invar1_finish:\n    assumes INV: \"prim_invar1 A\"\n    assumes FIN: \"edges g \\<inter> S A\\<times>-S A = {}\"\n    shows \"is_MST w rg (graph {r} A)\"\n  proof -\n    from INV interpret Prim_Invar1_loc w g r A by unfold_locales\n\n    from subset_MST obtain t where MST: \"is_MST w rg t\" and \"A \\<subseteq> edges t\"\n      unfolding is_subset_MST_def by auto\n    \n    have \"S A = nodes t\"\n    proof safe\n      fix u\n      show \"u\\<in>S A \\<Longrightarrow> u\\<in>nodes t\" using MST\n        unfolding is_MST_def is_spanning_tree_def\n        using S_reachable by auto\n    next\n      fix u\n      assume \"u\\<in>nodes t\"\n      hence \"u\\<in>nodes rg\"\n        using MST is_MST_def is_spanning_tree_def by force\n      hence 1: \"(u,r)\\<in>(edges rg)\\<^sup>*\" by (simp add: connectedD rg_def)\n      have \"r\\<in>S A\" by (simp add: S_def)\n      show \"u\\<in>S A\" proof (rule ccontr)\n        assume \"u\\<notin>S A\"\n        from find_crossing_edge_rtrancl[where P=\"\\<lambda>u. u\\<in>S A\", OF 1 \\<open>u\\<notin>S A\\<close> \\<open>r\\<in>S A\\<close>] \n          FIN reachable_edges_subset \n        show False\n          by (smt ComplI IntI contra_subsetD edges_sym' emptyE mem_Sigma_iff)\n          \n      qed\n    qed\n    also have \"nodes t = nodes rg\" \n      using MST unfolding is_MST_def is_spanning_tree_def\n      by auto\n    finally have S_eq: \"S A = nodes rg\" .\n    \n    define t' where \"t' = graph {r} A\"\n    \n    have [simp]: \"nodes t' = S A\" and Et': \"edges t' = (A\\<union>A\\<inverse>)\" unfolding t'_def \n      using A_edges\n      by (auto simp: graph_accs S_alt_def)\n    \n    hence \"edges t' \\<subseteq> edges t\"\n      by (smt UnE \\<open>A \\<subseteq> edges t\\<close> converseD edges_sym' subrelI subset_eq)\n    \n    have \"is_spanning_tree rg t'\"\n    proof -\n      have \"connected t'\"  \n        apply rule\n        apply (auto simp: Et' S_def)\n        apply (simp add: A_connected converse_rtrancl_into_rtrancl in_rtrancl_UnI rtrancl_converse)+\n        apply (meson A_connected in_rtrancl_UnI r_into_rtrancl rtrancl_converseI rtrancl_trans)+\n        done\n    \n      moreover have \"cycle_free t'\"\n        by (meson MST \\<open>edges t' \\<subseteq> edges t\\<close> cycle_free_antimono is_MST_def \n                  is_spanning_tree_def tree_def)      \n      moreover have \"edges t' \\<subseteq> edges rg\"\n        by (meson MST \\<open>edges t' \\<subseteq> edges t\\<close> dual_order.trans is_MST_def is_spanning_tree_def)\n      ultimately show ?thesis\n        unfolding is_spanning_tree_def tree_def\n        by (auto simp: S_eq)\n    qed                              \n    then show ?thesis\n      using MST weight_mono[OF \\<open>edges t' \\<subseteq> edges t\\<close>]\n      unfolding t'_def is_MST_def \n      using dual_order.trans by blast\n  qed    \n\n  \n  definition \"prim1 \\<equiv> do {\n    let A={};\n    A \\<leftarrow> WHILEIT prim_invar1 (\\<lambda>A. edges g \\<inter> S A\\<times>-S A \\<noteq> {}) (\\<lambda>A. do {\n      (u,v) \\<leftarrow> SPEC (\\<lambda>(u,v). light_edge (S A) A u v);\n      RETURN (insert (v,u) A)\n    }) A;\n    RETURN A\n  }\"\n  \n  lemma prim1_correct: \"prim1 \\<le> SPEC (\\<lambda>A. is_MST w rg (graph {r} A))\"\n    unfolding prim1_def\n    apply (refine_vcg WHILEIT_rule[where R=\"measure T_measure1\"])\n    using maintain_invar1\n    by (clarsimp_all simp: invar1_initial invar1_finish)\n  \n        \nend\n\nsubsection \\<open>Prim: Using a Priority Queue\\<close>\ntext \\<open>We define a new locale. Note that we could also reuse @{locale Prim}, however,\n  this would complicate referencing the constants later in the theories from \n  which we generate the paper.\n\\<close>\nlocale Prim2 = Prim w g r for w :: \"'v set \\<Rightarrow> nat\" and g :: \"'v ugraph\" and r :: 'v\nbegin  \n  text \\<open>Abstraction to edge set\\<close>\n  \n  definition \"A Q \\<pi> \\<equiv> {(u,v). \\<pi> u = Some v \\<and> Q u = \\<infinity>}\"\n  \n  text \\<open>Initialization\\<close>\n  definition initQ :: \"'v \\<Rightarrow> enat\"  where \"initQ \\<equiv> (\\<lambda>_. \\<infinity>)(r := 0)\"\n  definition init\\<pi> :: \"'v \\<Rightarrow> 'v option\" where \"init\\<pi> \\<equiv> Map.empty\"  \n\n\n  text \\<open>Step\\<close>  \n  definition \"upd_cond Q \\<pi> u v \\<equiv> \n      (v,u) \\<in> edges g \n    \\<and> v\\<noteq>r  \n    \\<and> enat (w {v,u}) < Q v\n    \\<and> (Q v = \\<infinity> \\<longrightarrow> \\<pi> v = None)\n    \"\n    \n  lemma upd_cond_alt: \"upd_cond Q \\<pi> u v' \\<longleftrightarrow> \n    (v',u) \\<in> edges g \\<and> v'\\<notin>S (A Q \\<pi>) \\<and> enat (w {v',u}) < Q v'\" \n    unfolding upd_cond_def S_def A_def\n    by (auto simp: fst_eq_Domain)\n    \n    \n  text \\<open>State after inner loop\\<close>  \n  definition \"Qinter Q \\<pi> u v' = (if upd_cond Q \\<pi> u v' then enat (w {v',u}) else Q v')\"\n\n  text \\<open>State after one step\\<close>  \n  definition \"Q' Q \\<pi> u \\<equiv> (Qinter Q \\<pi> u)(u:=\\<infinity>)\"\n  definition \"\\<pi>' Q \\<pi> u v' = (if upd_cond Q \\<pi> u v' then Some u else \\<pi> v')\"\n\n  definition \"prim_invar2_init Q \\<pi> \\<equiv> Q=initQ \\<and> \\<pi>=init\\<pi>\"\n  \n  definition \"prim_invar2_ctd Q \\<pi> \\<equiv> let A = A Q \\<pi>; S = S A in\n    prim_invar1 A \\<^cancel>\\<open>TODO: Remove this, once refinement is sorted out! \\<close>\n  \\<and> \\<pi> r = None \\<and> Q r = \\<infinity>  \n  \\<and> (\\<forall>(u,v)\\<in>edges rg \\<inter> (-S)\\<times>S. Q u \\<noteq> \\<infinity>)\n  \\<and> (\\<forall>u. Q u \\<noteq> \\<infinity> \\<longrightarrow> \\<pi> u \\<noteq> None)\n  \\<and> (\\<forall>u v. \\<pi> u = Some v \\<longrightarrow> v\\<in>S \\<and> (u,v)\\<in>edges rg)\n  \\<and> (\\<forall>u v d. Q u = enat d \\<and> \\<pi> u = Some v \\<longrightarrow> d=w {u,v} \\<and> (\\<forall>v'\\<in>S. (u,v')\\<in>edges rg \\<longrightarrow> d \\<le> w {u,v'}))  \n  \"\n  \n  lemma prim_invar2_ctd_alt_aux1: \"\\<lbrakk>Q u \\<noteq> \\<infinity>; u\\<noteq>r\\<rbrakk> \\<Longrightarrow> u\\<notin>S (A Q \\<pi>)\"\n    unfolding S_def A_def\n    by auto\n  \n  lemma prim_invar2_ctd_alt: \"prim_invar2_ctd Q \\<pi> \\<longleftrightarrow> (\n    let A = A Q \\<pi>; S = S A; cE=edges rg \\<inter> (-S)\\<times>S in\n      prim_invar1 A\n    \\<and> \\<pi> r = None \\<and> Q r = \\<infinity>  \n    \\<and> (\\<forall>(u,v)\\<in>cE. Q u \\<noteq> \\<infinity>)\n    \\<and> (\\<forall>u v. \\<pi> u = Some v \\<longrightarrow> v\\<in>S \\<and> (u,v)\\<in>edges rg)\n    \\<and> (\\<forall>u d. Q u = enat d \\<longrightarrow> (\\<exists>v. \\<pi> u = Some v \\<and> d=w {u,v} \\<and> (\\<forall>v'. (u,v')\\<in>cE \\<longrightarrow> d \\<le> w {u,v'})))\n  )\"\n    unfolding prim_invar2_ctd_def Let_def\n    using prim_invar2_ctd_alt_aux1[of Q _ \\<pi>]\n    apply (auto 0 3)\n    by (metis (no_types,lifting) option.simps(3))\n    \n  \n  definition \"prim_invar2 Q \\<pi> \\<equiv> prim_invar2_init Q \\<pi> \\<or> prim_invar2_ctd Q \\<pi>\"\n    \n  definition \"T_measure2 Q \\<pi> \\<equiv> if Q r = \\<infinity> then T_measure1 (A Q \\<pi>) else card (nodes rg)\"\n  \n  \n  lemma Q'_init_eq: \"Q' initQ init\\<pi> r = (\\<lambda>u. if (u,r)\\<in>edges rg then enat (w {u,r}) else \\<infinity>)\"\n    apply (rule ext) \n    using reachable_edges_subset\n    apply (auto simp: Q'_def Qinter_def upd_cond_def initQ_def init\\<pi>_def)\n    by (simp add: Prim.rg_def edges_sym' reachable_nodes_step'(2))\n\n  lemma \\<pi>'_init_eq: \"\\<pi>' initQ init\\<pi> r = (\\<lambda>u. if (u,r)\\<in>edges rg then Some r else None)\"  \n    apply (rule ext) \n    using reachable_edges_subset\n    apply (auto simp: \\<pi>'_def upd_cond_def initQ_def init\\<pi>_def)\n    by (simp add: Prim.rg_def edges_sym' reachable_nodes_step'(2))\n  \n  lemma A_init_eq: \"A initQ init\\<pi> = {}\"  \n    unfolding A_def init\\<pi>_def \n    by auto\n\n  lemma S_empty: \"S {} = {r}\" unfolding S_def by (auto simp: A_init_eq)\n        \n  lemma maintain_invar2_first_step: \n    assumes INV: \"prim_invar2_init Q \\<pi>\"\n    assumes UNS: \"Q u = enat d\"\n    shows \"prim_invar2_ctd (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u)\" (is ?G1)\n      and \"T_measure2 (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u) < T_measure2 Q \\<pi>\" (is ?G2)\n  proof -\n    from INV have [simp]: \"Q=initQ\" \"\\<pi>=init\\<pi>\"\n      unfolding prim_invar2_init_def by auto\n    from UNS have [simp]: \"u=r\" by (auto simp: initQ_def split: if_splits) \n      \n      \n    note Q'_init_eq \\<pi>'_init_eq A_init_eq \n      \n    have [simp]: \"(A (Q' initQ init\\<pi> r) (\\<pi>' initQ init\\<pi> r)) = {}\"\n      apply (auto simp: Q'_init_eq \\<pi>'_init_eq)\n      apply (auto simp: A_def split: if_splits)\n      done\n    \n    show ?G1\n      apply (auto simp: prim_invar2_ctd_def Let_def invar1_initial)\n      apply (simp_all add: Q'_init_eq \\<pi>'_init_eq S_empty split: if_splits)\n      done\n      \n    have [simp]: \"Q' initQ init\\<pi> r r = \\<infinity>\"  \n      by (auto simp: Q'_init_eq)\n      \n    have [simp]: \"initQ r = 0\" by (simp add: initQ_def) \n      \n    show ?G2  \n      unfolding T_measure2_def \n      apply simp\n      apply (simp add: T_measure1_def S_empty)\n      by (metis card_Diff1_less nodes_finite nodes_of_component reachable_nodes_refl rg_def)\n    \n  qed    \n    \n  lemma maintain_invar2_first_step_presentation: \n    assumes INV: \"prim_invar2_init Q \\<pi>\"\n    assumes UNS: \"Q u = enat d\"\n    shows \"prim_invar2_ctd (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u)\n         \\<and> T_measure2 (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u) < T_measure2 Q \\<pi>\"\n    using maintain_invar2_first_step assms by blast\n  \n    \nend\n\n(*<*)\n(*\n  This locale is only used to present the invariant in the paper.\n*)\nlocale Prim_Invar2_ctd_Presentation_Loc =\n  fixes w g and r :: 'v and Q \\<pi> A S rg cE\n  assumes I: \"Prim2.prim_invar2_ctd w g r Q \\<pi>\"\n  defines local_A_def: \"A \\<equiv> Prim2.A Q \\<pi>\"\n  defines local_S_def: \"S \\<equiv> Prim.S r A\"\n  defines local_rg_def: \"rg \\<equiv> Prim.rg g r\"\n  defines local_cE_def: \"cE \\<equiv> edges rg \\<inter> (-S)\\<times>S\"\nbegin  \n    \n  lemma \n        invar1: \"Prim.prim_invar1 w g r A\" (is ?G1)\n    and root_contained: \"\\<pi> r = None \\<and> Q r = \\<infinity>\" (is ?G2)\n    and Q_defined: \"\\<forall>(u,v)\\<in>cE. Q u \\<noteq> \\<infinity>\" (is ?G3)\n    and \\<pi>_edges: \"\\<forall>u v. \\<pi> u = Some v \\<longrightarrow> v\\<in>S \\<and> (u,v)\\<in>edges rg\" (is ?G4)\n    and Q_min: \"\\<forall>u d. Q u = enat d \\<longrightarrow> (\\<exists>v. \\<pi> u = Some v \\<and> d=w {u,v} \\<and> (\\<forall>v'. (u,v')\\<in>cE \\<longrightarrow> d \\<le> w {u,v'}))\" (is ?G5)\n  proof -\n    interpret Prim2 w g r .\n    \n    show ?G1 ?G2 ?G3 ?G4 ?G5\n      using I\n      unfolding local_A_def local_S_def local_rg_def local_cE_def prim_invar2_ctd_alt Let_def\n      by simp_all\n  qed    \nend\n\nlemma (in Prim2) Prim_Invar2_ctd_Presentation_Loc_eq:\n  \"Prim_Invar2_ctd_Presentation_Loc w g r Q \\<pi> \\<longleftrightarrow> prim_invar2_ctd Q \\<pi>\"\n  unfolding Prim_Invar2_ctd_Presentation_Loc_def ..\n\n(*>*)\n\ntext \\<open>Again, we define a locale to fix a state and assume the invariant\\<close> \nlocale Prim_Invar2_ctd_loc =   \n  Prim2 w g r for w g and r :: 'v +\n  fixes Q \\<pi>\n  assumes invar2: \"prim_invar2_ctd Q \\<pi>\"\nbegin\n\n  sublocale Prim_Invar1_loc w g r \"A Q \\<pi>\"\n    using invar2 unfolding prim_invar2_ctd_def\n    apply unfold_locales by (auto simp: Let_def)\n\n  lemma \\<pi>_root: \"\\<pi> r = None\"\n    and Q_root: \"Q r = \\<infinity>\" \n    and Q_defined: \"\\<lbrakk> (u,v)\\<in>edges rg; u\\<notin>S (A Q \\<pi>); v\\<in>S (A Q \\<pi>) \\<rbrakk> \\<Longrightarrow> Q u \\<noteq> \\<infinity>\"\n    and \\<pi>_defined: \"\\<lbrakk> Q u \\<noteq> \\<infinity> \\<rbrakk> \\<Longrightarrow> \\<pi> u \\<noteq> None\"\n    and frontier: \"\\<pi> u = Some v \\<Longrightarrow> v\\<in>S (A Q \\<pi>)\"\n    and edges: \"\\<pi> u = Some v \\<Longrightarrow> (u,v)\\<in>edges rg\"\n    and Q_\\<pi>_consistent: \"\\<lbrakk> Q u = enat d; \\<pi> u = Some v \\<rbrakk> \\<Longrightarrow> d = w {u,v}\" \n    and Q_min: \"Q u = enat d \\<Longrightarrow> (\\<forall>v'\\<in>S (A Q \\<pi>). (u,v')\\<in>edges rg \\<longrightarrow> d \\<le> w {u,v'})\"\n    using invar2 unfolding prim_invar2_ctd_def\n    apply (auto simp: Let_def)\n    done\n\n  lemma \\<pi>_def_on_S: \"u\\<in>S (A Q \\<pi>) \\<Longrightarrow> u\\<noteq>r \\<Longrightarrow> \\<pi> u \\<noteq> None\"\n    unfolding S_def\n    unfolding A_def\n    by auto \n    \n  lemma \\<pi>_def_on_edges_to_S: \"v\\<in>S (A Q \\<pi>) \\<Longrightarrow> u\\<noteq>r \\<Longrightarrow> (u,v)\\<in>edges rg \\<Longrightarrow> \\<pi> u \\<noteq> None\"\n    apply (cases \"u\\<in>S (A Q \\<pi>)\")\n    subgoal using \\<pi>_def_on_S by auto\n    subgoal by (simp add: Q_defined \\<pi>_defined)\n    done\n    \n  text \\<open>Refinement of loop condition\\<close>  \n  lemma Q_empty_iff_no_crossing_edges: \n    \"(Q = (\\<lambda>_. \\<infinity>)) \\<longleftrightarrow> (edges g \\<inter> S (A Q \\<pi>) \\<times> - S (A Q \\<pi>) = {})\" (is \"?LHS = ?RHS\") \n  proof \n    assume ?LHS thus ?RHS by auto (metis (full_types) Q_defined S_edge_reachable edges_sym')\n  next\n    assume \"?RHS\" thus ?LHS\n    proof (rule_tac ccontr; clarsimp simp: fun_eq_iff)\n      fix u d\n      assume UNS: \"Q u = enat d\"\n      let ?A = \"A Q \\<pi>\"\n      let ?S = \"S ?A\"\n    \n      from UNS obtain v where \n        S1[simp]: \"\\<pi> u = Some v\" \"d = w {u,v}\"\n        using \\<pi>_defined Q_\\<pi>_consistent \n        by blast\n              \n      have [simp]: \"u\\<noteq>r\" using \\<pi>_root using S1 by (auto simp del: S1)\n      \n      have \"v\\<in>?S\" using frontier[of u v] by auto\n      moreover have \"u\\<notin>?S\" unfolding S_def unfolding A_def using UNS by auto\n      moreover \n      note edges[OF S1(1), THEN edges_sym'] \n      hence \"(v,u)\\<in>edges g\" using reachable_edges_subset by blast \n      moreover assume \"edges g \\<inter> ?S \\<times> - ?S = {}\"\n      ultimately show False by blast\n    qed\n  qed\n    \n    \n  lemma Q_min_is_light:  \n    assumes UNS: \"Q u = enat d\"\n    assumes MIN: \"\\<forall>v. enat d \\<le> Q v\"\n    obtains v where \"\\<pi> u = Some v\" \"light_edge (S (A Q \\<pi>)) (A Q \\<pi>) v u\"\n  proof -\n    let ?A = \"A Q \\<pi>\"\n    let ?S = \"S ?A\"\n  \n    from UNS obtain v where \n      S1[simp]: \"\\<pi> u = Some v\" \"d = w {u,v}\"\n      using \\<pi>_defined Q_\\<pi>_consistent \n      by blast\n            \n    (*TODO: DUP with reasoning in thm Q_empty_iff_no_crossing_edges *)  \n      \n    have \"v\\<in>?S\" using frontier[of u v] by auto\n      \n    have [simp]: \"u\\<noteq>r\" using \\<pi>_root using S1 by (auto simp del: S1)\n    \n    have \"u\\<notin>?S\" unfolding S_def unfolding A_def using UNS by auto\n    \n    have \"(v,u)\\<in>edges rg\" using edges[OF S1(1)]\n      by (meson edges_sym' rev_subsetD)\n    \n    have M: \"\\<forall>(u', v')\\<in>edges rg \\<inter> ?S \\<times> - ?S. w {v, u} \\<le> w {u', v'}\"\n    proof safe\n      fix a b\n      assume \"(a,b)\\<in>edges rg\" \"a\\<in>?S\" \"b\\<notin>?S\"\n      hence \"(b,a)\\<in>edges rg\" by (simp add: edges_sym')\n    \n      from Q_defined[OF \\<open>(b,a)\\<in>edges rg\\<close> \\<open>b\\<notin>?S\\<close> \\<open>a\\<in>?S\\<close>] obtain d' where 1: \"Q b = enat d'\" by blast \n      with \\<pi>_defined obtain a' where \"\\<pi> b = Some a'\" by auto\n      from MIN 1 have \"d\\<le>d'\" by (metis enat_ord_simps(1))\n      also from Q_min[OF 1] \\<open>(b,a)\\<in>edges rg\\<close> \\<open>a\\<in>?S\\<close> have \"d'\\<le>w {b,a}\" by blast  \n      finally show \"w {v,u} \\<le> w {a,b}\" by (simp add: insert_commute)\n    qed  \n\n    have LE: \"light_edge ?S ?A v u\" using invar1 \\<open>v\\<in>?S\\<close> \\<open>u\\<notin>?S\\<close> \\<open>(v,u)\\<in>edges rg\\<close> M\n      unfolding light_edge_def\n      using respects_cut by blast\n    \n    thus ?thesis using that by auto\n  qed\n\n  lemma Q_min_light_edge':\n    assumes UNS: \"Q u = enat d\"\n    assumes MIN: \"\\<forall>v. enat d \\<le> Q v\"\n    shows \"\\<exists>v. light_edge (S (A Q \\<pi>)) (A Q \\<pi>) v u \\<and> A (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u) = {(u, v)} \\<union> A Q \\<pi>\"\n  proof -    \n    let ?A = \"A Q \\<pi>\"\n    let ?S = \"S ?A\"\n  \n    from Q_min_is_light[OF UNS MIN] obtain v where [simp]: \"\\<pi> u = Some v\" and LE: \"light_edge ?S ?A v u\" .\n    \n    let ?Q' = \"Q' Q \\<pi> u\"\n    let ?\\<pi>' = \"\\<pi>' Q \\<pi> u\"\n    let ?A' = \"A ?Q' ?\\<pi>'\"\n    \n    have NA: \"?A' = {(u,v)} \\<union> ?A\"\n      unfolding A_def  \n      unfolding Q'_def \\<pi>'_def upd_cond_def Qinter_def\n      by (auto split: if_splits)\n    \n    with LE show ?thesis by blast\n  qed\n          \n  lemma maintain_invar_ctd: \n    assumes UNS: \"Q u = enat d\"\n    assumes MIN: \"\\<forall>v. enat d \\<le> Q v\"\n    shows \"prim_invar2_ctd (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u)\" (is ?G1)\n      and \"T_measure2 (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u) < T_measure2 Q \\<pi>\" (is ?G2)\n  proof -\n    let ?A = \"A Q \\<pi>\"\n    let ?S = \"S ?A\"\n  \n    from Q_min_is_light[OF UNS MIN] obtain v where [simp]: \"\\<pi> u = Some v\" and LE: \"light_edge ?S ?A v u\" .\n\n    let ?Q' = \"Q' Q \\<pi> u\"\n    let ?\\<pi>' = \"\\<pi>' Q \\<pi> u\"\n    let ?A' = \"A ?Q' ?\\<pi>'\"\n    let ?S' = \"S ?A'\"\n    \n    have NA: \"?A' = {(u,v)} \\<union> ?A\"\n      unfolding A_def  \n      unfolding Q'_def \\<pi>'_def upd_cond_def Qinter_def\n      by (auto split: if_splits)\n    \n    from maintain_invar1[OF invar1 LE]\n    have \"prim_invar1 ?A'\" \"T_measure1 ?A' < T_measure1 ?A\" \n      by (auto simp: NA) \n    then interpret N: Prim_Invar1_loc w g r ?A' by unfold_locales\n                \n    have [simp]: \"?S' = insert u ?S\"\n      thm S_alt_def\n      unfolding S_def \n      unfolding Q'_def Qinter_def \\<pi>'_def upd_cond_def\n      unfolding A_def\n      by (auto split: if_splits simp: image_iff)\n      \n    show ?G1\n      unfolding prim_invar2_ctd_def Let_def  \n      apply safe\n      apply fact\n      subgoal \n        unfolding \\<pi>'_def upd_cond_def\n        by (auto simp: \\<pi>_root)\n      subgoal \n        by (simp add: Prim2.Q'_def Prim2.Qinter_def Prim2.upd_cond_def Q_root)\n      subgoal for a b\n        apply simp\n        apply auto\n        subgoal\n          apply (auto simp add: Q'_def Qinter_def upd_cond_def)\n          apply (auto simp: S_alt_def A_def)\n          subgoal using not_infinity_eq by fastforce\n          subgoal using reachable_edges_subset by blast\n          subgoal by (simp add: Prim.S_def)\n          subgoal by (metis (no_types) A_def Q_defined edges frontier)\n          done\n        subgoal\n          apply (auto simp: S_def A_def Q'_def Qinter_def upd_cond_def)\n          subgoal\n          proof -\n            assume a1: \"(a, r) \\<in> edges rg\"\n            assume \"a \\<notin> fst ` {(u, v). \\<pi> u = Some v \\<and> Q u = \\<infinity>}\"\n            then have \"a \\<notin> fst ` A Q \\<pi>\"\n              by (simp add: A_def)\n            then show ?thesis\n              using a1 by (metis (no_types) S_def Q_defined Un_insert_left edges_irrefl' insert_iff not_infinity_eq sup_bot.left_neutral)\n          qed \n          by (smt Domain.intros Q_defined \\<pi>_def_on_edges_to_S case_prod_conv edges enat.exhaust frontier fst_eq_Domain mem_Collect_eq option.exhaust) \n        done\n      subgoal \n        by (metis Q'_def Qinter_def \\<pi>'_def \\<pi>_defined enat.distinct(2) fun_upd_apply not_None_eq)\n        \n      subgoal\n        by (metis \\<open>S (A (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u)) = insert u (S (A Q \\<pi>))\\<close> \\<pi>'_def frontier insertCI option.inject)\n      subgoal\n        by (metis N.S_edge_reachable upd_cond_def \\<open>S (A (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u)) = insert u (S (A Q \\<pi>))\\<close> \\<pi>'_def edges edges_sym' insertI1 option.inject)\n      subgoal\n        by (smt Q'_def \\<pi>'_def Prim_Invar2_ctd_loc.Q_\\<pi>_consistent Prim_Invar2_ctd_loc_axioms Qinter_def fun_upd_apply insert_absorb not_enat_eq option.inject the_enat.simps)\n      subgoal for v' d'\n        apply auto unfolding Q'_def Qinter_def upd_cond_def\n        using Q_min\n        apply (auto split: if_splits simp: Q_root)\n        subgoal using reachable_edges_subset by auto\n        subgoal by (simp add: le_less less_le_trans)\n        subgoal using \\<pi>_def_on_edges_to_S by auto\n        done \n      done       \n    then interpret N: Prim_Invar2_ctd_loc w g r ?Q' ?\\<pi>' by unfold_locales\n\n    show ?G2  \n      unfolding T_measure2_def\n      apply (auto simp: Q_root N.Q_root) by fact\n      \n  qed      \n\nend\n\n  \ncontext Prim2 begin\n\n\n  lemma maintain_invar2_ctd: \n    assumes INV: \"prim_invar2_ctd Q \\<pi>\"\n    assumes UNS: \"Q u = enat d\"\n    assumes MIN: \"\\<forall>v. enat d \\<le> Q v\"\n    shows \"prim_invar2_ctd (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u)\" (is ?G1)\n      and \"T_measure2 (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u) < T_measure2 Q \\<pi>\" (is ?G2)\n  proof -\n    interpret Prim_Invar2_ctd_loc w g r Q \\<pi> using INV by unfold_locales\n    from maintain_invar_ctd[OF UNS MIN] show ?G1 ?G2 by auto\n  qed\n\n  lemma Q_min_is_light_presentation:  \n    assumes INV: \"prim_invar2_ctd Q \\<pi>\"\n    assumes UNS: \"Q u = enat d\"\n    assumes MIN: \"\\<forall>v. enat d \\<le> Q v\"\n    obtains v where \"\\<pi> u = Some v\" \"light_edge (S (A Q \\<pi>)) (A Q \\<pi>) v u\"\n  proof -\n    interpret Prim_Invar2_ctd_loc w g r Q \\<pi> using INV by unfold_locales\n    from Q_min_is_light[OF UNS MIN] show ?thesis using that .\n  qed\n  \n  lemma maintain_invar2_ctd_presentation: \n    assumes INV: \"prim_invar2_ctd Q \\<pi>\"\n    assumes UNS: \"Q u = enat d\"\n    assumes MIN: \"\\<forall>v. enat d \\<le> Q v\"\n    shows \"prim_invar2_ctd (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u)\n         \\<and> T_measure2 (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u) < T_measure2 Q \\<pi>\"\n    using maintain_invar2_ctd assms by blast\n  \n  \n\n  lemma maintain_invar2: \n    assumes A: \"prim_invar2 Q \\<pi>\"  \n    assumes UNS: \"Q u = enat d\"\n    assumes MIN: \"\\<forall>v. enat d \\<le> Q v\"\n    shows \"prim_invar2 (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u)\" (is ?G1)\n      and \"T_measure2 (Q' Q \\<pi> u) (\\<pi>' Q \\<pi> u) < T_measure2 Q \\<pi>\" (is ?G2)\n    using A unfolding prim_invar2_def\n    using maintain_invar2_first_step[of Q,OF _ UNS]\n    using maintain_invar2_ctd[OF _ UNS MIN]\n    using not_invar2_ctd_init\n    apply blast+\n    done\n\n  lemma invar2_ctd_finish:  \n    assumes INV: \"prim_invar2_ctd Q \\<pi>\"  \n    assumes FIN: \"Q = (\\<lambda>_. \\<infinity>)\"\n    shows \"is_MST w rg (graph {r} {(u, v). \\<pi> u = Some v})\"\n  proof -  \n    from INV interpret Prim_Invar2_ctd_loc w g r Q \\<pi> by unfold_locales\n  \n    let ?A = \"A Q \\<pi>\" let ?S=\"S ?A\"\n    \n    have FC: \"edges g \\<inter> ?S \\<times> - ?S = {}\" \n    proof (safe; simp)\n      fix a b\n      assume \"(a,b)\\<in>edges g\" \"a\\<in>?S\" \"b\\<notin>?S\"\n      with Q_defined[OF edges_sym'] S_edge_reachable have \"Q b \\<noteq> \\<infinity>\" \n        by blast\n      with FIN show False by auto\n    qed\n    \n    have Aeq: \"?A = {(u, v). \\<pi> u = Some v}\"\n      unfolding A_def using FIN by auto\n    \n    from invar1_finish[OF invar1 FC, unfolded Aeq] show ?thesis .\n  qed\n    \n    \n  lemma invar2_finish:  \n    assumes INV: \"prim_invar2 Q \\<pi>\"  \n    assumes FIN: \"Q = (\\<lambda>_. \\<infinity>)\"\n    shows \"is_MST w rg (graph {r} {(u, v). \\<pi> u = Some v})\"\n  proof -  \n    from INV have \"prim_invar2_ctd Q \\<pi>\"\n      unfolding prim_invar2_def prim_invar2_init_def initQ_def\n      by (auto simp: fun_eq_iff FIN split: if_splits)\n    with FIN invar2_ctd_finish show ?thesis by blast  \n  qed\n\n  \n  definition \"min_Q_spec Q \\<equiv> do {ASSERT (Q \\<noteq> (\\<lambda>_. \\<infinity>)); SPEC (\\<lambda>u. \\<exists>d. Q u = enat d \\<and> (\\<forall>v. enat d \\<le> Q v))}\"\n  definition \"upd_Q\\<pi>_spec u Q \\<pi> \\<equiv> (=) (Qinter Q \\<pi> u, \\<pi>' Q \\<pi> u)\"\n  \n  definition \"prim2 \\<equiv> WHILET \n    (\\<lambda>(Q,\\<pi>). Q \\<noteq> (\\<lambda>_. \\<infinity>)) \n    (\\<lambda>(Q,\\<pi>). do { \n      u \\<leftarrow> min_Q_spec Q; \n      (Q,\\<pi>) \\<leftarrow> SPEC (upd_Q\\<pi>_spec u Q \\<pi>);\n      ASSERT (Q u \\<noteq> \\<infinity>);\n      let Q = Q(u:=\\<infinity>);\n      RETURN (Q,\\<pi>) \n    })\n    (initQ,init\\<pi>)\n    \"\n  \n  definition \"p21_rel \\<equiv> br (uncurry A) (uncurry prim_invar2_ctd)\"\n  \n  lemma initQ_enat_iff[simp]: \"initQ x = enat d \\<longleftrightarrow> x=r \\<and> d=0\"\n    by (auto simp: initQ_def zero_enat_def)\n    \n  lemma A_one_step_after_init: \"A (Q' initQ init\\<pi> r) (\\<pi>' initQ init\\<pi> r) = {}\"  \n    unfolding A_def initQ_def init\\<pi>_def \\<pi>'_def Q'_def Qinter_def upd_cond_def\n    by auto\n    \n  \n  lemma Qinter_init_r_defined: \"Qinter initQ init\\<pi> r r \\<noteq> \\<infinity>\"  \n    by (auto simp: Qinter_def)\n    \n  lemma prim2_refine: \"prim2 \\<le>\\<Down>p21_rel prim1\"\n  proof -\n    have [simp]: \"initQ \\<noteq> (\\<lambda>_. \\<infinity>)\" by (auto simp: initQ_def fun_eq_iff zero_enat_def)\n  \n    show ?thesis\n      unfolding prim2_def prim1_def min_Q_spec_def upd_Q\\<pi>_spec_def\n      apply (simp add: Q'_def[symmetric])\n      apply (rule WHILEIT_add_init_step)\n      subgoal by (auto simp add: initQ_def fun_eq_iff zero_enat_def)\n      subgoal \n        apply refine_vcg \n        using Qinter_init_r_defined\n        apply (auto simp: p21_rel_def in_br_conv A_one_step_after_init\n          invar2_init_init maintain_invar2_first_step(1)) \n        done  \n      subgoal for s s'\n        apply (cases s; simp)\n        apply (clarsimp simp: p21_rel_def in_br_conv)\n        apply (blast dest: Prim_Invar2_ctd_loc.Q_empty_iff_no_crossing_edges[OF Prim_Invar2_ctd_loc.intro])\n        done\n      subgoal\n        apply (clarsimp simp: p21_rel_def in_br_conv pw_le_iff refine_pw_simps)\n        by (smt Prim2.Qinter_def Prim_Invar2_ctd_loc.Q_min_light_edge' Prim_Invar2_ctd_loc.intro Prim_Invar2_ctd_loc.maintain_invar_ctd(1) Un_insert_left sup_bot.left_neutral)\n      done\n  qed    \n  \n  \n  \n    \nend\n\n\nsubsection \\<open>Refinement of Inner Foreach Loop\\<close>\n\n\n\ncontext Prim2 begin\n\n\n  definition \"upd_Q\\<pi>_loop u Q \\<pi> \\<equiv> do {\n    adjs \\<leftarrow> mop_wgraph_adjs g w u;\n    nfoldli adjs (\\<lambda>_. True) (\\<lambda>(v,d) (Q,\\<pi>). do { \n      if v=r then RETURN (Q,\\<pi>)\n      else case (Q v, \\<pi> v) of\n        (\\<infinity>,None) \\<Rightarrow> RETURN (Q(v:=enat d), \\<pi>(v\\<mapsto>u))\n      | (enat d',_) \\<Rightarrow> if d<d' then RETURN (Q(v:=enat d), \\<pi>(v\\<mapsto>u)) else RETURN (Q,\\<pi>)\n      | (\\<infinity>,Some _) \\<Rightarrow> RETURN (Q,\\<pi>)\n    }) (Q,\\<pi>)\n  }\"\n  \n    \n  lemma Qinter_root[simp]: \"Qinter Q \\<pi> u r = Q r\" by (auto simp: Qinter_def upd_cond_def)\n  lemma \\<pi>'_root[simp]: \"\\<pi>' Q \\<pi> u r = \\<pi> r\" by (auto simp: \\<pi>'_def upd_cond_def)\n    \n        \n  lemma upd_Q\\<pi>_loop_refine_auxp[refine_vcg]: \"upd_Q\\<pi>_loop u Q \\<pi> \\<le> SPEC (upd_Q\\<pi>_spec u Q \\<pi>)\"\n    unfolding upd_Q\\<pi>_loop_def mop_wgraph_adjs_def\n    apply (refine_vcg nfoldli_rule[where \n      I=\"(\\<lambda>xs ys (Qh,\\<pi>h). \n        Qh = combf (fst`set xs) (Qinter Q \\<pi> u) Q    \n      \\<and> \\<pi>h = combf (fst`set xs) (\\<pi>' Q \\<pi> u) \\<pi>)\n      \"])\n    apply (clarsimp_all simp: fun_upd_idem_iff' combf_def split del: if_split)\n    subgoal by (auto)\n    subgoal by (auto)\n    subgoal for l1 l2 v d\n      by (auto\n        split!: enat.splits option.splits if_splits\n        dest!: ins_eq_set_memD \n        simp: fun_upd_idem_iff' img_fst\n        simp: Qinter_def \\<pi>'_def upd_cond_def insert_commute \n        intro: edges_sym'\n      )\n    subgoal for l  \n      by (auto simp: upd_Q\\<pi>_spec_def Qinter_def \\<pi>'_def fun_eq_iff combf_def upd_cond_def intro: edges_sym') \n    done\n\n  definition \"prim3 \\<equiv> WHILET \n    (\\<lambda>(Q,\\<pi>). Q \\<noteq> (\\<lambda>_. \\<infinity>)) \n    (\\<lambda>(Q,\\<pi>). do { \n      u \\<leftarrow> min_Q_spec Q; \n      (Q,\\<pi>) \\<leftarrow> upd_Q\\<pi>_loop u Q \\<pi>;\n      ASSERT (Q u \\<noteq> \\<infinity>);\n      let Q = Q(u:=\\<infinity>);\n      RETURN (Q,\\<pi>) \n    })\n    (initQ,init\\<pi>)\n    \"\n    \n  lemma prim3_refine: \"prim3 \\<le>\\<Down>Id prim2\"  \n    unfolding prim3_def prim2_def\n    apply (refine_vcg)\n    apply refine_dref_type\n    apply auto\n    done\n\n    \n  definition \"Qpm_rel \\<equiv> Id \\<rightarrow> br (\\<lambda>None\\<Rightarrow>\\<infinity> | Some d \\<Rightarrow> enat d) (\\<lambda>_. True)\"  \n\n  find_theorems FOREACH nfoldli\n  find_theorems LIST_FOREACH\n  \n\n  definition \"upd_Q\\<pi>_loop2 u Q \\<pi> \\<equiv> doN {\n    adjs \\<leftarrow> mop_wgraph_adjs g w u;\n    nfoldli adjs (\\<lambda>_. True) (\\<lambda>(v,d) (Q,\\<pi>). doN { \n      if v=r then RETURN (Q,\\<pi>)\n      else case (Q v, \\<pi> v) of\n        (None,None) \\<Rightarrow> RETURN (Q(v\\<mapsto>d), \\<pi>(v\\<mapsto>u))\n      | (Some d',_) \\<Rightarrow> if d<d' then RETURN (Q(v\\<mapsto>d), \\<pi>(v\\<mapsto>u)) else RETURN (Q,\\<pi>)\n      | (None,Some _) \\<Rightarrow> RETURN (Q,\\<pi>)\n    }) (Q,\\<pi>)\n  }\"\n\n  lemma Qpm_upd_refine: \"(Qi,Q)\\<in>Qpm_rel \\<Longrightarrow> (Qi(x\\<mapsto>d), Q(x:=enat d))\\<in>Qpm_rel\"\n    apply (clarsimp simp: Qpm_rel_def in_br_conv split: option.split)\n    subgoal for x\n      apply (drule fun_relD[OF _ IdI[of x]])\n      apply (auto simp: in_br_conv)\n      done\n    done\n    \n  lemma Qpm_None: \"(Qi,Q)\\<in>Qpm_rel \\<Longrightarrow> Qi x = None \\<longleftrightarrow> Q x = \\<infinity>\"  \n    by (auto simp: Qpm_rel_def in_br_conv dest: fun_relD[OF _ IdI[of x]] split: option.splits)\n  \n  lemma Qpm_Some: \"(Qi,Q)\\<in>Qpm_rel \\<Longrightarrow> Qi x = Some d \\<longleftrightarrow> Q x = enat d\"  \n    by (auto simp: Qpm_rel_def in_br_conv dest: fun_relD[OF _ IdI[of x]] split: option.splits)\n\n  lemma Qpm_empty: \"(Map.empty, Q) \\<in> Qpm_rel \\<Longrightarrow> Q=(\\<lambda>_. \\<infinity>)\"  \n    apply (clarsimp simp: fun_eq_iff Qpm_rel_def)\n    subgoal for x\n      by (auto simp: in_br_conv dest: fun_relD[OF _ IdI[of x]] split: option.splits)\n    done      \n    \n    \n  lemma upd_Q\\<pi>_loop2_refine[refine]: \"\\<lbrakk>(ui,u)\\<in>Id; (Qi,Q)\\<in>Qpm_rel; (\\<pi>i,\\<pi>)\\<in>Id\\<rbrakk> \n    \\<Longrightarrow> upd_Q\\<pi>_loop2 ui Qi \\<pi>i \\<le> \\<Down>(Qpm_rel\\<times>\\<^sub>rId) (upd_Q\\<pi>_loop u Q \\<pi>)\"\n    unfolding upd_Q\\<pi>_loop2_def upd_Q\\<pi>_loop_def\n    apply simp\n    apply refine_rcg\n    apply refine_dref_type\n    by (auto \n      split: enat.splits if_splits option.splits\n      simp: Qpm_None Qpm_Some\n      intro: Qpm_upd_refine)\n\n\n  definition \"prim4 \\<equiv> doN {\n    let Q = op_map_update r 0 op_map_empty;\n    WHILET \n      (\\<lambda>(Q,\\<pi>). \\<not>op_map_is_empty Q) \n      (\\<lambda>(Q,\\<pi>). doN { \n        (u,_) \\<leftarrow> mop_pm_peek_min id Q;\n        (Q,\\<pi>) \\<leftarrow> upd_Q\\<pi>_loop2 u Q \\<pi>;\n        Q \\<leftarrow> mop_map_delete_ex u Q;\n        RETURN (Q,\\<pi>) \n      })\n      (Q,op_map_empty)\n    }\n    \"\n\n  lemma peek_min_refine: \"(Qi,Q)\\<in>Qpm_rel \n    \\<Longrightarrow> mop_pm_peek_min id Qi \\<le> \\<Down> (br fst (\\<lambda>_. True)) (min_Q_spec Q)\"\n    apply (auto simp: min_Q_spec_def pw_le_iff refine_pw_simps in_br_conv Qpm_empty Qpm_Some)\n    by (metis enat_ile enat_ord_simps(1) linear)\n    \n  lemma Qpm_delete_refine: \"\\<lbrakk> (Qi,Q)\\<in>Qpm_rel; (ki,k)\\<in>Id; Q k \\<noteq> \\<infinity> \\<rbrakk> \\<Longrightarrow> mop_map_delete_ex ki Qi\n       \\<le> SPEC (\\<lambda>Qi'. (Qi', Q(k := \\<infinity>))\n                    \\<in> Qpm_rel)\"  \n    apply clarsimp                    \n    apply refine_vcg\n    subgoal by (simp add: Qpm_Some domIff) \n    apply (clarsimp simp: Qpm_rel_def in_br_conv split: option.split)\n    subgoal for _ x\n      apply (drule fun_relD[OF _ IdI[of x]])\n      by (auto simp: in_br_conv)\n    done\n    \n  lemma Qpm_init_refine: \"([r \\<mapsto> 0], initQ) \\<in> Qpm_rel\"  \n    by (auto simp: Qpm_rel_def in_br_conv initQ_def zero_enat_def)\n    \n  lemma Qpm_is_empty_refine: \"(Qi, Q) \\<in> Qpm_rel \n    \\<Longrightarrow> (Map.empty = Qi) = (Q = (\\<lambda>_. \\<infinity>))\"  \n    apply (clarsimp simp: Qpm_rel_def fun_eq_iff; safe)\n    subgoal for x by (auto dest!: fun_relD[OF _ IdI[of x]] simp: in_br_conv)\n    subgoal for x by (auto dest!: fun_relD[OF _ IdI[of x]] simp: in_br_conv split: option.splits)\n    done\n    \n  lemma prim4_refine: \"prim4 \\<le> \\<Down>(Qpm_rel\\<times>\\<^sub>rId) prim3\"  \n    unfolding prim4_def prim3_def\n    apply (refine_rcg peek_min_refine Qpm_delete_refine)\n    apply (auto simp: Qpm_init_refine init\\<pi>_def Qpm_is_empty_refine in_br_conv)\n    done\n    \nend\n\n\nlocale Prim5 = Prim2 w g r for w :: \"nat set \\<Rightarrow> nat\" and g r + \n  fixes g2 :: \"nat wugraph2\" \nbegin\n\n  definition \"N \\<equiv> wu2_max g2\"\n\n  (*definition \"upd_Q\\<pi>_loop3 u Q \\<pi> \\<equiv> doN {\n      num_adjs \\<leftarrow> wu2_adjs_len u g2;\n      nfoldli [0..<num_adjs] (\\<lambda>_. True)\n       (\\<lambda>i (Q, \\<pi>). doN {\n             vd \\<leftarrow> wu2_adjs_nth u i g2;\n             case vd of (v, d) \\<Rightarrow>\n               if v = r then RETURN (Q, \\<pi>)\n               else (case (op_map_lookup v Q, op_map_lookup v \\<pi>) of (None, None) \\<Rightarrow> RETURN (Q(v \\<mapsto> d), \\<pi>(v \\<mapsto> u))\n                    | (None, Some xa) \\<Rightarrow> RETURN (Q, \\<pi>)\n                    | (Some d', x) \\<Rightarrow> if d < d' then RETURN (Q(v \\<mapsto> d), \\<pi>(v \\<mapsto> u)) else RETURN (Q, \\<pi>))\n              \n           })\n       (Q, \\<pi>)\n    }\"*)\n\n  definition \"upd_Q\\<pi>_loop3 u Q \\<pi> \\<equiv> doN {\n      num_adjs \\<leftarrow> wu2_adjs_len u g2;\n      nfoldli [0..<num_adjs] (\\<lambda>_. True)\n       (\\<lambda>i (Q, \\<pi>). doN {\n            vd \\<leftarrow> wu2_adjs_nth u i g2;\n            case vd of (v, d) \\<Rightarrow>\n              if v = r then RETURN (Q, \\<pi>)\n              else doN {\n                ASSERT (v<N);\n                if op_map_contains_key v Q then\n                  if d < op_map_the_lookup v Q then RETURN (Q(v \\<mapsto> d), \\<pi>(v \\<mapsto> u)) else RETURN (Q, \\<pi>)\n                else\n                  if op_map_contains_key v \\<pi> then RETURN (Q,\\<pi>) else RETURN (Q(v \\<mapsto> d), \\<pi>(v \\<mapsto> u))\n            }\n          })\n       (Q, \\<pi>)\n    }\"\n    \n    \n    \n  definition \"prim5 \\<equiv> doN {\n    let Nn = wu2_max g2;\n    Q \\<leftarrow> HM.mop_hm_empty Nn;\n    ASSERT (r<N);\n    let Q = op_map_update r 0 Q;\n    \\<pi> \\<leftarrow> mop_am_custom_empty Nn;\n    WHILEIT (\\<lambda>(Q,\\<pi>). dom Q \\<subseteq> {0..<N})\n      (\\<lambda>(Q,\\<pi>). \\<not>op_map_is_empty Q) \n      (\\<lambda>(Q,\\<pi>). doN { \n        (u,_) \\<leftarrow> mop_pm_peek_min id Q;\n        (Q,\\<pi>) \\<leftarrow> upd_Q\\<pi>_loop3 u Q \\<pi>;\n        ASSERT (u<N);\n        Q \\<leftarrow> mop_map_delete_ex u Q;\n        RETURN (Q,\\<pi>) \n      })\n      (Q,\\<pi>)\n    }\n    \"\n\nend\n\nlocale Prim5_prf = Prim5 +    \n  assumes G_REL: \"(g2,(g,w))\\<in>wu_rel N\"\n  assumes R_ND: \"r<N\"\nbegin    \n    \n  lemma wu2_adjs_nth_bound: \"wu2_adjs_nth u i g2 \\<le>\\<^sub>n SPEC (\\<lambda>(v,d). v<N)\"\n    unfolding wu2_adjs_nth_def\n    apply refine_vcg\n    using G_REL\n    unfolding wu_rel_def wu2_invar_def\n    apply (auto simp: Let_def)\n    by (metis atLeastLessThan_iff fst_image_mp nth_mem)\n\n\n  method Q\\<pi>3_refine = (rule bind_refine; Q\\<pi>3_refine | rule nfoldli_refine)?\n  lemma upd_Q\\<pi>_loop3_refine[refine]:\n    assumes \"(ui,u)\\<in>Id\" \"(Qi,Q)\\<in>Id\" \"(\\<pi>i,\\<pi>)\\<in>Id\" \"u<N\"\n    shows \"upd_Q\\<pi>_loop3 ui Qi \\<pi>i \\<le>\\<Down> Id (upd_Q\\<pi>_loop2 u Q \\<pi>)\"\n    apply (simp add: assms(1-3)[simplified])\n    apply (rule order_trans[rotated])\n    unfolding upd_Q\\<pi>_loop2_def\n    apply (rule iterate_adjs_refine_aux[OF G_REL])\n    apply fact\n    unfolding upd_Q\\<pi>_loop3_def\n    apply (rule refine_IdD)\n    (* TODO: A more flexible refine_rcg tactic might save us from this manual rule applications *)\n    apply Q\\<pi>3_refine\n    apply refine_dref_type\n    supply conc_Id[simp del]\n    apply (clarsimp_all simp: refine_IdI[OF order_refl])\n    apply (rule bind_refine')\n    apply (rule refine_IdI[OF order_refl])\n    apply (clarsimp split del: if_split)\n    apply (rule if_refine)\n    apply simp\n    apply simp\n    apply (rule ASSERT_refine_left)\n    subgoal using wu2_adjs_nth_bound by (auto simp: pw_leof_iff)\n    subgoal by (auto simp: pw_le_iff refine_pw_simps split: option.splits)\n    done\n    \n  lemma N_len_eq: \"N=length g2\" using G_REL by (auto simp: wu_rel_def Let_def)\n  \n  lemma prim5_refine: \"prim5 \\<le>\\<Down>Id prim4\"  \n    unfolding prim4_def prim5_def Let_def\n    apply (rewrite in \"_ \\<le> \\<Down>_ \\<hole>\" WHILET_def)\n    apply (simp del: conc_Id)\n    apply (refine_vcg bind_refine' WHILEIT_refine_new_invar')\n    \n    apply (clarsimp_all split: if_splits simp: R_ND)\n    subgoal by auto\n    subgoal by auto\n    subgoal        \n      unfolding upd_Q\\<pi>_loop3_def wu2_adjs_len_def wu2_adjs_nth_def\n      apply (refine_vcg nfoldli_leof_rule[where I=\"\\<lambda>_ _ (Q,\\<pi>). dom Q \\<subseteq> {0..<N}\"])\n      apply (clarsimp_all split: if_splits)\n      apply (auto simp: N_len_eq)\n      (*apply (auto simp: wu2_invar_def) \n      by (metis (mono_tags, hide_lams) atLeastLessThan_iff img_fst nth_mem subsetD)\n      *)\n      done\n    done\n\nend    \n\n\n   \nabbreviation \"snat32_assn \\<equiv> snat_assn' TYPE(32)\"\nabbreviation \"snat64_assn \\<equiv> snat_assn' TYPE(64)\"\nabbreviation \"wu_64_assn \\<equiv> wu_assn' TYPE(64) TYPE(64)\"\n\n  \nsepref_def upd_Q\\<pi>_loop4 is \"uncurry4 (Prim5.upd_Q\\<pi>_loop3)\"\n  :: \"snat64_assn\\<^sup>k *\\<^sub>a (wu_64_assn N)\\<^sup>k *\\<^sub>a snat64_assn\\<^sup>k *\\<^sub>a (hm_assn' TYPE(64) N)\\<^sup>d *\\<^sub>a (snat_am_assn' TYPE(64) N)\\<^sup>d \n    \\<rightarrow>\\<^sub>a hm_assn' TYPE(64) N \\<times>\\<^sub>a snat_am_assn' TYPE(64) N\"\n  unfolding Prim5.upd_Q\\<pi>_loop3_def nfoldli_upt_by_while PR_CONST_def Prim5.N_def\n  apply (annot_snat_const \"TYPE(64)\")\n  supply [[goals_limit = 1]]\n  by sepref\n  \nsepref_register Prim5.upd_Q\\<pi>_loop3 :: \"nat\n     \\<Rightarrow> (nat \\<times> nat) list list\n        \\<Rightarrow> nat \\<Rightarrow> ((nat, nat) i_map) \\<Rightarrow> ((nat, nat) i_map) \\<Rightarrow> (((nat, nat) i_map) \\<times> ((nat, nat) i_map)) nres\"\n  \n  \n(* TODO: Move *)\ndefinition BCONST :: \"'b \\<Rightarrow> 'a \\<Rightarrow> 'a\" where \"BCONST c m \\<equiv> m\"\n\nlemma annot_BCONST: \"m = BCONST c m\" by (simp add: BCONST_def)\n\ndefinition bind_const :: \"'a \\<Rightarrow> 'a nres \\<Rightarrow> ('a \\<Rightarrow> 'b nres) \\<Rightarrow> 'b nres\" \n  where \"bind_const c \\<equiv> Refine_Basic.bind\"\n\nlemma bind_BCONST_pat[def_pat_rules]: \"Refine_Basic.bind$(BCONST$c$m)$f \\<equiv> UNPROTECT (bind_const c)$m$f\"\n  unfolding BCONST_def bind_const_def by auto\n    \nlemma Let_BCONST_pat[def_pat_rules]: \"Let$(BCONST$c$cc)$f \\<equiv> UNPROTECT (bind_const c)$(RETURN$cc)$f\"\n  unfolding BCONST_def bind_const_def by auto\n\nterm \"bind_const x\"\n\nlemma id_op_bind_const[id_rules]: \n  \"PR_CONST (bind_const c) ::\\<^sub>i TYPE('a nres \\<Rightarrow> ('a \\<Rightarrow> 'b nres) \\<Rightarrow> 'b nres)\"\n  by simp\n\n  \n    \nlemma hn_bind_const[sepref_comb_rules]:\n  assumes PRE: \"vassn_tag \\<Gamma> \\<Longrightarrow> m \\<le> RETURN c\"\n  assumes D1: \"hn_refine \\<Gamma> m' \\<Gamma>1 Rh m\"\n  assumes D2: \n    \"\\<And>x'. m = RETURN c \\<Longrightarrow> \n      hn_refine (hn_ctxt Rh c x' ** \\<Gamma>1) (f' x') (\\<Gamma>2 x') R (f c)\"\n  assumes IMP: \"\\<And>x'. \\<Gamma>2 x' \\<turnstile> hn_ctxt Rx c x' ** \\<Gamma>'\"\n  assumes \"MK_FREE Rx fr\"\n  shows \"hn_refine \\<Gamma> (doM {x\\<leftarrow>m'; r\\<leftarrow>f' x; fr x; return r}) \\<Gamma>' R (PR_CONST (bind_const c)$m$(\\<lambda>\\<^sub>2x. f x))\"\nproof (rule hn_refine_vassn_tagI)\n  assume \"vassn_tag \\<Gamma>\"\n  then have X: \"m = RETURN c \\<and> x=c\" if \"RETURN x \\<le> m\" for x\n    using PRE that dual_order.trans by fastforce\n  \n  show ?thesis  \n    unfolding APP_def PROTECT2_def bind_ref_tag_def bind_const_def PR_CONST_def\n    apply (rule hnr_bind[where ?\\<Gamma>2.0=\"\\<lambda>x x'. \\<up>(x=c) ** G x'\" for G])\n    apply fact\n    apply (drule X) apply (clarsimp simp: sep_algebra_simps) apply fact\n    find_theorems entails pred_lift\n    apply (clarsimp simp: entails_lift_extract_simps sep_algebra_simps) apply fact\n    by fact\n    \nqed\n\n\n\nsepref_def prim6 is \"uncurry Prim5.prim5\" \n  :: \"snat64_assn\\<^sup>k *\\<^sub>a (wu_64_assn N)\\<^sup>k \\<rightarrow>\\<^sub>a (hm_assn' TYPE(64) N \\<times>\\<^sub>a snat_am_assn' TYPE(64) N)\"\n  unfolding Prim5.prim5_def Prim5.N_def\n  apply (annot_snat_const \"TYPE(64)\")\n  apply (rewrite at \"wu2_max _\" annot_BCONST[where c=N])\n  by sepref\n  \n  \n  \nexport_llvm prim6 \n  \n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/examples/Prim/Prim_Abstract.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.6370307806984444, "lm_q1q2_score": 0.3359168565636752}}
{"text": "(*\nTitle: Value-Dependent SIFUM-Type-Systems\nAuthors: Toby Murray, Robert Sison, Edward Pierzchalski, Christine Rizkallah\n(Based on the SIFUM-Type-Systems AFP entry, whose authors\n are: Sylvia Grewe, Heiko Mantel, Daniel Schoepe)\n*)\nsection \\<open>Language for Instantiating the SIFUM-Security Property\\<close>\n\ntheory Language\nimports Preliminaries\nbegin\n\nsubsection \\<open>Syntax\\<close>\n\ndatatype 'var ModeUpd = Acq \"'var\" Mode (infix \"+=\\<^sub>m\" 75)\n  | Rel \"'var\" Mode (infix \"-=\\<^sub>m\" 75)\n\ndatatype ('var, 'aexp, 'bexp) Stmt = Assign \"'var\" \"'aexp\" (infix \"\\<leftarrow>\" 130)\n  | Skip\n  | ModeDecl \"('var, 'aexp, 'bexp) Stmt\" \"'var ModeUpd\" (\"_@[_]\" [0, 0] 150)\n  | Seq \"('var, 'aexp, 'bexp) Stmt\" \"('var, 'aexp, 'bexp) Stmt\" (infixr \";;\" 150)\n  | If \"'bexp\" \"('var, 'aexp, 'bexp) Stmt\" \"('var, 'aexp, 'bexp) Stmt\"\n  | While \"'bexp\" \"('var, 'aexp, 'bexp) Stmt\"\n  | Await \"'bexp\" \"('var, 'aexp, 'bexp) Stmt\"\n  | Stop\n\ntype_synonym ('var, 'aexp, 'bexp) EvalCxt = \"('var, 'aexp, 'bexp) Stmt list\"\n\nlocale sifum_lang_no_dma =\n  fixes eval\\<^sub>A :: \"('Var, 'Val) Mem \\<Rightarrow> 'AExp \\<Rightarrow> 'Val\"\n  fixes eval\\<^sub>B :: \"('Var, 'Val) Mem \\<Rightarrow> 'BExp \\<Rightarrow> bool\"\n  fixes aexp_vars :: \"'AExp \\<Rightarrow> 'Var set\"\n  fixes bexp_vars :: \"'BExp \\<Rightarrow> 'Var set\"\n  assumes Var_finite : \"finite {(x :: 'Var). True}\"\n  assumes eval_vars_det\\<^sub>A : \"\\<lbrakk> \\<forall> x \\<in> aexp_vars e. mem\\<^sub>1 x = mem\\<^sub>2 x \\<rbrakk> \\<Longrightarrow> eval\\<^sub>A mem\\<^sub>1 e = eval\\<^sub>A mem\\<^sub>2 e\"\n  assumes eval_vars_det\\<^sub>B : \"\\<lbrakk> \\<forall> x \\<in> bexp_vars b. mem\\<^sub>1 x = mem\\<^sub>2 x \\<rbrakk> \\<Longrightarrow> eval\\<^sub>B mem\\<^sub>1 b = eval\\<^sub>B mem\\<^sub>2 b\"\n\nlocale sifum_lang = sifum_lang_no_dma eval\\<^sub>A eval\\<^sub>B aexp_vars bexp_vars\n  for eval\\<^sub>A :: \"('Var, 'Val) Mem \\<Rightarrow> 'AExp \\<Rightarrow> 'Val\"\n  and eval\\<^sub>B :: \"('Var, 'Val) Mem \\<Rightarrow> 'BExp \\<Rightarrow> bool\"\n  and aexp_vars :: \"'AExp \\<Rightarrow> 'Var set\"\n  and bexp_vars :: \"'BExp \\<Rightarrow> 'Var set\"+\n  fixes dma :: \"'Var \\<Rightarrow> Sec\"\n\ncontext sifum_lang_no_dma\nbegin\n\n(* To make the examples look a bit nicer in the PDF. *)\n\nnotation (latex output)\n  Seq (\"_; _\" 60)\n\nnotation (Rule output)\n  Seq (\"_ ; _\" 60)\n\nnotation (Rule output)\n  If (\"if _ then _ else _ fi\" 50)\n\nnotation (Rule output)\n  While (\"while _ do _ done\")\n\nnotation (Rule output)\n  Await (\"await _ do _ done\")\n\nabbreviation conf\\<^sub>w_abv :: \"('Var, 'AExp, 'BExp) Stmt \\<Rightarrow>\n  'Var Mds \\<Rightarrow> ('Var, 'Val) Mem \\<Rightarrow> (_,_,_) LocalConf\"\n  (\"\\<langle>_, _, _\\<rangle>\\<^sub>w\" [0, 120, 120] 100)\n  where\n  \"\\<langle> c, mds, mem \\<rangle>\\<^sub>w \\<equiv> ((c, mds), mem)\"\n\nsubsection \\<open>Semantics\\<close>\n\nprimrec update_modes :: \"'Var ModeUpd \\<Rightarrow> 'Var Mds \\<Rightarrow> 'Var Mds\"\n  where\n  \"update_modes (Acq x m) mds = mds (m := insert x (mds m))\" |\n  \"update_modes (Rel x m) mds = mds (m := {y. y \\<in> mds m \\<and> y \\<noteq> x})\"\n\nfun updated_var :: \"'Var ModeUpd \\<Rightarrow> 'Var\"\n  where\n  \"updated_var (Acq x _) = x\" |\n  \"updated_var (Rel x _) = x\"\n\nfun updated_mode :: \"'Var ModeUpd \\<Rightarrow> Mode\"\n  where\n  \"updated_mode (Acq _ m) = m\" |\n  \"updated_mode (Rel _ m) = m\"\n\ninductive_set eval\\<^sub>w_simple :: \"(('Var, 'AExp, 'BExp) Stmt \\<times> ('Var, 'Val) Mem) rel\"\nand eval\\<^sub>w_simple_abv :: \"(('Var, 'AExp, 'BExp) Stmt \\<times> ('Var, 'Val) Mem) \\<Rightarrow>\n  ('Var, 'AExp, 'BExp) Stmt \\<times> ('Var, 'Val) Mem \\<Rightarrow> bool\"\n  (infixr \"\\<leadsto>\\<^sub>s\" 60)\n  where\n  \"c \\<leadsto>\\<^sub>s c' \\<equiv> (c, c') \\<in> eval\\<^sub>w_simple\" |\n  assign: \"((x \\<leftarrow> e, mem), (Stop, mem (x := eval\\<^sub>A mem e))) \\<in> eval\\<^sub>w_simple\" |\n  skip: \"((Skip, mem), (Stop, mem)) \\<in> eval\\<^sub>w_simple\" |\n  seq_stop: \"((Seq Stop c, mem), (c, mem)) \\<in> eval\\<^sub>w_simple\" |\n  if_true: \"\\<lbrakk> eval\\<^sub>B mem b \\<rbrakk> \\<Longrightarrow> ((If b t e, mem), (t, mem)) \\<in> eval\\<^sub>w_simple\" |\n  if_false: \"\\<lbrakk> \\<not> eval\\<^sub>B mem b \\<rbrakk> \\<Longrightarrow> ((If b t e, mem), (e, mem)) \\<in> eval\\<^sub>w_simple\" |\n  while: \"((While b c, mem), (If b (c ;; While b c) Stop, mem)) \\<in> eval\\<^sub>w_simple\"\n\nlemma cond:\n  \"((If b t e, mem), (if eval\\<^sub>B mem b then t else e, mem)) \\<in> eval\\<^sub>w_simple\"\n  apply(case_tac \"eval\\<^sub>B mem b\")\n   apply(auto intro: eval\\<^sub>w_simple.intros)\n  done\n\nprimrec cxt_to_stmt :: \"('Var, 'AExp, 'BExp) EvalCxt \\<Rightarrow> ('Var, 'AExp, 'BExp) Stmt\n  \\<Rightarrow> ('Var, 'AExp, 'BExp) Stmt\"\n  where\n  \"cxt_to_stmt [] c = c\" |\n  \"cxt_to_stmt (c # cs) c' = Seq c' (cxt_to_stmt cs c)\"\n\n(* Design decision: Add \"normal\" rule for sequential statements here as well.\n  Otherwise, one would have to take care of adding some sort of normalization\n  later, so that one doesn't get stuck on expressions of the form (c ;; c') ;; c''.\n*)\n(* Normalization turned out to be more difficult, as it made the proofs of several\n  helpful lemmas below quite difficult. *)\n\n\n\nlemma trancl_mono_proof[mono]:\n  \"(\\<And>a b. x a b \\<longrightarrow> y a b) \\<Longrightarrow> tranclp x a b \\<longrightarrow> tranclp y a b\"\n  apply (rule impI, rotate_tac, induct rule: tranclp.induct)\n   apply simp_all\n   apply blast\n  by fastforce\n\ninductive no_await :: \"('Var, 'AExp, 'BExp) Stmt \\<Rightarrow> bool\" where\n  \"no_await (x \\<leftarrow> e)\" |\n  \"no_await c1 \\<Longrightarrow> no_await c2 \\<Longrightarrow> no_await (c1 ;; c2)\" |\n  \"no_await c1 \\<Longrightarrow> no_await c2 \\<Longrightarrow> no_await (If b c1 c2)\" |\n  \"no_await c \\<Longrightarrow> no_await (While b c)\" |\n  \"no_await Skip\" |\n  \"no_await Stop\" |\n  \"no_await c \\<Longrightarrow> no_await (c@[m])\"\n\ninductive is_final :: \"('Var, 'AExp, 'BExp) Stmt \\<Rightarrow> bool\" where\n  \"is_final Stop\" |\n  \"is_final c \\<Longrightarrow> is_final (c@[m])\"\n\ninductive_set eval\\<^sub>w :: \"(('Var, 'AExp, 'BExp) Stmt, 'Var, 'Val) LocalConf rel\"\nand eval\\<^sub>w_abv :: \"(('Var, 'AExp, 'BExp) Stmt, 'Var, 'Val) LocalConf \\<Rightarrow>\n                  (('Var, 'AExp, 'BExp) Stmt, 'Var, 'Val) LocalConf \\<Rightarrow> bool\"\n  (infixr \"\\<leadsto>\\<^sub>w\" 60)\nwhere\n  \"c \\<leadsto>\\<^sub>w c' \\<equiv> (c, c') \\<in> eval\\<^sub>w\" |\n  unannotated: \"\\<lbrakk> (c, mem) \\<leadsto>\\<^sub>s (c', mem') \\<rbrakk>\n    \\<Longrightarrow> (\\<langle>cxt_to_stmt E c, mds, mem\\<rangle>\\<^sub>w, \\<langle>cxt_to_stmt E c', mds, mem'\\<rangle>\\<^sub>w) \\<in> eval\\<^sub>w\" |\n  seq: \"\\<lbrakk> \\<langle>c\\<^sub>1, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c\\<^sub>1', mds', mem'\\<rangle>\\<^sub>w \\<rbrakk> \\<Longrightarrow> (\\<langle>(c\\<^sub>1 ;; c\\<^sub>2), mds, mem\\<rangle>\\<^sub>w, \\<langle>(c\\<^sub>1' ;; c\\<^sub>2), mds', mem'\\<rangle>\\<^sub>w) \\<in> eval\\<^sub>w\" |\n  decl: \"\\<lbrakk> \\<langle>c, update_modes mu mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w \\<rbrakk> \\<Longrightarrow>\n         (\\<langle>cxt_to_stmt E (ModeDecl c mu), mds, mem\\<rangle>\\<^sub>w, \\<langle>cxt_to_stmt E c', mds', mem'\\<rangle>\\<^sub>w) \\<in> eval\\<^sub>w\" |\n(* This is added instead of defining eval\\<^sub>p -- see next comment*)\n  await: \"\\<lbrakk>eval\\<^sub>B mem b; no_await c\\<^sub>1;\n         (\\<langle>c\\<^sub>1, mds, mem\\<rangle>\\<^sub>w, \\<langle>c\\<^sub>2, mds', mem'\\<rangle>\\<^sub>w) \\<in> eval\\<^sub>w\\<^sup>+;\n         is_final c\\<^sub>2\\<rbrakk> \\<Longrightarrow>\n         (\\<langle>Await b c\\<^sub>1, mds, mem\\<rangle>\\<^sub>w, \\<langle>c\\<^sub>2, mds', mem'\\<rangle>\\<^sub>w) \\<in> eval\\<^sub>w\"\n\nabbreviation eval\\<^sub>w_plus :: \"\n  (('Var, 'AExp, 'BExp) Stmt, 'Var, 'Val) LocalConf \\<Rightarrow>\n                  (('Var, 'AExp, 'BExp) Stmt, 'Var, 'Val) LocalConf \\<Rightarrow> bool\" (\"_ \\<leadsto>\\<^sub>w\\<^sup>+ _\") where\n\"ctx \\<leadsto>\\<^sub>w\\<^sup>+ ctx' \\<equiv> (ctx, ctx') \\<in> eval\\<^sub>w\\<^sup>+\"\n  \nsubsection \\<open>Semantic Properties\\<close>\n\ntext \\<open>The following lemmas simplify working with evaluation contexts\n  in the soundness proofs for the type system(s).\\<close>\n\ninductive_cases eval_elim: \"(((c, mds), mem), ((c', mds'), mem')) \\<in> eval\\<^sub>w\"\ninductive_cases stop_no_eval' [elim]: \"((Stop, mem), (c', mem')) \\<in> eval\\<^sub>w_simple\"\ninductive_cases assign_elim' [elim]: \"((x \\<leftarrow> e, mem), (c', mem')) \\<in> eval\\<^sub>w_simple\"\ninductive_cases skip_elim' [elim]: \"(Skip, mem) \\<leadsto>\\<^sub>s (c', mem')\"\n\nlemma cxt_inv:\n  \"\\<lbrakk> cxt_to_stmt E c = c' ; \\<And> p q. c' \\<noteq> Seq p q \\<rbrakk> \\<Longrightarrow> E = [] \\<and> c' = c\"\n  by (metis cxt_to_stmt.simps(1) cxt_to_stmt.simps(2) neq_Nil_conv)\n\nlemma cxt_inv_assign:\n  \"\\<lbrakk> cxt_to_stmt E c = x \\<leftarrow> e \\<rbrakk> \\<Longrightarrow> c = x \\<leftarrow> e \\<and> E = []\"\n  by (metis Stmt.simps(11) cxt_inv)\n\nlemma cxt_inv_skip:\n  \"\\<lbrakk> cxt_to_stmt E c = Skip \\<rbrakk> \\<Longrightarrow> c = Skip \\<and> E = []\"\n  by (metis Stmt.simps(23) cxt_inv)\n\nlemma cxt_inv_stop:\n  \"cxt_to_stmt E c = Stop \\<Longrightarrow> c = Stop \\<and> E = []\"\n  by (metis Stmt.simps(49) cxt_inv)\n\nlemma cxt_inv_if:\n  \"cxt_to_stmt E c = If e p q \\<Longrightarrow> c = If e p q \\<and> E = []\"\n  by (metis Stmt.simps(43) cxt_inv)\n  \nlemma ctx_inv_anno:\n  \"cxt_to_stmt E c = c'@[mu] \\<Longrightarrow> c = c'@[mu] \\<and> E = []\"\n  using cxt_inv by blast \n  \nlemma cxt_inv_await:\n  \"cxt_to_stmt E c = Await e p \\<Longrightarrow> c = Await e p  \\<and> E = []\"\n  by (metis Stmt.simps(47) cxt_inv)\n\nlemma cxt_inv_while:\n  \"cxt_to_stmt E c = While e p \\<Longrightarrow> c = While e p \\<and> E = []\"\n  by (metis Stmt.simps(45) cxt_inv)\n\nlemma skip_elim [elim]:\n  \"\\<langle>Skip, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w \\<Longrightarrow> c' = Stop \\<and> mds = mds' \\<and> mem = mem'\"\n  apply (erule eval_elim)\n     apply (metis (lifting) cxt_inv_skip cxt_to_stmt.simps(1) skip_elim')\n    apply (metis Stmt.simps(24))\n   apply (metis Stmt.simps(21) cxt_inv_skip)\n  by simp\n\nlemma assign_elim [elim]:\n  \"\\<langle>x \\<leftarrow> e, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w \\<Longrightarrow> c' = Stop \\<and> mds = mds' \\<and> mem' = mem (x := eval\\<^sub>A mem e)\"\n  apply (erule eval_elim)\n     apply (rename_tac c c'a E)\n     apply (subgoal_tac \"c = x \\<leftarrow> e \\<and> E = []\")\n      apply force \n     apply auto\n      apply (metis cxt_inv_assign)\n     apply (metis cxt_inv_assign)\n    apply (metis Stmt.simps(9) cxt_inv_assign)\n   apply (metis Stmt.simps(9) cxt_inv_assign)\n  by (metis Stmt.simps(9) cxt_inv_assign)\n\ninductive_cases if_elim' [elim!]: \"(If b p q, mem) \\<leadsto>\\<^sub>s (c', mem')\"\n\nlemma if_elim [elim]:\n  \"\\<And> P.\n    \\<lbrakk> \\<langle>If b p q, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w ;\n     \\<lbrakk> c' = p; mem' = mem ; mds' = mds ; eval\\<^sub>B mem b \\<rbrakk> \\<Longrightarrow> P ;\n     \\<lbrakk> c' = q; mem' = mem ; mds' = mds ; \\<not> eval\\<^sub>B mem b \\<rbrakk> \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> P\"\n  apply (erule eval_elim)\n     apply (metis (no_types) cxt_inv_if cxt_to_stmt.simps(1) if_elim')\n    apply (metis Stmt.simps(43))\n   apply (metis Stmt.simps(35) cxt_inv_if)\n  by simp\n\ninductive_cases await_elim' [elim!]: \"\\<langle>Await b p, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c',mds', mem'\\<rangle>\\<^sub>w\"\n\ninductive_cases while_elim' [elim!]: \"(While e c, mem) \\<leadsto>\\<^sub>s (c', mem')\"\n\nlemma while_elim [elim]:\n  \"\\<lbrakk> \\<langle>While e c, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w \\<rbrakk> \\<Longrightarrow> c' = If e (c ;; While e c) Stop \\<and> mds' = mds \\<and> mem' = mem\"\n  apply (erule eval_elim)\n     apply (metis (no_types) cxt_inv_while cxt_to_stmt.simps(1) while_elim')\n    apply (metis Stmt.simps(45))\n   apply (metis (lifting) Stmt.simps(37) cxt_inv_while)\n  by simp\n\ninductive_cases upd_elim' [elim]: \"(c@[upd], mem) \\<leadsto>\\<^sub>s (c', mem')\"\n\nlemma upd_elim [elim]:\n  \"\\<langle>c@[upd], mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w \\<Longrightarrow> \\<langle>c, update_modes upd mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w\"\n  apply (erule eval_elim)\n     apply (metis (lifting) Stmt.simps(33) cxt_inv upd_elim')\n    apply (metis Stmt.simps(34))\n   apply (metis (lifting) Stmt.simps(2) Stmt.simps(33) cxt_inv cxt_to_stmt.simps(1))\n  by simp\n\nlemma cxt_seq_elim [elim]:\n  \"c\\<^sub>1 ;; c\\<^sub>2 = cxt_to_stmt E c \\<Longrightarrow> (E = [] \\<and> c = c\\<^sub>1 ;; c\\<^sub>2) \\<or> (\\<exists> c' cs. E = c' # cs \\<and> c = c\\<^sub>1 \\<and> c\\<^sub>2 = cxt_to_stmt cs c')\"\n  apply (cases E)\n   apply (metis cxt_to_stmt.simps(1))\n  by (metis Stmt.simps(3) cxt_to_stmt.simps(2))\n\ninductive_cases seq_elim' [elim]: \"(c\\<^sub>1 ;; c\\<^sub>2, mem) \\<leadsto>\\<^sub>s (c', mem')\"\n\nlemma stop_no_eval: \"\\<not> (\\<langle>Stop, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w)\"\n  apply auto\n  apply (erule eval_elim)\n     apply (metis cxt_inv_stop stop_no_eval')\n    apply (metis Stmt.simps(49))\n   apply (metis Stmt.simps(41) cxt_inv_stop)\n  by simp\n\nlemma seq_stop_elim [elim]:\n  \"\\<langle>Stop ;; c, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w \\<Longrightarrow> c' = c \\<and> mds' = mds \\<and> mem' = mem\"\n  apply (erule eval_elim)\n     apply clarify\n     apply (metis (no_types) cxt_seq_elim cxt_to_stmt.simps(1) seq_elim' stop_no_eval')\n    apply (metis Stmt.inject(3) stop_no_eval)\n   apply (metis Stmt.distinct(28) Stmt.distinct(36) cxt_seq_elim)\n  by simp\n\nlemma cxt_stmt_seq:\n  \"c ;; cxt_to_stmt E c' = cxt_to_stmt (c' # E) c\"\n  by (metis cxt_to_stmt.simps(2))\n\n\nlemma seq_elim [elim]:\n  \"\\<lbrakk> \\<langle>c\\<^sub>1 ;; c\\<^sub>2, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w ; c\\<^sub>1 \\<noteq> Stop \\<rbrakk> \\<Longrightarrow>\n  (\\<exists> c\\<^sub>1'. \\<langle>c\\<^sub>1, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c\\<^sub>1', mds', mem'\\<rangle>\\<^sub>w \\<and> c' = c\\<^sub>1' ;; c\\<^sub>2)\"\n  apply (erule eval_elim)\n    apply clarify\n    apply (drule cxt_seq_elim)\n    apply (erule disjE)\n     apply blast \n    apply auto\n   apply (metis cxt_to_stmt.simps(1) eval\\<^sub>w.unannotated)\n  apply (subgoal_tac \"c\\<^sub>1 = c@[mu]\")\n   apply simp\n   apply (drule cxt_seq_elim)\n   apply (metis Stmt.distinct(27) cxt_stmt_seq cxt_to_stmt.simps(1) eval\\<^sub>w.decl)\n  using cxt_seq_elim by blast\n\nlemma stop_cxt: \"Stop = cxt_to_stmt E c \\<Longrightarrow> c = Stop\"\n  by (metis Stmt.simps(50) cxt_to_stmt.simps(1) cxt_to_stmt.simps(2) neq_Nil_conv)\n\n(* Additional helper lemmas added by TobyM and RobS *)\n\nlemmas decl_eval\\<^sub>w = decl[OF unannotated, OF skip, where E=\"[]\", simplified, where E1=\"[]\", simplified]\nlemmas seq_stop_eval\\<^sub>w = unannotated[OF seq_stop, where E=\"[]\", simplified]\nlemmas assign_eval\\<^sub>w = unannotated[OF assign, where E=\"[]\", simplified]\nlemmas if_eval\\<^sub>w = unannotated[OF cond, where E=\"[]\", simplified]\nlemmas if_false_eval\\<^sub>w = unannotated[OF if_false, where E=\"[]\", simplified]\nlemmas skip_eval\\<^sub>w = unannotated[OF skip, where E=\"[]\", simplified]\nlemmas while_eval\\<^sub>w = unannotated[OF while, where E=\"[]\", simplified]\n\nlemma decl_eval\\<^sub>w':\n  assumes mem_unchanged: \"mem' = mem\"\n  assumes upd: \"mds' = update_modes upd mds\"\n  shows \"(\\<langle>Skip@[upd], mds, mem\\<rangle>\\<^sub>w, \\<langle>Stop, mds', mem'\\<rangle>\\<^sub>w) \\<in> eval\\<^sub>w\"\n  using assms decl_eval\\<^sub>w\n  by auto\n\nlemma assign_eval\\<^sub>w':\n  \"\\<lbrakk>mds = mds'; mem' = mem(x := eval\\<^sub>A mem e)\\<rbrakk> \\<Longrightarrow>\n  \\<langle>x \\<leftarrow> e, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>Stop, mds', mem'\\<rangle>\\<^sub>w\"\n  using assign_eval\\<^sub>w\n  by simp\n\n(* Following the naming convention, but we actually apply these as dest, not elim rules... *)\n\nlemma seq_decl_elim:\n  \"\\<langle>(Skip@[upd]) ;; c, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w \\<Longrightarrow>\n   c' = Stop ;; c \\<and> mem' = mem \\<and> mds' = update_modes upd mds\"\n  apply(drule seq_elim, simp)\n  apply(erule exE, clarsimp)\n  apply(drule upd_elim)\n  apply(drule skip_elim, clarsimp)\n  done\n\nlemma seq_assign_elim:\n  \"\\<langle>(x \\<leftarrow> e) ;; c, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w \\<Longrightarrow>\n   c' = Stop ;; c \\<and> mds' = mds \\<and> mem' = mem(x := eval\\<^sub>A mem e)\"\n  apply(drule seq_elim, simp)\n  apply(erule exE, clarsimp)\n  apply(drule assign_elim, clarsimp)\n  done\n\nlemma no_await_trans: \n  \"\\<lbrakk> no_await c; \\<langle>c, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c', mds', mem'\\<rangle>\\<^sub>w \\<rbrakk> \\<Longrightarrow> no_await c'\"\n  apply (induct arbitrary: c' mds rule: \"no_await.induct\")\n        using assign_elim \"no_await.simps\" apply blast\n       apply (rename_tac c1 c2 c3 mds)\n       apply (case_tac \"c1 = Stop\")\n        apply (simp, frule seq_stop_elim, clarsimp)\n        using seq_elim no_await.intros apply metis\n       using if_elim no_await.intros apply blast\n      apply (frule while_elim, clarsimp)\n     apply (rename_tac c b)\n     apply (subgoal_tac \"no_await (While b c)\")\n      apply (subgoal_tac \"no_await (c ;; While b c)\")\n       using no_await.intros apply blast\n      using no_await.intros apply blast\n     using no_await.intros apply blast\n    using no_await.intros skip_elim apply fast\n   using no_await.intros stop_no_eval apply fast\n  using no_await.intros upd_elim by fast\n\nlemma no_await_no_await[elim]: \"\\<lbrakk> no_await c \\<rbrakk> \\<Longrightarrow> c \\<noteq> Await b c'\"\n  using no_await.cases Stmt.distinct by fast\n\nlemma no_await_trancl_impl: \n  \"\\<lbrakk>ctx \\<leadsto>\\<^sub>w\\<^sup>+ ctx'\\<rbrakk> \\<Longrightarrow> no_await (fst (fst ctx)) \\<longrightarrow> no_await (fst (fst ctx'))\"\n  apply (erule trancl.induct, clarsimp)\n   using no_await_trans apply blast\n  apply clarsimp\n  using no_await_trans by blast\n  \nlemma no_await_trancl: \n  \"\\<lbrakk>ctx \\<leadsto>\\<^sub>w\\<^sup>+ ctx'; no_await (fst (fst ctx))\\<rbrakk> \\<Longrightarrow> no_await (fst (fst ctx'))\" \n  using no_await_trancl_impl by blast\n\nlemma await_elim: \n  \"\\<lbrakk>\\<langle>Await b c\\<^sub>1, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w \\<langle>c\\<^sub>2, mds', mem'\\<rangle>\\<^sub>w\\<rbrakk> \\<Longrightarrow> \n    eval\\<^sub>B mem b \\<and> no_await c\\<^sub>1 \\<and> is_final c\\<^sub>2  \\<and>\n    \\<langle>c\\<^sub>1, mds, mem\\<rangle>\\<^sub>w \\<leadsto>\\<^sub>w\\<^sup>+ \\<langle>c\\<^sub>2, mds', mem'\\<rangle>\\<^sub>w\"\n  apply (erule \"eval\\<^sub>w.cases\"; clarsimp)\n   apply (subgoal_tac \"cxt_to_stmt E c = Await b c\\<^sub>1\")\n    apply (drule cxt_inv_await)\n    using \"eval\\<^sub>w_simple.cases\" apply force\n   apply simp\n  by (metis Stmt.distinct(33) cxt_inv_await)\n  \nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Dependent_SIFUM_Type_Systems/Language.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3359131778250933}}
{"text": "section {* Designs *}\n\ntheory utp_designs\nimports\n  \"../utp/utp\"\nbegin\n\ntext {* In UTP, in order to explicitly record the termination of a program,\na subset of alphabetized relations is introduced. These relations are called\ndesigns and their alphabet should contain the special boolean observational variable ok.\nIt is used to record the start and termination of a program. *}\n\nsubsection {* Definitions *}\n\ntext {* In the following, the definitions of designs alphabets, designs and\nhealthiness (well-formedness) conditions are given. The healthiness conditions of\ndesigns are defined by $H1$, $H2$, $H3$ and $H4$.*}\n\nalphabet des_vars =\n  ok :: bool\n\n\ntext {*\n  The two locale interpretations below are a technicality to improve automatic\n  proof support via the predicate and relational tactics. This is to enable the\n  (re-)interpretation of state spaces to remove any occurrences of lens types\n  after the proof tactics @{method pred_simp} and @{method rel_simp}, or any\n  of their derivatives have been applied. Eventually, it would be desirable to\n  automate both interpretations as part of a custom outer command for defining\n  alphabets.\n*}\n\ninterpretation des_vars: lens_interp \"\\<lambda>r. (ok\\<^sub>v r, more r)\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\ninterpretation des_vars_rel:\n  lens_interp \"\\<lambda>(r, r'). (ok\\<^sub>v r, ok\\<^sub>v r', more r, more r')\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\nlemma ok_ord [usubst]:\n  \"$ok \\<prec>\\<^sub>v $ok\\<acute>\"\n  by (simp add: var_name_ord_def)\n\ntype_synonym '\\<alpha> des  = \"'\\<alpha> des_vars_scheme\"\ntype_synonym ('\\<alpha>, '\\<beta>) rel_des = \"('\\<alpha> des, '\\<beta> des) rel\"\ntype_synonym '\\<alpha> hrel_des = \"('\\<alpha> des) hrel\"\n\ntranslations\n  (type) \"'\\<alpha> des\" <= (type) \"'\\<alpha> des_vars_scheme\"\n  (type) \"'\\<alpha> des\" <= (type) \"'\\<alpha> des_vars_ext\"\n  (type) \"('\\<alpha>, '\\<beta>) rel_des\" <= (type) \"('\\<alpha> des, '\\<beta> des) rel\"\n\nnotation des_vars_child_lens (\"\\<Sigma>\\<^sub>D\")\n\nlemma ok_des_bij_lens: \"bij_lens (ok +\\<^sub>L \\<Sigma>\\<^sub>D)\"\n  by (unfold_locales, simp_all add: ok_def des_vars_child_lens_def lens_plus_def prod.case_eq_if)\n\ntext {* Define the lens functor for designs *}\n\ndefinition lmap_des_vars :: \"('\\<alpha> \\<Longrightarrow> '\\<beta>) \\<Rightarrow> ('\\<alpha> des_vars_scheme \\<Longrightarrow> '\\<beta> des_vars_scheme)\" (\"lmap\\<^sub>D\")\n  where \"lmap_des_vars f = \\<lparr> lens_get = \\<lambda> v. extend (truncate v) (get\\<^bsub>f\\<^esub> (more v))\n                           , lens_put = \\<lambda> s v. extend (truncate v) (put\\<^bsub>f\\<^esub> (more s) (more v)) \\<rparr>\"\n\nlemma lmap_des_vars: \"vwb_lens f \\<Longrightarrow> vwb_lens (lmap_des_vars f)\"\n  by (unfold_locales, simp_all add: lmap_des_vars_def extend_def truncate_def)\n\nlemma lmap_id: \"lmap\\<^sub>D 1\\<^sub>L = 1\\<^sub>L\"\n  by (simp add: lmap_des_vars_def id_lens_def extend_def truncate_def fun_eq_iff)\n\nlemma lmap_comp: \"lmap\\<^sub>D (f ;\\<^sub>L g) = lmap\\<^sub>D f ;\\<^sub>L lmap\\<^sub>D g\"\n  by (simp add: lmap_des_vars_def id_lens_def lens_comp_def extend_def truncate_def fun_eq_iff)\n\ntext {* The following notations define liftings from non-design predicates into design\n  predicates using alphabet extensions. *}\n\nabbreviation lift_desr (\"\\<lceil>_\\<rceil>\\<^sub>D\")\nwhere \"\\<lceil>P\\<rceil>\\<^sub>D \\<equiv> P \\<oplus>\\<^sub>p (\\<Sigma>\\<^sub>D \\<times>\\<^sub>L \\<Sigma>\\<^sub>D)\"\n\nabbreviation lift_pre_desr (\"\\<lceil>_\\<rceil>\\<^sub>D\\<^sub><\")\nwhere \"\\<lceil>p\\<rceil>\\<^sub>D\\<^sub>< \\<equiv> \\<lceil>\\<lceil>p\\<rceil>\\<^sub><\\<rceil>\\<^sub>D\"\n\nabbreviation lift_post_desr (\"\\<lceil>_\\<rceil>\\<^sub>D\\<^sub>>\")\nwhere \"\\<lceil>p\\<rceil>\\<^sub>D\\<^sub>> \\<equiv> \\<lceil>\\<lceil>p\\<rceil>\\<^sub>>\\<rceil>\\<^sub>D\"\n\nabbreviation drop_desr (\"\\<lfloor>_\\<rfloor>\\<^sub>D\")\nwhere \"\\<lfloor>P\\<rfloor>\\<^sub>D \\<equiv> P \\<restriction>\\<^sub>p (\\<Sigma>\\<^sub>D \\<times>\\<^sub>L \\<Sigma>\\<^sub>D)\" \n\ndefinition design::\"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (infixl \"\\<turnstile>\" 60)\nwhere \"P \\<turnstile> Q = ($ok \\<and> P \\<Rightarrow> $ok\\<acute> \\<and> Q)\"\n\ntext {* An rdesign is a design that uses the Isabelle type system to prevent reference to ok in the\n        assumption and commitment. *}\n\ndefinition rdesign::\"('\\<alpha>, '\\<beta>) rel \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (infixl \"\\<turnstile>\\<^sub>r\" 60)\nwhere \"(P \\<turnstile>\\<^sub>r Q) = \\<lceil>P\\<rceil>\\<^sub>D \\<turnstile> \\<lceil>Q\\<rceil>\\<^sub>D\"\n\ntext {* An ndesign is a normal design, i.e. where the assumption is a condition *}\n\ndefinition ndesign::\"'\\<alpha> cond \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (infixl \"\\<turnstile>\\<^sub>n\" 60)\nwhere \"(p \\<turnstile>\\<^sub>n Q) = (\\<lceil>p\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q)\"\n\ndefinition skip_d :: \"'\\<alpha> hrel_des\" (\"II\\<^sub>D\")\nwhere \"II\\<^sub>D \\<equiv> (true \\<turnstile>\\<^sub>r II)\"\n\ndefinition assigns_d :: \"'\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\" (\"\\<langle>_\\<rangle>\\<^sub>D\")\nwhere \"assigns_d \\<sigma> = (true \\<turnstile>\\<^sub>r assigns_r \\<sigma>)\"\n\nsyntax\n  \"_assignmentd\" :: \"svid_list \\<Rightarrow> uexprs \\<Rightarrow> logic\"  (infixr \":=\\<^sub>D\" 55)\n\ntranslations\n  \"_assignmentd xs vs\" => \"CONST assigns_d (_mk_usubst (CONST id) xs vs)\"\n  \"x :=\\<^sub>D v\" <= \"CONST assigns_d (CONST subst_upd (CONST id) (CONST svar x) v)\"\n  \"x :=\\<^sub>D v\" <= \"CONST assigns_d (CONST subst_upd (CONST id) x v)\"\n  \"x,y :=\\<^sub>D u,v\" <= \"CONST assigns_d (CONST subst_upd (CONST subst_upd (CONST id) (CONST svar x) u) (CONST svar y) v)\"\n\ndefinition J :: \"'\\<alpha> hrel_des\"\nwhere \"J = (($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\"\n\ndefinition \"H1 (P)  \\<equiv>  $ok \\<Rightarrow> P\"\n\ndefinition \"H2 (P)  \\<equiv>  P ;; J\"\n\ndefinition \"H3 (P)  \\<equiv>  P ;; II\\<^sub>D\"\n\ndefinition \"H4 (P)  \\<equiv> ((P;;true) \\<Rightarrow> P)\"\n\nsyntax\n  \"_ok_f\"  :: \"logic \\<Rightarrow> logic\" (\"_\\<^sup>f\" [1000] 1000)\n  \"_ok_t\"  :: \"logic \\<Rightarrow> logic\" (\"_\\<^sup>t\" [1000] 1000)\n  \"_top_d\" :: \"logic\" (\"\\<top>\\<^sub>D\")\n  \"_bot_d\" :: \"logic\" (\"\\<bottom>\\<^sub>D\")\n\ntranslations\n  \"P\\<^sup>f\" \\<rightleftharpoons> \"CONST usubst (CONST subst_upd CONST id (CONST ovar CONST ok) false) P\"\n  \"P\\<^sup>t\" \\<rightleftharpoons> \"CONST usubst (CONST subst_upd CONST id (CONST ovar CONST ok) true) P\"\n  \"\\<top>\\<^sub>D\" => \"CONST not_upred (CONST utp_expr.var (CONST ivar CONST ok))\"\n  \"\\<bottom>\\<^sub>D\" => \"true\"\n\ndefinition pre_design :: \"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel\" (\"pre\\<^sub>D'(_')\") where\n\"pre\\<^sub>D(P) = \\<lfloor>\\<not> P\\<lbrakk>true,false/$ok,$ok\\<acute>\\<rbrakk>\\<rfloor>\\<^sub>D\"\n\ndefinition post_design :: \"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel\" (\"post\\<^sub>D'(_')\") where\n\"post\\<^sub>D(P) = \\<lfloor>P\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>\\<rfloor>\\<^sub>D\"\n\ndefinition wp_design :: \"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> '\\<beta> cond \\<Rightarrow> '\\<alpha> cond\" (infix \"wp\\<^sub>D\" 60) where\n\"Q wp\\<^sub>D r = (\\<lfloor>pre\\<^sub>D(Q) ;; true :: ('\\<alpha>, '\\<beta>) rel\\<rfloor>\\<^sub>< \\<and> (post\\<^sub>D(Q) wp r))\"\n\ndeclare design_def [upred_defs]\ndeclare rdesign_def [upred_defs]\ndeclare ndesign_def [upred_defs]\ndeclare skip_d_def [upred_defs]\ndeclare J_def [upred_defs]\ndeclare pre_design_def [upred_defs]\ndeclare post_design_def [upred_defs]\ndeclare wp_design_def [upred_defs]\ndeclare assigns_d_def [upred_defs]\n\ndeclare H1_def [upred_defs]\ndeclare H2_def [upred_defs]\ndeclare H3_def [upred_defs]\ndeclare H4_def [upred_defs]\n\nlemma drop_desr_inv [simp]: \"\\<lfloor>\\<lceil>P\\<rceil>\\<^sub>D\\<rfloor>\\<^sub>D = P\"\n  by (simp add: arestr_aext prod_mwb_lens)\n\nlemma lift_desr_inv:\n  fixes P :: \"('\\<alpha>, '\\<beta>) rel_des\"\n  assumes \"$ok \\<sharp> P\" \"$ok\\<acute> \\<sharp> P\"\n  shows \"\\<lceil>\\<lfloor>P\\<rfloor>\\<^sub>D\\<rceil>\\<^sub>D = P\"\nproof -\n  have \"bij_lens (\\<Sigma>\\<^sub>D \\<times>\\<^sub>L \\<Sigma>\\<^sub>D +\\<^sub>L (in_var ok +\\<^sub>L out_var ok) :: (_, '\\<alpha> des_vars_scheme \\<times> '\\<beta> des_vars_scheme) lens)\"\n    (is \"bij_lens (?P)\")\n  proof -\n    have \"?P \\<approx>\\<^sub>L (ok +\\<^sub>L \\<Sigma>\\<^sub>D) \\<times>\\<^sub>L (ok +\\<^sub>L \\<Sigma>\\<^sub>D)\" (is \"?P \\<approx>\\<^sub>L ?Q\")\n      apply (simp add: in_var_def out_var_def prod_as_plus)\n      apply (simp add: prod_as_plus[THEN sym])\n      apply (meson lens_equiv_sym lens_equiv_trans lens_indep_prod lens_plus_comm lens_plus_prod_exchange des_vars_indeps(1))\n    done\n    moreover have \"bij_lens ?Q\"\n      by (simp add: ok_des_bij_lens prod_bij_lens)\n    ultimately show ?thesis\n      by (metis bij_lens_equiv lens_equiv_sym)\n  qed\n\n  with assms show ?thesis\n    apply (rule_tac aext_arestr[of _ \"in_var ok +\\<^sub>L out_var ok\"])\n    apply (simp add: prod_mwb_lens)\n    apply (simp)\n    apply (metis alpha_in_var lens_indep_prod lens_indep_sym des_vars_indeps(1) out_var_def prod_as_plus)\n    using unrest_var_comp apply blast\n  done\nqed\n\nsubsection {* Design laws *}\n\nlemma unrest_out_des_lift [unrest]: \"out\\<alpha> \\<sharp> p \\<Longrightarrow> out\\<alpha> \\<sharp> \\<lceil>p\\<rceil>\\<^sub>D\"\n  by (pred_simp, auto simp add: out\\<alpha>_def des_vars_child_lens_def)\n\nlemma lift_dist_seq [simp]:\n  \"\\<lceil>P ;; Q\\<rceil>\\<^sub>D = (\\<lceil>P\\<rceil>\\<^sub>D ;; \\<lceil>Q\\<rceil>\\<^sub>D)\"\n  by (rel_auto)\n\nlemma lift_des_skip_dr_unit_unrest: \"$ok\\<acute> \\<sharp> P \\<Longrightarrow> (P ;; \\<lceil>II\\<rceil>\\<^sub>D) = P\"\n  by (rel_auto)\n\nlemma true_is_design:\n  \"(false \\<turnstile> true) = true\"\n  by (rel_auto)\n\nlemma true_is_rdesign:\n  \"(false \\<turnstile>\\<^sub>r true) = true\"\n  by (rel_auto)\n\nlemma design_false_pre:\n  \"(false \\<turnstile> P) = true\"\n  by (rel_auto)\n\nlemma rdesign_false_pre:\n  \"(false \\<turnstile>\\<^sub>r P) = true\"\n  by (rel_auto)\n\nlemma ndesign_false_pre:\n  \"(false \\<turnstile>\\<^sub>n P) = true\"\n  by (rel_auto)\n\ntheorem design_refinement:\n  assumes\n    \"$ok \\<sharp> P1\" \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\" \"$ok\\<acute> \\<sharp> P2\"\n    \"$ok \\<sharp> Q1\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\" \"$ok\\<acute> \\<sharp> Q2\"\n  shows \"(P1 \\<turnstile> Q1 \\<sqsubseteq> P2 \\<turnstile> Q2) \\<longleftrightarrow> (`P1 \\<Rightarrow> P2` \\<and> `P1 \\<and> Q2 \\<Rightarrow> Q1`)\"\nproof -\n  have \"(P1 \\<turnstile> Q1) \\<sqsubseteq> (P2 \\<turnstile> Q2) \\<longleftrightarrow> `($ok \\<and> P2 \\<Rightarrow> $ok\\<acute> \\<and> Q2) \\<Rightarrow> ($ok \\<and> P1 \\<Rightarrow> $ok\\<acute> \\<and> Q1)`\"\n    by (pred_auto)\n  also with assms have \"... = `(P2 \\<Rightarrow> $ok\\<acute> \\<and> Q2) \\<Rightarrow> (P1 \\<Rightarrow> $ok\\<acute> \\<and> Q1)`\"\n    by (subst subst_bool_split[of \"in_var ok\"], simp_all, subst_tac)\n  also with assms have \"... = `(\\<not> P2 \\<Rightarrow> \\<not> P1) \\<and> ((P2 \\<Rightarrow> Q2) \\<Rightarrow> P1 \\<Rightarrow> Q1)`\"\n    by (subst subst_bool_split[of \"out_var ok\"], simp_all, subst_tac)\n  also have \"... \\<longleftrightarrow> `(P1 \\<Rightarrow> P2)` \\<and> `P1 \\<and> Q2 \\<Rightarrow> Q1`\"\n    by (pred_auto)\n  finally show ?thesis .\nqed\n\ntheorem rdesign_refinement:\n  \"(P1 \\<turnstile>\\<^sub>r Q1 \\<sqsubseteq> P2 \\<turnstile>\\<^sub>r Q2) \\<longleftrightarrow> (`P1 \\<Rightarrow> P2` \\<and> `P1 \\<and> Q2 \\<Rightarrow> Q1`)\"\n  by (rel_auto)\n\nlemma design_refine_intro:\n  assumes \"`P1 \\<Rightarrow> P2`\" \"`P1 \\<and> Q2 \\<Rightarrow> Q1`\"\n  shows \"P1 \\<turnstile> Q1 \\<sqsubseteq> P2 \\<turnstile> Q2\"\n  using assms unfolding upred_defs\n  by (pred_auto)\n\nlemma design_refine_intro':\n  assumes \"P\\<^sub>2 \\<sqsubseteq> P\\<^sub>1\" \"Q\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)\"\n  shows \"P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<sqsubseteq> P\\<^sub>2 \\<turnstile> Q\\<^sub>2\"\n  using assms design_refine_intro[of P\\<^sub>1 P\\<^sub>2 Q\\<^sub>2 Q\\<^sub>1] by (simp add: refBy_order)\n\nlemma rdesign_refine_intro:\n  assumes \"`P1 \\<Rightarrow> P2`\" \"`P1 \\<and> Q2 \\<Rightarrow> Q1`\"\n  shows \"P1 \\<turnstile>\\<^sub>r Q1 \\<sqsubseteq> P2 \\<turnstile>\\<^sub>r Q2\"\n  using assms unfolding upred_defs\n  by (pred_auto)\n\nlemma ndesign_refine_intro:\n  assumes \"`p1 \\<Rightarrow> p2`\" \"`\\<lceil>p1\\<rceil>\\<^sub>< \\<and> Q2 \\<Rightarrow> Q1`\"\n  shows \"p1 \\<turnstile>\\<^sub>n Q1 \\<sqsubseteq> p2 \\<turnstile>\\<^sub>n Q2\"\n  using assms unfolding upred_defs\n  by (pred_auto)\n\nlemma design_subst [usubst]:\n  \"\\<lbrakk> $ok \\<sharp> \\<sigma>; $ok\\<acute> \\<sharp> \\<sigma> \\<rbrakk> \\<Longrightarrow> \\<sigma> \\<dagger> (P \\<turnstile> Q) = (\\<sigma> \\<dagger> P) \\<turnstile> (\\<sigma> \\<dagger> Q)\"\n  by (simp add: design_def usubst)\n\ntheorem design_ok_false [usubst]: \"(P \\<turnstile> Q)\\<lbrakk>false/$ok\\<rbrakk> = true\"\n  by (simp add: design_def usubst)\n\ntheorem design_npre:\n  \"(P \\<turnstile> Q)\\<^sup>f = (\\<not> $ok \\<or> \\<not> P\\<^sup>f)\"\n  by (rel_auto)\n\ntheorem design_pre:\n  \"\\<not> (P \\<turnstile> Q)\\<^sup>f = ($ok \\<and> P\\<^sup>f)\"\n  by (simp add: design_def, subst_tac)\n     (metis (no_types, hide_lams) not_conj_deMorgans true_not_false(2) utp_pred.compl_top_eq\n            utp_pred.sup.idem utp_pred.sup_compl_top)\n\ntheorem design_post:\n  \"(P \\<turnstile> Q)\\<^sup>t = (($ok \\<and> P\\<^sup>t) \\<Rightarrow> Q\\<^sup>t)\"\n  by (rel_auto)\n\ntheorem rdesign_pre [simp]: \"pre\\<^sub>D(P \\<turnstile>\\<^sub>r Q) = P\"\n  by (pred_auto)\n\ntheorem rdesign_post [simp]: \"post\\<^sub>D(P \\<turnstile>\\<^sub>r Q) = (P \\<Rightarrow> Q)\"\n  by (pred_auto)\n\ntheorem design_true_left_zero: \"(true ;; (P \\<turnstile> Q)) = true\"\nproof -\n  have \"(true ;; (P \\<turnstile> Q)) = (\\<^bold>\\<exists> ok\\<^sub>0 \\<bullet> true\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<acute>\\<rbrakk> ;; (P \\<turnstile> Q)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<rbrakk>)\"\n    by (subst seqr_middle[of ok], simp_all)\n  also have \"... = ((true\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; (P \\<turnstile> Q)\\<lbrakk>false/$ok\\<rbrakk>) \\<or> (true\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (P \\<turnstile> Q)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: disj_comm false_alt_def true_alt_def)\n  also have \"... = ((true\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; true\\<^sub>h) \\<or> (true ;; ((P \\<turnstile> Q)\\<lbrakk>true/$ok\\<rbrakk>)))\"\n    by (subst_tac, rel_auto)\n  also have \"... = true\"\n    by (subst_tac, simp add: precond_right_unit unrest)\n  finally show ?thesis .\nqed\n\ntheorem design_top_left_zero: \"(\\<top>\\<^sub>D ;; (P \\<turnstile> Q)) = \\<top>\\<^sub>D\"\n  by (rel_auto)\n\ntheorem design_choice:\n  \"(P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<sqinter> (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2) = ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<or> Q\\<^sub>2))\"\n  by (rel_auto)\n\ntheorem design_inf:\n  \"(P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<squnion> (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2) = ((P\\<^sub>1 \\<or> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>1 \\<Rightarrow> P\\<^sub>2) \\<and> (Q\\<^sub>1 \\<Rightarrow> Q\\<^sub>2)))\"\n  by (rel_auto)\n\ntheorem rdesign_choice:\n  \"(P\\<^sub>1 \\<turnstile>\\<^sub>r P\\<^sub>2) \\<sqinter> (Q\\<^sub>1 \\<turnstile>\\<^sub>r Q\\<^sub>2) = ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile>\\<^sub>r (P\\<^sub>2 \\<or> Q\\<^sub>2))\"\n  by (rel_auto)\n\ntheorem design_condr:\n  \"((P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<triangleleft> b \\<triangleright> (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2)) = ((P\\<^sub>1 \\<triangleleft> b \\<triangleright> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<triangleleft> b \\<triangleright> Q\\<^sub>2))\"\n  by (rel_auto)\n\nlemma design_top:\n  \"(P \\<turnstile> Q) \\<sqsubseteq> \\<top>\\<^sub>D\"\n  by (rel_auto)\n\nlemma design_bottom:\n  \"\\<bottom>\\<^sub>D \\<sqsubseteq> (P \\<turnstile> Q)\"\n  by simp\n\nlemma design_USUP:\n  assumes \"A \\<noteq> {}\"\n  shows \"(\\<Sqinter> i \\<in> A \\<bullet> P(i) \\<turnstile> Q(i)) = (\\<Squnion> i \\<in> A \\<bullet> P(i)) \\<turnstile> (\\<Sqinter> i \\<in> A \\<bullet> Q(i))\"\n  using assms by (rel_auto)\n\nlemma design_UINF:\n  \"(\\<Squnion> i \\<in> A \\<bullet> P(i) \\<turnstile> Q(i)) = (\\<Sqinter> i \\<in> A \\<bullet> P(i)) \\<turnstile> (\\<Squnion> i \\<in> A \\<bullet> P(i) \\<Rightarrow> Q(i))\"\n  by (rel_auto)\n\ntheorem design_composition_subst:\n  assumes\n    \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\"\n  shows \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) =\n         (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (\\<not> P2))) \\<turnstile> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; Q2\\<lbrakk>true/$ok\\<rbrakk>))\"\nproof -\n  have \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = (\\<^bold>\\<exists> ok\\<^sub>0 \\<bullet> ((P1 \\<turnstile> Q1)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<acute>\\<rbrakk> ;; (P2 \\<turnstile> Q2)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<rbrakk>))\"\n    by (rule seqr_middle, simp)\n  also have \" ...\n        = (((P1 \\<turnstile> Q1)\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; (P2 \\<turnstile> Q2)\\<lbrakk>false/$ok\\<rbrakk>)\n            \\<or> ((P1 \\<turnstile> Q1)\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (P2 \\<turnstile> Q2)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: true_alt_def false_alt_def, pred_auto)\n  also from assms\n  have \"... = ((($ok \\<and> P1 \\<Rightarrow> Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk>) ;; (P2 \\<Rightarrow> $ok\\<acute> \\<and> Q2\\<lbrakk>true/$ok\\<rbrakk>)) \\<or> ((\\<not> ($ok \\<and> P1)) ;; true))\"\n    by (simp add: design_def usubst unrest, pred_auto)\n  also have \"... = ((\\<not>$ok ;; true\\<^sub>h) \\<or> ((\\<not>P1) ;; true) \\<or> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (\\<not>P2)) \\<or> ($ok\\<acute> \\<and> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; Q2\\<lbrakk>true/$ok\\<rbrakk>)))\"\n    by (rel_auto)\n  also have \"... = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (\\<not> P2))) \\<turnstile> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; Q2\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: precond_right_unit design_def unrest, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma design_export_ok:\n  \"P \\<turnstile> Q = (P \\<turnstile> ($ok \\<and> Q))\"\n  by (rel_auto)\n\nlemma design_export_ok':\n  \"P \\<turnstile> Q = (P \\<turnstile> ($ok\\<acute> \\<and> Q))\"\n  by (rel_auto)\n\nlemma design_export_pre: \"P \\<turnstile> (P \\<and> Q) = P \\<turnstile> Q\"\n  by (rel_auto)\n\nlemma design_ok_pre_conj: \"($ok \\<and> P) \\<turnstile> Q = P \\<turnstile> Q\"\n  by (rel_auto)\n\ntheorem design_composition:\n  assumes\n    \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\"\n  shows \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile> (Q1 ;; Q2))\"\n  using assms by (simp add: design_composition_subst usubst)\n\nlemma runrest_ident_var:\n  assumes \"x \\<sharp>\\<sharp> P\"\n  shows \"($x \\<and> P) = (P \\<and> $x\\<acute>)\"\nproof -\n  have \"P = ($x\\<acute> =\\<^sub>u $x \\<and> P)\"\n    by (metis RID_def assms unrest_relation_def utp_pred.inf.cobounded2 utp_pred.inf_absorb2)\n  moreover have \"($x\\<acute> =\\<^sub>u $x \\<and> ($x \\<and> P)) = ($x\\<acute> =\\<^sub>u $x \\<and> (P \\<and> $x\\<acute>))\"\n    by (rel_auto)\n  ultimately show ?thesis\n    by (metis utp_pred.inf.assoc utp_pred.inf_left_commute)\nqed\n\ntheorem design_composition_runrest:\n  assumes\n    \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\" \"ok \\<sharp>\\<sharp> Q1\" \"ok \\<sharp>\\<sharp> Q2\"\n  shows \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1\\<^sup>t ;; (\\<not> P2))) \\<turnstile> (Q1 ;; Q2))\"\nproof -\n  have \"($ok \\<and> $ok\\<acute> \\<and> (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>)) = ($ok \\<and> $ok\\<acute> \\<and> (Q1 ;; Q2))\"\n  proof -\n    have \"($ok \\<and> $ok\\<acute> \\<and> (Q1 ;; Q2)) = (($ok \\<and> Q1) ;; (Q2 \\<and> $ok\\<acute>))\"\n      by (metis (no_types, lifting) conj_comm seqr_post_var_out seqr_pre_var_out)\n    also have \"... = ((Q1 \\<and> $ok\\<acute>) ;; ($ok \\<and> Q2))\"\n      by (simp add: assms(3) assms(4) runrest_ident_var)\n    also have \"... = (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>)\"\n      by (metis ok_vwb_lens seqr_pre_transfer seqr_right_one_point true_alt_def uovar_convr upred_eq_true utp_pred.inf.left_idem utp_urel_laws.unrest_ouvar vwb_lens_mwb)\n    finally show ?thesis\n      by (metis utp_pred.inf.left_commute utp_pred.inf_left_idem)\n  qed\n  moreover have \"(\\<not> (\\<not> P1 ;; true) \\<and> \\<not> (Q1\\<^sup>t ;; (\\<not> P2))) \\<turnstile> (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>) =\n                 (\\<not> (\\<not> P1 ;; true) \\<and> \\<not> (Q1\\<^sup>t ;; (\\<not> P2))) \\<turnstile> ($ok \\<and> $ok\\<acute> \\<and> (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (metis design_export_ok design_export_ok')\n  ultimately show ?thesis using assms\n    by (simp add: design_composition_subst usubst, metis design_export_ok design_export_ok')\nqed\n\ntheorem rdesign_composition:\n  \"((P1 \\<turnstile>\\<^sub>r Q1) ;; (P2 \\<turnstile>\\<^sub>r Q2)) = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile>\\<^sub>r (Q1 ;; Q2))\"\n  by (simp add: rdesign_def design_composition unrest alpha)\n\nlemma skip_d_alt_def: \"II\\<^sub>D = true \\<turnstile> II\"\n  by (rel_auto)\n\ntheorem design_skip_idem [simp]:\n  \"(II\\<^sub>D ;; II\\<^sub>D) = II\\<^sub>D\"\n  by (rel_auto)\n\ntheorem design_composition_cond:\n  assumes\n    \"out\\<alpha> \\<sharp> p1\" \"$ok \\<sharp> P2\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\"\n  shows \"((p1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = ((p1 \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile> (Q1 ;; Q2))\"\n  using assms\n  by (simp add: design_composition unrest precond_right_unit)\n\ntheorem rdesign_composition_cond:\n  assumes \"out\\<alpha> \\<sharp> p1\"\n  shows \"((p1 \\<turnstile>\\<^sub>r Q1) ;; (P2 \\<turnstile>\\<^sub>r Q2)) = ((p1 \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile>\\<^sub>r (Q1 ;; Q2))\"\n  using assms\n  by (simp add: rdesign_def design_composition_cond unrest alpha)\n\ntheorem design_composition_wp:\n  assumes\n    \"ok \\<sharp> p1\" \"ok \\<sharp> p2\"\n    \"$ok \\<sharp> Q1\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\" \"$ok\\<acute> \\<sharp> Q2\"\n  shows \"((\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile> Q1) ;; (\\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile> Q2)) = ((\\<lceil>p1 \\<and> Q1 wp p2\\<rceil>\\<^sub><) \\<turnstile> (Q1 ;; Q2))\"\n  using assms by (rel_blast)\n\ntheorem rdesign_composition_wp:\n  \"((\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q1) ;; (\\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q2)) = ((\\<lceil>p1 \\<and> Q1 wp p2\\<rceil>\\<^sub><) \\<turnstile>\\<^sub>r (Q1 ;; Q2))\"\n  by (rel_blast)\n\ntheorem ndesign_composition_wp:\n  \"((p1 \\<turnstile>\\<^sub>n Q1) ;; (p2 \\<turnstile>\\<^sub>n Q2)) = ((p1 \\<and> Q1 wp p2) \\<turnstile>\\<^sub>n (Q1 ;; Q2))\"\n  by (rel_blast)\n\ntheorem rdesign_wp [wp]:\n  \"(\\<lceil>p\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q) wp\\<^sub>D r = (p \\<and> Q wp r)\"\n  by (rel_auto)\n\ntheorem ndesign_wp [wp]:\n  \"(p \\<turnstile>\\<^sub>n Q) wp\\<^sub>D r = (p \\<and> Q wp r)\"\n  by (simp add: ndesign_def rdesign_wp)\n\ntheorem wpd_seq_r:\n  fixes Q1 Q2 :: \"'\\<alpha> hrel\"\n  shows \"(\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q1 ;; \\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q2) wp\\<^sub>D r = (\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q1) wp\\<^sub>D ((\\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q2) wp\\<^sub>D r)\"\n  apply (simp add: wp)\n  apply (subst rdesign_composition_wp)\n  apply (simp only: wp)\n  apply (rel_auto)\ndone\n\ntheorem wpnd_seq_r [wp]:\n  fixes Q1 Q2 :: \"'\\<alpha> hrel\"\n  shows \"(p1 \\<turnstile>\\<^sub>n Q1 ;; p2 \\<turnstile>\\<^sub>n Q2) wp\\<^sub>D r = (p1 \\<turnstile>\\<^sub>n Q1) wp\\<^sub>D ((p2 \\<turnstile>\\<^sub>n Q2) wp\\<^sub>D r)\"\n  by (simp add: ndesign_def wpd_seq_r)\n\nlemma design_subst_ok:\n  \"(P\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> Q\\<lbrakk>true/$ok\\<rbrakk>) = (P \\<turnstile> Q)\"\n  by (rel_auto)\n\nlemma design_subst_ok_ok':\n  \"(P\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> Q\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>) = (P \\<turnstile> Q)\"\nproof -\n  have \"(P \\<turnstile> Q) = (($ok \\<and> P) \\<turnstile> ($ok \\<and> $ok\\<acute> \\<and> Q))\"\n    by (pred_auto)\n  also have \"... = (($ok \\<and> P\\<lbrakk>true/$ok\\<rbrakk>) \\<turnstile> ($ok \\<and> ($ok\\<acute> \\<and> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (metis conj_eq_out_var_subst conj_pos_var_subst upred_eq_true utp_pred.inf_commute ok_vwb_lens)\n  also have \"... = (($ok \\<and> P\\<lbrakk>true/$ok\\<rbrakk>) \\<turnstile> ($ok \\<and> $ok\\<acute> \\<and> Q\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>))\"\n    by (simp add: usubst)\n  also have \"... = (P\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> Q\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>)\"\n    by (pred_auto)\n  finally show ?thesis ..\nqed\n\nlemma design_subst_ok':\n  \"(P \\<turnstile> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>) = (P \\<turnstile> Q)\"\nproof -\n  have \"(P \\<turnstile> Q) = (P \\<turnstile> ($ok\\<acute> \\<and> Q))\"\n    by (pred_auto)\n  also have \"... = (P \\<turnstile> ($ok\\<acute> \\<and> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>))\"\n    by (metis conj_eq_out_var_subst upred_eq_true utp_pred.inf_commute ok_vwb_lens)\n  also have \"... = (P \\<turnstile> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>)\"\n    by (pred_auto)\n  finally show ?thesis ..\nqed\n\ntheorem design_left_unit_hom:\n  fixes P Q :: \"'\\<alpha> hrel_des\"\n  shows \"(II\\<^sub>D ;; P \\<turnstile>\\<^sub>r Q) = (P \\<turnstile>\\<^sub>r Q)\"\nproof -\n  have \"(II\\<^sub>D ;; P \\<turnstile>\\<^sub>r Q) = (true \\<turnstile>\\<^sub>r II ;; P \\<turnstile>\\<^sub>r Q)\"\n    by (simp add: skip_d_def)\n  also have \"... = (true \\<and> \\<not> (II ;; (\\<not> P))) \\<turnstile>\\<^sub>r (II ;; Q)\"\n  proof -\n    have \"out\\<alpha> \\<sharp> true\"\n      by unrest_tac\n    thus ?thesis\n      using rdesign_composition_cond by blast\n  qed\n  also have \"... = (\\<not> (\\<not> P)) \\<turnstile>\\<^sub>r Q\"\n    by simp\n  finally show ?thesis by simp\nqed\n\ntheorem design_left_unit [simp]:\n  \"(II\\<^sub>D ;; P \\<turnstile>\\<^sub>r Q) = (P \\<turnstile>\\<^sub>r Q)\"\n  by (rel_auto)\n\ntheorem design_right_semi_unit:\n  \"(P \\<turnstile>\\<^sub>r Q ;; II\\<^sub>D) = ((\\<not> (\\<not> P) ;; true) \\<turnstile>\\<^sub>r Q)\"\n  by (simp add: skip_d_def rdesign_composition)\n\ntheorem design_right_cond_unit [simp]:\n  assumes \"out\\<alpha> \\<sharp> p\"\n  shows \"(p \\<turnstile>\\<^sub>r Q ;; II\\<^sub>D) = (p \\<turnstile>\\<^sub>r Q)\"\n  using assms\n  by (simp add: skip_d_def rdesign_composition_cond)\n\nlemma lift_des_skip_dr_unit [simp]:\n  \"(\\<lceil>P\\<rceil>\\<^sub>D ;; \\<lceil>II\\<rceil>\\<^sub>D) = \\<lceil>P\\<rceil>\\<^sub>D\"\n  \"(\\<lceil>II\\<rceil>\\<^sub>D ;; \\<lceil>P\\<rceil>\\<^sub>D) = \\<lceil>P\\<rceil>\\<^sub>D\"\n  by (rel_auto)+\n\nlemma assigns_d_id [simp]: \"\\<langle>id\\<rangle>\\<^sub>D = II\\<^sub>D\"\n  by (rel_auto)\n\nlemma assign_d_left_comp:\n  \"(\\<langle>f\\<rangle>\\<^sub>D ;; (P \\<turnstile>\\<^sub>r Q)) = (\\<lceil>f\\<rceil>\\<^sub>s \\<dagger> P \\<turnstile>\\<^sub>r \\<lceil>f\\<rceil>\\<^sub>s \\<dagger> Q)\"\n  by (simp add: assigns_d_def rdesign_composition assigns_r_comp subst_not)\n\nlemma assign_d_right_comp:\n  \"((P \\<turnstile>\\<^sub>r Q) ;; \\<langle>f\\<rangle>\\<^sub>D) = ((\\<not> ((\\<not> P) ;; true)) \\<turnstile>\\<^sub>r (Q ;; \\<langle>f\\<rangle>\\<^sub>a))\"\n  by (simp add: assigns_d_def rdesign_composition)\n\nlemma assigns_d_comp:\n  \"(\\<langle>f\\<rangle>\\<^sub>D ;; \\<langle>g\\<rangle>\\<^sub>D) = \\<langle>g \\<circ> f\\<rangle>\\<^sub>D\"\n  by (simp add: assigns_d_def rdesign_composition assigns_comp)\n\nsubsection {* Design preconditions *}\n\nlemma design_pre_choice [simp]:\n  \"pre\\<^sub>D(P \\<sqinter> Q) = (pre\\<^sub>D(P) \\<and> pre\\<^sub>D(Q))\"\n  by (rel_auto)\n\nlemma design_post_choice [simp]:\n  \"post\\<^sub>D(P \\<sqinter> Q) = (post\\<^sub>D(P) \\<or> post\\<^sub>D(Q))\"\n  by (rel_auto)\n\nlemma design_pre_condr [simp]:\n  \"pre\\<^sub>D(P \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>D \\<triangleright> Q) = (pre\\<^sub>D(P) \\<triangleleft> b \\<triangleright> pre\\<^sub>D(Q))\"\n  by (rel_auto)\n\nlemma design_post_condr [simp]:\n  \"post\\<^sub>D(P \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>D \\<triangleright> Q) = (post\\<^sub>D(P) \\<triangleleft> b \\<triangleright> post\\<^sub>D(Q))\"\n  by (rel_auto)\n\nsubsection {* H1: No observation is allowed before initiation *}\n\nlemma H1_idem:\n  \"H1 (H1 P) = H1(P)\"\n  by (pred_auto)\n\nlemma H1_monotone:\n  \"P \\<sqsubseteq> Q \\<Longrightarrow> H1(P) \\<sqsubseteq> H1(Q)\"\n  by (pred_auto)\n\nlemma H1_Continuous: \"Continuous H1\"\n  by (rel_auto)\n\nlemma H1_below_top:\n  \"H1(P) \\<sqsubseteq> \\<top>\\<^sub>D\"\n  by (pred_auto)\n\nlemma H1_design_skip:\n  \"H1(II) = II\\<^sub>D\"\n  by (rel_auto)\n\nlemma H1_cond: \"H1(P \\<triangleleft> b \\<triangleright> Q) = H1(P) \\<triangleleft> b \\<triangleright> H1(Q)\"\n  by (rel_auto)\n\nlemma H1_conj: \"H1(P \\<and> Q) = (H1(P) \\<and> H1(Q))\"\n  by (rel_auto)\n\nlemma H1_disj: \"H1(P \\<or> Q) = (H1(P) \\<or> H1(Q))\"\n  by (rel_auto)\n\nlemma design_export_H1: \"(P \\<turnstile> Q) = (P \\<turnstile> H1(Q))\"\n  by (rel_auto)\n\ntext {* The H1 algebraic laws are valid only when $\\alpha(R)$ is homogeneous. This should maybe be\n        generalised. *}\n\ntheorem H1_algebraic_intro:\n  assumes\n    \"(true\\<^sub>h ;; R) = true\\<^sub>h\"\n    \"(II\\<^sub>D ;; R) = R\"\n  shows \"R is H1\"\nproof -\n  have \"R = (II\\<^sub>D ;; R)\" by (simp add: assms(2))\n  also have \"... = (H1(II) ;; R)\"\n    by (simp add: H1_design_skip)\n  also have \"... = (($ok \\<Rightarrow> II) ;; R)\"\n    by (simp add: H1_def)\n  also have \"... = (((\\<not> $ok) ;; R) \\<or> R)\"\n    by (simp add: impl_alt_def seqr_or_distl)\n  also have \"... = ((((\\<not> $ok) ;; true\\<^sub>h) ;; R) \\<or> R)\"\n    by (simp add: precond_right_unit unrest)\n  also have \"... = (((\\<not> $ok) ;; true\\<^sub>h) \\<or> R)\"\n    by (metis assms(1) seqr_assoc)\n  also have \"... = ($ok \\<Rightarrow> R)\"\n    by (simp add: impl_alt_def precond_right_unit unrest)\n  finally show ?thesis by (metis H1_def Healthy_def')\nqed\n\nlemma nok_not_false:\n  \"(\\<not> $ok) \\<noteq> false\"\n  by (pred_auto)\n\ntheorem H1_left_zero:\n  assumes \"P is H1\"\n  shows \"(true ;; P) = true\"\nproof -\n  from assms have \"(true ;; P) = (true ;; ($ok \\<Rightarrow> P))\"\n    by (simp add: H1_def Healthy_def')\n  (* The next step ensures we get the right alphabet for true by copying it *)\n  also from assms have \"... = (true ;; (\\<not> $ok \\<or> P))\" (is \"_ = (?true ;; _)\")\n    by (simp add: impl_alt_def)\n  also from assms have \"... = ((?true ;; (\\<not> $ok)) \\<or> (?true ;; P))\"\n    using seqr_or_distr by blast\n  also from assms have \"... = (true \\<or> (true ;; P))\"\n    by (simp add: nok_not_false precond_left_zero unrest)\n  finally show ?thesis\n    by (simp add: upred_defs urel_defs)\nqed\n\ntheorem H1_left_unit:\n  fixes P :: \"'\\<alpha> hrel_des\"\n  assumes \"P is H1\"\n  shows \"(II\\<^sub>D ;; P) = P\"\nproof -\n  have \"(II\\<^sub>D ;; P) = (($ok \\<Rightarrow> II) ;; P)\"\n    by (metis H1_def H1_design_skip)\n  also have \"... = (((\\<not> $ok) ;; P) \\<or> P)\"\n    by (simp add: impl_alt_def seqr_or_distl)\n  also from assms have \"... = ((((\\<not> $ok) ;; true\\<^sub>h) ;; P) \\<or> P)\"\n    by (simp add: precond_right_unit unrest)\n  also have \"... = (((\\<not> $ok) ;; (true\\<^sub>h ;; P)) \\<or> P)\"\n    by (simp add: seqr_assoc)\n  also from assms have \"... = ($ok \\<Rightarrow> P)\"\n    by (simp add: H1_left_zero impl_alt_def precond_right_unit unrest)\n  finally show ?thesis using assms\n    by (simp add: H1_def Healthy_def')\nqed\n\ntheorem H1_algebraic:\n  \"P is H1 \\<longleftrightarrow> (true\\<^sub>h ;; P) = true\\<^sub>h \\<and> (II\\<^sub>D ;; P) = P\"\n  using H1_algebraic_intro H1_left_unit H1_left_zero by blast\n\ntheorem H1_nok_left_zero:\n  fixes P :: \"'\\<alpha> hrel_des\"\n  assumes \"P is H1\"\n  shows \"((\\<not> $ok) ;; P) = (\\<not> $ok)\"\nproof -\n  have \"((\\<not> $ok) ;; P) = (((\\<not> $ok) ;; true\\<^sub>h) ;; P)\"\n    by (simp add: precond_right_unit unrest)\n  also have \"... = ((\\<not> $ok) ;; true\\<^sub>h)\"\n    by (metis H1_left_zero assms seqr_assoc)\n  also have \"... = (\\<not> $ok)\"\n    by (simp add: precond_right_unit unrest)\n  finally show ?thesis .\nqed\n\nlemma H1_design:\n  \"H1(P \\<turnstile> Q) = (P \\<turnstile> Q)\"\n  by (rel_auto)\n\nlemma H1_rdesign:\n  \"H1(P \\<turnstile>\\<^sub>r Q) = (P \\<turnstile>\\<^sub>r Q)\"\n  by (rel_auto)\n\nlemma H1_choice_closed:\n  \"\\<lbrakk> P is H1; Q is H1 \\<rbrakk> \\<Longrightarrow> P \\<sqinter> Q is H1\"\n  by (simp add: H1_def Healthy_def' disj_upred_def impl_alt_def semilattice_sup_class.sup_left_commute)\n\nlemma H1_inf_closed:\n  \"\\<lbrakk> P is H1; Q is H1 \\<rbrakk> \\<Longrightarrow> P \\<squnion> Q is H1\"\n  by (rel_blast)\n\nlemma H1_USUP:\n  assumes \"A \\<noteq> {}\"\n  shows \"H1(\\<Sqinter> i \\<in> A \\<bullet> P(i)) = (\\<Sqinter> i \\<in> A \\<bullet> H1(P(i)))\"\n  using assms by (rel_auto)\n\nlemma H1_Sup:\n  assumes \"A \\<noteq> {}\" \"\\<forall> P \\<in> A. P is H1\"\n  shows \"(\\<Sqinter> A) is H1\"\nproof -\n  from assms(2) have \"H1 ` A = A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  with H1_USUP[of A id, OF assms(1)] show ?thesis\n    using assms\n    by (simp add: USUP_as_Sup_image Healthy_def)\nqed\n\nlemma H1_UINF:\n  shows \"H1(\\<Squnion> i \\<in> A \\<bullet> P(i)) = (\\<Squnion> i \\<in> A \\<bullet> H1(P(i)))\"\n  by (rel_auto)\n\nlemma H1_Inf:\n  assumes \"\\<forall> P \\<in> A. P is H1\"\n  shows \"(\\<Squnion> A) is H1\"\nproof -\n  from assms have \"H1 ` A = A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  with H1_UINF[of A id] show ?thesis\n    using assms\n    by (simp add: UINF_as_Inf_image Healthy_def)\nqed\n\nsubsection {* H2: A specification cannot require non-termination *}\n\nlemma J_split:\n  shows \"(P ;; J) = (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))\"\nproof -\n  have \"(P ;; J) = (P ;; (($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D))\"\n    by (simp add: H2_def J_def design_def)\n  also have \"... = (P ;; (($ok \\<Rightarrow> $ok \\<and> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D))\"\n    by (rel_auto)\n  also have \"... = ((P ;; (\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D)) \\<or> (P ;; ($ok \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<and> $ok\\<acute>))))\"\n    by (rel_auto)\n  also have \"... = (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))\"\n  proof -\n    have \"(P ;; (\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D)) = P\\<^sup>f\"\n    proof -\n      have \"(P ;; (\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D)) = ((P \\<and> \\<not> $ok\\<acute>) ;; \\<lceil>II\\<rceil>\\<^sub>D)\"\n        by (rel_auto)\n      also have \"... = (\\<exists> $ok\\<acute> \\<bullet> P \\<and> $ok\\<acute> =\\<^sub>u false)\"\n        by (rel_auto)\n      also have \"... = P\\<^sup>f\"\n        by (metis C1 one_point out_var_uvar unrest_as_exists ok_vwb_lens vwb_lens_mwb)\n     finally show ?thesis .\n    qed\n    moreover have \"(P ;; ($ok \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<and> $ok\\<acute>))) = (P\\<^sup>t \\<and> $ok\\<acute>)\"\n    proof -\n      have \"(P ;; ($ok \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<and> $ok\\<acute>))) = (P ;; ($ok \\<and> II))\"\n        by (rel_auto)\n      also have \"... = (P\\<^sup>t \\<and> $ok\\<acute>)\"\n        by (rel_auto)\n      finally show ?thesis .\n    qed\n    ultimately show ?thesis\n      by simp\n  qed\n  finally show ?thesis .\nqed\n\nlemma H2_split:\n  shows \"H2(P) = (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))\"\n  by (simp add: H2_def J_split)\n\ntheorem H2_equivalence:\n  \"P is H2 \\<longleftrightarrow> `P\\<^sup>f \\<Rightarrow> P\\<^sup>t`\"\nproof -\n  have \"`P \\<Leftrightarrow> (P ;; J)` \\<longleftrightarrow> `P \\<Leftrightarrow> (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))`\"\n    by (simp add: J_split)\n  also have \"... \\<longleftrightarrow> `(P \\<Leftrightarrow> P\\<^sup>f \\<or> P\\<^sup>t \\<and> $ok\\<acute>)\\<^sup>f \\<and> (P \\<Leftrightarrow> P\\<^sup>f \\<or> P\\<^sup>t \\<and> $ok\\<acute>)\\<^sup>t`\"\n    by (simp add: subst_bool_split)\n  also have \"... = `(P\\<^sup>f \\<Leftrightarrow> P\\<^sup>f) \\<and> (P\\<^sup>t \\<Leftrightarrow> P\\<^sup>f \\<or> P\\<^sup>t)`\"\n    by subst_tac\n  also have \"... = `P\\<^sup>t \\<Leftrightarrow> (P\\<^sup>f \\<or> P\\<^sup>t)`\"\n    by (pred_auto robust)\n  also have \"... = `(P\\<^sup>f \\<Rightarrow> P\\<^sup>t)`\"\n    by (pred_auto)\n  finally show ?thesis\n    by (metis H2_def Healthy_def' taut_iff_eq)\nqed\n\nlemma H2_equiv:\n  \"P is H2 \\<longleftrightarrow> P\\<^sup>t \\<sqsubseteq> P\\<^sup>f\"\n  using H2_equivalence refBy_order by blast\n\nlemma H2_design:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\"\n  shows \"H2(P \\<turnstile> Q) = P \\<turnstile> Q\"\n  using assms\n  by (simp add: H2_split design_def usubst unrest, pred_auto)\n\nlemma H2_rdesign:\n  \"H2(P \\<turnstile>\\<^sub>r Q) = P \\<turnstile>\\<^sub>r Q\"\n  by (simp add: H2_design unrest rdesign_def)\n\ntheorem J_idem:\n  \"(J ;; J) = J\"\n  by (rel_auto)\n\ntheorem H2_idem:\n  \"H2(H2(P)) = H2(P)\"\n  by (metis H2_def J_idem seqr_assoc)\n\ntheorem H2_Continuous: \"Continuous H2\"\n  by (rel_auto)\n\ntheorem H2_not_okay: \"H2 (\\<not> $ok) = (\\<not> $ok)\"\nproof -\n  have \"H2 (\\<not> $ok) = ((\\<not> $ok)\\<^sup>f \\<or> ((\\<not> $ok)\\<^sup>t \\<and> $ok\\<acute>))\"\n    by (simp add: H2_split)\n  also have \"... = (\\<not> $ok \\<or> (\\<not> $ok) \\<and> $ok\\<acute>)\"\n    by (subst_tac)\n  also have \"... = (\\<not> $ok)\"\n    by (pred_auto)\n  finally show ?thesis .\nqed\n\nlemma H2_true: \"H2(true) = true\"\n  by (rel_auto)\n\nlemma H2_choice_closed:\n  \"\\<lbrakk> P is H2; Q is H2 \\<rbrakk> \\<Longrightarrow> P \\<sqinter> Q is H2\"\n  by (metis H2_def Healthy_def' disj_upred_def seqr_or_distl)\n\nlemma H2_inf_closed:\n  assumes \"P is H2\" \"Q is H2\"\n  shows \"P \\<squnion> Q is H2\"\nproof -\n  have \"P \\<squnion> Q = (P\\<^sup>f \\<or> P\\<^sup>t \\<and> $ok\\<acute>) \\<squnion> (Q\\<^sup>f \\<or> Q\\<^sup>t \\<and> $ok\\<acute>)\"\n    by (metis H2_def Healthy_def J_split assms(1) assms(2))\n  moreover have \"H2(...) = ...\"\n    by (simp add: H2_split usubst, pred_auto)\n  ultimately show ?thesis\n    by (simp add: Healthy_def)\nqed\n\nlemma H2_USUP:\n  shows \"H2(\\<Sqinter> i \\<in> A \\<bullet> P(i)) = (\\<Sqinter> i \\<in> A \\<bullet> H2(P(i)))\"\n  by (rel_auto)\n\ntheorem H1_H2_commute:\n  \"H1 (H2 P) = H2 (H1 P)\"\nproof -\n  have \"H2 (H1 P) = (($ok \\<Rightarrow> P) ;; J)\"\n    by (simp add: H1_def H2_def)\n  also have \"... = ((\\<not> $ok \\<or> P) ;; J)\"\n    by (rel_auto)\n  also have \"... = (((\\<not> $ok) ;; J) \\<or> (P ;; J))\"\n    using seqr_or_distl by blast\n  also have \"... =  ((H2 (\\<not> $ok)) \\<or> H2(P))\"\n    by (simp add: H2_def)\n  also have \"... =  ((\\<not> $ok) \\<or> H2(P))\"\n    by (simp add: H2_not_okay)\n  also have \"... = H1(H2(P))\"\n    by (rel_auto)\n  finally show ?thesis by simp\nqed\n\nlemma ok_pre: \"($ok \\<and> \\<lceil>pre\\<^sub>D(P)\\<rceil>\\<^sub>D) = ($ok \\<and> (\\<not> P\\<^sup>f))\"\n  by (pred_auto robust)\n\nlemma ok_post: \"($ok \\<and> \\<lceil>post\\<^sub>D(P)\\<rceil>\\<^sub>D) = ($ok \\<and> (P\\<^sup>t))\"\n  by (pred_auto robust)\n\nabbreviation \"H1_H2 P \\<equiv> H1 (H2 P)\"\n\nnotation H1_H2 (\"\\<^bold>H\")\n\nlemma H1_H2_comp: \"\\<^bold>H = H1 \\<circ> H2\"\n  by (auto)\n\ntheorem H1_H2_eq_design:\n  \"\\<^bold>H(P) = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\nproof -\n  have \"\\<^bold>H(P) = ($ok \\<Rightarrow> H2(P))\"\n    by (simp add: H1_def)\n  also have \"... = ($ok \\<Rightarrow> (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>)))\"\n    by (metis H2_split)\n  also have \"... = ($ok \\<and> (\\<not> P\\<^sup>f) \\<Rightarrow> $ok\\<acute> \\<and> $ok \\<and> P\\<^sup>t)\"\n    by (rel_auto)\n  also have \"... = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\ntheorem H1_H2_is_design:\n  assumes \"P is H1\" \"P is H2\"\n  shows \"P = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\n  using assms by (metis H1_H2_eq_design Healthy_def)\n\ntheorem H1_H2_eq_rdesign:\n  \"\\<^bold>H(P) = pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\nproof -\n  have \"\\<^bold>H(P) = ($ok \\<Rightarrow> H2(P))\"\n    by (simp add: H1_def Healthy_def')\n  also have \"... = ($ok \\<Rightarrow> (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>)))\"\n    by (metis H2_split)\n  also have \"... = ($ok \\<and> (\\<not> P\\<^sup>f) \\<Rightarrow> $ok\\<acute> \\<and> P\\<^sup>t)\"\n    by (pred_auto)\n  also have \"... = ($ok \\<and> (\\<not> P\\<^sup>f) \\<Rightarrow> $ok\\<acute> \\<and> $ok \\<and> P\\<^sup>t)\"\n    by (pred_auto)\n  also have \"... = ($ok \\<and> \\<lceil>pre\\<^sub>D(P)\\<rceil>\\<^sub>D \\<Rightarrow> $ok\\<acute> \\<and> $ok \\<and> \\<lceil>post\\<^sub>D(P)\\<rceil>\\<^sub>D)\"\n    by (simp add: ok_post ok_pre)\n  also have \"... = ($ok \\<and> \\<lceil>pre\\<^sub>D(P)\\<rceil>\\<^sub>D \\<Rightarrow> $ok\\<acute> \\<and> \\<lceil>post\\<^sub>D(P)\\<rceil>\\<^sub>D)\"\n    by (pred_auto)\n  also have \"... =  pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\n    by (simp add: rdesign_def design_def)\n  finally show ?thesis .\nqed\n\ntheorem H1_H2_is_rdesign:\n  assumes \"P is H1\" \"P is H2\"\n  shows \"P = pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\n  by (metis H1_H2_eq_rdesign Healthy_def assms(1) assms(2))\n\nlemma H1_H2_idempotent: \"\\<^bold>H (\\<^bold>H P) = \\<^bold>H P\"\n  by (simp add: H1_H2_commute H1_idem H2_idem)\n\nlemma H1_H2_Idempotent: \"Idempotent \\<^bold>H\"\n  by (simp add: Idempotent_def H1_H2_idempotent)\n\nlemma H1_H2_monotonic: \"Monotonic \\<^bold>H\"\n  by (simp add: H1_monotone H2_def Monotonic_def seqr_mono)\n\nlemma H1_H2_Continuous: \"Continuous \\<^bold>H\"\n  by (simp add: Continuous_comp H1_Continuous H1_H2_comp H2_Continuous)\n\nlemma design_is_H1_H2 [closure]:\n  \"\\<lbrakk> $ok\\<acute> \\<sharp> P; $ok\\<acute> \\<sharp> Q \\<rbrakk> \\<Longrightarrow> (P \\<turnstile> Q) is \\<^bold>H\"\n  by (simp add: H1_design H2_design Healthy_def')\n\nlemma rdesign_is_H1_H2 [closure]:\n  \"(P \\<turnstile>\\<^sub>r Q) is \\<^bold>H\"\n  by (simp add: Healthy_def H1_rdesign H2_rdesign)\n\nlemma assigns_d_is_H1_H2 [closure]:\n  \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D is \\<^bold>H\"\n  by (simp add: assigns_d_def rdesign_is_H1_H2)\n\nlemma seq_r_H1_H2_closed [closure]:\n  assumes \"P is \\<^bold>H\" \"Q is \\<^bold>H\"\n  shows \"(P ;; Q) is \\<^bold>H\"\nproof -\n  obtain P\\<^sub>1 P\\<^sub>2 where \"P = P\\<^sub>1 \\<turnstile>\\<^sub>r P\\<^sub>2\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def assms(1))\n  moreover obtain Q\\<^sub>1 Q\\<^sub>2 where \"Q = Q\\<^sub>1 \\<turnstile>\\<^sub>r Q\\<^sub>2\"\n   by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def assms(2))\n  moreover have \"((P\\<^sub>1 \\<turnstile>\\<^sub>r P\\<^sub>2) ;; (Q\\<^sub>1 \\<turnstile>\\<^sub>r Q\\<^sub>2)) is \\<^bold>H\"\n    by (simp add: rdesign_composition rdesign_is_H1_H2)\n  ultimately show ?thesis by simp\nqed\n\nlemma assigns_d_comp_ext:\n  fixes P :: \"'\\<alpha> hrel_des\"\n  assumes \"P is \\<^bold>H\"\n  shows \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; P) = \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> P\"\nproof -\n  have \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; P) = (\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P))\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def' assms)\n  also have \"... = \\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> pre\\<^sub>D(P) \\<turnstile>\\<^sub>r \\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> post\\<^sub>D(P)\"\n    by (simp add: assign_d_left_comp)\n  also have \"... = \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> (pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P))\"\n    by (rel_auto)\n  also have \"... = \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> P\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def' assms)\n  finally show ?thesis .\nqed\n\nlemma USUP_H1_H2_closed:\n  assumes \"A \\<noteq> {}\" \"\\<forall> P \\<in> A. P is \\<^bold>H\"\n  shows \"(\\<Sqinter> A) is H1_H2\"\nproof -\n  from assms have A: \"A = H1_H2 ` A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  also have \"(\\<Sqinter> ...) = (\\<Sqinter> P \\<in> A \\<bullet> H1_H2(P))\"\n    by (simp add: USUP_as_Sup_collect)\n  also have \"... = (\\<Sqinter> P \\<in> A \\<bullet> (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t)\"\n    by (meson H1_H2_eq_design)\n  also have \"... = (\\<Squnion> P \\<in> A \\<bullet> \\<not> P\\<^sup>f) \\<turnstile> (\\<Sqinter> P \\<in> A \\<bullet> P\\<^sup>t)\"\n    by (simp add: design_USUP assms)\n  also have \"... is H1_H2\"\n    by (simp add: design_is_H1_H2 unrest)\n  finally show ?thesis .\nqed\n\ndefinition design_sup :: \"('\\<alpha>, '\\<beta>) rel_des set \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (\"\\<Sqinter>\\<^sub>D_\" [900] 900) where\n\"\\<Sqinter>\\<^sub>D A = (if (A = {}) then \\<top>\\<^sub>D else \\<Sqinter> A)\"\n\nlemma design_sup_H1_H2_closed:\n  assumes \"\\<forall> P \\<in> A. P is \\<^bold>H\"\n  shows \"(\\<Sqinter>\\<^sub>D A) is \\<^bold>H\"\n  apply (auto simp add: design_sup_def)\n  apply (simp add: H1_def H2_not_okay Healthy_def impl_alt_def)\n  using USUP_H1_H2_closed assms apply blast\ndone\n\nlemma design_sup_empty [simp]: \"\\<Sqinter>\\<^sub>D {} = \\<top>\\<^sub>D\"\n  by (simp add: design_sup_def)\n\nlemma design_sup_non_empty [simp]: \"A \\<noteq> {} \\<Longrightarrow> \\<Sqinter>\\<^sub>D A = \\<Sqinter> A\"\n  by (simp add: design_sup_def)\n\nlemma UINF_H1_H2_closed:\n  assumes \"\\<forall> P \\<in> A. P is \\<^bold>H\"\n  shows \"(\\<Squnion> A) is \\<^bold>H\"\nproof -\n  from assms have A: \"A = \\<^bold>H ` A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  also have \"(\\<Squnion> ...) = (\\<Squnion> P \\<in> A \\<bullet> \\<^bold>H(P))\"\n    by (simp add: UINF_as_Inf_collect)\n  also have \"... = (\\<Squnion> P \\<in> A \\<bullet> (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t)\"\n    by (meson H1_H2_eq_design)\n  also have \"... = (\\<Sqinter> P \\<in> A \\<bullet> \\<not> P\\<^sup>f) \\<turnstile> (\\<Squnion> P \\<in> A \\<bullet> \\<not> P\\<^sup>f \\<Rightarrow> P\\<^sup>t)\"\n    by (simp add: design_UINF)\n  also have \"... is \\<^bold>H\"\n    by (simp add: design_is_H1_H2 unrest)\n  finally show ?thesis .\nqed\n\nabbreviation design_inf :: \"('\\<alpha>, '\\<beta>) rel_des set \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (\"\\<Squnion>\\<^sub>D_\" [900] 900) where\n\"\\<Squnion>\\<^sub>D A \\<equiv> \\<Squnion> A\"\n\nsubsection {* H3: The design assumption is a precondition *}\n\ntheorem H3_idem:\n  \"H3(H3(P)) = H3(P)\"\n  by (metis H3_def design_skip_idem seqr_assoc)\n\ntheorem H3_mono:\n  \"P \\<sqsubseteq> Q \\<Longrightarrow> H3(P) \\<sqsubseteq> H3(Q)\"\n  by (simp add: H3_def seqr_mono)\n\ntheorem H3_Monotonic:\n  \"Monotonic H3\"\n  by (simp add: H3_mono Monotonic_def)\n\ntheorem H3_Continuous: \"Continuous H3\"\n  by (rel_auto)\n\ntheorem design_condition_is_H3:\n  assumes \"out\\<alpha> \\<sharp> p\"\n  shows \"(p \\<turnstile> Q) is H3\"\nproof -\n  have \"((p \\<turnstile> Q) ;; II\\<^sub>D) = (\\<not> ((\\<not> p) ;; true)) \\<turnstile> (Q\\<^sup>t ;; II\\<lbrakk>true/$ok\\<rbrakk>)\"\n    by (simp add: skip_d_alt_def design_composition_subst unrest assms)\n  also have \"... = p \\<turnstile> (Q\\<^sup>t ;; II\\<lbrakk>true/$ok\\<rbrakk>)\"\n    using assms precond_equiv seqr_true_lemma by force\n  also have \"... = p \\<turnstile> Q\"\n    by (rel_auto)\n  finally show ?thesis\n    by (simp add: H3_def Healthy_def')\nqed\n\ntheorem rdesign_H3_iff_pre:\n  \"P \\<turnstile>\\<^sub>r Q is H3 \\<longleftrightarrow> P = (P ;; true)\"\nproof -\n  have \"(P \\<turnstile>\\<^sub>r Q ;; II\\<^sub>D) = (P \\<turnstile>\\<^sub>r Q ;; true \\<turnstile>\\<^sub>r II)\"\n    by (simp add: skip_d_def)\n  also have \"... = (\\<not> ((\\<not> P) ;; true) \\<and> \\<not> (Q ;; (\\<not> true))) \\<turnstile>\\<^sub>r (Q ;; II)\"\n    by (simp add: rdesign_composition)\n  also have \"... = (\\<not> ((\\<not> P) ;; true) \\<and> \\<not> (Q ;; (\\<not> true))) \\<turnstile>\\<^sub>r Q\"\n    by simp\n  also have \"... = (\\<not> ((\\<not> P) ;; true)) \\<turnstile>\\<^sub>r Q\"\n    by (pred_auto)\n  finally have \"P \\<turnstile>\\<^sub>r Q is H3 \\<longleftrightarrow> P \\<turnstile>\\<^sub>r Q = (\\<not> ((\\<not> P) ;; true)) \\<turnstile>\\<^sub>r Q\"\n    by (metis H3_def Healthy_def')\n  also have \"... \\<longleftrightarrow> P = (\\<not> ((\\<not> P) ;; true))\"\n    by (metis rdesign_pre)\n      thm seqr_true_lemma\n  also have \"... \\<longleftrightarrow> P = (P ;; true)\"\n    by (simp add: seqr_true_lemma)\n  finally show ?thesis .\nqed\n\ntheorem design_H3_iff_pre:\n  assumes \"$ok \\<sharp> P\" \"$ok\\<acute> \\<sharp> P\" \"$ok \\<sharp> Q\" \"$ok\\<acute> \\<sharp> Q\"\n  shows \"P \\<turnstile> Q is H3 \\<longleftrightarrow> P = (P ;; true)\"\nproof -\n  have \"P \\<turnstile> Q = \\<lfloor>P\\<rfloor>\\<^sub>D \\<turnstile>\\<^sub>r \\<lfloor>Q\\<rfloor>\\<^sub>D\"\n    by (simp add: assms lift_desr_inv rdesign_def)\n  moreover hence \"\\<lfloor>P\\<rfloor>\\<^sub>D \\<turnstile>\\<^sub>r \\<lfloor>Q\\<rfloor>\\<^sub>D is H3 \\<longleftrightarrow> \\<lfloor>P\\<rfloor>\\<^sub>D = (\\<lfloor>P\\<rfloor>\\<^sub>D ;; true)\"\n    using rdesign_H3_iff_pre by blast\n  ultimately show ?thesis\n    by (metis assms(1,2) drop_desr_inv lift_desr_inv lift_dist_seq aext_true)\nqed\n\ntheorem H1_H3_commute:\n  \"H1 (H3 P) = H3 (H1 P)\"\n  by (rel_auto)\n\nlemma skip_d_absorb_J_1:\n  \"(II\\<^sub>D ;; J) = II\\<^sub>D\"\n  by (metis H2_def H2_rdesign skip_d_def)\n\nlemma skip_d_absorb_J_2:\n  \"(J ;; II\\<^sub>D) = II\\<^sub>D\"\nproof -\n  have \"(J ;; II\\<^sub>D) = ((($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D) ;; true \\<turnstile> II)\"\n    by (simp add: J_def skip_d_alt_def)\n  also have \"... = (\\<^bold>\\<exists> ok\\<^sub>0 \\<bullet> (($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<acute>\\<rbrakk> ;; (true \\<turnstile> II)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<rbrakk>)\"\n    by (subst seqr_middle[of ok], simp_all)\n  also have \"... = (((($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; (true \\<turnstile> II)\\<lbrakk>false/$ok\\<rbrakk>)\n                  \\<or> ((($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (true \\<turnstile> II)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: disj_comm false_alt_def true_alt_def)\n  also have \"... = ((\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D ;; true) \\<or> (\\<lceil>II\\<rceil>\\<^sub>D ;; $ok\\<acute> \\<and> \\<lceil>II\\<rceil>\\<^sub>D))\"\n    by (rel_auto)\n  also have \"... = II\\<^sub>D\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nlemma H2_H3_absorb:\n  \"H2 (H3 P) = H3 P\"\n  by (metis H2_def H3_def seqr_assoc skip_d_absorb_J_1)\n\nlemma H3_H2_absorb:\n  \"H3 (H2 P) = H3 P\"\n  by (metis H2_def H3_def seqr_assoc skip_d_absorb_J_2)\n\ntheorem H2_H3_commute:\n  \"H2 (H3 P) = H3 (H2 P)\"\n  by (simp add: H2_H3_absorb H3_H2_absorb)\n\ntheorem H3_design_pre:\n  assumes \"$ok \\<sharp> p\" \"out\\<alpha> \\<sharp> p\" \"$ok \\<sharp> Q\" \"$ok\\<acute> \\<sharp> Q\"\n  shows \"H3(p \\<turnstile> Q) = p \\<turnstile> Q\"\n  using assms\n  by (metis Healthy_def' design_H3_iff_pre precond_right_unit unrest_out\\<alpha>_var ok_vwb_lens vwb_lens_mwb)\n\ntheorem H3_rdesign_pre:\n  assumes \"out\\<alpha> \\<sharp> p\"\n  shows \"H3(p \\<turnstile>\\<^sub>r Q) = p \\<turnstile>\\<^sub>r Q\"\n  using assms\n  by (simp add: H3_def)\n\ntheorem H3_ndesign:\n  \"H3(p \\<turnstile>\\<^sub>n Q) = (p \\<turnstile>\\<^sub>n Q)\"\n  by (simp add: H3_def ndesign_def unrest_pre_out\\<alpha>)\n\ntheorem H1_H3_is_design:\n  assumes \"P is H1\" \"P is H3\"\n  shows \"P = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\n  by (metis H1_H2_eq_design H2_H3_absorb Healthy_def' assms(1) assms(2))\n\ntheorem H1_H3_is_rdesign:\n  assumes \"P is H1\" \"P is H3\"\n  shows \"P = pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\n  by (metis H1_H2_is_rdesign H2_H3_absorb Healthy_def' assms)\n\ntheorem H1_H3_is_normal_design:\n  assumes \"P is H1\" \"P is H3\"\n  shows \"P = \\<lfloor>pre\\<^sub>D(P)\\<rfloor>\\<^sub>< \\<turnstile>\\<^sub>n post\\<^sub>D(P)\"\n  by (metis H1_H3_is_rdesign assms drop_pre_inv ndesign_def precond_equiv rdesign_H3_iff_pre)\n\nabbreviation \"H1_H3 p \\<equiv> H1 (H3 p)\"\n\nnotation H1_H3 (\"\\<^bold>N\")\n\nlemma H1_H3_comp: \"H1_H3 = H1 \\<circ> H3\"\n  by (auto)\n\nlemma H1_H3_idempotent: \"\\<^bold>N (\\<^bold>N P) = \\<^bold>N P\"\n  by (simp add: H1_H3_commute H1_idem H3_idem)\n\nlemma H1_H3_Idempotent: \"Idempotent \\<^bold>N\"\n  by (simp add: Idempotent_def H1_H3_idempotent)\n\nlemma H1_H3_monotonic: \"Monotonic \\<^bold>N\"\n  by (simp add: H1_monotone H3_mono Monotonic_def)\n\nlemma H1_H3_Continuous: \"Continuous \\<^bold>N\"\n  by (simp add: Continuous_comp H1_Continuous H1_H3_comp H3_Continuous)\n\nlemma H1_H3_impl_H2: \"P is H1_H3 \\<Longrightarrow> P is H1_H2\"\n  by (metis H1_H2_commute H1_idem H2_H3_absorb Healthy_def')\n\nlemma H1_H3_eq_design_d_comp: \"H1 (H3 P) = ((\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t ;; II\\<^sub>D)\"\n  by (metis H1_H2_eq_design H1_H3_commute H3_H2_absorb H3_def)\n\nlemma H1_H3_eq_design: \"H1 (H3 P) = (\\<not> (P\\<^sup>f ;; true)) \\<turnstile> P\\<^sup>t\"\n  apply (simp add: H1_H3_eq_design_d_comp skip_d_alt_def)\n  apply (subst design_composition_subst)\n  apply (simp_all add: usubst unrest)\n  apply (rel_auto)\ndone\n\nlemma H3_unrest_out_alpha_nok [unrest]:\n  assumes \"P is H1_H3\"\n  shows \"out\\<alpha> \\<sharp> P\\<^sup>f\"\nproof -\n  have \"P = (\\<not> (P\\<^sup>f ;; true)) \\<turnstile> P\\<^sup>t\"\n    by (metis H1_H3_eq_design Healthy_def assms)\n  also have \"out\\<alpha> \\<sharp> (...\\<^sup>f)\"\n    by (simp add: design_def usubst unrest, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma H3_unrest_out_alpha [unrest]: \"P is H1_H3 \\<Longrightarrow> out\\<alpha> \\<sharp> pre\\<^sub>D(P)\"\n  by (metis H1_H3_commute H1_H3_is_rdesign H1_idem Healthy_def' precond_equiv rdesign_H3_iff_pre)\n\nlemma ndesign_H1_H3 [closure]: \"p \\<turnstile>\\<^sub>n Q is \\<^bold>N\"\n  by (simp add: H1_rdesign H3_def Healthy_def' ndesign_def unrest_pre_out\\<alpha>)\n\nlemma des_bot_H1_H3 [closure]: \"\\<bottom>\\<^sub>D is \\<^bold>N\"\n  by (metis H1_design H3_def Healthy_def' design_false_pre design_true_left_zero skip_d_alt_def)\n\nlemma assigns_d_H1_H3 [closure]: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D is \\<^bold>N\"\n  by (metis H1_rdesign H3_ndesign Healthy_def' aext_true assigns_d_def ndesign_def)\n\nlemma seq_r_H1_H3_closed [closure]:\n  assumes \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n  shows \"(P ;; Q) is \\<^bold>N\"\n  by (metis (no_types) H1_H2_eq_design H1_H3_eq_design_d_comp H1_H3_impl_H2 Healthy_def assms(1) assms(2) seq_r_H1_H2_closed seqr_assoc)\n\nlemma wp_assigns_d [wp]: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D wp\\<^sub>D r = \\<sigma> \\<dagger> r\"\n  by (rel_auto)\n\ntheorem wpd_seq_r_H1_H3 [wp]:\n  fixes P Q :: \"'\\<alpha> hrel_des\"\n  assumes \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n  shows \"(P ;; Q) wp\\<^sub>D r = P wp\\<^sub>D (Q wp\\<^sub>D r)\"\n  by (metis H1_H3_commute H1_H3_is_normal_design H1_idem Healthy_def' assms(1) assms(2) wpnd_seq_r)\n\ntext {* If two normal designs have the same weakest precondition for any given postcondition, then\n  the two designs are equivalent. *}\n\ntheorem wpd_eq_intro: \"\\<lbrakk> \\<And> r. (p\\<^sub>1 \\<turnstile>\\<^sub>n Q\\<^sub>1) wp\\<^sub>D r = (p\\<^sub>2 \\<turnstile>\\<^sub>n Q\\<^sub>2) wp\\<^sub>D r \\<rbrakk> \\<Longrightarrow> (p\\<^sub>1 \\<turnstile>\\<^sub>n Q\\<^sub>1) = (p\\<^sub>2 \\<turnstile>\\<^sub>n Q\\<^sub>2)\"\napply (rel_simp robust; metis curry_conv)\ndone\n\ntheorem wpd_H3_eq_intro: \"\\<lbrakk> P is H1_H3; Q is H1_H3; \\<And> r. P wp\\<^sub>D r = Q wp\\<^sub>D r \\<rbrakk> \\<Longrightarrow> P = Q\"\n  by (metis H1_H3_commute H1_H3_is_normal_design H3_idem Healthy_def' wpd_eq_intro)\n\nsubsection {* H4: Feasibility *}\n\ntheorem H4_idem:\n  \"H4(H4(P)) = H4(P)\"\n  by (pred_auto)\n\nlemma is_H4_alt_def:\n  \"P is H4 \\<longleftrightarrow> (P ;; true) = true\"\n  by (rel_auto)\n\nlemma H4_assigns_d: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D is H4\"\nproof -\n  have \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; (false \\<turnstile>\\<^sub>r true\\<^sub>h)) = (false \\<turnstile>\\<^sub>r true)\"\n    by (simp add: assigns_d_def rdesign_composition assigns_r_feasible)\n  moreover have \"... = true\"\n    by (rel_auto)\n  ultimately show ?thesis\n    using is_H4_alt_def by auto\nqed\n\nsubsection {* UTP theories *}\n\ntypedecl DES\ntypedecl NDES\n\nabbreviation \"DES \\<equiv> UTHY(DES, '\\<alpha> des)\"\nabbreviation \"NDES \\<equiv> UTHY(NDES, '\\<alpha> des)\"\n\noverloading\n  des_hcond == \"utp_hcond :: (DES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\"\n  des_unit == \"utp_unit :: (DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" (unchecked)\n\n  ndes_hcond == \"utp_hcond :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\"\n  ndes_unit == \"utp_unit :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" (unchecked)\n\nbegin\n  definition des_hcond :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\" where\n  [upred_defs]: \"des_hcond t = H1_H2\"\n\n  definition des_unit :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"des_unit t = II\\<^sub>D\"\n\n  definition ndes_hcond :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\" where\n  [upred_defs]: \"ndes_hcond t = H1_H3\"\n\n  definition ndes_unit :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"ndes_unit t = II\\<^sub>D\"\n\nend\n\ninterpretation des_utp_theory: utp_theory DES\n  by (simp add: H1_H2_commute H1_idem H2_idem des_hcond_def utp_theory_def)\n\ninterpretation ndes_utp_theory: utp_theory NDES\n  by (simp add: H1_H3_commute H1_idem H3_idem ndes_hcond_def utp_theory.intro)\n\ninterpretation des_left_unital: utp_theory_left_unital DES\n  apply (unfold_locales)\n  apply (simp_all add: des_hcond_def des_unit_def)\n  using seq_r_H1_H2_closed apply blast\n  apply (simp add: rdesign_is_H1_H2 skip_d_def)\n  apply (metis H1_idem H1_left_unit Healthy_def')\ndone\n\ninterpretation ndes_unital: utp_theory_unital NDES\n  apply (unfold_locales, simp_all add: ndes_hcond_def ndes_unit_def)\n  using seq_r_H1_H3_closed apply blast\n  apply (metis H1_rdesign H3_def Healthy_def' design_skip_idem skip_d_def)\n  apply (metis H1_idem H1_left_unit Healthy_def')\n  apply (metis H1_H3_commute H3_def H3_idem Healthy_def')\ndone\n\ninterpretation design_theory_continuous: utp_theory_continuous DES\n  rewrites \"\\<And> P. P \\<in> carrier (uthy_order DES) \\<longleftrightarrow> P is \\<^bold>H\"\n  and \"carrier (uthy_order DES) \\<rightarrow> carrier (uthy_order DES) \\<equiv> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n  and \"le (uthy_order DES) = op \\<sqsubseteq>\"\n  and \"eq (uthy_order DES) = op =\"\n  by (unfold_locales, simp_all add: des_hcond_def H1_H2_Continuous utp_order_def)\n\ninterpretation normal_design_theory_mono: utp_theory_continuous NDES\n  rewrites \"\\<And> P. P \\<in> carrier (uthy_order NDES) \\<longleftrightarrow> P is \\<^bold>N\"\n  and \"carrier (uthy_order NDES) \\<rightarrow> carrier (uthy_order NDES) \\<equiv> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H\"\n  and \"le (uthy_order NDES) = op \\<sqsubseteq>\"\n  and \"eq (uthy_order NDES) = op =\"\n  by (unfold_locales, simp_all add: ndes_hcond_def H1_H3_Continuous utp_order_def)\n\nlemma design_lat_top: \"\\<^bold>\\<top>\\<^bsub>DES\\<^esub> = \\<^bold>H(false)\"\n  by (simp add: design_theory_continuous.healthy_top, simp add: des_hcond_def)\n\nlemma design_lat_bottom: \"\\<^bold>\\<bottom>\\<^bsub>DES\\<^esub> = \\<^bold>H(true)\"\n  by (simp add: design_theory_continuous.healthy_bottom, simp add: des_hcond_def)\n\nabbreviation design_lfp :: \"('\\<alpha> hrel_des \\<Rightarrow> '\\<alpha> hrel_des) \\<Rightarrow> '\\<alpha> hrel_des\" (\"\\<mu>\\<^sub>D\") where\n\"\\<mu>\\<^sub>D F \\<equiv> \\<mu>\\<^bsub>uthy_order DES\\<^esub> F\"\n\nabbreviation design_gfp :: \"('\\<alpha> hrel_des \\<Rightarrow> '\\<alpha> hrel_des) \\<Rightarrow> '\\<alpha> hrel_des\" (\"\\<nu>\\<^sub>D\") where\n\"\\<nu>\\<^sub>D F \\<equiv> \\<nu>\\<^bsub>uthy_order DES\\<^esub> F\"\n\nthm design_theory_continuous.GFP_unfold\nthm design_theory_continuous.LFP_unfold\n\ntext {* We also set up local variables for designs. *}\n\noverloading\n  des_pvar == \"pvar :: (DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\"\n  des_assigns == \"pvar_assigns :: (DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\"\n  ndes_pvar == \"pvar :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\"\n  ndes_assigns == \"pvar_assigns :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\"\nbegin\n  definition des_pvar :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\" where\n  [upred_defs]: \"des_pvar T = \\<Sigma>\\<^sub>D\"\n  definition des_assigns :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"des_assigns T \\<sigma> = \\<langle>\\<sigma>\\<rangle>\\<^sub>D\"\n  definition ndes_pvar :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\" where\n  [upred_defs]: \"ndes_pvar T = \\<Sigma>\\<^sub>D\"\n  definition ndes_assigns :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"ndes_assigns T \\<sigma> = \\<langle>\\<sigma>\\<rangle>\\<^sub>D\"\n\nend\n\ninterpretation des_prog_var: utp_prog_var \"UTHY(DES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>DES\\<^esub> = \\<^bold>H\"\n  apply (unfold_locales, simp_all add: des_pvar_def des_assigns_def des_hcond_def)\n  apply (simp add: assigns_d_def rdesign_is_H1_H2)\n  apply (simp add: assigns_d_comp_ext assigns_d_is_H1_H2)\n  apply (rel_auto)\ndone\n\ninterpretation ndes_prog_var: utp_prog_var \"UTHY(NDES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>NDES\\<^esub> = \\<^bold>N\"\n  apply (unfold_locales, simp_all add: ndes_pvar_def ndes_assigns_def ndes_hcond_def)\n  apply (simp add: assigns_d_H1_H3)\n  apply (rel_auto)\ndone\n\ninterpretation des_local_var: utp_local_var \"UTHY(DES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>DES\\<^esub> = \\<^bold>H\"\n  by (unfold_locales, simp_all add: des_unit_def des_assigns_def des_hcond_def)\n\ninterpretation ndes_local_var: utp_local_var \"UTHY(NDES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>NDES\\<^esub> = \\<^bold>N\"\n  by (unfold_locales, simp_all add: ndes_unit_def ndes_assigns_def ndes_hcond_def)\n\ntext {* Weakest precondition laws for design variable scopes *}\n\nlemma wpd_var_begin [wp]:\n  fixes x :: \"'a list \\<Longrightarrow> '\\<alpha>\" and r :: \"'\\<alpha> upred\"\n  shows \"(var_begin NDES x) wp\\<^sub>D r = r\\<lbrakk>\\<langle>\\<guillemotleft>undefined\\<guillemotright>\\<rangle> ^\\<^sub>u &x/x\\<rbrakk>\"\n  by (simp add: var_begin_def ndes_assigns_def wp)\n\nlemma wpd_var_end [wp]:\n  fixes x :: \"'a list \\<Longrightarrow> '\\<alpha>\" and r :: \"'\\<alpha> upred\"\n  shows \"(var_end NDES x) wp\\<^sub>D r = r\\<lbrakk>tail\\<^sub>u(&x)/x\\<rbrakk>\"\n  by (simp add: var_end_def ndes_assigns_def wp)\n\ntext {* Example Galois connection between designs and relations. Based on Jim's example in COMPASS\n        deliverable D23.5. *}\n\ndefinition [upred_defs]: \"Des(R) = \\<^bold>H(\\<lceil>R\\<rceil>\\<^sub>D \\<and> $ok\\<acute>)\"\ndefinition [upred_defs]: \"Rel(D) = \\<lfloor>D\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>\\<rfloor>\\<^sub>D\"\n\nlemma Des_design: \"Des(R) = true \\<turnstile>\\<^sub>r R\"\n  by (rel_auto)\n\nlemma Rel_design: \"Rel(P \\<turnstile>\\<^sub>r Q) = (P \\<Rightarrow> Q)\"\n  by (rel_auto)\n\ninterpretation Des_Rel_coretract:\n  coretract \"DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\"\n  rewrites\n    \"\\<And> x. x \\<in> carrier \\<X>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = (x is \\<^bold>H)\" and\n    \"\\<And> x. x \\<in> carrier \\<Y>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = True\" and\n    \"\\<pi>\\<^sub>*\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = Des\" and\n    \"\\<pi>\\<^sup>*\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = Rel\" and\n    \"le \\<X>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = op \\<sqsubseteq>\" and\n    \"le \\<Y>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = op \\<sqsubseteq>\"\nproof (unfold_locales, simp_all add: rel_hcond_def des_hcond_def)\n  show \"\\<And>x. x is id\"\n    by (simp add: Healthy_def)\nnext\n  show \"Rel \\<in> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>id\\<rbrakk>\\<^sub>H\"\n    by (auto simp add: Rel_def rel_hcond_def Healthy_def)\nnext\n  show \"Des \\<in> \\<lbrakk>id\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n    by (auto simp add: Des_def des_hcond_def Healthy_def H1_H2_commute H1_idem H2_idem)\nnext\n  fix R :: \"'a hrel\"\n  show \"R \\<sqsubseteq> Rel (Des R)\"\n    by (simp add: Des_design Rel_design)\nnext\n  fix R :: \"'a hrel\" and D :: \"'a hrel_des\"\n  assume a: \"D is \\<^bold>H\"\n  then obtain D\\<^sub>1 D\\<^sub>2 where D: \"D = D\\<^sub>1 \\<turnstile>\\<^sub>r D\\<^sub>2\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H1_idem Healthy_def')\n  show \"(Rel D \\<sqsubseteq> R) = (D \\<sqsubseteq> Des R)\"\n  proof -\n    have \"(D \\<sqsubseteq> Des R) = (D\\<^sub>1 \\<turnstile>\\<^sub>r D\\<^sub>2 \\<sqsubseteq> true \\<turnstile>\\<^sub>r R)\"\n      by (simp add: D Des_design)\n    also have \"... = `D\\<^sub>1 \\<and> R \\<Rightarrow> D\\<^sub>2`\"\n      by (simp add: rdesign_refinement)\n    also have \"... = ((D\\<^sub>1 \\<Rightarrow> D\\<^sub>2) \\<sqsubseteq> R)\"\n      by (rel_auto)\n    also have \"... = (Rel D \\<sqsubseteq> R)\"\n      by (simp add: D Rel_design)\n    finally show ?thesis ..\n  qed\nqed\n\ntext {* From this interpretation we gain many Galois theorems. Some require simplification to\n        remove superfluous assumptions. *}\n\nthm Des_Rel_coretract.deflation[simplified]\nthm Des_Rel_coretract.inflation\nthm Des_Rel_coretract.upper_comp[simplified]\nthm Des_Rel_coretract.lower_comp\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/orca/theories/utp_designs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3359131778250933}}
{"text": "theory TA_NBA\n  imports Transition_Systems_and_Automata.NBA TA.Timed_Automata TA_Library.Temporal_Logics\n    \\<comment> \\<open>\"LTL_to_GBA.LTL_to_GBA\"\\<close>\nbegin\n\nlocale TA_NBA_Product_Defs =\n  fixes A :: \"('a, 'c, 't, 'l) ta\" and label :: \"'l \\<Rightarrow> 'p\" and l\\<^sub>0 :: 'l\n    and B :: \"('p, 's) nba\"\nbegin\n\ndefinition inv :: \"'l \\<times> 's \\<Rightarrow> ('c, 't) cconstraint\" where\n  \"inv \\<equiv> \\<lambda>(l, _). inv_of A l\"\n\ndefinition trans :: \"('a, 'c, 't, 'l \\<times> 's) transition set\" where\n  \"trans \\<equiv> {((l, q), g, a, r, (l', q')). (l, g, a, r, l') \\<in> trans_of A \\<and> q' \\<in> succ B (label l') q}\"\n\ndefinition prod :: \"('a, 'c, 't, 'l \\<times> 's) ta\" where\n  \"prod \\<equiv> (trans, inv)\"\n\ndefinition inits where\n  \"inits \\<equiv> {q. \\<exists>q\\<^sub>0 \\<in> initial B. q \\<in> succ B (label l\\<^sub>0) q\\<^sub>0}\"\n\ndefinition accept where\n  \"accept \\<equiv> \\<lambda>((l, q), u). accepting B q\"\n\nend\n\n\nlocale TA_NBA_Product =\n  TA_NBA_Product_Defs where A = A and B = B\n  for A :: \"('a, 'c, 't :: time, 'l) ta\" and B :: \"('p, 's) nba\" +\n  assumes labels_alphabet: \"range label \\<subseteq> alphabet B\"\nbegin\n\nsublocale A: Graph_Defs where\n  E = \"\\<lambda>(l, u) (l', u'). A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>\" .\n\nsublocale prod: Graph_Defs\n  \"\\<lambda>(l, u) (l', u'). prod \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>\" .\n\nlemma prod_step'_iff:\n  \"prod \\<turnstile>' \\<langle>(l, q), u\\<rangle> \\<rightarrow> \\<langle>(l', q'), u'\\<rangle> \\<longleftrightarrow> A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle> \\<and> q' \\<in> succ B (label l') q\"\n  by (auto\n        intro!: step'.intros step_t.intros step_a.intros\n        elim!: step'.cases step_t.cases step_a.cases\n        simp: inv_of_def trans_of_def prod_def trans_def inv_def)\n\nlemma prod_run_A_run:\n  \"A.run (smap (\\<lambda>((l, q), u). (l, u)) xs)\" (is \"A.run ?xs1\") if \"prod.run xs\"\nproof -\n  interpret Simulation\n    where A = \"\\<lambda>(l, u) (l', u'). prod \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>\"\n      and B = \"\\<lambda>(l, u) (l', u'). A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>\"\n    and sim = \"\\<lambda>((l, q), u) (l', u'). l = l' \\<and> u = u'\"\n    by standard (auto simp: prod_step'_iff)\n  obtain y ys where \"xs = y ## ys\"\n    by (cases xs)\n  obtain l q u where \"y = ((l, q), u)\"\n    by (metis surj_pair)\n  from simulation_run[OF that[unfolded \\<open>xs = _\\<close> \\<open>y = _\\<close>], of \"(l, u)\", simplified] obtain zs where\n    \"A.run ((l, u) ## zs)\" \"stream_all2 (\\<lambda>((l, q), u) (l', u'). l = l' \\<and> u = u') ys zs\"\n    by safe\n  from this(2) have \"?xs1 = (l, u) ## zs\"\n    unfolding \\<open>xs = _\\<close> \\<open>y = _\\<close>\n    by simp (coinduction arbitrary: ys zs, auto 4 3 simp: stream_all2_SCons2)\n  with \\<open>A.run _\\<close> show ?thesis\n    by metis\nqed\n\nlemma prod_run_iff:\n  fixes q\\<^sub>0'\n  assumes \"q \\<in> succ B (label l) q\\<^sub>0'\"\n  shows\n  \"prod.run (((l, q), u) ## xs)\n     \\<longleftrightarrow> A.run (smap (\\<lambda>((l, q), u). (l, u)) (((l, q), u) ## xs))\n       \\<and> run B (smap (\\<lambda>((l, q), u). (label l, q)) (((l, q), u) ## xs)) q\\<^sub>0'\"\n  (is \"prod.run ?xs \\<longleftrightarrow> A.run (smap ?p1 ?xs) \\<and> run B (smap ?p2 ?xs) q\\<^sub>0'\")\nproof -\n  have *: \"q' \\<in> succ B (label l') q\" if \"prod \\<turnstile>' \\<langle>(l, q), u\\<rangle> \\<rightarrow> \\<langle>(l', q'), u'\\<rangle>\" for l q u l' q' u'\n    using that by (simp add: prod_step'_iff)\n  have \"run B (smap ?p2 ?xs) q\\<^sub>0'\" if \"prod.run (((l, q), u) ## xs)\"\n    using that assms labels_alphabet\n    by (coinduction arbitrary: xs l q u q\\<^sub>0' rule: nba.run_coinduct)\n       (simp split: prod.splits, erule prod.run.cases, auto dest!: * split: prod.splits)\n  moreover have \"prod.run xs\"\n    if \"A.run (smap ?p1 xs)\" \"run B (smap ?p2 xs) q\\<^sub>0'\" for xs\n    using that\n    apply (coinduction arbitrary: xs q\\<^sub>0')\n    subgoal for xs q\\<^sub>0'\n      apply (cases xs)\n      subgoal for _ ys\n        by (cases ys) (auto simp: prod_step'_iff elim: A.run.cases split: prod.splits)\n      done\n    done\n  ultimately show ?thesis\n    using prod_run_A_run by metis\nqed\n\nlemma prod_Buechi_run_iff:\n  \"(\\<exists>q \\<in> inits. \\<exists>xs. prod.run (((l\\<^sub>0, q), u) ## xs) \\<and> infs accept (((l\\<^sub>0, q), u) ## xs))\n  \\<longleftrightarrow> (\\<exists>xs. A.run ((l\\<^sub>0, u) ## xs) \\<and> label l\\<^sub>0 ## smap (\\<lambda>(l, u). label l) xs \\<in> language B)\"\n  (is \"?l \\<longleftrightarrow> ?r\")\nproof -\n  have ?l if ?r\n  proof -\n    from that obtain xs ys q\\<^sub>0 q\\<^sub>0' where run:\n      \"A.run ((l\\<^sub>0, u) ## xs)\"\n      \"q\\<^sub>0 \\<in> initial B\"\n      \"infs (accepting B)\n       (trace (smap (\\<lambda>(l, u). label l) xs ||| ys) q\\<^sub>0')\"\n      \"run B (smap (\\<lambda>(l, u). label l) xs ||| ys) q\\<^sub>0'\"\n      \"label l\\<^sub>0 \\<in> alphabet B\" \"q\\<^sub>0' \\<in> succ B (label l\\<^sub>0) q\\<^sub>0\"\n      unfolding language_def by safe (erule nba.run.cases, auto)\n    let ?xs = \"smap (\\<lambda>((l, u), q). ((l, q), u)) (xs ||| ys)\"\n    have \"smap (\\<lambda>((l, q), u). (label l, q)) ?xs = smap (\\<lambda>(l, u). label l) xs ||| ys\"\n      by (coinduction arbitrary: xs ys) (auto split: prod.splits)\n    moreover have \"smap (case_prod (\\<lambda>(l, q). Pair l)) ?xs = xs\"\n      by (coinduction arbitrary: xs ys) auto\n    ultimately have \"prod.run (((l\\<^sub>0, q\\<^sub>0'), u) ## ?xs)\"\n      using run unfolding prod_run_iff[OF \\<open>q\\<^sub>0' \\<in> _\\<close>] by auto\n    moreover have \"infs accept (((l\\<^sub>0, q\\<^sub>0'), u) ## ?xs)\"\n    proof -\n      have \"stream_all2 (\\<lambda>a b. snd b = a) ys (xs ||| ys)\"\n        by (coinduction arbitrary: xs ys) auto\n      then show ?thesis\n        using run(3) unfolding accept_def trace_alt_def by (auto elim: alw_ev_lockstep)\n    qed\n    ultimately show ?thesis\n      using \\<open>q\\<^sub>0' \\<in> _\\<close> \\<open>q\\<^sub>0 \\<in> _\\<close> unfolding inits_def by blast\n  qed\n  moreover have ?r if ?l\n  proof -\n    let ?r = \"smap (\\<lambda>((l, q), u). q)\"\n    from that obtain q\\<^sub>0' q\\<^sub>0 xs where\n      \"q\\<^sub>0 \\<in> initial B\" \"q\\<^sub>0' \\<in> succ B (label l\\<^sub>0) q\\<^sub>0\" \"prod.run (((l\\<^sub>0, q\\<^sub>0'), u) ## xs)\" \"infs accept xs\"\n      unfolding inits_def by safe\n    moreover have \"smap (\\<lambda>((l, q), u). (label l, q)) xs = (smap (\\<lambda>(l, u). label l)\n        (smap (\\<lambda>((l, q), u). (l, u)) xs) ||| ?r xs)\"\n      by (coinduction arbitrary: xs) (auto split: prod.splits)\n    ultimately show ?thesis\n      by (subst (asm) prod_run_iff)\n         (auto 4 4\n          simp: holds.simps trace_alt_def accept_def \n          elim!: alw_ev_mono language[where r = \"q\\<^sub>0' ## ?r xs\"])\n  qed\n  ultimately show ?thesis\n    by blast\nqed\n\nend\n\n\n\nlocale TA_NBA_LTL_Product1 =\n  TA_NBA_Product where A = A and B = B\n  for A :: \"('a, 'c, 't :: time, 'l) ta\" and B :: \"('p, 's) nba\" +\n  fixes \\<phi> :: \"('l \\<Rightarrow> bool) ltlc\"\n  assumes B_\\<phi>: \"language B = smap label ` {xs. Graph_Defs.models_ltlc \\<phi> xs}\"\n      and label_formula_compatible: \"\\<And>xs ys. smap label xs = smap label ys\n    \\<Longrightarrow> Graph_Defs.models_ltlc \\<phi> xs \\<longleftrightarrow> Graph_Defs.models_ltlc \\<phi> ys\"\nbegin\n\nlemma smap_project:\n  \"smap (\\<lambda>(l, u). label l) xs = smap label (smap fst xs)\"\n  by (coinduction arbitrary: xs) (auto split: prod.split)\n\ntheorem\n  \"(\\<exists>q \\<in> inits. \\<exists>xs. prod.run (((l\\<^sub>0, q), u) ## xs) \\<and> infs accept (((l\\<^sub>0, q), u) ## xs))\n\\<longleftrightarrow> (\\<exists>xs. A.run ((l\\<^sub>0, u) ## xs) \\<and> Graph_Defs.models_ltlc \\<phi> (l\\<^sub>0 ## smap fst xs))\"\n  unfolding prod_Buechi_run_iff B_\\<phi>\n  apply safe\n  subgoal for xs ys\n    apply (intro exI conjI)\n     apply assumption\n    apply (subst label_formula_compatible)\n     apply (auto simp add: smap_project)\n    done\n  apply (force simp: smap_project)\n  done\n\nend\n\nlocale TA_NBA_LTL_Product2 =\n  TA_NBA_Product where A = A and B = B\n  for A :: \"('a, 'c, 't :: time, 'l) ta\" and B :: \"('p, 's) nba\" +\n  fixes \\<phi> :: \"('l \\<Rightarrow> bool) ltlc\" and \\<psi> :: \"('p \\<Rightarrow> bool) ltlc\"\n  assumes B_\\<phi>: \"language B = {xs. Graph_Defs.models_ltlc \\<psi> xs}\"\n      and label_formula_compatible:\n      \"\\<And>xs. Graph_Defs.models_ltlc \\<phi> xs \\<longleftrightarrow> Graph_Defs.models_ltlc \\<psi> (smap label xs)\"\nbegin\n\nlemma smap_project:\n  \"smap (\\<lambda>(l, u). label l) xs = smap label (smap fst xs)\"\n  by (coinduction arbitrary: xs) (auto split: prod.split)\n\ntheorem\n  \"(\\<exists>q \\<in> inits. \\<exists>xs. prod.run (((l\\<^sub>0, q), u) ## xs) \\<and> infs accept (((l\\<^sub>0, q), u) ## xs))\n\\<longleftrightarrow> (\\<exists>xs. A.run ((l\\<^sub>0, u) ## xs) \\<and> Graph_Defs.models_ltlc \\<phi> (l\\<^sub>0 ## smap fst xs))\"\n  unfolding prod_Buechi_run_iff B_\\<phi> by (auto simp: label_formula_compatible smap_project)\n\nend\n\ncontext\n  fixes \\<phi> :: \"'a ltlc\" and f :: \"'a \\<Rightarrow> 'p\" and interp :: \"'a \\<Rightarrow> ('l \\<Rightarrow> bool)\"\nbegin\n\nlemma semantics_ltlc_map_prop:\n  \"(\\<lambda>i. {a \\<in> interp ` atoms_ltlc \\<phi>. a (w i)}) \\<Turnstile>\\<^sub>c map_ltlc interp \\<phi> \\<longleftrightarrow>\n   (\\<lambda>i. {a \\<in> atoms_ltlc \\<phi>. interp a (w i)}) \\<Turnstile>\\<^sub>c \\<phi>\"\nproof -\n  have [simp]:\n    \"(\\<lambda>i. {a. (a \\<in> atoms_ltlc \\<phi>1 \\<or> a \\<in> atoms_ltlc \\<phi>2) \\<and> interp a (w i)}) \\<Turnstile>\\<^sub>c \\<phi>1\n    \\<longleftrightarrow> ((\\<lambda>i. {a \\<in> atoms_ltlc \\<phi>1. interp a (w i)}) \\<Turnstile>\\<^sub>c \\<phi>1)\"\n    \"(\\<lambda>i. {a. (a \\<in> atoms_ltlc \\<phi>1 \\<or> a \\<in> atoms_ltlc \\<phi>2) \\<and> interp a (w i)}) \\<Turnstile>\\<^sub>c \\<phi>2\n    \\<longleftrightarrow> ((\\<lambda>i. {a \\<in> atoms_ltlc \\<phi>2. interp a (w i)}) \\<Turnstile>\\<^sub>c \\<phi>2)\" for w \\<phi>1 \\<phi>2\n    by (rule ltlc_eq_on; auto simp: pw_eq_on_def)+\n  have [simp]:\n    \"(\\<lambda>i. {a \\<in> interp ` (atoms_ltlc \\<phi>1 \\<union> atoms_ltlc \\<phi>2). a (w i)}) \\<Turnstile>\\<^sub>c map_ltlc interp \\<phi>1\n    \\<longleftrightarrow> (\\<lambda>i. {a \\<in> interp ` atoms_ltlc \\<phi>1. a (w i)}) \\<Turnstile>\\<^sub>c map_ltlc interp \\<phi>1\"\n    \"(\\<lambda>i. {a \\<in> interp ` (atoms_ltlc \\<phi>1 \\<union> atoms_ltlc \\<phi>2). a (w i)}) \\<Turnstile>\\<^sub>c map_ltlc interp \\<phi>2\n    \\<longleftrightarrow> (\\<lambda>i. {a \\<in> interp ` atoms_ltlc \\<phi>2. a (w i)}) \\<Turnstile>\\<^sub>c map_ltlc interp \\<phi>2\" for w \\<phi>1 \\<phi>2\n    by (rule ltlc_eq_on; auto simp: pw_eq_on_def ltlc.set_map)+\n  show ?thesis\n    by (induction \\<phi> arbitrary: w) (simp_all add: suffix_def)\nqed\n\nlemma prop_ltlc_abstract:\n  assumes f_inj: \"inj_on f (atoms_ltlc \\<phi>)\"\n  shows\n  \"w \\<Turnstile>\\<^sub>c' map_ltlc interp \\<phi> \\<longleftrightarrow>\n  ((\\<lambda>s. f ` {a \\<in> atoms_ltlc \\<phi>. interp a s}) o w) \\<Turnstile>\\<^sub>c map_ltlc f \\<phi>\" (is \"?l \\<longleftrightarrow> ?r\")\nproof -\n  have \"?l \\<longleftrightarrow> (\\<lambda>i. {a \\<in> atoms_ltlc \\<phi>. interp a (w i)}) \\<Turnstile>\\<^sub>c \\<phi>\"\n    by (simp add: semantics_ltlc'_semantics_ltlc_atoms_iff ltlc.set_map semantics_ltlc_map_prop)\n  also have \"\\<dots> \\<longleftrightarrow> ?r\"\n    by (subst map_semantics_ltlc_aux[OF f_inj]) (auto simp: comp_def)\n  finally show ?thesis .\nqed\n\nend\n\n\nlocale TA_NBA_LTL_Product =\n  TA_NBA_Product where A = A and B = B\n  for A :: \"('a, 'c, 't :: time, 'l) ta\" and B :: \"('p set, 's) nba\" +\n  fixes \\<phi> :: \"'x ltlc\" and interp :: \"'x \\<Rightarrow> ('l \\<Rightarrow> bool)\" and f :: \"'x \\<Rightarrow> 'p\"\n  assumes B_\\<phi>: \"to_omega ` language B = {w. w \\<Turnstile>\\<^sub>c map_ltlc f \\<phi>}\"\n      and f_inj: \"inj_on f (atoms_ltlc \\<phi>)\"\n      and label: \"label s = f ` {a \\<in> atoms_ltlc \\<phi>. interp a s}\"\nbegin\n\nlemma smap_project:\n  \"smap (\\<lambda>(l, u). label l) xs = smap label (smap fst xs)\"\n  by (coinduction arbitrary: xs) (auto split: prod.split)\n\nlemma B_\\<phi>':\n  \"language B = {w. to_omega w \\<Turnstile>\\<^sub>c map_ltlc f \\<phi>}\"\n  using B_\\<phi> by auto (metis in_image(1) mem_Collect_eq to_stream_to_omega)\n\nlemma comp_to_omega_is_smap:\n  \"g o to_omega xs = to_omega (smap g xs)\"\n  unfolding to_omega_def comp_def by auto\n\ntheorem prod_formula_run_iff:\n  \"(\\<exists>q \\<in> inits. \\<exists>xs. prod.run (((l\\<^sub>0, q), u) ## xs) \\<and> infs accept (((l\\<^sub>0, q), u) ## xs))\n\\<longleftrightarrow> (\\<exists>xs. A.run ((l\\<^sub>0, u) ## xs) \\<and> Graph_Defs.models_ltlc (map_ltlc interp \\<phi>) (l\\<^sub>0 ## smap fst xs))\"\n  unfolding prod_Buechi_run_iff Graph_Defs.models_ltlc_def B_\\<phi>'\n  by (simp add: prop_ltlc_abstract[OF f_inj] smap_project label[symmetric] comp_to_omega_is_smap)\n\nend\n\n\n\n\n\ncontext\n  fixes \\<phi> :: \"('l \\<Rightarrow> bool) ltlc\" and f :: \"('l \\<Rightarrow> bool) \\<Rightarrow> 'p\"\n  assumes f_inj: \"inj_on f (atoms_ltlc \\<phi>)\"\nbegin\n\nlemma\n  \"w \\<Turnstile>\\<^sub>c' \\<phi> \\<longleftrightarrow> (\\<lambda>i. (\\<lambda>s. f ` {a \\<in> atoms_ltlc \\<phi>. a s}) (w i)) \\<Turnstile>\\<^sub>c map_ltlc f \\<phi>\"\n  using f_inj\n  apply (subst semantics_ltlc'_semantics_ltlc_atoms_iff)\n  apply (subst map_semantics_ltlc_aux[where f = f])\n     apply auto\n  done\n\nend\n\n\ncontext\n  fixes collision sent :: \"'l \\<Rightarrow> bool\"\nbegin\n\nprivate definition\n  \"edges = (\\<lambda>s n.\n    if n = 0 then\n      if collision s \\<and> sent s then {0}\n      else if collision s \\<and> \\<not> sent s then {0}\n      else if \\<not> collision s then {1}\n      else {}\n    else if n = 1 then\n      if collision s \\<and> sent s then {0}\n      else if \\<not> collision s then {1}\n      else if collision s \\<and> \\<not> sent s then {2}\n      else {}\n    else if n = 2 then\n      if sent s then {0}\n      else {2}\n    else {}\n   )\"\n\nlemma edges_determ:\n  \"\\<exists>x \\<in> {0,1,2}. edges s l = {x}\" if \"l \\<in> {0,1,2}\"\n  using that unfolding edges_def by auto\n\ndefinition\n  \"not_fg_collision_impl_g_not_sent = nba\n    UNIV {0,1,2} edges (\\<lambda>l. l = 0)\"\n\ndefinition\n  \"formula = not\\<^sub>c (F\\<^sub>c (G\\<^sub>c (prop\\<^sub>c(collision) implies\\<^sub>c G\\<^sub>c (not\\<^sub>c(prop\\<^sub>c(sent))))))\"\n\nschematic_goal\n  \"formula = TT ?x\"\n  unfolding formula_def\n  oops\n\nlemma\n  \"\\<xi> \\<Turnstile>\\<^sub>c' formula = \\<xi> \\<Turnstile>\\<^sub>c' G\\<^sub>c (F\\<^sub>c (prop\\<^sub>c(collision) and\\<^sub>c F\\<^sub>c (prop\\<^sub>c(sent))))\"\n  unfolding semantics_ltlc'_semantics_ltlc_atoms_iff\n  unfolding formula_def\n  by simp\n\nlemma\n  \"language not_fg_collision_impl_g_not_sent =\n    {xs. Graph_Defs.models_ltlc formula xs}\n\"\n  unfolding Graph_Defs.models_ltlc_def\n  apply auto\n  oops\n\nend\n\n\n\n\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Networks/TA_NBA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.33585154042488713}}
{"text": "(*<*)\n(*\n * Copyright 2015, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory CIMP_pred\nimports\n  Main\nbegin\n\n(* Extra HOL *)\n\nlemma triv: \"P \\<Longrightarrow> P\"\nby simp\n\nlemma always_eventually_pigeonhole:\n  \"(\\<forall>i. \\<exists>n\\<ge>i. \\<exists>m\\<le>k. P m n) \\<longleftrightarrow> (\\<exists>m\\<le>k::nat. \\<forall>i::nat. \\<exists>n\\<ge>i. P m n)\"\nproof(induct k)\n  case (Suc k) then show ?case\n    apply (auto 8 0)\n    using le_SucI apply blast\n    apply (metis (full_types) le_Suc_eq nat_le_linear order_trans)\n    done\nqed simp\n\n(*>*)\nsection\\<open> Point-free notation \\<close>\n\ntext\\<open>\n\n\\label{sec:cimp-lifted-predicates}\n\nTypically we define predicates as functions of a state. The following\nprovide a somewhat comfortable point-free imitation of Isabelle/HOL's\noperators.\n\n\\<close>\n\nabbreviation (input)\n  pred_K :: \"'b \\<Rightarrow> 'a \\<Rightarrow> 'b\" (\"\\<langle>_\\<rangle>\") where\n  \"\\<langle>f\\<rangle> \\<equiv> \\<lambda>s. f\"\n\nabbreviation (input)\n  pred_not :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\" (\"\\<^bold>\\<not> _\" [40] 40) where\n  \"\\<^bold>\\<not>a \\<equiv> \\<lambda>s. \\<not>a s\"\n\nabbreviation (input)\n  pred_conj :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\" (infixr \"\\<^bold>\\<and>\" 35) where\n  \"a \\<^bold>\\<and> b \\<equiv> \\<lambda>s. a s \\<and> b s\"\n\nabbreviation (input)\n  pred_disj :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\" (infixr \"\\<^bold>\\<or>\" 30) where\n  \"a \\<^bold>\\<or> b \\<equiv> \\<lambda>s. a s \\<or> b s\"\n\nabbreviation (input)\n  pred_implies :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\" (infixr \"\\<^bold>\\<longrightarrow>\" 25) where\n  \"a \\<^bold>\\<longrightarrow> b \\<equiv> \\<lambda>s. a s \\<longrightarrow> b s\"\n\nabbreviation (input)\n  pred_iff :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\" (infixr \"\\<^bold>\\<longleftrightarrow>\" 25) where\n  \"a \\<^bold>\\<longleftrightarrow> b \\<equiv> \\<lambda>s. a s \\<longleftrightarrow> b s\"\n\nabbreviation (input)\n  pred_eq :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> bool\" (infix \"\\<^bold>=\" 40) where\n  \"a \\<^bold>= b \\<equiv> \\<lambda>s. a s = b s\"\n\nabbreviation (input)\n  pred_member :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'b set) \\<Rightarrow> 'a \\<Rightarrow> bool\" (infix \"\\<^bold>\\<in>\" 40) where\n  \"a \\<^bold>\\<in> b \\<equiv> \\<lambda>s. a s \\<in> b s\"\n\nabbreviation (input)\n  pred_neq :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> bool\" (infix \"\\<^bold>\\<noteq>\" 40) where\n  \"a \\<^bold>\\<noteq> b \\<equiv> \\<lambda>s. a s \\<noteq> b s\"\n\nabbreviation (input)\n  pred_If :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b\" (\"(If (_)/ Then (_)/ Else (_))\" [0, 0, 10] 10)\n  where \"If P Then x Else y \\<equiv> \\<lambda>s. if P s then x s else y s\"\n\nabbreviation (input)\n  pred_less :: \"('a \\<Rightarrow> 'b::ord) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> bool\" (infix \"\\<^bold><\" 40) where\n  \"a \\<^bold>< b \\<equiv> \\<lambda>s. a s < b s\"\n\nabbreviation (input)\n  pred_le :: \"('a \\<Rightarrow> 'b::ord) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> bool\" (infix \"\\<^bold>\\<le>\" 40) where\n  \"a \\<^bold>\\<le> b \\<equiv> \\<lambda>s. a s \\<le> b s\"\n\nabbreviation (input)\n  pred_plus :: \"('a \\<Rightarrow> 'b::plus) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b\" (infixl \"\\<^bold>+\" 65) where\n  \"a \\<^bold>+ b \\<equiv> \\<lambda>s. a s + b s\"\n\nabbreviation (input)\n  pred_minus :: \"('a \\<Rightarrow> 'b::minus) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b\" (infixl \"\\<^bold>-\" 65) where\n  \"a \\<^bold>- b \\<equiv> \\<lambda>s. a s - b s\"\n\nabbreviation (input)\n  fun_fanout :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'c) \\<Rightarrow> 'a \\<Rightarrow> 'b \\<times> 'c\" (infix \"\\<^bold>\\<bowtie>\" 35) where\n  \"f \\<^bold>\\<bowtie> g \\<equiv> \\<lambda>x. (f x, g x)\"\n\nabbreviation (input)\n  pred_all :: \"('b \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\" (binder \"\\<^bold>\\<forall>\" 10) where\n  \"\\<^bold>\\<forall>x. P x \\<equiv> \\<lambda>s. \\<forall>x. P x s\"\n\nabbreviation (input)\n  pred_ex :: \"('b \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\" (binder \"\\<^bold>\\<exists>\" 10) where\n  \"\\<^bold>\\<exists>x. P x \\<equiv> \\<lambda>s. \\<exists>x. P x s\"\n\nabbreviation (input)\n  pred_app :: \"('b \\<Rightarrow> 'a \\<Rightarrow> 'c) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'c\" (infixl \"\\<^bold>$\" 100) where\n  \"f \\<^bold>$ g \\<equiv> \\<lambda>s. f (g s) s\"\n\nabbreviation (input)\n  pred_subseteq :: \"('a \\<Rightarrow> 'b set) \\<Rightarrow> ('a \\<Rightarrow> 'b set) \\<Rightarrow> 'a \\<Rightarrow> bool\" (infix \"\\<^bold>\\<subseteq>\" 50) where\n  \"A \\<^bold>\\<subseteq> B \\<equiv> \\<lambda>s. A s \\<subseteq> B s\"\n\nabbreviation (input)\n  pred_union :: \"('a \\<Rightarrow> 'b set) \\<Rightarrow> ('a \\<Rightarrow> 'b set) \\<Rightarrow> 'a \\<Rightarrow> 'b set\" (infixl \"\\<^bold>\\<union>\" 65) where\n  \"a \\<^bold>\\<union> b \\<equiv> \\<lambda>s. a s \\<union> b s\"\n\nabbreviation (input)\n  pred_inter :: \"('a \\<Rightarrow> 'b set) \\<Rightarrow> ('a \\<Rightarrow> 'b set) \\<Rightarrow> 'a \\<Rightarrow> 'b set\" (infixl \"\\<^bold>\\<inter>\" 65) where\n  \"a \\<^bold>\\<inter> b \\<equiv> \\<lambda>s. a s \\<inter> b s\"\n\ntext\\<open>\n\nMore application specific.\n\n\\<close>\n\nabbreviation (input)\n  pred_conjoin :: \"('a \\<Rightarrow> bool) list \\<Rightarrow> 'a \\<Rightarrow> bool\" where\n  \"pred_conjoin xs \\<equiv> foldr (\\<^bold>\\<and>) xs \\<langle>True\\<rangle>\"\n\nabbreviation (input)\n  pred_disjoin :: \"('a \\<Rightarrow> bool) list \\<Rightarrow> 'a \\<Rightarrow> bool\" where\n  \"pred_disjoin xs \\<equiv> foldr (\\<^bold>\\<or>) xs \\<langle>False\\<rangle>\"\n\nabbreviation (input)\n  pred_is_none :: \"('a \\<Rightarrow> 'b option) \\<Rightarrow> 'a \\<Rightarrow> bool\" (\"NULL _\" [40] 40) where\n  \"NULL a \\<equiv> \\<lambda>s. a s = None\"\n\nabbreviation (input)\n  pred_empty :: \"('a \\<Rightarrow> 'b set) \\<Rightarrow> 'a \\<Rightarrow> bool\" (\"EMPTY _\" [40] 40) where\n  \"EMPTY a \\<equiv> \\<lambda>s. a s = {}\"\n\nabbreviation (input)\n  pred_list_null :: \"('a \\<Rightarrow> 'b list) \\<Rightarrow> 'a \\<Rightarrow> bool\" (\"LIST'_NULL _\" [40] 40) where\n  \"LIST_NULL a \\<equiv> \\<lambda>s. a s = []\"\n\nabbreviation (input)\n  pred_list_append :: \"('a \\<Rightarrow> 'b list) \\<Rightarrow> ('a \\<Rightarrow> 'b list) \\<Rightarrow> 'a \\<Rightarrow> 'b list\" (infixr \"\\<^bold>@\" 65) where\n  \"xs \\<^bold>@ ys \\<equiv> \\<lambda>s. xs s @ ys s\"\n\nabbreviation (input)\n  pred_pair :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'c) \\<Rightarrow> 'a \\<Rightarrow> 'b \\<times> 'c\" (infixr \"\\<^bold>\\<otimes>\" 60) where\n  \"a \\<^bold>\\<otimes> b \\<equiv> \\<lambda>s. (a s, b s)\"\n\nabbreviation (input)\n  pred_singleton :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b set\" where\n  \"pred_singleton x \\<equiv> \\<lambda>s. {x s}\"\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/ConcurrentIMP/CIMP_pred.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.33569984061527874}}
{"text": "theory Test_SeLFiE\nimports Main SeLFiE\nbegin\n\nlemma \"zip xs ys = zip xs ys\"\n  sem_ind\n  oops\n\nlemma \"length xs = length ys \\<Longrightarrow> True\"\n  sem_ind\n  oops\n\nlemma \"List.list.list_all2 f xs ys \\<Longrightarrow> xs = ys\"\n  sem_ind\n  apply(induct xs ys rule:list_all2_induct)\n  oops\n\nlemma \"f x \\<Longrightarrow> g y \\<Longrightarrow> h z\"\n  sem_ind\n  assert_SeLFiE_true  test_is_a_meta_premise    [on[\"f x\"], arb[],rule[]]\n  assert_SeLFiE_false test_is_a_meta_premise    [on[\"h z\"], arb[],rule[]]\n  assert_SeLFiE_true  test_is_a_meta_conclusion [on[\"h z\"], arb[],rule[]]\n  assert_SeLFiE_true  test_is_a_meta_premise_or_below    [on[\"x\"], arb[],rule[]]\n  assert_SeLFiE_false test_is_a_meta_premise_or_below    [on[\"z\"], arb[],rule[]]\n  assert_SeLFiE_true  test_is_a_meta_conclusion_or_below [on[\"z\"], arb[],rule[]]\n  assert_SeLFiE_false test_is_a_meta_conclusion_or_below [on[\"x\"], arb[],rule[]]\n  assert_SeLFiE_true test_is_more_than [on[\"zs\"], arb[],rule[]]\n  assert_SeLFiE_false test_Is_If_Then_Else [on[\"zs\"], arb[],rule[]]\n  assert_SeLFiE_false test_Is_If_Then_Else [on[\"x\"], arb[],rule[]]\n  assert_SeLFiE_false test_Is_Case_Distinct_Of_Trm_With_A_Case [on[\"zs\"], arb[],rule[]]\n  oops\n\nlemma \"if x then True else False\"\n  sem_ind\n  assert_SeLFiE_true  test_Is_If_Then_Else [on[\"x\"], arb[],rule[]]\n  oops\n\nlemma \"case x of [y] \\<Rightarrow> y | _ \\<Rightarrow> False\"\n  assert_SeLFiE_true  test_Is_Case_Distinct_Of_Trm_With_A_Case [on[\"zs\"], arb[],rule[]]\n  assert_SeLFiE_false test_Is_Let_X_Be_Y_In_X [on[\"zs\"], arb[],rule[]]\n  oops\n\nlemma \"let (x1, x2) = y in z < x1\"\n  assert_SeLFiE_true test_Is_Let_X_Be_Y_In_X [on[\"zs\"], arb[],rule[]]\n  oops\n\n primrec rev1 :: \"'a list \\<Rightarrow> 'a list\" where\n  \"rev1 []       = []\" |\n  \"rev1 (x # xs) = rev1 xs @ [x]\"\n\n fun rev2 :: \"'a list \\<Rightarrow> 'a list \\<Rightarrow> 'a list\" where\n  \"rev2 []     ys = ys\" |\n  \"rev2 (x#xs) ys = rev2 xs (x#ys)\"\n\n lemma \"rev2 xs ys = rev1 xs @ ys\"\n  apply(induct xs arbitrary: ys)\n\n  sem_ind\n  all_induction_heuristic      [on[], arb[],rule[\"List.list_induct2'\"]]\n  all_induction_heuristic      [on[\"xs\"], arb[\"ys\"],rule[]]\n  all_generalization_heuristic [on[\"xs\"], arb[\"ys\"],rule[]]\n  all_induction_heuristic [on[\"xs\",\"ys\"], arb[],rule[\"rev2.induct\"]]\n(*\n  assert_SeLFiE_true  generalize_arguments_used_in_recursion_deep [on[\"xs\"], arb[\"ys\"], rule[]]\n  assert_SeLFiE_true  generalize_arguments_used_in_recursion_deep [on[\"xs\"], arb[    ], rule[]](*Not great, but does not harm much.*)\n*)\n  assert_SeLFiE_true  generalize_arguments_used_in_recursion [on[\"xs\"], arb[\"ys\"],rule[]](*It used to take 1.196s elapsed time*)\n  assert_SeLFiE_false generalize_arguments_used_in_recursion [on[\"xs\"], arb[\"xs\"],rule[]](*It used to take 2.467s elapsed time*)\n  assert_SeLFiE_false generalize_arguments_used_in_recursion [on[\"xs\"], arb[    ],rule[]](*It used to take 0.864s elapsed time*)\n  assert_SeLFiE_true  for_all_arbs_there_should_be_a_change  [on[\"xs\"], arb[\"ys\"],rule[]]\n  assert_SeLFiE_true  for_all_arbs_there_should_be_a_change_simplified_for_presentation [on[\"xs\"], arb[\"ys\"],rule[]]\n  assert_SeLFiE_false for_all_arbs_there_should_be_a_change_simplified_for_presentation [on[\"xs\"], arb[\"xs\"],rule[]]\n  assert_SeLFiE_true  for_all_arbs_there_should_be_a_change  [on[\"xs\"], arb[],rule[]](*unfortunate result due to the universal quantifier.*)\n  assert_SeLFiE_true  is_defined_recursively_on_nth  [on[\"xs\"], arb[\"ys\"],rule[]](*It used to take 0.703s elapsed time*)\n  assert_SeLFiE_false is_defined_recursively_on_nth  [on[\"ys\"], arb[],rule[]](*It used to take 1.647s elapsed time*)\n  assert_SeLFiE_true heuristic_1  [on[\"xs\"], arb[\"ys\"],rule[]]\n  assert_SeLFiE_true heuristic_2  [on[\"xs\"], arb[\"ys\"],rule[]]\n  assert_SeLFiE_true heuristic_3  [on[\"xs\"], arb[\"ys\"],rule[]]\n  assert_SeLFiE_true heuristic_4  [on[\"xs\"], arb[\"ys\"],rule[\"itrev.induct\"]]\n  assert_SeLFiE_true heuristic_5  [on[\"xs\"], arb[\"ys\"],rule[]]\n  assert_SeLFiE_true heuristic_6  [on[\"xs\"], arb[\"ys\"],rule[]]\n  assert_SeLFiE_true heuristic_7  [on[\"xs\"], arb[\"ys\"],rule[]]\n  assert_SeLFiE_true heuristic_8  [on[\"xs\"], arb[\"ys\"],rule[]]\n  assert_SeLFiE_true heuristic_9  [on[\"xs\"], arb[\"ys\"],rule[]]\n  assert_SeLFiE_true heuristic_10 [on[\"xs\"], arb[\"ys\"],rule[]]\n(*\n  assert_SeLFiE_true heuristic_11 [on[\"xs\"], arb[\"ys\"],rule[]]\n*)\n  assert_SeLFiE_true heuristic_12 [on[\"xs\"], arb[\"ys\"],rule[\"itrev.induct\"]]\n  assert_SeLFiE_true heuristic_13 [on[\"xs\"], arb[\"ys\"],rule[\"itrev.induct\"]]\n  assert_SeLFiE_true heuristic_14 [on[\"xs\"], arb[\"ys\"],rule[\"itrev.induct\"]]\n  assert_SeLFiE_true test_dive_in  [on[\"xs\"], arb[\"ys\"],rule[\"itrev.induct\"]]\n  assert_SeLFiE_true print_all_outer_prints [on[\"xs\"], arb[\"ys\"],rule[\"itrev.induct\"]]\n  assert_SeLFiE_true print_all_inner_prints [on[\"xs\"], arb[\"ys\"],rule[\"itrev.induct\"]]\n  assert_SeLFiE_true print_all_unodes       [on[\"xs\"], arb[\"ys\"],rule[\"itrev.induct\"]]\n  assert_SeLFiE_true print_outer_path_root  [on[\"xs\"], arb[\"ys\"],rule[\"itrev.induct\"]]\n  assert_SeLFiE_true lifter_4  [on[\"xs\"], arb[\"ys\"], rule[]]\n  assert_SeLFiE_true lifter_5  [on[\"xs\",\"ys\"], arb[], rule[\"rev2.induct\"]]\n  assert_SeLFiE_true lifter_6  [on[\"xs\"], arb[\"ys\"], rule[]]\n  assert_SeLFiE_true lifter_7  [on[\"xs\"], arb[\"ys\"], rule[]]\n  assert_SeLFiE_true lifter_8  [on[\"xs\"], arb[\"ys\"], rule[]]\n  assert_SeLFiE_true lifter_9  [on[\"xs\"], arb[\"ys\"], rule[]]\n  assert_SeLFiE_true lifter_10  [on[\"xs\"], arb[\"ys\"], rule[]]\n  assert_SeLFiE_true lifter_11  [on[\"xs\",\"ys\"], arb[], rule[\"rev2.induct\"]]\n  assert_SeLFiE_true lifter_12  [on[\"xs\"], arb[\"ys\"], rule[\"rev2.induct\"]]\n  assert_SeLFiE_true lifter_15  [on[\"xs\"], arb[\"ys\"], rule[\"rev.induct\"]]\n  assert_SeLFiE_true lifter_13  [on[\"xs\"], arb[\"ys\"], rule[\"rev2.induct\"]]\n  assert_SeLFiE_true lifter_14  [on[\"xs\"], arb[\"ys\"], rule[\"rev2.induct\"]]\n  assert_SeLFiE_true print_fst_params_of_fun_const [on[\"xs\"], arb[\"ys\"],rule[\"rev2.induct\"]]\n  assert_SeLFiE_true print_inner_roots      [on[\"xs\"], arb[\"ys\"],rule[\"rev2.induct\"]]\n  assert_SeLFiE_true print_all_inner_lhss   [on[\"xs\"], arb[\"ys\"],rule[\"rev2.induct\"]]\n  assert_SeLFiE_true lifter_1  [on[\"xs\"], arb[\"ys\"],rule[\"rev2.induct\"]]\n  assert_SeLFiE_true lifter_1b [on[\"xs\"], arb[\"ys\"],rule[\"rev2.induct\"]]\n  assert_SeLFiE_true lifter_2  [on[\"xs\"], arb[\"ys\"],rule[\"rev2.induct\"]]\n  assert_SeLFiE_true lifter_3  [on[\"xs\"], arb[\"ys\"],rule[\"rev2.induct\"]]\n  assert_SeLFiE_true  test_Is_Subprint_Of_true  [on[\"xs\"], arb[\"ys\"],rule[\"rev2.induct\"]]\n  assert_SeLFiE_false test_Is_Subprint_Of_false  [on[\"xs\"], arb[\"ys\"],rule[\"rev2.induct\"]]\n  assert_SeLFiE_false rule_inversion_using_the_deepest_const [on[\"xs\", \"ys\"], arb[],rule[\"rev2.induct\"]]\n  apply(induct xs arbitrary: ys) apply auto done\n\ndefinition \"list_reversal_eq xs ys \\<equiv> rev2 xs ys = rev1 xs @ ys\"\nprint_theorems\n\nlemma \"list_reversal_eq xs ys\"\n  sem_ind\n(*\n  assert_SeLFiE_true  generalize_arguments_used_in_recursion_deep [on[\"xs\"], arb[\"ys\"], rule[]](*good*)\n  assert_SeLFiE_false generalize_arguments_used_in_recursion_deep [on[\"xs\"], arb[    ], rule[]](*Great*)\n*)\n  sem_ind\n  apply(induct xs arbitrary: ys)\n   apply(auto simp: list_reversal_eq_def)\n  done\n\n(* auxiliary stuff *)\nML\\<open>\n@{term \"let x = 1 in x\"};\n(*\n  Const (\"HOL.Let\", \"'a \\<Rightarrow> ('a \\<Rightarrow> 'a) \\<Rightarrow> 'a\")\n$ Const (\"Groups.one_class.one\", \"'a\")\n$ Abs   (\"x\", \"'a\", Bound 0): term\n*)\n\n@{term \"let x = 1 + y in x\"};\n(*\n  Const (\"HOL.Let\", \"'a \\<Rightarrow> ('a \\<Rightarrow> 'a) \\<Rightarrow> 'a\")\n$(  Const (\"Groups.plus_class.plus\", \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\")\n  $ Const (\"Groups.one_class.one\", \"'a\")\n  $ Free (\"y\", \"'a\")\n )\n$ Abs   (\"x\", \"'a\", Bound 0)\n*)\n\n@{term \"\\<lambda>x. x + 1\"};\n@{term \"case x of [] => y | _ \\<Rightarrow> z\"};\n(*\n  Const (\"List.list.case_list\", \"'a \\<Rightarrow> ('b \\<Rightarrow> 'b list \\<Rightarrow> 'a) \\<Rightarrow> 'b list \\<Rightarrow> 'a\")\n$ Free  (\"y\", \"'a\")\n$ Abs   (\"a\", \"'b\", Abs (\"list\", \"'b list\", Free (\"z\", \"'a\")))\n$ Free  (\"x\", \"'b list\")\n*)\n\n@{term \"case x of [] => y | w#ws \\<Rightarrow> z\"};\n(*\n  Const (\"List.list.case_list\", \"'a \\<Rightarrow> ('b \\<Rightarrow> 'b list \\<Rightarrow> 'a) \\<Rightarrow> 'b list \\<Rightarrow> 'a\")\n$ Free  (\"y\", \"'a\")\n$ Abs   (\"w\", \"'b\", Abs (\"ws\", \"'b list\", Free (\"z\", \"'a\")))\n$ Free  (\"x\", \"'b list\"):\n*)\n\n@{term \"case x of [] => y | w#ws \\<Rightarrow> w\"};\n(*\n  Const (\"List.list.case_list\", \"'a \\<Rightarrow> ('a \\<Rightarrow> 'a list \\<Rightarrow> 'a) \\<Rightarrow> 'a list \\<Rightarrow> 'a\")\n$ Free  (\"y\", \"'a\")\n$ Abs   (\"w\", \"'a\", Abs (\"ws\", \"'a list\", Bound 1))\n$ Free  (\"x\", \"'a list\")\n*)\n\n@{term \"case x of True => y | _ \\<Rightarrow> z\"}\n(*\n  Const (\"Product_Type.bool.case_bool\", \"'a \\<Rightarrow> 'a \\<Rightarrow> bool \\<Rightarrow> 'a\")\n$ Free  (\"y\", \"'a\")\n$ Free  (\"z\", \"'a\")\n$ Free  (\"x\", \"bool\")\n*)\n\n(*\nIs_Case = name has a string \"case\" as its sub-string\n  and it it takes n arguments, (n-1)th argument's type name is part of the constant name..;\nIs_Maybe_Bound_Of_Case;\n*)\n\\<close>\nfind_consts name:\"case_list\"\nfind_consts name:\"Product_Type.bool.case_bool\"\nfind_theorems name:\"case\" name:\"bool\"\nfind_theorems name:\"List.list\"\nthm List.list.case\n(*\ndatatype alpha = A | B | C | D\nML\\<open>\n@{term \"case x of A \\<Rightarrow> True | B \\<Rightarrow> False\"};\n(*\n   Const (\"SeLFiE.alpha.case_alpha\", \"bool \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> alpha \\<Rightarrow> bool\")\n $ Const (\"HOL.True\", \"bool\")\n $ Const (\"HOL.False\", \"bool\")\n $ Const (\"HOL.undefined\", \"bool\")\n $ Const (\"HOL.undefined\", \"bool\")\n $ Free (\"x\", \"alpha\"):\n term\n\n\n  Const (\"LiFtEr.alpha.case_alpha\", \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> alpha \\<Rightarrow> 'a\")\n$ Free  (\"a\", \"'a\")\n$ Free  (\"b\", \"'a\")\n$ Const (\"HOL.undefined\", \"'a\")\n$ Const (\"HOL.undefined\", \"'a\")\n$ Free  (\"x\", \"alpha\")\n*)\n\\<close>\n*)\nML\\<open>\n(*\n@{term \"case x of B \\<Rightarrow> False | A \\<Rightarrow> True \"};\n*)\n(*\n  Const (\"SeLFiE.alpha.case_alpha\", \"bool \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> alpha \\<Rightarrow> bool\")\n$ Const (\"HOL.True\", \"bool\")\n$ Const (\"HOL.False\", \"bool\")\n$ Const (\"HOL.undefined\", \"bool\")\n$ Const (\"HOL.undefined\", \"bool\")\n$ Free (\"x\", \"alpha\")\n: term\n*)\n\\<close>\ndeclare[[ML_print_depth=100]]\nML\\<open>\n@{term \"case x of [x] \\<Rightarrow> False | [] \\<Rightarrow> True | x#xs \\<Rightarrow> True\"};\n(*\n  Const (\"List.list.case_list\", \"bool \\<Rightarrow> ('a \\<Rightarrow> 'a list \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> bool\")\n$ Const (\"HOL.True\", \"bool\")\n$ Abs (\"x\", \"'a\",\n    Abs (\"xs\",\n         \"'a list\",\n           Const (\"List.list.case_list\", \"bool \\<Rightarrow> ('a \\<Rightarrow> 'a list \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> bool\")\n         $ Const (\"HOL.False\", \"bool\")\n         $ Abs (\"a\", \"'a\",\n             Abs (\"list\", \"'a list\",\n               Const (\"HOL.True\", \"bool\")\n             )\n           )\n         $ Bound 0\n    )\n  )\n$ Free (\"x\", \"'a list\")\n: term\n*)\n\\<close>\n\nML\\<open>\n@{term \"case x of [] \\<Rightarrow> True | x#xs \\<Rightarrow> False\"};\n(*\n  Const (\"List.list.case_list\", \"bool \\<Rightarrow> ('a \\<Rightarrow> 'a list \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> bool\")\n$ Const (\"HOL.True\", \"bool\")\n$ Abs (\"x\", \"'a\", Abs (\"xs\", \"'a list\", Const (\"HOL.False\", \"bool\")))\n$ Free (\"x\", \"'a list\")\n: term\n*)\n\\<close>\n\nML\\<open>\n@{term \"List.list.case_list\"};\nIsabelle_Utils.count_numb_of_args_of_fun_typ;\n\nfun count_numb_of_args_of_fun_typ' (fun_typ:typ) (acc:int) = case try dest_funT fun_typ of\n  NONE => acc\n| SOME (_(*domain_typ*), range_typ) => count_numb_of_args_of_fun_typ' range_typ (acc + 1);\n\nfun count_numb_of_args_of_fun_typ (typ:typ) = count_numb_of_args_of_fun_typ' typ 0;\n\n@{term \"List.null\"};\ndest_Const @{term \"List.null\"} |> snd |> dest_funT;\n\n@{term \"List.nth\"};\ndest_Const @{term \"List.nth\"} |> snd |> dest_funT |> snd |> dest_funT;\n\nlocal\n\nfun get_fist_type (fun_typ:typ) =\n    let\n      val (first_typ, _) = dest_funT fun_typ;\n    in\n      first_typ\n    end;\n\nfun remove_first_n_minus_one_typs (fun_typ:typ) (0:int) = fun_typ\n  | remove_first_n_minus_one_typs (fun_typ:typ) (n:int) =\n    let\n      val (_, tail_fun_typ) = dest_funT fun_typ;\n    in\n      remove_first_n_minus_one_typs tail_fun_typ (n - 1)\n    end;\n\nin\n\nfun fun_typ_to_typ_of_nth_arg (fun_typ:typ) (n:int) = (get_fist_type oo remove_first_n_minus_one_typs) fun_typ n;\n\nend;\n\nfun_typ_to_typ_of_nth_arg ((snd o dest_Const) @{term \"List.list.case_list\"}) 1\n\\<close>\n\nML\\<open>\n@{term \"case x of x#xs \\<Rightarrow> False | [] \\<Rightarrow> True\"};\n(*\n  Const (\"List.list.case_list\", \"bool \\<Rightarrow> ('a \\<Rightarrow> 'a list \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> bool\")\n$ Const (\"HOL.True\", \"bool\")\n$ Abs (\"x\", \"'a\", Abs (\"xs\", \"'a list\", Const (\"HOL.False\", \"bool\")))\n$ Free (\"x\", \"'a list\")\n: term\n*)\n\\<close>\n\nML\\<open>\n@{term \"case [] of x#xs \\<Rightarrow> False | [] \\<Rightarrow> True\"};\n(*\n  Const (\"List.list.case_list\", \"bool \\<Rightarrow> ('a \\<Rightarrow> 'a list \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> bool\")\n$ Const (\"HOL.True\", \"bool\")\n$ Abs (\"x\", \"'a\", Abs (\"xs\", \"'a list\", Const (\"HOL.False\", \"bool\")))\n$ Const (\"List.list.Nil\", \"'a list\"): term\n*)\n\\<close>\n\nML\\<open>\n@{term \"case f x of x#xs \\<Rightarrow> False | [] \\<Rightarrow> True\"};\n(*\n  Const (\"List.list.case_list\", \"bool \\<Rightarrow> ('a \\<Rightarrow> 'a list \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> bool\")\n$ Const (\"HOL.True\", \"bool\")\n$ Abs (\"x\", \"'a\", Abs (\"xs\", \"'a list\", Const (\"HOL.False\", \"bool\")))\n$ (Free (\"f\", \"'b \\<Rightarrow> 'a list\") $ Free (\"x\", \"'b\")): term\n*);\n\\<close>\n\nML\\<open>\n@{term \"let ((x1,  x2),  x3) = (y1, y2) in (y1, x3)\"};\n(*\nval it =\n   Const (\"HOL.Let\", \"'a \\<times> 'b \\<times> 'c \\<Rightarrow> ('a \\<times> 'b \\<times> 'c \\<Rightarrow> 'a \\<times> 'c) \\<Rightarrow> 'a \\<times> 'c\")\n$ (Const (\"Product_Type.Pair\", \"'a \\<Rightarrow> 'b \\<times> 'c \\<Rightarrow> 'a \\<times> 'b \\<times> 'c\")\n  $ Free (\"y1\", \"'a\")\n  $ Free (\"y2\", \"'b \\<times> 'c\"))\n$ (Const (\"Product_Type.prod.case_prod\", \"('a \\<Rightarrow> 'b \\<times> 'c \\<Rightarrow> 'a \\<times> 'c) \\<Rightarrow> 'a \\<times> 'b \\<times> 'c \\<Rightarrow> 'a \\<times> 'c\")\n  $ Abs (\"x1\", \"'a\",\n      Const (\"Product_Type.prod.case_prod\", \"('b \\<Rightarrow> 'c \\<Rightarrow> 'a \\<times> 'c) \\<Rightarrow> 'b \\<times> 'c \\<Rightarrow> 'a \\<times> 'c\")\n     $ Abs (\"x2\", \"'b\",\n         Abs (\"x3\", \"'c\",\n           Const (\"Product_Type.Pair\", \"'a \\<Rightarrow> 'c \\<Rightarrow> 'a \\<times> 'c\")\n          $ Free (\"y1\", \"'a\")\n          $ Bound 0\n         )\n       )\n    )\n  )\n\n: term\nIs_Let_X_Be_Y_In_Z.\nAgain, we have to count the number of Abs.\nX_Is_Let_Z_Be_Y_In_Z.\n*)\n@{term \"Product_Type.Pair\"};\ndest_funT;\n\\<close>\n\nML\\<open>\n@{term \"let x = y in z\"};\n@{term \"(x = y)\"};\nName.skolem;\nVariable.names_of;\nVariable.add_fixes;\ntype asdf = term;\n\\<close>\n\nschematic_goal \"?x = ?x\"\n  apply(tactic \\<open>fn x => (\nlet\n  val fst_subg = try (hd o Thm.prems_of) x: term option;\n  val _        = if length (Thm.prems_of x) = 0 then tracing \"empty\" else tracing \"no empty\";\n  \n  val _ = Option.map (tracing o Isabelle_Utils.trm_to_string @{context}) (fst_subg);\n\n  val _ = if Utils.is_some_true (Option.map (exists_subterm (is_Var)) fst_subg)\n          then tracing \"Yes Var!\"\n          else tracing \"No Var!\"\n  val _ = if Utils.is_some_true (Option.map (exists_subterm (is_Bound)) fst_subg)\n          then tracing \"Yes Bound!\"\n          else tracing \"No Bound!\"\n\nin\n  Seq.single x\nend) \\<close>)\n  oops\n\nlemma helper: \"rev2 xs ys = rev1 xs @ ys\"\n  apply (induct xs arbitrary: ys)\n  by auto\n\nlemma equivalence: \"rev2 xs [] = rev1 xs\"\n  by (simp add: helper)\n\n\nML\\<open>\n(*\n Try.tool_setup (nitpickN, (50, \\<^system_option>\\<open>auto_nitpick\\<close>, try_nitpick))\n*)\n Try.tool_setup;\n\nTerm.add_free_names @{term \"f (x z) y\"} [] |> rev  |> distinct (op =)\n\\<close>\n\nlemma \"rev2 xs ys = rev1 xs @ ys\"\n  apply(induct xs)\n   apply auto\n  apply(subgoal_tac \"\\<And>xs. \\<forall>ys. rev2 xs ys = rev1 xs @ ys\")\n  apply fastforce\n  apply(induct_tac xsa)\n   apply auto\n  done\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Test_SeLFiE.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5774953651858117, "lm_q1q2_score": 0.3356998406152787}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"Signed Words\"\n\ntheory Signed_Words\nimports \"~~/src/HOL/Word/Word\"\nbegin\n\ntext \\<open>Signed words as separate (isomorphic) word length class. Useful for tagging words in C.\\<close>\n\ntypedef ('a::len0) signed = \"UNIV :: 'a set\" ..\n\nlemma card_signed [simp]: \"CARD (('a::len0) signed) = CARD('a)\"\n  unfolding type_definition.card [OF type_definition_signed]\n  by simp\n\ninstantiation signed :: (len0) len0\nbegin\n\ndefinition\n  len_signed [simp]: \"len_of (x::'a::len0 signed itself) = len_of TYPE('a)\"\n\ninstance ..\n\nend\n\ninstance signed :: (len) len\n  by (intro_classes, simp)\n\ntype_synonym 'a sword = \"'a signed word\"\ntype_synonym  sword8 =  \"8 sword\"\ntype_synonym sword16 = \"16 sword\"\ntype_synonym sword32 = \"32 sword\"\ntype_synonym sword64 = \"64 sword\"\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Word_Lib/Signed_Words.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525098, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.335659898341935}}
{"text": "theory VertexCover4ToMetricTravelingSalesman_AdjList                                                 \n  imports VertexCover4ToMetricTravelingSalesman_Specs GraphAdjList\nbegin  \n\nnotation ugraph_adj_list.ugraph_adj_map_invar (\"ugraph'_invar\")\nnotation ugraph_adj_list.rep (\"rep'_uedge\")\nnotation ugraph_adj_list.neighborhood (\"\\<N>\")\n\ncontext ugraph_adj_map_by_linorder \nbegin\n\n\\<comment> \\<open>Compute representatives for induced graph.\\<close>\nfun rep_prod :: \"('v uedge \\<times> 'v \\<times> nat) uedge \\<Rightarrow> ('v uedge \\<times> 'v \\<times> nat) uedge\" where\n  \"rep_prod (uEdge (uEdge u\\<^sub>1 v\\<^sub>1,w\\<^sub>1,i\\<^sub>1) (uEdge u\\<^sub>2 v\\<^sub>2,w\\<^sub>2,i\\<^sub>2)) = \n    (let e\\<^sub>1 = (uEdge u\\<^sub>1 v\\<^sub>1,w\\<^sub>1,i\\<^sub>1); e\\<^sub>2 = (uEdge u\\<^sub>2 v\\<^sub>2,w\\<^sub>2,i\\<^sub>2) in\n    if u\\<^sub>1 < u\\<^sub>2 then uEdge e\\<^sub>1 e\\<^sub>2\n    else if u\\<^sub>2 < u\\<^sub>1 then uEdge e\\<^sub>2 e\\<^sub>1\n    else if v\\<^sub>1 < v\\<^sub>2 then uEdge e\\<^sub>1 e\\<^sub>2\n    else if v\\<^sub>2 < v\\<^sub>1 then uEdge e\\<^sub>2 e\\<^sub>1\n    else if w\\<^sub>1 < w\\<^sub>2 then uEdge e\\<^sub>1 e\\<^sub>2\n    else if w\\<^sub>2 < w\\<^sub>1 then uEdge e\\<^sub>2 e\\<^sub>1\n    else if i\\<^sub>1 < i\\<^sub>2 then uEdge e\\<^sub>1 e\\<^sub>2\n    else if i\\<^sub>2 < i\\<^sub>1 then uEdge e\\<^sub>2 e\\<^sub>1\n    else uEdge e\\<^sub>1 e\\<^sub>2)\" (* TODO: is there a way of automizing this? *)\n\nlemma rep_prod_is_rep_sym: \"rep_prod (uEdge x y) = rep_prod (uEdge y x)\" \nproof (cases x; cases y)\n  fix e\\<^sub>1 w\\<^sub>1 i\\<^sub>1 e\\<^sub>2 w\\<^sub>2 i\\<^sub>2\n  assume [simp]: \"x = (e\\<^sub>1,w\\<^sub>1,i\\<^sub>1)\" and [simp]: \"y = (e\\<^sub>2,w\\<^sub>2,i\\<^sub>2)\"\n  show ?thesis\n    by (cases e\\<^sub>1; cases e\\<^sub>2) (auto simp add: Let_def)\nqed\n\nlemma rep_prod_is_rep_cases: \"rep_prod (uEdge x y) = uEdge x y \\<or> rep_prod (uEdge x y) = uEdge y x\"\nproof (cases x; cases y)\n  fix e\\<^sub>1 w\\<^sub>1 i\\<^sub>1 e\\<^sub>2 w\\<^sub>2 i\\<^sub>2\n  assume [simp]: \"x = (e\\<^sub>1,w\\<^sub>1,i\\<^sub>1)\" and [simp]: \"y = (e\\<^sub>2,w\\<^sub>2,i\\<^sub>2)\"\n  show ?thesis\n    by (cases e\\<^sub>1; cases e\\<^sub>2) (auto simp add: Let_def)\nqed\n\nlemmas rep_prod_is_rep = rep_prod_is_rep_sym rep_prod_is_rep_cases\n\nend\n\nnotation ugraph_adj_list.rep_prod (\"rep'_uedge'_prod\")\n\nabbreviation \"uedge \\<equiv> \\<lambda>u v. rep_uedge (uEdge u v)\"\n\nlemma inj_rep_uedge_uv: \"inj_on (uedge u) X\"\n  by rule (auto split: if_splits)\n\nfun edges_from where \"edges_from (u,Nu) = map (uedge u) (filter (\\<lambda>v. uEdge u v = uedge u v) Nu)\"\n\nfun uedges where \"uedges G = concat (map edges_from G)\"\n\nlemma distinct_edges_from: \"distinct Nu \\<Longrightarrow> distinct (edges_from (u,Nu))\"\n  using inj_rep_uedge_uv by (auto simp add: distinct_map)\n\nlemma isin_edges_from_elim: \n  assumes \"x \\<in> set (edges_from (u,Nu))\"\n  obtains v where \"v \\<in> set Nu\" \"x = uEdge u v\" \"x = uedge u v\"\n  using assms by fastforce\n\nlemma isin_edges_from_intro: \n  assumes \"v \\<in> set Nu\" \"x = uEdge u v\" \"x = uedge u v\" \n  shows \"x \\<in> set (edges_from (u,Nu))\"\n  using assms by fastforce\n\nlemma disjoint_edges_from: \n  assumes \"ugraph_invar G\" \"(u,Nu) \\<in> set G\" \"(v,Nv) \\<in> set G\" \"(u,Nu) \\<noteq> (v,Nv)\"\n  shows \"set (edges_from (u,Nu)) \\<inter> set (edges_from (v,Nv)) = {}\"\nproof (rule ccontr)\n  assume \"set (edges_from (u,Nu)) \\<inter> set (edges_from (v,Nv)) \\<noteq> {}\"\n  then obtain w\\<^sub>1 w\\<^sub>2 where \"uEdge u w\\<^sub>1 = uEdge v w\\<^sub>2\"\n    by (auto elim: isin_edges_from_elim)\n  moreover have \"u \\<noteq> v\"\n    using assms lmap_unique_assoc by fastforce\n  ultimately show \"False\"\n    by auto\nqed\n\nlemma distinct_uedges_adj_list: \n  assumes \"ugraph_invar G\"\n  shows \"distinct (uedges G)\"\n  apply (subst uedges.simps)\n  apply (rule distinct_concat_map)\nproof -\n  have \"distinct (map fst G)\"\n    using assms by auto\n  thus \"distinct G\"\n    by (metis distinct_zipI1 zip_map_fst_snd)\n  show \"\\<And>x. x \\<in> set G \\<Longrightarrow> distinct (edges_from x)\" \n  proof -\n    fix x\n    assume \"x \\<in> set G\"\n    moreover obtain u Nu where [simp]: \"x = (u,Nu)\"\n      by (cases x)\n    ultimately have \"\\<N> G u = Nu\"\n      using assms isin_lmap_neighborhood by auto\n    hence \"distinct Nu\"\n      using assms by auto\n    thus \"distinct (edges_from x)\"\n      by (simp del: edges_from.simps) (intro distinct_edges_from)\n  qed\n  show \"\\<And>x y. x \\<in> set G \\<Longrightarrow> y \\<in> set G \\<Longrightarrow> x \\<noteq> y \\<Longrightarrow> set (edges_from x) \\<inter> set (edges_from y) = {}\"\n  proof -\n    fix x y\n    assume \"x \\<in> set G\" \"y \\<in> set G\" \"x \\<noteq> y\"\n    moreover obtain u Nu v Nv where [simp]: \"x = (u,Nu)\" and [simp]: \"y = (v,Nv)\"\n      by (cases x; cases y)\n    ultimately show \"set (edges_from x) \\<inter> set (edges_from y) = {}\"\n      apply (simp del: edges_from.simps)\n      apply (intro disjoint_edges_from)\n      using assms by auto\n  qed\nqed\n\nlemma uedges_rep_idem: \"map rep_uedge (uedges G) = (uedges G)\"\n  by (induction G) (auto simp add: ugraph_adj_list.rep_idem simp del: ugraph_adj_list.rep.simps)\n  \nlemma set_uedges:\n  assumes \"ugraph_invar G\"\n  shows \"set (uedges G) = ugraph_adj_list.uedges G\"\nproof\n  show \"set (uedges G) \\<subseteq> ugraph_adj_list.uedges G\"\n  proof\n    fix x\n    assume \"x \\<in> set (uedges G)\"\n    then obtain u Nu where \"(u,Nu) \\<in> set G\" \"x \\<in> set (edges_from (u,Nu))\"\n      by auto\n    moreover then obtain v where \"v \\<in> set Nu\" and [simp]: \"x = uedge u v\"\n      by (elim isin_edges_from_elim)\n    moreover have [simp]: \"\\<N> G u = Nu\"\n      using assms calculation isin_lmap_neighborhood by auto\n    ultimately have \"lset_isin (\\<N> G u) v\"\n      using assms by (auto simp add: lset_isin simp del: lset_isin.simps)\n    thus \"x \\<in> ugraph_adj_list.uedges G\"\n      unfolding ugraph_adj_list.uedges_def2 by auto\n  qed\nnext\n  show \"ugraph_adj_list.uedges G \\<subseteq> set (uedges G)\"\n  proof\n    fix x\n    assume \"x \\<in> ugraph_adj_list.uedges G\"\n    then obtain u v where [simp]: \"x = uedge u v\" and v_isin_Nu: \"lset_isin (\\<N> G u) v\" (is \"lset_isin ?Nu v\")\n      unfolding ugraph_adj_list.uedges_def2 by auto\n    moreover hence u_isin_Nv: \"lset_isin (\\<N> G v) u\" (is \"lset_isin ?Nv u\")\n      using assms by auto\n    ultimately consider \"x = uEdge u v\" | \"x = uEdge v u\"\n      using ugraph_adj_list.is_rep by auto\n    thus \"x \\<in> set (uedges G)\"\n    proof cases\n      assume \"x = uEdge u v\"\n      moreover have \"v \\<in> lset_set (\\<N> G u)\"\n        using assms v_isin_Nu lset_isin by metis\n      ultimately have \"x \\<in> set (edges_from (u,?Nu))\"\n        by (intro isin_edges_from_intro) simp+\n      moreover have \"lmap_lookup G u = Some ?Nu\" \n        using v_isin_Nu by (intro ugraph_adj_list.lookup_non_empty_neighborhood)\n      moreover hence \"(u,?Nu) \\<in> set G\"\n        using assms isin_lmap_lookup by metis\n      ultimately show \"x \\<in> set (uedges G)\"\n        by force\n    next\n      assume \"x = uEdge v u\"\n      moreover have \"x = uedge v u\"\n        using ugraph_adj_list.is_rep by auto\n      moreover have \"u \\<in> lset_set (\\<N> G v)\"\n        using assms v_isin_Nu lset_isin by metis\n      ultimately have \"x \\<in> set (edges_from (v,?Nv))\"\n        by (intro isin_edges_from_intro) simp+\n      moreover have \"lmap_lookup G v = Some ?Nv\" \n        using u_isin_Nv by (intro ugraph_adj_list.lookup_non_empty_neighborhood)\n      moreover hence \"(v,?Nv) \\<in> set G\"\n        using assms isin_lmap_lookup by metis\n      ultimately show \"x \\<in> set (uedges G)\"\n        by force\n    qed\n  qed\nqed\n\nfun fold_uedges where\n  \"fold_uedges f G = fold f (uedges G)\"\n\nlemma fold_uedges:\n  assumes \"ugraph_invar G\"\n  obtains es where \"distinct es\" \"map rep_uedge es = es\" \n    \"set es = ugraph_adj_list.uedges G\" \"fold_uedges f G a = fold f es a\"\nproof (rule that)\n  let ?es=\"uedges G\"\n  show \"distinct ?es\"\n    using assms by (intro distinct_uedges_adj_list)\n  show \"map rep_uedge ?es = ?es\"\n    using assms by (intro uedges_rep_idem)\n  show \"set ?es = ugraph_adj_list.uedges G\"\n    using assms by (intro set_uedges)\n  show \"fold_uedges f G a = fold f ?es a\"\n    by auto\nqed\n\ninterpretation fold_uedges: ugraph_adj_map_fold_uedges\n  lmap_empty lmap_update lmap_delete lmap_lookup lmap_invar lset_empty lset_insert lset_delete \n  lset_isin lset_set lset_invar lset_union lset_inter lset_diff\n  rep_uedge fold_uedges\n  apply unfold_locales \n  apply (elim fold_uedges)\n  apply auto\n  done\n\nfun fold_vset where\n  \"fold_vset f X = fold f X\"\n\nlemma finite_lsets: \"finite (lset_set X)\"\n  by auto\n\nlemma fold_vset: \n  assumes \"lset_invar X\"\n  obtains xs where \"distinct xs\" \"set xs = lset_set X\" \"fold_vset f X a = fold f xs a\"\n  using assms by auto\n\ninterpretation fold_vset: ugraph_adj_map_fold_vset\n  lmap_empty lmap_update lmap_delete lmap_lookup lmap_invar lset_empty lset_insert lset_delete \n  lset_isin lset_set lset_invar lset_union lset_inter lset_diff\n  rep_uedge fold_vset\n  apply unfold_locales\n  using finite_lsets apply simp\n  apply (elim fold_vset)\n  apply auto\n  done\n\ninterpretation lreduction: VC4_To_mTSP\n  (* graph representation 1 *) lmap_empty lmap_update lmap_delete lmap_lookup lmap_invar lset_empty \n  lset_insert lset_delete lset_isin lset_set lset_invar lset_union lset_inter lset_diff rep_uedge\n  (* graph representation 2 *) lmap_empty lmap_update lmap_delete lmap_lookup lmap_invar lset_empty \n  lset_insert lset_delete lset_isin lset_set lset_invar lset_union lset_inter lset_diff rep_uedge_prod\n  fold_uedges fold_uedges fold_uedges fold_uedges fold_uedges\n  fold_vset fold_vset fold_vset\n  choose_edge\n  apply unfold_locales\n  apply (rule ugraph_adj_list.rep_prod_is_rep(1))\n  apply (rule ugraph_adj_list.rep_prod_is_rep(2))\n  apply (elim fold_uedges; blast)\n  apply (elim fold_uedges; blast)\n  apply (elim fold_uedges; blast)\n  apply (elim fold_uedges; blast)\n  using finite_lsets apply simp\n  apply (elim fold_vset; blast)\n  apply (elim fold_vset; blast)\n  using finite_lsets apply simp\n  apply (elim fold_vset; blast)\n  apply (rule choose_edge) \n  apply simp\n  apply simp\n  done\n\n\\<comment> \\<open>Functions\\<close>\nthm lreduction.f.simps\nthm lreduction.c.simps\nthm lreduction.g.simps\n\nfun f_adjlist where\n  \"f_adjlist G = (\n    let V = fold_uedges (lset_union o lreduction.vertices_of_He) G lset_empty;\n        n = \\<lambda>x. (if lset_isin V x then lset_delete x V else lset_empty) in \n    fold_vset (\\<lambda>v. lmap_update v (n v)) V lmap_empty)\"\n\nlemma \"f_adjlist = lreduction.f\"\n  unfolding f_adjlist.simps Let_def lreduction.f.simps lreduction.complete_graph.simps \n    lreduction.graph_of_vertices.simps lreduction.vertices_of_H.simps \n    lreduction.neighborhood_compl.simps by simp\n\n\\<comment> \\<open>Feasibility\\<close>\nthm lreduction.f_is_complete\nthm lreduction.c_tri_inequality\nthm lreduction.g_is_vc\n\n\\<comment> \\<open>Correctness\\<close>\nthm lreduction.l_reduction1\nthm lreduction.l_reduction2\n\nend", "meta": {"author": "kollerlukas", "repo": "tsp", "sha": "1da45a02ba155387a267adacadae9a0dc374167c", "save_path": "github-repos/isabelle/kollerlukas-tsp", "path": "github-repos/isabelle/kollerlukas-tsp/tsp-1da45a02ba155387a267adacadae9a0dc374167c/reductions/VertexCover4ToMetricTravelingSalesman_AdjList.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.33565989834193494}}
{"text": "theory Deadlock\n  imports\n    TA.Timed_Automata TA_Library.CTL DBM.DBM_Operations TA.Normalized_Zone_Semantics\n    TA_Impl.Normalized_Zone_Semantics_Impl\n    TA_Impl.Normalized_Zone_Semantics_Impl_Refine\n    DBM.FW_More\n    TA_Library.Syntax_Bundles\nbegin\n\nunbundle no_library_syntax\n\nsection \\<open>Deadlock Checking\\<close>\n\nsubsection \\<open>Notes\\<close>\n\ntext \\<open>\nIf we want to run the deadlock checker together with a reachability check for property \\<open>P\\<close>, we can:\n  \\<^item> run a reachability check with \\<open>\\<not> check_deadlock\\<close> first; if we find a deadlock, we are done;\n    else we can check whether any of the reachable states satisfies \\<open>P\\<close>;\n  \\<^item> or run a reachability check with \\<open>P\\<close> first, which might give us earlier termination;\n    if we find that \\<open>P\\<close> is satisfied, can we directly report that the original formula is satisfied?\n\nGenerally, it seems advantageous to compute \\<open>\\<not> check_deadlock\\<close> on the final set of states, and\nnot intermediate subsumed ones, as the operation is expensive.\n\\<close>\n\n\nsubsection \\<open>Abstract Reachability Checking\\<close>\n\ndefinition zone_time_pre :: \"('c, ('t::time)) zone \\<Rightarrow> ('c, 't) zone\"\n(\"_\\<^sup>\\<down>\" [71] 71)\nwhere\n  \"Z\\<^sup>\\<down> = {u | u d. (u \\<oplus> d) \\<in> Z \\<and> d \\<ge> (0::'t)}\"\n\ndefinition zone_set_pre :: \"('c, 't::time) zone \\<Rightarrow> 'c list \\<Rightarrow> ('c, 't) zone\"\nwhere\n  \"zone_set_pre Z r = {u . ([r \\<rightarrow> (0::'t)]u) \\<in> Z}\"\n\ndefinition zone_pre :: \"('c, 't::time) zone \\<Rightarrow> 'c list \\<Rightarrow> ('c, 't) zone\"\n  where\n  \"zone_pre Z r = (zone_set_pre Z r)\\<^sup>\\<down>\"\n\nlemma zone_time_pre_mono:\n  \"A\\<^sup>\\<down> \\<subseteq> B\\<^sup>\\<down>\" if \"A \\<subseteq> B\"\n  using that unfolding zone_time_pre_def by auto\n\nlemma clock_set_split:\n  \"P (([r \\<rightarrow> 0]u) x) \\<longleftrightarrow> (x \\<notin> set r \\<longrightarrow> P (u x)) \\<and> (x \\<in> set r \\<longrightarrow> P 0)\"\n  by (cases \"x \\<in> set r\") auto\n\n\n\n\n\n\ncontext Regions_TA\nbegin\n\ndefinition\n  \"check_deadlock l Z \\<equiv> Z \\<subseteq>\n    \\<Union> {(zone_set_pre {u. u \\<turnstile> inv_of A l'} r \\<inter> {u. u \\<turnstile> g} \\<inter> {u. u \\<turnstile> inv_of A l})\\<^sup>\\<down> | g a r l'.\n        A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l'}\"\n\nlemma V_zone_time_pre:\n  \"x \\<in> (Z \\<inter> V)\\<^sup>\\<down>\" if \"x \\<in> Z\\<^sup>\\<down>\" \"x \\<in> V\"\n  using that unfolding zone_time_pre_def by (auto simp: V_def cval_add_def)\n\nlemma check_deadlock_alt_def:\n  \"check_deadlock l Z = (Z \\<subseteq> \\<Union> {\n    (zone_set_pre ({u. u \\<turnstile> inv_of A l'} \\<inter> V) r \\<inter> {u. \\<forall> x \\<in> set r. u x \\<ge> 0}\n       \\<inter> {u. u \\<turnstile> g} \\<inter> {u. u \\<turnstile> inv_of A l})\\<^sup>\\<down> \\<inter> V\n    | g a r l'. A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l'})\" (is \"_ = (?L \\<subseteq> ?R)\") if \"Z \\<subseteq> V\"\nproof -\n  { fix g a r l' x\n    assume t: \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l'\"\n    assume x: \"x \\<in> (zone_set_pre {u. u \\<turnstile> inv_of A l'} r \\<inter> {u. u \\<turnstile> g} \\<inter> {u. u \\<turnstile> inv_of A l})\\<^sup>\\<down>\"\n    assume \"x \\<in> V\"\n    let ?A = \"zone_set_pre {u. u \\<turnstile> inv_of A l'} r \\<inter> {u. u \\<turnstile> g} \\<inter> {u. u \\<turnstile> inv_of A l}\"\n    let ?B = \"zone_set_pre ({u. u \\<turnstile> inv_of A l'} \\<inter> V) r \\<inter> {u. \\<forall> x \\<in> set r. u x \\<ge> 0}\n              \\<inter> {u. u \\<turnstile> g} \\<inter> {u. u \\<turnstile> inv_of A l}\"\n    from valid_abstraction have \"collect_clkvt (trans_of A) \\<subseteq> X\"\n      by (auto elim: valid_abstraction.cases)\n    have *: \"0 \\<le> u c\" if \"c \\<in> set r\" \"u \\<in> V\" for c u\n    proof -\n      from t \\<open>c \\<in> set r\\<close> have \"c \\<in> collect_clkvt (trans_of A)\"\n        unfolding collect_clkvt_def by force\n      with \\<open>_ \\<subseteq> X\\<close> have \"c \\<in> X\"\n        by auto\n      with \\<open>u \\<in> V\\<close> show ?thesis\n        by (auto simp: V_def)\n    qed\n    have **: \"u \\<in> zone_set_pre ({u. u \\<turnstile> inv_of A l'} \\<inter> V) r\"\n      if \"u \\<in> zone_set_pre {u. u \\<turnstile> inv_of A l'} r\" \"u \\<in> V\" for u\n      using that unfolding zone_set_pre_def V_def by (auto split: clock_set_split)\n    from x \\<open>x \\<in> V\\<close> have \"x \\<in> (?A \\<inter> V)\\<^sup>\\<down>\"\n      by (rule V_zone_time_pre)\n    moreover have \"y \\<in> ?B\" if \"y \\<in> ?A \\<inter> V\" for y\n      using that by (auto intro: * **)\n    ultimately have \"x \\<in> ?B\\<^sup>\\<down>\"\n      unfolding zone_time_pre_def by auto\n  } note * = this\n  have \"zone_set_pre (Z \\<inter> V) r \\<subseteq> zone_set_pre Z r\" for Z r\n    unfolding zone_set_pre_def by auto\n  with \\<open>Z \\<subseteq> V\\<close> show ?thesis\n    unfolding check_deadlock_def\n    apply safe\n    subgoal for x\n      apply rotate_tac\n      apply (drule subsetD, assumption)\n      apply (drule subsetD, assumption)\n      apply clarsimp\n      apply (frule *, assumption+)\n      subgoal for g a r l'\n        by (inst_existentials\n            \"(zone_set_pre ({u. u \\<turnstile> inv_of A l'} \\<inter> V) r \\<inter> {u. \\<forall>x\\<in>set r. 0 \\<le> u x} \\<inter> {u. u \\<turnstile> g} \\<inter>\n             {u. u \\<turnstile> inv_of A l})\\<^sup>\\<down> \\<inter> V\") auto\n      done\n    apply (drule subsetD, assumption)+\n    apply safe\n    subgoal for x X g a r l'\n      by (drule\n          subsetD[OF zone_time_pre_mono,\n            where B1 = \"zone_set_pre {u. u \\<turnstile> inv_of A l'} r \\<inter> {u. u \\<turnstile> g} \\<inter> {u. u \\<turnstile> inv_of A l}\",\n              rotated]; force)\n    done\nqed\n\nlemma step_trans1:\n  assumes \"A \\<turnstile>\\<^sub>t \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsub>(g,a,r)\\<^esub> \\<langle>l', u'\\<rangle>\"\n  shows \"u \\<in> zone_set_pre {u. u \\<turnstile> inv_of A l'} r \\<inter> {u. u \\<turnstile> g}\" \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l'\"\n  using assms by (auto elim!: step_trans.cases simp: zone_set_pre_def)\n\nlemma step_trans2:\n  assumes \"u \\<in> zone_set_pre {u. u \\<turnstile> inv_of A l'} r \\<inter> {u. u \\<turnstile> g}\" \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l'\"\n  shows \"\\<exists> u'. A \\<turnstile>\\<^sub>t \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsub>(g,a,r)\\<^esub> \\<langle>l', u'\\<rangle>\"\n  using assms unfolding zone_set_pre_def by auto\n\nlemma time_pre_zone:\n  \"u \\<in> (Z \\<inter> {u. u \\<turnstile> inv_of A l})\\<^sup>\\<down>\" if \"A \\<turnstile> \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsup>d\\<^esup> \\<langle>l', u'\\<rangle>\" \"u' \\<in> Z\"\n  using that by (auto elim!: step_t.cases simp: zone_time_pre_def)\n\nlemma time_pre_zone':\n  \"\\<exists> d u'. u' \\<in> Z \\<and> A \\<turnstile> \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsup>d\\<^esup> \\<langle>l, u'\\<rangle>\" if \"u \\<in> (Z \\<inter> {u. u \\<turnstile> inv_of A l})\\<^sup>\\<down>\"\n  using that unfolding zone_time_pre_def by auto\n\nlemma step_trans3:\n  assumes \"A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsup>(g,a,r)\\<^esup> \\<langle>l', u'\\<rangle>\"\n  shows \"u \\<in> (zone_set_pre {u. u \\<turnstile> inv_of A l'} r \\<inter> {u. u \\<turnstile> g} \\<inter> {u. u \\<turnstile> inv_of A l})\\<^sup>\\<down>\"\n        \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l'\"\n  using assms by (auto dest: step_trans1 time_pre_zone step_delay_loc elim: step_trans'.cases)\n\nlemma step_trans4:\n  assumes \"u \\<in> (zone_set_pre {u. u \\<turnstile> inv_of A l'} r \\<inter> {u. u \\<turnstile> g} \\<inter> {u. u \\<turnstile> inv_of A l})\\<^sup>\\<down>\"\n          \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l'\"\n    shows \"\\<exists> u'. A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsup>(g,a,r)\\<^esup> \\<langle>l', u'\\<rangle>\"\n  using assms by (fast dest: time_pre_zone' step_trans2[rotated])\n\nlemma check_deadlock_correct:\n  \"check_deadlock l Z \\<longleftrightarrow> (\\<forall>u \\<in> Z. \\<exists>l' u' g a r. A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsup>(g,a,r)\\<^esup> \\<langle>l', u'\\<rangle>)\"\n  unfolding check_deadlock_def\n  apply safe\n  subgoal for x\n    using step_trans4 by blast\n  subgoal for x\n    using step_trans3 by fast\n  done\n\nlemma step'_step_trans'_iff:\n  \"A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle> \\<longleftrightarrow> (\\<exists>g a r. A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsup>(g,a,r)\\<^esup> \\<langle>l', u'\\<rangle>)\"\n  by (metis prod_cases3 step'.cases step'.intros step_a.cases step_a.simps step_trans'.cases\n            step_trans'.intros step_trans.cases step_trans.simps\n     )\n\nlemma check_deadlock_correct_step':\n  \"check_deadlock l Z \\<longleftrightarrow> (\\<forall>u \\<in> Z. \\<exists>l' u'. A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>)\"\n  using check_deadlock_correct step'_step_trans'_iff by simp\n\nparagraph \\<open>Unused\\<close>\n\nlemma delay_step_zone:\n  \"u' \\<in> Z\\<^sup>\\<up> \\<inter> {u. u \\<turnstile> inv_of A l}\" if \"A \\<turnstile> \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsup>d\\<^esup> \\<langle>l, u'\\<rangle>\" \"u \\<in> Z\"\n  using that by (auto elim!: step_t.cases simp: zone_delay_def)\n\nlemma delay_step_zone':\n  \"\\<exists> d u. u \\<in> Z \\<and> A \\<turnstile> \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsup>d\\<^esup> \\<langle>l, u'\\<rangle>\" if \"u' \\<in> Z\\<^sup>\\<up> \\<inter> {u. u \\<turnstile> inv_of A l}\"\n  using that by (auto simp: zone_delay_def)\n\nlemma delay_step_zone'':\n  \"(\\<exists> d u. u \\<in> Z \\<and> A \\<turnstile> \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsup>d\\<^esup> \\<langle>l, u'\\<rangle>) \\<longleftrightarrow> u' \\<in> Z\\<^sup>\\<up> \\<inter> {u. u \\<turnstile> inv_of A l}\"\n  using delay_step_zone delay_step_zone' by blast\n\nlemma delay_step_zone''':\n  \"{u' | u' d u. u \\<in> Z \\<and> A \\<turnstile> \\<langle>l, u\\<rangle> \\<rightarrow>\\<^bsup>d\\<^esup> \\<langle>l, u'\\<rangle>} = Z\\<^sup>\\<up> \\<inter> {u. u \\<turnstile> inv_of A l}\"\n  using delay_step_zone'' by auto\n\nend (* Regions TA *)\n\n\ncontext Regions_TA_Start_State\nbegin\n\nlemma check_deadlock_deadlocked:\n  \"\\<not> check_deadlock l Z \\<longleftrightarrow> (\\<exists>u\\<in>Z. sim.sim.deadlocked (l, u))\"\n  unfolding check_deadlock_correct_step' sim.sim.deadlocked_def by simp\n\nlemma deadlock_check':\n  \"(\\<exists>x\\<^sub>0\\<in>a\\<^sub>0. \\<exists>l u. sim.sim.reaches x\\<^sub>0 (l, u) \\<and> sim.sim.deadlocked (l, u)) \\<longleftrightarrow>\n   (\\<exists>l Z. reaches (l\\<^sub>0, Z\\<^sub>0) (l, Z) \\<and> \\<not> check_deadlock l Z)\"\n  apply (subst ta_reaches_ex_iff)\n  subgoal for l u u' R\n    by (rule sim_complete_bisim'.P1_deadlocked_compatible[where a = \"from_R l R\"];\n       (rule sim_complete_bisim'.P1_P1')?) (auto intro: sim_complete_bisim'.P1_P1')\n  using check_deadlock_deadlocked by auto\n\nlemma deadlock_check:\n  \"(\\<exists>x\\<^sub>0\\<in>a\\<^sub>0. sim.sim.deadlock x\\<^sub>0) \\<longleftrightarrow> (\\<exists>l Z. reaches (l\\<^sub>0, Z\\<^sub>0) (l, Z) \\<and> \\<not> check_deadlock l Z)\"\n  unfolding deadlock_check'[symmetric] sim.sim.deadlock_def by simp\n\nend (* Regions TA Start State *)\n\n\nsubsection \\<open>Operations\\<close>\n\nsubsubsection \\<open>Subset inclusion check for federations on DBMs\\<close>\n\nlemma\n  \"S \\<subseteq> R \\<longleftrightarrow> S \\<inter> -R = {}\"\n  by auto\n\nlemma\n  \"A \\<subseteq> B \\<union> C \\<longleftrightarrow> A \\<inter> -B \\<inter> -C = {}\"\n  by auto\n\nlemma\n  \"(A \\<union> B) \\<inter> (C \\<union> D) = A \\<inter> C \\<union> A \\<inter> D \\<union> B \\<inter> C \\<union> B \\<inter> D\"\n  by auto\n\n(* XXX *)\nlemma Le_le_inf[intro]:\n  \"Le (x :: _ :: linordered_cancel_ab_monoid_add) \\<preceq> \\<infinity>\"\n  by (auto intro: linordered_monoid.order.strict_implies_order)\n\n(* XXX Move *)\nlemma dbm_entry_val_mono:\n  \"dbm_entry_val u a b e'\" if \"dbm_entry_val u a b e\" \"e \\<le> e'\"\nusing that\n  by cases\n  (auto simp: DBM.less_eq intro: dbm_entry_val_mono_1 dbm_entry_val_mono_2 dbm_entry_val_mono_3\n    | simp add: DBM.less_eq dbm_entry_val.simps dbm_le_def\n  )+\n\ndefinition and_entry ::\n  \"nat \\<Rightarrow> nat \\<Rightarrow> ('t::{linordered_cancel_ab_monoid_add,uminus}) DBMEntry \\<Rightarrow> 't DBM \\<Rightarrow> 't DBM\" where\n  \"and_entry a b e M = (\\<lambda>i j. if i = a \\<and> j = b then min (M i j) e else M i j)\"\n\nlemma and_entry_mono:\n  \"and_entry a b e M i j \\<le> M i j\"\n  by (auto simp: and_entry_def)\n\nabbreviation \"clock_to_option a \\<equiv> (if a > 0 then Some a else None)\"\n\ndefinition\n  \"dbm_entry_val' u a b e \\<equiv> dbm_entry_val u (clock_to_option a) (clock_to_option b) e\"\n\ndefinition\n  \"dbm_minus n xs m = concat (map (\\<lambda>(i, j). map (\\<lambda> M. and_entry j i (neg_dbm_entry (m i j)) M) xs)\n  [(i, j). i\\<leftarrow>[0..<Suc n], j\\<leftarrow>[0..<Suc n], (i > 0 \\<or> j > 0) \\<and> i \\<le> n \\<and> j \\<le> n \\<and> m i j \\<noteq> \\<infinity>])\"\n\nlocale Default_Nat_Clock_Numbering =\n  fixes n :: nat and v :: \"nat \\<Rightarrow> nat\"\n  assumes v_is_id: \"\\<forall> c. c > 0 \\<and> c \\<le> n \\<longrightarrow> v c = c\" \"\\<forall> c. c > n \\<longrightarrow> v c = n + 1\" \"v 0 = n + 1\"\nbegin\n\nlemma v_id:\n  \"v c = c\" if \"v c \\<le> n\"\n  using v_is_id that\n  apply (cases \"c = 0\")\n  apply (simp; fail)\n  apply (cases \"c \\<le> n\"; auto)\n  done\n\nlemma le_n:\n  \"c \\<le> n\" if \"v c \\<le> n\"\n  using that v_is_id by auto\n\nlemma gt_0:\n  \"c > 0\" if \"v c \\<le> n\"\n  using that v_is_id by auto\n\nlemma le_n_iff:\n  \"v c \\<le> n \\<longleftrightarrow> c \\<le> n \\<and> c > 0\"\n  using v_is_id by auto\n\nlemma v_0:\n  \"v c = 0 \\<longleftrightarrow> False\"\n  using v_is_id by (cases \"c > 0\"; simp; cases \"c > n\"; simp)\n\nlemma surj_on: \"\\<forall> k \\<le> n. k > 0 \\<longrightarrow> (\\<exists> c. v c = k)\"\n  using v_is_id by blast\n\nabbreviation zone_of (\"\\<lbrakk>_\\<rbrakk>\") where \"zone_of M \\<equiv> [M]\\<^bsub>v,n\\<^esub>\"\n\nabbreviation\n  \"dbm_fed S \\<equiv> \\<Union> m \\<in> S. \\<lbrakk>m\\<rbrakk>\"\n\nabbreviation\n  \"dbm_list xs \\<equiv> dbm_fed (set xs)\"\n\nlemma dbm_fed_singleton:\n  \"dbm_fed {m} = [m]\\<^bsub>v,n\\<^esub>\"\n  by auto\n\nlemma dbm_list_single:\n  \"dbm_list xs = [m]\\<^bsub>v,n\\<^esub>\" if \"set xs = {m}\"\n  using that by auto\n\nlemma dbm_fed_superset_fold:\n  \"S \\<subseteq> dbm_list xs \\<longleftrightarrow> fold (\\<lambda>m S. S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>)) xs S = {}\"\nproof (induction xs arbitrary: S)\n  case Nil\n  then show ?case\n    by auto\nnext\n  case (Cons m xs)\n  have \"S \\<subseteq> dbm_list (m # xs) \\<longleftrightarrow> S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>) \\<subseteq> dbm_list xs\"\n    by auto\n  moreover have \"\\<dots> \\<longleftrightarrow> fold (\\<lambda>m S. S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>)) xs (S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>)) = {}\"\n    by fact\n  ultimately show ?case\n    by simp\nqed\n\nlemma dbm_fed_superset_fold':\n  \"dbm_fed S \\<subseteq> dbm_list xs \\<longleftrightarrow> dbm_fed (fold f xs S) = {}\" if\n  \"\\<And> m S. m \\<in> set xs \\<Longrightarrow> dbm_fed (f m S) = dbm_fed S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>)\"\nproof -\n  from that have \"fold (\\<lambda>m S. S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>)) xs (dbm_fed S) = dbm_fed (fold f xs S)\"\n  proof (induction xs arbitrary: S)\n    case Nil\n    then show ?case\n      by simp\n  next\n    case (Cons a xs)\n    from Cons.prems have\n      \"dbm_fed (fold f xs (f a S)) = fold (\\<lambda>m S. S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>)) xs (dbm_fed (f a S))\"\n      by - (rule sym, rule Cons.IH, auto)\n    then show ?case\n      by (simp add: Cons.prems)\n  qed\n  then show ?thesis\n    by (simp add: dbm_fed_superset_fold)\nqed\n\nlemma dbm_fed_superset_fold'':\n  \"dbm_list S \\<subseteq> dbm_list xs \\<longleftrightarrow> dbm_list (fold f xs S) = {}\" if\n  \"\\<And> m S. m \\<in> set xs \\<Longrightarrow> dbm_list (f m S) = dbm_list S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>)\"\nproof -\n  from that have \"fold (\\<lambda>m S. S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>)) xs (dbm_list S) = dbm_list (fold f xs S)\"\n  proof (induction xs arbitrary: S)\n    case Nil\n    then show ?case\n      by simp\n  next\n    case (Cons a xs)\n    from Cons.prems have\n      \"dbm_list (fold f xs (f a S)) = fold (\\<lambda>m S. S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>)) xs (dbm_list (f a S))\"\n      by - (rule sym, rule Cons.IH, auto)\n    then show ?case\n      by (simp add: Cons.prems)\n  qed\n  then show ?thesis\n    by (simp add: dbm_fed_superset_fold)\nqed\n\nlemma neg_inf:\n  \"{u. \\<not> dbm_entry_val u a b e} = {}\" if \"e = (\\<infinity> :: _ DBMEntry)\"\n  using that by auto\n\nlemma dbm_entry_val'_diff_shift:\n  \"dbm_entry_val' (u \\<oplus> d) c1 c2 (M c1 c2)\" if \"dbm_entry_val' u c1 c2 (M c1 c2)\" \"0 < c1\" \"0 < c2\"\n  using that unfolding dbm_entry_val'_def cval_add_def\n  by (auto elim!: dbm_entry_val.cases intro!: dbm_entry_val.intros)\n\nlemma dbm_entry_val_iff_bounded_Le1:\n  \"dbm_entry_val u (Some c1) None e \\<longleftrightarrow> Le (u c1) \\<le> e\"\n  by (cases e) (auto simp: any_le_inf)\n\nlemma dbm_entry_val_iff_bounded_Le2:\n  \"dbm_entry_val u None (Some c2) e \\<longleftrightarrow> Le (- u c2) \\<le> e\"\n  by (cases e) (auto simp: any_le_inf)\n\nlemma dbm_entry_val_iff_bounded_Le3:\n  \"dbm_entry_val u (Some c1) (Some c2) e \\<longleftrightarrow> Le (u c1 - u c2) \\<le> e\"\n  by (cases e) (auto simp: any_le_inf)\n\nlemma dbm_entry_val'_iff_bounded:\n  \"dbm_entry_val' u c1 c2 e \\<longleftrightarrow> Le((if c1 > 0 then u c1 else 0) - (if c2 > 0 then u c2 else 0)) \\<le> e\"\n  if \"c1 > 0 \\<or> c2 > 0\"\n  using that unfolding dbm_entry_val'_def\n  by (auto simp:\n      dbm_entry_val_iff_bounded_Le1 dbm_entry_val_iff_bounded_Le2 dbm_entry_val_iff_bounded_Le3\n     )\n\ncontext\n  notes [simp] = dbm_entry_val'_def\nbegin\n\nlemma neg_entry':\n  \"{u. \\<not> dbm_entry_val' u a b e} = {u. dbm_entry_val' u b a (neg_dbm_entry e)}\"\n  if \"e \\<noteq> (\\<infinity> :: _ DBMEntry)\" \"a > 0 \\<or> b > 0\"\n  (* using that by (auto simp: neg_entry) *)\n  using that by (cases e; cases \"a > 0\"; cases \"b > 0\"; auto 4 3 simp: le_minus_iff less_minus_iff)\n\nlemma neg_unbounded:\n  \"{u. \\<not> dbm_entry_val' u i j e} = {}\" if \"e = (\\<infinity> :: _ DBMEntry)\"\n  using that by auto\n\nlemma and_entry_sound:\n  \"u \\<turnstile>\\<^bsub>v,n\\<^esub> and_entry a b e M\" if \"dbm_entry_val' u a b e\" \"u \\<turnstile>\\<^bsub>v,n\\<^esub> M\"\n  using that unfolding DBM_val_bounded_def\n  by (cases a; cases b; auto simp: le_n_iff v_is_id(1) min_def v_0 and_entry_def)\n\n(* XXX Move *)\nlemma DBM_val_bounded_mono:\n  \"u \\<turnstile>\\<^bsub>v,n\\<^esub> M\" if \"u \\<turnstile>\\<^bsub>v,n\\<^esub> M'\" \"\\<forall> i \\<le> n. \\<forall> j \\<le> n. M' i j \\<le> M i j\"\n  using that unfolding DBM_val_bounded_def\n  apply (safe; clarsimp simp: le_n_iff v_is_id(1) DBM.less_eq[symmetric])\n     apply force\n    apply (blast intro: dbm_entry_val_mono)+\n  done\n\nlemma and_entry_entry:\n  \"dbm_entry_val' u a b e\" if \"u \\<turnstile>\\<^bsub>v,n\\<^esub> and_entry a b e M\" \"a \\<le> n\" \"b \\<le> n\" \"a > 0 \\<or> b > 0\"\nproof -\n  from that have \"dbm_entry_val' u a b (min (M a b) e)\"\n    unfolding DBM_val_bounded_def by (fastforce simp: le_n_iff v_is_id(1) and_entry_def)\n  then show ?thesis\n    by (auto intro: dbm_entry_val_mono)\nqed\n\nlemma and_entry_correct:\n  \"[and_entry a b e M]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub> \\<inter> {u. dbm_entry_val' u a b e}\"\n  if \"a \\<le> n\" \"b \\<le> n\" \"a > 0 \\<or> b > 0\"\n  unfolding DBM_zone_repr_def using that\n  by (blast intro: and_entry_entry and_entry_sound DBM_val_bounded_mono and_entry_mono)\n\nlemma dbm_list_Int_entry_iff_map:\n  \"dbm_list xs \\<inter> {u. dbm_entry_val' u i j e} = dbm_list (map (\\<lambda> m. and_entry i j e m) xs)\"\n  if \"i \\<le> n\" \"j \\<le> n\" \"i > 0 \\<or> j > 0\"\n  unfolding dbm_entry_val'_def\n  by (induction xs;\n      simp add: and_entry_correct[OF that, symmetric, unfolded dbm_entry_val'_def] Int_Un_distrib2\n     )\n\ncontext\n  fixes m :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a :: {time}) DBMEntry\"\n  assumes \"Le 0 \\<preceq> m 0 0\"\nbegin\n\nprivate lemma A:\n  \"- ([m]\\<^bsub>v,n\\<^esub>) =\n  (\\<Union> (i, j) \\<in> {(i, j). i > 0 \\<and> j > 0 \\<and> i \\<le> n \\<and> j \\<le> n}.\n    {u. \\<not> dbm_entry_val u (Some i) (Some j) (m i j)})\n  \\<union> (\\<Union> i \\<in> {i. i > 0 \\<and> i \\<le> n}. {u. \\<not> dbm_entry_val u (Some i) None (m i 0)})\n  \\<union> (\\<Union> j \\<in> {i. i > 0 \\<and> i \\<le> n}. {u. \\<not> dbm_entry_val u None (Some j) (m 0 j)})\"\n  unfolding DBM_zone_repr_def\n  apply auto\n  subgoal for u\n    unfolding DBM_val_bounded_def\n    apply (intro conjI impI allI)\n    subgoal\n      by (rule \\<open>Le 0 \\<preceq> m 0 0\\<close>)\n    subgoal for c\n      by (auto simp: le_n_iff v_is_id(1))\n    subgoal for c\n      by (auto simp: le_n_iff v_is_id(1))\n    subgoal for c1 c2\n      by (auto elim: allE[where x = c1] simp: le_n_iff v_is_id(1))\n    done\n  unfolding DBM_val_bounded_def by (simp add: le_n_iff v_is_id(1))+\n\nprivate lemma B:\n  \"S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>) =\n  (\\<Union> (i, j) \\<in> {(i, j). i > 0 \\<and> j > 0 \\<and> i \\<le> n \\<and> j \\<le> n}.\n    S \\<inter> {u. \\<not> dbm_entry_val u (Some i) (Some j) (m i j)})\n  \\<union> (\\<Union> i \\<in> {i. i > 0 \\<and> i \\<le> n}. S \\<inter> {u. \\<not> dbm_entry_val u (Some i) None (m i 0)})\n  \\<union> (\\<Union> j \\<in> {i. i > 0 \\<and> i \\<le> n}. S \\<inter> {u. \\<not> dbm_entry_val u None (Some j) (m 0 j)})\"\n  by (subst A) auto\n\nprivate lemma UNION_cong:\n  \"(\\<Union> x \\<in> S. f x) = (\\<Union> x \\<in> T. g x)\" if \"S = T\" \"\\<And> x. x \\<in> T \\<Longrightarrow> f x = g x\"\n  by (simp add: that)\n\nprivate lemma 1:\n  \"S \\<inter> - ([m]\\<^bsub>v,n\\<^esub>) =\n  (\\<Union> (i, j) \\<in> {(i, j). (i > 0 \\<or> j > 0) \\<and> i \\<le> n \\<and> j \\<le> n}. S \\<inter> {u. \\<not> dbm_entry_val' u i j (m i j)})\n  \"\nproof -\n  have *: \"{(i, j). (0 < i \\<or> 0 < j) \\<and> i \\<le> n \\<and> j \\<le> n}\n  = {(i, j). 0 < i \\<and> 0 < j \\<and> i \\<le> n \\<and> j \\<le> n}\n  \\<union> {(i, j). 0 < i \\<and> 0 = j \\<and> i \\<le> n \\<and> j \\<le> n}\n  \\<union> {(i, j). 0 = i \\<and> 0 < j \\<and> i \\<le> n \\<and> j \\<le> n}\"\n    by auto\n  show ?thesis\n    by (simp only: B UN_Un *) (intro arg_cong2[where f = \"(\\<union>)\"] UNION_cong; force)\nqed\n\nprivate lemma UNION_remove:\n  \"(\\<Union> x \\<in> S. f x) = (\\<Union> x \\<in> T. g x)\"\n  if \"T \\<subseteq> S\" \"\\<And> x. x \\<in> T \\<Longrightarrow> f x = g x\" \"\\<And> x. x \\<in> S - T \\<Longrightarrow> f x = {}\"\n  using that by fastforce\n\nprivate lemma 2:\n  \"(\\<Union>(i, j)\\<in>{(i, j).(i > 0 \\<or> j > 0) \\<and> i \\<le> n \\<and> j \\<le> n}. S \\<inter> {u. \\<not> dbm_entry_val' u i j (m i j)})\n = (\\<Union>(i, j)\\<in>{(i, j).(i > 0 \\<or> j > 0) \\<and> i \\<le> n \\<and> j \\<le> n \\<and> m i j \\<noteq> \\<infinity>}.\n    S \\<inter> {u. dbm_entry_val' u j i (neg_dbm_entry (m i j))})\"\n  apply (rule UNION_remove)\n    apply force\n  subgoal for x\n    by (cases x; simp add: neg_entry'[simplified])\n  by auto\n\nlemma dbm_list_subtract:\n  \"dbm_list xs \\<inter> - ([m]\\<^bsub>v,n\\<^esub>) = dbm_list (dbm_minus n xs m)\"\nproof -\n  have *:\n    \"set [(i, j). i\\<leftarrow>[0..<Suc n], j\\<leftarrow>[0..<Suc n], (i > 0 \\<or> j > 0) \\<and> i \\<le> n \\<and> j \\<le> n \\<and> m i j \\<noteq> \\<infinity>]\n  = {(i, j).(i > 0 \\<or> j > 0) \\<and> i \\<le> n \\<and> j \\<le> n \\<and> m i j \\<noteq> \\<infinity>}\"\n    by (auto simp del: upt.upt_Suc)\n  show ?thesis\n    unfolding dbm_minus_def\n    apply (subst set_concat)\n    apply (subst set_map)\n    apply (subst *)\n    apply (subst 1, subst 2)\n    apply (subst UN_UN_flatten)\n    apply (subst UN_simps)\n    apply (rule UNION_cong[OF HOL.refl])\n    apply (simp split del: if_split split: prod.splits)\n    apply (subst dbm_list_Int_entry_iff_map[simplified])\n       apply auto\n    done\nqed\n\nend \\<comment> \\<open>Context for fixed DBM\\<close>\n\nend \\<comment> \\<open>Simplifier setup\\<close>\n\nlemma dbm_list_empty_check:\n  \"dbm_list xs = {} \\<longleftrightarrow> list_all (\\<lambda>m. [m]\\<^bsub>v,n\\<^esub> = {}) xs\"\n  unfolding list_all_iff by auto\n\nlemmas dbm_list_superset_op =\n  dbm_fed_superset_fold''[OF dbm_list_subtract[symmetric], unfolded dbm_list_empty_check]\n\nend (* Trivial clock numbering *)\n\ncontext TA_Start_No_Ceiling\nbegin\n\nsublocale dbm: Default_Nat_Clock_Numbering n v\n  by unfold_locales (auto simp: v_def)\n\nend\n\n\nsubsubsection \\<open>Down\\<close>\n\nparagraph \\<open>Auxiliary\\<close>\n\nlemma dbm_entry_le_iff:\n  \"Le a \\<le> Le b \\<longleftrightarrow> a \\<le> b\"\n  \"Le a \\<le> Lt b \\<longleftrightarrow> a < b\"\n  \"Lt a \\<le> Le b \\<longleftrightarrow> a \\<le> b\"\n  \"Lt a \\<le> Lt b \\<longleftrightarrow> a \\<le> b\"\n  \"0 \\<le> Le a \\<longleftrightarrow> 0 \\<le> a\"\n  \"0 \\<le> Lt a \\<longleftrightarrow> 0 < a\"\n  \"Le a \\<le> 0 \\<longleftrightarrow> a \\<le> 0\"\n  \"Lt a \\<le> 0 \\<longleftrightarrow> a \\<le> 0\"\n  \"\\<infinity> \\<le> x \\<longleftrightarrow> x = \\<infinity>\"\n  \"x \\<le> \\<infinity> \\<longleftrightarrow> True\"\nproof -\n  show \"\\<infinity> \\<le> x \\<longleftrightarrow> x = \\<infinity>\"\n    by (cases x; auto)\nqed (auto simp: any_le_inf DBM.neutral)\n\nlemma dbm_entry_lt_iff:\n  \"Le a < Le b \\<longleftrightarrow> a < b\"\n  \"Le a < Lt b \\<longleftrightarrow> a < b\"\n  \"Lt a < Le b \\<longleftrightarrow> a \\<le> b\"\n  \"Lt a < Lt b \\<longleftrightarrow> a < b\"\n  \"0 < Le a \\<longleftrightarrow> 0 < a\"\n  \"0 < Lt a \\<longleftrightarrow> 0 < a\"\n  \"Le a < 0 \\<longleftrightarrow> a < 0\"\n  \"Lt a < 0 \\<longleftrightarrow> a \\<le> 0\"\n  \"x < \\<infinity> \\<longleftrightarrow> x \\<noteq> \\<infinity>\"\n  \"\\<infinity> < x \\<longleftrightarrow> False\"\n  by (auto simp: any_le_inf DBM.neutral DBM.less)\n\nlemmas [dbm_entry_simps] = dbm_entry_le_iff(1-9) dbm_entry_lt_iff(1-9)\n\nlemma Le_le_sum_iff:\n  \"Le (y :: _ :: time) \\<le> e \\<longleftrightarrow> 0 \\<le> e + Le (- y)\"\n  by (cases e) (auto simp: DBM.add dbm_entry_le_iff)\n\nlemma dense':\n  \"\\<exists>c\\<ge>a. c \\<le> b\" if \"a \\<le> b\" for a :: \"_ :: time\"\n  using dense \\<open>a \\<le> b\\<close> by auto\n\n(* XXX Move/rename/private *)\nlemma aux1:\n  \"- c \\<le> (a :: _ :: time)\" if \"a \\<ge> 0\" \"c \\<ge> 0\"\n  using that using dual_order.trans neg_le_0_iff_le by blast\n\nthm sum_gt_neutral_dest sum_gt_neutral_dest'\n\nlemma dbm_entries_dense:\n  \"\\<exists>d\\<ge>0. Le (- d) \\<le> l \\<and> Le (d :: _ :: time) \\<le> r\" if \"0 \\<le> l\" \"l \\<le> r\"\n  using that by (cases l; cases r; auto simp: dbm_entry_le_iff intro: aux1)\n\nlemma dbm_entries_dense'_aux:\n  \"\\<exists>d\\<ge>0. l + Le d \\<ge> 0 \\<and> 0 \\<le> r + Le (- d :: _ :: time)\" if \"l \\<le> 0\" \"l + r \\<ge> 0\" \"r \\<ge> 0\"\nproof ((cases l; cases r), goal_cases)\n  case (2 x1 x2)\n  have \"\\<exists>d\\<ge>0. 0 \\<le> x + d \\<and> d < y\" if \"x \\<le> 0\" \"0 < x + y\" \"0 < y\" for x y :: 'a\n    using that by (metis add.right_inverse add_le_cancel_left leD leI linear)\n  with 2 that show ?case\n    by (auto simp: dbm_entry_le_iff DBM.add)\nnext\n  case (3 x1)\n  have \"\\<exists>d\\<ge>0. 0 \\<le> x + d\" if \"x \\<le> 0\" for x :: 'a\n    using that by (metis add.right_inverse eq_iff neg_0_le_iff_le)\n  with that 3 show ?case \n    by (auto simp: dbm_entry_le_iff DBM.add)\nnext\n  case (5 a b)\n  have \"\\<exists>d\\<ge>0. 0 < x + d \\<and> d < y\" if \"x \\<le> 0\" \"0 < x + y\" for x y :: 'a\n    using that by (smt add.right_inverse add_less_cancel_left leD le_less_trans linear neg_0_le_iff_le time_class.dense)\n  with 5 that show ?case \n    by (auto simp: dbm_entry_le_iff DBM.add)\nnext\n  case (6 x2)\n  have \"\\<exists>d\\<ge>0. 0 < x + d\" if \"x \\<le> 0\" for x :: 'a\n    by (metis add.inverse_neutral add_minus_cancel add_strict_increasing2 eq_iff less_le less_minus_iff non_trivial_neg not_less_iff_gr_or_eq)\n  with that 6 show ?case \n    by (auto simp: dbm_entry_le_iff DBM.add)\nqed (use that in \\<open>auto simp: dbm_entry_le_iff DBM.add\\<close>)\n\nlemma dbm_entries_dense':\n  \"\\<exists>d\\<ge>0. l + Le d \\<ge> 0 \\<and> 0 \\<le> r + Le (- d :: _ :: time)\" if \"l \\<le> 0\" \"l + r \\<ge> 0\"\nproof -\n  from that have \"r \\<ge> 0\"\n    by (meson add_decreasing order_refl order_trans)\n  with that show ?thesis\n    by (rule dbm_entries_dense'_aux)\nqed\n\nlemma (in time) non_trivial_pos: \"\\<exists> x. x > 0\"\n  by (meson leD le_less_linear neg_le_0_iff_le non_trivial_neg)\n\nlemma dbm_entries_dense_pos:\n  \"\\<exists>d>0. Le (d :: _ :: time) \\<le> e\" if \"e > 0\"\n  (* XXX Clean duplicate rewrite rule *)\n  using dbm_entry_simps[simp]\nproof (cases e)\ncase (Le d)\n  with that show ?thesis\n    by auto\nnext\n  case prems: (Lt d)\n  with that have \"d > 0\"\n    by auto\n  from dense[OF this] obtain z where \"z > 0\" \"z < d\"\n    by auto\n  then show ?thesis\n    by (auto simp: prems)\nnext\n  case prems: INF\n  obtain d :: 'a where \"d > 0\"\n    by atomize_elim (rule non_trivial_pos)\n  then show ?thesis\n    by (auto simp: prems)\nqed\n\nlemma le_minus_iff:\n  \"- x \\<le> (y :: _ :: time) \\<longleftrightarrow> 0 \\<le> y + x\"\n  by (metis add.commute add.right_inverse add_le_cancel_left)\n\nlemma lt_minus_iff:\n  \"- x < (y :: _ :: time) \\<longleftrightarrow> 0 < y + x\"\n  by (metis add.commute add_less_cancel_right neg_eq_iff_add_eq_0)\n\ncontext Default_Nat_Clock_Numbering\nbegin\n\nlemma DBM_val_bounded_alt_def1:\n  \"u \\<turnstile>\\<^bsub>v,n\\<^esub> m \\<equiv>\n     Le 0 \\<preceq> m 0 0 \\<and>\n     (\\<forall>c. c > 0 \\<and> c \\<le> n \\<longrightarrow>\n          dbm_entry_val u None (Some c) (m 0 c) \\<and>\n          dbm_entry_val u (Some c) None (m c 0)) \\<and>\n     (\\<forall>c1 c2. c1 > 0 \\<and> c1 \\<le> n \\<and> c2 > 0 \\<and> c2 \\<le> n \\<longrightarrow> dbm_entry_val u (Some c1) (Some c2) (m c1 c2))\"\n  unfolding DBM_val_bounded_def by (rule eq_reflection) (auto simp: v_id le_n_iff)\n\nlemma DBM_val_bounded_alt_def2:\n  \"u \\<turnstile>\\<^bsub>v,n\\<^esub> m \\<equiv>\n     Le 0 \\<le> m 0 0 \\<and>\n     (\\<forall>c1 c2. (c1 \\<noteq> 0 \\<or> c2 \\<noteq> 0) \\<and> c1 \\<le> n \\<and> c2 \\<le> n \\<longrightarrow> dbm_entry_val' u c1 c2 (m c1 c2))\"\n  unfolding DBM_val_bounded_alt_def1 dbm_entry_val'_def DBM.less_eq\n  by (rule eq_reflection; clarsimp; safe; blast)\n\nlemma DBM_val_bounded_altI:\n  assumes\n    \"Le 0 \\<le> m 0 0\"\n    \"\\<And> c1 c2. (c1 \\<noteq> 0 \\<or> c2 \\<noteq> 0) \\<and> c1 \\<le> n \\<and> c2 \\<le> n \\<Longrightarrow> dbm_entry_val' u c1 c2 (m c1 c2)\"\n  shows\n    \"u \\<in> \\<lbrakk>m\\<rbrakk>\"\n  unfolding DBM_zone_repr_def DBM_val_bounded_alt_def2 using assms by auto\n\nlemma dbm_entry_val'_delay1:\n  \"dbm_entry_val' u c1 c2 (m c1 c2)\" if \"dbm_entry_val' (u \\<oplus> d) c1 c2 (m c1 c2)\" \"d \\<ge> 0\" \"c1 > 0\"\n  using that unfolding dbm_entry_val'_def\n  by (cases \"m c1 c2\")\n     (auto 0 2\n        dest: add_strict_increasing2 add_increasing intro!: dbm_entry_val.intros\n        simp: cval_add_def\n     )\n\nlemma dbm_entry_val'_delay2:\n  \"dbm_entry_val' u (0 :: nat) c2 (m c1 c2)\" if\n  \"dbm_entry_val' (u \\<oplus> d) c1 c2 (m c1 c2)\" \"d \\<ge> 0\"\n  \"c1 > 0\" \"c2 > 0\" \"c1 \\<le> n\" \"c2 \\<le> n\"\n  \"\\<forall> c \\<le> n. c > 0 \\<longrightarrow> u c \\<ge> 0\"\n  using that  unfolding dbm_entry_val'_def\n  apply (auto elim!: dbm_entry_val.cases intro!: dbm_entry_val.intros simp: cval_add_def)\n   apply (auto simp: algebra_simps le_minus_iff lt_minus_iff intro: dual_order.trans dual_order.strict_trans2)\n  done\n\nlemma dbm_entry_val'_nonneg_bound:\n  \"dbm_entry_val' u (0 :: nat) c (Le 0)\" if \"u c \\<ge> 0\" \"c > 0\"\n  using that unfolding dbm_entry_val'_def by auto\n\nlemma neg_diag_empty_spec:\n  \"\\<lbrakk>M\\<rbrakk> = {}\" if \"i \\<le> n\" \"M i i < 0\"\n  using that by (meson neg_diag_empty v_is_id(1))\n\nlemma in_DBM_D:\n  \"dbm_entry_val' u c1 c2 (M c1 c2)\" if \"u \\<in> \\<lbrakk>M\\<rbrakk>\" \"c1 \\<noteq> 0 \\<or> c2 \\<noteq> 0\" \"c1 \\<le> n\" \"c2 \\<le> n\"\n  using that unfolding zone_time_pre_def DBM_zone_repr_def DBM_val_bounded_alt_def2 by auto\n\ncontext\n  fixes M :: \"('t::time) DBM\"\n  assumes \"\\<lbrakk>M\\<rbrakk> \\<noteq> {}\"\nbegin\n\nlemma non_empty_diag_0_0: \"M 0 0 \\<ge> 0\"\n  using \\<open>\\<lbrakk>M\\<rbrakk> \\<noteq> {}\\<close> neg_diag_empty_spec[of 0 M] leI by auto\n\nlemma M_k_0: \"M k 0 \\<ge> 0\" if \"\\<forall> u \\<in> \\<lbrakk>M\\<rbrakk>. \\<forall> c \\<le> n. c > 0 \\<longrightarrow> u c \\<ge> 0\" \"k \\<le> n\"\nproof (cases \"k = 0\")\n  case True with non_empty_diag_0_0 show ?thesis\n    by auto\nnext\n  case False\n  from \\<open>\\<lbrakk>M\\<rbrakk> \\<noteq> {}\\<close> obtain u where \"u \\<in> \\<lbrakk>M\\<rbrakk>\"\n    by auto\n  with False that(1) \\<open>k \\<le> n\\<close> have \"u k \\<ge> 0\"\n    by auto\n  from \\<open>u \\<in> _\\<close> \\<open>k \\<noteq> 0\\<close> \\<open>k \\<le> n\\<close> have \"dbm_entry_val' u k 0 (M k 0)\"\n    unfolding DBM_zone_repr_def DBM_val_bounded_alt_def2 by auto\n  with \\<open>k \\<noteq> 0\\<close> have \"Le (u k) \\<le> M k 0\"\n    by (simp add: dbm_entry_val'_iff_bounded)\n  with \\<open>u k \\<ge> 0\\<close> show \"M k 0 \\<ge> 0\"\n    by (cases \"M k 0\") (auto simp: dbm_entry_le_iff)\nqed\n\nlemma non_empty_cycle_free:\n  \"cycle_free M n\"\n  using \\<open>\\<lbrakk>M\\<rbrakk> \\<noteq> {}\\<close> non_empty_cycle_free v_is_id(1) by blast\n\nlemma canonical_saturated_2:\n  assumes \"Le r \\<le> M 0 c\"\n    and \"Le (- r) \\<le> M c 0\"\n    and \"cycle_free M n\"\n    and \"canonical M n\"\n    and \"c \\<le> n\"\n    and \"c > 0\"\n  obtains u where \"u \\<in> \\<lbrakk>M\\<rbrakk>\" \"u c = - r\"\n  using assms v_0 by (auto simp: v_is_id intro: canonical_saturated_2[of r M v c n])\n\nlemma M_0_k: \"M 0 k \\<le> 0\"\n  if \"canonical M n\" \"M 0 0 \\<le> 0\" \"\\<forall> u \\<in> \\<lbrakk>M\\<rbrakk>. \\<forall> c \\<le> n. c > 0 \\<longrightarrow> u c \\<ge> 0\" \"k \\<le> n\"\nproof (cases \"k = 0\")\n  case True\n  with \\<open>M 0 0 \\<le> 0\\<close> show ?thesis\n    by auto\nnext\n  case False\n  show ?thesis\n  proof (rule ccontr)\n    assume \"\\<not> M 0 k \\<le> 0\"\n    then have \"M 0 k > 0\"\n      by auto\n    from that(3) \\<open>k \\<le> n\\<close> have \"M k 0 \\<ge> 0\"\n      by (rule M_k_0)\n    from \\<open>M 0 k > 0\\<close> obtain d where\n      \"Le d \\<le> M 0 k\" \"d > 0\"\n      by (rule dbm_entries_dense_pos[elim_format]) auto\n    with \\<open>M k 0 \\<ge> 0\\<close> have \"Le (-d) \\<le> M k 0\"\n      by (auto simp: dbm_entry_le_iff intro: order.trans[rotated])\n    with \\<open>canonical M n\\<close> \\<open>Le d \\<le> M 0 k\\<close> obtain u where\n      \"u \\<in> \\<lbrakk>M\\<rbrakk>\" \"u k = -d\"\n      using v_0 False \\<open>k \\<le> n\\<close>\n      by - (rule canonical_saturated_2[of d], auto simp: non_empty_cycle_free)\n    with \\<open>d > 0\\<close> that(3) False \\<open>k \\<le> n\\<close> show False\n      by fastforce\n  qed\nqed\n\nend (* Fixed non-empty DBM *)\n\nend (* Default Clock Numbering *)\n\nparagraph \\<open>Definition\\<close>\n\ndefinition\n  down :: \"nat \\<Rightarrow> ('t::linordered_cancel_ab_monoid_add) DBM \\<Rightarrow> 't DBM\"\nwhere\n  \"down n M \\<equiv>\n    \\<lambda> i j. if i = 0 \\<and> j > 0 then Min ({Le 0} \\<union> {M k j | k. 1 \\<le> k \\<and> k \\<le> n}) else M i j\"\n\n\nparagraph \\<open>Correctness\\<close>\n\ncontext Default_Nat_Clock_Numbering\nbegin\n\nsublocale Alpha_defs \"{1..n}\" .\n\ncontext\n  fixes M :: \"('t::time) DBM\"\nbegin\n\nlemma down_complete: \"u \\<in> \\<lbrakk>down n M\\<rbrakk>\" if \"u \\<in> \\<lbrakk>M\\<rbrakk>\\<^sup>\\<down>\" \"\\<forall> c \\<le> n. c > 0 \\<longrightarrow> u c \\<ge> 0\"\nproof (rule DBM_val_bounded_altI, goal_cases)\n  case 1\n  with \\<open>u \\<in> _\\<close> show ?case\n    unfolding down_def zone_time_pre_def by (auto intro: non_empty_diag_0_0 simp: neutral[symmetric])\nnext\n  case prems: (2 c1 c2)\n  then consider \"c1 > 0\" | \"c1 = 0\" \"c2 > 0\"\n    by auto\n  then show ?case\n  proof cases\n    case 1\n    with prems \\<open>u \\<in> _\\<close> show ?thesis\n      unfolding zone_time_pre_def down_def by (auto intro: dbm_entry_val'_delay1 dest: in_DBM_D)\n  next\n    case 2\n    from \\<open>u \\<in> \\<lbrakk>M\\<rbrakk>\\<^sup>\\<down>\\<close> obtain d where d: \"0 \\<le> d\" \"u \\<oplus> d \\<in> \\<lbrakk>M\\<rbrakk>\"\n      unfolding zone_time_pre_def by auto\n    let ?e = \"Min ({Le 0} \\<union> {M k c2 |k. 1 \\<le> k \\<and> k \\<le> n})\"\n    have \"?e \\<in> {Le 0} \\<union> {M k c2 |k. 1 \\<le> k \\<and> k \\<le> n}\"\n      by (intro Min_in) auto\n    then consider \"?e = Le 0\" | k where \"?e = M k c2\" \"k > 0\" \"k \\<le> n\"\n      by auto\n    then show ?thesis\n      using prems that(2) d 2 unfolding down_def\n      by cases (auto intro: dbm_entry_val'_delay2 dbm_entry_val'_nonneg_bound in_DBM_D)\n  qed\nqed\n\nlemma down_sound: \"u \\<in> \\<lbrakk>M\\<rbrakk>\\<^sup>\\<down>\" if \"u \\<in> \\<lbrakk>down n M\\<rbrakk>\" \"canonical M n\"\nproof -\n  note [simp] = dbm_entry_simps and [intro] = order.trans add_right_mono\n  from \\<open>u \\<in> _\\<close> non_empty_diag_0_0[of \"down n M\"] have \"Le 0 \\<le> M 0 0\"\n    by (auto simp: down_def neutral)\n  note * = in_DBM_D[OF \\<open>u \\<in> _\\<close>]\n  define l where \"l = Min ({M 0 c + Le (u c)   | c. 0 < c \\<and> c \\<le> n} \\<union> {Le 0})\"\n    \\<comment> \\<open>maximum current violation of the future bounds\\<close>\n  define r where \"r = Min ({M c 0 + Le (- u c) | c. 0 < c \\<and> c \\<le> n} \\<union> {\\<infinity>})\"\n    \\<comment> \\<open>slack for shifting upwards\\<close>\n  have \"0 \\<le> l + r\" \"l \\<le> 0\"\n  proof -\n    have\n      \"l \\<in> {M 0 c + Le (u c)   | c. 0 < c \\<and> c \\<le> n} \\<union> {Le 0}\"\n      \"r \\<in> {M c 0 + Le (- u c) | c. 0 < c \\<and> c \\<le> n} \\<union> {\\<infinity>}\"\n      unfolding l_def r_def by (intro Min_in; simp)+\n    from \\<open>l \\<in> _\\<close> show \"l \\<le> 0\"\n      unfolding l_def by (auto intro: Min_le simp: DBM.neutral)\n    from \\<open>l \\<in> _\\<close> \\<open>r \\<in> _\\<close> show \"0 \\<le> l + r\"\n    proof (safe, goal_cases)\n      case prems: (1 c1 c2)\n      with \\<open>u \\<in> _\\<close> have \"Le (u c2 - u c1) \\<le> M c2 c1\"\n        by (auto 0 2 dest: in_DBM_D simp: dbm_entry_val'_iff_bounded down_def)\n      also from prems \\<open>canonical M n\\<close> have \"M c2 0 + M 0 c1 \\<ge> M c2 c1\"\n        by auto\n      finally have \"0 \\<le> M c2 0 + M 0 c1 + (Le (u c1) + Le (- u c2))\"\n        by (simp add: DBM.add Le_le_sum_iff)\n      then show ?case\n        by (simp add: algebra_simps)\n    next\n      case (3 c)\n      with \\<open>u \\<in> _\\<close> have \"Le (u c) \\<le> M c 0\"\n        by (auto 0 2 dest: in_DBM_D simp: dbm_entry_val'_iff_bounded down_def)\n      then show ?case\n        by (auto simp: DBM.add Le_le_sum_iff)\n    qed auto\n  qed\n  from dbm_entries_dense'[OF this(2,1)] obtain d where\n    \"d \\<ge> 0\" \"0 \\<le> l + Le d\" \"0 \\<le> r + Le (- d)\"\n    by auto\n  have \"u \\<oplus> d \\<in> \\<lbrakk>M\\<rbrakk>\"\n  proof (rule DBM_val_bounded_altI, goal_cases)\n    case 1\n    from \\<open>Le 0 \\<le> M 0 0\\<close> show ?case .\n  next\n    case (2 c1 c2)\n    with * have **: \"dbm_entry_val' u c1 c2 (down n M c1 c2)\"\n      by auto\n    from 2 consider\n      \"c1 \\<le> n\" \"c2 \\<le> n\" \"c1 > 0\" \"c2 > 0\"\n      | \"c1 = 0\" \"c2 \\<le> n\" \"c2 > 0\" | \"c2 = 0\" \"c1 \\<le> n\" \"c1 > 0\"\n      by auto\n    then show ?case\n    proof cases\n      case 1\n      then show ?thesis\n        using ** unfolding down_def by (auto intro: dbm_entry_val'_diff_shift)\n    next\n      case 2\n      then have \"l \\<le> (M 0 c2 + Le (u c2))\"\n        unfolding l_def by (auto intro: Min_le)\n      with \\<open>0 \\<le> l + Le d\\<close> have \"0 \\<le> M 0 c2 + Le (u c2) + Le d\"\n        by auto\n      with 2 show ?thesis\n        unfolding down_def dbm_entry_val'_def\n        by (cases \"M 0 c2\")\n           (auto 4 3 simp: cval_add_def DBM.add algebra_simps lt_minus_iff le_minus_iff)\n    next\n      case 3\n      then have \"r \\<le> M c1 0 + Le (- u c1)\"\n        unfolding r_def by (auto intro: Min_le)\n      with \\<open>0 \\<le> r + Le (- d)\\<close> have \"0 \\<le> M c1 0 + Le (- u c1) + Le ( -d)\"\n        by auto\n      with 3 ** show ?thesis\n        unfolding down_def dbm_entry_val'_def\n        by (auto elim!: dbm_entry_val.cases simp: cval_add_def algebra_simps DBM.add)\n    qed\n  qed\n  with \\<open>d \\<ge> 0\\<close> show ?thesis\n    unfolding zone_time_pre_def cval_add_def by auto\nqed\n\nlemma down_canonical:\n  \"canonical (down n M) n\"\n  if assms: \"canonical M n\" \"\\<lbrakk>M\\<rbrakk> \\<noteq> {}\" \"\\<forall> u \\<in> \\<lbrakk>M\\<rbrakk>. \\<forall> c \\<le> n. c > 0 \\<longrightarrow> u c \\<ge> 0\" \"M 0 0 \\<le> 0\"\nproof -\n  from non_empty_diag_0_0[OF \\<open>\\<lbrakk>M\\<rbrakk> \\<noteq> {}\\<close>] have \"M 0 0 \\<ge> 0\" .\n  with \\<open>M 0 0 \\<le> 0\\<close> have \"M 0 0 = 0\"\n    by auto\n  note M_0_k = M_0_k[OF that(2,1,4,3)] and M_k_0 = M_k_0[OF that(2,3)]\n  have Suc_0_le_iff: \"Suc 0 \\<le> x \\<longleftrightarrow> 0 < x\" for x\n    by auto\n  define S where \"S j = Min ({Le 0} \\<union> {M k j |k. 1 \\<le> k \\<and> k \\<le> n})\" for j\n  { fix j :: nat\n    consider (0) \"S j = 0\" \"\\<forall> i. 1 \\<le> i \\<and> i \\<le> n \\<longrightarrow> M i j \\<ge> 0\"\n      | (entry) i where\n        \"S j = M i j\" \"0 < i\" \"i \\<le> n\" \"M i j \\<le> 0\" \"\\<forall> k. 1 \\<le> k \\<and> k \\<le> n \\<longrightarrow> M i j \\<le> M k j\"\n      unfolding S_def neutral\n      using Min_in[of \"{Le 0} \\<union> {M k j |k. 1 \\<le> k \\<and> k \\<le> n}\"]\n      apply auto\n      using Min_le[of \"{Le 0} \\<union> {M k j |k. 1 \\<le> k \\<and> k \\<le> n}\"]\n       apply auto\n      done\n  } note S_cases = this\n  show ?thesis\n    apply (intro allI impI; elim conjE)\n    unfolding down_def S_def[symmetric]\n    apply clarsimp\n    apply safe\n  proof goal_cases\n    case (1 i j k)\n    from \\<open>M 0 0 \\<ge> 0\\<close> show ?case\n      by (blast intro: add_increasing)\n  next\n    case (2 i j k)\n    with \\<open>canonical M n\\<close> show ?case\n      by (cases rule: S_cases[of k]; cases rule: S_cases[of j])\n         (auto intro: order.trans simp: Suc_0_le_iff)\n  next\n    case prems: (3 i j k)\n    then have \"M 0 k \\<le> S k\"\n      apply (cases rule: S_cases[of k])\n      subgoal\n        using M_0_k[of k] by auto\n      subgoal for i'\n        using M_0_k \\<open>canonical M n\\<close> by (metis add.left_neutral add_right_mono dual_order.trans)\n      done\n    from \\<open>canonical M n\\<close> prems have \"M i k \\<le> M i 0 + M 0 k\"\n      by auto\n    also from \\<open>_ \\<le> S k\\<close> have \"\\<dots> \\<le> M i 0 + S k\"\n      by (simp add: add_left_mono)\n    finally show ?case .\n  next\n    case (6 i j k)\n    with \\<open>canonical M n\\<close> \\<open>M 0 0 \\<le> 0\\<close> show ?case\n      by (smt M_k_0 S_cases add_increasing order.trans)\n  qed (use \\<open>canonical M n\\<close> in simp_all)\nqed\n\nend (* Fixed DBM *)\n\nend (* Default Clock Numbering *)\n\nsubsubsection \\<open>Free\\<close>\n\nparagraph \\<open>Definition\\<close>\n\ndefinition\n  free :: \"nat \\<Rightarrow> ('t::linordered_cancel_ab_monoid_add) DBM \\<Rightarrow> nat \\<Rightarrow> 't DBM\"\nwhere\n  \"free n M x \\<equiv>\n    \\<lambda> i j. if i = x \\<and> j \\<noteq> x then \\<infinity> else if i \\<noteq> x \\<and> j = x then M i 0 else M i j\"\n\ndefinition repair_pair where\n  \"repair_pair n M a b = FWI (FWI M n b) n a\"\n\ndefinition\n  \"and_entry_repair n a b e M \\<equiv> repair_pair n (and_entry a b e M) a b\"\n\ndefinition\n  \"restrict_zero n M x \\<equiv>\n    let\n      M1 = and_entry x 0 (Le 0) M;\n      M2 = and_entry 0 x (Le 0) M1\n    in repair_pair n M2 x 0\"\n\ndefinition\n  \"pre_reset n M x \\<equiv> free n (restrict_zero n M x) x\"\n\ndefinition\n  \"pre_reset_list n M r \\<equiv> fold (\\<lambda> x M. pre_reset n M x) r M\"\n\nparagraph \\<open>Auxiliary\\<close>\n\nlemma repair_pair_characteristic:\n  assumes \"canonical_subs n I M\"\n    and \"I \\<subseteq> {0..n}\"\n    and \"a \\<le> n\" \"b \\<le> n\"\n  shows \"canonical_subs n (I \\<union> {a,b}) (repair_pair n M a b) \\<or> (\\<exists>i\\<le>n. repair_pair n M a b i i < 0)\"\nproof -\n  from fwi_characteristic[OF assms(1,2,4)] have\n    \"canonical_subs n (I \\<union> {b}) (FWI M n b) \\<or> (\\<exists>i\\<le>n. FWI M n b i i < 0)\"\n    by auto\n  then show ?thesis\n  proof\n    assume \"canonical_subs n (I \\<union> {b}) (FWI M n b)\"\n    from fwi_characteristic[OF this _ \\<open>a \\<le> n\\<close>] assms(2) \\<open>b \\<le> n\\<close> show ?thesis\n      unfolding repair_pair_def by simp\n  next\n    assume \"\\<exists>i\\<le>n. FWI M n b i i < 0\"\n    then have \"\\<exists>i\\<le>n. repair_pair n M a b i i < 0\"\n      unfolding repair_pair_def\n      apply safe\n      subgoal for i\n        apply (inst_existentials i)\n         apply assumption\n        apply (frule FWI_mono[where M = \"FWI M n b\" and k = a])\n         apply auto\n        done\n      done\n    then show ?thesis ..\n  qed\nqed\n\nlemma repair_pair_mono:\n  assumes \"i \\<le> n\"\n      and \"j \\<le> n\"\n    shows \"repair_pair n M a b i j \\<le> M i j\"\n  unfolding repair_pair_def by (auto intro: FWI_mono assms order.trans)\n\ncontext Default_Nat_Clock_Numbering\nbegin\n\nlemmas FWI_zone_equiv = FWI_zone_equiv[OF surj_on, symmetric]\n\nlemma repair_pair_zone_equiv:\n  \"\\<lbrakk>repair_pair n M a b\\<rbrakk> = \\<lbrakk>M\\<rbrakk>\" if \"a \\<le> n\" \"b \\<le> n\"\n  using that unfolding repair_pair_def by (simp add: FWI_zone_equiv)\n\ncontext\n  fixes c1 c2 c x :: nat\n  notes [simp] = dbm_entry_val'_iff_bounded dbm_entry_simps DBM.add algebra_simps\nbegin\n\nlemma dbm_entry_val'_diag_iff: \"dbm_entry_val' u c c e \\<longleftrightarrow> e \\<ge> 0\" if \"c > 0\"\n  using that by (cases e) auto\n\nlemma dbm_entry_val'_inf: \"dbm_entry_val' u c1 c2 \\<infinity> \\<longleftrightarrow> True\"\n  unfolding dbm_entry_val'_def by auto\n\nlemma dbm_entry_val'_reset_1:\n  \"dbm_entry_val' (u(x := d)) x c e \\<longleftrightarrow> dbm_entry_val' u 0 c (e + Le (-d))\"\n  if \"d \\<ge> 0\" \"c \\<noteq> x\" \"c > 0\" \"x > 0\"\n  using that \\<open>d \\<ge> 0\\<close> by (cases e) auto\n\nlemma dbm_entry_val'_reset_2:\n  \"dbm_entry_val' (u(x := d)) c x e \\<longleftrightarrow> dbm_entry_val' u c (0 :: nat) (e + Le d)\"\n  if \"d \\<ge> 0\" \"c \\<noteq> x\" \"c > 0\" \"x > 0\"\n  using that \\<open>d \\<ge> 0\\<close> by (cases e) auto\n\nlemma dbm_entry_val'_reset_2':\n  \"dbm_entry_val' (u(x := d)) 0 x e \\<longleftrightarrow> Le (- d) \\<le> e\" if \"d \\<ge> 0\" \"x > 0\"\n  using that \\<open>d \\<ge> 0\\<close> by (cases e) auto\n\nlemma dbm_entry_val'_reset_3:\n  \"dbm_entry_val' (u(x := d)) c1 c2 e \\<longleftrightarrow> dbm_entry_val' u c1 c2 e\" if \"c1 \\<noteq> x\" \"c2 \\<noteq> x\" for e\n  using that unfolding dbm_entry_val'_def by (cases e) auto\n\nend (* Simplifier setup *)\n\n\nparagraph \\<open>Correctness\\<close>\n\ncontext\n  fixes M :: \"('t::time) DBM\"\nbegin\n\nlemma free_complete: \"u(x := d) \\<in> \\<lbrakk>free n M x\\<rbrakk>\"\n  if assms: \"u \\<in> \\<lbrakk>M\\<rbrakk>\" \"d \\<ge> 0\" \"x > 0\" \"\\<forall>c \\<le> n. M c c \\<ge> 0\"\nproof (rule DBM_val_bounded_altI, goal_cases)\n  case 1\n  with \\<open>_ \\<in> \\<lbrakk>M\\<rbrakk>\\<close> show ?case\n    unfolding free_def by (auto simp: neutral[symmetric] intro: non_empty_diag_0_0)\nnext\n  case prems: (2 c1 c2)\n  then have \"c1 \\<le> n\" \"c2 \\<le> n\"\n    by auto\n  note [simp] = dbm_entry_simps\n  have *: \"Le (u c1) \\<le> M c1 0 + Le d\" if \"c1 > 0\"\n  proof -\n    from \\<open>_ \\<in> \\<lbrakk>M\\<rbrakk>\\<close> \\<open>c1 > 0\\<close> \\<open>c1 \\<le> n\\<close> have \"Le (u c1) \\<le> M c1 0\"\n      by (auto 0 2 simp: dbm_entry_val'_iff_bounded dest: in_DBM_D)\n    with \\<open>d \\<ge> 0\\<close> show ?thesis\n      by (simp add: algebra_simps add_increasing)\n  qed\n  have \"dbm_entry_val' (u(x := d)) c1 x (M c1 0)\" if \"c1 \\<noteq> x\"\n  proof (cases \"c1 = 0\")\n    case True\n    with that show ?thesis\n      using assms(4) \\<open>d \\<ge> 0\\<close> by (auto intro: order.trans[rotated] simp: dbm_entry_val'_reset_2')\n  next\n    case False\n    with that \\<open>x > 0\\<close> show ?thesis\n      by (subst dbm_entry_val'_reset_2[OF \\<open>d \\<ge> 0\\<close>]) (auto simp: dbm_entry_val'_iff_bounded *)\n  qed\n  with prems in_DBM_D[OF \\<open>_ \\<in> \\<lbrakk>M\\<rbrakk>\\<close>] that(4) show ?case\n    by (auto simp: free_def dbm_entry_val'_diag_iff dbm_entry_val'_inf dbm_entry_val'_reset_3)\nqed\n\nlemma free_sound: \"\\<exists>d \\<ge> 0. u(x := d) \\<in> \\<lbrakk>M\\<rbrakk>\" \"u x \\<ge> 0\"\n  if assms: \"u \\<in> \\<lbrakk>free n M x\\<rbrakk>\" \"x > 0\" \"x \\<le> n\" \"canonical M n\" \"M 0 x \\<le> 0\" \"M 0 0 \\<le> 0\"\nproof -\n  define l where \"l = Min ({M c x + Le (- u c) | c. 0 < c \\<and> c \\<le> n \\<and> c \\<noteq> x} \\<union> {M 0 x})\"\n  define r where \"r = Min ({M x c + Le (u c)   | c. 0 < c \\<and> c \\<le> n \\<and> c \\<noteq> x} \\<union> {M x 0})\"\n  from non_empty_diag_0_0 \\<open>u \\<in> _\\<close> \\<open>x > 0\\<close> have \"0 \\<le> M 0 0\"\n    unfolding free_def by fastforce\n  note [simp]  = dbm_entry_simps and [intro] = order.trans add_right_mono\n  have \"0 \\<le> l + r\" \"l \\<le> 0\"\n  proof -\n    have\n      \"l \\<in> {M c x + Le (- u c)   | c. 0 < c \\<and> c \\<le> n \\<and> c \\<noteq> x} \\<union> {M 0 x}\"\n      \"r \\<in> {M x c + Le (u c)     | c. 0 < c \\<and> c \\<le> n \\<and> c \\<noteq> x} \\<union> {M x 0}\"\n      unfolding l_def r_def by (intro Min_in; simp)+\n    from \\<open>l \\<in> _\\<close> \\<open>M 0 x \\<le> 0\\<close> show \"l \\<le> 0\"\n      unfolding l_def by - (rule order.trans[rotated], auto intro: Min_le simp: DBM.neutral)\n    from \\<open>l \\<in> _\\<close> \\<open>r \\<in> _\\<close> show \"0 \\<le> l + r\"\n    proof (safe, goal_cases)\n      case prems: (1 c1 c2)\n      with \\<open>canonical M n\\<close> \\<open>x \\<le> n\\<close> have \"M c1 x + M x c2 \\<ge> M c1 c2\"\n        by auto\n      from prems \\<open>u \\<in> _\\<close> have \"Le (u c1 - u c2) \\<le> M c1 c2\"\n        unfolding free_def by (auto 0 2 simp: dbm_entry_val'_iff_bounded dest: in_DBM_D)\n      with \\<open>M c1 c2 \\<le> M c1 x + M x c2\\<close> have \"Le (u c1 - u c2) \\<le> M c1 x + M x c2\"\n        by auto\n      then have \"0 \\<le> M c1 x + M x c2 + (Le (u c2) + Le (- u c1))\"\n        by (simp add: DBM.add Le_le_sum_iff)\n      then show ?case\n        by (simp add: algebra_simps)\n    next\n      case prems: (2 c)\n      from prems \\<open>u \\<in> _\\<close> have \"Le (u c) \\<le> M c 0\"\n        unfolding free_def by (auto 0 2 simp: dbm_entry_val'_iff_bounded dest: in_DBM_D)\n      also from prems \\<open>canonical M n\\<close> \\<open>x \\<le> n\\<close> have \"\\<dots> \\<le> M c x + M x 0\"\n        by auto\n      finally show ?case\n        by (simp add: algebra_simps Le_le_sum_iff)\n    next\n      case prems: (3 c)\n      with \\<open>u \\<in> _\\<close> \\<open>x > 0\\<close> have \"Le (- u c) \\<le> M 0 c\"\n        unfolding free_def by (auto simp: dbm_entry_val'_iff_bounded dest: in_DBM_D[of _ _ 0 c])\n      also from prems \\<open>canonical M n\\<close> \\<open>x \\<le> n\\<close> have \"\\<dots> \\<le> M 0 x + M x c\"\n        by auto\n      finally show ?case\n        by (simp add: algebra_simps Le_le_sum_iff)\n    next\n      case 4\n      from \\<open>0 \\<le> M 0 0\\<close> \\<open>canonical M n\\<close> \\<open>x \\<le> n\\<close> show ?case\n        by auto\n    qed\n  qed\n  from dbm_entries_dense'[OF this(2,1)] obtain d where\n    \"d \\<ge> 0\" \"0 \\<le> l + Le d\" \"0 \\<le> r + Le (- d)\"\n    by auto\n  have \"u(x := d) \\<in> \\<lbrakk>M\\<rbrakk>\"\n  proof (rule DBM_val_bounded_altI, goal_cases)\n    case 1\n    from \\<open>0 \\<le> M 0 0\\<close> show ?case unfolding DBM.neutral .\n  next\n    case prems: (2 c1 c2)\n    then have **: \"dbm_entry_val' u c1 c2 (free n M x c1 c2)\"\n      by (auto intro: in_DBM_D[OF \\<open>u \\<in> _\\<close>])\n    with prems \\<open>x > 0\\<close> show ?case\n    proof (auto simp: dbm_entry_val'_iff_bounded free_def split: if_split_asm, goal_cases)\n      case prems: 1\n      then have \"r \\<le> M x c2 + Le (u c2)\"\n        unfolding r_def by (intro Min_le) auto\n      with \\<open>0 \\<le> r + _\\<close> have \"0 \\<le> M x c2 + Le (u c2) + Le (- d)\"\n        by auto\n      moreover have \"Le (d - u c2) \\<le> M x c2 \\<longleftrightarrow> 0 \\<le> M x c2 + Le (u c2) + Le (- d)\"\n        by (cases \"M x c2\") (auto simp: DBM.add algebra_simps)\n      ultimately show \"Le (d - u c2) \\<le> M x c2\"\n        by simp\n    next\n      case prems: 2\n      from \\<open>0 \\<le> r + _\\<close> have \"Le d \\<le> r\"\n        by (simp add: Le_le_sum_iff)\n      also have \"r \\<le> M x 0\"\n        unfolding r_def by auto\n      finally show \"Le d \\<le> M x 0\" .\n    next\n      case prems: 3\n      then have \"l \\<le> M c1 x + Le (- u c1)\"\n        unfolding l_def by (intro Min_le) auto\n      with \\<open>0 \\<le> l + Le d\\<close> have \"0 \\<le> M c1 x + Le (- u c1) + Le d\"\n        by auto\n      moreover have \"Le (u c1 - d) \\<le> M c1 x \\<longleftrightarrow> 0 \\<le> M c1 x + Le (- u c1) + Le d\"\n        by (cases \"M c1 x\") (auto simp: DBM.add algebra_simps)\n      ultimately show \"Le (u c1 - d) \\<le> M c1 x\"\n        by simp\n    next\n      case prems: 4\n      from \\<open>0 \\<le> l + Le d\\<close> have \"Le (- d) \\<le> l\"\n        by (simp add: Le_le_sum_iff)\n      also have \"l \\<le> M 0 x\"\n        unfolding l_def by auto\n      finally show \"Le (- d) \\<le> M 0 x\" .\n    qed\n  qed\n  with \\<open>d \\<ge> 0\\<close> show \"\\<exists>d\\<ge>0. u(x := d) \\<in> \\<lbrakk>M\\<rbrakk>\"\n    by auto\n  from \\<open>x > 0\\<close> \\<open>x \\<le> n\\<close> have \"dbm_entry_val' u 0 x (free n M x 0 x)\"\n    by (auto intro: in_DBM_D[OF \\<open>u \\<in> _\\<close>])\n  with \\<open>0 < x\\<close> have \"Le (- u x) \\<le> M 0 0\"\n    by (auto simp: free_def dbm_entry_val'_iff_bounded)\n  with \\<open>M 0 0 \\<le> 0\\<close> have \"Le (- u x) \\<le> 0\"\n    by blast\n  then show \"0 \\<le> u x\"\n    by auto\nqed\n\nlemma free_correct:\n  \"\\<lbrakk>free n M x\\<rbrakk> = {u(x := d) | u d. u \\<in> \\<lbrakk>M\\<rbrakk> \\<and> d \\<ge> 0}\"\n  if \"x > 0\" \"x \\<le> n\" \"\\<forall>c \\<le> n. M c c \\<ge> 0\" \"\\<forall> u \\<in> \\<lbrakk>M\\<rbrakk>. u x \\<ge> 0\" \"canonical M n\"\n    \"M 0 x \\<le> 0\" \"M 0 0 \\<le> 0\"\n  using that\n  apply safe\n  subgoal for u'\n    apply (frule free_sound, assumption+)\n    apply (frule free_sound(2), assumption+)\n    apply (erule exE)\n    subgoal for d\n      by (inst_existentials \"u'(x := d)\" \"u' x\"; simp)\n    done\n  subgoal for u d\n    by (auto intro: free_complete)\n  done\n\nlemma pre_reset_correct_aux:\n  \"{u. (u(x := (0::'t))) \\<in> \\<lbrakk>M\\<rbrakk>} \\<inter> {u. u x \\<ge> 0} = {u(x := d) | u d. u \\<in> \\<lbrakk>M\\<rbrakk> \\<and> u x = 0 \\<and> d \\<ge> 0}\"\n  apply auto\n  subgoal for u\n    by (inst_existentials \"u(x := (0::'t))\" \"u x\") auto\n  subgoal for u d\n    by (subgoal_tac \"u = u(x := 0)\") auto\n  done\n\nlemma restrict_zero_correct:\n  \"\\<lbrakk>restrict_zero n M x\\<rbrakk> = {u. u \\<in> \\<lbrakk>M\\<rbrakk> \\<and> u x = 0}\" if \"0 < x\" \"x \\<le> n\"\n  using that unfolding restrict_zero_def\n  by (auto simp: repair_pair_zone_equiv and_entry_correct dbm_entry_val'_iff_bounded dbm_entry_simps)\n\nlemma restrict_zero_canonical:\n  \"canonical (restrict_zero n M x) n \\<or> check_diag n (uncurry (restrict_zero n M x))\"\n  if \"canonical M n\" \"x \\<le> n\"\nproof -\n  from \\<open>x \\<le> n\\<close> have *: \"{0..n} - {0, x} \\<union> {x, 0} = {0..n}\"\n    by auto\n  define M1 and M2 where \"M1 = and_entry x 0 (Le 0) M\" \"M2 = and_entry 0 x (Le 0) M1\"\n  from \\<open>canonical M n\\<close> have \"canonical_subs n {0..n} M\"\n    unfolding canonical_alt_def .\n  with * have \"canonical_subs n ({0..n} - {0, x}) M2\"\n    unfolding and_entry_def M1_M2_def canonical_subs_def by (auto simp: min.coboundedI1)\n  from repair_pair_characteristic[OF this, of x 0] \\<open>x \\<le> n\\<close> have\n    \"canonical (repair_pair n M2 x 0) n \\<or> check_diag n (uncurry (repair_pair n M2 x 0))\"\n    unfolding canonical_alt_def check_diag_def * neutral by auto\n  then show ?thesis\n    unfolding restrict_zero_def M1_M2_def Let_def .\nqed\n\nend (* Fixed DBM *)\n\nsubsection \\<open>Structural Properties\\<close>\n\nlemma free_canonical:\n  \"canonical (free n M x) n\" if \"canonical M n\" \"M x x \\<ge> 0\"\n  unfolding free_def using that by (auto simp: add_increasing2 any_le_inf)\n\nlemma free_diag:\n  \"free n M x i i = M i i\"\n  unfolding free_def by auto\n\nlemma check_diag_free:\n  \"check_diag n (uncurry (free n M x))\" if \"check_diag n (uncurry M)\"\n  using that unfolding check_diag_def by (auto simp: free_diag)\n\nlemma\n  \"\\<forall>i\\<le>n. (free n M x) i i \\<le> 0\" if \"\\<forall>i\\<le>n. M i i \\<le> 0\"\n  using that by (auto simp: free_diag)\n\nlemma canonical_nonneg_diag_non_empty:\n  assumes \"canonical M n\" \"\\<forall>i\\<le>n. 0 \\<le> M i i\"\n  shows \"[M]\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n  using v_0 by (intro canonical_nonneg_diag_non_empty[OF assms]) force\n\nlemma V_structuralI:\n  \"\\<lbrakk>M\\<rbrakk> \\<subseteq> V\" if \"\\<forall> i \\<le> n. i > 0 \\<longrightarrow> M 0 i \\<le> 0\"\n  using that\n  unfolding V_def\nproof clarsimp\n  fix u i assume \"u \\<in> \\<lbrakk>M\\<rbrakk>\" \"Suc 0 \\<le> i\" \"i \\<le> n\"\n  from in_DBM_D[OF \\<open>u \\<in> _\\<close>, of 0 i] \\<open>_ \\<le> i\\<close> \\<open>i \\<le> n\\<close> have \"dbm_entry_val' u 0 i (M 0 i)\"\n    by auto\n  with \\<open>_ \\<le> i\\<close> \\<open>i \\<le> n\\<close> have \"Le (- u i) \\<le> M 0 i\"\n    by (auto simp: dbm_entry_val'_iff_bounded)\n  also from that \\<open>_ \\<le> i\\<close> \\<open>i \\<le> n\\<close> have \"\\<dots> \\<le> 0\"\n    by simp\n  finally show \"0 \\<le> u i\"\n    by (auto simp: dbm_entry_simps)\nqed\n\nlemma canonical_V_non_empty_iff:\n  assumes \"canonical M n\" \"M 0 0 \\<le> 0\"\n  shows \"\\<lbrakk>M\\<rbrakk> \\<subseteq> V \\<and> \\<lbrakk>M\\<rbrakk> \\<noteq> {} \\<longleftrightarrow> (\\<forall> i \\<le> n. i > 0 \\<longrightarrow> M 0 i \\<le> 0) \\<and> (\\<forall> i \\<le> n. M i i \\<ge> 0)\"\nproof (safe, goal_cases)\n  case (1 u i)\n  with \\<open>M 0 0 \\<le> 0\\<close> show ?case\n    unfolding V_def by - (rule M_0_k[OF _ \\<open>canonical M n\\<close>], auto)\nnext\n  case (2 x i)\n  then show ?case\n    using neg_diag_empty_spec[of i M] by fastforce\nnext\n  case prems: (3 u)\n  then show ?case\n    by (auto dest: subsetD[OF V_structuralI])\nnext\n  case 4\n  with canonical_nonneg_diag_non_empty[OF \\<open>canonical M n\\<close>] show ?case\n    by simp\nqed\n\nlemma\n  assumes \"(\\<forall> i \\<le> n. i > 0 \\<longrightarrow> M 0 i \\<le> 0) \\<and> (\\<forall> i \\<le> n. M i i \\<ge> 0)\" \"M 0 0 \\<le> 0\" \"x > 0\"\n  shows \"(\\<forall> i \\<le> n. i > 0 \\<longrightarrow> free n M x 0 i \\<le> 0) \\<and> (\\<forall> i \\<le> n. free n M x i i \\<ge> 0)\"\n  using assms by (auto simp: free_def)\n\nlemma\n  assumes \"(\\<forall> i \\<le> n. i > 0 \\<longrightarrow> M 0 i \\<le> 0) \\<and> (\\<forall> i \\<le> n. M i i \\<ge> 0) \\<Longrightarrow>\n           (\\<forall> i \\<le> n. i > 0 \\<longrightarrow> f M 0 i \\<le> 0) \\<and> (\\<forall> i \\<le> n. f M i i \\<ge> 0)\"\n  assumes \"canonical M n\" \"canonical (f M) n\"\n  assumes \"M 0 0 \\<le> 0\" \"f M 0 0 \\<le> 0\"\n  assumes check_diag: \"check_diag n (uncurry M) \\<Longrightarrow> check_diag n (uncurry (f M))\"\n  assumes \"\\<lbrakk>M\\<rbrakk> \\<subseteq> V\"\n  shows \"\\<lbrakk>f M\\<rbrakk> \\<subseteq> V\"\nproof (cases \"\\<lbrakk>M\\<rbrakk> = {}\")\n  case True\n  then have \"check_diag n (uncurry M)\"\n  using canonical_nonneg_diag_non_empty[OF \\<open>canonical M n\\<close>] by (force simp: neutral check_diag_def)\n  then have \"check_diag n (uncurry (f M))\"\n    by (rule check_diag)\n  then have \"\\<lbrakk>f M\\<rbrakk> = {}\"\n    by (auto dest: neg_diag_empty_spec simp: check_diag_def neutral)\n  then show ?thesis\n    by auto\nnext\n  case False\n  with \\<open>\\<lbrakk>M\\<rbrakk> \\<subseteq> V\\<close> canonical_V_non_empty_iff[OF \\<open>canonical M n\\<close> \\<open>M 0 0 \\<le> 0\\<close>] have\n    \"(\\<forall>i\\<le>n. 0 < i \\<longrightarrow> M 0 i \\<le> 0) \\<and> (\\<forall>i\\<le>n. 0 \\<le> M i i)\"\n    by auto\n  then have \"(\\<forall> i \\<le> n. i > 0 \\<longrightarrow> f M 0 i \\<le> 0) \\<and> (\\<forall> i \\<le> n. f M i i \\<ge> 0)\"\n    by (rule assms(1))\n  with \\<open>canonical (f M) n\\<close> have \"\\<lbrakk>f M\\<rbrakk> \\<subseteq> V \\<and> \\<lbrakk>f M\\<rbrakk> \\<noteq> {}\"\n    using \\<open>f M 0 0 \\<le> 0\\<close> by (subst canonical_V_non_empty_iff) (auto simp: free_diag)\n  then show ?thesis ..\nqed\n\nlemma\n  \"\\<lbrakk>free n M x\\<rbrakk> \\<subseteq> V\" if assms: \"x > 0\" \"canonical M n\" \"M 0 0 \\<le> 0\" \"0 \\<le> M x x\" \"\\<lbrakk>M\\<rbrakk> \\<subseteq> V\"\nproof (cases \"\\<lbrakk>M\\<rbrakk> = {}\")\n  case True\n  then obtain i where \"M i i < 0\" \"i \\<le> n\"\n    using canonical_nonneg_diag_non_empty[OF \\<open>canonical M n\\<close>] by atomize_elim force\n  then have \"free n M x i i < 0\"\n    by (auto simp: free_diag)\n  with \\<open>i \\<le> n\\<close> have \"\\<lbrakk>free n M x\\<rbrakk> = {}\"\n    by (intro neg_diag_empty_spec)\n  then show ?thesis\n    by auto\nnext\n  case False\n  with \\<open>\\<lbrakk>M\\<rbrakk> \\<subseteq> V\\<close> canonical_V_non_empty_iff[OF that(2,3)] have\n    \"(\\<forall>i\\<le>n. 0 < i \\<longrightarrow> M 0 i \\<le> 0) \\<and> (\\<forall>i\\<le>n. 0 \\<le> M i i)\"\n    by auto\n  with that have \"(\\<forall> i \\<le> n. i > 0 \\<longrightarrow> free n M x 0 i \\<le> 0) \\<and> (\\<forall> i \\<le> n. free n M x i i \\<ge> 0)\"\n    by (auto simp: free_def)\n  moreover have \"canonical (free n M x) n\"\n    apply (rule free_canonical)\n     apply fact\n    apply fact\n    done\n  ultimately have \"\\<lbrakk>free n M x\\<rbrakk> \\<subseteq> V \\<and> \\<lbrakk>free n M x\\<rbrakk> \\<noteq> {}\"\n    using \\<open>M 0 0 \\<le> 0\\<close> by (subst canonical_V_non_empty_iff) (auto simp: free_diag)\n  then show ?thesis ..\nqed\n\nlemma\n  \"down n M i i = M i i\"\n  unfolding down_def by auto\n\nlemma\n  assumes \"(\\<forall> i \\<le> n. i > 0 \\<longrightarrow> M 0 i \\<le> 0) \\<and> (\\<forall> i \\<le> n. M i i \\<ge> 0)\" \"M 0 0 \\<le> 0\" \"x > 0\"\n  shows \"(\\<forall> i \\<le> n. i > 0 \\<longrightarrow> down n M 0 i \\<le> 0) \\<and> (\\<forall> i \\<le> n. down n M i i \\<ge> 0)\"\n  using assms by (auto simp: down_def neutral)\n\nlemma check_diag_empty:\n  \"\\<lbrakk>M\\<rbrakk> = {}\" if \"check_diag n (uncurry M)\"\n  using check_diag_empty[of n v \"uncurry M\"] that v_is_id by auto\n\nlemma restrict_zero_mono:\n  \"restrict_zero n M x i j \\<le> M i j\" if \"i \\<le> n\" \"j \\<le> n\"\n  unfolding restrict_zero_def\n  by simp (rule \\<open>i \\<le> n\\<close> \\<open>j \\<le> n\\<close> repair_pair_mono and_entry_mono order.trans)+\n\nlemma restrict_zero_diag:\n  \"check_diag n (uncurry (restrict_zero n M x))\" if \"check_diag n (uncurry M)\"\n  using that unfolding check_diag_def neutral[symmetric]\n  by (elim exE conjE) (frule restrict_zero_mono[where M = M and x = x], auto)\n\nlemma pre_reset_correct:\n  \"\\<lbrakk>pre_reset n M x\\<rbrakk> = {u. (u(x := (0::'t::time))) \\<in> \\<lbrakk>M\\<rbrakk>} \\<inter> {u. u x \\<ge> 0}\"\n  if \"x > 0\" \"x \\<le> n\" \"canonical M n \\<or> check_diag n (uncurry M)\" \"M 0 x \\<le> 0\" \"M 0 0 \\<le> 0\"\nproof -\n  have check_diag: ?thesis if A: \"check_diag n (uncurry (restrict_zero n M x))\"\n  proof -\n    from A have \"check_diag n (uncurry (pre_reset n M x))\"\n      unfolding pre_reset_def by (rule check_diag_free)\n    then have \"\\<lbrakk>pre_reset n M x\\<rbrakk> = {}\"\n      by (rule check_diag_empty)\n    from A have \"\\<lbrakk>restrict_zero n M x\\<rbrakk> = {}\"\n      by (rule check_diag_empty)\n    then have \"{u. (u(x := (0::'t::time))) \\<in> \\<lbrakk>M\\<rbrakk>} \\<inter> {u. u x \\<ge> 0} = {}\"\n      using \\<open>0 < x\\<close> \\<open>x \\<le> n\\<close> by (auto simp: restrict_zero_correct)\n    with \\<open>\\<lbrakk>pre_reset n M x\\<rbrakk> = {}\\<close> show ?thesis\n      by simp\n  qed\n  from that(3) show ?thesis\n  proof\n    assume \"canonical M n\"\n    from restrict_zero_canonical[OF \\<open>canonical M n\\<close> \\<open>x \\<le> n\\<close>] have\n      \"canonical (restrict_zero n M x) n \\<or> check_diag n (uncurry (restrict_zero n M x))\"\n      (is \"?A \\<or> ?B\") .\n    then consider ?A \"\\<not> ?B\" | ?B\n      by blast\n    then show ?thesis\n    proof cases\n      case 1\n      assume ?A \"\\<not> ?B\"\n      moreover from \\<open>\\<not> ?B\\<close> have \"\\<forall>c\\<le>n. 0 \\<le> restrict_zero n M x c c\"\n        unfolding check_diag_def by (auto simp: DBM.neutral)\n      moreover have \"\\<forall>u\\<in>\\<lbrakk>restrict_zero n M x\\<rbrakk>. 0 \\<le> u x\"\n        by (simp add: restrict_zero_correct that)\n      moreover from \\<open>x \\<le> n\\<close> \\<open>M 0 x \\<le> 0\\<close> have \"restrict_zero n M x 0 x \\<le> 0\"\n        by (blast intro: order.trans restrict_zero_mono)\n      moreover from \\<open>x \\<le> n\\<close> \\<open>M 0 0 \\<le> 0\\<close> have \"restrict_zero n M x 0 0 \\<le> 0\"\n        by (blast intro: order.trans restrict_zero_mono)\n      ultimately show ?thesis\n        using that\n        by (auto simp: pre_reset_correct_aux restrict_zero_correct free_correct pre_reset_def)\n    next\n      assume ?B then show ?thesis\n        by (rule check_diag)\n    qed\n  next\n    assume \"check_diag n (uncurry M)\"\n    then have \"check_diag n (uncurry (restrict_zero n M x))\"\n      by (rule restrict_zero_diag)\n    then show ?thesis\n      by (rule check_diag)\n  qed\nqed\n\nlemma zone_set_pre_Cons:\n  \"zone_set_pre \\<lbrakk>M\\<rbrakk> (x # r) = zone_set_pre {u. (u(x := (0::'t::time))) \\<in> \\<lbrakk>M\\<rbrakk>} r\"\n  unfolding zone_set_pre_def by auto\n\nlemma pre_reset_list_Cons:\n  \"pre_reset_list n M (x # r) = pre_reset_list n (pre_reset n M x) r\"\n  unfolding pre_reset_list_def by simp\n\nlemma pre_reset_diag:\n  \"check_diag n (uncurry (pre_reset n M x))\" if \"check_diag n (uncurry M)\"\n  using that unfolding pre_reset_def by (intro check_diag_free restrict_zero_diag)\n\nlemma free_canonical':\n  \"canonical (free n (M :: (_ :: time) DBM) x) n \\<or> check_diag n (uncurry (free n M x))\"\n  if \"canonical M n \\<or> check_diag n (uncurry M)\" \"x \\<le> n\"\n  by (smt check_diag_def check_diag_free dbm_entry_le_iff(5) free_canonical leI\n          order_mono_setup.refl order_trans that uncurry_apply\n     )\n\nlemma pre_reset_canonical':\n  \"canonical (pre_reset n (M :: (_ :: time) DBM) x) n \\<or> check_diag n (uncurry (pre_reset n M x))\"\n  if \"canonical M n \\<or> check_diag n (uncurry M)\" \"x \\<le> n\"\n  using that(1)\nproof standard\n  assume \"canonical M n\"\n  with \\<open>x \\<le> n\\<close> have\n    \"canonical (restrict_zero n M x) n \\<or> check_diag n (uncurry (restrict_zero n M x))\"\n    by (intro restrict_zero_canonical)\n  with \\<open>x \\<le> n\\<close> show ?thesis\n    unfolding pre_reset_def by (intro free_canonical')\nnext\n  assume \"check_diag n (uncurry M)\"\n  from pre_reset_diag[OF this] show ?thesis ..\nqed\n\nlemma pre_reset_list_correct:\n  \"\\<lbrakk>pre_reset_list n M r\\<rbrakk> = zone_set_pre \\<lbrakk>M\\<rbrakk> r \\<inter> {u. \\<forall> x \\<in> set r. u x \\<ge> 0}\"\n  if \"\\<forall> x \\<in> set r. x > 0 \\<and> x \\<le> n\"\n    \"canonical M n \\<or> check_diag n (uncurry M)\" \"\\<forall> x \\<in> set r. M 0 x \\<le> 0\" \"M 0 0 \\<le> 0\"\n  using that\n  apply (induction r arbitrary: M)\n   apply (simp add: zone_set_pre_def pre_reset_list_def)\n  subgoal premises prems for x r M\n    apply (subst zone_set_pre_Cons)\n    apply (subst pre_reset_list_Cons)\n    apply (subst prems)\n        prefer 5\n        apply (subst pre_reset_correct)\n             prefer 6\n    subgoal\n      unfolding zone_set_pre_def by (cases \"x \\<in> set r\") auto\n    using prems(2-) apply (auto; fail)+\n    subgoal\n      using prems(2-) by (intro pre_reset_canonical'; auto)\n    subgoal\n      unfolding pre_reset_def free_def using prems(2-)\n      by (auto 4 3 intro: order.trans restrict_zero_mono)\n    subgoal\n      unfolding pre_reset_def free_def using prems(2-)\n      by (auto 4 3 intro: order.trans restrict_zero_mono)\n    done\n  done\n\nend (* Default Clock Numbering *)\n\ntext \\<open>\nComputes \\<open>dbm_list xs - \\<lbrakk>M\\<rbrakk> = dbm_list xs \\<inter> (- \\<lbrakk>M\\<rbrakk>)\\<close> by negating each entry of \\<open>M\\<close>\nand intersecting it with each member of \\<open>xs\\<close>.\n\\<close>\ndefinition\n  \"dbm_minus_canonical n xs M =\n   [and_entry_repair n j i (neg_dbm_entry (M i j)) M'.\n     (i, j) \\<leftarrow> [(i, j).\n        i\\<leftarrow>[0..<Suc n], j\\<leftarrow>[0..<Suc n], (i > 0 \\<or> j > 0) \\<and> i \\<le> n \\<and> j \\<le> n \\<and> M i j \\<noteq> \\<infinity>],\n     M'     \\<leftarrow> xs\n   ]\"\n\ntext \\<open>\nSame as @{text dbm_minus_canonical} but filters out empty DBMs.\n\\<close>\ndefinition\n  \"dbm_minus_canonical_check n xs M =\n  filter (\\<lambda>M. \\<not> check_diag n (uncurry M)) (dbm_minus_canonical n xs M)\"\n\ntext \\<open>Checks whether \\<open>\\<lbrakk>M\\<rbrakk> - dbm_list xs = {}\\<close>.\\<close>\ndefinition\n  \"dbm_subset_fed n M xs \\<equiv>\n    let xs = filter (\\<lambda>M. \\<not> check_diag n (uncurry M)) xs in\n    list_all (\\<lambda> M. check_diag n (uncurry M)) (fold (\\<lambda>m S. dbm_minus_canonical n S m) xs [M])\"\n\ndefinition\n  \"dbm_subset_fed_check n M xs \\<equiv>\n    let\n      xs = filter (\\<lambda>M. \\<not> check_diag n (uncurry M)) xs;\n      is_direct_subset = list_ex (\\<lambda> M'. dbm_subset' n (uncurry M) (uncurry M')) xs\n    in is_direct_subset \\<or>\n       list_all (\\<lambda>M. check_diag n (uncurry M)) (fold (\\<lambda>m S. dbm_minus_canonical_check n S m) xs [M])\"\n\ndefinition \"canonical' n M \\<equiv> canonical M n \\<or> check_diag n (uncurry M)\"\n\nlemma canonical'I:\n  \"canonical' n (f M)\" if\n  \"canonical' n M\"\n  \"canonical M n \\<Longrightarrow> canonical' n (f M)\" \"check_diag n (uncurry M) \\<Longrightarrow> check_diag n (uncurry (f M))\"\n  using that unfolding canonical'_def by metis\n\nlemma check_diag_repair_pair:\n  assumes \"check_diag n (uncurry M)\"\n  shows \"check_diag n (uncurry (repair_pair n M i j))\"\n  using assms repair_pair_mono[where M = M and a = i and b = j] unfolding check_diag_def by force\n\nlemma check_diag_and_entry:\n  assumes \"check_diag n (uncurry M)\"\n  shows \"check_diag n (uncurry (and_entry a b e M))\"\n  using assms unfolding check_diag_def\n  apply (elim exE)\n  subgoal for i\n    using and_entry_mono[where M = M and a = a and b = b and e = e, of i i] by auto\n  done\n\nlemma canonical'_and_entry_repair:\n  \"canonical' n (and_entry_repair n i j e M)\" if \"canonical' n M\" \"i \\<le> n\" \"j \\<le> n\"\n  using that(1)\nproof (rule canonical'I)\n  assume \"canonical M n\"\n  from \\<open>i \\<le> n\\<close> \\<open>j \\<le> n\\<close> have *: \"{0..n} - {i, j} \\<union> {i, j} = {0..n}\"\n    by auto\n  define M1 where \"M1 = and_entry i j e M\"\n  from \\<open>canonical M n\\<close> have \"canonical_subs n {0..n} M\"\n    unfolding canonical_alt_def .\n  with * have \"canonical_subs n ({0..n} - {i, j}) M1\"\n    unfolding and_entry_def M1_def canonical_subs_def by (auto simp: min.coboundedI1)\n  from repair_pair_characteristic[OF this, of i j] \\<open>i \\<le> n\\<close> \\<open>j \\<le> n\\<close> have\n    \"canonical' n (repair_pair n M1 i j)\"\n    unfolding canonical'_def\n    unfolding canonical_alt_def check_diag_def * neutral by auto\n  then show ?thesis\n    unfolding and_entry_repair_def M1_def Let_def .\nnext\n  assume \"check_diag n (uncurry M)\"\n  then show \"check_diag n (uncurry (and_entry_repair n i j e M))\"\n    unfolding and_entry_repair_def by (intro check_diag_repair_pair check_diag_and_entry)\nqed\n\nlemma dbm_minus_canonical_canonical':\n  \"\\<forall>M \\<in> set (dbm_minus_canonical n xs m). canonical' n M\" if \"\\<forall>M \\<in> set xs. canonical' n M\"\n  using that unfolding dbm_minus_canonical_def\n  by (auto split: if_split_asm intro: canonical'_and_entry_repair)\n\nlemma dbm_minus_canonical_check_canonical':\n  \"\\<forall>M \\<in> set (dbm_minus_canonical_check n xs m). canonical' n M\" if \"\\<forall>M \\<in> set xs. canonical' n M\"\n  using dbm_minus_canonical_canonical'[OF that] unfolding dbm_minus_canonical_check_def by auto\n\nsubsection \\<open>Correctness of @{term dbm_subset_fed}\\<close>\n\nparagraph \\<open>Misc\\<close>\n\nlemma list_all_iffI:\n  assumes \"\\<forall> x \\<in> set xs. \\<exists> y \\<in> set ys. P x \\<longleftrightarrow> Q y\"\n      and \"\\<forall> y \\<in> set ys. \\<exists> x \\<in> set xs. P x \\<longleftrightarrow> Q y\"\n    shows \"list_all P xs \\<longleftrightarrow> list_all Q ys\"\n  using assms unfolding list_all_def by blast\n\nlemma list_all_iff_list_all2I:\n  assumes \"list_all2 (\\<lambda> x y. P x \\<longleftrightarrow> Q y) xs ys\"\n  shows \"list_all P xs \\<longleftrightarrow> list_all Q ys\"\n  using assms by (intro list_all_iffI list_all2_set1 list_all2_set2)\n\nlemma list_all2_mapI:\n  assumes \"list_all2 (\\<lambda> x y. P (f x) (g y)) xs ys\"\n  shows \"list_all2 P (map f xs) (map g ys)\"\n  using assms by (simp only: list.rel_map)\n\ncontext Default_Nat_Clock_Numbering\nbegin\n\nlemma canonical_empty_zone:\n  \"[M]\\<^bsub>v,n\\<^esub> = {} \\<longleftrightarrow> (\\<exists>i\\<le>n. M i i < 0)\" if \"canonical M n\"\n  using v_0 that surj_on by (intro canonical_empty_zone) auto\n\nlemma check_diag_iff_empty:\n  \"check_diag n (uncurry M) \\<longleftrightarrow> \\<lbrakk>M\\<rbrakk> = {}\" if \"canonical' n M\"\nproof (auto dest: check_diag_empty, goal_cases)\n  case 1\n  show ?case\n  proof -\n    from that\n    show ?thesis\n      unfolding canonical'_def\n    proof\n      assume \"canonical M n\"\n      from canonical_empty_zone[OF this] \\<open>\\<lbrakk>M\\<rbrakk> = {}\\<close> have\n        \"\\<exists>i\\<le>n. M i i < 0\"\n        by auto\n      then show ?thesis unfolding check_diag_def neutral\n        by auto\n    next\n      assume \"check_diag n (uncurry M)\"\n      then show ?thesis unfolding check_diag_def neutral by auto\n    qed\n  qed\nqed\n\nlemma and_entry_repair_zone_equiv:\n  \"\\<lbrakk>and_entry_repair n a b e M\\<rbrakk> = \\<lbrakk>and_entry a b e M\\<rbrakk>\" if \"a \\<le> n\" \"b \\<le> n\"\n  unfolding and_entry_repair_def using that by (rule repair_pair_zone_equiv)\n\nlemma dbm_minus_rel:\n  assumes \"list_all2 (\\<lambda>x y. \\<lbrakk>x\\<rbrakk> = \\<lbrakk>y\\<rbrakk>) ms ms'\"\n  shows \"list_all2 (\\<lambda>x y. \\<lbrakk>x\\<rbrakk> = \\<lbrakk>y\\<rbrakk>) (dbm_minus n ms m) (dbm_minus_canonical n ms' m)\"\n  unfolding dbm_minus_def dbm_minus_canonical_def\n  apply (rule concat_transfer[unfolded rel_fun_def, rule_format])\n  apply (rule list_all2_mapI)\n  apply (rule list.rel_refl_strong)\n  apply (auto 4 3\n      intro: list_all2_mapI list_all2_mono[OF assms]\n      simp: and_entry_repair_zone_equiv and_entry_correct split: if_split_asm\n      )\n  done\n\nlemma dbm_minus_canonical_fold_canonical':\n  \"\\<forall>M \\<in> set (fold (\\<lambda>m S. dbm_minus_canonical n S m) xs ms). canonical' n M\"\n  if \"\\<forall>M \\<in> set ms. canonical' n M\" for ms and xs :: \"('t ::time) DBM list\"\n  using that by (induction xs arbitrary: ms) (auto dest: dbm_minus_canonical_canonical')\n\n(* XXX Move? *)\nlemma not_check_diag_nonnegD:\n  \"M i i \\<ge> 0\" if \"\\<not> check_diag n (uncurry M)\" \"i \\<le> n\"\n  using that unfolding check_diag_def by (auto simp: DBM.less_eq[symmetric] neutral)\n\ntheorem dbm_subset_fed_correct:\n  fixes xs :: \"(nat \\<Rightarrow> nat \\<Rightarrow> ('t ::time) DBMEntry) list\"\n    and S :: \"(nat \\<Rightarrow> nat \\<Rightarrow> 't DBMEntry) list\"\n  assumes \"canonical' n M\"\n  shows \"\\<lbrakk>M\\<rbrakk> \\<subseteq> (\\<Union>m\\<in>set xs. \\<lbrakk>m\\<rbrakk>) \\<longleftrightarrow> dbm_subset_fed n M xs\"\nproof -\n  have *: \"list_all2 (\\<lambda>x y. \\<lbrakk>x\\<rbrakk> = \\<lbrakk>y\\<rbrakk>)\n     (fold (\\<lambda>m S. dbm_minus n S m) xs ms)\n     (fold (\\<lambda>m S. dbm_minus_canonical n S m) xs ms')\"\n    if \"list_all2 (\\<lambda>x y. \\<lbrakk>x\\<rbrakk> = \\<lbrakk>y\\<rbrakk>) ms ms'\" for ms ms' and xs :: \"'t DBM list\"\n    using that\n  proof (induction xs arbitrary: ms ms')\n    case Nil\n    then show ?case\n      by simp\n  next\n    case prems: (Cons a xs)\n    from this(2) show ?case\n      by simp (intro prems(1) dbm_minus_rel)\n  qed\n  let ?xs = \"filter (\\<lambda>M. \\<not> check_diag n (uncurry M)) xs\"\n  have *: \"list_all2 (\\<lambda>x y. \\<lbrakk>x\\<rbrakk> = \\<lbrakk>y\\<rbrakk>)\n     (fold (\\<lambda>m S. dbm_minus n S m) ?xs [M])\n     (fold (\\<lambda>m S. dbm_minus_canonical n S m) ?xs [M])\"\n    by (rule *) simp\n  have **:\"(\\<Union>m\\<in>set xs. \\<lbrakk>m\\<rbrakk>) = (\\<Union>m\\<in>set (filter (\\<lambda>M. \\<not> check_diag n (uncurry M)) xs). \\<lbrakk>m\\<rbrakk>)\"\n    by (auto simp: check_diag_empty)\n  show ?thesis\n    apply (subst **)\n    apply (subst dbm_list_superset_op[where S = \"[M]\", simplified])\n    subgoal\n      by (auto dest: not_check_diag_nonnegD simp: neutral[symmetric] DBM.less_eq)\n    subgoal\n      unfolding dbm_subset_fed_def Let_def\n      using dbm_minus_canonical_fold_canonical'[of \"[M]\"] \\<open>canonical' n M\\<close>\n      by (intro list_all_iff_list_all2I list.rel_mono_strong[OF *])(auto dest: check_diag_iff_empty)\n    done\nqed\n\nlemma dbm_minus_canonical_check_fed_equiv:\n  \"dbm_list (dbm_minus_canonical_check n S m) = dbm_list (dbm_minus_canonical n S m)\"\n  unfolding dbm_minus_canonical_check_def by (auto simp: check_diag_empty)\n\nlemma dbm_minus_canonical_dbm_minus:\n  \"dbm_list (dbm_minus_canonical n xs m) = dbm_list (dbm_minus n xs m)\"\n  using dbm_minus_rel[of xs xs m] unfolding list_all2_same\n  by (force dest: list_all2_set1 list_all2_set2)\n\nlemma dbm_minus_canonical_fed_equiv:\n  \"dbm_list (dbm_minus_canonical n xs m) = dbm_list (dbm_minus_canonical n xs' m)\"\n  if \"dbm_list xs = dbm_list xs'\" \"0 \\<le> m 0 0\"\n  unfolding dbm_minus_canonical_dbm_minus\n  using that by (auto simp: neutral dbm_list_subtract[symmetric] DBM.less_eq)\n\ntheorem dbm_subset_fed_correct':\n  fixes xs :: \"(nat \\<Rightarrow> nat \\<Rightarrow> ('t ::time) DBMEntry) list\"\n    and S :: \"(nat \\<Rightarrow> nat \\<Rightarrow> 't DBMEntry) list\"\n  assumes \"canonical' n M\"\n  shows \"\\<lbrakk>M\\<rbrakk> \\<subseteq> (\\<Union>m\\<in>set xs. \\<lbrakk>m\\<rbrakk>) \\<longleftrightarrow> (\n    let xs = filter (\\<lambda>M. \\<not> check_diag n (uncurry M)) xs in\n    list_all (\\<lambda> M. check_diag n (uncurry M)) (fold (\\<lambda>m S. dbm_minus_canonical_check n S m) xs [M]))\"\nproof -\n  have canonical: \"\\<forall>M \\<in> set (fold (\\<lambda>m S. dbm_minus_canonical_check n S m) xs ms). canonical' n M\"\n    if \"\\<forall>M \\<in> set ms. canonical' n M\" for ms and xs :: \"'t DBM list\"\n    using that by (induction xs arbitrary: ms) (auto dest: dbm_minus_canonical_check_canonical')\n  have *: \"dbm_list (fold (\\<lambda>m S. dbm_minus_canonical_check n S m) xs ms) =\n    dbm_list (fold (\\<lambda>m S. dbm_minus_canonical n S m) xs ms')\"\n    if \"dbm_list ms = dbm_list ms'\" \"\\<forall>m \\<in> set xs. m 0 0 \\<ge> 0\" for ms ms' and xs :: \"'t DBM list\"\n    using that\n  proof (induction xs arbitrary: ms ms')\n    case Nil\n    then show ?case\n      by simp\n  next\n    case (Cons a xs)\n    from Cons.prems show ?case\n      by - (simp, rule Cons.IH,\n          auto intro!: dbm_minus_canonical_fed_equiv simp add: dbm_minus_canonical_check_fed_equiv\n          )\n  qed\n  define xs' where \"xs' = filter (\\<lambda>M. \\<not> check_diag n (uncurry M)) xs\"\n  have *: \"dbm_list (fold (\\<lambda>m S. dbm_minus_canonical_check n S m) xs' [M]) =\n        dbm_list (fold (\\<lambda>m S. dbm_minus_canonical n S m) xs' [M])\"\n    by (auto intro!: * dest: not_check_diag_nonnegD simp: xs'_def)\n  have **: \"list_all (\\<lambda> M. check_diag n (uncurry M)) xs \\<longleftrightarrow> dbm_list xs = {}\"\n    if \"\\<forall>M \\<in> set xs. canonical' n M\" for xs :: \"'t DBM list\"\n    using that by (metis (mono_tags, lifting) Ball_set SUP_bot_conv(2) check_diag_iff_empty)\n  show ?thesis\n    unfolding \n      dbm_subset_fed_correct[OF \\<open>canonical' _ _\\<close>] dbm_subset_fed_def\n      xs'_def[symmetric] Let_def\n    apply (subst **)\n     defer\n     apply (subst **)\n    using assms by (auto intro!: dbm_minus_canonical_fold_canonical' canonical simp: *)\nqed\n\n(* XXX Move *)\nlemma subset_if_pointwise_le:\n  \"\\<lbrakk>M\\<rbrakk> \\<subseteq> \\<lbrakk>M'\\<rbrakk>\" if \"pointwise_cmp (\\<le>) n M M'\"\n  using that by (simp add: DBM.less_eq DBM_le_subset pointwise_cmp_def subsetI)\n\ntheorem dbm_subset_fed_check_correct:\n  fixes xs :: \"(nat \\<Rightarrow> nat \\<Rightarrow> ('t ::time) DBMEntry) list\"\n    and S :: \"(nat \\<Rightarrow> nat \\<Rightarrow> 't DBMEntry) list\"\n  assumes \"canonical' n M\"\n  shows \"\\<lbrakk>M\\<rbrakk> \\<subseteq> (\\<Union>m\\<in>set xs. \\<lbrakk>m\\<rbrakk>) \\<longleftrightarrow> dbm_subset_fed_check n M xs\"\nproof -\n  define xs' where \"xs' = filter (\\<lambda>M. \\<not> check_diag n (uncurry M)) xs\"\n  define is_direct_subset where\n    \"is_direct_subset = list_ex (\\<lambda> M'. dbm_subset' n (uncurry M) (uncurry M')) xs'\"\n  have \"\\<lbrakk>M\\<rbrakk> \\<subseteq> (\\<Union>m\\<in>set xs. \\<lbrakk>m\\<rbrakk>)\" if is_direct_subset\n  proof -\n    from that have \"\\<exists>m \\<in> set xs'. \\<lbrakk>M\\<rbrakk> \\<subseteq> \\<lbrakk>m\\<rbrakk>\"\n      unfolding is_direct_subset_def list_ex_iff dbm_subset'_def\n      by (auto intro!: subset_if_pointwise_le)\n    then show ?thesis\n      unfolding xs'_def by auto\n  qed\n  then show ?thesis\n    apply (cases is_direct_subset; simp add:\n        dbm_subset_fed_check_def is_direct_subset_def dbm_subset_fed_def xs'_def[symmetric]\n        )\n    unfolding dbm_subset_fed_correct[\n        OF \\<open>canonical' n M\\<close>, of xs, unfolded Let_def dbm_subset_fed_def, folded xs'_def, symmetric\n        ]\n    unfolding dbm_subset_fed_correct'[\n        OF \\<open>canonical' n M\\<close>, of xs, folded xs'_def, unfolded Let_def, symmetric\n        ]\n    ..\nqed\n\nend (* Default Clock Numbering *)\n\n\nsubsection \\<open>Refined DBM operations\\<close>\n\n(* This is the odd one out *)\ndefinition\n  \"V_dbm = (\\<lambda> i j. if i = j then 0 else if i = 0 \\<and> j > 0 then 0 else \\<infinity>)\"\n\ndefinition and_entry_upd ::\n  \"nat \\<Rightarrow> nat \\<Rightarrow> int DBMEntry \\<Rightarrow> int DBM' \\<Rightarrow> int DBM'\" where\n  \"and_entry_upd a b e M = M((a,b) := min (M (a, b)) e)\"\n\ndefinition\n  \"and_entry_repair_upd n a b e M \\<equiv>\n   Normalized_Zone_Semantics_Impl_Semantic_Refinement.repair_pair n (and_entry_upd a b e M) a b\"\n\ndefinition\n  \"dbm_minus_canonical_upd n xs m =\n  concat (map (\\<lambda>(i, j). map (\\<lambda> M. and_entry_repair_upd n j i (neg_dbm_entry (m (i, j))) M) xs)\n    [(i, j). i\\<leftarrow>[0..<Suc n], j\\<leftarrow>[0..<Suc n], (i > 0 \\<or> j > 0) \\<and> i \\<le> n \\<and> j \\<le> n \\<and> m (i, j) \\<noteq> \\<infinity>])\"\n\ndefinition\n  \"dbm_minus_canonical_check_upd n xs M =\n  filter (\\<lambda>M. \\<not> check_diag n M) (dbm_minus_canonical_upd n xs M)\"\n\ndefinition\n  \"dbm_subset_fed_upd n M xs \\<equiv>\n   let xs = filter (\\<lambda>M. \\<not> check_diag n M) xs;\n       is_direct_subset = list_ex (\\<lambda>M'. dbm_subset' n M M') xs\n   in is_direct_subset \\<or>\n     list_all (\\<lambda> M. check_diag n M) (fold (\\<lambda>m S. dbm_minus_canonical_check_upd n S m) xs [M])\"\n\n(* XXX Move? *)\nlemma list_all_filter_neg:\n  \"list_all P (filter (\\<lambda>x. \\<not> P x) xs) \\<longleftrightarrow> (filter (\\<lambda>x. \\<not> P x) xs) = []\"\n  by (metis Cons_eq_filterD list_all_simps(2) list_pred_cases)\n\nlemma dbm_subset_fed_upd_alt_def:\n  \"dbm_subset_fed_upd n M xs \\<equiv>\n   let xs = filter (\\<lambda>M. \\<not> check_diag n M) xs\n   in if xs = [] then check_diag n M\n      else if list_ex (\\<lambda>M'. dbm_subset' n M M') xs then True\n      else fold (\\<lambda>m S. dbm_minus_canonical_check_upd n S m) xs [M] = []\"\n  unfolding dbm_subset_fed_upd_def short_circuit_conv using list_last\n  by (intro eq_reflection;force simp: list_all_filter_neg dbm_minus_canonical_check_upd_def Let_def)\n\ndefinition\n  \"V_dbm' n = (\\<lambda>(i, j). (if i = j \\<or> i = 0 \\<and> j > 0 \\<or> i > n \\<or> j > n then 0 else \\<infinity>))\"\n\ndefinition\n  down_upd :: \"nat \\<Rightarrow> _ DBM' \\<Rightarrow> _ DBM'\"\nwhere\n  \"down_upd n M \\<equiv> \\<lambda>(i, j).\n  if i = 0 \\<and> j > 0 \\<and> i \\<le> n \\<and> j \\<le> n then Min ({Le 0} \\<union> {M (k, j) | k. 1 \\<le> k \\<and> k \\<le> n}) else M (i, j)\"\n\ndefinition\n  \"restrict_zero_upd n M x \\<equiv>\n    let\n      M1 = and_entry_upd x 0 (Le 0) M;\n      M2 = and_entry_upd 0 x (Le 0) M1\n    in Normalized_Zone_Semantics_Impl_Semantic_Refinement.repair_pair n M2 x 0\"\n\ndefinition\n  free_upd :: \"nat \\<Rightarrow> _ DBM' \\<Rightarrow> nat \\<Rightarrow> _ DBM'\"\nwhere\n  \"free_upd n M x \\<equiv>\n   \\<lambda> (i, j). if i = x \\<and> j \\<noteq> x \\<and> i \\<le> n \\<and> j \\<le> n\n    then \\<infinity> else if i \\<noteq> x \\<and> j = x \\<and> i \\<le> n \\<and> j \\<le> n then M (i, 0) else M (i, j)\"\n\ndefinition\n  \"pre_reset_upd n M x \\<equiv> free_upd n (restrict_zero_upd n M x) x\"\n\ndefinition\n  \"pre_reset_list_upd n M r \\<equiv> fold (\\<lambda> x M. pre_reset_upd n M x) r M\"\n\n\nsubsection \\<open>Transferring properties\\<close>\n\ncontext\n  includes lifting_syntax\nbegin\n\nlemma neg_dbm_entry_transfer[transfer_rule]:\n  \"(rel_DBMEntry ri ===> rel_DBMEntry ri) neg_dbm_entry neg_dbm_entry\"\n  by (auto elim!: DBMEntry.rel_cases intro!: rel_funI)\n\nlemma fold_min_transfer:\n  \"((list_all2 (rel_DBMEntry ri)) ===> rel_DBMEntry ri ===> rel_DBMEntry ri) (fold min) (fold min)\"\n  by transfer_prover\n\ncontext\n  fixes n :: nat\nbegin\n\ndefinition\n  \"RI2 M D \\<equiv> RI n (uncurry M) D\"\n\nlemma and_entry_transfer[transfer_rule]:\n  \"((=) ===> (=) ===> rel_DBMEntry ri ===> RI2 ===> RI2) and_entry and_entry_upd\"\n  unfolding and_entry_def and_entry_upd_def\n  unfolding rel_fun_def eq_onp_def RI2_def\n  by (auto intro: min_ri_transfer[unfolded rel_fun_def, rule_format])\n\nlemma FWI_transfer[transfer_rule]:\n  \"(RI2 ===> eq_onp (\\<lambda>x. x = n) ===> eq_onp (\\<lambda>x. x < Suc n) ===> RI2) FWI FWI'\" (is \"?A\")\nand FW_transfer[transfer_rule]:\n  \"(RI2 ===> eq_onp (\\<lambda>x. x = n) ===> RI2) FW FW'\" (is \"?B\")\nproof -\n  define RI' where\n    \"RI' = (eq_onp (\\<lambda> x. x < Suc n) ===> eq_onp (\\<lambda> x. x < Suc n) ===> rel_DBMEntry ri)\"\n  have RI_iff: \"RI' M M' \\<longleftrightarrow> RI n (uncurry M) (uncurry M')\" for M M'\n    unfolding RI'_def rel_fun_def by auto\n  { fix M D k assume \"RI n (uncurry M) D\" \"k < Suc n\"\n    then have \"RI' M (curry D)\"\n      by (simp add: RI_iff)\n    with \\<open>k < Suc n\\<close> have \"RI' (FWI M n k) (FWI (curry D) n k)\"\n      unfolding FWI_def\n      by (intro fwi_RI_transfer[of n, folded RI'_def, unfolded rel_fun_def, rule_format])\n        (auto simp: eq_onp_def)\n    then have \"RI n (uncurry (FWI M n k)) (uncurry (FWI (curry D) n k))\"\n      by (simp add: RI_iff)\n  } note * = this\n  show ?A\n    unfolding FWI'_def\n    unfolding rel_fun_def\n    unfolding RI2_def\n    apply clarsimp\n    apply (subst (asm) (3) eq_onp_def)\n    apply (subst (asm) (3) eq_onp_def)\n    apply clarsimp\n    by (intro *)\n  { fix M D assume \"RI n (uncurry M) D\"\n    then have \"RI' M (curry D)\"\n      by (simp add: RI_iff)\n    then have \"RI' (FW M n) (FW (curry D) n)\"\n      by (intro FW_RI_transfer[of n, folded RI'_def, unfolded rel_fun_def, rule_format])\n         (auto simp: eq_onp_def)\n    then have \"RI n (uncurry (FW M n)) (FW' D n)\"\n      by (simp add: RI_iff FW'_def)\n  } note * = this\n  show ?B\n    unfolding rel_fun_def\n    unfolding RI2_def\n    apply clarsimp\n    apply (subst (asm) (3) eq_onp_def)\n    apply clarsimp\n    by (intro *)\nqed\n\nlemma repair_pair_transfer[transfer_rule]:\n  \"(eq_onp (\\<lambda>x. x = n) ===> RI2 ===> eq_onp (\\<lambda>x. x < Suc n) ===> eq_onp (\\<lambda>x. x < Suc n) ===> RI2)\n    repair_pair Normalized_Zone_Semantics_Impl_Semantic_Refinement.repair_pair\"\n  unfolding repair_pair_def Normalized_Zone_Semantics_Impl_Semantic_Refinement.repair_pair_def\n  by transfer_prover\n\nlemma and_entry_transfer_weak:\n  \"(eq_onp (\\<lambda>x. x < Suc n) ===> eq_onp (\\<lambda>x. x < Suc n) ===> rel_DBMEntry ri ===> RI2 ===> RI2)\n    and_entry and_entry_upd\"\n  using and_entry_transfer unfolding rel_fun_def eq_onp_def by auto\n\nlemma and_entry_repair_transfer[transfer_rule]:\n  \"(eq_onp (\\<lambda>x. x = n) ===> eq_onp (\\<lambda>x. x < Suc n) ===> eq_onp (\\<lambda>x. x < Suc n) ===> rel_DBMEntry ri\n    ===> RI2 ===> RI2) and_entry_repair and_entry_repair_upd\n  \"\n  supply [transfer_rule] = and_entry_transfer_weak\n  unfolding and_entry_repair_def and_entry_repair_upd_def by transfer_prover\n\nlemma dbm_minus_canonical_transfer[transfer_rule]:\n  \"(eq_onp (\\<lambda>x. x = n) ===> list_all2 RI2 ===> RI2 ===> list_all2 RI2)\n    dbm_minus_canonical dbm_minus_canonical_upd\n  \"\n  unfolding dbm_minus_canonical_def dbm_minus_canonical_upd_def\n  apply (intro rel_funI)\n  apply (rule concat_transfer[unfolded rel_fun_def, rule_format])\n  apply (rule list.map_transfer[unfolded rel_fun_def, rule_format,\n        where Rb = \"rel_prod (eq_onp (\\<lambda>x. x < Suc n)) (eq_onp (\\<lambda>x. x < Suc n))\"])\n   apply clarsimp\n  subgoal\n    apply (rule list_all2_mapI)\n    apply (erule list_all2_mono)\n    apply (rule and_entry_repair_transfer[unfolded rel_fun_def, rule_format])\n        apply assumption+\n    subgoal\n      unfolding RI2_def rel_fun_def\n      by (auto intro: neg_dbm_entry_transfer[unfolded rel_fun_def, rule_format])\n    apply assumption\n    done\n  subgoal premises prems for n1 n2 xs ys M D\n  proof -\n    have [simp]: \"D (i, j) \\<noteq> \\<infinity> \\<longleftrightarrow> M i j \\<noteq> \\<infinity>\" if \"i < Suc n\" \"j < Suc n\" for i j\n      using prems that by (auto 4 3 simp: eq_onp_def rel_fun_def RI2_def elim!: DBMEntry.rel_cases)\n    from prems have [simp]: \"n1 = n\" \"n2 = n\"\n      by (auto simp: eq_onp_def)\n    let ?a = \"(concat\n       (map (\\<lambda>i. concat\n                   (map (\\<lambda>j. if (0 < i \\<or> 0 < j) \\<and>\n                                 i \\<le> n \\<and> j \\<le> n \\<and> M i j \\<noteq> \\<infinity>\n                              then [(i, j)] else [])\n                     [0..<Suc n]))\n         [0..<Suc n]))\"\n    let ?b = \"(concat\n       (map (\\<lambda>i. concat\n                   (map (\\<lambda>j. if (0 < i \\<or> 0 < j) \\<and>\n                                 i \\<le> n \\<and> j \\<le> n \\<and> D (i, j) \\<noteq> \\<infinity>\n                              then [(i, j)] else [])\n                     [0..<Suc n]))\n         [0..<Suc n]))\"\n    have \"?b = ?a\"\n      by (auto intro!: arg_cong[where f = concat] simp del: upt_Suc)\n    then show ?thesis\n      by (simp del: upt_Suc add: list_all2_same eq_onp_def)\n  qed\n  done\n\nlemma check_diag_transfer[transfer_rule]:\n  \"(eq_onp (\\<lambda>x. x = n) ===> RI2 ===> (=)) (\\<lambda>n M. check_diag n (uncurry M)) check_diag\"\n  unfolding RI2_def rel_fun_def check_diag_def\n  by (auto 0 5 dest: neutral_RI simp: eq_onp_def less_Suc_eq_le neutral[symmetric])\n\nlemma dbm_minus_canonical_check_transfer[transfer_rule]:\n  \"(eq_onp (\\<lambda>x. x = n) ===> list_all2 RI2 ===> RI2 ===> list_all2 RI2)\n    dbm_minus_canonical_check dbm_minus_canonical_check_upd\n  \"\n  unfolding dbm_minus_canonical_check_def dbm_minus_canonical_check_upd_def by transfer_prover\n\n(* XXX Move *)\nlemma le_rel_DBMEntry_iff:\n  \"a \\<le> b \\<longleftrightarrow> x \\<le> y\" if \"rel_DBMEntry ri a x\" \"rel_DBMEntry ri b y\"\n  using that by (auto elim!: DBMEntry.rel_cases simp: dbm_entry_simps ri_def)\n\nlemma dbm_subset'_transfer[transfer_rule]:\n  \"(eq_onp (\\<lambda>x. x = n) ===> RI2 ===> RI2 ===> (=))\n    (\\<lambda> n M M'. dbm_subset' n (uncurry M) (uncurry M')) dbm_subset'\"\n  unfolding RI2_def rel_fun_def dbm_subset'_def\n  using le_rel_DBMEntry_iff by (clarsimp simp: eq_onp_def pointwise_cmp_def less_Suc_eq_le) meson\n\nlemma dbm_subset_fed_transfer:\n  \"(eq_onp (\\<lambda>x. x = n) ===> RI2 ===> list_all2 RI2 ===> (=)) dbm_subset_fed_check dbm_subset_fed_upd\"\n  unfolding dbm_subset_fed_check_def dbm_subset_fed_upd_def by transfer_prover\n\nlemma V_dbm_transfer[transfer_rule]:\n  \"RI2 V_dbm (V_dbm' n)\"\n  unfolding V_dbm_def V_dbm'_def RI2_def by (auto simp: rel_fun_def neutral eq_onp_def zero_RI)\n\nlemma down_transfer[transfer_rule]:\n  \"(eq_onp (\\<lambda>x. x = n) ===> RI2 ===> RI2) down down_upd\"\n  unfolding down_def down_upd_def\nproof (clarsimp simp: rel_fun_def RI2_def eq_onp_def, goal_cases)\n  case prems: (1 M D x)\n  have A: \"(insert (Le 0) {M k x |k. Suc 0 \\<le> k \\<and> k \\<le> n})\n      = (set (Le 0 # [M k x. k \\<leftarrow> [1..<Suc n]]))\"\n    by auto\n  have B: \"insert (Le 0) {D (k, x) |k. Suc 0 \\<le> k \\<and> k \\<le> n} \n      = (set (Le 0 # [D (k, x). k \\<leftarrow> [1..<Suc n]]))\"\n    by auto\n  show ?case\n    unfolding A B Min.set_eq_fold\n    apply (rule fold_min_transfer[unfolded rel_fun_def, rule_format])\n    unfolding list.rel_map list_all2_same using prems by (auto simp: zero_RI)\nqed\n\nlemma free_upd[transfer_rule]:\n  \"(eq_onp (\\<lambda>x. x = n) ===> RI2 ===> (=) ===> RI2) free free_upd\"\n  unfolding free_def free_upd_def by (auto simp: RI2_def rel_fun_def eq_onp_def)\n\nlemma pre_reset_transfer[transfer_rule]:\n  \"(eq_onp (\\<lambda>x. x = n) ===> RI2 ===> eq_onp (\\<lambda>x. x < Suc n) ===> RI2) pre_reset pre_reset_upd\"\nproof -\n  have [transfer_rule]: \"eq_onp (\\<lambda>x. x = n) n n\"\n    by (simp add: eq_onp_def)\n  note [transfer_rule] = and_entry_transfer_weak\n  have [transfer_rule]:\n    \"(eq_onp (\\<lambda>x. x = n) ===> RI2 ===> eq_onp (\\<lambda>x. x < Suc n) ===> RI2) free free_upd\"\n    using free_upd unfolding rel_fun_def eq_onp_def by blast\n  show ?thesis\n    unfolding pre_reset_def pre_reset_upd_def\n    unfolding restrict_zero_def restrict_zero_upd_def\n    by transfer_prover\nqed\n\nlemma pre_reset_list_transfer[transfer_rule]:\n  \"(eq_onp (\\<lambda>x. x = n) ===> RI2 ===> list_all2 (eq_onp (\\<lambda>x. x < Suc n)) ===> RI2)\n    pre_reset_list pre_reset_list_upd\"\n  unfolding pre_reset_list_def pre_reset_list_upd_def by transfer_prover\n\nend (* Fixed n *)\nend (* Lifting Syntax *)\n\n(* Unused *)\ndefinition\n  \"unbounded_dbm \\<equiv> \\<lambda> i j. if i = j then 0 else \\<infinity>\"\n\nlemma canonical_unbounded_dbm:\n  \"canonical unbounded_dbm n\"\n  by (auto simp: unbounded_dbm_def any_le_inf)\n\nlemma diag_unbounded_dbm:\n  \"unbounded_dbm i i = 0\"\n  unfolding unbounded_dbm_def by simp\n\nlemma down_diag:\n  \"down n M i i = M i i\"\n  unfolding down_def by auto\n\ndefinition\n  \"abstr_FW n cc M v \\<equiv> FW (abstr cc M v) n\"\n\ndefinition\n  \"abstr_FW_upd n cc M \\<equiv> FW' (abstr_upd cc M) n\"\n\nlemma abstr_mono:\n  \"abstr cc M v i j \\<le> M i j\"\n  by (subst abstr.simps, induction cc arbitrary: M) (auto intro: order.trans abstra_mono)\n\nlemma abstr_FW_mono:\n  \"abstr_FW n cc M v i j \\<le> M i j\" if \"i \\<le> n\" \"j \\<le> n\"\n  unfolding abstr_FW_def by (blast intro: that abstr_mono fw_mono order.trans)\n\nlemma abstr_FW_diag_preservation:\n  \"\\<forall>k\\<le>n. abstr_FW n cc M v k k \\<le> 0\" if \"\\<forall>k\\<le>n. M k k \\<le> 0\"\n  using that by (blast intro: abstr_FW_mono order.trans)\n\nlemma FW_canonical:\n  \"canonical' n (FW M n)\"\n  unfolding canonical'_def using FW_canonical[of n M] by (simp add: check_diag_def neutral)\n\nlemma abstr_FW_canonical:\n  \"canonical' n (abstr_FW n cc M v)\"\n  unfolding abstr_FW_def by (rule FW_canonical)\n\nlemma down_check_diag:\n  \"check_diag n (uncurry (down n M))\" if \"check_diag n (uncurry M)\"\n  using that unfolding check_diag_def down_def by force\n\ncontext Default_Nat_Clock_Numbering\nbegin\n\nlemma clock_numbering:\n  \"\\<forall> c. v c > 0 \\<and> (\\<forall>x. \\<forall>y. v x \\<le> n \\<and> v y \\<le> n \\<and> v x = v y \\<longrightarrow> x = y)\"\n  by (metis neq0_conv v_0 v_id)\n\nlemma V_dbm_correct:\n  \"\\<lbrakk>V_dbm\\<rbrakk> = V\"\n  unfolding V_def DBM_zone_repr_def DBM_val_bounded_alt_def2 \n  by (auto simp: dbm_entry_val'_iff_bounded V_dbm_def dbm_entry_simps neutral)\n\nlemma abstr_correct:\n  \"\\<lbrakk>abstr cc M v\\<rbrakk> = \\<lbrakk>M\\<rbrakk> \\<inter> {u. u \\<turnstile> cc}\" if \"\\<forall>c\\<in>collect_clks cc. 0 < c \\<and> c \\<le> n\"\n  apply (rule dbm_abstr_zone_eq2)\n  subgoal\n    by (rule clock_numbering)\n  subgoal\n    using that by (auto simp: v_is_id)\n  done\n\n(* Unused *)\nlemma unbounded_dbm_correct:\n  \"\\<lbrakk>unbounded_dbm\\<rbrakk> = UNIV\"\n  unfolding DBM_zone_repr_def DBM_val_bounded_alt_def2 unbounded_dbm_def neutral\n  by (simp add: dbm_entry_val'_iff_bounded any_le_inf)\n\n(* Unused *)\nlemma abstr_correct':\n  \"\\<lbrakk>abstr cc unbounded_dbm v\\<rbrakk> = {u. u \\<turnstile> cc}\" if \"\\<forall>c\\<in>collect_clks cc. 0 < c \\<and> c \\<le> n\"\n  by (simp add: unbounded_dbm_correct abstr_correct[OF that] del: abstr.simps)\n\nlemma abstr_FW_correct:\n  \"\\<lbrakk>abstr_FW n cc M v\\<rbrakk> = \\<lbrakk>M\\<rbrakk> \\<inter> {u. u \\<turnstile> cc}\" if \"\\<forall>c\\<in>collect_clks cc. 0 < c \\<and> c \\<le> n\"\n  unfolding abstr_FW_def by (subst FW_zone_equiv[symmetric]; intro surj_on abstr_correct that)\n\nlemma abstr_FW_correct':\n  \"\\<lbrakk>abstr_FW n cc unbounded_dbm v\\<rbrakk> = {u. u \\<turnstile> cc}\" if \"\\<forall>c\\<in>collect_clks cc. 0 < c \\<and> c \\<le> n\"\n  by (simp add: unbounded_dbm_correct abstr_FW_correct[OF that])\n\nlemma down_V:\n  \"\\<lbrakk>down n M\\<rbrakk> \\<subseteq> V\"\n  by (rule V_structuralI) (auto simp: down_def neutral intro: Min_le)\n\nlemma down_correct':\n  \"\\<lbrakk>down n M\\<rbrakk> = \\<lbrakk>M\\<rbrakk>\\<^sup>\\<down> \\<inter> V\" if \"canonical M n\"\n  apply safe\n  subgoal for u\n    by (erule down_sound, rule that)\n  subgoal for u\n    using down_V by blast\n  subgoal for u\n    unfolding V_def by (erule down_complete) simp\n  done\n\nlemma down_correct:\n  \"\\<lbrakk>down n M\\<rbrakk> = \\<lbrakk>M\\<rbrakk>\\<^sup>\\<down> \\<inter> V\" if \"canonical' n M\"\n  using that unfolding canonical'_def\n  apply standard\n  subgoal\n    by (rule down_correct')\n  by (frule down_check_diag) (simp add: check_diag_empty zone_time_pre_def)\n\nlemma pre_reset_diag_preservation:\n  \"pre_reset n M x i i \\<le> M i i\" if \"i \\<le> n\"\n  unfolding pre_reset_def by (auto simp add: free_diag restrict_zero_mono that)\n\nlemma pre_reset_list_diag:\n  \"pre_reset_list n M r i i \\<le> M i i\" if \"i \\<le> n\"\n  apply (induction r arbitrary: M)\n   apply (simp add: pre_reset_list_def; fail)\n  apply (simp add: pre_reset_list_Cons, blast intro: pre_reset_diag_preservation that order.trans)\n  done\n\ncontext\n  includes lifting_syntax\nbegin\n\nlemma abstra_upd_abstra:\n  \"abstra_upd ac M (i, j) = abstra ac (curry M) v i j\" if \"0 < constraint_clk ac\" \"i \\<le> n\" \"j \\<le> n\"\n  using that by (cases ac) (auto simp: le_n_iff v_is_id v_0)\n\nlemma abstra_transfer[transfer_rule]:\n  \"(rel_acconstraint (eq_onp (\\<lambda> x. 0 < x \\<and> x < Suc n)) ri ===> RI2 n ===> RI2 n)\n    (\\<lambda> cc M. abstra cc M v) abstra_upd\"\n  apply (intro rel_funI)\n  apply (subst RI2_def)\n  apply (intro rel_funI)\n  apply (elim rel_prod.cases)\n  apply (simp only:)\n  apply (subst abstra_upd_abstra)\n  by (auto 4 3 simp: eq_onp_def RI2_def rel_fun_def\n       intro!: min_ri_transfer[unfolded rel_fun_def, rule_format]\n       elim!: acconstraint.rel_cases\n     )\n\nlemma abstr_transfer[transfer_rule]:\n  \"(list_all2 (rel_acconstraint (eq_onp (\\<lambda> x. 0 < x \\<and> x < Suc n)) ri) ===> RI2 n ===> RI2 n)\n    (\\<lambda> cc M. abstr cc M v) abstr_upd\"\n  unfolding abstr.simps abstr_upd_def by transfer_prover\n\nlemma abstr_FW_transfer[transfer_rule]:\n  \"(list_all2 (rel_acconstraint (eq_onp (\\<lambda> x. 0 < x \\<and> x < Suc n)) ri) ===> RI2 n ===> RI2 n)\n    (\\<lambda> cc M. abstr_FW n cc M v) (abstr_FW_upd n)\"\nproof -\n  have [transfer_rule]: \"eq_onp (\\<lambda>x. x = n) n n\"\n    by (simp add: eq_onp_def)\n  show ?thesis\n    unfolding abstr_FW_def abstr_FW_upd_def by transfer_prover\nqed\n\nend\n\nend\n\nlemma RI2_trivial_transfer[transfer_rule]: \"(RI2 n) (curry (conv_M M)) M\"\n  unfolding RI2_def rel_fun_def by (auto simp: eq_onp_def)\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Deadlock/Deadlock.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.33565989834193494}}
{"text": "(*  Title:      HOL/MicroJava/BV/JVM.thy\n\n    Author:     Tobias Nipkow, Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nheader {* \\isaheader{Kildall for the JVM}\\label{sec:JVM} *}\n\ntheory BVExec\nimports \"../DFA/Abstract_BV\" TF_JVM\nbegin\n\ndefinition kiljvm :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> \n             instr list \\<Rightarrow> ex_table \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> ty\\<^sub>i' err list\"\nwhere\n  \"kiljvm P mxs mxl T\\<^sub>r is xt \\<equiv>\n  kildall (JVM_SemiType.le P mxs mxl) (JVM_SemiType.sup P mxs mxl) \n          (exec P mxs T\\<^sub>r xt is)\"\n\ndefinition wt_kildall :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n                 instr list \\<Rightarrow> ex_table \\<Rightarrow> bool\"\nwhere\n  \"wt_kildall P C' Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<equiv>\n   0 < size is \\<and> \n   (let first  = Some ([],[OK (Class C')]@(map OK Ts)@(replicate mxl\\<^sub>0 Err));\n        start  = OK first#(replicate (size is - 1) (OK None));\n        result = kiljvm P mxs (1+size Ts+mxl\\<^sub>0) T\\<^sub>r is xt  start\n    in \\<forall>n < size is. result!n \\<noteq> Err)\"\n\ndefinition wf_jvm_prog\\<^sub>k :: \"jvm_prog \\<Rightarrow> bool\"\nwhere\n  \"wf_jvm_prog\\<^sub>k P \\<equiv>\n  wf_prog (\\<lambda>P C' (M,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). wt_kildall P C' Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt) P\"\n\n\ntheorem (in start_context) is_bcv_kiljvm:\n  \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n(*<*)\n  apply (insert wf)\n  apply (unfold kiljvm_def)\n  apply (fold r_def f_def step_def_exec)\n  apply (rule is_bcv_kildall)\n       apply simp apply (rule Semilat.intro)\n       apply (fold sl_def2)\n       apply (erule semilat_JVM)\n      apply simp\n      apply blast\n     apply (simp add: JVM_le_unfold)\n    apply (rule exec_pres_type)\n   apply (rule bounded_step)\n  apply (erule step_mono)\n  done\n(*>*)\n\n(* FIXME: move? *)\nlemma subset_replicate [intro?]: \"set (replicate n x) \\<subseteq> {x}\"\n  by (induct n) auto\n\nlemma in_set_replicate:\n  assumes \"x \\<in> set (replicate n y)\"\n  shows \"x = y\"\n(*<*)\nproof -\n  note assms\n  also have \"set (replicate n y) \\<subseteq> {y}\" ..\n  finally show ?thesis by simp\nqed\n(*>*)\n\nlemma (in start_context) start_in_A [intro?]:\n  \"0 < size is \\<Longrightarrow> start \\<in> list (size is) A\"\n  using Ts C\n(*<*)\n  apply (simp add: JVM_states_unfold) \n  apply (force intro!: listI list_appendI dest!: in_set_replicate)\n  done   \n(*>*)\n\n\ntheorem (in start_context) wt_kil_correct:\n  assumes wtk: \"wt_kildall P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n  shows \"\\<exists>\\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n(*<*)\nproof -\n  from wtk obtain res where    \n    result:   \"res = kiljvm P mxs mxl T\\<^sub>r is xt start\" and\n    success:  \"\\<forall>n < size is. res!n \\<noteq> Err\" and\n    instrs:   \"0 < size is\" \n    by (unfold wt_kildall_def) simp\n      \n  have bcv: \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n    by (rule is_bcv_kiljvm)\n    \n  from instrs have \"start \\<in> list (size is) A\" ..\n  with bcv success result have \n    \"\\<exists>ts\\<in>list (size is) A. start [\\<sqsubseteq>\\<^sub>r] ts \\<and> wt_step r Err step ts\"\n    by (unfold is_bcv_def) blast\n  then obtain \\<tau>s' where\n    in_A: \"\\<tau>s' \\<in> list (size is) A\" and\n    s:    \"start [\\<sqsubseteq>\\<^sub>r] \\<tau>s'\" and\n    w:    \"wt_step r Err step \\<tau>s'\"\n    by blast\n  hence wt_err_step: \"wt_err_step (sup_state_opt P) step \\<tau>s'\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n\n  from in_A have l: \"size \\<tau>s' = size is\" by simp  \n  moreover {\n    from in_A  have \"check_types P mxs mxl \\<tau>s'\" by (simp add: check_types_def)\n    also from w have \"\\<forall>x \\<in> set \\<tau>s'. x \\<noteq> Err\" \n      by (auto simp add: wt_step_def all_set_conv_all_nth)\n    hence [symmetric]: \"map OK (map ok_val \\<tau>s') = \\<tau>s'\" \n      by (auto intro!: map_idI simp add: wt_step_def)\n    finally  have \"check_types P mxs mxl (map OK (map ok_val \\<tau>s'))\" .\n  } \n  moreover {  \n    from s have \"start!0 \\<sqsubseteq>\\<^sub>r \\<tau>s'!0\" by (rule le_listD) simp\n    moreover\n    from instrs w l \n    have \"\\<tau>s'!0 \\<noteq> Err\" by (unfold wt_step_def) simp\n    then obtain \\<tau>s0 where \"\\<tau>s'!0 = OK \\<tau>s0\" by auto\n    ultimately\n    have \"wt_start P C Ts mxl\\<^sub>0 (map ok_val \\<tau>s')\" using l instrs\n      by (unfold wt_start_def) \n         (simp add: lesub_def JVM_le_Err_conv Err.le_def)\n  }\n  moreover \n  from in_A have \"set \\<tau>s' \\<subseteq> A\" by simp  \n  with wt_err_step bounded_step\n  have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\<tau>s')\"\n    by (auto intro: wt_err_imp_wt_app_eff simp add: l)\n  ultimately\n  have \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\<tau>s')\"\n    using instrs by (simp add: wt_method_def2 check_types_def del: map_map)\n  thus ?thesis by blast\nqed\n(*>*)\n\n\ntheorem (in start_context) wt_kil_complete:\n  assumes wtm: \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n  shows \"wt_kildall P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n(*<*)\nproof -\n  from wtm obtain\n    instrs:   \"0 < size is\" and\n    length:   \"length \\<tau>s = length is\" and \n    ck_type:  \"check_types P mxs mxl (map OK \\<tau>s)\" and\n    wt_start: \"wt_start P C Ts mxl\\<^sub>0 \\<tau>s\" and\n    app_eff:  \"wt_app_eff (sup_state_opt P) app eff \\<tau>s\"\n    by (simp add: wt_method_def2 check_types_def)\n\n  from ck_type\n  have in_A: \"set (map OK \\<tau>s) \\<subseteq> A\" \n    by (simp add: check_types_def)  \n  with app_eff in_A bounded_step\n  have \"wt_err_step (sup_state_opt P) (err_step (size \\<tau>s) app eff) (map OK \\<tau>s)\"\n    by - (erule wt_app_eff_imp_wt_err,\n          auto simp add: exec_def length states_def)\n  hence wt_err: \"wt_err_step (sup_state_opt P) step (map OK \\<tau>s)\" \n    by (simp add: length)\n  have is_bcv: \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n    by (rule is_bcv_kiljvm)\n  moreover from instrs have \"start \\<in> list (size is) A\" ..\n  moreover\n  let ?\\<tau>s = \"map OK \\<tau>s\"  \n  have less_\\<tau>s: \"start [\\<sqsubseteq>\\<^sub>r] ?\\<tau>s\"\n  proof (rule le_listI)\n    from length instrs\n    show \"length start = length (map OK \\<tau>s)\" by simp\n  next\n    fix n\n    from wt_start have \"P \\<turnstile> ok_val (start!0) \\<le>' \\<tau>s!0\" \n      by (simp add: wt_start_def)\n    moreover from instrs length have \"0 < length \\<tau>s\" by simp\n    ultimately have \"start!0 \\<sqsubseteq>\\<^sub>r ?\\<tau>s!0\" \n      by (simp add: JVM_le_Err_conv lesub_def)\n    moreover {\n      fix n'\n      have \"OK None \\<sqsubseteq>\\<^sub>r ?\\<tau>s!n\"\n        by (auto simp add: JVM_le_Err_conv Err.le_def lesub_def \n                 split: err.splits)\n      hence \"\\<lbrakk>n = Suc n'; n < size start\\<rbrakk> \\<Longrightarrow> start!n \\<sqsubseteq>\\<^sub>r ?\\<tau>s!n\" by simp\n    }\n    ultimately\n    show \"n < size start \\<Longrightarrow> start!n \\<sqsubseteq>\\<^sub>r ?\\<tau>s!n\" by (cases n, blast+)   \n  qed\n  moreover\n  from ck_type length\n  have \"?\\<tau>s \\<in> list (size is) A\"\n    by (auto intro!: listI simp add: check_types_def)\n  moreover\n  from wt_err have \"wt_step r Err step ?\\<tau>s\" \n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  ultimately\n  have \"\\<forall>p. p < size is \\<longrightarrow> kiljvm P  mxs mxl T\\<^sub>r is xt start ! p \\<noteq> Err\" \n    by (unfold is_bcv_def) blast\n  with instrs \n  show \"wt_kildall P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\" by (unfold wt_kildall_def) simp\nqed\n(*>*)\n\n\ntheorem jvm_kildall_correct:\n  \"wf_jvm_prog\\<^sub>k P = wf_jvm_prog P\"\n(*<*)\nproof \n  let ?\\<Phi> = \"\\<lambda>C M. let (C,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)) = method P C M in \n              SOME \\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n\n  -- \"soundness\"\n  assume wt: \"wf_jvm_prog\\<^sub>k P\"\n  hence \"wf_jvm_prog\\<^bsub>?\\<Phi>\\<^esub> P\"\n    apply (unfold wf_jvm_prog_phi_def wf_jvm_prog\\<^sub>k_def)    \n    apply (erule wf_prog_lift)\n    apply (auto dest!: start_context.wt_kil_correct [OF start_context.intro] \n                intro: someI)\n    apply (erule sees_method_is_class)\n    done\n  thus \"wf_jvm_prog P\" by (unfold wf_jvm_prog_def) fast\nnext\n  -- \"completeness\"\n  assume wt: \"wf_jvm_prog P\"\n  thus \"wf_jvm_prog\\<^sub>k P\"\n    apply (unfold wf_jvm_prog_def wf_jvm_prog_phi_def wf_jvm_prog\\<^sub>k_def)\n    apply (clarify)\n    apply (erule wf_prog_lift)\n    apply (auto intro!: start_context.wt_kil_complete start_context.intro)\n    apply (erule sees_method_is_class)\n    done\nqed\n(*>*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/BV/BVExec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7341195269001831, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.33559299028610345}}
{"text": "(*  Title:      Graph_path.thy\n    Author:     Sebastian Ullrich\n*)\n\nsection \\<open>SSA Representation\\<close>\n\nsubsection \\<open>Inductive Graph Paths\\<close>\n\ntext \\<open>We extend the Graph framework with inductively defined paths.\n  We adopt the convention of separating locale definitions into assumption-less base locales.\\<close>\n\ntheory Graph_path imports\n  FormalSSA_Misc\n  Dijkstra_Shortest_Path.GraphSpec\n  CAVA_Automata.Digraph_Basic\nbegin\n\nhide_const \"Omega_Words_Fun.prefix\" \"Omega_Words_Fun.suffix\"\n\ntype_synonym ('n, 'ed) edge = \"('n \\<times> 'ed \\<times> 'n)\"\n\ndefinition getFrom :: \"('n, 'ed) edge \\<Rightarrow> 'n\" where\n  \"getFrom \\<equiv> fst\"\ndefinition getData :: \"('n, 'ed) edge \\<Rightarrow> 'ed\" where\n  \"getData \\<equiv> fst \\<circ> snd\"\ndefinition getTo :: \"('n, 'ed) edge \\<Rightarrow> 'n\" where\n  \"getTo \\<equiv> snd \\<circ> snd\"\n\nlemma get_edge_simps [simp]:\n  \"getFrom (f,d,t) = f\"\n  \"getData (f,d,t) = d\"\n  \"getTo (f,d,t) = t\"\n  by (simp_all add: getFrom_def getData_def getTo_def)\n\n  text \\<open>Predecessors of a node.\\<close>\n  definition pred :: \"('v,'w) graph \\<Rightarrow> 'v \\<Rightarrow> ('v\\<times>'w) set\"\n    where \"pred G v \\<equiv> {(v',w). (v',w,v)\\<in>edges G}\"\n\n  lemma pred_finite[simp, intro]: \"finite (edges G) \\<Longrightarrow> finite (pred G v)\"\n    unfolding pred_def\n    by (rule finite_subset[where B=\"(\\<lambda>(v,w,v'). (v,w))`edges G\"]) force+\n\n  lemma pred_empty[simp]: \"pred empty v = {}\" unfolding empty_def pred_def by auto\n\n  lemma (in valid_graph) pred_subset: \"pred G v \\<subseteq> V\\<times>UNIV\"\n    unfolding pred_def using E_valid\n    by (force)\n\n  type_synonym ('V,'W,'\\<sigma>,'G) graph_pred_it =\n    \"'G \\<Rightarrow> 'V \\<Rightarrow> ('V\\<times>'W,'\\<sigma>) set_iterator\"\n\n  locale graph_pred_it_defs =\n    fixes pred_list_it :: \"'G \\<Rightarrow> 'V \\<Rightarrow> ('V\\<times>'W,('V\\<times>'W) list) set_iterator\"\n  begin\n    definition \"pred_it g v \\<equiv> it_to_it (pred_list_it g v)\"\n  end\n\n  locale graph_pred_it = graph \\<alpha> invar + graph_pred_it_defs pred_list_it\n    for \\<alpha> :: \"'G \\<Rightarrow> ('V,'W) graph\" and invar and\n    pred_list_it :: \"'G \\<Rightarrow> 'V \\<Rightarrow> ('V\\<times>'W,('V\\<times>'W) list) set_iterator\" +\n    assumes pred_list_it_correct:\n      \"invar g \\<Longrightarrow> set_iterator (pred_list_it g v) (pred (\\<alpha> g) v)\"\n  begin\n    lemma pred_it_correct:\n      \"invar g \\<Longrightarrow> set_iterator (pred_it g v) (pred (\\<alpha> g) v)\"\n      unfolding pred_it_def\n      apply (rule it_to_it_correct)\n      by (rule pred_list_it_correct)\n\n    lemma pi_pred_it[icf_proper_iteratorI]:\n      \"proper_it (pred_it S v) (pred_it S v)\"\n      unfolding pred_it_def\n      by (intro icf_proper_iteratorI)\n\n    lemma pred_it_proper[proper_it]:\n      \"proper_it' (\\<lambda>S. pred_it S v) (\\<lambda>S. pred_it S v)\"\n      apply (rule proper_it'I)\n      by (rule pi_pred_it)\n  end\n\n  record ('V,'W,'G) graph_ops = \"('V,'W,'G) GraphSpec.graph_ops\" +\n    gop_pred_list_it :: \"'G \\<Rightarrow> 'V \\<Rightarrow> ('V\\<times>'W,('V\\<times>'W) list) set_iterator\"\n\n  lemma (in graph_pred_it) pred_it_is_iterator[refine_transfer]:\n    \"invar g \\<Longrightarrow> set_iterator (pred_it g v) (pred (\\<alpha> g) v)\"\n    by (rule pred_it_correct)\n\nlocale StdGraphDefs = GraphSpec.StdGraphDefs ops\n  + graph_pred_it_defs \"gop_pred_list_it ops\"\n  for ops :: \"('V,'W,'G,'m) graph_ops_scheme\"\nbegin\n  abbreviation pred_list_it  where \"pred_list_it \\<equiv> gop_pred_list_it ops\"\nend\n\nlocale StdGraph = StdGraphDefs + org:StdGraph +\n  graph_pred_it \\<alpha> invar pred_list_it\n\nlocale graph_path_base =\n  graph_nodes_it_defs \"\\<lambda>g. foldri (\\<alpha>n g)\" +\n  graph_pred_it_defs \"\\<lambda>g n. foldri (inEdges' g n)\"\nfor\n  \\<alpha>e :: \"'g \\<Rightarrow> ('node \\<times> 'edgeD \\<times> 'node) set\" and\n  \\<alpha>n :: \"'g \\<Rightarrow> 'node list\" and\n  invar :: \"'g \\<Rightarrow> bool\" and\n  inEdges' :: \"'g \\<Rightarrow> 'node \\<Rightarrow> ('node \\<times> 'edgeD) list\"\nbegin\n\n(*\n  abbreviation \\<alpha>e :: \"'g \\<Rightarrow> ('node \\<times> 'edgeD \\<times> 'node) set\"\n  where \"\\<alpha>e g \\<equiv> graph.edges (\\<alpha> g)\"\n  definition \\<alpha>n :: \"'g \\<Rightarrow> 'node list\"\n  where \"\\<alpha>n g \\<equiv> nodes_it g (\\<lambda>_. True) (#) []\"\n*)\n\n  definition inEdges :: \"'g \\<Rightarrow> 'node \\<Rightarrow> ('node \\<times> 'edgeD \\<times> 'node) list\"\n  where \"inEdges g n \\<equiv> map (\\<lambda>(f,d). (f,d,n)) (inEdges' g n)\"\n\n  definition predecessors :: \"'g \\<Rightarrow> 'node \\<Rightarrow> 'node list\" where\n    \"predecessors g n \\<equiv> map getFrom (inEdges g n)\"\n\n  definition successors :: \"'g \\<Rightarrow> 'node \\<Rightarrow> 'node list\" where\n    \"successors g m \\<equiv> [n . n \\<leftarrow> \\<alpha>n g, m \\<in> set (predecessors g n)]\"\n\n\n  declare predecessors_def [code]\n\n  declare [[inductive_internals]]\n  inductive path :: \"'g \\<Rightarrow> 'node list \\<Rightarrow> bool\"\n    for g :: 'g\n  where\n    empty_path[intro]: \"\\<lbrakk>n \\<in> set (\\<alpha>n g); invar g\\<rbrakk> \\<Longrightarrow> path g [n]\"\n    | Cons_path[intro]: \"\\<lbrakk>path g ns; n' \\<in> set (predecessors g (hd ns))\\<rbrakk> \\<Longrightarrow> path g (n'#ns)\"\n\n  definition path2 :: \"'g \\<Rightarrow> 'node \\<Rightarrow> 'node list \\<Rightarrow> 'node \\<Rightarrow> bool\" (\"_ \\<turnstile> _-_\\<rightarrow>_\" [51,0,0,51] 80) where\n    \"path2 g n ns m \\<equiv> path g ns \\<and> n = hd ns \\<and> m = last ns\"\n\n  abbreviation \"\\<alpha> g \\<equiv> \\<lparr>nodes = set (\\<alpha>n g), edges = \\<alpha>e g\\<rparr>\"\nend\n\nlocale graph_path =\n  graph_path_base \\<alpha>e \\<alpha>n invar inEdges' +\n  graph \\<alpha> invar +\n  ni: graph_nodes_it \\<alpha> invar \"\\<lambda>g. foldri (\\<alpha>n g)\" +\n  pi: graph_pred_it \\<alpha> invar \"\\<lambda>g n. foldri (inEdges' g n)\"\nfor\n  \\<alpha>e :: \"'g \\<Rightarrow> ('node \\<times> 'edgeD \\<times> 'node) set\" and\n  \\<alpha>n :: \"'g \\<Rightarrow> 'node list\" and\n  invar :: \"'g \\<Rightarrow> bool\" and\n  inEdges' :: \"'g \\<Rightarrow> 'node \\<Rightarrow> ('node \\<times> 'edgeD) list\"\nbegin\n  lemma \\<alpha>n_correct: \"invar g \\<Longrightarrow> set (\\<alpha>n g) \\<supseteq> getFrom ` \\<alpha>e g \\<union> getTo ` \\<alpha>e g\"\n    by (frule valid) (auto dest: valid_graph.E_validD)\n\n  lemma \\<alpha>n_distinct: \"invar g \\<Longrightarrow> distinct (\\<alpha>n g)\"\n    by (frule ni.nodes_list_it_correct)\n      (metis foldri_cons_id iterate_to_list_correct iterate_to_list_def)\n\n  lemma inEdges_correct':\n    assumes \"invar g\"\n    shows \"set (inEdges g n) = (\\<lambda>(f,d). (f,d,n)) ` (pred (\\<alpha> g) n)\"\n  proof -\n    from iterate_to_list_correct [OF pi.pred_list_it_correct [OF assms], of n]\n    show ?thesis\n      by (auto intro: rev_image_eqI simp: iterate_to_list_def pred_def inEdges_def)\n  qed\n\n  lemma inEdges_correct [intro!, simp]:\n    \"invar g \\<Longrightarrow> set (inEdges g n) = {(_, _, t). t = n} \\<inter> \\<alpha>e g\"\n    by (auto simp: inEdges_correct' pred_def)\n\n  lemma in_set_\\<alpha>nI1 [intro]: \"\\<lbrakk>invar g; x \\<in> getFrom ` \\<alpha>e g\\<rbrakk> \\<Longrightarrow> x \\<in> set (\\<alpha>n g)\"\n    using \\<alpha>n_correct by blast\n  lemma in_set_\\<alpha>nI2 [intro]: \"\\<lbrakk>invar g; x \\<in> getTo ` \\<alpha>e g\\<rbrakk> \\<Longrightarrow> x \\<in> set (\\<alpha>n g)\"\n    using \\<alpha>n_correct by blast\n\n(*\n\nlocale graph_path_base = graph_inEdges_base \\<alpha>e invar inEdges + graph_nodes_base \\<alpha>e invar \\<alpha>n\nfor\n  \\<alpha>e :: \"'g \\<Rightarrow> ('node \\<times> 'edgeD \\<times> 'node) set\" and\n  \\<alpha>n :: \"'g \\<Rightarrow> 'node list\" and\n  invar :: \"'g \\<Rightarrow> bool\" and\n  inEdges :: \"'g \\<Rightarrow> 'node \\<Rightarrow> ('node \\<times> 'edgeD \\<times> 'node) list\"\nbegin\n*)\n\n(*\nend\n\nlocale graph_path = graph_path_base \\<alpha>e \\<alpha>n invar inEdges + graph_inEdges \\<alpha>e invar inEdges + graph_nodes \\<alpha>e invar \\<alpha>n\nfor\n  \\<alpha>e :: \"'g \\<Rightarrow> ('node \\<times> 'edgeD \\<times> 'node) set\" and\n  \\<alpha>n :: \"'g \\<Rightarrow> 'node list\" and\n  invar :: \"'g \\<Rightarrow> bool\" and\n  inEdges :: \"'g \\<Rightarrow> 'node \\<Rightarrow> ('node \\<times> 'edgeD \\<times> 'node) list\"\nbegin\n*)\n\n  lemma edge_to_node:\n    assumes \"invar g\" and \"e \\<in> \\<alpha>e g\"\n    obtains \"getFrom e \\<in> set (\\<alpha>n g)\" and \"getTo e \\<in> set (\\<alpha>n g)\"\n  using assms(2) \\<alpha>n_correct [OF \\<open>invar g\\<close>]\n    by (cases e) (auto 4 3 intro: rev_image_eqI)\n\n  lemma inEdge_to_edge:\n    assumes \"e \\<in> set (inEdges g n)\" and \"invar g\"\n    obtains eD n' where \"(n',eD,n) \\<in> \\<alpha>e g\"\n    using assms by auto\n\n  lemma edge_to_inEdge:\n    assumes \"(n,eD,m) \\<in> \\<alpha>e g\" \"invar g\"\n    obtains \"(n,eD,m) \\<in> set (inEdges g m)\"\n    using assms by auto\n\n  lemma edge_to_predecessors:\n    assumes \"(n,eD,m) \\<in> \\<alpha>e g\" \"invar g\"\n    obtains \"n \\<in> set (predecessors g m)\"\n  proof atomize_elim\n    from assms have \"(n,eD,m) \\<in> set (inEdges g m)\" by (rule edge_to_inEdge)\n    thus \"n \\<in> set (predecessors g m)\" unfolding predecessors_def by (metis get_edge_simps(1) image_eqI set_map)\n  qed\n\n  lemma predecessor_is_node[elim]: \"\\<lbrakk>n \\<in> set (predecessors g n'); invar g\\<rbrakk> \\<Longrightarrow> n \\<in> set (\\<alpha>n g)\"\n  unfolding predecessors_def by (fastforce intro: rev_image_eqI simp: getTo_def getFrom_def)\n\n  lemma successor_is_node[elim]: \"\\<lbrakk>n \\<in> set (predecessors g n'); n \\<in> set (\\<alpha>n g); invar g\\<rbrakk> \\<Longrightarrow> n' \\<in> set (\\<alpha>n g)\"\n  unfolding predecessors_def by (fastforce intro: rev_image_eqI)\n\n  lemma successors_predecessors[simp]: \"n \\<in> set (\\<alpha>n g) \\<Longrightarrow> n \\<in> set (successors g m) \\<longleftrightarrow> m \\<in> set (predecessors g n)\"\n  by (auto simp:successors_def predecessors_def)\n\n\n  lemma path_not_Nil[simp, dest]: \"path g ns \\<Longrightarrow> ns \\<noteq> []\"\n  by (erule path.cases) auto\n\n  lemma path2_not_Nil[simp]: \"g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> ns \\<noteq> []\"\n  unfolding path2_def by auto\n\n  lemma path2_not_Nil2[simp]: \"\\<not> g \\<turnstile> n-[]\\<rightarrow>m\"\n  unfolding path2_def by auto\n\n  lemma path2_not_Nil3[simp]: \"g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> length ns \\<ge> 1\"\n    by (cases ns, auto)\n\n  lemma empty_path2[intro]: \"\\<lbrakk>n \\<in> set (\\<alpha>n g); invar g\\<rbrakk> \\<Longrightarrow> g \\<turnstile> n-[n]\\<rightarrow>n\"\n  unfolding path2_def by auto\n\n  lemma Cons_path2[intro]: \"\\<lbrakk>g \\<turnstile> n-ns\\<rightarrow>m; n' \\<in> set (predecessors g n)\\<rbrakk> \\<Longrightarrow> g \\<turnstile> n'-n'#ns\\<rightarrow>m\"\n  unfolding path2_def by auto\n\n  lemma path2_cases:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\"\n    obtains (empty_path) \"ns = [n]\" \"m = n\"\n          | (Cons_path) \"g \\<turnstile> hd (tl ns)-tl ns\\<rightarrow>m\" \"n \\<in> set (predecessors g (hd (tl ns)))\"\n  proof-\n    from assms have 1: \"path g ns\" \"hd ns = n\" \"last ns = m\" by (auto simp: path2_def)\n    from this(1) show thesis\n    proof cases\n      case (empty_path n)\n      with 1 show thesis by - (rule that(1), auto)\n    next\n      case (Cons_path ns n')\n      with 1 show thesis by - (rule that(2), auto simp: path2_def)\n    qed\n  qed\n\n  lemma path2_induct[consumes 1, case_names empty_path Cons_path]:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\"\n    assumes empty: \"invar g \\<Longrightarrow> P m [m] m\"\n    assumes Cons: \"\\<And>ns n' n. g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> P n ns m \\<Longrightarrow> n' \\<in> set (predecessors g n) \\<Longrightarrow> P n' (n' # ns) m\"\n    shows \"P n ns m\"\n  using assms(1)\n  unfolding path2_def\n  apply-\n  proof (erule conjE, induction arbitrary: n rule:path.induct)\n    case empty_path\n    with empty show ?case by simp\n  next\n    case (Cons_path ns n' n'')\n    hence[simp]: \"n'' = n'\" by simp\n    from Cons_path Cons show ?case unfolding path2_def by auto\n  qed\n\n  lemma path_invar[intro]: \"path g ns \\<Longrightarrow> invar g\"\n  by (induction rule:path.induct)\n\n  lemma path_in_\\<alpha>n[intro]: \"\\<lbrakk>path g ns; n \\<in> set ns\\<rbrakk> \\<Longrightarrow> n \\<in> set (\\<alpha>n g)\"\n  by (induct ns arbitrary: n rule:path.induct) auto\n\n  lemma path2_in_\\<alpha>n[elim]: \"\\<lbrakk>g \\<turnstile> n-ns\\<rightarrow>m; l \\<in> set ns\\<rbrakk> \\<Longrightarrow> l \\<in> set (\\<alpha>n g)\"\n  unfolding path2_def by auto\n\n  lemma path2_hd_in_\\<alpha>n[elim]: \"g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> n \\<in> set (\\<alpha>n g)\"\n  unfolding path2_def by auto\n\n  lemma path2_tl_in_\\<alpha>n[elim]: \"g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> m \\<in> set (\\<alpha>n g)\"\n  unfolding path2_def by auto\n\n  lemma path2_forget_hd[simp]: \"g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> g \\<turnstile> hd ns-ns\\<rightarrow>m\"\n  unfolding path2_def by simp\n\n  lemma path2_forget_last[simp]: \"g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> g \\<turnstile> n-ns\\<rightarrow>last ns\"\n  unfolding path2_def by simp\n\n  lemma path_hd[dest]: \"path g (n#ns) \\<Longrightarrow> path g [n]\"\n  by (rule empty_path, auto elim:path.cases)\n\n  lemma path_by_tail[intro]: \"\\<lbrakk>path g (n#n'#ns); path g (n'#ns) \\<Longrightarrow> path g (n'#ms)\\<rbrakk> \\<Longrightarrow> path g (n#n'#ms)\"\n  by (rule path.cases) auto\n\n  \n\n  lemma path_split:\n    assumes \"path g (ns@m#ns')\"\n    shows \"path g (ns@[m])\" \"path g(m#ns')\"\n  proof-\n    from assms show \"path g (ns@[m])\"\n    proof (induct ns)\n      case (Cons n ns)\n      thus ?case by (cases ns) auto\n    qed auto\n    from assms show \"path g (m#ns')\"\n    proof (induct ns)\n      case (Cons n ns)\n      thus ?case by (auto elim:path.cases)\n    qed auto\n  qed\n\n  lemma path2_split:\n    assumes \"g \\<turnstile> n-ns@n'#ns'\\<rightarrow>m\"\n    shows \"g \\<turnstile> n-ns@[n']\\<rightarrow>n'\" \"g \\<turnstile> n'-n'#ns'\\<rightarrow>m\"\n  using assms unfolding path2_def by (auto intro:path_split iff:hd_append)\n\n  lemma elem_set_implies_elem_tl_app_cons[simp]: \"x \\<in> set xs \\<Longrightarrow> x \\<in> set (tl (ys@y#xs))\"\n    by (induction ys arbitrary: y; auto)\n\n  lemma path2_split_ex:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"x \\<in> set ns\"\n    obtains ns\\<^sub>1 ns\\<^sub>2 where \"g \\<turnstile> n-ns\\<^sub>1\\<rightarrow>x\" \"g \\<turnstile> x-ns\\<^sub>2\\<rightarrow>m\" \"ns = ns\\<^sub>1@tl ns\\<^sub>2\" \"ns = butlast ns\\<^sub>1@ns\\<^sub>2\"\n  proof-\n    from assms(2) obtain ns\\<^sub>1 ns\\<^sub>2 where \"ns = ns\\<^sub>1@x#ns\\<^sub>2\" by atomize_elim (rule split_list)\n    with assms[simplified this] show thesis\n      by - (rule that, auto dest:path2_split(1) path2_split(2) intro: suffixI)\n  qed\n\n  lemma path2_split_ex':\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"x \\<in> set ns\"\n    obtains ns\\<^sub>1 ns\\<^sub>2 where \"g \\<turnstile> n-ns\\<^sub>1\\<rightarrow>x\" \"g \\<turnstile> x-ns\\<^sub>2\\<rightarrow>m\" \"ns = butlast ns\\<^sub>1@ns\\<^sub>2\"\n  using assms by (rule path2_split_ex)\n\n  lemma path_snoc:\n    assumes \"path g (ns@[n])\" \"n \\<in> set (predecessors g m)\"\n    shows \"path g (ns@[n,m])\"\n  using assms(1) proof (induction ns)\n    case Nil\n    hence 1: \"n \\<in> set (\\<alpha>n g)\" \"invar g\" by auto\n    with assms(2) have \"m \\<in> set (\\<alpha>n g)\" by auto\n    with 1 have \"path g [m]\" by auto\n    with assms(2) show ?case by auto\n  next\n    case (Cons l ns)\n    hence 1: \"path g (ns @ [n]) \\<and> l \\<in> set (predecessors g (hd (ns@[n])))\" by -(cases g \"(l # ns) @ [n]\" rule:path.cases, auto)\n    hence \"path g (ns @ [n,m])\" by (auto intro:Cons.IH)\n    with 1 have \"path g (l # ns @ [n,m])\" by -(rule Cons_path, assumption, cases ns, auto)\n    thus ?case by simp\n  qed\n\n  lemma path2_snoc[elim]:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"m \\<in> set (predecessors g m')\"\n    shows \"g \\<turnstile> n-ns@[m']\\<rightarrow>m'\"\n  proof-\n    from assms(1) have 1: \"ns \\<noteq> []\" by auto\n\n    have \"path g ((butlast ns) @ [last ns, m'])\"\n    using assms unfolding path2_def by -(rule path_snoc, auto)\n    hence \"path g ((butlast ns @ [last ns]) @ [m'])\" by simp\n    with 1 have \"path g (ns @ [m'])\" by simp\n    thus ?thesis\n    using assms unfolding path2_def by auto\n  qed\n\n  lemma path_unsnoc:\n    assumes \"path g ns\" \"length ns \\<ge> 2\"\n    obtains \"path g (butlast ns) \\<and> last (butlast ns) \\<in> set (predecessors g (last ns))\"\n  using assms\n  proof (atomize_elim, induction ns)\n    case (Cons_path ns n)\n    show ?case\n    proof (cases \"2 \\<le> length ns\")\n      case True\n        hence [simp]: \"hd (butlast ns) = hd ns\" by (cases ns, auto)\n        have 0: \"n#butlast ns = butlast (n#ns)\" using True by auto\n        have 1: \"n \\<in> set (predecessors g (hd (butlast ns)))\" using Cons_path by simp\n        from True have \"path g (butlast ns)\" using Cons_path by auto\n        hence \"path g (n#butlast ns)\" using 1 by auto\n        hence \"path g (butlast (n#ns))\" using 0 by simp\n      moreover\n        from Cons_path True have \"last (butlast ns) \\<in> set (predecessors g (last ns))\" by simp\n        hence \"last (butlast (n # ns)) \\<in> set (predecessors g (last (n # ns)))\"\n          using True by (cases ns, auto)\n      ultimately show ?thesis by auto\n    next\n      case False\n      thus ?thesis\n      proof (cases ns)\n        case Nil\n        thus ?thesis using Cons_path by -(rule ccontr, auto elim:path.cases)\n      next\n        case (Cons n' ns')\n        hence [simp]: \"ns = [n']\" using False by (cases ns', auto)\n        have \"path g [n,n']\" using Cons_path by auto\n        thus ?thesis using Cons_path by auto\n      qed\n    qed\n  qed auto\n\n  lemma path2_unsnoc:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"length ns \\<ge> 2\"\n    obtains \"g \\<turnstile> n-butlast ns\\<rightarrow>last (butlast ns)\" \"last (butlast ns) \\<in> set (predecessors g m)\"\n  using assms unfolding path2_def by (metis append_butlast_last_id hd_append2 path_not_Nil path_unsnoc)\n\n  lemma path2_rev_induct[consumes 1, case_names empty snoc]:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\"\n    assumes empty: \"n \\<in> set (\\<alpha>n g) \\<Longrightarrow> P n [n] n\"\n    assumes snoc: \"\\<And>ns m' m. g \\<turnstile> n-ns\\<rightarrow>m' \\<Longrightarrow> P n ns m' \\<Longrightarrow> m' \\<in> set (predecessors g m) \\<Longrightarrow> P n (ns@[m]) m\"\n    shows \"P n ns m\"\n  using assms(1) proof (induction arbitrary:m rule:length_induct)\n    case (1 ns)\n    show ?case\n    proof (cases \"length ns \\<ge> 2\")\n      case False\n      thus ?thesis\n      proof (cases ns)\n        case Nil\n        thus ?thesis using 1(2) by auto\n      next\n        case (Cons n' ns')\n        with False have \"ns' = []\" by (cases ns', auto)\n        with Cons 1(2) have \"n' = n\" \"m = n\" unfolding path2_def by auto\n        with Cons \\<open>ns' = []\\<close> 1(2) show ?thesis by (auto intro:empty)\n      qed\n    next\n      case True\n      let ?ns' = \"butlast ns\"\n      let ?m' = \"last ?ns'\"\n      from 1(2) have m: \"m = last ns\" unfolding path2_def by auto\n      from True 1(2) obtain ns': \"g \\<turnstile> n-?ns'\\<rightarrow>?m'\" \"?m' \\<in> set (predecessors g m)\" by -(rule path2_unsnoc)\n      with True \"1.IH\" have \"P n ?ns' ?m'\" by auto\n      with ns' have \"P n (?ns'@[m]) m\" by (auto intro!: snoc)\n      with m 1(2) show ?thesis by auto\n    qed\n  qed\n\n  lemma path2_hd[elim, dest?]: \"g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> n = hd ns\"\n  unfolding path2_def by simp\n\n  lemma path2_hd_in_ns[elim]: \"g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> n \\<in> set ns\"\n  unfolding path2_def by auto\n\n  lemma path2_last[elim, dest?]: \"g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> m = last ns\"\n  unfolding path2_def by simp\n\n  lemma path2_last_in_ns[elim]: \"g \\<turnstile> n-ns\\<rightarrow>m \\<Longrightarrow> m \\<in> set ns\"\n  unfolding path2_def by auto\n\n  lemma path_app[elim]:\n    assumes \"path g ns\" \"path g ms\" \"last ns = hd ms\"\n    shows \"path g (ns@tl ms)\"\n  using assms by (induction ns rule:path.induct) auto\n\n  lemma path2_app[elim]:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"g \\<turnstile> m-ms\\<rightarrow>l\"\n    shows \"g \\<turnstile> n-ns@tl ms\\<rightarrow>l\"\n  proof-\n    have \"last (ns @ tl ms) = last ms\" using assms\n    unfolding path2_def\n    proof (cases \"tl ms\")\n      case Nil\n      hence \"ms = [m]\" using assms(2) unfolding path2_def by (cases ms, auto)\n      thus ?thesis using assms(1) unfolding path2_def by auto\n    next\n      case (Cons m' ms')\n      from this[symmetric] have \"ms = hd ms#m'#ms'\" using assms(2) by auto\n      thus ?thesis using assms unfolding path2_def by auto\n    qed\n    with assms show ?thesis\n      unfolding path2_def by auto\n  qed\n\n  lemma butlast_tl:\n    assumes \"last xs = hd ys\" \"xs \\<noteq> []\" \"ys \\<noteq> []\"\n    shows \"butlast xs@ys = xs@tl ys\"\n    by (metis append.simps(1) append.simps(2) append_assoc append_butlast_last_id assms(1) assms(2) assms(3) list.collapse)\n\n  lemma path2_app'[elim]:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"g \\<turnstile> m-ms\\<rightarrow>l\"\n    shows \"g \\<turnstile> n-butlast ns@ms\\<rightarrow>l\"\n  proof-\n    have \"butlast ns@ms = ns@tl ms\" using assms by - (rule butlast_tl, auto dest:path2_hd path2_last)\n    moreover from assms have \"g \\<turnstile> n-ns@tl ms\\<rightarrow>l\" by (rule path2_app)\n    ultimately show ?thesis by simp\n  qed\n\n  lemma path2_nontrivial[elim]:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"n \\<noteq> m\"\n    shows \"length ns \\<ge> 2\"\n  using assms\n    by (metis Suc_1 le_antisym length_1_last_hd not_less_eq_eq path2_hd path2_last path2_not_Nil3)\n\n  lemma simple_path2_aux:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\"\n    obtains ns' where \"g \\<turnstile> n-ns'\\<rightarrow>m\" \"distinct ns'\" \"set ns' \\<subseteq> set ns\" \"length ns' \\<le> length ns\"\n  apply atomize_elim\n  using assms proof (induction rule:path2_induct)\n    case empty_path\n    with assms show ?case by - (rule exI[of _ \"[m]\"], auto)\n  next\n    case (Cons_path ns n n')\n    then obtain ns' where ns': \"g \\<turnstile> n'-ns'\\<rightarrow>m\" \"distinct ns'\" \"set ns' \\<subseteq> set ns\" \"length ns' \\<le> length ns\" by auto\n    show ?case\n    proof (cases \"n \\<in> set ns'\")\n      case False\n      with ns' Cons_path(2) show ?thesis by -(rule exI[where x=\"n#ns'\"], auto)\n    next\n      case True\n      with ns' obtain ns'\\<^sub>1 ns'\\<^sub>2 where split: \"ns' = ns'\\<^sub>1@n#ns'\\<^sub>2\" \"n \\<notin> set ns'\\<^sub>2\" by -(atomize_elim, rule split_list_last)\n      with ns' have \"g \\<turnstile> n-n#ns'\\<^sub>2\\<rightarrow>m\" by -(rule path2_split, simp)\n      with split ns' show ?thesis by -(rule exI[where x=\"n#ns'\\<^sub>2\"], auto)\n    qed\n  qed\n\n  lemma simple_path2:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\"\n    obtains ns' where \"g \\<turnstile> n-ns'\\<rightarrow>m\" \"distinct ns'\" \"set ns' \\<subseteq> set ns\" \"length ns' \\<le>  length ns\" \"n \\<notin> set (tl ns')\" \"m \\<notin> set (butlast ns')\"\n  using assms\n  apply (rule simple_path2_aux)\n  by (metis append_butlast_last_id distinct.simps(2) distinct1_rotate hd_Cons_tl path2_hd path2_last path2_not_Nil rotate1.simps(2))\n\n  lemma simple_path2_unsnoc:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"n \\<noteq> m\"\n    obtains ns' where \"g \\<turnstile> n-ns'\\<rightarrow>last ns'\" \"last ns' \\<in> set (predecessors g m)\" \"distinct ns'\" \"set ns' \\<subseteq> set ns\" \"m \\<notin> set ns'\"\n  proof-\n    obtain ns' where 1: \"g \\<turnstile> n-ns'\\<rightarrow>m\" \"distinct ns'\" \"set ns' \\<subseteq> set ns\" \"m \\<notin> set (butlast ns')\" by (rule simple_path2[OF assms(1)])\n    with assms(2) obtain 2: \"g \\<turnstile> n-butlast ns'\\<rightarrow>last (butlast ns')\" \"last (butlast ns') \\<in> set (predecessors g m)\" by - (rule path2_unsnoc, auto)\n    show thesis\n    proof (rule that[of \"butlast ns'\"])\n      from 1(3) show \"set (butlast ns') \\<subseteq> set ns\" by (metis in_set_butlastD subsetI subset_trans)\n    qed (auto simp:1 2 distinct_butlast)\n  qed\n\n  lemma path2_split_first_last:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"x \\<in> set ns\"\n    obtains ns\\<^sub>1 ns\\<^sub>3 ns\\<^sub>2 where \"ns = ns\\<^sub>1@ns\\<^sub>3@ns\\<^sub>2\" \"prefix (ns\\<^sub>1@[x]) ns\" \"suffix (x#ns\\<^sub>2) ns\"\n        and \"g \\<turnstile> n-ns\\<^sub>1@[x]\\<rightarrow>x\"  \"x \\<notin> set ns\\<^sub>1\"\n        and \"g \\<turnstile> x-ns\\<^sub>3\\<rightarrow>x\"\n        and \"g \\<turnstile> x-x#ns\\<^sub>2\\<rightarrow>m\" \"x \\<notin> set ns\\<^sub>2\"\n  proof-\n    from assms(2) obtain ns\\<^sub>1 ns' where 1: \"ns = ns\\<^sub>1@x#ns'\" \"x \\<notin> set ns\\<^sub>1\" by (atomize_elim, rule split_list_first)\n    from assms(1)[unfolded 1(1)] have 2: \"g \\<turnstile> n-ns\\<^sub>1@[x]\\<rightarrow>x\" \"g \\<turnstile> x-x#ns'\\<rightarrow>m\" by - (erule path2_split, erule path2_split)\n    obtain ns\\<^sub>3 ns\\<^sub>2 where 3: \"x#ns' = ns\\<^sub>3@x#ns\\<^sub>2\" \"x \\<notin> set ns\\<^sub>2\" by (atomize_elim, rule split_list_last, simp)\n    from 2(2)[unfolded 3(1)] have 4: \"g \\<turnstile> x-ns\\<^sub>3@[x]\\<rightarrow>x\" \"g \\<turnstile> x-x#ns\\<^sub>2\\<rightarrow>m\" by - (erule path2_split, erule path2_split)\n    show thesis\n    proof (rule that[OF _ _ _ 2(1) 1(2) 4 3(2)])\n      show \"ns = ns\\<^sub>1 @ (ns\\<^sub>3 @ [x]) @ ns\\<^sub>2\" using 1(1) 3(1) by simp\n      show \"prefix (ns\\<^sub>1@[x]) ns\" using 1 by auto\n      show \"suffix (x#ns\\<^sub>2) ns\" using 1 3 by (metis Sublist.suffix_def suffix_order.order_trans)\n    qed\n  qed\n\n  lemma path2_simple_loop:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>n\" \"n' \\<in> set ns\"\n    obtains ns' where \"g \\<turnstile> n-ns'\\<rightarrow>n\" \"n' \\<in> set ns'\" \"n \\<notin> set (tl (butlast ns'))\" \"set ns' \\<subseteq> set ns\"\n  using assms proof (induction \"length ns\" arbitrary: ns rule: nat_less_induct)\n    case 1\n    let ?ns' = \"tl (butlast ns)\"\n    show ?case\n    proof (cases \"n \\<in> set ?ns'\")\n      case False\n      with \"1.prems\"(2,3) show ?thesis by - (rule \"1.prems\"(1), auto)\n    next\n      case True\n      hence 2: \"length ns > 1\" by (cases ns, auto)\n      with \"1.prems\"(2) obtain m where m: \"g \\<turnstile> n-butlast ns\\<rightarrow>m\" \"m \\<in> set (predecessors g n)\" by - (rule path2_unsnoc, auto)\n      with True obtain m' where m': \"g \\<turnstile> m'-?ns'\\<rightarrow>m\" \"n \\<in> set (predecessors g m')\" by - (erule path2_cases, auto)\n      with True obtain ns\\<^sub>1 ns\\<^sub>2 where split: \"g \\<turnstile> m'-ns\\<^sub>1\\<rightarrow>n\" \"g \\<turnstile> n-ns\\<^sub>2\\<rightarrow>m\" \"?ns' = ns\\<^sub>1@tl ns\\<^sub>2\" \"?ns' = butlast ns\\<^sub>1@ns\\<^sub>2\"\n        by - (rule path2_split_ex)\n      have \"ns = butlast ns@[n]\" using 2 \"1.prems\"(2) by (auto simp: path2_def)\n      moreover have \"butlast ns = n#tl (butlast ns)\" using 2 m(1) by (auto simp: path2_def)\n      ultimately have split': \"ns = n#ns\\<^sub>1@tl ns\\<^sub>2@[n]\" \"ns = n#butlast ns\\<^sub>1@ns\\<^sub>2@[n]\" using split(3,4) by auto\n      show ?thesis\n      proof (cases \"n' \\<in> set (n#ns\\<^sub>1)\")\n        case True\n        show ?thesis\n        proof (rule \"1.hyps\"[rule_format, of _ \"n#ns\\<^sub>1\"])\n          show \"length (n#ns\\<^sub>1) < length ns\" using split'(1) by auto\n          show \"n' \\<in> set (n#ns\\<^sub>1)\" by (rule True)\n        qed (auto intro: split(1) m'(2) intro!: \"1.prems\"(1) simp: split'(1))\n      next\n        case False\n        from False split'(1) \"1.prems\"(3) have 5: \"n' \\<in> set (ns\\<^sub>2@[n])\" by auto\n        show ?thesis\n        proof (rule \"1.hyps\"[rule_format, of _ \"ns\\<^sub>2@[n]\"])\n          show \"length (ns\\<^sub>2@[n]) < length ns\" using split'(2) by auto\n          show \"n' \\<in> set (ns\\<^sub>2@[n])\" by (rule 5)\n          show \"g \\<turnstile> n-ns\\<^sub>2@[n]\\<rightarrow>n\" using split(2) m(2) by (rule path2_snoc)\n        qed (auto intro!: \"1.prems\"(1) simp: split'(2))\n      qed\n    qed\n  qed\n\n  lemma path2_split_first_prop:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"\\<exists>x\\<in>set ns. P x\"\n    obtains m' ns' where \"g \\<turnstile> n-ns'\\<rightarrow>m'\" \"P m'\" \"\\<forall>x \\<in> set (butlast ns'). \\<not>P x\" \"prefix ns' ns\"\n  proof-\n    obtain ns'' n' ns' where 1: \"ns = ns''@n'#ns'\" \"P n'\" \"\\<forall>x \\<in> set ns''. \\<not>P x\" by - (rule split_list_first_propE[OF assms(2)])\n    with assms(1) have \"g \\<turnstile> n-ns''@[n']\\<rightarrow>n'\" by - (rule path2_split(1), auto)\n    with 1 show thesis by - (rule that, auto)\n  qed\n\n  lemma path2_split_last_prop:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"\\<exists>x\\<in>set ns. P x\"\n    obtains n' ns' where \"g \\<turnstile> n'-ns'\\<rightarrow>m\" \"P n'\" \"\\<forall>x \\<in> set (tl ns'). \\<not>P x\" \"suffix ns' ns\"\n  proof-\n    obtain ns'' n' ns' where 1: \"ns = ns''@n'#ns'\" \"P n'\" \"\\<forall>x \\<in> set ns'. \\<not>P x\" by - (rule split_list_last_propE[OF assms(2)])\n    with assms(1) have \"g \\<turnstile> n'-n'#ns'\\<rightarrow>m\" by - (rule path2_split(2), auto)\n    with 1 show thesis by - (rule that, auto simp: Sublist.suffix_def)\n  qed\n\n  lemma path2_prefix[elim]:\n    assumes 1: \"g \\<turnstile> n-ns\\<rightarrow>m\"\n    assumes 2: \"prefix (ns'@[m']) ns\"\n    shows \"g \\<turnstile> n-ns'@[m']\\<rightarrow>m'\"\n  using assms by -(erule prefixE, rule path2_split, simp)\n\n  lemma path2_prefix_ex:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"m' \\<in> set ns\"\n    obtains ns' where \"g \\<turnstile> n-ns'\\<rightarrow>m'\" \"prefix ns' ns\" \"m' \\<notin> set (butlast ns')\"\n  proof-\n    from assms(2) obtain ns' where \"prefix (ns'@[m']) ns\" \"m' \\<notin> set ns'\" by (rule prefix_split_first)\n    with assms(1) show thesis by - (rule that, auto)\n  qed\n\n  lemma path2_strict_prefix_ex:\n    assumes \"g \\<turnstile> n-ns\\<rightarrow>m\" \"m' \\<in> set (butlast ns)\"\n    obtains ns' where \"g \\<turnstile> n-ns'\\<rightarrow>m'\" \"strict_prefix ns' ns\" \"m' \\<notin> set (butlast ns')\"\n  proof-\n    from assms(2) obtain ns' where ns': \"prefix (ns'@[m']) (butlast ns)\" \"m' \\<notin> set ns'\" by (rule prefix_split_first)\n    hence \"strict_prefix (ns'@[m']) ns\" using assms by - (rule strict_prefix_butlast, auto)\n    with assms(1) ns'(2) show thesis by - (rule that, auto)\n  qed\n\n  lemma path2_nontriv[elim]: \"\\<lbrakk>g \\<turnstile> n-ns\\<rightarrow>m; n \\<noteq> m\\<rbrakk> \\<Longrightarrow> length ns > 1\"\n    by (metis hd_Cons_tl last_appendR last_snoc length_greater_0_conv length_tl path2_def path_not_Nil zero_less_diff)\n\n  declare path_not_Nil [simp del]\n  declare path2_not_Nil [simp del]\n  declare path2_not_Nil3 [simp del]\nend\n\nsubsection \\<open>Domination\\<close>\n\ntext \\<open>We fix an entry node per graph and use it to define node domination.\\<close>\n\nlocale graph_Entry_base = graph_path_base \\<alpha>e \\<alpha>n invar inEdges'\nfor\n  \\<alpha>e :: \"'g \\<Rightarrow> ('node \\<times> 'edgeD \\<times> 'node) set\" and\n  \\<alpha>n :: \"'g \\<Rightarrow> 'node list\" and\n  invar :: \"'g \\<Rightarrow> bool\" and\n  inEdges' :: \"'g \\<Rightarrow> 'node \\<Rightarrow> ('node \\<times> 'edgeD) list\"\n+\nfixes Entry :: \"'g \\<Rightarrow> 'node\"\nbegin\n  definition dominates :: \"'g \\<Rightarrow> 'node \\<Rightarrow> 'node \\<Rightarrow> bool\" where\n    \"dominates g n m \\<equiv> m \\<in> set (\\<alpha>n g) \\<and> (\\<forall>ns. g \\<turnstile> Entry g-ns\\<rightarrow>m \\<longrightarrow> n \\<in> set ns)\"\n\n  abbreviation \"strict_dom g n m \\<equiv> n \\<noteq> m \\<and> dominates g n m\"\nend\n\nlocale graph_Entry = graph_Entry_base \\<alpha>e \\<alpha>n invar inEdges' Entry\n  + graph_path \\<alpha>e \\<alpha>n invar inEdges'\nfor\n  \\<alpha>e :: \"'g \\<Rightarrow> ('node \\<times> 'edgeD \\<times> 'node) set\" and\n  \\<alpha>n :: \"'g \\<Rightarrow> 'node list\" and\n  invar :: \"'g \\<Rightarrow> bool\" and\n  inEdges' :: \"'g \\<Rightarrow> 'node \\<Rightarrow> ('node \\<times> 'edgeD) list\" and\n  Entry :: \"'g \\<Rightarrow> 'node\"\n+\nassumes Entry_in_graph[simp]: \"Entry g \\<in> set (\\<alpha>n g)\"\nassumes Entry_unreachable: \"invar g \\<Longrightarrow> inEdges g (Entry g) = []\"\nassumes Entry_reaches[intro]:\n  \"\\<lbrakk>n \\<in> set (\\<alpha>n g); invar g\\<rbrakk> \\<Longrightarrow> \\<exists>ns. g \\<turnstile> Entry g-ns\\<rightarrow>n\"\nbegin\n  lemma Entry_dominates[simp,intro]: \"\\<lbrakk>invar g; n \\<in> set (\\<alpha>n g)\\<rbrakk> \\<Longrightarrow> dominates g (Entry g) n\"\n  unfolding dominates_def by auto\n\n  lemma Entry_iff_unreachable[simp]:\n    assumes \"invar g\" \"n \\<in> set (\\<alpha>n g)\"\n    shows \"predecessors g n = [] \\<longleftrightarrow> n = Entry g\"\n  proof (rule, rule ccontr)\n    assume \"predecessors g n = []\" \"n \\<noteq> Entry g\"\n    with Entry_reaches[OF assms(2,1)] show False by (auto elim:simple_path2_unsnoc)\n  qed (auto simp:assms Entry_unreachable predecessors_def)\n\n  lemma Entry_loop:\n    assumes \"invar g\" \"g \\<turnstile> Entry g-ns\\<rightarrow>Entry g\"\n    shows \"ns=[Entry g]\"\n  proof (cases \"length ns \\<ge> 2\")\n    case True\n    with assms have \"last (butlast ns) \\<in> set (predecessors g (Entry g))\" by - (rule path2_unsnoc)\n    with Entry_unreachable[OF assms(1)] have False by (simp add:predecessors_def)\n    thus ?thesis ..\n  next\n    case False\n    with assms show ?thesis\n      by (metis Suc_leI hd_Cons_tl impossible_Cons le_less length_greater_0_conv numeral_2_eq_2 path2_hd path2_not_Nil)\n  qed\n\n  lemma simple_Entry_path:\n    assumes \"invar g\" \"n \\<in> set (\\<alpha>n g)\"\n    obtains ns where \"g \\<turnstile> Entry g-ns\\<rightarrow>n\" and \"n \\<notin> set (butlast ns)\"\n  proof-\n    from assms obtain ns where p: \"g \\<turnstile> Entry g-ns\\<rightarrow>n\" by -(atomize_elim, rule Entry_reaches)\n    with p obtain ns' where \"g \\<turnstile> Entry g-ns'\\<rightarrow>n\" \"n \\<notin> set (butlast ns')\" by -(rule path2_split_first_last, auto)\n    thus ?thesis by (rule that)\n  qed\n\n  \n\n  lemma dominatesE:\n    assumes \"dominates g n m\"\n    obtains \"m \\<in> set (\\<alpha>n g)\" and \"\\<And>ns. g \\<turnstile> Entry g-ns\\<rightarrow>m \\<Longrightarrow> n \\<in> set ns\"\n    using assms unfolding dominates_def by auto\n\n  \n\n  lemma[simp]:\n    assumes \"dominates g n m\" and[simp]: \"invar g\"\n    shows \"n \\<in> set (\\<alpha>n g)\"\n  proof-\n    from assms obtain ns where \"g \\<turnstile> Entry g-ns\\<rightarrow>m\" by atomize_elim (rule Entry_reaches, auto)\n    with assms show ?thesis by (auto elim!:dominatesE)\n  qed\n\n  lemma strict_domE[elim]:\n    assumes \"strict_dom g n m\"\n    obtains \"m \\<in> set (\\<alpha>n g)\" and \"\\<And>ns. g \\<turnstile> Entry g-ns\\<rightarrow>m \\<Longrightarrow> n \\<in> set (butlast ns)\"\n  using assms by (metis dominates_def path2_def path_not_Nil rotate1.simps(2) set_ConsD set_rotate1 snoc_eq_iff_butlast)\n\n  lemma dominates_refl[intro!]: \"\\<lbrakk>invar g; n \\<in> set (\\<alpha>n g)\\<rbrakk> \\<Longrightarrow> dominates g n n\"\n  by auto\n\n  lemma dominates_trans:\n    assumes \"invar g\"\n    assumes part1: \"dominates g n n'\"\n    assumes part2: \"dominates g n' n''\"\n    shows   \"dominates g n n''\"\n  proof\n    from part2 show \"n'' \\<in> set (\\<alpha>n g)\" by auto\n\n    fix ns :: \"'node list\"\n    assume p: \"g \\<turnstile> Entry g-ns\\<rightarrow>n''\"\n    with part2 have \"n' \\<in> set ns\" by - (erule dominatesE, auto)\n    then obtain as where prefix: \"prefix (as@[n']) ns\" by (auto intro:prefix_split_first)\n    with p have \"g \\<turnstile> Entry g-(as@[n'])\\<rightarrow>n'\" by auto\n    with part1 have \"n \\<in> set (as@[n'])\" unfolding dominates_def by auto\n    with prefix show \"n \\<in> set ns\" by auto\n  qed\n\n  lemma dominates_antisymm:\n    assumes \"invar g\"\n    assumes dom1: \"dominates g n n'\"\n    assumes dom2: \"dominates g n' n\"\n    shows \"n = n'\"\n  proof (rule ccontr)\n    assume \"n \\<noteq> n'\"\n    from dom2 have \"n \\<in> set (\\<alpha>n g)\" by auto\n    with \\<open>invar g\\<close> obtain ns where p: \"g \\<turnstile> Entry g-ns\\<rightarrow>n\" and \"n \\<notin> set (butlast ns)\"\n      by (rule simple_Entry_path)\n    with dom2 have \"n' \\<in> set ns\" by - (erule dominatesE, auto)\n    then obtain as where prefix: \"prefix (as@[n']) ns\" by (auto intro:prefix_split_first)\n    with p have \"g \\<turnstile> Entry g-as@[n']\\<rightarrow>n'\" by (rule path2_prefix)\n    with dom1 have \"n \\<in> set (as@[n'])\" unfolding dominates_def by auto\n    with \\<open>n \\<noteq> n'\\<close> have \"n \\<in> set as\" by auto\n    with \\<open>prefix (as@[n']) ns\\<close> have \"n \\<in> set (butlast ns)\" by -(erule prefixE, auto iff:butlast_append)\n    with \\<open>n \\<notin> set (butlast ns)\\<close> show False..\n  qed\n\n  lemma dominates_unsnoc:\n    assumes [simp]: \"invar g\" and \"dominates g n m\" \"m' \\<in> set (predecessors g m)\" \"n \\<noteq> m\"\n    shows \"dominates g n m'\"\n  proof\n    show \"m' \\<in> set (\\<alpha>n g)\" using assms by auto\n  next\n    fix ns\n    assume \"g \\<turnstile> Entry g-ns\\<rightarrow>m'\"\n    with assms(3) have \"g \\<turnstile> Entry g-ns@[m]\\<rightarrow>m\" by auto\n    with assms(2,4) show \"n \\<in> set ns\" by (auto elim!:dominatesE)\n  qed\n\n  lemma dominates_unsnoc':\n    assumes [simp]: \"invar g\" and \"dominates g n m\" \"g \\<turnstile> m'-ms\\<rightarrow>m\" \"\\<forall>x \\<in> set (tl ms). x \\<noteq> n\"\n    shows \"dominates g n m'\"\n  using assms(3,4) proof (induction rule:path2_induct)\n    case empty_path\n    show ?case by (rule assms(2))\n  next\n    case (Cons_path ms m'' m')\n    from Cons_path(4) have \"dominates g n m'\"\n      by (simp add: Cons_path.IH in_set_tlD)\n    moreover from Cons_path(1) have \"m' \\<in> set ms\" by auto\n    hence \"m' \\<noteq> n\" using Cons_path(4) by simp\n    ultimately show ?case using Cons_path(2) by - (rule dominates_unsnoc, auto)\n  qed\n\n  lemma dominates_path:\n    assumes \"dominates g n m\" and[simp]: \"invar g\"\n    obtains ns where \"g \\<turnstile> n-ns\\<rightarrow>m\"\n  proof atomize_elim\n    from assms obtain ns where ns: \"g \\<turnstile> Entry g-ns\\<rightarrow>m\" by atomize_elim (rule Entry_reaches, auto)\n    with assms have \"n \\<in> set ns\" by - (erule dominatesE)\n    with ns show \"\\<exists>ns. g \\<turnstile> n-ns\\<rightarrow>m\" by - (rule path2_split_ex, auto)\n  qed\n\n  lemma dominates_antitrans:\n    assumes[simp]: \"invar g\" and \"dominates g n\\<^sub>1 m\" \"dominates g n\\<^sub>2 m\"\n    obtains (1) \"dominates g n\\<^sub>1 n\\<^sub>2\"\n          | (2) \"dominates g n\\<^sub>2 n\\<^sub>1\"\n  proof (cases \"dominates g n\\<^sub>1 n\\<^sub>2\")\n    case False\n    show thesis\n    proof (rule 2, rule dominatesI)\n      show \"n\\<^sub>1 \\<in> set (\\<alpha>n g)\" using assms(2) by simp\n    next\n      fix ns\n      assume asm: \"g \\<turnstile> Entry g-ns\\<rightarrow>n\\<^sub>1\"\n      from assms(2) obtain ns\\<^sub>2 where \"g \\<turnstile> n\\<^sub>1-ns\\<^sub>2\\<rightarrow>m\" by (rule dominates_path, simp)\n      then obtain ns\\<^sub>2' where ns\\<^sub>2': \"g \\<turnstile> n\\<^sub>1-ns\\<^sub>2'\\<rightarrow>m\" \"n\\<^sub>1 \\<notin> set (tl ns\\<^sub>2')\" \"set ns\\<^sub>2' \\<subseteq> set ns\\<^sub>2\" by (rule simple_path2)\n      with asm have \"g \\<turnstile> Entry g-ns@tl ns\\<^sub>2'\\<rightarrow>m\" by auto\n      with assms(3) have \"n\\<^sub>2 \\<in> set (ns@tl ns\\<^sub>2')\" by - (erule dominatesE)\n      moreover have \"n\\<^sub>2 \\<notin> set (tl ns\\<^sub>2')\"\n      proof\n        assume \"n\\<^sub>2 \\<in> set (tl ns\\<^sub>2')\"\n        with ns\\<^sub>2'(1,2) obtain ns\\<^sub>3 where ns\\<^sub>3: \"g \\<turnstile> n\\<^sub>2-ns\\<^sub>3\\<rightarrow>m\" \"n\\<^sub>1 \\<notin> set (tl ns\\<^sub>3)\"\n          by - (erule path2_split_ex, auto simp: path2_not_Nil)\n        have \"dominates g n\\<^sub>1 n\\<^sub>2\"\n        proof\n          show \"n\\<^sub>2 \\<in> set (\\<alpha>n g)\" using assms(3) by simp\n        next\n          fix ns'\n          assume ns': \"g \\<turnstile> Entry g-ns'\\<rightarrow>n\\<^sub>2\"\n          with ns\\<^sub>3(1) have \"g \\<turnstile> Entry g-ns'@tl ns\\<^sub>3\\<rightarrow>m\" by auto\n          with assms(2) have \"n\\<^sub>1 \\<in> set (ns'@tl ns\\<^sub>3)\" by - (erule dominatesE)\n          with ns\\<^sub>3(2) show \"n\\<^sub>1 \\<in> set ns'\" by simp\n        qed\n        with False show False ..\n      qed\n      ultimately show \"n\\<^sub>2 \\<in> set ns\" by simp\n    qed\n  qed\n\n  lemma dominates_extend:\n    assumes \"dominates g n m\"\n    assumes \"g \\<turnstile> m'-ms\\<rightarrow>m\" \"n \\<notin> set (tl ms)\"\n    shows \"dominates g n m'\"\n  proof (rule dominatesI)\n    show \"m' \\<in> set (\\<alpha>n g)\" using assms(2) by auto\n  next\n    fix ms'\n    assume \"g \\<turnstile> Entry g-ms'\\<rightarrow>m'\"\n    with assms(2) have \"g \\<turnstile> Entry g-ms'@tl ms\\<rightarrow>m\" by auto\n    with assms(1) have \"n \\<in> set (ms'@tl ms)\" by - (erule dominatesE)\n    with assms(3) show \"n \\<in> set ms'\" by auto\n  qed\n\n  definition dominators :: \"'g \\<Rightarrow> 'node \\<Rightarrow> 'node set\" where\n    \"dominators g n \\<equiv> {m \\<in> set (\\<alpha>n g). dominates g m n}\"\n\n  definition \"isIdom g n m \\<longleftrightarrow> strict_dom g m n \\<and> (\\<forall>m' \\<in> set (\\<alpha>n g). strict_dom g m' n \\<longrightarrow> dominates g m' m)\"\n  definition idom :: \"'g \\<Rightarrow> 'node \\<Rightarrow> 'node\" where\n    \"idom g n \\<equiv> THE m. isIdom g n m\"\n\n  lemma idom_ex:\n    assumes[simp]: \"invar g\" \"n \\<in> set (\\<alpha>n g)\" \"n \\<noteq> Entry g\"\n    shows \"\\<exists>!m. isIdom g n m\"\n  proof (rule ex_ex1I)\n    let ?A = \"\\<lambda>m. {m' \\<in> set (\\<alpha>n g). strict_dom g m' n \\<and> strict_dom g m m'}\"\n\n    have 1: \"\\<And>A m. finite A \\<Longrightarrow> A = ?A m \\<Longrightarrow> strict_dom g m n \\<Longrightarrow> \\<exists>m'. isIdom g n m'\"\n    proof-\n      fix A m\n      show \"finite A \\<Longrightarrow> A = ?A m \\<Longrightarrow> strict_dom g m n \\<Longrightarrow> \\<exists>m'. isIdom g n m'\"\n      proof (induction arbitrary:m rule:finite_psubset_induct)\n        case (psubset A m)\n        show ?case\n        proof (cases \"A = {}\")\n          case True\n          { fix m'\n            assume asm: \"strict_dom g m' n\" and [simp]: \"m' \\<in> set (\\<alpha>n g)\"\n            with True psubset.prems(1) have \"\\<not>(strict_dom g m m')\" by auto\n            hence \"dominates g m' m\" using dominates_antitrans[of g m' n m] asm psubset.prems(2) by fastforce\n          }\n          thus ?thesis using psubset.prems(2) by - (rule exI[of _ m], auto simp:isIdom_def)\n        next\n          case False\n          then obtain m' where \"m' \\<in> A\" by auto\n          with psubset.prems(1) have m': \"m' \\<in> set (\\<alpha>n g)\" \"strict_dom g m' n\" \"strict_dom g m m'\" by auto\n          have \"?A m' \\<subset> ?A m\"\n          proof\n            show \"?A m' \\<noteq> ?A m\" using m' by auto\n            show \"?A m' \\<subseteq> ?A m\" using m' dominates_antisymm[of g m m'] dominates_trans[of g m] by auto\n          qed\n          thus ?thesis by (rule psubset.IH[of _ m', simplified psubset.prems(1)], simp_all add: m')\n        qed\n      qed\n    qed\n    show \"\\<exists>m. isIdom g n m\" by (rule 1[of \"?A (Entry g)\"], auto)\n  next\n    fix m m'\n    assume \"isIdom g n m\" \"isIdom g n m'\"\n    thus \"m = m'\" by - (rule dominates_antisymm[of g], auto simp:isIdom_def)\n  qed\n\n  lemma idom: \"\\<lbrakk>invar g; n \\<in> set (\\<alpha>n g) - {Entry g}\\<rbrakk> \\<Longrightarrow> isIdom g n (idom g n)\"\n  unfolding idom_def by (rule theI', rule idom_ex, auto)\n\n  lemma dominates_mid:\n    assumes \"dominates g n x\" \"dominates g x m\" \"g \\<turnstile> n-ns\\<rightarrow>m\" and[simp]: \"invar g\"\n    shows \"x \\<in> set ns\"\n  using assms\n  proof (cases \"n = x\")\n    case False\n    from assms(1) obtain ns\\<^sub>0 where ns\\<^sub>0: \"g \\<turnstile> Entry g-ns\\<^sub>0\\<rightarrow>n\" \"n \\<notin> set (butlast ns\\<^sub>0)\" by - (rule simple_Entry_path, auto)\n    with assms(3) have \"g \\<turnstile> Entry g-butlast ns\\<^sub>0@ns\\<rightarrow>m\" by auto\n    with assms(2) have \"x \\<in> set (butlast ns\\<^sub>0@ns)\" by (auto elim!:dominatesE)\n    moreover have \"x \\<notin> set (butlast ns\\<^sub>0)\"\n    proof\n      assume asm: \"x \\<in> set (butlast ns\\<^sub>0)\"\n      with ns\\<^sub>0 obtain ns\\<^sub>0' where ns\\<^sub>0': \"g \\<turnstile> Entry g-ns\\<^sub>0'\\<rightarrow>x\" \"n \\<notin> set (butlast ns\\<^sub>0')\"\n        by - (erule path2_split_ex, auto dest:in_set_butlastD simp: butlast_append split: if_split_asm)\n      show False by (metis False assms(1) ns\\<^sub>0' strict_domE)\n    qed\n    ultimately show ?thesis by simp\n  qed auto\n\n  definition shortestPath :: \"'g \\<Rightarrow> 'node \\<Rightarrow> nat\" where\n    \"shortestPath g n \\<equiv> (LEAST l. \\<exists>ns. length ns = l \\<and> g \\<turnstile> Entry g-ns\\<rightarrow>n)\"\n\n  lemma shortestPath_ex:\n    assumes \"n \\<in> set (\\<alpha>n g)\" \"invar g\"\n    obtains ns where \"g \\<turnstile> Entry g-ns\\<rightarrow>n\" \"distinct ns\" \"length ns = shortestPath g n\"\n  proof-\n    from assms obtain ns where \"g \\<turnstile> Entry g-ns\\<rightarrow>n\" by - (atomize_elim, rule Entry_reaches)\n    then obtain sns where sns: \"length sns = shortestPath g n\" \"g \\<turnstile> Entry g-sns\\<rightarrow>n\"\n      unfolding shortestPath_def\n      by -(atomize_elim, rule LeastI, auto)\n    then obtain sns' where sns': \"length sns' \\<le> shortestPath g n\" \"g \\<turnstile> Entry g-sns'\\<rightarrow>n\" \"distinct sns'\" by - (rule simple_path2, auto)\n    moreover from sns'(2) have \"shortestPath g n \\<le> length sns'\" unfolding shortestPath_def by - (rule Least_le, auto)\n    ultimately show thesis by -(rule that, auto)\n  qed\n\n  lemma[simp]: \"\\<lbrakk>n \\<in> set (\\<alpha>n g); invar g\\<rbrakk> \\<Longrightarrow> shortestPath g n \\<noteq> 0\"\n    by (metis length_0_conv path2_not_Nil2 shortestPath_ex)\n\n  lemma shortestPath_upper_bound:\n    assumes \"n \\<in> set (\\<alpha>n g)\" \"invar g\"\n    shows \"shortestPath g n \\<le> length (\\<alpha>n g)\"\n  proof-\n    from assms obtain ns where ns: \"g \\<turnstile> Entry g-ns\\<rightarrow>n\" \"length ns = shortestPath g n\" \"distinct ns\" by (rule shortestPath_ex)\n    hence \"shortestPath g n = length ns\" by simp\n    also have \"... = card (set ns)\" using ns(3) by (rule distinct_card[symmetric])\n    also have \"... \\<le> card (set (\\<alpha>n g))\" using ns(1) by - (rule card_mono, auto)\n    also have \"... \\<le> length (\\<alpha>n g)\" by (rule card_length)\n    finally show ?thesis .\n  qed\n\n  lemma shortestPath_predecessor:\n    assumes \"n \\<in> set (\\<alpha>n g) - {Entry g}\" and[simp]: \"invar g\"\n    obtains n' where \"Suc (shortestPath g n') = shortestPath g n\" \"n' \\<in> set (predecessors g n)\"\n  proof -\n    from assms obtain sns where sns: \"length sns = shortestPath g n\" \"g \\<turnstile> Entry g-sns\\<rightarrow>n\"\n      by - (rule shortestPath_ex, auto)\n    let ?n' = \"last (butlast sns)\"\n    from assms(1) sns(2) have 1: \"length sns \\<ge> 2\" by auto\n    hence prefix: \"g \\<turnstile> Entry g-butlast sns\\<rightarrow>last (butlast sns) \\<and> last (butlast sns) \\<in> set (predecessors g n)\"\n      using sns by -(rule path2_unsnoc, auto)\n    hence \"shortestPath g ?n' \\<le> length (butlast sns)\"\n      unfolding shortestPath_def by -(rule Least_le, rule exI[where x = \"butlast sns\"], simp)\n    with 1 sns(1) have 2: \"shortestPath g ?n' < shortestPath g n\" by auto\n    { assume asm: \"Suc (shortestPath g ?n') \\<noteq> shortestPath g n\"\n      obtain sns' where sns': \"g \\<turnstile> Entry g-sns'\\<rightarrow>?n'\" \"length sns' = shortestPath g ?n'\"\n        using prefix by - (rule shortestPath_ex, auto)\n      hence[simp]: \"g \\<turnstile> Entry g-sns'@[n]\\<rightarrow>n\" using prefix by auto\n      from asm 2 have \"Suc (shortestPath g ?n') < shortestPath g n\" by auto\n      from this[unfolded shortestPath_def, THEN not_less_Least, folded shortestPath_def, simplified, THEN spec[of _ \"sns'@[n]\"]]\n      have False using sns'(2) by auto\n    }\n    with prefix show thesis by - (rule that, auto)\n  qed\n\n  lemma successor_in_\\<alpha>n[simp]:\n    assumes \"predecessors g n \\<noteq> []\" and[simp]: \"invar g\"\n    shows \"n \\<in> set (\\<alpha>n g)\"\n  proof-\n    from assms(1) obtain m where \"m \\<in> set (predecessors g n)\" by (cases \"predecessors g n\", auto)\n    with assms(1) obtain m' e where \"(m',e,n) \\<in> \\<alpha>e g\" using inEdges_correct[of g n, THEN arg_cong[where f=\"(`) getTo\"]]\n      by (auto simp: predecessors_def simp del: inEdges_correct)\n    with assms(1) show ?thesis\n      by (auto simp: predecessors_def)\n  qed\n\n  lemma shortestPath_single_predecessor:\n    assumes \"predecessors g n = [m]\" and[simp]: \"invar g\"\n    shows \"shortestPath g m < shortestPath g n\"\n  proof-\n    from assms(1) have \"n \\<in> set (\\<alpha>n g) - {Entry g}\"\n      by (auto simp: predecessors_def Entry_unreachable)\n    thus ?thesis by (rule shortestPath_predecessor, auto simp: assms(1))\n  qed\n\n  lemma strict_dom_shortestPath_order:\n    assumes \"strict_dom g n m\" \"m \\<in> set (\\<alpha>n g)\" \"invar g\"\n    shows \"shortestPath g n < shortestPath g m\"\n  proof-\n    from assms(2,3) obtain sns where sns: \"g \\<turnstile> Entry g-sns\\<rightarrow>m\" \"length sns = shortestPath g m\"\n      by (rule shortestPath_ex)\n    with assms(1) sns(1) obtain sns' where sns': \"g \\<turnstile> Entry g-sns'\\<rightarrow>n\" \"prefix sns' sns\" by -(erule path2_prefix_ex, auto elim:dominatesE)\n    hence \"shortestPath g n \\<le> length sns'\"\n      unfolding shortestPath_def by -(rule Least_le, auto)\n    also have \"length sns' < length sns\"\n    proof-\n      from assms(1) sns(1) sns'(1) have \"sns' \\<noteq> sns\" by -(drule path2_last, drule path2_last, auto)\n      with sns'(2) have \"strict_prefix sns' sns\" by auto\n      thus ?thesis by (rule prefix_length_less)\n    qed\n    finally show ?thesis by (simp add:sns(2))\n  qed\n\n  lemma dominates_shortestPath_order:\n    assumes \"dominates g n m\" \"m \\<in> set (\\<alpha>n g)\" \"invar g\"\n    shows \"shortestPath g n \\<le> shortestPath g m\"\n  using assms by (cases \"n = m\", auto intro:strict_dom_shortestPath_order[THEN less_imp_le])\n\n  lemma strict_dom_trans:\n    assumes[simp]: \"invar g\"\n    assumes \"strict_dom g n m\" \"strict_dom g m m'\"\n    shows \"strict_dom g n m'\"\n  proof (rule, rule notI)\n    assume \"n = m'\"\n    moreover from assms(3) have \"m' \\<in> set (\\<alpha>n g)\" by auto\n    ultimately have \"dominates g m' n\" by auto\n    with assms(2) have \"dominates g m' m\" by - (rule dominates_trans, auto)\n    with assms(3) show False by - (erule conjE, drule dominates_antisymm[OF assms(1)], auto)\n  next\n    from assms show \"dominates g n m'\" by - (rule dominates_trans, auto)\n  qed\n\n  inductive EntryPath :: \"'g \\<Rightarrow> 'node list \\<Rightarrow> bool\" where\n    EntryPath_triv[simp]: \"EntryPath g [n]\"\n  | EntryPath_snoc[intro]: \"EntryPath g ns \\<Longrightarrow> shortestPath g m = Suc (shortestPath g (last ns)) \\<Longrightarrow> EntryPath g (ns@[m])\"\n\n  lemma[simp]:\n    assumes \"EntryPath g ns\" \"prefix ns' ns\" \"ns' \\<noteq> []\"\n    shows \"EntryPath g ns'\"\n  using assms proof induction\n    case (EntryPath_triv ns n)\n    thus ?case by (cases ns', auto)\n  qed auto\n\n  lemma EntryPath_suffix:\n    assumes \"EntryPath g ns\" \"suffix ns' ns\" \"ns' \\<noteq> []\"\n    shows \"EntryPath g ns'\"\n  using assms proof (induction arbitrary: ns')\n    case EntryPath_triv\n    thus ?case\n      by (metis EntryPath.EntryPath_triv append_Nil append_is_Nil_conv list.sel(3) Sublist.suffix_def tl_append2)\n  next\n    case (EntryPath_snoc g ns m)\n    from EntryPath_snoc.prems obtain ns'' where [simp]: \"ns' = ns''@[m]\"\n      by - (erule suffix_unsnoc, auto)\n    show ?case\n    proof (cases \"ns'' = []\")\n      case True\n      thus ?thesis by auto\n    next\n      case False\n      from EntryPath_snoc.prems(1) have \"suffix ns'' ns\" by (auto simp: Sublist.suffix_def)\n      with False have \"last ns'' = last ns\" by (auto simp: Sublist.suffix_def)\n      moreover from False have \"EntryPath g ns''\" using EntryPath_snoc.prems(1)\n        by - (rule EntryPath_snoc.IH, auto simp: Sublist.suffix_def)\n      ultimately show ?thesis using EntryPath_snoc.hyps(2)\n        by - (simp, rule EntryPath.EntryPath_snoc, simp_all)\n    qed\n  qed\n\n  lemma EntryPath_butlast_less_last:\n    assumes \"EntryPath g ns\" \"z \\<in> set (butlast ns)\"\n    shows \"shortestPath g z < shortestPath g (last ns)\"\n  using assms proof (induction)\n    case (EntryPath_snoc g ns m)\n    thus ?case by (cases \"z \\<in> set (butlast ns)\", auto dest: not_in_butlast)\n  qed simp\n\n  lemma EntryPath_distinct:\n    assumes \"EntryPath g ns\"\n    shows \"distinct ns\"\n  using assms\n  proof (induction)\n    case (EntryPath_snoc g ns m)\n    from this consider (non_distinct) \"m \\<in> set ns\" | \"distinct (ns @ [m])\" by auto\n    thus \"distinct (ns @ [m])\"\n    proof (cases)\n      case non_distinct\n      have \"EntryPath g (ns @ [m])\" using EntryPath_snoc by (intro EntryPath.intros(2))\n      with non_distinct\n      have \"False\"\n       using EntryPath_butlast_less_last butlast_snoc last_snoc less_not_refl by force\n      thus ?thesis by simp\n    qed\n  qed simp\n\n  lemma Entry_reachesE:\n    assumes \"n \\<in> set (\\<alpha>n g)\" and[simp]: \"invar g\"\n    obtains ns where \"g \\<turnstile> Entry g-ns\\<rightarrow>n\" \"EntryPath g ns\"\n  using assms(1) proof (induction \"shortestPath g n\" arbitrary:n)\n    case 0\n    hence False by simp\n    thus ?case..\n  next\n    case (Suc l)\n    note Suc.prems(2)[simp]\n    show ?case\n    proof (cases \"n = Entry g\")\n      case True\n      thus ?thesis by - (rule Suc.prems(1), auto)\n    next\n      case False\n      then obtain n' where n': \"shortestPath g n' = l\" \"n' \\<in> set (predecessors g n)\"\n        using Suc.hyps(2)[symmetric] by - (rule shortestPath_predecessor, auto)\n      moreover {\n        fix ns\n        assume asm: \"g \\<turnstile> Entry g-ns\\<rightarrow>n'\" \"EntryPath g ns\"\n        hence thesis using n' Suc.hyps(2) path2_last[OF asm(1)]\n          by - (rule Suc.prems(1)[of \"ns@[n]\"], auto)\n      }\n      ultimately show thesis by - (rule Suc.hyps(1), auto)\n    qed\n  qed\nend\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Formal_SSA/Graph_path.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.33558003255702734}}
{"text": "section \\<open>Tarjan's Algorithm\\<close>\ntheory Tarjan\nimports \n  Tarjan_LowLink\nbegin\ntext \\<open>We use the DFS Framework to implement Tarjan's algorithm.\n  Note that, currently, we only provide an abstract version, and no refinement to \n  efficient code.\n\\<close>\n\nsubsection \\<open>Preliminaries\\<close>\n(* Though this is a general lemma about dropWhile/takeWhile, it is probably only of use for this algorithm. *)\nlemma tjs_union:\n  fixes tjs u\n  defines \"dw \\<equiv> dropWhile ((\\<noteq>) u) tjs\"\n  defines \"tw \\<equiv> takeWhile ((\\<noteq>) u) tjs\"\n  assumes \"u \\<in> set tjs\"\n  shows \"set tjs = set (tl dw) \\<union> insert u (set tw)\"\nproof -\n  from takeWhile_dropWhile_id have \"set tjs = set (tw@dw)\" by (auto simp: dw_def tw_def)\n  hence \"set tjs = set tw \\<union> set dw\" by (metis set_append)\n  moreover from \\<open>u \\<in> set tjs\\<close> dropWhile_eq_Nil_conv have \"dw \\<noteq> []\" by (auto simp: dw_def)\n  from hd_dropWhile[OF this[unfolded dw_def]] have \"hd dw = u\" by (simp add: dw_def)\n  with \\<open>dw \\<noteq> []\\<close> have \"set dw = insert u (set (tl dw))\" by (cases \"dw\") auto\n  ultimately show ?thesis by blast\nqed\n\nsubsection \\<open>Instantiation of the DFS-Framework\\<close>\nrecord 'v tarjan_state = \"'v state\" +\n  sccs :: \"'v set set\"\n  lowlink :: \"'v \\<rightharpoonup> nat\"\n  tj_stack :: \"'v list\"\n\ntype_synonym 'v tarjan_param = \"('v, ('v,unit) tarjan_state_ext) parameterization\"\n\nabbreviation \"the_lowlink s v \\<equiv> the (lowlink s v)\"\n\ncontext timing_syntax\nbegin\n  notation the_lowlink (\"\\<zeta>\")\nend\n\nlocale Tarjan_def = graph_defs G\n  for G :: \"('v, 'more) graph_rec_scheme\"\nbegin\n  context begin interpretation timing_syntax .\n\n  definition tarjan_disc :: \"'v \\<Rightarrow> 'v tarjan_state \\<Rightarrow> ('v,unit) tarjan_state_ext nres\" where\n    \"tarjan_disc v s = RETURN \\<lparr> sccs = sccs s, \n                                 lowlink = (lowlink s)(v \\<mapsto> \\<delta> s v),\n                                 tj_stack = v#tj_stack s\\<rparr>\"\n\n  definition tj_stack_pop :: \"'v list \\<Rightarrow> 'v \\<Rightarrow> ('v list \\<times> 'v set) nres\" where\n    \"tj_stack_pop tjs u = RETURN (tl (dropWhile ((\\<noteq>) u) tjs), insert u (set (takeWhile ((\\<noteq>) u) tjs)))\"\n\n  lemma tj_stack_pop_set:\n    \"tj_stack_pop tjs u \\<le> SPEC (\\<lambda>(tjs',scc). u \\<in> set tjs \\<longrightarrow> set tjs = set tjs' \\<union> scc \\<and> u \\<in> scc)\"\n  proof -\n    from tjs_union[of u tjs] show ?thesis\n      unfolding tj_stack_pop_def\n      by (refine_vcg) auto\n  qed\n\n  lemmas tj_stack_pop_set_leof_rule = weaken_SPEC[OF tj_stack_pop_set, THEN leof_lift]\n\n  definition tarjan_fin :: \"'v \\<Rightarrow> 'v tarjan_state \\<Rightarrow> ('v,unit) tarjan_state_ext nres\" where\n    \"tarjan_fin v s = do {\n           let ll = (if stack s = [] then lowlink s \n                     else let u = hd (stack s) in\n                          (lowlink s)(u \\<mapsto> min (\\<zeta> s u) (\\<zeta> s v)));\n           let s' = s\\<lparr> lowlink := ll \\<rparr>;\n\n           ASSERT (v \\<in> set (tj_stack s));\n           ASSERT (distinct (tj_stack s));\n           if \\<zeta> s v = \\<delta> s v then do {\n                ASSERT (scc_root' E s v (scc_of E v));\n                (tjs,scc) \\<leftarrow> tj_stack_pop (tj_stack s) v;\n                RETURN (state.more (s'\\<lparr> tj_stack := tjs, sccs := insert scc (sccs s)\\<rparr>))\n           } else do {\n                ASSERT (\\<not> scc_root' E s v (scc_of E v));\n                RETURN (state.more s')\n           }}\"\n\n  definition tarjan_back :: \"'v \\<Rightarrow> 'v \\<Rightarrow> 'v tarjan_state \\<Rightarrow> ('v,unit) tarjan_state_ext nres\" where\n    \"tarjan_back u v s = (\n       if \\<delta> s v < \\<delta> s u \\<and> v \\<in> set (tj_stack s) then\n         let ul' = min (\\<zeta> s u) (\\<delta> s v)\n         in RETURN (state.more (s\\<lparr> lowlink := (lowlink s)(u\\<mapsto>ul') \\<rparr>))\n       else NOOP s)\"\nend (* end timing syntax *)\n\n  definition tarjan_params :: \"'v tarjan_param\" where\n    \"tarjan_params = \\<lparr>\n      on_init = RETURN \\<lparr> sccs = {}, lowlink = Map.empty, tj_stack = [] \\<rparr>,\n      on_new_root = tarjan_disc,\n      on_discover = \\<lambda>u. tarjan_disc,\n      on_finish = tarjan_fin,\n      on_back_edge = tarjan_back,\n      on_cross_edge = tarjan_back,\n      is_break = \\<lambda>s. False \\<rparr>\"\n\n  schematic_goal tarjan_params_simps[simp]:\n    \"on_init tarjan_params = ?OI\"\n    \"on_new_root tarjan_params = ?ONR\"\n    \"on_discover tarjan_params = ?OD\"\n    \"on_finish tarjan_params = ?OF\"\n    \"on_back_edge tarjan_params = ?OBE\"\n    \"on_cross_edge tarjan_params = ?OCE\"\n    \"is_break tarjan_params = ?IB\"\n    unfolding tarjan_params_def gen_parameterization.simps\n    by (rule refl)+\n\n  sublocale param_DFS_defs G tarjan_params .\nend\n\nlocale Tarjan = Tarjan_def G +\n                param_DFS G tarjan_params\n  for G :: \"('v, 'more) graph_rec_scheme\"\nbegin\n\n  \n\n  lemma sccs_more_cong[cong]:\"state.more s = state.more s' \\<Longrightarrow> sccs s = sccs s'\"\n    by (cases s, cases s') simp\n  lemma lowlink_more_cong[cong]:\"state.more s = state.more s' \\<Longrightarrow> lowlink s = lowlink s'\"\n    by (cases s, cases s') simp\n  lemma tj_stack_more_cong[cong]:\"state.more s = state.more s' \\<Longrightarrow> tj_stack s = tj_stack s'\"\n    by (cases s, cases s') simp\n\n   lemma [simp]: \n     \"s\\<lparr> state.more := \\<lparr>sccs = sc, lowlink = l, tj_stack = t\\<rparr>\\<rparr>\n      = s\\<lparr> sccs := sc, lowlink := l, tj_stack := t\\<rparr>\"                  \n    by (cases s) simp\nend\n\nlocale Tarjan_invar = Tarjan +\n  DFS_invar where param = tarjan_params\n\ncontext Tarjan_def begin\n  lemma Tarjan_invar_eq[simp]:\n    \"DFS_invar G tarjan_params s \\<longleftrightarrow> Tarjan_invar G s\" (is \"?D \\<longleftrightarrow> ?T\")\n  proof\n    assume ?D then interpret DFS_invar where param=tarjan_params .\n    show ?T ..\n  next\n    assume ?T then interpret Tarjan_invar .\n    show ?D ..\n  qed\nend\n\nsubsection \\<open>Correctness Proof\\<close>\ncontext Tarjan begin\n  lemma i_tj_stack_discovered:\n    \"is_invar (\\<lambda>s. set (tj_stack s) \\<subseteq> dom (discovered s))\"\n  proof (induct rule: establish_invarI)\n    case (finish s)\n    from finish show ?case\n      apply simp\n      unfolding tarjan_fin_def\n      apply (refine_vcg tj_stack_pop_set_leof_rule)\n      apply auto\n      done\n  qed (auto simp add: tarjan_disc_def tarjan_back_def)\n\n  lemmas (in Tarjan_invar) tj_stack_discovered =\n    i_tj_stack_discovered[THEN make_invar_thm]\n\n  lemma i_tj_stack_distinct:\n    \"is_invar (\\<lambda>s. distinct (tj_stack s))\"\n  proof (induct rule: establish_invarI_ND)\n    case (new_discover s s' v) then interpret Tarjan_invar where s=s by simp\n    from new_discover tj_stack_discovered have \"v \\<notin> set (tj_stack s)\" by auto\n    with new_discover show ?case by (simp add: tarjan_disc_def)\n  next\n    case (finish s) thus ?case\n      apply simp\n      unfolding tarjan_fin_def tj_stack_pop_def\n      apply (refine_vcg)\n      apply (auto intro: distinct_tl)\n      done\n  qed (simp_all add: tarjan_back_def)\n\n  lemmas (in Tarjan_invar) tj_stack_distinct =\n    i_tj_stack_distinct[THEN make_invar_thm]\n\n  context begin interpretation timing_syntax .\n  lemma i_tj_stack_incr_disc:\n    \"is_invar (\\<lambda>s. \\<forall>k<length (tj_stack s). \\<forall>j<k. \\<delta> s (tj_stack s ! j) > \\<delta> s (tj_stack s ! k))\"\n  proof (induct rule: establish_invarI_ND)\n    case (new_discover s s' v) then interpret Tarjan_invar where s=s by simp\n\n    from new_discover tj_stack_discovered have \"v \\<notin> set (tj_stack s)\" by auto\n    moreover {\n      fix k j\n      assume \"k < Suc (length (tj_stack s))\" \"j < k\"\n      hence \"k - Suc 0 < length (tj_stack s)\" by simp\n      hence \"tj_stack s ! (k - Suc 0) \\<in> set (tj_stack s)\" using nth_mem by metis\n      with tj_stack_discovered timing_less_counter have \"\\<delta> s (tj_stack s ! (k - Suc 0)) < counter s\" by blast\n    }\n    moreover {\n      fix k j\n      define k' where \"k' = k - Suc 0\"\n      define j' where \"j' = j - Suc 0\"\n\n      assume A: \"k < Suc (length (tj_stack s))\" \"j < k\" \"(v#tj_stack s) ! j \\<noteq> v\"\n      hence gt_0: \"j > 0 \\<and> k>0\" by (cases \"j=0\") simp_all\n      moreover with \\<open>j < k\\<close> have \"j' < k'\" by (simp add: j'_def k'_def)\n      moreover from A have \"k' < length (tj_stack s)\" by (simp add: k'_def)\n      ultimately have \"\\<delta> s (tj_stack s ! j') > \\<delta> s (tj_stack s ! k')\"\n        using new_discover by blast\n      with gt_0 have \"\\<delta> s ((v#tj_stack s) ! j) > \\<delta> s (tj_stack s ! k')\"\n        unfolding j'_def\n        by (simp add: nth_Cons')\n    }\n\n    ultimately show ?case \n      using new_discover\n      by (auto simp add: tarjan_disc_def)\n  next\n    case (finish s s' u)\n\n    {\n      let ?dw = \"dropWhile ((\\<noteq>) u) (tj_stack s)\"\n      let ?tw = \"takeWhile ((\\<noteq>) u) (tj_stack s)\"\n\n      fix a k j\n      assume A: \"a = tl ?dw\" \"k < length a\" \"j < k\"\n      and \"u \\<in> set (tj_stack s)\"\n      hence \"?dw \\<noteq> []\" by auto\n\n      define j' k' where \"j' = Suc j + length ?tw\" and \"k' = Suc k + length ?tw\"\n      with \\<open>j < k\\<close> have \"j' < k'\" by simp\n      \n      have \"length (tj_stack s) = length ?tw + length ?dw\"\n        by (simp add: length_append[symmetric])\n      moreover from A have *: \"Suc k < length ?dw\" and **: \"Suc j < length ?dw\" by auto\n      ultimately have \"k' < length (tj_stack s)\" by (simp add: k'_def)\n\n      with finish \\<open>j'<k'\\<close> have \"\\<delta> s (tj_stack s ! k') < \\<delta> s (tj_stack s ! j')\" by simp\n      also from dropWhile_nth[OF *] have \"tj_stack s ! k' = ?dw ! Suc k\"\n        by (simp add: k'_def)\n      also from dropWhile_nth[OF **] have \"tj_stack s ! j' = ?dw ! Suc j\"\n        by (simp add: j'_def)\n      also from nth_tl[OF \\<open>?dw \\<noteq> []\\<close>] have \"?dw ! Suc k = a ! k\" by (simp add: A)\n      also from nth_tl[OF \\<open>?dw \\<noteq> []\\<close>] have \"?dw ! Suc j = a ! j\" by (simp add: A)\n      finally have \"\\<delta> s (a ! k) < \\<delta> s (a ! j)\" .\n    } note aux = this\n\n    from finish show ?case\n      apply simp\n      unfolding tarjan_fin_def tj_stack_pop_def\n      apply refine_vcg\n      apply (auto intro!: aux)\n      done\n  qed (simp_all add: tarjan_back_def)\nend end\n\ncontext Tarjan_invar begin context begin interpretation timing_syntax .\n  lemma tj_stack_incr_disc:\n    assumes \"k < length (tj_stack s)\"\n    and \"j < k\"\n    shows \"\\<delta> s (tj_stack s ! j) > \\<delta> s (tj_stack s ! k)\"\n    using assms i_tj_stack_incr_disc[THEN make_invar_thm]\n    by blast\n\n  lemma tjs_disc_dw_tw:\n    fixes u\n    defines \"dw \\<equiv> dropWhile ((\\<noteq>) u) (tj_stack s)\"\n    defines \"tw \\<equiv> takeWhile ((\\<noteq>) u) (tj_stack s)\"\n    assumes \"x \\<in> set dw\" \"y \\<in> set tw\"\n    shows \"\\<delta> s x < \\<delta> s y\"\n  proof -\n    from assms obtain k where k: \"dw ! k = x\" \"k < length dw\" by (metis in_set_conv_nth)\n    from assms obtain j where j: \"tw ! j = y\" \"j < length tw\" by (metis in_set_conv_nth)\n\n    have \"length (tj_stack s) = length tw + length dw\"\n        by (simp add: length_append[symmetric] tw_def dw_def)\n    with k j have \"\\<delta> s (tj_stack s ! (k + length tw)) < \\<delta> s (tj_stack s ! j)\"\n      by (simp add: tj_stack_incr_disc)\n    also from j takeWhile_nth have \"tj_stack s ! j = y\" by (metis tw_def)\n    also from dropWhile_nth k have \"tj_stack s ! (k + length tw) = x\" by (metis tw_def dw_def)\n    finally show ?thesis .\n  qed\nend end\n\ncontext Tarjan begin context begin interpretation timing_syntax .\n  lemma i_sccs_finished_stack_ss_tj_stack:\n    \"is_invar (\\<lambda>s. \\<Union>(sccs s) \\<subseteq> dom (finished s) \\<and> set (stack s) \\<subseteq> set (tj_stack s))\"\n  proof (induct rule: establish_invarI)\n    case (finish s s' u) then interpret Tarjan_invar where s=s by simp\n\n    let ?tw = \"takeWhile ((\\<noteq>) u) (tj_stack s)\"\n    let ?dw = \"dropWhile ((\\<noteq>) u) (tj_stack s)\"\n\n    {\n      fix x\n      assume A: \"x \\<noteq> u\" \"x \\<in> set ?tw\" \"u \\<in> set (tj_stack s)\"\n      hence x_tj: \"x \\<in> set (tj_stack s)\" by (auto dest: set_takeWhileD)\n\n      have \"x \\<in> dom (finished s)\"\n      proof (rule ccontr)\n        assume \"x \\<notin> dom (finished s)\"\n        with x_tj tj_stack_discovered discovered_eq_finished_un_stack have \"x \\<in> set (stack s)\" by blast\n        with \\<open>x\\<noteq>u\\<close> finish have \"x \\<in> set (tl (stack s))\" by (cases \"stack s\") auto\n        with tl_lt_stack_hd_discover finish have *: \"\\<delta> s x < \\<delta> s u\" by simp\n\n        from A have \"?dw \\<noteq> []\" by simp\n        with hd_dropWhile[OF this] hd_in_set have \"u \\<in> set ?dw\" by metis\n        with tjs_disc_dw_tw \\<open>x \\<in> set ?tw\\<close> have \"\\<delta> s u < \\<delta> s x\" by simp\n\n        with * show False by force\n      qed\n      hence \"\\<exists>y. finished s x = Some y\" by blast\n    } note aux_scc = this\n\n    {\n      fix  x\n      assume A: \"x \\<in> set (tl (stack s))\" \"u \\<in> set (tj_stack s)\"\n      with finish stack_distinct have \"x \\<noteq> u\" by (cases \"stack s\") auto\n\n      moreover\n      from A have \"x \\<in> set (stack s)\" by (metis in_set_tlD)\n      with stack_not_finished have \"x \\<notin> dom (finished s)\" by simp\n      with A aux_scc[OF \\<open>x \\<noteq> u\\<close>] have \"x \\<notin> set ?tw\" by blast\n\n      moreover \n      from finish \\<open>x \\<in> set (stack s)\\<close> have \"x \\<in> set (tj_stack s)\" by auto\n\n      moreover note tjs_union[OF \\<open>u \\<in> set (tj_stack s)\\<close>]\n\n      ultimately have \"x \\<in> set (tl ?dw)\" by blast\n    } note aux_tj = this\n      \n    from finish show ?case\n      apply simp\n      unfolding tarjan_fin_def tj_stack_pop_def\n      apply (refine_vcg)\n      using aux_scc aux_tj apply (auto dest: in_set_tlD)\n      done\n  qed (auto simp add: tarjan_disc_def tarjan_back_def)\n\n  lemma i_tj_stack_ss_stack_finished:\n    \"is_invar (\\<lambda>s. set (tj_stack s) \\<subseteq> set (stack s) \\<union> dom (finished s))\"\n  proof (induct rule: establish_invarI)\n    case (finish s) thus ?case\n      apply simp\n      unfolding tarjan_fin_def\n      apply (refine_vcg tj_stack_pop_set_leof_rule)\n      apply ((simp, cases \"stack s\", simp_all)[])+\n      done\n  qed (auto simp add: tarjan_disc_def tarjan_back_def)\n\n  lemma i_finished_ss_sccs_tj_stack:\n    \"is_invar (\\<lambda>s. dom (finished s) \\<subseteq> \\<Union>(sccs s) \\<union> set (tj_stack s))\"\n  proof (induction rule: establish_invarI_ND)\n    case (new_discover s s' v) then interpret Tarjan_invar where s=s by simp\n    from new_discover finished_discovered have \"v \\<notin> dom (finished s)\" by auto\n    with new_discover show ?case\n      by (auto simp add: tarjan_disc_def)\n  next\n    case (finish s s' u) then interpret Tarjan_invar where s=s by simp\n    from finish show ?case\n      apply simp\n      unfolding tarjan_fin_def\n      apply (refine_vcg tj_stack_pop_set_leof_rule)\n      apply auto\n      done\n  qed (simp_all add: tarjan_back_def)\nend end\n\ncontext Tarjan_invar begin\n  lemmas finished_ss_sccs_tj_stack =\n    i_finished_ss_sccs_tj_stack[THEN make_invar_thm]\n  \n  lemmas tj_stack_ss_stack_finished =\n    i_tj_stack_ss_stack_finished[THEN make_invar_thm]\n\n  lemma sccs_finished:\n    \"\\<Union>(sccs s) \\<subseteq> dom (finished s)\"\n    using i_sccs_finished_stack_ss_tj_stack[THEN make_invar_thm]\n    by blast\n\n  lemma stack_ss_tj_stack:\n    \"set (stack s) \\<subseteq> set (tj_stack s)\"\n    using i_sccs_finished_stack_ss_tj_stack[THEN make_invar_thm]\n    by blast\n  \n  lemma hd_stack_in_tj_stack:\n    \"stack s \\<noteq> [] \\<Longrightarrow> hd (stack s) \\<in> set (tj_stack s)\"\n    using stack_ss_tj_stack hd_in_set\n    by auto\nend\n\ncontext Tarjan begin context begin interpretation timing_syntax .\n  lemma i_no_finished_root:\n    \"is_invar (\\<lambda>s. scc_root s r scc \\<and> r \\<in> dom (finished s) \\<longrightarrow> (\\<forall>x \\<in> scc. x \\<notin> set (tj_stack s)))\"\n  proof (induct rule: establish_invarI_ND_CB)\n    case (new_discover s s' v) then interpret Tarjan_invar where s=s by simp\n    {\n      fix x\n      let ?s = \"s'\\<lparr>state.more := x\\<rparr>\"\n\n      assume TRANS: \"\\<And>\\<Psi>. tarjan_disc v s' \\<le>\\<^sub>n SPEC \\<Psi> \\<Longrightarrow> \\<Psi> x\"\n      and inv': \"DFS_invar G tarjan_params (s'\\<lparr>state.more := x\\<rparr>)\"\n      and r: \"scc_root ?s r scc\" \"r \\<in> dom (finished s')\"\n\n      from inv' interpret s': Tarjan_invar where s=\"?s\" by simp\n\n      have \"tj_stack ?s = v#tj_stack s\"\n        by (rule TRANS) (simp add: new_discover tarjan_disc_def)\n      \n      moreover\n      from r s'.scc_root_finished_impl_scc_finished have \"scc \\<subseteq> dom (finished ?s)\" by auto\n      with new_discover finished_discovered have \"v \\<notin> scc\" by force\n\n      moreover\n      from r finished_discovered new_discover have \"r \\<in> dom (discovered s)\" by auto\n      with r inv' new_discover have \"scc_root s r scc\"\n        apply (intro scc_root_transfer[where s'=\"?s\", THEN iffD2])\n        apply clarsimp_all\n        done\n      with new_discover r have \"\\<forall>x \\<in> scc. x \\<notin> set (tj_stack s')\" by simp\n\n      ultimately have \"\\<forall>x\\<in>scc. x \\<notin> set (tj_stack ?s)\" by (auto simp: new_discover)\n    }\n    with new_discover show ?case by (simp add: pw_leof_iff)\n  next\n    case (cross_back_edge s s' u v) then interpret Tarjan_invar where s=s by simp\n    { \n      fix x\n      let ?s = \"s'\\<lparr>state.more := x\\<rparr>\"\n      assume TRANS: \"\\<And>\\<Psi>. tarjan_back u v s' \\<le>\\<^sub>n SPEC \\<Psi> \\<Longrightarrow> \\<Psi> x\"\n      and r: \"scc_root ?s r scc\" \"r \\<in> dom (finished s')\"\n      with cross_back_edge have \"scc_root s r scc\"\n        by (simp add: scc_root_transfer'[where s'=\"?s\"])\n\n      moreover\n      have \"tj_stack ?s = tj_stack s\" by (rule TRANS) (simp add: cross_back_edge tarjan_back_def)\n\n      ultimately  have \"\\<forall>x\\<in>scc. x \\<notin> set (tj_stack ?s)\"\n        using cross_back_edge r by simp\n    }\n    with cross_back_edge show ?case by (simp add: pw_leof_iff)\n  next\n    case (finish s s' u) then interpret Tarjan_invar where s=s by simp\n    \n    {\n      fix x\n      let ?s = \"s'\\<lparr>state.more := x\\<rparr>\"\n      assume TRANS:  \"\\<And>\\<Psi>. tarjan_fin u s' \\<le>\\<^sub>n SPEC \\<Psi> \\<Longrightarrow> \\<Psi> x\"\n      and inv': \"DFS_invar G tarjan_params (s'\\<lparr>state.more := x\\<rparr>)\"\n      and r: \"scc_root ?s r scc\" \"r \\<in> dom (finished s')\"\n\n      from inv' interpret s': Tarjan_invar where s=\"?s\" by simp\n\n      have \"\\<forall>x\\<in>scc. x \\<notin> set (tj_stack ?s)\"\n      proof (cases \"r = u\")\n        case False with finish r have \"\\<forall>x\\<in>scc. x \\<notin> set (tj_stack s)\"\n          using scc_root_transfer'[where s'=\"?s\"]\n          by simp\n        moreover have \"set (tj_stack ?s) \\<subseteq> set (tj_stack s)\"\n          apply (rule TRANS)\n          unfolding tarjan_fin_def\n          apply (refine_vcg tj_stack_pop_set_leof_rule)\n          apply (simp_all add: finish)\n          done\n        ultimately show ?thesis by blast\n      next\n        case True with r s'.scc_root_unique_is_scc have \"scc_root ?s u (scc_of E u)\" by simp\n        with s'.scc_root_transfer'[where s'=s'] finish have \"scc_root s' u (scc_of E u)\" by simp\n\n        moreover\n        hence [simp]: \"tj_stack ?s = tl (dropWhile ((\\<noteq>) u) (tj_stack s))\"\n          apply (rule_tac TRANS)\n          unfolding tarjan_fin_def tj_stack_pop_def\n          apply (refine_vcg)\n          apply (simp_all add: finish)\n          done\n\n        {\n          let ?dw = \"dropWhile ((\\<noteq>) u) (tj_stack s)\"\n          let ?tw = \"takeWhile ((\\<noteq>) u) (tj_stack s)\"\n          fix x\n          define j::nat where \"j = 0\"\n          \n          assume x: \"x \\<in> set (tj_stack ?s)\"\n          then obtain i where i: \"i < length (tj_stack ?s)\" \"tj_stack ?s ! i = x\"\n            by (metis in_set_conv_nth)\n\n          have \"length (tj_stack s) = length ?tw + length ?dw\"\n            by (simp add: length_append[symmetric])\n          with i have \"\\<delta> s (tj_stack s ! (Suc i + length ?tw)) < \\<delta> s (tj_stack s ! length ?tw)\"\n            by (simp add: tj_stack_incr_disc)\n\n          also from hd_stack_in_tj_stack finish have ne: \"?dw \\<noteq> []\" and \"length ?dw > 0\" by simp_all\n          from hd_dropWhile[OF ne] hd_conv_nth[OF ne] have \"?dw ! 0 = u\" by simp\n          with dropWhile_nth[OF \\<open>length ?dw > 0\\<close>] have \"tj_stack s ! length ?tw = u\" by simp\n\n          also from i have \"?dw ! Suc i = x\" \"Suc i < length ?dw\" by (simp_all add: nth_tl[OF ne])\n          with dropWhile_nth[OF this(2)] have \"tj_stack s ! (Suc i + length ?tw) = x\" by simp\n\n          finally have \"\\<delta> ?s x < \\<delta> ?s u\" by (simp add: finish)\n\n          moreover from x s'.tj_stack_discovered have \"x \\<in> dom (discovered ?s)\" by auto\n          ultimately have \"x \\<notin> scc\" using s'.scc_root_disc_le r True by force\n        } thus ?thesis by metis\n      qed\n    }\n    with finish show ?case by (simp add: pw_leof_iff)\n  qed simp_all\nend end\n\ncontext Tarjan_invar begin\n  \n\n  context begin interpretation timing_syntax .\n\n  lemma tj_stack_reach_stack:\n    assumes \"u \\<in> set (tj_stack s)\"\n    shows \"\\<exists>v \\<in> set (stack s). (u,v) \\<in> E\\<^sup>* \\<and> \\<delta> s v \\<le> \\<delta> s u\"\n  proof -\n    have u_scc: \"u \\<in> scc_of E u\" by simp\n\n    from assms tj_stack_discovered have u_disc: \"u \\<in> dom (discovered s)\" by auto\n    with scc_root_of_node_exists obtain r where r: \"scc_root s r (scc_of E u)\" by blast\n    have \"r \\<in> set (stack s)\"\n    proof (rule ccontr)\n      assume \"r \\<notin> set (stack s)\"\n      with r[unfolded scc_root_def] stack_set_def have \"r \\<in> dom (finished s)\" by simp\n      with u_scc have \"u \\<notin> set (tj_stack s)\" using no_finished_root r by blast\n      with assms show False by contradiction\n    qed\n    moreover from r scc_reach_scc_root u_scc u_disc have \"(u,r) \\<in> E\\<^sup>*\" by blast\n    moreover from r scc_root_disc_le u_scc u_disc have \"\\<delta> s r \\<le> \\<delta> s u\" by blast\n    ultimately show ?thesis by metis\n  qed\n\n  lemma tj_stack_reach_hd_stack:\n    assumes \"v \\<in> set (tj_stack s)\"\n    shows \"(v, hd (stack s)) \\<in> E\\<^sup>*\"\n  proof -\n    from tj_stack_reach_stack assms obtain r where r: \"r \\<in> set (stack s)\" \"(v,r) \\<in> E\\<^sup>*\" by blast\n    hence \"r = hd (stack s) \\<or> r \\<in> set (tl (stack s))\" by (cases \"stack s\") auto\n    thus ?thesis\n    proof\n      assume \"r = hd (stack s)\" with r show ?thesis by simp\n    next\n      from r have ne :\"stack s \\<noteq> []\" by auto\n\n      assume \"r \\<in> set (tl (stack s))\"\n      with tl_stack_hd_tree_path ne have \"(r,hd (stack s)) \\<in> (tree_edges s)\\<^sup>+\" by simp\n      with trancl_mono_mp tree_edges_ssE have \"(r,hd (stack s))\\<in>E\\<^sup>*\" by (metis rtrancl_eq_or_trancl)\n      with \\<open>(v,r)\\<in>E\\<^sup>*\\<close> show ?thesis by (metis rtrancl_trans)\n    qed\n  qed\n  \n  lemma empty_stack_imp_empty_tj_stack: \n    assumes \"stack s = []\"\n    shows \"tj_stack s = []\"\n  proof (rule ccontr)\n    assume ne: \"tj_stack s \\<noteq> []\"\n    then obtain x where x: \"x \\<in> set (tj_stack s)\" by auto\n    with tj_stack_reach_stack obtain r where \"r \\<in> set (stack s)\" by auto\n    with assms show False by simp\n  qed\n  \n  lemma stacks_eq_iff: \"stack s = [] \\<longleftrightarrow> tj_stack s = []\"\n    using empty_stack_imp_empty_tj_stack stack_ss_tj_stack\n    by auto\nend end\n\ncontext Tarjan begin context begin interpretation timing_syntax .\n  lemma i_sccs_are_sccs:\n    \"is_invar (\\<lambda>s. \\<forall>scc \\<in> sccs s. is_scc E scc)\"\n  proof (induction rule: establish_invarI)\n    case (finish s s' u) then interpret Tarjan_invar where s=s by simp\n    from finish have EQ[simp]:\n      \"finished s' = (finished s)(u \\<mapsto> counter s)\"\n      \"discovered s' = discovered s\"\n      \"tree_edges s' = tree_edges s\"\n      \"sccs s' = sccs s\"\n      \"tj_stack s' = tj_stack s\"\n      by simp_all\n\n    {\n      fix x\n\n      let ?s = \"s'\\<lparr>state.more := x\\<rparr>\"\n      assume TRANS: \"\\<And>\\<Psi>. tarjan_fin u s' \\<le>\\<^sub>n SPEC \\<Psi> \\<Longrightarrow> \\<Psi> x\"\n      and inv': \"DFS_invar G tarjan_params (s'\\<lparr>state.more := x\\<rparr>)\"\n      then interpret s': Tarjan_invar where s=\"?s\" by simp\n      \n      from finish hd_in_set stack_set_def have \n        u_disc: \"u \\<in> dom (discovered s)\" \n        and u_n_fin: \"u \\<notin> dom (finished s)\" by blast+\n\n      have \"\\<forall>scc \\<in> sccs ?s. is_scc E scc\"\n      proof (cases \"scc_root s' u (scc_of E u)\")\n        case False\n        have \"sccs ?s = sccs s\"\n          apply (rule TRANS)\n          unfolding tarjan_fin_def tj_stack_pop_def\n          by (refine_vcg) (simp_all add: False)\n        thus ?thesis by (simp add: finish)\n      next\n        case True\n        let ?dw = \"dropWhile ((\\<noteq>) u) (tj_stack s)\"\n        let ?tw = \"takeWhile ((\\<noteq>) u) (tj_stack s)\"\n        let ?tw' = \"insert u (set ?tw)\"\n\n        have [simp]: \"sccs ?s = insert ?tw' (sccs s)\"\n          apply (rule TRANS)\n          unfolding tarjan_fin_def tj_stack_pop_def\n          by (refine_vcg) (simp_all add: True)\n\n        have [simp]: \"tj_stack ?s = tl ?dw\"\n          apply (rule TRANS)\n          unfolding tarjan_fin_def tj_stack_pop_def\n          by (refine_vcg) (simp_all add: True)\n\n        from True scc_root_transfer'[where s'=s'] have \"scc_root s u (scc_of E u)\" by simp\n        with inv' scc_root_transfer[where s'=\"?s\"] u_disc have u_root: \"scc_root ?s u (scc_of E u)\" by simp\n\n        have \"?tw' \\<subseteq> scc_of E u\"\n        proof\n          fix v assume v: \"v \\<in> ?tw'\"\n          show \"v \\<in> scc_of E u\"\n          proof cases\n            assume \"v \\<noteq> u\" with v have v: \"v \\<in> set ?tw\" by auto\n            hence v_tj: \"v \\<in> set (tj_stack s)\" by (auto dest: set_takeWhileD)\n            with tj_stack_discovered have v_disc: \"v \\<in> dom (discovered s)\" by auto\n\n            from hd_stack_in_tj_stack finish  have \"?dw \\<noteq> []\" by simp\n            with hd_dropWhile[OF this] hd_in_set have \"u \\<in> set ?dw\" by metis\n            with v have \"\\<delta> s v > \\<delta> s u\" using tjs_disc_dw_tw by blast\n           \n            moreover have \"v \\<in> dom (finished s)\"\n            proof (rule ccontr)\n              assume \"v \\<notin> dom (finished s)\" \n              with v_disc stack_set_def have \"v \\<in> set (stack s)\" by auto\n              with \\<open>v\\<noteq>u\\<close> finish have \"v \\<in> set (tl (stack s))\" by (cases \"stack s\") auto\n              with tl_lt_stack_hd_discover finish have \"\\<delta> s v < \\<delta> s u\" by simp\n              with \\<open>\\<delta> s v > \\<delta> s u\\<close> show False by force\n            qed\n\n            ultimately have \"(u,v) \\<in> (tree_edges s)\\<^sup>+\" \n              using parenthesis_impl_tree_path_not_finished[OF u_disc] u_n_fin\n              by force\n            with trancl_mono_mp tree_edges_ssE have \"(u,v)\\<in>E\\<^sup>*\" by (metis rtrancl_eq_or_trancl)\n\n            moreover\n            from tj_stack_reach_hd_stack v_tj finish have \"(v,u)\\<in>E\\<^sup>*\" by simp \n\n            moreover have \"is_scc E (scc_of E u)\" \"u \\<in> scc_of E u\" by simp_all\n            ultimately show ?thesis using is_scc_closed by metis\n          qed simp\n        qed\n        moreover have \"scc_of E u \\<subseteq> ?tw'\"\n        proof\n          fix v assume v: \"v \\<in> scc_of E u\"\n          moreover note u_root\n          moreover have \"u \\<in> dom (finished ?s)\" by simp\n          ultimately have \"v \\<in> dom (finished ?s)\" \"v \\<notin> set (tj_stack ?s)\" \n            using s'.scc_root_finished_impl_scc_finished s'.no_finished_root\n            by auto\n          with s'.finished_ss_sccs_tj_stack have \"v \\<in> \\<Union>(sccs ?s)\" by blast\n          hence \"v \\<in> \\<Union>(sccs s) \\<or> v \\<in> ?tw'\" by auto\n          thus \"v \\<in> ?tw'\"\n          proof\n            assume \"v \\<in> \\<Union>(sccs s)\"\n            then obtain scc where scc: \"v \\<in> scc\" \"scc \\<in> sccs s\" by auto\n            moreover with finish have \"is_scc E scc\" by simp\n            moreover have \"is_scc E (scc_of E u)\" by simp\n            moreover note v\n            ultimately have \"scc = scc_of E u\" using is_scc_unique by metis\n            hence \"u \\<in> scc\" by simp\n            with scc sccs_finished have \"u \\<in> dom (finished s)\" by auto\n            with u_n_fin show ?thesis by contradiction\n          qed simp\n        qed\n        ultimately have \"?tw' = scc_of E u\" by auto\n        hence \"is_scc E ?tw'\" by simp\n        with finish show ?thesis by auto\n      qed\n    }   \n    thus ?case by (auto simp: pw_leof_iff finish)\n  qed (simp_all add: tarjan_back_def tarjan_disc_def)\nend\n\n  lemmas (in Tarjan_invar) sccs_are_sccs =\n    i_sccs_are_sccs[THEN make_invar_thm]\n\ncontext begin interpretation timing_syntax .\n\n  lemma i_lowlink_eq_LowLink:\n    \"is_invar (\\<lambda>s. \\<forall>x \\<in> dom (discovered s). \\<zeta> s x = LowLink s x)\"\n  proof -\n    {\n      fix s s' :: \"'v tarjan_state\"\n      fix v w\n      fix x\n\n      let ?s = \"s'\\<lparr>state.more := x\\<rparr>\"\n\n      assume pre_ll_sub_rev: \"\\<And>w. \\<lbrakk>Tarjan_invar G ?s; w \\<in> dom (discovered ?s); w \\<noteq> v\\<rbrakk> \\<Longrightarrow> lowlink_set ?s w \\<subseteq> lowlink_set s w \\<union> {v}\"\n      assume tree_sub : \"tree_edges s' = tree_edges s \\<or> (\\<exists>u. u \\<noteq> v \\<and> tree_edges s' = tree_edges s \\<union> {(u,v)})\"\n\n      assume \"Tarjan_invar G s\"\n      assume [simp]: \"discovered s' = (discovered s)(v \\<mapsto> counter s)\"\n                     \"finished s' = finished s\"\n                     \"lowlink s' = lowlink s\"\n                     \"cross_edges s' = cross_edges s\" \"back_edges s' = back_edges s\"\n      assume v_n_disc: \"v \\<notin> dom (discovered s)\"\n      assume IH: \"\\<And>w. w\\<in>dom (discovered s) \\<Longrightarrow> \\<zeta> s w = LowLink s w\"\n\n      assume TRANS: \"\\<And>\\<Psi>. tarjan_disc v s' \\<le>\\<^sub>n SPEC \\<Psi> \\<Longrightarrow> \\<Psi> x\"\n      and INV: \"DFS_invar G tarjan_params ?s\"\n      and w_disc: \"w \\<in> dom (discovered ?s)\"\n\n      interpret Tarjan_invar where s=s by fact\n      from INV interpret s':Tarjan_invar where s=\"?s\" by simp\n\n      have [simp]: \"lowlink ?s = (lowlink s)(v \\<mapsto> counter s)\"\n        by (rule TRANS) (auto simp: tarjan_disc_def)\n\n      from v_n_disc edge_imp_discovered have \"edges s `` {v} = {}\" by auto\n      with tree_sub tree_edge_imp_discovered have \"edges ?s `` {v} = {}\" by auto\n      with s'.no_path_imp_no_lowlink_path have \"\\<And>w. \\<not>(\\<exists>p. lowlink_path ?s v p w)\" by metis\n      hence ll_v: \"lowlink_set ?s v = {v}\"\n          unfolding lowlink_set_def by auto\n\n      have \"\\<zeta> ?s w = LowLink ?s w\"\n      proof (cases \"w=v\")\n        case True with ll_v show ?thesis by simp \n      next\n        case False hence \"\\<zeta> ?s w = \\<zeta> s w\" by simp\n        also from IH have \"\\<zeta> s w = LowLink s w\" using w_disc False by simp\n        also have \"LowLink s w = LowLink ?s w\"\n        proof (rule LowLink_eqI[OF INV])\n          from v_n_disc show \"discovered s \\<subseteq>\\<^sub>m discovered ?s\" by (simp add: map_le_def)\n          \n          from tree_sub show \"lowlink_set s w \\<subseteq> lowlink_set ?s w\"\n            unfolding lowlink_set_def lowlink_path_def\n            by auto\n\n          show \"lowlink_set ?s w \\<subseteq> lowlink_set s w \\<union> {v}\"\n          proof (cases \"w = v\")\n            case True with ll_v show ?thesis by auto\n          next\n            case False thus ?thesis\n              using pre_ll_sub_rev w_disc INV\n              by simp\n          qed\n          \n          show \"w \\<in> dom (discovered s)\" using w_disc False by simp\n\n          fix ll assume \"ll \\<in> {v}\" with timing_less_counter lowlink_set_discovered have \n            \"\\<And>x. x\\<in>\\<delta> s`lowlink_set s w \\<Longrightarrow> x < \\<delta> ?s ll\" by simp force\n          moreover from Min_in lowlink_set_finite lowlink_set_not_empty w_disc False have \n            \"LowLink s w \\<in> \\<delta> s`lowlink_set s w \" by auto\n          ultimately show \"LowLink s w \\<le> \\<delta> ?s ll\" by force\n        qed\n        finally show ?thesis .\n      qed\n    } note tarjan_disc_aux = this\n\n    show ?thesis\n    proof (induct rule: establish_invarI_CB)\n      case (new_root s s' v0)\n      {\n        fix w x\n        let ?s = \"new_root v0 s\\<lparr>state.more := x\\<rparr>\"\n        have \"lowlink_set ?s w \\<subseteq> lowlink_set s w \\<union> {v0}\"\n          unfolding lowlink_set_def lowlink_path_def\n          by auto\n      } note * = this\n\n      from new_root show ?case\n        using tarjan_disc_aux[OF *]\n        by (auto simp add: pw_leof_iff)\n    next\n      case (discover s s' u v) then interpret Tarjan_invar where s=s by simp\n      let ?s' = \"discover (hd (stack s)) v (s\\<lparr>pending := pending s - {(hd (stack s),v)}\\<rparr>)\"\n      {\n        fix w x\n        let ?s = \"?s'\\<lparr>state.more := x\\<rparr>\"\n        assume INV: \"Tarjan_invar G ?s\"\n          and d: \"w \\<in> dom (discovered ?s')\"\n          and \"w\\<noteq>v\"\n\n        interpret s': Tarjan_invar where s=\"?s\" by fact\n\n        have \"lowlink_set ?s w \\<subseteq> lowlink_set s w \\<union> {v}\"\n        proof\n          fix ll\n          assume ll: \"ll \\<in> lowlink_set ?s w\"\n          hence \"ll = w \\<or> (\\<exists>p. lowlink_path ?s w p ll)\" by (auto simp add: lowlink_set_def)\n          thus \"ll \\<in> lowlink_set s w \\<union> {v}\" (is \"ll \\<in> ?L\")\n          proof\n            assume \"ll = w\" with d show ?thesis by (auto simp add: lowlink_set_def)\n          next\n            assume \"\\<exists>p. lowlink_path ?s w p ll\"\n            then guess p .. note p = this\n\n            hence [simp]: \"p\\<noteq>[]\" by (simp add: lowlink_path_def)\n    \n            from p have \"hd p = w\" by (auto simp add: lowlink_path_def path_hd)\n            \n            show ?thesis\n            proof (rule tri_caseE)\n              assume \"v\\<noteq>ll\" \"v \\<notin> set p\" hence \"lowlink_path s w p ll\"\n                using p by (auto simp add: lowlink_path_def)\n              with ll show ?thesis by (auto simp add: lowlink_set_def)\n            next\n              assume \"v = ll\" thus ?thesis by simp\n            next\n              assume \"v \\<in> set p\" \"v \\<noteq> ll\"\n              then obtain i where i: \"i < length p\" \"p!i = v\"\n                by (metis in_set_conv_nth)\n              have \"False\"\n              proof (cases i)\n                case \"0\" with i have \"hd p = v\" by (simp add: hd_conv_nth)\n                with \\<open>hd p = w\\<close> \\<open>w \\<noteq> v\\<close> show False by simp\n              next\n                case (Suc n) with i s'.lowlink_path_finished[OF p, where j=i] have \n                  \"v \\<in> dom (finished ?s)\" by simp\n                with finished_discovered discover show False by auto\n              qed\n              thus ?thesis ..\n            qed\n          qed\n        qed\n      } note * = this\n      \n      from discover hd_in_set stack_set_def have \"v \\<noteq> u\" by auto\n      with discover have **: \"tree_edges ?s' = tree_edges s \\<or> (\\<exists>u. u \\<noteq> v \\<and> tree_edges ?s' = tree_edges s \\<union> {(u,v)})\" by auto\n\n      from discover show ?case\n        using tarjan_disc_aux[OF * **]\n        by (auto simp: pw_leof_iff)\n    next\n      case (cross_back_edge s s' u v) then interpret Tarjan_invar where s=s by simp\n      from cross_back_edge have [simp]:\n        \"discovered s' = discovered s\"\n        \"finished s' = finished s\"\n        \"tree_edges s' = tree_edges s\"\n        \"lowlink s' = lowlink s\"\n        by simp_all\n      {\n        fix w :: \"'v\"\n        fix x\n\n        let ?s = \"s'\\<lparr>state.more := x\\<rparr>\"\n        let ?L = \"\\<delta> s ` lowlink_set s w\"\n        let ?L' = \"\\<delta> ?s ` lowlink_set ?s w\"\n\n        assume TRANS: \"\\<And>\\<Psi>. tarjan_back u v s' \\<le>\\<^sub>n SPEC \\<Psi> \\<Longrightarrow> \\<Psi> x\"\n          and inv': \"DFS_invar G tarjan_params ?s\"\n          and w_disc': \"w \\<in> dom (discovered ?s)\"\n        \n        from inv' interpret s':Tarjan_invar where s=\"?s\" by simp\n   \n        have ll_sub: \"lowlink_set s w \\<subseteq> lowlink_set ?s w\"\n          unfolding lowlink_set_def lowlink_path_def\n          by (auto simp: cross_back_edge)\n      \n        have ll_sub_rev: \"lowlink_set ?s w \\<subseteq> lowlink_set s w \\<union> {v}\"\n          unfolding lowlink_set_def lowlink_path_def\n          by (auto simp: cross_back_edge)\n\n        from w_disc' have w_disc: \"w \\<in> dom (discovered s)\" by simp\n        with LowLink_le_disc have LLw: \"LowLink s w \\<le> \\<delta> s w\" by simp\n\n        from cross_back_edge hd_in_set have u_n_fin: \"u \\<notin> dom (finished s)\" \n          using stack_not_finished by auto\n\n        {\n          assume *: \"v \\<in> lowlink_set ?s w \\<Longrightarrow> LowLink s w \\<le> \\<delta> ?s v\"\n          have \"LowLink s w = LowLink ?s w\"\n          proof (rule LowLink_eqI[OF inv' _ ll_sub ll_sub_rev w_disc])\n            show \"discovered s \\<subseteq>\\<^sub>m discovered ?s\" by simp\n            \n            fix ll assume \"ll \\<in> {v}\" \"ll \\<in> lowlink_set ?s w\"\n            with * show \"LowLink s w \\<le> \\<delta> ?s ll\" by simp\n          qed\n        } note LL_eqI = this\n\n        have \"\\<zeta> ?s w = LowLink ?s w\"\n        proof (cases \"w=u\")\n          case True show ?thesis\n          proof (cases \"(\\<delta> s v < \\<delta> s w \\<and> v \\<in> set (tj_stack s) \\<and> \\<delta> s v < \\<zeta> s w)\")\n            case False note all_False = this\n            with \\<open>w = u\\<close> have \"\\<zeta> ?s w = \\<zeta> s w\"\n              by (rule_tac TRANS) (auto simp add: tarjan_back_def cross_back_edge)\n            also from cross_back_edge w_disc have \\<zeta>w: \"... = LowLink s w\" by simp\n            also have \"LowLink s w = LowLink ?s w\"\n            proof (rule LL_eqI)\n              assume v: \"v \\<in> lowlink_set ?s w\"\n              show \"LowLink s w \\<le> \\<delta> ?s v\"\n              proof (cases \"\\<delta> s v < \\<delta> s w \\<and> \\<delta> s v < \\<zeta> s w\")\n                case False with \\<open>LowLink s w \\<le> \\<delta> s w\\<close> \\<zeta>w show ?thesis by auto\n              next\n                case True with all_False have v_n_tj: \"v \\<notin> set (tj_stack s)\" by simp\n                from v have e: \"(v,u) \\<in> E\\<^sup>*\" \"(u,v) \\<in> E\\<^sup>*\" \n                  unfolding lowlink_set_def by (auto simp add: \\<open>w=u\\<close>)\n                \n                from v_n_tj have \"v \\<notin> set (stack s)\" using stack_ss_tj_stack by auto\n                with cross_back_edge have \"v \\<in> dom (finished s)\" by (auto simp add: stack_set_def)\n                with finished_ss_sccs_tj_stack v_n_tj sccs_are_sccs obtain scc \n                  where scc: \"v \\<in> scc\" \"scc \\<in> sccs s\" \"is_scc E scc\" by blast\n                with is_scc_closed e have \"u \\<in> scc\" by metis\n                with scc sccs_finished u_n_fin have False by blast\n                thus ?thesis ..\n              qed\n            qed\n            finally show ?thesis .\n          next\n            case True note all_True = this\n            with \\<open>w=u\\<close> have \"\\<zeta> ?s w = \\<delta> s v\"\n              by (rule_tac TRANS) (simp add: tarjan_back_def cross_back_edge)\n\n            also from True cross_back_edge w_disc have \"\\<delta> s v < LowLink s w\" by simp\n            with lowlink_set_finite lowlink_set_not_empty w_disc have \"\\<delta> s v = Min (?L \\<union> {\\<delta> s v})\" by simp\n            also have \"v \\<in> lowlink_set ?s w\"\n            proof -\n              have cb: \"(u,v) \\<in> cross_edges ?s \\<union> back_edges ?s\" by (simp add: cross_back_edge)\n              with s'.lowlink_path_single have \"lowlink_path ?s u [u] v\" by auto\n              moreover from cb s'.cross_edges_ssE s'.back_edges_ssE have \"(u,v) \\<in> E\" by blast\n              hence \"(u,v) \\<in> E\\<^sup>*\" ..\n              moreover from all_True tj_stack_reach_hd_stack have \"(v,u) \\<in> E\\<^sup>*\" by (simp add: cross_back_edge)\n              moreover note \\<open>v \\<in> dom (discovered s)\\<close>\n              ultimately show ?thesis by (auto intro: s'.lowlink_setI simp: \\<open>w=u\\<close>)\n            qed\n            with ll_sub ll_sub_rev have \"lowlink_set ?s w = lowlink_set s w \\<union> {v}\" by auto\n            hence \"Min (?L \\<union> {\\<delta> s v}) = LowLink ?s w\" by simp\n            finally show ?thesis .\n          qed\n        next\n          case False \\<comment> \\<open>\\<open>w \\<noteq> u\\<close>\\<close>\n          hence \"\\<zeta> ?s w = \\<zeta> s w\"\n            by (rule_tac TRANS) (simp add: tarjan_back_def cross_back_edge)\n          also have \"\\<zeta> s w = LowLink s w\" using w_disc False by (simp add: cross_back_edge)\n          also have \"LowLink s w = LowLink ?s w\"\n          proof (rule LL_eqI)\n            assume v: \"v \\<in> lowlink_set ?s w\"\n            thus \"LowLink s w \\<le> \\<delta> ?s v\" using LLw\n            proof cases\n              assume \"v \\<noteq> w\"\n              with v obtain p where p: \"lowlink_path ?s w p v\" \"p\\<noteq>[]\" \n                by (auto simp add: lowlink_set_def lowlink_path_def)\n              hence \"hd p = w\" by (auto simp add: lowlink_path_def path_hd)\n\n              show ?thesis\n              proof (cases \"u \\<in> set p\")\n                case False with last_in_set p cross_back_edge have \"last p \\<noteq> hd (stack s)\" by force\n                with p have \"lowlink_path s w p v\"\n                  by (auto simp: cross_back_edge lowlink_path_def)\n                with v have \"v \\<in> lowlink_set s w\" \n                  by (auto intro: lowlink_setI simp: lowlink_set_def cross_back_edge)\n                thus ?thesis by simp\n              next\n                case True then obtain i where i: \"i < length p\" \"p!i = u\"\n                  by (metis in_set_conv_nth)\n                have \"False\"\n                proof (cases i)\n                  case \"0\" with i have \"hd p = u\" by (simp add: hd_conv_nth)\n                  with \\<open>hd p = w\\<close> \\<open>w \\<noteq> u\\<close> show False by simp\n                next\n                  case (Suc n) with i s'.lowlink_path_finished[OF p(1), where j=i] have \n                    \"u \\<in> dom (finished ?s)\" by simp\n                  with u_n_fin show ?thesis by simp\n                qed\n                thus ?thesis ..\n              qed\n            qed simp\n          qed\n          finally show ?thesis .\n        qed\n      } note aux = this\n      \n      with cross_back_edge show ?case by (auto simp: pw_leof_iff)\n    next\n      case (finish s s' u) then interpret Tarjan_invar where s=s by simp\n      from finish have [simp]:\n        \"discovered s' = discovered s\"\n        \"finished s' = (finished s)(u\\<mapsto>counter s)\"\n        \"tree_edges s' = tree_edges s\"\n        \"back_edges s' = back_edges s\"\n        \"cross_edges s' = cross_edges s\"\n        \"lowlink s' = lowlink s\" \"tj_stack s' = tj_stack s\"\n        by simp_all\n\n      from finish hd_in_set stack_discovered have u_disc: \"u \\<in> dom (discovered s)\" by blast\n\n      {\n        fix w :: \"'v\"\n        fix x\n\n        let ?s = \"s'\\<lparr>state.more := x\\<rparr>\"\n        let ?L = \"\\<delta> s ` lowlink_set s w\"\n        let ?Lu = \"\\<delta> s ` lowlink_set s u\"\n        let ?L' = \"\\<delta> s ` lowlink_set ?s w\"\n\n        assume TRANS: \"\\<And>\\<Psi>. tarjan_fin u s' \\<le>\\<^sub>n SPEC \\<Psi> \\<Longrightarrow> \\<Psi> x\"\n          and inv': \"DFS_invar G tarjan_params ?s\"\n          and w_disc: \"w \\<in> dom (discovered ?s)\"\n\n        from inv' interpret s':Tarjan_invar where s=\"?s\" by simp\n     \n        have ll_sub: \"lowlink_set s w \\<subseteq> lowlink_set ?s w\"\n          unfolding lowlink_set_def lowlink_path_def\n          by auto\n      \n        have ll_sub_rev: \"lowlink_set ?s w \\<subseteq> lowlink_set s w \\<union> lowlink_set s u\"\n        proof\n          fix ll\n          assume ll: \"ll \\<in> lowlink_set ?s w\"\n          hence \"ll = w \\<or> (\\<exists>p. lowlink_path ?s w p ll)\" by (auto simp add: lowlink_set_def)\n          thus \"ll \\<in> lowlink_set s w \\<union> lowlink_set s u\" \n          proof (rule disjE1)\n            assume \"ll = w\" with w_disc show ?thesis by (auto simp add: lowlink_set_def)\n          next\n            assume \"ll \\<noteq> w\"\n            assume \"\\<exists>p. lowlink_path ?s w p ll\"\n            then guess p .. note p = this\n\n            hence [simp]: \"p\\<noteq>[]\" by (simp add: lowlink_path_def)\n    \n            from p have \"hd p = w\" by (auto simp add: lowlink_path_def path_hd)\n            \n            show ?thesis\n            proof (cases \"u \\<in> set p\")\n              case False hence \"lowlink_path s w p ll\"\n                using p by (auto simp add: lowlink_path_def)\n              with ll show ?thesis by (auto simp add: lowlink_set_def)\n            next\n              case True\n              then obtain i where i: \"i < length p\" \"p!i = u\"\n                by (metis in_set_conv_nth)\n              moreover\n              let ?dp = \"drop i p\"\n\n              from i have \"?dp \\<noteq> []\" by simp\n\n              from i have \"hd ?dp = u\" by (simp add: hd_drop_conv_nth)\n              moreover from i have \"last ?dp = last p\" by simp\n              moreover {\n                fix k\n                assume \"1 < length ?dp\"\n                and  \"k < length ?dp - 1\"\n\n                hence l: \"1 < length p\" \"k+i < length p - 1\" by (auto)\n                with p have \"(p!(k+i), p!Suc (k+i)) \\<in> tree_edges s\" by (auto simp add: lowlink_path_def)\n                moreover from l have i: \"i+k \\<le> length p\" \"i+Suc k \\<le> length p\" by simp_all\n                ultimately have  \"(?dp!k,?dp!Suc k) \\<in> tree_edges s\" by (simp add: add.commute)\n              } note aux = this\n              moreover {\n                assume *: \"1 < length ?dp\"\n                hence l: \"1 + i < length p\" by simp\n                with s'.lowlink_path_finished[OF p] have \"p ! (1+i) \\<in> dom (finished ?s)\" by auto\n                moreover from l have \"i+1\\<le>length p\" by simp\n                ultimately have \"?dp!1 \\<in> dom (finished ?s)\" by simp\n                moreover from aux[of 0] * have \"(?dp!0,?dp!Suc 0) \\<in> tree_edges s\" by simp\n                with \\<open>hd ?dp = u\\<close> hd_conv_nth[of \"?dp\"] * have \"(u,?dp!Suc 0) \\<in> tree_edges s\" by simp\n                with no_self_loop_in_tree have \"?dp!1 \\<noteq> u\" by auto\n                ultimately have \"?dp!1 \\<in> dom (finished s)\" by simp\n              }\n              moreover \n                from p have P: \"path E w p ll\" by (simp add: lowlink_path_def)\n\n                have \"p = (take i p)@?dp\" by simp\n                with P path_conc_conv obtain x where p': \"path E x ?dp ll\" \"path E w (take i p) x\" by metis\n                with \\<open>?dp \\<noteq> []\\<close> path_hd have \"hd ?dp = x\" by metis\n                with \\<open>hd ?dp = u\\<close> p' have u_path: \"path E u ?dp ll\" and path_u: \"path E w (take i p) u\" by metis+\n\n              ultimately have \"lowlink_path s u ?dp ll\" using p by (simp add: lowlink_path_def)\n              moreover from u_path path_is_trancl \\<open>?dp \\<noteq> []\\<close> have \"(u,ll) \\<in> E\\<^sup>+\" by force\n              moreover { from ll \\<open>ll \\<noteq> w\\<close> have \"(ll,w) \\<in> E\\<^sup>+\" by (auto simp add: lowlink_set_def)\n                also from path_u path_is_rtrancl have \"(w,u) \\<in> E\\<^sup>*\" by metis\n                finally have \"(ll,u)\\<in>E\\<^sup>+\" .\n              }\n              moreover note ll u_disc\n              ultimately have \"ll \\<in> lowlink_set s u\" unfolding lowlink_set_def by auto\n              thus ?thesis by auto\n            qed\n          qed\n        qed\n        hence ll_sub_rev': \"?L' \\<subseteq> ?L \\<union> ?Lu\" by auto\n\n        have ref_ne: \"stack ?s \\<noteq> [] \\<Longrightarrow> \n             lowlink ?s = (lowlink s)(hd (stack ?s) \\<mapsto> min (\\<zeta> s (hd (stack ?s))) (\\<zeta> s u))\"\n          apply (rule TRANS)\n          unfolding tarjan_fin_def tj_stack_pop_def\n          by refine_vcg simp_all\n        \n        have ref_e: \"stack ?s = [] \\<Longrightarrow> lowlink ?s = lowlink s\"\n          apply (rule TRANS)\n          unfolding tarjan_fin_def tj_stack_pop_def\n          by refine_vcg simp_all\n\n        have ref_tj: \"\\<zeta> s u \\<noteq> \\<delta> s u \\<Longrightarrow> tj_stack ?s = tj_stack s\"\n          apply (rule TRANS)\n          unfolding tarjan_fin_def tj_stack_pop_def\n          by refine_vcg simp_all\n\n        have \"\\<zeta> ?s w = LowLink ?s w\"\n        proof (cases \"w = hd (stack ?s) \\<and> stack ?s \\<noteq> []\")\n          case True note all_True = this\n          with ref_ne have *: \"\\<zeta> ?s w = min (\\<zeta> s w) (\\<zeta> s u)\" by simp\n          show ?thesis\n          proof (cases \"\\<zeta> s u < \\<zeta> s w\")\n            case False with * finish w_disc have \"\\<zeta> ?s w = LowLink s w\" by simp\n            also have \"LowLink s w = LowLink ?s w\"\n            proof (rule LowLink_eqI[OF inv' _ ll_sub ll_sub_rev])\n              from w_disc show \"w \\<in> dom (discovered s)\" by simp\n              fix ll assume \"ll \\<in> lowlink_set s u\" \n              hence \"LowLink s u \\<le> \\<delta> s ll\" by simp\n              moreover from False finish w_disc u_disc have \"LowLink s w \\<le> LowLink s u\" by simp\n              ultimately show \"LowLink s w \\<le> \\<delta> ?s ll\" by simp\n            qed simp\n            finally show ?thesis .\n          next\n            case True note \\<zeta>rel = this\n            have \"LowLink s u \\<in> ?L'\"\n            proof -\n              from all_True finish have w_tl: \"w\\<in>set (tl (stack s))\" by auto\n\n              obtain ll where ll: \"ll \\<in> lowlink_set s u\" \"\\<delta> s ll = LowLink s u\"\n                using Min_in[of ?Lu] lowlink_set_finite lowlink_set_not_empty u_disc\n                by fastforce\n              have \"ll \\<in> lowlink_set ?s w\"\n              proof (cases \"\\<delta> s u = \\<zeta> s u\")\n                case True\n                moreover from w_tl finish tl_lt_stack_hd_discover have \"\\<delta> s w < \\<delta> s u\" by simp\n                moreover from w_disc have \"LowLink s w \\<le> \\<delta> s w\" by (simp add: LowLink_le_disc)\n                with w_disc finish have \"\\<zeta> s w \\<le> \\<delta> s w\" by simp\n                moreover note \\<zeta>rel\n                ultimately have False by force\n                thus ?thesis ..\n              next\n                case False with u_disc finish ll have \"u \\<noteq> ll\" by auto\n                with ll have\n                  e: \"(ll,u) \\<in> E\\<^sup>+\" \"(u,ll) \\<in> E\\<^sup>+\" and\n                  p: \"\\<exists>p. lowlink_path s u p ll\" and\n                  ll_disc: \"ll \\<in> dom (discovered s)\"\n                  by (auto simp: lowlink_set_def)\n\n                from p have p': \"\\<exists>p. lowlink_path ?s u p ll\"\n                  unfolding lowlink_path_def\n                  by auto\n                from w_tl tl_stack_hd_tree_path finish have T: \"(w,u) \\<in> (tree_edges ?s)\\<^sup>+\" by simp\n                with s'.lowlink_path_tree_prepend all_True p' have \"\\<exists>p. lowlink_path ?s w p ll\" by blast\n                moreover from T trancl_mono_mp[OF s'.tree_edges_ssE] have \"(w,u) \\<in> E\\<^sup>+\" by blast\n                with e have \"(w,ll) \\<in> E\\<^sup>+\" by simp\n                moreover {\n                  note e(1)\n                  also from finish False ref_tj have \"tj_stack ?s = tj_stack s\" by simp\n                  with hd_in_set finish stack_ss_tj_stack have \"u \\<in> set (tj_stack ?s)\" by auto\n                  with s'.tj_stack_reach_stack obtain x where x: \"x \\<in> set (stack ?s)\" \"(u,x) \\<in> E\\<^sup>*\" by blast\n                  note this(2)\n                  also have \"(x,w) \\<in> E\\<^sup>*\"\n                  proof (rule rtrancl_eq_or_trancl[THEN iffD2], safe)\n                    assume \"x \\<noteq> w\" with all_True x have \"x \\<in> set (tl (stack ?s))\" by (cases \"stack ?s\") auto\n                    with s'.tl_stack_hd_tree_path all_True have \"(x,w) \\<in> (tree_edges s)\\<^sup>+\" by auto\n                    with trancl_mono_mp[OF tree_edges_ssE] show \"(x,w) \\<in> E\\<^sup>+\" by simp\n                  qed\n                  finally have \"(ll,w) \\<in> E\\<^sup>+\" .\n                }\n                moreover note ll_disc\n                ultimately show ?thesis by (simp add: lowlink_set_def)\n              qed               \n              hence \"\\<delta> s ll \\<in> ?L'\" by auto\n              with ll show ?thesis by simp\n            qed\n            hence \"LowLink ?s w \\<le> LowLink s u\" \n              using Min_le_iff[of ?L'] s'.lowlink_set_not_empty w_disc s'.lowlink_set_finite\n              by fastforce\n            also from True u_disc w_disc finish have \"LowLink s u < LowLink s w\" by simp\n            hence \"Min (?L \\<union> ?Lu) = LowLink s u\" \n              using Min_Un[of ?L ?Lu] lowlink_set_finite lowlink_set_not_empty u_disc w_disc\n              by simp\n            hence \"LowLink s u \\<le> LowLink ?s w\" \n              using Min_antimono[OF ll_sub_rev'] lowlink_set_finite s'.lowlink_set_not_empty w_disc\n              by auto\n            also from True u_disc finish * have \"LowLink s u = \\<zeta> ?s w\" by simp\n            finally show ?thesis ..\n          qed\n        next\n          case False note all_False = this\n          have \"\\<zeta> ?s w = \\<zeta> s w\"\n          proof (cases \"stack ?s = []\")\n            case True with ref_e show ?thesis by simp\n          next\n            case False with all_False have \"w \\<noteq> hd (stack ?s)\" by simp\n            with False ref_ne show ?thesis by simp\n          qed\n          also from finish have \"\\<zeta> s w = LowLink s w\" using w_disc by simp\n          also {\n            fix v\n            assume \"v \\<in> lowlink_set s u\"\n              and *: \"v \\<notin> lowlink_set s w\"\n            hence \"v \\<noteq> w\" \"w\\<noteq>u\" by (auto simp add: lowlink_set_def)\n            have \"v \\<notin> lowlink_set ?s w\"\n            proof (rule notI)\n              assume v: \"v \\<in> lowlink_set ?s w\"\n              hence e: \"(v,w) \\<in> E\\<^sup>*\" \"(w,v) \\<in> E\\<^sup>*\"\n                and v_disc: \"v \\<in> dom (discovered s)\" by (auto simp add: lowlink_set_def)\n              \n              from v \\<open>v\\<noteq>w\\<close> obtain p where p: \"lowlink_path ?s w p v\" by (auto simp add: lowlink_set_def)\n              hence [simp]: \"p\\<noteq>[]\" by (simp add: lowlink_path_def)\n              \n              from p have \"hd p = w\" by (auto simp add: lowlink_path_def path_hd)\n              \n              show False\n              proof (cases \"u \\<in> set p\")\n                case False hence \"lowlink_path s w p v\"\n                  using p by (auto simp add: lowlink_path_def)\n                with e v_disc have \"v \\<in> lowlink_set s w\" by (auto intro: lowlink_setI)\n                with * show False ..\n              next\n                case True\n                then obtain i where i: \"i < length p\" \"p!i = u\"\n                  by (metis in_set_conv_nth)\n                show \"False\"\n                proof (cases i)\n                  case \"0\" with i have \"hd p = u\" by (simp add: hd_conv_nth)\n                  with \\<open>hd p = w\\<close> \\<open>w \\<noteq> u\\<close> show False by simp\n                next\n                  case (Suc n) with i p have *: \"(p!n,u) \\<in> tree_edges s\" \"n < length p\"\n                    unfolding lowlink_path_def\n                    by auto\n                  with tree_edge_imp_discovered have \"p!n \\<in> dom (discovered s)\" by auto\n                  moreover from finish hd_in_set stack_not_finished have \"u \\<notin> dom (finished s)\" by auto\n                  with * have pn_n_fin: \"p!n \\<notin> dom (finished s)\" by (metis tree_edge_impl_parenthesis)\n                  moreover from * no_self_loop_in_tree have \"p!n \\<noteq> u\" by blast\n                  ultimately have \"p!n \\<in> set (stack ?s)\" using stack_set_def finish by (cases \"stack s\") auto\n                  hence s_ne: \"stack ?s \\<noteq> []\" by auto\n                  with all_False have \"w \\<noteq> hd (stack ?s)\" by simp\n                  from stack_is_tree_path finish obtain v0 where\n                    \"path (tree_edges s) v0 (rev (stack ?s)) u\"\n                    by auto\n                  with s_ne have \"(hd (stack ?s), u) \\<in> tree_edges s\" by (auto simp: neq_Nil_conv path_simps)\n                  with * tree_eq_rule have **: \"hd (stack ?s) = p!n\" by simp\n                  show ?thesis\n                  proof (cases n)\n                    case \"0\" with * have \"hd p = p!n\" by (simp add: hd_conv_nth)\n                    with \\<open>hd p = w\\<close> ** have \"w = hd (stack ?s)\" by simp\n                    with \\<open>w\\<noteq>hd (stack ?s)\\<close> show False ..\n                  next\n                    case (Suc m) with * ** s'.lowlink_path_finished[OF p, where j=n] have \n                      \"hd (stack ?s) \\<in> dom (finished ?s)\" by simp\n                    with hd_in_set[OF s_ne] s'.stack_not_finished show ?thesis by blast\n                  qed\n                qed\n              qed\n            qed\n          } with ll_sub ll_sub_rev have \"lowlink_set ?s w = lowlink_set s w\" by auto\n          hence \"LowLink s w = LowLink ?s w\" by simp\n          finally show ?thesis .\n        qed\n      }\n\n      with finish show ?case by (auto simp: pw_leof_iff)\n    qed simp_all\n  qed\nend end\n\ncontext Tarjan_invar begin context begin interpretation timing_syntax .\n\n  lemmas lowlink_eq_LowLink =\n    i_lowlink_eq_LowLink[THEN make_invar_thm, rule_format]\n\n  lemma lowlink_eq_disc_iff_scc_root:\n    assumes \"v \\<in> dom (finished s) \\<or> (stack s \\<noteq> [] \\<and> v = hd (stack s) \\<and> pending s `` {v} = {})\"\n    shows \"\\<zeta> s v = \\<delta> s v \\<longleftrightarrow> scc_root s v (scc_of E v)\"\n  proof -\n    from assms have \"v \\<in> dom (discovered s)\" using finished_discovered hd_in_set stack_discovered by blast\n    hence \"\\<zeta> s v = LowLink s v\" using lowlink_eq_LowLink by simp\n    with LowLink_eq_disc_iff_scc_root[OF assms] show ?thesis by simp\n  qed\n\n  lemma nc_sccs_eq_reachable:\n    assumes NC: \"\\<not> cond s\"\n    shows \"reachable = \\<Union>(sccs s)\"\n  proof\n    from nc_finished_eq_reachable NC have [simp]: \"reachable = dom (finished s)\" by simp\n    with sccs_finished show \"\\<Union>(sccs s) \\<subseteq> reachable\" by simp\n\n    from NC have \"stack s = []\" by (simp add: cond_alt)\n    with stacks_eq_iff have \"tj_stack s = []\" by simp\n    with finished_ss_sccs_tj_stack show \"reachable \\<subseteq> \\<Union>(sccs s)\" by simp\n  qed\nend end\n\ncontext Tarjan begin\n  lemma tarjan_fin_nofail:\n    assumes \"pre_on_finish u s'\"\n    shows \"nofail (tarjan_fin u s')\"\n  proof -\n    from assms obtain s where s: \"DFS_invar G tarjan_params s\" \"stack s \\<noteq> []\"  \"u = hd (stack s)\" \"s' = finish u s\"  \"cond s\" \"pending s `` {u} = {}\"\n      by (auto simp: pre_on_finish_def)\n    then interpret Tarjan_invar where s=s by simp\n\n    from s hd_stack_in_tj_stack have \"u \\<in> set (tj_stack s')\" by simp\n\n    moreover from s tj_stack_distinct have \"distinct (tj_stack s')\" by simp\n    moreover have \"the (lowlink s' u) = the (discovered s' u) \\<longleftrightarrow> scc_root s' u (scc_of E u)\"\n    proof -\n      from s have \"the (lowlink s' u) = the (discovered s' u) \\<longleftrightarrow> the (lowlink s u) = the (discovered s u)\" by simp\n      also from s lowlink_eq_disc_iff_scc_root have \"... \\<longleftrightarrow> scc_root s u (scc_of E u)\" by blast\n      also from s scc_root_transfer'[where s'=s'] have \"... \\<longleftrightarrow> scc_root s' u (scc_of E u)\" by simp\n      finally show ?thesis .\n    qed\n    ultimately show ?thesis \n      unfolding tarjan_fin_def tj_stack_pop_def\n      by simp\n  qed\n\n  sublocale DFS G tarjan_params\n    by unfold_locales (simp_all add: tarjan_disc_def tarjan_back_def tarjan_fin_nofail)\nend\n\ninterpretation tarjan: Tarjan_def for G .\n\nsubsection \\<open>Interface\\<close>\ndefinition \"tarjan G \\<equiv> do {\n  ASSERT (fb_graph G);\n  s \\<leftarrow> tarjan.it_dfs TYPE('a) G;\n  RETURN (sccs s) }\"\n\ndefinition \"tarjan_spec G \\<equiv> do {\n  ASSERT (fb_graph G); \n  SPEC (\\<lambda>sccs.  (\\<forall>scc \\<in> sccs. is_scc (g_E G) scc)\n              \\<and> \\<Union>sccs = tarjan.reachable TYPE('a) G)}\"\n\nlemma tarjan_correct:\n  \"tarjan G \\<le> tarjan_spec G\"\n  unfolding tarjan_def tarjan_spec_def\nproof (refine_vcg le_ASSERTI order_trans[OF DFS.it_dfs_correct])\n  assume \"fb_graph G\"\n  then interpret fb_graph G .\n  interpret Tarjan ..\n  show \"DFS G (tarjan.tarjan_params TYPE('b) G)\" ..\nnext\n  fix s\n  assume C: \"DFS_invar G (tarjan.tarjan_params TYPE('b) G) s \\<and> \\<not> tarjan.cond TYPE('b) G s\"\n  then interpret Tarjan_invar G s by simp\n\n  from sccs_are_sccs show \"\\<forall>scc\\<in>sccs s. is_scc (g_E G) scc\" .\n  \n  from nc_sccs_eq_reachable C show \"\\<Union>(sccs s) = tarjan.reachable TYPE('b) G\" by simp\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/DFS_Framework/Examples/Tarjan.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.33558003255702734}}
{"text": "(*\n * Copyright 2023, Proofcraft Pty Ltd\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* The oblivious predicate and supporting lemmas.\n\n   \"oblivious f m\" expresses that execution of the monad m is oblivious to the effects of the\n   function f on the state *)\n\ntheory Oblivious\n  imports\n    Monads.In_Monad\n    Monads.NonDetMonadVCG\nbegin\n\n\ndefinition\n  oblivious :: \"('a \\<Rightarrow> 'a) \\<Rightarrow> ('a, 'b) nondet_monad \\<Rightarrow> bool\" where\n \"oblivious f m \\<equiv> \\<forall>s. (\\<forall>(rv, s') \\<in> fst (m s). (rv, f s') \\<in> fst (m (f s)))\n                    \\<and> (\\<forall>(rv, s') \\<in> fst (m (f s)). \\<exists>s''. (rv, s'') \\<in> fst (m s) \\<and> s' = f s'')\n                    \\<and> snd (m (f s)) = snd (m s)\"\n\n\nlemma oblivious_return[simp]:\n  \"oblivious f (return x)\"\n  by (simp add: oblivious_def return_def)\n\nlemma oblivious_fail[simp]:\n  \"oblivious f fail\"\n  by (simp add: oblivious_def fail_def)\n\nlemma oblivious_assert[simp]:\n  \"oblivious f (assert x)\"\n  by (simp add: assert_def)\n\nlemma oblivious_assert_opt[simp]:\n  \"oblivious f (assert_opt fn)\"\n  by (simp add: assert_opt_def split: option.splits)\n\nlemma oblivious_bind:\n  \"\\<lbrakk> oblivious f m; \\<And>rv. oblivious f (m' rv) \\<rbrakk> \\<Longrightarrow> oblivious f (m >>= m')\"\n  apply (simp add: oblivious_def)\n  apply (rule allI)\n  apply (erule allE)\n  apply (intro conjI)\n    apply (drule conjunct1)\n    apply (clarsimp simp: in_monad)\n    apply fastforce\n   apply (drule conjunct2, drule conjunct1)\n   apply (clarsimp simp: in_monad)\n   apply fastforce\n  apply (clarsimp simp: bind_def disj_commute)\n  apply (rule disj_cong [OF refl])\n  apply (rule iffI)\n   apply (clarsimp simp: split_def)\n   apply fastforce\n  apply clarsimp\n  apply (drule(1) bspec)\n  apply (clarsimp simp: split_def)\n  apply (drule (1) bspec)\n  apply (rule bexI [rotated], assumption)\n  apply clarsimp\n  done\n\nlemma oblivious_gets[simp]:\n  \"oblivious f (gets f') = (\\<forall>s. f' (f s) = f' s)\"\n  by (fastforce simp add: oblivious_def simpler_gets_def)\n\nlemma oblivious_liftM:\n  \"oblivious f m \\<Longrightarrow> oblivious f (liftM g m)\"\n  by (simp add: liftM_def oblivious_bind)\n\nlemma oblivious_modify[simp]:\n  \"oblivious f (modify f') = (\\<forall>s. f' (f s) = f (f' s))\"\n  apply (simp add: oblivious_def simpler_modify_def)\n  apply (rule ball_cong[where A=UNIV, OF refl, simplified])\n  apply fastforce\n  done\n\nlemma oblivious_modify_swap:\n  \"oblivious f m \\<Longrightarrow> (modify f >>= (\\<lambda>rv. m)) = (m >>= (\\<lambda>rv. modify f))\"\n  apply (clarsimp simp: bind_def simpler_modify_def)\n  apply (rule ext)+\n  apply (case_tac \"m (f s)\", clarsimp)\n  apply (simp add: oblivious_def)\n  apply (drule_tac x=s in spec)\n  apply (rule conjI)\n   apply (rule set_eqI)\n   apply (rule iffI)\n    apply (drule conjunct2, drule conjunct1)\n    apply (drule_tac x=x in bspec, simp)\n    apply clarsimp\n    apply (rule_tac x=\"((), s'')\" in bexI)\n     apply simp\n    apply simp\n   apply (drule conjunct1)\n   apply fastforce\n  apply (drule conjunct2)+\n  apply fastforce\n  done\n\nlemma oblivious_returnOk[simp]:\n  \"oblivious f (returnOk e)\"\n  by (simp add: returnOk_def)\n\nlemma oblivious_assertE[simp]:\n  \"oblivious f (assertE P)\"\n  by (simp add: assertE_def split: if_split)\n\nlemma oblivious_throwError[simp]:\n  \"oblivious f (throwError e)\"\n  by (simp add: throwError_def)\n\nlemma oblivious_bindE:\n  \"\\<lbrakk> oblivious u f; \\<And>v. oblivious u (g v) \\<rbrakk> \\<Longrightarrow> oblivious u (f >>=E (\\<lambda>v. g v))\"\n  apply (simp add: bindE_def)\n  apply (erule oblivious_bind)\n  apply (simp add: lift_def split: sum.split)\n  done\n\nlemma oblivious_catch:\n  \"\\<lbrakk> oblivious u f; \\<And>v. oblivious u (g v) \\<rbrakk> \\<Longrightarrow> oblivious u (catch f g)\"\n  apply (simp add: catch_def)\n  apply (erule oblivious_bind)\n  apply (simp split: sum.split)\n  done\n\nlemma oblivious_when[simp]:\n  \"oblivious f (when P m) = (P \\<longrightarrow> oblivious f m)\"\n  by (simp add: when_def split: if_split)\n\nlemma oblivious_whenE[simp]:\n  \"oblivious f (whenE P g) = (P \\<longrightarrow> oblivious f g)\"\n  by (simp add: whenE_def split: if_split)\n\nlemma select_f_oblivious[simp]:\n  \"oblivious f (select_f v)\"\n  by (simp add: oblivious_def select_f_def)\n\nlemma oblivious_select:\n  \"oblivious f (select S)\"\n  by (simp add: oblivious_def select_def)\n\nend", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Oblivious.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.33558003255702734}}
{"text": "theory RRLoopTwo\n(* Second instance of the RRLoop: note that here the infrastructure type gets re-defined.\n   Corresponding definitions are defined again for the new type. They co-exist with\n   the previous definitions. This is possible thanks to Isabelle's overloading and \n   theory name spacing possibilities! *)\nimports hcKripkeOne FMap (* \"/Applications/Isabelle2018.app/Isabelle/src/HOL/Hoare/Hoare_Logic\" *)\nbegin\n(* a simple definition of data and instantiating \nthe generic types of the Hoare logic to pairs of owner and data as \nbasic data type for specification. This enables the unique marking\n(modulo insider impersonation) of data within the system. \nThe manipulation of the data (using simple while language) can thus \nbe modelled but additionally taking the ownership into account. We use \neval below and anchor the access control in restricing base functions\nfor the basic com type *)\n(* taken over from previous level:\ndatatype action = get | move | eval |put\ntypedecl actor \ntype_synonym identity = string\nconsts Actor :: \"string => actor\"\ntype_synonym policy = \"((actor => bool) * action set)\"\n\ndefinition ID :: \"[actor, string] \\<Rightarrow> bool\"\nwhere \"ID a s \\<equiv> (a = Actor s)\"\n\ndatatype location = Location nat\n*)\n\ntype_synonym data = string\n  (* Inspired by Myers DLM mode: first is the owner of a data item, second is the\n     set of all actors that may access the data item *)\ntype_synonym dlm = \"actor * actor set\"\n  (* the following type constructors are from Hoare_logic:\n     bexp and assn are just synonyms for set, and\n     com is a simple datatype repesenting while command language\n     over some basic 'a \\<Rightarrow> 'a functions, while 'a sem is\n     just the type of relations 'a \\<Rightarrow> 'a \\<Rightarrow> bool representing relational\n     semantics *)\n\ntype_synonym acond = \"(dlm * data) set\"\n(*\ntype_synonym aassn = \"(dlm * data) assn\"\ntype_synonym acom = \"(dlm * data) com\"\ntype_synonym asem = \"(dlm * data) sem\"\n*)\n\ndatatype igraph = Lgraph \"(location * location)set\" \"location \\<Rightarrow> identity set\"\n                         \"actor \\<Rightarrow> (string set * string set)\"  \"location \\<Rightarrow> acond\"\ndatatype infrastructure = \n         Infrastructure \"igraph\" \n                        \"[igraph ,location] \\<Rightarrow> policy set\" \nprimrec loc :: \"location \\<Rightarrow> nat\"\nwhere  \"loc(Location n) = n\"\nprimrec gra :: \"igraph \\<Rightarrow> (location * location)set\"\nwhere  \"gra(Lgraph g a c l) = g\"\nprimrec agra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> identity set)\"\nwhere  \"agra(Lgraph g a c l) = a\"\nprimrec cgra :: \"igraph \\<Rightarrow> (actor \\<Rightarrow> string set * string set)\"\nwhere  \"cgra(Lgraph g a c l) = c\"\nprimrec lgra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> acond)\"\nwhere  \"lgra(Lgraph g a c l) = l\"\n\ndefinition nodes :: \"igraph \\<Rightarrow> location set\" \nwhere \"nodes g == { x. (? y. ((x,y): gra g) | ((y,x): gra g))}\"\n\ndefinition actors_graph :: \"igraph \\<Rightarrow> identity set\"  \nwhere  \"actors_graph g == {x. ? y. y : nodes g \\<and> x \\<in> (agra g y)}\"\n\nprimrec graphI :: \"infrastructure \\<Rightarrow> igraph\"\nwhere \"graphI (Infrastructure g d) = g\"\nprimrec delta :: \"[infrastructure, igraph, location] \\<Rightarrow> policy set\"\nwhere \"delta (Infrastructure g d) = d\"\nprimrec tspace :: \"[infrastructure, actor ] \\<Rightarrow> string set * string set\"\n  where \"tspace (Infrastructure g d) = cgra g\"\nprimrec lspace :: \"[infrastructure, location ] \\<Rightarrow> acond\"\nwhere \"lspace (Infrastructure g d) = lgra g\"\ndefinition credentials :: \"string set * string set \\<Rightarrow> string set\"\n  where  \"credentials lxl \\<equiv> (fst lxl)\"\ndefinition has :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"has G ac \\<equiv> snd ac \\<in> credentials(cgra G (fst ac))\"\ndefinition roles :: \"string set * string set \\<Rightarrow> string set\"\n  where  \"roles lxl \\<equiv> (snd lxl)\"\ndefinition role :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"role G ac \\<equiv> snd ac \\<in> roles(cgra G (fst ac))\"\n\n\ndefinition owner :: \"dlm * data \\<Rightarrow> actor\" where \"owner d \\<equiv> fst(fst d)\"\n    \ndefinition owns :: \"[igraph, location, actor, dlm * data] \\<Rightarrow> bool\"    \n  where \"owns G l a d \\<equiv> owner d = a\"\n    \ndefinition readers :: \"dlm * data \\<Rightarrow> actor set\"\n  where \"readers d \\<equiv> snd (fst d)\"\n\ndefinition has_access :: \"[igraph, location, actor, dlm * data] \\<Rightarrow> bool\"    \nwhere \"has_access G l a d \\<equiv> owns G l a d \\<or> a \\<in> readers d\"\n  \ndefinition actor_can_delete ::   \"[infrastructure, actor, location] \\<Rightarrow> bool\"\nwhere actor_can_delete_def: \"actor_can_delete I h l \\<equiv>  \n                   (\\<forall> as n. ((h, as), n) \\<notin> (lgra (graphI I) l))\"\n        \n\ndefinition atI :: \"[identity, igraph, location] \\<Rightarrow> bool\" (\"_ @\\<^bsub>(_)\\<^esub> _\" 50)\nwhere \"a @\\<^bsub>G\\<^esub> l \\<equiv> a \\<in> (agra G l)\"\n\ndefinition enables :: \"[infrastructure, location, actor, action] \\<Rightarrow> bool\"\nwhere\n\"enables I l a a' \\<equiv>  (\\<exists> (p,e) \\<in> delta I (graphI I) l. a' \\<in> e \\<and> p a)\"\n\ndefinition move_graph_a :: \"[identity, location, location, igraph] \\<Rightarrow> igraph\"\nwhere \"move_graph_a n l l' g \\<equiv> Lgraph (gra g) \n                    (if n \\<in> ((agra g) l) &  n \\<notin> ((agra g) l') then \n                     ((agra g)(l := (agra g l) - {n}))(l' := (insert n (agra g l')))\n                     else (agra g))(cgra g)(lgra g)\"\ninductive state_transition_in :: \"[infrastructure, infrastructure] \\<Rightarrow> bool\" (\"(_ \\<rightarrow>\\<^sub>n _)\" 50)\nwhere\n  move: \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; l \\<in> nodes G; l' \\<in> nodes G;\n          (a) \\<in> actors_graph(graphI I); enables I l' (Actor a) move;\n         I' = Infrastructure (move_graph_a a l l' (graphI I))(delta I) \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\" \n| get_data : \"G = graphI I \\<Longrightarrow> h @\\<^bsub>G\\<^esub> l \\<Longrightarrow>  l \\<in> nodes G \\<Longrightarrow> l' \\<in> nodes G \\<Longrightarrow> \n        enables I l (Actor h) get \\<Longrightarrow> \n       ((Actor h', hs), n) \\<in> lgra G l' \\<Longrightarrow> Actor h \\<in> hs \\<or> h = h' \\<Longrightarrow> \n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := (lgra G l)  \\<union> {((Actor h', hs), n)})))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| process : \"G = graphI I \\<Longrightarrow> h @\\<^bsub>G\\<^esub> l \\<Longrightarrow> l \\<in> nodes G \\<Longrightarrow> \n        enables I l (Actor h) eval \\<Longrightarrow> \n       ((Actor h', hs), n) \\<in> lgra G l \\<Longrightarrow> Actor h \\<in> hs \\<or> h = h' \\<Longrightarrow>\n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := ((lgra G l)  - {(y, x). x = n}\n                    \\<union> {f ((Actor h', hs), n)}))))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"  \n| del_data : \"G = graphI I \\<Longrightarrow> h \\<in> actors_graph G \\<Longrightarrow> l \\<in> nodes G \\<Longrightarrow>\n       ((Actor h, hs), n) \\<in> lgra G l \\<Longrightarrow> \n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := (lgra G l) - {(y, x). x = n })))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| put : \"G = graphI I \\<Longrightarrow> h @\\<^bsub>G\\<^esub> l \\<Longrightarrow> l \\<in> nodes G \\<Longrightarrow> \n        enables I l (Actor h) put \\<Longrightarrow>\n        I' = Infrastructure \n                  (Lgraph (gra G)(agra G)(cgra G)\n                          ((lgra G)(l := (lgra G l) \\<union> {((Actor h, hs), n)})))\n                   (delta I)\n          \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\ninstantiation \"infrastructure\" :: state\nbegin\n\ndefinition \n   state_transition_infra_def: \"(i \\<rightarrow>\\<^sub>i i') =  (i \\<rightarrow>\\<^sub>n (i' :: infrastructure))\"\n\ninstance\n  by (rule MC.class.MC.state.of_class.intro)\n\ndefinition state_transition_in_refl (\"(_ \\<rightarrow>\\<^sub>n* _)\" 50)\nwhere \"s \\<rightarrow>\\<^sub>n* s' \\<equiv> ((s,s') \\<in> {(x,y). state_transition_in x y}\\<^sup>*)\"\n\nend\n      \nlemma move_graph_eq: \"move_graph_a a l l g = g\"  \nproof (simp add: move_graph_a_def, case_tac g, force)\nqed     \n\n\n(* general scheme for map over finite sets.\n   This would be a useful provision for the Finite_Set library: everyone needs\n   a simple map on Finite Sets all the time! \ndefinition fmap :: \"['a \\<Rightarrow> 'b, 'a set] \\<Rightarrow> 'b set\"\n  where \"fmap f S = Finite_Set.fold (\\<lambda> x y. insert (f x) y) {} S\"\n\nlemma fmap_lem_map[rule_format]: \"finite S \\<Longrightarrow> n \\<in> S \\<longrightarrow> (f n) \\<in> (fmap f S)\"\n  apply (erule_tac F = S in finite_induct)\n   apply simp\n  apply clarify\n  apply (simp add: fmap_def)\n  apply (subgoal_tac \"comp_fun_commute (\\<lambda>x::'a. insert (f x))\")\n   apply (drule_tac A = \"F\" in Finite_Set.comp_fun_commute.fold_insert)\n     apply assumption+\n   apply (erule ssubst)\n   apply (erule disjE)\n  apply force+\napply (simp add: comp_fun_commute_def)\nby force\n\n\nlemma fmap_lem_map_rev[rule_format]: \"finite S \\<Longrightarrow> inj f \\<Longrightarrow> (f n) \\<in> (fmap f S) \\<longrightarrow> n \\<in> S\"\n  apply (erule_tac F = S in finite_induct)\n   apply (simp add: fmap_def)\n  apply clarify\n  apply (simp add: fmap_def)\n  apply (subgoal_tac \"comp_fun_commute (\\<lambda>x::'a. insert (f x))\")\n   apply (drule_tac A = \"F\" and z = \"{}\" in Finite_Set.comp_fun_commute.fold_insert)\n     apply assumption+\n   apply (subgoal_tac \"f n \\<in> insert (f x) (Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} F)\")\n    prefer 2\n    apply simp\n   apply (subgoal_tac \"f n = f x\")\n    prefer 2\n    apply simp\n   apply (erule injD, assumption) \napply (simp add: comp_fun_commute_def)\nby force\n\nlemma fold_one: \"Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} {n} = {f n}\"\n  thm Finite_Set.comp_fun_commute.fold_insert\n  apply (subgoal_tac \"comp_fun_commute (\\<lambda>x::'a. insert (f x))\")\n   apply (drule_tac A = \"{}\" in Finite_Set.comp_fun_commute.fold_insert)\n     apply simp+\n  apply (simp add: comp_fun_commute_def)\nby force\n\nlemma fmap_lem_one: \"fmap f {a} = {f a}\"\nby (simp add: fmap_def fold_one)\n\n\nlemma fmap_lem[rule_format]: \"finite S \\<Longrightarrow> \\<forall> n. (fmap f (insert n S)) = (insert (f n) (fmap f S))\"\n  thm finite.induct\n  apply (erule_tac F = S in finite_induct)\n   apply (rule allI)\n   apply (simp add: fmap_def)\n   apply (rule fold_one)\n(* *)\n  apply (subgoal_tac \"comp_fun_commute (\\<lambda>x::'a. insert (f x))\")\n   apply (rule allI)\n   apply (drule_tac x = x in spec)\n   apply (erule ssubst)\n   apply (subgoal_tac \"fmap f (insert n (insert x F)) = insert (f n) (fmap f (insert x F))\")\n  apply (erule ssubst)\n    apply (subgoal_tac \"fmap f (insert x F) = insert (f x) (fmap f F)\")\n     apply simp\n    apply (drule_tac A = \"F\" in Finite_Set.comp_fun_commute.fold_insert)\n      apply assumption\n     apply assumption\n    apply (unfold fmap_def, assumption)\n   apply (case_tac \"n \\<in> insert x F\")\n    defer\n    apply (drule_tac A = \"insert x F\" in Finite_Set.comp_fun_commute.fold_insert)\n     apply simp\n  apply assumption+\n  apply (simp add: comp_fun_commute_def)\n  apply force\n(* n \\<in> insert x F *)\n  apply (simp add: Finite_Set.comp_fun_commute.fold_rec)\n  apply (subgoal_tac \"Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} (insert n (insert x F)) =\n                     Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} (insert x F)\")\n   prefer 2\n   apply (subgoal_tac \"insert n (insert x F) = insert x F\")\n    apply simp\n  apply blast\n  apply (erule ssubst)\n  apply (rule Finite_Set.comp_fun_commute.fold_rec)\napply (simp add: comp_fun_commute_def)\n   apply force\n  by simp\n\n\nlemma insert_delete: \"x \\<notin> S \\<Longrightarrow> (insert x S) - {x} = S\"\nby simp\n\nlemma fmap_lem_del[rule_format]: \"finite S \\<Longrightarrow> inj f \\<Longrightarrow> \\<forall> n \\<in> S. fmap f (S - {n}) = (fmap f S) - {f n}\"\n  apply (erule_tac F = S in finite_induct)\n   apply (rule ballI)\n   apply (simp add: fmap_def)\n(* *)\n  apply (subgoal_tac \"comp_fun_commute (\\<lambda>x::'a. insert (f x))\")\n   apply (rule ballI)\napply simp\n   apply (erule disjE)\n(* n = x *)\n    apply simp\n    apply (drule_tac A = \"F\" and z = \"{}\" in Finite_Set.comp_fun_commute.fold_insert)\n      apply assumption+\n    apply (unfold fmap_def)\n    apply (rotate_tac -1)\n  apply (erule ssubst)\n  apply (rule sym)\n    apply (rule insert_delete)\n    apply (erule contrapos_nn)\n  apply (rule fmap_lem_map_rev, assumption, assumption)\n  apply (simp add: fmap_def)\n(* n \\<in> F *)\n    apply (frule_tac A = \"F\" and z = \"{}\" in Finite_Set.comp_fun_commute.fold_insert, assumption, assumption)\n   apply (rotate_tac -1)\n   apply (erule ssubst)\n  apply (subgoal_tac \"insert (f x) (Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} F) - {f n} =\n                      insert (f x) ((Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} F) - {f n})\")\n   apply (rotate_tac -1)\n   apply (erule ssubst)\n   apply (drule_tac x = n in bspec,assumption)\n   apply (rotate_tac -1)\n   apply (erule subst)\n    apply (drule_tac A = \"F - {n}\" and z = \"{}\" and x = x in Finite_Set.comp_fun_commute.fold_insert)\n      apply simp+\n    apply (subgoal_tac \"insert x (F - {n}) = insert x F - {n}\")\n     apply simp\n    apply blast\n   apply (subgoal_tac \"f x \\<noteq> f n\")\n    apply force\n   apply (subgoal_tac \"x \\<noteq> n\")\n  apply (rotate_tac -1)\n  apply (erule contrapos_nn)\n    apply (erule injD, assumption)\n  apply blast\napply (simp add: comp_fun_commute_def)\nby force\n\nthm finite_induct\n\nlemma fmap_empty1: \"(fmap f {} = S) \\<Longrightarrow> (S = {})\"\n  by (simp add: fmap_def)\n\nlemma fmap_empty2: \"S = {} \\<Longrightarrow> fmap f {} = S\"\n  by (simp add: fmap_def)\n\nlemma fmap_empty: \"(fmap f {} = S) = (S = {})\"\nproof  \n  show \"fmap f {} = S \\<Longrightarrow> S = {}\"\n    by (erule fmap_empty1)\nnext show  \"S = {} \\<Longrightarrow> fmap f {} = S\"\n    by (erule fmap_empty2)\nqed\n\nlemma fmap_empty3: \"fmap f {} = {}\"\n  by (simp add: fmap_def)\n\nlemma fmap_empty4[rule_format]: \"finite S \\<Longrightarrow> fmap f S = {} \\<longrightarrow> S = {}\"\n  apply (erule_tac F = S in finite_induct)\n  apply simp\n  apply (simp add: fmap_def)\n  apply (subgoal_tac \"Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} ({x}) \\<noteq> {}\")\n  apply (subgoal_tac \"Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} ({x}) \\<subseteq> \n                      Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} (insert x F)\")\n    apply blast\n  apply (subst fold_one)\n   apply (subgoal_tac \"comp_fun_commute (\\<lambda>x::'a. insert (f x))\")\n  thm Finite_Set.comp_fun_commute.fold_insert\n   apply (drule_tac A = \"F\" and z = \"{}\" in Finite_Set.comp_fun_commute.fold_insert)\n     apply simp\n     apply simp\n  apply (erule ssubst)\n    apply simp\n     apply (simp add: comp_fun_commute_def)\n     apply force\n    apply (subst fold_one)\n  by simp\n\n\nlemma insert_delete0: \"x \\<in> A \\<Longrightarrow> A = insert x (A - {x})\"\n  by auto\n\nlemma fmap_inj[rule_format]: \n  assumes \"finite S\" and \"inj f\"\n  shows \"\\<forall> S'. finite S' \\<longrightarrow> fmap f S = fmap f S' \\<longrightarrow> S = S'\"\n  using assms\nproof (erule_tac F = S in finite_induct, clarify)\n  show \"\\<And>S'::'a set. inj f \\<Longrightarrow> finite S \\<Longrightarrow> inj f \\<Longrightarrow> finite S' \\<Longrightarrow> \n        fmap f {} = fmap f S' \\<Longrightarrow> {} = S'\"\n    apply (rule sym)\n    apply (rule_tac f = f in fmap_empty4)\n    apply assumption\nby (erule fmap_empty1)\nnext show \"\\<And>(x::'a) F::'a set.\n       inj f \\<Longrightarrow>\n       finite F \\<Longrightarrow>\n       x \\<notin> F \\<Longrightarrow>\n       \\<forall>S'::'a set. finite S' \\<longrightarrow> fmap f F = fmap f S' \\<longrightarrow> F = S' \\<Longrightarrow>\n       \\<forall>S'::'a set. finite S' \\<longrightarrow> fmap f (insert x F) = fmap f S' \\<longrightarrow> insert x F = S'\"\n  proof (clarify)\n    fix x F S'\n    assume a0: \"inj f\"\n       and a1: \"finite F\"\n       and a1a: \"x \\<notin> F\"\n       and a2: \"\\<forall>S'::'a set. finite S' \\<longrightarrow> fmap f F = fmap f S' \\<longrightarrow> F = S'\"\n       and a3: \"finite S'\"\n       and a4: \"fmap f (insert x F) = fmap f S'\"\n    show \"insert x F = S'\"\n    proof -\n      have a5: \"insert (f x) (fmap f F) = fmap f S'\" \n        by (insert fmap_lem[of F f x], drule meta_mp, rule a1, erule subst, rule a4) \n      have a6: \"f x \\<in> fmap f S'\" by (insert a5, erule subst, simp)\n      have a6a: \"x \\<in> S'\" by (rule fmap_lem_map_rev, rule a3, rule a0, rule a6)\n      have a7: \"fmap f S' = insert (f x) ((fmap f S') - {f x})\" \n        by (insert insert_delete0[of \"f x\" \"(fmap f S')\"],drule meta_mp, rule a6)\n      have a8: \"insert (f x) (fmap f F) = insert (f x) ((fmap f S') - {f x})\" \n        by (subst a5, subst a7, rule refl)\n      have a9: \"f x \\<notin> (fmap f F)\" using a0 a1 a1a\n        apply (rule_tac P = \"f x \\<in> fmap f F\" in notI, subgoal_tac \"x \\<in> F\")\n          apply (rule notE, rule a1a, assumption)\n        by (rule fmap_lem_map_rev)\n      have a10: \"f x \\<notin> ((fmap f S') - {f x})\" by simp\n      have a11: \"fmap f F = ((fmap f S') - {f x})\" by (insert a8 a9 a10, force) \n      have a12: \"x \\<in> S' \\<Longrightarrow> fmap f F = fmap f (S' - {x})\" \n        apply (insert fmap_lem_del[of S' f x])\n        apply (drule meta_mp)\n         apply (rule a3)\n        apply (drule meta_mp)\n         apply (rule a0)\n        apply (drule meta_mp, assumption)\n        apply (erule ssubst)\n        by (rule a11)\n(*      have a13: \"x \\<notin> S' \\<Longrightarrow> f x \\<notin> fmap f S'\" \n        by (erule contrapos_nn, rule fmap_lem_map_rev, rule a3, rule a0)\n      have a14: \"x \\<notin> S' \\<Longrightarrow> fmap f F = (fmap f S')\" \n        by (insert a13, drule meta_mp, assumption, subst a11, simp) *)\n      show \"insert x F = S'\"\n        apply (insert a6a)\n         apply (insert a2)\n         apply (drule_tac x = \"S' - {x}\" in spec)\n         apply (drule mp)\n          apply (simp add: a3)\n         apply (drule mp)\n          apply (erule a12)\n         apply (erule ssubst)\n        apply (rule sym)\n        by (erule insert_delete0)\n    qed\n  qed\nqed\n\nlemma fmap_inj0: \"inj f \\<Longrightarrow> inj_on (fmap f){S. finite S}\"\n  apply (rule inj_onI)\n  apply (rule fmap_inj)\n  by simp+\n\n\n\nlemma fmap_lem_map_rev0[rule_format]: \"finite S \\<Longrightarrow> (\\<forall>y\\<in>S. f y \\<noteq> f n) \\<longrightarrow> (f n) \\<in> (fmap f S) \\<longrightarrow> n \\<in> S\"\n  apply (erule_tac F = S in finite_induct)\n   apply (simp add: fmap_def)\n  apply clarify\n  apply (simp add: fmap_def)\n  apply (subgoal_tac \"comp_fun_commute (\\<lambda>x::'a. insert (f x))\")\n   apply (drule_tac A = \"F\" and z = \"{}\" in Finite_Set.comp_fun_commute.fold_insert)\n     apply assumption+\n   apply (subgoal_tac \"f n \\<in> insert (f x) (Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} F)\")\n    prefer 2\n    apply simp\n   apply (subgoal_tac \"f n = f x\")\n  apply simp\n    apply simp\napply (simp add: comp_fun_commute_def)\nby force\n\nlemma fmap_lem_map_rev1: \"finite S \\<Longrightarrow> (\\<forall>y\\<in>S. f y \\<noteq> f n) \\<Longrightarrow> (f n) \\<in> (fmap f S) \\<Longrightarrow> n \\<in> S\"\n  apply (erule fmap_lem_map_rev0)\n  apply (drule bspec, assumption, assumption)\n  by assumption\n\nlemma fmap_lem_del_set1[rule_format]: \"finite S \\<Longrightarrow> \n                        \\<forall> n \\<in> S. fmap f (S - {y. f y = f n}) = (fmap f S) - {f n}\"\n  apply (erule_tac F = S in finite_induct)\n   apply (rule ballI)\n   apply (simp add: fmap_def)\n(* *)\n  apply (subgoal_tac \"comp_fun_commute (\\<lambda>x::'a. insert (f x))\")\n   apply (rule ballI)\n   prefer 2\napply (simp add: comp_fun_commute_def)\n   apply force\n(* *)\n  apply (case_tac \"n = x\")\n   apply (simp add: fmap_def)\n   apply (frule_tac A = \"F\" and z = \"{}\" in Finite_Set.comp_fun_commute.fold_insert)\n     apply assumption+\n   apply (rotate_tac -1)\n  apply (erule ssubst)\n(* *)\n    apply simp\n    apply (case_tac \"\\<exists> y \\<in> F. f y = f x\")\n     apply (erule bexE)\n     apply (drule_tac x = y in bspec, assumption)\n     apply simp+\n   apply (subgoal_tac \"F - {y::'a. f y = f x} = F - {x}\")\n    prefer 2\n  apply blast\n  apply (rotate_tac -1)\n  apply (erule ssubst)\n   apply simp\n  apply (subgoal_tac \"(f x) \\<notin> Finite_Set.fold (\\<lambda>x::'a. insert (f x)) {} F \")\n    apply simp\n   apply (erule contrapos_nn)\n   apply (rule fmap_lem_map_rev1, assumption, assumption)\n   apply (simp add: fmap_def)\n(* *)\n  apply (subgoal_tac \"n \\<in> F\")\n   apply (drule_tac x = n in bspec, assumption)\n  apply (frule_tac f = f and n = x in fmap_lem)\n   apply (rotate_tac -1)\n   apply (erule ssubst)\n(* *)\n  apply (case_tac \"f x = f n\")\n    apply simp\n  apply simp\n   apply (subgoal_tac \"insert (f x) (fmap f F) - {f n} = insert (f x) ((fmap f F) - {f n})\")\n    prefer 2\n    apply force\n  apply (rotate_tac -1)\n   apply (erule ssubst)\n   apply (subgoal_tac \"insert x F - {y::'a. f y = f n} = insert x (F - {y::'a. f y = f n})\")\n    prefer 2\n    apply force\n  apply (rotate_tac -1)\n   apply (erule ssubst)\n   apply (subgoal_tac \"finite (F - {y::'a. f y = f n})\")\n    apply (rotate_tac -1)\n  apply (drule_tac S = \"(F - {y::'a. f y = f n})\" and f = f and n = x in fmap_lem)\n    apply simp\n   apply simp\nby (simp add: comp_fun_commute_def)\n*)\n\ndefinition ref_map :: \"[RRLoopTwo.infrastructure, \n                        [RRLoopOne.igraph, RRLoopOne.location] \\<Rightarrow> policy set]\n                        \\<Rightarrow> RRLoopOne.infrastructure\"\n  where \"ref_map I lp = RRLoopOne.Infrastructure \n                                 (RRLoopOne.Lgraph\n                                        (RRLoopTwo.gra (graphI I))(RRLoopTwo.agra (graphI I))\n                                        (RRLoopTwo.cgra (graphI I))\n                                        (\\<lambda> l. fmap snd (RRLoopTwo.lgra (graphI I) l)))\n                                                                         lp\"\n(* archive, older approaches that are similar:\n (\\<lambda> l. Finite_Set.fold (\\<lambda> x y. insert (snd x) y){}(RRLoopTwo.lgra (graphI I) l)))\n(\\<lambda> l. {x. ? y. (y,x) \\<in> (RRLoopTwo.lgra (graphI I) l)}))\n*)\n\nlemma delta_invariant: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  delta(z) = delta(z')\"    \n  apply clarify\n  apply (erule state_transition_in.cases)\n  by simp+\nend\n", "meta": {"author": "flokam", "repo": "IsabelleAT", "sha": "b8d80c31ac13fdf8c7710f7ae032233b3fa474da", "save_path": "github-repos/isabelle/flokam-IsabelleAT", "path": "github-repos/isabelle/flokam-IsabelleAT/IsabelleAT-b8d80c31ac13fdf8c7710f7ae032233b3fa474da/RRLoopTwo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3354951426279839}}
{"text": "theory IICF_MS_Array_List\nimports \n  \"../Intf/IICF_List\" IICF_Array\nbegin\n\n  (* TODO: Move *)\n  lemma hfref_bassnI:\n    assumes \"\\<And>x. \\<lbrakk>P x; rdomp (fst A) x\\<rbrakk> \\<Longrightarrow> fa x \\<le> SPEC Q\"\n    assumes \"(fc,fa)\\<in>[P]\\<^sub>a A \\<rightarrow> R\"\n    shows \"(fc,fa)\\<in>[P]\\<^sub>a A \\<rightarrow> b_assn R Q\"\n  proof (cases A)\n    case [simp]: (Pair Apre Apost)\n    then show ?thesis \n      apply sepref_to_hoare\n      apply clarsimp\n      apply (rule htriple_pure_preI)\n      supply [vcg_rules] = assms(2)[to_hnr, THEN hn_refineD,unfolded autoref_tag_defs hn_ctxt_def, simplified]\n      apply vcg\n      apply (frule (1) order_trans[OF _ assms(1)])\n      subgoal by (auto simp: pure_part_def rdomp_def) \n      subgoal by vcg \n      done\n    \n  qed\n\n\n\n\n  definition \"ms_irel M N \\<equiv> br (\\<lambda>(l,xs). take l xs) (\\<lambda>(l,xs). l\\<le>N \\<and> N = length xs \\<and> N<M)\"\n\n  \n  definition \"ms_empty N \\<equiv> RETURN (0::nat,replicate N init)\"\n  definition \"ms_is_empty \\<equiv> \\<lambda>(l,_). RETURN (l=0)\"\n  definition \"ms_length \\<equiv> \\<lambda>(l,_). RETURN l\"\n  definition \"ms_push_back \\<equiv> \\<lambda>(l,xs) x. ASSERT (l < length xs) \\<then> RETURN (l+1,xs[l:=x])\"\n  definition \"ms_last \\<equiv> \\<lambda>(l,xs). ASSERT (0<l \\<and> l\\<le>length xs) \\<then> RETURN (xs!(l-1))\"\n  definition \"ms_butlast \\<equiv> \\<lambda>(l,xs). ASSERT (l>0) \\<then> RETURN (l-1,xs)\"\n  definition \"ms_get \\<equiv> \\<lambda>(l,xs) i. ASSERT (i<length xs) \\<then> RETURN (xs!i)\"\n  definition \"ms_set \\<equiv> \\<lambda>(l,xs) i x. ASSERT (i<length xs) \\<then> RETURN (l,xs[i:=x])\"\n\n  context begin\n  \n    private method ms_prove_refine = \n      (unfold ms_irel_def curry0_def;\n        intro nres_relI fun_relI frefI;\n        simp?;\n        refine_vcg?;\n        (auto simp: in_br_conv)\n      )\n  \n    lemma ms_empty_correct: \"N<M \\<Longrightarrow> (ms_empty N,mop_list_empty) \\<in> \\<langle>ms_irel M N\\<rangle>nres_rel\"\n      unfolding ms_empty_def by ms_prove_refine\n      \n    lemma ms_is_empty_correct: \"(ms_is_empty,mop_list_is_empty) \\<in> ms_irel M N \\<rightarrow> \\<langle>bool_rel\\<rangle>nres_rel\"  \n      unfolding ms_is_empty_def by ms_prove_refine\n\n    lemma ms_length_correct: \"(ms_length,mop_list_length) \\<in> ms_irel M N \\<rightarrow> \\<langle>nat_rel\\<rangle>nres_rel\"  \n      unfolding ms_length_def by ms_prove_refine\n    \n    lemma ms_push_back_correct: \"(uncurry ms_push_back,uncurry mop_list_append) \n      \\<in> [\\<lambda>(xs,x). length xs < N]\\<^sub>f (ms_irel M N \\<times>\\<^sub>r Id) \\<rightarrow> \\<langle>ms_irel M N\\<rangle>nres_rel\"  \n      unfolding ms_push_back_def \n      supply [simp] = take_update_last\n      by ms_prove_refine \n      \n    lemma ms_last_correct: \"(ms_last,mop_list_last)\\<in>ms_irel M N \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"  \n      unfolding ms_last_def supply [simp] = last_take_nth_conv by ms_prove_refine\n\n    lemma ms_butlast_correct: \"(ms_butlast,mop_list_butlast)\\<in>ms_irel M N \\<rightarrow> \\<langle>ms_irel M N\\<rangle>nres_rel\"  \n      unfolding ms_butlast_def supply [simp] = butlast_take by ms_prove_refine\n    \n    lemma ms_get_correct: \"(ms_get,mop_list_get)\\<in>ms_irel M N \\<rightarrow> nat_rel \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"  \n      unfolding ms_get_def by ms_prove_refine\n\n    lemma ms_set_correct: \"(ms_set,mop_list_set)\\<in>ms_irel M N \\<rightarrow> nat_rel \\<rightarrow> Id \\<rightarrow> \\<langle>ms_irel M N\\<rangle>nres_rel\"  \n      unfolding ms_set_def by ms_prove_refine\n    \n  end\n\n  type_synonym ('l,'a) marl = \"'l word \\<times> 'a ptr\"\n  \n  context\n    fixes M :: nat\n    defines \"M \\<equiv> max_snat (LENGTH ('l::len2))\"\n  begin\n\n    lemma ms_irel_prenorm[fcomp_prenorm_simps]: \n      assumes \"((l,xs),xs')\\<in>ms_irel M N\"\n      shows \"length xs = N\" \"l=length xs'\" \"length xs'\\<le>N\" \"N < M\"\n      using assms\n      unfolding ms_irel_def\n      by (auto simp: in_br_conv)\n  \n\n    abbreviation \"marl2_assn \\<equiv> snat_assn' TYPE('l) \\<times>\\<^sub>a array_assn id_assn\"\n  \n    \n    sepref_definition marl_empty_impl [llvm_inline] is \"ms_empty\" :: \"(snat_assn' TYPE('l))\\<^sup>k \\<rightarrow>\\<^sub>a marl2_assn\"\n      unfolding ms_empty_def\n      supply [sepref_import_param] = IdI[of init]\n      apply (annot_snat_const \"TYPE('l)\")\n      apply (rewrite array_fold_custom_replicate)\n      by sepref\n\n      \n    definition [simp]: \"marl_empty_aux (N::nat) \\<equiv> op_list_empty\"  \n    \n    sepref_decl_op marl_empty: marl_empty_aux :: \"nat_rel \\<rightarrow> \\<langle>A\\<rangle>list_rel\" .\n    \n    lemma ms_empty_correct': \"(ms_empty,RETURN o op_marl_empty) \n      \\<in> [\\<lambda>N. N<M]\\<^sub>f\\<^sub>d nat_rel \\<rightarrow> (\\<lambda>N. \\<langle>ms_irel M N\\<rangle>nres_rel)\"\n      apply (rule frefI) using ms_empty_correct by auto\n\n    (*    \n    definition \"marl_assn' TYPE('l) N A \\<equiv> hr_comp (hr_comp marl2_assn (ms_irel (max_snat LENGTH('l)) N))\n                                     (\\<langle>the_pure A\\<rangle>list_rel)\" \n    *)\n    \n    definition \"marl_assn' TYPE('l) A \\<equiv> hrr_comp nat_rel\n                                    (\\<lambda>N. hr_comp marl2_assn (ms_irel M N))\n                                    (\\<lambda>_. \\<langle>the_pure A\\<rangle>list_rel)\"\n                                         \n    lemmas [fcomp_norm_unfold] = marl_assn'_def[symmetric, folded M_def]\n    \n    lemma marl_assn'_fold'[fcomp_norm_unfold]: \n      \"hr_comp (hr_comp (snat_assn \\<times>\\<^sub>a array_assn id_assn) (ms_irel M N)) (\\<langle>the_pure A\\<rangle>list_rel)\n        = marl_assn' TYPE('l) A N\"\n      unfolding marl_assn'_def\n      unfolding hrr_comp_def \n      apply (auto simp: fun_eq_iff sep_algebra_simps pred_lift_extract_simps)\n      unfolding non_dep_def by metis+\n    \n    sepref_decl_impl marl_empty: marl_empty_impl.refine[FCOMP ms_empty_correct'] by simp \n  \n    sepref_definition marl_is_empty_impl [llvm_inline] is ms_is_empty :: \"marl2_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n      unfolding ms_is_empty_def\n      apply (annot_snat_const \"TYPE('l)\")\n      apply sepref_dbg_keep\n      done\n      \n    sepref_decl_impl (ismop) marl_is_empty_impl.refine[FCOMP ms_is_empty_correct[of M]] .\n      \n    sepref_definition marl_length_impl [llvm_inline] is ms_length :: \"marl2_assn\\<^sup>k \\<rightarrow>\\<^sub>a snat_assn' TYPE('l)\"\n      unfolding ms_length_def\n      by sepref\n    sepref_decl_impl (ismop) marl_length_impl.refine[FCOMP ms_length_correct[of M]] .\n\n  \n    sepref_definition marl_push_back_impl [llvm_code] is \n      \"uncurry ms_push_back\" :: \"[\\<lambda>((l,a),_). length a < M ]\\<^sub>a marl2_assn\\<^sup>d*\\<^sub>aid_assn\\<^sup>k \\<rightarrow> marl2_assn\"\n      unfolding ms_push_back_def M_def\n      apply (annot_snat_const \"TYPE('l)\")\n      apply sepref_dbg_keep\n      done\n\n    sepref_decl_impl (ismop) marl_push_back_impl.refine[FCOMP ms_push_back_correct[where M=M]]  \n      by (parametricity add: IdI[of N])\n      \n      \n    sepref_definition marl_last_impl [llvm_code] is \n      \"ms_last\" :: \"marl2_assn\\<^sup>k \\<rightarrow>\\<^sub>a id_assn\"\n      unfolding ms_last_def M_def\n      apply (annot_snat_const \"TYPE('l)\")\n      apply sepref_dbg_keep\n      done\n    sepref_decl_impl (ismop) marl_last_impl.refine[FCOMP ms_last_correct[where M=M]] .\n      \n    sepref_definition marl_butlast_impl [llvm_code] is \n      \"ms_butlast\" :: \"marl2_assn\\<^sup>d \\<rightarrow>\\<^sub>a marl2_assn\"\n      unfolding ms_butlast_def M_def\n      apply (annot_snat_const \"TYPE('l)\")\n      apply sepref_dbg_keep\n      done\n    sepref_decl_impl (ismop) marl_butlast_impl.refine[FCOMP ms_butlast_correct[where M=M]] .\n      \n    \n    sepref_definition marl_get_impl [llvm_inline] is \n      \"uncurry ms_get\" :: \"marl2_assn\\<^sup>k *\\<^sub>a (snat_assn' TYPE('l))\\<^sup>k \\<rightarrow>\\<^sub>a id_assn\"\n      unfolding ms_get_def M_def\n      apply sepref_dbg_keep\n      done\n    sepref_decl_impl (ismop) marl_get_impl.refine[FCOMP ms_get_correct[where M=M]] .\n      \n    sepref_definition marl_set_impl [llvm_inline] is \n      \"uncurry2 ms_set\" :: \"marl2_assn\\<^sup>d *\\<^sub>a (snat_assn' TYPE('l))\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\<rightarrow>\\<^sub>a marl2_assn\"\n      unfolding ms_set_def M_def\n      apply sepref_dbg_keep\n      done\n    sepref_decl_impl (ismop) marl_set_impl.refine[FCOMP ms_set_correct[where M=M]] .\n  end\n          \n     \n  lemma fold_marl_empty:\n    \"[] = op_marl_empty N\"\n    \"RETURN [] = mop_marl_empty N\" \n    \"op_list_empty = op_marl_empty N\"\n    \"mop_list_empty = mop_marl_empty N\"\n    by auto\n\n\n  (* TODO: Move *)    \n  lemma snat_rel_imp_less_max_snat: \n    \"\\<lbrakk>(x,n)\\<in>snat_rel' TYPE('l::len2); L = LENGTH('l)\\<rbrakk> \\<Longrightarrow> n<max_snat L\"\n    by (auto simp: snat_rel_def snat.rel_def in_br_conv)\n    \n    \n  schematic_goal [sepref_frame_free_rules]: \"MK_FREE (marl_assn' TYPE('l::len2) A N) ?f\"\n    unfolding marl_assn'_fold'[symmetric]\n    by sepref_dbg_side\n  \n  \n  lemma bind_assoc_tagged: \"bind$(bind$m$f)$g = bind$m$(\\<lambda>\\<^sub>2x. bind$(f$x)$g)\" \n    unfolding autoref_tag_defs by simp \n      \n  find_theorems name: beta  \n    \n    \nexperiment begin    \n\n  sepref_definition test is \"\\<lambda>N. (do {\n    let x = op_marl_empty N;\n    RETURN (x@[1::nat])\n  })\" :: \"[\\<lambda>N. N\\<ge>10]\\<^sub>a\\<^sub>d (snat_assn' TYPE(64))\\<^sup>k \\<rightarrow> marl_assn' TYPE(64) (snat_assn' TYPE(64))\"\n    apply (annot_snat_const \"TYPE(64)\")\n    supply [simp] = snat_rel_imp_less_max_snat\n    by sepref\n    \n\nend\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/sepref/IICF/Impl/IICF_MS_Array_List.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.33549513507827744}}
{"text": "section \\<open>Type Safety of Boogie expressions\\<close>\n\ntheory TypeSafety\nimports Semantics Typing Util\nbegin\n\nfun expr_is_defined :: \"var_context \\<Rightarrow> 'a nstate \\<Rightarrow> expr \\<Rightarrow> bool\"\n  where\n     \"expr_is_defined \\<Lambda> ns (Var x) = (lookup_var \\<Lambda> ns x \\<noteq> None)\"\n   | \"expr_is_defined \\<Lambda> ns (BVar i) = (binder_state ns i \\<noteq> None)\"\n   | \"expr_is_defined \\<Lambda> ns (Lit l) = True\"\n   | \"expr_is_defined \\<Lambda> ns (UnOp uop e) = expr_is_defined \\<Lambda> ns e\"\n   | \"expr_is_defined \\<Lambda> ns (e1 \\<guillemotleft>bop\\<guillemotright> e2) = ((expr_is_defined \\<Lambda> ns e1) \\<and> (expr_is_defined \\<Lambda> ns e2))\"\n   | \"expr_is_defined \\<Lambda> ns (FunExp f tys e) = ((list_all closed tys) \\<and> (list_all (expr_is_defined \\<Lambda> ns) e))\"\n   | \"expr_is_defined \\<Lambda> ns (CondExp cond thn els) = ( (expr_is_defined \\<Lambda> ns cond) \\<and> \n                                                      (expr_is_defined \\<Lambda> ns thn) \\<and> \n                                                      (expr_is_defined \\<Lambda> ns els) )\"\n   | \"expr_is_defined \\<Lambda> ns (Old e) = expr_is_defined \\<Lambda> ns e\"\n   | \"expr_is_defined \\<Lambda> ns (Forall ty e) = ((closed ty) \\<and> (\\<forall>w. (expr_is_defined \\<Lambda> (full_ext_env ns w) e)))\"\n   | \"expr_is_defined \\<Lambda> ns (Exists ty e) =  ((closed ty) \\<and> (\\<forall>w. (expr_is_defined \\<Lambda> (full_ext_env ns w) e)))\"\n   | \"expr_is_defined \\<Lambda> ns (ForallT e) = expr_is_defined \\<Lambda> ns e\"\n   | \"expr_is_defined \\<Lambda> ns (ExistsT e) = expr_is_defined \\<Lambda> ns e\"\n\nlemma unop_type_correct: \"\\<lbrakk> unop_type uop arg_ty = Some ret_ty; type_of_val A v' = TPrim arg_ty;\n                         (unop_eval_val uop v') = Some v  \\<rbrakk> \\<Longrightarrow>\n                       type_of_val A v = TPrim ret_ty\"\n  by (cases uop; rule lit_val_elim[where v=v']; auto)\n\nlemma unop_progress: \"\\<lbrakk> unop_type uop arg_ty = Some ret_ty; type_of_val A v' = TPrim arg_ty\\<rbrakk> \\<Longrightarrow>\n                       \\<exists>v. (unop_eval_val uop v') = Some v \"\n  by (cases uop; rule lit_val_elim[where v=v']; auto)\n\nlemma binop_type_correct: \n \"\\<lbrakk> binop_type bop = Some (targs, ret_ty); \n    type_of_val  A v1 = (TPrim left_ty); type_of_val A v2 = (TPrim right_ty); \n    (left_ty, right_ty) \\<in> targs;\n    (binop_eval_val bop v1 v2) = Some v  \\<rbrakk> \\<Longrightarrow>\n    type_of_val A v = TPrim ret_ty\"\n  by (cases bop; rule lit_val_elim[where v=v1]; rule lit_val_elim[where v=v2]; auto)\n\nlemma binop_progress:\n \"\\<lbrakk> binop_type bop = Some (targs, ret_ty); \n    type_of_val  A v1 = TPrim left_ty; type_of_val A v2 = TPrim right_ty;\n   (left_ty, right_ty) \\<in> targs \\<rbrakk> \\<Longrightarrow>\n    \\<exists>v. (binop_eval_val bop v1 v2) = Some v \"\n  by (cases bop; rule lit_val_elim[where v=v1]; rule lit_val_elim[where v=v2]; auto)\n\nlemma binop_realdiv_type_correct:\n \"\\<lbrakk> (binop_eval_val RealDiv v1 v2) = Some v  \\<rbrakk> \\<Longrightarrow>\n    type_of_val A v = TPrim TReal\"  \n  by (rule lit_val_elim[where v=v1]; rule lit_val_elim[where v=v2]; auto)\n\nlemma binop_realdiv_progress:\n \"\\<lbrakk> type_of_val A v1 = TPrim TInt \\<or> type_of_val A v1 = TPrim TReal;\n    type_of_val A v2 = TPrim TInt \\<or> type_of_val A v2 = TPrim TReal \\<rbrakk> \\<Longrightarrow>\n    \\<exists>v. binop_eval_val RealDiv v1 v2  = Some v\"\n  by (rule lit_val_elim[where v=v1]; rule lit_val_elim[where v=v2]; auto)\n\nlemma binop_poly_type_correct:\n \"\\<lbrakk> binop_poly_type bop; binop_eval_val bop v1 v2 = Some v \\<rbrakk> \\<Longrightarrow> type_of_val A v = TPrim TBool\"\n  by (cases bop; rule lit_val_elim[where v=v1]; rule lit_val_elim[where v=v2]; auto)\n\ntext\\<open>check whether the free variables of a type are at smaller than some value\\<close>\nfun wf_ty :: \"nat \\<Rightarrow> ty \\<Rightarrow> bool\"\n  where \n   \"wf_ty n (TVar i) = (i < n)\"\n | \"wf_ty n (TPrim p) = True\"\n | \"wf_ty n (TCon tcon_id ty_args) = list_all (wf_ty n) ty_args\"\n\nprimrec wf_expr :: \"nat \\<Rightarrow> expr \\<Rightarrow> bool\"\n  where \n    \"wf_expr k (Var x) = True\"\n  | \"wf_expr k (BVar i) = True\"\n  | \"wf_expr k (Lit l) = True\"\n  | \"wf_expr k (UnOp uop e) = wf_expr k e\"\n  | \"wf_expr k (e1 \\<guillemotleft>bop\\<guillemotright> e2) = (wf_expr k e1 \\<and> wf_expr k e2)\"\n  | \"wf_expr k (FunExp f ty_args args) = ((list_all (wf_ty k) ty_args) \\<and> (list_all (wf_expr k) args))\"\n  | \"wf_expr k (CondExp cond e1 e2) = (wf_expr k cond \\<and> wf_expr k e1 \\<and> wf_expr k e2)\"\n  | \"wf_expr k (Old e) = wf_expr k e\"\n  | \"wf_expr k (Forall ty e) = ((wf_ty k ty) \\<and> (wf_expr k e))\"\n  | \"wf_expr k (Exists ty e) = ((wf_ty k ty) \\<and> (wf_expr k e))\"\n  | \"wf_expr k (ExistsT e) = (wf_expr (k+1) e)\"\n  | \"wf_expr k (ForallT e) = (wf_expr (k+1) e)\"\n\ntext \\<open>A function declaration is well-formed, if the free type variables in the specified types are \ncaptured by the type parameters of the function\\<close>\n\nfun wf_fdecl :: \"(nat \\<times> ty list \\<times> ty) \\<Rightarrow> bool\"\n  where \n    \"wf_fdecl (n, args_ty, ret_ty) = ((list_all (wf_ty n) args_ty) \\<and> (wf_ty n ret_ty))\"\n\nlemma closed_instantiate: \"list_all closed \\<Omega> \\<Longrightarrow> wf_ty (length \\<Omega>) \\<tau> \\<Longrightarrow> closed (instantiate \\<Omega> \\<tau>)\"\n  by (induction \\<tau>) (auto simp: list_all_iff)\n\nlemma msubst_msubst: \n  assumes \"wf_ty (length ts2) t\" and \n          \"list_all (wf_ty (length ts1)) ts2\" and \n          \"list_all closed ts1\"\n  shows \"msubstT ts1 (msubstT ts2 t) = msubstT (map (msubstT ts1) ts2) t\"\n  using assms\n  oops\n\nlemma instantiate_msubst_opt:\n  assumes \"wf_ty (length ts) \\<tau>\"\n  shows \"instantiate \\<Omega> (msubstT_opt ts \\<tau>) = instantiate (map (instantiate \\<Omega>) ts) \\<tau>\"\n  using assms\nproof (induction \\<tau>)\n  case (TVar x)\n  hence \"x < length ts\" by simp\n  hence \"msubstT_opt ts (TVar x) = ts ! x\" by (simp add: msubstT_opt_def)\n  thus ?case using \\<open>x < length ts\\<close> by simp\nnext\n  case (TPrim x)\n  then show ?case by (simp add: msubstT_opt_def)\nnext\n  case (TCon x1a x2a)\n  thus ?case \n  apply (simp add: msubstT_opt_def)\n  by (metis (no_types, lifting) in_set_conv_nth list_all_length)\nqed\n\nlemma map_of_list_all:\n  assumes Map:\"map_of xs k = Some x\" and\n          Pred:\"list_all (P \\<circ> snd) xs\"\n  shows \"P x\"\nproof -\n  from Map obtain i where \"(i,x) \\<in> set xs\"\n    by (meson map_of_SomeD) \n  with Pred show ?thesis\n    by (metis comp_apply in_set_conv_nth list_all_length snd_conv) \nqed\n\nlemma map_map:\n  assumes \"map f (map g xs) = ys\"\n  shows \"map (f \\<circ> g) xs = ys\"\n  using assms\n  by auto\n\ndefinition state_well_typed :: \"'a absval_ty_fun \\<Rightarrow> var_context \\<Rightarrow> rtype_env \\<Rightarrow> 'a nstate \\<Rightarrow> bool\"\n  where \"state_well_typed A \\<Lambda> \\<Omega> ns \\<equiv>\n         state_typ_wf A \\<Omega> (local_state ns) (snd \\<Lambda>) \\<and>\n         state_typ_wf A \\<Omega> (global_state ns) (fst \\<Lambda>) \\<and>\n         state_typ_wf A \\<Omega> (old_global_state ns) (fst \\<Lambda>) \\<and>\n         (binder_state ns = Map.empty)\"\n\nlemma state_well_typed_lookup: \n  assumes \"state_well_typed A \\<Lambda> \\<Omega> ns\" and\n          \"lookup_var_ty \\<Lambda> x = Some \\<tau>\"          \n        shows \"\\<exists>v. lookup_var \\<Lambda> ns x = Some v \\<and>type_of_val A v = instantiate \\<Omega> \\<tau>\"\n  using assms\n  unfolding state_well_typed_def\n  using state_typ_wf_lookup lookup_var_ty_decl_Some\n  by blast\n\nlemma state_well_typed_lookup_old:\n  assumes \"state_well_typed A \\<Lambda> \\<Omega> ns\" and\n          \"lookup_var_ty \\<Lambda> x = Some \\<tau>\"          \n  shows \"\\<exists>v. lookup_var \\<Lambda> (ns\\<lparr>global_state := old_global_state ns\\<rparr>) x = Some v \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>\"  \n  apply (rule state_typ_wf_lookup)\n  using assms\n  unfolding state_well_typed_def\n  by auto \n\nlemma old_global_switch_wt:\n  assumes \"state_well_typed A \\<Lambda> \\<Omega> n_s\"\n  shows \"state_well_typed A \\<Lambda> \\<Omega> (n_s\\<lparr>global_state := old_global_state n_s\\<rparr>)\"\n  using assms\n  unfolding state_well_typed_def\n  by simp\n\ntext \\<open>Type preservation theorem\\<close>\n\ntheorem preservation:\n  assumes \n          \"list_all closed \\<Omega>\" and\n          \"\\<forall> k \\<tau>'. ((fst \\<Delta>) k = Some \\<tau>') \\<longrightarrow> (\\<exists>v. (lookup_var \\<Lambda> n_s k = Some v) \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>')\" and\n          \"\\<forall> k \\<tau>'. ((fst \\<Delta>) k = Some \\<tau>') \\<longrightarrow> (\\<exists>v. (lookup_var \\<Lambda> (n_s\\<lparr>global_state := old_global_state n_s\\<rparr>) k = Some v) \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>')\" and\n          \"\\<forall> i \\<tau>'. ((snd \\<Delta>) i = Some \\<tau>') \\<longrightarrow> (\\<exists>v. binder_state n_s i = Some v \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>')\" and\n          Wf_\\<Gamma>:\"fun_interp_wf A F \\<Gamma>\" and\n          Wf_F:\"list_all (wf_fdecl \\<circ> snd) F\"          \n  shows \"F, \\<Delta> \\<turnstile> e : \\<tau> \\<Longrightarrow> wf_expr (length \\<Omega>) e \\<Longrightarrow> A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,n_s\\<rangle> \\<Down> v \\<Longrightarrow> type_of_val A v = instantiate \\<Omega> \\<tau>\" and \n        \"F, \\<Delta> \\<turnstile> es [:] ts \\<Longrightarrow> list_all (wf_expr (length \\<Omega>)) es \\<Longrightarrow> A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>es,n_s\\<rangle> [\\<Down>] vs \\<Longrightarrow>\n          map (type_of_val A) vs = (map (instantiate \\<Omega>) ts)\"\n  using assms\nproof (induction arbitrary: v n_s \\<Omega> and vs n_s \\<Omega> rule: typing_typing_list.inducts)\n  case (TypVar \\<Delta> x ty)\n  then show ?case by fastforce\nnext\n  case (TypBVar \\<Delta> x ty)\n  then show ?case\n    by (metis RedBVar expr_eval_determ(1)) \nnext\ncase (TypPrim l prim_ty \\<Delta>)\n  then show ?case by fastforce\nnext\n  case (TypUnOp \\<Delta> e arg_ty uop ret_ty)\n  from this obtain v' where \n     \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,n_s\\<rangle> \\<Down> v'\" and \"unop_eval_val uop v' = Some v\" by auto\n  moreover from this have \"type_of_val A v' = TPrim arg_ty\" using TypUnOp by auto\n  ultimately show ?case using \\<open>unop_type uop arg_ty = Some ret_ty\\<close> unop_type_correct by fastforce \nnext\n  case (TypBinOpMono bop targs ret_ty \\<Delta> e1 left_ty e2 right_ty)\n  from this obtain v1 v2 where \n     \"A, \\<Lambda>, \\<Gamma>, \\<Omega> \\<turnstile> \\<langle>e1, n_s\\<rangle> \\<Down> v1\" and \"A, \\<Lambda>, \\<Gamma>, \\<Omega> \\<turnstile> \\<langle>e2, n_s\\<rangle> \\<Down> v2\" and \n     E:\"binop_eval_val bop v1 v2 = Some v\"\n    by auto\n  moreover from this have T1:\"type_of_val A v1 = TPrim left_ty\" and \n    T2:\"type_of_val A v2 = TPrim right_ty\" using TypBinOpMono by auto\n  ultimately show ?case using \\<open>(left_ty, right_ty) \\<in> targs\\<close> \\<open>binop_type bop = Some (targs, ret_ty)\\<close> binop_type_correct      \n    using TypBinOpMono.hyps(2) \n    by fastforce\nnext\n  case (TypBinopPoly bop \\<Delta> e1 ty1 e2 ty2 ty_inst)\n  from this obtain v1 v2 where \n     E:\"binop_eval_val bop v1 v2 = Some v\" by auto\n  thus ?case using  \\<open>binop_poly_type bop\\<close> binop_poly_type_correct by fastforce\nnext\n  case (TypFunExp f n_ty_params args_ty ret_ty ty_params args \\<Delta>)\n  from this obtain vargs fi where\n     RedArgs:\"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>args, n_s\\<rangle> [\\<Down>] vargs\" and Mem\\<Gamma>:\"\\<Gamma> f = Some fi\" and     \n    \"fi (map (instantiate \\<Omega>) ty_params) vargs = Some v\"\n    by auto\n  with TypFunExp have FunSingleWf:\"fun_interp_single_wf A (n_ty_params, args_ty, ret_ty) fi\"\n    using fun_interp_wf_def by (metis (mono_tags, lifting) option.inject)\n  have A1:\"length (map (instantiate \\<Omega>) ty_params) = n_ty_params\" using TypFunExp\n    using length_map by simp \n  have Wf_args_ty:\"list_all (wf_ty n_ty_params) args_ty\" using Wf_F \\<open>map_of F f = Some (n_ty_params, args_ty, ret_ty)\\<close>\n    by (meson map_of_list_all wf_fdecl.simps)   \n  have Wf_ret_ty:\"wf_ty n_ty_params ret_ty\" using Wf_F \\<open>map_of F f = Some (n_ty_params, args_ty, ret_ty)\\<close>\n    by (meson map_of_list_all wf_fdecl.simps)\n  have A3:\"length vargs = length args_ty\"\n    using RedArgs TypFunExp.hyps(2) red_exprs_length by fastforce\n  have A4:\"list_all closed (map (instantiate \\<Omega>) ty_params)\"\n    using TypFunExp.prems(1) TypFunExp.prems(3) closed_instantiate wf_ty.simps(3) by fastforce\n  have \"list_all (wf_expr (length \\<Omega>)) args\" using TypFunExp by simp\n  have InstMSubst:\"(map (instantiate \\<Omega>) (map (msubstT_opt ty_params) args_ty)) = map (instantiate (map (instantiate \\<Omega>) ty_params)) args_ty\"\n    using Wf_args_ty \\<open>length ty_params = n_ty_params\\<close>\n    apply simp\n    apply rule\n    apply (rule instantiate_msubst_opt)\n    by (simp add: list.pred_set)   \n  have\n   \"map (type_of_val A) vargs = (map (instantiate \\<Omega>) (map (msubstT_opt ty_params) args_ty))\"\n    using RedArgs TypFunExp \\<open>list_all (wf_expr (length \\<Omega>)) args\\<close>\n    using Wf_F by blast \n  hence \"type_of_val A v = instantiate (map (instantiate \\<Omega>) ty_params) ret_ty\"\n    apply (simp only: InstMSubst)\n    using FunSingleWf A1 A3 A4 \n    apply auto\n    by (metis (no_types, lifting) A1 \\<open>fi (map (instantiate \\<Omega>) ty_params) vargs = Some v\\<close> option.inject) \n  thus ?case using TypFunExp.IH(1)\n    by (simp add: TypFunExp.hyps(1) Wf_ret_ty instantiate_msubst_opt)\nnext\n  case (TypCondExp \\<Delta> cond thn ty els)\n  thus ?case by auto\nnext\n  case (TypOld \\<Delta> e ty)\n  from TypOld have RedE:\"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, n_s\\<lparr>global_state := old_global_state n_s \\<rparr>\\<rangle> \\<Down> v\" by auto\n  show ?case\n    apply (rule TypOld.IH(2))\n    using TypOld.prems apply simp\n          apply (rule RedE)\n    using TypOld.prems by auto\nnext\n  case (TypForall \\<Delta> ty e)\n  then show ?case by (auto dest: forall_red)    \nnext\ncase (TypExists \\<Delta> ty e)\n  then show ?case by (auto dest: exists_red)\nnext\n  case (TypForallT \\<Delta> e)\n  then show ?case using msubst_ty_forallT by (auto dest: forallt_red_bool)\nnext\n  case (TypExistsT \\<Delta> e)\n  then show ?case using msubst_ty_existsT by (auto dest: existst_red_bool)\nnext\n  case (TypListNil \\<Delta>)\n  then show ?case by auto \nnext\n  case (TypListCons \\<Delta> e ty es tys)\n  from \\<open>A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>(e # es),n_s\\<rangle> [\\<Down>] vs\\<close> have A0:\"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> hd vs\"\n    using cons_exp_elim by blast \n  moreover from \\<open>A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>(e # es),n_s\\<rangle> [\\<Down>] vs\\<close> have \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>es, n_s\\<rangle> [\\<Down>] tl vs\"\n   using cons_exp_elim by blast\n  with A0 TypListCons have A1:\"type_of_val A (hd vs) = instantiate \\<Omega> ty\" and\n                        A2:\"map (type_of_val A) (tl vs) = map (instantiate \\<Omega>) tys\" by auto\n  moreover have \"(hd vs) # (tl vs) = vs\" using \\<open>A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>(e # es),n_s\\<rangle> [\\<Down>] vs\\<close> \n      using cons_exp_elim list.collapse by blast\n  ultimately show ?case\n    by (metis list.simps(9))\nqed\n\nlemma instantiate_shift: \"wf_ty (length \\<Omega>) \\<tau> \\<Longrightarrow> instantiate (t#\\<Omega>) (shiftT 1 0 \\<tau>) = instantiate \\<Omega> \\<tau>\"\n  by (induction \\<tau>) (auto simp add: list_all_iff)\n  \nlemma instantiate_shift_wf: \"wf_ty (length \\<Omega>) \\<tau> \\<Longrightarrow> wf_ty (Suc (length \\<Omega>)) (shiftT 1 0 \\<tau>)\"\n  by (induction \\<tau>) (auto simp add: list_all_iff)\n\nlemma lookup_only_local_global:\n  assumes \"local_state ns = local_state ns'\" and\n          \"global_state ns = global_state ns'\"\n  shows \"lookup_var \\<Lambda> ns x = lookup_var \\<Lambda> ns' x\"\n  using assms\n  by (metis lookup_var_def)\n\n(* TODO: find a better solution *)\nlemma helper_lemma_old_state:  \n  assumes \"\\<forall>k \\<tau>. M k = Some \\<tau> \\<longrightarrow> (\\<exists>v. lookup_var \\<Lambda> (n_s\\<lparr>global_state := old_global_state n_s\\<rparr>) k = Some v \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>)\"\n  shows \"  \\<forall>k \\<tau>. M k = Some \\<tau> \\<longrightarrow>\n                (\\<exists>v. lookup_var \\<Lambda> ((full_ext_env n_s w)\\<lparr>global_state := old_global_state (full_ext_env n_s w)\\<rparr>) k = Some v \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>)\"\nproof (rule allI, rule allI, rule impI)\n  fix k \\<tau>\n  assume \"M k = Some \\<tau>\"\n  from this obtain v where Lookup:\"lookup_var \\<Lambda> (n_s\\<lparr>global_state := old_global_state n_s\\<rparr>) k = Some v\" and Typ:\"type_of_val A v = instantiate \\<Omega> \\<tau>\" using assms\n    by auto\n  have Aux1:\"old_global_state (full_ext_env n_s w) = old_global_state n_s\"\n    by simp\n  have Aux2:\"\\<And>n_s gs. lookup_var \\<Lambda> ((full_ext_env n_s w)\\<lparr>global_state := gs\\<rparr>) k = lookup_var \\<Lambda> (n_s\\<lparr>global_state := gs\\<rparr>) k\"\n    apply (rule lookup_only_local_global)\n     apply simp\n    apply simp\n    done\n  show \"(\\<exists>v. lookup_var \\<Lambda> ((full_ext_env n_s w)\\<lparr>global_state := old_global_state (full_ext_env n_s w)\\<rparr>) k = Some v \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>)\"\n    apply (rule exI[where ?x=v])\n    apply (rule conjI)\n     apply (simp only: Aux1)\n     apply (simp add: Aux2 del: full_ext_env.simps)\n     apply (rule Lookup)\n    apply (rule Typ)\n    done\nqed\n\ntext \\<open>Type progress theorem\\<close>\n\ntheorem progress:\n  assumes\n          Closed_\\<Omega>:\"list_all closed \\<Omega>\" and\n          \"\\<forall> k \\<tau>'. ((fst \\<Delta>) k = Some \\<tau>') \\<longrightarrow> wf_ty (length \\<Omega>) \\<tau>'\" and\n          \"\\<forall> i \\<tau>'. ((snd \\<Delta>) i = Some \\<tau>') \\<longrightarrow> wf_ty (length \\<Omega>) \\<tau>'\" and\n          \"\\<forall> k \\<tau>'. ((fst \\<Delta>) k = Some \\<tau>') \\<longrightarrow> (\\<exists>v. (lookup_var \\<Lambda> n_s k = Some v) \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>')\"\n          \"\\<forall> k \\<tau>'. ((fst \\<Delta>) k = Some \\<tau>') \\<longrightarrow> (\\<exists>v. (lookup_var \\<Lambda> (n_s\\<lparr>global_state := old_global_state n_s\\<rparr>) k = Some v) \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>')\" and\n          \"\\<forall> i \\<tau>'. ((snd \\<Delta>) i = Some \\<tau>') \\<longrightarrow> (\\<exists>v. binder_state n_s i = Some v \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>')\" and          \n          Wf_\\<Gamma>:\"fun_interp_wf A F \\<Gamma>\" and\n          Wf_F:\"list_all (wf_fdecl \\<circ> snd) F\"\n  shows \"F, \\<Delta> \\<turnstile> e : \\<tau> \\<Longrightarrow> wf_expr (length \\<Omega>) e \\<Longrightarrow>  \\<exists>v. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,n_s\\<rangle> \\<Down> v\" and\n        \"F, \\<Delta> \\<turnstile> es [:] ts \\<Longrightarrow> list_all (wf_expr (length \\<Omega>)) es \\<Longrightarrow>  \\<exists>vs. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>es,n_s\\<rangle> [\\<Down>] vs\"\n  using assms\nproof (induction arbitrary: n_s \\<Lambda> \\<Omega> and n_s \\<Lambda> \\<Omega> rule: typing_typing_list.inducts)\ncase (TypVar \\<Delta> x ty)\n  show ?case \n    apply (rule exI[where ?x=\"the (lookup_var \\<Lambda> n_s x)\"])\n    using TypVar(2) \n    by (metis RedVar TypVar.hyps TypVar.prems(5) option.distinct(1) option.exhaust_sel)\nnext\ncase (TypBVar \\<Delta> x ty)\n  show ?case \n    apply (rule exI[where ?x=\"the (binder_state n_s x)\"])\n    using TypBVar(2)\n    by (metis RedBVar TypBVar.hyps TypBVar.prems(7) option.distinct(1) option.exhaust_sel)\nnext\n  case (TypPrim l prim_ty \\<Delta>)\n  then show ?case by (auto intro: RedLit)\nnext\n  case (TypUnOp \\<Delta> e arg_ty uop ret_ty)\n  have \"\\<exists>a. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,n_s\\<rangle> \\<Down> a\" \n     apply (rule TypUnOp.IH) using TypUnOp.prems by auto\n  from this obtain v' where RedE:\"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,n_s\\<rangle> \\<Down> v'\" by auto\n  hence \"type_of_val A v' = TPrim arg_ty\"         \n    using TypUnOp preservation(1)[OF \\<open>list_all closed \\<Omega>\\<close> TypUnOp.prems(5) TypUnOp.prems(6) TypUnOp.prems(7) Wf_\\<Gamma> Wf_F]\n    by fastforce\n  thus ?case using \\<open>unop_type uop arg_ty = Some ret_ty\\<close> unop_progress RedE RedUnOp\n    by (metis (full_types))\nnext\n  case (TypBinOpMono bop targs ret_ty \\<Delta> e1 left_ty e2 right_ty)\n  have \"\\<exists>a. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1,n_s\\<rangle> \\<Down> a\" \n    apply (rule TypBinOpMono.IH) using TypBinOpMono.prems by auto\n  moreover have \"\\<exists>a. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2,n_s\\<rangle> \\<Down> a\"\n    apply (rule TypBinOpMono.IH) using TypBinOpMono.prems by auto\n  ultimately  obtain v1 v2 where RedLeft:\"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1,n_s\\<rangle> \\<Down> v1\" and  RedRight:\"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2,n_s\\<rangle> \\<Down> v2\"\n    by auto\n  moreover from RedLeft have \"type_of_val A v1 = TPrim left_ty\"\n    using TypBinOpMono.IH TypBinOpMono.prems preservation(1)[OF \\<open>list_all closed \\<Omega>\\<close> TypBinOpMono.prems(5) TypBinOpMono.prems(6) TypBinOpMono.prems(7) Wf_\\<Gamma> Wf_F]\n    by fastforce\n  moreover from RedRight have \"type_of_val A v2 = TPrim right_ty\"\n    using TypBinOpMono.IH TypBinOpMono.prems preservation(1)[OF \\<open>list_all closed \\<Omega>\\<close> TypBinOpMono.prems(5) TypBinOpMono.prems(6) TypBinOpMono.prems(7) Wf_\\<Gamma> Wf_F]\n    by fastforce\n  ultimately show ?case using \\<open>binop_type bop = Some (targs, ret_ty)\\<close> \\<open>(left_ty, right_ty) \\<in> targs\\<close> binop_progress RedBinOp\n    by metis\nnext\n  case (TypBinopPoly bop \\<Delta> e1 ty1 e2 ty2 ty_inst)\n  have \"\\<exists>a. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1,n_s\\<rangle> \\<Down> a\" \n    apply (rule TypBinopPoly.IH) using TypBinopPoly.prems by auto\n  moreover have \"\\<exists>a. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2,n_s\\<rangle> \\<Down> a\"\n    apply (rule TypBinopPoly.IH) using TypBinopPoly.prems by auto\n  ultimately  obtain v1 v2 where RedLeft:\"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1,n_s\\<rangle> \\<Down> v1\" and  RedRight:\"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2,n_s\\<rangle> \\<Down> v2\"\n    by auto\n  show ?case\n    apply (cases bop; rule exI; rule RedBinOp[OF RedLeft RedRight])\n    using \\<open>binop_poly_type bop\\<close> by auto\nnext\n  case (TypFunExp f n_ty_params args_ty ret_ty ty_params args \\<Delta>)\n  have \"\\<exists>vargs. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>args, n_s\\<rangle> [\\<Down>] vargs\" \n    apply (rule TypFunExp.IH)\n    using TypFunExp.prems by auto\n  from this obtain vargs where\n     RedArgs:\"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>args, n_s\\<rangle> [\\<Down>] vargs\" by fastforce\n  have Wf_args_ty:\"list_all (wf_ty n_ty_params) args_ty\" using Wf_F \\<open>map_of F f = Some (n_ty_params, args_ty, ret_ty)\\<close>\n    by (meson map_of_list_all wf_fdecl.simps)   \n  have InstMSubst:\"(map (instantiate \\<Omega>) (map (msubstT_opt ty_params) args_ty)) = map (instantiate (map (instantiate \\<Omega>) ty_params)) args_ty\"\n    using Wf_args_ty \\<open>length ty_params = n_ty_params\\<close>\n    apply simp\n    apply rule\n    apply (rule instantiate_msubst_opt)\n    by (simp add: list.pred_set)\n  from \\<open>map_of F f = Some (n_ty_params, args_ty, ret_ty)\\<close> Wf_\\<Gamma> obtain fi where\n       Mem: \"\\<Gamma> f = Some fi\" and\n       FunSingleWf:\"fun_interp_single_wf A (n_ty_params, args_ty, ret_ty) fi\"\n    using fun_interp_wf_def by blast \n  from RedArgs have \n    \"map (type_of_val A) vargs = map (instantiate \\<Omega>) (map (msubstT_opt ty_params) args_ty)\"\n    using preservation(2)[OF \\<open>list_all closed \\<Omega>\\<close> TypFunExp.prems(5) TypFunExp.prems(6) TypFunExp.prems(7) Wf_\\<Gamma> Wf_F] TypFunExp.prems TypFunExp.IH\n    by auto    \n  hence \"map (type_of_val A) vargs = map (instantiate (map (instantiate \\<Omega>) ty_params)) args_ty\"     \n    by (simp only: InstMSubst)\n  moreover from \\<open>length args = length args_ty\\<close> and RedArgs have \"length vargs = length args_ty\"\n    using red_exprs_length by fastforce\n  moreover have \"list_all closed (map (instantiate \\<Omega>) ty_params)\"\n    using TypFunExp.prems(1) \\<open>list_all closed \\<Omega>\\<close> closed_instantiate wf_ty.simps(3) by fastforce\n  ultimately have \"\\<exists>v. fi (map (instantiate \\<Omega>) ty_params) vargs = Some v\" using FunSingleWf \\<open>length ty_params = n_ty_params\\<close>\n    fun_interp_single_wf.simps length_map by blast\n  with RedArgs show ?case by (metis Mem RedFunOp)\nnext\n  case (TypCondExp \\<Delta> cond thn ty els)\n  hence RedCond: \"\\<exists>v. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>cond,n_s\\<rangle> \\<Down> v\" and\n        RedThn: \"\\<exists>v. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>thn,n_s\\<rangle> \\<Down> v\" and\n        RedElse: \"\\<exists>v. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>els,n_s\\<rangle> \\<Down> v\"        \n    by auto\n\n  moreover from RedCond obtain b where\n       \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>cond,n_s\\<rangle> \\<Down> BoolV b\"\n    using preservation(1)[OF \\<open>list_all closed \\<Omega>\\<close> TypCondExp.prems(5) TypCondExp.prems(6) TypCondExp.prems(7) \n                             Wf_\\<Gamma> Wf_F \\<open>F,\\<Delta> \\<turnstile> cond : TPrim TBool\\<close>]\n          \\<open>wf_expr _ _\\<close>\n    by (metis instantiate.simps(2) type_of_val_bool_elim wf_expr.simps(7))\n\n  ultimately show ?case\n    by (metis (full_types) RedCondExpFalse RedCondExpTrue)\nnext\n  case (TypOld \\<Delta> e ty)\n  have \"\\<exists>a. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,n_s\\<lparr>global_state := old_global_state n_s\\<rparr>\\<rangle> \\<Down> a\"\n    apply (rule TypOld.IH)\n    using TypOld.prems by auto\n  thus ?case\n    by (auto intro: RedOld)\nnext\n  case (TypForall \\<Delta> ty e)\n  have lookup_ext_1: \"\\<And>ns w. (old_global_state (full_ext_env ns w)) = old_global_state ns\"\n    by simp\n  thm TypForall.IH(2)\n  let ?ns'f = \"\\<lambda>w. full_ext_env n_s w\"\n\n  have lookup_aux:\"\\<And> b x. lookup_var \\<Lambda> (n_s\\<lparr> binder_state := b \\<rparr>) x  = lookup_var \\<Lambda> n_s x\"  by (simp only: lookup_var_binder_upd)    \n\n  have AuxOld:\"\\<And>w. \\<forall>k \\<tau>'. fst (fst \\<Delta>, ext_env (snd \\<Delta>) ty) k = Some \\<tau>' \\<longrightarrow>\n           (\\<exists>v. lookup_var \\<Lambda> ((full_ext_env n_s w)\\<lparr>global_state := old_global_state (full_ext_env n_s w)\\<rparr>) k = Some v \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>')\"\n    apply (rule helper_lemma_old_state)\n    using TypForall.prems(6) apply simp\n    done\n  have RedBody:\"\\<And>w. type_of_val A w = instantiate \\<Omega> ty \\<Longrightarrow> \\<exists>v'. A, \\<Lambda>, \\<Gamma>, \\<Omega> \\<turnstile> \\<langle>e, ?ns'f w\\<rangle> \\<Down> v'\" \n    apply (rule TypForall.IH(2)[OF _ _ _ _ _ AuxOld])\n    using TypForall.prems lookup_aux by auto\n\n\n  have EnvCorres:\"\\<And>w. type_of_val A w = instantiate \\<Omega> ty \\<Longrightarrow> \\<forall>k \\<tau>'. (snd (fst \\<Delta>, ext_env (snd \\<Delta>) ty)) k = Some \\<tau>' \\<longrightarrow> \n                (\\<exists>v. binder_state (full_ext_env n_s w) k = Some v \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>')\"\n    using TypForall.prems(7)\n    by simp\n  have RedBodyTy:\"\\<And>w v'. type_of_val A w = instantiate \\<Omega> ty \\<Longrightarrow> A, \\<Lambda>, \\<Gamma>, \\<Omega> \\<turnstile> \\<langle>e, full_ext_env n_s w\\<rangle> \\<Down> v' \\<Longrightarrow>\n        type_of_val A v' = TPrim TBool\"\n    using preservation(1)[OF \\<open>list_all closed \\<Omega>\\<close> _ AuxOld EnvCorres Wf_\\<Gamma> Wf_F _ _ ]\n          TypForall.IH(1) TypForall.prems \n    by (metis fst_conv instantiate.simps(2) lookup_full_ext_env_same wf_expr.simps(9))\n  show ?case\n  proof (cases \"\\<forall> w. type_of_val A w = instantiate \\<Omega> ty \\<longrightarrow> A, \\<Lambda>, \\<Gamma>, \\<Omega> \\<turnstile> \\<langle>e, full_ext_env n_s w\\<rangle> \\<Down> LitV (LBool True)\")\n    case True\n    show ?thesis\n      using RedForAllTrue True by blast   \n  next\n    case False\n    from this obtain w where\n       \"type_of_val A w = instantiate \\<Omega> ty\" and \"\\<not> (A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env n_s w\\<rangle> \\<Down> LitV (LBool True))\"\n      by auto\n    moreover from this RedBody RedBodyTy obtain w' where \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env n_s w\\<rangle> \\<Down> w'\"\n      and \"type_of_val A w' = TPrim (TBool)\"\n    by fastforce\n    ultimately show ?thesis\n      by (metis (full_types) RedForAllFalse type_of_val_bool_elim) \n  qed\nnext\n  case (TypExists \\<Delta> ty e)\n  (*  proof is almost identical to TypForall, TODO: re-use proof *)\n  have lookup_aux:\"\\<And> b x. lookup_var \\<Lambda> (n_s\\<lparr> binder_state := b \\<rparr>) x  = lookup_var \\<Lambda> n_s x\"  by (simp only: lookup_var_binder_upd)\n    have AuxOld:\"\\<And>w. \\<forall>k \\<tau>'. fst (fst \\<Delta>, ext_env (snd \\<Delta>) ty) k = Some \\<tau>' \\<longrightarrow>\n           (\\<exists>v. lookup_var \\<Lambda> ((full_ext_env n_s w)\\<lparr>global_state := old_global_state (full_ext_env n_s w)\\<rparr>) k = Some v \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>')\"\n    apply (rule helper_lemma_old_state)\n    using TypExists.prems(6) apply simp\n    done\n  have RedBody:\"\\<And>w. type_of_val A w = instantiate \\<Omega> ty \\<Longrightarrow> \\<exists>v'. A, \\<Lambda>, \\<Gamma>, \\<Omega> \\<turnstile> \\<langle>e, full_ext_env n_s w\\<rangle> \\<Down> v'\" \n    apply (rule TypExists.IH(2)[OF _ _ _ _ _ AuxOld])\n    using TypExists.prems lookup_aux by auto\n  have EnvCorres:\"\\<And>w. type_of_val A w = instantiate \\<Omega> ty \\<Longrightarrow> \\<forall>k \\<tau>'. (snd (fst \\<Delta>, ext_env (snd \\<Delta>) ty)) k = Some \\<tau>' \\<longrightarrow> \n                (\\<exists>v. binder_state (full_ext_env n_s w) k = Some v \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>')\"\n    using TypExists.prems(7)\n    by simp\n  have RedBodyTy:\"\\<And>w v'. type_of_val A w = instantiate \\<Omega> ty \\<Longrightarrow> A, \\<Lambda>, \\<Gamma>, \\<Omega> \\<turnstile> \\<langle>e, full_ext_env n_s w\\<rangle> \\<Down> v' \\<Longrightarrow>\n        type_of_val A v' = TPrim TBool\"\n    using preservation(1)[OF \\<open>list_all closed \\<Omega>\\<close> _ AuxOld EnvCorres Wf_\\<Gamma> Wf_F]\n          TypExists.IH(1) TypExists.prems     \n    by (metis fst_conv instantiate.simps(2) lookup_full_ext_env_same wf_expr.simps(10))\n  show ?case\n  proof (cases \"\\<forall> w. type_of_val A w = instantiate \\<Omega> ty \\<longrightarrow> A, \\<Lambda>, \\<Gamma>, \\<Omega> \\<turnstile> \\<langle>e, full_ext_env n_s w\\<rangle> \\<Down> LitV (LBool False)\")\n    case True\n    show ?thesis\n      using RedExistsFalse True by blast   \n  next\n    case False\n    from this obtain w where\n       \"type_of_val A w = instantiate \\<Omega> ty\" and \"\\<not> (A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env n_s w\\<rangle> \\<Down> LitV (LBool False))\"\n      by auto\n    moreover from this RedBody RedBodyTy obtain w' where \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env n_s w\\<rangle> \\<Down> w'\"\n      and \"type_of_val A w' = TPrim (TBool)\"\n    by fastforce\n    ultimately show ?thesis\n      by (metis (full_types) RedExistsTrue type_of_val_bool_elim) \n  qed\nnext\n  case (TypForallT \\<Delta> e)\n  have RedBody:\"\\<And>t. closed t \\<Longrightarrow> (\\<exists>v. A,\\<Lambda>,\\<Gamma>,t#\\<Omega> \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> v)\"    \n    apply (rule TypForallT.IH)\n    using TypForallT.prems apply simp_all\n    using instantiate_shift_wf apply fastforce\n    using instantiate_shift_wf apply fastforce\n    using instantiate_shift apply auto\n    done\n\n  have Closed\\<Omega>Ext: \"\\<And>t. closed t \\<Longrightarrow> list_all closed (t#\\<Omega>)\"\n    using \\<open>list_all closed \\<Omega>\\<close> by simp\n\n  have RedBodyTy:\"\\<And>t v. closed t \\<Longrightarrow> A,\\<Lambda>,\\<Gamma>, t#\\<Omega> \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> v \\<Longrightarrow> type_of_val A v = instantiate (t#\\<Omega>) (TPrim TBool)\"\n    apply (rule preservation(1)[where ?\\<Delta>=\"(shift_env 1 0 (fst \\<Delta>), shift_env 1 0 (snd \\<Delta>))\" and ?n_s=\"n_s\"])\n          apply (simp add: \\<open>list_all closed \\<Omega>\\<close>)\n    using TypForallT.prems instantiate_shift\n          apply fastforce\n    using TypForallT.prems instantiate_shift\n          apply fastforce\n    using TypForallT.prems instantiate_shift\n         apply fastforce\n        apply (rule Wf_\\<Gamma>)\n        apply (rule Wf_F)\n      apply (rule TypForallT.IH(1))\n    using TypForallT.prems apply simp_all\n   done\n  show ?case \n  proof (cases \"\\<forall>t. closed t \\<longrightarrow> A,\\<Lambda>,\\<Gamma>,t#\\<Omega> \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> LitV (LBool True)\")\n    case True\n    show ?thesis\n      using RedForallT_True True by blast\n  next\n    case False\n    from this obtain t where \"closed t\" and \"\\<not>(A,\\<Lambda>,\\<Gamma>,t#\\<Omega> \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> LitV (LBool True))\" by auto\n    moreover from this RedBody RedBodyTy obtain w' where \"A,\\<Lambda>,\\<Gamma>,(t#\\<Omega>) \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> w'\"\n      and \"type_of_val A w' = TPrim (TBool)\" by fastforce\n    ultimately show ?thesis\n      by (metis (full_types) RedForallT_False type_of_val_bool_elim)\n  qed\nnext\n  case (TypExistsT \\<Delta> e)\n  (* proof is almost identical to TypForallT, TODO: re-use proof *)\n\n  have RedBody:\"\\<And>t. closed t \\<Longrightarrow> (\\<exists>v. A,\\<Lambda>,\\<Gamma>,t#\\<Omega> \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> v)\"    \n    apply (rule TypExistsT.IH)\n    using TypExistsT.prems\n    apply simp_all\n    using instantiate_shift_wf apply fastforce\n    using instantiate_shift_wf apply fastforce\n    using instantiate_shift by auto\n\n  have Closed\\<Omega>Ext: \"\\<And>t. closed t \\<Longrightarrow> list_all closed (t#\\<Omega>)\"\n    using \\<open>list_all closed \\<Omega>\\<close> by simp\n\n  have RedBodyTy:\"\\<And>t v. closed t \\<Longrightarrow> A,\\<Lambda>,\\<Gamma>,t#\\<Omega> \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> v \\<Longrightarrow> type_of_val A v = instantiate (t#\\<Omega>) (TPrim TBool)\"\n    apply (rule preservation(1)[where ?\\<Delta>=\"(shift_env 1 0 (fst \\<Delta>), shift_env 1 0 (snd \\<Delta>))\" and ?n_s=\"n_s\"])\n          apply (simp add: \\<open>list_all closed \\<Omega>\\<close>)\n    using TypExistsT.prems instantiate_shift\n          apply fastforce\n    using TypExistsT.prems instantiate_shift\n          apply fastforce\n    using TypExistsT.prems instantiate_shift\n         apply fastforce\n        apply (rule Wf_\\<Gamma>)\n        apply (rule Wf_F)\n      apply (rule TypExistsT.IH(1))\n    using TypExistsT.prems apply simp_all\n    done\n  show ?case\n  proof (cases \"\\<forall>t. closed t \\<longrightarrow> A,\\<Lambda>,\\<Gamma>,t#\\<Omega> \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> LitV (LBool False)\")\n    case True\n    show ?thesis\n      using RedExistsT_False True by blast\n  next\n    case False\n    from this obtain t where \"closed t\" and \"\\<not>(A,\\<Lambda>,\\<Gamma>,t#\\<Omega> \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> LitV (LBool False))\" by auto\n    moreover from this RedBody RedBodyTy obtain w' where \"A,\\<Lambda>,\\<Gamma>,(t#\\<Omega>) \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> w'\"\n      and \"type_of_val A w' = TPrim TBool\" by fastforce\n    ultimately show ?thesis\n     by (metis (full_types) RedExistsT_True type_of_val_bool_elim)\n  qed\nnext\n  case (TypListNil \\<Delta>)\n  show ?case \n    by (auto intro: RedExpListNil)\nnext\n  case (TypListCons \\<Delta> e ty es tys)\n  hence \"\\<exists>v. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,n_s\\<rangle> \\<Down> v\" and \"\\<exists>vs. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>es,n_s\\<rangle> [\\<Down>] vs\"\n    by auto\n  from this obtain v vargs where \n      \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, n_s\\<rangle> \\<Down> v\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>es, n_s\\<rangle> [\\<Down>] vargs\" by auto\n  thus ?case by (auto intro: RedExpListCons)\nqed\n\ntext \\<open>We combine type preservation and type progress to get a top-level type safety theorem\\<close>\n\ncorollary type_safety_top_level:\n  assumes \"F, (lookup_var_ty \\<Lambda>, Map.empty) \\<turnstile> e : \\<tau>\" and\n          ClosedEnv:\"list_all closed \\<Omega>\" and\n          Wf_\\<Gamma>:\"fun_interp_wf A F \\<Gamma>\" and\n          Wf_\\<Lambda>: \"\\<forall>x \\<tau>. lookup_var_ty \\<Lambda> x = Some \\<tau> \\<longrightarrow> wf_ty (length \\<Omega>) \\<tau>\" and\n          Wf_F:\"list_all (wf_fdecl \\<circ> snd) F\" and\n          State_wt:\"state_well_typed A \\<Lambda> \\<Omega> n_s\" and\n          \"wf_expr (length \\<Omega>) e\"\n        shows \"\\<exists>v. (A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,n_s\\<rangle> \\<Down> v) \\<and> type_of_val A v = instantiate \\<Omega> \\<tau>\"\nproof -\n  let ?\\<Delta> = \"(lookup_var_ty \\<Lambda>, Map.empty)\"\n  have \"\\<exists>v. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,n_s\\<rangle> \\<Down> v\"    \n    apply (rule progress[where ?\\<Delta>=\"(lookup_var_ty \\<Lambda>, Map.empty)\"])\n             apply (rule ClosedEnv)\n    using Wf_\\<Lambda> apply simp\n           apply simp\n    using state_well_typed_lookup[OF State_wt]\n          apply simp\n    using state_well_typed_lookup_old[OF State_wt]\n         apply simp\n        apply simp\n    using assms\n    by auto\n  from this obtain v where RedE:\"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,n_s\\<rangle> \\<Down> v\"\n    by auto\n  moreover have \"type_of_val A v = instantiate \\<Omega> \\<tau>\"\n    apply (rule preservation[where ?\\<Delta>=\"(lookup_var_ty \\<Lambda>, Map.empty)\"])\n    apply (rule ClosedEnv)\n    using state_well_typed_lookup[OF State_wt]\n    apply fastforce\n    using state_well_typed_lookup_old[OF State_wt]\n    apply fastforce\n    using assms RedE by auto\n  ultimately show ?thesis\n    by auto\nqed\n \n\nend", "meta": {"author": "gauravpartha", "repo": "foundational_boogie", "sha": "4667c538759128ad88588ff2c1ae821d7a78b16b", "save_path": "github-repos/isabelle/gauravpartha-foundational_boogie", "path": "github-repos/isabelle/gauravpartha-foundational_boogie/foundational_boogie-4667c538759128ad88588ff2c1ae821d7a78b16b/BoogieLang/TypeSafety.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.33549513507827744}}
{"text": "section \\<open>Two approaches that failed \\label{sec:two-approaches-that}\\<close>\n\n(*<*) theory Failure imports RealRandVar begin (*>*)\n\ntext\\<open>\nDefining Lebesgue integration can be quite involved, judging by the\nprocess in \\ref{sec:stepwise-approach} that imitates Bauer's way\n\\<^cite>\\<open>\"Bauer\"\\<close>.  So it is quite tempting to try cutting a corner. The\nfollowing two alternative approaches back up my experience that this\nalmost never pays in formalization. The theory that seems most complex\nat first sight is often the one that is closest to formal reasoning\nand deliberately avoids ``hand-waving''.\n\\<close>\n\nsubsection \\<open>A closed expression \\label{sec:closed-expression}\\<close>\n\ntext \\<open>\n  In contrast, Billingsley's definition \\<^cite>\\<open>\\<open>p.~172\\<close> in \"Billingsley86\"\\<close> is\n  strikingly short. For nonnegative measurable functions $f$:\n\n  \\begin{quote}\n  \n  $\\int f d\\mu = \\mathit{sup} \\sum_i \\big[ \\mathit{inf}_{\\omega \\in A_i} f(w) \\big] \\mu(A_i).$\n  \n  The supremum here extends over all finite decompositions $\\{A_i\\}$ of\n  $\\Omega$ into $\\mathcal{F}$-sets.\\footnote{The $\\mathcal{F}$-sets are just the measurable sets of a measure\n  space.}\n\n  \\end{quote}\n  \n  Like the definition, the proofs of the essential properties are also\n  rather\n  short, about three pages in the textbook for almost all the theorems\n  in \\ref{sec:stepwise-approach}; and a proof of uniqueness is obsolete\n  for a closed expression like this. Therefore, I found this approach\n  quite tempting. It turns out, however, that it is unfortunately not\n  well suited for formalization, at least with the background we use.\n  \n  A complication shared by all possible styles of definition is the lack\n  of infinite values in our theory, combined with the lack of partial\n  functions in HOL. Like the sum operator in\n  \\ref{sec:measure-spaces}, the integral has to be defined\n  indirectly. The classical way to do this employs predicates, invoking \\<open>\\<epsilon>\\<close>\n  to choose the value that satisfies the condition:\n\n  \\<open>\\<integral> f dM \\<equiv> (\\<epsilon> i. is_integral M f i)\\<close>\n\n  To sensibly apply this principle, the predicate has to be \\<open>\\<epsilon>\\<close>-free to supply the information if the integral is\n  defined or not. Now the above definition contains up to three additional\n  \\<open>\\<epsilon>\\<close> when formalized naively in HOL, namely in the supremum,\n  infimum and sum operators. The sum is over a finite set, so it can\n  be replaced by a total function. For nonnegative functions, the\n  infimum can also be shown to exist everywhere, but, like the\n  supremum,  must\n  itself be replaced by a predicate. \n\n  Also note that predicates require a proof of uniqueness, thus losing\n  the prime advantage of a closed formula anyway. In this case,\n  uniqueness can be reduced to uniqueness of the supremum/infimum. The\n  problem is that neither suprema nor infima come predefined in\n  Isabelle/Isar as of yet. It is an easy task to make up for this ---\n  and I did --- but a much harder one to establish all the properties\n  needed for reasoning with the defined entities.\n\n  A lot of such reasoning is necessary to deduce from the above definition\n  (or a formal version of it, as just outlined) the basic behavior of\n  integration, which includes additivity, monotonicity and especially the\n  integral of simple functions. It turns out that the brevity of the\n  proofs in the textbook stems from a severely informal style that\n  assumes ample background knowledge. Formalizing all this knowledge\n  started to become overwhelming when the idea of a contrarian approach\n  emerged.\n\\<close>\n\nsubsection \\<open>A one-step inductive definition \\label{sec:one-step}\\<close>\n\ntext \\<open>\n  This idea was sparked by the following note: ``(\\ldots) the integral\n  is uniquely determined by certain simple properties it is natural to\n  require of it'' \\<^cite>\\<open>\\<open>p.~175\\<close> in \"Billingsley86\"\\<close>. Billingsley goes on\n  discussing exactly those properties that are so hard to derive\n  from his definition. So why not simply define integration using\n  these properties? That is the gist of an inductive set definition, like\n  the one we have seen in \\ref{sec:sigma}. This time a functional operator is\n  to be defined, but it can be represented as a set of pairs, where\n  the first component is the function and the second its integral.\n  To cut a long story short, here is the definition.\\<close>\n\ninductive_set\n  integral_set:: \"('a set set * ('a set \\<Rightarrow> real)) \\<Rightarrow> (('a \\<Rightarrow> real) * real) set\"\n  for M :: \"'a set set * ('a set \\<Rightarrow> real)\"\n  where\n    char: \"\\<lbrakk>f = \\<chi> A; A \\<in> measurable_sets M\\<rbrakk> \\<Longrightarrow> (f,measure M A) \\<in> integral_set M\"\n  | add: \"\\<lbrakk>f = (\\<lambda>w. g w + h w); (g,x) \\<in> integral_set M; (h,y) \\<in> integral_set M\\<rbrakk> \n    \\<Longrightarrow> (f,(x + y)) \\<in> integral_set M\"\n  | times: \"\\<lbrakk>f = (\\<lambda>w. a*g w); (g,x) \\<in> integral_set M\\<rbrakk> \\<Longrightarrow> (f,a*x) \\<in> integral_set M\"\n  | mon_conv: \"\\<lbrakk>u\\<up>f; \\<And>n. (u n, x n) \\<in> integral_set M; x\\<up>y\\<rbrakk> \n    \\<Longrightarrow> (f,y) \\<in> integral_set M\"\n\n  text \\<open>The technique is also encountered in the \\<open>Finite_Set\\<close> theory from the Isabelle library. It is used there\n    to define the \\<open>sum\\<close> function, which calculates a sum\n    indexed over a finite set and is employed in\n    \\ref{sec:stepwise-approach}. The definition here is much more\n    intricate though. \n\n    An obvious advantage of this approach is that almost all\n    important properties are gained without effort. The\n    introduction rule \\<open>mon_conv\\<close> corresponds to what is known as\n    the Monotone Convergence Theorem in scientific literature; negative functions are also provided for via\n    the \\<open>times\\<close> rule. \n    To be precise,\n    there is exactly one important theorem missing ---\n    uniqueness. That is, every function appears in at most one pair. \n    \n    From uniqueness together with the introduction rules, all the\n    other statements about integration, monotonicity for example,\n    could be derived. On the other hand, monotonicity implies\n    uniqueness. Much to my regret, none of these two could be proven.\n    The proof would basically amount to a double induction to show\n    that an integral gained via one rule is the same when derived by\n    another. A lot of effort was spent trying to strengthen the\n    induction hypothesis or reduce the goal to a simpler case. All of\n    this was in vain though, and it seems that the hypothesis would\n    have to be strengthened as far as to include the concept of\n    integration in the first place, which in a way defeats the\n    advantages of the approach.\\<close>\n    \n\n  (*<*)end  (*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Integration/Failure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.6224593312018546, "lm_q1q2_score": 0.33549513507827744}}
{"text": "(* @SUITE modules *)\n\ntheory \"moduletype\"\nimports \"../Modules\"\nbegin\n\ndeclare[[show_types,show_sorts]]\nmoduletype MT1 where\n  f1 :: \"(int*unit,string) procedure\"\nand f2 :: \"(bool*unit,real) procedure\"\n\nprint_theorems\n\n\n(* Checking constants *)\nterm \"MT1::module_type\"\nterm \"MT1.f1 :: module \\<Rightarrow> (int*unit,string) procedure\"\nterm \"MT1.f2 :: module \\<Rightarrow> (bool*unit,real) procedure\"\n\n(* Checking lemmas *)\nlemma \"has_module_type (M\\<Colon>module) MT1 \\<Longrightarrow>\n    get_proc_in_module M [''f1''] =\n    Some (mk_procedure_untyped (MT1.f1 M))\"\n    by (rule MT1.f1)\n\nlemma \"has_module_type (M\\<Colon>module) MT1 \\<Longrightarrow>\n    get_proc_in_module M [''f2''] =\n    Some (mk_procedure_untyped (MT1.f2 M))\"\n    by (rule MT1.f2)\n\n\n\nmoduletype MT2(M1:MT1) where\n  g1 :: \"(int*unit,string) procedure\"\nand g2 :: \"(bool*unit,real) procedure\"\n\nprint_theorems\n\nterm \"MT2::module_type\"\n(* TODO: getters *)\n\n(* TODO: check getter lemmas *)\n\nend\n", "meta": {"author": "dominique-unruh", "repo": "IsaCrypt", "sha": "1abc2041871af7b758adcc914b83f0d9135ec129", "save_path": "github-repos/isabelle/dominique-unruh-IsaCrypt", "path": "github-repos/isabelle/dominique-unruh-IsaCrypt/IsaCrypt-1abc2041871af7b758adcc914b83f0d9135ec129/old/moduletype.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6224593312018545, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3354951350782774}}
{"text": "(* \n   Title: Psi-calculi   \n   Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Bisim_Pres\n  imports Weak_Bisimulation Weak_Sim_Pres Weak_Stat_Imp_Pres\nbegin\n\ncontext env begin\n\nlemma weakBisimInputPres:\n  fixes \\<Psi>    :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n\n  assumes \"\\<And>Tvec. length xvec = length Tvec \\<Longrightarrow> \\<Psi> \\<rhd> P[xvec::=Tvec] \\<approx> Q[xvec::=Tvec]\"\n\n  shows \"\\<Psi> \\<rhd> M\\<lparr>\\<lambda>*xvec N\\<rparr>.P \\<approx> M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q\"\nproof -\n  let ?X = \"{(\\<Psi>, M\\<lparr>\\<lambda>*xvec N\\<rparr>.P, M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q) | \\<Psi> M xvec N P Q. \\<forall>Tvec. length xvec = length Tvec \\<longrightarrow> \\<Psi> \\<rhd> P[xvec::=Tvec] \\<approx> Q[xvec::=Tvec]}\"\n\n  from assms have \"(\\<Psi>, M\\<lparr>\\<lambda>*xvec N\\<rparr>.P, M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cStatImp \\<Psi> P Q)\n    thus ?case by(fastforce intro: weak_stat_impInputPres dest: weakBisimE(3))\n  next\n    case(cSim \\<Psi> P Q)\n    thus ?case\n      by auto (blast intro: weak_inputPres dest: weakBisimE)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(blast dest: weakBisimE)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(blast dest: weakBisimE)\n  qed\nqed\n  \nlemma weakBisimOutputPres:\n  fixes \\<Psi>    :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n\n  assumes \"\\<Psi> \\<rhd> P \\<approx> Q\"\n\n  shows \"\\<Psi> \\<rhd> M\\<langle>N\\<rangle>.P \\<approx> M\\<langle>N\\<rangle>.Q\"\nproof -\n  let ?X = \"{(\\<Psi>, M\\<langle>N\\<rangle>.P, M\\<langle>N\\<rangle>.Q) | \\<Psi> M N P Q. \\<Psi> \\<rhd> P \\<approx> Q}\"\n\n  from assms have \"(\\<Psi>, M\\<langle>N\\<rangle>.P, M\\<langle>N\\<rangle>.Q) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cStatImp \\<Psi> P Q)\n    thus ?case by auto (blast intro: weak_stat_impOutputPres dest: weakBisimE(3))\n  next\n    case(cSim \\<Psi> P Q)\n    thus ?case\n      by(auto intro: weak_outputPres dest: weakBisimE)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(blast dest: weakBisimE)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(blast dest: weakBisimE)\n  qed\nqed\n\n\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>P \\<approx> \\<lparr>\\<nu>x\\<rparr>Q\"\nproof -\n  let ?X = \"{(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) | \\<Psi> x P Q. \\<Psi> \\<rhd> P \\<approx> Q \\<and> x \\<sharp> \\<Psi>}\"\n  \n  from assms have \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cStatImp \\<Psi> xP xQ)\n    {\n      fix \\<Psi> P Q x\n      assume \"\\<Psi> \\<rhd> P \\<approx> Q\"\n      hence \"\\<Psi> \\<rhd> P \\<lessapprox><weakBisim> Q\" by(rule weakBisimE)\n      moreover have \"eqvt weakBisim\" by auto\n      moreover assume \"(x::name) \\<sharp> \\<Psi>\"\n      moreover have \"\\<And>\\<Psi> P Q x. \\<lbrakk>(\\<Psi>, P, Q) \\<in> weakBisim; x \\<sharp> \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n        by auto\n      ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>P \\<lessapprox><(?X \\<union> weakBisim)> \\<lparr>\\<nu>x\\<rparr>Q\"\n        by(rule weak_stat_impResPres)\n    }\n    with `(\\<Psi>, xP, xQ) \\<in> ?X` show ?case by auto\n  next\n    case(cSim \\<Psi> xP xQ)\n    from `(\\<Psi>, xP, xQ) \\<in> ?X` obtain x P Q where \"\\<Psi> \\<rhd> P \\<approx> Q\" and \"x \\<sharp> \\<Psi>\" and \"xP = \\<lparr>\\<nu>x\\<rparr>P\" and \"xQ = \\<lparr>\\<nu>x\\<rparr>Q\"\n      by auto\n    from `\\<Psi> \\<rhd> P \\<approx> Q` have \"\\<Psi> \\<rhd> P \\<leadsto><weakBisim> Q\" by(rule weakBisimE)\n    moreover have \"eqvt ?X\"\n      by(force simp add: eqvt_def weakBisimClosed pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n    hence \"eqvt(?X \\<union> weakBisim)\" by auto\n    moreover note `x \\<sharp> \\<Psi>`\n    moreover have \"weakBisim \\<subseteq> ?X \\<union> weakBisim\" by auto\n    moreover have \"\\<And>\\<Psi> P Q x. \\<lbrakk>(\\<Psi>, P, Q) \\<in> weakBisim; x \\<sharp> \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n      by auto\n    ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>P \\<leadsto><(?X \\<union> weakBisim)> \\<lparr>\\<nu>x\\<rparr>Q\"\n      by(rule weakResPres)\n    with `xP = \\<lparr>\\<nu>x\\<rparr>P` `xQ = \\<lparr>\\<nu>x\\<rparr>Q` show ?case\n      by simp\n  next\n    case(cExt \\<Psi> xP xQ \\<Psi>')\n    from `(\\<Psi>, xP, xQ) \\<in> ?X` obtain x P Q where \"\\<Psi> \\<rhd> P \\<approx> Q\" and \"x \\<sharp> \\<Psi>\" and \"xP = \\<lparr>\\<nu>x\\<rparr>P\" and \"xQ = \\<lparr>\\<nu>x\\<rparr>Q\"\n      by auto\n    obtain y::name where \"y \\<sharp> P\" and \"y \\<sharp> Q\" and \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\"\n     by(generate_fresh \"name\", auto simp add: fresh_prod)\n   from `\\<Psi> \\<rhd> P \\<approx> Q` have \"\\<Psi> \\<otimes> ([(x, y)] \\<bullet> \\<Psi>') \\<rhd> P \\<approx> Q\"\n     by(rule weakBisimE)\n   hence \"([(x, y)] \\<bullet> (\\<Psi> \\<otimes> ([(x, y)] \\<bullet> \\<Psi>'))) \\<rhd> ([(x, y)] \\<bullet> P) \\<approx> ([(x, y)] \\<bullet> Q)\"\n     by(rule weakBisimClosed)\n   with `x \\<sharp> \\<Psi>` `y \\<sharp> \\<Psi>` have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> ([(x, y)] \\<bullet> P) \\<approx> ([(x, y)] \\<bullet> Q)\"\n     by(simp add: eqvts)\n   with `y \\<sharp> \\<Psi>` `y \\<sharp> \\<Psi>'` have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P), \\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> Q)) \\<in> ?X\"\n     by auto\n   moreover from `y \\<sharp> P` `y \\<sharp> Q` have \"\\<lparr>\\<nu>x\\<rparr>P = \\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)\" and \"\\<lparr>\\<nu>x\\<rparr>Q = \\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> Q)\"\n     by(simp add: alpha_res)+\n   ultimately show ?case using `xP = \\<lparr>\\<nu>x\\<rparr>P` `xQ = \\<lparr>\\<nu>x\\<rparr>Q` by simp\n next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(blast dest: weakBisimE)\n  qed\nqed\n\nlemma weakBisimResChainPres:\n  fixes \\<Psi>   :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   xvec :: \"name list\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<approx> Q\"\n  and     \"xvec \\<sharp>* \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>P \\<approx> \\<lparr>\\<nu>*xvec\\<rparr>Q\"\nusing assms\nby(induct xvec) (auto intro: weakBisimResPres)\n\nlemma weakBisimParPresAux:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>\\<^sub>R :: 'b\n  and   P  :: \"('a, 'b, 'c) psi\"\n  and   Q  :: \"('a, 'b, 'c) psi\"\n  and   R  :: \"('a, 'b, 'c) psi\"\n  and   A\\<^sub>R :: \"name list\"\n  \n  assumes \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n  and     FrR: \"extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\"\n  and     \"A\\<^sub>R \\<sharp>* \\<Psi>\"\n  and     \"A\\<^sub>R \\<sharp>* P\"\n  and     \"A\\<^sub>R \\<sharp>* Q\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> R \\<approx> Q \\<parallel> R\"\nproof -\n  let ?X = \"{(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)) | xvec \\<Psi> P Q R. xvec \\<sharp>* \\<Psi> \\<and> (\\<forall>A\\<^sub>R \\<Psi>\\<^sub>R. (extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle> \\<and> A\\<^sub>R \\<sharp>* \\<Psi> \\<and> A\\<^sub>R \\<sharp>* P \\<and> A\\<^sub>R \\<sharp>* Q) \\<longrightarrow>\n                                                                                          \\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q)}\"\n  {\n    fix xvec :: \"name list\"\n    and \\<Psi>    :: 'b \n    and P    :: \"('a, 'b, 'c) psi\"\n    and Q    :: \"('a, 'b, 'c) psi\"\n    and R    :: \"('a, 'b, 'c) psi\"\n\n    assume \"xvec \\<sharp>* \\<Psi>\"\n    and    \"\\<And>A\\<^sub>R \\<Psi>\\<^sub>R. \\<lbrakk>extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>; A\\<^sub>R \\<sharp>* \\<Psi>; A\\<^sub>R \\<sharp>* P; A\\<^sub>R \\<sharp>* Q\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n\n    hence \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)) \\<in> ?X\"\n      by blast\n  }\n  note XI = this\n\n  {\n    fix xvec :: \"name list\"\n    and \\<Psi>    :: 'b \n    and P    :: \"('a, 'b, 'c) psi\"\n    and Q    :: \"('a, 'b, 'c) psi\"\n    and R    :: \"('a, 'b, 'c) psi\"\n    and C    :: \"'d::fs_name\"\n\n    assume \"xvec \\<sharp>* \\<Psi>\"\n    and    A: \"\\<And>A\\<^sub>R \\<Psi>\\<^sub>R. \\<lbrakk>extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>; A\\<^sub>R \\<sharp>* \\<Psi>; A\\<^sub>R \\<sharp>* P; A\\<^sub>R \\<sharp>* Q; A\\<^sub>R \\<sharp>* C\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n\n    from `xvec \\<sharp>* \\<Psi>` have \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)) \\<in> ?X\"\n    proof(rule XI)\n      fix A\\<^sub>R \\<Psi>\\<^sub>R\n      assume FrR: \"extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\"\n      obtain p::\"name prm\" where \"(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\" and \"(p \\<bullet> A\\<^sub>R) \\<sharp>* P\" and \"(p \\<bullet> A\\<^sub>R) \\<sharp>* Q\" and \"(p \\<bullet> A\\<^sub>R) \\<sharp>* R\" and \"(p \\<bullet> A\\<^sub>R) \\<sharp>* C\"\n                             and \"(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\\<^sub>R\" and S: \"(set p) \\<subseteq> (set A\\<^sub>R) \\<times> (set(p \\<bullet> A\\<^sub>R))\" and \"distinct_perm p\"\n        by(rule_tac c=\"(\\<Psi>, P, Q, R, \\<Psi>\\<^sub>R, C)\" in name_list_avoiding) auto\n      from FrR `(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\\<^sub>R` S have \"extract_frame R = \\<langle>(p \\<bullet> A\\<^sub>R), p \\<bullet> \\<Psi>\\<^sub>R\\<rangle>\" by(simp add: frame_chain_alpha')\n\n      moreover assume \"A\\<^sub>R \\<sharp>* \\<Psi>\"\n      hence \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> \\<Psi>)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with `A\\<^sub>R \\<sharp>* \\<Psi>` `(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>` S have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\" by simp\n      moreover assume \"A\\<^sub>R \\<sharp>* P\"\n      hence \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> P)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with `A\\<^sub>R \\<sharp>* P` `(p \\<bullet> A\\<^sub>R) \\<sharp>* P` S have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* P\" by simp\n      moreover assume \"A\\<^sub>R \\<sharp>* Q\"\n      hence \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> Q)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with `A\\<^sub>R \\<sharp>* Q` `(p \\<bullet> A\\<^sub>R) \\<sharp>* Q` S have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* Q\" by simp\n      ultimately have \"\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R) \\<rhd> P \\<approx> Q\" using `(p \\<bullet> A\\<^sub>R) \\<sharp>* C` A by blast\n      hence \"(p \\<bullet> (\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R))) \\<rhd> (p \\<bullet> P) \\<approx> (p \\<bullet> Q)\" by(rule weakBisimClosed)\n      with `A\\<^sub>R \\<sharp>* \\<Psi>` `(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>` `A\\<^sub>R \\<sharp>* P` `(p \\<bullet> A\\<^sub>R) \\<sharp>* P` `A\\<^sub>R \\<sharp>* Q` `(p \\<bullet> A\\<^sub>R) \\<sharp>* Q` S `distinct_perm p`\n      show \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\" by(simp add: eqvts)\n    qed\n  }\n  note XI' = this\n\n  have \"eqvt ?X\"\n    apply(auto simp add: eqvt_def)\n    apply(rule_tac x=\"p \\<bullet> xvec\" in exI)\n    apply(rule_tac x=\"p \\<bullet> P\" in exI)\n    apply(rule_tac x=\"p \\<bullet> Q\" in exI)\n    apply(rule_tac x=\"p \\<bullet> R\" in exI)\n    apply(simp add: eqvts)\n    apply(simp add: fresh_star_bij)\n    apply(clarify)\n    apply(erule_tac x=\"(rev p) \\<bullet> A\\<^sub>R\" in allE)\n    apply(erule_tac x=\"(rev p) \\<bullet> \\<Psi>\\<^sub>R\" in allE)\n    apply(drule mp)\n    apply(rule conjI)\n    apply(rule_tac pi=p in pt_bij4[OF pt_name_inst, OF at_name_inst])\n    apply(simp add: eqvts)\n    defer\n    apply(drule_tac p=p in weakBisimClosed)\n    apply(simp add: eqvts)\n    apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n    apply simp\n    apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n    apply simp\n    apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n    by simp\n\n  moreover have Res: \"\\<And>\\<Psi> P Q x. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim; x \\<sharp> \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n  proof -\n    fix \\<Psi> P Q x\n    assume \"(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim\" and \"(x::name) \\<sharp> \\<Psi>\"\n    show \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n    proof(case_tac \"(\\<Psi>, P, Q) \\<in> ?X\")\n      assume \"(\\<Psi>, P, Q) \\<in> ?X\"\n      with `x \\<sharp> \\<Psi>` have \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X\"\n        apply auto\n        by(rule_tac x=\"x#xvec\" in exI) auto\n      thus ?thesis by simp\n    next\n      assume \"\\<not>(\\<Psi>, P, Q) \\<in> ?X\"\n      with `(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim` have \"\\<Psi> \\<rhd> P \\<approx> Q\"\n        by blast\n      hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>P \\<approx> \\<lparr>\\<nu>x\\<rparr>Q\" using `x \\<sharp> \\<Psi>`\n        by(rule weakBisimResPres)\n      thus ?thesis\n        by simp\n    qed\n  qed\n\n  {\n    fix \\<Psi>  :: 'b\n      and P  :: \"('a, 'b, 'c) psi\"\n      and Q  :: \"('a, 'b, 'c) psi\"\n      and \\<Psi>' :: 'b\n\n    assume \"\\<Psi> \\<rhd> P \\<approx> Q\"\n\n    hence \"\\<Psi> \\<rhd> Q \\<approx> P\" by(rule weakBisimE)\n    then obtain P' P'' where PChain: \"\\<Psi> \\<rhd> P \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> P'\"\n                         and QimpP': \"insert_assertion(extract_frame Q) \\<Psi> \\<hookrightarrow>\\<^sub>F insert_assertion(extract_frame P') \\<Psi>\"\n                         and P'Chain: \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P' \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> P''\"   \n                         and \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> Q \\<approx> P''\" using weak_stat_imp_def\n      by(blast dest: weakBisimE)\n    note PChain QimpP' P'Chain\n    moreover from `\\<Psi> \\<otimes> \\<Psi>' \\<rhd> Q \\<approx> P''` have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P'' \\<approx> Q\" by(rule weakBisimE)\n    ultimately have \"\\<exists>P' P''. \\<Psi> \\<rhd> P \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> P' \\<and> insert_assertion(extract_frame Q) \\<Psi> \\<hookrightarrow>\\<^sub>F insert_assertion(extract_frame P') \\<Psi> \\<and>\n                              \\<Psi> \\<otimes> \\<Psi>' \\<rhd> P' \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> P'' \\<and> \\<Psi> \\<otimes> \\<Psi>' \\<rhd> P'' \\<approx> Q\"\n      by blast\n  }\n  moreover \n  {\n    fix \\<Psi> P Q A\\<^sub>R \\<Psi>\\<^sub>R R\n    assume PSimQ: \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n       and FrR: \"extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\"\n       and \"A\\<^sub>R \\<sharp>* \\<Psi>\"\n       and \"A\\<^sub>R \\<sharp>* P\"\n       and \"A\\<^sub>R \\<sharp>* Q\"\n    hence \"(\\<Psi>, P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\"\n    proof -\n      have \"P \\<parallel> R = \\<lparr>\\<nu>*[]\\<rparr>(P \\<parallel> R)\" by simp\n      moreover have \"Q \\<parallel> R = \\<lparr>\\<nu>*[]\\<rparr>(Q \\<parallel> R)\" by simp\n      moreover have \"([]::name list) \\<sharp>* \\<Psi>\" by simp\n      moreover \n      {\n        fix A\\<^sub>R' \\<Psi>\\<^sub>R'\n\n        assume FrR': \"extract_frame R = \\<langle>A\\<^sub>R', \\<Psi>\\<^sub>R'\\<rangle>\"\n            and \"A\\<^sub>R' \\<sharp>* \\<Psi>\"\n            and \"A\\<^sub>R' \\<sharp>* P\"\n            and \"A\\<^sub>R' \\<sharp>* Q\"\n        obtain p where \"(p \\<bullet> A\\<^sub>R') \\<sharp>* A\\<^sub>R\"\n                   and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\\<^sub>R'\"\n                   and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\"\n                   and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* P\"\n                   and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* Q\"\n                   and S: \"(set p) \\<subseteq> (set A\\<^sub>R') \\<times> (set(p \\<bullet> A\\<^sub>R'))\" and \"distinct_perm p\"\n          by(rule_tac c=\"(A\\<^sub>R, \\<Psi>, \\<Psi>\\<^sub>R', P, Q)\" in name_list_avoiding) auto\n\n        \n        from `(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\\<^sub>R'` S have \"\\<langle>A\\<^sub>R', \\<Psi>\\<^sub>R'\\<rangle> = \\<langle>p \\<bullet> A\\<^sub>R', p \\<bullet> \\<Psi>\\<^sub>R'\\<rangle>\"\n          by(simp add: frame_chain_alpha)\n        \n        with FrR' have FrR'': \"extract_frame R = \\<langle>p \\<bullet> A\\<^sub>R', p \\<bullet> \\<Psi>\\<^sub>R'\\<rangle>\" by simp\n        with FrR `(p \\<bullet> A\\<^sub>R') \\<sharp>* A\\<^sub>R`\n        obtain q where \"p \\<bullet> \\<Psi>\\<^sub>R' = (q::name prm) \\<bullet> \\<Psi>\\<^sub>R\" and S': \"set q \\<subseteq> (set A\\<^sub>R) \\<times> set(p \\<bullet> A\\<^sub>R')\" and \"distinct_perm q\"\n          apply auto\n          apply(drule_tac sym) apply simp\n          by(drule_tac frame_chain_eq) auto\n        from PSimQ have \"(q \\<bullet> (\\<Psi> \\<otimes> \\<Psi>\\<^sub>R)) \\<rhd> (q \\<bullet> P) \\<approx> (q \\<bullet> Q)\"\n          by(rule weakBisimClosed)\n        with `A\\<^sub>R \\<sharp>* \\<Psi>` `A\\<^sub>R \\<sharp>* P` `A\\<^sub>R \\<sharp>* Q` `(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>` `(p \\<bullet> A\\<^sub>R') \\<sharp>* P` `(p \\<bullet> A\\<^sub>R') \\<sharp>* Q` S'\n        have \"\\<Psi> \\<otimes> (q \\<bullet> \\<Psi>\\<^sub>R) \\<rhd> P \\<approx> Q\" by(simp add: eqvts)\n        hence \"(p \\<bullet> (\\<Psi> \\<otimes> (q \\<bullet> \\<Psi>\\<^sub>R))) \\<rhd> (p \\<bullet> P) \\<approx> (p \\<bullet> Q)\" by(rule weakBisimClosed)\n        with `A\\<^sub>R' \\<sharp>* \\<Psi>` `A\\<^sub>R' \\<sharp>* P` `A\\<^sub>R' \\<sharp>* Q` `(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>` `(p \\<bullet> A\\<^sub>R') \\<sharp>* P` `(p \\<bullet> A\\<^sub>R') \\<sharp>* Q` S `distinct_perm p` `(p \\<bullet> \\<Psi>\\<^sub>R') = q \\<bullet> \\<Psi>\\<^sub>R` \n        have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R' \\<rhd> P \\<approx> Q\"\n          by(drule_tac sym) (simp add: eqvts)\n      }\n      ultimately show ?thesis\n        by blast\n    qed\n    hence \"(\\<Psi>, P \\<parallel> R, Q \\<parallel> R) \\<in> ?X \\<union> weakBisim\"\n      by simp\n  }\n  note C1 = this\n\n  have C2: \"\\<And>\\<Psi> P Q xvec. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim; (xvec::name list) \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>P, \\<lparr>\\<nu>*xvec\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n  proof -\n    fix \\<Psi> P Q xvec\n    assume \"(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim\"\n    assume \"(xvec::name list) \\<sharp>* \\<Psi>\"\n    thus \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>P, \\<lparr>\\<nu>*xvec\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n    proof(induct xvec)\n      case Nil\n      thus ?case using `(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim` by simp\n    next\n      case(Cons x xvec)\n      thus ?case by(simp only: res_chain.simps) (rule_tac Res, auto)\n    qed\n  qed\n\n  {\n    fix \\<Psi> :: 'b\n    and P :: \"('a, 'b, 'c) psi\"\n    and Q :: \"('a, 'b, 'c) psi\"\n    and R :: \"('a, 'b, 'c) psi\"\n    and A\\<^sub>R :: \"name list\"\n    and \\<Psi>\\<^sub>R :: 'b\n\n    assume \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n    and     FrR: \"extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\"\n    and     \"A\\<^sub>R \\<sharp>* \\<Psi>\"\n    and     \"A\\<^sub>R \\<sharp>* P\"\n    and     \"A\\<^sub>R \\<sharp>* Q\"\n\n    \n    have \"(\\<Psi>, P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\" \n    proof -\n      {\n        fix A\\<^sub>R' :: \"name list\"\n        and \\<Psi>\\<^sub>R' :: 'b\n\n        assume FrR': \"extract_frame R = \\<langle>A\\<^sub>R', \\<Psi>\\<^sub>R'\\<rangle>\"\n        and    \"A\\<^sub>R' \\<sharp>* \\<Psi>\"\n        and    \"A\\<^sub>R' \\<sharp>* P\"\n        and    \"A\\<^sub>R' \\<sharp>* Q\"\n\n        obtain p where \"(p \\<bullet> A\\<^sub>R') \\<sharp>* A\\<^sub>R\" and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\\<^sub>R'\" and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\" and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* P\" and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* Q\"\n                   and Sp: \"(set p) \\<subseteq> (set A\\<^sub>R') \\<times> (set(p \\<bullet> A\\<^sub>R'))\" and \"distinct_perm p\"\n          by(rule_tac c=\"(A\\<^sub>R, \\<Psi>, \\<Psi>\\<^sub>R', P, Q)\" in name_list_avoiding) auto\n            \n        from FrR' `(p \\<bullet> A\\<^sub>R') \\<sharp>*  \\<Psi>\\<^sub>R'` Sp have \"extract_frame R = \\<langle>(p \\<bullet> A\\<^sub>R'), p \\<bullet> \\<Psi>\\<^sub>R'\\<rangle>\"\n          by(simp add: frame_chain_alpha eqvts)\n        with FrR `(p \\<bullet> A\\<^sub>R') \\<sharp>* A\\<^sub>R` obtain q::\"name prm\" \n          where Sq: \"set q \\<subseteq> set(p \\<bullet> A\\<^sub>R') \\<times> set A\\<^sub>R\" and \"distinct_perm q\" and \"\\<Psi>\\<^sub>R = q \\<bullet> p \\<bullet> \\<Psi>\\<^sub>R'\"\n          by(force elim: frame_chain_eq)\n\n        from `\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q` `\\<Psi>\\<^sub>R = q \\<bullet> p \\<bullet> \\<Psi>\\<^sub>R'` have \"\\<Psi> \\<otimes> (q \\<bullet> p \\<bullet> \\<Psi>\\<^sub>R') \\<rhd> P \\<approx> Q\" by simp\n        hence \"(q \\<bullet> (\\<Psi> \\<otimes> (q \\<bullet> p \\<bullet> \\<Psi>\\<^sub>R'))) \\<rhd> (q \\<bullet> P) \\<approx> (q \\<bullet> Q)\" by(rule weakBisimClosed)\n        with Sq `A\\<^sub>R \\<sharp>* \\<Psi>` `(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>` `A\\<^sub>R \\<sharp>* P` `(p \\<bullet> A\\<^sub>R') \\<sharp>* P` `A\\<^sub>R \\<sharp>* Q` `(p \\<bullet> A\\<^sub>R') \\<sharp>* Q` `distinct_perm q`\n        have \"\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R') \\<rhd> P \\<approx> Q\" by(simp add: eqvts)\n        hence \"(p \\<bullet> (\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R'))) \\<rhd> (p \\<bullet> P) \\<approx> (p \\<bullet> Q)\" by(rule weakBisimClosed)\n        with Sp `A\\<^sub>R' \\<sharp>* \\<Psi>` `(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>` `A\\<^sub>R' \\<sharp>* P` `(p \\<bullet> A\\<^sub>R') \\<sharp>* P` `A\\<^sub>R' \\<sharp>* Q` `(p \\<bullet> A\\<^sub>R') \\<sharp>* Q` `distinct_perm p`\n        have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R' \\<rhd> P \\<approx> Q\" by(simp add: eqvts)\n      }\n      thus ?thesis\n        apply auto\n        apply(rule_tac x=\"[]\" in exI)\n        by auto blast\n    qed\n  }\n  note Goal = this\n  with assms have \"(\\<Psi>, P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cStatImp \\<Psi> PR QR)\n    {\n      fix xvec :: \"name list\"\n      fix P Q R \n      assume A: \"\\<forall>A\\<^sub>R \\<Psi>\\<^sub>R. extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle> \\<and> A\\<^sub>R \\<sharp>* \\<Psi> \\<and> A\\<^sub>R \\<sharp>* P \\<and> A\\<^sub>R \\<sharp>* Q \\<longrightarrow> \\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n      {\n        fix A\\<^sub>R \\<Psi>\\<^sub>R\n        assume \"extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\" and \"A\\<^sub>R \\<sharp>* \\<Psi>\" and \"A\\<^sub>R \\<sharp>* P\" and \"A\\<^sub>R \\<sharp>* Q\"\n        with A have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<lessapprox><weakBisim> Q\" by(auto dest: weakBisimE)\n      }\n      moreover assume \"xvec \\<sharp>* \\<Psi>\"\n      moreover have \"eqvt weakBisim\" by auto\n      moreover note C1 C2 statEqWeakBisim\n      ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R) \\<lessapprox><(?X \\<union> weakBisim)> \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)\" \n        by(rule weak_stat_impParPres)\n    }\n    with `(\\<Psi>, PR, QR) \\<in> ?X` show ?case by auto\n  next\n    case(cSim \\<Psi> PR QR)\n    from `(\\<Psi>, PR, QR) \\<in> ?X`    \n    obtain xvec P Q R A\\<^sub>R \\<Psi>\\<^sub>R where PFrR: \"PR = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R)\" and QFrR: \"QR = \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)\"\n                               and \"xvec \\<sharp>* \\<Psi>\"\n      by auto\n    with `(\\<Psi>, PR, QR) \\<in> ?X` have \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)) \\<in> ?X\" by simp\n    hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R) \\<leadsto><(?X \\<union> weakBisim)> \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)\" using `xvec \\<sharp>* \\<Psi>`\n    proof(induct xvec)\n      case Nil\n      from `(\\<Psi>, \\<lparr>\\<nu>*[]\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*[]\\<rparr>(Q \\<parallel> R)) \\<in> ?X` have PRQR: \"(\\<Psi>, P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\" by simp\n      from PRQR have \"\\<And>A\\<^sub>R \\<Psi>\\<^sub>R. \\<lbrakk>extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>; A\\<^sub>R \\<sharp>* \\<Psi>;  A\\<^sub>R \\<sharp>* P;  A\\<^sub>R \\<sharp>* Q\\<rbrakk> \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>\\<^sub>R, P, Q) \\<in> weakBisim\"\n        by auto\n      moreover note weakBisimEqvt\n      moreover from `eqvt ?X` have \"eqvt(?X \\<union> weakBisim)\" by auto\n      moreover note weakBisimE(2) weakBisimE(4) weakBisimE(3) weakBisimE(1)\n      moreover note C1 C2 \n      ultimately have \"\\<Psi> \\<rhd> P \\<parallel> R \\<leadsto><(?X \\<union> weakBisim)> Q \\<parallel> R\" using statEqWeakBisim\n        by(rule weakParPres)\n      thus ?case by simp\n    next\n      case(Cons x xvec')\n      from `(x#xvec') \\<sharp>* \\<Psi>` have \"x \\<sharp> \\<Psi>\" and \"xvec' \\<sharp>* \\<Psi>\" by simp+\n      with `(\\<Psi>, \\<lparr>\\<nu>*(x#xvec')\\<rparr>P \\<parallel> R, \\<lparr>\\<nu>*(x#xvec')\\<rparr>Q \\<parallel> R) \\<in> ?X`\n      have \"(\\<Psi>, \\<lparr>\\<nu>*(xvec')\\<rparr>P \\<parallel> R, \\<lparr>\\<nu>*(xvec')\\<rparr>Q \\<parallel> R) \\<in> ?X\"\n        apply auto\n        apply(subgoal_tac \"\\<exists>y yvec. xvec=y#yvec\")\n        apply(clarify)\n        apply simp\n        apply(simp add: psi.inject alpha)\n        apply(clarify)\n        apply(erule disjE)\n        apply(erule disjE)\n        apply(clarify)\n        apply blast\n        apply(clarify)\n        apply(clarify)\n        apply(simp add: eqvts)\n        apply(rule_tac x=\"[(x, y)] \\<bullet> yvec\" in exI)\n        apply(rule_tac x=\"[(x, y)] \\<bullet> P\" in exI)\n        apply(rule_tac x=\"[(x, y)] \\<bullet> Q\" in exI)\n        apply(rule_tac x=\"[(x, y)] \\<bullet> R\" in exI)\n        apply(clarsimp)\n        apply(rule conjI)\n        apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of \"[(x, y)]\", THEN sym])\n        apply simp\n        apply(clarify)\n        apply(erule_tac x=\"[(x, y)] \\<bullet> A\\<^sub>R\" in allE)\n        apply(erule_tac x=\"[(x, y)] \\<bullet> \\<Psi>\\<^sub>R\" in allE)\n        apply(drule mp)\n        apply(rule conjI)\n        apply(rule_tac pi=\"[(x, y)]\" in pt_bij4[OF pt_name_inst, OF at_name_inst])\n        apply(simp add: eqvts)\n        apply(rule conjI)\n        apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of \"[(x, y)]\", THEN sym])\n        apply simp\n        apply(rule conjI)\n        apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of \"[(x, y)]\", THEN sym])\n        apply simp\n        apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of \"[(x, y)]\", THEN sym])\n        apply simp\n        apply(drule_tac p=\"[(x, y)]\" in weakBisimClosed)\n        apply(simp add: eqvts)\n        by(case_tac xvec) auto\n      \n      with `\\<lbrakk>(\\<Psi>, \\<lparr>\\<nu>*xvec'\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*xvec'\\<rparr>(Q \\<parallel> R)) \\<in> ?X; xvec' \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec'\\<rparr>(P \\<parallel> R) \\<leadsto><(?X \\<union> weakBisim)> \\<lparr>\\<nu>*xvec'\\<rparr>(Q \\<parallel> R)` `xvec' \\<sharp>* \\<Psi>`\n      have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec'\\<rparr>(P \\<parallel> R) \\<leadsto><(?X \\<union> weakBisim)> \\<lparr>\\<nu>*xvec'\\<rparr>(Q \\<parallel> R)\" by blast\n      moreover note `eqvt ?X` \n      moreover from `eqvt ?X` have \"eqvt(?X \\<union> weakBisim)\" by auto\n      moreover note `x \\<sharp> \\<Psi>`\n      moreover have \"?X \\<union> weakBisim \\<subseteq> ?X \\<union> weakBisim\" by simp\n      ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec'\\<rparr>(P \\<parallel> R)) \\<leadsto><(?X \\<union> weakBisim)> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec'\\<rparr>(Q \\<parallel> R))\" using Res\n        by(rule_tac weakResPres)\n      thus ?case\n        by simp\n    qed\n    with PFrR QFrR show ?case\n      by simp\n  next\n    case(cExt \\<Psi> PR QR \\<Psi>')\n\n    from `(\\<Psi>, PR, QR) \\<in> ?X`\n    obtain xvec P Q R A\\<^sub>R \\<Psi>\\<^sub>R where PFrR: \"PR = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R)\" and QFrR: \"QR = \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)\"\n                               and \"xvec \\<sharp>* \\<Psi>\" and A: \"\\<forall>A\\<^sub>R \\<Psi>\\<^sub>R. (extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle> \\<and> A\\<^sub>R \\<sharp>* \\<Psi> \\<and> A\\<^sub>R \\<sharp>* P \\<and> A\\<^sub>R \\<sharp>* Q) \\<longrightarrow> \\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n      by auto\n    \n    obtain p where \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>\"\n               and \"(p \\<bullet> xvec) \\<sharp>* P\"\n               and \"(p \\<bullet> xvec) \\<sharp>* Q\"\n               and \"(p \\<bullet> xvec) \\<sharp>* R\"\n               and \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\"\n               and S: \"(set p) \\<subseteq> (set xvec) \\<times> (set(p \\<bullet> xvec))\" and \"distinct_perm p\"\n      by(rule_tac c=\"(\\<Psi>, P, Q, R, \\<Psi>')\" in name_list_avoiding) auto\n\n    from `(p \\<bullet> xvec) \\<sharp>* P` `(p \\<bullet> xvec) \\<sharp>* R` S have \"\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(p \\<bullet> (P \\<parallel> R))\"\n      by(subst res_chain_alpha) auto\n    hence PRAlpha: \"\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> (p \\<bullet> R))\"\n      by(simp add: eqvts)\n\n    from `(p \\<bullet> xvec) \\<sharp>* Q` `(p \\<bullet> xvec) \\<sharp>* R` S have \"\\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(p \\<bullet> (Q \\<parallel> R))\"\n      by(subst res_chain_alpha) auto\n    hence QRAlpha: \"\\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> Q) \\<parallel> (p \\<bullet> R))\"\n      by(simp add: eqvts)\n\n    from `(p \\<bullet> xvec) \\<sharp>* \\<Psi>` `(p \\<bullet> xvec) \\<sharp>* \\<Psi>'` have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> (p \\<bullet> R)), \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> Q) \\<parallel> (p \\<bullet> R))) \\<in> ?X\"\n   proof(rule_tac C2=\"(\\<Psi>, (p \\<bullet> P), (p \\<bullet> Q), R, \\<Psi>', xvec, p \\<bullet> xvec)\" in XI', auto)\n      fix A\\<^sub>R \\<Psi>\\<^sub>R\n      assume FrR: \"extract_frame (p \\<bullet> R) = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\" and \"A\\<^sub>R \\<sharp>* \\<Psi>\" and \"A\\<^sub>R \\<sharp>* \\<Psi>'\" and \"A\\<^sub>R \\<sharp>* (p \\<bullet> P)\" and \"A\\<^sub>R \\<sharp>* (p \\<bullet> Q)\"\n      from FrR have \"(p \\<bullet> (extract_frame (p \\<bullet> R))) = (p \\<bullet> \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>)\" by simp\n      with `distinct_perm p` have \"extract_frame R = \\<langle>p \\<bullet> A\\<^sub>R, p \\<bullet> \\<Psi>\\<^sub>R\\<rangle>\" by(simp add: eqvts)\n      moreover from `A\\<^sub>R \\<sharp>* \\<Psi>` have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> \\<Psi>)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with `xvec \\<sharp>* \\<Psi>` `(p \\<bullet> xvec) \\<sharp>* \\<Psi>` S have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\" by simp\n      moreover from `A\\<^sub>R \\<sharp>* (p \\<bullet> P)` have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> p \\<bullet> P)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with `distinct_perm p` have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* P\" by simp\n      moreover from `A\\<^sub>R \\<sharp>* (p \\<bullet> Q)` have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> p \\<bullet> Q)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with `distinct_perm p` have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* Q\" by simp\n      ultimately have \"\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R) \\<rhd> P \\<approx> Q\" using A by blast\n      hence \"(\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R)) \\<otimes> (p \\<bullet> \\<Psi>') \\<rhd> P \\<approx> Q\" by(rule weakBisimE)\n      moreover have \"(\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R)) \\<otimes> (p \\<bullet> \\<Psi>') \\<simeq> (\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>')) \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R)\"\n        by(metis Associativity Commutativity Composition Assertion_stat_eq_trans Assertion_stat_eq_sym)\n      ultimately have \"(\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>')) \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R) \\<rhd> P \\<approx> Q\" \n        by(rule statEqWeakBisim)\n      hence \"(p \\<bullet> ((\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>')) \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R))) \\<rhd> (p \\<bullet> P) \\<approx> (p \\<bullet> Q)\"\n        by(rule weakBisimClosed)\n      with `distinct_perm p` `xvec \\<sharp>* \\<Psi>` `(p \\<bullet> xvec) \\<sharp>* \\<Psi>` S show \"(\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>\\<^sub>R \\<rhd> (p \\<bullet> P) \\<approx> (p \\<bullet> Q)\"\n        by(simp add: eqvts)\n    qed\n    with PFrR QFrR PRAlpha QRAlpha show ?case by simp\n  next\n    case(cSym \\<Psi> PR QR)\n    thus ?case by(blast dest: weakBisimE)\n  qed\nqed\n\nlemma weakBisimParPres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"\\<Psi> \\<rhd> P \\<approx> Q\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> R \\<approx> Q \\<parallel> R\"\nproof -\n  obtain A\\<^sub>R \\<Psi>\\<^sub>R where \"extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\" and \"A\\<^sub>R \\<sharp>* \\<Psi>\" and \"A\\<^sub>R \\<sharp>* P\" and \"A\\<^sub>R \\<sharp>* Q\"\n    by(rule_tac C=\"(\\<Psi>, P, Q)\" in fresh_frame) auto\n  moreover from `\\<Psi> \\<rhd> P \\<approx> Q` have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\" by(rule weakBisimE)\n  ultimately show ?thesis by(rule_tac weakBisimParPresAux)\nqed\n\nend\n\nend\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Weak_Bisim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3354602807656564}}
{"text": "(******************************************************************************)\n(* Project: Isabelle/UTP: Unifying Theories of Programming in Isabelle/HOL    *)\n(* File: ulift.thy                                                            *)\n(* Authors: Frank Zeyda and Simon Foster (University of York, UK)             *)\n(* Emails: frank.zeyda@gmail.com and simon.foster@york.ac.uk                  *)\n(******************************************************************************)\n(* LAST REVIEWED: 09 Jun 2022 *)\n\nsection \\<open>Predicate Lifting\\<close>\n\ntheory ulift\nimports upred unrest\nkeywords \"declare_uvar\" :: thy_decl\nbegin\n\ntext \\<open>A parser that lifts HOL predicates into @{type upred} objects.\\<close>\n\nsubsection \\<open>Tool Options\\<close>\n\ntext \\<open>Option that enables implicit typing in lifted predicates.\\<close>\n\nML \\<open>\n  val (ulift_typing, ulift_typing_setup) =\n    Attrib.config_bool @{binding ulift_typing} (K true);\n\\<close>\n\nsetup ulift_typing_setup\n\ntext \\<open>Option that disables the pretty-printer to facilitate debugging.\\<close>\n\nML \\<open>\n  val (disable_ulift_pp, disable_ulift_pp_setup) =\n    Attrib.config_bool @{binding disable_ulift_pp} (K false);\n\\<close>\n\nsetup disable_ulift_pp_setup\n\nsubsection \\<open>Lifting Operator\\<close>\n\nlift_definition LiftP :: \"(ustate \\<Rightarrow> bool) \\<Rightarrow> upred\"\nis \"\\<lambda>f::ustate \\<Rightarrow> bool. {b .f b}\"\ndone\n\n(* declare ustate_app_poly_def [evalp] *)\n\nsubsection \\<open>Lifting Syntax\\<close>\n\ntext \\<open>We define a constant to tag terms to be processed by the parser.\\<close>\n\nconsts ulift :: \"bool \\<Rightarrow> upred\" (\"'(_')\\<^sub>p\")\n\ntext \\<open>The following allows us to protect inner terms from processing.\\<close>\n\nconsts uprotect :: \"'a \\<Rightarrow> 'a\" (\"@'(_')\")\n\nsubsection \\<open>Parser and Printer\\<close>\n\nML_file \"ulift.ML\"\n\nsetup \\<open>\n  Context.theory_map (\n    (Syntax_Phases.term_check 2 \"ulift parser\" Ulift_Parser.ulift_tr) o\n    (Syntax_Phases.term_uncheck 2 \"ulift printer\" Ulift_Printer.ulift_tr'))\n\\<close>\n\nsubsection \\<open>Implicit Typing\\<close>\n\nparse_translation \\<open>\n  [(@{const_syntax \"ulift\"}, Ulift_Typing.implicit_typing)]\n\\<close>\n\ntext \\<open>The following configures a command to declare an auxiliary variable.\\<close>\n\nML \\<open>\n  Outer_Syntax.local_theory @{command_keyword \"declare_uvar\"} \"declare uvar\"\n    (Parse.const_decl >>\n      (fn (uvar, typ, _) => Ulift_Typing.mk_uvar_type_synonym uvar typ));\n\\<close>\n\nsubsection \\<open>Proof Support\\<close>\n\ntheorem EvalP_LiftP [evalp]:\n\"\\<lbrakk>LiftP f\\<rbrakk>b = (f b)\"\napply (transfer)\napply (simp)\ndone\n\nsubsection \\<open>Theorems\\<close>\n\nparagraph \\<open>Unrestriction of Lifting\\<close>\n\ntheorem LiftP_unrest_zero:\n\"vs \\<sharp> (LiftP (\\<lambda>b. P0))\"\napply (transfer)\napply (simp)\ndone\n\ntheorem LiftP_unrest:\n\"vs \\<inter> {v} = {} \\<Longrightarrow>\n vs \\<sharp> (LiftP (\\<lambda>b. P1 b\\<cdot>v))\"\n\"vs \\<inter> {v1, v2} = {} \\<Longrightarrow>\n vs \\<sharp> (LiftP (\\<lambda>b. P2 b\\<cdot>v1 b\\<cdot>v2))\"\n\"vs \\<inter> {v1, v2, v3} = {} \\<Longrightarrow>\n vs \\<sharp> (LiftP (\\<lambda>b. P3 b\\<cdot>v1 b\\<cdot>v2 b\\<cdot>v3))\"\n\"vs \\<inter> {v1, v2, v3, v4} = {} \\<Longrightarrow>\n vs \\<sharp> (LiftP (\\<lambda>b. P4 b\\<cdot>v1 b\\<cdot>v2 b\\<cdot>v3 b\\<cdot>v4))\"\n\"vs \\<inter> {v1, v2, v3, v4, v5} = {} \\<Longrightarrow>\n vs \\<sharp> (LiftP (\\<lambda>b. P5 b\\<cdot>v1 b\\<cdot>v2 b\\<cdot>v3 b\\<cdot>v4 b\\<cdot>v5))\"\n\"vs \\<inter> {v1, v2, v3, v4, v5, v6} = {} \\<Longrightarrow>\n vs \\<sharp> (LiftP (\\<lambda>b. P6 b\\<cdot>v1 b\\<cdot>v2 b\\<cdot>v3 b\\<cdot>v4 b\\<cdot>v5 b\\<cdot>v6))\"\n\"vs \\<inter> {v1, v2, v3, v4, v5, v6, v7} = {} \\<Longrightarrow>\n vs \\<sharp> (LiftP (\\<lambda>b. P7 b\\<cdot>v1 b\\<cdot>v2 b\\<cdot>v3 b\\<cdot>v4 b\\<cdot>v5 b\\<cdot>v6 b\\<cdot>v7))\"\n\"vs \\<inter> {v1, v2, v3, v4, v5, v6, v7, v8} = {} \\<Longrightarrow>\n vs \\<sharp> (LiftP (\\<lambda>b. P8 b\\<cdot>v1 b\\<cdot>v2 b\\<cdot>v3 b\\<cdot>v4 b\\<cdot>v5 b\\<cdot>v6 b\\<cdot>v7 b\\<cdot>v8))\"\napply (transfer', clarsimp, transfer', simp)+\ndone\n\ntheorem \"{$z\\<down>} \\<sharp> (x = y + (1::nat))\\<^sub>p\"\napply (unfold ustate_app_poly_def)\napply (rule LiftP_unrest)\napply (code_simp)\ndone\n\ntheorem \"{$x\\<down>} \\<sharp> (x = y + (1::nat))\\<^sub>p\"\napply (unfold ustate_app_poly_def)\napply (rule LiftP_unrest)\napply (code_simp)\noops\n\nsubsection \\<open>Experiments\\<close>\n\ntext \\<open>Types propagate through predicate connectives.\\<close>\n\ntheorem \"taut (x = y + 1)\\<^sub>p \\<and>\\<^sub>p (y = 2)\\<^sub>p \\<Rightarrow>\\<^sub>p (x = (3::nat))\\<^sub>p\"\napply (unfold evalp)\napply (clarify)\napply (simp)\ndone\n\ntext \\<open>HOL quantifies can be used in lifted predicates too.\\<close>\n\ntheorem \"taut (\\<exists> y . x = y + 1)\\<^sub>p \\<Rightarrow>\\<^sub>p (x > (0::nat))\\<^sub>p\"\napply (unfold evalp simp_thms)\napply (clarify)\napply (simp)\ndone\n\ntext \\<open>Note that the following holds for arbitrary HOL sets!\\<close>\n\ninject_type set\n\ntheorem \"taut (x < 3)\\<^sub>p \\<and>\\<^sub>p (s = {0::nat, 1, 2})\\<^sub>p \\<Rightarrow>\\<^sub>p (x \\<in> s)\\<^sub>p\"\napply (unfold evalp)\napply (safe)\napply (clarsimp)\ndone\n\ntext \\<open>Lifting implies that HOL connectives are naturally supported.\\<close>\n\ntheorem \"taut (x < 3 \\<and> s = {0, 1, 2::nat} \\<longrightarrow> x \\<in> s)\\<^sub>p\"\napply (unfold evalp)\napply (safe)\napply (clarsimp)\ndone\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/axiomatic/theories/core/ulift.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.3354602807656564}}
{"text": "(*<*)\n(* Author: Thomas Bauereiss *)\ntheory AArch64_Trivia\n  imports \"Sail-AArch64.Aarch64_lemmas\" Sail.Sail2_operators_mwords_lemmas Word_Extra Proof_methods\nbegin\n(*>*)\n\ntext \\<open>Various helper lemmas for simplifying proof obligations arising in the computation of\npreconditions, e.g. if-then-else-distributivity rules for the datatypes in the model.\\<close>\n\nabbreviation\n  \"CreateFaultRecord typ1 ipaddress level acctype write1 extflag errortype secondstage s2fs1walk \\<equiv>\n     \\<lparr>FaultRecord_typ = typ1, FaultRecord_acctype = acctype, FaultRecord_ipaddress = ipaddress,\n      FaultRecord_s2fs1walk = s2fs1walk, FaultRecord_write = write1, FaultRecord_level = level,\n      FaultRecord_extflag = extflag, FaultRecord_secondstage = secondstage, FaultRecord_domain = 0,\n      FaultRecord_errortype = errortype, FaultRecord_debugmoe = 0\\<rparr>\"\n\nabbreviation\n  \"AccessDescriptor acctype ptwalk secondstage s2fs2walk level \\<equiv>\n     \\<lparr>AccessDescriptor_acctype = acctype,\n      AccessDescriptor_page_table_walk = ptwalk,\n      AccessDescriptor_secondstage = secondstage,\n      AccessDescriptor_s2fs1walk = s2fs2walk,\n      AccessDescriptor_level = level\\<rparr>\"\n\nlemma CreateFaultRecord_if_distrib:\n  \"(if c then CreateFaultRecord typ1 ipaddress1 level1 acctype1 write1 extflag1 errortype1 secondstage1 s2fs1walk1\n    else CreateFaultRecord typ2 ipaddress2 level2 acctype2 write2 extflag2 errortype2 secondstage2 s2fs1walk2) =\n    CreateFaultRecord (if c then typ1 else typ2) (if c then ipaddress1 else ipaddress2)\n      (if c then level1 else level2) (if c then acctype1 else acctype2) (if c then write1 else write2)\n      (if c then extflag1 else extflag2) (if c then errortype1 else errortype2)\n      (if c then secondstage1 else secondstage2) (if c then s2fs1walk1 else s2fs1walk2)\"\n  by auto\n\nlemma fun2_if_distrib:\n  \"(if c then f x1 y1 else f x2 y2) = f (if c then x1 else x2) (if c then y1 else y2)\"\n  by auto\n\nlemmas fun2_if_distribs =\n  if_distrib[where f = f for f :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'c\", symmetric]\n  fun2_if_distrib\n  fun2_if_distrib[where f = Pair]\n  fun2_if_distrib[where f = \"(\\<and>)\"]\n  fun2_if_distrib[where f = \"(\\<or>)\"]\n\nlemmas prod_if_distrib = fun2_if_distrib[where f = Pair]\nlemmas conj_if_distrib = fun2_if_distrib[where f = \"(\\<and>)\"]\nlemmas disj_if_distrib = fun2_if_distrib[where f = \"(\\<or>)\"]\n\nlemmas all_if_distrib = if_distrib[where f = \"\\<lambda>c. \\<forall>b. c b\", symmetric]\n\nlemmas AddressDescriptor_memattrs_update_if_distrib =\n  if_distrib[where f = \"\\<lambda>c. addrdesc\\<lparr>AddressDescriptor_memattrs := c\\<rparr>\" for addrdesc, symmetric]\n  if_distrib[where f = \"\\<lambda>c. c\\<lparr>AddressDescriptor_memattrs := z\\<rparr>\" for z]\n\nlemma MemoryAttributes_if_distrib:\n  \"(if c then\n      \\<lparr>MemoryAttributes_typ = typ1, MemoryAttributes_device = device1,\n       MemoryAttributes_inner = inner1, MemoryAttributes_outer = outer1,\n       MemoryAttributes_shareable = shareable1, MemoryAttributes_outershareable = outershareable1\\<rparr>\n    else\n      \\<lparr>MemoryAttributes_typ = typ2, MemoryAttributes_device = device2,\n       MemoryAttributes_inner = inner2, MemoryAttributes_outer = outer2,\n       MemoryAttributes_shareable = shareable2, MemoryAttributes_outershareable = outershareable2\\<rparr>) =\n    \\<lparr>MemoryAttributes_typ = if c then typ1 else typ2,\n     MemoryAttributes_device = if c then device1 else device2,\n     MemoryAttributes_inner = if c then inner1 else inner2,\n     MemoryAttributes_outer = if c then outer1 else outer2,\n     MemoryAttributes_shareable = if c then shareable1 else shareable2,\n     MemoryAttributes_outershareable = if c then outershareable1 else outershareable2\\<rparr>\"\n  by auto\n\nlemma MemoryAttributes_cong:\n  assumes \"typ1 = typ2\" and \"device1 = device2\" and \"inner1 = inner2\" and \"outer1 = outer2\"\n    and \"shareable1 = shareable2\" and \"outershareable1 = outershareable2\"\n  shows\n    \"\\<lparr>MemoryAttributes_typ = typ1, MemoryAttributes_device = device1,\n      MemoryAttributes_inner = inner1, MemoryAttributes_outer = outer1,\n      MemoryAttributes_shareable = shareable1, MemoryAttributes_outershareable = outershareable1\\<rparr> =\n     \\<lparr>MemoryAttributes_typ = typ2, MemoryAttributes_device = device2,\n      MemoryAttributes_inner = inner2, MemoryAttributes_outer = outer2,\n      MemoryAttributes_shareable = shareable2, MemoryAttributes_outershareable = outershareable2\\<rparr>\"\n  using assms by auto\n\n\nlemma MemAttrHints_if_distrib:\n  \"(if c\n    then \\<lparr>MemAttrHints_attrs = attrs1, MemAttrHints_hints = hints1, MemAttrHints_transient = transient1\\<rparr>\n    else \\<lparr>MemAttrHints_attrs = attrs2, MemAttrHints_hints = hints2, MemAttrHints_transient = transient2\\<rparr>) =\n   \\<lparr>MemAttrHints_attrs = if c then attrs1 else attrs2,\n    MemAttrHints_hints = if c then hints1 else hints2,\n    MemAttrHints_transient = if c then transient1 else transient2\\<rparr>\"\n  by auto\n\nlemma MemAttrHints_cong:\n  assumes \"attrs1 = attrs2\" and \"hints1 = hints2\" and \"transient1 = transient2\"\n  shows \"\\<lparr>MemAttrHints_attrs = attrs1, MemAttrHints_hints = hints1, MemAttrHints_transient = transient1\\<rparr> =\n         \\<lparr>MemAttrHints_attrs = attrs2, MemAttrHints_hints = hints2, MemAttrHints_transient = transient2\\<rparr>\"\n  using assms by auto\n\nlemma case_option_if_distrib:\n  \"(if b then (case x1 of Some y \\<Rightarrow> f1 y | None \\<Rightarrow> g1) else (case x2 of Some y \\<Rightarrow> f2 y | None \\<Rightarrow> g2)) =\n   (case (if b then x1 else x2) of Some y \\<Rightarrow> if b then f1 y else f2 y | None \\<Rightarrow> if b then g1 else g2)\"\n  by (auto split: option.splits)\n\nlemma case_prod_if_distrib:\n  \"(if b then (case x1 of (y1, z1) \\<Rightarrow> f1 y1 z1) else (case x2 of (y2, z2) \\<Rightarrow> f2 y2 z2)) =\n   (case (if b then x1 else x2) of (y, z) \\<Rightarrow> if b then f1 y z else f2 y z)\"\n  by auto\n\nlemma app_let_distrib: \"(let x = y in f x) z = (let x = y in f x z)\"\n  by auto\n\nlemmas TLBRecord_if_distribs[simp] =\n  if_distrib[where f = TLBRecord_descupdate] if_distrib[where f = TLBRecord_descupdate_update]\n  if_distrib[where f = \"\\<lambda>x. r\\<lparr>TLBRecord_descupdate := x\\<rparr>\" for r]\n  if_distrib[where f = TLBRecord_addrdesc]\nlemmas DescriptorUpdate_if_distribs[simp] =\n  if_distrib[where f = DescriptorUpdate_descaddr_update]\nlemmas MemAttrHints_if_distribs[simp] =\n  if_distrib[where f = MemAttrHints_attrs]\nlemmas [simp] =\n  if_distrib[where f = FullAddress_physicaladdress]\n  if_distrib[where f = AddressDescriptor_paddress]\n  if_distrib[where f = \"\\<lambda>i. x < i\" for x]\n  if_distrib[where f = \"\\<lambda>i. i < x\" for x]\n  if_distrib[where f = \"\\<lambda>i. x - i\" for x]\n  if_distrib[where f = \"\\<lambda>i. i = x\" for x]\n\nlemmas PrePost_if_distribs = app_if_distrib prod_if_distrib conj_if_distrib disj_if_distrib all_if_distrib\n  AddressDescriptor_memattrs_update_if_distrib MemoryAttributes_if_distrib MemAttrHints_if_distrib\n  (*TLBRecord_descupdate_update_if_distrib DescriptorUpdate_descaddr_update_if_distrib*)\n  if_distrib[where f = \"\\<lambda>c. z \\<le> c\" for z] if_distrib[where f = \"\\<lambda>c. c \\<le> z\" for z]\n  if_distrib[where f = \"\\<lambda>c. z < c\" for z] if_distrib[where f = \"\\<lambda>c. c < z\" for z]\n  if_distrib[where f = returnS, symmetric]\n  if_distrib[where f = return, symmetric]\n  case_option_if_distrib case_prod_if_distrib\n  if_distrib[where f = \"\\<lambda>c. let a = b in c a\" for b, symmetric]\n  if_distrib[where f = \"\\<lambda>c. a \\<longrightarrow> c\" for a, symmetric]\n  (*if_distrib[where f = \"\\<lambda>c. z = c\" for z] if_distrib[where f = \"\\<lambda>c. c = z\" for z]*)\n  (*if_distrib[where f = \"\\<lambda>c. c' \\<and> c\" for c'] if_distrib[where f = \"\\<lambda>c. c \\<and> c'\" for c']*)\n\nlemmas app_case_distribs =\n  sum.case_distrib[where h = \"\\<lambda>c. c z\" for z]\n  ex.case_distrib[where h = \"\\<lambda>c. c z\" for z]\n  option.case_distrib[where h = \"\\<lambda>c. c z\" for z]\n  app_let_distrib\n\nlemma if_True_False_simps[simp]:\n  \"(if c then True else False) = c\"\n  \"(if c then False else True) = (\\<not>c)\"\n  \"(if c1 then True else c2) = (c1 \\<or> c2)\"\n  \"(if c1 then c2 else True) = (c1 \\<longrightarrow> c2)\"\n  \"(if c1 then c2 else False) = (c1 \\<and> c2)\"\n  by auto\n\nlemma conj_imp_cond_absorb[simp]: \"(b \\<longrightarrow> c1) \\<and> (b \\<longrightarrow> c2) \\<longleftrightarrow> (b \\<longrightarrow> c1 \\<and> c2)\"\n  by auto\n\nlemma if_then_imp_distrib:\n  \"(if c then x \\<longrightarrow> y else z) = ((c \\<and> \\<not>x) \\<or> (if c then y else z))\"\n  \"(if c then x \\<or> y else z) = ((c \\<and> x) \\<or> (if c then y else z))\"\n  \"(if c then x else y \\<longrightarrow> z) = ((\\<not>c \\<and> \\<not>y) \\<or> (if c then x else z))\"\n  \"(if c then x else y \\<or> z) = ((\\<not>c \\<and> y) \\<or> (if c then x else z))\"\n  by auto\n\nlemma if_then_all_distrib:\n  \"\\<And>c f g. (if c then \\<forall>x. f x else g) = (\\<forall>x. if c then f x else g)\"\n  \"\\<And>c f g. (if c then f else \\<forall>x. g x) = (\\<forall>x. if c then f else g x)\"\n  by auto\n\nlemma if_then_conj_distrib:\n  \"(if c then x \\<and> y else z) = ((c \\<longrightarrow> x) \\<and> (if c then y else z))\"\n  \"(if c then x else y \\<and> z) = ((\\<not>c \\<longrightarrow> y) \\<and> (if c then x else z))\"\n  by auto\n\nlemma nested_if_merges[simp]:\n  \"(if c1 then x else if c2 then x else y) = (if c1 \\<or> c2 then x else y)\"\n  \"(if c1 then x else if c2 then y else x) = (if c1 \\<or> \\<not>c2 then x else y)\"\n  \"(if c1 then x else (if c2 then y else (if c3 then x else z))) = (if c1 \\<or> (\\<not>c2 \\<and> c3) then x else if c2 then y else z)\"\n  \"(if c1 then x else (if c2 then (if c3 then x else y) else z)) = (if c1 \\<or> (c2 \\<and> c3) then x else if c2 then y else z)\"\n  \"(if c1 then (if c2 then x else y) else (if c3 then x else z)) = (if (c1 \\<and> c2) \\<or> (\\<not>c1 \\<and> c3) then x else if c1 then y else z)\"\n  \"(if (if a then b else c) then x else y) \\<longleftrightarrow> (if (\\<not>a \\<or> b) \\<and> (a \\<or> c) then x else y)\"\n  \"(if a then b \\<and> c else c) \\<longleftrightarrow> (\\<not>a \\<or> b) \\<and> c\"\n  \"(if a then (if b then x else y) else y) \\<longleftrightarrow> (if (a \\<and> b) then x else y)\"\n  \"(if a then (if b then x else y) else (if c then x else y)) \\<longleftrightarrow> (if (\\<not>a \\<or> b) \\<and> (a \\<or> c) then x else y)\"\n  \"(\\<forall>a. if a \\<or> b then x else y) \\<longleftrightarrow> x \\<and> (if b then x else y)\"\n  by auto\n\nlemma conj_disj_absorbs[simp]:\n  \"A \\<and> B \\<or> A \\<longleftrightarrow> A\"\n  \"A \\<and> B \\<or> B \\<longleftrightarrow> B\"\n  \"(A \\<and> B) \\<or> (\\<not>A \\<and> B) \\<longleftrightarrow> B\"\n  \"(\\<not>A \\<and> B) \\<or> (A \\<and> B) \\<longleftrightarrow> B\"\n  by auto\n\nlemma quant_singleton_bool_simps[simp]:\n  \"(\\<forall>b. b) \\<longleftrightarrow> False\" \"(\\<forall>b. \\<not>b) \\<longleftrightarrow> False\" \"(\\<exists>b. b) \\<longleftrightarrow> True\" \"(\\<exists>b. \\<not>b) \\<longleftrightarrow> True\"\n  by auto\n\nlemmas MemAttr_defs[simp] = MemAttr_WT_def MemAttr_WB_def MemAttr_NC_def\n\nlemma case_prod15_split:\n  \"(case vars of (accdesc, addrselectbottom, addrselecttop, ap_table, baseaddress, blocktranslate, desc, descaddr, descaddr2, hwupdatewalk, level,\n                     ns_table, pxn_table, result, xn_table) \\<Rightarrow>\n      f accdesc addrselectbottom addrselecttop ap_table baseaddress blocktranslate desc descaddr descaddr2 hwupdatewalk level\n                     ns_table pxn_table result xn_table) =\n   (\\<forall>accdesc addrselectbottom addrselecttop ap_table baseaddress blocktranslate desc descaddr descaddr2 hwupdatewalk level\n                     ns_table pxn_table result xn_table.\n      vars = (accdesc, addrselectbottom, addrselecttop, ap_table, baseaddress, blocktranslate, desc, descaddr, descaddr2, hwupdatewalk, level,\n                     ns_table, pxn_table, result, xn_table) \\<longrightarrow>\n      f accdesc addrselectbottom addrselecttop ap_table baseaddress blocktranslate desc descaddr descaddr2 hwupdatewalk level\n                     ns_table pxn_table result xn_table)\"\n  by auto\n\nlemma prod15_cases:\n  obtains accdesc addrselectbottom addrselecttop ap_table baseaddress blocktranslate desc descaddr descaddr2 hwupdatewalk level\n                     ns_table pxn_table result xn_table\n                   where \"x = (accdesc, addrselectbottom, addrselecttop, ap_table, baseaddress, blocktranslate, desc, descaddr, descaddr2, hwupdatewalk, level,\n                     ns_table, pxn_table, result, xn_table)\"\n  by (cases x) auto\n\nlemma TLBRecord_if_distrib:\n  \"(if c then\n      \\<lparr>TLBRecord_perms =\n         \\<lparr>Permissions_ap = ap1, Permissions_xn = xn1, Permissions_xxn = xxn1, Permissions_pxn = pxn1\\<rparr>,\n       TLBRecord_nG = nG1, TLBRecord_domain = domain1, TLBRecord_contiguous = contiguous1,\n       TLBRecord_level = level1, TLBRecord_blocksize = blocksize1,\n       TLBRecord_descupdate =\n         \\<lparr>DescriptorUpdate_AF = af1, DescriptorUpdate_AP = descupd_ap1,\n          DescriptorUpdate_descaddr = descaddr1 \\<rparr>,\n       TLBRecord_CnP = cnp1,\n       TLBRecord_addrdesc =\n         \\<lparr>AddressDescriptor_fault = fault1, AddressDescriptor_memattrs = memattrs1,\n          AddressDescriptor_paddress = \\<lparr>FullAddress_physicaladdress = paddress1, FullAddress_NS = ns1\\<rparr>,\n          AddressDescriptor_vaddress = vaddress1\\<rparr> \\<rparr>\n    else\n      \\<lparr>TLBRecord_perms =\n         \\<lparr>Permissions_ap = ap2, Permissions_xn = xn2, Permissions_xxn = xxn2, Permissions_pxn = pxn2\\<rparr>,\n       TLBRecord_nG = nG2, TLBRecord_domain = domain2, TLBRecord_contiguous = contiguous2,\n       TLBRecord_level = level2, TLBRecord_blocksize = blocksize2,\n       TLBRecord_descupdate =\n         \\<lparr>DescriptorUpdate_AF = af2, DescriptorUpdate_AP = descupd_ap2, DescriptorUpdate_descaddr = descaddr2 \\<rparr>,\n       TLBRecord_CnP = cnp2,\n       TLBRecord_addrdesc =\n         \\<lparr>AddressDescriptor_fault = fault2, AddressDescriptor_memattrs = memattrs2,\n          AddressDescriptor_paddress = \\<lparr>FullAddress_physicaladdress = paddress2, FullAddress_NS = ns2\\<rparr>,\n          AddressDescriptor_vaddress = vaddress2\\<rparr> \\<rparr>) =\n       \\<lparr>TLBRecord_perms =\n          \\<lparr>Permissions_ap = if c then ap1 else ap2,\n           Permissions_xn = if c then xn1 else xn2,\n           Permissions_xxn = if c then xxn1 else xxn2,\n           Permissions_pxn = if c then pxn1 else pxn2\\<rparr>,\n        TLBRecord_nG = if c then nG1 else nG2,\n        TLBRecord_domain = if c then domain1 else domain2,\n        TLBRecord_contiguous = if c then contiguous1 else contiguous2,\n        TLBRecord_level = if c then level1 else level2,\n        TLBRecord_blocksize = if c then blocksize1 else blocksize2,\n        TLBRecord_descupdate =\n          \\<lparr>DescriptorUpdate_AF = if c then af1 else af2,\n           DescriptorUpdate_AP = if c then descupd_ap1 else descupd_ap2,\n           DescriptorUpdate_descaddr = if c then descaddr1 else descaddr2 \\<rparr>,\n        TLBRecord_CnP = if c then cnp1 else cnp2,\n        TLBRecord_addrdesc =\n          \\<lparr>AddressDescriptor_fault = if c then fault1 else fault2,\n           AddressDescriptor_memattrs = if c then memattrs1 else memattrs2,\n           AddressDescriptor_paddress =\n              \\<lparr>FullAddress_physicaladdress = if c then paddress1 else paddress2,\n               FullAddress_NS = if c then ns1 else ns2\\<rparr>,\n           AddressDescriptor_vaddress = if c then vaddress1 else vaddress2\\<rparr> \\<rparr>\"\n  by auto\n\nlemma DescriptorUpdate_if_distrib:\n  \"(if c\n    then \\<lparr>DescriptorUpdate_AF = af1, DescriptorUpdate_AP = ap1, DescriptorUpdate_descaddr = addr1\\<rparr>\n    else \\<lparr>DescriptorUpdate_AF = af2, DescriptorUpdate_AP = ap2, DescriptorUpdate_descaddr = addr2\\<rparr>) =\n   \\<lparr>DescriptorUpdate_AF = if c then af1 else af2,\n    DescriptorUpdate_AP = if c then ap1 else ap2,\n    DescriptorUpdate_descaddr = if c then addr1 else addr2\\<rparr>\"\n  by auto\n\n\n(* Add some lemmas for automatically splitting TLBRecords into their components during precondition\n   computation.  This seems to make simplification of record updates more efficient. *)\n\nlemma TLBRecord_cases:\n  fixes x :: TLBRecord\n  obtains ap xn xxn pxn nG domain contiguous level blocksize af descupd_ap descaddr cnp fault memattrs paddress ns vaddress\n  where \"x = \\<lparr>TLBRecord_perms =\n                \\<lparr>Permissions_ap = ap, Permissions_xn = xn, Permissions_xxn = xxn, Permissions_pxn = pxn\\<rparr>,\n              TLBRecord_nG = nG, TLBRecord_domain = domain, TLBRecord_contiguous = contiguous,\n              TLBRecord_level = level, TLBRecord_blocksize = blocksize,\n              TLBRecord_descupdate =\n                \\<lparr>DescriptorUpdate_AF = af, DescriptorUpdate_AP = descupd_ap,\n                 DescriptorUpdate_descaddr = descaddr \\<rparr>,\n              TLBRecord_CnP = cnp,\n              TLBRecord_addrdesc =\n                \\<lparr>AddressDescriptor_fault = fault, AddressDescriptor_memattrs = memattrs,\n                 AddressDescriptor_paddress = \\<lparr>FullAddress_physicaladdress = paddress, FullAddress_NS = ns\\<rparr>,\n                 AddressDescriptor_vaddress = vaddress\\<rparr> \\<rparr>\"\nproof -\n  obtain perms nG domain contiguous level blocksize descupdate cnp addrdesc where\n    \"x = \\<lparr>TLBRecord_perms = perms, TLBRecord_nG = nG, TLBRecord_domain = domain,\n          TLBRecord_contiguous = contiguous, TLBRecord_level = level,\n          TLBRecord_blocksize = blocksize, TLBRecord_descupdate = descupdate,\n          TLBRecord_CnP = cnp, TLBRecord_addrdesc = addrdesc \\<rparr>\"\n    by (cases x)\n  moreover obtain ap xn xxn pxn where\n    \"perms = \\<lparr>Permissions_ap = ap, Permissions_xn = xn, Permissions_xxn = xxn, Permissions_pxn = pxn\\<rparr>\"\n    by (cases perms)\n  moreover obtain af descupd_ap descaddr where\n    \"descupdate = \\<lparr>DescriptorUpdate_AF = af, DescriptorUpdate_AP = descupd_ap,\n                   DescriptorUpdate_descaddr = descaddr \\<rparr>\"\n    by (cases descupdate)\n  moreover obtain fault memattrs paddress' vaddress where\n    \"addrdesc = \\<lparr>AddressDescriptor_fault = fault, AddressDescriptor_memattrs = memattrs,\n                  AddressDescriptor_paddress = paddress', AddressDescriptor_vaddress = vaddress\\<rparr>\"\n    by (cases addrdesc)\n  moreover obtain paddress ns where\n    \"paddress' = \\<lparr>FullAddress_physicaladdress = paddress, FullAddress_NS = ns\\<rparr>\"\n    by (cases paddress')\n  ultimately show thesis using that by blast\nqed\n\nlemma PrePostE_bindS_TLBRecord:\n  assumes f:\n    \"\\<And>ap xn xxn pxn nG domain contiguous level blocksize af descupd_ap descaddr cnp fault memattrs paddress ns vaddress.\n        PrePostE (P' ap xn xxn pxn nG domain contiguous level blocksize af descupd_ap descaddr\n                     cnp fault memattrs paddress ns vaddress)\n                 (f (\\<lparr>TLBRecord_perms =\n                        \\<lparr>Permissions_ap = ap, Permissions_xn = xn, Permissions_xxn = xxn, Permissions_pxn = pxn\\<rparr>,\n                      TLBRecord_nG = nG, TLBRecord_domain = domain, TLBRecord_contiguous = contiguous,\n                      TLBRecord_level = level, TLBRecord_blocksize = blocksize,\n                      TLBRecord_descupdate =\n                        \\<lparr>DescriptorUpdate_AF = af, DescriptorUpdate_AP = descupd_ap,\n                         DescriptorUpdate_descaddr = descaddr \\<rparr>,\n                      TLBRecord_CnP = cnp,\n                      TLBRecord_addrdesc =\n                        \\<lparr>AddressDescriptor_fault = fault, AddressDescriptor_memattrs = memattrs,\n                         AddressDescriptor_paddress =\n                            \\<lparr>FullAddress_physicaladdress = paddress,\n                             FullAddress_NS = ns\\<rparr>,\n                         AddressDescriptor_vaddress = vaddress\\<rparr> \\<rparr>)) Q E\"\n    and m: \"PrePostE P m\n                     (\\<lambda>r s. \\<forall>ap xn xxn pxn nG domain contiguous level blocksize af descupd_ap descaddr\n                             cnp fault memattrs paddress ns vaddress.\n                          \\<lparr>TLBRecord_perms =\n                             \\<lparr>Permissions_ap = ap, Permissions_xn = xn, Permissions_xxn = xxn, Permissions_pxn = pxn\\<rparr>,\n                           TLBRecord_nG = nG, TLBRecord_domain = domain, TLBRecord_contiguous = contiguous,\n                           TLBRecord_level = level, TLBRecord_blocksize = blocksize,\n                           TLBRecord_descupdate =\n                             \\<lparr>DescriptorUpdate_AF = af, DescriptorUpdate_AP = descupd_ap,\n                              DescriptorUpdate_descaddr = descaddr \\<rparr>,\n                           TLBRecord_CnP = cnp,\n                           TLBRecord_addrdesc =\n                             \\<lparr>AddressDescriptor_fault = fault, AddressDescriptor_memattrs = memattrs,\n                              AddressDescriptor_paddress =\n                                 \\<lparr>FullAddress_physicaladdress = paddress,\n                                  FullAddress_NS = ns\\<rparr>,\n                              AddressDescriptor_vaddress = vaddress\\<rparr> \\<rparr> = r \\<longrightarrow>\n                          P' ap xn xxn pxn nG domain contiguous level blocksize af descupd_ap descaddr\n                             cnp fault memattrs paddress ns vaddress s) E\"\n        (is \"PrePostE P m ?R E\")\n  shows \"PrePostE P (bindS m f) Q E\"\nproof (intro PrePostE_bindS_any)\n  fix a\n  show \"PrePostE (?R a) (f a) Q E\"\n    by (cases a rule: TLBRecord_cases) (auto intro: f)\n  show \"PrePostE P m ?R E\" using m .\nqed\n\nlemma PrePostE_bindS_prod15_TLBRecord14:\n  assumes\n    \"\\<And>x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x15 ap xn xxn pxn nG domain contiguous level\n      blocksize af descupd_ap descaddr cnp fault memattrs paddress ns vaddress.\n       PrePostE (P' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 ap xn xxn pxn nG domain contiguous level\n                    blocksize af descupd_ap descaddr cnp fault memattrs paddress ns vaddress x15)\n                (f (x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13,\n                    \\<lparr>TLBRecord_perms =\n                      \\<lparr>Permissions_ap = ap, Permissions_xn = xn, Permissions_xxn = xxn, Permissions_pxn = pxn\\<rparr>,\n                     TLBRecord_nG = nG, TLBRecord_domain = domain, TLBRecord_contiguous = contiguous,\n                     TLBRecord_level = level, TLBRecord_blocksize = blocksize,\n                     TLBRecord_descupdate =\n                       \\<lparr>DescriptorUpdate_AF = af, DescriptorUpdate_AP = descupd_ap,\n                        DescriptorUpdate_descaddr = descaddr \\<rparr>,\n                     TLBRecord_CnP = cnp,\n                     TLBRecord_addrdesc =\n                       \\<lparr>AddressDescriptor_fault = fault, AddressDescriptor_memattrs = memattrs,\n                        AddressDescriptor_paddress =\n                           \\<lparr>FullAddress_physicaladdress = paddress, FullAddress_NS = ns\\<rparr>,\n                        AddressDescriptor_vaddress = vaddress\\<rparr> \\<rparr>, x15)) Q E\"\n    and \"PrePostE P m\n                  (\\<lambda>r s. case r of (x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15) \\<Rightarrow>\n                         (\\<forall>ap xn xxn pxn nG domain contiguous level blocksize af descupd_ap\n                           descaddr cnp fault memattrs paddress ns vaddress.\n                         (\\<lparr>TLBRecord_perms =\n                             \\<lparr>Permissions_ap = ap, Permissions_xn = xn, Permissions_xxn = xxn,\n                              Permissions_pxn = pxn\\<rparr>,\n                           TLBRecord_nG = nG, TLBRecord_domain = domain, TLBRecord_contiguous = contiguous,\n                           TLBRecord_level = level, TLBRecord_blocksize = blocksize,\n                           TLBRecord_descupdate =\n                             \\<lparr>DescriptorUpdate_AF = af, DescriptorUpdate_AP = descupd_ap,\n                              DescriptorUpdate_descaddr = descaddr \\<rparr>,\n                           TLBRecord_CnP = cnp,\n                           TLBRecord_addrdesc =\n                             \\<lparr>AddressDescriptor_fault = fault, AddressDescriptor_memattrs = memattrs,\n                              AddressDescriptor_paddress =\n                                 \\<lparr>FullAddress_physicaladdress = paddress, FullAddress_NS = ns\\<rparr>,\n                              AddressDescriptor_vaddress = vaddress\\<rparr> \\<rparr>) = x14 \\<longrightarrow>\n                          P' x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 ap xn xxn pxn nG domain\n                             contiguous level blocksize af descupd_ap descaddr cnp fault memattrs\n                             paddress ns vaddress x15 s)) E\"\n    (is \"PrePostE P m ?R E\")\n  shows \"PrePostE P (bindS m f) Q E\"\nproof (intro PrePostE_bindS_any)\n  fix a :: \"'a \\<times> 'b \\<times> 'c \\<times> 'd \\<times> 'e \\<times> 'f \\<times> 'g \\<times> 'h \\<times> 'i \\<times> 'j \\<times> 'k \\<times> 'l \\<times> 'm \\<times> TLBRecord \\<times> 'n\"\n  obtain x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15\n    where \"a = (x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15)\"\n    by (cases a rule: prod15_cases)\n  then show \"PrePostE (?R a) (f a) Q E\"\n    by (cases x14 rule: TLBRecord_cases) (auto intro: assms)\n  show \"PrePostE P m ?R E\" using assms(2) .\nqed\n\nlemmas PrePostE_bindS_TLBRecords = PrePostE_bindS_TLBRecord PrePostE_bindS_prod15_TLBRecord14\n\nlemma option_case_prod_9_None_False_elim:\n  assumes \"case x of None \\<Rightarrow> False\n             | Some (x1, x2, x3, x4, x5, x6, x7, x8, x9) \\<Rightarrow> P x1 x2 x3 x4 x5 x6 x7 x8 x9\"\n  obtains x1 x2 x3 x4 x5 x6 x7 x8 x9\n  where \"Some (x1, x2, x3, x4, x5, x6, x7, x8, x9) = x\"\n    and \"P x1 x2 x3 x4 x5 x6 x7 x8 x9\"\n  using assms by (cases x) auto\n\nlemma GetSlice_int_get_slice_int[simp]:\n  \"GetSlice_int (len :: 'a::len itself) n i = get_slice_int (int LENGTH('a)) n i\"\n  by (auto simp: GetSlice_int_def)\n\nlemmas [simp] = ex_int_def ex_nat_def\n\ndeclare extzv_def[simp]\n\nlemma slice_mask_mask: \"slice_mask outlen i l = (mask (nat l)) << (nat i)\"\n  by (auto simp: slice_mask_def mask_def)\n\nlemma HasArchVersion_True: \"HasArchVersion v = True\"\n  by (cases v; auto simp: HasArchVersion_def)\n\nlemma HaveEL_True: \"HaveEL el = True\"\n  by (auto simp: HaveEL_def)\n\nlemmas Have_simps[simp] = HaveEL_True HasArchVersion_True Have52BitPAExt_def Have52BitVAExt_def\n  HaveAccessFlagUpdateExt_def HaveAtomicExt_def HaveCommonNotPrivateTransExt_def\n  HaveDirtyBitModifierExt_def HaveExtendedExecuteNeverExt_def HaveFJCVTZSExt_def HaveNVExt_def\n  HavePACExt_def HavePANExt_def HavePrivATExt_def HaveStatisticalProfiling_def\n  HaveTrapLoadStoreMultipleDeviceExt_def HaveUAOExt_def HaveVirtHostExt_def HaveRASExt_def\n  HaveCRCExt_def AArch64_HaveHPDExt_def\n\nlemma PAMax_simp: \"PAMax () = 52\" by (auto simp: PAMax_def IMPDEF_integer_def)\n\nlemma Zeros__0_0[simp]: \"Zeros__0 n = 0\" by (auto simp: Zeros__0_def)\nlemma IsZero_iff_eq0[simp]: \"IsZero w \\<longleftrightarrow> w = 0\" by (auto simp: IsZero_def Zeros__0_def)\n\nlemma ZeroExtend_simps[simp]:\n  \"\\<And>N w. LENGTH('a) \\<le> LENGTH('b) \\<Longrightarrow> ZeroExtend__0 w N = return (ucast (w :: 'a::len word) :: 'b::len word)\"\n  \"\\<And>N w. LENGTH('c) \\<le> LENGTH('d) \\<Longrightarrow> ZeroExtend__1 N w = return (ucast (w :: 'c::len word) :: 'd::len word)\"\n  by (auto simp: ZeroExtend__1_def ZeroExtend__0_def)\n\nlemma ZeroExtend__1_64_64_return: \"ZeroExtend__1 64 (w :: 64 word) = return w\"\n  by auto\n\nlemma undefined_bitvector_simp[simp]: \"undefined_bitvector n = return 0\"\n  by (auto simp add: undefined_bitvector_def simp del: repeat.simps)\n\nlemma hex_slice_13000000[simp]: \"hex_slice ''0x13000000'' 52 0 = return (0x13000000 :: 52 word)\"\n  by (auto simp: hex_slice_def hexstring_to_bools_def hexchar_to_bool_list_def ext_list_def maybe_fail_def\n                 subrange_list_def subrange_list_dec_def subrange_list_inc_def split_at_def)\n\ndefinition aligned :: \"'n::len word \\<Rightarrow> int \\<Rightarrow> bool\" where\n  \"aligned w n \\<equiv> n dvd uint w\"\n\nlemma aligned_8_mask_3: \"aligned w 8 \\<longleftrightarrow> (w AND mask 3) = 0\"\n  using and_mask_dvd[where n = 3]\n  by (auto simp: aligned_def)\n\nlemma aligned8_OR_distrib: \"aligned (x OR y) 8 \\<longleftrightarrow> aligned x 8 \\<and> aligned y 8\"\n  by (auto simp: aligned_8_mask_3 word_bool_alg.conj_disj_distrib2)\n\nlemma aligned8_ucast:\n  fixes a :: \"'a::len word\"\n  defines \"b \\<equiv> ucast a :: 'b::len word\"\n  assumes b: \"3 \\<le> LENGTH('b)\"\n  shows \"aligned b 8 \\<longleftrightarrow> aligned a 8\"\n  using b test_bit_size[of b] unfolding b_def\n  by (auto simp: aligned_8_mask_3 word_and_mask_0_iff_not_testbits nth_ucast)\n\nlemma aligned8_shiftl_3: \"i \\<ge> 3 \\<Longrightarrow> aligned (x << i) 8\"\n  by (auto simp: aligned_8_mask_3 word_and_mask_0_iff_not_testbits nth_shiftl)\n\nlemma aligned8_word_cat:\n  fixes a :: \"'a::len word\" and b :: \"'b::len word\"\n  defines \"c \\<equiv> word_cat a b :: 'c::len word\"\n  assumes b: \"3 \\<le> LENGTH('b)\" and c: \"LENGTH('b) \\<le> LENGTH('c)\"\n  shows \"aligned c 8 \\<longleftrightarrow> aligned b 8\"\n  using b c unfolding c_def\n  by (auto simp: word_cat_shiftl_OR aligned8_OR_distrib aligned8_shiftl_3 aligned8_ucast)\n\nlemma slice_zeros_concat_slice_and_mask[simp]:\n  fixes xs :: \"'a::len word\"\n  shows \"slice_zeros_concat outlen xs i l l' = (Word.slice (nat i) xs AND mask (nat l)) << nat l'\"\nproof -\n  have \"n - nat l' < LENGTH('a) \\<and> n + nat i - nat l' < LENGTH('a)\"\n    if \"xs !! (n + nat i - nat l')\" for n\n    using that by (auto dest: test_bit_size[of xs])\n  then show ?thesis\n    unfolding slice_zeros_concat_def slice_mask_mask\n    by (intro word_eqI) (auto simp: ucast_shiftr word_ao_nth nth_shiftl nth_slice)\nqed\n\nlemmas aligned8_simps = aligned8_OR_distrib aligned8_shiftl_3 aligned8_word_cat aligned8_ucast\n\nlemma place_slice_grainsize:\n  assumes \"grainsize \\<ge> 0\"\n  shows \"(place_slice 52 (w :: 64 word) grainsize (48 - grainsize) grainsize :: 52 word) =\n         word_cat (0 :: 4 word) ((Word.slice (nat grainsize) w << nat grainsize) :: 48 word)\"\n  using assms\n  by (intro word_eqI)\n     (auto simp: place_slice_def slice_mask_mask nth_shiftl nth_shiftr nth_slice word_ao_nth nth_ucast)\n\nlemma set_slice_of_bl_drop_take:\n  fixes out :: \"'a::len word\" and bs :: \"bool list\"\n  (*defines \"v \\<equiv> of_bl bs :: 'b::len word\"*)\n  assumes \"n \\<ge> 0\" and \"slice_len > 0\" and \"n + slice_len \\<le> int LENGTH('a)\" (*and \"length bs = LENGTH('b)\"*)\n  shows \"set_slice out_len slice_len (out :: 'a::len word) n v =\n           of_bl (take (LENGTH('a) - nat n - nat slice_len) (to_bl out) @\n                  to_bl v @\n                  drop (LENGTH('a) - nat n) (to_bl out))\"\n  using assms unfolding set_slice_def\n  by (auto simp: update_subrange_vec_dec_update_subrange_list_dec update_subrange_list_dec_drop_take nat_add_distrib)\n\nlemma NOT_of_bl[simp]:\n  fixes bs :: \"bool list\"\n  defines \"w \\<equiv> of_bl bs :: 'a::len word\"\n  assumes \"length bs = LENGTH('a)\"\n  shows \"NOT w = of_bl (map Not bs)\"\n  using assms by (intro word_eqI) (auto simp: word_ops_nth_size test_bit_of_bl rev_map)\n\nlemma of_bl_AND_of_bl:\n  assumes \"length l = length r\"\n  shows \"(of_bl l) AND (of_bl r) = of_bl (map2 (\\<and>) l r)\"\n  using assms\n  by (intro word_eqI) (auto simp: word_ops_nth_size test_bit_of_bl map2_def rev_map zip_rev[symmetric])\n\nlemma True_OR_1word_absorb: \"1 OR (w :: 1 word) = 1\"\n  by (intro word_eqI) (auto simp: word_ao_nth)\n\nlemma to_bl_1_1word: \"to_bl (1 :: 1 word) = [True]\"\n  by eval\n\nlemma of_bl_test_bit_1word[simp]: \"of_bl [w !! 0] = (w :: 1 word)\"\n  by (intro word_eqI) (auto simp: test_bit_of_bl)\n\nlemma all_bool_neq_or_iff: \"(\\<forall>b. x = (\\<not>b) \\<or> P b) = P x\"\n  by (cases x) (auto simp: all_bool_eq)\n\nlemma arg_cong5:\n  assumes \"a = a'\" and \"b = b'\" and \"c = c'\" and \"d = d'\" and \"e = e'\"\n  shows \"f a b c d e = f a' b' c' d' e'\"\n  using assms by auto\n\nlemma Suc_Suc_0_eq_2: \"Suc (Suc 0) = 2\"\n  by auto\n\nlemma nth_rev_drop: \"i < length xs - n \\<Longrightarrow> rev (drop n xs) ! i = rev xs ! i\"\n  by (auto simp: rev_drop)\n\nlemma nth_rev_to_bl:\n  fixes w :: \"'a::len word\"\n  assumes \"i < LENGTH('a)\"\n  shows \"rev (to_bl w) ! i = w !! i\"\n  using assms by (auto simp: test_bit_bl)\n\nlemma Let_const[simp]: \"(let x = y in f) = f\"\n  by auto\n\nlemma word_slice_if_distrib: \"(Word.slice n (if c then x else y) = z) \\<longleftrightarrow> (if c then Word.slice n x = z else Word.slice n y = z)\"\n  by auto\n\n\n\nlemma word4_and3_exhaust:\n  fixes x :: \"4 word\"\n  shows \"x AND 3 = 0 \\<longrightarrow> x = 0 \\<or> x = 4 \\<or> x = 8 \\<or> x = 12\"\n  by (cases x rule: exhaustive_4_word) auto\n\nlemma word4_and3_exhaust':\n  fixes x :: \"4 word\"\n  assumes \"x AND 3 = 0\" and \"x \\<noteq> 0\" and \"x \\<noteq> 4\" and \"x \\<noteq> 8\"\n  shows \"x = 12\"\n  using assms by (cases x rule: exhaustive_4_word) auto\n\nlemma [simp]:\n  \"bitU_of_bool b = B0 \\<longleftrightarrow> \\<not>b\"\n  \"bitU_of_bool b = B1 \\<longleftrightarrow> b\"\n  by (auto simp: bitU_of_bool_def)\n\nlemma word1_OR_of_bl_disj[simp]:\n  fixes w :: \"1 word\"\n  shows \"w OR of_bl [b] = of_bl [w !! 0 \\<or> b]\" and \"of_bl [b] OR w = of_bl [b \\<or> w !! 0]\"\n  by (intro word_eqI; auto simp: word_ao_nth test_bit_of_bl)+\n\nlemma nat_lt_2_cases:\n  fixes n :: nat\n  assumes \"n < 2\" and \"P 0\" and \"P 1\"\n  shows \"P n\"\n  using assms by (cases n) auto\n\nlemma word2_OR_of_bl_disj[simp]:\n  fixes w :: \"2 word\"\n  shows \"w OR of_bl [b1, b0] = of_bl [w !! 1 \\<or> b1, w !! 0 \\<or> b0]\"\n    and \"of_bl [b1, b0] OR w = of_bl [b1 \\<or> w !! 1, b0 \\<or> w !! 0]\"\n  by (intro word_eqI; auto elim!: nat_lt_2_cases simp: word_ao_nth test_bit_of_bl)+\n\nlemma word2_of_bl_test_bits_eq[simp]:\n  \"of_bl [w !! Suc 0, w !! 0] = (w :: 2 word)\"\n  by (intro word_eqI; auto elim!: nat_lt_2_cases simp: test_bit_of_bl)\n\nlemma set_slice_2_1_of_bl[simp]:\n  \"set_slice 2 1 (out :: 2 word) 1 (v :: 1 word) = of_bl [v !! 0, out !! 0]\"\n  \"set_slice 2 1 (out :: 2 word) 0 (v :: 1 word) = of_bl [out !! 1, v !! 0]\"\n  by (intro word_eqI;\n      auto simp: set_slice_def update_subrange_vec_dec_update_subrange_list_dec\n                 update_subrange_list_dec_drop_take test_bit_of_bl nth_rev nth_append to_bl_nth\n                 elim!: nat_lt_2_cases)+\n\nlemma case_prod_elims:\n  \"\\<And>Q P z thesis. Q (case z of (a, b, c, d, e, f, g) \\<Rightarrow> P a b c d e f g) \\<Longrightarrow> (\\<And>a b c d e f g. z = (a, b, c, d, e, f, g) \\<Longrightarrow> Q (P a b c d e f g) \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\"\n  \"\\<And>Q P z thesis. Q (case z of (a, b, c, d, e, f) \\<Rightarrow> P a b c d e f) \\<Longrightarrow> (\\<And>a b c d e f. z = (a, b, c, d, e, f) \\<Longrightarrow> Q (P a b c d e f) \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\"\n  \"\\<And>Q P z thesis. Q (case z of (a, b, c, d, e) \\<Rightarrow> P a b c d e) \\<Longrightarrow> (\\<And>a b c d e. z = (a, b, c, d, e) \\<Longrightarrow> Q (P a b c d e) \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\"\n  \"\\<And>Q P z thesis. Q (case z of (a, b, c, d) \\<Rightarrow> P a b c d) \\<Longrightarrow> (\\<And>a b c d. z = (a, b, c, d) \\<Longrightarrow> Q (P a b c d) \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\"\n  \"\\<And>Q P z thesis. Q (case z of (a, b, c) \\<Rightarrow> P a b c) \\<Longrightarrow> (\\<And>a b c. z = (a, b, c) \\<Longrightarrow> Q (P a b c) \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\"\n  \"\\<And>Q P z thesis. Q (case z of (a, b) \\<Rightarrow> P a b) \\<Longrightarrow> (\\<And>a b. z = (a, b) \\<Longrightarrow> Q (P a b) \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\"\n  by auto\n\nlemmas Run_case_prodE = case_prod_elims[where Q = \"\\<lambda>c. Run c t a\" for t a]\n\nlemma set_slice_set_bit[simp]:\n  assumes \"nat i < LENGTH('a)\"\n  shows \"set_slice len 1 (w :: 'a::len word) i (b :: 1 word) = set_bit w (nat i) (b !! 0)\"\n  using assms\n  by (intro word_eqI)\n     (auto simp: set_slice_def test_bit_set_gen update_subrange_vec_dec_def\n                word_update_def Let_def test_bit_of_bl nth_append nth_rev to_bl_nth)\n\nlemma slice_set_bit_below:\n  shows \"m > n \\<Longrightarrow> Word.slice m (set_bit w n x) = Word.slice m w\"\n  by (intro word_eqI) (auto simp: nth_slice test_bit_set_gen)\n\nlemma slice_set_bit_above:\n  fixes w :: \"'a::len word\" and m :: nat\n  defines \"w' \\<equiv> Word.slice m w :: 'b::len word\"\n  assumes \"m + LENGTH('b) < n\"\n  shows \"Word.slice m (set_bit w n x) = w'\"\n  using assms by (intro word_eqI) (auto simp: nth_slice test_bit_set_gen)\n\nlemma set_bit_3_word:\n  fixes w :: \"3 word\"\n  shows \"set_bit w 0 x = of_bl [w !! 2, w !! (Suc 0), x]\"\n        \"set_bit w (Suc 0) x = of_bl [w !! 2, x, w !! 0]\"\n        \"set_bit w 2 x = of_bl [x, w !! (Suc 0), w !! 0]\"\n  by (cases w rule: exhaustive_3_word; cases x; auto)+\n\nlemma case_None_False_exists_Some:\n  \"(case x of None \\<Rightarrow> False | Some y \\<Rightarrow> P y) \\<longleftrightarrow> (\\<exists>y. Some y = x \\<and> P y)\"\n  by (auto split: option.splits)\n\nlemma case_None_Not_exists_Some:\n  \"\\<not>P f1 \\<Longrightarrow> (P (case x of None \\<Rightarrow> f1 | Some y \\<Rightarrow> f2 y)) = (\\<exists>y. Some y = x \\<and> P (f2 y))\"\n  by (auto split: option.splits)\n\nlemma Some_eq_if_Some_None_iff_eq:\n  \"(Some x = (if c then Some y else None)) \\<longleftrightarrow> (c \\<and> x = y)\"\n  by auto\n\nlemma Align__1_8_iff_aligned_8[simp]: \"(w = Align__1 w 8) \\<longleftrightarrow> aligned (w :: 52 word) 8\"\nproof\n  assume \"w = Align__1 w 8\"\n  then have w: \"w = word_of_int (8 * (uint w div 8))\"\n    by (auto simp: Align__1_def Align__0_def of_bl_bin_word_of_int)\n  have 8: \"(8 :: int) dvd 2 ^ 52\" by eval\n  show \"aligned w 8\"\n    using dvd_mod_iff[OF 8]\n    by (subst w) (auto simp: aligned_def uint_word_of_int)\nnext\n  assume \"aligned w 8\"\n  then show \"w = Align__1 w 8\"\n    by (auto simp: Align__1_def Align__0_def aligned_def of_bl_bin_word_of_int)\nqed\n\nend\n", "meta": {"author": "rems-project", "repo": "armv8a-address-translation", "sha": "3ddeec3949ee4a859be1b38b41e93f8d9523970c", "save_path": "github-repos/isabelle/rems-project-armv8a-address-translation", "path": "github-repos/isabelle/rems-project-armv8a-address-translation/armv8a-address-translation-3ddeec3949ee4a859be1b38b41e93f8d9523970c/AArch64_Trivia.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3353218426814197}}
{"text": "           (*-------------------------------------------*\n            |                  DFtick                   |\n            |                                           |\n            |                   June 2007               |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory DFP_DFtick\nimports DFP_Deadlock\nbegin\n\n(*****************************************************************\n\n         1. The most abstract deadlockfree process DFtick\n\n *****************************************************************)\n\ndeclare csp_prefix_ss_def[simp]\n\n(*********************************************************\n                         event\n *********************************************************)\n\n(* typedecl Event    any event *)\n\ndatatype DFtickName = DFtick\n\n(*** Spc ***)\n\nprimrec\n  DFtickfun ::  \"(DFtickName, 'event) pnfun\"\nwhere\n  \"DFtickfun (DFtick) = (! x ->  $(DFtick)) |~| SKIP \"\n(*\ndefs (overloaded)\nSet_DFtickfun_def [simp]: \"PNfun == DFtickfun\"\n*)\n\noverloading Set_DFtickfun == \n  \"PNfun :: (DFtickName, 'event) pnfun\"\nbegin\n  definition \"PNfun :: (DFtickName, 'event) pnfun == DFtickfun\"\nend\n  \ndeclare Set_DFtickfun_def [simp]\n\n(*---------------------------------------------------*\n |                  n-replicted spec                 |\n *---------------------------------------------------*)\n\ndatatype RDFtickName = RDFtick\n\n(*** Spc ***)\n\nprimrec\n  NatDFtick :: \n     \"nat => (RDFtickName, 'event) proc\n          => (RDFtickName, 'event) proc\"\nwhere\n    \"NatDFtick 0 P = P\"\n  | \"NatDFtick (Suc n) P = ((! x -> NatDFtick n P) |~| SKIP) |~| P\"\n\n\nprimrec\n  RDFtickfun :: \n    \"RDFtickName\n         => (RDFtickName, 'event) proc\"\nwhere\n  \"RDFtickfun (RDFtick)\n     = (! x -> (!nat n .. NatDFtick n ($(RDFtick))) |~| SKIP)\"\n(*\ndefs (overloaded)\nSet_RDFtickfun_def [simp]: \"PNfun == RDFtickfun\"\n*)\n\noverloading Set_RDFtickfun == \n  \"PNfun :: (RDFtickName, 'event) pnfun\"\nbegin\n  definition \"PNfun :: (RDFtickName, 'event) pnfun == RDFtickfun\"\nend\n  \ndeclare Set_RDFtickfun_def [simp]\n\n\n(*********************************************************\n              DFtick lemma\n *********************************************************)\n\nlemma guardedfun_DFtick[simp]:\n      \"guardedfun DFtickfun\"\nby (simp add: guardedfun_def, rule allI, induct_tac p, simp_all)\n\nlemma guardedfun_RDFtick[simp]:\n      \"guardedfun RDFtickfun\"\napply (simp add: guardedfun_def)\napply (rule allI)\napply (induct_tac p)\napply (simp)\napply (rule allI)\napply (induct_tac n)\napply (simp_all)\ndone\n\n(* -------------------------------------------------*\n |                                                  |\n |  syntactical approach --> semantical approach    |\n |                                                  |\n * -------------------------------------------------*)\n\n(*** sub ***)\n\nlemma DFtick_is_DeadlockFree:\n  \"(($DFtick) :: (DFtickName, 'event) proc) isDeadlockFree\"\napply (simp add: DeadlockFree_def)\napply (rule allI)\napply (induct_tac s rule: induct_trace)\n\n(* base case *)\napply (simp)\napply (subgoal_tac \n  \"((DFtickfun (DFtick))::(DFtickName, 'event) proc) =F \n   ($(DFtick)::(DFtickName, 'event) proc)\")\napply (simp add: cspF_eqF_semantics)\napply (erule conjE)\napply (rotate_tac 1)\napply (drule sym)\napply (simp)\napply (rotate_tac 1)\napply (drule sym)\napply (simp (no_asm) add: in_failures)\napply (simp add: Evset_def)\napply (force)\n\napply (cspF_unwind)\napply (simp add: CPOmode_or_CMSmode_or_MIXmode)\n\napply (subgoal_tac \n  \"failures (($DFtick)::(DFtickName, 'event) proc) MF = \n   failures ((DFtickfun DFtick)::(DFtickName, 'event) proc) MF\")\napply (simp)\napply (rotate_tac -1)\napply (drule sym)\napply (simp (no_asm) add: in_failures)\napply (intro impI)\napply (simp add: in_failures)\n\napply (subgoal_tac \n  \"(($DFtick)::(DFtickName, 'event) proc) =F\n   ((DFtickfun DFtick)::(DFtickName, 'event) proc)\")\napply (simp add: cspF_eqF_semantics)\napply (cspF_unwind)\napply (simp add: CPOmode_or_CMSmode_or_MIXmode)\ndone\n\n(*** main ***)\n\nlemma DFtick_DeadlockFree:\n  \"($DFtick :: (DFtickName, 'event) proc) <=F P ==> P isDeadlockFree\"\napply (insert DFtick_is_DeadlockFree)\napply (simp add: DeadlockFree_def)\napply (simp add: cspF_refF_semantics)\napply (auto)\ndone\n\n(* -------------------------------------------------*\n |                                                  |\n |  semantical approach --> syntactical approach    |\n |                                                  |\n * -------------------------------------------------*)\n\nlemma traces_included_in_DFtick:\n  \"t :t traces ((FIX DFtickfun) (DFtick)) (fstF o MF)\"\napply (induct_tac t rule: induct_trace)\n\n (* <> *)\n apply (simp)\n\n (* <Tick> *)\n apply (simp add: FIX_def)\n apply (simp add: in_traces)\n apply (rule_tac x=\"Suc 0\" in exI)\n apply (simp add: FIXn_def)\n apply (simp add: Subst_procfun_prod_def)\n apply (simp add: in_traces)\n\n (* <Eva>^^^s *)\n apply (simp add: FIX_def)\n apply (simp add: in_traces)\n apply (erule disjE)\n\n apply (simp)\n apply (rule_tac x=\"Suc 0\" in exI)\n apply (simp add: FIXn_def)\n apply (simp add: Subst_procfun_prod_def)\n apply (simp add: in_traces)\n\n apply (erule exE)\n apply (rule_tac x=\"Suc n\" in exI)\n apply (simp add: FIXn_def)\n apply (simp add: Subst_procfun_prod_def)\n apply (simp add: in_traces)\ndone\n\nlemma failures_included_in_DFtick_lm:\n  \"(X ~= UNIV | Tick : sett t) -->\n   (t,X) :f failures ((FIX DFtickfun) (DFtick)) MF\"\napply (induct_tac t rule: induct_trace)\n\n (* <> *)\napply (simp add: FIX_def)\napply (intro impI)\napply (simp add: in_failures)\napply (rule_tac x=\"Suc 0\" in exI)\napply (simp add: FIXn_def)\napply (simp add: Subst_procfun_prod_def)\napply (simp add: in_failures)\n\napply (case_tac \"EX x. x ~: X\")\napply (elim exE)\napply (case_tac \"x = Tick\")\napply (simp)\napply (simp add: Evset_def)\napply (force)\napply (simp add: not_Tick_to_Ev)\napply (force)\napply (force)\n\n (* <Tick> *)\n apply (simp add: FIX_def)\napply (simp add: in_failures)\napply (rule_tac x=\"Suc 0\" in exI)\napply (simp add: FIXn_def)\napply (simp add: Subst_procfun_prod_def)\napply (simp add: in_failures)\n\n (* <Eva>^^^s *)\napply (intro impI)\n apply (simp add: FIX_def)\napply (simp add: in_failures)\napply (erule exE)\napply (rule_tac x=\"Suc n\" in exI)\napply (simp add: FIXn_def)\napply (simp add: Subst_procfun_prod_def)\napply (simp add: in_failures)\ndone\n\nlemma failures_included_in_DFtick:\n  \"[| X ~= UNIV | Tick : sett t |] ==>\n   (t,X) :f failures ((FIX DFtickfun) (DFtick)) MF\"\nby (simp add: failures_included_in_DFtick_lm)\n\nlemma DeadlockFree_DFtick:\n  \"P isDeadlockFree ==> ($DFtick :: (DFtickName, 'event) proc) <=F P\"\napply (rule cspF_rw_left)\napply (rule cspF_FIX)\nprefer 2\napply (simp)\napply (simp add: CPOmode_or_CMSmode_or_MIXmode)\napply (simp add: cspF_refF_semantics)\n\napply (rule conjI)\n\n(* trace *)\napply (simp add: subdomT_iff)\napply (simp add: traces_included_in_DFtick)\n\n(* failures *)\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (rule failures_included_in_DFtick)\napply (simp add: DeadlockFree_def)\napply (drule_tac x=\"s\" in spec)\napply (auto)\ndone\n\n\n(* -------------------------------------------------*\n |                                                  |\n |  syntactical approach <--> semantical approach   |\n |                                                  |\n * -------------------------------------------------*)\n\ntheorem DeadlockFree_DFtick_ref:\n  \"P isDeadlockFree = (($DFtick:: (DFtickName, 'event) proc) <=F P)\"\napply (rule)\napply (simp add: DeadlockFree_DFtick)\napply (simp add: DFtick_DeadlockFree)\ndone\n\n(*================================================================*\n |                                                                |\n |                   n-replicted DF specification                 |\n |                                                                |\n *================================================================*)\n\n(*******************************************************************\n        relating function between DFtickName and Rep...\n *******************************************************************)\n\n(*** ref1 ***)\n\nprimrec\n  RepDF_to_DF :: \"RDFtickName => \n                 (DFtickName, 'event) proc\"\nwhere\n  \"RepDF_to_DF (RDFtick) = ($DFtick)\"\n\nlemma RDFtick_DFtick_ref1_induct_lm:\n  \"(($DFtick)::(DFtickName, 'event) proc)\n   <=F (NatDFtick n (($RDFtick)::(RDFtickName,'event)proc)) << RepDF_to_DF\"\napply (induct_tac n)\napply (simp_all)\napply (rule cspF_Int_choice_right)\napply (rule cspF_rw_left)\napply (rule cspF_unwind)\napply (simp_all)\napply (simp add: CPOmode_or_CMSmode_or_MIXmode)\napply (simp)\ndone\n\nlemma RDFtick_DFtick_ref1:\n  \"($DFtick :: (DFtickName, 'event) proc) <=F $RDFtick\"\napply (rule cspF_fp_induct_right[of _ _ \"RepDF_to_DF\"])\napply (simp)\napply (simp add: CPOmode_or_CMSmode_or_MIXmode)\napply (simp)\n\napply (induct_tac p)\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_unwind)\napply (simp)\napply (simp add: CPOmode_or_CMSmode_or_MIXmode)\napply (simp)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\n\napply (rule cspF_Rep_int_choice_right)\napply (simp add: RDFtick_DFtick_ref1_induct_lm)\napply (simp)\ndone\n\n(*** ref2 ***)\n\nprimrec\n  DF_to_RepDF :: \"DFtickName => \n                 (RDFtickName, 'event) proc\"\nwhere\n  \"DF_to_RepDF (DFtick) = ($RDFtick)\"\n\nlemma RDFtick_DFtick_ref2:\n  \"$RDFtick <=F ($DFtick :: (DFtickName, 'event) proc)\"\napply (rule cspF_fp_induct_right[of _ _ \"DF_to_RepDF\"])\napply (simp)\napply (simp add: CPOmode_or_CMSmode_or_MIXmode)\napply (simp)\n\napply (induct_tac p)\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_unwind)\napply (simp)\napply (simp add: CPOmode_or_CMSmode_or_MIXmode)\napply (simp)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\n\napply (rule cspF_Rep_int_choice_left)\napply (rule_tac x=\"0\" in exI)\napply (simp)\napply (simp)\ndone\n\n(**************************** =F****************************)\n\nlemma RDFtick_DFtick:\n  \"$RDFtick =F ($DFtick :: (DFtickName, 'event) proc)\"\napply (simp add: cspF_eq_ref_iff)\napply (simp add: RDFtick_DFtick_ref1)\napply (simp add: RDFtick_DFtick_ref2)\ndone\n\n(* ---------------------------------------------------*\n |                                                    |\n |  syntactical approach 2 <--> semantical approach   |\n |                                                    |\n * ---------------------------------------------------*)\n\ntheorem DeadlockFree_RDFtick_ref:\n  \"P isDeadlockFree = (($RDFtick :: (RDFtickName, 'event) proc) <=F P)\"\napply (simp add: DeadlockFree_DFtick_ref)\napply (rule)\napply (rule cspF_rw_left)\napply (rule RDFtick_DFtick)\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule RDFtick_DFtick[THEN cspF_sym])\napply (simp)\ndone\n\n(* ------------------------------------------------------------------ *)\n\ndeclare csp_prefix_ss_def[simp del]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/DFP/DFP_DFtick.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.33530448648772276}}
{"text": "theory Ipassmt\nimports Common_Primitive_Syntax\n        \"../Semantics_Ternary/Primitive_Normalization\"\n        Simple_Firewall.Iface\n        Simple_Firewall.IP_Addr_WordInterval_toString (*for debug pretty-printing*)\n        Automatic_Refinement.Misc (*dependnecy!*)\nbegin\n  hide_const Misc.uncurry\n  hide_fact Misc.uncurry_def\n    \n  text\\<open>A mapping from an interface to its assigned ip addresses in CIDR notation\\<close>\n  type_synonym 'i ipassignment=\"iface \\<rightharpoonup> ('i word \\<times> nat) list\" (*technically, a set*)\n\n\nsubsection\\<open>Sanity checking for an @{typ \"'i ipassignment\"}.\\<close>\n\n  text\\<open>warning if interface map has wildcards\\<close>\n  definition ipassmt_sanity_nowildcards :: \"'i ipassignment \\<Rightarrow> bool\" where\n    \"ipassmt_sanity_nowildcards ipassmt \\<equiv> \\<forall> iface \\<in> dom ipassmt. \\<not> iface_is_wildcard iface\"\n\n    text\\<open>Executable of the @{typ \"'i ipassignment\"} is given as a list.\\<close>\n    \n\n\n  (* use this in all exported code*)\n  (*TODO: generate useful error message in exported code*)\n  definition map_of_ipassmt :: \"(iface \\<times> ('i word \\<times> nat) list) list \\<Rightarrow> iface \\<rightharpoonup> ('i word \\<times> nat) list\" where\n    \"map_of_ipassmt ipassmt = (\n      if\n        distinct (map fst ipassmt) \\<and> ipassmt_sanity_nowildcards (map_of ipassmt)\n      then\n        map_of ipassmt\n      else undefined \\<^cancel>\\<open>undefined_ipassmt_must_be_distinct_and_dont_have_wildcard_interfaces\\<close>)\"\n\n\n  text\\<open>some additional (optional) sanity checks\\<close>\n  \n  text\\<open>sanity check that there are no zone-spanning interfaces\\<close>\n  definition ipassmt_sanity_disjoint :: \"'i::len ipassignment \\<Rightarrow> bool\" where\n    \"ipassmt_sanity_disjoint ipassmt \\<equiv> \\<forall> i1 \\<in> dom ipassmt. \\<forall> i2 \\<in> dom ipassmt. i1 \\<noteq> i2 \\<longrightarrow>\n          ipcidr_union_set (set (the (ipassmt i1))) \\<inter> ipcidr_union_set (set (the (ipassmt i2))) = {}\"\n  \n  lemma[code_unfold]: \"ipassmt_sanity_disjoint (map_of ipassmt) \\<longleftrightarrow>\n    (let Is = fst` set ipassmt in \n      (\\<forall> i1 \\<in> Is. \\<forall> i2 \\<in> Is. i1 \\<noteq> i2 \\<longrightarrow> wordinterval_empty (wordinterval_intersection (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i1))))  (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i2)))))))\"\n    apply(simp add: ipassmt_sanity_disjoint_def Map.dom_map_of_conv_image_fst)\n    apply(simp add: ipcidr_union_set_def)\n    apply(simp add: l2wi)\n    apply(simp add: ipcidr_to_interval_def)\n    using ipset_from_cidr_ipcidr_to_interval by blast\n  \n  \n  text\\<open>Checking that the ipassmt covers the complete ipv4 address space.\\<close>\n  definition ipassmt_sanity_complete :: \"(iface \\<times> ('i::len word \\<times> nat) list) list \\<Rightarrow> bool\" where\n    \"ipassmt_sanity_complete ipassmt \\<equiv> distinct (map fst ipassmt) \\<and> (\\<Union>(ipcidr_union_set ` set ` (ran (map_of ipassmt)))) = UNIV\"\n\n    lemma[code_unfold]: \"ipassmt_sanity_complete ipassmt \\<longleftrightarrow> distinct (map fst ipassmt) \\<and> (let range = map snd ipassmt in \n        wordinterval_eq (wordinterval_Union (map (l2wi \\<circ> (map ipcidr_to_interval)) range)) wordinterval_UNIV\n        )\"\n     apply(cases \"distinct (map fst ipassmt)\")\n      apply(simp add: ipassmt_sanity_complete_def)\n      apply(simp add: Map.ran_distinct)\n      apply(simp add: wordinterval_eq_set_eq wordinterval_Union)\n      apply(simp add: l2wi)\n      apply(simp add: ipcidr_to_interval_def)\n      apply(simp add: ipcidr_union_set_def ipset_from_cidr_ipcidr_to_interval; fail)\n     apply(simp add: ipassmt_sanity_complete_def)\n     done\n\n\n\n    value[code] \"ipassmt_sanity_nowildcards (map_of [(Iface ''eth1.1017'', [(ipv4addr_of_dotdecimal (131,159,14,240), 28)])])\"\n\n  fun collect_ifaces' :: \"'i::len common_primitive rule list \\<Rightarrow> iface list\" where\n    \"collect_ifaces' [] = []\" |\n    \"collect_ifaces' ((Rule m a)#rs) = filter (\\<lambda>iface. iface \\<noteq> ifaceAny) (\n                                      (map (\\<lambda>x. case x of Pos i \\<Rightarrow> i | Neg i \\<Rightarrow> i) (fst (primitive_extractor (is_Iiface, iiface_sel) m))) @\n                                      (map (\\<lambda>x. case x of Pos i \\<Rightarrow> i | Neg i \\<Rightarrow> i) (fst (primitive_extractor (is_Oiface, oiface_sel) m))) @ collect_ifaces' rs)\"\n\n  definition collect_ifaces :: \"'i::len common_primitive rule list \\<Rightarrow> iface list\" where\n    \"collect_ifaces rs \\<equiv> mergesort_remdups (collect_ifaces' rs)\"\n  lemma \"set (collect_ifaces rs) = set (collect_ifaces' rs)\"\n    by(simp add: collect_ifaces_def mergesort_remdups_correct)\n\n  text\\<open>sanity check that all interfaces mentioned in the ruleset are also listed in the ipassmt. May fail for wildcard interfaces in the ruleset.\\<close>\n\n  (*primitive_extractor requires normalized_nnf_primitives*)\n  definition ipassmt_sanity_defined :: \"'i::len common_primitive rule list \\<Rightarrow> 'i ipassignment \\<Rightarrow> bool\" where\n    \"ipassmt_sanity_defined rs ipassmt \\<equiv> \\<forall> iface \\<in> set (collect_ifaces rs). iface \\<in> dom ipassmt\"\n\n    lemma[code]: \"ipassmt_sanity_defined rs ipassmt \\<longleftrightarrow> (\\<forall> iface \\<in> set (collect_ifaces rs). ipassmt iface \\<noteq> None)\"\n      by(simp add: ipassmt_sanity_defined_def Map.domIff)\n  \n    lemma \"ipassmt_sanity_defined [\n         Rule (MatchAnd (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192,168,0,0)) 24))) (Match (IIface (Iface ''eth1.1017'')))) action.Accept,\n         Rule (MatchAnd (Match (Src (IpAddrNetmask (ipv4addr_of_dotdecimal (192,168,0,0)) 24))) (Match (IIface (ifaceAny)))) action.Accept,\n         Rule MatchAny action.Drop]\n             (map_of [(Iface ''eth1.1017'', [(ipv4addr_of_dotdecimal (131,159,14,240), 28)])])\" by eval\n\n\n\n  (*TODO: use and add code equation*)\n  definition ipassmt_ignore_wildcard :: \"'i::len ipassignment \\<Rightarrow> 'i ipassignment\" where\n    \"ipassmt_ignore_wildcard ipassmt \\<equiv> \\<lambda>k. case ipassmt k of None \\<Rightarrow> None \n                                                           | Some ips \\<Rightarrow> if ipcidr_union_set (set ips) = UNIV then None else Some ips\"\n\n  lemma ipassmt_ignore_wildcard_le: \"ipassmt_ignore_wildcard ipassmt \\<subseteq>\\<^sub>m ipassmt\"\n    apply(simp add: ipassmt_ignore_wildcard_def map_le_def)\n    apply(clarify)\n    apply(simp split: option.split_asm if_split_asm)\n    done\n\n  definition ipassmt_ignore_wildcard_list:: \"(iface \\<times> ('i::len word \\<times> nat) list) list \\<Rightarrow> (iface \\<times> ('i word \\<times> nat) list) list\" where\n    \"ipassmt_ignore_wildcard_list ipassmt = filter (\\<lambda>(_,ips).  \\<not> wordinterval_eq (l2wi (map ipcidr_to_interval ips)) wordinterval_UNIV) ipassmt\"\n\n  (*distinct fst ipassmt notwendig?*)\n  lemma \"distinct (map fst ipassmt) \\<Longrightarrow>\n    map_of (ipassmt_ignore_wildcard_list ipassmt) = ipassmt_ignore_wildcard (map_of ipassmt)\"\n      apply(simp add: ipassmt_ignore_wildcard_list_def ipassmt_ignore_wildcard_def)\n      apply(simp add: wordinterval_eq_set_eq)\n      apply(simp add: l2wi)\n      apply(simp add: ipcidr_to_interval_def)\n      apply(simp add: fun_eq_iff)\n      apply(clarify)\n      apply(induction ipassmt)\n       apply(simp; fail)\n      apply(simp)\n      apply(simp split:option.split option.split_asm)\n      apply(simp add: ipcidr_union_set_def ipset_from_cidr_ipcidr_to_interval)\n      apply(simp add: case_prod_unfold)\n      by blast\n      (*apply(safe)\n                       apply(simp_all)\n      by (simp add: rev_image_eqI)*)\n      \n\n  \n  text\\<open>Debug algorithm with human-readable output\\<close>\n  definition debug_ipassmt_generic\n    :: \"('i::len wordinterval \\<Rightarrow> string) \\<Rightarrow>\n          (iface \\<times> ('i word \\<times> nat) list) list \\<Rightarrow> 'i common_primitive rule list \\<Rightarrow> string list\" where\n    \"debug_ipassmt_generic toStr ipassmt rs \\<equiv> let ifaces = (map fst ipassmt) in [\n      ''distinct: '' @ (if distinct ifaces then ''passed'' else ''FAIL!'')\n      , ''ipassmt_sanity_nowildcards: '' @\n          (if ipassmt_sanity_nowildcards (map_of ipassmt)\n           then ''passed'' else ''fail: ''@list_toString iface_sel (filter iface_is_wildcard ifaces))\n      , ''ipassmt_sanity_defined (interfaces defined in the ruleset are also in ipassmt): '' @ \n          (if ipassmt_sanity_defined rs (map_of ipassmt)\n           then ''passed'' else ''fail: ''@list_toString iface_sel [i \\<leftarrow> (collect_ifaces rs). i \\<notin> set ifaces])\n      , ''ipassmt_sanity_disjoint (no zone-spanning interfaces): '' @\n          (if ipassmt_sanity_disjoint (map_of ipassmt)\n           then ''passed'' else ''fail: ''@list_toString (\\<lambda>(i1,i2). ''('' @ iface_sel i1 @ '','' @ iface_sel i2 @ '')'')\n               [(i1,i2) \\<leftarrow> List.product ifaces ifaces. i1 \\<noteq> i2 \\<and>\n                \\<not> wordinterval_empty (wordinterval_intersection\n                                        (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i1))))\n                                        (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i2)))))\n          ])\n      , ''ipassmt_sanity_disjoint excluding UNIV interfaces: '' @\n          (let ipassmt = ipassmt_ignore_wildcard_list ipassmt;\n               ifaces = (map fst ipassmt)\n           in\n          (if ipassmt_sanity_disjoint (map_of ipassmt)\n           then ''passed'' else ''fail: ''@list_toString (\\<lambda>(i1,i2). ''('' @ iface_sel i1 @ '','' @ iface_sel i2 @ '')'')\n               [(i1,i2) \\<leftarrow> List.product ifaces ifaces. i1 \\<noteq> i2 \\<and>\n                \\<not> wordinterval_empty (wordinterval_intersection\n                                        (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i1))))\n                                        (l2wi (map ipcidr_to_interval (the ((map_of ipassmt) i2)))))\n          ]))\n       , ''ipassmt_sanity_complete: '' @ \n          (if ipassmt_sanity_complete ipassmt\n           then ''passed''\n           else ''the following is not covered: '' @ \n            toStr (wordinterval_setminus wordinterval_UNIV (wordinterval_Union (map (l2wi \\<circ> (map ipcidr_to_interval)) (map snd ipassmt)))))\n      , ''ipassmt_sanity_complete excluding UNIV interfaces: '' @\n          (let ipassmt = ipassmt_ignore_wildcard_list ipassmt\n           in\n          (if ipassmt_sanity_complete ipassmt\n           then ''passed''\n           else ''the following is not covered: '' @\n            toStr (wordinterval_setminus wordinterval_UNIV (wordinterval_Union (map (l2wi \\<circ> (map ipcidr_to_interval)) (map snd ipassmt))))))\n      ]\"\n\n  definition \"debug_ipassmt_ipv4 \\<equiv> debug_ipassmt_generic ipv4addr_wordinterval_toString\"\n  definition \"debug_ipassmt_ipv6 \\<equiv> debug_ipassmt_generic ipv6addr_wordinterval_toString\"\n\n\n  lemma dom_ipassmt_ignore_wildcard:\n    \"i\\<in>dom (ipassmt_ignore_wildcard ipassmt) \\<longleftrightarrow> i \\<in> dom ipassmt \\<and> ipcidr_union_set (set (the (ipassmt i))) \\<noteq> UNIV\"\n    apply(simp add: ipassmt_ignore_wildcard_def)\n    apply(rule)\n     apply(clarify)\n     apply(simp split: option.split_asm if_split_asm)\n     apply blast\n    apply(clarify)\n    apply(simp)\n    done\n\n  lemma ipassmt_ignore_wildcard_the:\n    \"ipassmt i = Some ips \\<Longrightarrow> ipcidr_union_set (set ips) \\<noteq> UNIV \\<Longrightarrow> (the (ipassmt_ignore_wildcard ipassmt i)) = ips\"\n    \"ipassmt_ignore_wildcard ipassmt i = Some ips \\<Longrightarrow> the (ipassmt i) = ips\"\n    \"ipassmt_ignore_wildcard ipassmt i = Some ips \\<Longrightarrow> ipcidr_union_set (set ips) \\<noteq> UNIV\"\n    by (simp_all add: ipassmt_ignore_wildcard_def split: option.split_asm if_split_asm)\n    \n\n  lemma ipassmt_sanity_disjoint_ignore_wildcards:\n        \"ipassmt_sanity_disjoint (ipassmt_ignore_wildcard ipassmt) \\<longleftrightarrow>\n         (\\<forall>i1\\<in>dom ipassmt.\n          \\<forall>i2\\<in>dom ipassmt.\n            ipcidr_union_set (set (the (ipassmt i1))) \\<noteq> UNIV \\<and>\n            ipcidr_union_set (set (the (ipassmt i2))) \\<noteq> UNIV \\<and>\n            i1 \\<noteq> i2 \n            \\<longrightarrow> ipcidr_union_set (set (the (ipassmt i1))) \\<inter> ipcidr_union_set (set (the (ipassmt i2))) = {})\"\n    apply(simp add: ipassmt_sanity_disjoint_def)\n    apply(rule)\n     apply(clarify)\n     apply(simp)\n     subgoal for i1 i2 ips1 ips2\n     apply(erule_tac x=i1 in ballE)\n      prefer 2\n      using dom_ipassmt_ignore_wildcard  apply (metis domI option.sel)\n     apply(erule_tac x=i2 in ballE)\n      prefer 2\n      using dom_ipassmt_ignore_wildcard apply (metis domI domIff option.sel)\n     by(simp add: ipassmt_ignore_wildcard_the; fail)\n    apply(clarify)\n    apply(simp)\n    subgoal for i1 i2 ips1 ips2\n    apply(erule_tac x=i1 in ballE)\n     prefer 2\n     using dom_ipassmt_ignore_wildcard apply auto[1]\n    apply(erule_tac x=i2 in ballE)\n     prefer 2\n     using dom_ipassmt_ignore_wildcard apply auto[1]\n    by(simp add: ipassmt_ignore_wildcard_the)\n   done\n\n  text\\<open>Confusing names: @{const ipassmt_sanity_nowildcards} refers to wildcard interfaces.\n       @{const ipassmt_ignore_wildcard} refers to the UNIV ip range.\n\\<close>\n  lemma ipassmt_sanity_nowildcards_ignore_wildcardD:\n    \"ipassmt_sanity_nowildcards ipassmt \\<Longrightarrow> ipassmt_sanity_nowildcards (ipassmt_ignore_wildcard ipassmt)\"\n    by (simp add: dom_ipassmt_ignore_wildcard ipassmt_sanity_nowildcards_def)\n    \n\n lemma ipassmt_disjoint_nonempty_inj:\n     assumes ipassmt_disjoint: \"ipassmt_sanity_disjoint ipassmt\"\n        and ifce: \"ipassmt ifce = Some i_ips\"\n        and a: \"ipcidr_union_set (set i_ips) \\<noteq> {}\"\n        and k: \"ipassmt k = Some i_ips\"\n     shows \"k = ifce\"\n     proof(rule ccontr)\n       assume \"k \\<noteq> ifce\"\n       with ifce k ipassmt_disjoint have \"ipcidr_union_set (set (the (ipassmt k))) \\<inter> ipcidr_union_set (set (the (ipassmt ifce))) = {}\"\n         unfolding ipassmt_sanity_disjoint_def by fastforce\n       thus False using a ifce k by auto \n     qed\n\n  lemma ipassmt_ignore_wildcard_None_Some:\n    \"ipassmt_ignore_wildcard ipassmt ifce = None \\<Longrightarrow> ipassmt ifce = Some ips \\<Longrightarrow> ipcidr_union_set (set ips) = UNIV\"\n    by (metis domI domIff dom_ipassmt_ignore_wildcard option.sel)\n    \n\n (*can this lemma be somehow useful?\n   maybe when rewriting, we can try to rewrite in the ignore_wildcard space and just constrain the the other area?*)\n lemma ipassmt_disjoint_ignore_wildcard_nonempty_inj:\n     assumes ipassmt_disjoint: \"ipassmt_sanity_disjoint (ipassmt_ignore_wildcard ipassmt)\"\n        and ifce: \"ipassmt ifce = Some i_ips\"\n        and a: \"ipcidr_union_set (set i_ips) \\<noteq> {}\"\n        and k: \"(ipassmt_ignore_wildcard ipassmt) k = Some i_ips\"\n     shows \"k = ifce\"\n     proof(rule ccontr)\n       assume \"k \\<noteq> ifce\"\n       show False\n       proof(cases \"(ipassmt_ignore_wildcard ipassmt) ifce\")\n       case (Some i_ips') (*proofs mainly by sledgehammer*)\n         hence \"i_ips' = i_ips\" using ifce ipassmt_ignore_wildcard_the(2) by fastforce\n         hence \"(ipassmt_ignore_wildcard ipassmt) k = Some i_ips\" using Some ifce ipassmt_ignore_wildcard_def k by auto \n         thus False using Some \\<open>i_ips' = i_ips\\<close> \\<open>k \\<noteq> ifce\\<close> a ipassmt_disjoint ipassmt_disjoint_nonempty_inj by blast\n       next\n       case None\n         with ipassmt_ignore_wildcard_None_Some have \"ipcidr_union_set (set i_ips) = UNIV\" using ifce by auto \n         thus False using ipassmt_ignore_wildcard_the(3) k by blast \n       qed\n     qed\n\n lemma ipassmt_disjoint_inj_k: \n     assumes ipassmt_disjoint: \"ipassmt_sanity_disjoint ipassmt\"\n        and ifce: \"ipassmt ifce = Some ips\"\n        and k: \"ipassmt k = Some ips'\"\n        and a: \"p \\<in> ipcidr_union_set (set ips)\"\n        and b: \"p \\<in> ipcidr_union_set (set ips')\"\n     shows \"k = ifce\"\n     proof(rule ccontr)\n       assume \"k \\<noteq> ifce\"\n       with ipassmt_disjoint have\n          \"ipcidr_union_set (set (the (ipassmt k))) \\<inter> ipcidr_union_set (set (the (ipassmt ifce))) = {}\"\n         unfolding ipassmt_sanity_disjoint_def using ifce k by blast\n       hence \"ipcidr_union_set (set ips') \\<inter> ipcidr_union_set (set ips) = {}\" by(simp add: k ifce)\n       thus False using a b by blast\n     qed\n\n (*might also work when we ignore UNIVs in the ipassmt? (not tested)*)\n lemma ipassmt_disjoint_matcheq_iifce_srcip:\n        assumes ipassmt_nowild: \"ipassmt_sanity_nowildcards ipassmt\"\n            and ipassmt_disjoint: \"ipassmt_sanity_disjoint ipassmt\"\n            and ifce: \"ipassmt ifce = Some i_ips\"\n            and p_ifce: \"ipassmt (Iface (p_iiface p)) = Some p_ips \\<and> p_src p \\<in> ipcidr_union_set (set p_ips)\"\n        shows   \"match_iface ifce (p_iiface p) \\<longleftrightarrow> p_src p \\<in> ipcidr_union_set (set i_ips)\"\n    proof\n     assume \"match_iface ifce (p_iiface p)\"\n     thus \"p_src p \\<in> ipcidr_union_set (set i_ips)\"\n       apply(cases \"ifce = Iface (p_iiface p)\")\n        using ifce p_ifce apply force\n       by (metis domI iface.sel iface_is_wildcard_def ifce ipassmt_nowild ipassmt_sanity_nowildcards_def match_iface.elims(2) match_iface_case_nowildcard)\n   next\n     assume a: \"p_src p \\<in> ipcidr_union_set (set i_ips)\"\n     \\<comment> \\<open>basically, we need to reverse the map @{term ipassmt}\\<close>\n\n     from ipassmt_disjoint_nonempty_inj[OF ipassmt_disjoint ifce] a have ipassmt_inj: \"\\<forall>k. ipassmt k = Some i_ips \\<longrightarrow> k = ifce\" by blast\n\n     from ipassmt_disjoint_inj_k[OF ipassmt_disjoint ifce _ a] have ipassmt_inj_k:\n      \"\\<And>k ips'. ipassmt k = Some ips' \\<Longrightarrow> p_src p \\<in> ipcidr_union_set (set ips') \\<Longrightarrow> k = ifce\" by simp\n\n     have ipassmt_inj_p: \"\\<forall>ips'. p_src p \\<in> ipcidr_union_set (set ips') \\<and> (\\<exists>k. ipassmt k = Some ips') \\<longrightarrow> ips' = i_ips\"\n       apply(clarify)\n       apply(rename_tac ips' k)\n       apply(subgoal_tac \"k = ifce\")\n        using ifce apply simp\n       using ipassmt_inj_k by simp\n\n     from p_ifce have \"(Iface (p_iiface p)) = ifce\" using ipassmt_inj_p ipassmt_inj by blast \n\n     thus \"match_iface ifce (p_iiface p)\" using match_iface_refl by blast \n   qed\n\n\n\n  definition ipassmt_generic_ipv4 :: \"(iface \\<times> (32 word \\<times> nat) list) list\" where\n    \"ipassmt_generic_ipv4 = [(Iface ''lo'', [(ipv4addr_of_dotdecimal (127,0,0,0),8)])]\"\n\n  definition ipassmt_generic_ipv6 :: \"(iface \\<times> (128 word \\<times> nat) list) list\" where\n    \"ipassmt_generic_ipv6 = [(Iface ''lo'', [(1,128)])]\" (*::1/128*)\n\n\n\nsubsection\\<open>IP Assignment difference\\<close>\n  text\\<open>Compare two ipassmts. Returns a list of tuples\n    First entry of the tuple: things which are in the left ipassmt but not in the right.\n    Second entry of the tupls: things which are in the right ipassmt but not in the left.\\<close>\n  definition ipassmt_diff\n    :: \"(iface \\<times> ('i::len word \\<times> nat) list) list \\<Rightarrow> (iface \\<times> ('i::len word \\<times> nat) list) list\n        \\<Rightarrow> (iface \\<times> ('i word \\<times> nat) list \\<times> ('i word \\<times> nat) list) list\"\n  where\n  \"ipassmt_diff a b \\<equiv> let\n      t = \\<lambda>s. (case s of None \\<Rightarrow> Empty_WordInterval\n                       | Some s \\<Rightarrow> wordinterval_Union (map ipcidr_tuple_to_wordinterval s));\n      k = \\<lambda>x y d. cidr_split (wordinterval_setminus (t (map_of x d)) (t (map_of y d)))\n    in\n      [(d, (k a b d, k b a d)). d \\<leftarrow> remdups (map fst (a @ b))]\"\n  \n  \n  text\\<open>If an interface is defined in both ipassignments and there is no difference\n       then the two ipassignements describe the same IP range for this interface.\\<close>\n  lemma ipassmt_diff_ifce_equal: \"(ifce, [], []) \\<in> set (ipassmt_diff ipassmt1 ipassmt2)  \\<Longrightarrow>\n         ifce \\<in> dom (map_of ipassmt1) \\<Longrightarrow> ifce \\<in> dom (map_of ipassmt2) \\<Longrightarrow>\n           ipcidr_union_set (set (the ((map_of ipassmt1) ifce))) =\n           ipcidr_union_set (set (the ((map_of ipassmt2) ifce)))\"\n    proof -\n    have cidr_empty: \"[] = cidr_split r \\<Longrightarrow> wordinterval_to_set r = {}\" for r :: \"'a wordinterval\"\n      apply(subst cidr_split_prefix[symmetric])\n      by(simp)\n    show \"(ifce, [], []) \\<in> set (ipassmt_diff ipassmt1 ipassmt2)  \\<Longrightarrow>\n         ifce \\<in> dom (map_of ipassmt1) \\<Longrightarrow> ifce \\<in> dom (map_of ipassmt2) \\<Longrightarrow>\n           ipcidr_union_set (set (the ((map_of ipassmt1) ifce))) =\n           ipcidr_union_set (set (the ((map_of ipassmt2) ifce)))\"\n    apply(simp add: ipassmt_diff_def Let_def ipcidr_union_set_uncurry)\n    apply(simp add: Set.image_iff)\n    apply(elim conjE)\n    apply(drule cidr_empty)+\n    apply(simp)\n    apply(simp add: domIff)\n    apply(elim exE)\n    apply(simp add: wordinterval_Union wordinterval_to_set_ipcidr_tuple_to_wordinterval_uncurry)\n    done\n  qed\n\n  lemma ipcidr_union_cidr_split[simp]: \"ipcidr_union_set (set (cidr_split a)) = wordinterval_to_set a\"\n    by(simp add: ipcidr_union_set_uncurry cidr_split_prefix)\n\n  lemma \n    defines \"assmt as ifce \\<equiv> ipcidr_union_set (set (the ((map_of as ifce))))\"\n    assumes diffs: \"(ifce, d1, d2) \\<in> set (ipassmt_diff ipassmt1 ipassmt2)\"\n        and  doms: \"ifce \\<in> dom (map_of ipassmt1)\" \"ifce \\<in> dom (map_of ipassmt2)\"\n    shows \"ipcidr_union_set (set d1) = assmt ipassmt1 ifce - assmt ipassmt2 ifce\"\n          \"ipcidr_union_set (set d2) = assmt ipassmt2 ifce - assmt ipassmt1 ifce\"\n    using assms by (clarsimp simp add: ipassmt_diff_def Let_def assmt_def wordinterval_Union; simp add: ipcidr_union_set_uncurry uncurry_def wordinterval_to_set_ipcidr_tuple_to_wordinterval_uncurry)+\n            \n  \n  text\\<open>Explanation for interface @{term \"Iface ''a''\"}: \n          Left ipassmt: The IP range 4/30 contains the addresses 4,5,6,7\n          Diff: right ipassmt contains 6/32, so 4,5,7 is only in the left ipassmt.\n          IP addresses 4,5 correspond to subnet 4/30.\\<close>\n  lemma \"ipassmt_diff (ipassmt_generic_ipv4 @ [(Iface ''a'', [(4,30)])])\n                       (ipassmt_generic_ipv4 @ [(Iface ''a'', [(6,32), (0,30)]), (Iface ''b'', [(42,32)])]) =\n    [(Iface ''lo'', [], []),\n     (Iface ''a'', [(4, 31),(7, 32)],\n                   [(0, 30)]\n     ),\n     (Iface ''b'', [], [(42, 32)])]\" by eval\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Iptables_Semantics/Primitive_Matchers/Ipassmt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6654105454764747, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3353044798007169}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* Author: Thomas Sewell *)\n\nsection \"Enumeration Instances for Words\"\n\ntheory Word_Enum\nimports Enumeration Word_Lib\nbegin\n\ninstantiation word :: (len) enum\nbegin\n\ndefinition\n  \"(enum_class.enum :: ('a :: len) word list) \\<equiv> map of_nat [0 ..< 2 ^ LENGTH('a)]\"\n\ndefinition\n  \"enum_class.enum_all (P :: ('a :: len) word \\<Rightarrow> bool) \\<longleftrightarrow> Ball UNIV P\"\n\ndefinition\n  \"enum_class.enum_ex (P :: ('a :: len) word \\<Rightarrow> bool) \\<longleftrightarrow> Bex UNIV P\"\n\ninstance\n  apply (intro_classes)\n     apply (force simp: enum_word_def)\n    apply (simp add: distinct_map enum_word_def)\n    apply (rule subset_inj_on, rule word_unat.Abs_inj_on)\n    apply (clarsimp simp add: unats_def)\n   apply (simp add: enum_all_word_def)\n  apply (simp add: enum_ex_word_def)\n  done\n\nend\n\nlemma fromEnum_unat[simp]: \"fromEnum (x :: 'a::len word) = unat x\"\nproof -\n  have \"enum ! the_index enum x = x\" by (auto intro: nth_the_index)\n  moreover\n  have \"the_index enum x < length (enum::'a::len word list)\" by (auto intro: the_index_bounded)\n  moreover\n  { fix y assume \"of_nat y = x\"\n    moreover assume \"y < 2 ^ LENGTH('a)\"\n    ultimately have \"y = unat x\" using of_nat_inverse by fastforce\n  }\n  ultimately\n  show ?thesis by (simp add: fromEnum_def enum_word_def)\nqed\n\nlemma length_word_enum: \"length (enum :: ('a :: len) word list) = 2 ^ LENGTH('a)\"\n  by (simp add: enum_word_def)\n\nlemma toEnum_of_nat[simp]: \"n < 2 ^ LENGTH('a) \\<Longrightarrow> ((toEnum n) :: ('a :: len) word) = of_nat n\"\n  by (simp add: toEnum_def length_word_enum enum_word_def)\n\ndeclare of_nat_diff [simp]\n\ninstantiation word :: (len) enumeration_both\nbegin\n\ndefinition\n  enum_alt_word_def: \"enum_alt \\<equiv> alt_from_ord (enum :: ('a :: len) word list)\"\n\ninstance\n  by (intro_classes, simp add: enum_alt_word_def)\n\nend\n\ndefinition\n  upto_enum_step :: \"('a :: len) word \\<Rightarrow> 'a word \\<Rightarrow> 'a word \\<Rightarrow> 'a word list\" (\"[_ , _ .e. _]\")\nwhere\n  \"upto_enum_step a b c \\<equiv>\n      if c < a then [] else map (\\<lambda>x. a + x * (b - a)) [0 .e. (c - a) div (b - a)]\"\n  (* in the wraparound case, bad things happen. *)\n\nlemma maxBound_word:\n  \"(maxBound::'a::len word) = -1\"\n  by (simp add: maxBound_def enum_word_def last_map)\n\nlemma minBound_word:\n  \"(minBound::'a::len word) = 0\"\n  by (simp add: minBound_def enum_word_def upt_conv_Cons)\n\nlemma maxBound_max_word:\n  \"(maxBound::'a::len word) = max_word\"\n  by (simp add: maxBound_word max_word_minus [symmetric])\n\n\n\nend\n", "meta": {"author": "Daohub-io", "repo": "cap9-spec", "sha": "de42d102f2054547c1aa0c8d0dc6d9cc2c763181", "save_path": "github-repos/isabelle/Daohub-io-cap9-spec", "path": "github-repos/isabelle/Daohub-io-cap9-spec/cap9-spec-de42d102f2054547c1aa0c8d0dc6d9cc2c763181/Word_Lib/Word_Enum.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.33530070724483146}}
{"text": "theory Lift_Fst_Snd imports Lift_Fst Lift_Snd\nbegin\n\nlocale fst_l_snd_l_ortho' =\n  fixes l1 :: \"('a, 'b1, 'c1 :: Pordb) lifting\"\n  fixes S1 :: \"'a \\<Rightarrow> 'c1 set\"\n  fixes l2 :: \"('a, 'b2, 'c2 :: Pordb) lifting\"\n  fixes S2 :: \"'a \\<Rightarrow> 'c2 set\"\n\nlocale fst_l_snd_l_ortho = fst_l_snd_l_ortho' +\n  in1 : lifting_valid_base_ext l1 S1 +\n  in2 : lifting_valid_base_ext l2 S2\n\nsublocale fst_l_snd_l_ortho \\<subseteq> out : l_ortho \"fst_l l1\" \"fst_l_S S1\" \"snd_l l2\" \"snd_l_S S2\"\nproof\n  fix s\n  show \"LBase (fst_l l1) s = LBase (snd_l l2) s\"\n    using in1.base in2.base\n    by(auto simp add: fst_l_def snd_l_def)\nnext\n  fix b :: \"'c * 'e\"\n  fix s :: 'a\n  fix a1 :: 'b\n  fix a2 :: 'd\n\n  obtain b1 b2 where B: \"b = (b1, b2)\"\n    by(cases b; auto)\n\n  then show \"LUpd (fst_l l1) s a1 (LUpd (snd_l l2) s a2 b) = LUpd (snd_l l2) s a2 (LUpd (fst_l l1) s a1 b)\"\n    by(auto simp add: fst_l_def snd_l_def)\n\nnext\n\n  fix b :: \"'c * 'e\"\n  fix s :: 'a\n  fix a1\n\n  obtain b1 b2 where B: \"b = (b1, b2)\"\n    by(cases b; auto)\n\n  then show \"LOut (snd_l l2) s (LUpd (fst_l l1) s a1 b) = LOut (snd_l l2) s b\"\n    by(auto simp add: fst_l_def snd_l_def)\nnext\n\n  fix b :: \"'c * 'e\"\n  fix s :: 'a\n  fix a2 :: 'd\n\n\n  obtain b1 b2 where B: \"b = (b1, b2)\"\n    by(cases b; auto)\n\n  then show \"LOut (fst_l l1) s (LUpd (snd_l l2) s a2 b) = LOut (fst_l l1) s b\"\n    by(cases b; auto simp add: fst_l_def snd_l_def)\n\n\nnext\n  fix b :: \"'c * 'e\"\n  fix s :: 'a\n  fix a1 :: 'b\n\n  assume Bin : \"b \\<in> snd_l_S S2 s\"\n\n  obtain b1 b2 where B: \"b = (b1, b2)\"\n    by(cases b; auto)\n\n  then show \" LUpd (fst_l l1) s a1 b \\<in> snd_l_S S2 s\" using Bin\n    by(auto simp add: fst_l_def snd_l_S_def)\nnext\n  fix b :: \"'c * 'e\"\n  fix s :: 'a\n  fix a2 :: 'd\n\n  assume Bin: \"b \\<in> fst_l_S S1 s\"\n  obtain b1 b2 where B: \"b = (b1, b2)\"\n    by(cases b; auto)\n\n  then show \"LUpd (snd_l l2) s a2 b \\<in> fst_l_S S1 s\" using Bin\n    by(auto simp add: snd_l_def fst_l_S_def)\nqed\n\nlemma (in fst_l_snd_l_ortho) ax :\n  shows \"l_ortho (fst_l l1) (fst_l_S S1) (snd_l l2) (snd_l_S S2)\"\n  using out.l_ortho_axioms\n  by auto\n\nlemma (in fst_l_snd_l_ortho) ax_g :\n  assumes H1 : \"\\<And> x . S'1 x = fst_l_S S1 x\"\n  assumes H2 : \"\\<And> x . S'2 x = snd_l_S S2 x\"\n  shows \"l_ortho (fst_l l1) S'1 (snd_l l2) S'2\"\nproof-\n  have H1' : \"S'1 = fst_l_S S1\"\n    using H1 by auto\n  have H2' : \"S'2 = snd_l_S S2\"\n    using H2 by auto\n  then show ?thesis using ax unfolding H1' H2'\n    by auto\nqed\n\n(* commutative *)\nlemma (in fst_l_snd_l_ortho) ax_comm :\n  shows \"l_ortho (snd_l l2) (snd_l_S S2) (fst_l l1) (fst_l_S S1)\"\n  using out.comm.l_ortho_axioms\n  by auto\n\nlemma (in fst_l_snd_l_ortho) ax_g_comm :\n  assumes H1 : \"\\<And> x . S'2 x = snd_l_S S2 x\"\n  assumes H2 : \"\\<And> x . S'1 x = fst_l_S S1 x\"\n  shows \"l_ortho (snd_l l2) S'2 (fst_l l1) S'1\"\nproof-\n  have H1' : \"S'2 = snd_l_S S2\"\n    using H1 by auto\n  have H2' : \"S'1 = fst_l_S S1\"\n    using H2 by auto\n  then show ?thesis using ax_comm unfolding H1' H2'\n    by auto\nqed\n\n\nlocale fst_l_snd_l_ortho_ok_ext =\n  fixes l1 :: \"('a, 'b1, 'c1 :: {Pord_Weakb, Okay}) lifting\"\n  fixes l2 :: \"('a, 'b2, 'c2 :: {Pord_Weakb, Okay}) lifting\"\n\nsublocale fst_l_snd_l_ortho_ok_ext \\<subseteq> out : l_ortho_ok_ext \"fst_l l1\" \"snd_l l2\" .\n\nlocale fst_l_snd_l_ortho_base_ext =\n  fst_l_snd_l_ortho' + \n  in1 : lifting_valid_weak_base l1 S1 +\n  in2 : lifting_valid_weak_base l2 S2\n\n\nsublocale fst_l_snd_l_ortho_base_ext \\<subseteq> out : l_ortho_base_ext \"fst_l l1\" \"snd_l l2\"\nproof\n  fix s\n  show \"LBase (fst_l l1) s = \\<bottom>\"\n    using in1.base\n    by(auto simp add: fst_l_def prod_bot)\nnext\n  fix s\n  show \"LBase (snd_l l2) s = \\<bottom>\"\n    using in2.base\n    by(auto simp add: snd_l_def prod_bot)\nqed\n\nlemma (in fst_l_snd_l_ortho_base_ext) ax :\n  shows \"l_ortho_base_ext (fst_l l1) (snd_l l2)\"\n  using out.l_ortho_base_ext_axioms\n  by auto\n\nlemma (in fst_l_snd_l_ortho_base_ext) ax_comm :\n  shows \"l_ortho_base_ext (snd_l l2) (fst_l l1)\"\n  using out.comm.l_ortho_base_ext_axioms\n  by auto\n\n(*\n(* TODO: this was originally lifting_valid_weak_pres, but i think we actually need strength\n * to make this work *)\nlocale fst_l_snd_l_ortho_pres =\n  fst_l_snd_l_ortho +\n  in1 : lifting_valid_pres l1 S1 +\n  in2 : lifting_valid_pres l2 S2\n\nsublocale fst_l_snd_l_ortho_pres \\<subseteq> out : l_ortho_pres \"fst_l l1\" \"fst_l_S S1\" \"snd_l l2\" \"snd_l_S S2\"\nproof\n  fix a1 a2 s\n  fix x :: \"('c * 'e)\"\n\n  obtain x1 x2 where X: \"x = (x1, x2)\"\n    by(cases x; auto)\n\n  have Leq1 : \"x1 <[ LUpd l1 s a1 x1\"\n    using in1.get_put by auto\n\n  have Leq2 : \"x2 <[ LUpd l2 s a2 x2\"\n    using in2.get_put by auto\n\n  show \"is_sup {LUpd (fst_l l1) s a1 x, LUpd (snd_l l2) s a2 x} (LUpd (fst_l l1) s a1 (LUpd (snd_l l2) s a2 x))\"\n  proof(rule is_supI)\n    fix w\n\n    assume W: \"w \\<in> {LUpd (fst_l l1) s a1 x, LUpd (snd_l l2) s a2 x}\"\n\n    obtain w1 w2 where \"w = (w1, w2)\"\n      by(cases w; auto)\n\n    show \"w <[ LUpd (fst_l l1) s a1 (LUpd (snd_l l2) s a2 x)\"\n      using W X Leq1 Leq2\n      by(auto simp add: fst_l_def snd_l_def prod_pleq leq_refl)\n  next\n    fix x'\n    assume Ub : \"is_ub {LUpd (fst_l l1) s a1 x, LUpd (snd_l l2) s a2 x} x'\"\n\n    obtain x'1 x'2 where X': \"x' = (x'1, x'2)\"\n      by(cases x'; auto)\n\n    have Leq1 : \"LUpd (fst_l l1) s a1 x <[ x'\"\n      using is_ubE[OF Ub]\n      by auto\n\n    have Leq2 : \"LUpd (snd_l l2) s a2 x <[ x'\"\n      using is_ubE[OF Ub]\n      by auto\n\n    show \"LUpd (fst_l l1) s a1 (LUpd (snd_l l2) s a2 x) <[ x'\"\n      using X' X Leq1 Leq2\n      by(auto simp add: fst_l_def snd_l_def prod_pleq)\n  qed\nqed\n*)\n\nend\n", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Lifter/Instances/Lift_Fst_Snd.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.3353006991793546}}
{"text": "(* Author: Alexander Maletzky *)\n\nsection \\<open>Ordered Associative Lists for Polynomials\\<close>\n\ntheory OAlist_Poly_Mapping\n  imports PP_Type MPoly_Type_Class_Ordered OAlist\nbegin\n\ntext \\<open>We introduce a dedicated type for ordered associative lists (oalists) representing polynomials.\n  To that end, we require the order relation the oalists are sorted wrt. to be admissible term orders,\n  and furthermore sort the lists @{emph \\<open>descending\\<close>} rather than @{emph \\<open>ascending\\<close>}, because this\n  allows to implement various operations more efficiently.\n  For technical reasons, we must restrict the type of terms to types embeddable into\n  @{typ \"(nat, nat) pp \\<times> nat\"}, though. All types we are interested in meet this requirement.\\<close>\n\nlemma comparator_lexicographic:\n  fixes f::\"'a \\<Rightarrow> 'b\" and g::\"'a \\<Rightarrow> 'c\"\n  assumes \"comparator c1\" and \"comparator c2\" and \"\\<And>x y. f x = f y \\<Longrightarrow> g x = g y \\<Longrightarrow> x = y\"\n  shows \"comparator (\\<lambda>x y. case c1 (f x) (f y) of Eq \\<Rightarrow> c2 (g x) (g y) | val \\<Rightarrow> val)\"\n          (is \"comparator ?c3\")\nproof -\n  from assms(1) interpret c1: comparator c1 .\n  from assms(2) interpret c2: comparator c2 .\n  show ?thesis\n  proof\n    fix x y :: 'a\n    show \"invert_order (?c3 x y) = ?c3 y x\"\n      by (simp add: c1.eq c2.eq split: order.split,\n          metis invert_order.simps(1) invert_order.simps(2) c1.sym c2.sym order.distinct(5))\n  next\n    fix x y :: 'a\n    assume \"?c3 x y = Eq\"\n    hence \"f x = f y\" and \"g x = g y\" by (simp_all add: c1.eq c2.eq split: order.splits if_split_asm)\n    thus \"x = y\" by (rule assms(3))\n  next\n    fix x y z :: 'a\n    assume \"?c3 x y = Lt\"\n    hence d1: \"c1 (f x) (f y) = Lt \\<or> (c1 (f x) (f y) = Eq \\<and> c2 (g x) (g y) = Lt)\"\n      by (simp split: order.splits)\n    assume \"?c3 y z = Lt\"\n    hence d2: \"c1 (f y) (f z) = Lt \\<or> (c1 (f y) (f z) = Eq \\<and> c2 (g y) (g z) = Lt)\"\n      by (simp split: order.splits)\n    from d1 show \"?c3 x z = Lt\"\n    proof\n      assume 1: \"c1 (f x) (f y) = Lt\"\n      from d2 show ?thesis\n      proof\n        assume \"c1 (f y) (f z) = Lt\"\n        with 1 have \"c1 (f x) (f z) = Lt\" by (rule c1.trans)\n        thus ?thesis by simp\n      next\n        assume \"c1 (f y) (f z) = Eq \\<and> c2 (g y) (g z) = Lt\"\n        hence \"f z = f y\" and \"c2 (g y) (g z) = Lt\" by (simp_all add: c1.eq)\n        with 1 show ?thesis by simp\n      qed\n    next\n      assume \"c1 (f x) (f y) = Eq \\<and> c2 (g x) (g y) = Lt\"\n      hence 1: \"f x = f y\" and 2: \"c2 (g x) (g y) = Lt\" by (simp_all add: c1.eq)\n      from d2 show ?thesis\n      proof\n        assume \"c1 (f y) (f z) = Lt\"\n        thus ?thesis by (simp add: 1)\n      next\n        assume \"c1 (f y) (f z) = Eq \\<and> c2 (g y) (g z) = Lt\"\n        hence 3: \"f y = f z\" and \"c2 (g y) (g z) = Lt\" by (simp_all add: c1.eq)\n        from 2 this(2) have \"c2 (g x) (g z) = Lt\" by (rule c2.trans)\n        thus ?thesis by (simp add: 1 3)\n      qed\n    qed\n  qed\nqed\n\nclass nat_term =\n  fixes rep_nat_term :: \"'a \\<Rightarrow> ((nat, nat) pp \\<times> nat)\"\n    and splus :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  assumes rep_nat_term_inj: \"rep_nat_term x = rep_nat_term y \\<Longrightarrow> x = y\"\n    and full_component: \"snd (rep_nat_term x) = i \\<Longrightarrow> (\\<exists>y. rep_nat_term y = (t, i))\"\n    and splus_term: \"rep_nat_term (splus x y) = pprod.splus (fst (rep_nat_term x)) (rep_nat_term y)\"\nbegin\n\ndefinition \"lex_comp_aux = (\\<lambda>x y. case comp_of_ord lex_pp (fst (rep_nat_term x)) (fst (rep_nat_term y)) of\n                                      Eq \\<Rightarrow> comparator_of (snd (rep_nat_term x)) (snd (rep_nat_term y)) | val \\<Rightarrow> val)\"\n\nlemma full_componentE:\n  assumes \"snd (rep_nat_term x) = i\"\n  obtains y where \"rep_nat_term y = (t, i)\"\nproof -\n  from assms have \"\\<exists>y. rep_nat_term y = (t, i)\" by (rule full_component)\n  then obtain y where \"rep_nat_term y = (t, i)\" ..\n  thus ?thesis ..\nqed\n\nend\n\nclass nat_pp_term = nat_term + zero + plus +\n  assumes rep_nat_term_zero: \"rep_nat_term 0 = (0, 0)\"\n    and splus_pp_term: \"splus = (+)\"\n\ndefinition nat_term_comp :: \"'a::nat_term comparator \\<Rightarrow> bool\"\n  where \"nat_term_comp cmp \\<longleftrightarrow>\n              (\\<forall>u v. snd (rep_nat_term u) = snd (rep_nat_term v) \\<longrightarrow> fst (rep_nat_term u) = 0 \\<longrightarrow> cmp u v \\<noteq> Gt) \\<and>\n              (\\<forall>u v. fst (rep_nat_term u) = fst (rep_nat_term v) \\<longrightarrow> snd (rep_nat_term u) < snd (rep_nat_term v) \\<longrightarrow> cmp u v = Lt) \\<and>\n              (\\<forall>t u v. cmp u v = Lt \\<longrightarrow> cmp (splus t u) (splus t v) = Lt) \\<and>\n              (\\<forall>u v a b. fst (rep_nat_term u) = fst (rep_nat_term a) \\<longrightarrow> fst (rep_nat_term v) = fst (rep_nat_term b) \\<longrightarrow>\n                  snd (rep_nat_term u) = snd (rep_nat_term v) \\<longrightarrow> snd (rep_nat_term a) = snd (rep_nat_term b) \\<longrightarrow>\n                  cmp a b = Lt \\<longrightarrow> cmp u v = Lt)\"\n\nlemma nat_term_compI:\n  assumes \"\\<And>u v. snd (rep_nat_term u) = snd (rep_nat_term v) \\<Longrightarrow> fst (rep_nat_term u) = 0 \\<Longrightarrow> cmp u v \\<noteq> Gt\"\n    and \"\\<And>u v. fst (rep_nat_term u) = fst (rep_nat_term v) \\<Longrightarrow> snd (rep_nat_term u) < snd (rep_nat_term v) \\<Longrightarrow> cmp u v = Lt\"\n    and \"\\<And>t u v. cmp u v = Lt \\<Longrightarrow> cmp (splus t u) (splus t v) = Lt\"\n    and \"\\<And>u v a b. fst (rep_nat_term u) = fst (rep_nat_term a) \\<Longrightarrow> fst (rep_nat_term v) = fst (rep_nat_term b) \\<Longrightarrow>\n                  snd (rep_nat_term u) = snd (rep_nat_term v) \\<Longrightarrow> snd (rep_nat_term a) = snd (rep_nat_term b) \\<Longrightarrow>\n                  cmp a b = Lt \\<Longrightarrow> cmp u v = Lt\"\n  shows \"nat_term_comp cmp\"\n  unfolding nat_term_comp_def fst_conv snd_conv using assms by blast\n\nlemma nat_term_compD1:\n  assumes \"nat_term_comp cmp\" and \"snd (rep_nat_term u) = snd (rep_nat_term v)\" and \"fst (rep_nat_term u) = 0\"\n  shows \"cmp u v \\<noteq> Gt\"\n  using assms unfolding nat_term_comp_def fst_conv by blast\n\nlemma nat_term_compD2:\n  assumes \"nat_term_comp cmp\" and \"fst (rep_nat_term u) = fst (rep_nat_term v)\" and \"snd (rep_nat_term u) < snd (rep_nat_term v)\"\n  shows \"cmp u v = Lt\"\n  using assms unfolding nat_term_comp_def fst_conv snd_conv by blast\n\nlemma nat_term_compD3:\n  assumes \"nat_term_comp cmp\" and \"cmp u v = Lt\"\n  shows \"cmp (splus t u) (splus t v) = Lt\"\n  using assms unfolding nat_term_comp_def snd_conv by blast\n\nlemma nat_term_compD4:\n  assumes \"nat_term_comp cmp\" and \"fst (rep_nat_term u) = fst (rep_nat_term a)\"\n    and \"fst (rep_nat_term v) = fst (rep_nat_term b)\" and \"snd (rep_nat_term u) = snd (rep_nat_term v)\"\n    and \"snd (rep_nat_term a) = snd (rep_nat_term b)\" and \"cmp a b = Lt\"\n  shows \"cmp u v = Lt\"\n  using assms unfolding nat_term_comp_def snd_conv by blast\n\nlemma nat_term_compD1':\n  assumes \"comparator cmp\" and \"nat_term_comp cmp\" and \"snd (rep_nat_term u) \\<le> snd (rep_nat_term v)\"\n    and \"fst (rep_nat_term u) = 0\"\n  shows \"cmp u v \\<noteq> Gt\"\nproof (cases \"snd (rep_nat_term u) = snd (rep_nat_term v)\")\n  case True\n  with assms(2) show ?thesis using assms(4) by (rule nat_term_compD1)\nnext\n  from assms(1) interpret cmp: comparator cmp .\n  case False\n  with assms(3) have a: \"snd (rep_nat_term u) < snd (rep_nat_term v)\" by simp\n  from refl obtain w::'a where eq: \"rep_nat_term w = (0, snd (rep_nat_term v))\" by (rule full_componentE)\n  have \"cmp u w = Lt\" by (rule nat_term_compD2, fact assms(2), simp_all add: eq assms(4) a)\n  moreover have \"cmp w v \\<noteq> Gt\" by (rule nat_term_compD1, fact assms(2), simp_all add: eq)\n  ultimately show \"cmp u v \\<noteq> Gt\" by (simp add: cmp.nGt_le_conv cmp.Lt_lt_conv)\nqed\n\nlemma nat_term_compD4':\n  assumes \"comparator cmp\" and \"nat_term_comp cmp\" and \"fst (rep_nat_term u) = fst (rep_nat_term a)\"\n    and \"fst (rep_nat_term v) = fst (rep_nat_term b)\" and \"snd (rep_nat_term u) = snd (rep_nat_term v)\"\n    and \"snd (rep_nat_term a) = snd (rep_nat_term b)\"\n  shows \"cmp u v = cmp a b\"\nproof -\n  from assms(1) interpret cmp: comparator cmp .\n  show ?thesis\n  proof (cases \"cmp a b\")\n    case Eq\n    hence \"fst (rep_nat_term u) = fst (rep_nat_term v)\" by (simp add: cmp.eq assms(3, 4))\n    hence \"rep_nat_term u = rep_nat_term v\" using assms(5) by (rule prod_eqI)\n    hence \"u = v\" by (rule rep_nat_term_inj)\n    thus ?thesis by (simp add: Eq)\n  next\n    case Lt\n    with assms(2, 3, 4, 5, 6) have \"cmp u v = Lt\" by (rule nat_term_compD4)\n    thus ?thesis by (simp add: Lt)\n  next\n    case Gt\n    hence \"cmp b a = Lt\" by (simp only: cmp.Gt_lt_conv cmp.Lt_lt_conv)\n    with assms(2, 4, 3) assms(5, 6)[symmetric] have \"cmp v u = Lt\" by (rule nat_term_compD4)\n    hence \"cmp u v = Gt\" by (simp only: cmp.Gt_lt_conv cmp.Lt_lt_conv)\n    thus ?thesis by (simp add: Gt)\n  qed\nqed\n\nlemma nat_term_compD4'':\n  assumes \"comparator cmp\" and \"nat_term_comp cmp\" and \"fst (rep_nat_term u) = fst (rep_nat_term a)\"\n    and \"fst (rep_nat_term v) = fst (rep_nat_term b)\" and \"snd (rep_nat_term u) \\<le> snd (rep_nat_term v)\"\n    and \"snd (rep_nat_term a) = snd (rep_nat_term b)\" and \"cmp a b \\<noteq> Gt\"\n  shows \"cmp u v \\<noteq> Gt\"\nproof (cases \"snd (rep_nat_term u) = snd (rep_nat_term v)\")\n  case True\n  with assms(1, 2, 3, 4) have \"cmp u v = cmp a b\" using assms(6) by (rule nat_term_compD4')\n  thus ?thesis using assms(7) by simp\nnext\n  case False\n  from assms(1) interpret cmp: comparator cmp .\n  from refl obtain w::'a where w: \"rep_nat_term w = (fst (rep_nat_term u), snd (rep_nat_term v))\"\n    by (rule full_componentE)\n  have 1: \"fst (rep_nat_term w) = fst (rep_nat_term a)\" and 2: \"snd (rep_nat_term w) = snd (rep_nat_term v)\"\n    by (simp_all add: w assms(3))\n  from False assms(5) have *: \"snd (rep_nat_term u) < snd (rep_nat_term v)\" by simp\n  have \"cmp u w = Lt\" by (rule nat_term_compD2, fact assms(2), simp_all add: * w)\n  moreover from assms(1, 2) 1 assms(4) 2 assms(6) have \"cmp w v = cmp a b\" by (rule nat_term_compD4')\n  ultimately show ?thesis using assms(7) by (metis cmp.nGt_le_conv cmp.nLt_le_conv cmp.trans)\nqed\n\nlemma comparator_lex_comp_aux: \"comparator (lex_comp_aux::'a::nat_term comparator)\"\n  unfolding lex_comp_aux_def\nproof (rule comparator_composition)\n  from lex_pp_antisym have as: \"antisymp lex_pp\" by (rule antisympI)\n  have \"comparator (comp_of_ord (lex_pp::(nat, nat) pp \\<Rightarrow> _))\"\n    unfolding comp_of_ord_eq_comp_of_ords[OF as]\n    by (rule comp_of_ords, unfold_locales,\n        auto simp: lex_pp_refl intro: lex_pp_trans lex_pp_lin' elim!: lex_pp_antisym)\n  thus \"comparator (\\<lambda>x y::((nat, nat) pp \\<times> nat). case comp_of_ord lex_pp (fst x) (fst y) of\n                                          Eq \\<Rightarrow> comparator_of (snd x) (snd y) | val \\<Rightarrow> val)\"\n    using comparator_of prod_eqI by (rule comparator_lexicographic)\nnext\n  from rep_nat_term_inj show \"inj rep_nat_term\" by (rule injI)\nqed\n\nlemma nat_term_comp_lex_comp_aux: \"nat_term_comp (lex_comp_aux::'a::nat_term comparator)\"\nproof -\n  from lex_pp_antisym have as: \"antisymp lex_pp\" by (rule antisympI)\n  interpret lex: comparator \"comp_of_ord (lex_pp::(nat, nat) pp \\<Rightarrow> _)\"\n    unfolding comp_of_ord_eq_comp_of_ords[OF as]\n    by (rule comp_of_ords, unfold_locales,\n        auto simp: lex_pp_refl intro: lex_pp_trans lex_pp_lin' elim!: lex_pp_antisym)\n  show ?thesis\n  proof (rule nat_term_compI)\n    fix u v :: 'a\n    assume 1: \"snd (rep_nat_term u) = snd (rep_nat_term v)\" and 2: \"fst (rep_nat_term u) = 0\"\n    show \"lex_comp_aux u v \\<noteq> Gt\"\n      by (simp add: lex_comp_aux_def 1 2 split: order.split, simp add: comp_of_ord_def lex_pp_zero_min)\n  next\n    fix u v :: 'a\n    assume 1: \"fst (rep_nat_term u) = fst (rep_nat_term v)\" and 2: \"snd (rep_nat_term u) < snd (rep_nat_term v)\"\n    show \"lex_comp_aux u v = Lt\"\n      by (simp add: lex_comp_aux_def 1 split: order.split, simp add: comparator_of_def 2)\n  next\n    fix t u v :: 'a\n    show \"lex_comp_aux u v = Lt \\<Longrightarrow> lex_comp_aux (splus t u) (splus t v) = Lt\"\n      by (auto simp: lex_comp_aux_def splus_term pprod.splus_def comp_of_ord_def lex_pp_refl\n          split: order.splits if_splits intro: lex_pp_plus_monotone')\n  next\n    fix u v a b :: 'a\n    assume \"fst (rep_nat_term u) = fst (rep_nat_term a)\" and \"fst (rep_nat_term v) = fst (rep_nat_term b)\"\n      and \"snd (rep_nat_term a) = snd (rep_nat_term b)\" and \"lex_comp_aux a b = Lt\"\n    thus \"lex_comp_aux u v = Lt\" by (simp add: lex_comp_aux_def split: order.splits)\n  qed\nqed\n\ntypedef (overloaded) 'a nat_term_order =\n  \"{cmp::'a::nat_term comparator. comparator cmp \\<and> nat_term_comp cmp}\"\n  morphisms nat_term_compare Abs_nat_term_order\nproof (rule, simp)\n  from comparator_lex_comp_aux nat_term_comp_lex_comp_aux\n  show \"comparator lex_comp_aux \\<and> nat_term_comp lex_comp_aux\" ..\nqed\n\nlemma nat_term_compare_Abs_nat_term_order_id:\n  assumes \"comparator cmp\" and \"nat_term_comp cmp\"\n  shows \"nat_term_compare (Abs_nat_term_order cmp) = cmp\"\n  by (rule Abs_nat_term_order_inverse, simp add: assms)\n\ninstantiation nat_term_order :: (type) equal\nbegin\n\ndefinition equal_nat_term_order :: \"'a nat_term_order \\<Rightarrow> 'a nat_term_order \\<Rightarrow> bool\" where \"equal_nat_term_order = (=)\"\n\ninstance by (standard, simp add: equal_nat_term_order_def)\n\nend\n\ndefinition nat_term_compare_inv :: \"'a nat_term_order \\<Rightarrow> 'a::nat_term comparator\"\n  where \"nat_term_compare_inv to = (\\<lambda>x y. nat_term_compare to y x)\"\n\ndefinition key_order_of_nat_term_order :: \"'a nat_term_order \\<Rightarrow> 'a::nat_term key_order\"\n  where key_order_of_nat_term_order_def [code del]:\n    \"key_order_of_nat_term_order to = Abs_key_order (nat_term_compare to)\"\n\ndefinition key_order_of_nat_term_order_inv :: \"'a nat_term_order \\<Rightarrow> 'a::nat_term key_order\"\n  where key_order_of_nat_term_order_inv_def [code del]:\n    \"key_order_of_nat_term_order_inv to = Abs_key_order (nat_term_compare_inv to)\"\n\ndefinition le_of_nat_term_order :: \"'a nat_term_order \\<Rightarrow> 'a \\<Rightarrow> 'a::nat_term \\<Rightarrow> bool\"\n  where \"le_of_nat_term_order to = le_of_key_order (key_order_of_nat_term_order to)\"\n\ndefinition lt_of_nat_term_order :: \"'a nat_term_order \\<Rightarrow> 'a \\<Rightarrow> 'a::nat_term \\<Rightarrow> bool\"\n  where \"lt_of_nat_term_order to = lt_of_key_order (key_order_of_nat_term_order to)\"\n\ndefinition nat_term_order_of_le :: \"'a::{linorder,nat_term} nat_term_order\"\n  where \"nat_term_order_of_le = Abs_nat_term_order (comparator_of)\"\n\nlemma comparator_nat_term_compare: \"comparator (nat_term_compare to)\"\n  using nat_term_compare by blast\n\nlemma nat_term_comp_nat_term_compare: \"nat_term_comp (nat_term_compare to)\"\n  using nat_term_compare by blast\n\n\n\nlemma nat_term_compare_conv: \"nat_term_compare to = key_compare (key_order_of_nat_term_order to)\"\n  unfolding key_order_of_nat_term_order_def\n  by (rule sym, rule Abs_key_order_inverse, simp add: comparator_nat_term_compare)\n\nlemma comparator_nat_term_compare_inv: \"comparator (nat_term_compare_inv to)\"\n  unfolding nat_term_compare_inv_def using comparator_nat_term_compare by (rule comparator_converse)\n\nlemma nat_term_compare_inv_conv: \"nat_term_compare_inv to = key_compare (key_order_of_nat_term_order_inv to)\"\n  unfolding key_order_of_nat_term_order_inv_def\n  by (rule sym, rule Abs_key_order_inverse, simp add: comparator_nat_term_compare_inv)\n\nlemma nat_term_compare_inv_alt [code_unfold]: \"nat_term_compare_inv to x y = nat_term_compare to y x\"\n  by (simp only: nat_term_compare_inv_def)\n\nlemma le_of_nat_term_order [code]: \"le_of_nat_term_order to x y = (nat_term_compare to x y \\<noteq> Gt)\"\n  by (simp add: le_of_key_order_alt le_of_nat_term_order_def nat_term_compare_conv)\n\nlemma lt_of_nat_term_order [code]: \"lt_of_nat_term_order to x y = (nat_term_compare to x y = Lt)\"\n  by (simp add: lt_of_key_order_alt lt_of_nat_term_order_def nat_term_compare_conv)\n\nlemma le_of_nat_term_order_alt:\n  \"le_of_nat_term_order to = (\\<lambda>u v. ko.le (key_order_of_nat_term_order_inv to) v u)\"\n  by (intro ext, simp add: le_of_comp_def nat_term_compare_inv_conv[symmetric] le_of_nat_term_order_def\n      le_of_key_order_def nat_term_compare_conv[symmetric] nat_term_compare_inv_alt)\n\nlemma lt_of_nat_term_order_alt:\n  \"lt_of_nat_term_order to = (\\<lambda>u v. ko.lt (key_order_of_nat_term_order_inv to) v u)\"\n  by (intro ext, simp add: lt_of_comp_def nat_term_compare_inv_conv[symmetric] lt_of_nat_term_order_def\n      lt_of_key_order_def nat_term_compare_conv[symmetric] nat_term_compare_inv_alt)\n\nlemma linorder_le_of_nat_term_order: \"class.linorder (le_of_nat_term_order to) (lt_of_nat_term_order to)\"\n  unfolding le_of_nat_term_order_alt lt_of_nat_term_order_alt using ko.linorder\n  by (rule linorder.dual_linorder)\n\nlemma le_of_nat_term_order_zero_min: \"le_of_nat_term_order to 0 (t::'a::nat_pp_term)\"\n  unfolding le_of_nat_term_order\n  by (rule nat_term_compD1', fact comparator_nat_term_compare, fact nat_term_comp_nat_term_compare, simp_all add: rep_nat_term_zero)\n\n\n\nglobal_interpretation ko_ntm: comparator \"nat_term_compare_inv ko\"\n  defines lookup_pair_ko_ntm = ko_ntm.lookup_pair\n  and update_by_pair_ko_ntm = ko_ntm.update_by_pair\n  and update_by_fun_pair_ko_ntm = ko_ntm.update_by_fun_pair\n  and update_by_fun_gr_pair_ko_ntm = ko_ntm.update_by_fun_gr_pair\n  and map2_val_pair_ko_ntm = ko_ntm.map2_val_pair\n  and lex_ord_pair_ko_ntm = ko_ntm.lex_ord_pair\n  and prod_ord_pair_ko_ntm = ko_ntm.prod_ord_pair\n  and sort_oalist_ko_ntm' = ko_ntm.sort_oalist\n  by (fact comparator_nat_term_compare_inv)\n\nlemma ko_ntm_le: \"ko_ntm.le to = (\\<lambda>x y. le_of_nat_term_order to y x)\"\n  by (intro ext, simp add: le_of_comp_def le_of_nat_term_order nat_term_compare_inv_def split: order.split)\n\nglobal_interpretation ko_ntm: oalist_raw key_order_of_nat_term_order_inv\n  rewrites \"comparator.lookup_pair (key_compare (key_order_of_nat_term_order_inv ko)) = lookup_pair_ko_ntm ko\"\n  and \"comparator.update_by_pair (key_compare (key_order_of_nat_term_order_inv ko)) = update_by_pair_ko_ntm ko\"\n  and \"comparator.update_by_fun_pair (key_compare (key_order_of_nat_term_order_inv ko)) = update_by_fun_pair_ko_ntm ko\"\n  and \"comparator.update_by_fun_gr_pair (key_compare (key_order_of_nat_term_order_inv ko)) = update_by_fun_gr_pair_ko_ntm ko\"\n  and \"comparator.map2_val_pair (key_compare (key_order_of_nat_term_order_inv ko)) = map2_val_pair_ko_ntm ko\"\n  and \"comparator.lex_ord_pair (key_compare (key_order_of_nat_term_order_inv ko)) = lex_ord_pair_ko_ntm ko\"\n  and \"comparator.prod_ord_pair (key_compare (key_order_of_nat_term_order_inv ko)) = prod_ord_pair_ko_ntm ko\"\n  and \"comparator.sort_oalist (key_compare (key_order_of_nat_term_order_inv ko)) = sort_oalist_ko_ntm' ko\"\n  defines sort_oalist_aux_ko_ntm = ko_ntm.sort_oalist_aux\n  and lookup_ko_ntm = ko_ntm.lookup_raw\n  and sorted_domain_ko_ntm = ko_ntm.sorted_domain_raw\n  and tl_ko_ntm = ko_ntm.tl_raw\n  and min_key_val_ko_ntm = ko_ntm.min_key_val_raw\n  and update_by_ko_ntm = ko_ntm.update_by_raw\n  and update_by_fun_ko_ntm = ko_ntm.update_by_fun_raw\n  and update_by_fun_gr_ko_ntm = ko_ntm.update_by_fun_gr_raw\n  and map2_val_ko_ntm = ko_ntm.map2_val_raw\n  and lex_ord_ko_ntm = ko_ntm.lex_ord_raw\n  and prod_ord_ko_ntm = ko_ntm.prod_ord_raw\n  and oalist_eq_ko_ntm = ko_ntm.oalist_eq_raw\n  and sort_oalist_ko_ntm = ko_ntm.sort_oalist_raw\n  subgoal by (simp only: lookup_pair_ko_ntm_def nat_term_compare_inv_conv)\n  subgoal by (simp only: update_by_pair_ko_ntm_def nat_term_compare_inv_conv)\n  subgoal by (simp only: update_by_fun_pair_ko_ntm_def nat_term_compare_inv_conv)\n  subgoal by (simp only: update_by_fun_gr_pair_ko_ntm_def nat_term_compare_inv_conv)\n  subgoal by (simp only: map2_val_pair_ko_ntm_def nat_term_compare_inv_conv)\n  subgoal by (simp only: lex_ord_pair_ko_ntm_def nat_term_compare_inv_conv)\n  subgoal by (simp only: prod_ord_pair_ko_ntm_def nat_term_compare_inv_conv)\n  subgoal by (simp only: sort_oalist_ko_ntm'_def nat_term_compare_inv_conv)\n  done\n\n\n\ntypedef (overloaded) ('a, 'b) oalist_ntm =\n    \"{xs::('a, 'b::zero, 'a::nat_term nat_term_order) oalist_raw. ko_ntm.oalist_inv xs}\"\n  morphisms list_of_oalist_ntm Abs_oalist_ntm\n  by (auto simp: ko_ntm.oalist_inv_def intro: ko.oalist_inv_raw_Nil)\n\nlemma oalist_ntm_eq_iff: \"xs = ys \\<longleftrightarrow> list_of_oalist_ntm xs = list_of_oalist_ntm ys\"\n  by (simp add: list_of_oalist_ntm_inject)\n\nlemma oalist_ntm_eqI: \"list_of_oalist_ntm xs = list_of_oalist_ntm ys \\<Longrightarrow> xs = ys\"\n  by (simp add: oalist_ntm_eq_iff)\n\ntext \\<open>Formal, totalized constructor for @{typ \"('a, 'b) oalist_ntm\"}:\\<close>\n\ndefinition OAlist_ntm :: \"('a \\<times> 'b) list \\<times> 'a nat_term_order \\<Rightarrow> ('a::nat_term, 'b::zero) oalist_ntm\"\n  where \"OAlist_ntm xs = Abs_oalist_ntm (sort_oalist_ko_ntm xs)\"\n\ndefinition \"oalist_of_list_ntm = OAlist_ntm\"\n\nlemma oalist_inv_list_of_oalist_ntm: \"ko_ntm.oalist_inv (list_of_oalist_ntm xs)\"\n  using list_of_oalist_ntm[of xs] by simp\n\nlemma list_of_oalist_OAlist_ntm: \"list_of_oalist_ntm (OAlist_ntm xs) = sort_oalist_ko_ntm xs\"\nproof -\n  obtain xs' ox where xs: \"xs = (xs', ox)\" by fastforce\n  have \"ko_ntm.oalist_inv (sort_oalist_ko_ntm' ox xs', ox)\"\n    using ko_ntm.oalist_inv_sort_oalist_raw by fastforce\n  thus ?thesis by (simp add: xs OAlist_ntm_def Abs_oalist_ntm_inverse)\nqed\n\nlemma OAlist_list_of_oalist_ntm [simp, code abstype]: \"OAlist_ntm (list_of_oalist_ntm xs) = xs\"\nproof -\n  obtain xs' ox where xs: \"list_of_oalist_ntm xs = (xs', ox)\" by fastforce\n  have \"ko_ntm.oalist_inv_raw ox xs'\"\n    by (simp add: xs[symmetric] ko_ntm.oalist_inv_alt[symmetric] nat_term_compare_inv_conv oalist_inv_list_of_oalist_ntm)\n  thus ?thesis by (simp add: xs OAlist_ntm_def ko_ntm.sort_oalist_id, simp add: list_of_oalist_ntm_inverse xs[symmetric])\nqed\n\nlemma [code abstract]: \"list_of_oalist_ntm (oalist_of_list_ntm xs) = sort_oalist_ko_ntm xs\"\n  by (simp add: list_of_oalist_OAlist_ntm oalist_of_list_ntm_def)\n\nglobal_interpretation oa_ntm: oalist_abstract key_order_of_nat_term_order_inv list_of_oalist_ntm OAlist_ntm\n  defines OAlist_lookup_ntm = oa_ntm.lookup\n  and OAlist_sorted_domain_ntm = oa_ntm.sorted_domain\n  and OAlist_empty_ntm = oa_ntm.empty\n  and OAlist_reorder_ntm = oa_ntm.reorder\n  and OAlist_tl_ntm = oa_ntm.tl\n  and OAlist_hd_ntm = oa_ntm.hd\n  and OAlist_except_min_ntm = oa_ntm.except_min\n  and OAlist_min_key_val_ntm = oa_ntm.min_key_val\n  and OAlist_insert_ntm = oa_ntm.insert\n  and OAlist_update_by_fun_ntm = oa_ntm.update_by_fun\n  and OAlist_update_by_fun_gr_ntm = oa_ntm.update_by_fun_gr\n  and OAlist_filter_ntm = oa_ntm.filter\n  and OAlist_map2_val_neutr_ntm = oa_ntm.map2_val_neutr\n  and OAlist_eq_ntm = oa_ntm.oalist_eq\n  apply unfold_locales\n  subgoal by (fact oalist_inv_list_of_oalist_ntm)\n  subgoal by (simp only: list_of_oalist_OAlist_ntm sort_oalist_ko_ntm_def)\n  subgoal by (fact OAlist_list_of_oalist_ntm)\n  done\n\nglobal_interpretation oa_ntm: oalist_abstract3 key_order_of_nat_term_order_inv\n    \"list_of_oalist_ntm::('a, 'b) oalist_ntm \\<Rightarrow> ('a, 'b::zero, 'a::nat_term nat_term_order) oalist_raw\" OAlist_ntm\n    \"list_of_oalist_ntm::('a, 'c) oalist_ntm \\<Rightarrow> ('a, 'c::zero, 'a nat_term_order) oalist_raw\" OAlist_ntm\n    \"list_of_oalist_ntm::('a, 'd) oalist_ntm \\<Rightarrow> ('a, 'd::zero, 'a nat_term_order) oalist_raw\" OAlist_ntm\n  defines OAlist_map_val_ntm = oa_ntm.map_val\n  and OAlist_map2_val_ntm = oa_ntm.map2_val\n  and OAlist_map2_val_rneutr_ntm = oa_ntm.map2_val_rneutr\n  and OAlist_lex_ord_ntm = oa_ntm.lex_ord\n  and OAlist_prod_ord_ntm = oa_ntm.prod_ord ..\n\nlemmas OAlist_lookup_ntm_single = oa_ntm.lookup_oalist_of_list_single[folded oalist_of_list_ntm_def]\n\nend (* theory *)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Polynomials/OAlist_Poly_Mapping.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.33530069917935457}}
{"text": "section \\<open>Imperative Implementation of Dijkstra's Shortest Paths Algorithm\\<close>\ntheory Sepref_Dijkstra\nimports \n  \"../IICF/IICF\"\n  \"../Sepref_ICF_Bindings\"\n  Dijkstra_Shortest_Path.Dijkstra\n  Dijkstra_Shortest_Path.Test\n  \"HOL-Library.Code_Target_Numeral\"\n  (*\"../../../DFS_Framework/Misc/DFS_Framework_Refine_Aux\"*)\n  Sepref_WGraph\nbegin\n\n\n(* Setup for Infty *)\n\ninstantiation infty :: (heap) heap\nbegin\n  instance \n    apply standard\n    apply (rule_tac x=\"\\<lambda>Infty \\<Rightarrow> 0 | Num a \\<Rightarrow> to_nat a + 1\" in exI)\n    apply (rule injI)\n    apply (auto split: infty.splits)\n    done\nend\n\nfun infty_assn where\n  \"infty_assn A (Num x) (Num y) = A x y\"\n| \"infty_assn A Infty Infty = emp\"\n| \"infty_assn _ _ _ = false\"\n\ntext \\<open>Connection with \\<open>infty_rel\\<close>\\<close>\nlemma infty_assn_pure_conv: \"infty_assn (pure A) = pure (\\<langle>A\\<rangle>infty_rel)\"\n  apply (intro ext)\n  subgoal for x y by (cases x; cases y; simp add: pure_def)\n  done\n\nlemmas [sepref_import_rewrite, fcomp_norm_unfold, sepref_frame_normrel_eqs] =\n  infty_assn_pure_conv[symmetric]\nlemmas [constraint_simps] = infty_assn_pure_conv\n\nlemma infty_assn_pure[safe_constraint_rules]: \"is_pure A \\<Longrightarrow> is_pure (infty_assn A)\"\n  by (auto simp: is_pure_conv infty_assn_pure_conv)\n\nlemma infty_assn_id[simp]: \"infty_assn id_assn = id_assn\"\n  by (simp add: infty_assn_pure_conv)\n\nlemma [safe_constraint_rules]: \"IS_BELOW_ID R \\<Longrightarrow> IS_BELOW_ID (\\<langle>R\\<rangle>infty_rel)\"  \n  by (auto simp: infty_rel_def IS_BELOW_ID_def)\n\nsepref_register Num Infty\n\nlemma Num_hnr[sepref_fr_rules]: \"(return o Num,RETURN o Num)\\<in>A\\<^sup>d \\<rightarrow>\\<^sub>a infty_assn A\"\n  by sepref_to_hoare sep_auto\n\nlemma Infty_hnr[sepref_fr_rules]: \"(uncurry0 (return Infty),uncurry0 (RETURN Infty))\\<in>unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a infty_assn A\"\n  by sepref_to_hoare sep_auto\n\nsepref_register case_infty\nlemma [sepref_monadify_arity]: \"case_infty \\<equiv> \\<lambda>\\<^sub>2f1 f2 x. SP case_infty$f1$(\\<lambda>\\<^sub>2x. f2$x)$x\"\n  by simp\nlemma [sepref_monadify_comb]: \"case_infty$f1$f2$x \\<equiv> (\\<bind>)$(EVAL$x)$(\\<lambda>\\<^sub>2x. SP case_infty$f1$f2$x)\" by simp\nlemma [sepref_monadify_comb]: \"EVAL$(case_infty$f1$(\\<lambda>\\<^sub>2x. f2 x)$x) \n  \\<equiv> (\\<bind>)$(EVAL$x)$(\\<lambda>\\<^sub>2x. SP case_infty$(EVAL $ f1)$(\\<lambda>\\<^sub>2x. EVAL $ f2 x)$x)\"\n  apply (rule eq_reflection)\n  by (simp split: infty.splits)\n\nlemma infty_assn_ctxt: \"infty_assn A x y = z \\<Longrightarrow> hn_ctxt (infty_assn A) x y = z\"\n  by (simp add: hn_ctxt_def)\n\nlemma infty_cases_hnr[sepref_prep_comb_rule, sepref_comb_rules]:\n  fixes A e e'\n  defines [simp]: \"INVe \\<equiv> hn_invalid (infty_assn A) e e'\"\n  assumes FR: \"\\<Gamma> \\<Longrightarrow>\\<^sub>t hn_ctxt (infty_assn A) e e' * F\"\n  assumes Infty: \"\\<lbrakk>e = Infty; e' = Infty\\<rbrakk> \\<Longrightarrow> hn_refine (hn_ctxt (infty_assn A) e e' * F) f1' (hn_ctxt XX1 e e' * \\<Gamma>1') R f1\"\n  assumes Num: \"\\<And>x1 x1a. \\<lbrakk>e = Num x1; e' = Num x1a\\<rbrakk> \\<Longrightarrow> hn_refine (hn_ctxt A x1 x1a * INVe * F) (f2' x1a) (hn_ctxt A' x1 x1a * hn_ctxt XX2 e e' * \\<Gamma>2') R (f2 x1)\"\n  assumes MERGE2[unfolded hn_ctxt_def]: \"\\<Gamma>1' \\<or>\\<^sub>A \\<Gamma>2' \\<Longrightarrow>\\<^sub>t \\<Gamma>'\"\n  shows \"hn_refine \\<Gamma> (case_infty f1' f2' e') (hn_ctxt (infty_assn A') e e' * \\<Gamma>') R (case_infty$f1$(\\<lambda>\\<^sub>2x. f2 x)$e)\"\n  apply (rule hn_refine_cons_pre[OF FR])\n  apply1 extract_hnr_invalids\n  apply (cases e; cases e'; simp add: infty_assn.simps[THEN infty_assn_ctxt])\n  subgoal \n    apply (rule hn_refine_cons[OF _ Infty _ entt_refl]; assumption?)\n    applyS (simp add: hn_ctxt_def)\n    apply (subst mult.commute, rule entt_fr_drop)\n    apply (rule entt_trans[OF _ MERGE2])\n    apply (simp add:)\n  done  \n  subgoal \n    apply (rule hn_refine_cons[OF _ Num _ entt_refl]; assumption?)\n    applyS (simp add: hn_ctxt_def)\n    apply (rule entt_star_mono)\n    apply1 (rule entt_fr_drop)\n    applyS (simp add: hn_ctxt_def)\n    apply1 (rule entt_trans[OF _ MERGE2])\n    applyS (simp add:)\n  done    \n  done\n  \nlemma hnr_val[sepref_fr_rules]: \"(return o Weight.val,RETURN o Weight.val) \\<in> [\\<lambda>x. x\\<noteq>Infty]\\<^sub>a (infty_assn A)\\<^sup>d \\<rightarrow> A\"\n  apply sepref_to_hoare\n  subgoal for x y by (cases x; cases y; sep_auto)\n  done\n\ncontext\n  fixes A :: \"'a::weight \\<Rightarrow> 'b \\<Rightarrow> assn\"\n  fixes plusi\n  assumes GA[unfolded GEN_ALGO_def, sepref_fr_rules]: \"GEN_ALGO plusi (\\<lambda>f. (uncurry f,uncurry (RETURN oo (+)))\\<in>A\\<^sup>k*\\<^sub>aA\\<^sup>k \\<rightarrow>\\<^sub>a A)\"\nbegin\n  sepref_thm infty_plus_impl is \"uncurry (RETURN oo (+))\" :: \"((infty_assn A)\\<^sup>k *\\<^sub>a (infty_assn A)\\<^sup>k \\<rightarrow>\\<^sub>a infty_assn A)\"\n    unfolding infty_plus_eq_plus[symmetric] infty_plus_def[abs_def]\n    by sepref\nend\nconcrete_definition infty_plus_impl uses infty_plus_impl.refine_raw is \"(uncurry ?impl,_)\\<in>_\"\nlemmas [sepref_fr_rules] = infty_plus_impl.refine\n\ndefinition infty_less where\n  \"infty_less lt a b \\<equiv> case (a,b) of (Num a, Num b) \\<Rightarrow> lt a b | (Num _, Infty) \\<Rightarrow> True | _ \\<Rightarrow> False\"\n\nlemma infty_less_param[param]:\n  \"(infty_less,infty_less) \\<in> (R\\<rightarrow>R\\<rightarrow>bool_rel) \\<rightarrow> \\<langle>R\\<rangle>infty_rel \\<rightarrow> \\<langle>R\\<rangle>infty_rel \\<rightarrow> bool_rel\"\n  unfolding infty_less_def[abs_def]\n  by parametricity\n\nlemma infty_less_eq_less: \"infty_less (<) = (<)\"\n  unfolding infty_less_def[abs_def] \n  apply (clarsimp intro!: ext)\n  subgoal for a b by (cases a; cases b; auto)\n  done\n\ncontext\n  fixes A :: \"'a::weight \\<Rightarrow> 'b \\<Rightarrow> assn\"\n  fixes lessi\n  assumes GA[unfolded GEN_ALGO_def, sepref_fr_rules]: \"GEN_ALGO lessi (\\<lambda>f. (uncurry f,uncurry (RETURN oo (<)))\\<in>A\\<^sup>k*\\<^sub>aA\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn)\"\nbegin\n  sepref_thm infty_less_impl is \"uncurry (RETURN oo (<))\" :: \"((infty_assn A)\\<^sup>k *\\<^sub>a (infty_assn A)\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn)\"\n    unfolding infty_less_eq_less[symmetric] infty_less_def[abs_def]\n    by sepref\nend\nconcrete_definition infty_less_impl uses infty_less_impl.refine_raw is \"(uncurry ?impl,_)\\<in>_\"\nlemmas [sepref_fr_rules] = infty_less_impl.refine\n\nlemma param_mpath': \"(mpath',mpath')\n  \\<in> \\<langle>\\<langle>A\\<times>\\<^sub>r B \\<times>\\<^sub>r A\\<rangle>list_rel \\<times>\\<^sub>r B\\<rangle>option_rel \\<rightarrow> \\<langle>\\<langle>A\\<times>\\<^sub>r B \\<times>\\<^sub>r A\\<rangle>list_rel\\<rangle>option_rel\"\nproof -\n  have 1: \"mpath' = map_option fst\"\n    apply (intro ext, rename_tac x)\n    apply (case_tac x)\n    apply simp\n    apply (rename_tac a)\n    apply (case_tac a)\n    apply simp\n    done\n  show ?thesis  \n    unfolding 1\n    by parametricity\nqed\nlemmas (in -) [sepref_import_param] = param_mpath'\n\nlemma param_mpath_weight': \n  \"(mpath_weight', mpath_weight') \\<in> \\<langle>\\<langle>A\\<times>\\<^sub>rB\\<times>\\<^sub>rA\\<rangle>list_rel \\<times>\\<^sub>r B\\<rangle>option_rel \\<rightarrow> \\<langle>B\\<rangle>infty_rel\"\n  by (auto elim!: option_relE simp: infty_rel_def top_infty_def)\n\nlemmas [sepref_import_param] = param_mpath_weight'\n\ncontext Dijkstra begin  \n  lemmas impl_aux = mdijkstra_def[unfolded mdinit_def mpop_min_def mupdate_def]\n\n  lemma mdijkstra_correct:  \n    \"(mdijkstra, SPEC (is_shortest_path_map v0)) \\<in> \\<langle>br \\<alpha>r res_invarm\\<rangle>nres_rel\"\n  proof -\n    note mdijkstra_refines\n    also note dijkstra'_refines\n    also note dijkstra_correct\n    finally show ?thesis\n      by (rule nres_relI)\n  qed\n\nend\n\nlocale Dijkstra_Impl = fixes w_dummy :: \"'W::{weight,heap}\"\nbegin\n  text \\<open>Weights\\<close>\n  sepref_register \"0::'W\"  \n  lemmas [sepref_import_param] = \n    IdI[of \"0::'W\"]\n\n  abbreviation \"weight_assn \\<equiv> id_assn :: 'W \\<Rightarrow> _\"\n\n  lemma w_plus_param: \"((+), (+)::'W\\<Rightarrow>_) \\<in> Id \\<rightarrow> Id \\<rightarrow> Id\" by simp\n  lemma w_less_param: \"((<), (<)::'W\\<Rightarrow>_) \\<in> Id \\<rightarrow> Id \\<rightarrow> Id\" by simp\n  lemmas [sepref_import_param] = w_plus_param w_less_param\n  lemma [sepref_gen_algo_rules]: \n    \"GEN_ALGO (return oo (+)) (\\<lambda>f. (uncurry f, uncurry (RETURN \\<circ>\\<circ> (+))) \\<in> id_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\<rightarrow>\\<^sub>a id_assn)\"\n    \"GEN_ALGO (return oo (<)) (\\<lambda>f. (uncurry f, uncurry (RETURN \\<circ>\\<circ> (<))) \\<in> id_assn\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\<rightarrow>\\<^sub>a id_assn)\"\n    by (sep_auto simp: GEN_ALGO_def pure_def intro!: hfrefI hn_refineI)+\n\n  lemma conv_prio_pop_min: \"prio_pop_min m = do {\n      ASSERT (dom m \\<noteq> {}); \n      ((k,v),m) \\<leftarrow> mop_pm_pop_min id m;\n      RETURN (k,v,m)\n    }\"\n    unfolding prio_pop_min_def mop_pm_pop_min_def\n    by (auto simp: pw_eq_iff refine_pw_simps ran_def)\nend\n\ncontext fixes N :: nat and w_dummy::\"'W::{heap,weight}\" begin  \n\n  interpretation Dijkstra_Impl w_dummy .\n\n  definition \"drmap_assn2 \\<equiv> IICF_Sepl_Binding.iam.assn \n    (pure (node_rel N))  \n    (prod_assn\n      (list_assn (prod_assn (pure (node_rel N)) (prod_assn weight_assn (pure (node_rel N)))))\n      weight_assn)\n    \"\n    \n\n  concrete_definition mdijkstra' uses Dijkstra.impl_aux\n\n  sepref_definition dijkstra_imp is \"uncurry mdijkstra'\" \n    :: \"(is_graph N (Id::('W\\<times>'W) set))\\<^sup>k *\\<^sub>a (pure (node_rel N))\\<^sup>k \\<rightarrow>\\<^sub>a drmap_assn2\"\n    unfolding mdijkstra'_def\n    apply (subst conv_prio_pop_min)\n    apply (rewrite in \"RETURN (_,\\<hole>)\" iam.fold_custom_empty)\n    apply (rewrite hm_fold_custom_empty_sz[of N])\n    apply (rewrite in \"_(_ \\<mapsto> (\\<hole>,0))\" HOL_list.fold_custom_empty)\n    unfolding drmap_assn2_def\n    using [[id_debug, goals_limit = 1]]\n    by sepref\n  export_code dijkstra_imp checking SML_imp\nend\n\n\ntext \\<open>The main correctness theorem\\<close>\n\nthm Dijkstra.mdijkstra_correct\n\nlemma mdijkstra'_aref: \"(uncurry mdijkstra',uncurry (SPEC oo weighted_graph.is_shortest_path_map))\n  \\<in> [\\<lambda>(G,v0). Dijkstra G v0]\\<^sub>f Id\\<times>\\<^sub>rId \\<rightarrow> \\<langle>br Dijkstra.\\<alpha>r Dijkstra.res_invarm\\<rangle>nres_rel\"\n  using Dijkstra.mdijkstra_correct\n  by (fastforce intro!: frefI simp: mdijkstra'.refine[symmetric])\n\ndefinition \"drmap_assn N \\<equiv> hr_comp (drmap_assn2 N) (br Dijkstra.\\<alpha>r Dijkstra.res_invarm)\"\n\ncontext notes [fcomp_norm_unfold] = drmap_assn_def[symmetric] begin\n\ntheorem dijkstra_imp_correct: \"(uncurry (dijkstra_imp N), uncurry (SPEC \\<circ>\\<circ> weighted_graph.is_shortest_path_map))\n  \\<in> [\\<lambda>(G, v0). v0 \\<in> nodes G \\<and> (\\<forall>(v, w, v') \\<in> edges G. 0 \\<le> w)]\\<^sub>a (is_graph N Id)\\<^sup>k *\\<^sub>a (node_assn N)\\<^sup>k \\<rightarrow> drmap_assn N\"\n  apply (rule hfref_weaken_pre'[OF _ dijkstra_imp.refine[FCOMP mdijkstra'_aref]])\nproof clarsimp\n  fix G :: \"(nat,'w::{weight,heap}) graph\" and v0\n  assume v0_is_node: \"v0 \\<in> nodes G\"\n    and nonneg_weights: \"\\<forall>(v, w, v') \\<in> edges G. 0 \\<le> w\"\n    and \"v0<N\" \n    and RDOM: \"rdomp (is_graph N Id) G\"\n\n  from RDOM interpret valid_graph G unfolding is_graph_def rdomp_def by auto\n\n  from RDOM have [simp]: \"finite V\" unfolding is_graph_def rdomp_def by auto\n\n  from RDOM have \"\\<forall>v\\<in>V. {(w, v'). (v, w, v') \\<in> E} \\<in> \n    Range (\\<langle>Id \\<times>\\<^sub>r node_rel N\\<rangle>list_set_rel)\"\n    by (auto simp: succ_def is_graph_def rdomp_def)\n  hence \"\\<forall>v\\<in>V. finite {(w, v'). (v, w, v') \\<in> E}\"\n    unfolding list_set_rel_range by simp\n  hence \"finite (Sigma V (\\<lambda>v. {(w, v'). (v, w, v') \\<in> E}))\"\n    by auto\n  also have \"E \\<subseteq> (Sigma V (\\<lambda>v. {(w, v'). (v, w, v') \\<in> E}))\"  \n    using E_valid\n    by auto\n  finally (finite_subset[rotated]) have [simp]: \"finite E\" .\n    \n  show \"Dijkstra G v0\"\n    apply (unfold_locales)\n    unfolding is_graph_def using v0_is_node nonneg_weights\n    by auto\nqed    \n\nend\n  \ncorollary dijkstra_imp_rule: \"\n  <is_graph n Id G Gi * \\<up>(v0 \\<in> nodes G \\<and> (\\<forall>(v, w, v') \\<in> edges G. 0 \\<le> w))> \n    dijkstra_imp n Gi v0 \n  <\\<lambda>mi. (is_graph n Id) G Gi \n      * (\\<exists>\\<^sub>Am. drmap_assn n m mi * \\<up>(weighted_graph.is_shortest_path_map G v0 m)) >\\<^sub>t\"\n  using dijkstra_imp_correct[to_hnr, of v0 G n v0 Gi]\n  unfolding hn_refine_def\n  apply (clarsimp)\n  apply (erule cons_rule[rotated -1])\n  apply (sep_auto simp: hn_ctxt_def pure_def is_graph_def)\n  apply (sep_auto simp: hn_ctxt_def)\n  done\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/Examples/Sepref_Dijkstra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5964331462646254, "lm_q1q2_score": 0.3353006991793545}}
{"text": "\ntheory CheckerExe\n  imports TheoryExe ProofTerm\nbegin\n\nabbreviation \"exetyp_ok \\<Theta> \\<equiv> exetyp_ok_sig (exesig \\<Theta>)\"\n\nlemma typ_ok_code: \n  assumes \"exe_wf_theory' \\<Theta>\"\n  shows \"typ_ok (translate_theory \\<Theta>) ty = exetyp_ok \\<Theta> ty\"\n  using assms typ_ok_sig_code\n  by (metis exe_sig_conds_def exe_wf_theory.simps exe_wf_theory_code exesignature.exhaust\n      exetheory.sel(1) sig.simps translate_theory.elims typ_ok_def wf_type_iff_typ_ok_sig)\n\ndefinition [simp]: \"execlass_leq cs c1 c2 = List.member cs (c1,c2)\"\nlemma execlass_leq_code: \"class_leq (set cs) c1 c2 = execlass_leq cs c1 c2\"\n  by (simp add: class_leq_def class_les_def member_def)\n\ndefinition \"exesort_leq sub s1 s2 = (\\<forall>c\\<^sub>2 \\<in> s2 . \\<exists>c\\<^sub>1 \\<in> s1. execlass_leq sub c\\<^sub>1 c\\<^sub>2)\"\nlemma exesort_les_code: \"sort_leq (set cs) c1 c2 = exesort_leq cs c1 c2\"\n  by (simp add: execlass_leq_code exesort_leq_def sort_leq_def)\n\nfun exehas_sort :: \"exeosig \\<Rightarrow> typ \\<Rightarrow> sort \\<Rightarrow> bool\" where\n\"exehas_sort oss (Tv _ S) S' = exesort_leq (execlasses oss) S S'\" |\n\"exehas_sort oss (Ty a Ts) S =\n  (case lookup (\\<lambda>k. k=a) (exetcsigs oss) of\n  None \\<Rightarrow> False |\n  Some mgd \\<Rightarrow> (\\<forall>C \\<in> S.\n    case lookup (\\<lambda>k. k=C) mgd of\n        None \\<Rightarrow> False\n      | Some Ss \\<Rightarrow> list_all2 (exehas_sort oss) Ts Ss))\"\n\n(* cleanup *)\nlemma exehas_sort_imp_has_sort: \n  assumes \"exe_osig_conds (sub, tcs)\"\n  shows \"exehas_sort (sub, tcs) T S \\<Longrightarrow> has_sort (translate_osig (sub, tcs)) T S\"\nproof (induction T arbitrary: S)\n  case (Ty n Ts)\n  obtain sub' tcs' where sub'_tcs': \"translate_osig (sub, tcs) = (sub', tcs')\" by fastforce\n  obtain mgd where mgd: \"tcs' n = Some mgd\" \n    using Ty.prems sub'_tcs' apply (simp split: option.splits) \n    by (metis assms exe_ars_conds_def exe_osig_conds_def in_alist_imp_in_map_of lookup_eq_map_of_ap \n        map_of_SomeD snd_conv)\n  show ?case\n  proof (subst sub'_tcs', rule has_sort_Ty[of tcs', OF mgd], rule ballI)\n    fix c assume asm: \"c\\<in>S\"\n\n    have l: \"lookup (\\<lambda>k. k=n) (map (apsnd map_of) tcs) = Some mgd\"\n      by (metis assms lookup_eq_map_of_ap mgd snd_conv sub'_tcs' translate_ars.simps translate_osig.simps)\n    hence \"\\<exists>x. (lookup (\\<lambda>k. k=n) tcs) = Some x\"\n      by (induction tcs) auto\n    from this obtain pre_mgd where pre_mgd: \"(lookup (\\<lambda>k. k=n) tcs) = Some pre_mgd\"\n      by blast\n    have pre_mgd_mgd: \"map_of pre_mgd = mgd\"\n      by (metis l assms exe_ars_conds_def\n          exe_osig_conds_def in_alist_imp_in_map_of lookup_eq_map_of_ap map_of_SomeD \n          option.sel pre_mgd snd_conv translate_ars.simps)\n\n    obtain Ss where Ss: \"lookup (\\<lambda>k. k=c) pre_mgd = Some Ss\"\n      using Ty.prems asm by (auto simp add: pre_mgd split: option.splits)\n    hence cond: \"list_all2 (exehas_sort (sub,tcs)) Ts Ss\"\n      using \\<open>exehas_sort (sub, tcs) (Ty n Ts) S\\<close>asm pre_mgd by (auto split: option.splits)\n      \n    from Ss have \"mgd c = Some Ss\"\n      by (simp add: lookup_eq_map_of_ap pre_mgd_mgd)\n    then show \"\\<exists>Ss. mgd c = Some Ss \\<and> list_all2 (has_sort (sub', tcs')) Ts Ss\"\n      using cond Ty.IH list.rel_mono_strong sub'_tcs' by force\n  qed\nnext\n  case (Tv n S)\n  then show ?case\n    by (metis assms exehas_sort.simps(1) exesort_les_code has_sort_Tv prod.collapse translate_osig.simps)\nqed\n\nlemma has_sort_imp_exehas_sort: \n  assumes \"exe_osig_conds (sub, tcs)\"\n  shows \"has_sort (translate_osig (sub, tcs)) T S \\<Longrightarrow> exehas_sort (sub, tcs) T S\"\nproof (induction T arbitrary: S)\n  case (Ty n Ts)\n  obtain sub' tcs' where sub'_tcs': \"translate_osig (sub, tcs) = (sub', tcs')\" by fastforce\n  obtain mgd where mgd: \"tcs' n = Some mgd\" \n    using Ty.prems sub'_tcs' has_sort.simps by (auto split: option.splits)\n  hence \"lookup (\\<lambda>k. k=n) (map (apsnd map_of) tcs) = Some mgd\"\n    by (metis assms lookup_eq_map_of_ap prod.inject sub'_tcs' translate_ars.simps translate_osig.simps)\n  have l: \"lookup (\\<lambda>k. k=n) (map (apsnd map_of) tcs) = Some mgd\"\n    by (metis assms lookup_eq_map_of_ap mgd snd_conv sub'_tcs' \n        translate_ars.simps translate_osig.simps)\n  hence \"\\<exists>x. (lookup (\\<lambda>k. k=n) tcs) = Some x\"\n    by (induction tcs) auto\n  from this obtain pre_mgd where pre_mgd: \"(lookup (\\<lambda>k. k=n) tcs) = Some pre_mgd\"\n    by blast\n  have pre_mgd_mgd: \"map_of pre_mgd = mgd\"\n    by (metis l assms exe_ars_conds_def\n        exe_osig_conds_def in_alist_imp_in_map_of lookup_eq_map_of_ap map_of_SomeD option.sel\n        pre_mgd snd_conv translate_ars.simps)\n\n  {\n    fix c assume asm: \"c\\<in>S\"\n    \n    obtain Ss where Ss: \"lookup (\\<lambda>k. k=c) pre_mgd = Some Ss\"\n      using \\<open>c \\<in> S\\<close> \\<open>map_of pre_mgd = mgd\\<close> sub'_tcs' mgd assms Ty.prems has_sort.simps\n      by (auto simp add: dom_map_of_conv_image_fst domIff eq_fst_iff exe_ars_conds_def \n          map_of_eq_None_iff classes_translate lookup_eq_map_of_ap split: typ.splits\n          dest!: domD intro!: domI)\n    have l: \"length Ts = length Ss\"\n      using asm mgd pre_mgd Ty.prems assms sub'_tcs' Ss list_all2_lengthD pre_mgd_mgd\n      by (fastforce simp add: has_sort.simps lookup_eq_map_of_ap)\n\n    have 1: \"\\<forall>c \\<in> S. \\<exists>Ss . mgd c = Some Ss \\<and> list_all2 (has_sort (sub', tcs')) Ts Ss\"\n      using mgd Ty.prems has_sort.simps sub'_tcs' by auto\n\n    have cond: \"list_all2 (exehas_sort (sub,tcs)) Ts Ss\"\n      apply (rule list_all2_all_nthI)\n      using l apply simp\n      subgoal premises p for m \n        apply (rule Ty.IH)\n        using p apply simp\n        using p Ty.prems assms 1\n        by (metis Ss asm list_all2_conv_all_nth lookup_eq_map_of_ap option.sel pre_mgd_mgd sub'_tcs') \n      done\n    have \"(\\<forall>C \\<in> S.\n    case lookup (\\<lambda>k. k=C) pre_mgd of\n        None \\<Rightarrow> False\n      | Some Ss \\<Rightarrow> list_all2 (exehas_sort (sub,tcs)) Ts Ss)\"\n      by (metis \"1\" Ty.IH list_all2_conv_all_nth lookup_eq_map_of_ap nth_mem option.simps(5) \n        pre_mgd_mgd sub'_tcs')\n  }\n\n  then show ?case\n    using pre_mgd by simp\nnext\n  case (Tv n S)\n  then show ?case\n    using assms exesort_les_code has_sort_Tv_imp_sort_leq by fastforce\nqed\n\nlemma has_sort_code:\n  assumes \"exe_osig_conds oss\"\n  shows \"has_sort (translate_osig oss) T S = exehas_sort oss T S\"\n  by (metis assms exehas_sort_imp_has_sort has_sort_imp_exehas_sort prod.collapse)\n\nlemma has_sort_code':\n  assumes \"exe_wf_theory' \\<Theta>\"\n  shows \"has_sort (osig (sig (translate_theory \\<Theta>))) T S \n    = exehas_sort (exesorts (exesig \\<Theta>)) T S\"\n  apply (cases \\<Theta> rule: exetheory_full_exhaust) using assms has_sort_code by auto\n\nabbreviation \"exeinst_ok \\<Theta> insts \\<equiv> \n    distinct (map fst insts)\n  \\<and> list_all (exetyp_ok \\<Theta>) (map snd insts)\n  \\<and> list_all (\\<lambda>((idn, S), T) . exehas_sort (exesorts (exesig \\<Theta>)) T S) insts\"\n\nlemma inst_ok_code1:\n  assumes \"exe_wf_theory' \\<Theta>\"\n  shows \"list_all (exetyp_ok \\<Theta>) (map snd insts) = list_all (typ_ok (translate_theory \\<Theta>)) (map snd insts)\"\n  using assms typ_ok_code by (auto simp add: list_all_iff)\n\nlemma inst_ok_code2:\n  assumes \"exe_wf_theory' \\<Theta>\"\n  shows \"list_all (\\<lambda>((idn, S), T) . has_sort (osig (sig (translate_theory \\<Theta>))) T S) insts\n    = list_all (\\<lambda>((idn, S), T) . exehas_sort (exesorts (exesig \\<Theta>)) T S) insts\"\n  using has_sort_code' assms by auto\n\nlemma inst_ok_code:\n  assumes \"exe_wf_theory' \\<Theta>\"\n  shows \"inst_ok (translate_theory \\<Theta>) insts = exeinst_ok \\<Theta> insts\"\n  using inst_ok_code1 inst_ok_code2 assms by auto\n\ndefinition [simp]: \"exeterm_ok \\<Theta> t \\<equiv> exeterm_ok' (exesig \\<Theta>) t \\<and> typ_of t \\<noteq> None\"\nlemma term_ok_code:\n  assumes \"exe_wf_theory' \\<Theta>\"\n  shows \"term_ok (translate_theory \\<Theta>) t = exeterm_ok \\<Theta> t\"\n  using assms apply (cases \\<Theta> rule: exetheory_full_exhaust) \n  by (metis exe_sig_conds_def exe_wf_theory'.simps exeterm_ok_def exetheory.sel(1) \n      sig.simps term_okD1 term_okD2 term_okI wt_term_code translate_theory.simps)\n\nfun exereplay' :: \"exetheory \\<Rightarrow> (variable \\<times> typ) list \\<Rightarrow> variable set\n  \\<Rightarrow> term list \\<Rightarrow> proofterm \\<Rightarrow> term option\" where\n  \"exereplay' thy _ _ Hs (PAxm t Tis) = (if exeinst_ok thy Tis \\<and> exeterm_ok thy t\n    then if t \\<in> set (exeaxioms_of thy)\n      then Some (forall_intro_vars (subst_typ' Tis t) []) \n    else None else None)\"\n| \"exereplay' thy _ _ Hs (PBound n) = partial_nth Hs n\" \n| \"exereplay' thy vs ns Hs (Abst T p) = (if exetyp_ok thy T \n    then (let (s',ns') = variant_variable (Free STR ''default'') ns in \n      map_option (mk_all s' T) (exereplay' thy ((s', T) # vs) ns' Hs p))\n    else None)\"\n| \"exereplay' thy vs ns Hs (Appt p t) = \n    (let rep = exereplay' thy vs ns Hs p in\n    let t' = subst_bvs (map (\\<lambda>(x,y) . Fv x y) vs) t in\n      case (rep, typ_of t') of\n        (Some (Ct s (Ty fun1 [Ty fun2 [\\<tau>, Ty propT1 Nil], Ty propT2 Nil]) $ b), Some \\<tau>') \\<Rightarrow> \n          if s = STR ''Pure.all'' \\<and> fun1 = STR ''fun'' \\<and> fun2 = STR ''fun'' \n            \\<and> propT1 = STR ''prop'' \\<and> propT2 = STR ''prop''\n             \\<and> \\<tau>=\\<tau>' \\<and> exeterm_ok thy t'\n            then Some (b \\<bullet> t') else None\n      | _ \\<Rightarrow> None)\" \n| \"exereplay' thy vs ns Hs (AbsP t p) =\n    (let t' = subst_bvs (map (\\<lambda>(x,y) . Fv x y) vs) t in\n    let rep = exereplay' thy vs ns (t'#Hs) p in\n      (if typ_of t' = Some propT \\<and> exeterm_ok thy t' then map_option (mk_imp t') rep else None))\"\n| \"exereplay' thy vs ns Hs (AppP p1 p2) = \n    (let rep1 = Option.bind (exereplay' thy vs ns Hs p1) beta_eta_norm in\n    let rep2 = Option.bind (exereplay' thy vs ns Hs p2) beta_eta_norm in\n      (case (rep1, rep2) of (\n        Some (Ct imp (Ty fn1 [Ty prp1 [], Ty fn2 [Ty prp2 [], Ty prp3 []]]) $ A $ B),\n        Some A') \\<Rightarrow> \n          if imp = STR ''Pure.imp'' \\<and> fn1 = STR ''fun'' \\<and> fn2 = STR ''fun''\n            \\<and> prp1 = STR ''prop'' \\<and> prp2 = STR ''prop'' \\<and> prp3 = STR ''prop'' \\<and> A=A' \n          then Some B else None\n        | _ \\<Rightarrow> None))\"\n| \"exereplay' thy vs ns Hs (OfClass ty c) = (if exehas_sort (exesorts (exesig thy)) ty {c} \n    \\<and> exetyp_ok thy ty\n    then (case lookup (\\<lambda>k. k=const_of_class c) (execonst_type_of (exesig thy)) of \n      Some (Ty fun [Ty it [ity], Ty prop []]) \\<Rightarrow> \n        if ity = tvariable STR '''a'' \\<and> fun = STR ''fun'' \\<and> prop = STR ''prop'' \\<and> it = STR ''itself''\n          then Some (mk_of_class ty c) else None | _ \\<Rightarrow> None) else None)\"\n| \"exereplay' thy vs ns Hs (Hyp t) = (if t\\<in>set Hs then Some t else None)\"\n\nlemma of_class_code1: \n  assumes \"exe_wf_theory' thy\"\n  shows \"(has_sort (osig (sig (translate_theory thy))) ty {c} \\<and> typ_ok (translate_theory thy) ty)\n    = (exehas_sort (exesorts (exesig thy)) ty {c} \\<and> exetyp_ok thy ty)\"\nproof-\n  have \"has_sort (osig (sig (translate_theory thy))) ty {c}\n    = exehas_sort (exesorts (exesig thy)) ty {c}\"\n    using has_sort_code' assms by simp\n  moreover have \"typ_ok (translate_theory thy) ty = exetyp_ok thy ty\"\n    using typ_ok_code assms by simp\n  ultimately show ?thesis \n    by auto\nqed\n\nlemma of_class_code2: \n  assumes \"exe_wf_theory' thy\"\n  shows \"const_type (sig (translate_theory thy)) (const_of_class c) \n    = lookup (\\<lambda>k. k=const_of_class c) (execonst_type_of (exesig thy))\"\n  by (metis assms const_type_of_lookup_code exe_wf_theory_code \n      exe_wf_theory_translate_imp_wf_theory exetheory.sel(1) illformed_theory_not_wf_theory \n      sig.simps translate_theory.elims)\n\nlemma replay'_code:\n  assumes \"exe_wf_theory' thy\"\n  shows \"replay' (translate_theory thy) vs ns Hs P = exereplay' thy vs ns Hs P\"\nproof (induction P arbitrary: vs ns Hs)\n  case (PAxm ax tys)\n  have wf: \"wf_theory (translate_theory thy)\"\n    by (simp add: assms exe_wf_theory_code exe_wf_theory_translate_imp_wf_theory)\n  moreover have inst: \"inst_ok (translate_theory thy) tys \\<longleftrightarrow> exeinst_ok thy tys\"\n    by (simp add: assms inst_ok_code1 inst_ok_code2)\n  moreover have tok: \"term_ok (translate_theory thy) ax \\<longleftrightarrow> exeterm_ok thy ax\"\n    using assms term_ok_code by blast\n  moreover have ax: \"ax \\<in> axioms (translate_theory thy) \\<longleftrightarrow> ax \\<in> set (exeaxioms_of thy)\"\n    by (metis axioms.simps wf exetheory.sel(2) illformed_theory_not_wf_theory translate_theory.elims)\n  ultimately show ?case\n    by simp\nqed (use assms term_ok_code typ_ok_code of_class_code1 of_class_code2 \n      in \\<open>auto simp only: replay'.simps exereplay'.simps split: if_splits\\<close>)\n\nabbreviation \"exereplay'' thy vs ns Hs P \\<equiv> Option.bind (exereplay' thy vs ns Hs P) beta_eta_norm\"\nlemma replay''_code:\n  assumes \"exe_wf_theory' thy\"\n  shows \"replay'' (translate_theory thy) vs ns Hs P = exereplay'' thy vs ns Hs P\"\n  by (simp add: assms replay'_code)\n\ndefinition [simp]: \"exereplay thy P \\<equiv> \n  (if \\<forall>x\\<in>set (hyps P) . exeterm_ok thy x \\<and> typ_of x = Some propT then\n  exereplay'' thy [] (fst ` (fv_Proof P \\<union> FV (set (hyps P)))) (hyps P) P else None)\"\n\nlemma replay_code:\n  assumes \"exe_wf_theory' thy\"\n  shows \"replay (translate_theory thy) P = exereplay thy P\"\n  using assms replay''_code term_ok_code by auto\n\ndefinition \"exe_replay' e P = exereplay'' e [] (fst ` fv_Proof P) [] P\"\n\ndefinition \"exe_check_proof e P res \\<equiv> \n  exe_wf_theory' e \\<and> exereplay e P = Some res\"\n\nlemma exe_check_proof_iff_check_proof: \n  \"exe_check_proof e P res \\<longleftrightarrow> check_proof (translate_theory e) P res\"\n  using check_proof_def exe_check_proof_def wf_theory_translate_iff_exe_wf_theory \n  by (metis exe_wf_theory_code replay_code)\n\nlemma check_proof_sound:\n  shows \"exe_check_proof e P res \\<Longrightarrow> translate_theory e, set (hyps P) \\<turnstile> res\"\n  by (simp add: check_proof_sound exe_check_proof_iff_check_proof)\n\nlemma check_proof_really_sound:\n  shows \"exe_check_proof e P res \\<Longrightarrow> translate_theory e, set (hyps P) \\<tturnstile> res\"\n  by (simp add: check_proof_really_sound exe_check_proof_iff_check_proof)\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Metalogic_ProofChecker/CheckerExe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.33530069111387767}}
{"text": "theory flash24Bra  imports flash24Rev\n \n  begin\nlemma onInv24:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv24  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv24  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv24 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash24Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.33524264874042736}}
{"text": "theory CardArityTransformSafe\nimports ArityTransform CardinalityAnalysisSpec AbstractTransform Sestoft SestoftGC ArityEtaExpansionSafe ArityAnalysisStack  ArityConsistent\nbegin\n\ncontext CardinalityPrognosisSafe\nbegin\n  sublocale AbstractTransformBoundSubst\n    \"\\<lambda> a . inc\\<cdot>a\"\n    \"\\<lambda> a . pred\\<cdot>a\"\n    \"\\<lambda> \\<Delta> e a . (a, Aheap \\<Delta> e\\<cdot>a)\"\n    \"fst\"\n    \"snd\"\n    \"\\<lambda> _. 0\"\n    \"Aeta_expand\"\n    \"snd\"\n  apply standard\n  apply (simp add: Aheap_subst)\n  apply (rule subst_Aeta_expand)\n  done\n\n  abbreviation ccTransform where \"ccTransform \\<equiv> transform\"\n\n  lemma supp_transform: \"supp (transform a e) \\<subseteq> supp e\"\n    by (induction rule: transform.induct)\n       (auto simp add: exp_assn.supp Let_supp dest!: subsetD[OF supp_map_transform] subsetD[OF supp_map_transform_step] )\n  interpretation supp_bounded_transform transform\n    by standard (auto simp add: fresh_def supp_transform) \n\n  type_synonym tstate = \"(AEnv \\<times> (var \\<Rightarrow> two) \\<times> Arity \\<times> Arity list \\<times> var list)\"\n\n  fun transform_alts :: \"Arity list \\<Rightarrow> stack \\<Rightarrow> stack\"\n    where \n      \"transform_alts _ [] = []\"\n    | \"transform_alts (a#as) (Alts e1 e2 # S) = (Alts (ccTransform a e1) (ccTransform a e2)) # transform_alts as S\"\n    | \"transform_alts as (x # S) = x # transform_alts as S\"\n\n  lemma transform_alts_Nil[simp]: \"transform_alts [] S = S\"\n    by (induction  S) auto\n\n  lemma Astack_transform_alts[simp]:\n    \"Astack (transform_alts as S) = Astack S\"\n   by (induction rule: transform_alts.induct) auto\n\n  lemma fresh_star_transform_alts[intro]: \"a \\<sharp>* S \\<Longrightarrow> a \\<sharp>* transform_alts as S\"\n   by (induction as S  rule: transform_alts.induct) (auto simp add: fresh_star_Cons)\n\n  fun a_transform :: \"astate \\<Rightarrow> conf \\<Rightarrow> conf\"\n  where \"a_transform (ae, a, as) (\\<Gamma>, e, S) =\n    (map_transform Aeta_expand ae (map_transform ccTransform ae \\<Gamma>), \n     ccTransform a e,\n     transform_alts as  S)\"\n\n  fun restr_conf :: \"var set \\<Rightarrow> conf \\<Rightarrow> conf\"\n    where \"restr_conf V (\\<Gamma>, e, S) = (restrictA V \\<Gamma>, e, restr_stack V S)\"\n\n  fun add_dummies_conf :: \"var list \\<Rightarrow> conf \\<Rightarrow> conf\"\n    where \"add_dummies_conf l (\\<Gamma>, e, S) = (\\<Gamma>, e, S @ map Dummy (rev l))\"\n\n  fun conf_transform :: \"tstate \\<Rightarrow> conf \\<Rightarrow> conf\"\n  where \"conf_transform (ae, ce, a, as, r) c = add_dummies_conf r ((a_transform (ae, a, as) (restr_conf (- set r) c)))\"\n\n  inductive consistent :: \"tstate \\<Rightarrow> conf \\<Rightarrow> bool\" where\n    consistentI[intro!]: \n    \"a_consistent (ae, a, as) (restr_conf (- set r) (\\<Gamma>, e, S))\n    \\<Longrightarrow> edom ae = edom ce\n    \\<Longrightarrow> prognosis ae as a (\\<Gamma>, e, S) \\<sqsubseteq> ce\n    \\<Longrightarrow> (\\<And> x. x \\<in> thunks \\<Gamma> \\<Longrightarrow> many \\<sqsubseteq> ce x \\<Longrightarrow> ae x = up\\<cdot>0)\n    \\<Longrightarrow> set r \\<subseteq> (domA \\<Gamma> \\<union> upds S) - edom ce\n    \\<Longrightarrow> consistent (ae, ce, a, as, r) (\\<Gamma>, e, S)\"  \n  inductive_cases consistentE[elim!]: \"consistent (ae, ce, a, as) (\\<Gamma>, e, S)\"\n\n  lemma closed_consistent:\n    assumes \"fv e = ({}::var set)\"\n    shows \"consistent (\\<bottom>, \\<bottom>, 0, [], []) ([], e, [])\"\n  proof-\n    from assms\n    have \"edom (prognosis \\<bottom> [] 0 ([], e, [])) = {}\"\n     by (auto dest!: subsetD[OF edom_prognosis])\n    thus ?thesis\n      by (auto simp add: edom_empty_iff_bot closed_a_consistent[OF assms])\n  qed\n\n  lemma card_arity_transform_safe:\n    fixes c c'\n    assumes \"c \\<Rightarrow>\\<^sup>* c'\" and \"\\<not> boring_step c'\" and \"heap_upds_ok_conf c\" and \"consistent (ae,ce,a,as,r) c\"\n    shows \"\\<exists>ae' ce' a' as' r'. consistent (ae',ce',a',as',r') c' \\<and> conf_transform (ae,ce,a,as,r) c \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae',ce',a',as',r') c'\"\n  using assms(1,2) heap_upds_ok_invariant assms(3-)\n  proof(induction c c' arbitrary: ae ce a as r rule:step_invariant_induction)\n  case (app\\<^sub>1 \\<Gamma> e x S)\n    have \"prognosis ae as (inc\\<cdot>a) (\\<Gamma>, e, Arg x # S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, App e x, S)\" by (rule prognosis_App)\n    with app\\<^sub>1 have \"consistent (ae, ce, inc\\<cdot>a, as, r) (\\<Gamma>, e, Arg x # S)\"\n      by (auto intro: a_consistent_app\\<^sub>1 elim: below_trans)\n    moreover\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, App e x, S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, inc\\<cdot>a, as, r) (\\<Gamma>, e, Arg x # S)\"\n      by simp rule\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n  case (app\\<^sub>2 \\<Gamma> y e x S)\n    have \"prognosis ae as (pred\\<cdot>a) (\\<Gamma>, e[y::=x], S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, (Lam [y]. e), Arg x # S)\"\n       by (rule prognosis_subst_Lam)\n    then\n    have \"consistent (ae, ce, pred\\<cdot>a, as, r) (\\<Gamma>, e[y::=x], S)\" using app\\<^sub>2\n      by (auto 4 3 intro: a_consistent_app\\<^sub>2 elim: below_trans)\n    moreover\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Lam [y]. e, Arg x # S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, pred \\<cdot> a, as, r) (\\<Gamma>, e[y::=x], S)\" by (simp add: subst_transform[symmetric]) rule\n    ultimately\n    show ?case by (blast  del: consistentI consistentE)\n  next\n  case (thunk \\<Gamma> x e S)\n    hence \"x \\<in> thunks \\<Gamma>\" by auto\n    hence [simp]: \"x \\<in> domA \\<Gamma>\" by (rule subsetD[OF thunks_domA])\n\n    from thunk have \"prognosis ae as a (\\<Gamma>, Var x, S) \\<sqsubseteq> ce\" by auto\n    from below_trans[OF prognosis_called fun_belowD[OF this] ]\n    have [simp]: \"x \\<in> edom ce\" by (auto simp add: edom_def)\n    hence [simp]: \"x \\<notin> set r\" using thunk by auto\n\n    from \\<open>heap_upds_ok_conf (\\<Gamma>, Var x, S)\\<close>\n    have \"x \\<notin> upds S\" by (auto dest!:  heap_upds_okE)\n\n    have \"x \\<in> edom ae\" using thunk by auto\n    then obtain u where \"ae x = up\\<cdot>u\" by (cases \"ae x\") (auto simp add: edom_def)\n  \n\n    show ?case\n    proof(cases \"ce x\" rule:two_cases)\n      case none\n      with \\<open>x \\<in> edom ce\\<close> have False by (auto simp add: edom_def)\n      thus ?thesis..\n    next\n      case once\n\n      from \\<open>prognosis ae as a (\\<Gamma>, Var x, S) \\<sqsubseteq> ce\\<close>\n      have \"prognosis ae as a (\\<Gamma>, Var x, S) x \\<sqsubseteq> once\"\n        using once by (metis (mono_tags) fun_belowD)\n      hence \"x \\<notin> ap S\" using prognosis_ap[of ae as a \\<Gamma> \"(Var x)\" S] by auto\n      \n  \n      from \\<open>map_of \\<Gamma> x = Some e\\<close> \\<open>ae x = up\\<cdot>u\\<close> \\<open>\\<not> isVal e\\<close>\n      have *: \"prognosis ae as u (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> record_call x \\<cdot> (prognosis ae as a (\\<Gamma>, Var x, S))\"\n        by (rule prognosis_Var_thunk)\n  \n      from \\<open>prognosis ae as a (\\<Gamma>, Var x, S) x \\<sqsubseteq> once\\<close>\n      have \"(record_call x \\<cdot> (prognosis ae as a (\\<Gamma>, Var x, S))) x = none\"\n        by (simp add: two_pred_none)\n      hence **: \"prognosis ae as u (delete x \\<Gamma>, e, Upd x # S) x = none\" using fun_belowD[OF *, where x = x] by auto\n\n      have eq: \"prognosis (env_delete x ae) as u (delete x \\<Gamma>, e, Upd x # S) = prognosis ae as u (delete x \\<Gamma>, e, Upd x # S)\"\n        by (rule prognosis_env_cong) simp\n\n      have [simp]: \"restr_stack (- set r - {x}) S = restr_stack (- set r) S\"\n        using \\<open>x \\<notin> upds S\\<close> by (auto intro: restr_stack_cong)\n    \n      have \"prognosis (env_delete x ae) as u (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> env_delete x ce\"\n        unfolding eq\n        using ** below_trans[OF below_trans[OF * Cfun.monofun_cfun_arg[OF \\<open>prognosis ae as a (\\<Gamma>, Var x, S) \\<sqsubseteq> ce\\<close>]] record_call_below_arg]\n        by (rule below_env_deleteI)\n      moreover\n\n      have *: \"a_consistent (env_delete x ae, u, as) (delete x (restrictA (- set r) \\<Gamma>), e, restr_stack (- set r) S)\"\n        using thunk \\<open>ae x = up\\<cdot>u\\<close>\n        by (auto intro!: a_consistent_thunk_once simp del: restr_delete)\n      ultimately\n\n      have \"consistent (env_delete x ae, env_delete x ce, u, as, x # r) (delete x \\<Gamma>, e, Upd x # S)\" using thunk\n        by (auto simp add: restr_delete_twist Compl_insert elim:below_trans )\n      moreover\n\n      from *\n      have **: \"Astack (transform_alts as (restr_stack (- set r) S) @ map Dummy (rev r) @ [Dummy x]) \\<sqsubseteq> u\" by (auto elim: a_consistent_stackD)\n      \n      {\n      from  \\<open>map_of \\<Gamma> x = Some e\\<close> \\<open>ae x = up\\<cdot>u\\<close> once\n      have \"map_of (map_transform Aeta_expand ae (map_transform ccTransform ae (restrictA (- set r) \\<Gamma>))) x = Some (Aeta_expand u (transform u e))\"\n        by (simp add: map_of_map_transform)\n      hence \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sub>G\n             add_dummies_conf r (delete x (map_transform Aeta_expand ae (map_transform ccTransform ae (restrictA (- set r) \\<Gamma>))), Aeta_expand u (ccTransform u e), Upd x # transform_alts as (restr_stack (- set r) S))\"\n          by (auto simp add:  map_transform_delete delete_map_transform_env_delete insert_absorb restr_delete_twist simp del: restr_delete)\n      also\n      have \"\\<dots> \\<Rightarrow>\\<^sub>G\\<^sup>* add_dummies_conf (x # r) (delete x (map_transform Aeta_expand ae (map_transform ccTransform ae (restrictA (- set r) \\<Gamma>))), Aeta_expand u (ccTransform u e), transform_alts as (restr_stack (- set r) S))\"\n        apply (rule r_into_rtranclp)\n        apply (simp add: append_assoc[symmetric] del: append_assoc)\n        apply (rule dropUpd)\n        done\n      also\n      have \"\\<dots> \\<Rightarrow>\\<^sub>G\\<^sup>* add_dummies_conf (x # r) (delete x (map_transform Aeta_expand ae (map_transform ccTransform ae  (restrictA (- set r) \\<Gamma>))), ccTransform u e, transform_alts as (restr_stack (- set r) S))\"\n        by simp (intro  normal_trans Aeta_expand_safe **)\n      also(rtranclp_trans)\n      have \"\\<dots> = conf_transform (env_delete x ae, env_delete x ce, u, as, x # r) (delete x \\<Gamma>, e, Upd x # S)\" \n        by (auto intro!: map_transform_cong simp add:  map_transform_delete[symmetric]  restr_delete_twist Compl_insert)\n      finally(back_subst)\n      have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (env_delete x ae, env_delete x ce, u, as, x # r) (delete x \\<Gamma>, e, Upd x # S)\".\n      }\n      ultimately\n      show ?thesis by (blast del: consistentI consistentE)\n  \n    next\n      case many\n  \n      from \\<open>map_of \\<Gamma> x = Some e\\<close> \\<open>ae x = up\\<cdot>u\\<close> \\<open>\\<not> isVal e\\<close>\n      have \"prognosis ae as u (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> record_call x \\<cdot> (prognosis ae as a (\\<Gamma>, Var x, S))\"\n        by (rule prognosis_Var_thunk)\n      also note record_call_below_arg\n      finally\n      have *: \"prognosis ae as u (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, Var x, S)\" by this simp_all\n  \n      have \"ae x = up\\<cdot>0\" using thunk many \\<open>x \\<in> thunks \\<Gamma>\\<close> by (auto)\n      hence \"u = 0\" using \\<open>ae x = up\\<cdot>u\\<close> by simp\n  \n      \n      have \"prognosis ae as 0 (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> ce\" using *[unfolded \\<open>u=0\\<close>] thunk by (auto elim: below_trans)\n      moreover\n      have \"a_consistent (ae, 0, as) (delete x (restrictA (- set r) \\<Gamma>), e, Upd x # restr_stack (- set r) S)\" using thunk \\<open>ae x = up\\<cdot>0\\<close>\n        by (auto intro!: a_consistent_thunk_0 simp del: restr_delete)\n      ultimately\n      have \"consistent (ae, ce, 0, as, r) (delete x \\<Gamma>, e, Upd x # S)\" using thunk \\<open>ae x = up\\<cdot>u\\<close> \\<open>u = 0\\<close>\n        by (auto simp add:  restr_delete_twist)\n      moreover\n  \n      from  \\<open>map_of \\<Gamma> x = Some e\\<close> \\<open>ae x = up\\<cdot>0\\<close> many\n      have \"map_of (map_transform Aeta_expand ae (map_transform ccTransform ae (restrictA (- set r) \\<Gamma>))) x = Some (transform 0 e)\"\n        by (simp add: map_of_map_transform)\n      with \\<open>\\<not> isVal e\\<close>\n      have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, 0, as, r) (delete x \\<Gamma>, e, Upd x # S)\"\n        by (auto intro: gc_step.intros simp add: map_transform_delete restr_delete_twist intro!: step.intros  simp del: restr_delete)\n      ultimately\n      show ?thesis by (blast del: consistentI consistentE)\n    qed\n  next\n  case (lamvar \\<Gamma> x e S)\n    from lamvar(1) have [simp]: \"x \\<in> domA \\<Gamma>\" by (metis domI dom_map_of_conv_domA)\n\n    from lamvar have \"prognosis ae as a (\\<Gamma>, Var x, S) \\<sqsubseteq> ce\" by auto\n    from below_trans[OF prognosis_called fun_belowD[OF this] ]\n    have [simp]: \"x \\<in> edom ce\" by (auto simp add: edom_def)\n    then obtain c where \"ce x = up\\<cdot>c\" by (cases \"ce x\") (auto simp add: edom_def)\n\n    from lamvar\n    have [simp]: \"x \\<notin> set r\" by auto\n\n    then have \"x \\<in> edom ae\" using lamvar by auto\n    then obtain  u where \"ae x = up\\<cdot>u\"  by (cases \"ae x\") (auto simp add: edom_def)\n\n\n    have \"prognosis ae as u ((x, e) # delete x \\<Gamma>, e, S) = prognosis ae as u (\\<Gamma>, e, S)\"\n      using \\<open>map_of \\<Gamma> x = Some e\\<close> by (auto intro!: prognosis_reorder)\n    also have \"\\<dots> \\<sqsubseteq> record_call x \\<cdot> (prognosis ae as a (\\<Gamma>, Var x, S))\"\n       using \\<open>map_of \\<Gamma> x = Some e\\<close> \\<open>ae x = up\\<cdot>u\\<close> \\<open>isVal e\\<close>  by (rule prognosis_Var_lam)\n    also have \"\\<dots> \\<sqsubseteq> prognosis ae as a (\\<Gamma>, Var x, S)\" by (rule record_call_below_arg)\n    finally have *: \"prognosis ae as u ((x, e) # delete x \\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, Var x, S)\" by this simp_all\n    moreover\n    have \"a_consistent (ae, u, as) ((x,e) # delete x (restrictA (- set r) \\<Gamma>), e, restr_stack (- set r) S)\" using lamvar \\<open>ae x = up\\<cdot>u\\<close>\n      by (auto intro!: a_consistent_lamvar simp del: restr_delete)\n    ultimately\n    have \"consistent (ae, ce, u, as, r) ((x, e) # delete x \\<Gamma>, e, S)\"\n      using lamvar edom_mono[OF *] by (auto simp add:  thunks_Cons restr_delete_twist elim: below_trans)\n    moreover\n\n    from \\<open>a_consistent _ _\\<close>\n    have **: \"Astack (transform_alts as (restr_stack (- set r) S) @ map Dummy (rev r)) \\<sqsubseteq> u\" by (auto elim: a_consistent_stackD) \n\n    {\n    from \\<open>isVal e\\<close>\n    have \"isVal (transform u e)\" by simp\n    hence \"isVal (Aeta_expand u (transform u e))\" by (rule isVal_Aeta_expand)\n    moreover\n    from  \\<open>map_of \\<Gamma> x = Some e\\<close>  \\<open>ae x = up \\<cdot> u\\<close> \\<open>ce x = up\\<cdot>c\\<close> \\<open>isVal (transform u e)\\<close>\n    have \"map_of (map_transform Aeta_expand ae (map_transform transform ae (restrictA (- set r) \\<Gamma>))) x = Some (Aeta_expand u (transform u e))\"\n      by (simp add: map_of_map_transform)\n    ultimately\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sub>G\\<^sup>*\n          add_dummies_conf r ((x, Aeta_expand u (transform u e)) # delete x (map_transform Aeta_expand ae (map_transform transform ae (restrictA (- set r) \\<Gamma>))), Aeta_expand u (transform u e), transform_alts as (restr_stack (- set r) S))\"\n       by (auto intro!: normal_trans[OF lambda_var] simp add: map_transform_delete simp del: restr_delete)\n    also have \"\\<dots> = add_dummies_conf r ((map_transform Aeta_expand ae (map_transform transform ae ((x,e) # delete x (restrictA (- set r) \\<Gamma>)))), Aeta_expand u  (transform u e), transform_alts as (restr_stack (- set r) S))\"\n      using \\<open>ae x = up \\<cdot> u\\<close> \\<open>ce x = up\\<cdot>c\\<close> \\<open>isVal (transform u e)\\<close>\n      by (simp add: map_transform_Cons map_transform_delete restr_delete_twist del: restr_delete)\n    also(subst[rotated]) have \"\\<dots> \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae, ce, u, as, r) ((x, e) # delete x \\<Gamma>, e, S)\"\n      by (simp add: restr_delete_twist) (rule normal_trans[OF Aeta_expand_safe[OF ** ]])\n    finally(rtranclp_trans)\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae, ce, u, as, r) ((x, e) # delete x \\<Gamma>, e, S)\".\n    }\n    ultimately show ?case by (blast del: consistentI consistentE)\n  next\n  case (var\\<^sub>2 \\<Gamma> x e S)\n    show ?case\n    proof(cases \"x \\<in> set r\")\n      case [simp]: False\n\n      from var\\<^sub>2\n      have \"a_consistent (ae, a, as) (restrictA (- set r) \\<Gamma>, e, Upd x # restr_stack (-set r) S)\" by auto\n      from a_consistent_UpdD[OF this]\n      have \"ae x = up\\<cdot>0\" and \"a = 0\".\n  \n      from \\<open>isVal e\\<close> \\<open>x \\<notin> domA \\<Gamma>\\<close>\n      have *: \"prognosis ae as 0 ((x, e) # \\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as 0 (\\<Gamma>, e, Upd x # S)\" by (rule prognosis_Var2)\n      moreover\n      have \"a_consistent (ae, a, as) ((x, e) # restrictA (- set r) \\<Gamma>, e, restr_stack (- set r) S)\"\n        using var\\<^sub>2 by (auto intro!: a_consistent_var\\<^sub>2)\n      ultimately\n      have \"consistent (ae, ce, 0, as, r) ((x, e) # \\<Gamma>, e, S)\"\n        using var\\<^sub>2 \\<open>a = 0\\<close>\n        by (auto simp add: thunks_Cons elim: below_trans)\n      moreover\n      have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, e, Upd x # S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, 0, as, r) ((x, e) # \\<Gamma>, e, S)\"\n        using \\<open>ae x = up\\<cdot>0\\<close> \\<open>a = 0\\<close> var\\<^sub>2 \n        by (auto intro: gc_step.intros simp add: map_transform_Cons)\n      ultimately show ?thesis by (blast del: consistentI consistentE)\n    next\n      case True\n      hence \"ce x = \\<bottom>\" using var\\<^sub>2 by (auto simp add: edom_def)\n      hence \"x \\<notin> edom ce\" by (simp add: edomIff)\n      hence \"x \\<notin> edom ae\" using var\\<^sub>2 by auto\n      hence [simp]: \"ae x = \\<bottom>\" by (auto simp add: edom_def)\n\n      note  \\<open>x \\<in> set r\\<close>[simp]\n      \n      have \"prognosis ae as a ((x, e) # \\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as a ((x, e) # \\<Gamma>, e, Upd x # S)\" by (rule prognosis_upd)\n      also have \"\\<dots> \\<sqsubseteq> prognosis ae as a (delete x ((x,e) # \\<Gamma>), e, Upd x # S)\"\n        using \\<open>ae x = \\<bottom>\\<close> by (rule prognosis_not_called)\n      also have \"delete x ((x,e)#\\<Gamma>) = \\<Gamma>\" using \\<open>x \\<notin> domA \\<Gamma>\\<close> by simp\n      finally\n      have *: \"prognosis ae as a ((x, e) # \\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, e, Upd x # S)\" by this simp\n      then\n      have \"consistent (ae, ce, a, as, r) ((x, e) # \\<Gamma>, e, S)\" using var\\<^sub>2\n        by (auto simp add: thunks_Cons  elim:below_trans a_consistent_var\\<^sub>2)\n      moreover\n      have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, e, Upd x # S) = conf_transform (ae, ce, a, as, r) ((x, e) # \\<Gamma>, e, S)\"\n        by (auto simp add: map_transform_restrA[symmetric])\n      ultimately show ?thesis\n        by (fastforce del: consistentI consistentE simp del:conf_transform.simps)\n    qed\n  next\n    case (let\\<^sub>1 \\<Delta> \\<Gamma> e S)\n    let ?ae = \"Aheap \\<Delta> e\\<cdot>a\"\n    let ?ce = \"cHeap \\<Delta> e\\<cdot>a\"\n  \n    have \"domA \\<Delta> \\<inter> upds S = {}\" using fresh_distinct_fv[OF let\\<^sub>1(2)] by (auto dest: subsetD[OF ups_fv_subset])\n    hence *: \"\\<And> x. x \\<in> upds S \\<Longrightarrow> x \\<notin> edom ?ae\" by (auto simp add: edom_cHeap dest!: subsetD[OF edom_Aheap])\n    have restr_stack_simp2: \"restr_stack (edom (?ae \\<squnion> ae)) S = restr_stack (edom ae) S\"\n      by (auto intro: restr_stack_cong dest!: *)\n\n    have \"edom ce = edom ae\" using let\\<^sub>1 by auto\n  \n    have \"edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S\" using let\\<^sub>1 by (auto dest!: a_consistent_edom_subsetD)\n    from subsetD[OF this] fresh_distinct[OF let\\<^sub>1(1)] fresh_distinct_fv[OF let\\<^sub>1(2)]\n    have \"edom ae \\<inter> domA \\<Delta> = {}\" by (auto dest: subsetD[OF ups_fv_subset])\n\n    from \\<open>edom ae \\<inter> domA \\<Delta> = {}\\<close>\n    have [simp]: \"edom (Aheap \\<Delta> e\\<cdot>a) \\<inter> edom ae = {}\" by (auto dest!: subsetD[OF edom_Aheap]) \n\n    from fresh_distinct[OF let\\<^sub>1(1)]\n    have [simp]: \"restrictA (edom ae \\<union> edom (Aheap \\<Delta> e\\<cdot>a)) \\<Gamma> = restrictA (edom ae) \\<Gamma>\"\n      by (auto intro: restrictA_cong dest!: subsetD[OF edom_Aheap]) \n\n    have \"set r \\<subseteq> domA \\<Gamma> \\<union> upds S\" using let\\<^sub>1 by auto\n    have [simp]: \"restrictA (- set r) \\<Delta> = \\<Delta>\"\n      apply (rule restrictA_noop)\n      apply auto\n      by (metis IntI UnE \\<open>set r \\<subseteq> domA \\<Gamma> \\<union> upds S\\<close> \\<open>domA \\<Delta> \\<inter> domA \\<Gamma> = {}\\<close> \\<open>domA \\<Delta> \\<inter> upds S = {}\\<close> contra_subsetD empty_iff)\n\n    {\n    have \"edom (?ae \\<squnion> ae) = edom (?ce \\<squnion> ce)\"\n      using let\\<^sub>1(4) by (auto simp add: edom_cHeap)\n    moreover\n    { fix x e'\n      assume \"x \\<in> thunks \\<Gamma>\"\n      hence \"x \\<notin> edom ?ce\" using fresh_distinct[OF let\\<^sub>1(1)]\n        by (auto simp add: edom_cHeap dest: subsetD[OF edom_Aheap]  subsetD[OF thunks_domA])\n      hence [simp]: \"?ce x = \\<bottom>\" unfolding edomIff by auto\n    \n      assume \"many \\<sqsubseteq> (?ce \\<squnion> ce) x\"\n      with let\\<^sub>1 \\<open>x \\<in> thunks \\<Gamma>\\<close>\n      have \"(?ae \\<squnion> ae) x = up \\<cdot>0\" by auto\n    }\n    moreover\n    { fix x e'\n      assume \"x \\<in> thunks \\<Delta>\" \n      hence \"x \\<notin> domA \\<Gamma>\" and \"x \\<notin> upds S\"\n        using fresh_distinct[OF let\\<^sub>1(1)] fresh_distinct_fv[OF let\\<^sub>1(2)]\n        by (auto dest!: subsetD[OF thunks_domA] subsetD[OF ups_fv_subset])\n      hence \"x \\<notin> edom ce\" using \\<open>edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S\\<close> \\<open>edom ce = edom ae\\<close> by auto\n      hence [simp]: \"ce x = \\<bottom>\"  by (auto simp add: edomIff)\n  \n      assume \"many \\<sqsubseteq> (?ce \\<squnion> ce) x\" with \\<open>x \\<in> thunks \\<Delta>\\<close>\n      have \"(?ae \\<squnion> ae) x = up\\<cdot>0\" by (auto simp add: Aheap_heap3)\n    }\n    moreover\n    {\n    from let\\<^sub>1(1,2) \\<open>edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S\\<close>\n    have \"prognosis (?ae \\<squnion> ae) as a (\\<Delta> @ \\<Gamma>, e, S) \\<sqsubseteq> ?ce \\<squnion> prognosis ae as a (\\<Gamma>, Let \\<Delta> e, S)\" by (rule prognosis_Let)\n    also have \"prognosis ae as a (\\<Gamma>, Let \\<Delta> e, S) \\<sqsubseteq> ce\" using let\\<^sub>1 by auto\n    finally have \"prognosis (?ae \\<squnion> ae) as a (\\<Delta> @ \\<Gamma>, e, S) \\<sqsubseteq> ?ce \\<squnion> ce\" by this simp\n    }\n    moreover\n\n    have \"a_consistent (ae, a, as) (restrictA (- set r) \\<Gamma>, Let \\<Delta> e, restr_stack (- set r) S)\"\n      using let\\<^sub>1 by auto\n    hence \"a_consistent (?ae \\<squnion> ae, a, as) (\\<Delta> @ restrictA (- set r) \\<Gamma>, e, restr_stack (- set r) S)\"\n      using let\\<^sub>1(1,2) \\<open>edom ae \\<inter> domA \\<Delta> = {}\\<close> \n      by (auto intro!:  a_consistent_let simp del: join_comm)\n    hence \"a_consistent (?ae \\<squnion> ae, a, as) (restrictA (- set r) (\\<Delta> @ \\<Gamma>), e, restr_stack (- set r) S)\"\n      by (simp add: restrictA_append)\n    moreover\n    have  \"set r \\<subseteq> (domA \\<Gamma> \\<union> upds S) - edom ce\" using let\\<^sub>1 by auto\n    hence  \"set r \\<subseteq> (domA \\<Gamma> \\<union> upds S) - edom (?ce \\<squnion> ce)\"\n      apply (rule order_trans)\n      using \\<open>domA \\<Delta> \\<inter> domA \\<Gamma> = {}\\<close> \\<open>domA \\<Delta> \\<inter> upds S = {}\\<close> \n      apply (auto simp add: edom_cHeap dest!: subsetD[OF edom_Aheap])\n      done\n    ultimately\n    have \"consistent (?ae \\<squnion> ae, ?ce \\<squnion> ce, a, as, r) (\\<Delta> @ \\<Gamma>, e, S)\" by auto\n    }\n    moreover\n    {\n      have \"\\<And> x. x \\<in> domA \\<Gamma> \\<Longrightarrow> x \\<notin> edom ?ae\" \"\\<And> x. x \\<in> domA \\<Gamma> \\<Longrightarrow> x \\<notin> edom ?ce\"\n        using fresh_distinct[OF let\\<^sub>1(1)]\n        by (auto simp add: edom_cHeap dest!: subsetD[OF edom_Aheap])\n      hence \"map_transform Aeta_expand (?ae \\<squnion> ae) (map_transform transform (?ae \\<squnion> ae) (restrictA (-set r) \\<Gamma>))\n         = map_transform Aeta_expand ae (map_transform transform ae (restrictA (-set r) \\<Gamma>))\"\n         by (auto intro!: map_transform_cong restrictA_cong simp add: edomIff)\n      moreover\n  \n      from \\<open>edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S\\<close> \\<open>edom ce = edom ae\\<close>\n      have \"\\<And> x. x \\<in> domA \\<Delta> \\<Longrightarrow> x \\<notin> edom ce\" and  \"\\<And> x. x \\<in> domA \\<Delta> \\<Longrightarrow> x \\<notin> edom ae\"\n         using fresh_distinct[OF let\\<^sub>1(1)] fresh_distinct_ups[OF let\\<^sub>1(2)]  by auto\n      hence \"map_transform Aeta_expand (?ae \\<squnion> ae) (map_transform transform (?ae \\<squnion> ae) (restrictA (- set r) \\<Delta>))\n         = map_transform Aeta_expand ?ae (map_transform transform ?ae (restrictA (- set r) \\<Delta>))\"\n         by (auto intro!: map_transform_cong restrictA_cong simp add: edomIff)\n      moreover\n            \n      from  \\<open>domA \\<Delta> \\<inter> domA \\<Gamma> = {}\\<close>   \\<open>domA \\<Delta> \\<inter> upds S = {}\\<close>\n      have \"atom ` domA \\<Delta> \\<sharp>* set r\"\n        by (auto simp add: fresh_star_def fresh_at_base fresh_finite_set_at_base dest!: subsetD[OF \\<open>set r \\<subseteq> domA \\<Gamma> \\<union> upds S\\<close>])\n      hence \"atom ` domA \\<Delta> \\<sharp>* map Dummy (rev r)\" \n        apply -\n        apply (rule eqvt_fresh_star_cong1[where f = \"map Dummy\"], perm_simp, rule)\n        apply (rule eqvt_fresh_star_cong1[where f = \"rev\"], perm_simp, rule)\n        apply (auto simp add: fresh_star_def fresh_set)\n        done\n      ultimately\n      \n      \n      have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Let \\<Delta> e, S) \\<Rightarrow>\\<^sub>G conf_transform (?ae \\<squnion> ae, ?ce \\<squnion> ce, a, as, r) (\\<Delta> @ \\<Gamma>, e, S)\"\n        using restr_stack_simp2 let\\<^sub>1(1,2)  \\<open>edom ce = edom ae\\<close>\n        apply (auto simp add: map_transform_append restrictA_append edom_cHeap restr_stack_simp2[simplified] )\n        apply (rule normal)\n        apply (rule step.let\\<^sub>1)\n        apply (auto intro: normal step.let\\<^sub>1 dest: subsetD[OF edom_Aheap] simp add: fresh_star_list)\n        done\n    }\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case (if\\<^sub>1 \\<Gamma> scrut e1 e2 S)\n    have \"prognosis ae as a (\\<Gamma>, scrut ? e1 : e2, S) \\<sqsubseteq> ce\" using if\\<^sub>1 by auto\n    hence \"prognosis ae (a#as) 0 (\\<Gamma>, scrut, Alts e1 e2 # S) \\<sqsubseteq> ce\"\n      by (rule below_trans[OF prognosis_IfThenElse])\n    hence \"consistent (ae, ce, 0, a#as, r) (\\<Gamma>, scrut, Alts e1 e2 # S)\"\n      using if\\<^sub>1  by (auto dest: a_consistent_if\\<^sub>1)\n    moreover\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, scrut ? e1 : e2, S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, 0, a#as, r) (\\<Gamma>, scrut, Alts e1 e2 # S)\"\n      by (auto intro: normal step.intros)\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case (if\\<^sub>2 \\<Gamma> b e1 e2 S)\n    hence \"a_consistent (ae, a, as) (restrictA (- set r) \\<Gamma>, Bool b, Alts e1 e2 # restr_stack (-set r) S)\" by auto\n    then  obtain a' as' where [simp]: \"as = a' # as'\" \"a = 0\"\n      by (rule a_consistent_alts_on_stack)\n\n    {\n    have \"prognosis ae (a'#as') 0 (\\<Gamma>, Bool b, Alts e1 e2 # S) \\<sqsubseteq> ce\" using if\\<^sub>2 by auto\n    hence \"prognosis ae as' a' (\\<Gamma>, if b then e1 else e2, S) \\<sqsubseteq> ce\" by (rule below_trans[OF prognosis_Alts])\n    then\n    have \"consistent (ae, ce, a', as', r) (\\<Gamma>, if b then e1 else e2, S)\" \n      using if\\<^sub>2 by (auto dest!: a_consistent_if\\<^sub>2)\n    }\n    moreover\n    have \"conf_transform (ae, ce, a, as, r) (\\<Gamma>, Bool b, Alts e1 e2 # S) \\<Rightarrow>\\<^sub>G conf_transform (ae, ce, a', as', r) (\\<Gamma>, if b then e1 else e2, S)\"\n      by (auto intro: normal step.if\\<^sub>2[where b = True, simplified] step.if\\<^sub>2[where b = False, simplified])\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case refl thus ?case by force\n  next\n    case (trans c c' c'')\n      from trans(3)[OF trans(5)]\n      obtain ae' ce' a' as' r'\n      where \"consistent (ae', ce', a', as', r') c'\" and *: \"conf_transform (ae, ce, a, as, r) c \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae', ce', a', as', r') c'\" by blast\n      from trans(4)[OF this(1)]\n      obtain ae'' ce'' a'' as'' r''\n      where \"consistent (ae'', ce'', a'', as'', r'') c''\" and **: \"conf_transform (ae', ce', a', as', r') c' \\<Rightarrow>\\<^sub>G\\<^sup>* conf_transform (ae'', ce'', a'', as'', r'') c''\" by blast\n      from this(1) rtranclp_trans[OF * **]\n      show ?case by blast\n  qed\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/CardArityTransformSafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.33524264874042736}}
{"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      Semantic.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Big-Step Semantics for Simpl *}\ntheory Semantic imports Language begin\n\nnotation\nrestrict_map  (\"_|\\<^bsub>_\\<^esub>\" [90, 91] 90)\n\n\ndatatype ('s,'f) xstate = Normal 's | Abrupt 's | Fault 'f | Stuck\n\ndefinition isAbr::\"('s,'f) xstate \\<Rightarrow> bool\"\n  where \"isAbr S = (\\<exists>s. S=Abrupt s)\"\n \nlemma isAbr_simps [simp]:\n\"isAbr (Normal s) = False\"\n\"isAbr (Abrupt s) = True\"\n\"isAbr (Fault f) = False\"\n\"isAbr Stuck = False\"\nby (auto simp add: isAbr_def)\n\nlemma isAbrE [consumes 1, elim?]: \"\\<lbrakk>isAbr S; \\<And>s. S=Abrupt s \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp add: isAbr_def)\n\nlemma not_isAbrD: \n\"\\<not> isAbr s \\<Longrightarrow> (\\<exists>s'. s=Normal s') \\<or> s = Stuck \\<or> (\\<exists>f. s=Fault f)\"\n  by (cases s) auto\n\ndefinition isFault:: \"('s,'f) xstate \\<Rightarrow> bool\"\n  where \"isFault S = (\\<exists>f. S=Fault f)\"\n\nlemma isFault_simps [simp]:\n\"isFault (Normal s) = False\"\n\"isFault (Abrupt s) = False\"\n\"isFault (Fault f) = True\"\n\"isFault Stuck = False\"\nby (auto simp add: isFault_def)\n\nlemma isFaultE [consumes 1, elim?]: \"\\<lbrakk>isFault s; \\<And>f. s=Fault f \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp add: isFault_def)\n\nlemma not_isFault_iff: \"(\\<not> isFault t) = (\\<forall>f. t \\<noteq> Fault f)\"\n  by (auto elim: isFaultE)\n\n(* ************************************************************************* *)\nsubsection {* Big-Step Execution: @{text \"\\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> \\<Rightarrow> t\"} *}\n(* ************************************************************************* *)\n\ntext {* The procedure environment *}\ntype_synonym ('s,'p,'f) body = \"'p \\<Rightarrow> ('s,'p,'f) com option\"\n\ninductive \n  \"exec\"::\"[('s,'p,'f) body,('s,'p,'f) com,('s,'f) xstate,('s,'f) xstate] \n                    \\<Rightarrow> bool\" (\"_\\<turnstile> \\<langle>_,_\\<rangle> \\<Rightarrow> _\"  [60,20,98,98] 89)\n  for \\<Gamma>::\"('s,'p,'f) body\"\nwhere\n  Skip: \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> \\<Rightarrow> Normal s\"\n \n| Guard: \"\\<lbrakk>s\\<in>g; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk> \n          \\<Longrightarrow> \n          \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| GuardFault: \"s\\<notin>g \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>  Fault f\"\n\n| FaultProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> \\<Rightarrow>  Fault f\" \n\n| Basic: \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> \\<Rightarrow>  Normal (f s)\"\n\n| Spec: \"(s,t) \\<in> r \n         \\<Longrightarrow> \n         \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> \\<Rightarrow>  Normal t\"\n\n| SpecStuck: \"\\<forall>t. (s,t) \\<notin> r \n              \\<Longrightarrow> \n              \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> \\<Rightarrow>  Stuck\"\n\n| Seq: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>  s'; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,s'\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>\\<turnstile>\\<langle>Seq c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\" \n\n| CondTrue: \"\\<lbrakk>s \\<in> b; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk> \n             \\<Longrightarrow>  \n             \\<Gamma>\\<turnstile>\\<langle>Cond b c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| CondFalse: \"\\<lbrakk>s \\<notin> b; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk> \n              \\<Longrightarrow>  \n              \\<Gamma>\\<turnstile>\\<langle>Cond b c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| WhileTrue: \"\\<lbrakk>s \\<in> b; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>  s'; \\<Gamma>\\<turnstile>\\<langle>While b c,s'\\<rangle> \\<Rightarrow>  t\\<rbrakk> \n              \\<Longrightarrow>  \n              \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| WhileFalse: \"\\<lbrakk>s \\<notin> b\\<rbrakk> \n               \\<Longrightarrow>  \n               \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>  Normal s\"\n\n| Call:  \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk> \n          \\<Longrightarrow> \n          \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \n| CallUndefined: \"\\<lbrakk>\\<Gamma> p=None\\<rbrakk> \n                  \\<Longrightarrow> \n                  \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>  Stuck\"\n\n| StuckProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> \\<Rightarrow>  Stuck\"\n\n| DynCom:  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>(c s),Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk> \n             \\<Longrightarrow> \n             \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>  t\"\n\n| Throw: \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> \\<Rightarrow>  Abrupt s\"\n\n| AbruptProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> \\<Rightarrow>  Abrupt s\"\n  \n| CatchMatch: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>  Abrupt s'; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s'\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n               \\<Longrightarrow>\n               \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\" \n| CatchMiss: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>  t; \\<not>isAbr t\\<rbrakk>\n               \\<Longrightarrow>\n               \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>  t\" \n\ninductive_cases exec_elim_cases [cases set]:\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Skip,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Basic f,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Spec r,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>While b c,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Call p,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Throw,s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,s\\<rangle> \\<Rightarrow>  t\"\n\n\ninductive_cases exec_Normal_elim_cases [cases set]: \n  \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> \\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s\\<rangle> \\<Rightarrow>  t\"\n\nlemma exec_block: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Normal t; \\<Gamma>\\<turnstile>\\<langle>c s t,Normal (return s t)\\<rangle> \\<Rightarrow>  u\\<rbrakk>\n  \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> \\<Rightarrow>  u\"\napply (unfold block_def)\nby (fastforce intro: exec.intros)\n\nlemma exec_blockAbrupt: \n     \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Abrupt t\\<rbrakk>\n       \\<Longrightarrow> \n       \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> \\<Rightarrow>  Abrupt (return s t)\"\napply (unfold block_def)\nby (fastforce intro: exec.intros)\n\nlemma exec_blockFault: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Fault f\\<rbrakk>\n   \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> \\<Rightarrow>  Fault f\"\napply (unfold block_def)\nby (fastforce intro: exec.intros)\n\nlemma exec_blockStuck:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Stuck\\<rbrakk>\n  \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> \\<Rightarrow>  Stuck\"\napply (unfold block_def)\nby (fastforce intro: exec.intros)\n\nlemma exec_call:   \n \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Normal t; \\<Gamma>\\<turnstile>\\<langle>c s t,Normal (return s t)\\<rangle> \\<Rightarrow>  u\\<rbrakk> \n  \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  u\"\napply (simp add: call_def)\napply (rule exec_block)\napply  (erule (1) Call)\napply assumption\ndone\n\n\nlemma exec_callAbrupt: \n \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Abrupt t\\<rbrakk> \n  \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  Abrupt (return s t)\"\napply (simp add: call_def)\napply (rule exec_blockAbrupt)\napply (erule (1) Call)\ndone\n\nlemma exec_callFault: \n             \"\\<lbrakk>\\<Gamma> p=Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Fault f\\<rbrakk> \n               \\<Longrightarrow> \n              \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  Fault f\"\napply (simp add: call_def)\napply (rule exec_blockFault)\napply (erule (1) Call)\ndone\n\nlemma exec_callStuck: \n          \"\\<lbrakk>\\<Gamma> p=Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Stuck\\<rbrakk> \n           \\<Longrightarrow> \n           \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  Stuck\"\napply (simp add: call_def)\napply (rule exec_blockStuck)\napply (erule (1) Call)\ndone\n\nlemma  exec_callUndefined: \n       \"\\<lbrakk>\\<Gamma> p=None\\<rbrakk> \n        \\<Longrightarrow> \n        \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  Stuck\"\napply (simp add: call_def)\napply (rule exec_blockStuck)\napply (erule CallUndefined)\ndone\n\n\nlemma Fault_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>  t\" and s: \"s=Fault f\" \n  shows \"t=Fault f\"\nusing exec s by (induct) auto\n\nlemma Stuck_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>  t\" and s: \"s=Stuck\" \n  shows \"t=Stuck\"\nusing exec s by (induct) auto\n\nlemma Abrupt_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>  t\" and s: \"s=Abrupt s'\" \n  shows \"t=Abrupt s'\"\nusing exec s by (induct) auto\n\nlemma exec_Call_body_aux: \n  \"\\<Gamma> p=Some bdy \\<Longrightarrow> \n   \\<Gamma>\\<turnstile>\\<langle>Call p,s\\<rangle> \\<Rightarrow> t = \\<Gamma>\\<turnstile>\\<langle>bdy,s\\<rangle> \\<Rightarrow> t\"\napply (rule)\napply (fastforce elim: exec_elim_cases )\napply (cases s)\napply   (cases t)\napply (auto intro: exec.intros dest: Fault_end Stuck_end Abrupt_end)\ndone\n\nlemma exec_Call_body':\n  \"p \\<in> dom \\<Gamma> \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>Call p,s\\<rangle> \\<Rightarrow> t = \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),s\\<rangle> \\<Rightarrow> t\"\n  apply clarsimp\n  by (rule exec_Call_body_aux)\n\n\n\nlemma exec_block_Normal_elim [consumes 1]:\nassumes exec_block: \"\\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> \\<Rightarrow>  t\"\nassumes Normal:\n \"\\<And>t'.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Normal t';\n     \\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Abrupt: \n \"\\<And>t'.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Abrupt t'; \n     t = Abrupt (return s t')\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Fault:\n \"\\<And>f.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Fault f; \n     t = Fault f\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Stuck:\n \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Stuck; \n     t = Stuck\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes \n \"\\<lbrakk>\\<Gamma> p = None; t = Stuck\\<rbrakk> \\<Longrightarrow> P\"\nshows \"P\"\n  using exec_block\napply (unfold block_def)\napply (elim exec_Normal_elim_cases)\napply simp_all\napply  (case_tac s')\napply     simp_all\napply     (elim exec_Normal_elim_cases)\napply     simp\napply    (drule Abrupt_end) apply simp \napply    (erule exec_Normal_elim_cases)\napply    simp  \napply    (rule Abrupt,assumption+)\napply   (drule Fault_end) apply simp\napply   (erule exec_Normal_elim_cases)\napply   simp\napply  (drule Stuck_end) apply simp\napply  (erule exec_Normal_elim_cases)\napply  simp\napply (case_tac s')\napply    simp_all\napply   (elim exec_Normal_elim_cases)\napply   simp\napply   (rule Normal, assumption+)\napply  (drule Fault_end) apply simp\napply  (rule Fault,assumption+) \napply (drule Stuck_end) apply simp\napply (rule Stuck,assumption+)\ndone\n\nlemma exec_call_Normal_elim [consumes 1]:\nassumes exec_call: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> \\<Rightarrow>  t\"\nassumes Normal:\n \"\\<And>bdy t'.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Normal t';\n     \\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> \\<Rightarrow>  t\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Abrupt:\n \"\\<And>bdy t'.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Abrupt t'; \n     t = Abrupt (return s t')\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Fault:\n \"\\<And>bdy f.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Fault f; \n     t = Fault f\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Stuck:\n \"\\<And>bdy.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> \\<Rightarrow>  Stuck; \n     t = Stuck\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Undef:\n \"\\<lbrakk>\\<Gamma> p = None; t = Stuck\\<rbrakk> \\<Longrightarrow> P\"\nshows \"P\"\n  using exec_call\n  apply (unfold call_def)\n  apply (cases \"\\<Gamma> p\")\n  apply  (erule exec_block_Normal_elim)\n  apply      (elim exec_Normal_elim_cases)\n  apply       simp\n  apply      simp\n  apply     (elim exec_Normal_elim_cases)\n  apply      simp\n  apply     simp\n  apply    (elim exec_Normal_elim_cases)\n  apply     simp\n  apply    simp\n  apply   (elim exec_Normal_elim_cases)\n  apply    simp\n  apply   (rule Undef,assumption,assumption)\n  apply  (rule Undef,assumption+)\n  apply (erule exec_block_Normal_elim)\n  apply     (elim exec_Normal_elim_cases)\n  apply      simp\n  apply      (rule Normal,assumption+)\n  apply     simp\n  apply    (elim exec_Normal_elim_cases)\n  apply     simp\n  apply     (rule Abrupt,assumption+)\n  apply    simp\n  apply   (elim exec_Normal_elim_cases)\n  apply    simp\n  apply   (rule Fault, assumption+)\n  apply   simp\n  apply  (elim exec_Normal_elim_cases)\n  apply   simp\n  apply  (rule Stuck,assumption,assumption,assumption)\n  apply  simp\n  apply (rule Undef,assumption+)\n  done\n\n\nlemma exec_dynCall:  \n          \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> \\<Rightarrow>  t\\<rbrakk> \n           \\<Longrightarrow> \n           \\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> \\<Rightarrow>  t\"\napply (simp add: dynCall_def)\nby (rule DynCom)\n\nlemma exec_dynCall_Normal_elim:\n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> \\<Rightarrow>  t\"\n  assumes call: \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> \\<Rightarrow>  t \\<Longrightarrow> P\"\n  shows \"P\"\n  using exec\n  apply (simp add: dynCall_def)\n  apply (erule exec_Normal_elim_cases)\n  apply (rule call,assumption)\n  done\n\n\n\n\nlemma exec_Seq': \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow>  s'; \\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> \\<Rightarrow>  s''\\<rbrakk>\n             \\<Longrightarrow>\n             \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>  s''\" \n  apply (cases s)\n  apply    (fastforce intro: exec.intros)\n  apply   (fastforce dest: Abrupt_end)\n  apply  (fastforce dest: Fault_end)\n  apply (fastforce dest: Stuck_end)\n  done\n\n\nlemma exec_assoc: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 (Seq c2 c3),s\\<rangle> \\<Rightarrow>  t = \\<Gamma>\\<turnstile>\\<langle>Seq (Seq c1 c2) c3,s\\<rangle> \\<Rightarrow>  t\"\n  by (blast elim!: exec_elim_cases intro: exec_Seq' )\n\n\n(* ************************************************************************* *)\nsubsection {* Big-Step Execution with Recursion Limit: @{text \"\\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> =n\\<Rightarrow> t\"} *}\n(* ************************************************************************* *)\n\ninductive \"execn\"::\"[('s,'p,'f) body,('s,'p,'f) com,('s,'f) xstate,nat,('s,'f) xstate] \n                      \\<Rightarrow> bool\" (\"_\\<turnstile> \\<langle>_,_\\<rangle> =_\\<Rightarrow> _\"  [60,20,98,65,98] 89)\n  for \\<Gamma>::\"('s,'p,'f) body\"\nwhere\n  Skip: \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> =n\\<Rightarrow>  Normal s\"\n| Guard: \"\\<lbrakk>s\\<in>g; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk> \n          \\<Longrightarrow> \n          \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| GuardFault: \"s\\<notin>g \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow>  Fault f\"\n\n| FaultProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> =n\\<Rightarrow>  Fault f\" \n\n| Basic: \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> =n\\<Rightarrow>  Normal (f s)\"\n\n| Spec: \"(s,t) \\<in> r \n         \\<Longrightarrow> \n         \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow>  Normal t\"\n\n| SpecStuck: \"\\<forall>t. (s,t) \\<notin> r \n              \\<Longrightarrow> \n              \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow>  Stuck\"\n\n| Seq: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow>  s'; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,s'\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>\\<turnstile>\\<langle>Seq c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow>  t\" \n\n| CondTrue: \"\\<lbrakk>s \\<in> b; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk> \n             \\<Longrightarrow>  \n             \\<Gamma>\\<turnstile>\\<langle>Cond b c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| CondFalse: \"\\<lbrakk>s \\<notin> b; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk> \n              \\<Longrightarrow>  \n              \\<Gamma>\\<turnstile>\\<langle>Cond b c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| WhileTrue: \"\\<lbrakk>s \\<in> b; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow>  s'; \n              \\<Gamma>\\<turnstile>\\<langle>While b c,s'\\<rangle> =n\\<Rightarrow>  t\\<rbrakk> \n              \\<Longrightarrow>  \n              \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| WhileFalse: \"\\<lbrakk>s \\<notin> b\\<rbrakk> \n               \\<Longrightarrow>  \n               \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow>  Normal s\"\n\n| Call:  \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk> \n          \\<Longrightarrow> \n          \\<Gamma>\\<turnstile>\\<langle>Call p ,Normal s\\<rangle> =Suc n\\<Rightarrow>  t\"\n \n| CallUndefined: \"\\<lbrakk>\\<Gamma> p=None\\<rbrakk> \n                 \\<Longrightarrow> \n                 \\<Gamma>\\<turnstile>\\<langle>Call p ,Normal s\\<rangle> =Suc n\\<Rightarrow>  Stuck\"\n\n| StuckProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> =n\\<Rightarrow>  Stuck\"\n \n| DynCom:  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>(c s),Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk> \n             \\<Longrightarrow> \n             \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\n| Throw: \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> =n\\<Rightarrow>  Abrupt s\"\n\n| AbruptProp [intro,simp]: \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> =n\\<Rightarrow>  Abrupt s\"\n  \n| CatchMatch: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow>  Abrupt s'; \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s'\\<rangle> =n\\<Rightarrow> t\\<rbrakk>\n               \\<Longrightarrow>\n               \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> t\" \n| CatchMiss: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow>  t; \\<not>isAbr t\\<rbrakk>\n               \\<Longrightarrow>\n               \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n \ninductive_cases execn_elim_cases [cases set]:\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Skip,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Basic f,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Spec r,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>While b c,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Call p ,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Throw,s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,s\\<rangle> =n\\<Rightarrow>  t\"\n\n\ninductive_cases execn_Normal_elim_cases [cases set]: \n  \"\\<Gamma>\\<turnstile>\\<langle>c,Fault f\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Stuck\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>c,Abrupt s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n  \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s\\<rangle> =n\\<Rightarrow>  t\"\n\nlemma execn_Skip': \"\\<Gamma>\\<turnstile>\\<langle>Skip,t\\<rangle> =n\\<Rightarrow> t\"\n  by (cases t) (auto intro: execn.intros)\n\nlemma execn_Fault_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\" and s: \"s=Fault f\" \n  shows \"t=Fault f\"\nusing exec s by (induct) auto\n\nlemma execn_Stuck_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\" and s: \"s=Stuck\" \n  shows \"t=Stuck\"\nusing exec s by (induct) auto\n\nlemma execn_Abrupt_end: assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\" and s: \"s=Abrupt s'\" \n  shows \"t=Abrupt s'\"\nusing exec s by (induct) auto\n\nlemma execn_block: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Normal t; \\<Gamma>\\<turnstile>\\<langle>c s t,Normal (return s t)\\<rangle> =n\\<Rightarrow>  u\\<rbrakk>\n  \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> =n\\<Rightarrow>  u\"\napply (unfold block_def)\nby (fastforce intro: execn.intros)\n\nlemma execn_blockAbrupt: \n     \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Abrupt t\\<rbrakk>\n       \\<Longrightarrow> \n       \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> =n\\<Rightarrow>  Abrupt (return s t)\"\napply (unfold block_def)\nby (fastforce intro: execn.intros)\n\nlemma execn_blockFault: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Fault f\\<rbrakk>\n   \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> =n\\<Rightarrow>  Fault f\"\napply (unfold block_def)\nby (fastforce intro: execn.intros)\n\nlemma execn_blockStuck:\n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Stuck\\<rbrakk>\n  \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> =n\\<Rightarrow>  Stuck\"\napply (unfold block_def)\nby (fastforce intro: execn.intros)\n\n\nlemma execn_call:   \n \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Normal t; \n   \\<Gamma>\\<turnstile>\\<langle>c s t,Normal (return s t)\\<rangle> =Suc n\\<Rightarrow>  u\\<rbrakk> \n  \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =Suc n\\<Rightarrow>  u\"\napply (simp add: call_def)\napply (rule execn_block)\napply  (erule (1) Call)\napply assumption\ndone\n\n\nlemma execn_callAbrupt: \n \"\\<lbrakk>\\<Gamma> p=Some bdy;\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Abrupt t\\<rbrakk> \n  \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =Suc n\\<Rightarrow>  Abrupt (return s t)\"\napply (simp add: call_def)\napply (rule execn_blockAbrupt)\napply (erule (1) Call)\ndone\n\nlemma execn_callFault: \n             \"\\<lbrakk>\\<Gamma> p=Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Fault f\\<rbrakk> \n               \\<Longrightarrow> \n              \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =Suc n\\<Rightarrow>  Fault f\"\napply (simp add: call_def)\napply (rule execn_blockFault)\napply (erule (1) Call)\ndone\n\nlemma execn_callStuck: \n          \"\\<lbrakk>\\<Gamma> p=Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Stuck\\<rbrakk> \n           \\<Longrightarrow> \n           \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =Suc n\\<Rightarrow>  Stuck\"\napply (simp add: call_def)\napply (rule execn_blockStuck)\napply (erule (1) Call)\ndone\n\nlemma  execn_callUndefined: \n       \"\\<lbrakk>\\<Gamma> p=None\\<rbrakk> \n        \\<Longrightarrow> \n        \\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =Suc n\\<Rightarrow>  Stuck\"\napply (simp add: call_def)\napply (rule execn_blockStuck)\napply (erule CallUndefined)\ndone\n\nlemma execn_block_Normal_elim [consumes 1]:\nassumes execn_block: \"\\<Gamma>\\<turnstile>\\<langle>block init bdy return c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\nassumes Normal: \n \"\\<And>t'.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Normal t';\n     \\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =n\\<Rightarrow>  t\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Abrupt:\n \"\\<And>t'.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Abrupt t'; \n     t = Abrupt (return s t')\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Fault:\n \"\\<And>f.\n    \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Fault f; \n     t = Fault f\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Stuck:\n \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =n\\<Rightarrow>  Stuck; \n     t = Stuck\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Undef:\n \"\\<lbrakk>\\<Gamma> p = None; t = Stuck\\<rbrakk> \\<Longrightarrow> P\"\nshows \"P\"\n  using execn_block\napply (unfold block_def)\napply (elim execn_Normal_elim_cases)\napply simp_all\napply  (case_tac s')\napply     simp_all\napply     (elim execn_Normal_elim_cases)\napply     simp\napply    (drule execn_Abrupt_end) apply simp \napply    (erule execn_Normal_elim_cases)\napply    simp\napply    (rule Abrupt,assumption+)\napply   (drule execn_Fault_end) apply simp\napply   (erule execn_Normal_elim_cases)\napply   simp\napply  (drule execn_Stuck_end) apply simp\napply  (erule execn_Normal_elim_cases)\napply  simp\napply (case_tac s')\napply    simp_all\napply   (elim execn_Normal_elim_cases)\napply   simp\napply   (rule Normal,assumption+)\napply  (drule execn_Fault_end) apply simp\napply  (rule Fault,assumption+)\napply (drule execn_Stuck_end) apply simp\napply (rule Stuck,assumption+)\ndone\n\nlemma execn_call_Normal_elim [consumes 1]:\nassumes exec_call: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\nassumes Normal:\n \"\\<And>bdy i t'.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =i\\<Rightarrow>  Normal t'; \n     \\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc i\\<Rightarrow>  t; n = Suc i\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Abrupt:\n \"\\<And>bdy i t'.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =i\\<Rightarrow>  Abrupt t'; n = Suc i;\n     t = Abrupt (return s t')\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Fault:\n \"\\<And>bdy i f.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =i\\<Rightarrow>  Fault f; n = Suc i;\n     t = Fault f\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Stuck:\n \"\\<And>bdy i.\n    \\<lbrakk>\\<Gamma> p = Some bdy; \\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =i\\<Rightarrow>  Stuck; n = Suc i;\n     t = Stuck\\<rbrakk>\n    \\<Longrightarrow> P\"\nassumes Undef:\n \"\\<And>i. \\<lbrakk>\\<Gamma> p = None; n = Suc i; t = Stuck\\<rbrakk> \\<Longrightarrow> P\"\nshows \"P\"\n  using exec_call\n  apply (unfold call_def)\n  apply (cases n)\n  apply  (simp only: block_def)\n  apply  (fastforce elim: execn_Normal_elim_cases)\n  apply (cases \"\\<Gamma> p\")\n  apply  (erule execn_block_Normal_elim)\n  apply      (elim execn_Normal_elim_cases)\n  apply       simp\n  apply      simp\n  apply     (elim execn_Normal_elim_cases)\n  apply      simp\n  apply     simp\n  apply    (elim execn_Normal_elim_cases)\n  apply     simp\n  apply    simp\n  apply   (elim execn_Normal_elim_cases)\n  apply    simp\n  apply   (rule Undef,assumption,assumption,assumption)\n  apply  (rule Undef,assumption+)\n  apply (erule execn_block_Normal_elim)\n  apply     (elim execn_Normal_elim_cases)\n  apply      simp\n  apply      (rule Normal,assumption+)\n  apply     simp\n  apply    (elim execn_Normal_elim_cases)\n  apply     simp\n  apply     (rule Abrupt,assumption+)\n  apply    simp\n  apply   (elim execn_Normal_elim_cases)\n  apply    simp\n  apply   (rule Fault,assumption+)\n  apply   simp\n  apply  (elim execn_Normal_elim_cases)\n  apply   simp\n  apply  (rule Stuck,assumption,assumption,assumption,assumption)\n  apply  (rule Undef,assumption,assumption,assumption)\n  apply (rule Undef,assumption+)\n  done\n\nlemma execn_dynCall:  \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> =n\\<Rightarrow>  t\\<rbrakk> \n  \\<Longrightarrow> \n  \\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> =n\\<Rightarrow>  t\"\napply (simp add: dynCall_def)\nby (rule DynCom)\n\n\n\n\n\n\n\nlemma  execn_Seq': \n       \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow>  s'; \\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> =n\\<Rightarrow>  s''\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> =n\\<Rightarrow>  s''\"\n  apply (cases s)\n  apply    (fastforce intro: execn.intros)\n  apply   (fastforce dest: execn_Abrupt_end)\n  apply  (fastforce dest: execn_Fault_end)\n  apply (fastforce dest: execn_Stuck_end)\n  done\n\nlemma execn_mono:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\"\n  shows \"\\<And> m. n \\<le> m \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =m\\<Rightarrow>  t\"\nusing exec\nby (induct) (auto intro: execn.intros dest: Suc_le_D)\n\n\nlemma execn_Suc: \n  \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =Suc n\\<Rightarrow>  t\"\n  by (rule execn_mono [OF _ le_refl [THEN le_SucI]])\n\nlemma execn_assoc: \n \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 (Seq c2 c3),s\\<rangle> =n\\<Rightarrow>  t = \\<Gamma>\\<turnstile>\\<langle>Seq (Seq c1 c2) c3,s\\<rangle> =n\\<Rightarrow>  t\"\n  by (auto elim!: execn_elim_cases intro: execn_Seq')\n\n\nlemma execn_to_exec: \n  assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nusing execn\nby induct (auto intro: exec.intros)\n\nlemma exec_to_execn: \n  assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>n. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>  t\"\nusing execn\nproof (induct)\n  case Skip thus ?case by (iprover intro: execn.intros)\nnext\n  case Guard thus ?case by (iprover intro: execn.intros)\nnext\n  case GuardFault thus ?case by (iprover intro: execn.intros)\nnext\n case FaultProp thus ?case by (iprover intro: execn.intros)\nnext\n  case Basic thus ?case by (iprover intro: execn.intros)\nnext\n  case Spec thus ?case by (iprover intro: execn.intros)\nnext\n  case SpecStuck thus ?case by (iprover intro: execn.intros)\nnext\n  case (Seq c1 s s' c2 s'')\n  then obtain n m where\n    \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow>  s'\" \"\\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> =m\\<Rightarrow>  s''\"\n    by blast\n  then have \n    \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =max n m\\<Rightarrow>  s'\" \n    \"\\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> =max n m\\<Rightarrow>  s''\"\n    by (auto elim!: execn_mono intro: max.cobounded1 max.cobounded2)\n  thus ?case \n    by (iprover intro: execn.intros)\nnext\n  case CondTrue thus ?case by (iprover intro: execn.intros)\nnext\n  case CondFalse thus ?case by (iprover intro: execn.intros)\nnext\n  case (WhileTrue s b c s' s'') \n  then obtain n m where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow>  s'\" \"\\<Gamma>\\<turnstile>\\<langle>While b c,s'\\<rangle> =m\\<Rightarrow>  s''\"\n    by blast\n  then have \n    \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =max n m\\<Rightarrow>  s'\" \"\\<Gamma>\\<turnstile>\\<langle>While b c,s'\\<rangle> =max n m\\<Rightarrow>  s''\"\n    by (auto elim!: execn_mono intro: max.cobounded1 max.cobounded2)\n  with WhileTrue\n  show ?case\n    by (iprover intro: execn.intros)\nnext\n  case WhileFalse thus ?case by (iprover intro: execn.intros)\nnext\n  case Call thus ?case by (iprover intro: execn.intros)\nnext\n  case CallUndefined thus ?case by (iprover intro: execn.intros)\nnext\n  case StuckProp thus ?case by (iprover intro: execn.intros)\nnext\n  case DynCom thus ?case by (iprover intro: execn.intros)\nnext\n  case Throw thus ?case by (iprover intro: execn.intros)\nnext\n  case AbruptProp thus ?case by (iprover intro: execn.intros)\nnext\n  case (CatchMatch c1 s s' c2 s'')\n  then obtain n m where\n    \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow>  Abrupt s'\" \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> =m\\<Rightarrow>  s''\"\n    by blast\n  then have \n    \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =max n m\\<Rightarrow>  Abrupt s'\" \n    \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> =max n m\\<Rightarrow>  s''\"\n    by (auto elim!: execn_mono intro: max.cobounded1 max.cobounded2)\n  with CatchMatch.hyps show ?case \n    by (iprover intro: execn.intros)\nnext\n  case CatchMiss thus ?case by (iprover intro: execn.intros)\nqed\n\ntheorem exec_iff_execn: \"(\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t) = (\\<exists>n. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t)\"\n  by (iprover intro: exec_to_execn execn_to_exec)\n\n\ndefinition nfinal_notin:: \"('s,'p,'f) body \\<Rightarrow> ('s,'p,'f) com \\<Rightarrow> ('s,'f) xstate \\<Rightarrow>  nat \n                       \\<Rightarrow> ('s,'f) xstate set \\<Rightarrow> bool\"\n  (\"_\\<turnstile> \\<langle>_,_\\<rangle> =_\\<Rightarrow>\\<notin>_\"  [60,20,98,65,60] 89) where\n\"\\<Gamma>\\<turnstile> \\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>T = (\\<forall>t. \\<Gamma>\\<turnstile> \\<langle>c,s\\<rangle> =n\\<Rightarrow> t \\<longrightarrow> t\\<notin>T)\"\n\ndefinition final_notin:: \"('s,'p,'f) body \\<Rightarrow> ('s,'p,'f) com \\<Rightarrow> ('s,'f) xstate  \n                       \\<Rightarrow> ('s,'f) xstate set \\<Rightarrow> bool\"\n  (\"_\\<turnstile> \\<langle>_,_\\<rangle> \\<Rightarrow>\\<notin>_\"  [60,20,98,60] 89) where\n\"\\<Gamma>\\<turnstile> \\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T = (\\<forall>t. \\<Gamma>\\<turnstile> \\<langle>c,s\\<rangle> \\<Rightarrow>t \\<longrightarrow> t\\<notin>T)\"\n\nlemma final_notinI: \"\\<lbrakk>\\<And>t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> t \\<notin> T\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T\"\n  by (simp add: final_notin_def)\n\nlemma noFaultStuck_Call_body': \"p \\<in> dom \\<Gamma> \\<Longrightarrow>\n\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) =\n\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n  by (clarsimp simp add: final_notin_def exec_Call_body)\n\nlemma noFault_startn: \n  assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" and t: \"t\\<noteq>Fault f\" \n  shows \"s\\<noteq>Fault f\"\nusing execn t by (induct) auto\n\nlemma noFault_start: \n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" and t: \"t\\<noteq>Fault f\" \n  shows \"s\\<noteq>Fault f\"\nusing exec t by (induct) auto\n\nlemma noStuck_startn: \n  assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" and t: \"t\\<noteq>Stuck\" \n  shows \"s\\<noteq>Stuck\"\nusing execn t by (induct) auto\n\nlemma noStuck_start: \n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" and t: \"t\\<noteq>Stuck\" \n  shows \"s\\<noteq>Stuck\"\nusing exec t by (induct) auto\n\nlemma noAbrupt_startn: \n  assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" and t: \"\\<forall>t'. t\\<noteq>Abrupt t'\" \n  shows \"s\\<noteq>Abrupt s'\"\nusing execn t by (induct) auto\n\nlemma noAbrupt_start: \n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" and t: \"\\<forall>t'. t\\<noteq>Abrupt t'\" \n  shows \"s\\<noteq>Abrupt s'\"\nusing exec t by (induct) auto\n\nlemma noFaultn_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Fault f\"\n  by (auto dest: noFault_startn)\n\nlemma noFaultn_startD': \"t\\<noteq>Fault f \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> s \\<noteq> Fault f\"\n  by (auto dest: noFault_startn)\n\nlemma noFault_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Fault f\"\n  by (auto dest: noFault_start)\n\nlemma noFault_startD': \"t\\<noteq>Fault f\\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> s \\<noteq> Fault f\"\n  by (auto dest: noFault_start)\n\nlemma noStuckn_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Stuck\"\n  by (auto dest: noStuck_startn)\n\nlemma noStuckn_startD': \"t\\<noteq>Stuck \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> s \\<noteq> Stuck\"\n  by (auto dest: noStuck_startn)\n\nlemma noStuck_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Stuck\"\n  by (auto dest: noStuck_start)\n\nlemma noStuck_startD': \"t\\<noteq>Stuck \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> s \\<noteq> Stuck\"\n  by (auto dest: noStuck_start)\n\nlemma noAbruptn_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Abrupt s'\"\n  by (auto dest: noAbrupt_startn)\n\nlemma noAbrupt_startD: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Normal t \\<Longrightarrow> s \\<noteq> Abrupt s'\"\n  by (auto dest: noAbrupt_start)\n\nlemma noFaultnI: \"\\<lbrakk>\\<And>t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t \\<Longrightarrow> t\\<noteq>Fault f\\<rbrakk> \\<Longrightarrow>  \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault f}\" \n  by (simp add: nfinal_notin_def)\n\nlemma noFaultnI': \n  assumes contr: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Fault f \\<Longrightarrow> False\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault f}\"\n  proof (rule noFaultnI)\n    fix t assume \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" \n    with contr show \"t \\<noteq> Fault f\"\n      by (cases \"t=Fault f\") auto\n  qed\n\nlemma noFaultn_def': \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault f} = (\\<not>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Fault f)\"\n  apply rule\n  apply  (fastforce simp add: nfinal_notin_def)\n  apply (fastforce intro: noFaultnI')\n  done\n\n\n\nlemma noStucknI': \n  assumes contr: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Stuck \\<Longrightarrow> False\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Stuck}\"\n  proof (rule noStucknI)\n    fix t assume \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" \n    with contr show \"t \\<noteq> Stuck\"\n      by (cases t) auto\n  qed\n\nlemma noStuckn_def': \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Stuck} = (\\<not>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Stuck)\"\n  apply rule\n  apply  (fastforce simp add: nfinal_notin_def)\n  apply (fastforce intro: noStucknI')\n  done\n\n\nlemma noFaultI: \"\\<lbrakk>\\<And>t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t \\<Longrightarrow> t\\<noteq>Fault f\\<rbrakk> \\<Longrightarrow>  \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}\" \n  by (simp add: final_notin_def)\n\nlemma noFaultI': \n  assumes contr: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Fault f\\<Longrightarrow> False\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}\"\n  proof (rule noFaultI)\n    fix t assume \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" \n    with contr show \"t \\<noteq> Fault f\"\n      by (cases \"t=Fault f\") auto\n  qed\n\nlemma noFaultE: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Fault f\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp add: final_notin_def)\n \n\n\n\nlemma noStuckI: \"\\<lbrakk>\\<And>t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t \\<Longrightarrow> t\\<noteq>Stuck\\<rbrakk> \\<Longrightarrow>  \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\" \n  by (simp add: final_notin_def)\n\nlemma noStuckI': \n  assumes contr: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Stuck \\<Longrightarrow> False\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  proof (rule noStuckI)\n    fix t assume \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" \n    with contr show \"t \\<noteq> Stuck\"\n      by (cases t) auto\n  qed\n\nlemma noStuckE: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Stuck\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp add: final_notin_def)\n \nlemma noStuck_def': \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck} = (\\<not>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Stuck)\"\n  apply rule\n  apply  (fastforce simp add: final_notin_def)\n  apply (fastforce intro: noStuckI')\n  done\n\n\nlemma noFaultn_execD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault f}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> t\\<noteq>Fault f\"\n  by (simp add: nfinal_notin_def)\n\nlemma noFault_execD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> t\\<noteq>Fault f\"\n  by (simp add: final_notin_def)\n\nlemma noFaultn_exec_startD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault f}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> s\\<noteq>Fault f\"\n  by (auto simp add: nfinal_notin_def dest: noFaultn_startD)\n\nlemma noFault_exec_startD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> s\\<noteq>Fault f\"\n  by (auto simp add: final_notin_def dest: noFault_startD)\n\nlemma noStuckn_execD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> t\\<noteq>Stuck\"\n  by (simp add: nfinal_notin_def)\n\nlemma noStuck_execD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> t\\<noteq>Stuck\"\n  by (simp add: final_notin_def)\n\nlemma noStuckn_exec_startD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> s\\<noteq>Stuck\"\n  by (auto simp add: nfinal_notin_def dest: noStuckn_startD)\n\nlemma noStuck_exec_startD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> s\\<noteq>Stuck\"\n  by (auto simp add: final_notin_def dest: noStuck_startD)\n\nlemma noFaultStuckn_execD: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault True,Fault False,Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \\<Longrightarrow> \n       t\\<notin>{Fault True,Fault False,Stuck}\"\n  by (simp add: nfinal_notin_def)\n\nlemma noFaultStuck_execD: \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault True,Fault False,Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk> \n \\<Longrightarrow> t\\<notin>{Fault True,Fault False,Stuck}\"\n  by (simp add: final_notin_def)\n\nlemma noFaultStuckn_exec_startD: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>{Fault True, Fault False,Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\\<rbrakk> \n   \\<Longrightarrow> s\\<notin>{Fault True,Fault False,Stuck}\"\n  by (auto simp add: nfinal_notin_def )\n\nlemma noFaultStuck_exec_startD: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Fault True, Fault False,Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>t\\<rbrakk> \n  \\<Longrightarrow> s\\<notin>{Fault True,Fault False,Stuck}\"\n  by (auto simp add: final_notin_def )\n\nlemma noStuck_Call: \n  assumes noStuck: \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  shows \"p \\<in> dom \\<Gamma>\"\nproof (cases \"p \\<in> dom \\<Gamma>\")\n  case True thus ?thesis by simp\nnext\n  case False\n  hence \"\\<Gamma> p = None\" by auto \n  hence \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>Stuck\"\n    by (rule exec.CallUndefined)\n  with noStuck show ?thesis\n    by (auto simp add: final_notin_def)\nqed\n\n\nlemma Guard_noFaultStuckD: \n  assumes \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n  assumes \"f \\<notin> F\"\n  shows \"s \\<in> g\"\n  using assms\n  by (auto simp add: final_notin_def intro: exec.intros)\n\n\nlemma final_notin_to_finaln:  \n  assumes notin: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>T\"\nproof (clarsimp simp add: nfinal_notin_def)\n  fix t assume \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" and \"t\\<in>T\"\n  with notin show \"False\"\n    by (auto intro: execn_to_exec simp add: final_notin_def)\nqed\n\nlemma noFault_Call_body: \n\"\\<Gamma> p=Some bdy\\<Longrightarrow>\n \\<Gamma>\\<turnstile>\\<langle>Call p ,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Fault f} = \n \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal s\\<rangle> \\<Rightarrow>\\<notin>{Fault f}\"\n  by (simp add: noFault_def' exec_Call_body)\n\nlemma noStuck_Call_body: \n\"\\<Gamma> p=Some bdy\\<Longrightarrow>\n \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck} = \n \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (simp add: noStuck_def' exec_Call_body)\n\nlemma exec_final_notin_to_execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>T\"\n  by (auto simp add: final_notin_def nfinal_notin_def dest: execn_to_exec)\n\nlemma execn_final_notin_to_exec: \"\\<forall>n. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>T \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T\"\n  by (auto simp add: final_notin_def nfinal_notin_def dest: exec_to_execn)\n\nlemma exec_final_notin_iff_execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>T = (\\<forall>n. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>\\<notin>T)\"\n  by (auto intro: exec_final_notin_to_execn execn_final_notin_to_exec)\n\nlemma Seq_NoFaultStuckD2: \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<forall>t. \\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> t\\<notin> ({Stuck} \\<union> Fault `  F) \\<longrightarrow> \n             \\<Gamma>\\<turnstile>\\<langle>c2,t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nusing noabort\nby (auto simp add: final_notin_def intro: exec_Seq') lemma Seq_NoFaultStuckD1: \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nproof (rule final_notinI)\n  fix t\n  assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t\"\n  show \"t \\<notin> {Stuck} \\<union> Fault `  F\"\n  proof \n    assume \"t \\<in> {Stuck} \\<union> Fault `  F\"\n    moreover\n    {\n      assume \"t = Stuck\"\n      with exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Stuck\"\n        by (auto intro: exec_Seq')\n      with noabort have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    moreover \n    {\n      assume \"t \\<in> Fault ` F\"\n      then obtain f where \n      t: \"t=Fault f\" and f: \"f \\<in> F\"\n        by auto\n      from t exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Fault f\"\n        by (auto intro: exec_Seq')\n      with noabort f have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    ultimately show False by auto\n  qed\nqed\n\nlemma Seq_NoFaultStuckD2': \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<forall>t. \\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> t\\<notin> ({Stuck} \\<union> Fault `  F) \\<longrightarrow> \n             \\<Gamma>\\<turnstile>\\<langle>c2,t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nusing noabort\nby (auto simp add: final_notin_def intro: exec_Seq') \n\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{const \"sequence\"}, @{const \"flatten\"} and \n @{const \"normalize\"} *}\n(* ************************************************************************ *)\n\nlemma execn_sequence_app: \"\\<And>s s' t.\n \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> =n\\<Rightarrow> s'; \\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =n\\<Rightarrow> t\\<rbrakk>\n \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs@ys),Normal s\\<rangle> =n\\<Rightarrow> t\"\nproof (induct xs)\n  case Nil \n  thus ?case by (auto elim: execn_Normal_elim_cases)\nnext\n  case (Cons x xs)\n  have exec_x_xs: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (x # xs),Normal s\\<rangle> =n\\<Rightarrow> s'\" by fact\n  have exec_ys: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases xs)\n    case Nil\n    with exec_x_xs have \"\\<Gamma>\\<turnstile>\\<langle>x,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n      by (auto elim: execn_Normal_elim_cases )\n    with Nil exec_ys show ?thesis\n      by (cases ys) (auto intro: execn.intros elim: execn_elim_cases)\n  next\n    case Cons\n    with exec_x_xs\n    obtain s'' where\n      exec_x: \"\\<Gamma>\\<turnstile>\\<langle>x,Normal s\\<rangle> =n\\<Rightarrow> s''\" and\n      exec_xs: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,s''\\<rangle> =n\\<Rightarrow> s'\"\n      by (auto elim: execn_Normal_elim_cases )\n    show ?thesis\n    proof (cases s'')\n      case (Normal s''')\n      from Cons.hyps [OF exec_xs [simplified Normal] exec_ys]\n      have \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s'''\\<rangle> =n\\<Rightarrow> t\" .\n      with Cons exec_x Normal\n      show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case (Abrupt s''')\n      with exec_xs have \"s'=Abrupt s'''\"\n        by (auto dest: execn_Abrupt_end)\n      with exec_ys have \"t=Abrupt s'''\"\n        by (auto dest: execn_Abrupt_end)\n      with exec_x Abrupt Cons show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case (Fault f)\n      with exec_xs have \"s'=Fault f\"\n        by (auto dest: execn_Fault_end)\n      with exec_ys have \"t=Fault f\"\n        by (auto dest: execn_Fault_end)\n      with exec_x Fault Cons show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case Stuck\n      with exec_xs have \"s'=Stuck\"\n        by (auto dest: execn_Stuck_end)\n      with exec_ys have \"t=Stuck\"\n        by (auto dest: execn_Stuck_end)\n      with exec_x Stuck Cons show ?thesis\n        by (auto intro: execn.intros)\n    qed\n  qed\nqed\n\nlemma execn_sequence_appD: \"\\<And>s t. \\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow>\n         \\<exists>s'. \\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> =n\\<Rightarrow> s' \\<and> \\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =n\\<Rightarrow> t\"\nproof (induct xs)\n  case Nil\n  thus ?case\n    by (auto intro: execn.intros)\nnext\n  case (Cons x xs)\n  have exec_app: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq ((x # xs) @ ys),Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases xs)\n    case Nil\n    with exec_app show ?thesis\n      by (cases ys) (auto elim: execn_Normal_elim_cases intro: execn_Skip')\n  next\n    case Cons\n    with exec_app obtain s' where \n      exec_x: \"\\<Gamma>\\<turnstile>\\<langle>x,Normal s\\<rangle> =n\\<Rightarrow> s'\" and\n      exec_xs_ys: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),s'\\<rangle> =n\\<Rightarrow> t\"\n      by (auto elim: execn_Normal_elim_cases)\n    show ?thesis\n    proof (cases s')\n      case (Normal s'')\n      from Cons.hyps [OF exec_xs_ys [simplified Normal]] Normal exec_x Cons\n      show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case (Abrupt s'')\n      with exec_xs_ys have \"t=Abrupt s''\"\n        by (auto dest: execn_Abrupt_end)\n      with Abrupt exec_x Cons\n      show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case (Fault f)\n      with exec_xs_ys have \"t=Fault f\"\n        by (auto dest: execn_Fault_end)\n      with Fault exec_x Cons\n      show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case Stuck\n      with exec_xs_ys have \"t=Stuck\"\n        by (auto dest: execn_Stuck_end)\n      with Stuck exec_x Cons\n      show ?thesis\n        by (auto intro: execn.intros)\n    qed\n  qed\nqed\n    \nlemma execn_sequence_appE [consumes 1]: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> =n\\<Rightarrow> t;\n   \\<And>s'. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> =n\\<Rightarrow> s';\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =n\\<Rightarrow> t\\<rbrakk> \\<Longrightarrow> P\n   \\<rbrakk> \\<Longrightarrow> P\"\n  by (auto dest: execn_sequence_appD)\n\nlemma execn_to_execn_sequence_flatten: \n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c),s\\<rangle> =n\\<Rightarrow> t\"\nusing exec \nproof induct\n  case (Seq c1 c2 n s s' s'') thus ?case \n    by (auto intro: execn.intros execn_sequence_app)\nqed (auto intro: execn.intros)\n\nlemma execn_to_execn_normalize: \n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> =n\\<Rightarrow> t\"\nusing exec \nproof induct\n  case (Seq c1 c2 n s s' s'') thus ?case\n    by (auto intro: execn_to_execn_sequence_flatten  execn_sequence_app )\nqed (auto intro: execn.intros)\n\n\n\nlemma execn_sequence_flatten_to_execn: \n  shows \"\\<And>s t. \\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c),s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\nproof (induct c)\n  case (Seq c1 c2)\n  have exec_seq: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten (Seq c1 c2)),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Normal s')\n    with exec_seq obtain s'' where\n      \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c1),Normal s'\\<rangle> =n\\<Rightarrow> s''\" and\n      \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c2),s''\\<rangle> =n\\<Rightarrow> t\"\n      by (auto elim: execn_sequence_appE)\n    with Seq.hyps Normal\n    show ?thesis\n      by (fastforce intro: execn.intros)\n  next\n    case Abrupt \n    with exec_seq \n    show ?thesis by (auto intro: execn.intros dest: execn_Abrupt_end)\n  next\n    case Fault \n    with exec_seq \n    show ?thesis by (auto intro: execn.intros dest: execn_Fault_end)\n  next\n    case Stuck \n    with exec_seq \n    show ?thesis by (auto intro: execn.intros dest: execn_Stuck_end)\n  qed\nqed auto\n\nlemma execn_normalize_to_execn: \n  shows \"\\<And>s t n. \\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\nproof (induct c)\n  case Skip thus ?case by simp\nnext\n  case Basic thus ?case by simp\nnext\n  case Spec thus ?case by simp\nnext\n  case (Seq c1 c2)\n  have \"\\<Gamma>\\<turnstile>\\<langle>normalize (Seq c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  hence exec_norm_seq: \n    \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten (normalize c1) @ flatten (normalize c2)),s\\<rangle> =n\\<Rightarrow> t\"\n    by simp\n  show ?case\n  proof (cases s)\n    case (Normal s')\n    with exec_norm_seq obtain s'' where\n      exec_norm_c1: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten (normalize c1)),Normal s'\\<rangle> =n\\<Rightarrow> s''\" and\n      exec_norm_c2: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten (normalize c2)),s''\\<rangle> =n\\<Rightarrow> t\"\n      by (auto elim: execn_sequence_appE)\n    from execn_sequence_flatten_to_execn [OF exec_norm_c1]\n      execn_sequence_flatten_to_execn [OF exec_norm_c2] Seq.hyps Normal\n    show ?thesis\n      by (fastforce intro: execn.intros)\n  next\n    case (Abrupt s')\n    with exec_norm_seq have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Fault f)\n    with exec_norm_seq have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_norm_seq have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by (auto intro: execn.intros)\n  qed\nnext\n  case Cond thus ?case\n    by (auto intro: execn.intros elim!: execn_elim_cases)\nnext\n  case (While b c)\n  have \"\\<Gamma>\\<turnstile>\\<langle>normalize (While b c),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  hence exec_norm_w: \"\\<Gamma>\\<turnstile>\\<langle>While b (normalize c),s\\<rangle> =n\\<Rightarrow> t\"\n    by simp\n  {\n    fix s t w \n    assume exec_w: \"\\<Gamma>\\<turnstile>\\<langle>w,s\\<rangle> =n\\<Rightarrow> t\"\n    have \"w=While b (normalize c) \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>While b c,s\\<rangle> =n\\<Rightarrow> t\"\n      using exec_w \n    proof (induct)\n      case (WhileTrue s b' c' n w t)\n      from WhileTrue obtain \n        s_in_b: \"s \\<in> b\" and\n        exec_c: \"\\<Gamma>\\<turnstile>\\<langle>normalize c,Normal s\\<rangle> =n\\<Rightarrow> w\" and\n        hyp_w: \"\\<Gamma>\\<turnstile>\\<langle>While b c,w\\<rangle> =n\\<Rightarrow> t\"\n        by simp\n      from While.hyps [OF exec_c]\n      have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> w\"\n        by simp\n      with hyp_w s_in_b\n      have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by (auto intro: execn.intros)\n      with WhileTrue show ?case by simp\n    qed (auto intro: execn.intros)\n  }\n  from this [OF exec_norm_w]\n  show ?case\n    by simp\nnext\n  case Call thus ?case by simp\nnext\n  case DynCom thus ?case by (auto intro: execn.intros elim!: execn_elim_cases)\nnext\n  case Guard thus ?case by (auto intro: execn.intros elim!: execn_elim_cases)\nnext\n  case Throw thus ?case by simp\nnext\n  case Catch thus ?case by (fastforce intro: execn.intros elim!: execn_elim_cases)\nqed\n\nlemma execn_normalize_iff_execn:\n \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> =n\\<Rightarrow> t = \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" \n  by (auto intro: execn_to_execn_normalize execn_normalize_to_execn)\n\nlemma exec_sequence_app: \n  assumes exec_xs: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> \\<Rightarrow> s'\" \n  assumes exec_ys: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs@ys),Normal s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec_xs]\n  obtain n where \n    execn_xs: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> =n\\<Rightarrow> s'\"..\n  from exec_to_execn [OF exec_ys]\n  obtain m where\n    execn_ys: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =m\\<Rightarrow> t\"..\n  with execn_xs obtain\n    \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> =max n m\\<Rightarrow> s'\"\n    \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> =max n m\\<Rightarrow> t\"\n    by (auto intro: execn_mono max.cobounded1 max.cobounded2)\n  from execn_sequence_app [OF this]\n  have \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> =max n m\\<Rightarrow> t\" .\n  thus ?thesis\n    by (rule execn_to_exec)\nqed\n\nlemma exec_sequence_appD: \n  assumes exec_xs_ys: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>s'. \\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> \\<Rightarrow> s' \\<and> \\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec_xs_ys]\n  obtain n where \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> =n\\<Rightarrow> t\"..\n  thus ?thesis\n    by (cases rule: execn_sequence_appE) (auto intro: execn_to_exec)\nqed\n\n\nlemma exec_sequence_appE [consumes 1]: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>sequence Seq (xs @ ys),Normal s\\<rangle> \\<Rightarrow> t;\n   \\<And>s'. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>sequence Seq xs,Normal s\\<rangle> \\<Rightarrow> s';\\<Gamma>\\<turnstile>\\<langle>sequence Seq ys,s'\\<rangle> \\<Rightarrow> t\\<rbrakk> \\<Longrightarrow> P\n   \\<rbrakk> \\<Longrightarrow> P\"\n  by (auto dest: exec_sequence_appD)\n\nlemma exec_to_exec_sequence_flatten: \n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c),s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec]\n  obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"..\n  from execn_to_execn_sequence_flatten [OF this]\n  show ?thesis\n    by (rule execn_to_exec)\nqed\n\nlemma exec_sequence_flatten_to_exec: \n  assumes exec_seq: \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c),s\\<rangle> \\<Rightarrow> t\" \n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec_seq]\n  obtain n where \"\\<Gamma>\\<turnstile>\\<langle>sequence Seq (flatten c),s\\<rangle> =n\\<Rightarrow> t\"..\n  from execn_sequence_flatten_to_execn [OF this]\n  show ?thesis\n    by (rule execn_to_exec)\nqed\n\nlemma exec_to_exec_normalize: \n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec] obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"..\n  hence \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_to_execn_normalize)\n  thus ?thesis\n    by (rule execn_to_exec)\nqed\n\nlemma exec_normalize_to_exec: \n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> \\<Rightarrow> t\" \n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_to_execn [OF exec] obtain n where \"\\<Gamma>\\<turnstile>\\<langle>normalize c,s\\<rangle> =n\\<Rightarrow> t\"..\n  hence \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_normalize_to_execn)\n  thus ?thesis\n    by (rule execn_to_exec)\nqed\n\n\n\nlemma execn_to_execn_subseteq_guards: \"\\<And>c s t n. \\<lbrakk>c \\<subseteq>\\<^sub>g c'; \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\\<rbrakk>\n    \\<Longrightarrow> \\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c',s\\<rangle> =n\\<Rightarrow> t' \\<and> \n            (isFault t \\<longrightarrow> isFault t') \\<and> (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof (induct c')\n  case Skip thus ?case \n    by (fastforce dest: subseteq_guardsD elim: execn_elim_cases)\nnext\n  case Basic thus ?case \n    by (fastforce dest: subseteq_guardsD elim: execn_elim_cases)\nnext\n  case Spec thus ?case \n    by (fastforce dest: subseteq_guardsD elim: execn_elim_cases)\nnext\n  case (Seq c1' c2')\n  have \"c \\<subseteq>\\<^sub>g Seq c1' c2'\" by fact\n  from subseteq_guards_Seq [OF this]\n  obtain c1 c2 where \n    c: \"c = Seq c1 c2\" and\n    c1_c1': \"c1 \\<subseteq>\\<^sub>g c1'\" and\n    c2_c2': \"c2 \\<subseteq>\\<^sub>g c2'\"\n    by blast\n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c obtain w where\n    exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> w\" and\n    exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,w\\<rangle> =n\\<Rightarrow> t\"\n    by (auto elim: execn_elim_cases)\n  from exec_c1 Seq.hyps c1_c1'\n  obtain w' where\n    exec_c1': \"\\<Gamma>\\<turnstile>\\<langle>c1',s\\<rangle> =n\\<Rightarrow> w'\" and\n    w_Fault: \"isFault w \\<longrightarrow> isFault w'\" and\n    w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w'=w\"\n    by blast\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"isFault w\")\n      case True\n      then obtain f where w': \"w=Fault f\"..\n      moreover with exec_c2 \n      have t: \"t=Fault f\"\n        by (auto dest: execn_Fault_end)\n      ultimately show ?thesis\n        using Normal w_Fault exec_c1'\n        by (fastforce intro: execn.intros elim: isFaultE)      \n    next\n      case False\n      note noFault_w = this\n      show ?thesis\n      proof (cases \"isFault w'\")\n        case True\n        then obtain f' where w': \"w'=Fault f'\"..\n        with Normal exec_c1' \n        have exec: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1' c2',s\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        then show ?thesis\n          by auto\n      next\n        case False\n        with w'_noFault have w': \"w'=w\" by simp\n        from Seq.hyps exec_c2 c2_c2'\n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c2',w\\<rangle> =n\\<Rightarrow> t'\" and\n          \"isFault t \\<longrightarrow> isFault t'\" and\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with Normal exec_c1' w'\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    qed\n  qed\nnext\n  case (Cond b c1' c2') \n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  have \"c \\<subseteq>\\<^sub>g Cond b c1' c2'\" by fact\n  from subseteq_guards_Cond [OF this]\n  obtain c1 c2 where\n    c: \"c = Cond b c1 c2\" and\n    c1_c1': \"c1 \\<subseteq>\\<^sub>g c1'\" and\n    c2_c2': \"c2 \\<subseteq>\\<^sub>g c2'\"\n    by blast\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    from exec [simplified c Normal]\n    show ?thesis\n    proof (cases)\n      assume s'_in_b: \"s' \\<in> b\" \n      assume \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      with c1_c1' Normal Cond.hyps obtain t' where\n        \"\\<Gamma>\\<turnstile>\\<langle>c1',Normal s'\\<rangle> =n\\<Rightarrow> t'\" \n        \"isFault t \\<longrightarrow> isFault t'\" \n        \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with s'_in_b Normal show ?thesis\n        by (fastforce intro: execn.intros)\n    next\n      assume s'_notin_b: \"s' \\<notin> b\" \n      assume \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      with c2_c2' Normal Cond.hyps obtain t' where\n        \"\\<Gamma>\\<turnstile>\\<langle>c2',Normal s'\\<rangle> =n\\<Rightarrow> t'\" \n        \"isFault t \\<longrightarrow> isFault t'\" \n        \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with s'_notin_b Normal show ?thesis\n        by (fastforce intro: execn.intros)\n    qed\n  qed\nnext\n  case (While b c')\n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  have \"c \\<subseteq>\\<^sub>g While b c'\" by fact\n  from subseteq_guards_While [OF this]\n  obtain c'' where \n    c: \"c = While b c''\" and\n    c''_c': \"c'' \\<subseteq>\\<^sub>g c'\"\n    by blast\n  {\n    fix c r w\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,r\\<rangle> =n\\<Rightarrow> w\"\n    assume c: \"c=While b c''\"\n    have \"\\<exists>w'. \\<Gamma>\\<turnstile>\\<langle>While b c',r\\<rangle> =n\\<Rightarrow> w' \\<and>\n                 (isFault w \\<longrightarrow> isFault w') \\<and> (\\<not> isFault w' \\<longrightarrow> w'=w)\"\n    using exec c\n    proof (induct)\n      case (WhileTrue r b' ca n u w)\n      have eqs: \"While b' ca = While b c''\" by fact\n      from WhileTrue have r_in_b: \"r \\<in> b\" by simp\n      from WhileTrue have exec_c'': \"\\<Gamma>\\<turnstile>\\<langle>c'',Normal r\\<rangle> =n\\<Rightarrow> u\" by simp\n      from While.hyps [OF c''_c' exec_c''] obtain u' where\n        exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',Normal r\\<rangle> =n\\<Rightarrow> u'\" and\n        u_Fault: \"isFault u \\<longrightarrow> isFault u' \"and \n        u'_noFault: \"\\<not> isFault u' \\<longrightarrow> u' = u\"\n        by blast\n      from WhileTrue obtain w' where\n        exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b c',u\\<rangle> =n\\<Rightarrow> w'\" and\n        w_Fault: \"isFault w \\<longrightarrow> isFault w'\" and\n        w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w' = w\"\n        by blast\n      show ?case\n      proof (cases \"isFault u'\")\n        case True\n        with exec_c' r_in_b\n        show ?thesis\n          by (fastforce intro: execn.intros elim: isFaultE)\n      next\n        case False\n        with exec_c' r_in_b u'_noFault exec_w w_Fault w'_noFault\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    next\n      case WhileFalse thus ?case by (fastforce intro: execn.intros)\n    qed auto\n  }\n  from this [OF exec c]\n  show ?case .\nnext\n  case Call thus ?case \n    by (fastforce dest: subseteq_guardsD elim: execn_elim_cases)\nnext\n  case (DynCom C') \n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  have \"c \\<subseteq>\\<^sub>g DynCom C'\" by fact\n  from subseteq_guards_DynCom [OF this] obtain C where\n    c: \"c = DynCom C\" and\n    C_C': \"\\<forall>s. C s \\<subseteq>\\<^sub>g C' s\"\n    by blast\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    from exec [simplified c Normal] \n    have \"\\<Gamma>\\<turnstile>\\<langle>C s',Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      by cases\n    from DynCom.hyps C_C' [rule_format] this obtain t' where\n      \"\\<Gamma>\\<turnstile>\\<langle>C' s',Normal s'\\<rangle> =n\\<Rightarrow> t'\"\n      \"isFault t \\<longrightarrow> isFault t'\" \n      \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n      by blast\n    with Normal show ?thesis\n      by (fastforce intro: execn.intros)\n  qed\nnext\n  case (Guard f' g' c')\n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  have \"c \\<subseteq>\\<^sub>g Guard f' g' c'\" by fact\n  hence subset_cases: \"(c \\<subseteq>\\<^sub>g c') \\<or> (\\<exists>c''. c = Guard f' g' c'' \\<and> (c'' \\<subseteq>\\<^sub>g c'))\"\n    by (rule subseteq_guards_Guard)\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    from subset_cases show ?thesis\n    proof \n      assume c_c': \"c \\<subseteq>\\<^sub>g c'\"\n      from Guard.hyps [OF this exec] Normal obtain t' where\n        exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n        t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and \n        t_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\" \n        by blast\n      with Normal\n      show ?thesis\n        by (cases \"s' \\<in> g'\") (fastforce intro: execn.intros)+\n    next\n      assume \"\\<exists>c''. c = Guard f' g' c'' \\<and> (c'' \\<subseteq>\\<^sub>g c')\"\n      then obtain c'' where\n        c: \"c = Guard f' g' c''\" and\n        c''_c': \"c'' \\<subseteq>\\<^sub>g c'\"\n        by blast\n      from c exec Normal\n      have exec_Guard': \"\\<Gamma>\\<turnstile>\\<langle>Guard f' g' c'',Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by simp\n      thus ?thesis\n      proof (cases)\n        assume s'_in_g': \"s' \\<in> g'\"\n        assume exec_c'': \"\\<Gamma>\\<turnstile>\\<langle>c'',Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        from Guard.hyps [OF c''_c' exec_c'']  obtain t' where\n          exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n          t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and \n          t_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\" \n          by blast\n        with Normal s'_in_g'\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      next\n        assume \"s' \\<notin> g'\" \"t=Fault f'\"\n        with Normal show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    qed\n  qed\nnext\n  case Throw thus ?case \n    by (fastforce dest: subseteq_guardsD intro: execn.intros \n         elim: execn_elim_cases)\nnext\n  case (Catch c1' c2')\n  have \"c \\<subseteq>\\<^sub>g Catch c1' c2'\" by fact\n  from subseteq_guards_Catch [OF this]\n  obtain c1 c2 where \n    c: \"c = Catch c1 c2\" and\n    c1_c1': \"c1 \\<subseteq>\\<^sub>g c1'\" and\n    c2_c2': \"c2 \\<subseteq>\\<^sub>g c2'\"\n    by blast\n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    from exec [simplified c Normal]\n    show ?thesis\n    proof (cases)\n      fix w\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> Abrupt w\" \n      assume exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal w\\<rangle> =n\\<Rightarrow> t\"\n      from Normal exec_c1 c1_c1' Catch.hyps obtain w' where\n        exec_c1': \"\\<Gamma>\\<turnstile>\\<langle>c1',Normal s'\\<rangle> =n\\<Rightarrow> w'\" and\n        w'_noFault:  \"\\<not> isFault w' \\<longrightarrow> w' = Abrupt w\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault w'\")\n        case True\n        with exec_c1' Normal show ?thesis\n          by (fastforce intro: execn.intros elim: isFaultE)\n      next\n        case False\n        with w'_noFault have w': \"w'=Abrupt w\" by simp\n        from Normal exec_c2 c2_c2' Catch.hyps obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c2',Normal w\\<rangle> =n\\<Rightarrow> t'\" \n          \"isFault t \\<longrightarrow> isFault t'\" \n          \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n          by blast\n        with exec_c1' w' Normal\n        show ?thesis\n          by (fastforce intro: execn.intros )\n      qed\n    next\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t\" \n      assume t: \"\\<not> isAbr t\"\n      from Normal exec_c1 c1_c1' Catch.hyps obtain t' where\n        exec_c1': \"\\<Gamma>\\<turnstile>\\<langle>c1',Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n        t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and\n        t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault t'\")\n        case True\n        with exec_c1' Normal show ?thesis\n          by (fastforce intro: execn.intros elim: isFaultE)\n      next\n        case False\n        with exec_c1' Normal t_Fault t'_noFault t\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    qed\n  qed\nqed\n\nlemma exec_to_exec_subseteq_guards: \n  assumes c_c': \"c \\<subseteq>\\<^sub>g c'\" \n  assumes  exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c',s\\<rangle> \\<Rightarrow> t' \\<and> \n             (isFault t \\<longrightarrow> isFault t') \\<and> (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof -\n  from exec_to_execn [OF exec] obtain n where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" ..\n  from execn_to_execn_subseteq_guards [OF c_c' this]\n  show ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\n  \n(* ************************************************************************* *)\nsubsection {* Lemmas about @{const \"merge_guards\"} *}\n(* ************************************************************************ *)\n\n\ntheorem execn_to_execn_merge_guards:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" \n shows \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> =n\\<Rightarrow> t \"\nusing exec_c \nproof (induct) \n  case (Guard s g c n t f)\n  have s_in_g: \"s \\<in> g\"  by fact\n  have exec_merge_c: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases \"\\<exists>f' g' c'. merge_guards c = Guard f' g' c'\")\n    case False\n    with exec_merge_c s_in_g\n    show ?thesis\n      by (cases \"merge_guards c\") (auto intro: execn.intros simp add: Let_def)\n  next\n    case True\n    then obtain f' g' c' where \n      merge_guards_c: \"merge_guards c = Guard f' g' c'\"\n      by iprover\n    show ?thesis\n    proof (cases \"f=f'\")\n      case False\n      from exec_merge_c s_in_g merge_guards_c False show ?thesis\n        by (auto intro: execn.intros simp add: Let_def)\n    next\n      case True\n      from exec_merge_c s_in_g merge_guards_c True show ?thesis \n        by (fastforce intro: execn.intros elim: execn.cases)\n    qed\n  qed\nnext\n  case (GuardFault s g f c n)\n  have s_notin_g: \"s \\<notin> g\"  by fact\n  show ?case\n  proof (cases \"\\<exists>f' g' c'. merge_guards c = Guard f' g' c'\")\n    case False\n    with s_notin_g\n    show ?thesis\n      by (cases \"merge_guards c\") (auto intro: execn.intros simp add: Let_def)\n  next\n    case True\n    then obtain f' g' c' where \n      merge_guards_c: \"merge_guards c = Guard f' g' c'\"\n      by iprover\n    show ?thesis\n    proof (cases \"f=f'\")\n      case False\n      from s_notin_g merge_guards_c False show ?thesis\n        by (auto intro: execn.intros simp add: Let_def)\n    next\n      case True\n      from  s_notin_g merge_guards_c True show ?thesis \n        by (fastforce intro: execn.intros)\n    qed\n  qed\nqed (fastforce intro: execn.intros)+\n\nlemma execn_merge_guards_to_execn_Normal:\n  \"\\<And>s n t. \\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \nproof (induct c)\n  case Skip thus ?case by auto\nnext\n  case Basic thus ?case by auto\nnext\n  case Spec thus ?case by auto\nnext\n  case (Seq c1 c2) \n  have \"\\<Gamma>\\<turnstile>\\<langle>merge_guards (Seq c1 c2),Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  hence exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>Seq (merge_guards c1) (merge_guards c2),Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by simp\n  then obtain s' where\n    exec_merge_c1: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c1,Normal s\\<rangle> =n\\<Rightarrow> s'\" and\n    exec_merge_c2: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c2,s'\\<rangle> =n\\<Rightarrow> t\"\n    by cases\n  from exec_merge_c1\n  have exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n    by (rule Seq.hyps)\n  show ?case\n  proof (cases s')\n    case (Normal s'')\n    with exec_merge_c2\n    have \"\\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: Seq.hyps)\n    with exec_c1 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Abrupt s'')\n    with exec_merge_c2 have \"t=Abrupt s''\"\n      by (auto dest: execn_Abrupt_end)\n    with exec_c1 Abrupt\n    show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Fault f)\n    with exec_merge_c2 have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with exec_c1 Fault\n    show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_merge_c2 have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with exec_c1 Stuck\n    show ?thesis\n      by (auto intro: execn.intros)\n  qed\nnext\n  case Cond thus ?case\n    by (fastforce intro: execn.intros elim: execn_Normal_elim_cases)\nnext\n  case (While b c)\n  {\n    fix c' r w\n    assume exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',r\\<rangle> =n\\<Rightarrow> w\"\n    assume c': \"c'=While b (merge_guards c)\"\n    have \"\\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> w\"\n      using exec_c' c' \n    proof (induct)\n      case (WhileTrue r b' c'' n u w)\n      have eqs: \"While b' c'' = While b (merge_guards c)\" by fact\n      from WhileTrue \n      have r_in_b: \"r \\<in> b\" \n        by simp\n      from WhileTrue While.hyps have exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal r\\<rangle> =n\\<Rightarrow> u\"\n        by simp\n      from WhileTrue have exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b c,u\\<rangle> =n\\<Rightarrow> w\"\n        by simp\n      from r_in_b exec_c exec_w\n      show ?case\n        by (rule execn.WhileTrue)\n    next\n      case WhileFalse thus ?case by (auto intro: execn.WhileFalse)\n    qed auto\n  }\n  with While.prems show ?case\n    by (auto)\nnext\n  case Call thus ?case by simp\nnext\n  case DynCom thus ?case\n    by (fastforce intro: execn.intros elim: execn_Normal_elim_cases)\nnext\n  case (Guard f g c)\n  have exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards (Guard f g c),Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases \"s \\<in> g\")\n    case False\n    with exec_merge have \"t=Fault f\"\n      by (auto split: com.splits split_if_asm elim: execn_Normal_elim_cases \n        simp add: Let_def is_Guard_def)\n    with False show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case True\n    note s_in_g = this\n    show ?thesis\n    proof (cases \"\\<exists>f' g' c'. merge_guards c = Guard f' g' c'\")\n      case False\n      then\n      have \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n        by (cases \"merge_guards c\") (auto simp add: Let_def)\n      with exec_merge s_in_g\n      obtain \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      from Guard.hyps [OF this] s_in_g\n      show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case True\n      then obtain f' g' c' where \n        merge_guards_c: \"merge_guards c = Guard f' g' c'\"\n        by iprover\n      show ?thesis\n      proof (cases \"f=f'\")\n        case False\n        with merge_guards_c\n        have \"merge_guards (Guard f g c) = Guard f g (merge_guards c)\"\n          by (simp add: Let_def)\n        with exec_merge s_in_g\n        obtain \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n          by (auto elim: execn_Normal_elim_cases)\n        from Guard.hyps [OF this] s_in_g\n        show ?thesis\n          by (auto intro: execn.intros)\n      next\n        case True\n        note f_eq_f' = this\n        with merge_guards_c have \n          merge_guards_Guard: \"merge_guards (Guard f g c) = Guard f (g \\<inter> g') c'\"\n          by simp\n        show ?thesis\n        proof (cases \"s \\<in> g'\")\n          case True\n          with exec_merge merge_guards_Guard merge_guards_c s_in_g\n          have \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n            by (auto intro: execn.intros elim: execn_Normal_elim_cases)\n          with Guard.hyps [OF this] s_in_g\n          show ?thesis\n            by (auto intro: execn.intros)\n        next\n          case False\n          with exec_merge merge_guards_Guard \n          have \"t=Fault f\"\n            by (auto elim: execn_Normal_elim_cases)\n          with merge_guards_c f_eq_f' False\n          have \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n            by (auto intro: execn.intros)\n          from Guard.hyps [OF this] s_in_g\n          show ?thesis\n            by (auto intro: execn.intros)\n        qed\n      qed\n    qed\n  qed\nnext\n  case Throw thus ?case by simp\nnext\n  case (Catch c1 c2)\n  have \"\\<Gamma>\\<turnstile>\\<langle>merge_guards (Catch c1 c2),Normal s\\<rangle> =n\\<Rightarrow> t\"  by fact\n  hence \"\\<Gamma>\\<turnstile>\\<langle>Catch (merge_guards c1) (merge_guards c2),Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n  thus ?case\n    by cases (auto intro: execn.intros Catch.hyps)\nqed\n  \ntheorem execn_merge_guards_to_execn:\n  \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> =n\\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> =n\\<Rightarrow> t\" \napply (cases s)\napply    (fastforce intro: execn_merge_guards_to_execn_Normal)\napply   (fastforce dest: execn_Abrupt_end)\napply  (fastforce dest: execn_Fault_end)\napply (fastforce dest: execn_Stuck_end)\ndone\n\ncorollary execn_iff_execn_merge_guards:\n \"\\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> =n\\<Rightarrow> t = \\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> =n\\<Rightarrow> t\"\n  by (blast intro: execn_merge_guards_to_execn execn_to_execn_merge_guards)\n\ntheorem exec_iff_exec_merge_guards:\n \"\\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> \\<Rightarrow> t = \\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> \\<Rightarrow> t\"\n  by (blast dest: exec_to_execn intro: execn_to_exec\n            intro: execn_to_execn_merge_guards\n                   execn_merge_guards_to_execn)\n\ncorollary exec_to_exec_merge_guards:\n \"\\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> \\<Rightarrow> t\"\n  by (rule iffD1 [OF exec_iff_exec_merge_guards])\n\ncorollary exec_merge_guards_to_exec:\n \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c, s\\<rangle> \\<Rightarrow> t\"\n  by (rule iffD2 [OF exec_iff_exec_merge_guards])\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{const \"mark_guards\"} *}\n(* ************************************************************************ *)\n\nlemma execn_to_execn_mark_guards:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" \n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,s\\<rangle> =n\\<Rightarrow> t \"\nusing exec_c t_not_Fault [simplified not_isFault_iff]\nby (induct) (auto intro: execn.intros dest: noFaultn_startD')\n\nlemma execn_to_execn_mark_guards_Fault:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n shows \"\\<And>f. \\<lbrakk>t=Fault f\\<rbrakk> \\<Longrightarrow> \\<exists>f'. \\<Gamma>\\<turnstile>\\<langle>mark_guards x c,s\\<rangle> =n\\<Rightarrow> Fault f'\"\nusing exec_c \nproof (induct)\n  case Skip thus ?case by auto\nnext\n  case Guard thus ?case by (fastforce intro: execn.intros)\nnext\n  case GuardFault thus ?case by (fastforce intro: execn.intros)\nnext\n  case FaultProp thus ?case by auto\nnext\n case Basic thus ?case by auto\nnext\n case Spec thus ?case by auto\nnext\n case SpecStuck thus ?case by auto\nnext\n  case (Seq c1 s n w c2 t)\n  have exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> w\" by fact\n  have exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t=Fault f\" by fact\n  show ?case\n  proof (cases w)\n    case (Fault f')\n    with exec_c2 t have \"f'=f\"\n      by (auto dest: execn_Fault_end)\n    with Fault Seq.hyps obtain f'' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c1,Normal s\\<rangle> =n\\<Rightarrow> Fault f''\"\n      by auto\n    moreover have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c2,Fault f''\\<rangle> =n\\<Rightarrow> Fault f''\"\n      by auto\n    ultimately show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Normal s')\n    with execn_to_execn_mark_guards [OF exec_c1] \n    have exec_mark_c1: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c1,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with Seq.hyps t obtain f' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c2,w\\<rangle> =n\\<Rightarrow> Fault f'\" \n      by blast\n    with exec_mark_c1 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Abrupt s')\n    with execn_to_execn_mark_guards [OF exec_c1] \n    have exec_mark_c1: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c1,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with Seq.hyps t obtain f' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c2,w\\<rangle> =n\\<Rightarrow> Fault f'\" \n      by (auto intro: execn.intros)\n    with exec_mark_c1 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_c2 have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with t show ?thesis by simp\n  qed\nnext\n  case CondTrue thus ?case by (fastforce intro: execn.intros)\nnext\n  case CondFalse thus ?case by (fastforce intro: execn.intros)\nnext\n  case (WhileTrue s b c n w t) \n  have exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> w\" by fact\n  have exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b c,w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t = Fault f\" by fact\n  have s_in_b: \"s \\<in> b\" by fact\n  show ?case\n  proof (cases w)\n    case (Fault f')\n    with exec_w t have \"f'=f\"\n      by (auto dest: execn_Fault_end)\n    with Fault WhileTrue.hyps obtain f'' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c,Normal s\\<rangle> =n\\<Rightarrow> Fault f''\"\n      by auto\n    moreover have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x (While b c),Fault f''\\<rangle> =n\\<Rightarrow> Fault f''\"\n      by auto\n    ultimately show ?thesis\n      using s_in_b by (auto intro: execn.intros)\n  next\n    case (Normal s')\n    with execn_to_execn_mark_guards [OF exec_c] \n    have exec_mark_c: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with WhileTrue.hyps t obtain f' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x (While b c),w\\<rangle> =n\\<Rightarrow> Fault f'\" \n      by blast\n    with exec_mark_c s_in_b show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Abrupt s')\n    with execn_to_execn_mark_guards [OF exec_c] \n    have exec_mark_c: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with WhileTrue.hyps t obtain f' where\n      \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x (While b c),w\\<rangle> =n\\<Rightarrow> Fault f'\" \n      by (auto intro: execn.intros)\n    with exec_mark_c s_in_b show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_w have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with t show ?thesis by simp\n  qed\nnext\n  case WhileFalse thus ?case by (fastforce intro: execn.intros)\nnext\n  case Call thus ?case by (fastforce intro: execn.intros)\nnext\n  case CallUndefined thus ?case by simp\nnext\n  case StuckProp thus ?case by simp\nnext\n  case DynCom thus ?case by (fastforce intro: execn.intros)\nnext\n  case Throw thus ?case by simp\nnext\n  case AbruptProp thus ?case by simp\nnext\n  case (CatchMatch c1 s n w c2 t) \n  have exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt w\" by fact\n  have exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t = Fault f\" by fact\n  from execn_to_execn_mark_guards [OF exec_c1]\n  have exec_mark_c1: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt w\"\n    by simp\n  with CatchMatch.hyps t obtain f' where\n    \"\\<Gamma>\\<turnstile>\\<langle>mark_guards x c2,Normal w\\<rangle> =n\\<Rightarrow> Fault f'\" \n    by blast\n  with exec_mark_c1 show ?case\n    by (auto intro: execn.intros)\nnext\n  case CatchMiss thus ?case by (fastforce intro: execn.intros)\nqed\n\nlemma execn_mark_guards_to_execn:\n  \"\\<And>s n t. \\<Gamma>\\<turnstile>\\<langle>mark_guards f c,s\\<rangle> =n\\<Rightarrow> t\n  \\<Longrightarrow> \\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t' \\<and> \n            (isFault t \\<longrightarrow> isFault t') \\<and> \n            (t' = Fault f \\<longrightarrow> t'=t) \\<and>\n            (isFault t' \\<longrightarrow> isFault t) \\<and>\n            (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof (induct c)\n  case Skip thus ?case by auto\nnext\n  case Basic thus ?case by auto\nnext\n  case Spec thus ?case by auto\nnext\n  case (Seq c1 c2 s n t)\n  have exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f (Seq c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  then obtain w where \n    exec_mark_c1: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c1,s\\<rangle> =n\\<Rightarrow> w\" and\n    exec_mark_c2: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c2,w\\<rangle> =n\\<Rightarrow> t\"\n    by (auto elim: execn_elim_cases)\n  from Seq.hyps exec_mark_c1\n  obtain w' where \n    exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> w'\" and\n    w_Fault: \"isFault w \\<longrightarrow> isFault w'\" and\n    w'_Fault_f: \"w' = Fault f \\<longrightarrow> w'=w\" and\n    w'_Fault: \"isFault w' \\<longrightarrow> isFault w\" and\n    w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w'=w\"\n    by blast\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec_mark have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_mark have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_mark have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"isFault w\")\n      case True\n      then obtain f where w': \"w=Fault f\"..\n      moreover with exec_mark_c2 \n      have t: \"t=Fault f\"\n        by (auto dest: execn_Fault_end)\n      ultimately show ?thesis\n        using Normal w_Fault w'_Fault_f exec_c1\n        by (fastforce intro: execn.intros elim: isFaultE)      \n    next\n      case False\n      note noFault_w = this\n      show ?thesis\n      proof (cases \"isFault w'\")\n        case True\n        then obtain f' where w': \"w'=Fault f'\"..\n        with Normal exec_c1 \n        have exec: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        from w'_Fault_f w' noFault_w\n        have \"f' \\<noteq> f\"\n          by (cases w) auto\n        moreover\n        from w' w'_Fault exec_mark_c2 have \"isFault t\" \n          by (auto dest: execn_Fault_end elim: isFaultE)\n        ultimately \n        show ?thesis\n          using exec\n          by auto\n      next\n        case False\n        with w'_noFault have w': \"w'=w\" by simp\n        from Seq.hyps exec_mark_c2\n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c2,w\\<rangle> =n\\<Rightarrow> t'\" and\n          \"isFault t \\<longrightarrow> isFault t'\" and\n          \"t' = Fault f \\<longrightarrow> t'=t\" and\n          \"isFault t' \\<longrightarrow> isFault t\" and\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with Normal exec_c1 w'\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    qed\n  qed\nnext\n  case (Cond b c1 c2 s n t)\n  have exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f (Cond b c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_mark have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_mark have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_mark have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"s'\\<in> b\")\n      case True\n      with Normal exec_mark\n      have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c1 ,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal True Cond.hyps obtain t'\n        where \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t'\" \n            \"isFault t \\<longrightarrow> isFault t'\" \n            \"t' = Fault f \\<longrightarrow> t'=t\"\n            \"isFault t' \\<longrightarrow> isFault t\"\n            \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with Normal True\n      show ?thesis\n        by (blast intro: execn.intros)\n    next\n      case False\n      with Normal exec_mark\n      have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c2 ,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal False Cond.hyps obtain t'\n        where \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> =n\\<Rightarrow> t'\" \n            \"isFault t  \\<longrightarrow> isFault t'\" \n            \"t' = Fault f  \\<longrightarrow> t'=t\"\n            \"isFault t' \\<longrightarrow> isFault t\"\n            \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with Normal False\n      show ?thesis\n        by (blast intro: execn.intros)\n    qed\n  qed\nnext\n  case (While b c s n t)\n  have exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f (While b c),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_mark have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_mark have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_mark have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    {\n      fix c' r w\n      assume exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',r\\<rangle> =n\\<Rightarrow> w\"\n      assume c': \"c'=While b (mark_guards f c)\"\n      have \"\\<exists>w'. \\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> w' \\<and> (isFault w \\<longrightarrow> isFault w') \\<and>\n                   (w' = Fault f \\<longrightarrow> w'=w) \\<and> (isFault w' \\<longrightarrow> isFault w) \\<and>\n                   (\\<not> isFault w' \\<longrightarrow> w'=w)\"\n        using exec_c' c' \n      proof (induct)\n        case (WhileTrue r b' c'' n u w)\n        have eqs: \"While b' c'' = While b (mark_guards f c)\" by fact\n        from WhileTrue.hyps eqs\n        have r_in_b: \"r\\<in>b\" by simp\n        from WhileTrue.hyps eqs\n        have exec_mark_c: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal r\\<rangle> =n\\<Rightarrow> u\" by simp\n        from WhileTrue.hyps eqs\n        have exec_mark_w: \"\\<Gamma>\\<turnstile>\\<langle>While b (mark_guards f c),u\\<rangle> =n\\<Rightarrow> w\"\n          by simp\n        show ?case\n        proof -\n          from WhileTrue.hyps eqs have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal r\\<rangle> =n\\<Rightarrow> u\"\n            by simp\n          with While.hyps\n          obtain u' where \n            exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal r\\<rangle> =n\\<Rightarrow> u'\" and\n            u_Fault: \"isFault u \\<longrightarrow> isFault u'\" and\n            u'_Fault_f: \"u' = Fault f \\<longrightarrow> u'=u\" and\n            u'_Fault: \"isFault u' \\<longrightarrow> isFault u\" and\n            u'_noFault: \"\\<not> isFault u' \\<longrightarrow> u'=u\"\n            by blast\n          show ?thesis\n          proof (cases \"isFault u'\")\n            case False\n            with u'_noFault have u': \"u'=u\" by simp\n            from WhileTrue.hyps eqs obtain w' where\n              \"\\<Gamma>\\<turnstile>\\<langle>While b c,u\\<rangle> =n\\<Rightarrow> w'\"\n              \"isFault w  \\<longrightarrow> isFault w'\"\n              \"w' = Fault f \\<longrightarrow> w'=w\" \n              \"isFault w' \\<longrightarrow> isFault w\" \n              \"\\<not> isFault w' \\<longrightarrow> w' = w\"\n              by blast\n            with u' exec_c r_in_b \n            show ?thesis\n              by (blast intro: execn.WhileTrue)\n          next\n            case True\n            then obtain f' where u': \"u'=Fault f'\"..\n            with exec_c r_in_b \n            have exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> =n\\<Rightarrow> Fault f'\"\n              by (blast intro: execn.intros)\n            from True u'_Fault have \"isFault u\"\n              by simp\n            then obtain f where u: \"u=Fault f\"..\n            with exec_mark_w have \"w=Fault f\"\n              by (auto dest: execn_Fault_end)\n            with exec u' u u'_Fault_f\n            show ?thesis\n              by auto\n          qed\n        qed\n      next\n        case (WhileFalse r b' c'' n)\n        have eqs: \"While b'  c'' = While b (mark_guards f c)\" by fact\n        from WhileFalse.hyps eqs\n        have r_not_in_b: \"r\\<notin>b\" by simp\n        show ?case\n        proof -\n          from r_not_in_b \n          have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> =n\\<Rightarrow> Normal r\"\n            by (rule execn.WhileFalse)\n          thus ?thesis\n            by blast\n        qed\n      qed auto\n    } note hyp_while = this\n    show ?thesis\n    proof (cases \"s'\\<in>b\") \n      case False\n      with Normal exec_mark\n      have \"t=s\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal False show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case True note s'_in_b = this\n      with Normal exec_mark obtain r where\n        exec_mark_c: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s'\\<rangle> =n\\<Rightarrow> r\" and\n        exec_mark_w: \"\\<Gamma>\\<turnstile>\\<langle>While b (mark_guards f c),r\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      from While.hyps exec_mark_c obtain r' where \n        exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s'\\<rangle> =n\\<Rightarrow> r'\" and\n        r_Fault: \"isFault r \\<longrightarrow> isFault r'\" and\n        r'_Fault_f: \"r' = Fault f \\<longrightarrow> r'=r\" and\n        r'_Fault: \"isFault r' \\<longrightarrow> isFault r\" and\n        r'_noFault: \"\\<not> isFault r' \\<longrightarrow> r'=r\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault r'\")\n        case False\n        with r'_noFault have r': \"r'=r\" by simp\n        from hyp_while exec_mark_w \n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> t'\"\n          \"isFault t \\<longrightarrow> isFault t'\"\n          \"t' = Fault f \\<longrightarrow> t'=t\"\n          \"isFault t' \\<longrightarrow> isFault t\"\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with r' exec_c Normal s'_in_b\n        show ?thesis\n          by (blast intro: execn.intros)\n      next\n        case True\n        then obtain f' where r': \"r'=Fault f'\"..\n        hence \"\\<Gamma>\\<turnstile>\\<langle>While b c,r'\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by auto \n        with Normal s'_in_b exec_c\n        have exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s'\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        from True r'_Fault\n        have \"isFault r\"\n          by simp\n        then obtain f where r: \"r=Fault f\"..\n        with exec_mark_w have \"t=Fault f\"\n          by (auto dest: execn_Fault_end)\n        with Normal exec r' r r'_Fault_f\n        show ?thesis\n          by auto\n      qed\n    qed\n  qed\nnext\n  case Call thus ?case by auto\nnext\n  case DynCom thus ?case \n    by (fastforce elim!: execn_elim_cases intro: execn.intros)\nnext\n  case (Guard f' g c s n t)\n  have exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f (Guard f' g c),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_mark have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_mark have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_mark have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"s'\\<in>g\")\n      case False\n      with Normal exec_mark have t: \"t=Fault f\"\n        by (auto elim: execn_Normal_elim_cases)\n      from False\n      have \"\\<Gamma>\\<turnstile>\\<langle>Guard f' g c,Normal s'\\<rangle> =n\\<Rightarrow> Fault f'\"\n        by (blast intro: execn.intros)\n      with Normal t show ?thesis\n        by auto\n    next\n      case True\n      with exec_mark Normal \n      have \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Guard.hyps obtain t' where\n        \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n        \"isFault t \\<longrightarrow> isFault t'\" and\n        \"t' = Fault f \\<longrightarrow> t'=t\" and\n        \"isFault t' \\<longrightarrow> isFault t\" and\n        \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n        by blast\n      with Normal True\n      show ?thesis\n        by (blast intro: execn.intros)\n    qed\n  qed\nnext\n  case Throw thus ?case by auto\nnext\n  case (Catch c1 c2 s n t)\n  have exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f (Catch c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec_mark have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_mark have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_mark have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s') note s=this\n    with exec_mark have \n      \"\\<Gamma>\\<turnstile>\\<langle>Catch (mark_guards f c1) (mark_guards f c2),Normal s'\\<rangle> =n\\<Rightarrow> t\" by simp\n    thus ?thesis\n    proof (cases)\n      fix w\n      assume exec_mark_c1: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c1,Normal s'\\<rangle> =n\\<Rightarrow> Abrupt w\"\n      assume exec_mark_c2: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c2,Normal w\\<rangle> =n\\<Rightarrow> t\"\n      from exec_mark_c1 Catch.hyps \n      obtain w' where \n        exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> w'\" and\n        w'_Fault_f: \"w' = Fault f \\<longrightarrow> w'=Abrupt w\" and\n        w'_Fault: \"isFault w' \\<longrightarrow> isFault (Abrupt w)\" and\n        w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w'=Abrupt w\"\n        by fastforce\n      show ?thesis\n      proof (cases \"w'\")\n        case (Fault f')\n        with Normal exec_c1 have \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,s\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        with w'_Fault Fault show ?thesis\n          by auto\n      next\n        case Stuck\n        with w'_noFault have False\n          by simp\n        thus ?thesis ..\n      next\n        case (Normal w'')\n        with w'_noFault have False by simp thus ?thesis ..\n      next\n        case (Abrupt w'')\n        with w'_noFault have w'': \"w''=w\" by simp\n        from  exec_mark_c2 Catch.hyps \n        obtain t' where \n          \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal w\\<rangle> =n\\<Rightarrow> t'\"\n          \"isFault t \\<longrightarrow> isFault t'\"\n          \"t' = Fault f \\<longrightarrow> t'=t\"\n          \"isFault t' \\<longrightarrow> isFault t\"\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with w'' Abrupt s exec_c1\n        show ?thesis\n          by (blast intro: execn.intros)\n      qed\n    next\n      assume t: \"\\<not> isAbr t\"\n      assume \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c1,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      with Catch.hyps \n      obtain t' where \n        exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t'\"  and\n        t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and\n        t'_Fault_f: \"t' = Fault f \\<longrightarrow> t'=t\" and\n        t'_Fault: \"isFault t' \\<longrightarrow> isFault t\" and\n        t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault t'\")\n        case True\n        then obtain f' where t': \"t'=Fault f'\"..\n        with exec_c1 have \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s'\\<rangle> =n\\<Rightarrow> Fault f'\" \n          by (auto intro: execn.intros)\n        with t'_Fault_f t'_Fault t' s show ?thesis\n          by auto\n      next\n        case False\n        with t'_noFault have \"t'=t\" by simp\n        with t exec_c1 s show ?thesis\n          by (blast intro: execn.intros)\n      qed\n    qed\n  qed\nqed\n\nlemma exec_to_exec_mark_guards:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" \n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,s\\<rangle> \\<Rightarrow> t \"\nproof -\n  from exec_to_execn [OF exec_c] obtain n where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" ..\n  from execn_to_execn_mark_guards [OF this t_not_Fault]\n  show ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\nlemma exec_to_exec_mark_guards_Fault:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Fault f\"\n shows \"\\<exists>f'. \\<Gamma>\\<turnstile>\\<langle>mark_guards x c,s\\<rangle> \\<Rightarrow> Fault f'\"\nproof -\n  from exec_to_execn [OF exec_c] obtain n where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Fault f\" ..\n  from execn_to_execn_mark_guards_Fault [OF this]\n  show ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\n\nlemma exec_mark_guards_to_exec:\n  assumes exec_mark: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and> \n            (isFault t \\<longrightarrow> isFault t') \\<and> \n            (t' = Fault f \\<longrightarrow> t'=t) \\<and>\n            (isFault t' \\<longrightarrow> isFault t) \\<and>\n            (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof -\n  from exec_to_execn [OF exec_mark] obtain n where\n    \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,s\\<rangle> =n\\<Rightarrow> t\" ..\n  from execn_mark_guards_to_execn [OF this]\n  show ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{const \"strip_guards\"} *}\n(* ************************************************************************* *)\n\nlemma execn_to_execn_strip_guards:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" \n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t \"\nusing exec_c t_not_Fault [simplified not_isFault_iff]\nby (induct) (auto intro: execn.intros dest: noFaultn_startD')\n\n\nlemma execn_to_execn_strip_guards_Fault:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n shows \"\\<And>f. \\<lbrakk>t=Fault f; f \\<notin> F\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> Fault f\"\nusing exec_c \nproof (induct)\n  case Skip thus ?case by auto\nnext\n  case Guard thus ?case by (fastforce intro: execn.intros)\nnext\n  case GuardFault thus ?case by (fastforce intro: execn.intros)\nnext\n  case FaultProp thus ?case by auto\nnext\n case Basic thus ?case by auto\nnext\n case Spec thus ?case by auto\nnext\n case SpecStuck thus ?case by auto\nnext\n  case (Seq c1 s n w c2 t)\n  have exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> w\" by fact\n  have exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t=Fault f\" by fact\n  have notinF: \"f \\<notin> F\" by fact\n  show ?case\n  proof (cases w)\n    case (Fault f')\n    with exec_c2 t have \"f'=f\"\n      by (auto dest: execn_Fault_end)\n    with Fault notinF Seq.hyps \n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    moreover have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,Fault f\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    ultimately show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Normal s')\n    with execn_to_execn_strip_guards [OF exec_c1] \n    have exec_strip_c1: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with Seq.hyps t notinF \n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,w\\<rangle> =n\\<Rightarrow> Fault f\" \n      by blast\n    with exec_strip_c1 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Abrupt s')\n    with execn_to_execn_strip_guards [OF exec_c1] \n    have exec_strip_c1: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with Seq.hyps t notinF \n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,w\\<rangle> =n\\<Rightarrow> Fault f\" \n      by (auto intro: execn.intros)\n    with exec_strip_c1 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_c2 have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with t show ?thesis by simp\n  qed\nnext\n  case CondTrue thus ?case by (fastforce intro: execn.intros)\nnext\n  case CondFalse thus ?case by (fastforce intro: execn.intros)\nnext\n  case (WhileTrue s b c n w t) \n  have exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> w\" by fact\n  have exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b c,w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t = Fault f\" by fact\n  have notinF: \"f \\<notin> F\" by fact\n  have s_in_b: \"s \\<in> b\" by fact\n  show ?case\n  proof (cases w)\n    case (Fault f')\n    with exec_w t have \"f'=f\"\n      by (auto dest: execn_Fault_end)\n    with Fault notinF WhileTrue.hyps \n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    moreover have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (While b c),Fault f\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    ultimately show ?thesis\n      using s_in_b by (auto intro: execn.intros)\n  next\n    case (Normal s')\n    with execn_to_execn_strip_guards [OF exec_c] \n    have exec_strip_c: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with WhileTrue.hyps t notinF \n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (While b c),w\\<rangle> =n\\<Rightarrow> Fault f\" \n      by blast\n    with exec_strip_c s_in_b show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case (Abrupt s')\n    with execn_to_execn_strip_guards [OF exec_c] \n    have exec_strip_c: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s\\<rangle> =n\\<Rightarrow> w\"\n      by simp\n    with WhileTrue.hyps t notinF \n    have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (While b c),w\\<rangle> =n\\<Rightarrow> Fault f\" \n      by (auto intro: execn.intros)\n    with exec_strip_c s_in_b show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_w have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with t show ?thesis by simp\n  qed\nnext\n  case WhileFalse thus ?case by (fastforce intro: execn.intros)\nnext\n  case Call thus ?case by (fastforce intro: execn.intros)\nnext\n  case CallUndefined thus ?case by simp\nnext\n  case StuckProp thus ?case by simp\nnext\n  case DynCom thus ?case by (fastforce intro: execn.intros)\nnext\n  case Throw thus ?case by simp\nnext\n  case AbruptProp thus ?case by simp\nnext\n  case (CatchMatch c1 s n w c2 t) \n  have exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt w\" by fact\n  have exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal w\\<rangle> =n\\<Rightarrow> t\" by fact\n  have t: \"t = Fault f\" by fact\n  have notinF: \"f \\<notin> F\" by fact\n  from execn_to_execn_strip_guards [OF exec_c1]\n  have exec_strip_c1: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt w\"\n    by simp\n  with CatchMatch.hyps t notinF \n  have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,Normal w\\<rangle> =n\\<Rightarrow> Fault f\" \n    by blast\n  with exec_strip_c1 show ?case\n    by (auto intro: execn.intros)\nnext\n  case CatchMiss thus ?case by (fastforce intro: execn.intros)\nqed\n\nlemma execn_to_execn_strip_guards':\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" \n assumes t_not_Fault: \"t \\<notin> Fault ` F\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t\"\nproof (cases t)\n  case (Fault f)\n  with t_not_Fault exec_c show ?thesis \n    by (auto intro: execn_to_execn_strip_guards_Fault)\nqed (insert exec_c, auto intro: execn_to_execn_strip_guards)\n  \nlemma execn_strip_guards_to_execn:\n  \"\\<And>s n t. \\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t\n  \\<Longrightarrow> \\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t' \\<and> \n            (isFault t \\<longrightarrow> isFault t') \\<and> \n            (t' \\<in> Fault ` (- F) \\<longrightarrow> t'=t) \\<and>\n            (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof (induct c)\n  case Skip thus ?case by auto\nnext\n  case Basic thus ?case by auto\nnext\n  case Spec thus ?case by auto\nnext\n  case (Seq c1 c2 s n t)\n  have exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (Seq c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  then obtain w where \n    exec_strip_c1: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,s\\<rangle> =n\\<Rightarrow> w\" and\n    exec_strip_c2: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,w\\<rangle> =n\\<Rightarrow> t\"\n    by (auto elim: execn_elim_cases)\n  from Seq.hyps exec_strip_c1\n  obtain w' where \n    exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> w'\" and\n    w_Fault: \"isFault w \\<longrightarrow> isFault w'\" and\n    w'_Fault: \"w' \\<in> Fault ` (- F) \\<longrightarrow> w'=w\" and\n    w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w'=w\"\n    by blast\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec_strip have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_strip have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_strip have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"isFault w\")\n      case True\n      then obtain f where w': \"w=Fault f\"..\n      moreover with exec_strip_c2 \n      have t: \"t=Fault f\"\n        by (auto dest: execn_Fault_end)\n      ultimately show ?thesis\n        using Normal w_Fault w'_Fault exec_c1\n        by (fastforce intro: execn.intros elim: isFaultE)      \n    next\n      case False\n      note noFault_w = this\n      show ?thesis\n      proof (cases \"isFault w'\")\n        case True\n        then obtain f' where w': \"w'=Fault f'\"..\n        with Normal exec_c1 \n        have exec: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        from w'_Fault w' noFault_w\n        have \"f' \\<in> F\"\n          by (cases w) auto\n        with exec \n        show ?thesis\n          by auto\n      next\n        case False\n        with w'_noFault have w': \"w'=w\" by simp\n        from Seq.hyps exec_strip_c2\n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c2,w\\<rangle> =n\\<Rightarrow> t'\" and\n          \"isFault t \\<longrightarrow> isFault t'\" and\n          \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" and\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with Normal exec_c1 w'\n        show ?thesis\n          by (fastforce intro: execn.intros)\n      qed\n    qed\n  qed\nnext\nnext\n  case (Cond b c1 c2 s n t)\n  have exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (Cond b c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_strip have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_strip have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_strip have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"s'\\<in> b\")\n      case True\n      with Normal exec_strip\n      have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1 ,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal True Cond.hyps obtain t'\n        where \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t'\" \n            \"isFault t \\<longrightarrow> isFault t'\" \n            \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\"\n            \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with Normal True\n      show ?thesis\n        by (blast intro: execn.intros)\n    next\n      case False\n      with Normal exec_strip\n      have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2 ,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal False Cond.hyps obtain t'\n        where \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> =n\\<Rightarrow> t'\" \n            \"isFault t  \\<longrightarrow> isFault t'\" \n            \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\"\n            \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n        by blast\n      with Normal False\n      show ?thesis\n        by (blast intro: execn.intros)\n    qed\n  qed\nnext\n  case (While b c s n t)\n  have exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (While b c),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_strip have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_strip have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_strip have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    {\n      fix c' r w\n      assume exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',r\\<rangle> =n\\<Rightarrow> w\"\n      assume c': \"c'=While b (strip_guards F c)\"\n      have \"\\<exists>w'. \\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> w' \\<and> (isFault w \\<longrightarrow> isFault w') \\<and>\n                   (w' \\<in> Fault ` (-F) \\<longrightarrow> w'=w) \\<and>\n                   (\\<not> isFault w' \\<longrightarrow> w'=w)\"\n        using exec_c' c' \n      proof (induct)\n        case (WhileTrue r b' c'' n u w)\n        have eqs: \"While b' c'' = While b (strip_guards F c)\" by fact\n        from WhileTrue.hyps eqs\n        have r_in_b: \"r\\<in>b\" by simp\n        from WhileTrue.hyps eqs\n        have exec_strip_c: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal r\\<rangle> =n\\<Rightarrow> u\" by simp\n        from WhileTrue.hyps eqs\n        have exec_strip_w: \"\\<Gamma>\\<turnstile>\\<langle>While b (strip_guards F c),u\\<rangle> =n\\<Rightarrow> w\"\n          by simp\n        show ?case\n        proof -\n          from WhileTrue.hyps eqs have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal r\\<rangle> =n\\<Rightarrow> u\"\n            by simp\n          with While.hyps\n          obtain u' where \n            exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal r\\<rangle> =n\\<Rightarrow> u'\" and\n            u_Fault: \"isFault u \\<longrightarrow> isFault u'\" and\n            u'_Fault: \"u' \\<in> Fault ` (-F) \\<longrightarrow> u'=u\" and\n            u'_noFault: \"\\<not> isFault u' \\<longrightarrow> u'=u\"\n            by blast\n          show ?thesis\n          proof (cases \"isFault u'\")\n            case False\n            with u'_noFault have u': \"u'=u\" by simp\n            from WhileTrue.hyps eqs obtain w' where\n              \"\\<Gamma>\\<turnstile>\\<langle>While b c,u\\<rangle> =n\\<Rightarrow> w'\"\n              \"isFault w  \\<longrightarrow> isFault w'\"\n              \"w' \\<in> Fault ` (-F) \\<longrightarrow> w'=w\" \n              \"\\<not> isFault w' \\<longrightarrow> w' = w\"\n              by blast\n            with u' exec_c r_in_b \n            show ?thesis\n              by (blast intro: execn.WhileTrue)\n          next\n            case True\n            then obtain f' where u': \"u'=Fault f'\"..\n            with exec_c r_in_b \n            have exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> =n\\<Rightarrow> Fault f'\"\n              by (blast intro: execn.intros)\n            show ?thesis\n            proof (cases \"isFault u\")\n              case True\n              then obtain f where u: \"u=Fault f\"..\n              with exec_strip_w have \"w=Fault f\"\n                by (auto dest: execn_Fault_end)\n              with exec u' u u'_Fault\n              show ?thesis\n                by auto\n            next\n              case False\n              with u'_Fault u' have \"f' \\<in> F\"\n                by (cases u) auto\n              with exec show ?thesis\n                by auto\n            qed\n          qed\n        qed\n      next\n        case (WhileFalse r b' c'' n)\n        have eqs: \"While b'  c'' = While b (strip_guards F c)\" by fact\n        from WhileFalse.hyps eqs\n        have r_not_in_b: \"r\\<notin>b\" by simp\n        show ?case\n        proof -\n          from r_not_in_b \n          have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> =n\\<Rightarrow> Normal r\"\n            by (rule execn.WhileFalse)\n          thus ?thesis\n            by blast\n        qed\n      qed auto\n    } note hyp_while = this\n    show ?thesis\n    proof (cases \"s'\\<in>b\") \n      case False\n      with Normal exec_strip\n      have \"t=s\"\n        by (auto elim: execn_Normal_elim_cases)\n      with Normal False show ?thesis\n        by (auto intro: execn.intros)\n    next\n      case True note s'_in_b = this\n      with Normal exec_strip obtain r where\n        exec_strip_c: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s'\\<rangle> =n\\<Rightarrow> r\" and\n        exec_strip_w: \"\\<Gamma>\\<turnstile>\\<langle>While b (strip_guards F c),r\\<rangle> =n\\<Rightarrow> t\"\n        by (auto elim: execn_Normal_elim_cases)\n      from While.hyps exec_strip_c obtain r' where \n        exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s'\\<rangle> =n\\<Rightarrow> r'\" and\n        r_Fault: \"isFault r \\<longrightarrow> isFault r'\" and\n        r'_Fault: \"r' \\<in> Fault ` (-F) \\<longrightarrow> r'=r\" and\n        r'_noFault: \"\\<not> isFault r' \\<longrightarrow> r'=r\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault r'\")\n        case False\n        with r'_noFault have r': \"r'=r\" by simp\n        from hyp_while exec_strip_w \n        obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> t'\"\n          \"isFault t \\<longrightarrow> isFault t'\"\n          \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\"\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with r' exec_c Normal s'_in_b\n        show ?thesis\n          by (blast intro: execn.intros)\n      next\n        case True\n        then obtain f' where r': \"r'=Fault f'\"..\n        hence \"\\<Gamma>\\<turnstile>\\<langle>While b c,r'\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by auto \n        with Normal s'_in_b exec_c\n        have exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s'\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        show ?thesis\n        proof (cases \"isFault r\")\n          case True\n          then obtain f where r: \"r=Fault f\"..\n          with exec_strip_w have \"t=Fault f\"\n            by (auto dest: execn_Fault_end)\n          with Normal exec r' r r'_Fault\n          show ?thesis\n            by auto\n        next\n          case False\n          with r'_Fault r' have \"f' \\<in> F\"\n            by (cases r) auto\n          with Normal exec show ?thesis\n            by auto\n        qed\n      qed\n    qed\n  qed\nnext\n  case Call thus ?case by auto\nnext\n  case DynCom thus ?case \n    by (fastforce elim!: execn_elim_cases intro: execn.intros)\nnext\n  case (Guard f g c s n t)\n  have exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (Guard f g c),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases s)\n    case (Fault f)\n    with exec_strip have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_strip have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_strip have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s')\n    show ?thesis\n    proof (cases \"f\\<in>F\")\n      case True\n      with exec_strip Normal \n      have exec_strip_c: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n        by simp\n      with Guard.hyps obtain t' where\n        \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n        \"isFault t \\<longrightarrow> isFault t'\" and\n        \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" and\n        \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n        by blast\n      with Normal True \n      show ?thesis\n        by (cases \"s'\\<in> g\") (fastforce intro: execn.intros)+\n    next\n      case False\n      note f_notin_F = this\n      show ?thesis\n      proof (cases \"s'\\<in>g\")\n        case False\n        with Normal exec_strip f_notin_F have t: \"t=Fault f\"\n          by (auto elim: execn_Normal_elim_cases)\n        from False\n        have \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s'\\<rangle> =n\\<Rightarrow> Fault f\"\n          by (blast intro: execn.intros)\n        with False Normal t show ?thesis\n          by auto\n      next\n        case True\n        with exec_strip Normal f_notin_F\n        have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n          by (auto elim: execn_Normal_elim_cases)\n        with Guard.hyps obtain t' where\n          \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s'\\<rangle> =n\\<Rightarrow> t'\" and\n          \"isFault t \\<longrightarrow> isFault t'\" and\n          \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" and\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with Normal True\n        show ?thesis\n          by (blast intro: execn.intros)\n      qed\n    qed\n  qed\nnext\n  case Throw thus ?case by auto\nnext\n  case (Catch c1 c2 s n t)\n  have exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F (Catch c1 c2),s\\<rangle> =n\\<Rightarrow> t\" by fact\n  show ?case\n  proof (cases \"s\")\n    case (Fault f)\n    with exec_strip have \"t=Fault f\"\n      by (auto dest: execn_Fault_end)\n    with Fault show ?thesis\n      by auto\n  next\n    case Stuck\n    with exec_strip have \"t=Stuck\"\n      by (auto dest: execn_Stuck_end)\n    with Stuck show ?thesis\n      by auto\n  next\n    case (Abrupt s')\n    with exec_strip have \"t=Abrupt s'\"\n      by (auto dest: execn_Abrupt_end)\n    with Abrupt show ?thesis\n      by auto\n  next\n    case (Normal s') note s=this\n    with exec_strip have \n      \"\\<Gamma>\\<turnstile>\\<langle>Catch (strip_guards F c1) (strip_guards F c2),Normal s'\\<rangle> =n\\<Rightarrow> t\" by simp\n    thus ?thesis\n    proof (cases)\n      fix w\n      assume exec_strip_c1: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s'\\<rangle> =n\\<Rightarrow> Abrupt w\"\n      assume exec_strip_c2: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c2,Normal w\\<rangle> =n\\<Rightarrow> t\"\n      from exec_strip_c1 Catch.hyps \n      obtain w' where \n        exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> w'\" and\n        w'_Fault: \"w' \\<in> Fault ` (-F) \\<longrightarrow> w'=Abrupt w\" and\n        w'_noFault: \"\\<not> isFault w' \\<longrightarrow> w'=Abrupt w\"\n        by blast\n      show ?thesis\n      proof (cases \"w'\")\n        case (Fault f')\n        with Normal exec_c1 have \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,s\\<rangle> =n\\<Rightarrow> Fault f'\"\n          by (auto intro: execn.intros)\n        with w'_Fault Fault show ?thesis\n          by auto\n      next\n        case Stuck\n        with w'_noFault have False\n          by simp\n        thus ?thesis ..\n      next\n        case (Normal w'')\n        with w'_noFault have False by simp thus ?thesis ..\n      next\n        case (Abrupt w'')\n        with w'_noFault have w'': \"w''=w\" by simp\n        from  exec_strip_c2 Catch.hyps \n        obtain t' where \n          \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal w\\<rangle> =n\\<Rightarrow> t'\"\n          \"isFault t \\<longrightarrow> isFault t'\"\n          \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\"\n          \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n          by blast\n        with w'' Abrupt s exec_c1\n        show ?thesis\n          by (blast intro: execn.intros)\n      qed\n    next\n      assume t: \"\\<not> isAbr t\"\n      assume \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c1,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      with Catch.hyps \n      obtain t' where \n        exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s'\\<rangle> =n\\<Rightarrow> t'\"  and\n        t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and\n        t'_Fault: \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" and\n        t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n        by blast\n      show ?thesis\n      proof (cases \"isFault t'\")\n        case True\n        then obtain f' where t': \"t'=Fault f'\"..\n        with exec_c1 have \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s'\\<rangle> =n\\<Rightarrow> Fault f'\" \n          by (auto intro: execn.intros)\n        with t'_Fault t' s show ?thesis\n          by auto\n      next\n        case False\n        with t'_noFault have \"t'=t\" by simp\n        with t exec_c1 s show ?thesis\n          by (blast intro: execn.intros)\n      qed\n    qed\n  qed\nqed\n\n\nlemma execn_strip_to_execn:\n  assumes exec_strip: \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t' \\<and> \n                 (isFault t \\<longrightarrow> isFault t') \\<and> \n                 (t' \\<in> Fault ` (- F) \\<longrightarrow> t'=t) \\<and>\n                 (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nusing exec_strip\nproof (induct)\n  case Skip thus ?case by (blast intro: execn.intros)\nnext\n  case Guard thus ?case by (blast intro: execn.intros)\nnext\n  case GuardFault thus ?case by (blast intro: execn.intros)\nnext\n  case FaultProp thus ?case by (blast intro: execn.intros)\nnext\n  case Basic thus ?case by (blast intro: execn.intros)\nnext\n  case Spec thus ?case by (blast intro: execn.intros)\nnext\n  case SpecStuck thus ?case by (blast intro: execn.intros)\nnext\n  case Seq thus ?case by (blast intro: execn.intros elim: isFaultE)\nnext\n  case CondTrue thus ?case by (blast intro: execn.intros)\nnext\n  case CondFalse thus ?case by (blast intro: execn.intros)\nnext\n  case WhileTrue thus ?case by (blast intro: execn.intros elim: isFaultE)\nnext\n  case WhileFalse thus ?case by (blast intro: execn.intros)\nnext\n  case Call thus ?case\n    by simp (blast intro: execn.intros dest: execn_strip_guards_to_execn)\nnext\n  case CallUndefined thus ?case\n    by simp (blast intro: execn.intros)\nnext\n  case StuckProp thus ?case\n    by blast\nnext\n  case DynCom thus ?case by (blast intro: execn.intros)\nnext\n  case Throw thus ?case by (blast intro: execn.intros)\nnext\n  case AbruptProp thus ?case by (blast intro: execn.intros)\nnext\n  case (CatchMatch c1 s n r c2 t)\n  then obtain r' t' where \n    exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> r'\"  and\n    r'_Fault: \"r' \\<in> Fault ` (-F) \\<longrightarrow> r' = Abrupt r\" and\n    r'_noFault: \"\\<not> isFault r' \\<longrightarrow> r' = Abrupt r\" and\n    exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal r\\<rangle> =n\\<Rightarrow> t'\" and\n    t_Fault: \"isFault t \\<longrightarrow> isFault t'\" and\n    t'_Fault: \"t' \\<in> Fault ` (-F) \\<longrightarrow> t' = t\" and\n    t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n    by blast\n  show ?case\n  proof (cases \"isFault r'\")\n    case True\n    then obtain f' where r': \"r'=Fault f'\"..\n    with exec_c1 have \"\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s\\<rangle> =n\\<Rightarrow> Fault f'\"\n      by (auto intro: execn.intros)\n    with r' r'_Fault show ?thesis\n      by (auto intro: execn.intros)\n  next\n    case False\n    with r'_noFault have \"r'=Abrupt r\" by simp\n    with exec_c1 exec_c2 t_Fault t'_noFault t'_Fault\n    show ?thesis \n      by (blast intro: execn.intros)\n  qed\nnext  \n  case CatchMiss thus ?case by (fastforce intro: execn.intros elim: isFaultE)\nqed\n\nlemma exec_strip_guards_to_exec: \n  assumes exec_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> t\" \n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and> \n              (isFault t \\<longrightarrow> isFault t') \\<and> \n              (t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t) \\<and>\n              (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof -\n  from exec_strip obtain n where \n    execn_strip: \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (auto simp add: exec_iff_execn)\n  then obtain t' where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t'\"  \n    \"isFault t \\<longrightarrow> isFault t'\" \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: execn_strip_guards_to_execn)\n  thus ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\nlemma exec_strip_to_exec: \n  assumes exec_strip: \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" \n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and> \n              (isFault t \\<longrightarrow> isFault t') \\<and> \n              (t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t) \\<and>\n              (\\<not> isFault t' \\<longrightarrow> t'=t)\"\nproof -\n  from exec_strip obtain n where \n    execn_strip: \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (auto simp add: exec_iff_execn)\n  then obtain t' where\n    \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t'\"  \n    \"isFault t \\<longrightarrow> isFault t'\" \"t' \\<in> Fault ` (-F) \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: execn_strip_to_execn)\n  thus ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\n\nlemma exec_to_exec_strip_guards:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" \n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\" \n    by (auto simp add: exec_iff_execn)\n  from this t_not_Fault\n  have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_to_execn_strip_guards )\n  thus \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> t\"\n    by (rule execn_to_exec)\nqed\n\nlemma exec_to_exec_strip_guards':\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" \n assumes t_not_Fault: \"t \\<notin> Fault ` F\"\n shows \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\" \n    by (auto simp add: exec_iff_execn)\n  from this t_not_Fault\n  have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_to_execn_strip_guards' )\n  thus \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> t\"\n    by (rule execn_to_exec)\nqed\n\nlemma execn_to_execn_strip:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" \n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\nusing exec_c t_not_Fault\nproof (induct)\n  case (Call p bdy s n  s')\n  have bdy: \"\\<Gamma> p = Some bdy\" by fact\n  from Call have \"strip F \\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n    by blast\n  from execn_to_execn_strip_guards [OF this] Call\n  have \"strip F \\<Gamma>\\<turnstile>\\<langle>strip_guards F bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n    by simp\n  moreover from bdy have \"(strip F \\<Gamma>) p = Some (strip_guards F bdy)\"\n    by simp\n  ultimately\n  show ?case\n    by (blast intro: execn.intros)\nnext\n  case CallUndefined thus ?case by (auto intro: execn.CallUndefined)\nqed (auto intro: execn.intros dest: noFaultn_startD' simp add: not_isFault_iff)\n\nlemma execn_to_execn_strip':\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" \n assumes t_not_Fault: \"t \\<notin> Fault ` F\"\n shows \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\nusing exec_c t_not_Fault\nproof (induct)\n  case (Call p bdy s n s')\n  have bdy: \"\\<Gamma> p = Some bdy\" by fact\n  from Call have \"strip F \\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n    by blast\n  from execn_to_execn_strip_guards' [OF this] Call\n  have \"strip F \\<Gamma>\\<turnstile>\\<langle>strip_guards F bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\"\n    by simp\n  moreover from bdy have \"(strip F \\<Gamma>) p = Some (strip_guards F bdy)\"\n    by simp\n  ultimately\n  show ?case\n    by (blast intro: execn.intros)\nnext\n  case CallUndefined thus ?case by (auto intro: execn.CallUndefined)\nnext\n  case (Seq c1 s n s' c2 t)\n  show ?case\n  proof (cases \"isFault s'\") \n    case False\n    with Seq show ?thesis\n      by (auto intro: execn.intros simp add: not_isFault_iff)\n  next\n    case True\n    then obtain f' where s': \"s'=Fault f'\" by (auto simp add: isFault_def)\n    with Seq obtain \"t=Fault f'\" and \"f' \\<notin> F\"\n      by (force dest: execn_Fault_end)\n    with Seq s' show ?thesis\n      by (auto intro: execn.intros)\n  qed\nnext\n  case (WhileTrue b c s n s' t)\n  show ?case\n  proof (cases \"isFault s'\") \n    case False\n    with WhileTrue show ?thesis\n      by (auto intro: execn.intros simp add: not_isFault_iff)\n  next\n    case True\n    then obtain f' where s': \"s'=Fault f'\" by (auto simp add: isFault_def)\n    with WhileTrue obtain \"t=Fault f'\" and \"f' \\<notin> F\"\n      by (force dest: execn_Fault_end)\n    with WhileTrue s' show ?thesis\n      by (auto intro: execn.intros)\n  qed\nqed (auto intro: execn.intros)\n\nlemma exec_to_exec_strip:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" \n assumes t_not_Fault: \"\\<not> isFault t\"\n shows \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\" \n    by (auto simp add: exec_iff_execn)\n  from this t_not_Fault\n  have \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_to_execn_strip)\n  thus \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n    by (rule execn_to_exec)\nqed\n\nlemma exec_to_exec_strip':\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" \n assumes t_not_Fault: \"t \\<notin> Fault ` F\"\n shows \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>t\" \n    by (auto simp add: exec_iff_execn)\n  from this t_not_Fault\n  have \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule execn_to_execn_strip' )\n  thus \"strip F \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n    by (rule execn_to_exec)\nqed\n\nlemma exec_to_exec_strip_guards_Fault:\n assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Fault f\"\n assumes f_notin_F: \"f \\<notin> F\"\n shows\"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> Fault f\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow>Fault f\" \n    by (auto simp add: exec_iff_execn)\n  from execn_to_execn_strip_guards_Fault [OF this _ f_notin_F]\n  have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> =n\\<Rightarrow> Fault f\"\n    by simp\n  thus \"\\<Gamma>\\<turnstile>\\<langle>strip_guards F c,s\\<rangle> \\<Rightarrow> Fault f\"\n    by (rule execn_to_exec)\nqed\n\n(* ************************************************************************* *)\nsubsection {* Lemmas about @{term \"c\\<^sub>1 \\<inter>\\<^sub>g c\\<^sub>2\"} *}\n(* ************************************************************************* *)\n\nlemma inter_guards_execn_Normal_noFault: \n  \"\\<And>c c2 s t n. \\<lbrakk>(c1 \\<inter>\\<^sub>g c2) = Some c; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t; \\<not> isFault t\\<rbrakk>\n        \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> t \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\nproof (induct c1)\n  case Skip\n  have \"(Skip \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain c2: \"c2=Skip\" and c: \"c=Skip\"\n    by (simp add: inter_guards_Skip)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"t=Normal s\"\n    by (auto elim: execn_Normal_elim_cases)\n  with Skip c2\n  show ?case\n    by (auto intro: execn.intros)\nnext\n  case (Basic f)\n  have \"(Basic f \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain c2: \"c2=Basic f\" and c: \"c=Basic f\"\n    by (simp add: inter_guards_Basic)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"t=Normal (f s)\"\n    by (auto elim: execn_Normal_elim_cases)\n  with Basic c2\n  show ?case\n    by (auto intro: execn.intros)\nnext\n  case (Spec r)\n  have \"(Spec r \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain c2: \"c2=Spec r\" and c: \"c=Spec r\"\n    by (simp add: inter_guards_Spec)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n  from this Spec c2 show ?case\n    by (cases) (auto intro: execn.intros)\nnext\n  case (Seq a1 a2)\n  have noFault: \"\\<not> isFault t\" by fact\n  have \"(Seq a1 a2 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain b1 b2 d1 d2 where\n    c2: \"c2=Seq b1 b2\" and \n    d1: \"(a1 \\<inter>\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\<inter>\\<^sub>g b2) = Some d2\" and\n    c: \"c=Seq d1 d2\"\n    by (auto simp add: inter_guards_Seq)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c obtain s' where \n    exec_d1: \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> s'\" and\n    exec_d2: \"\\<Gamma>\\<turnstile>\\<langle>d2,s'\\<rangle> =n\\<Rightarrow> t\"\n    by (auto elim: execn_Normal_elim_cases)\n  show ?case\n  proof (cases s')\n    case (Fault f')\n    with exec_d2 have \"t=Fault f'\" \n      by (auto intro: execn_Fault_end)\n    with noFault show  ?thesis by simp\n  next\n    case (Normal s'')\n    with d1 exec_d1 Seq.hyps\n    obtain \n      \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Normal s''\" and \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Normal s''\"\n      by auto\n    moreover\n    from Normal d2 exec_d2 noFault Seq.hyps\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a2,Normal s''\\<rangle> =n\\<Rightarrow> t\" and \"\\<Gamma>\\<turnstile>\\<langle>b2,Normal s''\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    ultimately\n    show ?thesis\n      using Normal c2 by (auto intro: execn.intros)\n  next\n    case (Abrupt s'')\n    with exec_d2 have \"t=Abrupt s''\"\n      by (auto simp add: execn_Abrupt_end)\n    moreover\n    from Abrupt d1 exec_d1 Seq.hyps\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s''\" and \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s''\"\n      by auto\n    moreover\n    obtain \n      \"\\<Gamma>\\<turnstile>\\<langle>a2,Abrupt s''\\<rangle> =n\\<Rightarrow> Abrupt s''\" and \"\\<Gamma>\\<turnstile>\\<langle>b2,Abrupt s''\\<rangle> =n\\<Rightarrow> Abrupt s''\"\n      by auto\n    ultimately\n    show ?thesis\n      using Abrupt c2 by (auto intro: execn.intros)\n  next\n    case Stuck\n    with exec_d2 have \"t=Stuck\"\n      by (auto simp add: execn_Stuck_end)\n    moreover\n    from Stuck d1 exec_d1 Seq.hyps\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Stuck\" and \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Stuck\"\n      by auto\n    moreover\n    obtain \n      \"\\<Gamma>\\<turnstile>\\<langle>a2,Stuck\\<rangle> =n\\<Rightarrow> Stuck\" and \"\\<Gamma>\\<turnstile>\\<langle>b2,Stuck\\<rangle> =n\\<Rightarrow> Stuck\"\n      by auto\n    ultimately\n    show ?thesis\n      using Stuck c2 by (auto intro: execn.intros)\n  qed\nnext\n  case (Cond b t1 e1)\n  have noFault: \"\\<not> isFault t\" by fact\n  have \"(Cond b t1 e1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain t2 e2 t3 e3 where\n    c2: \"c2=Cond b t2 e2\" and\n    t3: \"(t1 \\<inter>\\<^sub>g t2) = Some t3\" and\n    e3: \"(e1 \\<inter>\\<^sub>g e2) = Some e3\" and\n    c: \"c=Cond b t3 e3\"\n    by (auto simp add: inter_guards_Cond)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Cond b t3 e3,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by simp\n  then show ?case\n  proof (cases)\n    assume s_in_b: \"s\\<in>b\" \n    assume \"\\<Gamma>\\<turnstile>\\<langle>t3,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    with Cond.hyps t3 noFault\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>t1,Normal s\\<rangle> =n\\<Rightarrow> t\" \"\\<Gamma>\\<turnstile>\\<langle>t2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    with s_in_b c2 show ?thesis\n      by (auto intro: execn.intros)\n  next\n    assume s_notin_b: \"s\\<notin>b\" \n    assume \"\\<Gamma>\\<turnstile>\\<langle>e3,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    with Cond.hyps e3 noFault\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>e1,Normal s\\<rangle> =n\\<Rightarrow> t\" \"\\<Gamma>\\<turnstile>\\<langle>e2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    with s_notin_b c2 show ?thesis\n      by (auto intro: execn.intros)\n  qed\nnext\n  case (While b bdy1)\n  have noFault: \"\\<not> isFault t\" by fact\n  have \"(While b bdy1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain bdy2 bdy where\n    c2: \"c2=While b bdy2\" and\n    bdy: \"(bdy1 \\<inter>\\<^sub>g bdy2) = Some bdy\" and\n    c: \"c=While b bdy\"\n    by (auto simp add: inter_guards_While)\n  have exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  {\n    fix s t n w w1 w2\n    assume exec_w: \"\\<Gamma>\\<turnstile>\\<langle>w,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    assume w: \"w=While b bdy\"\n    assume noFault: \"\\<not> isFault t\"\n    from exec_w w noFault\n    have \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Normal s\\<rangle> =n\\<Rightarrow> t \\<and> \n          \\<Gamma>\\<turnstile>\\<langle>While b bdy2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    proof (induct)\n      prefer 10\n      case (WhileTrue s b' bdy' n s' s'')\n      have eqs: \"While b'  bdy' = While b bdy\" by fact\n      from WhileTrue have s_in_b: \"s \\<in> b\" by simp\n      have noFault_s'': \"\\<not> isFault s''\"  by fact\n      from WhileTrue \n      have exec_bdy: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\" by simp\n      from WhileTrue\n      have exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b bdy,s'\\<rangle> =n\\<Rightarrow> s''\" by simp\n      show ?case\n      proof (cases s')\n        case (Fault f)\n        with exec_w have \"s''=Fault f\"\n          by (auto intro: execn_Fault_end)\n        with noFault_s'' show ?thesis by simp\n      next\n        case (Normal s''')\n        with exec_bdy bdy While.hyps\n        obtain \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Normal s'''\" \n               \"\\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Normal s'''\"\n          by auto\n        moreover\n        from Normal WhileTrue\n        obtain \n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Normal s'''\\<rangle> =n\\<Rightarrow> s''\" \n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy2,Normal s'''\\<rangle> =n\\<Rightarrow> s''\"\n          by simp\n        ultimately show ?thesis\n          using s_in_b Normal\n          by (auto intro: execn.intros)\n      next\n        case (Abrupt s''')\n        with exec_bdy bdy While.hyps\n        obtain \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'''\" \n               \"\\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'''\"\n          by auto\n        moreover\n        from Abrupt WhileTrue\n        obtain \n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Abrupt s'''\\<rangle> =n\\<Rightarrow> s''\" \n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy2,Abrupt s'''\\<rangle> =n\\<Rightarrow> s''\"\n          by simp\n        ultimately show ?thesis\n          using s_in_b Abrupt\n          by (auto intro: execn.intros)\n      next\n        case Stuck\n        with exec_bdy bdy While.hyps\n        obtain \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Stuck\" \n               \"\\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Stuck\"\n          by auto\n        moreover\n        from Stuck WhileTrue\n        obtain \n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Stuck\\<rangle> =n\\<Rightarrow> s''\" \n          \"\\<Gamma>\\<turnstile>\\<langle>While b bdy2,Stuck\\<rangle> =n\\<Rightarrow> s''\"\n          by simp\n        ultimately show ?thesis\n          using s_in_b Stuck\n          by (auto intro: execn.intros)\n      qed\n    next\n      case WhileFalse thus ?case by (auto intro: execn.intros)\n    qed (simp_all)  \n  }\n  with this [OF exec_c c noFault] c2\n  show ?case\n    by auto\nnext\n  case Call thus ?case by (simp add: inter_guards_Call)\nnext\n  case (DynCom f1)  \n  have noFault: \"\\<not> isFault t\" by fact\n  have \"(DynCom f1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain f2 f where\n    c2: \"c2=DynCom f2\" and\n    f_defined: \"\\<forall>s. ((f1 s) \\<inter>\\<^sub>g (f2 s)) \\<noteq> None\" and\n    c: \"c=DynCom (\\<lambda>s. the ((f1 s) \\<inter>\\<^sub>g (f2 s)))\"\n    by (auto simp add: inter_guards_DynCom)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>DynCom (\\<lambda>s. the ((f1 s) \\<inter>\\<^sub>g (f2 s))),Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n  then show ?case\n  proof (cases)\n    assume exec_f: \"\\<Gamma>\\<turnstile>\\<langle>the (f1 s \\<inter>\\<^sub>g f2 s),Normal s\\<rangle> =n\\<Rightarrow> t\"\n    from f_defined obtain f where \"(f1 s \\<inter>\\<^sub>g f2 s) = Some f\"\n      by auto\n    with DynCom.hyps this exec_f c2 noFault\n    show ?thesis\n      using execn.DynCom by fastforce\n  qed\nnext\n  case Guard thus ?case \n    by (fastforce elim: execn_Normal_elim_cases intro: execn.intros \n        simp add: inter_guards_Guard)\nnext\n  case Throw thus ?case\n    by (fastforce elim: execn_Normal_elim_cases \n        simp add: inter_guards_Throw)\nnext\n  case (Catch a1 a2)\n  have noFault: \"\\<not> isFault t\" by fact\n  have \"(Catch a1 a2 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain b1 b2 d1 d2 where\n    c2: \"c2=Catch b1 b2\" and \n    d1: \"(a1 \\<inter>\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\<inter>\\<^sub>g b2) = Some d2\" and\n    c: \"c=Catch d1 d2\"\n    by (auto simp add: inter_guards_Catch)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Catch d1 d2,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n  then show ?case\n  proof (cases)\n    fix s'\n    assume \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\"\n    with d1 Catch.hyps\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\" and \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\"\n      by auto\n    moreover\n    assume \"\\<Gamma>\\<turnstile>\\<langle>d2,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n    with d2 Catch.hyps noFault\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a2,Normal s'\\<rangle> =n\\<Rightarrow> t\" and \"\\<Gamma>\\<turnstile>\\<langle>b2,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    ultimately\n    show ?thesis\n      using c2 by (auto intro: execn.intros)\n  next\n    assume \"\\<not> isAbr t\"\n    moreover\n    assume \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    with d1 Catch.hyps noFault\n    obtain \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> t\" and \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    ultimately\n    show ?thesis\n      using c2 by (auto intro: execn.intros)\n  qed\nqed\n\n\nlemma inter_guards_execn_noFault: \n  assumes c: \"(c1 \\<inter>\\<^sub>g c2) = Some c\"\n  assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n  assumes noFault: \"\\<not> isFault t\" \n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> t \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> =n\\<Rightarrow> t\"\nproof (cases s) \n  case (Fault f)\n  with exec_c have \"t = Fault f\"\n    by (auto intro: execn_Fault_end)\n    with noFault show ?thesis\n    by simp \nnext\n  case (Abrupt s')\n  with exec_c have \"t=Abrupt s'\"\n    by (simp add: execn_Abrupt_end)\n  with Abrupt show ?thesis by auto\nnext\n  case Stuck\n  with exec_c have \"t=Stuck\"\n    by (simp add: execn_Stuck_end)\n  with Stuck show ?thesis by auto\nnext\n  case (Normal s')\n  with exec_c noFault inter_guards_execn_Normal_noFault [OF c]\n  show ?thesis\n    by blast\nqed\n\nlemma inter_guards_exec_noFault: \n  assumes c: \"(c1 \\<inter>\\<^sub>g c2) = Some c\"\n  assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n  assumes noFault: \"\\<not> isFault t\" \n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> \\<Rightarrow> t\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (auto simp add: exec_iff_execn)\n  from c this noFault\n  have \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> t \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> =n\\<Rightarrow> t\"\n    by (rule inter_guards_execn_noFault)\n  thus ?thesis\n    by (auto intro: execn_to_exec)\nqed\n\n\nlemma inter_guards_execn_Normal_Fault: \n  \"\\<And>c c2 s n. \\<lbrakk>(c1 \\<inter>\\<^sub>g c2) = Some c; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\\<rbrakk>\n        \\<Longrightarrow> (\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> =n\\<Rightarrow> Fault f)\"\nproof (induct c1)\n  case Skip thus ?case by (fastforce simp add: inter_guards_Skip)\nnext\n  case (Basic f) thus ?case by (fastforce simp add: inter_guards_Basic)\nnext\n  case (Spec r) thus ?case by (fastforce simp add: inter_guards_Spec)\nnext\n  case (Seq a1 a2)\n  have \"(Seq a1 a2 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain b1 b2 d1 d2 where\n    c2: \"c2=Seq b1 b2\" and \n    d1: \"(a1 \\<inter>\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\<inter>\\<^sub>g b2) = Some d2\" and\n    c: \"c=Seq d1 d2\"\n    by (auto simp add: inter_guards_Seq)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  with c obtain s' where \n    exec_d1: \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> s'\" and\n    exec_d2: \"\\<Gamma>\\<turnstile>\\<langle>d2,s'\\<rangle> =n\\<Rightarrow> Fault f\"\n    by (auto elim: execn_Normal_elim_cases)\n  show ?case\n  proof (cases s')\n    case (Fault f')\n    with exec_d2 have \"f'=f\"\n      by (auto dest: execn_Fault_end)\n    with Fault d1 exec_d1 \n    have \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" \n      by (auto dest: Seq.hyps)\n    thus ?thesis\n    proof (cases rule: disjE [consumes 1])\n      assume \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" \n      hence \"\\<Gamma>\\<turnstile>\\<langle>Seq a1 a2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n        by (auto intro: execn.intros)\n      thus ?thesis\n        by simp\n    next\n      assume \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" \n      hence \"\\<Gamma>\\<turnstile>\\<langle>Seq b1 b2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n        by (auto intro: execn.intros)\n      with c2 show ?thesis\n        by simp\n    qed\n  next\n    case Abrupt with exec_d2 show ?thesis by (auto dest: execn_Abrupt_end)\n  next\n    case Stuck with exec_d2 show ?thesis by (auto dest: execn_Stuck_end)\n  next\n    case (Normal s'') \n    with inter_guards_execn_noFault [OF d1 exec_d1] obtain\n      exec_a1: \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Normal s''\" and\n      exec_b1: \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Normal s''\"\n      by simp\n    moreover from d2 exec_d2 Normal \n    have \"\\<Gamma>\\<turnstile>\\<langle>a2,Normal s''\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>b2,Normal s''\\<rangle> =n\\<Rightarrow> Fault f\" \n      by (auto dest: Seq.hyps)\n    ultimately show ?thesis\n      using c2 by (auto intro: execn.intros)\n  qed\nnext\n  case (Cond b t1 e1)\n  have \"(Cond b t1 e1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain t2 e2 t e where\n    c2: \"c2=Cond b t2 e2\" and\n    t: \"(t1 \\<inter>\\<^sub>g t2) = Some t\" and\n    e: \"(e1 \\<inter>\\<^sub>g e2) = Some e\" and\n    c: \"c=Cond b t e\"\n    by (auto simp add: inter_guards_Cond)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Cond b t e,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by simp\n  thus ?case\n  proof (cases)\n    assume \"s \\<in> b\"\n    moreover assume \"\\<Gamma>\\<turnstile>\\<langle>t,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    with t have \"\\<Gamma>\\<turnstile>\\<langle>t1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>t2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (auto dest: Cond.hyps)\n    ultimately show ?thesis using c2 c by (fastforce intro: execn.intros)\n  next\n    assume \"s \\<notin> b\"\n    moreover assume \"\\<Gamma>\\<turnstile>\\<langle>e,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    with e have \"\\<Gamma>\\<turnstile>\\<langle>e1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>e2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (auto dest: Cond.hyps)\n    ultimately show ?thesis using c2 c by (fastforce intro: execn.intros)\n  qed\nnext\n  case (While b bdy1)\n  have \"(While b bdy1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain bdy2 bdy where\n    c2: \"c2=While b bdy2\" and\n    bdy: \"(bdy1 \\<inter>\\<^sub>g bdy2) = Some bdy\" and\n    c: \"c=While b bdy\"\n    by (auto simp add: inter_guards_While)\n  have exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  {\n    fix s t n w w1 w2 \n    assume exec_w: \"\\<Gamma>\\<turnstile>\\<langle>w,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    assume w: \"w=While b bdy\"\n    assume Fault: \"t=Fault f\"\n    from exec_w w Fault\n    have \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\\<or>  \n          \\<Gamma>\\<turnstile>\\<langle>While b bdy2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    proof (induct)\n      case (WhileTrue s b' bdy' n  s' s'')\n      have eqs: \"While b' bdy' = While b bdy\" by fact\n      from WhileTrue have s_in_b: \"s \\<in> b\" by simp\n      have Fault_s'': \"s''=Fault f\"  by fact\n      from WhileTrue \n      have exec_bdy: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow> s'\" by simp\n      from WhileTrue\n      have exec_w: \"\\<Gamma>\\<turnstile>\\<langle>While b bdy,s'\\<rangle> =n\\<Rightarrow> s''\" by simp\n      show ?case\n      proof (cases s')\n        case (Fault f')\n        with exec_w Fault_s'' have \"f'=f\"\n          by (auto dest: execn_Fault_end)\n        with Fault exec_bdy bdy While.hyps\n        have \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n          by auto\n        with s_in_b show ?thesis\n          by (fastforce intro: execn.intros)\n      next\n        case (Normal s''')\n        with inter_guards_execn_noFault [OF bdy exec_bdy]\n        obtain \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Normal s'''\" \n               \"\\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Normal s'''\"\n          by auto\n        moreover\n        from Normal WhileTrue\n        have \"\\<Gamma>\\<turnstile>\\<langle>While b bdy1,Normal s'''\\<rangle> =n\\<Rightarrow> Fault f \\<or>\n              \\<Gamma>\\<turnstile>\\<langle>While b bdy2,Normal s'''\\<rangle> =n\\<Rightarrow> Fault f\"\n          by simp\n        ultimately show ?thesis\n          using s_in_b by (fastforce intro: execn.intros)\n      next\n        case (Abrupt s''')\n        with exec_w Fault_s'' show ?thesis by (fastforce dest: execn_Abrupt_end)\n      next\n        case Stuck\n        with exec_w Fault_s'' show ?thesis by (fastforce dest: execn_Stuck_end)\n      qed\n    next\n      case WhileFalse thus ?case by (auto intro: execn.intros)\n    qed (simp_all)  \n  }\n  with this [OF exec_c c] c2\n  show ?case\n    by auto\nnext\n  case Call thus ?case by (fastforce simp add: inter_guards_Call)\nnext\n  case (DynCom f1)\n  have \"(DynCom f1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain f2  where\n    c2: \"c2=DynCom f2\" and\n    F_defined: \"\\<forall>s. ((f1 s) \\<inter>\\<^sub>g (f2 s)) \\<noteq> None\" and\n    c: \"c=DynCom (\\<lambda>s. the ((f1 s) \\<inter>\\<^sub>g (f2 s)))\"\n    by (auto simp add: inter_guards_DynCom)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>DynCom (\\<lambda>s. the ((f1 s) \\<inter>\\<^sub>g (f2 s))),Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by simp\n  then show ?case\n  proof (cases)\n    assume exec_F: \"\\<Gamma>\\<turnstile>\\<langle>the (f1 s \\<inter>\\<^sub>g f2 s),Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    from F_defined obtain F where \"(f1 s \\<inter>\\<^sub>g f2 s) = Some F\"\n      by auto\n    with DynCom.hyps this exec_F c2 \n    show ?thesis\n      by (fastforce intro: execn.intros)\n  qed\nnext\n  case (Guard m g1 bdy1)\n  have \"(Guard m g1 bdy1 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain g2 bdy2 bdy where\n    c2: \"c2=Guard m g2 bdy2\" and\n    bdy: \"(bdy1 \\<inter>\\<^sub>g bdy2) = Some bdy\" and\n    c: \"c=Guard m (g1 \\<inter> g2) bdy\"\n    by (auto simp add: inter_guards_Guard)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Guard m (g1 \\<inter> g2) bdy,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    by simp\n  thus ?case\n  proof (cases)\n    assume f_m: \"Fault f = Fault m\"\n    assume \"s \\<notin> g1 \\<inter> g2\"\n    hence \"s\\<notin>g1 \\<or> s\\<notin>g2\"\n      by blast\n    with c2 f_m show ?thesis\n      by (auto intro: execn.intros)\n  next\n    assume \"s \\<in> g1 \\<inter> g2\"\n    moreover\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>bdy1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>bdy2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by (rule Guard.hyps)\n    ultimately show ?thesis\n      using c2\n      by (auto intro: execn.intros)\n  qed\nnext\n  case Throw thus ?case by (fastforce simp add: inter_guards_Throw)\nnext\n  case (Catch a1 a2)\n  have \"(Catch a1 a2 \\<inter>\\<^sub>g c2) = Some c\" by fact\n  then obtain b1 b2 d1 d2 where\n    c2: \"c2=Catch b1 b2\" and \n    d1: \"(a1 \\<inter>\\<^sub>g b1) = Some d1\" and d2: \"(a2 \\<inter>\\<^sub>g b2) = Some d2\" and\n    c: \"c=Catch d1 d2\"\n    by (auto simp add: inter_guards_Catch)\n  have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by fact\n  with c have \"\\<Gamma>\\<turnstile>\\<langle>Catch d1 d2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" by simp\n  thus ?case\n  proof (cases)\n    fix s'\n    assume \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\"\n    from inter_guards_execn_noFault [OF d1 this] obtain\n      exec_a1: \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\" and\n      exec_b1: \"\\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\"\n      by simp\n    moreover assume  \"\\<Gamma>\\<turnstile>\\<langle>d2,Normal s'\\<rangle> =n\\<Rightarrow> Fault f\"\n    with d2 \n    have \"\\<Gamma>\\<turnstile>\\<langle>a2,Normal s'\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>b2,Normal s'\\<rangle> =n\\<Rightarrow> Fault f\" \n      by (auto dest: Catch.hyps)\n    ultimately show ?thesis\n      using c2 by (fastforce intro: execn.intros)\n  next\n    assume \"\\<Gamma>\\<turnstile>\\<langle>d1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" \n    with d1 have \"\\<Gamma>\\<turnstile>\\<langle>a1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>b1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" \n      by (auto dest: Catch.hyps)\n    with c2 show ?thesis\n      by (fastforce intro: execn.intros)\n  qed\nqed\n\n\nlemma inter_guards_execn_Fault: \n  assumes c: \"(c1 \\<inter>\\<^sub>g c2) = Some c\"\n  assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Fault f\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> =n\\<Rightarrow> Fault f\"\nproof (cases s) \n  case (Fault f)\n  with exec_c show ?thesis\n    by (auto dest: execn_Fault_end)\nnext\n  case (Abrupt s')\n  with exec_c show ?thesis \n    by (fastforce dest: execn_Abrupt_end)\nnext\n  case Stuck\n  with exec_c show ?thesis \n    by (fastforce dest: execn_Stuck_end)\nnext\n  case (Normal s')\n  with exec_c inter_guards_execn_Normal_Fault [OF c]\n  show ?thesis\n    by blast\nqed\n\nlemma inter_guards_exec_Fault: \n  assumes c: \"(c1 \\<inter>\\<^sub>g c2) = Some c\"\n  assumes exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> Fault f\" \n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> \\<Rightarrow> Fault f\"\nproof -\n  from exec_c obtain n where \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> Fault f\"\n    by (auto simp add: exec_iff_execn)\n  from c this \n  have \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c2,s\\<rangle> =n\\<Rightarrow> Fault f\"\n    by (rule inter_guards_execn_Fault)\n  thus ?thesis\n    by (auto intro: execn_to_exec)\nqed\n\n\n(* ************************************************************************* *)\nsubsection \"Restriction of Procedure Environment\"\n(* ************************************************************************* *)\n\nlemma restrict_SomeD: \"(m|\\<^bsub>A\\<^esub>) x = Some y \\<Longrightarrow> m x = Some y\"\n  by (auto simp add: restrict_map_def split: split_if_asm)\n\n(* FIXME: To Map *)\nlemma restrict_dom_same [simp]: \"m|\\<^bsub>dom m\\<^esub> = m\"\n  apply (rule ext)\n  apply (clarsimp simp add: restrict_map_def)\n  apply (simp only: not_None_eq [symmetric])\n  apply rule\n  apply (drule sym)\n  apply blast\n  done\n\nlemma restrict_in_dom: \"x \\<in> A \\<Longrightarrow> (m|\\<^bsub>A\\<^esub>) x = m x\"\n  by (auto simp add: restrict_map_def)\n\n\nlemma exec_restrict_to_exec:\n  assumes exec_restrict: \"\\<Gamma>|\\<^bsub>A\\<^esub>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" \n  assumes notStuck: \"t\\<noteq>Stuck\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\nusing exec_restrict notStuck\nby (induct) (auto intro: exec.intros dest: restrict_SomeD Stuck_end)\n\nlemma execn_restrict_to_execn:\n  assumes exec_restrict: \"\\<Gamma>|\\<^bsub>A\\<^esub>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\" \n  assumes notStuck: \"t\\<noteq>Stuck\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\nusing exec_restrict notStuck\nby (induct) (auto intro: execn.intros dest: restrict_SomeD execn_Stuck_end)\n\nlemma restrict_NoneD: \"m x = None \\<Longrightarrow>  (m|\\<^bsub>A\\<^esub>) x = None\"\n  by (auto simp add: restrict_map_def split: split_if_asm)\n\n\n\n\nlemma exec_to_exec_restrict: \n  assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\" \n  shows \"\\<exists>t'. \\<Gamma>|\\<^bsub>P\\<^esub>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and> (t=Stuck \\<longrightarrow> t'=Stuck) \\<and> \n                (\\<forall>f. t=Fault f\\<longrightarrow> t'\\<in>{Fault f,Stuck}) \\<and> (t'\\<noteq>Stuck \\<longrightarrow> t'=t)\"\nproof -\n  from exec obtain n where \n    execn_strip: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n    by (auto simp add: exec_iff_execn)\n  from execn_to_execn_restrict [where P=P,OF this]\n  obtain t' where\n    \"\\<Gamma>|\\<^bsub>P\\<^esub>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t'\"  \n    \"t=Stuck \\<longrightarrow> t'=Stuck\" \"\\<forall>f. t=Fault f\\<longrightarrow> t'\\<in>{Fault f,Stuck}\" \"t'\\<noteq>Stuck \\<longrightarrow> t'=t\"\n    by blast\n  thus ?thesis\n    by (blast intro: execn_to_exec)\nqed\n\nlemma notStuck_GuardD: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Guard m g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; s \\<in> g\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.Guard )\n\nlemma notStuck_SeqD1: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.Seq )\n\n\nlemma notStuck_SeqD2: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>s'\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.Seq )\n\nlemma notStuck_SeqD: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\\<rbrakk> \\<Longrightarrow> \n     \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck} \\<and> (\\<forall>s'. \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>s' \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c2,s'\\<rangle> \\<Rightarrow>\\<notin>{Stuck})\"\n  by (auto simp add: final_notin_def dest: exec.Seq )\n\nlemma notStuck_CondTrueD: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; s \\<in> b\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.CondTrue)\n\nlemma notStuck_CondFalseD: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; s \\<notin> b\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.CondFalse)\n\nlemma notStuck_WhileTrueD1: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; s \\<in> b\\<rbrakk> \n   \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.WhileTrue)\n\nlemma notStuck_WhileTrueD2: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>s'; s \\<in> b\\<rbrakk> \n   \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>While b c,s'\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.WhileTrue)\n\nlemma notStuck_CallD: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Call p ,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma> p = Some bdy\\<rbrakk> \n   \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.Call)\n\nlemma notStuck_CallDefinedD: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\\<rbrakk> \n   \\<Longrightarrow> \\<Gamma> p \\<noteq> None\"\n  by (cases \"\\<Gamma> p\") \n     (auto simp add: final_notin_def dest:  exec.CallUndefined)\n\nlemma notStuck_DynComD: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\\<rbrakk> \n   \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>(c s),Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.DynCom)\n\nlemma notStuck_CatchD1: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\\<rbrakk> \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.CatchMatch exec.CatchMiss )\n\nlemma notStuck_CatchD2: \n  \"\\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>Catch c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}; \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>Abrupt s'\\<rbrakk> \n   \\<Longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s'\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n  by (auto simp add: final_notin_def dest: exec.CatchMatch)\n\n\n(* ************************************************************************* *)\nsubsection \"Miscellaneous\"\n(* ************************************************************************* *)\n\nlemma execn_noguards_no_Fault:\n assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes noguards_c: \"noguards c\"\n assumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\n assumes s_no_Fault: \"\\<not> isFault s\"\n shows \"\\<not> isFault t\"\n  using execn noguards_c s_no_Fault\n  proof (induct) \n    case (Call p bdy n s t) with noguards_\\<Gamma> show ?case\n      apply -\n      apply (drule bspec [where x=p])\n      apply auto\n      done\n  qed (auto)\n\nlemma exec_noguards_no_Fault:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes noguards_c: \"noguards c\"\n assumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\n assumes s_no_Fault: \"\\<not> isFault s\"\n shows \"\\<not> isFault t\"\n  using exec noguards_c s_no_Fault\n  proof (induct) \n    case (Call p bdy s t) with noguards_\\<Gamma> show ?case\n      apply -\n      apply (drule bspec [where x=p])\n      apply auto\n      done\n  qed auto\n    \nlemma execn_nothrows_no_Abrupt:\n assumes execn: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes nothrows_c: \"nothrows c\"\n assumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\n assumes s_no_Abrupt: \"\\<not>(isAbr s)\"\n shows \"\\<not>(isAbr t)\"\n  using execn nothrows_c s_no_Abrupt\n  proof (induct) \n    case (Call p bdy n s t) with nothrows_\\<Gamma> show ?case\n      apply -\n      apply (drule bspec [where x=p])\n      apply auto\n      done\n  qed (auto)\n\nlemma exec_nothrows_no_Abrupt:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes nothrows_c: \"nothrows c\"\n assumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\n assumes s_no_Abrupt: \"\\<not>(isAbr s)\"\n shows \"\\<not>(isAbr t)\"\n  using exec nothrows_c s_no_Abrupt\n  proof (induct) \n    case (Call p bdy s t) with nothrows_\\<Gamma> show ?case\n      apply -\n      apply (drule bspec [where x=p])\n      apply auto\n      done\n  qed (auto)\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/Semantic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6548947290421276, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3351205071840919}}
{"text": "theory Proof_1_590\n  imports Proofs1\nbegin\n\nabbreviation s where \"s s0 PdOut_value paid_value opened_value \\<equiv> \n  (toEnv\n       (setPstate\n         (setVarBool\n           (setPstate\n             (setVarBool\n               (setVarBool (setVarBool (setVarBool s0 Init' PdOut_value) Init'init' paid_value) Controller'isClosed' opened_value)\n               Controller'minimalOpened' False)\n             Init'init' Controller'isClosed')\n           Controller'isOpened' False)\n         Controller'minimalOpened' STOP))\"\n\ntheorem proof_1_590: \"VC590 inv1 env s0 PdOut_value paid_value opened_value\"\n  apply(unfold VC590_def inv1_def R1_def)\n  apply(rule impI)\n  apply(rule conjI)\n   apply(rule conjI)\n    apply simp\n   apply(unfold extraInv_def)\n   apply(erule conjE)\n   apply(erule conjE)\n   apply((rule allI)+)\n  subgoal premises vc_prems for s1 s2\n    apply(insert vc_prems(2))\n    apply(erule conjE)\n    subgoal premises invs0\n      apply(rule impI)\n      apply((erule conjE)+)\n      apply(erule le_imp_less_or_eq[THEN disjE])\n      apply(rule cut_rl[of \" \\<exists>s4. toEnvP s4 \\<and>\n         substate s2 s4 \\<and>\n         substate s4 s0 \\<and>\n         toEnvNum s2 s4 \\<le> 10 - 1 \\<and>\n         \\<not> getVarBool s4 Controller'minimalOpened' \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow> getVarBool s3 Controller'minimalOpened')\"])\n      apply(erule exE)\n    subgoal for s4\n      apply(rule exI[of _ s4])\n      by simp\n     apply(insert invs0(1))[1]\n     apply(erule conjE)\n     apply(erule allE[of _ s1])\n     apply(erule allE[of _ s2])\n     apply(simp split: if_splits)\n      apply(rule cut_rl[of \"\\<forall> s5. toEnvP s5 \\<and> substate s2 s5 \\<and> substate s5 (s s0 PdOut_value paid_value opened_value) \\<longrightarrow>\npred1 s1 s2 (s s0 PdOut_value paid_value opened_value) s5\"])\n     apply(erule allE[of _ s2])\n     apply(erule impE)\n    using substate_refl apply blast\n     apply(unfold pred1_def)\n     apply(erule impE)\n      apply(insert substate_refl substate_trans substate_antisym)[1]\n      apply blast\n     apply assumption\n      apply(rule allI)\n      subgoal premises prems for s5\n        apply(induction rule: state_ind)\n        using prems apply simp\n         apply(rule impI)\n\n         apply(rule exI[of _  \"s s0 PdOut_value paid_value opened_value\"])\n         apply(((rule conjI),simp)+)\n        using substate_trans substate_antisym apply blast\n\n       subgoal for s5\n          apply(rule impI)\n          apply(cases \"getVarBool (predEnv s5) open' = False\")\n           apply(rule exI[of _ \"predEnv s5\"])\n           apply(rule conjI)\n        apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n            apply blast\n       apply(rule conjI)\n          using substate_refl apply simp\n       apply(rule conjI)\n      using predEnv_substate substate_trans apply blast\n       apply(rule conjI)\n      using toEnvNum3[of s2 \"predEnv s5\"\n \"(s s0 PdOut_value paid_value opened_value) \"] \n       apply force\n       apply(rule conjI)\n        apply blast\n      using substate_antisym apply blast\n      apply(drule impE)\n        prefer 3\n        apply assumption\n       apply(((rule conjI),blast)+)\n      using substate_imp_substatete_predEnv_or_eq apply blast\n      apply(drule exE)\n       prefer 2\n       apply assumption\n      subgoal for s4\n        apply(rule exI[of _ s4])\n       apply(rule conjI)\n         apply blast\n        apply(rule conjI)\n        using predEnv_substate substate_trans apply blast\n        apply(((rule conjI),blast)+)\n        using predEnv_substate_imp_substate_or_eq by blast\n      done\n    done\n  done\n  done", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/turnstile/Proof_1_590.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.33512050718409186}}
{"text": "theory Normalized_Zone_Semantics_Certification_Impl\n  imports\n    TA_Impl.Normalized_Zone_Semantics_Impl_Refine\n    Normalized_Zone_Semantics_Certification\n    Collections.Refine_Dflt_ICF\n    Certification.Unreachability_Certification2\n    Certification.Unreachability_Certification\n    \"HOL-Library.IArray\"\n    Deadlock.Deadlock_Impl\n    TA_Library.More_Methods\n    \"HOL-Library.Rewrite\"\nbegin\n\nparagraph \\<open>Misc\\<close>\n\nlemma (in Graph_Defs) run_first_reaches:\n  \"pred_stream (reaches x) xs\" if \"run (x ## xs)\"\nproof -\n  from that obtain a where \"run (a ## xs)\" \"reaches x a\"\n    by auto\n  then show ?thesis\n    by (coinduction arbitrary: a xs rule: stream_pred_coinduct) (auto 4 3 elim: run.cases)\nqed\n\nlemma (in Graph_Start_Defs) run_reachable:\n  \"pred_stream reachable xs\" if \"run (s\\<^sub>0 ## xs)\"\n  using run_first_reaches[OF that] unfolding reachable_def .\n\nlemma pred_stream_stream_all2_combine:\n  assumes \"pred_stream P xs\" \"stream_all2 Q xs ys\" \"\\<And>x y. P x \\<Longrightarrow> Q x y \\<Longrightarrow> R x y\"\n  shows \"stream_all2 R xs ys\"\n  using assms by (auto intro: stream_all2_combine simp: stream.pred_rel eq_onp_def)\n\nlemma stream_all2_pred_stream_combine:\n  assumes \"stream_all2 Q xs ys\" \"pred_stream P ys\" \"\\<And>x y. Q x y \\<Longrightarrow> P y \\<Longrightarrow> R x y\"\n  shows \"stream_all2 R xs ys\"\n  using assms by (auto intro: stream_all2_combine simp: stream.pred_rel eq_onp_def)\n\nlemma map_set_rel:\n  assumes \"list_all P xs\" \"(f, g) \\<in> {(xs, ys). xs = ys \\<and> P xs} \\<rightarrow> B\"\n  shows \"(map f xs, g ` set xs) \\<in> \\<langle>B\\<rangle>list_set_rel\"\n  unfolding list_set_rel_def\n  apply (rule relcompI[where b = \"map g xs\"])\n  apply parametricity\n  using assms unfolding list_rel_def list_all_iff by (auto intro: list.rel_refl_strong)\n\ncontext TA_Start\nbegin\n\n(* XXX This is in Normalized_Zone_Semantics_Impl but in the wrong context *)\nlemma V_I:\n  assumes \"\\<forall> i \\<in> {1..<Suc n}. M 0 i \\<le> 0\"\n  shows \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> V\"\n  unfolding V_def DBM_zone_repr_def\nproof (safe, goal_cases)\n  case prems: (1 u i)\n  then have \"v i = i\"\n    using X_alt_def X_def triv_numbering by blast\n  with prems have \"v i > 0\" \"v i \\<le> n\" by auto\n  with prems have \"dbm_entry_val u None (Some i) (M 0 (v i))\"\n    unfolding DBM_val_bounded_def by auto\n  moreover from assms \\<open>v i > 0\\<close> \\<open>v i \\<le> n\\<close> have \"M 0 (v i) \\<le> 0\" by auto\n  ultimately\n  show ?case\n    apply (cases \"M 0 (v i)\")\n    unfolding neutral less_eq dbm_le_def\n    by (auto elim!: dbm_lt.cases simp: \\<open>v i = i\\<close>)\nqed\n\nend\n\nlemma Simulation_Composition:\n  fixes A B C\n  assumes\n    \"Simulation A B sim1\" \"Simulation B C sim2\" \"\\<And>a c. (\\<exists> b. sim1 a b \\<and> sim2 b c) \\<longleftrightarrow> sim a c\"\n  shows \"Simulation A C sim\"\nproof -\n  interpret A: Simulation A B sim1\n    by (rule assms)\n  interpret B: Simulation B C sim2\n    by (rule assms)\n  show ?thesis\n    by standard (auto dest!: B.A_B_step A.A_B_step simp: assms(3)[symmetric])\nqed\n\nlemma fold_generalize_start:\n  assumes \"\\<And>a. P a \\<Longrightarrow> Q (fold g xs a)\" \"P a\"\n  shows \"Q (fold g xs a)\"\n  using assms by auto\n\ndefinition\n  \"set_of_list xs = SPEC (\\<lambda>S. set xs = S)\"\n\n(* XXX Move *)\nlemma set_of_list_hnr:\n  \"(return o id, set_of_list) \\<in> (list_assn A)\\<^sup>d \\<rightarrow>\\<^sub>a lso_assn A\"\n  unfolding set_of_list_def lso_assn_def hr_comp_def br_def by sepref_to_hoare sep_auto\n\nlemma set_of_list_alt_def:\n  \"set_of_list = RETURN o set\"\n  unfolding set_of_list_def by auto\n\nlemmas set_of_list_hnr' = set_of_list_hnr[unfolded set_of_list_alt_def]\n\n\nlemmas amtx_copy_hnr = amtx_copy_hnr[unfolded op_mtx_copy_def, folded COPY_def[abs_def]]\n\nlemma lso_op_set_is_empty_hnr[sepref_fr_rules]:\n  \"(return o (\\<lambda>xs. xs = []), RETURN o op_set_is_empty) \\<in> (lso_assn AA)\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  unfolding lso_assn_def hr_comp_def br_def by sepref_to_hoare sep_auto\n\ncontext\n  fixes n :: nat\nbegin\n\nqualified definition\n  \"dbm_tab M \\<equiv> \\<lambda> (i, j). if i \\<le> n \\<and> j \\<le> n then M ! ((n + 1) * i + j) else 0\"\n\nprivate lemma\n  shows mtx_nonzero_dbm_tab_1: \"(a, b) \\<in> mtx_nonzero (dbm_tab M) \\<Longrightarrow> a < Suc n\"\n    and mtx_nonzero_dbm_tab_2: \"(a, b) \\<in> mtx_nonzero (dbm_tab M) \\<Longrightarrow> b < Suc n\"\n  unfolding mtx_nonzero_def dbm_tab_def by (auto split: if_split_asm)\n\ndefinition\n  \"list_to_dbm M = op_amtx_new (Suc n) (Suc n) (dbm_tab M)\"\n\nlemma [sepref_fr_rules]:\n  \"(return o dbm_tab, RETURN o PR_CONST dbm_tab) \\<in> id_assn\\<^sup>k \\<rightarrow>\\<^sub>a pure (nat_rel \\<times>\\<^sub>r nat_rel \\<rightarrow> Id)\"\n  by sepref_to_hoare sep_auto\n\nlemmas [sepref_opt_simps] = dbm_tab_def\n\nsepref_register dbm_tab\n\nsepref_definition list_to_dbm_impl\n  is \"RETURN o PR_CONST list_to_dbm\" :: \"id_assn\\<^sup>k \\<rightarrow>\\<^sub>a mtx_assn n\"\n  supply mtx_nonzero_dbm_tab_1[simp] mtx_nonzero_dbm_tab_2[simp]\n  unfolding PR_CONST_def list_to_dbm_def by sepref\n\nlemma the_pure_Id:\n  \"the_pure (\\<lambda>a c. \\<up> (c = a)) = Id\"\n  by (subst is_pure_the_pure_id_eq) (auto simp: pure_def intro: is_pureI)\n\nlemma of_list_list_to_dbm:\n  \"(Array.of_list, (RETURN \\<circ>\\<circ> PR_CONST) list_to_dbm)\n  \\<in> [\\<lambda>a. length a = Suc n * Suc n]\\<^sub>a id_assn\\<^sup>k \\<rightarrow> mtx_assn n\"\n  apply sepref_to_hoare\n  apply sep_auto\n  unfolding amtx_assn_def hr_comp_def IICF_Array_Matrix.is_amtx_def\n  apply (sep_auto eintros del: exI)\n  subgoal for xs p\n    apply (rule exI[where x = \"list_to_dbm xs\"])\n    apply (rule exI[where x = xs])\n    apply (sep_auto simp: list_to_dbm_def dbm_tab_def the_pure_Id)\n     apply (simp add: algebra_simps; fail)\n    apply sep_auto\n    done\n  done\n\nend\n\ndefinition\n  \"array_freeze a = do {xs \\<leftarrow> Array.freeze a; Heap_Monad.return (IArray xs)}\"\n\ndefinition\n  \"array_unfreeze a = Array.of_list (IArray.list_of a)\"\n\ndefinition\n  \"iarray_mtx_rel n m c a \\<equiv>\n    IArray.length a = n * m\n  \\<and> (\\<forall>i<n.\\<forall>j<m. c (i, j) = IArray.sub a (i * m + j))\n  \\<and> (\\<forall>i j. i \\<ge> n \\<or> j \\<ge> m \\<longrightarrow> c (i, j) = 0)\"\n\nlemma iarray_mtx_rel_is_amtx:\n  \"x \\<mapsto>\\<^sub>a IArray.list_of a \\<Longrightarrow>\\<^sub>A IICF_Array_Matrix.is_amtx n m c x\" if \"iarray_mtx_rel n m c a\"\n  using that unfolding is_amtx_def iarray_mtx_rel_def by simp solve_entails\n\nlemma array_unfreeze_ht:\n  \"<emp> array_unfreeze a <amtx_assn n m id_assn c>\" if \"iarray_mtx_rel n m c a\"\n  using that unfolding array_unfreeze_def amtx_assn_def by (sep_auto intro: iarray_mtx_rel_is_amtx)\n\nlemma array_freeze_ht:\n  \"<amtx_assn n m id_assn c a> array_freeze a <\\<lambda>a. \\<up>(iarray_mtx_rel n m c a)>\\<^sub>t\"\n  unfolding array_freeze_def amtx_assn_def iarray_mtx_rel_def is_amtx_def\n  by (sep_auto intro: iarray_mtx_rel_is_amtx)\n\n\ndatatype ('a, 'b) frozen_hm =\n  Frozen_Hash_Map (array_of_hm: \"('a, 'b) list_map iarray\") (size_of_hm: nat)\n\ndefinition diff_array_freeze :: \"'a array \\<Rightarrow> 'a iarray\" where\n  \"diff_array_freeze a = IArray (list_of_array a)\"\n\ndefinition hm_freeze where\n  \"hm_freeze \\<equiv> \\<lambda>hm. case hm of Impl_Array_Hash_Map.HashMap a _\n    \\<Rightarrow> Frozen_Hash_Map (diff_array_freeze a) (array_length a)\"\n\ndefinition frozen_hm_lookup where\n  \"frozen_hm_lookup \\<equiv> \\<lambda>key hm.\n    case hm of Frozen_Hash_Map a n \\<Rightarrow>\n      let\n        code = bounded_hashcode_nat n key;\n        bucket = IArray.sub a code\n      in\n        list_map_lookup (=) key bucket\n  \"\n\nlemma list_of_array_nth:\n  \"list_of_array a ! n = array_get a n\"\n  by (cases a) simp\n\nlemma frozen_hm_lookup_hm_freeze:\n  \"frozen_hm_lookup k (hm_freeze m) = Impl_Array_Hash_Map.ahm_lookup (=) bounded_hashcode_nat k m\"\nproof -\n  obtain a n where \"m = Impl_Array_Hash_Map.HashMap a n\"\n    by (cases m) auto\n  have \"IArray.sub (diff_array_freeze a) i = array_get a i\" for i\n    unfolding diff_array_freeze_def by (simp add: list_of_array_nth)\n  then show ?thesis\n    unfolding frozen_hm_lookup_def \\<open>m = _\\<close> hm_freeze_def by simp\nqed\n\ncontext\n  fixes M :: \"('a :: hashable * 'b) list\"\nbegin\n\ndefinition \"map_of_list = fold (\\<lambda>(k, v) a. a(k \\<mapsto> v)) M Map.empty\"\n\nlemma [autoref_rules]:\n  \"(M, M) \\<in> \\<langle>Id \\<times>\\<^sub>r Id\\<rangle>list_rel\"\n  by simp\n\nschematic_goal M_impl:\n  \"(?M::?'c, map_of_list:::\\<^sub>r\\<langle>Id,Id\\<rangle>dflt_ahm_rel) \\<in> ?R\"\n  unfolding map_of_list_def\n  apply (autoref (trace))\n  done\n\nconcrete_definition hashmap_of_list uses M_impl\n\ndefinition\n  \"frozen_hm_of_list \\<equiv> hm_freeze hashmap_of_list\"\n\ntheorem hashmap_of_list_lookup:\n  \"(\\<lambda>k. Impl_Array_Hash_Map.ahm_lookup (=) bounded_hashcode_nat k hashmap_of_list, map_of_list)\n  \\<in> Id \\<rightarrow> \\<langle>Id\\<rangle>option_rel\" (is \"(\\<lambda>k. ?f k hashmap_of_list, _) \\<in> ?R\")\nproof -\n  have *: \"(?f, Intf_Map.op_map_lookup) \\<in> Id \\<rightarrow> ahm_map_rel' bounded_hashcode_nat \\<rightarrow> Id\"\n    using Impl_Array_Hash_Map.ahm_lookup_impl[OF hashable_bhc_is_bhc] by simp\n  { fix k :: 'a\n    have \"abstract_bounded_hashcode Id bounded_hashcode_nat = bounded_hashcode_nat\"\n      unfolding abstract_bounded_hashcode_def by (intro ext) auto\n    from hashmap_of_list.refine guess hm\n      unfolding ahm_rel_def by clarsimp\n    then have \"(hm, map_of_list) \\<in> ahm_map_rel' bounded_hashcode_nat\"\n      unfolding \\<open>_ = bounded_hashcode_nat\\<close> by -\n    with * have \"?f k hm = Intf_Map.op_map_lookup k map_of_list\"\n      by (auto dest!: fun_relD)\n    with \\<open>(hashmap_of_list, hm) \\<in> _\\<close> have \"?f k hashmap_of_list = map_of_list k\"\n      unfolding ahm_map_rel_def array_rel_def by clarsimp\n  }\n  then show ?thesis\n    by simp\nqed\n\ntheorem frozen_hm_of_list_lookup:\n  \"(\\<lambda>k. frozen_hm_lookup k frozen_hm_of_list, map_of_list) \\<in> Id \\<rightarrow> \\<langle>Id\\<rangle>option_rel\"\n  using hashmap_of_list_lookup unfolding frozen_hm_of_list_def\n  by (simp add: frozen_hm_lookup_hm_freeze)\n\nend\n\n\ndefinition\n  \"array_all2 n P as bs \\<equiv> \\<forall>i < n. P (IArray.sub as i) (IArray.sub bs i)\"\n\nlemma iarray_mtx_relD:\n  assumes \"iarray_mtx_rel n m M a\" \"i < n\" \"j < m\"\n  shows \"M (i, j) = IArray.sub a (i * m + j)\"\n  using assms unfolding iarray_mtx_rel_def by auto\n\nlemma array_all2_iff_pointwise_cmp:\n  assumes \"iarray_mtx_rel (Suc n) (Suc n) M a\" \"iarray_mtx_rel (Suc n) (Suc n) M' b\"\n  shows \"array_all2 (Suc n * Suc n) P a b \\<longleftrightarrow> pointwise_cmp P n (curry M) (curry M')\"\nproof -\n  have *: \\<open>i + i * n + j < Suc (n + (n + n * n))\\<close> if \\<open>i \\<le> n\\<close> and \\<open>j \\<le> n\\<close> for i j :: \\<open>nat\\<close>\n    using that by (simp add: algebra_simps) (intro le_imp_less_Suc add_mono; simp)\n  have **: \"\\<exists>i \\<le> n. \\<exists>j \\<le> n. k = i + i * n + j\" if \"k < Suc n * Suc n\" for k\n    apply (inst_existentials \"k div Suc n\" \"k mod Suc n\")\n    subgoal\n      by (meson Suc_leI not_le th2 that)\n    subgoal\n      by simp\n    subgoal\n      by (metis dme mult_Suc_right)\n    done\n  from assms show ?thesis\n    unfolding pointwise_cmp_def array_all2_def\n    by (auto dest: *[simplified] **[simplified] simp: iarray_mtx_relD)\nqed\n\n\ncontext TA_Impl\nbegin\n\ninterpretation DBM_Impl n .\n\nsepref_definition E_precise_op'_impl is\n  \"uncurry4 (\\<lambda> l r. RETURN ooo E_precise_op' l r)\" :: \"op_impl_assn\"\n  unfolding\n    E_precise_op'_def FW''_def[symmetric] reset'_upd_def inv_of_A_def[symmetric] PR_CONST_def\n    filter_diag_def\n  by sepref\n\nend\n\n(*\nlocale Reachability_Problem_Impl_Precise =\n  Reachability_Problem_Impl _ _ _ _ _ _ l\\<^sub>0i _ l\\<^sub>0\n  + op_precise: E_Precise_Bisim l\\<^sub>0 for l\\<^sub>0 :: 's and l\\<^sub>0i :: \"'si:: {hashable,heap}\" +\n  fixes op_impl and states_mem_impl\n  assumes op_impl: \"(uncurry4 op_impl, uncurry4 (\\<lambda> l r. RETURN ooo PR_CONST f l r)) \\<in> op_impl_assn\"\n      and states_mem_impl: \"(states_mem_impl, (\\<lambda>l. l \\<in> states')) \\<in> loc_rel \\<rightarrow> bool_rel\"\nbegin\n*)\n\nlocale TA_Impl_Precise =\n  TA_Impl _ _ _ l\\<^sub>0 _ _ _ _ _ l\\<^sub>0i\n  + op_precise: E_Precise_Bisim _ l\\<^sub>0 for l\\<^sub>0 :: 's and l\\<^sub>0i :: \"'si:: {hashable,heap}\" +\n  fixes op_impl and states_mem_impl\n  assumes op_impl: \"(uncurry4 op_impl, uncurry4 (\\<lambda> l r. RETURN ooo PR_CONST f l r)) \\<in> op_impl_assn\"\n      and states_mem_impl: \"(states_mem_impl, (\\<lambda>l. l \\<in> states')) \\<in> loc_rel \\<rightarrow> bool_rel\"\n\nlocale Reachability_Problem_Impl_Precise =\n  TA_Impl_Precise _ show_state A\n  for show_state :: \"'si:: {hashable,heap} \\<Rightarrow> string\" and A :: \"('a, nat, int, 's) ta\"+\n  fixes F :: \"'s \\<times> (nat \\<times> nat \\<Rightarrow> int DBMEntry) \\<Rightarrow> bool\" and F' and F1 and F_impl\n  assumes F_mono: \"\\<And> a b.\n    (\\<lambda>(l, M). l \\<in> states' \\<and> wf_dbm M) a \\<Longrightarrow> F a \\<Longrightarrow>\n    (\\<lambda>(l, s) (l', s'). l' = l \\<and> dbm_subset n s s') a b \\<Longrightarrow> (\\<lambda>(l, M). l \\<in> states' \\<and> wf_dbm M) b\n    \\<Longrightarrow> F b\"\n      and F_F1: \"\\<And>l D Z. op_precise.E_from_op_empty\\<^sup>*\\<^sup>* (l\\<^sub>0, init_dbm) (l, D)\n          \\<Longrightarrow> dbm.zone_of (curry (conv_M D)) = Z \\<Longrightarrow> F (l, D) = F1 (l, Z)\"\n      and F'_F1: \"\\<And>l u Z. u \\<in> Z \\<Longrightarrow> F' (l, u) \\<Longrightarrow> F1 (l, Z)\"\n      and F_impl: \"(F_impl, RETURN o PR_CONST F) \\<in> state_assn'\\<^sup>d \\<rightarrow>\\<^sub>a bool_assn\"\n\ncontext TA_Impl_Precise\nbegin\n\nlemma E_precise_E_op:\n  \"E_precise = (\\<lambda>(l, M) (l', M'''). \\<exists>g a r. A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l' \\<and> M''' = E_precise_op l r g l' M)\"\n  unfolding E_precise_op_def E_precise_def by (intro ext) (auto elim!: step_impl.cases)\n\ndefinition succs_precise where\n  \"succs_precise \\<equiv> \\<lambda>l S.\n    if S = {} then []\n    else rev [\n      (l', {D' | D' D. D \\<in> S \\<and> D' = f l r g l' D \\<and> \\<not> check_diag n D'}). (g,a,r,l') \\<leftarrow> trans_fun l]\"\n\ndefinition succs_precise_inner where\n \"succs_precise_inner l r g l' S \\<equiv> do {\n    xs \\<leftarrow> SPEC (\\<lambda>xs. set xs = S);\n    p \\<leftarrow> nfoldli xs (\\<lambda>_. True) (\\<lambda>D xs.\n      do {let D' = PR_CONST f l r g l' D; if check_diag n D' then RETURN xs else RETURN (D' # xs)}\n    ) [];\n    S' \\<leftarrow> SPEC (\\<lambda>S. set p = S);\n    RETURN S'\n  }\"\n\ndefinition succs_precise' where\n  \"succs_precise' \\<equiv> \\<lambda>l S. if S = {} then RETURN [] else do {\n    nfoldli (trans_fun l) (\\<lambda> _. True) (\\<lambda> (g,a,r,l') xxs.\n      do {\n        S' \\<leftarrow> PR_CONST succs_precise_inner l r g l' (COPY S);\n        RETURN ((l', S') # xxs)\n      }\n    ) []\n  }\"\n\nlemma succs_precise_inner_rule:\n  \"succs_precise_inner l r g l' S\n  \\<le> RETURN {D' | D' D. D \\<in> S \\<and> D' = f l r g l' D \\<and> \\<not> check_diag n D'}\"\n  unfolding succs_precise_inner_def\n  by (refine_vcg nfoldli_rule[where\n        I = \"\\<lambda>l1 l2 \\<sigma>. \\<sigma> = rev (filter (\\<lambda>D'. \\<not> check_diag n D') (map (f l r g l') l1))\"\n     ]) auto\n\nlemma succs_precise'_refine:\n  \"succs_precise' l S \\<le> RETURN (succs_precise l S)\"\n  unfolding succs_precise_def succs_precise'_def\n  unfolding rev_map_fold fold_eq_nfoldli PR_CONST_def\n  apply (cases \"S = {}\")\n   apply (simp; fail)\n  apply (simp only: if_False fold_eq_nfoldli)\n  apply (refine_vcg nfoldli_mono)\n  apply (rule order.trans)\n   apply (rule succs_precise_inner_rule)\n  apply auto\n  done\n\nlemma succs_precise'_correct:\n  \"(uncurry succs_precise', uncurry (RETURN oo PR_CONST succs_precise)) \\<in> Id \\<times>\\<^sub>r Id \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"\n  using succs_precise'_refine by (clarsimp simp: pw_le_iff pw_nres_rel_iff)\n\nsepref_register \"PR_CONST f\" ::\n  \"'s \\<Rightarrow> nat list \\<Rightarrow> (nat, int) acconstraint list \\<Rightarrow> 's \\<Rightarrow> int DBMEntry i_mtx \\<Rightarrow> int DBMEntry i_mtx\"\n\nlemma aux:\n  \"b ::\\<^sub>i TYPE((nat \\<times> nat \\<Rightarrow> int DBMEntry) set) \\<Longrightarrow>\n       ID b b TYPE(int DBMEntry i_mtx set)\"\n  unfolding ID_def by simp\n\nlemma aux':\n  \"(b ::\\<^sub>i TYPE((nat \\<times> nat \\<Rightarrow> int DBMEntry) set)) = (b ::\\<^sub>i TYPE(int DBMEntry i_mtx set))\"\n  by simp\n\nlemma aux'':\n  \"(b ::\\<^sub>i TYPE((nat \\<times> nat \\<Rightarrow> int DBMEntry) )) = (b ::\\<^sub>i TYPE(int DBMEntry i_mtx))\"\n  by simp\n\nlemma aux3:\n  \"ID D x'a TYPE(nat \\<times> nat \\<Rightarrow> int DBMEntry) = ID D x'a TYPE(int DBMEntry i_mtx)\"\n  by simp\n\nlemmas [sepref_fr_rules] =\n  set_of_list_hnr Leadsto_Impl.lso_id_hnr\n  op_impl\n\ninterpretation DBM_Impl n .\n\nsepref_definition succs_precise_inner_impl is\n  \"uncurry4 (PR_CONST succs_precise_inner)\"\n  :: \"location_assn\\<^sup>k *\\<^sub>a (list_assn clock_assn)\\<^sup>k *\\<^sub>a\n      (list_assn (acconstraint_assn clock_assn int_assn))\\<^sup>k *\\<^sub>a\n      location_assn\\<^sup>k *\\<^sub>a (lso_assn mtx_assn)\\<^sup>d\n  \\<rightarrow>\\<^sub>a lso_assn mtx_assn\"\n  unfolding PR_CONST_def\n  unfolding succs_precise_inner_def\n    list_of_set_def[symmetric] set_of_list_def[symmetric]\n  apply (rewrite \"HOL_list.fold_custom_empty\")\n  apply sepref_dbg_keep\n     apply sepref_dbg_id_keep\n  unfolding aux3\n         apply sepref_dbg_id_step+\n     apply sepref_dbg_monadify\n     apply sepref_dbg_opt_init\n      apply sepref_dbg_trans_keep\n     apply sepref_dbg_opt\n    apply sepref_dbg_cons_solve\n   apply sepref_dbg_cons_solve\n  apply sepref_dbg_constraints\n  done\n\nsepref_register succs_precise_inner\n\nlemmas [sepref_fr_rules] = succs_precise_inner_impl.refine\n\nlemmas [sepref_fr_rules] = copy_list_lso_assn_refine[OF amtx_copy_hnr]\n\n(* The d can also be a k *)\nsepref_definition succs_precise'_impl is\n  \"uncurry succs_precise'\"\n  :: \"location_assn\\<^sup>k *\\<^sub>a (lso_assn mtx_assn)\\<^sup>d\n      \\<rightarrow>\\<^sub>a list_assn (prod_assn location_assn (lso_assn mtx_assn))\"\n  unfolding PR_CONST_def\n  unfolding\n    comp_def succs_precise'_def\n    FW''_def[symmetric] rev_map_fold inv_of_A_def[symmetric]\n    list_of_set_def[symmetric] set_of_list_def[symmetric]\n  unfolding HOL_list.fold_custom_empty by sepref\n\nlemmas succs_precise_impl_refine = succs_precise'_impl.refine[FCOMP succs_precise'_correct]\n\nlemma succs_precise_finite:\n  \"\\<forall>l S. \\<forall>(l', S')\\<in>set (succs_precise l S). finite S \\<longrightarrow> finite S'\"\n  unfolding succs_precise_def by auto\n\ndefinition\n  \"wf_dbm' D \\<equiv> (canonical' D \\<or> check_diag n D) \\<and>\n     (list_all (\\<lambda>i. D (i, i) \\<le> 0) [0..<n+1]) \\<and> list_all (\\<lambda>i. D (0, i) \\<le> 0) [0..<n+1]\"\n\ntheorem wf_dbm'_wf_dbm:\n  fixes D :: \"nat \\<times> nat \\<Rightarrow> int DBMEntry\"\n  assumes \"wf_dbm' D\"\n  shows \"wf_dbm D\"\n  using assms\n  unfolding wf_dbm'_def wf_dbm_def valid_dbm_def list_all_iff canonical'_conv_M_iff\n  unfolding valid_dbm.simps\n  apply (elim conjE)\n  apply (rule conjI)\n   apply blast\n  apply (rule conjI)\n  subgoal\n    by (intro impI diag_conv_M) auto\n  apply (inst_existentials \"curry (conv_M D)\")\n    apply (rule HOL.refl)\n   apply (rule V_I)\n  subgoal\n    apply (auto del: disjE)\n    subgoal for i\n      apply (subgoal_tac \"D (0, i) \\<le> Le 0\")\n       apply (auto dest: conv_dbm_entry_mono simp: neutral del: disjE)\n      apply (cases \"i = n\")\n       apply auto\n      done\n    done\n  apply (rule dbm_int_conv)\n  done\n\nlemma canonical'_compute:\n  \"canonical' M =\n  list_all (\\<lambda>i.\n    list_all (\\<lambda>j.\n      list_all (\\<lambda>k.\n        M (i, k) \\<le> M (i, j) + M (j, k)\n  )[0..<n+1]) [0..<n+1]) [0..<n+1]\n  \"\n  unfolding list_all_iff by auto force\n\nsepref_definition canonical'_impl is\n  \"RETURN o PR_CONST canonical'\" :: \"mtx_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  unfolding canonical'_compute list_all_foldli PR_CONST_def by sepref\n\nsepref_thm wf_dbm'_impl is\n  \"RETURN o PR_CONST wf_dbm'\" :: \"mtx_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  unfolding wf_dbm'_def canonical'_compute list_all_foldli PR_CONST_def by sepref\n\ndefinition\n  \"states_mem l \\<equiv> l \\<in> states'\"\n\ndefinition\n  \"P \\<equiv> \\<lambda> (l, M). PR_CONST states_mem l \\<and> wf_dbm' M\"\n\nlemma P_correct:\n  \"l \\<in> states' \\<and> wf_dbm M\" if \"P (l, M)\"\n  using that unfolding P_def states_mem_def by (auto intro: wf_dbm'_wf_dbm)\n\n(* lemma [sepref_import_param]:\n  \"(states_mem, states_mem) \\<in> Id \\<rightarrow> Id\"\n  by simp *)\n\nlemmas [sepref_import_param] = states_mem_impl[folded states_mem_def]\n\nsepref_register states_mem\n\n(* sepref_thm is_in_states_impl is\n  \"RETURN o PR_CONST states_mem\" :: \"(pure loc_rel)\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  unfolding PR_CONST_def by sepref *)\n\nsepref_register wf_dbm' :: \"'c DBMEntry i_mtx \\<Rightarrow> bool\"\n\nlemmas [sepref_fr_rules] =\n  (* is_in_states_impl.refine_raw *)\n  wf_dbm'_impl.refine_raw\n\nsepref_definition P_impl is\n  \"RETURN o PR_CONST P\" :: \"(prod_assn (pure loc_rel) mtx_assn)\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  unfolding PR_CONST_def P_def by sepref\n\n(* XXX Better proof technique? *)\nlemma P_impl_refine:\n  \"(P_impl, (RETURN \\<circ>\\<circ> PR_CONST) P) \\<in> (location_assn \\<times>\\<^sub>a mtx_assn)\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  apply sepref_to_hoare\n  apply sep_auto\n  subgoal for l M l' M'\n    using P_impl.refine[to_hnr, unfolded hn_refine_def hn_ctxt_def, rule_format, of \"(l, M)\"]\n    by (sep_auto simp: pure_def)\n  done\n\nlemma E_from_op_states:\n  \"l' \\<in> states'\" if \"op_precise.E_from_op (l, M) (l', M')\" \"l \\<in> states'\"\n  using that unfolding op_precise.E_from_op_def by auto\n\nlemmas [safe_constraint_rules] = location_assn_constraints\n\nend (* TA Impl Precise *)\n\n\ncontext Reachability_Problem_Impl_Precise\nbegin\n\ncontext\n  fixes L_list :: \"'si list\" and P_loc\n  assumes state_impl_abstract: \"\\<And>li. P_loc li \\<Longrightarrow> \\<exists>l. (li, l) \\<in> loc_rel\"\n  assumes P_loc: \"list_all (\\<lambda>x. P_loc x \\<and> states_mem_impl x) L_list\"\nbegin\n\ndefinition\n  \"L \\<equiv> map (\\<lambda>li. SOME l. (li, l) \\<in> loc_rel) L_list\"\n\nlemma mem_states'I:\n  \"l \\<in> states'\" if \"states_mem_impl li\" \"(li, l) \\<in> loc_rel\" for l li\n  using states_mem_impl that by (auto dest: fun_relD)\n\nlemma L_list_rel:\n  \"(L_list, L) \\<in> \\<langle>location_rel\\<rangle>list_rel\"\n  unfolding list_rel_def L_def\n  using P_loc\n  apply (clarsimp simp: list.pred_rel list.rel_map)\n  apply (elim list_all2_mono)\n  apply (clarsimp simp: eq_onp_def)\n  apply (meson someI_ex state_impl_abstract)\n  apply (erule mem_states'I, meson someI_ex state_impl_abstract)\n  done\n\nlemma L_list_hnr:\n  \"(uncurry0 (return L_list), uncurry0 (RETURN (PR_CONST (set L))))\n  \\<in> unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a lso_assn location_assn\"\nproof -\n  have \"(\\<lambda>a c. \\<up> ((c, a) \\<in> loc_rel \\<and> a \\<in> states')) = pure location_rel\"\n    unfolding pure_def by auto\n  then have \"list_assn (\\<lambda>a c. \\<up> ((c, a) \\<in> loc_rel \\<and> a \\<in> states')) = pure (\\<langle>location_rel\\<rangle>list_rel)\"\n    by (simp add: fcomp_norm_unfold)\n  then have \"emp \\<Longrightarrow>\\<^sub>A list_assn (\\<lambda>a c. \\<up> ((c, a) \\<in> loc_rel \\<and> a \\<in> states')) L L_list * true\"\n    by (sep_auto simp: pure_def intro: L_list_rel)\n  then show ?thesis\n    by sepref_to_hoare (sep_auto simp: lso_assn_def hr_comp_def br_def)\nqed\n\nsepref_register \"list_to_dbm n\"\n\nlemmas [sepref_fr_rules] = of_list_list_to_dbm[of n]\n\nsepref_register set\n\nlemmas [sepref_fr_rules] = set_of_list_hnr'\n\nlemmas step_z_dbm_complete = step_z_dbm_complete[OF global_clock_numbering']\n\ninterpretation A:\n  Simulation\n  \"\\<lambda> (l, u) (l', u'). conv_A A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>\"\n  \"\\<lambda> (l, Z) (l', Z'). \\<exists> a. conv_A A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto> \\<langle>l', Z'\\<rangle> \\<and> Z' \\<noteq> {}\"\n  \"\\<lambda> (l, u) (l', Z). l' = l \\<and> u \\<in> Z\"\n  by standard (auto dest!: step_z_complete')\n\ninterpretation B:\n  Simulation\n  \"\\<lambda> (l, Z) (l', Z'). \\<exists> a. conv_A A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto> \\<langle>l', Z'\\<rangle> \\<and> Z' \\<noteq> {}\"\n  \"\\<lambda> (l, M) (l', M'). \\<exists> a. conv_A A \\<turnstile>' \\<langle>l, M\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', M'\\<rangle> \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n  \"\\<lambda> (l, Z) (l', M). l' = l \\<and> Z = [M]\\<^bsub>v,n\\<^esub>\"\n  by standard (force simp: step_z'_def step_z_dbm'_def elim!: step_z_dbm_DBM)\n\ninterpretation\n  Simulation\n  \"\\<lambda> (l, u) (l', u'). conv_A A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>\"\n  \"\\<lambda> (l, M) (l', M'). \\<exists> a. step_z_dbm' (conv_A A) l M v n a l' M' \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n  \"\\<lambda> (l, u) (l', M). l' = l \\<and> u \\<in> [M]\\<^bsub>v,n\\<^esub>\"\n  by (rule Simulation_Composition, rule A.Simulation_axioms, rule B.Simulation_axioms) auto\n\nlemma op_precise_buechi_run_correct:\n  assumes\n    \"(\\<nexists>xs.\n    Graph_Defs.run op_precise.E_from_op_empty ((l\\<^sub>0', init_dbm) ## xs)\n    \\<and> alw (ev (holds F)) ((l\\<^sub>0', init_dbm) ## xs))\"\n  and F_F1: \"\\<And>l D Z. op_precise.E_from_op_empty\\<^sup>*\\<^sup>* (l\\<^sub>0', init_dbm) (l, D)\n          \\<Longrightarrow> dbm.zone_of (curry (conv_M D)) = Z \\<Longrightarrow> F (l, D) = F1 (l, Z)\"\n  shows\n    \"\\<nexists>u xs. (\\<forall>c \\<le> n. u c = 0)\n    \\<and> Graph_Defs.run (\\<lambda>(l, u) (l', u'). conv_A A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>) ((l\\<^sub>0', u) ## xs)\n    \\<and> alw (ev (holds F')) ((l\\<^sub>0', u) ## xs)\"\nproof -\n  let ?E = \"\\<lambda>(l, u) (l', u'). conv_A A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>\"\n  define E where \"E \\<equiv> \\<lambda>(l, M) (l', M'). \\<exists>a. conv_A A \\<turnstile>' \\<langle>l, M\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', M'\\<rangle> \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n  interpret Bisimulation_Invariant\n    E\n    op_precise.E_from_op_empty\n    \"\\<lambda>(l, M) (l', D). l' = l \\<and> [curry (conv_M D)]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>\"\n    \"\\<lambda>(l, y). valid_dbm y\"\n    \"wf_state\"\n    unfolding E_def by (rule op_precise.step_z_dbm'_E_from_op_bisim_empty)\n  have init: \"u \\<in> dbm.zone_of (curry init_dbm)\" if \"\\<forall>c \\<le> n. u c = 0\" for u :: \"_ \\<Rightarrow> real\"\n    by (simp add: init_dbm_zone that)\n  let ?F1 = \"\\<lambda>(l, M). F1 (l, [M]\\<^bsub>v,n\\<^esub>)\"\n  have \"alw (ev (holds F)) ys\"\n    if \"stream_all2 equiv' xs ys\"\n      \"alw (ev (holds (\\<lambda>(l, M). F1 (l, dbm.zone_of M)))) xs\"\n      \"B.run ((l\\<^sub>0', init_dbm) ## ys)\"\n    for xs ys\n  proof -\n    from that(3) have \"pred_stream (B.reaches (l\\<^sub>0', init_dbm)) ys\"\n      by (rule B.run_first_reaches)\n    with that(1) have \"stream_all2 (\\<lambda>x y. equiv' x y \\<and> B.reaches (l\\<^sub>0', init_dbm) y) xs ys\"\n      by (rule stream_all2_pred_stream_combine) (rule conjI)\n    with that(2) show ?thesis\n      apply (rule alw_ev_lockstep)\n      unfolding equiv'_def using F_F1 by blast\n  qed\n  with assms have \"\\<nexists>xs.\n    Graph_Defs.run E ((l\\<^sub>0', curry (conv_M init_dbm)) ## xs)\n  \\<and> alw (ev (holds ?F1)) ((l\\<^sub>0', curry (conv_M init_dbm)) ## xs)\"\n    apply safe\n    apply (drule bisim.A_B.simulation_run[where y = \"(l\\<^sub>0', init_dbm)\"])\n    using valid_init_dbm unfolding equiv'_def\n    by (auto simp: wf_state_def dest: bisim.A_B.simulation_run[where y = \"(l\\<^sub>0', init_dbm)\"])\n  then show ?thesis\n    unfolding E_def\n    by (auto\n        intro: F'_F1\n        dest: alw_ev_lockstep[where R = ?F1]\n        dest!: simulation_run[where y = \"(l\\<^sub>0', curry init_dbm)\"] init\n        )\nqed\n\nlemma op_precise_unreachable_correct:\n  assumes \"\\<nexists>s'. op_precise.E_from_op_empty\\<^sup>*\\<^sup>* (l\\<^sub>0, init_dbm) s' \\<and> F s'\"\n  shows \"\\<nexists>u l' u'. (\\<forall>c \\<le> n. u c = 0) \\<and> conv_A A \\<turnstile>' \\<langle>l\\<^sub>0, u\\<rangle> \\<rightarrow>* \\<langle>l', u'\\<rangle> \\<and> F' (l', u')\"\nproof -\n  define E where \"E \\<equiv> \\<lambda>(l, M) (l', M'). \\<exists> a. conv_A A \\<turnstile>' \\<langle>l, M\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', M'\\<rangle> \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n  interpret Bisimulation_Invariant\n    E\n    op_precise.E_from_op_empty\n    \"\\<lambda>(l, M) (l', D). l' = l \\<and> [curry (conv_M D)]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>\"\n    \"\\<lambda>(l, y). valid_dbm y\"\n    \"wf_state\"\n    unfolding E_def by (rule op_precise.step_z_dbm'_E_from_op_bisim_empty)\n  have 1: \"reaches (l\\<^sub>0, u) (l', u')\" if \"conv_A A \\<turnstile>' \\<langle>l\\<^sub>0, u\\<rangle> \\<rightarrow>* \\<langle>l', u'\\<rangle>\" for u u' l'\n    by (simp add: steps'_iff that)\n  have 2: \"u \\<in> dbm.zone_of (curry init_dbm)\" if \"\\<forall>c \\<le> n. u c = 0\" for u :: \"_ \\<Rightarrow> real\"\n    by (simp add: init_dbm_zone that)\n  from assms have\n    \"\\<nexists>l' M'. E\\<^sup>*\\<^sup>* (l\\<^sub>0, curry (conv_M init_dbm)) (l', M') \\<and> F1 (l', [M']\\<^bsub>v,n\\<^esub>) \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n    apply (clarsimp simp: )\n    apply (drule bisim.A_B_reaches[where b = \"(l\\<^sub>0, init_dbm)\"])\n    subgoal\n      using valid_init_dbm unfolding equiv'_def\n      by (auto simp: wf_state_def)\n    unfolding equiv'_def using canonical_check_diag_empty_iff\n    using F_F1 by blast\n  then show ?thesis\n    unfolding E_def by (fastforce dest: dbm.check_diag_empty F'_F1 dest!: simulation_reaches 1 2)\nqed\n\nlemma op_precise_unreachable_correct':\n  \"(uncurry0 (SPEC (\\<lambda>r. r \\<longrightarrow>\n      (\\<nexists>s'. op_precise.E_from_op_empty\\<^sup>*\\<^sup>* (l\\<^sub>0, init_dbm) s' \\<and> F s'))),\n    uncurry0 (SPEC (\\<lambda>r. r \\<longrightarrow>\n      (\\<nexists>u l' u'. (\\<forall>c \\<le> n. u c = 0) \\<and> conv_A A \\<turnstile>' \\<langle>l\\<^sub>0, u\\<rangle> \\<rightarrow>* \\<langle>l', u'\\<rangle> \\<and> F' (l', u')))))\n  \\<in> Id \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"\n  using op_precise_unreachable_correct by (clarsimp simp: pw_le_iff pw_nres_rel_iff)\n\n(*\nlemma op_precise_unreachable_correct:\n  assumes \"\\<nexists>s'. op_precise.E_from_op_empty\\<^sup>*\\<^sup>* (l\\<^sub>0, init_dbm) s' \\<and> (\\<lambda> (l, M). F l) s'\"\n  shows \"\\<nexists>u l' u'. (\\<forall>c \\<le> n. u c = 0) \\<and> conv_A A \\<turnstile>' \\<langle>l\\<^sub>0, u\\<rangle> \\<rightarrow>* \\<langle>l', u'\\<rangle> \\<and> F l'\"\nproof -\n  define E where \"E \\<equiv> \\<lambda>(l, M) (l', M'). \\<exists> a. conv_A A \\<turnstile>' \\<langle>l, M\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', M'\\<rangle> \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n  interpret Bisimulation_Invariant\n    E\n    op_precise.E_from_op_empty\n    \"\\<lambda>(l, M) (l', D). l' = l \\<and> [curry (conv_M D)]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>\"\n    \"\\<lambda>(l, y). valid_dbm y\"\n    \"wf_state\"\n    unfolding E_def by (rule op_precise.step_z_dbm'_E_from_op_bisim_empty)\n  have 1: \"reaches (l\\<^sub>0, u) (l', u')\" if \"conv_A A \\<turnstile>' \\<langle>l\\<^sub>0, u\\<rangle> \\<rightarrow>* \\<langle>l', u'\\<rangle>\" for u u' l'\n    by (simp add: steps'_iff that)\n  have 2: \"u \\<in> dbm.zone_of (curry init_dbm)\" if \"\\<forall>c \\<le> n. u c = 0\" for u :: \"_ \\<Rightarrow> real\"\n    by (simp add: init_dbm_zone that)\n  from assms have \"\\<nexists>l' M'. E\\<^sup>*\\<^sup>* (l\\<^sub>0, curry (conv_M init_dbm)) (l', M') \\<and> F l' \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n    apply (clarsimp simp: F_rel_def)\n    apply (drule bisim.A_B_reaches[where b = \"(l\\<^sub>0, init_dbm)\"])\n    subgoal\n      using valid_init_dbm unfolding equiv'_def\n      by (auto simp: wf_state_def)\n    unfolding equiv'_def using canonical_check_diag_empty_iff by blast\n  then show ?thesis\n    unfolding E_def using simulation_reaches by (force dest!: 1 2 dest: dbm.check_diag_empty)\nqed\n\nlemma op_precise_unreachable_correct':\n  \"(uncurry0 (SPEC (\\<lambda>r. r \\<longrightarrow>\n      (\\<nexists>s'. op_precise.E_from_op_empty\\<^sup>*\\<^sup>* (l\\<^sub>0, init_dbm) s' \\<and> (\\<lambda>(l, M). F l) s'))),\n    uncurry0 (SPEC (\\<lambda>r. r \\<longrightarrow>\n      (\\<nexists>u l' u'. (\\<forall>c \\<le> n. u c = 0) \\<and> conv_A A \\<turnstile>' \\<langle>l\\<^sub>0, u\\<rangle> \\<rightarrow>* \\<langle>l', u'\\<rangle> \\<and> F l'))))\n  \\<in> Id \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"\n  using op_precise_unreachable_correct by (clarsimp simp: pw_le_iff pw_nres_rel_iff)\n*)\n\n\nlemma IArray_list_to_dbm_rel[param]:\n  \"(IArray, list_to_dbm n)\n  \\<in> {(xs, ys). xs = ys \\<and> length xs = Suc n * Suc n} \\<rightarrow> {(a, b). iarray_mtx_rel (Suc n) (Suc n) b a}\"\n  unfolding list_to_dbm_def op_amtx_new_def iarray_mtx_rel_def\n    Normalized_Zone_Semantics_Certification_Impl.dbm_tab_def\n  by (auto simp: algebra_simps)\n\nlemma IArray_list_to_dbm_rel':\n  \"(map IArray xs, list_to_dbm n ` set xs)\n  \\<in> \\<langle>{(a, b). iarray_mtx_rel (Suc n) (Suc n) b a}\\<rangle>list_set_rel\"\n  if \"list_all (\\<lambda>xs. length xs = Suc n * Suc n) xs\"\n  using that by (rule map_set_rel) (rule IArray_list_to_dbm_rel)\n\n\n\ncontext\n  fixes M_list :: \"('si \\<times> 'v list) list\" and g :: \"'v \\<Rightarrow> 'v1\" and h :: \"'v \\<Rightarrow> 'v2\"\n    and P :: \"'v \\<Rightarrow> bool\" and R :: \"('v2 \\<times> 'v1) set\"\nbegin\n\ndefinition\n  \"M_list1 \\<equiv> map (\\<lambda>(li, xs). (SOME l. (li, l) \\<in> loc_rel, xs)) M_list\"\n\ndefinition\n  \"M1 = fold (\\<lambda>p M.\n    let\n      s = fst p; xs = snd p;\n      xs = rev (map g xs);\n      S = set xs in fun_upd M s (Some S)\n  ) (PR_CONST M_list1) IICF_Map.op_map_empty\"\n\ndefinition\n  \"M1i = hashmap_of_list (map (\\<lambda>(k, dbms). (k, map h dbms)) M_list)\"\n\ncontext\n  assumes M_list_covered: \"fst ` set M_list \\<subseteq> set L_list\"\n      and M_P: \"list_all (\\<lambda>(l, xs). list_all P xs) M_list\"\n    assumes g_h_param: \"(h, g) \\<in> {(x, y). x = y \\<and> P x} \\<rightarrow> R\"\nbegin\n\nlemma M1_finite:\n  \"\\<forall>S\\<in>ran M1. finite S\"\n  unfolding M1_def\n  apply (rule fold_generalize_start[where P = \"\\<lambda>M. \\<forall>S\\<in>ran M. finite S\"])\n  subgoal for a\n    unfolding M_list1_def\n    apply (induction M_list arbitrary: a)\n     apply (simp; fail)\n    apply (simp, rprem, auto dest: ran_upd_cases)\n    done\n  apply (simp; fail)\n  done\n\nlemma P_loc1:\n  \"list_all\n    (\\<lambda>(l, xs). P_loc l \\<and> states_mem_impl l \\<and> list_all P xs) M_list\"\n  using P_loc \\<open>_ \\<subseteq> set L_list\\<close> M_P unfolding list_all_iff by auto\n\nlemma M_list_rel1:\n  \"(M_list, M_list1) \\<in> \\<langle>location_rel \\<times>\\<^sub>r \\<langle>br id P\\<rangle>list_rel\\<rangle>list_rel\"\n  unfolding list_rel_def M_list1_def\n  using P_loc1\n  apply (clarsimp simp: list.pred_rel list.rel_map br_def)\n  apply (elim list_all2_mono)\n  apply (clarsimp simp: eq_onp_def)\n  apply (meson someI_ex state_impl_abstract)\n   apply (erule mem_states'I, meson someI_ex state_impl_abstract)\n  apply (elim list_all2_mono, clarsimp)\n  done\n\nlemma dom_M_eq1_aux:\n  \"dom (fold (\\<lambda>p M.\n    let s = fst p; xs = snd p;\n    xs = rev (map g xs); S = set xs in fun_upd M s (Some S)\n  ) xs m) = dom m \\<union> fst ` set xs\" for xs m\n    by (induction xs arbitrary: m) auto\n\nlemma dom_M_eq1:\n  \"dom M1 = fst ` set M_list1\"\n  unfolding dom_M_eq1_aux M1_def by simp\n\nlemma L_dom_M_eqI1:\n  assumes \"fst ` set M_list = set L_list\"\n  shows \"set L = dom M1\"\nproof -\n  show ?thesis\n    unfolding dom_M_eq1\n  proof (safe; clarsimp?)\n    fix l assume \"l \\<in> set L\"\n    with L_list_rel assms obtain l' where \"l' \\<in> fst ` set M_list\" \"(l', l) \\<in> location_rel\"\n      by (fastforce simp: list_all2_append2 list_all2_Cons2 list_rel_def elim!: in_set_list_format)\n    with M_list_rel1 obtain l1 where \"l1 \\<in> fst ` set M_list1\" \"(l', l1) \\<in> location_rel\"\n      by (fastforce simp: list_all2_append1 list_all2_Cons1 list_rel_def elim!: in_set_list_format)\n    with \\<open>(l', l) \\<in> location_rel\\<close> show \"l \\<in> fst ` set M_list1\"\n      using loc_rel_right_unique by auto\n  next\n    fix l M assume \"(l, M) \\<in> set M_list1\"\n    with M_list_rel1 assms obtain l' where \"l' \\<in> set L_list\" \"(l', l) \\<in> location_rel\"\n      by (fastforce simp: list_all2_append2 list_all2_Cons2 list_rel_def elim!: in_set_list_format)\n    with L_list_rel obtain l1 where \"l1 \\<in> set L\" \"(l', l1) \\<in> location_rel\"\n      by (fastforce simp: list_all2_append1 list_all2_Cons1 list_rel_def elim!: in_set_list_format)\n    with \\<open>(l', l) \\<in> location_rel\\<close> show \"l \\<in> set L\"\n      using loc_rel_right_unique by auto\n  qed\nqed\n\nlemma map_of_M_list_M_rel1:\n  \"(map_of_list (map (\\<lambda>(k, dbms). (k, map h dbms)) M_list), M1)\n\\<in> location_rel \\<rightarrow> \\<langle>\\<langle>R\\<rangle>list_set_rel\\<rangle>option_rel\"\n  unfolding M1_def M_list1_def\n  unfolding map_of_list_def\n  unfolding PR_CONST_def\nproof goal_cases\n  case 1\n  let \"(fold ?f ?xs Map.empty, fold ?g ?ys _) \\<in> ?R\" = ?case\n  have *: \"l' = (SOME l'. (l, l') \\<in> loc_rel)\"\n    if \"(l, l') \\<in> loc_rel\" \"states_mem_impl l\" \"l' \\<in> states'\" for l l'\n  proof -\n    from that have \"(l, SOME l'. (l, l') \\<in> loc_rel) \\<in> loc_rel\"\n      by (intro someI)\n    moreover then have \"(SOME l'. (l, l') \\<in> loc_rel) \\<in> states'\"\n      using that(2) by (elim mem_states'I)\n    ultimately show ?thesis\n      using that right_unique_location_rel unfolding single_valued_def by auto\n  qed\n  have \"(fold ?f ?xs m, fold ?g ?ys m') \\<in> ?R\"\n    if \"(m, m') \\<in> ?R\" for m m'\n    using that P_loc1\n  proof (induction M_list arbitrary: m m')\n    case Nil\n    then show ?case\n      by simp\n  next\n    case (Cons x M_list)\n    obtain l M where \"x = (l, M)\"\n      by force\n    from Cons.IH \\<open>list_all _ (x # M_list)\\<close> show ?case\n      apply (simp split:)\n      apply rprems\n      unfolding \\<open>x = _\\<close>\n      apply simp\n      apply (rule fun_relI)\n      apply (clarsimp; safe)\n      subgoal\n        using g_h_param by (auto dest!: fun_relD intro!: map_set_rel)\n      subgoal\n        by (frule *) auto\n      subgoal\n        using left_unique_location_rel unfolding IS_LEFT_UNIQUE_def single_valued_def\n        by (auto dest: someI_ex[OF state_impl_abstract])\n      subgoal\n        using Cons.prems(1)\n        apply -\n        apply (drule fun_relD)\n        by simp\n      done\n  qed\n  then show ?case\n    by rprems auto\nqed\n\nlemma Mi_M1:\n  \"(\\<lambda>k. Impl_Array_Hash_Map.ahm_lookup (=) bounded_hashcode_nat k M1i, M1)\n  \\<in> location_rel \\<rightarrow> \\<langle>\\<langle>R\\<rangle>list_set_rel\\<rangle>option_rel\"\n(is \"(?f, M1) \\<in> ?R\")\nproof -\n  let ?g = \"map_of_list (map (\\<lambda>(k, dbms). (k, map h dbms)) M_list)\"\n  have \"(?f, ?g) \\<in> Id \\<rightarrow> \\<langle>Id\\<rangle>option_rel\"\n    unfolding M1i_def by (rule hashmap_of_list_lookup)\n  moreover have \"(?g, M1) \\<in> ?R\"\n    by (rule map_of_M_list_M_rel1)\n  ultimately show ?thesis\n    by auto\nqed\n\nend (* Assumptions *)\n\nend (* Defs *)\n\n\n\ncontext\n  fixes M_list :: \"('si \\<times> int DBMEntry list list) list\"\n  assumes M_list_covered: \"fst ` set M_list \\<subseteq> set L_list\"\n      and M_dbm_len: \"list_all (\\<lambda>(l, xs). list_all (\\<lambda>M. length M = Suc n * Suc n) xs) M_list\"\nbegin\n\nlemmas M_assms = M_list_covered M_dbm_len IArray_list_to_dbm_rel\n\ndefinition\n  \"M_list' \\<equiv> M_list1 M_list\"\n\ndefinition\n  \"M = fold (\\<lambda>p M.\n    let s = fst p; xs = snd p; xs = rev (map (list_to_dbm n) xs); S = set xs in fun_upd M s (Some S)\n  ) (PR_CONST M_list') IICF_Map.op_map_empty\"\n\nlemma M_alt_def:\n  \"M = M1 TYPE(int DBMEntry list) M_list (list_to_dbm n)\"\n  unfolding M_def M1_def M_list'_def ..\n\nlemma M_finite:\n  \"\\<forall>S\\<in>ran M. finite S\"\n  unfolding M_alt_def by (rule M1_finite[OF M_assms])\n\nlemmas M_list_rel = M_list_rel1[OF M_assms, folded M_list'_def]\n\nlemma M_list_hnr[sepref_fr_rules]:\n  \"(uncurry0 (return M_list), uncurry0 (RETURN (PR_CONST M_list')))\n    \\<in> id_assn\\<^sup>k \\<rightarrow>\\<^sub>a list_assn (\n        location_assn \\<times>\\<^sub>a list_assn (pure (b_rel Id (\\<lambda>xs. length xs = Suc n * Suc n))))\"\nproof -\n  let ?R1 = \"\\<langle>br id (\\<lambda>xs. length xs = Suc n * Suc n)\\<rangle>list_rel\"\n  let ?R2 = \"\\<lambda>a c. \\<up> (a = c \\<and> length c = Suc (n + (n + n * n)))\"\n  let ?R = \"(\\<lambda>a c. \\<up> ((c, a) \\<in> loc_rel \\<and> a \\<in> states')) \\<times>\\<^sub>a list_assn ?R2\"\n  have \"b_rel Id = br id\"\n    unfolding br_def b_rel_def by auto\n  have *: \"list_assn (\\<lambda>a c. \\<up> (a = c \\<and> length c = Suc (n + (n + n * n)))) = pure ?R1\"\n    unfolding fcomp_norm_unfold by (simp add: pure_def br_def)\n  have \"?R = pure (location_rel \\<times>\\<^sub>r ?R1)\"\n    unfolding * pure_def prod_assn_def by (intro ext) auto\n  then have **: \"list_assn ?R = pure (\\<langle>location_rel \\<times>\\<^sub>r ?R1\\<rangle>list_rel)\"\n    unfolding fcomp_norm_unfold by simp (fo_rule HOL.arg_cong)\n  have \"emp \\<Longrightarrow>\\<^sub>A list_assn ?R M_list' M_list * true\"\n    using M_list_rel unfolding ** by (sep_auto simp: pure_def)\n  then show ?thesis\n    by sepref_to_hoare (sep_auto simp: lso_assn_def hr_comp_def br_def \\<open>b_rel Id = br id\\<close>)\nqed\n\nsepref_register \"PR_CONST M_list'\"\n\ninterpretation DBM_Impl n .\n\nsepref_definition M_table is\n  \"uncurry0 (RETURN M)\" :: \"unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a hm.hms_assn' location_assn (lso_assn mtx_assn)\"\n  unfolding M_def set_of_list_def[symmetric] rev_map_fold\n    HOL_list.fold_custom_empty hm.op_hms_empty_def[symmetric]\n  by sepref\n\nlemmas dom_M_eq = dom_M_eq1[OF M_assms, folded M_alt_def M_list'_def]\n\ninterpretation\n  Reachability_Impl\n  where A = mtx_assn\n    and F = F\n    and l\\<^sub>0i = \"return l\\<^sub>0i\"\n    and s\\<^sub>0 = init_dbm\n    and s\\<^sub>0i = init_dbm_impl\n    and succs = succs_precise\n    and succsi = succs_precise'_impl\n    and less = \"\\<lambda> x y. dbm_subset n x y \\<and> \\<not> dbm_subset n y x\"\n    and less_eq = \"dbm_subset n\"\n    and Lei = \"dbm_subset_impl n\"\n    and E = op_precise.E_from_op_empty\n    and Fi = F_impl\n    and K = location_assn\n    and keyi = \"return o fst\"\n    and copyi = amtx_copy\n    and P = \"\\<lambda>(l, M). l \\<in> states' \\<and> wf_dbm M\"\n    and P' = P\n    and Pi = P_impl\n    and L = \"set L\"\n    and M = M\n  apply standard\n                      apply (rule HOL.refl; fail)\n                      apply (rule dbm_subset_refl; fail)\n                      apply (rule dbm_subset_trans; assumption)\n  subgoal (* succs correct *)\n    unfolding succs_precise_def op_precise.E_from_op_empty_def op_precise.E_from_op_def\n    apply (auto dest!: trans_impl_trans_of)\n    apply (auto dest!: trans_of_trans_impl)\n    apply (intro exI conjI, erule image_eqI[rotated])\n     apply auto\n    done\n  subgoal (* P correct *)\n    by (auto dest: P_correct)\n  subgoal (* F mono *)\n    by (rule F_mono)\n  subgoal (* L finite *)\n    ..\n  subgoal (* M finite *)\n    by (rule M_finite)\n  subgoal (* succs finite *)\n    by (rule succs_precise_finite)\n  subgoal (* succs empty *)\n    unfolding succs_precise_def by auto\n    (* using op.F_mono subsumes_simp_1 by fastforce *)\n      (* subgoal (* L refine *)\n    by (rule L_list_hnr) *)\n      (* subgoal (* M refine *)\n    unfolding PR_CONST_def by (rule M_table.refine) *)\n  subgoal (* key refine *)\n    by sepref_to_hoare sep_auto\n           apply (rule amtx_copy_hnr; fail)\n  subgoal (* P refine *)\n    by (rule P_impl_refine)\n  subgoal (* F refine *)\n    by (rule F_impl)\n  subgoal (* succs refine *)\n    using succs_precise_impl_refine unfolding b_assn_pure_conv .\n       apply (rule dbm_subset_impl.refine; fail)\n        apply (rule location_assn_constraints; fail)+\n  subgoal (* E_precise mono *)\n    by (auto dest: op_precise.E_from_op_empty_mono')\n  subgoal (* E_precise invariant *)\n    by (clarsimp simp: op_precise.E_from_op_empty_def, frule op_precise.E_from_op_wf_state[rotated])\n      (auto dest: E_from_op_states simp: wf_state_def)\n  subgoal (* init loc refine *)\n    using init_impl states'_states by sepref_to_hoare sep_auto\n     apply (unfold PR_CONST_def, rule init_dbm_impl.refine; fail)\n  done\n\ndefinition\n  \"Mi = hashmap_of_list (map (\\<lambda>(k, dbms). (k, map IArray dbms)) M_list)\"\n\nlemma Mi_alt_def:\n  \"Mi = M1i TYPE(int DBMEntry list) M_list IArray\"\n  unfolding Mi_def M1i_def ..\n\nlemmas map_of_M_list_M_rel = map_of_M_list_M_rel1[OF M_assms, folded M_alt_def]\n\nlemmas Mi_M = Mi_M1[OF M_assms, folded M_alt_def Mi_alt_def]\n\nlemmas L_dom_M_eqI = L_dom_M_eqI1[OF M_assms, folded M_alt_def]\n\ncontext\n  fixes Li_split :: \"'si list list\"\n  assumes full_split: \"set L_list = (\\<Union>xs \\<in> set Li_split. set xs)\"\nbegin\n\ninterpretation Reachability_Impl_imp_to_pure_correct\n  where A = mtx_assn\n    and F = F\n    and l\\<^sub>0i = \"return l\\<^sub>0i\"\n    and s\\<^sub>0 = init_dbm\n    and s\\<^sub>0i = init_dbm_impl\n    and succs = succs_precise\n    and succsi = succs_precise'_impl\n    and less = \"\\<lambda> x y. dbm_subset n x y \\<and> \\<not> dbm_subset n y x\"\n    and less_eq = \"dbm_subset n\"\n    and Lei = \"dbm_subset_impl n\"\n    and lei = \"\\<lambda>as bs.\n      (\\<exists>i\\<le>n. IArray.sub as (i + i * n + i) < Le 0) \\<or> array_all2 (Suc n * Suc n) (\\<le>) as bs\"\n    and E = op_precise.E_from_op_empty\n    and Fi = F_impl\n    and K = location_assn\n    and keyi = \"return o fst\"\n    and copyi = amtx_copy\n    and P = \"\\<lambda>(l, M). l \\<in> states' \\<and> wf_dbm M\"\n    and P' = P\n    and Pi = P_impl\n    and L = \"set L\"\n    and M = M\n    and to_loc = id\n    and from_loc = id\n    and L_list = L_list\n    and K_rel = location_rel\n    and L' = L\n    and Li = L_list\n    and to_state = array_unfreeze\n    and from_state = array_freeze\n    and A_rel = \"{(a, b). iarray_mtx_rel (Suc n) (Suc n) b a}\"\n    and Mi = \"\\<lambda>k. Impl_Array_Hash_Map.ahm_lookup (=) bounded_hashcode_nat k Mi\"\n  apply standard\n  subgoal\n    using L_list_rel by simp\n  subgoal\n    by (rule L_list_rel)\n  subgoal\n    ..\n  subgoal for s1 s\n    by (rule array_unfreeze_ht) simp\n  subgoal for si s\n    by (sep_auto heap: array_freeze_ht)\n  subgoal\n    by simp\n  subgoal\n    by simp\n  subgoal\n    by (rule right_unique_location_rel)\n  subgoal\n    using left_unique_location_rel unfolding IS_LEFT_UNIQUE_def .\n  subgoal\n    unfolding dbm_subset_def check_diag_def\n    by (auto simp: array_all2_iff_pointwise_cmp[symmetric] iarray_mtx_relD)\n  subgoal\n    using full_split .\n  using Mi_M .\n\nconcrete_definition certify_unreachable_pure\n  uses pure.certify_unreachable_impl_pure_correct[unfolded to_pair_def get_succs_def] is \"?f \\<longrightarrow> _\"\n\nlemma certify_unreachable_pure_refine:\n  assumes \"fst ` set M_list = set L_list\" certify_unreachable_pure\n  shows \"\\<nexists>u l' u'. (\\<forall>c\\<le>n. u c = 0) \\<and> conv_A A \\<turnstile>' \\<langle>l\\<^sub>0, u\\<rangle> \\<rightarrow>* \\<langle>l', u'\\<rangle> \\<and> F' (l', u')\"\n  using certify_unreachable_pure.refine[OF L_dom_M_eqI] assms op_precise_unreachable_correct by simp\n\nend (* Fixed splitter *)\n\ncontext\n  fixes splitter :: \"'s list \\<Rightarrow> 's list list\" and splitteri :: \"'si list \\<Rightarrow> 'si list list\"\n  assumes full_split: \"set xs = (\\<Union>xs \\<in> set (splitter xs). set xs)\"\n      and same_split:\n  \"\\<And>L Li.\n    list_assn (list_assn location_assn) (splitter L) (splitteri Li) = list_assn location_assn L Li\"\nbegin\n\nlemmas certify_unreachable_impl_hnr =\n  certify_unreachable_impl.refine[\n    OF Reachability_Impl_axioms L_list_hnr, unfolded PR_CONST_def, OF M_table.refine,\n    OF full_split same_split,\n    FCOMP op_precise_unreachable_correct'\n  ]\n\ndefinition\n  \"unreachability_checker \\<equiv>\n  let\n    Fi = F_impl;\n    Pi = P_impl;\n    copyi = amtx_copy;\n    Lei = dbm_subset_impl n;\n    l\\<^sub>0i = Heap_Monad.return l\\<^sub>0i;\n    s\\<^sub>0i = init_dbm_impl;\n    succsi = succs_precise'_impl;\n    M_table = M_table\n  in\n    certify_unreachable_impl Fi Pi copyi Lei succsi l\\<^sub>0i s\\<^sub>0i L_list M_table splitteri\"\n\nlemma unreachability_checker_alt_def:\n  \"unreachability_checker \\<equiv>\n  let\n    Fi = F_impl;\n    Pi = P_impl;\n    copyi = amtx_copy;\n    Lei = dbm_subset_impl n;\n    l\\<^sub>0i = Heap_Monad.return l\\<^sub>0i;\n    s\\<^sub>0i = init_dbm_impl;\n    succsi = succs_precise'_impl\n  in do {\n    M_table \\<leftarrow> M_table;\n    certify_unreachable_impl_inner Fi Pi copyi Lei succsi l\\<^sub>0i s\\<^sub>0i splitteri L_list M_table\n  }\"\n  unfolding unreachability_checker_def certify_unreachable_impl_def Let_def .\n\nlemmas unreachability_checker_hnr =\n  certify_unreachable_impl_hnr[folded unreachability_checker_def[unfolded Let_def]]\n\nlemmas unreachability_checker_alt_def' = unreachability_checker_alt_def[unfolded M_table_def]\n\ndefinition\n  \"unreachability_checker2 \\<equiv>\n  let\n    Fi = F_impl;\n    Pi = P_impl;\n    copyi = amtx_copy;\n    Lei = dbm_subset_impl n;\n    l\\<^sub>0i = Heap_Monad.return l\\<^sub>0i;\n    s\\<^sub>0i = init_dbm_impl;\n    succsi = succs_precise'_impl;\n    M_table = M_table\n  in\n    certify_unreachable_impl2 Fi Pi copyi Lei succsi l\\<^sub>0i s\\<^sub>0i splitteri L_list M_table\"\n\nlemmas unreachability_checker2_refine = certify_unreachable_impl2_refine[\n    of L_list M_table splitter splitteri,\n    OF L_list_hnr _ full_split same_split L_dom_M_eqI[symmetric],\n    unfolded PR_CONST_def, OF M_table.refine,\n    folded unreachability_checker2_def[unfolded Let_def],\n    THEN mp, THEN op_precise_unreachable_correct\n]\n\nend (* Splitter *)\n\nend (* M *)\n\n\ncontext\n  fixes M_list :: \"('si \\<times> (int DBMEntry list \\<times> nat) list) list\"\n  assumes M_list_covered: \"fst ` set M_list \\<subseteq> set L_list\"\n      and M_dbm_len: \"list_all (\\<lambda>(l, xs). list_all (\\<lambda>(M, _). length M = Suc n * Suc n) xs) M_list\"\nbegin\n\nlemma conversions_param:\n  \"(\\<lambda>(M, i). (IArray M, i), \\<lambda>(M, i). (list_to_dbm n M, i))\n\\<in> {(x, y). x = y \\<and> (\\<lambda>(M, _). length M = Suc n * Suc n) x} \\<rightarrow>\n   {(a, b). iarray_mtx_rel (Suc n) (Suc n) b a} \\<times>\\<^sub>r Id\"\n  using IArray_list_to_dbm_rel by (auto dest!: fun_relD)\n\nlemmas M2_assms =\n  M_list_covered\n  M_dbm_len\n  conversions_param\n\ndefinition\n  \"M_list2 \\<equiv> map (\\<lambda>(li, xs). (SOME l. (li, l) \\<in> loc_rel, xs)) M_list\"\n\ndefinition\n  \"M2 = fold (\\<lambda>p M.\n    let\n      s = fst p; xs = snd p;\n      xs = rev (map (\\<lambda>(M, i). (list_to_dbm n M, i)) xs);\n      S = set xs in fun_upd M s (Some S)\n  ) (PR_CONST M_list2) IICF_Map.op_map_empty\"\n\nlemma M_list2_alt_def:\n  \"M_list2 = M_list1 M_list\"\n  unfolding M_list2_def M_list1_def ..\n\nlemma M2_alt_def:\n  \"M2 = M1 TYPE(int DBMEntry list \\<times> nat) M_list (\\<lambda>(M, i). (list_to_dbm n M, i))\"\n  unfolding M1_def M2_def M_list1_def M_list2_def ..\n\nlemmas M2_finite = M1_finite[OF M2_assms, folded M2_alt_def]\n\nlemmas L_dom_M_eqI2 = L_dom_M_eqI1[OF M2_assms, folded M2_alt_def M_list2_alt_def]\n\ndefinition\n  \"M2i = hashmap_of_list (map (\\<lambda>(k, dbms). (k, map (\\<lambda>(M, i). (IArray M, i)) dbms)) M_list)\"\n\nlemma M2i_alt_def:\n  \"M2i = M1i TYPE(int DBMEntry list \\<times> nat) M_list (\\<lambda>(M, i). (IArray M, i))\"\n  unfolding M2i_def M1i_def ..\n\nlemmas map_of_M_list_M_rel2 = map_of_M_list_M_rel1[OF M2_assms, folded M2_alt_def]\n\nlemmas Mi_M2 = Mi_M1[OF M2_assms, folded M2i_alt_def M2_alt_def]\n\ninterpretation\n  Buechi_Impl_pre\n  where F = F\n    and succs = succs_precise\n    and less = \"\\<lambda> x y. dbm_subset n x y \\<and> \\<not> dbm_subset n y x\"\n    and less_eq = \"dbm_subset n\"\n    and E = op_precise.E_from_op_empty\n    and P = \"\\<lambda>(l, M). l \\<in> states' \\<and> wf_dbm M\"\n    and P' = P\n    and L = \"set L\"\n    and M = \"\\<lambda>x. case M2 x of None \\<Rightarrow> {} | Some S \\<Rightarrow> S\"\n  apply standard\n                      apply (rule HOL.refl; fail)\n                      apply (rule dbm_subset_refl; fail)\n                      apply (rule dbm_subset_trans; assumption)\n  subgoal (* succs correct *)\n    unfolding succs_precise_def op_precise.E_from_op_empty_def op_precise.E_from_op_def\n    apply (auto dest!: trans_impl_trans_of)\n    apply (auto dest!: trans_of_trans_impl)\n    apply (intro exI conjI, erule image_eqI[rotated])\n     apply auto\n    done\n  subgoal (* P correct *)\n    by (auto dest: P_correct)\n  subgoal (* F mono *)\n    by (rule F_mono)\n  subgoal (* L finite *)\n    ..\n  subgoal (* M finite *)\n    using M2_finite by (auto split: option.split intro: ranI)\n  done\n\n\ncontext\n  fixes Li_split :: \"'si list list\"\n  assumes full_split: \"set L_list = (\\<Union>xs \\<in> set Li_split. set xs)\"\n  fixes init_locsi :: \"'si list\" and init_locs :: \"'s set\"\n  assumes init_locs_in_states: \"init_locs \\<subseteq> states'\"\n  assumes initsi_inits:\n    \"(init_locsi, init_locs) \\<in> \\<langle>loc_rel\\<rangle>list_set_rel\"\nbegin\n\ndefinition\n  \"init_locs1 = (SOME xs. set xs = init_locs \\<and> (init_locsi, xs) \\<in> \\<langle>loc_rel\\<rangle>list_rel)\"\n\nlemma init_locs1:\n  \"set init_locs1 = init_locs \\<and> (init_locsi, init_locs1) \\<in> \\<langle>loc_rel\\<rangle>list_rel\"\n  using initsi_inits unfolding list_set_rel_def\n  apply (elim relcompE)\n  unfolding init_locs1_def\n  apply (rule someI)\n  apply auto\n  done\n\nlemma init_locsi_init_locs1:\n  \"(init_locsi, init_locs1) \\<in> \\<langle>location_rel\\<rangle>list_rel\"\n  using init_locs1 init_locs_in_states unfolding b_rel_def\n  unfolding list_rel_def by (auto elim!: list.rel_mono_strong)\n\nlemma [sepref_fr_rules]:\n  \"(uncurry0 (return li), uncurry0 (RETURN (PR_CONST l)))\n    \\<in> unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a location_assn\" if \"(li, l) \\<in> loc_rel\" \"l \\<in> states'\"\n  using that by sepref_to_hoare sep_auto\n\nlemma init_locsi_refine[sepref_fr_rules]:\n  \"(uncurry0 (return init_locsi), uncurry0 (RETURN (PR_CONST init_locs1)))\n    \\<in> unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a list_assn location_assn\"\nproof -\n  let ?x = \"list_assn (\\<lambda>a c. \\<up> ((c, a) \\<in> loc_rel \\<and> a \\<in> states'))\"\n  have \"?x = pure (\\<langle>location_rel\\<rangle>list_rel)\"\n    unfolding fcomp_norm_unfold unfolding b_assn_def pure_def by simp\n  then have \"emp \\<Longrightarrow>\\<^sub>A ?x init_locs1 init_locsi * true\"\n    using init_locsi_init_locs1 by (simp add: pure_app_eq)\n  then show ?thesis\n    by sepref_to_hoare sep_auto\nqed\n\ndefinition\n  \"inits = map (\\<lambda>l. (l, init_dbm)) init_locs1\"\n\ninterpretation DBM_Impl n .\n\nsepref_register init_locs1\n\nsepref_definition initsi\n  is \"uncurry0 (RETURN (PR_CONST inits))\"\n  :: \"unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a list_assn (prod_assn location_assn mtx_assn)\"\n  unfolding inits_def PR_CONST_def\n  unfolding map_by_foldl[symmetric] foldl_conv_fold HOL_list.fold_custom_empty\n  by sepref\n\ninterpretation Buechi_Impl_imp_to_pure_correct\n  where A = mtx_assn\n    and F = F\n    and succs = succs_precise\n    and succsi = succs_precise'_impl\n    and less = \"\\<lambda> x y. dbm_subset n x y \\<and> \\<not> dbm_subset n y x\"\n    and less_eq = \"dbm_subset n\"\n    and Lei = \"dbm_subset_impl n\"\n    and lei = \"\\<lambda>as bs.\n      (\\<exists>i\\<le>n. IArray.sub as (i + i * n + i) < Le 0) \\<or> array_all2 (Suc n * Suc n) (\\<le>) as bs\"\n    and E = op_precise.E_from_op_empty\n    and Fi = F_impl\n    and K = location_assn\n    and keyi = \"return o fst\"\n    and copyi = amtx_copy\n    and P = \"\\<lambda>(l, M). l \\<in> states' \\<and> wf_dbm M\"\n    and P' = P\n    and Pi = P_impl\n    and L = \"set L\"\n    and M = M2\n    and to_loc = id\n    and from_loc = id\n    and L_list = L_list\n    and K_rel = location_rel\n    and L' = L\n    and Li = L_list\n    and to_state = array_unfreeze\n    and from_state = array_freeze\n    and A_rel = \"{(a, b). iarray_mtx_rel (Suc n) (Suc n) b a}\"\n    and Mi = \"\\<lambda>k. Impl_Array_Hash_Map.ahm_lookup (=) bounded_hashcode_nat k M2i\"\n    and inits = inits\n    and initsi = \"initsi\"\n  apply standard\n  subgoal (* key refine *)\n    by sepref_to_hoare sep_auto\n           apply (rule amtx_copy_hnr; fail)\n  subgoal (* P refine *)\n    by (rule P_impl_refine)\n  subgoal (* F refine *)\n    by (rule F_impl)\n  subgoal (* succs refine *)\n    using succs_precise_impl_refine unfolding b_assn_pure_conv .\n       apply (rule dbm_subset_impl.refine; fail)\n    apply (rule location_assn_constraints; fail)+\n  subgoal\n    using L_list_rel by simp\n  subgoal\n    by (rule L_list_rel)\n  subgoal\n    ..\n  subgoal for s1 s\n    by (rule array_unfreeze_ht) simp\n  subgoal for si s\n    by (sep_auto heap: array_freeze_ht)\n  subgoal\n    by simp\n  subgoal\n    by simp\n  subgoal\n    by (rule right_unique_location_rel)\n  subgoal\n    using left_unique_location_rel unfolding IS_LEFT_UNIQUE_def .\n  subgoal\n    unfolding dbm_subset_def check_diag_def\n    by (auto simp: array_all2_iff_pointwise_cmp[symmetric] iarray_mtx_relD)\n  subgoal\n    using full_split .\n  subgoal\n    using initsi.refine .\n  subgoal\n    using Mi_M2 .\n  subgoal (* E_precise mono *)\n    by (auto dest: op_precise.E_from_op_empty_mono')\n  subgoal (* E_precise invariant *)\n    by (clarsimp simp: op_precise.E_from_op_empty_def, frule op_precise.E_from_op_wf_state[rotated])\n       (auto dest: E_from_op_states simp: wf_state_def)\n  done\n\nconcrete_definition certify_no_buechi_run_pure\n  uses pure.certify_no_buechi_run_impl_pure_correct[unfolded to_pair_def get_succs_def]\n  is \"?f \\<longrightarrow> _\"\n\nlemma certify_no_buechi_run_pure_refine:\n  assumes \"fst ` set M_list = set L_list\" certify_no_buechi_run_pure\n  and F_F1: \"\\<And>l\\<^sub>0 l D Z. l\\<^sub>0 \\<in> init_locs \\<Longrightarrow> op_precise.E_from_op_empty\\<^sup>*\\<^sup>* (l\\<^sub>0, init_dbm) (l, D)\n          \\<Longrightarrow> dbm.zone_of (curry (conv_M D)) = Z \\<Longrightarrow> F (l, D) = F1 (l, Z)\"\n  shows \"\\<nexists>l\\<^sub>0 u xs. l\\<^sub>0 \\<in> init_locs \\<and> (\\<forall>c\\<le>n. u c = 0) \\<and> run ((l\\<^sub>0, u) ## xs) \\<and> alw (ev (holds F')) ((l\\<^sub>0, u) ## xs)\"\n  using certify_no_buechi_run_pure.refine[OF L_dom_M_eqI2] assms(1,2)\n    op_precise_buechi_run_correct[OF _ F_F1]\n  unfolding inits_def using init_locs1 by simp\n\nend (* Fixed splitter *)\n\nend (* M *)\n\nend (* L *)\n\nend (* Reachability Problem Impl Precise *)\n\n\n\ncontext TA_Impl_Precise\nbegin\n\nlemma (in TA_Impl) dbm_subset_correct:\n  assumes \"wf_dbm D\" and \"wf_dbm M\"\n  shows \"[curry (conv_M D)]\\<^bsub>v,n\\<^esub> \\<subseteq> [curry (conv_M M)]\\<^bsub>v,n\\<^esub> \\<longleftrightarrow> dbm_subset n D M\"\n  unfolding dbm_subset_correct''[OF assms] using dbm_subset_conv_rev dbm_subset_conv ..\n\nlemma empty_steps_states':\n  \"l' \\<in> states'\" if \"op_precise.E_from_op_empty\\<^sup>*\\<^sup>* (l, D) (l', D')\" \"l \\<in> states'\"\n  using that\nproof (induction \"(l, D)\" \"(l', D')\" arbitrary: l' D')\n  case rtrancl_refl\n  then show ?case\n    by simp\nnext\n  case (rtrancl_into_rtrancl b)\n  then show ?case\n    by (cases b) (auto simp add: op_precise.E_from_op_empty_def intro: E_from_op_states)\nqed\n\ninterpretation deadlock: Reachability_Problem_Impl_Precise where\n  F = \"\\<lambda>(l, D). \\<not> (check_deadlock_dbm l D)\" and\n  F1 = \"\\<lambda>(l, Z). \\<not> (TA.check_deadlock l Z)\" and\n  F' = deadlocked and\n  F_impl = \"\\<lambda>(l, M). do {r \\<leftarrow> check_deadlock_impl l M; return (\\<not> r)}\"\n  apply standard\n(* mono *)\n  subgoal for a b\n    apply clarsimp\n    apply (auto dest: TA.check_deadlock_anti_mono simp:\n        dbm_subset_correct[symmetric] check_deadlock_dbm_correct'[symmetric, unfolded wf_state_def])\n    done\n(* compatible zone *)\n  subgoal\n    using\n      Bisimulation_Invariant.B_steps_invariant[OF op_precise.step_z_dbm'_E_from_op_bisim_empty]\n      wf_state_init states'_states\n    unfolding a\\<^sub>0_def\n    by simp (subst check_deadlock_dbm_correct'[symmetric], auto elim: empty_steps_states')\n(* compatible semantics *)\n  subgoal for l u Z\n    unfolding TA.check_deadlock_correct_step' deadlocked_def by auto\n(* implementation correct *)\n  subgoal\n  proof -\n    define location_assn' where \"location_assn' = location_assn\"\n    define mtx_assn' :: \"_ \\<Rightarrow> int DBMEntry Heap.array \\<Rightarrow> _\" where \"mtx_assn' = mtx_assn n\"\n    note [sep_heap_rules] = check_deadlock_impl.refine[\n        to_hnr, unfolded hn_refine_def hn_ctxt_def,\n        folded location_assn'_def mtx_assn'_def, simplified]\n    show ?thesis\n      unfolding location_assn'_def[symmetric] mtx_assn'_def[symmetric]\n      by sepref_to_hoare (sep_auto simp: pure_def)\n  qed\n  done\n\nlemma deadlock_unreachability_checker2_hnr:\n  fixes P_loc :: \"'si \\<Rightarrow> bool\"\n    and L_list :: \"'si list\"\n    and M_list :: \"('si \\<times> int DBMEntry list list) list\"\n  fixes splitter :: \"'s list \\<Rightarrow> 's list list\" and splitteri :: \"'si list \\<Rightarrow> 'si list list\"\n  assumes \"\\<And>li. P_loc li \\<Longrightarrow> \\<exists>l. (li, l) \\<in> loc_rel\"\n    and \"list_all (\\<lambda>x. P_loc x \\<and> states_mem_impl x) L_list\"\n    and \"list_all (\\<lambda>(l, xs). list_all (\\<lambda>M. length M = Suc n * Suc n) xs) M_list\"\n    and \"fst ` set M_list = set L_list\"\n  assumes full_split: \"\\<And>xs. set xs = (\\<Union>xs \\<in> set (splitter xs). set xs)\"\n    and same_split:\n    \"\\<And>L Li.\n      list_assn (list_assn location_assn) (splitter L) (splitteri Li) = list_assn location_assn L Li\"\n  shows\n    \"deadlock.unreachability_checker2 L_list M_list splitteri\n    \\<longrightarrow> (\\<forall>u. (\\<forall>c\\<le>n. u c = 0) \\<longrightarrow> \\<not> deadlock (l\\<^sub>0, u))\"\n  using deadlock.unreachability_checker2_refine[\n      OF assms(1-2) assms(4)[THEN equalityD1] assms(3) full_split same_split assms(4)\n      ]\n  unfolding deadlock_def steps'_iff[symmetric] by auto\n\nlemma deadlock_unreachability_checker3_hnr:\n  fixes P_loc :: \"'si \\<Rightarrow> bool\"\n    and L_list :: \"'si list\"\n    and M_list :: \"('si \\<times> int DBMEntry list list) list\"\n  fixes Li_split :: \"'si list list\"\n  assumes \"\\<And>li. P_loc li \\<Longrightarrow> \\<exists>l. (li, l) \\<in> loc_rel\"\n    and \"list_all (\\<lambda>x. P_loc x \\<and> states_mem_impl x) L_list\"\n    and \"list_all (\\<lambda>(l, xs). list_all (\\<lambda>M. length M = Suc n * Suc n) xs) M_list\"\n    and \"fst ` set M_list = set L_list\"\n  assumes full_split: \"set L_list = (\\<Union>xs \\<in> set Li_split. set xs)\"\n  shows\n    \"deadlock.certify_unreachable_pure L_list M_list Li_split\n    \\<longrightarrow> (\\<forall>u. (\\<forall>c\\<le>n. u c = 0) \\<longrightarrow> \\<not> deadlock (l\\<^sub>0, u))\"\n  using deadlock.certify_unreachable_pure_refine[\n      OF assms(1-2) assms(4)[THEN equalityD1] assms(3) full_split assms(4)\n      ]\n  unfolding deadlock_def steps'_iff[symmetric] by auto\n\nlemmas deadlock_unreachability_checker2_def = deadlock.unreachability_checker2_def\n\nlemmas deadlock_unreachability_checker_alt_def = deadlock.unreachability_checker_alt_def\n\nlemmas deadlock_unreachability_checker3_def = deadlock.certify_unreachable_pure_def\n\nlemma deadlock_unreachability_checker_hnr:\n  fixes P_loc :: \"'si \\<Rightarrow> bool\"\n    and L_list :: \"'si list\"\n    and M_list :: \"('si \\<times> int DBMEntry list list) list\"\n  fixes splitter :: \"'s list \\<Rightarrow> 's list list\" and splitteri :: \"'si list \\<Rightarrow> 'si list list\"\n  assumes \"\\<And>li. P_loc li \\<Longrightarrow> \\<exists>l. (li, l) \\<in> loc_rel\"\n    and \"list_all (\\<lambda>x. P_loc x \\<and> states_mem_impl x) L_list\"\n    and \"fst ` set M_list \\<subseteq> set L_list\"\n    and \"list_all (\\<lambda>(l, xs). list_all (\\<lambda>M. length M = Suc n * Suc n) xs) M_list\"\n    and \"set (deadlock.L L_list) = dom (deadlock.M M_list)\"\n  assumes full_split: \"\\<And>xs. set xs = (\\<Union>xs \\<in> set (splitter xs). set xs)\"\n      and same_split:\n    \"\\<And>L Li.\n      list_assn (list_assn location_assn) (splitter L) (splitteri Li) = list_assn location_assn L Li\"\n  shows\n    \"(uncurry0\n       (Reachability_Problem_Impl_Precise.unreachability_checker n trans_impl l\\<^sub>0i op_impl\n         states_mem_impl (\\<lambda>(l, M). check_deadlock_impl l M \\<bind> (\\<lambda>r. return (\\<not> r))) L_list M_list splitteri),\n      uncurry0\n       (SPEC\n         (\\<lambda>r. r \\<longrightarrow> (\\<forall>u. (\\<forall>c\\<le>n. u c = 0) \\<longrightarrow> \\<not> deadlock (l\\<^sub>0, u)))))\n     \\<in> unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  using deadlock.unreachability_checker_hnr[OF assms(1-4), OF _ full_split same_split assms(5)]\n  unfolding deadlock_def steps'_iff[symmetric] by simp linarith\n\nend (* TA Impl Precise *)\n\nconcrete_definition (in -) unreachability_checker\n  uses Reachability_Problem_Impl_Precise.unreachability_checker_alt_def\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Certification/Normalized_Zone_Semantics_Certification_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883735630721, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.33510137064650697}}
{"text": "(*  Author:     Filip Maric\n\nExample theory involving Unicode characters (UTF-8 encoding) -- \nConversion between Serbian cyrillic and latin letters (српска ћирилица и латиница)\n*)\n\nsection {* A Serbian theory *}\n\ntheory Serbian\nimports Main\nbegin\n\ntext{* Serbian cyrillic letters *}\ndatatype azbuka =\n  azbA   (\"А\")\n| azbB   (\"Б\")\n| azbV   (\"В\")\n| azbG   (\"Г\")\n| azbD   (\"Д\")\n| azbDj  (\"Ђ\")\n| azbE   (\"Е\")\n| azbZv  (\"Ж\")\n| azbZ   (\"З\")\n| azbI   (\"И\")\n| azbJ   (\"Ј\")\n| azbK   (\"К\")\n| azbL   (\"Л\")\n| azbLj  (\"Љ\")\n| azbM   (\"М\")\n| azbN   (\"Н\")\n| azbNj  (\"Њ\")\n| azbO   (\"О\")\n| azbP   (\"П\")\n| azbR   (\"Р\")\n| azbS   (\"С\")\n| azbT   (\"Т\")\n| azbC'  (\"Ћ\")\n| azbU   (\"У\")\n| azbF   (\"Ф\")\n| azbH   (\"Х\")\n| azbC   (\"Ц\")\n| azbCv  (\"Ч\")\n| azbDzv (\"Џ\")\n| azbSv  (\"Ш\")\n| azbSpc\n\nthm azbuka.induct\n\ntext{* Serbian latin letters *}\ndatatype abeceda =\n  abcA   (\"A\")\n| abcB   (\"B\")\n| abcC   (\"C\")\n| abcCv  (\"Č\")\n| abcC'  (\"Ć\")\n| abcD   (\"D\")\n| abcE   (\"E\")\n| abcF   (\"F\")\n| abcG   (\"G\")\n| abcH   (\"H\")\n| abcI   (\"I\")\n| abcJ   (\"J\")\n| abcK   (\"K\")\n| abcL   (\"L\")\n| abcM   (\"M\")\n| abcN   (\"N\")\n| abcO   (\"O\")\n| abcP   (\"P\")\n| abcR   (\"R\")\n| abcS   (\"S\")\n| abcSv  (\"Š\")\n| abcT   (\"T\")\n| abcU   (\"U\")\n| abcV   (\"V\")\n| abcZ   (\"Z\")\n| abcvZ  (\"Ž\")\n| abcSpc\n\nthm abeceda.induct\n\n\ntext{* Conversion from cyrillic to latin - \n       this conversion is valid in all cases *}\nprimrec azb2abc_aux :: \"azbuka \\<Rightarrow> abeceda list\"\nwhere\n  \"azb2abc_aux А = [A]\"\n| \"azb2abc_aux Б = [B]\"\n| \"azb2abc_aux В = [V]\"\n| \"azb2abc_aux Г = [G]\"\n| \"azb2abc_aux Д = [D]\"\n| \"azb2abc_aux Ђ = [D, J]\"\n| \"azb2abc_aux Е = [E]\"\n| \"azb2abc_aux Ж = [Ž]\"\n| \"azb2abc_aux З = [Z]\"\n| \"azb2abc_aux И = [I]\"\n| \"azb2abc_aux Ј = [J]\"\n| \"azb2abc_aux К = [K]\"\n| \"azb2abc_aux Л = [L]\"\n| \"azb2abc_aux Љ = [L, J]\"\n| \"azb2abc_aux М = [M]\"\n| \"azb2abc_aux Н = [N]\"\n| \"azb2abc_aux Њ = [N, J]\"\n| \"azb2abc_aux О = [O]\"\n| \"azb2abc_aux П = [P]\"\n| \"azb2abc_aux Р = [R]\"\n| \"azb2abc_aux С = [S]\"\n| \"azb2abc_aux Т = [T]\"\n| \"azb2abc_aux Ћ = [Ć]\"\n| \"azb2abc_aux У = [U]\"\n| \"azb2abc_aux Ф = [F]\"\n| \"azb2abc_aux Х = [H]\"\n| \"azb2abc_aux Ц = [C]\"\n| \"azb2abc_aux Ч = [Č]\"\n| \"azb2abc_aux Џ = [D, Ž]\"\n| \"azb2abc_aux Ш = [Š]\"\n| \"azb2abc_aux azbSpc = [abcSpc]\"\n\nprimrec azb2abc :: \"azbuka list \\<Rightarrow> abeceda list\"\nwhere\n  \"azb2abc [] = []\"\n| \"azb2abc (x # xs) = azb2abc_aux x @ azb2abc xs\"\n\nvalue \"azb2abc [Д, О, Б, А, Р, azbSpc, Д, А, Н, azbSpc, С, В, И, М, А]\"\nvalue \"azb2abc [Љ, У, Б, И, Ч, И, Ц, А, azbSpc, Н, А, azbSpc, П, О, Љ, У]\"\n\ntext{* The conversion from latin to cyrillic - \n       this conversion is valid in most cases but there are some exceptions *}\nprimrec abc2azb_aux :: \"abeceda \\<Rightarrow> azbuka\"\nwhere\n   \"abc2azb_aux A = А\"\n|  \"abc2azb_aux B = Б\"\n|  \"abc2azb_aux C = Ц\"\n|  \"abc2azb_aux Č = Ч\"\n|  \"abc2azb_aux Ć = Ћ\"\n|  \"abc2azb_aux D = Д\"\n|  \"abc2azb_aux E = Е\"\n|  \"abc2azb_aux F = Ф\"\n|  \"abc2azb_aux G = Г\"\n|  \"abc2azb_aux H = Х\"\n|  \"abc2azb_aux I = И\"\n|  \"abc2azb_aux J = Ј\"\n|  \"abc2azb_aux K = К\"\n|  \"abc2azb_aux L = Л\"\n|  \"abc2azb_aux M = М\"\n|  \"abc2azb_aux N = Н\"\n|  \"abc2azb_aux O = О\"\n|  \"abc2azb_aux P = П\"\n|  \"abc2azb_aux R = Р\"\n|  \"abc2azb_aux S = С\"\n|  \"abc2azb_aux Š = Ш\"\n|  \"abc2azb_aux T = Т\"\n|  \"abc2azb_aux U = У\"\n|  \"abc2azb_aux V = В\"\n|  \"abc2azb_aux Z = З\"\n|  \"abc2azb_aux Ž = Ж\"\n|  \"abc2azb_aux abcSpc = azbSpc\"\n\nfun abc2azb :: \"abeceda list \\<Rightarrow> azbuka list\"\nwhere\n  \"abc2azb [] = []\"\n| \"abc2azb [x] = [abc2azb_aux x]\"\n| \"abc2azb (x1 # x2 # xs) = \n       (if x1 = D \\<and> x2 = J then\n           Ђ # abc2azb xs\n        else if x1 = L \\<and> x2 = J then\n           Љ # abc2azb xs\n        else if x1 = N \\<and> x2 = J then\n           Њ # abc2azb xs\n        else if x1 = D \\<and> x2 = Ž then\n           Џ # abc2azb xs\n        else\n           abc2azb_aux x1 # abc2azb (x2 # xs)\n       )\"\n\nvalue \"abc2azb [D, O, B, A, R, abcSpc, D, A, N, abcSpc, S, V, I, M, A]\"\nvalue \"abc2azb [L, J, U, B, I, Č, I, C, A, abcSpc, N, A, abcSpc, P, O, L, J, U]\"\n\ntext{* Here are some invalid conversions *}\nlemma \"abc2azb [N, A, D, Ž, I, V, E, T, I] = [Н, А, Џ, И, В, Е, Т, И]\"\n  by simp\ntext{* but it should be: НАДЖИВЕТИ *}\nlemma \"abc2azb [I, N, J, E, K, C, I, J, A] = [И, Њ, Е, К, Ц, И, Ј, А]\"\n  by simp\ntext{* but it should be: ИНЈЕКЦИЈА *}\n\ntext{* The conversion fails for all cyrrilic words that contain НЈ ЛЈ ДЈ ДЖ *}\n\n\ntext{* Idempotency in one direction *}\n\n\nlemma [simp]: \"abc2azb (Ž # xs) = Ж # abc2azb xs\"\n  by (cases xs) auto\n\nlemma [simp]: \"abc2azb (J # xs) = Ј # abc2azb xs\"\n  by (cases xs) auto\n\ntheorem \"azb2abc (abc2azb x) = x\"\nproof (induct x)\n  case (Cons x1 xs)\n  thus ?case\n  proof (cases xs)\n    case (Cons x2 xss)\n    thus ?thesis\n      using `azb2abc (abc2azb xs) = xs`\n      by auto\n  qed simp\nqed simp\n\ntext{* Idempotency in the other direction does not hold *}\nlemma \"abc2azb (azb2abc [И, Н, Ј, Е, К, Ц, И, Ј, А]) \\<noteq> [И, Н, Ј, Е, К, Ц, И, Ј, А]\"\n  by simp\ntext{* It fails for all cyrrilic words that contain НЈ ЛЈ ДЈ ДЖ *}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/ex/Serbian.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.3351013626608302}}
{"text": "section \\<open> Reactive Design Triples \\<close>\n\ntheory utp_rdes_triples\n  imports utp_rdes_designs\nbegin\n\nsubsection \\<open> Diamond notation\\<close>\n\ndefinition wait'_cond ::\n  \"('t::trace,'\\<alpha>,'\\<beta>) rel_rp \\<Rightarrow> ('t,'\\<alpha>,'\\<beta>) rel_rp \\<Rightarrow> ('t,'\\<alpha>,'\\<beta>) rel_rp\" (infixr \"\\<diamondop>\" 60) where\n[pred]: \"P \\<diamondop> Q = (P \\<triangleleft> wait\\<^sup>> \\<triangleright> Q)\"\n\nexpr_constructor wait'_cond\n\nlemma wait'_cond_unrest [unrest]:\n  \"\\<lbrakk> mwb_lens x; (wait\\<^sup>>)\\<^sub>v \\<bowtie> x; $x \\<sharp> P; $x \\<sharp> Q \\<rbrakk> \\<Longrightarrow> $x \\<sharp> (P \\<diamondop> Q)\"\n  by (metis (mono_tags, lifting) SEXP_def aext_var lens_indep.lens_put_irr2 lens_indep_sym unrest_cond unrest_lens  wait'_cond_def)\n\nlemma wait'_cond_subst [usubst]:\n  \"$wait\\<^sup>> \\<sharp>\\<^sub>s \\<sigma> \\<Longrightarrow> \\<sigma> \\<dagger> (P \\<diamondop> Q) = (\\<sigma> \\<dagger> P) \\<diamondop> (\\<sigma> \\<dagger> Q)\"\n  apply (simp add: wait'_cond_def usubst unrest usubst_apply_unrest)\n  (* TODO: get proof working *)\n  oops\n\nlemma wait'_cond_left_false: \"false \\<diamondop> P = (\\<not> wait\\<^sup>> \\<and> P)\"\n  by pred_auto\n\nlemma wait'_cond_seq: \"((P \\<diamondop> Q) ;; R) = ((P ;; (wait\\<^sup>< \\<and> R)) \\<or> (Q ;; (\\<not>wait\\<^sup>< \\<and> R)))\"\n  by (simp add: wait'_cond_def rcond_def seqr_or_distl, pred_auto; blast)\n\nlemma wait'_cond_true: \"(P \\<diamondop> Q \\<and> wait\\<^sup>>) = (P \\<and> wait\\<^sup>>)\"\n  by pred_auto\n\nlemma wait'_cond_false: \"(P \\<diamondop> Q \\<and> (\\<not>wait\\<^sup>>)) = (Q \\<and> (\\<not>wait\\<^sup>>))\"\n  by pred_auto\n\nlemma wait'_cond_idem: \"P \\<diamondop> P = P\"\n  by pred_auto\n\nlemma wait'_cond_conj_exchange:\n  \"((P \\<diamondop> Q) \\<and> (R \\<diamondop> S)) = (P \\<and> R) \\<diamondop> (Q \\<and> S)\"\n  by pred_auto\n\nlemma subst_wait'_cond_true [usubst]: \"(P \\<diamondop> Q)\\<lbrakk>True/wait\\<^sup>>\\<rbrakk> = P\\<lbrakk>True/wait\\<^sup>>\\<rbrakk>\"\n  by pred_auto\n\nlemma subst_wait'_cond_false [usubst]: \"(P \\<diamondop> Q)\\<lbrakk>False/wait\\<^sup>>\\<rbrakk> = Q\\<lbrakk>False/wait\\<^sup>>\\<rbrakk>\"\n  by pred_auto\n\nlemma subst_wait'_left_subst: \"(P\\<lbrakk>True/wait\\<^sup>>\\<rbrakk> \\<diamondop> Q) = (P \\<diamondop> Q)\"\n  by pred_auto\n\nlemma subst_wait'_right_subst: \"(P \\<diamondop> Q\\<lbrakk>False/wait\\<^sup>>\\<rbrakk>) = (P \\<diamondop> Q)\"\n  by pred_auto\n\nlemma wait'_cond_split: \"P\\<lbrakk>True/wait\\<^sup>>\\<rbrakk> \\<diamondop> P\\<lbrakk>False/wait\\<^sup>>\\<rbrakk> = P\"\n  by (simp add: subst_wait'_left_subst subst_wait'_right_subst wait'_cond_idem)\n\nlemma wait_cond'_assoc [simp]: \"P \\<diamondop> Q \\<diamondop> R = P \\<diamondop> R\"\n  by pred_auto\n\nlemma wait_cond'_shadow: \"(P \\<diamondop> Q) \\<diamondop> R = P \\<diamondop> Q \\<diamondop> R\"\n  by pred_auto\n\nlemma wait_cond'_conj [simp]: \"P \\<diamondop> (Q \\<and> (R \\<diamondop> S)) = P \\<diamondop> (Q \\<and> S)\"\n  by pred_auto\n\nlemma R1_wait'_cond: \"R1(P \\<diamondop> Q) = R1(P) \\<diamondop> R1(Q)\"\n  by pred_auto\n\nlemma R2s_wait'_cond: \"R2s(P \\<diamondop> Q) = R2s(P) \\<diamondop> R2s(Q)\"\n  by pred_auto\n\nlemma R2_wait'_cond: \"R2(P \\<diamondop> Q) = R2(P) \\<diamondop> R2(Q)\"\n  by (simp add: R2_def R2s_wait'_cond R1_wait'_cond)\n    \nlemma wait'_cond_R1_closed [closure]: \n  \"\\<lbrakk> P is R1; Q is R1 \\<rbrakk> \\<Longrightarrow> P \\<diamondop> Q is R1\"\n  by (simp add: Healthy_def R1_wait'_cond)\n\nlemma wait'_cond_R2c_closed [closure]: \"\\<lbrakk> P is R2c; Q is R2c \\<rbrakk> \\<Longrightarrow> P \\<diamondop> Q is R2c\"\n  by (simp add: R2c_condr wait'_cond_def Healthy_def, pred_auto)\n\nsubsection \\<open> Export laws \\<close>\n\nlemma RH_design_peri_R1: \"\\<^bold>R(P \\<turnstile> R1(Q) \\<diamondop> R) = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R)\"\n  by pred_auto\n(*  by (metis (no_types, lifting) R1_idem R1_wait'_cond RH_design_export_R1) *)\n\nlemma RH_design_post_R1: \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R1(R)) = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R)\"\n  by pred_auto\n(*  by (metis R1_wait'_cond RH_design_export_R1 RH_design_peri_R1) *)\n\nlemma RH_design_peri_R2s: \"\\<^bold>R(P \\<turnstile> R2s(Q) \\<diamondop> R) = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R)\"\n  by pred_auto\n(*  by (metis (no_types, lifting) R2s_idem R2s_wait'_cond RH_design_export_R2s) *)\n\nlemma RH_design_post_R2s: \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R2s(R)) = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R)\"\n  by pred_auto\n(*  by (metis (no_types, lifting) R2s_idem R2s_wait'_cond RH_design_export_R2s) *)\n\nlemma RH_design_peri_R2c: \"\\<^bold>R(P \\<turnstile> R2c(Q) \\<diamondop> R) = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis R1_R2s_R2c RH_design_peri_R1 RH_design_peri_R2s)\n\nlemma RHS_design_peri_R1: \"\\<^bold>R\\<^sub>s(P \\<turnstile> R1(Q) \\<diamondop> R) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)\"\n  by (pred_simp; blast)\n(*  by (metis (no_types, lifting) R1_idem R1_wait'_cond RHS_design_export_R1) *)\n\nlemma RHS_design_post_R1: \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R1(R)) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)\"\n  by pred_auto\n(*  by (metis R1_wait'_cond RHS_design_export_R1 RHS_design_peri_R1) *)\n\nlemma RHS_design_peri_R2s: \"\\<^bold>R\\<^sub>s(P \\<turnstile> R2s(Q) \\<diamondop> R) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)\"\n  by pred_auto\n(*  by (metis (no_types, lifting) R2s_idem R2s_wait'_cond RHS_design_export_R2s) *)\n\nlemma RHS_design_post_R2s: \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R2s(R)) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)\"\n  by pred_auto\n(*  by (metis R2s_wait'_cond RHS_design_export_R2s RHS_design_peri_R2s) *)\n\nlemma RHS_design_peri_R2c: \"\\<^bold>R\\<^sub>s(P \\<turnstile> R2c(Q) \\<diamondop> R) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)\"\n  by (metis R1_R2s_R2c RHS_design_peri_R1 RHS_design_peri_R2s)\n\nlemma RH_design_lemma1:\n  \"RH(P \\<turnstile> (R1(R2c(Q)) \\<or> R) \\<diamondop> S) = RH(P \\<turnstile> (Q \\<or> R) \\<diamondop> S)\"\n  by (metis (no_types, lifting) R1_R2c_is_R2 R1_R2s_R2c R2_R1_form R2_disj R2c_idem RH_design_peri_R1 RH_design_peri_R2s)\n\nlemma RHS_design_lemma1:\n  \"RHS(P \\<turnstile> (R1(R2c(Q)) \\<or> R) \\<diamondop> S) = RHS(P \\<turnstile> (Q \\<or> R) \\<diamondop> S)\"\n  by (metis (no_types, lifting) R1_R2c_is_R2 R1_R2s_R2c R2_R1_form R2_disj R2c_idem RHS_design_peri_R1 RHS_design_peri_R2s)\n\nsubsection \\<open> Pre-, peri-, and postconditions \\<close>\n\nsubsubsection \\<open> Definitions \\<close>\n\nabbreviation \"pre\\<^sub>s  \\<equiv> [ok\\<^sup>< \\<leadsto> True, ok\\<^sup>> \\<leadsto> False, wait\\<^sup>< \\<leadsto> False]\"\nabbreviation \"cmt\\<^sub>s  \\<equiv> [ok\\<^sup>< \\<leadsto> True, ok\\<^sup>> \\<leadsto> True, wait\\<^sup>< \\<leadsto> False]\"\nabbreviation \"peri\\<^sub>s \\<equiv> [ok\\<^sup>< \\<leadsto> True, ok\\<^sup>> \\<leadsto> True, wait\\<^sup>< \\<leadsto> False, wait\\<^sup>> \\<leadsto> True]\"\nabbreviation \"post\\<^sub>s \\<equiv> [ok\\<^sup>< \\<leadsto> True, ok\\<^sup>> \\<leadsto> True, wait\\<^sup>< \\<leadsto> False, wait\\<^sup>> \\<leadsto> False]\"\n\nabbreviation \"npre\\<^sub>R(P) \\<equiv> pre\\<^sub>s \\<dagger> P\"\n\ndefinition [pred]: \"pre\\<^sub>R(P)  = (\\<not>\\<^sub>r npre\\<^sub>R(P))\"\ndefinition [pred]: \"cmt\\<^sub>R(P)  = R1(cmt\\<^sub>s \\<dagger> P)\"\ndefinition [pred]: \"peri\\<^sub>R(P) = R1(peri\\<^sub>s \\<dagger> P)\"\ndefinition [pred]: \"post\\<^sub>R(P) = R1(post\\<^sub>s \\<dagger> P)\"\n\nexpr_constructor pre\\<^sub>R cmt\\<^sub>R peri\\<^sub>R post\\<^sub>R npre\\<^sub>R\n\nsubsubsection \\<open> Unrestriction laws \\<close>\n\nlemma ok_pre_unrest [unrest]: \"$ok\\<^sup>< \\<sharp> pre\\<^sub>R P\"\n  by pred_auto\n  \nlemma ok_peri_unrest [unrest]: \"$ok\\<^sup>< \\<sharp> peri\\<^sub>R P\"\n  by pred_auto\n\nlemma ok_post_unrest [unrest]: \"$ok\\<^sup>< \\<sharp> post\\<^sub>R P\"\n  by pred_auto\n\nlemma ok_cmt_unrest [unrest]: \"$ok\\<^sup>< \\<sharp> cmt\\<^sub>R P\"\n  by pred_auto\n\nlemma ok'_pre_unrest [unrest]: \"$ok\\<^sup>> \\<sharp> pre\\<^sub>R P\"\n  by pred_auto\n\nlemma ok'_peri_unrest [unrest]: \"$ok\\<^sup>> \\<sharp> peri\\<^sub>R P\"\n  by pred_auto\n\nlemma ok'_post_unrest [unrest]: \"$ok\\<^sup>> \\<sharp> post\\<^sub>R P\"\n  by pred_auto\n\nlemma ok'_cmt_unrest [unrest]: \"$ok\\<^sup>> \\<sharp> cmt\\<^sub>R P\"\n  by pred_auto\n\nlemma wait_pre_unrest [unrest]: \"$wait\\<^sup>< \\<sharp> pre\\<^sub>R P\"\n  by pred_auto\n\nlemma wait_peri_unrest [unrest]: \"$wait\\<^sup>< \\<sharp> peri\\<^sub>R P\"\n  by pred_auto\n\nlemma wait_post_unrest [unrest]: \"$wait\\<^sup>< \\<sharp> post\\<^sub>R P\"\n  by pred_auto\n\nlemma wait_cmt_unrest [unrest]: \"$wait\\<^sup>< \\<sharp> cmt\\<^sub>R P\"\n  by pred_auto\n\nlemma wait'_peri_unrest [unrest]: \"$wait\\<^sup>> \\<sharp> peri\\<^sub>R P\"\n  by pred_auto\n\nlemma wait'_post_unrest [unrest]: \"$wait\\<^sup>> \\<sharp> post\\<^sub>R P\"\n  by pred_auto\n\nsubsubsection \\<open> Substitution laws \\<close>\n\nlemma pre\\<^sub>s_design: \"pre\\<^sub>s \\<dagger> (P \\<turnstile> Q) = (\\<not> pre\\<^sub>s \\<dagger> P)\"\n  by pred_auto\n\nlemma peri\\<^sub>s_design: \"peri\\<^sub>s \\<dagger> (P \\<turnstile> Q \\<diamondop> R) = peri\\<^sub>s \\<dagger> (P \\<longrightarrow> Q)\"\n  by pred_auto\n\nlemma design_alt_def: \"(P \\<turnstile> Q) = (ok\\<^sup>< \\<and> P \\<longrightarrow> ok\\<^sup>> \\<and> Q)\"\n  by pred_auto\n\n(* Something wrong here! *)\nlemma post\\<^sub>s_design: \"post\\<^sub>s \\<dagger> (P \\<turnstile> Q \\<diamondop> R) = post\\<^sub>s \\<dagger> (P \\<longrightarrow> R)\"\n  apply (simp add: design_alt_def usubst wait'_cond_def)\n  apply(pred_auto)\n  oops\n\nlemma cmt\\<^sub>s_design: \"cmt\\<^sub>s \\<dagger> (P \\<turnstile> Q) = cmt\\<^sub>s \\<dagger> (P \\<longrightarrow> Q)\"\n  by pred_auto\n  \nlemma pre\\<^sub>s_R1 [usubst]: \"pre\\<^sub>s \\<dagger> R1(P) = R1(pre\\<^sub>s \\<dagger> P)\"\n  by (simp add: R1_def usubst)\n\nlemma pre\\<^sub>s_R2c [usubst]: \"pre\\<^sub>s \\<dagger> R2c(P) = R2c(pre\\<^sub>s \\<dagger> P)\"\n  by pred_auto\n\nlemma peri\\<^sub>s_R1 [usubst]: \"peri\\<^sub>s \\<dagger> R1(P) = R1(peri\\<^sub>s \\<dagger> P)\"\n  by (simp add: R1_def usubst)\n\nlemma peri\\<^sub>s_R2c [usubst]: \"peri\\<^sub>s \\<dagger> R2c(P) = R2c(peri\\<^sub>s \\<dagger> P)\"\n  by pred_auto\n\nlemma post\\<^sub>s_R1 [usubst]: \"post\\<^sub>s \\<dagger> R1(P) = R1(post\\<^sub>s \\<dagger> P)\"\n  by (simp add: R1_def usubst)\n\nlemma post\\<^sub>s_R2c [usubst]: \"post\\<^sub>s \\<dagger> R2c(P) = R2c(post\\<^sub>s \\<dagger> P)\"\n  by pred_auto\n\nlemma cmt\\<^sub>s_R1 [usubst]: \"cmt\\<^sub>s \\<dagger> R1(P) = R1(cmt\\<^sub>s \\<dagger> P)\"\n  by (simp add: R1_def usubst)\n\nlemma cmt\\<^sub>s_R2c [usubst]: \"cmt\\<^sub>s \\<dagger> R2c(P) = R2c(cmt\\<^sub>s \\<dagger> P)\"\n  by pred_auto\n\nlemma pre_wait_false:\n  \"pre\\<^sub>R(P\\<lbrakk>False/wait\\<^sup><\\<rbrakk>) = pre\\<^sub>R(P)\"\n  by pred_auto\n\nlemma cmt_wait_false:\n  \"cmt\\<^sub>R(P\\<lbrakk>False/wait\\<^sup><\\<rbrakk>) = cmt\\<^sub>R(P)\"\n  by pred_auto\n\nlemma rea_pre_RH_design: \"pre\\<^sub>R(\\<^bold>R(P \\<turnstile> Q)) = R1(R2c(pre\\<^sub>s \\<dagger> P))\"\n  by pred_auto\n\nlemma rea_pre_RHS_design: \"pre\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q)) = R1(R2c(pre\\<^sub>s \\<dagger> P))\"\n  by pred_auto\n\nlemma rea_cmt_RH_design: \"cmt\\<^sub>R(\\<^bold>R(P \\<turnstile> Q)) = R1(R2c(cmt\\<^sub>s \\<dagger> (P \\<longrightarrow> Q)))\"\n  by pred_auto\n\nlemma rea_cmt_RHS_design: \"cmt\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q)) = R1(R2c(cmt\\<^sub>s \\<dagger> (P \\<longrightarrow> Q)))\"\n  by pred_auto\n\nlemma rea_peri_RH_design: \"peri\\<^sub>R(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = R1(R2c(peri\\<^sub>s \\<dagger> (P \\<longrightarrow>\\<^sub>r Q)))\"\n  by pred_auto\n\nlemma rea_peri_RHS_design: \"peri\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = R1(R2c(peri\\<^sub>s \\<dagger> (P \\<longrightarrow>\\<^sub>r Q)))\"\n  by pred_auto\n\nlemma rea_post_RH_design: \"post\\<^sub>R(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = R1(R2c(post\\<^sub>s \\<dagger> (P \\<longrightarrow>\\<^sub>r R)))\"\n  (* TODO: fix proof *)\n  oops\n\nlemma rea_post_RHS_design: \"post\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = R1(R2c(post\\<^sub>s \\<dagger> (P \\<longrightarrow>\\<^sub>r R)))\"\n  oops\n  (* TODO: fix proof *)\n(*  by (simp add:RHS_def usubst post\\<^sub>R_def R3h_def post\\<^sub>s_design, rel_auto) *)\n\nlemma peri_cmt_def: \"peri\\<^sub>R(P) = (cmt\\<^sub>R(P))\\<lbrakk>True/wait\\<^sup>>\\<rbrakk>\"\n  by pred_auto\n\nlemma post_cmt_def: \"post\\<^sub>R(P) = (cmt\\<^sub>R(P))\\<lbrakk>False/wait\\<^sup>>\\<rbrakk>\"\n  by pred_auto\n\nlemma rdes_export_cmt: \"\\<^bold>R\\<^sub>s(P \\<turnstile> (cmt\\<^sub>s \\<dagger> Q)) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q)\"\n  by pred_auto\n\nlemma rdes_export_pre: \"\\<^bold>R\\<^sub>s((P\\<lbrakk>True,False/ok\\<^sup><,wait\\<^sup><\\<rbrakk>) \\<turnstile> Q) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q)\"\n  by pred_auto\n\nsubsubsection \\<open> Healthiness laws \\<close>\n\nlemma wait'_unrest_pre_SRD [unrest]:\n  \"$wait\\<^sup>> \\<sharp> pre\\<^sub>R(P) \\<Longrightarrow>  $wait\\<^sup>> \\<sharp> pre\\<^sub>R (SRD P)\"\n  apply (pred_auto)\n  using least_zero apply blast+\ndone\n\nlemma R1_R2s_cmt_SRD:\n  assumes \"P is SRD\"\n  shows \"R1(R2s(cmt\\<^sub>R(P))) = cmt\\<^sub>R(P)\"\n  by (metis (no_types, lifting) R1_R2c_commute R1_R2s_R2c R1_idem R2c_idem SRD_reactive_design assms rea_cmt_RHS_design)\n\n(* TODO: proof not working *)\n(*\nlemma R1_R2s_peri_SRD:\n  assumes \"P is SRD\"\n  shows \"R1(R2s(peri\\<^sub>R(P))) = peri\\<^sub>R(P)\"\n  by (metis (no_types, opaque_lifting) Healthy_def R1_R2s_R2c R2_def R2_idem RHS_def SRD_RH_design_form assms R1_idem peri\\<^sub>R_def peri\\<^sub>s_R1 peri\\<^sub>s_R2c)\n*)\n\n(* TODO: fix proof\nlemma R1_peri_SRD:\n  assumes \"P is SRD\"\n  shows \"R1(peri\\<^sub>R(P)) = peri\\<^sub>R(P)\"\nproof -\n  have \"R1(peri\\<^sub>R(P)) = R1(R1(R2s(peri\\<^sub>R(P))))\"\n    by (simp add: R1_R2s_peri_SRD assms)\n  also have \"... = peri\\<^sub>R(P)\"\n    by (simp add: R1_idem, simp add: R1_R2s_peri_SRD assms)\n  finally show ?thesis .\nqed\n*)\n\n(* TODO: fix proof\nlemma R1_R2c_peri_RHS:\n  assumes \"P is SRD\"\n  shows \"R1(R2c(peri\\<^sub>R(P))) = peri\\<^sub>R(P)\"\n  by (metis R1_R2s_R2c R1_R2s_peri_SRD assms)\n\nlemma R1_R2s_post_SRD:\n  assumes \"P is SRD\"\n  shows \"R1(R2s(post\\<^sub>R(P))) = post\\<^sub>R(P)\"\n  by (metis (no_types, opaque_lifting) Healthy_def R1_R2s_R2c R1_idem R2_def R2_idem RHS_def SRD_RH_design_form assms post\\<^sub>R_def post\\<^sub>s_R1 post\\<^sub>s_R2c)\n\nlemma R2c_peri_SRD:\n  assumes \"P is SRD\"\n  shows \"R2c(peri\\<^sub>R(P)) = peri\\<^sub>R(P)\"\n  by (metis R1_R2c_commute R1_R2c_peri_RHS R1_peri_SRD assms)\n\nlemma R1_post_SRD:\n  assumes \"P is SRD\"\n  shows \"R1(post\\<^sub>R(P)) = post\\<^sub>R(P)\"\nproof -\n  have \"R1(post\\<^sub>R(P)) = R1(R1(R2s(post\\<^sub>R(P))))\"\n    by (simp add: R1_R2s_post_SRD assms)\n  also have \"... = post\\<^sub>R(P)\"\n    by (simp add: R1_idem, simp add: R1_R2s_post_SRD assms)\n  finally show ?thesis .\nqed\n\nlemma R2c_post_SRD:\n  assumes \"P is SRD\"\n  shows \"R2c(post\\<^sub>R(P)) = post\\<^sub>R(P)\"\n  by (metis R1_R2c_commute R1_R2s_R2c R1_R2s_post_SRD R1_post_SRD assms)\n\nlemma R1_R2c_post_RHS:\n  assumes \"P is SRD\"\n  shows \"R1(R2c(post\\<^sub>R(P))) = post\\<^sub>R(P)\"\n  by (metis R1_R2s_R2c R1_R2s_post_SRD assms)\n\nlemma R2_cmt_conj_wait':\n  \"P is SRD \\<Longrightarrow> R2(cmt\\<^sub>R P \\<and> \\<not> $wait\\<acute>) = (cmt\\<^sub>R P \\<and> \\<not> $wait\\<acute>)\"\n  by (simp add: R2_def R2s_conj R2s_not R2s_wait' R1_extend_conj R1_R2s_cmt_SRD)\n\nlemma R2c_preR:\n  \"P is SRD \\<Longrightarrow> R2c(pre\\<^sub>R(P)) = pre\\<^sub>R(P)\"\n  by (metis (no_types, lifting) R1_R2c_commute R2c_idem SRD_reactive_design rea_pre_RHS_design)\n\nlemma preR_R2_closed [closure]: \n  assumes \"P is R2\"\n  shows \"pre\\<^sub>R P is R2\"\nproof -\n  have \"R2(pre\\<^sub>R(R2(P))) = pre\\<^sub>R(R2(P))\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n\nlemma periR_R2_closed [closure]: \n  assumes \"P is R2\"\n  shows \"peri\\<^sub>R P is R2\"\nproof -\n  have \"R2(peri\\<^sub>R(R2(P))) = peri\\<^sub>R(R2(P))\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n\nlemma postR_R2_closed [closure]: \n  assumes \"P is R2\"\n  shows \"post\\<^sub>R P is R2\"\nproof -\n  have \"R2(post\\<^sub>R(R2(P))) = post\\<^sub>R(R2(P))\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n\nlemma postR_SRD_R1 [closure]: \"P is SRD \\<Longrightarrow> post\\<^sub>R(P) is R1\"\n  by (simp add: Healthy_def' R1_post_SRD)\n\nlemma R2c_periR:\n  \"P is SRD \\<Longrightarrow> R2c(peri\\<^sub>R(P)) = peri\\<^sub>R(P)\"\n  by (metis (no_types, lifting) R1_R2c_commute R1_R2s_R2c R1_R2s_peri_SRD R2c_idem)\n\nlemma R2c_postR:\n  \"P is SRD \\<Longrightarrow> R2c(post\\<^sub>R(P)) = post\\<^sub>R(P)\"\n  by (metis (no_types, opaque_lifting) R1_R2c_commute R1_R2c_is_R2 R1_R2s_post_SRD R2_def R2s_idem)\n\nlemma periR_RR [closure]: \"P is R2 \\<Longrightarrow> peri\\<^sub>R(P) is RR\"\n  by (rule RR_intro, simp_all add: closure unrest)\n  \nlemma postR_RR [closure]: \"P is R2 \\<Longrightarrow> post\\<^sub>R(P) is RR\"\n  by (rule RR_intro, simp_all add: closure unrest)\n\nlemma wpR_trace_ident_pre [wp]:\n  \"($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R) wp\\<^sub>r pre\\<^sub>R P = pre\\<^sub>R P\"\n  by (rel_auto)\n    \nlemma R1_preR [closure]:\n  \"pre\\<^sub>R(P) is R1\"\n  by (rel_auto)\n\nlemma trace_ident_left_periR:\n  \"($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R) ;; peri\\<^sub>R(P) = peri\\<^sub>R(P)\"\n  by (rel_auto)\n\nlemma trace_ident_left_postR:\n  \"($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R) ;; post\\<^sub>R(P) = post\\<^sub>R(P)\"\n  by (rel_auto)\n\nlemma trace_ident_right_postR:\n  \"post\\<^sub>R(P) ;; ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R) = post\\<^sub>R(P)\"\n  by (rel_auto)\n*)\n\nsubsubsection \\<open> Calculation laws \\<close>\n\nlemma wait'_cond_peri_post_cmt [rdes]:\n  \"cmt\\<^sub>R P = peri\\<^sub>R P \\<diamondop> post\\<^sub>R P\"\n  by pred_auto\n     (metis (full_types))\n\n(* TODO: fix proof\nlemma preR_rdes [rdes]: \n  assumes \"P is RR\"\n  shows \"pre\\<^sub>R(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = P\"\n  by (simp add: rea_pre_RH_design unrest usubst assms Healthy_if RR_implies_R2c RR_implies_R1)\n\nlemma preR_srdes [rdes]: \n  assumes \"P is RR\"\n  shows \"pre\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = P\"\n  by (simp add: rea_pre_RHS_design unrest usubst assms Healthy_if RR_implies_R2c RR_implies_R1)\n*)\n\nlemma periR_rdes [rdes]: \n  assumes \"P is RR\" \"Q is RR\"\n  shows \"peri\\<^sub>R(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = (P \\<longrightarrow>\\<^sub>r Q)\"\n  by (simp add: rea_peri_RH_design unrest usubst assms Healthy_if RR_implies_R2c closure)\n\nlemma periR_srdes [rdes]: \n  assumes \"P is RR\" \"Q is RR\"\n  shows \"peri\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = (P \\<longrightarrow>\\<^sub>r Q)\"\n  by (simp add: rea_peri_RHS_design unrest usubst assms Healthy_if RR_implies_R2c closure)\n\n(* TODO: fix proof\nlemma postR_rdes [rdes]: \n  assumes \"P is RR\" \"R is RR\"\n  shows \"post\\<^sub>R(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = (P \\<longrightarrow>\\<^sub>r R)\"\n  by (simp add: rea_post_RH_design unrest usubst assms Healthy_if RR_implies_R2c closure)\n\nlemma postR_srdes [rdes]: \n  assumes \"P is RR\" \"R is RR\"\n  shows \"post\\<^sub>R(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = (P \\<longrightarrow>\\<^sub>r R)\"\n  by (simp add: rea_post_RHS_design unrest usubst assms Healthy_if RR_implies_R2c closure)\n    \nlemma preR_Chaos [rdes]: \"pre\\<^sub>R(Chaos) = false\"\n  by (simp add: Chaos_def, rel_simp)\n\nlemma periR_Chaos [rdes]: \"peri\\<^sub>R(Chaos) = true\\<^sub>r\"\n  by (simp add: Chaos_def, rel_simp)\n\nlemma postR_Chaos [rdes]: \"post\\<^sub>R(Chaos) = true\\<^sub>r\"\n  by (simp add: Chaos_def, rel_simp)\n\nlemma preR_Miracle [rdes]: \"pre\\<^sub>R(Miracle) = true\\<^sub>r\"\n  by (simp add: Miracle_def, rel_auto)\n\nlemma periR_Miracle [rdes]: \"peri\\<^sub>R(Miracle) = false\"\n  by (simp add: Miracle_def, rel_auto)\n\nlemma postR_Miracle [rdes]: \"post\\<^sub>R(Miracle) = false\"\n  by (simp add: Miracle_def, rel_auto)\n*)\n\nlemma preR_srdes_skip [rdes]: \"pre\\<^sub>R(II\\<^sub>R) = true\\<^sub>r\"\n  by pred_auto\n\nlemma periR_srdes_skip [rdes]: \"peri\\<^sub>R(II\\<^sub>R) = false\"\n  by pred_auto\n\nlemma postR_srdes_skip [rdes]: \"post\\<^sub>R(II\\<^sub>R) = ((tr\\<^sup>> = tr\\<^sup><)\\<^sub>e \\<and> \\<lceil>II\\<rceil>\\<^sub>R)\"\n  by pred_auto\n\n(*\nlemma preR_INF [rdes]: \"A \\<noteq> {} \\<Longrightarrow> pre\\<^sub>R(\\<Sqinter> A) = (\\<And> P\\<in>A. pre\\<^sub>R(P))\"\n  by (rel_auto)\n\nlemma periR_INF [rdes]: \"peri\\<^sub>R(\\<Sqinter> A) = (\\<Or> P\\<in>A. peri\\<^sub>R(P))\"\n  by (rel_auto)\n\nlemma postR_INF [rdes]: \"post\\<^sub>R(\\<Sqinter> A) = (\\<Or> P\\<in>A \\<bullet> post\\<^sub>R(P))\"\n  by (rel_auto)\n*)\n\nlemma preR_UINF [rdes]: \"pre\\<^sub>R(\\<Sqinter> i. P(i)) = (\\<Squnion> i. pre\\<^sub>R(P(i)))\"\n  by pred_auto\n\nlemma periR_UINF [rdes]: \"peri\\<^sub>R(\\<Sqinter> i. P(i)) = (\\<Sqinter> i. peri\\<^sub>R(P(i)))\"\n  by pred_auto\n\nlemma postR_UINF [rdes]: \"post\\<^sub>R(\\<Sqinter> i. P(i)) = (\\<Sqinter> i. post\\<^sub>R(P(i)))\"\n  by pred_auto\n\nlemma preR_UINF_member [rdes]: \"A \\<noteq> {} \\<Longrightarrow> pre\\<^sub>R(\\<Sqinter> i\\<in>A. P(i)) = (\\<Squnion> i\\<in>A. pre\\<^sub>R(P(i)))\"\n  by pred_auto\n    \nlemma preR_UINF_member_2 [rdes]: \"A \\<noteq> {} \\<Longrightarrow> pre\\<^sub>R(\\<Sqinter> (i,j)\\<in>A. P i j) = (\\<Squnion> (i,j)\\<in>A. pre\\<^sub>R(P i j))\"\n  by pred_auto\n\nlemma preR_UINF_member_3 [rdes]: \"A \\<noteq> {} \\<Longrightarrow> pre\\<^sub>R(\\<Sqinter> (i,j,k)\\<in>A. P i j k) = (\\<Squnion> (i,j,k)\\<in>A. pre\\<^sub>R(P i j k))\"\n  by pred_auto\n\nlemma periR_UINF_member [rdes]: \"peri\\<^sub>R(\\<Sqinter> i\\<in>A. P(i)) = (\\<Sqinter> i\\<in>A. peri\\<^sub>R(P(i)))\"\n  by pred_auto\n\n(* TODO: fix these lemmata\nlemma periR_UINF_member_2 [rdes]: \"peri\\<^sub>R(\\<Sqinter> (i,j)\\<in>A. P i j) = (\\<Sqinter> (i,j)\\<in>A. peri\\<^sub>R(P i j))\"\n  oops\n\nlemma periR_UINF_member_3 [rdes]: \"peri\\<^sub>R(\\<Sqinter> (i,j,k)\\<in>A \\<bullet> P i j k) = (\\<Sqinter> (i,j,k)\\<in>A \\<bullet> peri\\<^sub>R(P i j k))\"\n  by (rel_auto)\n*)\n\nlemma postR_UINF_member [rdes]: \"post\\<^sub>R(\\<Sqinter> i\\<in>A. P(i)) = (\\<Sqinter> i\\<in>A. post\\<^sub>R(P(i)))\"\n  by pred_auto\n\n(* TODO: fix these lemmata\nlemma postR_UINF_member_2 [rdes]: \"post\\<^sub>R(\\<Sqinter> (i,j)\\<in>A \\<bullet> P i j) = (\\<Sqinter> (i,j)\\<in>A \\<bullet> post\\<^sub>R(P i j))\"\n  by (rel_auto)\n    \nlemma postR_UINF_member_3 [rdes]: \"post\\<^sub>R(\\<Sqinter> (i,j,k)\\<in>A \\<bullet> P i j k) = (\\<Sqinter> (i,j,k)\\<in>A \\<bullet> post\\<^sub>R(P i j k))\"\n  by (rel_auto)    \n*)\n\nlemma preR_inf [rdes]: \"pre\\<^sub>R(P \\<sqinter> Q) = (pre\\<^sub>R(P) \\<and> pre\\<^sub>R(Q))\"\n  by pred_auto\n\nlemma periR_inf [rdes]: \"peri\\<^sub>R(P \\<sqinter> Q) = (peri\\<^sub>R(P) \\<or> peri\\<^sub>R(Q))\"\n  by pred_auto\n\nlemma postR_inf [rdes]: \"post\\<^sub>R(P \\<sqinter> Q) = (post\\<^sub>R(P) \\<or> post\\<^sub>R(Q))\"\n  by pred_auto\n\n(*\nlemma preR_SUP [rdes]: \"pre\\<^sub>R(\\<Squnion> A) = (\\<Or> P\\<in>A. pre\\<^sub>R(P))\"\n  by (rel_auto)\n\nlemma periR_SUP [rdes]: \"A \\<noteq> {} \\<Longrightarrow> peri\\<^sub>R(\\<Squnion> A) = (\\<And> P\\<in>A \\<bullet> peri\\<^sub>R(P))\"\n  by (rel_auto)\n\nlemma postR_SUP [rdes]: \"A \\<noteq> {} \\<Longrightarrow> post\\<^sub>R(\\<Squnion> A) = (\\<And> P\\<in>A \\<bullet> post\\<^sub>R(P))\"\n  by (rel_auto)\n*)\n\nsubsection \\<open> Formation laws \\<close>\n\nsubsubsection \\<open> Regular \\<close>\n\n(* TODO: this proof really should be working \nlemma rdes_skip_tri_design [rdes_def]: \"II\\<^sub>C = \\<^bold>R(true\\<^sub>r \\<turnstile> false \\<diamondop> II\\<^sub>r)\"\n  apply (simp add: skip_rea_def, pred_auto)\n  using minus_zero_eq apply blast+\n  done\n*)\n\n(* TODO: this proof really should be working \nlemma RH_tri_design_form:\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = (II\\<^sub>C \\<triangleleft> wait\\<^sup>< \\<triangleright> ((ok\\<^sup>< \\<and> P\\<^sub>1) \\<longrightarrow>\\<^sub>r (ok\\<^sup>> \\<and> (P\\<^sub>2 \\<diamondop> P\\<^sub>3))))\"\nproof -\n  have \"\\<^bold>R(RR(P\\<^sub>1) \\<turnstile> RR(P\\<^sub>2) \\<diamondop> RR(P\\<^sub>3)) = (II\\<^sub>C \\<triangleleft> wait\\<^sup>< \\<triangleright> ((ok\\<^sup>< \\<and> RR(P\\<^sub>1)) \\<longrightarrow>\\<^sub>r (ok\\<^sup>> \\<and> (RR(P\\<^sub>2) \\<diamondop> RR(P\\<^sub>3)))))\"\n    apply (pred_auto)\n    using minus_zero_eq by blast\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n*)\n\nlemma RH_design_pre_post_form:\n  \"\\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f) = \\<^bold>R(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\nproof -\n  have \"\\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f) = \\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f)\\<lbrakk>True/ok\\<^sup><\\<rbrakk> \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>True/ok\\<^sup><\\<rbrakk>)\"\n    by (simp add: design_subst_ok)\n  also have \"... = \\<^bold>R(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n    by (simp add: pre\\<^sub>R_def cmt\\<^sub>R_def usubst, pred_auto)\n  finally show ?thesis .\nqed\n\nlemma RD_as_reactive_design:\n  \"RD(P) = \\<^bold>R(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n  by (simp add: RH_design_pre_post_form RD_RH_design_form)\n\nlemma RD_reactive_design_alt:\n  assumes \"P is RD\"\n  shows \"\\<^bold>R(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) = P\"\nproof -\n  have \"\\<^bold>R(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) = \\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f)\"\n    by (simp add: RH_design_pre_post_form)\n  thus ?thesis\n    by (simp add: RD_reactive_design assms)\nqed\n\nlemma RD_reactive_tri_design_lemma:\n  \"RD(P) = \\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>True/wait\\<^sup>>\\<rbrakk> \\<diamondop> P\\<^sup>t\\<^sub>f\\<lbrakk>False/wait\\<^sup>>\\<rbrakk>)\"\n  apply (simp add: RD_RH_design_form wait'_cond_split)\n  oops\n\n(*\nlemma RD_as_reactive_tri_design:\n  \"RD(P) = \\<^bold>R(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P))\"\nproof -\n  have \"RD(P) = \\<^bold>R((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>True/wait\\<^sup>>\\<rbrakk> \\<diamondop> P\\<^sup>t\\<^sub>f\\<lbrakk>False/wait\\<^sup>>\\<rbrakk>)\"\n    by (simp add: RD_RH_design_form wait'_cond_split)\n  also have \"... = \\<^bold>R(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P))\"\n    by pred_auto\n  finally show ?thesis .\nqed\n\nlemma RD_reactive_tri_design:\n  assumes \"P is RD\"\n  shows \"\\<^bold>R(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) = P\"\n  by (metis Healthy_if RD_as_reactive_tri_design assms)\n    \nlemma RD_elimination [RD_elim]: \"\\<lbrakk> P is RD; Q(\\<^bold>R(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)))  \\<rbrakk> \\<Longrightarrow> Q(P)\"\n  by (simp add: RD_reactive_tri_design)\n*)\n\n(*\nlemma RH_tri_design_is_RD [closure]:\n  assumes \"$ok\\<^sup>> \\<sharp> P\" \"$ok\\<^sup>> \\<sharp> Q\" \"$ok\\<^sup>> \\<sharp> R\"\n  shows \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R) is RD\"\n  by (rule RH_design_is_RD, simp_all add: unrest assms)\n\nlemma RD_rdes_intro [closure]:\n  assumes \"P is RR\" \"Q is RR\" \"R is RR\"\n  shows \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R) is RD\"\n  by (rule RH_tri_design_is_RD, simp_all add: unrest closure assms)\n*)\n\nsubsubsection \\<open> Stateful \\<close>\n\n(* TODO: figure out why this isn't working *)\nlemma srdes_skip_tri_design [rdes_def]: \"II\\<^sub>R = \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> false \\<diamondop> II\\<^sub>r)\"\n  apply (simp add: srdes_skip_def, pred_auto)\n  oops\n\n(*\nlemma Chaos_tri_def [rdes_def]: \"Chaos = \\<^bold>R\\<^sub>s(false \\<turnstile> false \\<diamondop> false)\"\n  by (simp add: Chaos_def design_false_pre)\n\nlemma Miracle_tri_def [rdes_def]: \"Miracle = \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> false \\<diamondop> false)\"\n  by (simp add: Miracle_def R1_design_R1_pre wait'_cond_idem)\n\nlemma RHS_tri_design_form:\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = (II\\<^sub>R \\<triangleleft> $wait \\<triangleright> (($ok \\<and> P\\<^sub>1) \\<Rightarrow>\\<^sub>r ($ok\\<acute> \\<and> (P\\<^sub>2 \\<diamondop> P\\<^sub>3))))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(RR(P\\<^sub>1) \\<turnstile> RR(P\\<^sub>2) \\<diamondop> RR(P\\<^sub>3)) = (II\\<^sub>R \\<triangleleft> $wait \\<triangleright> (($ok \\<and> RR(P\\<^sub>1)) \\<Rightarrow>\\<^sub>r ($ok\\<acute> \\<and> (RR(P\\<^sub>2) \\<diamondop> RR(P\\<^sub>3)))))\"\n    apply (rel_auto) using minus_zero_eq by blast\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma RHS_design_pre_post_form:\n  \"\\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f) = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f) = \\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f)\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>true/$ok\\<rbrakk>)\"\n    by (simp add: design_subst_ok)\n  also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n    by (simp add: pre\\<^sub>R_def cmt\\<^sub>R_def usubst, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma SRD_as_reactive_design:\n  \"SRD(P) = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n  by (simp add: RHS_design_pre_post_form SRD_RH_design_form)\n\nlemma SRD_reactive_design_alt:\n  assumes \"P is SRD\"\n  shows \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) = P\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) = \\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f)\"\n    by (simp add: RHS_design_pre_post_form)\n  thus ?thesis\n    by (simp add: SRD_reactive_design assms)\nqed\n\nlemma SRD_reactive_tri_design_lemma:\n  \"SRD(P) = \\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<diamondop> P\\<^sup>t\\<^sub>f\\<lbrakk>false/$wait\\<acute>\\<rbrakk>)\"\n  by (simp add: SRD_RH_design_form wait'_cond_split)\n\nlemma SRD_as_reactive_tri_design:\n  \"SRD(P) = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P))\"\nproof -\n  have \"SRD(P) = \\<^bold>R\\<^sub>s((\\<not> P\\<^sup>f\\<^sub>f) \\<turnstile> P\\<^sup>t\\<^sub>f\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<diamondop> P\\<^sup>t\\<^sub>f\\<lbrakk>false/$wait\\<acute>\\<rbrakk>)\"\n    by (simp add: SRD_RH_design_form wait'_cond_split)\n  also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P))\"\n    apply (simp add: usubst)\n    apply (subst design_subst_ok_ok'[THEN sym])\n    apply (simp add: pre\\<^sub>R_def peri\\<^sub>R_def post\\<^sub>R_def usubst unrest)\n    apply (rel_auto)\n  done\n  finally show ?thesis .\nqed\n\nlemma SRD_reactive_tri_design:\n  assumes \"P is SRD\"\n  shows \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) = P\"\n  by (metis Healthy_if SRD_as_reactive_tri_design assms)\n    \nlemma SRD_elim [RD_elim]: \"\\<lbrakk> P is SRD; Q(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)))  \\<rbrakk> \\<Longrightarrow> Q(P)\"\n  by (simp add: SRD_reactive_tri_design)\n    \nlemma RHS_tri_design_is_SRD [closure]:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\" \"$ok\\<acute> \\<sharp> R\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) is SRD\"\n  by (rule RHS_design_is_SRD, simp_all add: unrest assms)\n\nlemma SRD_rdes_intro [closure]:\n  assumes \"P is RR\" \"Q is RR\" \"R is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) is SRD\"\n  by (rule RHS_tri_design_is_SRD, simp_all add: unrest closure assms)\n        \nlemma USUP_R1_R2s_cmt_SRD:\n  assumes \"A \\<subseteq> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"(\\<Squnion> P \\<in> A \\<bullet> R1 (R2s (cmt\\<^sub>R P))) = (\\<Squnion> P \\<in> A \\<bullet> cmt\\<^sub>R P)\"\n  by (rule USUP_cong[of A], metis (mono_tags, lifting) Ball_Collect R1_R2s_cmt_SRD assms)\n\nlemma UINF_R1_R2s_cmt_SRD:\n  assumes \"A \\<subseteq> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"(\\<Sqinter> P \\<in> A \\<bullet> R1 (R2s (cmt\\<^sub>R P))) = (\\<Sqinter> P \\<in> A \\<bullet> cmt\\<^sub>R P)\"\n  by (rule UINF_cong[of A], metis (mono_tags, lifting) Ball_Collect R1_R2s_cmt_SRD assms)\n*)\n\nsubsubsection \\<open> Order laws \\<close>\n\nlemma preR_antitone: \"P \\<sqsubseteq> Q \\<Longrightarrow> pre\\<^sub>R(Q) \\<sqsubseteq> pre\\<^sub>R(P)\"\n  by pred_auto\n\nlemma periR_monotone: \"P \\<sqsubseteq> Q \\<Longrightarrow> peri\\<^sub>R(P) \\<sqsubseteq> peri\\<^sub>R(Q)\"\n  by pred_auto\n\nlemma postR_monotone: \"P \\<sqsubseteq> Q \\<Longrightarrow> post\\<^sub>R(P) \\<sqsubseteq> post\\<^sub>R(Q)\"\n  by pred_auto\n\nsubsection \\<open> Composition laws \\<close>\n\n(*\ntheorem R1_design_composition_RR:\n  assumes \"P is RR\" \"Q is RR\" \"R is RR\" \"S is RR\"\n  shows\n  \"(R1(P \\<turnstile> Q) ;; R1(R \\<turnstile> S)) = R1(((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<and> Q wp\\<^sub>r R) \\<turnstile> (Q ;; S))\"\n  apply (subst R1_design_composition)\n  apply (simp_all add: assms unrest wp_rea_def Healthy_if closure)\n  apply (rel_auto)\ndone\n\ntheorem R1_design_composition_RC:\n  assumes \"P is RC\" \"Q is RR\" \"R is RR\" \"S is RR\"\n  shows\n  \"(R1(P \\<turnstile> Q) ;; R1(R \\<turnstile> S)) = R1((P \\<and> Q wp\\<^sub>r R) \\<turnstile> (Q ;; S))\"\n  by (simp add: R1_design_composition_RR assms unrest Healthy_if closure wp)\n\nsubsubsection \\<open> Regular \\<close>\n\ntheorem RH_tri_design_composition:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n          \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n  shows \"(\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)) =\n       \\<^bold>R((\\<not> (R1 (\\<not> R2s P) ;; R1 true) \\<and> \\<not> (R1(R2s Q\\<^sub>2) ;; R1 (\\<not> R2s R))) \\<turnstile>\n                       ((Q\\<^sub>1 \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))))\"\nproof -\n  have 1:\"(\\<not> ((R1 (R2s (Q\\<^sub>1 \\<diamondop> Q\\<^sub>2)) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R))) =\n        (\\<not> ((R1 (R2s Q\\<^sub>2) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R)))\"\n    by (metis (no_types, opaque_lifting) R1_extend_conj R2s_conj R2s_not R2s_wait' wait'_cond_false)\n  have 2: \"(R1 (R2s (Q\\<^sub>1 \\<diamondop> Q\\<^sub>2)) ;; (\\<lceil>II\\<rceil>\\<^sub>D \\<triangleleft> $wait \\<triangleright> R1 (R2s (S\\<^sub>1 \\<diamondop> S\\<^sub>2)))) =\n                 (((R1 (R2s Q\\<^sub>1)) \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n  proof -\n    have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n                       = (((R1 (R2s Q\\<^sub>1)) \\<and> $wait\\<acute>))\"\n    proof -\n      have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> ((\\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n           = (R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> (\\<lceil>II\\<rceil>\\<^sub>D)))\"\n        by (rel_auto)\n      also have \"... = ((R1 (R2s Q\\<^sub>1) ;; \\<lceil>II\\<rceil>\\<^sub>D) \\<and> $wait\\<acute>)\"\n        by (rel_auto)\n      also from assms(2) have \"... = ((R1 (R2s Q\\<^sub>1)) \\<and> $wait\\<acute>)\"\n        by (rel_auto, blast)\n      finally show ?thesis .\n    qed\n\n    moreover have \"(R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> ((\\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n                  = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2)))\"\n    proof -\n      have \"(R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n            = (R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\"\n        by (metis (no_types, lifting) cond_def conj_disj_not_abs utp_pred_laws.double_compl utp_pred_laws.inf.left_idem utp_pred_laws.sup_assoc utp_pred_laws.sup_inf_absorb)\n\n      also have \"... = ((R1 (R2s Q\\<^sub>2))\\<lbrakk>false/$wait\\<acute>\\<rbrakk> ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))\\<lbrakk>false/$wait\\<rbrakk>)\"\n        by (metis false_alt_def seqr_right_one_point upred_eq_false wait_vwb_lens)\n\n      also have \"... = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2)))\"\n        by (simp add: wait'_cond_def usubst unrest assms)\n\n      finally show ?thesis .\n    qed\n\n    moreover\n    have \"((R1 (R2s Q\\<^sub>1) \\<and> $wait\\<acute>) \\<or> ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n          = (R1 (R2s Q\\<^sub>1) \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n      by (simp add: wait'_cond_def cond_seq_right_distr cond_and_T_integrate unrest)\n\n    ultimately show ?thesis\n      by (simp add: R2s_wait'_cond R1_wait'_cond wait'_cond_seq ex_conj_contr_right unrest)  \n  qed\n\n  from assms(7,8) have 3: \"(R1 (R2s Q\\<^sub>2) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R) = R1 (R2s Q\\<^sub>2) ;; R1 (\\<not> R2s R)\"\n    by (rel_auto, meson)\n\n  show ?thesis\n    by (simp add: RH_design_composition unrest assms 1 2 3, simp add: R1_R2s_R2c RH_design_lemma1)\nqed\n\ntheorem RH_tri_design_composition_wp:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n          \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n          \"P is R2c\" \"Q\\<^sub>1 is R1\" \"Q\\<^sub>1 is R2c\" \"Q\\<^sub>2 is R1\" \"Q\\<^sub>2 is R2c\"\n          \"R is R2c\" \"S\\<^sub>1 is R1\" \"S\\<^sub>1 is R2c\" \"S\\<^sub>2 is R1\" \"S\\<^sub>2 is R2c\"\n  shows \"\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n          \\<^bold>R(((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> ((Q\\<^sub>1 \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2)))\" (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs = \\<^bold>R ((\\<not> R1 (\\<not> P) ;; R1 true \\<and> \\<not> Q\\<^sub>2 ;; R1 (\\<not> R)) \\<turnstile> (Q\\<^sub>1 \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp add: RH_tri_design_composition assms Healthy_if R2c_healthy_R2s disj_upred_def)\n       (metis (no_types, opaque_lifting) R1_negate_R1 R2c_healthy_R2s assms(11,16))\n  also have \"... = ?rhs\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\ntheorem RH_tri_design_composition_RR_wp:\n  assumes \"P is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\"\n          \"R is RR\" \"S\\<^sub>1 is RR\" \"S\\<^sub>2 is RR\"\n  shows \"\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n          \\<^bold>R(((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> ((Q\\<^sub>1 \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2)))\" (is \"?lhs = ?rhs\")\n  by (simp add: RH_tri_design_composition_wp add: closure assms unrest RR_implies_R2c)\n\nlemma RH_tri_normal_design_composition:\n  assumes\n    \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n    \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n    \"P is R2c\" \"Q\\<^sub>1 is R1\" \"Q\\<^sub>1 is R2c\" \"Q\\<^sub>2 is R1\" \"Q\\<^sub>2 is R2c\"\n    \"R is R2c\" \"S\\<^sub>1 is R1\" \"S\\<^sub>1 is R2c\" \"S\\<^sub>2 is R1\" \"S\\<^sub>2 is R2c\"\n    \"R1 (\\<not> P) ;; R1(true) = R1(\\<not> P)\"\n  shows \"\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\n         = \\<^bold>R((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\nproof -\n  have \"\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n        \\<^bold>R((R1 (\\<not> P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp_all add: RH_tri_design_composition_wp rea_not_def assms unrest)\n  also have \"... = \\<^bold>R((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp add: assms wp_rea_def ex_unrest, rel_auto)\n  finally show ?thesis .\nqed\n  \nlemma RH_tri_normal_design_composition' [rdes_def]:\n  assumes \"P is RC\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"R is RR\" \"S\\<^sub>1 is RR\" \"S\\<^sub>2 is RR\"\n  shows \"\\<^bold>R(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\n         = \\<^bold>R((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\nproof -\n  have \"R1 (\\<not> P) ;; R1 true = R1(\\<not> P)\"\n    using RC_implies_RC1[OF assms(1)]\n    by (simp add: Healthy_def RC1_def rea_not_def)\n       (metis R1_negate_R1 R1_seqr utp_pred_laws.double_compl)\n  thus ?thesis\n    by (simp add: RH_tri_normal_design_composition assms closure unrest RR_implies_R2c)\nqed\n\nlemma RH_tri_design_right_unit_lemma:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\" \"$ok\\<acute> \\<sharp> R\" \"$wait\\<acute> \\<sharp> R\"\n  shows \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R) ;; II\\<^sub>C = \\<^bold>R((\\<not>\\<^sub>r (\\<not>\\<^sub>r P) ;; true\\<^sub>r) \\<turnstile> (Q \\<diamondop> R))\"\nproof -\n  have \"\\<^bold>R(P \\<turnstile> Q \\<diamondop> R) ;; II\\<^sub>C = \\<^bold>R(P \\<turnstile> Q \\<diamondop> R) ;; \\<^bold>R(true \\<turnstile> false \\<diamondop> ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))\"\n    by (simp add: rdes_skip_tri_design, rel_auto)\n  also have \"... = \\<^bold>R ((\\<not> R1 (\\<not> R2s P) ;; R1 true) \\<turnstile> Q \\<diamondop> (R1 (R2s R) ;; R1 (R2s ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))))\"\n    by (simp_all add: RH_tri_design_composition assms unrest R2s_true R1_false R2s_false)\n  also have \"... = \\<^bold>R ((\\<not> R1 (\\<not> R2s P) ;; R1 true) \\<turnstile> Q \\<diamondop> R1 (R2s R))\"\n  proof -\n    from assms(3,4) have \"(R1 (R2s R) ;; R1 (R2s ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))) = R1 (R2s R)\"\n      by (rel_auto, metis (no_types, lifting) minus_zero_eq, meson order_refl trace_class.diff_cancel)\n    thus ?thesis\n      by simp\n  qed\n  also have \"... = \\<^bold>R((\\<not> (\\<not> P) ;; R1 true) \\<turnstile> (Q \\<diamondop> R))\"\n    by (metis (no_types, lifting) R1_R2s_R1_true_lemma R1_R2s_R2c R2c_not RH_design_R2c_pre RH_design_neg_R1_pre RH_design_post_R1 RH_design_post_R2s)\n  also have \"... = \\<^bold>R((\\<not>\\<^sub>r (\\<not>\\<^sub>r P) ;; true\\<^sub>r) \\<turnstile> Q \\<diamondop> R)\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nsubsubsection \\<open> Stateful \\<close>\n\ntheorem RHS_tri_design_composition:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n          \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n  shows \"(\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)) =\n       \\<^bold>R\\<^sub>s((\\<not> (R1 (\\<not> R2s P) ;; R1 true) \\<and> \\<not> (R1(R2s Q\\<^sub>2) ;; R1 (\\<not> R2s R))) \\<turnstile>\n                       (((\\<exists> $st\\<acute> \\<bullet> Q\\<^sub>1) \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))))\"\nproof -\n  have 1:\"(\\<not> ((R1 (R2s (Q\\<^sub>1 \\<diamondop> Q\\<^sub>2)) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R))) =\n        (\\<not> ((R1 (R2s Q\\<^sub>2) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R)))\"\n    by (metis (no_types, opaque_lifting) R1_extend_conj R2s_conj R2s_not R2s_wait' wait'_cond_false)\n  have 2: \"(R1 (R2s (Q\\<^sub>1 \\<diamondop> Q\\<^sub>2)) ;; ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s (S\\<^sub>1 \\<diamondop> S\\<^sub>2)))) =\n                 (((\\<exists> $st\\<acute> \\<bullet> R1 (R2s Q\\<^sub>1)) \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n  proof -\n    have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n                       = (\\<exists> $st\\<acute> \\<bullet> ((R1 (R2s Q\\<^sub>1)) \\<and> $wait\\<acute>))\"\n    proof -\n      have \"(R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n           = (R1 (R2s Q\\<^sub>1) ;; ($wait \\<and> (\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D)))\"\n        by (rel_auto, blast+)\n      also have \"... = ((R1 (R2s Q\\<^sub>1) ;; (\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D)) \\<and> $wait\\<acute>)\"\n        by (rel_auto)\n      also from assms(2) have \"... = (\\<exists> $st\\<acute> \\<bullet> ((R1 (R2s Q\\<^sub>1)) \\<and> $wait\\<acute>))\"\n        by (rel_auto, blast)\n      finally show ?thesis .\n    qed\n\n    moreover have \"(R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n                  = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2)))\"\n    proof -\n      have \"(R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n            = (R1 (R2s Q\\<^sub>2) ;; (\\<not> $wait \\<and> (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\"\n        by (metis (no_types, lifting) cond_def conj_disj_not_abs utp_pred_laws.double_compl utp_pred_laws.inf.left_idem utp_pred_laws.sup_assoc utp_pred_laws.sup_inf_absorb)\n\n      also have \"... = ((R1 (R2s Q\\<^sub>2))\\<lbrakk>false/$wait\\<acute>\\<rbrakk> ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))\\<lbrakk>false/$wait\\<rbrakk>)\"\n        by (metis false_alt_def seqr_right_one_point upred_eq_false wait_vwb_lens)\n\n      also have \"... = ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2)))\"\n        by (simp add: wait'_cond_def usubst unrest assms)\n\n      finally show ?thesis .\n    qed\n\n    moreover\n    have \"((R1 (R2s Q\\<^sub>1) \\<and> $wait\\<acute>) \\<or> ((R1 (R2s Q\\<^sub>2)) ;; (R1 (R2s S\\<^sub>1) \\<diamondop> R1 (R2s S\\<^sub>2))))\n          = (R1 (R2s Q\\<^sub>1) \\<or> (R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>1))) \\<diamondop> ((R1 (R2s Q\\<^sub>2) ;; R1 (R2s S\\<^sub>2)))\"\n      by (simp add: wait'_cond_def cond_seq_right_distr cond_and_T_integrate unrest)\n\n    ultimately show ?thesis\n      by (simp add: R2s_wait'_cond R1_wait'_cond wait'_cond_seq ex_conj_contr_right unrest)\n         (simp add: cond_and_T_integrate cond_seq_right_distr unrest_var wait'_cond_def)\n  qed\n\n  from assms(7,8) have 3: \"(R1 (R2s Q\\<^sub>2) \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s R) = R1 (R2s Q\\<^sub>2) ;; R1 (\\<not> R2s R)\"\n    by (rel_auto, blast, meson)\n\n  show ?thesis\n    apply (subst RHS_design_composition)\n    apply (simp_all add: assms)\n    apply (simp add: assms wait'_cond_def unrest)\n    apply (simp add: assms wait'_cond_def unrest)\n    apply (simp add: 1 2 3)\n    apply (simp add: R1_R2s_R2c RHS_design_lemma1)\n    apply (metis R1_R2c_ex_st RHS_design_lemma1)\n  done\nqed\n \ntheorem RHS_tri_design_composition_wp:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n          \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n          \"P is R2c\" \"Q\\<^sub>1 is R1\" \"Q\\<^sub>1 is R2c\" \"Q\\<^sub>2 is R1\" \"Q\\<^sub>2 is R2c\"\n          \"R is R2c\" \"S\\<^sub>1 is R1\" \"S\\<^sub>1 is R2c\" \"S\\<^sub>2 is R1\" \"S\\<^sub>2 is R2c\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n          \\<^bold>R\\<^sub>s(((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (((\\<exists> $st\\<acute> \\<bullet> Q\\<^sub>1) \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2)))\" (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs = \\<^bold>R\\<^sub>s ((\\<not> R1 (\\<not> P) ;; R1 true \\<and> \\<not> Q\\<^sub>2 ;; R1 (\\<not> R)) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q\\<^sub>1) \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp add: RHS_tri_design_composition assms Healthy_if R2c_healthy_R2s disj_upred_def)\n       (metis (no_types, opaque_lifting) R1_negate_R1 R2c_healthy_R2s assms(11,16))\n  also have \"... = ?rhs\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\ntheorem RHS_tri_design_composition_RR_wp:\n  assumes \"P is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\"\n          \"R is RR\" \"S\\<^sub>1 is RR\" \"S\\<^sub>2 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n          \\<^bold>R\\<^sub>s(((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (((\\<exists> $st\\<acute> \\<bullet> Q\\<^sub>1) \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2)))\" (is \"?lhs = ?rhs\")\n  by (simp add: RHS_tri_design_composition_wp add: closure assms unrest RR_implies_R2c)\n\nlemma RHS_tri_normal_design_composition:\n  assumes\n    \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>2\" \"$ok \\<sharp> R\" \"$ok \\<sharp> S\\<^sub>1\" \"$ok \\<sharp> S\\<^sub>2\"\n    \"$wait \\<sharp> R\" \"$wait\\<acute> \\<sharp> Q\\<^sub>2\" \"$wait \\<sharp> S\\<^sub>1\" \"$wait \\<sharp> S\\<^sub>2\"\n    \"P is R2c\" \"Q\\<^sub>1 is R1\" \"Q\\<^sub>1 is R2c\" \"Q\\<^sub>2 is R1\" \"Q\\<^sub>2 is R2c\"\n    \"R is R2c\" \"S\\<^sub>1 is R1\" \"S\\<^sub>1 is R2c\" \"S\\<^sub>2 is R1\" \"S\\<^sub>2 is R2c\"\n    \"R1 (\\<not> P) ;; R1(true) = R1(\\<not> P)\" \"$st\\<acute> \\<sharp> Q\\<^sub>1\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\n         = \\<^bold>R\\<^sub>s((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n        \\<^bold>R\\<^sub>s ((R1 (\\<not> P) wp\\<^sub>r false \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q\\<^sub>1) \\<sqinter> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp_all add: RHS_tri_design_composition_wp rea_not_def assms unrest)\n  also have \"... = \\<^bold>R\\<^sub>s((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\n    by (simp add: assms wp_rea_def ex_unrest, rel_auto)\n  finally show ?thesis .\nqed\n  \nlemma RHS_tri_normal_design_composition' [rdes_def]:\n  assumes \"P is RC\" \"Q\\<^sub>1 is RR\" \"$st\\<acute> \\<sharp> Q\\<^sub>1\" \"Q\\<^sub>2 is RR\" \"R is RR\" \"S\\<^sub>1 is RR\" \"S\\<^sub>2 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) ;; \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\n         = \\<^bold>R\\<^sub>s((P \\<and> Q\\<^sub>2 wp\\<^sub>r R) \\<turnstile> (Q\\<^sub>1 \\<or> (Q\\<^sub>2 ;; S\\<^sub>1)) \\<diamondop> (Q\\<^sub>2 ;; S\\<^sub>2))\"\nproof -\n  have \"R1 (\\<not> P) ;; R1 true = R1(\\<not> P)\"\n    using RC_implies_RC1[OF assms(1)]\n    by (simp add: Healthy_def RC1_def rea_not_def)\n       (metis R1_negate_R1 R1_seqr utp_pred_laws.double_compl)\n  thus ?thesis\n    by (simp add: RHS_tri_normal_design_composition assms closure unrest RR_implies_R2c)\nqed\n\nlemma RHS_tri_design_right_unit_lemma:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\" \"$ok\\<acute> \\<sharp> R\" \"$wait\\<acute> \\<sharp> R\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) ;; II\\<^sub>R = \\<^bold>R\\<^sub>s((\\<not>\\<^sub>r (\\<not>\\<^sub>r P) ;; true\\<^sub>r) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> R))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) ;; II\\<^sub>R = \\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) ;; \\<^bold>R\\<^sub>s(true \\<turnstile> false \\<diamondop> ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))\"\n    by (simp add: srdes_skip_tri_design, rel_auto)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not> R1 (\\<not> R2s P) ;; R1 true) \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> (R1 (R2s R) ;; R1 (R2s ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))))\"\n    by (simp_all add: RHS_tri_design_composition assms unrest R2s_true R1_false R2s_false)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not> R1 (\\<not> R2s P) ;; R1 true) \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> R1 (R2s R))\"\n  proof -\n    from assms(3,4) have \"(R1 (R2s R) ;; R1 (R2s ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<lceil>II\\<rceil>\\<^sub>R))) = R1 (R2s R)\"\n      by (rel_auto, metis (no_types, lifting) minus_zero_eq, meson order_refl trace_class.diff_cancel)\n    thus ?thesis\n      by simp\n  qed\n  also have \"... = \\<^bold>R\\<^sub>s((\\<not> (\\<not> P) ;; R1 true) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> R))\"\n    by (metis (no_types, lifting) R1_R2s_R1_true_lemma R1_R2s_R2c R2c_not RHS_design_R2c_pre RHS_design_neg_R1_pre RHS_design_post_R1 RHS_design_post_R2s)\n  also have \"... = \\<^bold>R\\<^sub>s((\\<not>\\<^sub>r (\\<not>\\<^sub>r P) ;; true\\<^sub>r) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> R))\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nlemma RD_composition_wp:\n  assumes \"P is RD\" \"Q is RD\"\n  shows \"(P ;; Q) = \\<^bold>R (((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<and> post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q) \\<turnstile>\n                       (peri\\<^sub>R P \\<or> (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\<diamondop> (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"(P ;; Q) = (\\<^bold>R(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) ;; \\<^bold>R(pre\\<^sub>R(Q) \\<turnstile> peri\\<^sub>R(Q) \\<diamondop> post\\<^sub>R(Q)))\"\n    by (simp add: RD_reactive_tri_design assms(1) assms(2))\n  also from assms\n  have \"... = ?rhs\"\n    by (simp add: RH_tri_design_composition_wp unrest closure disj_upred_def)\n  finally show ?thesis .\nqed\n\nlemma SRD_composition_wp:\n  assumes \"P is SRD\" \"Q is SRD\"\n  shows \"(P ;; Q) = \\<^bold>R\\<^sub>s (((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<and> post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q) \\<turnstile>\n                       ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<or> (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\<diamondop> (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"(P ;; Q) = (\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\<turnstile> peri\\<^sub>R(Q) \\<diamondop> post\\<^sub>R(Q)))\"\n    by (simp add: SRD_reactive_tri_design assms(1) assms(2))\n  also from assms\n  have \"... = ?rhs\"\n    by (simp add: RHS_tri_design_composition_wp disj_upred_def unrest assms closure)\n  finally show ?thesis .\nqed\n\nsubsection \\<open> Refinement introduction laws \\<close>\n\nsubsubsection \\<open> Regular \\<close>\n\nlemma RH_tri_design_refine:\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"Q\\<^sub>3 is RR\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqsubseteq> \\<^bold>R(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>2 \\<Rightarrow> P\\<^sub>2` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>3 \\<Rightarrow> P\\<^sub>3`\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3 \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3`\"\n    by (simp add: RH_design_refine assms closure RR_implies_R2c unrest ex_unrest)\n  also have \"... \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `(P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3`\"\n    by (rel_auto)\n  also have \"... \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `((P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3)\\<lbrakk>true/$wait\\<acute>\\<rbrakk>` \\<and> `((P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3)\\<lbrakk>false/$wait\\<acute>\\<rbrakk>`\"\n    by (rel_auto, metis)\n  also have \"... \\<longleftrightarrow> ?rhs\"\n    by (simp add: usubst unrest assms)\n  finally show ?thesis .\nqed\n\nlemma RH_tri_design_refine':\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"Q\\<^sub>3 is RR\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqsubseteq> \\<^bold>R(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> (Q\\<^sub>1 \\<sqsubseteq> P\\<^sub>1) \\<and> (P\\<^sub>2 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)) \\<and> (P\\<^sub>3 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>3))\"\n  by (simp add: RH_tri_design_refine assms, rel_auto)\n\nlemma rdes_tri_refine_intro:\n  assumes \"`P\\<^sub>1 \\<Rightarrow> P\\<^sub>2`\" \"`P\\<^sub>1 \\<and> Q\\<^sub>2 \\<Rightarrow> Q\\<^sub>1`\" \"`P\\<^sub>1 \\<and> R\\<^sub>2 \\<Rightarrow> R\\<^sub>1`\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<diamondop> R\\<^sub>1) \\<sqsubseteq> \\<^bold>R(P\\<^sub>2 \\<turnstile> Q\\<^sub>2 \\<diamondop> R\\<^sub>2)\"\n  using assms\n  by (rule_tac rdes_refine_intro, simp_all, rel_auto)  \n    \nlemma rdes_tri_refine_intro':\n  assumes \"P\\<^sub>2 \\<sqsubseteq> P\\<^sub>1\" \"Q\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)\" \"R\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> R\\<^sub>2)\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<diamondop> R\\<^sub>1) \\<sqsubseteq> \\<^bold>R(P\\<^sub>2 \\<turnstile> Q\\<^sub>2 \\<diamondop> R\\<^sub>2)\"\n  using assms\n  by (rule_tac rdes_tri_refine_intro, simp_all add: refBy_order)\n\nsubsubsection \\<open> Stateful \\<close>\n\nlemma RHS_tri_design_refine:\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"Q\\<^sub>3 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqsubseteq> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>2 \\<Rightarrow> P\\<^sub>2` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>3 \\<Rightarrow> P\\<^sub>3`\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `P\\<^sub>1 \\<and> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3 \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3`\"\n    by (simp add: RHS_design_refine assms closure RR_implies_R2c unrest ex_unrest)\n  also have \"... \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `(P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3`\"\n    by (rel_auto)\n  also have \"... \\<longleftrightarrow> `P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1` \\<and> `((P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3)\\<lbrakk>true/$wait\\<acute>\\<rbrakk>` \\<and> `((P\\<^sub>1 \\<and> Q\\<^sub>2) \\<diamondop> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<Rightarrow> P\\<^sub>2 \\<diamondop> P\\<^sub>3)\\<lbrakk>false/$wait\\<acute>\\<rbrakk>`\"\n    by (rel_auto, metis)\n  also have \"... \\<longleftrightarrow> ?rhs\"\n    by (simp add: usubst unrest assms)\n  finally show ?thesis .\nqed\n\nlemma RHS_tri_design_refine':\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"Q\\<^sub>3 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqsubseteq> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> (Q\\<^sub>1 \\<sqsubseteq> P\\<^sub>1) \\<and> (P\\<^sub>2 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)) \\<and> (P\\<^sub>3 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>3))\"\n  by (simp add: RHS_tri_design_refine assms, rel_auto)\n\nlemma srdes_tri_refine_intro:\n  assumes \"`P\\<^sub>1 \\<Rightarrow> P\\<^sub>2`\" \"`P\\<^sub>1 \\<and> Q\\<^sub>2 \\<Rightarrow> Q\\<^sub>1`\" \"`P\\<^sub>1 \\<and> R\\<^sub>2 \\<Rightarrow> R\\<^sub>1`\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<diamondop> R\\<^sub>1) \\<sqsubseteq> \\<^bold>R\\<^sub>s(P\\<^sub>2 \\<turnstile> Q\\<^sub>2 \\<diamondop> R\\<^sub>2)\"\n  using assms\n  by (rule_tac srdes_refine_intro, simp_all, rel_auto)  \n    \nlemma srdes_tri_refine_intro':\n  assumes \"P\\<^sub>2 \\<sqsubseteq> P\\<^sub>1\" \"Q\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)\" \"R\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> R\\<^sub>2)\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<diamondop> R\\<^sub>1) \\<sqsubseteq> \\<^bold>R\\<^sub>s(P\\<^sub>2 \\<turnstile> Q\\<^sub>2 \\<diamondop> R\\<^sub>2)\"\n  using assms\n  by (rule_tac srdes_tri_refine_intro, simp_all add: refBy_order)\n\nlemma SRD_peri_under_pre:\n  assumes \"P is SRD\" \"$wait\\<acute> \\<sharp> pre\\<^sub>R(P)\"\n  shows \"(pre\\<^sub>R(P) \\<Rightarrow>\\<^sub>r peri\\<^sub>R(P)) = peri\\<^sub>R(P)\"\nproof -\n  have \"peri\\<^sub>R(P) =\n        peri\\<^sub>R(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)))\"\n    by (simp add: SRD_reactive_tri_design assms)\n  also have \"... = (pre\\<^sub>R P \\<Rightarrow>\\<^sub>r peri\\<^sub>R P)\"\n    by (simp add: rea_pre_RHS_design rea_peri_RHS_design assms \n        unrest usubst R1_peri_SRD R2c_preR R1_rea_impl R2c_rea_impl R2c_periR)\n  finally show ?thesis ..\nqed\n\nlemma SRD_post_under_pre:\n  assumes \"P is SRD\" \"$wait\\<acute> \\<sharp> pre\\<^sub>R(P)\"\n  shows \"(pre\\<^sub>R(P) \\<Rightarrow>\\<^sub>r post\\<^sub>R(P)) = post\\<^sub>R(P)\"\nproof -\n  have \"post\\<^sub>R(P) =\n        post\\<^sub>R(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)))\"\n    by (simp add: SRD_reactive_tri_design assms)\n  also have \"... = (pre\\<^sub>R P \\<Rightarrow>\\<^sub>r post\\<^sub>R P)\"\n    by (simp add: rea_pre_RHS_design rea_post_RHS_design assms \n        unrest usubst R1_post_SRD R2c_preR R1_rea_impl R2c_rea_impl R2c_postR)\n  finally show ?thesis ..\nqed\n\nlemma SRD_refine_intro:\n  assumes\n    \"P is SRD\" \"Q is SRD\"\n    \"`pre\\<^sub>R(P) \\<Rightarrow> pre\\<^sub>R(Q)`\" \"`pre\\<^sub>R(P) \\<and> peri\\<^sub>R(Q) \\<Rightarrow> peri\\<^sub>R(P)`\" \"`pre\\<^sub>R(P) \\<and> post\\<^sub>R(Q) \\<Rightarrow> post\\<^sub>R(P)`\"\n  shows \"P \\<sqsubseteq> Q\"\n  by (metis SRD_reactive_tri_design assms(1) assms(2) assms(3) assms(4) assms(5) srdes_tri_refine_intro)\n\nlemma SRD_refine_intro':\n  assumes\n    \"P is SRD\" \"Q is SRD\"\n    \"`pre\\<^sub>R(P) \\<Rightarrow> pre\\<^sub>R(Q)`\" \"peri\\<^sub>R(P) \\<sqsubseteq> (pre\\<^sub>R(P) \\<and> peri\\<^sub>R(Q))\" \"post\\<^sub>R(P) \\<sqsubseteq> (pre\\<^sub>R(P) \\<and> post\\<^sub>R(Q))\"\n  shows \"P \\<sqsubseteq> Q\"\n  using assms by (rule_tac SRD_refine_intro, simp_all add: refBy_order)\n \nlemma SRD_eq_intro:\n  assumes\n    \"P is SRD\" \"Q is SRD\" \"pre\\<^sub>R(P) = pre\\<^sub>R(Q)\" \"peri\\<^sub>R(P) = peri\\<^sub>R(Q)\" \"post\\<^sub>R(P) = post\\<^sub>R(Q)\"\n  shows \"P = Q\"\n  by (metis SRD_reactive_tri_design assms)\n\nlemma srdes_tri_eq_iff:\n  assumes \"P\\<^sub>1 is RR\" \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"Q\\<^sub>1 is RR\" \"Q\\<^sub>2 is RR\" \"Q\\<^sub>3 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> (P\\<^sub>1 = Q\\<^sub>1 \\<and> (P\\<^sub>1 \\<and> Q\\<^sub>2) = (Q\\<^sub>1 \\<and> P\\<^sub>2) \\<and> (P\\<^sub>1 \\<and> Q\\<^sub>3) = (Q\\<^sub>1 \\<and> P\\<^sub>3))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<longleftrightarrow> \n        (\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqsubseteq> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<and> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<sqsubseteq> \\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3))\"\n    by fastforce\n  also have \"... = (Q\\<^sub>1 \\<sqsubseteq> P\\<^sub>1 \\<and> P\\<^sub>2 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2) \\<and> P\\<^sub>3 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<and> P\\<^sub>1 \\<sqsubseteq> Q\\<^sub>1 \\<and> Q\\<^sub>2 \\<sqsubseteq> (Q\\<^sub>1 \\<and> P\\<^sub>2) \\<and> Q\\<^sub>3 \\<sqsubseteq> (Q\\<^sub>1 \\<and> P\\<^sub>3))\"\n    by (simp add: RHS_tri_design_refine' assms)\n  also have \"... = (P\\<^sub>1 = Q\\<^sub>1 \\<and> P\\<^sub>2 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2) \\<and> P\\<^sub>3 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>3) \\<and> Q\\<^sub>2 \\<sqsubseteq> (Q\\<^sub>1 \\<and> P\\<^sub>2) \\<and> Q\\<^sub>3 \\<sqsubseteq> (Q\\<^sub>1 \\<and> P\\<^sub>3))\"\n    by fastforce\n  also have \"... = (P\\<^sub>1 = Q\\<^sub>1 \\<and> (P\\<^sub>1 \\<and> Q\\<^sub>2) = (Q\\<^sub>1 \\<and> P\\<^sub>2) \\<and> (P\\<^sub>1 \\<and> Q\\<^sub>3) = (Q\\<^sub>1 \\<and> P\\<^sub>3))\"\n    apply (safe, simp_all)\n    apply (meson eq_iff utp_pred_laws.inf_greatest utp_pred_laws.inf_le1)+\n     apply (metis utp_pred_laws.inf_le2)+\n    done\n  finally show ?thesis .\nqed\n\nlemma rdes_tri_eq_intro:\n  assumes \"P\\<^sub>1 = Q\\<^sub>1\" \"(P\\<^sub>1 \\<and> Q\\<^sub>2) = (Q\\<^sub>1 \\<and> P\\<^sub>2)\" \"(P\\<^sub>1 \\<and> Q\\<^sub>3) = (Q\\<^sub>1 \\<and> P\\<^sub>3)\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)\"\n  by (metis (no_types, opaque_lifting) assms(1) assms(2) assms(3) design_export_pre wait'_cond_conj_exchange wait'_cond_idem)\n\nlemma srdes_tri_eq_intro:\n  assumes \"P\\<^sub>1 = Q\\<^sub>1\" \"(P\\<^sub>1 \\<and> Q\\<^sub>2) = (Q\\<^sub>1 \\<and> P\\<^sub>2)\" \"(P\\<^sub>1 \\<and> Q\\<^sub>3) = (Q\\<^sub>1 \\<and> P\\<^sub>3)\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)\"\n  by (metis (no_types, opaque_lifting) assms(1) assms(2) assms(3) design_export_pre wait'_cond_conj_exchange wait'_cond_idem)\n\nlemma rdes_tri_eq_intro':\n  assumes \"P\\<^sub>1 = Q\\<^sub>1\" \"P\\<^sub>2 = Q\\<^sub>2\" \"P\\<^sub>3 = Q\\<^sub>3\"\n  shows \"\\<^bold>R(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)\"\n  using assms by (simp)\n\nlemma srdes_tri_eq_intro':\n  assumes \"P\\<^sub>1 = Q\\<^sub>1\" \"P\\<^sub>2 = Q\\<^sub>2\" \"P\\<^sub>3 = Q\\<^sub>3\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) = \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)\"\n  using assms by (simp)\n\nsubsection \\<open> Closure laws \\<close>\n\nsubsubsection \\<open> Regular \\<close>\n\nlemma RD_srdes_skip [closure]: \"II\\<^sub>C is RD\"\n  by (simp add: rdes_skip_def RH_design_is_RD unrest)\n\nlemma RD_seqr_closure [closure]:\n  assumes \"P is RD\" \"Q is RD\"\n  shows \"(P ;; Q) is RD\"\nproof -\n  have \"(P ;; Q) = \\<^bold>R (((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<and> post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q) \\<turnstile> \n                       (peri\\<^sub>R P \\<or> (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\<diamondop> (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n    by (simp add: RD_composition_wp assms(1) assms(2))\n  also have \"... is RD\"\n    by (rule RH_design_is_RD, simp_all add: wp_rea_def unrest)\n  finally show ?thesis .\nqed\n\nlemma RD_power_Suc [closure]: \"P is RD \\<Longrightarrow> P\\<^bold>^(Suc n) is RD\"\nproof (induct n)\n  case 0\n  then show ?case\n    by (simp)\nnext\n  case (Suc n)\n  then show ?case\n    using RD_seqr_closure by (simp add: RD_seqr_closure upred_semiring.power_Suc) \nqed\n\nlemma RD_power_comp [closure]: \"P is RD \\<Longrightarrow> P ;; P\\<^bold>^n is RD\"\n  by (metis RD_power_Suc upred_semiring.power_Suc)\n\nlemma uplus_RD_closed [closure]: \"P is RD \\<Longrightarrow> P\\<^sup>+ is RD\"\n  by (simp add: uplus_power_def closure)\n\nsubsubsection \\<open> Stateful \\<close>\n\nlemma SRD_srdes_skip [closure]: \"II\\<^sub>R is SRD\"\n  by (simp add: srdes_skip_def RHS_design_is_SRD unrest)\n\nlemma SRD_seqr_closure [closure]:\n  assumes \"P is SRD\" \"Q is SRD\"\n  shows \"(P ;; Q) is SRD\"\nproof -\n  have \"(P ;; Q) = \\<^bold>R\\<^sub>s (((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<and> post\\<^sub>R P wp\\<^sub>r pre\\<^sub>R Q) \\<turnstile> \n                       ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<or> (post\\<^sub>R P ;; peri\\<^sub>R Q)) \\<diamondop> (post\\<^sub>R P ;; post\\<^sub>R Q))\"\n    by (simp add: SRD_composition_wp assms(1) assms(2))\n  also have \"... is SRD\"\n    by (rule RHS_design_is_SRD, simp_all add: wp_rea_def unrest)\n  finally show ?thesis .\nqed\n\nlemma SRD_power_Suc [closure]: \"P is SRD \\<Longrightarrow> P\\<^bold>^(Suc n) is SRD\"\nproof (induct n)\n  case 0\n  then show ?case\n    by (simp)\nnext\n  case (Suc n)\n  then show ?case\n    using SRD_seqr_closure by (simp add: SRD_seqr_closure upred_semiring.power_Suc) \nqed\n\nlemma SRD_power_comp [closure]: \"P is SRD \\<Longrightarrow> P ;; P\\<^bold>^n is SRD\"\n  by (metis SRD_power_Suc upred_semiring.power_Suc)\n\nlemma uplus_SRD_closed [closure]: \"P is SRD \\<Longrightarrow> P\\<^sup>+ is SRD\"\n  by (simp add: uplus_power_def closure)\n\nlemma SRD_Sup_closure [closure]:\n  assumes \"A \\<subseteq> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\" \"A \\<noteq> {}\"\n  shows \"(\\<Sqinter> A) is SRD\"\nproof -\n  have \"SRD (\\<Sqinter> A) = (\\<Sqinter> (SRD `A))\"\n    by (simp add: ContinuousD SRD_Continuous assms(2))\n  also have \"... = (\\<Sqinter> A)\"\n    by (simp only: Healthy_carrier_image assms)\n  finally show ?thesis by (simp add: Healthy_def)\nqed\n\nsubsection \\<open> Distribution laws \\<close>\n\nlemma RHS_tri_design_choice [rdes_def]: \n  \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<sqinter> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<or> Q\\<^sub>2) \\<diamondop> (P\\<^sub>3 \\<or> Q\\<^sub>3))\"\n  apply (simp add: RHS_design_choice)\n  apply (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"])\n   apply (simp)\n  apply (rel_auto)\n  done\n\nlemma RHS_tri_design_disj [rdes_def]: \n  \"(\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<or> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<or> Q\\<^sub>2) \\<diamondop> (P\\<^sub>3 \\<or> Q\\<^sub>3))\"\n  by (simp add: RHS_tri_design_choice disj_upred_def)\n\nlemma RHS_tri_design_sup [rdes_def]: \n  \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<squnion> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\<or> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>1 \\<Rightarrow>\\<^sub>r P\\<^sub>2) \\<and> (Q\\<^sub>1 \\<Rightarrow>\\<^sub>r Q\\<^sub>2)) \\<diamondop> ((P\\<^sub>1 \\<Rightarrow>\\<^sub>r P\\<^sub>3) \\<and> (Q\\<^sub>1 \\<Rightarrow>\\<^sub>r Q\\<^sub>3)))\"\n  by (simp add: RHS_design_sup, rel_auto)\n\nlemma RHS_tri_design_conj [rdes_def]: \n  \"(\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<and> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)) = \\<^bold>R\\<^sub>s((P\\<^sub>1 \\<or> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>1 \\<Rightarrow>\\<^sub>r P\\<^sub>2) \\<and> (Q\\<^sub>1 \\<Rightarrow>\\<^sub>r Q\\<^sub>2)) \\<diamondop> ((P\\<^sub>1 \\<Rightarrow>\\<^sub>r P\\<^sub>3) \\<and> (Q\\<^sub>1 \\<Rightarrow>\\<^sub>r Q\\<^sub>3)))\"\n  by (simp add: RHS_tri_design_sup conj_upred_def)\n\nlemma SRD_UINF [rdes_def]:\n  assumes \"A \\<noteq> {}\" \"A \\<subseteq> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"\\<Sqinter> A = \\<^bold>R\\<^sub>s((\\<And> P\\<in>A \\<bullet> pre\\<^sub>R(P)) \\<turnstile> (\\<Or> P\\<in>A \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<Or> P\\<in>A \\<bullet> post\\<^sub>R(P)))\"\nproof -\n  have \"\\<Sqinter> A = \\<^bold>R\\<^sub>s(pre\\<^sub>R(\\<Sqinter> A) \\<turnstile> peri\\<^sub>R(\\<Sqinter> A) \\<diamondop> post\\<^sub>R(\\<Sqinter> A))\"\n    by (metis SRD_as_reactive_tri_design assms srdes_theory.healthy_inf srdes_theory.healthy_inf_def)\n  also have \"... = \\<^bold>R\\<^sub>s((\\<And> P\\<in>A \\<bullet> pre\\<^sub>R(P)) \\<turnstile> (\\<Or> P\\<in>A \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<Or> P\\<in>A \\<bullet> post\\<^sub>R(P)))\"\n    by (simp add: preR_INF periR_INF postR_INF assms)\n  finally show ?thesis .\nqed\n\nlemma RHS_tri_design_USUP [rdes_def]:\n  assumes \"A \\<noteq> {}\"\n  shows \"(\\<Sqinter> i \\<in> A \\<bullet> \\<^bold>R\\<^sub>s(P(i) \\<turnstile> Q(i) \\<diamondop> R(i))) = \\<^bold>R\\<^sub>s((\\<Squnion> i \\<in> A \\<bullet> P(i)) \\<turnstile> (\\<Sqinter> i \\<in> A \\<bullet> Q(i)) \\<diamondop> (\\<Sqinter> i \\<in> A \\<bullet> R(i)))\"\n  by (subst RHS_INF[OF assms, THEN sym], simp add: design_UINF_mem assms, rel_auto)\n\nlemma SRD_UINF_mem:\n  assumes \"A \\<noteq> {}\" \"\\<And> i. P i is SRD\"\n  shows \"(\\<Sqinter> i\\<in>A \\<bullet> P i) = \\<^bold>R\\<^sub>s((\\<And> i\\<in>A \\<bullet> pre\\<^sub>R(P i)) \\<turnstile> (\\<Or> i\\<in>A \\<bullet> peri\\<^sub>R(P i)) \\<diamondop> (\\<Or> i\\<in>A \\<bullet> post\\<^sub>R(P i)))\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs = (\\<Sqinter> (P ` A))\"\n    by (rel_auto) \n  also have \" ... =  \\<^bold>R\\<^sub>s ((\\<Squnion> Pa \\<in> P ` A \\<bullet> pre\\<^sub>R Pa) \\<turnstile> (\\<Sqinter> Pa \\<in> P ` A \\<bullet> peri\\<^sub>R Pa) \\<diamondop> (\\<Sqinter> Pa \\<in> P ` A \\<bullet> post\\<^sub>R Pa))\"\n    by (subst rdes_def, simp_all add: assms image_subsetI)\n  also have \"... = ?rhs\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nlemma RHS_tri_design_UINF_ind [rdes_def]:\n  \"(\\<Sqinter> i \\<bullet> \\<^bold>R\\<^sub>s(P\\<^sub>1(i) \\<turnstile> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i))) = \\<^bold>R\\<^sub>s((\\<And> i \\<bullet> P\\<^sub>1 i) \\<turnstile> (\\<Or> i \\<bullet> P\\<^sub>2(i)) \\<diamondop> (\\<Or> i \\<bullet> P\\<^sub>3(i)))\"\n  by (rel_auto)\n\nlemma cond_srea_form [rdes_def]:\n  \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) \\<triangleleft> b \\<triangleright>\\<^sub>R \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) =\n   \\<^bold>R\\<^sub>s((P \\<triangleleft> b \\<triangleright>\\<^sub>R R) \\<turnstile> (Q\\<^sub>1 \\<triangleleft> b \\<triangleright>\\<^sub>R S\\<^sub>1) \\<diamondop> (Q\\<^sub>2 \\<triangleleft> b \\<triangleright>\\<^sub>R S\\<^sub>2))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) \\<triangleleft> b \\<triangleright>\\<^sub>R \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2) = \\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2) \\<triangleleft> R2c(\\<lceil>b\\<rceil>\\<^sub>S\\<^sub><) \\<triangleright> \\<^bold>R\\<^sub>s(R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\"\n    by (pred_auto)\n  also have \"... = \\<^bold>R\\<^sub>s (P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2 \\<triangleleft> b \\<triangleright>\\<^sub>R R \\<turnstile> S\\<^sub>1 \\<diamondop> S\\<^sub>2)\"\n    by (simp add: RHS_cond lift_cond_srea_def)\n  also have \"... = \\<^bold>R\\<^sub>s ((P \\<triangleleft> b \\<triangleright>\\<^sub>R R) \\<turnstile> (Q\\<^sub>1 \\<diamondop> Q\\<^sub>2 \\<triangleleft> b \\<triangleright>\\<^sub>R S\\<^sub>1 \\<diamondop> S\\<^sub>2))\"\n    by (simp add: design_condr lift_cond_srea_def)\n  also have \"... = \\<^bold>R\\<^sub>s((P \\<triangleleft> b \\<triangleright>\\<^sub>R R) \\<turnstile> (Q\\<^sub>1 \\<triangleleft> b \\<triangleright>\\<^sub>R S\\<^sub>1) \\<diamondop> (Q\\<^sub>2 \\<triangleleft> b \\<triangleright>\\<^sub>R S\\<^sub>2))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma SRD_cond_srea [closure]:\n  assumes \"P is SRD\" \"Q is SRD\"\n  shows \"P \\<triangleleft> b \\<triangleright>\\<^sub>R Q is SRD\"\nproof -\n  have \"P \\<triangleleft> b \\<triangleright>\\<^sub>R Q = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) \\<triangleleft> b \\<triangleright>\\<^sub>R \\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\<turnstile> peri\\<^sub>R(Q) \\<diamondop> post\\<^sub>R(Q))\"\n    by (simp add: SRD_reactive_tri_design assms)\n  also have \"... = \\<^bold>R\\<^sub>s ((pre\\<^sub>R P \\<triangleleft> b \\<triangleright>\\<^sub>R pre\\<^sub>R Q) \\<turnstile> (peri\\<^sub>R P \\<triangleleft> b \\<triangleright>\\<^sub>R peri\\<^sub>R Q) \\<diamondop> (post\\<^sub>R P \\<triangleleft> b \\<triangleright>\\<^sub>R post\\<^sub>R Q))\"\n    by (simp add: cond_srea_form)\n  also have \"... is SRD\"\n    by (simp add: RHS_tri_design_is_SRD lift_cond_srea_def unrest)\n  finally show ?thesis .\nqed\n\nsubsection \\<open> Algebraic laws \\<close>\n\nlemma RD_left_unit:\n  assumes \"P is RD\"\n  shows \"II\\<^sub>C ;; P = P\"\n  by (simp add: RD1_left_unit RD_healths(1) RD_healths(4) assms)\n\nlemma skip_rdes_self_unit [simp]:\n  \"II\\<^sub>C ;; II\\<^sub>C = II\\<^sub>C\"\n  by (simp add: RD_left_unit closure)\n\nlemma SRD_left_unit:\n  assumes \"P is SRD\"\n  shows \"II\\<^sub>R ;; P = P\"\n  by (simp add: SRD_composition_wp closure rdes wp C1 R1_negate_R1 R1_false \n      rpred trace_ident_left_periR trace_ident_left_postR SRD_reactive_tri_design assms)\n\nlemma skip_srea_self_unit [simp]:\n  \"II\\<^sub>R ;; II\\<^sub>R = II\\<^sub>R\"\n  by (simp add: SRD_left_unit closure)\n\nlemma SRD_right_unit_tri_lemma:\n  assumes \"P is SRD\"\n  shows \"P ;; II\\<^sub>R = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> post\\<^sub>R P)\"\n  by (simp add: SRD_composition_wp closure rdes wp rpred trace_ident_right_postR assms)\n\nlemma Miracle_left_zero:\n  assumes \"P is SRD\"\n  shows \"Miracle ;; P = Miracle\"\nproof -\n  have \"Miracle ;; P = \\<^bold>R\\<^sub>s(true \\<turnstile> false) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n    by (simp add: Miracle_def SRD_reactive_design_alt assms)\n  also have \"... = \\<^bold>R\\<^sub>s(true \\<turnstile> false)\"\n    by (simp add: RHS_design_composition unrest R1_false R2s_false R2s_true)\n  also have \"... = Miracle\"\n    by (simp add: Miracle_def)\n  finally show ?thesis .\nqed\n\nlemma Chaos_left_zero:\n  assumes \"P is SRD\"\n  shows \"(Chaos ;; P) = Chaos\"\nproof -\n  have \"Chaos ;; P = \\<^bold>R\\<^sub>s(false \\<turnstile> true) ;; \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P))\"\n    by (simp add: Chaos_def SRD_reactive_design_alt assms)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not> R1 true \\<and> \\<not> (R1 true \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s (pre\\<^sub>R P))) \\<turnstile>\n                       R1 true ;; ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s (cmt\\<^sub>R P))))\"\n    by (simp add: RHS_design_composition unrest R2s_false R2s_true R1_false)\n  also have \"... = \\<^bold>R\\<^sub>s ((false \\<and> \\<not> (R1 true \\<and> \\<not> $wait\\<acute>) ;; R1 (\\<not> R2s (pre\\<^sub>R P))) \\<turnstile>\n                       R1 true ;; ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> R1 (R2s (cmt\\<^sub>R P))))\"\n    by (simp add: RHS_design_conj_neg_R1_pre)\n  also have \"... = \\<^bold>R\\<^sub>s(true)\"\n    by (simp add: design_false_pre)\n  also have \"... = \\<^bold>R\\<^sub>s(false \\<turnstile> true)\"\n    by (simp add: design_def)\n  also have \"... = Chaos\"\n    by (simp add: Chaos_def)\n  finally show ?thesis .\nqed\n\nlemma SRD_right_Chaos_tri_lemma:\n  assumes \"P is SRD\"\n  shows \"P ;; Chaos = \\<^bold>R\\<^sub>s (((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<and> post\\<^sub>R P wp\\<^sub>r false) \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> false)\"\n  by (simp add: SRD_composition_wp closure rdes assms wp, rel_auto)\n\nlemma SRD_right_Miracle_tri_lemma:\n  assumes \"P is SRD\"\n  shows \"P ;; Miracle = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> false)\"\n  by (simp add: SRD_composition_wp closure rdes assms wp, rel_auto)\n\ntext \\<open> Reactive designs are left unital \\<close>\n\ninterpretation rdes_left_unital: utp_theory_left_unital \"RD\" \"II\\<^sub>C\"\n  by (unfold_locales, simp_all add: closure RD_left_unit)\n\ntext \\<open> Stateful reactive designs are left unital \\<close>\n\ninterpretation srdes_left_unital: utp_theory_left_unital \"SRD\" \"II\\<^sub>R\"\n  by (unfold_locales, simp_all add: closure SRD_left_unit)\n\nsubsection \\<open> Recursion laws \\<close>\n\nlemma mono_srd_iter:\n  assumes \"mono F\" \"F \\<in> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"mono (\\<lambda>X. \\<^bold>R\\<^sub>s(pre\\<^sub>R(F X) \\<turnstile> peri\\<^sub>R(F X) \\<diamondop> post\\<^sub>R (F X)))\"\n  apply (rule monoI)\n  apply (rule srdes_tri_refine_intro')\n  apply (meson assms(1) monoE preR_antitone utp_pred_laws.le_infI2)\n  apply (meson assms(1) monoE periR_monotone utp_pred_laws.le_infI2)\n  apply (meson assms(1) monoE postR_monotone utp_pred_laws.le_infI2)\ndone\n\nlemma mu_srd_SRD:\n  assumes \"mono F\" \"F \\<in> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"(\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s (pre\\<^sub>R (F X) \\<turnstile> peri\\<^sub>R (F X) \\<diamondop> post\\<^sub>R (F X))) is SRD\"\n  apply (subst gfp_unfold)\n  apply (simp add: mono_srd_iter assms)\n  apply (rule RHS_tri_design_is_SRD)\n  apply (simp_all add: unrest)\ndone\n\nlemma mu_srd_iter:\n  assumes \"mono F\" \"F \\<in> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"(\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R(F(X)) \\<turnstile> peri\\<^sub>R(F(X)) \\<diamondop> post\\<^sub>R(F(X)))) = F(\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R(F(X)) \\<turnstile> peri\\<^sub>R(F(X)) \\<diamondop> post\\<^sub>R(F(X))))\"\n  apply (subst gfp_unfold)\n   apply (simp add: mono_srd_iter assms)\n  apply (subst SRD_as_reactive_tri_design[THEN sym])\n  apply (simp add: Healthy_apply_closed SRD_as_reactive_design SRD_reactive_design_alt assms(1) assms(2) mu_srd_SRD)\n  done\n\nlemma mu_srd_form:\n  assumes \"mono F\" \"F \\<in> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>SRD\\<rbrakk>\\<^sub>H\"\n  shows \"\\<mu>\\<^sub>R F = (\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R(F(X)) \\<turnstile> peri\\<^sub>R(F(X)) \\<diamondop> post\\<^sub>R(F(X))))\"\nproof -\n  have 1: \"F (\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R (F X) \\<turnstile> peri\\<^sub>R(F X) \\<diamondop> post\\<^sub>R (F X))) is SRD\"\n    by (simp add: Healthy_apply_closed assms(1) assms(2) mu_srd_SRD)\n  have 2:\"Mono\\<^bsub>utp_order SRD\\<^esub> F\"\n    by (simp add: assms(1) mono_Monotone_utp_order)\n  hence 3:\"\\<mu>\\<^sub>R F = F (\\<mu>\\<^sub>R F)\"\n    by (simp add: srdes_theory.LFP_unfold[THEN sym] assms)\n  hence \"\\<^bold>R\\<^sub>s(pre\\<^sub>R (F (F (\\<mu>\\<^sub>R F))) \\<turnstile> peri\\<^sub>R (F (F (\\<mu>\\<^sub>R F))) \\<diamondop> post\\<^sub>R (F (F (\\<mu>\\<^sub>R F)))) = \\<mu>\\<^sub>R F\"\n    using SRD_reactive_tri_design by force\n  hence \"(\\<mu> X \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R (F X) \\<turnstile> peri\\<^sub>R(F X) \\<diamondop> post\\<^sub>R (F X))) \\<sqsubseteq> F (\\<mu>\\<^sub>R F)\"\n    by (simp add: 2 srdes_theory.weak.LFP_lemma3 gfp_upperbound assms)\n  thus ?thesis\n    using assms 1 3 srdes_theory.weak.LFP_lowerbound eq_iff mu_srd_iter\n    by (metis (mono_tags, lifting))\nqed\n\nlemma Monotonic_SRD_comp [closure]: \"Monotonic ((;;) P \\<circ> SRD)\"\n  by (simp add: mono_def R1_R2c_is_R2 R2_mono R3h_mono RD1_mono RD2_mono RHS_def SRD_def seqr_mono)\n\n*)\n\nend", "meta": {"author": "twright", "repo": "UTP-Rea-Designs", "sha": "bc8b78a280415e6c80eb5bb7a379d6b7e66ccfa0", "save_path": "github-repos/isabelle/twright-UTP-Rea-Designs", "path": "github-repos/isabelle/twright-UTP-Rea-Designs/UTP-Rea-Designs-bc8b78a280415e6c80eb5bb7a379d6b7e66ccfa0/utp_rdes_triples.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.33510135467515323}}
{"text": "theory AltNormEnv\n  imports PermEnvLeq\nbegin\n  \ndefinition norm_use_env where\n  \"norm_use_env r_x r_s = (\\<lambda> x. if r_s x = NoPerm then NoPerm else r_x x)\"  \n  \n    (* - norm ordering lemmas *)\n  \nlemma self_norm_leq_use_env: \"leq_use_env (norm_use_env r_x r_s) r_x\"\n  apply (simp add: norm_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done \n  \nlemma norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_c \\<rbrakk> \\<Longrightarrow> leq_use_env (norm_use_env r_x r_s) r_c\"\n  apply (simp add: norm_use_env_def)\n  apply (simp add: leq_use_env_def)\n  done\n\nlemma dist_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (norm_use_env r_ex r_x) (norm_use_env r_ex r_s)\"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  done    \n    \nlemma diff_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_ex) \\<rbrakk> \\<Longrightarrow> leq_use_env (norm_use_env r_s r_x) (diff_use_env r_s r_ex)\"\n  apply (simp add: diff_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n   apply (case_tac \"r_ex x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  done    \n    \nlemma diff_norm_leq_use_env_ex: \"\\<lbrakk> leq_use_env r_s r_c \\<rbrakk> \\<Longrightarrow> leq_use_env (diff_use_env r_s (norm_use_env r_x r_c)) (diff_use_env r_s r_x)\"\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (auto)  \n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n    \nlemma diff_norm_leq_use_env_gen: \"\\<lbrakk> leq_use_env r_sa r_c; leq_use_env r_sa r_sb \\<rbrakk> \\<Longrightarrow> leq_use_env (diff_use_env r_sa (norm_use_env r_x r_c)) (diff_use_env r_sb r_x)\"    \n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (auto)\n   apply (case_tac \"r_sa x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)    \n  done\n \nlemma spec_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_ex) \\<rbrakk> \\<Longrightarrow> leq_use_env (norm_use_env r_c r_x) (diff_use_env (norm_use_env r_c r_s) r_ex)\"    \n  apply (simp add: diff_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n    apply (case_tac \"r_ex x\")\n      apply (auto)\n   apply (case_tac \"r_ex x\")\n     apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n    apply (case_tac \"r_c x\")\n      apply (auto)\n   apply (case_tac \"r_c x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done    \n\nlemma rhs_self_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env r_x (norm_use_env r_s r_x)\"\n  apply (simp add: leq_use_env_def)\n  apply (simp add: norm_use_env_def)\n  done\n    \nlemma rhs_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_ex; leq_use_env r_ex r_s \\<rbrakk> \\<Longrightarrow> leq_use_env r_x (norm_use_env r_s r_ex)\"    \n  apply (rule_tac r_sb=\"r_ex\" in trans_leq_use_env)\n   apply (rule_tac rhs_self_norm_leq_use_env)\n   apply (auto)\n  done    \n    \n    (* - norm equality lemmas *)\n    \nlemma sub_norm_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> norm_use_env (norm_use_env r_c r_s) r_x = norm_use_env r_c r_x\"    \n  apply (case_tac \"\\<forall> x. norm_use_env (norm_use_env r_c r_s) r_x x = norm_use_env r_c r_x x\")\n   apply (auto)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done    \n \nlemma dist_norm_comp_use_env: \"comp_use_env (norm_use_env r_s r_c) (norm_use_env r_x r_c) = norm_use_env (comp_use_env r_s r_x) r_c\"    \n  apply (case_tac \"\\<forall> x. comp_use_env (norm_use_env r_s r_c) (norm_use_env r_x r_c) x = norm_use_env (comp_use_env r_s r_x) r_c x\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (auto)\n  done     \n    \n    (* - norm disjointness lemmas *)\n    \nlemma mini_disj_norm_use_env1: \"\\<lbrakk> mini_disj_use_env r_x r_c \\<rbrakk> \\<Longrightarrow> mini_disj_use_env (norm_use_env r_x r_s) r_c\"      \n  apply (simp add: mini_disj_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (simp add: norm_use_env_def)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n\nlemma mini_disj_norm_use_env2: \"\\<lbrakk> mini_disj_use_env r_c r_s \\<rbrakk> \\<Longrightarrow> mini_disj_use_env r_c (norm_use_env r_x r_s)\"       \n  apply (simp add: mini_disj_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (simp add: norm_use_env_def)\n  done    \n \nlemma disj_norm_use_env1: \"\\<lbrakk> mini_disj_use_env r_x r_c; disj_use_env r_s r_c \\<rbrakk> \\<Longrightarrow> disj_use_env (norm_use_env r_x r_s) r_c\"    \n  apply (simp add: disj_use_env_def)\n  apply (auto)\n   apply (rule_tac mini_disj_norm_use_env1)\n    apply (auto)\n  apply (rule_tac mini_disj_norm_use_env2)\n   apply (auto)\n  done\n\nlemma disj_norm_use_env2: \"\\<lbrakk> mini_disj_use_env r_x r_c; disj_use_env r_c r_s \\<rbrakk> \\<Longrightarrow> disj_use_env r_c (norm_use_env r_x r_s)\"    \n  apply (simp add: disj_use_env_def)\n  apply (auto)\n   apply (rule_tac mini_disj_norm_use_env2)\n    apply (auto)\n  apply (rule_tac mini_disj_norm_use_env1)\n   apply (auto)\n  done     \n\ndefinition strong_use_env where\n  \"strong_use_env r_s = (\\<forall> x. r_s x \\<noteq> UsePerm)\"    \n    \nlemma ex_norm_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> (\\<exists> r_ex. strong_use_env r_ex \\<and> norm_use_env r_s r_x = diff_use_env r_s r_ex)\"\n  apply (rule_tac x=\"\\<lambda> x. if r_s x \\<noteq> NoPerm \\<and> r_x x = NoPerm then OwnPerm else NoPerm\" in exI)\n  apply (auto)\n   apply (simp add: strong_use_env_def)\n  apply (case_tac \"\\<forall> x. norm_use_env r_s r_x x = diff_use_env r_s (\\<lambda>x. if r_s x \\<noteq> NoPerm \\<and> r_x x = NoPerm then OwnPerm else NoPerm) x\")\n   apply (auto)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done        \n    \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/AltNormEnv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269796369905, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.3351013538390312}}
{"text": "theory flash81Bra  imports flash81Rev\n \n  begin\nlemma onInv81:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv81 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv81 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv81 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash81Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7520125737597972, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.33504381233111485}}
{"text": "theory Review_RAut_NCPC\nimports \"../Observation_Setup\" Review_Value_Setup \"Bounded_Deducibility_Security.Compositional_Reasoning\"\nbegin\n\nsubsection \\<open>Confidentiality protection from users who are not the review's author or a PC member\\<close>\n\ntext \\<open>We verify the following property:\n\n\\ \\\\\nA group of users UIDs learn nothing\nabout the various updates of the N'th review of a paper PID\nexcept for the last edited version before notification\nunless/until one of the following holds:\n\\begin{itemize}\n\\item a user in UIDs is the review's author, or\n\\item a user in UIDs becomes a PC member in the paper's conference\nhaving no conflict with that paper, and the conference moves to the discussion phase.\n\\end{itemize}\n\\<close>\n\ntype_synonym \"value\" = rcontent\n\nfun f :: \"(state,act,out) trans \\<Rightarrow> value\" where\n\"f (Trans _ (Uact (uReview cid uid p pid n rc)) _ _) = rc\"\n|\n\"f (Trans _ (UUact (uuReview cid uid p pid n rc)) _ _) = rc\"\n\nfun T :: \"(state,act,out) trans \\<Rightarrow> bool\" where\n\"T (Trans _ _ ou s') =\n (\\<exists> uid \\<in> UIDs.\n    isREVNth s' uid PID N\n    \\<or>\n    (\\<exists> cid. PID \\<in>\\<in> paperIDs s' cid \\<and> isPC s' cid uid \\<and> pref s' uid PID \\<noteq> Conflict \\<and> phase s' cid \\<ge> disPH)\n )\"\n\ndeclare T.simps [simp del]\n\ndefinition B :: \"value list \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"B vl vl1 \\<equiv> vl \\<noteq> [] \\<and> vl1 \\<noteq> [] \\<and> last vl = last vl1\"\n\ninterpretation BD_Security_IO where\nistate = istate and step = step and\n\\<phi> = \\<phi> and f = f and \\<gamma> = \\<gamma> and g = g and T = T and B = B\ndone\n\nlemma reachNT_non_isRevNth_isPC_isChair:\nassumes \"reachNT s\" and \"uid \\<in> UIDs\"\nshows\n\"\\<not> isRevNth s cid uid PID N \\<and>\n (PID \\<in>\\<in> paperIDs s cid \\<and> isPC s cid uid \\<longrightarrow> pref s uid PID = Conflict \\<or> phase s cid < disPH) \\<and>\n (PID \\<in>\\<in> paperIDs s cid \\<and> isChair s cid uid \\<longrightarrow> pref s uid PID = Conflict \\<or> phase s cid < disPH)\"\n  using assms\n  apply induct\n   apply (auto simp: istate_def)[]\n  apply(intro conjI)\n  subgoal for trn apply(cases trn, auto simp: T.simps reachNT_reach isREVNth_def)[] .\n  subgoal by (metis T.elims(3) not_le_imp_less tgtOf_simps)\n  by (metis T.elims(3) isChair_isPC not_le_imp_less reach.Step reachNT_reach tgtOf_simps)\n\n(* important: *) lemma T_\\<phi>_\\<gamma>:\nassumes 1: \"reachNT s\" and 2: \"step s a = (ou,s')\" \"\\<phi> (Trans s a ou s')\"\nshows \"\\<not> \\<gamma> (Trans s a ou s')\"\nusing reachNT_non_isRevNth_isPC_isChair[OF 1] 2 unfolding T.simps \\<phi>_def2\napply (auto simp add: u_defs uu_defs) by (metis isRev_imp_isRevNth_getReviewIndex)+\n\n(* major *) lemma eqExcPID_N_step_out:\nassumes s's1': \"eqExcPID_N s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand sP: \"reachNT s\" and s1: \"reach s1\"\nand PID: \"PID \\<in>\\<in> paperIDs s cid\"\nand ph: \"phase s cid = revPH \\<or> phase s cid = disPH\"\nand UIDs: \"userOfA a \\<in> UIDs\"\nshows \"ou = ou1\"\nproof-\n  note Inv = reachNT_non_isRevNth_isPC_isChair[OF sP UIDs]\n  note eqs = eqExcPID_N_imp[OF s's1']\n  note eqs' = eqExcPID_N_imp1[OF s's1']\n  note eqss = eqExcPID_N_imp2[OF s's1']\n  note s = reachNT_reach[OF sP]\n\n  note simps[simp] = c_defs u_defs uu_defs r_defs l_defs Paper_dest_conv eqExcPID_N_def eeqExcPID_N_def eqExcD\n  note * = step step1 eqs eqs' s s1 PID UIDs ph paperIDs_equals[OF s] Inv\n\n  show ?thesis\n  proof (cases a)\n    case (Cact x1)\n    with * show ?thesis by (cases x1; auto)\n  next\n    case (Uact x2)\n    with * show ?thesis by (cases x2; auto)\n  next\n    case (UUact x3)\n    with * show ?thesis by (cases x3; auto)\n  next\n    case (Ract x4)\n    with * show ?thesis\n    proof (cases x4)\n      case (rMyReview x81 x82 x83 x84)\n      with Ract * show ?thesis\n        by clarsimp (metis eqExcPID_N_imp3' getRevRole_Some_Rev_isRevNth s's1')\n    next\n      case (rReviews x91 x92 x93 x94)\n      with Ract * show ?thesis\n        by clarsimp (metis eqss not_less)\n    next\n      case (rFinalReviews x121 x122 x123 x124)\n      with Ract * show ?thesis\n        by clarsimp (metis Suc_leD Suc_n_not_le_n)\n    qed auto\n  next\n    case (Lact x5)\n    with * show ?thesis by (cases x5; auto; presburger)\n  qed\nqed\n\n(* major *) lemma eqExcPID_N2_step_out:\nassumes ss1: \"eqExcPID_N2 s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand sP: \"reachNT s\" and s1: \"reach s1\"\nand r: \"isRevNth s cid uid PID N\"\nand ph: \"phase s cid \\<ge> revPH\"\nand UIDs: \"userOfA a \\<in> UIDs\"\nand decs_exit: \"(reviewsPaper (paper s PID))!N \\<noteq> [] \\<and> (reviewsPaper (paper s1 PID))!N \\<noteq> []\"\nshows \"ou = ou1\"\nproof-\n  note s = reachNT_reach[OF sP]\n  note Inv = reachNT_non_isRevNth_isPC_isChair[OF sP UIDs]\n  note eqs = eqExcPID_N2_imp[OF ss1]\n  note eqs' = eqExcPID_N2_imp1[OF ss1]\n  note eqss = eqExcPID_N2_imp2[OF ss1] eqExcPID_N2_imp3'[OF s ss1] eqExcPID_N2_imp33[OF ss1]\n\n  have PID: \"PID \\<in>\\<in> paperIDs s cid\" using r by (metis isRevNth_paperIDs s)\n  have PID1: \"PID \\<in>\\<in> paperIDs s1 cid\" using PID ss1 unfolding eqExcPID_N2_def by auto\n  have r1: \"isRevNth s1 cid uid PID N\" by (metis eqs r)\n  hence decs_exit': \"(reviewsPaper (paper s' PID))!N \\<noteq> [] \\<and>\n                     (reviewsPaper (paper s1' PID))!N \\<noteq> []\"\n  using nonempty_reviews_persist s s1 PID PID1 r r1 decs_exit step step1 by metis+\n\n  note simps[simp] = c_defs u_defs uu_defs r_defs l_defs Paper_dest_conv eqExcPID_N2_def eeqExcPID_N2_def eqExcD2\n\n  have \"eqExcD2 (paper s PID) (paper s1 PID)\"\n  using eqExcPID_N2_imp[OF ss1] eeqExcPID_N2_imp by blast\n  hence 1: \"hd (reviewsPaper (paper s PID) ! N) =\n            hd (reviewsPaper (paper s1 PID) ! N)\"\n  unfolding eqExcD2 eqExcNth2_def by auto\n\n  { fix cid uid p pid assume a: \"a = Ract (rFinalReviews cid uid p pid)\"\n    have ?thesis using step step1 eqExcPID_N2_imp[OF ss1]\n      unfolding a\n      apply clarsimp\n      apply(intro nth_equalityI)\n      subgoal by simp\n      subgoal for i apply (cases \"i \\<noteq> N\")\n        subgoal by simp (smt eqExcPID_N2_imp3 getNthReview_def ss1)\n        by (auto split: list.splits)\n      subgoal for i ia\n        apply (cases \"pid = PID\")\n        subgoal\n          apply(cases \"reviewsPaper (paper s' PID) ! i\")\n          subgoal apply simp\n            by (smt decs_exit eqExcPID_N2_imp3 getNthReview_def list.simps(4) nth_Cons_0 ss1)\n          subgoal apply(cases \"reviewsPaper (paper s1' PID) ! i \")\n            subgoal apply simp\n              by (metis (no_types, lifting) decs_exit eqExcD2 eqExcNth2_def neq_Nil_conv)\n            subgoal apply simp\n              by (metis (no_types, lifting) eqExcD2 eqExcNth2_def list.sel(1)) . .\n        subgoal by simp . .\n  } note this[simp]\n\n  note * = step step1 eqs eqs' s s1 PID PID1 r r1 UIDs ph paperIDs_equals[OF s] Inv\n\n  show ?thesis\n  proof (cases a)\n    case (Cact x1)\n    with * show ?thesis by (cases x1; auto)\n  next\n    case (Uact x2)\n    with * show ?thesis by (cases x2; auto)\n  next\n    case (UUact x3)\n    with * show ?thesis by (cases x3; auto)\n  next\n    case (Ract x4)\n    with * show ?thesis\n    proof (cases x4)\n      case (rMyReview x81 x82 x83 x84)\n      with Ract * show ?thesis\n        by clarsimp (metis eqss(2) getRevRole_Some_Rev_isRevNth)\n    next\n      case (rReviews x91 x92 x93 x94)\n      with Ract * show ?thesis\n        by clarsimp (metis eqss(1) not_less)\n    qed auto\n  next\n    case (Lact x5)\n    with * show ?thesis by (cases x5; auto; presburger)\n  qed\nqed\n\nlemma eqExcPID_N_step_eqExcPID_N2:\nassumes rs: \"reach s\"\nand a: \"a = Uact (uReview cid uid p PID N rc) \\<or>\n        a = UUact (uuReview cid uid p PID N rc)\" (is \"?L \\<or> ?R\")\nand ss1: \"eqExcPID_N s s1\"\nand step: \"step s a = (outOK,s')\" and step1: \"step s1 a = (outOK,s1')\"\nshows \"eqExcPID_N2 s' s1'\"\nusing a proof\n  assume a: ?L\n  have \"isRevNth s cid uid PID N\" using step unfolding a apply(simp add: u_defs uu_defs)\n  by (metis isRev_imp_isRevNth_getReviewIndex)\n  hence N: \"N < length (reviewsPaper (paper s PID))\"\n  using rs by (metis isRevNth_less_length)\n  hence N1: \"N < length (reviewsPaper (paper s1 PID))\"\n  using ss1 unfolding eqExcPID_N_def eeqExcPID_N_def eqExcD eqExcNth_def by auto\n  have \"eqExcPID_N s' s1'\" using assms by (metis eqExcPID_N_step)\n  moreover have \"hd (reviewsPaper (paper s' PID) ! N) = hd (reviewsPaper (paper s1' PID) ! N)\"\n  using step step1 N N1 unfolding a by(auto simp add: u_defs uu_defs)\n  ultimately show ?thesis\n  unfolding eqExcPID_N_def eqExcPID_N2_def eeqExcPID_N_def eeqExcPID_N2_def eqExcD2 eqExcD\n  eqExcNth_def eqExcNth2_def by auto\nnext\n  assume a: ?R\n  have \"isRevNth s cid uid PID N\" using step unfolding a apply(simp add: u_defs uu_defs)\n  by (metis isRev_imp_isRevNth_getReviewIndex)\n  hence N: \"N < length (reviewsPaper (paper s PID))\"\n  using rs by (metis isRevNth_less_length)\n  hence N1: \"N < length (reviewsPaper (paper s1 PID))\"\n  using ss1 unfolding eqExcPID_N_def eeqExcPID_N_def eqExcD eqExcNth_def by auto\n  have \"eqExcPID_N s' s1'\" using assms by (metis eqExcPID_N_step)\n  moreover have \"hd (reviewsPaper (paper s' PID) ! N) = hd (reviewsPaper (paper s1' PID) ! N)\"\n  using step step1 N N1 unfolding a by(auto simp add: u_defs uu_defs)\n  ultimately show ?thesis\n  unfolding eqExcPID_N_def eqExcPID_N2_def eeqExcPID_N_def eeqExcPID_N2_def eqExcD2 eqExcD\n  eqExcNth_def eqExcNth2_def by auto\nqed\n\n(* major *) lemma eqExcPID_N_step_\\<phi>_eqExcPID_N2:\nassumes rs: \"reach s\"\nand ss1: \"eqExcPID_N s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand \\<phi>: \"\\<phi> (Trans s a ou s')\"\nshows \"eqExcPID_N2 s' s1'\"\nproof-\n  obtain cid uid p rc where\n  a: \"a = Uact (uReview cid uid p PID N rc) \\<or>\n      a = UUact (uuReview cid uid p PID N rc)\" (is \"?L \\<or> ?R\")\n  and ou: \"ou = outOK\"\n  using \\<phi> unfolding \\<phi>_def2 by blast\n  have \\<phi>1: \"\\<phi> (Trans s1 a ou1 s1')\" using \\<phi> ss1 by (metis eqExcPID_N_step_\\<phi>_imp step step1)\n  hence ou1: \"ou1 = outOK\" using \\<phi> unfolding \\<phi>_def2 by auto\n  show ?thesis using eqExcPID_N_step_eqExcPID_N2[OF rs a ss1 step[unfolded ou] step1[unfolded ou1]] .\nqed\n\ndefinition \\<Delta>1 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>1 s vl s1 vl1 \\<equiv>\n (\\<forall> cid. PID \\<in>\\<in> paperIDs s cid \\<longrightarrow> phase s cid < revPH)  \\<and>\n s = s1 \\<and> B vl vl1\"\n\ndefinition \\<Delta>2 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>2 s vl s1 vl1 \\<equiv>\n \\<exists> cid.\n    PID \\<in>\\<in> paperIDs s cid \\<and> phase s cid = revPH \\<and> \\<not> (\\<exists> uid. isREVNth s uid PID N) \\<and>\n    s = s1 \\<and> B vl vl1\"\n\ndefinition \\<Delta>3 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>3 s vl s1 vl1 \\<equiv>\n \\<exists> cid uid.\n    PID \\<in>\\<in> paperIDs s cid \\<and> phase s cid \\<in> {revPH, disPH} \\<and> isREVNth s uid PID N \\<and>\n    eqExcPID_N s s1 \\<and> B vl vl1\"\n\ndefinition \\<Delta>4 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>4 s vl s1 vl1 \\<equiv>\n \\<exists> cid uid.\n    PID \\<in>\\<in> paperIDs s cid \\<and> phase s cid \\<ge> revPH \\<and> isREVNth s uid PID N \\<and>\n    (reviewsPaper (paper s PID))!N \\<noteq> [] \\<and> (reviewsPaper (paper s1 PID))!N \\<noteq> [] \\<and>\n    eqExcPID_N2 s s1 \\<and> vl = [] \\<and> vl1 = []\"\n\ndefinition \\<Delta>e :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>e s vl s1 vl1 \\<equiv>\n vl \\<noteq> [] \\<and>\n (\n  (\\<exists> cid. PID \\<in>\\<in> paperIDs s cid \\<and> phase s cid > revPH \\<and> \\<not> (\\<exists> uid. isREVNth s uid PID N))\n  \\<or>\n  (\\<exists> cid. PID \\<in>\\<in> paperIDs s cid \\<and> phase s cid > disPH)\n )\"\n\nlemma istate_\\<Delta>1:\nassumes B: \"B vl vl1\"\nshows \"\\<Delta>1 istate vl istate vl1\"\nusing B unfolding \\<Delta>1_def B_def istate_def by auto\n\nlemma unwind_cont_\\<Delta>1: \"unwind_cont \\<Delta>1 {\\<Delta>1,\\<Delta>2,\\<Delta>e}\"\nproof(rule, simp)\n  let ?\\<Delta> = \"\\<lambda>s vl s1 vl1. \\<Delta>1 s vl s1 vl1 \\<or> \\<Delta>2 s vl s1 vl1 \\<or> \\<Delta>e s vl s1 vl1\"\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsP: \"reachNT s\" and rs1: \"reach s1\" and \"\\<Delta>1 s vl s1 vl1\"\n  hence rs: \"reach s\" and ss1: \"s1 = s\"\n  and vl: \"vl \\<noteq> []\" and vl1: \"vl1 \\<noteq> []\" and vl_vl1: \"last vl1 = last vl\"\n  and PID_ph: \"\\<And> cid. PID \\<in>\\<in> paperIDs s cid \\<Longrightarrow> phase s cid < revPH\"\n  using reachNT_reach unfolding \\<Delta>1_def B_def by auto\n  note vlvl1 = vl vl1 vl_vl1\n  show \"iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof-\n    have ?react proof\n      fix a :: act and ou :: out and s' and vl'\n      let ?trn = \"Trans s a ou s'\"  let ?trn1 = \"Trans s1 a ou s'\"\n      assume step: \"step s a = (ou, s')\" and P: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n      have \\<phi>: \"\\<not> \\<phi> ?trn\"\n        apply(cases a)\n        subgoal by simp\n        subgoal for x2 apply(cases x2) using step PID_ph by (fastforce simp: u_defs)+\n        subgoal for x3 apply(cases x3) using step PID_ph by (fastforce simp: uu_defs)+\n        by simp_all\n      hence vl': \"vl' = vl\" using c unfolding consume_def by auto\n      show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n      proof-\n        have ?match proof\n          show \"validTrans ?trn1\" unfolding ss1 using step by simp\n        next\n          show \"consume ?trn1 vl1 vl1\" unfolding consume_def ss1 using \\<phi> by auto\n        next\n          show \"\\<gamma> ?trn = \\<gamma> ?trn1\" unfolding ss1 by simp\n        next\n          assume \"\\<gamma> ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n        next\n          show \"?\\<Delta> s' vl' s' vl1\"\n          proof(cases \"\\<exists> cid. PID \\<in>\\<in> paperIDs s cid\")\n            case False note PID = False\n            have PID_ph': \"\\<And> cid. PID \\<in>\\<in> paperIDs s' cid \\<Longrightarrow> phase s' cid < revPH\" using PID step rs\n            subgoal apply(cases a)\n              subgoal for x1 apply(cases x1) apply(fastforce simp: c_defs)+ .\n              subgoal for x2 apply(cases x2) apply(fastforce simp: u_defs)+ .\n              subgoal for x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n              by auto\n            done\n            hence \"\\<Delta>1 s' vl' s' vl1\" unfolding \\<Delta>1_def B_def B_def vl' using PID_ph' vlvl1 by auto\n            thus ?thesis by auto\n          next\n            case True\n            then obtain CID where PID: \"PID \\<in>\\<in> paperIDs s CID\" by auto\n            hence ph: \"phase s CID < revPH\" using PID_ph by auto\n            have PID': \"PID \\<in>\\<in> paperIDs s' CID\" by (metis PID paperIDs_mono step)\n            show ?thesis\n            proof(cases \"phase s' CID < revPH\")\n              case True note ph' = True\n              hence \"\\<Delta>1 s' vl' s' vl1\" unfolding \\<Delta>1_def B_def B_def vl' using vlvl1 ph' PID' apply auto\n              by (metis reach_PairI paperIDs_equals rs step)\n              thus ?thesis by auto\n            next\n              case False note ph' = False\n              have \"\\<not> (\\<exists> uid. isRevNth s CID uid PID N)\" using rs ph isRevNth_geq_revPH by fastforce\n              hence ph_isRev': \"phase s' CID = revPH \\<and> \\<not> (\\<exists> uid. isRevNth s' CID uid PID N)\"\n              using ph' ph PID step rs\n              subgoal apply(cases a)\n                subgoal for x1 apply(cases x1) apply(fastforce simp: c_defs)+ .\n                subgoal for x2 apply(cases x2) apply(fastforce simp: u_defs)+ .\n                subgoal for x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n                by auto\n              done\n              hence \"\\<not> (\\<exists> uid. isREVNth s' uid PID N)\"\n              by (metis PID' isREVNth_imp_isRevNth reach_PairI rs step)\n              hence \"\\<Delta>2 s' vl' s' vl1\" unfolding \\<Delta>2_def B_def vl' using vlvl1 ph' PID' ph_isRev' by auto\n              thus ?thesis by auto\n            qed\n          qed\n        qed\n        thus ?thesis by simp\n      qed\n    qed\n    thus ?thesis using vl by auto\n  qed\nqed\n\nlemma unwind_cont_\\<Delta>2: \"unwind_cont \\<Delta>2 {\\<Delta>2,\\<Delta>3,\\<Delta>e}\"\nproof(rule, simp)\n  let ?\\<Delta> = \"\\<lambda>s vl s1 vl1. \\<Delta>2 s vl s1 vl1 \\<or> \\<Delta>3 s vl s1 vl1 \\<or> \\<Delta>e s vl s1 vl1\"\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsP: \"reachNT s\" and rs1: \"reach s1\" and \"\\<Delta>2 s vl s1 vl1\"\n  then obtain CID where rs: \"reach s\" and ph: \"phase s CID = revPH\" (is \"?ph = _\") and ss1: \"s1 = s\"\n  and uuid: \"\\<not> (\\<exists> uid. isREVNth s uid PID N)\"\n  and vl: \"vl \\<noteq> []\" and vl1: \"vl1 \\<noteq> []\" and vl_vl1: \"last vl1 = last vl\"\n  and PID: \"PID \\<in>\\<in> paperIDs s CID\" using reachNT_reach unfolding \\<Delta>2_def B_def by auto\n  hence uid: \"\\<not> (\\<exists> uid. isRevNth s CID uid PID N)\" by (metis isREVNth_def)\n  note vlvl1 = vl vl1 vl_vl1\n  show \"iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof-\n    have ?react proof\n      fix a :: act and ou :: out and s' :: state and vl'\n      let ?trn = \"Trans s a ou s'\"  let ?trn1 = \"Trans s1 a ou s'\"\n      let ?ph' = \"phase s' CID\"\n      assume step: \"step s a = (ou, s')\" and P: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n      have \\<phi>: \"\\<not> \\<phi> ?trn\"\n        apply(cases a)\n        subgoal by simp\n        subgoal for x2 apply(cases x2)\n          using step ph apply (auto simp: u_defs)\n          by (metis PID isRev_imp_isRevNth_getReviewIndex paperIDs_equals rs uid)\n        subgoal for x3 apply(cases x3)\n          using step ph apply (auto simp: uu_defs)\n          using PID paperIDs_equals rs by force\n        by simp_all\n      hence vl': \"vl' = vl\" using c unfolding consume_def by auto\n      have PID': \"PID \\<in>\\<in> paperIDs s' CID\" by (metis paperIDs_mono step PID)\n      show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n      proof-\n        have ?match proof\n          show \"validTrans ?trn1\" unfolding ss1 using step by simp\n        next\n          show \"consume ?trn1 vl1 vl1\" unfolding consume_def ss1 using \\<phi> by auto\n        next\n          show \"\\<gamma> ?trn = \\<gamma> ?trn1\" unfolding ss1 by simp\n        next\n          assume \"\\<gamma> ?trn\" thus \"g ?trn = g ?trn1\" unfolding ss1 by simp\n        next\n          show \"?\\<Delta> s' vl' s' vl1\"\n          proof(cases \"?ph' = revPH\")\n            case False\n            hence 1: \"?ph' > revPH \\<and> \\<not> (\\<exists> uid. isRevNth s' CID uid PID N)\"\n            using uid PID ph step rs\n            subgoal apply(cases a)\n              subgoal for x1 apply(cases x1) apply(fastforce simp: c_defs)+ .\n              subgoal for x2 apply(cases x2) apply(fastforce simp: u_defs)+ .\n              subgoal for x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n              by auto\n            done\n            hence \"\\<not> (\\<exists> uid. isREVNth s' uid PID N)\"\n            by (metis PID' isREVNth_imp_isRevNth reach_PairI rs step)\n            hence \"\\<Delta>e s' vl' s' vl1\" unfolding \\<Delta>e_def vl' using PID' vl 1 by auto\n            thus ?thesis by simp\n          next\n            case True note ph' = True\n            show ?thesis proof(cases \"\\<exists> uid. isREVNth s' uid PID N\")\n              case False\n              hence \"\\<Delta>2 s' vl' s' vl1\" using PID' vlvl1 ph' unfolding \\<Delta>2_def B_def vl' by auto\n              thus ?thesis by simp\n            next\n              case True\n              hence \"\\<Delta>3 s' vl' s' vl1\" using PID' vlvl1 ph' unfolding \\<Delta>3_def B_def vl' by auto\n              thus ?thesis by simp\n            qed\n          qed\n        qed\n        thus ?thesis by simp\n      qed\n    qed\n    thus ?thesis using vl by auto\n  qed\nqed\n\nlemma unwind_cont_\\<Delta>3: \"unwind_cont \\<Delta>3 {\\<Delta>3,\\<Delta>4,\\<Delta>e}\"\nproof(rule, simp)\n  let ?\\<Delta> = \"\\<lambda>s vl s1 vl1. \\<Delta>3 s vl s1 vl1 \\<or> \\<Delta>4 s vl s1 vl1 \\<or> \\<Delta>e s vl s1 vl1\"\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\<Delta>3 s vl s1 vl1\"\n  then obtain CID uid where uuid: \"isREVNth s uid PID N\"\n  and PID: \"PID \\<in>\\<in> paperIDs s CID\"\n  and rs: \"reach s\" and ph: \"phase s CID = revPH \\<or> phase s CID = disPH\" (is \"?ph = _ \\<or> _\")\n  and ss1: \"eqExcPID_N s s1\" and vl: \"vl \\<noteq> []\" and vl1: \"vl1 \\<noteq> []\" and vl_vl1: \"last vl = last vl1\"\n  using reachNT_reach unfolding \\<Delta>3_def B_def by auto\n  hence uid: \"isRevNth s CID uid PID N\" by (metis isREVNth_imp_isRevNth)\n  note vlvl1 = vl vl1 vl_vl1\n  from vl vl1 obtain v vl' v1 vl1' where vl: \"vl = v # vl'\" and vl1: \"vl1 = v1 # vl1'\" by (metis list.exhaust)\n  have uid_notin: \"uid \\<notin> UIDs\" using uid by (metis reachNT_non_isRevNth_isPC_isChair rsT)\n  show \"iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof(cases \"vl1' = []\")\n    case False note vl1' = False\n    hence vl_vl1': \"last vl = last vl1'\" using vl_vl1 unfolding vl1 by simp\n    have uid1: \"isRevNth s CID uid PID N\" using ss1 uid unfolding eqExcPID_N_def by auto\n    define a1 where \"a1 \\<equiv>\n     if ?ph = revPH\n      then Uact (uReview CID uid (pass s uid) PID N v1)\n      else UUact (uuReview CID uid (pass s uid) PID N v1)\"\n    (is \"_ \\<equiv> if ?ph = revPH then ?A else ?B\")\n    hence a1: \"a1 \\<in> {?A,?B}\" by auto\n    obtain s1' ou1 where step1: \"step s1 a1 = (ou1,s1')\" by (metis prod.exhaust)\n    let ?trn1 = \"Trans s1 a1 ou1 s1'\"\n    have s1s1': \"eqExcPID_N s1 s1'\" using step1 by (metis a1_def uReview_uuReview_step_eqExcPID_N)\n    have ss1': \"eqExcPID_N s s1'\" using eqExcPID_N_trans[OF ss1 s1s1'] .\n    hence many_s1': \"PID \\<in>\\<in> paperIDs s1' CID\" \"isRevNth s1' CID uid PID N\"\n    \"pass s1' uid = pass s uid\" \"phase s1' CID = phase s CID\"\n    using uid PID ph unfolding eqExcPID_N_def by simp_all\n    hence more_s1': \"uid \\<in>\\<in> userIDs s1'\" \"CID \\<in>\\<in> confIDs s1'\"\n    by (metis paperIDs_confIDs reach_PairI roles_userIDs rs1 step1 many_s1'(1))+\n    have f: \"f ?trn1 = v1\" unfolding a1_def by simp\n    have rs1': \"reach s1'\" using rs1 step1 by (auto intro: reach_PairI)\n    have ou1: \"ou1 = outOK\"\n    using step1 uid1 ph unfolding a1_def apply (simp_all add: u_defs uu_defs many_s1' more_s1')\n    by (metis isRevNth_getReviewIndex isRev_def3 many_s1' rs1')+\n    have ?iact proof\n      show \"step s1 a1 = (ou1,s1')\" by fact\n    next\n      show \\<phi>: \"\\<phi> ?trn1\" using ou1 unfolding a1_def by simp\n      thus \"consume ?trn1 vl1 vl1'\" using f unfolding consume_def vl1 by simp\n    next\n      show \"\\<not> \\<gamma> ?trn1\" by (simp add: a1_def uid_notin)\n    next\n      have \"\\<Delta>3 s vl s1' vl1'\" unfolding \\<Delta>3_def B_def using ph PID ss1' uuid vl_vl1' vl1' vl by auto\n      thus \"?\\<Delta> s vl s1' vl1'\" by simp\n    qed\n    thus ?thesis by auto\n  next\n    case True hence vl1: \"vl1 = [v1]\" unfolding vl1 by simp\n    have ?react proof\n      fix a :: act and ou :: out and s' :: state and vll'\n      let ?trn = \"Trans s a ou s'\"\n      let ?ph' = \"phase s' CID\"\n      assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vll'\"\n      have PID': \"PID \\<in>\\<in> paperIDs s' CID\" using PID rs by (metis paperIDs_mono step)\n      have uid': \"isRevNth s' CID uid PID N\" using uid step rs ph PID isRevNth_persistent by auto\n      hence uuid': \"isREVNth s' uid PID N\" by (metis isREVNth_def)\n      show \"match ?\\<Delta> s s1 vl1 a ou s' vll' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vll'\" (is \"?match \\<or> ?ignore\")\n      proof(cases \"\\<phi> ?trn\")\n        case False note \\<phi> = False\n        have vll': \"vll' = vl\" using c \\<phi> unfolding consume_def by (cases vl) auto\n        obtain ou1 and s1' where step1: \"step s1 a = (ou1,s1')\" by (metis prod.exhaust)\n        let ?trn1 = \"Trans s1 a ou1 s1'\"\n        have s's1': \"eqExcPID_N s' s1'\" using eqExcPID_N_step[OF ss1 step step1] .\n        have \\<phi>1: \"\\<not> \\<phi> ?trn1\" using \\<phi> unfolding eqExcPID_N_step_\\<phi>[OF ss1 step step1] .\n        have ?match proof\n          show \"validTrans ?trn1\" using step1 by simp\n        next\n          show \"consume ?trn1 vl1 vl1\" unfolding consume_def using \\<phi>1 by auto\n        next\n          show \"\\<gamma> ?trn = \\<gamma> ?trn1\" unfolding ss1 by simp\n        next\n          assume \"\\<gamma> ?trn\" thus \"g ?trn = g ?trn1\"\n          using eqExcPID_N_step_out[OF ss1 step step1 rsT rs1 PID ph] by simp\n        next\n          show \"?\\<Delta> s' vll' s1' vl1\"\n          proof(cases \"?ph' = revPH \\<or> ?ph' = disPH\")\n            case True\n            hence \"\\<Delta>3 s' vll' s1' vl1\" using PID' s's1' uuid' vlvl1 unfolding \\<Delta>3_def B_def vll' by auto\n            thus ?thesis by auto\n          next\n            case False hence ph': \"?ph' > disPH\" using ph rs step\n            by (metis le_less less_antisym not_less phase_increases2 prod.sel(2))\n            hence \"\\<Delta>e s' vll' s1' vl1\" unfolding \\<Delta>e_def vll' using PID' vlvl1 by auto\n            thus ?thesis by auto\n          qed\n        qed\n        thus ?thesis by simp\n      next\n        case True note \\<phi> = True\n        hence vll': \"vll' = vl'\" using c unfolding vl consume_def by simp\n        obtain cid uid p rc where a:\n        \"a = Uact (uReview cid uid p PID N rc) \\<or>\n         a = UUact (uuReview cid uid p PID N rc)\" (is \"a = ?A \\<or> a = ?B\")\n        and ou: \"ou = outOK\" and v: \"v = rc\"\n        using \\<phi> c unfolding vl consume_def \\<phi>_def2 vll' by fastforce\n        hence cid: \"cid = CID\" using step apply(auto simp: u_defs uu_defs)\n        (* crucial use of safety: *) by (metis PID paperIDs_equals rs)+\n        have a: \"(?ph = revPH \\<longrightarrow> a = ?A) \\<and> (?ph = disPH \\<longrightarrow> a = ?B)\"\n        using step ou a by (cases \"a = ?A\", auto simp: u_defs uu_defs cid)\n        have \\<gamma>: \"\\<not> \\<gamma> ?trn\" using step T rsT by (metis T_\\<phi>_\\<gamma> True)\n        hence f: \"f ?trn = v\" using c \\<phi> unfolding consume_def vl by auto\n        have s's: \"eqExcPID_N s' s\" using eqExcPID_N_sym[OF \\<phi>_step_eqExcPID_N[OF \\<phi> step]] .\n        have s's1: \"eqExcPID_N s' s1\" using eqExcPID_N_trans[OF s's ss1] .\n        have ph': \"phase s' CID = ?ph\" using s's ph unfolding eqExcPID_N_def by auto\n        show ?thesis\n        proof(cases \"vl' = []\")\n          case False note vl' = False\n          hence vl'_vl1: \"last vl' = last vl1\" using vl_vl1 unfolding vl by auto\n          have ?ignore proof\n            show \"\\<not> \\<gamma> ?trn\" by fact\n          next\n            show \"?\\<Delta> s' vll' s1 vl1\"\n            proof(cases \"?ph' = revPH \\<or> ?ph' = disPH\")\n              case True\n              hence \"\\<Delta>3 s' vll' s1 vl1\" using s's1 PID' uuid' vl' vl1 vl_vl1 unfolding \\<Delta>3_def B_def vl vll' by auto\n              thus ?thesis by auto\n            next\n              case False hence \"?ph' > disPH\" using ph rs step by (simp add: ph')\n              hence \"\\<Delta>e s' vll' s1 vl1\" unfolding \\<Delta>e_def vll' using PID' vlvl1 vl' by auto\n              thus ?thesis by auto\n            qed\n          qed\n          thus ?thesis by auto\n        next\n          case True note vl' = True hence vl: \"vl = [v]\" unfolding vl by simp\n(* the transition to \\<Delta>4: \\<phi> holds and both vl and vl1 are singletons: *)\n          hence v1v: \"v1 = v\" using vl_vl1 unfolding vl1 by simp\n          obtain s1' ou1 where step1: \"step s1 a = (ou1,s1')\" by (metis prod.exhaust)\n          let ?trn1 = \"Trans s1 a ou1 s1'\"\n          have \\<phi>1: \"\\<phi> ?trn1\" using eqExcPID_N_step_\\<phi>_imp[OF ss1 step step1 \\<phi>] .\n          hence ou1: \"ou1 = outOK\" unfolding \\<phi>_def2 by auto\n          have uid'_uid1': \"isRevNth s' CID uid PID N \\<and> isRevNth s1' CID uid PID N\"\n          using step step1 ou ou1 ph a apply(auto simp: u_defs uu_defs)\n          by (metis cid isRev_imp_isRevNth_getReviewIndex)+\n          hence N: \"N < length (reviewsPaper (paper s' PID)) \\<and> N < length (reviewsPaper (paper s1' PID))\"\n          by (metis isRevNth_less_length reach_PairI rs rs1 step step1)\n          hence l: \"reviewsPaper (paper s' PID) ! N \\<noteq> [] \\<and> reviewsPaper (paper s1' PID) ! N \\<noteq> []\"\n          using step step1 ph a ou ou1 by (auto simp add: u_defs uu_defs)\n          have ?match proof\n          show \"validTrans ?trn1\" using step1 by simp\n        next\n          show \"consume ?trn1 vl1 []\" unfolding consume_def using \\<phi>1 a ph\n          by (auto simp add: a v vl1 v1v)\n        next\n          show \"\\<gamma> ?trn = \\<gamma> ?trn1\" unfolding ss1 by simp\n        next\n          assume \"\\<gamma> ?trn\" thus \"g ?trn = g ?trn1\"\n          using eqExcPID_N_step_out[OF ss1 step step1 rsT rs1 PID ph] by simp\n        next\n          have \"\\<Delta>4 s' vll' s1' []\" unfolding vll' vl' \\<Delta>4_def\n          using ph' ph uuid' l eqExcPID_N_step_\\<phi>_eqExcPID_N2[OF rs ss1 step step1 \\<phi>] PID' by auto\n          thus \"?\\<Delta> s' vll' s1' []\" by simp\n        qed\n        thus ?thesis by simp\n        qed\n      qed\n    qed\n    thus ?thesis using vl by auto\n  qed\nqed\n\nlemma unwind_cont_\\<Delta>4: \"unwind_cont \\<Delta>4 {\\<Delta>4,\\<Delta>e}\"\nproof(rule, simp)\n  let ?\\<Delta> = \"\\<lambda>s vl s1 vl1. \\<Delta>4 s vl s1 vl1 \\<or> \\<Delta>e s vl s1 vl1\"\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \"\\<Delta>4 s vl s1 vl1\"\n  then obtain CID uid where uuid: \"isREVNth s uid PID N\"\n  and rs: \"reach s\" and ph: \"phase s CID \\<ge> revPH\" (is \"?ph \\<ge> _\")\n  and PID: \"PID \\<in>\\<in> paperIDs s CID\"\n  and decs: \"(reviewsPaper (paper s PID))!N \\<noteq> [] \\<and> (reviewsPaper (paper s1 PID))!N \\<noteq> []\"\n  and ss1: \"eqExcPID_N2 s s1\" and vl: \"vl = []\" and vl1: \"vl1 = []\"\n  using reachNT_reach unfolding \\<Delta>4_def by auto\n  hence uid: \"isRevNth s CID uid PID N\" by (metis isREVNth_imp_isRevNth)\n  show \"iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof-\n    have \"?react\"\n    proof\n      fix a :: act and ou :: out and s' :: state and vl'\n      let ?trn = \"Trans s a ou s'\"\n      let ?ph' = \"phase s' CID\"\n      assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n      have ph': \"phase s' CID \\<ge> revPH\" using ph rs isRevNth_geq_revPH isRevNth_persistent local.step reach_PairI uid by blast\n      have PID': \"PID \\<in>\\<in> paperIDs s' CID\" by (metis PID paperIDs_mono step)\n      have uid': \"isRevNth s' CID uid PID N\" using isRevNth_persistent by (metis isRevNth_persistent rs step uid)\n      hence uuid': \"isREVNth s' uid PID N\" by (metis isREVNth_def)\n      show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n      proof-\n        have \\<phi>: \"\\<not> \\<phi> ?trn\" and vl': \"vl' = []\" using c unfolding consume_def vl by auto\n        obtain ou1 and s1' where step1: \"step s1 a = (ou1,s1')\" by (metis prod.exhaust)\n        let ?trn1 = \"Trans s1 a ou1 s1'\"\n        have s's1': \"eqExcPID_N2 s' s1'\" using eqExcPID_N2_step[OF ss1 step step1 rs uid] .\n        have \\<phi>1: \"\\<not> \\<phi> ?trn1\" using \\<phi> unfolding eqExcPID_N2_step_\\<phi>[OF rs rs1 ss1 step step1] .\n        have uid1: \"isRevNth s1 CID uid PID N\" using uid eqExcPID_N2_imp[OF ss1] by auto\n        have decs': \"(reviewsPaper (paper s' PID))!N \\<noteq> []\" \"(reviewsPaper (paper s1' PID))!N \\<noteq> []\"\n        using nonempty_reviews_persist rs rs1 step step1 uid uid1 decs by blast+\n        have ?match proof\n          show \"validTrans ?trn1\" using step1 by simp\n        next\n          show \"consume ?trn1 vl1 vl1\" unfolding consume_def using \\<phi>1 by auto\n        next\n          show \"\\<gamma> ?trn = \\<gamma> ?trn1\" unfolding ss1 by simp\n        next\n          assume \"\\<gamma> ?trn\" thus \"g ?trn = g ?trn1\"\n          using eqExcPID_N2_step_out[OF ss1 step step1 rsT rs1 uid ph _ decs] by simp\n        next\n          have \"\\<Delta>4 s' vl' s1' vl1\" using ph' uuid' s's1' PID' unfolding \\<Delta>4_def vl1 vl' by (auto simp: decs')\n          thus \"?\\<Delta> s' vl' s1' vl1\" by simp\n        qed\n        thus ?thesis by simp\n      qed\n    qed\n    thus ?thesis using vl1 by simp\n  qed\nqed\n\n\n(* Exit arguments: *)\ndefinition K1exit where\n\"K1exit cid s \\<equiv> PID \\<in>\\<in> paperIDs s cid \\<and> phase s cid > revPH \\<and> \\<not> (\\<exists> uid. isRevNth s cid uid PID N)\"\n\nlemma invarNT_K1exit: \"invarNT (K1exit cid)\"\nunfolding invarNT_def apply (safe dest!: reachNT_reach)\n  subgoal for _ a apply(cases a)\n    subgoal for x1 apply(cases x1) apply (fastforce simp add: c_defs K1exit_def geq_noPH_confIDs)+ .\n    subgoal for x2 apply(cases x2) apply (fastforce simp add: u_defs K1exit_def paperIDs_equals)+ .\n    subgoal for x3 apply(cases x3) apply (fastforce simp add: uu_defs K1exit_def)+ .\n    by auto\ndone\n\nlemma noVal_K1exit: \"noVal (K1exit cid) v\"\n  apply(rule no\\<phi>_noVal)\n  unfolding no\\<phi>_def apply safe\n  subgoal for _ a apply(cases a)\n    subgoal by (fastforce simp add: c_defs K1exit_def)\n    subgoal for x2 apply(cases x2) apply (auto simp add: u_defs K1exit_def)\n     apply (metis less_not_refl paperIDs_equals reachNT_reach) .\n    subgoal for x3 apply(cases x3) apply (auto simp add: uu_defs K1exit_def)\n      apply (metis isRev_def3 paperIDs_equals reachNT_reach) .\n    by auto\ndone\n\ndefinition K2exit where\n\"K2exit cid s \\<equiv> PID \\<in>\\<in> paperIDs s cid \\<and> phase s cid > disPH\"\n\nlemma invarNT_K2exit: \"invarNT (K2exit cid)\"\nunfolding invarNT_def apply (safe dest!: reachNT_reach)\n  subgoal for _ a apply(cases a)\n    subgoal for x1 apply(cases x1) apply (fastforce simp add: c_defs K2exit_def geq_noPH_confIDs)+ .\n    subgoal for x2 apply(cases x2) apply (fastforce simp add: u_defs K2exit_def paperIDs_equals)+ .\n    subgoal for x3 apply(cases x3) apply (fastforce simp add: uu_defs K2exit_def)+ .\n    by auto\n  done\n\nlemma noVal_K2exit: \"noVal (K2exit cid) v\"\n  apply(rule no\\<phi>_noVal)\n  unfolding no\\<phi>_def apply safe\n  subgoal for _ a apply(cases a)\n    subgoal by (fastforce simp add: c_defs K2exit_def)\n    subgoal for x2 apply(cases x2) apply (auto simp add: u_defs K2exit_def)\n      using paperIDs_equals reachNT_reach apply fastforce .\n    subgoal for x3 apply(cases x3) apply (auto simp add: uu_defs K2exit_def)\n      using paperIDs_equals reachNT_reach apply fastforce .\n    by auto\ndone\n\nlemma unwind_exit_\\<Delta>e: \"unwind_exit \\<Delta>e\"\nproof\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\<Delta>e: \"\\<Delta>e s vl s1 vl1\"\n  hence vl: \"vl \\<noteq> []\" using reachNT_reach unfolding \\<Delta>e_def by auto\n  then obtain CID where \"K1exit CID s \\<or> K2exit CID s\" using \\<Delta>e\n  unfolding K1exit_def K2exit_def \\<Delta>e_def isREVNth_def by auto\n  thus \"vl \\<noteq> [] \\<and> exit s (hd vl)\" apply(simp add: vl)\n  by (metis rsT exitI2 invarNT_K1exit noVal_K1exit invarNT_K2exit noVal_K2exit)\nqed\n\ntheorem secure: secure\napply(rule unwind_decomp4_secure[of \\<Delta>1 \\<Delta>2 \\<Delta>e \\<Delta>3 \\<Delta>4])\nusing\nistate_\\<Delta>1\nunwind_cont_\\<Delta>1 unwind_cont_\\<Delta>2 unwind_cont_\\<Delta>2 unwind_cont_\\<Delta>3 unwind_cont_\\<Delta>4\nunwind_exit_\\<Delta>e\nby auto\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoCon/Review_Confidentiality/Review_RAut_NCPC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241911813151, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.33503807082622983}}
{"text": "section \\<open>FLPTheorem\\<close>\n\ntext \\<open>\n  \\file{FLPTheorem} combines the results of \\file{FLPSystem} with the concept\n  of fair infinite executions and culminates in showing the impossibility\n  of a consensus algorithm in the proposed setting.\n\\<close>\n\ntheory FLPTheorem\nimports Execution FLPSystem\nbegin\n\nlocale flpPseudoConsensus =\n  flpSystem trans sends start\nfor\n  trans :: \"'p \\<Rightarrow> 's \\<Rightarrow> 'v messageValue \\<Rightarrow>'s\" and\n  sends :: \"'p \\<Rightarrow> 's \\<Rightarrow> 'v messageValue \\<Rightarrow> ('p, 'v) message multiset\" and\n  start :: \"'p \\<Rightarrow> 's\" +\nassumes\n  Agreement: \"\\<And> i c . agreementInit i c\" and\n  PseudoTermination: \"\\<And>cc Q . terminationPseudo 1 cc Q\"\nbegin\n\nsubsection \\<open>Obtaining non-uniform executions\\<close>\n\ntext \\<open>\n  Executions which end with a \\isb{nonUniform} configuration can be expanded\n  to a strictly longer execution consuming a particular message.\n\n  This lemma connects the previous results to the world of executions,\n  thereby paving the way to the final contradiction. It covers a big part of\n  the original proof of the theorem, i.e.\\ finding the expansion to a longer\n  execution where the decision for both values is still possible.\n  \\voelzer{constructing executions using Lemma 2}\n\\<close>\nlemma NonUniformExecutionsConstructable:\nfixes\n  exec :: \"('p, 'v, 's ) configuration list \" and\n  trace :: \"('p, 'v) message list\" and \n  msg :: \"('p, 'v) message\" and\n  p :: 'p  \nassumes\n  MsgEnabled: \"enabled (last exec) msg\" and\n  PisReceiverOf: \"isReceiverOf p msg\" and\n  ExecIsExecution: \"execution trans sends start exec trace\" and\n  NonUniformLexec: \"nonUniform (last exec)\" and\n  Agree: \"\\<And> cfg . reachable (last exec) cfg \\<longrightarrow> agreement cfg\"\nshows\n  \"\\<exists> exec' trace' . (execution trans sends start exec' trace') \n    \\<and> nonUniform (last exec')\n    \\<and> prefixList exec exec' \\<and> prefixList trace trace' \n    \\<and> (\\<forall> cfg . reachable (last exec') cfg \\<longrightarrow> agreement cfg)\n    \\<and> stepReachable (last exec) msg (last exec') \n    \\<and> (msg \\<in> set (drop (length trace) trace'))\"\nproof -\n  from NonUniformCanReachSilentBivalence[OF NonUniformLexec PseudoTermination Agree]\n    obtain c' where C':\n      \"reachable (last exec) c'\" \n      \"val[p,c'] = {True, False}\"\n    by blast\n  show ?thesis \n  proof (cases \"stepReachable (last exec) msg c'\")\n    case True\n    hence IsStepReachable: \"stepReachable (last exec) msg c'\" by simp\n    hence \"\\<exists> exec' trace'. (execution trans sends start exec' trace') \n      \\<and> prefixList exec exec' \n      \\<and> prefixList trace trace' \\<and> (last exec') = c' \n      \\<and> msg \\<in> set (drop (length trace) trace')\" \n      using ExecIsExecution expandExecution\n      by auto\n    then obtain exec' trace' where NewExec: \n      \"(execution trans sends start exec' trace')\" \n      \"prefixList exec exec'\" \"(last exec') = c'\" \"prefixList trace trace'\" \n      \"msg \\<in> set (drop (length trace) trace')\" by blast\n    hence lastExecExec'Reachable: \"reachable (last exec) (last exec')\" \n      using C'(1) by simp\n    hence InitReachLastExec':  \"initReachable (last exec')\" \n      using NonUniformLexec \n      by (metis ReachableTrans initReachable_def)\n    hence nonUniformC': \"nonUniform (last exec')\" using C'(2) NewExec(3) \n      by (auto simp add: vUniform_def)\n    hence isAgreementPreventing: \n      \"(\\<forall> cfg . reachable (last exec') cfg \\<longrightarrow> agreement cfg)\"\n      using lastExecExec'Reachable Agree by (metis ReachableTrans)\n    with NewExec nonUniformC' IsStepReachable show ?thesis by auto\n  next\n    case False\n    hence NotStepReachable: \"\\<not> (stepReachable (last exec) msg c')\" by simp\n    from C'(1) obtain exec' trace' where NewExec: \n      \"execution trans sends start exec' trace'\"\n      \"(prefixList exec exec' \\<and> prefixList trace trace') \n      \\<or> (exec = exec' \\<and> trace = trace')\"\n      \"last exec' = c'\"\n      using ExecIsExecution expandExecutionReachable by blast\n    have lastExecExec'Reachable: \"reachable (last exec) (last exec')\" \n      using C'(1) NewExec(3) by simp\n    with NonUniformLexec have InitReachLastExec': \n      \"initReachable (last exec')\" \n      by (metis ReachableTrans initReachable_def)\n    with C'(2) NewExec(3) have nonUniformC': \"nonUniform (last exec')\" \n      by (auto simp add: vUniform_def)\n    show \"\\<exists> exec1 trace1 . (execution trans sends start exec1 trace1) \n      \\<and> nonUniform (last exec1)\n      \\<and> prefixList exec exec1 \\<and> prefixList trace trace1 \n      \\<and> (\\<forall> cfg . reachable (last exec1) cfg \\<longrightarrow> agreement cfg)\n      \\<and> stepReachable (last exec) msg (last exec1) \n      \\<and> (msg \\<in> set (drop (length trace) trace1))\"\n    proof (cases \"enabled (last exec') msg\") \n      case True\n      hence EnabledMsg: \"enabled (last exec') msg\" by auto\n      hence \"\\<exists> cMsg . ((last exec') \\<turnstile> msg \\<mapsto> cMsg )\"  \n      proof (cases msg)\n        case (InMsg p' b)\n        with PisReceiverOf have MsgIsInMsg: \"(msg = <p, inM b>)\" by auto\n        define cfgInM where \"cfgInM = \\<lparr>states = \\<lambda>proc. (\n        if proc = p then\n          trans p (states (last exec') p) (Bool b)\n        else states (last exec') proc),\n        msgs = (((sends p (states (last exec') p) (Bool b))\n              \\<union># (msgs (last exec')-# msg)))\\<rparr> \"\n          with UniqueReceiverOf MsgIsInMsg EnabledMsg have \n          \"((last exec') \\<turnstile> msg \\<mapsto> cfgInM)\" by auto\n        thus \"\\<exists> cMsg . ((last exec') \\<turnstile> msg \\<mapsto> cMsg )\" by blast\n      next \n        case (OutMsg b)\n        thus \"\\<exists> cMsg . ((last exec') \\<turnstile> msg \\<mapsto> cMsg )\" using PisReceiverOf \n          by auto\n      next \n        case (Msg p' v')\n        with PisReceiverOf have MsgIsVMsg: \"(msg = <p, v'>)\" by auto\n        define cfgVMsg where \"cfgVMsg =\n          \\<lparr>states = \\<lambda>proc. (\n              if proc = p then\n               trans p (states (last exec') p) (Value v')\n               else states (last exec') proc),\n            msgs = (((sends p (states (last exec') p) (Value v'))\n                \\<union># (msgs (last exec') -# msg )))\\<rparr> \"\n        with UniqueReceiverOf MsgIsVMsg EnabledMsg noInSends have \n          \"((last exec') \\<turnstile> msg \\<mapsto> cfgVMsg)\" by auto \n        thus \"\\<exists> cMsg . ((last exec') \\<turnstile> msg \\<mapsto> cMsg )\" by blast\n      qed  \n      then obtain cMsg where  CMsg:\"((last exec') \\<turnstile> msg \\<mapsto> cMsg )\" by auto\n      define execMsg where \"execMsg = exec' @ [cMsg]\"\n      define traceMsg where \"traceMsg = trace' @ [msg]\"\n      from NewExec(1) CMsg obtain execMsg traceMsg where isExecution: \n        \"execution trans sends start execMsg traceMsg\"\n        and ExecMsg: \"prefixList exec' execMsg\" \"prefixList trace' traceMsg\"\n        \"last execMsg = cMsg\" \"last traceMsg = msg\" \n        using expandExecutionStep by blast\n      have isPrefixListExec: \"prefixList exec execMsg\" \n        using PrefixListTransitive NewExec(2) ExecMsg(1) by auto \n      have isPrefixListTrace: \"prefixList trace traceMsg\" \n        using PrefixListTransitive NewExec(2) ExecMsg(2) by auto\n      have cMsgLastReachable: \"reachable cMsg (last execMsg)\" \n        by (auto simp add: ExecMsg reachable.init) \n      hence isStepReachable: \"stepReachable (last exec) msg (last execMsg)\" \n        using CMsg lastExecExec'Reachable   \n        by (auto simp add: stepReachable_def) \n      have InitReachLastExecMsg: \"initReachable (last execMsg)\" \n        using CMsg InitReachLastExec' cMsgLastReachable \n        by (metis ReachableTrans initReachable_def step) \n      have \"val[p, (last exec')] \\<subseteq> val[p, cMsg]\" \n        using CMsg PisReceiverOf InitReachLastExec'\n          ActiveProcessSilentDecisionValuesIncrease[of p p \"last exec'\" msg cMsg]\n        by auto\n      with ExecMsg C'(2) NewExec(3) have \n        \"val[p, (last execMsg)] = {True, False}\" by auto\n      with InitReachLastExecMsg have isNonUniform: \n        \"nonUniform (last execMsg)\" by (auto simp add: vUniform_def)\n      have \"reachable (last exec) (last execMsg)\" \n        using lastExecExec'Reachable cMsgLastReachable CMsg \n        by (metis ReachableTrans step)\n      hence isAgreementPreventing: \n        \"(\\<forall> cfg . reachable (last execMsg) cfg \\<longrightarrow> agreement cfg)\" \n        using Agree by (metis ReachableTrans)\n      have \"msg \\<in> set (drop (length trace) traceMsg)\" using ExecMsg(4) \n        isPrefixListTrace \n        by (metis (full_types) PrefixListMonotonicity last_drop last_in_set\n          length_0_conv length_drop less_zeroE zero_less_diff)\n      thus ?thesis using isExecution isNonUniform isPrefixListExec \n        isPrefixListTrace isAgreementPreventing isStepReachable by blast\n    next\n      case False\n      hence notEnabled: \"\\<not> (enabled (last exec') msg)\" by auto\n      have isStepReachable: \"stepReachable (last exec) msg (last exec')\" \n        using MsgEnabled notEnabled lastExecExec'Reachable StepReachable \n          by auto\n        with NotStepReachable NewExec(3) show ?thesis by simp\n    qed \n  qed \nqed\n\nlemma NonUniformExecutionBase:\nfixes\n  cfg\nassumes\n  Cfg: \"initial cfg\" \"nonUniform cfg\"\nshows \n  \"execution trans sends start [cfg] [] \n  \\<and> nonUniform (last [cfg]) \n  \\<and> (\\<exists> cfgList' msgList'.  nonUniform (last cfgList') \n    \\<and> prefixList [cfg] cfgList' \n    \\<and> prefixList [] msgList'\n    \\<and> (execution trans sends start cfgList' msgList')\n     \\<and> (\\<exists> msg'. execution.minimalEnabled [cfg] [] msg' \n         \\<and> msg' \\<in> set msgList'))\"\nproof -\n  have NonUniListCfg: \"nonUniform (last [cfg])\" using Cfg(2) by auto\n  have AgreeCfg': \"\\<forall> cfg' . \n    reachable (last [cfg]) cfg' \\<longrightarrow> agreement cfg'\" \n    using Agreement Cfg(1) \n    by (auto simp add: agreementInit_def reachable.init agreement_def)\n  have StartExec: \"execution trans sends start [cfg] []\" \n    using Cfg(1) by (unfold_locales, auto)\n  hence \"\\<exists> msg . execution.minimalEnabled [cfg] [] msg\" \n    using Cfg execution.ExistImpliesMinEnabled\n    by (metis enabled_def initial_def isReceiverOf.simps(1) \n       last.simps zero_less_one)\n  then obtain msg where MinEnabledMsg: \n    \"execution.minimalEnabled [cfg] [] msg\" by blast\n  hence \"\\<exists> pMin . isReceiverOf pMin msg\" using StartExec \n    by (auto simp add: execution.minimalEnabled_def)\n  then obtain pMin where PMin: \"isReceiverOf pMin msg\" by blast\n  hence \"enabled (last [cfg]) msg \\<and> isReceiverOf pMin msg\" \n    using MinEnabledMsg StartExec \n    by (auto simp add: execution.minimalEnabled_def)\n  hence Enabled: \"enabled (last [cfg]) msg\" \"isReceiverOf pMin msg\" \n    by auto\n  from Enabled StartExec NonUniListCfg PseudoTermination AgreeCfg' \n  have \"\\<exists> exec' trace' . (execution trans sends start exec' trace') \n    \\<and> nonUniform (last exec')\n    \\<and> prefixList [cfg] exec' \\<and> prefixList [] trace' \n    \\<and> (\\<forall> cfg' . reachable (last exec') cfg' \\<longrightarrow> agreement cfg')\n    \\<and> stepReachable (last [cfg]) msg (last exec') \n    \\<and> (msg \\<in> set (drop (length []) trace'))\" \n  using NonUniformExecutionsConstructable[of \"[cfg]\" \"msg\" \"pMin\"\n          \"[]::('p,'v) message list\"] \n    by simp\n  with StartExec NonUniListCfg MinEnabledMsg show ?thesis by auto\nqed\n\nlemma NonUniformExecutionStep:\nfixes\n cfgList msgList\nassumes\n  Init: \"initial (hd cfgList)\" and\n  NonUni: \"nonUniform (last cfgList)\" and\n  Execution: \"execution trans sends start cfgList msgList\"\nshows\n  \"(\\<exists> cfgList' msgList' .\n      nonUniform (last cfgList') \n      \\<and> prefixList cfgList cfgList' \n      \\<and> prefixList msgList msgList'\n      \\<and> (execution trans sends start cfgList' msgList') \n      \\<and> (initial (hd cfgList'))\n      \\<and> (\\<exists> msg'. execution.minimalEnabled cfgList msgList msg' \n        \\<and> msg' \\<in> (set (drop (length msgList ) msgList')) ))\"\nproof -\n  have ReachImplAgree: \"\\<forall> cfg . reachable (last cfgList) cfg \n    \\<longrightarrow> agreement cfg\"\n    using Agreement Init NonUni ReachableTrans\n    unfolding agreementInit_def agreement_def initReachable_def\n    by (metis (full_types))\n  have \"\\<exists> msg p. enabled (last cfgList) msg \\<and> isReceiverOf p msg\" \n  proof -\n    from PseudoTermination NonUni have \n      \"\\<exists>c'. qReachable (last cfgList) Proc c' \\<and> decided c'\" \n      using terminationPseudo_def by auto\n      then obtain c' where C': \"reachable (last cfgList) c'\" \n        \"decided c'\" \n        using QReachImplReach by blast \n    have NoOut: \n      \"0 = msgs (last cfgList) <\\<bottom>, outM False>\"  \n      \"0 = msgs (last cfgList) <\\<bottom>, outM True>\" \n      using NonUni ReachImplAgree PseudoTermination \n      by (metis NonUniformImpliesNotDecided neq0_conv)+\n    with C'(2) have \"(last cfgList) \\<noteq> c'\" \n      by (metis (full_types) less_zeroE)\n    thus ?thesis using C'(1) ReachableStepFirst by blast\n  qed\n  then obtain msg p where Enabled: \n    \"enabled (last cfgList) msg\" \"isReceiverOf p msg\" by blast\n  hence \"\\<exists> msg . execution.minimalEnabled cfgList msgList msg\" \n    using Init execution.ExistImpliesMinEnabled[OF Execution] by auto        \n  then obtain msg' where MinEnabledMsg: \n    \"execution.minimalEnabled cfgList msgList msg'\" by blast\n  hence \"\\<exists> p' . isReceiverOf p' msg'\"\n    using Execution\n    by (auto simp add: execution.minimalEnabled_def)\n  then obtain p' where\n    P': \"isReceiverOf p' msg'\" by blast\n  hence Enabled':\n    \"enabled (last cfgList) msg'\" \"isReceiverOf p' msg'\" \n    using MinEnabledMsg Execution\n    by (auto simp add: execution.minimalEnabled_def)     \n  have \"\\<exists> exec' trace' . (execution trans sends start exec' trace') \n    \\<and> nonUniform (last exec')\n    \\<and> prefixList cfgList exec' \\<and> prefixList msgList trace' \n    \\<and> (\\<forall> cfg . reachable (last exec') cfg \\<longrightarrow> agreement cfg)\n    \\<and> stepReachable (last cfgList) msg' (last exec') \n    \\<and> (msg' \\<in> set (drop (length msgList) trace')) \"\n    using NonUniformExecutionsConstructable[OF Enabled' Execution\n          NonUni] ReachImplAgree by auto\n  thus ?thesis\n    using MinEnabledMsg by (metis execution.base)\nqed\n\nsubsection \\<open>Non-uniformity even when demanding fairness\\<close>\n\ntext \\<open>\n  Using \\isb{NonUniformExecutionBase} and \\isb{NonUniformExecutionStep} one can obtain\n  non-uniform executions which are fair.\n\n  Proving the fairness turned out quite cumbersome.\n\\<close>\n\ntext \\<open>\n  These two functions construct infinite series of configurations lists\n  and message lists from two extension functions. \n\\<close>\nfun infiniteExecutionCfg ::\n  \"('p, 'v, 's) configuration \\<Rightarrow>\n   (('p, 'v, 's) configuration list \\<Rightarrow> ('p, 'v) message list \n    \\<Rightarrow> ('p, 'v, 's) configuration list) \\<Rightarrow>\n   (('p, 'v, 's) configuration list \\<Rightarrow> ('p, 'v) message list \n    \\<Rightarrow>('p, 'v) message list) \n  \\<Rightarrow> nat\n  \\<Rightarrow> (('p, 'v, 's) configuration list)\"\nand  infiniteExecutionMsg ::\n  \"('p, 'v, 's) configuration \\<Rightarrow>\n   (('p, 'v, 's) configuration list \\<Rightarrow> ('p, 'v) message list \n    \\<Rightarrow> ('p, 'v, 's) configuration list) \\<Rightarrow>\n   (('p, 'v, 's) configuration list \\<Rightarrow> ('p, 'v) message list \n    \\<Rightarrow>('p, 'v) message list) \n  \\<Rightarrow> nat\n  \\<Rightarrow> ('p, 'v) message list\"\nwhere\n  \"infiniteExecutionCfg cfg fStepCfg fStepMsg 0 = [cfg]\"\n| \"infiniteExecutionCfg cfg fStepCfg fStepMsg (Suc n) =\n    fStepCfg (infiniteExecutionCfg cfg fStepCfg fStepMsg n) \n             (infiniteExecutionMsg cfg fStepCfg fStepMsg n)\"\n| \"infiniteExecutionMsg cfg fStepCfg fStepMsg 0 = []\"\n| \"infiniteExecutionMsg cfg fStepCfg fStepMsg (Suc n) =\n    fStepMsg (infiniteExecutionCfg cfg fStepCfg fStepMsg n) \n             (infiniteExecutionMsg cfg fStepCfg fStepMsg n)\"\n\nlemma FairNonUniformExecution:\nfixes\n  cfg\nassumes\n  Cfg: \"initial cfg\" \"nonUniform cfg\"\nshows \"\\<exists> fe ft.\n  (fe 0) = [cfg]\n  \\<and> fairInfiniteExecution fe ft\n  \\<and> (\\<forall> n . nonUniform (last (fe n))\n       \\<and> prefixList (fe n) (fe (n+1)) \n       \\<and> prefixList (ft n) (ft (n+1))\n       \\<and> (execution trans sends start (fe n) (ft n)))\"\nproof -\n  have BC: \n    \"execution trans sends start [cfg] [] \n    \\<and> nonUniform (last [cfg]) \n    \\<and> (\\<exists> cfgList' msgList'.  nonUniform (last cfgList') \n    \\<and> prefixList [cfg] cfgList' \n    \\<and> prefixList [] msgList'\n    \\<and> (execution trans sends start cfgList' msgList')\n    \\<and> (\\<exists> msg'. execution.minimalEnabled [cfg] [] msg' \n       \\<and> msg' \\<in> set msgList'))\"\n    using NonUniformExecutionBase[OF assms] .\n  \\<comment> \\<open>fStep ... a step leading to a fair execution.\\<close> \n  obtain fStepCfg fStepMsg where FStep: \"\\<forall> cfgList msgList . \\<exists>cfgList' msgList' .\n          fStepCfg cfgList msgList = cfgList' \\<and>\n          fStepMsg cfgList msgList = msgList' \\<and>\n          (initial (hd cfgList) \\<and>\n          nonUniform (last cfgList) \\<and>\n          execution trans sends start cfgList msgList \\<longrightarrow> \n          (nonUniform (last (fStepCfg cfgList msgList)) \n          \\<and> prefixList cfgList (fStepCfg cfgList msgList) \n          \\<and> prefixList msgList (fStepMsg cfgList msgList) \n          \\<and> execution trans sends start (fStepCfg cfgList msgList) \n              (fStepMsg cfgList msgList) \n          \\<and> (initial (hd (fStepCfg cfgList msgList)))\n          \\<and> (\\<exists> msg'. execution.minimalEnabled cfgList msgList msg' \n            \\<and> msg' \\<in> (set (drop (length msgList) \n                                (fStepMsg cfgList msgList))))))\"\n   using NonUniformExecutionStep\n      PredicatePairFunctions2[of \n        \"\\<lambda> cfgList msgList cfgList' msgList'. \n          (initial (hd cfgList) \n          \\<and> nonUniform (last cfgList) \n          \\<and> execution trans sends start cfgList msgList \n            \\<longrightarrow> (nonUniform (last cfgList') \n            \\<and> prefixList cfgList cfgList' \n            \\<and> prefixList msgList msgList' \n            \\<and> execution trans sends start cfgList' msgList'\n            \\<and> (initial (hd cfgList'))\n            \\<and> (\\<exists> msg'. execution.minimalEnabled cfgList msgList msg' \n              \\<and> msg' \\<in> (set (drop (length msgList ) msgList')))))\" \"False\"] by auto\n  define fe ft\n    where \"fe = infiniteExecutionCfg cfg fStepCfg fStepMsg\"\n      and \"ft = infiniteExecutionMsg cfg fStepCfg fStepMsg\"\n  \n  have BasicProperties: \"(\\<forall>n. nonUniform (last (fe n)) \n    \\<and> prefixList (fe n) (fe (n + 1)) \\<and> prefixList (ft n) (ft (n + 1)) \n    \\<and> execution trans sends start (fe n) (ft n) \n    \\<and> initial (hd (fe (n + 1))))\"\n  proof (clarify)\n    fix n\n    show \"nonUniform (last (fe n)) \\<and>\n          prefixList (fe n) (fe (n + (1::nat))) \n          \\<and> prefixList (ft n) (ft (n + (1::nat))) \n          \\<and> execution trans sends start (fe n) (ft n) \n          \\<and> initial (hd (fe (n + 1)))\"\n    proof(induct n)\n      case 0\n      hence \"fe 0 = [cfg]\" \"ft 0 = []\" \"fe 1 = fStepCfg (fe 0) (ft 0)\" \n        \"ft 1 = fStepMsg (fe 0) (ft 0)\"\n        using fe_def ft_def\n        by simp_all\n      thus ?case\n        using BC FStep\n        by (simp, metis execution.base)\n    next\n      case (Suc n)\n        thus ?case\n        using fe_def ft_def\n        by (auto, (metis FStep execution.base)+)\n    qed\n  qed\n  have Fair: \"fairInfiniteExecution fe ft\" \n    using BasicProperties\n    unfolding fairInfiniteExecution_def infiniteExecution_def \n      execution_def flpSystem_def\n  proof(auto simp add: finiteProcs minimalProcs finiteSends noInSends) \n    fix n n0 p msg\n    assume AssumptionFair: \"\\<forall>n. initReachable (last (fe n)) \\<and>\n       \\<not> vUniform False (last (fe n)) \\<and>\n       \\<not> vUniform True (last (fe n)) \\<and>\n       prefixList (fe n) (fe (Suc n)) \\<and>\n       prefixList (ft n) (ft (Suc n)) \\<and>\n       Suc 0 \\<le> length (fe n) \\<and>\n       length (fe n) - Suc 0 = length (ft n) \\<and>\n       initial (hd (fe n)) \\<and> \n       (\\<forall>i<length (fe n) - Suc 0. ((fe n ! i) \\<turnstile> (ft n ! i) \n       \\<mapsto> (fe n ! Suc i))) \\<and> initial (hd (fe (Suc n)))\"\n      \"n0 < length (fe n)\"\n      \"enabled (fe n ! n0) msg\" \n      \"isReceiverOf p msg\" \n      \"correctInfinite fe ft p\"\n    have MessageStaysOrConsumed: \"\\<And> n n1 n2 msg. \n      (n1 \\<le> n2 \\<and> n2 < length (fe n) \\<and> (enabled (fe n ! n1) msg)) \n      \\<longrightarrow> (enabled (fe n ! n2) msg) \n          \\<or> (\\<exists> n0' \\<ge> n1. n0' < length (ft n) \\<and> ft n ! n0' = msg)\"\n    proof(auto)\n      fix n n1 n2 msg\n      assume Ass: \"n1 \\<le> n2\" \"n2 < length (fe n)\" \"enabled (fe n ! n1) msg\"\n        \"\\<forall>index<length (ft n). n1 \\<le> index \\<longrightarrow> ft n ! index \\<noteq> msg\"\n      have \"\\<forall> k \\<le> n2 - n1 . \n        msgs (fe n ! n1) msg \\<le> msgs (fe n ! (n1 + k)) msg\" \n      proof(auto)\n        fix k\n        show \"k \\<le> n2 - n1 \\<Longrightarrow> \n          msgs (fe n ! n1) msg \\<le> msgs (fe n ! (n1 + k)) msg\"\n        proof(induct k, auto)\n          fix k\n          assume IV: \"msgs (fe n ! n1) msg \\<le> msgs (fe n ! (n1 + k)) msg\" \n            \"Suc k \\<le> n2 - n1\"\n          from BasicProperties have Exec: \n            \"execution trans sends start (fe n) (ft n)\" by blast\n          have \"n2 \\<le> length (ft n)\"\n            using Exec Ass(2)\n            execution.length[of trans sends start \"fe n\" \"ft n\"]\n            by simp\n          hence RightIndex: \"n1 + k \\<ge> n1 \\<and> n1 + k < length (ft n)\"\n            using IV(2) by simp\n          have  Step: \"(fe n ! (n1 + k)) \\<turnstile> (ft n ! (n1 + k)) \n                      \\<mapsto> (fe n ! Suc (n1 + k))\" \n            using Exec execution.step[of trans sends start \"fe n\" \"ft n\" \n              \"n1 + k\" \"fe n ! (n1 + k)\" \"fe n ! (n1 + k + 1)\"] IV(2) \n              Ass(2) \n            by simp\n          hence \"msg \\<noteq> (ft n ! (n1 + k))\" \n            using Ass(4) Ass(2) IV(2) RightIndex Exec \n            execution.length[of trans sends start \"fe n\" \"ft n\"]\n            by blast\n          thus \"msgs (fe n ! n1) msg \\<le> msgs (fe n ! Suc (n1 + k)) msg\" \n            using Step OtherMessagesOnlyGrowing[of \"(fe n ! (n1 + k))\" \n              \"(ft n ! (n1 + k))\" \"(fe n ! Suc (n1 + k))\" \"msg\"] IV(1)\n            by simp\n        qed\n      qed\n      hence \"msgs (fe n ! n1) msg \\<le> msgs (fe n ! n2) msg\" \n        by (metis Ass(1) le_add_diff_inverse order_refl)\n      thus \"enabled (fe n ! n2) msg\" using Ass(3) enabled_def \n        by (metis gr0I leD)\n    qed\n    have EnabledOrConsumed: \"enabled (fe n ! (length (fe n) - 1)) msg \n      \\<or> (\\<exists>n0'\\<ge>n0. n0' < length (ft n) \\<and> ft n ! n0' = msg)\" \n      using AssumptionFair(3) AssumptionFair(2) \n        MessageStaysOrConsumed[of \"n0\" \"length (fe n) - 1\" \"n\" \"msg\"] \n      by auto\n    have EnabledOrConsumedAtLast: \"enabled (last (fe n)) msg \\<or> \n      (\\<exists> n0' . n0' \\<ge> n0 \\<and> n0' < length (ft n) \\<and> (ft n) ! n0' = msg )\"\n      using EnabledOrConsumed last_conv_nth AssumptionFair(2) \n      by (metis length_0_conv less_nat_zero_code)\n    have Case2ImplThesis: \"(\\<exists> n0' . n0' \\<ge> n0 \\<and> n0' < length (ft n) \n      \\<and> ft n ! n0' = msg) \n      \\<Longrightarrow> (\\<exists>n'\\<ge>n. \\<exists>n0'\\<ge>n0. n0' < length (ft n') \\<and> msg = ft n' ! n0')\"\n      by auto\n    have Case1ImplThesis': \"enabled (last (fe n)) msg \n      \\<longrightarrow> (\\<exists>n'\\<ge>n. \\<exists>n0'\\<ge> (length (ft n)). n0' < length (ft n') \n          \\<and> msg = ft n' ! n0')\" \n    proof(clarify)\n      assume AssumptionCase1ImplThesis': \"enabled (last (fe n)) msg\"\n      show \"\\<exists>n'\\<ge>n. \\<exists>n0'\\<ge>length (ft n). n0' < length (ft n') \n        \\<and> msg = ft n' ! n0'\" \n      proof(rule ccontr,simp)\n        assume AssumptionFairContr: \"\\<forall>n'\\<ge>n. \\<forall>n0'<length (ft n'). \n          length (ft n) \\<le> n0' \\<longrightarrow> msg \\<noteq> ft n' ! n0'\"\n        define firstOccSet where \"firstOccSet n = { msg1 . \\<exists> nMsg . \n          \\<exists> n1 \\<le> nMsg . \n          execution.firstOccurrence (fe n) (ft n) msg1 n1 \n          \\<and> execution.firstOccurrence (fe n) (ft n) msg nMsg }\" for n\n        have NotEmpty: \"fe n \\<noteq> []\" using  AssumptionFair(2) \n          by (metis less_nat_zero_code list.size(3))\n        have FirstToLast': \n          \"\\<forall> n . reachable ((fe n) ! 0) ((fe n) ! (length (fe n) - 1))\"\n          using execution.ReachableInExecution BasicProperties execution.notEmpty\n          by (metis diff_less less_or_eq_imp_le not_gr0 not_one_le_zero)\n        hence FirstToLast: \"\\<forall> n . reachable (hd (fe n)) (last (fe n))\" \n          using NotEmpty hd_conv_nth last_conv_nth AssumptionFair(1) \n          by (metis (full_types) One_nat_def length_0_conv \n            not_one_le_zero)\n        hence InitToLast: \"\\<forall> n . initReachable (last (fe n))\" \n          using BasicProperties by auto\n        have \"\\<And> msg n0 . \\<forall> n . \n          (execution.firstOccurrence (fe n) (ft n) msg n0) \n          \\<longrightarrow>  0 < msgs (last (fe n)) msg\"\n          using BasicProperties execution.firstOccurrence_def \n            enabled_def\n          by metis\n        hence \"\\<forall> n . \\<forall> msg' \\<in> (firstOccSet n) . \n          0 < msgs (last (fe n)) msg'\" using firstOccSet_def by blast\n        hence \"\\<forall> n . firstOccSet n \\<subseteq> {msg. 0 < msgs (last (fe n)) msg}\"\n          by (metis (lifting, full_types) mem_Collect_eq subsetI)\n        hence FiniteMsgs: \"\\<forall> n . finite (firstOccSet n)\" \n          using FiniteMessages[OF finiteProcs finiteSends] InitToLast\n          by (metis rev_finite_subset)\n        have FirstOccSetDecrOrConsumed: \"\\<forall> index . \n          (enabled (last (fe index)) msg) \n          \\<longrightarrow> (firstOccSet (Suc index) \\<subset> firstOccSet index \n          \\<and> (enabled (last (fe (Suc index))) msg)\n            \\<or> msg \\<in> (set (drop (length (ft index)) (ft (Suc index)))))\"\n        proof(clarify)\n          fix index\n          assume AssumptionFirstOccSetDecrOrConsumed:\n            \"enabled (last (fe index)) msg\" \n            \"msg \\<notin> set (drop (length (ft index)) (ft (Suc index)))\"\n          have NotEmpty: \"fe (Suc index) \\<noteq> []\" \"fe index \\<noteq> []\" \n            using BasicProperties \n            by (metis AssumptionFair(1) One_nat_def list.size(3) \n              not_one_le_zero)+\n          have LengthStep: \"length (ft (Suc index)) > length (ft index)\"\n            using AssumptionFair(1) \n            by (metis PrefixListMonotonicity)              \n          have IPrefixList:\n            \"\\<forall> i::nat . prefixList (ft i) (ft (Suc i))\" \n            using AssumptionFair(1) by auto\n          have IPrefixListEx:\n            \"\\<forall> i::nat . prefixList (fe i) (fe (Suc i))\" \n            using AssumptionFair(1) by auto\n          have LastOfIndex:\n            \"(fe (Suc index) ! (length (fe index) - Suc 0)) \n            = (last (fe index))\"\n            using PrefixSameOnLow[of \"fe index\" \"fe (Suc index)\"]\n              IPrefixListEx[rule_format, of index]\n              NotEmpty LengthStep \n            by (auto simp add: last_conv_nth)\n          have NotConsumedIntermediate: \n            \"\\<forall> i::nat < length (ft (Suc index)) . \n              (i \\<ge> length (ft index)\n              \\<longrightarrow> ft (Suc index) ! i \\<noteq> msg)\" \n            using AssumptionFirstOccSetDecrOrConsumed(2) ListLenDrop \n            by auto\n          hence \n            \"\\<not>(\\<exists>i. i < length (ft (Suc index)) \\<and> i \\<ge> length (ft index)\n            \\<and> msg = (ft (Suc index)) ! i)\" \n            using execution.length BasicProperties\n            by auto\n          hence \"\\<not>(\\<exists>i. i < length (fe (Suc index)) - 1 \n            \\<and> i \\<ge> length (fe index) - 1 \n            \\<and> msg = (ft (Suc index)) ! i)\"\n            using BasicProperties[rule_format, of \"Suc index\"]\n              BasicProperties[rule_format, of \"index\"]\n              execution.length[of trans sends start]\n            by auto\n          hence EnabledIntermediate: \n            \"\\<forall> i < length (fe (Suc index)) . (i \\<ge> length (fe index) - 1\n              \\<longrightarrow> enabled (fe (Suc index) ! i) msg)\" \n            using BasicProperties[rule_format, of \"Suc index\"]\n              BasicProperties[rule_format, of \"index\"]\n              execution.StaysEnabled[of trans sends start\n              \"fe (Suc index)\" \"ft (Suc index)\" \"last (fe index)\" msg \n              \"length (fe index) - 1 \"]\n              AssumptionFirstOccSetDecrOrConsumed(1)\n            by (auto, metis AssumptionFair(1) LastOfIndex \n              MessageStaysOrConsumed)\n          have \"length (fe (Suc index)) - 1 \\<ge> length (fe index) - 1\"\n            using PrefixListMonotonicity NotEmpty BasicProperties \n            by (metis AssumptionFair(1) diff_le_mono less_imp_le)\n          hence \"enabled (fe (Suc index) \n            ! (length (fe (Suc index)) - 1)) msg\"\n            using EnabledIntermediate NotEmpty(1) \n            by (metis diff_less length_greater_0_conv zero_less_one)\n          hence EnabledInSuc: \"enabled (last (fe (Suc index))) msg\" \n            using NotEmpty last_conv_nth[of \"fe (Suc index)\"] by simp\n          have IndexIsExec: \n            \"execution trans sends start (fe index) (ft index)\" \n            using BasicProperties by blast\n          have SucIndexIsExec: \n            \"execution trans sends start (fe (Suc index)) \n              (ft (Suc index))\" \n            using BasicProperties by blast\n          have SameCfgOnLow: \"\\<forall> i < length (fe index) . (fe index) ! i\n            = (fe (Suc index)) ! i\"\n            using BasicProperties PrefixSameOnLow by auto\n          have SameMsgOnLow: \"\\<forall> i < length (ft index) . (ft index) ! i\n            = (ft (Suc index)) ! i\"\n            using BasicProperties PrefixSameOnLow by auto\n          have SmallIndex: \"\\<And> nMsg . execution.firstOccurrence\n            (fe (Suc index)) (ft (Suc index)) msg nMsg \n            \\<Longrightarrow> nMsg < length (fe index)\" \n          proof(-)\n            fix nMsg\n            assume \"execution.firstOccurrence (fe (Suc index)) \n              (ft (Suc index)) msg nMsg\"\n            hence AssumptionSubset3: \n              \"\\<exists>p. isReceiverOf p msg\"\n                \"enabled (last (fe (Suc index))) msg\"\n                \"nMsg < length (fe (Suc index))\"\n                \"enabled (fe (Suc index) ! nMsg) msg\"\n                \"\\<forall>n'\\<ge>nMsg. n' < length (ft (Suc index)) \n                \\<longrightarrow> msg \\<noteq> ft (Suc index) ! n'\"\n                \"nMsg \\<noteq> 0 \\<longrightarrow> \\<not> enabled (fe (Suc index) ! (nMsg - 1)) \n                msg \\<or> msg = ft (Suc index) ! (nMsg - 1)\"\n              using execution.firstOccurrence_def[of \"trans\" \"sends\" \n                \"start\" \"fe (Suc index)\" \"ft (Suc index)\" \"msg\" \"nMsg\"]\n                SucIndexIsExec by auto\n            show \"nMsg < length (fe index)\"\n            proof(rule ccontr)\n              assume AssumpSmallIndex: \"\\<not> nMsg < length (fe index)\"\n              have \"fe index \\<noteq> []\" using BasicProperties \n                AssumptionFair(1)\n                by (metis One_nat_def list.size(3) not_one_le_zero)\n              hence \"length (fe index) > 0\" \n                by (metis length_greater_0_conv)\n              hence nMsgNotZero: \"nMsg \\<noteq> 0\" \n                using AssumpSmallIndex by metis\n              hence SucCases: \"\\<not> enabled ((fe (Suc index)) ! (nMsg - 1))\n                msg \\<or> msg = (ft (Suc index)) ! (nMsg - 1)\"\n                using AssumptionSubset3(6) by blast\n              have Cond1: \"nMsg - 1 \\<ge> length (fe index) - 1\"\n                using AssumpSmallIndex by (metis diff_le_mono leI)\n              hence Enabled: \"enabled (fe (Suc index) ! (nMsg - 1)) msg\"\n                using EnabledIntermediate AssumptionSubset3(3) \n                by (metis less_imp_diff_less)\n              have Cond2: \"nMsg - 1 \\<ge> length (ft index) \\<and> nMsg - 1\n                < length (ft (Suc index))\"\n                using Cond1 execution.length[of \"trans\" \"sends\" \"start\"\n                  \"fe index\" \"ft index\"]\n                  IndexIsExec AssumptionSubset3(3) \n                  by (simp, metis AssumptionFair(1) One_nat_def Suc_diff_1 \n                    Suc_eq_plus1 less_diff_conv nMsgNotZero neq0_conv)\n              hence NotConsumed: \"ft (Suc index) ! (nMsg - 1) \\<noteq> msg\" \n                using NotConsumedIntermediate by simp\n              show False using SucCases Enabled NotConsumed\n              by blast\n            qed\n          qed\n          have Subset: \"\\<And> msgInSet . msgInSet \\<in> firstOccSet (Suc index)\n            \\<Longrightarrow> msgInSet \\<in> firstOccSet index\" \n          unfolding firstOccSet_def\n          proof(auto)\n            fix msgInSet nMsg n1\n            assume AssumptionSubset: \"n1 \\<le> nMsg\"\n              \"execution.firstOccurrence (fe (Suc index)) \n                (ft (Suc index)) msgInSet n1\"\n              \"execution.firstOccurrence (fe (Suc index)) \n                (ft (Suc index)) msg nMsg\"\n            have AssumptionSubset2: \n              \"\\<exists>p. isReceiverOf p msgInSet\"\n                \"enabled (last (fe (Suc index))) msgInSet\"\n                \"n1 < length (fe (Suc index))\"\n                \"enabled (fe (Suc index) ! n1) msgInSet\"\n                \"\\<forall>n'\\<ge>n1. n' < length (ft (Suc index)) \n                  \\<longrightarrow> msgInSet \\<noteq> ft (Suc index) ! n'\"\n                \"n1 \\<noteq> 0 \\<longrightarrow> \\<not> enabled (fe (Suc index) ! (n1 - 1)) \n                  msgInSet \\<or> msgInSet = ft (Suc index) ! (n1 - 1)\"\n              using execution.firstOccurrence_def[of \"trans\" \"sends\" \n                \"start\" \"fe (Suc index)\" \"ft (Suc index)\" \"msgInSet\" \n                \"n1\"] AssumptionSubset(2) SucIndexIsExec by auto \n            have AssumptionSubset3: \n              \"\\<exists>p. isReceiverOf p msg\"\n                \"enabled (last (fe (Suc index))) msg\"\n                \"nMsg < length (fe (Suc index))\"\n                \"enabled (fe (Suc index) ! nMsg) msg\"\n                \"\\<forall>n'\\<ge>nMsg. n' < length (ft (Suc index)) \n                  \\<longrightarrow> msg \\<noteq> ft (Suc index) ! n'\"\n                \"nMsg \\<noteq> 0 \\<longrightarrow> \\<not> enabled (fe (Suc index) ! (nMsg - 1)) \n                  msg \\<or> msg = ft (Suc index) ! (nMsg - 1)\"\n              using execution.firstOccurrence_def[of \"trans\" \"sends\" \n                \"start\" \"fe (Suc index)\" \"ft (Suc index)\" \"msg\" \"nMsg\"]\n                AssumptionSubset(3) SucIndexIsExec by auto\n            have ShorterTrace: \"length (ft index) \n                                < length (ft (Suc index))\" \n              using PrefixListMonotonicity BasicProperties by auto\n\n            have FirstOccurrenceMsg: \"execution.firstOccurrence \n              (fe index) (ft index) msg nMsg\"\n            proof-\n              have Occ1: \"\\<exists> p . isReceiverOf p msg\" \n                using AssumptionSubset3(1) by blast\n              have Occ2: \"enabled (last (fe index)) msg\" \n                using AssumptionFirstOccSetDecrOrConsumed by blast\n\n              have \"(fe index) ! nMsg = (fe (Suc index)) ! nMsg\"\n                using SmallIndex AssumptionSubset(3) \n                  PrefixSameOnLow[of \"fe index\" \"fe (Suc index)\"] \n                  BasicProperties \n                by simp\n              hence Occ4: \"enabled ((fe index) ! nMsg) msg\" \n                using AssumptionSubset3(4) by simp\n              have OccSameMsg: \"\\<forall> n' \\<ge> nMsg . n' < length (ft index) \n                \\<longrightarrow> (ft index) ! n' = (ft (Suc index)) ! n'\" \n                using PrefixSameOnLow BasicProperties by auto\n              hence Occ5: \"\\<forall> n' \\<ge> nMsg . n' < length (ft index) \n                \\<longrightarrow> msg \\<noteq> ((ft index) ! n')\" \n                using AssumptionSubset3(5) ShorterTrace by simp\n\n              have Occ6: \"nMsg \\<noteq> 0 \\<longrightarrow> (\\<not> enabled ((fe index) ! \n                (nMsg - 1)) msg \\<or> msg = (ft index ) ! (nMsg - 1))\" \n              proof(clarify)\n                assume AssumpOcc6: \"0 < nMsg\" \"msg \\<noteq> ft index ! \n                  (nMsg - 1)\" \"enabled (fe index ! (nMsg - 1)) msg\"\n                have \"nMsg - (Suc 0) < length (fe index) - (Suc 0)\" \n                  using SmallIndex AssumptionSubset(3) AssumpOcc6(1) \n                  by (metis Suc_le_eq diff_less_mono)\n                hence SmallIndexTrace: \"nMsg - 1 < length (ft index)\" \n                  using IndexIsExec execution.length \n                  by (metis One_nat_def)\n                have \"\\<not> enabled (fe (Suc index) ! (nMsg - 1)) msg \n                  \\<or> msg = ft (Suc index) ! (nMsg - 1)\"\n                  using AssumptionSubset3(6) AssumpOcc6(1) by blast\n                moreover have \"fe (Suc index) ! (nMsg - 1) \n                  = fe index ! (nMsg - 1)\"\n                  using SameCfgOnLow SmallIndex AssumptionSubset(3) \n                  by (metis less_imp_diff_less)\n                moreover have \"ft (Suc index) ! (nMsg - 1) \n                  = ft index ! (nMsg - 1)\"\n                  using SameMsgOnLow SmallIndexTrace by metis \n                ultimately have \"\\<not> enabled (fe index ! (nMsg - 1)) msg \n                  \\<or> msg = ft index ! (nMsg - 1)\"\n                  by simp\n                thus False using AssumpOcc6 by blast\n              qed\n\n              show ?thesis using IndexIsExec Occ1 Occ2 SmallIndex \n                AssumptionSubset(3) Occ4 Occ5 Occ6\n                execution.firstOccurrence_def[of \"trans\" \"sends\" \"start\"\n                  \"fe index\" \"ft index\"]\n                by simp \n            qed\n\n            have \"execution.firstOccurrence (fe index) (ft index) \n              msgInSet n1\" \n              using AssumptionSubset2 AssumptionSubset(1)\n            proof-\n              have Occ1': \"\\<exists>p. isReceiverOf p msgInSet\" \n                using AssumptionSubset2(1) by blast                 \n              have Occ3': \"n1 < length (fe index)\" \n                using SmallIndex AssumptionSubset(3) AssumptionSubset(1)\n                by (metis le_less_trans)\n              have \"(fe index) ! n1 = (fe (Suc index)) ! n1\"\n                using Occ3' PrefixSameOnLow[of \"fe index\" \n                  \"fe (Suc index)\"] BasicProperties by simp\n              hence Occ4': \"enabled (fe index ! n1) msgInSet\" \n                using AssumptionSubset2(4) by simp\n              have OccSameMsg': \"\\<forall> n' \\<ge> n1 . n' < length (ft index) \n                \\<longrightarrow> (ft index) ! n' = (ft (Suc index)) ! n'\" \n                using PrefixSameOnLow BasicProperties by auto\n              hence Occ5': \"\\<forall>n' \\<ge> n1. n' < length (ft index) \n                \\<longrightarrow> msgInSet \\<noteq> ft index ! n'\" \n                using AssumptionSubset2(5) ShorterTrace by simp\n              have \"length (fe index) > 0\" using NotEmpty(2) \n                by (metis length_greater_0_conv)\n              hence \"length (fe index) - 1 < length (fe index)\" \n                by (metis One_nat_def diff_Suc_less)                  \n              hence \n                \"enabled (fe index ! (length (fe index) - 1)) msgInSet\n                \\<or> (\\<exists>n0'\\<ge>n1. n0' < length (ft index) \\<and> ft index ! n0'\n                  = msgInSet)\"\n                using Occ4' Occ3' MessageStaysOrConsumed[of \"n1\" \n                  \"length (fe index) - 1\" \"index\" \"msgInSet\"]\n                by (metis Suc_pred' \\<open>0 < length (fe index)\\<close> \n                  not_le not_less_eq_eq)\n              hence \"enabled ((fe index) ! (length (fe index) - 1)) \n                msgInSet\" \n                using Occ5' by auto\n              hence Occ2': \"enabled (last (fe index)) msgInSet\" \n                using last_conv_nth[of \"fe index\"] NotEmpty(2) by simp\n\n              have Occ6': \"n1 \\<noteq> 0 \\<longrightarrow> \\<not> enabled (fe index ! (n1 - 1)) \n                msgInSet \\<or> msgInSet = ft index ! (n1 - 1)\"\n              proof(clarify)\n                assume AssumpOcc6': \"0 < n1\" \"msgInSet \\<noteq> ft index ! \n                  (n1 - 1)\" \"enabled (fe index ! (n1 - 1)) msgInSet\"\n                have \"n1 - (Suc 0) < length (fe index) - (Suc 0)\" \n                  using Occ3' AssumpOcc6'(1) \n                  by (metis Suc_le_eq diff_less_mono)\n                hence SmallIndexTrace': \"n1 - 1 < length (ft index)\" \n                  using IndexIsExec execution.length \n                  by (metis One_nat_def)\n                have \"\\<not> enabled (fe (Suc index) ! (n1 - 1)) msgInSet \n                  \\<or> msgInSet = ft (Suc index) ! (n1 - 1)\"\n                  using AssumptionSubset2(6) AssumpOcc6'(1) by blast\n                moreover have \"fe (Suc index) ! (n1 - 1) \n                  = fe index ! (n1 - 1)\"\n                  using SameCfgOnLow Occ3' by (metis less_imp_diff_less)\n                moreover have \"ft (Suc index) ! (n1 - 1) \n                  = ft index ! (n1 - 1)\"\n                  using SameMsgOnLow SmallIndexTrace' by metis \n                ultimately have \"\\<not> enabled (fe index ! \n                  (n1 - 1)) msgInSet \\<or> msgInSet = ft index ! (n1 - 1)\"\n                  by simp\n                thus False using AssumpOcc6' by blast\n              qed\n\n              show ?thesis using IndexIsExec Occ1' Occ2' Occ3' Occ4' \n                Occ5' Occ6'\n                execution.firstOccurrence_def[of \"trans\" \"sends\" \n                  \"start\" \"fe index\" \"ft index\"]\n                by simp  \n            qed\n            \n            thus \"\\<exists>nMsg' n1'. n1' \\<le> nMsg' \n              \\<and> execution.firstOccurrence (fe index) (ft index) \n                msgInSet n1' \n              \\<and> execution.firstOccurrence (fe index) (ft index) \n                msg nMsg'\" \n              using FirstOccurrenceMsg AssumptionSubset(1) by blast\n          qed\n\n          have ProperSubset: \"\\<exists> msg' .msg' \\<in> firstOccSet index \n            \\<and> msg' \\<notin> firstOccSet (Suc index)\"\n          proof-               \n            have \"initial (hd (fe index))\" using AssumptionFair(1) \n              by blast\n            hence \"\\<exists>msg'. execution.minimalEnabled (fe index) (ft index)\n              msg' \\<and>  msg' \\<in> set (drop (length (ft index)) \n                (fStepMsg (fe index) (ft index)))\" \n              using FStep fe_def ft_def\n                BasicProperties by simp\n            then obtain consumedMsg where ConsumedMsg: \n              \"execution.minimalEnabled (fe index) (ft index) \n                consumedMsg\"\n              \"consumedMsg \\<in> set (drop (length (ft index)) \n                (fStepMsg (fe index) (ft index)))\" by blast\n            hence ConsumedIsInDrop:\n              \"consumedMsg \\<in> set (drop (length (ft index)) (ft (Suc index)))\"\n              using fe_def ft_def FStep\n                BasicProperties[rule_format, of index]\n              by auto\n            \n            have MinImplAllBigger: \"\\<And> msg' . execution.minimalEnabled\n            (fe index) (ft index) msg' \n             \\<longrightarrow> (\\<exists> OccM' . (execution.firstOccurrence (fe index) \n              (ft index) msg' OccM' )\n                \\<and> (\\<forall> msg . \\<forall> OccM . execution.firstOccurrence (fe index)\n                  (ft index) msg OccM \n                \\<longrightarrow> OccM' \\<le> OccM))\" \n            proof(auto)\n              fix msg'\n              assume AssumpMinImplAllBigger: \"execution.minimalEnabled \n                (fe index) (ft index) msg'\"\n              have IsExecIndex: \"execution trans sends start \n                (fe index) (ft index)\" \n                using  BasicProperties[rule_format, of index] by simp\n              have \"(\\<exists> p . isReceiverOf p msg') \\<and> \n                (enabled (last (fe index)) msg')\n                \\<and> (\\<exists> n .  n < length (fe index) \n                  \\<and> enabled ( (fe index) ! n) msg' \n                  \\<and> (\\<forall> n' \\<ge> n . n' < length (ft index) \n                  \\<longrightarrow> msg' \\<noteq> ((ft index)! n'))\n                  \\<and> (\\<forall> n' msg' . ((\\<exists> p . isReceiverOf p msg') \n                    \\<and> (enabled (last (fe index)) msg') \n                    \\<and> n' < length (ft index) \n                    \\<and> enabled ((fe index)! n') msg' \n                    \\<and> (\\<forall> n'' \\<ge> n' . n'' < length (ft index) \n                    \\<longrightarrow> msg' \\<noteq> ((ft index) ! n''))) \\<longrightarrow> n' \\<ge> n))\" \n              using execution.minimalEnabled_def[of trans sends start \n                \"(fe index)\" \"(ft index)\" msg'] \n                AssumpMinImplAllBigger IsExecIndex by auto\n              then obtain OccM' where OccM': \n                \"(\\<exists> p . isReceiverOf p msg')\" \n                \"(enabled (last (fe index)) msg')\"\n                \"OccM' < length (fe index)\" \n                \"enabled ( (fe index) ! OccM') msg'\"  \n                \"(\\<forall> n' \\<ge> OccM' . n' < length (ft index) \n                \\<longrightarrow> msg' \\<noteq> ((ft index)! n'))\"\n                \"(\\<forall> n' msg' . ((\\<exists> p . isReceiverOf p msg') \n                  \\<and> (enabled (last (fe index)) msg') \n                  \\<and> n' < length (ft index) \n                  \\<and> enabled ((fe index)! n') msg' \n                  \\<and> (\\<forall> n'' \\<ge> n' . n'' < length (ft index) \n                  \\<longrightarrow> msg' \\<noteq> ((ft index) ! n''))) \\<longrightarrow> n' \\<ge> OccM')\" \n                by blast                  \n              have \"0 < OccM' \\<Longrightarrow> enabled (fe index ! (OccM' - Suc 0)) msg' \n                      \\<Longrightarrow> msg' \\<noteq> ft index ! (OccM' - Suc 0) \\<Longrightarrow> False\"\n              proof(-)\n                fix p\n                assume AssumpContr: \n                  \"0 < OccM'\"\n                  \"enabled (fe index ! (OccM' - Suc 0)) msg'\"\n                  \"msg' \\<noteq> ft index ! (OccM' - Suc 0)\"\n                have LengthOccM': \"(OccM' - 1) < length (ft index)\" \n                using OccM'(3) IndexIsExec AssumpContr(1)   \n                  AssumptionFair(1)\n                  by (metis  One_nat_def Suc_diff_1 Suc_eq_plus1_left \n                    Suc_less_eq le_add_diff_inverse)\n                have BiggerIndices: \"(\\<forall>n''\\<ge>(OccM' - 1). \n                  n'' < length (ft index) \\<longrightarrow> msg' \\<noteq> ft index ! n'')\"\n                  using OccM'(5) by (metis AssumpContr(3) One_nat_def \n                      Suc_eq_plus1 diff_Suc_1 le_SucE le_diff_conv)\n                have \"(\\<exists>p. isReceiverOf p msg') \\<and> enabled (last \n                  (fe index)) msg' \\<and> (OccM' - 1) < length (ft index)\n                    \\<and> enabled (fe index ! (OccM' - 1)) msg' \n                    \\<and> (\\<forall>n''\\<ge>(OccM' - 1). n'' < length (ft index) \n                      \\<longrightarrow> msg' \\<noteq> ft index ! n'')\" \n                  using OccM' LengthOccM' AssumpContr BiggerIndices \n                  by simp\n                hence \"OccM' \\<le> OccM' - 1\" using OccM'(6) by blast \n                thus False using AssumpContr(1) diff_less leD zero_less_one by blast\n              qed\n              hence FirstOccMsg': \"execution.firstOccurrence (fe index)\n                  (ft index) msg' OccM'\"   \n                unfolding execution_def\n                  execution.firstOccurrence_def[OF IsExecIndex, of msg' OccM']\n                by (auto simp add: OccM'(1,2,3,4,5))\n              have \"\\<forall>msg OccM. execution.firstOccurrence (fe index) \n                (ft index) msg OccM \\<longrightarrow> OccM' \\<le> OccM\" \n              proof clarify\n                fix msg OccM\n                assume  \"execution.firstOccurrence (fe index) \n                  (ft index) msg OccM\"\n                hence AssumpOccMFirstOccurrence: \n                  \"\\<exists> p . isReceiverOf p msg\" \n                  \"enabled (last (fe index)) msg\" \n                  \"OccM < (length (fe index))\"\n                  \"enabled ((fe index) ! OccM) msg\" \n                  \"(\\<forall> n' \\<ge> OccM . n' < length (ft index) \n                  \\<longrightarrow> msg \\<noteq> ((ft index) ! n'))\"\n                  \"(OccM \\<noteq> 0 \\<longrightarrow> (\\<not> enabled ((fe index) ! (OccM - 1)) \n                  msg \\<or> msg = (ft index)!(OccM - 1)))\"\n                  by (auto simp add: execution.firstOccurrence_def[of \n                      trans sends start \"(fe index)\" \"(ft index)\" \n                      msg OccM] IsExecIndex)\n                hence \"(\\<exists>p. isReceiverOf p msg) \\<and>\n                  enabled (last (fe index)) msg \\<and>\n                  enabled (fe index ! OccM) msg \\<and> \n                  (\\<forall>n''\\<ge> OccM. n'' < length (ft index) \n                    \\<longrightarrow> msg \\<noteq> ft index ! n'')\" \n                 by simp\n                thus \"OccM' \\<le> OccM\" using OccM' \n                proof(cases \"OccM < length (ft index)\",auto)\n                  assume \"\\<not> OccM < length (ft index)\"\n                  hence \"OccM \\<ge> length (fe index) - 1\" \n                    using AssumptionFair(1) by (metis One_nat_def leI)\n                  hence \"OccM = length (fe index) - 1\"\n                    using AssumpOccMFirstOccurrence(3) by simp\n                  thus \"OccM' \\<le> OccM\" using OccM'(3) by simp\n                qed\n              qed\n              with FirstOccMsg' show \"\\<exists>OccM'. \n                execution.firstOccurrence (fe index) (ft index) \n                  msg' OccM' \n                \\<and> (\\<forall>msg OccM. execution.firstOccurrence (fe index) \n                  (ft index) msg OccM \\<longrightarrow> OccM' \\<le> OccM)\" by blast\n            qed\n\n            have MinImplFirstOcc: \"\\<And> msg' . execution.minimalEnabled \n              (fe index) (ft index) msg' \n              \\<Longrightarrow> msg' \\<in> firstOccSet index\"\n            proof -\n              fix msg'\n              assume AssumpMinImplFirstOcc: \n                \"execution.minimalEnabled (fe index) (ft index) msg'\"\n              then obtain OccM' where OccM': \n                \"execution.firstOccurrence (fe index) (ft index) \n                  msg' OccM'\"\n                \"\\<forall> msg . \\<forall> OccM . execution.firstOccurrence \n                (fe index) (ft index) msg OccM \n              \\<longrightarrow> OccM' \\<le> OccM\" using MinImplAllBigger by blast\n              thus \"msg' \\<in> firstOccSet index\" using OccM' \n              proof (auto simp add: firstOccSet_def)\n                have \"enabled (last (fe index)) msg\" \n                  using AssumptionFirstOccSetDecrOrConsumed(1) by blast\n                hence \"\\<exists>nMsg .  execution.firstOccurrence (fe index) \n                  (ft index) msg nMsg\"\n                  using execution.FirstOccurrenceExists IndexIsExec \n                  AssumptionFair(4) by blast\n                then obtain nMsg where NMsg: \"execution.firstOccurrence\n                  (fe index) (ft index) msg nMsg\" by blast\n                hence \"OccM' \\<le> nMsg\" using OccM' by simp\n                hence \"\\<exists>nMsg . OccM' \\<le> nMsg \\<and>\n                  execution.firstOccurrence (fe index) (ft index) msg'\n                    OccM' \\<and>\n                  execution.firstOccurrence (fe index) (ft index) msg \n                    nMsg\" \n                  using OccM'(1) NMsg by blast \n                thus \"\\<exists>nMsg n1 . n1 \\<le> nMsg \\<and>\n                  execution.firstOccurrence (fe index) (ft index) \n                    msg' n1 \\<and>\n                  execution.firstOccurrence (fe index) (ft index) \n                    msg nMsg\" by blast\n              qed\n            qed\n            hence ConsumedInSet: \"consumedMsg \\<in> firstOccSet index\" \n              using ConsumedMsg by simp\n            have GreaterOccurrence: \"\\<And> nMsg n1 . \n                execution.firstOccurrence (fe (Suc index)) \n                  (ft (Suc index)) consumedMsg n1 \\<and> \n                execution.firstOccurrence (fe (Suc index)) \n                  (ft (Suc index)) msg nMsg \n                \\<Longrightarrow> nMsg < n1\" \n            proof(rule ccontr,auto)\n              fix nMsg n1\n              assume AssumpGreaterOccurrence: \"\\<not> nMsg < n1\"\n                \"execution.firstOccurrence (fe (Suc index)) \n                  (ft (Suc index)) consumedMsg n1\"\n                \"execution.firstOccurrence (fe (Suc index)) \n                  (ft (Suc index)) msg nMsg\" \n              have \"nMsg < length (fe index)\" \n                using SmallIndex AssumpGreaterOccurrence(3) by simp\n              hence \"n1 < length (fe index)\" \n                using AssumpGreaterOccurrence(1) \n                by (metis less_trans nat_neq_iff)\n              hence N1Small: \"n1 \\<le> length (ft index)\" \n                using IndexIsExec AssumptionFair(1) \n                by (metis  One_nat_def Suc_eq_plus1 le_diff_conv2 \n                  not_le not_less_eq_eq)\n              have NotConsumed: \"\\<forall> i \\<ge> n1 . i < length (ft (Suc index))\n                \\<longrightarrow> consumedMsg \\<noteq> (ft (Suc index)) ! i\" \n                using execution.firstOccurrence_def[of \"trans\" \"sends\"\n                  \"start\" \"fe (Suc index)\" \"ft (Suc index)\" \n                  \"consumedMsg\" \"n1\"]\n                  AssumpGreaterOccurrence(2) SucIndexIsExec by auto\n              have \"\\<exists> i \\<ge> length (ft index) . \n                i < length (ft (Suc index)) \n                \\<and> consumedMsg = (ft (Suc index)) ! i\"\n                using DropToIndex[of \"consumedMsg\" \"length (ft index)\"]\n                ConsumedIsInDrop by simp\n              then obtain i where IDef: \"i \\<ge> length (ft index)\"\n                \"i < length (ft (Suc index))\" \n                \"consumedMsg = (ft (Suc index)) ! i\" by blast\n              thus False using NotConsumed N1Small by simp\n            qed\n            have \"consumedMsg \\<notin> firstOccSet (Suc index)\" \n            proof(clarify)\n              assume AssumpConsumedInSucSet: \n                \"consumedMsg \\<in> firstOccSet (Suc index)\"\n              hence \"\\<exists>nMsg n1. n1 \\<le> nMsg \\<and>\n                  execution.firstOccurrence (fe (Suc index)) \n                    (ft (Suc index)) consumedMsg n1 \\<and> \n                  execution.firstOccurrence (fe (Suc index)) \n                    (ft (Suc index)) msg nMsg\" \n                using firstOccSet_def by blast\n              thus False using GreaterOccurrence \n                by (metis less_le_trans less_not_refl3)\n            qed\n            thus ?thesis using ConsumedInSet by blast\n          qed\n\n          hence \"firstOccSet (Suc index) \\<subset> firstOccSet index\" \n            using Subset by blast\n          thus \"firstOccSet (Suc index) \\<subset> firstOccSet index \n            \\<and> enabled (last (fe (Suc index))) msg\"\n            using EnabledInSuc by blast\n        qed\n\n        have NotConsumed: \"\\<forall> index \\<ge> n . \\<not> msg \\<in> \n          (set (drop (length (ft index)) (ft (Suc index))))\"\n        proof(clarify)\n          fix index\n          assume AssumpMsgNotConsumed: \"n \\<le> index\" \n            \"msg \\<in> set (drop (length (ft index)) (ft (Suc index)))\"\n\n          have \"\\<exists> n0' \\<ge> length (ft index) . \n            n0' < length (ft (Suc index)) \n            \\<and> msg = (ft (Suc index)) ! n0'\" \n            using AssumpMsgNotConsumed(2) DropToIndex[of \"msg\" \n              \"length (ft index)\" \"ft (Suc index)\"] by auto\n          then obtain n0' where MessageIndex: \"n0' \\<ge> length (ft index)\" \n            \"n0' < length (ft (Suc index))\" \n            \"msg = (ft (Suc index)) ! n0'\" by blast\n          have LengthIncreasing: \"length (ft n) \\<le> length (ft index)\" \n            using AssumpMsgNotConsumed(1) \n          proof(induct index,auto)\n            fix indexa\n            assume AssumpLengthIncreasing: \n              \"n \\<le> indexa \\<Longrightarrow> length (ft n) \\<le> length (ft indexa)\" \n              \"n \\<le> Suc indexa\" \"n \\<le> index\"\n            show \"length (ft n) \\<le> length (ft (Suc indexa))\"\n            proof(cases \"n = Suc indexa\",auto)\n              assume \"n \\<noteq> Suc indexa\"\n              hence \"n \\<le> indexa\" using AssumpLengthIncreasing(2) \n                by (metis le_SucE)\n              hence LengthNA: \"length (ft n) \\<le> length (ft indexa)\" \n                using AssumpLengthIncreasing(1) by blast\n              have PrefixIndexA: \"prefixList (ft indexa) (ft (Suc indexa))\"\n                using BasicProperties by simp\n              show \"length (ft n) \\<le> length (ft (Suc indexa))\"\n                using LengthNA PrefixListMonotonicity[OF PrefixIndexA]\n                by (metis (hide_lams, no_types) antisym le_cases \n                  less_imp_le less_le_trans)\n            qed\n          qed\n          thus False using AssumptionFairContr MessageIndex \n            AssumpMsgNotConsumed(1) \n            by (metis \\<open>length (ft index) \\<le> n0'\\<close> le_SucI le_trans)\n        qed\n\n        hence FirstOccSetDecrImpl: \n          \"\\<forall> index \\<ge> n . (enabled (last (fe index)) msg) \n          \\<longrightarrow> firstOccSet (Suc index) \\<subset> firstOccSet index \n            \\<and> (enabled (last (fe (Suc index))) msg)\"\n          using FirstOccSetDecrOrConsumed by blast\n        hence FirstOccSetDecrImpl: \"\\<forall> index \\<ge> n . firstOccSet \n          (Suc index) \\<subset> firstOccSet index\"\n          using KeepProperty[of \"n\" \"\\<lambda>x.(enabled (last (fe x)) msg)\" \n            \"\\<lambda>x.(firstOccSet (Suc x) \\<subset> firstOccSet x)\"]\n            AssumptionCase1ImplThesis' by blast\n        hence FirstOccSetDecr': \"\\<forall> index \\<ge> n . \n          card (firstOccSet (Suc index)) < card (firstOccSet index)\"\n          using FiniteMsgs psubset_card_mono by metis\n        hence \"card (firstOccSet (n + (card (firstOccSet n) + 1))) \n          \\<le> card (firstOccSet n) - (card (firstOccSet n) + 1)\"\n          using SmallerMultipleStepsWithLimit[of \"n\" \n            \"\\<lambda>x. card (firstOccSet x)\" \"card (firstOccSet n) + 1\"]\n          by blast\n        hence IsNegative:\"card (firstOccSet (n + (card \n          (firstOccSet n) + 1))) < 0\" \n          by (metis FirstOccSetDecr' diff_add_zero leD le_add1 \n            less_nat_zero_code neq0_conv)\n        thus False by (metis less_nat_zero_code)\n      qed\n    qed\n\n    hence Case1ImplThesis: \"enabled (last (fe n)) msg \n      \\<Longrightarrow> (\\<exists>n'\\<ge>n. \\<exists>n0'\\<ge>n0. n0' < length (ft n') \\<and> msg = ft n' ! n0')\"\n      using AssumptionFair(2) execution.length[of trans sends start \n        \"fe n\" \"ft n\"] BasicProperties \n      by (metis One_nat_def Suc_eq_plus1 Suc_lessI leI le_less_trans \n        less_asym less_diff_conv)\n\n    show \"\\<exists>n'\\<ge>n. \\<exists>n0'\\<ge>n0. n0' < length (ft n') \\<and> msg = ft n' ! n0'\"\n    using disjE[OF EnabledOrConsumedAtLast Case1ImplThesis Case2ImplThesis] .\n  qed\n  show ?thesis proof (rule exI[of _ fe], rule exI[of _ ft])\n    show \"fe 0 = [cfg] \\<and> fairInfiniteExecution fe ft \n      \\<and> (\\<forall>n. nonUniform (last (fe n)) \\<and> prefixList (fe n) (fe (n + 1)) \n          \\<and> prefixList (ft n) (ft (n + 1))\n          \\<and> execution trans sends start (fe n) (ft n))\"\n    using Fair fe_def FStep BasicProperties by auto\n  qed\nqed\n\nsubsection \\<open>Contradiction\\<close>\n\ntext \\<open>\n  An infinite execution is said to be a terminating FLP execution if each process\n  at some point sends a decision message or if it stops, which is expressed\n  by the process not processing any further messages.\n\\<close>\ndefinition (in flpSystem) terminationFLP::\n  \"(nat \\<Rightarrow> ('p, 'v, 's) configuration list) \n  \\<Rightarrow> (nat \\<Rightarrow> ('p, 'v) message list) \\<Rightarrow> bool\"\nwhere\n  \"terminationFLP fe ft \\<equiv> infiniteExecution fe ft \\<longrightarrow> \n  (\\<forall> p . \\<exists> n .\n     (\\<exists> i0 < length (ft n). \\<exists> b . \n      (<\\<bottom>, outM b> \\<in># sends p (states ((fe n) ! i0) p) (unpackMessage ((ft n) ! i0)))\n      \\<and> isReceiverOf p ((ft n) ! i0))\n  \\<or> (\\<forall> n1 > n . \\<forall> m \\<in> set (drop (length (ft n)) (ft n1)) . \\<not> isReceiverOf p m))\"\n\n\n\n  have AllArePrefixesExec: \"\\<forall> m . \\<forall> n > m . prefixList (fe m) (fe n)\"\n  proof(clarify)\n    fix m::nat and n::nat\n    assume MLessN: \"m < n\"\n    have \"prefixList (fe m) (fe n)\" using MLessN \n    proof(induct n, simp)\n      fix n\n      assume IA: \"(m < n) \\<Longrightarrow> (prefixList (fe m) (fe n))\" \"m < (Suc n)\"\n      have \"m = n \\<or> m < n\" using IA(2) by (metis less_SucE)\n      thus \"prefixList (fe m) (fe (Suc n))\"\n      proof(cases \"m = n\", auto)\n        show \"prefixList (fe n) (fe (Suc n))\" using FE by simp\n      next\n        assume \"m < n\"\n        hence IA2: \"prefixList (fe m) (fe n)\" using IA(1) by simp\n        have \"prefixList (fe n) (fe (n+1))\" using FE by simp\n        thus \"prefixList (fe m) (fe (Suc n))\" using PrefixListTransitive \n          IA2 by simp\n      qed\n    qed\n    thus \"prefixList (fe m) (fe n)\" by simp\n  qed\n\n  have AllArePrefixesTrace: \"\\<forall> m . \\<forall> n > m . prefixList (ft m) (ft n)\"\n  proof(clarify)\n    fix m::nat and n::nat\n    assume MLessN: \"m < n\"\n    have \"prefixList (ft m) (ft n)\" using MLessN\n    proof(induct n, simp)\n      fix n\n      assume IA: \"(m < n) \\<Longrightarrow> (prefixList (ft m) (ft n))\" \"m < (Suc n)\"\n      have \"m = n \\<or> m < n\" using IA(2) by (metis less_SucE)\n      thus \"prefixList (ft m) (ft (Suc n))\"\n      proof(cases \"m = n\", auto)\n        show \"prefixList (ft n) (ft (Suc n))\" using FE by simp\n      next\n        assume \"m < n\"\n        hence IA2: \"prefixList (ft m) (ft n)\" using IA(1) by simp\n        have \"prefixList (ft n) (ft (n+1))\" using FE by simp\n        thus \"prefixList (ft m) (ft (Suc n))\" using PrefixListTransitive \n          IA2 by simp\n      qed\n    qed\n    thus \"prefixList (ft m) (ft n)\" by simp\n  qed\n\n  have Length: \"\\<forall> n . length (fe n) \\<ge> n + 1\" \n  proof(clarify)\n    fix n\n    show \"length (fe n) \\<ge> n + 1\" \n    proof(induct n, simp add: FE(1))\n      fix n\n      assume IH: \"(n + (1::nat)) \\<le> (length (fe n))\"\n      have \"length (fe (n+1)) \\<ge> length (fe n) + 1\" using FE(3) \n        PrefixListMonotonicity\n        by (metis Suc_eq_plus1 Suc_le_eq)\n      thus \"(Suc n) + (1::nat) \\<le> (length (fe (Suc n)))\" using IH by auto\n    qed\n  qed\n\n  have AllExecsFromInit: \"\\<forall> n . \\<forall> n0 < length (fe n) . \n    reachable cfg ((fe n) ! n0)\"\n  proof(clarify)\n    fix n::nat and n0::nat\n    assume \"n0 < length (fe n)\"\n    thus \"reachable cfg ((fe n) ! n0)\"\n    proof(cases \"0 = n\", auto)\n      assume N0Less: \"n0 < length (fe 0)\"\n      have NoStep: \"reachable cfg cfg\" using reachable.simps by blast \n      have \"length (fe 0) = 1\" using FE(1) by simp\n      hence N0Zero: \"n0 = 0\" using N0Less FE by simp\n      hence \"(fe 0) ! n0 = cfg\" using FE(1) by simp\n      thus \"reachable cfg ((fe 0) ! n0)\" using FE(1) NoStep N0Zero by simp\n    next\n      assume NNotZero: \"0 < n\" \"n0 < (length (fe n))\"\n      have ZeroCfg: \"(fe 0) = [cfg]\" using FE by simp\n      have \"prefixList (fe 0) (fe n)\" using AllArePrefixesExec NNotZero \n        by simp\n      hence PrList: \"prefixList [cfg] (fe n)\" using ZeroCfg by simp\n      have CfgFirst: \"cfg = (fe n) ! 0\"\n        using prefixList.cases[OF PrList]\n        by (metis (full_types) ZeroCfg list.distinct(1) nth_Cons_0)\n      have \"reachable ((fe n) ! 0) ((fe n) ! n0)\"\n        using execution.ReachableInExecution FE NNotZero(2) by (metis le0)\n      thus \"(reachable cfg ((fe n) ! n0))\" using assms CfgFirst by simp\n    qed\n  qed\n\n  have NoDecided: \"(\\<forall> n n0 v . (n0 < length (fe n)) \n                  \\<longrightarrow> \\<not> vDecided v ((fe n) ! n0))\" \n  proof(clarify)\n    fix n n0 v\n    assume AssmNoDecided: \"n0 < length (fe n)\" \n      \"initReachable ((fe n) ! n0)\"\n      \"0 < (msgs ((fe n) ! n0) <\\<bottom>, outM v>)\"\n    have LastNonUniform: \"nonUniform (last (fe n))\" using FE by simp\n    have LastIsLastIndex: \"\\<And> l . l \\<noteq> [] \\<longrightarrow> last l = l ! ((length l) - 1)\" \n      by (metis last_conv_nth)\n    have Fou: \"n0 \\<le> length (fe n) - 1\" using AssmNoDecided by simp\n    have FeNNotEmpty:\"fe n \\<noteq> []\" using FE(1) AllArePrefixesExec \n      by (metis AssmNoDecided(1) less_nat_zero_code list.size(3))\n    hence Fou2: \"length (fe n) - 1 < length (fe n)\" by simp\n    have \"last (fe n) = (fe n) ! (length (fe n) - 1)\" \n      using LastIsLastIndex FeNNotEmpty by auto\n    have LastNonUniform: \"nonUniform (last (fe n))\" using FE by simp \n    have \"reachable ((fe n) ! n0) ((fe n) ! (length (fe n) - 1))\" \n      using FE execution.ReachableInExecution Fou Fou2 by metis\n    hence N0ToLast: \"reachable ((fe n) ! n0) (last (fe n))\" \n      using LastIsLastIndex[of \"fe n\"] FeNNotEmpty by simp\n    hence LastVDecided: \"vDecided v (last (fe n))\" \n      using NoOutMessageLoss[of \"((fe n) ! n0)\" \"(last (fe n))\"] \n        AssmNoDecided\n      by (simp,\n        metis LastNonUniform le_neq_implies_less less_nat_zero_code neq0_conv)\n\n    have AllAgree: \"\\<forall> cfg' . reachable (last (fe n)) cfg' \n      \\<longrightarrow> agreement cfg'\" \n    proof(clarify)\n      fix cfg'\n      assume LastToNext: \"reachable (last (fe n)) cfg'\"\n      hence \"reachable cfg  ((fe n) ! (length (fe n) - 1))\" \n        using AllExecsFromInit AssmNoDecided(1) by auto\n      hence \"reachable cfg (last (fe n))\" using LastIsLastIndex[of \"fe n\"] \n        FeNNotEmpty by simp\n      hence FirstToLast: \"reachable cfg cfg'\" using initReachable_def Cfg \n        LastToNext ReachableTrans by blast\n      hence \"agreementInit cfg cfg'\" using Agreement by simp\n      hence \"\\<forall>v1. (<\\<bottom>, outM v1> \\<in># msgs cfg') \\<longrightarrow> (\\<forall>v2. (<\\<bottom>, outM v2> \\<in># \n        msgs cfg') \\<longleftrightarrow> v2 = v1)\"\n        using Cfg FirstToLast\n        by (simp add: agreementInit_def)\n      thus \"agreement cfg'\" by (simp add: agreement_def)\n    qed\n    thus \"False\" using NonUniformImpliesNotDecided LastNonUniform \n      PseudoTermination LastVDecided by simp\n  qed\n\n  have Termination: \"terminationFLP fe ft\" using assms(1)[OF FE(2)] .\n\n  hence AllDecideOrCrash: \n    \"\\<forall>p. \\<exists>n . \n       (\\<exists> i0 < length (ft n) . \\<exists>b. \n          (<\\<bottom>, outM b> \\<in># \n            sends p (states (fe n ! i0) p) (unpackMessage (ft n ! i0))) \n          \\<and> isReceiverOf p (ft n ! i0)) \n      \\<or> (\\<forall> n1 > n . \\<forall> m \\<in> (set (drop (length (ft n)) (ft n1))) .\n          \\<not> isReceiverOf p m)\"\n    using FE(2)\n    unfolding terminationFLP_def fairInfiniteExecution_def \n    by blast\n\n  have \"\\<forall> p . \\<exists> n . (\\<forall> n1 > n . \\<forall> m \\<in> (set (drop (length (ft n)) (ft n1))) .\n    \\<not> isReceiverOf p m)\"\n  proof(clarify)\n    fix p\n    from AllDecideOrCrash have\n    \"\\<exists> n . \n       (\\<exists> i0 < length (ft n) . \\<exists>b. \n        (<\\<bottom>, outM b> \\<in># sends p (states (fe n ! i0) p) (unpackMessage (ft n ! i0))) \n       \\<and> isReceiverOf p (ft n ! i0)) \n      \\<or> (\\<forall> n1 > n . \\<forall> m \\<in> (set (drop (length (ft n)) (ft n1))). \n        \\<not> isReceiverOf p m)\" by simp\n    hence \"(\\<exists> n . \\<exists> i0 < length (ft n) . \n         (\\<exists>b. (<\\<bottom>, outM b> \\<in># \n            sends p (states (fe n ! i0) p) (unpackMessage (ft n ! i0))) \n          \\<and> isReceiverOf p (ft n ! i0)))\n         \\<or> (\\<exists> n .\\<forall> n1 > n . \\<forall> m \\<in> (set (drop (length (ft n)) (ft n1))) .\n           \\<not> isReceiverOf p m)\" by blast\n    thus \"\\<exists>n. (\\<forall>n1>n. (\\<forall> m \\<in> (set (drop (length (ft n)) (ft n1))).\n      (\\<not> (isReceiverOf p m))))\"\n    proof(elim disjE, auto)\n      fix n i0 b\n      assume DecidingPoint:\n        \"i0 < length (ft n)\"\n        \"isReceiverOf p (ft n ! i0)\"\n        \"<\\<bottom>, outM b> \\<in># sends p (states (fe n ! i0) p) (unpackMessage (ft n ! i0))\"\n      have \"i0 < length (fe n) - 1\"\n        using DecidingPoint(1)\n        by (metis (no_types) FE(3) execution.length) \n      hence StepN0: \"((fe n) ! i0) \\<turnstile> ((ft n) ! i0) \\<mapsto> ((fe n) ! (i0 + 1))\" \n        using FE by (metis execution.step)\n      hence \"msgs ((fe n) ! (i0 + 1)) <\\<bottom>, outM b> \n        = (msgs ((fe n) ! i0) <\\<bottom>, outM b>) +\n        (sends p (states ((fe n) ! i0) p) \n        (unpackMessage ((ft n) ! i0)) <\\<bottom>, outM b>)\" \n        using DecidingPoint(2) OutOnlyGrowing[of \"(fe n) ! i0\" \"(ft n) ! i0\"\n          \"(fe n) ! (i0 + 1)\" \"p\"] \n        by auto\n      hence \"(sends p (states ((fe n) ! i0) p) \n        (unpackMessage ((ft n) ! i0)) <\\<bottom>, outM b>) \n        \\<le> msgs ((fe n) ! (i0 + 1)) <\\<bottom>, outM b>\" \n        using asynchronousSystem.steps_def by auto\n      hence OutMsgEx: \"0 < msgs ((fe n) ! (i0 + 1)) <\\<bottom>, outM b>\" \n        using asynchronousSystem.steps_def DecidingPoint(3) by auto\n      have \"(i0 + 1) < length (fe n)\"\n        using DecidingPoint(1) \\<open>i0 < length (fe n) - 1\\<close> by auto\n      hence \"initReachable ((fe n) ! (i0 + 1))\" \n        using AllExecsFromInit Cfg(1) \n        by (metis asynchronousSystem.initReachable_def)\n      hence Decided: \"vDecided b ((fe n) ! (i0 + 1))\" using OutMsgEx \n        by auto\n      have \"i0 + 1 < length (fe n)\" using DecidingPoint(1) \n        by (metis \\<open>(((i0::nat) + (1::nat)) < (length (\n          (fe::(nat \\<Rightarrow> ('p, 'v, 's) configuration list)) (n::nat))))\\<close>)\n      hence \"\\<not> vDecided b ((fe n) ! (i0 + 1))\" using NoDecided by auto\n      hence \"False\" using Decided by auto\n      thus \"\\<exists>n. (\\<forall>n1>n. (\\<forall> m \\<in> (set (drop (length (ft n)) (ft n1))). \n        (\\<not> (isReceiverOf p m))))\" by simp\n    qed\n  qed\n  hence \"\\<exists> (crashPoint::'p \\<Rightarrow> nat) . \n    \\<forall> p . \\<exists>  n . crashPoint p = n \\<and> (\\<forall> n1 > n . \\<forall> m \\<in> (set (drop \n    (length (ft n)) (ft n1))) . (\\<not> isReceiverOf p m))\" by metis  \n  then obtain crashPoint where CrashPoint:\n    \"\\<forall> p . (\\<forall> n1 > (crashPoint p) . \\<forall> m \\<in> (set (drop (length \n    (ft (crashPoint p))) (ft n1))) . (\\<not> isReceiverOf p m))\"\n    by blast\n  define limitSet where \"limitSet = {crashPoint p | p . p \\<in> Proc}\"\n  have \"finite {p. p \\<in> Proc}\" using finiteProcs by simp\n  hence \"finite limitSet\" using limitSet_def finite_image_set[] by blast\n  hence \"\\<exists> limit . \\<forall> l \\<in> limitSet . l < limit\" using \n    finite_nat_set_iff_bounded by auto\n  hence \"\\<exists> limit . \\<forall> p . (crashPoint p) < limit\" using limitSet_def by auto\n  then obtain limit where Limit: \"\\<forall> p . (crashPoint p) < limit\" by blast\n  define lengthLimit where \"lengthLimit = length (ft limit) - 1\"\n  define lateMessage where \"lateMessage = last (ft limit)\"\n  hence \"lateMessage = (ft limit) ! (length (ft limit) - 1)\" \n    by (metis AllArePrefixesTrace Limit last_conv_nth less_nat_zero_code \n      list.size(3) PrefixListMonotonicity)\n  hence LateIsLast: \"lateMessage = (ft limit) ! lengthLimit\" \n  using lateMessage_def lengthLimit_def by auto\n\n  have \"\\<exists> p . isReceiverOf p lateMessage\" \n  proof(rule ccontr)\n    assume \"\\<not> (\\<exists>(p::'p). (isReceiverOf p lateMessage))\"\n    hence IsOutMsg: \"\\<exists> v . lateMessage = <\\<bottom>, outM v>\"\n      by (metis isReceiverOf.simps(1) isReceiverOf.simps(2) message.exhaust)\n    have \"execution trans sends start (fe limit) (ft limit)\" using FE \n      by auto\n    hence \"length (fe limit) - 1 = length (ft limit)\"\n      using execution.length by simp\n    hence \"lengthLimit < length (fe limit) - 1\" \n      using lengthLimit_def \n      by (metis (hide_lams, no_types) Length Limit One_nat_def Suc_eq_plus1\n        Suc_le_eq diff_less \n        diffs0_imp_equal gr_implies_not0 less_Suc0 neq0_conv)\n    hence \"((fe limit) ! lengthLimit) \\<turnstile> ((ft limit) ! lengthLimit) \n      \\<mapsto> ((fe limit) ! (lengthLimit + 1))\"\n      using FE by (metis execution.step)\n    hence \"((fe limit) ! lengthLimit) \\<turnstile> lateMessage \\<mapsto> ((fe limit) ! \n      (lengthLimit + 1))\"\n      using LateIsLast by auto\n    thus False using IsOutMsg steps_def by auto\n  qed\n\n  then obtain p where ReceiverOfLate: \"isReceiverOf p lateMessage\" by blast\n  have \"\\<forall> n1 > (crashPoint p) . \n    \\<forall> m \\<in> (set (drop (length (ft (crashPoint p))) (ft n1))) . \n      (\\<not> isReceiverOf p m)\"\n    using CrashPoint\n    by simp\n  hence NoMsgAfterLimit: \"\\<forall> m \\<in> (set (drop (length (ft (crashPoint p))) \n    (ft limit))) . (\\<not> isReceiverOf p m)\"\n    using Limit\n    by auto\n  have \"lateMessage \\<in> set (drop (length(ft (crashPoint p))) (ft limit))\" \n  proof-\n    have \"crashPoint p < limit\" using Limit by simp\n    hence \"prefixList (ft (crashPoint p)) (ft limit)\" \n      using AllArePrefixesTrace by auto\n    hence CrashShorterLimit: \"length (ft (crashPoint p)) \n      < length (ft limit)\" using PrefixListMonotonicity by auto\n    hence \"last (drop (length (ft (crashPoint p))) (ft limit)) \n      = last (ft limit)\" by (metis last_drop)\n    hence \"lateMessage = last (drop (length (ft (crashPoint p))) \n      (ft limit))\" using lateMessage_def by auto\n    thus \"lateMessage \\<in> set (drop (length(ft (crashPoint p))) (ft limit))\" \n      by (metis CrashShorterLimit drop_eq_Nil last_in_set not_le)\n  qed\n  \n  hence \"\\<not> isReceiverOf p lateMessage\" using NoMsgAfterLimit by auto\n  thus \"False\" using ReceiverOfLate by simp\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/FLP/FLPTheorem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.33503807082622983}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory WP\nimports\n  WP_Pre\n  WPFix\n  Eisbach_Tools.Apply_Debug\n  ML_Utils.ML_Utils\nbegin\n\ndefinition\n  triple_judgement :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'b \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n \"triple_judgement pre body property = (\\<forall>s. pre s \\<longrightarrow> property s body)\"\n\ndefinition\n  postcondition :: \"('r \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> ('r \\<times> 's) set)\n            \\<Rightarrow> 'a \\<Rightarrow> 'b \\<Rightarrow> bool\"\nwhere\n \"postcondition P f = (\\<lambda>a b. \\<forall>(rv, s) \\<in> f a b. P rv s)\"\n\ndefinition\n  postconditions :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\"\nwhere\n \"postconditions P Q = (\\<lambda>a b. P a b \\<and> Q a b)\"\n\nlemma conj_TrueI: \"P \\<Longrightarrow> True \\<and> P\" by simp\nlemma conj_TrueI2: \"P \\<Longrightarrow> P \\<and> True\" by simp\n\nML_file \"WP-method.ML\"\n\ndeclare [[wp_trace = false, wp_trace_instantiation = false]]\n\nsetup WeakestPre.setup\n\nmethod_setup wp = \\<open>WeakestPre.apply_wp_args\\<close>\n  \"applies weakest precondition rules\"\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Monads/wp/WP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.3350380633599952}}
{"text": "section \\<open>Verification Condition Testing\\<close>\n\ntheory utp_hoare_total\n  imports \"../../../AlgebraicLaws/Abrupt/algebraic_laws_abrupt\"\nbegin\nnamed_theorems hoare_total\n\nsubsection {*Hoare triple definition*}\n\ndefinition hoare_rd :: \"'\\<alpha> cond \\<Rightarrow> '\\<alpha> hrel_cpa \\<Rightarrow> '\\<alpha> cond \\<Rightarrow> bool\" (\"\\<lbrace>_\\<rbrace>_\\<lbrace>_\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\") where\n[upred_defs]:\"\\<lbrace>p\\<rbrace>Q\\<lbrace>r\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R = \n  ((\\<lceil>p\\<rceil>\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub>< \\<and> $ok \\<and> \\<not>$abrupt  \\<Rightarrow> \\<lceil>r\\<rceil>\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub>> \\<and> $ok\\<acute> \\<and> \\<not>$abrupt\\<acute>) \\<sqsubseteq> Q)\"\n\nlemma hoare_true_t [hoare_total]:\n  shows \"\\<lbrace>p\\<rbrace>(\\<lceil>P\\<rceil>\\<^sub>A\\<^sub>B\\<^sub>R \\<turnstile> \\<lceil>Q\\<rceil>\\<^sub>A\\<^sub>B\\<^sub>R)\\<lbrace>true\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  apply pred_simp\n  apply auto\n oops\n\nlemma hoare_true_assisgns_abr_t [hoare_total]: \n  \"\\<lbrace>p\\<rbrace>\\<langle>\\<sigma>\\<rangle>\\<^sub>A\\<^sub>B\\<^sub>R\\<lbrace>true\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by rel_auto\n\nlemma hoare_true_skip_abr_t [hoare_total]: \n  \"\\<lbrace>p\\<rbrace>SKIP\\<^sub>A\\<^sub>B\\<^sub>R\\<lbrace>true\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by rel_auto\n\nlemma hoare_false_t [hoare_total]: \n  \"\\<lbrace>false\\<rbrace>C\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by rel_auto\n\nsubsection {*Precondition strengthening*}\n\nlemma hoare_pre_str_t[hoare_total]:\n  assumes \"`p\\<^sub>1 \\<Rightarrow> p\\<^sub>2`\" and \"\\<lbrace>p\\<^sub>2\\<rbrace>C\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  shows \"\\<lbrace>p\\<^sub>1\\<rbrace>C\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" \n  by (insert assms) rel_auto\n\nsubsection {*Post-condition weakening*}\n\nlemma hoare_post_weak_t[hoare_total]:\n  assumes \"\\<lbrace>p\\<rbrace>C\\<lbrace>q\\<^sub>2\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" and \"`q\\<^sub>2 \\<Rightarrow> q\\<^sub>1`\"\n  shows \"\\<lbrace>p\\<rbrace>C\\<lbrace>q\\<^sub>1\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" \n by (insert assms) rel_auto\n\nsubsection {*Hoare and assertion logic*}\n\nlemma hoare_r_conj_t [hoare_total]: \n  assumes\"\\<lbrace>p\\<rbrace>C\\<lbrace>r\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" and \"\\<lbrace>p\\<rbrace>C\\<lbrace>s\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"  \n  shows \"\\<lbrace>p\\<rbrace>C\\<lbrace>r \\<and> s\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by (insert assms) rel_auto\n\nsubsection {*Hoare SKIP*}\n\nlemma skip_abr_hoare_r_t [hoare_total]: \n  \"\\<lbrace>p\\<rbrace>SKIP\\<^sub>A\\<^sub>B\\<^sub>R\\<lbrace>p\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by rel_auto\n\nsubsection {*Hoare for assignment*}\n\nlemma assigns_abr_hoare_r_t [hoare_total]: \n  assumes\"`p \\<Rightarrow> \\<sigma> \\<dagger> q`\" \n  shows  \"\\<lbrace>p\\<rbrace>\\<langle>\\<sigma>\\<rangle>\\<^sub>A\\<^sub>B\\<^sub>R\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by (insert assms) rel_auto\n\nlemma assigns_abr_hoare_r'_t [hoare_total]: \n  \"\\<lbrace>\\<sigma> \\<dagger> p\\<rbrace>\\<langle>\\<sigma>\\<rangle>\\<^sub>A\\<^sub>B\\<^sub>R\\<lbrace>p\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by rel_auto\n\nsubsection {*Hoare for Sequential Composition*}\n\nlemma seq_hoare_r_t [hoare_total]: \n  assumes\"\\<lbrace>p\\<rbrace>C\\<^sub>1\\<lbrace>s\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" and \"\\<lbrace>s\\<rbrace>C\\<^sub>2\\<lbrace>r\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" \n  shows\"\\<lbrace>p\\<rbrace>C\\<^sub>1 ;; C\\<^sub>2\\<lbrace>r\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by (insert assms, rel_auto) metis+ \n\nsubsection {*Hoare for Conditional*}\n\nlemma cond_hoare_r_t [hoare_total]: \n  assumes \"\\<lbrace>b \\<and> p\\<rbrace>C\\<^sub>1\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" and \"\\<lbrace>\\<not>b \\<and> p\\<rbrace>C\\<^sub>2\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" \n  shows \"\\<lbrace>p\\<rbrace>C\\<^sub>1 \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>A\\<^sub>B\\<^sub>R\\<^sub>< \\<triangleright> C\\<^sub>2\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by (insert assms, rel_auto) metis+ \n\nlemma cond_abr_hoare_r_t [hoare_total]: \n  assumes \"\\<lbrace>b \\<and> p\\<rbrace>C\\<^sub>1\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" and \"\\<lbrace>\\<not>b \\<and> p\\<rbrace>C\\<^sub>2\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" \n  shows \"\\<lbrace>p\\<rbrace>bif b then C\\<^sub>1 else C\\<^sub>2 eif \\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by (insert assms, rel_auto) metis+ \n\nsubsection {*Hoare for assert*}\n\nlemma assert_hoare_r_t [hoare_total]: \n  assumes \"\\<lbrace>c \\<and> p\\<rbrace>SKIP\\<^sub>A\\<^sub>B\\<^sub>R\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" and \"\\<lbrace>\\<not>c \\<and> p\\<rbrace>\\<bottom>\\<^sub>A\\<^sub>B\\<^sub>R\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" \n  shows \"\\<lbrace>p\\<rbrace> c\\<^sub>\\<bottom>\\<^sub>C \\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  unfolding rassert_abr_def using cond_abr_hoare_r_t assms\n  by blast\n\nsubsection {*Hoare for assume*}\n\nlemma assume_hoare_r_t [hoare_total]: \n  assumes \"\\<lbrace>c \\<and> p\\<rbrace>SKIP\\<^sub>A\\<^sub>B\\<^sub>R\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" and \"\\<lbrace>\\<not>c \\<and> p\\<rbrace>\\<top>\\<^sub>A\\<^sub>B\\<^sub>R\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" \n  shows \"\\<lbrace>p\\<rbrace>c\\<^sup>\\<top>\\<^sup>C\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  unfolding rassume_abr_def using cond_abr_hoare_r_t assms\n  by blast\n\nsubsection {*Hoare for While-loop*}\n\nlemma while_hoare_r_t [hoare_total]:\n  assumes \"\\<lbrace>p \\<and> b \\<rbrace> C\\<lbrace>p\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  shows \"\\<lbrace>p\\<rbrace>while b do C od\\<lbrace>\\<not>b \\<and> p\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  using assms\n  by (simp add: While_def hoare_rd_def, rule_tac lfp_lowerbound)(rel_blast) \n\nlemma while_hoare_r'_t [hoare_total]:\n  assumes \"\\<lbrace>p \\<and> b\\<rbrace>C\\<lbrace>p\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" and \"`p \\<and> \\<not>b \\<Rightarrow> q`\"\n  shows \"\\<lbrace>p\\<rbrace>while b do C od\\<lbrace>q\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  using assms\n  by (metis hoare_post_weak_t while_hoare_r_t inf_commute)\n\nlemma while_invr_hoare_r_t [hoare_total]:\n  assumes \"\\<lbrace>p \\<and> b\\<rbrace>C\\<lbrace>p\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\" and \"`pre \\<Rightarrow> p`\" and \"`(\\<not>b \\<and> p) \\<Rightarrow> post`\"\n  shows \"\\<lbrace>pre\\<rbrace>while b invr p do C od\\<lbrace>post\\<rbrace>\\<^sub>A\\<^sub>B\\<^sub>R\"\n  by (metis assms hoare_pre_str_t while_hoare_r'_t While_inv_def inf_commute)\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/hoare/HoareLogic/TotalCorrectness/Abrupt/utp_hoare_total.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283035, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3350380633599952}}
{"text": "theory (*calc_name_eq*)\nimports Main (*calc_name*) (*calc_name_se*) \"~~/src/HOL/Eisbach/Eisbach_Tools\"\nbegin\n\n(*calc_structure_se_to_de*)\n\n\n(*calc_structure_de_to_se*)\n\n\nlemma DE_to_SE_Atprop_freevars[simp]:\n  fixes t\n  assumes \"freevars t = {}\"\n  shows \"\\<exists>t'. DE_to_SE_Atprop t = Some t'\"\nusing assms\nby (induct t, simp+)\n\nlemma SD_DS_Atprop_Id:\n  fixes a :: Atprop\n  defines \"a' \\<equiv> SE_to_DE_Atprop a\"\n  shows \"case (DE_to_SE_Atprop a') of Some x \\<Rightarrow> x = a\"\nusing assms\nby (metis (poly_guards_query) DE_to_SE_Atprop.simps(1) SE_to_DE_Atprop.simps option.simps(5))\n\nlemma DS_SD_Atprop_Id:\n  fixes a\n  assumes \"freevars a = {}\"\n  shows \"case (DE_to_SE_Atprop a) of Some x \\<Rightarrow> SE_to_DE_Atprop x = a\"\nusing assms\nby (metis (mono_tags) Atprop.exhaust freevars_Atprop.simps(1) insert_not_empty DE_to_SE_Atprop.simps(1) SE_to_DE_Atprop.simps option.simps(5))\n\n(*---------------------------*)\n\nlemma DE_to_SE_Action_freevars[simp]:\n  fixes t\n  assumes \"freevars t = {}\"\n  shows \"\\<exists>t'. DE_to_SE_Action t = Some t'\"\nusing assms\nby (induct t, simp+)\n\nlemma SD_DS_Action_Id:\n  fixes a :: Action\n  defines \"a' \\<equiv> SE_to_DE_Action a\"\n  shows \"case (DE_to_SE_Action a') of Some x \\<Rightarrow> x = a\"\nusing assms\nby (metis (poly_guards_query) DE_to_SE_Action.simps(1) SE_to_DE_Action.simps option.simps(5))\n\n\nlemma DS_SD_Action_Id:\n  fixes a\n  assumes \"freevars a = {}\"\n  shows \"case (DE_to_SE_Action a) of Some x \\<Rightarrow> SE_to_DE_Action x = a\"\nusing assms\nby (metis (mono_tags) Action.exhaust freevars_Action.simps(1) insert_not_empty DE_to_SE_Action.simps(1) SE_to_DE_Action.simps option.simps(5))\n\n(*---------------------------*)\n\nlemma DE_to_SE_Agent_freevars[simp]:\n  fixes t\n  assumes \"freevars t = {}\"\n  shows \"\\<exists>t'. DE_to_SE_Agent t = Some t'\"\nusing assms\nby (induct t, simp+)\n\nlemma SD_DS_Agent_Id:\n  fixes a :: Action\n  defines \"a' \\<equiv> SE_to_DE_Agent a\"\n  shows \"case (DE_to_SE_Agent a') of Some x \\<Rightarrow> x = a\"\nusing assms\nby (metis (poly_guards_query) DE_to_SE_Agent.simps(1) SE_to_DE_Agent.simps option.simps(5))\n\n\nlemma DS_SD_Agent_Id:\n  fixes a\n  assumes \"freevars a = {}\"\n  shows \"case (DE_to_SE_Agent a) of Some x \\<Rightarrow> SE_to_DE_Agent x = a\"\nusing assms\nby (metis (mono_tags) Agent.exhaust freevars_Agent.simps(1) insert_not_empty DE_to_SE_Agent.simps(1) SE_to_DE_Agent.simps option.simps(5))\n\n\n\n\n\nlemma DE_to_SE_Formula_freevars:\n  fixes t\n  assumes \"freevars t = {}\"\n  shows \"\\<exists>t'. DE_to_SE_Formula t = Some t'\"\nusing assms\napply (induct t)\napply simp_all\napply (case_tac x1a, simp_all)\nusing DE_to_SE_Action_freevars apply fastforce+\napply (case_tac x1a, simp_all)\nusing DE_to_SE_Agent_freevars apply fastforce+\nusing DE_to_SE_Atprop_freevars apply fastforce\napply (case_tac x2, auto)\nby (case_tac x, simp_all)+\n\n\nlemma SE_to_DE_Formula_freevars:\n  fixes t\n  shows \"freevars (SE_to_DE_Formula t) = {}\"\nby (induct t) simp+\n\nlemma SD_DS_Formula_Id:\n  fixes a\n  shows \"case (DE_to_SE_Formula (SE_to_DE_Formula a)) of Some x \\<Rightarrow> x = a\"\napply (induct a)\nby (simp add: option.case_eq_if)+\n\n\nlemma DS_SD_Formula_Id:\n  fixes a\n  assumes \"freevars a = {}\"\n  shows \"case (DE_to_SE_Formula a) of Some x \\<Rightarrow> SE_to_DE_Formula x = a\"\nusing assms\napply (induct a)\napply simp_all\napply (case_tac x1a, simp_all)\napply (case_tac x2, simp_all add: option.case_eq_if)\napply (case_tac x2, simp_all add: option.case_eq_if)\napply (case_tac x2, simp_all add: option.case_eq_if)\napply (case_tac x2, simp_all add: option.case_eq_if)\napply (case_tac x1a, simp_all)\napply (case_tac x2, simp_all add: option.case_eq_if)\napply (case_tac x2, simp_all add: option.case_eq_if)\napply (case_tac x2, simp_all add: option.case_eq_if)\napply (case_tac x2, simp_all add: option.case_eq_if)\napply (case_tac x, simp_all)\napply (case_tac x2, simp_all add: option.case_eq_if)\napply (case_tac x, simp_all)\napply (case_tac x, simp_all)\ndone\n\nlemma DS_SD_Formula_Id2:\n  fixes a\n  assumes \"freevars a = {}\"\n  shows \"SE_to_DE_Formula (the (DE_to_SE_Formula a)) = a\"\nusing assms DE_to_SE_Formula_freevars DS_SD_Formula_Id by fastforce\n\nlemma foldr_bigu_equiv[simp]:\n  fixes x fu\n  shows \"foldr op \\<union> (map fu x) {} = \\<Union>(image fu (set x))\"\nby(induct x, simp_all)\n\nlemma DE_to_SE_Structure_freevars:\n  fixes t\n  assumes \"freevars t = {}\"\n  shows \"\\<exists>t'. DE_to_SE_Structure t = Some t'\"\nusing assms\napply (induct t)\napply simp_all\napply (case_tac x1, simp_all)\nusing DE_to_SE_Action_freevars apply fastforce+\napply (case_tac x1, simp_all)\nusing DE_to_SE_Agent_freevars apply fastforce+\ndefer\napply (case_tac x2, auto)\nusing DE_to_SE_Formula_freevars apply fastforce\nusing DE_to_SE_Action_freevars apply fastforce\napply (case_tac x, auto)\nproof -\ncase goal1 thus ?case\n  proof(induct x, simp)\n  case goal1 \n    then obtain t' where t'_def: \"DE_to_SE_Structure (;;\\<^sub>S x) = Some t'\" by auto\n    from goal1(3) have \"\\<forall>e \\<in> set x. freevars e = {}\" by simp_all\n    then have \"\\<forall>xa \\<in> set x. \\<exists>t'. DE_to_SE_Structure xa = Some t'\" by (simp add: goal1(2))\n    then have \"\\<exists>x'. DE_to_SE_Structure (;;\\<^sub>S x) = Some (Structure_Bigcomma x')\"\n    proof(induct x, simp)\n    case goal1 \n      then have \"\\<exists>x'. DE_to_SE_Structure (;;\\<^sub>S x) = Some (;;\\<^sub>S x')\" by simp\n      then obtain x' where x'_def: \"DE_to_SE_Structure (;;\\<^sub>S x) = Some (;;\\<^sub>S x')\" by auto\n      from goal1 obtain a' where a'_def: \"DE_to_SE_Structure (a) = Some a'\" by auto\n      with x'_def have \"DE_to_SE_Structure (;;\\<^sub>S (a # x)) = Some (;;\\<^sub>S (a'#x'))\" by simp\n      thus ?case by simp\n    qed\n    then obtain x' where x'_def: \"DE_to_SE_Structure (;;\\<^sub>S x) = Some (Structure_Bigcomma x')\" by auto\n    with goal1 obtain a' where a'_def: \"DE_to_SE_Structure a = Some a'\" by fastforce\n    with t'_def x'_def  have \"DE_to_SE_Structure (DEAK_Core.Structure_Bigcomma (a#x)) = Some (Structure_Bigcomma (a'#x'))\" by auto\n    thus ?case by simp\n  qed\nqed\n\nlemma SE_to_DE_Structure_freevars:\n  fixes t\n  shows \"freevars (SE_to_DE_Structure t) = {}\"\nby (induct t rule: SE_to_DE_Structure.induct, simp_all add: SE_to_DE_Formula_freevars)\n\n\n\nlemma SD_DS_Structure_Id:\n  fixes a :: Structure\n  shows \"\\<exists>x. (DE_to_SE_Structure (SE_to_DE_Structure a)) = Some x \\<and> x = a\"\napply (induct a)\napply (auto simp add: option.case_eq_if)\ndefer\nusing DE_to_SE_Formula_freevars SE_to_DE_Formula_freevars apply blast\napply (metis (mono_tags, lifting) SD_DS_Formula_Id option.simps(5))\nproof -\ncase goal1 thus ?case by(induct x, auto)\nqed\n\n\nlemma SD_DS_Structure_Id2:\n  fixes a :: Structure\n  shows \"the (DE_to_SE_Structure (SE_to_DE_Structure a)) = a\"\nusing SD_DS_Structure_Id by auto\n\nlemma DS_SD_Structure_Id:\n  fixes a\n  assumes \"freevars a = {}\"\n  shows \"\\<exists>x. (DE_to_SE_Structure a) = Some x \\<and> SE_to_DE_Structure x = a\"\nusing assms\napply (induct a)\napply simp_all\napply (case_tac x1, simp_all)\napply (metis (mono_tags, lifting) DE_to_SE_Action_freevars DS_SD_Action_Id SE_to_DE_Structure.simps(2) option.simps(5))\napply (metis (mono_tags, lifting) DE_to_SE_Action_freevars DS_SD_Action_Id SE_to_DE_Structure.simps(1) option.simps(5))\n\napply (case_tac x1, simp_all)\napply (metis (mono_tags, lifting) DE_to_SE_Agent_freevars DS_SD_Agent_Id SE_to_DE_Structure.simps(3) option.simps(5))\napply (metis (mono_tags, lifting) DE_to_SE_Agent_freevars DS_SD_Agent_Id SE_to_DE_Structure.simps(4) option.simps(5))\ndefer\napply (case_tac x2, simp_all)\napply auto\napply (simp add: DE_to_SE_Formula_freevars DS_SD_Formula_Id2 option.case_eq_if)\napply (case_tac x, simp_all)\napply (case_tac x, simp_all)\nproof -\ncase goal1 thus ?case\n  proof(induct x, simp)\n  case goal1 \n    then have assms: \"\\<exists>xx. DE_to_SE_Structure (;;\\<^sub>S x) = Some xx \\<and> SE_to_DE_Structure xx = ;;\\<^sub>S x\" \"\\<exists>xx. DE_to_SE_Structure a = Some xx \\<and> SE_to_DE_Structure xx = a\" by simp_all\n    then obtain a' where a'_def: \"DE_to_SE_Structure a = Some a' \\<and> SE_to_DE_Structure a' = a\" by auto\n    from assms obtain list where list_def: \"DE_to_SE_Structure (;;\\<^sub>S x) = Some list \\<and> SE_to_DE_Structure list = ;;\\<^sub>S x\" by auto\n    with assms\n    obtain x' where x'_def: \"list = (Structure_Bigcomma x')\"\n      by (smt DEAK_Core.Structure.distinct(16) DEAK_Core.Structure.distinct(28) DEAK_Core.Structure.distinct(30) DEAK_Core.Structure.distinct(34) DEAK_Core.Structure.distinct(36) DEAK_Core.Structure.distinct(4) SE_to_DE_Structure.elims)\n      (* get rid of smt!!! *)\n    with a'_def list_def have \"DE_to_SE_Structure (;;\\<^sub>S (a # x)) = Some (Structure_Bigcomma (a'#x'))\" by simp\n    thus ?case using a'_def list_def x'_def by auto\n  qed\nqed\n\n\nlemma DS_SD_Structure_Id2:\n  fixes a\n  assumes \"freevars a = {}\"\n  shows \"SE_to_DE_Structure (the (DE_to_SE_Structure a)) = a\"\nusing assms DS_SD_Structure_Id by fastforce\n\n\n\nlemma DE_to_SE_Sequent_freevars:\n  fixes l r\n  assumes \"freevars (l \\<turnstile>\\<^sub>S r) = {}\"\n  shows \"\\<exists>l' r'. DE_to_SE_Sequent (l \\<turnstile>\\<^sub>S r) = Some (l' \\<turnstile>\\<^sub>S r')\"\nby (metis (no_types, lifting) DE_to_SE_Sequent.simps(1) DS_SD_Structure_Id assms freevars_Sequent.simps(1) image_is_empty option.simps(5) sup_eq_bot_iff)\n\nlemma DE_to_SE_Sequent_freevars2:\n  fixes s\n  assumes \"DE_to_SE_Sequent s = None\"\n  shows \"freevars s \\<noteq> {} \\<or> (\\<exists>s'. s = Sequent_Structure s')\"\nusing DE_to_SE_Sequent_freevars by (metis DE_to_SE_Sequent.elims assms option.distinct(1))\n\n\n(*lemma DE_to_SE_Sequent_freevars3:\n  fixes X Y\n  assumes \"freevars ((Z\\<^sub>S I\\<^sub>S) \\<turnstile>\\<^sub>S (B\\<^sub>S X \\<rightarrow>\\<^sub>S Y)) = {}\"\n  shows \"\\<exists>(X'::Structure) Y'::Structure. DE_to_SE_Sequent (Z\\<^sub>S I\\<^sub>S \\<turnstile>\\<^sub>S B\\<^sub>S X \\<rightarrow>\\<^sub>S Y) = Some (I\\<^sub>S \\<turnstile>\\<^sub>S X' \\<rightarrow>\\<^sub>S Y')\"\nproof -\n  obtain ss :: \"DEAK_Core.Structure \\<Rightarrow> DEAK_Core_SE.Structure\" where\n    f1: \"DE_to_SE_Structure (B\\<^sub>S X \\<rightarrow>\\<^sub>S Y) = Some (ss (B\\<^sub>S X \\<rightarrow>\\<^sub>S Y))\"\n    by (metis (no_types) DE_to_SE_Structure_freevars assms bot_eq_sup_iff freevars_Sequent.simps(1) image_is_empty)\n  hence f2: \"(case DE_to_SE_Structure Y of None \\<Rightarrow> None | Some s \\<Rightarrow> case DE_to_SE_Structure X of None \\<Rightarrow> None | Some sa \\<Rightarrow> Some (sa \\<rightarrow>\\<^sub>S s)) \\<noteq> None\"\n    by force\n  have f3: \"DE_to_SE_Sequent (Z\\<^sub>S I\\<^sub>S \\<turnstile>\\<^sub>S B\\<^sub>S X \\<rightarrow>\\<^sub>S Y) = Some (I\\<^sub>S \\<turnstile>\\<^sub>S ss (B\\<^sub>S X \\<rightarrow>\\<^sub>S Y))\"\n    using f1 by simp\n  have f4: \"\\<forall>z f za. if za = None then (case za of None \\<Rightarrow> z\\<Colon>DEAK_Core_SE.Structure option | Some (x\\<Colon>DEAK_Core_SE.Structure) \\<Rightarrow> f x) = z else (case za of None \\<Rightarrow> z | Some x \\<Rightarrow> f x) = f (the za)\"\n    by fastforce\n  hence f5: \"(case DE_to_SE_Structure Y of None \\<Rightarrow> None | Some s \\<Rightarrow> case DE_to_SE_Structure X of None \\<Rightarrow> None | Some sa \\<Rightarrow> Some (sa \\<rightarrow>\\<^sub>S s)) = (case DE_to_SE_Structure X of None \\<Rightarrow> None | Some s \\<Rightarrow> Some (s \\<rightarrow>\\<^sub>S the (DE_to_SE_Structure Y)))\"\n    using f2 by meson\n  hence \"(case DE_to_SE_Structure X of None \\<Rightarrow> None | Some s \\<Rightarrow> Some (s \\<rightarrow>\\<^sub>S the (DE_to_SE_Structure Y))) \\<noteq> None\"\n    using f2 by presburger\n  thus ?thesis\n    using f5 f4 f3 f1 by (metis DE_to_SE_Structure.simps(9) option.sel)\nqed*)\n\nfun SE_to_DE_Locale :: \"Locale \\<Rightarrow> DEAK.Locale\" where\n\"SE_to_DE_Locale (CutFormula f) = DEAK.CutFormula (SE_to_DE_Formula f)\" |\n\"SE_to_DE_Locale (Premise s) = DEAK.Premise (SE_to_DE_Sequent s)\" |\n\"SE_to_DE_Locale (Part s) = DEAK.Part (SE_to_DE_Structure s)\" |\n\"SE_to_DE_Locale (RelAKA a) = DEAK.RelAKA (\\<lambda>ac. \\<lambda>ag. (map (SE_to_DE_Action) (a (the (DE_to_SE_Action ac)) (the (DE_to_SE_Agent ag)))))\" |\n\"SE_to_DE_Locale (PreFormula a f) = DEAK.PreFormula (SE_to_DE_Action a) (SE_to_DE_Formula f)\" |\n\"SE_to_DE_Locale (LAgent a) = DEAK.LAgent (SE_to_DE_Agent a)\" |\n\"SE_to_DE_Locale Empty = DEAK.Empty\"\n\n\nlemma what_the1[simp]: \"foldr (op \\<or>) (map (\\<lambda>x. (\n    set (Product_Type.snd (der x r s)) = set (map concl l) \\<and> \n    Fail \\<noteq> Product_Type.fst (der x r s)\n  )) loc) False = (\\<exists>x\\<in>set loc. set (prod.snd (der x r s)) = set (map concl l) \\<and> Fail \\<noteq> prod.fst (der x r s))\"\nby(induct loc, simp_all)\n\nlemma isProofTreeWoMacro_concl_freevars_aux:\n  fixes loc s r l n pt\n  assumes \"isProofTreeWoMacro loc (s \\<Longleftarrow> PT(r) l)\" \"r \\<noteq> RuleMacro n pt\"\n  shows \"foldr (op \\<or>) (map (\\<lambda>x. (\n    set (Product_Type.snd (der x r s)) = set (map concl l) \\<and> \n    Fail \\<noteq> Product_Type.fst (der x r s)\n  )) loc) False\"\nusing assms by (cases r, auto)\n\nlemma isProofTreeWoMacro_concl_freevars[simp]:\n  fixes loc s r l\n  assumes \"isProofTreeWoMacro loc (s \\<Longleftarrow> PT(r) l)\"\n  shows \"\\<exists>x\\<in>set loc. set (Product_Type.snd (der x r s)) = set (map concl l) \\<and> \n    Fail \\<noteq> Product_Type.fst (der x r s)\"\nproof (rule ccontr)\n  assume assm:  \"\\<not> (\\<exists>x\\<in>set loc. set (prod.snd (der x r s)) = set (map concl l) \\<and> Fail \\<noteq> prod.fst (der x r s))\"\n  with assms show False\n  apply(cases r)\n  using assm isProofTreeWoMacro_concl_freevars_aux what_the1 by blast+\nqed\n\nlemma der_imp_ruleMatch:\n  fixes l r s\n  assumes \"der l r s \\<noteq> (Fail, [])\"\n  shows \"ruleMatch (fst (rule l r)) s\"\nproof -\n  have f1: \"(case DEAK.snd (rule l r) s of None \\<Rightarrow> (Fail, []) | Some ss \\<Rightarrow> if ruleMatch (DEAK.fst (rule l r)) s then case cond (rule l r) of None \\<Rightarrow> (r, map (replaceAll (match (DEAK.fst (rule l r)) s)) ss) | Some p \\<Rightarrow> if p s then (r, map (replaceAll (match (DEAK.fst (rule l r)) s)) ss) else (Fail, []) else (Fail, [])) \\<noteq> (Fail, [])\"\n    using assms by auto\n  have f2: \"\\<forall>p f z. if z = None then (case z of None \\<Rightarrow> p\\<Colon>Rule \\<times> DEAK_Core.Sequent list | Some (x\\<Colon>DEAK_Core.Sequent list) \\<Rightarrow> f x) = p else (case z of None \\<Rightarrow> p | Some x \\<Rightarrow> f x) = f (the z)\"\n    by fastforce\n  hence \"DEAK.snd (rule l r) s \\<noteq> None\"\n    using f1 by meson\n  hence \"der l r s = (if ruleMatch (DEAK.fst (rule l r)) s then case cond (rule l r) of None \\<Rightarrow> (r, map (replaceAll (match (DEAK.fst (rule l r)) s)) (the (DEAK.snd (rule l r) s))) | Some p \\<Rightarrow> if p s then (r, map (replaceAll (match (DEAK.fst (rule l r)) s)) (the (DEAK.snd (rule l r) s))) else (Fail, []) else (Fail, []))\"\n    using f2 by auto\n  thus ?thesis\n    using assms by presburger\nqed\n\nlemma isProofTree_concl_freevars[simp]:\n  fixes pt loc\n  assumes \"isProofTreeWoMacro loc pt\"\n  shows \"freevars (concl pt) = {}\"\napply(cases pt)\napply(case_tac x2)\napply simp_all\nusing assms der_imp_ruleMatch isProofTreeWoMacro_concl_freevars ruleMatch_def\napply (metis (no_types) Pair_inject prod.exhaust_sel)+\ndone\n\nlemma replace_Structure_aux_freevars_unchanged:\n  fixes X Y free\n  assumes \"freevars X = {}\"\n  shows \"replace_Structure_aux (?\\<^sub>S free) Y X = X\" (*\"replace_Structure ((?\\<^sub>S free), Y) X = X\"*)\nusing assms apply(induct X, auto)\nproof -\ncase goal1 \n  thus ?case by (induct x, auto)\nqed\n\n\nlemma SE_to_DE_Empty_redundant :\n  fixes t\n  shows \"[Empty] \\<turnstile>d t \\<Longrightarrow> [] \\<turnstile>d t\"\napply (induction \"[Empty]\" t rule:derivable.induct)\nby (auto intro: derivable.intros)\n\n\n\nlemma SE_to_DE_subset_loc :\n  fixes t l l'\n  assumes \"l \\<turnstile>d t\" \"set l \\<subseteq> set l'\"\n  shows \"l' \\<turnstile>d t\"\nusing assms apply (induction l t rule:derivable.induct)\napply (auto intro: derivable.intros)\napply (meson Swapout_L subsetCE)\nby (meson Swapout_R subsetCE)\n\nlemma DS_SD_Sequent_Id :\n  fixes seq seq'\n  assumes \"freevars seq = {}\" \"DE_to_SE_Sequent seq = Some (seq')\"\n  shows \"seq = SE_to_DE_Sequent seq'\"\nusing assms apply(induct seq, simp_all)\nusing DS_SD_Structure_Id2 by (metis (mono_tags, lifting) SE_to_DE_Sequent.simps option.case_eq_if option.distinct(1) option.sel)\n\n\n\n\nlemma replace_Atprop_no_freevars:\n  fixes X::DEAK_Core.Atprop\n  assumes \"freevars X = {}\"\n  shows \"replace a X = X\"\nusing assms apply (induction X arbitrary:a)\napply auto\nby (metis Atprop.simps(5) DE_to_SE_Atprop.elims replace_Atprop_aux.simps(1) replace_Atprop_aux.simps(2))\n\nlemma replace_Action_no_freevars:\n  fixes X::DEAK_Core.Action\n  assumes \"freevars X = {}\"\n  shows \"replace a X = X\"\nusing assms apply(induct X arbitrary:a)\nby auto\n\nlemma replace_Agent_no_freevars:\n  fixes X::DEAK_Core.Agent\n  assumes \"freevars X = {}\"\n  shows \"replace a X = X\"\nusing assms apply(induct X arbitrary:a)\nby auto\n\nlemma replace_Formula_no_freevars0:\n  fixes X::DEAK_Core.Formula\n  assumes \"freevars X = {}\"\n  shows \"replace_Formula_aux a b X = X\"\nusing assms apply(induct X)\napply (auto)\napply (case_tac x1a)\napply (auto)\napply((induct a;induct b, auto),(simp add: replace_Action_no_freevars))\napply((induct a;induct b, auto),(simp add: replace_Action_no_freevars))\napply((induct a;induct b, auto),(simp add: replace_Action_no_freevars))\napply((induct a;induct b, auto),(simp add: replace_Action_no_freevars))\napply (case_tac x1a)\napply (auto)\napply((induct a;induct b, auto),(simp add: replace_Agent_no_freevars))\napply((induct a;induct b, auto),(simp add: replace_Agent_no_freevars))\napply((induct a;induct b, auto),(simp add: replace_Agent_no_freevars))\napply((induct a;induct b, auto),(simp add: replace_Agent_no_freevars))\napply(induct a;induct b, auto)\nusing replace_Atprop_no_freevars apply auto[1]\napply(induct a;induct b, auto)\nby (simp add: replace_Action_no_freevars)\n\n\n\n\nlemma replace_Formula_no_freevars:\n  fixes X::DEAK_Core.Formula\n  assumes \"freevars X = {}\"\n  shows \"replace a X = X\"\nusing assms apply(induct X arbitrary:a)\napply (auto)\napply (case_tac x1a)\napply (auto)\napply((case_tac a;case_tac b, auto),(simp add: replace_Action_no_freevars))\napply((case_tac a;case_tac b, auto),(simp add: replace_Action_no_freevars))\napply((case_tac a;case_tac b, auto),(simp add: replace_Action_no_freevars))\napply((case_tac a;case_tac b, auto),(simp add: replace_Action_no_freevars))\napply (case_tac x1a)\napply (auto)\napply((case_tac a;case_tac b, auto),(simp add: replace_Agent_no_freevars))\napply((case_tac a;case_tac b, auto),(simp add: replace_Agent_no_freevars))\napply((case_tac a;case_tac b, auto),(simp add: replace_Agent_no_freevars))\napply((case_tac a;case_tac b, auto),(simp add: replace_Agent_no_freevars))\napply(case_tac a;case_tac b, auto)\nusing replace_Atprop_no_freevars apply auto[1]\napply(case_tac a;case_tac b, auto)\nby (simp add: replace_Action_no_freevars)\n\n\nlemma replace_Structure_no_freevars0:\n  fixes X::DEAK_Core.Structure\n  assumes \"freevars X = {}\"\n  shows \"replace_Structure_aux a b X = X\"\nusing assms apply(induct X arbitrary:a b)\napply simp_all\napply (case_tac x1)\napply simp_all\napply(case_tac a, simp_all)\napply(case_tac x5, simp_all)\napply(case_tac b, simp_all)\napply(case_tac x5a, simp_all)\napply (simp add: replace_Action_no_freevars)+\napply(case_tac a, simp_all)\napply(case_tac x5, simp_all)\napply(case_tac b, simp_all)\napply(case_tac x5a, simp_all)\napply (simp add: replace_Action_no_freevars)+\napply(case_tac a, simp_all)\napply(case_tac x5, simp_all)\napply(case_tac b, simp_all)\napply(case_tac x5a, simp_all)\napply (simp add: replace_Agent_no_freevars)+\ndefer\napply(induct_tac a, simp_all)\napply(induct_tac b, simp_all)\nusing replace_Formula_no_freevars apply auto\napply(case_tac a, simp_all)\napply(case_tac x5, simp_all)\napply(case_tac b, simp_all)\napply(case_tac x5a, simp_all)\napply (simp add: replace_Action_no_freevars)+\nproof -\ncase goal1 thus ?case by(induct x, auto)\nqed\n\n\nlemma foldr_loc:\nfixes X::bool and loc\nassumes \"loc \\<noteq> []\"\nshows \"foldr op \\<or> (map ((\\<lambda>x. X) \\<circ> SE_to_DE_Locale) loc) False = X\"\nusing assms apply(induction loc)\napply simp\nby fastforce\n\n\nmethod se_to_de_tac for tree::'a uses add = \n  (rule exI [where x=tree]), \n  (auto simp add: add ruleMatch_def m_clash_def replace_Structure_aux_freevars_unchanged),\n  (insert SD_DS_Structure_Id replace_Structure_no_freevars0 SE_to_DE_Structure_freevars)?,\n  (auto simp add: add foldr_loc)?\n\n\nlemma replace_match_X_t_Y:\n  fixes X Y\n  assumes \"freevars (X \\<turnstile>\\<^sub>S Y) = {}\"\n  shows \"replaceAll (match (?\\<^sub>S ''X'' \\<turnstile>\\<^sub>S ?\\<^sub>S ''Y'') (X \\<turnstile>\\<^sub>S Y)) (?\\<^sub>S ''X'' \\<turnstile>\\<^sub>S ?\\<^sub>S ''Y'') = (X \\<turnstile>\\<^sub>S Y)\"\nusing assms \napply(induction Y)\nby (auto simp add: m_clash_def replace_Structure_aux_freevars_unchanged)\n\nlemma atom_SE_to_DE_equiv:\n  fixes seq\n  assumes \"atom seq\"\n  shows \"DEAK.atom (SE_to_DE_Sequent seq)\"\nusing assms apply(induct seq rule: atom.induct)\nproof -\ncase goal1 \n  thus ?case \n  apply(induction l)\n  using DEAK.atom.simps(1) apply(cases \"DEAK_SE.atom (l \\<turnstile>\\<^sub>S r)\", fastforce, force)\n  using DEAK.atom.simps(1) apply(cases \"DEAK_SE.atom (l \\<turnstile>\\<^sub>S r)\", fastforce, force)\n  using DEAK.atom.simps(1) apply(cases \"DEAK_SE.atom (l \\<turnstile>\\<^sub>S r)\", fastforce, force)\n  using DEAK.atom.simps(1) apply(cases \"DEAK_SE.atom (l \\<turnstile>\\<^sub>S r)\", fastforce, force)\n  using DEAK.atom.simps(1) apply(cases \"DEAK_SE.atom (l \\<turnstile>\\<^sub>S r)\", fastforce, force)\n  using DEAK.atom.simps(1) apply(cases \"DEAK_SE.atom (l \\<turnstile>\\<^sub>S r)\", fastforce, force)\n  using DEAK.atom.simps(1) apply(cases \"DEAK_SE.atom (l \\<turnstile>\\<^sub>S r)\", fastforce, force)\n  using DEAK.atom.simps(1) apply(cases \"DEAK_SE.atom (l \\<turnstile>\\<^sub>S r)\", fastforce, force)\ndefer\n  using DEAK.atom.simps(1) apply(cases \"DEAK_SE.atom (l \\<turnstile>\\<^sub>S r)\", fastforce, force)\n  using DEAK.atom.simps(1) apply(cases \"DEAK_SE.atom (l \\<turnstile>\\<^sub>S r)\", fastforce, force)\n  proof (rule ccontr)\n  case goal1 \n    from goal1(2) have \"\\<not>atom (x \\<^sub>S \\<turnstile>\\<^sub>S r)\"\n    proof (cases x, auto)\n    case goal1 thus ?case\n      proof(induct r, auto)\n      case goal1 thus ?case by(induct x, auto)\n      qed\n    qed\n    thus ?case using goal1(1) by blast\n  qed\nqed\n\n\n\nlemma replace_Bigcomma_list_no_freevars: \n  fixes list x y\n  assumes \"freevars (;;\\<^sub>S list) = {}\"\n  shows \"replace_Structure_list_aux x y list = list\"\nusing assms DEAK_Eq.replace_Structure_no_freevars0 by(induct list, auto)\n\n(*lemma foldr_ex_eq:\n  assumes \"foldr (op \\<or>) (map (\\<lambda>x. (\n    set (Product_Type.snd (der x r s)) = set (map concl l) \\<and> \n    Fail \\<noteq> Product_Type.fst (der x r s)\n  )) loc) False\"\nshows \"x\"*)\n\nlemma foldr_isPTWOMacro1:\n  fixes loc l\n  assumes \"\\<exists>x \\<in> set (map SE_to_DE_Locale loc). set (prod.snd (der x r s)) = set (map concl l) \\<and> Fail \\<noteq> prod.fst (der x r s)\"\n  and \"loc \\<noteq> []\"\n  shows \"foldr (op \\<or>) (map ((\\<lambda>x. (set (prod.snd (der x r s)) = set (map concl l) \\<and> Fail \\<noteq> prod.fst (der x r s))) \\<circ> SE_to_DE_Locale) loc) False\"\nusing assms apply(induction loc)\napply simp\nby fastforce\n\nlemma list_find:\n  assumes \"e \\<in> set list\"\n  shows \"List.find (\\<lambda>x. x = e) list = Some e\"\nusing assms by(induction list, auto)\n\nlemma relAKA_find:\n  fixes rel alpha a beta\n  assumes \"beta \\<in> set (rel alpha a)\"\n  shows \"List.find (\\<lambda>x. x = Action beta) (map SE_to_DE_Action (rel alpha a)) = Some (Action beta)\"\nproof -\nfrom assms have \"Action beta \\<in> set (map SE_to_DE_Action (rel alpha a))\" by fastforce\nwith list_find assms show ?thesis by fastforce\nqed\n\nlemma swapout_L_some:\nfixes actionList Ys\nassumes \"List.length actionList = List.length Ys\"\nshows \"\\<And>alpha a X. \\<exists>x. (swapout_L' actionList alpha a X Ys) = Some x\"\nusing assms \napply(induct rule:swapout_L'.induct)\napply simp_all\nby (metis option.simps(5))\n\n\nlemma swapout_L_shape:\nfixes actionList alpha a X Ys x\nassumes \"(swapout_L' actionList alpha a X Ys) = Some x\" \nshows \"\\<forall>seq \\<in> set x. \\<exists>beta \\<in> set actionList. \\<exists>Y \\<in> set Ys. seq = (AgS\\<^sub>S forwK\\<^sub>S a ActS\\<^sub>S forwA\\<^sub>S beta X \\<turnstile>\\<^sub>S Y)\"\nusing assms apply (induct rule:swapout_L'.induct)\napply auto\nsorry\n\nlemma swapout_L_no_freevars:\nfixes actionList alpha a X Ys x\nassumes \"(swapout_L' actionList alpha a X Ys) = Some x\" \n  and \"\\<forall>act \\<in> set actionList. freevars act = {}\" \n  and \"\\<forall>Y \\<in> set Ys. freevars Y = {}\" \n  and \"freevars alpha = {}\"\n  and \"freevars X = {}\"\nshows \"\\<forall>seq \\<in> set x. freevars seq = {}\"\nproof -\nhave \"\\<forall>seq \\<in> set x. \\<exists>beta \\<in> set actionList. \\<exists>Y \\<in> set Ys. seq = (AgS\\<^sub>S forwK\\<^sub>S a ActS\\<^sub>S forwA\\<^sub>S beta X \\<turnstile>\\<^sub>S Y)\" sorry\nthus ?thesis using assms sorry\nqed\n\nlemma map_list_len:\n  fixes l1 l2\n  shows \"\\<And>f1 f2. List.length l1 = List.length l2 \\<longleftrightarrow> List.length (map f1 l1) = List.length (map f2 l2)\"\nby(induct l1; induct l2, auto)\n\n\nlemma hilbert_concl_id:\nfixes seq\nshows\"concl (SOME pt. concl pt = seq) = seq\" \nby (meson concl.simps someI_ex)\n\nlemma hilbert_concl_id2:\nfixes seq loc\nassumes \"\\<exists>pt. concl pt = seq \\<and> isProofTreeWoMacro loc pt\"\nshows \"concl (SOME pt::Prooftree. concl pt = seq \\<and> isProofTreeWoMacro loc pt) = seq\" \nusing assms sorry\n\nlemma SE_to_DE:\n  fixes t loc\n  assumes \"loc \\<turnstile>d t\" and \"loc \\<noteq> []\"\n  shows \"\\<exists>pt. DE_to_SE_Sequent (concl pt) = Some t \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) pt\"\nusing assms\nproof (induction loc t)\ncase (Swapout_L rel loc alpha a Ys X)\n  then have 0: \"\\<forall>(beta, Y)\\<in>set (pairs (rel alpha a) Ys).\n    loc \\<turnstile>d forwK\\<^sub>S a forwA\\<^sub>S beta X \\<turnstile>\\<^sub>S Y \\<and> (\\<exists>pt. DE_to_SE_Sequent (concl pt) = Some (forwK\\<^sub>S a forwA\\<^sub>S beta X \\<turnstile>\\<^sub>S Y) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) pt)\" by simp\n  def seq_list \\<equiv> \"map SE_to_DE_Sequent (map (\\<lambda>(beta, Y). forwK\\<^sub>S a forwA\\<^sub>S beta X \\<turnstile>\\<^sub>S Y) (pairs (rel alpha a) Ys))\"\n  with 0 obtain aa where aa_def: \"aa = map (\\<lambda>x. SOME pt::Prooftree. ((concl pt) = x \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) pt)) seq_list\" by simp\n\n  show ?case\n  apply (rule exI [where x=\"(SE_to_DE_Sequent (forwA\\<^sub>S alpha (forwK\\<^sub>S a X) \\<turnstile>\\<^sub>S ;;\\<^sub>S Ys)) \\<Longleftarrow>PT (RuleSwapout Swapout_L) aa\"])\n  apply rule\n  proof -\n  case goal1\n    have 0: \"(SE_to_DE_Locale (DEAK_SE.Locale.RelAKA rel)) \\<in> set (map SE_to_DE_Locale loc)\" using Swapout_L.hyps(1) by force\n    \n\n    then have \"set (prod.snd (der (SE_to_DE_Locale (DEAK_SE.Locale.RelAKA rel)) (RuleSwapout Swapout_L) (SE_to_DE_Sequent (forwA\\<^sub>S alpha (forwK\\<^sub>S a X) \\<turnstile>\\<^sub>S ;;\\<^sub>S Ys)))) = set (map concl aa) \\<and> \n      Fail \\<noteq> prod.fst (der (SE_to_DE_Locale (DEAK_SE.Locale.RelAKA rel)) (RuleSwapout Swapout_L) (SE_to_DE_Sequent (forwA\\<^sub>S alpha (forwK\\<^sub>S a X) \\<turnstile>\\<^sub>S ;;\\<^sub>S Ys)))\" \n    apply (auto simp add: Swapout_L assms ruleMatch_def m_clash_def replace_Structure_aux_freevars_unchanged aa_def option.case_eq_if)\n    proof -\n    case goal1 \n      from Swapout_L(2) have \"List.length (map SE_to_DE_Action (rel alpha a)) = List.length (map SE_to_DE_Structure Ys)\" using map_list_len by auto\n      with swapout_L_some show ?case by simp\n    next\n    case goal2\n      have \"\\<forall>beta \\<in> set (map SE_to_DE_Action (rel alpha a)). freevars beta = {}\" by simp\n      then have \"freevars xb = {}\" using goal2 swapout_L_no_freevars by simp (* swapout_L_no_freevars not done *)\n      then have 0: \"replace (Sequent_Structure (?\\<^sub>S ''Ylist''), Sequent_Structure (;;\\<^sub>S map SE_to_DE_Structure Ys))\n       (replace (Sequent_Structure (?\\<^sub>S ''X''), Sequent_Structure (SE_to_DE_Structure X))\n         (replace (Sequent_Structure (Formula_Agent (?\\<^sub>Ag ''a'') \\<^sub>S), Sequent_Structure (Formula_Agent (Agent a) \\<^sub>S))\n           (replace (Sequent_Structure (Formula_Action (?\\<^sub>Act ''alpha'') \\<^sub>S), Sequent_Structure (Formula_Action (Action alpha) \\<^sub>S)) xb))) = xb\"\n      apply (cases xb, auto) by (simp add: replace_Structure_no_freevars0)+\n\n      have \"\\<forall>seq \\<in> set seq_list. \\<exists>pt. (concl pt) = seq \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) pt\" using aa unfolding seq_list_def  sorry\n      then have \"\\<forall>seq \\<in> set seq_list. concl (SOME pt. concl pt = seq \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) pt) = seq\" unfolding seq_list_def using  hilbert_concl_id2 by blast (* hilbert_concl_id2 not finished *)\n      then have 1: \"((concl \\<circ> (\\<lambda>x. SOME pt. concl pt = x \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) pt)) ` set seq_list) = (set seq_list)\" by (metis (no_types, lifting) comp_apply list.set_map map_idI)\n      from goal2(5) have \"set y = (set seq_list)\" unfolding seq_list_def sorry\n      with 0 1 goal2(6) show ?case by simp\n    next\n    case goal3\n      using swapout_L_no_freevars show ?case\n\n\n\n   sorry\nqed\n     (* proof -\n      case goal2 thus ?case\n        apply (induction \"(map SE_to_DE_Action (rel alpha a))\")\n        apply (auto simp add: Swapout_L assms ruleMatch_def m_clash_def replace_Structure_aux_freevars_unchanged aa_def option.case_eq_if)\n        using Swapout_L.IH apply auto[1]\n        proof -\n        case goal1 show ?case\n      *)\n\n\n  sorry\n    (*then obtain YBeta_list where YBeta_list_def: \"YBeta_list = map (\\<lambda>Y. (Y,  (the (List.find (\\<lambda>beta. loc \\<turnstile>d forwK\\<^sub>S a forwA\\<^sub>S beta X \\<turnstile>\\<^sub>S Y) (rel alpha a)))   )) Ys\" by simp\n    then obtain list where \"list = (map (\\<lambda>x. SE_to_DE_Sequent (forwK\\<^sub>S a forwA\\<^sub>S (prod.snd x) X \\<turnstile>\\<^sub>S (prod.fst x))) YBeta_list)\" by simp\n    then have \"concl ` set aa\"\n    proof -\n      have \"set aa = {pt. \\<forall>Y\\<in>set Ys. \\<exists>beta\\<in>set (rel alpha a).\n        loc \\<turnstile>d forwK\\<^sub>S a forwA\\<^sub>S beta X \\<turnstile>\\<^sub>S Y \\<and>\n        DE_to_SE_Sequent (concl pt) = Some (forwK\\<^sub>S a forwA\\<^sub>S beta X \\<turnstile>\\<^sub>S Y) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) pt}\" unfolding aa_def sorry\nwith YBeta_list_def show ?case unfolding aa_def\n    sorry\n   *)\n\n    with 0 have \"\\<exists>x \\<in> set (map SE_to_DE_Locale loc). set (prod.snd (der x (RuleSwapout Swapout_L) (SE_to_DE_Sequent (forwA\\<^sub>S alpha (forwK\\<^sub>S a X) \\<turnstile>\\<^sub>S ;;\\<^sub>S Ys)))) = set (map concl aa) \\<and> \n      Fail \\<noteq> prod.fst (der x (RuleSwapout Swapout_L) (SE_to_DE_Sequent (forwA\\<^sub>S alpha (forwK\\<^sub>S a X) \\<turnstile>\\<^sub>S ;;\\<^sub>S Ys)))\" by blast\n    then have 1: \"foldr (op \\<or>) (map ((\\<lambda>x. (\n      set (prod.snd (der x (RuleSwapout Swapout_L) (SE_to_DE_Sequent (forwA\\<^sub>S alpha (forwK\\<^sub>S a X) \\<turnstile>\\<^sub>S ;;\\<^sub>S Ys)))) = set (map concl aa) \\<and> \n      Fail \\<noteq> prod.fst (der x (RuleSwapout Swapout_L) (SE_to_DE_Sequent (forwA\\<^sub>S alpha (forwK\\<^sub>S a X) \\<turnstile>\\<^sub>S ;;\\<^sub>S Ys)))\n      )) \\<circ> SE_to_DE_Locale) loc) False\" using foldr_isPTWOMacro1 Swapout_L.prems by blast\n    have \"\\<forall>pt \\<in> set aa. isProofTreeWoMacro (map SE_to_DE_Locale loc) pt\" apply(auto simp add: some_eq_ex aa_def) apply (induct_tac x) sorry \n    then have \"foldr op \\<and> (map (isProofTreeWoMacro (map SE_to_DE_Locale loc)) aa) True\" sorry\n    with assms 1 show ?case by simp\n  qed\n\nnext\n\ncase (Pre_L alpha f loc X)\n  then obtain aa where assms: \"DE_to_SE_Sequent (concl aa) = Some (f \\<^sub>S \\<turnstile>\\<^sub>S X) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (rule exI [where x=\"(SE_to_DE_Sequent ((One\\<^sub>F alpha)\\<^sub>S \\<turnstile>\\<^sub>S X)) \\<Longleftarrow>PT (RuleOpAct Pre_L) [aa]\"])\n  apply rule\n  using SD_DS_Structure_Id apply auto[1]\n  proof -\n  case goal1\n    have 0: \"(SE_to_DE_Locale (DEAK_SE.Locale.PreFormula alpha f)) \\<in> set (map SE_to_DE_Locale loc)\" using Pre_L.hyps(1) by force\n\n    then have \"set (prod.snd (der (SE_to_DE_Locale (DEAK_SE.Locale.PreFormula alpha f)) (RuleOpAct Pre_L) (SE_to_DE_Sequent ((One\\<^sub>F alpha)\\<^sub>S \\<turnstile>\\<^sub>S X)))) = set (map concl [aa]) \\<and> \n      Fail \\<noteq> prod.fst (der (SE_to_DE_Locale (DEAK_SE.Locale.PreFormula alpha f)) (RuleOpAct Pre_L) (SE_to_DE_Sequent ((One\\<^sub>F alpha)\\<^sub>S \\<turnstile>\\<^sub>S X)))\" \n    apply (auto simp add: assms ruleMatch_def m_clash_def replace_Structure_aux_freevars_unchanged)\n    using SD_DS_Structure_Id replace_Structure_no_freevars0 SE_to_DE_Structure_freevars assms apply auto\n    by (metis DS_SD_Sequent_Id SE_to_DE_Sequent.simps SE_to_DE_Structure.simps(9) isProofTree_concl_freevars)\n\n    with 0 have \"\\<exists>x \\<in> set (map SE_to_DE_Locale loc). set (prod.snd (der x (RuleOpAct Pre_L) (SE_to_DE_Sequent ((One\\<^sub>F alpha)\\<^sub>S \\<turnstile>\\<^sub>S X)))) = set (map concl [aa]) \\<and> \n      Fail \\<noteq> prod.fst (der x (RuleOpAct Pre_L) (SE_to_DE_Sequent ((One\\<^sub>F alpha)\\<^sub>S \\<turnstile>\\<^sub>S X)))\" by blast\n    then have \"foldr (op \\<or>) (map ((\\<lambda>x. (\n      set (prod.snd (der x (RuleOpAct Pre_L) (SE_to_DE_Sequent ((One\\<^sub>F alpha)\\<^sub>S \\<turnstile>\\<^sub>S X)))) = set (map concl [aa]) \\<and> \n      Fail \\<noteq> prod.fst (der x (RuleOpAct Pre_L) (SE_to_DE_Sequent ((One\\<^sub>F alpha)\\<^sub>S \\<turnstile>\\<^sub>S X)))\n      )) \\<circ> SE_to_DE_Locale) loc) False\" using foldr_isPTWOMacro1 Pre_L.prems by blast\n    with assms show ?case by auto\nqed\nnext\n\ncase (SingleCut form loc X Y) \n  then obtain aa bb where assms: \"DE_to_SE_Sequent (concl aa) = Some (X \\<turnstile>\\<^sub>S form \\<^sub>S) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" \"DE_to_SE_Sequent (concl bb) = Some (form \\<^sub>S \\<turnstile>\\<^sub>S Y) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) bb\" by auto\n  show ?case\n  apply (rule exI [where x=\"(SE_to_DE_Sequent (X \\<turnstile>\\<^sub>S Y)) \\<Longleftarrow>PT (RuleCut SingleCut) [aa, bb]\"])\n  apply rule\n  using SD_DS_Structure_Id apply auto[1]\n  proof -\n  case goal1 \n    obtain form' where \"SE_to_DE_Formula form = form'\" by simp\n    with SingleCut(1) have 0: \"DEAK.Locale.CutFormula form' \\<in> set (map SE_to_DE_Locale loc)\" by force\n    then have \"set (prod.snd (der (DEAK.Locale.CutFormula form') (RuleCut SingleCut) (SE_to_DE_Sequent (X \\<turnstile>\\<^sub>S Y)))) = set (map concl [aa,bb]) \\<and> \n      Fail \\<noteq> prod.fst (der (DEAK.Locale.CutFormula form') (RuleCut SingleCut) (SE_to_DE_Sequent (X \\<turnstile>\\<^sub>S Y)))\" \n    apply (auto simp add: assms ruleMatch_def m_clash_def replace_Structure_aux_freevars_unchanged)\n    using SD_DS_Structure_Id replace_Structure_no_freevars0 SE_to_DE_Structure_freevars assms apply auto\n    by (metis DS_SD_Sequent_Id SE_to_DE_Sequent.simps SE_to_DE_Structure.simps(9) `SE_to_DE_Formula form = form'` assms isProofTree_concl_freevars)+\n\n    with 0 have \"\\<exists>x \\<in> set (map SE_to_DE_Locale loc). set (prod.snd (der x (RuleCut SingleCut) (SE_to_DE_Sequent (X \\<turnstile>\\<^sub>S Y)))) = set (map concl [aa,bb]) \\<and> \n      Fail \\<noteq> prod.fst (der x (RuleCut SingleCut) (SE_to_DE_Sequent (X \\<turnstile>\\<^sub>S Y)))\" by blast\n    then have \"foldr (op \\<or>) (map ((\\<lambda>x. (\n      set (prod.snd (der x (RuleCut SingleCut) (SE_to_DE_Sequent (X \\<turnstile>\\<^sub>S Y)))) = set (map concl [aa,bb]) \\<and> \n      Fail \\<noteq> prod.fst (der x (RuleCut SingleCut) (SE_to_DE_Sequent (X \\<turnstile>\\<^sub>S Y)))\n      )) \\<circ> SE_to_DE_Locale) loc) False\" using foldr_isPTWOMacro1 SingleCut(6) by blast\n    with assms show ?case by auto\n  qed\nnext\n\ncase (Swapin_L rel loc alpha a X Y beta)\n  then obtain aa where assms: \"DE_to_SE_Sequent (concl aa) = Some (forwA\\<^sub>S alpha forwK\\<^sub>S a X \\<turnstile>\\<^sub>S Y) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (rule exI [where x=\"(SE_to_DE_Sequent ((Phi\\<^sub>S alpha) ;\\<^sub>S (forwK\\<^sub>S a forwA\\<^sub>S beta X) \\<turnstile>\\<^sub>S Y)) \\<Longleftarrow>PT (RuleSwapin Swapin_L) [aa]\"])\n  apply rule\n  using SD_DS_Structure_Id apply simp\n  proof -\n  case goal1\n    have 0: \"(SE_to_DE_Locale (DEAK_SE.Locale.RelAKA rel)) \\<in> set (map SE_to_DE_Locale loc)\" using Swapin_L.hyps(1) by force\n\n    then have \"set (prod.snd (der (SE_to_DE_Locale (DEAK_SE.Locale.RelAKA rel)) (RuleSwapin Swapin_L) (SE_to_DE_Sequent ((Phi\\<^sub>S alpha) ;\\<^sub>S (forwK\\<^sub>S a forwA\\<^sub>S beta X) \\<turnstile>\\<^sub>S Y)))) = set (map concl [aa]) \\<and> \n      Fail \\<noteq> prod.fst (der (SE_to_DE_Locale (DEAK_SE.Locale.RelAKA rel)) (RuleSwapin Swapin_L) (SE_to_DE_Sequent ((Phi\\<^sub>S alpha) ;\\<^sub>S (forwK\\<^sub>S a forwA\\<^sub>S beta X) \\<turnstile>\\<^sub>S Y)))\" \n    apply (auto simp add: assms ruleMatch_def m_clash_def replace_Structure_aux_freevars_unchanged)\n    using SD_DS_Structure_Id replace_Structure_no_freevars0 SE_to_DE_Structure_freevars assms apply auto\n    apply (metis DS_SD_Sequent_Id SE_to_DE_Action.elims SE_to_DE_Agent.elims SE_to_DE_Sequent.simps SE_to_DE_Structure.simps(1) SE_to_DE_Structure.simps(4) isProofTree_concl_freevars)\n    proof -\n    case goal1 \n      from Swapin_L(3) have \"\\<exists>res. List.find (\\<lambda>x. x = Action beta) (map SE_to_DE_Action (rel alpha a)) = Some (Action beta)\" using relAKA_find by metis \n      with goal1 show ?case by simp\n    qed\n\n    with 0 have \"\\<exists>x \\<in> set (map SE_to_DE_Locale loc). set (prod.snd (der x (RuleSwapin Swapin_L) (SE_to_DE_Sequent ((Phi\\<^sub>S alpha) ;\\<^sub>S (forwK\\<^sub>S a forwA\\<^sub>S beta X) \\<turnstile>\\<^sub>S Y)))) = set (map concl [aa]) \\<and> \n      Fail \\<noteq> prod.fst (der x (RuleSwapin Swapin_L) (SE_to_DE_Sequent ((Phi\\<^sub>S alpha) ;\\<^sub>S (forwK\\<^sub>S a forwA\\<^sub>S beta X) \\<turnstile>\\<^sub>S Y)))\" by blast\n    then have \"foldr (op \\<or>) (map ((\\<lambda>x. (\n      set (prod.snd (der x (RuleSwapin Swapin_L) (SE_to_DE_Sequent ((Phi\\<^sub>S alpha) ;\\<^sub>S (forwK\\<^sub>S a forwA\\<^sub>S beta X) \\<turnstile>\\<^sub>S Y)))) = set (map concl [aa]) \\<and> \n      Fail \\<noteq> prod.fst (der x (RuleSwapin Swapin_L) (SE_to_DE_Sequent ((Phi\\<^sub>S alpha) ;\\<^sub>S (forwK\\<^sub>S a forwA\\<^sub>S beta X) \\<turnstile>\\<^sub>S Y)))\n      )) \\<circ> SE_to_DE_Locale) loc) False\" using foldr_isPTWOMacro1 Swapin_L.prems by blast\n     \n    with assms show ?case by auto\n  qed\nnext\ncase (Swapin_R rel loc Y alpha a X beta)\n  then obtain aa where assms: \"DE_to_SE_Sequent (concl aa) = Some (Y \\<turnstile>\\<^sub>S forwA\\<^sub>S alpha forwK\\<^sub>S a X) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (rule exI [where x=\"(SE_to_DE_Sequent (Y \\<turnstile>\\<^sub>S (Phi\\<^sub>S alpha) \\<rightarrow>\\<^sub>S (forwK\\<^sub>S a (forwA\\<^sub>S beta X)))) \\<Longleftarrow>PT (RuleSwapin Swapin_R) [aa]\"])\n  apply rule\n  using SD_DS_Structure_Id apply simp\n  proof -\n  case goal1\n    have 0: \"(SE_to_DE_Locale (DEAK_SE.Locale.RelAKA rel)) \\<in> set (map SE_to_DE_Locale loc)\" using Swapin_R.hyps(1) by force\n\n    then have \"set (prod.snd (der (SE_to_DE_Locale (DEAK_SE.Locale.RelAKA rel)) (RuleSwapin Swapin_R) (SE_to_DE_Sequent (Y \\<turnstile>\\<^sub>S (Phi\\<^sub>S alpha) \\<rightarrow>\\<^sub>S (forwK\\<^sub>S a (forwA\\<^sub>S beta X)))))) = set (map concl [aa]) \\<and> \n      Fail \\<noteq> prod.fst (der (SE_to_DE_Locale (DEAK_SE.Locale.RelAKA rel)) (RuleSwapin Swapin_R) (SE_to_DE_Sequent (Y \\<turnstile>\\<^sub>S (Phi\\<^sub>S alpha) \\<rightarrow>\\<^sub>S (forwK\\<^sub>S a (forwA\\<^sub>S beta X)))))\" \n    apply (auto simp add: assms ruleMatch_def m_clash_def replace_Structure_aux_freevars_unchanged)\n    using SD_DS_Structure_Id replace_Structure_no_freevars0 SE_to_DE_Structure_freevars assms apply auto\n    apply (metis DS_SD_Sequent_Id SE_to_DE_Action.elims SE_to_DE_Agent.elims SE_to_DE_Sequent.simps SE_to_DE_Structure.simps(1) SE_to_DE_Structure.simps(4) isProofTree_concl_freevars)\n    proof -\n    case goal1 \n      from Swapin_R(3) have \"\\<exists>res. List.find (\\<lambda>x. x = Action beta) (map SE_to_DE_Action (rel alpha a)) = Some (Action beta)\" using relAKA_find by metis \n      with goal1 show ?case by simp\n    qed\n\n    with 0 have \"\\<exists>x \\<in> set (map SE_to_DE_Locale loc). set (prod.snd (der x (RuleSwapin Swapin_R) (SE_to_DE_Sequent (Y \\<turnstile>\\<^sub>S (Phi\\<^sub>S alpha) \\<rightarrow>\\<^sub>S (forwK\\<^sub>S a (forwA\\<^sub>S beta X)))))) = set (map concl [aa]) \\<and> \n      Fail \\<noteq> prod.fst (der x (RuleSwapin Swapin_R) (SE_to_DE_Sequent (Y \\<turnstile>\\<^sub>S (Phi\\<^sub>S alpha) \\<rightarrow>\\<^sub>S (forwK\\<^sub>S a (forwA\\<^sub>S beta X)))))\" by blast\n    then have \"foldr (op \\<or>) (map ((\\<lambda>x. (\n      set (prod.snd (der x (RuleSwapin Swapin_R) (SE_to_DE_Sequent (Y \\<turnstile>\\<^sub>S (Phi\\<^sub>S alpha) \\<rightarrow>\\<^sub>S (forwK\\<^sub>S a (forwA\\<^sub>S beta X)))))) = set (map concl [aa]) \\<and> \n      Fail \\<noteq> prod.fst (der x (RuleSwapin Swapin_R) (SE_to_DE_Sequent (Y \\<turnstile>\\<^sub>S (Phi\\<^sub>S alpha) \\<rightarrow>\\<^sub>S (forwK\\<^sub>S a (forwA\\<^sub>S beta X)))))\n      )) \\<circ> SE_to_DE_Locale) loc) False\" using foldr_isPTWOMacro1 Swapin_R.prems by blast\n     \n    with assms show ?case by auto\n  qed\nnext\n\n\ncase Swapout_R thus ?case sorry\nnext\ncase (Bigcomma_Nil_R2 loc Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Y \\<turnstile>\\<^sub>S I\\<^sub>S)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Y \\<turnstile>\\<^sub>S (;;\\<^sub>S [])))) \\<Longleftarrow>PT (RuleBigcomma Bigcomma_Nil_R2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Bigcomma_Nil_R loc Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Y \\<turnstile>\\<^sub>S (;;\\<^sub>S []))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Y \\<turnstile>\\<^sub>S I\\<^sub>S))) \\<Longleftarrow>PT (RuleBigcomma Bigcomma_Nil_R) [aa]\" add: assms)\n  proof -\n  case goal1 \n    then have \"concl aa = SE_to_DE_Sequent (Y \\<turnstile>\\<^sub>S ;;\\<^sub>S [])\"\n      using DS_SD_Sequent_Id assms isProofTree_concl_freevars by blast\n    thus ?case by force\n  qed\nnext\ncase (Bigcomma_Nil_L2 loc Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((I\\<^sub>S \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((;;\\<^sub>S []) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleBigcomma Bigcomma_Nil_L2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Bigcomma_Nil_L loc Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((;;\\<^sub>S []) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((I\\<^sub>S \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleBigcomma Bigcomma_Nil_L) [aa]\" add: assms)\n  proof -\n  case goal1\n    then have \"concl aa = ;;\\<^sub>S [] \\<turnstile>\\<^sub>S SE_to_DE_Structure Y\"\n      using DS_SD_Sequent_Id assms isProofTree_concl_freevars\n      by (metis SE_to_DE_Sequent.simps SE_to_DE_Structure.simps(5) list.simps(8))\n    thus ?case by force\n  qed\nnext\n\n\n\ncase (Comma_impL_disp loc X Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((X ;\\<^sub>S Y) \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (Z \\<leftarrow>\\<^sub>S Y)))) \\<Longleftarrow>PT (RuleDisp Comma_impL_disp) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Comma_impR_disp2 loc Y X Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Y \\<turnstile>\\<^sub>S (X \\<rightarrow>\\<^sub>S Z))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((X ;\\<^sub>S Y) \\<turnstile>\\<^sub>S Z))) \\<Longleftarrow>PT (RuleDisp Comma_impR_disp2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpL_comma_disp2 loc Z Y X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((Z \\<leftarrow>\\<^sub>S Y) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Z \\<turnstile>\\<^sub>S (X ;\\<^sub>S Y)))) \\<Longleftarrow>PT (RuleDisp ImpL_comma_disp2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpR_comma_disp2 loc X Z Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((X \\<rightarrow>\\<^sub>S Z) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Z \\<turnstile>\\<^sub>S (X ;\\<^sub>S Y)))) \\<Longleftarrow>PT (RuleDisp ImpR_comma_disp2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpR_comma_disp loc Z X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Z \\<turnstile>\\<^sub>S (X ;\\<^sub>S Y))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((X \\<rightarrow>\\<^sub>S Z) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleDisp ImpR_comma_disp) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpL_comma_disp loc Z X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Z \\<turnstile>\\<^sub>S (X ;\\<^sub>S Y))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((Z \\<leftarrow>\\<^sub>S Y) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleDisp ImpL_comma_disp) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Comma_impR_disp loc X Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((X ;\\<^sub>S Y) \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Y \\<turnstile>\\<^sub>S (X \\<rightarrow>\\<^sub>S Z)))) \\<Longleftarrow>PT (RuleDisp Comma_impR_disp) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Comma_impL_disp2 loc X Z Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (Z \\<leftarrow>\\<^sub>S Y))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((X ;\\<^sub>S Y) \\<turnstile>\\<^sub>S Z))) \\<Longleftarrow>PT (RuleDisp Comma_impL_disp2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (Back_forw_A loc X a Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (forwA\\<^sub>S a Y))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((backA\\<^sub>S a X) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleDispAct Back_forw_A) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Forw_back_A2 loc X a Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (backA\\<^sub>S a Y))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwA\\<^sub>S a X) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleDispAct Forw_back_A2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Forw_back_A loc a X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((forwA\\<^sub>S a X) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (backA\\<^sub>S a Y)))) \\<Longleftarrow>PT (RuleDispAct Forw_back_A) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Back_forw_A2 loc a X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((backA\\<^sub>S a X) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (forwA\\<^sub>S a Y)))) \\<Longleftarrow>PT (RuleDispAct Back_forw_A2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (Back_forw_K2 loc a X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((backK\\<^sub>S a X) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (forwK\\<^sub>S a Y)))) \\<Longleftarrow>PT (RuleDispK Back_forw_K2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Back_forw_K loc X a Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (forwK\\<^sub>S a Y))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((backK\\<^sub>S a X) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleDispK Back_forw_K) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Forw_back_K2 loc X a Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (backK\\<^sub>S a Y))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwK\\<^sub>S a X) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleDispK Forw_back_K2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Forw_back_K loc a X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((forwK\\<^sub>S a X) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (backK\\<^sub>S a Y)))) \\<Longleftarrow>PT (RuleDispK Forw_back_K) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (Grishin_R2 loc W X Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((W \\<turnstile>\\<^sub>S ((X \\<rightarrow>\\<^sub>S Y) ;\\<^sub>S Z))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((W \\<turnstile>\\<^sub>S (X \\<rightarrow>\\<^sub>S (Y ;\\<^sub>S Z))))) \\<Longleftarrow>PT (RuleGrish Grishin_R2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Grishin_R loc W X Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((W \\<turnstile>\\<^sub>S (X \\<rightarrow>\\<^sub>S (Y ;\\<^sub>S Z)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((W \\<turnstile>\\<^sub>S ((X \\<rightarrow>\\<^sub>S Y) ;\\<^sub>S Z)))) \\<Longleftarrow>PT (RuleGrish Grishin_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Grishin_L loc X Y Z W)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((X \\<rightarrow>\\<^sub>S (Y ;\\<^sub>S Z)) \\<turnstile>\\<^sub>S W)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((X \\<rightarrow>\\<^sub>S Y) ;\\<^sub>S Z) \\<turnstile>\\<^sub>S W))) \\<Longleftarrow>PT (RuleGrish Grishin_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Grishin_L2 loc X Y Z W)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((X \\<rightarrow>\\<^sub>S Y) ;\\<^sub>S Z) \\<turnstile>\\<^sub>S W)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((X \\<rightarrow>\\<^sub>S (Y ;\\<^sub>S Z)) \\<turnstile>\\<^sub>S W))) \\<Longleftarrow>PT (RuleGrish Grishin_L2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (Bot_R loc X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S I\\<^sub>S)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (\\<bottom>\\<^sub>F \\<^sub>S)))) \\<Longleftarrow>PT (RuleOp Bot_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Top_L loc X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((I\\<^sub>S \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((\\<top>\\<^sub>F \\<^sub>S) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleOp Top_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (DImpR_L loc A B Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((A \\<^sub>S) \\<rightarrow>\\<^sub>S (B \\<^sub>S)) \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((A >-\\<^sub>F B) \\<^sub>S) \\<turnstile>\\<^sub>S Z))) \\<Longleftarrow>PT (RuleOp DImpR_L) [aa]\" add: assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis DE_to_SE_Formula.simps(13) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Formula.simps(13) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpL_R loc Z B A)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Z \\<turnstile>\\<^sub>S ((B \\<^sub>S) \\<leftarrow>\\<^sub>S (A \\<^sub>S)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Z \\<turnstile>\\<^sub>S ((B \\<leftarrow>\\<^sub>F A) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOp ImpL_R) [aa]\" add: assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis (no_types, lifting) DE_to_SE_Formula.simps(11) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Formula.simps(11) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (DImpL_R loc Y B A X)\n  then obtain aa bb where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((A \\<^sub>S) \\<turnstile>\\<^sub>S X)) \\<and> (isProofTreeWoMacro (map SE_to_DE_Locale loc) aa)\" \"DE_to_SE_Sequent (concl bb) = Some ((Y \\<turnstile>\\<^sub>S (B \\<^sub>S))) \\<and> (isProofTreeWoMacro (map SE_to_DE_Locale loc) bb)\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((Y \\<leftarrow>\\<^sub>S X) \\<turnstile>\\<^sub>S ((B -<\\<^sub>F A) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOp DImpL_R) [aa, bb]\" add: assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis (no_types, lifting) DE_to_SE_Formula.simps(12) DE_to_SE_Formula_freevars DE_to_SE_Structure.simps(10) SE_to_DE_Formula.simps(12) SE_to_DE_Structure.simps(7) SE_to_DE_Structure.simps(9) option.simps(5))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (And_L loc A B Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((A \\<^sub>S) ;\\<^sub>S (B \\<^sub>S)) \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((A \\<and>\\<^sub>F B) \\<^sub>S) \\<turnstile>\\<^sub>S Z))) \\<Longleftarrow>PT (RuleOp And_L) [aa]\" add: assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis DE_to_SE_Formula.simps(10) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Formula.simps(10) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpR_R loc Z A B)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Z \\<turnstile>\\<^sub>S ((A \\<^sub>S) \\<rightarrow>\\<^sub>S (B \\<^sub>S)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Z \\<turnstile>\\<^sub>S ((A \\<rightarrow>\\<^sub>F B) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOp ImpR_R) [aa]\" add: assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis (no_types, lifting) DE_to_SE_Formula.simps(15) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Formula.simps(15) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Or_L loc B Y A X)\n  then obtain aa bb where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((A \\<^sub>S) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" \"DE_to_SE_Sequent (concl bb) = Some (((B \\<^sub>S) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) bb\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((A \\<or>\\<^sub>F B) \\<^sub>S) \\<turnstile>\\<^sub>S (X ;\\<^sub>S Y)))) \\<Longleftarrow>PT (RuleOp Or_L) [aa, bb]\" add:assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis DE_to_SE_Formula.simps(14) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Formula.simps(14) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Or_R loc Z A B)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Z \\<turnstile>\\<^sub>S ((A \\<^sub>S) ;\\<^sub>S (B \\<^sub>S)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Z \\<turnstile>\\<^sub>S ((A \\<or>\\<^sub>F B) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOp Or_R) [aa]\" add:assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis (no_types, lifting) DE_to_SE_Formula.simps(14) DE_to_SE_Formula_freevars DE_to_SE_Structure.simps(10) SE_to_DE_Formula.simps(14) SE_to_DE_Structure.simps(9) option.simps(5))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpR_L loc B Y X A)\n  then obtain aa bb where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (A \\<^sub>S))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" \"DE_to_SE_Sequent (concl bb) = Some (((B \\<^sub>S) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) bb\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((A \\<rightarrow>\\<^sub>F B) \\<^sub>S) \\<turnstile>\\<^sub>S (X \\<rightarrow>\\<^sub>S Y)))) \\<Longleftarrow>PT (RuleOp ImpR_L) [aa, bb]\" add:assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis (no_types, lifting) DE_to_SE_Formula.simps(15) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Formula.simps(15) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (DImpL_L loc B A Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((B \\<^sub>S) \\<leftarrow>\\<^sub>S (A \\<^sub>S)) \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((B -<\\<^sub>F A) \\<^sub>S) \\<turnstile>\\<^sub>S Z))) \\<Longleftarrow>PT (RuleOp DImpL_L) [aa]\" add:assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis DE_to_SE_Formula.simps(12) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Formula.simps(12) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (And_R loc Y B X A)\n  then obtain aa bb where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (A \\<^sub>S))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" \"DE_to_SE_Sequent (concl bb) = Some ((Y \\<turnstile>\\<^sub>S (B \\<^sub>S))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) bb\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((X ;\\<^sub>S Y) \\<turnstile>\\<^sub>S ((A \\<and>\\<^sub>F B) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOp And_R) [aa, bb]\" add:assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis (no_types, lifting) DE_to_SE_Formula.simps(10) DE_to_SE_Formula_freevars DE_to_SE_Structure.simps(10) SE_to_DE_Formula.simps(10) SE_to_DE_Structure.simps(6) SE_to_DE_Structure.simps(9) option.simps(5))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (DImpR_R loc Y B A X)\n  then obtain aa bb where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((A \\<^sub>S) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" \"DE_to_SE_Sequent (concl bb) = Some ((Y \\<turnstile>\\<^sub>S (B \\<^sub>S))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) bb\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((X \\<rightarrow>\\<^sub>S Y) \\<turnstile>\\<^sub>S ((A >-\\<^sub>F B) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOp DImpR_R) [aa, bb]\" add:assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis (mono_tags, lifting) DE_to_SE_Formula.simps(13) DE_to_SE_Formula_freevars DE_to_SE_Structure.simps(10) SE_to_DE_Formula.simps(13) SE_to_DE_Structure.simps(8) SE_to_DE_Structure.simps(9) option.simps(5))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpL_L loc B Y X A)\n  then obtain aa bb where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (A \\<^sub>S))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" \"DE_to_SE_Sequent (concl bb) = Some (((B \\<^sub>S) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) bb\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((B \\<leftarrow>\\<^sub>F A) \\<^sub>S) \\<turnstile>\\<^sub>S (Y \\<leftarrow>\\<^sub>S X)))) \\<Longleftarrow>PT (RuleOp ImpL_L) [aa, bb]\" add:assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis DE_to_SE_Formula.simps(11) DE_to_SE_Formula_freevars DE_to_SE_Structure.simps(10) SE_to_DE_Formula.simps(11) SE_to_DE_Structure.simps(9) option.simps(5))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (Top_R loc )\n  show ?case\n  by (se_to_de_tac \"(SE_to_DE_Sequent (I\\<^sub>S \\<turnstile>\\<^sub>S (\\<top>\\<^sub>F \\<^sub>S))) \\<Longleftarrow>PT (RuleOp Top_R) []\" add:assms Top_R)\nnext\n\ncase (Bot_L loc )\n  show ?case\n  by (se_to_de_tac \"(SE_to_DE_Sequent (((\\<bottom>\\<^sub>F \\<^sub>S) \\<turnstile>\\<^sub>S I\\<^sub>S))) \\<Longleftarrow>PT (RuleOp Bot_L) []\" add: assms Bot_L)\nnext\n\ncase (FdiamA_L loc a A X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((forwA\\<^sub>S a (A \\<^sub>S)) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((fdiamA\\<^sub>F a A) \\<^sub>S) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleOpAct FdiamA_L) [aa]\" add:assms)\n  using SD_DS_Structure_Id replace_Formula_no_freevars0 replace_Structure_no_freevars0 SE_to_DE_Structure_freevars SE_to_DE_Formula_freevars apply auto\n  apply (metis DE_to_SE_Formula.simps(2) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Action.simps SE_to_DE_Formula.simps(2) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (One_R loc a)\n  show ?case\n  by (se_to_de_tac \"(SE_to_DE_Sequent (((Phi\\<^sub>S a) \\<turnstile>\\<^sub>S ((One\\<^sub>F a) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOpAct One_R) []\" add: assms One_R)\nnext\ncase (FboxA_R loc X a A)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (forwA\\<^sub>S a (A \\<^sub>S)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S ((fboxA\\<^sub>F a A) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOpAct FboxA_R) [aa]\" add: assms)\n  apply (metis (no_types, lifting) DE_to_SE_Formula.simps(1) DE_to_SE_Formula_freevars DE_to_SE_Structure.simps(10) SE_to_DE_Action.simps SE_to_DE_Formula.simps(1) SE_to_DE_Structure.simps(9) option.simps(5))\n  using SE_to_DE_Formula_freevars apply auto\n  by (metis DS_SD_Sequent_Id SE_to_DE_Action.elims SE_to_DE_Sequent.simps SE_to_DE_Structure.simps(1) SE_to_DE_Structure.simps(9) assms isProofTree_concl_freevars)\n  next\n\ncase (FboxA_L loc A X a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((A \\<^sub>S) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((fboxA\\<^sub>F a A) \\<^sub>S) \\<turnstile>\\<^sub>S (forwA\\<^sub>S a X)))) \\<Longleftarrow>PT (RuleOpAct FboxA_L) [aa]\" add: assms)\n  using SE_to_DE_Formula_freevars replace_Formula_no_freevars0 apply auto\n  apply (metis DE_to_SE_Formula.simps(1) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Action.elims SE_to_DE_Formula.simps(1) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (One_L loc a X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((Phi\\<^sub>S a) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((One\\<^sub>F a) \\<^sub>S) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleOpAct One_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (FdiamA_R loc X A a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (A \\<^sub>S))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwA\\<^sub>S a X) \\<turnstile>\\<^sub>S ((fdiamA\\<^sub>F a A) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOpAct FdiamA_R) [aa]\" add: assms)\n  using SE_to_DE_Formula_freevars replace_Formula_no_freevars0 apply auto\n  apply (metis (no_types, lifting) DE_to_SE_Formula.simps(2) DE_to_SE_Formula_freevars DE_to_SE_Structure.simps(10) SE_to_DE_Action.simps SE_to_DE_Formula.simps(2) SE_to_DE_Structure.simps(1) SE_to_DE_Structure.simps(9) option.simps(5))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (FboxK_L loc A X a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((A \\<^sub>S) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((fboxK\\<^sub>F a A) \\<^sub>S) \\<turnstile>\\<^sub>S (forwK\\<^sub>S a X)))) \\<Longleftarrow>PT (RuleOpK FboxK_L) [aa]\" add: assms)\n  using SE_to_DE_Formula_freevars replace_Formula_no_freevars0 apply auto\n  apply (metis DE_to_SE_Formula.simps(5) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Agent.simps SE_to_DE_Formula.simps(5) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (FdiamK_R loc X A a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (A \\<^sub>S))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwK\\<^sub>S a X) \\<turnstile>\\<^sub>S ((fdiamK\\<^sub>F a A) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOpK FdiamK_R) [aa]\" add: assms)\n  using SE_to_DE_Formula_freevars replace_Formula_no_freevars0 apply auto\n  apply (metis (no_types, lifting) DE_to_SE_Formula.simps(6) DE_to_SE_Formula_freevars DE_to_SE_Structure.simps(10) SE_to_DE_Agent.simps SE_to_DE_Formula.simps(6) SE_to_DE_Structure.simps(4) SE_to_DE_Structure.simps(9) option.simps(5))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (FboxK_R loc X a A)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (forwK\\<^sub>S a (A \\<^sub>S)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S ((fboxK\\<^sub>F a A) \\<^sub>S)))) \\<Longleftarrow>PT (RuleOpK FboxK_R) [aa]\" add: assms)\n  using SE_to_DE_Formula_freevars replace_Formula_no_freevars0 apply auto\n  apply (metis (no_types, lifting) DE_to_SE_Formula.simps(5) DE_to_SE_Structure.simps(10) SE_to_DE_Agent.simps SE_to_DE_Formula.simps(5) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1) option.simps(5))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (FdiamK_L loc a A X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((forwK\\<^sub>S a (A \\<^sub>S)) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((fdiamK\\<^sub>F a A) \\<^sub>S) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleOpK FdiamK_L) [aa]\" add: assms)\n  using SE_to_DE_Formula_freevars replace_Formula_no_freevars0 apply auto\n  apply (metis DE_to_SE_Formula.simps(6) DE_to_SE_Structure.simps(10) SD_DS_Structure_Id2 SE_to_DE_Agent.simps SE_to_DE_Formula.simps(6) SE_to_DE_Structure.simps(9) option.case_eq_if option.distinct(1))\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (W_impL_R loc X Z Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((X \\<leftarrow>\\<^sub>S Z) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct W_impL_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpL_I loc X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((X \\<leftarrow>\\<^sub>S Y) \\<turnstile>\\<^sub>S I\\<^sub>S))) \\<Longleftarrow>PT (RuleStruct ImpL_I) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (W_impL_L loc X Z Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Y \\<turnstile>\\<^sub>S (Z \\<leftarrow>\\<^sub>S X)))) \\<Longleftarrow>PT (RuleStruct W_impL_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpR_I2 loc Y X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((Y \\<rightarrow>\\<^sub>S X) \\<turnstile>\\<^sub>S I\\<^sub>S)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct ImpR_I2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (E_R loc X Y1 Y2)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (Y1 ;\\<^sub>S Y2))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (Y2 ;\\<^sub>S Y1)))) \\<Longleftarrow>PT (RuleStruct E_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (IW_R loc X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S I\\<^sub>S)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct IW_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (IW_L loc Y X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((I\\<^sub>S \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct IW_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (A_L2 loc X Y Z W)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((X ;\\<^sub>S (Y ;\\<^sub>S Z)) \\<turnstile>\\<^sub>S W)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((X ;\\<^sub>S Y) ;\\<^sub>S Z) \\<turnstile>\\<^sub>S W))) \\<Longleftarrow>PT (RuleStruct A_L2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (E_L loc X1 X2 Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((X1 ;\\<^sub>S X2) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((X2 ;\\<^sub>S X1) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct E_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (A_R loc W X Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((W \\<turnstile>\\<^sub>S ((X ;\\<^sub>S Y) ;\\<^sub>S Z))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((W \\<turnstile>\\<^sub>S (X ;\\<^sub>S (Y ;\\<^sub>S Z))))) \\<Longleftarrow>PT (RuleStruct A_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (W_impR_R loc X Z Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Y \\<turnstile>\\<^sub>S (X \\<rightarrow>\\<^sub>S Z)))) \\<Longleftarrow>PT (RuleStruct W_impR_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (C_L loc X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((X ;\\<^sub>S X) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct C_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (C_R loc X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S (Y ;\\<^sub>S Y))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct C_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpR_I loc X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((Y \\<rightarrow>\\<^sub>S X) \\<turnstile>\\<^sub>S I\\<^sub>S))) \\<Longleftarrow>PT (RuleStruct ImpR_I) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (W_impR_L loc X Z Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((Z \\<rightarrow>\\<^sub>S X) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct W_impR_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (A_L loc X Y Z W)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((X ;\\<^sub>S Y) ;\\<^sub>S Z) \\<turnstile>\\<^sub>S W)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((X ;\\<^sub>S (Y ;\\<^sub>S Z)) \\<turnstile>\\<^sub>S W))) \\<Longleftarrow>PT (RuleStruct A_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (A_R2 loc W X Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((W \\<turnstile>\\<^sub>S (X ;\\<^sub>S (Y ;\\<^sub>S Z)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((W \\<turnstile>\\<^sub>S ((X ;\\<^sub>S Y) ;\\<^sub>S Z)))) \\<Longleftarrow>PT (RuleStruct A_R2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (I_impR2 loc X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((I\\<^sub>S \\<turnstile>\\<^sub>S (X \\<rightarrow>\\<^sub>S Y))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct I_impR2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (I_impL loc X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((I\\<^sub>S \\<turnstile>\\<^sub>S (Y \\<leftarrow>\\<^sub>S X)))) \\<Longleftarrow>PT (RuleStruct I_impL) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (I_impR loc X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((I\\<^sub>S \\<turnstile>\\<^sub>S (X \\<rightarrow>\\<^sub>S Y)))) \\<Longleftarrow>PT (RuleStruct I_impR) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (ImpL_I2 loc X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((X \\<leftarrow>\\<^sub>S Y) \\<turnstile>\\<^sub>S I\\<^sub>S)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct ImpL_I2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (I_impL2 loc Y X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((I\\<^sub>S \\<turnstile>\\<^sub>S (Y \\<leftarrow>\\<^sub>S X))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStruct I_impL2) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (A_nec_L loc X a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((I\\<^sub>S \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((backA\\<^sub>S a I\\<^sub>S) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleStructAct A_nec_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (A_mon_L loc a X Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((backA\\<^sub>S a X) ;\\<^sub>S (backA\\<^sub>S a Y)) \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((backA\\<^sub>S a (X ;\\<^sub>S Y)) \\<turnstile>\\<^sub>S Z))) \\<Longleftarrow>PT (RuleStructAct A_mon_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Mon_A_R loc Z a X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Z \\<turnstile>\\<^sub>S ((forwA\\<^sub>S a X) ;\\<^sub>S (forwA\\<^sub>S a Y)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Z \\<turnstile>\\<^sub>S (forwA\\<^sub>S a (X ;\\<^sub>S Y))))) \\<Longleftarrow>PT (RuleStructAct Mon_A_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Nec_A_L loc X a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((I\\<^sub>S \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwA\\<^sub>S a I\\<^sub>S) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleStructAct Nec_A_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (FS_A_L loc a Y Z X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((forwA\\<^sub>S a Y) \\<rightarrow>\\<^sub>S (forwA\\<^sub>S a Z)) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwA\\<^sub>S a (Y \\<rightarrow>\\<^sub>S Z)) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleStructAct FS_A_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (FS_A_R loc X a Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S ((forwA\\<^sub>S a Y) \\<rightarrow>\\<^sub>S (forwA\\<^sub>S a Z)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (forwA\\<^sub>S a (Y \\<rightarrow>\\<^sub>S Z))))) \\<Longleftarrow>PT (RuleStructAct FS_A_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (A_mon_R loc Z a X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Z \\<turnstile>\\<^sub>S ((backA\\<^sub>S a X) ;\\<^sub>S (backA\\<^sub>S a Y)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Z \\<turnstile>\\<^sub>S (backA\\<^sub>S a (X ;\\<^sub>S Y))))) \\<Longleftarrow>PT (RuleStructAct A_mon_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (A_FS_R loc X a Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S ((backA\\<^sub>S a Y) \\<rightarrow>\\<^sub>S (backA\\<^sub>S a Z)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (backA\\<^sub>S a (Y \\<rightarrow>\\<^sub>S Z))))) \\<Longleftarrow>PT (RuleStructAct A_FS_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Nec_A_R loc X a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S I\\<^sub>S)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (forwA\\<^sub>S a I\\<^sub>S)))) \\<Longleftarrow>PT (RuleStructAct Nec_A_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Mon_A_L loc a X Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((forwA\\<^sub>S a X) ;\\<^sub>S (forwA\\<^sub>S a Y)) \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwA\\<^sub>S a (X ;\\<^sub>S Y)) \\<turnstile>\\<^sub>S Z))) \\<Longleftarrow>PT (RuleStructAct Mon_A_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (A_FS_L loc a Y Z X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((backA\\<^sub>S a Y) \\<rightarrow>\\<^sub>S (backA\\<^sub>S a Z)) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((backA\\<^sub>S a (Y \\<rightarrow>\\<^sub>S Z)) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleStructAct A_FS_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (A_nec_R loc X a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S I\\<^sub>S)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (backA\\<^sub>S a I\\<^sub>S)))) \\<Longleftarrow>PT (RuleStructAct A_nec_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (Reduce_R loc Y a X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Y \\<turnstile>\\<^sub>S ((Phi\\<^sub>S a) \\<rightarrow>\\<^sub>S (forwA\\<^sub>S a X)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Y \\<turnstile>\\<^sub>S (forwA\\<^sub>S a X)))) \\<Longleftarrow>PT (RuleStructEA Reduce_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (CompA_R loc Y a X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Y \\<turnstile>\\<^sub>S (forwA\\<^sub>S a (backA\\<^sub>S a X)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Y \\<turnstile>\\<^sub>S ((Phi\\<^sub>S a) \\<rightarrow>\\<^sub>S X)))) \\<Longleftarrow>PT (RuleStructEA CompA_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Balance loc X Y a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwA\\<^sub>S a X) \\<turnstile>\\<^sub>S (forwA\\<^sub>S a Y)))) \\<Longleftarrow>PT (RuleStructEA Balance) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (CompA_L loc a X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (((forwA\\<^sub>S a (backA\\<^sub>S a X)) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((((Phi\\<^sub>S a) ;\\<^sub>S X) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStructEA CompA_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Reduce_L loc a X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((Phi\\<^sub>S a) ;\\<^sub>S (forwA\\<^sub>S a X)) \\<turnstile>\\<^sub>S Y)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwA\\<^sub>S a X) \\<turnstile>\\<^sub>S Y))) \\<Longleftarrow>PT (RuleStructEA Reduce_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\ncase (K_nec_R loc X a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S I\\<^sub>S)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (backK\\<^sub>S a I\\<^sub>S)))) \\<Longleftarrow>PT (RuleStructK K_nec_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Nec_K_L loc X a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((I\\<^sub>S \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwK\\<^sub>S a I\\<^sub>S) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleStructK Nec_K_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (K_mon_L loc a X Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((backK\\<^sub>S a X) ;\\<^sub>S (backK\\<^sub>S a Y)) \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((backK\\<^sub>S a (X ;\\<^sub>S Y)) \\<turnstile>\\<^sub>S Z))) \\<Longleftarrow>PT (RuleStructK K_mon_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Mon_K_L loc a X Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((forwK\\<^sub>S a X) ;\\<^sub>S (forwK\\<^sub>S a Y)) \\<turnstile>\\<^sub>S Z)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwK\\<^sub>S a (X ;\\<^sub>S Y)) \\<turnstile>\\<^sub>S Z))) \\<Longleftarrow>PT (RuleStructK Mon_K_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (FS_K_L loc a Y Z X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((forwK\\<^sub>S a Y) \\<rightarrow>\\<^sub>S (forwK\\<^sub>S a Z)) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((forwK\\<^sub>S a (Y \\<rightarrow>\\<^sub>S Z)) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleStructK FS_K_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (FS_K_R loc X a Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S ((forwK\\<^sub>S a Y) \\<rightarrow>\\<^sub>S (forwK\\<^sub>S a Z)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (forwK\\<^sub>S a (Y \\<rightarrow>\\<^sub>S Z))))) \\<Longleftarrow>PT (RuleStructK FS_K_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Mon_K_R loc Z a X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Z \\<turnstile>\\<^sub>S ((forwK\\<^sub>S a X) ;\\<^sub>S (forwK\\<^sub>S a Y)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Z \\<turnstile>\\<^sub>S (forwK\\<^sub>S a (X ;\\<^sub>S Y))))) \\<Longleftarrow>PT (RuleStructK Mon_K_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (K_mon_R loc Z a X Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((Z \\<turnstile>\\<^sub>S ((backK\\<^sub>S a X) ;\\<^sub>S (backK\\<^sub>S a Y)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((Z \\<turnstile>\\<^sub>S (backK\\<^sub>S a (X ;\\<^sub>S Y))))) \\<Longleftarrow>PT (RuleStructK K_mon_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (K_FS_L loc a Y Z X)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((((backK\\<^sub>S a Y) \\<rightarrow>\\<^sub>S (backK\\<^sub>S a Z)) \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((backK\\<^sub>S a (Y \\<rightarrow>\\<^sub>S Z)) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleStructK K_FS_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (Nec_K_R loc X a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S I\\<^sub>S)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (forwK\\<^sub>S a I\\<^sub>S)))) \\<Longleftarrow>PT (RuleStructK Nec_K_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (K_FS_R loc X a Y Z)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((X \\<turnstile>\\<^sub>S ((backK\\<^sub>S a Y) \\<rightarrow>\\<^sub>S (backK\\<^sub>S a Z)))) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent ((X \\<turnstile>\\<^sub>S (backK\\<^sub>S a (Y \\<rightarrow>\\<^sub>S Z))))) \\<Longleftarrow>PT (RuleStructK K_FS_R) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\ncase (K_nec_L loc X a)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some ((I\\<^sub>S \\<turnstile>\\<^sub>S X)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (((backK\\<^sub>S a I\\<^sub>S) \\<turnstile>\\<^sub>S X))) \\<Longleftarrow>PT (RuleStructK K_nec_L) [aa]\" add: assms)\n  using SE_to_DE_Action.simps SE_to_DE_Agent.simps SE_to_DE_Structure.simps SE_to_DE_Sequent.simps by (metis DS_SD_Sequent_Id assms isProofTree_concl_freevars)+\nnext\n\n\ncase (Id loc p)\n  show ?case\n  by (se_to_de_tac \"(SE_to_DE_Sequent ((((p \\<^sub>F) \\<^sub>S) \\<turnstile>\\<^sub>S ((p \\<^sub>F) \\<^sub>S)))) \\<Longleftarrow>PT (RuleZer Id) []\" add: assms Id)\nnext\ncase (Atom seq loc)\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (seq)) \\<Longleftarrow>PT (RuleZer Atom) []\" add: assms Atom)\n  proof -\n  case goal1\n    assume a1: \"freevars (SE_to_DE_Sequent seq) = {}\"\n    obtain ss :: \"DEAK_Core.Sequent \\<Rightarrow> DEAK_Core_SE.Sequent \\<Rightarrow> DEAK_Core_SE.Structure\" and ssa :: \"DEAK_Core.Sequent \\<Rightarrow> DEAK_Core_SE.Sequent \\<Rightarrow> DEAK_Core_SE.Structure\" where\n      \"\\<forall>x0 x1. (\\<exists>v2 v3. x1 = v2 \\<turnstile>\\<^sub>S v3 \\<and> x0 = SE_to_DE_Structure v2 \\<turnstile>\\<^sub>S SE_to_DE_Structure v3) = (x1 = ss x0 x1 \\<turnstile>\\<^sub>S ssa x0 x1 \\<and> x0 = SE_to_DE_Structure (ss x0 x1) \\<turnstile>\\<^sub>S SE_to_DE_Structure (ssa x0 x1))\"\n      by moura\n    hence f2: \"\\<forall>s sa. SE_to_DE_Sequent s \\<noteq> sa \\<or> s = ss sa s \\<turnstile>\\<^sub>S ssa sa s \\<and> sa = SE_to_DE_Structure (ss sa s) \\<turnstile>\\<^sub>S SE_to_DE_Structure (ssa sa s)\"\n      by (meson SE_to_DE_Sequent.elims)\n    hence f3: \"seq = ss (SE_to_DE_Sequent seq) seq \\<turnstile>\\<^sub>S ssa (SE_to_DE_Sequent seq) seq \\<and> SE_to_DE_Sequent seq = SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq) \\<turnstile>\\<^sub>S SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)\"\n      by presburger\n    obtain ssb :: \"DEAK_Core.Structure \\<Rightarrow> DEAK_Core.Structure \\<Rightarrow> DEAK_Core_SE.Structure\" and ssc :: \"DEAK_Core.Structure \\<Rightarrow> DEAK_Core.Structure \\<Rightarrow> DEAK_Core_SE.Structure\" where\n      f4: \"\\<forall>s sa. freevars (s \\<turnstile>\\<^sub>S sa) \\<noteq> {} \\<or> DE_to_SE_Sequent (s \\<turnstile>\\<^sub>S sa) = Some (ssb sa s \\<turnstile>\\<^sub>S ssc sa s)\"\n      using DE_to_SE_Sequent_freevars by moura\n    hence \"SE_to_DE_Sequent seq = SE_to_DE_Sequent (ssb (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq)) \\<turnstile>\\<^sub>S ssc (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq)))\"\n      using f3 a1 by (metis DS_SD_Sequent_Id)\n    hence \"ssb (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq)) \\<turnstile>\\<^sub>S ssc (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq)) = ss (SE_to_DE_Sequent seq) (ssb (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq)) \\<turnstile>\\<^sub>S ssc (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq))) \\<turnstile>\\<^sub>S ssa (SE_to_DE_Sequent seq) (ssb (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq)) \\<turnstile>\\<^sub>S ssc (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq))) \\<and> SE_to_DE_Sequent seq = SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) (ssb (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq)) \\<turnstile>\\<^sub>S ssc (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq)))) \\<turnstile>\\<^sub>S SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) (ssb (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq)) \\<turnstile>\\<^sub>S ssc (SE_to_DE_Structure (ssa (SE_to_DE_Sequent seq) seq)) (SE_to_DE_Structure (ss (SE_to_DE_Sequent seq) seq))))\"\n      using f2 by (metis (no_types))\n    thus ?case\n      using f4 f3 a1 by (metis DEAK_Core.Sequent.inject(1) SD_DS_Structure_Id2)\n  next\n  case goal2 with replace_match_X_t_Y show ?case by (metis DEAK.atom.elims(2))\n  next\n  case goal3 thus ?case using Atom.hyps atom_SE_to_DE_equiv by blast \n  next\n  case goal4 with atom_SE_to_DE_equiv show ?case using Atom.hyps by (metis SE_to_DE_Sequent.elims Un_empty equals0D freevars_Sequent.simps(1) image_is_empty)\n  next\n  case goal5 thus ?case by (metis SE_to_DE_Sequent.elims Un_empty_right equals0D freevars_Sequent.simps(1) image_is_empty)\nqed\nnext\n\ncase (Bigcomma_Cons_R2 loc Y X Xs)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (Y \\<turnstile>\\<^sub>S X ;\\<^sub>S (;;\\<^sub>S Xs)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (Y \\<turnstile>\\<^sub>S ;;\\<^sub>S (X # Xs))) \\<Longleftarrow>PT (RuleBigcomma Bigcomma_Cons_R2) [aa]\" add: assms) \n  apply (metis DEAK_Core_SE.Structure.simps(125) SE_to_DE_Structure.simps(5) option.simps(5))\n  proof -\n  case goal1\n    then have 0: \"replace_Structure_list_aux (?\\<^sub>S ''X'') (SE_to_DE_Structure Y) (map SE_to_DE_Structure Xs) = map SE_to_DE_Structure Xs\" by(induct Xs, auto)\n    from goal1 have \"freevars (;;\\<^sub>S (map SE_to_DE_Structure Xs)) = {}\" by (induct Xs, auto)\n    with goal1 0 replace_Bigcomma_list_no_freevars have \"(replace_Structure_list_aux (?\\<^sub>S ''Y'') (;;\\<^sub>S (SE_to_DE_Structure X # map SE_to_DE_Structure Xs))\n      (replace_Structure_list_aux (?\\<^sub>S ''X'') (SE_to_DE_Structure Y) (map SE_to_DE_Structure Xs))) = (map SE_to_DE_Structure Xs)\" by simp\n    thus ?case using DS_SD_Sequent_Id assms isProofTree_concl_freevars by fastforce\n  qed\nnext\ncase (Bigcomma_Cons_R loc Y X Xs)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (Y \\<turnstile>\\<^sub>S ;;\\<^sub>S (X # Xs)) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (Y \\<turnstile>\\<^sub>S X ;\\<^sub>S (;;\\<^sub>S Xs))) \\<Longleftarrow>PT (RuleBigcomma Bigcomma_Cons_R) [aa]\" add: assms)\n  apply (metis SE_to_DE_Structure.simps(5) option.simps(5))\n  proof -\n  case goal1\n    then have 0: \"replace_Structure_list_aux (?\\<^sub>S ''X'') (SE_to_DE_Structure Y) (map SE_to_DE_Structure Xs) = map SE_to_DE_Structure Xs\" by(induct Xs, auto)\n    from goal1 have \"freevars (;;\\<^sub>S (map SE_to_DE_Structure Xs)) = {}\" by (induct Xs, auto)\n    with goal1 0 replace_Bigcomma_list_no_freevars have \"replace_Structure_list_aux (?\\<^sub>S ''Y'') (B\\<^sub>S SE_to_DE_Structure X ;\\<^sub>S (;;\\<^sub>S map SE_to_DE_Structure Xs))\n      (replace_Structure_list_aux (?\\<^sub>S ''X'') (SE_to_DE_Structure Y) (map SE_to_DE_Structure Xs)) =  map SE_to_DE_Structure Xs\" by simp\n    thus ?case using DS_SD_Sequent_Id assms isProofTree_concl_freevars by fastforce\n  qed\nnext\ncase (Bigcomma_Cons_L2 loc X Xs Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (X ;\\<^sub>S (;;\\<^sub>S Xs) \\<turnstile>\\<^sub>S Y) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (;;\\<^sub>S (X # Xs) \\<turnstile>\\<^sub>S Y)) \\<Longleftarrow>PT (RuleBigcomma Bigcomma_Cons_L2) [aa]\" add: assms)\n  apply (metis DEAK_Core_SE.Structure.simps(125) SE_to_DE_Structure.simps(5) option.simps(5))\n  using replace_Bigcomma_list_no_freevars apply auto\n  proof -\n  case goal1 \n    then have \"freevars (;;\\<^sub>S (map SE_to_DE_Structure Xs)) = {}\" by (induct Xs, auto)\n    with replace_Bigcomma_list_no_freevars have 0: \"(replace_Structure_list_aux (?\\<^sub>S ''X'') (;;\\<^sub>S (SE_to_DE_Structure X # map SE_to_DE_Structure Xs)) (map SE_to_DE_Structure Xs)) = map SE_to_DE_Structure Xs\" by simp\n    thus ?case using DS_SD_Sequent_Id assms goal1(1) isProofTree_concl_freevars by fastforce\n  qed\nnext\ncase (Bigcomma_Cons_L loc X Xs Y)\n  then obtain aa where assms: \"loc \\<noteq> []\" \"DE_to_SE_Sequent (concl aa) = Some (;;\\<^sub>S (X # Xs) \\<turnstile>\\<^sub>S Y) \\<and> isProofTreeWoMacro (map SE_to_DE_Locale loc) aa\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (X ;\\<^sub>S (;;\\<^sub>S Xs) \\<turnstile>\\<^sub>S Y)) \\<Longleftarrow>PT (RuleBigcomma Bigcomma_Cons_L) [aa]\" add: assms)\n  apply (metis SE_to_DE_Structure.simps(5) option.simps(5))\n  using replace_Bigcomma_list_no_freevars apply auto\n  proof -\n  case goal1 \n    then have \"freevars (;;\\<^sub>S (map SE_to_DE_Structure Xs)) = {}\" by (induct Xs, auto)\n    with replace_Bigcomma_list_no_freevars have 0: \"(replace_Structure_list_aux (?\\<^sub>S ''X'') (B\\<^sub>S SE_to_DE_Structure X ;\\<^sub>S (;;\\<^sub>S map SE_to_DE_Structure Xs)) (map SE_to_DE_Structure Xs)) = map SE_to_DE_Structure Xs\" by simp\n    thus ?case using DS_SD_Sequent_Id assms goal1(1) isProofTree_concl_freevars by fastforce\n  qed\nqed\n\n(*\n\nlemma SE_to_DE2:\n  fixes t f\n  assumes \"[CutFormula f] \\<turnstile>d t\"\n  shows \"\\<exists>pt. DE_to_SE_Sequent (concl pt) = Some t \\<and> isProofTreeWoMacro [SE_to_DE_Locale (CutFormula f)] pt\"\nusing assms \napply (induction \"[CutFormula f]\" t)\nproof -\ncase Swapin_L thus?case by simp\nnext\ncase (SingleCut form X Y) \n  then obtain aa bb where assms: \"DE_to_SE_Sequent (concl aa) = Some (X \\<turnstile>\\<^sub>S f \\<^sub>S) \\<and> isProofTreeWoMacro [SE_to_DE_Locale (DEAK_SE.Locale.CutFormula f)] aa\" \"DE_to_SE_Sequent (concl bb) = Some (f \\<^sub>S \\<turnstile>\\<^sub>S Y) \\<and> isProofTreeWoMacro [SE_to_DE_Locale (DEAK_SE.Locale.CutFormula f)] bb\" by auto\n  show ?case\n  apply (se_to_de_tac \"(SE_to_DE_Sequent (X  \\<turnstile>\\<^sub>S Y)) \\<Longleftarrow>PT (RuleCut SingleCut) [aa, bb]\" add: assms)\n  using assms apply auto[2]\n  using DS_SD_Sequent_Id assms isProofTree_concl_freevars by (metis SE_to_DE_Sequent.simps SE_to_DE_Structure.simps(9))+\n\nqed\n*)\n\n\nend", "meta": {"author": "goodlyrottenapple", "repo": "calculus-toolbox", "sha": "1c0009f1bf2b08e8a7466e024fdb02f62e34ee91", "save_path": "github-repos/isabelle/goodlyrottenapple-calculus-toolbox", "path": "github-repos/isabelle/goodlyrottenapple-calculus-toolbox/calculus-toolbox-1c0009f1bf2b08e8a7466e024fdb02f62e34ee91/template/Calc_Eq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.3350380633599952}}
{"text": "theory flash54Bra  imports flash54Rev\n \n  begin\nlemma onInv54:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv54  iInv1  iInv2  iInv3 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX1VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_GetXVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ShWbVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX7VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak2VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX5VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_WbVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_GetVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceShrVldVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_2VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak2VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_ReplaceVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_HomeVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put2VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX11VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX6VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put2VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1_HomeVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak1VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak1VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak2VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak3VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX2VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put1VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutXVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis StoreVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_FAckVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX3VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutXVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put1VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis StoreHomeVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_NakVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_PutXVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX4VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_NakVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak1VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_ClearVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_PutXVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak3VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX9VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetXVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv54  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put3VsInv54 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash54Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494550081925, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3349377288927276}}
{"text": "(*  Title:      HOL/HOLCF/IOA/CompoScheds.thy\n    Author:     Olaf Müller\n*)\n\nsection \\<open>Compositionality on Schedule level\\<close>\n\ntheory CompoScheds\nimports CompoExecs\nbegin\n\ndefinition mkex2 :: \"('a, 's) ioa \\<Rightarrow> ('a, 't) ioa \\<Rightarrow> 'a Seq \\<rightarrow>\n  ('a, 's) pairs \\<rightarrow> ('a, 't) pairs \\<rightarrow> ('s \\<Rightarrow> 't \\<Rightarrow> ('a, 's \\<times> 't) pairs)\"\n  where \"mkex2 A B =\n    (fix \\<cdot>\n      (LAM h sch exA exB.\n        (\\<lambda>s t.\n          case sch of\n            nil \\<Rightarrow> nil\n        | x ## xs \\<Rightarrow>\n            (case x of\n              UU \\<Rightarrow> UU\n            | Def y \\<Rightarrow>\n               (if y \\<in> act A then\n                 (if y \\<in> act B then\n                    (case HD \\<cdot> exA of\n                      UU \\<Rightarrow> UU\n                    | Def a \\<Rightarrow>\n                        (case HD \\<cdot> exB of\n                          UU \\<Rightarrow> UU\n                        | Def b \\<Rightarrow>\n                           (y, (snd a, snd b)) \\<leadsto>\n                            (h \\<cdot> xs \\<cdot> (TL \\<cdot> exA) \\<cdot> (TL \\<cdot> exB)) (snd a) (snd b)))\n                  else\n                    (case HD \\<cdot> exA of\n                      UU \\<Rightarrow> UU\n                    | Def a \\<Rightarrow> (y, (snd a, t)) \\<leadsto> (h \\<cdot> xs \\<cdot> (TL \\<cdot> exA) \\<cdot> exB) (snd a) t))\n                else\n                  (if y \\<in> act B then\n                    (case HD \\<cdot> exB of\n                      UU \\<Rightarrow> UU\n                    | Def b \\<Rightarrow> (y, (s, snd b)) \\<leadsto> (h \\<cdot> xs \\<cdot> exA \\<cdot> (TL \\<cdot> exB)) s (snd b))\n                   else UU))))))\"\n\ndefinition mkex :: \"('a, 's) ioa \\<Rightarrow> ('a, 't) ioa \\<Rightarrow> 'a Seq \\<Rightarrow>\n    ('a, 's) execution \\<Rightarrow> ('a, 't) execution \\<Rightarrow> ('a, 's \\<times> 't) execution\"\n  where \"mkex A B sch exA exB =\n    ((fst exA, fst exB), (mkex2 A B \\<cdot> sch \\<cdot> (snd exA) \\<cdot> (snd exB)) (fst exA) (fst exB))\"\n\ndefinition par_scheds :: \"'a schedule_module \\<Rightarrow> 'a schedule_module \\<Rightarrow> 'a schedule_module\"\n  where \"par_scheds SchedsA SchedsB =\n    (let\n      schA = fst SchedsA; sigA = snd SchedsA;\n      schB = fst SchedsB; sigB = snd SchedsB\n     in\n      ({sch. Filter (\\<lambda>a. a\\<in>actions sigA)\\<cdot>sch \\<in> schA} \\<inter>\n       {sch. Filter (\\<lambda>a. a\\<in>actions sigB)\\<cdot>sch \\<in> schB} \\<inter>\n       {sch. Forall (\\<lambda>x. x\\<in>(actions sigA Un actions sigB)) sch},\n        asig_comp sigA sigB))\"\n\n\nsubsection \\<open>\\<open>mkex\\<close> rewrite rules\\<close>\n\nlemma mkex2_unfold:\n  \"mkex2 A B =\n    (LAM sch exA exB.\n      (\\<lambda>s t.\n        case sch of\n          nil \\<Rightarrow> nil\n        | x ## xs \\<Rightarrow>\n            (case x of\n              UU \\<Rightarrow> UU\n            | Def y \\<Rightarrow>\n                (if y \\<in> act A then\n                  (if y \\<in> act B then\n                    (case HD \\<cdot> exA of\n                      UU \\<Rightarrow> UU\n                    | Def a \\<Rightarrow>\n                        (case HD \\<cdot> exB of\n                          UU \\<Rightarrow> UU\n                        | Def b \\<Rightarrow>\n                            (y, (snd a, snd b)) \\<leadsto>\n                              (mkex2 A B \\<cdot> xs \\<cdot> (TL \\<cdot> exA) \\<cdot> (TL \\<cdot> exB)) (snd a) (snd b)))\n                   else\n                     (case HD \\<cdot> exA of\n                       UU \\<Rightarrow> UU\n                     | Def a \\<Rightarrow> (y, (snd a, t)) \\<leadsto> (mkex2 A B \\<cdot> xs \\<cdot> (TL \\<cdot> exA) \\<cdot> exB) (snd a) t))\n                 else\n                   (if y \\<in> act B then\n                     (case HD \\<cdot> exB of\n                       UU \\<Rightarrow> UU\n                     | Def b \\<Rightarrow> (y, (s, snd b)) \\<leadsto> (mkex2 A B \\<cdot> xs \\<cdot> exA \\<cdot> (TL \\<cdot> exB)) s (snd b))\n                    else UU)))))\"\n  apply (rule trans)\n  apply (rule fix_eq2)\n  apply (simp only: mkex2_def)\n  apply (rule beta_cfun)\n  apply simp\n  done\n\nlemma mkex2_UU: \"(mkex2 A B \\<cdot> UU \\<cdot> exA \\<cdot> exB) s t = UU\"\n  apply (subst mkex2_unfold)\n  apply simp\n  done\n\nlemma mkex2_nil: \"(mkex2 A B \\<cdot> nil \\<cdot> exA \\<cdot> exB) s t = nil\"\n  apply (subst mkex2_unfold)\n  apply simp\n  done\n\nlemma mkex2_cons_1:\n  \"x \\<in> act A \\<Longrightarrow> x \\<notin> act B \\<Longrightarrow> HD \\<cdot> exA = Def a \\<Longrightarrow>\n    (mkex2 A B \\<cdot> (x \\<leadsto> sch) \\<cdot> exA \\<cdot> exB) s t =\n      (x, snd a,t) \\<leadsto> (mkex2 A B \\<cdot> sch \\<cdot> (TL \\<cdot> exA) \\<cdot> exB) (snd a) t\"\n  apply (rule trans)\n  apply (subst mkex2_unfold)\n  apply (simp add: Consq_def If_and_if)\n  apply (simp add: Consq_def)\n  done\n\nlemma mkex2_cons_2:\n  \"x \\<notin> act A \\<Longrightarrow> x \\<in> act B \\<Longrightarrow> HD \\<cdot> exB = Def b \\<Longrightarrow>\n    (mkex2 A B \\<cdot> (x \\<leadsto> sch) \\<cdot> exA \\<cdot> exB) s t =\n      (x, s, snd b) \\<leadsto> (mkex2 A B \\<cdot> sch \\<cdot> exA \\<cdot> (TL \\<cdot> exB)) s (snd b)\"\n  apply (rule trans)\n  apply (subst mkex2_unfold)\n  apply (simp add: Consq_def If_and_if)\n  apply (simp add: Consq_def)\n  done\n\nlemma mkex2_cons_3:\n  \"x \\<in> act A \\<Longrightarrow> x \\<in> act B \\<Longrightarrow> HD \\<cdot> exA = Def a \\<Longrightarrow> HD \\<cdot> exB = Def b \\<Longrightarrow>\n    (mkex2 A B \\<cdot> (x \\<leadsto> sch) \\<cdot> exA \\<cdot> exB) s t =\n      (x, snd a,snd b) \\<leadsto> (mkex2 A B \\<cdot> sch \\<cdot> (TL \\<cdot> exA) \\<cdot> (TL \\<cdot> exB)) (snd a) (snd b)\"\n  apply (rule trans)\n  apply (subst mkex2_unfold)\n  apply (simp add: Consq_def If_and_if)\n  apply (simp add: Consq_def)\n  done\n\ndeclare mkex2_UU [simp] mkex2_nil [simp] mkex2_cons_1 [simp]\n  mkex2_cons_2 [simp] mkex2_cons_3 [simp]\n\n\nsubsection \\<open>\\<open>mkex\\<close>\\<close>\n\nlemma mkex_UU: \"mkex A B UU  (s,exA) (t,exB) = ((s,t),UU)\"\n  by (simp add: mkex_def)\n\nlemma mkex_nil: \"mkex A B nil (s,exA) (t,exB) = ((s,t),nil)\"\n  by (simp add: mkex_def)\n\nlemma mkex_cons_1:\n  \"x \\<in> act A \\<Longrightarrow> x \\<notin> act B \\<Longrightarrow>\n    mkex A B (x \\<leadsto> sch) (s, a \\<leadsto> exA) (t, exB) =\n      ((s, t), (x, snd a, t) \\<leadsto> snd (mkex A B sch (snd a, exA) (t, exB)))\"\n  apply (unfold mkex_def)\n  apply (cut_tac exA = \"a \\<leadsto> exA\" in mkex2_cons_1)\n  apply auto\n  done\n\nlemma mkex_cons_2:\n  \"x \\<notin> act A \\<Longrightarrow> x \\<in> act B \\<Longrightarrow>\n    mkex A B (x \\<leadsto> sch) (s, exA) (t, b \\<leadsto> exB) =\n      ((s, t), (x, s, snd b) \\<leadsto> snd (mkex A B sch (s, exA) (snd b, exB)))\"\n  apply (unfold mkex_def)\n  apply (cut_tac exB = \"b\\<leadsto>exB\" in mkex2_cons_2)\n  apply auto\n  done\n\nlemma mkex_cons_3:\n  \"x \\<in> act A \\<Longrightarrow> x \\<in> act B \\<Longrightarrow>\n    mkex A B (x \\<leadsto> sch) (s, a \\<leadsto> exA) (t, b \\<leadsto> exB) =\n      ((s, t), (x, snd a, snd b) \\<leadsto> snd (mkex A B sch (snd a, exA) (snd b, exB)))\"\n  apply (unfold mkex_def)\n  apply (cut_tac exB = \"b\\<leadsto>exB\" and exA = \"a\\<leadsto>exA\" in mkex2_cons_3)\n  apply auto\n  done\n\ndeclare mkex2_UU [simp del] mkex2_nil [simp del]\n  mkex2_cons_1 [simp del] mkex2_cons_2 [simp del] mkex2_cons_3 [simp del]\n\nlemmas composch_simps = mkex_UU mkex_nil mkex_cons_1 mkex_cons_2 mkex_cons_3\n\ndeclare composch_simps [simp]\n\n\nsubsection \\<open>Compositionality on schedule level\\<close>\n\nsubsubsection \\<open>Lemmas for \\<open>\\<Longrightarrow>\\<close>\\<close>\n\nlemma lemma_2_1a:\n  \\<comment> \\<open>\\<open>tfilter ex\\<close> and \\<open>filter_act\\<close> are commutative\\<close>\n  \"filter_act \\<cdot> (Filter_ex2 (asig_of A) \\<cdot> xs) =\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> (filter_act \\<cdot> xs)\"\n  apply (unfold filter_act_def Filter_ex2_def)\n  apply (simp add: MapFilter o_def)\n  done\n\nlemma lemma_2_1b:\n  \\<comment> \\<open>State-projections do not affect \\<open>filter_act\\<close>\\<close>\n  \"filter_act \\<cdot> (ProjA2 \\<cdot> xs) = filter_act \\<cdot> xs \\<and>\n    filter_act \\<cdot> (ProjB2 \\<cdot> xs) = filter_act \\<cdot> xs\"\n  by (pair_induct xs)\n\n\ntext \\<open>\n  Schedules of \\<open>A \\<parallel> B\\<close> have only \\<open>A\\<close>- or \\<open>B\\<close>-actions.\n\n  Very similar to \\<open>lemma_1_1c\\<close>, but it is not checking if every action element\n  of an \\<open>ex\\<close> is in \\<open>A\\<close> or \\<open>B\\<close>, but after projecting it onto the action\n  schedule. Of course, this is the same proposition, but we cannot change this\n  one, when then rather \\<open>lemma_1_1c\\<close>.\n\\<close>\n\nlemma sch_actions_in_AorB:\n  \"\\<forall>s. is_exec_frag (A \\<parallel> B) (s, xs) \\<longrightarrow> Forall (\\<lambda>x. x \\<in> act (A \\<parallel> B)) (filter_act \\<cdot> xs)\"\n  apply (pair_induct xs simp: is_exec_frag_def Forall_def sforall_def)\n  text \\<open>main case\\<close>\n  apply auto\n  apply (simp add: trans_of_defs2 actions_asig_comp asig_of_par)\n  done\n\n\nsubsubsection \\<open>Lemmas for \\<open>\\<Longleftarrow>\\<close>\\<close>\n\ntext \\<open>\n  Filtering actions out of \\<open>mkex (sch, exA, exB)\\<close> yields the oracle \\<open>sch\\<close>\n  structural induction.\n\\<close>\n\nlemma Mapfst_mkex_is_sch:\n  \"\\<forall>exA exB s t.\n    Forall (\\<lambda>x. x \\<in> act (A \\<parallel> B)) sch \\<and>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exA \\<and>\n    Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exB \\<longrightarrow>\n    filter_act \\<cdot> (snd (mkex A B sch (s, exA) (t, exB))) = sch\"\n  apply (Seq_induct sch simp: Filter_def Forall_def sforall_def mkex_def)\n\n  text \\<open>main case: splitting into 4 cases according to \\<open>a \\<in> A\\<close>, \\<open>a \\<in> B\\<close>\\<close>\n  apply auto\n\n  text \\<open>Case \\<open>y \\<in> A\\<close>, \\<open>y \\<in> B\\<close>\\<close>\n  apply (Seq_case_simp exA)\n  text \\<open>Case \\<open>exA = UU\\<close>, Case \\<open>exA = nil\\<close>\\<close>\n  text \\<open>\n    These \\<open>UU\\<close> and \\<open>nil\\<close> cases are the only places where the assumption\n    \\<open>filter A sch \\<sqsubseteq> f_act exA\\<close> is used!\n    \\<open>\\<longrightarrow>\\<close> to generate a contradiction using \\<open>\\<not> a \\<leadsto> ss \\<sqsubseteq> UU nil\\<close>,\n    using theorems \\<open>Cons_not_less_UU\\<close> and \\<open>Cons_not_less_nil\\<close>.\\<close>\n  apply (Seq_case_simp exB)\n  text \\<open>Case \\<open>exA = a \\<leadsto> x\\<close>, \\<open>exB = b \\<leadsto> y\\<close>\\<close>\n  text \\<open>\n    Here it is important that @{method Seq_case_simp} uses no \\<open>!full!_simp_tac\\<close>\n    for the cons case, as otherwise \\<open>mkex_cons_3\\<close> would not be rewritten\n    without use of \\<open>rotate_tac\\<close>: then tactic would not be generally\n    applicable.\\<close>\n  apply simp\n\n  text \\<open>Case \\<open>y \\<in> A\\<close>, \\<open>y \\<notin> B\\<close>\\<close>\n  apply (Seq_case_simp exA)\n  apply simp\n\n  text \\<open>Case \\<open>y \\<notin> A\\<close>, \\<open>y \\<in> B\\<close>\\<close>\n  apply (Seq_case_simp exB)\n  apply simp\n\n  text \\<open>Case \\<open>y \\<notin> A\\<close>, \\<open>y \\<notin> B\\<close>\\<close>\n  apply (simp add: asig_of_par actions_asig_comp)\n  done\n\n\ntext \\<open>Generalizing the proof above to a proof method:\\<close>\nML \\<open>\nfun mkex_induct_tac ctxt sch exA exB =\n  EVERY' [\n    Seq_induct_tac ctxt sch\n      @{thms Filter_def Forall_def sforall_def mkex_def stutter_def},\n    asm_full_simp_tac ctxt,\n    SELECT_GOAL\n      (safe_tac (Context.raw_transfer (Proof_Context.theory_of ctxt) \\<^theory_context>\\<open>Fun\\<close>)),\n    Seq_case_simp_tac ctxt exA,\n    Seq_case_simp_tac ctxt exB,\n    asm_full_simp_tac ctxt,\n    Seq_case_simp_tac ctxt exA,\n    asm_full_simp_tac ctxt,\n    Seq_case_simp_tac ctxt exB,\n    asm_full_simp_tac ctxt,\n    asm_full_simp_tac (ctxt addsimps @{thms asig_of_par actions_asig_comp})]\n\\<close>\n\nmethod_setup mkex_induct = \\<open>\n  Scan.lift (Parse.embedded -- Parse.embedded -- Parse.embedded)\n    >> (fn ((sch, exA), exB) => fn ctxt =>\n      SIMPLE_METHOD' (mkex_induct_tac ctxt sch exA exB))\n\\<close>\n\n\ntext \\<open>\n  Projection of \\<open>mkex (sch, exA, exB)\\<close> onto \\<open>A\\<close> stutters on \\<open>A\\<close>\n  structural induction.\n\\<close>\n\nlemma stutterA_mkex:\n  \"\\<forall>exA exB s t.\n    Forall (\\<lambda>x. x \\<in> act (A \\<parallel> B)) sch \\<and>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exA \\<and>\n    Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exB \\<longrightarrow>\n    stutter (asig_of A) (s, ProjA2 \\<cdot> (snd (mkex A B sch (s, exA) (t, exB))))\"\n  by (mkex_induct sch exA exB)\n\nlemma stutter_mkex_on_A:\n  \"Forall (\\<lambda>x. x \\<in> act (A \\<parallel> B)) sch \\<Longrightarrow>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> (snd exA) \\<Longrightarrow>\n    Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> (snd exB) \\<Longrightarrow>\n    stutter (asig_of A) (ProjA (mkex A B sch exA exB))\"\n  apply (cut_tac stutterA_mkex)\n  apply (simp add: stutter_def ProjA_def mkex_def)\n  apply (erule allE)+\n  apply (drule mp)\n  prefer 2 apply (assumption)\n  apply simp\n  done\n\n\ntext \\<open>\n  Projection of \\<open>mkex (sch, exA, exB)\\<close> onto \\<open>B\\<close> stutters on \\<open>B\\<close>\n  structural induction.\n\\<close>\n\nlemma stutterB_mkex:\n  \"\\<forall>exA exB s t.\n    Forall (\\<lambda>x. x \\<in> act (A \\<parallel> B)) sch \\<and>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exA \\<and>\n    Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exB \\<longrightarrow>\n    stutter (asig_of B) (t, ProjB2 \\<cdot> (snd (mkex A B sch (s, exA) (t, exB))))\"\n  by (mkex_induct sch exA exB)\n\n\nlemma stutter_mkex_on_B:\n  \"Forall (\\<lambda>x. x \\<in> act (A \\<parallel> B)) sch \\<Longrightarrow>\n   Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> (snd exA) \\<Longrightarrow>\n   Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> (snd exB) \\<Longrightarrow>\n   stutter (asig_of B) (ProjB (mkex A B sch exA exB))\"\n  apply (cut_tac stutterB_mkex)\n  apply (simp add: stutter_def ProjB_def mkex_def)\n  apply (erule allE)+\n  apply (drule mp)\n  prefer 2 apply (assumption)\n  apply simp\n  done\n\n\ntext \\<open>\n  Filter of \\<open>mkex (sch, exA, exB)\\<close> to \\<open>A\\<close> after projection onto \\<open>A\\<close> is \\<open>exA\\<close>,\n  using \\<open>zip \\<cdot> (proj1 \\<cdot> exA) \\<cdot> (proj2 \\<cdot> exA)\\<close> instead of \\<open>exA\\<close>,\n  because of admissibility problems structural induction.\n\\<close>\n\nlemma filter_mkex_is_exA_tmp:\n  \"\\<forall>exA exB s t.\n    Forall (\\<lambda>x. x \\<in> act (A \\<parallel> B)) sch \\<and>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exA \\<and>\n    Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exB \\<longrightarrow>\n    Filter_ex2 (asig_of A) \\<cdot> (ProjA2 \\<cdot> (snd (mkex A B sch (s, exA) (t, exB)))) =\n      Zip \\<cdot> (Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch) \\<cdot> (Map snd \\<cdot> exA)\"\n  by (mkex_induct sch exB exA)\n\ntext \\<open>\n  \\<open>zip \\<cdot> (proj1 \\<cdot> y) \\<cdot> (proj2 \\<cdot> y) = y\\<close>  (using the lift operations)\n  lemma for admissibility problems\n\\<close>\n\nlemma Zip_Map_fst_snd: \"Zip \\<cdot> (Map fst \\<cdot> y) \\<cdot> (Map snd \\<cdot> y) = y\"\n  by (Seq_induct y)\n\n\ntext \\<open>\n  \\<open>filter A \\<cdot> sch = proj1 \\<cdot> ex \\<longrightarrow> zip \\<cdot> (filter A \\<cdot> sch) \\<cdot> (proj2 \\<cdot> ex) = ex\\<close>\n  lemma for eliminating non admissible equations in assumptions\n\\<close>\n\nlemma trick_against_eq_in_ass:\n  \"Filter (\\<lambda>a. a \\<in> act AB) \\<cdot> sch = filter_act \\<cdot> ex \\<Longrightarrow>\n    ex = Zip \\<cdot> (Filter (\\<lambda>a. a \\<in> act AB) \\<cdot> sch) \\<cdot> (Map snd \\<cdot> ex)\"\n  apply (simp add: filter_act_def)\n  apply (rule Zip_Map_fst_snd [symmetric])\n  done\n\ntext \\<open>\n  Filter of \\<open>mkex (sch, exA, exB)\\<close> to \\<open>A\\<close> after projection onto \\<open>A\\<close> is \\<open>exA\\<close>\n  using the above trick.\n\\<close>\n\nlemma filter_mkex_is_exA:\n  \"Forall (\\<lambda>a. a \\<in> act (A \\<parallel> B)) sch \\<Longrightarrow>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch = filter_act \\<cdot> (snd exA) \\<Longrightarrow>\n    Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch = filter_act \\<cdot> (snd exB) \\<Longrightarrow>\n  Filter_ex (asig_of A) (ProjA (mkex A B sch exA exB)) = exA\"\n  apply (simp add: ProjA_def Filter_ex_def)\n  apply (pair exA)\n  apply (pair exB)\n  apply (rule conjI)\n  apply (simp (no_asm) add: mkex_def)\n  apply (simplesubst trick_against_eq_in_ass)\n  back\n  apply assumption\n  apply (simp add: filter_mkex_is_exA_tmp)\n  done\n\ntext \\<open>\n  Filter of \\<open>mkex (sch, exA, exB)\\<close> to \\<open>B\\<close> after projection onto \\<open>B\\<close> is \\<open>exB\\<close>\n  using \\<open>zip \\<cdot> (proj1 \\<cdot> exB) \\<cdot> (proj2 \\<cdot> exB)\\<close> instead of \\<open>exB\\<close>\n  because of admissibility problems structural induction.\n\\<close>\n\nlemma filter_mkex_is_exB_tmp:\n  \"\\<forall>exA exB s t.\n    Forall (\\<lambda>x. x \\<in> act (A \\<parallel> B)) sch \\<and>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exA \\<and>\n    Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exB \\<longrightarrow>\n    Filter_ex2 (asig_of B) \\<cdot> (ProjB2 \\<cdot> (snd (mkex A B sch (s, exA) (t, exB)))) =\n      Zip \\<cdot> (Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch) \\<cdot> (Map snd \\<cdot> exB)\"\n  (*notice necessary change of arguments exA and exB*)\n  by (mkex_induct sch exA exB)\n\ntext \\<open>\n  Filter of \\<open>mkex (sch, exA, exB)\\<close> to \\<open>A\\<close> after projection onto \\<open>B\\<close> is \\<open>exB\\<close>\n  using the above trick.\n\\<close>\n\nlemma filter_mkex_is_exB:\n  \"Forall (\\<lambda>a. a \\<in> act (A \\<parallel> B)) sch \\<Longrightarrow>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch = filter_act \\<cdot> (snd exA) \\<Longrightarrow>\n    Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch = filter_act \\<cdot> (snd exB) \\<Longrightarrow>\n    Filter_ex (asig_of B) (ProjB (mkex A B sch exA exB)) = exB\"\n  apply (simp add: ProjB_def Filter_ex_def)\n  apply (pair exA)\n  apply (pair exB)\n  apply (rule conjI)\n  apply (simp add: mkex_def)\n  apply (simplesubst trick_against_eq_in_ass)\n  back\n  apply assumption\n  apply (simp add: filter_mkex_is_exB_tmp)\n  done\n\nlemma mkex_actions_in_AorB:\n  \\<comment> \\<open>\\<open>mkex\\<close> has only \\<open>A\\<close>- or \\<open>B\\<close>-actions\\<close>\n  \"\\<forall>s t exA exB.\n    Forall (\\<lambda>x. x \\<in> act (A \\<parallel> B)) sch &\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exA \\<and>\n    Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch \\<sqsubseteq> filter_act \\<cdot> exB \\<longrightarrow>\n    Forall (\\<lambda>x. fst x \\<in> act (A \\<parallel> B)) (snd (mkex A B sch (s, exA) (t, exB)))\"\n  by (mkex_induct sch exA exB)\n\n\ntheorem compositionality_sch:\n  \"sch \\<in> schedules (A \\<parallel> B) \\<longleftrightarrow>\n    Filter (\\<lambda>a. a \\<in> act A) \\<cdot> sch \\<in> schedules A \\<and>\n    Filter (\\<lambda>a. a \\<in> act B) \\<cdot> sch \\<in> schedules B \\<and>\n    Forall (\\<lambda>x. x \\<in> act (A \\<parallel> B)) sch\"\n  apply (simp add: schedules_def has_schedule_def)\n  apply auto\n  text \\<open>\\<open>\\<Longrightarrow>\\<close>\\<close>\n  apply (rule_tac x = \"Filter_ex (asig_of A) (ProjA ex)\" in bexI)\n  prefer 2\n  apply (simp add: compositionality_ex)\n  apply (simp (no_asm) add: Filter_ex_def ProjA_def lemma_2_1a lemma_2_1b)\n  apply (rule_tac x = \"Filter_ex (asig_of B) (ProjB ex)\" in bexI)\n  prefer 2\n  apply (simp add: compositionality_ex)\n  apply (simp add: Filter_ex_def ProjB_def lemma_2_1a lemma_2_1b)\n  apply (simp add: executions_def)\n  apply (pair ex)\n  apply (erule conjE)\n  apply (simp add: sch_actions_in_AorB)\n  text \\<open>\\<open>\\<Longleftarrow>\\<close>\\<close>\n  text \\<open>\\<open>mkex\\<close> is exactly the construction of \\<open>exA\\<parallel>B\\<close> out of \\<open>exA\\<close>, \\<open>exB\\<close>,\n    and the oracle \\<open>sch\\<close>, we need here\\<close>\n  apply (rename_tac exA exB)\n  apply (rule_tac x = \"mkex A B sch exA exB\" in bexI)\n  text \\<open>\\<open>mkex\\<close> actions are just the oracle\\<close>\n  apply (pair exA)\n  apply (pair exB)\n  apply (simp add: Mapfst_mkex_is_sch)\n  text \\<open>\\<open>mkex\\<close> is an execution -- use compositionality on ex-level\\<close>\n  apply (simp add: compositionality_ex)\n  apply (simp add: stutter_mkex_on_A stutter_mkex_on_B filter_mkex_is_exB filter_mkex_is_exA)\n  apply (pair exA)\n  apply (pair exB)\n  apply (simp add: mkex_actions_in_AorB)\n  done\n\ntheorem compositionality_sch_modules:\n  \"Scheds (A \\<parallel> B) = par_scheds (Scheds A) (Scheds B)\"\n  apply (unfold Scheds_def par_scheds_def)\n  apply (simp add: asig_of_par)\n  apply (rule set_eqI)\n  apply (simp add: compositionality_sch actions_of_par)\n  done\n\ndeclare compoex_simps [simp del]\ndeclare composch_simps [simp del]\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/CompoScheds.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494421679929, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.33493772262307137}}
{"text": "theory ResourcedAdequacy\nimports \"ResourcedDenotational\" \"Launchbury\" \"AList-Utils\" \"CorrectnessResourced\"\nbegin\n\nlemma demand_not_0: \"demand (\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<rho>\\<^esub>) \\<noteq> \\<bottom>\"\nproof\n  assume \"demand (\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<rho>\\<^esub>) = \\<bottom>\"\n  with demand_suffices'[where n = 0, simplified, OF this]\n  have \"(\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<rho>\\<^esub>)\\<cdot>\\<bottom> \\<noteq> \\<bottom>\" by simp\n  thus False by simp\nqed\n\ntext {*\nThe semantics of an expression, given only @{term r} resources, will only use values from the\nenvironment with less resources.\n*}\n\nlemma restr_can_restrict_env: \"(\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>\\<^esub>)|\\<^bsub>r\\<^esub> = (\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)|\\<^bsub>r\\<^esub>\"\nproof(induction e arbitrary: \\<rho> r rule: exp_induct)\n  case (Var x)\n  show ?case\n  proof(rule C_restr_cong)\n    fix r'\n    assume \"r' \\<sqsubseteq> r\"\n    {\n      fix r''\n      assume \"r' = C\\<cdot>r''\" with `r' \\<sqsubseteq> r`\n      have \"(Cpred\\<cdot>r \\<sqinter> r'') = r''\"\n        by (metis Cpred.simps below_refl is_meetI monofun_cfun_arg)\n      hence \"\\<rho> x\\<cdot>r'' = (\\<rho> x|\\<^bsub>Cpred\\<cdot>r\\<^esub>)\\<cdot>r''\" by simp\n    }\n    thus \"(\\<N>\\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<rho>\\<^esub>)\\<cdot>r' = (\\<N>\\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)\\<cdot>r'\"\n      unfolding CESem_simps\n      by -(rule C_case_cong, simp)\n  qed\nnext\n  case (Lam x e)\n  show ?case\n  proof(rule C_restr_cong)\n    fix r'\n    assume \"r' \\<sqsubseteq> r\"\n    {\n      fix r''\n      fix v\n      assume \"r' = C\\<cdot>r''\"\n      with `r' \\<sqsubseteq> r`\n      have [simp]: \"r'' \\<sqinter> Cpred\\<cdot>r = r''\"\n        by (metis C.inverts C_Cpred_id below_refl is_meetI meet_above_iff meet_bot2)\n\n      have \"r'' \\<sqsubseteq> r\" by (metis `r' = C\\<cdot>r''` `r' \\<sqsubseteq> r` below_C below_trans)\n      hence \"(\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>(x := v|\\<^bsub>r''\\<^esub>)\\<^esub>)|\\<^bsub>r''\\<^esub> = (\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>(\\<rho>(x := v|\\<^bsub>r''\\<^esub>))|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)|\\<^bsub>r''\\<^esub>\"\n        by (rule C_restr_eq_lower[OF Lam])\n      also have \"(\\<rho>(x := v|\\<^bsub>r''\\<^esub>))|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub> = (\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>)(x := v|\\<^bsub>r''\\<^esub>)\"  by simp\n      finally\n      have \"(\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>(x := v|\\<^bsub>r''\\<^esub>)\\<^esub>)|\\<^bsub>r''\\<^esub> = (\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>(\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>)(x := v|\\<^bsub>r''\\<^esub>)\\<^esub>)|\\<^bsub>r''\\<^esub>\".\n    }\n    thus \"(\\<N>\\<lbrakk> Lam [x]. e \\<rbrakk>\\<^bsub>\\<rho>\\<^esub>)\\<cdot>r' = (\\<N>\\<lbrakk> Lam [x]. e \\<rbrakk>\\<^bsub>\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)\\<cdot>r'\"\n      unfolding CESem_simps\n      by -(rule C_case_cong, simp)\n  qed\nnext\n  case (App e x)\n  show ?case\n  proof (rule C_restr_cong)\n    fix r'\n    assume \"r' \\<sqsubseteq> r\"\n    {\n      fix r''\n      assume \"r' = C\\<cdot>r''\" with `r' \\<sqsubseteq> r`\n      have ** : \"(Cpred\\<cdot>r \\<sqinter> r'') = r''\"\n        by (metis Cpred.simps below_refl is_meetI monofun_cfun_arg)\n\n      have \"r'' \\<sqsubseteq> r\" by (metis `r' = C\\<cdot>r''` `r' \\<sqsubseteq> r` below_C below_trans)\n      hence *: \"(\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>\\<^esub>)\\<cdot>r'' = (\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)\\<cdot>r''\"\n        by (rule C_restr_eqD[OF App])\n\n      note * **\n    }\n    thus \"(\\<N>\\<lbrakk> App e x \\<rbrakk>\\<^bsub>\\<rho>\\<^esub>)\\<cdot>r' = (\\<N>\\<lbrakk> App e x \\<rbrakk>\\<^bsub>\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)\\<cdot>r'\"\n      unfolding CESem_simps\n      by -(rule C_case_cong, simp)\n  qed\nnext\n  case (Let as e)\n\n  txt {* The lemma, lifted to heaps *}\n  have restr_can_restrict_env_heap : \"\\<And> r. (\\<N>\\<lbrace>as\\<rbrace>\\<rho>)|\\<^sup>\\<circ>\\<^bsub>r\\<^esub> = (\\<N>\\<lbrace>as\\<rbrace>\\<rho>|\\<^sup>\\<circ>\\<^bsub>r\\<^esub>)|\\<^sup>\\<circ>\\<^bsub>r\\<^esub>\"\n  proof(rule has_ESem.parallel_HSem_ind)\n    fix \\<rho>\\<^sub>1 \\<rho>\\<^sub>2 :: CEnv and r :: C\n    assume \"\\<rho>\\<^sub>1|\\<^sup>\\<circ>\\<^bsub>r\\<^esub> = \\<rho>\\<^sub>2|\\<^sup>\\<circ>\\<^bsub>r\\<^esub>\"\n    hence \"\\<rho>\\<^sub>1|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub> = \\<rho>\\<^sub>2|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\" by (metis env_restr_eq_Cpred)\n\n    show \" (\\<rho> ++\\<^bsub>domA as\\<^esub> \\<^bold>\\<N>\\<lbrakk> as \\<^bold>\\<rbrakk>\\<^bsub>\\<rho>\\<^sub>1\\<^esub>)|\\<^sup>\\<circ>\\<^bsub>r\\<^esub> = (\\<rho>|\\<^sup>\\<circ>\\<^bsub>r\\<^esub> ++\\<^bsub>domA as\\<^esub> \\<^bold>\\<N>\\<lbrakk> as \\<^bold>\\<rbrakk>\\<^bsub>\\<rho>\\<^sub>2\\<^esub>)|\\<^sup>\\<circ>\\<^bsub>r\\<^esub>\"\n    proof(rule env_C_restr_cong)\n      fix x and r'\n      assume \"r' \\<sqsubseteq> r\"\n\n      show \"(\\<rho> ++\\<^bsub>domA as\\<^esub> \\<^bold>\\<N>\\<lbrakk> as \\<^bold>\\<rbrakk>\\<^bsub>\\<rho>\\<^sub>1\\<^esub>) x\\<cdot>r' = (\\<rho>|\\<^sup>\\<circ>\\<^bsub>r\\<^esub> ++\\<^bsub>domA as\\<^esub> \\<^bold>\\<N>\\<lbrakk> as \\<^bold>\\<rbrakk>\\<^bsub>\\<rho>\\<^sub>2\\<^esub>) x\\<cdot>r'\"\n      proof(cases \"x \\<in> domA as\")\n        case True\n        have \"(\\<N>\\<lbrakk> the (map_of as x) \\<rbrakk>\\<^bsub>\\<rho>\\<^sub>1\\<^esub>)\\<cdot>r' = (\\<N>\\<lbrakk> the (map_of as x) \\<rbrakk>\\<^bsub>\\<rho>\\<^sub>1|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)\\<cdot>r'\"\n          by (rule C_restr_eqD[OF Let(1)[OF True] `r' \\<sqsubseteq> r`])\n        also have \"\\<dots> = (\\<N>\\<lbrakk> the (map_of as x) \\<rbrakk>\\<^bsub>\\<rho>\\<^sub>2|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)\\<cdot>r'\"\n          unfolding `\\<rho>\\<^sub>1|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub> = \\<rho>\\<^sub>2|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>`..\n        also have \"\\<dots>   = (\\<N>\\<lbrakk> the (map_of as x) \\<rbrakk>\\<^bsub>\\<rho>\\<^sub>2\\<^esub>)\\<cdot>r'\"\n          by (rule C_restr_eqD[OF Let(1)[OF True] `r' \\<sqsubseteq> r`, symmetric])\n        finally\n        show ?thesis using True by (simp add: lookupEvalHeap)\n      next\n        case False\n        from `r' \\<sqsubseteq> r` have \"(r \\<sqinter> r') = r'\" by (metis below_refl is_meetI)\n        thus ?thesis using False by simp\n      qed\n    qed\n  qed simp_all\n\n  show ?case\n  proof (rule C_restr_cong)\n    fix r'\n    assume \"r' \\<sqsubseteq> r\"\n    {\n      fix r''\n      assume \"r' = C\\<cdot>r''\" with `r' \\<sqsubseteq> r`\n      have ** : \"(Cpred\\<cdot>r \\<sqinter> r'') = r''\"\n        by (metis Cpred.simps below_refl is_meetI monofun_cfun_arg)\n\n      have \"r'' \\<sqsubseteq> r\" by (metis `r' = C\\<cdot>r''` `r' \\<sqsubseteq> r` below_C below_trans)\n\n      have \"(\\<N>\\<lbrace>as\\<rbrace>\\<rho>)|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub> = (\\<N>\\<lbrace>as\\<rbrace>(\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>))|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\"\n        by (rule restr_can_restrict_env_heap)\n      hence \"(\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>as\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r'' = (\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>as\\<rbrace>\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)\\<cdot>r''\"\n        by (subst (1 2)  C_restr_eqD[OF Let(2) `r'' \\<sqsubseteq> r`]) simp\n    }\n    thus \" (\\<N>\\<lbrakk> Let as e \\<rbrakk>\\<^bsub>\\<rho>\\<^esub>)\\<cdot>r' = (\\<N>\\<lbrakk> Let as e \\<rbrakk>\\<^bsub>\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)\\<cdot>r'\"\n      unfolding CESem_simps\n      by -(rule C_case_cong, simp)\n  qed\nqed\n\nlemma can_restrict_env:\n  \"(\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<rho>\\<^esub>)\\<cdot>r = (\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)\\<cdot>r\"\n  by (rule C_restr_eqD[OF restr_can_restrict_env below_refl])\n\ntext {*\nWhen an expression @{term e} terminates, then we can remove such an expression from the heap and it\nstill terminates. This is the curcial trick to handle black-holing in the resourced semantics.\n*}\n\nlemma add_BH:\n  assumes \"map_of \\<Gamma> x = Some e\"\n  assumes  \"(\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<noteq> \\<bottom>\"\n  shows \"(\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<noteq> \\<bottom>\"\nproof-\n  def r \\<equiv> \"demand (\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\"\n  have \"r \\<noteq> \\<bottom>\" unfolding r_def by (rule demand_not_0)\n\n  from  assms(2)\n  have \"r \\<sqsubseteq> C\\<^bsup>n\\<^esup>\" unfolding r_def not_bot_demand by simp\n\n  from assms(1)\n  have [simp]: \"the (map_of \\<Gamma> x) = e\" by (metis option.sel)\n\n  from assms(1)\n  have [simp]: \"x \\<in> domA \\<Gamma>\" by (metis domIff dom_map_of_conv_domA not_Some_eq)\n\n  def ub \\<equiv> \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\" -- \"An upper bound for the induction\"\n\n  have heaps: \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>)|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub> \\<sqsubseteq> \\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\" and \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace> \\<sqsubseteq> ub\"\n  proof (induction rule: HSem_bot_ind) \n    fix \\<rho>'\n    assume \"\\<rho>'|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub> \\<sqsubseteq> \\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\"\n    assume \"\\<rho>' \\<sqsubseteq> ub\"\n\n    show \"(\\<^bold>\\<N>\\<lbrakk> \\<Gamma> \\<^bold>\\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>)|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub> \\<sqsubseteq> \\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\"\n    proof (rule fun_belowI)\n      fix y\n      show \"((\\<^bold>\\<N>\\<lbrakk> \\<Gamma> \\<^bold>\\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>)|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>) y \\<sqsubseteq> (\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>) y\"\n      proof (cases \"y = x\")\n        case True\n        have \"((\\<^bold>\\<N>\\<lbrakk> \\<Gamma> \\<^bold>\\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>)|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>) x = (\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>)|\\<^bsub>Cpred\\<cdot>r\\<^esub>\"\n          by (simp add: lookupEvalHeap)\n        also have \"\\<dots> \\<sqsubseteq> (\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>ub\\<^esub>)|\\<^bsub>Cpred\\<cdot>r\\<^esub>\"\n          using `\\<rho>' \\<sqsubseteq> ub` by (intro monofun_cfun_arg)\n        also have \"\\<dots> = (\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)|\\<^bsub>Cpred\\<cdot>(demand (\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>))\\<^esub>\"\n          unfolding ub_def r_def..\n        also have \"\\<dots> = \\<bottom>\"\n          by (rule C_restr_bot_demand) (simp add:  demand_not_0)\n        also have \"\\<dots> =  (\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>) x\"\n          by (simp add: lookup_HSem_other)\n        finally\n        show ?thesis unfolding True.\n      next\n        case False\n        show ?thesis\n        proof (cases \"y \\<in> domA \\<Gamma>\")\n          case True\n          have \"(\\<N>\\<lbrakk> the (map_of \\<Gamma> y) \\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>)|\\<^bsub>Cpred\\<cdot>r\\<^esub> = (\\<N>\\<lbrakk> the (map_of \\<Gamma> y) \\<rbrakk>\\<^bsub>\\<rho>'|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>(Cpred\\<cdot>r)\\<^esub>\\<^esub>)|\\<^bsub>Cpred\\<cdot>r\\<^esub>\"\n            by (rule restr_can_restrict_env)\n          also have \"\\<dots> \\<sqsubseteq> \\<N>\\<lbrakk> the (map_of \\<Gamma> y) \\<rbrakk>\\<^bsub>\\<rho>'|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>(Cpred\\<cdot>r)\\<^esub>\\<^esub>\"\n            by (rule C_restr_below)\n          also have \"\\<rho>'|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>(Cpred\\<cdot>r)\\<^esub> \\<sqsubseteq> \\<rho>'|\\<^sup>\\<circ>\\<^bsub>(Cpred\\<cdot>r)\\<^esub>\"\n            by (intro monofun_cfun_arg monofun_cfun_fun Cpred_below)\n          also note `\\<dots> \\<sqsubseteq> \\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>`\n          finally\n          show ?thesis\n            using `y \\<in> domA \\<Gamma>` `y \\<noteq> x`\n            by (simp add: lookupEvalHeap lookup_HSem_heap)\n        next\n          case False\n          thus ?thesis by simp\n        qed\n      qed\n    qed\n\n    from `\\<rho>' \\<sqsubseteq> ub`\n    have \"(\\<^bold>\\<N>\\<lbrakk> \\<Gamma> \\<^bold>\\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>) \\<sqsubseteq> (\\<^bold>\\<N>\\<lbrakk> \\<Gamma> \\<^bold>\\<rbrakk>\\<^bsub>ub\\<^esub>)\" \n      by (rule cont2monofunE[rotated]) simp\n    also have \"\\<dots> = ub\"\n      unfolding ub_def HSem_bot_eq[symmetric]..\n    finally     \n    show \"(\\<^bold>\\<N>\\<lbrakk> \\<Gamma> \\<^bold>\\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>) \\<sqsubseteq> ub\".\n  qed simp_all\n\n  from assms(2)\n  have \"(\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>r \\<noteq> \\<bottom>\"\n    unfolding r_def\n    by (rule demand_suffices[OF infinite_resources_suffice])\n  also\n  have \"(\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>r = (\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>)|\\<^sup>\\<circ>\\<^bsub>Cpred\\<cdot>r\\<^esub>\\<^esub>)\\<cdot>r\"\n    by (rule can_restrict_env)\n  also\n  have \"\\<dots> \\<sqsubseteq> (\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>r\"\n    by (intro monofun_cfun_arg monofun_cfun_fun heaps )\n  also\n  have \"\\<dots> \\<sqsubseteq> (\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup>\"\n    using `r \\<sqsubseteq> C\\<^bsup>n\\<^esup>` by (rule monofun_cfun_arg)\n  finally\n  show ?thesis by this (intro cont2cont)+\nqed\n\ntext {*\nIf we get a result with finitely many resources, we can perform induction on that numbers.\n*}\n\nlemma adequacy_finite:\n  assumes \"(\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<noteq> \\<bottom>\"\n  shows \"\\<exists> \\<Delta> v. \\<Gamma> : e \\<Down>\\<^bsub>S\\<^esub> \\<Delta> : v\"\nusing assms\nproof(induction n arbitrary: \\<Gamma> e S)\n  case 0\n  hence False by auto\n  thus ?case..\nnext\n  case (Suc n)\n  show ?case\n  proof(cases e rule:exp_strong_exhaust(1)[where c = \"(\\<Gamma>,S)\", case_names Var App Let Lam])\n  case (Var x)\n    let ?e = \"the (map_of \\<Gamma> x)\"\n    from Suc.prems[unfolded Var]\n    have \"x \\<in> domA \\<Gamma>\" \n      by (auto intro: ccontr simp add: lookup_HSem_other)\n    hence \"map_of \\<Gamma> x = Some ?e\" by (rule domA_map_of_Some_the)\n    moreover\n    from Suc.prems[unfolded Var] `map_of \\<Gamma> x = Some ?e` `x \\<in> domA \\<Gamma>`\n    have \"(\\<N>\\<lbrakk>?e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<noteq> \\<bottom>\" by (auto simp add: lookup_HSem_heap  simp del: app_strict)\n    hence \"(\\<N>\\<lbrakk>?e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<noteq> \\<bottom>\" by (rule add_BH[OF `map_of \\<Gamma> x = Some ?e`])\n    from Suc.IH[OF this]\n    obtain \\<Delta> v where \"delete x \\<Gamma> : ?e \\<Down>\\<^bsub>x # S\\<^esub> \\<Delta> : v\" by blast\n    ultimately\n    have \"\\<Gamma> : (Var x) \\<Down>\\<^bsub>S\\<^esub> (x,v) #  \\<Delta> : v\" by (rule Variable)\n    thus ?thesis using Var by auto\n  next\n  case (App e' x)\n    have \"finite (set S \\<union> fv (\\<Gamma>, e'))\" by simp\n    from finite_list[OF this]\n    obtain S' where S': \"set S' = set S \\<union> fv (\\<Gamma>, e')\"..\n\n    from Suc.prems[unfolded App]\n    have prem: \"((\\<N>\\<lbrakk> e' \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<down>CFn (\\<N>\\<lbrace>\\<Gamma>\\<rbrace>) x|\\<^bsub>C\\<^bsup>n\\<^esup>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<noteq> \\<bottom>\" by (auto simp del: app_strict)\n    hence \"(\\<N>\\<lbrakk>e'\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<noteq> \\<bottom>\" by auto\n    from Suc.IH[OF this]\n    obtain \\<Delta> v where lhs': \"\\<Gamma> : e' \\<Down>\\<^bsub>x#S'\\<^esub> \\<Delta> : v\" by blast \n\n    from result_evaluated_fresh[OF lhs']\n    obtain y e'' where n': \"v = (Lam [y]. e'')\" and \"atom y \\<sharp> (x, \\<Delta>)\" by blast\n    with lhs'\n    have lhs: \"\\<Gamma> : e' \\<Down>\\<^bsub>x # S'\\<^esub> \\<Delta> : Lam [y]. e''\" by simp\n\n    from `atom y \\<sharp> _` have \"y \\<notin> domA \\<Delta>\" by (metis (full_types) fresh_Pair domA_not_fresh)\n    from `atom y \\<sharp> _` have \"y \\<noteq> x\" by (metis (full_types) fresh_Pair fresh_at_base(2))\n   \n    have \"fv (\\<Gamma>, e') \\<subseteq> set (x # S')\" using S' by auto\n    from correctness_empty_env[OF lhs this]\n    have correct1: \"\\<N>\\<lbrakk>e'\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk>Lam [y]. e''\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<^esub>\" and correct2: \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace> \\<sqsubseteq> \\<N>\\<lbrace>\\<Delta>\\<rbrace>\" by auto\n\n    have \"((\\<N>\\<lbrakk> e' \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<down>CFn (\\<N>\\<lbrace>\\<Gamma>\\<rbrace>) x|\\<^bsub>C\\<^bsup>n\\<^esup>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<noteq> \\<bottom>\" using prem.\n    also have \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>) x|\\<^bsub>C\\<^bsup>n\\<^esup>\\<^esub> \\<sqsubseteq> (\\<N>\\<lbrace>\\<Gamma>\\<rbrace>) x\" by (rule C_restr_below)\n    also note `\\<N>\\<lbrakk>e'\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk>Lam [y]. e''\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<^esub>`\n    also note `(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>) \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>)`\n    also have \"(\\<N>\\<lbrakk> Lam [y]. e'' \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<sqsubseteq> CFn\\<cdot>(\\<Lambda> v. \\<N>\\<lbrakk>e''\\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Delta>\\<rbrace>)(y := v)\\<^esub>)\"\n      by (rule CELam_no_restr)\n    also have \"(\\<dots> \\<down>CFn (\\<N>\\<lbrace>\\<Delta>\\<rbrace>) x)\\<cdot>C\\<^bsup>n\\<^esup> = (\\<N>\\<lbrakk>e''\\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Delta>\\<rbrace>)(y := ((\\<N>\\<lbrace>\\<Delta>\\<rbrace>) x))\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup>\"\n      using `y \\<notin> domA \\<Delta>` by simp\n    also have \"\\<dots> = (\\<N>\\<lbrakk>e''[y::=x]\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup>\"\n      unfolding ESem_subst[OF `y \\<noteq> x`]..\n    finally\n    have \"\\<dots> \\<noteq> \\<bottom>\" by this (intro cont2cont cont_fun)+\n    then\n    obtain \\<Theta> v' where rhs: \"\\<Delta> : e''[y::=x] \\<Down>\\<^bsub>S'\\<^esub> \\<Theta> : v'\" using Suc.IH by blast\n    \n    have \"\\<Gamma> : App e' x \\<Down>\\<^bsub>S'\\<^esub> \\<Theta> : v'\"\n      by (rule reds_ApplicationI[OF lhs rhs])\n    hence \"\\<Gamma> : App e' x \\<Down>\\<^bsub>S\\<^esub> \\<Theta> : v'\"\n      apply (rule reds_smaller_L) using S' by auto\n    thus ?thesis using App by auto\n  next\n  case (Lam v e')\n    have \"\\<Gamma> : Lam [v]. e' \\<Down>\\<^bsub>S\\<^esub> \\<Gamma> : Lam [v]. e'\" ..\n    thus ?thesis using Lam by blast\n  next\n  case (Let as e')\n    from Suc.prems[unfolded Let(2)]\n    have prem: \"(\\<N>\\<lbrakk>e'\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>as\\<rbrace>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<noteq> \\<bottom>\" \n      by (simp  del: app_strict)\n    also\n      have \"atom ` domA as \\<sharp>* \\<Gamma>\" using Let(1) by (simp add: fresh_star_Pair)\n      hence \"\\<N>\\<lbrace>as\\<rbrace>\\<N>\\<lbrace>\\<Gamma>\\<rbrace> = \\<N>\\<lbrace>as @ \\<Gamma>\\<rbrace>\" by (rule HSem_merge)\n    finally \n    have \"(\\<N>\\<lbrakk>e'\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>as @ \\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>C\\<^bsup>n\\<^esup> \\<noteq> \\<bottom>\".\n    then\n    obtain \\<Delta> v where \"as @ \\<Gamma> : e' \\<Down>\\<^bsub>S\\<^esub> \\<Delta> : v\" using Suc.IH by blast\n    hence \"\\<Gamma> : Let as e' \\<Down>\\<^bsub>S\\<^esub> \\<Delta> : v\"\n      by (rule reds.Let[OF Let(1)])\n    thus ?thesis using Let by auto\n  qed\nqed\n\ntheorem resourced_adequacy:\n  assumes \"(\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub>)\\<cdot>r \\<noteq> \\<bottom>\"\n  shows \"\\<exists> \\<Delta> v. \\<Gamma> : e \\<Down>\\<^bsub>S\\<^esub> \\<Delta> : v\"\n  by (rule finite_resources_suffice[OF infinite_resources_suffice[OF assms(1)]])\n     (erule adequacy_finite)\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Launchbury/ResourcedAdequacy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3348623646504356}}
{"text": "section \\<open> Interaction Trees \\<close>\n\ntheory Interaction_Trees\n  imports \"HOL-Library.Monad_Syntax\" \"HOL-Library.BNF_Corec\" \"HOL-Library.Prefix_Order\"\n  \"Z_Toolkit.Relation_Toolkit\"\nbegin\n\nsubsection \\<open> Preliminaries \\<close>\n\nunbundle Z_Type_Syntax\n\ntext \\<open> Allow partial functions to be written with braces \\<close>\n\nsyntax \"_Pfun\"     :: \"maplets => ('a, 'b) pfun\"            (\"(1{_})\")\n\nnotation pempty (\"{\\<mapsto>}\")\n\nconsts tick :: \"'a \\<Rightarrow> 'b\" (\"\\<checkmark>\")\n\nsubsection \\<open> Interaction Tree Type \\<close>\n\ncodatatype ('e, 'r) itree = \n  Ret 'r | \\<comment> \\<open> Terminate, returning a value \\<close>\n  Sil \"('e, 'r) itree\" (\"\\<tau>\") | \\<comment> \\<open> Invisible event \\<close>\n  Vis \"'e \\<Zpfun> ('e, 'r) itree\" \\<comment> \\<open> Visible events choosing the continuation \\<close>\n\nadhoc_overloading tick Ret\n\nsyntax\n  \"_gchoice\"      :: \"pttrn \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"\\<bbar> _ \\<in> _ \\<rightarrow> _\" [0, 0, 100] 100)\n  \"_gchoice_UNIV\" :: \"pttrn \\<Rightarrow> logic \\<Rightarrow> logic\" (\"\\<bbar> _ \\<rightarrow> _\" [0, 100] 100)\n\ntranslations\n  \"\\<bbar> e \\<in> E \\<rightarrow> P\" == \"CONST Vis (\\<lambda> e \\<in> E \\<bullet> P)\"\n  \"\\<bbar> e \\<rightarrow> P\" == \"CONST Vis (\\<lambda> e \\<bullet> P)\"\n\ntext \\<open> A stable process has no possible internal activity \\<close>\n\nabbreviation unstable :: \"('e, 's) itree \\<Rightarrow> bool\" where\n\"unstable P \\<equiv> is_Sil P\"\n\nabbreviation stable :: \"('e, 's) itree \\<Rightarrow> bool\" where\n\"stable P \\<equiv> \\<not> unstable P\"\n\ntranslations \"CONST stable P\" <= \"\\<not> CONST unstable P\"\n\nlemma stable_Ret [intro]: \"stable (Ret x)\"\n  by simp\n\nlemma stable_Vis [intro]: \"stable (Vis F)\"\n  by simp\n\nlemma unstableE: \"\\<lbrakk> unstable P; \\<And> P'. P = Sil P' \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\n  using is_Sil_def by auto\n\nlemma stableE:\n  assumes \"stable P\" \"is_Ret P \\<Longrightarrow> Q\" \"is_Vis P \\<Longrightarrow> Q\"\n  shows Q\n  by (metis assms(1) assms(2) assms(3) itree.exhaust_disc)\n\nlemma is_VisE [elim]: \"\\<lbrakk> is_Vis P; \\<And> x. P = Vis x \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\n  using is_Vis_def by blast\n\nlemma is_RetE [elim]: \"\\<lbrakk> is_Ret P; \\<And> x. P = Ret x \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\n  by (metis (mono_tags, opaque_lifting) is_Ret_def)\n\ntheorem itree_coind[elim, consumes 1, case_names wform Ret Sil Vis, induct pred: \"HOL.eq\"]:\n  assumes \"\\<phi> P Q\" and\n  \"\\<And> P Q. \\<phi> P Q \\<Longrightarrow> (is_Ret P \\<longleftrightarrow> is_Ret Q) \\<and> (is_Sil P \\<longleftrightarrow> is_Sil Q) \\<and> (is_Vis P \\<longleftrightarrow> is_Vis Q)\" and\n  \"\\<And> x y. \\<phi> (Ret x) (Ret y) \\<Longrightarrow> x = y\" and\n  \"\\<And> P Q. \\<phi> (Sil P) (Sil Q) \\<Longrightarrow> \\<phi> P Q\" and\n  \"\\<And> F G. \\<phi> (Vis F) (Vis G) \\<Longrightarrow> (pdom(F) = pdom(G) \\<and> (\\<forall> x\\<in>pdom(F). \\<phi> (F x) (G x)))\"\n  shows \"P = Q\"\n  using assms\n  by (coinduct rule: itree.coinduct, auto simp add: relt_pfun_iff)\n\ntheorem itree_coind'[elim, consumes 1, case_names RetF SilF VisF Ret Sil Vis, induct pred: \"HOL.eq\"]:\n  assumes \"\\<phi> P Q\" and\n  \"\\<And> P Q. \\<phi> P Q \\<Longrightarrow> (is_Ret P \\<longleftrightarrow> is_Ret Q)\"\n  \"\\<And> P Q. \\<phi> P Q \\<Longrightarrow> (is_Sil P \\<longleftrightarrow> is_Sil Q)\"\n  \"\\<And> P Q. \\<phi> P Q \\<Longrightarrow> (is_Vis P \\<longleftrightarrow> is_Vis Q)\"\n  \"\\<And> x y. \\<phi> (Ret x) (Ret y) \\<Longrightarrow> x = y\" and\n  \"\\<And> P Q. \\<phi> (Sil P) (Sil Q) \\<Longrightarrow> \\<phi> P Q\" and\n  \"\\<And> F G. \\<phi> (Vis F) (Vis G) \\<Longrightarrow> (pdom(F) = pdom(G) \\<and> (\\<forall> x\\<in>pdom(F). \\<phi> (F x) (G x)))\"\n  shows \"P = Q\"\n  using assms\n  by (coinduct rule: itree.coinduct, auto simp add: relt_pfun_iff)\n\ntheorem itree_strong_coind[elim, consumes 1, case_names wform Ret Sil Vis, induct pred: \"HOL.eq\"]:\n  assumes phi: \"\\<phi> P Q\" and\n  \"\\<And> P Q. \\<phi> P Q \\<Longrightarrow> (is_Ret P \\<longleftrightarrow> is_Ret Q) \\<and> (is_Sil P \\<longleftrightarrow> is_Sil Q) \\<and> (is_Vis P \\<longleftrightarrow> is_Vis Q)\" and\n  \"\\<And> x y. \\<phi> (Ret x) (Ret y) \\<Longrightarrow> x = y\" and\n  \"\\<And> P Q. \\<phi> (Sil P) (Sil Q) \\<Longrightarrow> \\<phi> P Q \\<or> P = Q\" and\n  \"\\<And> F G. \\<phi> (Vis F) (Vis G) \\<Longrightarrow> (pdom(F) = pdom(G) \\<and> (\\<forall> x\\<in>pdom(F). \\<phi> (F x) (G x) \\<or> F x = G x))\"\n  shows \"P = Q\"\n  using assms\n  by (coinduct rule: itree.coinduct_strong, auto elim!: is_VisE simp add: relt_pfun_iff)\n\ntheorem itree_strong_coind'[elim, consumes 1, case_names RetF SilF VisF Ret Sil Vis, induct pred: \"HOL.eq\"]:\n  assumes phi: \"\\<phi> P Q\" and\n  \"\\<And> P Q. \\<phi> P Q \\<Longrightarrow> (is_Ret P \\<longleftrightarrow> is_Ret Q)\"\n  \"\\<And> P Q. \\<phi> P Q \\<Longrightarrow> (is_Sil P \\<longleftrightarrow> is_Sil Q)\"\n  \"\\<And> P Q. \\<phi> P Q \\<Longrightarrow> (is_Vis P \\<longleftrightarrow> is_Vis Q)\"\n  \"\\<And> x y. \\<phi> (Ret x) (Ret y) \\<Longrightarrow> x = y\" and\n  \"\\<And> P Q. \\<phi> (Sil P) (Sil Q) \\<Longrightarrow> \\<phi> P Q \\<or> P = Q\" and\n  \"\\<And> F G. \\<phi> (Vis F) (Vis G) \\<Longrightarrow> (pdom(F) = pdom(G) \\<and> (\\<forall> x\\<in>pdom(F). \\<phi> (F x) (G x) \\<or> F x = G x))\"\n  shows \"P = Q\"\n  using assms\n  by (erule_tac itree_strong_coind, auto)\n\ntext \\<open> Up-to technique would add a functor on. Respectful closure and enhancement. \n cf. \"Coinduction all the way up\". Davide Sangiorgi. Replace @{term \"R \\<subseteq> F(R)\"} prove @{term \"R \\<subseteq> C(F(R))\"}. \\<close>\n\nsubsection \\<open> Kleisli Trees and Monads \\<close>\n\ntype_synonym ('e, 'r, 's) ktree = \"'r \\<Rightarrow> ('e, 's) itree\"\ntype_synonym ('e, 'r) htree = \"('e, 'r, 'r) ktree\"\n\nprimcorec (exhaustive) bind_itree :: \"('e, 'r) itree \\<Rightarrow> ('r \\<Rightarrow> ('e, 's) itree) \\<Rightarrow> ('e, 's) itree\" where\n\"bind_itree u k = \n  (case u of\n    \\<comment> \\<open> Pass the returned value to the continuation; the silent event is needed for friendliness. \\<close>\n    Ret r \\<Rightarrow> (k r) | \n    \\<comment> \\<open> Execute the silent action and then the remainder of the binding. \\<close>\n    Sil t \\<Rightarrow> Sil (bind_itree t k) | \n    \\<comment> \\<open> Apply the binding function to every possible continuation (non-trivial). \\<close>\n    Vis t \\<Rightarrow> Vis (map_pfun (\\<lambda> x. bind_itree x k) t))\"\n\nlemma map_pfun_alt_def: \"map_pfun f g = pfun_of_map (map_option f \\<circ> pfun_lookup g)\"\n  by (simp add: map_pfun_def)\n\nadhoc_overloading bind bind_itree\n\nlemma bind_Ret [simp, code]: \"Ret v \\<bind> k = (k v)\"\n  by (simp add: bind_itree.code)\n\nlemma bind_Sil [simp, code]: \"Sil t \\<bind> k = Sil (t \\<bind> k)\"\n  by (simp add: bind_itree.ctr)\n\nlemma bind_Vis [simp, code]: \"Vis t \\<bind> k = Vis (map_pfun (\\<lambda> x. bind_itree x k) t)\"\n  by (auto simp add: bind_itree.ctr option.case_eq_if fun_eq_iff)\n\ndefinition \"kleisli_comp bnd f g = (\\<lambda> x. bnd (f x) g)\"\n\ndefinition seq_itree :: \"('a \\<Rightarrow> ('e, 'b) itree) \\<Rightarrow> ('b \\<Rightarrow> ('e, 'c) itree) \\<Rightarrow> 'a \\<Rightarrow> ('e, 'c) itree\" (infixr \";;\" 54) where \n\"seq_itree P Q = kleisli_comp bind_itree P Q\"\n\ntext \\<open> A bind cannot evaluate to simply a @{const Ret} because the @{term P} and @{term Q} must both\n  minimally terminate. \\<close>\n\nlemma bind_RetE [elim]:\n  assumes \"P \\<bind> Q = Ret x\"\n  obtains y where \"P = Ret y\" \"Q y = Ret x\"\n  by (metis (no_types, opaque_lifting) assms bind_Ret bind_itree.disc_iff(1) is_Ret_def)\n  \nlemma bind_RetE' [elim]:\n  assumes \"Ret x = P \\<bind> Q\"\n  obtains y where \"P = Ret y\" \"Q y = Ret x\"\n  by (metis assms bind_RetE)\n\nlemma bind_VisE [elim]:\n  assumes \"P \\<bind> Q = Vis F\"\n    \"\\<And> F'. \\<lbrakk> P = Vis F'; F = map_pfun (\\<lambda> x. x \\<bind> Q) F' \\<rbrakk> \\<Longrightarrow> R\"\n    \"\\<And> x. \\<lbrakk> P = Ret x; Q x = Vis F \\<rbrakk> \\<Longrightarrow> R\"\n  shows \"R\"\n  by (metis assms bind_Ret bind_Vis bind_itree.disc_iff(3) is_VisE itree.collapse(1) itree.disc(9) itree.sel(3))\n\n\nlemma bind_VisE' [elim, consumes 1, case_names initial continue]:\n  assumes \"Vis F = P \\<bind> Q\"\n    \"\\<And> F'. \\<lbrakk> P = Vis F'; F = map_pfun (\\<lambda> x. x \\<bind> Q) F' \\<rbrakk> \\<Longrightarrow> R\"\n    \"\\<And> x. \\<lbrakk> P = Ret x; Q x = Vis F \\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  by (metis assms bind_VisE)\n\nlemma bind_Sil_dest:\n  \"P \\<bind> Q = Sil R \\<Longrightarrow> ((\\<exists> P'. P = Sil P' \\<and> R = P' \\<bind> Q) \\<or> (\\<exists> x. P = Ret x \\<and> Sil R = Q x))\"\n  by (metis (no_types, lifting) bind_itree.code bind_itree.disc_iff(2) itree.case_eq_if itree.collapse(1) itree.collapse(2) itree.disc(5) itree.sel(2))\n  \nlemma bind_SilE [elim]:\n  assumes \"(P \\<bind> Q) = Sil X\"\n    \"\\<And> P'. \\<lbrakk> P = Sil P'; X = P' \\<bind> Q \\<rbrakk> \\<Longrightarrow> R\"\n    \"\\<And> x. \\<lbrakk> P = Ret x; Sil X = Q x \\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  using assms bind_Sil_dest by blast\n\nlemma bind_SilE' [elim, consumes 1, case_names initial continue]:\n  assumes \"Sil X = (P \\<bind> Q)\"\n    \"\\<And> P'. \\<lbrakk> P = Sil P'; X = P' \\<bind> Q \\<rbrakk> \\<Longrightarrow> R\"\n    \"\\<And> x. \\<lbrakk> P = Ret x; Sil X = Q x \\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  by (metis assms(1) assms(2) assms(3) bind_SilE)\n\nlemma bind_itree_right_unit:\n  shows \"P \\<bind> Ret = P\"\n  by (coinduction arbitrary: P rule: itree_strong_coind, auto)\n\nlemma bind_itree_assoc:\n  fixes P :: \"('e, 's) itree\"\n  shows \"P \\<bind> (\\<lambda> x. (Q x \\<bind> R)) = (P \\<bind> Q) \\<bind> R\"\nproof (coinduction arbitrary: P Q R rule: itree_strong_coind')\n  case RetF\n  then show ?case by auto\nnext\n  case SilF\n  then show ?case by auto\nnext\n  case VisF\n  then show ?case by auto\nnext\n  case Ret\n  then show ?case by auto\nnext\n  case Sil\n  then show ?case by (auto elim!: bind_SilE', metis itree.sel(2))\nnext\n  case Vis\n  then show ?case by (force elim!: bind_VisE')\nqed\n\nfriend_of_corec bind_itree :: \"('e, 'r) itree \\<Rightarrow> ('r \\<Rightarrow> ('e, 'r) itree) \\<Rightarrow> ('e, 'r) itree\" where\n\"bind_itree u k = \n  (case u of \n    Ret r \\<Rightarrow> \n      (case k r of \n         Ret x \\<Rightarrow> Ret x |\n         Vis F \\<Rightarrow> Vis F |\n         Sil P \\<Rightarrow> Sil P) |\n    Sil t \\<Rightarrow> Sil (bind_itree t k) | \n    Vis t \\<Rightarrow> Vis (map_pfun (\\<lambda> x. bind_itree x k) t))\"\n   apply (simp add: bind_itree.code)\n   apply (metis (no_types, opaque_lifting) itree.case_eq_if itree.collapse(1) itree.collapse(2) itree.collapse(3) itree.exhaust_disc)\n  apply transfer_prover\n  done\n\nlemma kcomp_assoc: \n  fixes P :: \"('e, 'r, 's) ktree\" \n  shows \"(P ;; Q) ;; R = P ;; (Q ;; R)\"\n  by (simp add: seq_itree_def kleisli_comp_def fun_eq_iff bind_itree_assoc)\n\nsubsection \\<open> Run \\<close>\n\nprimcorec run :: \"'e set \\<Rightarrow> ('e, 's) itree\" where\n\"run E = Vis (map_pfun (\\<lambda> x. run E) (pId_on E))\"\n\nlemma Run_alt_def: \"run E = (\\<bbar> e \\<in> E \\<rightarrow> run E)\"\nproof -\n  have \"run E = Vis (map_pfun (\\<lambda> x. run E) (pId_on E))\"\n    by (metis run.code)\n  also have \"... = \\<bbar> x \\<in> E \\<rightarrow> run E\"\n    by (simp add: map_pfun_as_pabs)\n  finally show ?thesis .\nqed\n\nlemma run_empty: \"run {} = Vis {}\\<^sub>p\"\n  by (metis (no_types, lifting) pdom_map_pfun pdom_pId_on pdom_res_empty pdom_res_pdom run.code)\n\nlemma run_bind: \"run E \\<bind> K = run E\"\n  apply (coinduction rule: itree_coind')\n  apply (meson bind_itree.disc(3) itree.distinct_disc(3) run.disc_iff)\n  apply (meson bind_itree.disc(3) itree.distinct_disc(5) run.disc_iff)\n  apply simp\n  apply (metis itree.disc(7) run.disc_iff)\n   apply (metis itree.disc(8) run.disc_iff)\n  apply (smt (verit, best) bind_VisE itree.disc(7) itree.sel(3) map_pfun_apply pdom_map_pfun run.disc_iff run.sel)\n  done  \n\nsubsection \\<open> Transitive Silent Steps \\<close>\n\nfun Sils :: \"nat \\<Rightarrow> ('e, 's) itree \\<Rightarrow> ('e, 's) itree\" where\n\"Sils 0 P = P\" |\n\"Sils (Suc n) P = Sil (Sils n P)\"\n\nlemma \"Sils n P = (\\<tau>^^n) P\"\n  by (induct n, simp_all)\n\nlemma Sils_0 [intro]: \"Sils 0 P = P\"\n  by (simp)\n\nlemma is_Ret_Sils [simp]: \"is_Ret (Sils n P) \\<longleftrightarrow> n = 0 \\<and> is_Ret P\"\n  by (metis Sils.elims itree.disc(2) less_numeral_extra(3) zero_less_Suc)\n\nlemma is_Vis_Sils [simp]: \"is_Vis (Sils n P) \\<longleftrightarrow> n = 0 \\<and> is_Vis P\"\n  by (metis Sils.elims Sils.simps(1) itree.disc(8))\n\nlemma is_Sil_Sils: \"is_Sil (Sils n P) \\<longleftrightarrow> (n > 0 \\<or> is_Sil P)\"\n  by (metis Sils.simps(1) is_Ret_Sils is_Vis_Sils itree.exhaust_disc neq0_conv)\n\nlemma un_Sil_Sils [simp]: \"un_Sil (Sils n P) = (if n = 0 then un_Sil P else Sils (n - 1) P)\"\n  by (cases n, simp_all)\n\nlemma Sils_Sils [simp]: \"Sils m (Sils n P) = Sils (m + n) P\"\n  by (induct m, simp_all)\n\nlemma Sils_injective: \"Sils n P = Sils n Q \\<Longrightarrow> P = Q\"\n  by (induct n, simp_all)\n\nlemma Vis_Sils: \"Vis F = Sils n (Vis G) \\<longleftrightarrow> (n = 0 \\<and> F = G)\"\n  by (metis Sils.elims is_Vis_Sils itree.disc(8) itree.disc(9) itree.inject(3))\n\nlemma Sils_Vis_inj: \"Sils m (Vis F) = Sils n (Vis G) \\<Longrightarrow> (m = n \\<and> F = G)\"\n  apply (induct m, auto simp add: Vis_Sils)\n  apply (induct n, auto)\n   apply (metis Sils.elims is_Vis_Sils itree.disc(9))\n  apply (induct n, auto)\n  apply (metis Sils.elims Vis_Sils)\n  done \n\nlemma Vis_not_Sils_Ret: \"Vis F = Sils n (Ret x) \\<Longrightarrow> False\"\n  by (metis is_Vis_Sils itree.disc(7) itree.disc(9))\n\nlemma Sils_Vis_not_Ret: \"Sils m (Vis F) = Sils n (Ret x) \\<Longrightarrow> False\"\n  apply (induct m, auto dest: Vis_not_Sils_Ret)\n  apply (induct n, auto)\n  apply (metis Sils.elims Vis_not_Sils_Ret)\n  done\n\nlemma Sils_Vis_iff: \"Sils m (Vis F) = Sils n (Vis G) \\<longleftrightarrow> (m = n \\<and> F = G)\"\n  by (auto simp add: Sils_Vis_inj)\n\nlemma bind_Sils [simp]: \"Sils n P \\<bind> Q = Sils n (P \\<bind> Q)\"\n  by (induct n; simp)\n\nlemma Sils_Sil_shift [simp]: \"Sils n (Sil P) = Sil (Sils n P)\"\n  by (metis Sils.simps(1) Sils.simps(2) Sils_Sils add_Suc_right)\n\nlemma bind_Sils_dest:\n  \"P \\<bind> Q = Sils n R \\<Longrightarrow> \n  ((\\<exists> P'. P = Sils n P' \\<and> R = P' \\<bind> Q) \n    \\<or> (\\<exists> x m. m \\<le> n \\<and> P = Sils m (Ret x) \\<and> Q x = Sils (n - (m)) R))\"\n  apply (induct n arbitrary: P Q R)\n   apply (auto)[1]\n  apply (simp)\n  apply (erule bind_SilE)\n   apply (metis (no_types, opaque_lifting) Sils.simps(2) Suc_le_mono diff_Suc_Suc)\n  apply (metis Sils.simps(1) Sils.simps(2) diff_zero zero_le)\n  done\n\nlemma bind_SilsE:\n  assumes \"(P \\<bind> Q) = Sils n X\"\n    \"\\<And> P'. \\<lbrakk> P = Sils n P'; P' \\<bind> Q = X \\<rbrakk> \\<Longrightarrow> R\"\n    \"\\<And> x m. \\<lbrakk> m \\<le> n; P = Sils m (Ret x); Q x = Sils (n - m) X \\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  using assms(1) assms(2) assms(3) bind_Sils_dest by blast  \n\nlemma bind_SilsE':\n  assumes \"Sils n X = (P \\<bind> Q)\"\n    \"\\<And> P'. \\<lbrakk> P = Sils n P'; P' \\<bind> Q = X \\<rbrakk> \\<Longrightarrow> R\"\n    \"\\<And> x m. \\<lbrakk> m \\<le> n; P = Sils m (Ret x); Q x = Sils (n - m) X \\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  by (metis assms(1) assms(2) assms(3) bind_SilsE)\n\nlemma Ret_Sils_iff [simp]: \"Ret x = Sils n P \\<longleftrightarrow> (n = 0 \\<and> P = Ret x)\"\n  by (metis Sils.simps(1) is_Ret_Sils itree.disc(1))\n\nlemma Sils_VisE:\n  assumes \"Sils n P = Vis F\"\n  \"\\<lbrakk> n = 0; P = Vis F \\<rbrakk> \\<Longrightarrow> Q\"\n  shows Q\n  by (metis Sils.elims assms(1) assms(2) itree.distinct(5))\n\nlemma stabilises_eq_iff [simp]: \n  \"\\<lbrakk> stable P; stable Q \\<rbrakk> \\<Longrightarrow> Sils m P = Sils n Q \\<longleftrightarrow> (m = n \\<and> P = Q)\"\n  apply (induct m arbitrary: n P Q )\n  apply (case_tac P, case_tac[!] Q)\n  apply (auto dest: Vis_not_Sils_Ret simp add: Vis_Sils)\n  apply (metis Sils.elims itree.disc(2) itree.disc(4) itree.discI(1) itree.sel(2))\n  apply (metis Sils.elims itree.disc(4) itree.distinct(1) itree.sel(2))\n  apply (metis Sils.elims itree.disc(6) itree.disc(8) itree.disc(9) itree.sel(2))\n  apply (metis Sils.elims itree.disc(6) itree.distinct(5) itree.sel(2))\n  done\n\nsubsection \\<open> Operational Semantics and Traces \\<close>\n\ninductive trace_to :: \"('e, 's) itree \\<Rightarrow> 'e list \\<Rightarrow> ('e, 's) itree \\<Rightarrow> bool\" (\"_ \\<midarrow>_\\<leadsto> _\" [55, 0, 55] 55) where\ntrace_to_Nil [intro]: \"P \\<midarrow>[]\\<leadsto> P\" | \ntrace_to_Sil [intro]: \"P \\<midarrow>tr\\<leadsto> P' \\<Longrightarrow> Sil P \\<midarrow>tr\\<leadsto> P'\" |\ntrace_to_Vis [intro]: \"\\<lbrakk> e \\<in> pdom F; F e \\<midarrow>tr\\<leadsto> P' \\<rbrakk> \\<Longrightarrow> Vis F \\<midarrow>e # tr\\<leadsto> P'\"\n\ninductive_cases\n  trace_to_VisE [elim]: \"Vis F \\<midarrow>tr\\<leadsto> P\" and\n  trace_to_RetE [elim]: \"Ret x \\<midarrow>tr\\<leadsto> P\" and\n  trace_to_SilE [elim]: \"Sil P \\<midarrow>tr\\<leadsto> P'\"\n\nlemma trace_to_Sils [intro]: \"P \\<midarrow>tr\\<leadsto> P' \\<Longrightarrow> Sils n P \\<midarrow>tr\\<leadsto> P'\"\n  by (induct n, auto)\n\nlemma trace_to_Ret: \"Ret x \\<midarrow>tr\\<leadsto> P \\<Longrightarrow> (tr, P) = ([], Ret x)\"\n  by auto\n\nlemma trace_of_Sils [intro]: \"Sils n P \\<midarrow>[]\\<leadsto> P\"\n  by (induct n, auto)\n\nlemma trace_to_prefix_closed:\n  assumes \"P \\<midarrow>tr'\\<leadsto> Q\" \"tr \\<le> tr'\"\n  shows \"\\<exists> P'. P \\<midarrow>tr\\<leadsto> P'\"\n  using assms proof (induct arbitrary: tr rule: trace_to.induct)\n  case (trace_to_Nil P)\n  then show ?case by (auto)\nnext\n  case (trace_to_Sil P tr' P' tr)\n  then show ?case by (auto)\nnext\n  case (trace_to_Vis e F tr' P' tr)\n  then show ?case\n  proof (cases \"tr = []\")\n    case True\n    then show ?thesis by auto\n  next\n    case False\n    then obtain tr'' where tr: \"tr = e # tr''\" \"tr'' \\<le> tr'\"\n      by (meson Prefix_Order.prefix_Cons trace_to_Vis.prems)\n    moreover then obtain P'' where \"F e \\<midarrow>tr''\\<leadsto> P''\"\n      using trace_to_Vis.hyps(3) by presburger\n    with trace_to_Vis tr show ?thesis\n      by auto      \n  qed\nqed\n\nlemma trace_to_Nil_Sils:\n  assumes \"P \\<midarrow>[]\\<leadsto> P'\" \n  shows \"\\<exists> n. Sils n P' = P\"\nproof - \n  have \"\\<And> tr. P \\<midarrow>tr\\<leadsto> P' \\<Longrightarrow> tr = [] \\<longrightarrow> (\\<exists> n. P = Sils n P')\"\n    by (induct_tac rule: trace_to.induct, auto\n       , metis (mono_tags) Sils_0, metis (mono_tags) Sils.simps(2))\n  thus ?thesis\n    using assms by fastforce\nqed\n\nlemma trace_to_NilE [elim]:\n  assumes \"P \\<midarrow>[]\\<leadsto> P'\" \n  obtains n where \"P = Sils n P'\"\n  using assms trace_to_Nil_Sils by auto\n\nlemma trace_to_Nil_iff: \"P \\<midarrow>[]\\<leadsto> P' \\<longleftrightarrow> (\\<exists> n. P = Sils n P')\"\n  by (meson trace_of_Sils trace_to_NilE)\n\nlemma trace_to_ConsE:\n  assumes \"P \\<midarrow>x # xs\\<leadsto> Q\" \n  obtains P' where \"P \\<midarrow>[x]\\<leadsto> P'\" \"P' \\<midarrow>xs\\<leadsto> Q\"\nproof -\n  have \"\\<And> tr. P \\<midarrow>tr\\<leadsto> Q \\<Longrightarrow> tr \\<noteq> [] \\<longrightarrow> (\\<exists>P'. P \\<midarrow>[hd tr]\\<leadsto> P' \\<and> P' \\<midarrow>tl tr\\<leadsto> Q)\"\n  proof -\n    fix tr\n    assume \"P \\<midarrow>tr\\<leadsto> Q\"\n    thus \"tr \\<noteq> [] \\<longrightarrow> (\\<exists>P'. P \\<midarrow>[hd tr]\\<leadsto> P' \\<and> P' \\<midarrow>tl tr\\<leadsto> Q)\"\n      by (induct rule: trace_to.induct, auto)\n  qed\n  thus ?thesis\n    by (metis assms list.distinct(1) list.sel(1) list.sel(3) that)\nqed\n\nlemma trace_to_singleE [elim!]:\n  assumes \"P \\<midarrow>[a]\\<leadsto> P'\"\n  obtains m n F  where \"P = Sils m (Vis F)\" \"a \\<in> pdom F\" \"F a = Sils n P'\"\nproof -\n  have \"\\<And> tr. P \\<midarrow>tr\\<leadsto> P' \\<Longrightarrow> (length tr = 1 \\<longrightarrow> (\\<exists> m n F. P = Sils m (Vis F) \\<and> hd tr \\<in> pdom F \\<and> F (hd tr) = Sils n P'))\"\n    apply (induct_tac rule: trace_to.induct)\n       apply (auto)\n      apply (metis Sils.simps(2))\n     apply (metis Sils.simps(1) trace_to_Nil_Sils)\n    apply (metis Vis_Sils trace_to_Nil_Sils)\n    done\n  thus ?thesis\n    by (metis One_nat_def assms length_Cons list.sel(1) list.size(3) that)\nqed\n\nlemma trace_to_single_iff: \"P \\<midarrow>[a]\\<leadsto> P' \\<longleftrightarrow> (\\<exists> m n F. P = Sils m (Vis F) \\<and> a \\<in> pdom F \\<and> F a = Sils n P')\"\n  by (metis trace_of_Sils trace_to_Sils trace_to_Vis trace_to_singleE)\n\nlemma trace_to_Cons [intro]:\n  \"\\<lbrakk> P \\<midarrow>[x]\\<leadsto> P'; P' \\<midarrow>xs\\<leadsto> P'' \\<rbrakk> \\<Longrightarrow> P \\<midarrow>x # xs\\<leadsto> P''\"\n  by force\n\nlemma trace_to_appendE:\n  assumes \"P \\<midarrow>t\\<^sub>1 @ t\\<^sub>2\\<leadsto> Q\"\n  obtains P' where \"P \\<midarrow>t\\<^sub>1\\<leadsto> P'\" \"P' \\<midarrow>t\\<^sub>2\\<leadsto> Q\"\n  using assms by (induct t\\<^sub>1 arbitrary: P, auto, meson trace_to_Cons trace_to_ConsE)\n\nlemma trace_to_trans:\n  \"\\<lbrakk> P \\<midarrow>tr\\<leadsto> P'; P' \\<midarrow>tr'\\<leadsto> P'' \\<rbrakk> \\<Longrightarrow> P \\<midarrow>tr @ tr'\\<leadsto> P''\"\n  apply (induct tr arbitrary: P P' P'' tr')\n   apply (auto elim: trace_to_NilE trace_to_ConsE)\n  apply (meson trace_to_Cons trace_to_ConsE)\n  done  \n\nlemma trace_to_bind_left:\n  assumes \"P \\<midarrow>tr\\<leadsto> P'\"\n  shows \"(P \\<bind> Q) \\<midarrow>tr\\<leadsto> (P' \\<bind> Q)\"\nusing assms proof (induct tr arbitrary: P)\n  case Nil\n  then show ?case\n    by (metis bind_Sils trace_of_Sils trace_to_NilE) \nnext\n  case (Cons a tr)\n  obtain P'' where P'': \"P \\<midarrow>[a]\\<leadsto> P''\" \"P'' \\<midarrow>tr\\<leadsto> P'\"\n    by (meson Cons.prems trace_to_ConsE)\n  with Cons(1)[OF P''(2)] show ?case\n    apply (rule_tac trace_to_Cons)\n     apply (auto)\n    apply (rule trace_to_Sils)\n    apply (rule trace_to_Vis)\n     apply (auto)\n    done    \nqed\n\nlemma trace_to_bind:\n  assumes \"P \\<midarrow>tr\\<leadsto> Ret x\" \"Q x \\<midarrow>tr'\\<leadsto> Q'\"\n  shows \"(P \\<bind> Q) \\<midarrow>tr @ tr'\\<leadsto> Q'\"\nproof -\n  have \"(P \\<bind> Q) \\<midarrow>tr\\<leadsto> (Ret x \\<bind> Q)\"\n    by (meson assms(1) trace_to_bind_left)\n  moreover have \"(Ret x \\<bind> Q) \\<midarrow>tr'\\<leadsto> Q'\"\n    by (auto simp add: assms)\n  ultimately show ?thesis\n    by (simp add: trace_to_trans)\nqed\n\ninductive_cases\n  ttb: \"(P \\<bind> Q) \\<midarrow>tr\\<leadsto> Q'\"\n\nlemma Sil_to_Ret [simp]: \"Sil P \\<midarrow>xs\\<leadsto> Ret x \\<longleftrightarrow> P \\<midarrow>xs\\<leadsto> Ret x\"\n  by (auto)\n\nlemma Sils_to_Ret [simp]: \"Sils n P \\<midarrow>tr\\<leadsto> Ret x \\<longleftrightarrow> P \\<midarrow>tr\\<leadsto> Ret x\"\n  by (induct n, auto)\n\nlemma trace_to_bind_Nil_cases:\n  assumes \n    \"(P \\<bind> Q) \\<midarrow>[]\\<leadsto> Q'\"\n  shows \"(\\<exists> P'. P \\<midarrow>[]\\<leadsto> P' \\<and> Q' = (P' \\<bind> Q)) \n          \\<or> (\\<exists> x. P \\<midarrow>[]\\<leadsto> Ret x \\<and> Q x \\<midarrow>[]\\<leadsto> Q')\"\n  using assms\n  apply (erule_tac ttb)\n    apply (auto)[1]\n  apply (erule bind_SilE)\n  apply (simp)\n  apply (auto)\n  apply (metis bind_Sils_dest trace_of_Sils trace_to_Nil_Sils trace_to_Sil)\n  apply (metis assms bind_Ret trace_to_Nil)\n  done\n\nlemma trace_to_bind_single_cases:\n  assumes \n    \"(P \\<bind> Q) \\<midarrow>[a]\\<leadsto> Q'\"\n  shows \"(\\<exists> P'. P \\<midarrow>[a]\\<leadsto> P' \\<and> (P' \\<bind> Q) = Q') \n          \\<or> (\\<exists> x. P \\<midarrow>[a]\\<leadsto> Ret x \\<and> Q x \\<midarrow>[]\\<leadsto> Q')\n          \\<or> (\\<exists> x. P \\<midarrow>[]\\<leadsto> Ret x \\<and> Q x \\<midarrow>[a]\\<leadsto> Q')\"\n  using assms\n  apply (erule_tac trace_to_singleE)\n    apply (auto)[1]\n  apply (erule bind_SilsE)\n   apply (simp)\n   apply (erule bind_VisE)\n  apply (auto simp add: bind_eq_Some_conv)\n  apply (metis trace_of_Sils trace_to_Sils trace_to_Vis trace_to_bind_Nil_cases)\n  apply (metis trace_to_Nil trace_to_Sils trace_to_Vis)\n  apply (metis (full_types) trace_to_Nil trace_to_Sils trace_to_Vis)\n  done\n\nlemma Vis_Cons_trns [simp]: \"Vis F' \\<midarrow>a # tr\\<leadsto> P' \\<longleftrightarrow> (a \\<in> pdom(F') \\<and> F' a \\<midarrow>tr\\<leadsto> P')\"\n  by (auto)\n\nlemma Ret_trns [simp]: \"Ret x \\<midarrow>tr\\<leadsto> P \\<longleftrightarrow> (tr = [] \\<and> P = Ret x)\"\n  by auto\n\nlemma Sils_Vis_trns [simp]: \"Sils n (Vis F) \\<midarrow>x # xs\\<leadsto> P' \\<longleftrightarrow> (Vis F \\<midarrow>x # xs\\<leadsto> P')\"\n  by (smt (verit, ccfv_threshold) Sils_Vis_inj option.sel trace_to_ConsE trace_to_Sils trace_to_Vis trace_to_singleE)\n\nlemma Sils_Ret_trns [simp]: \"Sils n (Ret x) \\<midarrow>t # ts\\<leadsto> P' \\<longleftrightarrow> False\"\n  by (auto, metis Sils_Vis_not_Ret trace_to_ConsE trace_to_singleE)\n\nlemma trace_to_bind_cases:\n  assumes \n    \"(P \\<bind> Q) \\<midarrow>tr\\<leadsto> Q'\"\n  shows \"(\\<exists> P'. P \\<midarrow>tr\\<leadsto> P' \\<and> Q' = (P' \\<bind> Q)) \n          \\<or> (\\<exists> x tr\\<^sub>1 tr\\<^sub>2. P \\<midarrow>tr\\<^sub>1\\<leadsto> Ret x \\<and> Q x \\<midarrow>tr\\<^sub>2\\<leadsto> Q' \\<and> tr = tr\\<^sub>1 @ tr\\<^sub>2)\"\n  using assms\n  apply (induct tr arbitrary: P Q Q')\n   apply (simp add: trace_to_bind_Nil_cases)\n  apply (erule trace_to_ConsE)\n  apply (auto)\n  apply (erule bind_SilsE)\n  apply (erule bind_VisE)\n  apply (auto simp add: bind_eq_Some_conv)\n  apply (smt (verit) append_Cons append_Nil domI option.sel trace_of_Sils trace_to_Vis trace_to_trans)\n  apply (metis trace_to_Sils trace_to_Vis)\n  apply (metis trace_to_Sils trace_to_Vis)\n  done\n\nlemma trace_to_bindE:\n  assumes \n    \"(P \\<bind> Q) \\<midarrow>tr\\<leadsto> Q'\"\n    \"\\<And> P'. \\<lbrakk> P \\<midarrow>tr\\<leadsto> P'; Q' = (P' \\<bind> Q) \\<rbrakk> \\<Longrightarrow> R\"\n    \"\\<And> x tr\\<^sub>1 tr\\<^sub>2. \\<lbrakk> P \\<midarrow>tr\\<^sub>1\\<leadsto> Ret x; Q x \\<midarrow>tr\\<^sub>2\\<leadsto> Q'; tr = tr\\<^sub>1 @ tr\\<^sub>2 \\<rbrakk> \\<Longrightarrow> R\"\n  shows R\n  using assms(1) assms(2) assms(3) trace_to_bind_cases by blast\n\ntext \\<open> If an interaction tree has terminated, no further interactions are possible. \\<close>\n\nlemma trace_to_Ret_end:\n  \"\\<lbrakk> P \\<midarrow>tr\\<leadsto> Ret x; P \\<midarrow>tr @ [e]\\<leadsto> P' \\<rbrakk> \\<Longrightarrow> False\"\n  by (induct tr arbitrary: P P', auto)\n     (metis Sils_Vis_trns Vis_Cons_trns trace_to_ConsE trace_to_singleE)\n\ntext \\<open> If an event happened beyond a visible choice, then this must have resolved the choice. \\<close>\n\nlemma trace_to_determinstic_choice:\n  \"\\<lbrakk> P \\<midarrow>tr\\<leadsto> Vis F; P \\<midarrow>tr @ [e]\\<leadsto> P' \\<rbrakk> \\<Longrightarrow> e \\<in> pdom(F)\"\n  apply (induct tr arbitrary: P P', auto)\n  apply (metis Sils_Vis_trns Vis_Cons_trns trace_to_ConsE trace_to_singleE)\n  done\n\ntext \\<open> An interaction tree cannot lead to both termination and a visible event. \\<close>\n\nlemma trace_to_Ret_excl_Vis:\n  \"\\<lbrakk> P \\<midarrow>tr\\<leadsto> Ret v; P \\<midarrow>tr\\<leadsto> Vis F \\<rbrakk> \\<Longrightarrow> False\"\n  apply (induct tr arbitrary: P)\n  apply (metis Sils_Vis_not_Ret trace_to_NilE)\n  apply (metis Sils_Vis_trns Vis_Cons_trns trace_to_ConsE trace_to_singleE)\n  done\n\nlemma trace_to_Sil_dest [dest]: \"P \\<midarrow>tr\\<leadsto> \\<tau> P' \\<Longrightarrow> P \\<midarrow>tr\\<leadsto> P'\"\n  by (metis append.right_neutral trace_to_Nil trace_to_Sil trace_to_trans)\n\nlemma trace_to_post_Sil_iff:\n  \"(P \\<bind> \\<tau> \\<circ> \\<checkmark>) \\<midarrow>es\\<leadsto> \\<checkmark> x \\<longleftrightarrow> P \\<midarrow>es\\<leadsto> \\<checkmark> x\"\n  apply (auto)\n   apply (force elim: trace_to_bindE)\n  apply (metis bind_Ret comp_eq_dest_lhs trace_to_Sil_dest trace_to_bind_left)\n  done\n\ntext \\<open> Termination is deterministic. \\<close>\n\nlemma termination_determinsitic: \"\\<lbrakk> P \\<midarrow>tr\\<leadsto> \\<checkmark> x; P \\<midarrow>tr\\<leadsto> \\<checkmark> y \\<rbrakk> \\<Longrightarrow> x = y\"\n  by (induct tr arbitrary: P, auto)\n     (metis Sils_to_Ret Vis_Cons_trns trace_to_ConsE trace_to_singleE)\n\nsubsection \\<open> Initial Events \\<close>\n\ndefinition initev :: \"('e, 's) itree \\<Rightarrow> 'e set\" (\"\\<^bold>I\") where\n\"\\<^bold>I(P) = {e. (\\<exists> P'. P \\<midarrow>[e]\\<leadsto> P')}\"\n\nlemma initev_Sil [simp]: \"\\<^bold>I(Sil P) = \\<^bold>I(P)\"\n  apply (auto simp add: initev_def)\n  apply (metis not_Cons_self2 trace_to_SilE trace_to_single_iff)\n  apply blast\n  done\n\nlemma initev_Sils [simp]: \"\\<^bold>I(Sils n P) = \\<^bold>I(P)\"\n  by (induct n, auto)\n\nlemma initev_Vis [simp]: \"\\<^bold>I(Vis F) = pdom F\"\n  by (auto simp add: initev_def)\n\nlemma initev_Ret [simp]: \"\\<^bold>I(Ret x) = {}\"\n  by (auto simp add: initev_def)\n\nsubsection \\<open> Return Values \\<close>\n\ndefinition retvals :: \"('e, 's) itree \\<Rightarrow> 's set\" (\"\\<^bold>R\") where\n\"\\<^bold>R(P) = {x. \\<exists> es. P \\<midarrow>es\\<leadsto> Ret x}\"\n\nlemma retvals_traceI: \"P \\<midarrow>es\\<leadsto> Ret x \\<Longrightarrow> x \\<in> \\<^bold>R(P)\"\n  by (auto simp add: retvals_def)\n\nabbreviation \"nonterminating P \\<equiv> (\\<^bold>R(P) = {})\"\n\nlemma nonterminates_iff: \"nonterminating P \\<longleftrightarrow> (\\<forall> es x. \\<not> P \\<midarrow>es\\<leadsto> \\<checkmark> x)\"\n  by (auto simp add: retvals_def)\n\nlemma retvals_Ret [simp]: \"\\<^bold>R(Ret x) = {x}\"\n  by (auto simp add: retvals_def)\n\nlemma retvals_Sil [simp]: \"\\<^bold>R(Sil P) = \\<^bold>R(P)\"\n  by (auto simp add: retvals_def)\n\nlemma retvals_Sils [simp]: \"\\<^bold>R(Sils n P) = \\<^bold>R(P)\"\n  by (auto simp add: retvals_def)\n\nlemma retvals_Vis [simp]: \"\\<^bold>R(Vis F) = \\<Union> (\\<^bold>R ` pran(F))\"\n  apply (auto simp add: retvals_def)\n  apply (metis image_eqI itree.distinct(3) pran_pdom trace_to_VisE)\n  apply (metis (no_types, lifting) image_iff pran_pdom trace_to_Vis)\n  done\n\nlemma retvals_bind [simp]: \"\\<^bold>R(P \\<bind> Q) = \\<Union> {\\<^bold>R (Q x)| x. x \\<in> \\<^bold>R(P)}\"\n  apply (auto elim!: trace_to_bindE bind_RetE' simp add: retvals_def)\n  apply (metis mem_Collect_eq trace_to_Nil)\n  apply (meson trace_to_bind)\n  done\n\nsubsection \\<open> Pure ITrees \\<close>\n\ntext \\<open> A pure ITree does not exhibit any visible choices, and therefore cannot be influenced by\n  the environment. \\<close>\n\ndefinition pure_itree :: \"('e, 's) itree \\<Rightarrow> bool\" where\n\"pure_itree P = (\\<forall> tr\\<^sub>0 P'. P \\<midarrow>tr\\<^sub>0\\<leadsto> P' \\<longrightarrow> tr\\<^sub>0 = [])\"\n\nlemma pure_itree_Sil: \"pure_itree (Sil P) = pure_itree P\"\n  by (auto simp add: pure_itree_def)\n\nlemma pure_itree_Ret: \"pure_itree (Ret x)\"\n  by (auto simp add: pure_itree_def)\n\nlemma pure_itree_trace_to:\n  assumes \"pure_itree P\" \"P \\<midarrow>tr\\<leadsto> P'\"\n  shows \"pure_itree P'\"\n  using assms by (auto simp add: pure_itree_def, blast)\n\nlemma pure_itree_Vis: \"pure_itree (Vis F) = (F = {\\<mapsto>})\"\n  by (auto simp add: pure_itree_def)\n     (metis Vis_Cons_trns ex_in_conv pdom_empty_iff_dom_empty trace_to_Nil)\n\nlemma pure_itree_bind: \"pure_itree (P \\<bind> Q) = (pure_itree(P) \\<and> (\\<forall> x\\<in>\\<^bold>R(P). pure_itree (Q x)))\" (is \"?lhs = ?rhs\")\nproof\n  show \"?lhs \\<Longrightarrow> ?rhs\"\n    by (auto simp add: pure_itree_def retvals_def)\n       (meson trace_to_bind_left, meson append_is_Nil_conv trace_to_bind)\n  show \"?rhs \\<Longrightarrow> ?lhs\"\n    by (auto simp add: pure_itree_def retvals_def)\n       (metis append_self_conv2 trace_to_bindE)\nqed\n\nsubsection \\<open> Termination \\<close>\n\nsubsection \\<open> Event Alphabet \\<close>\n\ndefinition evalpha :: \"('e, 's) itree \\<Rightarrow> 'e set\" (\"\\<^bold>A\") where\n\"\\<^bold>A(P) = \\<Union> {set es | es. \\<exists> P'. P \\<midarrow>es\\<leadsto> P'}\"\n\nlemma initev_subset_evalpha: \"\\<^bold>I(P) \\<subseteq> \\<^bold>A(P)\"\n  by (auto simp add: initev_def evalpha_def)\n     (metis list.set_intros(1) trace_to_single_iff)\n\nlemma evalpha_Sil [simp]: \"\\<^bold>A(Sil P) = \\<^bold>A(P)\"\n  by (auto simp add: evalpha_def, metis equals0D set_empty trace_to_SilE)\n\nlemma evalpha_Ret [simp]: \"\\<^bold>A(Ret x) = {}\"\n  by (auto simp add: evalpha_def)\n\nlemma evalpha_Vis [simp]: \"\\<^bold>A(Vis F) = pdom(F) \\<union> (\\<Union> (\\<^bold>A ` pran(F)))\"\n  apply (auto simp add: evalpha_def)\n  apply (metis Vis_Cons_trns image_eqI list.set_cases pran_pdom)\n   apply (metis list.set_intros(1) trace_to_Nil trace_to_Vis)\n  apply (metis (no_types, lifting) imageE list.set_intros(2) pran_pdom trace_to_Vis)\n  done\n\nlemma evalpha_bind: \"\\<^bold>A(P \\<bind> Q) = \\<^bold>A(P) \\<union> \\<Union> {\\<^bold>A (Q x)| x. x \\<in> \\<^bold>R(P)}\"\n  apply (auto elim!: trace_to_bindE bind_RetE' simp add: evalpha_def retvals_def)\n     apply blast\n    apply blast\n   apply (metis trace_to_bind_left)\n  apply (metis (no_types, opaque_lifting) append.assoc bind_Ret in_set_conv_decomp trace_to_bind_left trace_to_trans)\n  done\n\nend", "meta": {"author": "isabelle-utp", "repo": "interaction-trees", "sha": "90510d119364f534d2ab61daf2f274060f0a040e", "save_path": "github-repos/isabelle/isabelle-utp-interaction-trees", "path": "github-repos/isabelle/isabelle-utp-interaction-trees/interaction-trees-90510d119364f534d2ab61daf2f274060f0a040e/Interaction_Trees.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.33486236465043556}}
{"text": "(*  Title:      JinjaThreads/Common/Heap.thy\n    Author:     Andreas Lochbihler\n\n    Reminiscent of the Jinja theory Common/Objects.thy\n*)\n\nsection \\<open>An abstract heap model\\<close>\n\ntheory Heap\nimports \n  Value\nbegin\n\nprimrec typeof :: \"'addr val \\<rightharpoonup> ty\"\nwhere\n  \"typeof  Unit    = Some Void\"\n| \"typeof  Null    = Some NT\"\n| \"typeof (Bool b) = Some Boolean\"\n| \"typeof (Intg i) = Some Integer\"\n| \"typeof (Addr a) = None\"\n\ndatatype addr_loc =\n    CField cname vname\n  | ACell nat\n\nlemma rec_addr_loc [simp]: \"rec_addr_loc = case_addr_loc\"\nby(auto simp add: fun_eq_iff split: addr_loc.splits)\n\nprimrec is_volatile :: \"'m prog \\<Rightarrow> addr_loc \\<Rightarrow> bool\"\nwhere \n  \"is_volatile P (ACell n) = False\"\n| \"is_volatile P (CField D F) = volatile (snd (snd (field P D F)))\"\n\nlocale heap_base =\n  addr_base addr2thread_id thread_id2addr \n  for addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  +\n  fixes spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\nbegin\n\nfun typeof_h :: \"'heap \\<Rightarrow> 'addr val \\<Rightarrow> ty option\"  (\"typeof\\<^bsub>_\\<^esub>\")\nwhere\n  \"typeof\\<^bsub>h\\<^esub> (Addr a) = map_option ty_of_htype (typeof_addr h a)\"\n| \"typeof\\<^bsub>h\\<^esub>  v = typeof v\"\n\ndefinition cname_of :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> cname\"\nwhere \"cname_of h a = the_Class (ty_of_htype (the (typeof_addr h a)))\"\n\ndefinition hext :: \"'heap \\<Rightarrow> 'heap \\<Rightarrow> bool\" (\"_ \\<unlhd> _\" [51,51] 50)\nwhere\n  \"h \\<unlhd> h' \\<equiv> typeof_addr h \\<subseteq>\\<^sub>m typeof_addr h'\"\n\ncontext\n  notes [[inductive_internals]]\nbegin\n\ninductive addr_loc_type :: \"'m prog \\<Rightarrow> 'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> ty \\<Rightarrow> bool\"\n  (\"_,_ \\<turnstile> _@_ : _\" [50, 50, 50, 50, 50] 51)\nfor P :: \"'m prog\" and h :: 'heap and a :: 'addr\nwhere\n  addr_loc_type_field:\n  \"\\<lbrakk> typeof_addr h a = \\<lfloor>U\\<rfloor>; P \\<turnstile> class_type_of U has F:T (fm) in D \\<rbrakk> \n  \\<Longrightarrow> P,h \\<turnstile> a@CField D F : T\"\n\n| addr_loc_type_cell:\n  \"\\<lbrakk> typeof_addr h a = \\<lfloor>Array_type T n'\\<rfloor>; n < n' \\<rbrakk>\n  \\<Longrightarrow> P,h \\<turnstile> a@ACell n : T\"\n\nend\n\ndefinition typeof_addr_loc :: \"'m prog \\<Rightarrow> 'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> ty\"\nwhere \"typeof_addr_loc P h a al = (THE T. P,h \\<turnstile> a@al : T)\"\n\ndefinition deterministic_heap_ops :: bool\nwhere\n  \"deterministic_heap_ops \\<longleftrightarrow>\n  (\\<forall>h ad al v v'. heap_read h ad al v \\<longrightarrow> heap_read h ad al v' \\<longrightarrow> v = v') \\<and>\n  (\\<forall>h ad al v h' h''. heap_write h ad al v h' \\<longrightarrow> heap_write h ad al v h'' \\<longrightarrow> h' = h'') \\<and>\n  (\\<forall>h hT h' a h'' a'. (h', a) \\<in> allocate h hT \\<longrightarrow> (h'', a') \\<in> allocate h hT \\<longrightarrow> h' = h'' \\<and> a = a') \\<and>\n  \\<not> spurious_wakeups\"\n\nend\n\nlemma typeof_lit_eq_Boolean [simp]: \"(typeof v = Some Boolean) = (\\<exists>b. v = Bool b)\"\nby(cases v)(auto)\n\nlemma typeof_lit_eq_Integer [simp]: \"(typeof v = Some Integer) = (\\<exists>i. v = Intg i)\"\nby(cases v)(auto)\n\nlemma typeof_lit_eq_NT [simp]: \"(typeof v = Some NT) = (v = Null)\"\nby(cases v)(auto)\n\nlemma typeof_lit_eq_Void [simp]: \"typeof v = Some Void \\<longleftrightarrow> v = Unit\"\nby(cases v)(auto)\n\nlemma typeof_lit_neq_Class [simp]: \"typeof v \\<noteq> Some (Class C)\"\nby(cases v) auto\n\nlemma typeof_lit_neq_Array [simp]: \"typeof v \\<noteq> Some (Array T)\"\nby(cases v) auto\n\nlemma typeof_NoneD [simp,dest]:\n  \"typeof v = Some x \\<Longrightarrow> \\<not> is_Addr v\"\n  by (cases v) auto\n\nlemma typeof_lit_is_type:\n  \"typeof v = Some T \\<Longrightarrow> is_type P T\"\nby(cases v) auto\n\ncontext heap_base begin\n\nlemma typeof_h_eq_Boolean [simp]: \"(typeof\\<^bsub>h\\<^esub> v = Some Boolean) = (\\<exists>b. v = Bool b)\"\nby(cases v)(auto)\n\nlemma typeof_h_eq_Integer [simp]: \"(typeof\\<^bsub>h\\<^esub> v = Some Integer) = (\\<exists>i. v = Intg i)\"\nby(cases v)(auto)\n\nlemma typeof_h_eq_NT [simp]: \"(typeof\\<^bsub>h\\<^esub> v = Some NT) = (v = Null)\"\nby(cases v)(auto)\n\n\nlemma hextI:\n  \"\\<lbrakk> \\<And>a C. typeof_addr h a = \\<lfloor>Class_type C\\<rfloor> \\<Longrightarrow> typeof_addr h' a = \\<lfloor>Class_type C\\<rfloor>;\n     \\<And>a T n. typeof_addr h a = \\<lfloor>Array_type T n\\<rfloor> \\<Longrightarrow> typeof_addr h' a = \\<lfloor>Array_type T n\\<rfloor> \\<rbrakk>\n  \\<Longrightarrow> h \\<unlhd> h'\"\nunfolding hext_def \nby(rule map_leI)(case_tac v, simp_all)\n\nlemma hext_objD:\n  assumes \"h \\<unlhd> h'\"\n  and \"typeof_addr h a = \\<lfloor>Class_type C\\<rfloor>\"\n  shows \"typeof_addr h' a = \\<lfloor>Class_type C\\<rfloor>\"\nusing assms unfolding hext_def by(auto dest: map_le_SomeD)\n\nlemma hext_arrD:\n  assumes \"h \\<unlhd> h'\" \"typeof_addr h a = \\<lfloor>Array_type T n\\<rfloor>\"\n  shows \"typeof_addr h' a = \\<lfloor>Array_type T n\\<rfloor>\"\nusing assms unfolding hext_def by(blast dest: map_le_SomeD)\n\nlemma hext_refl [iff]: \"h \\<unlhd> h\"\nby (rule hextI) blast+\n\nlemma hext_trans [trans]: \"\\<lbrakk> h \\<unlhd> h'; h' \\<unlhd> h'' \\<rbrakk> \\<Longrightarrow> h \\<unlhd> h''\"\nunfolding hext_def by(rule map_le_trans)\n\nlemma typeof_lit_typeof:\n  \"typeof v = \\<lfloor>T\\<rfloor> \\<Longrightarrow> typeof\\<^bsub>h\\<^esub> v = \\<lfloor>T\\<rfloor>\"\nby(cases v)(simp_all)\n\n\n\nlemma THE_addr_loc_type:\n  \"P,h \\<turnstile> a@al : T \\<Longrightarrow> (THE T. P,h \\<turnstile> a@al : T) = T\"\nby(rule the_equality)(auto dest: addr_loc_type_fun)\n\nlemma typeof_addr_locI [simp]:\n  \"P,h \\<turnstile> a@al : T \\<Longrightarrow> typeof_addr_loc P h a al = T\"\nby(auto simp add: typeof_addr_loc_def dest: addr_loc_type_fun)\n\nlemma deterministic_heap_opsI:\n  \"\\<lbrakk> \\<And>h ad al v v'. \\<lbrakk> heap_read h ad al v; heap_read h ad al v' \\<rbrakk> \\<Longrightarrow> v = v';\n     \\<And>h ad al v h' h''. \\<lbrakk> heap_write h ad al v h'; heap_write h ad al v h'' \\<rbrakk> \\<Longrightarrow> h' = h'';\n     \\<And>h hT h' a h'' a'. \\<lbrakk> (h', a) \\<in> allocate h hT; (h'', a') \\<in> allocate h hT \\<rbrakk> \\<Longrightarrow> h' = h'' \\<and> a = a';\n     \\<not> spurious_wakeups \\<rbrakk>\n  \\<Longrightarrow> deterministic_heap_ops\"\nunfolding deterministic_heap_ops_def by blast\n\nlemma deterministic_heap_ops_readD:\n  \"\\<lbrakk> deterministic_heap_ops; heap_read h ad al v; heap_read h ad al v' \\<rbrakk> \\<Longrightarrow> v = v'\"\nunfolding deterministic_heap_ops_def by blast\n\nlemma deterministic_heap_ops_writeD:\n  \"\\<lbrakk> deterministic_heap_ops; heap_write h ad al v h'; heap_write h ad al v h'' \\<rbrakk> \\<Longrightarrow> h' = h''\"\nunfolding deterministic_heap_ops_def by blast\n\nlemma deterministic_heap_ops_allocateD:\n  \"\\<lbrakk> deterministic_heap_ops; (h', a) \\<in> allocate h hT; (h'', a') \\<in> allocate h hT \\<rbrakk> \\<Longrightarrow> h' = h'' \\<and> a = a'\"\nunfolding deterministic_heap_ops_def by blast\n\nlemma deterministic_heap_ops_no_spurious_wakeups:\n  \"deterministic_heap_ops \\<Longrightarrow> \\<not> spurious_wakeups\"\nunfolding deterministic_heap_ops_def by blast\n\nend\n\nlocale addr_conv =\n  heap_base\n    addr2thread_id thread_id2addr\n    spurious_wakeups\n    empty_heap allocate typeof_addr heap_read heap_write\n  +\n  prog P\n  for addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  and P :: \"'m prog\"\n  +\n  assumes addr2thread_id_inverse: \n  \"\\<lbrakk> typeof_addr h a = \\<lfloor>Class_type C\\<rfloor>; P \\<turnstile> C \\<preceq>\\<^sup>* Thread \\<rbrakk> \\<Longrightarrow> thread_id2addr (addr2thread_id a) = a\"\nbegin\n\nlemma typeof_addr_thread_id2_addr_addr2thread_id [simp]:\n  \"\\<lbrakk> typeof_addr h a = \\<lfloor>Class_type C\\<rfloor>; P \\<turnstile> C \\<preceq>\\<^sup>* Thread \\<rbrakk> \\<Longrightarrow> typeof_addr h (thread_id2addr (addr2thread_id a)) = \\<lfloor>Class_type C\\<rfloor>\"\nby(simp add: addr2thread_id_inverse)\n\nend\n\nlocale heap =\n  addr_conv\n    addr2thread_id thread_id2addr\n    spurious_wakeups\n    empty_heap allocate typeof_addr heap_read heap_write\n    P\n  for addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  and P :: \"'m prog\"\n  +\n  assumes allocate_SomeD: \"\\<lbrakk> (h', a) \\<in> allocate h hT; is_htype P hT \\<rbrakk> \\<Longrightarrow> typeof_addr h' a = Some hT\"\n\n  and hext_allocate: \"\\<And>a. (h', a) \\<in> allocate h hT \\<Longrightarrow> h \\<unlhd> h'\"\n\n  and hext_heap_write:\n  \"heap_write h a al v h' \\<Longrightarrow> h \\<unlhd> h'\"\n\nbegin\n\nlemmas hext_heap_ops = hext_allocate hext_heap_write\n\nlemma typeof_addr_hext_mono:\n  \"\\<lbrakk> h \\<unlhd> h'; typeof_addr h a = \\<lfloor>hT\\<rfloor> \\<rbrakk> \\<Longrightarrow> typeof_addr h' a = \\<lfloor>hT\\<rfloor>\"\nunfolding hext_def by(rule map_le_SomeD)\n\nlemma hext_typeof_mono:\n  \"\\<lbrakk> h \\<unlhd> h'; typeof\\<^bsub>h\\<^esub> v = Some T \\<rbrakk> \\<Longrightarrow> typeof\\<^bsub>h'\\<^esub> v = Some T\"\nby (cases v)(auto intro: typeof_addr_hext_mono)\n\nlemma addr_loc_type_hext_mono:\n  \"\\<lbrakk> P,h \\<turnstile> a@al : T; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> a@al : T\"\nby(force elim!: addr_loc_type.cases intro: addr_loc_type.intros elim: typeof_addr_hext_mono dest: hext_arrD)\n\nlemma type_of_hext_type_of: \\<comment> \\<open>FIXME: What's this rule good for?\\<close>\n  \"\\<lbrakk> typeof\\<^bsub>h\\<^esub> w = \\<lfloor>T\\<rfloor>; hext h h' \\<rbrakk> \\<Longrightarrow> typeof\\<^bsub>h'\\<^esub> w = \\<lfloor>T\\<rfloor>\"\nby(rule hext_typeof_mono)\n\nlemma hext_None: \"\\<lbrakk> h \\<unlhd> h'; typeof_addr h' a = None \\<rbrakk> \\<Longrightarrow> typeof_addr h a = None\"\nby(rule ccontr)(auto dest: typeof_addr_hext_mono)\n\nlemma map_typeof_hext_mono:\n  \"\\<lbrakk> map typeof\\<^bsub>h\\<^esub> vs = map Some Ts; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow>  map typeof\\<^bsub>h'\\<^esub> vs = map Some Ts\"\napply(induct vs arbitrary: Ts)\napply(auto simp add: Cons_eq_map_conv intro: hext_typeof_mono)\ndone\n\nlemma hext_typeof_addr_map_le:\n  \"h \\<unlhd> h' \\<Longrightarrow> typeof_addr h \\<subseteq>\\<^sub>m typeof_addr h'\"\nby(auto simp add: map_le_def dest: typeof_addr_hext_mono)\n\nlemma hext_dom_typeof_addr_subset:\n  \"h \\<unlhd> h' \\<Longrightarrow> dom (typeof_addr h) \\<subseteq> dom (typeof_addr h')\"\nby (metis hext_typeof_addr_map_le map_le_implies_dom_le)\n\nend\n\ndeclare heap_base.typeof_h.simps [code]\ndeclare heap_base.cname_of_def [code]\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Common/Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300698514777, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.3348115355515571}}
{"text": "theory outSumUpData\n\nimports bundle.SB\n  begin\n\ntypedef outSumUp = \"{cout}\"\n  by auto\n\ninstantiation outSumUp::\"{somechan,finite}\"\nbegin\ndefinition \"Rep = Rep_outSumUp\"\ninstance\n  apply(standard)\n  apply(auto simp add: Rep_outSumUp_def cEmpty_def)\n  apply(auto simp add: ctype_empty_iff)\n  using ctype_empty_iff\n  apply (metis Rep_outSumUp cMsg.simps ex_in_conv insertE insert_iff)\n  apply (meson Rep_outSumUp_inject injI) using cMsg.elims Rep_outSumUp apply simp\n  using type_definition.Abs_image type_definition_outSumUp typedef_finite_UNIV by fastforce\nend\n\ndefinition \"SumUpout \\<equiv> Abs_outSumUp cout\"\n\nfree_constructors outSumUp for \"SumUpout\"\n  by (metis(full_types) Abs_outSumUp_cases singletonD)\n\nlemma Andin1_rep [simp]: \"Rep (SumUpout) = cout\"\n  by (simp add: Abs_outSumUp_inverse SumUpout_def Rep_outSumUp_def)\n\nfun outSumUpChan::\"('bool::type \\<Rightarrow> 'a::type) \\<Rightarrow> 'bool \\<Rightarrow> outSumUp \\<Rightarrow> 'a\" where\n\"outSumUpChan Cc1 bool SumUpout = Cc1 bool\"\n\nabbreviation \"buildSumUpoutSBE \\<equiv> outSumUpChan (Untimed o \\<N>)\" \n\nlemma buildsumUpout_ctype: \"buildSumUpoutSBE a c \\<in> ctype (Rep c)\"\n  sorry\n\nlemma buildsumUpout_inj: \"inj buildSumUpoutSBE\"\n  sorry\n\nlemma buildsumUpout_range: \"range (\\<lambda>a. buildSumUpoutSBE a c) = ctype (Rep c)\"\n  sorry\n\nlemma buildsumUpout_surj: assumes \"sbElem_well (Some sbe)\"\n  shows \"sbe \\<in> range buildSumUpoutSBE\"\nproof -\n  have ctypewell:\"\\<And> c. sbe c\\<in> ctype (Rep c)\"\n    using assms by auto\n  hence \"\\<And>c. sbe c \\<in> range (\\<lambda>a. buildSumUpoutSBE a c)\"\n    by (simp add: buildsumUpout_range)\n  hence \"\\<exists>prod. sbe = buildSumUpoutSBE prod\"\n    apply(subst fun_eq_iff,auto)\n    sorry\n  thus ?thesis\n    by auto\nqed\n\nabbreviation \"buildSumUpoutSB \\<equiv> outSumUpChan (Rep_cfun (smap (Untimed o \\<N>)))\" \n\nend", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/demo/sumUp/outSumUpData.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442251064863698, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.33468867895652665}}
{"text": "theory StaticAnalysis\n  imports Core.Semantics Util.MList \"HOL-Library.Monad_Syntax\" HOL.Wellfounded Core.SingleInputTransactions Core.PositiveAccounts Core.Timeout\nbegin\n\n(* Symbolic mock definition *)\n\ntype_synonym SymbolicMonadData = \"int list\"\n\ndatatype 'a Symbolic = Symbolic \"SymbolicMonadData \\<Rightarrow> ('a \\<times> SymbolicMonadData) option\"\n\nprimrec execute :: \"'a Symbolic \\<Rightarrow> SymbolicMonadData \\<Rightarrow> ('a \\<times> SymbolicMonadData) option\" where\n  \"execute (Symbolic f) = f\"\n\ndefinition bind :: \"'a Symbolic \\<Rightarrow> ('a \\<Rightarrow> 'b Symbolic) \\<Rightarrow> 'b Symbolic\" where\n  \"bind m nf =\n      Symbolic (\\<lambda> il. (case execute m il of\n                     Some (r1, s1) \\<Rightarrow> execute (nf r1) s1\n                   | None \\<Rightarrow> None))\"\n\nadhoc_overloading\n  Monad_Syntax.bind StaticAnalysis.bind\n\ndefinition newVar :: \"int Symbolic\" where\n  \"newVar = Symbolic (\\<lambda> st .\n                   case st of\n                     Cons h t \\<Rightarrow> Some (h, t)\n                   | Nil \\<Rightarrow> None )\"\n\ndefinition constrain :: \"bool \\<Rightarrow> unit Symbolic\" where\n  \"constrain val = Symbolic (\\<lambda> st . if val then Some ((), st) else None)\"\n\ndefinition return :: \"'a \\<Rightarrow> 'a Symbolic\" where\n  \"return x = Symbolic (\\<lambda> st . Some (x, st))\"\n\nlemma symbolicConstrain : \"(\\<exists> x. execute (do { a \\<leftarrow> newVar;\n                                               b \\<leftarrow> newVar;\n                                               constrain (c a b);\n                                               return () }) x \\<noteq> None) = (\\<exists> a b. c a b)\"\n  apply (rule iffI)\n  apply (simp add:bind_def add:constrain_def)\n  apply (smt case_prod_beta' execute.simps option.case_eq_if option.distinct(1))\n  apply (auto simp del:bind.simps not_None_eq)\n  subgoal for a b\n    apply(rule exI[of _ \"(Cons a (Cons b Nil))\"])\n    by (simp add:newVar_def bind_def constrain_def return_def)\n  done\n\n\nfun isCounterExample :: \"(bool \\<times> SymbolicMonadData) option \\<Rightarrow> bool\" where\n\"isCounterExample None = False\" |\n\"isCounterExample (Some (b, _)) = b\"\n\nlemma abstract_newVar : \"isCounterExample (execute (newVar \\<bind> (\\<lambda>v. m v)) (Cons h t)) = isCounterExample (execute (m h) t)\"\n  by (auto split:option.splits simp add:bind_def newVar_def)\n\nlemma abstract_constrain : \"isCounterExample (execute (constrain b \\<bind> (\\<lambda>_ . m)) x) = (b \\<and> isCounterExample (execute m x))\"\n  by (auto split:option.splits simp add:bind_def constrain_def)\n\nlemma newVar_failsForNil : \"isCounterExample (execute (newVar \\<bind> (\\<lambda>v. m v)) []) = False\"\n  by (simp add: StaticAnalysis.bind_def newVar_def)\n\nlemma inline_monad : \"((m1 \\<bind> return \\<circ> f) \\<bind> m2) = (m1 \\<bind> m2 \\<circ> f)\"\n  by (auto split:option.splits simp add:bind_def return_def)\n\nlemma inline_monads_ex1 : \"((newVar \\<bind> (\\<lambda>hs. newVar \\<bind> (\\<lambda>ls. constrain (ls \\<le> hs) \\<bind> (\\<lambda>_. return (ls, hs))))) \\<bind> (\\<lambda>(ls, hs). constrain (lPOSIXTime \\<le> ls) \\<bind> (\\<lambda>_. return (ls, hs)))) \\<bind> f =\n                            (newVar \\<bind> (\\<lambda>hs. newVar \\<bind> (\\<lambda>ls. constrain (ls \\<le> hs) \\<bind> (\\<lambda>_. constrain (lPOSIXTime \\<le> ls) \\<bind> (\\<lambda>_. f (ls, hs))))))\"\n  by (auto split:option.splits simp add:bind_def return_def execute_def)\n\nlemma bind_left_unit : \"do { x \\<leftarrow> return a :: int Symbolic; k x } = k a\"\n  apply (auto split:option.splits simp add:bind_def return_def execute_def)\n  by (metis Symbolic.exhaust Symbolic.rec)\n\nlemma bind_right_unit : \"do { x \\<leftarrow> m :: int Symbolic; return x } = m\"\n  apply (simp only:bind_def)\n  apply (cases m)\n  apply simp\n  subgoal for x\n    apply (subst HOL.fun_eq_iff)\n    apply auto\n    subgoal for a\n      apply (cases \"x a\")\n      by (auto simp add:execute_def return_def)\n    done\n  done\n\nlemma bind_assoc : \"do {y \\<leftarrow> do { x \\<leftarrow> m :: int Symbolic; k x }; h y} = do { x \\<leftarrow> m; do { y \\<leftarrow> k x; h y} }\"\n  by (auto split:option.splits simp add:bind_def return_def execute_def)\n\n(* Symbolic semantics definition *)\n\ndatatype SymInput = SymDeposit AccountId Party Token \"int\"\n                  | SymChoice ChoiceId \"int\"\n                  | SymNotify\n\nrecord SymStateRecord = lowTime :: \"int\"\n                        highTime :: \"int\"\n                        traces :: \"(int  \\<times> int \\<times> SymInput option \\<times> int) list\"\n                        paramTrace :: \"(int \\<times> int \\<times> int \\<times> int) list\"\n                        symInput :: \"SymInput option\"\n                        whenPos :: int\n                        symAccounts :: \"((AccountId \\<times> Token) \\<times> int) list\"\n                        symChoices :: \"(ChoiceId \\<times> int) list\"\n                        symBoundValues :: \"(ValueId \\<times> int) list\"\n\ndatatype SymState = SymState SymStateRecord\n\nfunction (sequential) generateSymbolicInterval :: \"int option \\<Rightarrow> (int \\<times> int) Symbolic\" where\n\"generateSymbolicInterval None =\n  do { hs \\<leftarrow> newVar;\n       ls \\<leftarrow> newVar;\n       constrain (ls \\<le> hs);\n       return (ls, hs) }\" |\n\"generateSymbolicInterval (Some ms) =\n  do { (ls, hs) \\<leftarrow> generateSymbolicInterval None;\n       constrain (ls \\<ge> ms);\n       return (ls, hs) }\"\n  by auto\ntermination generateSymbolicInterval\n  apply (relation \"measure (\\<lambda>s . if s = None then 0 else 1)\")\n  by simp_all\n\nfun mkInitialSymState :: \"(int \\<times> int \\<times> int \\<times> int) list \\<Rightarrow> State option \\<Rightarrow> SymState Symbolic\" where\n\"mkInitialSymState pt None = do { (ls, hs) \\<leftarrow> generateSymbolicInterval None;\n                                  return (SymState \\<lparr> lowTime = ls\n                                                   , highTime = hs\n                                                   , traces = Nil\n                                                   , paramTrace = pt\n                                                   , symInput = None\n                                                   , whenPos = 0\n                                                   , symAccounts = Nil\n                                                   , symChoices = Nil\n                                                   , symBoundValues = Nil\n                                                   \\<rparr>) }\" |\n\"mkInitialSymState pt (Some \\<lparr> accounts = accs\n                            , choices = cho\n                            , boundValues = bVal\n                            , minTime = ms \\<rparr>) =\n  do { (ls, hs) \\<leftarrow> generateSymbolicInterval (Some ms);\n       return (SymState \\<lparr> lowTime = ls\n                        , highTime = hs\n                        , traces = Nil\n                        , paramTrace = pt\n                        , symInput = None\n                        , whenPos = 0\n                        , symAccounts = accs\n                        , symChoices = cho\n                        , symBoundValues = bVal \\<rparr>) }\"\n\nfun getSymValFrom :: \"SymInput option \\<Rightarrow> int\" where\n\"getSymValFrom None = 0\" |\n\"getSymValFrom (Some (SymDeposit _ _ _ val)) = val\" |\n\"getSymValFrom (Some (SymChoice _ val)) = val\" |\n\"getSymValFrom (Some SymNotify) = 0\"\n\nfun convertRestToSymbolicTrace :: \"(int \\<times> int \\<times> SymInput option \\<times> int) list \\<Rightarrow>\n                               (int \\<times> int \\<times> int \\<times> int) list \\<Rightarrow> bool\" where\n\"convertRestToSymbolicTrace (Cons (lowS, highS, inp, pos) t) (Cons (a, b, c, d) t2) =\n   ((lowS = a) \\<and> (highS = b) \\<and> (getSymValFrom inp = c) \\<and> (pos = d) \\<and> (convertRestToSymbolicTrace t t2))\" |\n\"convertRestToSymbolicTrace Nil Nil = True\" |\n\"convertRestToSymbolicTrace _ _ = undefined\"\n\nfun isPadding :: \"(int \\<times> int \\<times> int \\<times> int) list \\<Rightarrow> bool\" where\n\"isPadding Nil = True\" |\n\"isPadding (Cons (a, b, c, d) t) = ((a = -1) \\<and> (b = -1) \\<and> (c = -1) \\<and> (d = -1) \\<and> isPadding t)\"\n\nfun convertToSymbolicTrace :: \"(int \\<times> int \\<times> SymInput option \\<times> int) list \\<Rightarrow>\n                               (int \\<times> int \\<times> int \\<times> int) list \\<Rightarrow> bool\" where\n\"convertToSymbolicTrace refL symL =\n   (let lenRefL = length refL;\n        lenSymL = length symL in\n    (if lenRefL \\<le> lenSymL\n     then (let lenPadding = lenSymL - lenRefL in\n           isPadding (take lenPadding symL) \\<and> convertRestToSymbolicTrace refL (drop lenPadding symL))\n     else undefined))\"\n\nfun convertToSymbolicTrace_old :: \"(int \\<times> int \\<times> SymInput option \\<times> int) list \\<Rightarrow>\n                               (int \\<times> int \\<times> int \\<times> int) list \\<Rightarrow> bool\" where\n\"convertToSymbolicTrace_old Nil Nil = True\" |\n\"convertToSymbolicTrace_old Nil (Cons (a, b, c, d) t) =\n   ((a = -1) \\<and> (b = -1) \\<and> (c = -1) \\<and> (d = -1) \\<and> convertToSymbolicTrace_old Nil t)\" |\n\"convertToSymbolicTrace_old (Cons (lowS, highS, inp, pos) t) (Cons (a, b, c, d) t2) =\n   ((lowS = a) \\<and> (highS = b) \\<and> (getSymValFrom inp = c) \\<and> (pos = d) \\<and> convertToSymbolicTrace_old t t2)\" |\n\"convertToSymbolicTrace_old _ _ = undefined\"\n\nfun symEvalVal :: \"Value \\<Rightarrow> SymState \\<Rightarrow> int\" and\n    symEvalObs :: \"Observation \\<Rightarrow> SymState \\<Rightarrow> bool\" where\n\"symEvalVal (AvailableMoney accId tok) (SymState symState) =\n   findWithDefault 0 (accId, tok) (symAccounts symState)\" |\n\"symEvalVal (Constant inte) symState = inte\" |\n\"symEvalVal (NegValue val) symState = - symEvalVal val symState\" |\n\"symEvalVal (AddValue lhs rhs) symState = symEvalVal lhs symState +\n                                          symEvalVal rhs symState\" |\n\"symEvalVal (SubValue lhs rhs) symState = symEvalVal lhs symState -\n                                          symEvalVal rhs symState\" |\n\"symEvalVal (MulValue lhs rhs) symState = symEvalVal lhs symState *\n                                          symEvalVal rhs symState\" |\n\"symEvalVal (DivValue lhs rhs) symState =\n  (let n = symEvalVal lhs symState in\n   let d = symEvalVal rhs symState in\n   if (d = 0)\n   then 0\n   else n quot d)\" |\n\"symEvalVal (ChoiceValue choId) (SymState symState) =\n  findWithDefault 0 choId (symChoices symState)\" |\n\"symEvalVal TimeIntervalStart (SymState symState) = lowTime symState\" |\n\"symEvalVal TimeIntervalEnd (SymState symState) = highTime symState\" |\n\"symEvalVal (UseValue valId) (SymState symState) =\n  findWithDefault 0 valId (symBoundValues symState)\" |\n\"symEvalVal (Cond cond v1 v2) symState = (if symEvalObs cond symState\n                                          then symEvalVal v1 symState\n                                          else symEvalVal v2 symState)\"  |\n\"symEvalObs (AndObs obs1 obs2) symState = (symEvalObs obs1 symState \\<and>\n                                           symEvalObs obs2 symState)\" |\n\"symEvalObs (OrObs obs1 obs2) symState = (symEvalObs obs1 symState \\<or>\n                                          symEvalObs obs2 symState)\" |\n\"symEvalObs (NotObs obs) symState = (\\<not> symEvalObs obs symState)\" |\n\"symEvalObs (ChoseSomething choiceId) (SymState symState) =\n  member choiceId (symChoices symState)\" |\n\"symEvalObs (ValueGE lhs rhs) symState = (symEvalVal lhs symState \\<ge>\n                                          symEvalVal rhs symState)\" |\n\"symEvalObs (ValueGT lhs rhs) symState = (symEvalVal lhs symState >\n                                          symEvalVal rhs symState)\" |\n\"symEvalObs (ValueLT lhs rhs) symState = (symEvalVal lhs symState <\n                                          symEvalVal rhs symState)\" |\n\"symEvalObs (ValueLE lhs rhs) symState = (symEvalVal lhs symState \\<le>\n                                          symEvalVal rhs symState)\" |\n\"symEvalObs (ValueEQ lhs rhs) symState = (symEvalVal lhs symState =\n                                          symEvalVal rhs symState)\" |\n\"symEvalObs TrueObs _ = True\" |\n\"symEvalObs FalseObs _ = False\"\n\nfun updateSymInput :: \"SymInput option \\<Rightarrow> SymState \\<Rightarrow> SymState Symbolic\" where\n\"updateSymInput None symState = return symState\" |\n\"updateSymInput (Some (SymDeposit accId _ tok val)) (SymState symState) =\n  (let resultVal = findWithDefault 0 (accId, tok) (symAccounts symState)\n                    + max 0 val in\n   return (SymState (symState \\<lparr> symAccounts :=\n                                   MList.insert (accId, tok) resultVal\n                                                (symAccounts symState) \\<rparr>)))\" |\n\"updateSymInput (Some (SymChoice choId val)) (SymState symState) =\n  return (SymState (symState \\<lparr> symChoices := MList.insert choId val (symChoices symState) \\<rparr>))\" |\n\"updateSymInput (Some SymNotify) symState =\n  return symState\"\n\nfun addTransaction :: \"int \\<Rightarrow> int \\<Rightarrow> SymInput option \\<Rightarrow> int \\<Rightarrow> SymState \\<Rightarrow> int \\<Rightarrow>\n                       (bool \\<times> SymState) Symbolic\" where\n\"addTransaction newLowTime newHighTime None timeTim\n                (SymState symState) pos =\n (let oldLowTime = lowTime symState in\n  let oldHighTime = highTime symState in\n  let oldTraces = traces symState in\n  let prevSymInp = symInput symState in\n  let oldPos = whenPos symState in\n  do { let tim = timeTim;\n       constrain (newLowTime \\<le> newHighTime);\n       let conditions = (((oldHighTime < tim) \\<or>\n                          ((oldLowTime = newLowTime) \\<and> (oldHighTime = newHighTime))) \\<and>\n                         (newLowTime \\<ge> tim));\n       uSymInput \\<leftarrow> updateSymInput None\n                      (SymState\n                         (symState \\<lparr> lowTime := newLowTime\n                                   , highTime := newHighTime\n                                   , traces := (Cons (oldLowTime, oldHighTime, prevSymInp, oldPos)\n                                                     oldTraces)\n                                   , symInput := None\n                                   , whenPos := pos\n                                   \\<rparr>));\n       return (conditions, uSymInput) })\" |\n\"addTransaction newLowTime newHighTime newSymInput timeTim (SymState symState) pos =\n  (let oldLowTime = lowTime symState in\n   let oldHighTime = highTime symState in\n   let oldTraces = traces symState in\n   let prevSymInp = symInput symState in\n   let oldPos = whenPos symState in\n   do { let tim = timeTim;\n        constrain (newLowTime \\<le> newHighTime);\n        let conditions = ((oldHighTime < tim) \\<and>\n                          (newHighTime < tim) \\<and>\n                          (newLowTime \\<ge> oldLowTime));\n        uSymInput \\<leftarrow> updateSymInput newSymInput\n                      (SymState\n                         (symState \\<lparr> lowTime := newLowTime\n                                   , highTime := newHighTime\n                                   , traces := (Cons (oldLowTime, oldHighTime, prevSymInp, oldPos)\n                                                     oldTraces)\n                                   , symInput := newSymInput\n                                   , whenPos := pos\n                                   \\<rparr>));\n        return (conditions, uSymInput) })\"\n\nfun const :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'a\" where\n\"const x _ = x\"\n\nfun ensureBounds :: \"int \\<Rightarrow> Bound list \\<Rightarrow> bool\" where\n\"ensureBounds cho Nil = False\" |\n\"ensureBounds cho (Cons (Bound lowBnd hiBnd) t) =\n  (((cho \\<ge> lowBnd) \\<and> (cho \\<le> hiBnd)) \\<or> ensureBounds cho t)\"\n\nfun addFreshTimesToState :: \"SymState \\<Rightarrow> (int \\<times> int \\<times> SymState) Symbolic\" where\n\"addFreshTimesToState (SymState sState) =\n  do { newLowTime \\<leftarrow> newVar;\n       newHighTime \\<leftarrow> newVar;\n       return (newLowTime, newHighTime, SymState (sState \\<lparr> lowTime := newLowTime,\n                                                           highTime := newHighTime \\<rparr>))\n     }\"\n\nfun newPreviousMatchDeposit :: \"Value \\<Rightarrow> AccountId \\<Rightarrow> Party \\<Rightarrow> Token \\<Rightarrow>\n                                (SymInput \\<Rightarrow> SymState \\<Rightarrow> bool) \\<Rightarrow>\n                                (SymInput \\<Rightarrow> SymState \\<Rightarrow> bool)\" where\n\"newPreviousMatchDeposit val accId party token previousMatch otherSymInput pmSymState =\n   (let pmConcVal = symEvalVal val pmSymState in\n    case otherSymInput of\n       SymDeposit otherAccId otherParty otherToken otherConcVal \\<Rightarrow>\n         if ((otherAccId = accId) \\<and> (otherParty = party) \\<and> (otherToken = token))\n         then (otherConcVal = pmConcVal) \\<or> previousMatch otherSymInput pmSymState\n         else previousMatch otherSymInput pmSymState\n     | _ \\<Rightarrow> previousMatch otherSymInput pmSymState)\"\n\nfun newPreviousMatchChoice :: \"ChoiceId \\<Rightarrow> Bound list \\<Rightarrow>\n                               (SymInput \\<Rightarrow> SymState \\<Rightarrow> bool) \\<Rightarrow>\n                               (SymInput \\<Rightarrow> SymState \\<Rightarrow> bool)\" where\n\"newPreviousMatchChoice choId bnds previousMatch otherSymInput pmSymState =\n   (case otherSymInput of\n       SymChoice otherChoId otherConcVal \\<Rightarrow>\n         if otherChoId = choId\n         then (ensureBounds otherConcVal bnds \\<or> previousMatch otherSymInput pmSymState)\n         else previousMatch otherSymInput pmSymState\n     | _ \\<Rightarrow> previousMatch otherSymInput pmSymState)\"\n\nfun newPreviousMatchNotify :: \"Observation \\<Rightarrow>\n                               (SymInput \\<Rightarrow> SymState \\<Rightarrow> bool) \\<Rightarrow>\n                               (SymInput \\<Rightarrow> SymState \\<Rightarrow> bool)\" where\n\"newPreviousMatchNotify obs previousMatch otherSymInput pmSymState =\n   (let pmObsRes = symEvalObs obs pmSymState in\n    case otherSymInput of\n       SymNotify \\<Rightarrow> (pmObsRes \\<or> previousMatch otherSymInput pmSymState)\n     | _ \\<Rightarrow> previousMatch otherSymInput pmSymState)\"\n\nfunction (sequential) isValidAndFailsAux :: \"bool \\<Rightarrow> Contract \\<Rightarrow> SymState \\<Rightarrow> bool Symbolic\" and\n     applyInputConditions :: \"int \\<Rightarrow> int \\<Rightarrow> bool \\<Rightarrow> SymInput option \\<Rightarrow> int \\<Rightarrow>\n                             SymState \\<Rightarrow> int \\<Rightarrow> Contract \\<Rightarrow>\n                             (bool \\<times> bool) Symbolic\" and\n    isValidAndFailsWhen :: \"bool \\<Rightarrow> Case list \\<Rightarrow> int \\<Rightarrow> Contract \\<Rightarrow>\n                            (SymInput \\<Rightarrow> SymState \\<Rightarrow> bool) \\<Rightarrow> SymState \\<Rightarrow>\n                            int \\<Rightarrow> bool Symbolic\" where\n\"isValidAndFailsAux hasErr Close (SymState sState) =\n  return (hasErr \\<and> convertToSymbolicTrace (Cons (lowTime sState, highTime sState,\n                                                 symInput sState, whenPos sState)\n                                                (traces sState)) (paramTrace sState))\" |\n\"isValidAndFailsAux hasErr (Pay accId payee tok val cont) (SymState sState) =\n  do { let concVal = symEvalVal val (SymState sState);\n       let originalMoney = findWithDefault 0 (accId, tok) (symAccounts sState);\n       let remainingMoneyInAccount = originalMoney - max 0 concVal;\n       let newAccs = MList.insert (accId, tok) (max 0 remainingMoneyInAccount)\n                                  (symAccounts sState);\n       let finalSState = SymState (sState \\<lparr> symAccounts :=\n             (case payee of\n                 Account destAccId \\<Rightarrow>\n                  MList.insert (destAccId, tok)\n                               (min originalMoney (max 0 concVal)\n                                 + findWithDefault 0 (destAccId, tok) newAccs)\n                               newAccs\n               | _ \\<Rightarrow> newAccs) \\<rparr>);\n       isValidAndFailsAux ((remainingMoneyInAccount < 0)\n                           \\<or> (concVal \\<le> 0)\n                           \\<or> hasErr) cont finalSState\n     }\" |\n\"isValidAndFailsAux hasErr (If obs cont1 cont2) sState =\n  do { let obsVal = symEvalObs obs sState;\n       contVal1 \\<leftarrow> isValidAndFailsAux hasErr cont1 sState;\n       contVal2 \\<leftarrow> isValidAndFailsAux hasErr cont2 sState;\n       return (if obsVal then contVal1 else contVal2)\n     }\" |\n\"isValidAndFailsAux hasErr (When list timeout cont) sState =\n  isValidAndFailsWhen hasErr list timeout cont (const (const False)) sState 1\" |\n\"isValidAndFailsAux hasErr (Let valId val cont) (SymState sState) =\n  do { let concVal = symEvalVal val (SymState sState);\n       let newBVMap = MList.insert valId concVal (symBoundValues sState);\n       let newSState = SymState (sState \\<lparr> symBoundValues := newBVMap \\<rparr>);\n       isValidAndFailsAux ((member valId (symBoundValues sState)) \\<or> hasErr) cont newSState }\" |\n\"isValidAndFailsAux hasErr (Assert obs cont) sState =\n  (let obsVal = symEvalObs obs sState in\n   isValidAndFailsAux (hasErr \\<or> (\\<not> obsVal)) cont sState)\" |\n\"applyInputConditions ls hs hasErr maybeSymInput timeout sState pos cont =\n  do { (newCond, newSState) \\<leftarrow> addTransaction ls hs maybeSymInput timeout sState pos;\n       newTrace \\<leftarrow> isValidAndFailsAux hasErr cont newSState;\n       return (newCond, newTrace) }\" |\n\"isValidAndFailsWhen hasErr Nil timeout cont previousMatch sState pos =\n  do { newLowTime \\<leftarrow> newVar;\n       newHighTime \\<leftarrow> newVar;\n       (cond, newTrace) \\<leftarrow> applyInputConditions newLowTime newHighTime\n                                                hasErr None timeout sState 0 cont;\n       return (if cond then newTrace else False) }\" |\n\"isValidAndFailsWhen hasErr (Cons (Case (Deposit accId party token val) cont) rest)\n                     timeout timCont previousMatch sState pos =\n  do { (newLowTime, newHighTime, sStateWithInput) \\<leftarrow> addFreshTimesToState sState;\n       let concVal = symEvalVal val sStateWithInput;\n       let symInput = SymDeposit accId party token concVal;\n       let clashResult = previousMatch symInput sStateWithInput;\n       let newPreviousMatch = newPreviousMatchDeposit val accId party token previousMatch;\n       (newCond, newTrace) \\<leftarrow> applyInputConditions newLowTime newHighTime\n                                (hasErr \\<or> (concVal \\<le> 0))\n                                (Some symInput) timeout sState pos cont;\n       contTrace \\<leftarrow> isValidAndFailsWhen hasErr rest timeout timCont\n                                        newPreviousMatch sState (pos + 1);\n       return (if (newCond \\<and> (\\<not> clashResult)) then newTrace else contTrace) }\" |\n\"isValidAndFailsWhen hasErr (Cons (Case (Choice choId bnds) cont) rest)\n                     timeout timCont previousMatch sState pos =\n  do { (newLowTime, newHighTime, sStateWithInput) \\<leftarrow> addFreshTimesToState sState;\n       concVal \\<leftarrow> newVar;\n       let symInput = SymChoice choId concVal;\n       let clashResult = previousMatch symInput sStateWithInput;\n       let newPreviousMatch = newPreviousMatchChoice choId bnds previousMatch;\n       (newCond, newTrace)\n                 \\<leftarrow> applyInputConditions newLowTime newHighTime\n                                         hasErr (Some symInput) timeout sState pos cont;\n       contTrace \\<leftarrow> isValidAndFailsWhen hasErr rest timeout timCont\n                                        newPreviousMatch sState (pos + 1);\n       return (if (newCond \\<and> (\\<not> clashResult) \\<and> ensureBounds concVal bnds) then newTrace\n               else contTrace) }\" |\n\"isValidAndFailsWhen hasErr (Cons (Case (Notify obs) cont) rest)\n                     timeout timCont previousMatch sState pos =\n  do { (newLowTime, newHighTime, sStateWithInput) \\<leftarrow> addFreshTimesToState sState;\n       let obsRes = symEvalObs obs sStateWithInput;\n       let symInput = SymNotify;\n       let clashResult = previousMatch symInput sStateWithInput;\n       let newPreviousMatch = newPreviousMatchNotify obs previousMatch;\n       (newCond, newTrace) \\<leftarrow> applyInputConditions newLowTime newHighTime\n                                                   hasErr (Some symInput) timeout sState pos cont;\n       contTrace \\<leftarrow> isValidAndFailsWhen hasErr rest timeout timCont\n                                        newPreviousMatch sState (pos + 1);\n       return (if (newCond \\<and> obsRes \\<and> (\\<not> clashResult)) then newTrace else contTrace) }\"\n  by pat_completeness auto\ntermination isValidAndFailsAux\n  apply (relation \"measure\n                     (\\<lambda> params .\n                         case params of\n                           Inl (_, (c, _)) \\<Rightarrow> (size (c :: Contract)) * 3\n                         | Inr (Inl (_, (_, (_, (_, (_, (_, (_, c)))))))) \\<Rightarrow> (size (c :: Contract) * 3) + 1\n                         | Inr (Inr (_, (cl, (_, (c, _))))) \\<Rightarrow> (size_list size (cl :: Case list)) * 3 + size c * 3 + 2)\")\n  by simp_all\n\nfun wrapper :: \"Contract \\<Rightarrow> (int \\<times> int \\<times> int \\<times> int) list \\<Rightarrow> State option \\<Rightarrow> bool Symbolic\" where\n\"wrapper c st maybeState = do { ess \\<leftarrow> mkInitialSymState st maybeState;\n                                isValidAndFailsAux False c ess }\"\n\nfun hasWarnings :: \"TransactionOutput \\<Rightarrow> bool\" where\n\"hasWarnings (TransactionError _) = False\" |\n\"hasWarnings (TransactionOutput txOutRec) = (Nil \\<noteq> txOutWarnings txOutRec)\"\n\n(* Functions for calculating symbolic variables and output *)\n\ntype_synonym SymVarsOutput = \"int list \\<times> (int \\<times> int \\<times> int \\<times> int) list\"\n\nfun repeat :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a list\" where\n\"repeat 0 x = Nil\" |\n\"repeat (Suc n) x = (Cons x (repeat n x))\"\n\nfun padWithMinusOnes :: \"nat \\<Rightarrow> (int \\<times> int \\<times> int \\<times> int) list \\<Rightarrow> (int \\<times> int \\<times> int \\<times> int) list\" where\n\"padWithMinusOnes n l = repeat (n - length l) (-1, -1, -1, -1) @ l\"\n\nfun combineOutputs :: \"nat \\<Rightarrow> (int \\<times> int \\<times> int \\<times> int) list list \\<Rightarrow> (int \\<times> int \\<times> int \\<times> int) list\" where\n\"combineOutputs execBranch l = padWithMinusOnes (fold max (map length l) 0) (l ! execBranch)\"\n\nfun combineSymVarsOutput :: \"nat \\<Rightarrow> SymVarsOutput list \\<Rightarrow> SymVarsOutput\" where\n\"combineSymVarsOutput executionBranch symVarsOutput =\n   (concat (map fst symVarsOutput), combineOutputs executionBranch (map snd symVarsOutput))\"\n\nfun calculateSymVars_mkInitialSymState :: \"int \\<Rightarrow> int \\<Rightarrow> State option \\<Rightarrow> SymState \\<times> SymVarsOutput\" where\n\"calculateSymVars_mkInitialSymState ls hs None =\n  (SymState \\<lparr> lowTime = ls\n            , highTime = hs\n            , traces = Nil\n            , paramTrace = Nil\n            , symInput = None\n            , whenPos = 0\n            , symAccounts = Nil\n            , symChoices = Nil\n            , symBoundValues = Nil\n            \\<rparr>, ([hs, ls], []))\" |\n\"calculateSymVars_mkInitialSymState ls hs (Some \\<lparr> accounts = accs\n                                                , choices = cho\n                                                , boundValues = bVal\n                                                , minTime = ms \\<rparr>) =\n  (SymState \\<lparr> lowTime = max ms ls\n            , highTime = hs\n            , traces = Nil\n            , paramTrace = Nil\n            , symInput = None\n            , whenPos = 0\n            , symAccounts = accs\n            , symChoices = cho\n            , symBoundValues = bVal \\<rparr>, ([hs, ls], []))\"\n\nfun calculateSymVars_updateSymInput :: \"SymInput option \\<Rightarrow> SymState \\<Rightarrow> SymState\" where\n\"calculateSymVars_updateSymInput None symState = symState\" |\n\"calculateSymVars_updateSymInput (Some (SymDeposit accId _ tok val)) (SymState symState) =\n  (let resultVal = findWithDefault 0 (accId, tok) (symAccounts symState)\n                    + max 0 val in\n   SymState (symState \\<lparr> symAccounts :=\n                            MList.insert (accId, tok) resultVal\n                                         (symAccounts symState) \\<rparr>))\" |\n\"calculateSymVars_updateSymInput (Some (SymChoice choId val)) (SymState symState) =\n  SymState (symState \\<lparr> symChoices := MList.insert choId val (symChoices symState) \\<rparr>)\" |\n\"calculateSymVars_updateSymInput (Some SymNotify) symState =\n  symState\"\n\nfun calculateSymVars_addTransaction :: \"int \\<Rightarrow> int \\<Rightarrow> SymInput option \\<Rightarrow> SymState \\<Rightarrow> int \\<Rightarrow>\n                                        SymState\" where\n\"calculateSymVars_addTransaction newLowTime newHighTime None\n                (SymState symState) pos =\n  (let uSymInput = calculateSymVars_updateSymInput None\n                      (SymState\n                         (symState \\<lparr> lowTime := newLowTime\n                                   , highTime := newHighTime\n                                   , symInput := None\n                                   , whenPos := pos\n                                   \\<rparr>)) in\n   uSymInput)\" |\n\"calculateSymVars_addTransaction newLowTime newHighTime newSymInput (SymState symState) pos =\n  (let uSymInput = calculateSymVars_updateSymInput newSymInput\n                      (SymState\n                         (symState \\<lparr> lowTime := newLowTime\n                                   , highTime := newHighTime\n                                   , symInput := newSymInput\n                                   , whenPos := pos\n                                   \\<rparr>)) in\n   uSymInput)\"\n\nfun firstMatchesSymInput :: \"SymInput \\<Rightarrow> Transaction \\<Rightarrow> bool\" where\n\"firstMatchesSymInput sInput transaction =\n  (case inputs transaction of\n     Nil \\<Rightarrow> False\n   | Cons h t \\<Rightarrow> (case sInput of\n                     SymDeposit accId party token amount \\<Rightarrow> (h = IDeposit accId party token amount)\n                   | SymChoice choId cho \\<Rightarrow> (h = IChoice choId cho)\n                   | SymNotify \\<Rightarrow> (h = INotify)))\"\n\nfun addSymVars :: \"int list \\<Rightarrow> SymVarsOutput \\<Rightarrow> SymVarsOutput\" where\n\"addSymVars l (vars, transactions) = (l @ vars, transactions)\"\n\nfun getFirstChoice :: \"Transaction \\<Rightarrow> ChosenNum option\" where\n\"getFirstChoice tra =\n   (case inputs tra of\n      Cons (IChoice _ v) _ \\<Rightarrow> Some v\n    | _ \\<Rightarrow> None)\"\n\nfun isValidChoice :: \"ChoiceId \\<Rightarrow> Bound list \\<Rightarrow> Transaction \\<Rightarrow> bool\" where\n\"isValidChoice choId bounds tra =\n  (case inputs tra of\n     Cons (IChoice traChoId traCho) _ \\<Rightarrow> ((traChoId = choId) \\<and> (inBounds traCho bounds))\n   | _ \\<Rightarrow> False)\"\n\nfunction (sequential)\n    calculateSymVars_isValidAndFailsAux :: \"Transaction \\<Rightarrow> Transaction list \\<Rightarrow> Contract \\<Rightarrow> SymState \\<Rightarrow> SymVarsOutput\"  and\n    calculateSymVars_applyInputConditions :: \"Transaction \\<Rightarrow> Transaction list \\<Rightarrow> int \\<Rightarrow> int \\<Rightarrow> SymInput option \\<Rightarrow>\n                                              SymState \\<Rightarrow> int \\<Rightarrow> Contract \\<Rightarrow>\n                                              SymVarsOutput\" and\n    calculateSymVars_isValidAndFailsWhen :: \"Transaction \\<Rightarrow> Transaction list \\<Rightarrow> Case list \\<Rightarrow> int \\<Rightarrow> Contract \\<Rightarrow>\n                                             SymState \\<Rightarrow> int \\<Rightarrow> SymVarsOutput\" where\n\"calculateSymVars_isValidAndFailsAux tra traList Close (SymState symState) =\n   ([], [(lowTime symState, highTime symState,\n          getSymValFrom (symInput symState), whenPos symState)])\" |\n\"calculateSymVars_isValidAndFailsAux tra traList (Pay accId payee tok val cont) (SymState symState) =\n   (let concVal = symEvalVal val (SymState symState);\n        originalMoney = findWithDefault 0 (accId, tok) (symAccounts symState);\n        remainingMoneyInAccount = originalMoney - max 0 concVal;\n        newAccs = MList.insert (accId, tok) (max 0 remainingMoneyInAccount)\n                               (symAccounts symState);\n        finalSState = SymState (symState \\<lparr> symAccounts :=\n         (case payee of\n             Account destAccId \\<Rightarrow>\n              MList.insert (destAccId, tok)\n                           (min originalMoney (max 0 concVal)\n                             + findWithDefault 0 (destAccId, tok) newAccs)\n                           newAccs\n           | _ \\<Rightarrow> newAccs) \\<rparr>) in\n    calculateSymVars_isValidAndFailsAux tra traList cont finalSState)\" |\n\"calculateSymVars_isValidAndFailsAux tra traList (If obs cont1 cont2) symState =\n   (let obsVal = symEvalObs obs symState;\n        contVal1 = calculateSymVars_isValidAndFailsAux tra traList cont1 symState;\n        contVal2 = calculateSymVars_isValidAndFailsAux tra traList cont2 symState in\n    combineSymVarsOutput (if obsVal then 0 else 1) [contVal1, contVal2])\" |\n\"calculateSymVars_isValidAndFailsAux tra traList (When list timeout cont) sState =\n  calculateSymVars_isValidAndFailsWhen tra traList list timeout cont sState 1\" |\n\"calculateSymVars_isValidAndFailsAux tra traList (Let valId val cont) (SymState symState) =\n   (let concVal = symEvalVal val (SymState symState);\n        newBVMap = MList.insert valId concVal (symBoundValues symState);\n        newSymState = SymState (symState \\<lparr> symBoundValues := newBVMap \\<rparr>) in\n    calculateSymVars_isValidAndFailsAux tra traList cont newSymState)\" |\n\"calculateSymVars_isValidAndFailsAux tra traList (Assert obs cont) symState =\n   calculateSymVars_isValidAndFailsAux tra traList cont symState\" |\n\"calculateSymVars_applyInputConditions tra traList ls hs maybeSymInput (SymState symState) pos cont =\n  (let newSState = calculateSymVars_addTransaction ls hs maybeSymInput (SymState symState) pos;\n       oldLowTime = lowTime symState;\n       oldHighTime = highTime symState;\n       oldSymInp = symInput symState;\n       oldPos = whenPos symState;\n       (symVars, symOutput) = calculateSymVars_isValidAndFailsAux tra traList cont newSState\n   in (symVars, symOutput @ [(oldLowTime, oldHighTime, getSymValFrom oldSymInp, oldPos)]))\" |\n\n\"calculateSymVars_isValidAndFailsWhen tra traList Nil timeout cont symState pos =\n   (let (low, high) = interval tra in\n    if low \\<ge> timeout\n    then addSymVars [low, high] (calculateSymVars_applyInputConditions tra traList low high None symState 0 cont)\n    else (case traList of\n            Nil \\<Rightarrow> addSymVars [0, 0] (calculateSymVars_applyInputConditions tra traList 0 0 None symState 0 cont)\n          | Cons h t \\<Rightarrow> let (newLow, newHigh) = interval h in\n                        addSymVars [newLow, newHigh] (calculateSymVars_applyInputConditions h t newLow newHigh None symState 0 cont)))\" |\n\"calculateSymVars_isValidAndFailsWhen tra traList (Cons (Case (Deposit accId party token val) cont) rest)\n                     timeout timCont (SymState symState) pos =\n       (let (low, high) = interval tra;\n            concVal = symEvalVal val (SymState symState);\n            sInput = SymDeposit accId party token concVal;\n            (newTra, newTraList) = if (high < timeout \\<and> firstMatchesSymInput sInput tra)\n                                   then (tra, traList)\n                                   else (case traList of\n                                           Nil \\<Rightarrow> (tra, traList)\n                                         | (Cons h t) \\<Rightarrow> (h, t));\n            (newLowTime, newHighTime) = interval newTra;\n            symStateWithInput = SymState (symState \\<lparr> lowTime := newLowTime,\n                                                     highTime := newHighTime \\<rparr>);\n            newConcVal = symEvalVal val symStateWithInput;\n            newSInput = SymDeposit accId party token newConcVal;\n            newCond = newHighTime < timeout \\<and> firstMatchesSymInput newSInput newTra;\n            newTrace = calculateSymVars_applyInputConditions newTra newTraList newLowTime newHighTime\n                                         (Some newSInput) (SymState symState) pos cont;\n            contTrace = calculateSymVars_isValidAndFailsWhen tra traList rest timeout timCont\n                                                             (SymState symState) (pos + 1) in\n       addSymVars [newLowTime, newHighTime] (combineSymVarsOutput (if newCond then 0 else 1) [newTrace, contTrace]))\" |\n\"calculateSymVars_isValidAndFailsWhen tra traList (Cons (Case (Choice choId bnds) cont) rest)\n                     timeout timCont (SymState symState) pos =\n       (let (low, high) = interval tra;\n            (newTra, newTraList) = if (high < timeout \\<and> isValidChoice choId bnds tra)\n                                   then (tra, traList)\n                                   else (case traList of\n                                           Nil \\<Rightarrow> (tra, traList)\n                                         | (Cons h t) \\<Rightarrow> (h, t));\n            (newLowTime, newHighTime) = interval newTra;\n            newConcVal = case getFirstChoice newTra of\n                           None \\<Rightarrow> 0\n                         | Some x \\<Rightarrow> x;\n            newSInput = SymChoice choId newConcVal;\n            newCond = newHighTime < timeout \\<and> isValidChoice choId bnds newTra;\n            newTrace = calculateSymVars_applyInputConditions newTra newTraList newLowTime newHighTime\n                                         (Some newSInput) (SymState symState) pos cont;\n            contTrace = calculateSymVars_isValidAndFailsWhen tra traList rest timeout timCont\n                                                             (SymState symState) (pos + 1) in\n       addSymVars [newLowTime, newHighTime, newConcVal] (combineSymVarsOutput (if newCond then 0 else 1) [newTrace, contTrace]))\" |\n\"calculateSymVars_isValidAndFailsWhen tra traList (Cons (Case (Notify obs) cont) rest)\n                     timeout timCont (SymState symState) pos =\n       (let (low, high) = interval tra;\n            sInput = SymNotify;\n            obsRes = symEvalObs obs (SymState symState);\n            (newTra, newTraList) = if (high < timeout \\<and> obsRes)\n                                   then (tra, traList)\n                                   else (case traList of\n                                           Nil \\<Rightarrow> (tra, traList)\n                                         | (Cons h t) \\<Rightarrow> (h, t));\n            (newLowTime, newHighTime) = interval newTra;\n            symStateWithInput = SymState (symState \\<lparr> lowTime := newLowTime,\n                                                     highTime := newHighTime \\<rparr>);\n            newSInput = SymNotify;\n            newObsRes = symEvalObs obs symStateWithInput;\n            newCond = newHighTime < timeout \\<and> firstMatchesSymInput newSInput newTra;\n            newTrace = calculateSymVars_applyInputConditions newTra newTraList newLowTime newHighTime\n                                         (Some newSInput) (SymState symState) pos cont;\n            contTrace = calculateSymVars_isValidAndFailsWhen tra traList rest timeout timCont\n                                                             (SymState symState) (pos + 1) in\n       addSymVars [newLowTime, newHighTime] (combineSymVarsOutput (if newCond then 0 else 1) [newTrace, contTrace]))\"\n  by pat_completeness auto\ntermination calculateSymVars_isValidAndFailsAux\n  apply (relation \"measure\n                     (\\<lambda> params .\n                         case params of\n                           Inl (_, (_, (c, _))) \\<Rightarrow> (size (c :: Contract)) * 3\n                         | Inr (Inl (_, (_, (_, (_, (_, (_, (_, c)))))))) \\<Rightarrow> (size (c :: Contract) * 3) + 1\n                         | Inr (Inr (_, (_, (cl, (_, (c, _)))))) \\<Rightarrow> (size_list size (cl :: Case list)) * 3 + size c * 3 + 2)\")\n  by simp_all\n\nfun calculateSymVars :: \"State option \\<Rightarrow> Transaction list \\<Rightarrow> Contract \\<Rightarrow> SymVarsOutput\" where\n\"calculateSymVars state (Cons h t) cont =\n  (let (low, high) = interval h;\n       (symState, symVars) = calculateSymVars_mkInitialSymState low high state in\n       combineSymVarsOutput 1 [symVars, calculateSymVars_isValidAndFailsAux h t cont symState])\" |\n\"calculateSymVars state Nil cont = ([], [])\"\n\n(* Test1 for calculateSymVars *)\n\ndefinition role_alice :: Party where\n\"role_alice = Role (BS ''alice'')\"\n\ndefinition role_bob :: Party where\n\"role_bob = Role (BS ''bob'')\"\n\ndefinition role_carol :: Party where\n\"role_carol = Role (BS ''carol'')\"\n\ndefinition token_ada :: Token where\n\"token_ada = Token (BS '''') (BS '''')\"\n\ndefinition choice_choice :: ChoiceName where\n\"choice_choice = BS ''1''\"\n\ndefinition badEscrow_aux :: Contract where\n\"badEscrow_aux = (When [\n                  (Case\n                     (Choice\n                        (ChoiceId choice_choice\n                           role_alice) [\n                        (Bound 0 1)])\n                     (When [\n                        (Case\n                           (Choice\n                              (ChoiceId choice_choice\n                                 role_bob) [\n                              (Bound 0 1)])\n                           (If\n                              (ValueEQ\n                                 (ChoiceValue\n                                    (ChoiceId choice_choice\n                                       role_alice))\n                                 (ChoiceValue\n                                    (ChoiceId choice_choice\n                                       role_bob)))\n                              (If\n                                 (ValueEQ\n                                    (ChoiceValue\n                                       (ChoiceId choice_choice\n                                          role_alice))\n                                    (Constant 0))\n                                 (Pay\n                                    role_alice\n                                    (Party\n                                       role_bob)\n                                    token_ada\n                                    (Constant 450) Close) Close)\n                              (When [\n                                    (Case\n                                       (Choice\n                                          (ChoiceId choice_choice\n                                             role_carol) [\n                                          (Bound 1 1)]) Close)\n                                    ,\n                                    (Case\n                                       (Choice\n                                          (ChoiceId choice_choice\n                                             role_carol) [\n                                          (Bound 0 0)])\n                                       (Pay\n                                          role_alice\n                                          (Party\n                                             role_bob)\n                                          token_ada\n                                          (Constant 451) Close))] 100 Close)))] 60\n                        (When [\n                              (Case\n                                 (Choice\n                                    (ChoiceId choice_choice\n                                       role_carol) [\n                                    (Bound 1 1)]) Close)\n                              ,\n                              (Case\n                                 (Choice\n                                    (ChoiceId choice_choice\n                                       role_carol) [\n                                    (Bound 0 0)])\n                                 (Pay\n                                    role_alice\n                                    (Party\n                                       role_bob)\n                                    token_ada\n                                    (Constant 450) Close))] 100 Close)))] 40\n                  (When [\n                        (Case\n                           (Choice\n                              (ChoiceId choice_choice\n                                 role_carol) [\n                              (Bound 1 1)]) Close)\n                        ,\n                        (Case\n                           (Choice\n                              (ChoiceId choice_choice\n                                 role_carol) [\n                              (Bound 0 0)])\n                           (Pay\n                              role_alice\n                              (Party\n                                 role_bob)\n                              token_ada\n                              (Constant 450) Close))] 100 Close))\"\n\ndefinition badEscrow :: Contract where\n\"badEscrow = When [\n            (Case\n               (Deposit\n                  role_alice\n                  role_alice\n                  token_ada\n                  (Constant 450))\n               badEscrow_aux)] 10 Close\"\n\ndefinition badEscrowOffendingTrace :: \"Transaction list\" where\n\"badEscrowOffendingTrace = [ \\<lparr> interval = (2, 3)\n                             , inputs = [IDeposit role_alice role_alice token_ada 450]\n                             \\<rparr>\n                           , \\<lparr> interval = (4, 5)\n                             , inputs = [IChoice (ChoiceId choice_choice role_alice) 0]\n                             \\<rparr>\n                           , \\<lparr> interval = (6, 7)\n                             , inputs = [IChoice (ChoiceId choice_choice role_bob) 1]\n                             \\<rparr>\n                           , \\<lparr> interval = (8, 9)\n                             , inputs = [IChoice (ChoiceId choice_choice role_carol) 0]\n                             \\<rparr>\n                           ]\"\n\nvalue \"calculateSymVars (Some (emptyState 0)) badEscrowOffendingTrace badEscrow\"\n\nvalue \"execute (wrapper badEscrow [(8, 9, 0, 2), (6, 7, 1, 1), (4, 5, 0, 1), (2, 3, 450, 1), (2, 3, 0, 0)]\n                        (Some (emptyState 0))) [3, 2, 2, 3, 4, 5, 0, 6, 7, 1, 8, 9, 0, 8, 9, 0, 8, 9, 6, 7, 8, 9, 0, 8, 9, 0, 8, 9, 4, 5, 6, 7, 1, 6, 7, 1, 6, 7, 4, 5]\"\n\n(* Invariants of symbolic execution *)\nfun symStateToState :: \"SymState \\<Rightarrow> State\" where\n\"symStateToState (SymState symState) =\n   \\<lparr> accounts = symAccounts symState\n   , choices = symChoices symState\n   , boundValues = symBoundValues symState\n   , minTime = lowTime symState \\<rparr>\"\n\nfun symStateToEnv :: \"SymState \\<Rightarrow> Environment\" where\n\"symStateToEnv (SymState symState) = \\<lparr> timeInterval = (lowTime symState, highTime symState) \\<rparr>\"\n\nlemma symEval_eval_equivalence : \"symEvalVal val symState = evalValue (symStateToEnv symState) (symStateToState symState) val\"\n                                 \"symEvalObs obs symState = evalObservation (symStateToEnv symState) (symStateToState symState) obs\"\n  apply (induction val symState and obs symState rule:symEvalVal_symEvalObs.induct)\n  by simp_all\n\nlemma closeContractRemains_reduceContractUntilQuiescent : \"reduceContractUntilQuiescent env fixSta Close = ContractQuiescent reduced reduceWarns pays curState cont \\<Longrightarrow> cont = Close\"\n  by (simp add: reduceClose_is_Close)\n\nlemma closeContractRemains_applyAllLoop : \"applyAllLoop reduced env fixSta Close inps warn pay = ApplyAllSuccess newReduced newWarn newPay newState cont \\<Longrightarrow> cont = Close\"\n  apply (simp only:applyAllLoop.simps[of reduced env fixSta \"Close\" inps warn pay])\n  apply (cases \"reduceContractUntilQuiescent env fixSta Close\")\n  subgoal for reduceWarns pays curState cont\n    apply (simp only:refl ReduceResult.case)\n    apply (induction inps)\n    apply (simp add: reduceClose_is_Close)\n    using reduceClose_is_Close by fastforce\n  by simp\n\nlemma closeContractRemains : \"validAndPositive_state st \\<Longrightarrow>\n                       computeTransaction inps st Close = TransactionOutput \\<lparr>txOutWarnings = newWarns, txOutPayments = newPays, txOutState = newSta, txOutContract = newCont\\<rparr> \\<Longrightarrow> newCont = Close\"\n  apply (simp del:validAndPositive_state.simps)\n  apply (cases \"fixInterval (interval inps) st\")\n  apply (simp only:refl IntervalResult.case)\n  subgoal for env fixSta\n    apply (cases \"applyAllInputs env fixSta Close (inputs inps)\")\n    subgoal for warnings payments newState cont\n      apply (simp only:refl ApplyAllResult.case)\n      by (metis TransactionOutput.distinct(1) TransactionOutput.inject(1) TransactionOutputRecord.ext_inject applyAllInputs.simps closeContractRemains_applyAllLoop)\n    by simp_all\n  apply (simp only:refl IntervalResult.case)\n  by simp\n\nlemma noCounterExamplePropagatesComputeEmptyTransaction_Close : \"\\<not> isCounterExample (execute (wrapper Close t (Some sta)) x)\"\n  apply simp\n  apply (auto split:option.splits prod.splits simp add:bind_def)\n  subgoal for a b\n    apply (cases a)\n    by (simp add:return_def)\n  done\n\nfun isNonPositivePay :: \"Environment \\<Rightarrow> State \\<Rightarrow> Value \\<Rightarrow> bool\" where\n\"isNonPositivePay env state val = (evalValue env state val \\<le> 0)\"\n\nfun isPartialPay :: \"Environment \\<Rightarrow> State \\<Rightarrow> AccountId \\<Rightarrow> Token \\<Rightarrow> Value \\<Rightarrow> bool\" where\n\"isPartialPay env state accId tok val = (moneyInAccount accId tok (accounts state) < evalValue env state val)\"\n\nlemma reductionLoop_keepsWarnings : \"reductionLoop reduced env state contract warnings effects = ContractQuiescent newReduced reduceWarns reduceEffects reduceState reduceNewContract \\<Longrightarrow> \\<exists>suff. reduceWarns = (rev warnings) @ suff\"\n  apply (induction reduced env state contract warnings effects arbitrary: newReduced reduceWarns reduceEffects reduceState reduceNewContract rule:reductionLoop.induct)\n  subgoal for reduced env state contract warnings payments newReduced reduceWarns reduceEffects reduceState reduceNewContract\n    apply (subst (asm) (2) reductionLoop.simps)\n    apply (cases \"reduceContractStep env state contract\")\n    subgoal for stepWarns stepEffects stepState stepNewContract\n      apply (simp only:refl ReduceStepResult.case Let_def)\n      by fastforce\n     apply auto[1]\n    by simp\n  done\n\nlemma onceAWarningAlwaysAWarning_reductionLoop_reduceContractStep : \"reduceContractStep env state contract = Reduced warnings effects newState newContract \\<Longrightarrow>\n                                                                     reductionLoop reduced env state contract wa ef = ContractQuiescent newReduced reduceWarns reduceEffects reduceState reduceNewContract \\<Longrightarrow>\n                                                                     warnings \\<noteq> ReduceNoWarning \\<Longrightarrow> reduceWarns \\<noteq> []\"\n  apply (simp only: reductionLoop.simps)\n  apply (cases \"reduceContractStep env state contract\")\n  subgoal for redStepwarning redStepEffect redStepState redStepContract\n    apply (simp only:Let_def refl ReduceStepResult.case)\n    using reductionLoop_keepsWarnings by fastforce\n   apply simp\n  by simp\n\nlemma onceAWarningAlwaysAWarning_reductionLoop_reduceContractStep_plus_aux : \"warnings \\<noteq> ReduceNoWarning \\<Longrightarrow>\n                                                                              reduceWarns = warnings # suff \\<Longrightarrow>\n                                                                              convertReduceWarnings reduceWarns \\<noteq> []\"\n  apply (induction suff arbitrary:reduceWarns)\n  apply (cases warnings)\n  apply simp_all\n  subgoal for a suff reduceWarns\n  apply (cases warnings)\n  by simp_all\n  done\n\nlemma onceAWarningAlwaysAWarning_reductionLoop_reduceContractStep_plus_aux2 : \"warnings = i @ [l] \\<Longrightarrow> l \\<noteq> ReduceNoWarning \\<Longrightarrow>\n                                                                              reduceWarns = warnings @ suff \\<Longrightarrow>\n                                                                              convertReduceWarnings reduceWarns \\<noteq> []\"\n  apply (induction i arbitrary:reduceWarns warnings l suff)\n  apply (simp add: onceAWarningAlwaysAWarning_reductionLoop_reduceContractStep_plus_aux)\n  by (metis append_Cons convertReduceWarnings.simps(2) onceAWarningAlwaysAWarning_reductionLoop_reduceContractStep_plus_aux)\n\nlemma onceAWarningAlwaysAWarning_reductionLoop_reduceContractStep_plus : \"reduceContractStep env state contract = Reduced warnings effects newState newContract \\<Longrightarrow>\n                                                                          reductionLoop reduced env state contract wa ef = ContractQuiescent newReduced reduceWarns reduceEffects reduceState reduceNewContract \\<Longrightarrow>\n                                                                          warnings \\<noteq> ReduceNoWarning \\<Longrightarrow> convertReduceWarnings reduceWarns \\<noteq> []\"\n  apply (simp only: reductionLoop.simps)\n  apply (cases \"reduceContractStep env state contract\")\n  subgoal for redStepwarning redStepEffect redStepState redStepContract\n    apply (simp only:Let_def refl ReduceStepResult.case if_False)\n    apply (subgoal_tac \"\\<exists>suff. reduceWarns = (rev ([warnings] @ wa)) @ suff\")\n    using onceAWarningAlwaysAWarning_reductionLoop_reduceContractStep_plus_aux2 apply auto[1]\n    apply (rule reductionLoop_keepsWarnings)\n    by simp\n  by simp_all\n\nlemma onceAWarningAlwaysAWarning_applyAllLoop_reduceContractStep : \"reduceContractStep env st c = Reduced warnings effects newState newContract \\<Longrightarrow>\n                                                                    applyAllLoop reduced env st c inp wa ef = ApplyAllSuccess newReduced applyWarnings applyEffects applyNewState applyNewContract \\<Longrightarrow>\n                                                                    warnings \\<noteq> ReduceNoWarning \\<Longrightarrow> applyWarnings \\<noteq> []\"\n  apply (subst (asm) applyAllLoop.simps[of reduced env st c inp wa ef])\n  apply (subst (asm) reduceContractUntilQuiescent.simps)\n  apply (cases \"reductionLoop False env st c [] []\")\n  apply (simp only:refl ReduceResult.case)\n  apply (cases inp)\n  using onceAWarningAlwaysAWarning_reductionLoop_reduceContractStep_plus apply auto[1]\n  apply (simp only:refl list.case)\n  subgoal for newReduced reduceWarns reduceEffects reduceState reduceNewContract h t\n    apply (cases \"applyInput env reduceState h reduceNewContract\")\n    apply (simp only:refl ApplyResult.case)\n    using applyAllInputsPrefix1 onceAWarningAlwaysAWarning_reductionLoop_reduceContractStep_plus apply fastforce\n    by simp\n  by simp\n\nlemma noCounterExamplePropagatesComputeEmptyTransaction_Pay_NonPositivePay : \"validAndPositive_state st \\<Longrightarrow>\n    computeTransaction \\<lparr>interval = (lo, hi), inputs = []\\<rparr> st (Pay accountId payee token val subCont) = TransactionOutput \\<lparr>txOutWarnings = [], txOutPayments = newPays, txOutState = newSta, txOutContract = newCont\\<rparr> \\<Longrightarrow>\n    env = \\<lparr>timeInterval = (max lo (minTime st), hi)\\<rparr> \\<Longrightarrow> fixedSt = (st\\<lparr>minTime := max lo (minTime st)\\<rparr>) \\<Longrightarrow> hi \\<ge> lo \\<Longrightarrow> hi \\<ge> minTime st \\<Longrightarrow> isNonPositivePay env fixedSt val \\<Longrightarrow> False\"\n  apply (simp only:computeTransaction.simps Let_def)\n  apply (simp del:validAndPositive_state.simps applyAllLoop.simps isPartialPay.simps isNonPositivePay.simps add:Let_def)\n  apply (cases \"applyAllLoop False \\<lparr>timeInterval = (max lo (minTime st), hi)\\<rparr> (st\\<lparr>minTime := max lo (minTime st)\\<rparr>) (Pay accountId payee token val subCont) [] [] []\")\n  subgoal for newReduced applyWarnings applyEffects applyNewState applyNewContract\n    apply (simp only:ApplyAllResult.case refl)\n    apply (cases newReduced)\n    apply (auto split:\"if_split\" simp del:validAndPositive_state.simps evalValue.simps applyAllLoop.simps isPartialPay.simps isNonPositivePay.simps)\n    apply (cases \"Pay accountId payee token val subCont = applyNewContract\")\n     apply (simp only:refl if_True)\n    apply (metis State.ext_inject State.surjective State.update_convs(4) allAccountsPositiveState.simps applyAllInputsLoopIsQuiescent isQuiescent.simps(3) validAndPositive_state.simps valid_state.simps)\n    apply (simp only:refl if_False)\n    apply (cases \"reduceContractStep \\<lparr>timeInterval = (max lo (minTime st), hi)\\<rparr> (st\\<lparr>minTime := max lo (minTime st)\\<rparr>) (Pay accountId payee token val subCont)\")\n    subgoal for reduceWarning reduceEffect reduceState reduceContract\n      apply (subgoal_tac \"reduceWarning \\<noteq> ReduceNoWarning\")\n      using onceAWarningAlwaysAWarning_applyAllLoop_reduceContractStep apply blast\n      by auto\n     apply simp\n    by simp\n   apply auto[1]\n  by simp\n\nlemma noCounterExamplePropagatesComputeEmptyTransaction_Pay_PartialPay : \"validAndPositive_state st \\<Longrightarrow>\n    computeTransaction \\<lparr>interval = (lo, hi), inputs = []\\<rparr> st (Pay accountId payee token val subCont) = TransactionOutput \\<lparr>txOutWarnings = [], txOutPayments = newPays, txOutState = newSta, txOutContract = newCont\\<rparr> \\<Longrightarrow>\n    env = \\<lparr>timeInterval = (max lo (minTime st), hi)\\<rparr> \\<Longrightarrow> fixedSt = (st\\<lparr>minTime := max lo (minTime st)\\<rparr>) \\<Longrightarrow> hi \\<ge> lo \\<Longrightarrow> hi \\<ge> minTime st \\<Longrightarrow> isPartialPay env fixedSt accountId token val \\<Longrightarrow> \\<not> isNonPositivePay env fixedSt val \\<Longrightarrow> False\"\n  apply (simp only:computeTransaction.simps Let_def)\n  apply (simp del:validAndPositive_state.simps applyAllLoop.simps isPartialPay.simps isNonPositivePay.simps add:Let_def)\n  apply (cases \"applyAllLoop False \\<lparr>timeInterval = (max lo (minTime st), hi)\\<rparr> (st\\<lparr>minTime := max lo (minTime st)\\<rparr>) (Pay accountId payee token val subCont) [] [] []\")\n  subgoal for newReduced applyWarnings applyEffects applyNewState applyNewContract\n    apply (simp only:ApplyAllResult.case refl)\n    apply (cases newReduced)\n    apply (auto split:\"if_split\" simp del:validAndPositive_state.simps evalValue.simps applyAllLoop.simps isPartialPay.simps isNonPositivePay.simps)\n    apply (cases \"Pay accountId payee token val subCont = applyNewContract\")\n     apply (simp only:refl if_True)\n    apply (metis State.ext_inject State.surjective State.update_convs(4) allAccountsPositiveState.simps applyAllInputsLoopIsQuiescent isQuiescent.simps(3) validAndPositive_state.simps valid_state.simps)\n    apply (simp only:refl if_False)\n    apply (cases \"reduceContractStep \\<lparr>timeInterval = (max lo (minTime st), hi)\\<rparr> (st\\<lparr>minTime := max lo (minTime st)\\<rparr>) (Pay accountId payee token val subCont)\")\n    subgoal for reduceWarning reduceEffect reduceState reduceContract\n      apply (subgoal_tac \"reduceWarning \\<noteq> ReduceNoWarning\")\n      using onceAWarningAlwaysAWarning_applyAllLoop_reduceContractStep apply blast\n      apply (simp only:reduceContractStep.simps)\n      apply (subgoal_tac \"let moneyToPay = evalValue \\<lparr>timeInterval = (max lo (minTime st), hi)\\<rparr> (st\\<lparr>minTime := max lo (minTime st)\\<rparr>) val;\n                              balance = moneyInAccount accountId token (accounts (st\\<lparr>minTime := max lo (minTime st)\\<rparr>));\n                              paidMoney = min balance moneyToPay;\n                              moneyToPay2 = evalValue env fixedSt val;\n                              balance2 = moneyInAccount accountId token (accounts fixedSt);\n                              paidMoney2 = min balance2 moneyToPay2\n                          in Reduced (if min balance moneyToPay < moneyToPay\n                                      then ReducePartialPay accountId payee token paidMoney moneyToPay\n                                      else ReduceNoWarning)\n                                     (fst (giveMoney accountId payee token paidMoney2\n                                                     (updateMoneyInAccount accountId token (balance2 - paidMoney2) (accounts fixedSt))))\n                                     (st\\<lparr> minTime := max lo (minTime st),\n                                          accounts := snd (giveMoney accountId payee token paidMoney2\n                                                                     (updateMoneyInAccount accountId token (balance2 - paidMoney2) (accounts fixedSt))) \\<rparr>)\n                                     subCont\n                           = Reduced reduceWarning reduceEffect reduceState reduceContract\")\n      apply (smt ReduceStepResult.inject ReduceWarning.distinct(3) isPartialPay.elims(2))\n      apply (simp only:Let_def)\n      by (simp add:prod.case_eq_if)\n     apply simp\n    by simp\n   apply simp\n  by simp\n\nlemma staticAnalysisComplete_emptyTransaction : \"(\\<And>nst nc.\n        validAndPositive_state nst \\<Longrightarrow>\n        hasWarnings (playTraceAux \\<lparr>txOutWarnings = [], txOutPayments = [], txOutState = nst, txOutContract = nc\\<rparr> tt) \\<Longrightarrow>\n        calculateSymVars (Some nst) tt nc = (x2, t2) \\<Longrightarrow> isCounterExample (execute (wrapper nc t2 (Some nst)) x2)) \\<Longrightarrow>\n    validAndPositive_state st \\<Longrightarrow>\n    isSingleInput (\\<lparr>interval = inte, inputs = []\\<rparr> # tt) \\<Longrightarrow>\n    hasWarnings (playTraceAux \\<lparr>txOutWarnings = [], txOutPayments = [], txOutState = st, txOutContract = c\\<rparr> (\\<lparr>interval = inte, inputs = []\\<rparr> # tt)) \\<Longrightarrow>\n    calculateSymVars (Some st) (\\<lparr>interval = inte, inputs = []\\<rparr> # tt) c = (x2, t2) \\<Longrightarrow> isCounterExample (execute (wrapper c t2 (Some st)) x2)\"\n  oops\n\nlemma staticAnlysisComplete_singleInputTransaction : \"(\\<And>nst nc.\n        validAndPositive_state nst \\<Longrightarrow>\n        isSingleInput tt \\<Longrightarrow> hasWarnings (playTraceAux \\<lparr>txOutWarnings = [], txOutPayments = [], txOutState = nst, txOutContract = nc\\<rparr> tt) \\<Longrightarrow> calculateSymVars (Some nst) tt nc = (x2, t2) \\<Longrightarrow> isCounterExample (execute (wrapper nc t2 (Some nst)) x2)) \\<Longrightarrow>\n    validAndPositive_state st \\<Longrightarrow>\n    isSingleInput (\\<lparr>interval = inte, inputs = [ih]\\<rparr> # tt) \\<Longrightarrow>\n    hasWarnings (playTraceAux \\<lparr>txOutWarnings = [], txOutPayments = [], txOutState = st, txOutContract = c\\<rparr> (\\<lparr>interval = inte, inputs = [ih]\\<rparr> # tt)) \\<Longrightarrow>\n    calculateSymVars (Some st) (\\<lparr>interval = inte, inputs = [ih]\\<rparr> # tt) c = (x2, t2) \\<Longrightarrow> isCounterExample (execute (wrapper c t2 (Some st)) x2)\"\n  oops\n\nlemma staticAnalysisComplete_aux : \"validAndPositive_state st \\<Longrightarrow>\n                                      isSingleInput t \\<Longrightarrow>\n                                      hasWarnings (playTraceAux \\<lparr> txOutWarnings = Nil\n                                                                , txOutPayments = Nil\n                                                                , txOutState = st\n                                                                , txOutContract = c \\<rparr> t) \\<Longrightarrow>\n                                      calculateSymVars (Some st) t c = (x2, t2) \\<Longrightarrow>\n                                      isCounterExample (execute (wrapper c t2 (Some st)) x2)\"\n  (*\n  apply (induction t arbitrary:st c)\n  apply simp\n  subgoal for th tt st c\n    apply (cases th)\n    subgoal for inte inps\n      apply (cases inps)\n      using isSingleInput.simps(2) staticAnalysisComplete_emptyTransaction apply blast\n      subgoal for ih it\n        apply (cases it)\n        using staticAnlysisComplete_singleInputTransaction apply blast\n        by simp\n      done\n    done\n  done\n  *)\n  oops\n\nlemma staticAnalysisComplete_aux2 : \"validAndPositive_state st \\<Longrightarrow>\n                                      hasWarnings (playTraceAux \\<lparr> txOutWarnings = Nil\n                                                                , txOutPayments = Nil\n                                                                , txOutState = st\n                                                                , txOutContract = c \\<rparr> (traceListToSingleInput t)) \\<Longrightarrow>\n                                      calculateSymVars (Some st) (traceListToSingleInput t) c = (x2, t2) \\<Longrightarrow>\n                                      isCounterExample (execute (wrapper c t2 (Some st)) x2)\"\n  (* using staticAnalysisComplete_aux traceListToSingleInput_isSingleInput2 by blast *)\n  oops\n\ntheorem staticAnalysisComplete : \"validAndPositive_state st \\<Longrightarrow>\n                                  (\\<exists> t. hasWarnings (playTraceAux \\<lparr> txOutWarnings = Nil\n                                                                  , txOutPayments = Nil\n                                                                  , txOutState = st\n                                                                  , txOutContract = c \\<rparr> t)) \\<Longrightarrow>\n                                  (\\<exists> t x. isCounterExample (execute (wrapper c t (Some st)) x))\"\n  (* by (metis playTraceAuxToSingleInputIsEquivalent staticAnalysisComplete_aux2 surj_pair) *)\n  oops\n\n(*\ntheorem staticAnalysisSound : \"validAndPositive_state st \\<Longrightarrow>\n                               (\\<exists> t x. isCounterExample (execute (wrapper c t (Some st)) x)) \\<Longrightarrow>\n                               (\\<exists> t. hasWarnings (playTraceAux \\<lparr> txOutWarnings = Nil\n                                                               , txOutPayments = Nil\n                                                               , txOutState = st\n                                                               , txOutContract = c \\<rparr> t))\"\n  oops\n\ntheorem staticAnalysisWorks : \"validAndPositive_state st \\<Longrightarrow>\n                               (\\<exists> t x. isCounterExample (execute (wrapper c t (Some st)) x)) =\n                               (\\<exists> t. hasWarnings (playTraceAux \\<lparr> txOutWarnings = Nil\n                                                               , txOutPayments = Nil\n                                                               , txOutState = st\n                                                               , txOutContract = c \\<rparr> t))\"\n  using staticAnalysisComplete staticAnalysisSound by blast\n *)\n\nend\n", "meta": {"author": "input-output-hk", "repo": "marlowe", "sha": "d2f7b3108894b7c3169c71214f1a2772716544bf", "save_path": "github-repos/isabelle/input-output-hk-marlowe", "path": "github-repos/isabelle/input-output-hk-marlowe/marlowe-d2f7b3108894b7c3169c71214f1a2772716544bf/isabelle/StaticAnalysis/StaticAnalysis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3345838170744818}}
{"text": "theory ModalCube\nimports Main\n\nbegin\n\ntext \\<open> \\begin{abstract}\nWe present an automated verification of the well-known\nmodal logic cube in Isabelle/HOL, in which we prove the inclusion relations\nbetween the cube's logics using automated reasoning tools.\nPrior work addresses this problem but without restriction to the modal logic cube,\nand using encodings in first-order logic in \ncombination with first-order automated theorem provers.\nIn contrast, our solution is\nmore elegant, transparent and effective. It employs an\nembedding of quantified modal logic in classical higher-order\nlogic. Automated reasoning tools, such as Sledgehammer with LEO-II,\nSatallax and CVC4, Metis and Nitpick, are employed to achieve full automation.\nThough successful, the experiments also motivate some technical improvements \nin the Isabelle/HOL tool. \n\n%An automated verification of the well known\n%modal logic cube in Isabelle/HOL is presented. In contrast to related\n%work, which achieved a similar result using encodings in first-order logic in \n%combination with first-order automated theorem provers, the solution presented here is\n%more elegant, transparent and effective. This solution employs an\n%embedding of quantified modal logic in classical higher-order\n%logic. Automated reasoning tools, such as Sledgehammer with LEO-II,\n%Satallax and CVC4, Metis and Nitpick, are employed to achieve full automation.\n%Though successful, the experiments also motivate some technical improvements \n%in the Isabelle/HOL tool. \n\\end{abstract} \\<close>\n\n\nsection \\<open> Introduction \\<close>\n\ntext \\<open> We present an approach to meta-reasoning about modal logics,\nand apply it to verify the relative strengths of logics in the well-known \\emph{modal logic cube},\nwhich is illustrated in Figure 1. In particular, proofs are given for the\nequivalences of different axiomatizations and the inclusion relations shown in the cube.\n\n\\begin{figure}[tp]\n\\centering\n\\scalebox{0.8}{\n\\begin{tikzpicture}[thick,node/.style={rectangle,draw,font=\\Large\\bfseries}]\n\n  % 1. Ebene\n  \\node[node] (K)   {K};\n  \\node[node] (K4)  [above right=2cm and 2cm of K.center,anchor=center] {K4};\n  \\node[node] (K5)  [below right=0.9cm and 1.6cm of K4.center,anchor=center] {K5};\n  \\node[node] (KB)  [right=8cm of K.center,anchor=center] {KB};\n  \\node[node] (K45) [right=5cm of K4.center,anchor=center] {K45};\n  \\node[node] (KB5) [above right=2cm and 2cm of KB.center,anchor=center] {KB5};\n\n  % 2. Ebene\n  \\node[node] (D)  [above=4cm of K.center,anchor=center] {D};\n  \\node[node] (D4) [above right=2cm and 2cm of D.center,anchor=center] {D4};\n  \\node[node] (D5) [below right=0.9cm and 1.6cm of D4.center,anchor=center] {D5};\n  \\node[node] (DB) [right=8cm of D.center,anchor=center] {DB};\n  \\node[node] (D45)[right=5cm of D4.center,anchor=center] {D45};\n\n  % 3. Ebene\n  \\node[node] (M)  [above=4cm of D.center,anchor=center] {M};\n  \\node[node] (S4) [above right=2cm and 2cm of M.center,anchor=center] {S4};\n  \\node[node] (B)  [right=8cm of M.center,anchor=center] {B};\n  \\node[node] (B)  [right=8cm of M.center,anchor=center] {B};\n  \\node[node] (S5) [above right=2cm and 2cm of B.center,anchor=center] {S5};\n\n  \\node[align=center,font=\\Large\\bfseries] [right=0.1cm of S5.north east,anchor=north west]\n   {\\begin{tabular}{ l }\n     $\\equiv$ M5 $\\equiv$ MB5 $\\equiv$ M4B5\\\\\n     $\\equiv$ M45 $\\equiv$ M4B $\\equiv$ D4B\\\\\n     $\\equiv$ D4B5 $\\equiv$ DB5\n    \\end{tabular}\n    };\n  \\node[align=left,font=\\large\\bfseries] [above right=1.75cm and 3cm of D45.north east,anchor=north west]\n   {\n   \\begin{tabular}{ l l }\n      M: & $\\nec P \\rightarrow P$ \\\\\n      B: & $P \\rightarrow \\nec\\pos P$ \\\\\n      D: & $\\nec P \\rightarrow \\pos P$ \\\\\n      4: & $\\nec P \\rightarrow \\nec\\nec P$ \\\\\n      5: & $\\pos P \\rightarrow \\nec\\pos P$\n   \\end{tabular}\n   };\n\n  \\node[draw=none,fill=none,font=\\large\\bfseries] (K1) [below right=2.5cm and 3.25cm of D45.south east,anchor=north west] {K};\n  \\node[draw=none,fill=none,font=\\large\\bfseries] (M1) [above=2cm of K1.center,anchor=center] {M};\n  \\node[draw=none,fill=none,font=\\large\\bfseries] (41) [above right=1.25cm and 1.25cm of K1.center,anchor=center] {4};\n  \\node[draw=none,fill=none,font=\\large\\bfseries] (51) [above right=0.75cm and 1.75cm of K1.center,anchor=center] {5};\n  \\node[draw=none,fill=none,font=\\large\\bfseries] (B1) [right=2cm of K1.center,anchor=center] {B};\n   \n  \\node[align=center,font=\\Large\\bfseries] [right=0.1cm of KB5.north east,anchor=north west]\n   {$\\equiv$ K4B5 $\\equiv$ K4B};\n  \\path[->,>=stealth',thick,every node/.style={font=\\large}]\n    (K1)  edge (M1)\n          edge (41)\n          edge (51)\n          edge (B1);\n\n  \\path[->,>=stealth',thick,every node/.style={font=\\large}]\n    (K)   edge (K4)\n          edge (K5)\n          edge (KB)\n          edge (D)\n    (K4)  edge (K45)\n          edge (D4)\n    (K5)  edge (K45)\n          edge (D5)\n    (KB)  edge (KB5)\n          edge (DB)\n    (K45) edge (KB5)\n          edge (D45)\n    (KB5) edge (S5)\n\n    (D)   edge (D4)\n          edge (D5)\n          edge (DB)\n          edge (M)\n    (D4)  edge (D45)\n          edge (S4)\n    (D5)  edge (D45)\n    (DB)  edge (B)\n    (D45) edge (S5)\n\n    (M)  edge (S4)\n         edge (B)\n    (S4) edge (S5)\n    (B)  edge (S5);\n    \n\\end{tikzpicture}\n}\n\\caption{The modal logic cube: \nreasoning in modal logics is commonly done with\nrespect to a certain set of basic axioms; different choices of basic\naxioms give rise to different modal logics. These modal logics can be\narranged as vertices in a cube, such that the edges between them\ndenote inclusion relations.\n}\n\\label{fig1}\n\\end{figure}\n\nOur solution makes extensive use of the fact that all modal logics found in the cube\nare sound and complete because they arise from base modal logic K by adding Sahlqvist axioms.\nThis is in contrast to prior work by Rabe et al.~\\cite{Rabe}, who address the more general problem of determining the\nrelation between two arbitrary modal logics characterized by their sets of inference\nrules. In their article the authors apply first-order logic encodings in combination with first-order\nautomated theorem provers to prove an inclusion relation employing a number of different decision strategies.\nFor the subproblem of only comparing logics within the cube (and therefore taking advantage of normality as additional knowledge)\nour solution improves on the elegance and simplicity of the problem encodings, as well as with automation performance.\nOne motivation of this paper is to demonstrate the advantage of a pragmatically more expressive logic\nenvironment (here classical higher-order logic) in comparison to a less expressive language such as\nfirst-order logic or decidable fragments thereof.\n\nWe exploit an embedding of quantified multimodal\nlogic (QML) in classical higher-order logic (HOL) \\cite{J23}, in which we carry out the\nautomated verification of the aforementioned inclusion relations. These include the logics \\textbf{K}, \\textbf{D},\n\\textbf{M} (also known as \\textbf{T}), \\textbf{S4}, and\n\\textbf{S5}. We analyze inclusion and equivalence\nrelations for modal logics that can be defined from normal modal logic\n\\textbf{K} by adding (combinations of) the axioms M, B, D, 4, and\n5. In our problem encodings we exploit the well-known correspondences\nbetween these axioms and semantic properties of accessibility\nrelations (i.e. Kripke models). These correspondences can themselves be elegantly formalized\nand effectively automated in our approach. Formalization of the modal\naxioms M, B, D, 4, and 5 requires quantification over propositional\nvariables. This explains why an embedding of \\textit{quantified} modal\nlogic in HOL is needed here, and not simply an embedding of propositional\nmodal logic in HOL.\n\n%In a sense, this paper provides a response to a related article by\n%Rabe et al.~\\cite{Rabe}. In their article the authors apply\n%first-order logic encodings in combination with first-order automated\n%theorem provers to verify the modal logic cube. \n%Our solution achieves significant improvements, most\n%notably with respect to elegance and simplicity of the problem\n%encodings, as well as with automation performance. One\n%motivation of this paper is to demonstrate the\n%advantage of a pragmatically more expressive logic environment (here\n%classical higher-order logic) in comparison to a less expressive\n%language such as first-order logic or decidable fragments thereof.\n\nOur previous work (see the non-refereed, invited paper \\cite{B12}) has\nalready demonstrated the feasibility of the approach. However, instead\nof the development done there in pure TPTP THF~\\cite{C25},\nwe here work with Isabelle/HOL~\\cite{Nipkow-Paulson-Wenzel:2002} as the base\nenvironment, and fruitfully exploit various reasoning\ntools that are provided with it. This includes the\nSledgehammer-based \\cite{EasyChair:128} interfaces from Isabelle/HOL to\nthe external higher-order theorem provers LEO-II~\\cite{C26} and\nSatallax~\\cite{Satallax}, as well as Isabelle/HOL's own reasoner\nMetis~\\cite{hurd2003d}. Moreover, the higher-order model finding capabilities\nof Nitpick~\\cite{BlanchetteN-ITP10} are heavily used in order to formulate\nand prove subsequent inclusion theorems in Isabelle/HOL.\nWe also encountered some problems with interacting with the proof\nreconstruction available for LEO-II and Satallax in Isabelle/HOL.\n\nThis paper is a verified document in\nthe sense that it has been automatically generated from Isabelle/HOL\nsource code with the help of Isabelle's \\textit{build} tool (the\nentire source package is available from\n\\url{http://christoph-benzmueller.de/varia/pxtp2015.zip}).\n\nThe paper is structured as follows: Section~\\ref{sec1} presents an\nencoding of QML in HOL. This part reuses the theory provided by\nBenzm\\\"uller and Paulson~\\cite{J23}, which has recently been further\ndeveloped (to cover full higher-order QML) and applied for the verification of\nG\\\"odel's ontological argument~\\cite{GoedelGod-AFP,ECAI}. Section~\\ref{sec2}\nfirst establishes the well-known correspondence between properties of models\nand base axioms, and then investigates the equivalence of different axiomatizations.\nSubsequently, all inclusion relations as depicted in the modal logic cube are shown to be proper. Finally, \nthe minimal number of possible worlds that is required to obtain proper inclusions in each case \nis determined and verified. Section~\\ref{sec:eval} presents a short evaluation and discussion of the \nconducted experiments, and Section~\\ref{sec:conc} concludes the paper.\n\\<close>\n\nsection \\<open> An Embedding of Quantified Multimodal Logics in HOL \\label{sec1} \\<close>\n\ntext\\<open> In contrast to the monomodal case, in quantified multimodal logics both modalities @{text \"\\<box>\"} and @{text \"\\<diamond>\"}\nare parametrized, such that they refer to potentially different accessibility relations. We write\n@{text \"\\<box>\\<^sup>R\"} and @{text \"\\<diamond>\\<^sup>R\"} to refer to necessity and possibility wrt.\\ a relation $R$. Furthermore, in terms of quantification,\nwe only consider the constant-domain case: this means that all possible worlds share one common domain\nof discourse. More details on the embedding of QML in HOL are given in earlier work~\\cite{J23,ECAI}. \\<close>\n \n\ntypedecl i\t\t (*the type for possible worlds\"*)\n\n \ntext \\<open> QML formulas are translated as HOL terms of type @{typ \"i \\<Rightarrow> bool\"}, where @{typ i} is the type of possible worlds.\nThis type is abbreviated as @{text \"\\<sigma>\"}. \\<close>\n\n\ntype_synonym \\<sigma> = \"(i \\<Rightarrow> bool)\"\n\n\ntext \\<open> The classical connectives $\\neg, \\wedge, \\rightarrow$, and $\\forall$\n(which quantifies over individuals and over sets of individuals) and $\\exists$ (over individuals) are\nlifted to type $\\sigma$. The lifted connectives are @{text \"\\<not>\\<^sup>m\"}, @{text \"\\<and>\\<^sup>m\"}, @{text \"\\<or>\\<^sup>m\"}, \n@{text \"\\<rightarrow>\\<^sup>m\"}, @{text \"\\<equiv>\\<^sup>m\"}, @{text \"\\<forall>\"}, and @{text \"\\<exists>\"} (the latter two are modeled as constant symbols). \nOther connectives can be introduced analogously. Moreover, the modal \noperators @{text \"\\<box>\"} and @{text \"\\<diamond>\"}, parametric to @{text \"R\"},  are introduced.\nNote that in symbols like @{text \"\\<not>\\<^sup>m\"}, symbol @{text \"m\"} is simply part of the name,\nwhereas in @{text \"\\<box>\\<^sup>R\"} and @{text \"\\<diamond>\\<^sup>R\"}, symbol @{text \"R\"} is a parameter to the modality.\\<close>\n\nabbreviation mnot :: \"\\<sigma> \\<Rightarrow> \\<sigma>\" (\"\\<not>\\<^sup>m\") where \"\\<not>\\<^sup>m \\<phi> \\<equiv> (\\<lambda>w. \\<not> \\<phi> w)\"    \nabbreviation mand :: \"\\<sigma> \\<Rightarrow> \\<sigma> \\<Rightarrow> \\<sigma>\" (infixr \"\\<and>\\<^sup>m\" 52) where \"\\<phi> \\<and>\\<^sup>m \\<psi> \\<equiv> (\\<lambda>w. \\<phi> w \\<and> \\<psi> w)\"   \nabbreviation mor :: \"\\<sigma> \\<Rightarrow> \\<sigma> \\<Rightarrow> \\<sigma>\" (infixr \"\\<or>\\<^sup>m\" 51) where \"\\<phi> \\<or>\\<^sup>m \\<psi> \\<equiv> (\\<lambda>w. \\<phi> w \\<or> \\<psi> w)\"   \nabbreviation mimplies :: \"\\<sigma> \\<Rightarrow> \\<sigma> \\<Rightarrow> \\<sigma>\" (infixr \"\\<rightarrow>\\<^sup>m\" 49) where \"\\<phi> \\<rightarrow>\\<^sup>m \\<psi> \\<equiv> (\\<lambda>w. \\<phi> w \\<longrightarrow> \\<psi> w)\"  \nabbreviation mequiv:: \"\\<sigma> \\<Rightarrow> \\<sigma> \\<Rightarrow> \\<sigma>\" (infixr \"\\<equiv>\\<^sup>m\" 48) where \"\\<phi> \\<equiv>\\<^sup>m \\<psi> \\<equiv> (\\<lambda>w. \\<phi> w \\<longleftrightarrow> \\<psi> w)\"  \nabbreviation mforall :: \"('a \\<Rightarrow> \\<sigma>) \\<Rightarrow> \\<sigma>\" (\"\\<forall>\") where \"\\<forall> \\<Phi> \\<equiv> (\\<lambda>w. \\<forall>x. \\<Phi> x w)\"   \nabbreviation mexists :: \"('a \\<Rightarrow> \\<sigma>) \\<Rightarrow> \\<sigma>\" (\"\\<exists>\") where \"\\<exists> \\<Phi> \\<equiv> (\\<lambda>w. \\<exists>x. \\<Phi> x w)\"\nabbreviation mbox :: \"(i \\<Rightarrow> i \\<Rightarrow> bool) \\<Rightarrow> \\<sigma> \\<Rightarrow> \\<sigma>\" (\"\\<box>\\<^sup>_ _\") where \"\\<box>\\<^sup>R \\<phi> \\<equiv> (\\<lambda>w. \\<forall>v. (R w v) \\<longrightarrow> \\<phi> v)\"\nabbreviation mdia :: \"(i \\<Rightarrow> i \\<Rightarrow> bool) \\<Rightarrow> \\<sigma> \\<Rightarrow> \\<sigma>\" (\"\\<diamond>\\<^sup>_ _\") where \"\\<diamond>\\<^sup>R \\<phi> \\<equiv> (\\<lambda>w. \\<exists>v. R w v \\<and> \\<phi> v)\" \n\ntext \\<open> For grounding lifted formulas, the meta-predicate @{text \"[\\<cdot>]\"}, read @{text \"valid\"}, is introduced. \\<close>\n\n no_syntax \"_list\" :: \"args \\<Rightarrow> 'a list\" (\"[(_)]\")  \nabbreviation valid :: \"\\<sigma> \\<Rightarrow> bool\" (\"[_]\") where \"[p] \\<equiv> \\<forall>w. p w\"\n\n\nsection \\<open> Reasoning about Modal Logics \\label{sec2} \\<close>\n\nsubsection \\<open> Correspondence Results \\<close>           \n\ntext \\<open> Axioms of the modal cube correspond to constraints on the underlying accessibility relations.\nThese constraints are as follows: \\<close>\n\nhide_const refl sym trans  \n\ndefinition \"refl \\<equiv> \\<lambda>R::i\\<Rightarrow>i\\<Rightarrow>bool. \\<forall>S. R S S\" \ndefinition \"sym \\<equiv> \\<lambda>R::i\\<Rightarrow>i\\<Rightarrow>bool. ( \\<forall>S T. (R S T \\<longrightarrow> R T S))\"                                \ndefinition \"ser \\<equiv> \\<lambda>R :: (i \\<Rightarrow> i \\<Rightarrow> bool). \\<forall>S. \\<exists>T. R S T\"                                              \ndefinition \"trans \\<equiv> \\<lambda>R :: (i \\<Rightarrow> i \\<Rightarrow> bool). \\<forall>S T U. (R S T \\<and> R T U \\<longrightarrow> R S U)\"          \ndefinition \"eucl \\<equiv> \\<lambda>R :: (i \\<Rightarrow> i \\<Rightarrow> bool). \\<forall>S T U. (R S T \\<and> R S U \\<longrightarrow> R T U)\"            \n\ntext \\<open> The corresponding axioms are defined next; note that they are parametric over accessibility \nrelation $R$: \\<close>\n\ndefinition \"M \\<equiv> \\<lambda>R . valid (\\<forall>(\\<lambda>P. (\\<box>\\<^sup>R P) \\<rightarrow>\\<^sup>m P))\"\ndefinition \"B \\<equiv> \\<lambda>R . valid (\\<forall>(\\<lambda>P. P \\<rightarrow>\\<^sup>m \\<box>\\<^sup>R\\<diamond>\\<^sup>R P))\"\ndefinition \"D \\<equiv> \\<lambda>R . valid (\\<forall>(\\<lambda>P. (\\<box>\\<^sup>R P) \\<rightarrow>\\<^sup>m \\<diamond>\\<^sup>R P))\"\ndefinition \"IV \\<equiv> \\<lambda>R . valid (\\<forall>(\\<lambda>P. (\\<box>\\<^sup>R P) \\<rightarrow>\\<^sup>m \\<box>\\<^sup>R\\<box>\\<^sup>R P))\"\ndefinition \"V \\<equiv> \\<lambda>R . valid (\\<forall>(\\<lambda>P. (\\<diamond>\\<^sup>R P) \\<rightarrow>\\<^sup>m \\<box>\\<^sup>R\\<diamond>\\<^sup>R P))\"\n\ntext \\<open> We will see below that \\emph{correspondence theorems} (between axioms and constraints on accessibility relations)\ncan be elegantly expressed in HOL by exploiting the embedding used above.\nThese correspondence theorems link a constraint to every axiom---for instance, $M$ is linked to $\\mathit{refl}$.\n%Furthermore, the constraint has to be met by its every model (e.g. accessibility relation).\nSubsequently, in order to make statements about the relationship of two logics in the cube, it is sufficient to only look at the model constraints of their\nrespective axiomatizations. Throughout the rest of this paper, all reasoning will be done on the model-theoretic\nside and then interpreted on the proof-theoretic side by the means of this correspondence. \\<close>\n\n\nsledgehammer_params [verbose=true]\n\n\nsubsubsection \\<open> Axiom M corresponds to Reflexivity \\<close>\n\ntheorem A1: \"(\\<forall>R. (refl R) \\<longleftrightarrow> (M R))\" by (metis M_def refl_def)\n\nsubsubsection \\<open> Axiom B corresponds to Symmetry \\<close>\n\nlemma A2_a: \"(\\<forall>R. (sym R) \\<longrightarrow> (B R))\" by (metis B_def sym_def)\nlemma A2_b:  \"(\\<forall>R. (B R) \\<longrightarrow> (sym R))\" (* by (simp add:B_def sym_def, force) *) sorry\ntheorem A2: \"(\\<forall>R. (sym R) \\<longleftrightarrow> (B R))\" by (metis A2_a A2_b)\n\nsubsubsection \\<open> Axiom D corresponds to Seriality \\<close>\n\ntheorem A3: \"(\\<forall>R. (ser R) \\<longleftrightarrow> (D R))\" by (metis D_def ser_def)\n\nsubsubsection \\<open> Axiom 4 corresponds to Transitivity \\<close>\n\ntheorem A4: \"(\\<forall>R. (trans R) \\<longleftrightarrow> (IV R))\" by (metis IV_def trans_def)\n\nsubsubsection \\<open> Axiom 5 corresponds to Euclideanness \\<close>\n\nlemma A5_a: \"(\\<forall>R. (eucl R) \\<longrightarrow> (V R))\" by (metis V_def eucl_def)\nlemma A5_b: \"(\\<forall>R. (V R) \\<longrightarrow> (eucl R))\" by (simp add:V_def eucl_def, force)\ntheorem A5: \"(\\<forall>R. (eucl R) \\<longleftrightarrow> (V R))\" by (metis A5_a A5_b)\n\n\nsubsection \\<open> Alternative Axiomatisations of Modal Logics \\<close>\n\ntext \\<open> Often the same logic within the cube can be obtained through different axiomatizations.\nIn this section we show how to prove different axiomatizations for logic \\textbf{S5} resp. \\textbf{KB5} to be equivalent. Using the\ncorrespondence theorems from the previous section, the equivalences can be elegantly formulated solely using the properties\nof accessibility relations. In Subsections~\\ref{M5-and-MB5} and~\\ref{M5-and-M4B5} we also add the corresponding \nstatements using the modal logic axioms; this could analogously be done also for the other theorems and lemmata \npresented in Sections {{3.2 and 3.3}}.\n\nThe theorems below can be solved directly by Metis when it is provided the \nminimal set of necessary definitions. Sledgehammer (with the ATPs LEO-II and Satallax or with first-order provers) can also \nquickly solve these problems, in which case the manual selection of the required definitions is not necessary. \\<close>\n\nsubsubsection \\<open> M5 $\\Longleftrightarrow$ MB5 \\label{M5-and-MB5}\\<close>\ntheorem B1: \"\\<forall>R.((refl R) \\<and> (eucl R)) \\<longleftrightarrow> ((refl R) \\<and> (sym R) \\<and> (eucl R))\"\n by (metis eucl_def refl_def sym_def) \ntheorem B1_alt: \"\\<forall>R.((M R) \\<and> (V R)) \\<longleftrightarrow> ((M R) \\<and> (B R) \\<and> (V R))\"\n by (metis A1 A2 A5 B1)\n\nsubsubsection \\<open> M5 $\\Longleftrightarrow$ M4B5 \\label{M5-and-M4B5}\\<close>\ntheorem B2: \"\\<forall>R.((refl R) \\<and> (eucl R)) \\<longleftrightarrow> ((refl R) \\<and> (trans R) \\<and> (sym R) \\<and> (eucl R))\"\n by (metis eucl_def refl_def trans_def sym_def)\ntheorem B2_alt: \"\\<forall>R.((M R) \\<and> (V R)) \\<longleftrightarrow> ((M R) \\<and> (IV R) \\<and> (B R) \\<and> (V R))\"\n by (metis A1 A4 A5 B1_alt B2)\n\nsubsubsection \\<open> M5 $\\Longleftrightarrow$ M45 \\<close>\ntheorem B3: \"\\<forall>R.((refl R) \\<and> (eucl R)) \\<longleftrightarrow> ((refl R) \\<and> (trans R) \\<and> (eucl R))\" \n by (metis eucl_def refl_def trans_def)\n\nsubsubsection \\<open> M5 $\\Longleftrightarrow$ M4B \\<close>\ntheorem B4: \"\\<forall>R.((refl R) \\<and> (eucl R)) \\<longleftrightarrow> ((refl R) \\<and> (trans R) \\<and> (sym R))\"\n by (metis eucl_def refl_def sym_def trans_def)\n                                        \nsubsubsection \\<open> M5 $\\Longleftrightarrow$ D4B \\<close>\ntheorem B5: \"\\<forall>R.((refl R) \\<and> (eucl R)) \\<longleftrightarrow> ((ser R) \\<and> (trans R) \\<and> (sym R))\"\n by (metis eucl_def refl_def ser_def sym_def trans_def)\n\nsubsubsection \\<open> M5 $\\Longleftrightarrow$ D4B5 \\<close>\ntheorem B6: \"\\<forall>R.((refl R) \\<and> (eucl R)) \\<longleftrightarrow> ((ser R) \\<and> (trans R) \\<and> (sym R) \\<and> (eucl R))\"\n by (metis eucl_def refl_def ser_def sym_def trans_def)\n\nsubsubsection \\<open> M5 $\\Longleftrightarrow$ DB5 \\<close>\ntheorem B7: \"\\<forall>R.((refl R) \\<and> (eucl R)) \\<longleftrightarrow> ((ser R) \\<and> (sym R) \\<and> (eucl R))\"\n by (metis eucl_def refl_def ser_def sym_def)\n\nsubsubsection \\<open> KB5 $\\Longleftrightarrow$ K4B5 \\<close>\ntheorem B8: \"\\<forall>R.((sym R) \\<and> (eucl R)) \\<longleftrightarrow> ((trans R) \\<and> (sym R) \\<and> (eucl R))\"\n by (metis eucl_def sym_def trans_def)\n\nsubsubsection \\<open> KB5 $\\Longleftrightarrow$ K4B \\<close>\ntheorem B9: \"\\<forall>R.((sym R) \\<and> (eucl R)) \\<longleftrightarrow> ((trans R) \\<and> (sym R))\"\n by (metis eucl_def sym_def trans_def)\n\n\nsubsection \\<open> Proper Inclusion Relations between Different Modal Logics \\<close>\n\ntext \\<open> An edge within the cube denotes an inclusion between the connected logics. In the forward direction, these can\nbe trivially shown valid through monotonicity of entailment and equivalence of the different\naxiomatizations. For example, for the forward link from logic \\textbf{K} to logic \\textbf{B}, we need to show that every \ntheorem of \\textbf{K} is also a theorem of \\textbf{B}; this simply means to\ndisregard the additional axiom B.\n Below, the crucial backward directions are proved. \nInformally, it is shown that through moving further\nup in the cube (adding further axioms), theorems can be proved which were not provable before; this means\nthat the inclusions are proper.\nWe write $A > B$ to indicate that logic $A$ can prove strictly more theorems than logic $B$.\n\nIt has to be noted that some logics are actually equivalent if the only models considered have few\nenough worlds; examples are given below. We introduce some useful abbreviations to formulate\nconstraints on the number of worlds in a model.\\<close>\n\n\nabbreviation one_world_model :: \"i \\<Rightarrow> bool\" (\"#\\<^sup>1\")\n  where \"#\\<^sup>1 w1 \\<equiv> \\<forall>x. x = w1\"\nabbreviation two_world_model :: \"i \\<Rightarrow> i \\<Rightarrow> bool\" (\"#\\<^sup>2\")\n  where \"#\\<^sup>2 w1 w2 \\<equiv> (\\<forall>x. x = w1 \\<or> x = w2) \\<and> w1 \\<noteq> w2\" \nabbreviation three_world_model :: \"i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool\" (\"#\\<^sup>3\")\n  where \"#\\<^sup>3 w1 w2 w3 \\<equiv> (\\<forall>x. x = w1 \\<or> x = w2 \\<or> x = w3) \\<and> w1 \\<noteq> w2 \\<and> w1 \\<noteq> w3 \\<and> w2 \\<noteq> w3\" \n\ntext \\<open>In what follows, we reserve the symbols \\emph{i1}, \\emph{i2} and \\emph{i3} for worlds, and \\emph{r} for an accessibility relation.\\<close>\n\nconsts i1::\"i\" i2::\"i\" i3::\"i\" r:: \"i \\<Rightarrow> i \\<Rightarrow> bool\"\n\ntext \\<open>\nWe applied the following methodology in the experiments reported in this section:\n\n\\begin{description}\n\\item[\\textbf{(Step A)}] First we deliberately made invalid conjectures about inclusion relations---e.g. for proving \nK4 $>$ K we first wrongly conjectured that K4 $\\subseteq$ K, meaning that K4 entails K. \nWe did this by conjecturing \n\\begin{center} @{text \"lemma C1_A: \\<forall>R. (trans R)\"} \\end{center}\nThese wrongly-conjectured lemmata in Step A are uniformly named @{text \"C*_A\"}.\nNote that for the formulation of the @{text \"C*_A\"}-lemmata we again exploit the correspondence results given earlier, \nand we work with conditions on the accessibility relations instead of using the corresponding modal logic axioms.\nFor each @{text \"C*_A\"}-lemma Nitpick quickly generates a countermodel, which \nit communicates in a specific syntax. For example, the countermodel it presents for @{text \"C1_A\"} is \n\\begin{center}\n@{text \"\nR = (\\<lambda>x. _)(i\\<^sub>1 := (\\<lambda>x. _)(i\\<^sub>1 := True, i\\<^sub>2 := True), i\\<^sub>2 := (\\<lambda>x. _)(i\\<^sub>1 := True, i\\<^sub>2 := False))\n\"}.\n\\end{center}\nDiagrammatically this 2-world countermodel can be represented as follows \n\\begin{center}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n          edge [bend left] node {} (i_2)\n    (i_2) edge [bend left] node {} (i_1);\n\\end{tikzpicture}\n\\end{center}\n\n\\item[\\textbf{(Step B)}] Next, we systematically employed the arity information obtained from the countermodels for the @{text \"C*_A\"}-lemmata, reported by Nitpick,\nto formulate a corresponding \nlemma to be passed via Sledgehammer to the HOL-ATPs LEO-II, Satallax and/or CVC4 \\cite{CVC4} (whenever it was not trivially provable by the automation \ntools @{text \"simp\"}, @{text \"force\"} and/or @{text \"blast\"} available within Isabelle/HOL).\nIn our running example this lemma is \n\\begin{center}\n @{text \"C1_B: #\\<^sup>2 i1 i2 \\<longrightarrow> \\<forall>R. \\<not> trans R\"}\n\\end{center}\n All but four of these lemmata can actually be proved by either LEO-II or Satallax. Some of the easier problems can already be automated with \n @{text \"simp\"}, @{text \"force\"} and  @{text \"blast\"}, which are preferred here.  \n The four cases in which no automation attempts succeeded (we also tried all other integrated ATPs in Isabelle) \n are named @{text \"C*_ATP_challenge\"} below.\n Moreover, there are ten problems named @{text \"C*_Isabelle_challenge\"}. For these problems LEO-II or Satallax found proofs, but their\n Metis-based integration into Isabelle failed. Hence, no verification was obtained for these problems. However, we found that \n five of these @{text \"C*_Isabelle_challenge\"} problems can also be proved by CVC4, for which proof integration\n worked. \n Unfortunately, no other automation means (including the integrated first-order ATPs or SMT solvers) succeeded for the\n @{text \"C*_Isabelle_challenge\"} problems.\n\n\\item[\\textbf{(Step C)}] For the verification of the modal logic cube, the non-proved or non-integrated @{text \"C*_challenge\"} problems of Step B are clearly unsatisfactory, since\nno proper verification in Isabelle is obtained. However, an easy solution for these (and all other) cases\nis possible by exploiting not only Nitpick's arity information on the countermodels, but by using all the information about the \ncountermodels it presents, that is, the precise information on the accessibility relation. \nFor example, Nitpick's countermodel for @{text \"C1_A\"} from above \ncan be converted into the following theorem\n(where @{text r} denotes a fixed accessibility relation) \n\\begin{center}\n@{text \"theorem C1_C: #\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> r i1 i2 \\<and> r i2 i1 \\<and> \\<not>r i2 i2 \\<longrightarrow> \\<not> trans r\"}. \n\\end{center}\nThe resulting theorems we generate \nare uniformly named @{text \"C*_C\"}. It turns out that all  @{text \"C*_C\"}-theorems can be quickly verified in Isabelle by Metis. \nThus, for each link in the modal logic we provide either a verified @{text \"C*_B\"} theorem or, if this was not successful, a verified @{text \"C*_C\"} \ntheorem. Taken together, this confirms that the inclusion relation in the cube are indeed proper. \nHence, these @{text \"C*_B\"} resp. @{text \"C*_C\"} theorems complete the verification of the modal logic cube. Below the \n@{text \"C*_C\"} proof attempts are omitted if the corresponding @{text \"C*_B\"} attempts were already successful.\n\n \n\\item[\\textbf{(Step D)}] We additionally prove that the countermodels found by Nitpick in Step A are minimal (regarding the number \nof possible worlds). In other words, we prove here that the world model constraints as exploited in Step B are in fact minimal constraints\nunder which the inclusion relations can be shown to be proper. Of course, if such a countermodel consists of one possible world only, nothing \nneeds to be shown. \n\\end{description}\n\nNote that the entire process sketched above, that is the schematic Steps A-D, could be fully automated, meaning that the formulation of the lemmata and theorems\nin each step could be obtained automatically by analyzing and converting Nitpick's output.\nIn our experiments we still wrote and invoked the verification of each link in the \nmodal cube manually however. Clearly, automation facilities could be very useful for the exploration of the meta-theory of other logics, for\nexample, conditional logics~\\cite{IJCAI}, since the overall methodology is obviously transferable to other logics of interest.\n\\<close>\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n          edge [bend left] node {} (i_2)\n    (i_2) edge [bend left] node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\n\nsubsubsection \\<open> K4 $>$ K \\<close>\n\nlemma C1_A: \"\\<forall>R. trans R\" nitpick oops\ntheorem C1_B: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. trans R)\" by (simp add:trans_def, force)\nlemma C1_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. trans R)\" by (metis (lifting, full_types) trans_def) \n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_2) edge [loop above] node {} ()\n          edge node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\n\nsubsubsection \\<open> K5 $>$ K \\<close>\n\nlemma C2_A: \"\\<forall>R. eucl R\" nitpick oops\ntheorem C2_B: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. eucl R)\" by (simp add:eucl_def, force)\nlemma C2_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. eucl R)\" by (metis (lifting, full_types) eucl_def) \n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_2) edge node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\n\nsubsubsection \\<open> KB $>$ K \\<close>\n\nlemma C3_A: \"\\<forall>R. sym R\" nitpick oops\ntheorem C3_B: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. sym R)\" by (simp add:sym_def, force)\nlemma C3_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. sym R)\" by (metis (full_types) sym_def) \n\nsubsubsection \\<open> K45 $>$ K4 \\<close>\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [bend left] node {} (i_2)\n    (i_2) edge [bend left] node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\n\nlemma C4_A: \"\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> eucl R)\" nitpick oops\nlemma C4_B_Isabelle_challenge: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> eucl R))\"  \n  sledgehammer oops\ntheorem C4_C: \"#\\<^sup>2 i1 i2  \\<and> \\<not>r i1 i1 \\<and> r i1 i2 \\<and> r i2 i1 \\<and> \\<not>r i2 i2 \\<longrightarrow> \\<not> (ser r \\<longrightarrow> (ser r \\<and> eucl r))\" \n by (metis ser_def eucl_def)\nlemma C4_D: \"#\\<^sup>1 i1  \\<longrightarrow> (\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> eucl R))\" by (metis (full_types) eucl_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$};\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> K45 $>$ K5 \\<close>\n\nlemma C5_A: \"\\<forall>R. eucl R \\<longrightarrow> (ser R \\<and> eucl R)\" \n nitpick oops\nlemma C5_B_Isabelle_challenge: \"#\\<^sup>1 i1 \\<longrightarrow> \\<not> (\\<forall>R. (eucl R) \\<longrightarrow> (ser R) \\<and> (eucl R))\" \n  sledgehammer oops\ntheorem C5_C: \"#\\<^sup>1 i1 \\<and> \\<not>r i1 i1 \\<longrightarrow> \\<not> (eucl r \\<longrightarrow> (ser r \\<and> eucl r))\" by (metis (full_types) eucl_def ser_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} () \n          edge [bend left] node {} (i_2) \n    (i_2) edge [bend left] node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> KB5 $>$ KB \\<close>\n\nlemma C6_A: \"\\<forall>R. sym R \\<longrightarrow> (sym R \\<and> eucl R)\" \n nitpick oops\nlemma C6_B: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. sym R \\<longrightarrow> (sym R \\<and> eucl R))\"\n  by (metis (full_types) A4 B8 C1_B IV_def sym_def) \ntheorem C6_C: \"#\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> r i1 i2 \\<and> r i2 i1 \\<and> \\<not> r i2 i2 \\<longrightarrow> \\<not> (sym r \\<longrightarrow> (sym r \\<and> eucl r))\" \n  by (metis (full_types) eucl_def sym_def) \nlemma C6_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. sym R \\<longrightarrow> (sym R \\<and> eucl R))\"\n by (metis (full_types) eucl_def)\n\ntext \\<open>\n\\begin{isbfig}{8em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n    (i_2) edge node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> KB5 $>$ K45 \\<close>\n\nlemma C7_A: \"\\<forall>R. ser R \\<and> eucl R \\<longrightarrow> (sym R \\<and> eucl R)\" \n nitpick oops\nlemma C7_B_Isabelle_challenge: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. ser R \\<and> eucl R \\<longrightarrow> (sym R \\<and> eucl R))\"\n  sledgehammer oops \ntheorem C7_C: \"#\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> \\<not> r i1 i2 \\<and> r i2 i1 \\<and> \\<not> r i2 i2 \\<longrightarrow> \\<not> (ser r \\<and> eucl r \\<longrightarrow> (sym r \\<and> eucl r))\" \n by (metis (full_types) ser_def eucl_def sym_def)\nlemma C7_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. ser R \\<and> eucl R \\<longrightarrow> (sym R \\<and> eucl R))\" by (metis (full_types) sym_def) \n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\n\nsubsubsection \\<open> D $>$ K \\<close>\n\nlemma C8_A: \"\\<forall>R. ser R\" nitpick oops\nlemma C8_B: \"#\\<^sup>1 i1 \\<longrightarrow> \\<not>(\\<forall>R. (ser R))\" by (simp add:ser_def, force)\ntheorem C8_C: \"#\\<^sup>1 i1 \\<and> \\<not>r i1 i1 \\<longrightarrow> \\<not>(ser r)\" by (metis (full_types) ser_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> D4 $>$ K4 \\<close>\n\nlemma C9_A: \"\\<forall>R. trans R \\<longrightarrow> (ser R \\<and> trans R)\" \n nitpick oops\ntheorem C9_B: \"#\\<^sup>1 i1 \\<longrightarrow> \\<not> (\\<forall>R. trans R \\<longrightarrow> (ser R \\<and> trans R))\" \n using C1_D C8_B by blast \ntheorem C9_C: \"#\\<^sup>1 i1 \\<and> \\<not> r i1 i1 \\<longrightarrow> \\<not> (trans r \\<longrightarrow> (ser r \\<and> trans r))\" \n by (metis (full_types) ser_def trans_def) \n \n\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> D5 $>$ K5 \\<close>\nlemma C10_A: \"\\<forall>R. eucl R \\<longrightarrow> (ser R \\<and> eucl R)\" nitpick oops\ntheorem C10_B: \"#\\<^sup>1 i1  \\<longrightarrow> \\<not> (\\<forall>R. eucl R \\<longrightarrow> (ser R \\<and> eucl R))\" using B9 C3_D C9_B by blast \ntheorem C10_C: \"#\\<^sup>1 i1 \\<and> \\<not> r i1 i1 \\<longrightarrow> \\<not> (eucl r \\<longrightarrow> (ser r \\<and> eucl r))\" by (metis (full_types) ser_def eucl_def) \n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ();\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> D45 $>$ K45 \\<close>\n\nlemma C11_A: \"\\<forall>R. trans R \\<and> eucl R \\<longrightarrow> (ser R \\<and> trans R \\<and> eucl R)\" \n nitpick oops\ntheorem C11_B: \"#\\<^sup>1 i1 \\<longrightarrow> \\<not> (\\<forall>R. trans R \\<and> eucl R \\<longrightarrow> (ser R \\<and> trans R \\<and> eucl R))\"\n  using B9 C3_D C9_B by blast \ntheorem C11_C: \"#\\<^sup>1 i1 \\<and> \\<not> r i1 i1 \\<longrightarrow> \\<not> (trans r \\<and> eucl r \\<longrightarrow> (ser r \\<and> trans r \\<and> eucl r))\" by (metis (full_types) ser_def eucl_def trans_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\n\nsubsubsection \\<open> DB $>$ KB \\<close>\n\nlemma C12_A: \"\\<forall>R. sym R \\<longrightarrow> (ser R \\<and> sym R)\" \n nitpick oops\ntheorem C12_B: \"#\\<^sup>1 i1 \\<longrightarrow> \\<not> (\\<forall>R. sym R \\<longrightarrow> (ser R \\<and> sym R))\" \n using C11_B C3_D by blast \ntheorem C12_easy: \"#\\<^sup>1 i1  \\<and> \\<not> r i1 i1 \\<longrightarrow> \\<not> (sym r \\<longrightarrow> (ser r \\<and> sym r))\" by (metis (full_types) ser_def sym_def) \n\ntext \\<open> \n\\begin{isbfig}{9em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> S5 $>$ KB5 \\<close>\nlemma C13_A: \"\\<forall>R. sym R \\<and> eucl R \\<longrightarrow> (refl R \\<and> eucl R)\" \n nitpick oops\ntheorem C13_B: \"#\\<^sup>1 i1 \\<longrightarrow> \\<not> (\\<forall>R. sym R \\<and> eucl R \\<longrightarrow> (refl R \\<and> eucl R))\" using B5 C12_B C6_D by blast \ntheorem C13_C: \"#\\<^sup>1 i1 \\<and> \\<not> r i1 i1 \\<longrightarrow> \\<not> (sym r \\<and> eucl r \\<longrightarrow> (refl r \\<and> eucl r))\" by (metis (full_types) sym_def eucl_def refl_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n          edge [bend left] node {} (i_2)\n    (i_2) edge [bend left] node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> D4 $>$ D \\<close>\n\nlemma C14_A: \"\\<forall>R. (ser R) \\<longrightarrow> (ser R) \\<and> (trans R)\" \n nitpick oops\ntheorem C14_B: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not>(\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> trans R))\"\n  by (metis (full_types) C1_B trans_def ser_def) \ntheorem C14_easy: \"#\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> r i1 i2 \\<and> r i2 i1 \\<and> \\<not>r i2 i2 \\<longrightarrow> \\<not> (ser r \\<longrightarrow> (ser r \\<and> trans r))\" by (metis ser_def trans_def)\nlemma C14_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> trans R))\" by (metis (full_types) trans_def) \n\nsubsubsection \\<open> D5 $>$ D \\<close>\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n    (i_2) edge [loop above] node {} () \n          edge node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nlemma C15_A: \"\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> eucl R)\" \n nitpick oops\ntheorem C15_B_Isabelle_challenge: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> eucl R))\"\n  by (metis (full_types) C14_B trans_def eucl_def) \ntheorem C15_C: \"#\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> r i1 i2 \\<and> r i2 i1 \\<and> \\<not> r i2 i2 \\<longrightarrow> \\<not> (ser r \\<longrightarrow> (ser r \\<and> eucl r))\" by (metis ser_def eucl_def) \nlemma C15_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> eucl R))\" by (metis (full_types) C2_D)\n\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} () \n          edge node {} (i_2)\n    (i_2) edge [loop above] node {} ();\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> DB $>$ D \\<close>\nlemma C16_A: \"\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> sym R)\" \n nitpick oops\n\nlemma C16_B: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> sym R))\" by (simp add:ser_def sym_def, force) \nlemma C16_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. ser R \\<longrightarrow> (ser R \\<and> sym R))\" by (metis (full_types) sym_def) \n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n          edge node {} (i_2)\n    (i_2) edge [loop above] node {} ();\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> D45 $>$ D4 \\<close>\n\nlemma C17_A: \"\\<forall>R. ser R \\<and> trans R \\<longrightarrow> (ser R \\<and> trans R \\<and> eucl R)\"\n nitpick oops\n\nlemma C17_B_ATP_challenge: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not>(\\<forall>R. ser R \\<and> trans R \\<longrightarrow> (ser R \\<and> trans R \\<and> eucl R))\"\n sledgehammer oops \ntheorem C17_C: \"#\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> r i1 i2 \\<and> \\<not> r i2 i1 \\<and> r i2 i2 \\<longrightarrow> \\<not> (ser r \\<and> trans r \\<longrightarrow> (ser r \\<and> trans r \\<and> eucl r))\" \n by (metis (full_types) ser_def trans_def eucl_def)\nlemma C17_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. ser R \\<and> trans R \\<longrightarrow> (ser R \\<and> trans R \\<and> eucl R))\"\n by (metis (full_types) eucl_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n   \\node[state] (i_3) [right=of i_2] {$i_3$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n          edge [bend left] node {} (i_2) \n    (i_2) edge [loop above] node {} () \n          edge [bend left] node {} (i_1) \n    (i_3) edge node {} (i_2);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> D45 $>$ D5 \\<close>\n\nlemma C18_A: \"\\<forall>R. ser R \\<and> eucl R \\<longrightarrow> (ser R \\<and> trans R \\<and> eucl R)\"\n nitpick oops\n\nlemma C18_ATP_challenge: \"#\\<^sup>3 i1 i2 i3 \\<longrightarrow> \\<not> (\\<forall>R. ser R \\<and> eucl R \\<longrightarrow> (ser R \\<and> trans R \\<and> eucl R))\"\n sledgehammer oops \ntheorem C18_C: \"#\\<^sup>3 i1 i2 i3 \\<and> r i1 i1 \\<and> r i1 i2 \\<and> \\<not> r i1 i3 \\<and> r i2 i1 \\<and> r i2 i2 \\<and> \\<not> r i2 i3 \\<and> \\<not> r i3 i1 \\<and> r i3 i2 \\<and> \\<not> r i3 i3  \\<longrightarrow> \\<not> (ser r \\<and> eucl r \\<longrightarrow> (ser r \\<and> trans r \\<and> eucl r))\" by (metis (full_types) eucl_def ser_def trans_def)\nlemma C18_D: \"#\\<^sup>2 i1 i2 \\<longrightarrow> (\\<forall>R. ser R \\<and> eucl R \\<longrightarrow> (ser R \\<and> trans R \\<and> eucl R))\"\n by (metis (full_types) eucl_def trans_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n    (i_2) edge node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> M $>$ D \\<close>\n\nlemma C19_A: \"\\<forall>R. ser R \\<longrightarrow> refl R\" \n nitpick oops\ntheorem C19_B_Isabelle_challenge: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. ser R \\<longrightarrow> refl R)\"\n  by (metis (full_types) C14_B trans_def refl_def) \ntheorem C19_C: \"#\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> \\<not> r i1 i2 \\<and> r i2 i1 \\<and> \\<not> r i2 i2 \\<longrightarrow> \\<not> (ser r \\<longrightarrow> refl r)\" by (metis ser_def refl_def) \nlemma C19_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. ser R \\<longrightarrow> refl R)\" by (metis (full_types) ser_def refl_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n    (i_2) edge node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> S4 $>$ D4 \\<close>\nlemma C20_A: \"\\<forall>R. ser R \\<and> trans R \\<longrightarrow> (refl R \\<and> trans R)\"\n nitpick oops\n\nlemma C20_B_Isabelle_challenge: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. ser R \\<and> trans R \\<longrightarrow> (refl R \\<and> trans R))\"\n  sledgehammer oops\ntheorem C20_C: \"#\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> \\<not> r i1 i2 \\<and> r i2 i1 \\<and> \\<not> r i2 i2 \\<longrightarrow> \\<not> (ser r \\<and> trans r \\<longrightarrow> (refl r \\<and> trans r))\" \n by (metis (full_types) ser_def refl_def trans_def)\nlemma C20_D: \"#\\<^sup>1 i1  \\<longrightarrow> (\\<forall>R. ser R \\<and> trans R \\<longrightarrow> (refl R \\<and> trans R))\"\n by (metis (full_types) ser_def refl_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n    (i_2) edge node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\nsubsubsection \\<open> S5 $>$ D45 \\<close>\nlemma C21_A: \"\\<forall>R. ser R \\<and> trans R \\<and> eucl R \\<longrightarrow> (refl R \\<and> eucl R)\" \n nitpick oops\n\nlemma C21_B_Isabelle_challenge: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. ser R \\<and> trans R \\<and> eucl R \\<longrightarrow> (refl R \\<and> eucl R))\"\n  sledgehammer oops\ntheorem C21_C: \"#\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> \\<not> r i1 i2 \\<and> r i2 i1 \\<and> \\<not> r i2 i2 \\<longrightarrow> \\<not> (ser r \\<and> trans r \\<and> eucl r \\<longrightarrow> (refl r \\<and> eucl r))\" \n by (metis (full_types) ser_def trans_def eucl_def refl_def)\nlemma C21_inclusion: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. ser R \\<and> trans R \\<and> eucl R \\<longrightarrow> (refl R \\<and> eucl R))\"\n by (metis (full_types) ser_def refl_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} () \n          edge [bend left] node {} (i_2)\n    (i_2) edge [bend left] node {} (i_1);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\n\nsubsubsection \\<open> B $>$ DB \\<close>\n\nlemma C22_A: \"\\<forall>R. ser R \\<and> sym R \\<longrightarrow> (refl R \\<and> sym R)\" \n nitpick oops\nlemma C22_B_Isabelle_challenge: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. ser R \\<and> sym R \\<longrightarrow> (refl R \\<and> sym R))\"\n by (smt C14_B sym_def trans_def refl_def)\ntheorem C22_C: \"#\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> r i1 i2 \\<and> r i2 i1 \\<and> \\<not> r i2 i2 \\<longrightarrow> \\<not> (ser r \\<and> sym r \\<longrightarrow> (refl r \\<and> sym r))\" \n by (metis (full_types) ser_def sym_def refl_def)\nlemma C22_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. ser R \\<and> sym R \\<longrightarrow> (refl R \\<and> sym R))\"\n by (metis (full_types) ser_def refl_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} () \n          edge node {} (i_2) \n    (i_2) edge [loop above] node {} ();\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\n\nsubsubsection \\<open> B $>$ M \\<close>\n\nlemma C23_A: \"\\<forall>R. refl R \\<longrightarrow> (refl R \\<and> sym R)\" nitpick oops\nlemma C23_B_ATP_challenge: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. refl R \\<longrightarrow> (refl R \\<and> sym R))\"\n sledgehammer oops \ntheorem C23_C: \"#\\<^sup>2 i1 i2  \\<and> r i1 i1 \\<and> r i1 i2 \\<and> \\<not> r i2 i1 \\<and> r i2 i2  \\<longrightarrow> \\<not> (refl r \\<longrightarrow> (refl r \\<and> sym r))\" \n by (metis refl_def sym_def)\nlemma C23_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. refl R \\<longrightarrow> (refl R \\<and> sym R))\" by (metis (full_types) sym_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} ()\n          edge node {} (i_2)\n    (i_2) edge [loop above] node {} ();\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\n\nsubsubsection \\<open> S5 $>$ S4 \\<close>\n\nlemma C24_A: \"\\<forall>R. refl R \\<and> trans R \\<longrightarrow> (refl R \\<and> eucl R)\"\n nitpick oops\n\nlemma C24_B_ATP_challenge: \"#\\<^sup>2 i1 i2 \\<longrightarrow> \\<not> (\\<forall>R. refl R \\<and> trans R \\<longrightarrow> (refl R \\<and> eucl R))\"\n sledgehammer oops \ntheorem C24_C: \"#\\<^sup>2 i1 i2 \\<and> r i1 i1 \\<and> r i1 i2 \\<and> \\<not> r i2 i1 \\<and> r i2 i2 \\<longrightarrow> \\<not> (refl r \\<and> trans r \\<longrightarrow> (refl r \\<and> eucl r))\" \n by (metis (full_types) trans_def refl_def eucl_def)\nlemma C24_D: \"#\\<^sup>1 i1 \\<longrightarrow> (\\<forall>R. refl R \\<and> trans R \\<longrightarrow> (refl R \\<and> eucl R))\" by (metis (full_types) eucl_def)\n\ntext \\<open> \n\\begin{isbfig}{7em}\n\\begin{tikzpicture}[shorten >=1pt,node distance=2cm,on grid,auto] \n   \\node[state] (i_1)   {$i_1$}; \n   \\node[state] (i_2) [right=of i_1] {$i_2$}; \n   \\node[state] (i_3) [right=of i_2] {$i_3$}; \n    \\path[->] \n    (i_1) edge [loop above] node {} () \n          edge [bend left] node {} (i_2) \n    (i_2) edge [loop above] node {} () \n          edge [bend left] node {} (i_1) \n          edge [bend left] node {} (i_3) \n    (i_3) edge [loop above] node {} () \n          edge [bend left] node {} (i_2);\n\\end{tikzpicture}\n\\end{isbfig}\n\\<close>\n\nsubsubsection \\<open> S5 $>$ B \\<close>\nlemma C25_A: \"\\<forall>R. refl R \\<and> sym R \\<longrightarrow> (refl R \\<and> eucl R)\"\n nitpick oops\n\nlemma C25_B_ATP_challenge: \"#\\<^sup>3 i1 i2 i3 \\<longrightarrow> \\<not> (\\<forall>R. (refl R \\<and> sym R) \\<longrightarrow> (refl R \\<and> eucl R))\"\n sledgehammer oops \ntheorem C25_C: \"#\\<^sup>3 i1 i2 i3 \\<and> r i1 i1 \\<and> r i1 i2 \\<and> \\<not> r i1 i3 \\<and> r i2 i1 \\<and> r i2 i2 \\<and> r i2 i3 \\<and> \\<not> r i3 i1 \\<and> r i3 i2 \\<and> r i3 i3  \\<longrightarrow> \\<not> ((refl r \\<and> sym r) \\<longrightarrow> (refl r \\<and> eucl r))\" \n by (metis (full_types) eucl_def refl_def sym_def)\nlemma C25_D: \"#\\<^sup>2 i1 i2 \\<longrightarrow> (\\<forall>R. (refl R \\<and> sym R) \\<longrightarrow> (refl R \\<and> eucl R))\"\n by (metis (full_types) refl_def sym_def eucl_def)\n\nsection \\<open> Discussion and Future Work. \\label{sec:eval} \\<close>\n\ntext \\<open> \nThe entire Isabelle document can be verified by Isabelle2014 in less than 60s on a semi-modern computer (2.4 GHz Core 2 Duo, 8 GB of memory).\nWhen including all (commented) remote calls to the external ATPs in the calculation the verification time sums up to a few minutes,\nwhich is still very reasonable. \n\nThe improvements in comparison to the first-order based verification of the modal logic cube done\nearlier by Rabe et al.~\\cite{Rabe}, are: clarity and readability of the problem encodings, methodology,\nreliability (our proofs are verifiable in Isabelle/HOL) and, most importantly, automation performance.\nFor the latter note that the experiments by Rabe et al.~\\cite{Rabe} required several days of reasoning \ntime in first-order theorem provers. Most importantly, however, their solution relied on an\nenormous manual coding effort. However, we want to point again to the more general aims of their work.\n\nOur solution instead requires a small amount of resources in comparison. In fact, as indicated before, \nthe entire process (Steps A-D) is schematic, so that it should eventually be possible to fully automate our method.\nFor this it would be beneficial to have a flexible and accessible\nconversion of the countermodels delivered by Nitpick back into Isabelle/HOL input syntax.\nIn fact, an automated conversion of Nitpick's countermodels into the corresponding @{text \"C*_B\"} \nand @{text \"C*_C\"} conjectures would eventually enable a truly automated exploration and verification of \nof the modal logic cube with no or minimal handcoding effort.\nSimilarly, for the interactive user a \nmore intuitive presentation of Nitpick's countermodels would be welcome (perhaps similar to the illustrations we used \nin this paper).\n\n\nUsing the first-order provers E \\cite{E}, SPASS \\cite{SPASS}, Z3 \\cite{Z3} and Vampire \\cite{Vampire} proved unsuccessful for \nall @{text \"C*_Isabelle_challenge\"} problems (unless the right lemmas were given to them). Analyzing the reason for their weakness, as compared to the better performing higher-order automated theorem provers,\nremains future work. In contrast, the SMT  solver CVC4 (via Sledgehammer) was quite successful \nand contributed five @{text \"C*_Isabelle_challenge\"} proofs.\n\n\nOur work motivates further improvements regarding the integration of LEO-II and Satallax: While these systems\n are able to prove all @{text \"*_Isabelle_challenge\"} problems their proofs cannot yet be easily replayed or integrated \nin Isabelle/HOL. There have been recent improvements regarding the transformation of proofs from LEO-II and Satallax to \nIsabelle/HOL \\cite{sultana14:_higher}, using which all the proofs produced by Satallax and LEO-II in\nour work could be checked in Isabelle/HOL,\\footnote{The proofs and the evaluation workflow can be downloaded from \\url{http://christoph-benzmueller.de/papers/pxtp2015-eval.zip}}\nbut this process still requires some manual work to adapt the output from the ATPs.\n\nOur work also motivates further improvements in higher-order automated theorem provers. For example, for these\nsystems it should be possible to also prove the remaining two @{text \"*_ATP_challenge\"} problems.\nMoreover, they needed more than 10 seconds of CPU time in our experiments\nfor the @{text \"*_Isabelle_challenge\"} problems; it should be possible to prove these theorems much faster.\n \n\\<close>\n\nsection \\<open> Conclusion \\label{sec:conc} \\<close>\n\ntext \\<open>\nWe have fully verified the modal logic cube in Isabelle/HOL. Our solution is simple, elegant, easy to follow, effective \nand efficient. Proof exchange between systems played a crucial role in our experiments. In particular, we have exploited and combined Nitpick's \ncountermodel-finding capabilities with subsequent calls to the higher-order theorem provers LEO-II and Satallax and the SMT solver\nCVC4 via Isabelle's Sledgehammer tool. \nOur experiments also point to several improvement opportunities for Isabelle and the higher-order reasoners, in particular, \nregarding interaction and proof exchange.\n\nRelated experiments have been\ncarried out earlier in collaboration with Geoff Sutcliffe. Similar to\nand improving on the\nwork reported in \\cite{B12}, these unpublished experiments used the TPTP\nTHF infrastructure directly. However, in that work we did not achieve\na `trusted verification' in the sense of the work presented in this paper.\nAnother improvement in this article has been the use of schematic meta-level\nworking steps (Steps A-D) to systematically convert (counter)models found\nby Nitpick into conjectures to be investigated. \n\nFuture work will explore and evaluate similar logic relationships for other non-classical logics, for example, \nconditional logics. Any improvements in the mentioned systems, as motivated above, would be very beneficial\ntowards this planned work. Moreover, it would be useful to fully automate the schematic, meta-level working steps (Steps A-D) as\napplied in our experiments. This would produce a system that would explore\nlogic relations truly automatically (for example, in conditional logics), analogous to what has been achieved here for the modal logic cube.\n\\<close>\n\n\ntext \\<open> \\paragraph{Acknowledgements:} We thank Florian Rabe and the anonymous reviewers of this paper \nfor their valuable feedback.  \\<close>\n\n\n\nend\n\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/Deontic-Logics/cube-ddl/mcube/ModalCube.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.6076631698328916, "lm_q1q2_score": 0.3345838170744818}}
{"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\<open>Simple Kan extensions\\<close>\ntheory CZH_UCAT_Kan\n  imports \n    CZH_Elementary_Categories.CZH_ECAT_Comma\n    CZH_UCAT_Adjoints\nbegin\n\n\n\nsubsection\\<open>Background\\<close>\n\nnamed_theorems cat_Kan_cs_simps\nnamed_theorems cat_Kan_cs_intros\n\n\n\nsubsection\\<open>Kan extension\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\n\ntext\\<open>See Chapter X-3 in \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close>.\\<close>\n\nlocale is_cat_rKe = \n  AG: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> + \n  Ran: is_functor \\<alpha> \\<CC> \\<AA> \\<GG> +\n  ntcf_rKe: is_ntcf \\<alpha> \\<BB> \\<AA> \\<open>\\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<TT> \\<epsilon>\n  for \\<alpha> \\<BB> \\<CC> \\<AA> \\<KK> \\<TT> \\<GG> \\<epsilon> +\n  assumes cat_rKe_ua_fo:\n    \"universal_arrow_fo\n      (exp_cat_cf \\<alpha> \\<AA> \\<KK>)\n      (cf_map \\<TT>)\n      (cf_map \\<GG>)\n      (ntcf_arrow \\<epsilon>)\"\n\nsyntax \"_is_cat_rKe\" :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> bool\"\n  (\\<open>(_ :/ _ \\<circ>\\<^sub>C\\<^sub>F _ \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<index> _ :/ _ \\<mapsto>\\<^sub>C _ \\<mapsto>\\<^sub>C _)\\<close> [51, 51, 51, 51, 51, 51, 51] 51)\ntranslations \"\\<epsilon> : \\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<TT> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C \\<AA>\" \\<rightleftharpoons> \n  \"CONST is_cat_rKe \\<alpha> \\<BB> \\<CC> \\<AA> \\<KK> \\<TT> \\<GG> \\<epsilon>\"\n\nlocale is_cat_lKe =\n  AG: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> +\n  Lan: is_functor \\<alpha> \\<CC> \\<AA> \\<FF> +\n  ntcf_lKe: is_ntcf \\<alpha> \\<BB> \\<AA> \\<TT> \\<open>\\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<eta>\n  for \\<alpha> \\<BB> \\<CC> \\<AA> \\<KK> \\<TT> \\<FF> \\<eta> +\n  assumes cat_lKe_ua_fo:\n    \"universal_arrow_fo\n      (exp_cat_cf \\<alpha> (op_cat \\<AA>) (op_cf \\<KK>))\n      (cf_map \\<TT>)\n      (cf_map \\<FF>)\n      (ntcf_arrow (op_ntcf \\<eta>))\"\n\nsyntax \"_is_cat_lKe\" :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> bool\"\n  (\\<open>(_ :/ _ \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<index> _ \\<circ>\\<^sub>C\\<^sub>F _ :/ _ \\<mapsto>\\<^sub>C _ \\<mapsto>\\<^sub>C _)\\<close> [51, 51, 51, 51, 51, 51, 51] 51)\ntranslations \"\\<eta> : \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C \\<AA>\" \\<rightleftharpoons> \n  \"CONST is_cat_lKe \\<alpha> \\<BB> \\<CC> \\<AA> \\<KK> \\<TT> \\<FF> \\<eta>\"\n\n\ntext\\<open>Rules.\\<close>\n\nlemma (in is_cat_rKe) is_cat_rKe_axioms'[cat_Kan_cs_intros]:\n  assumes \"\\<alpha>' = \\<alpha>\"\n    and \"\\<GG>' = \\<GG>\"\n    and \"\\<KK>' = \\<KK>\"\n    and \"\\<TT>' = \\<TT>\"\n    and \"\\<BB>' = \\<BB>\"\n    and \"\\<AA>' = \\<AA>\"\n    and \"\\<CC>' = \\<CC>\"\n  shows \"\\<epsilon> : \\<GG>' \\<circ>\\<^sub>C\\<^sub>F \\<KK>' \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>'\\<^esub> \\<TT>' : \\<BB>' \\<mapsto>\\<^sub>C \\<CC>' \\<mapsto>\\<^sub>C \\<AA>'\"\n  unfolding assms by (rule is_cat_rKe_axioms)\n\nmk_ide rf is_cat_rKe_def[unfolded is_cat_rKe_axioms_def]\n  |intro is_cat_rKeI|\n  |dest is_cat_rKeD[dest]|\n  |elim is_cat_rKeE[elim]|\n\nlemmas [cat_Kan_cs_intros] = is_cat_rKeD(1-3)\n\nlemma (in is_cat_lKe) is_cat_lKe_axioms'[cat_Kan_cs_intros]:\n  assumes \"\\<alpha>' = \\<alpha>\"\n    and \"\\<FF>' = \\<FF>\"\n    and \"\\<KK>' = \\<KK>\"\n    and \"\\<TT>' = \\<TT>\"\n    and \"\\<BB>' = \\<BB>\"\n    and \"\\<AA>' = \\<AA>\"\n    and \"\\<CC>' = \\<CC>\"\n  shows \"\\<eta> : \\<TT>' \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<FF>' \\<circ>\\<^sub>C\\<^sub>F \\<KK>' : \\<BB>' \\<mapsto>\\<^sub>C \\<CC>' \\<mapsto>\\<^sub>C \\<AA>'\"\n  unfolding assms by (rule is_cat_lKe_axioms)\n\nmk_ide rf is_cat_lKe_def[unfolded is_cat_lKe_axioms_def]\n  |intro is_cat_lKeI|\n  |dest is_cat_lKeD[dest]|\n  |elim is_cat_lKeE[elim]|\n\nlemmas [cat_Kan_cs_intros] = is_cat_lKeD(1-3)\n\n\ntext\\<open>Duality.\\<close>\n\nlemma (in is_cat_rKe) is_cat_lKe_op:\n  \"op_ntcf \\<epsilon> :\n    op_cf \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> op_cf \\<GG> \\<circ>\\<^sub>C\\<^sub>F op_cf \\<KK> :\n    op_cat \\<BB> \\<mapsto>\\<^sub>C op_cat \\<CC> \\<mapsto>\\<^sub>C op_cat \\<AA>\"\n  by (intro is_cat_lKeI, unfold cat_op_simps; (intro cat_rKe_ua_fo)?)\n    (cs_concl cs_shallow cs_simp: cat_op_simps cs_intro: cat_op_intros)+\n\nlemma (in is_cat_rKe) is_cat_lKe_op'[cat_op_intros]:\n  assumes \"\\<TT>' = op_cf \\<TT>\"\n    and \"\\<GG>' = op_cf \\<GG>\"\n    and \"\\<KK>' = op_cf \\<KK>\"\n    and \"\\<BB>' = op_cat \\<BB>\"\n    and \"\\<AA>' = op_cat \\<AA>\"\n    and \"\\<CC>' = op_cat \\<CC>\"\n  shows \"op_ntcf \\<epsilon> : \\<TT>' \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<GG>' \\<circ>\\<^sub>C\\<^sub>F \\<KK>' : \\<BB>' \\<mapsto>\\<^sub>C \\<CC>' \\<mapsto>\\<^sub>C \\<AA>'\"\n  unfolding assms by (rule is_cat_lKe_op)\n\nlemmas [cat_op_intros] = is_cat_rKe.is_cat_lKe_op'\n\nlemma (in is_cat_lKe) is_cat_rKe_op:\n  \"op_ntcf \\<eta> :\n    op_cf \\<FF> \\<circ>\\<^sub>C\\<^sub>F op_cf \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> op_cf \\<TT> :\n    op_cat \\<BB> \\<mapsto>\\<^sub>C op_cat \\<CC> \\<mapsto>\\<^sub>C op_cat \\<AA>\"\n  by (intro is_cat_rKeI, unfold cat_op_simps; (intro cat_lKe_ua_fo)?)\n    (cs_concl cs_shallow cs_simp: cat_op_simps cs_intro: cat_op_intros)+\n\nlemma (in is_cat_lKe) is_cat_lKe_op'[cat_op_intros]:\n  assumes \"\\<TT>' = op_cf \\<TT>\"\n    and \"\\<FF>' = op_cf \\<FF>\"\n    and \"\\<KK>' = op_cf \\<KK>\"\n    and \"\\<BB>' = op_cat \\<BB>\"\n    and \"\\<AA>' = op_cat \\<AA>\"\n    and \"\\<CC>' = op_cat \\<CC>\"\n  shows \"op_ntcf \\<eta> : \\<FF>' \\<circ>\\<^sub>C\\<^sub>F \\<KK>' \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<TT>' : \\<BB>' \\<mapsto>\\<^sub>C \\<CC>' \\<mapsto>\\<^sub>C \\<AA>'\"\n  unfolding assms by (rule is_cat_rKe_op)\n\nlemmas [cat_op_intros] = is_cat_lKe.is_cat_lKe_op'\n\n\ntext\\<open>Elementary properties.\\<close>\n\nlemma (in is_cat_rKe) cat_rKe_exp_cat_cf_cat_FUNCT_is_arr:\n  assumes \"\\<Z> \\<beta>\" and \"\\<alpha> \\<in>\\<^sub>\\<circ> \\<beta>\"\n  shows \"exp_cat_cf \\<alpha> \\<AA> \\<KK> : cat_FUNCT \\<alpha> \\<CC> \\<AA> \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>i\\<^sub>n\\<^sub>y\\<^bsub>\\<beta>\\<^esub> cat_FUNCT \\<alpha> \\<BB> \\<AA>\"\n  by \n    ( \n      rule exp_cat_cf_is_tiny_functor[\n        OF assms Ran.HomCod.category_axioms AG.is_functor_axioms\n        ]\n    )\n\nlemma (in is_cat_lKe) cat_lKe_exp_cat_cf_cat_FUNCT_is_arr:\n  assumes \"\\<Z> \\<beta>\" and \"\\<alpha> \\<in>\\<^sub>\\<circ> \\<beta>\"\n  shows \"exp_cat_cf \\<alpha> \\<AA> \\<KK> : cat_FUNCT \\<alpha> \\<CC> \\<AA> \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>i\\<^sub>n\\<^sub>y\\<^bsub>\\<beta>\\<^esub> cat_FUNCT \\<alpha> \\<BB> \\<AA>\"\n  by \n    ( \n      rule exp_cat_cf_is_tiny_functor[\n        OF assms Lan.HomCod.category_axioms AG.is_functor_axioms\n        ]\n    )\n\n\nsubsubsection\\<open>Universal property\\<close>\n\n\ntext\\<open>\nSee Chapter X-3 in \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close> and \n\\<^cite>\\<open>\"noauthor_wikipedia_2001\"\\<close>\\footnote{\n\\url{https://en.wikipedia.org/wiki/Kan_extension}\n}.\n\\<close>\n\nlemma is_cat_rKeI':\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<GG> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<epsilon> : \\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<And>\\<GG>' \\<epsilon>'.\n      \\<lbrakk> \\<GG>' : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>; \\<epsilon>' : \\<GG>' \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA> \\<rbrakk> \\<Longrightarrow>\n        \\<exists>!\\<sigma>. \\<sigma> : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA> \\<and> \\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\" \n  shows \"\\<epsilon> : \\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<TT> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C \\<AA>\"\nproof-\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<GG>: is_functor \\<alpha> \\<CC> \\<AA> \\<GG> by (rule assms(2))\n  interpret \\<epsilon>: is_ntcf \\<alpha> \\<BB> \\<AA> \\<open>\\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<TT> \\<epsilon> by (rule assms(3))\n  let ?\\<AA>\\<KK> = \\<open>exp_cat_cf \\<alpha> \\<AA> \\<KK>\\<close>\n    and ?\\<TT> = \\<open>cf_map \\<TT>\\<close>\n    and ?\\<GG> = \\<open>cf_map \\<GG>\\<close>\n  show ?thesis\n  proof(intro is_cat_rKeI is_functor.universal_arrow_foI assms)\n    define \\<beta> where \"\\<beta> = \\<alpha> + \\<omega>\"\n    have \"\\<Z> \\<beta>\" and \\<alpha>\\<beta>: \"\\<alpha> \\<in>\\<^sub>\\<circ> \\<beta>\" \n      by (simp_all add: \\<beta>_def \\<KK>.\\<Z>_Limit_\\<alpha>\\<omega> \\<KK>.\\<Z>_\\<omega>_\\<alpha>\\<omega> \\<Z>_def \\<KK>.\\<Z>_\\<alpha>_\\<alpha>\\<omega>)\n    then interpret \\<beta>: \\<Z> \\<beta> by simp \n    show \"?\\<AA>\\<KK> : cat_FUNCT \\<alpha> \\<CC> \\<AA> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<beta>\\<^esub> cat_FUNCT \\<alpha> \\<BB> \\<AA>\"\n      by \n        ( \n          cs_concl cs_shallow cs_intro: \n            cat_small_cs_intros \n            exp_cat_cf_is_tiny_functor[\n              OF \\<beta>.\\<Z>_axioms \\<alpha>\\<beta> \\<GG>.HomCod.category_axioms assms(1)\n              ]\n        )\n    from \\<alpha>\\<beta> assms(2) show \"cf_map \\<GG> \\<in>\\<^sub>\\<circ> cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<lparr>Obj\\<rparr>\"\n      unfolding cat_FUNCT_components\n      by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_FUNCT_cs_intros)\n    from assms(1-3) show \"ntcf_arrow \\<epsilon> :\n      ?\\<AA>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>?\\<GG>\\<rparr> \\<mapsto>\\<^bsub>cat_FUNCT \\<alpha> \\<BB> \\<AA>\\<^esub> ?\\<TT>\"\n      by \n        (\n          cs_concl cs_shallow\n            cs_simp: cat_Kan_cs_simps cat_FUNCT_cs_simps cat_FUNCT_components(1) \n            cs_intro: cat_FUNCT_cs_intros\n        )\n    fix \\<FF>' \\<epsilon>' assume prems: \n      \"\\<FF>' \\<in>\\<^sub>\\<circ> cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<lparr>Obj\\<rparr>\"\n      \"\\<epsilon>' : ?\\<AA>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<FF>'\\<rparr> \\<mapsto>\\<^bsub>cat_FUNCT \\<alpha> \\<BB> \\<AA>\\<^esub> ?\\<TT>\"\n    from prems(1) have \"\\<FF>' \\<in>\\<^sub>\\<circ> cf_maps \\<alpha> \\<CC> \\<AA>\"  \n      unfolding cat_FUNCT_components(1) by simp\n    then obtain \\<FF> where \\<FF>'_def: \"\\<FF>' = cf_map \\<FF>\" and \\<FF>: \"\\<FF> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\" \n      by clarsimp\n    note \\<epsilon>' = cat_FUNCT_is_arrD[OF prems(2)]\n    from \\<epsilon>'(1) \\<FF> have \\<epsilon>'_is_ntcf: \n      \"ntcf_of_ntcf_arrow \\<BB> \\<AA> \\<epsilon>' : \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      by \n        ( \n          cs_prems  \n            cs_simp: \\<FF>'_def cat_Kan_cs_simps cat_FUNCT_cs_simps \n            cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n        )\n    from assms(4)[OF \\<FF> \\<epsilon>'_is_ntcf] obtain \\<sigma>\n      where \\<sigma>: \"\\<sigma> : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\" \n        and \\<epsilon>'_def': \"ntcf_of_ntcf_arrow \\<BB> \\<AA> \\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n        and unique_\\<sigma>: \"\\<And>\\<sigma>'. \n          \\<lbrakk> \n            \\<sigma>' : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>;\n            ntcf_of_ntcf_arrow \\<BB> \\<AA> \\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>) \n          \\<rbrakk> \\<Longrightarrow> \\<sigma>' = \\<sigma>\"\n      by metis\n    show \"\\<exists>!f'.\n      f' : \\<FF>' \\<mapsto>\\<^bsub>cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<^esub> ?\\<GG> \\<and>\n      \\<epsilon>' = umap_fo ?\\<AA>\\<KK> ?\\<TT> ?\\<GG> (ntcf_arrow \\<epsilon>) \\<FF>'\\<lparr>ArrVal\\<rparr>\\<lparr>f'\\<rparr>\"\n    proof(intro ex1I conjI; (elim conjE)?, unfold \\<FF>'_def)\n      from \\<sigma> show \"ntcf_arrow \\<sigma> : cf_map \\<FF> \\<mapsto>\\<^bsub>cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<^esub> ?\\<GG>\"\n        by (cs_concl cs_shallow cs_intro: cat_FUNCT_cs_intros)\n      from \\<alpha>\\<beta> assms(1-3) \\<sigma> \\<epsilon>'(1) show \n        \"\\<epsilon>' = umap_fo ?\\<AA>\\<KK> ?\\<TT> ?\\<GG> (ntcf_arrow \\<epsilon>) (cf_map \\<FF>)\\<lparr>ArrVal\\<rparr>\\<lparr>ntcf_arrow \\<sigma>\\<rparr>\"\n        by (subst \\<epsilon>')\n          (\n            cs_concl \n              cs_simp: \n                \\<epsilon>'_def'[symmetric] \n                cat_cs_simps \n                cat_FUNCT_cs_simps \n                cat_Kan_cs_simps \n              cs_intro: \n                cat_small_cs_intros \n                cat_cs_intros \n                cat_Kan_cs_intros\n                cat_FUNCT_cs_intros\n          )\n      fix \\<sigma>' assume prems:\n        \"\\<sigma>' : cf_map \\<FF> \\<mapsto>\\<^bsub>cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<^esub> ?\\<GG>\"\n        \"\\<epsilon>' = umap_fo ?\\<AA>\\<KK> ?\\<TT> ?\\<GG> (ntcf_arrow \\<epsilon>) (cf_map \\<FF>)\\<lparr>ArrVal\\<rparr>\\<lparr>\\<sigma>'\\<rparr>\"\n      note \\<sigma>' = cat_FUNCT_is_arrD[OF prems(1)]\n      from \\<sigma>'(1) \\<FF> have \"ntcf_of_ntcf_arrow \\<CC> \\<AA> \\<sigma>' : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n        by \n          (\n            cs_prems cs_shallow \n              cs_simp: cat_FUNCT_cs_simps cs_intro: cat_cs_intros\n          )\n      moreover from prems(2) prems(1) \\<alpha>\\<beta> assms(1-3) this \\<epsilon>'(1) have \n        \"ntcf_of_ntcf_arrow \\<BB> \\<AA> \\<epsilon>' =\n          \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (ntcf_of_ntcf_arrow \\<CC> \\<AA> \\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n        by (subst (asm) \\<epsilon>'(2))\n          (\n            cs_prems \n              cs_simp: cat_Kan_cs_simps cat_FUNCT_cs_simps cat_cs_simps \n              cs_intro: \n                cat_Kan_cs_intros\n                cat_small_cs_intros\n                cat_cs_intros\n                cat_FUNCT_cs_intros\n          )\n      ultimately have \\<sigma>_def: \"\\<sigma> = ntcf_of_ntcf_arrow \\<CC> \\<AA> \\<sigma>'\" \n        by (rule unique_\\<sigma>[symmetric])\n      show \"\\<sigma>' = ntcf_arrow \\<sigma>\"\n        by (subst \\<sigma>'(2), use nothing in \\<open>subst \\<sigma>_def\\<close>)\n          (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n    qed\n  qed\nqed\n\nlemma is_cat_lKeI':\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<FF> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<eta> : \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<And>\\<FF>' \\<eta>'.\n      \\<lbrakk> \\<FF>' : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>; \\<eta>' : \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F \\<FF>' \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA> \\<rbrakk> \\<Longrightarrow>\n        \\<exists>!\\<sigma>. \\<sigma> : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F \\<FF>' : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA> \\<and> \\<eta>' = (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\" \n  shows \"\\<eta> : \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C \\<AA>\"\nproof-\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<FF>: is_functor \\<alpha> \\<CC> \\<AA> \\<FF> by (rule assms(2))\n  interpret \\<eta>: is_ntcf \\<alpha> \\<BB> \\<AA> \\<TT> \\<open>\\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<eta> by (rule assms(3))\n  have \n    \"\\<exists>!\\<sigma>.\n      \\<sigma> : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F op_cf \\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<AA> \\<and>\n      \\<eta>' = op_ntcf \\<eta> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F op_cf \\<KK>)\"\n    if \"\\<GG>' : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<AA>\"\n      and \"\\<eta>' : \\<GG>' \\<circ>\\<^sub>C\\<^sub>F op_cf \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F op_cf \\<TT> : op_cat \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<AA>\"\n    for \\<GG>' \\<eta>'\n  proof-\n    interpret \\<GG>': is_functor \\<alpha> \\<open>op_cat \\<CC>\\<close> \\<open>op_cat \\<AA>\\<close> \\<GG>' by (rule that(1))\n    interpret \\<eta>': \n      is_ntcf \\<alpha> \\<open>op_cat \\<BB>\\<close> \\<open>op_cat \\<AA>\\<close> \\<open>\\<GG>' \\<circ>\\<^sub>C\\<^sub>F op_cf \\<KK>\\<close> \\<open>op_cf \\<TT>\\<close> \\<eta>'\n      by (rule that(2))\n    from assms(4)[\n        OF is_functor.is_functor_op[OF that(1), unfolded cat_op_simps],\n        OF is_ntcf.is_ntcf_op[OF that(2), unfolded cat_op_simps]\n        ]\n    obtain \\<sigma> where \\<sigma>: \"\\<sigma> : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F op_cf \\<GG>' : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\" \n      and op_\\<eta>'_def: \"op_ntcf \\<eta>' = \\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\"\n      and unique_\\<sigma>':\n        \"\\<lbrakk>\n          \\<sigma>' : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F op_cf \\<GG>' : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>;\n          op_ntcf \\<eta>' = \\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\n         \\<rbrakk> \\<Longrightarrow> \\<sigma>' = \\<sigma>\"\n      for \\<sigma>'\n      by metis\n    interpret \\<sigma>: is_ntcf \\<alpha> \\<CC> \\<AA> \\<FF> \\<open>op_cf \\<GG>'\\<close> \\<sigma> by (rule \\<sigma>)\n    show ?thesis\n    proof(intro ex1I conjI; (elim conjE)?)\n      show \"op_ntcf \\<sigma> : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F op_cf \\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<AA>\"\n        by (rule \\<sigma>.is_ntcf_op[unfolded cat_op_simps])\n      from op_\\<eta>'_def have \"op_ntcf (op_ntcf \\<eta>') = op_ntcf (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>)\"\n        by simp\n      from this \\<sigma> assms(1-3) show \\<eta>'_def:\n        \"\\<eta>' = op_ntcf \\<eta> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (op_ntcf \\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F op_cf \\<KK>)\"\n        by (cs_prems cs_shallow cs_simp: cat_op_simps cs_intro: cat_cs_intros)\n      fix \\<sigma>' assume prems:\n        \"\\<sigma>' : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F op_cf \\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<AA>\"\n        \"\\<eta>' = op_ntcf \\<eta> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F op_cf \\<KK>)\"\n      interpret \\<sigma>': is_ntcf \\<alpha> \\<open>op_cat \\<CC>\\<close> \\<open>op_cat \\<AA>\\<close> \\<GG>' \\<open>op_cf \\<FF>\\<close> \\<sigma>' \n        by (rule prems(1))\n      from prems(2) have \n        \"op_ntcf \\<eta>' = op_ntcf (op_ntcf \\<eta> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F op_cf \\<KK>))\"\n        by simp\n      also have \"\\<dots> = op_ntcf \\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\"   \n        by\n          (\n            cs_concl cs_shallow\n              cs_simp: cat_cs_simps cat_op_simps\n              cs_intro: cat_cs_intros cat_op_intros\n          )\n      finally have \"op_ntcf \\<eta>' = op_ntcf \\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\" by simp\n      from unique_\\<sigma>'[OF \\<sigma>'.is_ntcf_op[unfolded cat_op_simps] this] show \n        \"\\<sigma>' = op_ntcf \\<sigma>\" \n        by (auto simp: cat_op_simps)\n    qed\n  qed\n  from \n    is_cat_rKeI'\n      [\n        OF \\<KK>.is_functor_op \\<FF>.is_functor_op \\<eta>.is_ntcf_op[unfolded cat_op_simps], \n        unfolded cat_op_simps, \n        OF this\n      ]\n  interpret \\<eta>: is_cat_rKe \n    \\<alpha> \n    \\<open>op_cat \\<BB>\\<close> \n    \\<open>op_cat \\<CC>\\<close>\n    \\<open>op_cat \\<AA>\\<close> \n    \\<open>op_cf \\<KK>\\<close> \n    \\<open>op_cf \\<TT>\\<close> \n    \\<open>op_cf \\<FF>\\<close> \n    \\<open>op_ntcf \\<eta>\\<close>\n    by simp\n  show \"\\<eta> : \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C \\<AA>\"\n    by (rule \\<eta>.is_cat_lKe_op[unfolded cat_op_simps])\nqed\n\nlemma (in is_cat_rKe) cat_rKe_unique:\n  assumes \"\\<GG>' : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\" and \"\\<epsilon>' : \\<GG>' \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"\\<exists>!\\<sigma>. \\<sigma> : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA> \\<and> \\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\" \nproof-\n\n  interpret \\<GG>': is_functor \\<alpha> \\<CC> \\<AA> \\<GG>' by (rule assms(1))\n  interpret \\<epsilon>': is_ntcf \\<alpha> \\<BB> \\<AA> \\<open>\\<GG>' \\<circ>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<TT> \\<epsilon>' by (rule assms(2))\n\n  let ?\\<TT> = \\<open>cf_map \\<TT>\\<close>\n    and ?\\<GG> = \\<open>cf_map \\<GG>\\<close>\n    and ?\\<GG>' = \\<open>cf_map \\<GG>'\\<close>\n    and ?\\<epsilon> = \\<open>ntcf_arrow \\<epsilon>\\<close>\n    and ?\\<epsilon>' = \\<open>ntcf_arrow \\<epsilon>'\\<close>\n\n  define \\<beta> where \"\\<beta> = \\<alpha> + \\<omega>\"\n  have \"\\<Z> \\<beta>\" and \\<alpha>\\<beta>: \"\\<alpha> \\<in>\\<^sub>\\<circ> \\<beta>\"\n    by (simp_all add: \\<beta>_def AG.\\<Z>_Limit_\\<alpha>\\<omega> AG.\\<Z>_\\<omega>_\\<alpha>\\<omega> \\<Z>_def AG.\\<Z>_\\<alpha>_\\<alpha>\\<omega>)\n  then interpret \\<beta>: \\<Z> \\<beta> by simp\n  \n  interpret \\<AA>\\<KK>: is_tiny_functor \n    \\<beta> \\<open>cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<close> \\<open>cat_FUNCT \\<alpha> \\<BB> \\<AA>\\<close> \\<open>exp_cat_cf \\<alpha> \\<AA> \\<KK>\\<close>\n    by (rule cat_rKe_exp_cat_cf_cat_FUNCT_is_arr[OF \\<beta>.\\<Z>_axioms \\<alpha>\\<beta>])\n\n  from assms(1) have \\<GG>': \"?\\<GG>' \\<in>\\<^sub>\\<circ> cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<lparr>Obj\\<rparr>\"\n    by \n      (\n        cs_concl cs_shallow \n          cs_simp: cat_FUNCT_components(1) cs_intro: cat_FUNCT_cs_intros\n      )\n  with assms(2) have\n    \"?\\<epsilon>' : exp_cat_cf \\<alpha> \\<AA> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>?\\<GG>'\\<rparr> \\<mapsto>\\<^bsub>cat_FUNCT \\<alpha> \\<BB> \\<AA>\\<^esub> ?\\<TT>\"\n    by \n      ( \n        cs_concl cs_shallow \n          cs_simp: cat_Kan_cs_simps cat_FUNCT_cs_simps \n          cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n      )\n\n  from\n    is_functor.universal_arrow_foD(3)[\n      OF \\<AA>\\<KK>.is_functor_axioms cat_rKe_ua_fo \\<GG>' this\n      ]\n  obtain f' where f': \"f' : cf_map \\<GG>' \\<mapsto>\\<^bsub>cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<^esub> cf_map \\<GG>\"\n    and \\<epsilon>'_def: \"?\\<epsilon>' = umap_fo (exp_cat_cf \\<alpha> \\<AA> \\<KK>) ?\\<TT> ?\\<GG> ?\\<epsilon> ?\\<GG>'\\<lparr>ArrVal\\<rparr>\\<lparr>f'\\<rparr>\"\n    and f'_unique: \n      \"\\<lbrakk> \n        f'' : ?\\<GG>' \\<mapsto>\\<^bsub>cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<^esub> ?\\<GG>;\n        ntcf_arrow \\<epsilon>' = umap_fo (exp_cat_cf \\<alpha> \\<AA> \\<KK>) ?\\<TT> ?\\<GG> ?\\<epsilon> ?\\<GG>'\\<lparr>ArrVal\\<rparr>\\<lparr>f''\\<rparr> \n       \\<rbrakk> \\<Longrightarrow> f'' = f'\"\n    for f''\n    by metis\n  \n  show ?thesis\n  proof(intro ex1I conjI; (elim conjE)?)\n    from \\<epsilon>'_def cat_FUNCT_is_arrD(1)[OF f'] show\n      \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (ntcf_of_ntcf_arrow \\<CC> \\<AA> f' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n      by (subst (asm) cat_FUNCT_is_arrD(2)[OF f']) (*slow*)\n        (\n          cs_prems cs_shallow\n            cs_simp: cat_cs_simps cat_FUNCT_cs_simps cat_Kan_cs_simps \n            cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n        )\n    from cat_FUNCT_is_arrD(1)[OF f'] show f'_is_arr:\n      \"ntcf_of_ntcf_arrow \\<CC> \\<AA> f' : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      by \n        (\n          cs_prems cs_shallow \n            cs_simp: cat_FUNCT_cs_simps cs_intro: cat_cs_intros\n        )\n    fix \\<sigma> assume prems: \n      \"\\<sigma> : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\" \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n    interpret \\<sigma>: is_ntcf \\<alpha> \\<CC> \\<AA> \\<GG>' \\<GG> \\<sigma> by (rule prems(1))\n    from prems(1) have \\<sigma>: \n      \"ntcf_arrow \\<sigma> : cf_map \\<GG>' \\<mapsto>\\<^bsub>cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<^esub> cf_map \\<GG>\"\n      by (cs_concl cs_shallow cs_intro: cat_FUNCT_cs_intros)\n    from prems have \\<epsilon>'_def: \"ntcf_arrow \\<epsilon>' =\n      umap_fo (exp_cat_cf \\<alpha> \\<AA> \\<KK>) ?\\<TT> ?\\<GG> ?\\<epsilon> ?\\<GG>'\\<lparr>ArrVal\\<rparr>\\<lparr>ntcf_arrow \\<sigma>\\<rparr>\"\n      by \n        (\n          cs_concl cs_shallow\n            cs_simp: prems(2) cat_Kan_cs_simps cat_cs_simps cat_FUNCT_cs_simps \n            cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n        )\n    show \"\\<sigma> = ntcf_of_ntcf_arrow \\<CC> \\<AA> f'\"\n      unfolding f'_unique[OF \\<sigma> \\<epsilon>'_def, symmetric]\n      by \n        (\n          cs_concl cs_shallow \n            cs_simp: cat_FUNCT_cs_simps cs_intro: cat_cs_intros\n        )\n  qed\n\nqed\n\nlemma (in is_cat_lKe) cat_lKe_unique:\n  assumes \"\\<FF>' : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\" and \"\\<eta>' : \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F \\<FF>' \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"\\<exists>!\\<sigma>. \\<sigma> : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F \\<FF>' : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA> \\<and> \\<eta>' = (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\" \nproof-\n\n  interpret \\<FF>': is_functor \\<alpha> \\<CC> \\<AA> \\<FF>' by (rule assms(1))\n  interpret \\<eta>': is_ntcf \\<alpha> \\<BB> \\<AA> \\<TT> \\<open>\\<FF>' \\<circ>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<eta>' by (rule assms(2))\n  interpret \\<eta>: is_cat_rKe \n    \\<alpha> \\<open>op_cat \\<BB>\\<close> \\<open>op_cat \\<CC>\\<close> \\<open>op_cat \\<AA>\\<close> \\<open>op_cf \\<KK>\\<close> \\<open>op_cf \\<TT>\\<close> \\<open>op_cf \\<FF>\\<close> \\<open>op_ntcf \\<eta>\\<close>\n    by (rule is_cat_rKe_op)\n\n  from \\<eta>.cat_rKe_unique[OF \\<FF>'.is_functor_op \\<eta>'.is_ntcf_op[unfolded cat_op_simps]]\n  obtain \\<sigma> where \\<sigma>: \"\\<sigma> : op_cf \\<FF>' \\<mapsto>\\<^sub>C\\<^sub>F op_cf \\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<AA>\"\n    and \\<eta>'_def: \"op_ntcf \\<eta>' = op_ntcf \\<eta> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F op_cf \\<KK>)\"\n    and unique_\\<sigma>': \"\\<And>\\<sigma>'.\n      \\<lbrakk>\n        \\<sigma>' : op_cf \\<FF>' \\<mapsto>\\<^sub>C\\<^sub>F op_cf \\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<AA>;\n        op_ntcf \\<eta>' = op_ntcf \\<eta> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F op_cf \\<KK>) \n      \\<rbrakk> \\<Longrightarrow> \\<sigma>' = \\<sigma>\"\n    by metis\n\n  interpret \\<sigma>: is_ntcf \\<alpha> \\<open>op_cat \\<CC>\\<close> \\<open>op_cat \\<AA>\\<close> \\<open>op_cf \\<FF>'\\<close> \\<open>op_cf \\<FF>\\<close> \\<sigma> \n    by (rule \\<sigma>)\n  \n  show ?thesis\n  proof(intro ex1I conjI; (elim conjE)?)\n    show \"op_ntcf \\<sigma> : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F \\<FF>' : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      by (rule \\<sigma>.is_ntcf_op[unfolded cat_op_simps])\n    have \"\\<eta>' = op_ntcf (op_ntcf \\<eta>')\" \n      by (cs_concl cs_shallow cs_simp: cat_op_simps)\n    also from \\<eta>'_def have \"\\<dots> = op_ntcf (op_ntcf \\<eta> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F op_cf \\<KK>))\"\n      by simp\n    also have \"\\<dots> = op_ntcf \\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\"\n      by (cs_concl cs_shallow cs_simp: cat_op_simps cs_intro: cat_cs_intros)\n    finally show \"\\<eta>' = op_ntcf \\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\" by simp\n    fix \\<sigma>' assume prems: \n      \"\\<sigma>' : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F \\<FF>' : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      \"\\<eta>' = \\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\"\n    interpret \\<sigma>': is_ntcf \\<alpha> \\<CC> \\<AA> \\<FF> \\<FF>' \\<sigma>' by (rule prems(1))\n    from prems(2) have \"op_ntcf \\<eta>' = op_ntcf (\\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>)\"\n      by simp\n    also have \"\\<dots> = op_ntcf \\<eta> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (op_ntcf \\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F op_cf \\<KK>)\"\n      by (cs_concl cs_shallow cs_simp: cat_op_simps cs_intro: cat_cs_intros)\n    finally have \"op_ntcf \\<eta>' = op_ntcf \\<eta> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (op_ntcf \\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F op_cf \\<KK>)\"\n      by simp\n    from unique_\\<sigma>'[OF \\<sigma>'.is_ntcf_op this] show \"\\<sigma>' = op_ntcf \\<sigma>\"\n      by (auto simp: cat_op_simps)\n  qed\n\nqed\n\n\nsubsubsection\\<open>Further properties\\<close>\n\nlemma (in is_cat_rKe) cat_rKe_ntcf_ua_fo_is_iso_ntcf_if_ge_Limit:\n  assumes \"\\<Z> \\<beta>\" and \"\\<alpha> \\<in>\\<^sub>\\<circ> \\<beta>\"\n  shows \n    \"ntcf_ua_fo \\<beta> (exp_cat_cf \\<alpha> \\<AA> \\<KK>) (cf_map \\<TT>) (cf_map \\<GG>) (ntcf_arrow \\<epsilon>) :\n      Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<beta>\\<^esub>cat_FUNCT \\<alpha> \\<CC> \\<AA>(-,cf_map \\<GG>) \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\n      Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<beta>\\<^esub>cat_FUNCT \\<alpha> \\<BB> \\<AA>(-,cf_map \\<TT>) \\<circ>\\<^sub>C\\<^sub>F op_cf (exp_cat_cf \\<alpha> \\<AA> \\<KK>) :\n      op_cat (cat_FUNCT \\<alpha> \\<CC> \\<AA>) \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<beta>\\<^esub> cat_Set \\<beta>\"\nproof-\n  interpret \\<AA>_\\<KK>: \n    is_tiny_functor \\<beta> \\<open>cat_FUNCT \\<alpha> \\<CC> \\<AA>\\<close> \\<open>cat_FUNCT \\<alpha> \\<BB> \\<AA>\\<close> \\<open>exp_cat_cf \\<alpha> \\<AA> \\<KK>\\<close>\n    by \n      (\n        rule exp_cat_cf_is_tiny_functor[\n          OF assms Ran.HomCod.category_axioms AG.is_functor_axioms\n          ]\n      )\n  show ?thesis\n    by \n      (\n        rule is_functor.cf_ntcf_ua_fo_is_iso_ntcf[\n          OF \\<AA>_\\<KK>.is_functor_axioms cat_rKe_ua_fo\n          ]\n      )\nqed\n\nlemma (in is_cat_lKe) cat_lKe_ntcf_ua_fo_is_iso_ntcf_if_ge_Limit:\n  assumes \"\\<Z> \\<beta>\" and \"\\<alpha> \\<in>\\<^sub>\\<circ> \\<beta>\"\n  defines \"\\<AA>\\<KK> \\<equiv> exp_cat_cf \\<alpha> (op_cat \\<AA>) (op_cf \\<KK>)\"\n    and \"\\<AA>\\<CC> \\<equiv> cat_FUNCT \\<alpha> (op_cat \\<CC>) (op_cat \\<AA>)\"\n    and \"\\<AA>\\<BB> \\<equiv> cat_FUNCT \\<alpha> (op_cat \\<BB>) (op_cat \\<AA>)\"\n  shows \n    \"ntcf_ua_fo \\<beta> \\<AA>\\<KK> (cf_map \\<TT>) (cf_map \\<FF>) (ntcf_arrow (op_ntcf \\<eta>)) :\n      Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<beta>\\<^esub>\\<AA>\\<CC>(-,cf_map \\<FF>) \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<beta>\\<^esub>\\<AA>\\<BB>(-,cf_map \\<TT>) \\<circ>\\<^sub>C\\<^sub>F op_cf \\<AA>\\<KK> :\n      op_cat \\<AA>\\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<beta>\\<^esub> cat_Set \\<beta>\"\nproof-\n  note simps = \\<AA>\\<CC>_def \\<AA>\\<BB>_def \\<AA>\\<KK>_def\n  interpret \\<AA>_\\<KK>: is_tiny_functor \\<beta> \\<AA>\\<CC> \\<AA>\\<BB> \\<AA>\\<KK>\n    unfolding simps\n    by\n      (\n        rule exp_cat_cf_is_tiny_functor[\n          OF assms(1,2) Lan.HomCod.category_op AG.is_functor_op\n          ]\n      )\n  show ?thesis\n    unfolding simps\n    by \n      (\n        rule is_functor.cf_ntcf_ua_fo_is_iso_ntcf[\n          OF \\<AA>_\\<KK>.is_functor_axioms[unfolded simps] cat_lKe_ua_fo\n          ]\n      )\nqed\n\n\n\nsubsection\\<open>Opposite universal arrow for Kan extensions\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\n\ntext\\<open>\nThe following definition is merely a convenience utility for \nthe exposition of dual results associated with the formula for \nthe right Kan extension and the pointwise right Kan extension.\n\\<close>\n\ndefinition op_ua :: \"(V \\<Rightarrow> V) \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V\"\n  where \"op_ua lim_Obj \\<KK> c =\n    [\n      lim_Obj c\\<lparr>UObj\\<rparr>,\n      op_ntcf (lim_Obj c\\<lparr>UArr\\<rparr>) \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf (op_cf_obj_comma \\<KK> c)\n    ]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma op_ua_components:\n  shows [cat_op_simps]: \"op_ua lim_Obj \\<KK> c\\<lparr>UObj\\<rparr> = lim_Obj c\\<lparr>UObj\\<rparr>\"\n    and \"op_ua lim_Obj \\<KK> c\\<lparr>UArr\\<rparr> =\n      op_ntcf (lim_Obj c\\<lparr>UArr\\<rparr>) \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf (op_cf_obj_comma \\<KK> c)\"\n  unfolding op_ua_def ua_field_simps by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Opposite universal arrow for Kan extensions is a limit\\<close>\n\nlemma op_ua_UArr_is_cat_limit:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    and \"u : \\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m r : \\<KK> \\<^sub>C\\<^sub>F\\<down> c \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"op_ntcf u \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf (op_cf_obj_comma \\<KK> c) :\n    r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m op_cf \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F (op_cf \\<KK>) : c \\<down>\\<^sub>C\\<^sub>F (op_cf \\<KK>) \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<AA>\"\nproof-\n\n  note [cf_cs_simps] = is_iso_functor_is_iso_arr(2,3)\n\n  let ?op_\\<KK> = \\<open>\\<lambda>c. op_cf_obj_comma \\<KK> c\\<close>\n  let ?op_\\<KK>c = \\<open>?op_\\<KK> c\\<close>\n    and ?op_ua_UArr = \\<open>op_ntcf u \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F inv_cf (op_cf_obj_comma \\<KK> c)\\<close>\n\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n  interpret u: is_cat_colimit \\<alpha> \\<open>\\<KK> \\<^sub>C\\<^sub>F\\<down> c\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c\\<close> r u\n    by (rule assms(4))\n\n  from \\<KK>.op_cf_cf_obj_comma_proj[OF assms(3)] have\n    \"op_cf (\\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c) \\<circ>\\<^sub>C\\<^sub>F inv_cf (?op_\\<KK> c) =\n      c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F (op_cf \\<KK>) \\<circ>\\<^sub>C\\<^sub>F (?op_\\<KK> c) \\<circ>\\<^sub>C\\<^sub>F inv_cf (?op_\\<KK> c)\"\n    by simp\n  from this assms(3) have [cat_comma_cs_simps]:\n    \"op_cf (\\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c) \\<circ>\\<^sub>C\\<^sub>F inv_cf (?op_\\<KK> c) = c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F (op_cf \\<KK>)\"\n    by\n      (\n        cs_prems \n          cs_simp: cat_cs_simps cat_comma_cs_simps cf_cs_simps cat_op_simps \n          cs_intro: cf_cs_intros cat_cs_intros cat_comma_cs_intros cat_op_intros\n      )\n  from assms(3) show \"?op_ua_UArr :\n    r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m op_cf \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F (op_cf \\<KK>) : c \\<down>\\<^sub>C\\<^sub>F (op_cf \\<KK>) \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<AA>\"\n    by\n      (\n        cs_concl\n          cs_simp:\n            cf_cs_simps cat_cs_simps cat_comma_cs_simps cat_op_simps \n            \\<KK>.op_cf_cf_obj_comma_proj[symmetric]\n          cs_intro:\n            cat_cs_intros\n            cf_cs_intros\n            cat_lim_cs_intros\n            cat_comma_cs_intros\n            cat_op_intros\n      )\n\nqed\n\ncontext\n  fixes lim_Obj :: \"V \\<Rightarrow> V\" and c :: V\nbegin\n\nlemmas op_ua_UArr_is_cat_limit' = op_ua_UArr_is_cat_limit\n  [\n    unfolded op_ua_components(2)[symmetric], \n    where u=\\<open>lim_Obj c\\<lparr>UArr\\<rparr>\\<close> and r=\\<open>lim_Obj c\\<lparr>UObj\\<rparr>\\<close> and c=c,\n    folded op_ua_components(2)[where lim_Obj=lim_Obj and c=c]\n  ]\n\nend\n\n\n\nsubsection\\<open>The Kan extension\\<close>\n\n\ntext\\<open>\nThe following subsection is based on the statement and proof of \nTheorem 1 in Chapter X-3 in \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close>.\n\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition the_cf_rKe :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V\"\n  where \"the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj =\n    [\n      (\\<lambda>c\\<in>\\<^sub>\\<circ>\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Obj\\<rparr>. lim_Obj c\\<lparr>UObj\\<rparr>),\n      (\n        \\<lambda>g\\<in>\\<^sub>\\<circ>\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Arr\\<rparr>. THE f.\n          f :\n            lim_Obj (\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Dom\\<rparr>\\<lparr>g\\<rparr>)\\<lparr>UObj\\<rparr> \\<mapsto>\\<^bsub>\\<TT>\\<lparr>HomCod\\<rparr>\\<^esub>\n            lim_Obj (\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Cod\\<rparr>\\<lparr>g\\<rparr>)\\<lparr>UObj\\<rparr> \\<and>\n          lim_Obj (\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Dom\\<rparr>\\<lparr>g\\<rparr>)\\<lparr>UArr\\<rparr> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> =\n            lim_Obj (\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Cod\\<rparr>\\<lparr>g\\<rparr>)\\<lparr>UArr\\<rparr> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \n            ntcf_const ((\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Cod\\<rparr>\\<lparr>g\\<rparr>) \\<down>\\<^sub>C\\<^sub>F \\<KK>) (\\<TT>\\<lparr>HomCod\\<rparr>) f\n      ),\n      \\<KK>\\<lparr>HomCod\\<rparr>,\n      \\<TT>\\<lparr>HomCod\\<rparr>\n    ]\\<^sub>\\<circ>\"\n\ndefinition the_ntcf_rKe :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V\"\n  where \"the_ntcf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj =\n    [\n      (\n        \\<lambda>c\\<in>\\<^sub>\\<circ>\\<TT>\\<lparr>HomDom\\<rparr>\\<lparr>Obj\\<rparr>.\n          lim_Obj (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>)\\<lparr>UArr\\<rparr>\\<lparr>NTMap\\<rparr>\\<lparr>0, c, \\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>CId\\<rparr>\\<lparr>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\\<rparr>\\<rparr>\\<^sub>\\<bullet>\n      ),\n      the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj \\<circ>\\<^sub>C\\<^sub>F \\<KK>,\n      \\<TT>,\n      \\<TT>\\<lparr>HomDom\\<rparr>,\n      \\<TT>\\<lparr>HomCod\\<rparr>\n    ]\\<^sub>\\<circ>\"\n\ndefinition the_cf_lKe :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V\"\n  where \"the_cf_lKe \\<alpha> \\<TT> \\<KK> lim_Obj =\n    op_cf (the_cf_rKe \\<alpha> (op_cf \\<TT>) (op_cf \\<KK>) (op_ua lim_Obj \\<KK>))\"\n\ndefinition the_ntcf_lKe :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V\"\n  where \"the_ntcf_lKe \\<alpha> \\<TT> \\<KK> lim_Obj =\n    op_ntcf (the_ntcf_rKe \\<alpha> (op_cf \\<TT>) (op_cf \\<KK>) (op_ua lim_Obj \\<KK>))\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma the_cf_rKe_components:\n  shows \"the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ObjMap\\<rparr> = \n    (\\<lambda>c\\<in>\\<^sub>\\<circ>\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Obj\\<rparr>. lim_Obj c\\<lparr>UObj\\<rparr>)\"\n    and \"the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr> =\n    (\n      \\<lambda>g\\<in>\\<^sub>\\<circ>\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Arr\\<rparr>. THE f.\n        f :\n          lim_Obj (\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Dom\\<rparr>\\<lparr>g\\<rparr>)\\<lparr>UObj\\<rparr> \\<mapsto>\\<^bsub>\\<TT>\\<lparr>HomCod\\<rparr>\\<^esub>\n          lim_Obj (\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Cod\\<rparr>\\<lparr>g\\<rparr>)\\<lparr>UObj\\<rparr> \\<and>\n        lim_Obj (\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Dom\\<rparr>\\<lparr>g\\<rparr>)\\<lparr>UArr\\<rparr> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> =\n          lim_Obj (\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Cod\\<rparr>\\<lparr>g\\<rparr>)\\<lparr>UArr\\<rparr> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \n          ntcf_const ((\\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>Cod\\<rparr>\\<lparr>g\\<rparr>) \\<down>\\<^sub>C\\<^sub>F \\<KK>) (\\<TT>\\<lparr>HomCod\\<rparr>) f\n    )\"\n    and \"the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>HomDom\\<rparr> = \\<KK>\\<lparr>HomCod\\<rparr>\"\n    and \"the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>HomCod\\<rparr> = \\<TT>\\<lparr>HomCod\\<rparr>\"\n  unfolding the_cf_rKe_def dghm_field_simps by (simp_all add: nat_omega_simps)\n\nlemma the_ntcf_rKe_components:\n  shows \"the_ntcf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>NTMap\\<rparr> =\n      (\n        \\<lambda>c\\<in>\\<^sub>\\<circ>\\<TT>\\<lparr>HomDom\\<rparr>\\<lparr>Obj\\<rparr>.\n          lim_Obj (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>)\\<lparr>UArr\\<rparr>\\<lparr>NTMap\\<rparr>\\<lparr>0, c, \\<KK>\\<lparr>HomCod\\<rparr>\\<lparr>CId\\<rparr>\\<lparr>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\\<rparr>\\<rparr>\\<^sub>\\<bullet>\n      )\"\n    and \"the_ntcf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>NTDom\\<rparr> = the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj \\<circ>\\<^sub>C\\<^sub>F \\<KK>\"\n    and \"the_ntcf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>NTCod\\<rparr> = \\<TT>\"\n    and \"the_ntcf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>NTDGDom\\<rparr> = \\<TT>\\<lparr>HomDom\\<rparr>\"\n    and \"the_ntcf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>NTDGCod\\<rparr> = \\<TT>\\<lparr>HomCod\\<rparr>\"\n  unfolding the_ntcf_rKe_def nt_field_simps by (simp_all add: nat_omega_simps)\n\ncontext\n  fixes \\<alpha> \\<AA> \\<BB> \\<CC> \\<KK> \\<TT>\n  assumes \\<KK>: \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \\<TT>: \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\nbegin\n\ninterpretation \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule \\<KK>)\ninterpretation \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule \\<TT>)\n\nlemmas the_cf_rKe_components' = the_cf_rKe_components[\n    where \\<KK>=\\<KK> and \\<TT>=\\<TT> and \\<alpha>=\\<alpha>, unfolded \\<KK>.cf_HomCod \\<TT>.cf_HomCod\n    ]\n\nlemmas [cat_Kan_cs_simps] = the_cf_rKe_components'(3,4)\n\nlemmas the_ntcf_rKe_components' = the_ntcf_rKe_components[\n    where \\<KK>=\\<KK> and \\<TT>=\\<TT> and \\<alpha>=\\<alpha>, unfolded \\<KK>.cf_HomCod \\<TT>.cf_HomCod \\<TT>.cf_HomDom\n    ]\n\nlemmas [cat_Kan_cs_simps] = the_ntcf_rKe_components'(2-5)\n\nend\n\n\nsubsubsection\\<open>Functor: object map\\<close>\n\nmk_VLambda the_cf_rKe_components(1)\n  |vsv the_cf_rKe_ObjMap_vsv[cat_Kan_cs_intros]|\n\ncontext\n  fixes \\<alpha> \\<AA> \\<BB> \\<CC> \\<KK> \\<TT>\n  assumes \\<KK>: \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \\<TT>: \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\nbegin\n\ninterpretation \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule \\<KK>)\n\nmk_VLambda the_cf_rKe_components'(1)[OF \\<KK> \\<TT>]\n  |vdomain the_cf_rKe_ObjMap_vdomain[cat_Kan_cs_simps]|\n  |app the_cf_rKe_ObjMap_impl_app[cat_Kan_cs_simps]|\n\nlemma the_cf_rKe_ObjMap_vrange: \n  assumes \"\\<And>c. c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr> \\<Longrightarrow> lim_Obj c\\<lparr>UObj\\<rparr> \\<in>\\<^sub>\\<circ> \\<AA>\\<lparr>Obj\\<rparr>\"\n  shows \"\\<R>\\<^sub>\\<circ> (the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ObjMap\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<AA>\\<lparr>Obj\\<rparr>\"\n  unfolding the_cf_rKe_components'[OF \\<KK> \\<TT>]\n  by (intro vrange_VLambda_vsubset assms)\n\nend\n\n\nsubsubsection\\<open>Functor: arrow map\\<close>\n\nmk_VLambda the_cf_rKe_components(2)\n  |vsv the_cf_rKe_ArrMap_vsv[cat_Kan_cs_intros]|\n\ncontext\n  fixes \\<alpha> \\<BB> \\<CC> \\<KK>\n  assumes \\<KK>: \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nbegin\n\ninterpretation \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule \\<KK>)\n\nmk_VLambda the_cf_rKe_components(2)[where \\<alpha>=\\<alpha> and \\<KK>=\\<KK>, unfolded \\<KK>.cf_HomCod]\n  |vdomain the_cf_rKe_ArrMap_vdomain[cat_Kan_cs_simps]|\n\ncontext \n  fixes \\<AA> \\<TT> c c' g\n  assumes \\<TT>: \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and g: \"g : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c'\"\nbegin\n\ninterpretation \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule \\<TT>)\n\nlemma g': \"g \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr>\" using g by auto\n\nmk_VLambda the_cf_rKe_components(2)[\n    where \\<alpha>=\\<alpha> and \\<KK>=\\<KK> and \\<TT>=\\<TT>, unfolded \\<KK>.cf_HomCod \\<TT>.cf_HomCod\n    ]\n  |app the_cf_rKe_ArrMap_app_impl'|\n\nlemmas the_cf_rKe_ArrMap_app' = the_cf_rKe_ArrMap_app_impl'[\n    OF g', unfolded \\<KK>.HomCod.cat_is_arrD[OF g]\n    ]\n\nend\n\nend\n\nlemma the_cf_rKe_ArrMap_app_impl:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"g : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c'\"\n    and \"u : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c' \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"\\<exists>!f.\n    f : r \\<mapsto>\\<^bsub>\\<AA>\\<^esub> r' \\<and>\n    u \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> = u' \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f\"\nproof-\n\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n  interpret u: is_cat_limit \\<alpha> \\<open>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> r u\n    by (rule assms(4))\n  interpret u': is_cat_limit \\<alpha> \\<open>c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> r' u'\n    by (rule assms(5))\n\n  have const_r_def:\n    \"cf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r = cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>\"\n  proof(rule cf_eqI)\n    show const_r: \"cf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r : c' \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      by (cs_concl cs_intro: cat_cs_intros cat_lim_cs_intros)\n    from assms(3) show const_r_g\\<KK>: \n      \"cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> : c' \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n    have ObjMap_dom_lhs: \"\\<D>\\<^sub>\\<circ> (cf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r\\<lparr>ObjMap\\<rparr>) = c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n      by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n    from assms(3) have ObjMap_dom_rhs: \n      \"\\<D>\\<^sub>\\<circ> ((cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>) = c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n      by \n        (\n          cs_concl \n            cs_simp: cat_cs_simps \n            cs_intro: cat_lim_cs_intros cat_cs_intros cat_comma_cs_intros\n        )\n    have ArrMap_dom_lhs: \"\\<D>\\<^sub>\\<circ> (cf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r\\<lparr>ArrMap\\<rparr>) = c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Arr\\<rparr>\"\n      by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n    from assms(3) have ArrMap_dom_rhs: \n      \"\\<D>\\<^sub>\\<circ> ((cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>) = c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Arr\\<rparr>\"\n      by\n        (\n          cs_concl \n            cs_simp: cat_cs_simps \n            cs_intro: cat_lim_cs_intros cat_cs_intros cat_comma_cs_intros\n        )\n    show \n      \"cf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r\\<lparr>ObjMap\\<rparr> =\n        (cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>\"\n    proof(rule vsv_eqI, unfold ObjMap_dom_lhs ObjMap_dom_rhs)\n      fix A assume prems: \"A \\<in>\\<^sub>\\<circ> c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n      from prems assms obtain b f \n        where A_def: \"A = [0, b, f]\\<^sub>\\<circ>\"\n          and b: \"b \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\" \n          and f: \"f : c' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n        by auto\n      from assms(1,3) prems f b show \n        \"cf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r\\<lparr>ObjMap\\<rparr>\\<lparr>A\\<rparr> =\n          (cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>\\<lparr>A\\<rparr>\"\n        unfolding A_def\n        by\n          (\n            cs_concl \n              cs_simp: cat_cs_simps cat_comma_cs_simps \n              cs_intro: cat_lim_cs_intros cat_cs_intros cat_comma_cs_intros\n          )\n    qed \n      (\n        use assms(3) in \n          \\<open>cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros\\<close>\n      )+\n    show\n      \"cf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r\\<lparr>ArrMap\\<rparr> =\n        (cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>\"\n    proof(rule vsv_eqI, unfold ArrMap_dom_lhs ArrMap_dom_rhs)\n      show \"vsv (cf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r\\<lparr>ArrMap\\<rparr>)\"\n        by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      from assms(3) show \"vsv ((cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>)\"\n        by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n      fix F assume prems: \"F \\<in>\\<^sub>\\<circ> c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Arr\\<rparr>\"\n      with prems obtain A B where F: \"F : A \\<mapsto>\\<^bsub>c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<^esub> B\"\n        by (auto intro: is_arrI)\n      with assms obtain b f b' f' h'\n        where F_def: \"F = [[0, b, f]\\<^sub>\\<circ>, [0, b', f']\\<^sub>\\<circ>, [0, h']\\<^sub>\\<circ>]\\<^sub>\\<circ>\"\n          and A_def: \"A = [0, b, f]\\<^sub>\\<circ>\"\n          and B_def: \"B = [0, b', f']\\<^sub>\\<circ>\"\n          and h': \"h' : b \\<mapsto>\\<^bsub>\\<BB>\\<^esub> b'\"\n          and f: \"f : c' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n          and f': \"f' : c' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n          and f'_def: \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>h'\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f = f'\"\n        by auto\n      from prems assms(3) F g' h' f f' show\n        \"cf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r\\<lparr>ArrMap\\<rparr>\\<lparr>F\\<rparr> =\n          (cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> r \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>\\<lparr>F\\<rparr>\"\n        unfolding F_def A_def B_def\n        by (*slow*)\n          (\n            cs_concl \n              cs_simp: cat_comma_cs_simps cat_cs_simps f'_def[symmetric]\n              cs_intro: cat_lim_cs_intros cat_cs_intros cat_comma_cs_intros\n          )\n    qed simp\n  qed simp_all\n\n  have \\<TT>c'\\<KK>: \"\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> = \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>\"\n  proof(rule cf_eqI)\n    show \"\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c' \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n    from assms show \" \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> : c' \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      by\n        (\n          cs_concl \n            cs_simp: cat_cs_simps \n            cs_intro: cat_comma_cs_intros cat_cs_intros\n        )\n    have ObjMap_dom_lhs: \"\\<D>\\<^sub>\\<circ> ((\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>) = c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n      by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n    from assms have ObjMap_dom_rhs: \n      \"\\<D>\\<^sub>\\<circ> ((\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>) = c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n      by\n        (\n          cs_concl \n            cs_simp: cat_cs_simps \n            cs_intro: cat_comma_cs_intros cat_cs_intros\n        )\n    show \"(\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr> = (\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>\"\n    proof(rule vsv_eqI, unfold ObjMap_dom_lhs ObjMap_dom_rhs)\n      from assms show \"vsv ((\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>)\"\n        by\n          (\n            cs_concl cs_shallow\n              cs_simp: cat_comma_cs_simps \n              cs_intro: cat_cs_intros cat_comma_cs_intros\n          )\n      from assms show \"vsv ((\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>)\"\n        by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n      fix A assume prems: \"A \\<in>\\<^sub>\\<circ> c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n      from assms(3) prems obtain b f\n        where A_def: \"A = [0, b, f]\\<^sub>\\<circ>\"\n          and b: \"b \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\"\n          and f: \"f : c' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n        by auto\n      from prems assms b f show \n        \"(\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>\\<lparr>A\\<rparr> =\n          (\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>\\<lparr>A\\<rparr>\"\n        unfolding A_def\n        by\n          (\n            cs_concl \n              cs_simp: cat_cs_simps cat_comma_cs_simps\n              cs_intro: cat_cs_intros cat_comma_cs_intros\n          )\n    qed simp\n\n    have ArrMap_dom_lhs: \"\\<D>\\<^sub>\\<circ> ((\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>) = c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Arr\\<rparr>\"\n      by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n    from assms have ArrMap_dom_rhs:\n      \"\\<D>\\<^sub>\\<circ> ((\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>) = c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Arr\\<rparr>\"\n      by\n        (\n          cs_concl \n            cs_simp: cat_cs_simps\n            cs_intro: cat_comma_cs_intros cat_cs_intros\n        )\n\n    show \"(\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr> = (\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>\"\n    proof(rule vsv_eqI, unfold ArrMap_dom_lhs ArrMap_dom_rhs)\n      from assms show \"vsv ((\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>)\"\n        by\n          (\n            cs_concl cs_shallow\n              cs_simp: cat_comma_cs_simps \n              cs_intro: cat_cs_intros cat_comma_cs_intros\n          )\n      from assms show \"vsv ((\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>)\"\n        by \n          (\n            cs_concl cs_shallow \n              cs_simp: cs_intro: cat_cs_intros cat_comma_cs_intros\n          )\n\n      fix F assume prems: \"F \\<in>\\<^sub>\\<circ> c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Arr\\<rparr>\"\n      with prems obtain A B where F: \"F : A \\<mapsto>\\<^bsub>c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<^esub> B\"\n        unfolding cat_comma_cs_simps by (auto intro: is_arrI)\n      with assms(3) obtain b f b' f' h'\n        where F_def: \"F = [[0, b, f]\\<^sub>\\<circ>, [0, b', f']\\<^sub>\\<circ>, [0, h']\\<^sub>\\<circ>]\\<^sub>\\<circ>\"\n          and A_def: \"A = [0, b, f]\\<^sub>\\<circ>\"\n          and B_def: \"B = [0, b', f']\\<^sub>\\<circ>\"\n          and h': \"h' : b \\<mapsto>\\<^bsub>\\<BB>\\<^esub> b'\"\n          and f: \"f : c' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n          and f': \"f' : c' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n          and f'_def: \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>h'\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f = f'\"\n        by auto\n      from prems assms(3) F g' h' f f' show\n        \"(\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>\\<lparr>F\\<rparr> =\n          (\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>\\<lparr>F\\<rparr>\"\n        unfolding F_def A_def B_def\n        by (*slow*)\n          (\n            cs_concl \n              cs_simp: cat_comma_cs_simps cat_cs_simps f'_def[symmetric]\n              cs_intro: cat_lim_cs_intros cat_cs_intros cat_comma_cs_intros\n          )\n    qed simp\n  qed simp_all\n\n  from assms(1-3) have\n    \"u \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c' \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    by (intro is_cat_coneI)\n      (\n        cs_concl \n          cs_intro: cat_cs_intros cat_comma_cs_intros cat_lim_cs_intros\n          cs_simp: const_r_def \\<TT>c'\\<KK>\n      )+\n  with u'.cat_lim_ua_fo show\n    \"\\<exists>!G.\n      G : r \\<mapsto>\\<^bsub>\\<AA>\\<^esub> r' \\<and>\n      u \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> = u' \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> G\"\n    by simp\n\nqed\n\nlemma the_cf_rKe_ArrMap_app:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"g : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c'\"\n    and \"lim_Obj c\\<lparr>UArr\\<rparr> :\n      lim_Obj c\\<lparr>UObj\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"lim_Obj c'\\<lparr>UArr\\<rparr> :\n      lim_Obj c'\\<lparr>UObj\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c' \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> :\n    lim_Obj c\\<lparr>UObj\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> lim_Obj c'\\<lparr>UObj\\<rparr>\"\n    and\n      \"lim_Obj c\\<lparr>UArr\\<rparr> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> =\n        lim_Obj c'\\<lparr>UArr\\<rparr> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\n          ntcf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr>)\"\n    and \n      \"\\<lbrakk>\n        f : lim_Obj c\\<lparr>UObj\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> lim_Obj c'\\<lparr>UObj\\<rparr>;\n        lim_Obj c\\<lparr>UArr\\<rparr> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> =\n          lim_Obj c'\\<lparr>UArr\\<rparr> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f\n       \\<rbrakk> \\<Longrightarrow> f = the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr>\"\nproof-\n\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n  interpret u: is_cat_limit \n    \\<alpha> \\<open>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>lim_Obj c\\<lparr>UObj\\<rparr>\\<close> \\<open>lim_Obj c\\<lparr>UArr\\<rparr>\\<close>\n    by (rule assms(4))\n  interpret u': is_cat_limit \n    \\<alpha> \\<open>c' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>lim_Obj c'\\<lparr>UObj\\<rparr>\\<close> \\<open>lim_Obj c'\\<lparr>UArr\\<rparr>\\<close>\n    by (rule assms(5))\n\n  from assms(3) have c: \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" and c': \"c' \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\n\n  note the_cf_rKe_ArrMap_app_impl' =\n    the_cf_rKe_ArrMap_app_impl[OF assms]\n  note the_f = theI'[OF the_cf_rKe_ArrMap_app_impl[OF assms]]\n  note the_f_is_arr = the_f[THEN conjunct1]\n    and the_f_commutes = the_f[THEN conjunct2]\n\n  from assms(3) the_f_is_arr show\n    \"the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> :\n      lim_Obj c\\<lparr>UObj\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> lim_Obj c'\\<lparr>UObj\\<rparr>\"\n    by\n      (\n        cs_concl cs_shallow\n          cs_simp: the_cf_rKe_ArrMap_app' cs_intro: cat_cs_intros\n      )\n  moreover from assms(3) the_f_commutes show\n    \"lim_Obj c\\<lparr>UArr\\<rparr> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> =\n      lim_Obj c'\\<lparr>UArr\\<rparr> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\n        ntcf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr>)\"\n    by \n      (\n        cs_concl cs_shallow \n          cs_simp: the_cf_rKe_ArrMap_app' cs_intro: cat_cs_intros\n      )\n  ultimately show \"f = the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr>\"\n    if \"f : lim_Obj c\\<lparr>UObj\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> lim_Obj c'\\<lparr>UObj\\<rparr>\"\n      and \"lim_Obj c\\<lparr>UArr\\<rparr> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F g \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> =\n        lim_Obj c'\\<lparr>UArr\\<rparr> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c' \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f\"\n    by (metis that the_cf_rKe_ArrMap_app_impl')\n\nqed\n\nlemma the_cf_rKe_ArrMap_is_arr'[cat_Kan_cs_intros]:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"g : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c'\"\n    and \"lim_Obj c\\<lparr>UArr\\<rparr> :\n      lim_Obj c\\<lparr>UObj\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"lim_Obj c'\\<lparr>UArr\\<rparr> :\n      lim_Obj c'\\<lparr>UObj\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F c' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c' \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"a = lim_Obj c\\<lparr>UObj\\<rparr>\"\n    and \"b = lim_Obj c'\\<lparr>UObj\\<rparr>\"\n  shows \"the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> : a \\<mapsto>\\<^bsub>\\<AA>\\<^esub> b\"\n  unfolding assms(6,7) by (rule the_cf_rKe_ArrMap_app[OF assms(1-5)])\n\nlemma lim_Obj_the_cf_rKe_commute:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"lim_Obj a\\<lparr>UArr\\<rparr> :\n      lim_Obj a\\<lparr>UObj\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F a \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : a \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"lim_Obj b\\<lparr>UArr\\<rparr> :\n      lim_Obj b\\<lparr>UObj\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : b \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\"\n    and \"[a', b', f']\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n  shows  \n    \"lim_Obj a\\<lparr>UArr\\<rparr>\\<lparr>NTMap\\<rparr>\\<lparr>a', b', f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\\<rparr>\\<^sub>\\<bullet> =\n      lim_Obj b\\<lparr>UArr\\<rparr>\\<lparr>NTMap\\<rparr>\\<lparr>a', b', f'\\<rparr>\\<^sub>\\<bullet> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub>\n        the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\" \nproof-\n\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n\n  note f = \\<KK>.HomCod.cat_is_arrD[OF assms(5)]\n\n  interpret lim_a: is_cat_limit\n    \\<alpha> \\<open>a \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F a \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>lim_Obj a\\<lparr>UObj\\<rparr>\\<close> \\<open>lim_Obj a\\<lparr>UArr\\<rparr>\\<close>\n    by (rule assms(3))\n  interpret lim_b: is_cat_limit \n    \\<alpha> \\<open>b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>lim_Obj b\\<lparr>UObj\\<rparr>\\<close> \\<open>lim_Obj b\\<lparr>UArr\\<rparr>\\<close> \n    by (rule assms(4))\n\n  note f_app = the_cf_rKe_ArrMap_app[\n      where lim_Obj=lim_Obj, OF assms(1,2,5,3,4)\n      ]\n\n  from f_app(2) have lim_a_f\\<KK>_NTMap_app:\n    \"(lim_Obj a\\<lparr>UArr\\<rparr> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F f \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> =\n      (\n        lim_Obj b\\<lparr>UArr\\<rparr> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\n        ntcf_const (b \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>)\n      )\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr>\"\n    if \\<open>A \\<in>\\<^sub>\\<circ> b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\\<close> for A\n    by simp\n  show \n    \"lim_Obj a\\<lparr>UArr\\<rparr>\\<lparr>NTMap\\<rparr>\\<lparr>a', b', f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\\<rparr>\\<^sub>\\<bullet> =\n      lim_Obj b\\<lparr>UArr\\<rparr>\\<lparr>NTMap\\<rparr>\\<lparr>a', b', f'\\<rparr>\\<^sub>\\<bullet> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub>\n        the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\" \n  proof-\n    from assms(5,6) have a'_def: \"a' = 0\"\n      and b': \"b' \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\"\n      and f': \"f' : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n      by auto\n    show \n      \"lim_Obj a\\<lparr>UArr\\<rparr>\\<lparr>NTMap\\<rparr>\\<lparr>a', b', f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\\<rparr>\\<^sub>\\<bullet> =\n        lim_Obj b\\<lparr>UArr\\<rparr>\\<lparr>NTMap\\<rparr>\\<lparr>a', b', f'\\<rparr>\\<^sub>\\<bullet> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub>\n          the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\"\n      using lim_a_f\\<KK>_NTMap_app[OF assms(6)] f' assms(3-6) \n      unfolding a'_def\n      by\n        (\n          cs_prems \n            cs_simp: cat_cs_simps cat_comma_cs_simps cat_Kan_cs_simps\n            cs_intro: cat_cs_intros cat_comma_cs_intros cat_Kan_cs_intros\n        )      \n  qed\n\nqed\n\n\nsubsubsection\\<open>Natural transformation: natural transformation map\\<close>\n\nmk_VLambda the_ntcf_rKe_components(1)\n  |vsv the_ntcf_rKe_NTMap_vsv[cat_Kan_cs_intros]|\n\ncontext\n  fixes \\<alpha> \\<AA> \\<BB> \\<CC> \\<KK> \\<TT>\n  assumes \\<KK>: \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \\<TT>: \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\nbegin\n\ninterpretation \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule \\<KK>)\ninterpretation \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule \\<TT>)\n\nmk_VLambda the_ntcf_rKe_components'(1)[OF \\<KK> \\<TT>]\n  |vdomain the_ntcf_rKe_ObjMap_vdomain[cat_Kan_cs_simps]|\n  |app the_ntcf_rKe_ObjMap_impl_app[cat_Kan_cs_simps]|\n\nend\n\n\nsubsubsection\\<open>The Kan extension is a Kan extension\\<close>\n\nlemma the_cf_rKe_is_functor:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<And>c. c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr> \\<Longrightarrow> lim_Obj c\\<lparr>UArr\\<rparr> :\n      lim_Obj c\\<lparr>UObj\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\nproof-\n\n  let ?UObj = \\<open>\\<lambda>a. lim_Obj a\\<lparr>UObj\\<rparr>\\<close> \n  let ?UArr = \\<open>\\<lambda>a. lim_Obj a\\<lparr>UArr\\<rparr>\\<close>\n  let ?const_comma = \\<open>\\<lambda>a b. cf_const (a \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (?UObj b)\\<close>\n  let ?the_cf_rKe = \\<open>the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<close>\n\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n\n  note [cat_lim_cs_intros] = is_cat_cone.cat_cone_obj\n  \n  show ?thesis\n  proof(intro is_functorI')\n\n    show \"vfsequence ?the_cf_rKe\" unfolding the_cf_rKe_def by simp\n    show \"vcard ?the_cf_rKe = 4\\<^sub>\\<nat>\" \n      unfolding the_cf_rKe_def by (simp add: nat_omega_simps)\n    show \"vsv (?the_cf_rKe\\<lparr>ObjMap\\<rparr>)\" \n      by (cs_concl cs_shallow cs_intro: cat_Kan_cs_intros)\n    moreover show \"\\<D>\\<^sub>\\<circ> (?the_cf_rKe\\<lparr>ObjMap\\<rparr>) = \\<CC>\\<lparr>Obj\\<rparr>\"\n      by (cs_concl cs_shallow cs_simp: cat_Kan_cs_simps cs_intro: cat_cs_intros)\n    moreover show \"\\<R>\\<^sub>\\<circ> (?the_cf_rKe\\<lparr>ObjMap\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<AA>\\<lparr>Obj\\<rparr>\"\n    proof\n      (\n        intro the_cf_rKe_ObjMap_vrange; \n        (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)?\n      )\n      fix c assume \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n      with assms(3)[OF this] show \"?UObj c \\<in>\\<^sub>\\<circ> \\<AA>\\<lparr>Obj\\<rparr>\"\n        by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_lim_cs_intros)\n    qed\n    ultimately have [cat_Kan_cs_intros]: \n      \"?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<in>\\<^sub>\\<circ> \\<AA>\\<lparr>Obj\\<rparr>\" if \\<open>c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\\<close> for c\n      by (metis that vsubsetE vsv.vsv_value)\n\n    show \"?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> :\n      ?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n      if \"f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\" for a b f\n      using assms(2) that\n      by \n        (\n          cs_concl \n            cs_simp: cat_Kan_cs_simps \n            cs_intro: assms(3) cat_cs_intros cat_Kan_cs_intros\n        )\n    then have [cat_Kan_cs_intros]: \"?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> : A \\<mapsto>\\<^bsub>\\<AA>\\<^esub> B\"\n      if \"A = ?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr>\" \n        and \"B = ?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n        and \"f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\" \n      for A B a b f\n      by (simp add: that)\n\n    show\n      \"?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\\<rparr> =\n        ?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> ?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\"\n      (is \\<open>?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\\<rparr> = ?the_rKe_g \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> ?the_rKe_f\\<close>)\n      if g_is_arr: \"g : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c\" and f_is_arr: \"f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\" for b c g a f\n    proof-\n\n      let ?ntcf_const_c = \\<open>\\<lambda>f. ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f\\<close>\n\n      note g = \\<KK>.HomCod.cat_is_arrD[OF that(1)]\n        and f = \\<KK>.HomCod.cat_is_arrD[OF that(2)]\n      note lim_a = assms(3)[OF f(2)]\n        and lim_b = assms(3)[OF g(2)]\n        and lim_c = assms(3)[OF g(3)]\n      from that have gf: \"g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c\" \n        by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n\n      interpret lim_a: is_cat_limit\n        \\<alpha> \\<open>a \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F a \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj a\\<close> \\<open>?UArr a\\<close>\n        by (rule lim_a)\n      interpret lim_c: is_cat_limit\n        \\<alpha> \\<open>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj c\\<close> \\<open>?UArr c\\<close>\n        by (rule lim_c)\n\n      show ?thesis\n      proof\n        (\n          rule sym, \n          rule the_cf_rKe_ArrMap_app(3)[OF assms(1,2) gf lim_a lim_c]\n        )\n\n        from assms(1,2) that lim_a lim_b lim_c show \n          \"?the_rKe_g \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> ?the_rKe_f : ?UObj a \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c\"\n          by\n            (\n              cs_concl \n                cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_Kan_cs_intros\n            )\n      \n        show\n          \"?UArr a \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> = \n            ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c (?the_rKe_g \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> ?the_rKe_f)\"\n          (\n            is \n              \\<open>\n                ?UArr a \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> =\n                  ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c ?the_rKe_gf\n              \\<close>\n           )\n        proof(rule ntcf_eqI)\n          from that show \n            \"?UArr a \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> :\n              cf_const (a \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (?UObj a) \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\n              \\<TT> \\<circ>\\<^sub>C\\<^sub>F a \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F ((g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>) :\n              c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n            by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n          have [cat_comma_cs_simps]: \n            \"?const_comma a a \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> = ?const_comma c a\"\n          proof(rule cf_eqI)\n            from g_is_arr f_is_arr show\n              \"?const_comma a a \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> : c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n              by\n                (\n                  cs_concl  \n                    cs_simp: cat_comma_cs_simps cat_cs_simps\n                    cs_intro: \n                      cat_cs_intros cat_lim_cs_intros cat_comma_cs_intros\n                )\n            from g_is_arr f_is_arr show \"?const_comma c a : c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n              by\n                (\n                  cs_concl \n                    cs_simp: cat_comma_cs_simps cat_cs_simps\n                    cs_intro: \n                      cat_cs_intros cat_lim_cs_intros cat_comma_cs_intros\n                )\n            from g_is_arr f_is_arr have ObjMap_dom_lhs:\n              \"\\<D>\\<^sub>\\<circ> ((?const_comma a a \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>) =\n                c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n              by\n                (\n                  cs_concl \n                    cs_simp: cat_comma_cs_simps cat_cs_simps \n                    cs_intro: \n                      cat_comma_cs_intros cat_lim_cs_intros cat_cs_intros\n                )\n            from g_is_arr f_is_arr have ObjMap_dom_rhs:\n              \"\\<D>\\<^sub>\\<circ> (?const_comma c a\\<lparr>ObjMap\\<rparr>) = c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n              by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps cat_cs_simps)\n\n            show\n              \"(?const_comma a a \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr> =\n                ?const_comma c a\\<lparr>ObjMap\\<rparr>\"\n            proof(rule vsv_eqI, unfold ObjMap_dom_lhs ObjMap_dom_rhs)\n              from f_is_arr g_is_arr show \n                \"vsv ((?const_comma a a \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>)\"\n                by\n                  (\n                    cs_concl\n                      cs_simp: cat_comma_cs_simps cat_cs_simps \n                      cs_intro:\n                        cat_cs_intros cat_lim_cs_intros cat_comma_cs_intros\n                  )\n              fix A assume prems: \"A \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n              with g_is_arr obtain b' f' \n                where A_def: \"A = [0, b', f']\\<^sub>\\<circ>\"\n                  and b': \"b' \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\"\n                  and f': \"f' : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n                by auto\n              from prems b' f' g_is_arr f_is_arr show \n                \"(?const_comma a a \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>\\<lparr>A\\<rparr> =\n                  ?const_comma c a\\<lparr>ObjMap\\<rparr>\\<lparr>A\\<rparr>\"\n                unfolding A_def\n                by\n                  (\n                    cs_concl\n                      cs_simp: cat_comma_cs_simps cat_cs_simps \n                      cs_intro:\n                        cat_cs_intros cat_lim_cs_intros cat_comma_cs_intros\n                  )\n            qed (cs_concl cs_shallow cs_intro: cat_cs_intros)\n\n            from g_is_arr f_is_arr have ArrMap_dom_lhs:\n              \"\\<D>\\<^sub>\\<circ> ((?const_comma a a \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>) = \n                c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Arr\\<rparr>\"\n              by\n                (\n                  cs_concl \n                    cs_simp: cat_comma_cs_simps cat_cs_simps \n                    cs_intro: \n                      cat_comma_cs_intros cat_lim_cs_intros cat_cs_intros\n                )\n            from g_is_arr f_is_arr have ArrMap_dom_rhs:\n              \"\\<D>\\<^sub>\\<circ> (?const_comma c a\\<lparr>ArrMap\\<rparr>) = c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Arr\\<rparr>\"\n              by (cs_concl cs_shallow cs_simp: cat_comma_cs_simps cat_cs_simps)\n\n            show \n              \"(?const_comma a a \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr> =\n                ?const_comma c a\\<lparr>ArrMap\\<rparr>\"\n            proof(rule vsv_eqI, unfold ArrMap_dom_lhs ArrMap_dom_rhs)\n              from f_is_arr g_is_arr show\n                \"vsv ((?const_comma a a \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>)\"\n                by\n                  (\n                    cs_concl\n                      cs_simp: cat_comma_cs_simps cat_cs_simps\n                      cs_intro:\n                        cat_cs_intros cat_lim_cs_intros cat_comma_cs_intros\n                  )\n              fix F assume \"F \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Arr\\<rparr>\"\n              then obtain A B where F: \"F : A \\<mapsto>\\<^bsub>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<^esub> B\"\n                unfolding cat_comma_cs_simps by (auto intro: is_arrI)\n              with g_is_arr obtain b' f' b'' f'' h'\n                where F_def: \"F = [[0, b', f']\\<^sub>\\<circ>, [0, b'', f'']\\<^sub>\\<circ>, [0, h']\\<^sub>\\<circ>]\\<^sub>\\<circ>\"\n                  and A_def: \"A = [0, b', f']\\<^sub>\\<circ>\"\n                  and B_def: \"B = [0, b'', f'']\\<^sub>\\<circ>\"\n                  and h': \"h' : b' \\<mapsto>\\<^bsub>\\<BB>\\<^esub> b''\"\n                  and f': \"f' : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n                  and f'': \"f'' : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b''\\<rparr>\"\n                  and f''_def: \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>h'\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f' = f''\"\n                by auto\n              from F f_is_arr g_is_arr g' h' f' f'' show \n                \"(?const_comma a a \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>\\<lparr>F\\<rparr> =\n                  ?const_comma c a\\<lparr>ArrMap\\<rparr>\\<lparr>F\\<rparr>\"\n                unfolding F_def A_def B_def\n                by\n                  (\n                    cs_concl \n                      cs_intro:\n                        cat_lim_cs_intros cat_cs_intros cat_comma_cs_intros\n                      cs_simp: \n                        cat_cs_simps cat_comma_cs_simps f''_def[symmetric]\n                  )\n            qed (cs_concl cs_shallow cs_intro: cat_cs_intros)\n          qed simp_all\n\n          from that show\n            \"?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c ?the_rKe_gf :\n              cf_const (a \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (?UObj a) \\<circ>\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\n              \\<TT> \\<circ>\\<^sub>C\\<^sub>F a \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F ((g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>) :\n              c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n            by\n              (\n                cs_concl \n                  cs_simp: cat_Kan_cs_simps cat_comma_cs_simps cat_cs_simps\n                  cs_intro: \n                    cat_lim_cs_intros\n                    cat_comma_cs_intros\n                    cat_Kan_cs_intros\n                    cat_cs_intros\n              )\n          from that have dom_lhs:\n            \"\\<D>\\<^sub>\\<circ> ((?UArr a \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>NTMap\\<rparr>) = c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n            by\n              (\n                cs_concl cs_shallow\n                  cs_intro: cat_cs_intros cat_comma_cs_intros\n                  cs_simp: cat_cs_simps cat_comma_cs_simps\n              )\n          from that have dom_rhs: \n            \"\\<D>\\<^sub>\\<circ> ((?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c ?the_rKe_gf)\\<lparr>NTMap\\<rparr>) = \n              c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n            by\n              (\n                cs_concl\n                  cs_intro: cat_cs_intros cat_Kan_cs_intros cat_comma_cs_intros\n                  cs_simp: cat_Kan_cs_simps cat_cs_simps cat_comma_cs_simps\n              )\n          show \n            \"(?UArr a \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>NTMap\\<rparr> =\n              (?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c ?the_rKe_gf)\\<lparr>NTMap\\<rparr>\"\n          proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n            fix A assume prems: \"A \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n            with g_is_arr obtain b' f' \n              where A_def: \"A = [0, b', f']\\<^sub>\\<circ>\"\n                and b': \"b' \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\"\n                and f': \"f' : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n              by auto\n            note \\<TT>.HomCod.cat_Comp_assoc[cat_cs_simps del]\n              and \\<KK>.HomCod.cat_Comp_assoc[cat_cs_simps del]\n              and category.cat_Comp_assoc[cat_cs_simps del]\n            note [symmetric, cat_cs_simps] =\n              lim_Obj_the_cf_rKe_commute[where lim_Obj=lim_Obj]\n              \\<KK>.HomCod.cat_Comp_assoc  \n              \\<TT>.HomCod.cat_Comp_assoc\n            from assms(1,2) that prems lim_a lim_b lim_c b' f' show\n              \"(?UArr a \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (g \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> =\n                (?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c ?the_rKe_gf)\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr>\"\n              unfolding A_def\n              by (*very slow*)\n                (\n                  cs_concl\n                    cs_simp:\n                      cat_cs_simps cat_Kan_cs_simps cat_comma_cs_simps \n                    cs_intro: \n                      cat_cs_intros cat_Kan_cs_intros cat_comma_cs_intros\n                )+\n          qed (cs_concl cs_simp: cs_intro: cat_cs_intros)+\n        qed simp_all\n      qed\n    qed\n    \n    show \"?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>\\<rparr> = \\<AA>\\<lparr>CId\\<rparr>\\<lparr>?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\\<rparr>\"\n      if \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" for c\n    proof-\n\n      let ?ntcf_const_c = \\<open>ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<AA>\\<lparr>CId\\<rparr>\\<lparr>?UObj c\\<rparr>)\\<close>\n\n      note lim_c = assms(3)[OF that]\n\n      from that have CId_c: \"\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr> : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c\" \n        by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n\n      interpret lim_c: is_cat_limit \n        \\<alpha> \\<open>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj c\\<close> \\<open>?UArr c\\<close>\n        by (rule lim_c)\n\n      show ?thesis\n      proof\n        (\n          rule sym,\n          rule the_cf_rKe_ArrMap_app(3)[\n            where lim_Obj=lim_Obj, OF assms(1,2) CId_c lim_c lim_c\n            ]\n        )\n        from that lim_c show \n          \"\\<AA>\\<lparr>CId\\<rparr>\\<lparr>?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\\<rparr> : ?UObj c \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c\"\n          by \n            (\n              cs_concl cs_shallow\n                cs_simp: cat_Kan_cs_simps\n                cs_intro: cat_cs_intros cat_lim_cs_intros\n            )\n        have \"?UArr c \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> =  ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c\"\n        proof(rule ntcf_eqI)\n          from lim_c that show \n            \"?UArr c \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> :\n              cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (?UObj c) \\<circ>\\<^sub>C\\<^sub>F (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\n              \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> :\n              c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n            by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_comma_cs_intros)\n          from lim_c that show \n            \"?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c :\n               cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (?UObj c) \\<circ>\\<^sub>C\\<^sub>F (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\n               \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> \\<circ>\\<^sub>C\\<^sub>F (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> :\n               c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n            by (*very slow*)\n              (\n                cs_concl \n                  cs_intro: cat_cs_intros \n                  cs_simp: \\<KK>.cf_arr_cf_comma_CId cat_cs_simps \n                  cs_intro: cat_lim_cs_intros\n              )\n          from that have dom_lhs:\n            \"\\<D>\\<^sub>\\<circ> ((?UArr c \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>NTMap\\<rparr>) = c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n            by \n              (\n                cs_concl cs_shallow\n                  cs_simp: cat_cs_simps \n                  cs_intro: cat_cs_intros cat_comma_cs_intros\n              )\n          \n          from that have dom_rhs:\n            \"\\<D>\\<^sub>\\<circ> ((?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c)\\<lparr>NTMap\\<rparr>) = c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n            by\n              (\n                cs_concl \n                  cs_intro: cat_lim_cs_intros cat_cs_intros \n                  cs_simp: cat_cs_simps\n              )\n          show \n            \"(?UArr c \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>NTMap\\<rparr> =\n              (?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c)\\<lparr>NTMap\\<rparr>\"\n          proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n            fix A assume prems: \"A \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n            with that obtain b f \n              where A_def: \"A = [0, b, f]\\<^sub>\\<circ>\"\n                and b: \"b \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\" \n                and f: \"f : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n              by auto\n            from that prems f have \n              \"?UArr c\\<lparr>NTMap\\<rparr>\\<lparr>0, b, f\\<rparr>\\<^sub>\\<bullet> : ?UObj c \\<mapsto>\\<^bsub>\\<AA>\\<^esub> \\<TT>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n              unfolding A_def\n              by\n                (\n                  cs_concl \n                    cs_simp: cat_cs_simps cat_comma_cs_simps \n                    cs_intro: cat_comma_cs_intros cat_cs_intros\n                )\n            from that prems f show \n              \"(?UArr c \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> =\n                (?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?ntcf_const_c)\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr>\"\n              unfolding A_def \n              by\n                (\n                  cs_concl \n                    cs_simp: cat_cs_simps cat_comma_cs_simps\n                    cs_intro:\n                      cat_lim_cs_intros cat_comma_cs_intros cat_cs_intros\n                )\n          qed (cs_concl cs_intro: cat_cs_intros)\n        qed simp_all\n\n        with that show \n          \"?UArr c \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>) \\<^sub>A\\<down>\\<^sub>C\\<^sub>F \\<KK> = \n            ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<AA>\\<lparr>CId\\<rparr>\\<lparr>?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\\<rparr>)\"\n          by \n            (\n              cs_concl cs_shallow \n                cs_simp: cat_Kan_cs_simps cs_intro: cat_cs_intros\n            )\n\n      qed\n\n    qed\n\n  qed\n    (\n      cs_concl \n        cs_simp: cat_Kan_cs_simps cs_intro: cat_cs_intros cat_Kan_cs_intros\n    )+\n\nqed\n\nlemma the_cf_lKe_is_functor:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<And>c. c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr> \\<Longrightarrow> lim_Obj c\\<lparr>UArr\\<rparr> :\n      \\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m lim_Obj c\\<lparr>UObj\\<rparr> : \\<KK> \\<^sub>C\\<^sub>F\\<down> c \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"the_cf_lKe \\<alpha> \\<TT> \\<KK> lim_Obj : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\nproof-\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n  {\n    fix c assume prems: \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    from assms(3)[OF this] have lim_Obj_UArr: \"lim_Obj c\\<lparr>UArr\\<rparr> :\n      \\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m lim_Obj c\\<lparr>UObj\\<rparr> : \\<KK> \\<^sub>C\\<^sub>F\\<down> c \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\". \n    then interpret lim_Obj_c: is_cat_colimit \n      \\<alpha> \\<open>\\<KK> \\<^sub>C\\<^sub>F\\<down> c\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c\\<close> \\<open>lim_Obj c\\<lparr>UObj\\<rparr>\\<close> \\<open>lim_Obj c\\<lparr>UArr\\<rparr>\\<close>\n      by simp\n    note op_ua_UArr_is_cat_limit'[\n      where lim_Obj=lim_Obj, OF assms(1,2) prems lim_Obj_UArr\n      ]\n  }\n  note the_cf_rKe_is_functor = the_cf_rKe_is_functor\n    [\n      OF \\<KK>.is_functor_op \\<TT>.is_functor_op,\n      unfolded cat_op_simps,\n      where lim_Obj=\\<open>op_ua lim_Obj \\<KK>\\<close>, \n      unfolded cat_op_simps, \n      OF this,\n      simplified,\n      folded the_cf_lKe_def\n    ]\n  show \"the_cf_lKe \\<alpha> \\<TT> \\<KK> lim_Obj : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    by \n      (\n        rule is_functor.is_functor_op\n          [\n            OF the_cf_rKe_is_functor, \n            folded the_cf_lKe_def,\n            unfolded cat_op_simps\n          ]\n      )\nqed\n\nlemma the_ntcf_rKe_is_ntcf:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<And>c. c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr> \\<Longrightarrow> lim_Obj c\\<lparr>UArr\\<rparr> : \n      lim_Obj c\\<lparr>UObj\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"the_ntcf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj :\n    the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\nproof-\n\n  let ?UObj = \\<open>\\<lambda>a. lim_Obj a\\<lparr>UObj\\<rparr>\\<close> \n  let ?UArr = \\<open>\\<lambda>a. lim_Obj a\\<lparr>UArr\\<rparr>\\<close>\n  let ?const_comma = \\<open>\\<lambda>a b. cf_const (a \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (?UObj b)\\<close>\n  let ?the_cf_rKe = \\<open>the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<close>\n  let ?the_ntcf_rKe = \\<open>the_ntcf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<close>\n\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n  interpret cf_rKe: is_functor \\<alpha> \\<CC> \\<AA> \\<open>?the_cf_rKe\\<close>\n    by (rule the_cf_rKe_is_functor[OF assms, simplified])\n\n  show ?thesis\n  proof(rule is_ntcfI')\n    show \"vfsequence ?the_ntcf_rKe\" unfolding the_ntcf_rKe_def by simp\n    show \"vcard ?the_ntcf_rKe = 5\\<^sub>\\<nat>\"\n      unfolding the_ntcf_rKe_def by (simp add: nat_omega_simps)\n    show \"?the_ntcf_rKe\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> : \n      (?the_cf_rKe \\<circ>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> \\<TT>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n      if \"b \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\" for b\n    proof-\n      let ?\\<KK>b = \\<open>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\\<close>\n      from that have \\<KK>b: \"\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n        by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n      note lim_\\<KK>b = assms(3)[OF \\<KK>b]\n      interpret lim_\\<KK>b: is_cat_limit \n        \\<alpha> \\<open>?\\<KK>b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F ?\\<KK>b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj ?\\<KK>b\\<close> \\<open>?UArr ?\\<KK>b\\<close>\n        by (rule lim_\\<KK>b)\n      from that lim_\\<KK>b show ?thesis\n        by\n          (\n            cs_concl \n              cs_simp: cat_cs_simps cat_comma_cs_simps cat_Kan_cs_simps\n              cs_intro: cat_cs_intros cat_comma_cs_intros cat_Kan_cs_intros\n          )+\n    qed\n    show \n      \"?the_ntcf_rKe\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> (?the_cf_rKe \\<circ>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> =\n        \\<TT>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> ?the_ntcf_rKe\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr>\"\n      if \"f : a \\<mapsto>\\<^bsub>\\<BB>\\<^esub> b\" for a b f \n    proof-\n      let ?\\<KK>a = \\<open>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr>\\<close> and ?\\<KK>b = \\<open>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\\<close> and ?\\<KK>f = \\<open>\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\\<close>\n      from that have \\<KK>a: \"?\\<KK>a \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" \n        and \\<KK>b: \"?\\<KK>b \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n        and \\<KK>f: \"?\\<KK>f : ?\\<KK>a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> ?\\<KK>b\"\n        by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)+\n      note lim_\\<KK>a = assms(3)[OF \\<KK>a]\n        and lim_\\<KK>b = assms(3)[OF \\<KK>b]\n      from that have z_b_\\<KK>b: \"[0, b, \\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>b\\<rparr>]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> ?\\<KK>b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n        by (cs_concl cs_intro: cat_cs_intros cat_comma_cs_intros)\n      from \n        lim_Obj_the_cf_rKe_commute[\n          OF assms(1,2) lim_\\<KK>a lim_\\<KK>b \\<KK>f z_b_\\<KK>b, symmetric\n          ]\n        that\n      have [cat_Kan_cs_simps]:\n        \"?UArr ?\\<KK>b\\<lparr>NTMap\\<rparr>\\<lparr>0, b, \\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>b\\<rparr>\\<rparr>\\<^sub>\\<bullet> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> ?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>?\\<KK>f\\<rparr> =\n          ?UArr ?\\<KK>a\\<lparr>NTMap\\<rparr>\\<lparr>0, b, ?\\<KK>f\\<rparr>\\<^sub>\\<bullet>\"\n        by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      interpret lim_\\<KK>a: is_cat_limit\n        \\<alpha> \\<open>?\\<KK>a \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F ?\\<KK>a \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj ?\\<KK>a\\<close> \\<open>?UArr ?\\<KK>a\\<close>\n        by (rule lim_\\<KK>a)\n      interpret lim_\\<KK>b: is_cat_limit \n        \\<alpha> \\<open>?\\<KK>b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F ?\\<KK>b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj ?\\<KK>b\\<close> \\<open>?UArr ?\\<KK>b\\<close>\n        by (rule lim_\\<KK>b)\n      note lim_\\<KK>a.cat_cone_Comp_commute[cat_cs_simps del]\n      note lim_\\<KK>b.cat_cone_Comp_commute[cat_cs_simps del]\n      from that have \n        \"[[0, a, \\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>a\\<rparr>]\\<^sub>\\<circ>, [0, b, ?\\<KK>f]\\<^sub>\\<circ>, [0, f]\\<^sub>\\<circ>]\\<^sub>\\<circ> :\n          [0, a, \\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>a\\<rparr>]\\<^sub>\\<circ> \\<mapsto>\\<^bsub>(?\\<KK>a) \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<^esub> [0, b, ?\\<KK>f]\\<^sub>\\<circ>\"\n        by\n          (\n            cs_concl \n              cs_simp: cat_cs_simps cat_comma_cs_simps\n              cs_intro: cat_cs_intros cat_comma_cs_intros\n          )\n      from lim_\\<KK>a.ntcf_Comp_commute[OF this, symmetric] that\n      have [cat_Kan_cs_simps]:\n        \"\\<TT>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> ?UArr (?\\<KK>a)\\<lparr>NTMap\\<rparr> \\<lparr>0, a, \\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>a\\<rparr>\\<rparr>\\<^sub>\\<bullet> =\n          ?UArr ?\\<KK>a\\<lparr>NTMap\\<rparr>\\<lparr>0, b, ?\\<KK>f\\<rparr>\\<^sub>\\<bullet>\"\n        by \n          (\n            cs_prems\n              cs_simp: cat_cs_simps cat_comma_cs_simps\n              cs_intro: cat_cs_intros cat_comma_cs_intros cat_1_is_arrI\n          )\n      from that show ?thesis\n        by \n          (\n            cs_concl \n              cs_simp: cat_cs_simps cat_Kan_cs_simps cs_intro: cat_cs_intros\n          )\n    qed\n  qed\n    (\n      cs_concl \n        cs_simp: cat_Kan_cs_simps cs_intro: cat_cs_intros cat_Kan_cs_intros\n    )+\n\nqed\n\nlemma the_ntcf_lKe_is_ntcf:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<And>c. c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr> \\<Longrightarrow> lim_Obj c\\<lparr>UArr\\<rparr> :\n      \\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m lim_Obj c\\<lparr>UObj\\<rparr> : \\<KK> \\<^sub>C\\<^sub>F\\<down> c \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"the_ntcf_lKe \\<alpha> \\<TT> \\<KK> lim_Obj :\n    \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F the_cf_lKe \\<alpha> \\<TT> \\<KK> lim_Obj \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\nproof-\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n  {\n    fix c assume prems: \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    from assms(3)[OF this] have lim_Obj_UArr: \"lim_Obj c\\<lparr>UArr\\<rparr> :\n      \\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m lim_Obj c\\<lparr>UObj\\<rparr> : \\<KK> \\<^sub>C\\<^sub>F\\<down> c \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\". \n    then interpret lim_Obj_c: is_cat_colimit \n      \\<alpha> \\<open>\\<KK> \\<^sub>C\\<^sub>F\\<down> c\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c\\<close> \\<open>lim_Obj c\\<lparr>UObj\\<rparr>\\<close> \\<open>lim_Obj c\\<lparr>UArr\\<rparr>\\<close>\n      by simp\n    note op_ua_UArr_is_cat_limit'[\n      where lim_Obj=lim_Obj, OF assms(1,2) prems lim_Obj_UArr\n      ]\n  }\n  note the_ntcf_rKe_is_ntcf = the_ntcf_rKe_is_ntcf\n    [\n      OF \\<KK>.is_functor_op \\<TT>.is_functor_op,\n      unfolded cat_op_simps,\n      where lim_Obj=\\<open>op_ua lim_Obj \\<KK>\\<close>,\n      unfolded cat_op_simps,\n      OF this,\n      simplified\n    ]\n  show \"the_ntcf_lKe \\<alpha> \\<TT> \\<KK> lim_Obj :\n    \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F the_cf_lKe \\<alpha> \\<TT> \\<KK> lim_Obj \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    by \n      (\n        rule is_ntcf.is_ntcf_op\n          [\n            OF the_ntcf_rKe_is_ntcf,\n            unfolded cat_op_simps, \n            folded the_cf_lKe_def the_ntcf_lKe_def\n          ]\n       )\nqed\n\nlemma the_ntcf_rKe_is_cat_rKe:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<And>c. c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr> \\<Longrightarrow> lim_Obj c\\<lparr>UArr\\<rparr> :\n      lim_Obj c\\<lparr>UObj\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"the_ntcf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj :\n    the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<TT> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C \\<AA>\"\nproof-\n\n  let ?UObj = \\<open>\\<lambda>a. lim_Obj a\\<lparr>UObj\\<rparr>\\<close> \n  let ?UArr = \\<open>\\<lambda>a. lim_Obj a\\<lparr>UArr\\<rparr>\\<close>\n  let ?the_cf_rKe = \\<open>the_cf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<close>\n  let ?the_ntcf_rKe = \\<open>the_ntcf_rKe \\<alpha> \\<TT> \\<KK> lim_Obj\\<close>\n\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n  interpret cf_rKe: is_functor \\<alpha> \\<CC> \\<AA> ?the_cf_rKe\n    by (rule the_cf_rKe_is_functor[OF assms, simplified])\n  interpret ntcf_rKe: is_ntcf \\<alpha> \\<BB> \\<AA> \\<open>?the_cf_rKe \\<circ>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<TT> ?the_ntcf_rKe\n    by (intro the_ntcf_rKe_is_ntcf assms(3))\n      (cs_concl cs_shallow cs_intro: cat_cs_intros)+\n\n  show ?thesis\n  proof(rule is_cat_rKeI')\n\n    fix \\<GG> \\<epsilon> assume prems: \n      \"\\<GG> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\" \"\\<epsilon> : \\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n\n    interpret \\<GG>: is_functor \\<alpha> \\<CC> \\<AA> \\<GG> by (rule prems(1))\n    interpret \\<epsilon>: is_ntcf \\<alpha> \\<BB> \\<AA> \\<open>\\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<TT> \\<epsilon> by (rule prems(2))\n\n    define \\<epsilon>' where \"\\<epsilon>' c =\n      [\n        (\\<lambda>A\\<in>\\<^sub>\\<circ>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>. \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>A\\<lparr>1\\<^sub>\\<nat>\\<rparr>\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>A\\<lparr>2\\<^sub>\\<nat>\\<rparr>\\<rparr>),\n        cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>),\n        \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>,\n        c \\<down>\\<^sub>C\\<^sub>F \\<KK>,\n        \\<AA>\n      ]\\<^sub>\\<circ>\"\n      for c\n\n    have \\<epsilon>'_components: \n      \"\\<epsilon>' c\\<lparr>NTMap\\<rparr> = (\\<lambda>A\\<in>\\<^sub>\\<circ>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>. \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>A\\<lparr>1\\<^sub>\\<nat>\\<rparr>\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>A\\<lparr>2\\<^sub>\\<nat>\\<rparr>\\<rparr>)\"\n      \"\\<epsilon>' c\\<lparr>NTDom\\<rparr> = cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>)\"\n      \"\\<epsilon>' c\\<lparr>NTCod\\<rparr> = \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\"\n      \"\\<epsilon>' c\\<lparr>NTDGDom\\<rparr> = c \\<down>\\<^sub>C\\<^sub>F \\<KK>\"\n      \"\\<epsilon>' c\\<lparr>NTDGCod\\<rparr> = \\<AA>\"\n      for c \n      unfolding \\<epsilon>'_def nt_field_simps by (simp_all add: nat_omega_simps)\n    note [cat_Kan_cs_simps] = \\<epsilon>'_components(2-5)\n    have [cat_Kan_cs_simps]: \"\\<epsilon>' c\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\"\n      if \"A = [a, b, f]\\<^sub>\\<circ>\" and \"[a, b, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\" for A a b c f\n      using that unfolding \\<epsilon>'_components by (auto simp: nat_omega_simps)\n\n    have \\<epsilon>': \"\\<epsilon>' c : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      and \\<epsilon>'_unique: \"\\<exists>!f'.\n        f' : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c \\<and>\n        \\<epsilon>' c = ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f'\" \n      if c: \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" for c\n    proof-\n      from that have \"?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> = ?UObj c\"\n        by \n          (\n            cs_concl cs_shallow \n              cs_simp: cat_Kan_cs_simps cs_intro: cat_cs_intros\n          )\n      interpret lim_c: is_cat_limit \n        \\<alpha> \\<open>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj c\\<close> \\<open>?UArr c\\<close>\n        by (rule assms(3)[OF that])\n      show \"\\<epsilon>' c : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : c \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      proof(intro is_cat_coneI is_ntcfI')\n        show \"vfsequence (\\<epsilon>' c)\" unfolding \\<epsilon>'_def by simp\n        show \"vcard (\\<epsilon>' c) = 5\\<^sub>\\<nat>\" unfolding \\<epsilon>'_def by (simp add: nat_omega_simps)\n        show \"vsv (\\<epsilon>' c\\<lparr>NTMap\\<rparr>)\" unfolding \\<epsilon>'_components by simp \n        show \"\\<D>\\<^sub>\\<circ> (\\<epsilon>' c\\<lparr>NTMap\\<rparr>) = c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\" unfolding \\<epsilon>'_components by simp\n        show \"\\<epsilon>' c\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> :\n          cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>)\\<lparr>ObjMap\\<rparr>\\<lparr>A\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub>\n          (\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>\\<lparr>A\\<rparr>\"\n          if \"A \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\" for A\n        proof-\n          from that prems c obtain b f \n            where A_def: \"A = [0, b, f]\\<^sub>\\<circ>\"\n              and b: \"b \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\" \n              and f: \"f : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n            by auto\n          from that prems f c that b f show ?thesis\n            unfolding A_def\n            by\n              (\n                cs_concl cs_shallow\n                  cs_simp: cat_cs_simps cat_Kan_cs_simps cat_comma_cs_simps\n                  cs_intro: cat_cs_intros cat_comma_cs_intros\n              )\n        qed\n        show\n          \"\\<epsilon>' c\\<lparr>NTMap\\<rparr>\\<lparr>B\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> cf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>)\\<lparr>ArrMap\\<rparr>\\<lparr>F\\<rparr> =\n            (\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>\\<lparr>F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<epsilon>' c\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr>\"\n          if \"F : A \\<mapsto>\\<^bsub>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<^esub> B\" for A B F\n        proof-\n          from that c \n          obtain b f b' f' k \n            where F_def: \"F = [[0, b, f]\\<^sub>\\<circ>, [0, b', f']\\<^sub>\\<circ>, [0, k]\\<^sub>\\<circ>]\\<^sub>\\<circ>\"\n              and A_def: \"A = [0, b, f]\\<^sub>\\<circ>\"\n              and B_def: \"B = [0, b', f']\\<^sub>\\<circ>\"\n              and k: \"k : b \\<mapsto>\\<^bsub>\\<BB>\\<^esub> b'\"\n              and f: \"f : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n              and f': \"f' : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n              and f'_def: \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>k\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f = f'\"\n            by auto\n          from c that k f f' show ?thesis\n            unfolding F_def A_def B_def\n            by (*slow*)\n              (\n                cs_concl \n                  cs_simp:\n                    cat_cs_simps\n                    cat_comma_cs_simps\n                    cat_Kan_cs_simps\n                    \\<epsilon>.ntcf_Comp_commute''\n                    f'_def[symmetric]\n                  cs_intro: cat_cs_intros cat_comma_cs_intros\n              )\n        qed\n      qed\n        (\n          use c that in\n            \\<open>cs_concl cs_simp: cat_Kan_cs_simps cs_intro: cat_cs_intros\\<close>\n        )+\n      from is_cat_limit.cat_lim_ua_fo[OF assms(3)[OF that] this] show \n        \"\\<exists>!f'.\n          f' : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c \\<and>\n          \\<epsilon>' c = ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f'\"  \n        by simp\n    qed\n\n    define \\<sigma> :: V where\n      \"\\<sigma> =\n        [\n          (\n            \\<lambda>c\\<in>\\<^sub>\\<circ>\\<CC>\\<lparr>Obj\\<rparr>. THE f.\n              f : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c \\<and>\n              \\<epsilon>' c = ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f\n          ),\n          \\<GG>,\n          ?the_cf_rKe,\n          \\<CC>,\n          \\<AA>\n        ]\\<^sub>\\<circ>\"\n\n    have \\<sigma>_components:\n      \"\\<sigma>\\<lparr>NTMap\\<rparr> =\n        (\n          \\<lambda>c\\<in>\\<^sub>\\<circ>\\<CC>\\<lparr>Obj\\<rparr>. THE f.\n            f : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c \\<and>\n            \\<epsilon>' c = ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f\n        )\"\n      \"\\<sigma>\\<lparr>NTDom\\<rparr> = \\<GG>\"\n      \"\\<sigma>\\<lparr>NTCod\\<rparr> = ?the_cf_rKe\"\n      \"\\<sigma>\\<lparr>NTDGDom\\<rparr> = \\<CC>\"\n      \"\\<sigma>\\<lparr>NTDGCod\\<rparr> = \\<AA>\"\n      unfolding \\<sigma>_def nt_field_simps by (simp_all add: nat_omega_simps)\n\n    note [cat_Kan_cs_simps] = \\<sigma>_components(2-5)\n\n    have \\<sigma>_NTMap_app_def: \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr> =\n      (\n        THE f.\n          f : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c \\<and>\n          \\<epsilon>' c = ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f\n      )\"\n      if \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" for c\n      using that unfolding \\<sigma>_components by simp\n\n    have \\<sigma>_NTMap_app_is_arr: \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr> : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c\"\n      and \\<epsilon>'_\\<sigma>_commute:\n        \"\\<epsilon>' c = ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>)\"\n      and \\<sigma>_NTMap_app_unique:\n        \"\\<lbrakk>\n          f : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c;\n          \\<epsilon>' c = ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f\n         \\<rbrakk> \\<Longrightarrow> f = \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>\"\n        if c: \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" for c f\n    proof-\n      have \n        \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr> : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c \\<and>\n        \\<epsilon>' c = ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>)\"\n        by \n          (\n            cs_concl cs_shallow\n              cs_simp: cat_Kan_cs_simps \\<sigma>_NTMap_app_def \n              cs_intro: theI' \\<epsilon>'_unique that\n          )\n      then show \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr> : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c\"\n        and \"\\<epsilon>' c = ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>)\"\n        by simp_all\n      with c \\<epsilon>'_unique[OF c] show \"f = \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>\"\n        if \"f : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c\"\n          and \"\\<epsilon>' c = ?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> f\"\n        using that by metis\n    qed\n\n    have \\<sigma>_NTMap_app_is_arr'[cat_Kan_cs_intros]: \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr> : a \\<mapsto>\\<^bsub>\\<AA>'\\<^esub> b\"\n      if \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" \n        and \"a = \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\" \n        and \"b = ?UObj c\" \n        and \"\\<AA>' = \\<AA>\"\n      for \\<AA>' a b c\n      by (simp add: that \\<sigma>_NTMap_app_is_arr)\n\n    have \\<epsilon>'_NTMap_app_def: \n      \"\\<epsilon>' c\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> =\n        (?UArr c \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (c \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>))\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr>\"\n      if \"A \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\" and \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" for A c\n      using \\<epsilon>'_\\<sigma>_commute[OF that(2)] by simp\n    have \\<epsilon>b_\\<GG>f:\n      \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> =\n        ?UArr c\\<lparr>NTMap\\<rparr>\\<lparr>a, b, f\\<rparr>\\<^sub>\\<bullet> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>\"\n      if \"A = [a, b, f]\\<^sub>\\<circ>\" and \"A \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\" and \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" \n      for A a b c f\n    proof-\n      interpret lim_c: is_cat_limit \n        \\<alpha> \\<open>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj c\\<close> \\<open>?UArr c\\<close>\n        by (rule assms(3)[OF that(3)])\n      from that have b: \"b \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\" and f: \"f : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n        by blast+\n      show\n        \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> =\n          ?UArr c\\<lparr>NTMap\\<rparr>\\<lparr>a, b, f\\<rparr>\\<^sub>\\<bullet> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>\"\n        using \\<epsilon>'_NTMap_app_def[OF that(2,3)] that(2,3)\n        unfolding that(1)\n        by\n          (\n            cs_prems cs_shallow\n              cs_simp: cat_cs_simps cat_Kan_cs_simps\n              cs_intro: cat_cs_intros cat_Kan_cs_intros\n          )\n    qed\n\n    show \"\\<exists>!\\<sigma>.\n      \\<sigma> : \\<GG> \\<mapsto>\\<^sub>C\\<^sub>F ?the_cf_rKe : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA> \\<and>\n      \\<epsilon> = ?the_ntcf_rKe \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n    proof(intro ex1I[where a=\\<sigma>] conjI; (elim conjE)?)\n\n      define \\<tau> where \"\\<tau> a b f =\n        [\n          (\n            \\<lambda>F\\<in>\\<^sub>\\<circ>b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>.\n              ?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\n          ),\n          cf_const (b \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr>),\n          \\<TT> \\<circ>\\<^sub>C\\<^sub>F b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>,\n          b \\<down>\\<^sub>C\\<^sub>F \\<KK>,\n          \\<AA>\n        ]\\<^sub>\\<circ>\"\n        for a b f\n\n      have \\<tau>_components:\n        \"\\<tau> a b f\\<lparr>NTMap\\<rparr> =\n          (\n            \\<lambda>F\\<in>\\<^sub>\\<circ>b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>.\n              ?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\n          )\"\n        \"\\<tau> a b f\\<lparr>NTDom\\<rparr> = cf_const (b \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr>)\"\n        \"\\<tau> a b f\\<lparr>NTCod\\<rparr> = \\<TT> \\<circ>\\<^sub>C\\<^sub>F b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\"\n        \"\\<tau> a b f\\<lparr>NTDGDom\\<rparr> = b \\<down>\\<^sub>C\\<^sub>F \\<KK>\"\n        \"\\<tau> a b f\\<lparr>NTDGCod\\<rparr> = \\<AA>\"\n        for a b f\n        unfolding \\<tau>_def nt_field_simps by (simp_all add: nat_omega_simps)\n      note [cat_Kan_cs_simps] = \\<tau>_components(2-5)\n      have \\<tau>_NTMap_app[cat_Kan_cs_simps]: \n        \"\\<tau> a b f\\<lparr>NTMap\\<rparr>\\<lparr>F\\<rparr> =\n          ?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\"\n        if \"F \\<in>\\<^sub>\\<circ> b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\" for a b f F\n        using that unfolding \\<tau>_components by auto\n      \n      have \\<tau>: \"\\<tau> a b f :\n        \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<TT> \\<circ>\\<^sub>C\\<^sub>F b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK> : b \\<down>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n        if f_is_arr: \"f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\" for a b f\n      proof-\n\n        note f = \\<KK>.HomCod.cat_is_arrD[OF that]\n        note lim_a = assms(3)[OF f(2)] and lim_b = assms(3)[OF f(3)]\n\n        interpret lim_b: is_cat_limit \n          \\<alpha> \\<open>b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj b\\<close> \\<open>?UArr b\\<close>\n          by (rule lim_b)\n\n        note lim_b.cat_cone_Comp_commute[cat_cs_simps del]\n\n        from f have a: \"a \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" and b: \"b \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\n\n        show ?thesis\n        proof(intro is_cat_coneI is_ntcfI')\n\n          show \"vfsequence (\\<tau> a b f)\" unfolding \\<tau>_def by simp\n          show \"vcard (\\<tau> a b f) = 5\\<^sub>\\<nat>\" \n            unfolding \\<tau>_def by (simp add: nat_omega_simps)\n          show \"vsv (\\<tau> a b f\\<lparr>NTMap\\<rparr>)\" unfolding \\<tau>_components by auto\n          show \"\\<D>\\<^sub>\\<circ> (\\<tau> a b f\\<lparr>NTMap\\<rparr>) = b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\" by (auto simp: \\<tau>_components)\n          show \"\\<tau> a b f\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> :\n            cf_const (b \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr>)\\<lparr>ObjMap\\<rparr>\\<lparr>A\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub>\n            (\\<TT> \\<circ>\\<^sub>C\\<^sub>F b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ObjMap\\<rparr>\\<lparr>A\\<rparr>\"\n            if \"A \\<in>\\<^sub>\\<circ> b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\" for A\n          proof-\n            from that f_is_arr obtain b' f' \n              where A_def: \"A = [0, b', f']\\<^sub>\\<circ>\"\n                and b': \"b' \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\"\n                and f': \"f' : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n              by auto\n            from  f_is_arr that b' f' a b show ?thesis\n              unfolding A_def\n              by\n                (\n                  cs_concl cs_shallow\n                    cs_simp: cat_cs_simps cat_comma_cs_simps cat_Kan_cs_simps\n                    cs_intro: cat_cs_intros cat_comma_cs_intros cat_Kan_cs_intros\n                )   \n          qed\n          show\n            \"\\<tau> a b f\\<lparr>NTMap\\<rparr>\\<lparr>B\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub>\n              cf_const (b \\<down>\\<^sub>C\\<^sub>F \\<KK>) \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr>)\\<lparr>ArrMap\\<rparr>\\<lparr>F\\<rparr> =\n              (\\<TT> \\<circ>\\<^sub>C\\<^sub>F b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>)\\<lparr>ArrMap\\<rparr>\\<lparr>F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<tau> a b f\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr>\"\n            if \"F : A \\<mapsto>\\<^bsub>b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<^esub> B\" for A B F\n          proof-\n            from that have F: \"F : A \\<mapsto>\\<^bsub>b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<^esub> B\"\n              by (auto intro: is_arrI)\n            with f_is_arr obtain b' f' b'' f'' h'\n              where F_def: \"F = [[0, b', f']\\<^sub>\\<circ>, [0, b'', f'']\\<^sub>\\<circ>, [0, h']\\<^sub>\\<circ>]\\<^sub>\\<circ>\"\n                and A_def: \"A = [0, b', f']\\<^sub>\\<circ>\"\n                and B_def: \"B = [0, b'', f'']\\<^sub>\\<circ>\"\n                and h': \"h' : b' \\<mapsto>\\<^bsub>\\<BB>\\<^esub> b''\"\n                and f': \"f' : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n                and f'': \"f'' : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b''\\<rparr>\"\n                and f''_def: \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>h'\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f' = f''\"\n              by auto\n            from\n              lim_b.ntcf_Comp_commute[OF that] \n              that f_is_arr g' h' f' f'' \n            have [cat_Kan_cs_simps]:\n              \"?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>0, b'', \\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>h'\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'\\<rparr>\\<^sub>\\<bullet> =\n                \\<TT>\\<lparr>ArrMap\\<rparr>\\<lparr>h'\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> ?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>0, b', f'\\<rparr>\\<^sub>\\<bullet>\"\n              unfolding F_def A_def B_def\n              by\n                (\n                  cs_prems \n                    cs_simp: \n                      cat_cs_simps cat_comma_cs_simps f''_def[symmetric]\n                    cs_intro: cat_cs_intros cat_comma_cs_intros\n                )\n            from f_is_arr that g' h' f' f'' show ?thesis\n              unfolding F_def A_def B_def (*very slow*)\n              by\n                (\n                  cs_concl \n                    cs_simp:\n                      cat_cs_simps \n                      cat_Kan_cs_simps \n                      cat_comma_cs_simps \n                      f''_def[symmetric]\n                    cs_intro:\n                      cat_cs_intros cat_Kan_cs_intros cat_comma_cs_intros\n                )+\n          qed\n\n        qed\n          (\n            use that f_is_arr in\n              \\<open>\n                cs_concl \n                  cs_simp: cat_cs_simps cat_Kan_cs_simps cs_intro: cat_cs_intros\n              \\<close>\n          )+\n      qed\n\n      show \\<sigma>: \"\\<sigma> : \\<GG> \\<mapsto>\\<^sub>C\\<^sub>F ?the_cf_rKe : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      proof(rule is_ntcfI')\n\n        show \"vfsequence \\<sigma>\" unfolding \\<sigma>_def by simp\n        show \"vcard \\<sigma> = 5\\<^sub>\\<nat>\" unfolding \\<sigma>_def by (simp add: nat_omega_simps)\n        show \"vsv (\\<sigma>\\<lparr>NTMap\\<rparr>)\" unfolding \\<sigma>_components by auto\n        show \"\\<D>\\<^sub>\\<circ> (\\<sigma>\\<lparr>NTMap\\<rparr>) = \\<CC>\\<lparr>Obj\\<rparr>\" unfolding \\<sigma>_components by simp\n        show \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr> : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr>\"\n          if \"a \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" for a\n          using that \n          by\n            (\n              cs_concl \n                cs_simp: cat_cs_simps cat_Kan_cs_simps\n                cs_intro: cat_cs_intros cat_Kan_cs_intros\n            )\n\n        then have [cat_Kan_cs_intros]: \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr> : b \\<mapsto>\\<^bsub>\\<AA>\\<^esub> c\"\n          if \"a \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" \n            and \"b = \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr>\" \n            and \"c = ?the_cf_rKe\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr>\"\n          for a b c\n          using that(1) unfolding that(2,3) by simp\n\n        show \n          \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> =\n            ?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr>\"\n          if f_is_arr: \"f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\" for a b f\n        proof-\n\n          note f = \\<KK>.HomCod.cat_is_arrD[OF that]\n          note lim_a = assms(3)[OF f(2)] and lim_b = assms(3)[OF f(3)]\n\n          interpret lim_a: is_cat_limit \n            \\<alpha> \\<open>a \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F a \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj a\\<close> \\<open>?UArr a\\<close>\n            by (rule lim_a)\n          interpret lim_b: is_cat_limit \n            \\<alpha> \\<open>b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F b \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj b\\<close> \\<open>?UArr b\\<close>\n            by (rule lim_b)\n\n          from f have a: \"a \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" and b: \"b \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\n          \n          from lim_b.cat_lim_unique_cone'[OF \\<tau>[OF that]] obtain g' \n            where g': \"g' : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj b\"\n              and \\<tau>_NTMap_app: \"\\<And>A. A \\<in>\\<^sub>\\<circ> (b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>) \\<Longrightarrow>\n                \\<tau> a b f\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> = ?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> g'\"\n              and g'_unique: \"\\<And>g''.\n                \\<lbrakk>\n                  g'' : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj b;\n                  \\<And>A. A \\<in>\\<^sub>\\<circ> b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr> \\<Longrightarrow>\n                    \\<tau> a b f\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> = ?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> g''\n                \\<rbrakk> \\<Longrightarrow> g'' = g'\"\n            by metis\n\n          have lim_Obj_a_f\\<KK>[symmetric, cat_Kan_cs_simps]:\n            \"?UArr a\\<lparr>NTMap\\<rparr>\\<lparr>a', b', f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\\<rparr>\\<^sub>\\<bullet> =\n              ?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> ?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\"\n            if \"A = [a', b', f']\\<^sub>\\<circ>\" and \"A \\<in>\\<^sub>\\<circ> b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\" for A a' b' f'\n          proof-\n            from that(2) f_is_arr have a'_def: \"a' = 0\" \n              and b': \"b' \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\" \n              and f': \"f' : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n              unfolding that(1) by auto\n            show ?thesis \n              unfolding that(1) \n              by \n                (\n                  rule \n                    lim_Obj_the_cf_rKe_commute\n                      [\n                        where lim_Obj=lim_Obj, \n                        OF \n                          assms(1,2) \n                          lim_a \n                          lim_b \n                          f_is_arr \n                          that(2)[unfolded that(1)] \n                      ]\n                )\n          qed\n          {\n            fix a' b' f' A\n            note \\<TT>.HomCod.cat_assoc_helper[\n              where h=\\<open>?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>a',b',f'\\<rparr>\\<^sub>\\<bullet>\\<close> \n                and g=\\<open>?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\\<close>\n                and q=\\<open>?UArr a\\<lparr>NTMap\\<rparr>\\<lparr>a', b', f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\\<rparr>\\<^sub>\\<bullet>\\<close>\n                ]\n          }\n          note [cat_Kan_cs_simps] = this\n\n          show ?thesis\n          proof(rule trans_sym[where s=g'])\n            show \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = g'\"\n            proof(rule g'_unique)\n              from that show\n                \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj b\"\n                by (cs_concl cs_intro: cat_cs_intros cat_Kan_cs_intros)\n              fix A assume prems': \"A \\<in>\\<^sub>\\<circ> b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n              with f_is_arr obtain b' f' \n                where A_def: \"A = [0, b', f']\\<^sub>\\<circ>\"\n                  and b': \"b' \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\"\n                  and f': \"f' : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n                by auto\n              from f_is_arr prems' show\n                \"\\<tau> a b f\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> =\n                  ?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> (\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>)\"\n                unfolding A_def\n                by\n                  (\n                    cs_concl \n                      cs_simp: cat_cs_simps cat_Kan_cs_simps\n                      cs_intro: cat_cs_intros cat_Kan_cs_intros\n                  )\n            qed\n            show \"?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr> = g'\"\n            proof(rule g'_unique)                  \n              fix A assume prems': \"A \\<in>\\<^sub>\\<circ> b \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n              with f_is_arr obtain b' f' \n                where A_def: \"A = [0, b', f']\\<^sub>\\<circ>\"\n                  and b': \"b' \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\"\n                  and f': \"f' : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n                by auto\n              {\n                fix a' b' f' A\n                note \\<TT>.HomCod.cat_assoc_helper\n                  [\n                    where h=\\<open>?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>a', b', f'\\<rparr>\\<^sub>\\<bullet>\\<close> \n                      and g=\\<open>\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr>\\<close>\n                      and q=\\<open>\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>b'\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ArrMap\\<rparr>\\<lparr>f'\\<rparr>\\<close>\n                  ]\n              }\n              note [cat_Kan_cs_simps] = \n                this\n                \\<epsilon>b_\\<GG>f[OF A_def prems' b, symmetric]\n                \\<epsilon>b_\\<GG>f[symmetric]\n              from f_is_arr prems' b' f' show \n                \"\\<tau> a b f\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> =\n                  ?UArr b\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \n                    (?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr>)\"\n                unfolding A_def\n                by\n                  (\n                    cs_concl\n                      cs_simp: \n                        cat_cs_simps \n                        cat_Kan_cs_simps \n                        cat_comma_cs_simps\n                        cat_op_simps\n                      cs_intro: \n                        cat_cs_intros \n                        cat_Kan_cs_intros \n                        cat_comma_cs_intros \n                        cat_op_intros\n                  )\n            qed\n              (\n                use that in\n                  \\<open>\n                    cs_concl \n                      cs_simp: cat_Kan_cs_simps\n                      cs_intro: cat_cs_intros cat_Kan_cs_intros\n                  \\<close>\n              )\n          qed\n        qed\n      qed\n        (\n          cs_concl cs_shallow\n            cs_simp: cat_cs_simps cat_Kan_cs_simps\n            cs_intro: cat_cs_intros\n        )+\n      then interpret \\<sigma>: is_ntcf \\<alpha> \\<CC> \\<AA> \\<GG> \\<open>?the_cf_rKe\\<close> \\<sigma> by simp\n\n      show \"\\<epsilon> = ?the_ntcf_rKe \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n      proof(rule ntcf_eqI)\n        have dom_lhs: \"\\<D>\\<^sub>\\<circ> (\\<epsilon>\\<lparr>NTMap\\<rparr>) = \\<BB>\\<lparr>Obj\\<rparr>\" \n          by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n        have dom_rhs: \"\\<D>\\<^sub>\\<circ> ((?the_ntcf_rKe \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>))\\<lparr>NTMap\\<rparr>) = \\<BB>\\<lparr>Obj\\<rparr>\"\n          by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n        show \"\\<epsilon>\\<lparr>NTMap\\<rparr> = (?the_ntcf_rKe \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>))\\<lparr>NTMap\\<rparr>\"\n        proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n          fix b assume prems': \"b \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\"\n          note [cat_Kan_cs_simps] = \\<epsilon>b_\\<GG>f[\n            where f=\\<open>\\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\\<rparr>\\<close> and c=\\<open>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\\<close>, symmetric\n            ]\n          from prems' \\<sigma> show \n            \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr> = (?the_ntcf_rKe \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>))\\<lparr>NTMap\\<rparr>\\<lparr>b\\<rparr>\"\n            by\n              (\n                cs_concl \n                  cs_simp: cat_cs_simps cat_comma_cs_simps cat_Kan_cs_simps \n                  cs_intro: cat_cs_intros cat_comma_cs_intros cat_Kan_cs_intros\n              )\n        qed (cs_concl cs_intro: cat_cs_intros V_cs_intros)\n      qed (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)+\n\n      fix \\<sigma>' assume prems':\n        \"\\<sigma>' : \\<GG> \\<mapsto>\\<^sub>C\\<^sub>F ?the_cf_rKe : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n        \"\\<epsilon> = ?the_ntcf_rKe \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n\n      interpret \\<sigma>': is_ntcf \\<alpha> \\<CC> \\<AA> \\<GG> \\<open>?the_cf_rKe\\<close> \\<sigma>' by (rule prems'(1))\n\n      have \\<epsilon>_NTMap_app[symmetric, cat_Kan_cs_simps]: \n        \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>b'\\<rparr> =\n          ?UArr (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>)\\<lparr>NTMap\\<rparr>\\<lparr>a', b', \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\\<rparr>\\<rparr>\\<^sub>\\<bullet> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub>\n          \\<sigma>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\\<rparr>\"\n        if \"b' \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\" and \"a' = 0\" for a' b'\n      proof-\n        from prems'(2) have \\<epsilon>_NTMap_app: \n          \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>b'\\<rparr> = (?the_ntcf_rKe \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>))\\<lparr>NTMap\\<rparr>\\<lparr>b'\\<rparr>\"\n          for b'\n          by simp\n        show ?thesis\n          using \\<epsilon>_NTMap_app[of b'] that(1)\n          unfolding that(2)\n          by\n            (\n              cs_prems cs_shallow\n                cs_simp: cat_cs_simps cat_comma_cs_simps cat_Kan_cs_simps\n                cs_intro: cat_cs_intros cat_comma_cs_intros\n            )\n      qed\n      {\n        fix a' b' f' A\n        note \\<TT>.HomCod.cat_assoc_helper\n          [\n            where h= \\<open>?UArr (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>)\\<lparr>NTMap\\<rparr>\\<lparr>a', b', \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\\<rparr>\\<rparr>\\<^sub>\\<bullet>\\<close>\n              and g=\\<open>\\<sigma>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\\<rparr>\\<close>\n              and q=\\<open>\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>b'\\<rparr>\\<close>\n          ]\n      }\n      note [cat_Kan_cs_simps] = this \\<epsilon>b_\\<GG>f[symmetric]\n      {\n        fix a' b' f' A\n        note \\<TT>.HomCod.cat_assoc_helper\n          [\n            where h=\n              \\<open>?UArr (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>)\\<lparr>NTMap\\<rparr>\\<lparr>a', b', \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\\<rparr>\\<rparr>\\<^sub>\\<bullet>\\<close>\n            and g=\\<open>\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\\<rparr>\\<close>\n            and q=\\<open>\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>b'\\<rparr>\\<close>\n          ]\n      }\n      note [cat_Kan_cs_simps] = this\n\n      show \"\\<sigma>' = \\<sigma>\"\n      proof(rule ntcf_eqI)\n\n        show \"\\<sigma>' : \\<GG> \\<mapsto>\\<^sub>C\\<^sub>F ?the_cf_rKe : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\" by (rule prems'(1))\n        show \"\\<sigma> : \\<GG> \\<mapsto>\\<^sub>C\\<^sub>F ?the_cf_rKe : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\" by (rule \\<sigma>)\n\n        have dom_lhs: \"\\<D>\\<^sub>\\<circ> (\\<sigma>\\<lparr>NTMap\\<rparr>) = \\<CC>\\<lparr>Obj\\<rparr>\" \n          by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n        have dom_rhs: \"\\<D>\\<^sub>\\<circ> (\\<sigma>'\\<lparr>NTMap\\<rparr>) = \\<CC>\\<lparr>Obj\\<rparr>\"\n          by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n\n        show \"\\<sigma>'\\<lparr>NTMap\\<rparr> = \\<sigma>\\<lparr>NTMap\\<rparr>\"\n        proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n\n          fix c assume prems': \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n\n          note lim_c = assms(3)[OF prems']\n          interpret lim_c: is_cat_limit \n            \\<alpha> \\<open>c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F c \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj c\\<close> \\<open>?UArr c\\<close>\n            by (rule lim_c)\n          from prems' have CId_c: \"\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr> : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c\"\n            by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n\n          from lim_c.cat_lim_unique_cone'[OF \\<tau>[OF CId_c]] obtain f \n            where f: \"f : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c\"\n              and \"\\<And>A. A \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr> \\<Longrightarrow>\n                \\<tau> c c (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>)\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> = ?UArr c\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> f\"\n              and f_unique: \"\\<And>f'.\n                \\<lbrakk>\n                  f' : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> ?UObj c;\n                  \\<And>A. A \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr> \\<Longrightarrow>\n                    \\<tau> c c (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>)\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> = ?UArr c\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> f'\n                \\<rbrakk> \\<Longrightarrow> f' = f\"\n            by metis\n\n          note [symmetric, cat_cs_simps] =\n            \\<sigma>.ntcf_Comp_commute\n            \\<sigma>'.ntcf_Comp_commute\n\n          show \"\\<sigma>'\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr> = \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>\"\n          proof(rule trans_sym[where s=f])\n\n            show \"\\<sigma>'\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr> = f\"\n            proof(rule f_unique)\n\n              fix A assume prems'': \"A \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n\n              with prems' obtain b' f' \n                where A_def: \"A = [0, b', f']\\<^sub>\\<circ>\"\n                  and b': \"b' \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\"\n                  and f': \"f' : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n                by auto\n\n              let ?\\<KK>b' = \\<open>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\\<close>\n\n              from b' have \\<KK>b': \"?\\<KK>b' \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n                by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n\n              interpret lim_\\<KK>b': is_cat_limit\n                \\<alpha> \\<open>?\\<KK>b' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F ?\\<KK>b' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj ?\\<KK>b'\\<close> \\<open>?UArr ?\\<KK>b'\\<close>\n                by (rule assms(3)[OF \\<KK>b'])\n\n              from \\<KK>b' have CId_\\<KK>b': \"\\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>b'\\<rparr> : ?\\<KK>b' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> ?\\<KK>b'\"\n                by (cs_concl cs_intro: cat_cs_intros)\n              from CId_\\<KK>b' b' have a'_b'_CId_\\<KK>b':\n                \"[0, b', \\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>b'\\<rparr>]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> ?\\<KK>b' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n                by\n                  (\n                    cs_concl cs_shallow\n                      cs_simp: cat_cs_simps cat_comma_cs_simps\n                      cs_intro: cat_cs_intros cat_comma_cs_intros\n                  )\n              from \n                lim_Obj_the_cf_rKe_commute[\n                  where lim_Obj=lim_Obj, \n                  OF assms(1,2) lim_c assms(3)[OF \\<KK>b'] f' a'_b'_CId_\\<KK>b'\n                  ]\n                f'\n              have [cat_Kan_cs_simps]:\n                \"?UArr c\\<lparr>NTMap\\<rparr>\\<lparr>0, b', f'\\<rparr>\\<^sub>\\<bullet> =\n                  ?UArr ?\\<KK>b'\\<lparr>NTMap\\<rparr>\\<lparr>0, b', \\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>b'\\<rparr>\\<rparr>\\<^sub>\\<bullet> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \n                    ?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>f'\\<rparr>\"\n                by (cs_prems cs_shallow cs_simp: cat_cs_simps)\n\n              from prems' prems'' b' f' show\n                \"\\<tau> c c (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>)\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> = ?UArr c\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<sigma>'\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>\"\n                unfolding A_def (*very slow*)\n                by\n                  (\n                    cs_concl \n                      cs_simp:\n                        cat_cs_simps cat_comma_cs_simps cat_Kan_cs_simps\n                      cs_intro:\n                        cat_lim_cs_intros \n                        cat_cs_intros \n                        cat_comma_cs_intros   \n                        cat_Kan_cs_intros\n                  )\n            qed\n              (\n                use prems' in\n                  \\<open>\n                    cs_concl cs_shallow \n                      cs_simp: cat_Kan_cs_simps cs_intro: cat_cs_intros\n                  \\<close>\n              )\n\n            show \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr> = f\"\n            proof(rule f_unique)\n              fix A assume prems'': \"A \\<in>\\<^sub>\\<circ> c \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n              from this prems' obtain b' f' \n                where A_def: \"A = [0, b', f']\\<^sub>\\<circ>\"\n                  and b': \"b' \\<in>\\<^sub>\\<circ> \\<BB>\\<lparr>Obj\\<rparr>\"\n                  and f': \"f' : c \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\"\n                by auto\n              let ?\\<KK>b' = \\<open>\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>b'\\<rparr>\\<close>\n              from b' have \\<KK>b': \"?\\<KK>b' \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n                by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n              interpret lim_\\<KK>b': is_cat_limit\n                \\<alpha> \\<open>?\\<KK>b' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F ?\\<KK>b' \\<^sub>O\\<Sqinter>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<open>?UObj ?\\<KK>b'\\<close> \\<open>?UArr ?\\<KK>b'\\<close>\n                by (rule assms(3)[OF \\<KK>b'])\n              from \\<KK>b' have CId_\\<KK>b': \"\\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>b'\\<rparr> : ?\\<KK>b' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> ?\\<KK>b'\"\n                by (cs_concl cs_intro: cat_cs_intros)\n              from CId_\\<KK>b' b' have a'_b'_CId_\\<KK>b': \n                \"[0, b', \\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>b'\\<rparr>]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> ?\\<KK>b' \\<down>\\<^sub>C\\<^sub>F \\<KK>\\<lparr>Obj\\<rparr>\"\n                by\n                  (\n                    cs_concl cs_shallow\n                      cs_simp: cat_cs_simps cat_comma_cs_simps\n                      cs_intro: cat_cs_intros cat_comma_cs_intros\n                  )\n\n              from \n                lim_Obj_the_cf_rKe_commute\n                  [\n                    where lim_Obj=lim_Obj, \n                    OF assms(1,2) lim_c assms(3)[OF \\<KK>b'] f' a'_b'_CId_\\<KK>b'\n                  ]\n                f'\n              have [cat_Kan_cs_simps]:\n                \"?UArr c\\<lparr>NTMap\\<rparr>\\<lparr>0, b', f'\\<rparr>\\<^sub>\\<bullet> =\n                  ?UArr (?\\<KK>b')\\<lparr>NTMap\\<rparr>\\<lparr>0, b', \\<CC>\\<lparr>CId\\<rparr>\\<lparr>?\\<KK>b'\\<rparr>\\<rparr>\\<^sub>\\<bullet> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub>\n                    ?the_cf_rKe\\<lparr>ArrMap\\<rparr>\\<lparr>f'\\<rparr>\"\n                by (cs_prems cs_shallow cs_simp: cat_cs_simps)\n              from prems' prems'' b' f' show\n                \"\\<tau> c c (\\<CC>\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>)\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> = ?UArr c\\<lparr>NTMap\\<rparr>\\<lparr>A\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<AA>\\<^esub> \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr>\"\n                unfolding A_def (*very slow*)\n                by\n                  (\n                    cs_concl \n                      cs_simp:\n                        cat_cs_simps cat_comma_cs_simps cat_Kan_cs_simps \n                      cs_intro:\n                        cat_lim_cs_intros\n                        cat_cs_intros\n                        cat_comma_cs_intros\n                        cat_Kan_cs_intros\n                  )\n            qed\n              (\n                use prems' in\n                  \\<open>\n                    cs_concl cs_shallow\n                      cs_simp: cat_Kan_cs_simps cs_intro: cat_cs_intros\n                  \\<close>\n              )\n          qed\n\n        qed auto\n\n      qed simp_all\n\n    qed\n\n  qed (cs_concl cs_shallow cs_intro: cat_cs_intros)+\n\nqed\n\nlemma the_ntcf_lKe_is_cat_lKe:\n  assumes \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<And>c. c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr> \\<Longrightarrow> lim_Obj c\\<lparr>UArr\\<rparr> :\n      \\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m lim_Obj c\\<lparr>UObj\\<rparr> : \\<KK> \\<^sub>C\\<^sub>F\\<down> c \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"the_ntcf_lKe \\<alpha> \\<TT> \\<KK> lim_Obj :\n    \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> the_cf_lKe \\<alpha> \\<TT> \\<KK> lim_Obj \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C \\<AA>\"\nproof-\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<CC> \\<KK> by (rule assms(1))\n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n  {\n    fix c assume prems: \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    from assms(3)[OF this] have lim_Obj_UArr: \"lim_Obj c\\<lparr>UArr\\<rparr> :\n      \\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m lim_Obj c\\<lparr>UObj\\<rparr> : \\<KK> \\<^sub>C\\<^sub>F\\<down> c \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\". \n    then interpret lim_Obj_c: is_cat_colimit \n      \\<alpha> \\<open>\\<KK> \\<^sub>C\\<^sub>F\\<down> c\\<close> \\<AA> \\<open>\\<TT> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<^sub>C\\<^sub>F\\<Sqinter>\\<^sub>O c\\<close> \\<open>lim_Obj c\\<lparr>UObj\\<rparr>\\<close> \\<open>lim_Obj c\\<lparr>UArr\\<rparr>\\<close>\n      by simp\n    note op_ua_UArr_is_cat_limit'[\n      where lim_Obj=lim_Obj, OF assms(1,2) prems lim_Obj_UArr\n      ]\n  }\n  note the_ntcf_rKe_is_cat_rKe = the_ntcf_rKe_is_cat_rKe\n    [\n      OF \\<KK>.is_functor_op \\<TT>.is_functor_op,\n      unfolded cat_op_simps,\n      where lim_Obj=\\<open>op_ua lim_Obj \\<KK>\\<close>,\n      unfolded cat_op_simps,\n      OF this,\n      simplified,\n      folded the_cf_lKe_def the_ntcf_lKe_def\n    ]\n  show ?thesis\n    by \n      (\n        rule is_cat_rKe.is_cat_lKe_op\n          [\n            OF the_ntcf_rKe_is_cat_rKe, \n            unfolded cat_op_simps, \n            folded the_cf_lKe_def the_ntcf_lKe_def\n          ]\n      )\nqed\n\n\n\nsubsection\\<open>Preservation of Kan extensions\\<close>\n\n\ntext\\<open>\nThe following definitions are similar to the definitions that can be \nfound in \\<^cite>\\<open>\"riehl_category_2016\"\\<close> or \\<^cite>\\<open>\"lehner_all_2014\"\\<close>.\n\\<close>\n\nlocale is_cat_rKe_preserves =\n  is_cat_rKe \\<alpha> \\<BB> \\<CC> \\<AA> \\<KK> \\<TT> \\<GG> \\<epsilon> + is_functor \\<alpha> \\<AA> \\<DD> \\<HH>\n  for \\<alpha> \\<BB> \\<CC> \\<AA> \\<DD> \\<KK> \\<TT> \\<GG> \\<HH> \\<epsilon> +\n  assumes cat_rKe_preserves:\n    \"\\<HH> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<epsilon> : (\\<HH> \\<circ>\\<^sub>C\\<^sub>F \\<GG>) \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<HH> \\<circ>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C \\<DD>\"\n\nsyntax \"_is_cat_rKe_preserves\" :: \n  \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> bool\"\n  (\n    \\<open>(_ :/ _ \\<circ>\\<^sub>C\\<^sub>F _ \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<index> _ :/ _ \\<mapsto>\\<^sub>C _ \\<mapsto>\\<^sub>C _ : _ \\<mapsto>\\<mapsto>\\<^sub>C _)\\<close> \n    [51, 51, 51, 51, 51, 51, 51, 51, 51] 51\n  )\ntranslations \"\\<epsilon> : \\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<TT> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C (\\<HH> : \\<AA> \\<mapsto>\\<mapsto>\\<^sub>C \\<DD>)\" \\<rightleftharpoons> \n  \"CONST is_cat_rKe_preserves \\<alpha> \\<BB> \\<CC> \\<AA> \\<DD> \\<KK> \\<TT> \\<GG> \\<HH> \\<epsilon>\"\n\nlocale is_cat_lKe_preserves =\n  is_cat_lKe \\<alpha> \\<BB> \\<CC> \\<AA> \\<KK> \\<TT> \\<FF> \\<eta> + is_functor \\<alpha> \\<AA> \\<DD> \\<HH>\n  for \\<alpha> \\<BB> \\<CC> \\<AA> \\<DD> \\<KK> \\<TT> \\<FF> \\<HH> \\<eta> +\n  assumes cat_lKe_preserves:\n    \"\\<HH> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta> : \\<HH> \\<circ>\\<^sub>C\\<^sub>F \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> (\\<HH> \\<circ>\\<^sub>C\\<^sub>F \\<FF>) \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C \\<DD>\"\n\nsyntax \"_is_cat_lKe_preserves\" :: \n  \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> bool\"\n  (\n    \\<open>(_ :/ _ \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<index> _ \\<circ>\\<^sub>C\\<^sub>F _ :/ _ \\<mapsto>\\<^sub>C _ \\<mapsto>\\<^sub>C _ : _ \\<mapsto>\\<mapsto>\\<^sub>C _)\\<close> \n    [51, 51, 51, 51, 51, 51, 51, 51, 51] 51\n  )\ntranslations \"\\<eta> : \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C (\\<HH> : \\<AA> \\<mapsto>\\<mapsto>\\<^sub>C \\<DD>)\" \\<rightleftharpoons>\n  \"CONST is_cat_lKe_preserves \\<alpha> \\<BB> \\<CC> \\<AA> \\<DD> \\<KK> \\<TT> \\<FF> \\<HH> \\<eta>\"\n\n\ntext\\<open>Rules.\\<close>\n\nlemma (in is_cat_rKe_preserves) is_cat_rKe_preserves_axioms':\n  assumes \"\\<alpha>' = \\<alpha>\"\n    and \"\\<GG>' = \\<GG>\"\n    and \"\\<KK>' = \\<KK>\"\n    and \"\\<TT>' = \\<TT>\"\n    and \"\\<HH>' = \\<HH>\"\n    and \"\\<BB>' = \\<BB>\"\n    and \"\\<AA>' = \\<AA>\"\n    and \"\\<CC>' = \\<CC>\"\n    and \"\\<DD>' = \\<DD>\"\n  shows \"\\<epsilon> : \\<GG>' \\<circ>\\<^sub>C\\<^sub>F \\<KK>' \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>'\\<^esub> \\<TT>' : \\<BB>' \\<mapsto>\\<^sub>C \\<CC>' \\<mapsto>\\<^sub>C (\\<HH>' : \\<AA>' \\<mapsto>\\<mapsto>\\<^sub>C \\<DD>')\"\n  unfolding assms by (rule is_cat_rKe_preserves_axioms)\n\nmk_ide rf is_cat_rKe_preserves_def[unfolded is_cat_rKe_preserves_axioms_def]\n  |intro is_cat_rKe_preservesI|\n  |dest is_cat_rKe_preservesD[dest]|\n  |elim is_cat_rKe_preservesE[elim]|\n\nlemmas [cat_Kan_cs_intros] = is_cat_rKeD(1-3)\n\nlemma (in is_cat_lKe_preserves) is_cat_lKe_preserves_axioms':\n  assumes \"\\<alpha>' = \\<alpha>\"\n    and \"\\<FF>' = \\<FF>\"\n    and \"\\<KK>' = \\<KK>\"\n    and \"\\<TT>' = \\<TT>\"\n    and \"\\<HH>' = \\<HH>\"\n    and \"\\<BB>' = \\<BB>\"\n    and \"\\<AA>' = \\<AA>\"\n    and \"\\<CC>' = \\<CC>\"\n    and \"\\<DD>' = \\<DD>\"\n  shows \"\\<eta> : \\<TT>' \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<FF>' \\<circ>\\<^sub>C\\<^sub>F \\<KK>' : \\<BB>' \\<mapsto>\\<^sub>C \\<CC>' \\<mapsto>\\<^sub>C (\\<HH>' : \\<AA>' \\<mapsto>\\<mapsto>\\<^sub>C \\<DD>')\"\n  unfolding assms by (rule is_cat_lKe_preserves_axioms)\n\nmk_ide rf is_cat_lKe_preserves_def[unfolded is_cat_lKe_preserves_axioms_def]\n  |intro is_cat_lKe_preservesI|\n  |dest is_cat_lKe_preservesD[dest]|\n  |elim is_cat_lKe_preservesE[elim]|\n\nlemmas [cat_Kan_cs_intros] = is_cat_lKe_preservesD(1-3)\n\n\ntext\\<open>Duality.\\<close>\n\nlemma (in is_cat_rKe_preserves) is_cat_rKe_preserves_op:\n  \"op_ntcf \\<epsilon> :\n    op_cf \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> op_cf \\<GG> \\<circ>\\<^sub>C\\<^sub>F op_cf \\<KK> :\n    op_cat \\<BB> \\<mapsto>\\<^sub>C op_cat \\<CC> \\<mapsto>\\<^sub>C (op_cf \\<HH> : op_cat \\<AA> \\<mapsto>\\<mapsto>\\<^sub>C op_cat \\<DD>)\"\nproof(intro is_cat_lKe_preservesI)\n  from cat_rKe_preserves show \"op_cf \\<HH> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf \\<epsilon> :\n    op_cf \\<HH> \\<circ>\\<^sub>C\\<^sub>F op_cf \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> (op_cf \\<HH> \\<circ>\\<^sub>C\\<^sub>F op_cf \\<GG>) \\<circ>\\<^sub>C\\<^sub>F op_cf \\<KK> :\n    op_cat \\<BB> \\<mapsto>\\<^sub>C op_cat \\<CC> \\<mapsto>\\<^sub>C op_cat \\<DD>\"\n    by (cs_concl_step op_ntcf_cf_ntcf_comp[symmetric])\n      (cs_concl cs_shallow cs_simp: cat_op_simps cs_intro: cat_op_intros)\nqed (cs_concl cs_shallow cs_simp: cat_op_simps cs_intro: cat_op_intros)+\n\nlemma (in is_cat_rKe_preserves) is_cat_lKe_preserves_op'[cat_op_intros]:\n  assumes \"\\<TT>' = op_cf \\<TT>\"\n    and \"\\<GG>' = op_cf \\<GG>\"\n    and \"\\<KK>' = op_cf \\<KK>\"\n    and \"\\<BB>' = op_cat \\<BB>\"\n    and \"\\<AA>' = op_cat \\<AA>\"\n    and \"\\<CC>' = op_cat \\<CC>\"\n    and \"\\<DD>' = op_cat \\<DD>\"\n    and \"\\<HH>' = op_cf \\<HH>\"\n  shows \"op_ntcf \\<epsilon> :\n    \\<TT>' \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<GG>' \\<circ>\\<^sub>C\\<^sub>F \\<KK>' : \\<BB>' \\<mapsto>\\<^sub>C \\<CC>' \\<mapsto>\\<^sub>C (\\<HH>' : \\<AA>' \\<mapsto>\\<mapsto>\\<^sub>C \\<DD>')\"\n  unfolding assms by (rule is_cat_rKe_preserves_op)\n\nlemmas [cat_op_intros] = is_cat_rKe_preserves.is_cat_lKe_preserves_op'\n\nlemma (in is_cat_lKe_preserves) is_cat_rKe_preserves_op:\n  \"op_ntcf \\<eta> :\n    op_cf \\<FF> \\<circ>\\<^sub>C\\<^sub>F op_cf \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> op_cf \\<TT> :\n    op_cat \\<BB> \\<mapsto>\\<^sub>C op_cat \\<CC> \\<mapsto>\\<^sub>C (op_cf \\<HH> : op_cat \\<AA> \\<mapsto>\\<mapsto>\\<^sub>C op_cat \\<DD>)\"\nproof(intro is_cat_rKe_preservesI)\n  from cat_lKe_preserves show \"op_cf \\<HH> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F op_ntcf \\<eta> :\n    (op_cf \\<HH> \\<circ>\\<^sub>C\\<^sub>F op_cf \\<FF>) \\<circ>\\<^sub>C\\<^sub>F op_cf \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> op_cf \\<HH> \\<circ>\\<^sub>C\\<^sub>F op_cf \\<TT> :\n    op_cat \\<BB> \\<mapsto>\\<^sub>C op_cat \\<CC> \\<mapsto>\\<^sub>C op_cat \\<DD>\"\n    by (cs_concl_step op_ntcf_cf_ntcf_comp[symmetric])\n      (cs_concl cs_shallow cs_simp: cat_op_simps cs_intro: cat_op_intros)\nqed (cs_concl cs_shallow cs_simp: cat_op_simps cs_intro: cat_op_intros)+\n\nlemma (in is_cat_lKe_preserves) is_cat_rKe_preserves_op'[cat_op_intros]:\n  assumes \"\\<TT>' = op_cf \\<TT>\"\n    and \"\\<FF>' = op_cf \\<FF>\"\n    and \"\\<KK>' = op_cf \\<KK>\"\n    and \"\\<HH>' = op_cf \\<HH>\"\n    and \"\\<BB>' = op_cat \\<BB>\"\n    and \"\\<AA>' = op_cat \\<AA>\"\n    and \"\\<CC>' = op_cat \\<CC>\"\n    and \"\\<DD>' = op_cat \\<DD>\"\n  shows \"op_ntcf \\<eta> :\n    \\<FF>' \\<circ>\\<^sub>C\\<^sub>F \\<KK>' \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<TT>' : \\<BB>' \\<mapsto>\\<^sub>C \\<CC>' \\<mapsto>\\<^sub>C (\\<HH>' : \\<AA>' \\<mapsto>\\<mapsto>\\<^sub>C \\<DD>')\"\n  unfolding assms by (rule is_cat_rKe_preserves_op)\n\n\n\nsubsection\\<open>All concepts are Kan extensions\\<close>\n\n\ntext\\<open>\nBackground information for this subsection is provided in \nChapter X-7 in \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close>\nand subsection 6.5 in \\<^cite>\\<open>\"riehl_category_2016\"\\<close>. \nIt should be noted that only the connections between the Kan extensions,\nlimits and adjunctions are exposed (an alternative proof of the Yoneda\nlemma using Kan extensions is not provided in the context of this work).\n\\<close>\n\n\nsubsubsection\\<open>Limits and colimits\\<close>\n\nlemma cat_rKe_is_cat_limit:\n  \\<comment>\\<open>The statement of the theorem is similar to the statement of a part of\n    Theorem 1 in Chapter X-7 in \\cite{mac_lane_categories_2010}\n    or Proposition 6.5.1 in \\cite{riehl_category_2016}.\\<close>\n  assumes \"\\<epsilon> : \\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<TT> : \\<BB> \\<mapsto>\\<^sub>C cat_1 \\<aa> \\<ff> \\<mapsto>\\<^sub>C \\<AA>\"\n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"\\<epsilon> : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\nproof-\n\n  interpret \\<epsilon>: is_cat_rKe \\<alpha> \\<BB> \\<open>cat_1 \\<aa> \\<ff>\\<close> \\<AA> \\<KK> \\<TT> \\<GG> \\<epsilon> by (rule assms(1))  \n  interpret \\<TT>: is_functor \\<alpha> \\<BB> \\<AA> \\<TT> by (rule assms(2))\n  \n  from cat_1_components(1) have \\<aa>: \"\\<aa> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    by (auto simp: \\<epsilon>.AG.HomCod.cat_in_Obj_in_Vset)\n  from cat_1_components(2) have \\<ff>: \"\\<ff> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    by (auto simp: \\<epsilon>.AG.HomCod.cat_in_Arr_in_Vset)\n\n  have \\<KK>_def: \"\\<KK> = cf_const \\<BB> (cat_1 \\<aa> \\<ff>) \\<aa>\"\n    by (rule cf_const_if_HomCod_is_cat_1) \n      (cs_concl cs_shallow cs_intro: cat_cs_intros)\n  have \\<GG>\\<KK>_def: \"\\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK> = cf_const \\<BB> \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>)\"\n    by\n      (\n        cs_concl cs_shallow\n          cs_simp: cat_1_components(1) \\<KK>_def cat_cs_simps \n          cs_intro: V_cs_intros cat_cs_intros\n      )\n\n  interpret \\<epsilon>: is_ntcf \\<alpha> \\<BB> \\<AA> \\<open>\\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK>\\<close> \\<TT> \\<epsilon> \n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n\n  show \"\\<epsilon> : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  proof(intro is_cat_limitI is_cat_coneI)\n\n    show \"\\<epsilon> : cf_const \\<BB> \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>) \\<mapsto>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      by (rule \\<epsilon>.ntcf_rKe.is_ntcf_axioms[unfolded \\<GG>\\<KK>_def])\n\n    fix u' r' assume prems: \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n\n    interpret u': is_cat_cone \\<alpha> r' \\<BB> \\<AA> \\<TT> u' by (rule prems)\n\n    have \\<GG>_def: \"\\<GG> = cf_const (cat_1 \\<aa> \\<ff>) \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>)\"\n      by (rule cf_const_if_HomDom_is_cat_1[OF \\<epsilon>.Ran.is_functor_axioms])\n\n    from prems have const_r': \"cf_const (cat_1 \\<aa> \\<ff>) \\<AA> r' : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      by \n        (\n          cs_concl \n            cs_simp: cat_cs_simps cs_intro: cat_lim_cs_intros cat_cs_intros\n        )\n\n    have cf_comp_cf_const_r_\\<KK>_def: \n      \"cf_const (cat_1 \\<aa> \\<ff>) \\<AA> r' \\<circ>\\<^sub>C\\<^sub>F \\<KK> = cf_const \\<BB> \\<AA> r'\"\n      by \n        (\n          cs_concl \n            cs_simp: cat_cs_simps \\<KK>_def\n            cs_intro: cat_cs_intros cat_lim_cs_intros\n        )\n\n    from \\<epsilon>.cat_rKe_unique[\n        OF const_r', unfolded cf_comp_cf_const_r_\\<KK>_def, OF u'.is_ntcf_axioms\n        ] \n    obtain \\<sigma> \n      where \\<sigma>: \"\\<sigma> : cf_const (cat_1 \\<aa> \\<ff>) \\<AA> r' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n        and u'_def: \"u' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n        and unique_\\<sigma>: \"\\<And>\\<sigma>'.\n          \\<lbrakk>\n            \\<sigma>' : cf_const (cat_1 \\<aa> \\<ff>) \\<AA> r' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>;\n            u' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\n          \\<rbrakk> \\<Longrightarrow> \\<sigma>' = \\<sigma>\"\n      by auto\n\n    interpret \\<sigma>: is_ntcf \\<alpha> \\<open>cat_1 \\<aa> \\<ff>\\<close> \\<AA> \\<open>cf_const (cat_1 \\<aa> \\<ff>) \\<AA> r'\\<close> \\<GG> \\<sigma>\n      by (rule \\<sigma>)\n    \n    show \"\\<exists>!f'. f' : r' \\<mapsto>\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> \\<and> u' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\<BB> \\<AA> f'\"\n    proof(intro ex1I conjI; (elim conjE)?)\n      fix f' assume prems': \n        \"f' : r' \\<mapsto>\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>\" \"u' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\<BB> \\<AA> f'\"\n      from prems'(1) have \"ntcf_const (cat_1 \\<aa> \\<ff>) \\<AA> f' :\n        cf_const (cat_1 \\<aa> \\<ff>) \\<AA> r' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n        by (subst \\<GG>_def) \n          (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      moreover with prems'(1) have \"u' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (ntcf_const (cat_1 \\<aa> \\<ff>) \\<AA> f' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n        by \n          (\n            cs_concl \n              cs_simp: cat_cs_simps prems'(2) \\<KK>_def cs_intro: cat_cs_intros\n          )\n      ultimately have \\<sigma>_def: \"\\<sigma> = ntcf_const (cat_1 \\<aa> \\<ff>) \\<AA> f'\"\n        by (auto simp: unique_\\<sigma>[symmetric])\n      show \"f' = \\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<rparr>\"\n        by (cs_concl cs_simp: cat_cs_simps \\<sigma>_def cs_intro: cat_cs_intros)\n    qed (cs_concl cs_simp: cat_cs_simps u'_def \\<KK>_def cs_intro: cat_cs_intros)+\n\n  qed (cs_concl cs_simp: \\<KK>_def cs_intro: cat_cs_intros)\n\nqed\n\nlemma cat_lKe_is_cat_colimit:\n  assumes \"\\<eta> : \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<^sub>C cat_1 \\<aa> \\<ff> \\<mapsto>\\<^sub>C \\<AA>\"\n    and \"\\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"\\<eta> : \\<TT> >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m \\<FF>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\nproof-\n  interpret \\<eta>: is_cat_lKe \\<alpha> \\<BB> \\<open>cat_1 \\<aa> \\<ff>\\<close> \\<AA> \\<KK> \\<TT> \\<FF> \\<eta> by (rule assms(1))\n  from cat_1_components(1) have \\<aa>: \"\\<aa> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    by (auto simp: \\<eta>.AG.HomCod.cat_in_Obj_in_Vset)\n  from cat_1_components(2) have \\<ff>: \"\\<ff> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    by (auto simp: \\<eta>.AG.HomCod.cat_in_Arr_in_Vset)\n  show ?thesis\n    by \n      (\n        rule is_cat_limit.is_cat_colimit_op\n          [\n            OF cat_rKe_is_cat_limit[\n              OF \n                \\<eta>.is_cat_rKe_op[unfolded \\<eta>.AG.cat_1_op[OF \\<aa> \\<ff>]] \n                \\<eta>.ntcf_lKe.NTDom.is_functor_op\n              ], \n            unfolded cat_op_simps\n          ]\n      )\nqed\n\nlemma cat_limit_is_rKe:\n  \\<comment>\\<open>The statement of the theorem is similar to the statement of a part of\n    Theorem 1 in Chapter X-7 in \\cite{mac_lane_categories_2010} \n    or Proposition 6.5.1 in \\cite{riehl_category_2016}.\\<close>\n  assumes \"\\<epsilon> : \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_1 \\<aa> \\<ff>\"\n    and \"\\<GG> : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"\\<epsilon> : \\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<TT> : \\<BB> \\<mapsto>\\<^sub>C cat_1 \\<aa> \\<ff> \\<mapsto>\\<^sub>C \\<AA>\"\nproof-\n\n  interpret \\<epsilon>: is_cat_limit \\<alpha> \\<BB> \\<AA> \\<TT> \\<open>\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>\\<close> \\<epsilon> by (rule assms)\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<open>cat_1 \\<aa> \\<ff>\\<close> \\<KK> by (rule assms(2))\n  interpret \\<GG>: is_functor \\<alpha> \\<open>cat_1 \\<aa> \\<ff>\\<close> \\<AA> \\<GG> by (rule assms(3))\n\n  show ?thesis\n  proof(rule is_cat_rKeI')\n\n    note \\<KK>_def = cf_const_if_HomCod_is_cat_1[OF assms(2)]\n    note \\<GG>_def = cf_const_if_HomDom_is_cat_1[OF assms(3)]\n\n    have \\<GG>\\<KK>_def: \"\\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK> = cf_const \\<BB> \\<AA> (\\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>)\"\n      by (subst \\<KK>_def, use nothing in \\<open>subst \\<GG>_def\\<close>)\n        (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n\n    show \"\\<epsilon> : \\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\" \n      by \n        (\n          cs_concl cs_shallow \n            cs_simp: cat_cs_simps \\<GG>\\<KK>_def cs_intro: cat_cs_intros\n        )\n\n    fix \\<GG>' \\<epsilon>' assume prems: \n      \"\\<GG>' : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      \"\\<epsilon>' : \\<GG>' \\<circ>\\<^sub>C\\<^sub>F \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n\n    interpret is_functor \\<alpha> \\<open>cat_1 \\<aa> \\<ff>\\<close> \\<AA> \\<GG>' by (rule prems(1))\n  \n    note \\<GG>'_def = cf_const_if_HomDom_is_cat_1[OF prems(1)]\n\n    from prems(2) have \\<epsilon>': \n      \"\\<epsilon>' : cf_const \\<BB> \\<AA> (\\<GG>'\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>) \\<mapsto>\\<^sub>C\\<^sub>F \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      unfolding \\<KK>_def \n      by (subst (asm) \\<GG>'_def)\n        (cs_prems cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n    from prems(2) have \"\\<epsilon>' : \\<GG>'\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<TT> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n      by (intro is_cat_coneI \\<epsilon>') (cs_concl cs_intro: cat_cs_intros)+\n\n    from \\<epsilon>.cat_lim_ua_fo[OF this] obtain f'\n      where f': \"f' : \\<GG>'\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>\"\n        and \\<epsilon>_def: \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\<BB> \\<AA> f'\"\n        and unique_f':\n          \"\\<lbrakk>\n            f'' : \\<GG>'\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>;\n            \\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\<BB> \\<AA> f''\n          \\<rbrakk> \\<Longrightarrow> f'' = f'\"\n        for f''\n      by metis\n\n    show \"\\<exists>!\\<sigma>.\n      \\<sigma> : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA> \\<and> \\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n    proof(intro ex1I conjI; (elim conjE)?)  \n      from f' show \n        \"ntcf_const (cat_1 \\<aa> \\<ff>) \\<AA> f' : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n        by (subst \\<GG>'_def, use nothing in \\<open>subst \\<GG>_def\\<close>) \n          (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      with f' show \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (ntcf_const (cat_1 \\<aa> \\<ff>) \\<AA> f' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n        by (cs_concl cs_simp: cat_cs_simps \\<epsilon>_def \\<KK>_def cs_intro: cat_cs_intros)\n      fix \\<sigma> assume prems:\n        \"\\<sigma> : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n        \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<sigma> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK>)\"\n      interpret \\<sigma>: is_ntcf \\<alpha> \\<open>cat_1 \\<aa> \\<ff>\\<close> \\<AA> \\<GG>' \\<GG> \\<sigma> by (rule prems(1))\n      have \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<rparr> : \\<GG>'\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> \\<mapsto>\\<^bsub>\\<AA>\\<^esub> \\<GG>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>\"\n        by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      moreover have \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\<BB> \\<AA> (\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<rparr>)\"\n        by\n          (\n            cs_concl \n              cs_simp: cat_cs_simps prems(2) \\<KK>_def cs_intro: cat_cs_intros\n          )\n      ultimately have \\<sigma>\\<aa>: \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<rparr> = f'\" by (rule unique_f')\n      show \"\\<sigma> = ntcf_const (cat_1 \\<aa> \\<ff>) \\<AA> f'\"\n      proof(rule ntcf_eqI)\n        from f' show \n          \"ntcf_const (cat_1 \\<aa> \\<ff>) \\<AA> f' : \\<GG>' \\<mapsto>\\<^sub>C\\<^sub>F \\<GG> : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n          by (subst \\<GG>'_def, use nothing in \\<open>subst \\<GG>_def\\<close>)\n            (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n        have dom_lhs: \"\\<D>\\<^sub>\\<circ> (\\<sigma>\\<lparr>NTMap\\<rparr>) = cat_1 \\<aa> \\<ff>\\<lparr>Obj\\<rparr>\"\n          by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro:cat_cs_intros)\n        have dom_rhs: \"\\<D>\\<^sub>\\<circ> (ntcf_const (cat_1 \\<aa> \\<ff>) \\<AA> f'\\<lparr>NTMap\\<rparr>) = cat_1 \\<aa> \\<ff>\\<lparr>Obj\\<rparr>\"\n          by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro:cat_cs_intros)\n        show \"\\<sigma>\\<lparr>NTMap\\<rparr> = ntcf_const (cat_1 \\<aa> \\<ff>) \\<AA> f'\\<lparr>NTMap\\<rparr>\"\n        proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n          fix a assume prems: \"a \\<in>\\<^sub>\\<circ> cat_1 \\<aa> \\<ff>\\<lparr>Obj\\<rparr>\"\n          then have a_def: \"a = \\<aa>\" unfolding cat_1_components by simp\n          from f' show \"\\<sigma>\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr> = ntcf_const (cat_1 \\<aa> \\<ff>) \\<AA> f'\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr>\"\n            unfolding a_def \\<sigma>\\<aa>\n            by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n        qed (auto intro: cat_cs_intros)\n      qed (simp_all add: prems)\n    qed\n\n  qed (auto simp: assms)\n\nqed\n\nlemma cat_colimit_is_lKe:\n  assumes \"\\<eta> : \\<TT> >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m \\<FF>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n    and \"\\<KK> : \\<BB> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_1 \\<aa> \\<ff>\"\n    and \"\\<FF> : cat_1 \\<aa> \\<ff> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<AA>\"\n  shows \"\\<eta> : \\<TT> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<BB> \\<mapsto>\\<^sub>C cat_1 \\<aa> \\<ff> \\<mapsto>\\<^sub>C \\<AA>\"\nproof-\n  interpret \\<eta>: is_cat_colimit \\<alpha> \\<BB> \\<AA> \\<TT> \\<open>\\<FF>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>\\<close> \\<eta>\n    by (rule assms(1))\n  interpret \\<KK>: is_functor \\<alpha> \\<BB> \\<open>cat_1 \\<aa> \\<ff>\\<close> \\<KK> by (rule assms(2))\n  interpret \\<FF>: is_functor \\<alpha> \\<open>cat_1 \\<aa> \\<ff>\\<close> \\<AA> \\<FF> by (rule assms(3))\n  from cat_1_components(1) have \\<aa>: \"\\<aa> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    by (auto simp: \\<KK>.HomCod.cat_in_Obj_in_Vset)\n  from cat_1_components(2) have \\<ff>: \"\\<ff> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    by (auto simp: \\<KK>.HomCod.cat_in_Arr_in_Vset)\n  have \\<FF>\\<aa>: \"\\<FF>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr> = op_cf \\<FF>\\<lparr>ObjMap\\<rparr>\\<lparr>\\<aa>\\<rparr>\" unfolding cat_op_simps by simp\n  note cat_1_op = \\<eta>.cat_1_op[OF \\<aa> \\<ff>]\n  show ?thesis\n    by \n      (\n        rule is_cat_rKe.is_cat_lKe_op\n          [\n            OF cat_limit_is_rKe\n              [\n                OF \n                  \\<eta>.is_cat_limit_op[unfolded \\<FF>\\<aa>]\n                  \\<KK>.is_functor_op[unfolded cat_1_op]\n                  \\<FF>.is_functor_op[unfolded cat_1_op]\n              ],\n            unfolded cat_op_simps cat_1_op\n          ]\n      )\nqed\n\n\nsubsubsection\\<open>Adjoints\\<close>\n\nlemma (in is_cf_adjunction) cf_adjunction_counit_is_rKe:\n  \\<comment>\\<open>The statement of the theorem is similar to the statement of a part of\n    Theorem 2 in Chapter X-7 in \\cite{mac_lane_categories_2010}\n    or Proposition 6.5.2 in \\cite{riehl_category_2016}.\n    The proof follows (approximately) the proof in \\cite{riehl_category_2016}.\\<close>\n  shows \"\\<epsilon>\\<^sub>C \\<Phi> : \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<GG> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> cf_id \\<DD> : \\<DD> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C \\<DD>\"\nproof-\n\n  define \\<beta> where \"\\<beta> = \\<alpha> + \\<omega>\"\n  have \\<beta>: \"\\<Z> \\<beta>\" and \\<alpha>\\<beta>: \"\\<alpha> \\<in>\\<^sub>\\<circ> \\<beta>\" \n    by (simp_all add: \\<beta>_def \\<Z>_Limit_\\<alpha>\\<omega> \\<Z>_\\<omega>_\\<alpha>\\<omega> \\<Z>_def \\<Z>_\\<alpha>_\\<alpha>\\<omega>)\n  then interpret \\<beta>: \\<Z> \\<beta> by simp\n\n  note exp_adj = cf_adj_exp_cf_cat_exp_cf_cat[OF \\<beta> \\<alpha>\\<beta> R.category_axioms]\n\n  let ?\\<eta> = \\<open>\\<eta>\\<^sub>C \\<Phi>\\<close>\n  let ?\\<epsilon> = \\<open>\\<epsilon>\\<^sub>C \\<Phi>\\<close>\n  let ?\\<DD>\\<eta> = \\<open>exp_cat_ntcf \\<alpha> \\<DD> ?\\<eta>\\<close>\n  let ?\\<DD>\\<FF> = \\<open>exp_cat_cf \\<alpha> \\<DD> \\<FF>\\<close>\n  let ?\\<DD>\\<GG> = \\<open>exp_cat_cf \\<alpha> \\<DD> \\<GG>\\<close>\n  let ?\\<DD>\\<DD> = \\<open>cat_FUNCT \\<alpha> \\<DD> \\<DD>\\<close>\n  let ?\\<CC>\\<DD> = \\<open>cat_FUNCT \\<alpha> \\<CC> \\<DD>\\<close>\n  let ?adj_\\<DD>\\<eta> = \\<open>cf_adjunction_of_unit \\<beta> ?\\<DD>\\<GG> ?\\<DD>\\<FF> ?\\<DD>\\<eta>\\<close>\n\n  interpret \\<DD>\\<eta>: is_cf_adjunction \\<beta> ?\\<CC>\\<DD> ?\\<DD>\\<DD> ?\\<DD>\\<GG> ?\\<DD>\\<FF> ?adj_\\<DD>\\<eta> by (rule exp_adj)\n\n  show ?thesis\n  proof(intro is_cat_rKeI)\n    have id_\\<DD>: \"cf_map (cf_id \\<DD>) \\<in>\\<^sub>\\<circ> cat_FUNCT \\<alpha> \\<DD> \\<DD>\\<lparr>Obj\\<rparr>\"\n      by \n        (\n          cs_concl \n            cs_simp: cat_FUNCT_components(1)\n            cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n        )\n    then have exp_id_\\<DD>: \n      \"exp_cat_cf \\<alpha> \\<DD> \\<FF>\\<lparr>ObjMap\\<rparr>\\<lparr>cf_map (cf_id \\<DD>)\\<rparr> = cf_map \\<FF>\"\n      by \n        (\n          cs_concl \n            cs_simp: cat_cs_simps cat_FUNCT_cs_simps cs_intro: cat_cs_intros\n        )\n    have \\<FF>: \"cf_map \\<FF> \\<in>\\<^sub>\\<circ> cat_FUNCT \\<alpha> \\<CC> \\<DD>\\<lparr>Obj\\<rparr>\"\n      by \n        (\n          cs_concl cs_shallow\n            cs_simp: cat_FUNCT_components(1)\n            cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n        )\n    have \\<epsilon>: \"ntcf_arrow (\\<epsilon>\\<^sub>C \\<Phi>) \\<in>\\<^sub>\\<circ> ntcf_arrows \\<alpha> \\<DD> \\<DD>\"\n      by (cs_concl cs_intro: cat_FUNCT_cs_intros adj_cs_intros)\n    have \\<DD>\\<DD>: \"category \\<beta> (cat_FUNCT \\<alpha> \\<DD> \\<DD>)\"\n      by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n    have \\<CC>\\<DD>: \"category \\<beta> (cat_FUNCT \\<alpha> \\<CC> \\<DD>)\"\n      by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n\n    from \n      \\<epsilon> \\<FF> \\<alpha>\\<beta> id_\\<DD> \n      \\<DD>\\<DD> \\<CC>\\<DD> LR.is_functor_axioms RL.is_functor_axioms R.cat_cf_id_is_functor\n      NT.is_iso_ntcf_axioms \n    have \\<epsilon>_id_\\<DD>: \"\\<epsilon>\\<^sub>C ?adj_\\<DD>\\<eta>\\<lparr>NTMap\\<rparr>\\<lparr>cf_map (cf_id \\<DD>)\\<rparr> = ntcf_arrow ?\\<epsilon>\"\n      by (*slow*)\n        (\n          cs_concl \n            cs_simp:\n              cat_Set_the_inverse[symmetric]\n              cat_op_simps\n              cat_cs_simps\n              cat_FUNCT_cs_simps\n              adj_cs_simps \n            cs_intro:\n              \\<DD>\\<eta>.NT.iso_ntcf_is_iso_arr''\n              cat_op_intros\n              adj_cs_intros\n              cat_cs_intros\n              cat_FUNCT_cs_intros\n              cat_prod_cs_intros\n        )      \n   show \"universal_arrow_fo ?\\<DD>\\<GG> (cf_map (cf_id \\<DD>)) (cf_map \\<FF>) (ntcf_arrow ?\\<epsilon>)\"\n      by \n        (\n          rule is_cf_adjunction.cf_adjunction_counit_component_is_ua_fo[\n            OF exp_adj id_\\<DD>, unfolded exp_id_\\<DD> \\<epsilon>_id_\\<DD>\n            ]\n        )\n  qed (cs_concl cs_intro: cat_cs_intros adj_cs_intros)+\n\nqed\n\nlemma (in is_cf_adjunction) cf_adjunction_unit_is_lKe:\n  shows \"\\<eta>\\<^sub>C \\<Phi> : cf_id \\<CC> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<FF> : \\<CC> \\<mapsto>\\<^sub>C \\<DD> \\<mapsto>\\<^sub>C \\<CC>\"\n  by \n    (\n      rule is_cat_rKe.is_cat_lKe_op\n        [\n          OF is_cf_adjunction.cf_adjunction_counit_is_rKe\n            [\n              OF is_cf_adjunction_op,\n              folded op_ntcf_cf_adjunction_unit op_cf_cf_id\n            ],\n          unfolded \n            cat_op_simps ntcf_op_ntcf_op_ntcf[OF cf_adjunction_unit_is_ntcf]\n        ]\n    )\n\nlemma cf_adjunction_if_lKe_preserves:\n  \\<comment>\\<open>The statement of the theorem is similar to the statement of a part of\n    Theorem 2 in Chapter X-7 in \\cite{mac_lane_categories_2010}\n    or Proposition 6.5.2 in \\cite{riehl_category_2016}.\\<close>\n  assumes \"\\<eta> : cf_id \\<DD> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>l\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<GG> : \\<DD> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C (\\<GG> : \\<DD> \\<mapsto>\\<mapsto>\\<^sub>C \\<CC>)\"\n  shows \"cf_adjunction_of_unit \\<alpha> \\<GG> \\<FF> \\<eta> : \\<GG> \\<rightleftharpoons>\\<^sub>C\\<^sub>F \\<FF> : \\<DD> \\<rightleftharpoons>\\<rightleftharpoons>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof-\n\n  interpret \\<eta>: is_cat_lKe_preserves \\<alpha> \\<DD> \\<CC> \\<DD> \\<CC> \\<GG> \\<open>cf_id \\<DD>\\<close> \\<FF> \\<GG> \\<eta> \n    by (rule assms)\n\n  from \\<eta>.cat_lKe_preserves interpret \\<GG>\\<eta>:\n    is_cat_lKe \\<alpha> \\<DD> \\<CC> \\<CC> \\<GG> \\<GG> \\<open>\\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<FF>\\<close> \\<open>\\<GG> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\\<close>\n    by (cs_prems cs_shallow cs_simp: cat_cs_simps)\n\n  from \n    \\<GG>\\<eta>.cat_lKe_unique\n      [\n        OF \\<eta>.AG.HomCod.cat_cf_id_is_functor,\n        unfolded \\<eta>.AG.cf_cf_comp_cf_id_left,\n        OF \\<eta>.AG.cf_ntcf_id_is_ntcf\n      ]\n  obtain \\<epsilon> where \\<epsilon>: \"\\<epsilon> : \\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F cf_id \\<CC> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and ntcf_id_\\<GG>_def: \"ntcf_id \\<GG> = \\<epsilon> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<GG> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>)\"\n    by metis\n  interpret \\<epsilon>: is_ntcf \\<alpha> \\<CC> \\<CC> \\<open>\\<GG> \\<circ>\\<^sub>C\\<^sub>F \\<FF>\\<close> \\<open>cf_id \\<CC>\\<close> \\<epsilon> by (rule \\<epsilon>)\n  \n  show ?thesis\n  proof(rule counit_unit_is_cf_adjunction)\n\n    show [cat_cs_simps]: \"\\<epsilon> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<GG> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>) = ntcf_id \\<GG>\"\n      by (rule ntcf_id_\\<GG>_def[symmetric])\n\n    have \\<eta>_def: \"\\<eta> = (ntcf_id \\<FF> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<GG>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\"\n      by \n        (\n          cs_concl cs_shallow \n            cs_simp: cat_cs_simps ntcf_id_cf_comp[symmetric] \n            cs_intro: cat_cs_intros\n        )\n    note [cat_cs_simps] = this[symmetric]\n\n    let ?\\<FF>\\<epsilon>\\<GG> = \\<open>\\<FF> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<epsilon> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<GG>\\<close>\n    let ?\\<eta>\\<FF>\\<GG> = \\<open>\\<eta> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<FF> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<GG>\\<close>\n    let ?\\<FF>\\<GG>\\<eta> = \\<open>\\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<GG> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\\<close>\n\n    have \"(?\\<FF>\\<epsilon>\\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?\\<eta>\\<FF>\\<GG>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta> = (?\\<FF>\\<epsilon>\\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?\\<FF>\\<GG>\\<eta>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\"\n    proof(rule ntcf_eqI)\n      have dom_lhs: \"\\<D>\\<^sub>\\<circ> (((?\\<FF>\\<epsilon>\\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?\\<eta>\\<FF>\\<GG>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>)\\<lparr>NTMap\\<rparr>) = \\<DD>\\<lparr>Obj\\<rparr>\"\n        by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      have dom_rhs: \"\\<D>\\<^sub>\\<circ> (((?\\<FF>\\<epsilon>\\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?\\<FF>\\<GG>\\<eta>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>)\\<lparr>NTMap\\<rparr>) = \\<DD>\\<lparr>Obj\\<rparr>\"\n        by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      note is_ntcf.ntcf_Comp_commute[cat_cs_simps del]\n      note category.cat_Comp_assoc[cat_cs_simps del]\n      show\n        \"((?\\<FF>\\<epsilon>\\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?\\<eta>\\<FF>\\<GG>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>)\\<lparr>NTMap\\<rparr> =\n          ((?\\<FF>\\<epsilon>\\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?\\<FF>\\<GG>\\<eta>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>)\\<lparr>NTMap\\<rparr>\"\n      proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n        fix a assume \"a \\<in>\\<^sub>\\<circ> \\<DD>\\<lparr>Obj\\<rparr>\"\n        then show\n          \"((?\\<FF>\\<epsilon>\\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?\\<eta>\\<FF>\\<GG>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>)\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr> =\n            ((?\\<FF>\\<epsilon>\\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?\\<FF>\\<GG>\\<eta>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>)\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr>\"\n          by\n            (\n              cs_concl \n                cs_simp: cat_cs_simps \\<eta>.ntcf_lKe.ntcf_Comp_commute[symmetric]\n                cs_intro: cat_cs_intros\n            )\n      qed (cs_concl cs_intro: cat_cs_intros)+\n    qed (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)+\n    also have \"\\<dots> = (ntcf_id \\<FF> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<GG>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\"\n      by\n        (\n          cs_concl cs_shallow\n            cs_simp:\n              cat_cs_simps\n              cf_comp_cf_ntcf_comp_assoc\n              cf_ntcf_comp_ntcf_cf_comp_assoc\n              cf_ntcf_comp_ntcf_vcomp[symmetric]\n            cs_intro: cat_cs_intros\n        )\n    also have \"\\<dots> = \\<eta>\" by (cs_concl cs_simp: cat_cs_simps)\n    finally have \"(?\\<FF>\\<epsilon>\\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?\\<eta>\\<FF>\\<GG>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta> = \\<eta>\" by simp\n    then have \\<eta>_def': \"\\<eta> = (\\<FF> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<eta> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<FF>) \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<GG>) \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta>\"\n      by \n        (\n          cs_concl cs_shallow\n            cs_simp: cat_cs_simps ntcf_vcomp_ntcf_cf_comp[symmetric] \n            cs_intro: cat_cs_intros\n        )+\n  \n    have \\<FF>\\<epsilon>\\<eta>\\<FF>: \"\\<FF> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<eta> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<FF>) : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F \\<FF> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<DD>\"\n      by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n\n    from \\<eta>.cat_lKe_unique[OF \\<eta>.Lan.is_functor_axioms \\<eta>.ntcf_lKe.is_ntcf_axioms]\n    obtain \\<sigma> where\n      \"\\<lbrakk> \\<sigma>' : \\<FF> \\<mapsto>\\<^sub>C\\<^sub>F \\<FF> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<DD>; \\<eta> = \\<sigma>' \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<GG> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<eta> \\<rbrakk> \\<Longrightarrow> \\<sigma>' = \\<sigma>\"\n      for \\<sigma>'\n      by metis\n  \n    from this[OF \\<eta>.Lan.cf_ntcf_id_is_ntcf \\<eta>_def] this[OF \\<FF>\\<epsilon>\\<eta>\\<FF> \\<eta>_def'] show\n      \"\\<FF> \\<circ>\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F (\\<eta> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<FF>) = ntcf_id \\<FF>\"\n      by simp\n\n  qed (cs_concl cs_intro: cat_cs_intros)+\n\nqed\n\nlemma cf_adjunction_if_rKe_preserves:\n  assumes \"\\<epsilon> : \\<FF> \\<circ>\\<^sub>C\\<^sub>F \\<GG> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>r\\<^sub>K\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> cf_id \\<DD> : \\<DD> \\<mapsto>\\<^sub>C \\<CC> \\<mapsto>\\<^sub>C (\\<GG> : \\<DD> \\<mapsto>\\<mapsto>\\<^sub>C \\<CC>)\"\n  shows \"cf_adjunction_of_counit \\<alpha> \\<FF> \\<GG> \\<epsilon> : \\<FF> \\<rightleftharpoons>\\<^sub>C\\<^sub>F \\<GG> : \\<CC> \\<rightleftharpoons>\\<rightleftharpoons>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<DD>\"\nproof-\n  interpret \\<epsilon>: is_cat_rKe_preserves \\<alpha> \\<DD> \\<CC> \\<DD> \\<CC> \\<GG> \\<open>cf_id \\<DD>\\<close> \\<FF> \\<GG> \\<epsilon> \n    by (rule assms)\n  have \"op_cf (cf_id \\<DD>) = cf_id (op_cat \\<DD>)\" unfolding cat_op_simps by simp\n  show ?thesis\n    by \n      (\n        rule is_cf_adjunction.is_cf_adjunction_op\n          [\n            OF cf_adjunction_if_lKe_preserves[\n              OF \\<epsilon>.is_cat_rKe_preserves_op[unfolded op_cf_cf_id]\n              ], \n            folded cf_adjunction_of_counit_def, \n            unfolded cat_op_simps\n          ]\n      )\nqed\n\ntext\\<open>\\newpage\\<close>\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Universal_Constructions/czh_ucategories/CZH_UCAT_Kan.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.629774621301746, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.33454218194839513}}
{"text": "(*  Title:      statecharts/DataSpace/Update.thy\n\n    Author:     Steffen Helke, Software Engineering Group\n    Copyright   2010 Technische Universitaet Berlin\n*)\n\nheader {* Update-Functions on Data Spaces *}\ntheory Update\nimports Data\nbegin\n\nsubsection {* Total update-functions *}\n\ndefinition\n  Update :: \"(('d data) => ('d data)) => bool\" where \n  \"Update U = (\\<forall> d. Data.DataSpace d = DataSpace (U d))\"\n\nlemma Update_EmptySet: \n \"(% d. d) \\<in> { L | L. Update L}\"; \nby (unfold Update_def, auto)\n\ndefinition\n  \"update = { L | (L::(('d data) => ('d data))). Update L}\"\n\ntypedef 'd update = \"update :: ('d data => 'd data) set\"\n  unfolding update_def\n  apply (rule exI)\n  apply (rule Update_EmptySet)\n  done\n \ndefinition\n UpdateApply :: \"['d update, 'd data] => 'd data\" (\"(_ !!!/ _)\" [10,11]10) where\n \"UpdateApply U D == Rep_update U D\" \n\ndefinition\n  DefaultUpdate :: \"('d update)\" where\n \"DefaultUpdate ==  Abs_update (\\<lambda> D. D)\"\n\nsubsubsection {* Basic lemmas *}\n\nlemma Update_select:\n   \"Update (Rep_update U)\"\napply (cut_tac x=U in Rep_update)\napply (unfold update_def)\napply auto\ndone\n\nlemma DataSpace_DataSpace_Update [simp]:\n   \"Data.DataSpace (Rep_update U DP) = Data.DataSpace DP\"\napply (cut_tac U=U in Update_select)\napply (unfold Update_def)\napply auto\ndone\n\nsubsubsection {* @{text \"DefaultUpdate\"} *}\n\nlemma Update_DefaultUpdate [simp]:\n   \"Update (\\<lambda> D. D)\";\nby (unfold Update_def, auto)\n\nlemma update_DefaultUpdate [simp]:\n   \"(\\<lambda> D. D) \\<in> update\";\nby (unfold update_def, auto)\n\nlemma DataSpace_UpdateApply [simp]:\n   \"Data.DataSpace (U !!! D) = Data.DataSpace D\";\nby (unfold UpdateApply_def, auto)\n\nsubsection {* Partial update-functions *}\n\ndefinition\n  PUpdate :: \"(('d data) => ('d pdata)) => bool\" where\n  \"PUpdate U = (\\<forall> d. Data.DataSpace d = PDataSpace (U d))\"\n\nlemma PUpdate_EmptySet:\n \"(% d. Data2PData d) \\<in> { L | L. PUpdate L}\"; \nby (unfold PUpdate_def, auto)\n\ndefinition \"pupdate = { L | (L::(('d data) => ('d pdata))). PUpdate L}\"\n\ntypedef 'd pupdate = \"pupdate :: ('d data => 'd pdata) set\" \n  unfolding pupdate_def\n  apply (rule exI)\n  apply (rule PUpdate_EmptySet)\n  done\n \ndefinition\n PUpdateApply :: \"['d pupdate, 'd data] => 'd pdata\" (\"(_ !!/ _)\" [10,11]10) where\n \"PUpdateApply U D = Rep_pupdate U D\" \n\ndefinition\n  DefaultPUpdate :: \"('d pupdate)\" where\n \"DefaultPUpdate = Abs_pupdate (\\<lambda> D. DefaultPData (Data.DataSpace D))\"\n                      \nsubsubsection {* Basic lemmas *}\n\nlemma PUpdate_select:\n   \"PUpdate (Rep_pupdate U)\";\napply (cut_tac x=U in Rep_pupdate)\napply (unfold pupdate_def)\napply auto\ndone\n\nlemma DataSpace_PDataSpace_PUpdate [simp]:\n   \"PDataSpace (Rep_pupdate U DP) = Data.DataSpace DP\";\napply (cut_tac U=U in PUpdate_select)\napply (unfold PUpdate_def)\napply auto\ndone\n\nsubsubsection {* @{text \"Data2PData\"} *}\n\nlemma  PUpdate_Data2PData [simp]: \n   \"PUpdate Data2PData\";\nby (unfold PUpdate_def, auto)\n\nlemma pupdate_Data2PData  [simp]:\n   \"Data2PData \\<in> pupdate\";\nby (unfold pupdate_def, auto)\n\nsubsubsection {* @{text \"PUpdate\"} *}\n\nlemma PUpdate_DefaultPUpdate [simp]:\n   \"PUpdate (\\<lambda> D. DefaultPData (Data.DataSpace D))\"\napply (unfold PUpdate_def)\napply auto\ndone\n\nlemma pupdate_DefaultPUpdate [simp]:\n   \"(\\<lambda> D. DefaultPData (Data.DataSpace D)) \\<in> pupdate\"\napply (unfold pupdate_def)\napply auto\ndone\n\nlemma DefaultPUpdate_None [simp]:\n    \"(DefaultPUpdate !! D) = DefaultPData (DataSpace D)\"\napply (unfold DefaultPUpdate_def PUpdateApply_def)\napply (subst Abs_pupdate_inverse)\napply auto\ndone\n\nsubsubsection {* @{text \"SequentialRacing\"} *}\n\ndefinition\n UpdateOverride :: \"['d pupdate, 'd update] => \n                     'd update\" (\"(_ [U+]/ _)\" [10,11]10) where\n \"UpdateOverride U P = Abs_update (\\<lambda> DA . (U !! DA) [D+] (P !!! DA))\"\n \n\n(* -------------------------------------------------------------- *)\n(* We use our own FoldSet operator simular to the definition      *)\n(* of Isabelle 2002. Note, it is different to the definition      *)\n(* in Isabelle 2009. Basically we express \"f (g x)\" by \"h x\"      *)\n(* -------------------------------------------------------------- *)\n\ninductive\n  FoldSet :: \"('b => 'a => 'a) => 'a => 'b set => 'a => bool\"\n  for h ::  \"'b => 'a => 'a\"\n  and z :: 'a\nwhere\n  emptyI [intro]: \"FoldSet h z {} z\"\n| insertI [intro]:\n     \"\\<lbrakk> x \\<notin> A; FoldSet h z A y \\<rbrakk>\n      \\<Longrightarrow> FoldSet h z (insert x A) (h x y)\"\n\ndefinition\nSequentialRacing :: \"('d pupdate set) => ('d update set)\" where\n \"SequentialRacing U = \n     {u. FoldSet UpdateOverride DefaultUpdate U u}\"\n\nlemma FoldSet_imp_finite:\n  \"FoldSet h z A x \\<Longrightarrow> finite A\"\nby (induct set: FoldSet) auto\n\nlemma finite_imp_FoldSet:\n  \"finite A \\<Longrightarrow> \\<exists> x. FoldSet h z A x\"\nby (induct set: finite) auto\n\nlemma finite_SequentialRacing:\n   \"finite US \\<Longrightarrow> (SOME u. u \\<in> SequentialRacing US) \\<in> SequentialRacing US\"\napply (unfold SequentialRacing_def)\napply auto\napply (drule_tac h=UpdateOverride and z=DefaultUpdate in finite_imp_FoldSet)\napply auto\napply (rule someI)\napply auto\ndone\n\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Statecharts/Update.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.3345421745660017}}
{"text": "(*  Author:     Gerwin Klein\n    Copyright   1999 Technische Universitaet Muenchen\n*)\n\nsection \\<open>Correctness of the LBV\\<close>\n\ntheory LBVCorrect\nimports LBVSpec Typing_Framework\nbegin\n\nlocale lbvs = lbv +\n  fixes s0  :: 'a (\"s\\<^sub>0\")\n  fixes c   :: \"'a list\"\n  fixes ins :: \"'b list\"\n  fixes phi :: \"'a list\" (\"\\<phi>\")\n  defines phi_def:\n  \"\\<phi> \\<equiv> map (\\<lambda>pc. if c!pc = \\<bottom> then wtl (take pc ins) c 0 s0 else c!pc) \n       [0..<length ins]\"\n\n  assumes bounded: \"bounded step (length ins)\"\n  assumes cert: \"cert_ok c (length ins) \\<top> \\<bottom> A\"\n  assumes pres: \"pres_type step (length ins) A\"\n\n\nlemma (in lbvs) phi_None [intro?]:\n  \"\\<lbrakk> pc < length ins; c!pc = \\<bottom> \\<rbrakk> \\<Longrightarrow> \\<phi> ! pc = wtl (take pc ins) c 0 s0\"\n  by (simp add: phi_def)\n\nlemma (in lbvs) phi_Some [intro?]:\n  \"\\<lbrakk> pc < length ins; c!pc \\<noteq> \\<bottom> \\<rbrakk> \\<Longrightarrow> \\<phi> ! pc = c ! pc\"\n  by (simp add: phi_def)\n\nlemma (in lbvs) phi_len [simp]:\n  \"length \\<phi> = length ins\"\n  by (simp add: phi_def)\n\n\nlemma (in lbvs) wtl_suc_pc:\n  assumes all: \"wtl ins c 0 s\\<^sub>0 \\<noteq> \\<top>\" \n  assumes pc:  \"pc+1 < length ins\"\n  shows \"wtl (take (pc+1) ins) c 0 s0 \\<sqsubseteq>\\<^sub>r \\<phi>!(pc+1)\"\nproof -\n  from all pc\n  have \"wtc c (pc+1) (wtl (take (pc+1) ins) c 0 s0) \\<noteq> T\" by (rule wtl_all)\n  with pc show ?thesis by (simp add: phi_def wtc split: if_split_asm)\nqed\n\n\nlemma (in lbvs) wtl_stable:\n  assumes wtl: \"wtl ins c 0 s0 \\<noteq> \\<top>\" \n  assumes s0:  \"s0 \\<in> A\" \n  assumes pc:  \"pc < length ins\" \n  shows \"stable r step \\<phi> pc\"\nproof (unfold stable_def, clarify)\n  fix pc' s' assume step: \"(pc',s') \\<in> set (step pc (\\<phi> ! pc))\" \n                      (is \"(pc',s') \\<in> set (?step pc)\")\n  \n  from bounded pc step have pc': \"pc' < length ins\" by (rule boundedD)\n\n  from wtl have tkpc: \"wtl (take pc ins) c 0 s0 \\<noteq> \\<top>\" (is \"?s1 \\<noteq> _\") by (rule wtl_take)\n  from wtl have s2: \"wtl (take (pc+1) ins) c 0 s0 \\<noteq> \\<top>\" (is \"?s2 \\<noteq> _\") by (rule wtl_take)\n  \n  from wtl pc have wt_s1: \"wtc c pc ?s1 \\<noteq> \\<top>\" by (rule wtl_all)\n\n  have c_Some: \"\\<forall>pc t. pc < length ins \\<longrightarrow> c!pc \\<noteq> \\<bottom> \\<longrightarrow> \\<phi>!pc = c!pc\" \n    by (simp add: phi_def)\n  from pc have c_None: \"c!pc = \\<bottom> \\<Longrightarrow> \\<phi>!pc = ?s1\" ..\n\n  from wt_s1 pc c_None c_Some\n  have inst: \"wtc c pc ?s1  = wti c pc (\\<phi>!pc)\"\n    by (simp add: wtc split: if_split_asm)\n\n  from pres cert s0 wtl pc have \"?s1 \\<in> A\" by (rule wtl_pres)\n  with pc c_Some cert c_None\n  have \"\\<phi>!pc \\<in> A\" by (cases \"c!pc = \\<bottom>\") (auto dest: cert_okD1)\n  with pc pres\n  have step_in_A: \"snd`set (?step pc) \\<subseteq> A\" by (auto dest: pres_typeD2)\n\n  show \"s' <=_r \\<phi>!pc'\" \n  proof (cases \"pc' = pc+1\")\n    case True\n    with pc' cert\n    have cert_in_A: \"c!(pc+1) \\<in> A\" by (auto dest: cert_okD1)\n    from True pc' have pc1: \"pc+1 < length ins\" by simp\n    with tkpc have \"?s2 = wtc c pc ?s1\" by - (rule wtl_Suc)\n    with inst \n    have merge: \"?s2 = merge c pc (?step pc) (c!(pc+1))\" by (simp add: wti)\n    also    \n    from s2 merge have \"\\<dots> \\<noteq> \\<top>\" (is \"?merge \\<noteq> _\") by simp\n    with cert_in_A step_in_A\n    have \"?merge = (map snd [(p',t') \\<leftarrow> ?step pc. p'=pc+1] ++_f (c!(pc+1)))\"\n      by (rule merge_not_top_s) \n    finally\n    have \"s' <=_r ?s2\" using step_in_A cert_in_A True step \n      by (auto intro: pp_ub1')\n    also \n    from wtl pc1 have \"?s2 <=_r \\<phi>!(pc+1)\" by (rule wtl_suc_pc)\n    also note True [symmetric]\n    finally show ?thesis by simp    \n  next\n    case False\n    from wt_s1 inst\n    have \"merge c pc (?step pc) (c!(pc+1)) \\<noteq> \\<top>\" by (simp add: wti)\n    with step_in_A\n    have \"\\<forall>(pc', s')\\<in>set (?step pc). pc'\\<noteq>pc+1 \\<longrightarrow> s' <=_r c!pc'\" \n      by - (rule merge_not_top)\n    with step False \n    have ok: \"s' <=_r c!pc'\" by blast\n    moreover\n    from ok\n    have \"c!pc' = \\<bottom> \\<Longrightarrow> s' = \\<bottom>\" by simp\n    moreover\n    from c_Some pc'\n    have \"c!pc' \\<noteq> \\<bottom> \\<Longrightarrow> \\<phi>!pc' = c!pc'\" by auto\n    ultimately\n    show ?thesis by (cases \"c!pc' = \\<bottom>\") auto \n  qed\nqed\n\n  \nlemma (in lbvs) phi_not_top:\n  assumes wtl: \"wtl ins c 0 s0 \\<noteq> \\<top>\"\n  assumes pc:  \"pc < length ins\"\n  shows \"\\<phi>!pc \\<noteq> \\<top>\"\nproof (cases \"c!pc = \\<bottom>\")\n  case False with pc\n  have \"\\<phi>!pc = c!pc\" ..\n  also from cert pc have \"\\<dots> \\<noteq> \\<top>\" by (rule cert_okD4)\n  finally show ?thesis .\nnext\n  case True with pc\n  have \"\\<phi>!pc = wtl (take pc ins) c 0 s0\" ..\n  also from wtl have \"\\<dots> \\<noteq> \\<top>\" by (rule wtl_take)\n  finally show ?thesis .\nqed\n\nlemma (in lbvs) phi_in_A:\n  assumes wtl: \"wtl ins c 0 s0 \\<noteq> \\<top>\"\n  assumes s0:  \"s0 \\<in> A\"\n  shows \"\\<phi> \\<in> list (length ins) A\"\nproof -\n  { fix x assume \"x \\<in> set \\<phi>\"\n    then obtain xs ys where \"\\<phi> = xs @ x # ys\" \n      by (auto simp add: in_set_conv_decomp)\n    then obtain pc where pc: \"pc < length \\<phi>\" and x: \"\\<phi>!pc = x\"\n      by (simp add: that [of \"length xs\"] nth_append)\n    \n    from pres cert wtl s0 pc\n    have \"wtl (take pc ins) c 0 s0 \\<in> A\" by (auto intro!: wtl_pres)\n    moreover\n    from pc have \"pc < length ins\" by simp\n    with cert have \"c!pc \\<in> A\" ..\n    ultimately\n    have \"\\<phi>!pc \\<in> A\" using pc by (simp add: phi_def)\n    hence \"x \\<in> A\" using x by simp\n  } \n  hence \"set \\<phi> \\<subseteq> A\" ..\n  thus ?thesis by (unfold list_def) simp\nqed\n\n\nlemma (in lbvs) phi0:\n  assumes wtl: \"wtl ins c 0 s0 \\<noteq> \\<top>\"\n  assumes 0:   \"0 < length ins\"\n  shows \"s0 <=_r \\<phi>!0\"\nproof (cases \"c!0 = \\<bottom>\")\n  case True\n  with 0 have \"\\<phi>!0 = wtl (take 0 ins) c 0 s0\" ..\n  moreover have \"wtl (take 0 ins) c 0 s0 = s0\" by simp\n  ultimately have \"\\<phi>!0 = s0\" by simp\n  thus ?thesis by simp\nnext\n  case False\n  with 0 have \"phi!0 = c!0\" ..\n  moreover \n  from wtl have \"wtl (take 1 ins) c 0 s0 \\<noteq> \\<top>\"  by (rule wtl_take)\n  with 0 False \n  have \"s0 <=_r c!0\" by (auto simp add: neq_Nil_conv wtc split: if_split_asm)\n  ultimately\n  show ?thesis by simp\nqed\n\n\n\n\n\ntheorem (in lbvs) wtl_sound_strong:\n  assumes wtl: \"wtl ins c 0 s0 \\<noteq> \\<top>\" \n  assumes s0: \"s0 \\<in> A\" \n  assumes nz: \"0 < length ins\"\n  shows \"\\<exists>ts \\<in> list (length ins) A. wt_step r \\<top> step ts \\<and> s0 <=_r ts!0\"\nproof -\n  from wtl s0 have \"\\<phi> \\<in> list (length ins) A\" by (rule phi_in_A)\n  moreover\n  have \"wt_step r \\<top> step \\<phi>\"\n  proof (unfold wt_step_def, intro strip conjI)\n    fix pc assume \"pc < length \\<phi>\"\n    then have pc: \"pc < length ins\" by simp\n    with wtl show \"\\<phi>!pc \\<noteq> \\<top>\" by (rule phi_not_top)\n    from wtl s0 pc show \"stable r step \\<phi> pc\" by (rule wtl_stable)\n  qed\n  moreover\n  from wtl nz have \"s0 <=_r \\<phi>!0\" by (rule phi0)\n  ultimately\n  show ?thesis by fast\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/MicroJava/DFA/LBVCorrect.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802735722128, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3344401367861064}}
{"text": "theory BPlusTree_ImpSplit\n  imports\n    BPlusTree_Imp\n    BPlusTree_Split\n    Imperative_Loops\nbegin\n\ndefinition \"split_relation xs \\<equiv>\n   \\<lambda>(as,bs) i. i \\<le> length xs \\<and> as = take i xs \\<and> bs = drop i xs\"\n\nlemma split_relation_alt: \n  \"split_relation as (ls,rs) i = (as = ls@rs \\<and> i = length ls)\"\n  by (auto simp add: split_relation_def)\n\n\nlemma split_relation_length: \"split_relation xs (ls,rs) (length xs) = (ls = xs \\<and> rs = [])\"\n  by (simp add: split_relation_def)\n\n(* auxiliary lemmas on assns *)\n(* simp? not sure if it always makes things more easy *)\nlemma list_assn_prod_map: \"list_assn (A \\<times>\\<^sub>a B) xs ys = list_assn B (map snd xs) (map snd ys) * list_assn A (map fst xs) (map fst ys)\"\n  apply(induct \"(A \\<times>\\<^sub>a B)\" xs ys rule: list_assn.induct)\n     apply(auto simp add: ab_semigroup_mult_class.mult.left_commute ent_star_mono star_aci(2) star_assoc)\n  done\n\n(* concrete *)\nlemma id_assn_list: \"h \\<Turnstile> list_assn id_assn (xs::'a list) ys \\<Longrightarrow> xs = ys\"\n  apply(induction \"id_assn::('a \\<Rightarrow> 'a \\<Rightarrow> assn)\" xs ys rule: list_assn.induct)\n     apply(auto simp add: less_Suc_eq_0_disj pure_def)\n  done\n\nlemma id_assn_list_alt: \"list_assn id_assn (xs::'a list) ys = \\<up>(xs = ys)\"\n  apply(induction \"id_assn::('a \\<Rightarrow> 'a \\<Rightarrow> assn)\" xs ys rule: list_assn.induct)\n     apply(auto simp add: less_Suc_eq_0_disj pure_def)\n  done\n\n\nlemma snd_map_help:\n  \"x \\<le> length tsi \\<Longrightarrow>\n       (\\<forall>j<x. snd (tsi ! j) = ((map snd tsi)!j))\"\n  \"x < length tsi \\<Longrightarrow> snd (tsi!x) = ((map snd tsi)!x)\"\n  by auto\n\n\nlemma split_ismeq: \"((a::nat) \\<le> b \\<and> X) = ((a < b \\<and> X) \\<or> (a = b \\<and> X))\"\n  by auto\n\nlemma split_relation_map: \"split_relation as (ls,rs) i \\<Longrightarrow> split_relation (map f as) (map f ls, map f rs) i\"\n  apply(induction as arbitrary: ls rs i)\n   apply(auto simp add: split_relation_def take_map drop_Cons')\n  apply(metis list.simps(9) take_map)\n  done\n\nlemma split_relation_access: \"\\<lbrakk>split_relation as (ls,rs) i; rs = r#rrs\\<rbrakk> \\<Longrightarrow> as!i = r\"\n  by (simp add: split_relation_alt)\n\n\n\nlemma index_to_elem_all: \"(\\<forall>j<length xs. P (xs!j)) = (\\<forall>x \\<in> set xs. P x)\"\n  by (simp add: all_set_conv_nth)\n\nlemma index_to_elem: \"n < length xs \\<Longrightarrow> (\\<forall>j<n. P (xs!j)) = (\\<forall>x \\<in> set (take n xs). P x)\"\n  by (simp add: all_set_conv_nth)\n    (* ----------------- *)\n\ndefinition split_half :: \"'a::heap pfarray \\<Rightarrow> nat Heap\"\n  where\n    \"split_half a \\<equiv> do {\n  l \\<leftarrow> pfa_length a;\n  return ((l + 1) div 2)\n}\"\n\nlemma split_half_rule[sep_heap_rules]: \"<\n    is_pfa c tsi a>\n    split_half a\n  <\\<lambda>i. \n      is_pfa c tsi a\n    * \\<up>(i = (length tsi + 1) div 2 \\<and>  split_relation tsi (BPlusTree_Split.split_half tsi) i)>\"\n  unfolding split_half_def split_relation_def\n  apply(rule hoare_triple_preI)\n  apply(sep_auto dest!: list_assn_len mod_starD)\n  done\n\n\nsubsection \"The imperative split locale\"\n\nlocale split\\<^sub>i_tree = abs_split_tree: BPlusTree_Split.split_tree split\n  for split::\n    \"('a::{heap,default,linorder,order_top} bplustree \\<times> 'a) list \\<Rightarrow> 'a\n       \\<Rightarrow> ('a bplustree \\<times> 'a) list \\<times> ('a bplustree \\<times> 'a) list\" +\n  fixes split\\<^sub>i:: \"('a btnode ref option \\<times> 'a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> 'a \\<Rightarrow> nat Heap\"\n  assumes split\\<^sub>i_rule [sep_heap_rules]:\"sorted_less (separators ts) \\<Longrightarrow>\n  length tsi = length rs \\<Longrightarrow>\n  tsi'' = zip (zip (map fst tsi) (zip (butlast (r#rs)) (butlast (rs@[z])))) (map snd tsi) \\<Longrightarrow>\n <is_pfa c tsi (a,n) \n  * blist_assn k ts tsi'' > \n    split\\<^sub>i (a,n) p \n  <\\<lambda>i. \n    is_pfa c tsi (a,n)\n    * blist_assn k ts tsi''\n    * \\<up>(split_relation ts (split ts p) i)>\\<^sub>t\"\n\nlocale split\\<^sub>i_list = abs_split_list: split_list split_list\n  for split_list::\n    \"('a::{heap,default,linorder,order_top}) list \\<Rightarrow> 'a\n       \\<Rightarrow> 'a list \\<times> 'a list\" +\n  fixes split\\<^sub>i_list:: \"('a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> 'a \\<Rightarrow> nat Heap\"\n  assumes split\\<^sub>i_list_rule [sep_heap_rules]: \"sorted_less xs \\<Longrightarrow>\n   <is_pfa c xs (a,n)> \n    split\\<^sub>i_list (a,n) p \n  <\\<lambda>i. \n    is_pfa c xs (a,n)\n    * \\<up>(split_relation xs (split_list xs p) i)>\\<^sub>t\"\n\n\nlocale split\\<^sub>i_full = split\\<^sub>i_tree: split\\<^sub>i_tree split + split\\<^sub>i_list: split\\<^sub>i_list split_list\n    for split::\n      \"('a bplustree \\<times> 'a::{linorder,heap,default,order_top}) list \\<Rightarrow> 'a\n         \\<Rightarrow> ('a bplustree \\<times> 'a) list \\<times> ('a bplustree \\<times> 'a) list\"\n    and split_list::\n      \"'a::{default,linorder,order_top,heap} list \\<Rightarrow> 'a\n         \\<Rightarrow> 'a list \\<times> 'a list\"\n\nsection \"Imperative split operations\"\n\ntext \"So far, we have only given a functional specification of a possible split.\n      We will now provide imperative split functions that refine the functional specification.\n      However, rather than tracing the execution of the abstract specification,\n      the imperative versions are implemented using while-loops.\"\n\n\nsubsection \"Linear split\"\n\ntext \"The linear split is the most simple split function for binary trees.\n      It serves a good example on how to use while-loops in Imperative/HOL\n      and how to prove Hoare-Triples about its application using loop invariants.\"\n\ndefinition lin_split :: \"('a::heap \\<times> 'b::{heap,linorder}) pfarray \\<Rightarrow> 'b \\<Rightarrow> nat Heap\"\n  where\n    \"lin_split \\<equiv> \\<lambda> (a,n) p. do {\n  \n  i \\<leftarrow> heap_WHILET \n    (\\<lambda>i. if i<n then do {\n      (_,s) \\<leftarrow> Array.nth a i;\n      return (s<p)\n    } else return False) \n    (\\<lambda>i. return (i+1)) \n    0;\n       \n  return i\n}\"\n\n\nlemma lin_split_rule: \"\n< is_pfa c xs (a,n)>\n lin_split (a,n) p\n <\\<lambda>i. is_pfa c xs (a,n) * \\<up>(i\\<le>n \\<and> (\\<forall>j<i. snd (xs!j) < p) \\<and> (i<n \\<longrightarrow> snd (xs!i)\\<ge>p))>\\<^sub>t\"\n  unfolding lin_split_def\n\n  supply R = heap_WHILET_rule''[where \n      R = \"measure (\\<lambda>i. n - i)\"\n      and I = \"\\<lambda>i. is_pfa c xs (a,n) * \\<up>(i\\<le>n \\<and> (\\<forall>j<i. snd (xs!j) < p))\"\n      and b = \"\\<lambda>i. i<n \\<and> snd (xs!i) < p\"\n      and Q=\"\\<lambda>i. is_pfa c xs (a,n) * \\<up>(i\\<le>n \\<and> (\\<forall>j<i. snd (xs!j) < p) \\<and> (i<n \\<longrightarrow> snd (xs!i)\\<ge>p))\"\n      ]\n  thm R\n\n  apply (sep_auto  decon: R simp: less_Suc_eq is_pfa_def) []\n       apply (metis nth_take snd_eqD)\n      apply (metis nth_take snd_eqD)\n     apply (sep_auto simp: is_pfa_def less_Suc_eq)+\n      apply (metis nth_take)\n    apply(sep_auto simp: is_pfa_def)\n  apply (metis le_simps(3) less_Suc_eq less_le_trans nth_take)\n  apply(sep_auto simp: is_pfa_def)+\n  done\n\nsubsection \"Binary split\"\n\ntext \"To obtain an efficient B-Tree implementation, we prefer a binary split\nfunction.\nTo explore the searching procedure\nand the resulting proof, we first implement the split on singleton arrays.\"\n\ndefinition bin'_split :: \"'b::{heap,linorder} array_list \\<Rightarrow> 'b \\<Rightarrow> nat Heap\"\n  where\n    \"bin'_split \\<equiv> \\<lambda>(a,n) p. do {\n  (low',high') \\<leftarrow> heap_WHILET \n    (\\<lambda>(low,high). return (low < high)) \n    (\\<lambda>(low,high). let mid = ((low  + high) div 2) in\n     do {\n      s \\<leftarrow> Array.nth a mid;\n      if p < s then\n         return (low, mid)\n      else if p > s then\n         return (mid+1, high)\n      else return (mid,mid)\n     }) \n    (0::nat,n);\n  return low'\n}\"\n\n\nthm sorted_wrt_nth_less\n\n(* alternative: replace (\\<forall>j<l. xs!j < p) by (l > 0 \\<longrightarrow> xs!(l-1) < p)*)\nlemma bin'_split_rule: \"\nsorted_less xs \\<Longrightarrow>\n< is_pfa c xs (a,n)>\n bin'_split (a,n) p\n <\\<lambda>l. is_pfa c xs (a,n) * \\<up>(l \\<le> n \\<and> (\\<forall>j<l. xs!j < p) \\<and> (l<n \\<longrightarrow> xs!l\\<ge>p)) >\\<^sub>t\"\n  unfolding bin'_split_def\n\n  supply R = heap_WHILET_rule''[where \n      R = \"measure (\\<lambda>(l,h). h-l)\"\n      and I = \"\\<lambda>(l,h). is_pfa c xs (a,n) * \\<up>(l\\<le>h \\<and> h \\<le> n \\<and> (\\<forall>j<l. xs!j < p) \\<and> (h<n \\<longrightarrow> xs!h\\<ge>p))\"\n      and b = \"\\<lambda>(l,h). l<h\"\n      and Q=\"\\<lambda>(l,h). is_pfa c xs (a,n) * \\<up>(l \\<le> n \\<and> (\\<forall>j<l. xs!j < p) \\<and> (l<n \\<longrightarrow> xs!l\\<ge>p))\"\n      ]\n  thm R\n\n  apply (sep_auto decon: R simp: less_Suc_eq is_pfa_def) []\n  subgoal for l' aa l'a aaa ba j\n  proof -\n    assume 0: \"n \\<le> length l'a\"\n    assume a: \"l'a ! ((aa + n) div 2) < p\"\n    moreover assume \"aa < n\"\n    ultimately have b: \"((aa+n)div 2) < n\"\n      by linarith\n    then have \"(take n l'a) ! ((aa + n) div 2) < p\"\n      using a by auto\n    moreover assume \"sorted_less (take n l'a)\"\n    ultimately have \"\\<And>j. j < (aa+n)div 2 \\<Longrightarrow> (take n l'a) ! j < (take n l'a) ! ((aa + n) div 2)\"\n      using\n        sorted_wrt_nth_less[where ?P=\"(<)\" and xs=\"(take n l'a)\" and ?j=\"((aa + n) div 2)\"]\n        a b \"0\" by auto\n    moreover fix j assume \"j < (aa+n) div 2\"\n    ultimately show \"l'a ! j < p\" using \"0\" b\n      using \\<open>take n l'a ! ((aa + n) div 2) < p\\<close> dual_order.strict_trans by auto\n  qed\n  subgoal for l' aa b l'a aaa ba j\n  proof -\n    assume t0: \"n \\<le> length l'a\"\n    assume t1: \"aa < b\"\n    assume a: \"l'a ! ((aa + b) div 2) < p\"\n    moreover assume \"b \\<le> n\"\n    ultimately have b: \"((aa+b)div 2) < n\" using t1\n      by linarith\n    then have \"(take n l'a) ! ((aa + b) div 2) < p\"\n      using a by auto\n    moreover assume \"sorted_less (take n l'a)\"\n    ultimately have \"\\<And>j. j < (aa+b)div 2 \\<Longrightarrow> (take n l'a) ! j < (take n l'a) ! ((aa + b) div 2)\"\n      using\n        sorted_wrt_nth_less[where ?P=\"(<)\" and xs=\"(take n l'a)\" and ?j=\"((aa + b) div 2)\"]\n        a b t0 by auto\n    moreover fix j assume \"j < (aa+b) div 2\"\n    ultimately show \"l'a ! j < p\" using t0 b\n      using \\<open>take n l'a ! ((aa + b) div 2) < p\\<close> dual_order.strict_trans by auto\n  qed\n     apply sep_auto\n      apply (metis le_less nth_take)\n     apply (metis le_less nth_take)\n    apply sep_auto\n  subgoal for l' aa l'a aaa ba j\n  proof -\n    assume t0: \"aa < n\"\n    assume t1: \" n \\<le> length l'a\"\n    assume t4: \"sorted_less (take n l'a)\"\n    assume t5: \"j < (aa + n) div 2\"\n    have \"(aa+n) div 2 < n\" using t0 by linarith\n    then have \"(take n l'a) ! j < (take n l'a) ! ((aa + n) div 2)\"\n      using t0 sorted_wrt_nth_less[where xs=\"take n l'a\" and ?j=\"((aa + n) div 2)\"]\n        t1 t4 t5 by auto\n    then show ?thesis\n      using \\<open>(aa + n) div 2 < n\\<close> t5 by auto\n  qed\n  subgoal for l' aa b l'a aaa ba j\n  proof -\n    assume t0: \"aa < b\"\n    assume t1: \" n \\<le> length l'a\"\n    assume t3: \"b \\<le> n\"\n    assume t4: \"sorted_less (take n l'a)\"\n    assume t5: \"j < (aa + b) div 2\"\n    have \"(aa+b) div 2 < n\" using t3 t0 by linarith\n    then have \"(take n l'a) ! j < (take n l'a) ! ((aa + b) div 2)\"\n      using t0 sorted_wrt_nth_less[where xs=\"take n l'a\" and ?j=\"((aa + b) div 2)\"]\n        t1 t4 t5 by auto\n    then show ?thesis\n      using \\<open>(aa + b) div 2 < n\\<close> t5 by auto\n  qed\n    apply (metis nth_take order_mono_setup.refl)\n   apply sep_auto\n  apply (sep_auto simp add: is_pfa_def)\n  done\n\ntext \"We can fortunately directly use this function as the split-list interpretation.\"\n\n\ntext \"Then, using the same loop invariant, a binary split for B-tree-like arrays\nis derived in a straightforward manner.\"\n\n\ndefinition bin_split :: \"('a::heap \\<times> 'b::{heap,linorder}) pfarray \\<Rightarrow> 'b \\<Rightarrow> nat Heap\"\n  where\n    \"bin_split \\<equiv> \\<lambda>(a,n) p. do {\n  (low',high') \\<leftarrow> heap_WHILET \n    (\\<lambda>(low,high). return (low < high)) \n    (\\<lambda>(low,high). let mid = ((low  + high) div 2) in\n     do {\n      (_,s) \\<leftarrow> Array.nth a mid;\n      if p < s then\n         return (low, mid)\n      else if p > s then\n         return (mid+1, high)\n      else return (mid,mid)\n     }) \n    (0::nat,n);\n  return low'\n}\"\n\n\nthm nth_take\n\nlemma nth_take_eq: \"take n ls = take n ls' \\<Longrightarrow> i < n \\<Longrightarrow> ls!i = ls'!i\"\n  by (metis nth_take)\n\nlemma map_snd_sorted_less: \"\\<lbrakk>sorted_less (map snd xs); i < j; j < length xs\\<rbrakk>\n       \\<Longrightarrow> snd (xs ! i) < snd (xs ! j)\"\n  by (metis (mono_tags, opaque_lifting) length_map less_trans nth_map sorted_wrt_iff_nth_less)\n\nlemma map_snd_sorted_lesseq: \"\\<lbrakk>sorted_less (map snd xs); i \\<le> j; j < length xs\\<rbrakk>\n       \\<Longrightarrow> snd (xs ! i) \\<le> snd (xs ! j)\"\n  by (metis eq_iff less_imp_le map_snd_sorted_less order.not_eq_order_implies_strict)\n\nlemma bin_split_rule: \"\nsorted_less (map snd xs) \\<Longrightarrow>\n< is_pfa c xs (a,n)>\n bin_split (a,n) p\n <\\<lambda>l. is_pfa c xs (a,n) * \\<up>(l \\<le> n \\<and> (\\<forall>j<l. snd(xs!j) < p) \\<and> (l<n \\<longrightarrow> snd(xs!l)\\<ge>p)) >\\<^sub>t\"\n  (* this works in principle, as demonstrated above *)\n  unfolding bin_split_def\n\n  supply R = heap_WHILET_rule''[where \n      R = \"measure (\\<lambda>(l,h). h-l)\"\n      and I = \"\\<lambda>(l,h). is_pfa c xs (a,n) * \\<up>(l\\<le>h \\<and> h \\<le> n \\<and> (\\<forall>j<l. snd (xs!j) < p) \\<and> (h<n \\<longrightarrow> snd (xs!h)\\<ge>p))\"\n      and b = \"\\<lambda>(l,h). l<h\"\n      and Q=\"\\<lambda>(l,h). is_pfa c xs (a,n) * \\<up>(l \\<le> n \\<and> (\\<forall>j<l. snd (xs!j) < p) \\<and> (l<n \\<longrightarrow> snd (xs!l)\\<ge>p))\"\n      ]\n  thm R\n\n  apply (sep_auto decon: R simp: less_Suc_eq is_pfa_def) []\n\n      apply(auto dest!: sndI nth_take_eq[of n _ _ \"(_ + _) div 2\"])[]\n     apply(auto dest!: sndI nth_take_eq[of n _ _ \"(_ + _) div 2\"])[]\n    apply (sep_auto dest!: sndI )\n  subgoal for ls i ls' _ _ j\n    using map_snd_sorted_lesseq[of \"take n ls'\" j \"(i + n) div 2\"] \n      less_mult_imp_div_less apply(auto)[]\n    done\n  subgoal for ls i j ls' _ _ j'\n    using map_snd_sorted_lesseq[of \"take n ls'\" j' \"(i + j) div 2\"] \n      less_mult_imp_div_less apply(auto)[]\n    done\n    apply sep_auto\n  subgoal for ls i ls' _ _ j\n    using map_snd_sorted_less[of \"take n ls'\" j \"(i + n) div 2\"] \n      less_mult_imp_div_less\n    apply(auto)[]\n    done\n  subgoal for ls i j ls' _ _ j'\n    using map_snd_sorted_less[of \"take n ls'\" j' \"(i + j) div 2\"] \n      less_mult_imp_div_less\n    apply(auto)[]\n    done\n    apply (metis le_less nth_take_eq)\n   apply sep_auto\n  apply (sep_auto simp add: is_pfa_def)\n  done\n\n\nsubsection \"Refinement of an abstract split\"\n\n\ntext \\<open>Any function that yields the heap rule\nwe have obtained for bin\\_split and lin\\_split also\nrefines this abstract split.\\<close>\n\nlocale split\\<^sub>i_tree_smeq =\n  fixes split_fun :: \"('a::{heap,default,linorder,order_top} btnode ref option \\<times> 'a) array \\<times> nat \\<Rightarrow> 'a \\<Rightarrow> nat Heap\"\n  assumes split_rule: \"sorted_less (separators xs) \\<Longrightarrow> \n <is_pfa c xs (a, n)>\n   split_fun (a, n) (p::'a)\n  <\\<lambda>r. is_pfa c xs (a, n) *\n                 \\<up> (r \\<le> n \\<and>\n                   (\\<forall>j<r. snd (xs ! j) < p) \\<and>\n                   (r < n \\<longrightarrow> p \\<le> snd (xs ! r)))>\\<^sub>t\"\nbegin\n\n\nlemma linear_split_full: \"\\<forall>(_,s) \\<in> set xs. s < p \\<Longrightarrow> linear_split xs p = (xs,[])\"\n  by simp\n\n\nlemma linear_split_split:\n  assumes \"n < length xs\" \n    and \"(\\<forall>(_,s) \\<in> set (take n xs). s < p)\"\n    and \" (case (xs!n) of (_,s) \\<Rightarrow> \\<not>(s < p))\"\n  shows \"linear_split xs p = (take n xs, drop n xs)\"\n  using assms  apply (auto)\n   apply (metis (mono_tags, lifting) id_take_nth_drop old.prod.case takeWhile_eq_all_conv takeWhile_tail)\n  by (metis (no_types, lifting) Cons_nth_drop_Suc case_prod_conv dropWhile.simps(2) dropWhile_append2 id_take_nth_drop)\n\n\n(* TODO refactor proof? *)\nlemma split_rule_linear_split: \n  shows\n    \"sorted_less (separators ts) \\<Longrightarrow> \n    min (length ks) (length tsi) = length tsi \\<Longrightarrow>\n    tsi' = zip ks (separators tsi) \\<Longrightarrow>\n    <\n    is_pfa c tsi (a,n)\n  * list_assn (A \\<times>\\<^sub>a id_assn) ts tsi'> \n    split_fun (a,n) p \n  <\\<lambda>i. \n    is_pfa c tsi (a,n)\n    * list_assn (A \\<times>\\<^sub>a id_assn) ts tsi'\n    * \\<up>(split_relation ts (linear_split ts p) i)>\\<^sub>t\"\n  apply(rule hoare_triple_preI)\n  apply (sep_auto heap: split_rule dest!: mod_starD id_assn_list\n      simp add: list_assn_prod_map split_ismeq map_snd_zip_take simp del: linear_split.simps)\n    apply(auto simp add: is_pfa_def simp del: linear_split.simps)\nproof -\n\n  fix h l' assume heap_init:\n    \"h \\<Turnstile> a \\<mapsto>\\<^sub>a l'\"\n    \"map snd ts = (map snd (take n l'))\"\n    \"n \\<le> length l'\"\n\n\n  show full_thm: \"\\<forall>j<n. snd (l' ! j) < p \\<Longrightarrow>\n       split_relation ts (linear_split ts p) n\"\n  proof -\n    assume sm_list: \"\\<forall>j<n. snd (l' ! j) < p\"\n    then have \"\\<forall>j < length (map snd (take n l')). ((map snd (take n l'))!j) < p\"\n      by simp\n    then have \"\\<forall>j<length (map snd ts). ((map snd ts)!j) < p\"\n      using heap_init by simp\n    then have \"\\<forall>(_,s) \\<in> set ts. s < p\"\n      by (metis case_prod_unfold in_set_conv_nth length_map nth_map)\n    then have \"linear_split ts p = (ts, [])\"\n      using linear_split_full[of ts p] by simp\n    then show \"split_relation ts (linear_split ts p) n\"\n      using split_relation_length\n      by (metis heap_init(2) heap_init(3) length_map length_take min.absorb2)\n\n  qed\n  then show \"\\<forall>j<n. snd (l' ! j) < p \\<Longrightarrow>\n       p \\<le> snd (take n l' ! n) \\<Longrightarrow>\n       split_relation ts (linear_split ts p) n\"\n    by simp\n\n  show part_thm: \"\\<And>x. x < n \\<Longrightarrow>\n       \\<forall>j<x. snd (l' ! j) < p \\<Longrightarrow>\n       p \\<le> snd (l' ! x) \\<Longrightarrow> split_relation ts (linear_split ts p) x\"\n  proof -\n    fix x assume x_sm_len: \"x < n\"\n    moreover assume sm_list: \"\\<forall>j<x. snd (l' ! j) < p\"\n    ultimately have \"\\<forall>j<x. ((map snd l') ! j) < p\"\n      using heap_init\n      by auto\n    then have \"\\<forall>j<x. ((map snd ts)!j) < p\"\n      using heap_init  x_sm_len\n      by auto\n    moreover have x_sm_len_ts: \"x < n\"\n      using heap_init x_sm_len by auto\n    ultimately have \"\\<forall>(_,x) \\<in> set (take x ts). x < p\"\n      by (auto simp add: in_set_conv_nth  min.absorb2)+\n    moreover assume \"p \\<le> snd (l' ! x)\"\n    then have \"case l'!x of (_,s) \\<Rightarrow> \\<not>(s < p)\"\n      by (simp add: case_prod_unfold)\n    then have \"case ts!x of (_,s) \\<Rightarrow> \\<not>(s < p)\"\n      using heap_init x_sm_len x_sm_len_ts\n      by (metis (mono_tags, lifting) case_prod_unfold length_map length_take min.absorb2 nth_take snd_map_help(2))\n    ultimately have \"linear_split ts p = (take x ts, drop x ts)\"\n      using x_sm_len_ts linear_split_split[of x ts p] heap_init\n      by (metis length_map length_take min.absorb2)\n    then show \"split_relation ts (linear_split ts p) x\"\n      using x_sm_len_ts \n      by (metis append_take_drop_id heap_init(2) heap_init(3) length_map length_take less_imp_le_nat min.absorb2 split_relation_alt)\n  qed\nqed\n\n\nsublocale split\\<^sub>i_tree linear_split split_fun\n  apply(unfold_locales)\n  unfolding linear_split.simps\n  subgoal by (auto split: list.splits)\n  subgoal\n    apply (auto split: list.splits)\n    by (metis (no_types, lifting) case_prodD in_set_conv_decomp takeWhile_eq_all_conv takeWhile_idem)\n  subgoal\n    by (metis case_prod_conv hd_dropWhile le_less_linear list.sel(1) list.simps(3))\n  subgoal for ts tsi rs tsi'' r z c a n k p\n    supply R= split_rule_linear_split[of ts \"zip (subtrees tsi) (zip (butlast (r # rs)) (butlast (rs @ [z])))\" tsi\ntsi''\n      ]\n    thm R\n    apply(sep_auto heap: R simp del: last.simps butlast.simps)\n    done\n  done\n\nend\n\nlocale split\\<^sub>i_list_smeq =\n  fixes split_list_fun :: \"('a::{heap,default,linorder,order_top} array \\<times> nat) \\<Rightarrow> 'a \\<Rightarrow> nat Heap\"\n  assumes split_list_rule: \"sorted_less xs \\<Longrightarrow> \n <is_pfa c xs (a, n)>\n   split_list_fun (a, n) (p::'a)\n  <\\<lambda>r. is_pfa c xs (a, n) *\n                 \\<up> (r \\<le> n \\<and>\n                   (\\<forall>j<r. xs ! j < p) \\<and>\n                   (r < n \\<longrightarrow> p \\<le> xs ! r))>\\<^sub>t\"\nbegin\n\n\nlemma split_list_rule_linear_split: \n  shows\n    \"sorted_less ts \\<Longrightarrow> <\n    is_pfa c ts (a,n)> \n    split_list_fun (a,n) p \n  <\\<lambda>i. \n    is_pfa c ts (a,n)\n    * \\<up>(split_relation ts (linear_split_list ts p) i)>\\<^sub>t\"\n  apply(rule hoare_triple_preI)\n  apply (sep_auto heap: split_list_rule dest!: mod_starD \n      simp add: list_assn_prod_map split_ismeq id_assn_list_alt simp del: linear_split_list.simps)\n    apply(auto simp add: is_pfa_def split_relation_alt)\n  subgoal by (smt (verit) eq_len_takeWhile_conv leD length_take length_takeWhile_le linorder_neqE_nat min_eq_arg(2) nth_length_takeWhile nth_take nth_take_eq)\n  subgoal by (metis le_neq_implies_less length_take length_takeWhile_le min_eq_arg(2) nth_length_takeWhile nth_take)\n  subgoal by (metis le_neq_implies_less length_take length_takeWhile_le min_eq_arg(2) nth_length_takeWhile nth_take)\n  done\n\n\nsublocale split\\<^sub>i_list linear_split_list split_list_fun\n  apply(unfold_locales)\n  subgoal by (auto split: list.splits)\n  subgoal\n    apply (auto split: list.splits)\n    by (metis (no_types, lifting) case_prodD in_set_conv_decomp takeWhile_eq_all_conv takeWhile_idem)\n  subgoal\n    apply (auto split: list.splits)\n    by (metis case_prod_conv hd_dropWhile le_less_linear list.sel(1) list.simps(3))\n  apply(sep_auto heap: split_list_rule_linear_split)\n  done\n\nend\n\nlocale split\\<^sub>i_full_smeq = split\\<^sub>i_tree_smeq split_fun + split\\<^sub>i_list_smeq split_list_fun\n  for split_fun:: \"('a::{heap,default,linorder,order_top} btnode ref option \\<times> 'a) array \\<times> nat \\<Rightarrow> 'a \\<Rightarrow> nat Heap\"\n  and split_list_fun :: \"('a::{heap,default,linorder,order_top} array \\<times> nat) \\<Rightarrow> 'a \\<Rightarrow> nat Heap\"\nbegin\n\nsublocale split\\<^sub>i_full split_fun split_list_fun linear_split linear_split_list\n  by (unfold_locales)\n\nend\n\ntext \"The fact that these functions fulfill the locale specifications will only be shown\nwhen we try to extract the executable code, because\nthe correct definitions have to be derived directly at the first instance of interpretation.\"\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/BTree/BPlusTree_ImpSplit.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3344401301855043}}
{"text": "theory Impl_List_Playground_statefulpolicycompliance\nimports \"../TopoS_Impl\"\n    Impl_List_Playground_ChairNetwork\nbegin\n\n\nthm ChairNetwork_def\nthm ChairSecurityRequirements_def\n\ndefinition \"ChairNetwork_stateful_IFS =\n  \\<lparr> hostsL = nodesL ChairNetwork,\n    flows_fixL = edgesL ChairNetwork,\n    flows_stateL = filter_IFS_no_violations ChairNetwork ChairSecurityRequirements \\<rparr>\"\nvalue \"edgesL ChairNetwork\"\nvalue \"filter_IFS_no_violations ChairNetwork ChairSecurityRequirements\"\nvalue \"ChairNetwork_stateful_IFS\"\nlemma \"set (flows_stateL ChairNetwork_stateful_IFS) \\<subseteq>\n       (set (flows_fixL ChairNetwork_stateful_IFS))\" by eval (*must always hold*)\nvalue \"(set (flows_fixL ChairNetwork_stateful_IFS)) - set (flows_stateL ChairNetwork_stateful_IFS)\"\n(*only problems: printers!!!*)\nvalue \"stateful_list_policy_to_list_graph ChairNetwork_stateful_IFS\"\n\ndefinition \"ChairNetwork_stateful_ACS =\n  \\<lparr> hostsL = nodesL ChairNetwork,\n   flows_fixL = edgesL ChairNetwork,\n   flows_stateL = filter_compliant_stateful_ACS ChairNetwork ChairSecurityRequirements \\<rparr>\"\nvalue \"edgesL ChairNetwork\"\nvalue \"filter_compliant_stateful_ACS ChairNetwork ChairSecurityRequirements\"\nvalue \"ChairNetwork_stateful_ACS\"\nlemma \"set (flows_stateL ChairNetwork_stateful_ACS) \\<subseteq> (set (flows_fixL ChairNetwork_stateful_ACS))\"\n  by eval (*must always hold*)\nvalue \"(set (flows_fixL ChairNetwork_stateful_ACS)) - set (flows_stateL ChairNetwork_stateful_ACS)\"\n\n(*TODO: lemma \\<dots> = X by eval*)\n\n(*flows that are already allowed in both directions are not marked as stateful*)\nvalue \"((set (flows_fixL ChairNetwork_stateful_ACS)) - set (flows_stateL ChairNetwork_stateful_ACS)) - set (backlinks (flows_fixL ChairNetwork_stateful_ACS))\"\n\n(*the new backflows*)\nvalue \"set (edgesL (stateful_list_policy_to_list_graph ChairNetwork_stateful_ACS)) - (set (edgesL ChairNetwork))\"\n\n(*the resulting ACS graph*)\nvalue \"stateful_list_policy_to_list_graph ChairNetwork_stateful_ACS\"\n\n\nvalue \"generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements\"\nvalue \"generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements\"\nlemma \"set (flows_fixL (generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements)) =\n       set (flows_fixL (generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements))\" by eval\nlemma \"set (flows_stateL (generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements)) =\n       set (flows_stateL (generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements))\" by eval\n\n\ndefinition \"ChairNetwork_stateful = generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements\"\n\n\nML_val\\<open>\nvisualize_edges @{context} @{term \"flows_fixL ChairNetwork_stateful\"} \n  [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\",\n   @{term \"flows_stateL ChairNetwork_stateful\"})] \"\"; \n\\<close>\n\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Examples/Impl_List_Playground_statefulpolicycompliance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3344401301855043}}
{"text": "           (*-------------------------------------------*\n            |                                           |\n            |       LW-CSP-Prover on Isabelle2021       | \n            |                                           |\n           *-------------------------------------------*)\n\ntheory CSP_syntax\nimports Main\nbegin\n\n(*************************************************************\n\n         1. Syntax of CSP\n         2. Syntactic sugar\n         3. \n         4. \n\n *************************************************************)\n\n(*-----------------------------------------------------------*\n |                                                           |\n |    Process Type Definitions                               |\n |                                                           |\n |             'a proc : type of process expressions         |\n |                       'n : process name                   |\n |                       'a : event                          |\n |                                                           |\n *-----------------------------------------------------------*)\n\n(*********************************************************************\n                       process expression\n *********************************************************************)\n\ndatatype \n ('p,'a) proc\n    = STOP\n\n    | Prefix   \"'a\" \"('p,'a) proc\"      (\"(1_ /-> _)\" [150,80] 80)\n\n    | ExtCh    \"('p,'a) proc\" \"('p,'a) proc\"  \n                                               (\"(1_ /[+] _)\" [72,73] 72)\n    | IntCh    \"('p,'a) proc\" \"('p,'a) proc\"  \n                                               (\"(1_ /|~| _)\" [64,65] 64)\n    | NatExtCh \"nat set\" \"nat => ('p,'a) proc\"\n                                               (\"(1[nat] :_ .. /_)\" [900,75] 75) \n    | RepIntCh \"'a set\" \"'a => ('p,'a) proc\"\n                                               (\"(1!! :_ .. /_)\" [900,68] 68) \n    | If       \"bool\" \"('p,'a) proc\" \"('p,'a) proc\"\n                                 (\"(0IF _ /THEN _ /ELSE _)\" [900,88,88] 88)\n    | Para     \"('p,'a) proc\" \"'a set\" \"('p,'a) proc\"  \n                                               (\"(1_ /|[_]| _)\" [76,0,77] 76)\n    | Hide     \"('p,'a) proc\" \"'a set\"   (\"(1_ /~~ _)\" [84,85] 84)\n\n    | Ren      \"('p,'a) proc\" \"('a * 'a) set\"\n                                               (\"(1_ /[[_]])\" [84,0] 84)\n    | PName    \"'p\"                      (\"$_\" [900] 90)\n\n(*--------------------------------------------------------------------*\n |                                                                    |\n | binding power:                                                     |\n |      PName > If > {Hide, Ren} > Prefix > Para >                    |\n |      NatExtCh > ExtCh >  RepIntCh > IntCh                          |\n |                                                                    |\n *--------------------------------------------------------------------*)\n\n(*---------------------------------------*\n |           Syntactic Sugars            |\n *---------------------------------------*)\n\n(*** nat external choice ***)\n\nsyntax\n  \"@Nat_ext_choice\"  :: \"pttrn => nat set => ('p,'a) proc \n                => ('p,'a) proc\"  (\"(1[Nat] _:_ .. _)\" [900,900,75] 75)\n  \"@Nat_Univ_ext_choice\"  :: \"pttrn => ('p,'a) proc \n                => ('p,'a) proc\"  (\"(1[Nat] _ .. _)\" [900,75] 75)\ntranslations\n  \"[Nat] n:N .. P\"  == \"[nat] :N .. (%n. P)\"\n  \"[Nat] n .. P\"  == \"[Nat] n:(CONST UNIV) .. P\"\n\n(*** replicated internal choice ***)\n\nsyntax\n  \"@Rep_int_choice\"  :: \"pttrn => 'a set => ('p,'a) proc \n                => ('p,'a) proc\"  (\"(1!! _:_ .. _)\" [900,900,68] 68)\n  \"@Rep_Univ_int_choice\"  :: \"pttrn => ('p,'a) proc \n                => ('p,'a) proc\"  (\"(1!! _ .. _)\" [900,68] 68)\ntranslations\n  \"!! a:X .. P\"  == \"!! :X .. (%a. P)\"\n  \"!! a .. P\"  == \"!! a:(CONST UNIV) .. P\"\n\n(*** sending ***)\n\nabbreviation\n  Send_prefix :: \"('x => 'a) => 'x => ('p,'a) proc => ('p,'a) proc\" \n                                      (\"(1_ ! _ /-> _)\" [900,990,80] 80)\n  where\n  \"a ! x -> P    == a x -> P\"\n\n(*** receiving on nat ***)\n\nabbreviation\n  Rec_prefix  :: \"(nat => 'a) => nat set => \n                  (nat => ('p,'a) proc) => ('p,'a) proc\" \n  where\n  \"Rec_prefix a N Pf == [nat] : N .. (%n. a n -> Pf n)\"\n\n(* rec set *)\n\nsyntax\n  \"@Rec_nat_prefix\"  :: \"(nat => 'a) => pttrn => nat set => ('p,'a) proc \n                => ('p,'a) proc\"   (\"(1_ ? _:_ /-> _)\" [900,990,1000,75] 75)\n  \"@Rec_nat_Univ_prefix\"  :: \"(nat => 'a) => pttrn => ('p,'a) proc \n                => ('p,'a) proc\"   (\"(1_ ? _ /-> _)\" [900,990,75] 75)\ntranslations\n  \"a ? n:N -> P\" == \"CONST Rec_prefix a N (%n. P)\"   \n  \"a ? n -> P\"   == \"a ? n:(CONST UNIV) -> P\"\n\n(*** interleaving ***)\n\nabbreviation\n   Interleave :: \"('p,'a) proc => ('p,'a) proc\n                    => ('p,'a) proc\"  (\"(1_ /||| _)\" [76,77] 76)\nwhere \"P ||| Q == P |[{}]| Q\"\n\n(*** guard ***)\n\nabbreviation\n   Guard :: \"bool => ('p,'a) proc\n                  => ('p,'a) proc\"  (\"(1_ /&> _)\" [150,80] 80)  (* ? *)\nwhere \"b &> P == IF b THEN P ELSE STOP\"\n\n(* renaming *)\n\nabbreviation\n  Ren_pair  :: \"'a => 'a => ('a * 'a) set\" (\"_ <- _\" [900,900] 900)\n  where\n  \"a <- b == {(a,b)}\"\n\n(* test of syntactic sugars *)\n\nlemma test_send_rec_syntax:\n  \"a ? n -> (b ! n -> STOP) = [Nat] n .. a n -> b n -> STOP\"\n  apply (simp)\n  done\nlemma test_renaming_syntax:\n  \"(a -> STOP)[[a <- b]] = (a -> STOP)[[{(a,b)}]]\"\n  apply (simp)\n  done\n\n(*  We assume that a process-name-function PNfun is given  *)\n(*  for defining the meaning of each process-name.         *)\n\ntype_synonym ('p,'a) pnfun = \"'p => ('p,'a) proc\"\nconsts PNfun :: \"('p,'a) pnfun\"  (* Definition of process names *)\n\nend\n", "meta": {"author": "nu-manycore", "repo": "public", "sha": "94b6a68b8183e6b756f6ece0fa483b93ad8cc833", "save_path": "github-repos/isabelle/nu-manycore-public", "path": "github-repos/isabelle/nu-manycore-public/public-94b6a68b8183e6b756f6ece0fa483b93ad8cc833/MBP-Prover/CSP_syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6688802603710085, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3344401301855042}}
{"text": "theory Extra4\n  imports ExtraInv VCTheoryLemmas\nbegin\n\nabbreviation s where \"s s0 userAtTop_value userAtBottom_value  directionSwitch_value alarmButton_value stuck_value \\<equiv>\n (toEnv\n   (setPstate\n     (setVarBool\n       (setVarBool\n         (setVarBool (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value)\n           up' UP')\n         moving' UP')\n       direction' UP')\n     ERROR Ctrl'goUp))\"\n\ntheorem extra4: \"VC4 extraInv env s0 userAtTop_value userAtBottom_value  directionSwitch_value alarmButton_value stuck_value\"\n  apply(simp only: VC4_def extraInv_def)\n  apply(rule impI)\n  apply(rule conjI)\n   apply simp\n  subgoal\n    apply((drule conjE[of _ _ ?thesis])+)\n                        defer\n                        apply assumption+\n    subgoal premises prems\n      apply(rule conjI)\n      using prems(1-7) prems(8) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(9) apply simp\n      apply(rule conjI)\n       apply(rule allI)\n      subgoal for s1\n        apply(cases \"s1 = s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\")\n         apply(rule impI)\n         apply(rule exI[of _ s0])\n         apply(rule exI[of _ \"s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\"])\n        using prems(1-7) substate_refl toEnvNum_id apply -[1]\n         apply((rule conjI);simp)\n        using prems(10) by simp\n      apply(rule conjI)\n      using prems(1-7) prems(11) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(12) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(13) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(14) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(15) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(16) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(17) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(18) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(19) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(20) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(21) apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(21) prems(22) substate_refl apply simp\n      apply(rule conjI)\n      using prems(1-7) prems(23) apply simp\n      using prems(1-7) prems(24) by simp\n    done\n  done\n\nend\n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/escalator/Extra4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6584175139669998, "lm_q2_score": 0.5078118642792043, "lm_q1q2_score": 0.3343522252416612}}
{"text": "(*  Title:      HOL/Auth/ZhouGollmann.thy\n    Author:     Giampaolo Bella and L C Paulson, Cambridge Univ Computer Lab\n    Copyright   2003  University of Cambridge\n\nThe protocol of\n  Jianying Zhou and Dieter Gollmann,\n  A Fair Non-Repudiation Protocol,\n  Security and Privacy 1996 (Oakland)\n  55-61\n*)\n\ntheory ZhouGollmann imports Public begin\n\nabbreviation\n  TTP :: agent where \"TTP == Server\"\n\nabbreviation f_sub :: nat where \"f_sub == 5\"\nabbreviation f_nro :: nat where \"f_nro == 2\"\nabbreviation f_nrr :: nat where \"f_nrr == 3\"\nabbreviation f_con :: nat where \"f_con == 4\"\n\n\ndefinition broken :: \"agent set\" where    \n    \\<comment>\\<open>the compromised honest agents; TTP is included as it's not allowed to\n        use the protocol\\<close>\n   \"broken == bad - {Spy}\"\n\ndeclare broken_def [simp]\n\ninductive_set zg :: \"event list set\"\n  where\n\n  Nil:  \"[] \\<in> zg\"\n\n| Fake: \"[| evsf \\<in> zg;  X \\<in> synth (analz (spies evsf)) |]\n         ==> Says Spy B X  # evsf \\<in> zg\"\n\n| Reception:  \"[| evsr \\<in> zg; Says A B X \\<in> set evsr |] ==> Gets B X # evsr \\<in> zg\"\n\n  (*L is fresh for honest agents.\n    We don't require K to be fresh because we don't bother to prove secrecy!\n    We just assume that the protocol's objective is to deliver K fairly,\n    rather than to keep M secret.*)\n| ZG1: \"[| evs1 \\<in> zg;  Nonce L \\<notin> used evs1; C = Crypt K (Number m);\n           K \\<in> symKeys;\n           NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, C\\<rbrace>|]\n       ==> Says A B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> # evs1 \\<in> zg\"\n\n  (*B must check that NRO is A's signature to learn the sender's name*)\n| ZG2: \"[| evs2 \\<in> zg;\n           Gets B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs2;\n           NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, C\\<rbrace>;\n           NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, C\\<rbrace>|]\n       ==> Says B A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> # evs2  \\<in>  zg\"\n\n  (*A must check that NRR is B's signature to learn the sender's name;\n    without spy, the matching label would be enough*)\n| ZG3: \"[| evs3 \\<in> zg; C = Crypt K M; K \\<in> symKeys;\n           Says A B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs3;\n           Gets A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs3;\n           NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, C\\<rbrace>;\n           sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>|]\n       ==> Says A TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace>\n             # evs3 \\<in> zg\"\n\n (*TTP checks that sub_K is A's signature to learn who issued K, then\n   gives credentials to A and B.  The Notes event models the availability of\n   the credentials, but the act of fetching them is not modelled.  We also\n   give con_K to the Spy. This makes the threat model more dangerous, while \n   also allowing lemma @{text Crypt_used_imp_spies} to omit the condition\n   @{term \"K \\<noteq> priK TTP\"}. *)\n| ZG4: \"[| evs4 \\<in> zg; K \\<in> symKeys;\n           Gets TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace>\n             \\<in> set evs4;\n           sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n           con_K = Crypt (priK TTP) \\<lbrace>Number f_con, Agent A, Agent B,\n                                      Nonce L, Key K\\<rbrace>|]\n       ==> Says TTP Spy con_K\n           #\n           Notes TTP \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K, con_K\\<rbrace>\n           # evs4 \\<in> zg\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare Fake_parts_insert_in_Un  [dest]\ndeclare analz_into_parts [dest]\n\ndeclare symKey_neq_priEK [simp]\ndeclare symKey_neq_priEK [THEN not_sym, simp]\n\n\ntext\\<open>A \"possibility property\": there are traces that reach the end\\<close>\nlemma \"[|A \\<noteq> B; TTP \\<noteq> A; TTP \\<noteq> B; K \\<in> symKeys|] ==>\n     \\<exists>L. \\<exists>evs \\<in> zg.\n           Notes TTP \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K,\n               Crypt (priK TTP) \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K\\<rbrace>\\<rbrace>\n               \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] zg.Nil\n                    [THEN zg.ZG1, THEN zg.Reception [of _ A B],\n                     THEN zg.ZG2, THEN zg.Reception [of _ B A],\n                     THEN zg.ZG3, THEN zg.Reception [of _ A TTP], \n                     THEN zg.ZG4])\napply (basic_possibility, auto)\ndone\n\nsubsection \\<open>Basic Lemmas\\<close>\n\nlemma Gets_imp_Says:\n     \"[| Gets B X \\<in> set evs; evs \\<in> zg |] ==> \\<exists>A. Says A B X \\<in> set evs\"\napply (erule rev_mp)\napply (erule zg.induct, auto)\ndone\n\nlemma Gets_imp_knows_Spy:\n     \"[| Gets B X \\<in> set evs; evs \\<in> zg |]  ==> X \\<in> spies evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\n\ntext\\<open>Lets us replace proofs about @{term \"used evs\"} by simpler proofs \nabout @{term \"parts (spies evs)\"}.\\<close>\nlemma Crypt_used_imp_spies:\n     \"[| Crypt K X \\<in> used evs; evs \\<in> zg |]\n      ==> Crypt K X \\<in> parts (spies evs)\"\napply (erule rev_mp)\napply (erule zg.induct)\napply (simp_all add: parts_insert_knows_A) \ndone\n\nlemma Notes_TTP_imp_Gets:\n     \"[|Notes TTP \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K, con_K\\<rbrace>\n           \\<in> set evs;\n        sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n        evs \\<in> zg|]\n    ==> Gets TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule zg.induct, auto)\ndone\n\ntext\\<open>For reasoning about C, which is encrypted in message ZG2\\<close>\nlemma ZG2_msg_in_parts_spies:\n     \"[|Gets B \\<lbrace>F, B', L, C, X\\<rbrace> \\<in> set evs; evs \\<in> zg|]\n      ==> C \\<in> parts (spies evs)\"\nby (blast dest: Gets_imp_Says)\n\n(*classical regularity lemma on priK*)\nlemma Spy_see_priK [simp]:\n     \"evs \\<in> zg ==> (Key (priK A) \\<in> parts (spies evs)) = (A \\<in> bad)\"\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, auto)\ndone\n\ntext\\<open>So that blast can use it too\\<close>\ndeclare  Spy_see_priK [THEN [2] rev_iffD1, dest!]\n\nlemma Spy_analz_priK [simp]:\n     \"evs \\<in> zg ==> (Key (priK A) \\<in> analz (spies evs)) = (A \\<in> bad)\"\nby auto \n\n\nsubsection\\<open>About NRO: Validity for @{term B}\\<close>\n\ntext\\<open>Below we prove that if @{term NRO} exists then @{term A} definitely\nsent it, provided @{term A} is not broken.\\<close>\n\ntext\\<open>Strong conclusion for a good agent\\<close>\nlemma NRO_validity_good:\n     \"[|NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, C\\<rbrace>;\n        NRO \\<in> parts (spies evs);\n        A \\<notin> bad;  evs \\<in> zg |]\n     ==> Says A B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, auto)  \ndone\n\nlemma NRO_sender:\n     \"[|Says A' B \\<lbrace>n, b, l, C, Crypt (priK A) X\\<rbrace> \\<in> set evs; evs \\<in> zg|]\n    ==> A' \\<in> {A,Spy}\"\napply (erule rev_mp)  \napply (erule zg.induct, simp_all)\ndone\n\ntext\\<open>Holds also for @{term \"A = Spy\"}!\\<close>\ntheorem NRO_validity:\n     \"[|Gets B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs;\n        NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, C\\<rbrace>;\n        A \\<notin> broken;  evs \\<in> zg |]\n     ==> Says A B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs\"\napply (drule Gets_imp_Says, assumption) \napply clarify \napply (frule NRO_sender, auto)\ntxt\\<open>We are left with the case where the sender is @{term Spy} and not\n  equal to @{term A}, because @{term \"A \\<notin> bad\"}. \n  Thus theorem \\<open>NRO_validity_good\\<close> applies.\\<close>\napply (blast dest: NRO_validity_good [OF refl])\ndone\n\n\nsubsection\\<open>About NRR: Validity for @{term A}\\<close>\n\ntext\\<open>Below we prove that if @{term NRR} exists then @{term B} definitely\nsent it, provided @{term B} is not broken.\\<close>\n\ntext\\<open>Strong conclusion for a good agent\\<close>\nlemma NRR_validity_good:\n     \"[|NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, C\\<rbrace>;\n        NRR \\<in> parts (spies evs);\n        B \\<notin> bad;  evs \\<in> zg |]\n     ==> Says B A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct) \napply (frule_tac [5] ZG2_msg_in_parts_spies, auto)  \ndone\n\nlemma NRR_sender:\n     \"[|Says B' A \\<lbrace>n, a, l, Crypt (priK B) X\\<rbrace> \\<in> set evs; evs \\<in> zg|]\n    ==> B' \\<in> {B,Spy}\"\napply (erule rev_mp)  \napply (erule zg.induct, simp_all)\ndone\n\ntext\\<open>Holds also for @{term \"B = Spy\"}!\\<close>\ntheorem NRR_validity:\n     \"[|Says B' A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs;\n        NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, C\\<rbrace>;\n        B \\<notin> broken; evs \\<in> zg|]\n    ==> Says B A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs\"\napply clarify \napply (frule NRR_sender, auto)\ntxt\\<open>We are left with the case where @{term \"B' = Spy\"} and  @{term \"B' \\<noteq> B\"},\n  i.e. @{term \"B \\<notin> bad\"}, when we can apply \\<open>NRR_validity_good\\<close>.\\<close>\n apply (blast dest: NRR_validity_good [OF refl])\ndone\n\n\nsubsection\\<open>Proofs About @{term sub_K}\\<close>\n\ntext\\<open>Below we prove that if @{term sub_K} exists then @{term A} definitely\nsent it, provided @{term A} is not broken.\\<close>\n\ntext\\<open>Strong conclusion for a good agent\\<close>\nlemma sub_K_validity_good:\n     \"[|sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n        sub_K \\<in> parts (spies evs);\n        A \\<notin> bad;  evs \\<in> zg |]\n     ==> Says A TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close> \napply (blast dest!: Fake_parts_sing_imp_Un)\ndone\n\nlemma sub_K_sender:\n     \"[|Says A' TTP \\<lbrace>n, b, l, k, Crypt (priK A) X\\<rbrace> \\<in> set evs;  evs \\<in> zg|]\n    ==> A' \\<in> {A,Spy}\"\napply (erule rev_mp)  \napply (erule zg.induct, simp_all)\ndone\n\ntext\\<open>Holds also for @{term \"A = Spy\"}!\\<close>\ntheorem sub_K_validity:\n     \"[|Gets TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs;\n        sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n        A \\<notin> broken;  evs \\<in> zg |]\n     ==> Says A TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs\"\napply (drule Gets_imp_Says, assumption) \napply clarify \napply (frule sub_K_sender, auto)\ntxt\\<open>We are left with the case where the sender is @{term Spy} and not\n  equal to @{term A}, because @{term \"A \\<notin> bad\"}. \n  Thus theorem \\<open>sub_K_validity_good\\<close> applies.\\<close>\napply (blast dest: sub_K_validity_good [OF refl])\ndone\n\n\n\nsubsection\\<open>Proofs About @{term con_K}\\<close>\n\ntext\\<open>Below we prove that if @{term con_K} exists, then @{term TTP} has it,\nand therefore @{term A} and @{term B}) can get it too.  Moreover, we know\nthat @{term A} sent @{term sub_K}\\<close>\n\nlemma con_K_validity:\n     \"[|con_K \\<in> used evs;\n        con_K = Crypt (priK TTP)\n                  \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K\\<rbrace>;\n        evs \\<in> zg |]\n    ==> Notes TTP \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K, con_K\\<rbrace>\n          \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply (blast dest!: Fake_parts_sing_imp_Un)\ntxt\\<open>ZG2\\<close> \napply (blast dest: parts_cut)\ndone\n\ntext\\<open>If @{term TTP} holds @{term con_K} then @{term A} sent\n @{term sub_K}.  We assume that @{term A} is not broken.  Importantly, nothing\n  needs to be assumed about the form of @{term con_K}!\\<close>\nlemma Notes_TTP_imp_Says_A:\n     \"[|Notes TTP \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K, con_K\\<rbrace>\n           \\<in> set evs;\n        sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n        A \\<notin> broken; evs \\<in> zg|]\n     ==> Says A TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt\\<open>ZG4\\<close>\napply clarify \napply (rule sub_K_validity, auto) \ndone\n\ntext\\<open>If @{term con_K} exists, then @{term A} sent @{term sub_K}.  We again\n   assume that @{term A} is not broken.\\<close>\ntheorem B_sub_K_validity:\n     \"[|con_K \\<in> used evs;\n        con_K = Crypt (priK TTP) \\<lbrace>Number f_con, Agent A, Agent B,\n                                   Nonce L, Key K\\<rbrace>;\n        sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n        A \\<notin> broken; evs \\<in> zg|]\n     ==> Says A TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs\"\nby (blast dest: con_K_validity Notes_TTP_imp_Says_A)\n\n\nsubsection\\<open>Proving fairness\\<close>\n\ntext\\<open>Cannot prove that, if @{term B} has NRO, then  @{term A} has her NRR.\nIt would appear that @{term B} has a small advantage, though it is\nuseless to win disputes: @{term B} needs to present @{term con_K} as well.\\<close>\n\ntext\\<open>Strange: unicity of the label protects @{term A}?\\<close>\nlemma A_unicity: \n     \"[|NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, Crypt K M\\<rbrace>;\n        NRO \\<in> parts (spies evs);\n        Says A B \\<lbrace>Number f_nro, Agent B, Nonce L, Crypt K M', NRO'\\<rbrace>\n          \\<in> set evs;\n        A \\<notin> bad; evs \\<in> zg |]\n     ==> M'=M\"\napply clarify\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, auto) \ntxt\\<open>ZG1: freshness\\<close>\napply (blast dest: parts.Body) \ndone\n\n\ntext\\<open>Fairness lemma: if @{term sub_K} exists, then @{term A} holds \nNRR.  Relies on unicity of labels.\\<close>\nlemma sub_K_implies_NRR:\n     \"[| NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, Crypt K M\\<rbrace>;\n         NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, Crypt K M\\<rbrace>;\n         sub_K \\<in> parts (spies evs);\n         NRO \\<in> parts (spies evs);\n         sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n         A \\<notin> bad;  evs \\<in> zg |]\n     ==> Gets A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs\"\napply clarify\napply hypsubst_thin\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply blast \ntxt\\<open>ZG1: freshness\\<close>\napply (blast dest: parts.Body) \ntxt\\<open>ZG3\\<close> \napply (blast dest: A_unicity [OF refl]) \ndone\n\n\nlemma Crypt_used_imp_L_used:\n     \"[| Crypt (priK TTP) \\<lbrace>F, A, B, L, K\\<rbrace> \\<in> used evs; evs \\<in> zg |]\n      ==> L \\<in> used evs\"\napply (erule rev_mp)\napply (erule zg.induct, auto)\ntxt\\<open>Fake\\<close>\napply (blast dest!: Fake_parts_sing_imp_Un)\ntxt\\<open>ZG2: freshness\\<close>\napply (blast dest: parts.Body) \ndone\n\n\ntext\\<open>Fairness for @{term A}: if @{term con_K} and @{term NRO} exist, \nthen @{term A} holds NRR.  @{term A} must be uncompromised, but there is no\nassumption about @{term B}.\\<close>\ntheorem A_fairness_NRO:\n     \"[|con_K \\<in> used evs;\n        NRO \\<in> parts (spies evs);\n        con_K = Crypt (priK TTP)\n                      \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K\\<rbrace>;\n        NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, Crypt K M\\<rbrace>;\n        NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, Crypt K M\\<rbrace>;\n        A \\<notin> bad;  evs \\<in> zg |]\n    ==> Gets A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\n   txt\\<open>Fake\\<close>\n   apply (simp add: parts_insert_knows_A) \n   apply (blast dest: Fake_parts_sing_imp_Un) \n  txt\\<open>ZG1\\<close>\n  apply (blast dest: Crypt_used_imp_L_used) \n txt\\<open>ZG2\\<close>\n apply (blast dest: parts_cut)\ntxt\\<open>ZG4\\<close> \napply (blast intro: sub_K_implies_NRR [OF refl] \n             dest: Gets_imp_knows_Spy [THEN parts.Inj])\ndone\n\ntext\\<open>Fairness for @{term B}: NRR exists at all, then @{term B} holds NRO.\n@{term B} must be uncompromised, but there is no assumption about @{term\nA}.\\<close>\ntheorem B_fairness_NRR:\n     \"[|NRR \\<in> used evs;\n        NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, C\\<rbrace>;\n        NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, C\\<rbrace>;\n        B \\<notin> bad; evs \\<in> zg |]\n    ==> Gets B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply (blast dest!: Fake_parts_sing_imp_Un)\ntxt\\<open>ZG2\\<close>\napply (blast dest: parts_cut)\ndone\n\n\ntext\\<open>If @{term con_K} exists at all, then @{term B} can get it, by \\<open>con_K_validity\\<close>.  Cannot conclude that also NRO is available to @{term B},\nbecause if @{term A} were unfair, @{term A} could build message 3 without\nbuilding message 1, which contains NRO.\\<close>\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/ZhouGollmann.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.33435221843428237}}
{"text": "theory Wasm_Assertions_Shallow imports \"Wasm_Big_Step\" begin\n\ntypedef lvar = \"UNIV :: (nat) set\" ..\n\n(* global, local, logical variables*)\ndatatype var = Gl nat | Lc nat | Lv lvar\n\ndatatype 'a lvar_v = V_p v | V_n nat | V_b byte | V_a 'a\n\nabbreviation \"case_ret r r_new \\<equiv> case_option r_new (\\<lambda>x. Some x) r\"\n\nlemma case_ret_None[simp]:\"case_ret r None = r\"\n  by (cases r) auto\n\n(* variable store *)\n(* global, local, logical variables*)\ntype_synonym 'a var_st = \"global list \\<times> v list \\<times> (lvar, 'a lvar_v) map\"\n\ndefinition var_st_get_local :: \"'a var_st \\<Rightarrow> nat \\<Rightarrow> v option\" where\n  \"var_st_get_local st n \\<equiv> let st_l = (fst (snd st)) in\n                            (if (n < length st_l)\n                            then Some (st_l!n)\n                            else None)\"\n\ndefinition var_st_set_local :: \"'a var_st \\<Rightarrow> nat \\<Rightarrow> v \\<Rightarrow> 'a var_st\" where\n  \"var_st_set_local st n v \\<equiv> let (gs, vs, lvs) = st in\n                             (if (n < length vs)\n                             then (gs, vs[n := v], lvs)\n                             else st)\"\n\ndefinition var_st_get_global :: \"'a var_st \\<Rightarrow> nat \\<Rightarrow> global option\" where\n  \"var_st_get_global st n \\<equiv> let st_g = (fst st) in\n                            (if (n < length st_g)\n                            then Some (st_g!n)\n                            else None)\"\n\ndefinition var_st_set_global :: \"'a var_st \\<Rightarrow> nat \\<Rightarrow> global \\<Rightarrow> 'a var_st\" where\n  \"var_st_set_global st n g \\<equiv> let (gs, vs, lvs) = st in\n                              (if (n < length gs)\n                              then (gs[n := g], vs, lvs)\n                              else st)\"\n\ndefinition var_st_set_global_v :: \"'a var_st \\<Rightarrow> nat \\<Rightarrow> v \\<Rightarrow> 'a var_st\" where\n  \"var_st_set_global_v st n v \\<equiv> let (gs, vs, lvs) = st in\n                                (if (n < length gs)\n                                then (gs[n := ((gs!n)\\<lparr>g_val := v\\<rparr>)], vs, lvs)\n                                else st)\"\n\ndefinition var_st_get_lvar :: \"'a var_st \\<Rightarrow> lvar \\<Rightarrow> 'a lvar_v option\" where\n  \"var_st_get_lvar st lv \\<equiv> let st_lv = (snd (snd st)) in st_lv lv\"\n\ndefinition var_st_set_lvar :: \"'a var_st \\<Rightarrow> lvar \\<Rightarrow> 'a lvar_v \\<Rightarrow> 'a var_st\" where\n  \"var_st_set_lvar st l lv \\<equiv> let (gs, vs, lvs) = st in\n                              (gs, vs, (lvs(l \\<mapsto> lv)))\"\n\n(* abstract heap with max length *)\ntype_synonym heap = \"((nat, byte) map) \\<times> (nat option)\"\n\ndefinition map_disj :: \"('a,'b) map \\<Rightarrow> ('a,'b) map \\<Rightarrow> bool\" where\n  \"map_disj m1 m2 \\<equiv> Set.disjnt (dom m1) (dom m2)\"\n\ndefinition option_disj :: \"'a option \\<Rightarrow> 'a option \\<Rightarrow> bool\" where\n  \"option_disj o1 o2 \\<equiv> Option.is_none o1 \\<or> Option.is_none o2\"\n\ndefinition heap_disj :: \"heap \\<Rightarrow> heap \\<Rightarrow> bool\" where\n  \"heap_disj h1 h2 \\<equiv> map_disj (fst h1) (fst h2) \\<and> option_disj (snd h1) (snd h2)\"\n\ndefinition heap_merge :: \"heap \\<Rightarrow> heap \\<Rightarrow> heap\" where\n  \"heap_merge h1 h2 \\<equiv> let (m1,s1) = h1 in\n                       let (m2,s2) = h2 in\n                       (m1 ++ m2, case_option s2 (\\<lambda>s. Some s) s1)\"\n\nlemma heap_disj_sym: \"heap_disj h1 h2 = heap_disj h2 h1\"\n  unfolding heap_disj_def map_disj_def option_disj_def\n  using disjnt_sym\n  by blast\n\nlemma heap_merge_disj_sym:\n  assumes \"heap_disj h1 h2\"\n  shows \"heap_merge h1 h2 = heap_merge h2 h1\"\n  using assms\n  unfolding heap_disj_def heap_merge_def option_disj_def heap_disj_def map_disj_def disjnt_def\n  by (auto simp add: map_add_comm split: option.splits prod.splits)\n\nlemma heap_merge_assoc:\n  shows \"heap_merge h1 (heap_merge h2 h3) = heap_merge (heap_merge h1 h2) h3\"\n  unfolding heap_merge_def\n  by (auto split: option.splits prod.splits)\n\nlemma heap_disj_merge_sub:\n  assumes \"heap_disj h1 (heap_merge h2 h3)\"\n  shows \"heap_disj h1 h2\"\n        \"heap_disj h1 h3\"\n  using assms\n  unfolding heap_disj_def heap_merge_def option_disj_def map_disj_def disjnt_def\n  by (auto split: option.splits prod.splits)\n\nlemma heap_disj_merge_assoc:\n  assumes \"heap_disj h_H h_Hf\"\n          \"heap_disj (heap_merge h_H h_Hf) hf\"\n  shows \"heap_disj h_H (heap_merge h_Hf hf)\"\n  using assms\n  unfolding heap_disj_def heap_merge_def map_disj_def disjnt_def\n  by (auto split: option.splits prod.splits)\n\nlemma heap_merge_dom:\n  assumes \"x \\<in> dom (fst (heap_merge h1 h2))\"\n  shows \"x \\<in> dom (fst h1) \\<or> x \\<in> dom (fst h2)\"\n  using assms\n  unfolding heap_disj_def heap_merge_def option_disj_def heap_disj_def map_disj_def disjnt_def\n  by (auto simp add: map_add_comm split: option.splits prod.splits)\n\nlemma heap_dom_merge:\n  assumes \"x \\<in> dom (fst h1) \\<or> x \\<in> dom (fst h2)\"\n  shows \"x \\<in> dom (fst (heap_merge h1 h2))\"\n  using assms\n  unfolding heap_disj_def heap_merge_def option_disj_def heap_disj_def map_disj_def disjnt_def\n  by (auto simp add: map_add_comm split: option.splits prod.splits)\n\nlemma heap_dom_merge_eq:\n  assumes \"dom (fst h1) = dom(fst h2)\"\n  shows \"dom (fst (heap_merge h1 hf)) = dom (fst (heap_merge h2 hf))\"\n  using assms\n  unfolding heap_disj_def heap_merge_def option_disj_def heap_disj_def map_disj_def disjnt_def\n  apply (simp add: map_add_comm split: option.splits prod.splits)\n  apply force\n  done\n\nlemma heap_disj_merge_maps1:\n  assumes \"heap_disj h1 h2\"\n          \"(fst h1) x = Some y\"\n  shows \"fst (heap_merge h1 h2) x = Some y\"\n  using assms\n  unfolding heap_disj_def heap_merge_def option_disj_def heap_disj_def map_disj_def disjnt_def\n  apply (simp add: map_add_dom_app_simps map_add_comm split: option.splits prod.splits)\n  apply (metis fst_conv map_add_comm map_add_find_right)\n  done\n\nlemma heap_disj_merge_maps2:\n  assumes \"heap_disj h1 h2\"\n          \"(fst h2) x = Some y\"\n  shows \"fst (heap_merge h1 h2) x = Some y\"\n  using assms\n  unfolding heap_disj_def heap_merge_def option_disj_def heap_disj_def map_disj_def disjnt_def\n  apply (simp add: map_add_dom_app_simps map_add_comm split: option.splits prod.splits)\n  apply (metis fst_conv map_add_find_right)\n  done\n\n(* local variable reification *)\ndefinition reifies_loc :: \"[v list, 'a var_st] \\<Rightarrow> bool\" where\n  \"reifies_loc locs st \\<equiv> (fst (snd st)) = locs\"\n\n(* global variable reification (with respect to a partial instance) *)\ndefinition reifies_glob :: \"[global list, nat list, 'a var_st] \\<Rightarrow> bool\" where\n  \"reifies_glob gs igs st \\<equiv>\n     let st_g = (fst st) in\n     length st_g = (length igs) \\<and> (\\<forall>gn < length st_g. igs!gn < (length gs) \\<and> st_g!gn = (gs!(igs!gn)))\"\n\n(* function reification (with respect to a partial instance) *)\ndefinition reifies_func :: \"[cl list, nat list, cl list] \\<Rightarrow> bool\" where\n  \"reifies_func cls icls fs \\<equiv> list_all2 (\\<lambda>icl f. icl < (length cls) \\<and> cls!icl = f) icls fs\"\n\n(* heap reification relations *)\ndefinition reifies_heap_contents :: \"[mem, ((nat, byte) map)] \\<Rightarrow> bool\" where\n  \"reifies_heap_contents m byte_m \\<equiv>\n     \\<forall>ind \\<in> (dom byte_m). ind < mem_length m \\<and> byte_m(ind) = Some (byte_at m ind)\"\n\ndefinition reifies_heap_length :: \"[mem, nat option] \\<Rightarrow> bool\" where\n  \"reifies_heap_length m l_opt \\<equiv> pred_option (\\<lambda>l. mem_length m = (l * Ki64)) l_opt\"\n\ndefinition reifies_heap :: \"[mem list, nat list, heap] \\<Rightarrow> bool\" where\n  \"reifies_heap ms im_opt h \\<equiv> let im = hd im_opt in\n                               im < length ms\n                             \\<and> reifies_heap_contents (ms!im) (fst h)\n                             \\<and> reifies_heap_length (ms!im) (snd h)\"\n\n(* store reification relation *)\ndefinition reifies_s :: \"[s, inst, heap, 'a var_st, cl list] \\<Rightarrow> bool\" where\n  \"reifies_s s i h st fs \\<equiv> reifies_glob (globs s) (inst.globs i) st\n                         \\<and> reifies_func (funcs s) (inst.funcs i) fs\n                         \\<and> reifies_heap (mems s) (inst.mems i) h\"\n\ndefinition var_st_agree :: \"'a var_st \\<Rightarrow> var \\<Rightarrow> 'a var_st \\<Rightarrow> bool\" where\n  \"var_st_agree st1 var st2 \\<equiv> case var of\n                                 Lc n \\<Rightarrow> (var_st_get_local st1 n) = (var_st_get_local st2 n)\n                               | Gl n \\<Rightarrow> (var_st_get_global st1 n) = (var_st_get_global st2 n)\n                               | Lv lvar \\<Rightarrow> (var_st_get_lvar st1 lvar) = (var_st_get_lvar st2 lvar)\"\n\n(* shallow embedding of assertions *)\ntype_synonym 'a stack_ass = \"(v \\<Rightarrow> 'a var_st \\<Rightarrow> bool) list\"\ntype_synonym 'a heap_ass = \"heap \\<Rightarrow> 'a var_st \\<Rightarrow> bool\"\n\ndatatype 'a ass = Ass \"'a stack_ass\" \"'a heap_ass\" (infix \"\\<^sub>s|\\<^sub>h\" 60) | Ex_ass lvar \"'a ass\" \n\ntype_synonym 'a triple = \"'a ass \\<times> e list \\<times> 'a ass\"\n\n(* function list, assms, label ass, return ass *)\ntype_synonym 'a triple_context = \"cl list \\<times> 'a ass list \\<times> 'a ass option\"\n\ndefinition add_label_ass :: \"'a triple_context \\<Rightarrow> 'a ass \\<Rightarrow> 'a triple_context\" where\n  \"add_label_ass \\<Gamma> l \\<equiv> let (fs, labs, ret) = \\<Gamma> in (fs, l#labs, ret)\"\n\ndefinition stack_ass_sat :: \"'a stack_ass \\<Rightarrow> v list \\<Rightarrow> 'a var_st \\<Rightarrow> bool\" where\n  \"stack_ass_sat St ves v_st = list_all2 (\\<lambda>Si v. Si v v_st) St ves\"\n\nfun ass_sat :: \"'a ass \\<Rightarrow> v list \\<Rightarrow> heap \\<Rightarrow> 'a var_st \\<Rightarrow> bool\" where\n  \"ass_sat (St \\<^sub>s|\\<^sub>h H) ves h v_st = (stack_ass_sat St ves v_st \\<and> H h v_st)\"\n| \"ass_sat (Ex_ass lv P) ves h st = (\\<exists>v. ass_sat P ves h (var_st_set_lvar st lv v))\"\n\nfun ass_stack_len :: \"'a ass \\<Rightarrow> nat\" where\n  \"ass_stack_len (St \\<^sub>s|\\<^sub>h H) = length St\"\n| \"ass_stack_len (Ex_ass lv P) = ass_stack_len P\"\n\n(* label reification relation *)\ndefinition reifies_lab :: \"nat list \\<Rightarrow> 'a triple_context \\<Rightarrow> bool\" where\n  \"reifies_lab lns \\<Gamma> \\<equiv> lns = map ass_stack_len (fst (snd \\<Gamma>))\"\n\n(* return reification relation *)\ndefinition reifies_ret :: \"nat option \\<Rightarrow> 'a triple_context \\<Rightarrow> bool\" where\n  \"reifies_ret rn \\<Gamma> \\<equiv> rn = Option.map_option ass_stack_len (snd (snd \\<Gamma>))\"\n\nlocale encapsulated_module =\n  fixes i :: inst\n  assumes encapsulated_inst_globs:\"\\<And> j k. \\<lbrakk>j \\<noteq> k; (j < length (inst.globs i)); (k < length (inst.globs i))\\<rbrakk>\n                                    \\<Longrightarrow> (inst.globs i)!j \\<noteq> (inst.globs i)!k\"\nbegin\n\ndefinition ass_wf where\n  \"ass_wf lvar_st ret \\<Gamma> labs locs s hf st h vcs P \\<equiv>\n     ass_sat P vcs h st\n      \\<and> heap_disj h hf\n      \\<and> reifies_s s i (heap_merge h hf) st (fst \\<Gamma>)\n      \\<and> reifies_loc locs st\n      \\<and> reifies_lab labs \\<Gamma>\n      \\<and> reifies_ret ret \\<Gamma>\n      \\<and> snd (snd st) = lvar_st\"\n\ndefinition res_wf where\n  \"res_wf lvar_st' \\<Gamma> res locs' s' hf vcsf Q \\<equiv>\n    let (fs,lasss,rass) = \\<Gamma> in\n    (case res of\n       RTrap \\<Rightarrow> False\n     | RValue rvs \\<Rightarrow> \\<exists>h' h'' vcs' st'.\n                             ass_sat Q vcs' h'' st'\n                             \\<and> rvs = vcsf@vcs'\n                             \\<and> heap_disj h'' hf\n                             \\<and> h' = heap_merge h'' hf\n                             \\<and> reifies_s s' i h' st' fs\n                             \\<and> reifies_loc locs' st'\n                             \\<and> snd (snd st') = lvar_st'\n     | RBreak n rvs \\<Rightarrow> \\<exists>h' h'' vcs' st'.\n                             n < length lasss\n                             \\<and> ass_sat (lasss!n) vcs' h'' st'\n                             \\<and> rvs = vcs'\n                             \\<and> heap_disj h'' hf\n                             \\<and> h' = heap_merge h'' hf\n                             \\<and> reifies_s s' i h' st' fs\n                             \\<and> reifies_loc locs' st'\n                             \\<and> snd (snd st') = lvar_st'\n     | RReturn rvs \\<Rightarrow> \\<exists>h' h'' vcs' st' the_rass.\n                             rass = Some the_rass\n                             \\<and> ass_sat the_rass vcs' h'' st'\n                             \\<and> rvs = vcs'\n                             \\<and> heap_disj h'' hf\n                             \\<and> h' = heap_merge h'' hf\n                             \\<and> reifies_s s' i h' st' fs\n                             \\<and> reifies_loc locs' st'\n                             \\<and> snd (snd st') = lvar_st')\"\n\n(* TODO: frame? ? ? ?*)\ndefinition valid_triple :: \"'a triple_context \\<Rightarrow> 'a ass \\<Rightarrow> e list \\<Rightarrow> 'a ass \\<Rightarrow> bool\" (\"_ \\<Turnstile> {_}_{_}\" 60) where\n  \"(\\<Gamma> \\<Turnstile> {P}es{Q}) \\<equiv> \\<forall>vcs h st s locs labs labsf ret retf lvar_st hf vcsf s' locs' res.\n                                      ((ass_wf lvar_st ret \\<Gamma> labs locs s hf st h vcs P \\<and>\n                                      ((s,locs,($$*vcsf)@($$*vcs)@es) \\<Down>{(labs@labsf,case_ret ret retf,i)} (s',locs', res))) \\<longrightarrow>\n                                      res_wf lvar_st \\<Gamma> res locs' s' hf vcsf Q)\"\n\ndefinition valid_triples :: \"'a triple_context \\<Rightarrow> 'a triple set \\<Rightarrow> bool\" (\"_ \\<TTurnstile> _\" 60) where\n  \"\\<Gamma> \\<TTurnstile> specs \\<equiv> \\<forall>(P,es,Q) \\<in> specs. (\\<Gamma> \\<Turnstile> {P}es{Q})\"\n\n(* TODO: frame? ? ? ?*)\ndefinition valid_triple_n :: \"'a triple_context \\<Rightarrow> nat \\<Rightarrow> 'a ass \\<Rightarrow> e list \\<Rightarrow> 'a ass \\<Rightarrow> bool\" (\"_ \\<Turnstile>'_ _ {_}_{_}\" 60) where\n  \"(\\<Gamma> \\<Turnstile>_k {P}es{Q}) \\<equiv> \\<forall>vcs h st s locs labs labsf ret retf lvar_st hf vcsf s' locs' res.\n                                      ((ass_wf lvar_st ret \\<Gamma> labs locs s hf st h vcs P \\<and>\n                                      ((s,locs,($$*vcsf)@($$*vcs)@es) \\<Down>k{(labs@labsf,case_ret ret retf,i)} (s',locs', res))) \\<longrightarrow>\n                                      res_wf lvar_st \\<Gamma> res locs' s' hf vcsf Q)\"\n\ndefinition valid_triples_n :: \"'a triple_context \\<Rightarrow> nat \\<Rightarrow> 'a triple set \\<Rightarrow> bool\" (\"_ \\<TTurnstile>'_ _ _\" 60) where\n  \"(\\<Gamma> \\<TTurnstile>_n specs) \\<equiv> \\<forall>(P,es,Q) \\<in> specs. (\\<Gamma> \\<Turnstile>_n {P}es{Q})\"\n\ndefinition valid_triples_assms :: \"'a triple_context \\<Rightarrow> 'a triple set \\<Rightarrow> 'a triple set \\<Rightarrow> bool\" (\"_\\<bullet>_ \\<TTurnstile> _\" 60) where\n  \"(\\<Gamma>\\<bullet>assms \\<TTurnstile> specs) \\<equiv> ((fst \\<Gamma>,[],None) \\<TTurnstile> assms) \\<longrightarrow> (\\<Gamma> \\<TTurnstile> specs)\"\n\ndefinition valid_triples_assms_n :: \"'a triple_context \\<Rightarrow> 'a triple set \\<Rightarrow> nat \\<Rightarrow> 'a triple set \\<Rightarrow> bool\" (\"_\\<bullet>_ \\<TTurnstile>'_ _ _\" 60) where\n  \"(\\<Gamma>\\<bullet>assms \\<TTurnstile>_n specs) \\<equiv> ((fst \\<Gamma>,[],None) \\<TTurnstile>_n assms) \\<longrightarrow> (\\<Gamma> \\<TTurnstile>_n specs)\"\n\nlemmas valid_triple_defs = valid_triple_def valid_triples_def valid_triples_assms_def\n                           valid_triple_n_def valid_triples_n_def valid_triples_assms_n_def\n\ndefinition ass_conseq :: \"'a ass \\<Rightarrow> 'a ass \\<Rightarrow> v list \\<Rightarrow> heap \\<Rightarrow> 'a var_st \\<Rightarrow> bool\" where\n  \"ass_conseq P P' vcs h st \\<equiv> (ass_stack_len P \\<le> ass_stack_len P' \\<and> (ass_sat P vcs h st \\<longrightarrow> ass_sat P' vcs h st))\"\n\nlemma extend_context_res_wf:\n  assumes \"res_wf lvar_st' (fs,[],None) res locs' s' hf vcsf Q\"\n  shows \"res_wf lvar_st' (fs,ls,rs) res locs' s' hf vcsf Q\"\n  using assms\n  unfolding res_wf_def\n  by (auto split: res_b.splits)\n\nlemma extend_context_res_wf_value_trap:\n  assumes \"res_wf lvar_st' (fs,ls,rs) res locs' s' hf vcsf Q\"\n          \"\\<exists>rvs. res = RValue rvs \\<or> res = RTrap\"\n  shows \"res_wf lvar_st' (fs,ls',rs') res locs' s' hf vcsf Q\"\n  using assms\n  unfolding res_wf_def\n  by (auto split: res_b.splits)\n\nlemma ex_lab:\"\\<exists>l. lab = ass_stack_len l\"\n  using ass_stack_len.simps(1)\n  by (metis Ex_list_of_length)\n\nlemma ex_labs:\"\\<exists>ls. labs = map ass_stack_len ls\"\n  using ex_lab\n  by (simp add: ex_lab ex_map_conv)\n\nlemma ex_ret:\"\\<exists>rs. ret = map_option ass_stack_len rs\"\n  using ex_lab\n  by (metis not_Some_eq option.simps(8) option.simps(9))\n\nlemma res_wf_valid_triple_n_intro:\n  assumes \"\\<Gamma> \\<Turnstile>_k {P}es{Q}\"\n          \"ass_wf lvar_st ret \\<Gamma> labs locs s hf st h vcs P\"\n          \"((s,locs,($$*vcsf)@($$*vcs)@es) \\<Down>k{(labs@labsf,case_ret ret retf,i)} (s',locs', res))\"\n  shows \"res_wf lvar_st \\<Gamma> res locs' s' hf vcsf Q\"\n  using assms\n  unfolding valid_triple_n_def\n  by blast\n\nlemma res_wf_valid_triple_n_intro_tight:\n  assumes \"\\<Gamma> \\<Turnstile>_k {P}es{Q}\"\n          \"ass_wf lvar_st ret \\<Gamma> labs locs s hf st h vcs P\"\n          \"((s,locs,($$*vcsf)@($$*vcs)@es) \\<Down>k{(labs,ret,i)} (s',locs', res))\"\n  shows \"res_wf lvar_st \\<Gamma> res locs' s' hf vcsf Q\"\n  using res_wf_valid_triple_n_intro[OF assms(1,2), of vcsf \"[]\" None] assms(3)\n  by fastforce\n\nlemma res_wf_valid_triple_n_not_rvalue:\n  assumes \"res_wf lvar_st \\<Gamma> res locs s hf vcsf Q\"\n          \"\\<nexists>vs. res = RValue vs\"\n  shows \"res_wf lvar_st \\<Gamma> res locs s hf vcsf Q'\"\n  using assms\n  unfolding res_wf_def\n  by (cases res) auto\n\nlemma extend_context_call:\n  assumes \"(fs,ls,rs) \\<Turnstile>_n {P} [$Call j] {Q}\"\n  shows \"(fs,ls',rs') \\<Turnstile>_n {P} [$Call j] {Q}\"\nproof -\n  {\n    fix vcs h st s locs labs labsf ret retf lvar_st hf vcsf s' locs' res\n    assume local_assms:\"ass_wf lvar_st ret (fs, ls', rs') labs locs s hf st h vcs P\"\n                       \"(s, locs, ($$* vcsf) @ ($$* vcs) @ [$Call j]) \\<Down>n{(labs@labsf, case_ret ret retf, i)} (s', locs', res)\"\n    obtain ret' labs' where \"ass_wf lvar_st ret' (fs, ls, rs) labs' locs s hf st h vcs P\"\n      using local_assms(1) \n      unfolding ass_wf_def reifies_s_def reifies_lab_def reifies_ret_def\n      by fastforce\n    moreover\n    have \"(s, locs, ($$* vcsf) @ ($$* vcs) @ [$Call j]) \\<Down>n{(labs'@labsf, case_ret ret' retf, i)} (s', locs', res)\"\n      by (metis append_assoc calln_context local_assms(2) map_append)\n    ultimately\n    have \"res_wf lvar_st (fs, ls, rs) res locs' s' hf vcsf Q\"\n      using assms local_assms(2)\n      unfolding valid_triple_n_def\n      by fastforce\n    hence \"res_wf lvar_st (fs, ls', rs') res locs' s' hf vcsf Q\"\n      using extend_context_res_wf_value_trap call_value_trap local_assms(2)\n      by (metis (no_types, lifting) append_assoc map_append)\n  }\n  thus ?thesis\n    unfolding valid_triple_n_def\n    by blast\nqed\n\nlemma reifies_func_ind:\n  assumes \"reifies_func (funcs s) (inst.funcs i) fs\"\n          \"j < length fs\"\n  shows \"sfunc s i j = fs!j\"\n  using assms\n  unfolding reifies_func_def\n  by (simp add: list_all2_conv_all_nth sfunc_def sfunc_ind_def)\n\nlemma valid_triples_n_emp: \"\\<Gamma> \\<TTurnstile>_n {}\"\n  unfolding valid_triples_n_def\n  by blast\n\nlemma res_wf_conseq:\n  assumes \"res_wf l_st (fs,ls,rs) res locs' s' hf vcsf P\"\n          \"\\<forall>vs h v_st. (list_all2 (\\<lambda>L L'. ass_conseq L L' vs h v_st) ls ls')\"\n          \"\\<forall>vs h v_st. (rel_option (\\<lambda>R R'. ass_conseq R R' vs h v_st) rs rs')\"\n          \"\\<forall>vs h v_st. (ass_sat P vs h v_st \\<longrightarrow> ass_sat P' vs h v_st)\"\n  shows \"res_wf l_st (fs,ls',rs') res locs' s' hf vcsf P'\"\nproof (cases res)\n  case (RValue x1)\n  thus ?thesis\n    using assms\n    unfolding res_wf_def\n    apply simp\n    apply metis\n    done\nnext\n  case (RBreak x21 x22)\n  thus ?thesis\n    using assms\n    unfolding res_wf_def\n    apply (simp add: ass_conseq_def)\n    apply (metis (no_types, lifting) list_all2_conv_all_nth)\n    done\nnext\n  case (RReturn x3)\n  thus ?thesis\n    using assms(1,3)\n    unfolding res_wf_def\n    apply (cases rs; cases rs')\n    apply (simp_all add: ass_conseq_def)\n    apply blast\n    done\nnext\n  case RTrap\n  thus ?thesis\n    using assms\n    unfolding res_wf_def\n    by simp\nqed\n\nlemma stack_ass_sat_len:\n  assumes \"ass_sat P vcs h st\"\n  shows \"length vcs = ass_stack_len P\"\n  using assms\nproof (induction rule: ass_sat.induct)\n  case (1 St H ves h v_st)\n  thus ?case\n    apply (simp add: stack_ass_sat_def)\n    apply (metis list_all2_lengthD)\n    done\nqed auto\n\nlemma stack_ass_sat_len1:\n  assumes \"ass_sat P vcs h st\"\n          \"ass_sat P vcs' h st\"\n  shows \"length vcs = length vcs'\"\n  using stack_ass_sat_len[OF assms(1)] stack_ass_sat_len[OF assms(2)]\n  by simp\n\nlemma ass_sat_len_eq_lab:\n  assumes \"(list_all2 (\\<lambda>L L'. ass_conseq L L' vcs h st) ls ls')\"\n  shows \"(list_all2 (\\<lambda>L L'. ((\\<not>ass_sat L vcs h st \\<and> (ass_stack_len L \\<le> ass_stack_len L')) \\<or> (ass_stack_len L = ass_stack_len L'))) ls ls')\"\n  using assms\n  unfolding ass_conseq_def list_all2_conv_all_nth\n  by (metis stack_ass_sat_len)\n\nlemma ass_sat_len_eq_ret:\n  assumes \"(rel_option (\\<lambda>R R'. ass_conseq R R' vcs h st) rs rs')\"\n  shows \"(rel_option (\\<lambda>R R'. ((\\<not>ass_sat R vcs h st \\<and> (ass_stack_len R \\<le> ass_stack_len R')) \\<or> (ass_stack_len R = ass_stack_len R'))) rs rs')\"\n  using assms\n  unfolding ass_conseq_def\n  apply (cases rs; cases rs')\n  apply simp_all\n  apply (metis stack_ass_sat_len)\n  done\n\nlemma ass_wf_conseq1:\n  assumes \"ass_wf lvar_st ret (fs,ls,rs) labs locs s hf st h vcs P\"\n          \"(ass_sat P vcs h st \\<longrightarrow> ass_sat P' vcs h st)\"\n  shows \"ass_wf lvar_st ret (fs,ls,rs) labs locs s hf st h vcs P'\"\n  using assms\n  unfolding ass_wf_def\n  by (auto simp add: reifies_lab_def reifies_ret_def)\n\nlemma rel_option_to_eq_map_option:\n  assumes\n    \"rel_option f x y\" and\n    \"\\<And>a b. f a b \\<Longrightarrow> g a = g b\"\n  shows \"map_option g x = map_option g y\"\n  using assms\n  by (induction x y rule: option.rel_induct; simp)\n\nlemma list_all2_to_eq_map:\n  assumes\n    \"list_all2 f xs ys\" and\n    \"\\<And>a b. f a b \\<Longrightarrow> g a = g b\"\n  shows \"map g xs = map g ys\"\n  using assms\n  by (induction xs ys rule: list.rel_induct; simp)\n\nlemma ass_wf_conseq2:\n  assumes \"ass_wf lvar_st ret (fs,ls,rs) labs locs s hf st h vcs P\"\n          \"(list_all2 (\\<lambda>L L'. (ass_stack_len L = ass_stack_len L') \\<and> ass_conseq L L' vcs h st) ls ls')\"\n          \"(rel_option (\\<lambda>R R'. (ass_stack_len R = ass_stack_len R') \\<and> ass_conseq R R' vcs h st) rs rs')\"\n        shows \"ass_wf lvar_st ret (fs,ls',rs') labs locs s hf st h vcs P\"\nproof -\n  show ?thesis\n    using assms\n    unfolding ass_wf_def ass_conseq_def\n    unfolding reifies_lab_def reifies_ret_def\n    by (auto intro: list_all2_to_eq_map rel_option_to_eq_map_option)\nqed\n\nlemma valid_triple_assms_n_label_false:\n  assumes \"res_wf lvar_st (fs,ls,rs) res locs' s' hf vcsf Q\"\n          \"j \\<ge> length ls \\<or> (\\<forall>vcs h st. \\<not>ass_sat (ls!j) vcs h st)\"\n  shows \"res \\<noteq> RBreak j rvs\"\n  using assms\n  unfolding res_wf_def\n  by (auto split: res_b.splits)\n\nlemma valid_triple_assms_n_return_false:\n  assumes \"res_wf lvar_st (fs,ls,rs) res locs' s' hf vcsf Q\"\n          \"rs = None \\<or> (\\<forall>vcs h st. \\<not>ass_sat (the rs) vcs h st)\"\n  shows \"res \\<noteq> RReturn rvs\"\n  using assms\n  unfolding res_wf_def\n  by (auto split: res_b.splits)\n\nlemma valid_triple_n_conseq:\n  assumes \"(fs,ls,rs) \\<Turnstile>_n {P'} es {Q'}\"\n          \"\\<forall>vs h v_st. (list_all2 (\\<lambda>L L'. ass_conseq L L' vs h v_st) ls ls') \\<and>\n                       (rel_option (\\<lambda>R R'. ass_conseq R R' vs h v_st) rs rs') \\<and>\n                       (ass_sat P vs h v_st \\<longrightarrow> ass_sat P' vs h v_st) \\<and>\n                       (ass_sat Q' vs h v_st \\<longrightarrow> ass_sat Q vs h v_st)\"\n  shows \"(fs,ls',rs') \\<Turnstile>_n {P} es {Q}\"\nproof -\n  {\n    fix vcs h st s locs labs' labsf' ret' retf' lvar_st hf vcsf s' locs' res\n    assume local_assms:\"ass_wf lvar_st ret' (fs,ls',rs') labs' locs s hf st h vcs P\"\n                       \"(s, locs, ($$*vcsf)@($$*vcs)@es) \\<Down>n{(labs'@labsf', case_ret ret' retf', i)} (s', locs', res)\"\n    have \"ass_wf lvar_st ret' (fs,ls',rs') labs' locs s hf st h vcs P'\"\n      using ass_wf_conseq1[OF local_assms(1)] assms(2)\n      by blast\n    then obtain labs ret where labs_def:\"ass_wf lvar_st ret (fs,ls,rs) labs locs s hf st h vcs P'\"\n                                        \"length labs = length labs'\"\n                                        \"length ls = length ls'\"\n                                        \"length (labs'@labsf') = length (labs@labsf')\"\n      unfolding ass_wf_def reifies_lab_def reifies_ret_def\n      by simp (meson assms(2) list_all2_conv_all_nth)\n    have \"res_wf lvar_st (fs,ls',rs') res locs' s' hf vcsf Q\"\n    proof (cases res)\n      case (RValue x1)\n      hence \"(s, locs, ($$*vcsf)@($$*vcs)@es) \\<Down>n{(labs@labsf', case_ret ret retf', i)} (s', locs', res)\"\n        using reduce_to_n_not_break_n_return[OF local_assms(2)] labs_def(2)\n        by simp\n      hence \"res_wf lvar_st (fs,ls,rs) res locs' s' hf vcsf Q'\"\n        using assms(1) labs_def\n        unfolding valid_triple_n_def\n        by fastforce\n      thus ?thesis\n        using assms(2) RValue\n        unfolding res_wf_def\n        by fastforce\n    next\n      case (RBreak ib vbs)\n      have 0:\"ib < length (labs'@labsf')\"\n        using local_assms(2) RBreak reduce_to_n_break_n\n        by fastforce\n      have b0:\"(s, locs, ($$*vcsf)@($$*vcs)@es) \\<Down>n{(labs'@labsf', case_ret ret' retf', i)} (s', locs', RBreak ib vbs)\"\n        using local_assms(2) RBreak\n        by simp\n      show ?thesis\n      proof (cases \"labs!ib \\<noteq> labs'!ib\")\n        case True\n        have \"\\<And>vs h v_st. list_all2 (\\<lambda>L L'. \\<not> ass_sat L vs h v_st \\<and> ass_stack_len L \\<le> ass_stack_len L' \\<or> ass_stack_len L = ass_stack_len L') ls ls'\"\n          using ass_sat_len_eq_lab assms(2)\n          by blast\n        hence 1:\"\\<And>vcs h st. ib < length labs' \\<Longrightarrow> \\<not> ass_sat (ls!ib) vcs h st\"\n                \"ib < length labs' \\<Longrightarrow> labs!ib \\<le> labs'!ib\"\n                \"ib < length labs' \\<Longrightarrow> labs!ib = ass_stack_len (ls!ib)\"\n                \"ib < length labs' \\<Longrightarrow> labs'!ib = ass_stack_len (ls'!ib)\"\n          using True 0 labs_def local_assms(1)\n          unfolding list_all2_conv_all_nth ass_wf_def reifies_lab_def\n          by fastforce+\n        obtain vbs' where 2:\"((s, locs, ($$*vcsf)@($$*vcs)@es) \\<Down>n{(labs@labsf', case_ret ret retf', i)} (s', locs', RBreak ib vbs'))\"\n          using reduce_to_n_break_n2[OF reduce_to_n_not_return[OF b0] labs_def(4)] 0 1(2)\n          by simp (metis True append_Nil2 labs_def(2) nth_append)\n        thus ?thesis\n          using res_wf_valid_triple_n_intro[OF assms(1) labs_def(1) 2] 1(1) RBreak\n          unfolding res_wf_def\n          by (simp split: res_b.splits) (metis True append_Nil2 labs_def(2) nth_append)\n      next\n        case False\n        hence \"(s, locs, ($$*vcsf)@($$*vcs)@es) \\<Down>n{(labs@labsf', case_ret ret retf', i)} (s', locs', res)\"\n          using reduce_to_n_not_break_n_return[OF local_assms(2), of \"labs@labsf'\"] RBreak\n                labs_def(2)\n          by simp (metis nth_append)\n        hence \"res_wf lvar_st (fs,ls,rs) res locs' s' hf vcsf Q'\"\n          using assms(1) labs_def\n          unfolding valid_triple_n_def\n          by fastforce\n        thus ?thesis\n          using assms(2) RBreak\n          unfolding res_wf_def ass_conseq_def\n          by simp (metis (mono_tags, lifting) list_all2_conv_all_nth)\n      qed\n    next\n      case (RReturn vrs)\n      show ?thesis\n      proof (cases \"(pred_option (\\<lambda>r_r. (case_ret ret retf') \\<noteq> Some r_r) (case_ret ret' retf'))\")\n        case True\n        obtain r_r r_r' rs'_r rs_r where r_r'_def:\"ret = Some r_r\"\n                                                  \"ret' = Some r_r'\"\n                                                  \"rs' = Some rs'_r\"\n                                                  \"rs = Some rs_r\"\n\n          using reduce_to_n_return1 local_assms(1,2) RReturn assms(2) labs_def True\n          unfolding ass_wf_def reifies_ret_def\n          by (fastforce split: option.splits)\n        have \"ass_stack_len rs_r \\<noteq> ass_stack_len rs'_r\"\n          using local_assms(1) labs_def r_r'_def True\n          unfolding ass_wf_def reifies_ret_def\n          by simp\n        moreover\n        have \"\\<And>vs h v_st. rel_option (\\<lambda>R R'. (\\<not>ass_sat R vs h v_st \\<and> (ass_stack_len R \\<le> ass_stack_len R')) \\<or> ass_stack_len R = ass_stack_len R') rs rs'\"\n          using ass_sat_len_eq_ret assms(2)\n          by blast\n        ultimately\n        have 1:\"\\<And>vcs h st. \\<not> ass_sat rs_r vcs h st \\<and> ass_stack_len rs_r \\<le> ass_stack_len rs'_r\"\n          using r_r'_def\n          by simp\n        hence \"r_r \\<le> r_r'\"\n          using r_r'_def local_assms(1)\n          unfolding ass_wf_def reifies_ret_def\n          by (metis (mono_tags, lifting) ass_wf_def eq_snd_iff labs_def(1) option.inject option.map(2) reifies_ret_def)\n        then obtain vrs' where \"((s, locs, ($$*vcsf)@($$*vcs)@es) \\<Down>n{(labs@labsf', case_ret ret retf', i)} (s', locs', RReturn vrs'))\"\n          using local_assms(2) RReturn reduce_to_n_return2 reduce_to_n_not_break_n r_r'_def(1,2)\n          by (metis labs_def(4) option.simps(5) res_b.distinct(7))\n        thus ?thesis\n          using assms(1) labs_def 1 r_r'_def RReturn\n          unfolding valid_triple_n_def res_wf_def\n          apply (cases \"hf\")\n          apply (cases \"st\")\n          apply (cases \"h\")\n          apply (simp split: res_b.splits option.splits)\n          apply metis\n          done\n      next\n        case False\n        hence \"(s, locs, ($$*vcsf)@($$*vcs)@es) \\<Down>n{(labs@labsf', case_ret ret retf', i)} (s', locs', res)\"\n          using reduce_to_n_not_break_n_return[OF local_assms(2), of \"labs@labsf'\" \"case_ret ret retf'\"] RReturn labs_def(2)\n          by auto\n        hence \"res_wf lvar_st (fs,ls,rs) res locs' s' hf vcsf Q'\"\n          using assms(1) labs_def\n          unfolding valid_triple_n_def\n          by fastforce\n        thus ?thesis\n          using assms(2) RReturn\n          unfolding res_wf_def ass_conseq_def\n          by simp (metis (no_types, lifting) option.rel_cases option.sel)\n      qed\n    next\n      case RTrap\n      hence \"(s, locs, ($$*vcsf)@($$*vcs)@es) \\<Down>n{(labs@labsf', case_ret ret retf', i)} (s', locs', res)\"\n        using reduce_to_n_not_break_n_return[OF local_assms(2)] labs_def(2)\n        by auto\n      hence \"res_wf lvar_st (fs,ls,rs) res locs' s' hf vcsf Q'\"\n        using assms(1) labs_def\n        unfolding valid_triple_n_def\n        by fastforce\n      thus ?thesis\n        using assms(2) RTrap\n        unfolding res_wf_def\n        by fastforce\n    qed\n  }\n  thus ?thesis\n    unfolding valid_triple_n_def\n    by blast\nqed\n\nlemma valid_triple_assms_n_conseq:\n  assumes \"((fs,ls,rs)\\<bullet>assms \\<TTurnstile>_n {(P',es,Q')})\"\n          \"\\<forall>vs h v_st. (list_all2 (\\<lambda>L L'. ass_conseq L L' vs h v_st) ls ls') \\<and>\n                       (rel_option (\\<lambda>R R'. ass_conseq R R' vs h v_st) rs rs') \\<and>\n                       (ass_sat P vs h v_st \\<longrightarrow> ass_sat P' vs h v_st) \\<and>\n                       (ass_sat Q' vs h v_st \\<longrightarrow> ass_sat Q vs h v_st)\"\n  shows \"((fs,ls',rs')\\<bullet>assms \\<TTurnstile>_n {(P,es,Q)})\"\n  using valid_triple_n_conseq[OF _ assms(2)] assms(1)\n  unfolding valid_triples_assms_n_def valid_triples_n_def\n  by simp\nend\n\nend", "meta": {"author": "conrad-watt", "repo": "wasm-pl-isabelle", "sha": "265f292250c01770d50d4ecda998ed5961c6719e", "save_path": "github-repos/isabelle/conrad-watt-wasm-pl-isabelle", "path": "github-repos/isabelle/conrad-watt-wasm-pl-isabelle/wasm-pl-isabelle-265f292250c01770d50d4ecda998ed5961c6719e/Wasm_Assertions_Shallow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.33435221843428237}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               February 2005               |\n            |                   June 2005  (modified)   |\n            |                 August 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_T_law_fp\nimports CSP_T_law_ufp\nbegin\n\n(*****************************************************************\n\n         1. cpo fixed point theory in CSP-Prover\n         2.\n         3.\n         4. \n\n *****************************************************************)\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n\n(*=======================================================*\n |                                                       |\n |                        CPO                            |\n |                                                       |\n *=======================================================*)\n\n(*-------------*\n |  existency  |\n *-------------*)\n\nlemma semT_hasLFP_cpo: \n \"Pf = PNfun ==> [[Pf]]Tfun hasLFP\"\napply (rule Tarski_thm_EX)\napply (rule continuous_semTfun)\ndone\n\nlemma semT_LFP_cpo:\n  \"[| Pf = PNfun ;\n      FPmode = CPOmode | FPmode = MIXmode |]\n  ==> [[$p]]T = LFP [[Pf]]Tfun p\"\napply (simp add: semT_def semTf_def)\napply (simp add: traces_iff)\napply (simp add: MT_def)\napply (simp add: semTfix_def)\napply (force)\ndone\n\nlemma semT_LFP_fun_cpo:\n  \"[| Pf = PNfun ;\n      FPmode = CPOmode | FPmode = MIXmode |]\n  ==> (%p. [[$p]]T) = LFP [[Pf]]Tfun\"\napply (simp (no_asm) add: fun_eq_iff)\napply (simp add: semT_LFP_cpo)\ndone\n\n(*---------*\n |    MT   |\n *---------*)\n\nlemma MT_fixed_point_cpo:\n      \"[| (Pf::'p=>('p,'a) proc) = PNfun; FPmode = CPOmode | FPmode = MIXmode |]\n        ==> [[Pf]]Tfun (MT::'p => 'a domT) = (MT::'p => 'a domT)\"\napply (simp add: MT_def)\napply (simp add: semTfix_def)\napply (erule disjE)\napply (simp_all)\napply (rule LFP_fp)\napply (simp add: semT_hasLFP_cpo)\napply (rule LFP_fp)\napply (simp add: semT_hasLFP_cpo)\ndone\n\n(*-------------*\n |  greatest   |\n *-------------*)\n\nlemma ALL_cspT_greatest_cpo:\n  \"[| Pf = PNfun ;\n       FPmode = CPOmode ;\n       ALL p. (Pf p) << f =T f p |] ==> ALL p. f p <=T $p\"\napply (simp add: eqT_def refT_def)\napply (fold semT_def)\napply (simp add: fun_eq_iff[THEN sym])\napply (fold order_prod_def)\napply (insert semT_LFP_fun_cpo[of \"Pf\"])\napply (simp)\n\napply (rule LFP_least)\napply (simp add: semT_hasLFP_cpo)\n\napply (simp add: semT_def semTfun_def semTf_def)\napply (simp add: traces_subst)\ndone\n\nlemma cspT_greatest_cpo:\n  \"[| Pf = PNfun ;\n       FPmode = CPOmode ;\n       ALL p. (Pf p) << f =T f p |] ==> f p <=T $p\"\nby (simp add: ALL_cspT_greatest_cpo)\n\n(*-------------------------------------------------------*\n |                                                       |\n |           Fixpoint unwind (CSP-Prover rule)           |\n |                                                       |\n *-------------------------------------------------------*)\n\nlemma ALL_cspT_unwind_cpo:\n   \"[| Pf = PNfun ;\n       FPmode = CPOmode | FPmode = MIXmode |]\n     ==> ALL p. ($p =T Pf p)\"\napply (simp add: cspT_semantics)\napply (simp add: traces_iff)\napply (simp add: MT_def)\napply (simp add: semTfix_def)\napply (simp add: fun_eq_iff[THEN sym])\napply (simp add: traces_semTfun)\napply (simp add: LFP_fp semT_hasLFP_cpo)\napply (force)\ndone\n\n(*  csp law  *)\n\nlemma cspT_unwind_cpo:\n   \"[| Pf = PNfun ;\n       FPmode = CPOmode | FPmode = MIXmode |]\n     ==> $p =T Pf p\"\nby (simp add: ALL_cspT_unwind_cpo)\n\n(*-------------------------------------------------------*\n |                                                       |\n |    fixed point inducntion (CSP-Prover intro rule)     |\n |                                                       |\n *-------------------------------------------------------*)\n\n(*** right ***)\n\nlemma cspT_fp_induct_cpo_ref_right_ALL:\n   \"[| Pf = PNfun ;\n       FPmode = CPOmode | FPmode = MIXmode ;\n       Q <=T f p;\n       ALL p. f p <=T (Pf p)<<f |]\n    ==> Q <=T $p\"\napply (simp add: refT_semT)\napply (insert cpo_fixpoint_induction_rev\n       [of \"[[Pf]]Tfun\" \"(%p. [[f p]]T)\"])\napply (simp add: LFP_fp semT_hasLFP_cpo)\napply (simp add: fold_order_prod_def)\napply (simp add: semT_subst_semTfun)\n\napply (simp add: continuous_semTfun)\napply (simp add: order_prod_def)\napply (drule_tac x=\"p\" in spec)+\n\napply (simp add: semT_LFP_cpo)\ndone\n\n(*  csp law  *)\n\nlemma cspT_fp_induct_cpo_ref_right:\n   \"[| Pf = PNfun ;\n       FPmode = CPOmode | FPmode = MIXmode ;\n       Q <=T f p;\n       !! p. f p <=T (Pf p)<<f |]\n    ==> Q <=T $p\"\nby (simp add: cspT_fp_induct_cpo_ref_right_ALL)\n\nlemmas cspT_fp_induct_cpo_right \n     = cspT_fp_induct_cpo_ref_right\n\n(*=======================================================*\n |                                                       |\n |                    LFP <--> UFP                       |\n |                                                       |\n |                       MIXmode                         |\n |                                                       |\n *=======================================================*)\n\nlemma semT_guarded_LFP_UFP:\n  \"[| Pf = PNfun ; guardedfun Pf |]\n   ==> LFP [[Pf]]Tfun = UFP [[Pf]]Tfun\"\nby (simp add: semT_hasUFP_cms hasUFP_LFP_UFP)\n\n(*----------- refinement -----------*)\n\n(*** left ***)\n\nlemma cspT_fp_induct_mix_ref_left_ALL:\n   \"[| Pf = PNfun ;\n       guardedfun Pf ;\n       FPmode = MIXmode ;\n       f p <=T Q ;\n       ALL p. (Pf p)<<f <=T f p |]\n    ==> $p <=T Q\"\napply (simp add: refT_semT)\napply (insert cms_fixpoint_induction_ref\n       [of \"[[Pf]]Tfun\" \"(%p. [[f p]]T)\" \"UFP [[Pf]]Tfun\"])\napply (simp add: semT_guarded_LFP_UFP[THEN sym])\napply (simp add: LFP_fp semT_hasLFP_cpo)\n\napply (simp add: fold_order_prod_def)\napply (simp add: semT_subst_semTfun)\napply (simp add: mono_semTfun)\n\napply (simp add: contra_alpha_to_contst contraction_alpha_semTfun)\napply (simp add: to_distance_rs)\napply (simp add: order_prod_def)\napply (drule_tac x=\"p\" in spec)+\napply (simp add: semT_LFP_cpo)\ndone\n\n(*  csp law  *)\n\nlemma cspT_fp_induct_mix_ref_left:\n   \"[| Pf = PNfun ;\n       guardedfun Pf ;\n       FPmode = MIXmode ;\n       f p <=T Q ;\n       !! p. (Pf p)<<f <=T f p |]\n    ==> $p <=T Q\"\nby (simp add: cspT_fp_induct_mix_ref_left_ALL)\n\n(*----------- equality -----------*)\n\n(*** left ***)\n\nlemma cspT_fp_induct_mix_eq_left_ALL:\n   \"[| Pf = PNfun ;\n       guardedfun Pf ;\n       FPmode = MIXmode ;\n       f p =T Q ;\n       ALL p. (Pf p)<<f =T f p |]\n    ==> $p =T Q\"\napply (simp add: eqT_semT)\napply (simp add: fun_eq_iff[THEN sym])\napply (simp add: semT_subst_semTfun)\napply (insert semT_LFP_fun_cpo[of Pf])\napply (simp add: semT_guarded_LFP_UFP)\napply (subgoal_tac \"(%p. [[$p]]T) = (%p. [[f p]]T)\")\napply (simp add: fun_eq_iff)\n\napply (rule hasUFP_unique_solution[of \"[[Pf]]Tfun\"])\napply (simp_all add: semT_hasUFP_cms)\napply (simp add: UFP_fp semT_hasUFP_cms)\ndone\n\n(*  csp law  *)\n\nlemma cspT_fp_induct_mix_eq_left:\n   \"[| Pf = PNfun ;\n       guardedfun Pf ;\n       FPmode = MIXmode ;\n       f p =T Q;\n       !! p. (Pf p)<<f =T f p |]\n    ==> $p =T Q\"\nby (simp add: cspT_fp_induct_mix_eq_left_ALL)\n\nlemma cspT_fp_induct_mix_eq_right:\n   \"[| Pf = PNfun ;\n       guardedfun Pf ;\n       FPmode = MIXmode ;\n       Q =T f p;\n       !! p. f p =T (Pf p)<<f |]\n    ==> Q =T $p\"\napply (rule cspT_sym)\napply (rule cspT_fp_induct_mix_eq_left[of Pf f p Q])\napply (simp_all)\napply (rule cspT_sym)\napply (simp)\napply (rule cspT_sym)\napply (simp)\ndone\n\nlemmas cspT_fp_induct_mix_left \n     = cspT_fp_induct_mix_ref_left cspT_fp_induct_mix_eq_left\n\nlemmas cspT_fp_induct_mix_right \n     = cspT_fp_induct_cpo_ref_right cspT_fp_induct_mix_eq_right\n\n(*=======================================================*\n |                                                       |\n |            mixing CPOmode and CMSmode                 |\n |                                                       |\n *=======================================================*)\n\nlemma cspT_unwind:\n   \"[| Pf = PNfun ;\n       FPmode = CPOmode\n     | FPmode = CMSmode & guardedfun Pf\n     | FPmode = MIXmode |]\n     ==> $p =T Pf p\"\napply (erule disjE)\napply (simp add: cspT_unwind_cpo)\napply (erule disjE)\napply (simp add: cspT_unwind_cms)\napply (simp add: cspT_unwind_cpo)\ndone\n\nlemma cspT_fp_induct_ref_right:\n   \"[| Pf = PNfun ;\n       FPmode = CPOmode\n     | FPmode = CMSmode & guardedfun Pf\n     | FPmode = MIXmode ;\n       Q <=T f p;\n       !! p. f p <=T (Pf p)<<f |]\n    ==> Q <=T $p\"\napply (erule disjE)\napply (simp add: cspT_fp_induct_cpo_right)\napply (erule disjE)\napply (simp add: cspT_fp_induct_cms_right)\napply (simp add: cspT_fp_induct_cpo_right)\ndone\n\nlemma cspT_fp_induct_ref_left:\n   \"[| Pf = PNfun ;\n       FPmode = CMSmode \n     | FPmode = MIXmode ;\n       guardedfun Pf ;\n       f p <=T Q ;\n       !! p. (Pf p)<<f <=T f p |]\n    ==> $p <=T Q\"\napply (erule disjE)\napply (simp add: cspT_fp_induct_cms_left)\napply (simp add: cspT_fp_induct_mix_left)\ndone\n\nlemma cspT_fp_induct_eq_left:\n   \"[| Pf = PNfun ;\n       FPmode = CMSmode \n     | FPmode = MIXmode ;\n       guardedfun Pf ;\n       f p =T Q ;\n       !! p. (Pf p)<<f =T f p |]\n    ==> $p =T Q\"\napply (erule disjE)\napply (simp add: cspT_fp_induct_cms_left)\napply (simp add: cspT_fp_induct_mix_left)\ndone\n\nlemma cspT_fp_induct_eq_right:\n   \"[| Pf = PNfun ;\n       FPmode = CMSmode \n     | FPmode = MIXmode ;\n       guardedfun Pf ;\n       Q =T f p;\n       !! p. f p =T (Pf p)<<f |]\n    ==> Q =T $p\"\napply (erule disjE)\napply (simp add: cspT_fp_induct_cms_right)\napply (simp add: cspT_fp_induct_mix_right)\ndone\n\n(*** cpo and cms ***)\n\nlemmas cspT_fp_induct_right = cspT_fp_induct_ref_right cspT_fp_induct_eq_right\nlemmas cspT_fp_induct_left = cspT_fp_induct_ref_left cspT_fp_induct_eq_left\n\n(****************** to add them again ******************)\n(* 2013\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_T/CSP_T_law_fp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.658417487156366, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3343522116269034}}
{"text": "theory TS_Refinement_Proof_Rules\nimports  TS_Proof_Rules\nbegin\n\nlemma exists_ops_vts_push: \"ops_wfs s c \\<Longrightarrow> \\<exists>ts'. ops_vts_push t ts' s\"\n  apply(simp add: ops_vts_push_def getTs_def)\n  apply(case_tac \"ops s = {}\")\n   apply simp\n  apply(case_tac \"ops_matched s = {}\", simp_all)\n    apply (simp add: gt_ex)\n  apply(unfold ops_wfs_def)[1]\n   apply simp\n  apply(case_tac \"ops_matched s = {}\", simp_all)\n   apply(rule_tac x = \"Max(snd ` ops s) + 1\" in exI)\n   apply(unfold ops_wfs_def)[1]\n  apply(intro conjI, elim conjE, simp_all)  \n  apply (metis (no_types, lifting) add.commute finite_imageI image_eqI image_is_empty less_add_one member_less_max pos_add_strict zero_less_one)\n   apply (metis Max_less_iff equals0D finite_imageI infinite_growing less_add_same_cancel1 zero_less_double_add_iff_zero_less_single_add zero_less_two)\n  apply(subgoal_tac \"snd` ops_matched s \\<subseteq> ops s\")\n   apply(subgoal_tac \"fst` ops_matched s \\<subseteq> ops s\")\n    defer\n   apply(unfold ops_wfs_def)[1]\n  apply linarith\n   apply(unfold ops_wfs_def)[1]\n   apply linarith\n  apply(rule_tac x = \"Max (snd `(ops s)) +1\" in exI)\n  apply(intro allI impI conjI)\n    apply(unfold ops_wfs_def getTs_def getOp_def ops_init_def, simp)[1]\n  apply(subgoal_tac \"finite(snd ` ops s)\")\n  apply (simp add: add.commute add_strict_increasing)\n    apply simp\n   apply(subgoal_tac \"finite(snd ` ops s)\")\n  apply(subgoal_tac \"Max (snd ` ops s) + 1 > Max (snd ` ops s)\")\n  using Max_less_iff apply blast\n  using less_add_one apply blast\n    apply(unfold ops_wfs_def getTs_def getOp_def ops_init_def, simp)[1]\n  apply(unfold ops_wfs_def getTs_def getOp_def ops_init_def, simp)[1]\n  apply(subgoal_tac \"ba \\<le> Max (snd ` ops s)\")\n   apply linarith\n  apply simp\n  by (metis Max.coboundedI finite_imageI image_iff image_subset_iff prod.exhaust_sel snd_eqD)\n\n\nlemma exist_ops_vts_pop: \"ops_wfs s c \\<Longrightarrow> \\<exists> ts'. ops_vts_pop t ts' s\"\n  apply(simp add: ops_vts_pop_def ops_init_matched_pairs_def getTs_def)\n  apply(case_tac \"ops s = {}\")\n  apply simp\n  apply(case_tac \"ops_matched s = {}\", simp_all)\n    apply (simp add: gt_ex)\n  apply(unfold ops_wfs_def)[1]\n   apply simp\n   apply(rule_tac x = \"Max(snd ` ops s) + 1\" in exI)\n    apply(unfold ops_wfs_def, simp_all)[1]\n apply (intro conjI)\n  apply (simp add: add.commute add_strict_increasing)\n   apply (metis Max_less_iff equals0D finite_imageI infinite_growing less_add_same_cancel1 zero_less_double_add_iff_zero_less_single_add zero_less_two)  \n  apply(intro allI conjI impI)\n  apply(elim conjE, intro disjI2)\n  apply(subgoal_tac \" (aa, ba) \\<in> ops s\") defer\n   apply (metis imageI old.prod.inject prod.collapse subset_iff)\n  apply(simp add: getTs_def getOp_def ops_init_def)\n  by (metis Max.coboundedI add.commute add_strict_increasing finite_imageI image_iff snd_eqD zero_less_one)\n\n(*****************************************)\n\ndefinition \"ref_client_thrView t ac cc \\<equiv> \\<forall> x . tst (thrView ac t x) \\<le> tst (thrView cc t x) \"\n\ndefinition \"ref_Top ss ls \\<equiv> \\<forall> w . lib_lastWr ls Top = w \\<and> lib_value ls w \\<noteq> Null \\<longrightarrow>\n           (\\<exists> op . op\\<notin>fst`(ops_matched ss) \\<and> getOp op = PUSH \\<and> op\\<in>ops ss \n                  \\<and> op_value op ss = lib_value ls (lib_lastWr ls (lib_value ls w)))\"\n\n\ndefinition \"ref_addr_push f als cls ps \\<equiv> \\<forall> ad . ad\\<in>addr ps \\<longrightarrow>\n           (\\<exists> op . op\\<in>ops als \\<and> getOp op = PUSH \\<and> f ad = op \\<and> lib_value cls (lib_lastWr cls ad) = op_value op als)\"\n\n\ndefinition \"refs t f ps als cls acs ccs \\<equiv> ref_client_thrView t acs ccs \\<and> ref_addr_push f als cls ps\"\n\nlemmas [simp] = refs_def\n\nlemma \"f a = b \\<Longrightarrow> c\\<notin>dom f \\<Longrightarrow> f' = f(c:=d) \\<Longrightarrow> f' c = d\"\n  by simp\n\n(*\nps  = program state\nccs = concrete client state\nacs = abstract client state\nccl = concrete stack library state\nals = abstract stack library state\n*)\n\nlemma lib_last_in_writes_on: \"lib_wfs cls ccs \\<Longrightarrow> lib_writes_on cls x \\<noteq> {} \\<Longrightarrow> lib_lastWr cls x \\<in> lib_writes_on cls x\"\n  apply(simp add: lib_wfs_def lib_writes_on_def lib_lastWr_def tst_def var_def)\n  apply(subgoal_tac \"finite(snd ` {w. fst w = x \\<and> w \\<in> lib_writes cls})\")\n   apply safe\n  defer\n   apply blast\n  apply(subgoal_tac \" Max (snd ` {w. fst w = x \\<and> w \\<in> lib_writes cls}) \\<in>  (snd ` {w. fst w = x \\<and> w \\<in> lib_writes cls})\")\n  apply (simp add: image_iff)\n  using Max_in by blast\n  \nlemma ops_vts_push_max: \"ops_wfs als acs \\<Longrightarrow> ops_vts_push t (Max (snd ` ops als) + 1) als\"\n  apply(simp add: ops_vts_push_def getTs_def getOp_def)\n  apply (intro conjI)\n    apply(unfold ops_wfs_def ops_init_def getOp_def getTs_def)[1]\n  apply simp\n    apply (simp add: add.commute add_strict_increasing)\n    apply(unfold ops_wfs_def ops_init_def getOp_def getTs_def)[1]\n  apply simp\n    apply (simp add: add.commute add_strict_increasing)  \n  apply (meson Max.coboundedI add_le_same_cancel2 finite_imageI not_one_le_zero)\n    apply(unfold ops_wfs_def ops_init_def getOp_def getTs_def lastOp_def)[1]\n  apply simp\n  apply (simp add: add.commute add_strict_increasing )  \n  apply(intro allI impI conjI, elim conjE exE)\n  apply(intro disjI2)\n  apply clarsimp\n  by (metis Max.coboundedI add_strict_increasing finite_imageI image_eqI image_subset_iff snd_conv zero_less_one)\n\nlemma ops_vts_pop_max: \"ops_wfs als acs \\<Longrightarrow> ops_vts_pop t (Max (snd ` ops als) + 1) als\"\n  apply(simp add: ops_vts_pop_def getTs_def getOp_def)\n  apply (intro conjI)\n    apply(unfold ops_wfs_def ops_init_def)[1]\n  apply simp\n    apply (simp add: add.commute add_strict_increasing)\n    apply(unfold ops_wfs_def ops_init_def)[1]\n  apply (simp add: getOp_def getTs_def)\n  apply (metis (mono_tags, hide_lams) Max_ge add_le_same_cancel1 finite_imageI  not_one_le_zero)\n  apply(intro conjI allI impI disjI2)\n  apply(unfold ops_wfs_def ops_init_def)[1]\n  apply (simp add: getOp_def getTs_def ops_init_matched_pairs_def)\n  apply(elim conjE, simp)\n  apply(subgoal_tac \"(aa, ba)\\<in> ops als\") defer\n  apply (metis (mono_tags, hide_lams) fst_conv imageI snd_eqD subset_iff subset_refl)\n  by (metis Max_ge add.commute add_strict_increasing finite_imageI image_iff snd_eqD zero_less_one)\n\nlemma lastUnmatchedPush_max: \"ops_wfs als acs \\<Longrightarrow> ops_unmatched_push als \\<noteq> {} \\<Longrightarrow> lastUnmatchedPush (Max (snd ` ops als) + 1)\n        (PUSH, Max (snd ` ops_unmatched_push als)) als\"\n  apply(simp add: lastUnmatchedPush_def ops_umatched_upto_ts_def)\n  apply(intro conjI)\n    apply(intro disjI1)\n    apply(subgoal_tac \"fst` ops_unmatched_push als = {PUSH}\")\n  defer\n     apply(simp add: ops_unmatched_push_def)\n     apply(simp add: ops_on_def ops_mtch_push_def getOp_def) \n  apply blast\n    defer defer\n    apply(subgoal_tac \"finite (ops_unmatched_push als)\")\n  apply (metis Domain.DomainI Domain_fst Max_in RangeE Range_snd empty_is_image finite_imageI  singletonD)\n  apply(unfold ops_wfs_def ops_init_def)[1]\n    apply (simp add: getOp_def getTs_def ops_init_matched_pairs_def)\n  apply(simp add: ops_unmatched_push_def ops_on_def ops_mtch_push_def)\n   apply(simp_all add: getTs_def)\n  apply(subgoal_tac \"ops_unmatched_push als \\<subseteq> ops als\")\n    apply(subgoal_tac \"finite (ops_unmatched_push als)\")\n    apply(subgoal_tac \"finite (ops als)\")\n  apply (smt Max_less_iff empty_is_image finite_imageI image_iff less_add_one subset_empty subset_iff)\n   apply(unfold ops_wfs_def ops_init_def)[1]\n  apply blast\n  apply(unfold ops_wfs_def ops_init_def)[1]\n    apply (simp add: getOp_def getTs_def ops_init_matched_pairs_def)\n    apply(simp add: ops_unmatched_push_def ops_on_def ops_mtch_push_def)\n    apply(simp add: ops_unmatched_push_def ops_on_def ops_mtch_push_def)\n   apply blast\n \n  apply(subgoal_tac \"Max (snd `\n         {opp.\n          (opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als) \\<and> snd opp < Max (snd ` ops als) + 1}) \\<in> snd ` ops_init als \\<union> snd ` ops_unmatched_push als\") \n   defer\n  apply(subgoal_tac \" {opp.\n          (opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als) \\<and> snd opp < Max (snd ` ops als) + 1} \\<noteq> {}\")\n  apply(subgoal_tac \"finite({opp.\n          (opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als) \\<and> snd opp < Max (snd ` ops als) + 1})\")\n  apply (smt Max_in UnI1 UnI2 empty_is_image finite_imageI image_iff mem_Collect_eq)\n    apply(unfold ops_wfs_def ops_init_def)[1]\n  apply(simp add: ops_unmatched_push_def getOp_def ops_on_def)\n     apply(unfold ops_wfs_def ops_init_def)[1]\n  apply(simp add: ops_unmatched_push_def getOp_def ops_on_def ops_mtch_push_def)\n  apply (metis (no_types, lifting)  Max.coboundedI add.commute add_strict_increasing finite_imageI  imageI image_cong snd_eqD surj_pair zero_less_one)\n  apply(case_tac \"Max (snd `\n         {opp.\n          (opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als) \\<and> snd opp < Max (snd ` ops als) + 1})\n    \\<in> snd ` ops_init als\")\n   apply(subgoal_tac \"\\<exists> op . op\\<in>ops_unmatched_push als\")\n    apply (elim exE)\n  apply(subgoal_tac \"op\\<in>{opp.\n                (opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als) \\<and>\n                snd opp < Max (snd ` ops als) + 1}\")\n     apply(subgoal_tac \"getOp op = PUSH\")\n  defer\n  apply(simp add: getOp_def ops_unmatched_push_def ops_on_def)\n  apply(simp add: getOp_def ops_unmatched_push_def ops_on_def ops_mtch_push_def)\n     apply(unfold ops_wfs_def ops_init_def)[1]\n     apply(simp add: ops_unmatched_push_def getOp_def ops_on_def ops_mtch_push_def)\n  apply (metis (no_types, lifting) Max_ge add.commute add_strict_increasing finite_imageI imageI old.prod.exhaust snd_conv zero_less_one)\n  apply blast\n   defer\n   apply simp\n  apply(subgoal_tac \"op\\<in>{opp.\n                (opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als) \\<and>\n                snd opp < Max (snd ` ops als) + 1}\")\n    apply(subgoal_tac \"\\<forall> ts . ts \\<in> snd ` ops_init als \\<longrightarrow> getTs op > ts\")\n     defer\n     apply(intro allI impI)\n  apply(simp add: getTs_def)\n     apply(unfold ops_wfs_def ops_init_def)[1]\n     apply(simp add: getTs_def getOp_def)\n  apply(elim conjE exE)\n     apply(simp add: ops_unmatched_push_def getOp_def ops_on_def ops_mtch_push_def)\n  apply (smt OP.distinct(1) imageE mem_Collect_eq prod.collapse)\n  apply blast\n   defer\n   apply(subgoal_tac \"\\<forall> opp . opp\\<in>ops_init als \\<longrightarrow> getTs opp < getTs op\")\n  defer\n  using getTs_def apply blast\n  defer   \n  apply(subgoal_tac \"\\<forall> oppp opinit. oppp\\<in>{opp.\n                (opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als) \\<and>\n                snd opp < Max (snd ` ops als) + 1} \\<and> opinit\\<in>ops_init als \\<longrightarrow> getTs oppp \\<le> getTs opinit\")\n    apply (simp add: leD)\n   apply(intro allI impI)\n   apply(simp add: ops_init_def)\n  apply(subgoal_tac \"finite({opp.\n             (opp \\<in> ops_unmatched_push als \\<or> getOp opp = INIT \\<and> opp \\<in> ops als) \\<and>\n             snd opp < Max (snd ` ops als) + 1})\")\n  apply(subgoal_tac \"{opp.\n             (opp \\<in> ops_unmatched_push als \\<or> getOp opp = INIT \\<and> opp \\<in> ops als) \\<and>\n             snd opp < Max (snd ` ops als) + 1} \\<noteq> {}\")\n    apply (metis (mono_tags, lifting) Max_less_iff finite_imageI getTs_def imageI image_is_empty infinite_growing mem_Collect_eq)\n    apply blast\n     apply(unfold ops_wfs_def ops_init_def)[1]\n   apply(simp add: getTs_def getOp_def)\n\n apply(simp add: getTs_def ops_unmatched_push_def getOp_def ops_on_def ops_mtch_push_def)\n  apply simp\n  apply(subgoal_tac \"ops_unmatched_push als \\<subseteq> ops als\") defer\n apply(simp add: getTs_def ops_unmatched_push_def getOp_def ops_on_def ops_mtch_push_def)\n  apply blast\n  apply(subgoal_tac \"ops_init als \\<subseteq> ops als\") defer\n apply(simp add: ops_init_def  getTs_def ops_unmatched_push_def getOp_def ops_on_def ops_mtch_push_def)\n   apply blast\n  apply(subgoal_tac \"{opp. (opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als) \\<and> snd opp < Max (snd ` ops als) + 1} = {opp. (opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als)}\")\n   defer\n   apply(subgoal_tac \" Max (snd ` ops als) + 1 >  Max (snd ` ops als)\") \n  apply(subgoal_tac \"\\<forall> opp . opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als \\<longrightarrow> getTs opp < Max (snd ` ops als) + 1\")\n     apply (metis getTs_def)\n    apply(intro allI impI)\n    apply(simp add: getTs_def)\n    apply(elim disjE)\n  apply(subgoal_tac \"\\<forall> opp . opp \\<in> ops_unmatched_push als \\<longrightarrow> getTs opp \\<le> Max (snd ` ops als) \")\napply (metis add.commute getTs_def le_less_trans less_add_one)\n     apply(intro allI impI)\n  apply(unfold ops_wfs_def)[1]\n  apply simp\n  apply (metis Max.coboundedI finite_imageI getTs_def imageI subset_iff)\n  apply(unfold ops_wfs_def)[1]\n  apply simp\n  apply (metis (no_types, lifting) Max.coboundedI add.commute add_strict_increasing finite_imageI getOp_def imageI mem_Collect_eq old.prod.exhaust old.prod.inject ops_init_def prod.collapse snd_conv  zero_less_one)\n  apply linarith\n  apply simp\n  apply(subgoal_tac \"finite(snd ` {opp. opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als})\")\n  apply(subgoal_tac \"finite(snd ` ops_unmatched_push als)\")\n  apply (smt Max.coboundedI Max_eq_if image_iff mem_Collect_eq)\n apply(simp add: ops_init_def  getTs_def ops_unmatched_push_def getOp_def ops_on_def ops_mtch_push_def)\n   apply(unfold ops_wfs_def)[1]\n  apply simp\n apply(simp add: ops_init_def  getTs_def ops_unmatched_push_def getOp_def ops_on_def ops_mtch_push_def)\n   apply(unfold ops_wfs_def)[1]\n  apply simp\n  done\n\nlemma lastUnmatchedPush_lastPush: \"ops_wfs als acs \\<Longrightarrow> op = lastPush als \\<Longrightarrow> op \\<in> ops als \\<Longrightarrow> op \\<notin> fst ` ops_matched als  \\<Longrightarrow> lastUnmatchedPush (Max (snd ` ops als) + 1) op als\"\n  apply(simp add:lastUnmatchedPush_def)\n  apply safe\n   apply(simp add: ops_umatched_upto_ts_def lastPush_def ops_unmatched_push_def)\n   apply safe\n     apply (simp add: getOp_def ops_on_def)\n  using ops_mtch_push_def apply auto[1]\n   apply (simp add: getOp_def ops_on_def ops_mtch_push_def getTs_def)\n  apply(subgoal_tac \"{opp. fst opp = PUSH \\<and> opp \\<in> ops als} -\n          {opp. fst opp = PUSH \\<and> opp \\<in> fst ` ops_matched als} \\<subseteq> ops als\")\n  apply(subgoal_tac \" Max (snd `\n         ({opp. fst opp = PUSH \\<and> opp \\<in> ops als} -\n          {opp. fst opp = PUSH \\<and> opp \\<in> fst ` ops_matched als}))\n    \\<le> Max (snd ` ops als)\")\n  apply linarith\n    defer\n    apply blast defer\n   apply(unfold ops_wfs_def getOp_def, simp)[1]\n  apply(subgoal_tac \"{opp. fst opp = PUSH \\<and> opp \\<in> ops als} -\n          {opp. fst opp = PUSH \\<and> opp \\<in> fst ` ops_matched als} \\<noteq> {}\")  \n  apply (meson Max_mono finite_imageI image_is_empty image_mono)\n  apply (metis (mono_tags, lifting) Collect_mono_iff Diff_eq_empty_iff fst_conv image_is_empty)\n  apply(simp add: ops_umatched_upto_ts_def lastPush_def getTs_def)\n  apply(subgoal_tac \"{opp.\n          (opp \\<in> ops_unmatched_push als \\<or> opp \\<in> ops_init als) \\<and>\n          snd opp < Max (snd ` ops als) + 1} = ops_unmatched_push als \\<union> ops_init als\")\n   defer\n  apply(simp add: ops_unmatched_push_def ops_mtch_push_def ops_init_def ops_on_def getOp_def)\n   apply safe\n     apply blast\n    apply clarsimp\n    defer\n  apply(subgoal_tac \"snd (a, b) \\<le> Max (snd ` ops als)\")\n  apply linarith\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def, simp)[1]\n  apply (simp add: rev_image_eqI)\n   apply simp\n   defer\n  apply(subgoal_tac \"b \\<le> Max (snd ` ops als)\")\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def, simp)[1]\n   apply(case_tac \"b \\<in> snd ` ops als\")\n  apply(subgoal_tac \"finite(snd ` ops als)\")\n  using Max_ge apply blast\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def, simp)[1]\n   apply (simp add: rev_image_eqI)\n  apply(subgoal_tac \"Max (snd ` (ops_unmatched_push als \\<union> ops_init als)) = Max (snd ` (ops_unmatched_push als))\")\n   apply linarith\n  apply(subgoal_tac \"Max (snd ` (ops_unmatched_push als \\<union> ops_init als)) = Max (snd ` (ops_unmatched_push als)) \\<or> Max (snd ` (ops_unmatched_push als \\<union> ops_init als)) = Max (snd ` ( ops_init als))\")\n   apply(subgoal_tac \"\\<forall> op1 op2. op1\\<in>snd `(ops_unmatched_push als) \\<and> op2\\<in>snd `(ops_init als) \\<longrightarrow> op1 > op2\")\n    apply(subgoal_tac \"finite(ops_init als)\")\n     apply(subgoal_tac \"finite(ops_unmatched_push als)\")\n      apply(subgoal_tac \"ops_init als \\<noteq> {} \\<and> ops_unmatched_push als \\<noteq> {}\")\n  apply(elim conjE)\n       apply (smt Max_in Un_empty Un_iff finite_UnI finite_imageI image_Un image_is_empty member_less_max not_max)\n  apply(intro conjI)\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def, simp)[1]\n   apply auto[1]\n       apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def ops_unmatched_push_def ops_on_def ops_mtch_push_def, simp)[1]\n  apply (simp add: Collect_mono_iff)\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def ops_unmatched_push_def ops_on_def ops_mtch_push_def, simp)[1]\n  apply (simp add: Collect_mono_iff)\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def ops_init_def ops_unmatched_push_def ops_on_def ops_mtch_push_def, simp)[1]\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def ops_init_def ops_unmatched_push_def ops_on_def ops_mtch_push_def, simp)[1]\n  apply(intro allI impI conjI)\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def ops_init_def ops_unmatched_push_def ops_on_def ops_mtch_push_def, simp)[1]\n  apply (smt OP.distinct(1) image_iff mem_Collect_eq prod.collapse set_diff_eq)\n   apply(intro disjI1)\n    apply(subgoal_tac \"finite(ops_init als)\")\n   apply(subgoal_tac \"finite(ops_unmatched_push als)\")\n  apply(subgoal_tac \"ops_unmatched_push als \\<noteq> {}\")\n   apply(subgoal_tac \"\\<forall> op1 op2. op1\\<in>snd `(ops_unmatched_push als) \\<and> op2\\<in>snd `(ops_init als) \\<longrightarrow> op1 > op2\")\n  apply (smt Max_in Un_empty Un_iff finite_UnI finite_imageI image_Un image_is_empty member_less_max not_max)\n     apply(intro allI impI)\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def ops_init_def ops_unmatched_push_def ops_on_def ops_mtch_push_def, simp)[1]\n  apply (smt OP.distinct(1) image_iff mem_Collect_eq prod.collapse set_diff_eq)\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def ops_init_def ops_unmatched_push_def ops_on_def ops_mtch_push_def, simp)[1] \n  apply (metis (mono_tags, lifting) Collect_mono_iff fst_conv)\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def ops_init_def ops_unmatched_push_def ops_on_def ops_mtch_push_def, simp)[1]\n    apply(unfold ops_wfs_def getOp_def ops_init_def getTs_def ops_init_def ops_unmatched_push_def ops_on_def ops_mtch_push_def, simp)[1]\n  done\n\n\n\ndefinition \"cli_lib_mView cls w \\<equiv>   ((lib_modView cls) w) Lib.CVARS\"\ndefinition \"cli_stack_mView als op \\<equiv>   ((ops_modView_cli als) op)\"\n\n\nlemmas shorthands [simp] = TopL_def  cli_lib_mView_def cli_stack_mView_def\n\n\n(* nxt ps a = lastNxtVal cls a *)\ndefinition \"rr f ps als cls \\<equiv> \n  (\\<forall> a .  a \\<in> pushed_addr ps \\<longrightarrow> \n            (getTs (f a) > getTs (f (lastNxtVal cls a))) \n          \\<and> (\\<forall> op . op \\<in> ops_unmatched_push als \\<and> op \\<noteq> f a \\<and> op \\<noteq> f (lastNxtVal cls a) \\<longrightarrow> \n                        getTs op < getTs (f (lastNxtVal cls a)) \\<or> getTs op > getTs (f a)) \n          \\<and> f a \\<in> ops_unmatched_push als \n          \\<and> lastNxtVal cls a \\<in> pushed_addr ps \\<union> {Null} \n          \\<and> (lastTop cls \\<noteq> Null \\<longrightarrow> \n                (\\<exists> op opl . f a = op \\<and> op\\<in>ops_unmatched_push als \n                          \\<and> f (lastTop cls) = opl \\<and> opl\\<in>ops_unmatched_push als \n                          \\<and> opl = lastPush als))\n          \\<and> op_value (f a) als = lib_value cls (lib_lastWr cls a) \n          \\<and> lastNxtVal cls a \\<noteq> lastTop cls) \n \\<and> (\\<forall>a1 a2. a1 \\<in> pushed_addr ps \\<and> a2 \\<in> pushed_addr ps \\<and> f a1 = f a2 \\<longrightarrow> a1 = a2) \n \\<and> (\\<exists> op . op\\<in>ops_init als \\<and> f Null = op)      \n                \"\n\ndefinition \"rr_cliV f cls als ps \\<equiv>   \n   (\\<forall> ad w l. ad\\<in>pushed_addr ps \\<and> w\\<in>lib_writes_on cls Top \\<and> lib_value cls w = ad \\<longrightarrow>\n              tst ((cli_lib_mView cls w) l) \\<ge> tst ((cli_stack_mView als (f ad)) l))\"\n(*not correct\ndefinition \"rr_cliV_abst f cls als ps \\<equiv> (\\<forall> ad x . ad\\<in>pushed_addr ps \\<longrightarrow> snd (ops_modView_cli als (f (ad)) x) \\<ge> snd (ops_modView_cli als (f (nxt ps ad)) x))\"\n*)\n\ndefinition \"rr_cliV_thView t f ccs cls als ps \\<equiv> \\<forall> ad l . ad\\<in>pushed_addr ps \\<longrightarrow> tst (ops_modView_cli als (f (ad)) l)\n       \\<le> tst (thrView ccs t l)\"\n\ndefinition \"rr_f_pushed_unmatched f cls als ps \\<equiv> ops_unmatched_push als = {f a | a .  a\\<in>pushed_addr ps}\"\n\nlemma max_minus_max: \"finite A \\<Longrightarrow> A \\<noteq> {} \\<Longrightarrow> a\\<in>A \\<Longrightarrow> b\\<in>A \\<Longrightarrow> a > b \\<Longrightarrow> a = Max A\n\\<Longrightarrow> (\\<forall> e . e\\<in>A \\<and> e \\<noteq> Max A \\<longrightarrow> e \\<le> b) \\<Longrightarrow> b = Max (A-{a})\"\n  apply(subgoal_tac \"A-{a} \\<noteq> {}\")\n  defer  \n  apply blast\n    apply(subgoal_tac \"finite (A-{a})\")\n  defer \n   apply simp\n  apply (subgoal_tac \"\\<forall> e . e\\<in>A  \\<longrightarrow> e \\<le> Max A\")\n  defer\n  using Max_ge apply blast\n  apply (subgoal_tac \"a \\<noteq> b\")\n  defer\n   apply blast\n  apply(subgoal_tac \"b\\<in>A-{a}\")\n   defer\n  apply blast\n  by (metis DiffD1 Diff_insert_absorb Max_eqI mk_disjoint_insert)\n\n\nlemma nxt_TopLV_oneBeforeLast: \"ops_wfs als acs \\<Longrightarrow> lib_wfs cls ccs \\<Longrightarrow>\n       lastTop cls \\<noteq> Null \\<Longrightarrow> glb_inv ps cls \\<Longrightarrow>  ops_wfs als acs \\<Longrightarrow> \n        lastNxtVal cls (lastTop cls) \\<noteq> Null \\<Longrightarrow> \n        rr f ps als cls \\<Longrightarrow>\n        f (lastNxtVal cls (lastTop cls)) = oneBeforeLastPush als\"\n  apply(simp add: rr_def oneBeforeLastPush_def glb_inv_def)\n  apply(subgoal_tac \"f (lastTop cls) = lastPush als\")\n  defer\n   apply (metis Null_def  glb_inv3_def order.strict_implies_not_eq)\n  apply(subgoal_tac \"f (lastNxtVal cls (lib_value cls (lib_lastWr cls Top))) \\<in> ops_unmatched_push als\")\n  apply(subgoal_tac \"snd (f (lastNxtVal cls (lib_value cls (lib_lastWr cls Top)))) = Max (snd ` (ops_unmatched_push als - {lastPush als}))\")\n  apply(subgoal_tac \"fst (f (lastNxtVal cls (lib_value cls (lib_lastWr cls Top)))) = PUSH\")\n   apply simp\n    apply (metis lastTop_def   lastVal_def  prod.collapse)\n  apply(subgoal_tac \"(lastNxtVal cls (lib_value cls (lib_lastWr cls Top)))\\<in>pushed_addr ps\")\n    apply(simp add: glb_inv1_def glb_inv2_def glb_inv3_def glb_inv4_def glb_inv5_def)\n  apply(simp add: getTs_def getOp_def, elim conjE exE)\n  apply(simp add: ops_unmatched_push_def ops_on_def getOp_def ops_init_def getTs_def ops_mtch_push_def)\n  apply (metis Null_def Suc_eq_plus1 glb_inv3_def gr_implies_not_zero lastNxtVal_def lastTop_def lastVal_def)\n    using Null_def glb_inv3_def not_less_zero\n    defer  \n    apply (metis Suc_eq_plus1 lastNxtVal_def lastTop_def lastVal_def)\n  apply(subgoal_tac \"Max (snd`(ops_unmatched_push als)) = snd (lastPush als)\") defer\n   apply (simp add: lastPush_def)\n  apply(subgoal_tac \"(snd ` (ops_unmatched_push als - {lastPush als})) = (snd ` (ops_unmatched_push als)) - {snd (lastPush als)}\")\n   defer\n   apply (simp add: lastPush_def getTs_def getOp_def ops_unmatched_push_def)\n  apply safe\n     apply blast\n      apply blast\n  apply(simp add: ops_on_def)\n  apply (simp add: getOp_def)\n  apply (metis snd_conv)\n  apply simp\n  apply (metis DiffI Diff_insert image_eqI insert_iff snd_conv)\n  apply simp\n  apply(subgoal_tac \"snd (f (lastTop cls)) > snd (f (lastNxtVal cls (lib_value cls (lib_lastWr cls Top))))\")\n     defer  \n    apply (metis Nat.add_0_right Null_def One_nat_def add_Suc_right getTs_def glb_inv3_def gr_implies_not0 lastNxtVal_def lastTop_def lastVal_def)\n  apply(subgoal_tac \"snd (f (lastTop cls))\\<in> snd ` ops_unmatched_push als\")\n  defer\n  apply (metis Null_def  equals0I glb_inv3_def imageI  less_numeral_extra(3))\n  apply(subgoal_tac \"snd (f (lastNxtVal cls (lib_value cls (lib_lastWr cls Top)))) \\<in> snd ` ops_unmatched_push als\")\n   apply(subgoal_tac \"lastNxtVal cls (lib_value cls (lib_lastWr cls Top)) \\<in> pushed_addr ps\")\n  apply simp\n      defer  \n    apply (metis Nat.add_0_right Null_def One_nat_def add_Suc_right glb_inv3_def gr_implies_not0 lastNxtVal_def lastTop_def lastVal_def)\n  apply simp\n     apply(subgoal_tac \"(\\<forall> e . e\\<in>(snd ` ops_unmatched_push als) \\<and> e \\<noteq> Max (snd ` ops_unmatched_push als) \\<longrightarrow> e \\<le> snd (f (lastNxtVal cls (lib_value cls (lib_lastWr cls Top)))))\")\n   defer\n   apply(intro allI impI)\n  apply(case_tac \" e = snd (f (lastNxtVal cls (lib_value cls (lib_lastWr cls Top))))\")\n    apply linarith\n   apply simp\n  apply(subgoal_tac \"\\<forall> a b. a\\<in>pushed_addr ps \\<and>\n                b \\<in> snd`(ops_unmatched_push als) \\<and>  b \\<noteq> snd (f a) \\<and>  b \\<noteq> snd(f (lastNxtVal cls a)) \\<longrightarrow>\n                b < snd (f (lastNxtVal cls a)) \\<or> snd (f a) < b\") defer\n    apply(simp add: getTs_def)\n    apply(intro allI impI conjI)\n    apply(erule_tac x = aa in allE, simp, elim conjE)\n    apply(erule_tac x = PUSH in allE)\n    apply(erule_tac x = ba in allE)\n  apply(subgoal_tac \"(PUSH, ba) \\<in> ops_unmatched_push als \\<and>\n       (PUSH, ba) \\<noteq> f aa \\<and> (PUSH, ba) \\<noteq> f (lastNxtVal cls aa)\")\n    apply simp\n    apply(intro conjI)\n  apply(simp add: ops_on_def getOp_def ops_unmatched_push_def)\n  apply force \n       apply (metis sndI)\n    apply simp\n    apply (metis sndI) defer\n  apply(elim conjE)\n  apply(erule_tac x = \"lastTop cls\" in allE)\n   apply(erule_tac x = \"lastTop cls\" in allE)\n  apply(erule_tac x = \"lastTop cls\" in allE)\n  apply(erule_tac x = \"e\" in allE)\n   apply simp\n  apply(subgoal_tac \"lib_value cls (lib_lastWr cls Top) \\<in> pushed_addr ps \\<and>\n       e \\<in> snd ` ops_on PUSH als\", simp)\n    apply(subgoal_tac \"snd (lastPush als) > e\", simp)\n    apply(subgoal_tac \"Max ( snd ` (ops_unmatched_push als)) = snd (lastPush als)\", simp)\n        apply(subgoal_tac \"finite(snd ` ops_unmatched_push als)\")\n    apply simp\n    apply (simp add: lastTop_def)\n  apply(unfold ops_wfs_def ops_mtch_push_def getOp_def getTs_def ops_on_def ops_unmatched_push_def lastPush_def ops_init_def)[1]\n  apply (metis (no_types, lifting) Collect_mem_eq Collect_mono_iff Diff_eq_empty_iff finite.emptyI finite_Diff finite_Diff2 finite_imageI  set_diff_eq)\n       apply blast\n  apply(subgoal_tac \"finite(snd ` ops_unmatched_push als)\")\n       apply(subgoal_tac \"(snd ` ops_unmatched_push als) \\<noteq> {}\")\n        apply (metis member_less_max)\n       apply blast\n  apply(unfold ops_wfs_def ops_mtch_push_def getOp_def getTs_def ops_on_def ops_unmatched_push_def lastPush_def ops_init_def)[1]\n  apply (metis (no_types, lifting) Collect_mem_eq Collect_mono_iff Diff_eq_empty_iff finite.emptyI finite_Diff finite_Diff2 finite_imageI set_diff_eq)\n     apply simp\n    apply(intro conjI)\n    apply (simp add: bot_nat_def glb_inv3_def lastTop_def)\n    apply (metis (no_types, lifting) DiffD1 image_iff ops_unmatched_push_def)\n    apply clarsimp\n  apply(subgoal_tac \"finite(snd ` ops_unmatched_push als)\")\n  apply(subgoal_tac \"(snd ` ops_unmatched_push als) \\<noteq> {}\")\n    apply (simp add: max_minus_max)    \n    apply blast\n  apply(unfold ops_wfs_def ops_mtch_push_def getOp_def getTs_def ops_on_def ops_unmatched_push_def lastPush_def ops_init_def)[1]\n  apply (metis (no_types, lifting) Collect_mem_eq Collect_mono_iff Diff_eq_empty_iff finite.emptyI finite_Diff finite_Diff2 finite_imageI set_diff_eq)\n done\n\nend\n", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Treiber Stack C11/TS_Refinement_Proof_Rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6791787121629466, "lm_q2_score": 0.4921881357207955, "lm_q1q2_score": 0.33428370416073144}}
{"text": "           (*-------------------------------------------*\n            |                   Test                    |\n            |        CSP-Prover on Isabelle2005         |\n            |                  April 2006               |\n            |                                           |\n            |        CSP-Prover on Isabelle2009         |\n            |                   June 2009  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory Test_proof\nimports CSP_F_Main\nbegin\n\n(*****************************************************************\n\n   \"(a -> P) |[{a}]| (a -> Q) =F a -> (P |[{a}]| Q)\" is proven\n   by the following three strategies:\n\n         1. semantical proof\n         2. algebraic proof\n         3. tactic proof\n         4. \n\n *****************************************************************)\n\n(*---------------------------------------------------------------*\n    semantical proof by the difinition of traces and failures \n *---------------------------------------------------------------*)\n\nlemma semantical_proof: \n  \"(a -> P) |[{a}]| (a -> Q) =F a -> (P |[{a}]| Q)\"\napply (simp add: cspF_eqF_semantics)\napply (rule)\n\n(* trace *)\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)     (* subdomTI is automatically applied *)\n apply (simp add: in_traces)\n apply (auto simp add: par_tr_nil par_tr_head_Ev_Ev)\n\n (* => *)\n apply (auto simp add: in_traces)\n apply (simp add: par_tr_head)\n apply (rule_tac x=\"<Ev a> ^^^ sa\" in exI)\n apply (rule_tac x=\"<Ev a> ^^^ ta\" in exI)\n apply (auto)\n\n(* failures *)\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all add: par_tr_nil par_tr_head_Ev_Ev)\n apply (force)\n apply (force)\n apply (force)\n\n (* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (rule_tac x=\"X - {(Ev a)}\" in exI)\n apply (rule_tac x=\"X - {(Ev a)}\" in exI)\n apply (simp)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Z\" in exI)\n apply (simp)\n apply (simp add: par_tr_head)\n apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n apply (rule_tac x=\"<Ev a> ^^^ t\" in exI)\n apply (auto)\ndone\n\n(*---------------------------------------------------------------*\n          manual syntactical proof by algebraic CSP laws\n *---------------------------------------------------------------*)\n\nlemma syntactical_proof: \n  \"(a -> P) |[{a}]| (a -> Q) =F a -> (P |[{a}]| Q)\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_step)\napply (rule cspF_step)\n\napply (rule cspF_rw_left)\napply (rule cspF_step)\n\napply (rule cspF_rw_right)\napply (rule cspF_step)\n\napply (rule cspF_decompo)\napply (simp)\napply (simp)\ndone\n\n(*---------------------------------------------------------------*\n            semi-automatic syntactical proof by tactics\n *---------------------------------------------------------------*)\n\nlemma tactical_proof: \n  \"(a -> P) |[{a}]| (a -> Q) =F a -> (P |[{a}]| Q)\"\napply (cspF_auto)+\napply (auto)\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/Test/Test_proof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.3342836977684117}}
{"text": "(*  Title:      JinjaDCI/Compiler/Correctness2.thy\n    Author:     Tobias Nipkow, Susannah Mansky\n    Copyright   TUM 2003, UIUC 2019-20\n\n    Based on the Jinja theory Compiler/Correctness2.thy by Tobias Nipkow\n*)\n\nsection \\<open> Correctness of Stage 2 \\<close>\n\ntheory Correctness2\nimports \"HOL-Library.Sublist\" Compiler2 J1WellForm \"../J/EConform\"\nbegin\n\n(*<*)hide_const (open) Throw(*>*)\n\nsubsection\\<open> Instruction sequences \\<close>\n\ntext\\<open> How to select individual instructions and subsequences of\ninstructions from a program given the class, method and program\ncounter. \\<close>\n\ndefinition before :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> nat \\<Rightarrow> instr list \\<Rightarrow> bool\"\n   (\"(_,_,_,_/ \\<rhd> _)\" [51,0,0,0,51] 50) where\n \"P,C,M,pc \\<rhd> is \\<longleftrightarrow> prefix is (drop pc (instrs_of P C M))\"\n\ndefinition at :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> nat \\<Rightarrow> instr \\<Rightarrow> bool\"\n   (\"(_,_,_,_/ \\<triangleright> _)\" [51,0,0,0,51] 50) where\n \"P,C,M,pc \\<triangleright> i \\<longleftrightarrow> (\\<exists>is. drop pc (instrs_of P C M) = i#is)\"\n\n\n\n\nlemma [simp]: \"P,C,M,pc \\<rhd> (i#is) = (P,C,M,pc \\<triangleright> i \\<and> P,C,M,pc + 1 \\<rhd> is)\"\n(*<*)by(fastforce simp add:before_def at_def prefix_def drop_Suc drop_tl)(*>*)\n\n(*<*)\ndeclare drop_drop[simp del]\n(*>*)\n\n\nlemma [simp]: \"P,C,M,pc \\<rhd> (is\\<^sub>1 @ is\\<^sub>2) = (P,C,M,pc \\<rhd> is\\<^sub>1 \\<and> P,C,M,pc + size is\\<^sub>1 \\<rhd> is\\<^sub>2)\"\n(*<*)\nby(subst add.commute)\n  (fastforce simp add:before_def prefix_def drop_drop[symmetric])\n(*>*)\n\n(*<*)\ndeclare drop_drop[simp]\n(*>*)\n\n\nlemma [simp]: \"P,C,M,pc \\<triangleright> i \\<Longrightarrow> instrs_of P C M ! pc = i\"\n(*<*)by(clarsimp simp add:at_def strict_prefix_def nth_via_drop)(*>*)\n\nlemma beforeM:\n  \"P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = body in D \\<Longrightarrow>\n  compP\\<^sub>2 P,D,M,0 \\<rhd> compE\\<^sub>2 body @ [Return]\"\n(*<*)by(drule sees_method_idemp) (simp add:before_def compMb\\<^sub>2_def)(*>*)\n\ntext\\<open> This lemma executes a single instruction by rewriting: \\<close>\n\nlemma [simp]:\n  \"P,C,M,pc \\<triangleright> instr \\<Longrightarrow>\n  (P \\<turnstile> (None, h, (vs,ls,C,M,pc,ics) # frs, sh) -jvm\\<rightarrow> \\<sigma>') =\n  ((None, h, (vs,ls,C,M,pc,ics) # frs, sh) = \\<sigma>' \\<or>\n   (\\<exists>\\<sigma>. exec(P,(None, h, (vs,ls,C,M,pc,ics) # frs, sh)) = Some \\<sigma> \\<and> P \\<turnstile> \\<sigma> -jvm\\<rightarrow> \\<sigma>'))\"\n(*<*)\nby(simp only: exec_all_def)\n  (blast intro: converse_rtranclE converse_rtrancl_into_rtrancl)\n(*>*)\n\n\nsubsection\\<open> Exception tables \\<close>\n\ndefinition pcs :: \"ex_table \\<Rightarrow> nat set\"\nwhere\n  \"pcs xt  \\<equiv>  \\<Union>(f,t,C,h,d) \\<in> set xt. {f ..< t}\"\n\nlemma pcs_subset:\nshows \"(\\<And>pc d. pcs(compxE\\<^sub>2 e pc d) \\<subseteq> {pc..<pc+size(compE\\<^sub>2 e)})\"\nand \"(\\<And>pc d. pcs(compxEs\\<^sub>2 es pc d) \\<subseteq> {pc..<pc+size(compEs\\<^sub>2 es)})\"\n(*<*)\nproof(induct e and es rule: compxE\\<^sub>2.induct compxEs\\<^sub>2.induct)\n  case Cast then show ?case by (fastforce simp:pcs_def)\nnext\n  case BinOp then show ?case by (fastforce simp:pcs_def split:bop.splits)\nnext\n  case LAss then show ?case by (fastforce simp: pcs_def)\nnext\n  case FAcc then show ?case by (fastforce simp: pcs_def)\nnext\n  case FAss then show ?case by (fastforce simp: pcs_def)\nnext\n  case SFAss then show ?case by (fastforce simp: pcs_def)\nnext\n  case Call then show ?case by (fastforce simp: pcs_def)\nnext\n  case SCall then show ?case by (fastforce simp: pcs_def)\nnext\n  case Seq then show ?case by (fastforce simp: pcs_def)\nnext\n  case Cond then show ?case by (fastforce simp: pcs_def)\nnext\n  case While then show ?case by (fastforce simp: pcs_def)\nnext\n  case throw then show ?case by (fastforce simp: pcs_def)\nnext\n  case TryCatch then show ?case by (fastforce simp: pcs_def)\nnext\n  case Cons_exp then show ?case by (fastforce simp: pcs_def)\nqed (simp_all add:pcs_def)\n(*>*)\n\n\nlemma [simp]: \"pcs [] = {}\"\n(*<*)by(simp add:pcs_def)(*>*)\n\n\nlemma [simp]: \"pcs (x#xt) = {fst x ..< fst(snd x)} \\<union> pcs xt\"\n(*<*)by(auto simp add: pcs_def)(*>*)\n\n\nlemma [simp]: \"pcs(xt\\<^sub>1 @ xt\\<^sub>2) = pcs xt\\<^sub>1 \\<union> pcs xt\\<^sub>2\"\n(*<*)by(simp add:pcs_def)(*>*)\n\n\nlemma [simp]: \"pc < pc\\<^sub>0 \\<or> pc\\<^sub>0+size(compE\\<^sub>2 e) \\<le> pc \\<Longrightarrow> pc \\<notin> pcs(compxE\\<^sub>2 e pc\\<^sub>0 d)\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]: \"pc < pc\\<^sub>0 \\<or> pc\\<^sub>0+size(compEs\\<^sub>2 es) \\<le> pc \\<Longrightarrow> pc \\<notin> pcs(compxEs\\<^sub>2 es pc\\<^sub>0 d)\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]: \"pc\\<^sub>1 + size(compE\\<^sub>2 e\\<^sub>1) \\<le> pc\\<^sub>2 \\<Longrightarrow> pcs(compxE\\<^sub>2 e\\<^sub>1 pc\\<^sub>1 d\\<^sub>1) \\<inter> pcs(compxE\\<^sub>2 e\\<^sub>2 pc\\<^sub>2 d\\<^sub>2) = {}\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]: \"pc\\<^sub>1 + size(compE\\<^sub>2 e) \\<le> pc\\<^sub>2 \\<Longrightarrow> pcs(compxE\\<^sub>2 e pc\\<^sub>1 d\\<^sub>1) \\<inter> pcs(compxEs\\<^sub>2 es pc\\<^sub>2 d\\<^sub>2) = {}\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]:\n \"pc \\<notin> pcs xt\\<^sub>0 \\<Longrightarrow> match_ex_table P C pc (xt\\<^sub>0 @ xt\\<^sub>1) = match_ex_table P C pc xt\\<^sub>1\"\n(*<*)by (induct xt\\<^sub>0) (auto simp: matches_ex_entry_def)(*>*)\n\n\nlemma [simp]: \"\\<lbrakk> x \\<in> set xt; pc \\<notin> pcs xt \\<rbrakk> \\<Longrightarrow> \\<not> matches_ex_entry P D pc x\"\n(*<*)by(auto simp:matches_ex_entry_def pcs_def)(*>*)\n\n\nlemma [simp]:\nassumes xe: \"xe \\<in> set(compxE\\<^sub>2 e pc d)\" and outside: \"pc' < pc \\<or> pc+size(compE\\<^sub>2 e) \\<le> pc'\"\nshows \"\\<not> matches_ex_entry P C pc' xe\"\n(*<*)\nproof\n  assume \"matches_ex_entry P C pc' xe\"\n  with xe have \"pc' \\<in> pcs(compxE\\<^sub>2 e pc d)\"\n    by(force simp add:matches_ex_entry_def pcs_def)\n  with outside show False by simp\nqed\n(*>*)\n\n\nlemma [simp]:\nassumes xe: \"xe \\<in> set(compxEs\\<^sub>2 es pc d)\" and outside: \"pc' < pc \\<or> pc+size(compEs\\<^sub>2 es) \\<le> pc'\"\nshows \"\\<not> matches_ex_entry P C pc' xe\"\n(*<*)\nproof\n  assume \"matches_ex_entry P C pc' xe\"\n  with xe have \"pc' \\<in> pcs(compxEs\\<^sub>2 es pc d)\"\n    by(force simp add:matches_ex_entry_def pcs_def)\n  with outside show False by simp\nqed\n(*>*)\n\n\nlemma match_ex_table_app[simp]:\n  \"\\<forall>xte \\<in> set xt\\<^sub>1. \\<not> matches_ex_entry P D pc xte \\<Longrightarrow>\n  match_ex_table P D pc (xt\\<^sub>1 @ xt) = match_ex_table P D pc xt\"\n(*<*)by(induct xt\\<^sub>1) simp_all(*>*)\n\n\nlemma [simp]:\n  \"\\<forall>x \\<in> set xtab. \\<not> matches_ex_entry P C pc x \\<Longrightarrow>\n  match_ex_table P C pc xtab = None\"\n(*<*)using match_ex_table_app[where ?xt = \"[]\"] by fastforce(*>*)\n\n\nlemma match_ex_entry:\n  \"matches_ex_entry P C pc (start, end, catch_type, handler) =\n  (start \\<le> pc \\<and> pc < end \\<and>  P \\<turnstile> C \\<preceq>\\<^sup>* catch_type)\"\n(*<*)by(simp add:matches_ex_entry_def)(*>*)\n\n\ndefinition caught :: \"jvm_prog \\<Rightarrow> pc \\<Rightarrow> heap \\<Rightarrow> addr \\<Rightarrow> ex_table \\<Rightarrow> bool\" where\n  \"caught P pc h a xt \\<longleftrightarrow>\n  (\\<exists>entry \\<in> set xt. matches_ex_entry P (cname_of h a) pc entry)\"\n\ndefinition beforex :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> ex_table \\<Rightarrow> nat set \\<Rightarrow> nat \\<Rightarrow> bool\"\n              (\"(2_,/_,/_ \\<rhd>/ _ /'/ _,/_)\" [51,0,0,0,0,51] 50) where\n  \"P,C,M \\<rhd> xt / I,d \\<longleftrightarrow>\n  (\\<exists>xt\\<^sub>0 xt\\<^sub>1. ex_table_of P C M = xt\\<^sub>0 @ xt @ xt\\<^sub>1 \\<and> pcs xt\\<^sub>0 \\<inter> I = {} \\<and> pcs xt \\<subseteq> I \\<and>\n    (\\<forall>pc \\<in> I. \\<forall>C pc' d'. match_ex_table P C pc xt\\<^sub>1 = \\<lfloor>(pc',d')\\<rfloor> \\<longrightarrow> d' \\<le> d))\"\n\ndefinition dummyx :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> ex_table \\<Rightarrow> nat set \\<Rightarrow> nat \\<Rightarrow> bool\"  (\"(2_,_,_ \\<triangleright>/ _ '/_,_)\" [51,0,0,0,0,51] 50) where\n  \"P,C,M \\<triangleright> xt/I,d \\<longleftrightarrow> P,C,M \\<rhd> xt/I,d\"\n\nabbreviation\n\"beforex\\<^sub>0 P C M d I xt xt\\<^sub>0 xt\\<^sub>1\n  \\<equiv> ex_table_of P C M = xt\\<^sub>0 @ xt @ xt\\<^sub>1 \\<and> pcs xt\\<^sub>0 \\<inter> I = {}\n      \\<and> pcs xt \\<subseteq> I \\<and> (\\<forall>pc \\<in> I. \\<forall>C pc' d'. match_ex_table P C pc xt\\<^sub>1 = \\<lfloor>(pc',d')\\<rfloor> \\<longrightarrow> d' \\<le> d)\"\n\nlemma beforex_beforex\\<^sub>0_eq:\n \"P,C,M \\<rhd> xt / I,d \\<equiv> \\<exists>xt\\<^sub>0 xt\\<^sub>1. beforex\\<^sub>0 P C M d I xt xt\\<^sub>0 xt\\<^sub>1\"\nusing beforex_def by auto\n\nlemma beforexD1: \"P,C,M \\<rhd> xt / I,d \\<Longrightarrow> pcs xt \\<subseteq> I\"\n(*<*)by(auto simp add:beforex_def)(*>*)\n\n\nlemma beforex_mono: \"\\<lbrakk> P,C,M \\<rhd> xt/I,d'; d' \\<le> d \\<rbrakk> \\<Longrightarrow> P,C,M \\<rhd> xt/I,d\"\n(*<*)by(fastforce simp:beforex_def)(*>*)\n\n\nlemma [simp]: \"P,C,M \\<rhd> xt/I,d \\<Longrightarrow> P,C,M \\<rhd> xt/I,Suc d\"\n(*<*)by(fastforce intro:beforex_mono)(*>*)\n\n\nlemma beforex_append[simp]:\n  \"pcs xt\\<^sub>1 \\<inter> pcs xt\\<^sub>2 = {} \\<Longrightarrow>\n  P,C,M \\<rhd> xt\\<^sub>1 @ xt\\<^sub>2/I,d =\n  (P,C,M \\<rhd> xt\\<^sub>1/I-pcs xt\\<^sub>2,d  \\<and>  P,C,M \\<rhd> xt\\<^sub>2/I-pcs xt\\<^sub>1,d \\<and> P,C,M \\<triangleright> xt\\<^sub>1@xt\\<^sub>2/I,d)\"\n(*<*)(is \"?Q \\<Longrightarrow> ?P = (?P1 \\<and> ?P2 \\<and> ?P3)\" is \"?Q \\<Longrightarrow> ?P = ?P123\")\nproof -\n  assume pcs: ?Q\n  show ?thesis proof(rule iffI)\n    assume \"?P123\" then show ?P by(simp add:dummyx_def)\n  next\n    assume hyp: ?P\n    let ?xt = \"xt\\<^sub>1 @ xt\\<^sub>2\"\n    let ?beforex = \"beforex\\<^sub>0 P C M d\"\n    obtain xt\\<^sub>0 xt\\<^sub>1' where beforex: \"?beforex I ?xt xt\\<^sub>0 xt\\<^sub>1'\"\n      using hyp by(clarsimp simp: beforex_def)\n    have \"\\<exists>xt\\<^sub>0 xt\\<^sub>1'. ?beforex (I - pcs xt\\<^sub>2) xt\\<^sub>1 xt\\<^sub>0 xt\\<^sub>1'\" \\<comment> \\<open>?P1\\<close>\n      using pcs beforex by(rule_tac x=xt\\<^sub>0 in exI) auto\n    moreover have \"\\<exists>xt\\<^sub>0 xt\\<^sub>1'. ?beforex (I - pcs xt\\<^sub>1) xt\\<^sub>2 xt\\<^sub>0 xt\\<^sub>1'\"  \\<comment> \\<open>?P2\\<close>\n      using pcs beforex by(rule_tac x=\"xt\\<^sub>0@xt\\<^sub>1\" in exI) auto\n    moreover have ?P3 using hyp by(simp add: dummyx_def)\n    ultimately show ?P123 by (simp add: beforex_def)\n  qed\nqed\n(*>*)\n\n\nlemma beforex_appendD1:\nassumes bx: \"P,C,M \\<rhd> xt\\<^sub>1 @ xt\\<^sub>2 @ [(f,t,D,h,d)] / I,d\"\n  and pcs: \"pcs xt\\<^sub>1 \\<subseteq> J\" and JI: \"J \\<subseteq> I\" and Jpcs: \"J \\<inter> pcs xt\\<^sub>2 = {}\"\nshows \"P,C,M \\<rhd> xt\\<^sub>1 / J,d\"\n(*<*)\nproof -\n  let ?beforex = \"beforex\\<^sub>0 P C M d\"\n  obtain xt\\<^sub>0 xt\\<^sub>1' where bx': \"?beforex I (xt\\<^sub>1 @ xt\\<^sub>2 @ [(f,t,D,h,d)]) xt\\<^sub>0 xt\\<^sub>1'\"\n    using bx by(clarsimp simp:beforex_def)\n  let ?xt0 = xt\\<^sub>0 and ?xt1 = \"xt\\<^sub>2 @ (f, t, D, h, d) # xt\\<^sub>1'\"\n  have \"pcs xt\\<^sub>0 \\<inter> J = {}\" using bx' JI by blast\n  moreover {\n    fix pc C pc' d' assume pcJ: \"pc\\<in>J\"\n    then have \"pc \\<notin> pcs xt\\<^sub>2\" using bx' Jpcs by blast\n    then have \"match_ex_table P C pc (xt\\<^sub>2 @ (f, t, D, h, d) # xt\\<^sub>1')\n                   = \\<lfloor>(pc', d')\\<rfloor> \\<longrightarrow> d' \\<le> d\"\n      using bx' JI pcJ by (auto split:if_split_asm)\n  }\n  ultimately have \"?beforex J xt\\<^sub>1 ?xt0 ?xt1\" using bx' pcs by simp\n  then show ?thesis using beforex_def by blast\nqed\n(*>*)\n\n\nlemma beforex_appendD2:\nassumes bx: \"P,C,M \\<rhd> xt\\<^sub>1 @ xt\\<^sub>2 @ [(f,t,D,h,d)] / I,d\"\n  and pcs: \"pcs xt\\<^sub>2 \\<subseteq> J\" and JI: \"J \\<subseteq> I\" and Jpcs: \"J \\<inter> pcs xt\\<^sub>1 = {}\"\nshows \"P,C,M \\<rhd> xt\\<^sub>2 / J,d\"\n(*<*)\nproof -\n  let ?beforex = \"beforex\\<^sub>0 P C M d\"\n  obtain xt\\<^sub>0 xt\\<^sub>1' where bx': \"?beforex I (xt\\<^sub>1 @ xt\\<^sub>2 @ [(f,t,D,h,d)]) xt\\<^sub>0 xt\\<^sub>1'\"\n    using bx by(clarsimp simp:beforex_def)\n  then have \"\\<exists>xt\\<^sub>1''. beforex\\<^sub>0 P C M d J xt\\<^sub>2 (xt\\<^sub>0 @ xt\\<^sub>1) xt\\<^sub>1''\"\n    using assms by fastforce\n  then show ?thesis using beforex_def by blast\nqed\n(*>*)\n\n\nlemma beforexM:\n  \"P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = body in D \\<Longrightarrow> compP\\<^sub>2 P,D,M \\<rhd> compxE\\<^sub>2 body 0 0/{..<size(compE\\<^sub>2 body)},0\"\n(*<*)\nproof -\n  assume cM: \"P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = body in D\"\n  let ?xt0 = \"[]\"\n  have \"\\<exists>xt1. beforex\\<^sub>0 (compP\\<^sub>2 P) D M 0 ({..<size(compE\\<^sub>2 body)}) (compxE\\<^sub>2 body 0 0) ?xt0 xt1\"\n    using sees_method_compP[where f = compMb\\<^sub>2, OF sees_method_idemp[OF cM]]\n          pcs_subset by(fastforce simp add: compP\\<^sub>2_def compMb\\<^sub>2_def)\n  then show ?thesis using beforex_def by blast\nqed\n(*>*)\n\n\nlemma match_ex_table_SomeD2:\nassumes met: \"match_ex_table P D pc (ex_table_of P C M) = \\<lfloor>(pc',d')\\<rfloor>\"\n  and bx: \"P,C,M \\<rhd> xt/I,d\"\n  and nmet: \"\\<forall>x \\<in> set xt. \\<not> matches_ex_entry P D pc x\" and pcI: \"pc \\<in> I\"\nshows \"d' \\<le> d\"\n(*<*)\nproof -\n  obtain xt\\<^sub>0 xt\\<^sub>1 where bx': \"beforex\\<^sub>0 P C M d I xt xt\\<^sub>0 xt\\<^sub>1\"\n    using bx by(clarsimp simp:beforex_def)\n  then have \"pc \\<notin> pcs xt\\<^sub>0\" using pcI by blast\n  then show ?thesis using bx' met nmet pcI by simp\nqed\n(*>*)\n\n\nlemma match_ex_table_SomeD1:\n  \"\\<lbrakk> match_ex_table P D pc (ex_table_of P C M) = \\<lfloor>(pc',d')\\<rfloor>;\n     P,C,M \\<rhd> xt / I,d; pc \\<in> I; pc \\<notin> pcs xt \\<rbrakk> \\<Longrightarrow> d' \\<le> d\"\n(*<*)by(auto elim: match_ex_table_SomeD2)(*>*)\n\n\nsubsection\\<open> The correctness proof \\<close>\n\n(*<*)\ndeclare nat_add_distrib[simp] caught_def[simp]\ndeclare fun_upd_apply[simp del]\n(*>*)\n\ndefinition\n  handle :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> addr \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> nat \\<Rightarrow> init_call_status \\<Rightarrow> frame list \\<Rightarrow> sheap\n                \\<Rightarrow> jvm_state\" where\n  \"handle P C M a h vs ls pc ics frs sh = find_handler P a h ((vs,ls,C,M,pc,ics) # frs) sh\"\n\nlemma aux_isin[simp]: \"\\<lbrakk> B \\<subseteq> A; a \\<in> B \\<rbrakk> \\<Longrightarrow> a \\<in> A\"\n(*<*)by blast(*>*)\n\nlemma handle_frs_tl_neq:\n \"ics_of f \\<noteq> No_ics\n  \\<Longrightarrow> (xp, h, f#frs, sh) \\<noteq> handle P C M xa h' vs l pc ics frs sh'\"\n by(simp add: handle_def find_handler_frs_tl_neq del: find_handler.simps)\n\nsubsubsection \"Correctness proof inductive hypothesis\"\n\n\\<comment> \\<open> frame definitions for use by correctness proof inductive hypothesis \\<close>\nfun calling_to_called :: \"frame \\<Rightarrow> frame\" where\n\"calling_to_called (stk,loc,D,M,pc,ics) = (stk,loc,D,M,pc,case ics of Calling C Cs \\<Rightarrow> Called (C#Cs))\"\n\nfun calling_to_scalled :: \"frame \\<Rightarrow> frame\" where\n\"calling_to_scalled (stk,loc,D,M,pc,ics) = (stk,loc,D,M,pc,case ics of Calling C Cs \\<Rightarrow> Called Cs)\"\n\nfun calling_to_calling :: \"frame \\<Rightarrow> cname \\<Rightarrow> frame\" where\n\"calling_to_calling (stk,loc,D,M,pc,ics) C' = (stk,loc,D,M,pc,case ics of Calling C Cs \\<Rightarrow> Calling C' (C#Cs))\"\n\nfun calling_to_throwing :: \"frame \\<Rightarrow> addr \\<Rightarrow> frame\" where\n\"calling_to_throwing (stk,loc,D,M,pc,ics) a = (stk,loc,D,M,pc,case ics of Calling C Cs \\<Rightarrow> Throwing (C#Cs) a)\"\n\nfun calling_to_sthrowing :: \"frame \\<Rightarrow> addr \\<Rightarrow> frame\" where\n\"calling_to_sthrowing (stk,loc,D,M,pc,ics) a = (stk,loc,D,M,pc,case ics of Calling C Cs \\<Rightarrow> Throwing Cs a)\"\n\n\n\\<comment> \\<open> pieces of the correctness proof's inductive hypothesis, which depend on the\n expression being compiled) \\<close>\n\nfun Jcc_cond :: \"J\\<^sub>1_prog \\<Rightarrow> ty list \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> val list \\<Rightarrow> pc \\<Rightarrow> init_call_status\n   \\<Rightarrow> nat set \\<Rightarrow> heap \\<Rightarrow> sheap \\<Rightarrow> expr\\<^sub>1 \\<Rightarrow> bool\" where\n\"Jcc_cond P E C M vs pc ics I h sh (INIT C\\<^sub>0 (Cs,b) \\<leftarrow> e')\n  = ((\\<exists>T. P,E,h,sh \\<turnstile>\\<^sub>1 INIT C\\<^sub>0 (Cs,b) \\<leftarrow> e' : T) \\<and> unit = e' \\<and> ics = No_ics)\" |\n\"Jcc_cond P E C M vs pc ics I h sh (RI(C',e\\<^sub>0);Cs \\<leftarrow> e')\n  = (((e\\<^sub>0 = C'\\<bullet>\\<^sub>sclinit([]) \\<and> (\\<exists>T. P,E,h,sh \\<turnstile>\\<^sub>1 RI(C',e\\<^sub>0);Cs \\<leftarrow> e':T))\n         \\<or> ((\\<exists>a. e\\<^sub>0 = Throw a) \\<and> (\\<forall>C \\<in> set(C'#Cs). is_class P C)))\n      \\<and> unit = e' \\<and> ics = No_ics)\" |\n\"Jcc_cond P E C M vs pc ics I h sh (C'\\<bullet>\\<^sub>sM'(es))\n  = (let e = (C'\\<bullet>\\<^sub>sM'(es))\n     in if M' = clinit \\<and> es = [] then (\\<exists>T. P,E,h,sh \\<turnstile>\\<^sub>1 e:T) \\<and> (\\<exists>Cs. ics = Called Cs)\n        else (compP\\<^sub>2 P,C,M,pc \\<rhd> compE\\<^sub>2 e \\<and> compP\\<^sub>2 P,C,M \\<rhd> compxE\\<^sub>2 e pc (size vs)/I,size vs\n                  \\<and> {pc..<pc+size(compE\\<^sub>2 e)} \\<subseteq> I \\<and> \\<not>sub_RI e \\<and> ics = No_ics)\n    )\" |\n\"Jcc_cond P E C M vs pc ics I h sh e\n  = (compP\\<^sub>2 P,C,M,pc \\<rhd> compE\\<^sub>2 e \\<and> compP\\<^sub>2 P,C,M \\<rhd> compxE\\<^sub>2 e pc (size vs)/I,size vs\n                  \\<and> {pc..<pc+size(compE\\<^sub>2 e)} \\<subseteq> I \\<and> \\<not>sub_RI e \\<and> ics = No_ics)\"\n\n\nfun Jcc_frames :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> pc \\<Rightarrow> init_call_status\n  \\<Rightarrow> frame list \\<Rightarrow> expr\\<^sub>1 \\<Rightarrow> frame list\" where\n\"Jcc_frames P C M vs ls pc ics frs (INIT C\\<^sub>0 (C'#Cs,b) \\<leftarrow> e')\n  = (case b of False \\<Rightarrow> (vs,ls,C,M,pc,Calling C' Cs) # frs\n             | True \\<Rightarrow> (vs,ls,C,M,pc,Called (C'#Cs)) # frs\n    )\" |\n\"Jcc_frames P C M vs ls pc ics frs (INIT C\\<^sub>0 (Nil,b) \\<leftarrow> e')\n  = (vs,ls,C,M,pc,Called [])#frs\" |\n\"Jcc_frames P C M vs ls pc ics frs (RI(C',e\\<^sub>0);Cs \\<leftarrow> e')\n  = (case e\\<^sub>0 of Throw a \\<Rightarrow> (vs,ls,C,M,pc,Throwing (C'#Cs) a) # frs\n              | _ \\<Rightarrow> (vs,ls,C,M,pc,Called (C'#Cs)) # frs )\" |\n\"Jcc_frames P C M vs ls pc ics frs (C'\\<bullet>\\<^sub>sM'(es))\n  = (if M' = clinit \\<and> es = []\n     then create_init_frame P C'#(vs,ls,C,M,pc,ics)#frs\n     else (vs,ls,C,M,pc,ics)#frs\n    )\" |\n\"Jcc_frames P C M vs ls pc ics frs e\n  = (vs,ls,C,M,pc,ics)#frs\"\n\nfun Jcc_rhs :: \"J\\<^sub>1_prog \\<Rightarrow> ty list \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> pc \\<Rightarrow> init_call_status\n  \\<Rightarrow> frame list \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> sheap \\<Rightarrow> val \\<Rightarrow> expr\\<^sub>1 \\<Rightarrow> jvm_state\" where\n\"Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v (INIT C\\<^sub>0 (Cs,b) \\<leftarrow> e')\n  = (None,h',(vs,ls,C,M,pc,Called [])#frs,sh')\" |\n\"Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v (RI(C',e\\<^sub>0);Cs \\<leftarrow> e')\n  = (None,h',(vs,ls,C,M,pc,Called [])#frs,sh')\" |\n\"Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v (C'\\<bullet>\\<^sub>sM'(es))\n  = (let e = (C'\\<bullet>\\<^sub>sM'(es))\n     in if M' = clinit \\<and> es = []\n        then (None,h',(vs,ls,C,M,pc,ics)#frs,sh'(C'\\<mapsto>(fst(the(sh' C')),Done)))\n        else (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 e),ics)#frs,sh')\n    )\" |\n\"Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v e\n  = (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 e),ics)#frs,sh')\"\n\nfun Jcc_err :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> pc \\<Rightarrow> init_call_status\n  \\<Rightarrow> frame list \\<Rightarrow> sheap \\<Rightarrow> nat set \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> sheap \\<Rightarrow> addr \\<Rightarrow> expr\\<^sub>1\n  \\<Rightarrow> bool\" where\n\"Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa (INIT C\\<^sub>0 (Cs,b) \\<leftarrow> e')\n  = (\\<exists>vs'. P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs (INIT C\\<^sub>0 (Cs,b) \\<leftarrow> e'),sh)\n           -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls pc ics frs sh')\" |\n\"Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa (RI(C',e\\<^sub>0);Cs \\<leftarrow> e')\n  = (\\<exists>vs'. P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs (RI(C',e\\<^sub>0);Cs \\<leftarrow> e'),sh)\n           -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls pc ics frs sh')\" |\n\"Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa (C'\\<bullet>\\<^sub>sM'(es))\n  = (let e = (C'\\<bullet>\\<^sub>sM'(es))\n     in if M' = clinit \\<and> es = []\n        then case ics of\n               Called Cs \\<Rightarrow> P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs e,sh)\n                       -jvm\\<rightarrow> (None,h',(vs,ls,C,M,pc,Throwing Cs xa)#frs,(sh'(C' \\<mapsto> (fst(the(sh' C')),Error))))\n        else (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\<and>\n               \\<not> caught P pc\\<^sub>1 h' xa (compxE\\<^sub>2 e pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs e,sh)\n                      -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\\<^sub>1 ics frs sh'))\n    )\" |\n\"Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa e\n  = (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\<and>\n               \\<not> caught P pc\\<^sub>1 h' xa (compxE\\<^sub>2 e pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs e,sh)\n                      -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\\<^sub>1 ics frs sh'))\"\n\nfun Jcc_pieces :: \"J\\<^sub>1_prog \\<Rightarrow> ty list \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> pc \\<Rightarrow> init_call_status\n  \\<Rightarrow> frame list \\<Rightarrow> sheap \\<Rightarrow> nat set \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> sheap \\<Rightarrow> val \\<Rightarrow> addr \\<Rightarrow> expr\\<^sub>1\n  \\<Rightarrow> bool \\<times> frame list \\<times> jvm_state \\<times> bool\" where\n\"Jcc_pieces P E C M h vs ls pc ics frs sh I h' ls' sh' v xa e\n  = (Jcc_cond P E C M vs pc ics I h sh e, Jcc_frames (compP\\<^sub>2 P) C M vs ls pc ics frs e,\n      Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v e,\n      Jcc_err (compP\\<^sub>2 P) C M h vs ls pc ics frs sh I h' ls' sh' xa e)\"\n\n\\<comment> \\<open> @{text Jcc_pieces} lemmas \\<close>\n\nlemma nsub_RI_Jcc_pieces:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n  and nsub: \"\\<not>sub_RI e\"\nshows \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa e \n  = (let cond = P,C,M,pc \\<rhd> compE\\<^sub>2 e \\<and> P,C,M \\<rhd> compxE\\<^sub>2 e pc (size vs)/I,size vs\n                  \\<and> {pc..<pc+size(compE\\<^sub>2 e)} \\<subseteq> I \\<and> ics = No_ics;\n         frs' = (vs,ls,C,M,pc,ics)#frs;\n         rhs = (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 e),ics)#frs,sh');\n         err = (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\<and>\n               \\<not> caught P pc\\<^sub>1 h' xa (compxE\\<^sub>2 e pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\\<^sub>1 ics frs sh'))\n     in (cond, frs',rhs, err)\n    )\"\nproof -\n  have NC: \"\\<forall>C'. e \\<noteq> C'\\<bullet>\\<^sub>sclinit([])\" using assms(2) proof(cases e) qed(simp_all)\n  then show ?thesis using assms\n  proof(cases e)\n    case (SCall C M es)\n    then have \"M \\<noteq> clinit\" using nsub by simp\n    then show ?thesis using SCall nsub proof(cases es) qed(simp_all)\n  qed(simp_all)\nqed\n\nlemma Jcc_pieces_Cast:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (Cast C' e)\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h',(v'#vs',ls',C\\<^sub>0,M',pc' - 1,ics')#frs',sh'),\n        (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\<and>\n               \\<not> caught P pc\\<^sub>1 h\\<^sub>1 xa (compxE\\<^sub>2 e pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>0,frs\\<^sub>0,sh\\<^sub>0) -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1)))\"\nproof -\n  have pc: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using assms by clarsimp\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] pc by clarsimp\nqed\n\nlemma Jcc_pieces_BinOp1:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e \\<guillemotleft>bop\\<guillemotright> e')\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0\n (I - pcs (compxE\\<^sub>2 e' (pc + length (compE\\<^sub>2 e)) (Suc (length vs')))) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h\\<^sub>1,(v'#vs',ls\\<^sub>1,C\\<^sub>0,M',pc' - size (compE\\<^sub>2 e') - 1,ics')#frs',sh\\<^sub>1), err)\"\nproof -\n  have bef: \"compP compMb\\<^sub>2 P,C\\<^sub>0,M' \\<rhd> compxE\\<^sub>2 e pc (length vs) \n         / I - pcs (compxE\\<^sub>2 e' (pc + length (compE\\<^sub>2 e)) (Suc (length vs'))),length vs\"\n    using assms by clarsimp\n  have vs: \"vs = vs'\" using assms by simp\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] bef vs by clarsimp\nqed\n\nlemma Jcc_pieces_BinOp2:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e \\<guillemotleft>bop\\<guillemotright> e')\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 (v\\<^sub>1#vs) ls\\<^sub>1 (pc + size (compE\\<^sub>2 e)) ics frs sh\\<^sub>1\n   (I - pcs (compxE\\<^sub>2 e pc (length vs'))) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v' xa e'\n   = (True, (v\\<^sub>1#vs,ls\\<^sub>1,C,M,pc + size (compE\\<^sub>2 e),ics)#frs,\n       (xp',h',(v'#v\\<^sub>1#vs',ls',C\\<^sub>0,M',pc' - 1,ics')#frs',sh'),\n          (\\<exists>pc\\<^sub>1. pc + size (compE\\<^sub>2 e) \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size (compE\\<^sub>2 e) + length (compE\\<^sub>2 e') \\<and>\n               \\<not> caught P pc\\<^sub>1 h\\<^sub>2 xa (compxE\\<^sub>2 e' (pc + size (compE\\<^sub>2 e)) (Suc (length vs))) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,pc + size (compE\\<^sub>2 e),ics)#frs,sh\\<^sub>1)\n                       -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@v\\<^sub>1#vs) ls\\<^sub>2 pc\\<^sub>1 ics frs sh\\<^sub>2)))\"\nproof -\n  have bef: \"compP compMb\\<^sub>2 P\\<^sub>1,C\\<^sub>0,M' \\<rhd> compxE\\<^sub>2 e pc (length vs) \n         / I - pcs (compxE\\<^sub>2 e' (pc + length (compE\\<^sub>2 e)) (Suc (length vs'))),length vs\"\n    using assms by clarsimp\n  have vs: \"vs = vs'\" using assms by simp\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e'] bef vs by clarsimp\nqed\n\nlemma Jcc_pieces_FAcc:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h',(v'#vs',ls',C\\<^sub>0,M',pc' - 1,ics')#frs',sh'), err)\"\nproof -\n  have pc: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using assms by clarsimp\n  then show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by clarsimp\nqed\n\nlemma Jcc_pieces_LAss:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (i:=e)\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h',(v'#vs',ls',C\\<^sub>0,M',pc' - 2,ics')#frs',sh'),\n        (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\<and>\n               \\<not> caught P pc\\<^sub>1 h\\<^sub>1 xa (compxE\\<^sub>2 e pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>0,frs\\<^sub>0,sh\\<^sub>0) -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1)))\"\nproof -\n  have pc: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using assms by clarsimp\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] pc by clarsimp\nqed\n\nlemma Jcc_pieces_FAss1:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>F{D}:=e')\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0\n (I - pcs (compxE\\<^sub>2 e' (pc + length (compE\\<^sub>2 e)) (Suc (length vs')))) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h\\<^sub>1,(v'#vs',ls\\<^sub>1,C\\<^sub>0,M',pc' - size (compE\\<^sub>2 e') - 2,ics')#frs',sh\\<^sub>1), err)\"\nproof -\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by clarsimp\nqed\n\nlemma Jcc_pieces_FAss2:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>F{D}:=e')\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"Jcc_pieces P E C M h\\<^sub>1 (v\\<^sub>1#vs) ls\\<^sub>1 (pc + size (compE\\<^sub>2 e)) ics frs sh\\<^sub>1\n   (I - pcs (compxE\\<^sub>2 e pc (length vs'))) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v' xa e'\n   = (True, (v\\<^sub>1#vs,ls\\<^sub>1,C,M,pc + size (compE\\<^sub>2 e),ics)#frs,\n       (xp',h',(v'#v\\<^sub>1#vs',ls',C\\<^sub>0,M',pc' - 2,ics')#frs',sh'),\n        (\\<exists>pc\\<^sub>1. (pc + size (compE\\<^sub>2 e)) \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size (compE\\<^sub>2 e) + size(compE\\<^sub>2 e') \\<and>\n               \\<not> caught (compP\\<^sub>2 P) pc\\<^sub>1 h\\<^sub>2 xa (compxE\\<^sub>2 e' (pc + size (compE\\<^sub>2 e)) (size (v\\<^sub>1#vs))) \\<and>\n               (\\<exists>vs'. (compP\\<^sub>2 P) \\<turnstile> (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,pc + size (compE\\<^sub>2 e),ics)#frs,sh\\<^sub>1)\n                                   -jvm\\<rightarrow> handle (compP\\<^sub>2 P) C M xa h\\<^sub>2 (vs'@v\\<^sub>1#vs) ls\\<^sub>2 pc\\<^sub>1 ics frs sh\\<^sub>2)))\"\nproof -\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e'] by clarsimp\nqed\n\nlemma Jcc_pieces_SFAss:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h' ls' sh' v xa (C'\\<bullet>\\<^sub>sF{D}:=e)\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h\\<^sub>1,(v'#vs',ls\\<^sub>1,C\\<^sub>0,M',pc' - 2,ics')#frs',sh\\<^sub>1), err)\"\nproof -\n  have pc: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using assms by clarsimp\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] pc by clarsimp\nqed\n\nlemma Jcc_pieces_Call1:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 v xa (e\\<bullet>M\\<^sub>0(es))\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C',M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs')))) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0,\n       (xp',h\\<^sub>1,(v'#vs',ls\\<^sub>1,C',M',pc' - size (compEs\\<^sub>2 es) - 1,ics')#frs',sh\\<^sub>1), err)\"\nproof -\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by clarsimp\nqed\n\nlemma Jcc_pieces_clinit:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n  and cond: \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (C1\\<bullet>\\<^sub>sclinit([]))\"\nshows \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C1\\<bullet>\\<^sub>sclinit([]))\n     = (True, create_init_frame P C1 # (vs,ls,C,M,pc,ics)#frs,\n          (None, h', (vs,ls,C,M,pc,ics)#frs, sh'(C1\\<mapsto>(fst(the(sh' C1)),Done))), \n      P \\<turnstile> (None,h,create_init_frame P C1 # (vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow>\n     (case ics of Called Cs \\<Rightarrow> (None,h',(vs,ls,C,M,pc,Throwing Cs xa)#frs,(sh'(C1 \\<mapsto> (fst(the(sh' C1)),Error))))))\"\nusing assms by(auto split: init_call_status.splits list.splits bool.splits)\n\nlemma Jcc_pieces_SCall_clinit_body:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\" and wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>3 ls\\<^sub>2 sh\\<^sub>3 v xa (C1\\<bullet>\\<^sub>sclinit([]))\n         = (True, frs', rhs', err')\"\n and method: \"P\\<^sub>1 \\<turnstile> C1 sees clinit,Static: []\\<rightarrow>Void = body in D\"\nshows \"Jcc_pieces P\\<^sub>1 [] D clinit h\\<^sub>2 [] (replicate (max_vars body) undefined) 0\n          No_ics (tl frs') sh\\<^sub>2 {..<length (compE\\<^sub>2 body)} h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 v xa body\n           = (True, frs', \n                (None,h\\<^sub>3,([v],ls\\<^sub>3,D,clinit,size(compE\\<^sub>2 body), No_ics)#tl frs',sh\\<^sub>3),\n                    \\<exists>pc\\<^sub>1. 0 \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < size(compE\\<^sub>2 body) \\<and>\n                      \\<not> caught P pc\\<^sub>1 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0) \\<and>\n                      (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>2,frs',sh\\<^sub>2) -jvm\\<rightarrow> handle P D clinit xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>1\n                            No_ics (tl frs') sh\\<^sub>3))\"\nproof -\n  have M_in_D: \"P\\<^sub>1 \\<turnstile> D sees clinit,Static: []\\<rightarrow>Void = body in D\"\n    using method by(rule sees_method_idemp) \n  hence M_code: \"compP\\<^sub>2 P\\<^sub>1,D,clinit,0 \\<rhd> compE\\<^sub>2 body @ [Return]\"\n    and M_xtab: \"compP\\<^sub>2 P\\<^sub>1,D,clinit \\<rhd> compxE\\<^sub>2 body 0 0/{..<size(compE\\<^sub>2 body)},0\"\n    by(rule beforeM, rule beforexM)\n  have nsub: \"\\<not>sub_RI body\" by(rule sees_wf\\<^sub>1_nsub_RI[OF wf method])\n  then show ?thesis using assms nsub_RI_Jcc_pieces M_code M_xtab by clarsimp\nqed\n\nlemma Jcc_pieces_Cons:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"P,C,M,pc \\<rhd> compEs\\<^sub>2 (e#es)\" and \"P,C,M \\<rhd> compxEs\\<^sub>2 (e#es) pc (size vs)/I,size vs\"\n and \"{pc..<pc+size(compEs\\<^sub>2 (e#es))} \\<subseteq> I\"\n and \"ics = No_ics\"\n and \"\\<not>sub_RIs (e#es)\"\nshows \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh\n  (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs)))) h' ls' sh' v xa e\n  = (True, (vs, ls, C, M, pc, ics) # frs,\n        (None, h', (v#vs, ls', C, M, pc + length (compE\\<^sub>2 e), ics) # frs, sh'),\n          \\<exists>pc\\<^sub>1\\<ge>pc. pc\\<^sub>1 < pc + length (compE\\<^sub>2 e) \\<and> \\<not> caught P pc\\<^sub>1 h' xa (compxE\\<^sub>2 e pc (length vs))\n                   \\<and> (\\<exists>vs'. P \\<turnstile> (None, h, (vs, ls, C, M, pc, ics) # frs, sh)\n                         -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\\<^sub>1 ics frs sh'))\"\nproof -\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by auto\nqed\n\nlemma Jcc_pieces_InitNone:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs (sh(C\\<^sub>0 \\<mapsto> (sblank P C\\<^sub>0, Prepared)))\n     I h' l' sh' v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),\n        \\<exists>vs'. P \\<turnstile> (None,h,frs',(sh(C\\<^sub>0 \\<mapsto> (sblank P\\<^sub>1 C\\<^sub>0, Prepared))))\n            -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')\"\nproof -\n  have  \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\" using assms by simp\n  then obtain T where \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\" by fastforce\n  then have \"P\\<^sub>1,E,h,sh(C\\<^sub>0 \\<mapsto> (sblank P\\<^sub>1 C\\<^sub>0, Prepared)) \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\"\n    by(auto simp: fun_upd_apply)\n  then have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h (sh(C\\<^sub>0 \\<mapsto> (sblank P\\<^sub>1 C\\<^sub>0, Prepared))) (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit))\"\n    by(simp only: exI)\n  then show ?thesis using assms by clarsimp\nqed\n\nlemma Jcc_pieces_InitDP:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (Cs,True) \\<leftarrow> e)\n    = (True, (calling_to_scalled (hd frs'))#(tl frs'),\n         (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),\n             \\<exists>vs'. P \\<turnstile> (None,h,calling_to_scalled (hd frs')#(tl frs'),sh)\n                        -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')\"\nproof -\n  have \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\" using assms by simp\n  then obtain T where \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\" by fastforce\n  then have \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (Cs,True) \\<leftarrow> unit : T\"\n    by (auto; metis list.sel(2) list.set_sel(2))\n  then have wtrt: \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT C' (Cs,True) \\<leftarrow> unit))\" by(simp only: exI)\n  show ?thesis using assms wtrt\n  proof(cases Cs)\n    case (Cons C1 Cs1)\n    then show ?thesis using assms wtrt\n      by(case_tac \"method P C1 clinit\") clarsimp\n  qed(clarsimp)\nqed\n\nlemma Jcc_pieces_InitError:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n and err: \"sh C\\<^sub>0 = Some(sfs,Error)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (RI (C\\<^sub>0, THROW NoClassDefFoundError);Cs \\<leftarrow> e)\n    = (True, (calling_to_throwing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs'),\n         (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),\n             \\<exists>vs'. P \\<turnstile> (None,h, (calling_to_throwing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs'),sh)\n                        -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')\"\nproof -\n  show ?thesis using assms\n  proof(cases Cs)\n    case (Cons C1 Cs1)\n    then show ?thesis using assms\n      by(case_tac \"method P C1 clinit\", case_tac \"method P C\\<^sub>0 clinit\") clarsimp\n  qed(clarsimp)\nqed\n\nlemma Jcc_pieces_InitObj:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) I h' l' sh'' v xa (INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> e)\n    = (True, calling_to_called (hd frs')#(tl frs'),\n         (None, h', (vs, l, C, M, pc, Called []) # frs, sh''),\n             \\<exists>vs'. P \\<turnstile> (None,h,calling_to_called (hd frs')#(tl frs'),sh')\n                        -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'')\"\nproof -\n  have \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\" using assms by simp\n  then obtain T where \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\" by fastforce\n  then have \"P\\<^sub>1,E,h,sh(C\\<^sub>0 \\<mapsto> (sfs,Processing)) \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> unit : T\"\n    using assms by clarsimp (auto simp: fun_upd_apply)\n  then have wtrt: \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) (INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> unit))\"\n    by(simp only: exI)\n  show ?thesis using assms wtrt by clarsimp\nqed\n\nlemma Jcc_pieces_InitNonObj:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"is_class P\\<^sub>1 D\" and \"D \\<notin> set (C\\<^sub>0#Cs)\" and \"\\<forall>C \\<in> set (C\\<^sub>0#Cs). P\\<^sub>1 \\<turnstile> C \\<preceq>\\<^sup>* D\"\n and pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) I h' l' sh'' v xa (INIT C' (D # C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, calling_to_calling (hd frs') D#(tl frs'),\n         (None, h', (vs, l, C, M, pc, Called []) # frs, sh''),\n             \\<exists>vs'. P \\<turnstile> (None,h,calling_to_calling (hd frs') D#(tl frs'),sh')\n                        -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'')\"\nproof -\n  have \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\" using assms by simp\n  then obtain T where \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\" by fastforce\n  then have \"P\\<^sub>1,E,h,sh(C\\<^sub>0 \\<mapsto> (sfs,Processing)) \\<turnstile>\\<^sub>1 INIT C' (D # C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\"\n    using assms by clarsimp (auto simp: fun_upd_apply)\n  then have wtrt: \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) (INIT C' (D # C\\<^sub>0 # Cs,False) \\<leftarrow> unit))\"\n    by(simp only: exI)\n  show ?thesis using assms wtrt by clarsimp\nqed\n\nlemma Jcc_pieces_InitRInit:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\" and wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> e)\n    = (True, frs',\n         (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),\n             \\<exists>vs'. P \\<turnstile> (None,h,frs',sh)\n                        -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')\"\nproof -\n  have cond: \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> e)\" using assms by simp\n  then have clinit: \"\\<exists>T. P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 C\\<^sub>0\\<bullet>\\<^sub>sclinit([]) : T\" using wf\n    by clarsimp (auto simp: is_class_def intro: wf\\<^sub>1_types_clinit)\n  then obtain T where cT: \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 C\\<^sub>0\\<bullet>\\<^sub>sclinit([]) : T\" by blast\n  obtain T where \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> unit : T\" using cond by fastforce\n  then have \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> unit : T\"\n    using assms by (auto intro: cT)\n  then have wtrt: \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> unit))\"\n    by(simp only: exI)\n  then show ?thesis using assms by simp\nqed\n\nlemma Jcc_pieces_RInit_clinit:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\" and wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([]));Cs \\<leftarrow> e)\n    = (True, frs',\n         (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc (Called Cs) (tl frs') sh I h' l' sh' v xa (C\\<^sub>0\\<bullet>\\<^sub>sclinit([]))\n    = (True, create_init_frame P C\\<^sub>0#(vs,l,C,M,pc,Called Cs)#tl frs',\n         (None, h', (vs,l,C,M,pc,Called Cs)#tl frs', sh'(C\\<^sub>0\\<mapsto>(fst(the(sh' C\\<^sub>0)),Done))),\n             P \\<turnstile> (None,h,create_init_frame P C\\<^sub>0#(vs,l,C,M,pc,Called Cs)#tl frs',sh)\n   -jvm\\<rightarrow> (None,h',(vs, l, C, M, pc, Throwing Cs xa) # tl frs',sh'(C\\<^sub>0 \\<mapsto> (fst(the(sh' C\\<^sub>0)),Error))))\"\nproof -\n  have cond: \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([]));Cs \\<leftarrow> e)\" using assms by simp\n  then have wtrt: \"\\<exists>T. P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 C\\<^sub>0\\<bullet>\\<^sub>sclinit([]) : T\" using wf\n    by clarsimp (auto simp: is_class_def intro: wf\\<^sub>1_types_clinit)\n  then show ?thesis using assms by clarsimp\nqed\n\nlemma Jcc_pieces_RInit_Init:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\" and wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\n and proc: \"\\<forall>C' \\<in> set Cs. \\<exists>sfs. sh'' C' = \\<lfloor>(sfs,Processing)\\<rfloor>\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([]));Cs \\<leftarrow> e)\n    = (True, frs',\n         (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h' vs l pc ics frs sh'' I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa (INIT (last (C\\<^sub>0#Cs)) (Cs,True) \\<leftarrow> e)\n    = (True, (vs, l, C, M, pc, Called Cs) # frs,\n         (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1),\n             \\<exists>vs'. P \\<turnstile> (None,h',(vs, l, C, M, pc, Called Cs) # frs,sh'')\n                        -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) l pc ics frs sh\\<^sub>1)\"\nproof -\n  have \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([]));Cs \\<leftarrow> e)\" using assms by simp\n  then have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> unit))\" by simp\n  then obtain T where riwt: \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([]));Cs \\<leftarrow> unit : T\" by meson\n  then have \"P\\<^sub>1,E,h',sh'' \\<turnstile>\\<^sub>1 INIT (last (C\\<^sub>0#Cs)) (Cs,True) \\<leftarrow> unit : T\" using proc\n  proof(cases Cs) qed(auto)\n  then have wtrt: \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h' sh'' (INIT (last (C\\<^sub>0#Cs)) (Cs,True) \\<leftarrow> unit))\" by(simp only: exI)\n  show ?thesis using assms wtrt\n  proof(cases Cs)\n    case (Cons C1 Cs1)\n    then show ?thesis using assms wtrt\n      by(case_tac \"method P C1 clinit\") clarsimp\n  qed(clarsimp)\nqed\n\nlemma Jcc_pieces_RInit_RInit:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa (RI (C\\<^sub>0,e);D#Cs \\<leftarrow> e')\n    = (True, frs', rhs, err)\"\n and hd: \"hd frs' = (vs1,l1,C1,M1,pc1,ics1)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h' vs l pc ics frs sh'' I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa (RI (D,Throw xa) ; Cs \\<leftarrow> e')\n    = (True, (vs1, l1, C1, M1, pc1, Throwing (D#Cs) xa) # tl frs',\n         (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1),\n             \\<exists>vs'. P \\<turnstile> (None,h',(vs1, l1, C1, M1, pc1, Throwing (D#Cs) xa) # tl frs',sh'')\n                        -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) l pc ics frs sh\\<^sub>1)\"\nusing assms by(case_tac \"method P D clinit\", cases \"e = C\\<^sub>0\\<bullet>\\<^sub>sclinit([])\") clarsimp+\n\n\nsubsubsection \"JVM stepping lemmas\"\n\nlemma jvm_Invoke:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"P,C,M,pc \\<triangleright> Invoke M' (length Ts)\"\n and ha: \"h\\<^sub>2 a = \\<lfloor>(Ca, fs)\\<rfloor>\" and method: \"P\\<^sub>1 \\<turnstile> Ca sees M', NonStatic :  Ts\\<rightarrow>T = body in D\"\n and len: \"length pvs = length Ts\" and \"ls\\<^sub>2' = Addr a # pvs @ replicate (max_vars body) undefined\"\nshows \"P \\<turnstile> (None, h\\<^sub>2, (rev pvs @ Addr a # vs, ls\\<^sub>2, C, M, pc, No_ics) # frs, sh\\<^sub>2) -jvm\\<rightarrow>\n    (None, h\\<^sub>2, ([], ls\\<^sub>2', D, M', 0, No_ics) # (rev pvs @ Addr a # vs, ls\\<^sub>2, C, M, pc, No_ics) # frs, sh\\<^sub>2)\"\nproof -\n  have cname: \"cname_of h\\<^sub>2 (the_Addr ((rev pvs @ Addr a # vs) ! length Ts)) = Ca\"\n    using ha method len by(auto simp: nth_append)\n  have r: \"(rev pvs @ Addr a # vs) ! (length Ts) = Addr a\" using len by(auto simp: nth_append)\n  have exm: \"\\<exists>Ts T m D b. P \\<turnstile> Ca sees M',b:Ts \\<rightarrow> T = m in D\"\n    using sees_method_compP[OF method] by fastforce\n  show ?thesis using assms cname r exm by simp\nqed\n\nlemma jvm_Invokestatic:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"P,C,M,pc \\<triangleright> Invokestatic C' M' (length Ts)\"\n and sh: \"sh\\<^sub>2 D = Some(sfs,Done)\"\n and method: \"P\\<^sub>1 \\<turnstile> C' sees M', Static :  Ts\\<rightarrow>T = body in D\"\n and len: \"length pvs = length Ts\" and \"ls\\<^sub>2' = pvs @ replicate (max_vars body) undefined\"\nshows \"P \\<turnstile> (None, h\\<^sub>2, (rev pvs @ vs, ls\\<^sub>2, C, M, pc, No_ics) # frs, sh\\<^sub>2) -jvm\\<rightarrow>\n    (None, h\\<^sub>2, ([], ls\\<^sub>2', D, M', 0, No_ics) # (rev pvs @ vs, ls\\<^sub>2, C, M, pc, No_ics) # frs, sh\\<^sub>2)\"\nproof -\n  have exm: \"\\<exists>Ts T m D b. P \\<turnstile> C' sees M',b:Ts \\<rightarrow> T = m in D\"\n    using sees_method_compP[OF method] by fastforce\n  show ?thesis using assms exm by simp\nqed\n\nlemma jvm_Invokestatic_Called:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"                       \n and \"P,C,M,pc \\<triangleright> Invokestatic C' M' (length Ts)\"\n and sh: \"sh\\<^sub>2 D = Some(sfs,i)\"\n and method: \"P\\<^sub>1 \\<turnstile> C' sees M', Static :  Ts\\<rightarrow>T = body in D\"\n and len: \"length pvs = length Ts\" and \"ls\\<^sub>2' = pvs @ replicate (max_vars body) undefined\"\nshows \"P \\<turnstile> (None, h\\<^sub>2, (rev pvs @ vs, ls\\<^sub>2, C, M, pc, Called []) # frs, sh\\<^sub>2) -jvm\\<rightarrow>\n    (None, h\\<^sub>2, ([], ls\\<^sub>2', D, M', 0, No_ics) # (rev pvs @ vs, ls\\<^sub>2, C, M, pc, No_ics) # frs, sh\\<^sub>2)\"\nproof -\n  have exm: \"\\<exists>Ts T m D b. P \\<turnstile> C' sees M',b:Ts \\<rightarrow> T = m in D\"\n    using sees_method_compP[OF method] by fastforce\n  show ?thesis using assms exm by simp\nqed\n\nlemma jvm_Return_Init:\n\"P,D,clinit,0 \\<rhd> compE\\<^sub>2 body @ [Return]\n  \\<Longrightarrow> P \\<turnstile> (None, h, (vs, ls, D, clinit, size(compE\\<^sub>2 body), No_ics) # frs, sh)\n              -jvm\\<rightarrow> (None, h, frs, sh(D\\<mapsto>(fst(the(sh D)),Done)))\"\n(is \"?P \\<Longrightarrow> P \\<turnstile> ?s1 -jvm\\<rightarrow> ?s2\")\nproof -\n  assume ?P\n  then have \"exec (P, ?s1) = \\<lfloor>?s2\\<rfloor>\" by(cases frs) auto\n  then have \"(?s1, ?s2) \\<in> (exec_1 P)\\<^sup>*\"\n    by(rule exec_1I[THEN r_into_rtrancl])\n  then show ?thesis by(simp add: exec_all_def1)\nqed\n\nlemma jvm_InitNone:\n \"\\<lbrakk> ics_of f = Calling C Cs;\n    sh C = None \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> (None,h,f#frs,sh) -jvm\\<rightarrow> (None,h,f#frs,sh(C \\<mapsto> (sblank P C, Prepared)))\"\n(is \"\\<lbrakk> ?P; ?Q \\<rbrakk> \\<Longrightarrow> P \\<turnstile> ?s1 -jvm\\<rightarrow> ?s2\")\nproof -\n  assume assms: ?P ?Q\n  then obtain stk1 loc1 C1 M1 pc1 ics1 where \"f = (stk1,loc1,C1,M1,pc1,ics1)\"\n    by(cases f) simp\n  then have \"exec (P, ?s1) = \\<lfloor>?s2\\<rfloor>\" using assms\n    by(case_tac ics1) simp_all\n  then have \"(?s1, ?s2) \\<in> (exec_1 P)\\<^sup>*\"\n    by(rule exec_1I[THEN r_into_rtrancl])\n  then show ?thesis by(simp add: exec_all_def1)\nqed\n\nlemma jvm_InitDP:\n \"\\<lbrakk> ics_of f = Calling C Cs;\n    sh C = \\<lfloor>(sfs,i)\\<rfloor>; i = Done \\<or> i = Processing \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> (None,h,f#frs,sh) -jvm\\<rightarrow> (None,h,(calling_to_scalled f)#frs,sh)\"\n(is \"\\<lbrakk> ?P; ?Q; ?R \\<rbrakk> \\<Longrightarrow> P \\<turnstile> ?s1 -jvm\\<rightarrow> ?s2\")\nproof -\n  assume assms: ?P ?Q ?R\n  then obtain stk1 loc1 C1 M1 pc1 ics1 where \"f = (stk1,loc1,C1,M1,pc1,ics1)\"\n    by(cases f) simp\n  then have \"exec (P, ?s1) = \\<lfloor>?s2\\<rfloor>\" using assms\n    by(case_tac i) simp_all\n  then have \"(?s1, ?s2) \\<in> (exec_1 P)\\<^sup>*\"\n    by(rule exec_1I[THEN r_into_rtrancl])\n  then show ?thesis by(simp add: exec_all_def1)\nqed\n\nlemma jvm_InitError:\n \"sh C = \\<lfloor>(sfs,Error)\\<rfloor>\n  \\<Longrightarrow> P \\<turnstile> (None,h,(vs,ls,C\\<^sub>0,M,pc,Calling C Cs)#frs,sh)\n   -jvm\\<rightarrow> (None,h,(vs,ls,C\\<^sub>0,M,pc,Throwing Cs (addr_of_sys_xcpt NoClassDefFoundError))#frs,sh)\"\n by(clarsimp simp: exec_all_def1 intro!: r_into_rtrancl exec_1I)\n\nlemma exec_ErrorThrowing:\n \"sh C = \\<lfloor>(sfs,Error)\\<rfloor>\n  \\<Longrightarrow> exec (P, (None,h,calling_to_throwing (stk,loc,D,M,pc,Calling C Cs) a#frs,sh))\n   = Some (None,h,calling_to_sthrowing (stk,loc,D,M,pc,Calling C Cs) a #frs,sh)\"\n by(clarsimp simp: exec_all_def1 fun_upd_idem_iff intro!: r_into_rtrancl exec_1I)\n\nlemma jvm_InitObj:\n \"\\<lbrakk> sh C = Some(sfs,Prepared);\n     C = Object;\n     sh' = sh(C \\<mapsto> (sfs,Processing)) \\<rbrakk>\n\\<Longrightarrow> P \\<turnstile> (None, h, (vs,ls,C\\<^sub>0,M,pc,Calling C Cs)#frs, sh) -jvm\\<rightarrow>\n    (None, h, (vs,ls,C\\<^sub>0,M,pc,Called (C#Cs))#frs,sh')\"\n(is \"\\<lbrakk> ?P; ?Q; ?R \\<rbrakk> \\<Longrightarrow> P \\<turnstile> ?s1 -jvm\\<rightarrow> ?s2\")\nproof -\n  assume assms: ?P ?Q ?R\n  then have \"exec (P, ?s1) = \\<lfloor>?s2\\<rfloor>\"\n    by(case_tac \"method P C clinit\") simp\n  then have \"(?s1, ?s2) \\<in> (exec_1 P)\\<^sup>*\"\n    by(rule exec_1I[THEN r_into_rtrancl])\n  then show ?thesis by(simp add: exec_all_def1)\nqed\n\nlemma jvm_InitNonObj:\n \"\\<lbrakk> sh C = Some(sfs,Prepared);\n     C \\<noteq> Object;\n     class P C = Some (D,r);\n     sh' = sh(C \\<mapsto> (sfs,Processing)) \\<rbrakk>\n\\<Longrightarrow> P \\<turnstile> (None, h, (vs,ls,C\\<^sub>0,M,pc,Calling C Cs)#frs, sh) -jvm\\<rightarrow>\n    (None, h, (vs,ls,C\\<^sub>0,M,pc,Calling D (C#Cs))#frs, sh')\"\n(is \"\\<lbrakk> ?P; ?Q; ?R; ?S \\<rbrakk> \\<Longrightarrow> P \\<turnstile> ?s1 -jvm\\<rightarrow> ?s2\")\nproof -\n  assume assms: ?P ?Q ?R ?S\n  then have \"exec (P, ?s1) = \\<lfloor>?s2\\<rfloor>\"\n    by(case_tac \"method P C clinit\") simp\n  then have \"(?s1, ?s2) \\<in> (exec_1 P)\\<^sup>*\"\n    by(rule exec_1I[THEN r_into_rtrancl])\n  then show ?thesis by(simp add: exec_all_def1)\nqed\n\nlemma jvm_RInit_throw:\n \"P \\<turnstile> (None,h,(vs,l,C,M,pc,Throwing [] xa) # frs,sh)\n        -jvm\\<rightarrow> handle P C M xa h vs l pc No_ics frs sh\"\n(is \"P \\<turnstile> ?s1 -jvm\\<rightarrow> ?s2\")\nproof -\n  have \"exec (P, ?s1) = \\<lfloor>?s2\\<rfloor>\"\n    by(simp add: handle_def split: bool.splits)\n  then have \"(?s1, ?s2) \\<in> (exec_1 P)\\<^sup>*\"\n    by(rule exec_1I[THEN r_into_rtrancl])\n  then show ?thesis by(simp add: exec_all_def1)\nqed\n\nlemma jvm_RInit_throw':\n \"P \\<turnstile> (None,h,(vs,l,C,M,pc,Throwing [C'] xa) # frs,sh)\n        -jvm\\<rightarrow> handle P C M xa h vs l pc No_ics frs (sh(C':=Some(fst(the(sh C')), Error)))\"\n(is \"P \\<turnstile> ?s1 -jvm\\<rightarrow> ?s2\")\nproof -\n  let ?sy = \"(None,h,(vs,l,C,M,pc,Throwing [] xa) # frs,sh(C':=Some(fst(the(sh C')), Error)))\"\n  have \"exec (P, ?s1) = \\<lfloor>?sy\\<rfloor>\" by simp\n  then have \"(?s1, ?sy) \\<in> (exec_1 P)\\<^sup>*\"\n    by(rule exec_1I[THEN r_into_rtrancl])\n  also have \"(?sy, ?s2) \\<in> (exec_1 P)\\<^sup>*\"\n    using jvm_RInit_throw by(simp add: exec_all_def1)\n  ultimately show ?thesis by(simp add: exec_all_def1)\nqed\n\nlemma jvm_Called:\n \"P \\<turnstile> (None, h, (vs, l, C, M, pc, Called (C\\<^sub>0 # Cs)) # frs, sh) -jvm\\<rightarrow>\n    (None, h, create_init_frame P C\\<^sub>0 # (vs, l, C, M, pc, Called Cs) # frs, sh)\"\n by(simp add: exec_all_def1 r_into_rtrancl exec_1I)\n\nlemma jvm_Throwing:\n \"P \\<turnstile> (None, h, (vs, l, C, M, pc, Throwing (C\\<^sub>0#Cs) xa') # frs, sh) -jvm\\<rightarrow>\n    (None, h, (vs, l, C, M, pc, Throwing Cs xa') # frs, sh(C\\<^sub>0 \\<mapsto> (fst (the (sh C\\<^sub>0)), Error)))\"\n by(simp add: exec_all_def1 r_into_rtrancl exec_1I)\n\nsubsubsection \"Other lemmas for correctness proof\"\n\nlemma assumes wf:\"wf_prog wf_md P\"\n and ex: \"class P C = Some a\"\nshows create_init_frame_wf_eq: \"create_init_frame (compP\\<^sub>2 P) C = (stk,loc,D,M,pc,ics) \\<Longrightarrow> D=C\"\nusing wf_sees_clinit[OF wf ex] by(cases \"method P C clinit\", auto)\n\nlemma beforex_try:\nassumes pcI: \"{pc..<pc+size(compE\\<^sub>2(try e\\<^sub>1 catch(Ci i) e\\<^sub>2))} \\<subseteq> I\"\n  and bx: \"P,C,M \\<rhd> compxE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2) pc (size vs) / I,size vs\"\nshows \"P,C,M \\<rhd> compxE\\<^sub>2 e\\<^sub>1 pc (size vs) / {pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)},size vs\"\nproof -\n  obtain xt\\<^sub>0 xt\\<^sub>1 where\n   \"beforex\\<^sub>0 P C M (size vs) I (compxE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2) pc (size vs)) xt\\<^sub>0 xt\\<^sub>1\"\n    using bx by(clarsimp simp:beforex_def)\n  then have \"\\<exists>xt1. beforex\\<^sub>0 P C M (size vs) {pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)}\n                   (compxE\\<^sub>2 e\\<^sub>1 pc (size vs)) xt\\<^sub>0 xt1\"\n    using pcI pcs_subset(1) atLeastLessThan_iff by simp blast\n  then show ?thesis using beforex_def by blast\nqed\n\n\\<comment> \\<open> Evaluation of initialization expressions \\<close>\n\n(* --needs J1 and EConform; version for eval found in Equivalence *)\nlemma\nshows eval\\<^sub>1_init_return: \"P \\<turnstile>\\<^sub>1 \\<langle>e,s\\<rangle> \\<Rightarrow> \\<langle>e',s'\\<rangle>\n  \\<Longrightarrow> iconf (shp\\<^sub>1 s) e\n  \\<Longrightarrow> (\\<exists>Cs b. e = INIT C' (Cs,b) \\<leftarrow> unit) \\<or> (\\<exists>C e\\<^sub>0 Cs e\\<^sub>i. e = RI(C,e\\<^sub>0);Cs@[C'] \\<leftarrow> unit)\n     \\<or> (\\<exists>e\\<^sub>0. e = RI(C',e\\<^sub>0);Nil \\<leftarrow> unit)\n  \\<Longrightarrow> (val_of e' = Some v \\<longrightarrow> (\\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,i)\\<rfloor> \\<and> (i = Done \\<or> i = Processing)))\n   \\<and> (throw_of e' = Some a \\<longrightarrow> (\\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,Error)\\<rfloor>))\"\nand \"P \\<turnstile>\\<^sub>1 \\<langle>es,s\\<rangle> [\\<Rightarrow>] \\<langle>es',s'\\<rangle> \\<Longrightarrow> True\"\nproof(induct rule: eval\\<^sub>1_evals\\<^sub>1.inducts)\n  case (InitFinal\\<^sub>1 e s e' s' C b) then show ?case\n    by(auto simp: initPD_def dest: eval\\<^sub>1_final_same)\nnext\n  case (InitDone\\<^sub>1 sh C sfs C' Cs e h l e' s')\n  then have \"final e'\" using eval\\<^sub>1_final by simp\n  then show ?case\n  proof(rule finalE)\n    fix v assume e': \"e' = Val v\" then show ?thesis using InitDone\\<^sub>1 initPD_def\n    proof(cases Cs) qed(auto)\n  next\n    fix a assume e': \"e' = throw a\" then show ?thesis using InitDone\\<^sub>1 initPD_def\n    proof(cases Cs) qed(auto)\n  qed\nnext\n  case (InitProcessing\\<^sub>1 sh C sfs C' Cs e h l e' s')\n  then have \"final e'\" using eval\\<^sub>1_final by simp\n  then show ?case\n  proof(rule finalE)\n    fix v assume e': \"e' = Val v\" then show ?thesis using InitProcessing\\<^sub>1 initPD_def\n    proof(cases Cs) qed(auto)\n  next\n    fix a assume e': \"e' = throw a\" then show ?thesis using InitProcessing\\<^sub>1 initPD_def\n    proof(cases Cs) qed(auto)\n  qed\nnext\n  case (InitError\\<^sub>1 sh C sfs Cs e h l e' s' C') show ?case\n  proof(cases Cs)\n    case Nil then show ?thesis using InitError\\<^sub>1 by simp\n  next\n    case (Cons C2 list)\n    then have \"final e'\" using InitError\\<^sub>1 eval\\<^sub>1_final by simp\n    then show ?thesis\n    proof(rule finalE)\n      fix v assume e': \"e' = Val v\" show ?thesis\n        using InitError\\<^sub>1.hyps(2) e' rinit\\<^sub>1_throwE by blast\n    next\n      fix a assume e': \"e' = throw a\"\n      then show ?thesis using Cons InitError\\<^sub>1 cons_to_append[of list] by clarsimp\n    qed\n  qed\nnext\n  case (InitRInit\\<^sub>1 C Cs h l sh e' s' C') show ?case\n  proof(cases Cs)\n    case Nil then show ?thesis using InitRInit\\<^sub>1 by simp\n  next\n    case (Cons C' list) then show ?thesis\n      using InitRInit\\<^sub>1 Cons cons_to_append[of list] by clarsimp\n  qed\nnext\n  case (RInit\\<^sub>1 e s v h' l' sh' C sfs i sh'' C' Cs e' e\\<^sub>1 s\\<^sub>1)\n  then have final: \"final e\\<^sub>1\" using eval\\<^sub>1_final by simp\n  then show ?case\n  proof(cases Cs)\n    case Nil show ?thesis using final\n    proof(rule finalE)\n      fix v assume e': \"e\\<^sub>1 = Val v\" show ?thesis\n      using RInit\\<^sub>1 Nil by(clarsimp, meson fun_upd_same initPD_def)\n    next\n      fix a assume e': \"e\\<^sub>1 = throw a\" show ?thesis\n      using RInit\\<^sub>1 Nil by(clarsimp, meson fun_upd_same initPD_def)\n    qed\n  next\n    case (Cons a list) show ?thesis using final\n    proof(rule finalE)\n      fix v assume e': \"e\\<^sub>1 = Val v\" then show ?thesis\n      using RInit\\<^sub>1 Cons by(clarsimp, metis last.simps last_appendR list.distinct(1))\n    next\n      fix a assume e': \"e\\<^sub>1 = throw a\" then show ?thesis\n      using RInit\\<^sub>1 Cons by(clarsimp, metis last.simps last_appendR list.distinct(1))\n    qed\n  qed\nnext\n  case (RInitInitFail\\<^sub>1 e s a h' l' sh' C sfs i sh'' D Cs e' e\\<^sub>1 s\\<^sub>1)\n  then have final: \"final e\\<^sub>1\" using eval\\<^sub>1_final by simp\n  then show ?case\n  proof(rule finalE)\n    fix v assume e': \"e\\<^sub>1 = Val v\" then show ?thesis\n    using RInitInitFail\\<^sub>1 by(clarsimp, meson exp.distinct(101) rinit\\<^sub>1_throwE)\n  next\n    fix a' assume e': \"e\\<^sub>1 = Throw a'\"\n    then have \"iconf (sh'(C \\<mapsto> (sfs, Error))) a\"\n      using RInitInitFail\\<^sub>1.hyps(1) eval\\<^sub>1_final by fastforce\n    then show ?thesis using RInitInitFail\\<^sub>1 e'\n      by(clarsimp, meson Cons_eq_append_conv list.inject)\n  qed\nqed(auto simp: fun_upd_same)\n\nlemma init\\<^sub>1_Val_PD: \"P \\<turnstile>\\<^sub>1 \\<langle>INIT C' (Cs,b) \\<leftarrow> unit,s\\<rangle> \\<Rightarrow> \\<langle>Val v,s'\\<rangle>\n  \\<Longrightarrow> iconf (shp\\<^sub>1 s) (INIT C' (Cs,b) \\<leftarrow> unit)\n  \\<Longrightarrow> \\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,i)\\<rfloor> \\<and> (i = Done \\<or> i = Processing)\"\n by(drule_tac v = v in eval\\<^sub>1_init_return, simp+)\n\nlemma init\\<^sub>1_throw_PD: \"P \\<turnstile>\\<^sub>1 \\<langle>INIT C' (Cs,b) \\<leftarrow> unit,s\\<rangle> \\<Rightarrow> \\<langle>throw a,s'\\<rangle>\n  \\<Longrightarrow> iconf (shp\\<^sub>1 s) (INIT C' (Cs,b) \\<leftarrow> unit)\n  \\<Longrightarrow> \\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,Error)\\<rfloor>\"\n by(drule_tac a = a in eval\\<^sub>1_init_return, simp+)\n\nlemma rinit\\<^sub>1_Val_PD:\nassumes eval: \"P \\<turnstile>\\<^sub>1 \\<langle>RI(C,e\\<^sub>0);Cs \\<leftarrow> unit,s\\<rangle> \\<Rightarrow> \\<langle>Val v,s'\\<rangle>\"\n  and iconf: \"iconf (shp\\<^sub>1 s) (RI(C,e\\<^sub>0);Cs \\<leftarrow> unit)\" and last: \"last(C#Cs) = C'\"\nshows \"\\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,i)\\<rfloor> \\<and> (i = Done \\<or> i = Processing)\"\nproof(cases Cs)\n  case Nil\n  then show ?thesis using eval\\<^sub>1_init_return[OF eval iconf] last by simp\nnext\n  case (Cons a list)\n  then have nNil: \"Cs \\<noteq> []\" by simp\n  then have \"\\<exists>Cs'. Cs = Cs' @ [C']\" using last append_butlast_last_id[OF nNil]\n    by(rule_tac x=\"butlast Cs\" in exI) simp\n  then show ?thesis using eval\\<^sub>1_init_return[OF eval iconf] by simp\nqed\n\nlemma rinit\\<^sub>1_throw_PD:\nassumes eval: \"P \\<turnstile>\\<^sub>1 \\<langle>RI(C,e\\<^sub>0);Cs \\<leftarrow> unit,s\\<rangle> \\<Rightarrow> \\<langle>throw a,s'\\<rangle>\"\n  and iconf: \"iconf (shp\\<^sub>1 s) (RI(C,e\\<^sub>0);Cs \\<leftarrow> unit)\" and last: \"last(C#Cs) = C'\"\nshows \"\\<exists>sfs. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,Error)\\<rfloor>\"\nproof(cases Cs)\n  case Nil\n  then show ?thesis using eval\\<^sub>1_init_return[OF eval iconf] last by simp\nnext\n  case (Cons a list)\n  then have nNil: \"Cs \\<noteq> []\" by simp\n  then have \"\\<exists>Cs'. Cs = Cs' @ [C']\" using last append_butlast_last_id[OF nNil]\n    by(rule_tac x=\"butlast Cs\" in exI) simp\n  then show ?thesis using eval\\<^sub>1_init_return[OF eval iconf] by simp\nqed\n\nsubsubsection \"The proof\"\n\nlemma fixes P\\<^sub>1 defines [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\nassumes wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\nshows Jcc: \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>e,(h\\<^sub>0,ls\\<^sub>0,sh\\<^sub>0)\\<rangle> \\<Rightarrow> \\<langle>ef,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\<rangle> \\<Longrightarrow>\n  (\\<And>E C M pc ics v xa vs frs I.\n     \\<lbrakk> Jcc_cond P\\<^sub>1 E C M vs pc ics I h\\<^sub>0 sh\\<^sub>0 e \\<rbrakk> \\<Longrightarrow>\n     (ef = Val v \\<longrightarrow>\n         P \\<turnstile> (None,h\\<^sub>0,Jcc_frames P C M vs ls\\<^sub>0 pc ics frs e,sh\\<^sub>0)\n                -jvm\\<rightarrow> Jcc_rhs P\\<^sub>1 E C M vs ls\\<^sub>0 pc ics frs h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v e)\n     \\<and>\n     (ef = Throw xa \\<longrightarrow> Jcc_err P C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 xa e)\n  )\"\n(*<*)\n  (is \"_ \\<Longrightarrow> (\\<And>E C M pc ics v xa vs frs I.\n                  PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 ef h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs I)\")\n(*>*)\nand \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>0,ls\\<^sub>0,sh\\<^sub>0)\\<rangle> [\\<Rightarrow>] \\<langle>fs,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\<rangle> \\<Longrightarrow>\n    (\\<And>C M pc ics ws xa es' vs frs I.\n      \\<lbrakk> P,C,M,pc \\<rhd> compEs\\<^sub>2 es; P,C,M \\<rhd> compxEs\\<^sub>2 es pc (size vs)/I,size vs;\n       {pc..<pc+size(compEs\\<^sub>2 es)} \\<subseteq> I; ics = No_ics;\n       \\<not>sub_RIs es \\<rbrakk> \\<Longrightarrow>\n      (fs = map Val ws \\<longrightarrow>\n       P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(rev ws @ vs,ls\\<^sub>1,C,M,pc+size(compEs\\<^sub>2 es),ics)#frs,sh\\<^sub>1))\n      \\<and>\n      (fs = map Val ws @ Throw xa # es' \\<longrightarrow>\n       (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compEs\\<^sub>2 es) \\<and>\n                \\<not> caught P pc\\<^sub>1 h\\<^sub>1 xa (compxEs\\<^sub>2 es pc (size vs)) \\<and>\n                (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\n                                     -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1))))\"\n(*<*)\n  (is \"_ \\<Longrightarrow> (\\<And>C M pc ics ws xa es' vs frs I.\n                  PROP ?Ps es h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 fs h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C M pc ics ws xa es' vs frs I)\")\nproof (induct rule:eval\\<^sub>1_evals\\<^sub>1_inducts)\n  case New\\<^sub>1 thus ?case by auto\nnext\n  case (NewFail\\<^sub>1 sh C' sfs h ls)\n  let ?xa = \"addr_of_sys_xcpt OutOfMemory\"\n  have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> handle P C M ?xa h vs ls pc ics frs sh\"\n    using NewFail\\<^sub>1 by(clarsimp simp: handle_def)\n  then show ?case by(auto intro!: exI[where x=\"[]\"])\nnext\n  case (NewInit\\<^sub>1 sh C' h ls v' h' ls' sh' a FDTs h'')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (new C')\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (new C')),ics)#frs,sh'), err)\"\n    using NewInit\\<^sub>1.prems(1) by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT C' ([C'],False) \\<leftarrow> unit))\"\n    using has_fields_is_class[OF NewInit\\<^sub>1.hyps(5)] by auto\n  then obtain err' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v' xa (INIT C' ([C'],False) \\<leftarrow> unit)\n    = (True, (vs,ls,C,M,pc,Calling C' []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'), err')\"\n    using NewInit\\<^sub>1.prems(1) by auto\n  have IH: \"PROP ?P (INIT C' ([C'],False) \\<leftarrow> unit) h ls sh (Val v')\n             h' ls' sh' E C M pc ics v' xa vs frs I\" by fact\n  have ls: \"ls = ls'\" by(rule init\\<^sub>1_same_loc[OF NewInit\\<^sub>1.hyps(2)])\n  obtain sfs i where sh': \"sh' C' = Some(sfs,i)\"\n    using init\\<^sub>1_Val_PD[OF NewInit\\<^sub>1.hyps(2)] by clarsimp\n  have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling C' [])#frs,sh)\"\n  proof(cases \"sh C'\")\n    case None then show ?thesis using NewInit\\<^sub>1.prems by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using NewInit\\<^sub>1.hyps(1) NewInit\\<^sub>1.prems Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h', (vs, ls, C, M, pc, Called []) # frs, sh')\"\n    using IH pcs' by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h'', (Addr a#vs, ls, C, M, Suc pc, ics) # frs, sh')\"\n    using NewInit\\<^sub>1.hyps(1,2,4-6) NewInit\\<^sub>1.prems sh' by(cases ics) auto\n  finally show ?case using pcs ls by clarsimp\nnext\n  case (NewInitOOM\\<^sub>1 sh C' h ls v' h' ls' sh')\n  let ?xa = \"addr_of_sys_xcpt OutOfMemory\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (new C')\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (new C')),ics)#frs,sh'), err)\"\n    using NewInitOOM\\<^sub>1.prems(1) by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT C' ([C'],False) \\<leftarrow> unit))\" using NewInitOOM\\<^sub>1.hyps(5) by auto\n  then obtain err' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v' xa (INIT C' ([C'],False) \\<leftarrow> unit)\n    = (True, (vs,ls,C,M,pc,Calling C' []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'), err')\"\n    using NewInitOOM\\<^sub>1.prems(1) by auto\n  have IH: \"PROP ?P (INIT C' ([C'],False) \\<leftarrow> unit) h ls sh (Val v')\n             h' ls' sh' E C M pc ics v' xa vs frs I\" by fact\n  have ls: \"ls = ls'\" by(rule init\\<^sub>1_same_loc[OF NewInitOOM\\<^sub>1.hyps(2)])\n  have \"iconf (shp\\<^sub>1 (h, ls, sh)) (INIT C' ([C'],False) \\<leftarrow> unit)\" by simp\n  then obtain sfs i where sh': \"sh' C' = Some(sfs,i)\"\n    using init\\<^sub>1_Val_PD[OF NewInitOOM\\<^sub>1.hyps(2)] by clarsimp\n  have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling C' [])#frs,sh)\"\n  proof(cases \"sh C'\")\n    case None then show ?thesis using NewInitOOM\\<^sub>1.prems by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using NewInitOOM\\<^sub>1.hyps(1) NewInitOOM\\<^sub>1.prems Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h', (vs, ls, C, M, pc, Called []) # frs, sh')\"\n    using IH pcs' by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h' vs ls pc ics frs sh'\"\n    using NewInitOOM\\<^sub>1.hyps(1,2,4,5) NewInitOOM\\<^sub>1.prems sh' by(auto simp: handle_def)\n  finally show ?case using pcs ls by(simp, metis (no_types) append_Nil le_refl lessI)\nnext\n  case (NewInitThrow\\<^sub>1 sh C' h ls a h' ls' sh')\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (new C')\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (new C')),ics)#frs,sh'), err)\"\n    using NewInitThrow\\<^sub>1.prems(1) by clarsimp\n  obtain a' where throw: \"throw a = Throw a'\" using eval\\<^sub>1_final[OF NewInitThrow\\<^sub>1.hyps(2)] by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT C' ([C'],False) \\<leftarrow> unit))\" using NewInitThrow\\<^sub>1.hyps(4) by auto\n  then obtain vs' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v a' (INIT C' ([C'],False) \\<leftarrow> unit)\n    = (True, (vs,ls,C,M,pc,Calling C' []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'),\n        P \\<turnstile> (None,h,(vs,ls,C,M,pc,Calling C' []) # frs,sh)\n               -jvm\\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh')\"\n    using NewInitThrow\\<^sub>1.prems(1) by simp blast\n  have IH: \"PROP ?P (INIT C' ([C'],False) \\<leftarrow> unit) h ls sh (throw a)\n             h' ls' sh' E C M pc ics v a' vs frs I\" by fact\n  have ls: \"ls = ls'\" by(rule init\\<^sub>1_same_loc[OF NewInitThrow\\<^sub>1.hyps(2)])\n  then have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling C' []) # frs,sh)\"\n  proof(cases \"sh C'\")\n    case None then show ?thesis using NewInitThrow\\<^sub>1.prems by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using NewInitThrow\\<^sub>1.hyps(1) NewInitThrow\\<^sub>1.prems Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh'\" using IH pcs' throw by auto\n  finally show ?case using throw ls by auto\nnext\n  case (Cast\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 D fs C')\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (Cast C' e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (Cast C' e)),ics)#frs,sh\\<^sub>1), err)\"\n    using Cast\\<^sub>1.prems(1) by auto\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs I\" by fact\n  then have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using Jcc_pieces_Cast[OF assms(1) pcs, of \"Addr a\"] Cast\\<^sub>1.prems pcs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1)\"\n    using Cast\\<^sub>1 by (auto simp add:cast_ok_def)\n  finally show ?case by auto\nnext\n  case (CastNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C')\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (Cast C' e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (Cast C' e)),ics)#frs,sh\\<^sub>1), err)\"\n    using CastNull\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 null h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics Null xa vs frs I\" by fact\n  then have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using Jcc_pieces_Cast[OF assms(1) pcs, of Null] CastNull\\<^sub>1.prems pcs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1)\"\n    using CastNull\\<^sub>1 by (auto simp add:cast_ok_def)\n  finally show ?case by auto\nnext\n  case (CastFail\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 D fs C')\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?xa = \"addr_of_sys_xcpt ClassCast\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (Cast C' e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (Cast C' e)),ics)#frs,sh\\<^sub>1), err)\"\n    using CastFail\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs I\" by fact\n  then have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using Jcc_pieces_Cast[OF assms(1) pcs, of \"Addr a\"] CastFail\\<^sub>1.prems pcs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (Addr a#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using CastFail\\<^sub>1 by (auto simp add:handle_def cast_ok_def)\n  finally have exec: \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow> \\<dots>\".\n  show ?case (is \"?N \\<and> (?eq \\<longrightarrow> ?err)\")\n  proof\n    show ?N by simp\n  next\n    { assume ?eq\n      then have ?err using exec by (auto intro!: exI[where x=\"?pc\"] exI[where x=\"[Addr a]\"])\n    }\n    thus \"?eq \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (CastThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e' h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C')\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (Cast C' e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (Cast C' e)),ics)#frs,sh\\<^sub>1), err)\"\n    using CastThrow\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e') h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs I\" by fact\n  show ?case using IH Jcc_pieces_Cast[OF assms(1) pcs, of v] CastThrow\\<^sub>1.prems pcs less_SucI\n   by(simp, blast)\nnext\n  case Val\\<^sub>1 thus ?case by auto\nnext\n  case Var\\<^sub>1 thus ?case by auto\nnext\n  case (BinOp\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 v\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 v\\<^sub>2 h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 bop w)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using BinOp\\<^sub>1.prems(1) by clarsimp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val v\\<^sub>1) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v\\<^sub>1 xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val v\\<^sub>2) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics v\\<^sub>2 xa (v\\<^sub>1#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using IH\\<^sub>1 Jcc_pieces_BinOp1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v\\<^sub>1] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(v\\<^sub>2#v\\<^sub>1#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using IH\\<^sub>2 Jcc_pieces_BinOp2[OF assms(1) pcs, of h\\<^sub>1 v\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v\\<^sub>2] by (simp add: add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(w#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>2)\"\n    using BinOp\\<^sub>1 by(cases bop) auto\n  finally show ?case using pcs by (auto split: bop.splits simp:add.assoc)\nnext\n  case (BinOpThrow\\<^sub>1\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 bop e\\<^sub>2)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using BinOpThrow\\<^sub>1\\<^sub>1.prems(1) by clarsimp\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  show ?case using IH\\<^sub>1 Jcc_pieces_BinOp1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v] BinOpThrow\\<^sub>1\\<^sub>1.prems nsub_RI_Jcc_pieces\n    by auto\nnext\n  case (BinOpThrow\\<^sub>2\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 v\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 e h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 bop)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using BinOpThrow\\<^sub>2\\<^sub>1.prems(1) by clarsimp\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val v\\<^sub>1) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v\\<^sub>1 xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw e) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc ics v xa (v\\<^sub>1#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n  have 1: \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\"\n    using IH\\<^sub>1 Jcc_pieces_BinOp1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v\\<^sub>1] by simp\n  have \"(throw e = Val v \\<longrightarrow>  P \\<turnstile> (None, h\\<^sub>0, Jcc_frames P C M vs ls\\<^sub>0 pc ics frs (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2), sh\\<^sub>0) -jvm\\<rightarrow>\n     Jcc_rhs P\\<^sub>1 E C M vs ls\\<^sub>0 pc ics frs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2))\n   \\<and> (throw e = Throw xa \\<longrightarrow> (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)) \\<and>\n               \\<not> caught P pc\\<^sub>1 h\\<^sub>2 xa (compxE\\<^sub>2 (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2) pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>1 ics frs sh\\<^sub>2)))\"\n   (is \"?N \\<and> (?eq \\<longrightarrow> (\\<exists>pc\\<^sub>2. ?H pc\\<^sub>2))\")\n  proof\n    show ?N by simp\n  next\n    { assume ?eq\n      then obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc + size(compE\\<^sub>2 e\\<^sub>2) \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc (size vs + 1))\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@v\\<^sub>1#vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using IH\\<^sub>2 Jcc_pieces_BinOp2[OF assms(1) pcs, of h\\<^sub>1 v\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v] BinOpThrow\\<^sub>2\\<^sub>1.prems by clarsimp\n      then have \"?H pc\\<^sub>2\" using jvm_trans[OF 1 2] by(auto intro!: exI[where x=\"vs'@[v\\<^sub>1]\"])\n      hence \"\\<exists>pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n    }\n    thus \"?eq \\<longrightarrow> (\\<exists>pc\\<^sub>2. ?H pc\\<^sub>2)\" by iprover\n  qed\n  then show ?case using pcs by simp blast\nnext\n  case (FAcc\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' fs F T D w)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<bullet>F{D})),ics)#frs,sh\\<^sub>1), err)\"\n    using FAcc\\<^sub>1.prems(1) by clarsimp\n  have \"P\\<^sub>1 \\<turnstile> D sees F,NonStatic:T in D\" by(rule has_field_sees[OF has_field_idemp[OF FAcc\\<^sub>1.hyps(4)]])\n  then have field: \"field P D F = (D,NonStatic,T)\" by simp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_FAcc[OF pcs, of \"Addr a\"] pcs by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1)\"\n    using FAcc\\<^sub>1 field by auto\n  finally have \"P \\<turnstile> (None, h\\<^sub>0, frs', sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1)\"\n    by auto\n  then show ?case using pcs by auto\nnext\n  case (FAccNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 F D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<bullet>F{D})),ics)#frs,sh\\<^sub>1), err)\"\n    using FAccNull\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 null h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics Null xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?xa = \"addr_of_sys_xcpt NullPointer\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_FAcc[OF pcs, of Null] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (Null#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using FAccNull\\<^sub>1.prems\n    by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x=\"[Null]\"])\nnext\n  case (FAccThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e' h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 F D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<bullet>F{D})),ics)#frs,sh\\<^sub>1), err)\"\n    using FAccThrow\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e') h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs I\" by fact\n  show ?case using IH Jcc_pieces_FAcc[OF pcs, of v] FAccThrow\\<^sub>1.prems nsub_RI_Jcc_pieces\n    less_Suc_eq by auto\nnext\n  case (FAccNone\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C fs F D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<bullet>F{D})),ics)#frs,sh\\<^sub>1), err)\"\n    using FAccNone\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?xa = \"addr_of_sys_xcpt NoSuchFieldError\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_FAcc[OF pcs, of \"Addr a\"] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (Addr a#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using FAccNone\\<^sub>1\n    by(cases ics; clarsimp simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x=\"[Addr a]\"])\nnext\n  case (FAccStatic\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' fs F T D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<bullet>F{D})),ics)#frs,sh\\<^sub>1), err)\"\n    using FAccStatic\\<^sub>1.prems(1) by clarsimp\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:T in D\" by(rule has_field_sees[OF has_field_idemp[OF FAccStatic\\<^sub>1.hyps(4)]])\n  then have field: \"field P D F = (D,Static,T)\" by simp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_FAcc[OF pcs, of \"Addr a\"] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (Addr a#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using FAccStatic\\<^sub>1 field by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x=\"[Addr a]\"])\nnext\n  case (SFAcc\\<^sub>1 C' F t D sh sfs v' h ls)\n  have has: \"P\\<^sub>1 \\<turnstile> D has F,Static:t in D\" by(rule has_field_idemp[OF SFAcc\\<^sub>1.hyps(1)])\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:t in D\" by(rule has_field_sees[OF has])\n  then have field: \"field P D F = (D,Static,t)\" by simp\n  then have \"P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs (C'\\<bullet>\\<^sub>sF{D}),sh) -jvm\\<rightarrow>\n             (None,h,(v'#vs,ls,C,M,Suc pc,ics)#frs,sh)\"\n    using SFAcc\\<^sub>1 has by(cases ics) auto\n  then show ?case by clarsimp\nnext\n  case (SFAccInit\\<^sub>1 C' F t D sh h ls v' h' ls' sh' sfs i v'')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C'\\<bullet>\\<^sub>sF{D})\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D})),ics)#frs,sh'), err)\"\n    using SFAccInit\\<^sub>1.prems(1) by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT D ([D],False) \\<leftarrow> unit))\"\n    using has_field_is_class'[OF SFAccInit\\<^sub>1.hyps(1)] by auto\n  then obtain err' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v' xa (INIT D ([D],False) \\<leftarrow> unit)\n    = (True, (vs,ls,C,M,pc,Calling D []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'), err')\"\n    using SFAccInit\\<^sub>1.prems(1) by auto\n  have IH: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h ls sh (Val v')\n             h' ls' sh' E C M pc ics v' xa vs frs I\" by fact\n  have ls: \"ls = ls'\" by(rule init\\<^sub>1_same_loc[OF SFAccInit\\<^sub>1.hyps(3)])\n  have has: \"P\\<^sub>1 \\<turnstile> D has F,Static:t in D\" by(rule has_field_idemp[OF SFAccInit\\<^sub>1.hyps(1)])\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:t in D\" by(rule has_field_sees[OF has])\n  then have field: \"field P D F = (D,Static,t)\" by simp\n  have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling D [])#frs,sh)\"\n  proof(cases \"sh D\")\n    case None then show ?thesis using SFAccInit\\<^sub>1.hyps(1,2,5,6) SFAccInit\\<^sub>1.prems field\n      by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using SFAccInit\\<^sub>1.hyps(1,2,5,6) SFAccInit\\<^sub>1.prems field Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None, h', (vs, ls, C, M, pc, Called []) # frs, sh')\"\n    using IH pcs' by auto\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None, h', (v''#vs, ls, C, M, Suc pc, ics) # frs, sh')\"\n    using SFAccInit\\<^sub>1.hyps(1,2,5,6) SFAccInit\\<^sub>1.prems has field by(cases ics) auto\n  finally show ?case using pcs ls by clarsimp\nnext\n  case (SFAccInitThrow\\<^sub>1 C' F t D sh h ls a h' ls' sh')\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C'\\<bullet>\\<^sub>sF{D})\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D})),ics)#frs,sh'), err)\"\n    using SFAccInitThrow\\<^sub>1.prems(1) by clarsimp\n  obtain a' where throw: \"throw a = Throw a'\" using eval\\<^sub>1_final[OF SFAccInitThrow\\<^sub>1.hyps(3)] by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT D ([D],False) \\<leftarrow> unit))\"\n    using has_field_is_class'[OF SFAccInitThrow\\<^sub>1.hyps(1)] by auto\n  then obtain vs' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v a' (INIT D ([D],False) \\<leftarrow> unit)\n    = (True, (vs,ls,C,M,pc,Calling D []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'),\n        P \\<turnstile> (None,h,(vs,ls,C,M,pc,Calling D []) # frs,sh)\n               -jvm\\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh')\"\n    using SFAccInitThrow\\<^sub>1.prems(1) by simp blast\n  have IH: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h ls sh (throw a)\n             h' ls' sh' E C M pc ics v a' vs frs I\" by fact\n  have ls: \"ls = ls'\" by(rule init\\<^sub>1_same_loc[OF SFAccInitThrow\\<^sub>1.hyps(3)])\n  have has: \"P\\<^sub>1 \\<turnstile> D has F,Static:t in D\" by(rule has_field_idemp[OF SFAccInitThrow\\<^sub>1.hyps(1)])\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:t in D\" by(rule has_field_sees[OF has])\n  then have field: \"field P D F = (D,Static,t)\" by simp\n  then have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling D []) # frs,sh)\"\n  proof(cases \"sh D\")\n    case None then show ?thesis using SFAccInitThrow\\<^sub>1.hyps(1,2) SFAccInitThrow\\<^sub>1.prems field\n      by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using SFAccInitThrow\\<^sub>1.hyps(1,2) SFAccInitThrow\\<^sub>1.prems field Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh'\"\n    using IH pcs' throw by auto\n  finally show ?case using throw ls by auto\nnext\n  case (SFAccNone\\<^sub>1 C' F D h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1)\n  then obtain frs' err where pcs:\n   \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 vs ls\\<^sub>1 pc ics frs sh\\<^sub>1 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (C'\\<bullet>\\<^sub>sF{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D})),ics)#frs,sh\\<^sub>1), err)\"\n    by clarsimp\n  let ?xa = \"addr_of_sys_xcpt NoSuchFieldError\"\n  have \"P \\<turnstile> (None,h\\<^sub>1,frs',sh\\<^sub>1) -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 vs ls\\<^sub>1 pc ics frs sh\\<^sub>1\"\n    using SFAccNone\\<^sub>1 pcs\n    by(cases ics; clarsimp simp:split_beta handle_def simp del: split_paired_Ex)\n  then show ?case using pcs by(auto intro!: exI[where x = pc] exI[where x=\"[]\"])\nnext\n  case (SFAccNonStatic\\<^sub>1 C' F t D h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1)\n  let ?frs' = \"(vs, ls\\<^sub>1, C, M, pc, ics) # frs\"\n  let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n  have \"P\\<^sub>1 \\<turnstile> D sees F,NonStatic:t in D\"\n    by(rule has_field_sees[OF has_field_idemp[OF SFAccNonStatic\\<^sub>1.hyps(1)]])\n  then have field: \"field P D F = (D,NonStatic,t)\" by simp\n  have \"P \\<turnstile> (None,h\\<^sub>1,?frs',sh\\<^sub>1) -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 vs ls\\<^sub>1 pc ics frs sh\\<^sub>1\"\n    using SFAccNonStatic\\<^sub>1\n    proof(cases ics)\n      case No_ics\n      then show ?thesis using SFAccNonStatic\\<^sub>1 field\n       by (auto simp:split_beta handle_def simp del: split_paired_Ex)\n    qed(simp_all)\n  then show ?case by (auto intro!: exI[where x = pc] exI[where x=\"[]\"])\nnext\n  case (LAss\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 i ls\\<^sub>2)\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (i:=e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (i:=e)),ics)#frs,sh\\<^sub>1), err)\"\n    using LAss\\<^sub>1.prems(1) by auto\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  then have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using Jcc_pieces_LAss[OF assms(1) pcs, of w] LAss\\<^sub>1.prems pcs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(Unit#vs,ls\\<^sub>2,C,M,?pc+2,ics)#frs,sh\\<^sub>1)\"\n    using LAss\\<^sub>1 by (auto simp add:cast_ok_def)\n  finally show ?case by auto\nnext\n  case (LAssThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 i)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (i:=e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (i:=e)),ics)#frs,sh\\<^sub>1), err)\"\n    using LAssThrow\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs I\" by fact\n  show ?case using IH Jcc_pieces_LAss[OF assms(1) pcs, of v] LAssThrow\\<^sub>1.prems pcs less_SucI\n    by(simp, blast)\nnext\n  case (FAss\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 w h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' fs F T D fs' h\\<^sub>2')\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using FAss\\<^sub>1.prems(1) by clarsimp\n  have \"P\\<^sub>1 \\<turnstile> D sees F,NonStatic:T in D\" by(rule has_field_sees[OF has_field_idemp[OF FAss\\<^sub>1.hyps(6)]])\n  then have field: \"field P D F = (D,NonStatic,T)\" by simp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val w) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics w xa (Addr a#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 \"Addr a\"] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(w#Addr a#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using IH\\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 \"Addr a\" ls\\<^sub>1 sh\\<^sub>1 w] by (simp add: add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2',(Unit#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2+2,ics)#frs,sh\\<^sub>2)\"\n    using FAss\\<^sub>1 field by auto\n  finally show ?case using pcs by (auto simp:add.assoc)\nnext\n  case (FAssNull\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 w h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 F D)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using FAssNull\\<^sub>1.prems(1) by clarsimp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt NullPointer\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 null h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics Null xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val w) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics w xa (Null#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 Null] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(w#Null#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using IH\\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 Null ls\\<^sub>1 sh\\<^sub>1 w] by (simp add: add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (w#Null#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using FAssNull\\<^sub>1 by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"w#[Null]\"])\nnext\n  case (FAssThrow\\<^sub>2\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 F D)\n  let ?frs' = \"(vs, ls\\<^sub>0, C, M, pc, ics) # frs\"\n  obtain err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, ?frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using FAssThrow\\<^sub>2\\<^sub>1.prems(1) by clarsimp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw e') h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics v xa (w#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have 1: \"P \\<turnstile> (None,h\\<^sub>0,?frs',sh\\<^sub>0) -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\"\n    using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 w] by simp\n  show ?case (is \"?N \\<and> (?eq \\<longrightarrow> ?err)\")\n  proof\n    show ?N by simp\n  next\n    { assume ?eq\n      moreover\n      have \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw e') h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics v xa (w#vs) frs\n                    (I - pcs (compxE\\<^sub>2 e\\<^sub>1 pc (length vs)))\" by fact\n      ultimately obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>1 + size(compE\\<^sub>2 e\\<^sub>2) \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>1 (size vs + 1))\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@w#vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using FAssThrow\\<^sub>2\\<^sub>1.prems Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 w ls\\<^sub>1 sh\\<^sub>1] by auto\n      have ?err using Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 w ls\\<^sub>1 sh\\<^sub>1] pc\\<^sub>2 jvm_trans[OF 1 2]\n        by(auto intro!: exI[where x=pc\\<^sub>2] exI[where x=\"vs'@[w]\"])\n    }\n    thus \"?eq \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (FAssThrow\\<^sub>1\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e' h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 F D e\\<^sub>2)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using FAssThrow\\<^sub>1\\<^sub>1.prems(1) by clarsimp\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e') h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  show ?case using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v] FAssThrow\\<^sub>1\\<^sub>1.prems nsub_RI_Jcc_pieces\n    by auto\nnext\n  case (FAssNone\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 w h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' fs F D)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using FAssNone\\<^sub>1.prems(1) by clarsimp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt NoSuchFieldError\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val w) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics w xa (Addr a#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 \"Addr a\"] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(w#Addr a#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using IH\\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 \"Addr a\" ls\\<^sub>1 sh\\<^sub>1 w] by (simp add: add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (w#Addr a#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using FAssNone\\<^sub>1 by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"w#[Addr a]\"])\nnext\n  case (FAssStatic\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 w h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' fs F T D)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using FAssStatic\\<^sub>1.prems(1) by clarsimp\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:T in D\" by(rule has_field_sees[OF has_field_idemp[OF FAssStatic\\<^sub>1.hyps(6)]])\n  then have field: \"field P D F = (D,Static,T)\" by simp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val w) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics w xa (Addr a#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 \"Addr a\"] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(w#Addr a#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using IH\\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 \"Addr a\" ls\\<^sub>1 sh\\<^sub>1 w] by (simp add: add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (w#Addr a#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using FAssStatic\\<^sub>1 field by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"w#[Addr a]\"])\nnext\n  case (SFAss\\<^sub>1 e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F T D sfs sfs' sh\\<^sub>1')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using SFAss\\<^sub>1.prems(1) by clarsimp\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:T in D\" by(rule has_field_sees[OF has_field_idemp[OF SFAss\\<^sub>1.hyps(3)]])\n  then have field: \"field P D F = (D,Static,T)\" by simp\n  have IH: \"PROP ?P e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>2)\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1')\"\n    using SFAss\\<^sub>1.hyps(3-6) SFAss\\<^sub>1.prems(1) field by auto\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None,h\\<^sub>1,(Unit#vs,ls\\<^sub>1,C,M,?pc+2,ics)#frs,sh\\<^sub>1')\"\n    using SFAss\\<^sub>1 by auto\n  finally show ?case using pcs by auto\nnext\n  case (SFAssInit\\<^sub>1 e\\<^sub>2 h ls sh w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F t D v' h' ls' sh' sfs i sfs' sh'')\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>2)\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh'' v xa (C'\\<bullet>\\<^sub>sF{D}:=e\\<^sub>2)\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D}:=e\\<^sub>2)),ics)#frs,sh''), err)\"\n    using SFAssInit\\<^sub>1.prems(1) by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h\\<^sub>1 sh\\<^sub>1 (INIT D ([D],False) \\<leftarrow> unit))\"\n    using has_field_is_class'[OF SFAssInit\\<^sub>1.hyps(3)] by auto\n  then obtain err' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 (w#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1 I h' ls' sh' v' xa (INIT D ([D],False) \\<leftarrow> unit)\n    = (True, (w#vs,ls\\<^sub>1,C,M,?pc,Calling D []) # frs,\n       (None,h',(w#vs,ls\\<^sub>1,C,M,?pc,Called [])#frs,sh'), err')\"\n    using SFAssInit\\<^sub>1.prems(1) by simp\n  have ls: \"ls\\<^sub>1 = ls'\" by(rule init\\<^sub>1_same_loc[OF SFAssInit\\<^sub>1.hyps(5)])\n  have has: \"P\\<^sub>1 \\<turnstile> D has F,Static:t in D\" by(rule has_field_idemp[OF SFAssInit\\<^sub>1.hyps(3)])\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:t in D\" by(rule has_field_sees[OF has])\n  then have field: \"field P D F = (D,Static,t)\" by simp\n  have IH: \"PROP ?P e\\<^sub>2 h ls sh (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  have IHI: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val v')\n             h' ls' sh' E C M ?pc ics v' xa (w#vs) frs I\" by fact\n  have \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_SFAss[OF pcs, where v'=w] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,Calling D [])#frs,sh\\<^sub>1)\"\n  proof(cases \"sh\\<^sub>1 D\")\n    case None then show ?thesis using None SFAssInit\\<^sub>1.hyps(1,3-5,7-9) SFAssInit\\<^sub>1.prems field\n      by(cases ics, auto)\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using SFAssInit\\<^sub>1.hyps(1,3-5,7-9) SFAssInit\\<^sub>1.prems field Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None, h', (w#vs, ls\\<^sub>1, C, M, ?pc, Called []) # frs, sh')\"\n    using IHI pcs' by clarsimp\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None, h', (vs, ls\\<^sub>1, C, M, ?pc + 1, ics) # frs, sh'')\"\n    using SFAssInit\\<^sub>1.hyps(1,3-5,7-9) SFAssInit\\<^sub>1.prems has field by(cases ics) auto\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None, h', (Unit#vs, ls\\<^sub>1, C, M, ?pc + 2, ics) # frs, sh'')\"\n    using SFAssInit\\<^sub>1.hyps(1,3-5,7-9) SFAssInit\\<^sub>1.prems has field by(cases ics) auto\n  finally show ?case using pcs ls by simp blast\nnext\n  case (SFAssInitThrow\\<^sub>1 e\\<^sub>2 h ls sh w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F t D a h' ls' sh')\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>2)\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C'\\<bullet>\\<^sub>sF{D}:=e\\<^sub>2)\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D}:=e\\<^sub>2)),ics)#frs,sh'), err)\"\n    using SFAssInitThrow\\<^sub>1.prems(1) by clarsimp\n  obtain a' where throw: \"throw a = Throw a'\" using eval\\<^sub>1_final[OF SFAssInitThrow\\<^sub>1.hyps(5)] by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h\\<^sub>1 sh\\<^sub>1 (INIT D ([D],False) \\<leftarrow> unit))\"\n    using has_field_is_class'[OF SFAssInitThrow\\<^sub>1.hyps(3)] by auto\n  then obtain vs' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 (w#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1 I h' ls' sh' v a' (INIT D ([D],False) \\<leftarrow> unit)\n    = (True, (w#vs,ls\\<^sub>1,C,M,?pc,Calling D []) # frs, (None,h',(w#vs,ls\\<^sub>1,C,M,?pc,Called [])#frs,sh'),\n         P \\<turnstile> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,Calling D []) # frs,sh\\<^sub>1)\n               -jvm\\<rightarrow> handle P C M a' h' (vs'@w#vs) ls\\<^sub>1 ?pc ics frs sh')\"\n    using SFAssInitThrow\\<^sub>1.prems(1) by simp blast\n  have ls: \"ls\\<^sub>1 = ls'\" by(rule init\\<^sub>1_same_loc[OF SFAssInitThrow\\<^sub>1.hyps(5)])\n  have has: \"P\\<^sub>1 \\<turnstile> D has F,Static:t in D\" by(rule has_field_idemp[OF SFAssInitThrow\\<^sub>1.hyps(3)])\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:t in D\" by(rule has_field_sees[OF has])\n  then have field: \"field P D F = (D,Static,t)\" by simp\n  have IH: \"PROP ?P e\\<^sub>2 h ls sh (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  have IHI: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw a)\n             h' ls' sh' E C M ?pc ics v a' (w#vs) frs I\" by fact\n  have \"P \\<turnstile> (None,h,(vs, ls, C, M, pc, ics) # frs,sh) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp blast\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,Calling D [])#frs,sh\\<^sub>1)\"\n  proof(cases \"sh\\<^sub>1 D\")\n    case None then show ?thesis using SFAssInitThrow\\<^sub>1.hyps(1,3,4,5) SFAssInitThrow\\<^sub>1.prems field\n      by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using SFAssInitThrow\\<^sub>1.hyps(1,3,4,5) SFAssInitThrow\\<^sub>1.prems field Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> handle P C M a' h' (vs'@w#vs) ls\\<^sub>1 ?pc ics frs sh'\"\n    using IHI pcs' throw by auto\n  finally show ?case using throw ls by(auto intro!: exI[where x = ?pc] exI[where x=\"vs'@[w]\"])\nnext\n  case (SFAssThrow\\<^sub>1 e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e' h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using SFAssThrow\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e') h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs I\" by fact\n  show ?case using IH Jcc_pieces_SFAss[OF pcs, where v'=v] SFAssThrow\\<^sub>1.prems nsub_RI_Jcc_pieces\n    less_Suc_eq by auto\nnext\n  case (SFAssNone\\<^sub>1 e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using SFAssNone\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt NoSuchFieldError\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (w#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using SFAssNone\\<^sub>1 by(cases ics; clarsimp simp add: handle_def)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x=\"[w]\"])\nnext\n  case (SFAssNonStatic\\<^sub>1 e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F T D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using SFAssNonStatic\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n  have \"P\\<^sub>1 \\<turnstile> D sees F,NonStatic:T in D\"\n    by(rule has_field_sees[OF has_field_idemp[OF SFAssNonStatic\\<^sub>1.hyps(3)]])\n  then have field: \"field P D F = (D,NonStatic,T)\" by simp\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (w#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using SFAssNonStatic\\<^sub>1\n    proof(cases ics)\n      case No_ics\n      then show ?thesis using SFAssNonStatic\\<^sub>1 field\n       by (auto simp:split_beta handle_def simp del: split_paired_Ex)\n    qed(simp_all)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x=\"[w]\"])\nnext\n  case (Call\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 Ca fs M' Ts T body D ls\\<^sub>2' f h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3)\n  let ?frs\\<^sub>0 = \"(vs, ls\\<^sub>0, C,M,pc,ics)#frs\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,?frs\\<^sub>0,sh\\<^sub>0)\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(Addr a#vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  let ?frs\\<^sub>2 = \"(rev pvs @ Addr a # vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n  let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n  let ?frs\\<^sub>2' = \"([], ls\\<^sub>2', D,M',0,No_ics) # ?frs\\<^sub>2\"\n  let ?\\<sigma>\\<^sub>2' = \"(None, h\\<^sub>2, ?frs\\<^sub>2', sh\\<^sub>2)\"\n  have nclinit: \"M' \\<noteq> clinit\" using wf_sees_clinit1[OF wf] visible_method_exists[OF Call\\<^sub>1.hyps(6)]\n    sees_method_idemp[OF Call\\<^sub>1.hyps(6)] by fastforce\n  have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n  hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n  have invoke: \"P,C,M,?pc\\<^sub>2 \\<triangleright> Invoke M' (length Ts)\"\n    using Call\\<^sub>1.hyps(7) Call\\<^sub>1.prems(1) by clarsimp\n  have nsub: \"\\<not> sub_RI body\" by(rule sees_wf\\<^sub>1_nsub_RI[OF wf Call\\<^sub>1.hyps(6)])\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>3 ls\\<^sub>2 sh\\<^sub>3 v xa (e\\<bullet>M'(es)) =\n    (True, ?frs\\<^sub>0, (None, h\\<^sub>3, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>3), err)\"\n   using Call\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics pvs xa\n                    (map Val pvs) (Addr a#vs) frs (I - pcs(compxE\\<^sub>2 e pc (size vs)))\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Jcc_pieces_Call1[OF pcs] IH by clarsimp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es Call\\<^sub>1.prems by fastforce\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\"\n    using jvm_Invoke[OF assms(1) invoke _ Call\\<^sub>1.hyps(6-8)] Call\\<^sub>1.hyps(5) Call\\<^sub>1.prems(1) by simp\n  finally have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\".\n  have \"P\\<^sub>1 \\<turnstile> Ca sees M',NonStatic: Ts\\<rightarrow>T = body in D\" by fact\n  then have M'_in_D: \"P\\<^sub>1 \\<turnstile> D sees M',NonStatic: Ts\\<rightarrow>T = body in D\"\n    by(rule sees_method_idemp) \n  have M'_code: \"compP\\<^sub>2 P\\<^sub>1,D,M',0 \\<rhd> compE\\<^sub>2 body @ [Return]\" using beforeM M'_in_D by simp\n  have M'_xtab: \"compP\\<^sub>2 P\\<^sub>1,D,M' \\<rhd> compxE\\<^sub>2 body 0 0/{..<size(compE\\<^sub>2 body)},0\"\n    using M'_in_D by(rule beforexM)\n  have IH_body: \"PROP ?P body h\\<^sub>2 ls\\<^sub>2' sh\\<^sub>2 f h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 (Class D # Ts) D M' 0 No_ics v xa [] ?frs\\<^sub>2\n    ({..<size(compE\\<^sub>2 body)})\" by fact\n  have cond: \"Jcc_cond P\\<^sub>1 (Class D # Ts) D M' [] 0 No_ics {..<length (compE\\<^sub>2 body)} h\\<^sub>2 sh\\<^sub>2 body\"\n    using nsub_RI_Jcc_pieces[OF assms(1) nsub] M'_code M'_xtab by clarsimp\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note 1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> (None,h\\<^sub>3,([v],ls\\<^sub>3,D,M',size(compE\\<^sub>2 body),No_ics)#?frs\\<^sub>2,sh\\<^sub>3)\"\n        using val IH_body Call\\<^sub>1.prems M'_code cond nsub_RI_Jcc_pieces nsub by auto\n      also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h\\<^sub>3, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>3)\"\n        using Call\\<^sub>1.hyps(7) M'_code M'_in_D nclinit by(cases T, auto)\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      with IH_body obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"0 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < size(compE\\<^sub>2 body) \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0)\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>2 sh\\<^sub>3\"\n        using Call\\<^sub>1.prems M'_code M'_xtab cond nsub_RI_Jcc_pieces nsub\n         by (auto simp del:split_paired_Ex)\n      have \"handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>2 sh\\<^sub>3 =\n            handle P C M xa h\\<^sub>3 (rev pvs @ Addr a # vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>3\"\n        using pc\\<^sub>2 M'_in_D nclinit by(auto simp add:handle_def)\n      then show \"?err\" using pc\\<^sub>2 jvm_trans[OF 1 2]\n       by(auto intro!:exI[where x=\"?pc\\<^sub>2\"] exI[where x=\"rev pvs@[Addr a]\"])\n    qed\n  qed\nnext\n  case (CallParamsThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es es' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 pvs ex es'' M')\n  let ?frs\\<^sub>0 = \"(vs, ls\\<^sub>0, C,M,pc,ics)#frs\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs, ls\\<^sub>0, C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(w # vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>M'(es)) =\n    (True, ?frs\\<^sub>0, (None, h\\<^sub>2, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>2), err)\"\n   using CallParamsThrow\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Jcc_pieces_Call1[OF pcs] IH by clarsimp\n  have Isubs: \"{?pc\\<^sub>1..<?pc\\<^sub>2} \\<subseteq> I - pcs (compxE\\<^sub>2 e pc (length vs))\"\n    using CallParamsThrow\\<^sub>1.prems by clarsimp\n  show ?case (is \"?N \\<and> (?eq \\<longrightarrow> ?err)\")\n  proof\n    show ?N by simp\n  next\n    { assume ?eq\n      moreover\n      have \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics pvs xa es'' (w#vs) frs\n        (I - pcs (compxE\\<^sub>2 e pc (length vs)))\" by fact\n      ultimately obtain vs' where \"\\<exists>pc\\<^sub>2.\n        (?pc\\<^sub>1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>1 + size(compEs\\<^sub>2 es) \\<and>\n         \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxEs\\<^sub>2 es ?pc\\<^sub>1 (size vs + 1))) \\<and>\n        P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@w#vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        (is \"\\<exists>pc\\<^sub>2. ?PC pc\\<^sub>2 \\<and> ?Exec pc\\<^sub>2\")\n        using CallParamsThrow\\<^sub>1 Isubs by auto\n      then obtain pc\\<^sub>2 where pc\\<^sub>2: \"?PC pc\\<^sub>2\" and 2: \"?Exec pc\\<^sub>2\" by iprover\n      then have \"?err\" using pc\\<^sub>2 jvm_trans[OF 1 2]\n       by(auto intro!: exI[where x=\"pc\\<^sub>2\"] exI[where x=\"vs'@[w]\"])\n    }\n    thus \"?eq \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (CallNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 M')\n  have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n  hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n  let ?frs\\<^sub>0 = \"(vs, ls\\<^sub>0, C,M,pc,ics)#frs\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  let ?xa = \"addr_of_sys_xcpt NullPointer\"\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>M'(es)) =\n    (True, ?frs\\<^sub>0, (None, h\\<^sub>2, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>2), err)\"\n   using CallNull\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 null h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics Null xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics pvs xa\n                    (map Val pvs) (Null#vs) frs (I - pcs(compxE\\<^sub>2 e pc (size vs)))\" by fact\n  have Isubs: \"{pc + length (compE\\<^sub>2 e)..<pc + length (compE\\<^sub>2 e) + length (compEs\\<^sub>2 es)}\n     \\<subseteq> I - pcs (compxE\\<^sub>2 e pc (length vs))\" using CallNull\\<^sub>1.prems by clarsimp\n  have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using Jcc_pieces_Call1[OF pcs] IH by clarsimp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(rev pvs@Null#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using CallNull\\<^sub>1 IH_es Isubs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (rev pvs@Null#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using CallNull\\<^sub>1.prems\n    by(auto simp:split_beta handle_def nth_append simp del: split_paired_Ex)\n  finally show ?case by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"rev pvs@[Null]\"])\nnext\n  case (CallObjThrow\\<^sub>1 e h ls sh e' h' ls' sh' M' es)\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (e\\<bullet>M'(es)) =\n    (True, (vs, ls, C,M,pc,ics)#frs,\n       (None, h', (v#vs, ls', C,M,pc+size(compE\\<^sub>2 (e\\<bullet>M'(es))),ics)#frs,sh'), err)\"\n   using CallObjThrow\\<^sub>1.prems(1) by clarsimp\n  obtain a' where throw: \"throw e' = Throw a'\"\n    using eval\\<^sub>1_final[OF CallObjThrow\\<^sub>1.hyps(1)] by clarsimp\n  have IH: \"PROP ?P e h ls sh (throw e') h' ls' sh' E C M pc ics v a' vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  show ?case using IH Jcc_pieces_Call1[OF pcs] throw CallObjThrow\\<^sub>1.prems nsub_RI_Jcc_pieces\n    by auto\nnext\n  case (CallNone\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' fs M')\n  let ?frs\\<^sub>0 = \"(vs, ls\\<^sub>0, C,M,pc,ics)#frs\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,?frs\\<^sub>0,sh\\<^sub>0)\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(Addr a#vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  let ?frs\\<^sub>2 = \"(rev pvs @ Addr a # vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n  let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt NoSuchMethodError\"\n  have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n  hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n  have aux: \"(rev pvs @ Addr a # vs) ! length pvs = Addr a\"\n    by (metis length_rev nth_append_length)\n  have nmeth: \"\\<not>(\\<exists>b Ts T body D. P \\<turnstile> C' sees M', b :  Ts\\<rightarrow>T = body in D)\"\n    using sees_method_compPD CallNone\\<^sub>1.hyps(6) by fastforce\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>M'(es)) =\n    (True, ?frs\\<^sub>0, (None, h\\<^sub>2, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>2), err)\"\n   using CallNone\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics pvs xa\n                    (map Val pvs) (Addr a#vs) frs (I - pcs(compxE\\<^sub>2 e pc (size vs)))\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Jcc_pieces_Call1[OF pcs] IH by clarsimp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es CallNone\\<^sub>1.prems by fastforce\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (rev pvs@Addr a#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using CallNone\\<^sub>1.hyps(5) CallNone\\<^sub>1.prems aux nmeth\n     by(cases \"method P C' M'\", cases \"find_handler P ?xa h\\<^sub>2 frs sh\\<^sub>2\", auto simp: handle_def)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"rev pvs@[Addr a]\"])\nnext\n  case (CallStatic\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' fs M' Ts T body D)\n  let ?frs\\<^sub>0 = \"(vs, ls\\<^sub>0, C,M,pc,ics)#frs\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,?frs\\<^sub>0,sh\\<^sub>0)\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(Addr a#vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  let ?frs\\<^sub>2 = \"(rev pvs @ Addr a # vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n  let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n  have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n  hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n  have aux: \"(rev pvs @ Addr a # vs) ! length pvs = Addr a\"\n    by (metis length_rev nth_append_length)\n  obtain body' where method: \"P \\<turnstile> C' sees M', Static :  Ts\\<rightarrow>T = body' in D\"\n    by (metis CallStatic\\<^sub>1.hyps(6) P_def compP\\<^sub>2_def sees_method_compP)\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>M'(es)) =\n    (True, ?frs\\<^sub>0, (None, h\\<^sub>2, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>2), err)\"\n   using CallStatic\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics pvs xa\n                    (map Val pvs) (Addr a#vs) frs (I - pcs(compxE\\<^sub>2 e pc (size vs)))\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Jcc_pieces_Call1[OF pcs] IH by clarsimp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es CallStatic\\<^sub>1.prems by fastforce\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (rev pvs@Addr a#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using CallStatic\\<^sub>1.hyps(5) CallStatic\\<^sub>1.prems aux method\n     by(cases \"method P C' M'\", cases \"find_handler P ?xa h\\<^sub>2 frs sh\\<^sub>2\")\n       (auto simp: handle_def; meson frames_of.cases)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"rev pvs@[Addr a]\"])\nnext\n  case (SCallParamsThrow\\<^sub>1 es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 pvs ex es'' C' M')\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True then show ?thesis\n      using SCallParamsThrow\\<^sub>1.hyps(1,3) evals\\<^sub>1_cases(1) by fastforce\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs, ls\\<^sub>1, C,M,pc,ics)#frs,sh\\<^sub>1)\"\n    let ?pc\\<^sub>2 = \"pc + length(compEs\\<^sub>2 es)\"\n    have Isubs: \"{pc..<pc + length (compEs\\<^sub>2 es)} \\<subseteq> I\" using SCallParamsThrow\\<^sub>1.prems nclinit by clarsimp\n    show ?thesis (is \"?N \\<and> (?eq \\<longrightarrow> ?err)\")\n    proof\n      show ?N by simp\n    next\n      { assume ?eq\n        moreover\n        have \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M pc ics pvs xa es'' vs frs I\" by fact\n        ultimately have \"\\<exists>pc\\<^sub>2.\n          (pc \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < pc + size(compEs\\<^sub>2 es) \\<and>\n           \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxEs\\<^sub>2 es pc (size vs))) \\<and>\n          (\\<exists>vs'. P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2)\"\n          (is \"\\<exists>pc\\<^sub>2. ?PC pc\\<^sub>2 \\<and> ?Exec pc\\<^sub>2\")\n          using SCallParamsThrow\\<^sub>1 Isubs nclinit by auto\n        then obtain pc\\<^sub>2 where pc\\<^sub>2: \"?PC pc\\<^sub>2\" and 2: \"?Exec pc\\<^sub>2\" by iprover\n        then have \"?err\" using pc\\<^sub>2 2 by(auto intro: exI[where x=\"pc\\<^sub>2\"])\n      }\n      thus \"?eq \\<longrightarrow> ?err\" by iprover\n    qed\n  qed\nnext\n  case (SCallNone\\<^sub>1 es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' M')\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True then show ?thesis using SCallNone\\<^sub>1.hyps(3) SCallNone\\<^sub>1.prems by auto\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs, ls\\<^sub>1, C,M,pc,ics)#frs,sh\\<^sub>1)\"\n    let ?pc\\<^sub>2 = \"pc + length(compEs\\<^sub>2 es)\"\n    let ?frs\\<^sub>2 = \"(rev pvs @ vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n    let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n    let ?xa = \"addr_of_sys_xcpt NoSuchMethodError\"\n    have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n    hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n    have nmeth: \"\\<not>(\\<exists>b Ts T body D. P \\<turnstile> C' sees M', b :  Ts\\<rightarrow>T = body in D)\"\n      using sees_method_compPD SCallNone\\<^sub>1.hyps(3) by fastforce\n    have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M pc ics pvs xa\n                      (map Val pvs) vs frs I\" by fact\n    have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es SCallNone\\<^sub>1.prems nclinit by auto fastforce+\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (rev pvs@vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n      using SCallNone\\<^sub>1.prems nmeth nclinit\n       by(cases \"method P C' M'\", cases \"find_handler P ?xa h\\<^sub>2 frs sh\\<^sub>2\", auto simp: handle_def)\n    finally show ?thesis using nclinit by (auto intro: exI[where x = ?pc\\<^sub>2])\n  qed\nnext\n  case (SCallNonStatic\\<^sub>1 es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' M' Ts T body D)\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True then show ?thesis\n      using SCallNonStatic\\<^sub>1.hyps(3) SCallNonStatic\\<^sub>1.prems sees_method_fun by fastforce\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs, ls\\<^sub>1, C,M,pc,ics)#frs,sh\\<^sub>1)\"\n    let ?pc\\<^sub>2 = \"pc + length(compEs\\<^sub>2 es)\"\n    let ?frs\\<^sub>2 = \"(rev pvs @ vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n    let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n    let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n    have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n    hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n    obtain body' where method: \"P \\<turnstile> C' sees M', NonStatic :  Ts\\<rightarrow>T = body' in D\"\n      by (metis SCallNonStatic\\<^sub>1.hyps(3) P_def compP\\<^sub>2_def sees_method_compP)\n    have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M pc ics pvs xa\n                      (map Val pvs) vs frs I\" by fact\n    have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es SCallNonStatic\\<^sub>1.prems nclinit by auto fastforce+\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (rev pvs@vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n      using SCallNonStatic\\<^sub>1.prems method nclinit\n       by(cases \"method P C' M'\", cases \"find_handler P ?xa h\\<^sub>2 frs sh\\<^sub>2\")\n         (auto simp: handle_def; meson frames_of.cases)\n    finally show ?thesis using nclinit by (auto intro: exI[where x = ?pc\\<^sub>2])\n  qed\nnext\n  case (SCallInitThrow\\<^sub>1 es h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 pvs h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' M' Ts T body D a h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2)\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True then show ?thesis using SCallInitThrow\\<^sub>1 by simp\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs, ls\\<^sub>0, C,M,pc,ics)#frs,sh\\<^sub>0)\"\n    let ?pc\\<^sub>1 = \"pc + length(compEs\\<^sub>2 es)\"\n    let ?frs\\<^sub>1 = \"(rev pvs @ vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs\"\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,?frs\\<^sub>1,sh\\<^sub>1)\"\n    let ?frs\\<^sub>1' = \"(rev pvs@vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,Calling D [])#frs\"\n    let ?\\<sigma>\\<^sub>1' = \"(None,h\\<^sub>1,?frs\\<^sub>1',sh\\<^sub>1)\"\n    let ?frs\\<^sub>2 = \"(rev pvs@vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,Called [])#frs\"\n    let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n    have ls: \"ls\\<^sub>1 = ls\\<^sub>2\" by(rule init\\<^sub>1_same_loc[OF SCallInitThrow\\<^sub>1.hyps(6)])\n    have method: \"\\<exists>m'. P \\<turnstile> C' sees M',Static:Ts\\<rightarrow>T = m' in D\" using SCallInitThrow\\<^sub>1.hyps(3)\n      by (metis P_def compP\\<^sub>2_def sees_method_compP)\n    obtain a' where throw: \"throw a = Throw a'\" using eval\\<^sub>1_final[OF SCallInitThrow\\<^sub>1.hyps(6)] by clarsimp\n    have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h\\<^sub>1 sh\\<^sub>1 (INIT D ([D],False) \\<leftarrow> unit))\"\n      using sees_method_is_class'[OF SCallInitThrow\\<^sub>1.hyps(3)] by auto\n    then obtain err' where pcs':\n      \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 (rev pvs@vs) ls\\<^sub>1 ?pc\\<^sub>1 ics frs sh\\<^sub>1 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (INIT D ([D],False) \\<leftarrow> unit)\n      = (True, ?frs\\<^sub>1', (None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2), err')\"\n      using SCallInitThrow\\<^sub>1.prems(1) nclinit by auto\n    have IHI: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw a)\n               h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics v a' (rev pvs@vs) frs I\" by fact\n    have IH_es: \"PROP ?Ps es h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (map Val pvs) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C M pc ics pvs xa\n                      (map Val pvs) vs frs I\" by fact\n    have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using IH_es SCallInitThrow\\<^sub>1.prems nclinit by auto fastforce+\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1'\"\n    proof(cases \"sh\\<^sub>1 D\")\n      case None then show ?thesis using SCallInitThrow\\<^sub>1.hyps(1,3-6) SCallInitThrow\\<^sub>1.prems method\n        by(cases ics) auto\n    next\n      case (Some a)\n      then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n      then show ?thesis using SCallInitThrow\\<^sub>1.hyps(1,3-6) SCallInitThrow\\<^sub>1.prems method Some\n        by(cases ics; case_tac i, auto)\n    qed\n    also obtain vs' where \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M a' h\\<^sub>2 (vs'@rev pvs@vs) ls\\<^sub>1 ?pc\\<^sub>1 ics frs sh\\<^sub>2\"\n      using IHI pcs' throw by auto\n    finally show ?thesis using nclinit throw ls\n     by(auto intro!: exI[where x=\"?pc\\<^sub>1\"] exI[where x=\"vs'@rev pvs\"])\n  qed\nnext\n  case (SCallInit\\<^sub>1 es h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 pvs h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' M' Ts T body D v' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 ls\\<^sub>2' e' h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3)\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True then show ?thesis using SCallInit\\<^sub>1 by simp\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs, ls\\<^sub>0, C,M,pc,ics)#frs,sh\\<^sub>0)\"\n    let ?pc\\<^sub>1 = \"pc + length(compEs\\<^sub>2 es)\"\n    let ?frs\\<^sub>1 = \"(rev pvs @ vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs\"\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,?frs\\<^sub>1,sh\\<^sub>1)\"\n    let ?frs\\<^sub>1' = \"(rev pvs@vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,Calling D [])#frs\"\n    let ?\\<sigma>\\<^sub>1' = \"(None,h\\<^sub>1,?frs\\<^sub>1',sh\\<^sub>1)\"\n    let ?frs\\<^sub>2 = \"(rev pvs@vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,Called [])#frs\"\n    let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n    let ?frs\\<^sub>2' = \"([], ls\\<^sub>2', D,M',0,No_ics) # ?frs\\<^sub>1\"\n    let ?\\<sigma>\\<^sub>2' = \"(None, h\\<^sub>2, ?frs\\<^sub>2', sh\\<^sub>2)\"\n    have nclinit': \"M' \\<noteq> clinit\" by fact\n    have ics: \"ics = No_ics\" using SCallInit\\<^sub>1.hyps(5) SCallInit\\<^sub>1.prems by simp\n    have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>0, ls\\<^sub>0, sh\\<^sub>0)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle>\" by fact\n    hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n    have invoke: \"P,C,M,?pc\\<^sub>1 \\<triangleright> Invokestatic C' M' (length Ts)\"\n      using SCallInit\\<^sub>1.hyps(8) SCallInit\\<^sub>1.prems nclinit by(auto simp: add.assoc)\n    have nsub: \"\\<not> sub_RI body\" by(rule sees_wf\\<^sub>1_nsub_RI[OF wf SCallInit\\<^sub>1.hyps(3)])\n    have ls: \"ls\\<^sub>1 = ls\\<^sub>2\" by(rule init\\<^sub>1_same_loc[OF SCallInit\\<^sub>1.hyps(6)])\n    obtain sfs i where sh\\<^sub>2: \"sh\\<^sub>2 D = Some(sfs,i)\"\n      using init\\<^sub>1_Val_PD[OF SCallInit\\<^sub>1.hyps(6)] by clarsimp\n    have method: \"\\<exists>m'. P \\<turnstile> C' sees M',Static:Ts\\<rightarrow>T = m' in D\" using SCallInit\\<^sub>1.hyps(3)\n      by (metis P_def compP\\<^sub>2_def sees_method_compP)\n    have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h\\<^sub>1 sh\\<^sub>1 (INIT D ([D],False) \\<leftarrow> unit))\"\n      using sees_method_is_class'[OF SCallInit\\<^sub>1.hyps(3)] by auto\n    then obtain err' where pcs':\n      \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 (rev pvs@vs) ls\\<^sub>1 ?pc\\<^sub>1 ics frs sh\\<^sub>1 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v' xa (INIT D ([D],False) \\<leftarrow> unit)\n      = (True, ?frs\\<^sub>1', (None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2), err')\"\n      using SCallInit\\<^sub>1.prems(1) nclinit by auto\n    have IHI: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val v')\n               h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics v' xa (rev pvs@vs) frs I\" by fact\n    have IH_es: \"PROP ?Ps es h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (map Val pvs) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C M pc ics pvs xa\n                      (map Val pvs) vs frs I\" by fact\n    have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using IH_es SCallInit\\<^sub>1.prems nclinit by auto fastforce+\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1'\"\n    proof(cases \"sh\\<^sub>1 D\")\n      case None then show ?thesis using SCallInit\\<^sub>1.hyps(1,3-6,8-10) SCallInit\\<^sub>1.prems method\n        by(cases ics) auto\n    next\n      case (Some a)\n      then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n      then show ?thesis using SCallInit\\<^sub>1.hyps(1,3-6,8-10) SCallInit\\<^sub>1.prems method Some\n        by(cases ics; case_tac i, auto)\n    qed\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IHI pcs' by auto\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\"\n      using jvm_Invokestatic_Called[OF assms(1) invoke _ SCallInit\\<^sub>1.hyps(3,8,9)] sh\\<^sub>2 ics by auto\n    finally have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\".\n    have \"P\\<^sub>1 \\<turnstile> C' sees M',Static: Ts\\<rightarrow>T = body in D\" by fact\n    then have M'_in_D: \"P\\<^sub>1 \\<turnstile> D sees M',Static: Ts\\<rightarrow>T = body in D\"\n      by(rule sees_method_idemp) \n    have M'_code: \"compP\\<^sub>2 P\\<^sub>1,D,M',0 \\<rhd> compE\\<^sub>2 body @ [Return]\" using beforeM M'_in_D by simp\n    have M'_xtab: \"compP\\<^sub>2 P\\<^sub>1,D,M' \\<rhd> compxE\\<^sub>2 body 0 0/{..<size(compE\\<^sub>2 body)},0\"\n      using M'_in_D by(rule beforexM)\n    have IH_body: \"PROP ?P body h\\<^sub>2 ls\\<^sub>2' sh\\<^sub>2 e' h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 (Class D # Ts) D M' 0 No_ics v xa [] ?frs\\<^sub>1\n      ({..<size(compE\\<^sub>2 body)})\" by fact\n    have cond: \"Jcc_cond P\\<^sub>1 (Class D # Ts) D M' [] 0 No_ics {..<length (compE\\<^sub>2 body)} h\\<^sub>2 sh\\<^sub>2 body\"\n      using nsub_RI_Jcc_pieces[OF assms(1) nsub] M'_code M'_xtab by clarsimp\n    show ?thesis (is \"?Norm \\<and> ?Err\")\n    proof\n      show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n      proof\n        assume val: ?val\n        note 1\n        also have \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> (None,h\\<^sub>3,([v],ls\\<^sub>3,D,M',size(compE\\<^sub>2 body),No_ics)#?frs\\<^sub>1,sh\\<^sub>3)\"\n          using val IH_body SCallInit\\<^sub>1.prems M'_code cond nsub_RI_Jcc_pieces nsub by auto\n        also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h\\<^sub>3, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>1+1,ics)#frs,sh\\<^sub>3)\"\n          using SCallInit\\<^sub>1.hyps(8) M'_code M'_in_D ls nclinit' by(cases T, auto)\n        finally show ?trans using nclinit by(auto simp:add.assoc)\n      qed\n    next\n      show ?Err (is \"?throw \\<longrightarrow> ?err\")\n      proof\n        assume throw: ?throw\n        with IH_body obtain pc\\<^sub>2 vs' where\n          pc\\<^sub>2: \"0 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < size(compE\\<^sub>2 body) \\<and>\n                \\<not> caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0)\" and\n          2: \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>1 sh\\<^sub>3\"\n          using SCallInit\\<^sub>1.prems M'_code M'_xtab cond nsub_RI_Jcc_pieces nsub\n           by (auto simp del:split_paired_Ex)\n        have \"handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>1 sh\\<^sub>3 =\n              handle P C M xa h\\<^sub>3 (rev pvs @ vs) ls\\<^sub>2 ?pc\\<^sub>1 ics frs sh\\<^sub>3\"\n          using pc\\<^sub>2 M'_in_D ls nclinit' by(auto simp add:handle_def)\n        then show \"?err\" using pc\\<^sub>2 jvm_trans[OF 1 2] nclinit\n         by(auto intro!:exI[where x=\"?pc\\<^sub>1\"] exI[where x=\"rev pvs\"])\n      qed\n    qed\n  qed\nnext\n  case (SCall\\<^sub>1 es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' M' Ts T body D sfs ls\\<^sub>2' e' h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3)\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True\n    then have s1: \"pvs = []\" \"h\\<^sub>1 = h\\<^sub>2\" \"ls\\<^sub>1 = ls\\<^sub>2\" \"sh\\<^sub>1 = sh\\<^sub>2\"\n      using SCall\\<^sub>1.hyps(1) evals\\<^sub>1_cases(1) by blast+\n    then have ls\\<^sub>2': \"ls\\<^sub>2' = replicate (max_vars body) undefined\" using SCall\\<^sub>1.hyps(6) clinit by simp\n    let ?frs = \"create_init_frame P C' # (vs, ls\\<^sub>1, C,M,pc,ics)#frs\"\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,?frs,sh\\<^sub>1)\"\n    have method: \"P\\<^sub>1 \\<turnstile> C' sees clinit,Static: []\\<rightarrow>Void = body in C'\"\n      using SCall\\<^sub>1.hyps(3) clinit s1(1) wf_sees_clinit[OF wf]\n        by (metis is_class_def option.collapse sees_method_fun sees_method_is_class)\n    then have M_code: \"compP\\<^sub>2 P\\<^sub>1,C',clinit,0 \\<rhd> compE\\<^sub>2 body @ [Return]\" by(rule beforeM)\n    have pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 vs ls\\<^sub>1 pc ics frs sh\\<^sub>1 I h\\<^sub>3 ls\\<^sub>2 sh\\<^sub>3 v xa (C'\\<bullet>\\<^sub>sclinit([]))\n         = (True, ?frs, (None, h\\<^sub>3, tl ?frs, sh\\<^sub>3(C'\\<mapsto>(fst(the(sh\\<^sub>3 C')),Done))),\n        P \\<turnstile> (None, h\\<^sub>1, ?frs, sh\\<^sub>1) -jvm\\<rightarrow>\n        (case ics of\n     Called Cs \\<Rightarrow> (None, h\\<^sub>3, (vs, ls\\<^sub>1, C, M, pc, Throwing Cs xa) # frs, sh\\<^sub>3(C' \\<mapsto> (fst (the (sh\\<^sub>3 C')), Error)))))\"\n      using Jcc_pieces_clinit[OF assms(1),of E C M vs pc ics I h\\<^sub>1 sh\\<^sub>1 C' ls\\<^sub>1 frs h\\<^sub>3 ls\\<^sub>2 sh\\<^sub>3 v xa]\n         SCall\\<^sub>1.prems(1) clinit s1(1) by clarsimp\n    have IH_body: \"PROP ?P body h\\<^sub>2 ls\\<^sub>2' sh\\<^sub>2 e' h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 [] C' clinit 0 No_ics v xa [] (tl ?frs)\n     ({..<size(compE\\<^sub>2 body)})\" by fact\n    show ?thesis (is \"?Norm \\<and> ?Err\")\n    proof\n      show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n      proof\n        assume val: ?val\n        then have \"P \\<turnstile> ?\\<sigma>\\<^sub>1\n           -jvm\\<rightarrow> (None, h\\<^sub>3, ([v], ls\\<^sub>3, C', clinit, size(compE\\<^sub>2 body), No_ics) # tl ?frs,sh\\<^sub>3)\"\n          using IH_body Jcc_pieces_SCall_clinit_body[OF assms(1) wf pcs method] s1 ls\\<^sub>2' by clarsimp\n        also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h\\<^sub>3, tl ?frs, sh\\<^sub>3(C'\\<mapsto>(fst(the(sh\\<^sub>3 C')),Done)))\"\n          using jvm_Return_Init[OF M_code] by simp\n        finally show ?trans using pcs s1 clinit by simp\n      qed\n    next\n      show ?Err (is \"?throw \\<longrightarrow> ?err\")\n      proof\n        assume throw: ?throw\n        with IH_body obtain pc\\<^sub>2 vs2 where\n          pc\\<^sub>2: \"0 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < size(compE\\<^sub>2 body) \\<and>\n                \\<not> caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0)\" and\n          2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C' clinit xa h\\<^sub>3 vs2 ls\\<^sub>3 pc\\<^sub>2 No_ics (tl ?frs) sh\\<^sub>3\"\n          using SCall\\<^sub>1.prems Jcc_pieces_SCall_clinit_body[OF assms(1) wf pcs method] s1 ls\\<^sub>2' by clarsimp\n        show ?err using SCall\\<^sub>1.prems(1) clinit\n        proof(cases ics)\n          case (Called Cs)\n          note 2\n          also have \"handle P C' clinit xa h\\<^sub>3 vs2 ls\\<^sub>3 pc\\<^sub>2 No_ics (tl ?frs) sh\\<^sub>3\n             = (None, h\\<^sub>3, (vs, ls\\<^sub>1, C, M, pc, Throwing (C'#Cs) xa) # frs, sh\\<^sub>3)\"\n            using Called pc\\<^sub>2 method by(simp add: handle_def)\n          also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h\\<^sub>3, (vs, ls\\<^sub>1, C, M, pc, Throwing Cs xa) # frs,\n             sh\\<^sub>3(C' \\<mapsto> (fst (the (sh\\<^sub>3 C')), Error)))\" using Called jvm_Throwing by simp\n          finally show ?thesis using pcs clinit Called by(clarsimp intro!: exI[where x=\"[]\"])\n        qed(auto)\n      qed\n    qed\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs, ls\\<^sub>1, C,M,pc,ics)#frs,sh\\<^sub>1)\"\n    let ?pc\\<^sub>2 = \"pc + length(compEs\\<^sub>2 es)\"\n    let ?frs\\<^sub>2 = \"(rev pvs @ vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n    let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n    let ?frs\\<^sub>2' = \"([], ls\\<^sub>2', D,M',0,No_ics) # ?frs\\<^sub>2\"\n    let ?\\<sigma>\\<^sub>2' = \"(None, h\\<^sub>2, ?frs\\<^sub>2', sh\\<^sub>2)\"\n    have nclinit': \"M' \\<noteq> clinit\"\n     using wf_sees_clinit1[OF wf] visible_method_exists[OF SCall\\<^sub>1.hyps(3)]\n       sees_method_idemp[OF SCall\\<^sub>1.hyps(3)] nclinit SCall\\<^sub>1.hyps(5)\n       evals\\<^sub>1_preserves_elen[OF SCall\\<^sub>1.hyps(1)] by fastforce\n    have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n    hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n    have invoke: \"P,C,M,?pc\\<^sub>2 \\<triangleright> Invokestatic C' M' (length Ts)\"\n      using SCall\\<^sub>1.hyps(5) SCall\\<^sub>1.prems nclinit by(auto simp: add.assoc)\n    have nsub: \"\\<not> sub_RI body\" by(rule sees_wf\\<^sub>1_nsub_RI[OF wf SCall\\<^sub>1.hyps(3)])\n    have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M pc ics pvs xa\n                      (map Val pvs) vs frs I\" by fact\n    have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es SCall\\<^sub>1.prems nclinit by auto fastforce+\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\" using jvm_Invokestatic[OF assms(1) invoke _ SCall\\<^sub>1.hyps(3,5,6)]\n         SCall\\<^sub>1.hyps(4) SCall\\<^sub>1.prems nclinit by auto\n    finally have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\".\n    have \"P\\<^sub>1 \\<turnstile> C' sees M',Static: Ts\\<rightarrow>T = body in D\" by fact\n    then have M'_in_D: \"P\\<^sub>1 \\<turnstile> D sees M',Static: Ts\\<rightarrow>T = body in D\"\n      by(rule sees_method_idemp) \n    have M'_code: \"compP\\<^sub>2 P\\<^sub>1,D,M',0 \\<rhd> compE\\<^sub>2 body @ [Return]\" using beforeM M'_in_D by simp\n    have M'_xtab: \"compP\\<^sub>2 P\\<^sub>1,D,M' \\<rhd> compxE\\<^sub>2 body 0 0/{..<size(compE\\<^sub>2 body)},0\"\n      using M'_in_D by(rule beforexM)\n    have IH_body: \"PROP ?P body h\\<^sub>2 ls\\<^sub>2' sh\\<^sub>2 e' h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 (Class D # Ts) D M' 0 No_ics v xa [] ?frs\\<^sub>2\n      ({..<size(compE\\<^sub>2 body)})\" by fact\n    have cond: \"Jcc_cond P\\<^sub>1 (Class D # Ts) D M' [] 0 No_ics {..<length (compE\\<^sub>2 body)} h\\<^sub>2 sh\\<^sub>2 body\"\n      using nsub_RI_Jcc_pieces[OF assms(1) nsub] M'_code M'_xtab by clarsimp\n    show ?thesis (is \"?Norm \\<and> ?Err\")\n    proof\n      show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n      proof\n        assume val: ?val\n        note 1\n        also have \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> (None,h\\<^sub>3,([v],ls\\<^sub>3,D,M',size(compE\\<^sub>2 body),No_ics)#?frs\\<^sub>2,sh\\<^sub>3)\"\n          using val IH_body SCall\\<^sub>1.prems M'_code cond nsub_RI_Jcc_pieces nsub by auto\n        also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h\\<^sub>3, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>3)\"\n          using SCall\\<^sub>1.hyps(5) M'_code M'_in_D nclinit' by(cases T, auto)\n        finally show ?trans using nclinit by(auto simp:add.assoc)\n      qed\n    next\n      show ?Err (is \"?throw \\<longrightarrow> ?err\")\n      proof\n        assume throw: ?throw\n        with IH_body obtain pc\\<^sub>2 vs' where\n          pc\\<^sub>2: \"0 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < size(compE\\<^sub>2 body) \\<and>\n                \\<not> caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0)\" and\n          2: \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>2 sh\\<^sub>3\"\n          using SCall\\<^sub>1.prems M'_code M'_xtab cond nsub_RI_Jcc_pieces nsub\n           by (auto simp del:split_paired_Ex)\n        have \"handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>2 sh\\<^sub>3 =\n              handle P C M xa h\\<^sub>3 (rev pvs @ vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>3\"\n          using pc\\<^sub>2 M'_in_D nclinit' by(auto simp add:handle_def)\n        then show \"?err\" using pc\\<^sub>2 jvm_trans[OF 1 2] nclinit by(auto intro:exI[where x=\"?pc\\<^sub>2\"])\n      qed\n    qed\n  qed\nnext\n  case Block\\<^sub>1 then show ?case using nsub_RI_Jcc_pieces by auto\nnext\n  case (Seq\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>1+1,ics)#frs,sh\\<^sub>1)\"\n  let ?I = \"I - pcs (compxE\\<^sub>2 e\\<^sub>2 (Suc ?pc\\<^sub>1) (length vs))\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)} \\<subseteq> ?I\" using Seq\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs ?I\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using Seq\\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Seq\\<^sub>1 by auto\n  finally have eval\\<^sub>1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\".\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?I' = \"I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs))\"\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M (?pc\\<^sub>1+1) ics v xa vs frs\n                     ?I'\" by fact\n  have Isub2: \"{Suc (pc + length (compE\\<^sub>2 e\\<^sub>1))..<Suc (pc + length (compE\\<^sub>2 e\\<^sub>1) + length (compE\\<^sub>2 e\\<^sub>2))}\n     \\<subseteq> ?I'\" using Seq\\<^sub>1.prems by clarsimp\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note eval\\<^sub>1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n        using val Seq\\<^sub>1.prems nsub_RI_Jcc_pieces IH\\<^sub>2 Isub2 by auto\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      then obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1+1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>2 \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 (?pc\\<^sub>1+1) (size vs))\" and\n        eval\\<^sub>2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using IH\\<^sub>2 Seq\\<^sub>1.prems nsub_RI_Jcc_pieces Isub2 by auto\n      show \"?err\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by(auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (SeqThrow\\<^sub>1 e\\<^sub>0 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>1)\n  let ?I = \"I - pcs (compxE\\<^sub>2 e\\<^sub>1 (Suc (pc + length (compE\\<^sub>2 e\\<^sub>0))) (length vs))\"\n  obtain a' where throw: \"throw e = Throw a'\" using eval\\<^sub>1_final[OF SeqThrow\\<^sub>1.hyps(1)] by clarsimp\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e\\<^sub>0)} \\<subseteq> ?I\" using SeqThrow\\<^sub>1.prems by clarsimp\n  have \"PROP ?P e\\<^sub>0 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v a' vs frs ?I\" by fact\n  then show ?case using SeqThrow\\<^sub>1.prems throw nsub_RI_Jcc_pieces Isub by auto\nnext\n  case (CondT\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>1 e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 e\\<^sub>2)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>1+1,ics)#frs,sh\\<^sub>1)\"\n  let ?d = \"size vs\"\n  let ?xt\\<^sub>1 = \"compxE\\<^sub>2 e\\<^sub>1 (pc+size(compE\\<^sub>2 e)+1) ?d\"\n  let ?xt\\<^sub>2 = \"compxE\\<^sub>2 e\\<^sub>2 (pc+size(compE\\<^sub>2 e)+size(compE\\<^sub>2 e\\<^sub>1)+2) ?d\"\n  let ?I = \"I - (pcs ?xt\\<^sub>1 \\<union> pcs ?xt\\<^sub>2)\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> ?I\" using CondT\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 true h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Bool True) xa vs frs ?I\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,(Bool(True)#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using CondT\\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by(auto simp: Int_Un_distrib)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using CondT\\<^sub>1 by auto\n  finally have eval\\<^sub>1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\".\n  let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2' = \"?pc\\<^sub>1' + 1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?I' = \"I - pcs(compxE\\<^sub>2 e pc ?d) - pcs(compxE\\<^sub>2 e\\<^sub>2 (?pc\\<^sub>1'+1) ?d)\"\n  have IH2: \"PROP ?P e\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M (?pc\\<^sub>1+1) ics v xa vs frs ?I'\" by fact\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note eval\\<^sub>1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>1',ics)#frs,sh\\<^sub>2)\"\n        using val CondT\\<^sub>1.prems nsub_RI_Jcc_pieces IH2 by(fastforce simp:Int_Un_distrib)\n      also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2',ics)#frs,sh\\<^sub>2)\"\n        using CondT\\<^sub>1 nsub_RI_Jcc_pieces by(auto simp:add.assoc)\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      moreover\n      note IH2\n      ultimately obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1+1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>1' \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>1 (?pc\\<^sub>1+1) (size vs))\" and\n        eval\\<^sub>2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using CondT\\<^sub>1.prems nsub_RI_Jcc_pieces by (fastforce simp:Int_Un_distrib)\n      show \"?err\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by(auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (CondF\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 e\\<^sub>1)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 e\\<^sub>1)+ 1\"\n  let ?pc\\<^sub>2' = \"?pc\\<^sub>2 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>1)\"\n  let ?d = \"size vs\"\n  let ?xt\\<^sub>1 = \"compxE\\<^sub>2 e\\<^sub>1 (pc+size(compE\\<^sub>2 e)+1) ?d\"\n  let ?xt\\<^sub>2 = \"compxE\\<^sub>2 e\\<^sub>2 (pc+size(compE\\<^sub>2 e)+size(compE\\<^sub>2 e\\<^sub>1)+2) ?d\"\n  let ?I = \"I - (pcs ?xt\\<^sub>1 \\<union> pcs ?xt\\<^sub>2)\"\n  let ?I' = \"I - pcs(compxE\\<^sub>2 e pc ?d) - pcs(compxE\\<^sub>2 e\\<^sub>1 (?pc\\<^sub>1+1) ?d)\"\n  have pcs: \"pcs(compxE\\<^sub>2 e pc ?d) \\<inter> pcs(?xt\\<^sub>1 @ ?xt\\<^sub>2) = {}\"\n    using CondF\\<^sub>1.prems by (simp add:Int_Un_distrib)\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> ?I\" using CondF\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 false h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Bool False) xa vs frs ?I\" by fact\n  have IH2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>2 ics v xa vs frs ?I'\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,(Bool(False)#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using CondF\\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub pcs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using CondF\\<^sub>1 by auto\n  finally have eval\\<^sub>1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\".\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note eval\\<^sub>1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2',ics)#frs,sh\\<^sub>2)\"\n        using val CondF\\<^sub>1.prems nsub_RI_Jcc_pieces IH2 by(fastforce simp:Int_Un_distrib)\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      let ?I' = \"I - pcs(compxE\\<^sub>2 e pc ?d) - pcs(compxE\\<^sub>2 e\\<^sub>1 (?pc\\<^sub>1+1) ?d)\"\n      assume throw: ?throw\n      then obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>2 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>2' \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>2 ?d)\" and\n        eval\\<^sub>2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using CondF\\<^sub>1.prems nsub_RI_Jcc_pieces IH2 by(fastforce simp:Int_Un_distrib)\n      show \"?err\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by(auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (CondThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 f h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>1 e\\<^sub>2)\n  let ?d = \"size vs\"\n  let ?xt\\<^sub>1 = \"compxE\\<^sub>2 e\\<^sub>1 (pc+size(compE\\<^sub>2 e)+1) ?d\"\n  let ?xt\\<^sub>2 = \"compxE\\<^sub>2 e\\<^sub>2 (pc+size(compE\\<^sub>2 e)+size(compE\\<^sub>2 e\\<^sub>1)+2) ?d\"\n  let ?I = \"I - (pcs ?xt\\<^sub>1 \\<union> pcs ?xt\\<^sub>2)\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> ?I\" using CondThrow\\<^sub>1.prems by clarsimp\n  have \"pcs(compxE\\<^sub>2 e pc ?d) \\<inter> pcs(?xt\\<^sub>1 @ ?xt\\<^sub>2) = {}\"\n    using CondThrow\\<^sub>1.prems by (simp add:Int_Un_distrib)\n  moreover have \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw f) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs ?I\" by fact\n  ultimately show ?case using CondThrow\\<^sub>1.prems nsub_RI_Jcc_pieces Isub by auto\nnext\n  case (WhileF\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 c)\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?pc' = \"?pc + length(compE\\<^sub>2 c) + 3\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs))\"\n    using WhileF\\<^sub>1.prems by clarsimp\n  have Isub2: \"{Suc (pc + length (compE\\<^sub>2 e))..<Suc (pc + length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c))}\n     \\<subseteq> I - pcs (compxE\\<^sub>2 e pc (length vs))\" using WhileF\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 false h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Bool False) xa vs frs\n    (I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n            (None,h\\<^sub>1,(Bool False#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using WhileF\\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc',ics)#frs,sh\\<^sub>1)\"\n    using WhileF\\<^sub>1 by (auto simp:add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(Unit#vs,ls\\<^sub>1,C,M,?pc'+1,ics)#frs,sh\\<^sub>1)\"\n    using WhileF\\<^sub>1.prems by (auto simp:eval_nat_numeral)\n  finally show ?case by (simp add:add.assoc eval_nat_numeral)\nnext\n  case (WhileT\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 c v\\<^sub>1 h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 e\\<^sub>3 h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3)\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?pc' = \"?pc + length(compE\\<^sub>2 c) + 1\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,(vs,ls\\<^sub>2,C,M,pc,ics)#frs,sh\\<^sub>2)\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs))\"\n    using WhileT\\<^sub>1.prems by clarsimp\n  have Isub2: \"{Suc (pc + length (compE\\<^sub>2 e))..<Suc (pc + length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c))}\n     \\<subseteq> I - pcs (compxE\\<^sub>2 e pc (length vs))\" using WhileT\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 true h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Bool True) xa vs frs\n    (I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs)))\" by fact\n  have IH2: \"PROP ?P c h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val v\\<^sub>1) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M (Suc ?pc) ics v\\<^sub>1 xa vs frs\n    (I - pcs (compxE\\<^sub>2 e pc (length vs)))\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,(Bool True#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using WhileT\\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1)\"\n    using WhileT\\<^sub>1.prems by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(v\\<^sub>1#vs,ls\\<^sub>2,C,M,?pc',ics)#frs,sh\\<^sub>2)\"\n    using WhileT\\<^sub>1.prems nsub_RI_Jcc_pieces IH2 Isub2 by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using WhileT\\<^sub>1.prems by auto\n  finally have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\".\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note 1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>2 -jvm\\<rightarrow> (None,h\\<^sub>3,(v#vs,ls\\<^sub>3,C,M,?pc'+3,ics)#frs,sh\\<^sub>3)\"\n        using val WhileT\\<^sub>1 by (auto simp add:add.assoc eval_nat_numeral)\n      finally show ?trans by(simp add:add.assoc eval_nat_numeral)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      moreover\n      have \"PROP ?P (while (e) c) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 e\\<^sub>3 h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 E C M pc ics v xa vs frs I\" by fact\n      ultimately obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"pc \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc'+3 \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 (while (e) c) pc (size vs))\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>2 -jvm\\<rightarrow> handle P C M xa h\\<^sub>3 (vs'@vs) ls\\<^sub>3 pc\\<^sub>2 ics frs sh\\<^sub>3\"\n        using WhileT\\<^sub>1.prems by (auto simp:add.assoc eval_nat_numeral)\n      show \"?err\" using pc\\<^sub>2 jvm_trans[OF 1 2] by(auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (WhileCondThrow\\<^sub>1 e h ls sh e' h' ls' sh' c)\n  let ?I = \"I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs))\"\n  obtain a' where throw: \"throw e' = Throw a'\" using eval\\<^sub>1_final[OF WhileCondThrow\\<^sub>1.hyps(1)] by clarsimp\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> ?I\" using WhileCondThrow\\<^sub>1.prems by clarsimp\n  have \"PROP ?P e h ls sh (throw e') h' ls' sh' E C M pc ics v a' vs frs ?I\" by fact\n  then show ?case using WhileCondThrow\\<^sub>1.prems throw nsub_RI_Jcc_pieces Isub by auto\nnext\n  case (WhileBodyThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 c e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>1+1,ics)#frs,sh\\<^sub>1)\"\n  let ?I = \"I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs))\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> ?I\"\n    using WhileBodyThrow\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 true h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Bool True) xa vs frs ?I\" by fact\n  then have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,(Bool(True)#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using WhileBodyThrow\\<^sub>1.prems nsub_RI_Jcc_pieces Isub by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using  WhileBodyThrow\\<^sub>1 by auto\n  finally have eval\\<^sub>1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\".\n  let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 c)\"\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm by simp\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      moreover\n      have \"PROP ?P c h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw e') h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M (?pc\\<^sub>1+1) ics v xa vs frs\n                    (I - pcs (compxE\\<^sub>2 e pc (size vs)))\" by fact\n      ultimately obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1+1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>1' \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 c (?pc\\<^sub>1+1) (size vs))\" and\n        eval\\<^sub>2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using WhileBodyThrow\\<^sub>1.prems nsub_RI_Jcc_pieces by (fastforce simp:Int_Un_distrib)\n      show \"?err\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by(auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (Throw\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1)\n  let ?pc = \"pc + size(compE\\<^sub>2 e)\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using Throw\\<^sub>1.prems by clarsimp\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm by simp\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw:?throw\n      have \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) a vs frs I\" by fact\n      then have \"P \\<turnstile> (None, h\\<^sub>0, (vs, ls\\<^sub>0, C, M, pc, ics) # frs, sh\\<^sub>0) -jvm\\<rightarrow>\n                 (None, h\\<^sub>1, (Addr xa#vs, ls\\<^sub>1, C, M, ?pc, ics) # frs, sh\\<^sub>1)\"\n        using Throw\\<^sub>1 nsub_RI_Jcc_pieces Isub throw by auto\n      also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (Addr xa#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n        using Throw\\<^sub>1.prems by(auto simp add:handle_def)\n      finally show \"?err\" by(auto intro!: exI[where x=\"?pc\"] exI[where x=\"[Addr xa]\"])\n    qed\n  qed\nnext\n  case (ThrowNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1)\n  let ?pc = \"pc + size(compE\\<^sub>2 e)\"\n  let ?xa = \"addr_of_sys_xcpt NullPointer\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using ThrowNull\\<^sub>1.prems by clarsimp\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm by simp\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      have \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 null h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics Null xa vs frs I\" by fact\n      then have \"P \\<turnstile> (None, h\\<^sub>0, (vs, ls\\<^sub>0, C, M, pc, ics) # frs, sh\\<^sub>0) -jvm\\<rightarrow>\n                 (None, h\\<^sub>1, (Null#vs, ls\\<^sub>1, C, M, ?pc, ics) # frs, sh\\<^sub>1)\"\n        using ThrowNull\\<^sub>1.prems nsub_RI_Jcc_pieces Isub by auto\n      also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow>  handle P C M ?xa h\\<^sub>1 (Null#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n        using ThrowNull\\<^sub>1.prems by(auto simp add:handle_def)\n      finally show \"?err\" using throw by(auto intro!: exI[where x=\"?pc\"] exI[where x=\"[Null]\"])\n    qed\n  qed\nnext\n  case (ThrowThrow\\<^sub>1 e h ls sh e' h' ls' sh')\n  obtain a' where throw: \"throw e' = Throw a'\" using eval\\<^sub>1_final[OF ThrowThrow\\<^sub>1.hyps(1)] by clarsimp\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using ThrowThrow\\<^sub>1.prems by clarsimp\n  have \"PROP ?P e h ls sh (throw e') h' ls' sh' E C M pc ics v a' vs frs I\" by fact\n  then show ?case using ThrowThrow\\<^sub>1.prems throw nsub_RI_Jcc_pieces Isub by auto\nnext\n  case (Try\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 v\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 Ci i e\\<^sub>2)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 2 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  have \"{pc..<pc+size(compE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2))} \\<subseteq> I\" using Try\\<^sub>1.prems by simp\n  also have \"P,C,M \\<rhd> compxE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2) pc (size vs) / I,size vs\"\n    using Try\\<^sub>1.prems by simp\n  ultimately have \"P,C,M \\<rhd> compxE\\<^sub>2 e\\<^sub>1 pc (size vs) / {pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)},size vs\"\n    by(rule beforex_try)\n  hence \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using Try\\<^sub>1 nsub_RI_Jcc_pieces by auto blast\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1',ics)#frs,sh\\<^sub>1)\"\n    using Try\\<^sub>1.prems by auto\n  finally show ?case by (auto simp:add.assoc)\nnext\n  case (TryCatch\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 D fs Ci i e\\<^sub>2 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2)\n  let ?e = \"try e\\<^sub>1 catch(Ci i) e\\<^sub>2\"\n  let ?xt = \"compxE\\<^sub>2 ?e pc (size vs)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?ls\\<^sub>1 = \"ls\\<^sub>1[i := Addr a]\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 2\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs,?ls\\<^sub>1,C,M, ?pc\\<^sub>1',ics) # frs,sh\\<^sub>1)\"\n  have I: \"{pc..<pc + length (compE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2))} \\<subseteq> I\"\n   and beforex: \"P,C,M \\<rhd> ?xt/I,size vs\" using TryCatch\\<^sub>1.prems by simp+\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,((Addr a)#vs,ls\\<^sub>1,C,M, ?pc\\<^sub>1+1,ics) # frs,sh\\<^sub>1)\"\n  proof -\n    have ics: \"ics = No_ics\" using TryCatch\\<^sub>1.prems by auto\n    have \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Throw a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v a vs frs {pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)}\"\n      by fact\n    moreover have \"P,C,M \\<rhd> compxE\\<^sub>2 e\\<^sub>1 pc (size vs)/{pc..<?pc\\<^sub>1},size vs\"\n      using beforex I pcs_subset by(force elim!: beforex_appendD1)\n    ultimately have\n      \"\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < ?pc\\<^sub>1 \\<and>\n             \\<not> caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs)) \\<and>\n             (\\<exists>vs'. P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> handle P C M a h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1)\"\n      using  TryCatch\\<^sub>1.prems nsub_RI_Jcc_pieces by auto\n    then obtain pc\\<^sub>1 vs' where\n      pc\\<^sub>1_in_e\\<^sub>1: \"pc \\<le> pc\\<^sub>1\" \"pc\\<^sub>1 < ?pc\\<^sub>1\" and\n      pc\\<^sub>1_not_caught: \"\\<not> caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs))\" and\n      0: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> handle P C M a h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1\" by iprover\n    from beforex obtain xt\\<^sub>0 xt\\<^sub>1\n      where ex_tab: \"ex_table_of P C M = xt\\<^sub>0 @ ?xt @ xt\\<^sub>1\"\n      and disj: \"pcs xt\\<^sub>0 \\<inter> I = {}\" by(auto simp:beforex_def)\n    have hp: \"h\\<^sub>1 a = Some (D, fs)\" \"P\\<^sub>1 \\<turnstile> D \\<preceq>\\<^sup>* Ci\" by fact+\n    have \"pc\\<^sub>1 \\<notin> pcs xt\\<^sub>0\" using pc\\<^sub>1_in_e\\<^sub>1 I disj by auto\n    with pc\\<^sub>1_in_e\\<^sub>1 pc\\<^sub>1_not_caught hp\n    show ?thesis using ex_tab 0 ics by(simp add:handle_def matches_ex_entry_def)\n  qed\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using TryCatch\\<^sub>1 by auto\n  finally have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" .\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1' + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?I\\<^sub>2 = \"{?pc\\<^sub>1' ..< ?pc\\<^sub>2}\"\n  have \"P,C,M \\<rhd> compxE\\<^sub>2 ?e pc (size vs) / I,size vs\" by fact\n  hence beforex\\<^sub>2: \"P,C,M \\<rhd> compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>1' (size vs) / ?I\\<^sub>2, size vs\"\n    using I pcs_subset[of _ ?pc\\<^sub>1'] by(auto elim!:beforex_appendD2)\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ?ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1' ics v xa vs frs ?I\\<^sub>2\" by fact\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note 1 also have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n        using val beforex\\<^sub>2 IH\\<^sub>2 TryCatch\\<^sub>1.prems nsub_RI_Jcc_pieces by auto\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      then obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1+2 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>2 \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>1' (size vs))\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using IH\\<^sub>2 beforex\\<^sub>2 TryCatch\\<^sub>1.prems nsub_RI_Jcc_pieces by auto\n      show ?err using pc\\<^sub>2 jvm_trans[OF 1 2]\n       by (simp add:match_ex_entry) (auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (TryThrow\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 D fs Ci i e\\<^sub>2)\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?e = \"try e\\<^sub>1 catch(Ci i) e\\<^sub>2\"\n  let ?xt = \"compxE\\<^sub>2 ?e pc (size vs)\"\n  have I: \"{pc..<pc + length (compE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2))} \\<subseteq> I\"\n   and beforex: \"P,C,M \\<rhd> ?xt/I,size vs\" using TryThrow\\<^sub>1.prems by simp+\n  have \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Throw a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v a vs frs \n   {pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)}\" by fact\n  moreover have \"P,C,M \\<rhd> compxE\\<^sub>2 e\\<^sub>1 pc (size vs)/{pc..<?pc\\<^sub>1},size vs\"\n    using beforex I pcs_subset by(force elim!: beforex_appendD1)\n    ultimately have\n      \"\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < ?pc\\<^sub>1 \\<and>\n             \\<not> caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs)) \\<and>\n             (\\<exists>vs'. P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> handle P C M a h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1)\"\n      using TryThrow\\<^sub>1.prems nsub_RI_Jcc_pieces by auto\n    then obtain pc\\<^sub>1 vs' where\n      pc\\<^sub>1_in_e\\<^sub>1: \"pc \\<le> pc\\<^sub>1\" \"pc\\<^sub>1 < ?pc\\<^sub>1\" and\n      pc\\<^sub>1_not_caught: \"\\<not> caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs))\" and\n      0: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> handle P C M a h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1\" by iprover\n  show ?case (is \"?N \\<and> (?eq \\<longrightarrow> ?err)\")\n  proof\n    show ?N by simp\n  next\n    { assume ?eq\n      with TryThrow\\<^sub>1 pc\\<^sub>1_in_e\\<^sub>1 pc\\<^sub>1_not_caught 0\n      have \"?err\" by (simp add:match_ex_entry) auto\n    }\n    thus \"?eq \\<longrightarrow> ?err\" by iprover\n  qed\nnext\n  case Nil\\<^sub>1 thus ?case by simp\nnext\n  case (Cons\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 v h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es fs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val v) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 [] C M pc ics v xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es ?pc\\<^sub>1 (Suc (length vs))))\" by fact\n  then have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Jcc_pieces_Cons[OF _ Cons\\<^sub>1.prems(1-5)] by auto\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  have IHs: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 fs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics (tl ws) xa es' (v#vs) frs\n    (I - pcs (compxE\\<^sub>2 e pc (length vs)))\" by fact\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note 1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> (None,h\\<^sub>2,(rev(ws) @ vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n        using val IHs Cons\\<^sub>1.prems by fastforce\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> (\\<exists>pc\\<^sub>2. ?H pc\\<^sub>2)\")\n    proof\n      assume throw: ?throw\n      then obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>2 \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxEs\\<^sub>2 es ?pc\\<^sub>1 (size vs + 1))\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@v#vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using IHs Cons\\<^sub>1.prems by(fastforce simp:Cons_eq_append_conv neq_Nil_conv)\n      have \"?H pc\\<^sub>2\" using Cons\\<^sub>1.prems pc\\<^sub>2 jvm_trans[OF 1 2] by(auto intro!: exI[where x=\"vs'@[v]\"])\n      thus \"\\<exists>pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n    qed\n  qed\nnext\n  case (ConsThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es)\n  then show ?case using Jcc_pieces_Cons[OF _ ConsThrow\\<^sub>1.prems(1-5)]\n    by (fastforce simp:Cons_eq_append_conv)\nnext\n  case InitFinal\\<^sub>1 then show ?case using eval\\<^sub>1_final_same[OF InitFinal\\<^sub>1.hyps(1)] by clarsimp\nnext\n  case (InitNone\\<^sub>1 sh C\\<^sub>0 C' Cs e h l e' h' l' sh')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa\n     (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitNone\\<^sub>1.prems(1) by clarsimp\n  let ?sh = \"(sh(C\\<^sub>0 \\<mapsto> (sblank P\\<^sub>1 C\\<^sub>0, Prepared)))\"\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,frs',?sh)\"\n    using InitNone\\<^sub>1 jvm_InitNone[where P = P] by(cases frs', simp+)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note 1\n      also have \"P \\<turnstile> (None,h,frs',?sh) -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')\"\n        using InitNone\\<^sub>1.hyps(3)[of E] Jcc_pieces_InitNone[OF assms(1) pcs] InitNone\\<^sub>1.prems val\n         by clarsimp\n      finally have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note 1\n      also obtain vs' where \"P \\<turnstile> (None,h,frs',?sh)\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using InitNone\\<^sub>1.hyps(3)[of E] Jcc_pieces_InitNone[OF assms(1) pcs] throw\n         by clarsimp presburger\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitDone\\<^sub>1 sh C\\<^sub>0 sfs C' Cs e h l e' h' l' sh')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa\n     (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitDone\\<^sub>1.prems(1) by clarsimp\n  let ?frs' = \"(calling_to_scalled (hd frs'))#(tl frs')\"\n  have IH: \"PROP ?P (INIT C' (Cs,True) \\<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I\"\n    by fact\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,?frs',sh)\"\n    using InitDone\\<^sub>1 jvm_InitDP[where P = P] by(cases frs', simp+)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note 1\n      also have \"P \\<turnstile> (None,h,?frs',sh) -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')\"\n        using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitDone\\<^sub>1.prems val by clarsimp\n      finally have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note 1\n      also obtain vs' where \"P \\<turnstile> (None,h,?frs',sh)\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitDone\\<^sub>1.prems throw by clarsimp\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitProcessing\\<^sub>1 sh C\\<^sub>0 sfs C' Cs e h l e' h' l' sh')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa\n     (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitProcessing\\<^sub>1.prems(1) by clarsimp\n  let ?frs' = \"(calling_to_scalled (hd frs'))#(tl frs')\"\n  have IH: \"PROP ?P (INIT C' (Cs,True) \\<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I\"\n    by fact\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,?frs',sh)\"\n    using InitProcessing\\<^sub>1 jvm_InitDP[where P = P] by(cases frs', simp+)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note 1\n      also have \"P \\<turnstile> (None,h,?frs',sh) -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')\"\n        using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitProcessing\\<^sub>1.prems val by clarsimp\n      finally have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note 1\n      also obtain vs' where \"P \\<turnstile> (None,h,?frs',sh)\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitProcessing\\<^sub>1.prems throw by clarsimp\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitError\\<^sub>1 sh C\\<^sub>0 sfs Cs e h l e' h' l' sh' C')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa\n     (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitError\\<^sub>1.prems(1) by clarsimp\n  let ?e\\<^sub>0 = \"THROW NoClassDefFoundError\"\n  let ?frs' = \"(calling_to_sthrowing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs')\"\n  have IH: \"PROP ?P (RI (C\\<^sub>0,?e\\<^sub>0) ; Cs \\<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I\" by fact\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\"\n     and tl: \"tl frs' = frs\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,?frs',sh)\"\n  proof(cases frs')\n    case (Cons a list)\n    obtain vs' l' C' M' pc' ics' where a: \"a = (vs',l',C',M',pc',ics')\" by(cases a)\n    then have \"ics' = Calling C\\<^sub>0 Cs\" using Cons ics by simp\n    then show ?thesis\n     using Cons a IH InitError\\<^sub>1.prems jvm_InitError[where P = P] InitError\\<^sub>1.hyps(1) by simp\n  qed(simp)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      then have False using val rinit\\<^sub>1_throw[OF InitError\\<^sub>1.hyps(2)] by blast\n      then have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      let ?frs = \"(calling_to_throwing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs')\"\n      have exec: \"exec (P, (None,h,?frs,sh)) = Some (None,h,?frs',sh)\"\n        using exec_ErrorThrowing[where sh=sh, OF InitError\\<^sub>1.hyps(1)] ics by(cases \"hd frs'\", simp)\n      obtain vs' where 2: \"P \\<turnstile> (None,h,?frs,sh) -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using IH Jcc_pieces_InitError[OF assms(1) pcs InitError\\<^sub>1.hyps(1)] throw by clarsimp\n      have neq: \"(None, h, ?frs, sh) \\<noteq> handle P C M xa h' (vs' @ vs) l pc ics frs sh'\"\n        using tl ics by(cases \"hd frs'\", simp add: handle_frs_tl_neq)\n\n      note 1\n      also have \"P \\<turnstile> (None,h,?frs',sh) -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using exec_1_exec_all_conf[OF exec 2] neq by simp\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitObject\\<^sub>1 sh C\\<^sub>0 sfs sh' C' Cs e h l e' h' l' sh'')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l'\n    (sh(C\\<^sub>0 \\<mapsto> (sfs, Processing))) v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitObject\\<^sub>1.prems(1) by clarsimp\n  let ?frs' = \"(calling_to_called (hd frs'))#(tl frs')\"\n  have IH: \"PROP ?P (INIT C' (C\\<^sub>0#Cs,True) \\<leftarrow> e) h l sh' e' h' l' sh'' E C M pc ics v xa vs frs I\"\n    by fact\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,?frs',sh')\"\n  proof(cases frs')\n    case (Cons a list)\n    obtain vs' l' C' M' pc' ics' where a: \"a = (vs',l',C',M',pc',ics')\" by(cases a)\n    then have \"ics' = Calling C\\<^sub>0 Cs\" using Cons ics by simp\n    then show ?thesis\n     using Cons Nil a IH InitObject\\<^sub>1 jvm_InitObj[where P = P] by simp\n  qed(simp)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note 1\n      also have \"P \\<turnstile> (None,h,?frs',sh') -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh'')\"\n        using IH Jcc_pieces_InitObj[OF assms(1) pcs] InitObject\\<^sub>1 val by simp\n      finally have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note 1\n      also obtain vs' where \"P \\<turnstile> (None,h,?frs',sh')\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh''\"\n        using IH Jcc_pieces_InitObj[OF assms(1) pcs] InitObject\\<^sub>1 throw by clarsimp\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitNonObject\\<^sub>1 sh C\\<^sub>0 sfs D a b sh' C' Cs e h l e' h' l' sh'')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l'\n    (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitNonObject\\<^sub>1.prems(1) by clarsimp\n  let ?frs' = \"(calling_to_calling (hd frs') D)#(tl frs')\"\n  have cls1: \"is_class P\\<^sub>1 D\" using InitNonObject\\<^sub>1.hyps(2,3) class_wf wf wf_cdecl_supD by blast\n  have cls_aux: \"distinct (C\\<^sub>0#Cs) \\<and> supercls_lst P\\<^sub>1 (C\\<^sub>0#Cs)\" using InitNonObject\\<^sub>1.prems(1) by auto\n  then have cls2: \"D \\<notin> set (C\\<^sub>0 # Cs)\"\n  proof -\n    have \"distinct (D # C\\<^sub>0 # Cs)\"\n      using InitNonObject\\<^sub>1.hyps(2,3) cls_aux wf wf_supercls_distinct_app by blast\n    then show \"D \\<notin> set (C\\<^sub>0 # Cs)\"\n      by (metis distinct.simps(2))\n  qed\n  have cls3: \"\\<forall>C\\<in>set (C\\<^sub>0 # Cs). P\\<^sub>1 \\<turnstile> C \\<preceq>\\<^sup>* D\" using InitNonObject\\<^sub>1.hyps(2,3) cls_aux\n    by (metis r_into_rtrancl rtrancl_into_rtrancl set_ConsD subcls1.subcls1I supercls_lst.simps(1))\n  have IH: \"PROP ?P (INIT C' (D # C\\<^sub>0 # Cs,False) \\<leftarrow> e) h l sh' e' h' l' sh'' E C M pc ics v xa vs frs I\"\n    by fact\n  obtain r where cls: \"class P C\\<^sub>0 = \\<lfloor>(D, r)\\<rfloor>\" using InitNonObject\\<^sub>1.hyps(3)\n    by (metis assms class_compP compP\\<^sub>2_def)\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,?frs',sh')\"\n  proof(cases frs')\n    case (Cons a list)\n    obtain vs' l' C' M' pc' ics' where a: \"a = (vs',l',C',M',pc',ics')\" by(cases a)\n    then have \"ics' = Calling C\\<^sub>0 Cs\" using Cons ics by simp\n    then show ?thesis\n     using Cons a IH InitNonObject\\<^sub>1 jvm_InitNonObj[OF _ _ cls] by simp\n  qed(simp)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note 1\n      also have \"P \\<turnstile> (None,h,?frs',sh') -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh'')\"\n        using IH Jcc_pieces_InitNonObj[OF assms(1) cls1 cls2 cls3 pcs] InitNonObject\\<^sub>1 val by simp\n      finally have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note 1\n      also obtain vs' where \"P \\<turnstile> (None,h,?frs',sh')\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh''\"\n        using IH Jcc_pieces_InitNonObj[OF assms(1) cls1 cls2 cls3 pcs] InitNonObject\\<^sub>1 throw by clarsimp\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitRInit\\<^sub>1 C\\<^sub>0 Cs e h l sh e' h' l' sh' C')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa\n     (INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitRInit\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I\"\n    by fact\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      have \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')\"\n        using IH Jcc_pieces_InitRInit[OF assms(1,2) pcs] InitRInit\\<^sub>1.prems val by simp\n      then have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      obtain vs' where \"P \\<turnstile> (None,h,frs',sh)\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using IH Jcc_pieces_InitRInit[OF assms(1,2) pcs] InitRInit\\<^sub>1 throw by clarsimp\n      then have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (RInit\\<^sub>1 e h l sh v1 h' l' sh' C\\<^sub>0 sfs i sh'' C' Cs e' e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1)\n  let ?frs = \"(vs,l,C,M,pc,Called (C\\<^sub>0#Cs)) # frs\"\n  let ?frs' = \"(vs,l,C,M,pc,Called Cs) # frs\"\n  have clinit: \"e = C\\<^sub>0\\<bullet>\\<^sub>sclinit([])\" using RInit\\<^sub>1\n    by (metis Jcc_cond.simps(2) eval\\<^sub>1_final_same exp.distinct(101) final_def)\n  then obtain err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa\n     (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> e')\n    = (True, ?frs, (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1), err)\"\n    using RInit\\<^sub>1.prems(1) by simp\n  have shC: \"\\<forall>C'\\<in>set Cs. \\<exists>sfs. sh C' = \\<lfloor>(sfs, Processing)\\<rfloor>\" using RInit\\<^sub>1.prems(1) clinit by clarsimp\n  then have shC'': \"\\<forall>C'\\<in>set Cs. \\<exists>sfs. sh'' C' = \\<lfloor>(sfs, Processing)\\<rfloor>\"\n    using clinit\\<^sub>1_proc_pres[OF wf] RInit\\<^sub>1.hyps(1) clinit RInit\\<^sub>1.hyps(4) RInit\\<^sub>1.prems(1)\n      by (auto simp: fun_upd_apply)\n  have loc: \"l = l'\" using clinit\\<^sub>1_loc_pres RInit\\<^sub>1.hyps(1) clinit by simp\n  have IH: \"PROP ?P e h l sh (Val v1) h' l' sh' E C M pc (Called Cs) v1 xa vs (tl ?frs') I\" by fact\n  then have IH':\n   \"PROP ?P (C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) h l sh (Val v1) h' l' sh' E C M pc (Called Cs) v1 xa vs (tl ?frs') I\"\n    using clinit by simp\n  have IH2: \"PROP ?P (INIT C' (Cs,True) \\<leftarrow> e') h' l' sh'' e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 E C M\n    pc ics v xa vs frs I\" by fact\n  have \"P \\<turnstile> (None,h,?frs,sh) -jvm\\<rightarrow> (None,h,create_init_frame P C\\<^sub>0 # ?frs',sh)\" by(rule jvm_Called)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h',?frs',sh'')\"\n     using IH' Jcc_pieces_RInit_clinit[OF assms(1-2) pcs,of h' l' sh'] RInit\\<^sub>1.hyps(3,4) by simp\n  finally have jvm1: \"P \\<turnstile> (None,h,?frs,sh) -jvm\\<rightarrow> (None,h',?frs',sh'')\" .\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note jvm1\n      also have \"P \\<turnstile> (None,h',?frs',sh'') -jvm\\<rightarrow> (None,h\\<^sub>1,(vs,l,C,M,pc,Called [])#frs,sh\\<^sub>1)\"\n        using IH2 Jcc_pieces_RInit_Init[OF assms(1-2) shC'' pcs,of h'] RInit\\<^sub>1.hyps(5) loc val by auto\n      finally have ?jvm1 using pcs clinit by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note jvm1\n      also obtain vs' where \"P \\<turnstile> (None,h',?frs',sh'')\n                     -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) l pc ics frs sh\\<^sub>1\"\n        using IH2 Jcc_pieces_RInit_Init[OF assms(1-2) shC'' pcs,of h'] RInit\\<^sub>1.hyps(5) loc throw by auto\n      finally have ?err using pcs clinit by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (RInitInitFail\\<^sub>1 e h l sh a h' l' sh' C\\<^sub>0 sfs i sh'' D Cs e' e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1)\n  let ?frs = \"(vs,l,C,M,pc,Called (C\\<^sub>0#D#Cs)) # frs\"\n  let ?frs' = \"(vs,l,C,M,pc,Called (D#Cs)) # frs\"\n  let \"?frsT\" = \"\\<lambda>xa1. (vs,l,C,M,pc,Throwing (C\\<^sub>0#D#Cs) xa1) # frs\"\n  let \"?frsT'\" = \"\\<lambda>xa1. (vs,l,C,M,pc,Throwing (D#Cs) xa1) # frs\"\n  obtain xa' where xa': \"throw a = Throw xa'\"\n    by (metis RInitInitFail\\<^sub>1.hyps(1) eval\\<^sub>1_final exp.distinct(101) final_def)\n  have e\\<^sub>1: \"e\\<^sub>1 = Throw xa'\" using xa' rinit\\<^sub>1_throw RInitInitFail\\<^sub>1.hyps(5) by simp\n  show ?case\n  proof(cases \"e = C\\<^sub>0\\<bullet>\\<^sub>sclinit([])\")\n    case clinit: True\n    then obtain err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa'\n       (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; D # Cs \\<leftarrow> e')\n      = (True, ?frs, (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1), err)\"\n      using RInitInitFail\\<^sub>1.prems(1) by simp\n    have loc: \"l = l'\" using clinit\\<^sub>1_loc_pres RInitInitFail\\<^sub>1.hyps(1) clinit by simp\n    have IH: \"PROP ?P e h l sh (throw a) h' l' sh' E C M pc (Called (D#Cs)) v xa' vs frs I\"\n     by fact\n    then have IH':\n     \"PROP ?P (C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) h l sh (Throw xa') h' l' sh' E C M pc (Called (D#Cs)) v xa' vs\n       frs I\"  using clinit xa' by simp\n    have IH2: \"PROP ?P (RI (D,throw a) ; Cs \\<leftarrow> e') h' l' sh'' e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 E C M\n      pc ics v xa' vs frs I\" by fact\n    have \"P \\<turnstile> (None,h,?frs,sh) -jvm\\<rightarrow> (None,h,create_init_frame P C\\<^sub>0 # ?frs',sh)\" by(rule jvm_Called)\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h',(vs, l, C, M, pc, Throwing (D#Cs) xa') # frs,sh'')\"\n      using IH' Jcc_pieces_RInit_clinit[OF assms(1-2) pcs,of h' l' sh'] RInitInitFail\\<^sub>1.hyps(3,4)\n        by simp\n    also obtain vs'' where \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M xa' h\\<^sub>1 (vs''@vs) l pc ics frs sh\\<^sub>1\"\n      using IH2 pcs Jcc_pieces_RInit_RInit[OF assms(1) pcs] RInitInitFail\\<^sub>1.hyps(3,4)\n        xa' loc e\\<^sub>1 xa' by clarsimp\n    finally show ?thesis using pcs e\\<^sub>1 clinit by auto\n  next\n    case throw: False\n    then have eT: \"e = Throw xa'\" \"h = h'\" \"l = l'\" \"sh = sh'\" using xa' RInitInitFail\\<^sub>1.prems(1)\n      eval\\<^sub>1_final_same[OF RInitInitFail\\<^sub>1.hyps(1)] by clarsimp+\n    obtain a' where \"class P\\<^sub>1 C\\<^sub>0 = \\<lfloor>a'\\<rfloor>\" using RInitInitFail\\<^sub>1.prems by(auto simp: is_class_def)\n    then obtain stk' loc' M' pc' ics' where \"create_init_frame P C\\<^sub>0 = (stk',loc',C\\<^sub>0,M',pc',ics')\"\n      using create_init_frame_wf_eq[OF wf] by(cases \"create_init_frame P C\\<^sub>0\", simp)\n    then obtain rhs err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh'' v xa'\n       (RI (C\\<^sub>0,e) ; D#Cs \\<leftarrow> e') = (True, ?frsT xa', rhs, err)\"\n      using RInitInitFail\\<^sub>1.prems(1) eT by clarsimp\n    have IH2: \"PROP ?P (RI (D,throw a) ; Cs \\<leftarrow> e') h' l' sh'' e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 E C M\n      pc ics v xa' vs frs I\" by fact\n    have \"P \\<turnstile> (None,h,?frsT xa',sh') -jvm\\<rightarrow> (None,h,?frsT' xa',sh'(C\\<^sub>0 \\<mapsto> (fst (the (sh' C\\<^sub>0)), Error)))\"\n      by(rule jvm_Throwing)\n    also obtain vs' where \"P \\<turnstile> ... -jvm\\<rightarrow> handle P C M xa' h\\<^sub>1 (vs'@vs) l pc ics frs sh\\<^sub>1\"\n      using IH2 Jcc_pieces_RInit_RInit[OF assms(1) pcs] RInitInitFail\\<^sub>1.hyps(3,4)\n       eT e\\<^sub>1 xa' by clarsimp\n    finally show ?thesis using pcs e\\<^sub>1 throw eT by auto\n  qed\nnext\n  case (RInitFailFinal\\<^sub>1 e h l sh a h' l' sh' C\\<^sub>0 sfs i sh'' e'')\n  let ?frs = \"(vs,l,C,M,pc,Called [C\\<^sub>0]) # frs\"\n  let ?frs' = \"(vs,l,C,M,pc,Called []) # frs\"\n  let \"?frsT\" = \"\\<lambda>xa1. (vs,l,C,M,pc,Throwing [C\\<^sub>0] xa1) # frs\"\n  let \"?frsT'\" = \"\\<lambda>xa1. (vs,l,C,M,pc,Throwing [] xa1) # frs\"\n  obtain xa' where xa': \"throw a = Throw xa'\"\n    by (metis RInitFailFinal\\<^sub>1.hyps(1) eval\\<^sub>1_final exp.distinct(101) final_def)\n  show ?case\n  proof(cases \"e = C\\<^sub>0\\<bullet>\\<^sub>sclinit([])\")\n    case clinit: True\n    then obtain err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh'' v xa'\n       (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; [] \\<leftarrow> unit) = (True, ?frs, (None, h', ?frs', sh''), err)\"\n      using RInitFailFinal\\<^sub>1.prems(1) by clarsimp\n    have IH: \"PROP ?P e h l sh (throw a) h' l' sh' E C M pc (Called []) v xa' vs frs I\" by fact\n    then have IH':\n     \"PROP ?P (C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) h l sh (throw a) h' l' sh' E C M pc (Called []) v xa' vs frs I\"\n      using clinit by simp\n    have \"P \\<turnstile> (None,h,?frs,sh) -jvm\\<rightarrow> (None,h,create_init_frame P C\\<^sub>0 # ?frs',sh)\"\n      by(rule jvm_Called)\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h',?frsT' xa',sh'')\"\n      using IH' Jcc_pieces_RInit_clinit[OF assms(1-2) pcs,of h' l' sh'] xa'\n        RInitFailFinal\\<^sub>1.hyps(3,4) by simp\n    also have\n       \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle (compP compMb\\<^sub>2 P\\<^sub>1) C M xa' h' vs l pc No_ics frs sh''\"\n      using RInitFailFinal\\<^sub>1.hyps(3,4) jvm_RInit_throw[where h=h' and sh=sh''] by simp\n    finally show ?thesis using xa' pcs clinit by(clarsimp intro!: exI[where x=\"[]\"])\n  next\n    case throw: False\n    then have eT: \"e = Throw xa'\" \"h = h'\" \"sh = sh'\" using xa' RInitFailFinal\\<^sub>1.prems(1)\n      eval\\<^sub>1_final_same[OF RInitFailFinal\\<^sub>1.hyps(1)] by clarsimp+\n    obtain a where \"class P\\<^sub>1 C\\<^sub>0 = \\<lfloor>a\\<rfloor>\" using RInitFailFinal\\<^sub>1.prems by(auto simp: is_class_def)\n    then obtain stk' loc' M' pc' ics' where \"create_init_frame P C\\<^sub>0 = (stk',loc',C\\<^sub>0,M',pc',ics')\"\n      using create_init_frame_wf_eq[OF wf] by(cases \"create_init_frame P C\\<^sub>0\", simp)\n    then obtain rhs err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh'' v xa'\n       (RI (C\\<^sub>0,e) ; [] \\<leftarrow> unit) = (True, ?frsT xa', rhs, err)\"\n      using RInitFailFinal\\<^sub>1.prems(1) eT by clarsimp\n    have \"P \\<turnstile> (None,h,?frsT xa',sh) -jvm\\<rightarrow> (None,h,?frsT' xa',sh(C\\<^sub>0 \\<mapsto> (fst (the (sh C\\<^sub>0)), Error)))\"\n      by(rule jvm_Throwing)\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M xa' h' vs l pc No_ics frs sh''\"\n      using RInitFailFinal\\<^sub>1.hyps(3,4) jvm_RInit_throw[where h=h and sh=sh''] eT by simp\n    finally show ?thesis using pcs xa' by(clarsimp intro!: exI[where x=\"[]\"])\n  qed\nqed\n(*>*)\n\n(*FIXME move! *)\nlemma atLeast0AtMost[simp]: \"{0::nat..n} = {..n}\"\nby auto\n\nlemma atLeast0LessThan[simp]: \"{0::nat..<n} = {..<n}\"\nby auto\n\nfun exception :: \"'a exp \\<Rightarrow> addr option\" where\n  \"exception (Throw a) = Some a\"\n| \"exception e = None\"\n\nlemma comp\\<^sub>2_correct:\nassumes wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\n    and \"method\": \"P\\<^sub>1 \\<turnstile> C sees M,b:Ts\\<rightarrow>T = body in C\"\n    and eval:   \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>body,(h,ls,sh)\\<rangle> \\<Rightarrow> \\<langle>e',(h',ls',sh')\\<rangle>\"\n    and nclinit: \"M \\<noteq> clinit\"\nshows \"compP\\<^sub>2 P\\<^sub>1 \\<turnstile> (None,h,[([],ls,C,M,0,No_ics)],sh) -jvm\\<rightarrow> (exception e',h',[],sh')\"\n(*<*)\n      (is \"_ \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\")\nproof -\n  let ?P = \"compP\\<^sub>2 P\\<^sub>1\"\n  let ?E = \"case b of Static \\<Rightarrow> Ts | NonStatic \\<Rightarrow> Class C#Ts\"\n  have nsub: \"\\<not>sub_RI body\" using sees_wf\\<^sub>1_nsub_RI[OF wf method] by simp\n  have code: \"?P,C,M,0 \\<rhd> compE\\<^sub>2 body\" using beforeM[OF \"method\"] by auto\n  have xtab: \"?P,C,M \\<rhd> compxE\\<^sub>2 body 0 (size[])/{..<size(compE\\<^sub>2 body)},size[]\"\n    using beforexM[OF \"method\"] by auto\n  have cond: \"Jcc_cond P\\<^sub>1 ?E C M [] 0 No_ics {..<size(compE\\<^sub>2 body)} h sh body\"\n    using nsub_RI_Jcc_pieces nsub code xtab by auto\n  \\<comment> \\<open>Distinguish if e' is a value or an exception\\<close>\n  { fix v assume [simp]: \"e' = Val v\"\n    have \"?P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h',[([v],ls',C,M,size(compE\\<^sub>2 body),No_ics)],sh')\"\n      using Jcc[OF wf eval cond] nsub_RI_Jcc_pieces[OF _ nsub] by auto\n    also have \"?P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using beforeM[OF \"method\"] nclinit by auto\n    finally have ?thesis .\n  }\n  moreover\n  { fix a assume [simp]: \"e' = Throw a\"\n    obtain pc vs' where pc: \"0 \\<le> pc \\<and> pc < size(compE\\<^sub>2 body) \\<and>\n          \\<not> caught ?P pc h' a (compxE\\<^sub>2 body 0 0)\"\n    and 1: \"?P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> handle ?P C M a h' vs' ls' pc No_ics [] sh'\"\n      using Jcc[OF wf eval cond] nsub_RI_Jcc_pieces[OF _ nsub] by auto meson\n    from pc have \"handle ?P C M a h' vs' ls' pc No_ics [] sh' = ?\\<sigma>\\<^sub>1\" using xtab \"method\" nclinit\n      by(auto simp:handle_def compMb\\<^sub>2_def)\n    with 1 have ?thesis by simp\n  } \n  ultimately show ?thesis using eval\\<^sub>1_final[OF eval] by(auto simp:final_def)\nqed\n(*>*)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/Compiler/Correctness2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3342658502355507}}
{"text": "theory Sepref_Misc\nimports \n  \"../Refine_Monadic_Add\"\n  PO_Normalizer\n  \"List-Index.List_Index\"\n  \"Refine_Imperative_HOL.Named_Theorems_Rev\"\n  \"HOL-Eisbach.Eisbach\"\nbegin\n\n  hide_const (open) CONSTRAINT\n\n  (* Additions for List_Index *)  \n  lemma index_of_last_distinct[simp]: \n    \"distinct l \\<Longrightarrow> index l (last l) = length l - 1\"  \n    apply (cases l rule: rev_cases)\n    apply (auto simp: index_append)\n    done\n\n  lemma index_eqlen_conv[simp]: \"index l x = length l \\<longleftrightarrow> x\\<notin>set l\"\n    by (auto simp: index_size_conv)\n\n\n  subsection \\<open>Iterated Curry and Uncurry\\<close>    \n\n\n  text \\<open>Uncurry0\\<close>  \n  definition \"uncurry0 c \\<equiv> \\<lambda>_::unit. c\"\n  definition curry0 :: \"(unit \\<Rightarrow> 'a) \\<Rightarrow> 'a\" where \"curry0 f = f ()\"\n  lemma uncurry0_apply[simp]: \"uncurry0 c x = c\" by (simp add: uncurry0_def)\n\n  lemma curry_uncurry0_id[simp]: \"curry0 (uncurry0 f) = f\" by (simp add: curry0_def)\n  lemma uncurry_curry0_id[simp]: \"uncurry0 (curry0 g) = g\" by (auto simp: curry0_def)\n  lemma param_uncurry0[param]: \"(uncurry0,uncurry0) \\<in> A \\<rightarrow> (unit_rel\\<rightarrow>A)\" by auto\n    \n  text \\<open>Abbreviations for higher-order uncurries\\<close>    \n  abbreviation \"uncurry2 f \\<equiv> uncurry (uncurry f)\"\n  abbreviation \"curry2 f \\<equiv> curry (curry f)\"\n  abbreviation \"uncurry3 f \\<equiv> uncurry (uncurry2 f)\"\n  abbreviation \"curry3 f \\<equiv> curry (curry2 f)\"\n  abbreviation \"uncurry4 f \\<equiv> uncurry (uncurry3 f)\"\n  abbreviation \"curry4 f \\<equiv> curry (curry3 f)\"\n  abbreviation \"uncurry5 f \\<equiv> uncurry (uncurry4 f)\"\n  abbreviation \"curry5 f \\<equiv> curry (curry4 f)\"\n  abbreviation \"uncurry6 f \\<equiv> uncurry (uncurry5 f)\"\n  abbreviation \"curry6 f \\<equiv> curry (curry5 f)\"\n  abbreviation \"uncurry7 f \\<equiv> uncurry (uncurry6 f)\"\n  abbreviation \"curry7 f \\<equiv> curry (curry6 f)\"\n  abbreviation \"uncurry8 f \\<equiv> uncurry (uncurry7 f)\"\n  abbreviation \"curry8 f \\<equiv> curry (curry7 f)\"\n  abbreviation \"uncurry9 f \\<equiv> uncurry (uncurry8 f)\"\n  abbreviation \"curry9 f \\<equiv> curry (curry8 f)\"\n\n    \n    \n  lemma fold_partial_uncurry: \"uncurry (\\<lambda>(ps, cf). f ps cf) = uncurry2 f\" by auto\n\n  lemma curry_shl: \n    \"\\<And>g f. (g \\<equiv> curry f) \\<equiv> (uncurry g \\<equiv> f)\"\n    \"\\<And>g f. (g \\<equiv> curry0 f) \\<equiv> (uncurry0 g \\<equiv> f)\"\n    by (atomize (full); auto)+\n  \n  lemma curry_shr: \n    \"\\<And>f g. (curry f \\<equiv> g) \\<equiv> (f \\<equiv> uncurry g)\"\n    \"\\<And>f g. (curry0 f \\<equiv> g) \\<equiv> (f \\<equiv> uncurry0 g)\"\n    by (atomize (full); auto)+\n  \n  lemmas uncurry_shl = curry_shr[symmetric]  \n  lemmas uncurry_shr = curry_shl[symmetric]  \n  \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/sepref/Lib/Sepref_Misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381372136563, "lm_q2_score": 0.6113819732941511, "lm_q1q2_score": 0.33426584120485353}}
{"text": "theory flash103Bra  imports flash103Rev\n \n  begin\nlemma onInv103:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv103 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv103 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv103 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash103Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7310585786300049, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.33419371844349544}}
{"text": "theory flash6Bra  imports flash6Rev\n \n  begin\nlemma onInv6:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv6  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv6  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv6 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash6Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702880639791, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.3341773656224463}}
{"text": "theory flash113Bra  imports flash113Rev\n \n  begin\nlemma onInv113:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv113 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv113 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv113 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash113Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702761768248, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.3341773601422687}}
{"text": "theory LLVM_Memory_RS\nimports \n  \"../basic/LLVM_Basic_Main\"\n  Sep_Value_RS \n  Sep_Array_Block_RS\nbegin\n  \n  interpretation ab: array_block2 \"STATIC_ERROR ''''\" MEM_ERROR \"vload MEM_ERROR::_ \\<Rightarrow> (llvm_primval val,_,_,_) M\" \"vstore MEM_ERROR\" \"checked_gep MEM_ERROR\" val_\\<alpha> vpto_assn \"\\<lambda>v. v\\<in>range val_\\<alpha>\"\n    apply unfold_locales\n    apply (rule vload_rule)\n    apply (rule vstore_rule)\n    apply (rule vpto_assn_notZ)\n    apply auto []\n    apply (simp; rule vpto_assn_this)\n    apply auto []\n    done\n  \n  \n  datatype llvm_amemory = LLVM_AMEMORY (the_amemory: \"(nat \\<Rightarrow> (nat \\<Rightarrow> llvm_primval aval) \\<times> int tsa_opt)\")\n  \n  instantiation llvm_amemory :: unique_zero_sep_algebra begin\n    definition \"sep_disj_llvm_amemory a b \\<equiv> the_amemory a ## the_amemory b\"\n    definition \"plus_llvm_amemory a b \\<equiv> LLVM_AMEMORY (the_amemory a + the_amemory b)\"\n    definition \"zero_llvm_amemory \\<equiv> LLVM_AMEMORY 0\"\n  \n    instance\n      apply standard\n      unfolding sep_disj_llvm_amemory_def plus_llvm_amemory_def zero_llvm_amemory_def\n      apply (auto simp: sep_algebra_simps llvm_amemory.expand)\n      done\n      \n  end    \n  \n  type_synonym llvm_assn = \"llvm_amemory \\<Rightarrow> bool\"\n  \n  definition \"llvm_\\<alpha> \\<equiv> LLVM_AMEMORY o ab.ba.\\<alpha> o llvm_memory.the_memory\"\n  definition \"llvm_pto x p \\<equiv> (ab.ba.pto (llvm_val.the_val x) (llvm_ptr.the_ptr p)) o llvm_amemory.the_amemory\"\n  (*definition \"llvm_is_base_ptr p \\<equiv> ab.is_base_ptr (llvm_ptr.the_ptr p)\"*)\n  \n  definition \"llvm_malloc_tag n p \\<equiv> ab.ba.tag n (llvm_ptr.the_ptr p) o llvm_amemory.the_amemory\"\n  \n  instantiation llvm_ptr :: addr_algebra begin\n    definition \"abase_llvm_ptr = abase o llvm_ptr.the_ptr\"\n    definition \"acompat_llvm_ptr a b \\<equiv> acompat (llvm_ptr.the_ptr a) (llvm_ptr.the_ptr b)\"\n    definition \"adiff_llvm_ptr a b \\<equiv> adiff (llvm_ptr.the_ptr a) (llvm_ptr.the_ptr b)\"\n    definition \"aidx_llvm_ptr a i \\<equiv> LLVM_PTR ((llvm_ptr.the_ptr a) +\\<^sub>a i)\"\n    \n    instance\n      apply standard\n      unfolding abase_llvm_ptr_def acompat_llvm_ptr_def adiff_llvm_ptr_def aidx_llvm_ptr_def\n      apply (intro part_equivpI sympI transpI)\n      apply (metis ab.block_ptr_imp_abase ab.is_block_ptr_simps(2) acompat_refl llvm_ptr.sel)\n      apply (auto intro: acompat_sym acompat_trans simp: acompat_dom)\n      done\n  end\n  \n  \n  (*\n  definition \"llvm_idx_ptr p i \\<equiv> LLVM_PTR (ab.idx_ptr (llvm_ptr.the_ptr p) i)\"\n  definition \"llvm_is_arr_ptr p \\<equiv> ab.is_arr_ptr (llvm_ptr.the_ptr p)\"\n  \n  lemma llvm_idx_ptr_add[simp]: \"llvm_idx_ptr (llvm_idx_ptr p i) j = llvm_idx_ptr p (i+j)\"\n    by (cases p) (auto simp: llvm_idx_ptr_def)\n  \n  lemma llvm_is_arr_ptr_idx[simp]: \"llvm_is_arr_ptr (llvm_idx_ptr p i) \\<longleftrightarrow> llvm_is_arr_ptr p\"\n    by (cases p) (auto simp: llvm_idx_ptr_def llvm_is_arr_ptr_def)\n  *)  \n    \n  \n  lemma xfer_htriple: \n    assumes \"htriple ab.ba.\\<alpha> P c Q\"\n    assumes \"P' = P o llvm_amemory.the_amemory\"\n    assumes \"c' = llvm_zoom_base \\<alpha> c\"\n    assumes \"\\<And>r. Q' (\\<alpha> r) = Q r o llvm_amemory.the_amemory\"\n    shows \"htriple llvm_\\<alpha> P' c' Q'\"\n    using assms unfolding htriple_alt llvm_zoom_base_def llvm_\\<alpha>_def wp_def\n    apply (clarsimp simp: run_simps)\n  proof goal_cases\n    case A: (1 p s f)\n    \n    \n    \n    find_theorems llvm_memory.the_memory\\<^sub>L\n    \n    from \\<open>p##f\\<close> \\<open>LLVM_AMEMORY (ab.ba.\\<alpha> (get' llvm_memory.the_memory\\<^sub>L s)) = p + f\\<close>\n    have \"llvm_amemory.the_amemory p ## llvm_amemory.the_amemory f\"\n      and \"ab.ba.\\<alpha> (get' llvm_memory.the_memory\\<^sub>L s) = llvm_amemory.the_amemory p + llvm_amemory.the_amemory f\"\n      by (auto simp: sep_disj_llvm_amemory_def plus_llvm_amemory_def)\n    \n    from A(1)[rule_format] show ?case\n      apply (rule mwp_cons)\n      apply (intro conjI; fact)\n      apply (clarsimp_all simp: run_simps)\n      by (metis (full_types) assms(4) comp_apply llvm_amemory.sel plus_llvm_amemory_def sep_disj_llvm_amemory_def)\n    \n  qed  \n    \n    \n  \n  \n  lemma llvm_load_rule[vcg_rules]: \"htriple llvm_\\<alpha> (llvm_pto x p) (llvm_load p) (\\<lambda>r. \\<up>(r=x) ** llvm_pto x p)\"\n    apply (rule xfer_htriple[OF ab.ba.load_rule])\n    unfolding llvm_pto_def llvm_load_def\n    apply simp\n    apply simp\n    apply (rule ext)\n    apply (auto simp: sep_algebra_simps pred_lift_extract_simps)\n    done\n\n  lemma llvm_store_unchecked_rule[vcg_rules]: \"htriple llvm_\\<alpha> (llvm_pto xx p) (llvm_store_unchecked x p) (\\<lambda>_. llvm_pto x p)\"\n    apply (rule xfer_htriple[OF ab.ba.store_rule])\n    unfolding llvm_pto_def llvm_store_unchecked_def\n    apply simp\n    apply simp\n    apply (rule ext)\n    apply (auto simp: sep_algebra_simps pred_lift_extract_simps)\n    done\n\n    \n  lemma llvm_store_rule[vcg_rules]: \"llvm_vstruct x = llvm_vstruct xx \n    \\<Longrightarrow> htriple llvm_\\<alpha> (llvm_pto xx p) (llvm_store x p) (\\<lambda>_. llvm_pto x p)\"\n    unfolding llvm_store_def\n    by vcg\n    \n    \n  lemma the_amemoryZ[simp]: \"the_amemory 0 = 0\" by (auto simp: zero_llvm_amemory_def)\n\n  lemma the_amemoryZ_iff[simp]: \"the_amemory x = 0 \\<longleftrightarrow> x=0\" \n    by (auto simp: zero_llvm_amemory_def llvm_amemory.expand)\n    \n    \n  lemma xfer_sep_conj1: \"((\\<lambda>x. a (the_amemory x)) ** (\\<lambda>x. b (the_amemory x))) = (a**b) o the_amemory\"  \n    apply (rule ext)\n    apply (auto 3 3 simp: sep_conj_def sep_disj_llvm_amemory_def plus_llvm_amemory_def)\n    by (metis (full_types) llvm_amemory.exhaust_sel llvm_amemory.sel)\n\n  lemma xfer_sep_conj2: \"((a o the_amemory) ** (b o the_amemory)) = (a**b) o the_amemory\"  \n    using xfer_sep_conj1 unfolding comp_def .\n\n  lemmas xfer_sep_conj = xfer_sep_conj1 xfer_sep_conj2\n            \n  lemma xfer_sep_list_conj1: \"(\\<And>*map (\\<lambda>x. f x o the_amemory) l) = (\\<And>*map f l) o the_amemory\"  \n    apply (induction l)\n    apply auto\n    by (auto intro!: ext simp: sep_algebra_simps xfer_sep_conj)\n\n  lemma xfer_sep_list_conj2: \"(\\<And>*map (\\<lambda>x s. f x (the_amemory s)) l) = (\\<And>*map f l) o the_amemory\"  \n    using xfer_sep_list_conj1 unfolding comp_def .\n      \n  lemmas xfer_sep_list_conj = xfer_sep_list_conj1 xfer_sep_list_conj2  \n\n  lemma xfer_sep_set_img1: \"(\\<Union>*x\\<in>I. f x o the_amemory) = (\\<Union>*x\\<in>I. f x) o the_amemory\"  \n  proof (cases \"finite I\")  \n    case True then show ?thesis\n      by (induction) (auto del: ext intro!: ext simp: sep_algebra_simps xfer_sep_conj)\n  qed auto   \n\n  lemma xfer_sep_set_img2: \"(\\<Union>*x\\<in>I. (\\<lambda>s. f x (the_amemory s))) = (\\<Union>*x\\<in>I. f x) o the_amemory\"  \n    using xfer_sep_set_img1 unfolding comp_def .\n      \n  lemmas xfer_sep_set_img = xfer_sep_set_img1 xfer_sep_set_img2  \n  \n      \n  lemma llvm_allocn_rule[vcg_rules]: \n    \"htriple llvm_\\<alpha> \n      \\<box> \n      (llvm_allocn v n) \n      (\\<lambda>r. (\\<Union>*i\\<in>{0..<int n}. llvm_pto v (r +\\<^sub>a i)) \n        ** llvm_malloc_tag (int n) r ** \\<up>(abase r))\"  \n    apply (rule xfer_htriple[OF ab.ba_allocn_rule])\n    unfolding llvm_pto_def llvm_allocn_def llvm_malloc_tag_def abase_llvm_ptr_def aidx_llvm_ptr_def\n    apply (rule ext) apply (auto simp: sep_algebra_simps) []\n    apply simp\n    apply (rule ext)\n    apply (auto simp: sep_algebra_simps pred_lift_extract_simps xfer_sep_set_img xfer_sep_conj)\n    done\n            \n    \n    \n  lemma llvm_free_rule[vcg_rules]:\n    \"htriple llvm_\\<alpha> \n      ((\\<Union>*i\\<in>{0..<n}. EXS v. llvm_pto v (p +\\<^sub>a i)) \n        ** llvm_malloc_tag n p)\n      (llvm_free p)\n      (\\<lambda>_. \\<box>)\"  \n    apply (rule xfer_htriple[OF ab.ba_freen_rule[where p=\"llvm_ptr.the_ptr p\" and n=n], where \\<alpha>=id])\n    apply (cases p; simp add: )\n    \n    unfolding llvm_pto_def llvm_free_def llvm_malloc_tag_def aidx_llvm_ptr_def\n    apply (auto simp: sep_algebra_simps)\n    apply (subst xfer_sep_set_img xfer_sep_conj)+\n    apply (cases p; simp)\n    by (metis llvm_val.sel)\n  \n  lemma llvm_checked_idx_ptr_rule[vcg_rules]:\n    \"abase p \\<Longrightarrow>\n      htriple llvm_\\<alpha>\n        (llvm_pto v (p +\\<^sub>a i))\n        (llvm_checked_idx_ptr p i)\n        (\\<lambda>r. \\<up>(r= p +\\<^sub>a i) ** llvm_pto v (p +\\<^sub>a i))\n    \"\n    \n    supply R=xfer_htriple[OF ab.checked_idx_ptr_rule[where p=\"llvm_ptr.the_ptr p\" and i=i and xx=\"llvm_val.the_val v\"], where \\<alpha>=LLVM_PTR]\n    apply (rule R)\n    unfolding llvm_checked_idx_ptr_def llvm_pto_def abase_llvm_ptr_def aidx_llvm_ptr_def\n    apply (auto simp: xfer_sep_conj sep_algebra_simps pred_lift_extract_simps)\n    done\n    \n  \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/vcg/LLVM_Memory_RS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702642896702, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.334177354662091}}
{"text": "theory FunctionalImplementation\nimports Initialization SolveLoop\nbegin\n\n(******************************************************************************)\nsubsection\\<open>Total correctness theorem\\<close>\n(******************************************************************************)\n\ntheorem correctness:\nshows \n\"(solve F0 = TRUE \\<and> satisfiable F0) \\<or> (solve F0 = FALSE \\<and> \\<not> satisfiable F0)\"\nproof-\n  let ?istate = \"initialize F0 initialState\"\n  let ?F0' = \"filter (\\<lambda> c. \\<not> clauseTautology c) F0\"\n  have\n  \"InvariantConsistent (getM ?istate)\"\n  \"InvariantUniq (getM ?istate)\"\n  \"InvariantWatchesEl (getF ?istate) (getWatch1 ?istate) (getWatch2 ?istate)\" and \n  \"InvariantWatchesDiffer (getF ?istate) (getWatch1 ?istate) (getWatch2 ?istate)\" and \n  \"InvariantWatchCharacterization (getF ?istate) (getWatch1 ?istate) (getWatch2 ?istate) (getM ?istate)\" and \n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?istate) (getF ?istate)\" and\n  \"InvariantWatchListsUniq (getWatchList ?istate)\" and\n  \"InvariantWatchListsCharacterization (getWatchList ?istate) (getWatch1 ?istate) (getWatch2 ?istate)\" and\n  \"InvariantUniqQ (getQ ?istate)\" and\n  \"InvariantQCharacterization (getConflictFlag ?istate) (getQ ?istate) (getF ?istate) (getM ?istate)\" and\n  \"InvariantConflictFlagCharacterization (getConflictFlag ?istate) (getF ?istate) (getM ?istate)\" and\n  \"InvariantNoDecisionsWhenConflict (getF ?istate) (getM ?istate) (currentLevel (getM ?istate))\" and\n  \"InvariantNoDecisionsWhenUnit (getF ?istate) (getM ?istate) (currentLevel (getM ?istate))\" and\n  \"InvariantGetReasonIsReason (getReason ?istate) (getF ?istate) (getM ?istate) (set (getQ ?istate))\" and\n  \"InvariantConflictClauseCharacterization (getConflictFlag ?istate) (getConflictClause ?istate) (getF ?istate) (getM ?istate)\"\n  \"InvariantVarsM (getM ?istate) F0 (vars F0)\"\n  \"InvariantVarsQ (getQ ?istate) F0 (vars F0)\"\n  \"InvariantVarsF (getF ?istate) F0 (vars F0)\"\n  \"getSATFlag ?istate = UNDEF \\<longrightarrow> InvariantEquivalentZL (getF ?istate) (getM ?istate) ?F0'\" and\n  \"getSATFlag ?istate = FALSE \\<longrightarrow> \\<not> satisfiable ?F0'\"\n  \"getSATFlag ?istate = TRUE  \\<longrightarrow> satisfiable F0\"\n    using InvariantsAfterInitialization[of \"F0\"]\n    using InvariantEquivalentZLAfterInitialization[of \"F0\"]\n    unfolding InvariantVarsM_def\n    unfolding InvariantVarsF_def\n    unfolding InvariantVarsQ_def\n    by (auto simp add: Let_def)\n  moreover\n  hence \"solve_loop_dom ?istate (vars F0)\"\n    using SolveLoopTermination[of \"?istate\" \"?F0'\" \"vars F0\" \"F0\"]\n    using finiteVarsFormula[of \"F0\"]\n    using varsSubsetFormula[of \"?F0'\" \"F0\"]\n    by auto\n  ultimately\n  show ?thesis\n    using finiteVarsFormula[of \"F0\"]\n    using SATFlagAfterSolveLoop[of \"?istate\" \"vars F0\" \"?F0'\" \"F0\"]\n    using satisfiableFilterTautologies[of \"F0\"]\n    unfolding solve_def\n    using varsSubsetFormula[of \"?F0'\" \"F0\"]\n    by (auto simp add: Let_def)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/SATSolverVerification/FunctionalImplementation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7371581626286834, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.3341256710727036}}
{"text": "(*  Title:      HOL/HOLCF/IOA/NTP/Abschannel.thy\n    Author:     Olaf Müller\n*)\n\nsection \\<open>The (faulty) transmission channel (both directions)\\<close>\n\ntheory Abschannel\nimports IOA.IOA Action\nbegin\n\ndatatype 'a abs_action = S 'a | R 'a\n\ndefinition\n  ch_asig :: \"'a abs_action signature\" where\n  \"ch_asig = (UN b. {S(b)}, UN b. {R(b)}, {})\"\n\ndefinition\n  ch_trans :: \"('a abs_action, 'a multiset)transition set\" where\n  \"ch_trans =\n    {tr. let s = fst(tr);\n             t = snd(snd(tr))\n         in\n         case fst(snd(tr))\n           of S(b) => t = addm s b |\n              R(b) => count s b ~= 0 & t = delm s b}\"\n\ndefinition\n  ch_ioa :: \"('a abs_action, 'a multiset)ioa\" where\n  \"ch_ioa = (ch_asig, {{|}}, ch_trans,{},{})\"\n\ndefinition\n  rsch_actions :: \"'m action => bool abs_action option\" where\n  \"rsch_actions (akt) =\n          (case akt of\n           S_msg(m) => None |\n            R_msg(m) => None |\n           S_pkt(packet) => None |\n            R_pkt(packet) => None |\n            S_ack(b) => Some(S(b)) |\n            R_ack(b) => Some(R(b)) |\n           C_m_s =>  None  |\n           C_m_r =>  None |\n           C_r_s =>  None  |\n           C_r_r(m) => None)\"\n\ndefinition\n  srch_actions :: \"'m action =>(bool * 'm) abs_action option\" where\n  \"srch_actions (akt) =\n          (case akt of\n           S_msg(m) => None |\n            R_msg(m) => None |\n           S_pkt(p) => Some(S(p)) |\n            R_pkt(p) => Some(R(p)) |\n            S_ack(b) => None |\n            R_ack(b) => None |\n           C_m_s => None |\n           C_m_r => None |\n           C_r_s => None |\n           C_r_r(m) => None)\"\n\ndefinition\n  srch_ioa :: \"('m action, 'm packet multiset)ioa\" where\n  \"srch_ioa = rename ch_ioa srch_actions\"\n\ndefinition\n  rsch_ioa :: \"('m action, bool multiset)ioa\" where\n  \"rsch_ioa = rename ch_ioa rsch_actions\"\n\ndefinition\n  srch_asig :: \"'m action signature\" where\n  \"srch_asig = asig_of(srch_ioa)\"\n\ndefinition\n  rsch_asig :: \"'m action signature\" where\n  \"rsch_asig = asig_of(rsch_ioa)\"\n\ndefinition\n  srch_wfair :: \"('m action)set set\" where\n  \"srch_wfair = wfair_of(srch_ioa)\"\ndefinition\n  srch_sfair :: \"('m action)set set\" where\n  \"srch_sfair = sfair_of(srch_ioa)\"\ndefinition\n  rsch_sfair :: \"('m action)set set\" where\n  \"rsch_sfair = sfair_of(rsch_ioa)\"\ndefinition\n  rsch_wfair :: \"('m action)set set\" where\n  \"rsch_wfair = wfair_of(rsch_ioa)\"\n\ndefinition\n  srch_trans :: \"('m action, 'm packet multiset)transition set\" where\n  \"srch_trans = trans_of(srch_ioa)\"\ndefinition\n  rsch_trans :: \"('m action, bool multiset)transition set\" where\n  \"rsch_trans = trans_of(rsch_ioa)\"\n\n\nlemmas unfold_renaming =\n  srch_asig_def rsch_asig_def rsch_ioa_def srch_ioa_def ch_ioa_def\n  ch_asig_def srch_actions_def rsch_actions_def rename_def rename_set_def asig_of_def\n  actions_def srch_trans_def rsch_trans_def ch_trans_def starts_of_def\n  trans_of_def asig_projections\n\nlemma in_srch_asig: \n     \"S_msg(m) \\<notin> actions(srch_asig)        \\<and>\n       R_msg(m) \\<notin> actions(srch_asig)        \\<and>\n       S_pkt(pkt) \\<in> actions(srch_asig)    \\<and>\n       R_pkt(pkt) \\<in> actions(srch_asig)    \\<and>     \n       S_ack(b) \\<notin> actions(srch_asig)     \\<and>     \n       R_ack(b) \\<notin> actions(srch_asig)     \\<and>     \n       C_m_s \\<notin> actions(srch_asig)           \\<and>     \n       C_m_r \\<notin> actions(srch_asig)           \\<and>     \n       C_r_s \\<notin> actions(srch_asig)  & C_r_r(m) \\<notin> actions(srch_asig)\"\n  by (simp add: unfold_renaming)\n\nlemma in_rsch_asig: \n      \"S_msg(m) \\<notin> actions(rsch_asig)         \\<and>\n       R_msg(m) \\<notin> actions(rsch_asig)         \\<and>\n       S_pkt(pkt) \\<notin> actions(rsch_asig)    \\<and>\n       R_pkt(pkt) \\<notin> actions(rsch_asig)    \\<and>\n       S_ack(b) \\<in> actions(rsch_asig)       \\<and>\n       R_ack(b) \\<in> actions(rsch_asig)       \\<and>\n       C_m_s \\<notin> actions(rsch_asig)            \\<and>\n       C_m_r \\<notin> actions(rsch_asig)            \\<and>\n       C_r_s \\<notin> actions(rsch_asig)            \\<and>\n       C_r_r(m) \\<notin> actions(rsch_asig)\"\n  by (simp add: unfold_renaming)\n\nlemma srch_ioa_thm: \"srch_ioa =  \n    (srch_asig, {{|}}, srch_trans,srch_wfair,srch_sfair)\"\napply (simp (no_asm) add: srch_asig_def srch_trans_def asig_of_def trans_of_def wfair_of_def sfair_of_def srch_wfair_def srch_sfair_def)\napply (simp (no_asm) add: unfold_renaming)\ndone\n\nlemma rsch_ioa_thm: \"rsch_ioa =  \n     (rsch_asig, {{|}}, rsch_trans,rsch_wfair,rsch_sfair)\"\napply (simp (no_asm) add: rsch_asig_def rsch_trans_def asig_of_def trans_of_def wfair_of_def sfair_of_def rsch_wfair_def rsch_sfair_def)\napply (simp (no_asm) add: unfold_renaming)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/NTP/Abschannel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7185943805178139, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.33407565668281836}}
{"text": "theory OG_Syntax\nimports OG_Tactics Quote_Antiquote\nbegin\n\ntext\\<open>Syntax for commands and for assertions and boolean expressions in\n commands \\<open>com\\<close> and annotated commands \\<open>ann_com\\<close>.\\<close>\n\nabbreviation Skip :: \"'a com\"  (\"SKIP\" 63)\n  where \"SKIP \\<equiv> Basic ID\"\n\nabbreviation AnnSkip :: \"'a assn \\<Rightarrow> 'a ann_com\"  (\"_//SKIP\" [90] 63)\n  where \"r SKIP \\<equiv> AnnBasic (True, r) ID\"\n\nabbreviation AnnSkipIgnore :: \"'a assn \\<Rightarrow> 'a ann_com\"  (\"_*//SKIP\" [90] 63)\n  where \"r* SKIP \\<equiv> AnnBasic (False, r) ID\"\n\nnotation\n  Seq  (\"_,,/ _\" [55, 56] 55) and\n  AnnSeq  (\"_;;/ _\" [60,61] 60)\n\nabbreviation DETERM :: \"('a \\<Rightarrow> 'a) \\<Rightarrow> ('a \\<Rightarrow> 'a set)\" where\n  \"DETERM f \\<equiv> \\<lambda>s. {f s}\"\n\nlemma \"DETERM id = ID\" by simp\n\nsyntax\n  \"_Assign\"      :: \"idt \\<Rightarrow> 'b \\<Rightarrow> 'a com\"    (\"(\\<acute>_ :=/ _)\" [70, 65] 61)\n  \"_AnnAssign\"   :: \"'a assn \\<Rightarrow> idt \\<Rightarrow> 'b \\<Rightarrow> 'a com\"    (\"(_ \\<acute>_ :=/ _)\" [90,70,65] 61)\n  \"_AnnAssignIgnore\"   :: \"'a assn \\<Rightarrow> idt \\<Rightarrow> 'b \\<Rightarrow> 'a com\"    (\"(_* \\<acute>_ :=/ _)\" [90,70,65] 61)\n\ntranslations\n  \"\\<acute>x := a\" \\<rightharpoonup> \"CONST Basic \\<guillemotleft>\\<acute>(CONST DETERM (_update_name x (\\<lambda>_. a)))\\<guillemotright>\"\n  \"r \\<acute>x := a\" \\<rightharpoonup> \"CONST AnnBasic (HOL.True, r) \\<guillemotleft>\\<acute>(CONST DETERM (_update_name x (\\<lambda>_. a)))\\<guillemotright>\"\n  \"r* \\<acute>x := a\" \\<rightharpoonup> \"CONST AnnBasic (HOL.False, r) \\<guillemotleft>\\<acute>(CONST DETERM (_update_name x (\\<lambda>_. a)))\\<guillemotright>\"\n\nabbreviation\n  \"update_var f S s \\<equiv> (\\<lambda>v. f (\\<lambda>_. v) s) ` S\"\n\nsyntax\n  \"_Pick\"      :: \"idt \\<Rightarrow> 'b \\<Rightarrow> 'a com\"    (\"(\\<acute>_ :\\<in>/ _)\" [70, 65] 61)\n  \"_AnnPick\"   :: \"'a assn \\<Rightarrow> idt \\<Rightarrow> 'b \\<Rightarrow> 'a com\"    (\"(_ \\<acute>_ :\\<in>/ _)\" [90,70,65] 61)\n  \"_AnnPickIgnore\"   :: \"'a assn \\<Rightarrow> idt \\<Rightarrow> 'b \\<Rightarrow> 'a com\"    (\"(_* \\<acute>_ :\\<in>/ _)\" [90,70,65] 61)\n\ntranslations\n  \"\\<acute>x :\\<in> S\" \\<rightharpoonup> \"CONST Basic \\<guillemotleft>\\<acute>(CONST update_var (_update_name x) S)\\<guillemotright>\"\n  \"r \\<acute>x :\\<in> S\" \\<rightharpoonup> \"CONST AnnBasic (HOL.True, r) \\<guillemotleft>\\<acute>(CONST update_var (_update_name x) S)\\<guillemotright>\"\n  \"r* \\<acute>x :\\<in> S\" \\<rightharpoonup> \"CONST AnnBasic (HOL.False, r) \\<guillemotleft>\\<acute>(CONST update_var (_update_name x) S)\\<guillemotright>\"\n\nsyntax\n  \"_AnnCond1\"    :: \"'a assn \\<Rightarrow> 'a bexp  \\<Rightarrow> 'a ann_com  \\<Rightarrow> 'a ann_com \\<Rightarrow> 'a ann_com\"\n                    (\"_ //IF _ /THEN _ /ELSE _ /FI\"  [90,0,0,0] 61)\n  \"_AnnCond2\"    :: \"'a assn \\<Rightarrow> 'a bexp  \\<Rightarrow> 'a ann_com \\<Rightarrow> 'a ann_com\"\n                    (\"_ //IF _ /THEN _ /FI\"  [90,0,0] 61)\n  \"_AnnWhile\"    :: \"'a assn \\<Rightarrow> 'a bexp  \\<Rightarrow> 'a assn \\<Rightarrow> 'a ann_com \\<Rightarrow> 'a ann_com\"\n                    (\"_ //WHILE _ /INV _ //DO _//OD\"  [90,0,0,0] 61)\n  \"_AnnAwait\"    :: \"'a assn \\<Rightarrow> 'a bexp  \\<Rightarrow> 'a com \\<Rightarrow> 'a ann_com\"\n                    (\"_ //AWAIT _ /THEN /_ /END\"  [90,0,0] 61)\n  \"_AnnAtom\"     :: \"'a assn  \\<Rightarrow> 'a com \\<Rightarrow> 'a ann_com\"   (\"_//\\<langle>_\\<rangle>\" [90,0] 61)\n  \"_AnnWait\"     :: \"'a assn \\<Rightarrow> 'a bexp \\<Rightarrow> 'a ann_com\"   (\"_//WAIT _ END\" [90,0] 61)\n\n  \"_AnnCond1Ig\"  :: \"'a assn \\<Rightarrow> 'a bexp  \\<Rightarrow> 'a ann_com  \\<Rightarrow> 'a ann_com \\<Rightarrow> 'a ann_com\"\n                    (\"_* //IF _ /THEN _ /ELSE _ /FI\"  [90,0,0,0] 61)\n  \"_AnnCond2Ig\"  :: \"'a assn \\<Rightarrow> 'a bexp  \\<Rightarrow> 'a ann_com \\<Rightarrow> 'a ann_com\"\n                    (\"_* //IF _ /THEN _ /FI\"  [90,0,0] 61)\n  \"_AnnWhileIg\"  :: \"'a assn \\<Rightarrow> 'a bexp  \\<Rightarrow> 'a assn \\<Rightarrow> 'a ann_com \\<Rightarrow> 'a ann_com\"\n                    (\"_* //WHILE _ /INV _ //DO _//OD\"  [90,0,0,0] 61)\n  \"_AnnWhileIg'\"  :: \"'a assn \\<Rightarrow> 'a bexp  \\<Rightarrow> 'a assn \\<Rightarrow> 'a ann_com \\<Rightarrow> 'a ann_com\"\n                    (\"_ //WHILE _ /INV _* //DO _//OD\"  [90,0,0,0] 61)\n  \"_AnnWhileIg''\"  :: \"'a assn \\<Rightarrow> 'a bexp  \\<Rightarrow> 'a assn \\<Rightarrow> 'a ann_com \\<Rightarrow> 'a ann_com\"\n                    (\"_* //WHILE _ /INV _* //DO _//OD\"  [90,0,0,0] 61)\n  \"_AnnAwaitIg\"  :: \"'a assn \\<Rightarrow> 'a bexp  \\<Rightarrow> 'a com \\<Rightarrow> 'a ann_com\"\n                    (\"_* //AWAIT _ /THEN /_ /END\"  [90,0,0] 61)\n  \"_AnnAtomIg\"   :: \"'a assn  \\<Rightarrow> 'a com \\<Rightarrow> 'a ann_com\"   (\"_*//\\<langle>_\\<rangle>\" [90,0] 61)\n  \"_AnnWaitIg\"   :: \"'a assn \\<Rightarrow> 'a bexp \\<Rightarrow> 'a ann_com\"   (\"_*//WAIT _ END\" [90,0] 61)\n\n  \"_Cond\"        :: \"'a bexp \\<Rightarrow> 'a com \\<Rightarrow> 'a com \\<Rightarrow> 'a com\"\n                                  (\"(0IF _/ THEN _/ ELSE _/ FI)\" [0, 0, 0] 61)\n  \"_Cond2\"       :: \"'a bexp \\<Rightarrow> 'a com \\<Rightarrow> 'a com\"   (\"IF _ THEN _ FI\" [0,0] 56)\n  \"_While_inv\"   :: \"'a bexp \\<Rightarrow> 'a assn \\<Rightarrow> 'a com \\<Rightarrow> 'a com\"\n                    (\"(0WHILE _/ INV _ //DO _ /OD)\"  [0, 0, 0] 61)\n  \"_While\"       :: \"'a bexp \\<Rightarrow> 'a com \\<Rightarrow> 'a com\"\n                    (\"(0WHILE _ //DO _ /OD)\"  [0, 0] 61)\n\ntranslations\n  \"IF b THEN c1 ELSE c2 FI\" \\<rightharpoonup> \"CONST Cond \\<lbrace>b\\<rbrace> c1 c2\"\n  \"IF b THEN c FI\" \\<rightleftharpoons> \"IF b THEN c ELSE SKIP FI\"\n  \"WHILE b INV i DO c OD\" \\<rightharpoonup> \"CONST While \\<lbrace>b\\<rbrace> i c\"\n  \"WHILE b DO c OD\" \\<rightleftharpoons> \"WHILE b INV CONST undefined DO c OD\"\n\n  \"r IF b THEN c1 ELSE c2 FI\" \\<rightharpoonup> \"CONST AnnCond1 (HOL.True, r) \\<lbrace>b\\<rbrace> c1 c2\"\n  \"r IF b THEN c FI\" \\<rightharpoonup> \"CONST AnnCond2 (HOL.True, r) \\<lbrace>b\\<rbrace> c\"\n  \"r WHILE b INV i DO c OD\" \\<rightharpoonup> \"CONST AnnWhile (HOL.True, r) \\<lbrace>b\\<rbrace> (HOL.True, i) c\"\n  \"r AWAIT b THEN c END\" \\<rightharpoonup> \"CONST AnnAwait (HOL.True, r) \\<lbrace>b\\<rbrace> c\"\n  \"r \\<langle>c\\<rangle>\" \\<rightleftharpoons> \"r AWAIT CONST True THEN c END\"\n  \"r WAIT b END\" \\<rightleftharpoons> \"r AWAIT b THEN SKIP END\"\n\n  \"r* IF b THEN c1 ELSE c2 FI\" \\<rightharpoonup> \"CONST AnnCond1 (HOL.False, r) \\<lbrace>b\\<rbrace> c1 c2\"\n  \"r* IF b THEN c FI\" \\<rightharpoonup> \"CONST AnnCond2 (HOL.False, r) \\<lbrace>b\\<rbrace> c\"\n  \"r* WHILE b INV i DO c OD\" \\<rightharpoonup> \"CONST AnnWhile (HOL.False, r) \\<lbrace>b\\<rbrace> (HOL.True, i) c\"\n  \"r WHILE b INV i* DO c OD\" \\<rightharpoonup> \"CONST AnnWhile (HOL.True, r) \\<lbrace>b\\<rbrace> (HOL.False, i) c\"\n  \"r* WHILE b INV i* DO c OD\" \\<rightharpoonup> \"CONST AnnWhile (HOL.False, r) \\<lbrace>b\\<rbrace> (HOL.False, i) c\"\n  \"r* AWAIT b THEN c END\" \\<rightharpoonup> \"CONST AnnAwait (HOL.False, r) \\<lbrace>b\\<rbrace> c\"\n  \"r* \\<langle>c\\<rangle>\" \\<rightleftharpoons> \"r* AWAIT CONST True THEN c END\"\n  \"r* WAIT b END\" \\<rightleftharpoons> \"r* AWAIT b THEN SKIP END\"\n\nnonterminal prgs\n\nsyntax\n  \"_PAR\" :: \"prgs \\<Rightarrow> 'a\"              (\"COBEGIN//_//COEND\" [57] 56)\n  \"_prg\" :: \"['a, 'a] \\<Rightarrow> prgs\"        (\"_//_\" [60, 90] 57)\n  \"_prgs\" :: \"['a, 'a, prgs] \\<Rightarrow> prgs\"  (\"_//_//\\<parallel>//_\" [60,90,57] 57)\n\n  \"_prg_scheme\" :: \"['a, 'a, 'a, 'a, 'a] \\<Rightarrow> prgs\"\n                  (\"SCHEME [_ \\<le> _ < _] _// _\" [0,0,0,60, 90] 57)\n\ntranslations\n  \"_prg c q\" \\<rightleftharpoons> \"[(CONST Some c, q)]\"\n  \"_prgs c q ps\" \\<rightleftharpoons> \"(CONST Some c, q) # ps\"\n  \"_PAR ps\" \\<rightleftharpoons> \"CONST Parallel ps\"\n\n  \"_prg_scheme j i k c q\" \\<rightleftharpoons> \"CONST map (\\<lambda>i. (CONST Some c, q)) [j..<k]\"\n\nprint_translation \\<open>\n  let\n    fun quote_tr' f (t :: ts) =\n          Term.list_comb (f $ Syntax_Trans.quote_tr' @{syntax_const \"_antiquote\"} t, ts)\n      | quote_tr' _ _ = raise Match;\n\n    fun annquote_tr' f (r :: t :: ts) =\n          Term.list_comb (f $ r $ Syntax_Trans.quote_tr' @{syntax_const \"_antiquote\"} t, ts)\n      | annquote_tr' _ _ = raise Match;\n\n    val assert_tr' = quote_tr' (Syntax.const @{syntax_const \"_Assert\"});\n\n    fun bexp_tr' name ((Const (@{const_syntax Collect}, _) $ t) :: ts) =\n          quote_tr' (Syntax.const name) (t :: ts)\n      | bexp_tr' _ _ = raise Match;\n\n    fun annbexp_tr' name (r :: (Const (@{const_syntax Collect}, _) $ t) :: ts) =\n          annquote_tr' (Syntax.const name) (r :: t :: ts)\n      | annbexp_tr' _ _ = raise Match;\n\n    fun assign_tr' (Abs (x, _, f $ k $ Bound 0) :: ts) =\n          quote_tr' (Syntax.const @{syntax_const \"_Assign\"} $ Syntax_Trans.update_name_tr' f)\n            (Abs (x, dummyT, Syntax_Trans.const_abs_tr' k) :: ts)\n      | assign_tr' _ = raise Match;\n\n    fun annassign_tr' (r :: Abs (x, _, f $ k $ Bound 0) :: ts) =\n    \n          quote_tr' (Syntax.const @{syntax_const \"_AnnAssign\"} $ r $ Syntax_Trans.update_name_tr' f)\n            (Abs (x, dummyT, Syntax_Trans.const_abs_tr' k) :: ts)\n      | annassign_tr' _ = raise Match;\n\n  in\n   [(@{const_syntax Collect}, K assert_tr'),\n    (@{const_syntax Basic}, K assign_tr'),\n    (@{const_syntax Cond}, K (bexp_tr' @{syntax_const \"_Cond\"})),\n    (@{const_syntax While}, K (bexp_tr' @{syntax_const \"_While_inv\"})),\n    (@{const_syntax AnnBasic}, K annassign_tr'),\n    (@{const_syntax AnnWhile}, K (annbexp_tr' @{syntax_const \"_AnnWhile\"})),\n    (@{const_syntax AnnAwait}, K (annbexp_tr' @{syntax_const \"_AnnAwait\"})),\n    (@{const_syntax AnnCond1}, K (annbexp_tr' @{syntax_const \"_AnnCond1\"})),\n    (@{const_syntax AnnCond2}, K (annbexp_tr' @{syntax_const \"_AnnCond2\"}))]\n  end;\n\\<close>\n\nend", "meta": {"author": "echronos", "repo": "echronos-proofs", "sha": "5983821e591c6878f1fe96aa831e11c5c97ce385", "save_path": "github-repos/isabelle/echronos-echronos-proofs", "path": "github-repos/isabelle/echronos-echronos-proofs/echronos-proofs-5983821e591c6878f1fe96aa831e11c5c97ce385/lib/Hoare_Parallel/OG_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6477982315512489, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3340176695579736}}
{"text": "theory UnionFind_Impl\nimports  \"../../Refine_Imperative_HOL/Sepref\" UnionFind  \nbegin\n\nsection \"Union find Implementation\"\n\nsubsection \"MOP interface\"\n\ncontext\n  fixes t ::  \"nat \\<Rightarrow> nat\"\nbegin\n\n  definition \"mop_per_init n = SPECT [ per_init' n \\<mapsto> enat (t n) ]\"\n\n  lemma progress_mop_per_init[progress_rules]: \"t n > 0 \\<Longrightarrow> progress (mop_per_init n)\"\n    unfolding mop_per_init_def by (auto intro!: progress_rules simp add:   zero_enat_def) \n\n  lemma mop_per_init: \"tt \\<le> lst (SPECT [ per_init' n \\<mapsto> t n]) Q \\<Longrightarrow> tt\n           \\<le> lst (mop_per_init n) Q\" unfolding mop_per_init_def by simp\n\n  sepref_register \"mop_per_init\" \nend\n\ncontext\n  fixes t ::  \"('a \\<times> 'a) set \\<Rightarrow> nat\"\nbegin\n\n  definition \"mop_per_compare R a b = SPECT [ per_compare R a b \\<mapsto> enat (t R) ]\"\n\n  sepref_register \"mop_per_compare\" \nend\n\ncontext\n  fixes t ::  \"('a \\<times> 'a) set \\<Rightarrow> nat\"\nbegin\n\n  definition \"mop_per_union R a b = SPECT [ per_union R a b \\<mapsto> enat (t R) ]\"\n\n  sepref_register \"mop_per_union\" \nend\n\n\n\nsubsection \"Implementation Locale\"\n\n\ntype_synonym uf = \"nat array \\<times> nat array\"\n\nlocale UnionFind_Impl = \n  fixes is_uf :: \"(nat\\<times>nat) set \\<Rightarrow> uf \\<Rightarrow> assn\"\n      and uf_init :: \"nat \\<Rightarrow> uf Heap\"\n      and uf_init_time :: \"nat \\<Rightarrow> nat\"\n      and uf_cmp :: \"uf \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool Heap\"\n      and uf_cmp_time :: \"nat \\<Rightarrow> nat\"\n      and uf_union :: \"uf \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> uf Heap\"\n      and uf_union_time :: \"nat \\<Rightarrow> nat\"\n    assumes \nper_init'_sepref_rule[sepref_fr_rules]:  \"\\<And>t x' x. uf_init_time x' \\<le> t x' \\<Longrightarrow>\n     hn_refine (hn_ctxt nat_assn x' x) (uf_init x)\n         (hn_ctxt nat_assn x' x)  \n             is_uf (PR_CONST (mop_per_init t) $  x' )\" \n\n  and\n\nper_compare_sepref_rule[sepref_fr_rules]:  \"\\<And>t R' R a' a b' b . uf_cmp_time (card (Domain R')) \\<le> t R' \\<Longrightarrow>\n     hn_refine (hn_ctxt is_uf R' R * hn_ctxt nat_assn a' a * hn_ctxt nat_assn b' b) (uf_cmp R a b)\n         (hn_ctxt is_uf R' R * hn_ctxt nat_assn a' a * hn_ctxt nat_assn b' b) \n             bool_assn (PR_CONST (mop_per_compare t) $  R' $ a' $ b' )\" \n\n  and\n\nper_union_sepref_rule[sepref_fr_rules]:  \"\\<And>t R' R a' a b' b . a' \\<in> Domain R' \\<Longrightarrow> b' \\<in> Domain R'\n  \\<Longrightarrow> uf_union_time (card (Domain R')) \\<le> t R' \\<Longrightarrow> \n     hn_refine (hn_ctxt is_uf R' R * hn_ctxt nat_assn a' a * hn_ctxt nat_assn b' b) (uf_union R a b)\n         (hn_invalid is_uf R' R * hn_ctxt nat_assn a' a * hn_ctxt nat_assn b' b) \n             is_uf (PR_CONST (mop_per_union t) $  R' $ a' $ b' )\" \n\nbegin\n\n\nthm per_init'_sepref_rule[to_hfref]\nthm per_compare_sepref_rule[to_hfref]\nthm per_union_sepref_rule[to_hfref]\n\n\nend\n\n\n\nend", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Examples/Kruskal/UnionFind_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3340076981155336}}
{"text": "           (*-------------------------------------------*\n            |                   Test                    |\n            |                                           |\n            |        CSP-Prover on Isabelle2004         |\n            |               August 2004                 |\n            |             December 2004 (modified)      |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |               November 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2009         |\n            |                   June 2009  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2016         |\n            |                    May 2016  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory Test_infinite\nimports CSP_F_Main\nbegin\n\n(*****************************************************************\n\n         1. simple example for fixed point inductuction theorem\n         2. Parallel, Hiding, Internal choice\n         3. Refinement\n         4. \n\n *****************************************************************)\n\n(*********************************************************\n                         event\n *********************************************************)\n\ndatatype Event = Num nat | Read nat\ndatatype SpcName = SPC nat\ndatatype ImpName = UI | VAR nat\n\n(*********************************************************\n            specification SPC and system IMP\n *********************************************************)\n\ndefinition\n  GTs :: \"nat => nat set\"\n  where\n  GTs_def : \"GTs n == {m. n < m}\"\n\n(*** Spc ***)\n\nprimrec\n  Spcfun :: \"SpcName => (SpcName, Event) proc\"\nwhere\n  \"Spcfun   (SPC n) = Num n -> (!nat m:(GTs n) .. $(SPC m))\"\n\noverloading Set_Spcfun == \n  \"PNfun :: (SpcName, Event) pnfun\"\nbegin\n(*  definition \"PNfun (pn::SpcName) == Spcfun pn\" *)\n  definition \"PNfun == Spcfun\"\nend\n\ndeclare Set_Spcfun_def [simp]\n\n(* Isabelle 2013\ndefs (overloaded)\nSet_Spcfun_def [simp]: \"PNfun == Spcfun\"\n*)\n\ndefinition\n  Spc :: \"(SpcName, Event) proc\"\n  where\n  Spc_def: \"Spc == $(SPC 0)\"\n\n(*** Imp ***)\n\nprimrec\n  Impfun :: \"ImpName => (ImpName, Event) proc\"\nwhere\n  \"Impfun      (UI) = Read ? m -> Num m -> $UI\"\n |\"Impfun   (VAR n) = Read ! n -> $(VAR (Suc n))\"\n \noverloading Set_Impfun == \n  \"PNfun :: (ImpName, Event) pnfun\"\nbegin\n(*  definition \"PNfun (pn::ImpName) == Impfun pn\" *)\n  definition \"PNfun == Impfun\"\nend\n  \ndeclare Set_Impfun_def [simp]\n\nlemma \"(PNfun::(ImpName, Event) pnfun) = Impfun\"\nby (simp)\n\n(*\ndefs (overloaded)\nSet_Impfun_def [simp]: \"PNfun == Impfun\"\n*)\n\ndefinition\n  Imp :: \"(ImpName, Event) proc\"\n  where\n  Imp_def: \"Imp == ($UI |[range Read]| $(VAR 0)) -- (range Read)\"\n\n(*********************************************************\n            relation between SPC and IMP\n *********************************************************)\n\nprimrec\n  Spc_to_Imp :: \"SpcName => (ImpName, Event) proc\"\nwhere\n  \"Spc_to_Imp (SPC n) = ($UI |[range Read]| $(VAR n)) -- (range Read)\"\n\n(*********************************************************\n                     small lemmas\n *********************************************************)\n\ndeclare Int_commute [simp]\n\nlemma set1[simp]: \"range Read Int {(Read n)} = {(Read n)}\"\nby (auto)\n\nlemma set2[simp]: \"{(Read (Suc n))} Int (range Read Int {(Num n)}) Un\n                    ({(Num n)} - range Read) = {(Num n)}\"\nby (auto)\n\nlemma set3[simp]: \"Num n ~: range Read\"\nby (simp add: image_def)\n\n(*********************************************************\n               guardedfun (rutine work)\n *********************************************************)\n\n(*** To automatically unfold syntactic sugar ***)\ndeclare csp_prefix_ss_def[simp]\n\nlemma guardedfun_Spc_Imp[simp]:\n      \"guardedfun Spcfun\"\n      \"guardedfun Impfun\"\nby (simp add: guardedfun_def, rule allI, induct_tac p, simp_all)+\n\ndeclare inj_on_def[simp]\n\n(*********************************************************\n                   ? SPC <=F IMP ?\n *********************************************************)\n(* Isabelle 2013\ndefs FPmode_def [simp]: \"FPmode == CMSmode\"\n*)\n\noverloading FPmode == \n  \"FPmode :: fpmode\"\nbegin\n  definition \"FPmode == CMSmode\"\nend\n\ndeclare FPmode_def [simp]\n\n\n(* it declares to use CMS approach.\n\n   If you want to verify them by CPO approach, \n   use the following mode:\n\ndefs FPmode_def [simp]: \"FPmode == CPOmode\"\n\n   In this example, both modes are available,\n   because Spcfun and Impfun are guarded.       *)\n\nlemma \"Spc <=F Imp\"\napply (simp add: Spc_def Imp_def)\n\n  (***** by fixed point induction *****)\napply (rule cspF_fp_induct_left[of _ \"Spc_to_Imp\"])\n\n  (***** check guarded and no hiding operators *****)\n\napply (simp_all)\napply (simp)\n\n  (***** by step laws (for transforming it to a hnf) *****)\n\napply (induct_tac p)\napply (cspF_unwind)\napply (cspF_hsf)+\napply (cspF_unwind)\napply (cspF_hsf)+\napply (auto)\napply (cspF_simp)+\n\n  (***** instantiate a non-deterministic choice *****)\n\napply (rule cspF_Rep_int_choice_left)\napply (rule_tac  x=\"(Suc xa)\" in exI)\napply (simp add: GTs_def)\n\napply (cspF_auto)+\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/Test/Test_infinite.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3340076981155336}}
{"text": "theory Abstract_Rigorous_Numerics\nimports\n  \"HOL-Library.Parallel\"\n  Transfer_Euclidean_Space_Vector\n  \"../Refinement/Enclosure_Operations\"\n  \"../Refinement/Refine_Vector_List\"\n  \"../Refinement/Refine_Hyperplane\"\n  \"../Refinement/Refine_Interval\"\n  \"../Refinement/Refine_Invar\"\n  \"../Refinement/Refine_Unions\"\n  \"../Refinement/Refine_Info\"\nbegin\n\nsection \\<open>misc\\<close>\n\nlemma length_listset: \"xi \\<in> listset xs \\<Longrightarrow> length xi = length xs\"\n  by (induction xs arbitrary: xi) (auto simp: set_Cons_def)\n\nlemma Nil_mem_listset[simp]: \"[] \\<in> listset list \\<longleftrightarrow> list = []\"\n  by (induction list) (auto simp: set_Cons_def)\n\nlemma sing_mem_listset_iff[simp]: \"[b] \\<in> listset ys \\<longleftrightarrow> (\\<exists>z. ys = [z] \\<and> b \\<in> z)\"\n  \\<comment> \\<open>TODO: generalize to Cons?\\<close>\n  by (cases ys) (auto simp: set_Cons_def)\n\n\nno_notation (in autoref_syn) funcset (infixr \"\\<rightarrow>\" 60)\n\ndefinition cfuncset where \"cfuncset l u X = funcset {l .. u} X \\<inter> Collect (continuous_on {l .. u})\"\nlemma cfuncset_iff: \"f \\<in> cfuncset l u X \\<longleftrightarrow> (\\<forall>i\\<in>{l .. u}. f i \\<in> X) \\<and> continuous_on {l .. u} f\"\n  unfolding cfuncset_def by auto\n\nlemma cfuncset_continuous_onD: \"f \\<in> cfuncset 0 h X \\<Longrightarrow> continuous_on {0..h} f\"\n  by (simp add: cfuncset_iff)\n\n\nsection \\<open>Implementations\\<close>\n\nsubsection \\<open>locale for sets\\<close>\n\ndefinition \"product_listset xs ys = (\\<lambda>(x, y). x @ y) ` ((xs::real list set) \\<times> (ys::real list set))\"\n\nabbreviation \"rl_rel \\<equiv> \\<langle>rnv_rel\\<rangle>list_rel\"\n\nabbreviation \"slp_rel \\<equiv> \\<langle>Id::floatarith rel\\<rangle>list_rel\"\nabbreviation \"fas_rel \\<equiv> \\<langle>Id::floatarith rel\\<rangle>list_rel\"\n\ntype_synonym 'b reduce_argument = \"'b list \\<Rightarrow> nat \\<Rightarrow> real list \\<Rightarrow> bool\" \\<comment> \\<open>is this too special?\\<close>\n\nrecord 'b numeric_options =\n  precision :: nat\n  adaptive_atol :: real\n  adaptive_rtol :: real\n  method_id :: nat\n  start_stepsize :: real\n  iterations :: nat\n  halve_stepsizes :: nat\n  widening_mod :: nat\n  rk2_param :: real\n  default_reduce :: \"'b reduce_argument\"\n  printing_fun :: \"bool \\<Rightarrow> 'b list \\<Rightarrow> unit\"\n  tracing_fun :: \"string \\<Rightarrow> 'b list option \\<Rightarrow> unit\"\n\nrecord 'b reach_options =\n  max_tdev_thres :: \"real\"\n  pre_split_reduce :: \"'b reduce_argument\"\n  pre_inter_granularity :: \"real\"\n  post_inter_granularity :: \"real\"\n  pre_collect_granularity :: real\n  max_intersection_step :: real\n\ndefinition \"reach_options_rel TYPE('b) = (UNIV::('b reach_options \\<times> unit) set)\"\nlemma sv_reach_options_rel[relator_props]: \"single_valued (reach_options_rel TYPE('a))\"\n  by (auto simp: reach_options_rel_def single_valued_def)\n\ndefinition \"reduce_argument_rel TYPE('b) = (UNIV::('b reduce_argument \\<times> unit) set)\"\nlemma sv_reduce_argument_rel[relator_props]: \"single_valued (reduce_argument_rel TYPE('a))\"\n  by (auto simp: reduce_argument_rel_def single_valued_def)\n\n\ndefinition [refine_vcg_def, simp]: \"max_tdev_thres_spec (ro::unit) = SPEC (\\<lambda>x::real. True)\"\ndefinition [refine_vcg_def, simp]: \"max_intersection_step_spec (ro::unit) = SPEC (\\<lambda>x::real. True)\"\ndefinition [refine_vcg_def, simp]: \"pre_inter_granularity_spec (ro::unit) = SPEC (\\<lambda>x::real. True)\"\ndefinition [refine_vcg_def, simp]: \"post_inter_granularity_spec (ro::unit) = SPEC (\\<lambda>x::real. True)\"\ndefinition [refine_vcg_def, simp]: \"pre_collect_granularity_spec (ro::unit) = SPEC (\\<lambda>x::real. True)\"\n\nlemma reach_optns_autoref[autoref_rules]:\n  includes autoref_syntax\n  shows\n    \"(\\<lambda>x. RETURN (max_tdev_thres x), max_tdev_thres_spec) \\<in> reach_options_rel TYPE('b) \\<rightarrow> \\<langle>rnv_rel\\<rangle>nres_rel\"\n    \"(\\<lambda>x. RETURN (pre_inter_granularity x), pre_inter_granularity_spec) \\<in> reach_options_rel TYPE('b)  \\<rightarrow> \\<langle>rnv_rel\\<rangle>nres_rel\"\n    \"(\\<lambda>x. RETURN (post_inter_granularity x), post_inter_granularity_spec) \\<in> reach_options_rel TYPE('b) \\<rightarrow> \\<langle>rnv_rel\\<rangle>nres_rel\"\n    \"(\\<lambda>x. RETURN (pre_collect_granularity x), pre_collect_granularity_spec) \\<in> reach_options_rel TYPE('b)  \\<rightarrow> \\<langle>rnv_rel\\<rangle>nres_rel\"\n    \"(\\<lambda>x. RETURN (max_intersection_step x), max_intersection_step_spec) \\<in> reach_options_rel TYPE('b)  \\<rightarrow> \\<langle>rnv_rel\\<rangle>nres_rel\"\n  by (auto simp: nres_rel_def)\n\n\nrecord 'b approximate_set_ops =\n  appr_of_ivl::\"real list \\<Rightarrow> real list \\<Rightarrow> 'b list\"\n  product_appr::\"'b list \\<Rightarrow> 'b list \\<Rightarrow> 'b list\"\n  msum_appr::\"'b list \\<Rightarrow> 'b list \\<Rightarrow> 'b list\"\n  inf_of_appr::\"'b numeric_options \\<Rightarrow> 'b list \\<Rightarrow> real list\"\n  sup_of_appr::\"'b numeric_options \\<Rightarrow> 'b list \\<Rightarrow> real list\"\n  split_appr::\"nat \\<Rightarrow> 'b list \\<Rightarrow> 'b list \\<times> 'b list\"\n  appr_inf_inner::\"'b numeric_options \\<Rightarrow> 'b list \\<Rightarrow> real list \\<Rightarrow> real\"\n  appr_sup_inner::\"'b numeric_options \\<Rightarrow> 'b list \\<Rightarrow> real list \\<Rightarrow> real\"\n  inter_appr_plane::\"'b numeric_options \\<Rightarrow> 'b list \\<Rightarrow> real list sctn \\<Rightarrow> 'b list dres\"\n  reduce_appr::\"'b numeric_options \\<Rightarrow> 'b reduce_argument \\<Rightarrow> 'b list \\<Rightarrow> 'b list\"\n  width_appr::\"'b numeric_options \\<Rightarrow> 'b list \\<Rightarrow> real\"\n  approx_slp_dres::\"'b numeric_options \\<Rightarrow> nat \\<Rightarrow> slp \\<Rightarrow> 'b list \\<Rightarrow> 'b list option dres\"\n  approx_euclarithform::\"'b numeric_options \\<Rightarrow> form \\<Rightarrow> 'b list \\<Rightarrow> bool dres\"\n  approx_isFDERIV::\"'b numeric_options \\<Rightarrow> nat \\<Rightarrow> nat list \\<Rightarrow> floatarith list \\<Rightarrow> 'b list \\<Rightarrow> bool dres\"\n\nprimrec concat_appr where\n  \"concat_appr ops [] = []\"\n| \"concat_appr ops (x#xs) = product_appr ops x (concat_appr ops xs)\"\n\n\nunbundle autoref_syntax\n\nlocale approximate_sets =\n  fixes ops :: \"'b approximate_set_ops\"\n    and set_of_appr::\"'b list \\<Rightarrow> real list set\"\n    and appr_rell :: \"('b list \\<times> real list set) set\"\n    and optns :: \"'b numeric_options\"\n  assumes appr_rell_internal: \"appr_rell \\<equiv> br set_of_appr top\"\n  assumes transfer_operations_rl:\n    \"SIDE_PRECOND (list_all2 (\\<le>) xrs yrs) \\<Longrightarrow>\n      (xri, xrs) \\<in> \\<langle>rnv_rel\\<rangle>list_rel \\<Longrightarrow>\n      (yri, yrs) \\<in> \\<langle>rnv_rel\\<rangle>list_rel \\<Longrightarrow>\n      (appr_of_ivl ops xri yri, lv_ivl $ xrs $ yrs) \\<in> appr_rell\"\n    \"(product_appr ops, product_listset) \\<in> appr_rell \\<rightarrow> appr_rell \\<rightarrow> appr_rell\"\n    \"(msum_appr ops, (\\<lambda>xs ys. {List.map2 (+) x y |x y. x \\<in> xs \\<and> y \\<in> ys})) \\<in> appr_rell \\<rightarrow> appr_rell \\<rightarrow> appr_rell\"\n    \"(xi, x) \\<in> appr_rell \\<Longrightarrow> length xi = d \\<Longrightarrow>\n      (RETURN (inf_of_appr ops optns xi), Inf_specs d x) \\<in> \\<langle>rl_rel\\<rangle>nres_rel\"\n    \"(xi, x) \\<in> appr_rell \\<Longrightarrow> length xi = d \\<Longrightarrow>\n      (RETURN (sup_of_appr ops optns xi), Sup_specs d x) \\<in> \\<langle>rl_rel\\<rangle>nres_rel\"\n    \"(ni, n) \\<in> nat_rel \\<Longrightarrow> (xi, x) \\<in> appr_rell \\<Longrightarrow> length xi = d \\<Longrightarrow>\n      (RETURN (split_appr ops ni xi), split_spec_params d n x) \\<in> \\<langle>appr_rell \\<times>\\<^sub>r appr_rell\\<rangle>nres_rel\"\n    \"(RETURN o2 appr_inf_inner ops optns, Inf_inners) \\<in> appr_rell \\<rightarrow> rl_rel \\<rightarrow> \\<langle>rnv_rel\\<rangle>nres_rel\"\n    \"(RETURN o2 appr_sup_inner ops optns, Sup_inners) \\<in> appr_rell \\<rightarrow> rl_rel \\<rightarrow> \\<langle>rnv_rel\\<rangle>nres_rel\"\n    \"(xi, x) \\<in> appr_rell \\<Longrightarrow> length xi = d \\<Longrightarrow> length (normal si) = d \\<Longrightarrow> d > 0 \\<Longrightarrow> (si, s) \\<in> \\<langle>rl_rel\\<rangle>sctn_rel \\<Longrightarrow>\n      (nres_of (inter_appr_plane ops optns xi si), inter_sctn_specs d x s) \\<in> \\<langle>appr_rell\\<rangle>nres_rel\"\n    \"(xi, x) \\<in> appr_rell \\<Longrightarrow> length xi = d \\<Longrightarrow> (rai, ra) \\<in> reduce_argument_rel TYPE('b) \\<Longrightarrow>\n      (RETURN (reduce_appr ops optns rai xi), reduce_specs d ra x) \\<in> \\<langle>appr_rell\\<rangle>nres_rel\"\n    \"(RETURN o width_appr ops optns, width_spec) \\<in> appr_rell \\<rightarrow> \\<langle>rnv_rel\\<rangle>nres_rel\"\n    \"(nres_of o3 approx_slp_dres ops optns, approx_slp_spec fas) \\<in> nat_rel \\<rightarrow> slp_rel \\<rightarrow> appr_rell \\<rightarrow> \\<langle>\\<langle>appr_rell\\<rangle>option_rel\\<rangle>nres_rel\"\nassumes approx_euclarithform[unfolded comps, autoref_rules]:\n  \"(nres_of o2 approx_euclarithform ops optns, approx_form_spec) \\<in> Id \\<rightarrow> appr_rell \\<rightarrow> \\<langle>bool_rel\\<rangle>nres_rel\"\nassumes approx_isFDERIV[unfolded comps, autoref_rules]:\n  \"(\\<lambda>N xs fas vs. nres_of (approx_isFDERIV ops optns N xs fas vs), isFDERIV_spec) \\<in>\n  nat_rel \\<rightarrow> \\<langle>nat_rel\\<rangle>list_rel \\<rightarrow> \\<langle>Id\\<rangle>list_rel \\<rightarrow>  appr_rell \\<rightarrow> \\<langle>bool_rel\\<rangle>nres_rel\"\nassumes set_of_appr_nonempty[simp]: \"set_of_appr X \\<noteq> {}\"\nassumes length_set_of_appr: \"xrs \\<in> set_of_appr xs \\<Longrightarrow> length xrs = length xs\"\nassumes set_of_appr_project: \"xrs \\<in> set_of_appr xs \\<Longrightarrow> (\\<And>i. i \\<in> set is \\<Longrightarrow> i < length xs) \\<Longrightarrow>\n    map ((!) xrs) is \\<in> set_of_appr (map ((!) xs) is)\"\nassumes set_of_apprs_ex_Cons: \"xrs \\<in> set_of_appr xs \\<Longrightarrow> \\<exists>r. r#xrs \\<in> set_of_appr (b#xs)\"\nassumes set_of_apprs_Nil[simp]: \"xrs \\<in> set_of_appr [] \\<longleftrightarrow> xrs = []\"\nbegin\n\nabbreviation \"reach_optns_rel \\<equiv> reach_options_rel TYPE('b)\"\n\ndefinition \"appr_rel = appr_rell O \\<langle>lv_rel\\<rangle>set_rel\"\nlemmas [autoref_rel_intf] = REL_INTFI[of appr_rel i_appr]\n\ndefinition [simp]: \"op_concat_listset xs = concat ` listset xs\"\n\nlemma [autoref_op_pat_def]: \"concat ` listset xs \\<equiv> OP op_concat_listset $ xs\"\n  by simp\n\nlemma list_all2_replicate [simp]: \"list_all2 (\\<le>) xs xs\" for xs::\"'a::order list\"\n  by (auto simp: list_all2_iff in_set_zip)\n\nlemma length_appr_of_ivl[simp]:\n  \"length (appr_of_ivl ops xs ys) = length xs\"\n  if \"list_all2 (\\<le>) xs ys\"\n  using transfer_operations_rl(1)[of xs ys xs ys] that\n    apply (simp add: appr_rell_internal br_def lv_ivl_def)\n  apply (auto simp: appr_rell_internal br_def list_all2_lengthD dest!: length_set_of_appr)\n  using length_set_of_appr by fastforce\n\ndefinition [simp]: \"op_atLeastAtMost_appr = atLeastAtMost\"\n\n\ndefinition card_info::\"_ set \\<Rightarrow> nat nres\" where [refine_vcg_def]: \"card_info x = SPEC top\" \\<comment> \\<open>\\<open>op_set_wcard\\<close>\\<close>\n\ndefinition [simp]: \"set_of_coll X = X\"\n\ndefinition [simp]: \"ivl_to_set X = X\"\n\ndefinition \"ivls_of_sets X = do {\n    XS \\<leftarrow> (sets_of_coll (X:::clw_rel appr_rel) ::: \\<langle>\\<langle>appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel);\n    FORWEAK XS (RETURN (op_empty_coll:::clw_rel lvivl_rel))\n      (\\<lambda>X. do {\n        (i, s) \\<leftarrow> op_ivl_rep_of_set X;\n        RETURN (mk_coll (op_atLeastAtMost_ivl i s:::\\<langle>lv_rel\\<rangle>ivl_rel))\n      })\n      (\\<lambda>a b. RETURN (a \\<union> b))\n  }\"\nsublocale autoref_op_pat_def ivls_of_sets .\n\ndefinition \"ivl_rep_of_set_coll X = do { Xs \\<leftarrow> sets_of_coll (X:::clw_rel appr_rel); op_ivl_rep_of_sets Xs}\"\nsublocale autoref_op_pat_def ivl_rep_of_set_coll .\n\ndefinition [simp]: \"sets_of_ivls X = X\"\nsublocale autoref_op_pat_def sets_of_ivls .\n\ndefinition \"op_intersects X sctn = (do {\n    ii \\<leftarrow> Inf_inner X (normal sctn);\n    si \\<leftarrow> Sup_inner X (normal sctn);\n    RETURN (ii \\<le> pstn sctn \\<and> si \\<ge> pstn sctn)\n  })\"\nsublocale autoref_op_pat_def op_intersects .\n\ndefinition \"sbelow_sctns_coll XS sctns = do {\n    XS \\<leftarrow> (sets_of_coll XS ::: \\<langle>\\<langle>appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel);\n    FORWEAK XS (RETURN True) (\\<lambda>X. sbelow_sctns X sctns) (\\<lambda>a b. RETURN (a \\<and> b))\n  }\"\nsublocale autoref_op_pat_def sbelow_sctns_coll .\n\ndefinition \"below_sctn_coll XS sctn = do {\n    XS \\<leftarrow> (sets_of_coll XS ::: \\<langle>\\<langle>appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel);\n    FORWEAK XS (RETURN True) (\\<lambda>X. below_sctn X sctn) (\\<lambda>a b. RETURN (a \\<and> b))\n  }\"\nsublocale autoref_op_pat_def below_sctn_coll .\n\n\ndefinition \"intersects_clw X sctn = (do {\n    XS \\<leftarrow> sets_of_coll (X:::clw_rel appr_rel);\n    FORWEAK XS (RETURN False) (\\<lambda>X. op_intersects X sctn) (\\<lambda>a b. RETURN (a \\<or> b))\n  })\"\nsublocale autoref_op_pat_def intersects_clw .\n\ndefinition \"op_subset X ivl = do {\n    (i', s') \\<leftarrow> ((ivl_rep ((ivl))));\n    (i, s) \\<leftarrow> (op_ivl_rep_of_set ((X::'a::executable_euclidean_space set)));\n    RETURN (((i' \\<le> i):::bool_rel) \\<and> ((s \\<le> s'):::bool_rel))\n  }\"\nsublocale autoref_op_pat_def op_subset .\n\ndefinition [simp]: \"subset_spec_coll X ivl = do {\n    XS \\<leftarrow> (sets_of_coll X:::\\<langle>\\<langle>appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel);\n    FORWEAK XS (RETURN True)\n      (\\<lambda>X. op_subset X ivl)\n      (\\<lambda>x y. RETURN (x \\<and> y))\n  }\"\nsublocale autoref_op_pat_def subset_spec_coll .\n\ndefinition \"op_project_set X b y = inter_sctn_spec X (Sctn b y)\"\nsublocale autoref_op_pat_def op_project_set .\n\ndefinition [simp]: \"project_set_clw X b y = do {\n    XS \\<leftarrow> (sets_of_coll (X:::clw_rel appr_rel));\n    FORWEAK XS (RETURN op_empty_coll) (\\<lambda>X. do {\n      P \\<leftarrow> op_project_set X b y;\n      RETURN (mk_coll P)\n    }) (\\<lambda>X Y. RETURN (Y \\<union> X))\n  }\"\nsublocale autoref_op_pat_def project_set_clw .\n\ndefinition \"subset_spec_ivls X Y = do {\n    Ys \\<leftarrow> sets_of_coll Y; FORWEAK Ys (RETURN False) (\\<lambda>Y. op_subset X Y) (\\<lambda>a b. RETURN (a \\<or> b))\n  }\"\nsublocale autoref_op_pat_def subset_spec_ivls .\n\ndefinition \"subset_spec_ivls_clw M X Y = do {\n    X \\<leftarrow> split_along_ivls M X Y;\n    X \\<leftarrow> sets_of_coll (sets_of_ivls X);\n    FORWEAK X (RETURN True) (\\<lambda>X. subset_spec_ivls X Y) (\\<lambda>a b. RETURN (a \\<and> b))\n  }\"\nsublocale autoref_op_pat_def subset_spec_ivls_clw .\n\ndefinition [simp]: \"REMDUPS x = x\"\nsublocale autoref_op_pat_def REMDUPS .\n\ndefinition \"split_along_ivls2 M X Y = do {\n    Xs \\<leftarrow> sets_of_coll X;\n    Rs \\<leftarrow>FORWEAK Xs (RETURN op_empty_coll) (\\<lambda>X. do {\n      (I, N) \\<leftarrow> split_intersecting Y (mk_coll X);\n      split_along_ivls M (mk_coll X) I\n    }) (\\<lambda>x y. RETURN (y \\<union> x));\n    RETURN (REMDUPS Rs)\n  }\"\nsublocale autoref_op_pat_def split_along_ivls2 .\n\ndefinition [simp]: \"op_list_of_eucl_image X = list_of_eucl ` X\"\nlemma [autoref_op_pat_def]: \"list_of_eucl ` X \\<equiv> OP op_list_of_eucl_image $ X\" by simp\n\ndefinition [simp]: \"op_eucl_of_list_image X = (eucl_of_list ` X::'a::executable_euclidean_space set)\"\nlemma [autoref_op_pat_def]: \"eucl_of_list ` X \\<equiv> OP op_eucl_of_list_image $ X\" by simp\n\ndefinition [simp]: \"op_take_image n X = take n ` X\"\nlemma [autoref_op_pat_def]: \"take n ` X \\<equiv> OP op_take_image $ n $ X\" by simp\n\ndefinition [simp]: \"op_drop_image n X = drop n ` X\"\nlemma [autoref_op_pat_def]: \"drop n ` X \\<equiv> OP op_drop_image $ n $ X\" by simp\n\ndefinition \"approx_slp_appr fas slp X = do {\n    cfp \\<leftarrow> approx_slp_spec fas DIM('a::executable_euclidean_space) slp X;\n    (case cfp of\n      Some cfp \\<Rightarrow> do {\n        RETURN ((eucl_of_list ` cfp::'a set):::appr_rel)\n      }\n      | None \\<Rightarrow> do {\n        SUCCEED\n      }\n    )\n  }\"\nsublocale autoref_op_pat_def approx_slp_appr .\n\ndefinition \"mig_set D (X::'a::executable_euclidean_space set) = do {\n    (i, s) \\<leftarrow> op_ivl_rep_of_set (X:::appr_rel);\n    let migc = mig_componentwise i s;\n    ASSUME (D = DIM('a));\n    let norm_fas = ([Norm (map floatarith.Var [0..<D])]:::\\<langle>Id\\<rangle>list_rel);\n    let env = (list_of_eucl ` ({migc .. migc}:::appr_rel):::appr_rell);\n    (n::real set) \\<leftarrow> approx_slp_appr  norm_fas (slp_of_fas norm_fas) env;\n    (ni::real) \\<leftarrow> Inf_spec (n:::appr_rel);\n    RETURN (rnv_of_lv ni::real)\n  }\"\nsublocale autoref_op_pat_def mig_set .\n\nlemma appr_rel_br: \"appr_rel = br (\\<lambda>xs. eucl_of_list ` (set_of_appr xs)::'a set) (\\<lambda>xs. length xs = DIM('a::executable_euclidean_space))\"\n  unfolding appr_rel_def lv_rel_def set_rel_br\n  unfolding appr_rell_internal br_chain o_def\n  using length_set_of_appr\n  by (auto dest!: brD intro: brI)\n\ndefinition print_set::\"bool \\<Rightarrow> 'a set \\<Rightarrow> unit\" where \"print_set _ _ = ()\"\n\ndefinition trace_set::\"string\\<Rightarrow>'a set option\\<Rightarrow>unit\" where \"trace_set _ _ = ()\"\n\ndefinition print_msg::\"string \\<Rightarrow> unit\" where \"print_msg _ = ()\"\n\nabbreviation \"CHECKs \\<equiv> \\<lambda>s. CHECK (\\<lambda>_. print_msg s)\"\n\ndefinition \"ncc (X::'a::executable_euclidean_space set) \\<longleftrightarrow> X \\<noteq> {} \\<and> compact X \\<and> convex X\"\n\ndefinition \"ncc_precond TYPE('a::executable_euclidean_space) \\<longleftrightarrow> (\\<forall>(Xi, X::'a set) \\<in> appr_rel. ncc X)\"\n\nend\n\nlemma prod_relI': \"\\<lbrakk>(a,fst ab')\\<in>R1; (b,snd ab')\\<in>R2\\<rbrakk> \\<Longrightarrow> ((a,b),ab')\\<in>\\<langle>R1,R2\\<rangle>prod_rel\"\n  by  (auto simp: prod_rel_def)\n\nlemma lv_relivl_relI:\n  \"((xs', ys'), {eucl_of_list xs..eucl_of_list ys::'a::executable_euclidean_space}) \\<in> \\<langle>lv_rel\\<rangle>ivl_rel\"\n  if [simp]: \"xs' = xs\" \"ys' = ys\" \"DIM('a) = length xs\" \"length ys = length xs\"\n  by (force simp: ivl_rel_def set_of_ivl_def\n      intro!:  brI lv_relI prod_relI[of _ \"eucl_of_list xs\" _ _ \"eucl_of_list ys\"])\n\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Ordinary_Differential_Equations/Numerics/Abstract_Rigorous_Numerics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3340076981155336}}
{"text": "theory Example\n  imports DisConSemantics\nbegin\n\n\ndefinition Gain::block where \"Gain = Block ''x'' ''y'' [0] 1 [(\\<lambda>s. (if length s = 1\n  then (2*hd s) else 0))]\"\n\ndefinition UD1::block where \"UD1 = Block ''y'' ''s'' [0] 1 [(\\<lambda>s. (if length s = 1\n  then (hd s) else 0))]\"\ndefinition UD2::block where \"UD2 = Block ''s'' ''z'' [1] 1 [(\\<lambda>s. (if length s = 1\n  then (hd s) else 0))]\"\n\ndefinition Integ1::block where \"Integ1 = Block ''z'' ''a'' [1] 0 [(\\<lambda>s. (if length s = 1\n  then (hd s) else 0))]\"\n\ndefinition Bias::block where \"Bias = Block ''a'' ''b'' [0] 0 [(\\<lambda>s. (if length s = 1\n  then (hd s + 2::real) else 0))]\"\n\ndefinition Integ2::block where \"Integ2 = Block ''b'' ''x'' [1] 0 [(\\<lambda>s. (if length s = 1\n  then (hd s) else 0))]\"\n\ndefinition h:: timed_vars where \"h = (\\<lambda>v t. 0)\"\n\ndefinition h':: timed_vars where \"h' = (\\<lambda>v t. (if t = 0 \\<and> v = CHR ''b'' then 2 else 0))\"\n\ndefinition Bias'::block where \"Bias' = Block ''a'' ''b'' [0] (-1) [(\\<lambda>s. (if length s = 1\n  then (hd s + 2::real) else 0))]\"\n\\<comment> \\<open>compute sample time of block \"Bias'\", and sample_time = 0 inherited by Ingteg1\\<close>\n\nterm \"exe_discrete_diag_tilltime [B2,B1] h 0 (CHR ''a'') 0\"\n\nlemma test0: \"((\\<lambda>x. k*x) has_vderiv_on (\\<lambda>x. k)) T\"\n  by (auto simp: has_vderiv_on_def intro!: derivative_eq_intros)\n\nlemma test0': \"((\\<lambda>x. 2*x*x) has_vderiv_on (\\<lambda>x. 4*x)) T\"\n  by (auto simp: has_vderiv_on_def intro!: derivative_eq_intros) \n\ntext \\<open>Projection of has_vector_derivative onto components.\\<close>\nlemma has_vector_derivative_proj:\n  assumes \"(p has_vector_derivative q t) (at t within D)\"\n  shows \"((\\<lambda>t. p t $ i) has_vector_derivative q t $ i) (at t within D)\"\n  using assms unfolding has_vector_derivative_def has_derivative_def \n  apply (simp add: bounded_linear_scaleR_left)\n  using tendsto_vec_nth by fastforce\n\nlemma has_vderiv_on_proj:\n  assumes \"(p has_vderiv_on q) D\"\n  shows \"((\\<lambda>t. p t $ i) has_vderiv_on (\\<lambda>t. q t $ i)) D\"\n  using assms unfolding has_vderiv_on_def \n  by (simp add: has_vector_derivative_proj)\n\nlemma has_vector_derivative_projI:\n  assumes \"\\<forall>i. ((\\<lambda>t. p t $ i) has_vector_derivative q t $ i) (at t within D)\"\n  shows \"(p has_vector_derivative q t) (at t within D)\"\n  using assms unfolding has_vector_derivative_def has_derivative_def\n  apply (auto simp add: bounded_linear_scaleR_left)\n  by (auto intro: vec_tendstoI)\n                              \n\n\\<comment> \\<open>combination check\\<close>\nlemma relatedBlocks_lemma1:\"(getRelatedBlocks [Bias,Integ2] Integ2 []) = [Bias]\"\nproof- \n  have 1: \"getOneRelatedBlock [Bias,Integ2] Integ2 [] = Some Bias\"\n    unfolding getOneRelatedBlock.simps Integ1_def Bias_def Integ2_def by force\n  have 2: \"(remove1 (the (Some Bias)) [Bias,Integ2] = [Integ2])\"\n    by simp\n  have 3: \"(getRelatedBlocks [Bias,Integ2] Integ2 []) = (getRelatedBlocks [Integ2] Integ2 [Bias])\"\n    using 1 2 by auto\n  have 4: \"getOneRelatedBlock [Integ2] Integ2 [Bias] = None\"\n    unfolding getOneRelatedBlock.simps Integ1_def Bias_def Integ2_def by force\n  have 5: \"(remove1 (the (Some Integ1)) [Integ1,Integ2] = [Integ2])\"\n    by simp\n  have 6: \"(getRelatedBlocks [Integ2] Integ2 [Bias]) = [Bias]\"\n    using 4 5 by auto\n  show ?thesis using 3 6 by simp\nqed\n\nlemma relatedBlocks_lemma2:\"(getRelatedBlocks [Integ1,Bias,Integ2] Integ1 []) = []\"\nproof- \n  have 1: \"getOneRelatedBlock [Integ1,Bias,Integ2] Integ1 [] = None\"\n    unfolding getOneRelatedBlock.simps Integ1_def Bias_def Integ2_def by force\n  show ?thesis using 1 by simp\nqed\n\nlemma outputs_sort_lemma1: \"sort_by_outputs [Integ1, Integ2] = [Integ1, Integ2]\"\nproof -\n  have 1: \"get_first_block [Integ1, Integ2] = Integ1\"\n  proof -\n    show ?thesis unfolding get_first_block.simps Integ1_def Integ2_def integer_of_char_def by simp\n  qed\n  show ?thesis unfolding sort_by_outputs.simps using 1 by auto\nqed\n\nlemma outputs_sort_lemma2: \"sort_by_outputs [Integ1, Bias, Integ2] = [Integ1, Bias, Integ2]\"\nproof -\n  have 1: \"get_first_block [Integ1, Bias, Integ2] = Integ1\"\n    unfolding get_first_block.simps Integ1_def Integ2_def Bias_def integer_of_char_def by simp\n  have 2: \"remove1 Integ1 [Integ1, Bias, Integ2] = [Bias, Integ2]\"\n    by simp\n  have 3: \"sort_by_outputs [Bias, Integ2] = [Bias, Integ2]\"\n    unfolding sort_by_outputs.simps get_first_block.simps Integ2_def Bias_def integer_of_char_def by simp\n  show ?thesis unfolding sort_by_outputs.simps using 1 3 by auto\nqed\n\nlemma combineOneBlock_lemma1: \"combineOneBlock ''a'' ''b'' [0] [(\\<lambda>s. (if length s = 1\n  then (hd s + 2) else 0))] Integ2 = (Block ''a'' ''x'' [1] 0 (updateFunc [\\<lambda>s. if length s = 1 \nthen hd s else 0] ''b'' CHR ''b''(\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\"\nproof -\n  have 1: \"\\<forall>b. get_sample_time b = 0 \\<longrightarrow> combineOneBlock ''a'' [] [] [] b = b\"\n    by (metis (no_types, opaque_lifting) combineOneBlock.simps(1) get_sample_time.elims)\n  have 2: \"combineOneOutput ''a'' CHR ''b'' 0 (\\<lambda>s. if length s = 1 then hd s + 2 else 0)\n           (Block ''b'' ''x'' [1] 0 [(\\<lambda>s. (if length s = 1 then (hd s) else 0))]) = \n  (Block ''a'' ''x'' [1] 0 (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n             (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\"\n  proof -\n    have tmp1: \"(combineInputs ''b'' ''a'' CHR ''b'') = ''a''\"\n      by simp\n    show ?thesis unfolding combineOneOutput.simps by auto\n  qed\n  show ?thesis using combineOneBlock.simps(4)[of \"''a''\" \"CHR ''b''\" \"[]\" 0 \"[]\" \"(\\<lambda>s. (if length s = 1\n  then (hd s + 2) else 0))\" \"[]\"] 1 2 by (simp add: Integ2_def)\nqed\n\nvalue \"(combineInputs2 ''a'' ''z'')\"\n\nlemma combineOneBlock_lemma2: \"combineOneBlock ''a'' ''x'' [1] (updateFunc [\\<lambda>s. if length s = 1 \nthen hd s else 0] ''b'' CHR ''b''(\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a'') Integ1  = \nBlock ''za'' ''ax'' [1,1] 0\n           (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n             (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n                   (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n             ''z'')\"\nproof -\n  have 1: \"\\<forall>b. get_sample_time b = 0 \\<longrightarrow> combineOneBlock ''a'' [] [] [] b = b\"\n    by (metis (no_types, opaque_lifting) combineOneBlock.simps(1) get_sample_time.elims)\n  have 2: \"combineOneOutput2 ''a'' CHR ''x'' 1 (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s \n          else 0] ''b'' CHR ''b'' (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n             Integ1 = Block ''za'' ''ax'' [1,1] 0\n           (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n             (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n                   (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n             ''z'')\"\n  proof -\n    have tmp1: \"(combineInputs2 ''z'' ''a'') = ''za''\"\n      by simp\n    show ?thesis unfolding Integ1_def combineOneOutput2.simps by simp\n  qed\n  show ?thesis using combineOneBlock.simps(4)[of \"''a''\" \"CHR ''x''\" \"[]\" 1 \"[]\" \"hd \n    (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''(\\<lambda>s. if length s = 1 \n    then hd s + 2 else 0) ''a'')\" \"[]\"] 1 2 by (simp add: Integ1_def)\nqed\n\nlemma combineBlocks_lemma1: \"combineBlocks (getRelatedBlocks [Bias,Integ2] Integ2 []) Integ2\n  = (Block ''a'' ''x'' [1] 0 (updateFunc [\\<lambda>s. if length s = 1 \nthen hd s else 0] ''b'' CHR ''b''(\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\"\nproof -\n  have 1: \"combineBlocks [Bias] Integ2 = (Block ''a'' ''x'' [1] 0 (updateFunc [\\<lambda>s. if length s = 1 \nthen hd s else 0] ''b'' CHR ''b''(\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\"\n    unfolding combineBlocks.simps Bias_def Integ1_def using combineOneBlock_lemma1 \n      get_inputs.simps get_offsets.simps get_outputs.simps     \n      get_outupd.simps by presburger\n  show ?thesis using 1 relatedBlocks_lemma1 by auto\nqed\n\nlemma combineBlocks_lemma2: \"combineBlocks (getRelatedBlocks [Integ1,Bias,Integ2] Integ1 []) \n  Integ1 = Integ1\"\n  using relatedBlocks_lemma2 by auto\n\nlemma combination_lemma: \"combination [Integ1,Bias,Integ2] [Integ1, Integ2] = \n  [Integ1,(Block ''a'' ''x'' [1] 0 (updateFunc [\\<lambda>s. if length s = 1 \nthen hd s else 0] ''b'' CHR ''b''(\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))]\"\n  unfolding combination.simps using combineBlocks_lemma1\n  using combineBlocks_lemma2 by auto\n\nlemma Combine_lemma: \"Combine [Integ1,(Block ''a'' ''x'' [1] 0 (updateFunc [\\<lambda>s. if length s = 1 \nthen hd s else 0] ''b'' CHR ''b''(\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))] = \n  Block ''za'' ''ax'' [1, 1] 0\n   (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n     (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n           (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n     ''z'')\"\n  unfolding Combine.simps combineBlocks.simps using combineOneBlock_lemma2 by simp\n\nlemma updateIntegBlks_lemma: \"updateIntegBlks [Integ1, Bias, Integ2] [Integ1, Integ2] =\n  Block ''za'' ''ax'' [1, 1] 0\n   (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n     (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n           (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n     ''z'')\"\n  unfolding updateIntegBlks.simps using outputs_sort_lemma1 outputs_sort_lemma2\n  combination_lemma Combine_lemma by auto\n\n\nlemma getODE':\"(block2ODE (Block ''a'' ''x'' [1] 0 (updateFunc [\\<lambda>s. if length s = 1 \nthen hd s else 0] ''b'' CHR ''b''(\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))) =\n(\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then (v $ CHR ''a'' + 2) else 0)))\"\nproof -\n  have 1: \"getExps (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n                (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a'') ''a'' = [\\<lambda>s. s CHR ''a'' + 2]\"\n  proof -\n    have tmp1: \"\\<forall>s. length (map s ''a'') = length (combineInputs ''b'' ''a'' CHR ''b'')\"\n      by simp\n    have tmp2: \"\\<forall>s. (splitInputs ''b'' ''a'' CHR ''b'' (map s ''a'')\n            (\\<lambda>s. if length s = 1 then hd s + 2 else 0)) = [s CHR ''a'' + 2]\"\n      by simp\n    have tmp3: \"\\<forall>s. length (splitInputs ''b'' ''a'' CHR ''b'' (map s ''a'')\n                    (\\<lambda>s. if length s = 1 then hd s + 2 else 0)) = 1\"\n      by simp\n    show ?thesis  unfolding updateFunc.simps getExps.simps outupd2exp_def using tmp1 tmp2 tmp3 \n      by force\n  qed\n  have 2: \"exp2ODE ''x'' [\\<lambda>s. s CHR ''a'' + 2] = \n      (\\<lambda>s. if CHR ''x'' = s then \\<lambda>st. st CHR ''a'' + 2 else zeroExp)\"\n    unfolding exp2ODE.simps by simp  \n  have 3: \"\\<forall>v1. state2vec (\\<lambda>x. (if CHR ''x'' = x then \\<lambda>st. st CHR ''a'' + 2 else zeroExp) \n    (vec2state v1))\n    = (\\<chi> x. (if x = CHR ''x'' then v1 $ CHR ''a'' + 2 else 0))\"\n    apply clarify subgoal for v by (smt (verit, ccfv_SIG) Cart_lambda_cong \n          state2vec_def vec2state_def zeroExp_def)\n    done\n  show ?thesis unfolding block2ODE.simps using 1 2 apply simp subgoal premises pre\n      using 3 by presburger done\nqed\n\nlemma combine1: \"[\\<lambda>xl. if length xl = length (combineInputs ''b'' ''a'' CHR ''b'')\n               then if length\n                        (splitInputs ''b'' ''a'' CHR ''b'' xl\n                          (\\<lambda>s. if length s = 1 then hd s + 2 else 0)) =\n                       1\n                    then hd (splitInputs ''b'' ''a'' CHR ''b'' xl\n                              (\\<lambda>s. if length s = 1 then hd s + 2 else 0))\n                    else 0\n               else 0] = [\\<lambda>xl. (if length xl = 1 then hd xl + 2 else 0)]\"\nproof -\n  have 1: \"length (combineInputs ''b'' ''a'' CHR ''b'') = 1\"\n    by simp\n  have 2: \"\\<forall>xl. length (splitInputs ''b'' ''a'' CHR ''b'' xl\n                        (\\<lambda>s. if length s = 1 then hd s + 2 else 0)) = 1\"\n    by simp\n  have 3: \"\\<forall>xl. length xl = 1 \\<longrightarrow> (splitInputs ''b'' ''a'' CHR ''b'' xl\n           (\\<lambda>s. if length s = 1 then hd s + 2 else 0)) = [hd xl + 2]\"\n    unfolding splitInputs.simps replaceInputs.simps by force\n  show ?thesis using 1 2 3 by auto\nqed\n\nvalue \"length (combineInputs2 ''a'' ''z'')\"\nlemma combine2: \"updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n                (\\<lambda>xl. (if length xl = 1 then hd xl + 2 else 0))\n                ''z'' = [\\<lambda>s. if length s = 2 then hd s else 0,\n\\<lambda>s. if length s = 2 then last s + 2 else 0]\"\nproof -\n  have 1: \"reviseFun [\\<lambda>s. if length s = 1 then hd s else 0] ''a'' ''z'' =\n  [\\<lambda>xl. if length xl = 2 then hd xl else 0]\"\n  proof -\n    have tmp1: \"\\<forall>s. length s = 2 \\<longrightarrow> length (splitInputs ''z'' ''a'' CHR '' '' s (\\<lambda>x. 0)) = 1\"\n      by simp\n    have tmp2: \"\\<forall>s. length s = 2 \\<longrightarrow> hd (splitInputs ''z'' ''a'' CHR '' '' s (\\<lambda>x. 0)) = hd s\"\n      apply clarify subgoal for s by simp\n      done\n    show ?thesis unfolding reviseFun.simps using tmp1 tmp2 by auto\n  qed\n  have 2: \"[\\<lambda>s. if length s = length (combineInputs2 ''z'' ''a'') then if \n          length (drop (length ''z'') s) = 1 then hd (drop (length ''z'') s) + 2 else 0 else 0]\n  = [\\<lambda>s. if length s = 2 then last s + 2 else 0]\"\n  proof -\n    have tmp1: \"\\<forall>s. length s = 2 \\<longrightarrow> hd (drop 1 s) = last s\"\n      apply clarify subgoal for s by (metis Suc_1 add_diff_cancel_left' hd_drop_conv_nth \n            last_conv_nth length_0_conv lessI nat.simps(3) plus_1_eq_Suc)\n      done\n    have tmp2: \"length (combineInputs2 ''z'' ''a'') = 2\"\n      by simp\n    have tmp3: \"\\<forall>s. length s = 2 \\<longrightarrow> length (drop (length ''a'') s) = 1\"\n      by auto\n    show ?thesis using tmp1 tmp2 tmp3 by (metis One_nat_def length_0_conv length_Cons)\n  qed\n  show ?thesis unfolding updateFunc2.simps using 1 2 by auto\nqed\n\n\nlemma getODE'_2 : \"(block2ODE (Block ''za'' ''ax'' [1, 1] 0\n   (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n     (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n           (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n     ''z''))) =\n(\\<lambda>t v. (\\<chi> x. (if x = CHR ''x'' then v $ CHR ''a'' + 2 else if \n      x = CHR ''a'' then v $ CHR ''z'' else 0)))\"\nproof -\n  have 1: \"(getExps\n              (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n                (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n                      (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n                ''z'')\n              ''za'') = [\\<lambda>s. s CHR ''z'', \\<lambda>s. s CHR ''a''+2]\"\n  proof -\n    have tmp1: \"(updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n                (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n                      (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n                ''z'') = [\\<lambda>s. if length s = 2 then hd s else 0,\n\\<lambda>s. if length s = 2 then last s + 2 else 0]\"\n      unfolding updateFunc.simps using combine1 combine2 by auto\n    have tmp2: \"\\<forall>s. (if length (map s ''az'') = 2 then hd (map s ''az'') + 2 else 0)\n        = (s CHR ''a'' + 2)\"\n      by auto\n    have tmp3: \"\\<forall>s. (if length (map s ''az'') = 2 then last (map s ''az'') else 0)\n        = (s CHR ''z'')\"\n      by auto\n    have tmp4: \"getExps [\\<lambda>s. if length s = 2 then hd s else 0,\n\\<lambda>s. if length s = 2 then last s + 2 else 0] ''za'' = [\\<lambda>s. s CHR ''z'', \\<lambda>s. s CHR ''a''+2]\"\n      unfolding getExps.simps outupd2exp_def using tmp2 tmp3 by auto\n    show ?thesis using tmp1 tmp4 by presburger\n  qed\n  have 2: \"exp2ODE ''ax'' [\\<lambda>s. s CHR ''z'', \\<lambda>s. s CHR ''a'' + 2] = \n    (\\<lambda>s. if CHR ''x'' = s then \\<lambda>st. st CHR ''a'' + 2 else \n    if CHR ''a'' = s then \\<lambda>s. s CHR ''z'' else zeroExp)\"\n    unfolding exp2ODE.simps by force\n  have 3: \"\\<forall>v1. state2vec (\\<lambda>x. (if CHR ''x'' = x then \\<lambda>st. st CHR ''a'' + 2\n               else if CHR ''a'' = x then \\<lambda>s. s CHR ''z'' else zeroExp) (vec2state v1))\n    = (\\<chi> x. (if x = CHR ''x'' then v1 $ CHR ''a'' + 2 else if \n      x = CHR ''a'' then v1 $ CHR ''z'' else 0))\"\n    apply clarify subgoal for v by (smt (verit, ccfv_SIG) Cart_lambda_cong \n          state2vec_def vec2state_def zeroExp_def)\n    done\n  show ?thesis unfolding block2ODE.simps using 1 2 apply simp subgoal premises pre\n      using 3 by presburger done\nqed\n\nlemma base1: \"((\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else if y = CHR ''b'' then 2 else 0) has_vderiv_on\n     (\\<lambda>t. \\<chi> x. if x = CHR ''x''\n               then (\\<chi> y. if y = CHR ''x'' then 2 * t else if y = CHR ''b'' then 2 else 0) $\n                    CHR ''a'' +\n                    2\n               else if x = CHR ''a''\n                    then (\\<chi> y. if y = CHR ''x'' then 2 * t else if y = CHR ''b'' then 2 else 0) $\n                         CHR ''z''\n                    else 0))\n     {0--1}\"\n  unfolding has_vderiv_on_def apply clarify subgoal premises pre for x\nproof -\n  have 1: \"\\<forall>i. ((\\<lambda>t. (\\<chi> y. if y = CHR ''x'' then 2 * t else if y = CHR ''b'' then 2 else 0) $\n              i) has_vector_derivative\n         (\\<chi> xa. if xa = CHR ''x''\n                then (\\<chi> y. if y = CHR ''x'' then 2 * x else if y = CHR ''b'' then 2 else 0) $\n                     CHR ''a'' +\n                     2\n                else if xa = CHR ''a''\n                     then (\\<chi> y. if y = CHR ''x'' then 2 * x else if y = CHR ''b'' then 2 else 0) $\n                          CHR ''z''\n                     else 0) $\n         i)\n         (at x within {0--1})\"\n    apply clarify subgoal for i\n    proof(cases \"i = CHR ''x''\")\n      case True\n      then show ?thesis apply simp\n        by (auto simp: has_vderiv_on_def intro!: derivative_eq_intros)\n    next\n      case False\n      then show ?thesis by simp\n    qed\n    done\n  show ?thesis \n    using has_vector_derivative_projI[of \"(\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else if y = CHR ''b'' then 2 else 0)\" \n        \"(\\<lambda>t. \\<chi> x. if x = CHR ''x''\n               then (\\<chi> y. if y = CHR ''x'' then 2 * t else if y = CHR ''b'' then 2 else 0) $\n                    CHR ''a'' +\n                    2\n               else if x = CHR ''a''\n                    then (\\<chi> y. if y = CHR ''x'' then 2 * t else if y = CHR ''b'' then 2 else 0) $\n                         CHR ''z''\n                    else 0)\" x \"{0--1}\"] 1 pre by blast\n  qed\n  done\n\nlemma base2: \"(\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else if y = CHR ''b'' then 2 else 0) \\<in> {0--1} \\<rightarrow> UNIV\"\n  by simp\n\nlemma base3: \"((\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x\n               else if y = CHR ''b'' then 2\n                    else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0) has_vderiv_on\n     (\\<lambda>t. \\<chi> x. if x = CHR ''x''\n               then (\\<chi> y. if y = CHR ''x'' then 2 * t\n                          else if y = CHR ''b'' then 2\n                               else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0) $\n                    CHR ''a'' +\n                    2\n               else if x = CHR ''a''\n                    then (\\<chi> y. if y = CHR ''x'' then 2 * t\n                               else if y = CHR ''b'' then 2\n                                    else if y = CHR ''y'' then 4\n                                         else if y = CHR ''s'' then 4 else 0) $\n                         CHR ''z''\n                    else 0))\n     {1--2}\"\n  unfolding has_vderiv_on_def apply clarify subgoal premises pre for x\nproof -\n  have 1: \"\\<forall>i. ((\\<lambda>t. (\\<chi> y. if y = CHR ''x'' then 2 * t\n                    else if y = CHR ''b'' then 2\n                         else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0) $\n              i) has_vector_derivative\n         (\\<chi> xa. if xa = CHR ''x''\n                then (\\<chi> y. if y = CHR ''x'' then 2 * x\n                           else if y = CHR ''b'' then 2\n                                else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0) $\n                     CHR ''a'' +\n                     2\n                else if xa = CHR ''a''\n                     then (\\<chi> y. if y = CHR ''x'' then 2 * x\n                                else if y = CHR ''b'' then 2\n                                     else if y = CHR ''y'' then 4\n                                          else if y = CHR ''s'' then 4 else 0) $\n                          CHR ''z''\n                     else 0) $\n         i)\n         (at x within {1--2})\"\n    apply clarify subgoal for i\n    proof(cases \"i = CHR ''x''\")\n      case True\n      then show ?thesis apply simp\n        by (auto simp: has_vderiv_on_def intro!: derivative_eq_intros)\n    next\n      case False\n      then show ?thesis by simp\n    qed\n    done\n  show ?thesis \n    using has_vector_derivative_projI[of \"(\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x\n               else if y = CHR ''b'' then 2\n                    else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0)\" \n              \"(\\<lambda>t. \\<chi> x. if x = CHR ''x''\n               then (\\<chi> y. if y = CHR ''x'' then 2 * t\n                          else if y = CHR ''b'' then 2\n                               else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0) $\n                    CHR ''a'' +\n                    2\n               else if x = CHR ''a''\n                    then (\\<chi> y. if y = CHR ''x'' then 2 * t\n                               else if y = CHR ''b'' then 2\n                                    else if y = CHR ''y'' then 4\n                                         else if y = CHR ''s'' then 4 else 0) $\n                         CHR ''z''\n                    else 0)\" x \"{1--2}\"] 1 pre by blast\n  qed\n  done\n\nlemma base4: \"(\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x\n              else if y = CHR ''b'' then 2\n                   else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0)\n    \\<in> {1--2} \\<rightarrow> UNIV\"\n  by simp\n\nlemma base5: \"((\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x * x - 6 * x + 8\n               else if y = CHR ''b'' then 2\n                    else if y = CHR ''z'' then 4\n                         else if y = CHR ''a'' then 4 * (x - 2)\n                              else if y = CHR ''y'' then 8\n                                   else if y = CHR ''s'' then 8 else 0) has_vderiv_on\n     (\\<lambda>t. \\<chi> x. if x = CHR ''x''\n               then (\\<chi> y. if y = CHR ''x'' then 2 * t * t - 6 * t + 8\n                          else if y = CHR ''b'' then 2\n                               else if y = CHR ''z'' then 4\n                                    else if y = CHR ''a'' then 4 * (t - 2)\n                                         else if y = CHR ''y'' then 8\n                                              else if y = CHR ''s'' then 8 else 0) $\n                    CHR ''a'' +\n                    2\n               else if x = CHR ''a''\n                    then (\\<chi> y. if y = CHR ''x'' then 2 * t * t - 6 * t + 8\n                               else if y = CHR ''b'' then 2\n                                    else if y = CHR ''z'' then 4\n                                         else if y = CHR ''a'' then 4 * (t - 2)\n                                              else if y = CHR ''y'' then 8\nelse if y = CHR ''s'' then 8 else 0) $\n                         CHR ''z''\n                    else 0))\n     {2--3}\"\n  unfolding has_vderiv_on_def apply clarify subgoal premises pre for x\nproof -\n  have 1: \"\\<forall>i. ((\\<lambda>t. (\\<chi> y. if y = CHR ''x'' then 2 * t * t - 6 * t + 8\n                    else if y = CHR ''b'' then 2\n                         else if y = CHR ''z'' then 4\n                              else if y = CHR ''a'' then 4 * (t - 2)\n                                   else if y = CHR ''y'' then 8\n                                        else if y = CHR ''s'' then 8 else 0) $\n              i) has_vector_derivative\n         (\\<chi> xa. if xa = CHR ''x''\n                then (\\<chi> y. if y = CHR ''x'' then 2 * x * x - 6 * x + 8\n                           else if y = CHR ''b'' then 2\n                                else if y = CHR ''z'' then 4\n                                     else if y = CHR ''a'' then 4 * (x - 2)\n                                          else if y = CHR ''y'' then 8\n                                               else if y = CHR ''s'' then 8 else 0) $\n                     CHR ''a'' +\n                     2\n                else if xa = CHR ''a''\n                     then (\\<chi> y. if y = CHR ''x'' then 2 * x * x - 6 * x + 8\n                                else if y = CHR ''b'' then 2\n                                     else if y = CHR ''z'' then 4\n                                          else if y = CHR ''a'' then 4 * (x - 2)\n                                               else if y = CHR ''y'' then 8\n else if y = CHR ''s'' then 8 else 0) $\n                          CHR ''z''\n                     else 0) $\n         i)\n         (at x within {2--3})\"\n    apply clarify subgoal for i\n    proof(cases \"i = CHR ''x''\")\n      case True\n      then show ?thesis apply simp\n        by (auto simp: has_vderiv_on_def intro!: derivative_eq_intros)\n    next\n      case False\n      note F1 = False\n      then show ?thesis\n      proof(cases \"i = CHR ''b''\")\n        case True\n        then show ?thesis by simp\n      next\n        case False\n        note F2 = False\n        then show ?thesis\n        proof(cases \"i = CHR ''a''\")\n          case True\n          then show ?thesis apply simp\n            by (auto simp: has_vderiv_on_def intro!: derivative_eq_intros)\n        next\n          case False\n          note F3 = False\n          then show ?thesis\n          proof(cases \"i = CHR ''z''\")\n            case True\n            then show ?thesis by simp\n          next\n            case False\n            then show ?thesis using F1 F2 F3 by simp\n          qed\n        qed\n      qed\n    qed\n    done\n  show ?thesis \n    using has_vector_derivative_projI[of \"(\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x * x - 6 * x + 8\n               else if y = CHR ''b'' then 2\n                    else if y = CHR ''z'' then 4\n                         else if y = CHR ''a'' then 4 * (x - 2)\n                              else if y = CHR ''y'' then 8\n                                   else if y = CHR ''s'' then 8 else 0)\" \n            \"(\\<lambda>t. \\<chi> x. if x = CHR ''x''\n               then (\\<chi> y. if y = CHR ''x'' then 2 * t * t - 6 * t + 8\n                          else if y = CHR ''b'' then 2\n                               else if y = CHR ''z'' then 4\n                                    else if y = CHR ''a'' then 4 * (t - 2)\n                                         else if y = CHR ''y'' then 8\n                                              else if y = CHR ''s'' then 8 else 0) $\n                    CHR ''a'' +\n                    2\n               else if x = CHR ''a''\n                    then (\\<chi> y. if y = CHR ''x'' then 2 * t * t - 6 * t + 8\n                               else if y = CHR ''b'' then 2\n                                    else if y = CHR ''z'' then 4\n                                         else if y = CHR ''a'' then 4 * (t - 2)\n                                              else if y = CHR ''y'' then 8\nelse if y = CHR ''s'' then 8 else 0) $\n                         CHR ''z''\n                    else 0)\" x \"{2--3}\"] 1 pre by blast\n  qed\n  done\n\nlemma base6: \"(\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x * x - 6 * x + 8\n              else if y = CHR ''b'' then 2\n                   else if y = CHR ''z'' then 4\n                        else if y = CHR ''a'' then 4 * (x - 2)\n                             else if y = CHR ''y'' then 8 else if y = CHR ''s'' then 8 else 0)\n    \\<in> {2--3} \\<rightarrow> UNIV\"\n  by simp\n\ndefinition h1:: timed_vars where \"h1 = (\\<lambda>v t. (if v = CHR ''b'' \\<and> t \\<ge> 0 \\<and> t < 1 then 2 else \nif v = CHR ''x'' \\<and> t \\<ge> 0 \\<and> t \\<le> 1 then 2*t else h v t))\"\n\n\\<comment> \\<open>t \\<in> {0--1}\\<close>\nlemma solves1: \"((\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else \nif y = CHR ''b'' then 2 else 0) solves_ode \n  (\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0)))) {(0::real) -- (1::real)} UNIV\"\n  unfolding solves_ode_def using base1 base2 by auto\n\ndefinition Vec0 :: \"vec\" where \"Vec0 = (\\<chi> x. (if x = CHR ''b'' then 2 else 0))\"\n\nlemma get_Vec0: \"(state2vec (timedVar2State h' 0)) = Vec0\"\n  unfolding timedVar2State_def Vec0_def state2vec_def h'_def h_def by fastforce\n\nlemma solves1_fixedpoint: \"\\<exists>L. unique_on_bounded_closed 0 {0--1} Vec0 \n  (\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0))) UNIV L \\<Longrightarrow>\n\\<forall>t \\<in> {0 -- 1}. (\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else \nif y = CHR ''b'' then 2 else 0) t = \n(unique_on_bounded_closed.fixed_point 0 {0--1} Vec0 \n(\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0))) UNIV) t\"\n  subgoal premises pre\nproof -\n  have 1: \"(\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else \nif y = CHR ''b'' then 2 else 0) 0 = Vec0\"\n    unfolding Vec0_def by auto\n  show ?thesis using solves1 unique_on_bounded_closed.solves_ode_equals_fixed_point 1 pre by blast\nqed\n  done\n\n\\<comment> \\<open>t \\<in> {1--2}\\<close>\nlemma solves2: \"((\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else if y = CHR ''b'' then 2 \n      else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0) solves_ode \n  (\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0)))) {(1::real) -- (2::real)} UNIV\"\n  unfolding solves_ode_def using base3 base4 by auto\n\ndefinition h2::timed_vars where \"h2 = (\\<lambda>v t. if v = CHR ''b'' \\<and> t = 1 then 2 else\n(if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t)))\"\n\ndefinition h2'::timed_vars where \"h2' = (\\<lambda>vv tt. if 1 < tt \\<and> tt < 2 \\<and> vv = CHR ''y'' then 4 else \n  if 1 < tt \\<and> tt < 2 \\<and> vv = CHR ''s'' then 4 else h2 vv tt)\"\n\ndefinition Vec1 :: \"vec\" where \"Vec1 = (\\<chi> x.(if x = CHR ''x'' then 2 else if x = CHR ''b'' then 2 \nelse if x = CHR ''y'' then 4 else if x = CHR ''s'' then 4 else 0))\"\n\nlemma get_Vec1: \"(state2vec (timedVar2State h2 1)) = Vec1\"\n  unfolding timedVar2State_def h2_def h1_def Vec1_def state2vec_def h_def by fastforce\n\nlemma solves2_fixedpoint: \"\\<exists>L. unique_on_bounded_closed 1 {1--2} Vec1 \n  (\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0))) UNIV L \\<Longrightarrow>\n\\<forall>t \\<in> {1 -- 2}. (\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else if y = CHR ''b'' then 2 \n      else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0) t = \n(unique_on_bounded_closed.fixed_point 1 {1--2} Vec1\n(\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0))) UNIV) t\"\n  subgoal premises pre\nproof -\n  have 1: \"(\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else if y = CHR ''b'' then 2 \n      else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0) 1 = Vec1\"\n    unfolding Vec1_def by auto\n  show ?thesis using solves2 unique_on_bounded_closed.solves_ode_equals_fixed_point 1 pre by blast\nqed\n  done\n\n\\<comment> \\<open>t \\<in> {2--3}\\<close>\nlemma solves3: \"((\\<lambda>x. (\\<chi> y.(if y = CHR ''x'' then 2*x*x - 6*x + 8\n  else if y = CHR ''b'' then 2 else if\n  y = CHR ''z'' then 4 else if y = CHR ''a'' then 4*(x-2) \n  else if y = CHR ''y'' then 8 else if y = CHR ''s'' then 8 else 0)))  solves_ode \n  (\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else\n  if x = CHR ''a'' then v $ CHR ''z'' else 0)))) {(2::real) -- (3::real)} UNIV\"\n  unfolding solves_ode_def using base5 base6 by auto\n\ndefinition h3:: timed_vars where \"h3 = (\\<lambda>v t. (if v = CHR ''b'' \\<and> t > 1 \\<and> t < 2 then 2 else \n(if v = CHR ''x'' \\<and> t \\<ge> 1 \\<and> t \\<le> 2 then 2*t else h2' v t)))\"\ndefinition h4::timed_vars where \"h4 = (\\<lambda>v t. if v = CHR ''b'' \\<and> t = 2 then 2 else\n(if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else \nif v = CHR ''z'' \\<and> t = 2 then 4 else h3 v t)))\"\ndefinition h4'::timed_vars where \"h4' = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t > 2 \\<and> t < 3 then 8 else (if v = CHR ''s'' \\<and> t > 2 \\<and> t < 3 then 8 else \nif v = CHR ''z'' \\<and> t > 2 \\<and> t < 3 then 4 else h4 v t)))\"\n\ndefinition Vec2 :: \"vec\" where \"Vec2 = (\\<chi> x.(if x = CHR ''x'' then 4 else if x = CHR ''b'' then 2 \nelse if x = CHR ''z'' then 4 else if x = CHR ''y'' then 8 else if x = CHR ''s'' then 8 else 0))\"\n\nlemma getVec2: \"(state2vec (timedVar2State h4 2)) = Vec2\"\n  unfolding Vec2_def h4_def h3_def h1_def h2'_def h2_def h_def timedVar2State_def state2vec_def by auto\n\nlemma solves3_fixedpoint: \"\\<exists>L. unique_on_bounded_closed 2 {2--3} Vec2 \n  (\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0))) UNIV L \\<Longrightarrow>\n\\<forall>t \\<in> {2 -- 3}. (\\<lambda>x. (\\<chi> y.(if y = CHR ''x'' then 2*x*x - 6*x + 8\n  else if y = CHR ''b'' then 2 else if\n  y = CHR ''z'' then 4 else if y = CHR ''a'' then 4*(x-2) \n  else if y = CHR ''y'' then 8 else if y = CHR ''s'' then 8 else 0))) t = \n(unique_on_bounded_closed.fixed_point 2 {2--3} Vec2\n(\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0))) UNIV) t\"\n  subgoal premises pre\nproof -\n  have 1: \"(\\<lambda>x. (\\<chi> y.(if y = CHR ''x'' then 2*x*x - 6*x + 8\n  else if y = CHR ''b'' then 2 else if\n  y = CHR ''z'' then 4 else if y = CHR ''a'' then 4*(x-2) \n  else if y = CHR ''y'' then 8 else if y = CHR ''s'' then 8 else 0))) 2 = Vec2\"\n    unfolding Vec2_def by auto\n  show ?thesis using solves3 unique_on_bounded_closed.solves_ode_equals_fixed_point 1 pre by blast\nqed\n  done\n\nvalue \"(map (\\<lambda>a. h1 a (real 1 - real 0)) ''x'')\"\n\nlemma exe1_0: \"exeCalBlks [Bias] \n(\\<lambda>v t. (if v = CHR ''x'' \\<and> t \\<ge> 0 \\<and> t \\<le> 1 then 2*t else h' v t)) 0 1 = (\\<lambda>v t. (if \nv = CHR ''b'' \\<and> t > 0 \\<and> t < 1 then 2 else if v = CHR ''x'' \\<and> t \\<ge> 0 \\<and> t \\<le> 1 then 2*t else h' v t))\"\nproof -\n  have 1: \"\\<forall>tt. length (map (\\<lambda>a. if a = CHR ''x'' \\<and> 0 \\<le> tt \\<and> tt \\<le> 1 then 2 * tt\n                           else if tt = 0 \\<and> a = CHR ''b'' then 2 else 0) ''a'') = 1\"\n    by auto\n  have 2: \"\\<forall>tt. hd (map (\\<lambda>a. if a = CHR ''x'' \\<and> 0 \\<le> tt \\<and> tt \\<le> 1 then 2 * tt\n                               else if tt = 0 \\<and> a = CHR ''b'' then 2 else 0) ''a'') = (0::real)\"\n    by auto\n  have 3: \"\\<forall>v t. (\\<lambda>vv tt.\n        if vv = CHR ''b'' \\<and> tt < 1 \\<and> 0 < tt\n        then if length\n                 (map (\\<lambda>a. if a = CHR ''x'' \\<and> 0 \\<le> tt \\<and> tt \\<le> 1 then 2 * tt\n                           else if tt = 0 \\<and> a = CHR ''b'' then 2 else 0)\n                   ''a'') =\n                Suc 0\n             then hd (map (\\<lambda>a. if a = CHR ''x'' \\<and> 0 \\<le> tt \\<and> tt \\<le> 1 then 2 * tt\n                               else if tt = 0 \\<and> a = CHR ''b'' then 2 else 0)\n                       ''a'') +\n                  2::real\n             else 0\n        else if vv = CHR ''x'' \\<and> 0 \\<le> tt \\<and> tt \\<le> 1 then 2 * tt\n             else if tt = 0 \\<and> vv = CHR ''b'' then 2 else 0) v t = (\\<lambda>v t. if v = CHR ''b'' \\<and> 0 < t \\<and> t < 1 then 2\n           else if v = CHR ''x'' \\<and> 0 \\<le> t \\<and> t \\<le> 1 then 2 * t\n                else if t = 0 \\<and> v = CHR ''b'' then 2 else 0) v t\"\n    apply clarify subgoal for v t \n    proof(cases \"v = CHR ''b'' \\<and> t < 1 \\<and> 0 < t\")\n      case True\n      have tmp1: \"(if v = CHR ''b'' \\<and> 0 < t \\<and> t < 1 then 2\n     else if v = CHR ''x'' \\<and> 0 \\<le> t \\<and> t \\<le> 1 then 2 * t else 0) = 2\"\n        using True by auto\n      have tmp2: \"length (map (\\<lambda>a. if a = CHR ''x'' \\<and> 0 \\<le> t \\<and> t \\<le> 1 then 2 * t else 0) ''a'') = 1\"\n        using 1 by auto\n      have tmp3: \"(if v = CHR ''b'' \\<and> t < 1 \\<and> 0 < t\n     then if length\n              (map (\\<lambda>a. if a = CHR ''x'' \\<and> 0 \\<le> t \\<and> t \\<le> 1 then 2 * t\n                        else if t = 0 \\<and> a = CHR ''b'' then 2 else 0)\n                ''a'') =\n             Suc 0\n          then hd (map (\\<lambda>a. if a = CHR ''x'' \\<and> 0 \\<le> t \\<and> t \\<le> 1 then 2 * t\n                            else if t = 0 \\<and> a = CHR ''b'' then 2 else 0)\n                    ''a'') +\n               2::real\n          else 0\n     else if v = CHR ''x'' \\<and> 0 \\<le> t \\<and> t \\<le> 1 then 2 * t\n          else if t = 0 \\<and> v = CHR ''b'' then 2 else 0) = 2\"\n        using True by simp\n      then show ?thesis using tmp3 by presburger\n    next\n      case False\n      note F1 = False\n      then show ?thesis by presburger\n    qed\n    done\n  show ?thesis unfolding exeCalBlks.simps Bias_def h'_def h_def apply simp using 3 by auto\nqed\n\nvalue \"sortDiag [Gain,UD1,UD2,Bias]\"\nlemma sort_lemma: \"sortDiag [Gain,UD1,UD2,Bias] = [Gain,UD1,UD2,Bias]\"\nproof -\n  have 1: \"get_block_indegree Bias [Gain, UD1, UD2, Bias] = {}\"\n    unfolding get_block_indegree_def Bias_def Gain_def UD1_def UD2_def by auto\n  have 2: \"get_block_indegree UD2 [Gain, UD1, UD2, Bias] = {}\"\n    unfolding get_block_indegree_def Bias_def Gain_def UD1_def UD2_def by auto\n  have 3: \"get_block_indegree UD1 [Gain, UD1, UD2, Bias] = {CHR ''y''}\"\n    unfolding get_block_indegree_def Bias_def Gain_def UD1_def UD2_def by auto\n  have 4: \"get_block_indegree Gain [Gain, UD1, UD2, Bias] = {}\"\n    unfolding get_block_indegree_def Bias_def Gain_def UD1_def UD2_def by auto\n  show ?thesis unfolding sortDiag_def using topological_sort.simps[of \"[Gain,UD1,UD2,Bias]\" \n      \"[Gain,UD1,UD2,Bias]\" \"[]\"] unfolding find_0indegree_blocks.simps using 1 2 3 4 apply simp\n    unfolding Bias_def Gain_def UD1_def UD2_def by auto\nqed\n\nlemma exe0_1: \"\\<forall>v. exeDisDiag_attime [Gain] h 0 v 0 = h v 0\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. 0 = get_sample_time Gain * k)\"\n    proof -\n      have tmp1: \"get_sample_time Gain = 1\"\n        using Gain_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 1 = get_sample_time Gain * 1\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h 0) = h\"\n      using exeDisDiag_attime.simps(1)[of h 0] by simp\n    have 3: \"get_inputs Gain = ''x''\"\n      using Gain_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs Gain = ''y''\"\n      using Gain_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets Gain = [0]\"\n      using Gain_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd Gain = [\\<lambda>s. if length s = 1 then 2 * hd s else 0]\"\n      using Gain_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''x'' ''y'' [0] [\\<lambda>s. if length s = 1 then 2 * hd s else 0]\n         h 0 v t = h v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''x'' [] [] [] h 0 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 0 \\<and> vv = CHR ''y''\n       then if length (map (\\<lambda>a. h a (real 0 - real 0)) ''x'') = 1\n            then 2 * hd (map (\\<lambda>a. h a (real 0 - real 0)) ''x'') else 0\n       else h vv tt) v t = h v t\"\n        apply clarify subgoal for v t using h1_def h_def by (smt (verit, ccfv_SIG) One_nat_def \n              add.commute hd_map length_map list.sel(1) list.size(3) list.size(4) of_nat_0 \n              of_nat_1 plus_1_eq_Suc)\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''x''\" \"CHR ''y''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. if length s = 1 then 2 * hd s else 0\" \"[]\" h 0] using tmp1 tmp2 by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"Gain\" \"[]\" h1 0] using 1 2 3 4 5 6 7\n      by simp\n  qed\n  done\n\nlemma exe0_2: \"\\<forall>v. exeDisDiag_attime [UD1, Gain] h 0 v 0 = h v 0\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. 0 = get_sample_time UD1 * k)\"\n    proof -\n      have tmp1: \"get_sample_time UD1 = 1\"\n        using UD1_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"0 = get_sample_time UD1 * 0\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h 0) = h\"\n      using exeDisDiag_attime.simps(1)[of h 0] by simp\n    have 3: \"get_inputs UD1 = ''y''\"\n      using UD1_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs UD1 = ''s''\"\n      using UD1_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets UD1 = [0]\"\n      using UD1_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd UD1 = [\\<lambda>s. if length s = 1 then hd s else 0]\"\n      using UD1_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''y'' ''s'' [0] [\\<lambda>s. if length s = 1 then hd s else 0]\n         h 0 v t = h v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''y'' [] [] [] h 0 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 0 \\<and> vv = CHR ''s''\n       then if length (map (\\<lambda>a. h a (real 0 - real 0)) ''y'') = 1\n            then hd (map (\\<lambda>a. h a (real 0 - real 0)) ''y'') else 0\n       else h vv tt) v t = h v t\"\n        apply clarify subgoal for v t using h1_def h_def by (smt (verit, ccfv_SIG) One_nat_def \n              add.commute hd_map length_map list.sel(1) list.size(3) list.size(4) of_nat_0 \n              of_nat_1 plus_1_eq_Suc)\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''y''\" \"CHR ''s''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. if length s = 1 then hd s else 0\" \"[]\" \"h\"\n            0] using tmp1 tmp2 by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"UD1\" \"[Gain]\" h 0] using 1 2 3 4 5 6 7\n      exe0_1 by (smt (verit, best) hd_map int_ops(1) length_map list.distinct(1) \n          outupd_exe_atst.simps(1) outupd_exe_atst.simps(4))\n  qed\n  done\n\n\nlemma exe0_3: \"\\<forall>v. exeDisDiag_attime [UD2, UD1, Gain] h 0 v 0 = h v 0\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. int 0 = get_sample_time UD2 * k)\"\n    proof -\n      have tmp1: \"get_sample_time UD2 = 1\"\n        using UD2_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 1 = get_sample_time UD2 * 1\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h 0) = h\"\n      using exeDisDiag_attime.simps(1)[of h1 1] by simp\n    have 3: \"get_inputs UD2 = ''s''\"\n      using UD2_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs UD2 = ''z''\"\n      using UD2_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets UD2 = [1]\"\n      using UD2_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd UD2 = [\\<lambda>s. if length s = 1 then hd s else 0]\"\n      using UD2_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''s'' ''z'' [1] [\\<lambda>s. if length s = 1 then hd s else 0] \n      h 0 v t = h v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''s'' [] [] [] h 0 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 0 \\<and> vv = CHR ''z''\n       then if length (map (\\<lambda>a. h a (real 0 - real 1)) ''s'') = 1\n            then hd (map (\\<lambda>a. h a (real 0 - real 1)) ''s'') else 0\n       else h vv tt) v t = h v t\"\n        apply clarify subgoal for v t using h1_def h_def apply simp\n          using char.inject by presburger\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''s''\" \"CHR ''z''\" \"[]\" 1 \"[]\" \"\n        \\<lambda>s. if length s = 1 then hd s else 0\" \"[]\" h\n            0] using tmp1 tmp2 by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"UD2\" \"[UD1, Gain]\" h 0] using 1 2 3 4 5 6 7\n      exe0_2 by (smt (z3) One_nat_def exeDisDiag_attime_lemma2 hd_map length_map \n          list.distinct(1) outupd_exe_atst.simps(1) outupd_exe_atst.simps(4))\n  qed\n  done\n\nlemma exe0_4: \"exeDisDiag_attime [Bias, UD2, UD1, Gain] h 0 = h'\"\n  proof -\n    have 1: \"get_sample_time Bias = 0\"\n    proof -\n      show ?thesis unfolding Bias_def by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h 0) = h\"\n      using exeDisDiag_attime.simps(1)[of h1 1] by simp\n    have 3: \"get_inputs Bias = ''a''\"\n      using Bias_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs Bias = ''b''\"\n      using Bias_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets Bias = [0]\"\n      using Bias_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd Bias = [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\"\n      using Bias_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''a'' ''b'' [0] [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\n h 0 v t = h' v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''a'' [] [] [] h 0 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 0 \\<and> vv = CHR ''b''\n       then if length (map (\\<lambda>a. h a (real 0 - real 0)) ''a'') = 1\n            then hd (map (\\<lambda>a. h a (real 0 - real 0)) ''a'') + 2 else 0\n       else h vv tt) \n      v t = h' v t\"\n        apply clarify subgoal for v t using h'_def h_def apply simp\n          using char.inject by (smt (z3))\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''a''\" \"CHR ''b''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0)\" \"[]\" h 0] using tmp1 tmp2 by presburger\n    qed\n    have 8: \"(exeDisDiag_attime [UD2, UD1, Gain] h 0) = h\"\n    proof -\n      have tmp1: \"\\<forall>v t. (exeDisDiag_attime [UD2, UD1, Gain] h 0) v t = h v t\"\n        using exe0_3 exeDisDiag_attime_lemma2 by (metis of_nat_0)\n      show ?thesis using tmp1 by blast\n    qed\n    have 9: \"outupd_exe_atst ''a'' ''b'' [0] [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\n      h 0 = h'\"\n      using 7 by presburger\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"Bias\" \"[UD2, UD1, Gain]\" h1 1] \n      using 1 2 3 4 5 6 8 9 by auto\n  qed\n\nlemma exe1_1: \"\\<forall>v. exeDisDiag_attime [Gain] h1 (Suc 0) v 1 = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 1 then 4 else h1 v t)) v 1\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. int 1 = get_sample_time Gain * k)\"\n    proof -\n      have tmp1: \"get_sample_time Gain = 1\"\n        using Gain_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 1 = get_sample_time Gain * 1\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h1 1) = h1\"\n      using exeDisDiag_attime.simps(1)[of h1 1] by simp\n    have 3: \"get_inputs Gain = ''x''\"\n      using Gain_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs Gain = ''y''\"\n      using Gain_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets Gain = [0]\"\n      using Gain_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd Gain = [\\<lambda>s. if length s = 1 then 2 * hd s else 0]\"\n      using Gain_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''x'' ''y'' [0] [\\<lambda>s. if length s = 1 then 2 * hd s else 0]\n         h1 1 v t = (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 1 then 4 else h1 v t)) v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''x'' [] [] [] h 1 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 1 \\<and> vv = CHR ''y''\n       then if length (map (\\<lambda>a. h1 a (real 1 - real 0)) ''x'') = 1\n            then 2 * hd (map (\\<lambda>a. h1 a (real 1 - real 0)) ''x'') else 0\n       else h1 vv tt) v t = (\\<lambda>vv tt. (if vv = CHR ''y'' \\<and> tt = 1 then 4 else h1 vv tt)) v t\"\n        apply clarify subgoal for v t using h1_def h_def by (smt (verit, ccfv_SIG) One_nat_def \n              add.commute hd_map length_map list.sel(1) list.size(3) list.size(4) of_nat_0 \n              of_nat_1 plus_1_eq_Suc)\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''x''\" \"CHR ''y''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. if length s = 1 then 2 * hd s else 0\" \"[]\" h1 1] using tmp1 tmp2 by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"Gain\" \"[]\" h1 1] using 1 2 3 4 5 6 7\n      using One_nat_def by presburger\n  qed\n  done\n\nlemma exe1_2: \"\\<forall>v. exeDisDiag_attime [UD1, Gain] h1 (Suc 0) v 1 = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t))) v 1\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. int 1 = get_sample_time UD1 * k)\"\n    proof -\n      have tmp1: \"get_sample_time UD1 = 1\"\n        using UD1_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 1 = get_sample_time UD1 * 1\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h1 1) = h1\"\n      using exeDisDiag_attime.simps(1)[of h1 1] by simp\n    have 3: \"get_inputs UD1 = ''y''\"\n      using UD1_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs UD1 = ''s''\"\n      using UD1_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets UD1 = [0]\"\n      using UD1_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd UD1 = [\\<lambda>s. if length s = 1 then hd s else 0]\"\n      using UD1_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''y'' ''s'' [0] [\\<lambda>s. if length s = 1 then hd s else 0]\n         (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 1 then 4 else h1 v t)) 1 v t = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t))) v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''y'' [] [] [] h 1 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 1 \\<and> vv = CHR ''s''\n       then if length\n                (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 1 - real 0 = 1 then 4 else h1 a (real 1 - real 0))\n                  ''y'') = 1\n            then hd (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 1 - real 0 = 1 then 4\n                              else h1 a (real 1 - real 0))\n                      ''y'') else 0\n       else if vv = CHR ''y'' \\<and> tt = 1 then 4 else h1 vv tt) v t = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t))) v t\"\n        apply clarify subgoal for v t using h1_def h_def by (smt (verit, ccfv_SIG) One_nat_def \n              add.commute hd_map length_map list.sel(1) list.size(3) list.size(4) of_nat_0 \n              of_nat_1 plus_1_eq_Suc)\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''y''\" \"CHR ''s''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. if length s = 1 then hd s else 0\" \"[]\" \"(\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 1 then 4 else h1 v t))\"\n            1] using tmp1 tmp2 by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"UD1\" \"[Gain]\" h1 1] using 1 2 3 4 5 6 7\n      exe1_1 by simp\n  qed\n  done\n\n\nlemma exe1_3: \"\\<forall>v. exeDisDiag_attime [UD2, UD1, Gain] h1 (Suc 0) v 1 = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t))) v 1\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. int 1 = get_sample_time UD2 * k)\"\n    proof -\n      have tmp1: \"get_sample_time UD2 = 1\"\n        using UD2_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 1 = get_sample_time UD2 * 1\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h1 1) = h1\"\n      using exeDisDiag_attime.simps(1)[of h1 1] by simp\n    have 3: \"get_inputs UD2 = ''s''\"\n      using UD2_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs UD2 = ''z''\"\n      using UD2_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets UD2 = [1]\"\n      using UD2_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd UD2 = [\\<lambda>s. if length s = 1 then hd s else 0]\"\n      using UD2_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''s'' ''z'' [1] [\\<lambda>s. if length s = 1 then hd s else 0] (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t))) 1 v t \n= (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t))) v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''s'' [] [] [] h 1 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 1 \\<and> vv = CHR ''z''\n       then if length (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 1 - real 1 = 1 then 4\n                          else if a = CHR ''s'' \\<and> real 1 - real 1 = 1 then 4\n                               else h1 a (real 1 - real 1)) ''s'') = 1\n            then hd (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 1 - real 1 = 1 then 4\n                              else if a = CHR ''s'' \\<and> real 1 - real 1 = 1 then 4\n                                   else h1 a (real 1 - real 1)) ''s'') else 0\n       else if vv = CHR ''y'' \\<and> tt = 1 then 4 else if vv = CHR ''s'' \\<and> tt = 1 then 4 else h1 vv tt) v t = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t))) v t\"\n        apply clarify subgoal for v t using h1_def h_def apply simp\n          using char.inject by presburger\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''s''\" \"CHR ''z''\" \"[]\" 1 \"[]\" \"\n        \\<lambda>s. if length s = 1 then hd s else 0\" \"[]\" \"(\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 1 \n        then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t)))\"\n            1] using tmp1 tmp2 by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"UD2\" \"[UD1, Gain]\" h1 1] using 1 2 3 4 5 6 7\n      exe1_2 by (smt (z3) One_nat_def exeDisDiag_attime_lemma2 hd_map length_map \n          list.distinct(1) outupd_exe_atst.simps(1) outupd_exe_atst.simps(4))\n  qed\n  done\n\nlemma exe1_4: \"exeDisDiag_attime [Bias, UD2, UD1, Gain] h1 (Suc 0) = h2\"\n  proof -\n    have 1: \"get_sample_time Bias = 0\"\n    proof -\n      show ?thesis unfolding Bias_def by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h1 1) = h1\"\n      using exeDisDiag_attime.simps(1)[of h1 1] by simp\n    have 3: \"get_inputs Bias = ''a''\"\n      using Bias_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs Bias = ''b''\"\n      using Bias_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets Bias = [0]\"\n      using Bias_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd Bias = [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\"\n      using Bias_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''a'' ''b'' [0] [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\n (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t))) 1 v t \n= h2 v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''a'' [] [] [] h 1 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n         if tt = real 1 \\<and> vv = CHR ''b''\n         then if length\n                  (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 1 - real 0 = 1 then 4\n                            else if a = CHR ''s'' \\<and> real 1 - real 0 = 1 then 4\n                                 else h1 a (real 1 - real 0))\n                    ''a'') = 1\n              then hd (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 1 - real 0 = 1 then 4\n                                else if a = CHR ''s'' \\<and> real 1 - real 0 = 1 then 4\n                                     else h1 a (real 1 - real 0))\n                        ''a'') + 2\n              else 0\n         else if vv = CHR ''y'' \\<and> tt = 1 then 4\n              else if vv = CHR ''s'' \\<and> tt = 1 then 4 else h1 vv tt) \n      v t = h2 v t\"\n        apply clarify subgoal for v t using h2_def h1_def h_def apply simp\n          using char.inject by (smt (z3))\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''a''\" \"CHR ''b''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0)\" \"[]\" \"(\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 1 \n        then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t)))\"\n            1] using tmp1 tmp2 by presburger\n    qed\n    have 8: \"(exeDisDiag_attime [UD2, UD1, Gain] h1 1) = \n    (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t)))\"\n      using exe1_3 exeDisDiag_attime_lemma2 by (metis \n          (no_types, opaque_lifting) One_nat_def of_nat_1)\n    have 9: \"outupd_exe_atst ''a'' ''b'' [0] [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\n (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 1 then 4 else (if v = CHR ''s'' \\<and> t = 1 then 4 else h1 v t))) 1 = h2\"\n      using 7 by presburger\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"Bias\" \"[UD2, UD1, Gain]\" h1 1] \n      using 1 2 3 4 5 6 8 9 by auto\n  qed\n\nlemma exe_diag_interval1: \"ODE_cond (Block ''za'' ''ax'' [1, 1] 0\n   (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n     (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n           (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n     ''z'')) h' 0 1 \\<Longrightarrow>\n  exe_diag_interval [Gain, UD1, UD2] [Integ1, Bias, Integ2] h' 0 1 = h2\"\n  subgoal premises pre\n  proof -\n    have 0: \"\\<exists>L. unique_on_bounded_closed 0 {0--1} Vec0 \n  (\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0))) UNIV L\"\n      using pre(1) unfolding ODE_cond_def using get_Vec0 getODE'_2 by auto\n  have 1: \"(\\<lambda>vv tt. if 0 < tt \\<and> tt < 0 + 1 \\<and> vv \\<in> Outputs [Gain, UD1, UD2] then h' vv 0 else h' vv tt) = h'\"\n  proof -\n    have tmp1: \"Outputs [Gain, UD1, UD2] = {CHR ''y'', CHR ''s'', CHR ''z''}\"\n      unfolding Gain_def UD1_def UD2_def Outputs.simps by auto\n    have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n        if 0 < tt \\<and> tt < 0 + 1 \\<and> vv \\<in> Outputs [Gain, UD1, UD2]\n        then if 0 = 0 \\<and> vv = CHR ''b'' then 2 else 0\n        else if tt = 0 \\<and> vv = CHR ''b'' then 2 else 0) v t=\n    (\\<lambda>v t. if t = 0 \\<and> v = CHR ''b'' then 2 else 0) v t\"\n      using tmp1 by simp\n    show ?thesis unfolding h'_def h_def using tmp2 by blast\n  qed\n  have 2: \"exeContinuousDiag_interval [Integ1, Bias, Integ2] h' 0 1 = h1\"\n  proof -\n    have tmp1: \"findIntegBlks [Integ1, Bias, Integ2] = [Integ1, Integ2]\"\n      unfolding findIntegBlks.simps Integ1_def Bias_def Integ2_def by auto\n    have tmp2: \"(block2ODE (updateIntegBlks [Integ1, Bias, Integ2] \n    (findIntegBlks [Integ1, Bias, Integ2]))) = (\\<lambda>t v. (\\<chi> x. (if x = CHR ''x'' then v $ CHR ''a'' + 2 else if \n      x = CHR ''a'' then v $ CHR ''z'' else 0)))\"\n      using updateIntegBlks_lemma getODE'_2 tmp1 by auto\n    have tmp3: \"(state2vec (timedVar2State h' 0)) = Vec0\"\n      unfolding timedVar2State_def h'_def h_def Vec0_def state2vec_def by simp\n    have tmp4: \"\\<forall>t \\<in> {0 -- 1}. (apply_bcontfun\n         (unique_on_bounded_closed.fixed_point 0 {0--0 + 1} (state2vec (timedVar2State h' 0))\n           (block2ODE\n             (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n           UNIV)) t = (\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else \n            if y = CHR ''b'' then 2 else 0) t \"\n      using tmp2 tmp3 solves1_fixedpoint 0 by auto\n    have tmp5: \"(get_outputs (updateIntegBlks [Integ1, Bias, Integ2] \n      (findIntegBlks [Integ1, Bias, Integ2]))) = ''ax''\"\n      using updateIntegBlks_lemma tmp1 by simp\n    have tmp6: \"\\<forall>tt. tt > (0::real) \\<and> tt \\<le> (1::real) \\<longrightarrow> tt \\<in> {0::real -- 1::real}\"\n      unfolding closed_segment_def by force\n    have tmp7: \"\\<forall>vv tt . updTimedVar\n       (apply_bcontfun\n         (unique_on_bounded_closed.fixed_point 0 {0--0 + 1} (state2vec (timedVar2State h' 0))\n           (block2ODE\n             (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n           UNIV)) ''ax'' h' 0 1 vv tt  = \n        (\\<lambda>v t. (if v = CHR ''x'' \\<and> t \\<ge> 0 \\<and> t \\<le> 1 then 2*t else h' v t)) vv tt\"\n      apply clarify subgoal for vv tt \n      proof(cases \"vv \\<in> set ''ax'' \\<and> tt > (0::real) \\<and> tt \\<le> (1::real)\")\n        case True\n        have tmp1: \"tt \\<in> {0::real -- 1::real}\"\n          using True tmp6 by simp\n        then show ?thesis using True updTimedVar_eq2[of \"''ax''\" 0 1\n              \"(\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else \n            if y = CHR ''b'' then 2 else 0)\" h'] tmp4 unfolding h'_def h_def by auto\n      next\n        case False\n        have tmp1: \"vv \\<notin> set ''ax'' \\<or> tt \\<le> 0 \\<or> 1 < tt\"\n          using False by auto\n        have tmp2: \"updTimedVar\n     (apply_bcontfun\n       (unique_on_bounded_closed.fixed_point 0 {0--0 + 1} (state2vec (timedVar2State h' 0))\n         (block2ODE\n           (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n         UNIV))\n     ''ax'' h' 0 1 (CHR ''x'') 0 = 0\"\n          using updTimedVar_eq1 unfolding h'_def h_def using tmp1 by force\n        then show ?thesis\n        proof(cases \"tt = 0 \\<and> vv = CHR ''x''\")\n          case True\n          then show ?thesis using tmp2 by auto\n        next\n          case False\n          note F1 = False\n          have tmp: \"\\<not>(vv = CHR ''x'' \\<and> 0 \\<le> tt \\<and> tt \\<le> 1)\"\n            using False tmp1 by force\n          then show ?thesis\n          proof (cases \"tt = 0 \\<and> vv = CHR ''b''\")\n            case True\n            then show ?thesis unfolding h'_def h_def by (smt (verit, ccfv_SIG) tmp updTimedVar_eq1)\n          next\n            case False\n            then show ?thesis using tmp1 F1 False unfolding h'_def h_def\n              by (smt (verit, ccfv_SIG) tmp updTimedVar_eq1)\n          qed\n        qed\n      qed\n      done\n    have tmp8: \"updTimedVar\n       (apply_bcontfun\n         (unique_on_bounded_closed.fixed_point 0 {0--0 + 1} (state2vec (timedVar2State h' 0))\n           (block2ODE\n             (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n           UNIV)) ''ax'' h' 0 1  = \n        (\\<lambda>v t. (if v = CHR ''x'' \\<and> t \\<ge> 0 \\<and> t \\<le> 1 then 2*t else h' v t))\"\n      using tmp7 by presburger\n    have tmp9: \"getCalBlks [Integ1, Bias, Integ2] = [Bias]\"\n      unfolding getCalBlks.simps Integ1_def Bias_def Integ2_def by auto\n    have tmp10: \"exeCalBlks [Bias] (\\<lambda>v t. if v = CHR ''x'' \\<and> 0 \\<le> t \\<and> t \\<le> 1 \n    then 2 * t else h' v t) 0 1 = h1\"\n    proof -\n      have tmp: \"\\<forall>v t. (\\<lambda>v t. if v = CHR ''b'' \\<and> 0 < t \\<and> t < 1 then 2\n         else if v = CHR ''x'' \\<and> 0 \\<le> t \\<and> t \\<le> 1 then 2 * t else h' v t) v t = h1 v t\"\n        unfolding h1_def h'_def h_def by simp\n      show ?thesis using exe1_0 unfolding h1_def h'_def h_def using tmp using less_numeral_extra(3)\n          linorder_not_le order.asym order_less_irrefl order_less_le real_scaleR_def \n          zero_neq_numeral by fastforce\n    qed\n    show ?thesis unfolding exeContinuousDiag_interval.simps solveODE_def using tmp5 tmp8 tmp9 tmp10 by auto\n  qed\n  have 3: \"(rev (sortDiag ([Gain, UD1, UD2] @ getCalBlks [Integ1, Bias, Integ2]))) =\n    [Bias, UD2, UD1, Gain]\"\n  proof -\n    have tmp1: \"getCalBlks [Integ1, Bias, Integ2] = [Bias]\"\n      unfolding getCalBlks.simps Integ1_def Bias_def Integ2_def by simp\n    show ?thesis using sort_lemma tmp1 by auto\n  qed\n  show ?thesis unfolding exe_diag_interval.simps using 1 2 3 exe1_4 by auto\nqed\n  done\n\nvalue \"(\\<lambda>vv tt.\n       if tt = real 2 \\<and> vv = CHR ''y''\n       then if length (map (\\<lambda>a. h3 a (real 2 - real 0)) ''x'') = 1\n            then 2 * hd (map (\\<lambda>a. h3 a (real 2 - real 0)) ''x'') else 0\n       else h3 vv tt) (CHR ''y'') (real 2)\"\n\nlemma exe2_0: \"exeCalBlks [Bias] (\\<lambda>v t. (if v = CHR ''x'' \\<and> t > 1 \n        \\<and> t \\<le> 2 then 2*t else h2' v t)) 1 1 = h3\"\nproof -\n  have 1: \"\\<forall>tt. length (map (\\<lambda>a. if a = CHR ''x'' \\<and> 1 < tt \\<and> tt \\<le> 2 then 2 * tt \n  else h2' a tt) ''a'') = 1\"\n    by auto\n  have 2: \"\\<forall>tt. hd (map (\\<lambda>a. if a = CHR ''x'' \\<and> 1 < tt \\<and> tt \\<le> 2 then 2 * tt else h2' a tt)\n                       ''a'') = (0::real)\"\n    unfolding h2'_def h2_def h1_def h_def by auto\n  have 3: \"\\<forall>v t. (\\<lambda>vv tt.\n        if vv = CHR ''b'' \\<and> tt < 2 \\<and> 1 < tt\n        then if length\n                 (map (\\<lambda>a. if a = CHR ''x'' \\<and> 1 < tt \\<and> tt \\<le> 2 then 2 * tt else h2' a tt) ''a'') =\n                Suc 0\n             then hd (map (\\<lambda>a. if a = CHR ''x'' \\<and> 1 < tt \\<and> tt \\<le> 2 then 2 * tt else h2' a tt)\n                       ''a'') + 2 else 0\n        else if vv = CHR ''x'' \\<and> 1 < tt \\<and> tt \\<le> 2 then 2 * tt else h2' vv tt) v t = h3 v t\"\n    apply clarify subgoal for v t \n    proof(cases \"v = CHR ''b'' \\<and> t < 2 \\<and> 1 < t\")\n      case True\n      have tmp1: \"h3 v t = 2\"\n        using True unfolding h3_def h2'_def h2_def by auto\n      have tmp2: \"length (map (\\<lambda>a. if a = CHR ''x'' \\<and> 1 < t \\<and> t \\<le> 2 then 2 * t else h2' a t) ''a'') = 1\"\n        using 1 by auto\n      have tmp3: \"(if v = CHR ''b'' \\<and> t < 2 \\<and> 1 < t\n          then if length (map (\\<lambda>a. if a = CHR ''x'' \\<and> 1 < t \\<and> t \\<le> 2 then 2 * t else h2' a t) ''a'') =\n             Suc 0\n          then hd (map (\\<lambda>a. if a = CHR ''x'' \\<and> 1 < t \\<and> t \\<le> 2 then 2 * t else h2' a t) ''a'') + 2\n          else 0\n          else if v = CHR ''x'' \\<and> 1 < t \\<and> t \\<le> 2 then 2 * t else h2' v t) = 2\"\n        using True tmp2 2 by auto\n      then show ?thesis using tmp1 tmp2 tmp3 by auto\n    next\n      case False\n      note F1 = False\n      then show ?thesis unfolding h3_def by (smt (z3) char.inject h1_def h2'_def h2_def)\n    qed\n    done\n  show ?thesis unfolding exeCalBlks.simps Bias_def h_def apply simp using 3 by simp\nqed\n\nlemma exe2_1: \"\\<forall>v. exeDisDiag_attime [Gain] h3 (Suc 1) v 2 = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 2 then 8 else h3 v t)) v 2\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. int 2 = get_sample_time Gain * k)\"\n    proof -\n      have tmp1: \"get_sample_time Gain = 1\"\n        using Gain_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 2 = get_sample_time Gain * 2\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h3 2) = h3\"\n      using exeDisDiag_attime.simps(1)[of h3 2] by simp\n    have 3: \"get_inputs Gain = ''x''\"\n      using Gain_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs Gain = ''y''\"\n      using Gain_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets Gain = [0]\"\n      using Gain_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd Gain = [\\<lambda>s. if length s = 1 then 2 * hd s else 0]\"\n      using Gain_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''x'' ''y'' [0] [\\<lambda>s. if length s = 1 then 2 * hd s else 0]\n         h3 2 v t = (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 2 then 8 else h3 v t)) v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''x'' [] [] [] h 1 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 2 \\<and> vv = CHR ''y''\n       then if length (map (\\<lambda>a. h3 a (real 2 - real 0)) ''x'') = 1\n            then 2 * hd (map (\\<lambda>a. h3 a (real 2 - real 0)) ''x'') else 0\n       else h3 vv tt) v t = (\\<lambda>vv tt. (if vv = CHR ''y'' \\<and> tt = 2 then 8 else h3 vv tt)) v t\"\n        apply clarify subgoal for v t\n        proof(cases \"v = CHR ''y'' \\<and> t = real 2\")\n          case True\n          then show ?thesis unfolding h3_def h2_def h1_def h_def by force\n        next\n          case False\n          then show ?thesis by auto\n        qed\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''x''\" \"CHR ''y''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. if length s = 1 then 2 * hd s else 0\" \"[]\" h3 2] using tmp1 tmp2\n        using outupd_exe_atst.simps(1) by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"Gain\" \"[]\" h3 2] using 1 2 3 4 5 6 7\n      using One_nat_def Suc_1 by presburger\n  qed\n  done\n\nlemma exe2_2: \"\\<forall>v. exeDisDiag_attime [UD1, Gain] h3 (Suc 1) v 2 = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else h3 v t))) v 2\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. int 2 = get_sample_time UD1 * k)\"\n    proof -\n      have tmp1: \"get_sample_time UD1 = 1\"\n        using UD1_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 2 = get_sample_time UD1 * 2\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h3 2) = h3\"\n      using exeDisDiag_attime.simps(1)[of h3 2] by simp\n    have 3: \"get_inputs UD1 = ''y''\"\n      using UD1_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs UD1 = ''s''\"\n      using UD1_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets UD1 = [0]\"\n      using UD1_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd UD1 = [\\<lambda>s. if length s = 1 then hd s else 0]\"\n      using UD1_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''y'' ''s'' [0] [\\<lambda>s. if length s = 1 then hd s else 0]\n         (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 2 then 8 else h3 v t)) 2 v t = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else h3 v t))) v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''y'' [] [] [] h 2 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 2 \\<and> vv = CHR ''s''\n       then if length\n                (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 2 - real 0 = 2 then 8 else h3 a (real 2 - real 0))\n                  ''y'') = 1\n            then hd (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 2 - real 0 = 2 then 8\n                              else h3 a (real 2 - real 0))\n                      ''y'') else 0\n       else if vv = CHR ''y'' \\<and> tt = 2 then 8 else h3 vv tt) v t = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else h3 v t))) v t\"\n        apply clarify subgoal for v t using h3_def h2_def h1_def h_def by simp\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''y''\" \"CHR ''s''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. if length s = 1 then hd s else 0\" \"[]\" \"(\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 2 then 8 else h3 v t))\"\n            2] using tmp1 tmp2 by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"UD1\" \"[Gain]\" h3 2] using 1 2 3 4 5 6 7\n      exe2_1 by simp\n  qed\n  done\n\nlemma exe2_3: \"\\<forall>v. exeDisDiag_attime [UD2, UD1, Gain] h3 2 v 2 = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else \nif v = CHR ''z'' \\<and> t = 2 then 4 else h3 v t))) v 2\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. int 2 = get_sample_time UD2 * k)\"\n    proof -\n      have tmp1: \"get_sample_time UD2 = 1\"\n        using UD2_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 2 = get_sample_time UD2 * 2\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h3 2) = h3\"\n      using exeDisDiag_attime.simps(1)[of h3 2] by simp\n    have 3: \"get_inputs UD2 = ''s''\"\n      using UD2_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs UD2 = ''z''\"\n      using UD2_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets UD2 = [1]\"\n      using UD2_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd UD2 = [\\<lambda>s. if length s = 1 then hd s else 0]\"\n      using UD2_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''s'' ''z'' [1] [\\<lambda>s. if length s = 1 then hd s else 0] (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else h3 v t))) 2 v t \n= (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else \nif v = CHR ''z'' \\<and> t = 2 then 4 else h3 v t))) v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''s'' [] [] [] h 2 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 2 \\<and> vv = CHR ''z''\n       then if length\n                (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 2 - real 1 = 2 then 8\n                          else if a = CHR ''s'' \\<and> real 2 - real 1 = 2 then 8\n                               else h3 a (real 2 - real 1))\n                  ''s'') =\n               1\n            then hd (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 2 - real 1 = 2 then 8\n                              else if a = CHR ''s'' \\<and> real 2 - real 1 = 2 then 8\n                                   else h3 a (real 2 - real 1))\n                      ''s'')\n            else 0\nelse if vv = CHR ''y'' \\<and> tt = 2 then 8 else if vv = CHR ''s'' \\<and> tt = 2 then 8 else h3 vv tt) v t = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else \nif v = CHR ''z'' \\<and> t = 2 then 4 else h3 v t))) v t\"\n        apply clarify subgoal for v t using h3_def h2'_def h2_def h1_def h_def apply simp\n          using char.inject by presburger\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''s''\" \"CHR ''z''\" \"[]\" 1 \"[]\" \"\n        \\<lambda>s. if length s = 1 then hd s else 0\" \"[]\" \"(\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 2 \n        then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else h3 v t)))\"\n            2] using tmp1 tmp2 by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"UD2\" \"[UD1, Gain]\" h3 2] using 1 2 3 4 5 6 7\n      exe2_2 by (smt (z3) Suc_1 exeDisDiag_attime_lemma2 hd_map length_map \n          list.distinct(1) outupd_exe_atst.simps(1) outupd_exe_atst.simps(4))\n  qed\n  done\n\nlemma exe2_4: \"exeDisDiag_attime [Bias, UD2, UD1, Gain] h3 2 = h4\"\n  proof -\n    have 1: \"get_sample_time Bias = 0\"\n    proof -\n      show ?thesis unfolding Bias_def by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h3 2) = h3\"\n      using exeDisDiag_attime.simps(1)[of h3 2] by simp\n    have 3: \"get_inputs Bias = ''a''\"\n      using Bias_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs Bias = ''b''\"\n      using Bias_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets Bias = [0]\"\n      using Bias_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd Bias = [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\"\n      using Bias_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''a'' ''b'' [0] [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\n (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else \nif v = CHR ''z'' \\<and> t = 2 then 4 else h3 v t))) 2 v t \n= h4 v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''a'' [] [] [] h 2 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 2 \\<and> vv = CHR ''b''\n       then if length\n                (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 2 - real 0 = 2 then 8\n                          else if a = CHR ''s'' \\<and> real 2 - real 0 = 2 then 8\n                               else if a = CHR ''z'' \\<and> real 2 - real 0 = 2 then 4\n                                    else h3 a (real 2 - real 0))\n                  ''a'') =\n               1\n            then hd (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 2 - real 0 = 2 then 8\n                              else if a = CHR ''s'' \\<and> real 2 - real 0 = 2 then 8\n                                   else if a = CHR ''z'' \\<and> real 2 - real 0 = 2 then 4\n                                        else h3 a (real 2 - real 0))\n                      ''a'') +\n                 2\n            else 0\n       else if vv = CHR ''y'' \\<and> tt = 2 then 8\n            else if vv = CHR ''s'' \\<and> tt = 2 then 8\n                 else if vv = CHR ''z'' \\<and> tt = 2 then 4 else h3 vv tt) \n      v t = h4 v t\"\n        apply clarify subgoal for v t using h4_def h3_def h2'_def h2_def h1_def h_def apply simp\n          using char.inject by (smt (z3))\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''a''\" \"CHR ''b''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0)\" \"[]\" \"(\\<lambda>v t. (if v = CHR ''y'' \n        \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else \n        if v = CHR ''z'' \\<and> t = 2 then 4 else h3 v t)))\" 2] using tmp1 tmp2 by presburger\n    qed\n    have 8: \"exeDisDiag_attime [UD2, UD1, Gain] h3 2 = \n    (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else \n      if v = CHR ''z'' \\<and> t = 2 then 4 else h3 v t)))\"\n    proof -\n      have tmp1: \"\\<forall>v t. exeDisDiag_attime [UD2, UD1, Gain] h3 2 v t = \n      (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else \n      if v = CHR ''z'' \\<and> t = 2 then 4 else h3 v t))) v t\"\n        apply clarify subgoal for v t\n        proof(cases \"t = real 2\")\n          case True\n          then show ?thesis using exe2_3 by auto\n        next\n          case False\n          then show ?thesis using exeDisDiag_attime_lemma2[of t 2 \"[UD2, UD1, Gain]\" h3 v]\n            by auto\n        qed\n        done\n      show ?thesis using tmp1 by presburger\n    qed\n    have 9: \"outupd_exe_atst ''a'' ''b'' [0] [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\n (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 2 then 8 else (if v = CHR ''s'' \\<and> t = 2 then 8 else \n    if v = CHR ''z'' \\<and> t = 2 then 4 else h3 v t))) 2 = h4\"\n      using 7 by presburger\n    have 10: \"outupd_exe_atst (get_inputs Bias) (get_outputs Bias) (get_offsets Bias) (get_outupd Bias)\n         (exeDisDiag_attime [UD2, UD1, Gain] h3 2) 2 = h4\"\n      using 1 2 3 4 5 6 8 9 by auto\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"Bias\" \"[UD2, UD1, Gain]\" h3 2] \n      using 1 10 by auto\n  qed\n\nlemma exe_diag_interval2: \"ODE_cond (Block ''za'' ''ax'' [1, 1] 0\n   (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n     (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n           (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n     ''z'')) h2 1 1 \\<Longrightarrow>\n  exe_diag_interval [Gain, UD1, UD2] [Integ1, Bias, Integ2] h2 1 1 = h4\"\n  subgoal premises pre\n  proof -\n    have 0: \"\\<exists>L. unique_on_bounded_closed 1 {1--2} Vec1 \n  (\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0))) UNIV L\"\n      using pre unfolding ODE_cond_def using get_Vec1 getODE'_2 by auto\n  have 1: \"(\\<lambda>vv tt. if 1 < tt \\<and> tt < 1 + 1 \\<and> vv \\<in> Outputs [Gain, UD1, UD2] then h2 vv 1 else h2 \n  vv tt) = h2'\"\n  proof -\n    have tmp1: \"Outputs [Gain, UD1, UD2] = {CHR ''y'', CHR ''s'', CHR ''z''}\"\n      unfolding Gain_def UD1_def UD2_def Outputs.simps by auto\n    have tmp2: \"\\<forall>v t. (\\<lambda>vv tt. if 1 < tt \\<and> tt < 1 + 1 \\<and> vv \\<in> Outputs [Gain, UD1, UD2] then h2 vv 1 else h2 \n  vv tt) v t = h2' v t\"\n      apply clarify subgoal for v t\n      proof(cases \"1 < t \\<and> t < 2 \\<and> v = CHR ''y''\")\n        case True\n        then show ?thesis using tmp1 unfolding h2'_def h2_def h1_def h_def by auto\n      next\n        case False\n        then show ?thesis using tmp1 unfolding h2'_def h2_def h1_def h_def by auto\n      qed\n      done\n    show ?thesis using tmp2 by presburger\n  qed\n  have 2: \"exeContinuousDiag_interval [Integ1, Bias, Integ2] h2' 1 1 = h3\"\n  proof -\n    have tmp1: \"findIntegBlks [Integ1, Bias, Integ2] = [Integ1, Integ2]\"\n      unfolding findIntegBlks.simps Integ1_def Bias_def Integ2_def by auto\n    have tmp2: \"(block2ODE (updateIntegBlks [Integ1, Bias, Integ2] \n    (findIntegBlks [Integ1, Bias, Integ2]))) = (\\<lambda>t v. (\\<chi> x. (if x = CHR ''x'' then v $ CHR ''a'' + 2 else if \n      x = CHR ''a'' then v $ CHR ''z'' else 0)))\"\n      using updateIntegBlks_lemma getODE'_2 tmp1 by auto\n    have tmp3: \"(state2vec (timedVar2State h2' 1)) = Vec1\"\n      unfolding timedVar2State_def h2'_def h2_def h1_def h_def Vec1_def state2vec_def by fastforce\n    have tmp4: \"\\<forall>t \\<in> {1 -- 2}. (apply_bcontfun\n         (unique_on_bounded_closed.fixed_point 1 {1--1 + 1} (state2vec (timedVar2State h2' 1))\n           (block2ODE\n             (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n           UNIV)) t = (\\<lambda>x. \\<chi> y. if y = CHR ''x'' then 2 * x else if y = CHR ''b'' then 2 \n      else if y = CHR ''y'' then 4 else if y = CHR ''s'' then 4 else 0) t \"\n      using tmp2 tmp3 solves2_fixedpoint 0 by simp\n    have tmp5: \"(get_outputs (updateIntegBlks [Integ1, Bias, Integ2] \n      (findIntegBlks [Integ1, Bias, Integ2]))) = ''ax''\"\n      using updateIntegBlks_lemma tmp1 by simp\n    have tmp7: \"\\<forall>vv tt . updTimedVar\n       (apply_bcontfun\n         (unique_on_bounded_closed.fixed_point 1 {1--1 + 1} (state2vec (timedVar2State h2' 1))\n           (block2ODE\n             (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n           UNIV)) ''ax'' h2' 1 1 vv tt  = \n        (\\<lambda>v t. (if v = CHR ''x'' \\<and> t > 1 \\<and> t \\<le> 2 then 2*t else h2' v t)) vv tt\"\n      apply clarify subgoal for vv tt \n      proof(cases \"vv \\<in> set ''ax'' \\<and> tt > (1::real) \\<and> tt \\<le> (2::real)\")\n        case True\n        have tmp1: \"tt \\<in> {1::real -- 2::real}\"\n          using True by (simp add: Line_Segment.closed_segment_eq_real_ivl)\n        then show ?thesis using True updTimedVar_eq2 tmp4 unfolding h2'_def h2_def h1_def h_def\n          using char.inject empty_iff set_ConsD set_empty vec_lambda_beta by auto\n      next\n        case False\n        have tmp1: \"vv \\<notin> set ''ax'' \\<or> tt \\<le> 1 \\<or> 2 < tt\"\n          using False by auto\n        have tmp2: \"updTimedVar\n     (apply_bcontfun\n       (unique_on_bounded_closed.fixed_point 1 {1--1 + 1} (state2vec (timedVar2State h2' 1))\n         (block2ODE\n           (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n         UNIV))\n     ''ax'' h2' 1 1 vv tt = h2' vv tt\"\n          using updTimedVar_eq1[of \"''ax''\" 1 1 ] using tmp1 by fastforce\n        then show ?thesis\n        proof(cases \"tt = 1 \\<and> vv = CHR ''x''\")\n          case True\n          then show ?thesis using tmp2 by auto\n        next\n          case False\n          have tmp: \"\\<not>(vv = CHR ''x'' \\<and> 1 \\<le> tt \\<and> tt \\<le> 2)\"\n            using False tmp1 by force\n          then show ?thesis using tmp2 unfolding h_def by auto\n        qed\n      qed\n      done\n    have tmp8: \"updTimedVar\n       (apply_bcontfun\n         (unique_on_bounded_closed.fixed_point 1 {1--1 + 1} (state2vec (timedVar2State h2' 1))\n           (block2ODE\n             (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n           UNIV)) ''ax'' h2' 1 1  = (\\<lambda>v t. (if v = CHR ''x'' \\<and> t > 1 \\<and> t \\<le> 2 then 2*t else h2' v t))\"\n      using tmp7 by presburger\n    have tmp9: \"getCalBlks [Integ1, Bias, Integ2] = [Bias]\"\n      unfolding getCalBlks.simps Integ1_def Bias_def Integ2_def by auto\n    have tmp10: \"exeCalBlks [Bias] (\\<lambda>v t. (if v = CHR ''x'' \\<and> t > 1 \n        \\<and> t \\<le> 2 then 2*t else h2' v t)) 1 1 = h3\"\n      using exe2_0 by simp\n    show ?thesis unfolding exeContinuousDiag_interval.simps solveODE_def using tmp5 tmp8 tmp9 tmp10 by simp\n  qed\n  have 3: \"(rev (sortDiag ([Gain, UD1, UD2] @ getCalBlks [Integ1, Bias, Integ2]))) =\n    [Bias, UD2, UD1, Gain]\"\n  proof -\n    have tmp1: \"getCalBlks [Integ1, Bias, Integ2] = [Bias]\"\n      unfolding getCalBlks.simps Integ1_def Bias_def Integ2_def by simp\n    show ?thesis using sort_lemma tmp1 by auto\n  qed\n  show ?thesis unfolding exe_diag_interval.simps using 1 2 3 exe2_4 by auto\nqed\n  done\n\ndefinition h5:: timed_vars where \"h5 = (\\<lambda>v t. (if v = CHR ''a'' \\<and> t > 2 \\<and> t \\<le> 3 then 4*(t-2) \nelse (if v = CHR ''x'' \\<and> t > 2 \\<and> t \\<le> 3 then 2*t*t - 6*t + 8 else h4' v t)))\"\n\ndefinition h6:: timed_vars where \"h6 = (\\<lambda>v t. (if v = CHR ''b'' \\<and> t > 2 \\<and> t < 3 then 4*(t-2)+2 \nelse h5 v t ))\"\n\nlemma exe3_continuous : \"exeCalBlks [Bias] h5 2 1 = h6\"\nproof -\n  have 1: \"(exeCalBlks [] h5 2 1) = h5\"\n    by simp\n  have 2: \"get_inputs Bias = ''a''\"\n    using Bias_def get_inputs.simps by (metis (no_types, lifting))\n  have 3: \"get_outputs Bias = ''b''\"\n    using Bias_def get_outputs.simps by (metis (no_types, lifting))\n  have 4: \"get_offsets Bias = [0]\"\n    using Bias_def get_offsets.simps by (metis (no_types, lifting))\n  have 5: \"get_outupd Bias = [\\<lambda>s. if length s = 1 then hd s + 2 else 0]\"\n    using Bias_def get_outupd.simps by (metis (no_types, lifting))\n  have 6: \"exeCalBlk ''a'' ''b'' [0] [\\<lambda>s. if length s = 1 then hd s + 2 else 0]\n   h5 2 1 = h6\"\n  proof -\n    have tmp1: \"\\<forall>h. exeCalBlk ''a'' [] [] [] h 2 1 = h\"\n      by simp\n    have tmp2: \"\\<forall>t::real. t \\<ge> 2 \\<and> t < 3 \\<longrightarrow> (h5 (CHR ''a'') t + 2) = 4*(t-2)+2\"\n      apply clarify subgoal for t\n        unfolding h5_def h4'_def h4_def h3_def h2'_def h2_def h1_def h_def by simp\n      done\n    have tmp3: \"\\<forall>t::real. t \\<ge> 2 \\<and> t < 3 \\<longrightarrow> hd (map (\\<lambda>a. h5 a t) ''a'') + 2 = (h5 (CHR ''a'') t + 2)\"\n      using tmp2 by simp\n    have tmp4: \"\\<forall>v t. (\\<lambda>vv tt.\n             if vv = CHR ''b'' \\<and> tt < 2 + 1 \\<and> 2 < tt\n             then if length (map (\\<lambda>a. h5 a tt) ''a'') = 1 then hd (map (\\<lambda>a. h5 a tt) ''a'') + 2\n                  else 0\n             else h5 vv tt) v t = h6 v t\"\n      apply clarify subgoal for v t\n    proof(cases \"v = CHR ''b'' \\<and> t < 2 + 1 \\<and> 2 < t\")\n      case True\n      then show ?thesis using tmp2 tmp3 by (simp add: h6_def)\n    next\n      case False\n      then show ?thesis apply simp unfolding h6_def by auto\n    qed\n    done\n    show ?thesis using exeCalBlk.simps(4)[of \"''a''\" \"CHR ''b''\" \"[]\" 0 \"[]\"\n          \"\\<lambda>s. if length s = 1 then hd s + 2 else 0\" \"[]\" h5 2 1] tmp4 by force\n  qed\n  show ?thesis using exeCalBlks.simps(2)[of \"Bias\" \"[]\" h5 2 3]\n    using \"1\" \"2\" \"3\" \"4\" \"5\" \"6\" by auto\nqed\n\nlemma exe3_1: \"\\<forall>v. exeDisDiag_attime [Bias] h6 (Suc 2) v 3 = (\\<lambda>v t. \n(if v = CHR ''b'' \\<and> t = 3 then 6 else h6 v t)) v 3\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(get_sample_time Bias = 0)\"\n    proof -\n      show ?thesis using Bias_def get_sample_time.simps by (metis (no_types, lifting))\n    qed\n    have 2: \"(exeDisDiag_attime [] h6 3) = h6\"\n      using exeDisDiag_attime.simps(1)[of h6 3] by simp\n    have 3: \"get_inputs Bias = ''a''\"\n      using Bias_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs Bias = ''b''\"\n      using Bias_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets Bias = [0]\"\n      using Bias_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd Bias = [\\<lambda>s. if length s = 1 then hd s + 2 else 0]\"\n      using Bias_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''a'' ''b'' [0] [\\<lambda>s. if length s = 1 then hd s + 2 else 0]\n         h6 3 v t = (\\<lambda>v t. (if v = CHR ''b'' \\<and> t = 3 then 6 else h6 v t)) v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''a'' [] [] [] h 3 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 3 \\<and> vv = CHR ''b''\n       then if length (map (\\<lambda>a. h6 a (real 3 - real 0)) ''a'') = 1\n            then hd (map (\\<lambda>a. h6 a (real 3 - real 0)) ''a'') + 2 else 0\n       else h6 vv tt) v t = (\\<lambda>vv tt. (if vv = CHR ''b'' \\<and> tt = 3 then 6 else h6 vv tt)) v t\"\n        apply clarify subgoal for v t\n        proof(cases \"v = CHR ''b'' \\<and> t = real 3\")\n          case True\n          then show ?thesis unfolding h6_def h5_def h4_def h3_def h2_def h1_def h_def by force\n        next\n          case False\n          then show ?thesis by auto\n        qed\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''a''\" \"CHR ''b''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. if length s = 1 then hd s + 2 else 0\" \"[]\" h6 3] using tmp1 tmp2\n        using outupd_exe_atst.simps(1) by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"Bias\" \"[]\" h6 3] using 1 2 3 4 5 6 7\n      using One_nat_def Suc_1 by (metis numeral_3_eq_3)\n  qed\n  done\n\nlemma exe3_2: \"\\<forall>v. exeDisDiag_attime [Gain] h6 (Suc 2) v 3 = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else h6 v t)) v 3\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. int 3 = get_sample_time Gain * k)\"\n    proof -\n      have tmp1: \"get_sample_time Gain = 1\"\n        using Gain_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 3 = get_sample_time Gain * 3\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h6 3) = h6\"\n      using exeDisDiag_attime.simps(1)[of h6 3] by simp\n    have 3: \"get_inputs Gain = ''x''\"\n      using Gain_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs Gain = ''y''\"\n      using Gain_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets Gain = [0]\"\n      using Gain_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd Gain = [\\<lambda>s. if length s = 1 then 2 * hd s else 0]\"\n      using Gain_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''x'' ''y'' [0] [\\<lambda>s. if length s = 1 then 2 * hd s else 0]\n         h6 3 v t = (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 3 then 16 else h6 v t)) v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''x'' [] [] [] h 3 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 3 \\<and> vv = CHR ''y''\n       then if length (map (\\<lambda>a. h6 a (real 3 - real 0)) ''x'') = 1\n            then 2 * hd (map (\\<lambda>a. h6 a (real 3 - real 0)) ''x'') else 0\n       else h6 vv tt) v t = (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 3 then 16 else h6 v t)) v t\"\n        apply clarify subgoal for v t\n        proof(cases \"v = CHR ''y'' \\<and> t = real 3\")\n          case True\n          then show ?thesis unfolding h6_def h5_def h4_def h3_def h2_def h1_def h_def by auto\n        next\n          case False\n          then show ?thesis using of_nat_numeral by auto\n        qed\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''x''\" \"CHR ''y''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. if length s = 1 then 2 * hd s else 0\" \"[]\" \"h6\" 3] using tmp1 tmp2 \n          using outupd_exe_atst.simps(1) by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"Gain\" \"[]\" h6 3] using 1 2 3 4 5 6 7\n      by simp\n  qed\n  done\n\nlemma exe3_3: \"\\<forall>v. exeDisDiag_attime [UD1, Gain] h6 3 v 3 = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else h6 v t)) v 3\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. int 3 = get_sample_time UD1 * k)\"\n    proof -\n      have tmp1: \"get_sample_time UD1 = 1\"\n        using UD1_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 3 = get_sample_time UD1 * 3\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h6 3) = h6\"\n      using exeDisDiag_attime.simps(1)[of h6 3] by simp\n    have 3: \"get_inputs UD1 = ''y''\"\n      using UD1_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs UD1 = ''s''\"\n      using UD1_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets UD1 = [0]\"\n      using UD1_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd UD1 = [\\<lambda>s. if length s = 1 then hd s else 0]\"\n      using UD1_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''y'' ''s'' [0] [\\<lambda>s. if length s = 1 then hd s else 0]\n         (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 3 then 16 else h6 v t)) 3 v t = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else h6 v t)) v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''y'' [] [] [] h 3 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 3 \\<and> vv = CHR ''s''\n       then if length\n                (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 3 - real 0 = 3 then 16\n                          else h6 a (real 3 - real 0))\n                  ''y'') =\n               1\n            then hd (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 3 - real 0 = 3 then 16\n                              else h6 a (real 3 - real 0))\n                      ''y'')\n            else 0\n       else if vv = CHR ''y'' \\<and> tt = 3 then 16 else h6 vv tt) v t = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else h6 v t)) v t\"\n        apply clarify subgoal for v t by simp\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''y''\" \"CHR ''s''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. if length s = 1 then hd s else 0\" \"[]\" \"(\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 3 then 16 else \n          h6 v t))\" 3] using tmp1 tmp2 by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"UD1\" \"[Gain]\" h3 2] using 1 2 3 4 5 6 7\n      exe3_2 by simp\n  qed\n  done\n\nlemma exe3_4: \"\\<forall>v. exeDisDiag_attime [UD2, UD1, Gain] h6 (Suc 2) v 3 = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else\n if v = CHR ''z'' \\<and> t = 3 then 8 else h6 v t)) v 3\"\n  apply clarify subgoal for v\n  proof -\n    have 1: \"(\\<exists>k. int 3 = get_sample_time UD2 * k)\"\n    proof -\n      have tmp1: \"get_sample_time UD2 = 1\"\n        using UD2_def get_sample_time.simps by (metis (no_types, lifting))\n      have tmp2: \"int 3 = get_sample_time UD2 * 3\"\n        using tmp1 by simp\n      show ?thesis using tmp2 by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h6 3) = h6\"\n      using exeDisDiag_attime.simps(1)[of h6 3] by simp\n    have 3: \"get_inputs UD2 = ''s''\"\n      using UD2_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs UD2 = ''z''\"\n      using UD2_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets UD2 = [1]\"\n      using UD2_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd UD2 = [\\<lambda>s. if length s = 1 then hd s else 0]\"\n      using UD2_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''s'' ''z'' [1] [\\<lambda>s. if length s = 1 then hd s else 0] (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else\nh6 v t)) 3 v t = (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 \nthen 16 else if v = CHR ''z'' \\<and> t = 3 then 8 else h6 v t)) v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''s'' [] [] [] h 3 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 3 \\<and> vv = CHR ''z''\n       then if length\n                (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 3 - real 1 = 3 then 16\n                          else if a = CHR ''s'' \\<and> real 3 - real 1 = 3 then 16\n                               else h6 a (real 3 - real 1))\n                  ''s'') =\n               1\n            then hd (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 3 - real 1 = 3 then 16\n                              else if a = CHR ''s'' \\<and> real 3 - real 1 = 3 then 16\n                                   else h6 a (real 3 - real 1))\n                      ''s'')\n            else 0\n       else if vv = CHR ''y'' \\<and> tt = 3 then 16\n            else if vv = CHR ''s'' \\<and> tt = 3 then 16 else h6 vv tt) v t = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else\nif v = CHR ''z'' \\<and> t = 3 then 8 else h6 v t)) v t\"\n        apply clarify subgoal for v t unfolding h4'_def h4_def h5_def h6_def by simp\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''s''\" \"CHR ''z''\" \"[]\" 1 \"[]\" \"\n        \\<lambda>s. if length s = 1 then hd s else 0\" \"[]\" \"(\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else h6 v t))\"\n            3] using tmp1 tmp2 by presburger\n    qed\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"UD2\" \"[UD1, Gain]\" h6 3] using 1 2 3 4 5 6 7\n      exe3_3 by (smt (z3) One_nat_def Suc_1 char.inject exeDisDiag_attime_lemma2 hd_map \n     length_map list.distinct(1) numeral_3_eq_3 outupd_exe_atst.simps(1) outupd_exe_atst.simps(4))\n  qed\n  done\n\ndefinition h7::timed_vars where \"h7 = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else\nif v = CHR ''b'' \\<and> t = 3 then 6 else if v = CHR ''z'' \\<and> t = 3 then 8 else h6 v t))\"\n\nlemma exe3_5: \"exeDisDiag_attime [Bias, UD2, UD1, Gain] h6 3 = h7\"\n  proof -\n    have 1: \"get_sample_time Bias = 0\"\n    proof -\n      show ?thesis unfolding Bias_def by simp\n    qed\n    have 2: \"(exeDisDiag_attime [] h6 3) = h6\"\n      using exeDisDiag_attime.simps(1)[of h6 3] by simp\n    have 3: \"get_inputs Bias = ''a''\"\n      using Bias_def get_inputs.simps by (metis (no_types, lifting))\n    have 4: \"get_outputs Bias = ''b''\"\n      using Bias_def get_outputs.simps by (metis (no_types, lifting))\n    have 5: \"get_offsets Bias = [0]\"\n      using Bias_def get_offsets.simps by (metis (no_types, lifting))\n    have 6: \"get_outupd Bias = [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\"\n      using Bias_def get_outupd.simps by (metis (no_types, lifting))\n    have 7: \"\\<forall>v t. outupd_exe_atst ''a'' ''b'' [0] [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\n (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else\n if v = CHR ''z'' \\<and> t = 3 then 8 else h6 v t)) 3 v t \n= h7 v t\"\n    proof -\n      have tmp1: \"\\<forall>h. outupd_exe_atst ''a'' [] [] [] h 3 = h\"\n        by auto\n      have tmp2: \"\\<forall>v t. (\\<lambda>vv tt.\n       if tt = real 3 \\<and> vv = CHR ''b''\n       then if length\n                (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 3 - real 0 = 3 then 16\n                          else if a = CHR ''s'' \\<and> real 3 - real 0 = 3 then 16\n                               else if a = CHR ''z'' \\<and> real 3 - real 0 = 3 then 8\n                                    else h6 a (real 3 - real 0))\n                  ''a'') =\n               1\n            then hd (map (\\<lambda>a. if a = CHR ''y'' \\<and> real 3 - real 0 = 3 then 16\n                              else if a = CHR ''s'' \\<and> real 3 - real 0 = 3 then 16\n                                   else if a = CHR ''z'' \\<and> real 3 - real 0 = 3 then 8\n                                        else h6 a (real 3 - real 0))\n                      ''a'') +\n                 2\n            else 0\n       else if vv = CHR ''y'' \\<and> tt = 3 then 16\n            else if vv = CHR ''s'' \\<and> tt = 3 then 16\n                 else if vv = CHR ''z'' \\<and> tt = 3 then 8 else h6 vv tt) \n      v t = h7 v t\"\n        apply clarify subgoal for v t unfolding h7_def h6_def h5_def \n            h4_def h3_def h2'_def h2_def h1_def h_def by simp\n        done\n      show ?thesis using outupd_exe_atst.simps(4)[of \"''a''\" \"CHR ''b''\" \"[]\" 0 \"[]\" \"\n        \\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0)\" \"[]\" \"(\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else\n if v = CHR ''z'' \\<and> t = 3 then 8 else h6 v t))\" 3] using tmp1 tmp2 by presburger\n    qed\n    have 8: \"exeDisDiag_attime [UD2, UD1, Gain] h6 (Suc 2) = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else\n if v = CHR ''z'' \\<and> t = 3 then 8 else h6 v t))\"\n    proof -\n      have tmp1: \"\\<forall>v t. exeDisDiag_attime [UD2, UD1, Gain] h6 (Suc 2) v t = (\\<lambda>v t. \n(if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else\n if v = CHR ''z'' \\<and> t = 3 then 8 else h6 v t)) v t\"\n        apply clarify subgoal for v t\n        proof(cases \"t = real 3\")\n          case True\n          then show ?thesis using exe3_4 by auto\n        next\n          case False\n          then show ?thesis using exeDisDiag_attime_lemma2[of t 3 \"[UD2, UD1, Gain]\" h6 v]\n            by auto\n        qed\n        done\n      show ?thesis using tmp1 by presburger\n    qed\n    have 9: \"outupd_exe_atst ''a'' ''b'' [0] [(\\<lambda>s. (if length s = 1 then (hd s + 2::real) else 0))]\n (\\<lambda>v t. (if v = CHR ''y'' \\<and> t = 3 then 16 else if v = CHR ''s'' \\<and> t = 3 then 16 else\n if v = CHR ''z'' \\<and> t = 3 then 8 else h6 v t)) 3 = h7\"\n      using 7 by presburger\n    have 10: \"outupd_exe_atst (get_inputs Bias) (get_outputs Bias) (get_offsets Bias) (get_outupd Bias)\n         (exeDisDiag_attime [UD2, UD1, Gain] h6 3) 3 = h7\"\n      using 1 2 3 4 5 6 8 9 by auto\n    show ?thesis using exeDisDiag_attime.simps(2)[of \"Bias\" \"[UD2, UD1, Gain]\" h6 3] \n      using 1 10 by auto\n  qed\n\n  term \"ODE_cond\"\n\nlemma exe_diag_interval3: \"ODE_cond (Block ''za'' ''ax'' [1, 1] 0\n   (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n     (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n           (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n     ''z'')) h4 2 1 \\<Longrightarrow>\n  exe_diag_interval [Gain, UD1, UD2] [Integ1, Bias, Integ2] h4 2 1 = h7\"\n  subgoal premises pre\n  proof -\n    have 0: \"\\<exists>L. unique_on_bounded_closed 2 {2--3} Vec2\n  (\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0))) UNIV L\"\n    proof -\n      have tmp1: \"(block2ODE\n         (Block ''za'' ''ax'' [1, 1] 0\n           (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n             (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b'' (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a'')) ''z'')))\n        = (\\<lambda>t v. (\\<chi> x.(if x = CHR ''x'' then v $ CHR ''a'' + 2 else \n  if x = CHR ''a'' then v $ CHR ''z'' else 0)))\"\n        using getODE'_2 by force\n      show ?thesis using pre(1) unfolding ODE_cond_def  using tmp1 getVec2 by auto\n    qed\n  have 1: \"(\\<lambda>vv tt. if 2 < tt \\<and> tt < 2 + 1 \\<and> vv \\<in> Outputs [Gain, UD1, UD2] then h4 vv 2 else h4 \n  vv tt) = h4'\"\n  proof -\n    have tmp1: \"Outputs [Gain, UD1, UD2] = {CHR ''y'', CHR ''s'', CHR ''z''}\"\n      unfolding Gain_def UD1_def UD2_def Outputs.simps by auto\n    have tmp2: \"\\<forall>v t. (\\<lambda>vv tt. if 2 < tt \\<and> tt < 2 + 1 \\<and> vv \\<in> Outputs [Gain, UD1, UD2] then h4 vv 2 else h4 \n  vv tt) v t = h4' v t\"\n      apply clarify subgoal for v t\n      proof(cases \"2 < t \\<and> t < 3 \\<and> v = CHR ''y''\")\n        case True\n        then show ?thesis using tmp1 unfolding h4'_def h4_def h2'_def h2_def h1_def h_def by auto\n      next\n        case False\n        then show ?thesis using tmp1 unfolding h4'_def h4_def h3_def h2'_def h2_def h1_def h_def by auto\n      qed\n      done\n    show ?thesis using tmp2 by presburger\n  qed\n  have 2: \"exeContinuousDiag_interval [Integ1, Bias, Integ2] h4' 2 1 = h6\"\n  proof -\n    have tmp1: \"findIntegBlks [Integ1, Bias, Integ2] = [Integ1, Integ2]\"\n      unfolding findIntegBlks.simps Integ1_def Bias_def Integ2_def by auto\n    have tmp2: \"(block2ODE (updateIntegBlks [Integ1, Bias, Integ2] \n    (findIntegBlks [Integ1, Bias, Integ2]))) = (\\<lambda>t v. (\\<chi> x. (if x = CHR ''x'' then v $ CHR ''a'' + 2 else if \n      x = CHR ''a'' then v $ CHR ''z'' else 0)))\"\n      using updateIntegBlks_lemma getODE'_2 tmp1 by auto\n    have tmp3: \"(state2vec (timedVar2State h4' 2)) = Vec2\"\n      unfolding timedVar2State_def h4'_def h4_def h3_def\n       h2'_def h2_def h1_def h_def Vec2_def state2vec_def by fastforce\n    have tmp4: \"\\<forall>t \\<in> {2 -- 3}. (apply_bcontfun\n         (unique_on_bounded_closed.fixed_point 2 {2--2 + 1} (state2vec (timedVar2State h4' 2))\n           (block2ODE\n             (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n           UNIV)) t = (\\<lambda>x. (\\<chi> y.(if y = CHR ''x'' then 2*x*x - 6*x + 8\n  else if y = CHR ''b'' then 2 else if\n  y = CHR ''z'' then 4 else if y = CHR ''a'' then 4*(x-2) \n  else if y = CHR ''y'' then 8 else if y = CHR ''s'' then 8 else 0))) t \"\n      using tmp2 tmp3 solves3_fixedpoint 0 by simp\n    have tmp5: \"(get_outputs (updateIntegBlks [Integ1, Bias, Integ2] \n      (findIntegBlks [Integ1, Bias, Integ2]))) = ''ax''\"\n      using updateIntegBlks_lemma tmp1 by simp\n    have tmp7: \"\\<forall>vv tt . updTimedVar\n       (apply_bcontfun\n         (unique_on_bounded_closed.fixed_point 2 {2--2 + 1} (state2vec (timedVar2State h4' 2))\n           (block2ODE\n             (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n           UNIV)) ''ax'' h4' 2 1 vv tt  = h5 vv tt\"\n      apply clarify subgoal for vv tt \n      proof(cases \"vv \\<in> set ''ax'' \\<and> tt > (2::real) \\<and> tt \\<le> (3::real)\")\n        case True\n        have tmp1: \"tt \\<in> {2::real -- 3::real}\"\n          using True by (simp add: Line_Segment.closed_segment_eq_real_ivl)\n        then show ?thesis using True updTimedVar_eq2 tmp4 unfolding h5_def apply simp\n          by fastforce\n      next\n        case False\n        have tmp1: \"vv \\<notin> set ''ax'' \\<or> tt \\<le> 2 \\<or> 3 < tt\"\n          using False by auto\n        have tmp2: \"updTimedVar\n     (apply_bcontfun\n       (unique_on_bounded_closed.fixed_point 2 {2--2 + 1} (state2vec (timedVar2State h4' 2))\n         (block2ODE\n           (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n         UNIV))\n     ''ax'' h4' 2 1 vv tt = h5 vv tt\"\n          unfolding h5_def using updTimedVar_eq1[of \"''ax''\" 2 1 ] using tmp1 by fastforce\n        then show ?thesis\n        proof(cases \"tt = 2 \\<and> vv = CHR ''x''\")\n          case True\n          then show ?thesis using tmp2 by auto\n        next\n          case False\n          have tmp: \"\\<not>(vv = CHR ''x'' \\<and> 2 \\<le> tt \\<and> tt \\<le> 3)\"\n            using False tmp1 by force\n          then show ?thesis using tmp2 unfolding h_def by auto\n        qed\n      qed\n      done\n    have tmp8: \"updTimedVar\n       (apply_bcontfun\n         (unique_on_bounded_closed.fixed_point 2 {2--2 + 1} (state2vec (timedVar2State h4' 2))\n           (block2ODE\n             (updateIntegBlks [Integ1, Bias, Integ2] (findIntegBlks [Integ1, Bias, Integ2])))\n           UNIV)) ''ax'' h4' 2 1  = h5\"\n      using tmp7 by presburger\n    have tmp9: \"getCalBlks [Integ1, Bias, Integ2] = [Bias]\"\n      unfolding getCalBlks.simps Integ1_def Bias_def Integ2_def by auto\n    have tmp10: \"exeCalBlks [Bias] h5 2 1 = h6\"\n      using exe3_continuous by simp\n    show ?thesis unfolding exeContinuousDiag_interval.simps solveODE_def using tmp5 tmp8 tmp9 tmp10 by simp\n  qed\n  have 3: \"(rev (sortDiag ([Gain, UD1, UD2] @ getCalBlks [Integ1, Bias, Integ2]))) =\n    [Bias, UD2, UD1, Gain]\"\n  proof -\n    have tmp1: \"getCalBlks [Integ1, Bias, Integ2] = [Bias]\"\n      unfolding getCalBlks.simps Integ1_def Bias_def Integ2_def by simp\n    show ?thesis using sort_lemma tmp1 by auto\n  qed\n  show ?thesis unfolding exe_diag_interval.simps using 1 2 3 exe3_5 by auto\nqed\n  done\n\nlemma exe_diag: \"ODE_cond (Block ''za'' ''ax'' [1, 1] 0\n   (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n     (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n           (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n     ''z'')) h' 0 1 \\<Longrightarrow> ODE_cond (Block ''za'' ''ax'' [1, 1] 0\n   (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n     (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n           (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n     ''z'')) h2 1 1 \\<Longrightarrow> ODE_cond (Block ''za'' ''ax'' [1, 1] 0\n   (updateFunc2 [\\<lambda>s. if length s = 1 then hd s else 0] ''a''\n     (hd (updateFunc [\\<lambda>s. if length s = 1 then hd s else 0] ''b'' CHR ''b''\n           (\\<lambda>s. if length s = 1 then hd s + 2 else 0) ''a''))\n     ''z'')) h4 2 1 \\<Longrightarrow> exe_diag_tilltime [Gain,UD1,UD2] [Integ1,Bias,Integ2] h 3 = h7\"\n  subgoal premises pre\nproof -\n  have 0: \"getCalBlks [Integ1, Bias, Integ2] = [Bias]\"\n    unfolding getCalBlks.simps Integ1_def Bias_def Integ2_def by simp\n  have 1: \"exe_diag_tilltime [Gain,UD1,UD2] [Integ1,Bias,Integ2] h 0 = h'\"\n    unfolding exe_diag_tilltime.simps DisBlks_init.simps using sort_lemma 0 exe0_4 by simp\n  have 2: \"exe_diag_interval [Gain,UD1,UD2] [Integ1,Bias,Integ2] h' 0 1 = h2\"\n    using exe_diag_interval1 pre(1) by simp\n  have 3: \"exe_diag_interval [Gain,UD1,UD2] [Integ1,Bias,Integ2] h2 1 1 = h4\"\n    using exe_diag_interval2 pre(2) by simp\n  have 4: \"exe_diag_interval [Gain,UD1,UD2] [Integ1,Bias,Integ2] h4 2 1 = h7\"\n    using exe_diag_interval3 pre(3) by simp\n  have 5: \"3 = Suc (Suc (Suc 0))\"\n    by simp\n  have 6: \"exe_diag_tilltime [Gain,UD1,UD2] [Integ1,Bias,Integ2] h (Suc (Suc (Suc 0))) = h7\"\n    unfolding exe_diag_tilltime.simps using 1 2 3 4 by (metis (mono_tags, opaque_lifting)  \n        exe_diag_tilltime.simps(1) numeral_1_eq_Suc_0 numeral_2_eq_2 numeral_eq_one_iff \n        of_nat_0_eq_iff of_nat_numeral)\n  show ?thesis using 5 6 by presburger\nqed\n  done\n    \n\nend", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/Semantics_Simulink/Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878414043814, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3339086050242717}}
{"text": "header {* Execution rules for groups *}\n\ntheory KPL_execution_group imports \n  KPL_execution_thread\nbegin\n\ntext {* Intra-group race detection *}\ndefinition group_race \n  :: \"lid set \\<Rightarrow> (lid \\<rightharpoonup> thread_state) \\<Rightarrow> bool\"\nwhere \"group_race T \\<gamma> \\<equiv> \n  \\<exists>j \\<in> T. \\<exists>k \\<in> T. j \\<noteq> k \\<and> \n  W (the (\\<gamma> j)) \\<inter> (R (the (\\<gamma> k)) \\<union> W (the (\\<gamma> k))) \\<noteq> {}\"\n\ntext {* The constraints for the @{term \"merge\"} map *}\ninductive pre_merge \n  :: \"lid set \\<Rightarrow> (lid \\<rightharpoonup> thread_state) \\<Rightarrow> nat \\<Rightarrow> word \\<Rightarrow> bool\"\nwhere \n  \"\\<lbrakk> j \\<in> T ; z \\<in> W (the (\\<gamma> j)) ; dom \\<gamma> = T \\<rbrakk> \\<Longrightarrow>\n  pre_merge T \\<gamma> z (sh (the (\\<gamma> j)) z)\"\n| \"\\<lbrakk> \\<forall>j \\<in> T. z \\<notin> W (the (\\<gamma> j)) ; dom \\<gamma> = T \\<rbrakk> \\<Longrightarrow> \n  pre_merge T \\<gamma> z (sh (the (\\<gamma> 0)) z)\"\n\ninductive_cases pre_merge_inv [elim!]: \"pre_merge P \\<gamma> z z'\"\n\ntext {* The @{term \"merge\"} map maps each nat to the word that \n   satisfies the above constaints. The @{text \"merge_is_unique\"}\n   lemma shows that there exists exactly one such word \n   per nat, provided there are no group races. *}\ndefinition merge :: \"lid set \\<Rightarrow> (lid \\<rightharpoonup> thread_state) \\<Rightarrow> nat \\<Rightarrow> word\"\nwhere \"merge T \\<gamma> \\<equiv> \\<lambda>z. The (pre_merge T \\<gamma> z)\"\n\nlemma no_races_imp_no_write_overlap: \n  \"\\<not> (group_race T \\<gamma>) \\<Longrightarrow> \n  \\<forall>i \\<in> T. \\<forall>j \\<in> T. \n  i \\<noteq> j \\<longrightarrow> W (the (\\<gamma> i)) \\<inter> W (the (\\<gamma> j)) = {}\"\nunfolding group_race_def \nby blast\n\nlemma merge_is_unique:\n  assumes \"dom \\<gamma> = T\"\n  assumes \"\\<not> (group_race T \\<gamma>)\"\n  shows \"\\<exists>!z'. pre_merge T \\<gamma> z z'\"\napply (insert assms)\napply (drule no_races_imp_no_write_overlap)\napply (intro allI ex_ex1I)\napply (metis pre_merge.intros)\napply clarify\nproof -\n  fix z1 z2\n  assume a: \"\\<forall>i\\<in>dom \\<gamma>. \\<forall>j\\<in>dom \\<gamma>. i \\<noteq> j \\<longrightarrow> W (the (\\<gamma> i)) \\<inter> W (the (\\<gamma> j)) = {}\"\n  assume \"pre_merge (dom \\<gamma>) \\<gamma> z z1\" \n  and \"pre_merge (dom \\<gamma>) \\<gamma> z z2\"\n  thus \"z1 = z2\"\n  apply (elim pre_merge_inv)\n  apply (rename_tac j1 j2)\n  apply (case_tac \"j1 = j2\")\n  apply auto[1]\n  apply simp\n  apply (subgoal_tac \"W (the (\\<gamma> j1)) \\<inter> W (the (\\<gamma> j2)) = {}\")\n  apply auto[1]\n  apply (auto simp add: a)\n  done\nqed\n \ntext {* The rules of Figure 5, plus an additional rule for\n  equality abstraction (Fig 7a), plus an additional rule for\n  adversarial abstraction (Fig 7b)  *}\ninductive step_g\n  :: \"abs_level \\<Rightarrow> gid \\<Rightarrow> (gid \\<rightharpoonup> lid set) \\<Rightarrow> (group_state \\<times> pred_stmt) \\<Rightarrow> group_state option \\<Rightarrow> bool\"\nwhere\n  G_Race:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). step_t a (the (\\<gamma> \\<^sub>t\\<^sub>s j), (s, p)) (the (\\<gamma>' \\<^sub>t\\<^sub>s j)) ; \n    group_race (the (T i)) ((\\<gamma>' :: group_state)\\<^sub>t\\<^sub>s) \\<rbrakk>\n  \\<Longrightarrow> step_g a i T (\\<gamma>, (Basic s, p)) None\"\n| G_Basic:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). step_t a (the (\\<gamma> \\<^sub>t\\<^sub>s j), (s, p)) (the (\\<gamma>' \\<^sub>t\\<^sub>s j)) ; \n    \\<not> (group_race (the (T i)) (\\<gamma>' \\<^sub>t\\<^sub>s)) ;\n    R_group \\<gamma>' = R_group \\<gamma> \\<union> (\\<Union>j \\<in> the (T i). ({j} \\<times> R (the (\\<gamma>' \\<^sub>t\\<^sub>s j)))) ;\n    W_group \\<gamma>' = W_group \\<gamma> \\<union> (\\<Union>j \\<in> the (T i). ({j} \\<times> W (the (\\<gamma>' \\<^sub>t\\<^sub>s j)))) \\<rbrakk>\n  \\<Longrightarrow> step_g a i T (\\<gamma>, (Basic s, p)) (Some \\<gamma>')\"\n| G_No_Op:\n  \"\\<forall>j \\<in> the (T i). \\<not> (eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j)))\n  \\<Longrightarrow> step_g a i T (\\<gamma>, (Barrier, p)) (Some \\<gamma>)\"\n| G_Divergence:\n  \"\\<lbrakk> j \\<noteq> k ; j \\<in> the (T i) ; k \\<in> the (T i) ;\n   eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j)) ; \\<not> (eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s k))) \\<rbrakk>\n  \\<Longrightarrow> step_g a i T (\\<gamma>, (Barrier, p)) None\"\n| G_Sync:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j)) ;\n    \\<forall>j \\<in> the (T i). the (\\<gamma>' \\<^sub>t\\<^sub>s j) = (the (\\<gamma> \\<^sub>t\\<^sub>s j)) (| \n    sh := merge P (\\<gamma> \\<^sub>t\\<^sub>s), R := {}, W := {} |) \\<rbrakk> \n  \\<Longrightarrow> step_g No_Abst i T (\\<gamma>, (Barrier, p)) (Some \\<gamma>')\"\n| G_Sync_Eq:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j)) ;\n    \\<forall>j \\<in> the (T i). the (\\<gamma>' \\<^sub>t\\<^sub>s j) = (the (\\<gamma> \\<^sub>t\\<^sub>s j)) (| \n    sh := sh', R := {}, W := {} |) \\<rbrakk> \n  \\<Longrightarrow> step_g Eq_Abst i T (\\<gamma>, (Barrier, p)) (Some \\<gamma>')\"\n| G_Sync_Adv:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j)) ;\n    \\<forall>j \\<in> the (T i). \\<exists>sh'. the (\\<gamma>' \\<^sub>t\\<^sub>s j) = (the (\\<gamma> \\<^sub>t\\<^sub>s j)) (| \n    sh := sh', R := {}, W := {} |) \\<rbrakk> \n  \\<Longrightarrow> step_g Adv_Abst i T (\\<gamma>, (Barrier, p)) (Some \\<gamma>')\"\n\ntext {* Rephrasing @{text G_No_Op} to make it more usable *}\nlemma G_No_Op_helper:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). \\<not> (eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j))) ; \\<gamma> = \\<gamma>' \\<rbrakk>\n  \\<Longrightarrow> step_g a i T (\\<gamma>, (Barrier, p)) (Some \\<gamma>')\"\nby (simp add: step_g.G_No_Op)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/GPU_Kernel_PL/KPL_execution_group.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056167854461, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.33388591275113305}}
{"text": "theory Seq_Atomic\nimports Seq_Obs\nbegin\n\ndatatype labels = Pgm | Env \n\n\nlocale seq_atomic = test_seq + \n  fixes step :: \"labels \\<Rightarrow> ('b \\<times> 'b) \\<Rightarrow> 'a\"\n  assumes step_test: \"range (step l) \\<inter> range test = {}\"\n  assumes step_last: \"x \\<le> step l (a,b) \\<Longrightarrow> last x \\<le> test b\"\n  assumes test_step: \"test a ; step l (a, b) \\<ge>  step l (a, b)\"\n  assumes first_step': \"first (step l (a, b); x) \\<ge> test a\"\n  assumes last_step': \"last (step l (a,b)) \\<ge> test b\"\n  assumes test_step': \" step l (a, b); test b \\<ge>  step l (a, b)\"\n  assumes bot_not_step: \"\\<bottom> \\<notin> range (step l)\"\n  assumes step_le: \"step l s \\<ge> (step l' s' ; x) \\<Longrightarrow> l = l' \\<and> s = s'\"\n  assumes step_meet_seq: \"\\<And>a b.  a \\<le> step l s \\<Longrightarrow> b \\<le> step l' s' \\<Longrightarrow>  x \\<le> a ; c \\<Longrightarrow> x \\<le> b ; d \\<Longrightarrow> \n                                  \\<exists>y y'. y \\<le> a \\<and> y \\<le> b \\<and> y' \\<le> c \\<and> y' \\<le> d \\<and> x \\<le> y ; y'\" \n  assumes ref_tail: \"step l s ; c \\<ge> step l s ; d \\<Longrightarrow> (test (snd s) ; c) \\<ge> (test (snd s) ; d)\" \n  assumes step_atomic: \"x \\<le> step l (a, b)  \\<Longrightarrow>\n      ((x \\<le> \\<bottom>) \\<or> ((x \\<le> step l (a, b) ; \\<bottom>) \\<and> (x \\<ge>  step l (a, b) ; \\<bottom>) ) \\<or> (x \\<ge> step l (a, b)))\"\nbegin\n\n\n\nlemma last_step: \"last (step l (a,b)) \\<le> test b\"\n  apply (subst unit_of_unit)\n  using test_step' by blast\n\nlemma step_first: \"x \\<le> step l (a, b) \\<Longrightarrow> first x \\<le> test a\"\n  by (metis first_le first_step order_trans unit_of_apply)\n\nlemma first_stepD: \"first (step l (a, b) ; x) \\<ge> test a' \\<Longrightarrow> a = a'\"\n  by (metis dual_order.trans first_step test_le)\n  \nlemma  step_meet: \"x \\<le> step l (a, b) \\<Longrightarrow> x \\<le> step l' (c, d) \\<Longrightarrow> x \\<le> \\<bottom> \\<or> (c = a \\<and> d = b)\"\n  apply (case_tac \"x \\<le> \\<bottom>\"; clarsimp)\n  apply (case_tac \"c = a\"; clarsimp?)\n   defer\n   apply (frule step_first)\n   apply (frule step_first) back\n  apply (metis bot_annihilate_seq dual_order.trans flip.unit_of_apply mono_f test_atom test_le)\n  apply (subgoal_tac \"last x \\<le> test b \\<and> last x \\<le> test d\")\n   apply (clarsimp)\n   apply (subst (asm) unit_of_unit)\n   apply (subst (asm) unit_of_unit)\n   apply (frule (3) step_meet_seq) back\n   apply (clarsimp)\n  apply (case_tac \"y' = \\<bottom>\")\n    apply (smt (verit, del_insts) Pair_inject le_test order_trans step_atomic step_le)\n  \n   apply (smt (verit, del_insts) Pair_inject le_test order_trans preorder_bot_class.bot_least step_atomic step_le)\n  using step_last by blast\n\nlemma  step_meet': \"x \\<le> step l (a, b) \\<Longrightarrow> x \\<le> step l' (c, d) \\<Longrightarrow> x \\<le> \\<bottom> \\<or> (c = a \\<and> d = b \\<and> l = l')\"\n  apply (case_tac \"x \\<le> \\<bottom>\"; clarsimp)\n  apply (case_tac \"c = a\"; clarsimp?)\n   defer\n   apply (frule step_first)\n   apply (frule step_first) back\n  apply (metis bot_annihilate_seq dual_order.trans flip.unit_of_apply mono_f test_atom test_le)\n  apply (subgoal_tac \"last x \\<le> test b \\<and> last x \\<le> test d\")\n   apply (clarsimp)\n   apply (subst (asm) unit_of_unit)\n   apply (subst (asm) unit_of_unit)\n   apply (frule (3) step_meet_seq) back\n   apply (clarsimp)\n  apply (case_tac \"y' = \\<bottom>\")\n    apply (smt (verit, del_insts) Pair_inject le_test order_trans step_atomic step_le)\n  \n   apply (smt (verit, del_insts) Pair_inject le_test order_trans preorder_bot_class.bot_least step_atomic step_le)\n  using step_last by blast\n\n\nlemma step_le_first: \"step l (a, b) \\<le> step l' (x, y) \\<Longrightarrow> a = x\"\n  apply (frule first_le)\n  by (metis dual_order.trans le_test prod.inject seq_atomic.step_le seq_atomic_axioms)\n\n\nlemma step_le_last: \"step l (a,b) \\<le> step l' (x,y) \\<Longrightarrow> b = y\"\n  apply (drule step_last)\n  by (meson last_step' order_trans test_le)\n\n\nlemma step_not_bot [simp]: \" step l (a, b) \\<notin> \\<down> \\<bottom>\"\n  apply (clarsimp simp: in_down_iff)\n  by (metis dual_order.trans labels.distinct(1) le_test preorder_bot_class.bot_least step_le)\n  \nlift_definition datomic :: \"(labels \\<times> 'b \\<times> 'b) set \\<Rightarrow> 'a downset\"  is\n                           \"\\<lambda>S. \\<Down>((\\<lambda>x. step (fst x) (snd x)) ` S) \\<union> \\<down>\\<bottom> \"\n  by (clarsimp simp: down_sup_distrib down_union_distrib)\n\nlemma step_le_bex[simp, elim!]: \"(a, aa, b) \\<in> p \\<Longrightarrow> c \\<le> step a (aa, b) \\<Longrightarrow> (\\<exists>x\\<in>p. c \\<le> step (fst x) (snd x))\"\n  \n  by (metis fst_conv snd_conv)\n\nsublocale step_atomic: abstract_atomic_commands datomic\n  apply (standard)\n      apply (clarsimp simp: inj_def)\n  apply (transfer)\n                 apply (intro set_eqI iffI; clarsimp)\n                  apply (drule_tac x=\"step a (aa,b)\" in set_eqD1[rotated]; clarsimp?)\n        apply (clarsimp simp: downset_set_def'  )\n       apply (clarsimp simp: in_Down_iff)\n  apply (metis dual_order.trans le_test seq_atomic.step_le seq_atomic_axioms)\n                 apply (drule sym, drule_tac x=\"step a (aa,b)\" in set_eqD1[rotated]; clarsimp?)\n       apply (clarsimp simp: downset_set_def')\n\n      apply (clarsimp simp: in_Down_iff)\n  apply (metis dual_order.trans le_test seq_atomic.step_le seq_atomic_axioms)\n\n     apply (clarsimp simp: sup_downset_def, transfer)\n                apply (safe; clarsimp?)[1]\n                  apply (clarsimp simp: downset_set_def' in_down_iff)\n                  apply (elim disjE; clarsimp?)\n        apply (metis fst_conv order_refl snd_conv)\n\n      apply (clarsimp simp: downset_set_def')+\n  apply (metis Un_iff fst_conv snd_conv)\n  apply (simp add: down_union_distrib image_Un)+\n    apply (clarsimp simp: inf_downset_def, transfer)\n apply (safe; clarsimp?)[1]\n      apply (clarsimp simp: downset_set_def')\n\n          apply (fastforce simp: down_union_distrib image_Un down_image_iff )+\n    apply (clarsimp simp: down_image_iff)\n    apply (clarsimp simp: in_down_iff)\n    apply (frule (1) step_meet') back\n  apply (elim disjE; clarsimp?)\n\n              apply (transfer; clarsimp)\n             apply (clarsimp simp: less_eq_downset_def, transfer, clarsimp)\n  apply (safe; clarsimp simp: downset_set_def')[1]\n  apply (metis fst_eqD snd_eqD subsetD)\n  apply (drule_tac c=\"step a (aa,b)\" in subsetD)\n   apply (clarsimp)+\n  by (metis in_down_iff order_refl step_meet' step_not_bot)\n\nsublocale seq_elem_fiter: iteration_finite_distrib convolute conv_test_pre.nil\n  apply (standard)\n  using conv_seq_distrib.seq_nondet_distrib by presburger\n\nsublocale seq_elem_iter: iteration_infinite_distrib convolute conv_test_pre.nil\n  apply (standard)\n  using conv_seq_Distrib.seq_Nondet_distrib by presburger\n\n\nend\n\nend", "meta": {"author": "onomatic", "repo": "icfemproofs-downset", "sha": "master", "save_path": "github-repos/isabelle/onomatic-icfemproofs-downset", "path": "github-repos/isabelle/onomatic-icfemproofs-downset/icfemproofs-downset-main/Seq_Atomic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.689305616785446, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.333885912751133}}
{"text": "theory CorrectnessResourced\n  imports ResourcedDenotational Launchbury\nbegin\n\ntheorem correctness:\n  assumes \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : z\"\n  and     \"fv (\\<Gamma>, e) \\<subseteq> set L \\<union> domA \\<Gamma>\"\n  shows   \"\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk>z\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>\" and \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` domA \\<Gamma> \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>\"\n  using assms\nproof(nominal_induct arbitrary: \\<rho> rule:reds.strong_induct)\ncase Lambda\n  case 1 show ?case..\n  case 2 show ?case..\nnext\ncase (Application y \\<Gamma> e x L \\<Delta> \\<Theta> z e')\n  have Gamma_subset: \"domA \\<Gamma> \\<subseteq> domA \\<Delta>\"\n    by (rule reds_doesnt_forget[OF Application.hyps(8)])\n\n  case 1\n  hence prem1: \"fv (\\<Gamma>, e) \\<subseteq> set L \\<union> domA \\<Gamma>\" and  \"x \\<in> set L \\<union> domA \\<Gamma>\" by auto\n  moreover\n  note reds_pres_closed[OF Application.hyps(8) prem1]\n  moreover\n  note reds_doesnt_forget[OF Application.hyps(8)] \n  moreover\n  have \"fv (e'[y::=x]) \\<subseteq> fv (Lam [y]. e') \\<union> {x}\"\n    by (auto simp add: fv_subst_eq)\n  ultimately\n  have prem2: \"fv (\\<Delta>, e'[y::=x]) \\<subseteq> set L \\<union> domA \\<Delta>\" by auto\n\n  \n  have *: \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x\"\n  proof(cases \"x \\<in> domA \\<Gamma>\")\n    case True\n    thus ?thesis\n      using fun_belowD[OF Application.hyps(10)[OF prem1], where \\<rho>1 = \\<rho> and x = x]\n      by simp\n  next\n    case False\n    from False \\<open>x \\<in> set L \\<union> domA \\<Gamma>\\<close> reds_avoids_live[OF Application.hyps(8)] \n    show ?thesis by (auto simp add: lookup_HSem_other)\n  qed\n\n  {\n  fix r\n  have \"(\\<N>\\<lbrakk> App e x \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r \\<sqsubseteq> ((\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r \\<down>CFn (\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x)\\<cdot>r\"\n    by (rule CEApp_no_restr)\n  also have \"((\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)) \\<sqsubseteq> ((\\<N>\\<lbrakk> Lam [y]. e' \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>))\"\n    using Application.hyps(9)[OF prem1].\n  also note \\<open>((\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x) \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x\\<close>\n  also have \"(\\<N>\\<lbrakk> Lam [y]. e' \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r \\<sqsubseteq> (CFn\\<cdot>(\\<Lambda> v. (\\<N>\\<lbrakk> e' \\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>)(y := v)\\<^esub>)))\"\n    by (rule CELam_no_restr)\n  also have \"CFn\\<cdot>(\\<Lambda> v. (\\<N>\\<lbrakk> e' \\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>)(y := v)\\<^esub>)) \\<down>CFn ((\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x) = (\\<N>\\<lbrakk> e' \\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>)(y := (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x)\\<^esub>)\"\n    by simp\n  also have \"\\<dots> = (\\<N>\\<lbrakk> e'[y ::= x] \\<rbrakk>\\<^bsub>(\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>)\\<^esub>)\"\n    unfolding ESem_subst..\n  also have \"\\<dots> \\<sqsubseteq> \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>\\<^esub>\"\n    using Application.hyps(12)[OF prem2].\n  finally\n  have \"(\\<N>\\<lbrakk> App e x \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r \\<sqsubseteq> (\\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r\" by this (intro cont2cont)+\n  }\n  thus ?case by (rule cfun_belowI)\n  \n  show \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` (domA \\<Gamma>) \\<sqsubseteq> (\\<N>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>)  f|` (domA \\<Gamma>)\"\n    using Application.hyps(10)[OF prem1]\n          env_restr_below_subset[OF Gamma_subset Application.hyps(13)[OF prem2]]\n    by (rule below_trans)\nnext\ncase (Variable \\<Gamma> x e L \\<Delta> z)\n  hence [simp]:\"x \\<in> domA \\<Gamma>\"\n    by (metis domA_from_set map_of_SomeD)\n\n  case 2\n\n  have \"x \\<notin> domA \\<Delta>\"\n    by (rule reds_avoids_live[OF Variable.hyps(2)], simp_all)\n\n  have subset: \"domA (delete x \\<Gamma>) \\<subseteq> domA \\<Delta>\"\n    by (rule reds_doesnt_forget[OF Variable.hyps(2)])\n\n  let \"?new\" = \"domA \\<Delta> - domA \\<Gamma>\"\n  have \"fv (delete x \\<Gamma>, e) \\<union> {x} \\<subseteq> fv (\\<Gamma>, Var x)\"\n    by (rule fv_delete_heap[OF \\<open>map_of \\<Gamma> x = Some e\\<close>])\n  hence prem: \"fv (delete x \\<Gamma>, e) \\<subseteq> set (x # L) \\<union> domA (delete x \\<Gamma>)\" using 2 by auto\n  hence fv_subset: \"fv (delete x \\<Gamma>, e) - domA (delete x \\<Gamma>) \\<subseteq> - ?new\"\n    using reds_avoids_live'[OF Variable.hyps(2)] by auto\n\n\n\n  have \"domA \\<Gamma> \\<subseteq> (-?new)\" by auto\n\n\n  have \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho> = \\<N>\\<lbrace>(x,e) # delete x \\<Gamma>\\<rbrace>\\<rho>\"\n    by (rule HSem_reorder[OF map_of_delete_insert[symmetric, OF Variable(1)]])\n  also have \"\\<dots> = (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>(domA (delete x \\<Gamma>))\\<^esub> (\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<rho>'))( x := \\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>))\"\n    by (rule iterative_HSem, simp)\n  also have \"\\<dots> = (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>(domA (delete x \\<Gamma>))\\<^esub> (\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<rho>'))( x := \\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<rho>'\\<^esub>))\"\n    by (rule iterative_HSem', simp)\n  finally\n  have \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>)f|` (- ?new) \\<sqsubseteq> (...) f|` (- ?new)\" by (rule ssubst) (rule below_refl)\n  also have \"\\<dots> \\<sqsubseteq> (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>domA \\<Delta>\\<^esub> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>'))( x := \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>'\\<^esub>)) f|` (- ?new)\"\n  proof (induction rule: parallel_fix_ind[where P =\"\\<lambda> x y. x f|` (- ?new) \\<sqsubseteq> y f|` (- ?new)\"])\n    case 1 show ?case by simp\n  next\n    case 2 show ?case ..\n  next\n    case (3 \\<sigma> \\<sigma>')\n    hence \"\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>'\\<^esub>\"\n      and \"(\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>) f|` domA (delete x \\<Gamma>) \\<sqsubseteq> (\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>') f|` domA (delete x \\<Gamma>)\"\n      using fv_subset by (auto intro: ESem_fresh_cong_below HSem_fresh_cong_below  env_restr_below_subset[OF _ 3])\n    from below_trans[OF this(1) Variable(3)[OF prem]] below_trans[OF this(2) Variable(4)[OF prem]]\n    have  \"\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<sigma>'\\<^esub>\"\n       and \"(\\<N>\\<lbrace>delete x \\<Gamma>\\<rbrace>\\<sigma>) f|` domA (delete x \\<Gamma>) \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<sigma>') f|` domA (delete x \\<Gamma>)\".\n    thus ?case\n      using subset\n      by (auto intro!: fun_belowI simp add: lookup_override_on_eq  lookup_env_restr_eq elim: env_restr_belowD)\n  qed\n  also have \"\\<dots> = (\\<mu> \\<rho>'. (\\<rho> ++\\<^bsub>domA \\<Delta>\\<^esub> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>'))( x := \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<rho>'\\<^esub>)) f|` (-?new)\"\n    by (rule arg_cong[OF iterative_HSem'[symmetric], OF \\<open>x \\<notin> domA \\<Delta>\\<close>])\n  also have \"\\<dots> = (\\<N>\\<lbrace>(x,z) # \\<Delta>\\<rbrace>\\<rho>)  f|` (-?new)\"\n    by (rule arg_cong[OF iterative_HSem[symmetric], OF \\<open>x \\<notin> domA \\<Delta>\\<close>])\n  finally\n  show le: ?case by (rule env_restr_below_subset[OF \\<open>domA \\<Gamma> \\<subseteq> (-?new)\\<close>]) (intro cont2cont)+\n\n  have \"\\<N>\\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> (\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x\" by (rule CESem_simps_no_tick)\n  also have \"\\<dots> \\<sqsubseteq> (\\<N>\\<lbrace>(x, z) # \\<Delta>\\<rbrace>\\<rho>) x\"\n    using fun_belowD[OF le, where x = x] by simp\n  also have \"\\<dots> = \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>(x, z) # \\<Delta>\\<rbrace>\\<rho>\\<^esub>\"\n    by (simp add: lookup_HSem_heap)\n  finally\n  show \"\\<N>\\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>(x, z) # \\<Delta>\\<rbrace>\\<rho>\\<^esub>\"  by this (intro cont2cont)+\nnext\ncase (Bool b)\n  case 1\n  show ?case by simp\n  case 2\n  show ?case by simp\nnext\ncase (IfThenElse \\<Gamma> scrut L \\<Delta> b e\\<^sub>1 e\\<^sub>2 \\<Theta> z)\n  have Gamma_subset: \"domA \\<Gamma> \\<subseteq> domA \\<Delta>\"\n    by (rule reds_doesnt_forget[OF IfThenElse.hyps(1)])\n\n  let ?e = \"if b then e\\<^sub>1 else e\\<^sub>2\"\n\n  case 1\n\n  hence prem1: \"fv (\\<Gamma>, scrut) \\<subseteq> set L \\<union> domA \\<Gamma>\"\n    and prem2: \"fv (\\<Delta>, ?e) \\<subseteq> set L \\<union> domA \\<Delta>\"\n    and \"fv ?e \\<subseteq> domA \\<Gamma> \\<union> set L\"\n    using new_free_vars_on_heap[OF IfThenElse.hyps(1)] Gamma_subset by auto\n\n  {\n  fix r\n  have \"(\\<N>\\<lbrakk> (scrut ? e\\<^sub>1 : e\\<^sub>2) \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r \\<sqsubseteq> CB_project\\<cdot>((\\<N>\\<lbrakk> scrut \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r)\\<cdot>((\\<N>\\<lbrakk> e\\<^sub>1 \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r)\\<cdot>((\\<N>\\<lbrakk> e\\<^sub>2 \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r)\"\n    by (rule CESem_simps_no_tick)\n  also have \"\\<dots> \\<sqsubseteq> CB_project\\<cdot>((\\<N>\\<lbrakk> Bool b \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r)\\<cdot>((\\<N>\\<lbrakk> e\\<^sub>1 \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r)\\<cdot>((\\<N>\\<lbrakk> e\\<^sub>2 \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r)\"\n    by (intro monofun_cfun_fun monofun_cfun_arg  IfThenElse.hyps(2)[OF prem1])\n  also have \"\\<dots> = (\\<N>\\<lbrakk> ?e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r\" by (cases r) simp_all\n  also have \"\\<dots> \\<sqsubseteq> (\\<N>\\<lbrakk> ?e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r\"\n    proof(rule monofun_cfun_fun[OF ESem_fresh_cong_below_subset[OF  \\<open>fv ?e \\<subseteq> domA \\<Gamma> \\<union> set L\\<close> Env.env_restr_belowI]])\n      fix x\n      assume \"x \\<in> domA \\<Gamma> \\<union> set L\"\n      thus \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) x \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) x\"\n      proof(cases \"x \\<in> domA \\<Gamma>\")\n        assume \"x \\<in> domA \\<Gamma>\"\n        from IfThenElse.hyps(3)[OF prem1]\n        have \"((\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` domA \\<Gamma>) x \\<sqsubseteq> ((\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>) x\" by (rule fun_belowD)\n        with \\<open>x \\<in> domA \\<Gamma>\\<close> show ?thesis by simp\n      next\n        assume \"x \\<notin> domA \\<Gamma>\"\n        from this \\<open>x \\<in> domA \\<Gamma> \\<union> set L\\<close> reds_avoids_live[OF IfThenElse.hyps(1)]\n        show ?thesis\n          by (simp add: lookup_HSem_other)\n      qed\n    qed\n  also have \"\\<dots> \\<sqsubseteq> (\\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r\"\n    by (intro monofun_cfun_fun monofun_cfun_arg IfThenElse.hyps(5)[OF prem2])\n  finally\n  have \"(\\<N>\\<lbrakk> (scrut ? e\\<^sub>1 : e\\<^sub>2) \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r \\<sqsubseteq> (\\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>\\<^esub>)\\<cdot>r\" by this (intro cont2cont)+\n  }\n  thus ?case  by (rule cfun_belowI)\n\n  show \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` (domA \\<Gamma>) \\<sqsubseteq> (\\<N>\\<lbrace>\\<Theta>\\<rbrace>\\<rho>)  f|` (domA \\<Gamma>)\"\n    using IfThenElse.hyps(3)[OF prem1]\n          env_restr_below_subset[OF Gamma_subset IfThenElse.hyps(6)[OF prem2]]\n    by (rule below_trans)\nnext\ncase (Let as \\<Gamma> L body \\<Delta> z)\n  case 1\n  have *: \"domA as \\<inter> domA \\<Gamma> = {}\" by (metis Let.hyps(1) fresh_distinct)\n  \n  have \"fv (as @ \\<Gamma>, body) - domA (as @ \\<Gamma>) \\<subseteq> fv (\\<Gamma>, Let as body) - domA \\<Gamma>\"\n    by auto\n  with 1 have prem: \"fv (as @ \\<Gamma>, body)  \\<subseteq> set L \\<union>  domA (as @ \\<Gamma>)\" by auto\n  \n  have f1: \"atom ` domA as \\<sharp>* \\<Gamma>\"\n    using Let(1) by (simp add: set_bn_to_atom_domA)\n\n  have \"\\<N>\\<lbrakk> Let as body \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk> body \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>as\\<rbrace>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>\\<^esub>\"\n     by (rule CESem_simps_no_tick)\n  also have \"\\<dots> =  \\<N>\\<lbrakk> body \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>as @ \\<Gamma>\\<rbrace>\\<rho>\\<^esub>\"\n    by (rule arg_cong[OF HSem_merge[OF f1]])\n  also have \"\\<dots> \\<sqsubseteq>  \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>\\<^esub>\"\n    by (rule Let.hyps(4)[OF prem])\n  finally\n  show ?case  by this (intro cont2cont)+\n\n  have \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` (domA \\<Gamma>) = (\\<N>\\<lbrace>as\\<rbrace>(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>)) f|` (domA \\<Gamma>)\"\n    unfolding env_restr_HSem[OF *]..\n  also have \"\\<N>\\<lbrace>as\\<rbrace>(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) = (\\<N>\\<lbrace>as @ \\<Gamma>\\<rbrace>\\<rho>)\"\n    by (rule HSem_merge[OF f1])\n  also have \"\\<dots> f|` domA \\<Gamma> \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>\"\n    by (rule env_restr_below_subset[OF _ Let.hyps(5)[OF prem]]) simp\n  finally\n  show \"(\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<rho>) f|` domA \\<Gamma> \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<rho>) f|` domA \\<Gamma>\".\nqed\n\n\ncorollary correctness_empty_env:\n  assumes \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : z\"\n  and     \"fv (\\<Gamma>, e) \\<subseteq> set L\"\n  shows   \"\\<N>\\<lbrakk>e\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk>z\\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<^esub>\" and \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace> \\<sqsubseteq> \\<N>\\<lbrace>\\<Delta>\\<rbrace>\"\nproof-\n  from assms(2) have \"fv (\\<Gamma>, e) \\<subseteq> set L \\<union>  domA \\<Gamma>\" by auto\n  note corr = correctness[OF assms(1) this, where \\<rho> = \"\\<bottom>\"]\n\n  show \"\\<N>\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Gamma>\\<rbrace>\\<^esub> \\<sqsubseteq> \\<N>\\<lbrakk> z \\<rbrakk>\\<^bsub>\\<N>\\<lbrace>\\<Delta>\\<rbrace>\\<^esub>\" using corr(1).\n\n  have \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace> = (\\<N>\\<lbrace>\\<Gamma>\\<rbrace>) f|` domA \\<Gamma> \"\n    using env_restr_useless[OF HSem_edom_subset, where \\<rho>1 = \"\\<bottom>\"] by simp\n  also have \"\\<dots> \\<sqsubseteq> (\\<N>\\<lbrace>\\<Delta>\\<rbrace>) f|` domA \\<Gamma>\" using corr(2).\n  also have \"\\<dots> \\<sqsubseteq> \\<N>\\<lbrace>\\<Delta>\\<rbrace>\" by (rule env_restr_below_itself)\n  finally show \"\\<N>\\<lbrace>\\<Gamma>\\<rbrace> \\<sqsubseteq> \\<N>\\<lbrace>\\<Delta>\\<rbrace>\" by this (intro cont2cont)+\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Launchbury/CorrectnessResourced.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3335470215551666}}
{"text": "subsection \\<open>Arithmetizing equations are Diophantine\\<close>\n\ntheory Equation_Setup imports \"../Register_Machine/RegisterMachineSpecification\"\n          \"../Diophantine/Diophantine_Relations\"\n\nbegin\n\nlocale register_machine = \n  fixes p :: program\n    and n :: nat\n  assumes p_nonempty: \"length p > 0\"\n      and valid_program: \"program_register_check p n\"\n  assumes n_gt_0: \"n > 0\"\n\nbegin\n\n  definition m :: \"nat\" where\n    \"m \\<equiv> length p - 1\"\n\n  lemma modifies_yields_valid_register:\n    assumes \"k < length p\"\n    shows \"modifies (p!k) < n\"\n  proof - \n    have \"instruction_register_check n (p!k)\"\n      using valid_program assms list_all_length program_register_check.simps by auto\n\n    thus ?thesis by (cases \"p!k\", auto simp: n_gt_0) \n  qed\n\nend\n\nlocale rm_eq_fixes = register_machine + \n  fixes a b c d e f :: \"nat\"\n    and q :: nat\n    and r z :: \"register \\<Rightarrow> nat\"\n    and s :: \"state \\<Rightarrow> nat\"\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/DPRM_Theorem/Machine_Equations/Equation_Setup.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723317123102955, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.33353961383475506}}
{"text": "theory Iterator\nimports \n  It_to_It \n  SetIteratorOperations \n  SetIteratorGA \n  Proper_Iterator\n  Gen_Iterator\n  Idx_Iterator\nbegin\n\n  text \\<open>Folding over a list created by a proper iterator can be replaced\n    by a single iteration\\<close>\n  lemma proper_it_to_list_opt[refine_transfer_post_subst]:\n    assumes PR: \"proper_it' it it'\"\n    shows \"foldli o it_to_list it \\<equiv> it'\"\n  proof (rule eq_reflection, intro ext)\n    fix s c f \\<sigma>\n    \n    obtain l where \"it s = foldli l\" and \"it' s = foldli l\"\n      by (rule proper_itE[OF PR[THEN proper_it'D[where s=s]]])\n    thus \"(foldli o it_to_list it) s c f \\<sigma> = it' s c f \\<sigma>\"\n      by (simp add: comp_def it_to_list_def)\n  qed\n\n  lemma iterator_cnv_to_comp[refine_transfer_post_simp]:\n    \"foldli (it_to_list it x) = (foldli o it_to_list it) x\"\n    by auto\n\n  declare idx_iteratei_eq_foldli[autoref_rules]\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/Iterator/Iterator.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723316991792861, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3335396073205423}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory CreateIRQCaps_SI\nimports\n  \"DSpecProofs.IRQ_DP\"\n  ObjectInitialised_SI\n  RootTask_SI\n  SysInit_SI\nbegin\n\n(*****************\n * Helper lemmas *\n *****************)\n\n\n\nlemma si_cnode_caps:\n  \"si_cnode_cap = si_cspace_cap\"\n  by (simp add: si_cnode_cap_def si_cspace_cap_def)\n\nlemma hoare_grab_exs2:\n  \"(\\<And>x. P x \\<Longrightarrow> \\<lbrace>P' x\\<rbrace> f \\<lbrace>Q\\<rbrace>) \\<Longrightarrow> \\<lbrace>\\<lambda>s. \\<exists>x. P x \\<and> P' x s\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  by (fastforce simp: valid_def)\n\nlemma sep_map_irq_sep_irq_node:\n  \"(irq \\<mapsto>irq k_irq_table irq \\<and>* R) s\n  \\<Longrightarrow> sep_irq_node s irq = Some (k_irq_table irq)\"\n  by (fastforce simp: sep_map_irq_def sep_conj_def\n                      sep_disj_sep_state_def sep_state_disj_def\n                      plus_sep_state_def sep_state_add_def\n                      map_disj_def map_add_Some_iff)\n\n(*********************************************************************************\n * A new definition of si_irq_nodes that states that the mapping is injective. *\n *********************************************************************************)\n\nlemma sep_map_o_distinct:\n  \"(obj_id \\<mapsto>o obj \\<and>* obj_id' \\<mapsto>o obj') s \\<Longrightarrow> obj_id \\<noteq> obj_id'\"\n  by (fastforce simp: sep_map_o_def sep_map_general_def sep_conj_def object_to_sep_state_def\n                      sep_disj_sep_state_def sep_state_disj_def\n                      map_disj_def dom_def disjoint_iff_not_equal)\n\nlemma sep_any_map_o_false_eq:\n  \"(obj_id \\<mapsto>o - \\<and>* obj_id \\<mapsto>o -) = sep_false\"\n  by (fastforce simp: sep_any_def sep_map_o_def sep_map_general_def sep_conj_def\n                      object_to_sep_state_def sep_disj_sep_state_def sep_state_disj_def\n                      map_disj_def dom_def disjoint_iff_not_equal)\n\nlemma sep_any_map_o_false:\n  \"(obj_id \\<mapsto>o - \\<and>* obj_id \\<mapsto>o -) s \\<Longrightarrow> False\"\n  by (simp add: sep_any_map_o_false_eq)\n\nlemma sep_map_o_false:\n  \"(obj_id \\<mapsto>o obj \\<and>* obj_id \\<mapsto>o obj') s \\<Longrightarrow> False\"\n  by (metis sep_map_o_distinct)\n\nlemma sep_map_o_any_distinct_list:\n  \"((f x) \\<mapsto>o - \\<and>* \\<And>* map (\\<lambda>x. (f x) \\<mapsto>o -) xs) s\n  \\<Longrightarrow> x \\<notin> set xs\"\n  apply clarsimp\n  apply (subst (asm) sep_list_conj_map_remove1, assumption)\n  apply (sep_drule sep_any_map_o_false)\n  apply clarsimp\n  done\n\nlemma sep_any_map_o_inj_on:\n  \"(\\<And>* map (\\<lambda>x. (f x) \\<mapsto>o -) xs) s\n  \\<Longrightarrow> inj_on f (set xs)\"\n  apply (induct xs arbitrary: s)\n   apply clarsimp\n  apply clarsimp\n  apply (rule conjI)\n   apply (clarsimp simp: sep_conj_def)\n  apply clarsimp\n  apply (frule sep_map_o_any_distinct_list)\n  apply simp\n  done\n\nlemma sep_any_map_o_inj_on_set:\n  \"\\<lbrakk>(\\<And>* x \\<in> A. (f x) \\<mapsto>o -) s; finite A\\<rbrakk>\n  \\<Longrightarrow> inj_on f A\"\n  apply (drule sep_map_set_conj_sep_list_conj [where P=\"\\<lambda>x. (f x) \\<mapsto>o -\"])\n  apply clarsimp\n  apply (erule sep_any_map_o_inj_on)\n  done\n\nlemma sep_map_o_inj_on_set:\n  \"\\<lbrakk>(\\<And>* x \\<in> A. (f x) \\<mapsto>o obj) s; finite A\\<rbrakk>\n  \\<Longrightarrow> inj_on f A\"\n  apply (rule sep_any_map_o_inj_on_set [rotated, where s=s], assumption)\n  apply (erule sep_map_set_conj_impl)\n   apply (fastforce simp: sep_any_def)\n  apply simp\n  done\n\nlemma sep_conj_existL:\n  \"(P \\<and>* Q) s \\<Longrightarrow> \\<exists>s. P s\"\n  by (auto simp: sep_conj_def)\n\nlemma sep_conj_existR:\n  \"(P \\<and>* Q) s \\<Longrightarrow> \\<exists>s. Q s\"\n  by (auto simp: sep_conj_def)\n\nlemma si_irq_nodes_def2:\n  \"si_irq_nodes spec =\n     (\\<lambda>s. \\<exists>k_irq_table. inj_on k_irq_table (used_irqs spec) \\<and>\n                        (\\<And>* irq\\<in>used_irqs spec. irq \\<mapsto>irq k_irq_table irq \\<and>*\n                                                 k_irq_table irq \\<mapsto>o IRQNode empty_irq_node) s)\"\n  apply (rule ext)\n  apply (clarsimp simp: si_irq_nodes_def)\n  apply (rule iffI)\n   apply clarsimp\n   apply (rule_tac x=k_irq_table in exI, simp)\n   apply (subst (asm) sep.prod.distrib)\n   apply (drule sep_conj_existR, clarsimp)\n    apply (erule sep_map_o_inj_on_set) (* Why doesn't sep_rule work? *)\n   apply simp\n  apply blast\n  done\n\n\n\n(*******************************************\n * The actual proofs about create_irq_caps *\n *******************************************)\n\nlemma well_formed_default_irq_node_empty:\n  \"\\<lbrakk>well_formed spec; irq \\<in> used_irqs spec\\<rbrakk>\n    \\<Longrightarrow> object_at (\\<lambda>obj. object_default_state obj = IRQNode empty_irq_node) (cdl_irq_node spec irq) spec\"\n  apply (frule (1) well_formed_used_irqs_have_irq_node, clarsimp)\n  apply (frule (1) well_formed_irq_is_irq_node)\n  apply (frule (1) well_formed_size_irq_node)\n  apply (clarsimp simp: object_at_def empty_irq_node_def object_default_state_def2\n                        is_irq_node_def object_size_bits_def\n                 split: cdl_object.splits)\n  done\n\nlemma create_irq_cap_sep:\n  \"\\<lbrace>\\<guillemotleft>(si_cnode_id, unat free_cptr) \\<mapsto>c NullCap \\<and>*\n      irq \\<mapsto>irq kernel_irq_id \\<and>*\n      kernel_irq_id \\<mapsto>o (IRQNode empty_irq_node) \\<and>*\n      si_objects \\<and>* R\\<guillemotright> and\n    K(well_formed spec \\<and>\n      irq \\<in> used_irqs spec \\<and>\n      t' (cdl_irq_node spec irq) = Some kernel_irq_id \\<and>\n      irq_caps irq = Some free_cptr \\<and>\n      free_cptr < 2 ^ si_cnode_size)\\<rbrace>\n   create_irq_cap spec (irq, free_cptr)\n   \\<lbrace>\\<lambda>_.\n    \\<guillemotleft>irq_empty spec t' irq \\<and>*\n     si_irq_cap_at irq_caps spec irq \\<and>*\n     si_objects \\<and>*\n     R\\<guillemotright>\\<rbrace>\"\n  apply (rule hoare_gen_asm, clarsimp)\n  apply (frule (1) well_formed_used_irqs_have_irq_node, clarsimp)\n  apply (frule (1) well_formed_default_irq_node_empty, clarsimp simp: object_at_def)\n  apply (clarsimp simp: create_irq_cap_def si_objects_def si_cnode_caps\n                        irq_empty_def irq_initialised_general_def\n                        si_irq_cap_at_def sep_conj_assoc)\n  apply (wp add: hoare_drop_imp sep_wp: seL4_IRQHandler_IRQControl_Get, simp)\n  apply (rule conjI)\n   apply sep_solve\n  apply (simp add: offset_slot_si_cnode_size' guard_equal_si_cspace_cap word_bits_def)\n  done\n\nlemma word_upto_enum_sorted:\n  \"sorted [(x::('a::len) word) .e. y]\"\nproof (induct \"fromEnumAlt y\" arbitrary: x y)\n  case 0\n    then show ?case by (simp add: upto_enum_def)\n  next case (Suc d)\n    have d_prev: \"d = fromEnumAlt (y - 1)\"\n      using Suc.hyps\n      apply clarsimp\n      apply (subst unat_minus_one; fastforce)\n      done\n    then show ?case\n      using Suc.hyps(1)[where x=x and y=\"y-1\"] Suc.hyps(2)\n      apply (simp only: upto_enum_def)\n      apply (clarsimp simp: sorted_append)\n      by (metis le_def order_le_less_trans order_less_imp_le toEnum_of_nat unat_lt2p\n                word_not_le word_unat_less_le)\nqed\n\nlemma sorted_list_of_set_eq_filter:\n  fixes P::\"('a::len) word \\<Rightarrow> bool\"\n  shows \"sorted_list_of_set {x. P x} = filter P [minBound .e. maxBound]\"\n        (is \"_ = ?rhs\")\nproof -\n  have rhs_sorted: \"sorted ?rhs\"\n    by (intro sorted_imp_sorted_filter word_upto_enum_sorted)\n  moreover have rhs_distinct: \"distinct ?rhs\"\n    by (intro distinct_filter distinct_enum_upto')\n  moreover have enum_UNIV: \"set [(minBound::'a word) .e. maxBound] = UNIV\"\n   by (force simp: upto_enum_def minBound_word maxBound_word word_unat.univ unats_def\n                   unat_minus_one_word\n                   atLeastLessThan_def atLeast_def lessThan_def)\n  moreover have rhs_set: \"{x. P x} = set ?rhs\"\n    by (simp only: set_filter enum_UNIV, blast)\n  ultimately show ?thesis\n    by (metis sorted_list_of_set_already_sorted)\nqed\n\nlemma well_formed_spec_used_irqs_compute:\n  assumes \"well_formed spec\"\n  shows \"used_irq_list_compute spec = used_irq_list spec\"\n  using assms\n  unfolding used_irq_list_compute_def used_irq_list_def used_irqs_def\n            sorted_list_of_set_eq_filter minBound_word\n  apply (rule_tac filter_cong[OF refl, OF iffI])\n   apply (clarsimp simp add: Option.is_none_def)\n   apply (frule well_formed_cap_to_irq_object,assumption)\n    apply (simp add: well_formed_cdl_irq_node_irq_nodes)\n   apply (force dest: well_formed_inj_cdl_irq_node[THEN injD]\n                      well_formed_cap_to_irq_object\n                simp add: all_caps_def)\n  apply (clarsimp simp add: Option.is_none_def well_formed_all_caps_cap_irq)\n  done\n\nlemma create_irq_caps_sep_helper:\n  \"\\<lbrace>\\<guillemotleft>((\\<And>* cptr \\<in> set (take (card (used_irqs spec)) free_cptrs).\n           ((si_cnode_id, unat cptr) \\<mapsto>c NullCap)) \\<and>*\n      si_caps_at t orig_caps spec dev {obj_id. real_object_at obj_id spec} \\<and>*\n      si_objects \\<and>* si_irq_nodes spec \\<and>* R)  and\n   K (well_formed spec \\<and>\n      list_all (\\<lambda>n. n < 2 ^ si_cnode_size) free_cptrs \\<and>\n      distinct free_cptrs \\<and>\n      card (used_irqs spec) \\<le> length free_cptrs)\\<guillemotright> \\<rbrace>\n  create_irq_caps spec free_cptrs\n   \\<lbrace>\\<lambda>rv s. \\<exists>(t'::32 word \\<Rightarrow> 32 word option).\n    \\<guillemotleft>(irqs_empty spec t' (used_irqs spec) \\<and>*\n      si_irq_caps_at (fst rv) spec (used_irqs spec) \\<and>*\n      si_caps_at t orig_caps spec dev {obj_id. real_object_at obj_id spec} \\<and>*\n      si_objects \\<and>* R)\n    and K ((map_of (zip (used_irq_list spec) free_cptrs), drop (card (used_irqs spec)) free_cptrs) = rv \\<and>\n    inj_on t' (used_irq_nodes spec) \\<and>\n    dom t' = used_irq_nodes spec)\\<guillemotright> s\\<rbrace>\"\n  apply clarsimp\n  apply (rule hoare_gen_asm_conj)\n  apply (clarsimp simp: create_irq_caps_def si_irq_nodes_def2 sep_conj_exists\n                        well_formed_spec_used_irqs_compute)\n  apply (rule hoare_grab_exs2)\n  apply wp\n   apply simp\n   apply (rule_tac x=\"(\\<lambda>obj_id. Some ((k_irq_table \\<circ> inv (cdl_irq_node spec)) obj_id))\n                      |` used_irq_nodes spec\" in hoare_exI)\n\n   apply (rule_tac P1 = \"\\<lambda>(irq,free_cptr). (si_cnode_id, unat free_cptr) \\<mapsto>c NullCap \\<and>*\n                                           irq \\<mapsto>irq k_irq_table irq \\<and>*\n                                           k_irq_table irq \\<mapsto>o IRQNode empty_irq_node\" and\n                  Q1 = \"\\<lambda>(irq,free_cptr). irq_empty spec ((\\<lambda>obj_id. Some ((k_irq_table \\<circ> inv (cdl_irq_node spec)) obj_id))\n                                                           |` used_irq_nodes spec) irq \\<and>*\n                                          si_irq_cap_at (map_of (zip (used_irq_list spec) free_cptrs)) spec irq\" and\n                  I1 = \"si_objects\" and\n                  R1 = \"si_caps_at t orig_caps spec dev {obj_id. real_object_at obj_id spec} \\<and>*\n                        R\" in hoare_chain [OF mapM_x_set_sep])\n      apply (metis distinct_zipI2)\n     apply (clarsimp split:prod.splits)\n     apply (clarsimp simp: sep_conj_assoc)\n     apply (wp sep_wp: create_irq_cap_sep, simp+)\n     apply (rule conjI)\n      apply (clarsimp simp: sep_conj_assoc sep_conj_exists)\n      apply sep_solve\n     apply (frule well_formed_inj_cdl_irq_node)\n     apply (frule set_zip_leftD)\n     apply (frule in_set_zip2)\n     apply (simp add: map_of_zip_tuple_in list_all_iff unat_less_2_si_cnode_size\n                      restrict_map_def used_irq_nodes_def)\n    apply assumption\n   defer\n   apply (subst sep_list_conj_sep_map_set_conj [symmetric], erule distinct_zipI2)\n   apply (subst (asm) sep_list_conj_sep_map_set_conj [symmetric, where xs = \"used_irq_list spec\", simplified])\n   apply (subst split_beta')\n   apply (subst sep_list_conj_map_add)\n   apply (subst zip_take_length [symmetric])\n   apply (subst split_beta' [symmetric])+\n   apply (subst map_zip_snd', simp)\n\n   apply (subst (asm) (3) append_take_drop_id [where n=\"card (used_irqs spec)\" and xs=free_cptrs, symmetric])\n   apply (subst map_zip_fst', simp)\n   apply (subst sep_list_conj_sep_map_set_conj, fastforce simp: used_irq_list_def)\n   apply (simp add: comp_def)\n   apply sep_solve\n\n  apply simp\n  apply (subst (asm) sep_list_conj_sep_map_set_conj [symmetric], erule distinct_zipI2)\n  apply (subst (asm) map_zip_fst', simp)\n  apply (subst (asm) sep_list_conj_map_add)\n  apply (subst (asm) sep_list_conj_sep_map_set_conj,\n         metis used_irq_list_def distinct_sorted_list_of_set)\n  apply (subst (asm) sep_list_conj_sep_map_set_conj,\n         metis used_irq_list_def distinct_sorted_list_of_set)\n  apply (clarsimp simp: irqs_empty_def si_irq_caps_at_def)\n  apply (rule conjI)\n   apply sep_solve\n  apply (frule well_formed_inj_cdl_irq_node)\n  apply (fastforce simp: inj_on_def used_irq_nodes_def)\n  done\n\n\n\n\n\n(*****************************************************************************\n * The above lemma has an injection on just the IRQs.                        *\n * We take the above proof, and join it with the result of CreateObjects     *\n * to produce an injection on all objects.                                   *\n *                                                                           *\n * The sum of the two injections \"t_irqs\" and \"t_real\" is injective because: *\n *  - Each individual relation is injective                                  *\n *  - The domains are separate                                               *\n *  - The ranges are separate                                                *\n *                                                                           *\n * The first two are easily true.                                            *\n * The last one is hard and only true because we have                        *\n     obj_id \\<mapsto>o Untyped \\<and>* obj_id \\<mapsto> IRQ, and so the obj_ids are distinct.   *\n *****************************************************************************)\n\nlemma irq_empty_cong:\n  \"t (cdl_irq_node spec irq) = t' (cdl_irq_node spec irq)\n  \\<Longrightarrow> irq_empty spec t irq = irq_empty spec t' irq\"\n  by (clarsimp simp: irq_empty_def irq_initialised_general_def)\n\nlemma object_empty_cong:\n  \"t obj_id = t' obj_id\n  \\<Longrightarrow> object_empty spec t obj_id = object_empty spec t' obj_id\"\n  by (clarsimp simp: object_empty_def object_initialised_general_def)\n\nlemma si_cap_at_cong:\n  \"t obj_id = t' obj_id\n  \\<Longrightarrow> si_cap_at  t si_caps spec dev obj_id = si_cap_at  t' si_caps spec dev obj_id\"\n  by (clarsimp simp: si_cap_at_def)\n\nlemma irq_empty_map_add:\n  \"\\<lbrakk>dom t' = cdl_irq_node spec ` irqs\\<rbrakk>\n  \\<Longrightarrow> irqs_empty spec t' irqs = irqs_empty spec (t++t') irqs\"\n  apply (clarsimp simp: irqs_empty_def)\n  apply (rule sep.prod.cong, simp)\n  apply (subst irq_empty_cong [where t'=\"t++t'\" and t=t'], simp_all)\n  by (metis imageI map_add_eval_right)\n\nlemma object_empty_map_add:\n  \"\\<lbrakk>dom t = obj_ids; map_disj t t'\\<rbrakk>\n  \\<Longrightarrow> objects_empty spec t obj_ids = objects_empty spec (t++t') obj_ids\"\n  apply (clarsimp simp: objects_empty_def)\n  apply (rule sep.prod.cong, simp)\n  apply (subst object_empty_cong [where t'=\"t++t'\" and t=t], simp_all)\n  by (metis map_add_eval_left)\n\nlemma si_caps_at_map_add:\n  \"\\<lbrakk>dom t = obj_ids; map_disj t t'\\<rbrakk>\n  \\<Longrightarrow> si_caps_at t si_caps spec dev obj_ids = si_caps_at (t++t') si_caps spec dev obj_ids\"\n  apply (clarsimp simp: si_caps_at_def)\n  apply (rule sep.prod.cong, simp)\n  apply (subst si_cap_at_cong [where t'=\"t++t'\" and t=t], simp_all)\n  by (metis map_add_eval_left)\n\n\nlemma inj_on_map_add:\n  \"\\<lbrakk>inj_on m (dom m); inj_on m' (dom m');\n    dom m \\<inter> dom m' = {}; ran m \\<inter> ran m' = {}; A = dom m \\<union> dom m'\\<rbrakk>\n  \\<Longrightarrow> inj_on (m ++ m') A\"\n  apply (rule inj_onI)\n  apply clarsimp\n  apply (elim disjE)\n     apply (metis inj_on_eq_iff inter_empty_not_both map_add_eval_left')\n    apply (metis dom_ran map_add_comm map_add_eval_right orthD1)\n   apply (metis dom_ran map_add_comm map_add_eval_right orthD1)\n  apply (metis inj_on_def map_add_eval_right)\n  done\n\nlemma inter_emptyI:\n  \"\\<lbrakk>\\<And>x. x \\<in> A \\<and> x \\<in> B \\<Longrightarrow> False\\<rbrakk>  \\<Longrightarrow> A \\<inter> B = {}\"\n  by auto\n\nlemma ran_inter_emptyI:\n  \"\\<lbrakk>\\<And>x a b. f a = Some x \\<and> g b = Some x \\<Longrightarrow> False\\<rbrakk> \\<Longrightarrow> ran f \\<inter> ran g = {}\"\n  apply (rule inter_emptyI)\n  apply (auto simp: ran_def)\n  done\n\nlemma irq_empty_objects_empty_ran_distinct:\n  \"\\<lbrakk>\\<guillemotleft>irqs_empty spec t_irq (used_irqs spec) \\<and>*\n    objects_empty spec t_real {obj_id. real_object_at obj_id spec} \\<and>* R\\<guillemotright> s;\n    well_formed spec;\n    inj_on t_irq (cdl_irq_node spec ` used_irqs spec); dom t_irq = cdl_irq_node spec ` used_irqs spec;\n    inj_on t_real {obj_id. real_object_at obj_id spec}; dom t_real = {obj_id. real_object_at obj_id spec}\\<rbrakk>\n  \\<Longrightarrow> ran t_real \\<inter> ran t_irq = {}\"\n  apply (frule well_formed_inj_cdl_irq_node)\n  apply (clarsimp simp: irqs_empty_def irq_empty_def irq_initialised_general_def\n                        objects_empty_def object_empty_def object_initialised_general_def)\n  apply (rule ran_inter_emptyI)\n  apply clarsimp\n  apply (frule domI [where m=t_real])\n  apply (frule domI [where m=t_irq])\n  apply clarsimp\n  apply (rename_tac irq_obj_id obj_id irq)\n  apply (subst (asm) sep.prod.remove, simp, assumption)\n  apply (subst (asm) sep.prod.remove, simp, fast)\n  apply (clarsimp simp: sep_conj_exists sep_conj_assoc)\n  apply (sep_drule sep_map_o_false, simp)\n  done\n\n\nlemma si_objects_extra_caps'_split:\n  \"\\<lbrakk>well_formed spec; distinct free_cptrs';\n   free_cptrs = drop (card {obj_id. real_object_at obj_id spec}) free_cptrs'\\<rbrakk> \\<Longrightarrow>\n   si_objects_extra_caps' {obj_id. real_object_at obj_id spec} free_cptrs' untyped_cptrs\n    =\n  ((\\<And>* cptr \\<in> set (take (card (used_irqs spec)) free_cptrs). (si_cnode_id, unat cptr) \\<mapsto>c NullCap) \\<and>*\n   si_objects_extra_caps' (dom (cdl_objects spec)) free_cptrs' untyped_cptrs)\"\n  apply (frule well_formed_objects_card [symmetric])\n  apply (subst (asm) add.commute)\n  apply (clarsimp simp: si_objects_extra_caps'_def sep_conj_exists sep_conj_assoc)\n  apply (subst take_drop_append [where a=\"card {obj_id. real_object_at obj_id spec}\"\n                                   and b=\"card (used_irqs spec)\"])\n  apply clarsimp\n  apply (subst sep.prod.union_disjoint, (simp add: distinct_take_drop_append)+)\n  apply (clarsimp simp: sep_conj_ac)\n  done\n\n\nlemma create_irq_caps_sep:\n  \"\\<lbrace>\\<lambda>s. \\<exists>t_real.\n    \\<guillemotleft>(objects_empty spec t_real {obj_id. real_object_at obj_id spec} \\<and>*\n      si_caps_at t_real orig_caps spec dev {obj_id. real_object_at obj_id spec} \\<and>*\n      si_objects \\<and>*\n      si_objects_extra_caps' {obj_id. real_object_at obj_id spec} free_cptrs_orig untyped_cptrs \\<and>*\n      si_irq_nodes spec \\<and>* R)  and\n   K (well_formed spec \\<and>\n      distinct free_cptrs_orig \\<and>\n      list_all (\\<lambda>n. n < 2 ^ si_cnode_size) free_cptrs \\<and>\n      card (used_irqs spec) \\<le> length free_cptrs \\<and>\n      inj_on t_real {obj_id. real_object_at obj_id spec} \\<and>\n      dom t_real = {obj_id. real_object_at obj_id spec} \\<and>\n      dom orig_caps = {obj_id. real_object_at obj_id spec} \\<and>\n      free_cptrs = drop (card {obj_id. real_object_at obj_id spec}) free_cptrs_orig)\\<guillemotright> s\\<rbrace>\n  create_irq_caps spec free_cptrs\n   \\<lbrace>\\<lambda>rv s. \\<exists>(t::32 word \\<Rightarrow> 32 word option).\n    \\<guillemotleft>(objects_empty spec t {obj_id. real_object_at obj_id spec} \\<and>*\n      irqs_empty spec t (used_irqs spec) \\<and>*\n      si_caps_at t orig_caps spec dev {obj_id. real_object_at obj_id spec} \\<and>*\n      si_irq_caps_at (fst rv) spec (used_irqs spec) \\<and>*\n      si_objects \\<and>*\n      si_objects_extra_caps' (dom (cdl_objects spec)) free_cptrs_orig untyped_cptrs \\<and>*\n      R) and\n    K ((map_of (zip (used_irq_list spec) free_cptrs), drop (card (used_irqs spec)) free_cptrs) = rv \\<and>\n       inj_on t (dom (cdl_objects spec)) \\<and> dom t = dom (cdl_objects spec))\\<guillemotright> s\\<rbrace>\"\n  apply (rule hoare_ex_pre)\n  apply (rule hoare_gen_lifted_asm)\n  apply (elim conjE)\n  apply (subst si_objects_extra_caps'_split, assumption+)\n  apply (rule hoare_chain [OF create_irq_caps_sep_helper, where orig_caps1=orig_caps])\n   apply (rule pred_conjI)\n    apply sep_solve\n   apply clarsimp\n  apply clarsimp\n  apply (rule_tac x=\"t_real ++ t'\" in exI)\n  apply clarsimp\n  apply (frule well_formed_objects_real_or_irq)\n  apply (frule well_formed_objects_only_real_or_irq)\n  apply (clarsimp simp: used_irq_nodes_def)\n  apply (subgoal_tac \"map_disj t_real t'\")\n   apply (rule conjI)\n    apply (subst object_empty_map_add [symmetric], assumption+)\n    apply (subst irq_empty_map_add [symmetric],simp add: used_irq_nodes_def)\n    apply (subst si_caps_at_map_add [symmetric], assumption+)\n    apply (clarsimp simp: si_objects_extra_caps'_def sep_conj_exists sep_conj_assoc)\n    apply (rule_tac x=untyped_caps in exI)\n    apply (rule_tac x=all_available_ids in exI)\n    apply sep_solve\n   apply (rule conjI)\n    apply (rule inj_on_map_add, simp+)\n     apply (rule irq_empty_objects_empty_ran_distinct, sep_solve, simp+)\n   apply (metis sup_commute)\n  apply (clarsimp simp: map_disjI)\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/sys-init/CreateIRQCaps_SI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3335396073205422}}
{"text": "(* Author: Joshua Schneider, ETH Zurich *)\n\nsection \\<open>Lifting with applicative functors\\<close>\n\ntheory Applicative\nimports Main\nkeywords \"applicative\" :: thy_goal and \"print_applicative\" :: diag\nbegin\n\nsubsection \\<open>Equality restricted to a set\\<close>\n\ndefinition eq_on :: \"'a set \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> bool\"\nwhere [simp]: \"eq_on A = (\\<lambda>x y. x \\<in> A \\<and> x = y)\"\n\nlemma rel_fun_eq_onI: \"(\\<And>x. x \\<in> A \\<Longrightarrow> R (f x) (g x)) \\<Longrightarrow> rel_fun (eq_on A) R f g\"\nby auto\n\nlemma rel_fun_map_fun2: \"rel_fun (eq_on (range h)) A f g \\<Longrightarrow> rel_fun (BNF_Def.Grp UNIV h)\\<inverse>\\<inverse> A f (map_fun h id g)\"\n  by(auto simp add: rel_fun_def Grp_def eq_onp_def)\n\nlemma rel_fun_refl_eq_onp:\n  \"(\\<And>z. z \\<in> f ` X \\<Longrightarrow> A z z) \\<Longrightarrow> rel_fun (eq_on X) A f f\"\n  by(auto simp add: rel_fun_def eq_onp_def)\n\nlemma eq_onE: \"\\<lbrakk> eq_on X a b; \\<lbrakk> b \\<in> X; a = b \\<rbrakk> \\<Longrightarrow> thesis \\<rbrakk> \\<Longrightarrow> thesis\" by auto\n\nlemma Domainp_eq_on [simp]: \"Domainp (eq_on X) = (\\<lambda>x. x \\<in> X)\"\n  by auto\n\nsubsection \\<open>Proof automation\\<close>\n\nlemma arg1_cong: \"x = y \\<Longrightarrow> f x z = f y z\"\nby (rule arg_cong)\n\nlemma UNIV_E: \"x \\<in> UNIV \\<Longrightarrow> P \\<Longrightarrow> P\" .\n\ncontext begin\n\nprivate named_theorems combinator_unfold\nprivate named_theorems combinator_repr\n\nprivate definition \"B g f x \\<equiv> g (f x)\"\nprivate definition \"C f x y \\<equiv> f y x\"\nprivate definition \"I x \\<equiv> x\"\nprivate definition \"K x y \\<equiv> x\"\nprivate definition \"S f g x \\<equiv> (f x) (g x)\"\nprivate definition \"T x f \\<equiv> f x\"\nprivate definition \"W f x \\<equiv> f x x\"\n\nlemmas [abs_def, combinator_unfold] = B_def C_def I_def K_def S_def T_def W_def\nlemmas [combinator_repr] = combinator_unfold\n\nprivate definition \"cpair \\<equiv> Pair\"\nprivate definition \"cuncurry \\<equiv> case_prod\"\n\nprivate lemma uncurry_pair: \"cuncurry f (cpair x y) = f x y\"\nunfolding cpair_def cuncurry_def by simp\n\nML_file \"applicative.ML\"\n\nlocal_setup \\<open>Applicative.setup_combinators\n [(\"B\", @{thm B_def}),\n  (\"C\", @{thm C_def}),\n  (\"I\", @{thm I_def}),\n  (\"K\", @{thm K_def}),\n  (\"S\", @{thm S_def}),\n  (\"T\", @{thm T_def}),\n  (\"W\", @{thm W_def})]\\<close>\n\nprivate attribute_setup combinator_eq =\n  \\<open>Scan.lift (Scan.option (Args.$$$ \"weak\" |--\n    Scan.optional (Args.colon |-- Scan.repeat1 Args.name) []) >>\n    Applicative.combinator_rule_attrib)\\<close>\n\nlemma [combinator_eq]: \"B \\<equiv> S (K S) K\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"C \\<equiv> S (S (K (S (K S) K)) S) (K K)\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"I \\<equiv> W K\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"I \\<equiv> C K ()\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"S \\<equiv> B (B W) (B B C)\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"T \\<equiv> C I\" unfolding combinator_unfold .\nlemma [combinator_eq]: \"W \\<equiv> S S (S K)\" unfolding combinator_unfold .\n\nlemma [combinator_eq weak: C]:\n  \"C \\<equiv> C (B B (B B (B W (C (B C (B (B B) (C B (cuncurry (K I))))) (cuncurry K))))) cpair\"\nunfolding combinator_unfold uncurry_pair .\n\nend (* context *)\n\n\nmethod_setup applicative_unfold =\n  \\<open>Applicative.parse_opt_afun >> (fn opt_af => fn ctxt =>\n    SIMPLE_METHOD' (Applicative.unfold_wrapper_tac ctxt opt_af))\\<close>\n  \"unfold into an applicative expression\"\n\nmethod_setup applicative_fold =\n  \\<open>Applicative.parse_opt_afun >> (fn opt_af => fn ctxt =>\n    SIMPLE_METHOD' (Applicative.fold_wrapper_tac ctxt opt_af))\\<close>\n  \"fold an applicative expression\"\n\nmethod_setup applicative_nf =\n  \\<open>Applicative.parse_opt_afun >> (fn opt_af => fn ctxt =>\n    SIMPLE_METHOD' (Applicative.normalize_wrapper_tac ctxt opt_af))\\<close>\n  \"prove an equation that has been lifted to an applicative functor, using normal forms\"\n\nmethod_setup applicative_lifting =\n  \\<open>Applicative.parse_opt_afun >> (fn opt_af => fn ctxt =>\n    SIMPLE_METHOD' (Applicative.lifting_wrapper_tac ctxt opt_af))\\<close>\n  \"prove an equation that has been lifted to an applicative functor\"\n\nML \\<open>Outer_Syntax.local_theory_to_proof @{command_keyword \"applicative\"}\n  \"register applicative functors\"\n  (Parse.binding --\n    Scan.optional (@{keyword \"(\"} |-- Parse.list Parse.short_ident --| @{keyword \")\"}) [] --\n    (@{keyword \"for\"} |-- Parse.reserved \"pure\" |-- @{keyword \":\"} |-- Parse.term) --\n    (Parse.reserved \"ap\" |-- @{keyword \":\"} |-- Parse.term) --\n    Scan.option (Parse.reserved \"rel\" |-- @{keyword \":\"} |-- Parse.term) --\n    Scan.option (Parse.reserved \"set\" |-- @{keyword \":\"} |-- Parse.term) >>\n    Applicative.applicative_cmd)\\<close>\n\nML \\<open>Outer_Syntax.command @{command_keyword \"print_applicative\"}\n  \"print registered applicative functors\"\n  (Scan.succeed (Toplevel.keep (Applicative.print_afuns o Toplevel.context_of)))\\<close>\n\nattribute_setup applicative_unfold =\n  \\<open>Scan.lift (Scan.option Parse.name >> Applicative.add_unfold_attrib)\\<close>\n  \"register rules for unfolding into applicative expressions\"\n\nattribute_setup applicative_lifted =\n  \\<open>Scan.lift (Parse.name >> Applicative.forward_lift_attrib)\\<close>\n  \"lift an equation to an applicative functor\"\n\n\nsubsection \\<open>Overloaded applicative operators\\<close>\n\nconsts\n  pure :: \"'a \\<Rightarrow> 'b\"\n  ap :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'c\"\n\nbundle applicative_syntax\nbegin\n  notation ap (infixl \"\\<diamondop>\" 70)\nend\n\nhide_const (open) ap\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Applicative_Lifting/Applicative.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.6187804196836383, "lm_q1q2_score": 0.3335122634995642}}
{"text": "theory basicprime\n  imports\n    HHLProver.ContinuousInv\n    HHLProver.BigStepParallel\n    HHLProver.Complementlemma\nbegin\n\ntext \\<open>Variables\\<close>\n\ndefinition T :: char where \"T = CHR ''t''\"\ndefinition X :: char where \"X = CHR ''x''\"\ndefinition Y :: char where \"Y = CHR ''y''\"\ndefinition Z :: char where \"Z = CHR ''z''\"\ndefinition J :: char where \"J = CHR ''j''\"\ndefinition L :: char where \"L = CHR ''l''\"\ndefinition M :: char where \"M = CHR ''m''\"\ndefinition N :: char where \"N = CHR ''n''\"\n\nlemma vars_distinct [simp]: \"T \\<noteq> X\" \"T \\<noteq> Y\" \"T \\<noteq> Z\" \"T \\<noteq> J\" \"T \\<noteq> L\" \"T \\<noteq> M\" \"T \\<noteq> N\"\n                            \"X \\<noteq> T\" \"X \\<noteq> Y\" \"X \\<noteq> Z\" \"X \\<noteq> J\" \"X \\<noteq> L\" \"X \\<noteq> M\" \"X \\<noteq> N\"\n                            \"Y \\<noteq> T\" \"Y \\<noteq> X\" \"Y \\<noteq> Z\" \"Y \\<noteq> J\" \"Y \\<noteq> L\" \"Y \\<noteq> M\" \"Y \\<noteq> N\"\n                            \"Z \\<noteq> T\" \"Z \\<noteq> X\" \"Z \\<noteq> Y\" \"Z \\<noteq> J\" \"Z \\<noteq> L\" \"Z \\<noteq> M\" \"Z \\<noteq> N\"\n                            \"J \\<noteq> T\" \"J \\<noteq> X\" \"J \\<noteq> Y\" \"J \\<noteq> Z\" \"J \\<noteq> L\" \"J \\<noteq> M\" \"J \\<noteq> N\"\n                            \"L \\<noteq> T\" \"L \\<noteq> X\" \"L \\<noteq> Y\" \"L \\<noteq> Z\" \"L \\<noteq> J\" \"L \\<noteq> M\" \"L \\<noteq> N\"\n                            \"M \\<noteq> T\" \"M \\<noteq> X\" \"M \\<noteq> Y\" \"M \\<noteq> Z\" \"M \\<noteq> J\" \"M \\<noteq> L\" \"M \\<noteq> N\"\n                            \"N \\<noteq> T\" \"N \\<noteq> X\" \"N \\<noteq> Y\" \"N \\<noteq> Z\" \"N \\<noteq> J\" \"N \\<noteq> L\" \"N \\<noteq> M\"\n  unfolding T_def X_def Y_def Z_def J_def  L_def M_def N_def by auto\n\n\ntext \\<open>\n  Analysis of <x' = -x, t' = 1> by explicit solution.\n\\<close>\nlemma exp_1_subst:\n  \"(state2vec\n     (\\<lambda>a. (if a = T then \\<lambda>s. 1 else ((\\<lambda>_ _. 0)(X := \\<lambda>s. - s X)) a)\n          (vec2state v))) = (\\<chi> a. if a = T then 1 else if a = X then -v $ X else 0)\" for v\n  apply(auto simp add: state2vec_def)\n  using vec2state_def by auto\n  \nlemma exp_1_deriv_bounded:\n  \"bounded_linear (\\<lambda>v. \\<chi> a. if a = T then 0 else if a = X then - v $ X else 0)\"\n  apply (rule Real_Vector_Spaces.bounded_linear_intro[where K=1])\n    apply (auto simp add: plus_vec_def scaleR_vec_def)\n  by (simp add: norm_le_componentwise_cart)\n\nlemma exp_1_deriv:\n  \"((\\<lambda>v. \\<chi> a. if a = T then 1 else if a = X then - v $ X else 0) has_derivative\n      (\\<lambda>v. (\\<chi> a. if a = T then 0 else if a = X then - v $ X else 0)))\n     (at x)\"\nproof -\n  have a: \"((\\<chi> a. if a = T then 1 else if a = X then - y $ X else 0) -\n            (\\<chi> a. if a = T then 1 else if a = X then - x $ X else 0) -\n            (\\<chi> a. if a = T then 0 else if a = X then - (y - x) $ X else 0)) = (\\<chi> a. 0)\" for y\n    by (auto simp add: minus_vec_def)\n  show ?thesis\n    apply (rule has_derivativeI)\n     prefer 2\n    apply (rule tendstoI)\n     apply auto\n    subgoal for e\n      apply (subst a)\n      by (metis (mono_tags, lifting) eventuallyI mult.commute norm_zero\n          vector_space_over_itself.scale_zero_left zero_vec_def)\n    by (rule exp_1_deriv_bounded)\nqed\n\nlemma exp_1_1:\n  \"\\<Turnstile> {\\<lambda>s tr. s X > 0 \\<and> s T < P}\n       Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>s. - s X, T := \\<lambda>s. 1))) (\\<lambda>s. s T < P)\n      {\\<lambda>s tr. s X > 0}\"\n  apply (rule Valid_strengthen_post)\n  prefer 2\n   apply (rule Valid_ode_unique_solution_s_sp[where\n              d=\"\\<lambda>s. P - s T\" and\n              p = \"\\<lambda>s. (\\<lambda>t. s(X := s X * exp (-1 * t), T := s T + t))\" ] )\n     apply auto\n  subgoal for s\n    unfolding ODEsol_def has_vderiv_on_def\n    apply auto\n    apply (rule exI[where x=\"1\"])\n    apply auto\n     apply (rule has_vector_derivative_projI)\n    apply (auto simp add: state2vec_def)\n     prefer 2\n     apply (rule has_vector_derivative_eq_rhs)\n      apply (auto intro!: derivative_intros)[1]\n     apply (auto simp add: has_vector_derivative_def)\n    apply (rule has_derivative_eq_rhs)\n     apply (fast intro!: derivative_intros)[1]\n    by auto\n   apply(rule c1_implies_local_lipschitz[where\n            f'=\"(\\<lambda>_. Blinfun (\\<lambda>v. (\\<chi> a. if a = T then 0 else if a = X then -v $ X else 0)))\"])\n       apply (subst exp_1_subst) \n      apply (rule has_derivative_eq_rhs)\n        apply (rule exp_1_deriv)\n       apply (auto simp add: bounded_linear_Blinfun_apply exp_1_deriv_bounded)\n  apply(auto simp add: entails_def)\n  done\n\nlemma exp_1:\n \"\\<Turnstile> {\\<lambda>s tr. s X > 0}\n      Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>s. - s X, T := \\<lambda>s. 1))) (\\<lambda>s. s T < P)\n     {\\<lambda>s tr. s X > 0}\"\n  apply(rule Valid_pre_cases)\n   apply(rule exp_1_1)\n  apply (rule Valid_ode_not) by auto\n\n\ntext \\<open>\n  Analysis of <x' = x, t' = 1> by explicit solution\n\\<close>\nlemma exp_2_subst:\n  \"(state2vec\n     (\\<lambda>a. (if a = T then \\<lambda>s. 1 else ((\\<lambda>_ _. 0)(X := \\<lambda>s. s X)) a)\n          (vec2state v))) = ( \\<chi> a. if a = T then 1 else if a = X then v $ X else 0)\" for v\n  apply(auto simp add: state2vec_def)\n  using vec2state_def by auto\n\nlemma exp_2_deriv_bounded:\n  \"bounded_linear (\\<lambda>v. \\<chi> a. if a = T then 0 else if a = X then v $ X else 0)\"\n  apply (rule Real_Vector_Spaces.bounded_linear_intro[where K=1])\n    apply (auto simp add: plus_vec_def scaleR_vec_def)\n  by (simp add: norm_le_componentwise_cart)\n\nlemma exp_2_deriv:\n  \"((\\<lambda>v. \\<chi> a. if a = T then 1 else if a = X then v $ X else 0) has_derivative\n      (\\<lambda>v. (\\<chi> a. if a = T then 0 else if a = X then v $ X else 0)))\n     (at x)\"\nproof -\n  have a: \"((\\<chi> a. if a = T then 1 else if a = X then y $ X else 0) -\n            (\\<chi> a. if a = T then 1 else if a = X then x $ X else 0) -\n            (\\<chi> a. if a = T then 0 else if a = X then (y - x) $ X else 0)) = (\\<chi> a. 0)\" for y\n    by (auto simp add: minus_vec_def)\n  show ?thesis\n    apply (rule has_derivativeI)\n     prefer 2\n    apply (rule tendstoI)\n     apply auto\n    subgoal for e\n      apply (subst a)\n      by (metis (mono_tags, lifting) eventuallyI mult.commute norm_zero\n          vector_space_over_itself.scale_zero_left zero_vec_def)\n    by (rule exp_2_deriv_bounded)\nqed\n\nlemma exp_2_1:\n  \"\\<Turnstile> {\\<lambda>s tr. s X > 0 \\<and> s T < P}\n       Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>s. s X, T := \\<lambda>s. 1))) (\\<lambda>s. s T < P)\n      {\\<lambda>s tr. s X > 0}\"\n  apply (rule Valid_strengthen_post)\n  prefer 2\n  apply (rule Valid_ode_unique_solution_s_sp[where\n            d=\"\\<lambda>s. P - s T\" and\n            p = \"\\<lambda>s. (\\<lambda>t. s(X := s X * exp t, T := s T + t))\" ] )\n     apply auto\n  subgoal for s\n    unfolding ODEsol_def has_vderiv_on_def\n    apply auto\n    apply (rule exI[where x=\"1\"])\n    apply auto\n     apply (rule has_vector_derivative_projI)\n    apply (auto simp add: state2vec_def)\n    prefer 2\n    apply (rule has_vector_derivative_eq_rhs)\n      apply (auto intro!: derivative_intros)[1]\n     apply (auto simp add: has_vector_derivative_def)\n    apply (rule has_derivative_eq_rhs)\n     apply (fast intro!: derivative_intros)[1]\n    by auto\n  apply(rule c1_implies_local_lipschitz[where\n            f'=\"(\\<lambda>_. Blinfun (\\<lambda>v. (\\<chi> a. if a = T then 0 else if a = X then v $ X else 0)))\"])\n       apply (subst exp_2_subst) \n      apply (rule has_derivative_eq_rhs)\n        apply (rule exp_2_deriv)\n       apply (auto simp add: bounded_linear_Blinfun_apply exp_2_deriv_bounded)\n  apply (auto simp add: entails_def)\n  done\n\nlemma exp_2:\n  \"\\<Turnstile> {\\<lambda>s tr. s X > 0}\n       Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>s. s X, T := \\<lambda>s. 1))) (\\<lambda>s. s T < P)\n     {\\<lambda>s tr. s X > 0}\"\n  apply(rule Valid_pre_cases)\n   apply(rule exp_2_1)\n  apply(rule Valid_ode_not) by auto\n\n\ntext \\<open>\n  Analysis of <x' = -x + 1, t' = 1> by explicit solution.\n\\<close>\nlemma exp_3_subst:\n  \"(state2vec\n      (\\<lambda>a. (if a = T then \\<lambda>s. 1 else ((\\<lambda>_ _. 0)(X := \\<lambda>s. 1 - s X)) a)\n      (vec2state v))) = (\\<chi> a. if a = T then 1 else if a = X then 1 - v $ X else 0)\" for v\n  apply(auto simp add: state2vec_def)\n  using vec2state_def by auto\n\nlemma exp_3_deriv_bounded:\n  \"bounded_linear (\\<lambda>v. \\<chi> a. if a = T then 0 else if a = X then -v $ X else 0)\"\n  apply (rule Real_Vector_Spaces.bounded_linear_intro[where K=1])\n    apply (auto simp add: plus_vec_def scaleR_vec_def)\n  by (simp add: norm_le_componentwise_cart)\n\nlemma exp_3_deriv:\n  \"((\\<lambda>v. \\<chi> a. if a = T then 1 else if a = X then 1 - v $ X else 0) has_derivative\n      (\\<lambda>v. (\\<chi> a. if a = T then 0 else if a = X then -v $ X else 0)))\n     (at x)\"\nproof -\n  have a: \"((\\<chi> a. if a = T then 1 else if a = X then 1 - y $ X else 0) -\n            (\\<chi> a. if a = T then 1 else if a = X then 1 - x $ X else 0) -\n            (\\<chi> a. if a = T then 0 else if a = X then -(y - x) $ X else 0)) = (\\<chi> a. 0)\" for y\n    by (auto simp add: minus_vec_def)\n  show ?thesis\n    apply (rule has_derivativeI)\n     prefer 2\n    apply (rule tendstoI)\n     apply auto\n    subgoal for e\n      apply (subst a)\n      by (metis (mono_tags, lifting) eventuallyI mult.commute norm_zero\n          vector_space_over_itself.scale_zero_left zero_vec_def)\n    by (rule exp_3_deriv_bounded)\nqed\n\nlemma exp_3_1:\n  \"\\<Turnstile> {\\<lambda>s tr. s X > 0 \\<and> s T < P}\n     Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>s. - s X + 1, T := \\<lambda>s. 1))) (\\<lambda>s. s T < P)\n {\\<lambda>s tr. s X > 0}\"\n  apply (rule Valid_strengthen_post)\n  prefer 2\n   apply (rule Valid_ode_unique_solution_s_sp[where\n             d=\"\\<lambda>s. P - s T\" and\n             p = \"\\<lambda>s. (\\<lambda>t. s(X := (s X - 1) * exp (-t) + 1, T := s T + t))\" ] )\n     apply auto\n  subgoal for s\n    unfolding ODEsol_def has_vderiv_on_def\n    apply auto\n    apply (rule exI[where x=\"1\"])\n    apply auto\n     apply (rule has_vector_derivative_projI)\n    apply (auto simp add: state2vec_def)\n    prefer 2\napply (rule has_vector_derivative_eq_rhs)\n      apply (auto intro!: derivative_intros)[1]\n     apply (auto simp add: has_vector_derivative_def)\n    apply (rule has_derivative_eq_rhs)\n     apply (fast intro!: derivative_intros)[1]\n    by auto\n    apply(rule c1_implies_local_lipschitz[where f'=\"(\\<lambda>_. Blinfun (\\<lambda>v. (\\<chi> a. if a = T then 0 else if a = X then -v $ X else 0)))\"])\n       apply (subst exp_3_subst) \n      apply (rule has_derivative_eq_rhs)\n       apply (rule exp_3_deriv)\n       apply (auto simp add: bounded_linear_Blinfun_apply exp_3_deriv_bounded)\n  apply(auto simp add: entails_def)\n  subgoal premises pre for s\n  proof(cases \"s X \\<ge> 1\")\n    case True\n    then show ?thesis\n      using exp_ge_zero\n      by (smt mult_nonneg_nonneg)\n  next\n    case False\n    then have 1:\"s X - 1 < 0\" by auto\n    have 2:\"exp (s T - P) > 0\" by auto\n    have 3:\"exp (s T - P) < 1\" using pre by auto\n    have 4:\"(s X - 1) * exp (s T - P) > (s X - 1)\"\n      using 1 2 3 by auto\n    then show ?thesis using pre by auto\n  qed\n done\n\nlemma exp_3:\n  \"\\<Turnstile> {\\<lambda>s tr. s X > 0}\n     Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>s. -s X + 1, T := \\<lambda>s. 1))) (\\<lambda>s. s T < P)\n {\\<lambda>s tr. s X > 0}\"\n  apply(rule Valid_pre_cases)\n   apply(rule exp_3_1)\n  apply(rule Valid_ode_not) by auto\n\n\ntext \\<open>\n  Analysis of <x' = -y * x, t = 1> by Darboux invariants (with g = -y).\n\\<close>\nlemma exp_4:\n  \"\\<Turnstile> {\\<lambda>s tr. s X > 0}\n       Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>s. - s Y * s X, T := \\<lambda>s. 1))) (\\<lambda>s. s T < P)\n     {\\<lambda>s tr. s X > 0}\"\n  apply (rule Valid_dbx_s_g[where g=\"\\<lambda> s . - s Y\"])\n    apply clarify\n  unfolding vec2state_def\n    apply (fast intro!: derivative_intros)[1]\n   apply(auto simp add: state2vec_def)\n  apply(auto simp add: continuous_on_eq_continuous_within)\n  done\n\n\ntext \\<open>\n  Analysis of <x' = x, t' = 1>, to show x remains non-negative.\n\\<close>\nlemma exp_5_1:\n  \"\\<Turnstile> {\\<lambda>s tr. s X \\<ge> 0 \\<and> s T < P}\n       Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>s. s X, T := \\<lambda>s. 1))) (\\<lambda>s. s T < P)\n      {\\<lambda>s tr. s X \\<ge> 0}\"\n  apply (rule Valid_strengthen_post)\n  prefer 2\n   apply (rule Valid_ode_unique_solution_s_sp[where\n             d=\"\\<lambda>s. P - s T\" and\n             p = \"\\<lambda>s. (\\<lambda>t. s(X := s X * exp t, T := s T + t))\" ] )\n     apply auto\n  subgoal for s\n    unfolding ODEsol_def has_vderiv_on_def\n    apply auto\n    apply (rule exI[where x=\"1\"])\n    apply auto\n     apply (rule has_vector_derivative_projI)\n    apply (auto simp add: state2vec_def)\n    prefer 2\napply (rule has_vector_derivative_eq_rhs)\n      apply (auto intro!: derivative_intros)[1]\n     apply (auto simp add: has_vector_derivative_def)\n    apply (rule has_derivative_eq_rhs)\n     apply (fast intro!: derivative_intros)[1]\n    by auto\n    apply(rule c1_implies_local_lipschitz[where f'=\"(\\<lambda>_. Blinfun (\\<lambda>v. (\\<chi> a. if a = T then 0 else if a = X then  v $ X else 0)))\"])\n       apply (subst exp_2_subst) \n      apply (rule has_derivative_eq_rhs)\n        apply (rule exp_2_deriv)\n       apply (auto simp add: bounded_linear_Blinfun_apply exp_2_deriv_bounded)\n  apply(auto simp add: entails_def)\n  done\n\nlemma exp_5:\n \"\\<Turnstile> {\\<lambda>s tr. s X \\<ge> 0}\n      Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>s. s X, T := \\<lambda>s. 1))) (\\<lambda>s. s T < P)\n     {\\<lambda>s tr. s X \\<ge> 0}\"\n  apply(rule Valid_pre_cases)\n   apply (rule exp_5_1)\n   apply (rule Valid_ode_not) by auto\n\nend\n", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/CaseStudies/basic/basicprime.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.33350090520972675}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory HaskellLemmaBucket\nimports\n  HaskellLib_H\n  NonDetMonadLemmaBucket\nbegin\n\nlemma map_bits_to_bl:\n  \"map ((!!) x) [0..<size x] = reverse (to_bl x)\"\n  by (simp add: map_bits_rev_to_bl)\n\nlemma not_orList_is_replicate:\n  \"\\<not> orList ls \\<Longrightarrow> ls = replicate (length ls) False\"\nproof (induct ls rule: rev_induct)\n  case Nil thus ?case unfolding orList_def by simp\nnext\n  case (snoc l ls)\n\n  from snoc.prems have ol: \"\\<not> orList ls\" and nl: \"\\<not> l\" unfolding orList_def by auto\n  have \"ls = replicate (length ls) False\" by (rule snoc.hyps [OF ol])\n  thus ?case\n    by (rule ssubst) (simp add: nl replicate_app_Cons_same [where xs = \"[]\", simplified])\nqed\n\nlemma andList_Cons:\n  assumes al: \"andList $ map P (y # ys)\"\n  shows   \"P y\"\n  using al unfolding andList_def\n  by simp (induct rule: rev_induct, simp+)\n\nlemma andList_mapE:\n  assumes al: \"andList $ map P xs\"\n  and     xv: \"x \\<in> set xs\"\n  shows   \"P x\"\n  using al xv\nproof (induct xs arbitrary: x rule: rev_induct)\n  case Nil thus ?case by simp\nnext\n  case (snoc y ys)\n\n  show ?case\n  proof (cases \"x = y\")\n    case True\n    with snoc.prems show ?thesis by (simp add: andList_def)\n  next\n    case False\n    with snoc.prems show ?thesis\n      by (auto simp: andList_def intro!: snoc.hyps)\n  qed\nqed\n\nlemma andList_to_aligned:\n  assumes al: \"andList $ map (\\<lambda>x. x && mask pageBits = 0) xs\"\n  and     xv: \"x \\<in> set xs\"\n  shows   \"is_aligned x pageBits\"\nproof (subst is_aligned_mask)\n  from al show \"x && mask pageBits = 0\" by (rule andList_mapE) fact\nqed\n\n(* minimum/maximum *)\n\nlemma maximum_ge: \"x \\<in> set b \\<Longrightarrow> x \\<le> maximum b\"\n  unfolding maximum_def by (auto intro: Max_ge)\n\nlemma less_minimum_not_in:\n  \"\\<lbrakk> ls \\<noteq> []; x < minimum ls \\<rbrakk> \\<Longrightarrow> x \\<notin> set ls\"\n  unfolding minimum_def by auto\n\nlemma minimum_le_member:\n  \"\\<lbrakk> x \\<in> set ls; ls \\<noteq> []\\<rbrakk> \\<Longrightarrow> minimum ls \\<le> x\"\n  unfolding minimum_def\n  apply (rule Min_le)\n    apply simp\n   apply simp\n  done\n\nlemma minimum_map_distrib:\n  fixes f :: \"('a :: linorder) \\<Rightarrow> 'a\" and ls :: \"'a list\"\n  assumes minf: \"\\<And>x y. \\<lbrakk>x \\<in> set ls; y \\<in> set ls\\<rbrakk> \\<Longrightarrow> min (f x) (f y) = f (min x y)\"\n  and      lsn: \"ls \\<noteq> []\"\n  shows \"minimum (map f ls) = f (minimum ls)\"\n  unfolding minimum_def\n  apply simp\n  apply (rule Min_image_distrib)\n    apply (erule (1) minf)\n   apply simp\n  apply (simp add: lsn)\n  done\n\nlemma minimum_enum_upto:\n  fixes x :: \"'a::len word\"\n  assumes le: \"x \\<le> y\"\n  shows   \"minimum [x .e. y] = x\"\n  unfolding minimum_def using le by (auto intro!: MinI)\n\nlemma break_subsetsD:\n  \"break f xs = (ys, zs) \\<Longrightarrow> set ys \\<subseteq> set xs \\<and> set zs \\<subseteq> set xs\"\n  apply (induct xs arbitrary: ys zs)\n   apply simp\n  apply (case_tac \"break f xs\")\n  apply (elim meta_allE, drule(1) meta_mp)\n  apply (fastforce simp: split_def split: if_split_asm)\n  done\n\nlemma distinct_prop_breakD:\n  \"\\<lbrakk> distinct_prop P xs; break f xs = (ys, zs) \\<rbrakk>\n    \\<Longrightarrow> \\<forall>y \\<in> set ys. \\<forall>z \\<in> set zs. P y z\"\n  apply (induct xs arbitrary: ys zs)\n   apply simp\n  apply (simp add: split_def split: if_split_asm)\n  apply (case_tac \"break f xs\")\n  apply (elim meta_allE, drule(1) meta_mp)\n  apply (frule break_subsetsD)\n  apply fastforce\n  done\n\nlemma stateAssert_wp:\n  \"\\<lbrace>\\<lambda>s. P s \\<longrightarrow> Q () s\\<rbrace> stateAssert P e \\<lbrace>Q\\<rbrace>\"\n  by (clarsimp simp: stateAssert_def) wp\n\nlemma haskell_assert_wp:\n  \"\\<lbrace>\\<lambda>s. Q \\<longrightarrow> P s\\<rbrace> haskell_assert Q xs \\<lbrace>\\<lambda>_. P\\<rbrace>\"\n  by simp wp\n\nlemma init_append_last:\n  \"xs \\<noteq> [] \\<Longrightarrow> init xs @ [last xs] = xs\"\n  apply (induct xs rule: rev_induct)\n   apply simp\n  apply (simp add: init_def)\n  done\n\nlemma init_Snoc[simp]:\n  \"init (xs @ [x]) = xs\"\n  by (induct xs) (auto simp: init_def)\n\nlemma init_upto_enum_upt[simp]:\n  \"init [0.e.n] = [0..<n]\"\n  by (induct n) (auto simp: init_def)\n\nlemma no_fail_stateAssert:\n  \"no_fail P (stateAssert P xs)\"\n  apply (simp add: stateAssert_def)\n  apply (rule no_fail_pre, wp no_fail_bind)\n  apply simp\n  done\n\nlemma empty_fail_stateAssert:\n  \"empty_fail (stateAssert P s)\"\n  by (simp add: stateAssert_def assert_def empty_fail_get)\n\nlemma haskell_fail_wp:\n  \"\\<lbrace>\\<top>\\<rbrace> haskell_fail x \\<lbrace>P\\<rbrace>\"\n  by simp\n\nlemma no_fail_haskell_fail [simp, wp]:\n  \"no_fail \\<bottom> (haskell_fail xs)\"\n  by simp\n\nlemma in_assocs_is_fun:\n  \"(x \\<in> set (assocs f)) = (f (fst x) = snd x)\"\n  by (cases x) (auto simp add: assocs_def)\n\nlemma fun_is_in_assocs:\n  \"(f x = y) = ((x,y) \\<in> set (assocs f))\"\n  by (simp add: in_assocs_is_fun)\n\nlemma empty_set_is_null:\n  \"(set xs = {}) = null xs\"\n  by (clarsimp simp: null_def)\n\nlemma assert_into_when:\n  \"(assert P) = (when (\\<not> P) (haskell_fail []))\"\n  by (simp add: assert_def when_def)\n\nlemma const_apply:\n  \"const x y = x\"\n  by (simp add: const_def)\n\nlemma const_None_empty:\n  \"const None = Map.empty\"\n  by (rule ext, simp add: const_apply)\n\nlemma headM_tailM_Cons:\n  \"headM (x # xs) = return x\"\n  \"tailM (x # xs) = return xs\"\n  by (simp add: headM_def tailM_def)+\n\nlemma replicateM_mapM:\n  \"replicateM n f = mapM (\\<lambda>x. f) (replicate n ())\"\n  by (simp add: replicateM_def mapM_def)\n\nlemma orList_False:\n  \"(\\<not> orList bs) = (set bs \\<subseteq> {False})\"\n  apply (induct bs)\n  apply (simp_all add: orList_def foldl_True)\n  apply (case_tac a)\n  apply (simp_all add: orList_def foldl_True)\n  done\n\nlemma Cons_eq_tails:\n  \"((xs # xxs) = tails ys) = (ys = xs \\<and> xxs = tl (tails ys))\"\n  by (case_tac ys, auto)\n\nlemma findM_on_outcome':\n  assumes x: \"\\<And>x xs. \\<lbrace>\\<lambda>s. Q None s \\<and> x \\<in> fn s \\<and> set xs \\<subseteq> fn s\\<rbrace> f x\n                     \\<lbrace>\\<lambda>rv s. (rv \\<longrightarrow> Q (Some x) s) \\<and> (\\<not> rv \\<longrightarrow> Q None s \\<and> set xs \\<subseteq> fn s)\\<rbrace>\"\n  shows      \"\\<lbrace>\\<lambda>s. Q None s \\<and> set xs \\<subseteq> fn s\\<rbrace> findM f xs \\<lbrace>Q\\<rbrace>\"\n  apply (induct xs)\n   apply (simp, wp)\n  apply (simp, wp)\n   apply (rule x)\n  apply simp\n  done\n\n\nlemma findM_on_outcome:\n  assumes x: \"\\<And>x ys. x \\<in> set xs \\<Longrightarrow> \\<lbrace>Q None and I\\<rbrace> f x \\<lbrace>\\<lambda>rv s. (rv \\<longrightarrow> Q (Some x) s) \\<and> (\\<not> rv \\<longrightarrow> Q None s \\<and> I s)\\<rbrace>\"\n  shows      \"\\<lbrace>Q None and I\\<rbrace> findM f xs \\<lbrace>Q\\<rbrace>\"\n  apply (rule hoare_vcg_precond_imp)\n   apply (rule findM_on_outcome' [where fn=\"\\<lambda>s. if I s then set xs else {}\"])\n   apply (case_tac \"x \\<notin> set xs\")\n    apply simp\n   apply (simp cong: rev_conj_cong)\n   apply (case_tac \"\\<not> set xsa \\<subseteq> set xs\")\n    apply simp\n   apply simp\n   apply (rule hoare_vcg_precond_imp)\n    apply (rule hoare_post_imp [OF _ x])\n     apply clarsimp\n    apply assumption\n   apply simp\n  apply simp\n  done\n\nlemma in_set_tailsD: \"xs \\<in> set (tails ys) \\<Longrightarrow> set xs \\<subseteq> set ys\"\n  apply (induct ys)\n   apply simp\n  apply simp\n  apply (erule disjE)\n   apply simp\n  apply simp\n  apply blast\n  done\n\nlemma notin_set_tails_set:\n  \"x \\<notin> set xs \\<Longrightarrow> \\<forall>xs' \\<in> set (tails xs). \\<forall>x' \\<in> set xs'. x \\<noteq> x'\"\n  by (fastforce dest!: in_set_tailsD)\n\nlemma set_tails_set: \"(set (tails v) \\<subseteq> {x. set x \\<subseteq> S}) = (set v \\<subseteq> S)\"\n  apply (induct v, simp_all)\n  done\n\nlemma filter_assocs_Cons:\n  fixes v :: \"('a :: len) word\" shows\n  \"\\<lbrakk> f (v, g v); \\<forall>x < v. \\<not> f (x, g x) \\<rbrakk> \\<Longrightarrow>\n     filter f (assocs g) = (v, g v) # tl (filter f (assocs g))\"\n  apply (simp add: assocs_def)\n  apply (cut_tac v=v in enum_word_div)\n  apply clarsimp\n  apply (subst map_cong [OF _ refl], assumption)+\n  apply (simp(no_asm))\n  apply simp\n  done\n\nlemma snd_stateAssert_after:\n  \"\\<not> snd ((do _ \\<leftarrow> f; stateAssert R vs od) s) \\<Longrightarrow>\n  \\<not>snd (f s) \\<and> (\\<forall>(rv, s') \\<in> fst (f s). R s')\"\n  apply (clarsimp simp: bind_def stateAssert_def get_def assert_def\n      return_def fail_def split_def split: if_split_asm)\n  done\n\nlemma oblivious_stateAssert [simp]:\n  \"oblivious f (stateAssert g xs) = (\\<forall>s. g (f s) = g s)\"\n  apply (simp add: oblivious_def stateAssert_def exec_get\n                   assert_def return_def fail_def split: if_split)\n  apply auto\n  done\n\nlemma stateAssert_def2:\n  \"stateAssert f xs = do v \\<leftarrow> gets f; if v then return () else fail od\"\n  by (simp add: stateAssert_def gets_def assert_def)\n\nlemma findM_is_mapME:\n  \"(findM f xs >>= g)\n   = liftM (\\<lambda>_. ())\n      (doE ys \\<leftarrow> mapME_x (\\<lambda>x. do v \\<leftarrow> f x;\n                             if v then do g (Some x); throwError () od\n                             else returnOk () od) xs;\n              liftE (g None) odE)\"\n  apply (induct xs)\n   apply (simp add: mapME_x_def sequenceE_x_def liftM_def returnOk_bind)\n   apply (simp add: liftE_def)\n  apply (simp add: mapME_x_Cons bindE_assoc liftE_bindE[symmetric]\n                   liftM_def cong: if_cong)\n  apply (simp add: liftE_bindE bind_assoc)\n  apply (rule bind_cong[OF refl])\n  apply (simp add: bindE_assoc split: if_split)\n  apply (simp add: liftE_bindE bind_assoc throwError_bind)\n  done\n\ntext \\<open>Some word equalities can be solved by considering the\nproblem bitwise.\n\nThis is proven for all n < len_of TYPE ('a), which is different to\nrunning word_bitwise and expanding into an explicit list of bits.\n\\<close>\n\nlemmas word_eqI_solve_simps = word_and_le1 word_or_zero le_word_or2\n  shiftL_nat word_FF_is_mask word_1FF_is_mask neg_mask_bang nth_ucast\n  linorder_not_less word_size minus_one_norm word_ops_nth_size\n  is_aligned_nth nth_w2p nth_shiftl nth_shiftr conj_comms\n  less_2p_is_upper_bits_unset\n\nmethod word_eqI_solve = solves \\<open>rule word_eqI;\n  clarsimp simp: word_eqI_solve_simps;\n  (eval_int_nat; clarsimp simp: word_eqI_solve_simps)?;\n  fastforce simp: mask_def\n\\<close>\n\nadd_try_method word_eqI_solve\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/HaskellLemmaBucket.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.33350088841246134}}
{"text": "section \\<open>Shallow Embedding of LLVM Semantics\\<close>\ntheory LLVM_Shallow\nimports Main  \n  \"LLVM_Memory\"\nbegin\n  text \\<open>We define a type synonym for the LLVM monad\\<close>\n  type_synonym 'a llM = \"('a,unit,llvm_memory,err) M\"\n  translations\n    (type) \"'a llM\" \\<leftharpoondown> (type) \"('a, unit, llvm_memory, err) M\"\n  \n    \n\n  subsection \\<open>Shallow Embedding of Values\\<close>  \n\n  text \\<open>We use a type class to characterize types that can be injected into the value type.\n    We will instantiate this type class to obtain injections from types of shape \n    \\<open>T = T\\<times>T | _ word | _ ptr\\<close>\n  \n    Although, this type class can be instantiated by other types, those will not be accepted \n    by the code generator.\n    \n    We also define a class \\<open>llvm_repv\\<close>, which additionally contains \\<open>unit\\<close>. \n    This is required for void functions, and if-the-else statements that produce no result.\n    \n    Again, while this class might be instantiated for other types, those will be rejected\n    by the code generator.\n  \\<close>\n  \n  class llvm_repv  \n    \n  class llvm_rep = llvm_repv +\n    fixes to_val :: \"'a \\<Rightarrow> llvm_val\"\n      and from_val :: \"llvm_val \\<Rightarrow> 'a\"\n      and struct_of :: \"'a itself \\<Rightarrow> llvm_vstruct\"\n      and init :: 'a\n    assumes from_to_id[simp]: \"from_val o to_val = id\"\n    assumes to_from_id[simp]: \"llvm_vstruct v = struct_of TYPE('a) \\<Longrightarrow> to_val (from_val v) = v\"\n    assumes struct_of_matches[simp]: \"llvm_vstruct (to_val x) = (struct_of TYPE('a))\"\n    assumes init_zero: \"to_val init = llvm_zero_initializer (struct_of TYPE('a))\"\n    \n  begin\n  \n    lemma from_to_id'[simp]: \"from_val (to_val x) = x\" \n      using pointfree_idE[OF from_to_id] .\n  \n    lemma \"to_val x = to_val y \\<longleftrightarrow> x=y\"  \n      by (metis from_to_id')\n      \n  end\n  \n  text \\<open>We use a phantom type to attach the type of the pointed to value to a pointer.\\<close>\n  datatype 'a::llvm_rep ptr = PTR (the_raw_ptr: llvm_ptr)\n  definition null :: \"'a::llvm_rep ptr\" where \"null = PTR llvm_null\"\n  \n\n  text \\<open>We instantiate the type classes for the supported types, \n    i.e., unit, word, ptr, and prod.\\<close>\n  \n  instance unit :: llvm_repv by standard\n  \n  instantiation word :: (len) llvm_rep begin\n    definition \"to_val w \\<equiv> llvm_int (lconst (len_of TYPE('a)) (uint w))\"\n    definition \"from_val v \\<equiv> word_of_int (lint_to_uint (llvm_the_int v))\"\n    definition [simp]: \"struct_of_word (_::'a word itself) \\<equiv> llvm_s_int (len_of TYPE('a))\"\n    definition [simp]: \"init_word \\<equiv> 0::'a word\"\n    \n    \n    lemma int_inv_aux: \"width i = LENGTH('a) \\<Longrightarrow> lconst LENGTH('a) (uint (word_of_int (lint_to_uint i) :: 'a word)) = i\"\n      by (metis uint_const uint_eq uint_lower_bound uint_upper_bound width_lconst word_of_int_inverse word_ubin.norm_Rep)\n    \n    instance\n      apply standard\n      apply (rule ext)\n      apply (auto simp: from_val_word_def to_val_word_def)\n      apply (auto simp: llvm_s_int_def llvm_zero_initializer_def llvm_int_def)\n      subgoal for v apply (cases v) \n        apply (auto simp: llvm_int_def llvm_the_int_def llvm_s_ptr_def llvm_s_pair_def)\n        apply (simp add: llvm_vstruct_def int_inv_aux)\n      done\n      done\n      \n  end\n  \n  instantiation ptr :: (llvm_rep) llvm_rep begin\n    definition \"to_val \\<equiv> llvm_ptr o ptr.the_raw_ptr\"\n    definition \"from_val v \\<equiv> PTR (llvm_the_ptr v)\"\n    definition [simp]: \"struct_of_ptr (_::'a ptr itself) \\<equiv> llvm_s_ptr\"\n    definition [simp]: \"init_ptr::'a ptr \\<equiv> null\"\n  \n    instance\n      apply standard\n      apply (rule ext)\n      apply (auto simp: from_val_ptr_def to_val_ptr_def)\n      apply (auto simp: llvm_zero_initializer_def llvm_ptr_def llvm_s_ptr_def null_def llvm_null_def)\n      subgoal for v apply (cases v)\n        by (auto simp: llvm_s_int_def llvm_s_pair_def llvm_ptr_def llvm_the_ptr_def)\n      done\n      \n  end\n  \n  instantiation prod :: (llvm_rep, llvm_rep) llvm_rep begin\n    definition \"to_val_prod \\<equiv> \\<lambda>(a,b). llvm_pair (to_val a) (to_val b)\"\n    definition \"from_val_prod p \\<equiv> case llvm_the_pair p of (a,b) \\<Rightarrow> (from_val a, from_val b)\"\n    definition [simp]: \"struct_of_prod (_::('a\\<times>'b) itself) \\<equiv> llvm_s_pair (struct_of TYPE('a)) (struct_of TYPE('b))\"\n    definition [simp]: \"init_prod ::'a\\<times>'b \\<equiv> (init,init)\"\n    \n    instance\n      apply standard\n      apply (rule ext)\n      apply (auto simp: from_val_prod_def to_val_prod_def)\n      apply (auto simp: llvm_pair_def llvm_s_pair_def init_zero llvm_zero_initializer_def)\n      subgoal for v\n        apply (cases v)\n        apply (auto simp: llvm_s_int_def llvm_s_ptr_def llvm_pair_def llvm_the_pair_def \n          llvm_val.the_val_def llvm_vstruct_def split: prod.splits llvm_val.splits val.split)\n        done\n      done\n      \n  end\n\n  lemma to_val_prod_conv[simp]: \"to_val (a,b) = llvm_pair (to_val a) (to_val b)\"\n    unfolding to_val_prod_def by auto\n  \n  \n  text \\<open>Checked conversion from value\\<close>  \n  definition checked_from_val :: \"llvm_val \\<Rightarrow> 'a::llvm_rep llM\" where\n    \"checked_from_val v \\<equiv> doM {\n      fcheck (STATIC_ERROR ''Type mismatch'') (llvm_vstruct v = struct_of TYPE('a));\n      return (from_val v)\n    }\" \n\n      \n  subsection \\<open>Instructions\\<close>  \n  \n  text \\<open>The instructions are arranged in the order as they are described in the \n    LLVM Language Reference Manual \\<^url>\\<open>https://llvm.org/docs/LangRef.html\\<close>.\\<close>\n    \n  \n  subsubsection \\<open>Binary Operations\\<close>  \n  text \\<open>We define a generic lifter for binary arithmetic operations.\n    It is parameterized by an error condition.\n  \\<close> (* TODO: Use precondition instead of negated precondition! *)\n  \n  definition op_lift_arith2 :: \"_ \\<Rightarrow> _ \\<Rightarrow> 'a::len word \\<Rightarrow> 'a word \\<Rightarrow> 'a word llM\"\n    where \"op_lift_arith2 ovf f a b \\<equiv> doM {\n    let a = word_to_lint a;\n    let b = word_to_lint b;\n    fcheck (OVERFLOW_ERROR) (\\<not>ovf a b);\n    return (lint_to_word (f a b))\n  }\"\n        \n  definition \"op_lift_arith2' \\<equiv> op_lift_arith2 (\\<lambda>_ _. False)\"\n\n  definition udivrem_is_undef :: \"lint \\<Rightarrow> lint \\<Rightarrow> bool\" \n    where \"udivrem_is_undef a b \\<equiv> lint_to_uint b=0\"\n  definition sdivrem_is_undef :: \"lint \\<Rightarrow> lint \\<Rightarrow> bool\" \n    where \"sdivrem_is_undef a b \\<equiv> lint_to_sint b=0 \\<or> sdivrem_ovf a b\"\n  \n  definition \"ll_add \\<equiv> op_lift_arith2' (+)\"\n  definition \"ll_sub \\<equiv> op_lift_arith2' (-)\"\n  definition \"ll_mul \\<equiv> op_lift_arith2' ( * )\"\n  definition \"ll_udiv \\<equiv> op_lift_arith2 udivrem_is_undef (div)\"\n  definition \"ll_urem \\<equiv> op_lift_arith2 udivrem_is_undef (mod)\"\n  definition \"ll_sdiv \\<equiv> op_lift_arith2 sdivrem_is_undef (sdiv)\"\n  definition \"ll_srem \\<equiv> op_lift_arith2 sdivrem_is_undef (smod)\"\n  \n  \n  subsubsection \\<open>Compare Operations\\<close>\n  definition op_lift_cmp :: \"_ \\<Rightarrow> 'a::len word \\<Rightarrow> 'a word \\<Rightarrow> 1 word llM\"\n    where \"op_lift_cmp f a b \\<equiv> doM {\n    let a = word_to_lint a;\n    let b = word_to_lint b;\n    return (lint_to_word (bool_to_lint (f a b)))\n  }\"\n    \n  definition op_lift_ptr_cmp :: \"_ \\<Rightarrow> 'a::llvm_rep ptr \\<Rightarrow> 'a ptr \\<Rightarrow> 1 word llM\"\n    where \"op_lift_ptr_cmp f a b \\<equiv> doM {\n    return (lint_to_word (bool_to_lint (f a b)))\n  }\"\n  \n  definition \"ll_icmp_eq \\<equiv>  op_lift_cmp (=)\"\n  definition \"ll_icmp_ne \\<equiv>  op_lift_cmp (\\<noteq>)\"\n  definition \"ll_icmp_sle \\<equiv> op_lift_cmp (\\<le>\\<^sub>s)\"\n  definition \"ll_icmp_slt \\<equiv> op_lift_cmp (<\\<^sub>s)\"\n  definition \"ll_icmp_ule \\<equiv> op_lift_cmp (\\<le>)\"\n  definition \"ll_icmp_ult \\<equiv> op_lift_cmp (<)\"\n\n  text \\<open>Note: There are no pointer compare instructions in LLVM. \n    To compare pointers in LLVM, they have to be casted to integers first.\n    However, our abstract memory model cannot assign a bit-width to pointers.\n    \n    Thus, we model pointer comparison instructions in our semantics, and let the \n    code generator translate them to integer comparisons. \n    \n    Up to now, we only model pointer equality. \n    For less-than, suitable preconditions are required, which are consistent with the \n    actual memory layout of LLVM. We could, e.g., adopt the rules from the C standard here.\n  \\<close>\n  definition \"ll_ptrcmp_eq \\<equiv> op_lift_ptr_cmp (=)\"\n  definition \"ll_ptrcmp_ne \\<equiv> op_lift_ptr_cmp (\\<noteq>)\"\n  \n\n  \n  subsubsection \\<open>Bitwise Binary Operations\\<close>  \n  definition \"shift_ovf a n \\<equiv> nat (lint_to_uint n) \\<ge> width a\"\n  definition \"bitSHL' a n \\<equiv> bitSHL a (nat (lint_to_uint n))\"\n  definition \"bitASHR' a n \\<equiv> bitASHR a (nat (lint_to_uint n))\"\n  definition \"bitLSHR' a n \\<equiv> bitLSHR a (nat (lint_to_uint n))\"\n  \n  definition \"ll_shl \\<equiv> op_lift_arith2 shift_ovf bitSHL'\"  \n  definition \"ll_lshr \\<equiv> op_lift_arith2 shift_ovf bitLSHR'\"  \n  definition \"ll_ashr \\<equiv> op_lift_arith2 shift_ovf bitASHR'\"\n  \n  definition \"ll_and \\<equiv> op_lift_arith2' (AND)\"\n  definition \"ll_or \\<equiv> op_lift_arith2' (OR)\"\n  definition \"ll_xor \\<equiv> op_lift_arith2' (XOR)\"\n    \n\n  subsubsection \\<open>Aggregate Operations\\<close>\n  text \\<open>In LLVM, there is an \\<open>extractvalue\\<close> and \\<open>insertvalue\\<close> operation.\n    In our shallow embedding, these get instantiated for \\<open>fst\\<close> and \\<open>snd\\<close>.\\<close>\n    \n  \n  definition \"checked_split_pair v \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Expected pair'') (llvm_is_pair v);\n    return (llvm_the_pair v)\n  }\"\n  \n  definition ll_extract_fst :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>1::llvm_rep llM\" where \"ll_extract_fst p = doM { (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val a }\"\n  definition ll_extract_snd :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>2::llvm_rep llM\" where \"ll_extract_snd p = doM { (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val b }\"\n  definition ll_insert_fst :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>1::llvm_rep \\<Rightarrow> 't llM\" where \"ll_insert_fst p x = doM { (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val (llvm_pair (to_val x) b) }\" \n  definition ll_insert_snd :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>2::llvm_rep \\<Rightarrow> 't llM\" where \"ll_insert_snd p x = doM { (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val (llvm_pair a (to_val x)) }\" \n    \n  (*  \n  definition ll_extract_fst :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'a llM\" where \"ll_extract_fst ab \\<equiv> return (fst ab)\"\n  definition ll_extract_snd :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'b llM\" where \"ll_extract_snd ab \\<equiv> return (snd ab)\"\n  definition ll_insert_fst :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'a \\<Rightarrow> ('a\\<times>'b) llM\" where \"ll_insert_fst ab a \\<equiv> return (a,snd ab)\"\n  definition ll_insert_snd :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'b \\<Rightarrow> ('a\\<times>'b) llM\" where \"ll_insert_snd ab b \\<equiv> return (fst ab,b)\"\n  *)\n    \n  subsubsection \\<open>Memory Access and Addressing Operations\\<close>\n    \n  definition ll_load :: \"'a::llvm_rep ptr \\<Rightarrow> 'a llM\" where\n    \"ll_load p \\<equiv> doM {\n      r \\<leftarrow> llvm_load (the_raw_ptr p);\n      checked_from_val r\n    }\"\n    \n  definition ll_store :: \"'a::llvm_rep \\<Rightarrow> 'a ptr \\<Rightarrow> unit llM\" where\n    \"ll_store v p \\<equiv> llvm_store (to_val v) (the_raw_ptr p)\"\n\n  text \\<open>Note that LLVM itself does not have malloc and free instructions.\n    However, these are primitive instructions in our abstract memory model, \n    such that we have to model them in our semantics.\n    \n    The code generator will map them to the C standard library \n    functions \\<open>calloc\\<close> and \\<open>free\\<close>.\n  \\<close>\n    \n  definition ll_malloc :: \"'a::llvm_rep itself \\<Rightarrow> _::len word \\<Rightarrow> 'a ptr llM\" where\n    \"ll_malloc TYPE('a) n = doM {\n      fcheck MEM_ERROR (unat n > 0); \\<comment> \\<open>Disallow empty malloc\\<close>\n      r \\<leftarrow> llvm_allocn (to_val (init::'a)) (unat n);\n      return (PTR r)\n    }\"\n        \n  definition ll_free :: \"'a::llvm_rep ptr \\<Rightarrow> unit llM\" \n    where \"ll_free p \\<equiv> llvm_free (the_raw_ptr p)\"\n\n\n  text \\<open>As for the aggregate operations, the \\<open>getelementptr\\<close> instruction is instantiated \n    for pointer indexing, fst, and snd. \\<close>\n      \n  definition ll_ofs_ptr :: \"'a::llvm_rep ptr \\<Rightarrow> _::len word \\<Rightarrow> 'a ptr llM\" where \"ll_ofs_ptr p ofs = doM {\n    r \\<leftarrow> llvm_checked_idx_ptr (the_raw_ptr p) (sint ofs);\n    return (PTR r)\n  }\"  \n\n  definition ll_gep_fst :: \"'p::llvm_rep ptr \\<Rightarrow> 'a::llvm_rep ptr llM\" where \"ll_gep_fst p = doM {\n    fcheck (STATIC_ERROR ''gep_fst: Expected pair type'') (llvm_is_s_pair (struct_of TYPE('p)));\n    r \\<leftarrow> llvm_checked_gep (the_raw_ptr p) PFST;\n    return (PTR r)\n  }\"\n\n  definition ll_gep_snd :: \"'p::llvm_rep ptr \\<Rightarrow> 'b::llvm_rep ptr llM\" where \"ll_gep_snd p = doM {\n    fcheck (STATIC_ERROR ''gep_snd: Expected pair type'') (llvm_is_s_pair (struct_of TYPE('p)));\n    r \\<leftarrow> llvm_checked_gep (the_raw_ptr p) PSND;\n    return (PTR r)\n  }\"\n\n  subsubsection \\<open>Conversion Operations\\<close>\n  definition \"llb_trunc i w \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Trunc must go to smaller type'') (width i > w);\n    return (trunc w i)\n  }\"\n  \n  definition \"llb_sext i w \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Sext must go to greater type'') (width i < w);\n    return (sext w i)\n  }\"\n  \n  definition \"llb_zext i w \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Zext must go to greater type'') (width i < w);\n    return (zext w i)\n  }\"\n  \n  definition op_lift_iconv :: \"_ \\<Rightarrow> 'a::len word \\<Rightarrow> 'b::len word itself  \\<Rightarrow> 'b word llM\"\n    where \"op_lift_iconv f a _ \\<equiv> doM {\n    let a = word_to_lint a;\n    let w = LENGTH('b);\n    r \\<leftarrow> f a w;\n    return (lint_to_word r)\n  }\"\n  \n  definition \"ll_trunc \\<equiv> op_lift_iconv llb_trunc\"\n  definition \"ll_sext \\<equiv> op_lift_iconv llb_sext\"\n  definition \"ll_zext \\<equiv> op_lift_iconv llb_zext\"\n  \n    \n        \n        \n  subsection \\<open>Control Flow\\<close>  \n\n  text \\<open>Our shallow embedding uses a structured control flow, which allows\n    only sequential composition, if-then-else, and function calls.\n    \n    The code generator then maps sequential composition to basic blocks, \n    and if-then-else to a control flow graph with conditional branching.\n    Function calls are mapped to LLVM function calls.  \n   \\<close>\n  \n  text \\<open>We use the to Boolean conversion from word-lib. We re-state its semantics here.\\<close>\n    \n  lemma to_bool_as_lint_to_bool:\n    \"to_bool (w::1 word) = lint_to_bool (word_to_lint w)\"\n    unfolding to_bool_def word_to_lint_def\n    apply (clarsimp simp: ltrue_def lfalse_def lint_to_bool_def)\n    apply transfer\n    apply auto\n    by (metis bin_rest_BIT bin_rest_x2)\n  \n  lemma to_bool_eq[simp]: \"to_bool (w::1 word) \\<longleftrightarrow> w\\<noteq>0\"\n    by (rule to_bool_neq_0)\n  \n  definition llc_if :: \"1 word \\<Rightarrow> 'a::llvm_repv llM \\<Rightarrow> 'a llM \\<Rightarrow> 'a llM\" where\n    \"llc_if b t e \\<equiv> doM {\n      if to_bool b then t else e\n    }\"\n  \n  lemma llc_if_mono[partial_function_mono]:      \n    \"\\<lbrakk>monotone orda ordb F; monotone orda ordb G\\<rbrakk> \\<Longrightarrow> monotone orda ordb (\\<lambda>f. llc_if b (F f) (G f))\"\n    unfolding llc_if_def by pf_mono_prover\n\n  subsubsection \\<open>While-Combinator\\<close>\n  text \\<open>\n    Note that we also include the while combinator at this point, as we plan\n    to add direct translation of while to a control flow graph as an optional \n    feature of the code generator. \n    \n    In the current state, the code generator will recognize the while combinator, \n    but refuse to translate it.\n  \n    Note that the standard way of using a while combinator is to translate it to \n    a tail recursive function call, which the preprocessor can do automatically.\n  \\<close>\n    \n  definition llc_while :: \"('a::llvm_repv \\<Rightarrow> 1 word llM) \\<Rightarrow> ('a \\<Rightarrow> 'a llM) \\<Rightarrow> 'a \\<Rightarrow> 'a llM\" where\n    \"llc_while b f s\\<^sub>0 \\<equiv> mwhile (\\<lambda>s. b s \\<bind> return o to_bool) f s\\<^sub>0\"\n      \n  lemma gen_code_thm_llc_while:\n    assumes \"f \\<equiv> llc_while b body\"\n    shows \"f s = doM { ctd \\<leftarrow> b s; llc_if ctd (doM { s\\<leftarrow>body s; f s}) (return s)}\"\n    unfolding assms\n    unfolding llc_while_def llc_if_def\n    apply (rewrite mwhile_unfold)\n    by simp\n\n  (* 'Definition' of llc_while for presentation in paper: *)  \n  lemma \"llc_while b c s \\<equiv> doM { x \\<leftarrow> b s; llc_if x (doM {s\\<leftarrow>c s; llc_while b c s}) (return s) }\"\n    unfolding llc_while_def llc_if_def\n    apply (rewrite mwhile_unfold)\n    by simp\n    \n      \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/basic/kernel/LLVM_Shallow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.3334810397620536}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* A theory of guarded monadic bisimulation. *)\n\ntheory Bisim_UL\nimports\n  \"Monad_WP/NonDetMonadVCG\"\n  Corres_UL\n  EmptyFailLib\nbegin\n\n(* This still looks a bit wrong to me, although it is more or less what I want \\<emdash> we want to be\n   able to move hoare triples across bisimulations, and this allows guards to be left behind, more or less\ndefinition\n  \"bisim_underlying SR R P P' m m' \\<equiv>\n    \\<forall>s s'. SR s s' \\<longrightarrow> (P s \\<longrightarrow> (\\<forall>(r, t) \\<in> fst (m s). \\<exists>(r', t') \\<in> fst (m' s'). R r r' \\<and> SR t t')) \\<and>\n                       (P' s' \\<longrightarrow> (\\<forall>(r', t') \\<in> fst (m' s'). \\<exists>(r, t) \\<in> fst (m s). R r r' \\<and> SR t t'))\"\n*)\n\ndefinition\n  bisim_underlying :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('c \\<Rightarrow> 'd \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> ('b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> (('c \\<times> 'a) set) \\<times> bool) \\<Rightarrow> ('b \\<Rightarrow> (('d \\<times> 'b) set) \\<times> bool) \\<Rightarrow> bool\"\nwhere\n  \"bisim_underlying SR R P P' m m' \\<equiv>\n    \\<forall>s s'. SR s  s' \\<and> P s \\<and> P' s' \\<longrightarrow> ((\\<forall>(r, t) \\<in> fst (m s). \\<exists>(r', t') \\<in> fst (m' s'). R r r' \\<and> SR t t') \\<and>\n                                      (\\<forall>(r', t') \\<in> fst (m' s'). \\<exists>(r, t) \\<in> fst (m s). R r r' \\<and> SR t t'))\"\n\n(*\nlemma bisim_is_corres_both_ways:\n  \"bisim_underlying SR R P P' m m' = (corres_underlying SR False R P P' m m' \\<and> corres_underlying (converse SR) False (swp R) P' P m' m)\"\n  unfolding bisim_underlying_def corres_underlying_def\n  by (fastforce simp: swp_def Ball_def Bex_def)\n*)\n\nlemma bisim_valid:\n  assumes ac: \"bisim_underlying (op =)  (op =) P P' a a'\"\n  and     rl: \"\\<lbrace>Q\\<rbrace> a \\<lbrace>S\\<rbrace>\"\n  shows   \"\\<lbrace>P and P' and Q\\<rbrace> a' \\<lbrace>S\\<rbrace>\"\n  using ac rl\n  unfolding bisim_underlying_def valid_def\n  by (fastforce simp: split_def)\n\nlemma bisim_valid2:\n  assumes ac: \"bisim_underlying (op =) (op =) P P' a a'\"\n  and     rl: \"\\<lbrace>Q\\<rbrace> a' \\<lbrace>S\\<rbrace>\"\n  shows   \"\\<lbrace>P and P' and Q\\<rbrace> a \\<lbrace>S\\<rbrace>\"\n  using ac rl\n  unfolding bisim_underlying_def valid_def\n  by (fastforce simp: split_def)\n\nlemma bisim_underlyingI [consumes 0, case_names Left Right]:\n  assumes r1: \"\\<And>s s' r t. \\<lbrakk>SR s s'; P s; P' s'; (r, t) \\<in> fst (m s) \\<rbrakk> \\<Longrightarrow> \\<exists>(r', t') \\<in> fst (m' s'). R r r' \\<and> SR t t'\"\n  and     r2: \"\\<And>s s' r' t'. \\<lbrakk>SR s s'; P s; P' s'; (r', t') \\<in> fst (m' s') \\<rbrakk> \\<Longrightarrow> \\<exists>(r, t) \\<in> fst (m s). R r r' \\<and> SR t t'\"\n  shows   \"bisim_underlying SR R P P' m m'\"\n  unfolding bisim_underlying_def\n  by (fastforce dest: r1 r2 simp: split_def)\n\nlemma bisim_underlyingE1:\n  assumes bs: \"bisim_underlying SR R P P' m m'\"\n  and     sr: \"SR s s'\"\n  and     ps: \"P s\" \"P' s'\"\n  and     ms: \"(r, t) \\<in> fst (m s)\"\n  and     rl: \"\\<And>r' t'. \\<lbrakk> (r', t') \\<in> fst (m' s'); R r r'; SR t t' \\<rbrakk> \\<Longrightarrow> X\"\n  shows X\n  using bs sr ps ms unfolding bisim_underlying_def\n  by (fastforce intro: rl)\n\nlemma bisim_underlyingE2:\n  assumes bs: \"bisim_underlying SR R P P' m m'\"\n  and     sr: \"SR s s'\"\n  and     ps: \"P s\" \"P' s'\"\n  and     ms: \"(r', t') \\<in> fst (m' s')\"\n  and     rl: \"\\<And>r t. \\<lbrakk> (r, t) \\<in> fst (m s); R r r'; SR t t' \\<rbrakk> \\<Longrightarrow> X\"\n  shows X\n  using bs sr ps ms unfolding bisim_underlying_def\n  by (fastforce intro: rl)\n\nlemma bisim_split:\n  assumes ac: \"bisim_underlying SR R' P P' a c\"\n  and     bd: \"\\<And>r r'. R' r r' \\<Longrightarrow> bisim_underlying SR R (Q r) (Q' r') (b r) (d r')\"\n  and     v1: \"\\<lbrace>S\\<rbrace> a \\<lbrace>Q\\<rbrace>\"\n  and     v2: \"\\<lbrace>S'\\<rbrace> c \\<lbrace>Q'\\<rbrace>\"\n  shows \"bisim_underlying SR R (P and S) (P' and S') (a >>= b) (c >>= d)\"\n  using ac\n  apply -\n  apply (rule bisim_underlyingI)\n   apply (clarsimp simp: in_monad split_def)\n   apply (erule (4) bisim_underlyingE1)\n   apply (frule (1) use_valid [OF _ v1])\n   apply (frule (1) use_valid [OF _ v2])\n   apply (erule (4) bisim_underlyingE1 [OF bd])\n   apply (rename_tac r'' t'')\n   apply (rule_tac x = \"(r'', t'')\" in bexI)\n    apply clarsimp\n   apply (fastforce simp: in_monad)\n  apply (clarsimp simp: in_monad split_def)\n  apply (erule (4) bisim_underlyingE2)\n  apply (frule (1) use_valid [OF _ v1])\n  apply (frule (1) use_valid [OF _ v2])\n  apply (erule (4) bisim_underlyingE2 [OF bd])\n  apply (rename_tac r'' t'')\n   apply (rule_tac x = \"(r'', t'')\" in bexI)\n    apply clarsimp\n   apply (fastforce simp: in_monad)\n  done\n\nabbreviation\n  \"bisim \\<equiv> bisim_underlying (op =)\"\n\nlemma bisim_refl:\n  assumes rrefl: \"\\<And>r. R r r\"\n  shows \"bisim R P P' m m\"\n  apply (rule bisim_underlyingI)\n   apply (clarsimp simp: split_def)\n   apply (erule bexI [rotated])\n   apply (simp add: rrefl)\n  apply (clarsimp simp: split_def)\n  apply (erule bexI [rotated])\n  apply (simp add: rrefl)\n  done\n\nlemma bisim_guard_imp:\n  assumes bs: \"bisim_underlying SR R Q Q' m m'\"\n  and   rls: \"\\<And>s. P s \\<Longrightarrow> Q s\" \"\\<And>s. P' s \\<Longrightarrow> Q' s\"\n  shows \"bisim_underlying SR R P P' m m'\"\n  using bs rls\n  by (fastforce intro!: bisim_underlyingI elim: bisim_underlyingE1  bisim_underlyingE2)\n\nlemma bisim_return':\n  assumes Rxx: \"R x x'\"\n  shows \"bisim_underlying SR R P P' (return x) (return x')\"\n  apply (rule bisim_underlyingI)\n  apply (clarsimp simp: in_monad split_def Bex_def Rxx)\n  apply (clarsimp simp: in_monad split_def Bex_def Rxx)\n  done\n\nlemmas bisim_return = bisim_return' [where P = \\<top> and P' = \\<top>]\n\nlemma bisim_split_handle:\n  assumes bm: \"bisim (f' \\<oplus> r) Pn Pn' m m'\"\n  and     bc: \"\\<And>x x'. f' x x' \\<Longrightarrow> bisim (f \\<oplus> r) (Pf x) (Pf' x') (c x) (c' x')\"\n  and     v1: \"\\<lbrace>P\\<rbrace> m \\<lbrace>\\<lambda>_ _. True\\<rbrace>, \\<lbrace>Pf\\<rbrace>\"\n  and     v2: \"\\<lbrace>P'\\<rbrace> m' \\<lbrace>\\<lambda>_ _. True\\<rbrace>, \\<lbrace>Pf'\\<rbrace>\"\n  shows \"bisim (f \\<oplus> r) (Pn and P) (Pn' and P') (m <handle> c) (m' <handle> c')\"\n  unfolding handleE_def handleE'_def\n  apply (rule bisim_split [where Q = \"\\<lambda>r s. case_sum (\\<lambda>l. Pf l s) (\\<lambda>_. True) r\" and Q' = \"\\<lambda>r s. case_sum (\\<lambda>l. Pf' l s) (\\<lambda>_. True) r\", OF bm, folded validE_def])\n  apply (case_tac ra)\n   apply clarsimp\n   apply (erule bc)\n  apply clarsimp\n  apply (rule bisim_return')\n  apply simp\n  apply (rule v1)\n  apply (rule v2)\n  done\n\n(* Set up wpc *)\nlemma wpc_helper_bisim:\n  \"bisim_underlying SR r Q Q' f f' \\<Longrightarrow> wpc_helper (P, P') (Q, {s. Q' s}) (bisim_underlying SR r P (\\<lambda>s. s \\<in> P') f f')\"\n  apply (clarsimp simp: wpc_helper_def)\n  apply (erule bisim_guard_imp)\n   apply simp\n  apply fastforce\n  done\n\nwpc_setup \"\\<lambda>m. bisim_underlying SR r P P' a m\" wpc_helper_bisim\nwpc_setup \"\\<lambda>m. bisim_underlying SR r P P' a (m >>= c)\" wpc_helper_bisim\n\nlemma bisim_split_refl:\n  assumes bs: \"\\<And>r. bisim R (Q r) (Q' r) (b r) (d r)\"\n  and    v1: \"\\<lbrace>S\\<rbrace> a \\<lbrace>Q\\<rbrace>\"\n  and   v2: \"\\<lbrace>S'\\<rbrace> a \\<lbrace>Q'\\<rbrace>\"\n  shows \"bisim R S S' (a >>= b) (a >>= d)\"\n  apply (rule bisim_guard_imp)\n  apply (rule bisim_split [OF _ _ v1 v2])\n   apply (rule bisim_refl [where P = \\<top> and P' = \\<top> and R = \"op =\", OF refl])\n  apply simp\n  apply (rule bs)\n  apply simp_all\n  done\n\nlemma bisim_throwError':\n  \"f e e' \\<Longrightarrow> bisim_underlying SR (f \\<oplus> R') P P' (throwError e) (throwError e')\"\n  apply (rule bisim_underlyingI)\n  apply (clarsimp simp: in_monad Bex_def)+\n  done\n\nlemmas bisim_throwError = bisim_throwError' [where P = \\<top> and P' = \\<top>]\n\nlemma bisim_splitE:\n  assumes ac: \"bisim_underlying SR (f \\<oplus> R') P P' a c\"\n  and     bd: \"\\<And>r r'. R' r r' \\<Longrightarrow> bisim_underlying SR (f \\<oplus> R) (Q r) (Q' r') (b r) (d r')\"\n  and     v1: \"\\<lbrace>S\\<rbrace> a \\<lbrace>Q\\<rbrace>, -\"\n  and     v2: \"\\<lbrace>S'\\<rbrace> c \\<lbrace>Q'\\<rbrace>, -\"\n  shows \"bisim_underlying SR (f \\<oplus> R) (P and S) (P' and S') (a >>=E b) (c >>=E d)\"\n  apply (simp add: bindE_def lift_def[abs_def])\n  apply (rule bisim_split [where Q = \"\\<lambda>r s. case_sum  (\\<lambda>_. True) (\\<lambda>l. Q l s) r\" and Q' = \"\\<lambda>r s. case_sum  (\\<lambda>_. True) (\\<lambda>l. Q' l s) r\", OF ac, folded validE_def, folded validE_R_def])\n  apply (case_tac r')\n   apply clarsimp\n   apply (erule bisim_throwError')\n  apply clarsimp\n  apply (erule bd)\n  apply (rule v1)\n  apply (rule v2)\n  done\n\nlemma bisim_split_reflE:\n  assumes ab: \"\\<And>r. bisim (f \\<oplus> R) (Q r) (Q' r) (a r) (b r)\"\n  and     v1: \"\\<lbrace>S\\<rbrace> m \\<lbrace>Q\\<rbrace>, -\"\n  and     v2: \"\\<lbrace>S'\\<rbrace> m \\<lbrace>Q'\\<rbrace>, -\"\n  and  refls: \"\\<And>e. f e e\" \"\\<And>r. R r r\"\n  shows \"bisim (f \\<oplus> R) S S' (m >>=E a) (m >>=E b)\"\n  using refls\n  apply -\n  apply (rule bisim_guard_imp)\n  apply (rule bisim_splitE [where R' = \"op =\", OF _ _ v1 v2])\n  apply (rule bisim_refl)\n  apply (case_tac r, simp_all)[1]\n  apply simp\n  apply (rule ab)\n  apply simp+\n  done\n\nlemma bisim_split_bind_case_sum:\n  \"\\<lbrakk>bisim_underlying sr (lr \\<oplus> rr) P P' a d;\n   \\<And>rv rv'. lr rv rv' \\<Longrightarrow> bisim_underlying sr r (R rv) (R' rv') (b rv) (e rv');\n   \\<And>rv rv'. rr rv rv' \\<Longrightarrow> bisim_underlying sr r (S rv) (S' rv') (c rv) (f rv'); \\<lbrace>Q\\<rbrace> a \\<lbrace>S\\<rbrace>, \\<lbrace>R\\<rbrace>; \\<lbrace>Q'\\<rbrace> d \\<lbrace>S'\\<rbrace>, \\<lbrace>R'\\<rbrace>\\<rbrakk>\n  \\<Longrightarrow> bisim_underlying sr r (P and Q) (P' and Q') (a >>= case_sum b c) (d >>= case_sum e f)\"\n  apply (erule bisim_split [where Q = \"\\<lambda>rv s. case_sum (\\<lambda>l. R l s) (\\<lambda>r. S r s) rv\" and Q' = \"\\<lambda>rv s. case_sum (\\<lambda>l. R' l s) (\\<lambda>r. S' r s) rv\", folded validE_def])\n   apply (case_tac r')\n    apply clarsimp\n   apply clarsimp\n  apply assumption+\n  done\n\nlemma bisim_liftE [simp]:\n  \"bisim_underlying SR (f \\<oplus> R) P P' (liftE a) (liftE b) = bisim_underlying SR R P P' a b\"\n  by (fastforce simp: in_monad intro: bisim_underlyingI elim: bisim_underlyingE1  bisim_underlyingE2)\n\nlemma bisim_when:\n  assumes bs:  \"b \\<Longrightarrow> bisim_underlying SR R P P' m m'\"\n  and     rr: \"R () ()\"\n  shows   \"bisim_underlying SR R (\\<lambda>s. b \\<longrightarrow> P s) (\\<lambda>s. b \\<longrightarrow> P' s) (when b m) (when b m')\"\n  using assms\n  apply (cases b, simp_all add: when_def)\n  apply (erule bisim_return)\n  done\n\n\n(* not really used *)\ndefinition\n  \"det_on P f \\<equiv> \\<forall>s. P s \\<longrightarrow> (\\<exists>r. f s = ({r}, False))\"\n\nlemma det_onE:\n  \"\\<lbrakk>det_on P f; P s; \\<And>r s'. \\<lbrakk> (r, s') \\<in> fst (f s); \\<not> snd (f s)\\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  unfolding det_on_def by fastforce\n\nlemma bisim_noop_det_on:\n  assumes a: \"\\<And>s. \\<lbrace>Pa and op = s\\<rbrace> a \\<lbrace>\\<lambda>_. op = s\\<rbrace>\"\n  and     b: \"\\<And>s. \\<lbrace>Pb and op = s\\<rbrace> b \\<lbrace>\\<lambda>_. op = s\\<rbrace>\"\n  and    da: \"det_on P a\"\n  and    db: \"det_on P' b\"\n  shows   \"bisim_underlying sr dc (Pa and P) (Pb and P') a b\"\n  using da db\n  apply -\n  apply (rule bisim_underlyingI)\n  apply clarsimp\n  apply (erule (1) det_onE)+\n  apply (frule use_valid [OF _ a], fastforce)\n  apply (frule use_valid [OF _ b], fastforce)\n  apply fastforce\n\n  apply clarsimp\n  apply (erule (1) det_onE)+\n  apply (frule use_valid [OF _ a], fastforce)\n  apply (frule use_valid [OF _ b], fastforce)\n  apply fastforce\n  done\n\nlemma det_on_gets:\n  \"det_on \\<top> (gets f)\" unfolding det_on_def\n  by (clarsimp simp: gets_def return_def bind_def get_def)\n\nlemma hoare_gen_asmE':\n  \"(P \\<Longrightarrow> \\<lbrace>P'\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>R\\<rbrace>) \\<Longrightarrow> \\<lbrace>P' and K P\\<rbrace> f \\<lbrace>Q\\<rbrace>, \\<lbrace>R\\<rbrace>\"\n  unfolding validE_def\n  by (erule hoare_gen_asm)\n\nlemma det_onE':\n  \"\\<lbrakk>det_on P f; P s; \\<And>r s'. \\<lbrakk> f s = ({(r, s')}, False)\\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  unfolding det_on_def by fastforce\n\n(* ugh *)\nlemma det_on_guard_imp [wp_comb]:\n  assumes da: \"det_on P' a\"\n  and   \"\\<And>s. P s \\<Longrightarrow> P' s\"\n  shows \"det_on P a\"\n  using assms unfolding det_on_def by auto\n\nlemma det_on_split [wp_split]:\n  assumes da: \"det_on Pa a\"\n  and     db: \"\\<And>x. det_on (Pb x) (b x)\"\n  and      v: \"\\<lbrace>Pb'\\<rbrace> a \\<lbrace>Pb\\<rbrace>\"\n  shows \"det_on (Pa and Pb') (a >>= b)\"\n  unfolding det_on_def using da\n  apply -\n  apply clarsimp\n  apply (erule (1) det_onE)\n  apply (frule (1) use_valid [OF _ v])\n  apply (erule det_onE' [OF da])\n  apply (erule det_onE' [OF db])\n  apply (clarsimp simp: bind_def split_def)\n  done\n\nlemma det_det_on:\n  \"det m \\<Longrightarrow> det_on \\<top> m\"\n  unfolding det_def det_on_def by auto\n\nlemma det_on_liftE [wp]:\n  \"det_on P m \\<Longrightarrow> det_on P (liftE m)\"\n  unfolding liftE_def\n  apply (rule det_on_guard_imp)\n  apply (erule det_on_split [OF _ det_det_on])\n   apply simp\n  apply wp\n  apply simp\n  done\n\nlemma det_on_lift [wp]:\n  \"(\\<And>y. det_on (P y) (m y)) \\<Longrightarrow> det_on (case_sum (\\<lambda>_. \\<top>) P x) (lift m x)\"\n  unfolding lift_def\n  by (auto simp: det_on_def throwError_def return_def split: sum.splits)\n\nlemma det_on_assert_opt [wp]:\n  \"det_on (\\<lambda>_. x \\<noteq> None) (assert_opt x)\"\n  unfolding det_on_def assert_opt_def by (fastforce split: option.splits simp: fail_def return_def)\n\nlemmas dets_to_det_on [wp] = det_det_on [OF det_gets] det_det_on [OF return_det]\n\n(* Set up wpc *)\nlemma wpc_helper_det_on:\n  \"det_on Q f \\<Longrightarrow> wpc_helper (P, P') (Q, Q') (det_on P f)\"\n  apply (clarsimp simp: wpc_helper_def det_on_def)\n  done\n\nwpc_setup \"\\<lambda>m. det_on P m\" wpc_helper_det_on\nwpc_setup \"\\<lambda>m. det_on P (m >>= c)\" wpc_helper_det_on\n\nlemma bisim_symb_exec_r_det_on:\n  assumes z: \"\\<And>rv. bisim_underlying sr r P (Q' rv) x (y rv)\"\n  assumes y: \"\\<lbrace>P'\\<rbrace> m \\<lbrace>Q'\\<rbrace>\"\n  assumes x: \"\\<And>s. \\<lbrace>Pe and op = s\\<rbrace> m \\<lbrace>\\<lambda>r. op = s\\<rbrace>\"\n  assumes nf: \"det_on Pd m\"\n  shows      \"bisim_underlying sr r P (P' and Pe and Pd) x (m >>= (\\<lambda>rv. y rv))\"\n  apply (rule bisim_guard_imp)\n    apply (subst gets_bind_ign [symmetric], rule bisim_split)\n      apply (rule bisim_noop_det_on [OF _ x det_on_gets])\n      apply wp\n      apply fastforce\n     apply (rule nf)\n    apply (rule z)\n   apply (wp y)+\n  apply simp+\n  done\n\ndefinition\n  not_empty :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b set \\<times> bool) \\<Rightarrow> bool\"\nwhere\n  \"not_empty P f \\<equiv> \\<forall>s. P s \\<longrightarrow> (fst (f s) \\<noteq> {})\"\n\nlemma not_emptyE:\n  \"\\<lbrakk> not_empty P f; P s; \\<And>r s'. \\<lbrakk> (r, s') \\<in> fst (f s)\\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  unfolding not_empty_def by fastforce\n\n(* ugh *)\nlemma not_empty_guard_imp [wp_comb]:\n  assumes da: \"not_empty P' a\"\n  and   \"\\<And>s. P s \\<Longrightarrow> P' s\"\n  shows \"not_empty P a\"\n  using assms unfolding not_empty_def by auto\n\nlemma not_empty_split [wp_split]:\n  assumes da: \"not_empty Pa a\"\n  and     db: \"\\<And>x. not_empty (Pb x) (b x)\"\n  and      v: \"\\<lbrace>Pb'\\<rbrace> a \\<lbrace>Pb\\<rbrace>\"\n  shows \"not_empty (Pa and Pb') (a >>= b)\"\n  unfolding not_empty_def using da\n  apply -\n  apply clarsimp\n  apply (erule (1) not_emptyE)\n  apply (frule (1) use_valid [OF _ v])\n  apply (erule not_emptyE [OF da])\n  apply (erule not_emptyE [OF db])\n  apply (fastforce simp: bind_def split_def)\n  done\n\nlemma not_empty_return [wp]:\n  \"not_empty \\<top> (return x)\"\n  unfolding not_empty_def\n  by (simp add: return_def)\n\nlemma not_empty_liftE [wp]:\n  assumes ne: \"not_empty P m\"\n  shows \"not_empty P (liftE m)\"\n  unfolding liftE_def\n  apply (rule not_empty_guard_imp)\n  apply (wp ne)\n  apply simp\n  done\n\nlemma not_empty_lift [wp]:\n  \"(\\<And>y. not_empty (P y) (m y)) \\<Longrightarrow> not_empty (case_sum (\\<lambda>_. \\<top>) P x) (lift m x)\"\n  unfolding lift_def\n  by (auto simp: not_empty_def throwError_def return_def split: sum.splits)\n\nlemma not_empty_assert_opt [wp]:\n  \"not_empty (\\<lambda>_. x \\<noteq> None) (assert_opt x)\"\n  unfolding not_empty_def assert_opt_def by (fastforce split: option.splits simp: fail_def return_def)\n\nlemma not_empty_gets [wp]:\n  \"not_empty \\<top> (gets f)\" unfolding not_empty_def\n  by (clarsimp simp: gets_def return_def bind_def get_def)\n\n(* Set up wpc *)\nlemma wpc_helper_not_empty:\n  \"not_empty Q f \\<Longrightarrow> wpc_helper (P, P') (Q, Q') (not_empty P f)\"\n  apply (clarsimp simp: wpc_helper_def not_empty_def)\n  done\n\nwpc_setup \"\\<lambda>m. not_empty P m\" wpc_helper_not_empty\nwpc_setup \"\\<lambda>m. not_empty P (m >>= c)\" wpc_helper_not_empty\n\nlemma bisim_noop:\n  assumes a: \"\\<And>s. \\<lbrace>Pa and op = s\\<rbrace> a \\<lbrace>\\<lambda>_. op = s\\<rbrace>\"\n  and     b: \"\\<And>s. \\<lbrace>Pb and op = s\\<rbrace> b \\<lbrace>\\<lambda>_. op = s\\<rbrace>\"\n  and    da: \"not_empty P a\"\n  and    db: \"not_empty P' b\"\n  shows   \"bisim_underlying sr dc (Pa and P) (Pb and P') a b\"\n  using da db\n  apply -\n  apply (rule bisim_underlyingI)\n  apply clarsimp\n  apply (erule (1) not_emptyE)+\n  apply (frule use_valid [OF _ a], fastforce)\n  apply (frule use_valid [OF _ b], fastforce)\n  apply fastforce\n\n  apply clarsimp\n  apply (erule (1) not_emptyE)+\n  apply (frule use_valid [OF _ a], fastforce)\n  apply (frule use_valid [OF _ b], fastforce)\n  apply fastforce\n  done\n\nlemma bisim_symb_exec_r:\n  assumes  z: \"\\<And>rv. bisim_underlying sr r P (Q' rv) x (y rv)\"\n  assumes  y: \"\\<lbrace>P'\\<rbrace> m \\<lbrace>Q'\\<rbrace>\"\n  assumes  x: \"\\<And>s. \\<lbrace>Pe and op = s\\<rbrace> m \\<lbrace>\\<lambda>r. op = s\\<rbrace>\"\n  assumes ne: \"not_empty Pd m\"\n  shows      \"bisim_underlying sr r P (P' and Pe and Pd) x (m >>= (\\<lambda>rv. y rv))\"\n  apply (rule bisim_guard_imp)\n    apply (subst gets_bind_ign [symmetric], rule bisim_split)\n      apply (rule bisim_noop [OF _ x not_empty_gets])\n      apply wp\n      apply fastforce\n     apply (rule ne)\n    apply (rule z)\n   apply (wp y)+\n  apply simp+\n  done\n\nlemma bisim_not_empty:\n  assumes bs: \"bisim r P P' m m'\"\n  and     ne: \"not_empty R m\"\n  shows   \"not_empty (P and P' and R) m'\"\n  unfolding not_empty_def using bs ne\n  apply clarsimp\n  apply (erule (1) not_emptyE)\n  apply (erule_tac s=s and s'=s in bisim_underlyingE1 [where SR = \"op =\"])\n      apply simp+\n  done\n\nlemma bisim_split_req:\n  assumes ac: \"bisim (op =) P P' a c\"\n  and     bd: \"\\<And>r. bisim R (Q r) (Q' r) (b r) (d r)\"\n  and     v1: \"\\<lbrace>S\\<rbrace> a \\<lbrace>\\<lambda>r. Q r and Q' r\\<rbrace>\"\n  shows \"bisim R (P and S) P' (a >>= b) (c >>= d)\"\n  using ac\n  apply -\n  apply (rule bisim_underlyingI)\n   apply (clarsimp simp: in_monad split_def)\n   apply (erule bisim_underlyingE1)\n    apply simp\n    apply assumption+\n   apply (frule (1) use_valid [OF _ v1])\n   apply clarsimp\n   apply (rule bisim_underlyingE1 [OF bd])\n    apply simp\n    apply assumption+\n   apply (rename_tac r'' t'')\n   apply (rule_tac x = \"(r'', t'')\" in bexI)\n    apply clarsimp\n   apply (fastforce simp: in_monad)\n\n   apply (clarsimp simp: in_monad split_def)\n   apply (erule bisim_underlyingE2)\n    apply simp\n    apply assumption+\n   apply (frule (1) use_valid [OF _ v1])\n   apply clarsimp\n   apply (rule bisim_underlyingE2 [OF bd])\n    apply simp\n    apply assumption+\n   apply (rename_tac r'' t'')\n   apply (rule_tac x = \"(r'', t'')\" in bexI)\n    apply clarsimp\n   apply (fastforce simp: in_monad)\n  done\n\nlemma bisim_splitE_req:\n  assumes ac: \"bisim (f \\<oplus> op =) P P' a c\"\n  and     bd: \"\\<And>r. bisim (f \\<oplus> R) (Q r) (Q' r) (b r) (d r)\"\n  and     v1: \"\\<lbrace>S\\<rbrace> a \\<lbrace>\\<lambda>r. Q r and Q' r\\<rbrace>, -\"\n  shows \"bisim (f \\<oplus> R) (P and S) P' (a >>=E b) (c >>=E d)\"\n  using ac\n  apply -\n  apply (simp add: bindE_def lift_def[abs_def])\n  apply (rule bisim_underlyingI)\n   apply (clarsimp simp: in_monad split_def)\n   apply (erule bisim_underlyingE1)\n    apply simp\n    apply assumption+\n   apply (frule (1) use_valid [OF _ v1 [unfolded validE_R_def validE_def]])\n   apply clarsimp\n   apply (case_tac x)\n    apply (clarsimp simp: in_monad)\n    apply (rule_tac x = \"(Inl y', t')\" in bexI)\n    apply fastforce\n   apply (fastforce simp: in_monad)\n   apply clarsimp\n   apply (rule bisim_underlyingE1 [OF bd])\n    apply simp\n    apply assumption+\n   apply (rename_tac r'' t'')\n   apply (rule_tac x = \"(r'', t'')\" in bexI)\n    apply clarsimp\n   apply (fastforce simp: in_monad)\n\n   apply (clarsimp simp: in_monad split_def)\n   apply (erule bisim_underlyingE2)\n    apply simp\n    apply assumption+\n   apply (frule (1) use_valid [OF _ v1 [unfolded validE_R_def validE_def]])\n   apply clarsimp\n   apply (case_tac r)\n    apply (clarsimp simp: in_monad)\n    apply (rule_tac x = \"(Inl aa, s'')\" in bexI)\n    apply fastforce\n   apply (fastforce simp: in_monad)\n   apply clarsimp\n   apply (rule bisim_underlyingE2 [OF bd])\n    apply simp\n    apply assumption+\n   apply (rename_tac r'' t'')\n   apply (rule_tac x = \"(r'', t'')\" in bexI)\n    apply clarsimp\n   apply (fastforce simp: in_monad)\n  done\n\nlemma bisim_symb_exec_r_bs:\n  assumes bs: \"bisim op = R R' (return ()) m\"\n  and      z: \"\\<And>rv. bisim r P P' x (y rv)\"\n  shows      \"bisim r (P and R and P') R' x (m >>= (\\<lambda>rv. y rv))\"\n  apply (rule bisim_guard_imp)\n    apply (subst return_bind [symmetric, where f = \"\\<lambda>(_ :: unit).x\"],  rule bisim_split_req)\n    apply (rule bs)\n     apply (rule z)\n     apply wp\n   apply simp\n  apply simp+\n  done\n\nend\n", "meta": {"author": "carl88888", "repo": "filesystem", "sha": "2700e011249e8a675f675c5e0fd13efc1a0957f7", "save_path": "github-repos/isabelle/carl88888-filesystem", "path": "github-repos/isabelle/carl88888-filesystem/filesystem-2700e011249e8a675f675c5e0fd13efc1a0957f7/lib/Bisim_UL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443134, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.33348103128805157}}
{"text": "section \\<open>Implementation of Dijkstra's Algorithm\\<close>\ntheory Dijkstra_Impl\nimports \n  Dijkstra_Abstract\n  \"Directed_Graph_Impl\"\n  \"HOL-Library.While_Combinator\"\n  \"Priority_Search_Trees.PST_RBT\"\n  \"HOL-Data_Structures.RBT_Map\"\nbegin\n\nsubsection \\<open>Implementation using ADT Interfaces\\<close>\n\nlocale Dijkstra_Impl_Adts = \n  G: adt_finite_wgraph G_invar G_succ G_empty G_add G_\\<alpha>\n+ M: Map M_empty M_update M_delete M_lookup M_invar\n+ Q: PrioMap Q_empty Q_update Q_delete Q_invar Q_lookup Q_is_empty Q_getmin\n  \n  for G_\\<alpha> :: \"'g \\<Rightarrow> ('v) wgraph\" and G_invar G_succ G_empty G_add\n  \n  and M_empty M_update M_delete and M_lookup :: \"'m \\<Rightarrow> 'v \\<Rightarrow> nat option\" \n  and M_invar\n  \n  and Q_empty Q_update Q_delete Q_invar and Q_lookup :: \"'q \\<Rightarrow> 'v \\<Rightarrow> nat option\" \n  and Q_is_empty Q_getmin\nbegin\n\ntext \\<open>Simplifier setup\\<close>\nlemmas [simp] = G.wgraph_specs\nlemmas [simp] = M.map_specs\nlemmas [simp] = Q.prio_map_specs\n\nend  \n  \n\ncontext PrioMap begin\n\nlemma map_getminE:\n  assumes \"getmin m = (k,p)\" \"invar m\" \"lookup m \\<noteq> Map.empty\" \n  obtains \"lookup m k = Some p\" \"\\<forall>k' p'. lookup m k' = Some p' \\<longrightarrow> p\\<le>p'\"  \n  using map_getmin[OF assms]\n  by (auto simp: ran_def)\n    \nend\n\nlocale Dijkstra_Impl_Defs = Dijkstra_Impl_Adts where G_\\<alpha> = G_\\<alpha>\n  + Dijkstra \\<open>G_\\<alpha> g\\<close> s\n  for G_\\<alpha> :: \"'g \\<Rightarrow> ('v::linorder) wgraph\" and g s \n\n\nlocale Dijkstra_Impl = Dijkstra_Impl_Defs where G_\\<alpha> = G_\\<alpha>  \n  for G_\\<alpha> :: \"'g \\<Rightarrow> ('v::linorder) wgraph\" \n  +\n  assumes G_invar[simp]: \"G_invar g\"\nbegin  \n\nlemma finite_all_dnodes[simp, intro!]: \"finite all_dnodes\"\nproof -  \n  have \"all_dnodes \\<subseteq> Set.insert s (snd ` edges)\"\n    by (fastforce simp: all_dnodes_def edges_def image_iff)\n  also have \"finite \\<dots>\" by (auto simp: G.finite)\n  finally (finite_subset) show ?thesis .\nqed\n\nlemma finite_unfinished_dnodes[simp, intro!]: \"finite (unfinished_dnodes S)\"\n  using finite_subset[OF unfinished_nodes_subset] by auto\n  \n\nlemma (in -) fold_refine:\n  assumes \"I s\"\n  assumes \"\\<And>s x. I s \\<Longrightarrow> x\\<in>set l \\<Longrightarrow> I (f x s) \\<and> \\<alpha> (f x s) = f' x (\\<alpha> s)\"\n  shows \"I (fold f l s) \\<and> \\<alpha> (fold f l s) = fold f' l (\\<alpha> s)\"\n  using assms\n  by (induction l arbitrary: s) auto\n\ndefinition (in Dijkstra_Impl_Defs) \"Q_relax_outgoing u du V Q = fold (\\<lambda>(d,v) Q.\n  case Q_lookup Q v of \n    None \\<Rightarrow> if M_lookup V v \\<noteq> None then Q else Q_update v (du+d) Q\n  | Some d' \\<Rightarrow> Q_update v (min (du+d) d') Q) ((G_succ g u)) Q\"\n  \nlemma Q_relax_outgoing[simp]:\n  assumes [simp]: \"Q_invar Q\"\n  shows \"Q_invar (Q_relax_outgoing u du V Q) \n       \\<and> Q_lookup (Q_relax_outgoing u du V Q) \n          = relax_outgoing' u du (M_lookup V) (Q_lookup Q)\"\n  apply (subst relax_outgoing''_refine[symmetric, where l=\"G_succ g u\"])\n  apply simp\n  unfolding Q_relax_outgoing_def relax_outgoing''_def\n  apply (rule fold_refine[where I=Q_invar and \\<alpha>=Q_lookup])\n  by (auto split: option.split)\n  \ndefinition (in Dijkstra_Impl_Defs) \"D_invar_impl Q V \\<equiv> \n  Q_invar Q \\<and> M_invar V \\<and> D_invar' (Q_lookup Q) (M_lookup V)\"\n\ndefinition (in Dijkstra_Impl_Defs)\n  \"Q_initQ \\<equiv> Q_update s 0 Q_empty\"\n          \nlemma Q_init_Q[simp]:\n  shows \"Q_invar (Q_initQ)\" \"Q_lookup (Q_initQ) = initQ\"\n  by (auto simp: Q_initQ_def initQ_def)\n  \ndefinition (in Dijkstra_Impl_Defs)\n  \"M_initV \\<equiv> M_empty\"\n  \nlemma M_initS[simp]: \"M_invar M_initV\" \"M_lookup M_initV = initV\" \n  unfolding M_initV_def initV_def by auto\n\nterm Q_getmin\n\ndefinition (in Dijkstra_Impl_Defs) \n  \"dijkstra_loop \\<equiv> while (\\<lambda>(Q,V). \\<not> Q_is_empty Q) (\\<lambda>(Q,V). \n    let\n      (u,du) = Q_getmin Q;\n      Q = Q_relax_outgoing u du V Q;\n      Q = Q_delete u Q;\n      V = M_update u du V\n    in\n      (Q,V)\n  ) (Q_initQ,M_initV)\"\n\ndefinition (in Dijkstra_Impl_Defs) \"dijkstra \\<equiv> snd dijkstra_loop\"\n\nlemma transfer_preconditions:\n  assumes \"coupling Q V D S\"\n  shows \"Q u = Some du \\<longleftrightarrow> D u = enat du \\<and> u\\<notin>S\"\n  using assms\n  by (auto simp: coupling_def)\n\n\nlemma dijkstra_loop_invar_and_empty:\n  shows \"case dijkstra_loop of (Q,V) \\<Rightarrow> D_invar_impl Q V \\<and> Q_is_empty Q\"\n  unfolding dijkstra_loop_def\n  apply (rule while_rule[where \n        P=\"case_prod D_invar_impl\" \n    and r=\"inv_image finite_psubset (unfinished_dnodes' o M_lookup o snd)\"])\n  apply (all \\<open>(clarsimp split: prod.splits)?\\<close>)\n  subgoal\n    apply (simp add: D_invar_impl_def)\n    apply (simp add: D_invar'_def)\n    apply (intro exI conjI)\n    apply (rule coupling_init)\n    using initD_def initS_def invar_init by auto\nproof -  \n  fix Q V u du\n  assume \"\\<not> Q_is_empty Q\" \"D_invar_impl Q V\" \"Q_getmin Q = (u, du)\"\n  hence \"Q_lookup Q \\<noteq> Map.empty\" \"D_invar' (Q_lookup Q) (M_lookup V)\"\n    and [simp]: \"Q_invar Q\" \"M_invar V\"\n    and \"Q_lookup Q u = Some du\" \"\\<forall>k' p'. Q_lookup Q k' = Some p' \\<longrightarrow> du \\<le> p'\"\n    by (auto simp: D_invar_impl_def elim: Q.map_getminE)\n    \n  then obtain D S where \n    \"D_invar D S\" \n    and COUPLING: \"coupling (Q_lookup Q) (M_lookup V) D S\"  \n    and ABS_PRE: \"D u = enat du\" \"u\\<notin>S\" \"\\<forall>v. v \\<notin> S \\<longrightarrow> D u \\<le> D v\"\n    by (auto \n          simp: D_invar'_def transfer_preconditions less_eq_enat_def \n          split: enat.splits) \n    \n  then interpret Dijkstra_Invar \"G_\\<alpha> g\" s D S by simp\n    \n  have COUPLING': \"coupling \n    ((relax_outgoing' u du (M_lookup V) (Q_lookup Q))(u := None)) \n    (M_lookup V(u \\<mapsto> du)) \n    (relax_outgoing u D) \n    (Set.insert u S)\"  \n    using coupling_step[OF COUPLING \\<open>u\\<notin>S\\<close> \\<open>D u = enat du\\<close>] by auto\n    \n  show \"D_invar_impl (Q_delete u (Q_relax_outgoing u du V Q)) (M_update u du V)\"\n    using maintain_D_invar[OF \\<open>u\\<notin>S\\<close>] ABS_PRE\n    using COUPLING'\n    by (auto simp: D_invar_impl_def D_invar'_def)\n  \n  show \"unfinished_dnodes' (M_lookup (M_update u du V)) \n        \\<subset> unfinished_dnodes' (M_lookup V) \n      \\<and> finite (unfinished_dnodes' (M_lookup V))\"\n    using coupling_unfinished[OF COUPLING] coupling_unfinished[OF COUPLING']\n    using unfinished_nodes_decr[OF \\<open>u\\<notin>S\\<close>] ABS_PRE\n    by simp\nqed  \n  \nlemma dijkstra_correct: \n  \"M_invar dijkstra\" \n  \"M_lookup dijkstra u = Some d \\<longleftrightarrow> \\<delta> s u = enat d\"\n  using dijkstra_loop_invar_and_empty\n  unfolding dijkstra_def\n  apply -\n  apply (all \\<open>clarsimp simp: D_invar_impl_def\\<close>)\n  apply (clarsimp simp: D_invar'_def)\n  subgoal for Q V D S  \n    using Dijkstra_Invar.invar_finish_imp_correct[of \"G_\\<alpha> g\" s D S u]\n    apply (clarsimp simp: coupling_def)\n    by (auto simp: domIff)\n  done\n\n  \nend       \n\n\nsubsection \\<open>Instantiation of ADTs and Code Generation\\<close>\n\nglobal_interpretation \n  G: wgraph_by_map RBT_Set.empty RBT_Map.update \n                   RBT_Map.delete Lookup2.lookup RBT_Map.M.invar\n  defines G_empty = G.empty_graph\n      and G_add_edge = G.add_edge\n      and G_succ = G.succ\n  by unfold_locales\n\nglobal_interpretation Dijkstra_Impl_Adts\n  G.\\<alpha> G.invar G.succ G.empty_graph G.add_edge\n  \n  RBT_Set.empty RBT_Map.update RBT_Map.delete Lookup2.lookup RBT_Map.M.invar\n  \n  PST_RBT.empty PST_RBT.update PST_RBT.delete PST_RBT.PM.invar \n  Lookup2.lookup PST_RBT.rbt_is_empty pst_getmin\n  ..\n\nglobal_interpretation D: Dijkstra_Impl_Defs  \n  G.invar G.succ G.empty_graph G.add_edge\n  \n  RBT_Set.empty RBT_Map.update RBT_Map.delete Lookup2.lookup RBT_Map.M.invar\n  \n  PST_RBT.empty PST_RBT.update PST_RBT.delete PST_RBT.PM.invar \n  Lookup2.lookup PST_RBT.rbt_is_empty pst_getmin\n  \n  G.\\<alpha> g s for g and s::\"'v::linorder\"\n  defines dijkstra = D.dijkstra\n      and dijkstra_loop = D.dijkstra_loop\n      and Q_relax_outgoing = D.Q_relax_outgoing\n      and M_initV = D.M_initV\n      and Q_initQ = D.Q_initQ\n  ..\n  \n(* TODO: Why is this fix necessary? *)\nlemmas [code] =    \n  D.dijkstra_def D.dijkstra_loop_def  \n  \ncontext\n  fixes g\n  assumes [simp]: \"G.invar g\"  \nbegin  \n  \ninterpretation AUX: Dijkstra_Impl\n  G.invar G.succ G.empty_graph G.add_edge\n  \n  RBT_Set.empty RBT_Map.update RBT_Map.delete Lookup2.lookup RBT_Map.M.invar\n  \n  PST_RBT.empty PST_RBT.update PST_RBT.delete PST_RBT.PM.invar \n  Lookup2.lookup PST_RBT.rbt_is_empty pst_getmin\n  \n  g s G.\\<alpha> for s\n  by unfold_locales simp_all\n\nlemmas dijkstra_correct = AUX.dijkstra_correct[folded dijkstra_def]\n\nend  \n\nsubsection \\<open>Combination with Graph Parser\\<close>  \ntext \\<open>We combine the algorithm with a parser from lists to graphs\\<close>\n\nglobal_interpretation \n  G: wgraph_from_list_algo G.\\<alpha> G.invar G.succ G.empty_graph G.add_edge\n  defines from_list = G.from_list\n  ..\n  \n  \ndefinition \"dijkstra_list l s \\<equiv> \n  if valid_graph_rep l then Some (dijkstra (from_list l) s) else None\"\n\ntheorem dijkstra_list_correct:\n  \"case dijkstra_list l s of\n    None \\<Rightarrow> \\<not>valid_graph_rep l\n  | Some D \\<Rightarrow> \n        valid_graph_rep l \n      \\<and> M.invar D \n      \\<and> (\\<forall>u d. lookup D u = Some d \\<longleftrightarrow> WGraph.\\<delta> (wgraph_of_list l) s u = enat d)\"\n  unfolding dijkstra_list_def\n  by (auto simp: dijkstra_correct G.from_list_correct)\n\nexport_code dijkstra_list checking SML OCaml? Scala Haskell?\n  \nvalue \"dijkstra_list [(1::nat,2,7),(1,3,1),(3,2,2)] 1\"\nvalue \"dijkstra_list [(1::nat,2,7),(1,3,1),(3,2,2)] 3\"\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Prim_Dijkstra_Simple/Dijkstra_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.33348102281404934}}
{"text": "(*  Title:       Safe OCL\n    Author:      Denis Nikiforov, March 2019\n    Maintainer:  Denis Nikiforov <denis.nikif at gmail.com>\n    License:     LGPL\n*)\nchapter \\<open>Types\\<close>\ntheory OCL_Types\n  imports Tuple Errorable \"HOL-Library.Phantom_Type\"\nbegin\n\n(*** Definition *************************************************************)\n\nsection \\<open>Definition\\<close>\n\ntext \\<open>\n  Types are parameterized over classes.\\<close>\n\ntype_synonym 'a enum_type = \"('a, String.literal) phantom\"\ntype_synonym elit = String.literal\ntype_synonym telem = String.literal\ndatatype collection_kind =\n  CollectionKind | SetKind | OrderedSetKind | BagKind | SequenceKind\n\ndatatype (plugins del: size) 'a type =\n  OclAny\n| OclVoid\n\n| Boolean\n| Real\n| Integer\n| UnlimitedNatural\n| String\n\n| Enum \"'a enum_type\"\n| ObjectType 'a (\"\\<langle>_\\<rangle>\\<^sub>\\<T>\" [0] 1000)\n| Tuple \"telem \\<rightharpoonup>\\<^sub>f 'a type\\<^sub>N\"\n\n| Collection \"'a type\\<^sub>N\"\n| Set \"'a type\\<^sub>N\"\n| OrderedSet \"'a type\\<^sub>N\"\n| Bag \"'a type\\<^sub>N\"\n| Sequence \"'a type\\<^sub>N\"\n\n| Map \"'a type\\<^sub>N\" \"'a type\\<^sub>N\"\n\nand 'a type\\<^sub>N =\n  Required \"'a type\" (\"_[\\<^bold>1]\" [1000] 1000)\n| Optional \"'a type\" (\"_[\\<^bold>?]\" [1000] 1000)\n\n\ntype_synonym 'a type\\<^sub>N\\<^sub>E = \"'a type\\<^sub>N errorable\"\n\n\nprimrec type_size :: \"'a type \\<Rightarrow> nat\"\n    and type_size\\<^sub>N :: \"'a type\\<^sub>N \\<Rightarrow> nat\" where\n\n  \"type_size OclAny = 0\"\n| \"type_size OclVoid = 0\"\n\n| \"type_size Boolean = 0\"\n| \"type_size Real = 0\"\n| \"type_size Integer = 0\"\n| \"type_size UnlimitedNatural = 0\"\n| \"type_size String = 0\"\n\n| \"type_size (Enum \\<E>) = 0\"\n| \"type_size (ObjectType \\<C>) = 0\"\n| \"type_size (Tuple \\<pi>) = Suc (ffold tcf 0 (fset_of_fmap (fmmap type_size\\<^sub>N \\<pi>)))\"\n\n| \"type_size (Collection \\<tau>) = Suc (type_size\\<^sub>N \\<tau>)\"\n| \"type_size (Set \\<tau>) = Suc (type_size\\<^sub>N \\<tau>)\"\n| \"type_size (OrderedSet \\<tau>) = Suc (type_size\\<^sub>N \\<tau>)\"\n| \"type_size (Bag \\<tau>) = Suc (type_size\\<^sub>N \\<tau>)\"\n| \"type_size (Sequence \\<tau>) = Suc (type_size\\<^sub>N \\<tau>)\"\n\n| \"type_size (Map \\<tau> \\<sigma>) = Suc (type_size\\<^sub>N \\<tau> + type_size\\<^sub>N \\<sigma>)\"\n\n| \"type_size\\<^sub>N (Required \\<tau>) = Suc (type_size \\<tau>)\"\n| \"type_size\\<^sub>N (Optional \\<tau>) = Suc (type_size \\<tau>)\"\n\nlemma Tuple_type_size\\<^sub>N_intro [intro]:\n  \"\\<tau> |\\<in>| fmran \\<pi> \\<Longrightarrow>\n   type_size\\<^sub>N \\<tau> < Suc (ffold tcf 0 (fset_of_fmap (fmmap type_size\\<^sub>N \\<pi>)))\"\n  using fmran'I by fastforce\n\ninstantiation type :: (type) size\nbegin\ndefinition size_type where [simp, code]: \"size_type \\<equiv> type_size\"\ninstance ..\nend\n\ninstantiation type\\<^sub>N :: (type) size\nbegin\ndefinition size_type\\<^sub>N where [simp, code]: \"size_type\\<^sub>N \\<equiv> type_size\\<^sub>N\"\ninstance ..\nend\n\ntext \\<open>\n  Please take a note that the @{text \"UnlimitedNatural\"} type is not a subtype\n  of the @{text \"Integer\"} type.\\<close>\n\ninductive subtype :: \"'a::order type \\<Rightarrow> 'a type \\<Rightarrow> bool\" (infix \"\\<sqsubset>\" 65)\n      and subtype\\<^sub>N :: \"'a type\\<^sub>N \\<Rightarrow> 'a type\\<^sub>N \\<Rightarrow> bool\" (infix \"\\<sqsubset>\\<^sub>N\" 65) where\n\n\\<comment> \\<open>Basic Types\\<close>\n\n  \"OclVoid \\<sqsubset> Boolean\"\n| \"OclVoid \\<sqsubset> Integer\"\n| \"OclVoid \\<sqsubset> UnlimitedNatural\"\n| \"OclVoid \\<sqsubset> String\"\n| \"OclVoid \\<sqsubset> \\<langle>\\<C>\\<rangle>\\<^sub>\\<T>\"\n| \"OclVoid \\<sqsubset> Enum \\<E>\"\n\n| \"Integer \\<sqsubset> Real\"\n| \"\\<C> < \\<D> \\<Longrightarrow> \\<langle>\\<C>\\<rangle>\\<^sub>\\<T> \\<sqsubset> \\<langle>\\<D>\\<rangle>\\<^sub>\\<T>\"\n\n| \"Boolean \\<sqsubset> OclAny\"\n| \"Real \\<sqsubset> OclAny\"\n| \"UnlimitedNatural \\<sqsubset> OclAny\"\n| \"String \\<sqsubset> OclAny\"\n| \"\\<langle>\\<C>\\<rangle>\\<^sub>\\<T> \\<sqsubset> OclAny\"\n| \"Enum \\<E> \\<sqsubset> OclAny\"\n\n\\<comment> \\<open>Tuple Types\\<close>\n\n| \"OclVoid \\<sqsubset> Tuple \\<pi>\"\n| \"strict_subtuple (\\<lambda>\\<tau> \\<sigma>. \\<tau> \\<sqsubset>\\<^sub>N \\<sigma> \\<or> \\<tau> = \\<sigma>) \\<pi> \\<xi> \\<Longrightarrow>\n   Tuple \\<pi> \\<sqsubset> Tuple \\<xi>\"\n| \"Tuple \\<pi> \\<sqsubset> OclAny\"\n\n\\<comment> \\<open>Collection Types\\<close>\n\n| \"OclVoid \\<sqsubset> Set OclVoid[\\<^bold>1]\"\n| \"OclVoid \\<sqsubset> OrderedSet OclVoid[\\<^bold>1]\"\n| \"OclVoid \\<sqsubset> Bag OclVoid[\\<^bold>1]\"\n| \"OclVoid \\<sqsubset> Sequence OclVoid[\\<^bold>1]\"\n\n| \"\\<tau> \\<sqsubset>\\<^sub>N \\<sigma> \\<Longrightarrow> Collection \\<tau> \\<sqsubset> Collection \\<sigma>\"\n| \"\\<tau> \\<sqsubset>\\<^sub>N \\<sigma> \\<Longrightarrow> Set \\<tau> \\<sqsubset> Set \\<sigma>\"\n| \"\\<tau> \\<sqsubset>\\<^sub>N \\<sigma> \\<Longrightarrow> OrderedSet \\<tau> \\<sqsubset> OrderedSet \\<sigma>\"\n| \"\\<tau> \\<sqsubset>\\<^sub>N \\<sigma> \\<Longrightarrow> Bag \\<tau> \\<sqsubset> Bag \\<sigma>\"\n| \"\\<tau> \\<sqsubset>\\<^sub>N \\<sigma> \\<Longrightarrow> Sequence \\<tau> \\<sqsubset> Sequence \\<sigma>\"\n\n| \"Set \\<tau> \\<sqsubset> Collection \\<tau>\"\n| \"OrderedSet \\<tau> \\<sqsubset> Collection \\<tau>\"\n| \"Bag \\<tau> \\<sqsubset> Collection \\<tau>\"\n| \"Sequence \\<tau> \\<sqsubset> Collection \\<tau>\"\n\n| \"Collection OclAny[\\<^bold>?] \\<sqsubset> OclAny\"\n\n\\<comment> \\<open>Map Types\\<close>\n\n| \"OclVoid \\<sqsubset> Map \\<tau> \\<sigma>\"\n| \"\\<sigma> \\<sqsubset>\\<^sub>N \\<upsilon> \\<Longrightarrow> Map \\<tau> \\<sigma> \\<sqsubset> Map \\<tau> \\<upsilon>\"\n| \"\\<tau> \\<sqsubset>\\<^sub>N \\<rho> \\<Longrightarrow> Map \\<tau> \\<sigma> \\<sqsubset> Map \\<rho> \\<sigma>\"\n| \"Map \\<tau> \\<sigma> \\<sqsubset> OclAny\"\n\n\\<comment> \\<open>Nullable Types\\<close>\n\n| \"\\<tau> \\<sqsubset> \\<sigma> \\<Longrightarrow> Required \\<tau> \\<sqsubset>\\<^sub>N Required \\<sigma>\"\n| \"\\<tau> \\<sqsubset> \\<sigma> \\<Longrightarrow> Optional \\<tau> \\<sqsubset>\\<^sub>N Optional \\<sigma>\"\n| \"Required \\<tau> \\<sqsubset>\\<^sub>N Optional \\<tau>\"\n\ndeclare subtype_subtype\\<^sub>N.intros [intro!]\n\ninductive_cases subtype_x_OclAny [elim!]: \"\\<tau> \\<sqsubset> OclAny\"\ninductive_cases subtype_x_OclVoid [elim!]: \"\\<tau> \\<sqsubset> OclVoid\"\ninductive_cases subtype_x_Boolean [elim!]: \"\\<tau> \\<sqsubset> Boolean\"\ninductive_cases subtype_x_Real [elim!]: \"\\<tau> \\<sqsubset> Real\"\ninductive_cases subtype_x_Integer [elim!]: \"\\<tau> \\<sqsubset> Integer\"\ninductive_cases subtype_x_UnlimitedNatural [elim!]: \"\\<tau> \\<sqsubset> UnlimitedNatural\"\ninductive_cases subtype_x_String [elim!]: \"\\<tau> \\<sqsubset> String\"\ninductive_cases subtype_x_Enum [elim!]: \"\\<tau> \\<sqsubset> Enum \\<E>\"\ninductive_cases subtype_x_ObjectType [elim!]: \"\\<tau> \\<sqsubset> ObjectType \\<C>\"\ninductive_cases subtype_x_Tuple [elim!]: \"\\<tau> \\<sqsubset> Tuple \\<pi>\"\ninductive_cases subtype_x_Collection [elim!]: \"\\<tau> \\<sqsubset> Collection \\<sigma>\"\ninductive_cases subtype_x_Set [elim!]: \"\\<tau> \\<sqsubset> Set \\<sigma>\"\ninductive_cases subtype_x_OrderedSet [elim!]: \"\\<tau> \\<sqsubset> OrderedSet \\<sigma>\"\ninductive_cases subtype_x_Bag [elim!]: \"\\<tau> \\<sqsubset> Bag \\<sigma>\"\ninductive_cases subtype_x_Sequence [elim!]: \"\\<tau> \\<sqsubset> Sequence \\<sigma>\"\ninductive_cases subtype_x_Map [elim!]: \"\\<tau> \\<sqsubset> Map \\<rho> \\<upsilon>\"\n\ninductive_cases subtype_x_Required [elim!]: \"\\<tau> \\<sqsubset>\\<^sub>N Required \\<sigma>\"\ninductive_cases subtype_x_Optional [elim!]: \"\\<tau> \\<sqsubset>\\<^sub>N Optional \\<sigma>\"\n\ninductive_cases subtype_OclAny_x [elim!]: \"OclAny \\<sqsubset> \\<sigma>\"\ninductive_cases subtype_Collection_x [elim!]: \"Collection \\<tau> \\<sqsubset> \\<sigma>\"\ninductive_cases subtype_Map_x [elim!]: \"Map \\<tau> \\<sigma> \\<sqsubset> \\<psi>\"\n\nlemma\n  subtype_asym: \"\\<tau> \\<sqsubset> \\<sigma> \\<Longrightarrow> \\<sigma> \\<sqsubset> \\<tau> \\<Longrightarrow> False\" and\n  subtype\\<^sub>N_asym: \"\\<tau>\\<^sub>N \\<sqsubset>\\<^sub>N \\<sigma>\\<^sub>N \\<Longrightarrow> \\<sigma>\\<^sub>N \\<sqsubset>\\<^sub>N \\<tau>\\<^sub>N \\<Longrightarrow> False\"\n  for \\<tau> \\<sigma> :: \"'a :: order type\"\n  and \\<tau>\\<^sub>N \\<sigma>\\<^sub>N :: \"'a type\\<^sub>N\"\n  apply (induct rule: subtype_subtype\\<^sub>N.inducts, auto)\n  using subtuple_antisym by fastforce\n\n(*** Notation ***************************************************************)\n\nsection \\<open>Notation\\<close>\n\nnotation to_error_free_type (\"_\\<lbrakk>.\\<rbrakk>\" [1000] 1000)\nnotation to_errorable_type (\"_\\<lbrakk>.!\\<rbrakk>\" [1000] 1000)\n\nfun required_type\\<^sub>N where\n  \"required_type\\<^sub>N (Required \\<tau>) = True\"\n| \"required_type\\<^sub>N (Optional \\<tau>) = False\"\n\nfun required_type where\n  \"required_type (ErrorFree \\<tau>) = required_type\\<^sub>N \\<tau>\"\n| \"required_type (Errorable \\<tau>) = required_type\\<^sub>N \\<tau>\"\n\nabbreviation \"optional_type\\<^sub>N \\<tau> \\<equiv> \\<not> required_type\\<^sub>N \\<tau>\"\nabbreviation \"optional_type \\<tau> \\<equiv> \\<not> required_type \\<tau>\"\n\nfun to_required_type\\<^sub>N where\n  \"to_required_type\\<^sub>N (Required \\<tau>) = Required \\<tau>\"\n| \"to_required_type\\<^sub>N (Optional \\<tau>) = Required \\<tau>\"\n\nabbreviation to_required_type (\"_\\<lbrakk>1.\\<rbrakk>\" [1000] 1000) where\n  \"to_required_type \\<equiv> map_errorable to_required_type\\<^sub>N\"\n\n(* Is it realy required? Maybe it is better to check types intersection? *)\nfun to_optional_type_nested\\<^sub>T\nand to_optional_type_nested\\<^sub>N where\n  \"to_optional_type_nested\\<^sub>T OclAny = OclAny\"\n| \"to_optional_type_nested\\<^sub>T OclVoid = OclVoid\"\n\n| \"to_optional_type_nested\\<^sub>T Boolean = Boolean\"\n| \"to_optional_type_nested\\<^sub>T Real = Real\"\n| \"to_optional_type_nested\\<^sub>T Integer = Integer\"\n| \"to_optional_type_nested\\<^sub>T UnlimitedNatural = UnlimitedNatural\"\n| \"to_optional_type_nested\\<^sub>T String = String\"\n\n| \"to_optional_type_nested\\<^sub>T (Enum \\<E>) = Enum \\<E>\"\n| \"to_optional_type_nested\\<^sub>T (ObjectType \\<C>) = ObjectType \\<C>\"\n| \"to_optional_type_nested\\<^sub>T (Tuple \\<pi>) =\n      Tuple (fmmap to_optional_type_nested\\<^sub>N \\<pi>)\"\n\n| \"to_optional_type_nested\\<^sub>T (Collection \\<tau>) =\n      Collection (to_optional_type_nested\\<^sub>N \\<tau>)\"\n| \"to_optional_type_nested\\<^sub>T (Set \\<tau>) =\n      Set (to_optional_type_nested\\<^sub>N \\<tau>)\"\n| \"to_optional_type_nested\\<^sub>T (OrderedSet \\<tau>) =\n      OrderedSet (to_optional_type_nested\\<^sub>N \\<tau>)\"\n| \"to_optional_type_nested\\<^sub>T (Bag \\<tau>) =\n      Bag (to_optional_type_nested\\<^sub>N \\<tau>)\"\n| \"to_optional_type_nested\\<^sub>T (Sequence \\<tau>) =\n      Sequence (to_optional_type_nested\\<^sub>N \\<tau>)\"\n\n| \"to_optional_type_nested\\<^sub>T (Map \\<tau> \\<sigma>) =\n      Map (to_optional_type_nested\\<^sub>N \\<tau>) (to_optional_type_nested\\<^sub>N \\<sigma>)\"\n\n| \"to_optional_type_nested\\<^sub>N (Required \\<tau>) = Optional (to_optional_type_nested\\<^sub>T \\<tau>)\"\n| \"to_optional_type_nested\\<^sub>N (Optional \\<tau>) = Optional (to_optional_type_nested\\<^sub>T \\<tau>)\"\n\nabbreviation to_optional_type_nested (\"_\\<lbrakk>??.\\<rbrakk>\" [1000] 1000) where\n  \"to_optional_type_nested \\<equiv> map_errorable to_optional_type_nested\\<^sub>N\"\n\nabbreviation Required_ErrorFree (\"_[1]\" [1000] 1000) where\n  \"Required_ErrorFree \\<tau> \\<equiv> ErrorFree (Required \\<tau>)\"\n\nabbreviation Optional_ErrorFree (\"_[?]\" [1000] 1000) where\n  \"Optional_ErrorFree \\<tau> \\<equiv> ErrorFree (Optional \\<tau>)\"\n\nabbreviation Required_Errorable (\"_[1!]\" [1000] 1000) where\n  \"Required_Errorable \\<tau> \\<equiv> Errorable (Required \\<tau>)\"\n\nabbreviation Optional_Errorable (\"_[?!]\" [1000] 1000) where\n  \"Optional_Errorable \\<tau> \\<equiv> Errorable (Optional \\<tau>)\"\n\n(*** Constructors Bijectivity on Transitive Closures ************************)\n\nsection \\<open>Constructors Bijectivity on Transitive Closures\\<close>\n\nlemma Tuple_bij_on_trancl [simp]:\n  \"bij_on_trancl (\\<sqsubset>) Tuple\"\n  unfolding inj_def\n  using tranclp.cases by fastforce\n\nlemma subtype_tranclp_Collection_x:\n  \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Collection \\<tau>) \\<sigma> \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<sigma> = Collection \\<rho> \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau> \\<rho> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<sigma> = OclAny \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (induct rule: tranclp_induct)\n  apply auto[1]\n  by (metis subtype_Collection_x subtype_OclAny_x tranclp.trancl_into_trancl)\n\nlemma Collection_bij_on_trancl [simp]:\n  \"bij_on_trancl (\\<sqsubset>) Collection\"\n  unfolding inj_def\n  using subtype_tranclp_Collection_x by auto\n\nlemma Set_bij_on_trancl [simp]:\n  \"bij_on_trancl (\\<sqsubset>) Set\"\n  unfolding inj_def\n  using tranclp.cases by fastforce\n\nlemma OrderedSet_bij_on_trancl [simp]:\n  \"bij_on_trancl (\\<sqsubset>) OrderedSet\"\n  unfolding inj_def\n  using tranclp.cases by fastforce\n\nlemma Bag_bij_on_trancl [simp]:\n  \"bij_on_trancl (\\<sqsubset>) Bag\"\n  unfolding inj_def\n  using tranclp.cases by fastforce\n\nlemma Sequence_bij_on_trancl [simp]:\n  \"bij_on_trancl (\\<sqsubset>) Sequence\"\n  unfolding inj_def\n  using tranclp.cases by fastforce\n\nlemma subtype_tranclp_x_Map_key:\n  \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Map \\<tau> \\<sigma>) (Map \\<rho> \\<upsilon>) \\<Longrightarrow>\n   ((\\<And>\\<tau>'. \\<tau> = \\<tau>' \\<Longrightarrow> \\<sigma> = \\<upsilon> \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau>' \\<rho> \\<Longrightarrow> P) \\<Longrightarrow>\n    (\\<And>\\<sigma>'. \\<tau> = \\<rho> \\<Longrightarrow> \\<sigma> = \\<sigma>' \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<sigma>' \\<upsilon> \\<Longrightarrow> P) \\<Longrightarrow>\n    (\\<And>\\<tau>' \\<sigma>'. \\<tau> = \\<tau>' \\<Longrightarrow> \\<sigma> = \\<sigma>' \\<Longrightarrow>\n          (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau>' \\<rho> \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<sigma>' \\<upsilon> \\<Longrightarrow> P) \\<Longrightarrow> P) \\<Longrightarrow>\n   ((\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau>' \\<rho> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau>' \\<tau> \\<Longrightarrow> P\"\n  by (metis tranclp_trans)\n\nlemma subtype_tranclp_x_Map_value:\n  \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Map \\<tau> \\<sigma>) (Map \\<rho> \\<upsilon>) \\<Longrightarrow>\n   ((\\<And>\\<tau>'. \\<tau> = \\<tau>' \\<Longrightarrow> \\<sigma> = \\<upsilon> \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau>' \\<rho> \\<Longrightarrow> P) \\<Longrightarrow>\n    (\\<And>\\<sigma>'. \\<tau> = \\<rho> \\<Longrightarrow> \\<sigma> = \\<sigma>' \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<sigma>' \\<upsilon> \\<Longrightarrow> P) \\<Longrightarrow>\n    (\\<And>\\<tau>' \\<sigma>'. \\<tau> = \\<tau>' \\<Longrightarrow> \\<sigma> = \\<sigma>' \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau>' \\<rho> \\<Longrightarrow>\n          (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<sigma>' \\<upsilon> \\<Longrightarrow> P) \\<Longrightarrow> P) \\<Longrightarrow>\n   ((\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<sigma>' \\<upsilon> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<sigma>' \\<sigma> \\<Longrightarrow> P\"\n  by (metis tranclp_trans)\n\nlemma subtype_tranclp_x_Map:\n  \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ \\<phi> (Map \\<tau> \\<sigma>) \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<phi> = Map \\<rho> \\<sigma> \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<rho> \\<tau> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<upsilon>. \\<phi> = Map \\<tau> \\<upsilon> \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<upsilon> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<rho> \\<upsilon>. \\<phi> = Map \\<rho> \\<upsilon> \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<rho> \\<tau> \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<upsilon> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<phi> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (induct rule: converse_tranclp_induct)\n  apply auto[1]\n  apply (erule subtype.cases; simp)\n  apply (drule subtype_tranclp_x_Map_value; auto)\n  apply (drule subtype_tranclp_x_Map_key; auto)\n  done\n\nlemma Map_key_bij_on_trancl [simp]:\n  \"((\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<sigma> \\<sigma> \\<Longrightarrow> False) \\<Longrightarrow> bij_on_trancl (\\<sqsubset>) (\\<lambda>\\<tau>. Map \\<tau> \\<sigma>)\"\n  apply (auto simp add: inj_def)\n  using tranclp.cases apply fastforce\n  by (erule subtype_tranclp_x_Map; simp add: tranclp.trancl_into_trancl)\n\nlemma Map_value_bij_on_trancl [simp]:\n  \"((\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau> \\<tau> \\<Longrightarrow> False) \\<Longrightarrow> bij_on_trancl (\\<sqsubset>) (\\<lambda>\\<sigma>. Map \\<tau> \\<sigma>)\"\n  apply (auto simp add: inj_def)\n  using tranclp.cases apply fastforce\n  by (erule subtype_tranclp_x_Map; simp add: tranclp.trancl_into_trancl)\n\nlemma Required_bij_on_trancl [simp]:\n  \"bij_on_trancl (\\<sqsubset>\\<^sub>N) Required\"\n  by (auto simp add: inj_def)\n\nlemma not_subtype_Optional_Required:\n  \"(\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ (Optional \\<tau>) \\<sigma> \\<Longrightarrow> \\<sigma> = Required \\<rho> \\<Longrightarrow> P\"\n  by (induct arbitrary: \\<rho> rule: tranclp_induct; auto)\n\nlemma Optional_bij_on_trancl [simp]:\n  \"bij_on_trancl (\\<sqsubset>\\<^sub>N) Optional\"\n  unfolding inj_def\n  using not_subtype_Optional_Required by blast\n\n(*** Partial Order of Types *************************************************)\n\nsection \\<open>Partial Order of Types\\<close>\n\ninstantiation type :: (order) ord\nbegin\ndefinition \"(<) \\<equiv> (\\<sqsubset>)\\<^sup>+\\<^sup>+\"\ndefinition \"(\\<le>) \\<equiv> (\\<sqsubset>)\\<^sup>*\\<^sup>*\"\ninstance ..\nend\n\ninstantiation type\\<^sub>N :: (order) ord\nbegin\ndefinition \"(<) \\<equiv> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+\"\ndefinition \"(\\<le>) \\<equiv> (\\<sqsubset>\\<^sub>N)\\<^sup>*\\<^sup>*\"\ninstance ..\nend\n\n(*** Strict Introduction Rules **********************************************)\n\nsubsection \\<open>Strict Introduction Rules\\<close>\n\nlemma type_less_x_OclAny_intro [intro]:\n  \"\\<tau> \\<noteq> OclAny \\<Longrightarrow> \\<tau> < OclAny\"\n  \"\\<tau>\\<^sub>N \\<noteq> Optional OclAny \\<Longrightarrow> \\<tau>\\<^sub>N < Optional OclAny\"\n  for \\<tau> :: \"'a :: order type\"\n  and \\<tau>\\<^sub>N :: \"'a type\\<^sub>N\"\nproof (induct \\<tau> and \\<tau>\\<^sub>N)\n  case OclAny thus ?case by simp\nnext\n  case OclVoid\n  have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ OclVoid Boolean\" by auto\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ Boolean OclAny\" by auto\n  finally show ?case unfolding less_type_def by simp\nnext\n  case Boolean show ?case unfolding less_type_def by auto\nnext\n  case Real show ?case unfolding less_type_def by auto\nnext\n  case Integer\n  have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ Integer Real\" by auto\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ Real OclAny\" by auto\n  finally show ?case unfolding less_type_def by simp\nnext\n  case UnlimitedNatural show ?case unfolding less_type_def by auto\nnext\n  case String show ?case unfolding less_type_def by auto\nnext\n  case (Enum \\<E>) show ?case unfolding less_type_def by auto\nnext\n  case (ObjectType \\<C>) show ?case unfolding less_type_def by auto\nnext\n  case (Tuple \\<pi>) show ?case unfolding less_type_def by auto\nnext\n  case (Collection \\<tau>)\n  from Collection.hyps\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Collection \\<tau>) (Collection OclAny[\\<^bold>?])\"\n    unfolding less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>\\<^sub>N)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Collection OclAny[\\<^bold>?]) OclAny\" by auto\n  finally show ?case unfolding less_type_def by simp\nnext\n  case (Set \\<tau>)\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Set \\<tau>) (Collection \\<tau>)\" by auto\n  also from Set.hyps\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Collection \\<tau>) (Collection OclAny[\\<^bold>?])\"\n    unfolding less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>\\<^sub>N)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Collection OclAny[\\<^bold>?]) OclAny\" by auto\n  finally show ?case unfolding less_type_def by simp\nnext\n  case (OrderedSet \\<tau>)\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (OrderedSet \\<tau>) (Collection \\<tau>)\" by auto\n  also from OrderedSet.hyps\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Collection \\<tau>) (Collection OclAny[\\<^bold>?])\"\n    unfolding less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>\\<^sub>N)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Collection OclAny[\\<^bold>?]) OclAny\" by auto\n  finally show ?case unfolding less_type_def by simp\nnext\n  case (Bag \\<tau>)\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Bag \\<tau>) (Collection \\<tau>)\" by auto\n  also from Bag.hyps\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Collection \\<tau>) (Collection OclAny[\\<^bold>?])\"\n    unfolding less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>\\<^sub>N)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Collection OclAny[\\<^bold>?]) OclAny\" by auto\n  finally show ?case unfolding less_type_def by simp\nnext\n  case (Sequence \\<tau>)\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Sequence \\<tau>) (Collection \\<tau>)\" by auto\n  also from Sequence.hyps\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Collection \\<tau>) (Collection OclAny[\\<^bold>?])\"\n    unfolding less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>\\<^sub>N)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Collection OclAny[\\<^bold>?]) OclAny\" by auto\n  finally show ?case unfolding less_type_def by simp\nnext\n  case (Map \\<tau> \\<sigma>) show ?case unfolding less_type_def by auto\nnext\n  case (Required \\<tau>)\n  have \"(\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ (Required \\<tau>) (Optional \\<tau>)\" by auto\n  also from Required.hyps\n  have \"(\\<sqsubset>\\<^sub>N)\\<^sup>*\\<^sup>* (Optional \\<tau>) (Optional OclAny)\"\n    unfolding less_type_def\n    by (rule_tac ?R=\"(\\<sqsubset>)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  finally show ?case unfolding less_type\\<^sub>N_def by simp\nnext\n  case (Optional \\<tau>) thus ?case\n    unfolding less_type_def less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>)\" in preserve_tranclp, auto)\nqed\n\nlemma type_less_OclVoid_x_intro [intro]:\n  \"\\<tau> \\<noteq> OclVoid \\<Longrightarrow> OclVoid < \\<tau>\"\n  \"\\<tau>\\<^sub>N \\<noteq> Required OclVoid \\<Longrightarrow> Required OclVoid < \\<tau>\\<^sub>N\"\n  for \\<tau> :: \"'a :: order type\"\n  and \\<tau>\\<^sub>N :: \"'a type\\<^sub>N\"\nproof (induct \\<tau> and \\<tau>\\<^sub>N)\n  case OclAny\n  have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ OclVoid Boolean\" by auto\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ Boolean OclAny\" by auto\n  finally show ?case unfolding less_type_def by simp\nnext\n  case OclVoid thus ?case by simp\nnext\n  case Boolean show ?case unfolding less_type_def by auto\nnext\n  case Real\n  have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ OclVoid Integer\" by auto\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ Integer Real\" by auto\n  finally show ?case unfolding less_type_def by simp\nnext\n  case Integer show ?case unfolding less_type_def by auto\nnext\n  case UnlimitedNatural show ?case unfolding less_type_def by auto\nnext\n  case String show ?case unfolding less_type_def by auto\nnext\n  case (Enum \\<E>) show ?case unfolding less_type_def by auto\nnext\n  case (ObjectType \\<C>) show ?case unfolding less_type_def by auto\nnext\n  case (Tuple \\<pi>) show ?case unfolding less_type_def by auto\nnext\n  case (Collection \\<tau>)\n  have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ OclVoid (Set OclVoid[\\<^bold>1])\" by auto\n  also from Collection.hyps\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Set OclVoid[\\<^bold>1]) (Set \\<tau>)\"\n    unfolding less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>\\<^sub>N)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Set \\<tau>) (Collection \\<tau>)\" by auto\n  finally show ?case unfolding less_type_def by simp\nnext\n  case (Set \\<tau>)\n  have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ OclVoid (Set OclVoid[\\<^bold>1])\" by auto\n  also from Set.hyps\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Set OclVoid[\\<^bold>1]) (Set \\<tau>)\"\n    unfolding less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>\\<^sub>N)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  finally show ?case unfolding less_type_def by simp\nnext\n  case (OrderedSet \\<tau>)\n  have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ OclVoid (OrderedSet OclVoid[\\<^bold>1])\" by auto\n  also from OrderedSet.hyps\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (OrderedSet OclVoid[\\<^bold>1]) (OrderedSet \\<tau>)\"\n    unfolding less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>\\<^sub>N)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  finally show ?case unfolding less_type_def by simp\nnext\n  case (Bag \\<tau>)\n  have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ OclVoid (Bag OclVoid[\\<^bold>1])\" by auto\n  also from Bag.hyps\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Bag OclVoid[\\<^bold>1]) (Bag \\<tau>)\"\n    unfolding less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>\\<^sub>N)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  finally show ?case unfolding less_type_def by simp\nnext\n  case (Sequence \\<tau>)\n  have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ OclVoid (Sequence OclVoid[\\<^bold>1])\" by auto\n  also from Sequence.hyps\n  have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* (Sequence OclVoid[\\<^bold>1]) (Sequence \\<tau>)\"\n    unfolding less_type\\<^sub>N_def\n    by (rule_tac ?R=\"(\\<sqsubset>\\<^sub>N)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  finally show ?case unfolding less_type_def by simp\nnext\n  case (Map \\<tau> \\<sigma>) show ?case unfolding less_type_def by auto\nnext\n  case (Required \\<tau>) thus ?case\n    unfolding less_type\\<^sub>N_def less_type_def\n    by (rule_tac ?f=\"Required\" in preserve_tranclp; auto)\nnext\n  case (Optional \\<tau>)\n  hence \"(\\<sqsubset>\\<^sub>N)\\<^sup>*\\<^sup>* (Required OclVoid) (Required \\<tau>)\"\n    unfolding less_type_def\n    by (rule_tac ?R=\"(\\<sqsubset>)\" in preserve_rtranclp;\n        auto simp add: Nitpick.rtranclp_unfold)\n  also have \"(\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ (Required \\<tau>) (Optional \\<tau>)\" by auto\n  finally show ?case unfolding less_type\\<^sub>N_def by simp\nqed\n\nlemma type_less_x_Real_intro [intro]:\n  \"\\<tau> = Integer \\<Longrightarrow> \\<tau> < Real\"\n  unfolding less_type_def\n  by (rule rtranclp_into_tranclp2, auto)+\n\nlemma type_less_x_ObjectType_intro [intro]:\n  \"\\<tau> = \\<langle>\\<C>\\<rangle>\\<^sub>\\<T> \\<Longrightarrow> \\<C> < \\<D> \\<Longrightarrow> \\<tau> < \\<langle>\\<D>\\<rangle>\\<^sub>\\<T>\"\n  unfolding less_type_def\n  using dual_order.order_iff_strict by blast\n\nlemma fun_or_eq_refl [intro]:\n  \"reflp (\\<lambda>x y. f x y \\<or> x = y)\"\n  by (simp add: reflpI)\n\nlemma type_less_x_Tuple_intro [intro]:\n  assumes \"\\<tau> = Tuple \\<pi>\"\n      and \"strict_subtuple (\\<le>) \\<pi> \\<xi>\"\n    shows \"\\<tau> < Tuple \\<xi>\"\nproof -\n  have \"subtuple (\\<lambda>\\<tau> \\<sigma>. \\<tau> \\<sqsubset>\\<^sub>N \\<sigma> \\<or> \\<tau> = \\<sigma>)\\<^sup>*\\<^sup>* \\<pi> \\<xi>\"\n    by (metis assms(2) less_eq_type\\<^sub>N_def rtranclp_eq_rtranclp)\n  hence \"(subtuple (\\<lambda>\\<tau> \\<sigma>. \\<tau> \\<sqsubset>\\<^sub>N \\<sigma> \\<or> \\<tau> = \\<sigma>))\\<^sup>+\\<^sup>+ \\<pi> \\<xi>\"\n    by simp (rule subtuple_to_trancl; auto)\n  hence \"(strict_subtuple (\\<lambda>\\<tau> \\<sigma>. \\<tau> \\<sqsubset>\\<^sub>N \\<sigma> \\<or> \\<tau> = \\<sigma>))\\<^sup>*\\<^sup>* \\<pi> \\<xi>\"\n    by (simp add: tranclp_into_rtranclp)\n  hence \"(strict_subtuple (\\<lambda>\\<tau> \\<sigma>. \\<tau> \\<sqsubset>\\<^sub>N \\<sigma> \\<or> \\<tau> = \\<sigma>))\\<^sup>+\\<^sup>+ \\<pi> \\<xi>\"\n    by (meson assms(2) rtranclpD)\n  thus ?thesis\n    unfolding less_type_def\n    using assms(1) apply simp\n    by (rule preserve_tranclp; auto)\nqed\n\nlemma type_less_x_Collection_intro [intro]:\n  \"\\<tau> = Collection \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> \\<tau> < Collection \\<sigma>\"\n  \"\\<tau> = Set \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> < Collection \\<sigma>\"\n  \"\\<tau> = OrderedSet \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> < Collection \\<sigma>\"\n  \"\\<tau> = Bag \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> < Collection \\<sigma>\"\n  \"\\<tau> = Sequence \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> < Collection \\<sigma>\"\n  unfolding less_type_def less_type\\<^sub>N_def less_eq_type\\<^sub>N_def\n  apply simp_all\n  apply (rule_tac ?f=\"Collection\" in preserve_tranclp; auto)\n  by (rule preserve_rtranclp''; auto)+\n\nlemma type_less_x_Set_intro [intro]:\n  \"\\<tau> = Set \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> \\<tau> < Set \\<sigma>\"\n  unfolding less_type_def less_type\\<^sub>N_def\n  by simp (rule preserve_tranclp; auto)\n\nlemma type_less_x_OrderedSet_intro [intro]:\n  \"\\<tau> = OrderedSet \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> \\<tau> < OrderedSet \\<sigma>\"\n  unfolding less_type_def less_type\\<^sub>N_def\n  by simp (rule preserve_tranclp; auto)\n\nlemma type_less_x_Bag_intro [intro]:\n  \"\\<tau> = Bag \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> \\<tau> < Bag \\<sigma>\"\n  unfolding less_type_def less_type\\<^sub>N_def\n  by simp (rule preserve_tranclp; auto)\n\nlemma type_less_x_Sequence_intro [intro]:\n  \"\\<tau> = Sequence \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> \\<tau> < Sequence \\<sigma>\"\n  unfolding less_type_def less_type\\<^sub>N_def\n  by simp (rule preserve_tranclp; auto)\n\n\nlemma type_less_x_Map_intro':\n  assumes \"(\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau> \\<rho>\"\n      and \"(\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<sigma> \\<upsilon>\"\n    shows \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Map \\<tau> \\<sigma>) (Map \\<rho> \\<upsilon>)\"\nproof -\n  from assms(2) have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Map \\<tau> \\<sigma>) (Map \\<tau> \\<upsilon>)\"\n    by (metis preserve_tranclp subtype_subtype\\<^sub>N.intros(33))\n  also have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ (Map \\<tau> \\<upsilon>) (Map \\<rho> \\<upsilon>)\"\n    apply (insert assms(1))\n    by (rule preserve_tranclp; simp add: subtype_subtype\\<^sub>N.intros(34))\n  finally show ?thesis by simp\nqed\n\nlemma type_less_x_Map_intro [intro]:\n  \"\\<phi> = Map \\<tau> \\<sigma> \\<Longrightarrow> \\<tau> = \\<rho> \\<Longrightarrow> \\<sigma> < \\<upsilon> \\<Longrightarrow> \\<phi> < Map \\<rho> \\<upsilon>\"\n  \"\\<phi> = Map \\<tau> \\<sigma> \\<Longrightarrow> \\<tau> < \\<rho> \\<Longrightarrow> \\<sigma> = \\<upsilon> \\<Longrightarrow> \\<phi> < Map \\<rho> \\<upsilon>\"\n  \"\\<phi> = Map \\<tau> \\<sigma> \\<Longrightarrow> \\<tau> < \\<rho> \\<Longrightarrow> \\<sigma> < \\<upsilon> \\<Longrightarrow> \\<phi> < Map \\<rho> \\<upsilon>\"\n  unfolding less_type\\<^sub>N_def less_type_def\n  apply simp_all\n  apply (rule preserve_tranclp;\n         simp add: subtype_subtype\\<^sub>N.intros(33) subtype_subtype\\<^sub>N.intros(34))+\n  by (simp add: type_less_x_Map_intro')\n\n\nlemma type_less_x_Required_intro [intro]:\n  \"\\<tau> = Required \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> \\<tau> < Required \\<sigma>\"\n  unfolding less_type\\<^sub>N_def less_type_def\n  by simp (rule preserve_tranclp; auto)\n\nlemma type_less_x_Optional_intro [intro]:\n  \"\\<tau> = Required \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> < Optional \\<sigma>\"\n  \"\\<tau> = Optional \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> \\<tau> < Optional \\<sigma>\"\n  unfolding less_type\\<^sub>N_def less_type_def less_eq_type_def\n  apply simp_all\n  apply (rule preserve_rtranclp''; auto)\n  by (rule preserve_tranclp; auto)\n\n(*** Strict Elimination Rules ***********************************************)\n\nsubsection \\<open>Strict Elimination Rules\\<close>\n\nlemma type_less_x_OclAny [elim!]:\n  \"\\<tau> < OclAny \\<Longrightarrow> (\\<tau> \\<noteq> OclAny \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  unfolding less_type_def\n  by (drule tranclpD; auto)\n\nlemma type_less_x_OclVoid [elim!]:\n  \"\\<tau> < OclVoid \\<Longrightarrow> P\"\n  unfolding less_type_def\n  by (induct rule: converse_tranclp_induct; auto)\n\nlemma type_less_x_Boolean [elim!]:\n  \"\\<tau> < Boolean \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  unfolding less_type_def\n  by (induct rule: converse_tranclp_induct; auto)\n\nlemma type_less_x_Real [elim!]:\n  \"\\<tau> < Real \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = Integer \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  unfolding less_type_def\n  by (induct rule: converse_tranclp_induct; auto)\n\nlemma type_less_x_Integer [elim!]:\n  \"\\<tau> < Integer \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  unfolding less_type_def\n  by (induct rule: converse_tranclp_induct; auto)\n\nlemma type_less_x_UnlimitedNatural [elim!]:\n  \"\\<tau> < UnlimitedNatural \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  unfolding less_type_def\n  by (induct rule: converse_tranclp_induct; auto)\n\nlemma type_less_x_String [elim!]:\n  \"\\<tau> < String \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  unfolding less_type_def\n  by (induct rule: converse_tranclp_induct; auto)\n\nlemma type_less_x_Enum [elim!]:\n  \"\\<tau> < Enum \\<E> \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  unfolding less_type_def\n  by (induct rule: converse_tranclp_induct; auto)\n\nlemma type_less_x_ObjectType [elim!]:\n  \"\\<tau> < \\<langle>\\<D>\\<rangle>\\<^sub>\\<T> \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<C>. \\<tau> = \\<langle>\\<C>\\<rangle>\\<^sub>\\<T> \\<Longrightarrow> \\<C> < \\<D> \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  unfolding less_type_def\n  apply (induct rule: converse_tranclp_induct)\n  using less_trans by auto\n\ntext \\<open>\n  We will be able to remove the acyclicity assumption only after\n  we prove that the subtype relation is acyclic.\\<close>\n\nlemma type_less_x_Tuple':\n  assumes \"\\<tau> < Tuple \\<xi>\"\n      and \"acyclicP_on (fmran' \\<xi>) (\\<sqsubset>\\<^sub>N)\"\n      and \"\\<And>\\<pi>. \\<tau> = Tuple \\<pi> \\<Longrightarrow> strict_subtuple (\\<le>) \\<pi> \\<xi> \\<Longrightarrow> P\"\n      and \"\\<tau> = OclVoid \\<Longrightarrow> P\"\n    shows \"P\"\nproof -\n  from assms(1) obtain \\<pi> where \"\\<tau> = Tuple \\<pi> \\<or> \\<tau> = OclVoid\"\n    unfolding less_type_def\n    by (induct rule: converse_tranclp_induct; auto)\n  moreover from assms(2) have\n    \"\\<And>\\<pi>. Tuple \\<pi> < Tuple \\<xi> \\<Longrightarrow> strict_subtuple (\\<le>) \\<pi> \\<xi>\"\n    unfolding less_type_def less_eq_type\\<^sub>N_def\n    by (rule_tac ?f=\"Tuple\" in strict_subtuple_rtranclp_intro; auto)\n  ultimately show ?thesis\n    using assms by auto\nqed\n\nlemma type_less_x_Collection [elim!]:\n  \"\\<tau> < Collection \\<sigma> \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Collection \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Set \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow> \n   (\\<And>\\<rho>. \\<tau> = OrderedSet \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow> \n   (\\<And>\\<rho>. \\<tau> = Bag \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow> \n   (\\<And>\\<rho>. \\<tau> = Sequence \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow> \n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  unfolding less_type_def less_type\\<^sub>N_def less_eq_type\\<^sub>N_def\n  apply (induct rule: converse_tranclp_induct)\n  apply auto[1]\n  by (erule subtype.cases;\n      auto simp add: converse_rtranclp_into_rtranclp less_eq_type_def\n                     tranclp_into_tranclp2 tranclp_into_rtranclp)\n\nlemma type_less_x_Set [elim!]:\n  assumes \"\\<tau> < Set \\<sigma>\"\n      and \"\\<And>\\<rho>. \\<tau> = Set \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> P\"\n      and \"\\<tau> = OclVoid \\<Longrightarrow> P\"\n    shows \"P\"\nproof -\n  from assms(1) obtain \\<rho> where \"\\<tau> = Set \\<rho> \\<or> \\<tau> = OclVoid\"\n    unfolding less_type_def\n    by (induct rule: converse_tranclp_induct; auto)\n  moreover have \"\\<And>\\<tau> \\<sigma>. Set \\<tau> < Set \\<sigma> \\<Longrightarrow> \\<tau> < \\<sigma>\"\n    unfolding less_type_def less_type\\<^sub>N_def\n    by (rule reflect_tranclp; auto)\n  ultimately show ?thesis\n    using assms by auto\nqed\n\n\n\nlemma type_less_x_Bag [elim!]:\n  assumes \"\\<tau> < Bag \\<sigma>\"\n      and \"\\<And>\\<rho>. \\<tau> = Bag \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> P\"\n      and \"\\<tau> = OclVoid \\<Longrightarrow> P\"\n    shows \"P\"\nproof -\n  from assms(1) obtain \\<rho> where \"\\<tau> = Bag \\<rho> \\<or> \\<tau> = OclVoid\"\n    unfolding less_type_def\n    by (induct rule: converse_tranclp_induct; auto)\n  moreover have \"\\<And>\\<tau> \\<sigma>. Bag \\<tau> < Bag \\<sigma> \\<Longrightarrow> \\<tau> < \\<sigma>\"\n    unfolding less_type_def less_type\\<^sub>N_def\n    by (rule reflect_tranclp; auto)\n  ultimately show ?thesis\n    using assms by auto\nqed\n\nlemma type_less_x_Sequence [elim!]:\n  assumes \"\\<tau> < Sequence \\<sigma>\"\n      and \"\\<And>\\<rho>. \\<tau> = Sequence \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> P\"\n      and \"\\<tau> = OclVoid \\<Longrightarrow> P\"\n    shows \"P\"\nproof -\n  from assms(1) obtain \\<rho> where \"\\<tau> = Sequence \\<rho> \\<or> \\<tau> = OclVoid\"\n    unfolding less_type_def\n    by (induct rule: converse_tranclp_induct; auto)\n  moreover have \"\\<And>\\<tau> \\<sigma>. Sequence \\<tau> < Sequence \\<sigma> \\<Longrightarrow> \\<tau> < \\<sigma>\"\n    unfolding less_type_def less_type\\<^sub>N_def\n    by (rule reflect_tranclp; auto)\n  ultimately show ?thesis\n    using assms by auto\nqed\n\nlemma type_less_x_Map [elim!]:\n  assumes \"\\<phi> < Map \\<rho> \\<upsilon>\"\n      and \"\\<And>\\<sigma>. \\<phi> = Map \\<rho> \\<sigma> \\<Longrightarrow> \\<sigma> < \\<upsilon> \\<Longrightarrow> P\"\n      and \"\\<And>\\<tau>. \\<phi> = Map \\<tau> \\<upsilon> \\<Longrightarrow> \\<tau> < \\<rho> \\<Longrightarrow> P\"\n      and \"\\<And>\\<tau> \\<sigma>. \\<phi> = Map \\<tau> \\<sigma> \\<Longrightarrow> \\<tau> < \\<rho> \\<Longrightarrow> \\<sigma> < \\<upsilon> \\<Longrightarrow> P\"\n      and \"\\<phi> = OclVoid \\<Longrightarrow> P\"\n    shows \"P\"\nproof -\n  from assms(1) obtain \\<tau> \\<sigma> where \"\\<phi> = Map \\<tau> \\<sigma> \\<or> \\<phi> = OclVoid\"\n    unfolding less_type_def\n    by (induct rule: converse_tranclp_induct; auto)\n  moreover have\n    \"Map \\<tau> \\<sigma> < Map \\<rho> \\<upsilon> \\<Longrightarrow>\n     (\\<tau> = \\<rho> \\<Longrightarrow> \\<sigma> < \\<upsilon> \\<Longrightarrow> P) \\<Longrightarrow>\n     (\\<tau> < \\<rho> \\<Longrightarrow> \\<sigma> = \\<upsilon> \\<Longrightarrow> P) \\<Longrightarrow>\n     (\\<tau> < \\<rho> \\<Longrightarrow> \\<sigma> < \\<upsilon> \\<Longrightarrow> P) \\<Longrightarrow> P\"\n    unfolding less_type_def less_type\\<^sub>N_def\n    by (erule subtype_tranclp_x_Map, auto)\n  ultimately show ?thesis\n    using assms by auto\nqed\n\n\nlemma type_less_x_Required [elim!]:\n  assumes \"\\<tau> < Required \\<sigma>\"\n      and \"\\<And>\\<rho>. \\<tau> = Required \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> P\"\n    shows \"P\"\nproof -\n  from assms(1) obtain \\<rho> where \"\\<tau> = Required \\<rho>\"\n    unfolding less_type\\<^sub>N_def\n    by (induct rule: converse_tranclp_induct; auto)\n  moreover have \"Required \\<rho> < Required \\<sigma> \\<Longrightarrow> \\<rho> < \\<sigma>\"\n    unfolding less_type_def less_type\\<^sub>N_def\n    by (rule reflect_tranclp; auto)\n  ultimately show ?thesis\n    using assms by auto\nqed\n\nlemma type_less_x_Optional [elim!]:\n  \"\\<tau> < Optional \\<sigma> \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Required \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Optional \\<rho> \\<Longrightarrow> \\<rho> < \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  unfolding less_type\\<^sub>N_def less_type_def less_eq_type_def\n  apply (induct rule: converse_tranclp_induct)\n  apply auto[1]\n  apply (erule subtype\\<^sub>N.cases)\n  apply (auto simp: converse_rtranclp_into_rtranclp tranclp_into_tranclp2)[1]\n  apply (auto simp: converse_rtranclp_into_rtranclp tranclp_into_tranclp2)[1]\n  using tranclp_into_rtranclp by fastforce\n\n(*** Properties *************************************************************)\n\nsubsection \\<open>Properties\\<close>\n\nlemma\n  subtype_irrefl: \"\\<tau> < \\<tau> \\<Longrightarrow> False\" and\n  subtype\\<^sub>N_irrefl: \"\\<tau>\\<^sub>N < \\<tau>\\<^sub>N \\<Longrightarrow> False\"\n  for \\<tau> :: \"'a :: order type\"\n  and \\<tau>\\<^sub>N :: \"'a type\\<^sub>N\"\n  apply (induct \\<tau> and \\<tau>\\<^sub>N, auto)\n  by (erule type_less_x_Tuple'; auto simp add: less_type\\<^sub>N_def tranclp_unfold)\n\nlemma subtype_acyclic:\n  \"acyclicP (\\<sqsubset>)\"\nproof -\n  have \"\\<nexists>\\<tau>. (\\<sqsubset>)\\<^sup>+\\<^sup>+ \\<tau> \\<tau>\"\n    by (metis (mono_tags) less_type_def OCL_Types.subtype_irrefl)\n  thus ?thesis\n    by (intro acyclicI) (simp add: trancl_def)\nqed\n\nlemma subtype\\<^sub>N_acyclic:\n  \"acyclicP (\\<sqsubset>\\<^sub>N)\"\nproof -\n  have \"\\<nexists>\\<tau>. (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau> \\<tau>\"\n    by (metis (mono_tags) less_type\\<^sub>N_def OCL_Types.subtype\\<^sub>N_irrefl)\n  thus ?thesis\n    by (intro acyclicI) (simp add: trancl_def)\nqed\n\n(*** Partial Order **********************************************************)\n\nsubsection \\<open>Partial Order\\<close>\n\ninstantiation type :: (order) order\nbegin\n\nlemma less_le_not_le_type:\n  \"\\<tau> < \\<sigma> \\<longleftrightarrow> \\<tau> \\<le> \\<sigma> \\<and> \\<not> \\<sigma> \\<le> \\<tau>\"\n  for \\<tau> \\<sigma> :: \"'a type\"\nproof -\n  have \"(\\<sqsubset>)\\<^sup>+\\<^sup>+ \\<tau> \\<sigma> \\<Longrightarrow> (\\<sqsubset>)\\<^sup>*\\<^sup>* \\<sigma> \\<tau> \\<Longrightarrow> False\"\n    by (metis (mono_tags) subtype_irrefl less_type_def tranclp_rtranclp_tranclp)\n  moreover have \"(\\<sqsubset>)\\<^sup>*\\<^sup>* \\<tau> \\<sigma> \\<Longrightarrow> \\<not> (\\<sqsubset>)\\<^sup>*\\<^sup>* \\<sigma> \\<tau> \\<Longrightarrow> (\\<sqsubset>)\\<^sup>+\\<^sup>+ \\<tau> \\<sigma>\"\n    by (metis rtranclpD)\n  ultimately show ?thesis\n    unfolding less_type_def less_eq_type_def by auto\nqed\n\nlemma order_refl_type:\n  \"\\<tau> \\<le> \\<tau>\"\n  for \\<tau> :: \"'a type\"\n  unfolding less_eq_type_def by simp\n\nlemma order_trans_type:\n  \"\\<tau> \\<le> \\<sigma> \\<Longrightarrow> \\<sigma> \\<le> \\<rho> \\<Longrightarrow> \\<tau> \\<le> \\<rho>\"\n  for \\<tau> \\<sigma> \\<rho> :: \"'a type\"\n  unfolding less_eq_type_def by simp\n\nlemma antisym_type:\n  \"\\<tau> \\<le> \\<sigma> \\<Longrightarrow> \\<sigma> \\<le> \\<tau> \\<Longrightarrow> \\<tau> = \\<sigma>\"\n  for \\<tau> \\<sigma> :: \"'a type\"\n  unfolding less_eq_type_def less_type_def\n  by (metis (mono_tags, lifting) less_eq_type_def\n      less_le_not_le_type less_type_def rtranclpD)\n\ninstance\n  apply intro_classes\n  apply (simp add: less_le_not_le_type)\n  apply (simp add: order_refl_type)\n  using order_trans_type apply blast\n  by (simp add: antisym_type)\n\nend\n\ninstantiation type\\<^sub>N :: (order) order\nbegin\n\nlemma less_le_not_le_type\\<^sub>N:\n  \"\\<tau> < \\<sigma> \\<longleftrightarrow> \\<tau> \\<le> \\<sigma> \\<and> \\<not> \\<sigma> \\<le> \\<tau>\"\n  for \\<tau> \\<sigma> :: \"'a type\\<^sub>N\"\nproof -\n  have \"(\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau> \\<sigma> \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>*\\<^sup>* \\<sigma> \\<tau> \\<Longrightarrow> False\"\n    by (metis subtype\\<^sub>N_irrefl less_type\\<^sub>N_def tranclp_rtranclp_tranclp)\n  moreover have \"(\\<sqsubset>\\<^sub>N)\\<^sup>*\\<^sup>* \\<tau> \\<sigma> \\<Longrightarrow> \\<not> (\\<sqsubset>\\<^sub>N)\\<^sup>*\\<^sup>* \\<sigma> \\<tau> \\<Longrightarrow> (\\<sqsubset>\\<^sub>N)\\<^sup>+\\<^sup>+ \\<tau> \\<sigma>\"\n    by (metis rtranclpD)\n  ultimately show ?thesis\n    unfolding less_type\\<^sub>N_def less_eq_type\\<^sub>N_def by auto\nqed\n\nlemma order_refl_type\\<^sub>N:\n  \"\\<tau> \\<le> \\<tau>\"\n  for \\<tau> :: \"'a type\\<^sub>N\"\n  unfolding less_eq_type\\<^sub>N_def by simp\n\nlemma order_trans_type\\<^sub>N:\n  \"\\<tau> \\<le> \\<sigma> \\<Longrightarrow> \\<sigma> \\<le> \\<rho> \\<Longrightarrow> \\<tau> \\<le> \\<rho>\"\n  for \\<tau> \\<sigma> \\<rho> :: \"'a type\\<^sub>N\"\n  unfolding less_eq_type\\<^sub>N_def by simp\n\nlemma antisym_type\\<^sub>N:\n  \"\\<tau> \\<le> \\<sigma> \\<Longrightarrow> \\<sigma> \\<le> \\<tau> \\<Longrightarrow> \\<tau> = \\<sigma>\"\n  for \\<tau> \\<sigma> :: \"'a type\\<^sub>N\"\n  unfolding less_eq_type\\<^sub>N_def less_type\\<^sub>N_def\n  by (metis (mono_tags, lifting) less_eq_type\\<^sub>N_def\n      less_le_not_le_type\\<^sub>N less_type\\<^sub>N_def rtranclpD)\n\ninstance\n  apply intro_classes\n  apply (simp add: less_le_not_le_type\\<^sub>N)\n  apply (simp add: order_refl_type\\<^sub>N)\n  using order_trans_type\\<^sub>N apply blast\n  by (simp add: antisym_type\\<^sub>N)\n\nend\n\n(*** Non-Strict Introduction Rules ******************************************)\n\nsubsection \\<open>Non-Strict Introduction Rules\\<close>\n\nlemma type_less_eq_x_OclAny_intro [intro]:\n  \"\\<tau> \\<le> OclAny\"\n  unfolding dual_order.order_iff_strict by auto\n\nlemma type_less_eq_OclVoid_x_intro [intro]:\n  \"OclVoid \\<le> \\<tau>\"\n  unfolding dual_order.order_iff_strict by auto\n\nlemma type_less_eq_x_Real_intro [intro]:\n  \"\\<tau> = Real \\<Longrightarrow> \\<tau> \\<le> Real\"\n  \"\\<tau> = Integer \\<Longrightarrow> \\<tau> \\<le> Real\"\n  unfolding dual_order.order_iff_strict by auto\n\nlemma type_less_eq_x_Integer_intro [intro]:\n  \"\\<tau> = Integer \\<Longrightarrow> \\<tau> \\<le> Integer\"\n  unfolding dual_order.order_iff_strict by auto\n\nlemma type_less_eq_x_ObjectType_intro [intro]:\n  \"\\<tau> = \\<langle>\\<C>\\<rangle>\\<^sub>\\<T> \\<Longrightarrow> \\<C> \\<le> \\<D> \\<Longrightarrow> \\<tau> \\<le> \\<langle>\\<D>\\<rangle>\\<^sub>\\<T>\"\n  unfolding dual_order.order_iff_strict by auto\n\nlemma type_less_eq_x_Tuple_intro [intro]:\n  \"\\<tau> = Tuple \\<pi> \\<Longrightarrow> subtuple (\\<le>) \\<pi> \\<xi> \\<Longrightarrow> \\<tau> \\<le> Tuple \\<xi>\"\n  using order.strict_iff_order by blast\n\nlemma type_less_eq_x_Collection_intro [intro]:\n  \"\\<tau> = Collection \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Collection \\<sigma>\"\n  \"\\<tau> = Set \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Collection \\<sigma>\"\n  \"\\<tau> = OrderedSet \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Collection \\<sigma>\"\n  \"\\<tau> = Bag \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Collection \\<sigma>\"\n  \"\\<tau> = Sequence \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Collection \\<sigma>\"\n  unfolding order.order_iff_strict by auto\n\nlemma type_less_eq_x_Set_intro [intro]:\n  \"\\<tau> = Set \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Set \\<sigma>\"\n  unfolding order.order_iff_strict by auto\n\nlemma type_less_eq_x_OrderedSet_intro [intro]:\n  \"\\<tau> = OrderedSet \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> OrderedSet \\<sigma>\"\n  unfolding order.order_iff_strict by auto\n\nlemma type_less_eq_x_Bag_intro [intro]:\n  \"\\<tau> = Bag \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Bag \\<sigma>\"\n  unfolding order.order_iff_strict by auto\n\nlemma type_less_eq_x_Sequence_intro [intro]:\n  \"\\<tau> = Sequence \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Sequence \\<sigma>\"\n  unfolding order.order_iff_strict by auto\n\nlemma type_less_eq_x_Map_intro [intro]:\n  \"\\<phi> = Map \\<tau> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> \\<rho> \\<Longrightarrow> \\<sigma> \\<le> \\<upsilon> \\<Longrightarrow> \\<phi> \\<le> Map \\<rho> \\<upsilon>\"\n  by (metis eq_iff le_imp_less_or_eq order.strict_implies_order type_less_x_Map_intro)\n\nlemma type_less_eq_x_Required_intro [intro]:\n  \"\\<tau> = Required \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Required \\<sigma>\"\n  unfolding order.order_iff_strict by auto\n\nlemma type_less_eq_x_Optional_intro [intro]:\n  \"\\<tau> = Required \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Optional \\<sigma>\"\n  \"\\<tau> = Optional \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> Optional \\<sigma>\"\n  unfolding order.order_iff_strict by auto\n\n(*** Non-Strict Elimination Rules *******************************************)\n\nsubsection \\<open>Non-Strict Elimination Rules\\<close>\n\nlemma type_less_eq_x_OclVoid [elim!]:\n  \"\\<tau> \\<le> OclVoid \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_Boolean [elim!]:\n  \"\\<tau> \\<le> Boolean \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = Boolean \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_Real [elim!]:\n  \"\\<tau> \\<le> Real \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = Integer \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = Real \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_Integer [elim!]:\n  \"\\<tau> \\<le> Integer \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = Integer \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_UnlimitedNatural [elim!]:\n  \"\\<tau> \\<le> UnlimitedNatural \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = UnlimitedNatural \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_String [elim!]:\n  \"\\<tau> \\<le> String \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = String \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_Enum [elim!]:\n  \"\\<tau> \\<le> Enum \\<E> \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = Enum \\<E> \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_ObjectType [elim!]:\n  \"\\<tau> \\<le> \\<langle>\\<D>\\<rangle>\\<^sub>\\<T> \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<C>. \\<tau> = \\<langle>\\<C>\\<rangle>\\<^sub>\\<T> \\<Longrightarrow> \\<C> \\<le> \\<D> \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_x_Tuple [elim!]:\n  \"\\<tau> < Tuple \\<xi> \\<Longrightarrow>\n   (\\<And>\\<pi>. \\<tau> = Tuple \\<pi> \\<Longrightarrow> strict_subtuple (\\<le>) \\<pi> \\<xi> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (erule type_less_x_Tuple')\n  apply (meson acyclic_def subtype\\<^sub>N_acyclic)\n  by simp\n\nlemma type_less_eq_x_Tuple [elim!]:\n  \"\\<tau> \\<le> Tuple \\<xi> \\<Longrightarrow>\n   (\\<And>\\<pi>. \\<tau> = Tuple \\<pi> \\<Longrightarrow> subtuple (\\<le>) \\<pi> \\<xi> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (drule le_imp_less_or_eq, auto)\n  by (simp add: fmap.rel_refl fmrel_to_subtuple)\n\nlemma type_less_eq_x_Collection [elim!]:\n  \"\\<tau> \\<le> Collection \\<sigma> \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Collection \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Set \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = OrderedSet \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Bag \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Sequence \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_Set [elim!]:\n  \"\\<tau> \\<le> Set \\<sigma> \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Set \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_OrderedSet [elim!]:\n  \"\\<tau> \\<le> OrderedSet \\<sigma> \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = OrderedSet \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_Bag [elim!]:\n  \"\\<tau> \\<le> Bag \\<sigma> \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Bag \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_Sequence [elim!]:\n  \"\\<tau> \\<le> Sequence \\<sigma> \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Sequence \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<tau> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_Map [elim!]:\n  \"\\<phi> \\<le> Map \\<rho> \\<upsilon> \\<Longrightarrow>\n   (\\<And>\\<tau> \\<sigma>. \\<phi> = Map \\<tau> \\<sigma> \\<Longrightarrow> \\<tau> \\<le> \\<rho> \\<Longrightarrow> \\<sigma> \\<le> \\<upsilon> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<phi> = OclVoid \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_Required [elim!]:\n  \"\\<tau> \\<le> Required \\<sigma> \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Required \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\nlemma type_less_eq_x_Optional [elim!]:\n  \"\\<tau> \\<le> Optional \\<sigma> \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Required \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow>\n   (\\<And>\\<rho>. \\<tau> = Optional \\<rho> \\<Longrightarrow> \\<rho> \\<le> \\<sigma> \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (drule le_imp_less_or_eq; auto)\n\n(*** Simplification Rules ***************************************************)\n\nsubsection \\<open>Simplification Rules\\<close>\n\ntext \\<open>\n  We can not declare @{thm Orderings.order_class.le_less} as\n  a simplification theorem for two arbitrary types, because it is too aggressive.\n  So we define a specific simplification rules for @{text \"\\<le>\"} operator.\\<close>\n\nlemma type_less_left_simps [simp]:\n  \"OclAny < \\<sigma> = False\"\n  \"OclVoid < \\<sigma> = (\\<sigma> \\<noteq> OclVoid)\"\n\n  \"Boolean < \\<sigma> = (\\<sigma> = OclAny)\"\n  \"Real < \\<sigma> = (\\<sigma> = OclAny)\"\n  \"Integer < \\<sigma> = (\\<sigma> = OclAny \\<or> \\<sigma> = Real)\"\n  \"UnlimitedNatural < \\<sigma> = (\\<sigma> = OclAny)\"\n  \"String < \\<sigma> = (\\<sigma> = OclAny)\"\n\n  \"Enum \\<E> < \\<sigma> = (\\<sigma> = OclAny)\"\n  \"ObjectType \\<C> < \\<sigma> = (\\<exists>\\<D>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = ObjectType \\<D> \\<and> \\<C> < \\<D>)\"\n  \"Tuple \\<pi> < \\<sigma> = (\\<exists>\\<xi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Tuple \\<xi> \\<and> strict_subtuple (\\<le>) \\<pi> \\<xi>)\"\n\n  \"Collection \\<tau> < \\<sigma> = (\\<exists>\\<phi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Collection \\<phi> \\<and> \\<tau> < \\<phi>)\"\n  \"Set \\<tau> < \\<sigma> = (\\<exists>\\<phi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Collection \\<phi> \\<and> \\<tau> \\<le> \\<phi> \\<or>\n      \\<sigma> = Set \\<phi> \\<and> \\<tau> < \\<phi>)\"\n  \"OrderedSet \\<tau> < \\<sigma> = (\\<exists>\\<phi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Collection \\<phi> \\<and> \\<tau> \\<le> \\<phi> \\<or>\n      \\<sigma> = OrderedSet \\<phi> \\<and> \\<tau> < \\<phi>)\"\n  \"Bag \\<tau> < \\<sigma> = (\\<exists>\\<phi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Collection \\<phi> \\<and> \\<tau> \\<le> \\<phi> \\<or>\n      \\<sigma> = Bag \\<phi> \\<and> \\<tau> < \\<phi>)\"\n  \"Sequence \\<tau> < \\<sigma> = (\\<exists>\\<phi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Collection \\<phi> \\<and> \\<tau> \\<le> \\<phi> \\<or>\n      \\<sigma> = Sequence \\<phi> \\<and> \\<tau> < \\<phi>)\"\n\n  \"Map \\<tau> \\<phi> < \\<sigma> = (\\<exists>\\<rho> \\<upsilon>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Map \\<rho> \\<upsilon> \\<and> \\<tau> = \\<rho> \\<and> \\<phi> < \\<upsilon> \\<or>\n      \\<sigma> = Map \\<rho> \\<upsilon> \\<and> \\<tau> < \\<rho> \\<and> \\<phi> = \\<upsilon> \\<or>\n      \\<sigma> = Map \\<rho> \\<upsilon> \\<and> \\<tau> < \\<rho> \\<and> \\<phi> < \\<upsilon>)\"\n  by (induct \\<sigma>; auto)+\n\nlemma type_less_eq_left_simps [simp]:\n  \"OclAny \\<le> \\<sigma> = (\\<sigma> = OclAny)\"\n  \"OclVoid \\<le> \\<sigma> = True\"\n\n  \"Boolean \\<le> \\<sigma> = (\\<sigma> = OclAny \\<or> \\<sigma> = Boolean)\"\n  \"Real \\<le> \\<sigma> = (\\<sigma> = OclAny \\<or> \\<sigma> = Real)\"\n  \"Integer \\<le> \\<sigma> = (\\<sigma> = OclAny \\<or> \\<sigma> = Real \\<or> \\<sigma> = Integer)\"\n  \"UnlimitedNatural \\<le> \\<sigma> = (\\<sigma> = OclAny \\<or> \\<sigma> = UnlimitedNatural)\"\n  \"String \\<le> \\<sigma> = (\\<sigma> = OclAny \\<or> \\<sigma> = String)\"\n\n  \"Enum \\<E> \\<le> \\<sigma> = (\\<sigma> = OclAny \\<or> \\<sigma> = Enum \\<E>)\"\n  \"ObjectType \\<C> \\<le> \\<sigma> = (\\<exists>\\<D>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = ObjectType \\<D> \\<and> \\<C> \\<le> \\<D>)\"\n  \"Tuple \\<pi> \\<le> \\<sigma> = (\\<exists>\\<xi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Tuple \\<xi> \\<and> subtuple (\\<le>) \\<pi> \\<xi>)\"\n\n  \"Collection \\<tau> \\<le> \\<sigma> = (\\<exists>\\<phi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Collection \\<phi> \\<and> \\<tau> \\<le> \\<phi>)\"\n  \"Set \\<tau> \\<le> \\<sigma> = (\\<exists>\\<phi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Collection \\<phi> \\<and> \\<tau> \\<le> \\<phi> \\<or>\n      \\<sigma> = Set \\<phi> \\<and> \\<tau> \\<le> \\<phi>)\"\n  \"OrderedSet \\<tau> \\<le> \\<sigma> = (\\<exists>\\<phi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Collection \\<phi> \\<and> \\<tau> \\<le> \\<phi> \\<or>\n      \\<sigma> = OrderedSet \\<phi> \\<and> \\<tau> \\<le> \\<phi>)\"\n  \"Bag \\<tau> \\<le> \\<sigma> = (\\<exists>\\<phi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Collection \\<phi> \\<and> \\<tau> \\<le> \\<phi> \\<or>\n      \\<sigma> = Bag \\<phi> \\<and> \\<tau> \\<le> \\<phi>)\"\n  \"Sequence \\<tau> \\<le> \\<sigma> = (\\<exists>\\<phi>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Collection \\<phi> \\<and> \\<tau> \\<le> \\<phi> \\<or>\n      \\<sigma> = Sequence \\<phi> \\<and> \\<tau> \\<le> \\<phi>)\"\n\n  \"Map \\<tau> \\<phi> \\<le> \\<sigma> = (\\<exists>\\<rho> \\<upsilon>.\n      \\<sigma> = OclAny \\<or>\n      \\<sigma> = Map \\<rho> \\<upsilon> \\<and> \\<tau> \\<le> \\<rho> \\<and> \\<phi> \\<le> \\<upsilon>)\"\n  by (auto simp: order.order_iff_strict reflpI)\n\nlemma type\\<^sub>N_less_left_simps [simp]:\n  \"Required \\<rho> < \\<sigma> = (\\<exists>\\<upsilon>.\n      \\<sigma> = Required \\<upsilon> \\<and> \\<rho> < \\<upsilon> \\<or>\n      \\<sigma> = Optional \\<upsilon> \\<and> \\<rho> \\<le> \\<upsilon>)\"\n  \"Optional \\<rho> < \\<sigma> = (\\<exists>\\<upsilon>.\n      \\<sigma> = Optional \\<upsilon> \\<and> \\<rho> < \\<upsilon>)\"\n  by (induct \\<sigma>; auto)+\n\nlemma type\\<^sub>N_less_eq_left_simps [simp]:\n  \"Required \\<rho> \\<le> \\<sigma> = (\\<exists>\\<upsilon>.\n      \\<sigma> = Required \\<upsilon> \\<and> \\<rho> \\<le> \\<upsilon> \\<or>\n      \\<sigma> = Optional \\<upsilon> \\<and> \\<rho> \\<le> \\<upsilon>)\"\n  \"Optional \\<rho> \\<le> \\<sigma> = (\\<exists>\\<upsilon>.\n      \\<sigma> = Optional \\<upsilon> \\<and> \\<rho> \\<le> \\<upsilon>)\"\n  by (auto simp: dual_order.order_iff_strict)\n\nlemma type_less_right_simps [simp]:\n  \"\\<tau> < OclAny = (\\<tau> \\<noteq> OclAny)\"\n  \"\\<tau> < OclVoid = False\"\n\n  \"\\<tau> < Boolean = (\\<tau> = OclVoid)\"\n  \"\\<tau> < Real = (\\<tau> = Integer \\<or> \\<tau> = OclVoid)\"\n  \"\\<tau> < Integer = (\\<tau> = OclVoid)\"\n  \"\\<tau> < UnlimitedNatural = (\\<tau> = OclVoid)\"\n  \"\\<tau> < String = (\\<tau> = OclVoid)\"\n\n  \"\\<tau> < Enum \\<E> = (\\<tau> = OclVoid)\"\n  \"\\<tau> < ObjectType \\<D> = (\\<exists>\\<C>.\n      \\<tau> = ObjectType \\<C> \\<and> \\<C> < \\<D> \\<or>\n      \\<tau> = OclVoid)\"\n  \"\\<tau> < Tuple \\<xi> = (\\<exists>\\<pi>.\n      \\<tau> = Tuple \\<pi> \\<and> strict_subtuple (\\<le>) \\<pi> \\<xi> \\<or>\n      \\<tau> = OclVoid)\"\n\n  \"\\<tau> < Collection \\<sigma> = (\\<exists>\\<phi>.\n      \\<tau> = Collection \\<phi> \\<and> \\<phi> < \\<sigma> \\<or>\n      \\<tau> = Set \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or>\n      \\<tau> = OrderedSet \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or>\n      \\<tau> = Bag \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or>\n      \\<tau> = Sequence \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or>\n      \\<tau> = OclVoid)\"\n  \"\\<tau> < Set \\<sigma> = (\\<exists>\\<phi>.\n      \\<tau> = Set \\<phi> \\<and> \\<phi> < \\<sigma> \\<or>\n      \\<tau> = OclVoid)\"\n  \"\\<tau> < OrderedSet \\<sigma> = (\\<exists>\\<phi>.\n      \\<tau> = OrderedSet \\<phi> \\<and> \\<phi> < \\<sigma> \\<or>\n      \\<tau> = OclVoid)\"\n  \"\\<tau> < Bag \\<sigma> = (\\<exists>\\<phi>.\n      \\<tau> = Bag \\<phi> \\<and> \\<phi> < \\<sigma> \\<or>\n      \\<tau> = OclVoid)\"\n  \"\\<tau> < Sequence \\<sigma> = (\\<exists>\\<phi>.\n      \\<tau> = Sequence \\<phi> \\<and> \\<phi> < \\<sigma> \\<or>\n      \\<tau> = OclVoid)\"\n\n  \"\\<tau> < Map \\<rho> \\<upsilon> = (\\<exists>\\<phi> \\<sigma>.\n      \\<tau> = Map \\<phi> \\<sigma> \\<and> \\<phi> = \\<rho> \\<and> \\<sigma> < \\<upsilon> \\<or>\n      \\<tau> = Map \\<phi> \\<sigma> \\<and> \\<phi> < \\<rho> \\<and> \\<sigma> = \\<upsilon> \\<or>\n      \\<tau> = Map \\<phi> \\<sigma> \\<and> \\<phi> < \\<rho> \\<and> \\<sigma> < \\<upsilon> \\<or>\n      \\<tau> = OclVoid)\"\n  by auto\n\nlemma type_less_eq_right_simps [simp]:\n  \"\\<tau> \\<le> OclAny = True\"\n  \"\\<tau> \\<le> OclVoid = (\\<tau> = OclVoid)\"\n\n  \"\\<tau> \\<le> Boolean = (\\<tau> = Boolean \\<or> \\<tau> = OclVoid)\"\n  \"\\<tau> \\<le> Real = (\\<tau> = Real \\<or> \\<tau> = Integer \\<or> \\<tau> = OclVoid)\"\n  \"\\<tau> \\<le> Integer = (\\<tau> = Integer \\<or> \\<tau> = OclVoid)\"\n  \"\\<tau> \\<le> UnlimitedNatural = (\\<tau> = UnlimitedNatural \\<or> \\<tau> = OclVoid)\"\n  \"\\<tau> \\<le> String = (\\<tau> = String \\<or> \\<tau> = OclVoid)\"\n\n  \"\\<tau> \\<le> Enum \\<E> = (\\<tau> = Enum \\<E> \\<or> \\<tau> = OclVoid)\"\n  \"\\<tau> \\<le> ObjectType \\<D> = (\\<exists>\\<C>. \\<tau> = ObjectType \\<C> \\<and> \\<C> \\<le> \\<D> \\<or> \\<tau> = OclVoid)\"\n  \"\\<tau> \\<le> Tuple \\<xi> = (\\<exists>\\<pi>. \\<tau> = Tuple \\<pi> \\<and> subtuple (\\<le>) \\<pi> \\<xi> \\<or> \\<tau> = OclVoid)\"\n\n  \"\\<tau> \\<le> Collection \\<sigma> = (\\<exists>\\<phi>.\n      \\<tau> = Collection \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or>\n      \\<tau> = Set \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or>\n      \\<tau> = OrderedSet \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or>\n      \\<tau> = Bag \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or>\n      \\<tau> = Sequence \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or>\n      \\<tau> = OclVoid)\"\n  \"\\<tau> \\<le> Set \\<sigma> = (\\<exists>\\<phi>. \\<tau> = Set \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or> \\<tau> = OclVoid)\"\n  \"\\<tau> \\<le> OrderedSet \\<sigma> = (\\<exists>\\<phi>. \\<tau> = OrderedSet \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or> \\<tau> = OclVoid)\"\n  \"\\<tau> \\<le> Bag \\<sigma> = (\\<exists>\\<phi>. \\<tau> = Bag \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or> \\<tau> = OclVoid)\"\n  \"\\<tau> \\<le> Sequence \\<sigma> = (\\<exists>\\<phi>. \\<tau> = Sequence \\<phi> \\<and> \\<phi> \\<le> \\<sigma> \\<or> \\<tau> = OclVoid)\"\n\n  \"\\<tau> \\<le> Map \\<rho> \\<upsilon> = (\\<exists>\\<phi> \\<sigma>.\n      \\<tau> = Map \\<phi> \\<sigma> \\<and> \\<phi> \\<le> \\<rho> \\<and> \\<sigma> \\<le> \\<upsilon> \\<or>\n      \\<tau> = OclVoid)\"\n  by (auto simp: order.order_iff_strict reflpI)\n\nlemma type\\<^sub>N_less_right_simps [simp]:\n  \"\\<tau> < Required \\<upsilon> = (\\<exists>\\<rho>.\n      \\<tau> = Required \\<rho> \\<and> \\<rho> < \\<upsilon>)\"\n  \"\\<tau> < Optional \\<upsilon> = (\\<exists>\\<rho>.\n      \\<tau> = Required \\<rho> \\<and> \\<rho> \\<le> \\<upsilon> \\<or>\n      \\<tau> = Optional \\<rho> \\<and> \\<rho> < \\<upsilon>)\"\n  by auto\n\nlemma type\\<^sub>N_less_eq_right_simps [simp]:\n  \"\\<tau> \\<le> Required \\<upsilon> = (\\<exists>\\<rho>.\n      \\<tau> = Required \\<rho> \\<and> \\<rho> \\<le> \\<upsilon>)\"\n  \"\\<tau> \\<le> Optional \\<upsilon> = (\\<exists>\\<rho>.\n      \\<tau> = Required \\<rho> \\<and> \\<rho> \\<le> \\<upsilon> \\<or>\n      \\<tau> = Optional \\<rho> \\<and> \\<rho> \\<le> \\<upsilon>)\"\n  by auto\n\n(*** Upper Semilattice of Types *********************************************)\n\nsection \\<open>Upper Semilattice of Types\\<close>\n\nnotation sup (infixl \"\\<squnion>\" 65)\n\nfun type_sup (infixl \"\\<squnion>\\<^sub>T\" 65)\nand type_sup\\<^sub>N (infixl \"\\<squnion>\\<^sub>N\" 65) where\n  \"OclAny \\<squnion>\\<^sub>T \\<sigma> = OclAny\"\n| \"OclVoid \\<squnion>\\<^sub>T \\<sigma> = \\<sigma>\"\n\n| \"Boolean \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of Boolean \\<Rightarrow> Boolean\n     | OclVoid \\<Rightarrow> Boolean\n     | _ \\<Rightarrow> OclAny)\"\n| \"Real \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of Real \\<Rightarrow> Real\n     | Integer \\<Rightarrow> Real\n     | OclVoid \\<Rightarrow> Real\n     | _ \\<Rightarrow> OclAny)\"\n| \"Integer \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of Real \\<Rightarrow> Real\n     | Integer \\<Rightarrow> Integer\n     | OclVoid \\<Rightarrow> Integer\n     | _ \\<Rightarrow> OclAny)\"\n| \"UnlimitedNatural \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of UnlimitedNatural \\<Rightarrow> UnlimitedNatural\n     | OclVoid \\<Rightarrow> UnlimitedNatural\n     | _ \\<Rightarrow> OclAny)\"\n| \"String \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of String \\<Rightarrow> String\n     | OclVoid \\<Rightarrow> String\n     | _ \\<Rightarrow> OclAny)\"\n\n| \"Enum \\<E> \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of Enum \\<E>' \\<Rightarrow> if \\<E> = \\<E>' then Enum \\<E> else OclAny\n     | OclVoid \\<Rightarrow> Enum \\<E>\n     | _ \\<Rightarrow> OclAny)\"\n| \"\\<langle>\\<C>\\<rangle>\\<^sub>\\<T> \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of \\<langle>\\<D>\\<rangle>\\<^sub>\\<T> \\<Rightarrow> \\<langle>\\<C> \\<squnion> \\<D>\\<rangle>\\<^sub>\\<T>\n     | OclVoid \\<Rightarrow> \\<langle>\\<C>\\<rangle>\\<^sub>\\<T>\n     | _ \\<Rightarrow> OclAny)\"\n| \"Tuple \\<pi> \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of Tuple \\<xi> \\<Rightarrow> Tuple (fmmerge_fun (\\<squnion>\\<^sub>N) \\<pi> \\<xi>)\n     | OclVoid \\<Rightarrow> Tuple \\<pi>\n     | _ \\<Rightarrow> OclAny)\"\n\n| \"Collection \\<tau> \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of Collection \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Set \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | OrderedSet \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Bag \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Sequence \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | OclVoid \\<Rightarrow> Collection \\<tau>\n     | _ \\<Rightarrow> OclAny)\"\n| \"Set \\<tau> \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of Collection \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Set \\<rho> \\<Rightarrow> Set (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | OrderedSet \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Bag \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Sequence \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | OclVoid \\<Rightarrow> Set \\<tau>\n     | _ \\<Rightarrow> OclAny)\"\n| \"OrderedSet \\<tau> \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of Collection \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Set \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | OrderedSet \\<rho> \\<Rightarrow> OrderedSet (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Bag \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Sequence \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | OclVoid \\<Rightarrow> OrderedSet \\<tau>\n     | _ \\<Rightarrow> OclAny)\"\n| \"Bag \\<tau> \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of Collection \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Set \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | OrderedSet \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Bag \\<rho> \\<Rightarrow> Bag (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Sequence \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | OclVoid \\<Rightarrow> Bag \\<tau>\n     | _ \\<Rightarrow> OclAny)\"\n| \"Sequence \\<tau> \\<squnion>\\<^sub>T \\<sigma> = (case \\<sigma>\n    of Collection \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Set \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | OrderedSet \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Bag \\<rho> \\<Rightarrow> Collection (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | Sequence \\<rho> \\<Rightarrow> Sequence (\\<tau> \\<squnion>\\<^sub>N \\<rho>)\n     | OclVoid \\<Rightarrow> Sequence \\<tau>\n     | _ \\<Rightarrow> OclAny)\"\n\n| \"Map \\<tau> \\<sigma> \\<squnion>\\<^sub>T \\<phi> = (case \\<phi>\n    of Map \\<rho> \\<upsilon> \\<Rightarrow> Map (\\<tau> \\<squnion>\\<^sub>N \\<rho>) (\\<sigma> \\<squnion>\\<^sub>N \\<upsilon>)\n     | OclVoid \\<Rightarrow> Map \\<tau> \\<sigma>\n     | _ \\<Rightarrow> OclAny)\"\n\n| \"Required \\<tau> \\<squnion>\\<^sub>N \\<sigma> = (case \\<sigma>\n    of Required \\<rho> \\<Rightarrow> Required (\\<tau> \\<squnion>\\<^sub>T \\<rho>)\n     | Optional \\<rho> \\<Rightarrow> Optional (\\<tau> \\<squnion>\\<^sub>T \\<rho>))\"\n| \"Optional \\<tau> \\<squnion>\\<^sub>N \\<sigma> = (case \\<sigma>\n    of Required \\<rho> \\<Rightarrow> Optional (\\<tau> \\<squnion>\\<^sub>T \\<rho>)\n     | Optional \\<rho> \\<Rightarrow> Optional (\\<tau> \\<squnion>\\<^sub>T \\<rho>))\"\n\nlemma sup_ge1_type:\n  \"\\<tau> \\<le> \\<tau> \\<squnion>\\<^sub>T \\<sigma>\"\n  \"\\<tau>\\<^sub>N \\<le> \\<tau>\\<^sub>N \\<squnion>\\<^sub>N \\<sigma>\\<^sub>N\"\n  for \\<tau> \\<sigma> :: \"'a::{order,semilattice_sup} type\"\n  and \\<tau>\\<^sub>N \\<sigma>\\<^sub>N :: \"'a type\\<^sub>N\"\nproof (induct \\<tau> and \\<tau>\\<^sub>N arbitrary: \\<sigma> and \\<sigma>\\<^sub>N)\n  case OclAny show ?case by auto\nnext\n  case OclVoid show ?case by auto\nnext\n  case Boolean show ?case by (cases \\<sigma>; auto)\nnext\n  case Real show ?case by (cases \\<sigma>; auto)\nnext\n  case Integer show ?case by (cases \\<sigma>; auto)\nnext\n  case UnlimitedNatural show ?case by (cases \\<sigma>; auto)\nnext\n  case String show ?case by (cases \\<sigma>; auto)\nnext\n  case (Enum \\<E>) show ?case by (cases \\<sigma>; auto)\nnext\n  case (ObjectType \\<C>) show ?case by (cases \\<sigma>; auto)\nnext\n  case (Tuple \\<pi>) thus ?case by (cases \\<sigma>;\n    auto simp del: type_less_eq_left_simps type_less_eq_right_simps)\nnext\n  case (Collection \\<tau>) thus ?case by (cases \\<sigma>; auto)\nnext\n  case (Set \\<tau>) thus ?case by (cases \\<sigma>; auto)\nnext\n  case (OrderedSet \\<tau>) thus ?case by (cases \\<sigma>; auto)\nnext\n  case (Bag \\<tau>) thus ?case by (cases \\<sigma>; auto)\nnext\n  case (Sequence \\<tau>) thus ?case by (cases \\<sigma>; auto)\nnext\n  case (Map \\<tau> \\<phi>) thus ?case by (cases \\<sigma>; auto)\nnext\n  case (Required \\<tau>) thus ?case by (cases \\<sigma>\\<^sub>N; auto)\nnext\n  case (Optional \\<tau>) thus ?case by (cases \\<sigma>\\<^sub>N; auto)\nqed\n\nlemma sup_commut_type:\n  \"\\<tau> \\<squnion>\\<^sub>T \\<sigma> = \\<sigma> \\<squnion>\\<^sub>T \\<tau>\"\n  \"\\<tau>\\<^sub>N \\<squnion>\\<^sub>N \\<sigma>\\<^sub>N = \\<sigma>\\<^sub>N \\<squnion>\\<^sub>N \\<tau>\\<^sub>N\"\n  for \\<tau> \\<sigma> :: \"'a::semilattice_sup type\"\n  and \\<tau>\\<^sub>N \\<sigma>\\<^sub>N :: \"'a type\\<^sub>N\"\nproof (induct \\<tau> and \\<tau>\\<^sub>N arbitrary: \\<sigma> and \\<sigma>\\<^sub>N)\n  case OclAny show ?case by (cases \\<sigma>; simp)\nnext\n  case OclVoid show ?case by (cases \\<sigma>; simp)\nnext\n  case Boolean show ?case by (cases \\<sigma>; simp)\nnext\n  case Real show ?case by (cases \\<sigma>; simp)\nnext\n  case Integer show ?case by (cases \\<sigma>; simp)\nnext\n  case UnlimitedNatural show ?case by (cases \\<sigma>; simp)\nnext\n  case String show ?case by (cases \\<sigma>; simp)\nnext\n  case (Enum \\<E>) show ?case by (cases \\<sigma>; simp)\nnext\n  case (ObjectType \\<C>) show ?case by (cases \\<sigma>; simp add: sup_commute)\nnext\n  case (Tuple \\<pi>) thus ?case apply (cases \\<sigma>; simp)\n    using fmmerge_commut by blast\nnext\n  case (Collection \\<tau>) thus ?case by (cases \\<sigma>; simp)\nnext\n  case (Set \\<tau>) thus ?case by (cases \\<sigma>; simp)\nnext\n  case (OrderedSet \\<tau>) thus ?case by (cases \\<sigma>; simp)\nnext\n  case (Bag \\<tau>) thus ?case by (cases \\<sigma>; simp)\nnext\n  case (Sequence \\<tau>) thus ?case by (cases \\<sigma>; simp)\nnext\n  case (Map \\<tau> \\<phi>) thus ?case by (cases \\<sigma>; simp)\nnext\n  case (Required \\<tau>) thus ?case by (cases \\<sigma>\\<^sub>N; simp)\nnext\n  case (Optional \\<tau>) thus ?case by (cases \\<sigma>\\<^sub>N; simp)\nqed\n\nlemma sup_least_type:\n  \"\\<tau> \\<le> \\<rho> \\<Longrightarrow> \\<sigma> \\<le> \\<rho> \\<Longrightarrow> \\<tau> \\<squnion>\\<^sub>T \\<sigma> \\<le> \\<rho>\"\n  \"\\<tau>\\<^sub>N \\<le> \\<rho>\\<^sub>N \\<Longrightarrow> \\<sigma>\\<^sub>N \\<le> \\<rho>\\<^sub>N \\<Longrightarrow> \\<tau>\\<^sub>N \\<squnion>\\<^sub>N \\<sigma>\\<^sub>N \\<le> \\<rho>\\<^sub>N\"\n  for \\<tau> \\<sigma> \\<rho> :: \"'a::semilattice_sup type\"\n  and \\<tau>\\<^sub>N \\<sigma>\\<^sub>N \\<rho>\\<^sub>N :: \"'a type\\<^sub>N\"\n  by (induct \\<rho> and \\<rho>\\<^sub>N arbitrary: \\<tau> \\<sigma> and \\<tau>\\<^sub>N \\<sigma>\\<^sub>N,\n      auto simp: fmrel_on_fset_fmmerge1)\n\nno_notation type_sup (infixl \"\\<squnion>\\<^sub>T\" 65)\nno_notation type_sup\\<^sub>N (infixl \"\\<squnion>\\<^sub>N\" 65)\n\n\ninstantiation type :: (semilattice_sup) semilattice_sup\nbegin\ndefinition sup_type where [simp, code]: \"sup_type \\<equiv> type_sup\"\ninstance\n  apply intro_classes\n  apply (simp add: sup_ge1_type)\n  apply (simp add: sup_commut_type sup_ge1_type)\n  by (simp add: sup_least_type)\nend\n\ninstantiation type\\<^sub>N :: (semilattice_sup) semilattice_sup\nbegin\ndefinition sup_type\\<^sub>N where [simp, code]: \"sup_type\\<^sub>N \\<equiv> type_sup\\<^sub>N\"\ninstance\n  apply intro_classes\n  apply (simp add: sup_ge1_type)\n  apply (simp add: sup_commut_type sup_ge1_type)\n  by (simp add: sup_least_type)\nend\n\n(*** Code Setup *************************************************************)\n\nsection \\<open>Code Setup\\<close>\n\ncode_pred subtype .\n\nlemma Tuple_measure_intro [intro]:\n  assumes \"fmlookup \\<xi> k = Some \\<sigma>\"\n    shows \"(Inr (\\<tau>, \\<sigma>), Inl (Tuple \\<pi>, Tuple \\<xi>)) \\<in>\n   case_sum (type_size \\<circ> snd) (type_size\\<^sub>N \\<circ> snd) <*mlex*> {}\"\nproof -\n  have \"fmlookup \\<xi> k = Some \\<sigma> \\<Longrightarrow> type_size\\<^sub>N \\<sigma> < type_size (Tuple \\<xi>)\"\n    by (simp add: elem_le_ffold' fmran'I)\n  with assms show ?thesis\n    unfolding mlex_prod_def less_eq by simp\nqed\n\nfunction subtype\\<^sub>T_fun :: \"'a::order type \\<Rightarrow> 'a type \\<Rightarrow> bool\"\n     and subtype\\<^sub>N_fun :: \"'a type\\<^sub>N \\<Rightarrow> 'a type\\<^sub>N \\<Rightarrow> bool\" where\n\n  \"subtype\\<^sub>T_fun OclAny _ = False\"\n| \"subtype\\<^sub>T_fun OclVoid \\<sigma> = (\\<sigma> \\<noteq> OclVoid)\"\n\n| \"subtype\\<^sub>T_fun Boolean \\<sigma> = (\\<sigma> = OclAny)\"\n| \"subtype\\<^sub>T_fun Real \\<sigma> = (\\<sigma> = OclAny)\"\n| \"subtype\\<^sub>T_fun Integer \\<sigma> = (\\<sigma> = Real \\<or> \\<sigma> = OclAny)\"\n| \"subtype\\<^sub>T_fun UnlimitedNatural \\<sigma> = (\\<sigma> = OclAny)\"\n| \"subtype\\<^sub>T_fun String \\<sigma> = (\\<sigma> = OclAny)\"\n\n| \"subtype\\<^sub>T_fun (Enum _) \\<sigma> = (\\<sigma> = OclAny)\"\n| \"subtype\\<^sub>T_fun \\<langle>\\<C>\\<rangle>\\<^sub>\\<T> \\<sigma> = (case \\<sigma>\n    of OclAny \\<Rightarrow> True\n     | \\<langle>\\<D>\\<rangle>\\<^sub>\\<T> \\<Rightarrow> \\<C> < \\<D>\n     | _ \\<Rightarrow> False)\"\n| \"subtype\\<^sub>T_fun (Tuple \\<pi>) \\<sigma> = (case \\<sigma>\n    of OclAny \\<Rightarrow> True\n     | Tuple \\<xi> \\<Rightarrow> strict_subtuple_fun (\\<lambda>\\<tau> \\<sigma>. subtype\\<^sub>N_fun \\<tau> \\<sigma> \\<or> \\<tau> = \\<sigma>) \\<pi> \\<xi>\n     | _ \\<Rightarrow> False)\"\n\n| \"subtype\\<^sub>T_fun (Collection \\<tau>) \\<sigma> = (case \\<sigma>\n    of OclAny \\<Rightarrow> True\n     | Collection \\<rho> \\<Rightarrow> subtype\\<^sub>N_fun \\<tau> \\<rho>\n     | _ \\<Rightarrow> False)\"\n| \"subtype\\<^sub>T_fun (Set \\<tau>) \\<sigma> = (case \\<sigma>\n    of OclAny \\<Rightarrow> True\n     | Collection \\<rho> \\<Rightarrow> subtype\\<^sub>N_fun \\<tau> \\<rho> \\<or> \\<tau> = \\<rho>\n     | Set \\<rho> \\<Rightarrow> subtype\\<^sub>N_fun \\<tau> \\<rho>\n     | _ \\<Rightarrow> False)\"\n| \"subtype\\<^sub>T_fun (OrderedSet \\<tau>) \\<sigma> = (case \\<sigma>\n    of OclAny \\<Rightarrow> True\n     | Collection \\<rho> \\<Rightarrow> subtype\\<^sub>N_fun \\<tau> \\<rho> \\<or> \\<tau> = \\<rho>\n     | OrderedSet \\<rho> \\<Rightarrow> subtype\\<^sub>N_fun \\<tau> \\<rho>\n     | _ \\<Rightarrow> False)\"\n| \"subtype\\<^sub>T_fun (Bag \\<tau>) \\<sigma> = (case \\<sigma>\n    of OclAny \\<Rightarrow> True\n     | Collection \\<rho> \\<Rightarrow> subtype\\<^sub>N_fun \\<tau> \\<rho> \\<or> \\<tau> = \\<rho>\n     | Bag \\<rho> \\<Rightarrow> subtype\\<^sub>N_fun \\<tau> \\<rho>\n     | _ \\<Rightarrow> False)\"\n| \"subtype\\<^sub>T_fun (Sequence \\<tau>) \\<sigma> = (case \\<sigma>\n    of OclAny \\<Rightarrow> True\n     | Collection \\<rho> \\<Rightarrow> subtype\\<^sub>N_fun \\<tau> \\<rho> \\<or> \\<tau> = \\<rho>\n     | Sequence \\<rho> \\<Rightarrow> subtype\\<^sub>N_fun \\<tau> \\<rho>\n     | _ \\<Rightarrow> False)\"\n\n| \"subtype\\<^sub>T_fun (Map \\<tau> \\<sigma>) \\<phi> = (case \\<phi>\n    of OclAny \\<Rightarrow> True\n     | Map \\<rho> \\<upsilon> \\<Rightarrow>\n        \\<tau> = \\<rho> \\<and> subtype\\<^sub>N_fun \\<sigma> \\<upsilon> \\<or>\n        subtype\\<^sub>N_fun \\<tau> \\<rho> \\<and> \\<sigma> = \\<upsilon> \\<or>\n        subtype\\<^sub>N_fun \\<tau> \\<rho> \\<and> subtype\\<^sub>N_fun \\<sigma> \\<upsilon>\n     | _ \\<Rightarrow> False)\"\n\n| \"subtype\\<^sub>N_fun (Required \\<tau>) \\<sigma> = (case \\<sigma>\n    of Required \\<rho> \\<Rightarrow> subtype\\<^sub>T_fun \\<tau> \\<rho>\n     | Optional \\<rho> \\<Rightarrow> subtype\\<^sub>T_fun \\<tau> \\<rho> \\<or> \\<tau> = \\<rho>)\"\n| \"subtype\\<^sub>N_fun (Optional \\<tau>) \\<sigma>\\<^sub>N = (case \\<sigma>\\<^sub>N\n    of Required \\<rho> \\<Rightarrow> False\n     | Optional \\<rho> \\<Rightarrow> subtype\\<^sub>T_fun \\<tau> \\<rho>)\"\n  by pat_completeness auto\ntermination\n  apply (relation \"case_sum (size \\<circ> snd) (size \\<circ> snd) <*mlex*> {}\")\n  by (auto simp add: wf_mlex mlex_less)\n\nlemma subtuple_subtype\\<^sub>N_fun_intro [simp]:\n  assumes \"(\\<And>\\<tau> \\<sigma>\\<^sub>N. \\<tau> \\<in> fmran' \\<pi> \\<Longrightarrow> \\<tau> < \\<sigma>\\<^sub>N \\<Longrightarrow> subtype\\<^sub>N_fun \\<tau> \\<sigma>\\<^sub>N)\"\n      and \"subtuple (\\<le>) \\<pi> \\<xi>\"\n    shows \"subtuple (\\<lambda>\\<tau> \\<sigma>. subtype\\<^sub>N_fun \\<tau> \\<sigma> \\<or> \\<tau> = \\<sigma>) \\<pi> \\<xi>\"\nproof -\n  have \"subtuple (\\<le>) \\<pi> \\<xi> \\<longrightarrow> subtuple (\\<lambda>\\<tau> \\<sigma>. subtype\\<^sub>N_fun \\<tau> \\<sigma> \\<or> \\<tau> = \\<sigma>) \\<pi> \\<xi>\"\n    apply (rule subtuple_mono)\n    using assms(1) by auto\n  with assms(2) show ?thesis by simp\nqed\n\nlemma subtuple_subtype\\<^sub>N_fun_drule [simp]:\n  assumes \"(\\<And>\\<tau> \\<sigma>\\<^sub>N. \\<tau> \\<in> fmran' \\<pi> \\<Longrightarrow> subtype\\<^sub>N_fun \\<tau> \\<sigma>\\<^sub>N \\<Longrightarrow> \\<tau> < \\<sigma>\\<^sub>N)\"\n      and \"subtuple (\\<lambda>\\<tau> \\<sigma>. subtype\\<^sub>N_fun \\<tau> \\<sigma> \\<or> \\<tau> = \\<sigma>) \\<pi> \\<xi>\"\n    shows \"subtuple (\\<le>) \\<pi> \\<xi>\"\nproof -\n  have \"subtuple (\\<lambda>\\<tau> \\<sigma>. subtype\\<^sub>N_fun \\<tau> \\<sigma> \\<or> \\<tau> = \\<sigma>) \\<pi> \\<xi> \\<longrightarrow> subtuple (\\<le>) \\<pi> \\<xi>\"\n    apply (rule subtuple_mono)\n    by (simp add: assms(1) order.strict_implies_order)\n  with assms(2) show ?thesis by simp\nqed\n\nlemma\n  subtype\\<^sub>T_fun_intro: \"\\<tau> < \\<sigma> \\<Longrightarrow> subtype\\<^sub>T_fun \\<tau> \\<sigma>\" and\n  subtype\\<^sub>N_fun_intro: \"\\<tau>\\<^sub>N < \\<sigma>\\<^sub>N \\<Longrightarrow> subtype\\<^sub>N_fun \\<tau>\\<^sub>N \\<sigma>\\<^sub>N\"\n  for \\<tau> \\<sigma> :: \"'a::order type\"\n  and \\<tau>\\<^sub>N \\<sigma>\\<^sub>N :: \"'a type\\<^sub>N\"\n  by (induct \\<tau> and \\<tau>\\<^sub>N arbitrary: \\<sigma> and \\<sigma>\\<^sub>N, auto)\n\nlemma\n  subtype\\<^sub>T_fun_drule: \"subtype\\<^sub>T_fun \\<tau> \\<sigma> \\<Longrightarrow> \\<tau> < \\<sigma>\" and\n  subtype\\<^sub>N_fun_drule: \"subtype\\<^sub>N_fun \\<tau>\\<^sub>N \\<sigma>\\<^sub>N \\<Longrightarrow> \\<tau>\\<^sub>N < \\<sigma>\\<^sub>N\"\n  for \\<tau> \\<sigma> :: \"'a::order type\"\n  and \\<tau>\\<^sub>N \\<sigma>\\<^sub>N :: \"'a type\\<^sub>N\"\nproof (induct \\<tau> and \\<tau>\\<^sub>N arbitrary: \\<sigma> and \\<sigma>\\<^sub>N)\n  case OclAny thus ?case by auto\nnext\n  case OclVoid thus ?case by auto\nnext\n  case Boolean thus ?case by auto\nnext\n  case Real thus ?case by auto\nnext\n  case Integer thus ?case by auto\nnext\n  case UnlimitedNatural thus ?case by auto\nnext\n  case String thus ?case by auto\nnext\n  case (Enum \\<E>) thus ?case by auto\nnext\n  case (ObjectType \\<C>) thus ?case by (cases \\<sigma>; auto)\nnext\n  case (Tuple \\<pi>) thus ?case by (cases \\<sigma>; auto)\nnext\n  case (Collection \\<tau>) thus ?case by (cases \\<sigma>; auto)\nnext\n  case (Set \\<tau>) thus ?case by (cases \\<sigma>; auto simp: less_imp_le)\nnext\n  case (OrderedSet \\<tau>) thus ?case by (cases \\<sigma>; auto simp: less_imp_le)\nnext\n  case (Bag \\<tau>) thus ?case by (cases \\<sigma>; auto simp: less_imp_le)\nnext\n  case (Sequence \\<tau>) thus ?case by (cases \\<sigma>; auto simp: less_imp_le)\nnext\n  case (Map \\<tau> \\<phi>) thus ?case by (cases \\<sigma>; auto)\nnext\n  case (Required \\<tau>) thus ?case by (cases \\<sigma>\\<^sub>N; auto simp: order.strict_implies_order)\nnext\n  case (Optional \\<tau>) thus ?case by (cases \\<sigma>\\<^sub>N; auto)\nqed\n\nlemma less_type\\<^sub>T_code [code]:\n  \"(<) = subtype\\<^sub>T_fun\"\n  by (intro ext iffI; simp add: subtype\\<^sub>T_fun_intro subtype\\<^sub>T_fun_drule)\n\nlemma less_type\\<^sub>N_code [code]:\n  \"(<) = subtype\\<^sub>N_fun\"\n  by (intro ext iffI; simp add: subtype\\<^sub>N_fun_intro subtype\\<^sub>N_fun_drule)\n\nlemma less_eq_type\\<^sub>T_code [code]:\n  \"(\\<le>) = (\\<lambda>x y. subtype\\<^sub>T_fun x y \\<or> x = y)\"\n  unfolding dual_order.order_iff_strict less_type\\<^sub>T_code\n  by auto\n\nlemma less_eq_type\\<^sub>N_code [code]:\n  \"(\\<le>) = (\\<lambda>x y. subtype\\<^sub>N_fun x y \\<or> x = y)\"\n  unfolding dual_order.order_iff_strict less_type\\<^sub>N_code\n  by auto\n\nend\n", "meta": {"author": "AresEkb", "repo": "Safe_OCL", "sha": "61efbf1207b7a0e892190fe36fb60daf6dcf45a5", "save_path": "github-repos/isabelle/AresEkb-Safe_OCL", "path": "github-repos/isabelle/AresEkb-Safe_OCL/Safe_OCL-61efbf1207b7a0e892190fe36fb60daf6dcf45a5/OCL_Types.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370308082623216, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3334348879438529}}
{"text": "theory BigStep\n  imports Analysis_More\nbegin\n\nsubsection \\<open>Syntax\\<close>\n\ntext \\<open>State\\<close>\ntype_synonym state = \"char \\<Rightarrow> real\"\n\ntext \\<open>Expressions\\<close>\ntype_synonym exp = \"state \\<Rightarrow> real\"\n\ntext \\<open>Predicates\\<close>\ntype_synonym fform = \"state \\<Rightarrow> bool\"\n\ntext \\<open>Channel names\\<close>\ntype_synonym cname = string\n\ntext \\<open>Time\\<close>\ntype_synonym time = real\n\ntext \\<open>Variable names\\<close>\ntype_synonym var = char\n\ntext \\<open>Some common variables\\<close>\ndefinition X :: char where \"X = CHR ''x''\"\ndefinition Y :: char where \"Y = CHR ''y''\"\ndefinition Z :: char where \"Z = CHR ''z''\"\n\nlemma vars_distinct: \"X \\<noteq> Y\" \"X \\<noteq> Z\" \"Y \\<noteq> Z\"\n  unfolding X_def Y_def Z_def by auto\n\ntext \\<open>Ready information.\n  First component is set of channels that are ready to output.\n  Second component is set of channels that are ready to input.\\<close>\ntype_synonym rdy_info = \"cname set \\<times> cname set\"\n\ntext \\<open>History at a time interval\\<close>\ntype_synonym history = \"time \\<Rightarrow> state\"\n\ntext \\<open>Communications\\<close>\ndatatype comm =\n  Send cname exp         (\"_[!]_\" [110,108] 100)\n| Receive cname var     (\"_[?]_\" [110,108] 100)\n\ndatatype ODE =\n  ODE \"var \\<Rightarrow> exp\"\n\ntext \\<open>HCSP processes\\<close>\ndatatype proc =\n  Cm comm\n| Skip\n| Assign var exp             (\"_ ::= _\" [99,95] 94)\n| Seq proc proc           (\"_; _\" [91,90] 90)\n| Cond fform proc proc        (\"IF _ _ _\" [95,94] 93)\n| Wait time  \\<comment> \\<open>Waiting for a specified amount of time\\<close>\n| IChoice \"proc list\"  \\<comment> \\<open>Nondeterminism\\<close>\n| EChoice \"(comm \\<times> proc) list\"  \\<comment> \\<open>External choice\\<close>\n| Rep proc   \\<comment> \\<open>Nondeterministic repetition\\<close>\n| Cont ODE fform  \\<comment> \\<open>ODE with boundary\\<close>\n| Interrupt ODE \"(comm \\<times> proc) list\"  \\<comment> \\<open>Interrupt\\<close>\n\ntext \\<open>Parallel of several HCSP processes\\<close>\ndatatype pproc = PProc \"proc list\"\n\ntext \\<open>Events\\<close>\ndatatype event =\n  Tau\n| WaitE real \\<comment> \\<open>add Wait because ParTau and ParWait are distinct\\<close>\n| In cname real\n| Out cname real \n| IO cname real \n\n\nsubsection \\<open>Traces\\<close>\n\ntext \\<open>First, we define the concept of traces\\<close>\n\ntext \\<open>Time delay, ending state, and set of communications available at the interval\\<close>\ndatatype trace_block =\n  InBlock time cname var real rdy_info  \\<comment> \\<open>Delay time, channel name, variable name, value sent\\<close>\n  | OutBlock time cname real rdy_info  \\<comment> \\<open>Delay time, channel name, value sent\\<close>\n  | TauBlock state   \\<comment> \\<open>Instantaneous update, keep new state\\<close>\n  | WaitBlock time   \\<comment> \\<open>Delay time\\<close>\n  | ODEBlock time \"real \\<Rightarrow> state\"  \\<comment> \\<open>Length of time interval, history\\<close>\n  | ODEInBlock time \"real \\<Rightarrow> state\" cname var real rdy_info\n  | ODEOutBlock time \"real \\<Rightarrow> state\" cname real rdy_info\n\ntext \\<open>Starting state, blocks\\<close>\ndatatype trace = Trace state \"trace_block list\"\n\nfun delay_of_block :: \"trace_block \\<Rightarrow> time\" where\n  \"delay_of_block (InBlock dly _ _ _ _) = dly\"\n| \"delay_of_block (OutBlock dly _ _ _) = dly\"\n| \"delay_of_block (TauBlock _) = 0\"\n| \"delay_of_block (WaitBlock dly) = dly\"\n| \"delay_of_block (ODEBlock d h) = d\"\n| \"delay_of_block (ODEInBlock dly _ _ _ _ _) = dly\"\n| \"delay_of_block (ODEOutBlock dly _ _ _ _) = dly\"\n\nfun event_of_block :: \"trace_block \\<Rightarrow> event\" where\n  \"event_of_block (InBlock _ ch _ v _) = In ch v\"\n| \"event_of_block (OutBlock _ ch v _) = Out ch v\"\n| \"event_of_block (TauBlock _) = Tau\"\n| \"event_of_block (WaitBlock v) = WaitE v\"\n| \"event_of_block (ODEBlock v _) = WaitE v\"\n| \"event_of_block (ODEInBlock _ _ ch _ v _) = In ch v\"\n| \"event_of_block (ODEOutBlock _ _ ch v _) = Out ch v\"\n\nfun rdy_of_block :: \"trace_block \\<Rightarrow> rdy_info\" where\n  \"rdy_of_block (InBlock _ _ _ _ rdy) = rdy\"\n| \"rdy_of_block (OutBlock _ _ _ rdy) = rdy\"\n| \"rdy_of_block (TauBlock _) = ({}, {})\"\n| \"rdy_of_block (WaitBlock _) = ({}, {})\"\n| \"rdy_of_block (ODEBlock _ _) = ({}, {})\"\n| \"rdy_of_block (ODEInBlock _ _ _ _ _ rdy) = rdy\"\n| \"rdy_of_block (ODEOutBlock _ _ _ _ rdy) = rdy\"\n\nfun var_of_block :: \"trace_block \\<Rightarrow> var set\" where\n  \"var_of_block (InBlock dly _ v _ _) = {v}\"\n| \"var_of_block (OutBlock dly _ _ _) = {}\"\n| \"var_of_block (TauBlock _) = {}\"\n| \"var_of_block (WaitBlock dly) = {}\"\n| \"var_of_block (ODEBlock d h) = {}\"\n| \"var_of_block (ODEInBlock dly _ _ v _ _) = {v}\"\n| \"var_of_block (ODEOutBlock dly _ _ _ _) = {}\"\n\nfun start_of_trace :: \"trace \\<Rightarrow> state\" where\n  \"start_of_trace (Trace s _) = s\"\n\nfun blocks_of_trace :: \"trace \\<Rightarrow> trace_block list\" where\n  \"blocks_of_trace (Trace _ blks) = blks\"\n\nfun end_of_blocks :: \"state \\<Rightarrow> trace_block list \\<Rightarrow> state\" where\n  \"end_of_blocks s [] = s\"\n| \"end_of_blocks s ((InBlock _ _ var v _) # rest) = end_of_blocks (s(var := v)) rest\"\n| \"end_of_blocks s ((OutBlock _ _ _ _) # rest) = end_of_blocks s rest\"\n| \"end_of_blocks s ((TauBlock st) # rest) = end_of_blocks st rest\"\n| \"end_of_blocks s ((WaitBlock _) # rest) = end_of_blocks s rest\"\n| \"end_of_blocks _ ((ODEBlock d h) # rest) = end_of_blocks (h d) rest\"\n| \"end_of_blocks _ ((ODEInBlock d h _ var v _) # rest) = end_of_blocks ((h d)(var := v)) rest\"\n| \"end_of_blocks _ ((ODEOutBlock d h _ _ _) # rest) = end_of_blocks (h d) rest\"\n\ntheorem end_of_blocks_append:\n  \"end_of_blocks st (blks1 @ blks2) = end_of_blocks (end_of_blocks st blks1) blks2\"\n  apply (induction blks1 arbitrary: st rule: list.induct)\n   apply auto\n  subgoal for blk1 blk2 st\n    by (cases blk1, auto)\n  done\n\nfun end_of_trace :: \"trace \\<Rightarrow> state\" where\n  \"end_of_trace (Trace s blks) = end_of_blocks s blks\"\n\nfun extend_trace :: \"trace \\<Rightarrow> trace_block \\<Rightarrow> trace\" where\n  \"extend_trace (Trace s blks) blk = Trace s (blks @ [blk])\"\n\n\ntext \\<open>Now we define the ready set of a trace at any given time\\<close>\n\nfun rdy_of_blocks :: \"trace_block list \\<Rightarrow> time \\<Rightarrow> rdy_info\" where\n  \"rdy_of_blocks [] t = ({}, {})\"\n| \"rdy_of_blocks ((InBlock dly _ _ _ rdy) # blks) t =\n    (if 0 \\<le> t \\<and> t < dly then rdy\n     else rdy_of_blocks blks (t - dly))\"\n| \"rdy_of_blocks ((OutBlock dly _ _ rdy) # blks) t =\n    (if 0 \\<le> t \\<and> t < dly then rdy\n     else rdy_of_blocks blks (t - dly))\"\n| \"rdy_of_blocks ((TauBlock _) # blks) t = rdy_of_blocks blks t\"\n| \"rdy_of_blocks ((WaitBlock d) # blks) t =\n    (if t \\<le> d then ({}, {}) else rdy_of_blocks blks (t - d))\"\n| \"rdy_of_blocks ((ODEBlock d _) # blks) t =\n    (if t \\<le> d then ({}, {}) else rdy_of_blocks blks (t - d))\"\n| \"rdy_of_blocks ((ODEInBlock d _ _ _ _ rdy) # blks) t =\n    (if 0 \\<le> t \\<and> t < d then rdy\n     else rdy_of_blocks blks (t - d))\"\n| \"rdy_of_blocks ((ODEOutBlock d _ _ _ rdy) # blks) t =\n    (if 0 \\<le> t \\<and> t < d then rdy\n     else rdy_of_blocks blks (t - d))\"\n\nfun rdy_of_trace :: \"trace \\<Rightarrow> time \\<Rightarrow> rdy_info\" where\n  \"rdy_of_trace (Trace _ blks) t = rdy_of_blocks blks t\"\n\ntext \\<open>Whether two rdy_infos from different processes are compatible.\\<close>\nfun compat_rdy_pair :: \"rdy_info \\<Rightarrow> rdy_info \\<Rightarrow> bool\" where\n  \"compat_rdy_pair (r11, r12) (r21, r22) = (r11 \\<inter> r22 = {} \\<and> r12 \\<inter> r21 = {})\"\n\nlemma compat_rdy_pair_sym:\n  \"compat_rdy_pair p1 p2 \\<longleftrightarrow> compat_rdy_pair p2 p1\"\n  apply (cases p1) apply (cases p2) by auto\n\ndefinition compat_rdy_block_pair :: \"trace_block list \\<Rightarrow> trace_block list \\<Rightarrow> bool\" where\n  \"compat_rdy_block_pair blks1 blks2 = (\\<forall>t. compat_rdy_pair (rdy_of_blocks blks1 t) (rdy_of_blocks blks2 t))\"\n\nlemma compat_rdy_block_pair_sym:\n  \"compat_rdy_block_pair blks1 blks2 \\<longleftrightarrow> compat_rdy_block_pair blks2 blks1\"\n  unfolding compat_rdy_block_pair_def \n  using compat_rdy_pair_sym by auto\n\nfun compat_trace_pair :: \"trace \\<Rightarrow> trace \\<Rightarrow> bool\" where\n  \"compat_trace_pair (Trace _ blks1) (Trace _ blks2) = compat_rdy_block_pair blks1 blks2\"\n\nlemma compat_trace_pair_sym:\n  \"compat_trace_pair tr1 tr2 \\<longleftrightarrow> compat_trace_pair tr2 tr1\"\n  by (metis compat_rdy_block_pair_sym compat_trace_pair.simps trace.exhaust)\n\ndefinition compat_rdy_blocks :: \"trace_block list list \\<Rightarrow> bool\" where\n  \"compat_rdy_blocks blkss = (\\<forall>i<length blkss. \\<forall>j<length blkss. i \\<noteq> j \\<longrightarrow> compat_rdy_block_pair (blkss ! i) (blkss ! j))\"\n\nlemma compat_rdy_blocks2:\n  \"compat_rdy_blocks [blks1, blks2] \\<longleftrightarrow> compat_rdy_block_pair blks1 blks2\"\n  unfolding compat_rdy_blocks_def\n  apply (auto simp add: less_Suc_eq)\n  using compat_rdy_block_pair_sym by auto\n\ntext \\<open>Main definition: compatibility between a list of traces.\\<close>\ndefinition compat_rdy :: \"trace list \\<Rightarrow> bool\" where\n  \"compat_rdy trs = (\\<forall>i<length trs. \\<forall>j<length trs. i \\<noteq> j \\<longrightarrow> compat_trace_pair (trs ! i) (trs ! j))\"\n\n\nsubsection \\<open>Traces of parallel processes\\<close>\n\ndatatype par_block =\n    IOBlock nat nat cname var real  \\<comment> \\<open>Receive process, Send process, channel name, variable name, value sent\\<close>\n  | ParTauBlock nat state       \\<comment> \\<open>Instantaneous update on one process to new state\\<close>\n  | ParWaitBlock real \"real \\<Rightarrow> state list\"  \\<comment> \\<open>Delay\\<close>\n\ntext \\<open>ParTrace st pblks:\n  st -- starting state for each process. Length is the number of processes.\n  pblks -- list of parallel blocks.\\<close>\ndatatype par_trace = ParTrace \"state list\" \"par_block list\"\n\ntext \\<open>Determine the end of state for a parallel trace\\<close>\nfun end_of_par_blocks :: \"state list \\<Rightarrow> par_block list \\<Rightarrow> state list\" where\n  \"end_of_par_blocks sts [] = sts\"\n| \"end_of_par_blocks sts ((IOBlock pin pout ch v x) # rest) =\n      end_of_par_blocks (sts[pin := (sts ! pin)(v := x)]) rest\"\n| \"end_of_par_blocks sts ((ParTauBlock ptau st) # rest) =\n      end_of_par_blocks (sts[ptau := st]) rest\"\n| \"end_of_par_blocks sts ((ParWaitBlock d hist) # rest) =\n      end_of_par_blocks (hist d) rest\"\n\n\ntext \\<open>Now we define how to combine a list of traces for individual processes\n  into a parallel trace.\\<close>\n\ntext \\<open>Given a delay time t and a block with time interval at least t,\n  find the block starting at time t.\n\n  Examples:\n    wait_block 2 (In ''ch'' 1 after 5) = In ''ch'' 1 after 3.\n\\<close>\nfun wait_block :: \"time \\<Rightarrow> trace_block \\<Rightarrow> trace_block\" where\n  \"wait_block t (InBlock dly ch var v rdy) = InBlock (dly - t) ch var v rdy\"\n| \"wait_block t (OutBlock dly ch v rdy) = OutBlock (dly - t) ch v rdy\"\n| \"wait_block t (TauBlock st) = TauBlock st\"\n| \"wait_block t (WaitBlock d) = WaitBlock (d - t)\"\n| \"wait_block t (ODEBlock d h) = ODEBlock (d - t) (\\<lambda>s. h (s + t))\"\n| \"wait_block t (ODEInBlock d h ch var v rdy) = ODEInBlock (d - t) (\\<lambda>s. h (s + t)) ch var v rdy\"\n| \"wait_block t (ODEOutBlock d h ch v rdy) = ODEOutBlock (d - t) (\\<lambda>s. h (s + t)) ch v rdy\"\n\nlemma wait_block_0[simp]:\n  \"wait_block 0 blk = blk\" by (cases blk, auto)\n\ntext \\<open>Operate on a list of blocks. We assume that if the list is nonempty,\n  then the first block has length at least t.\\<close>\nfun wait_blocks :: \"time \\<Rightarrow> trace_block list \\<Rightarrow> trace_block list\" where\n  \"wait_blocks t [] = []\"\n| \"wait_blocks t (blk # blks) = wait_block t blk # blks\"\n\ntext \\<open>From a list of traces, delay every trace by t, and remove the first block\n  from i'th trace. We assume that each trace is either empty or its first block\n  has length at least t.\\<close>\ndefinition remove_one :: \"nat \\<Rightarrow> time \\<Rightarrow> trace_block list list \\<Rightarrow> trace_block list list\" where\n  \"remove_one i t blkss = (\n    let blkss' = map (wait_blocks t) blkss in\n      blkss'[i := tl (blkss' ! i)])\"\n\ntext \\<open>From a list of traces, delay every trace by t, and remove the first block\n  from i'th and j'th trace. We assume that each trace is either empty or its first\n  block has length at least t.\\<close>\ndefinition remove_pair :: \"nat \\<Rightarrow> nat \\<Rightarrow> trace_block list list \\<Rightarrow> trace_block list list\" where\n  \"remove_pair i j blkss = (\n      blkss[i := tl (blkss ! i), j := tl (blkss ! j)])\"\n\ntext \\<open>the state of a trace at any given time\\<close>\nfun state_of_blocks :: \"state \\<Rightarrow> trace_block list \\<Rightarrow> time \\<Rightarrow> state\" where\n  \"state_of_blocks s [] t = s\"\n| \"state_of_blocks s ((InBlock dly _ var v _) # blks) t =\n    (if 0 \\<le> t \\<and> t \\<le>dly then s\n     else state_of_blocks (s(var := v)) blks (t - dly))\"\n| \"state_of_blocks s ((OutBlock dly _ _ rdy) # blks) t =\n    (if 0 \\<le> t \\<and> t \\<le> dly then s\n     else state_of_blocks s blks (t - dly))\"\n| \"state_of_blocks s ((TauBlock _) # blks) t = state_of_blocks s blks t\"\n| \"state_of_blocks s ((WaitBlock d) # blks) t =\n    (if t \\<le> d then s else state_of_blocks s blks (t - d))\"\n| \"state_of_blocks s ((ODEBlock d h) # blks) t =\n    (if t \\<le> d then h t else state_of_blocks (h d) blks (t - d))\"\n| \"state_of_blocks s ((ODEInBlock d h _ var v _) # blks) t = \n    (if t \\<le> d then h t else state_of_blocks ((h d)(var := v)) blks (t - d))\"\n| \"state_of_blocks s ((ODEOutBlock d h _ _ _) # blks) t = \n    (if t \\<le> d then h t else state_of_blocks (h d) blks (t - d))\"\n\nfun wait_block_state_list :: \"state list \\<Rightarrow> time \\<Rightarrow> trace_block list list \\<Rightarrow> state list\" where\n  \"wait_block_state_list [] t [] = []\" \n| \"wait_block_state_list [] t (b # trbl) = undefined\"\n| \"wait_block_state_list (a # sts) t [] = (a # sts)\"\n| \"wait_block_state_list (a # sts) t (b # trbl) = (state_of_blocks a b t) # (wait_block_state_list sts t trbl)\"\n\n\ntext \\<open>Main definition: combining a list of block lists.\n  combine_blocks blkss pblks means the list of block lists blkss can be combined\n  together into pblks.\\<close>\ninductive combine_blocks :: \"state list \\<Rightarrow> trace_block list list \\<Rightarrow> par_block list \\<Rightarrow> bool\" where\n  \\<comment> \\<open>empty case\\<close>\n  \"\\<forall>i<length blkss. blkss ! i = [] \\<Longrightarrow> combine_blocks sts blkss []\"\n\n  \\<comment> \\<open>Tau step at i'th process\\<close>\n| \"i < length blkss \\<Longrightarrow>\n   blkss ! i \\<noteq> [] \\<Longrightarrow>\n   delay_of_block (hd (blkss ! i)) = 0 \\<Longrightarrow>\n   event_of_block (hd (blkss ! i)) = Tau \\<Longrightarrow>\n   combine_blocks (sts[i := (end_of_blocks (sts ! i) [hd (blkss ! i)])]) (remove_one i 0 blkss) pblks \\<Longrightarrow>\n   combine_blocks sts blkss ((ParTauBlock i (end_of_blocks (sts ! i) [hd (blkss ! i)])) # pblks)\" \n\n  \\<comment> \\<open>Communication between i'th and j'th process\\<close>\n| \"i < length blkss \\<Longrightarrow> j < length blkss \\<Longrightarrow> i \\<noteq> j \\<Longrightarrow>\n   blkss ! i \\<noteq> [] \\<Longrightarrow> blkss ! j \\<noteq> [] \\<Longrightarrow>\n   delay_of_block (hd (blkss ! i)) = 0 \\<Longrightarrow>\n   delay_of_block (hd (blkss ! j)) = 0 \\<Longrightarrow>\n   event_of_block (hd (blkss ! i)) = In c v \\<Longrightarrow>\n   event_of_block (hd (blkss ! j)) = Out c v \\<Longrightarrow>\n   var_of_block (hd (blkss !i)) = {x} \\<Longrightarrow>\n   combine_blocks (sts[i := (end_of_blocks (sts ! i) [hd (blkss ! i)])]) (remove_pair i j blkss) pblks \\<Longrightarrow>\n   combine_blocks sts blkss ((IOBlock i j c x v) # pblks)\" \n\n \\<comment> \\<open>Wait action at i'th process\\<close>\n| \"i < length blkss \\<Longrightarrow>\n   t > 0 \\<Longrightarrow>\n   \\<forall>k<length blkss. blkss ! k \\<noteq> [] \\<longrightarrow> delay_of_block (hd (blkss ! k)) \\<ge> t \\<Longrightarrow>\n   blkss ! i \\<noteq> [] \\<Longrightarrow>\n   delay_of_block (hd (blkss ! i)) = t \\<Longrightarrow>\n   event_of_block (hd (blkss ! i)) = WaitE t \\<Longrightarrow>\n   combine_blocks (wait_block_state_list sts t blkss) (remove_one i t blkss) pblks \\<Longrightarrow>\n   combine_blocks sts blkss (\n     ParWaitBlock t (\\<lambda>d. if 0\\<le>d \\<and> d\\<le>t then wait_block_state_list sts d blkss else undefined)\n     # pblks)\"\n\n\ntext \\<open>Use the previous definition to combine a list of traces into a parallel trace.\\<close>\ninductive combine_par_trace :: \"trace list \\<Rightarrow> par_trace \\<Rightarrow> bool\" where\n  \"length trs = length sts \\<Longrightarrow>\n   \\<forall>i<length trs. start_of_trace (trs ! i) = sts ! i \\<Longrightarrow>\n   combine_blocks sts (map blocks_of_trace trs) par_blks \\<Longrightarrow>\n   combine_par_trace trs (ParTrace sts par_blks)\"\n\n\n\nsubsection \\<open>External choice\\<close>\n\ntext \\<open>Compute list of ready communications for an external choice.\\<close>\nfun rdy_of_echoice :: \"(comm \\<times> proc) list \\<Rightarrow> rdy_info\" where\n  \"rdy_of_echoice [] = ({}, {})\"\n| \"rdy_of_echoice ((Send ch e, _) # rest) = (\n    let rdy = rdy_of_echoice rest in\n      (insert ch (fst rdy), snd rdy))\"\n| \"rdy_of_echoice ((Receive ch var, _) # rest) = (\n    let rdy = rdy_of_echoice rest in\n      (fst rdy, insert ch (snd rdy)))\"\n\nsubsection \\<open>Definitions of ODEs\\<close>\n\ntype_synonym vec = \"real^(var)\"\n\ntext \\<open>Conversion between state and vector\\<close>\ndefinition state2vec :: \"state \\<Rightarrow> vec\" where\n  \"state2vec s = (\\<chi> x. s x)\"\n\ndefinition vec2state :: \"vec \\<Rightarrow> state\" where\n  \"(vec2state v) x = v $ x\"\n\nlemma vec_state_map1[simp]: \"vec2state (state2vec s) = s\"\n  unfolding vec2state_def state2vec_def by auto\n\nlemma vec_state_map2[simp]: \"state2vec (vec2state s) = s\"\n  unfolding vec2state_def state2vec_def by auto\n\ntext \\<open>Given ODE and a state, find the derivative vector.\\<close>\nfun ODE2Vec :: \"ODE \\<Rightarrow> state \\<Rightarrow> vec\" where\n  \"ODE2Vec (ODE f) s = state2vec (\\<lambda>a. f a s)\"\n\ntext \\<open>History p on time {0 .. d} is a solution to ode.\\<close>\ndefinition ODEsol :: \"ODE \\<Rightarrow> (real \\<Rightarrow> state) \\<Rightarrow> real \\<Rightarrow> bool\" where\n  \"ODEsol ode p d = (d \\<ge> 0 \\<and> (((\\<lambda>t. state2vec (p t)) has_vderiv_on (\\<lambda>t. ODE2Vec ode (p t))) {0 .. d}))\"\n\ntext \\<open>Mean value theorem (constant case) for vectors.\\<close>\nlemma mvt_vector:\n  fixes p :: \"real \\<Rightarrow> state\"\n  assumes \"\\<forall>t\\<in>{0 .. d}. (((\\<lambda>t. state2vec (p t)) has_vector_derivative state2vec (q t)) (at t within {0 .. d}) \\<and> q t v = 0)\"\n    and \"d \\<ge> 0\"\n  shows \"\\<forall>t\\<in>{0 .. d}. p 0 v = p t v\"\nproof -\n  have 1: \"\\<forall>t\\<in>{0 .. d}. ((\\<lambda>t. state2vec (p t) $ v) has_vector_derivative state2vec (q t) $ v) (at t within {0 .. d})\" \n    using assms \n    using has_vector_derivative_proj[where p=\"\\<lambda>t. state2vec (p t)\" and q=\"\\<lambda>t. state2vec (q t)\"]\n    by blast\n  have 2: \"\\<forall>t\\<in>{0 .. d}.  state2vec (q t) $ v = 0\" \n    using assms  state2vec_def by auto\n  have 3: \"\\<forall>t\\<in>{0 .. d}. state2vec (p 0) $ v = state2vec (p t) $ v\"\n    using assms 1 2 unfolding has_vector_derivative_def \n    using mvt_real_eq[where p = \"\\<lambda>t. state2vec (p t) $ v\" and q = \"\\<lambda>t. (\\<lambda>x. x *\\<^sub>R state2vec (q t) $ v)\" and d=\"d\"]\n    by auto\n  then show ?thesis\n    using state2vec_def by auto\nqed\n\nlemma chainrule:\n  assumes \"\\<forall>x. ((\\<lambda>v. g (vec2state v)) has_derivative g' (vec2state x)) (at x within UNIV)\"\n    and \"ODEsol ode p d\"\n    and \"t \\<in> {0 .. d}\"\n  shows \"((\\<lambda>t. g (p t)) has_derivative (\\<lambda>s. g' (p t) (s *\\<^sub>R ODE2Vec ode (p t)))) (at t within {0 .. d})\"\nproof -\n  have 1: \"(\\<And>x. x \\<in> UNIV \\<Longrightarrow> ((\\<lambda>v. g (vec2state v)) has_derivative g' (vec2state x)) (at x))\"\n    using assms(1) by auto\n  have 2: \"0 \\<le> t \\<and> t \\<le> d\"\n    using assms(3) by auto\n  have 3: \"((\\<lambda>t. state2vec(p t)) has_derivative (\\<lambda>s. s *\\<^sub>R ODE2Vec ode (p t))) (at t within {0..d})\"\n    using 2 assms(2) unfolding ODEsol_def has_vderiv_on_def has_vector_derivative_def by auto\n  show ?thesis\n  using 1 2 3 has_derivative_in_compose2[of UNIV \"(\\<lambda>v. g (vec2state v))\" \"(\\<lambda>v. g' (vec2state v))\" \"(\\<lambda>t. state2vec (p t))\" \"{0 .. d}\" t \"(\\<lambda>s. s *\\<^sub>R ODE2Vec ode (p t))\"]\n  by auto\nqed\n\n\nsubsection \\<open>Big-step semantics\\<close>\n\ntext \\<open>Big-step semantics specifies for each command a mapping from trace to trace\\<close>\n\ntext \\<open>Extend by a send block\\<close>\ndefinition extend_send :: \"cname \\<Rightarrow> exp \\<Rightarrow> time \\<Rightarrow> rdy_info \\<Rightarrow> trace \\<Rightarrow> trace\" where\n  \"extend_send ch e dly rdy tr =\n    extend_trace tr (OutBlock dly ch (e (end_of_trace tr)) rdy)\"\n\ntext \\<open>Extend by a receive block\\<close>\ndefinition extend_receive :: \"cname \\<Rightarrow> var \\<Rightarrow> time \\<Rightarrow> real \\<Rightarrow> rdy_info \\<Rightarrow> trace \\<Rightarrow> trace\" where\n  \"extend_receive ch var dly v rdy tr =\n    extend_trace tr (InBlock dly ch var v ({}, {ch}))\"\n\ntext \\<open>Big-step semantics.\n  big_step p tr tr2 means executing p starting at trace tr can end in trace tr2.\n  This should imply that tr is a prefix of tr2.\\<close>\ninductive big_step :: \"proc \\<Rightarrow> trace \\<Rightarrow> trace \\<Rightarrow> bool\" where\n  \\<comment> \\<open>dly: amount of time waited at the current send.\\<close>\n  sendB: \"dly \\<ge> 0 \\<Longrightarrow> big_step (Cm (Send ch e)) tr (extend_send ch e dly ({ch}, {}) tr)\"\n  \\<comment> \\<open>dly: amount of time waited at the current receive, v: the value received.\\<close>\n| receiveB: \"dly \\<ge> 0 \\<Longrightarrow> big_step (Cm (Receive ch var)) tr\n    (extend_receive ch var dly v ({}, {ch}) tr)\"\n| skipB: \"big_step Skip tr tr\"\n| assignB: \"big_step (Assign var e) tr\n    (extend_trace tr (TauBlock ((end_of_trace tr)(var := e (end_of_trace tr)))))\"\n| seqB: \"big_step p1 tr tr2 \\<Longrightarrow>\n   big_step p2 tr2 tr3 \\<Longrightarrow> big_step (Seq p1 p2) tr tr3\"\n| condB1: \"b (end_of_trace tr) \\<Longrightarrow>\n   big_step p1 tr tr2 \\<Longrightarrow> big_step (Cond b p1 p2) tr tr2\"\n| condB2: \"\\<not> b (end_of_trace tr) \\<Longrightarrow>\n   big_step p2 tr tr2 \\<Longrightarrow> big_step (Cond b p1 p2) tr tr2\"\n| waitB: \"big_step (Wait d) tr\n    (extend_trace tr (WaitBlock d))\"\n| IChoiceB: \"i < length ps \\<Longrightarrow> big_step (ps ! i) tr tr2 \\<Longrightarrow>\n   big_step (IChoice ps) tr tr2\"\n| EChoiceSendB: \"i < length cs \\<Longrightarrow> cs ! i = (Send ch e, p2) \\<Longrightarrow>\n   big_step p2 (extend_send ch e dly (rdy_of_echoice cs) tr) tr3 \\<Longrightarrow>\n   big_step (EChoice cs) tr tr3\"\n| EChoiceReceiveB: \"i < length cs \\<Longrightarrow> cs ! i = (Receive ch var, p2) \\<Longrightarrow>\n   big_step p2 (extend_receive ch var dly v (rdy_of_echoice cs) tr) tr3 \\<Longrightarrow>\n   big_step (EChoice cs) tr tr3\"\n| RepetitionB1: \"big_step (Rep p) tr tr\"\n| RepetitionB2: \"big_step p tr tr2 \\<Longrightarrow> big_step (Rep p) tr2 tr3 \\<Longrightarrow> \n   big_step (Rep p) tr tr3\"\n| ContB:\n   \"d \\<ge> 0 \\<Longrightarrow> ODEsol ode p d \\<Longrightarrow>\n    (\\<forall>t. t \\<ge> 0 \\<and> t < d \\<longrightarrow> b (p t)) \\<Longrightarrow>\n    \\<not> b (p d) \\<Longrightarrow> p 0 = end_of_trace tr \\<Longrightarrow>\n    tr2 = extend_trace tr (ODEBlock d (restrict p {0..d})) \\<Longrightarrow>\n    big_step (Cont ode b) tr tr2\"\n| InterruptSendB:\n   \"d \\<ge> 0 \\<Longrightarrow> ODEsol ode p d \\<Longrightarrow>\n    p 0 = end_of_trace tr \\<Longrightarrow>\n    i < length cs \\<Longrightarrow> cs ! i = (Send ch e, p2) \\<Longrightarrow>\n    big_step p2 (extend_trace tr (ODEOutBlock d (restrict p {0..d}) ch (e (p d)) (rdy_of_echoice cs))) tr3 \\<Longrightarrow>\n    big_step (Interrupt ode cs) tr tr3\"\n| InterruptReceiveB:\n   \"d \\<ge> 0 \\<Longrightarrow> ODEsol ode p d \\<Longrightarrow>\n    p 0 = end_of_trace tr \\<Longrightarrow>\n    i < length cs \\<Longrightarrow> cs ! i = (Receive ch var, p2) \\<Longrightarrow>\n    big_step p2 (extend_trace tr (ODEInBlock d (restrict p {0..d}) ch var v (rdy_of_echoice cs))) tr3 \\<Longrightarrow>\n    big_step (Interrupt ode cs) tr tr3\"\n\n\ntext \\<open>Big-step semantics for parallel processes.\\<close>\ninductive par_big_step :: \"pproc \\<Rightarrow> par_trace \\<Rightarrow> par_trace \\<Rightarrow> bool\" where\n  parallelB: \"length trs = length ps \\<Longrightarrow> length trs2 = length ps \\<Longrightarrow>\n   \\<forall>i<length ps. big_step (ps ! i) (trs ! i) (trs2 ! i) \\<Longrightarrow>\n   compat_rdy trs \\<Longrightarrow> compat_rdy trs2 \\<Longrightarrow>\n   combine_par_trace trs par_tr \\<Longrightarrow>\n   combine_par_trace trs2 par_tr2 \\<Longrightarrow>\n   par_big_step (PProc ps) par_tr par_tr2\"\n\n\nsubsection \\<open>More convenient version of rules\\<close>\n\nlemma sendB2:\n  assumes \"blks' = blks @ [OutBlock dly ch (e (end_of_trace (Trace s blks))) ({ch}, {})]\"\n    and \"dly \\<ge> 0\"\n  shows \"big_step (Cm (Send ch e)) (Trace s blks) (Trace s blks')\"\nproof -\n  have 1: \"Trace s (blks @ [OutBlock dly ch (e (end_of_trace (Trace s blks))) ({ch}, {})]) =\n        extend_send ch e dly ({ch}, {}) (Trace s blks)\"\n    unfolding extend_send_def extend_trace.simps by auto\n  show ?thesis\n    apply (subst assms(1))\n    apply (subst 1)\n    using assms(2) by (rule sendB)\nqed\n\nlemma receiveB2:\n  assumes \"blks' = blks @ [InBlock dly ch var v ({}, {ch})]\"\n    and \"dly \\<ge> 0\"\n  shows \"big_step (Cm (Receive ch var)) (Trace s blks) (Trace s blks')\"\nproof -\n  have 1: \"Trace s (blks @ [InBlock dly ch var v ({}, {ch})]) =\n        extend_receive ch var dly v ({}, {ch}) (Trace s blks)\"\n    unfolding extend_receive_def extend_trace.simps by auto\n  show ?thesis\n    apply (subst assms(1))\n    apply (subst 1)\n    using assms(2) by (rule receiveB)\nqed\n\nlemma waitB2:\n  assumes \"blks' = blks @ [WaitBlock d]\"\n  shows \"big_step (Wait d) (Trace s blks) (Trace s blks')\"\nproof -\n  have 1: \"Trace s (blks @ [WaitBlock d]) = extend_trace (Trace s blks) (WaitBlock d)\"\n    by auto\n  show ?thesis\n    apply (subst assms(1))\n    apply (subst 1)\n    by (rule waitB)\nqed\n\nlemma parallelB2:\n  assumes \"big_step ps1 tr11 tr12\"\n   \"big_step ps2 tr21 tr22\"\n   \"compat_trace_pair tr11 tr21\"\n   \"compat_trace_pair tr12 tr22\"\n   \"combine_par_trace [tr11, tr21] par_tr\"\n   \"combine_par_trace [tr12, tr22] par_tr2\"\n  shows \"par_big_step (PProc [ps1, ps2]) par_tr par_tr2\"\n  apply (rule parallelB[OF _ _ _ _ _ assms(5,6)])\n  by (auto simp add: less_Suc_eq compat_rdy_def compat_trace_pair_sym assms)\n\nsubsection \\<open>Test of big-step semantics\\<close>\n\ntext \\<open>Send 1 immediately\\<close>\nlemma test1a: \"big_step (Cm (Send ''ch'' (\\<lambda>_. 1)))\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [OutBlock 0 ''ch'' 1 ({''ch''}, {})])\"\n  apply (rule sendB2)\n  by auto\n\ntext \\<open>Send x + 1 immediately\\<close>\nlemma test1b: \"big_step (Cm (Send ''ch'' (\\<lambda>s. s X + 1)))\n        (Trace ((\\<lambda>_. 0)(X := 1)) [])\n        (Trace ((\\<lambda>_. 0)(X := 1)) [OutBlock 0 ''ch'' 2 ({''ch''}, {})])\"\n  apply (rule sendB2)\n  by auto\n\ntext \\<open>Send 1 after delay 2\\<close>\nlemma test1c: \"big_step (Cm (Send ''ch'' (\\<lambda>_. 1)))\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [OutBlock 2 ''ch'' 1 ({''ch''}, {})])\"\n  apply (rule sendB2)\n  by auto\n\ntext \\<open>Receive 1 immediately\\<close>\nlemma test2a: \"big_step (Cm (Receive ''ch'' X))\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [InBlock 0 ''ch'' X 1 ({}, {''ch''})])\"\n  apply (rule receiveB2)\n  by auto\n\ntext \\<open>Receive 1 after delay 2\\<close>\nlemma test2b: \"big_step (Cm (Receive ''ch'' X))\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [InBlock 2 ''ch'' X 1 ({}, {''ch''})])\"\n  apply (rule receiveB2)\n  by auto\n\ntext \\<open>Communication\\<close>\nlemma test3: \"par_big_step (PProc [Cm (Send ''ch'' (\\<lambda>_. 1)), Cm (Receive ''ch'' X)])\n        (ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [])\n        (ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [IOBlock 1 0 ''ch'' X 1])\"\nproof -\n  have 1: \"combine_blocks [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] [[], []] []\"\n    apply (rule combine_blocks.intros(1))\n    by (auto simp add: less_Suc_eq)\n  have 2: \"combine_blocks [(\\<lambda>_. 0), (\\<lambda>_. 0)]\n     [[OutBlock 0 ''ch'' 1 ({''ch''}, {})],\n      [InBlock 0 ''ch'' X 1 ({}, {''ch''})]]\n     [IOBlock 1 0 ''ch'' X 1]\"\n    apply (rule combine_blocks.intros(3)[where i=1 and j=0])\n    apply (auto simp add: less_Suc_eq)\n    unfolding remove_pair_def Let_def apply auto\n    by (rule 1)\n  have 3: \" combine_blocks [\\<lambda>_. 0, \\<lambda>_. 0] [[], []] []\"\n    apply (rule combine_blocks.intros(1))\n    by (auto simp add: less_Suc_eq)\n  show ?thesis\n    apply (rule parallelB2[OF test1a test2a])\n    apply (auto simp add: compat_rdy_block_pair_def less_Suc_eq combine_par_trace.simps)\n    using 1 2 3 by auto\nqed\n\ntext \\<open>Wait\\<close>\nlemma test4: \"big_step (Wait 2)\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [WaitBlock 2])\"\n  apply (rule waitB2)\n  by auto\n\ntext \\<open>Seq\\<close>\nlemma test5: \"big_step (Wait 2; Cm (Send ''ch'' (\\<lambda>_. 1)))\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [WaitBlock 2, OutBlock 0 ''ch'' 1 ({''ch''}, {})])\"\n  apply (rule seqB[OF test4])\n  apply (rule sendB2)\n  by auto\n\ntext \\<open>Communication after delay 2\\<close>\nlemma test6: \"par_big_step (PProc [\n  Wait 2; Cm (Send ''ch'' (\\<lambda>_. 1)),\n  Cm (Receive ''ch'' X)])\n    (ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [])\n    (ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [ParWaitBlock 2 ((\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 2 then [\\<lambda>_. 0, \\<lambda>_. 0] else undefined)), \n                                  IOBlock 1 0 ''ch'' X 1])\"\nproof -\n  have 1: \"combine_blocks [(\\<lambda>_. 0), (\\<lambda>_. 0)(X := 1)] [[], []] []\"\n    apply (rule combine_blocks.intros(1))\n    by (auto simp add: less_Suc_eq)\n\n  have 11: \"combine_blocks [(\\<lambda>_. 0), (\\<lambda>_. 0)] [[], []] []\"\n    apply (rule combine_blocks.intros(1))\n    by (auto simp add: less_Suc_eq)\n\n  have 2: \"combine_blocks [\\<lambda>_. 0, \\<lambda>_. 0] [[OutBlock 0 ''ch'' 1 ({''ch''}, {})], [InBlock 0 ''ch'' X 1 ({}, {''ch''})]] [IOBlock 1 0 ''ch'' X 1]\"\n    apply (rule combine_blocks.intros(3))\n     unfolding remove_pair_def Let_def apply auto\n     by (rule 1)\n\n   have 3: \"(\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 2 then wait_block_state_list [\\<lambda>_. 0, \\<lambda>_. 0] d \n            [[WaitBlock 2, OutBlock 0 ''ch'' 1 ({''ch''}, {})], [InBlock 2 ''ch'' X 1 ({}, {''ch''})]] \n                                  else undefined)\n           = (\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 2 then [\\<lambda>_. 0, \\<lambda>_. 0] else undefined)\"\n     by auto\n    \n  have 4: \"combine_blocks [(\\<lambda>_. 0), (\\<lambda>_. 0)]\n     [[WaitBlock 2, OutBlock 0 ''ch'' 1 ({''ch''}, {})],\n      [InBlock 2 ''ch'' X 1 ({}, {''ch''})]]\n     [ParWaitBlock 2 (\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 2 then [(\\<lambda>_. 0), (\\<lambda>_. 0)] else undefined), IOBlock 1 0 ''ch'' X 1]\"\n   using combine_blocks.intros(4)[of 0 \"[[WaitBlock 2, OutBlock 0 ''ch'' 1 ({''ch''}, {})],\n      [InBlock 2 ''ch'' X 1 ({}, {''ch''})]]\" 2\n     \"[(\\<lambda>_. 0), (\\<lambda>_. 0)]\"] \n   apply (auto simp add: less_Suc_eq if_split)\n   unfolding remove_one_def Let_def apply auto\n   using 2 3 \n   by auto\n  show ?thesis\n    apply (rule parallelB2[OF test5 test2b])\n       apply (auto simp add: compat_rdy_block_pair_def less_Suc_eq combine_par_trace.simps)\n    using 11 4 by auto\nqed\n\n\ntext \\<open>Loop one time\\<close>\nlemma test7: \"big_step (Rep (Assign X (\\<lambda>s. s X + 1); Cm (Send ''ch'' (\\<lambda>s. s X))))\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [TauBlock ((\\<lambda>_. 0)(X := 1)), OutBlock 0 ''ch'' 1 ({''ch''}, {})])\"\n  apply (rule RepetitionB2)\n   apply (rule seqB)\n    apply (rule assignB)\n  apply auto[1]\n   apply (rule sendB2[where dly=0])\n   apply auto\n  apply (rule RepetitionB1)\n  done\n\ntext \\<open>Loop two times\\<close>\nlemma test8: \"big_step (Rep (Assign X (\\<lambda>s. s X + 1); Cm (Send ''ch'' (\\<lambda>s. s X))))\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [TauBlock ((\\<lambda>_. 0)(X := 1)), OutBlock 0 ''ch'' 1 ({''ch''}, {}),\n                        TauBlock ((\\<lambda>_. 0)(X := 2)), OutBlock 0 ''ch'' 2 ({''ch''}, {})])\"\n  apply (rule RepetitionB2)\n  apply (rule seqB)\n  apply (rule assignB)\n   apply auto[1]\n  apply (rule sendB2[where dly=0])\n   apply auto\n  apply (rule RepetitionB2)\n   apply (rule seqB)\n  apply (rule assignB)\n   apply auto[1]\n   apply (rule sendB2[where dly=0])\n   apply auto\n  apply (rule RepetitionB1)\n  done\n\ntext \\<open>External choice 1\\<close>\nlemma test9a: \"big_step (EChoice [(Send ''ch'' (\\<lambda>_. 1), Wait 1), (Send ''ch2'' (\\<lambda>_. 2), Wait 2)])\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [OutBlock 0 ''ch'' 1 ({''ch'', ''ch2''}, {}), WaitBlock 1])\"\n  apply (rule EChoiceSendB[where i=0])\n    apply (auto simp add: extend_send_def)\n  apply (rule waitB2)\n  by auto\n\ntext \\<open>External choice 2\\<close>\nlemma test9b: \"big_step (EChoice [(Send ''ch'' (\\<lambda>_. 1), Wait 1), (Send ''ch2'' (\\<lambda>_. 2), Wait 2)])\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [OutBlock 0 ''ch2'' 2 ({''ch'', ''ch2''}, {}), WaitBlock 2])\"\n  apply (rule EChoiceSendB[where i=1])\n    apply (auto simp add: extend_send_def)\n  apply (rule waitB2)\n  by auto\n\ntext \\<open>Communication with external choice\\<close>\nlemma test10: \"par_big_step (PProc [\n  EChoice [(Send ''ch'' (\\<lambda>_. 1), Wait 1), (Send ''ch2'' (\\<lambda>_. 2), Wait 2)],\n  Cm (Receive ''ch'' X)])\n    (ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [])\n    (ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [IOBlock 1 0 ''ch'' X 1, \n        ParWaitBlock 1 (\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 1 then [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] else undefined)])\"\nproof -\n  have 1: \"combine_blocks [(\\<lambda>_. 0), (\\<lambda>_. 0)] [[], []] []\"\n    apply (rule combine_blocks.intros(1))\n    by (auto simp add: less_Suc_eq)\n\n  have 11: \"combine_blocks [(\\<lambda>_. 0), (\\<lambda>_. 0)(X := 1)] [[], []] []\"\n    apply (rule combine_blocks.intros(1))\n    by (auto simp add: less_Suc_eq)\n\n  have 2: \"(\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 1 then wait_block_state_list [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] \n            d [[WaitBlock 1], []] else undefined)\n         = (\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 1 then [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] else undefined)\"\n    by auto\n\n  have 3: \"combine_blocks [(\\<lambda>_. 0), (\\<lambda>_. 0)]\n     [[OutBlock 0 ''ch'' 1 ({''ch'', ''ch2''}, {}), WaitBlock 1],\n      [InBlock 0 ''ch'' X 1 ({}, {''ch''})]]\n     [IOBlock 1 0 ''ch'' X 1, ParWaitBlock 1 ((\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 1 then [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] else undefined))]\"\n    apply (rule combine_blocks.intros(3)[where i=1 and j=0])\n    apply (auto simp add: remove_pair_def)\n    using combine_blocks.intros(4)[where i=0 and t=1 and blkss=\"[[WaitBlock 1], []]\" \n            and sts=\"[\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)]\"]\n    apply (auto simp add: remove_one_def less_Suc_eq)\n    using 11 2 by auto\n  show ?thesis\n    apply (rule parallelB2[OF test9a test2a])\n    apply (auto simp add: compat_rdy_block_pair_def less_Suc_eq combine_par_trace.simps)\n    using 1 3 by auto\nqed\n\ntext \\<open>ODE Example 1\\<close>\nlemma test11: \"big_step (Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) (\\<lambda>s. s X < 1))\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [ODEBlock 1 (restrict (\\<lambda>t. (\\<lambda>_. 0)(X := t)) {0..1})])\"\n  apply (rule ContB)\n  apply (auto simp add: ODEsol_def state2vec_def fun_upd_def has_vderiv_on_def)\n  apply (rule has_vector_derivative_projI)\n  by (auto intro!: derivative_intros)\n\ntext \\<open>ODE Example 2\\<close>\nlemma test11b: \"big_step (Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 2), Y := (\\<lambda>s. s X)))) (\\<lambda>s. s Y < 1))\n        (Trace (\\<lambda>_. 0) [])\n        (Trace (\\<lambda>_. 0) [ODEBlock 1 (restrict (\\<lambda>t. (\\<lambda>_. 0)(X := 2 * t, Y := t ^ 2)) {0..1})])\"\n  apply (rule ContB)\n  apply (auto simp add: ODEsol_def state2vec_def fun_upd_def has_vderiv_on_def)\n  apply (rule has_vector_derivative_projI)\n   apply (auto simp: vars_distinct)\n  apply (rule has_vector_derivative_eq_rhs)\n     apply (auto intro!: derivative_intros)[1] apply simp\n   apply (rule has_vector_derivative_eq_rhs)\n    unfolding power2_eq_square apply (auto intro!: derivative_intros)[1] apply simp\n  by (metis (full_types) less_1_mult less_eq_real_def mult_le_one mult_less_cancel_left1)\n\ntext \\<open>ODE Example 3\\<close>\nlemma test11c: \"big_step (Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>s. - s Y), Y := (\\<lambda>s. s X)))) (\\<lambda>s. s Y < 1))\n        (Trace ((\\<lambda>_. 0)(X := 1)) [])\n        (Trace ((\\<lambda>_. 0)(X := 1)) [ODEBlock (pi / 2) (restrict (\\<lambda>t. (\\<lambda>_. 0)(X := cos t, Y := sin t)) {0..pi / 2})])\"\nproof -\n  have 1: \"sin t < 1\" if \"0 \\<le> t\" \"t * 2 < pi\" for t\n  proof (cases \"t = 0\")\n    case True\n    then show ?thesis by auto\n  next\n    case False\n    have \"0 < cos t\"\n      apply (rule cos_gt_zero) using that False by auto\n    then show ?thesis\n      using sin_cos_squared_add[of t, unfolded power2_eq_square]\n      using less_eq_real_def by fastforce\n  qed\n  show ?thesis\n    apply (rule ContB[where d=\"pi / 2\"])\n         apply (auto simp add: ODEsol_def state2vec_def fun_upd_def has_vderiv_on_def vars_distinct)\n      apply (rule has_vector_derivative_projI)\n      apply (auto simp: vars_distinct)\n      apply (rule has_vector_derivative_eq_rhs)\n    unfolding has_vector_derivative_def\n       apply (auto intro!: derivative_intros)[1] apply simp\n     apply (auto intro!: derivative_intros)[1]\n    by (auto intro: 1)\nqed\n\nsubsection \\<open>Validity\\<close>\n\ntype_synonym assn = \"trace \\<Rightarrow> bool\"\n\ndefinition Valid :: \"assn \\<Rightarrow> proc \\<Rightarrow> assn \\<Rightarrow> bool\" where\n  \"Valid P c Q \\<longleftrightarrow> (\\<forall>tr tr2. P tr \\<longrightarrow> big_step c tr tr2 \\<longrightarrow> Q tr2)\"\n\ntheorem Valid_union:\n  \"\\<forall>a\\<in>S. Valid (P a) c (Q a) \\<Longrightarrow> Valid (\\<lambda>tr. \\<exists>a\\<in>S. P a tr) c (\\<lambda>tr. \\<exists>a\\<in>S. Q a tr)\"\n  unfolding Valid_def by auto\n\ntheorem Valid_pre:\n  \"\\<forall>tr. P tr \\<longrightarrow> P' tr \\<Longrightarrow> Valid P' c Q \\<Longrightarrow> Valid P c Q\"\n  unfolding Valid_def by auto\n\ntheorem Valid_post:\n  \"\\<forall>tr. Q tr \\<longrightarrow> Q' tr \\<Longrightarrow> Valid P c Q \\<Longrightarrow> Valid P c Q'\"\n  unfolding Valid_def by auto\n\ntheorem Valid_ex_pre:\n  \"Valid (\\<lambda>tr. \\<exists>x. P x tr) c Q \\<longleftrightarrow> (\\<forall>x. Valid (P x) c Q)\"\n  unfolding Valid_def by auto\n\ntheorem Valid_and_pre:\n  \"Valid (\\<lambda>t. P t \\<and> P2) c Q \\<longleftrightarrow> (P2 \\<longrightarrow> (Valid P c Q))\"\n  unfolding Valid_def by auto\n\ntheorem Valid_cond:\n  assumes \"b \\<Longrightarrow> Valid P c Q1\"\n      and \"\\<not>b \\<Longrightarrow> Valid P c Q2\"\n    shows \"Valid P c (if b then Q1 else Q2)\" \n  using assms Valid_def by auto\n\ninductive_cases skipE :\"big_step Skip tr tr2\"\nthm skipE\n\ninductive_cases assignE: \"big_step (Assign var e) tr tr2\"\nthm assignE\n\ninductive_cases sendE: \"big_step (Cm (Send ch e)) tr tr2\"\nthm sendE\n\ninductive_cases receiveE: \"big_step (Cm (Receive ch var)) tr tr2\"\nthm receiveE\n\ninductive_cases seqE: \"big_step (Seq p1 p2) tr tr3\"\nthm seqE\n\ninductive_cases waitE: \"big_step (Wait d) tr tr2\"\nthm waitE\n\ninductive_cases repE: \"big_step (Rep p) tr tr2\"\nthm repE\n\ninductive_cases echoiceE: \"big_step (EChoice cs) tr tr2\"\nthm echoiceE\n\ninductive_cases contE: \"big_step (Cont ode b) tr tr2\"\nthm contE\n\ninductive_cases interruptE: \"big_step (Interrupt ode cs) tr tr2\"\nthm interruptE\n\ntheorem Valid_skip:\n  \"Valid\n    (\\<lambda>t. t = tr)\n    (Skip)\n    (\\<lambda>t. t = tr)\"\n  unfolding Valid_def by (auto elim: skipE)\n\ntheorem Valid_assign:\n  \"Valid\n    (\\<lambda>t. t = tr)\n    (Assign var e)\n    (\\<lambda>t. t = extend_trace tr (TauBlock ((end_of_trace tr)(var := e (end_of_trace tr)))))\"\n  unfolding Valid_def by (auto elim: assignE)\n\ntheorem Valid_send:\n  \"Valid\n    (\\<lambda>t. t = tr)\n    (Cm (Send ch e))\n    (\\<lambda>t. \\<exists>dly. t = extend_send ch e dly ({ch}, {}) tr)\"\n  unfolding Valid_def by (auto elim: sendE)\n\ntheorem Valid_receive:\n  \"Valid\n    (\\<lambda>t. t = tr)\n    (Cm (Receive ch var))\n    (\\<lambda>t. \\<exists>dly v. t = extend_receive ch var dly v ({}, {ch}) tr)\"\n  unfolding Valid_def by (auto elim!: receiveE)\n\ntheorem Valid_seq:\n  \"Valid P c1 Q \\<Longrightarrow> Valid Q c2 R \\<Longrightarrow> Valid P (Seq c1 c2) R\"\n  unfolding Valid_def by (auto elim!: seqE)\n\ntheorem Valid_wait:\n  \"Valid\n    (\\<lambda>t. t = tr)\n    (Wait d)\n    (\\<lambda>t. t = extend_trace tr (WaitBlock d))\"\n  unfolding Valid_def by (auto elim!: waitE)\n\ntheorem Valid_rep:\n  assumes \"Valid P c P\"\n  shows \"Valid P (Rep c) P\"\nproof -\n  have 1: \"big_step p tr tr2 \\<Longrightarrow> p = Rep c \\<Longrightarrow>\n        \\<forall>tr tr2. P tr \\<longrightarrow> big_step c tr tr2 \\<longrightarrow> P tr2 \\<Longrightarrow> P tr \\<Longrightarrow> P tr2\" for p tr tr2\n    by (induct rule: big_step.induct, auto)\n  show ?thesis\n    using assms 1 unfolding Valid_def by auto\nqed\n\ntheorem Valid_echoice:\n  assumes \"\\<forall>i<length es.\n    case (es ! i) of\n      (Send ch e, p2) \\<Rightarrow> \\<forall>dly. Valid (\\<lambda>t. t = extend_send ch e dly (rdy_of_echoice es) tr) p2 R\n    | (Receive ch var, p2) \\<Rightarrow> \\<forall>dly v. Valid (\\<lambda>t. t = extend_receive ch var dly v (rdy_of_echoice es) tr) p2 R\"\n  shows\n    \"Valid (\\<lambda>t. t = tr) (EChoice es) R\"\nproof -\n  have 1: \"R tr2\" if \"i < length es\" \"es ! i = (ch[!]e, p2)\" \"big_step p2 (extend_send ch e dly (rdy_of_echoice es) tr) tr2\"\n    for tr2 i ch e p2 dly\n  proof -\n    have \"Valid (\\<lambda>t. t = extend_send ch e dly (rdy_of_echoice es) tr) p2 R\"\n      using assms that by auto\n    then show ?thesis\n      unfolding Valid_def using that(3) by auto\n  qed\n  have 2: \"R tr2\" if \"i < length es\" \"es ! i = (ch[?]var, p2)\" \"big_step p2 (extend_receive ch var dly v (rdy_of_echoice es) tr) tr2\"\n    for tr2 i ch var p2 dly v\n  proof -\n    have \"Valid (\\<lambda>t. t = extend_receive ch var dly v (rdy_of_echoice es) tr) p2 R\"\n      using assms that by auto\n    then show ?thesis\n      unfolding Valid_def using that(3) by auto\n  qed\n  show ?thesis\n    unfolding Valid_def apply (auto elim!: echoiceE)\n    using 1 2 by auto\nqed\n\ntext \\<open>Hoare triple for ODE with unique solution\\<close>\ntheorem Valid_ode_solution:\n  assumes \"\\<forall>d2 p2. d2 \\<ge> 0 \\<longrightarrow> ODEsol ode p2 d2 \\<longrightarrow>\n      (\\<forall>t. t \\<ge> 0 \\<and> t < d2 \\<longrightarrow> b (p2 t)) \\<longrightarrow>\n      \\<not> b (p2 d2) \\<longrightarrow> p2 0 = end_of_trace tr \\<longrightarrow>d2 = d \\<and> (restrict p {0..d} = restrict p2 {0..d2})\"\n  shows \"Valid\n     (\\<lambda>t. t = tr)\n     (Cont ode b)\n     (\\<lambda>t. t = extend_trace tr (ODEBlock d (restrict p {0..d})))\"\n  unfolding Valid_def using assms \n  by (metis contE)\n\n\ntext \\<open>Hoare triple for ODE with non-unique solutions\\<close>\ntheorem Valid_ode_all_solution:\n  assumes \"\\<forall>d p. d \\<ge> 0 \\<longrightarrow> ODEsol ode p d \\<longrightarrow>\n      (\\<forall>t. t \\<ge> 0 \\<and> t < d \\<longrightarrow> b (p t)) \\<longrightarrow>\n      \\<not> b (p d) \\<longrightarrow> p 0 = end_of_trace tr \\<longrightarrow> Q d p\"\n  shows \"Valid\n    (\\<lambda>t. t = tr)\n    (Cont ode b)\n    (\\<lambda>t. \\<exists>d p. t = extend_trace tr (ODEBlock d (restrict p {0..d})) \\<and> d \\<ge> 0 \\<and> p 0 = end_of_trace tr \\<and> Q d p)\"\n  unfolding Valid_def using assms by (metis contE)\n\ntheorem Valid_interrupt:\n  assumes \"\\<forall>i<length es.\n    case (es ! i) of\n      (Send ch e, p2) \\<Rightarrow>\n        \\<forall>p d. d \\<ge> 0 \\<longrightarrow> ODEsol ode p d \\<longrightarrow> p 0 = end_of_trace tr \\<longrightarrow>\n              Valid (\\<lambda>t. t = extend_trace tr (ODEOutBlock d (restrict p {0..d}) ch (e (p d)) (rdy_of_echoice es))) p2 R\n    | (Receive ch var, p2) \\<Rightarrow>\n        \\<forall>p d v. d \\<ge> 0 \\<longrightarrow> ODEsol ode p d \\<longrightarrow> p 0 = end_of_trace tr \\<longrightarrow>\n              Valid (\\<lambda>t. t = extend_trace tr (ODEInBlock d (restrict p {0..d}) ch var v (rdy_of_echoice es))) p2 R\"\n  shows\n    \"Valid (\\<lambda>t. t = tr) (Interrupt ode es) R\"\nproof -\n  have 1: \"R tr2\" if \"0 \\<le> d\" \"ODEsol ode p d\"\n       \"p 0 = end_of_trace tr\"\n       \"i < length es\"\n       \"es ! i = (ch[!]e, p2)\" \"big_step p2 (extend_trace tr (ODEOutBlock d (restrict p {0..d}) ch (e (p d)) (rdy_of_echoice es))) tr2\"\n     for tr2 d p i ch e p2\n  proof -\n    have \"Valid (\\<lambda>t. t = extend_trace tr (ODEOutBlock d (restrict p {0..d}) ch (e (p d)) (rdy_of_echoice es))) p2 R\"\n      using assms that(1-5) by auto\n    then show ?thesis\n      unfolding Valid_def using that(6) by auto\n  qed\n  have 2: \"R tr2\" if \"0 \\<le> d\" \"ODEsol ode p d\"\n       \"p 0 = end_of_trace tr\"\n       \"i < length es\"\n       \"es ! i = (ch[?]var, p2)\" \"big_step p2 (extend_trace tr (ODEInBlock d (restrict p {0..d}) ch var v (rdy_of_echoice es))) tr2\"\n     for tr2 d p i ch var p2 v\n  proof -\n    have \"Valid (\\<lambda>t. t = extend_trace tr (ODEInBlock d (restrict p {0..d}) ch var v (rdy_of_echoice es))) p2 R\"\n      using assms that(1-5) by auto\n    then show ?thesis\n      unfolding Valid_def using that(6) by auto\n  qed\n  show ?thesis\n    unfolding Valid_def apply (auto elim!: interruptE)\n    using 1 2 by auto\nqed\n\n\ntext \\<open>Differential invariant rule\\<close>\n\nlemma Valid_ode_invariant:\n  fixes inv :: \"state \\<Rightarrow> real\"\n  assumes \"\\<forall>x. ((\\<lambda>v. inv (vec2state v)) has_derivative g' (x)) (at x within UNIV)\"\n      and \"\\<forall>S. g' (state2vec S) (ODE2Vec ode S) = 0\"\n  shows \"Valid\n    (\\<lambda>t. t = tr)\n    (Cont ode b)\n    (\\<lambda>t. \\<exists>d p. t = extend_trace tr (ODEBlock d (restrict p {0..d})) \\<and>\n               d \\<ge> 0 \\<and> p 0 = end_of_trace tr \\<and>\n               (\\<forall>t. 0\\<le>t \\<and> t\\<le>d \\<longrightarrow> inv (p t) = inv (p 0)))\"\n  apply(rule Valid_ode_all_solution)\n  apply auto\n  subgoal premises pre for d p t\n  proof-\n    have 1: \"\\<forall>t\\<in>{0 .. d}. ((\\<lambda>t. inv(p t)) has_derivative  (\\<lambda>s. g' (state2vec(p t)) (s *\\<^sub>R ODE2Vec ode (p t)))) (at t within {0 .. d})\"\n      using pre assms\n      using chainrule[of inv \"\\<lambda>x. g'(state2vec x)\" ode p d] \n      by auto\n    have 2: \"\\<forall>s. g' (state2vec(p t)) ((s *\\<^sub>R 1) *\\<^sub>R ODE2Vec ode (p t)) = s *\\<^sub>R g' (state2vec(p t)) (1 *\\<^sub>R ODE2Vec ode (p t))\" if \"t\\<in>{0 .. d}\" for t\n      using 1 unfolding has_derivative_def bounded_linear_def \n      using that linear_iff[of \"(\\<lambda>s. g' (state2vec(p t)) (s *\\<^sub>R ODE2Vec ode (p t)))\"]\n      by blast\n    have 3: \"\\<forall>s. (s *\\<^sub>R 1) = s\" by simp\n    have 4: \"\\<forall>s. g' (state2vec(p t)) (s *\\<^sub>R ODE2Vec ode (p t)) = s *\\<^sub>R g' (state2vec(p t)) (ODE2Vec ode (p t))\" if \"t\\<in>{0 .. d}\" for t\n      using 2 3 that by auto\n    have 5: \"\\<forall>s. g' (state2vec(p t)) (s *\\<^sub>R ODE2Vec ode (p t))= 0\" if \"t\\<in>{0 .. d}\" for t\n      using 4 assms(2) that by simp \n    show ?thesis\n      using mvt_real_eq[of d \"(\\<lambda>t. inv(p t))\"\"\\<lambda>t. (\\<lambda>s. g' (state2vec(p t)) (s *\\<^sub>R ODE2Vec ode (p t)))\" t]\n      using 1 5 pre by auto\n  qed\n  done\n\n\nsubsection \\<open>Validity for parallel processes\\<close>\n\ntype_synonym par_assn = \"par_trace \\<Rightarrow> bool\"\n\ndefinition ParValid :: \"par_assn \\<Rightarrow> pproc \\<Rightarrow> par_assn \\<Rightarrow> bool\" where\n  \"ParValid P pc Q \\<longleftrightarrow> (\\<forall>par_tr par_tr2. P par_tr \\<longrightarrow> par_big_step pc par_tr par_tr2 \\<longrightarrow> Q par_tr2)\"\n\ntheorem ParValid_pre:\n  \"\\<forall>tr. P tr \\<longrightarrow> P' tr \\<Longrightarrow> ParValid P' pc Q \\<Longrightarrow> ParValid P pc Q\"\n  unfolding ParValid_def by auto\n\ntheorem ParValid_post:\n  \"\\<forall>tr. Q tr \\<longrightarrow> Q' tr \\<Longrightarrow> ParValid P pc Q \\<Longrightarrow> ParValid P pc Q'\"\n  unfolding ParValid_def by auto\n\ninductive_cases parE: \"par_big_step (PProc ps) par_tr par_tr2\"\nthm parE\n\ninductive_cases combine_blocksE1: \"combine_blocks sts blkss []\"\nthm combine_blocksE1\n\nlemma combine_par_trace_trivial:\n  \"combine_par_trace tr (ParTrace par_st []) \\<Longrightarrow> \\<forall>i<length par_st. (tr ! i) = Trace (par_st ! i) []\"\n  apply (auto elim!: combine_par_trace.cases)\n  apply (auto elim!: combine_blocksE1)\n  by (metis blocks_of_trace.simps start_of_trace.simps trace.exhaust)\n\ntext \\<open>Parallel rule\\<close>\n\ntext \\<open>Hoare triple for parallel processes.\n  ps -- list of processes.\n  P -- list of pre-conditions of processes.\n  Q -- list of post-conditions of processes.\n\\<close>\ntheorem Valid_parallel:\n  assumes \"length P = length ps\"\n      \"length Q = length ps\"\n      \"length par_st = length ps\"\n      \"\\<forall>i<length ps. (P ! i) (Trace (par_st ! i) [])\"\n      \"\\<forall>i<length ps. Valid (P ! i) (ps ! i) (Q ! i)\"\n  shows \"ParValid\n    (\\<lambda>par_t. par_t = ParTrace par_st [])\n    (PProc ps)\n    (\\<lambda>par_t. \\<exists>tr2. length tr2 = length ps \\<and> (\\<forall>i<length ps. (Q ! i) (tr2 ! i)) \\<and> compat_rdy tr2 \\<and> combine_par_trace tr2 par_t)\"\nproof -\n  have 1: \"\\<forall>i<length ps. (Q ! i) (tr2 ! i)\"\n    if \"\\<forall>i<length ps. big_step (ps ! i) (tr ! i) (tr2 ! i)\"\n       \"combine_par_trace tr (ParTrace par_st [])\" for tr tr2\n  proof -\n    from that(2) have \"\\<forall>i<length ps. (tr ! i) = Trace (par_st ! i) []\"\n      using combine_par_trace_trivial assms(3) by auto\n    then show ?thesis\n      using assms(4-5) that(1) unfolding Valid_def by auto\n  qed\n  show ?thesis\n    apply (auto simp add: ParValid_def)\n    apply (auto elim!: parE)\n    subgoal for par_tr2 tr tr2\n      apply (rule exI[where x=tr2])\n      by (auto simp add: assms 1)\n  done\nqed\n\nsubsection \\<open>Other versions of Hoare triples\\<close>\n\ntheorem Valid_skip2:\n  \"Q tr \\<Longrightarrow>\n   Valid\n    (\\<lambda>t. t = tr)\n    (Skip)\n    Q\"\n  using Valid_def skipE by blast\n\ntheorem Valid_assign2:\n  \"Q (extend_trace tr (TauBlock ((end_of_trace tr)(var := e (end_of_trace tr))))) \\<Longrightarrow>\n   Valid\n    (\\<lambda>t. t = tr)\n    (Assign var e)\n    Q\"\n  using Valid_def assignE by blast\n\ntheorem Valid_send2:\n  \"\\<forall>dly. Q (extend_send ch e dly ({ch}, {}) tr) \\<Longrightarrow>\n   Valid\n    (\\<lambda>t. t = tr)\n    (Cm (Send ch e))\n    Q\"\n  using Valid_def sendE by blast\n\ntheorem Valid_send3:\n  \"\\<forall>tr dly. P tr \\<longrightarrow> Q (extend_send ch e dly ({ch}, {}) tr) \\<Longrightarrow>\n    Valid P (Cm (Send ch e)) Q\"\n  using Valid_def sendE by blast\n\ntheorem Valid_receive2:\n  \"\\<forall>dly v. Q (extend_receive ch var dly v ({}, {ch}) tr) \\<Longrightarrow>\n   Valid\n    (\\<lambda>t. t = tr)\n    (Cm (Receive ch var))\n    Q\"\n  using Valid_def receiveE by blast\n\ntheorem Valid_wait2:\n  \"Q (extend_trace tr (WaitBlock d)) \\<Longrightarrow>\n   Valid\n    (\\<lambda>t. t = tr)\n    (Wait d)\n    Q\"\n  using Valid_def waitE by blast\n\ntheorem Valid_ode_solution2:\n  assumes \"\\<forall>d2 p2. d2 \\<ge> 0 \\<longrightarrow> ODEsol ode p2 d2 \\<longrightarrow>\n      (\\<forall>t. t \\<ge> 0 \\<and> t < d2 \\<longrightarrow> b (p2 t)) \\<longrightarrow>\n      \\<not> b (p2 d2) \\<longrightarrow> p2 0 = end_of_trace tr \\<longrightarrow> d2 = d \\<and> (restrict p {0..d} = restrict p2 {0..d2})\"\n    and \"Q (extend_trace tr (ODEBlock d (restrict p {0..d})))\"\n  shows \"Valid\n     (\\<lambda>t. t = tr)\n     (Cont ode b)\n     Q\"\n  unfolding Valid_def using assms by (metis contE)\n\ntheorem Valid_ode_solution3:\n  assumes \"\\<not> b (end_of_trace tr)\"\n      and \"Q (extend_trace tr (ODEBlock 0 (restrict (\\<lambda>t. end_of_trace tr) {0..0})))\"\n    shows \"Valid\n     (\\<lambda>t. t = tr)\n     (Cont ode b)\n     Q\"\nproof-\n  have main: \"restrict p2 {0..d2} = restrict (\\<lambda>t. end_of_trace tr) {0..0} \\<and> d2 = 0\"\n    if cond: \"0 \\<le> d2\"\n       \"ODEsol ode p2 d2\"\n       \"\\<forall>t. 0 \\<le> t \\<and> t < d2 \\<longrightarrow> b (p2 t)\"\n       \"\\<not> b (p2 d2)\"\n       \"p2 0 = (end_of_trace tr)\"\n     for p2 d2\n  proof-\n    have \"d2\\<le>0\" using cond(3) cond(5) assms(1) by auto\n    then have \"d2=0\" using cond(1) by auto\n    then show ?thesis using cond(5) by auto\n  qed\n  show ?thesis \n    apply(rule Valid_ode_solution2[where d=0 and p=\"(\\<lambda>t. end_of_trace tr)\"]) \n    using main assms by auto\nqed\n\ntheorem Valid_ode_unique_solution:\n  assumes \"d \\<ge> 0\" \"ODEsol ode p d\" \"\\<forall>t. t \\<ge> 0 \\<and> t < d \\<longrightarrow> b (p t)\"\n      \"\\<not> b (p d)\" \"p 0 = end_of_trace tr\"\n      \"local_lipschitz {- 1<..} UNIV (\\<lambda>(t::real) v. ODE2Vec ode (vec2state v))\"\n      \"Q (extend_trace tr (ODEBlock d (restrict p {0..d})))\"\n  shows \"Valid\n    (\\<lambda>t. t = tr)\n    (Cont ode b)\n    Q\"\nproof -\n  have main: \"d2 = d \\<and> restrict p {0..d} = restrict p2 {0..d2}\"\n    if cond: \"0 \\<le> d2\"\n       \"ODEsol ode p2 d2\"\n       \"(\\<forall>t. 0 \\<le> t \\<and> t < d2 \\<longrightarrow> b (p2 t))\"\n       \"\\<not> b (p2 d2)\"\n       \"p2 0 = end_of_trace tr\"\n     for p2 d2\n  proof -\n    interpret loc:ll_on_open_it \"{-1<..}\"\n      \"\\<lambda>t v. ODE2Vec ode (vec2state v)\" UNIV 0\n      apply standard\n      using assms(6) by auto\n    have s1: \"((\\<lambda>t. state2vec (p t)) solves_ode ((\\<lambda>t v. ODE2Vec ode (vec2state v)))) {0..d} UNIV\"\n      using assms(2) unfolding ODEsol_def solves_ode_def by auto\n    have s2: \"(loc.flow 0 (state2vec (end_of_trace tr))) t = (\\<lambda>t. state2vec (p t)) t\" if \"t \\<in> {0..d}\" for t\n      apply (rule loc.maximal_existence_flow(2)[OF s1])\n      using that by (auto simp add: state2vec_def assms(1,5))\n    have s3: \"((\\<lambda>t. state2vec(p2 t)) solves_ode ((\\<lambda>t v. ODE2Vec ode (vec2state v)))) {0..d2} UNIV\"\n      using cond(2) unfolding ODEsol_def solves_ode_def by auto\n    have s4: \"loc.flow 0 (state2vec (end_of_trace tr)) t = state2vec (p2 t)\" if \"t\\<in>{0..d2}\" for t\n      apply (rule loc.maximal_existence_flow(2)[OF s3])\n      using cond(1,5) that by auto\n    have s5: \"d \\<le> d2\"\n    proof (rule ccontr)\n      assume 0: \"\\<not>(d \\<le> d2)\"\n      from 0 have 1: \"(\\<lambda>t. state2vec (p t)) d2 = (\\<lambda>t. state2vec (p2 t)) d2\"\n        using s2[of d2] s4[of d2] cond(1) by auto\n      from 1 have \"p d2 = p2 d2\"\n        by (auto simp add: state2vec_def)\n      show False\n        using \"0\" \\<open>p d2 = p2 d2\\<close> assms(3) that(1) that(4) by auto\n    qed\n    have s6: \"d2 \\<le> d\"\n    proof (rule ccontr)\n      assume 0: \"\\<not>(d2 \\<le> d)\"\n      from 0 have 1: \"(\\<lambda>t. state2vec (p t)) d = (\\<lambda>t. state2vec (p2 t)) d\"\n        using s2[of d] s4[of d] assms(1) by auto\n      from 1 have \"p d = p2 d\"\n        by (auto simp add: state2vec_def)\n      show False\n        using \"0\" \\<open>p d = p2 d\\<close> assms(1) assms(4) that(3) by auto\n    qed\n    have s7: \"d = d2\" using s5 s6 by auto\n    have s8: \"t\\<in>{0..d} \\<Longrightarrow> p2 t = p t\" for t\n      using s2 s4 s7 by (metis vec_state_map1)\n    have s9: \"restrict p2 {0..d2} = restrict p {0..d}\"\n      using s7 s8 unfolding restrict_def by auto\n    show ?thesis using s7 s9 by auto\n  qed\n  show ?thesis\n    apply (rule Valid_ode_solution2[where d=d and p=p])\n    using main assms(7) by auto\nqed\n\n\ntext \\<open>Version of Valid_parallel with arbitrary post-condition\\<close>\ntheorem Valid_parallel':\n  \"length P = length ps \\<Longrightarrow>\n   length Q = length ps \\<Longrightarrow>\n   length par_st = length ps \\<Longrightarrow>\n   \\<forall>i<length ps. (P ! i) (Trace (par_st ! i) []) \\<Longrightarrow>\n   \\<forall>i<length ps. Valid (P ! i) (ps ! i) (Q ! i) \\<Longrightarrow>\n   (\\<forall>par_t tr. length tr = length ps \\<and> (\\<forall>i<length ps. (Q ! i) (tr ! i)) \\<and> compat_rdy tr \\<and> combine_par_trace tr par_t \\<longrightarrow> par_Q par_t) \\<Longrightarrow>\n   ParValid (\\<lambda>t. t = ParTrace par_st [])\n    (PProc ps)\n    par_Q\"\n  using ParValid_post Valid_parallel by auto\n\ntext \\<open>Version for two processes\\<close>\ntheorem Valid_parallel2':\n  assumes \"P1 (Trace st1 [])\"\n    \"P2 (Trace st2 [])\"\n    \"Valid P1 p1 Q1\" \"Valid P2 p2 Q2\"\n    \"(\\<forall>par_t tr1 tr2. Q1 tr1 \\<longrightarrow> Q2 tr2 \\<longrightarrow> compat_trace_pair tr1 tr2 \\<longrightarrow> combine_par_trace [tr1, tr2] par_t \\<longrightarrow> par_Q par_t)\"\n  shows \"ParValid (\\<lambda>t. t = ParTrace [st1, st2] [])\n    (PProc [p1, p2])\n    par_Q\"\nproof -\n  have 1: \"par_Q par_t\" if\n    \"length tr = length [p1, p2]\" \"(\\<forall>i<length [p1, p2]. ([Q1, Q2] ! i) (tr ! i))\" \"compat_rdy tr\" \"combine_par_trace tr par_t\"\n  for par_t tr\n  proof -\n    have \"tr = [tr ! 0, tr ! 1]\"\n      apply (rule nth_equalityI)\n      using that(1) by (auto simp add: less_Suc_eq)\n    then obtain tr1 tr2 where 2: \"tr = [tr1, tr2]\"\n      by auto\n    then have 3: \"compat_trace_pair tr1 tr2\"\n      using \\<open>compat_rdy tr\\<close> unfolding compat_rdy_def by (auto simp add: less_Suc_eq)\n    from assms show ?thesis\n      using that 3 unfolding 2 by (auto simp add: less_Suc_eq)\n  qed\n  show ?thesis\n    apply (rule Valid_parallel'[where P=\"[P1,P2]\" and Q=\"[Q1,Q2]\"])\n    by (auto simp add: less_Suc_eq assms 1)\nqed\n\nsubsection \\<open>More on combine_blocks\\<close>\n\nlemma combine_blocks_triv2:\n  \"combine_blocks sts [[], []] par_blks \\<Longrightarrow> par_blks = []\"\nproof (induct rule: combine_blocks.cases)\ncase (1 blkss)\n  then show ?case by auto\nnext\n  case (2 i blkss t pblks)\n  have \"i = 0 \\<or> i = 1\"\n    using 2  by auto\n  then show ?case using 2 by auto\nnext\n  case (3 i blkss j c v pblks)\n  have \"i = 0 \\<or> i = 1\"\n    using 3  by auto\n  then show ?case using 3 by auto\nnext\n  case (4 i blkss t sts pblks)\n have \"i = 0 \\<or> i = 1\"\n    using 4  by auto\n  then show ?case using 4 by auto\nqed\n\nlemma combine_blocks_IO2:\n  \"combine_blocks sts [OutBlock d1 ch1 v1 rdy1 # blks1,\n                   InBlock d2 ch2 var v2 rdy2 # blks2] par_tr \\<Longrightarrow>\n   (\\<exists>rest. d1 = 0 \\<and> d2 = 0 \\<and> ch1 = ch2 \\<and> v1 = v2 \\<and>\n           combine_blocks (sts[1 := end_of_blocks (sts ! 1) [InBlock d2 ch2 var v2 rdy2]]) [blks1, blks2] rest \\<and> par_tr = (IOBlock 1 0 ch1 var v1) # rest)\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss)\n  then show ?case by auto\nnext\n  case (2 i blkss t pblks)\n  have \"i = 0 \\<or> i = 1\"\n    using 2 by auto\n  then show ?case using 2 by auto\nnext\n  case (3 i blkss j c v x stsa pblks)\n  have \"length blkss = 2\"\n    using 3  by auto\n  have \"i = 0 \\<or> i = 1\" \"j = 0 \\<or> j = 1\"\n    using 3 by auto\n  then have ij: \"i = 1\" \"j = 0\"\n    using 3  by auto\n  have \"d1 = 0\" \"d2 = 0\"\n    using 3  ij by auto\n  moreover have \"v1 = v2\" \"ch1 = ch2\" \"v = v1\" \"c = ch1\"\n    using 3  ij by auto\n  moreover have \"\\<exists>rest. combine_blocks (stsa[i := end_of_blocks (stsa ! i) [hd (blkss ! i)]]) [blks1, blks2] rest \\<and> par_tr = (IOBlock 1 0 ch1 var v1) # rest\"\n    apply (rule exI[where x=\"pblks\"])\n    using 3 ij\n    by (auto simp add: remove_pair_def)\n  ultimately show ?case\n    using 3 ij by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n   have \"i = 0 \\<or> i = 1\"\n    using 4 by auto\n  then show ?case using 4 by auto \nqed\n\nlemma combine_blocks_ODEIO2:\n  \"combine_blocks sts [ODEOutBlock d1 h ch1 v1 rdy1 # blks1,\n                   InBlock d2 ch2 var v2 rdy2 # blks2] par_tr \\<Longrightarrow>\n   (\\<exists>rest. d1 = 0 \\<and> d2 = 0 \\<and> ch1 = ch2 \\<and> v1 = v2 \\<and>\n           combine_blocks (sts[1 := end_of_blocks (sts ! 1) [InBlock d2 ch2 var v2 rdy2]]) [blks1, blks2] rest \\<and> par_tr = (IOBlock 1 0 ch1 var v1) # rest)\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss)\n  then show ?case by auto\nnext\n  case (2 i blkss t pblks)\n  have \"i = 0 \\<or> i = 1\"\n    using 2 by auto\n  then show ?case using 2 by auto\nnext\n  case (3 i blkss j c v x stsa pblks)\n  have \"length blkss = 2\"\n    using 3  by auto\n  have \"i = 0 \\<or> i = 1\" \"j = 0 \\<or> j = 1\"\n    using 3 by auto\n  then have ij: \"i = 1\" \"j = 0\"\n    using 3  by auto\n  have \"d1 = 0\" \"d2 = 0\"\n    using 3  ij by auto\n  moreover have \"v1 = v2\" \"ch1 = ch2\" \"v = v1\" \"c = ch1\"\n    using 3  ij by auto\n  moreover have \"\\<exists>rest. combine_blocks (stsa[i := end_of_blocks (stsa ! i) [hd (blkss ! i)]]) [blks1, blks2] rest \\<and> par_tr = (IOBlock 1 0 ch1 var v1) # rest\"\n    apply (rule exI[where x=\"pblks\"])\n    using 3 ij\n    by (auto simp add: remove_pair_def)\n  ultimately show ?case\n    using 3 ij by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n   have \"i = 0 \\<or> i = 1\"\n    using 4 by auto\n  then show ?case using 4 by auto \nqed\n\nlemma combine_blocks_IO2':\n  \"combine_blocks sts [InBlock d2 ch2 var v2 rdy2 # blks2,\n                       OutBlock d1 ch1 v1 rdy1 # blks1] par_tr \\<Longrightarrow>\n  (\\<exists>rest. d1 = 0 \\<and> d2 = 0 \\<and> ch1 = ch2 \\<and> v1 = v2 \\<and>\n           combine_blocks (sts[0 := end_of_blocks (sts ! 0) [InBlock d2 ch2 var v2 rdy2]]) [blks2, blks1] rest \\<and> par_tr = (IOBlock 0 1 ch1 var v1) # rest)\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss)\n  then show ?case by auto\nnext\n  case (2 i blkss t pblks)\n  have \"i = 0 \\<or> i = 1\"\n    using 2  by auto\n  then show ?case using 2 by auto\nnext\n  case (3 i blkss j c v x stsa pblks)\n  have \"length blkss = 2\"\n    using 3  by auto\n  have \"i = 0 \\<or> i = 1\" \"j = 0 \\<or> j = 1\"\n    using 3  by auto\n  then have ij: \"i = 0\" \"j = 1\"\n    using 3  by auto\n  have \"d1 = 0\" \"d2 = 0\"\n    using 3  ij by auto\n  moreover have \"v1 = v2\" \"ch1 = ch2\" \"v = v1\" \"c = ch1\"\n    using 3 ij by auto\n  moreover have \"\\<exists>rest. combine_blocks (sts[0 := end_of_blocks (sts ! 0) [InBlock d2 ch2 var v2 rdy2]]) [blks2, blks1] rest \\<and> par_tr = (IOBlock 0 1 ch1 var v1) # rest\"\n    apply (rule exI[where x=\"pblks\"])\n    using 3  unfolding ij \\<open>v = v1\\<close> \\<open>c = ch1\\<close> 3(1)[symmetric] 3(12)\n    by (auto simp add: remove_pair_def)\n  ultimately show ?case\n    using 3 by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n   have \"i = 0 \\<or> i = 1\"\n    using 4 by auto\n  then show ?case using 4 by auto \nqed\n\ndefinition sts_init :: \"state list\" where\n  \"sts_init == [(\\<lambda>_. 0), (\\<lambda>_. 0)]\"\ndeclare sts_init_def [simp]\n\nlemma combine_blocks_OutW2:\n  \"combine_blocks sts_init [OutBlock d1 ch1 v ({ch1}, {}) # blks1,\n                            WaitBlock d2 # blks2] par_tr \\<Longrightarrow>\n   \\<exists>rest. d1 \\<ge> d2 \\<and>\n          combine_blocks sts_init  [OutBlock (d1 - d2) ch1 v ({ch1}, {}) # blks1, blks2] rest \\<and>\n          par_tr = (ParWaitBlock d2 (\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> d2 then sts_init else undefined)) # rest\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss)\n  then show ?case by auto\nnext\n  case (2 i blkss stsa pblks)\n  then show ?case by (auto simp add: less_Suc_eq)\nnext\n  case (3 i blkss j c v pblks)\n  then show ?case by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n  have \"i = 1\"\n    using 4  by (auto simp add: less_Suc_eq)\n  then have 1: \"t = d2\"\n    using 4 by auto\n  then have 2: \"d1 \\<ge> d2\"\n    using 4 by auto\n  show ?case\n    apply (rule exI[where x=pblks])\n    using 4  \\<open>i = 1\\<close> \\<open>d1 \\<ge> d2\\<close> \\<open>t = d2\\<close>\n    by (auto simp add: remove_one_def Let_def)\nqed\n\nlemma combine_blocks_ODEOutW2:\n  \"combine_blocks [(\\<lambda>_. 0), (\\<lambda>_. 0)(X := 1)] [ODEOutBlock d1 h ch1 v ({ch1}, {}) # blks1,\n                            WaitBlock d2 # blks2] par_tr \\<Longrightarrow>\n   \\<exists>rest. d1 \\<ge> d2 \\<and>\n          combine_blocks [h d2, (\\<lambda>_. 0)(X := 1)] [ODEOutBlock (d1 - d2) (\\<lambda>s. h (s + d2)) ch1 v ({ch1}, {}) # blks1, blks2] rest \\<and>\n          par_tr = (ParWaitBlock d2 (\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> d2 then [h d, (\\<lambda>_. 0)(X := 1)] else undefined)) # rest\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss)\n  then show ?case by auto\nnext\n  case (2 i blkss stsa pblks)\n  then show ?case by (auto simp add: less_Suc_eq)\nnext\n  case (3 i blkss j c v pblks)\n  then show ?case by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n  have \"i = 1\"\n    using 4  by (auto simp add: less_Suc_eq)\n  then have 1: \"t = d2\"\n    using 4 by auto\n  then have 2: \"d1 \\<ge> d2\"\n    using 4 by auto\n  show ?case\n    apply (rule exI[where x=pblks])\n    using 4  \\<open>i = 1\\<close> \\<open>d1 \\<ge> d2\\<close> \\<open>t = d2\\<close>\n    by (auto simp add: remove_one_def Let_def)\nqed\n\nlemma combine_blocks_WaitNil2:\n  \"combine_blocks [sl, sr] [WaitBlock d # blks1, []] par_tr \\<Longrightarrow>\n   \\<exists>rest. combine_blocks [sl, sr] [blks1, []] rest \\<and> par_tr \n         = (ParWaitBlock d (\\<lambda>t. if 0 \\<le> t \\<and> t \\<le> d then [sl, sr] else undefined)) # rest\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss)\n  then show ?case by auto\nnext\n  case (2 i blkss sts pblks)\n  then show ?case by (auto simp add: less_Suc_eq)\nnext\n  case (3 i blkss j c v pblks)\n  then show ?case\n    by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n  have \"i = 0\" \"t = d\"\n    using 4 by (auto simp add: less_Suc_eq)\n  then have 5: \"wait_block_state_list sts t blkss = sts\"\n               \"wait_block_state_list sts d blkss = sts\"\n               \"remove_one i t blkss = [blks1, []]\"\n    using 4 remove_one_def by auto\n  show ?case\n    apply (rule exI[where x=pblks])\n    using 4 \\<open>i = 0\\<close> \\<open>t = d\\<close> 5  by auto\nqed\n\nlemma combine_blocks_NilWait2:\n  \"combine_blocks [sl, sr] [[], WaitBlock d # blks1] par_tr \\<Longrightarrow>\n    \\<exists>rest. combine_blocks [sl, sr] [[], blks1] rest \\<and> par_tr \n         = (ParWaitBlock d (\\<lambda>t. if 0 \\<le> t \\<and> t \\<le> d then [sl, sr] else undefined)) # rest\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss)\n  then show ?case by auto\nnext\n  case (2 i blkss sts pblks)\n  then show ?case by (auto simp add: less_Suc_eq)\nnext\n  case (3 i blkss j c v pblks)\n  then show ?case\n    by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n  have \"i = 1\" \"t = d\"\n    using 4 by (auto simp add: less_Suc_eq)\n  then have 5: \"wait_block_state_list sts t blkss = sts\"\n               \"wait_block_state_list sts d blkss = sts\"\n               \"remove_one i t blkss = [[],blks1]\"\n    using 4 remove_one_def by auto\n  show ?case\n    apply (rule exI[where x=pblks])\n    using 4 \\<open>i = 1\\<close> \\<open>t = d\\<close> 5  by auto\nqed\n\nlemma combine_blocks_TauNil2:\n  \"combine_blocks sts [TauBlock st # blks1, []] par_tr \\<Longrightarrow>\n   \\<exists>rest. combine_blocks (sts[0 := st]) [blks1, []] rest \\<and> par_tr = ParTauBlock 0 st # rest\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss)\n  then show ?case by auto\nnext\n  case (2 i blkss sts pblks)\n  have \"i = 0\"  \n    using 2 by (auto simp add: less_Suc_eq)\n  show ?case\n    apply (rule exI[where x=pblks])\n    using 2 \\<open>i = 0\\<close> by (auto simp add: remove_one_def)\nnext\n  case (3 i blkss j c v x sts pblks)\n  then show ?case\n    by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n  then show ?case \n    by (auto simp add: less_Suc_eq)\nqed\n\nlemma combine_blocks_ODENil2:\n  \"combine_blocks [sl, sr] [ODEBlock d p # blks1, []] par_tr \\<Longrightarrow>\n   \\<exists>rest. combine_blocks [p d, sr] [blks1, []] rest \\<and> par_tr = (ParWaitBlock d (\\<lambda>t. if 0 \\<le> t \\<and> t \\<le> d then [p t, sr] else undefined)) # rest\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss)\n  then show ?case by auto\nnext\n  case (2 i blkss sts pblks)\n  have \"i = 0\"  \n    using 2 by (auto simp add: less_Suc_eq)\n  show ?case\n    apply (rule exI[where x=pblks])\n    using 2 \\<open>i = 0\\<close>  by (auto simp add: remove_one_def)\nnext\n  case (3 i blkss j c v pblks)\n  then show ?case\n    by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n   have \"i = 0\"\n    using 4  by (auto simp add: less_Suc_eq)\n  then have 1: \"t = d\"\n    using 4 by auto\n  show ?case\n    apply (rule exI[where x=pblks])\n    using 4  \\<open>i = 0\\<close> \\<open>t = d\\<close>\n    by (auto simp add: remove_one_def Let_def)\nqed\n\nlemma combine_blocks_TauIn2:\n  \"combine_blocks sts [TauBlock st # blks1, blk2 # blks2] par_tr \\<Longrightarrow>\n   event_of_block blk2 \\<noteq> Tau \\<Longrightarrow>\n   \\<exists>rest. combine_blocks (sts[0 := st]) [blks1, blk2 # blks2] rest \\<and> par_tr = ParTauBlock 0 st # rest\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss sts)\n  then show ?case by auto\nnext\n  case (2 i blkss sts pblks)\n  have \"i = 0\" \n    using 2 by (auto simp add: less_Suc_eq)\n  show ?case\n    apply (rule exI[where x=pblks])\n    using 2 \\<open>i = 0\\<close> by (auto simp add: remove_one_def)\nnext\n  case (3 i blkss j c v pblks)\n  then show ?case by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n  then show ?case by (auto simp add: less_Suc_eq)\nqed\n\nlemma combine_blocks_ODEIn2:\n  \"combine_blocks [sl, sr] [ODEBlock d p # blks1, (InBlock dly ch x r rdy) # blks2] par_tr \\<Longrightarrow>\n    \\<exists>rest. dly \\<ge> d \\<and>\n     combine_blocks [p d, sr] [blks1, wait_block d (InBlock dly ch x r rdy) # blks2] rest \\<and> par_tr = \n       (ParWaitBlock d (restrict (\\<lambda>t. [p t, sr]) {0..d})) # rest\"\nproof (induct rule: combine_blocks.cases)\n  case (1 blkss sts)\n  then show ?case by auto\nnext\n  case (2 i blkss sts pblks)\n  have \"i = 0\"  \n    using 2 by (auto simp add: less_Suc_eq)\n  show ?case\n    apply (rule exI[where x=pblks])\n    using 2 \\<open>i = 0\\<close> by (auto simp add: remove_one_def)\nnext\n  case (3 i blkss j c v pblks)\n  then show ?case by (auto simp add: less_Suc_eq)\nnext\n  case (4 i blkss t sts pblks)\n  have 40: \"i = 0\"\n    using 4  by (auto simp add: less_Suc_eq)\n  then have 41: \"t = d\"\n    using 4 by auto\n  then have 11: \"dly \\<ge> d\"\n    using 4 by auto\n  have 42: \"(wait_block_state_list sts t blkss) = [p d, sr]\"\n    using 4 41 by auto\n  have 43: \"remove_one i t blkss = [blks1, wait_block d (InBlock dly ch x r rdy) # blks2]\"\n    using 4(2) 41 40 unfolding remove_one_def Let_def by auto\n  have 44: \"(\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> t then wait_block_state_list sts d blkss else undefined)\n          = (\\<lambda>t\\<in>{0..d}. [p t, sr])\" \n    using 41 4(1, 2) 11 by auto\n  show ?case\n    apply (rule exI[where x=pblks])\n    using 44 4 \\<open>i = 0\\<close> \\<open>t = d\\<close> 42 43 11 by auto\n qed\n\n\nlemma combine_blocks_OutNil:\n  \"combine_blocks sts [OutBlock d1 ch1 v ({ch1}, {}) # blks1, []] par_tr \\<Longrightarrow> False\"\n  apply (induct rule: combine_blocks.cases)\n  by (auto simp add: less_Suc_eq)\n\nlemma combine_blocks_NilIn:\n  \"combine_blocks sts  [[], InBlock d2 ch2 var v2 ({}, {ch2}) # blks2] par_tr \\<Longrightarrow> False\"\n  apply (induct rule: combine_blocks.cases)\n  by (auto simp add: less_Suc_eq)\n\nlemma combine_blocks_OOutNil:\n  \"combine_blocks sts [ODEOutBlock d1 p ch1 v ({ch1}, {}) # blks1, []] par_tr \\<Longrightarrow> False\"\n  apply (induct rule: combine_blocks.cases)\n  by (auto simp add: less_Suc_eq)\n\n\n\nsubsection \\<open>More on combine_par_trace\\<close>\n\ninductive_cases combine_par_traceE: \"combine_par_trace trs par_tr\"\nthm combine_par_traceE\n\nlemma combine_par_traceE2:\n  \"combine_par_trace [Trace st1 blks1, Trace st2 blks2] par_tr \\<Longrightarrow>\n   \\<exists>par_blks. par_tr = ParTrace [st1, st2] par_blks \\<and> combine_blocks [st1, st2] [blks1, blks2] par_blks\"\n  apply (elim combine_par_traceE)\n  apply auto\n  apply (smt length_Cons less_Suc0 less_Suc_eq list.size(3) nth_Cons_0 nth_Cons_Suc nth_equalityI start_of_trace.simps)\n  by (smt length_Cons less_Suc0 less_Suc_eq list.size(3) nth_Cons_0 nth_Cons_Suc nth_equalityI start_of_trace.simps)\n\n\nsubsection \\<open>Examples\\<close>\n\ntext \\<open>Send 1\\<close>\nlemma testHL1:\n  \"Valid\n    (\\<lambda>t. t = Trace (\\<lambda>_. 0) [])\n    (Cm (Send ''ch'' (\\<lambda>_. 1)))\n    (\\<lambda>t. \\<exists>dly. t = Trace (\\<lambda>_. 0) [OutBlock dly ''ch'' 1 ({''ch''}, {})])\"\n  apply (rule Valid_send2)\n  by (auto simp add: extend_send_def)\n\ntext \\<open>Send 1, then send 2\\<close>\nlemma testHL2:\n  \"Valid\n    (\\<lambda>t. t = Trace (\\<lambda>_. 0) [])\n    (Cm (Send ''ch'' (\\<lambda>_. 1)); Cm (Send ''ch'' (\\<lambda>_. 2)))\n    (\\<lambda>t. \\<exists>dly dly2. t = Trace (\\<lambda>_. 0) [OutBlock dly ''ch'' 1 ({''ch''}, {}),\n                                       OutBlock dly2 ''ch'' 2 ({''ch''}, {})])\"\n  apply (rule Valid_seq[OF testHL1])\n  apply (rule Valid_send3)\n  by (auto simp add: extend_send_def)\n\ntext \\<open>Receive from ch\\<close>\nlemma testHL3:\n  \"Valid\n    (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) [])\n    (Cm (Receive ''ch'' X))\n    (\\<lambda>tr. \\<exists>dly v. tr = Trace (\\<lambda>_. 0) [InBlock dly ''ch'' X v ({}, {''ch''})])\"\n  apply (rule Valid_receive2)\n  by (auto simp add: extend_receive_def)\n\n\ntext \\<open>Communication\\<close>\nlemma testHL4:\n  \"ParValid\n    (\\<lambda>t. t = ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [])\n    (PProc [Cm (Send ''ch'' (\\<lambda>_. 1)), Cm (Receive ''ch'' X)])\n    (\\<lambda>t. t = ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [IOBlock 1 0 ''ch'' X 1])\"\nproof -\n  have 1: \"par_t = ParTrace [\\<lambda>_. 0, \\<lambda>_. 0] [IOBlock 1 0 ''ch'' X 1]\"\n    if tr1: \"tr1 = Trace (\\<lambda>_. 0) [OutBlock dly1 ''ch'' 1 ({''ch''}, {})]\" and\n       tr2: \"tr2 = Trace (\\<lambda>_. 0) [InBlock dly2 ''ch'' X v ({}, {''ch''})]\" and\n       rdy: \"compat_trace_pair tr1 tr2\" and\n       par_trace: \"combine_par_trace [tr1, tr2] par_t\"\n     for par_t dly1 dly2 v tr1 tr2\n  proof -\n    from par_trace[unfolded tr1 tr2] obtain par_blks where\n      1: \"par_t = ParTrace [\\<lambda>_. 0, \\<lambda>_. 0] par_blks\" and\n      2: \"combine_blocks [\\<lambda>_. 0, \\<lambda>_. 0] [\n              [OutBlock dly1 ''ch'' 1 ({''ch''}, {})],\n              [InBlock dly2 ''ch'' X v ({}, {''ch''})]] par_blks\"\n      using combine_par_traceE2 by blast\n    from 2 obtain rest where\n      3: \"dly1 = 0\" \"dly2 = 0\" \"v = 1\" \"combine_blocks [\\<lambda>_. 0, (\\<lambda>_. 0)(X:=1)] [[], []] rest\"\n         \"par_blks = (IOBlock 1 0 ''ch'' X 1) # rest\"\n      using combine_blocks_IO2[of \"[\\<lambda>_. 0, \\<lambda>_. 0]\" dly1 \"''ch''\" 1 \"({''ch''}, {})\" \"[]\"\n                                  dly2 \"''ch''\" X v \"({}, {''ch''})\" \"[]\" par_blks]\n      by auto\n    from 3(4) have 4: \"rest = []\"\n      using combine_blocks_triv2 by auto\n    show ?thesis\n      using 1 unfolding 3(5) 4 by auto\n  qed\n  show ?thesis\n    apply (rule Valid_parallel2'[OF _ _ testHL1 testHL3])\n    using 1 by blast+\nqed\n\ntext \\<open>Delay followed by receive\\<close>\nlemma testHL5:\n  \"Valid\n    (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) [])\n    (Wait 2; Cm (Receive ''ch'' X))\n    (\\<lambda>tr. \\<exists>dly v. tr = Trace (\\<lambda>_. 0) [WaitBlock 2, InBlock dly ''ch'' X v ({}, {''ch''})])\"\n  apply (rule Valid_seq)\n   apply (rule Valid_wait)\n  apply (rule Valid_receive2)\n  by (auto simp add: extend_receive_def)\n\ntext \\<open>Delay followed by communication\\<close>\nlemma testHL6:\n  \"ParValid\n    (\\<lambda>t. t = ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [])\n    (PProc [Cm (Send ''ch'' (\\<lambda>_. 1)), Wait 2; Cm (Receive ''ch'' X)])\n    (\\<lambda>t. t = ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] \n        [ParWaitBlock 2 (\\<lambda>t. if 0 \\<le> t \\<and> t \\<le> 2 then [(\\<lambda>_. 0), (\\<lambda>_. 0)] else undefined), IOBlock 1 0 ''ch'' X 1])\"\nproof -\n  let ?HH = \"(\\<lambda>t. if 0 \\<le> t \\<and> t \\<le> 2 then [(\\<lambda>_. 0), (\\<lambda>_. 0)] else undefined)\"\n  let ?sts = \"[(\\<lambda>_. 0), (\\<lambda>_. 0)]\"\n  have 1: \"par_t = ParTrace [\\<lambda>_. 0, \\<lambda>_. 0] [ParWaitBlock 2 ?HH, IOBlock 1 0 ''ch'' X 1]\"\n    if tr1: \"tr1 = Trace (\\<lambda>_. 0) [OutBlock dly1 ''ch'' 1 ({''ch''}, {})]\" and\n       tr2: \"tr2 = Trace (\\<lambda>_. 0) [WaitBlock 2, InBlock dly2 ''ch'' X v ({}, {''ch''})]\" and\n       rdy: \"compat_trace_pair tr1 tr2\" and\n       par_trace: \"combine_par_trace [tr1, tr2] par_t\"\n     for par_t dly1 dly2 v tr1 tr2\n  proof -\n    from par_trace[unfolded tr1 tr2] obtain par_blks where\n      1: \"par_t = ParTrace [\\<lambda>_. 0, \\<lambda>_. 0] par_blks\" and\n      2: \"combine_blocks ?sts [[OutBlock dly1 ''ch'' 1 ({''ch''}, {})],\n                          [WaitBlock 2, InBlock dly2 ''ch'' X v ({}, {''ch''})]] par_blks\"\n      using combine_par_traceE2 by blast\n    have 22: \"(\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 2 then sts_init else undefined) = \n          (\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 2 then [(\\<lambda>_. 0), (\\<lambda>_. 0)] else undefined)\"\n      by auto\n    from 2 22 obtain rest where\n      3: \"dly1 \\<ge> 2\"\n      \"combine_blocks ?sts [[OutBlock (dly1 - 2) ''ch'' 1 ({''ch''}, {})],\n                       [InBlock dly2 ''ch'' X v ({}, {''ch''})]] rest\"\n      \"par_blks = ParWaitBlock 2 ?HH # rest\"\n      using combine_blocks_OutW2[of dly1 \"''ch''\" 1 \"[]\" 2 \"[InBlock dly2 ''ch'' X v ({}, {''ch''})]\" par_blks]\n      by auto \n    from 3 obtain rest2 where\n      4: \"dly1 - 2 = 0\" \"dly2 = 0\" \"v = 1\" \"combine_blocks [\\<lambda>_. 0, (\\<lambda>_. 0)(X:=1)] [[], []] rest2\"\n         \"rest = (IOBlock 1 0 ''ch'' X 1) # rest2\"\n      using combine_blocks_IO2[of ?sts \"dly1-2\" \"''ch''\" 1 \"({''ch''}, {})\" \"[]\" dly2 \"''ch''\" X v \"({}, {''ch''})\" \"[]\" rest] \n      by auto\n    from 4(4) have 5: \"rest2 = []\"\n      using combine_blocks_triv2 by auto\n    show ?thesis\n      using 1 unfolding 3(3) 4(5) 5 by auto\n  qed\n  show ?thesis\n    apply (rule Valid_parallel2'[OF _ _ testHL1 testHL5])\n    using 1 by blast+\nqed\n\n\ntext \\<open>Repetition: count up and send\\<close>\n\ntext \\<open>Auxiliary definition for invariant.\n  n is the starting value of x (needed for induction to work)\n  dlys is the list of delay times between send events.\n\n  Intended invariant is: \\<exists>dlys. tr = Trace (\\<lambda>_. 0) (count_blocks 0 dlys).\\<close>\nfun count_blocks :: \"real \\<Rightarrow> real list \\<Rightarrow> trace_block list\" where\n  \"count_blocks n [] = []\"\n| \"count_blocks n (dly # rest) =\n     TauBlock ((\\<lambda>_. 0)(X := n + 1)) # OutBlock dly ''ch'' (n + 1) ({''ch''}, {}) #\n     count_blocks (n + 1) rest\"\n\nlemma end_count_blocks:\n  \"end_of_blocks ((\\<lambda>_. 0)(X := n)) (count_blocks n dlys) = (\\<lambda>_. 0)(X := n + length dlys)\"\n  apply (induct dlys arbitrary: n)\n  by auto\n\nlemma end_count_blocks_init:\n  \"end_of_blocks (\\<lambda>_. 0) (count_blocks 0 dlys) = (\\<lambda>_. 0)(X := length dlys)\"\nproof -\n  have 1: \"(\\<lambda>_. 0) = (\\<lambda>_. 0)(X := 0)\"\n    by auto\n  show ?thesis\n    apply (subst 1)\n    apply (subst end_count_blocks)\n    by auto\nqed\n\nlemma count_blocks_snoc:\n  \"count_blocks n (dlys @ [l]) = \n   count_blocks n dlys @ [\n     TauBlock ((\\<lambda>_. 0)(X := n + length dlys + 1)),\n     OutBlock l ''ch'' (n + length dlys + 1) ({''ch''}, {})]\"\n  apply (induct dlys arbitrary: n)\n  by auto\n\nlemma testHL7:\n  \"Valid\n    (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) [])\n    (Rep (Assign X (\\<lambda>s. s X + 1); Cm (Send ''ch'' (\\<lambda>s. s X))))\n    (\\<lambda>tr. \\<exists>dlys. tr = Trace (\\<lambda>_. 0) (count_blocks 0 dlys))\"\nproof -\n  have 1: \"Valid\n             (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) (count_blocks 0 dlys))\n             (X ::= (\\<lambda>s. s X + 1))\n             (\\<lambda>tr. \\<exists>dlys. tr = Trace (\\<lambda>_. 0) (count_blocks 0 dlys @ [TauBlock (\\<lambda>x. real (((\\<lambda>_. 0)(X := length dlys + 1)) x))]))\" for dlys\n    apply (rule Valid_assign2)\n    apply (rule exI[where x=dlys])\n    by (auto simp add: end_count_blocks_init count_blocks_snoc)\n  have 2: \"Valid\n             (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) (count_blocks 0 dlys @ [TauBlock (\\<lambda>x. real (((\\<lambda>_. 0)(X := length dlys + 1)) x))]))\n             (Cm (''ch''[!](\\<lambda>s. s X)))\n             (\\<lambda>tr. \\<exists>dlys. tr = Trace (\\<lambda>_. 0) (count_blocks 0 dlys))\" for dlys\n    apply (rule Valid_send2)\n    apply auto\n    subgoal for dly\n      apply (rule exI[where x=\"dlys @ [dly]\"])\n      by (auto simp add: extend_send_def end_count_blocks_init count_blocks_snoc end_of_blocks_append)\n    done\n  have 3: \"Valid\n    (\\<lambda>tr. \\<exists>dlys. tr = Trace (\\<lambda>_. 0) (count_blocks 0 dlys))\n    (Rep (Assign X (\\<lambda>s. s X + 1); Cm (Send ''ch'' (\\<lambda>s. s X))))\n    (\\<lambda>tr. \\<exists>dlys. tr = Trace (\\<lambda>_. 0) (count_blocks 0 dlys))\"\n    apply (rule Valid_rep)\n    apply (rule Valid_seq[where Q=\"\\<lambda>tr. \\<exists>dlys. tr = Trace (\\<lambda>_. 0) (count_blocks 0 dlys @ [TauBlock ((\\<lambda>_. 0)(X := length dlys + 1))])\"])\n    using 1 2 by (auto simp add: Valid_ex_pre)\n  show ?thesis\n    apply (rule Valid_pre[OF _ 3])\n    apply auto\n    apply (rule exI[where x=\"[]\"])\n    by auto\nqed\n\n\ntext \\<open>Repetition: receive\\<close>\n\ntext \\<open>Auxiliary definition for invariant.\n  dly is the delay of each receive.\n  v is the value of each receive.\n\n  Intended invariant is: \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (receive_blocks dlyvs).\\<close>\nfun receive_blocks :: \"(time \\<times> real) list \\<Rightarrow> trace_block list\" where\n  \"receive_blocks [] = []\"\n| \"receive_blocks ((dly, v) # rest) = InBlock dly ''ch'' X v ({}, {''ch''}) # receive_blocks rest\"\n\nlemma receive_blocks_snoc:\n  \"receive_blocks (dlyvs @ [(dly, v)]) = receive_blocks dlyvs @ [InBlock dly ''ch'' X v ({}, {''ch''})]\"\n  apply (induct dlyvs) by auto\n\nlemma testHL8:\n  \"Valid\n    (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) [])\n    (Rep (Cm (Receive ''ch'' X)))\n    (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (receive_blocks dlyvs))\"\nproof -\n  have 1: \"Valid\n             (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (receive_blocks dlyvs))\n             (Rep (Cm (''ch''[?]X)))\n             (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (receive_blocks dlyvs))\"\n    apply (rule Valid_rep)\n    apply (subst Valid_ex_pre)\n    apply auto\n    subgoal for dlyvs\n      apply (rule Valid_receive2)\n      apply auto\n      subgoal for dly v\n        apply (rule exI[where x=\"dlyvs @ [(dly, v)]\"])\n        by (auto simp add: extend_receive_def receive_blocks_snoc)\n      done\n    done\n  show ?thesis\n    apply (rule Valid_pre[OF _ 1])\n    apply auto\n    apply (rule exI[where x=\"[]\"])\n    by auto\nqed\n\n\ntext \\<open>Repetition: communication\\<close>\n\ntext \\<open>The invariant\\<close>\nfun comm_blocks :: \"real \\<Rightarrow> nat \\<Rightarrow> par_block list\" where\n  \"comm_blocks x 0 = []\"\n| \"comm_blocks x (Suc n) = (ParTauBlock 0 ((\\<lambda>_. 0)(X := (x+1)))) # IOBlock 1 0 ''ch'' X (x + 1) # comm_blocks (x + 1) n\"\n\nlemma testHL9_blocks:\n  \"combine_blocks sts[count_blocks x dlys, receive_blocks dlyvs] par_blks \\<Longrightarrow>\n   \\<exists>n. par_blks = comm_blocks x n\"\nproof (induct dlyvs arbitrary: dlys par_blks x sts)\n  case Nil\n  note Nil1 = Nil\n  then show ?case\n  proof (cases dlys)\n    case Nil\n    show ?thesis\n      apply (rule exI[where x=0])\n      using Nil1[unfolded Nil] combine_blocks_triv2 by auto \n  next\n    case (Cons d restd)\n    then show ?thesis\n      using Nil1 apply auto\n      using combine_blocks_TauNil2[of sts \"((\\<lambda>_. 0)(X := x + 1))\" \"OutBlock d ''ch'' (x + 1) ({''ch''}, {}) # count_blocks (x + 1) restd\" \"par_blks\"] \n            combine_blocks_OutNil[of \"(sts[0 := (\\<lambda>_. 0)(X := x + 1)])\" d \"''ch''\" \"x+1\" \" count_blocks (x + 1) restd\"]\n      by metis\n  qed\nnext\n  case (Cons p dlyvs)\n  note Cons1 = Cons\n  then show ?case\n  proof (cases dlys)\n    case Nil\n    then show ?thesis\n      using Cons1 apply (cases p) apply auto\n      using combine_blocks_NilIn\n    by metis\n  next\n    case (Cons d restd)\n    have 1: \"combine_blocks sts\n        [TauBlock ((\\<lambda>_. 0)(X := x + 1)) # OutBlock d ''ch'' (x + 1) ({''ch''}, {}) # count_blocks (x + 1) restd,\n         InBlock (fst p) ''ch'' X (snd p) ({}, {''ch''}) # receive_blocks dlyvs]\n        par_blks\"\n      using Cons Cons1(2) apply (cases p) by auto \n    have 2: \"event_of_block (InBlock (fst p) ''ch'' X (snd p) ({}, {''ch''})) \\<noteq> Tau\"\n      by auto\n    from 1 2 obtain rest where\n      3: \"combine_blocks (sts[0 := (\\<lambda>_. 0)(X := x + 1)]) [OutBlock d ''ch'' (x + 1) ({''ch''}, {}) # count_blocks (x + 1) restd,\n                          InBlock (fst p) ''ch'' X (snd p) ({}, {''ch''}) # receive_blocks dlyvs] rest\"\n         \"par_blks = ParTauBlock 0 ((\\<lambda>_. 0)(X := x + 1)) # rest\"\n      using combine_blocks_TauIn2 by blast\n    let ?sts0 = \"sts[0 := (\\<lambda>_. 0)(X := x + 1)]\" and\n        ?sts1 = \"(sts[0 := (\\<lambda>_. 0)(X := x + 1)])[1 := (sts!1)(X := x + 1)]\"\n    from 3 have \"snd p = x + 1\"\n      using combine_blocks_IO2[of ?sts0 d \"''ch''\" \"x+1\" \"({''ch''}, {})\" \"count_blocks (x + 1) restd\"\n                   \"fst p\" \"''ch''\" X \"snd p\" \"({}, {''ch''})\" \"receive_blocks dlyvs\" rest]\n      by auto\n    then have 31:\"(sts[0 := (\\<lambda>_. 0)(X := x + 1), 1 := end_of_blocks (sts[0 := (\\<lambda>_. 0)(X := x + 1)] ! 1) \n                 [InBlock (fst p) ''ch'' X (snd p) ({}, {''ch''})]])\n          = ?sts1\"\n      by auto      \n    from 3 31 obtain rest2 where\n      4: \"d = 0\" \"fst p = 0\" \"x + 1 = snd p\" \"combine_blocks ?sts1 [count_blocks (x + 1) restd, receive_blocks dlyvs] rest2\"\n         \"rest = (IOBlock 1 0 ''ch'' X (x + 1)) # rest2\"\n         \"(sts[0 := (\\<lambda>_. 0)(X := x + 1), 1 := end_of_blocks (sts[0 := (\\<lambda>_. 0)(X := x + 1)] ! 1) [InBlock (fst p) ''ch'' X (snd p) ({}, {''ch''})]])\n          = ?sts1\"\n      using combine_blocks_IO2[of ?sts0 d \"''ch''\" \"x+1\" \"({''ch''}, {})\" \"count_blocks (x + 1) restd\"\n                   \"fst p\" \"''ch''\" X \"snd p\" \"({}, {''ch''})\" \"receive_blocks dlyvs\" rest] \n      by auto\n    obtain n where 5: \"rest2 = comm_blocks (x + 1) n\"\n      using 4  Cons1  by blast\n    then have 6: \"par_blks = ParTauBlock 0 ((\\<lambda>_. 0)(X := x + 1)) # IOBlock 1 0 ''ch'' X (x + 1) # comm_blocks (x + 1) n\"\n      using 3(2) unfolding 4(5) 4(3)[symmetric] by auto\n    show ?thesis\n      apply (rule exI[where x=\"Suc n\"])\n      using 6 by auto\n  qed\nqed\n\nlemma testHL9:\n  \"ParValid\n    (\\<lambda>t. t = ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [])\n    (PProc [Rep (Assign X (\\<lambda>s. s X + 1); Cm (Send ''ch'' (\\<lambda>s. s X))),\n            Rep (Cm (Receive ''ch'' X))])\n    (\\<lambda>t. \\<exists>n. t = ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] (comm_blocks 0 n))\"\nproof -\n  have 1: \"\\<exists>n. par_t = ParTrace [\\<lambda>_. 0, \\<lambda>_. 0] (comm_blocks 0 n)\"\n    if tr1: \"tr1 = Trace (\\<lambda>_. 0) (count_blocks 0 dlys)\" and\n       tr2: \"tr2 = Trace (\\<lambda>_. 0) (receive_blocks dlyvs)\" and\n       rdy: \"compat_trace_pair tr1 tr2\" and\n       par_trace: \"combine_par_trace [tr1, tr2] par_t\"\n     for par_t dlys dlyvs tr1 tr2\n  proof -\n    from par_trace[unfolded tr1 tr2] obtain par_blks where\n      1: \"par_t = ParTrace [\\<lambda>_. 0, \\<lambda>_. 0] par_blks\" and\n      2: \"combine_blocks sts_init [count_blocks 0 dlys, receive_blocks dlyvs] par_blks\"\n      using combine_par_traceE2 sts_init_def \n      by metis\n    then obtain n where 3: \"par_blks = comm_blocks 0 n\"\n      using testHL9_blocks by blast\n    show ?thesis\n      apply (rule exI[where x=n])\n      using 1 unfolding 3 by auto\n  qed\n  show ?thesis\n    apply (rule Valid_parallel2'[OF _ _ testHL7 testHL8])\n    using 1 by blast+\nqed\n\n\ntext \\<open>External choice\\<close>\n\nlemma testHL10:\n  \"Valid\n    (\\<lambda>t. t = Trace (\\<lambda>_. 0) [])\n    (EChoice [(Send ''ch'' (\\<lambda>_. 1), Wait 1), (Send ''ch2'' (\\<lambda>_. 2), Wait 2)])\n    (\\<lambda>t. (\\<exists>dly. t = Trace (\\<lambda>_. 0) [OutBlock dly ''ch'' 1 ({''ch'', ''ch2''}, {}), WaitBlock 1]) \\<or>\n         (\\<exists>dly. t = Trace (\\<lambda>_. 0) [OutBlock dly ''ch2'' 2 ({''ch'', ''ch2''}, {}), WaitBlock 2]))\"\n  apply (rule Valid_echoice)\n  apply (auto simp add: less_Suc_eq)\n  by (auto simp add: Valid_wait2 extend_send_def)\n\ntext \\<open>External choice with communication\\<close>\n\nlemma testHL11:\n  \"ParValid\n    (\\<lambda>t. t = ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [])\n    (PProc [EChoice [(Send ''ch'' (\\<lambda>_. 1), Wait 1), (Send ''ch2'' (\\<lambda>_. 2), Wait 2)],\n            Cm (Receive ''ch'' X)])\n    (\\<lambda>t. t = ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)] [IOBlock 1 0 ''ch'' X 1, ParWaitBlock 1 (\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 1 then [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] else undefined)])\"\nproof -\n  let ?sts = \"[(\\<lambda>_. 0), (\\<lambda>_. 0)]\"\n  let ?HH = \"(\\<lambda>d. if 0 \\<le> d \\<and> d \\<le> 1 then [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] else undefined)\"\n  have 1: \"par_t = ParTrace [\\<lambda>_. 0, \\<lambda>_. 0] [IOBlock 1 0 ''ch'' X 1, ParWaitBlock 1 ?HH]\"\n    if tr1: \"tr1 = Trace (\\<lambda>_. 0) [OutBlock dly1 ''ch'' 1 ({''ch'', ''ch2''}, {}), WaitBlock 1]\" and\n       tr2: \"tr2 = Trace (\\<lambda>_. 0) [InBlock dly2 ''ch'' X v ({}, {''ch''})]\" and\n       rdy: \"compat_trace_pair tr1 tr2\" and\n       par_trace: \"combine_par_trace [tr1, tr2] par_t\"\n     for par_t dly1 dly2 v tr1 tr2\n  proof -\n    from par_trace[unfolded tr1 tr2] obtain par_blks where\n      1: \"par_t = ParTrace [\\<lambda>_. 0, \\<lambda>_. 0] par_blks\" and\n      2: \"combine_blocks [\\<lambda>_. 0, \\<lambda>_. 0] [[OutBlock dly1 ''ch'' 1 ({''ch'', ''ch2''}, {}), WaitBlock 1],\n                          [InBlock dly2 ''ch'' X v ({}, {''ch''})]] par_blks\"\n      using combine_par_traceE2 by blast\n    from 2 obtain rest where\n      3: \"dly1 = 0\" \"dly2 = 0\" \"v = 1\" \"combine_blocks [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] [[WaitBlock 1], []] rest\"\n         \"par_blks = (IOBlock 1 0 ''ch'' X 1) # rest\"\n      using combine_blocks_IO2[of \"?sts\" dly1 \"''ch''\" 1 \" ({''ch'', ''ch2''}, {})\" \"[WaitBlock 1]\" dly2 \"''ch''\" X v \"({}, {''ch''})\" \"[]\" par_blks]  \n      by auto\n    from 3(4) obtain rest2 where\n      4: \"combine_blocks [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] [[], []] rest2\" \"rest = ParWaitBlock 1 ?HH # rest2\"\n      using combine_blocks_WaitNil2 by blast\n    from 4(1) have 5: \"rest2 = []\"\n      using combine_blocks_triv2 by auto\n    show ?thesis\n      using 1 unfolding 3(5) 4(2) 5 by auto\n  qed\n  have 2: \"False\"\n    if tr1: \"tr1 = Trace (\\<lambda>_. 0) [OutBlock dly1 ''ch2'' 2 ({''ch'', ''ch2''}, {}), WaitBlock 2]\" and\n       tr2: \"tr2 = Trace (\\<lambda>_. 0) [InBlock dly2 ''ch'' X v ({}, {''ch''})]\" and\n       par_trace: \"combine_par_trace [tr1, tr2] par_t\"\n     for par_t dly1 dly2 v tr1 tr2\n  proof -\n    from par_trace[unfolded tr1 tr2] obtain par_blks where\n      1: \"par_t = ParTrace [\\<lambda>_. 0, \\<lambda>_. 0] par_blks\" and\n      2: \"combine_blocks ?sts [[OutBlock dly1 ''ch2'' 2 ({''ch'', ''ch2''}, {}), WaitBlock 2],\n                          [InBlock dly2 ''ch'' X v ({}, {''ch''})]] par_blks\"\n      using combine_par_traceE2 by blast\n    from 2 show ?thesis\n      using combine_blocks_IO2 by blast\n  qed\n  show ?thesis\n    apply (rule Valid_parallel2'[OF _ _ testHL10 testHL3])\n    using 1 2 by fastforce+\nqed\n\n\ntext \\<open>ODE with solution\\<close>\n\nlemma testHL12:\n  \"Valid\n    (\\<lambda>t. t = Trace (\\<lambda>_. 0) [])\n    (Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) (\\<lambda>s. s X < 1))\n    (\\<lambda>t. t = Trace (\\<lambda>_. 0) [ODEBlock 1 (restrict (\\<lambda>t. (\\<lambda>_. 0)(X := t)) {0..1})])\"\nproof -\n  have 1: \"ODEsol (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1))) (fun_upd (\\<lambda>_. 0) X) 1\"\n     unfolding ODEsol_def solves_ode_def has_vderiv_on_def\n     apply auto\n     apply (rule has_vector_derivative_projI)\n     by (auto simp add: state2vec_def)\n  have 2: \"local_lipschitz {- 1<..} UNIV (\\<lambda>t v. ODE2Vec (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1))) (vec2state v))\"\n  proof -\n    have eq: \"(\\<chi> a. (if a = X then \\<lambda>_. 1 else (\\<lambda>_. 0)) (($) v)) = (\\<chi> a. if a = X then 1 else 0)\" for v::vec\n      by auto\n    show ?thesis\n      unfolding fun_upd_def vec2state_def\n      apply (auto simp add: state2vec_def eq)\n      by (rule local_lipschitz_constI)\n  qed\n  show ?thesis\n    apply (rule Valid_ode_unique_solution[of 1 _ \"\\<lambda>t. (\\<lambda>_. 0)(X := t)\"])\n    using 1 2 by auto\nqed\n\n\nlemma testHL12':\n  fixes v :: real\n  assumes d1: \"v < 1\"\n      and d2: \"end_of_trace (Trace (\\<lambda>_. 0) list) = (\\<lambda>_. 0)(X := v)\"\n    shows \"Valid\n    (\\<lambda>t. t = Trace (\\<lambda>_. 0) list)\n    (Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) (\\<lambda>s. s X < 1))\n    (\\<lambda>t. t = Trace (\\<lambda>_. 0) (list@[ODEBlock (1-v) (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+v)){0..1-v})]))\"\nproof -\n  have 1: \"ODEsol (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1))) (\\<lambda>t. (\\<lambda>_. 0)(X := t + v)) (1 - v)\"\n    unfolding ODEsol_def has_vderiv_on_def\n    apply auto using d1 apply simp\n    apply (rule has_vector_derivative_projI)\n    apply (auto simp add: state2vec_def)\n    apply (rule has_vector_derivative_eq_rhs)\n    apply (auto intro!: derivative_intros)[1]\n    by auto\n  have 2: \"local_lipschitz {- 1<..} UNIV (\\<lambda>t v. ODE2Vec (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1))) (vec2state v))\"\n  proof -\n    have 1: \"(\\<chi> a. (if a = X then \\<lambda>_. 1 else (\\<lambda>_. 0)) (($) v)) = (\\<chi> a. if a = X then 1 else 0)\"\n      for v::vec\n      by auto\n    show ?thesis\n      unfolding fun_upd_def vec2state_def\n      apply (auto simp add: state2vec_def 1)\n      by (rule local_lipschitz_constI)\n  qed\n  show ?thesis\n    apply (rule Valid_ode_unique_solution[of \"1-v\" _ \"\\<lambda>t. (\\<lambda>_. 0)(X := t+v)\"])\n    using d1 d2 1 2 by auto\nqed\n\nlemma testHL12b:\n  \"Valid\n    (\\<lambda>t. t = Trace (\\<lambda>_. 0) [])\n    (Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 2), Y := (\\<lambda>s. s X)))) (\\<lambda>s. s Y < 1))\n    (\\<lambda>t. t = Trace (\\<lambda>_. 0) [ODEBlock 1 (restrict (\\<lambda>t. ((\\<lambda>_. 0)(X := 2 * t, Y := t * t))) {0..1})])\"\nproof -\n  have 1: \"ODEsol (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 2, Y := \\<lambda>s. s X))) (\\<lambda>t. (\\<lambda>_. 0)(X := 2 * t, Y := t * t)) 1\"\n    unfolding ODEsol_def has_vderiv_on_def\n    apply auto\n    apply (rule has_vector_derivative_projI)\n    apply (auto simp add: state2vec_def vars_distinct)\n    apply (rule has_vector_derivative_eq_rhs)\n      apply (auto intro!: derivative_intros)[1]\n    apply auto\n    apply (rule has_vector_derivative_eq_rhs)\n    apply (auto intro!: derivative_intros)[1]\n    by auto\n  have 2: \"local_lipschitz {- (1::real)<..} UNIV (\\<lambda>t v. ODE2Vec (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 2, Y := \\<lambda>s. s X))) (vec2state v))\"\n  proof -\n    have bounded: \"bounded_linear ((\\<lambda>(y::vec). \\<chi> a. if a = Y then y $ X else 0))\"\n      apply (rule bounded_linearI')\n      using vec_lambda_unique by fastforce+\n    show ?thesis\n      unfolding state2vec_def vec2state_def fun_upd_def ODE2Vec.simps\n      apply (rule c1_implies_local_lipschitz[where f'=\"(\\<lambda>(t,y). Blinfun(\\<lambda>y. \\<chi> a. if a = Y then y $ X else 0))\"])\n         apply (auto simp add: bounded_linear_Blinfun_apply[OF bounded])\n      subgoal premises pre for t x\n        unfolding has_derivative_def apply (auto simp add: bounded)\n        apply (rule vec_tendstoI)\n        by (auto simp add: vars_distinct)\n      done\n  qed\n  have 3: \"\\<And>t. 0 \\<le> (t::real) \\<Longrightarrow> t < 1 \\<Longrightarrow> t * t < 1\"\n    using mult_left_le_one_le by fastforce\n  show ?thesis\n    apply (rule Valid_ode_unique_solution[of 1 _ \"\\<lambda>t. ((\\<lambda>_. 0)(X := 2 * t, Y := t * t))\"])\n    using 1 2 3 by auto\nqed\n\nlemma testHL12inv:\n  \"Valid\n    (\\<lambda>t. t = Trace ((\\<lambda>_. 0)(X := 1)) [])\n    (Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>s. - s Y), Y := (\\<lambda>s. s X)))) (\\<lambda>s. s Y < 1))\n    (\\<lambda>t. \\<exists>d p. t = extend_trace (Trace ((\\<lambda>_. 0)(X := 1)) []) (ODEBlock d (restrict p {0..d})) \\<and>\n               d \\<ge> 0 \\<and> p 0 = end_of_trace (Trace ((\\<lambda>_. 0)(X := 1)) []) \\<and>\n               (\\<forall>t. 0\\<le>t \\<and> t\\<le>d \\<longrightarrow> p t X * p t X + p t Y * p t Y = p 0 X * p 0 X + p 0 Y * p 0 Y))\"\n  apply (rule Valid_ode_invariant)\n   apply (auto simp add: vec2state_def)[1]\n   apply (auto intro!: derivative_intros)[1]\n  by (auto simp add: state2vec_def vars_distinct)\n\n\ntext \\<open>Example with parallel, loop, and ODE\\<close>\n\nfun right_blocks :: \"(time \\<times> real \\<times> time) list \\<Rightarrow> trace_block list\" where\n  \"right_blocks [] = []\"\n| \"right_blocks ((dly1, v, dly2) # rest) =\n      InBlock dly1 ''ch'' X v ({}, {''ch''}) #\n      OutBlock dly2 ''ch'' (v - 1) ({''ch''}, {}) # right_blocks rest\"\n\nlemma right_blocks_snoc:\n  \"right_blocks (dlys @ [(dly1, v, dly2)]) =\n   right_blocks dlys @ [\n      InBlock dly1 ''ch'' X v ({}, {''ch''}),\n      OutBlock dly2 ''ch'' (v - 1) ({''ch''}, {})]\"\n  by (induct dlys, auto)\n\nlemma end_of_right_blocks:\n  \"end_of_blocks ((\\<lambda>_. 0)(X := a)) (right_blocks dlyvs @ [InBlock dly1 ''ch'' X v ({}, {''ch''})]) X = v\"\n  by (induction dlyvs arbitrary: a, auto)\n\nlemma end_of_right_blocks_zero:\n  \"end_of_blocks (\\<lambda>_. 0) (right_blocks dlyvs @ [InBlock dly1 ''ch'' X v ({}, {''ch''})]) X = v\"\nproof -\n  have 1: \"(\\<lambda>_. 0) = ((\\<lambda>_. 0)(X := 0))\"\n    by auto\n  show ?thesis\n    apply (subst 1)\n    by (auto simp add: end_of_right_blocks)\nqed\n\nlemma testHL13b:\n  \"Valid\n    (\\<lambda>tr. tr = Trace ((\\<lambda>_. 0)(X := 1)) [])\n    (Rep (Cm (Receive ''ch'' X); Cm (Send ''ch'' (\\<lambda>s. s X - 1))))\n    (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (right_blocks dlyvs))\"\nproof -\n  have 1: \"Valid\n     (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (right_blocks dlyvs))\n     (Cm (''ch''[?]X))\n     (\\<lambda>tr. \\<exists>dlyvs dly1 v. tr = Trace ((\\<lambda>_. 0)(X := 1)) (right_blocks dlyvs @ [InBlock dly1 ''ch'' X v ({}, {''ch''})]))\"\n    apply (subst Valid_ex_pre)\n    apply auto\n    apply (rule Valid_receive2)\n    by (auto simp add: extend_receive_def)\n  have 2: \"Valid\n     (\\<lambda>tr. \\<exists>dlyvs dly1 v. tr = Trace ((\\<lambda>_. 0)(X := 1)) (right_blocks dlyvs @ [InBlock dly1 ''ch'' X v ({}, {''ch''})]))\n     (Cm (''ch''[!](\\<lambda>s. s X - 1)))\n     (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (right_blocks dlyvs))\"\n    apply (simp only: Valid_ex_pre)\n    apply auto\n    apply (rule Valid_send2)\n    apply (auto simp add: extend_send_def end_of_right_blocks_zero)\n    subgoal for dlyvs dly1 v dly2\n      apply (rule exI[where x=\"dlyvs @ [(dly1, v, dly2)]\"])\n      by (simp add: end_of_right_blocks right_blocks_snoc)\n      done\n  have 3: \"Valid\n    (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (right_blocks dlyvs))\n    (Rep (Cm (Receive ''ch'' X); Cm (Send ''ch'' (\\<lambda>s. s X - 1))))\n    (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (right_blocks dlyvs))\"\n    apply (rule Valid_rep)\n    apply (rule Valid_seq[where Q=\"\\<lambda>tr. \\<exists>dlyvs dly1 v. tr = Trace ((\\<lambda>_. 0)(X := 1)) (right_blocks dlyvs @ [InBlock dly1 ''ch'' X v ({}, {''ch''})])\"])\n    using 1 2 by auto\n  show ?thesis\n    apply (rule Valid_pre[OF _ 3])\n    apply auto\n    apply (rule exI[where x=\"[]\"])\n    by auto\nqed\n\nfun left_blocks :: \"real \\<Rightarrow> (time \\<times> real \\<times> time) list \\<Rightarrow> trace_block list\" where\n  \"left_blocks x [] = []\"\n| \"left_blocks x ((dly1, v, dly2) # rest) =\n    (if x < 1 then\n       ODEBlock (1-x) (restrict (\\<lambda>t. (\\<lambda>_. 0)(X := t+x)){0..1-x}) #\n       OutBlock dly1 ''ch'' 1 ({''ch''}, {}) # \n       InBlock dly2 ''ch'' X v ({}, {''ch''}) # left_blocks v rest \n     else\n       ODEBlock 0 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := x)){0..0}) #\n       OutBlock dly1 ''ch'' x ({''ch''}, {}) # \n       InBlock dly2 ''ch'' X v ({}, {''ch''}) # left_blocks v rest)\"\n\nlemma left_blocks_snoc: \n  assumes \"length dlys > 0\"\n      and \"x = fst(snd(last dlys))\"\n    shows \"left_blocks n (dlys @ [(dly1, v, dly2)]) =\n           left_blocks n dlys @ (\n             if x < 1 then\n               [ODEBlock (1-x) (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+x)){0..1-x}),\n                OutBlock dly1 ''ch'' 1 ({''ch''}, {}), \n                InBlock dly2 ''ch'' X v ({}, {''ch''})]\n             else\n               [ODEBlock 0 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := x)){0..0}),\n                OutBlock dly1 ''ch'' x ({''ch''}, {}), \n                InBlock dly2 ''ch'' X v ({}, {''ch''})])\"\n  using assms apply (induct dlys arbitrary: n)\n  by auto\n\nlemma end_left_blocks:\n  \"end_of_blocks ((\\<lambda>_. 0)(X := v)) (left_blocks v dlys) =\n    (if length dlys = 0 then (\\<lambda>_. 0)(X := v) else (\\<lambda>_. 0)(X := fst (snd (last dlys))))\" \n  apply (induct dlys arbitrary: v) by auto\n\nlemma end_left_blocks_init:\n  \"end_of_blocks (\\<lambda>_. 0) (left_blocks 0 dlys) =\n    (if length dlys = 0 then (\\<lambda>_. 0)(X := 0) else (\\<lambda>_. 0)(X := fst (snd (last dlys))))\"\nproof -\n  have 1: \"(\\<lambda>_. 0) = (\\<lambda>_. 0)(X := 0)\"\n    by auto\n  show ?thesis\n    apply (subst 1)\n    apply (subst end_left_blocks)\n    by auto\nqed\n\nlemma end_left_blocks_1:\n  \"end_of_blocks ((\\<lambda>_. 0)(X := v)) ((left_blocks v dlys) @ [ODEBlock d (restrict p {0..d})]) =\n     restrict p {0..d} d\" \n  apply (induct dlys arbitrary: v)\n  by auto\n\nlemma end_left_blocks_1_init:\n  \"end_of_blocks ((\\<lambda>_. 0)) ((left_blocks 0 dlys) @ [ODEBlock d (restrict p {0..d})]) =\n     restrict p {0..d} d\" \nproof-  \n  have 1: \"(\\<lambda>_. 0) = (\\<lambda>_. 0)(X := 0)\"\n    by auto\n  show ?thesis\n    apply (subst 1)\n    apply (subst end_left_blocks_1)\n    by auto\nqed\n\nlemma testHL13a:\n  \"Valid\n    (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) [])\n    (Rep ((Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) (\\<lambda>s. s X < 1); Cm (Send ''ch'' (\\<lambda>s. s X )));Cm (Receive ''ch'' X)))\n    (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (left_blocks  0 dlyvs))\"\nproof -\n  have main: \"Valid\n    (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\n    (Rep ((Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) (\\<lambda>s. s X < 1); Cm (Send ''ch'' (\\<lambda>s. s X )));Cm (Receive ''ch'' X)))\n    (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\"\n    apply (rule Valid_rep)\n    apply (subst Valid_ex_pre)\n    apply auto\n    subgoal for dlyvs\n    proof cases\n      assume c1: \"length dlyvs = 0\"\n      have 1: \"left_blocks 0 dlyvs = []\"\n        using end_left_blocks_init c1 by auto\n      have 2: \"Valid\n                (\\<lambda>t. t = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\n                (Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) (\\<lambda>s. s X < 1))\n                (\\<lambda>t. t = Trace (\\<lambda>_. 0) [ODEBlock 1 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..1})])\"\n        using testHL12 1 by auto\n      have 3: \"Valid\n                (\\<lambda>t. t = Trace (\\<lambda>_. 0) [ODEBlock 1 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..1})])\n                (Cm (Send ''ch'' (\\<lambda>s. s X )))\n                (\\<lambda>t. \\<exists>dly1. t = Trace (\\<lambda>_. 0) [ODEBlock 1 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..1}),\n                                               OutBlock dly1 ''ch'' 1 ({''ch''}, {})])\"\n        apply (rule Valid_send2)\n        unfolding extend_send_def by auto\n      have 4: \"Valid\n                 (\\<lambda>t. \\<exists>dly1. t = Trace (\\<lambda>_. 0) [ODEBlock 1 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..1}),\n                                                OutBlock dly1 ''ch'' 1 ({''ch''}, {})])\n                 (Cm (Receive ''ch'' X))\n                 (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\"\n        apply(simp only: Valid_ex_pre)\n        apply auto\n        subgoal for dly1\n          apply(rule Valid_receive2)\n          apply auto\n          subgoal for dly v\n            apply(rule exI[where x=\"[(dly1,v,dly)]\"])\n            unfolding extend_receive_def \n            by auto\n          done\n        done\n      show ?thesis \n        using 2 3 4 by (auto intro: Valid_seq)\n    next\n      assume c2: \"length dlyvs \\<noteq> 0\"\n      obtain v where ini: \"v=fst (snd (last dlyvs))\" by auto\n      have 1: \"end_of_trace (Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs)) = (\\<lambda>_. 0)(X := v)\"\n        using end_left_blocks_init c2 ini by auto\n      have 2: \"Valid\n                (\\<lambda>t. t = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\n                (Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) (\\<lambda>s. s X < 1))\n                (\\<lambda>t. t = Trace (\\<lambda>_. 0) ((left_blocks 0 dlyvs)@[ODEBlock  (1-v) (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+v)){0..1-v})]))\" \n        if cond1:\"v<1\"\n        using testHL12' cond1 ini end_left_blocks_init c2 by auto\n      have 3: \"Valid\n                (\\<lambda>t. t = Trace (\\<lambda>_. 0) ((left_blocks 0 dlyvs)@[ODEBlock  (1-v) (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+v)){0..1-v})]))\n                (Cm (Send ''ch'' (\\<lambda>s. s X )))\n                (\\<lambda>t. \\<exists>dly1. t = Trace (\\<lambda>_. 0) ((left_blocks 0 dlyvs)@[ODEBlock (1-v) (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+v)){0..1-v}),\n                                                                      OutBlock dly1 ''ch'' 1 ({''ch''}, {})]))\"\n        if cond1:\"v<1\"\n        apply(rule Valid_send2)\n        apply auto\n        subgoal for dly\n          apply(rule exI[where x=\"dly\"])\n          unfolding extend_send_def apply auto\n          using cond1 end_left_blocks_1_init by auto\n        done\n      have 4: \"Valid\n              (\\<lambda>t. \\<exists>dly1. t = Trace (\\<lambda>_. 0) ((left_blocks 0 dlyvs)@[ODEBlock  (1-v) (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+v)){0..1-v}),OutBlock dly1 ''ch'' 1 ({''ch''}, {})]))\n              (Cm (Receive ''ch'' X))\n              (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\" \n        if cond1:\"v<1\"\n        apply(simp only:Valid_ex_pre)\n        apply auto\n        subgoal for dly1\n          apply(rule Valid_receive2)\n          apply auto\n          subgoal for dly va \n            apply(rule exI[where x= \"dlyvs @ [(dly1,va,dly)]\"])\n            using c2 ini cond1 left_blocks_snoc[of dlyvs v 0 dly1 va dly]\n            unfolding extend_receive_def by auto\n          done\n        done\n      have 5: \"Valid (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\n                ((Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1)))\n                (\\<lambda>s. s X < 1); Cm (''ch''[!](\\<lambda>s. s X))); Cm (''ch''[?]X))\n                (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\" \n        if cond1:\"v<1\"\n        using 2 3 4 cond1 by (auto intro: Valid_seq)\n     have 6: \"Valid\n               (\\<lambda>t. t = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\n               (Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) (\\<lambda>s. s X < 1))\n               (\\<lambda>t. t = Trace (\\<lambda>_. 0) ((left_blocks 0 dlyvs)@[ODEBlock 0 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := v)){0..0})]))\" \n       if cond2:\"v\\<ge>1\"\n       apply(rule Valid_ode_solution3) \n       using cond2 ini end_left_blocks_init c2 by auto\n     have 7: \"Valid\n               (\\<lambda>t. t = Trace (\\<lambda>_. 0) ((left_blocks 0 dlyvs)@[ODEBlock  0 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := v)){0..0})]))\n               (Cm (Send ''ch'' (\\<lambda>s. s X )))\n               (\\<lambda>t. \\<exists>dly1. t = Trace (\\<lambda>_. 0) ((left_blocks 0 dlyvs)@[ODEBlock 0 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := v)){0..0}),\n                                                                     OutBlock dly1 ''ch'' v ({''ch''}, {})]))\"\n       if cond2:\"v\\<ge>1\"\n       apply(rule Valid_send2)\n       apply auto\n       subgoal for dly\n         apply(rule exI[where x=\"dly\"])\n         unfolding extend_send_def apply auto\n         using cond2 end_left_blocks_1_init[of dlyvs 0 \"(\\<lambda>t\\<in>{0}. (\\<lambda>_. 0)(X := v))\"] by auto\n       done\n     have 8: \"Valid\n               (\\<lambda>t. \\<exists>dly1. t = Trace (\\<lambda>_. 0) ((left_blocks 0 dlyvs)@[ODEBlock 0 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := v)){0..0}),\n                                                                 OutBlock dly1 ''ch'' v ({''ch''}, {})]))\n               (Cm (Receive ''ch'' X))\n               (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\" \n        if cond2:\"v\\<ge>1\"\n        apply(simp only:Valid_ex_pre)\n        apply auto\n        subgoal for dly1\n          apply(rule Valid_receive2)\n          apply auto\n          subgoal for dly va \n            apply(rule exI[where x=\"dlyvs @ [(dly1,va,dly)]\"])\n            using c2 ini cond2 left_blocks_snoc[of dlyvs v 0 dly1 va dly]\n            unfolding extend_receive_def by auto\n          done\n        done\n     have 9: \"Valid (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\n               ((Cont (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1)))\n               (\\<lambda>s. s X < 1); Cm (''ch''[!](\\<lambda>s. s X))); Cm (''ch''[?]X))\n               (\\<lambda>tr. \\<exists>dlyvs. tr = Trace (\\<lambda>_. 0) (left_blocks 0 dlyvs))\" \n       if cond2:\"v\\<ge>1\"\n       using 6 7 8 cond2 by (auto intro: Valid_seq)\n      show ?thesis\n        using 5 9 by linarith\n    qed\n    done\n  show ?thesis\n    apply (rule Valid_pre[OF _ main])\n    apply auto\n    apply (rule exI[where x=\"[]\"])\n    by auto\nqed       \n\n\nfun tot_blocks :: \"nat \\<Rightarrow> par_block list\" where\n  \"tot_blocks 0 = []\"\n| \"tot_blocks (Suc n) = ParWaitBlock 1 (restrict (\\<lambda>t. [(\\<lambda>_. 0)(X := t), (\\<lambda>_. 0)(X := 1)]) {0..1::real}) \n                        # IOBlock 1 0 ''ch'' X 1 # IOBlock 0 1 ''ch'' X 0 # tot_blocks  n\"\n\nlemma testHL13_blocks:\n  \"combine_blocks [(\\<lambda>_. 0), (\\<lambda>_. 0)(X := 1)] [left_blocks 0 dlys, right_blocks dlyvs] par_blks \\<Longrightarrow>\n   \\<exists>n. par_blks = tot_blocks n\"\nproof (induct dlyvs arbitrary: dlys par_blks)\n  case Nil\n  note Nil1 = Nil\n  then show ?case\n  proof (cases dlys)\n    case Nil\n    show ?thesis \n      apply (rule exI[where x=0])\n      using Nil1[unfolded Nil]  combine_blocks_triv2 by auto\n  next\n    case (Cons a list)\n    then show ?thesis \n      using Nil1 apply auto\n      apply(cases a) apply auto\n      subgoal for aa b c\n        using combine_blocks_ODENil2 combine_blocks_OutNil by blast\n      done\n    qed\nnext\n  case (Cons a dlyvs)\n  note Cons1 = Cons\n  then show ?case\n  proof (cases dlys)\n    case Nil\n    then show ?thesis \n      using Cons1(2) apply (cases a) apply auto\n      using combine_blocks_NilIn by blast\n  next\n    case (Cons b list)\n    have 1: \"combine_blocks [(\\<lambda>_. 0), (\\<lambda>_. 0)(X := 1)]\n        [ODEBlock 1 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..1}) #\n        OutBlock (fst b) ''ch'' 1 ({''ch''}, {}) # \n        InBlock (snd(snd b)) ''ch'' X (fst(snd b)) ({}, {''ch''}) # \n        left_blocks (fst(snd b)) list,\n        InBlock (fst a) ''ch'' X (fst(snd a)) ({}, {''ch''}) #\n        OutBlock (snd(snd a)) ''ch'' ((fst(snd a)) - 1) ({''ch''}, {}) # \n        right_blocks dlyvs]\n        par_blks\"\n      using Cons Cons1(2) \n      apply auto \n      by (smt Cons.prems fst_conv left_blocks.elims list.distinct(1) list.inject restrict_ext right_blocks.elims snd_conv)      \n    have 2: \"event_of_block (InBlock (fst a) ''ch'' X (fst(snd a)) ({}, {''ch''})) \\<noteq> Tau\"\n      by auto\n    have 21: \"restrict (fun_upd (\\<lambda>_. 0) X) {0..1::real} 1 = (\\<lambda>_. 0)(X := 1)\"\n      by auto\n    have 22: \"(\\<lambda>t\\<in>{0..1}. [restrict (fun_upd (\\<lambda>_. 0) X) {0..1::real} t, (\\<lambda>_. 0)(X := 1)]) =\n              (\\<lambda>t\\<in>{0..1}. [(\\<lambda>_. 0)(X := t), (\\<lambda>_. 0)(X := 1)])\"\n      by auto \n    from 1 2 obtain rest where\n      3: \"combine_blocks [(\\<lambda>_. 0)(X := 1), (\\<lambda>_. 0)(X := 1)] [OutBlock (fst b) ''ch'' 1 ({''ch''}, {}) # \n        InBlock (snd(snd b)) ''ch'' X (fst(snd b)) ({}, {''ch''}) # \n        left_blocks (fst(snd b)) list,\n        wait_block 1 (InBlock (fst a) ''ch'' X (fst(snd a)) ({}, {''ch''})) #\n        OutBlock (snd(snd a)) ''ch'' ((fst(snd a)) - 1) ({''ch''}, {}) # \n        right_blocks dlyvs] rest\"\n         \"par_blks = ParWaitBlock 1 (restrict (\\<lambda>t. [(\\<lambda>_. 0)(X := t), (\\<lambda>_. 0)(X := 1)]) {0..1::real})  # rest\"\n      using combine_blocks_ODEIn2[of \"(\\<lambda>_. 0)\" \"(\\<lambda>_. 0)(X := 1)\" 1 \"(restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..1::real})\"\n              \"OutBlock (fst b) ''ch'' 1 ({''ch''}, {}) # InBlock (snd (snd b)) ''ch'' X (fst (snd b)) ({}, {''ch''}) # left_blocks (fst (snd b)) list\"\n              \"fst a\" \"''ch''\" X \"(fst (snd a))\" \"({}, {''ch''})\" \"OutBlock (snd (snd a)) ''ch'' (fst (snd a) - 1) ({''ch''}, {}) # right_blocks dlyvs\"\n              \"par_blks\"] 21 22 by auto\n\n    from 3(1) obtain rest1 where\n      4: \"(fst b) = 0\" \"fst a = 1\" \"(fst(snd a)) = 1\" \n         \"combine_blocks [(\\<lambda>_. 0)(X := 1), (\\<lambda>_. 0)(X := 1)] [InBlock (snd(snd b)) ''ch'' X (fst(snd b)) ({}, {''ch''}) # left_blocks (fst(snd b)) list, \n               OutBlock (snd(snd a)) ''ch'' ((fst(snd a)) - 1) ({''ch''}, {}) #right_blocks dlyvs] rest1\"\n         \"rest =  IOBlock 1 0 ''ch'' X 1 # rest1\"\n        apply simp\n        using combine_blocks_IO2 by(force)\n\n    from 4(3,4) obtain rest2 where\n      5: \"(snd (snd b)) = 0\" \"(snd (snd a)) = 0\" \"(fst (snd b)) = 0\" \"combine_blocks [(\\<lambda>_. 0)(X := 0), (\\<lambda>_. 0)(X := 1)] [left_blocks (fst(snd b)) list,right_blocks dlyvs] rest2\"\n         \"rest1 =  IOBlock 0 1 ''ch'' X 0 # rest2\"\n        using combine_blocks_IO2' by force\n\n    obtain n where 6: \"rest2 = tot_blocks n\"\n      using 5(3,4) Cons1(1)[of list rest2] \n      by (metis fun_upd_triv)\n\n    then have 7: \"par_blks = ParWaitBlock 1 (restrict (\\<lambda>t. [(\\<lambda>_. 0)(X := t), (\\<lambda>_. 0)(X := 1)]) {0..1::real})\n                   # IOBlock 1 0 ''ch'' X 1 # IOBlock 0 1 ''ch'' X 0 # tot_blocks  n\"\n      using 3(2) unfolding 4(5) 4(3)[symmetric] 5(5) by auto\n    show ?thesis\n      apply (rule exI[where x=\"Suc n\"])\n      using 7 by auto\n    qed\nqed\n\nlemma testHL13:\n  \"ParValid\n    (\\<lambda>t. t = ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)(X := 1)] [])\n    (PProc [Rep(((Cont (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) (\\<lambda>s. s X < 1);\n             Cm (Send ''ch'' (\\<lambda>s. s X)));\n             Cm (Receive ''ch'' X))),\n            Rep((Cm (Receive ''ch'' X);\n             Cm (Send ''ch'' (\\<lambda>s. s X - 1))))] )\n    (\\<lambda>t. \\<exists>n. t = ParTrace [(\\<lambda>_. 0), (\\<lambda>_. 0)(X := 1)] (tot_blocks n))\"\nproof-\n  have 1: \"\\<exists>n. par_t = ParTrace [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] (tot_blocks n)\"\n    if tr1: \"tr1 = Trace (\\<lambda>_. 0) (left_blocks 0 dlys)\" and\n       tr2: \"tr2 = Trace ((\\<lambda>_. 0)(X := 1)) (right_blocks dlyvs)\" and\n       rdy: \"compat_trace_pair tr1 tr2\" and\n       par_trace: \"combine_par_trace [tr1, tr2] par_t\"\n     for par_t dlys dlyvs tr1 tr2\n  proof -\n    from par_trace[unfolded tr1 tr2] obtain par_blks where\n      1: \"par_t = ParTrace [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] par_blks\" and\n      2: \"combine_blocks [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] [left_blocks 0 dlys, right_blocks dlyvs] par_blks\"\n      using combine_par_traceE2 by blast\n    then obtain n where 3: \"par_blks = tot_blocks n\"\n      using testHL13_blocks by blast\n    show ?thesis\n      apply (rule exI[where x=n])\n      using 1 unfolding 3 by auto\n  qed\n  show ?thesis\n    apply (rule Valid_parallel2'[OF _ _ testHL13a testHL13b]) \n    using 1 by auto\nqed\n\n\ntext \\<open>Example with interrupt, loop, and parallel\\<close>\n\ninductive ileft_blocks :: \"real \\<Rightarrow> trace_block list \\<Rightarrow> bool\" where\n  \"ileft_blocks x []\"\n| \"ileft_blocks v rest \\<Longrightarrow> dly1 \\<ge> 0 \\<Longrightarrow>\n   ileft_blocks x (ODEOutBlock dly1 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+x)){0..dly1}) ''ch'' (dly1+x) ({''ch''}, {}) #\n                   InBlock dly2 ''ch'' X v ({}, {''ch''}) # rest)\"\n\nlemma end_ileft_blocks:\n  \"ileft_blocks x blks \\<Longrightarrow>\n   \\<exists>v. end_of_blocks ((\\<lambda>_. 0)(X := x)) blks = ((\\<lambda>_. 0)(X := v))\"\nproof (induction rule: ileft_blocks.induct)\n  case (1 x)\n  then show ?case by auto\nnext\n  case (2 v rest dly1 x dly2)\n  from 2(3) obtain v2 where 3:\n    \"end_of_blocks ((\\<lambda>_. 0)(X := v)) rest = (\\<lambda>_. 0)(X := v2)\"\n    by blast\n  show ?case\n    apply (rule exI[where x=v2])\n    by (auto simp add: 3 2(2))\nqed\n\nlemma end_ileft_blocks_init:\n  assumes \"ileft_blocks 0 blks\"\n  shows \"\\<exists>v. end_of_blocks (\\<lambda>_. 0) blks = ((\\<lambda>_. 0)(X := v))\"\nproof -\n  have 1: \"(\\<lambda>_. 0) = (\\<lambda>_. 0)(X := 0)\"\n    by auto\n  show ?thesis\n    apply (subst 1) apply (rule end_ileft_blocks)\n    using assms by auto\nqed\n\nlemma ileft_blocks_snoc:\n  \"ileft_blocks x blks \\<Longrightarrow>\n   end_of_blocks ((\\<lambda>_. 0)(X := x)) blks = ((\\<lambda>_. 0)(X := v)) \\<Longrightarrow> dly1 \\<ge> 0 \\<Longrightarrow>\n   ileft_blocks x (blks @ [ODEOutBlock dly1 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+v)){0..dly1}) ''ch'' (dly1+v) ({''ch''}, {}),\n      InBlock dly2 ''ch'' X v2 ({}, {''ch''})])\"\nproof (induction rule: ileft_blocks.induct)\n  case (1 x)\n  have \"v = x\"\n    using 1 apply simp by metis\n  show ?case\n    apply (simp only: append_Nil \\<open>v = x\\<close>)\n    by (auto intro!: ileft_blocks.intros 1(2))\nnext\n  case (2 v1 rest dly11 x1 dly21)\n  show ?case\n    thm 2\n    apply (simp only: append_Cons)\n    apply (rule ileft_blocks.intros(2)[of v1 _ dly11 x1 dly21])\n     apply (rule 2(3))\n    using 2(2,4,5) apply auto\n    by (auto simp add: fun_upd_def)\nqed\n\nlemma testHL14o:\n  assumes \"end_of_trace (Trace (\\<lambda>_. 0) list) = (\\<lambda>_. 0)(X := v)\"\n    shows \"Valid\n    (\\<lambda>t. t = Trace (\\<lambda>_. 0) list)\n    (Interrupt (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) [\n             ((Send ''ch'' (\\<lambda>s. s X)), Skip)])\n    (\\<lambda>t. \\<exists>d. t = Trace (\\<lambda>_. 0) (list@[ODEOutBlock d (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+v)){0..d}) ''ch'' (d+v) ({''ch''}, {})])\n              \\<and> d \\<ge> 0)\"\nproof -\n  have main: \"ODEOutBlock d (restrict p {0..d}) ''ch'' (p d X) ({''ch''}, {}) =\n              ODEOutBlock d (\\<lambda>t\\<in>{0..d}. (\\<lambda>_. 0)(X := t + v)) ''ch'' (d + v) ({''ch''}, {})\"\n    if pre: \"0 \\<le> d\" \"ODEsol (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1))) p d\"\n       \"p 0 = end_of_blocks (\\<lambda>_. 0) list\"\n     for p d\n  proof-\n    have 1: \"restrict p {0..d} = restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+v)){0..d}\"\n    proof -\n      interpret loc:ll_on_open_it \"{-1<..}\" \"(\\<lambda>t v. ODE2Vec (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1))) (vec2state v))\" \"UNIV\" \"0\"\n        apply standard\n        apply auto\n        subgoal proof -\n        have 1: \"(\\<chi> a. (if a = X then \\<lambda>_. 1 else (\\<lambda>_. 0)) (($) v)) = (\\<chi> a. if a = X then 1 else 0)\"\n          for v::vec\n          by auto\n        show ?thesis\n          unfolding state2vec_def vec2state_def fun_upd_def 1\n          by (rule local_lipschitz_constI)\n        qed\n        done\n      have step2: \"((\\<lambda>t. state2vec ((\\<lambda>_. 0)(X := t+v))) solves_ode ((\\<lambda>t. \\<lambda>v. ODE2Vec (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1)))(vec2state v)))) {0..} UNIV\"\n        unfolding solves_ode_def has_vderiv_on_def\n        apply auto\n        apply (rule has_vector_derivative_projI)\n        apply (auto simp add: state2vec_def)\n        apply (rule has_vector_derivative_eq_rhs)\n         apply (auto intro!: derivative_intros)[1]\n        by auto\n      have step4: \"(loc.flow 0 (state2vec ((\\<lambda>_. 0)(X := v)))) t = (\\<lambda>t. state2vec((\\<lambda>_. 0)(X := t+v))) t\" if \"t \\<in> {0..}\" for t\n        apply (rule loc.maximal_existence_flow(2)[OF step2])\n        using that by (auto simp add: state2vec_def)\n      have step5: \"((\\<lambda>t. state2vec(p t)) solves_ode ((\\<lambda>t. \\<lambda>v. ODE2Vec (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1)))(vec2state v)))) {0..d} UNIV\"\n        using pre unfolding ODEsol_def solves_ode_def by auto\n      have step6: \"loc.flow 0 (state2vec ((\\<lambda>_. 0)(X := v))) t = state2vec (p t)\" if \"t\\<in>{0..d}\" for t\n        apply (rule loc.maximal_existence_flow(2)[OF step5])\n        using assms that pre by auto\n      have step7:\"(\\<lambda>t. state2vec((\\<lambda>_. 0)(X := t+v))) t =  state2vec (p t)\" if \"t\\<in>{0..d}\" for t\n        using step4 step6 that by auto\n      then show ?thesis \n        unfolding restrict_def state2vec_def by auto\n    qed\n    show ?thesis\n      using 1 apply (auto simp add: restrict_def)\n      by (metis fun_upd_same order_refl pre(1))\n  qed\n  show ?thesis\n    apply (rule Valid_interrupt)\n    apply auto\n    apply (rule Valid_skip2)\n    using main by auto\nqed\n\nlemma testHL14a:\n  \"Valid\n    (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) [])\n    (Rep (Interrupt (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) [\n             ((Send ''ch'' (\\<lambda>s. s X)),Skip)];\n             Cm (Receive ''ch'' X)))\n    (\\<lambda>tr. \\<exists>blks. tr = Trace (\\<lambda>_. 0) blks \\<and> ileft_blocks 0 blks)\"\nproof -\n  have 1: \"Valid\n     (\\<lambda>tr. tr = Trace (\\<lambda>_. 0) blks)\n     (Interrupt (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1)))\n      [(''ch''[!](\\<lambda>s. s X), Skip)];\n      Cm (''ch''[?]X))\n     (\\<lambda>tr. \\<exists>blks. tr = Trace (\\<lambda>_. 0) blks \\<and> ileft_blocks 0 blks)\"\n    if ileft_blks: \"ileft_blocks 0 blks\" for blks\n  proof -\n    obtain v where v: \"end_of_blocks (\\<lambda>_. 0) blks = ((\\<lambda>_. 0)(X := v))\"\n      using end_ileft_blocks_init[OF ileft_blks] by blast\n    have eq: \"(\\<lambda>_. 0) = ((\\<lambda>_. 0)(X := 0))\"\n      by auto\n    have 2: \"Valid\n              (\\<lambda>t. t = Trace (\\<lambda>_. 0) blks)\n              (Interrupt (ODE ((\\<lambda>_ _. 0)(X := \\<lambda>_. 1)))[(''ch''[!](\\<lambda>s. s X), Skip)])\n              (\\<lambda>tr. \\<exists>d. tr = Trace (\\<lambda>_. 0) (blks @ [\n                ODEOutBlock d (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+v)){0..d}) ''ch'' (d+v) ({''ch''}, {})]) \\<and> d \\<ge> 0)\"\n      apply (rule testHL14o[of blks \"v\"])\n      using v by auto\n    have 3: \"Valid\n              (\\<lambda>tr. \\<exists>d. tr = Trace (\\<lambda>_. 0) (blks @ [\n                ODEOutBlock d (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t+v)){0..d}) ''ch'' (d+v) ({''ch''}, {})]) \\<and> d \\<ge> 0)\n              (Cm (Receive ''ch'' X))\n              (\\<lambda>tr. \\<exists>blks. tr = Trace (\\<lambda>_. 0) blks \\<and> (ileft_blocks 0 blks))\"\n      apply (simp only: Valid_ex_pre Valid_and_pre)\n      apply auto\n      subgoal premises pre for d\n        apply(rule Valid_receive2)\n        apply auto\n        subgoal for dly v2\n          unfolding extend_receive_def\n          apply (auto simp add: ileft_blocks_snoc)\n          apply (rule ileft_blocks_snoc[OF ileft_blks _ pre])\n            apply (subst eq[symmetric]) by (rule v)\n        done\n      done\n    show ?thesis\n      using 2 3 by (auto intro: Valid_seq)\n  qed\n  have main: \"Valid\n    (\\<lambda>tr. \\<exists>blks. tr = Trace (\\<lambda>_. 0) blks \\<and> ileft_blocks 0 blks)\n    (Rep (Interrupt (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) [\n             ((Send ''ch'' (\\<lambda>s. s X)),Skip)];\n             Cm (Receive ''ch'' X)))\n    (\\<lambda>tr. \\<exists>blks. tr = Trace (\\<lambda>_. 0) blks \\<and> ileft_blocks 0 blks)\"\n    apply (rule Valid_rep)\n    apply (simp only: Valid_ex_pre Valid_and_pre)\n    using 1 by auto\n  show ?thesis\n    apply(rule Valid_pre[OF _ main])\n    apply auto\n    by (rule ileft_blocks.intros(1))\nqed\n\nfun iright_blocks :: \"(time \\<times> real \\<times> time) list \\<Rightarrow> trace_block list\" where\n  \"iright_blocks [] = []\"\n| \"iright_blocks ((dly1, v, dly2) # rest) = WaitBlock 1 #\n      InBlock dly1 ''ch'' X v ({}, {''ch''}) #\n      OutBlock dly2 ''ch'' (v - 1) ({''ch''}, {}) # iright_blocks rest\"\n\nlemma iright_blocks_snoc:\n  \"iright_blocks (dlys @ [(dly1, v, dly2)]) =\n   iright_blocks dlys @ [ WaitBlock 1,\n      InBlock dly1 ''ch'' X v ({}, {''ch''}),\n      OutBlock dly2 ''ch'' (v - 1) ({''ch''}, {})]\"\n  by (induct dlys, auto)\n\nlemma end_of_iright_blocks:\n  \"end_of_blocks ((\\<lambda>_. 0)(X := a)) (iright_blocks dlyvs @ [WaitBlock 1,InBlock dly1 ''ch'' X v ({}, {''ch''})]) X = v\"\n  by (induction dlyvs arbitrary: a, auto)\n\nlemma end_of_iright_blocks_zero:\n  \"end_of_blocks (\\<lambda>_. 0) (iright_blocks dlyvs @ [WaitBlock 1,InBlock dly1 ''ch'' X v ({}, {''ch''})]) X = v\"\nproof -\n  have 1: \"(\\<lambda>_. 0) = ((\\<lambda>_. 0)(X := 0))\"\n    by auto\n  show ?thesis\n    apply (subst 1)\n    by (auto simp add: end_of_iright_blocks)\nqed\n\n\nlemma testHL14b:\n  \"Valid\n    (\\<lambda>tr. tr = Trace ((\\<lambda>_. 0)(X := 1)) [])\n    (Rep (Wait 1; Cm (Receive ''ch'' X); Cm (Send ''ch'' (\\<lambda>s. s X - 1))))\n    (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (iright_blocks dlyvs))\"\nproof-\n  have 1:\"Valid (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (iright_blocks dlyvs)) (Wait 1)\n     (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (iright_blocks dlyvs @ [WaitBlock 1]))\"\n    apply(simp only: Valid_ex_pre)\n    apply auto\n    subgoal for dlyvs\n      apply(rule Valid_wait2)\n      apply(rule exI[where x=\"dlyvs\"])\n      by auto\n    done\n  have 2:\"Valid \n     (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (iright_blocks dlyvs @ [WaitBlock 1])) \n     (Cm (''ch''[?]X))\n     (\\<lambda>tr. \\<exists>dlyvs dly1 v. tr = Trace ((\\<lambda>_. 0)(X := 1)) (iright_blocks dlyvs @ [WaitBlock 1, InBlock dly1 ''ch'' X v ({}, {''ch''})]))\"\n    apply(simp only:Valid_ex_pre)\n    apply auto\n    subgoal for dlyvs\n      apply(rule Valid_receive2)\n      apply auto\n      subgoal for dly v\n        apply(rule exI[where x=\"dlyvs\"])\n        apply(rule exI[where x=\"dly\"])\n        apply(rule exI[where x=\"v\"])\n        unfolding extend_receive_def\n        by auto\n      done\n    done\n  have 3:\"Valid\n     (\\<lambda>tr. \\<exists>dlyvs dly1 v. tr = Trace ((\\<lambda>_. 0)(X := 1)) (iright_blocks dlyvs @ [WaitBlock 1, InBlock dly1 ''ch'' X v ({}, {''ch''})]))\n     (Cm (''ch''[!](\\<lambda>s. s X - 1))) \n     (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (iright_blocks dlyvs))\"\n    apply(simp only:Valid_ex_pre)\n    apply auto\n    subgoal for dlyvs dly1 v\n      apply(rule Valid_send2)\n      apply auto\n      subgoal for dly\n        apply (rule exI[where x=\"dlyvs @ [(dly1, v, dly)]\"])\n        unfolding extend_send_def\n        using end_of_iright_blocks iright_blocks_snoc by auto\n      done\n    done\n  have 4:\"Valid\n    (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (iright_blocks dlyvs))\n    (Rep (Wait 1;Cm (Receive ''ch'' X); Cm (Send ''ch'' (\\<lambda>s. s X - 1))))\n    (\\<lambda>tr. \\<exists>dlyvs. tr = Trace ((\\<lambda>_. 0)(X := 1)) (iright_blocks dlyvs))\"\n    apply(rule Valid_rep)\n    using 1 2 3 by (auto intro: Valid_seq)\n  show ?thesis\n    apply (rule Valid_pre[OF _ 4])\n    apply auto\n    apply (rule exI[where x=\"[]\"])\n    by auto\nqed\n\n\nlemma testHL14_blocks:\n  \"ileft_blocks 0 blks \\<Longrightarrow>\n   combine_blocks [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] [blks, iright_blocks dlyvs] par_blks \\<Longrightarrow>\n   \\<exists>n. par_blks = tot_blocks n\"\nproof(induct dlyvs arbitrary: blks par_blks)\n  case Nil\n  from Nil(1) show ?case\n  proof (induct rule: ileft_blocks.cases)\n    case (1 x)\n    show ?case\n      apply (rule exI[where x=0])\n      using Nil(2)[unfolded 1(2)] combine_blocks_triv2 by auto\n  next\n    case (2 v rest dly1 x dly2)\n    show ?case \n      using Nil(2)[unfolded 2(2)] apply auto \n      using combine_blocks_OOutNil by blast\n  qed\nnext\n  case (Cons a dlyvs)\n  from Cons(2) show ?case\n  proof (induct rule: ileft_blocks.cases)\n    case (1 x)\n    show ?case\n      using Cons(3)[unfolded 1(2)] apply (cases a) apply auto\n      using combine_blocks_NilWait2 combine_blocks_NilIn by blast\n  next\n    case (2 v rest dly1 x dly2)\n    have 1: \"combine_blocks [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)]\n      [ODEOutBlock dly1 (restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..dly1}) ''ch'' dly1 ({''ch''}, {}) # \n       InBlock dly2 ''ch'' X v ({}, {''ch''}) # rest,\n       WaitBlock 1 #\n       InBlock (fst a) ''ch'' X (fst(snd a)) ({}, {''ch''}) #\n       OutBlock (snd(snd a)) ''ch'' ((fst(snd a)) - 1) ({''ch''}, {}) # \n       iright_blocks dlyvs]\n       par_blks\"\n      using Cons(3)[unfolded 2(2) 2(1)[symmetric]]\n      apply (cases a) by (auto simp add: fun_upd_def)\n\n    obtain rest2 where s2:\n      \"dly1 \\<ge> 1\"\n      \"combine_blocks [(restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..dly1}) 1, (\\<lambda>_. 0)(X := 1)]\n      [ODEOutBlock (dly1 - 1) ((\\<lambda>s. restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..dly1} (s + 1))) ''ch'' dly1 ({''ch''}, {}) # \n       InBlock dly2 ''ch'' X v ({}, {''ch''}) # rest,\n       InBlock (fst a) ''ch'' X (fst(snd a)) ({}, {''ch''}) #\n       OutBlock (snd(snd a)) ''ch'' ((fst(snd a)) - 1) ({''ch''}, {}) # \n       iright_blocks dlyvs]\n       rest2\"\n      \"par_blks = (ParWaitBlock 1 (\\<lambda>d. if 0\\<le>d \\<and> d\\<le>1 then [(restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..dly1}) d, (\\<lambda>_. 0)(X := 1)] else undefined)) # rest2\"\n      using combine_blocks_ODEOutW2[OF 1] by blast\n\n    from s2 have 21:\n      \"combine_blocks [(\\<lambda>_. 0)(X := 1), (\\<lambda>_. 0)(X := 1)]\n      [ODEOutBlock (dly1 - 1) ((\\<lambda>s. restrict(\\<lambda>t. (\\<lambda>_. 0)(X := t)){0..dly1} (s + 1))) ''ch'' dly1 ({''ch''}, {}) # \n       InBlock dly2 ''ch'' X v ({}, {''ch''}) # rest,\n       InBlock (fst a) ''ch'' X (fst(snd a)) ({}, {''ch''}) #\n       OutBlock (snd(snd a)) ''ch'' ((fst(snd a)) - 1) ({''ch''}, {}) # \n       iright_blocks dlyvs]\n       rest2\"\n      \"par_blks = (ParWaitBlock 1 (\\<lambda>d. if 0\\<le>d \\<and> d\\<le>1 then [(\\<lambda>_. 0)(X := d), (\\<lambda>_. 0)(X := 1)] else undefined)) # rest2\"\n      by auto\n\n    let ?sts = \"[(\\<lambda>_. 0)(X := 1), (\\<lambda>_. 0)(X := 1)]\"\n    obtain rest3 where 3:\n      \"dly1 - 1 = 0\" \"fst a = 0\" \"dly1 = fst (snd a)\"\n      \"combine_blocks (?sts[1 := end_of_blocks (?sts ! 1)\n          [InBlock (fst a) ''ch'' X (fst(snd a)) ({}, {''ch''})]])\n       [InBlock dly2 ''ch'' X v ({}, {''ch''}) # rest,\n        OutBlock (snd(snd a)) ''ch'' ((fst(snd a)) - 1) ({''ch''}, {}) # \n        iright_blocks dlyvs] rest3\"\n      \"rest2 = IOBlock 1 0 ''ch'' X dly1 # rest3\"\n      using combine_blocks_ODEIO2[OF 21(1)] by blast\n\n    from 3(4) have 31:\n      \"combine_blocks ([(\\<lambda>_. 0)(X := 1), (\\<lambda>_. 0)(X := fst (snd a))])\n       [InBlock dly2 ''ch'' X v ({}, {''ch''}) # rest,\n        OutBlock (snd(snd a)) ''ch'' ((fst(snd a)) - 1) ({''ch''}, {}) # \n        iright_blocks dlyvs] rest3\"\n      by auto\n\n    let ?sts2 = \"[(\\<lambda>_. 0)(X := 1), (\\<lambda>_. 0)(X := fst (snd a))]\"\n    from 31 obtain rest4 where 4:\n      \"dly2 = 0\" \"snd (snd a) = 0\" \"fst (snd a) - 1 = v\"\n      \"combine_blocks (?sts2[0 := end_of_blocks (?sts2 ! 0) [InBlock dly2 ''ch'' X v ({}, {''ch''})]])\n       [rest, iright_blocks dlyvs] rest4\"\n      \"rest3 = IOBlock 0 1 ''ch'' X (fst (snd a) - 1) # rest4\"\n      using combine_blocks_IO2' by blast\n\n    from 3(1) have 5: \"dly1 = 1\" \"(\\<lambda>_. 0)(X := 0) = (\\<lambda>_. 0)\" \"v = 0\"\n      by (auto simp add: 4(3)[symmetric] 3(3)[symmetric])\n\n    from 4(4) have 41:\n      \"combine_blocks [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)]\n       [rest, iright_blocks dlyvs] rest4\"\n      by (auto simp add: 4(3)[symmetric] 3(3)[symmetric] 5)\n\n    obtain n where 6: \"rest4 = tot_blocks n\"\n      using Cons(1) 41 2(3) 5(3) by blast\n\n    show ?thesis\n      apply (rule exI[where x=\"Suc n\"])\n      by (auto simp add: 21(2) 3(5) 4(5) 5 6 3(3)[symmetric])\n  qed\nqed\n\n\nlemma testHL14:\n  \"ParValid\n    (\\<lambda>t. t = ParTrace [(\\<lambda>_. 0), ((\\<lambda>_. 0)(X := 1))] [])\n    (PProc [Rep (Interrupt (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_. 1)))) [\n             ((Send ''ch'' (\\<lambda>s. s X)),Skip)];\n             Cm (Receive ''ch'' X)),\n            Rep(Wait 1;(Cm (Receive ''ch'' X);\n             Cm (Send ''ch'' (\\<lambda>s. s X - 1))))] )\n    (\\<lambda>t. \\<exists>n. t = ParTrace [(\\<lambda>_. 0), ((\\<lambda>_. 0)(X := 1))] (tot_blocks n))\"\nproof -\n  have 1: \"(\\<exists>n. par_t = ParTrace [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] (tot_blocks n))\"\n    if tr1: \"tr1 = Trace (\\<lambda>_. 0) blks1\" \"ileft_blocks 0 blks1\" and\n       tr2: \"tr2 = Trace ((\\<lambda>_. 0)(X := 1)) (iright_blocks dlyvs2)\" and\n       rdy: \"compat_trace_pair tr1 tr2\" and\n       par_trace: \"combine_par_trace [tr1, tr2] par_t\"\n     for par_t blks1 dlyvs2 tr1 tr2\n  proof -\n    from par_trace[unfolded tr1 tr2] obtain par_blks where\n      1: \"par_t = ParTrace [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] par_blks\" and\n      2: \"combine_blocks [\\<lambda>_. 0, (\\<lambda>_. 0)(X := 1)] [blks1, iright_blocks dlyvs2] par_blks\"\n      using combine_par_traceE2 by blast\n    then obtain n where 3: \"par_blks = tot_blocks n\"\n      using testHL14_blocks tr1(2) by blast\n    show ?thesis\n      apply (rule exI[where x=n])\n      using 1 unfolding 3 by auto\n  qed\n  show ?thesis\n    apply (rule Valid_parallel2'[OF _ _ testHL14a testHL14b])\n    using 1 by auto\nqed\n\n\nend\n", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/lunarlander_sl/BigStep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3334348807301059}}
{"text": "theory Execution imports\n  Main HOL.String Deduction\nbegin\n\n(* 9. (a) *)\n\nlemma \"maps_exists\":\n  assumes \"b \\<in> set (List.maps f as)\"\n  shows \"\\<exists>a \\<in> set as. b \\<in> set (f a)\"\n  using assms\n  apply (induction as)\n   apply (simp add: maps_simps(2))\n  by (metis Un_iff list.set_intros(1) list.set_intros(2) maps_simps(1) set_append)\n\nlemma \"exists_maps\":\n  assumes \"\\<exists>a \\<in> set as. b \\<in> set (f a)\"\n  shows \"b \\<in> set (List.maps f as)\"\n  using assms\n  apply (induction as)\n   apply simp\n  by (metis Un_iff maps_simps(1) set_ConsD set_append)\n\n(* successors of a constraint using Unif rule of rer1 *)\nfun c_unify :: \"constraint \\<Rightarrow> (constraint_system \\<times> m_subst) list\" where\n  \"c_unify (M | A \\<triangleright> (Var _)) = []\"\n| \"c_unify (M | A \\<triangleright> t) = List.maps (\\<lambda>u. case m_unify [(t, u)] of Some \\<sigma> \\<Rightarrow> [([], \\<sigma>)] | None \\<Rightarrow> []) (M @ A)\"\n\n(* soundness of c_unify *)\nlemma \"c_unify_rer1\":\n  assumes \"(cs, \\<sigma>) \\<in> set (c_unify (M | A \\<triangleright> t))\"\n  shows \"rer1 (M | A \\<triangleright> t) \\<sigma> cs\"\n  proof -\n    have \"not_is_var\": \"\\<not>is_var t\"\n      using assms is_var.simps\n      by auto\n    obtain u where \"u \\<in> set (M @ A)\" and \"(cs, \\<sigma>) \\<in> set (case m_unify [(t, u)] of Some \\<sigma> \\<Rightarrow> [([], \\<sigma>)] | None \\<Rightarrow> [])\"\n      using assms maps_exists\n      apply (cases t)\n      by force+\n    then show ?thesis\n      using not_is_var\n      by fastforce\n  qed\n\n(* successors of a constraint using Comp rules of rer1 *)\nfun c_comp :: \"constraint \\<Rightarrow> (constraint_system \\<times> m_subst) list\" where\n  \"c_comp (M | A \\<triangleright> Hash t) = [([M | A \\<triangleright> t], Var)]\"\n| \"c_comp (M | A \\<triangleright> Pair t1 t2) = [([M | A \\<triangleright> t1, M | A \\<triangleright> t2], Var)]\"\n| \"c_comp (M | A \\<triangleright> Sym_encrypt m k) = [([M | A \\<triangleright> m, M | A \\<triangleright> k], Var)]\"\n| \"c_comp (M | A \\<triangleright> Public_key_encrypt m k) = [([M | A \\<triangleright> m, M | A \\<triangleright> k], Var)]\"\n| \"c_comp (M | A \\<triangleright> Signature t (Cons i)) = (if i = \\<iota> then [([M | A \\<triangleright> t], Var)] else [])\"\n| \"c_comp (M | A \\<triangleright> _) = []\"\n\n(* soundness of c_comp *)\nlemma \"c_comp_rer1\":\n  assumes \"(cs, \\<sigma>) \\<in> set (c_comp (M | A \\<triangleright> t))\"\n  shows \"rer1 (M | A \\<triangleright> t) \\<sigma> cs\"\n  using assms\nproof (cases t)\n  case (Signature t k)\n  then show ?thesis\n    using assms\n    proof (cases k)\n      case (Cons i)\n      then show ?thesis\n        using Signature assms intruder_def\n        by auto\n    qed auto\n  qed force+\n\n(* helper function for Analysis rules of rer1 providing successors of analyzing one message from M *)\nfun \"c_dec_term\" :: \"constraint \\<Rightarrow> msg \\<Rightarrow> (constraint_system \\<times> m_subst) list\" where\n  \"c_dec_term (M | A \\<triangleright> t) (Pair u v) = (let M' = removeAll (Pair u v) M in [([(u # v # M') | (Pair u v # A) \\<triangleright> t], Var)])\"\n| \"c_dec_term (M | A \\<triangleright> t) (Sym_encrypt u k) = (let M' = removeAll (Sym_encrypt u k) M in [([(u # M') | (Sym_encrypt u k # A) \\<triangleright> t, M' | (Sym_encrypt u k # A) \\<triangleright> k], Var)])\"\n| \"c_dec_term (M | A \\<triangleright> t) (Public_key_encrypt u (Cons i)) = (if i = \\<iota> then let M' = removeAll (Public_key_encrypt u intruder) M in [([(u # M') | (Public_key_encrypt u intruder # A) \\<triangleright> t], Var)] else [])\"\n| \"c_dec_term (M | A \\<triangleright> t) (Public_key_encrypt u (Var x)) = (let \\<sigma> = Var(x := intruder) in [([c_sapply \\<sigma> (M | A \\<triangleright> t)], \\<sigma>)])\"\n| \"c_dec_term (M | A \\<triangleright> t) _ = []\"\n\n(* soundness of c_dec_term *)\nlemma \"c_dec_term_rer1\":\n  assumes \"(cs, \\<sigma>) \\<in> set (c_dec_term (M | A \\<triangleright> t) m)\" and \"m \\<in> set M\"\n  shows \"rer1 (M | A \\<triangleright> t) \\<sigma> cs\"\n  using assms\nproof (cases m)\n  case (Sym_encrypt m k)\n  then show ?thesis\n    using assms\n    apply auto\n    by (metis empty_set fst_conv list.set(2) rer1.Sdec singletonD snd_conv)\nnext\n  case (Public_key_encrypt u k)\n  then show ?thesis\n    using assms\n    proof (cases k)\n      case (Cons i)\n      then show ?thesis\n        using intruder_def Public_key_encrypt assms(1) assms(2)\n        by auto\n    next\n      case (Var x)\n      then show ?thesis\n        using assms Ksub Public_key_encrypt\n        by (metis c_dec_term.simps(4) Pair_inject empty_set list.set(2) singletonD)\n    qed auto\nqed auto\n\n(* successors of a constraint using Analysis rules of rer1 *)\nfun \"c_dec\" :: \"constraint \\<Rightarrow> (constraint_system \\<times> m_subst) list\" where\n  \"c_dec (M | A \\<triangleright> t) = List.maps (c_dec_term (M | A \\<triangleright> t)) M\"\n\n(* soundness of c_dec *)\nlemma \"c_dec_rer1\":\n  assumes \"(cs, \\<sigma>) \\<in> set (c_dec (M | A \\<triangleright> t))\"\n  shows \"rer1 (M | A \\<triangleright> t) \\<sigma> cs\"\nproof -\n  obtain m where \"m \\<in> set M\" and \"(cs, \\<sigma>) \\<in> set (c_dec_term (M | A \\<triangleright> t) m)\"\n    using assms maps_exists\n    by force\n  then show ?thesis\n    using c_dec_term_rer1\n    by simp\nqed\n\n(* successors of a constraint under rer1 *)\ndefinition \"c_succ\" :: \"constraint \\<Rightarrow> (constraint_system \\<times> m_subst) list\" where\n  \"c_succ c = c_unify c @ c_comp c @ c_dec c\"\n\n(* soundness of c_succ *)\nlemma \"c_succ_rer1\":\n  assumes \"(cs, \\<sigma>) \\<in> set (c_succ c)\"\n  shows \"rer1 c \\<sigma> cs\"\nproof -\n  obtain M A t where \"c = M | A \\<triangleright> t\"\n    using assms c_derives.cases by blast\n  then show ?thesis\n    using assms c_unify_rer1 c_comp_rer1 c_dec_rer1 c_succ_def by auto\nqed\n\n(* completeness of c_succ w.r.t. rer1 *)\nlemma \"c_rer1_succ\": \"rer1 c \\<sigma> cs \\<Longrightarrow> (cs, \\<sigma>) \\<in> set (c_succ c)\"\nproof (induction rule: rer1.induct)\n  case (Unif t M A \\<sigma>)\n  then obtain u where \"u \\<in> set (M @ A)\" and \"m_unify [(t, u)] = Some \\<sigma>\"\n    by auto\n  then have \"([], \\<sigma>) \\<in> set (List.maps (\\<lambda>u. case m_unify [(t, u)] of Some \\<sigma> \\<Rightarrow> [([], \\<sigma>)] | None \\<Rightarrow> []) (M @ A))\"\n    using exists_maps[of \"M @ A\" \"([], \\<sigma>)\" \"(\\<lambda>u. case m_unify [(t, u)] of Some \\<sigma> \\<Rightarrow> [([], \\<sigma>)] | None \\<Rightarrow> [])\"]\n    by force\n  then have \"([], \\<sigma>) \\<in> set (c_unify (M | A \\<triangleright> t))\"\n    using Unif(1) is_var.intros\n    apply (cases t)\n    by force+\n  then show ?case\n    by (simp add: c_succ_def)\nnext\n  case (Proj u v M M' A t)\n  then have \"c_dec_term (M | A \\<triangleright> t) (Pair u v) = [([(u # v # M') | (Pair u v # A) \\<triangleright> t], Var)]\"\n    by simp\n  then have \"([(u # v # M') | (Pair u v # A) \\<triangleright> t], Var) \\<in> set (c_dec (M | A \\<triangleright> t))\"\n    using exists_maps\n    by (metis (full_types) Proj.hyps(1) c_dec.simps list.set_intros(1))\n  then show ?case\n    by (simp add: c_succ_def)\nnext\n  case (Sdec u k M M' A t)\n  then have \"c_dec_term (M | A \\<triangleright> t) (Sym_encrypt u k) = [([(u # M') | (Sym_encrypt u k # A) \\<triangleright> t, M' | (Sym_encrypt u k # A) \\<triangleright> k], Var)]\"\n    using c_dec_term.simps(2)\n    by metis\n  then have \"([(u # M') | (Sym_encrypt u k # A) \\<triangleright> t, M' | (Sym_encrypt u k # A) \\<triangleright> k], Var) \\<in> set (c_dec (M | A \\<triangleright> t))\"\n    using exists_maps\n    by (metis (full_types) Sdec.hyps(1) c_dec.simps list.set_intros(1))\n  then show ?case\n    by (simp add: c_succ_def)\nnext\n  case (Adec u M M' A t)\n  then have \"c_dec_term (M | A \\<triangleright> t) (Public_key_encrypt u (Cons \\<iota>)) = [([(u # M') | (Public_key_encrypt u intruder # A) \\<triangleright> t], Var)]\"\n    by simp\n  then have \"([(u # M') | (Public_key_encrypt u intruder # A) \\<triangleright> t], Var) \\<in> set (c_dec (M | A \\<triangleright> t))\"\n    using exists_maps\n    by (metis (full_types) Adec.hyps(1) c_dec.simps intruder_def list.set_intros(1))\n  then show ?case\n    by (simp add: c_succ_def)\nnext\n  case (Ksub u x M \\<sigma> A t)\n  then have \"c_dec_term (M | A \\<triangleright> t) (Public_key_encrypt u (Var x)) = [([c_sapply \\<sigma> (M | A \\<triangleright> t)], \\<sigma>)]\"\n    using c_dec_term.simps(4)\n    by metis\n  then have \"([c_sapply \\<sigma> (M | A \\<triangleright> t)], \\<sigma>) \\<in> set (c_dec (M | A \\<triangleright> t))\"\n    using exists_maps\n    by (metis (full_types) Ksub.hyps(1) c_dec.simps list.set_intros(1))\n  then show ?case\n    by (simp add: c_succ_def)\nqed (simp add: c_succ_def intruder_def)+\n\n(* successors of a constraint system under rer, i.e., using rule Context *)\nfun \"cs_succ_aux\" :: \"constraint_system \\<Rightarrow> constraint_system \\<Rightarrow> (constraint_system \\<times> m_subst) list\" where\n  \"cs_succ_aux _ [] = []\"\n| \"cs_succ_aux cs' (c # cs'') = map (\\<lambda>(cs, \\<sigma>). (cs_sapply \\<sigma> cs' @ cs @ cs_sapply \\<sigma> cs'', \\<sigma>)) (c_succ c)\n                              @ cs_succ_aux (cs' @ [c]) cs''\"\n\n(* helper lemma for soundness of cs_succ_aux_rer *)\nlemma \"cs_succ_aux_rer\":\n  assumes \"(ocs, \\<sigma>) \\<in> set (cs_succ_aux pcs ics)\"\n  shows \"rer (pcs @ ics) \\<sigma> ocs\"\n  using assms\nproof (induction ics arbitrary: pcs)\n  case (Cons c ics)\n  then show ?case\n    proof (cases \"(ocs, \\<sigma>) \\<in> set (cs_succ_aux (pcs @ [c]) ics)\")\n      case False\n      then obtain cs where \"(cs, \\<sigma>) \\<in> set (c_succ c)\" and \"ocs_def\": \"ocs = cs_sapply \\<sigma> pcs @ cs @ cs_sapply \\<sigma> ics\"\n        using Cons False\n        by auto\n      then show ?thesis\n        by (simp add: Context c_succ_rer1)\n    qed fastforce\nqed simp\n\n(* helper lemma for completeness of cs_succ_aux w.r.t. rer1 *)\nlemma \"cs_rer_succ_aux\":\n  assumes \"rer1 c \\<sigma> cs\"\n  shows \"(cs_sapply \\<sigma> (pcs @ cs') @ cs @ cs_sapply \\<sigma> cs'', \\<sigma>) \\<in> set (cs_succ_aux pcs (cs' @ [c] @ cs''))\"\nproof (induction cs' arbitrary: pcs)\n  case Nil\n  have \"(cs, \\<sigma>) \\<in> set (c_succ c)\"\n    using assms c_rer1_succ\n    by simp\n  then show ?case\n    using Nil\n    by auto\nnext\n  case (Cons a cs')\n  then show ?case\n    using Cons[of \"pcs @ [a]\"]\n    by simp\nqed\n\n(* successors of a constraint system under rer *)\ndefinition \"cs_succ\" :: \"constraint_system \\<Rightarrow> (constraint_system \\<times> m_subst) list\" where\n  \"cs_succ cs = cs_succ_aux [] cs\"\n\n(* soundness of cs_succ *)\nlemma \"cs_succ_rer\": \"(cs, \\<sigma>) \\<in> set (cs_succ ics) \\<Longrightarrow> rer ics \\<sigma> cs\"\n  unfolding cs_succ_def\n  using cs_succ_aux_rer by fastforce\n\n(* completeness of cs_succ w.r.t. rer *)\nlemma \"cs_rer_succ\": \"rer ics \\<sigma> cs \\<Longrightarrow> (cs, \\<sigma>) \\<in> set (cs_succ ics)\"\n  unfolding cs_succ_def\n  apply (induction rule: rer.induct)\n  subgoal for c \\<sigma> cs cs' cs''\n    using cs_rer_succ_aux[of c \\<sigma> cs \"[]\" cs' cs'']\n    by simp\n  done\n\n(* needed for termination proof of search *)\nlemma \"cs_succ_rer_any\": \"(cs, \\<sigma>) \\<in> set (cs_succ ics) \\<Longrightarrow> rer_any cs ics\"\n  using cs_succ_rer rer_any.intros\n  by blast\n\n(* 9. (b) *)\n\n(* map a list until an element is mapped to Some _ and return it *)\nfun \"fold_option\" :: \"('a \\<Rightarrow> 'b option) \\<Rightarrow> 'a list \\<Rightarrow> 'b option\" where\n  \"fold_option f [] = None\"\n| \"fold_option f (a # as) = (case f a of Some b \\<Rightarrow> Some b | None \\<Rightarrow> fold_option f as)\"\n\nlemma \"fold_option_exists\":\n  assumes \"fold_option f as = Some b\"\n  shows \"\\<exists>a \\<in> set as. f a = Some b\"\n  using assms\n  apply (induction as)\n   apply simp_all\n  by (metis option.case_eq_if option.collapse)\n\nlemma \"exists_fold_option\":\n  assumes \"\\<exists>a \\<in> set as. \\<not>Option.is_none (f a)\"\n  shows \"\\<not>Option.is_none (fold_option f as)\"\n  using assms\n  apply (induction as)\n   apply simp_all\n  by (simp add: Option.is_none_def option.case_eq_if)\n\nlemma \"fold_option_cong\": \"xs = ys \\<Longrightarrow> (\\<And>a. a \\<in> set xs \\<Longrightarrow> f a = f' a) \\<Longrightarrow> fold_option f xs = fold_option f' ys\"\nproof (induction xs arbitrary: ys)\n  case (Cons a as)\n  then obtain a' as' where \"ys = a' # as'\"\n    by blast\n  then show ?case\n    by (metis Cons.IH Cons.prems(1) Cons.prems(2) fold_option.simps(2) list.set_intros(1) list.set_intros(2))\nqed simp\n\ncontext notes fold_option_cong[fundef_cong] begin\n(* main search function *)\nfunction search :: \"constraint_system \\<Rightarrow> (constraint_system \\<times> m_subst) option\" where\n  \"search ics = (if cs_simple ics then Some (ics, Var)\n                 else fold_option id (map (\\<lambda>(cs, \\<sigma>). case search cs of Some (cs', \\<sigma>') \\<Rightarrow> Some (cs', m_scomp \\<sigma>' \\<sigma>) | None \\<Rightarrow> None) (cs_succ ics)))\"\n  by pat_completeness auto\ntermination\n  apply (relation \"{(x, y). rer_any x y}\")\n  using rer_any_wf wfP_def apply blast\n  using cs_succ_rer_any by auto\nend\n\nlemma \"fold_option_map\": \"fold_option id (map f xs) = fold_option f xs\"\n  apply (induction xs)\n   apply simp\n  by (metis fold_option.simps(2) id_apply list.simps(9))\n\n(* define fast search code equation for search *)\nlemmas search_code[code] = search.simps[unfolded fold_option_map]\n(* slow search function *)\ndefinition \"search_slow = search\"\nlemmas search_slow_code[code] = search.simps[folded search_slow_def]\n\n(* 9. (c) *)\n\n(* Key transport protocol *)\ndefinition ktp :: \"constraint_system\" where\n  \"ktp = [[Cons ''a'', Cons ''b'', intruder] | [] \\<triangleright> Pair (Var ''A0'') (Var ''B0''),\n               [Public_key_encrypt (Pair (Cons ''k0'') (Signature (Cons ''k0'') (Var ''A0''))) (Var ''B0''), Cons ''a'', Cons ''b'', intruder] | [] \\<triangleright> Public_key_encrypt (Pair (Var ''K1'') (Signature (Var ''K1'') (Cons ''a''))) (Cons ''b''),\n               [Sym_encrypt (Cons ''m1'') (Var ''K1''), Public_key_encrypt (Pair (Cons ''k0'') (Signature (Cons ''k0'') (Var ''A0''))) (Var ''B0''), Cons ''a'', Cons ''b'', intruder] | [] \\<triangleright> Sym_encrypt (Var ''Z0'') (Cons ''k0''),\n               [Sym_encrypt (Cons ''m1'') (Var ''K1''), Public_key_encrypt (Pair (Cons ''k0'') (Signature (Cons ''k0'') (Var ''A0''))) (Var ''B0''), Cons ''a'', Cons ''b'', intruder] | [] \\<triangleright> Pair (Var ''K1'') (Cons ''m1'')]\"\ndefinition ktp_vars :: \"string list\" where\n  \"ktp_vars = [''A0'', ''B0'', ''K1'', ''Z0'']\"\n\n(* Needham-Schroeder Public-Key protocol *)\ndefinition nspk :: \"constraint_system\" where\n  \"nspk = [[Cons ''a'', Cons ''b'', intruder] | [] \\<triangleright> Pair (Var ''A0'') (Var ''B0''),\n               [Public_key_encrypt (Pair (Cons ''na0'') (Var ''A0'')) (Var ''B0''), Cons ''a'', Cons ''b'', intruder] | [] \\<triangleright> Public_key_encrypt (Pair (Var ''NA1'') (Cons ''a'')) (Cons ''b''),\n               [Public_key_encrypt (Pair (Var ''NA1'') (Cons ''nb1'')) (Cons ''a''), Public_key_encrypt (Pair (Cons ''na0'') (Var ''A0'')) (Var ''B0''), Cons ''a'', Cons ''b'', intruder] | [] \\<triangleright> Public_key_encrypt (Pair (Cons ''na0'') (Var ''NB0'')) (Var ''A0''),\n               [Public_key_encrypt (Var ''NB0'') (Var ''B0''), Public_key_encrypt (Pair (Var ''NA1'') (Cons ''nb1'')) (Cons ''a''), Public_key_encrypt (Pair (Cons ''na0'') (Var ''A0'')) (Var ''B0''), Cons ''a'', Cons ''b'', intruder] | [] \\<triangleright> Public_key_encrypt (Cons ''nb1'') (Cons ''b''),\n               [Public_key_encrypt (Var ''NB0'') (Var ''B0''), Public_key_encrypt (Pair (Var ''NA1'') (Cons ''nb1'')) (Cons ''a''), Public_key_encrypt (Pair (Cons ''na0'') (Var ''A0'')) (Var ''B0''), Cons ''a'', Cons ''b'', intruder] | [] \\<triangleright> Pair (Var ''NA1'') (Cons ''nb1'')]\"\ndefinition nspk_vars :: \"string list\" where\n  \"nspk_vars = [''A0'', ''B0'', ''NA1'', ''NB0'']\"\n\n(* pretty-print functions for exporting the code *)\ndefinition print_list :: \"('a \\<Rightarrow> string) \\<Rightarrow> 'a list \\<Rightarrow> string\" where\n  \"print_list f M = ''['' @ foldl (\\<lambda>out m. out @ (if out = [] then [] else '', '')  @ f m) [] M @ '']''\"\n\nfun print_msg :: \"msg \\<Rightarrow> string\" where\n  \"print_msg (Cons s) = ''(Cons '' @ s @ '')''\"\n| \"print_msg (Var s) = ''(Var '' @ s @ '')''\"\n| \"print_msg (Hash m) = ''(Hash '' @ print_msg m @ '')''\"\n| \"print_msg (Pair u v) = ''(Pair '' @ print_msg u @ '' '' @ print_msg v @ '')''\"\n| \"print_msg (Sym_encrypt m k) = ''(Sym_encrypt '' @ print_msg m @ '' '' @ print_msg k @ '')''\"\n| \"print_msg (Public_key_encrypt m k) = ''(Public_key_encrypt '' @ print_msg m @ '' '' @ print_msg k @ '')''\"\n| \"print_msg (Signature m k) = ''(Signature '' @ print_msg m @ '' '' @ print_msg k @ '')''\"\n\nfun print_c :: \"constraint \\<Rightarrow> string\" where\n  \"print_c (M | A \\<triangleright> t) = ''('' @ print_list print_msg M @ '' | '' @ print_list print_msg A @ '' --> '' @ print_msg t @ '')''\"\n\nfun print_search_result :: \"(constraint list \\<times> (char list \\<times> msg) list) option \\<Rightarrow> string\" where\n  \"print_search_result None = ''No solution.''\"\n| \"print_search_result (Some (cs, \\<sigma>)) = ''Simple constraints: '' @ print_list print_c cs @ ''; Substitutions: '' @ print_list (\\<lambda>(s, m). ''('' @ s @ '' --> '' @ print_msg m @ '')'') \\<sigma>\"\n\ndefinition print_search :: \"string list \\<Rightarrow> constraint_system \\<Rightarrow> String.literal\" where\n  \"print_search ns cs = String.implode (print_search_result (map_option (\\<lambda>(cs, \\<sigma>). (cs, map (\\<lambda>v. (v, \\<sigma> v)) ns)) (search cs)))\"\n\ndefinition print_search_slow :: \"string list \\<Rightarrow> constraint_system \\<Rightarrow> String.literal\" where\n  \"print_search_slow ns cs = String.implode (print_search_result (map_option (\\<lambda>(cs, \\<sigma>). (cs, map (\\<lambda>v. (v, \\<sigma> v)) ns)) (search_slow cs)))\"\n\ndefinition \"print_search_KTP = print_search ktp_vars ktp\"\ndefinition \"print_search_slow_KTP = print_search_slow ktp_vars ktp\"\n\ndefinition \"print_search_NSPK = print_search nspk_vars nspk\"\ndefinition \"print_search_slow_NSPK = print_search_slow nspk_vars nspk\"\n\nvalue \"print_search_KTP\"\n(* value \"print_search_slow_KTP\" *)\n\nvalue \"print_search_NSPK\"\n(* value \"print_search_slow_NSPK\" *)\n\nexport_code print_search_KTP print_search_slow_KTP print_search_NSPK print_search_slow_NSPK in Haskell module_name Search file \"./ghc\"\nexport_code print_search print_search_slow ktp_vars ktp nspk_vars nspk in SML module_name Search file \"./sml/Search.sml\"\n\n(* 10. (a) *)\n\n(* soundness of search *)\nlemma \"search_sound\":\n  assumes \"search ics = Some (cs', \\<sigma>'')\"\n  shows \"rer_star ics \\<sigma>'' cs' \\<and> cs_simple cs'\"\n  using assms\n  apply (induction arbitrary: cs' \\<sigma>'' rule: search.induct)\n  subgoal premises prems for ics cs' \\<sigma>''\n    using prems\n    proof (cases \"cs_simple ics\")\n      case False\n      then have \"search ics = fold_option (\\<lambda>(cs, \\<sigma>). case search cs of Some (cs', \\<sigma>') \\<Rightarrow> Some (cs', m_scomp \\<sigma>' \\<sigma>) | None \\<Rightarrow> None) (cs_succ ics)\"\n        by (simp add: fold_option_map)\n      then have \"fold_option (\\<lambda>(cs, \\<sigma>). case search cs of Some (cs', \\<sigma>') \\<Rightarrow> Some (cs', m_scomp \\<sigma>' \\<sigma>) | None \\<Rightarrow> None) (cs_succ ics) = Some (cs', \\<sigma>'')\"\n        using prems(2)\n        by simp\n      then obtain cs \\<sigma> where $: \"(cs, \\<sigma>) \\<in> set (cs_succ ics)\" and \"(case search cs of Some (cs', \\<sigma>') \\<Rightarrow> Some (cs', m_scomp \\<sigma>' \\<sigma>) | None \\<Rightarrow> None) = Some (cs', \\<sigma>'')\"\n        using fold_option_exists[of \"(\\<lambda>(cs, \\<sigma>). case search cs of Some (cs', \\<sigma>') \\<Rightarrow> Some (cs', m_scomp \\<sigma>' \\<sigma>) | None \\<Rightarrow> None)\" \"(cs_succ ics)\" \"(cs', \\<sigma>'')\"]\n        by auto\n      then obtain \\<sigma>' where \"search cs = Some (cs', \\<sigma>')\" and \"m_scomp_sigma\": \"\\<sigma>'' = m_scomp \\<sigma>' \\<sigma>\"\n        by (cases \"search cs\") auto\n      then have \"sub\": \"cs_simple cs' \\<and> rer_star cs \\<sigma>' cs'\"\n        using prems(1) False $\n        by blast\n      have \"rer ics \\<sigma> cs\"\n        using $\n        by (simp add: cs_succ_rer)\n      then show ?thesis\n        using m_scomp_sigma sub Trans\n        by blast\n    qed (simp add: Refl)\n  done\n\n(* 10. (b) *)\n\n(* completeness of search w.r.t. rer_star *)\nlemma \"search_complete\":\n  assumes \"rer_star ics \\<sigma>'' cs'\" and \"cs_simple cs'\"\n  shows \"\\<exists>x. search ics = Some x\"\n  using assms\n  apply (induction rule: rer_star.induct)\n   apply simp\n  subgoal premises prems for ics \\<sigma> cs \\<sigma>' cs'\n    using prems\n    proof (cases \"cs_simple ics\")\n      case False\n      have $: \"(cs, \\<sigma>) \\<in> set (cs_succ ics)\"\n        using prems(1)\n        by (simp add: cs_rer_succ)\n      obtain css' \\<sigma>s' where \"search cs = Some (css', \\<sigma>s')\"\n        using prems\n        by auto\n      then have \"\\<exists>x \\<in> set (cs_succ ics). \\<not>Option.is_none ((\\<lambda>(cs, \\<sigma>). case search cs of Some (cs', \\<sigma>') \\<Rightarrow> Some (cs', m_scomp \\<sigma>' \\<sigma>) | None \\<Rightarrow> None) x)\"\n        using $\n        by force\n      then have \"\\<exists>z. z \\<noteq> None \\<and> search ics = z\"\n        using False exists_fold_option[of \"(cs_succ ics)\" \"(\\<lambda>(cs, \\<sigma>). case search cs of Some (cs', \\<sigma>') \\<Rightarrow> Some (cs', m_scomp \\<sigma>' \\<sigma>) | None \\<Rightarrow> None)\"]\n        by (simp add: Option.is_none_def fold_option_map)\n      then show ?thesis\n        by blast\n    qed simp\n  done\n\nend", "meta": {"author": "tdardinier", "repo": "camr", "sha": "d8a4f774285bb185b1431b9c7e9325e5cc4eb1c4", "save_path": "github-repos/isabelle/tdardinier-camr", "path": "github-repos/isabelle/tdardinier-camr/camr-d8a4f774285bb185b1431b9c7e9325e5cc4eb1c4/Execution.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3334348807301059}}
{"text": "(*  Title:      HOL/Auth/flash_data_cub.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The flash_data_cub Protocol Case Study*} \n\ntheory flash_data_cub imports flash_data_cub_lemma_invs_on_rules flash_data_cub_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/flash_data_cub/flash_data_cub.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3334348735163587}}
{"text": "section \\<open> External Choice \\<close>\n\ntheory utp_sfrd_extchoice\n  imports \n    utp_sfrd_healths\n    utp_sfrd_rel\nbegin\n\nsubsection \\<open> Definitions and syntax \\<close>\n\ndefinition EXTCHOICE :: \"'a set \\<Rightarrow> ('a \\<Rightarrow> ('\\<sigma>, '\\<phi>) action) \\<Rightarrow> ('\\<sigma>, '\\<phi>) action\" where\nExtChoice_def [upred_defs]: \"EXTCHOICE A F = \\<^bold>R\\<^sub>s((\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R(F P)) \\<turnstile> ((\\<Squnion> P\\<in>A \\<bullet> cmt\\<^sub>R(F P)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter> P\\<in>A \\<bullet> cmt\\<^sub>R(F P))))\"\n\nabbreviation ExtChoice :: \"('\\<sigma>, '\\<phi>) action set \\<Rightarrow> ('\\<sigma>, '\\<phi>) action\" where \n\"ExtChoice A \\<equiv> EXTCHOICE A id\"\n\nsyntax\n  \"_ExtChoice\" :: \"pttrn \\<Rightarrow> 'a set \\<Rightarrow> 'b \\<Rightarrow> 'b\"  (\"(3\\<box> _\\<in>_ \\<bullet>/ _)\" [0, 0, 10] 10)\n  \"_ExtChoice_simp\" :: \"pttrn \\<Rightarrow> 'b \\<Rightarrow> 'b\"  (\"(3\\<box> _ \\<bullet>/ _)\" [0, 10] 10)\n\ntranslations\n  \"\\<box>P\\<in>A \\<bullet> B\"   \\<rightleftharpoons> \"CONST EXTCHOICE A (\\<lambda>P. B)\"\n  \"\\<box>P \\<bullet> B\"     \\<rightleftharpoons> \"CONST EXTCHOICE (CONST UNIV) (\\<lambda>P. B)\"\n\ndefinition extChoice ::\n  \"('\\<sigma>, '\\<phi>) action \\<Rightarrow> ('\\<sigma>, '\\<phi>) action \\<Rightarrow> ('\\<sigma>, '\\<phi>) action\" (infixl \"\\<box>\" 59) where\n[upred_defs]: \"P \\<box> Q \\<equiv> ExtChoice {P, Q}\"\n\ntext \\<open> Small external choice as an indexed big external choice. \\<close>\n\nlemma extChoice_alt_def:\n  \"P \\<box> Q = (\\<box>i::nat\\<in>{0,1} \\<bullet> P \\<triangleleft> \\<guillemotleft>i = 0\\<guillemotright> \\<triangleright> Q)\"\n  by (simp add: extChoice_def ExtChoice_def)\n\nsubsection \\<open> Basic laws \\<close>\n\nsubsection \\<open> Algebraic laws \\<close>\n\nlemma ExtChoice_empty: \"EXTCHOICE {} F = Stop\"\n  by (simp add: ExtChoice_def cond_def Stop_def)\n\nlemma ExtChoice_single:\n  \"P is CSP \\<Longrightarrow> ExtChoice {P} = P\"\n  by (simp add: ExtChoice_def usup_and uinf_or SRD_reactive_design_alt)\n\nsubsection \\<open> Reactive design calculations \\<close>\n\nlemma ExtChoice_rdes:\n  assumes \"\\<And> i. $ok\\<acute> \\<sharp> P(i)\" \"A \\<noteq> {}\"\n  shows \"(\\<box>i\\<in>A \\<bullet> \\<^bold>R\\<^sub>s(P(i) \\<turnstile> Q(i))) = \\<^bold>R\\<^sub>s((\\<Squnion>i\\<in>A \\<bullet> P(i)) \\<turnstile> ((\\<Squnion>i\\<in>A \\<bullet> Q(i)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter>i\\<in>A \\<bullet> Q(i))))\"\nproof -\n  have \"(\\<box>i\\<in>A \\<bullet> \\<^bold>R\\<^sub>s(P(i) \\<turnstile> Q(i))) =\n        \\<^bold>R\\<^sub>s ((\\<Squnion>i\\<in>A \\<bullet> pre\\<^sub>R (\\<^bold>R\\<^sub>s (P i \\<turnstile> Q i))) \\<turnstile>\n            ((\\<Squnion>i\\<in>A \\<bullet> cmt\\<^sub>R (\\<^bold>R\\<^sub>s (P i \\<turnstile> Q i)))\n              \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n             (\\<Sqinter>i\\<in>A \\<bullet> cmt\\<^sub>R (\\<^bold>R\\<^sub>s (P i \\<turnstile> Q i)))))\"\n    by (simp add: ExtChoice_def)\n  also have \"... =\n        \\<^bold>R\\<^sub>s ((\\<Squnion>i\\<in>A \\<bullet> R1 (R2c (pre\\<^sub>s \\<dagger> P(i)))) \\<turnstile>\n            ((\\<Squnion>i\\<in>A \\<bullet> R1(R2c(cmt\\<^sub>s \\<dagger> (P(i) \\<Rightarrow> Q(i)))))\n              \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n             (\\<Sqinter>i\\<in>A \\<bullet> R1(R2c(cmt\\<^sub>s \\<dagger> (P(i) \\<Rightarrow> Q(i)))))))\"\n    by (simp add: rea_pre_RHS_design rea_cmt_RHS_design)\n  also have \"... =\n        \\<^bold>R\\<^sub>s ((\\<Squnion>i\\<in>A \\<bullet> R1 (R2c (pre\\<^sub>s \\<dagger> P(i)))) \\<turnstile>\n            R1(R2c\n            ((\\<Squnion>i\\<in>A \\<bullet> R1(R2c(cmt\\<^sub>s \\<dagger> (P(i) \\<Rightarrow> Q(i)))))\n              \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n             (\\<Sqinter>i\\<in>A \\<bullet> R1(R2c(cmt\\<^sub>s \\<dagger> (P(i) \\<Rightarrow> Q(i))))))))\"\n    by (metis (no_types, lifting) RHS_design_export_R1 RHS_design_export_R2c)\n  also have \"... =\n        \\<^bold>R\\<^sub>s ((\\<Squnion>i\\<in>A \\<bullet> R1 (R2c (pre\\<^sub>s \\<dagger> P(i)))) \\<turnstile>\n            R1(R2c\n            ((\\<Squnion>i\\<in>A \\<bullet> (cmt\\<^sub>s \\<dagger> (P(i) \\<Rightarrow> Q(i))))\n              \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n             (\\<Sqinter>i\\<in>A \\<bullet> (cmt\\<^sub>s \\<dagger> (P(i) \\<Rightarrow> Q(i)))))))\"\n    by (simp add: R2c_UINF R2c_condr R1_cond R1_idem R1_R2c_commute R2c_idem R1_UINF assms R1_USUP R2c_USUP)\n  also have \"... =\n        \\<^bold>R\\<^sub>s ((\\<Squnion>i\\<in>A \\<bullet> R1 (R2c (pre\\<^sub>s \\<dagger> P(i)))) \\<turnstile>\n            cmt\\<^sub>s \\<dagger>\n            ((\\<Squnion>i\\<in>A \\<bullet> (cmt\\<^sub>s \\<dagger> (P(i) \\<Rightarrow> Q(i))))\n              \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n             (\\<Sqinter>i\\<in>A \\<bullet> (cmt\\<^sub>s \\<dagger> (P(i) \\<Rightarrow> Q(i))))))\"\n    by (metis (no_types, lifting) RHS_design_export_R1 RHS_design_export_R2c rdes_export_cmt)\n  also have \"... =\n        \\<^bold>R\\<^sub>s ((\\<Squnion>i\\<in>A \\<bullet> R1 (R2c (pre\\<^sub>s \\<dagger> P(i)))) \\<turnstile>\n            cmt\\<^sub>s \\<dagger>\n            ((\\<Squnion>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i)))\n              \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n             (\\<Sqinter>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i)))))\"\n    by (simp add: usubst)\n  also have \"... =\n        \\<^bold>R\\<^sub>s ((\\<Squnion>i\\<in>A \\<bullet> R1 (R2c (pre\\<^sub>s \\<dagger> P(i)))) \\<turnstile>\n            ((\\<Squnion>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i))) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i)))))\"\n    by (simp add: rdes_export_cmt)\n  also have \"... =\n        \\<^bold>R\\<^sub>s ((R1(R2c(\\<Squnion>i\\<in>A \\<bullet> (pre\\<^sub>s \\<dagger> P(i))))) \\<turnstile>\n            ((\\<Squnion>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i))) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i)))))\"\n    by (simp add: not_UINF R1_UINF R2c_UINF assms)\n  also have \"... =\n        \\<^bold>R\\<^sub>s ((R2c(\\<Squnion>i\\<in>A \\<bullet> (pre\\<^sub>s \\<dagger> P(i)))) \\<turnstile>\n            ((\\<Squnion>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i))) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i)))))\"\n    by (simp add: R1_design_R1_pre)\n  also have \"... =\n        \\<^bold>R\\<^sub>s (((\\<Squnion>i\\<in>A \\<bullet> (pre\\<^sub>s \\<dagger> P(i)))) \\<turnstile>\n            ((\\<Squnion>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i))) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i)))))\"\n    by (metis (no_types, lifting) RHS_design_R2c_pre)\n  also have \"... =\n        \\<^bold>R\\<^sub>s (([$ok \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s false] \\<dagger> (\\<Squnion>i\\<in>A \\<bullet> P(i))) \\<turnstile>\n            ((\\<Squnion>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i))) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i)))))\"\n  proof -\n    from assms have \"\\<And> i. pre\\<^sub>s \\<dagger> P(i) = [$ok \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s false] \\<dagger> P(i)\"\n      by (rel_auto)\n    thus ?thesis\n      by (simp add: usubst)\n  qed\n  also have \"... =\n        \\<^bold>R\\<^sub>s ((\\<Squnion>i\\<in>A \\<bullet> P(i)) \\<turnstile> ((\\<Squnion>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i))) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter>i\\<in>A \\<bullet> (P(i) \\<Rightarrow> Q(i)))))\"\n    by (simp add: rdes_export_pre not_UINF)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<Squnion>i\\<in>A \\<bullet> P(i)) \\<turnstile> ((\\<Squnion>i\\<in>A \\<bullet> Q(i)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter>i\\<in>A \\<bullet> Q(i))))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto, blast+)\n\n  finally show ?thesis .\nqed\n\nlemma ExtChoice_tri_rdes:\n  assumes \"\\<And> i . $ok\\<acute> \\<sharp> P\\<^sub>1(i)\" \"A \\<noteq> {}\"\n  shows \"(\\<box> i\\<in>A \\<bullet> \\<^bold>R\\<^sub>s(P\\<^sub>1(i) \\<turnstile> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i))) =\n         \\<^bold>R\\<^sub>s ((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>1(i)) \\<turnstile> (((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>2(i)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (\\<Sqinter> i\\<in>A \\<bullet> P\\<^sub>2(i))) \\<diamondop> (\\<Sqinter> i\\<in>A \\<bullet> P\\<^sub>3(i))))\"\nproof -\n  have \"(\\<box> i\\<in>A \\<bullet> \\<^bold>R\\<^sub>s(P\\<^sub>1(i) \\<turnstile> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i))) =\n         \\<^bold>R\\<^sub>s ((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>1(i)) \\<turnstile> ((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter> i\\<in>A \\<bullet> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i))))\"\n    by (simp add: ExtChoice_rdes assms)\n  also\n  have \"... =\n         \\<^bold>R\\<^sub>s ((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>1(i)) \\<turnstile> ((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i)) \\<triangleleft> $wait\\<acute> \\<and> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (\\<Sqinter> i\\<in>A \\<bullet> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i))))\"\n    by (simp add: conj_comm)\n  also\n  have \"... =\n         \\<^bold>R\\<^sub>s ((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>1(i)) \\<turnstile> (((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (\\<Sqinter> i\\<in>A \\<bullet> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i))) \\<diamondop> (\\<Sqinter> i\\<in>A \\<bullet> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i))))\"\n    by (simp add: cond_conj wait'_cond_def)\n  also\n  have \"... = \\<^bold>R\\<^sub>s ((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>1(i)) \\<turnstile> (((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>2(i)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (\\<Sqinter> i\\<in>A \\<bullet> P\\<^sub>2(i))) \\<diamondop> (\\<Sqinter> i\\<in>A \\<bullet> P\\<^sub>3(i))))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma ExtChoice_tri_rdes' [rdes_def]:\n  assumes \"\\<And> i . $ok\\<acute> \\<sharp> P\\<^sub>1(i)\" \"A \\<noteq> {}\"\n  shows \"(\\<box> i\\<in>A \\<bullet> \\<^bold>R\\<^sub>s(P\\<^sub>1(i) \\<turnstile> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i))) =\n         \\<^bold>R\\<^sub>s ((\\<Squnion> i\\<in>A \\<bullet> P\\<^sub>1(i)) \\<turnstile> (((\\<Squnion> i\\<in>A \\<bullet> R5(P\\<^sub>2(i))) \\<or> (\\<Sqinter> i\\<in>A \\<bullet> R4(P\\<^sub>2(i)))) \\<diamondop> (\\<Sqinter> i\\<in>A \\<bullet> P\\<^sub>3(i))))\"\n  by (simp add: ExtChoice_tri_rdes assms, rel_auto, simp_all add: less_le assms)\n\nlemma ExtChoice_tri_rdes_def:\n  assumes \"\\<And> i. i\\<in>A \\<Longrightarrow> F i is CSP\"\n  shows \"(\\<box> i\\<in>A \\<bullet> F i) = \\<^bold>R\\<^sub>s ((\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R (F P)) \\<turnstile> (((\\<Squnion> P\\<in>A \\<bullet> peri\\<^sub>R (F P)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (\\<Sqinter> P\\<in>A \\<bullet> peri\\<^sub>R (F P))) \\<diamondop> (\\<Sqinter> P\\<in>A \\<bullet> post\\<^sub>R (F P))))\"\nproof -\n  have \"((\\<Squnion> P\\<in>A \\<bullet> cmt\\<^sub>R (F P)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (\\<Sqinter> P\\<in>A \\<bullet> cmt\\<^sub>R (F P))) =\n        (((\\<Squnion> P\\<in>A \\<bullet> cmt\\<^sub>R (F P)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (\\<Sqinter> P\\<in>A \\<bullet> cmt\\<^sub>R (F P))) \\<diamondop> (\\<Sqinter> P\\<in>A \\<bullet> cmt\\<^sub>R (F P)))\"\n    by (rel_auto)\n  also have \"... = (((\\<Squnion> P\\<in>A \\<bullet> peri\\<^sub>R (F P)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (\\<Sqinter> P\\<in>A \\<bullet> peri\\<^sub>R (F P))) \\<diamondop> (\\<Sqinter> P\\<in>A \\<bullet> post\\<^sub>R (F P)))\"\n    by (rel_auto)\n  finally show ?thesis\n    by (simp add: ExtChoice_def)\nqed\n\nlemma extChoice_rdes:\n  assumes \"$ok\\<acute> \\<sharp> P\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<box> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2) = \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>2 \\<and> Q\\<^sub>2) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (P\\<^sub>2 \\<or> Q\\<^sub>2)))\"\nproof -\n  have \"(\\<box>i::nat\\<in>{0, 1} \\<bullet> \\<^bold>R\\<^sub>s (P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<triangleleft> \\<guillemotleft>i = 0\\<guillemotright> \\<triangleright> \\<^bold>R\\<^sub>s (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2)) = (\\<box>i::nat\\<in>{0, 1} \\<bullet> \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<triangleleft> \\<guillemotleft>i = 0\\<guillemotright> \\<triangleright> (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2)))\"\n    by (simp only: RHS_cond R2c_lit)\n  also have \"... = (\\<box>i::nat\\<in>{0, 1} \\<bullet> \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<triangleleft> \\<guillemotleft>i = 0\\<guillemotright> \\<triangleright> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<triangleleft> \\<guillemotleft>i = 0\\<guillemotright> \\<triangleright> Q\\<^sub>2)))\"\n    by (simp add: design_condr)\n  also have \"... = \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>2 \\<and> Q\\<^sub>2) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (P\\<^sub>2 \\<or> Q\\<^sub>2)))\"\n    by (subst ExtChoice_rdes, simp_all add: assms unrest uinf_or usup_and)\n  finally show ?thesis by (simp add: extChoice_alt_def)\nqed\n\nlemma extChoice_tri_rdes:\n  assumes \"$ok\\<acute> \\<sharp> P\\<^sub>1\" \"$ok\\<acute> \\<sharp> Q\\<^sub>1\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<box> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) =\n         \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> (((P\\<^sub>2 \\<and> Q\\<^sub>2) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (P\\<^sub>2 \\<or> Q\\<^sub>2)) \\<diamondop> (P\\<^sub>3 \\<or> Q\\<^sub>3)))\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<box> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) =\n        \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>2 \\<diamondop> P\\<^sub>3 \\<and> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (P\\<^sub>2 \\<diamondop> P\\<^sub>3 \\<or> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)))\"\n    by (simp add: extChoice_rdes assms)\n  also\n  have \"... = \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>2 \\<diamondop> P\\<^sub>3 \\<and> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<triangleleft> $wait\\<acute> \\<and> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (P\\<^sub>2 \\<diamondop> P\\<^sub>3 \\<or> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)))\"\n    by (simp add: conj_comm)\n  also\n  have \"... = \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile>\n               (((P\\<^sub>2 \\<diamondop> P\\<^sub>3 \\<and> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (P\\<^sub>2 \\<diamondop> P\\<^sub>3 \\<or> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)) \\<diamondop> (P\\<^sub>2 \\<diamondop> P\\<^sub>3 \\<or> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3)))\"\n    by (simp add: cond_conj wait'_cond_def)\n  also\n  have \"... = \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> (((P\\<^sub>2 \\<and> Q\\<^sub>2) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (P\\<^sub>2 \\<or> Q\\<^sub>2)) \\<diamondop> (P\\<^sub>3 \\<or> Q\\<^sub>3)))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma extChoice_rdes_def:\n  assumes \"P\\<^sub>1 is RR\" \"Q\\<^sub>1 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<box> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) =\n         \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> (((P\\<^sub>2 \\<and> Q\\<^sub>2) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (P\\<^sub>2 \\<or> Q\\<^sub>2)) \\<diamondop> (P\\<^sub>3 \\<or> Q\\<^sub>3)))\"\n  by (subst extChoice_tri_rdes, simp_all add: assms unrest)\n\nlemma extChoice_rdes_def' [rdes_def]:\n  assumes \"P\\<^sub>1 is RR\" \"Q\\<^sub>1 is RR\"\n  shows \"\\<^bold>R\\<^sub>s(P\\<^sub>1 \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<box> \\<^bold>R\\<^sub>s(Q\\<^sub>1 \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) =\n         \\<^bold>R\\<^sub>s ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> ((R5(P\\<^sub>2 \\<and> Q\\<^sub>2) \\<or> R4(P\\<^sub>2 \\<or> Q\\<^sub>2)) \\<diamondop> (P\\<^sub>3 \\<or> Q\\<^sub>3)))\"\n  by (simp add: extChoice_rdes_def assms, rel_auto, simp_all add: less_le)\n\nlemma CSP_ExtChoice [closure]:\n  \"EXTCHOICE A F is CSP\"\n  by (simp add: ExtChoice_def RHS_design_is_SRD unrest)\n\nlemma CSP_extChoice [closure]:\n  \"P \\<box> Q is CSP\"\n  by (simp add: CSP_ExtChoice extChoice_def)\n\nlemma preR_EXTCHOICE [rdes]:\n  assumes \"A \\<noteq> {}\" \"\\<And> i. i\\<in>A \\<Longrightarrow> F i is NCSP\"\n  shows \"pre\\<^sub>R(EXTCHOICE A F) = (\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R(F P))\"\n  by (simp add: ExtChoice_tri_rdes_def closure rdes assms)\n\nlemma preR_ExtChoice:\n  assumes \"A \\<noteq> {}\" \"\\<forall> P\\<in>A. P is NCSP\"\n  shows \"pre\\<^sub>R(ExtChoice A) = (\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R(P))\"\n  using assms by (auto simp add: preR_EXTCHOICE)\n\nlemma periR_ExtChoice [rdes]:\n  assumes \"A \\<noteq> {}\" \"\\<And> i. i\\<in>A \\<Longrightarrow> F i is NCSP\"\n  shows \"peri\\<^sub>R(EXTCHOICE A F) = (((\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R (F P)) \\<Rightarrow>\\<^sub>r (\\<Squnion> P\\<in>A \\<bullet> peri\\<^sub>R (F P))) \\<triangleleft> \\<^U>($tr\\<acute> = $tr) \\<triangleright> (\\<Sqinter> P\\<in>A \\<bullet> peri\\<^sub>R (F P)))\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs = ((\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R (F P)) \\<Rightarrow>\\<^sub>r (\\<Squnion> P\\<in>A \\<bullet> peri\\<^sub>R (F P)) \\<triangleleft> \\<^U>($tr\\<acute> = $tr) \\<triangleright> (\\<Sqinter> P\\<in>A \\<bullet> peri\\<^sub>R (F P)))\"\n    by (simp add: ExtChoice_tri_rdes_def closure rdes assms)\n  also have \"... = ((\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R (F P)) \\<Rightarrow>\\<^sub>r (\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R (F P) \\<Rightarrow>\\<^sub>r peri\\<^sub>R (F P)) \\<triangleleft> \\<^U>($tr\\<acute> = $tr) \\<triangleright> (\\<Sqinter> P\\<in>A \\<bullet> pre\\<^sub>R (F P) \\<Rightarrow>\\<^sub>r peri\\<^sub>R (F P)))\"\n    by (simp add: NSRD_peri_under_pre assms closure cong: UINF_cong USUP_cong)\n  also have \"... = ((\\<Squnion> P\\<in>A \\<bullet> RR(pre\\<^sub>R (F P))) \\<Rightarrow>\\<^sub>r (\\<Squnion> P\\<in>A \\<bullet> RR(pre\\<^sub>R (F P)) \\<Rightarrow>\\<^sub>r RR(peri\\<^sub>R (F P))) \\<triangleleft> \\<^U>($tr\\<acute> = $tr) \\<triangleright> (\\<Sqinter> P\\<in>A \\<bullet> RR(pre\\<^sub>R (F P)) \\<Rightarrow>\\<^sub>r RR(peri\\<^sub>R (F P))))\"\n    by (simp add: Healthy_if assms closure cong: UINF_cong USUP_cong)\n  also from assms(1) have \"... = ((\\<Squnion> P\\<in>A \\<bullet> RR(pre\\<^sub>R (F P))) \\<Rightarrow>\\<^sub>r (\\<Squnion> P\\<in>A \\<bullet> RR(pre\\<^sub>R (F P)) \\<Rightarrow>\\<^sub>r RR(peri\\<^sub>R (F P)))) \\<triangleleft> \\<^U>($tr\\<acute> = $tr) \\<triangleright> ((\\<Sqinter> P\\<in>A \\<bullet> RR(pre\\<^sub>R (F P)) \\<Rightarrow>\\<^sub>r RR(peri\\<^sub>R (F P))))\"\n    by (rel_auto)\n  finally show ?thesis\n    by (simp add: Healthy_if NSRD_peri_under_pre assms closure cong: UINF_cong USUP_cong)\nqed\n\nlemma periR_ExtChoice':\n  assumes \"A \\<noteq> {}\" \"\\<And> i. i\\<in>A \\<Longrightarrow> F i is NCSP\"\n  shows \"peri\\<^sub>R(EXTCHOICE A F) = (R5((\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R (F P)) \\<Rightarrow>\\<^sub>r (\\<Squnion> P\\<in>A \\<bullet> peri\\<^sub>R (F P))) \\<or> R4(\\<Sqinter> P\\<in>A \\<bullet> peri\\<^sub>R (F P)))\"\n  by (simp add: periR_ExtChoice assms, rel_auto)\n\nlemma postR_ExtChoice [rdes]:\n  assumes \"A \\<noteq> {}\" \"\\<And> i. i\\<in>A \\<Longrightarrow> F i is NCSP\"\n  shows \"post\\<^sub>R(EXTCHOICE A F) = (\\<Sqinter> P\\<in>A \\<bullet> post\\<^sub>R (F P))\"\n  (is \"?lhs = ?rhs\")\nproof -\n  have \"?lhs = ((\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R (F P)) \\<Rightarrow>\\<^sub>r (\\<Sqinter> P\\<in>A \\<bullet> post\\<^sub>R (F P)))\"\n    by (simp add: ExtChoice_tri_rdes_def closure rdes assms)\n  also have \"... = ((\\<Squnion> P\\<in>A \\<bullet> pre\\<^sub>R (F P)) \\<Rightarrow>\\<^sub>r (\\<Sqinter> P\\<in>A \\<bullet> pre\\<^sub>R (F P) \\<Rightarrow>\\<^sub>r post\\<^sub>R (F P)))\"\n    by (simp add: NSRD_post_under_pre assms closure cong: UINF_cong)\n  also have \"... = (\\<Sqinter> P\\<in>A \\<bullet> pre\\<^sub>R (F P) \\<Rightarrow>\\<^sub>r post\\<^sub>R (F P))\"\n    by (rel_auto)\n  finally show ?thesis\n    by (simp add: NSRD_post_under_pre assms closure cong: UINF_cong)\nqed\n\nlemma preR_extChoice' [rdes]:\n  assumes \"P is NCSP\" \"Q is NCSP\"  \n  shows \"pre\\<^sub>R(P \\<box> Q) = (pre\\<^sub>R(P) \\<and> pre\\<^sub>R(Q))\"  \n  by (simp add: extChoice_def preR_ExtChoice assms closure usup_and)\n    \nlemma periR_extChoice [rdes]:\n  assumes \"P is NCSP\" \"Q is NCSP\"\n  shows \"peri\\<^sub>R(P \\<box> Q) = ((pre\\<^sub>R(P) \\<and> pre\\<^sub>R(Q) \\<Rightarrow>\\<^sub>r peri\\<^sub>R(P) \\<and> peri\\<^sub>R(Q)) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<triangleright> (peri\\<^sub>R(P) \\<or> peri\\<^sub>R(Q)))\"\n  using assms\n  by (simp add: extChoice_def, subst periR_ExtChoice, auto simp add: usup_and uinf_or)\n  \nlemma postR_extChoice [rdes]:\n  assumes \"P is NCSP\" \"Q is NCSP\"\n  shows \"post\\<^sub>R(P \\<box> Q) = (post\\<^sub>R(P) \\<or> post\\<^sub>R(Q))\"\n  using assms\n  by (simp add: extChoice_def, subst postR_ExtChoice, auto simp add: usup_and uinf_or)\n    \nlemma ExtChoice_cong:\n  assumes \"\\<And> P. P \\<in> A \\<Longrightarrow> F(P) = G(P)\"\n  shows \"(\\<box> P\\<in>A \\<bullet> F(P)) = (\\<box> P\\<in>A \\<bullet> G(P))\"\n  by (simp add: ExtChoice_def assms cong: UINF_cong USUP_cong)\n\nlemma ref_unrest_ExtChoice:\n  assumes\n    \"\\<And> P. P \\<in> A \\<Longrightarrow> $ref \\<sharp> pre\\<^sub>R(P)\"\n    \"\\<And> P. P \\<in> A \\<Longrightarrow> $ref \\<sharp> cmt\\<^sub>R(P)\"\n  shows \"$ref \\<sharp> (ExtChoice A)\\<lbrakk>false/$wait\\<rbrakk>\"\nproof -\n  have \"\\<And> P. P \\<in> A \\<Longrightarrow> $ref \\<sharp> pre\\<^sub>R(P\\<lbrakk>0/$tr\\<rbrakk>)\"\n    using assms by (rel_blast)\n  with assms show ?thesis\n    by (simp add: ExtChoice_def RHS_def R1_def R2c_def R2s_def R3h_def design_def usubst unrest)\nqed\n\nlemma CSP4_ExtChoice:\n  assumes \"\\<And> i. i\\<in>A \\<Longrightarrow> F i is NCSP\"\n  shows \"EXTCHOICE A F is CSP4\"\nproof (cases \"A = {}\")\n  case True thus ?thesis\n    by (simp add: ExtChoice_empty Healthy_def CSP4_def, simp add: Skip_is_CSP Stop_left_zero)\nnext\n  case False\n  have 1:\"(\\<not>\\<^sub>r (\\<not>\\<^sub>r pre\\<^sub>R (EXTCHOICE A F)) ;;\\<^sub>h R1 true) = pre\\<^sub>R (EXTCHOICE A F)\"\n  proof -\n    have \"\\<And> P. P \\<in> A \\<Longrightarrow> (\\<not>\\<^sub>r pre\\<^sub>R(F P)) ;; R1 true = (\\<not>\\<^sub>r pre\\<^sub>R(F P))\"\n      by (simp add: NCSP_Healthy_subset_member NCSP_implies_NSRD NSRD_neg_pre_unit assms)\n    thus ?thesis\n      apply (simp add: False preR_EXTCHOICE closure NCSP_set_unrest_pre_wait' assms not_UINF seq_UINF_distr not_USUP)\n      apply (rule USUP_cong)\n      apply (simp add: rpred assms closure)\n      done\n  qed\n  have 2: \"$st\\<acute> \\<sharp> peri\\<^sub>R (EXTCHOICE A F)\"\n  proof -\n    have a: \"\\<And> P. P \\<in> A \\<Longrightarrow> $st\\<acute> \\<sharp> pre\\<^sub>R(F P)\"\n      by (simp add: NCSP_Healthy_subset_member NCSP_implies_NSRD NSRD_st'_unrest_pre assms)\n    have b: \"\\<And> P. P \\<in> A \\<Longrightarrow> $st\\<acute> \\<sharp> peri\\<^sub>R(F P)\"\n      by (simp add: NCSP_Healthy_subset_member NCSP_implies_NSRD NSRD_st'_unrest_peri assms)\n    from a b show ?thesis\n      apply (subst periR_ExtChoice)\n        apply (simp_all add: assms closure unrest CSP4_set_unrest_pre_st' NCSP_set_unrest_pre_wait' False) \n      done\n  qed\n  have 3: \"$ref\\<acute> \\<sharp> post\\<^sub>R (EXTCHOICE A F)\"\n  proof -\n    have a: \"\\<And> P. P \\<in> A \\<Longrightarrow> $ref\\<acute> \\<sharp> pre\\<^sub>R(F P)\"\n      by (simp add: CSP4_ref'_unrest_pre assms closure)\n    have b: \"\\<And> P. P \\<in> A \\<Longrightarrow> $ref\\<acute> \\<sharp> post\\<^sub>R(F P)\"\n      by (simp add: CSP4_ref'_unrest_post assms closure)\n    from a b show ?thesis\n      by (subst postR_ExtChoice, simp_all add: assms CSP4_set_unrest_pre_st' NCSP_set_unrest_pre_wait' unrest False)\n  qed\n  show ?thesis\n    by (rule CSP4_tri_intro, simp_all add: 1 2 3 assms closure)\n       (metis \"1\" R1_seqr_closure rea_not_R1 rea_not_not rea_true_R1)\nqed\n\nlemma CSP4_extChoice [closure]:\n  assumes \"P is NCSP\" \"Q is NCSP\"\n  shows \"P \\<box> Q is CSP4\"\n  by (simp add: extChoice_def, rule CSP4_ExtChoice, auto simp add: assms)\n\nlemma NCSP_ExtChoice [closure]:\n  assumes \"\\<And> i. i\\<in>A \\<Longrightarrow> F i is NCSP\"\n  shows \"EXTCHOICE A F is NCSP\"\nproof (cases \"A = {}\")\n  case True\n  then show ?thesis by (simp add: ExtChoice_empty closure)\nnext\n  case False\n  show ?thesis\n  proof (rule NCSP_intro)\n    show 1:\"EXTCHOICE A F is CSP\"\n      by (metis (mono_tags) CSP_ExtChoice)\n    show \"EXTCHOICE A F is CSP3\"\n      by (rule_tac CSP3_SRD_intro, simp_all add: CSP_Healthy_subset_member CSP3_Healthy_subset_member closure rdes unrest assms 1 False) \n    show \"EXTCHOICE A F is CSP4\"\n      by (simp add: CSP4_ExtChoice assms)\n  qed\nqed\n\nlemma ExtChoice_NCSP_closed [closure]:\n  assumes \"\\<And> i. i \\<in> I \\<Longrightarrow> P(i) is NCSP\"\n  shows \"(\\<box> i\\<in>I \\<bullet> P(i)) is NCSP\"\n  by (simp add: NCSP_ExtChoice assms image_subset_iff)\n\nlemma NCSP_extChoice [closure]:\n  assumes \"P is NCSP\" \"Q is NCSP\"\n  shows \"P \\<box> Q is NCSP\"\n  unfolding extChoice_def\n  by (auto intro: NCSP_ExtChoice simp add: assms)\n\nsubsection \\<open> Productivity and Guardedness \\<close>\n\nlemma Productive_ExtChoice [closure]:\n  assumes \"\\<And> i. i \\<in> I \\<Longrightarrow> P(i) is NCSP\" \"\\<And> i. i \\<in> I \\<Longrightarrow> P(i) is Productive\"\n  shows \"EXTCHOICE I P is Productive\"\nproof (cases \"I = {}\")\n  case True\n  then show ?thesis\n    by (simp add: ExtChoice_empty Productive_Stop)\nnext\n  case False\n  have 1: \"\\<And> i. i \\<in> I \\<Longrightarrow> $wait\\<acute> \\<sharp> pre\\<^sub>R(P i)\"\n    using NCSP_implies_NSRD NSRD_wait'_unrest_pre assms(1) by blast\n\n  show ?thesis\n  proof (rule Productive_intro, simp_all add: assms closure rdes unrest 1 False)\n    have \"((\\<Squnion> i\\<in>I \\<bullet> pre\\<^sub>R (P i)) \\<and> (\\<Sqinter> i\\<in>I \\<bullet> post\\<^sub>R (P i))) =\n          ((\\<Squnion> i\\<in>I \\<bullet> pre\\<^sub>R (P i)) \\<and> (\\<Sqinter> i\\<in>I \\<bullet> (pre\\<^sub>R (P i) \\<and> post\\<^sub>R (P i))))\"\n      by (rel_auto)\n    moreover have \"(\\<Sqinter> i\\<in>I \\<bullet> (pre\\<^sub>R (P i) \\<and> post\\<^sub>R (P i))) = (\\<Sqinter> i\\<in>I \\<bullet> ((pre\\<^sub>R (P i) \\<and> post\\<^sub>R (P i)) \\<and> $tr <\\<^sub>u $tr\\<acute>))\"\n      by (rule UINF_cong, metis (no_types, lifting) \"1\" NCSP_implies_CSP Productive_post_refines_tr_increase assms utp_pred_laws.inf.absorb1)\n\n    ultimately show \"U($tr < $tr\\<acute>) \\<sqsubseteq> ((\\<Squnion> i\\<in>I \\<bullet> pre\\<^sub>R (P i)) \\<and> ((\\<Sqinter> i\\<in>I \\<bullet> post\\<^sub>R (P i))))\"\n      by (rel_auto)\n  qed\nqed\n\nlemma Productive_extChoice [closure]:\n  assumes \"P is NCSP\" \"Q is NCSP\" \"P is Productive\" \"Q is Productive\"\n  shows \"P \\<box> Q is Productive\"\n  unfolding extChoice_def\n  by (auto intro: Productive_ExtChoice simp add: assms)\n\nlemma ExtChoice_Guarded [closure]:\n  assumes  \"\\<And> P. P \\<in> A \\<Longrightarrow> Guarded P\"\n  shows \"Guarded (\\<lambda> X. \\<box>P\\<in>A \\<bullet> P(X))\"\nproof (rule GuardedI)\n  fix X n\n  have \"\\<And> Y. ((\\<box>P\\<in>A \\<bullet> P Y) \\<and> gvrt(n+1)) = ((\\<box>P\\<in>A \\<bullet> (P Y \\<and> gvrt(n+1))) \\<and> gvrt(n+1))\"\n  proof -\n    fix Y\n    let ?lhs = \"((\\<box>P\\<in>A \\<bullet> P Y) \\<and> gvrt(n+1))\" and ?rhs = \"((\\<box>P\\<in>A \\<bullet> (P Y \\<and> gvrt(n+1))) \\<and> gvrt(n+1))\"\n    have a:\"?lhs\\<lbrakk>false/$ok\\<rbrakk> = ?rhs\\<lbrakk>false/$ok\\<rbrakk>\"\n      by (rel_auto)\n    have b:\"?lhs\\<lbrakk>true/$ok\\<rbrakk>\\<lbrakk>true/$wait\\<rbrakk> = ?rhs\\<lbrakk>true/$ok\\<rbrakk>\\<lbrakk>true/$wait\\<rbrakk>\"\n      by (rel_auto)\n    have c:\"?lhs\\<lbrakk>true/$ok\\<rbrakk>\\<lbrakk>false/$wait\\<rbrakk> = ?rhs\\<lbrakk>true/$ok\\<rbrakk>\\<lbrakk>false/$wait\\<rbrakk>\"\n      by (simp add: ExtChoice_def RHS_def R1_def R2c_def R2s_def R3h_def design_def usubst unrest, rel_blast)\n    show \"?lhs = ?rhs\"\n      using a b c\n      by (rule_tac bool_eq_splitI[of \"in_var ok\"], simp, rule_tac bool_eq_splitI[of \"in_var wait\"], simp_all)\n  qed\n  moreover have \"((\\<box>P\\<in>A \\<bullet> (P X \\<and> gvrt(n+1))) \\<and> gvrt(n+1)) =  ((\\<box>P\\<in>A \\<bullet> (P (X \\<and> gvrt(n)) \\<and> gvrt(n+1))) \\<and> gvrt(n+1))\"\n  proof -\n    have \"(\\<box>P\\<in>A \\<bullet> (P X \\<and> gvrt(n+1))) = (\\<box>P\\<in>A \\<bullet> (P (X \\<and> gvrt(n)) \\<and> gvrt(n+1)))\"\n    proof (rule ExtChoice_cong)\n      fix P assume \"P \\<in> A\"\n      thus \"(P X \\<and> gvrt(n+1)) = (P (X \\<and> gvrt(n)) \\<and> gvrt(n+1))\"\n        using Guarded_def assms by blast\n    qed\n    thus ?thesis by simp\n  qed\n  ultimately show \"((\\<box>P\\<in>A \\<bullet> P X) \\<and> gvrt(n+1)) = ((\\<box>P\\<in>A \\<bullet> (P (X \\<and> gvrt(n)))) \\<and> gvrt(n+1))\"\n    by simp\nqed\n\nlemma ExtChoice_image: \"ExtChoice (P ` A) = EXTCHOICE A P\"\n  by (rel_auto)\n\nlemma extChoice_Guarded [closure]:\n  assumes \"Guarded P\" \"Guarded Q\"\n  shows \"Guarded (\\<lambda> X. P(X) \\<box> Q(X))\"\nproof -\n  have \"Guarded (\\<lambda> X. \\<box>F\\<in>{P,Q} \\<bullet> F(X))\"\n    by (rule ExtChoice_Guarded, auto simp add: assms)\n  thus ?thesis\n    by (subst (asm) ExtChoice_image[THEN sym], simp add: extChoice_def)\nqed\n\nsubsection \\<open> Algebraic laws \\<close>\n\nlemma extChoice_comm:\n  \"P \\<box> Q = Q \\<box> P\"\n  by (unfold extChoice_def, simp add: insert_commute)\n\nlemma extChoice_idem:\n  \"P is CSP \\<Longrightarrow> P \\<box> P = P\"\n  by (unfold extChoice_def, simp add: ExtChoice_single)\n\nlemma extChoice_assoc:\n  assumes \"P is CSP\" \"Q is CSP\" \"R is CSP\"\n  shows \"P \\<box> Q \\<box> R = P \\<box> (Q \\<box> R)\"\nproof -\n  have \"P \\<box> Q \\<box> R = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) \\<box> \\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\<turnstile> cmt\\<^sub>R(Q)) \\<box> \\<^bold>R\\<^sub>s(pre\\<^sub>R(R) \\<turnstile> cmt\\<^sub>R(R))\"\n    by (simp add: SRD_reactive_design_alt assms(1) assms(2) assms(3))\n  also have \"... =\n    \\<^bold>R\\<^sub>s (((pre\\<^sub>R P \\<and> pre\\<^sub>R Q) \\<and> pre\\<^sub>R R) \\<turnstile>\n          (((cmt\\<^sub>R P \\<and> cmt\\<^sub>R Q) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (cmt\\<^sub>R P \\<or> cmt\\<^sub>R Q) \\<and> cmt\\<^sub>R R)\n              \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n           ((cmt\\<^sub>R P \\<and> cmt\\<^sub>R Q) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (cmt\\<^sub>R P \\<or> cmt\\<^sub>R Q) \\<or> cmt\\<^sub>R R)))\"\n    by (simp add: extChoice_rdes unrest)\n  also have \"... =\n    \\<^bold>R\\<^sub>s (((pre\\<^sub>R P \\<and> pre\\<^sub>R Q) \\<and> pre\\<^sub>R R) \\<turnstile>\n          (((cmt\\<^sub>R P \\<and> cmt\\<^sub>R Q) \\<and> cmt\\<^sub>R R)\n              \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n            ((cmt\\<^sub>R P \\<or> cmt\\<^sub>R Q) \\<or> cmt\\<^sub>R R)))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  also have \"... =\n    \\<^bold>R\\<^sub>s ((pre\\<^sub>R P \\<and> pre\\<^sub>R Q \\<and> pre\\<^sub>R R) \\<turnstile>\n          ((cmt\\<^sub>R P \\<and> (cmt\\<^sub>R Q \\<and> cmt\\<^sub>R R) )\n              \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n           (cmt\\<^sub>R P \\<or> (cmt\\<^sub>R Q \\<or> cmt\\<^sub>R R))))\"\n    by (simp add: conj_assoc disj_assoc)\n  also have \"... =\n    \\<^bold>R\\<^sub>s ((pre\\<^sub>R P \\<and> pre\\<^sub>R Q \\<and> pre\\<^sub>R R) \\<turnstile>\n          ((cmt\\<^sub>R P \\<and> (cmt\\<^sub>R Q \\<and> cmt\\<^sub>R R) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (cmt\\<^sub>R Q \\<or> cmt\\<^sub>R R))\n              \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n           (cmt\\<^sub>R P \\<or> (cmt\\<^sub>R Q \\<and> cmt\\<^sub>R R) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (cmt\\<^sub>R Q \\<or> cmt\\<^sub>R R))))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) \\<box> (\\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\<turnstile> cmt\\<^sub>R(Q)) \\<box> \\<^bold>R\\<^sub>s(pre\\<^sub>R(R) \\<turnstile> cmt\\<^sub>R(R)))\"\n    by (simp add: extChoice_rdes unrest)\n  also have \"... = P \\<box> (Q \\<box> R)\"\n    by (simp add: SRD_reactive_design_alt assms(1) assms(2) assms(3))\n  finally show ?thesis .\nqed\n\nlemma extChoice_Stop:\n  assumes \"Q is CSP\"\n  shows \"Stop \\<box> Q = Q\"\n  using assms\nproof -\n  have \"Stop \\<box> Q = \\<^bold>R\\<^sub>s (true \\<turnstile> ($tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute>)) \\<box> \\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\<turnstile> cmt\\<^sub>R(Q))\"\n    by (simp add: Stop_def SRD_reactive_design_alt assms)\n  also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R Q \\<turnstile> ((($tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute>) \\<and> cmt\\<^sub>R Q) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> ($tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<or> cmt\\<^sub>R Q)))\"\n    by (simp add: extChoice_rdes unrest)\n  also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R Q \\<turnstile> (cmt\\<^sub>R Q \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> cmt\\<^sub>R Q))\"\n    by (metis (no_types, lifting) cond_def eq_upred_sym neg_conj_cancel1 utp_pred_laws.inf.left_idem)\n  also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R Q \\<turnstile> cmt\\<^sub>R Q)\"\n    by (simp add: cond_idem)\n  also have \"... = Q\"\n    by (simp add: SRD_reactive_design_alt assms)\n  finally show ?thesis .\nqed\n\nlemma extChoice_Chaos:\n  assumes \"Q is CSP\"\n  shows \"Chaos \\<box> Q = Chaos\"\nproof -\n  have \"Chaos \\<box> Q = \\<^bold>R\\<^sub>s (false \\<turnstile> true) \\<box> \\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\<turnstile> cmt\\<^sub>R(Q))\"\n    by (simp add: Chaos_def SRD_reactive_design_alt assms)\n  also have \"... = \\<^bold>R\\<^sub>s (false \\<turnstile> (cmt\\<^sub>R Q \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> true))\"\n    by (simp add: extChoice_rdes unrest)\n  also have \"... = \\<^bold>R\\<^sub>s (false \\<turnstile> true)\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  also have \"... = Chaos\"\n    by (simp add: Chaos_def)\n  finally show ?thesis .\nqed\n\nlemma extChoice_Dist:\n  assumes \"P is CSP\" \"S \\<subseteq> \\<lbrakk>CSP\\<rbrakk>\\<^sub>H\" \"S \\<noteq> {}\"\n  shows \"P \\<box> (\\<Sqinter> S) = (\\<Sqinter> Q\\<in>S. P \\<box> Q)\"\nproof -\n  let ?S1 = \"pre\\<^sub>R ` S\" and ?S2 = \"cmt\\<^sub>R ` S\"\n  have \"P \\<box> (\\<Sqinter> S) = P \\<box> (\\<Sqinter> Q\\<in>S \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\<turnstile> cmt\\<^sub>R(Q)))\"\n    by (simp add: SRD_as_reactive_design[THEN sym] Healthy_SUPREMUM UINF_as_Sup_collect assms)\n  also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) \\<box> \\<^bold>R\\<^sub>s((\\<Squnion> Q \\<in> S \\<bullet> pre\\<^sub>R(Q)) \\<turnstile> (\\<Sqinter> Q \\<in> S \\<bullet> cmt\\<^sub>R(Q)))\"\n    by (simp add: RHS_design_USUP SRD_reactive_design_alt assms)\n  also have \"... = \\<^bold>R\\<^sub>s ((pre\\<^sub>R(P) \\<and> (\\<Squnion> Q \\<in> S \\<bullet> pre\\<^sub>R(Q))) \\<turnstile>\n                       ((cmt\\<^sub>R(P) \\<and> (\\<Sqinter> Q \\<in> S \\<bullet> cmt\\<^sub>R(Q)))\n                         \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright>\n                        (cmt\\<^sub>R(P) \\<or> (\\<Sqinter> Q \\<in> S \\<bullet> cmt\\<^sub>R(Q)))))\"\n    by (simp add: extChoice_rdes unrest)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<Squnion> Q\\<in>S \\<bullet> pre\\<^sub>R P \\<and> pre\\<^sub>R Q) \\<turnstile>\n                       (\\<Sqinter> Q\\<in>S \\<bullet> (cmt\\<^sub>R P \\<and> cmt\\<^sub>R Q) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (cmt\\<^sub>R P \\<or> cmt\\<^sub>R Q)))\"\n    by (simp add: conj_USUP_dist conj_UINF_dist disj_UINF_dist cond_UINF_dist assms)\n  also have \"... = (\\<Sqinter> Q \\<in> S \\<bullet> \\<^bold>R\\<^sub>s ((pre\\<^sub>R P \\<and> pre\\<^sub>R Q) \\<turnstile>\n                                  ((cmt\\<^sub>R P \\<and> cmt\\<^sub>R Q) \\<triangleleft> $tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<triangleright> (cmt\\<^sub>R P \\<or> cmt\\<^sub>R Q))))\"\n    by (simp add: assms RHS_design_USUP)\n  also have \"... = (\\<Sqinter> Q\\<in>S \\<bullet> \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> cmt\\<^sub>R(P)) \\<box> \\<^bold>R\\<^sub>s(pre\\<^sub>R(Q) \\<turnstile> cmt\\<^sub>R(Q)))\"\n    by (simp add: extChoice_rdes unrest)\n  also have \"... = (\\<Sqinter> Q\\<in>S. P \\<box> CSP(Q))\"\n    by (simp add: UINF_as_Sup_collect, metis (no_types, lifting) Healthy_if SRD_as_reactive_design assms(1))\n  also have \"... = (\\<Sqinter> Q\\<in>S. P \\<box> Q)\"\n    by (rule SUP_cong, simp_all add: Healthy_subset_member[OF assms(2)])\n  finally show ?thesis .\nqed\n\nlemma extChoice_dist:\n  assumes \"P is CSP\" \"Q is CSP\" \"R is CSP\"\n  shows \"P \\<box> (Q \\<sqinter> R) = (P \\<box> Q) \\<sqinter> (P \\<box> R)\"\n  using assms extChoice_Dist[of P \"{Q, R}\"] by simp\n\nlemma ExtChoice_seq_distr:\n  assumes \"\\<And> i. i \\<in> A \\<Longrightarrow> P i is PCSP\" \"Q is NCSP\"\n  shows \"(\\<box> i\\<in>A \\<bullet> P i) ;; Q = (\\<box> i\\<in>A \\<bullet> P i ;; Q)\"\nproof (cases \"A = {}\")\n  case True\n  then show ?thesis \n    by (simp add: ExtChoice_empty NCSP_implies_CSP Stop_left_zero assms(2))\nnext\n  case False\n  show ?thesis\n  proof -\n    have 1:\"(\\<box> i\\<in>A \\<bullet> P i) = (\\<box> i\\<in>A \\<bullet> (\\<^bold>R\\<^sub>s ((pre\\<^sub>R (P i)) \\<turnstile> peri\\<^sub>R (P i) \\<diamondop> (R4(post\\<^sub>R (P i))))))\"\n      (is \"?X = ?Y\")\n      by (rule ExtChoice_cong, metis (no_types, opaque_lifting) R4_def Healthy_if NCSP_implies_CSP PCSP_implies_NCSP Productive_form assms(1) comp_apply)\n    have 2:\"(\\<box> i\\<in>A \\<bullet> P i ;; Q) = (\\<box> i\\<in>A \\<bullet> (\\<^bold>R\\<^sub>s ((pre\\<^sub>R (P i)) \\<turnstile> peri\\<^sub>R (P i) \\<diamondop> (R4(post\\<^sub>R (P i))))) ;; Q)\"\n      (is \"?X = ?Y\")\n      by (rule ExtChoice_cong, metis (no_types, opaque_lifting) R4_def Healthy_if NCSP_implies_CSP PCSP_implies_NCSP Productive_form assms(1) comp_apply)\n    show ?thesis\n      by (simp add: 1 2, rdes_eq cls: assms False cong: ExtChoice_cong USUP_cong)\n  qed\nqed\n\nlemma extChoice_seq_distr:\n  assumes \"P is PCSP\" \"Q is PCSP\" \"R is NCSP\"\n  shows \"(P \\<box> Q) ;; R = (P ;; R \\<box> Q ;; R)\"\n  by (rdes_eq' cls: assms)\n\nlemma extChoice_seq_distl:\n  assumes \"P is ICSP\" \"Q is ICSP\" \"R is NCSP\"\n  shows \"P ;; (Q \\<box> R) = (P ;; Q \\<box> P ;; R)\"\n  by (rdes_eq cls: assms)\n\nlemma extchoice_StateInvR_refine:\n  assumes \n    \"P is NCSP\" \"Q is NCSP\"\n    \"sinv\\<^sub>R(b) \\<sqsubseteq> P\" \"sinv\\<^sub>R(b) \\<sqsubseteq> Q\"\n  shows \"sinv\\<^sub>R(b) \\<sqsubseteq> P \\<box> Q\"\nproof -\n  have \"P is R2\" \"Q is R2\" by (simp_all add: closure assms)\n  hence 1:\n    \"pre\\<^sub>R P \\<sqsubseteq> [b]\\<^sub>S\\<^sub><\" \"[b]\\<^sub>S\\<^sub>> \\<sqsubseteq> ([b]\\<^sub>S\\<^sub>< \\<and> post\\<^sub>R P)\"\n    \"pre\\<^sub>R Q \\<sqsubseteq> [b]\\<^sub>S\\<^sub><\" \"[b]\\<^sub>S\\<^sub>> \\<sqsubseteq> ([b]\\<^sub>S\\<^sub>< \\<and> post\\<^sub>R Q)\"\n    by (metis (no_types, lifting) CRR_implies_RR NCSP_implies_CSP RHS_tri_design_refine SRD_reactive_tri_design StateInvR_def assms periR_RR postR_RR preR_CRR rea_st_cond_RR rea_true_RR refBy_order st_post_CRR)+\n  show ?thesis\n    by (rdes_refine_split cls: assms(1-2), simp_all add: 1 closure assms truer_bottom_rpred  utp_pred_laws.inf_sup_distrib1)\nqed\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/sf_rdes/utp_sfrd_extchoice.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3334348735163587}}
{"text": "(*  Title:      HOL/Library/BNF_Corec.thy\n    Author:     Jasmin Blanchette, Inria, LORIA, MPII\n    Author:     Aymeric Bouzy, Ecole polytechnique\n    Author:     Dmitriy Traytel, ETH Zurich\n    Copyright   2015, 2016\n\nGeneralized corecursor sugar (\"corec\" and friends).\n*)\n\nsection \\<open>Generalized Corecursor Sugar (corec and friends)\\<close>\n\ntheory BNF_Corec\nimports MainRLT\nkeywords\n  \"corec\" :: thy_defn and\n  \"corecursive\" :: thy_goal_defn and\n  \"friend_of_corec\" :: thy_goal_defn and\n  \"coinduction_upto\" :: thy_decl\nbegin\n\nlemma obj_distinct_prems: \"P \\<longrightarrow> P \\<longrightarrow> Q \\<Longrightarrow> P \\<Longrightarrow> Q\"\n  by auto\n\nlemma inject_refine: \"g (f x) = x \\<Longrightarrow> g (f y) = y \\<Longrightarrow> f x = f y \\<longleftrightarrow> x = y\"\n  by (metis (no_types))\n\nlemma convol_apply: \"BNF_Def.convol f g x = (f x, g x)\"\n  unfolding convol_def ..\n\nlemma Grp_UNIV_id: \"BNF_Def.Grp UNIV id = (=)\"\n  unfolding BNF_Def.Grp_def by auto\n\nlemma sum_comp_cases:\n  assumes \"f \\<circ> Inl = g \\<circ> Inl\" and \"f \\<circ> Inr = g \\<circ> Inr\"\n  shows \"f = g\"\nproof (rule ext)\n  fix a show \"f a = g a\"\n    using assms unfolding comp_def fun_eq_iff by (cases a) auto\nqed\n\nlemma case_sum_Inl_Inr_L: \"case_sum (f \\<circ> Inl) (f \\<circ> Inr) = f\"\n  by (metis case_sum_expand_Inr')\n\nlemma eq_o_InrI: \"\\<lbrakk>g \\<circ> Inl = h; case_sum h f = g\\<rbrakk> \\<Longrightarrow> f = g \\<circ> Inr\"\n  by (auto simp: fun_eq_iff split: sum.splits)\n\nlemma id_bnf_o: \"BNF_Composition.id_bnf \\<circ> f = f\"\n  unfolding BNF_Composition.id_bnf_def by (rule o_def)\n\nlemma o_id_bnf: \"f \\<circ> BNF_Composition.id_bnf = f\"\n  unfolding BNF_Composition.id_bnf_def by (rule o_def)\n\nlemma if_True_False:\n  \"(if P then True else Q) \\<longleftrightarrow> P \\<or> Q\"\n  \"(if P then False else Q) \\<longleftrightarrow> \\<not> P \\<and> Q\"\n  \"(if P then Q else True) \\<longleftrightarrow> \\<not> P \\<or> Q\"\n  \"(if P then Q else False) \\<longleftrightarrow> P \\<and> Q\"\n  by auto\n\nlemma if_distrib_fun: \"(if c then f else g) x = (if c then f x else g x)\"\n  by simp\n\n\nsubsection \\<open>Coinduction\\<close>\n\nlemma eq_comp_compI: \"a \\<circ> b = f \\<circ> x \\<Longrightarrow> x \\<circ> c = id \\<Longrightarrow> f = a \\<circ> (b \\<circ> c)\"\n  unfolding fun_eq_iff by simp\n\nlemma self_bounded_weaken_left: \"(a :: 'a :: semilattice_inf) \\<le> inf a b \\<Longrightarrow> a \\<le> b\"\n  by (erule le_infE)\n\nlemma self_bounded_weaken_right: \"(a :: 'a :: semilattice_inf) \\<le> inf b a \\<Longrightarrow> a \\<le> b\"\n  by (erule le_infE)\n\nlemma symp_iff: \"symp R \\<longleftrightarrow> R = R\\<inverse>\\<inverse>\"\n  by (metis antisym conversep.cases conversep_le_swap predicate2I symp_def)\n\nlemma equivp_inf: \"\\<lbrakk>equivp R; equivp S\\<rbrakk> \\<Longrightarrow> equivp (inf R S)\"\n  unfolding equivp_def inf_fun_def inf_bool_def by metis\n\nlemma vimage2p_rel_prod:\n  \"(\\<lambda>x y. rel_prod R S (BNF_Def.convol f1 g1 x) (BNF_Def.convol f2 g2 y)) =\n   (inf (BNF_Def.vimage2p f1 f2 R) (BNF_Def.vimage2p g1 g2 S))\"\n  unfolding vimage2p_def rel_prod.simps convol_def by auto\n\nlemma predicate2I_obj: \"(\\<forall>x y. P x y \\<longrightarrow> Q x y) \\<Longrightarrow> P \\<le> Q\"\n  by auto\n\nlemma predicate2D_obj: \"P \\<le> Q \\<Longrightarrow> P x y \\<longrightarrow> Q x y\"\n  by auto\n\nlocale cong =\n  fixes rel :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> ('b \\<Rightarrow> 'b \\<Rightarrow> bool)\"\n    and eval :: \"'b \\<Rightarrow> 'a\"\n    and retr :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'a \\<Rightarrow> bool)\"\n  assumes rel_mono: \"\\<And>R S. R \\<le> S \\<Longrightarrow> rel R \\<le> rel S\"\n    and equivp_retr: \"\\<And>R. equivp R \\<Longrightarrow> equivp (retr R)\"\n    and retr_eval: \"\\<And>R x y. \\<lbrakk>(rel_fun (rel R) R) eval eval; rel (inf R (retr R)) x y\\<rbrakk> \\<Longrightarrow>\n      retr R (eval x) (eval y)\"\nbegin\n\ndefinition cong :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> bool\" where\n  \"cong R \\<equiv> equivp R \\<and> (rel_fun (rel R) R) eval eval\"\n\nlemma cong_retr: \"cong R \\<Longrightarrow> cong (inf R (retr R))\"\n  unfolding cong_def\n  by (auto simp: rel_fun_def dest: predicate2D[OF rel_mono, rotated]\n    intro: equivp_inf equivp_retr retr_eval)\n\nlemma cong_equivp: \"cong R \\<Longrightarrow> equivp R\"\n  unfolding cong_def by simp\n\ndefinition gen_cong :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> bool\" where\n  \"gen_cong R j1 j2 \\<equiv> \\<forall>R'. R \\<le> R' \\<and> cong R' \\<longrightarrow> R' j1 j2\"\n\nlemma gen_cong_reflp[intro, simp]: \"x = y \\<Longrightarrow> gen_cong R x y\"\n  unfolding gen_cong_def by (auto dest: cong_equivp equivp_reflp)\n\nlemma gen_cong_symp[intro]: \"gen_cong R x y \\<Longrightarrow> gen_cong R y x\"\n  unfolding gen_cong_def by (auto dest: cong_equivp equivp_symp)\n\nlemma gen_cong_transp[intro]: \"gen_cong R x y \\<Longrightarrow> gen_cong R y z \\<Longrightarrow> gen_cong R x z\"\n  unfolding gen_cong_def by (auto dest: cong_equivp equivp_transp)\n\nlemma equivp_gen_cong: \"equivp (gen_cong R)\"\n  by (intro equivpI reflpI sympI transpI) auto\n\nlemma leq_gen_cong: \"R \\<le> gen_cong R\"\n  unfolding gen_cong_def[abs_def] by auto\n\nlemmas imp_gen_cong[intro] = predicate2D[OF leq_gen_cong]\n\nlemma gen_cong_minimal: \"\\<lbrakk>R \\<le> R'; cong R'\\<rbrakk> \\<Longrightarrow> gen_cong R \\<le> R'\"\n  unfolding gen_cong_def[abs_def] by (rule predicate2I) metis\n\nlemma congdd_base_gen_congdd_base_aux:\n  \"rel (gen_cong R) x y \\<Longrightarrow> R \\<le> R' \\<Longrightarrow> cong R' \\<Longrightarrow> R' (eval x) (eval y)\"\n   by (force simp: rel_fun_def gen_cong_def cong_def dest: spec[of _ R'] predicate2D[OF rel_mono, rotated -1, of _ _ _ R'])\n\nlemma cong_gen_cong: \"cong (gen_cong R)\"\nproof -\n  { fix R' x y\n    have \"rel (gen_cong R) x y \\<Longrightarrow> R \\<le> R' \\<Longrightarrow> cong R' \\<Longrightarrow> R' (eval x) (eval y)\"\n      by (force simp: rel_fun_def gen_cong_def cong_def dest: spec[of _ R']\n        predicate2D[OF rel_mono, rotated -1, of _ _ _ R'])\n  }\n  then show \"cong (gen_cong R)\" by (auto simp: equivp_gen_cong rel_fun_def gen_cong_def cong_def)\nqed\n\nlemma gen_cong_eval_rel_fun:\n  \"(rel_fun (rel (gen_cong R)) (gen_cong R)) eval eval\"\n  using cong_gen_cong[of R] unfolding cong_def by simp\n\nlemma gen_cong_eval:\n  \"rel (gen_cong R) x y \\<Longrightarrow> gen_cong R (eval x) (eval y)\"\n  by (erule rel_funD[OF gen_cong_eval_rel_fun])\n\nlemma gen_cong_idem: \"gen_cong (gen_cong R) = gen_cong R\"\n  by (simp add: antisym cong_gen_cong gen_cong_minimal leq_gen_cong)\n\nlemma gen_cong_rho:\n  \"\\<rho> = eval \\<circ> f \\<Longrightarrow> rel (gen_cong R) (f x) (f y) \\<Longrightarrow> gen_cong R (\\<rho> x) (\\<rho> y)\"\n  by (simp add: gen_cong_eval)\nlemma coinduction:\n  assumes coind: \"\\<forall>R. R \\<le> retr R \\<longrightarrow> R \\<le> (=)\"\n  assumes cih: \"R \\<le> retr (gen_cong R)\"\n  shows \"R \\<le> (=)\"\n  apply (rule order_trans[OF leq_gen_cong mp[OF spec[OF coind]]])\n  apply (rule self_bounded_weaken_left[OF gen_cong_minimal])\n   apply (rule inf_greatest[OF leq_gen_cong cih])\n  apply (rule cong_retr[OF cong_gen_cong])\n  done\n\nend\n\nlemma rel_sum_case_sum:\n  \"rel_fun (rel_sum R S) T (case_sum f1 g1) (case_sum f2 g2) = (rel_fun R T f1 f2 \\<and> rel_fun S T g1 g2)\"\n  by (auto simp: rel_fun_def rel_sum.simps split: sum.splits)\n\ncontext\n  fixes rel eval rel' eval' retr emb\n  assumes base: \"cong rel eval retr\"\n  and step: \"cong rel' eval' retr\"\n  and emb: \"eval' \\<circ> emb = eval\"\n  and emb_transfer: \"rel_fun (rel R) (rel' R) emb emb\"\nbegin\n\ninterpretation base: cong rel eval retr by (rule base)\ninterpretation step: cong rel' eval' retr by (rule step)\n\nlemma gen_cong_emb: \"base.gen_cong R \\<le> step.gen_cong R\"\nproof (rule base.gen_cong_minimal[OF step.leq_gen_cong])\n  note step.gen_cong_eval_rel_fun[transfer_rule] emb_transfer[transfer_rule]\n  have \"(rel_fun (rel (step.gen_cong R)) (step.gen_cong R)) eval eval\"\n    unfolding emb[symmetric] by transfer_prover\n  then show \"base.cong (step.gen_cong R)\"\n    by (auto simp: base.cong_def step.equivp_gen_cong)\nqed\n\nend\n\nnamed_theorems friend_of_corec_simps\n\nML_file \\<open>../Tools/BNF/bnf_gfp_grec_tactics.ML\\<close>\nML_file \\<open>../Tools/BNF/bnf_gfp_grec.ML\\<close>\nML_file \\<open>../Tools/BNF/bnf_gfp_grec_sugar_util.ML\\<close>\nML_file \\<open>../Tools/BNF/bnf_gfp_grec_sugar_tactics.ML\\<close>\nML_file \\<open>../Tools/BNF/bnf_gfp_grec_sugar.ML\\<close>\nML_file \\<open>../Tools/BNF/bnf_gfp_grec_unique_sugar.ML\\<close>\n\nmethod_setup transfer_prover_eq = \\<open>\n  Scan.succeed (SIMPLE_METHOD' o BNF_GFP_Grec_Tactics.transfer_prover_eq_tac)\n\\<close> \"apply transfer_prover after folding relator_eq\"\n\nmethod_setup corec_unique = \\<open>\n  Scan.succeed (SIMPLE_METHOD' o BNF_GFP_Grec_Unique_Sugar.corec_unique_tac)\n\\<close> \"prove uniqueness of corecursive equation\"\n\nend\n", "meta": {"author": "dtraytel", "repo": "HOLRLT", "sha": "e9029da59bb3af0c835604a65308498f9696a364", "save_path": "github-repos/isabelle/dtraytel-HOLRLT", "path": "github-repos/isabelle/dtraytel-HOLRLT/HOLRLT-e9029da59bb3af0c835604a65308498f9696a364/HOLRLT/Library/BNF_Corec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.3334214440681949}}
{"text": "(* Title: GPV_Bisim.thy\n  Author: Andreas Lochbihler, ETH Zurich *)\n\ntheory GPV_Bisim imports\n  GPV_Expectation\nbegin\n\nsubsection \\<open>Bisimulation for oracles\\<close>\n\ntext \\<open>Bisimulation is a consequence of parametricity\\<close>\n\nlemma exec_gpv_oracle_bisim':\n  assumes *: \"X s1 s2\"\n  and bisim: \"\\<And>s1 s2 x. X s1 s2 \\<Longrightarrow> rel_spmf (\\<lambda>(a, s1') (b, s2'). a = b \\<and> X s1' s2') (oracle1 s1 x) (oracle2 s2 x)\"\n  shows \"rel_spmf (\\<lambda>(a, s1') (b, s2'). a = b \\<and> X s1' s2') (exec_gpv oracle1 gpv s1) (exec_gpv oracle2 gpv s2)\"\nby(rule exec_gpv_parametric[of X \"(=)\" \"(=)\", unfolded gpv.rel_eq rel_prod_conv, THEN rel_funD, THEN rel_funD, THEN rel_funD, OF rel_funI refl, OF rel_funI *])(simp add: bisim)\n\nlemma exec_gpv_oracle_bisim:\n  assumes *: \"X s1 s2\"\n  and bisim: \"\\<And>s1 s2 x. X s1 s2 \\<Longrightarrow> rel_spmf (\\<lambda>(a, s1') (b, s2'). a = b \\<and> X s1' s2') (oracle1 s1 x) (oracle2 s2 x)\"\n  and R: \"\\<And>x s1' s2'. \\<lbrakk> X s1' s2'; (x, s1') \\<in> set_spmf (exec_gpv oracle1 gpv s1); (x, s2') \\<in> set_spmf (exec_gpv oracle2 gpv s2) \\<rbrakk> \\<Longrightarrow> R (x, s1') (x, s2')\"\n  shows \"rel_spmf R (exec_gpv oracle1 gpv s1) (exec_gpv oracle2 gpv s2)\"\napply(rule spmf_rel_mono_strong)\napply(rule exec_gpv_oracle_bisim'[OF * bisim])\napply(auto dest: R)\ndone\n\nlemma run_gpv_oracle_bisim:\n  assumes  \"X s1 s2\"\n  and \"\\<And>s1 s2 x. X s1 s2 \\<Longrightarrow> rel_spmf (\\<lambda>(a, s1') (b, s2'). a = b \\<and> X s1' s2') (oracle1 s1 x) (oracle2 s2 x)\"\n  shows \"run_gpv oracle1 gpv s1 = run_gpv oracle2 gpv s2\"\nusing exec_gpv_oracle_bisim'[OF assms]\nby(fold spmf_rel_eq)(fastforce simp add: spmf_rel_map intro: rel_spmf_mono)\n\ncontext\n  fixes joint_oracle :: \"('s1 \\<times> 's2) \\<Rightarrow> 'a \\<Rightarrow> (('b \\<times> 's1) \\<times> ('b \\<times> 's2)) spmf\"\n  and oracle1 :: \"'s1 \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 's1) spmf\"\n  and bad1 :: \"'s1 \\<Rightarrow> bool\"\n  and oracle2 :: \"'s2 \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 's2) spmf\"\n  and bad2 :: \"'s2 \\<Rightarrow> bool\"\nbegin\n\npartial_function (spmf) exec_until_bad :: \"('x, 'a, 'b) gpv \\<Rightarrow> 's1 \\<Rightarrow> 's2 \\<Rightarrow> (('x \\<times> 's1) \\<times> ('x \\<times> 's2)) spmf\"\nwhere\n  \"exec_until_bad gpv s1 s2 = \n  (if bad1 s1 \\<or> bad2 s2 then pair_spmf (exec_gpv oracle1 gpv s1) (exec_gpv oracle2 gpv s2)\n  else bind_spmf (the_gpv gpv) (\\<lambda>generat.\n     case generat of Pure x \\<Rightarrow> return_spmf ((x, s1), (x, s2))\n     | IO out f \\<Rightarrow> bind_spmf (joint_oracle (s1, s2) out) (\\<lambda>((x, s1'), (y, s2')). \n       if bad1 s1' \\<or> bad2 s2' then pair_spmf (exec_gpv oracle1 (f x) s1') (exec_gpv oracle2 (f y) s2')\n       else exec_until_bad (f x) s1' s2')))\"\n\nlemma exec_until_bad_fixp_induct [case_names adm bottom step]:\n  assumes \"ccpo.admissible (fun_lub lub_spmf) (fun_ord (ord_spmf (=))) (\\<lambda>f. P (\\<lambda>gpv s1 s2. f ((gpv, s1), s2)))\"\n  and \"P (\\<lambda>_ _ _. return_pmf None)\"\n  and \"\\<And>exec_until_bad'. P exec_until_bad' \\<Longrightarrow> \n     P (\\<lambda>gpv s1 s2. if bad1 s1 \\<or> bad2 s2 then pair_spmf (exec_gpv oracle1 gpv s1) (exec_gpv oracle2 gpv s2)\n     else bind_spmf (the_gpv gpv) (\\<lambda>generat.\n     case generat of Pure x \\<Rightarrow> return_spmf ((x, s1), (x, s2))\n     | IO out f \\<Rightarrow> bind_spmf (joint_oracle (s1, s2) out) (\\<lambda>((x, s1'), (y, s2')). \n       if bad1 s1' \\<or> bad2 s2' then pair_spmf (exec_gpv oracle1 (f x) s1') (exec_gpv oracle2 (f y) s2') \n       else exec_until_bad' (f x) s1' s2')))\"\n  shows \"P exec_until_bad\"\nusing assms by(rule exec_until_bad.fixp_induct[unfolded curry_conv[abs_def]])\n\nend\n\nlemma exec_gpv_oracle_bisim_bad_plossless:\n  fixes s1 :: 's1 and s2 :: 's2 and X :: \"'s1 \\<Rightarrow> 's2 \\<Rightarrow> bool\"\n  and oracle1 :: \"'s1 \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 's1) spmf\"\n  and oracle2 :: \"'s2 \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 's2) spmf\"\n  assumes *: \"if bad2 s2 then X_bad s1 s2 else X s1 s2\"\n  and bad: \"bad1 s1 = bad2 s2\"\n  and bisim: \"\\<And>s1 s2 x. \\<lbrakk> X s1 s2; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> rel_spmf (\\<lambda>(a, s1') (b, s2'). bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else a = b \\<and> X s1' s2')) (oracle1 s1 x) (oracle2 s2 x)\"\n  and bad_sticky1: \"\\<And>s2. bad2 s2 \\<Longrightarrow> callee_invariant_on oracle1 (\\<lambda>s1. bad1 s1 \\<and> X_bad s1 s2) \\<I>\"\n  and bad_sticky2: \"\\<And>s1. bad1 s1 \\<Longrightarrow> callee_invariant_on oracle2 (\\<lambda>s2. bad2 s2 \\<and> X_bad s1 s2) \\<I>\"\n  and lossless1: \"\\<And>s1 x. \\<lbrakk> bad1 s1; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> lossless_spmf (oracle1 s1 x)\"\n  and lossless2: \"\\<And>s2 x. \\<lbrakk> bad2 s2; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> lossless_spmf (oracle2 s2 x)\"\n  and lossless: \"plossless_gpv \\<I> gpv\"\n  and WT_oracle1: \"\\<And>s1. \\<I> \\<turnstile>c oracle1 s1 \\<surd>\" (* stronger than the invariants above because unconditional *)\n  and WT_oracle2: \"\\<And>s2. \\<I> \\<turnstile>c oracle2 s2 \\<surd>\"\n  and WT_gpv: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n  shows \"rel_spmf (\\<lambda>(a, s1') (b, s2'). bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else a = b \\<and> X s1' s2')) (exec_gpv oracle1 gpv s1) (exec_gpv oracle2 gpv s2)\"\n  (is \"rel_spmf ?R ?p ?q\")\nproof -\n  let ?R' = \"\\<lambda>(a, s1') (b, s2'). bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else a = b \\<and> X s1' s2')\"\n  from bisim have \"\\<forall>s1 s2. \\<forall>x \\<in> outs_\\<I> \\<I>. X s1 s2 \\<longrightarrow> rel_spmf ?R' (oracle1 s1 x) (oracle2 s2 x)\" by blast\n  then obtain joint_oracle\n    where oracle1 [symmetric]: \"\\<And>s1 s2 x. \\<lbrakk> X s1 s2; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> map_spmf fst (joint_oracle s1 s2 x) = oracle1 s1 x\"\n    and oracle2 [symmetric]: \"\\<And>s1 s2 x. \\<lbrakk> X s1 s2; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> map_spmf snd (joint_oracle s1 s2 x) = oracle2 s2 x\"\n    and 3 [rotated 2]: \"\\<And>s1 s2 x y y' s1' s2'. \\<lbrakk> X s1 s2; x \\<in> outs_\\<I> \\<I>; ((y, s1'), (y', s2')) \\<in> set_spmf (joint_oracle s1 s2 x) \\<rbrakk>\n      \\<Longrightarrow> bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else y = y' \\<and> X s1' s2')\"\n    apply atomize_elim\n    apply(unfold rel_spmf_simps all_conj_distrib[symmetric] all_simps(6) imp_conjR[symmetric])\n    apply(subst choice_iff[symmetric] ex_simps(6))+\n    apply fastforce\n    done\n  let ?joint_oracle = \"\\<lambda>(s1, s2). joint_oracle s1 s2\"\n  let ?pq = \"exec_until_bad ?joint_oracle oracle1 bad1 oracle2 bad2 gpv s1 s2\"\n\n  have setD: \"\\<And>s1 s2 x y y' s1' s2'. \\<lbrakk> X s1 s2; x \\<in> outs_\\<I> \\<I>; ((y, s1'), (y', s2')) \\<in> set_spmf (joint_oracle s1 s2 x) \\<rbrakk>\n    \\<Longrightarrow> (y, s1') \\<in> set_spmf (oracle1 s1 x) \\<and> (y', s2') \\<in> set_spmf (oracle2 s2 x)\"\n    unfolding oracle1 oracle2 by(auto intro: rev_image_eqI)\n  show ?thesis\n  proof\n    show \"map_spmf fst ?pq = exec_gpv oracle1 gpv s1\"\n    proof(rule spmf.leq_antisym)\n      show \"ord_spmf (=) (map_spmf fst ?pq) (exec_gpv oracle1 gpv s1)\" using * bad WT_gpv lossless\n      proof(induction arbitrary: s1 s2 gpv rule: exec_until_bad_fixp_induct)\n        case adm show ?case by simp\n        case bottom show ?case by simp\n        case (step exec_until_bad')\n        show ?case\n        proof(cases \"bad2 s2\")\n          case True\n          then have \"weight_spmf (exec_gpv oracle2 gpv s2) = 1\"\n            using callee_invariant_on.weight_exec_gpv[OF bad_sticky2 lossless2, of s1 gpv s2]\n              step.prems weight_spmf_le_1[of \"exec_gpv oracle2 gpv s2\"]\n            by(simp add: pgen_lossless_gpv_def weight_gpv_def)\n          then show ?thesis using True by simp\n        next\n          case False\n          hence \"\\<not> bad1 s1\" using step.prems(2) by simp\n          moreover {\n            fix out c r1 s1' r2 s2'\n            assume IO: \"IO out c \\<in> set_spmf (the_gpv gpv)\"\n              and joint: \"((r1, s1'), (r2, s2')) \\<in> set_spmf (joint_oracle s1 s2 out)\"\n            from step.prems(3) IO have out: \"out \\<in> outs_\\<I> \\<I>\" by(rule WT_gpvD)\n            from setD[OF _ out joint] step.prems(1) False\n            have 1: \"(r1, s1') \\<in> set_spmf (oracle1 s1 out)\"\n              and 2: \"(r2, s2') \\<in> set_spmf (oracle2 s2 out)\" by simp_all\n            hence r1: \"r1 \\<in> responses_\\<I> \\<I> out\" and r2: \"r2 \\<in> responses_\\<I> \\<I> out\"\n              using WT_oracle1 WT_oracle2 out by(blast dest: WT_calleeD)+\n            have *: \"plossless_gpv \\<I> (c r2)\" using step.prems(4) IO r2 step.prems(3)\n              by(rule plossless_gpv_ContD)\n            then have \"bad2 s2' \\<Longrightarrow> weight_spmf (exec_gpv oracle2 (c r2) s2') = 1\"\n              and \"\\<not> bad2 s2' \\<Longrightarrow> ord_spmf (=) (map_spmf fst (exec_until_bad' (c r2) s1' s2')) (exec_gpv oracle1 (c r2) s1')\"\n              using callee_invariant_on.weight_exec_gpv[OF bad_sticky2 lossless2, of s1' \"c r2\" s2'] \n                weight_spmf_le_1[of \"exec_gpv oracle2 (c r2) s2'\"] WT_gpv_ContD[OF step.prems(3) IO r2]\n                3[OF joint _ out] step.prems(1) False\n              by(simp_all add: pgen_lossless_gpv_def weight_gpv_def step.IH) }\n          ultimately show ?thesis using False step.prems(1)\n            by(rewrite in \"ord_spmf _ _ \\<hole>\" exec_gpv.simps)\n              (fastforce simp add: split_def bind_map_spmf map_spmf_bind_spmf oracle1 WT_gpv_OutD[OF step.prems(3)] intro!: ord_spmf_bind_reflI split!: generat.split dest: 3)\n        qed\n      qed\n      show \"ord_spmf (=) (exec_gpv oracle1 gpv s1) (map_spmf fst ?pq)\" using * bad WT_gpv lossless\n      proof(induction arbitrary: gpv s1 s2 rule: exec_gpv_fixp_induct_strong)\n        case adm show ?case by simp\n        case bottom show ?case by simp\n        case (step exec_gpv')\n        then show ?case\n        proof(cases \"bad2 s2\")\n          case True\n          then have \"weight_spmf (exec_gpv oracle2 gpv s2) = 1\"\n            using callee_invariant_on.weight_exec_gpv[OF bad_sticky2 lossless2, of s1 gpv s2]\n              step.prems weight_spmf_le_1[of \"exec_gpv oracle2 gpv s2\"]\n            by(simp add: pgen_lossless_gpv_def weight_gpv_def)\n          then show ?thesis using True\n            by(rewrite exec_until_bad.simps; rewrite exec_gpv.simps)\n              (clarsimp intro!: ord_spmf_bind_reflI split!: generat.split simp add: step.hyps)\n        next\n          case False\n          hence \"\\<not> bad1 s1\" using step.prems(2) by simp\n          moreover {\n            fix out c r1 s1' r2 s2'\n            assume IO: \"IO out c \\<in> set_spmf (the_gpv gpv)\"\n              and joint: \"((r1, s1'), (r2, s2')) \\<in> set_spmf (joint_oracle s1 s2 out)\"\n            from step.prems(3) IO have out: \"out \\<in> outs_\\<I> \\<I>\" by(rule WT_gpvD)\n            from setD[OF _ out joint] step.prems(1) False\n            have 1: \"(r1, s1') \\<in> set_spmf (oracle1 s1 out)\"\n              and 2: \"(r2, s2') \\<in> set_spmf (oracle2 s2 out)\" by simp_all\n            hence r1: \"r1 \\<in> responses_\\<I> \\<I> out\" and r2: \"r2 \\<in> responses_\\<I> \\<I> out\"\n              using WT_oracle1 WT_oracle2 out by(blast dest: WT_calleeD)+\n            have *: \"plossless_gpv \\<I> (c r2)\" using step.prems(4) IO r2 step.prems(3)\n              by(rule plossless_gpv_ContD)\n            then have \"bad2 s2' \\<Longrightarrow> weight_spmf (exec_gpv oracle2 (c r2) s2') = 1\" \n              and \"\\<not> bad2 s2' \\<Longrightarrow> ord_spmf (=) (exec_gpv' (c r2) s1') (map_spmf fst (exec_until_bad (\\<lambda>(x, y). joint_oracle x y) oracle1 bad1 oracle2 bad2 (c r2) s1' s2'))\"\n              using callee_invariant_on.weight_exec_gpv[OF bad_sticky2 lossless2, of s1' \"c r2\" s2'] \n                weight_spmf_le_1[of \"exec_gpv oracle2 (c r2) s2'\"] WT_gpv_ContD[OF step.prems(3) IO r2]\n                3[OF joint _ out] step.prems(1) False\n              by(simp_all add: pgen_lossless_gpv_def weight_gpv_def step.IH) }\n          ultimately show ?thesis using False step.prems(1)\n            by(rewrite exec_until_bad.simps)\n              (fastforce simp add: map_spmf_bind_spmf WT_gpv_OutD[OF step.prems(3)] oracle1 bind_map_spmf step.hyps intro!: ord_spmf_bind_reflI split!: generat.split dest: 3)\n        qed\n      qed\n    qed\n\n    show \"map_spmf snd ?pq = exec_gpv oracle2 gpv s2\"\n    proof(rule spmf.leq_antisym)\n      show \"ord_spmf (=) (map_spmf snd ?pq) (exec_gpv oracle2 gpv s2)\" using * bad WT_gpv lossless\n      proof(induction arbitrary: s1 s2 gpv rule: exec_until_bad_fixp_induct)\n        case adm show ?case by simp\n        case bottom show ?case by simp\n        case (step exec_until_bad')\n        show ?case\n        proof(cases \"bad2 s2\")\n          case True\n          then have \"weight_spmf (exec_gpv oracle1 gpv s1) = 1\"\n            using callee_invariant_on.weight_exec_gpv[OF bad_sticky1 lossless1, of s2 gpv s1]\n              step.prems weight_spmf_le_1[of \"exec_gpv oracle1 gpv s1\"]\n            by(simp add: pgen_lossless_gpv_def weight_gpv_def)\n          then show ?thesis using True by simp\n        next\n          case False\n          hence \"\\<not> bad1 s1\" using step.prems(2) by simp\n          moreover {\n            fix out c r1 s1' r2 s2'\n            assume IO: \"IO out c \\<in> set_spmf (the_gpv gpv)\"\n              and joint: \"((r1, s1'), (r2, s2')) \\<in> set_spmf (joint_oracle s1 s2 out)\"\n            from step.prems(3) IO have out: \"out \\<in> outs_\\<I> \\<I>\" by(rule WT_gpvD)\n            from setD[OF _ out joint] step.prems(1) False\n            have 1: \"(r1, s1') \\<in> set_spmf (oracle1 s1 out)\"\n              and 2: \"(r2, s2') \\<in> set_spmf (oracle2 s2 out)\" by simp_all\n            hence r1: \"r1 \\<in> responses_\\<I> \\<I> out\" and r2: \"r2 \\<in> responses_\\<I> \\<I> out\"\n              using WT_oracle1 WT_oracle2 out by(blast dest: WT_calleeD)+\n            have *: \"plossless_gpv \\<I> (c r1)\" using step.prems(4) IO r1 step.prems(3)\n              by(rule plossless_gpv_ContD)\n            then have \"bad2 s2' \\<Longrightarrow> weight_spmf (exec_gpv oracle1 (c r1) s1') = 1\"\n              and \"\\<not> bad2 s2' \\<Longrightarrow> ord_spmf (=) (map_spmf snd (exec_until_bad' (c r2) s1' s2')) (exec_gpv oracle2 (c r2) s2')\"\n              using callee_invariant_on.weight_exec_gpv[OF bad_sticky1 lossless1, of s2' \"c r1\" s1'] \n                weight_spmf_le_1[of \"exec_gpv oracle1 (c r1) s1'\"] WT_gpv_ContD[OF step.prems(3) IO r1]\n                3[OF joint _ out] step.prems(1) False\n              by(simp_all add: pgen_lossless_gpv_def weight_gpv_def step.IH) }\n          ultimately show ?thesis using False step.prems(1)\n            by(rewrite in \"ord_spmf _ _ \\<hole>\" exec_gpv.simps)\n              (fastforce simp add: split_def bind_map_spmf map_spmf_bind_spmf oracle2 WT_gpv_OutD[OF step.prems(3)] intro!: ord_spmf_bind_reflI split!: generat.split dest: 3)\n        qed\n      qed\n      show \"ord_spmf (=) (exec_gpv oracle2 gpv s2) (map_spmf snd ?pq)\" using * bad WT_gpv lossless\n      proof(induction arbitrary: gpv s1 s2 rule: exec_gpv_fixp_induct_strong)\n        case adm show ?case by simp\n        case bottom show ?case by simp\n        case (step exec_gpv')\n        then show ?case\n        proof(cases \"bad2 s2\")\n          case True\n          then have \"weight_spmf (exec_gpv oracle1 gpv s1) = 1\"\n            using callee_invariant_on.weight_exec_gpv[OF bad_sticky1 lossless1, of s2 gpv s1]\n              step.prems weight_spmf_le_1[of \"exec_gpv oracle1 gpv s1\"]\n            by(simp add: pgen_lossless_gpv_def weight_gpv_def)\n          then show ?thesis using True\n            by(rewrite exec_until_bad.simps; subst (2) exec_gpv.simps)\n              (clarsimp intro!: ord_spmf_bind_reflI split!: generat.split simp add: step.hyps)\n        next\n          case False\n          hence \"\\<not> bad1 s1\" using step.prems(2) by simp\n          moreover {\n            fix out c r1 s1' r2 s2'\n            assume IO: \"IO out c \\<in> set_spmf (the_gpv gpv)\"\n              and joint: \"((r1, s1'), (r2, s2')) \\<in> set_spmf (joint_oracle s1 s2 out)\"\n            from step.prems(3) IO have out: \"out \\<in> outs_\\<I> \\<I>\" by(rule WT_gpvD)\n            from setD[OF _ out joint] step.prems(1) False\n            have 1: \"(r1, s1') \\<in> set_spmf (oracle1 s1 out)\"\n              and 2: \"(r2, s2') \\<in> set_spmf (oracle2 s2 out)\" by simp_all\n            hence r1: \"r1 \\<in> responses_\\<I> \\<I> out\" and r2: \"r2 \\<in> responses_\\<I> \\<I> out\"\n              using WT_oracle1 WT_oracle2 out by(blast dest: WT_calleeD)+\n            have *: \"plossless_gpv \\<I> (c r1)\" using step.prems(4) IO r1 step.prems(3)\n              by(rule plossless_gpv_ContD)\n            then have \"bad2 s2' \\<Longrightarrow> weight_spmf (exec_gpv oracle1 (c r1) s1') = 1\" \n              and \"\\<not> bad2 s2' \\<Longrightarrow> ord_spmf (=) (exec_gpv' (c r2) s2') (map_spmf snd (exec_until_bad (\\<lambda>(x, y). joint_oracle x y) oracle1 bad1 oracle2 bad2 (c r2) s1' s2'))\"\n              using callee_invariant_on.weight_exec_gpv[OF bad_sticky1 lossless1, of s2' \"c r1\" s1'] \n                weight_spmf_le_1[of \"exec_gpv oracle1 (c r1) s1'\"] WT_gpv_ContD[OF step.prems(3) IO r1]\n                3[OF joint _ out] step.prems(1) False\n              by(simp_all add: pgen_lossless_gpv_def step.IH weight_gpv_def) }\n          ultimately show ?thesis using False step.prems(1)\n            by(rewrite exec_until_bad.simps)\n              (fastforce simp add: map_spmf_bind_spmf WT_gpv_OutD[OF step.prems(3)] oracle2 bind_map_spmf step.hyps intro!: ord_spmf_bind_reflI split!: generat.split dest: 3)\n        qed\n      qed\n    qed\n\n    have \"set_spmf ?pq \\<subseteq> {(as1, bs2). ?R' as1 bs2}\" using * bad WT_gpv\n    proof(induction arbitrary: gpv s1 s2 rule: exec_until_bad_fixp_induct)\n      case adm show ?case by(intro cont_intro ccpo_class.admissible_leI)\n      case bottom show ?case by simp\n      case step\n      have switch: \"set_spmf (exec_gpv oracle1 (c r1) s1') \\<times> set_spmf (exec_gpv oracle2 (c r2) s2')\n            \\<subseteq> {((a, s1'), b, s2'). bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else a = b \\<and> X s1' s2')}\"\n        if \"\\<not> bad1 s1\" \"\\<I> \\<turnstile>g gpv \\<surd>\" \"\\<not> bad2 s2\" and X: \"X s1 s2\" and out: \"IO out c \\<in> set_spmf (the_gpv gpv)\"\n        and joint: \"((r1, s1'), (r2, s2')) \\<in> set_spmf (joint_oracle s1 s2 out)\" \n        and bad2: \"bad2 s2'\"\n        for out c r1 s1' r2 s2'\n      proof(clarify; rule conjI)\n        from step.prems(3) out have outs: \"out \\<in> outs_\\<I> \\<I>\" by(rule WT_gpv_OutD)\n        from bad2 3[OF joint X this] have bad1: \"bad1 s1' \\<and> X_bad s1' s2'\" by simp_all\n\n        have s1': \"(r1, s1') \\<in> set_spmf (oracle1 s1 out)\" and s2': \"(r2, s2') \\<in> set_spmf (oracle2 s2 out)\"\n          using setD[OF X outs joint] by simp_all\n        have resp: \"r1 \\<in> responses_\\<I> \\<I> out\" using WT_oracle1 s1' outs by(rule WT_calleeD)\n        with step.prems(3) out have WT1: \"\\<I> \\<turnstile>g c r1 \\<surd>\" by(rule WT_gpv_ContD)\n        have resp: \"r2 \\<in> responses_\\<I> \\<I> out\" using WT_oracle2 s2' outs by(rule WT_calleeD)\n        with step.prems(3) out have WT2: \"\\<I> \\<turnstile>g c r2 \\<surd>\" by(rule WT_gpv_ContD)\n\n        fix r1' s1'' r2' s2''\n        assume s1'': \"(r1', s1'') \\<in> set_spmf (exec_gpv oracle1 (c r1) s1')\"\n          and s2'': \"(r2', s2'') \\<in> set_spmf (exec_gpv oracle2 (c r2) s2')\"\n        have *: \"bad1 s1'' \\<and> X_bad s1'' s2'\" using bad2 s1'' bad1 WT1\n          by(rule callee_invariant_on.exec_gpv_invariant[OF bad_sticky1])\n        have \"bad2 s2'' \\<and> X_bad s1'' s2''\" using _ s2'' _ WT2\n          by(rule callee_invariant_on.exec_gpv_invariant[OF bad_sticky2])(simp_all add: bad2 *)\n        then show \"bad1 s1'' = bad2 s2''\" \"if bad2 s2'' then X_bad s1'' s2'' else r1' = r2' \\<and> X s1'' s2''\"\n          using * by(simp_all)\n      qed\n      show ?case using step.prems\n        apply(clarsimp simp add: bind_UNION step.IH 3 WT_gpv_OutD WT_gpv_ContD del: subsetI intro!: UN_least split: generat.split if_split_asm)\n        subgoal by(auto 4 3 dest: callee_invariant_on.exec_gpv_invariant[OF bad_sticky1, rotated] callee_invariant_on.exec_gpv_invariant[OF bad_sticky2, rotated] 3)\n        apply(intro strip conjI)\n        subgoal by(drule (6) switch) auto\n        subgoal by(auto 4 3 intro!: step.IH[THEN order.trans] del: subsetI dest: 3 setD[rotated 2] simp add: WT_gpv_OutD WT_gpv_ContD intro: WT_gpv_ContD intro!: WT_calleeD[OF WT_oracle1])\n        done\n    qed\n    then show \"\\<And>x y. (x, y) \\<in> set_spmf ?pq \\<Longrightarrow> ?R x y\" by auto\n  qed\nqed\n\nlemma exec_gpv_oracle_bisim_bad':\n  fixes s1 :: 's1 and s2 :: 's2 and X :: \"'s1 \\<Rightarrow> 's2 \\<Rightarrow> bool\"\n  and oracle1 :: \"'s1 \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 's1) spmf\"\n  and oracle2 :: \"'s2 \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 's2) spmf\"\n  assumes *: \"if bad2 s2 then X_bad s1 s2 else X s1 s2\"\n  and bad: \"bad1 s1 = bad2 s2\"\n  and bisim: \"\\<And>s1 s2 x. \\<lbrakk> X s1 s2; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> rel_spmf (\\<lambda>(a, s1') (b, s2'). bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else a = b \\<and> X s1' s2')) (oracle1 s1 x) (oracle2 s2 x)\"\n  and bad_sticky1: \"\\<And>s2. bad2 s2 \\<Longrightarrow> callee_invariant_on oracle1 (\\<lambda>s1. bad1 s1 \\<and> X_bad s1 s2) \\<I>\"\n  and bad_sticky2: \"\\<And>s1. bad1 s1 \\<Longrightarrow> callee_invariant_on oracle2 (\\<lambda>s2. bad2 s2 \\<and> X_bad s1 s2) \\<I>\"\n  and lossless1: \"\\<And>s1 x. \\<lbrakk> bad1 s1; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> lossless_spmf (oracle1 s1 x)\"\n  and lossless2: \"\\<And>s2 x. \\<lbrakk> bad2 s2; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> lossless_spmf (oracle2 s2 x)\"\n  and lossless: \"lossless_gpv \\<I> gpv\"\n  and WT_oracle1: \"\\<And>s1. \\<I> \\<turnstile>c oracle1 s1 \\<surd>\" (* stronger than the invariants above because unconditional *)\n  and WT_oracle2: \"\\<And>s2. \\<I> \\<turnstile>c oracle2 s2 \\<surd>\"\n  and WT_gpv: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n  shows \"rel_spmf (\\<lambda>(a, s1') (b, s2'). bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else a = b \\<and> X s1' s2')) (exec_gpv oracle1 gpv s1) (exec_gpv oracle2 gpv s2)\"\nusing assms(1-7) lossless_imp_plossless_gpv[OF lossless WT_gpv] assms(9-)\nby(rule exec_gpv_oracle_bisim_bad_plossless)\n\nlemma exec_gpv_oracle_bisim_bad_invariant:\n  fixes s1 :: 's1 and s2 :: 's2 and X :: \"'s1 \\<Rightarrow> 's2 \\<Rightarrow> bool\" and I1 :: \"'s1 \\<Rightarrow> bool\" and I2 :: \"'s2 \\<Rightarrow> bool\"\n  and oracle1 :: \"'s1 \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 's1) spmf\"\n  and oracle2 :: \"'s2 \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 's2) spmf\"\n  assumes *: \"if bad2 s2 then X_bad s1 s2 else X s1 s2\"\n  and bad: \"bad1 s1 = bad2 s2\"\n  and bisim: \"\\<And>s1 s2 x. \\<lbrakk> X s1 s2; x \\<in> outs_\\<I> \\<I>; I1 s1; I2 s2 \\<rbrakk> \\<Longrightarrow> rel_spmf (\\<lambda>(a, s1') (b, s2'). bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else a = b \\<and> X s1' s2')) (oracle1 s1 x) (oracle2 s2 x)\"\n  and bad_sticky1: \"\\<And>s2. \\<lbrakk> bad2 s2; I2 s2 \\<rbrakk> \\<Longrightarrow> callee_invariant_on oracle1 (\\<lambda>s1. bad1 s1 \\<and> X_bad s1 s2) \\<I>\"\n  and bad_sticky2: \"\\<And>s1. \\<lbrakk> bad1 s1; I1 s1 \\<rbrakk> \\<Longrightarrow> callee_invariant_on oracle2 (\\<lambda>s2. bad2 s2 \\<and> X_bad s1 s2) \\<I>\"\n  and lossless1: \"\\<And>s1 x. \\<lbrakk> bad1 s1; I1 s1; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> lossless_spmf (oracle1 s1 x)\"\n  and lossless2: \"\\<And>s2 x. \\<lbrakk> bad2 s2; I2 s2; x \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> lossless_spmf (oracle2 s2 x)\"\n  and lossless: \"lossless_gpv \\<I> gpv\"\n  and WT_gpv: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n  and I1: \"callee_invariant_on oracle1 I1 \\<I>\"\n  and I2: \"callee_invariant_on oracle2 I2 \\<I>\"\n  and s1: \"I1 s1\"\n  and s2: \"I2 s2\"\n  shows \"rel_spmf (\\<lambda>(a, s1') (b, s2'). bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else a = b \\<and> X s1' s2')) (exec_gpv oracle1 gpv s1) (exec_gpv oracle2 gpv s2)\"\n  including lifting_syntax\nproof -\n  interpret I1: callee_invariant_on oracle1 I1 \\<I> by(fact I1)\n  interpret I2: callee_invariant_on oracle2 I2 \\<I> by(fact I2)\n  from s1 have nonempty1: \"{s. I1 s} \\<noteq> {}\" by auto\n  { assume \"\\<exists>(Rep1 :: 's1' \\<Rightarrow> 's1) Abs1. type_definition Rep1 Abs1 {s. I1 s}\"\n      and \"\\<exists>(Rep2 :: 's2' \\<Rightarrow> 's2) Abs2. type_definition Rep2 Abs2 {s. I2 s}\"\n    then obtain Rep1 :: \"'s1' \\<Rightarrow> 's1\" and Abs1 and Rep2 :: \"'s2' \\<Rightarrow> 's2\" and Abs2\n      where td1: \"type_definition Rep1 Abs1 {s. I1 s}\" and td2: \"type_definition Rep2 Abs2 {s. I2 s}\"\n      by blast\n    interpret td1: type_definition Rep1 Abs1 \"{s. I1 s}\" by(rule td1)\n    interpret td2: type_definition Rep2 Abs2 \"{s. I2 s}\" by(rule td2)\n    define cr1 where \"cr1 \\<equiv> \\<lambda>x y. x = Rep1 y\"\n    have [transfer_rule]: \"bi_unique cr1\" \"right_total cr1\" using td1 cr1_def by(rule typedef_bi_unique typedef_right_total)+\n    have [transfer_domain_rule]: \"Domainp cr1 = I1\" using type_definition_Domainp[OF td1 cr1_def] by simp\n    define cr2 where \"cr2 \\<equiv> \\<lambda>x y. x = Rep2 y\"\n    have [transfer_rule]: \"bi_unique cr2\" \"right_total cr2\" using td2 cr2_def by(rule typedef_bi_unique typedef_right_total)+\n    have [transfer_domain_rule]: \"Domainp cr2 = I2\" using type_definition_Domainp[OF td2 cr2_def] by simp\n\n    let ?C = \"eq_onp (\\<lambda>out. out \\<in> outs_\\<I> \\<I>)\"\n\n    define oracle1' where \"oracle1' \\<equiv> (Rep1 ---> id ---> map_spmf (map_prod id Abs1)) oracle1\"\n    have [transfer_rule]: \"(cr1 ===> ?C ===> rel_spmf (rel_prod (=) cr1)) oracle1 oracle1'\"\n      by(auto simp add: oracle1'_def rel_fun_def cr1_def spmf_rel_map prod.rel_map td1.Abs_inverse eq_onp_def intro!: rel_spmf_reflI intro: td1.Rep[simplified] dest: I1.callee_invariant)\n    define oracle2' where \"oracle2' \\<equiv> (Rep2 ---> id ---> map_spmf (map_prod id Abs2)) oracle2\"\n    have [transfer_rule]: \"(cr2 ===> ?C ===> rel_spmf (rel_prod (=) cr2)) oracle2 oracle2'\"\n      by(auto simp add: oracle2'_def rel_fun_def cr2_def spmf_rel_map prod.rel_map td2.Abs_inverse eq_onp_def intro!: rel_spmf_reflI intro: td2.Rep[simplified] dest: I2.callee_invariant)\n\n    define s1' where \"s1' \\<equiv> Abs1 s1\"\n    have [transfer_rule]: \"cr1 s1 s1'\" using s1 by(simp add: cr1_def s1'_def td1.Abs_inverse)\n    define s2' where \"s2' \\<equiv> Abs2 s2\"\n    have [transfer_rule]: \"cr2 s2 s2'\" using s2 by(simp add: cr2_def s2'_def td2.Abs_inverse)\n\n    define bad1' where \"bad1' \\<equiv> (Rep1 ---> id) bad1\"\n    have [transfer_rule]: \"(cr1 ===> (=)) bad1 bad1'\" by(simp add: rel_fun_def bad1'_def cr1_def)\n    define bad2' where \"bad2' \\<equiv> (Rep2 ---> id) bad2\"\n    have [transfer_rule]: \"(cr2 ===> (=)) bad2 bad2'\" by(simp add: rel_fun_def bad2'_def cr2_def)\n\n    define X' where \"X' \\<equiv> (Rep1 ---> Rep2 ---> id) X\"\n    have [transfer_rule]: \"(cr1 ===> cr2 ===> (=)) X X'\" by(simp add: rel_fun_def X'_def cr1_def cr2_def)\n    define X_bad' where \"X_bad' \\<equiv> (Rep1 ---> Rep2 ---> id) X_bad\"\n    have [transfer_rule]: \"(cr1 ===> cr2 ===> (=)) X_bad X_bad'\" by(simp add: rel_fun_def X_bad'_def cr1_def cr2_def)\n\n    define gpv' where \"gpv' \\<equiv> restrict_gpv \\<I> gpv\"\n    have [transfer_rule]: \"rel_gpv (=) ?C gpv' gpv'\"\n      by(fold eq_onp_top_eq_eq)(auto simp add: gpv.rel_eq_onp eq_onp_same_args pred_gpv_def gpv'_def dest: in_outs'_restrict_gpvD)\n\n    have \"if bad2' s2' then X_bad' s1' s2' else X' s1' s2'\" using * by transfer\n    moreover have \"bad1' s1' \\<longleftrightarrow> bad2' s2'\" using bad by transfer\n    moreover have x: \"?C x x\" if \"x \\<in> outs_\\<I> \\<I>\" for x using that by(simp add: eq_onp_def)\n    have \"rel_spmf (\\<lambda>(a, s1') (b, s2'). (bad1' s1' \\<longleftrightarrow> bad2' s2') \\<and> (if bad2' s2' then X_bad' s1' s2' else a = b \\<and> X' s1' s2')) (oracle1' s1 x) (oracle2' s2 x)\"\n      if \"X' s1 s2\" and \"x \\<in> outs_\\<I> \\<I>\" for s1 s2 x using that(1) supply that(2)[THEN x, transfer_rule]\n      by(transfer)(rule bisim[OF _ that(2)])\n    moreover have [transfer_rule]: \"rel_\\<I> ?C (=) \\<I> \\<I>\" by(rule rel_\\<I>I)(auto simp add: set_relator_eq_onp eq_onp_same_args rel_set_eq dest: eq_onp_to_eq)\n    have \"callee_invariant_on oracle1' (\\<lambda>s1. bad1' s1 \\<and> X_bad' s1 s2) \\<I>\" if \"bad2' s2\" for s2\n      using that unfolding callee_invariant_on_alt_def apply(transfer)\n      using bad_sticky1[unfolded callee_invariant_on_alt_def] by blast\n    moreover have \"callee_invariant_on oracle2' (\\<lambda>s2. bad2' s2 \\<and> X_bad' s1 s2) \\<I>\" if \"bad1' s1\" for s1\n      using that unfolding callee_invariant_on_alt_def apply(transfer)\n      using bad_sticky2[unfolded callee_invariant_on_alt_def] by blast\n    moreover have \"lossless_spmf (oracle1' s1 x)\" if \"bad1' s1\" \"x \\<in> outs_\\<I> \\<I>\" for s1 x\n      using that supply that(2)[THEN x, transfer_rule] by transfer(rule lossless1)\n    moreover have \"lossless_spmf (oracle2' s2 x)\" if \"bad2' s2\" \"x \\<in> outs_\\<I> \\<I>\" for s2 x\n      using that supply that(2)[THEN x, transfer_rule] by transfer(rule lossless2)\n    moreover have \"lossless_gpv \\<I> gpv'\" using WT_gpv lossless by(simp add: gpv'_def lossless_restrict_gpvI)\n    moreover have \"\\<I> \\<turnstile>c oracle1' s1 \\<surd>\" for s1 using I1.WT_callee by transfer\n    moreover have \"\\<I> \\<turnstile>c oracle2' s2 \\<surd>\" for s2 using I2.WT_callee by transfer\n    moreover have \"\\<I> \\<turnstile>g gpv' \\<surd>\" by(simp add: gpv'_def)\n    ultimately have **: \"rel_spmf (\\<lambda>(a, s1') (b, s2'). bad1' s1' = bad2' s2' \\<and> (if bad2' s2' then X_bad' s1' s2' else a = b \\<and> X' s1' s2')) (exec_gpv oracle1' gpv' s1') (exec_gpv oracle2' gpv' s2')\"\n      by(rule exec_gpv_oracle_bisim_bad')\n    have [transfer_rule]: \"((=) ===> ?C ===> rel_spmf (rel_prod (=) (=))) oracle2 oracle2\"\n      \"((=) ===> ?C ===> rel_spmf (rel_prod (=) (=))) oracle1 oracle1\"\n      by(simp_all add: rel_fun_def eq_onp_def prod.rel_eq)\n    note [transfer_rule] = bi_unique_eq_onp bi_unique_eq\n    from ** have \"rel_spmf (\\<lambda>(a, s1') (b, s2'). bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else a = b \\<and> X s1' s2')) (exec_gpv oracle1 gpv' s1) (exec_gpv oracle2 gpv' s2)\"\n      by(transfer)\n    also have \"exec_gpv oracle1 gpv' s1 = exec_gpv oracle1 gpv s1\"\n      unfolding gpv'_def using WT_gpv s1 by(rule I1.exec_gpv_restrict_gpv_invariant)\n    also have \"exec_gpv oracle2 gpv' s2 = exec_gpv oracle2 gpv s2\"\n      unfolding gpv'_def using WT_gpv s2 by(rule I2.exec_gpv_restrict_gpv_invariant)\n    finally have ?thesis . }\n  from this[cancel_type_definition, OF nonempty1, cancel_type_definition] s2 show ?thesis by blast\nqed\n\nlemma exec_gpv_oracle_bisim_bad:\n  assumes *: \"if bad2 s2 then X_bad s1 s2 else X s1 s2\"\n  and bad: \"bad1 s1 = bad2 s2\"\n  and bisim: \"\\<And>s1 s2 x. X s1 s2 \\<Longrightarrow> rel_spmf (\\<lambda>(a, s1') (b, s2'). bad1 s1' = bad2 s2' \\<and> (if bad2 s2' then X_bad s1' s2' else a = b \\<and> X s1' s2')) (oracle1 s1 x) (oracle2 s2 x)\"\n  and bad_sticky1: \"\\<And>s2. bad2 s2 \\<Longrightarrow> callee_invariant_on oracle1 (\\<lambda>s1. bad1 s1 \\<and> X_bad s1 s2) \\<I>\"\n  and bad_sticky2: \"\\<And>s1. bad1 s1 \\<Longrightarrow> callee_invariant_on oracle2 (\\<lambda>s2. bad2 s2 \\<and> X_bad s1 s2) \\<I>\"\n  and lossless1: \"\\<And>s1 x. bad1 s1 \\<Longrightarrow> lossless_spmf (oracle1 s1 x)\"\n  and lossless2: \"\\<And>s2 x. bad2 s2 \\<Longrightarrow> lossless_spmf (oracle2 s2 x)\"\n  and lossless: \"lossless_gpv \\<I> gpv\"\n  and WT_oracle1: \"\\<And>s1. \\<I> \\<turnstile>c oracle1 s1 \\<surd>\"\n  and WT_oracle2: \"\\<And>s2. \\<I> \\<turnstile>c oracle2 s2 \\<surd>\"\n  and WT_gpv: \"\\<I> \\<turnstile>g gpv \\<surd>\"\n  and R: \"\\<And>a s1 b s2. \\<lbrakk> bad1 s1 = bad2 s2; \\<not> bad2 s2 \\<Longrightarrow> a = b \\<and> X s1 s2; bad2 s2 \\<Longrightarrow> X_bad s1 s2 \\<rbrakk> \\<Longrightarrow> R (a, s1) (b, s2)\"\n  shows \"rel_spmf R (exec_gpv oracle1 gpv s1) (exec_gpv oracle2 gpv s2)\"\nusing exec_gpv_oracle_bisim_bad'[OF * bad bisim bad_sticky1 bad_sticky2 lossless1 lossless2 lossless WT_oracle1 WT_oracle2 WT_gpv]\nby(rule rel_spmf_mono)(auto intro: R)\n\nlemma exec_gpv_oracle_bisim_bad_full:\n  assumes \"X s1 s2\"\n  and \"bad1 s1 = bad2 s2\"\n  and \"\\<And>s1 s2 x. X s1 s2 \\<Longrightarrow> rel_spmf (\\<lambda>(a, s1') (b, s2'). bad1 s1' = bad2 s2' \\<and> (\\<not> bad2 s2' \\<longrightarrow> a = b \\<and> X s1' s2')) (oracle1 s1 x) (oracle2 s2 x)\"\n  and \"callee_invariant oracle1 bad1\"\n  and \"callee_invariant oracle2 bad2\"\n  and \"\\<And>s1 x. bad1 s1 \\<Longrightarrow> lossless_spmf (oracle1 s1 x)\"\n  and \"\\<And>s2 x. bad2 s2 \\<Longrightarrow> lossless_spmf (oracle2 s2 x)\"\n  and \"lossless_gpv \\<I>_full gpv\"\n  and R: \"\\<And>a s1 b s2. \\<lbrakk> bad1 s1 = bad2 s2; \\<not> bad2 s2 \\<Longrightarrow> a = b \\<and> X s1 s2 \\<rbrakk> \\<Longrightarrow> R (a, s1) (b, s2)\"\n  shows \"rel_spmf R (exec_gpv oracle1 gpv s1) (exec_gpv oracle2 gpv s2)\"\nusing assms\nby(intro exec_gpv_oracle_bisim_bad[of bad2 s2 \"\\<lambda>_ _. True\" s1 X bad1 oracle1 oracle2 \\<I>_full gpv R])(auto intro: rel_spmf_mono)\n\nlemma max_enn2ereal: \"max (enn2ereal x) (enn2ereal y) = enn2ereal (max x y)\"\nincluding ennreal.lifting unfolding max_def by transfer simp\n\nlemma identical_until_bad:\n  assumes bad_eq: \"map_spmf bad p = map_spmf bad q\"\n  and not_bad: \"measure (measure_spmf (map_spmf (\\<lambda>x. (f x, bad x)) p)) (A \\<times> {False}) = measure (measure_spmf (map_spmf (\\<lambda>x. (f x, bad x)) q)) (A \\<times> {False})\"\n  shows \"\\<bar>measure (measure_spmf (map_spmf f p)) A - measure (measure_spmf (map_spmf f q)) A\\<bar> \\<le> spmf (map_spmf bad p) True\"\nproof -\n  have \"\\<bar>enn2ereal (measure (measure_spmf (map_spmf f p)) A) - enn2ereal (measure (measure_spmf (map_spmf f q)) A)\\<bar> = \n    \\<bar>enn2ereal (\\<integral>\\<^sup>+ x. indicator A (f x) \\<partial>measure_spmf p) - enn2ereal (\\<integral>\\<^sup>+ x. indicator A (f x) \\<partial>measure_spmf q)\\<bar>\"\n    unfolding measure_spmf.emeasure_eq_measure[symmetric]\n    by(simp add: nn_integral_indicator[symmetric] indicator_vimage[abs_def] o_def)\n  also have \"\\<dots> =\n    \\<bar>enn2ereal (\\<integral>\\<^sup>+ x. indicator (A \\<times> {False}) (f x, bad x) + indicator (A \\<times> {True}) (f x, bad x) \\<partial>measure_spmf p) -\n     enn2ereal (\\<integral>\\<^sup>+ x. indicator (A \\<times> {False}) (f x, bad x) + indicator (A \\<times> {True}) (f x, bad x) \\<partial>measure_spmf q)\\<bar>\"\n    by(intro arg_cong[where f=abs] arg_cong2[where f=\"(-)\"] arg_cong[where f=enn2ereal] nn_integral_cong)(simp_all split: split_indicator)\n  also have \"\\<dots> = \n    \\<bar>enn2ereal (emeasure (measure_spmf (map_spmf (\\<lambda>x. (f x, bad x)) p)) (A \\<times> {False}) + (\\<integral>\\<^sup>+ x. indicator (A \\<times> {True}) (f x, bad x) \\<partial>measure_spmf p)) -\n     enn2ereal (emeasure (measure_spmf (map_spmf (\\<lambda>x. (f x, bad x)) q)) (A \\<times> {False}) + (\\<integral>\\<^sup>+ x. indicator (A \\<times> {True}) (f x, bad x) \\<partial>measure_spmf q))\\<bar>\"\n    by(subst (1 2) nn_integral_add)(simp_all add: indicator_vimage[abs_def] o_def nn_integral_indicator[symmetric])\n  also have \"\\<dots> = \\<bar>enn2ereal (\\<integral>\\<^sup>+ x. indicator (A \\<times> {True}) (f x, bad x) \\<partial>measure_spmf p) - enn2ereal (\\<integral>\\<^sup>+ x. indicator (A \\<times> {True}) (f x, bad x) \\<partial>measure_spmf q)\\<bar>\"\n    (is \"_ = \\<bar>?x - ?y\\<bar>\")\n    by(simp add: measure_spmf.emeasure_eq_measure not_bad plus_ennreal.rep_eq ereal_diff_add_eq_diff_diff_swap ereal_diff_add_assoc2 ereal_add_uminus_conv_diff)\n  also have \"\\<dots> \\<le> max ?x ?y\"\n  proof(rule ereal_abs_leI)\n    have \"?x - ?y \\<le> ?x - 0\" by(rule ereal_minus_mono)(simp_all)\n    also have \"\\<dots> \\<le> max ?x ?y\" by simp\n    finally show \"?x - ?y \\<le> \\<dots>\" .\n\n    have \"- (?x - ?y) = ?y - ?x\"\n      by(rule ereal_minus_diff_eq)(simp_all add: measure_spmf.nn_integral_indicator_neq_top)\n    also have \"\\<dots> \\<le> ?y - 0\" by(rule ereal_minus_mono)(simp_all)\n    also have \"\\<dots> \\<le> max ?x ?y\" by simp\n    finally show \"- (?x - ?y) \\<le> \\<dots>\" .\n  qed\n  also have \"\\<dots> \\<le> enn2ereal (max (\\<integral>\\<^sup>+ x. indicator {True} (bad x) \\<partial>measure_spmf p) (\\<integral>\\<^sup>+ x. indicator {True} (bad x) \\<partial>measure_spmf q))\"\n    unfolding max_enn2ereal less_eq_ennreal.rep_eq[symmetric]\n    by(intro max.mono nn_integral_mono)(simp_all split: split_indicator)\n  also have \"\\<dots> = enn2ereal (spmf (map_spmf bad p) True)\"\n    using arg_cong2[where f=spmf, OF bad_eq refl, of True, THEN arg_cong[where f=ennreal]]\n    unfolding ennreal_spmf_map_conv_nn_integral indicator_vimage[abs_def] by simp\n  finally show ?thesis by simp\nqed\n\nlemma (in callee_invariant_on) exec_gpv_bind_materialize:\n  fixes f :: \"'s \\<Rightarrow> 'r spmf\"\n  and g :: \"'x \\<times> 's \\<Rightarrow> 'r \\<Rightarrow> 'y spmf\"\n  and s :: \"'s\"\n  defines \"exec_gpv2 \\<equiv> exec_gpv\"\n  assumes cond: \"\\<And>s x y s'. \\<lbrakk> (y, s') \\<in> set_spmf (callee s x); I s \\<rbrakk> \\<Longrightarrow> f s = f s'\"\n  and \\<I>: \"\\<I> = \\<I>_full\" (* TODO: generalize *)\n  shows \"bind_spmf (exec_gpv callee gpv s) (\\<lambda>as. bind_spmf (f (snd as)) (g as)) =\n    exec_gpv2 (\\<lambda>(r, s) x. bind_spmf (callee s x) (\\<lambda>(y, s'). if I s' \\<and> r = None then map_spmf (\\<lambda>r. (y, (Some r, s'))) (f s') else return_spmf (y, (r, s')))) gpv (None, s)\n    \\<bind> (\\<lambda>(a, r, s). case r of None \\<Rightarrow> bind_spmf (f s) (g (a, s)) | Some r' \\<Rightarrow> g (a, s) r')\"\n    (is \"?lhs = ?rhs\" is \"_ = bind_spmf (exec_gpv2 ?callee2 _ _) _\")\nproof -\n  define exec_gpv1 :: \"('a, 'b, 's option \\<times> 's) callee \\<Rightarrow> ('x, 'a, 'b) gpv \\<Rightarrow> _\"\n    where [simp]: \"exec_gpv1 = exec_gpv\"\n  let ?X = \"\\<lambda>s (ss, s'). s = s'\"\n  let ?callee = \"\\<lambda>(ss, s) x. map_spmf (\\<lambda>(y, s'). (y, if I s' \\<and> ss = None then Some s' else ss, s')) (callee s x)\"\n  let ?track = \"exec_gpv1 ?callee gpv (None, s)\"\n  have \"rel_spmf (rel_prod (=) ?X) (exec_gpv callee gpv s) ?track\" unfolding exec_gpv1_def\n    by(rule exec_gpv_oracle_bisim[where X=\"?X\"])(auto simp add: spmf_rel_map intro!: rel_spmf_reflI)\n  hence \"exec_gpv callee gpv s = map_spmf (\\<lambda>(a, ss, s). (a, s)) ?track\"\n    by(auto simp add: spmf_rel_eq[symmetric] spmf_rel_map elim: rel_spmf_mono)\n  hence \"?lhs = bind_spmf ?track (\\<lambda>(a, s'', s'). bind_spmf (f s') (g (a, s')))\"\n    by(simp add: bind_map_spmf o_def split_def)\n  also let ?inv = \"\\<lambda>(ss, s). case ss of None \\<Rightarrow> True | Some s' \\<Rightarrow> f s = f s' \\<and> I s' \\<and> I s\"\n  interpret inv: callee_invariant_on \"?callee\" \"?inv\" \\<I>\n    by unfold_locales(auto 4 4 split: option.split if_split_asm dest: cond callee_invariant simp add: \\<I>)\n  have \"bind_spmf ?track (\\<lambda>(a, s'', s'). bind_spmf (f s') (g (a, s'))) =\n    bind_spmf ?track (\\<lambda>(a, ss', s'). bind_spmf (f (case ss' of None \\<Rightarrow> s' | Some s'' \\<Rightarrow> s'')) (g (a, s')))\"\n    (is \"_ = ?rhs'\")\n    by(rule bind_spmf_cong[OF refl])(auto dest!: inv.exec_gpv_invariant split: option.split_asm simp add: \\<I>)\n  also\n  have track_Some: \"exec_gpv ?callee gpv (Some ss, s) = map_spmf (\\<lambda>(a, s). (a, Some ss, s)) (exec_gpv callee gpv s)\"\n    for s ss :: 's and gpv :: \"('x, 'a, 'b) gpv\"\n  proof -\n    let ?X = \"\\<lambda>(ss', s') s. s = s' \\<and> ss' = Some ss\"\n    have \"rel_spmf (rel_prod (=) ?X) (exec_gpv ?callee gpv (Some ss, s)) (exec_gpv callee gpv s)\"\n      by(rule exec_gpv_oracle_bisim[where X=\"?X\"])(auto simp add: spmf_rel_map intro!: rel_spmf_reflI)\n    thus ?thesis by(auto simp add: spmf_rel_eq[symmetric] spmf_rel_map elim: rel_spmf_mono)\n  qed\n  have sample_Some: \"exec_gpv ?callee2 gpv (Some r, s) = map_spmf (\\<lambda>(a, s). (a, Some r, s)) (exec_gpv callee gpv s)\" \n    for s :: 's and r :: 'r and gpv :: \"('x, 'a, 'b) gpv\"\n  proof -\n    let ?X = \"\\<lambda>(r', s') s. s' = s \\<and> r' = Some r\"\n    have \"rel_spmf (rel_prod (=) ?X) (exec_gpv ?callee2 gpv (Some r, s)) (exec_gpv callee gpv s)\"\n      by(rule exec_gpv_oracle_bisim[where X=\"?X\"])(auto simp add: spmf_rel_map map_spmf_conv_bind_spmf[symmetric] split_def intro!: rel_spmf_reflI)\n    then show ?thesis by(auto simp add: spmf_rel_eq[symmetric] spmf_rel_map elim: rel_spmf_mono)\n  qed\n  have \"?rhs' = ?rhs\"\n    \\<comment> \\<open>Actually, parallel fixpoint induction should be used here, but then we cannot use the\n      facts @{thm [source] track_Some} and @{thm [source] sample_Some} because fixpoint induction\n      replaces @{const exec_gpv} with approximations. So we do two separate fixpoint inductions\n      instead and jump from the approximation to the fixpoint when the state has been found.\\<close>\n  proof(rule spmf.leq_antisym)\n    show \"ord_spmf (=) ?rhs' ?rhs\" unfolding exec_gpv1_def\n    proof(induction arbitrary: gpv s rule: exec_gpv_fixp_induct_strong)\n      case adm show ?case by simp\n      case bottom show ?case by simp\n      case (step exec_gpv')\n      show ?case unfolding exec_gpv2_def\n        apply(rewrite in \"ord_spmf _ _ \\<hole>\" exec_gpv.simps)\n        apply(clarsimp split: generat.split simp add: bind_map_spmf intro!: ord_spmf_bind_reflI split del: if_split)\n        subgoal for out rpv ret s'\n          apply(cases \"I s'\")\n          subgoal\n            apply simp\n            apply(rule spmf.leq_trans)\n             apply(rule ord_spmf_bindI[OF step.hyps])\n             apply hypsubst\n             apply(rule spmf.leq_refl)\n            apply(simp add: track_Some sample_Some bind_map_spmf o_def)\n            apply(subst bind_commute_spmf)\n            apply(simp add: split_def)\n            done\n          subgoal\n            apply simp\n            apply(rule step.IH[THEN spmf.leq_trans])\n            apply(simp add: split_def exec_gpv2_def)\n            done\n          done\n        done\n    qed\n    show \"ord_spmf (=) ?rhs ?rhs'\" unfolding exec_gpv2_def\n    proof(induction arbitrary: gpv s rule: exec_gpv_fixp_induct_strong)\n      case adm show ?case by simp\n      case bottom show ?case by simp\n      case (step exec_gpv')\n      show ?case unfolding exec_gpv1_def\n        apply(rewrite in \"ord_spmf _ _ \\<hole>\" exec_gpv.simps)\n        apply(clarsimp split: generat.split simp add: bind_map_spmf intro!: ord_spmf_bind_reflI split del: if_split)\n        subgoal for out rpv ret s'\n          apply(cases \"I s'\")\n          subgoal\n            apply(simp add: bind_map_spmf o_def)\n            apply(rule spmf.leq_trans)\n             apply(rule ord_spmf_bind_reflI)\n             apply(rule ord_spmf_bindI)\n              apply(rule step.hyps)\n             apply hypsubst\n             apply(rule spmf.leq_refl)\n            apply(simp add: track_Some sample_Some bind_map_spmf o_def)\n            apply(subst bind_commute_spmf)\n            apply(simp add: split_def)\n            done\n          subgoal\n            apply simp\n            apply(rule step.IH[THEN spmf.leq_trans])\n            apply(simp add: split_def exec_gpv2_def)\n            done\n          done\n        done\n    qed\n  qed\n  finally show ?thesis .\nqed\n\nprimcorec gpv_stop :: \"('a, 'c, 'r) gpv \\<Rightarrow> ('a option, 'c, 'r option) gpv\"\nwhere\n  \"the_gpv (gpv_stop gpv) = \n   map_spmf (map_generat Some id (\\<lambda>rpv input. case input of None \\<Rightarrow> Done None | Some input' \\<Rightarrow> gpv_stop (rpv input'))) \n     (the_gpv gpv)\"\n\nlemma gpv_stop_Done [simp]: \"gpv_stop (Done x) = Done (Some x)\"\nby(rule gpv.expand) simp\n\nlemma gpv_stop_Fail [simp]: \"gpv_stop Fail = Fail\"\nby(rule gpv.expand) simp\n\nlemma gpv_stop_Pause [simp]: \"gpv_stop (Pause out rpv) = Pause out (\\<lambda>input. case input of None \\<Rightarrow> Done None | Some input' \\<Rightarrow> gpv_stop (rpv input'))\"\nby(rule gpv.expand) simp\n\nlemma gpv_stop_lift_spmf [simp]: \"gpv_stop (lift_spmf p) = lift_spmf (map_spmf Some p)\"\nby(rule gpv.expand)(simp add: spmf.map_comp o_def)\n\nlemma gpv_stop_bind [simp]:\n  \"gpv_stop (bind_gpv gpv f) = bind_gpv (gpv_stop gpv) (\\<lambda>x. case x of None \\<Rightarrow> Done None | Some x' \\<Rightarrow> gpv_stop (f x'))\"\napply(coinduction arbitrary: gpv rule: gpv.coinduct_strong)\napply(auto 4 3 simp add: spmf_rel_map map_spmf_bind_spmf o_def bind_map_spmf bind_gpv.sel generat.rel_map simp del: bind_gpv_sel' intro!: rel_spmf_bind_reflI generat.rel_refl_strong rel_spmf_reflI rel_funI split!: generat.split option.split)\ndone\n\ncontext includes lifting_syntax begin\n\nlemma gpv_stop_parametric':\n  notes [transfer_rule] = the_gpv_parametric' the_gpv_parametric' Done_parametric' corec_gpv_parametric'\n  shows \"(rel_gpv'' A C R ===> rel_gpv'' (rel_option A) C (rel_option R)) gpv_stop gpv_stop\"\nunfolding gpv_stop_def by transfer_prover\n\nlemma gpv_stop_parametric [transfer_rule]:\n  shows \"(rel_gpv A C ===> rel_gpv (rel_option A) C) gpv_stop gpv_stop\"\nunfolding gpv_stop_def by transfer_prover\n\nlemma gpv_stop_transfer:\n  \"(rel_gpv'' A B C ===> rel_gpv'' (pcr_Some A) B (pcr_Some C)) (\\<lambda>x. x) gpv_stop\"\napply(rule rel_funI)\nsubgoal for gpv gpv'\n  apply(coinduction arbitrary: gpv gpv')\n  apply(drule rel_gpv''D)\n  apply(auto simp add: spmf_rel_map generat.rel_map rel_fun_def elim!: pcr_SomeE generat.rel_mono_strong rel_spmf_mono)\n  done\ndone\n\nend\n  \nlemma gpv_stop_map' [simp]:\n  \"gpv_stop (map_gpv' f g h gpv) = map_gpv' (map_option f) g (map_option h) (gpv_stop gpv)\"\napply(coinduction arbitrary: gpv rule: gpv.coinduct_strong)\napply(auto 4 3 simp add: spmf_rel_map generat.rel_map intro!: rel_spmf_reflI generat.rel_refl_strong split!: option.split)\ndone\n\nlemma interaction_bound_gpv_stop [simp]:\n  \"interaction_bound consider (gpv_stop gpv) = interaction_bound consider gpv\"\nproof(induction arbitrary: gpv rule: parallel_fixp_induct_strong_1_1[OF complete_lattice_partial_function_definitions complete_lattice_partial_function_definitions interaction_bound.mono interaction_bound.mono interaction_bound_def interaction_bound_def, case_names adm bottom step])\n  case adm show ?case by simp\n  case bottom show ?case by simp\nnext\n  case (step interaction_bound' interaction_bound'')\n  have \"(SUP x. interaction_bound' (case x of None \\<Rightarrow> Done None | Some input \\<Rightarrow> gpv_stop (c input))) =\n        (SUP input. interaction_bound'' (c input))\" (is \"?lhs = ?rhs\" is \"(SUP x. ?f x) = _\")\n    if \"IO out c \\<in> set_spmf (the_gpv gpv)\" for out c\n  proof -\n    have \"?lhs = sup (interaction_bound' (Done None)) (\\<Squnion>x. ?f (Some x))\"\n      by (simp add: UNIV_option_conv image_comp)\n    also have \"interaction_bound' (Done None) = 0\" using step.hyps(1)[of \"Done None\"] by simp\n    also have \"(\\<Squnion>x. ?f (Some x)) = ?rhs\" by (simp add: step.IH)\n    finally show ?thesis by (simp add: bot_enat_def [symmetric])\n  qed\n  then show ?case\n    by (auto simp add: case_map_generat o_def image_comp cong del: generat.case_cong_weak if_weak_cong intro!: SUP_cong split: generat.split)\nqed\n  \nabbreviation exec_gpv_stop :: \"('s \\<Rightarrow> 'c \\<Rightarrow> ('r option \\<times> 's) spmf) \\<Rightarrow> ('a, 'c, 'r) gpv \\<Rightarrow> 's \\<Rightarrow> ('a option \\<times> 's) spmf\"\nwhere \"exec_gpv_stop callee gpv \\<equiv> exec_gpv callee (gpv_stop gpv)\"\n\nabbreviation inline_stop :: \"('s \\<Rightarrow> 'c \\<Rightarrow> ('r option \\<times> 's, 'c', 'r') gpv) \\<Rightarrow> ('a, 'c, 'r) gpv \\<Rightarrow> 's \\<Rightarrow> ('a option \\<times> 's, 'c', 'r') gpv\"\nwhere \"inline_stop callee gpv \\<equiv> inline callee (gpv_stop gpv)\"\n\ncontext\n  fixes joint_oracle :: \"'s1 \\<Rightarrow> 's2 \\<Rightarrow> 'c \\<Rightarrow> (('r option \\<times> 's1) option \\<times> ('r option \\<times> 's2) option) pmf\"\n  and callee1 :: \"'s1 \\<Rightarrow> 'c \\<Rightarrow> ('r option \\<times> 's1) spmf\"\n  notes [[function_internals]]\nbegin\n\npartial_function (spmf) exec_until_stop :: \"('a option, 'c, 'r) gpv \\<Rightarrow> 's1 \\<Rightarrow> 's2 \\<Rightarrow> bool \\<Rightarrow> ('a option \\<times> 's1 \\<times> 's2) spmf\"\nwhere\n  \"exec_until_stop gpv s1 s2 b =\n  (if b then \n     bind_spmf (the_gpv gpv) (\\<lambda>generat. case generat of\n       Pure x \\<Rightarrow> return_spmf (x, s1, s2)\n     | IO out rpv \\<Rightarrow> bind_pmf (joint_oracle s1 s2 out) (\\<lambda>(a, b).\n         case a of None \\<Rightarrow> return_pmf None\n         | Some (r1, s1') \\<Rightarrow> (case b of None \\<Rightarrow> undefined | Some (r2, s2') \\<Rightarrow>\n           (case (r1, r2) of (None, None) \\<Rightarrow> exec_until_stop (Done None) s1' s2' True\n             | (Some r1', Some r2') \\<Rightarrow> exec_until_stop (rpv r1') s1' s2' True\n             | (None, Some r2') \\<Rightarrow> exec_until_stop (Done None) s1' s2' True\n             | (Some r1', None) \\<Rightarrow> exec_until_stop (rpv r1') s1' s2' False))))\n   else\n     bind_spmf (the_gpv gpv) (\\<lambda>generat. case generat of\n       Pure x \\<Rightarrow> return_spmf (None, s1, s2)\n     | IO out rpv \\<Rightarrow> bind_spmf (callee1 s1 out) (\\<lambda>(r1, s1').\n         case r1 of None \\<Rightarrow> exec_until_stop (Done None) s1' s2 False\n           | Some r1' \\<Rightarrow> exec_until_stop (rpv r1') s1' s2 False)))\"\n\nend\n\nlemma ord_spmf_exec_gpv_stop: (* TODO: generalize ord_spmf to support different type variables *)\n  fixes callee1 :: \"('c, 'r option, 's) callee\"\n  and callee2 :: \"('c, 'r option, 's) callee\"\n  and S :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\"\n  and gpv :: \"('a, 'c, 'r) gpv\"\n  assumes bisim:\n    \"\\<And>s1 s2 x. \\<lbrakk> S s1 s2; \\<not> stop s2 \\<rbrakk> \\<Longrightarrow> \n    ord_spmf (\\<lambda>(r1, s1') (r2, s2'). le_option r2 r1 \\<and> S s1' s2' \\<and> (r2 = None \\<and> r1 \\<noteq> None \\<longleftrightarrow> stop s2'))\n      (callee1 s1 x) (callee2 s2 x)\"\n  and init: \"S s1 s2\"\n  and go: \"\\<not> stop s2\"\n  and sticking: \"\\<And>s1 s2 x y s1'. \\<lbrakk> (y, s1') \\<in> set_spmf (callee1 s1 x); S s1 s2; stop s2 \\<rbrakk> \\<Longrightarrow> S s1' s2\"\n  shows \"ord_spmf (rel_prod (ord_option \\<top>)\\<inverse>\\<inverse> S) (exec_gpv_stop callee1 gpv s1) (exec_gpv_stop callee2 gpv s2)\"\nproof -\n  let ?R = \"\\<lambda>(r1, s1') (r2, s2'). le_option r2 r1 \\<and> S s1' s2' \\<and> (r2 = None \\<and> r1 \\<noteq> None \\<longleftrightarrow> stop s2')\"\n  obtain joint :: \"'s \\<Rightarrow> 's \\<Rightarrow> 'c \\<Rightarrow> (('r option \\<times> 's) option \\<times> ('r option \\<times> 's) option) pmf\"\n    where j1: \"map_pmf fst (joint s1 s2 x) = callee1 s1 x\"\n    and j2: \"map_pmf snd (joint s1 s2 x) = callee2 s2 x\"\n    and rel [rule_format, rotated -1]: \"\\<forall>(a, b) \\<in> set_pmf (joint s1 s2 x). ord_option ?R a b\"\n    if \"S s1 s2\" \"\\<not> stop s2\" for x s1 s2 using bisim\n    apply atomize_elim \n    apply(subst (asm) rel_pmf.simps)\n    apply(unfold rel_spmf_simps all_conj_distrib[symmetric] all_simps(6) imp_conjR[symmetric])\n    apply(subst all_comm)\n    apply(subst (2) all_comm)\n    apply(subst choice_iff[symmetric] ex_simps(6))+\n    apply fastforce\n    done\n  note [simp del] = top_apply conversep_iff id_apply\n  have \"\\<not> stop s2 \\<Longrightarrow> rel_spmf (rel_prod (ord_option \\<top>)\\<inverse>\\<inverse> S) (exec_gpv_stop callee1 gpv s1) (map_spmf (\\<lambda>(x, s1, s2). (x, s2)) (exec_until_stop joint callee1 (map_gpv Some id gpv) s1 s2 True))\"\n    and \"rel_spmf (rel_prod (ord_option \\<top>)\\<inverse>\\<inverse> S) (exec_gpv callee1 (Done None :: ('a option, 'c, 'r option) gpv) s1) (map_spmf (\\<lambda>(x, s1, s2). (x, s2)) (exec_until_stop joint callee1 (Done None :: ('a option, 'c, 'r) gpv) s1 s2 b))\"\n    and \"stop s2 \\<Longrightarrow> rel_spmf (rel_prod (ord_option \\<top>)\\<inverse>\\<inverse> S) (exec_gpv_stop callee1 gpv s1) (map_spmf (\\<lambda>(x, s1, y). (x, y)) (exec_until_stop joint callee1 (map_gpv Some id gpv) s1 s2 False))\"\n    for b using init\n  proof(induction arbitrary: gpv s1 s2 b rule: parallel_fixp_induct_2_4[OF partial_function_definitions_spmf partial_function_definitions_spmf exec_gpv.mono exec_until_stop.mono exec_gpv_def exec_until_stop_def, unfolded lub_spmf_empty, case_names adm bottom step])\n    case adm show ?case by simp\n    { case bottom case 1 show ?case by simp }\n    { case bottom case 2 show ?case by simp }\n    { case bottom case 3 show ?case by simp }\n  next\n    case (step exec_gpv' exec_until_stop') case step: 1\n    show ?case using step.prems\n      apply(rewrite gpv_stop.sel)\n      apply(simp add: map_spmf_bind_spmf bind_map_spmf gpv.map_sel)\n      apply(rule rel_spmf_bind_reflI)\n      apply(clarsimp split!: generat.split)\n      apply(rewrite j1[symmetric], assumption+)\n      apply(rewrite bind_spmf_def)\n      apply(auto 4 3 split!: option.split dest: rel intro: step.IH intro!: rel_pmf_bind_reflI simp add: map_bind_pmf bind_map_pmf)\n      done\n  next\n    case step case 2\n    then show ?case by(simp add: conversep_iff)\n  next\n    case (step exec_gpv' exec_until_stop') case step: 3\n    show ?case using step.prems\n      apply(simp add: map_spmf_bind_spmf bind_map_spmf gpv.map_sel)\n      apply(rule rel_spmf_bind_reflI)\n      apply(clarsimp simp add: map_spmf_bind_spmf split!: generat.split)\n      apply(rule rel_spmf_bind_reflI)\n      apply clarsimp\n      apply(drule (2) sticking)\n      apply(auto split!: option.split intro: step.IH)\n      done\n  qed\n  note this(1)[OF go]\n  also\n  have \"\\<not> stop s2 \\<Longrightarrow> ord_spmf (=) (map_spmf (\\<lambda>(x, s1, s2). (x, s2)) (exec_until_stop joint callee1 (map_gpv Some id gpv) s1 s2 True)) (exec_gpv_stop callee2 gpv s2)\"\n    and \"ord_spmf (=) (map_spmf (\\<lambda>(x, s1, y). (x, y)) (exec_until_stop joint callee1 (Done None :: ('a option, 'c, 'r) gpv) s1 s2 b)) (return_spmf (None, s2))\"\n    and \"stop s2 \\<Longrightarrow> ord_spmf (=) (map_spmf (\\<lambda>(x, s1, s2). (x, s2)) (exec_until_stop joint callee1 (map_gpv Some id gpv) s1 s2 False)) (return_spmf (None, s2))\"\n    for b using init\n  proof(induction arbitrary: gpv s1 s2 b rule: exec_until_stop.fixp_induct[case_names adm bottom step])\n    case adm show ?case by simp\n    { case bottom case 1 show ?case by simp }\n    { case bottom case 2 show ?case by simp }\n    { case bottom case 3 show ?case by simp }\n  next\n    case (step exec_until_stop') case step: 1\n    show ?case using step.prems\n      using [[show_variants]]\n      apply(rewrite exec_gpv.simps)\n      apply(simp add: map_spmf_bind_spmf bind_map_spmf gpv.map_sel)\n      apply(rule ord_spmf_bind_reflI)\n      apply(clarsimp split!: generat.split simp add: map_bind_pmf bind_spmf_def)\n      apply(rewrite j2[symmetric], assumption+)\n      apply(auto 4 3 split!: option.split dest: rel intro: step.IH intro!: rel_pmf_bind_reflI simp add: bind_map_pmf)\n      done\n  next\n    case step case 2 thus ?case by simp\n  next\n    case (step exec_until_stop') case 3\n    thus ?case\n      apply(simp add: map_spmf_bind_spmf o_def)\n      apply(rule ord_spmf_bind_spmfI1)\n      apply(clarsimp split!: generat.split simp add: map_spmf_bind_spmf o_def gpv.map_sel)\n      apply(rule ord_spmf_bind_spmfI1)\n      apply clarsimp\n      apply(drule (2) sticking)\n      apply(clarsimp split!: option.split simp add: step.IH)\n      done\n  qed\n  note this(1)[OF go]\n  finally show ?thesis by(rule rel_pmf_mono)(auto elim!: option.rel_cases)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CryptHOL/GPV_Bisim.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3333221631901137}}
{"text": "(*  Title:      HOL/SMT.thy\n    Author:     Sascha Boehme, TU Muenchen\n*)\n\nsection {* Bindings to Satisfiability Modulo Theories (SMT) solvers based on SMT-LIB 2 *}\n\ntheory SMT\nimports Divides\nkeywords \"smt_status\" :: diag\nbegin\n\nsubsection {* A skolemization tactic and proof method *}\n\nlemma choices:\n  \"\\<And>Q. \\<forall>x. \\<exists>y ya. Q x y ya \\<Longrightarrow> \\<exists>f fa. \\<forall>x. Q x (f x) (fa x)\"\n  \"\\<And>Q. \\<forall>x. \\<exists>y ya yb. Q x y ya yb \\<Longrightarrow> \\<exists>f fa fb. \\<forall>x. Q x (f x) (fa x) (fb x)\"\n  \"\\<And>Q. \\<forall>x. \\<exists>y ya yb yc. Q x y ya yb yc \\<Longrightarrow> \\<exists>f fa fb fc. \\<forall>x. Q x (f x) (fa x) (fb x) (fc x)\"\n  \"\\<And>Q. \\<forall>x. \\<exists>y ya yb yc yd. Q x y ya yb yc yd \\<Longrightarrow>\n     \\<exists>f fa fb fc fd. \\<forall>x. Q x (f x) (fa x) (fb x) (fc x) (fd x)\"\n  \"\\<And>Q. \\<forall>x. \\<exists>y ya yb yc yd ye. Q x y ya yb yc yd ye \\<Longrightarrow>\n     \\<exists>f fa fb fc fd fe. \\<forall>x. Q x (f x) (fa x) (fb x) (fc x) (fd x) (fe x)\"\n  \"\\<And>Q. \\<forall>x. \\<exists>y ya yb yc yd ye yf. Q x y ya yb yc yd ye yf \\<Longrightarrow>\n     \\<exists>f fa fb fc fd fe ff. \\<forall>x. Q x (f x) (fa x) (fb x) (fc x) (fd x) (fe x) (ff x)\"\n  \"\\<And>Q. \\<forall>x. \\<exists>y ya yb yc yd ye yf yg. Q x y ya yb yc yd ye yf yg \\<Longrightarrow>\n     \\<exists>f fa fb fc fd fe ff fg. \\<forall>x. Q x (f x) (fa x) (fb x) (fc x) (fd x) (fe x) (ff x) (fg x)\"\n  by metis+\n\nlemma bchoices:\n  \"\\<And>Q. \\<forall>x \\<in> S. \\<exists>y ya. Q x y ya \\<Longrightarrow> \\<exists>f fa. \\<forall>x \\<in> S. Q x (f x) (fa x)\"\n  \"\\<And>Q. \\<forall>x \\<in> S. \\<exists>y ya yb. Q x y ya yb \\<Longrightarrow> \\<exists>f fa fb. \\<forall>x \\<in> S. Q x (f x) (fa x) (fb x)\"\n  \"\\<And>Q. \\<forall>x \\<in> S. \\<exists>y ya yb yc. Q x y ya yb yc \\<Longrightarrow> \\<exists>f fa fb fc. \\<forall>x \\<in> S. Q x (f x) (fa x) (fb x) (fc x)\"\n  \"\\<And>Q. \\<forall>x \\<in> S. \\<exists>y ya yb yc yd. Q x y ya yb yc yd \\<Longrightarrow>\n    \\<exists>f fa fb fc fd. \\<forall>x \\<in> S. Q x (f x) (fa x) (fb x) (fc x) (fd x)\"\n  \"\\<And>Q. \\<forall>x \\<in> S. \\<exists>y ya yb yc yd ye. Q x y ya yb yc yd ye \\<Longrightarrow>\n    \\<exists>f fa fb fc fd fe. \\<forall>x \\<in> S. Q x (f x) (fa x) (fb x) (fc x) (fd x) (fe x)\"\n  \"\\<And>Q. \\<forall>x \\<in> S. \\<exists>y ya yb yc yd ye yf. Q x y ya yb yc yd ye yf \\<Longrightarrow>\n    \\<exists>f fa fb fc fd fe ff. \\<forall>x \\<in> S. Q x (f x) (fa x) (fb x) (fc x) (fd x) (fe x) (ff x)\"\n  \"\\<And>Q. \\<forall>x \\<in> S. \\<exists>y ya yb yc yd ye yf yg. Q x y ya yb yc yd ye yf yg \\<Longrightarrow>\n    \\<exists>f fa fb fc fd fe ff fg. \\<forall>x \\<in> S. Q x (f x) (fa x) (fb x) (fc x) (fd x) (fe x) (ff x) (fg x)\"\n  by metis+\n\nML {*\nfun moura_tac ctxt =\n  Atomize_Elim.atomize_elim_tac ctxt THEN'\n  SELECT_GOAL (Clasimp.auto_tac (ctxt addSIs @{thms choice choices bchoice bchoices}) THEN\n    ALLGOALS (Metis_Tactic.metis_tac (take 1 ATP_Proof_Reconstruct.partial_type_encs)\n        ATP_Proof_Reconstruct.default_metis_lam_trans ctxt [] ORELSE'\n      blast_tac ctxt))\n*}\n\nmethod_setup moura = {*\n Scan.succeed (SIMPLE_METHOD' o moura_tac)\n*} \"solve skolemization goals, especially those arising from Z3 proofs\"\n\nhide_fact (open) choices bchoices\n\n\nsubsection {* Triggers for quantifier instantiation *}\n\ntext {*\nSome SMT solvers support patterns as a quantifier instantiation\nheuristics. Patterns may either be positive terms (tagged by \"pat\")\ntriggering quantifier instantiations -- when the solver finds a\nterm matching a positive pattern, it instantiates the corresponding\nquantifier accordingly -- or negative terms (tagged by \"nopat\")\ninhibiting quantifier instantiations. A list of patterns\nof the same kind is called a multipattern, and all patterns in a\nmultipattern are considered conjunctively for quantifier instantiation.\nA list of multipatterns is called a trigger, and their multipatterns\nact disjunctively during quantifier instantiation. Each multipattern\nshould mention at least all quantified variables of the preceding\nquantifier block.\n*}\n\ntypedecl 'a symb_list\n\nconsts\n  Symb_Nil :: \"'a symb_list\"\n  Symb_Cons :: \"'a \\<Rightarrow> 'a symb_list \\<Rightarrow> 'a symb_list\"\n\ntypedecl pattern\n\nconsts\n  pat :: \"'a \\<Rightarrow> pattern\"\n  nopat :: \"'a \\<Rightarrow> pattern\"\n\ndefinition trigger :: \"pattern symb_list symb_list \\<Rightarrow> bool \\<Rightarrow> bool\" where\n  \"trigger _ P = P\"\n\n\nsubsection {* Higher-order encoding *}\n\ntext {*\nApplication is made explicit for constants occurring with varying\nnumbers of arguments. This is achieved by the introduction of the\nfollowing constant.\n*}\n\ndefinition fun_app :: \"'a \\<Rightarrow> 'a\" where \"fun_app f = f\"\n\ntext {*\nSome solvers support a theory of arrays which can be used to encode\nhigher-order functions. The following set of lemmas specifies the\nproperties of such (extensional) arrays.\n*}\n\nlemmas array_rules = ext fun_upd_apply fun_upd_same fun_upd_other  fun_upd_upd fun_app_def\n\n\nsubsection {* Normalization *}\n\nlemma case_bool_if[abs_def]: \"case_bool x y P = (if P then x else y)\"\n  by simp\n\nlemmas Ex1_def_raw = Ex1_def[abs_def]\nlemmas Ball_def_raw = Ball_def[abs_def]\nlemmas Bex_def_raw = Bex_def[abs_def]\nlemmas abs_if_raw = abs_if[abs_def]\nlemmas min_def_raw = min_def[abs_def]\nlemmas max_def_raw = max_def[abs_def]\n\n\nsubsection {* Integer division and modulo for Z3 *}\n\ntext {*\nThe following Z3-inspired definitions are overspecified for the case where @{text \"l = 0\"}. This\nSchönheitsfehler is corrected in the @{text div_as_z3div} and @{text mod_as_z3mod} theorems.\n*}\n\ndefinition z3div :: \"int \\<Rightarrow> int \\<Rightarrow> int\" where\n  \"z3div k l = (if l \\<ge> 0 then k div l else - (k div - l))\"\n\ndefinition z3mod :: \"int \\<Rightarrow> int \\<Rightarrow> int\" where\n  \"z3mod k l = k mod (if l \\<ge> 0 then l else - l)\"\n\nlemma div_as_z3div:\n  \"\\<forall>k l. k div l = (if l = 0 then 0 else if l > 0 then z3div k l else z3div (- k) (- l))\"\n  by (simp add: z3div_def)\n\nlemma mod_as_z3mod:\n  \"\\<forall>k l. k mod l = (if l = 0 then k else if l > 0 then z3mod k l else - z3mod (- k) (- l))\"\n  by (simp add: z3mod_def)\n\n\nsubsection {* Setup *}\n\nML_file \"Tools/SMT/smt_util.ML\"\nML_file \"Tools/SMT/smt_failure.ML\"\nML_file \"Tools/SMT/smt_config.ML\"\nML_file \"Tools/SMT/smt_builtin.ML\"\nML_file \"Tools/SMT/smt_datatypes.ML\"\nML_file \"Tools/SMT/smt_normalize.ML\"\nML_file \"Tools/SMT/smt_translate.ML\"\nML_file \"Tools/SMT/smtlib.ML\"\nML_file \"Tools/SMT/smtlib_interface.ML\"\nML_file \"Tools/SMT/smtlib_proof.ML\"\nML_file \"Tools/SMT/smtlib_isar.ML\"\nML_file \"Tools/SMT/z3_proof.ML\"\nML_file \"Tools/SMT/z3_isar.ML\"\nML_file \"Tools/SMT/smt_solver.ML\"\nML_file \"Tools/SMT/cvc4_interface.ML\"\nML_file \"Tools/SMT/cvc4_proof_parse.ML\"\nML_file \"Tools/SMT/verit_proof.ML\"\nML_file \"Tools/SMT/verit_isar.ML\"\nML_file \"Tools/SMT/verit_proof_parse.ML\"\nML_file \"Tools/SMT/z3_interface.ML\"\nML_file \"Tools/SMT/z3_replay_util.ML\"\nML_file \"Tools/SMT/z3_replay_literals.ML\"\nML_file \"Tools/SMT/z3_replay_rules.ML\"\nML_file \"Tools/SMT/z3_replay_methods.ML\"\nML_file \"Tools/SMT/z3_replay.ML\"\nML_file \"Tools/SMT/smt_systems.ML\"\n\nmethod_setup smt = {*\n  Scan.optional Attrib.thms [] >>\n    (fn thms => fn ctxt =>\n      METHOD (fn facts => HEADGOAL (SMT_Solver.smt_tac ctxt (thms @ facts))))\n*} \"apply an SMT solver to the current goal\"\n\n\nsubsection {* Configuration *}\n\ntext {*\nThe current configuration can be printed by the command\n@{text smt_status}, which shows the values of most options.\n*}\n\n\nsubsection {* General configuration options *}\n\ntext {*\nThe option @{text smt_solver} can be used to change the target SMT\nsolver. The possible values can be obtained from the @{text smt_status}\ncommand.\n\nDue to licensing restrictions, Z3 is not enabled by default. Z3 is free\nfor non-commercial applications and can be enabled by setting Isabelle\nsystem option @{text z3_non_commercial} to @{text yes}.\n*}\n\ndeclare [[smt_solver = z3]]\n\ntext {*\nSince SMT solvers are potentially nonterminating, there is a timeout\n(given in seconds) to restrict their runtime.\n*}\n\ndeclare [[smt_timeout = 20]]\n\ntext {*\nSMT solvers apply randomized heuristics. In case a problem is not\nsolvable by an SMT solver, changing the following option might help.\n*}\n\ndeclare [[smt_random_seed = 1]]\n\ntext {*\nIn general, the binding to SMT solvers runs as an oracle, i.e, the SMT\nsolvers are fully trusted without additional checks. The following\noption can cause the SMT solver to run in proof-producing mode, giving\na checkable certificate. This is currently only implemented for Z3.\n*}\n\ndeclare [[smt_oracle = false]]\n\ntext {*\nEach SMT solver provides several commandline options to tweak its\nbehaviour. They can be passed to the solver by setting the following\noptions.\n*}\n\ndeclare [[cvc3_options = \"\"]]\ndeclare [[cvc4_options = \"--full-saturate-quant --inst-when=full-last-call --inst-no-entail --term-db-mode=relevant\"]]\ndeclare [[verit_options = \"\"]]\ndeclare [[z3_options = \"\"]]\n\ntext {*\nThe SMT method provides an inference mechanism to detect simple triggers\nin quantified formulas, which might increase the number of problems\nsolvable by SMT solvers (note: triggers guide quantifier instantiations\nin the SMT solver). To turn it on, set the following option.\n*}\n\ndeclare [[smt_infer_triggers = false]]\n\ntext {*\nEnable the following option to use built-in support for datatypes,\ncodatatypes, and records in CVC4. Currently, this is implemented only\nin oracle mode.\n*}\n\ndeclare [[cvc4_extensions = false]]\n\ntext {*\nEnable the following option to use built-in support for div/mod, datatypes,\nand records in Z3. Currently, this is implemented only in oracle mode.\n*}\n\ndeclare [[z3_extensions = false]]\n\n\nsubsection {* Certificates *}\n\ntext {*\nBy setting the option @{text smt_certificates} to the name of a file,\nall following applications of an SMT solver a cached in that file.\nAny further application of the same SMT solver (using the very same\nconfiguration) re-uses the cached certificate instead of invoking the\nsolver. An empty string disables caching certificates.\n\nThe filename should be given as an explicit path. It is good\npractice to use the name of the current theory (with ending\n@{text \".certs\"} instead of @{text \".thy\"}) as the certificates file.\nCertificate files should be used at most once in a certain theory context,\nto avoid race conditions with other concurrent accesses.\n*}\n\ndeclare [[smt_certificates = \"\"]]\n\ntext {*\nThe option @{text smt_read_only_certificates} controls whether only\nstored certificates are should be used or invocation of an SMT solver\nis allowed. When set to @{text true}, no SMT solver will ever be\ninvoked and only the existing certificates found in the configured\ncache are used;  when set to @{text false} and there is no cached\ncertificate for some proposition, then the configured SMT solver is\ninvoked.\n*}\n\ndeclare [[smt_read_only_certificates = false]]\n\n\nsubsection {* Tracing *}\n\ntext {*\nThe SMT method, when applied, traces important information. To\nmake it entirely silent, set the following option to @{text false}.\n*}\n\ndeclare [[smt_verbose = true]]\n\ntext {*\nFor tracing the generated problem file given to the SMT solver as\nwell as the returned result of the solver, the option\n@{text smt_trace} should be set to @{text true}.\n*}\n\ndeclare [[smt_trace = false]]\n\n\nsubsection {* Schematic rules for Z3 proof reconstruction *}\n\ntext {*\nSeveral prof rules of Z3 are not very well documented. There are two\nlemma groups which can turn failing Z3 proof reconstruction attempts\ninto succeeding ones: the facts in @{text z3_rule} are tried prior to\nany implemented reconstruction procedure for all uncertain Z3 proof\nrules;  the facts in @{text z3_simp} are only fed to invocations of\nthe simplifier when reconstructing theory-specific proof steps.\n*}\n\nlemmas [z3_rule] =\n  refl eq_commute conj_commute disj_commute simp_thms nnf_simps\n  ring_distribs field_simps times_divide_eq_right times_divide_eq_left\n  if_True if_False not_not\n  NO_MATCH_def\n\nlemma [z3_rule]:\n  \"(P \\<and> Q) = (\\<not> (\\<not> P \\<or> \\<not> Q))\"\n  \"(P \\<and> Q) = (\\<not> (\\<not> Q \\<or> \\<not> P))\"\n  \"(\\<not> P \\<and> Q) = (\\<not> (P \\<or> \\<not> Q))\"\n  \"(\\<not> P \\<and> Q) = (\\<not> (\\<not> Q \\<or> P))\"\n  \"(P \\<and> \\<not> Q) = (\\<not> (\\<not> P \\<or> Q))\"\n  \"(P \\<and> \\<not> Q) = (\\<not> (Q \\<or> \\<not> P))\"\n  \"(\\<not> P \\<and> \\<not> Q) = (\\<not> (P \\<or> Q))\"\n  \"(\\<not> P \\<and> \\<not> Q) = (\\<not> (Q \\<or> P))\"\n  by auto\n\nlemma [z3_rule]:\n  \"(P \\<longrightarrow> Q) = (Q \\<or> \\<not> P)\"\n  \"(\\<not> P \\<longrightarrow> Q) = (P \\<or> Q)\"\n  \"(\\<not> P \\<longrightarrow> Q) = (Q \\<or> P)\"\n  \"(True \\<longrightarrow> P) = P\"\n  \"(P \\<longrightarrow> True) = True\"\n  \"(False \\<longrightarrow> P) = True\"\n  \"(P \\<longrightarrow> P) = True\"\n  \"(\\<not> (A \\<longleftrightarrow> \\<not> B)) \\<longleftrightarrow> (A \\<longleftrightarrow> B)\"\n  by auto\n\nlemma [z3_rule]:\n  \"((P = Q) \\<longrightarrow> R) = (R | (Q = (\\<not> P)))\"\n  by auto\n\nlemma [z3_rule]:\n  \"(\\<not> True) = False\"\n  \"(\\<not> False) = True\"\n  \"(x = x) = True\"\n  \"(P = True) = P\"\n  \"(True = P) = P\"\n  \"(P = False) = (\\<not> P)\"\n  \"(False = P) = (\\<not> P)\"\n  \"((\\<not> P) = P) = False\"\n  \"(P = (\\<not> P)) = False\"\n  \"((\\<not> P) = (\\<not> Q)) = (P = Q)\"\n  \"\\<not> (P = (\\<not> Q)) = (P = Q)\"\n  \"\\<not> ((\\<not> P) = Q) = (P = Q)\"\n  \"(P \\<noteq> Q) = (Q = (\\<not> P))\"\n  \"(P = Q) = ((\\<not> P \\<or> Q) \\<and> (P \\<or> \\<not> Q))\"\n  \"(P \\<noteq> Q) = ((\\<not> P \\<or> \\<not> Q) \\<and> (P \\<or> Q))\"\n  by auto\n\nlemma [z3_rule]:\n  \"(if P then P else \\<not> P) = True\"\n  \"(if \\<not> P then \\<not> P else P) = True\"\n  \"(if P then True else False) = P\"\n  \"(if P then False else True) = (\\<not> P)\"\n  \"(if P then Q else True) = ((\\<not> P) \\<or> Q)\"\n  \"(if P then Q else True) = (Q \\<or> (\\<not> P))\"\n  \"(if P then Q else \\<not> Q) = (P = Q)\"\n  \"(if P then Q else \\<not> Q) = (Q = P)\"\n  \"(if P then \\<not> Q else Q) = (P = (\\<not> Q))\"\n  \"(if P then \\<not> Q else Q) = ((\\<not> Q) = P)\"\n  \"(if \\<not> P then x else y) = (if P then y else x)\"\n  \"(if P then (if Q then x else y) else x) = (if P \\<and> (\\<not> Q) then y else x)\"\n  \"(if P then (if Q then x else y) else x) = (if (\\<not> Q) \\<and> P then y else x)\"\n  \"(if P then (if Q then x else y) else y) = (if P \\<and> Q then x else y)\"\n  \"(if P then (if Q then x else y) else y) = (if Q \\<and> P then x else y)\"\n  \"(if P then x else if P then y else z) = (if P then x else z)\"\n  \"(if P then x else if Q then x else y) = (if P \\<or> Q then x else y)\"\n  \"(if P then x else if Q then x else y) = (if Q \\<or> P then x else y)\"\n  \"(if P then x = y else x = z) = (x = (if P then y else z))\"\n  \"(if P then x = y else y = z) = (y = (if P then x else z))\"\n  \"(if P then x = y else z = y) = (y = (if P then x else z))\"\n  by auto\n\nlemma [z3_rule]:\n  \"0 + (x::int) = x\"\n  \"x + 0 = x\"\n  \"x + x = 2 * x\"\n  \"0 * x = 0\"\n  \"1 * x = x\"\n  \"x + y = y + x\"\n  by (auto simp add: mult_2)\n\nlemma [z3_rule]:  (* for def-axiom *)\n  \"P = Q \\<or> P \\<or> Q\"\n  \"P = Q \\<or> \\<not> P \\<or> \\<not> Q\"\n  \"(\\<not> P) = Q \\<or> \\<not> P \\<or> Q\"\n  \"(\\<not> P) = Q \\<or> P \\<or> \\<not> Q\"\n  \"P = (\\<not> Q) \\<or> \\<not> P \\<or> Q\"\n  \"P = (\\<not> Q) \\<or> P \\<or> \\<not> Q\"\n  \"P \\<noteq> Q \\<or> P \\<or> \\<not> Q\"\n  \"P \\<noteq> Q \\<or> \\<not> P \\<or> Q\"\n  \"P \\<noteq> (\\<not> Q) \\<or> P \\<or> Q\"\n  \"(\\<not> P) \\<noteq> Q \\<or> P \\<or> Q\"\n  \"P \\<or> Q \\<or> P \\<noteq> (\\<not> Q)\"\n  \"P \\<or> Q \\<or> (\\<not> P) \\<noteq> Q\"\n  \"P \\<or> \\<not> Q \\<or> P \\<noteq> Q\"\n  \"\\<not> P \\<or> Q \\<or> P \\<noteq> Q\"\n  \"P \\<or> y = (if P then x else y)\"\n  \"P \\<or> (if P then x else y) = y\"\n  \"\\<not> P \\<or> x = (if P then x else y)\"\n  \"\\<not> P \\<or> (if P then x else y) = x\"\n  \"P \\<or> R \\<or> \\<not> (if P then Q else R)\"\n  \"\\<not> P \\<or> Q \\<or> \\<not> (if P then Q else R)\"\n  \"\\<not> (if P then Q else R) \\<or> \\<not> P \\<or> Q\"\n  \"\\<not> (if P then Q else R) \\<or> P \\<or> R\"\n  \"(if P then Q else R) \\<or> \\<not> P \\<or> \\<not> Q\"\n  \"(if P then Q else R) \\<or> P \\<or> \\<not> R\"\n  \"(if P then \\<not> Q else R) \\<or> \\<not> P \\<or> Q\"\n  \"(if P then Q else \\<not> R) \\<or> P \\<or> R\"\n  by auto\n\nhide_type (open) symb_list pattern\nhide_const (open) Symb_Nil Symb_Cons trigger pat nopat fun_app z3div z3mod\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/SMT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5117166047041652, "lm_q2_score": 0.651354857898194, "lm_q1q2_score": 0.3333090963412279}}
{"text": "header {* \\section{A generic model for separation kernels}\\label{sect:generic} \n\n{\\em\n  This section defines a detailed generic model of separation kernels\n  called CISK (Controlled Interruptible Separation Kernel).  It\n  contains a generic functional model of the behaviour of a separation kernel\n  as a transition system, definitions of\n  the security property and proofs that the functional model satisfies \n  security properties. It is based on Rushby's approach \\cite{Rushby1992noninterference}\n  for  noninterference.  For an explanation of the model, its structure and\n  an overview of the proofs, we refer to the document entitled ``A New\n  Theory of Intransitive Noninterference for Separation Kernels with\n  Control''~\\cite{Verbeek2013}.\n\n  The structure of the model is based on locales and refinement:\n  \\begin{itemize}\n  \\item locale ``Kernel\" defines a highly generic model for a kernel, with execution semantics. \n        It defines a state transition system with some extensions to the one\n        used in \\cite{Rushby1992noninterference}.\n        The transition system defined here stores the currently active\n        domain in the state, and has transitions for explicit\n        context switches and interrupts and provides a notion of control.\n        As each operation of the system will be split into atomic actions \n        in our model, only certain sequences of actions will correspond to a run on a\n        real system. Therefore, \n        the function $run$, which applies an execution on a state and computes the resulting\n        new state, is partial and defined for realistic traces only.\n        Later, but not in this locale, we will define a predicate to distinguish \n        realistic traces from other traces.\n        Security properties are also not part of this locale, but will\n        be introduced in the locales to be described next.\n  \\item locale ``Separation\\_Kernel\" extends \"Kernel\" with constraints concerning non-interference.\n        The theorem is only sensical for realistic traces; for unrealistic trace it will hold vacuously.\n  \\item locale ``Interruptible\\_Separation\\_Kernel\" refines ``Separation\\_Kernel\" with interruptible action sequences.\n        It defines function ``realistic\\_trace'' based on these action sequences.\n        Therefore, we can formulate a total run function.\n  \\item locale ``Controlled\\_Interruptible\\_Separation\\_Kernel\" refines ``Interruptible\\_Separation\\_Kernel\" with abortable action sequences.\n        It refines function ``control'' which now uses a generic predicate ``aborting'' and a generic function ``set\\_error\\_code''\n        to manage aborting of action sequences.\n  \\end{itemize}\n  }\n  \n  \\subsection{K (Kernel)} *}\n\ntheory K\n  imports Main List Set Transitive_Closure List_Theorems Option_Binders\nbegin\n\n\ntext {*\nThe model makes use of the following types:\n\\begin{description}\n\\item['state\\_t] A state  contains information about the resources of the system, \n                 as well as which domain is currently active.\nWe decided that a state does \\emph{not} need to include a program stack, as in this model the actions that are executed are modelled separately. \n\\item['dom\\_t] A domain is an entity executing actions and making calls to the kernel. \n               This type represents the names of all domains.\n               Later on, we define security policies in terms of domains. \n\\item['action\\_t] Actions of type 'action\\_t represent atomic instructions that are executed by the kernel.\nAs kernel actions are assumed to be atomic, we assume that after each kernel action an interrupt point can occur.\n\\item['action\\_t execution] An execution of some domain is the code or the program that is executed by the domain.\nOne call from a domain to the kernel will typically trigger a succession of one or more kernel actions.\nTherefore, an execution is represented as a list of \\emph{sequences} of kernel actions.\nNon-kernel actions are not take into account. \n\\item['output\\_t] Given the current state and an action an output can be computed deterministically.\n\\item[time\\_t] Time is modelled using natural numbers. Each atomic kernel action can be executed within one time unit.\n\\end{description}\n*}\n\ntype_synonym ('action_t) execution = \"'action_t list list\"\ntype_synonym time_t = nat\n\ntext {*\n  Function \\emph{kstep} (for kernel step) computes the next state based on the current state $s$ and a given action $a$.\n  It may assume that it makes sense to perform this action, i.e., that any precondition that is necessary for execution of action $a$ in state $s$ is met.\n  If not, it may return any result. This precondition is represented by generic predicate \\emph{kprecondition} (for kernel precondition).\n  Only realistic traces are considered. Predicate \\emph{realistic\\_execution} decides whether a given execution is realistic.\n  \n  Function \\emph{current} returns given the state the domain that is currently executing actions. The model assumes a single-core setting, i.e., at all times only one domain is active.\n  Interrupt behavior is modelled using functions \\emph{interrupt} and \\emph{cswitch} (for context switch) that dictate respectively  when interrupts occur and how interrupts occur.\n  Interrupts are solely time-based, meaning that there is an at beforehand fixed schedule dictating which domain is active at which time.\n  \n  Finally, we add function \\emph{control}.\n  This function represents control of the kernel over the execution as performed by the domains.\n  Given the current state $s$, the currently active domain $d$ and the execution $\\alpha$ of that domain,\n  it returns three objects.\n  First, it returns the next action that domain $d$ will perform. Commonly, this is the next action in execution $\\alpha$. It may also return None, indicating that no action is done.\n  Secondly, it returns the updated execution. When executing action $a$, typically, this action will be removed from the current execution (i.e., updating the program stack).\n  Thirdly, it can update the state to set, e.g., error codes.\n*}\n\nlocale Kernel =\n  fixes kstep :: \"'state_t \\<Rightarrow> 'action_t \\<Rightarrow> 'state_t\"\n    and output_f :: \"'state_t \\<Rightarrow> 'action_t \\<Rightarrow> 'output_t\"\n    and s0 :: 'state_t\n    and current :: \"'state_t => 'dom_t\" (* \"Returns the currently active domain\"*)\n    and cswitch :: \"time_t \\<Rightarrow> 'state_t \\<Rightarrow> 'state_t\" (* \"Switches the current domain\" *)\n    and interrupt :: \"time_t \\<Rightarrow> bool\" (* \"Returns t iff an interrupt occurs in the given state at the given time\"*)\n    and kprecondition :: \"'state_t \\<Rightarrow> 'action_t \\<Rightarrow> bool\" (* \"Returns t if an precondition holds that relates the current action to the state\" *)\n    and realistic_execution :: \"'action_t execution \\<Rightarrow> bool\" (* \"In this locale, this function is completely unconstrained.\" *)\n    and control :: \"'state_t \\<Rightarrow> 'dom_t \\<Rightarrow> 'action_t execution \\<Rightarrow>\n                              (('action_t option) \\<times> 'action_t execution \\<times> 'state_t)\" \n    and kinvolved :: \"'action_t \\<Rightarrow> 'dom_t set\"\nbegin\n\nsubsubsection {* Execution semantics *}\n\ntext {*\n  Short hand notations for using function control.\n*}\ndefinition next_action::\"'state_t \\<Rightarrow> ('dom_t \\<Rightarrow> 'action_t execution) \\<Rightarrow> 'action_t option\"\nwhere \"next_action s execs = fst (control s (current s) (execs (current s)))\"\ndefinition next_execs::\"'state_t \\<Rightarrow> ('dom_t \\<Rightarrow> 'action_t execution) \\<Rightarrow> ('dom_t \\<Rightarrow> 'action_t execution)\"\nwhere \"next_execs s execs = (fun_upd execs (current s) (fst (snd (control s  (current s) (execs (current s))))))\"\ndefinition next_state::\"'state_t \\<Rightarrow> ('dom_t \\<Rightarrow> 'action_t execution) \\<Rightarrow> 'state_t\"\nwhere \"next_state s execs = snd (snd (control s  (current s) (execs (current s))))\"\n\ntext {*\n  A thread is empty iff either it has no further action sequences to execute, or when the current action sequence is finished and there are no further action sequences to execute.\n*}\nabbreviation thread_empty::\"'action_t execution \\<Rightarrow> bool\"\nwhere \"thread_empty exec \\<equiv> exec = [] \\<or> exec = [[]]\"\n\ntext {*\n  Wrappers for function kstep and kprecondition that deal with the case where the given action is None.\n*}\ndefinition step where \"step s oa \\<equiv> case oa of None \\<Rightarrow> s | (Some a) \\<Rightarrow> kstep s a\"\ndefinition precondition :: \"'state_t \\<Rightarrow> 'action_t option \\<Rightarrow> bool\"\nwhere \"precondition s a \\<equiv> a \\<rightharpoonup> kprecondition s\"\ndefinition involved\nwhere \"involved oa \\<equiv> case oa of None \\<Rightarrow> {} | (Some a) \\<Rightarrow> kinvolved a\"\n\n\ntext {*\n  Execution semantics are defined as follows: a run consists of consecutively running sequences of actions.\n  These sequences are interruptable.\n  Run first checks whether an interrupt occurs.\n  When this happens, function cswitch may switch the context.\n  Otherwise, function control is used to determine the next action $a$, which also yields a new state $s'$.\n  Action $a$ is executed by executing (step $s'$ $a$).\n  The current execution of the current domain is updated. \n  \n  Note that run is a partial function, i.e., it computes results only when at all times the preconditions hold.\n  Such runs are the realistic ones. For other runs, we do not need to -- and cannot -- prove security.\n  All the theorems are formulated in such a way that they hold vacuously for unrealistic runs.\n*} \nfunction run :: \"time_t \\<Rightarrow> 'state_t option \\<Rightarrow> ('dom_t \\<Rightarrow> 'action_t execution) \\<Rightarrow> 'state_t option\"\nwhere \"run 0 s execs = s\"\n| \"run (Suc n) None execs = None\"\n| \"interrupt (Suc n) \\<Longrightarrow> run (Suc n) (Some s) execs = run n (Some (cswitch (Suc n) s)) execs\"\n| \"\\<not>interrupt (Suc n) \\<Longrightarrow> thread_empty(execs (current s)) \\<Longrightarrow> run (Suc n) (Some s) execs = run n (Some s) execs\"\n| \"\\<not>interrupt (Suc n) \\<Longrightarrow> \\<not>thread_empty(execs (current s)) \\<Longrightarrow> \\<not>precondition (next_state s execs) (next_action s execs) \\<Longrightarrow> run (Suc n) (Some s) execs = None\"\n| \"\\<not>interrupt (Suc n) \\<Longrightarrow> \\<not>thread_empty(execs (current s)) \\<Longrightarrow> precondition (next_state s execs) (next_action s execs) \\<Longrightarrow>\n      run (Suc n) (Some s) execs = run n (Some (step (next_state s execs)  (next_action s execs))) (next_execs s execs)\"\nusing not0_implies_Suc by (metis option.exhaust prod_cases3,auto) \ntermination by lexicographic_order\nend\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/CISC-Kernel/trace/Rushby-with-Control/K.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.682573734412324, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3332894205786069}}
{"text": "(* Authors: Lammich, Wimmer *)\ntheory Recursion_Combinators\n  imports Refine_Imperative_HOL.IICF\nbegin\n\ncontext\nbegin\n\nprivate definition for_comb where\n  \"for_comb f a0 n = nfoldli [0..<n + 1] (\\<lambda> x. True) (\\<lambda> k a. (f a k)) a0\"\n\nfun for_rec :: \"('a \\<Rightarrow> nat \\<Rightarrow> 'a nres) \\<Rightarrow> 'a \\<Rightarrow> nat \\<Rightarrow> 'a nres\" where\n  \"for_rec f a 0 = f a 0\" |\n  \"for_rec f a (Suc n) = for_rec f a n \\<bind> (\\<lambda> x. f x (Suc n))\"\n\nprivate lemma for_comb_for_rec: \"for_comb f a n = for_rec f a n\"\nunfolding for_comb_def\nproof (induction f a n rule: for_rec.induct)\n  case 1 then show ?case by (auto simp: pw_eq_iff refine_pw_simps)\nnext\n  case IH: (2 a n)\n  then show ?case by (fastforce simp: nfoldli_append pw_eq_iff refine_pw_simps)\nqed\n\nprivate definition for_rec2' where\n  \"for_rec2' f a n i j =\n    (if i = 0 then RETURN a else for_rec (\\<lambda>a i. for_rec (\\<lambda> a. f a i) a n) a (i - 1))\n    \\<bind> (\\<lambda> a. for_rec (\\<lambda> a. f a i) a j)\"\n\nfun for_rec2 :: \"('a \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> 'a nres) \\<Rightarrow> 'a \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> 'a nres\" where\n  \"for_rec2 f a n 0 0 = f a 0 0\" |\n  \"for_rec2 f a n (Suc i) 0 = for_rec2 f a n i n \\<bind> (\\<lambda> a. f a (Suc i) 0)\" |\n  \"for_rec2 f a n i (Suc j) = for_rec2 f a n i j \\<bind> (\\<lambda> a. f a i (Suc j))\"\n\nprivate lemma for_rec2_for_rec2':\n  \"for_rec2 f a n i j = for_rec2' f a n i j\"\nunfolding for_rec2'_def\n apply (induction f a n i j rule: for_rec2.induct)\n apply simp_all\n subgoal for f a n i\n  apply (cases i)\n by auto\ndone\n\nfun for_rec3 :: \"('a \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> 'a nres) \\<Rightarrow> 'a \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> 'a nres\"\nwhere\n  \"for_rec3 f m n 0       0       0        = f m 0 0 0\" |\n  \"for_rec3 f m n (Suc k) 0       0        = for_rec3 f m n k n n \\<bind> (\\<lambda> a. f a (Suc k) 0 0)\" |\n  \"for_rec3 f m n k       (Suc i) 0        = for_rec3 f m n k i n \\<bind> (\\<lambda> a. f a k (Suc i) 0)\" |\n  \"for_rec3 f m n k       i       (Suc j)  = for_rec3 f m n k i j \\<bind> (\\<lambda> a. f a k i (Suc j))\"\n\nprivate definition for_rec3' where\n  \"for_rec3' f a n k i j =\n    (if k = 0 then RETURN a else for_rec (\\<lambda>a k. for_rec2' (\\<lambda> a. f a k) a n n n) a (k - 1))\n    \\<bind> (\\<lambda> a. for_rec2' (\\<lambda> a. f a k) a n i j)\"\n\nprivate lemma for_rec3_for_rec3':\n  \"for_rec3 f a n k i j = for_rec3' f a n k i j\"\nunfolding for_rec3'_def\n apply (induction f a n k i j rule: for_rec3.induct)\n apply (simp_all add: for_rec2_for_rec2'[symmetric])\n subgoal for f a n k\n  apply (cases k)\n by auto\ndone\n\nprivate lemma for_rec2'_for_rec:\n  \"for_rec2' f a n n n =\n    for_rec (\\<lambda>a i. for_rec (\\<lambda> a. f a i) a n) a n\"\nunfolding for_rec2'_def by (cases n) auto\n\nprivate lemma for_rec3'_for_rec:\n  \"for_rec3' f a n n n n =\n    for_rec (\\<lambda> a k. for_rec (\\<lambda>a i. for_rec (\\<lambda> a. f a k i) a n) a n) a n\"\nunfolding for_rec3'_def for_rec2'_for_rec by (cases n) auto\n\ntheorem for_rec_eq:\n  \"for_rec f a n = nfoldli [0..<n + 1] (\\<lambda>x. True) (\\<lambda>k a. f a k) a\"\nusing for_comb_for_rec[unfolded for_comb_def, symmetric] .\n\ntheorem for_rec2_eq:\n  \"for_rec2 f a n n n =\n     nfoldli [0..<n + 1] (\\<lambda>x. True)\n           (\\<lambda>i. nfoldli [0..<n + 1] (\\<lambda>x. True) (\\<lambda>j a. f a i j)) a\"\nusing\n  for_rec2'_for_rec[\n    unfolded for_rec2_for_rec2'[symmetric], unfolded for_comb_for_rec[symmetric] for_comb_def\n  ] .\n\ntheorem for_rec3_eq:\n  \"for_rec3 f a n n n n =\n    nfoldli [0..<n + 1] (\\<lambda>x. True)\n     (\\<lambda>k. nfoldli [0..<n + 1] (\\<lambda>x. True)\n           (\\<lambda>i. nfoldli [0..<n + 1] (\\<lambda>x. True) (\\<lambda>j a. f a k i j)))\n     a\"\nusing\n  for_rec3'_for_rec[\n    unfolded for_rec3_for_rec3'[symmetric], unfolded for_comb_for_rec[symmetric] for_comb_def\n  ] .\n\nend\n\nlemmas [intf_of_assn] = intf_of_assnI[where R= \"is_mtx n\" and 'a= \"'b i_mtx\" for n]\n\ndeclare param_upt[sepref_import_param]\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Floyd_Warshall/Recursion_Combinators.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.333183235354062}}
{"text": "(*\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n     http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n \n *)\n\ntheory BitVector_Rewriting\n  imports artifact_rewriting.Take_Bits_Rewriting artifact_manual_execution.BitVectors\nbegin\n\n\nsubsection \\<open>Logical Operators\\<close>\n\nlemma bv_to_bool_bool_to_bv:\n  shows \"bv_to_bool (bool_to_bv b) = b\"\n  by (cases b,auto simp add: bv_to_bool_def)\n      \nlemma snd_bool_to_bv:\n  shows \"snd (bool_to_bv b) = 1\"\n  by (cases b,auto)\n\nlemma bv_to_bool_True:\n  shows \"bv_to_bool (1, 1) = True\"\n  by (auto simp add: bv_to_bool_def)\n\nlemma bv_to_bool_True_Suc0:\n  shows \"bv_to_bool (1, Suc 0) = True\"\n  by (auto simp add: bv_to_bool_def)\n\nlemma bv_to_bool_False:\n  shows \"bv_to_bool (0, 1) = False\"\n  by (auto simp add: bv_to_bool_def)\n\nlemma bv_to_bool_False_Suc0:\n  shows \"bv_to_bool (0, Suc 0) = False\"\n  by (auto simp add: bv_to_bool_def)\n\n\nlemma bool_to_bv_eq:\n  shows \"bool_to_bv b = (x, Suc 0) \\<longleftrightarrow> (x \\<in> {0,1} \\<and> ((x = 1) \\<longleftrightarrow> b))\"\n  by (cases b,auto)\n\nlemma bv_NOT_bool_to_bv:\n  shows \"bv_NOT (bool_to_bv b) = bool_to_bv (\\<not>b)\"\n  by (cases b, auto simp add: max_word_def) \n\n\n\nsubsection \\<open>Concatenation and slicing\\<close>\n\n\n\nlemmas bv_slice_simps[simp] =\n  bv_slice.simps[of \"numeral h\" \"numeral l\" \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" \"numeral w\" 0]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" \"numeral w\" 1]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 0            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 0            0]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 0            1]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 1            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 1            0]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 1            1]\n  bv_slice.simps[of \"numeral h\" 0            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 0            \"numeral w\" 0]\n  bv_slice.simps[of \"numeral h\" 0            \"numeral w\" 1]\n  bv_slice.simps[of \"numeral h\" 0            0            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 0            0            0]\n  bv_slice.simps[of \"numeral h\" 0            0            1]\n  bv_slice.simps[of \"numeral h\" 0            1            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 0            1            0]\n  bv_slice.simps[of \"numeral h\" 0            1            1]\n  bv_slice.simps[of \"numeral h\" 1            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 1            \"numeral w\" 0]\n  bv_slice.simps[of \"numeral h\" 1            \"numeral w\" 1]\n  bv_slice.simps[of \"numeral h\" 1            0            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 1            0            0]\n  bv_slice.simps[of \"numeral h\" 1            0            1]\n  bv_slice.simps[of \"numeral h\" 1            1            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 1            1            0]\n  bv_slice.simps[of \"numeral h\" 1            1            1]\n  bv_slice.simps[of 0           \"numeral l\" \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 0           \"numeral l\" \"numeral w\" 0]\n  bv_slice.simps[of 0           \"numeral l\" \"numeral w\" 1]\n  bv_slice.simps[of 0           \"numeral l\" 0            \"numeral s\"]\n  bv_slice.simps[of 0           \"numeral l\" 0            0]\n  bv_slice.simps[of 0           \"numeral l\" 0            1]\n  bv_slice.simps[of 0           \"numeral l\" 1            \"numeral s\"]\n  bv_slice.simps[of 0           \"numeral l\" 1            0]\n  bv_slice.simps[of 0           \"numeral l\" 1            1]\n  bv_slice.simps[of 0           0            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 0           0            \"numeral w\" 0]\n  bv_slice.simps[of 0           0            \"numeral w\" 1]\n  bv_slice.simps[of 0           0            0            \"numeral s\"]\n  bv_slice.simps[of 0           0            0            0]\n  bv_slice.simps[of 0           0            0            1]\n  bv_slice.simps[of 0           0            1            \"numeral s\"]\n  bv_slice.simps[of 0           0            1            0]\n  bv_slice.simps[of 0           0            1            1]\n  bv_slice.simps[of 0           1            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 0           1            \"numeral w\" 0]\n  bv_slice.simps[of 0           1            \"numeral w\" 1]\n  bv_slice.simps[of 0           1            0            \"numeral s\"]\n  bv_slice.simps[of 0           1            0            0]\n  bv_slice.simps[of 0           1            0            1]\n  bv_slice.simps[of 0           1            1            \"numeral s\"]\n  bv_slice.simps[of 0           1            1            0]\n  bv_slice.simps[of 0           1            1            1]\n  bv_slice.simps[of 1           \"numeral l\" \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 1           \"numeral l\" \"numeral w\" 0]\n  bv_slice.simps[of 1           \"numeral l\" \"numeral w\" 1]\n  bv_slice.simps[of 1           \"numeral l\" 0            \"numeral s\"]\n  bv_slice.simps[of 1           \"numeral l\" 0            0]\n  bv_slice.simps[of 1           \"numeral l\" 0            1]\n  bv_slice.simps[of 1           \"numeral l\" 1            \"numeral s\"]\n  bv_slice.simps[of 1           \"numeral l\" 1            0]\n  bv_slice.simps[of 1           \"numeral l\" 1            1]\n  bv_slice.simps[of 1           0            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 1           0            \"numeral w\" 0]\n  bv_slice.simps[of 1           0            \"numeral w\" 1]\n  bv_slice.simps[of 1           0            0            \"numeral s\"]\n  bv_slice.simps[of 1           0            0            0]\n  bv_slice.simps[of 1           0            0            1]\n  bv_slice.simps[of 1           0            1            \"numeral s\"]\n  bv_slice.simps[of 1           0            1            0]\n  bv_slice.simps[of 1           0            1            1]\n  bv_slice.simps[of 1           1            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 1           1            \"numeral w\" 0]\n  bv_slice.simps[of 1           1            \"numeral w\" 1]\n  bv_slice.simps[of 1           1            0            \"numeral s\"]\n  bv_slice.simps[of 1           1            0            0]\n  bv_slice.simps[of 1           1            0            1]\n  bv_slice.simps[of 1           1            1            \"numeral s\"]\n  bv_slice.simps[of 1           1            1            0]\n  bv_slice.simps[of 1           1            1            1]\n  for h l w s\n\nlemmas bv_cat_simps[simp] =\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" \"numeral w1\" 0]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" \"numeral w1\" 1]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 0            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 0            0]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 0            1]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 1            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 1            0]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 1            1]\n  bv_cat.simps[of \"numeral w0\" 0            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 0            \"numeral w1\" 0]\n  bv_cat.simps[of \"numeral w0\" 0            \"numeral w1\" 1]\n  bv_cat.simps[of \"numeral w0\" 0            0            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 0            0            0]\n  bv_cat.simps[of \"numeral w0\" 0            0            1]\n  bv_cat.simps[of \"numeral w0\" 0            1            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 0            1            0]\n  bv_cat.simps[of \"numeral w0\" 0            1            1]\n  bv_cat.simps[of \"numeral w0\" 1            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 1            \"numeral w1\" 0]\n  bv_cat.simps[of \"numeral w0\" 1            \"numeral w1\" 1]\n  bv_cat.simps[of \"numeral w0\" 1            0            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 1            0            0]\n  bv_cat.simps[of \"numeral w0\" 1            0            1]\n  bv_cat.simps[of \"numeral w0\" 1            1            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 1            1            0]\n  bv_cat.simps[of \"numeral w0\" 1            1            1]\n  bv_cat.simps[of 0           \"numeral s0\" \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 0           \"numeral s0\" \"numeral w1\" 0]\n  bv_cat.simps[of 0           \"numeral s0\" \"numeral w1\" 1]\n  bv_cat.simps[of 0           \"numeral s0\" 0            \"numeral s1\"]\n  bv_cat.simps[of 0           \"numeral s0\" 0            0]\n  bv_cat.simps[of 0           \"numeral s0\" 0            1]\n  bv_cat.simps[of 0           \"numeral s0\" 1            \"numeral s1\"]\n  bv_cat.simps[of 0           \"numeral s0\" 1            0]\n  bv_cat.simps[of 0           \"numeral s0\" 1            1]\n  bv_cat.simps[of 0           0            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 0           0            \"numeral w1\" 0]\n  bv_cat.simps[of 0           0            \"numeral w1\" 1]\n  bv_cat.simps[of 0           0            0            \"numeral s1\"]\n  bv_cat.simps[of 0           0            0            0]\n  bv_cat.simps[of 0           0            0            1]\n  bv_cat.simps[of 0           0            1            \"numeral s1\"]\n  bv_cat.simps[of 0           0            1            0]\n  bv_cat.simps[of 0           0            1            1]\n  bv_cat.simps[of 0           1            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 0           1            \"numeral w1\" 0]\n  bv_cat.simps[of 0           1            \"numeral w1\" 1]\n  bv_cat.simps[of 0           1            0            \"numeral s1\"]\n  bv_cat.simps[of 0           1            0            0]\n  bv_cat.simps[of 0           1            0            1]\n  bv_cat.simps[of 0           1            1            \"numeral s1\"]\n  bv_cat.simps[of 0           1            1            0]\n  bv_cat.simps[of 0           1            1            1]\n  bv_cat.simps[of 1           \"numeral s0\" \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 1           \"numeral s0\" \"numeral w1\" 0]\n  bv_cat.simps[of 1           \"numeral s0\" \"numeral w1\" 1]\n  bv_cat.simps[of 1           \"numeral s0\" 0            \"numeral s1\"]\n  bv_cat.simps[of 1           \"numeral s0\" 0            0]\n  bv_cat.simps[of 1           \"numeral s0\" 0            1]\n  bv_cat.simps[of 1           \"numeral s0\" 1            \"numeral s1\"]\n  bv_cat.simps[of 1           \"numeral s0\" 1            0]\n  bv_cat.simps[of 1           \"numeral s0\" 1            1]\n  bv_cat.simps[of 1           0            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 1           0            \"numeral w1\" 0]\n  bv_cat.simps[of 1           0            \"numeral w1\" 1]\n  bv_cat.simps[of 1           0            0            \"numeral s1\"]\n  bv_cat.simps[of 1           0            0            0]\n  bv_cat.simps[of 1           0            0            1]\n  bv_cat.simps[of 1           0            1            \"numeral s1\"]\n  bv_cat.simps[of 1           0            1            0]\n  bv_cat.simps[of 1           0            1            1]\n  bv_cat.simps[of 1           1            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 1           1            \"numeral w1\" 0]\n  bv_cat.simps[of 1           1            \"numeral w1\" 1]\n  bv_cat.simps[of 1           1            0            \"numeral s1\"]\n  bv_cat.simps[of 1           1            0            0]\n  bv_cat.simps[of 1           1            0            1]\n  bv_cat.simps[of 1           1            1            \"numeral s1\"]\n  bv_cat.simps[of 1           1            1            0]\n  bv_cat.simps[of 1           1            1            1]\n  for w0 s0 w1 s1\n\nlemma size_bv_cat:\n  shows \"snd (bv_cat a b) = snd a + snd b\"\n  by (cases a,cases b,auto simp add: bv_cat.simps)\n\nlemma size_bv_slice:\n  shows \"snd (bv_slice h l a) = h + 1 - l\"\n  by (cases a,auto simp add: bv_slice.simps)\n\nlemma bv_cat_prepend_0:\n  fixes a :: \"'a::len word\"\n  assumes \"s < LENGTH('a)\"\n  shows \"bv_cat (0, s') (a,s) = (if s = 0 then 0 else \\<langle>s-1,0\\<rangle>a,s + s')\"\nproof(cases \"s = 0\")\n  case True\n  thus ?thesis\n    by (auto simp add: bv_cat.simps)\nnext\n  case False\n  {\n    fix b :: \"'a::len word\"\n    assume b: \"b=0\"\n    {\n      fix n::nat\n      assume n: \"n < LENGTH('a)\"  \n      {\n        fix x h l :: nat\n        {\n          fix m :: nat\n          assume m: \"m < LENGTH('a)\"\n          hence \"\\<not> b !! (LENGTH('a) - 1 - m)\"\n            using b\n            by auto\n          hence \"\\<not> to_bl b ! m\"\n            using m\n            by (auto simp add: unfold_test_bit split: if_split_asm)\n        }\n        hence \"\\<not>((\\<langle>h,l\\<rangle>b)::'a::len word) !! x\"\n          apply (cases \"x < LENGTH('a)\";cases \"h < LENGTH('a)\")\n          apply (auto simp add: test_bit_of_take_bits)[1]\n          using b apply simp\n          by (auto simp add: take_bits_def test_bit_bl word_size rev_nth word_rep_drop min_def nth_append)\n      }\n      note 1 = this\n      have \"(fst (bv_cat (b, s') (a,s))) !! n= ((\\<langle>s-1,0\\<rangle>a):: 'a::len word)!!n\"\n        using assms n 1 False\n        apply (auto split: if_split_asm simp add: test_bit_of_take_bits bv_cat.simps word_ao_nth nth_shiftl)\n        using b nth_0 by blast\n    }\n    hence \"(fst (bv_cat (b, s') (a,s))) = ((\\<langle>s-1,0\\<rangle>a):: 'a::len word)\"\n      and \"(snd (bv_cat (b, s') (a,s))) = (s+s')\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size bv_cat.simps)+\n  }\n  thus ?thesis\n    using False\n    apply auto\n    by (metis prod.exhaust_sel)\nqed\n\n\n\n\n\nlemma test_bit_of_bv_cat:\n  fixes a b :: \"'a ::len0 word \\<times> nat\"\n  assumes \"snd a \\<le> LENGTH('a)\"\n      and \"snd b \\<le> LENGTH('a)\"\n      and \"i < LENGTH('a)\"\n    shows \"fst (bv_cat a b) !! i = (if i \\<ge> snd b then (fst a) !! (i - snd b) else (fst b) !! i)\"\n  using assms\n  by (cases a, cases b,auto simp add: bv_cat.simps test_bit_of_take_bits word_ao_nth nth_shiftl word_size split: if_split_asm)\n\nlemma test_bit_of_bv_slice:\n  assumes \"h < \\<M>\"\n  shows \"fst (bv_slice h l a) !! n = (if n < Suc h - l then fst a!!(l+n) else False)\"\n  using assms\n  apply (cases a, cases \"n < \\<M>\",auto simp add: bv_slice.simps test_bit_of_take_bits)\n  by (simp add: word_size test_bit_bin')\n\n\n\nlemma bv_slice_bv_cat:\nassumes \"h < \\<M>\"\n    and \"snd a \\<le> \\<M>\"\n    and \"snd b \\<le> \\<M>\"\n  shows \"bv_slice h l (bv_cat a b) =\n        (if h \\<ge> snd b then\n          (if l \\<ge> snd b then\n            bv_slice (h - snd b) (l - snd b) a\n           else\n            bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b))\n        else\n          (if l \\<ge> snd b then\n               (0,0)\n           else\n              bv_slice h l b))\"\nproof(cases \"h \\<ge> snd b\")\n  case True\n  note h = this\n  show ?thesis\n  proof(cases \"l \\<ge> snd b\")\n    case True\n    {\n      fix i :: nat\n      assume \"i < \\<M>\"\n      hence \"fst (bv_slice h l (bv_cat a b)) !! i = fst (bv_slice (h - snd b) (l - snd b) a) !! i\"\n        using h True assms\n        by (auto simp add: bv_cat.simps test_bit_of_bv_slice nth_ucast test_bit_of_bv_cat split: if_split_asm)\n    }\n    hence \"fst (bv_slice h l (bv_cat a b)) = fst (bv_slice (h - snd b) (l - snd b) a)\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n    moreover\n    have \"snd (bv_slice h l (bv_cat a b)) = snd (bv_slice (h - snd b) (l - snd b) a)\"\n      using True h\n      by (cases a, cases b,auto simp add: size_bv_slice)\n    ultimately\n    show ?thesis\n      using True h\n      apply (auto)\n      by (metis prod.exhaust_sel)\n  next\n    case False\n    {\n      fix i :: nat\n      assume \"i < \\<M>\"\n      hence \"fst (bv_slice h l (bv_cat a b)) !! i = fst (bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b)) !! i\"\n        using h False assms\n        apply (auto simp add: bv_cat.simps nth_ucast test_bit_of_bv_slice test_bit_of_bv_cat word_ao_nth nth_shiftl size_bv_slice split: if_split_asm)\n        by (simp add: Groups.add_ac(2))+\n    }\n    hence \"fst (bv_slice h l (bv_cat a b)) = fst (bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b))\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n    moreover\n    have \"snd (bv_slice h l (bv_cat a b)) = snd (bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b))\"\n      using False h\n      by (cases a, cases b,auto simp add: size_bv_slice size_bv_cat)\n    ultimately\n    show ?thesis\n      using False h\n      apply (auto)\n      by (metis prod.exhaust_sel)\n  qed\nnext\n  case False\n  note h = this\n  show ?thesis\n  proof(cases \"l \\<ge> snd b\")\n    case True\n    {\n      fix i :: nat\n      assume \"i < \\<M>\"\n      hence \"fst (bv_slice h l (bv_cat a b)) !! i = (0::longword) !! i\"\n        using h True assms\n        by (auto simp add: bv_cat.simps nth_ucast test_bit_of_bv_slice test_bit_of_bv_cat split: if_split_asm)\n    }\n    hence \"fst (bv_slice h l (bv_cat a b)) = 0\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n    moreover\n    have \"snd (bv_slice h l (bv_cat a b)) = 0\"\n      using True h\n      by (cases a, cases b,auto simp add: size_bv_slice size_bv_cat)\n    ultimately\n    show ?thesis\n      using True h\n      apply (auto)\n      by (metis prod.exhaust_sel)\n  next\n    case False\n    {\n      fix i :: nat\n      assume \"i < \\<M>\"\n      hence \"fst (bv_slice h l (bv_cat a b)) !! i = fst (bv_slice h l b) !! i\"\n        using h False assms\n        by (auto simp add: bv_cat.simps nth_ucast test_bit_of_bv_slice test_bit_of_bv_cat split: if_split_asm)\n    }\n    hence \"fst (bv_slice h l (bv_cat a b)) = fst (bv_slice h l b)\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n    moreover\n    have \"snd (bv_slice h l (bv_cat a b)) = snd (bv_slice h l b)\"\n      using False h\n      by (cases a, cases b,auto simp add: size_bv_slice size_bv_cat)\n    ultimately\n    show ?thesis\n      using False h\n      apply (auto)\n      by (metis prod.exhaust_sel)\n  qed\nqed\n\n\n\nlemma take_bits_bv_cat:\n  fixes a b :: \"'b ::len0 word \\<times> nat\"\n  assumes \"h < LENGTH('b)\"\n      and \"h - l < LENGTH('a)\"\n      and \"snd b \\<le> LENGTH('b)\"\n    shows \"((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) =\n        (if h \\<ge> snd b then\n          (if l \\<ge> snd b then\n            \\<langle>h - snd b,l - snd b\\<rangle>fst a\n           else\n            fst (bv_cat (\\<langle>h- snd b,0\\<rangle> fst a, h + 1 - snd b) (\\<langle>snd b-1,l\\<rangle> fst b, snd b - l))\n          )\n        else\n          (if l \\<ge> snd b then\n               0\n           else\n              \\<langle>h,l\\<rangle> (fst b)))\"\nproof(cases \"h \\<ge> snd b\")\n  case True\n  note h = this\n  show ?thesis\n  proof(cases \"l \\<ge> snd b\")\n    case True\n    {\n      fix i :: nat\n      assume \"i < LENGTH('a)\"\n      hence \"((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) !! i = ((\\<langle>h - snd b,l - snd b\\<rangle>fst a)::'a::len0 word) !! i\"\n        using h True assms\n        apply (cases \"snd a \\<le> LENGTH('b)\",auto simp add: bv_cat.simps test_bit_of_take_bits nth_ucast test_bit_of_bv_cat split: if_split_asm)\n        apply (cases a,cases b,auto simp add: word_ao_nth nth_shiftl bv_cat.simps test_bit_of_take_bits nth_ucast split: if_split_asm)\n        apply (cases a,cases b,auto simp add: word_ao_nth nth_shiftl bv_cat.simps test_bit_of_take_bits nth_ucast split: if_split_asm)\n        done\n    }\n    hence \"((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) = ((\\<langle>h - snd b,l - snd b\\<rangle>fst a)::'a::len0 word)\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n    thus ?thesis\n      using True h\n      by auto\n  next\n    case False\n    {\n      fix i\n      assume \"i < LENGTH('a)\"\n      hence \"(fst (bv_cat (\\<langle>h- snd b,0\\<rangle> fst a, h + 1 - snd b) (\\<langle>snd b-1,l\\<rangle> fst b, snd b - l)) ::'a::len0 word) !! i = ((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) !! i\"\n        using h False True assms\n        apply (cases a;cases b;auto simp add: word_ao_nth nth_shiftl bv_cat.simps test_bit_of_take_bits nth_ucast split: if_split_asm)\n        by (auto simp add: Groups.add_ac(2) bv_cat.simps test_bit_of_take_bits nth_ucast test_bit_of_bv_cat word_ao_nth nth_shiftl split: if_split_asm)\n        \n      }\n    thus ?thesis\n      using False True\n      apply (auto simp add: )\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n  qed\nnext\n  case False\n  note h = this\n  show ?thesis\n  proof(cases \"l \\<ge> snd b\")\n    case True\n    {\n      fix i :: nat\n      assume \"i < LENGTH('a)\"\n      hence \"((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) !! i = (0::'a::len0 word) !! i\"\n        using h True assms\n        by (auto simp add: bv_cat.simps nth_ucast test_bit_of_take_bits test_bit_of_bv_cat split: if_split_asm)\n    }\n    thus ?thesis\n      using True h\n      apply (auto)\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n  next\n    case False\n    {\n      fix i :: nat\n      assume \"i < LENGTH('a)\"\n      hence \"((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) !! i = (\\<langle>h,l\\<rangle> (fst b)::'a::len0 word) !! i\"\n        using h False assms\n        by (cases a,cases b,auto simp add: word_ao_nth nth_shiftl bv_cat.simps test_bit_of_take_bits nth_ucast split: if_split_asm)\n    }\n    thus ?thesis\n      using False h\n      apply (auto)\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n  qed\nqed\n\nlemma bv_cat_rassoc:\n  fixes a b c :: \"'a::len word \\<times> nat\"\n  assumes \"s = snd a + snd b\"\n      and \"s0 = snd b + snd c\"\n      and \"s0 < LENGTH('a)\"\n    shows \"fst (bv_cat (fst (bv_cat a b), s) c) = fst (bv_cat a (fst (bv_cat b c), s0))\"\n  apply (rule word_eqI)\n  using assms\n  by (cases a;cases b;cases c;auto simp add: Groups.add_ac(2) bv_cat.simps word_ao_nth word_size nth_shiftl test_bit_of_take_bits)\n\n\nlemma take_bits_bv_slice:\n  assumes \"h < \\<M>\"\n      and \"h' < \\<M>\"\n  shows \"\\<langle>h,l\\<rangle>fst (bv_slice h' l' a) =  \\<langle>(if Suc h - l < Suc h' - (l + l') then h + l' else h'),l + l'\\<rangle>fst a\"\n  using assms\n  by (cases a,auto simp add: bv_slice.simps)\n\nlemma bv_slice_take_bits:\n  assumes \"h < \\<M>\"\n      and \"h' < LENGTH('a)\"\n  fixes a ::\"'a::len0 word\"\n  shows \"bv_slice h l (\\<langle>h',l'\\<rangle>a, s) = (\\<langle>(if Suc h - l < Suc h' - (l + l') then h + l' else h'),l + l'\\<rangle>a, h + 1 - l)\"\n  using assms\n  by (auto simp add: bv_slice.simps)\n\nlemma bv_slice_bit32:\n  fixes a :: longword\n  assumes \"s \\<ge> 32\"\n  shows \"bv_slice 31 0 (a,s) = (ucast (\\<langle>31,0\\<rangle>a::32 word), 32)\"\n  using assms\n  by (auto simp add: bv_slice.simps)\n\n(* TO BE MERGED *)\nlemma bv_slice_bit64:\n  fixes a :: longword\n  assumes \"s \\<ge> 64\"\n  shows \"bv_slice 63 0 (a, s) = (ucast (\\<langle>63,0\\<rangle>a::64 word), 64)\"\n  using assms\n  by (auto simp add: bv_slice.simps)\n(* END TO BE MERGED *)\n \nlemma bv_slice_nth_bit:\n  assumes \"h < \\<M>\"\n  shows \"bv_slice h h a = bool_to_bv (fst a !! h)\"\nproof-\n  {\n    fix i :: nat\n    assume \"i < \\<M>\"\n    hence \"((\\<langle>h,h\\<rangle>(fst a))::longword) !! i = (if fst a !! h then 1::longword else 0) !! i\"\n      using assms\n      by (auto simp add: test_bit_of_take_bits)\n  }\n  hence \"((\\<langle>h,h\\<rangle>(fst a))::longword) = (if fst a !! h then 1::longword else 0)\"\n    apply (intro word_eqI)\n    by (auto simp add: word_size)\n  thus ?thesis\n    by (cases a;auto simp add: bv_slice.simps)\nqed\n\n\n\nsubsection \\<open>Arithmetic\\<close>\n\nlemma BV_Add_bit64:\n  fixes a b :: longword\n    shows \"(a,64) +\\<^sup>b\\<^sup>v (b,64) = (ucast (((\\<langle>63,0\\<rangle>a)::64 word) + \\<langle>63,0\\<rangle>b), 64)\"\nproof-\n  have \"(a,64) +\\<^sup>b\\<^sup>v (b,64) = (\\<langle>63,0\\<rangle>(a + b), 64)\"\n    by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n  also have \"... = (ucast ((\\<langle>63,0\\<rangle>(a + b))::64 word), 64)\"\n    by (subst ucast_take_bits,simp,simp,simp)\n  also have \"... = (ucast (((\\<langle>63,0\\<rangle>a)::64 word) + \\<langle>63,0\\<rangle>b), 64)\"\n    by (subst take_bits_plus,simp,simp,simp)\n  finally\n  show ?thesis\n    by auto\nqed\n\nlemma BV_Add_bit33:\n  fixes a b :: longword\n    shows \"(a,33) +\\<^sup>b\\<^sup>v (b,33) = (ucast (((\\<langle>32,0\\<rangle>a)::33 word) + \\<langle>32,0\\<rangle>b), 33)\"\nproof-\n  have \"(a,33) +\\<^sup>b\\<^sup>v (b,33) = (\\<langle>32,0\\<rangle>(a + b), 33)\"\n    by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n  also have \"... = (ucast ((\\<langle>32,0\\<rangle>(a + b))::33 word), 33)\"\n    by (subst ucast_take_bits,simp,simp,simp)\n  also have \"... = (ucast (((\\<langle>32,0\\<rangle>a)::33 word) + \\<langle>32,0\\<rangle>b), 33)\"\n    by (subst take_bits_plus,simp,simp,simp)\n  finally\n  show ?thesis\n    by auto\nqed\n\nlemma BV_Add_bit65:\n  fixes a b :: longword\n    shows \"(a,65) +\\<^sup>b\\<^sup>v (b,65) = (ucast (((\\<langle>64,0\\<rangle>a)::65 word) + \\<langle>64,0\\<rangle>b), 65)\"\nproof-\n  have \"(a,65) +\\<^sup>b\\<^sup>v (b,65) = (\\<langle>64,0\\<rangle>(a + b), 65)\"\n    by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n  also have \"... = (ucast ((\\<langle>64,0\\<rangle>(a + b))::65 word), 65)\"\n    by (subst ucast_take_bits,simp,simp,simp)\n  also have \"... = (ucast (((\\<langle>64,0\\<rangle>a)::65 word) + \\<langle>64,0\\<rangle>b), 65)\"\n    by (subst take_bits_plus,simp,simp,simp)\n  finally\n  show ?thesis\n    by auto\nqed\n\nsubsection \\<open>Floating Point operations\\<close>\n\ncontext abstract_float\nbegin\n\n\nlemma BV_Plus_bit64:\n  fixes a b :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fplus\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>b, 64) = (\\<langle>63,0\\<rangle>(a +\\<^sup>f b), 64)\"\n  by (auto simp add: exec_BV_Plus_Double_def ucast_id)\n\nlemma BV_Plus_bit64_numeral:\n  fixes a :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fplus\\<^sup>b\\<^sup>v (numeral n, 64) = (\\<langle>63,0\\<rangle>(a +\\<^sup>f \\<langle>63,0\\<rangle>((numeral n)::longword)), 64)\"\n  by (auto simp add: exec_BV_Plus_Double_def ucast_id)\n\nlemma BV_Sub_bit64:\n  fixes a b :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fsub\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>b, 64) = (\\<langle>63,0\\<rangle>(a -\\<^sup>f b), 64)\"\n  by (auto simp add: exec_BV_Sub_Double_def ucast_id)\n\nlemma BV_Sub_bit64_numeral:\n  fixes a :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fsub\\<^sup>b\\<^sup>v (numeral n, 64) = (\\<langle>63,0\\<rangle>(a -\\<^sup>f \\<langle>63,0\\<rangle>((numeral n)::longword)), 64)\"\n  by (auto simp add: exec_BV_Sub_Double_def ucast_id)\n\nlemma BV_Mult_bit64:\n  fixes a b :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fmult\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>b, 64) = (\\<langle>63,0\\<rangle>(a *\\<^sup>f b), 64)\"\n  by (auto simp add: exec_BV_Mul_Double_def ucast_id)\n\nlemma BV_Mult_bit64_numeral_r:\n  fixes a :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fmult\\<^sup>b\\<^sup>v (numeral n, 64) = (\\<langle>63,0\\<rangle>(a *\\<^sup>f \\<langle>63,0\\<rangle>((numeral n)::longword)), 64)\"\n  by (auto simp add: exec_BV_Mul_Double_def ucast_id)\nlemma BV_Mult_bit64_numeral_l:\n  fixes a :: \"64 word\"\n  shows \"(numeral n, 64) fmult\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>a, 64) = (\\<langle>63,0\\<rangle>(\\<langle>63,0\\<rangle>((numeral n)::longword) *\\<^sup>f a), 64)\"\n  by (auto simp add: exec_BV_Mul_Double_def ucast_id)\nlemma BV_Mult_bit64_0_l:\n  fixes a :: \"64 word\"\n  shows \"(0, 64) fmult\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>a, 64) = (\\<langle>63,0\\<rangle>(0\\<^sup>+ *\\<^sup>f a), 64)\"\n  by (auto simp add: exec_BV_Mul_Double_def plus_zero_def ucast_id)\nlemma BV_Mult_bit64_0_r:\n  fixes a :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fmult\\<^sup>b\\<^sup>v (0, 64) = (\\<langle>63,0\\<rangle>(a *\\<^sup>f 0\\<^sup>+), 64)\"\n  by (auto simp add: exec_BV_Mul_Double_def plus_zero_def ucast_id)\n\n\nlemma BV_Div_bit64:\n  fixes a b :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fdiv\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>b, 64) = (\\<langle>63,0\\<rangle>(a div\\<^sup>f b), 64)\"\n  by (auto simp add: exec_BV_Div_Double_def ucast_id)\n\nlemma BV_Div_bit64_numeral: \n  fixes a :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fdiv\\<^sup>b\\<^sup>v (numeral n, 64) = (\\<langle>63,0\\<rangle>(a div\\<^sup>f \\<langle>63,0\\<rangle>((numeral n)::longword)), 64)\"\n  by (auto simp add: exec_BV_Div_Double_def ucast_id)\n\nend\n\n\n\nsubsection \\<open>Simplification rules\\<close>\n\n\nlemmas (in abstract_float) bit_vector_simps =\n    bv_slice_bv_cat take_bits_bv_slice bv_slice_take_bits take_bits_bv_cat bv_slice_bit32\n    bv_cat_prepend_0 size_bv_cat size_bv_slice\n    bv_to_bool_bool_to_bv snd_bool_to_bv\n    bv_to_bool_True bv_to_bool_True_Suc0\n    bv_to_bool_False bv_to_bool_False_Suc0\n    BV_Add_bit65 BV_Add_bit64 BV_Add_bit33\n    BV_Plus_bit64 BV_Plus_bit64_numeral\n    BV_Sub_bit64 BV_Sub_bit64_numeral\n    BV_Mult_bit64 BV_Mult_bit64_numeral_r BV_Mult_bit64_numeral_l BV_Mult_bit64_0_l BV_Mult_bit64_0_r\n    BV_Div_bit64 BV_Div_bit64_numeral\n    bv_slice_bit32\n    bv_slice_bit64 (* TO BE MERGED *)\n    bv_NOT.simps\n    bv_NOT_bool_to_bv bool_to_bv_eq bv_slice_nth_bit bv_cat_rassoc\nend\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/tacas2020_artifact/isabelle/BitVector_Rewriting.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540697, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.33318323535406197}}
{"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\<open>Discrete category\\<close>\ntheory CZH_ECAT_Discrete\n  imports \n    CZH_ECAT_Simple\n    CZH_ECAT_Small_Functor\nbegin\n\n\n\nsubsection\\<open>Abstract discrete category\\<close>\n\nnamed_theorems cat_discrete_cs_simps\nnamed_theorems cat_discrete_cs_intros\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\n\ntext\\<open>See Chapter I-2 in \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close>.\\<close>\n\nlocale cat_discrete = category \\<alpha> \\<CC> for \\<alpha> \\<CC> +\n  assumes cat_discrete_Arr: \"f \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr> \\<Longrightarrow> f \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (\\<CC>\\<lparr>CId\\<rparr>)\"\n\n\ntext\\<open>Rules.\\<close>\n\nlemma (in cat_discrete)\n  assumes \"\\<alpha>' = \\<alpha>\" \"\\<CC>' = \\<CC>\"\n  shows \"cat_discrete \\<alpha>' \\<CC>'\"\n  unfolding assms by (rule cat_discrete_axioms)\n\nmk_ide rf cat_discrete_def[unfolded cat_discrete_axioms_def]\n  |intro cat_discreteI|\n  |dest cat_discreteD[dest]|\n  |elim cat_discreteE[elim]|\n\nlemmas [cat_discrete_cs_intros] = cat_discreteD(1)\n\n\ntext\\<open>Elementary properties.\\<close>\n\nlemma (in cat_discrete) cat_discrete_is_arrD[dest]:\n  assumes \"f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\"\n  shows \"b = a\" and \"f = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>a\\<rparr>\"\nproof-\n  from assms cat_discrete_Arr have \"f \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (\\<CC>\\<lparr>CId\\<rparr>)\" \n    by (auto simp: cat_cs_simps)\n  with cat_CId_vdomain obtain a' where f_def: \"f = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>a'\\<rparr>\" and \"a' \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" \n    by (blast dest: CId.vrange_atD)\n  then have \"f : a' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> a'\" by (auto intro: cat_CId_is_arr')\n  with assms have \"a = a'\" and \"b = a'\" by blast+\n  with f_def show \"b = a\" and \"f = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>a\\<rparr>\" by auto\nqed\n\nlemma (in cat_discrete) cat_discrete_is_arrE[elim]:\n  assumes \"f : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c\"\n  obtains a where \"f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> a\" and \"f = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>a\\<rparr>\"\n  using assms by auto\n\n\n\nsubsection\\<open>The discrete category\\<close>\n\ntext\\<open>\nAs explained in Chapter I-2 in \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close>, every discrete\ncategory is identified with its set of objects. \nIn this work, it is assumed that the set of objects and the set of arrows\nin the canonical discrete category coincide; the domain and the codomain \nfunctions are identities.\n\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition the_cat_discrete :: \"V \\<Rightarrow> V\" (\\<open>:\\<^sub>C\\<close>)\n  where \":\\<^sub>C I = [I, I, vid_on I, vid_on I, (\\<lambda>fg\\<in>\\<^sub>\\<circ>fid_on I. fg\\<lparr>0\\<rparr>), vid_on I]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma the_cat_discrete_components:\n  shows \":\\<^sub>C I\\<lparr>Obj\\<rparr> = I\"\n    and \":\\<^sub>C I\\<lparr>Arr\\<rparr> = I\"\n    and \":\\<^sub>C I\\<lparr>Dom\\<rparr> = vid_on I\"\n    and \":\\<^sub>C I\\<lparr>Cod\\<rparr> = vid_on I\"\n    and \":\\<^sub>C I\\<lparr>Comp\\<rparr> = (\\<lambda>fg\\<in>\\<^sub>\\<circ>fid_on I. fg\\<lparr>0\\<rparr>)\"\n    and \":\\<^sub>C I\\<lparr>CId\\<rparr> = vid_on I\"\n  unfolding the_cat_discrete_def dg_field_simps \n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Domain\\<close>\n\nmk_VLambda the_cat_discrete_components(3)[folded VLambda_vid_on]\n  |vsv the_cat_discrete_Dom_vsv[cat_discrete_cs_intros]|\n  |vdomain the_cat_discrete_Dom_vdomain[cat_discrete_cs_simps]|\n  |app the_cat_discrete_Dom_app[cat_discrete_cs_simps]|\n\n\nsubsubsection\\<open>Codomain\\<close>\n\nmk_VLambda the_cat_discrete_components(4)[folded VLambda_vid_on]\n  |vsv the_cat_discrete_Cod_vsv[cat_discrete_cs_intros]|\n  |vdomain the_cat_discrete_Cod_vdomain[cat_discrete_cs_simps]|\n  |app the_cat_discrete_Cod_app[cat_discrete_cs_simps]|\n\n\nsubsubsection\\<open>Composition\\<close>\n\nlemma the_cat_discrete_Comp_vsv[cat_discrete_cs_intros]: \"vsv (:\\<^sub>C I\\<lparr>Comp\\<rparr>)\"\n  unfolding the_cat_discrete_components by simp\n\nlemma the_cat_discrete_Comp_vdomain: \"\\<D>\\<^sub>\\<circ> (:\\<^sub>C I\\<lparr>Comp\\<rparr>) = fid_on I\"\n  unfolding the_cat_discrete_components by simp\n\nlemma the_cat_discrete_Comp_vrange: \n  \"\\<R>\\<^sub>\\<circ> (:\\<^sub>C I\\<lparr>Comp\\<rparr>) = I\"\nproof(intro vsubset_antisym vsubsetI)\n  fix f assume \"f \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (:\\<^sub>C I\\<lparr>Comp\\<rparr>)\"\n  then obtain gg where f_def: \"f = :\\<^sub>C I\\<lparr>Comp\\<rparr>\\<lparr>gg\\<rparr>\" and gg: \"gg \\<in>\\<^sub>\\<circ> fid_on I\"\n    unfolding the_cat_discrete_components by auto\n  from gg show \"f \\<in>\\<^sub>\\<circ> I\"\n    unfolding f_def the_cat_discrete_components by clarsimp\nnext\n  fix f assume \"f \\<in>\\<^sub>\\<circ> I\"\n  then have \"[f, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> fid_on I\" by clarsimp\n  moreover then have \"f = :\\<^sub>C I\\<lparr>Comp\\<rparr>\\<lparr>f, f\\<rparr>\\<^sub>\\<bullet>\"\n    unfolding the_cat_discrete_components by simp\n  ultimately show \"f \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (:\\<^sub>C I\\<lparr>Comp\\<rparr>)\"\n    unfolding the_cat_discrete_components\n    by (metis rel_VLambda.vsv_vimageI2 vdomain_VLambda)\nqed\n \nlemma the_cat_discrete_Comp_app[cat_discrete_cs_simps]: \n  assumes \"i \\<in>\\<^sub>\\<circ> I\"\n  shows \"i \\<circ>\\<^sub>A\\<^bsub>:\\<^sub>C I\\<^esub> i = i\"\nproof-\n  from assms have \"[i, i]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> fid_on I\" by clarsimp\n  then show ?thesis unfolding the_cat_discrete_components by simp\nqed\n\n\nsubsubsection\\<open>Identity\\<close>\n\nmk_VLambda the_cat_discrete_components(6)[folded VLambda_vid_on]\n  |vsv the_cat_discrete_CId_vsv[cat_discrete_cs_intros]|\n  |vdomain the_cat_discrete_CId_vdomain[cat_discrete_cs_simps]|\n  |app the_cat_discrete_CId_app[cat_discrete_cs_simps]|\n\n\nsubsubsection\\<open>Arrow with a domain and a codomain\\<close>\n\nlemma the_cat_discrete_is_arrI:\n  assumes \"i \\<in>\\<^sub>\\<circ> I\"\n  shows \"i : i \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> i\"\n  using assms unfolding is_arr_def the_cat_discrete_components by simp\n\nlemma the_cat_discrete_is_arrI'[cat_discrete_cs_intros]:\n  assumes \"i \\<in>\\<^sub>\\<circ> I\"\n    and \"a = i\"\n    and \"b = i\"\n  shows \"i : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\"\n  using assms(1) unfolding assms(2,3) by (rule the_cat_discrete_is_arrI)\n\nlemma the_cat_discrete_is_arrD:\n  assumes \"f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\"\n  shows \"f : f \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> f\"\n    and \"a : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> a\" \n    and \"b : b \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\"\n    and \"f \\<in>\\<^sub>\\<circ> I\"\n    and \"a \\<in>\\<^sub>\\<circ> I\"\n    and \"b \\<in>\\<^sub>\\<circ> I\"\n    and \"f = a\"\n    and \"f = b\"\n    and \"b = a\"\n  using assms unfolding is_arr_def the_cat_discrete_components by force+\n\n\nsubsubsection\\<open>The discrete category is a discrete category\\<close>\n\nlemma (in \\<Z>) cat_discrete_the_cat_discrete:\n  assumes \"I \\<subseteq>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"cat_discrete \\<alpha> (:\\<^sub>C I)\"\nproof(intro cat_discreteI categoryI')\n  show \"vfsequence (:\\<^sub>C I)\" unfolding the_cat_discrete_def by simp\n  show \"vcard (:\\<^sub>C I) = 6\\<^sub>\\<nat>\"\n    unfolding the_cat_discrete_def by (simp add: nat_omega_simps)\n  show \"gf \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (:\\<^sub>C I\\<lparr>Comp\\<rparr>) \\<longleftrightarrow> \n    (\\<exists>g f b c a. gf = [g, f]\\<^sub>\\<circ> \\<and> g : b \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> c \\<and> f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b)\"\n    for gf\n    unfolding the_cat_discrete_Comp_vdomain\n  proof\n    assume \"gf \\<in>\\<^sub>\\<circ> fid_on I\"\n    then obtain a where \"gf = [a, a]\\<^sub>\\<circ>\" and \"a \\<in>\\<^sub>\\<circ> I\" by clarsimp\n    moreover then have \"a : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> a\" \n      by (auto intro: the_cat_discrete_is_arrI)\n    ultimately show \n      \"\\<exists>g f b c a. gf = [g, f]\\<^sub>\\<circ> \\<and> g : b \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> c \\<and> f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\"\n      by auto \n  next\n    assume \"\\<exists>g f b c a. gf = [g, f]\\<^sub>\\<circ> \\<and> g : b \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> c \\<and> f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\"\n    then obtain g f b c a where gf_def: \"gf = [g, f]\\<^sub>\\<circ>\"  \n      and g: \"g : b \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> c\"\n      and f: \"f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\"\n      by clarsimp\n    then have \"g = f\" by (metis is_arrE the_cat_discrete_is_arrD(1))\n    with the_cat_discrete_is_arrD(4)[OF f] show \"gf \\<in>\\<^sub>\\<circ> fid_on I\"\n      unfolding gf_def by clarsimp\n  qed\n  show \"g \\<circ>\\<^sub>A\\<^bsub>:\\<^sub>C I\\<^esub> f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> c\" if \"g : b \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> c\" and \"f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\"\n    for g b c f a\n  proof-\n    from that have fba: \"f = a\" \"b = a\" and a: \"a \\<in>\\<^sub>\\<circ> I\" \n      unfolding the_cat_discrete_is_arrD[OF that(2)] by (simp_all add: \\<open>a \\<in>\\<^sub>\\<circ> I\\<close>)\n    from that have gcb: \"g = b\" \"c = b\"\n      unfolding the_cat_discrete_is_arrD[OF that(1)] by simp_all\n    from a show ?thesis\n      unfolding fba gcb  \n      by \n        (\n          cs_concl cs_shallow\n            cs_simp: cat_discrete_cs_simps cs_intro: cat_discrete_cs_intros\n        )\n  qed\n  show \"h \\<circ>\\<^sub>A\\<^bsub>:\\<^sub>C I\\<^esub> g \\<circ>\\<^sub>A\\<^bsub>:\\<^sub>C I\\<^esub> f = h \\<circ>\\<^sub>A\\<^bsub>:\\<^sub>C I\\<^esub> (g \\<circ>\\<^sub>A\\<^bsub>:\\<^sub>C I\\<^esub> f)\"\n    if \"h : c \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> d\" and \"g : b \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> c\" and \"f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\"\n    for h c d g b f a\n  proof-\n    from that have fba: \"f = a\" \"b = a\" and a: \"a \\<in>\\<^sub>\\<circ> I\" \n      unfolding the_cat_discrete_is_arrD[OF that(3)] by (simp_all add: \\<open>a \\<in>\\<^sub>\\<circ> I\\<close>)\n    from that have gcb: \"g = b\" \"c = b\" \n      unfolding the_cat_discrete_is_arrD[OF that(2)] by simp_all\n    from that have hcd: \"h = c\" \"d = c\"\n      unfolding the_cat_discrete_is_arrD[OF that(1)] by simp_all\n    from a show ?thesis\n      unfolding fba gcb hcd \n      by (cs_concl cs_shallow cs_simp: cat_discrete_cs_simps)\n  qed\n  show \":\\<^sub>C I\\<lparr>CId\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>:\\<^sub>C I\\<^esub> f = f\" if \"f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\" for f a b\n  proof-\n    from that have fba: \"f = a\" \"b = a\" and a: \"a \\<in>\\<^sub>\\<circ> I\" \n      unfolding the_cat_discrete_is_arrD[OF that] by (simp_all add: \\<open>a \\<in>\\<^sub>\\<circ> I\\<close>)\n    from a show ?thesis \n      by (cs_concl cs_shallow cs_simp: cat_discrete_cs_simps fba)\n  qed\n  show \"f \\<circ>\\<^sub>A\\<^bsub>:\\<^sub>C I\\<^esub> :\\<^sub>C I\\<lparr>CId\\<rparr>\\<lparr>b\\<rparr> = f\" if \"f : b \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> c\" for f b c\n  proof-\n    from that have fba: \"f = b\" \"c = b\" and b: \"b \\<in>\\<^sub>\\<circ> I\" \n      unfolding the_cat_discrete_is_arrD[OF that] by (simp_all add: \\<open>b \\<in>\\<^sub>\\<circ> I\\<close>)\n    from b show ?thesis \n      by (cs_concl cs_shallow cs_simp: cat_discrete_cs_simps fba)\n  qed\n  show \":\\<^sub>C I\\<lparr>CId\\<rparr>\\<lparr>a\\<rparr> : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> a\"\n    if \"a \\<in>\\<^sub>\\<circ> :\\<^sub>C I\\<lparr>Obj\\<rparr>\" for a \n    using that \n    by (auto simp: the_cat_discrete_components intro: cat_discrete_cs_intros)\n  show \"\\<Union>\\<^sub>\\<circ>((\\<lambda>a\\<in>\\<^sub>\\<circ>A. \\<Union>\\<^sub>\\<circ>(VLambda B (Hom (:\\<^sub>C I) a) `\\<^sub>\\<circ> B)) `\\<^sub>\\<circ> A) \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    if \"A \\<subseteq>\\<^sub>\\<circ> :\\<^sub>C I\\<lparr>Obj\\<rparr>\"\n      and \"B \\<subseteq>\\<^sub>\\<circ> :\\<^sub>C I\\<lparr>Obj\\<rparr>\"\n      and \"A \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n      and \"B \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    for A B\n  proof-\n    have \"(\\<Union>\\<^sub>\\<circ>a\\<in>\\<^sub>\\<circ>A. \\<Union>\\<^sub>\\<circ>b\\<in>\\<^sub>\\<circ>B. Hom (:\\<^sub>C I) a b) \\<subseteq>\\<^sub>\\<circ> A \\<union>\\<^sub>\\<circ> B\"\n    proof(intro vsubsetI, elim vifunionE, unfold in_Hom_iff)\n      fix i j f assume prems: \"i \\<in>\\<^sub>\\<circ> A\" \"j \\<in>\\<^sub>\\<circ> B\" \"f : i \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> j\"\n      then show \"f \\<in>\\<^sub>\\<circ> A \\<union>\\<^sub>\\<circ> B\" \n        unfolding the_cat_discrete_is_arrD[OF prems(3)] by simp\n    qed\n    moreover have \"A \\<union>\\<^sub>\\<circ> B \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" by (simp add: that(3,4) vunion_in_VsetI)\n    ultimately show \"(\\<Union>\\<^sub>\\<circ>a\\<in>\\<^sub>\\<circ>A. \\<Union>\\<^sub>\\<circ>b\\<in>\\<^sub>\\<circ>B. Hom (:\\<^sub>C I) a b) \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n      by (auto simp: vsubset_in_VsetI)\n  qed\nqed (auto simp: assms the_cat_discrete_components intro: cat_cs_intros)\n\nlemmas [cat_discrete_cs_intros] = \\<Z>.cat_discrete_the_cat_discrete\n\n\nsubsubsection\\<open>Opposite discrete category\\<close>\n\nlemma (in \\<Z>) the_cat_discrete_op[cat_op_simps]:\n  assumes \"I \\<subseteq>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"op_cat (:\\<^sub>C I) = :\\<^sub>C I\"\nproof(rule cat_eqI[of \\<alpha>])\n  from assms show dI: \"category \\<alpha> (:\\<^sub>C I)\"\n    by (cs_concl cs_intro: cat_discrete_the_cat_discrete cat_discrete_cs_intros)\n  then show op_dI: \"category \\<alpha> (op_cat (:\\<^sub>C I))\"\n    by (cs_concl cs_shallow cs_intro: cat_op_intros)\n  interpret category \\<alpha> \\<open>op_cat (:\\<^sub>C I)\\<close> by (rule op_dI)\n  show \"op_cat (:\\<^sub>C I)\\<lparr>Comp\\<rparr> = :\\<^sub>C I\\<lparr>Comp\\<rparr>\"\n  proof(rule vsv_eqI)\n    show \"\\<D>\\<^sub>\\<circ> (op_cat (:\\<^sub>C I)\\<lparr>Comp\\<rparr>) = \\<D>\\<^sub>\\<circ> (:\\<^sub>C I\\<lparr>Comp\\<rparr>)\"\n      by (simp add: the_cat_discrete_components op_cat_components)\n    fix gf assume \"gf \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (op_cat (:\\<^sub>C I)\\<lparr>Comp\\<rparr>)\"\n    then have \"gf \\<in>\\<^sub>\\<circ> fid_on I\" \n      by (simp add: the_cat_discrete_components op_cat_components)\n    then obtain h where gf_def: \"gf = [h, h]\\<^sub>\\<circ>\" and h: \"h \\<in>\\<^sub>\\<circ> I\" by clarsimp\n    from dI h show \"op_cat (:\\<^sub>C I)\\<lparr>Comp\\<rparr>\\<lparr>gf\\<rparr> = :\\<^sub>C I\\<lparr>Comp\\<rparr>\\<lparr>gf\\<rparr>\" \n      by \n        ( \n          cs_concl cs_shallow\n            cs_simp: cat_op_simps gf_def cs_intro: cat_discrete_cs_intros\n        )\n  qed (auto intro: cat_discrete_cs_intros)\nqed (unfold the_cat_discrete_components op_cat_components, simp_all)\n\n\n\nsubsection\\<open>Discrete functor\\<close>\n\n\nsubsubsection\\<open>Local assumptions for the discrete functor\\<close>\n\n\ntext\\<open>See Chapter III in \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close>).\\<close>\n\nlocale cf_discrete = category \\<alpha> \\<CC> for \\<alpha> I F \\<CC> +\n  assumes cf_discrete_selector_vrange[cat_discrete_cs_intros]: \n    \"i \\<in>\\<^sub>\\<circ> I \\<Longrightarrow> F i \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    and cf_discrete_vdomain_vsubset_Vset: \"I \\<subseteq>\\<^sub>\\<circ> Vset \\<alpha>\"\n\nlemmas (in cf_discrete) cf_discrete_category = category_axioms\n\nlemmas [cat_discrete_cs_intros] = cf_discrete.cf_discrete_category\n\n\ntext\\<open>Rules.\\<close>\n\nlemma (in cf_discrete) cf_discrete_axioms'[cat_discrete_cs_intros]:\n  assumes \"\\<alpha>' = \\<alpha>\" and \"I' = I\" and \"F' = F\" \n  shows \"cf_discrete \\<alpha>' I' F' \\<CC>\"\n  unfolding assms by (rule cf_discrete_axioms)\n\nmk_ide rf cf_discrete_def[unfolded cf_discrete_axioms_def]\n  |intro cf_discreteI|\n  |dest cf_discreteD[dest]|\n  |elim cf_discreteE[elim]|\n\n\ntext\\<open>Elementary properties.\\<close>\n\nlemma (in cf_discrete) cf_discrete_is_functor_cf_CId_selector_is_arr: \n  assumes \"i \\<in>\\<^sub>\\<circ> I\"\n  shows \"\\<CC>\\<lparr>CId\\<rparr>\\<lparr>F i\\<rparr> : F i \\<mapsto>\\<^bsub>\\<CC>\\<^esub> F i\"\n  using assms by (meson cat_CId_is_arr' cf_discreteD(2) cf_discrete_axioms)\n\nlemma (in cf_discrete) \n  cf_discrete_is_functor_cf_CId_selector_is_arr'[cat_discrete_cs_intros]: \n  assumes \"i \\<in>\\<^sub>\\<circ> I\" and \"a = F i\" and \"b = F i\"\n  shows \"\\<CC>\\<lparr>CId\\<rparr>\\<lparr>F i\\<rparr> : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\"\n  using assms(1)\n  unfolding assms(2,3) \n  by (rule cf_discrete_is_functor_cf_CId_selector_is_arr)\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition the_cf_discrete :: \"V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V \\<Rightarrow> V\" (\\<open>:\\<rightarrow>:\\<close>)\n  where \":\\<rightarrow>: I F \\<CC> = [VLambda I F, (\\<lambda>i\\<in>\\<^sub>\\<circ>I. \\<CC>\\<lparr>CId\\<rparr>\\<lparr>F i\\<rparr>), :\\<^sub>C I, \\<CC>]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma the_cf_discrete_components:\n  shows \":\\<rightarrow>: I F \\<CC>\\<lparr>ObjMap\\<rparr> = (\\<lambda>i\\<in>\\<^sub>\\<circ>I. F i)\"\n    and \":\\<rightarrow>: I F \\<CC>\\<lparr>ArrMap\\<rparr> = (\\<lambda>i\\<in>\\<^sub>\\<circ>I. \\<CC>\\<lparr>CId\\<rparr>\\<lparr>F i\\<rparr>)\"\n    and [cat_discrete_cs_simps]: \":\\<rightarrow>: I F \\<CC>\\<lparr>HomDom\\<rparr> = :\\<^sub>C I\"\n    and [cat_discrete_cs_simps]: \":\\<rightarrow>: I F \\<CC>\\<lparr>HomCod\\<rparr> = \\<CC>\"\n  unfolding the_cf_discrete_def dghm_field_simps \n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Object map\\<close>\n\nmk_VLambda the_cf_discrete_components(1)\n  |vsv the_cf_discrete_ObjMap_vsv[cat_discrete_cs_intros]|\n  |vdomain the_cf_discrete_ObjMap_vdomain[cat_discrete_cs_simps]|\n  |app the_cf_discrete_ObjMap_app[cat_discrete_cs_simps]|\n\nlemma (in cf_discrete) cf_discrete_the_cf_discrete_ObjMap_vrange: \n  \"\\<R>\\<^sub>\\<circ> (:\\<rightarrow>: I F \\<CC>\\<lparr>ObjMap\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n  using cf_discrete_is_functor_cf_CId_selector_is_arr\n  unfolding the_cf_discrete_components\n  by (intro vrange_VLambda_vsubset) auto\n\n\nsubsubsection\\<open>Arrow map\\<close>\n\nmk_VLambda the_cf_discrete_components(2)\n  |vsv the_cf_discrete_ArrMap_vsv[cat_discrete_cs_intros]|\n  |vdomain the_cf_discrete_ArrMap_vdomain[cat_discrete_cs_simps]|\n  |app the_cf_discrete_ArrMap_app[cat_discrete_cs_simps]|\n\nlemma (in cf_discrete) cf_discrete_the_cf_discrete_ArrMap_vrange: \n  \"\\<R>\\<^sub>\\<circ> (:\\<rightarrow>: I F \\<CC>\\<lparr>ArrMap\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr>\"\n  using cf_discrete_is_functor_cf_CId_selector_is_arr\n  unfolding the_cf_discrete_components\n  by (intro vrange_VLambda_vsubset) (auto simp: cf_discrete_selector_vrange)\n\n\nsubsubsection\\<open>Discrete functor is a functor\\<close>\n\nlemma (in cf_discrete) cf_discrete_the_cf_discrete_is_functor:  \n  \":\\<rightarrow>: I F \\<CC> : :\\<^sub>C I \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof(intro is_functorI')\n  show \"vfsequence (:\\<rightarrow>: I F \\<CC>)\" unfolding the_cf_discrete_def by simp\n  show \"category \\<alpha> (:\\<^sub>C I)\"\n    by \n      (\n        simp add:\n          cat_discrete_the_cat_discrete \n          cf_discrete_vdomain_vsubset_Vset \n          cat_discrete.axioms(1)\n      )  \n  show \"vcard (:\\<rightarrow>: I F \\<CC>) = 4\\<^sub>\\<nat>\"\n    unfolding the_cf_discrete_def by (simp add: nat_omega_simps)\n  show \n    \":\\<rightarrow>: I F \\<CC>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> : :\\<rightarrow>: I F \\<CC>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> :\\<rightarrow>: I F \\<CC>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n    if \"f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\" for f a b\n  proof-\n    from that have fba: \"f = a\" \"b = a\" and a: \"a \\<in>\\<^sub>\\<circ> I\" \n      unfolding the_cat_discrete_is_arrD[OF that] by (simp_all add: \\<open>a \\<in>\\<^sub>\\<circ> I\\<close>)\n    from that \\<open>a \\<in>\\<^sub>\\<circ> I\\<close> show ?thesis\n      by \n        (\n          cs_concl cs_shallow\n            cs_simp: cat_discrete_cs_simps fba cs_intro: cat_discrete_cs_intros\n        )\n  qed\n  show \":\\<rightarrow>: I F \\<CC>\\<lparr>ArrMap\\<rparr>\\<lparr>g \\<circ>\\<^sub>A\\<^bsub>:\\<^sub>C I\\<^esub> f\\<rparr> = \n    :\\<rightarrow>: I F \\<CC>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> :\\<rightarrow>: I F \\<CC>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\"\n    if \"g : b \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> c\" and \"f : a \\<mapsto>\\<^bsub>:\\<^sub>C I\\<^esub> b\" for g b c f a\n  proof-\n    from that have gfacb: \"f = a\" \"a = b\" \"g = b\" \"c = b\" and b: \"b \\<in>\\<^sub>\\<circ> I\"  \n      by \n        (\n          simp_all add: \n            the_cat_discrete_is_arrD(8-9)[OF that(1)] \n            the_cat_discrete_is_arrD(5-9)[OF that(2)]\n        )\n    have \"F b \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by (simp add: b cf_discrete_selector_vrange)\n    from b category_axioms this show ?thesis\n      using that \n      unfolding gfacb\n      by \n        (\n          cs_concl cs_shallow\n            cs_simp: cat_cs_simps cat_discrete_cs_simps cs_intro: cat_cs_intros\n        )\n  qed\n  show \":\\<rightarrow>: I F \\<CC>\\<lparr>ArrMap\\<rparr>\\<lparr>:\\<^sub>C I\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>\\<rparr> = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>:\\<rightarrow>: I F \\<CC>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\\<rparr>\"\n    if \"c \\<in>\\<^sub>\\<circ> :\\<^sub>C I\\<lparr>Obj\\<rparr>\" for c\n    using that\n    unfolding the_cat_discrete_components(1)\n    by \n      (\n        cs_concl cs_shallow \n          cs_simp: cat_discrete_cs_simps cs_intro: cat_cs_intros\n      )\nqed \n  (\n    auto simp: \n      the_cf_discrete_components \n      the_cat_discrete_components \n      cat_cs_intros\n      cat_discrete_cs_intros\n  ) \n\nlemma (in cf_discrete) cf_discrete_the_cf_discrete_is_functor':\n  assumes \"\\<AA>' = :\\<^sub>C I\" and \"\\<CC>' = \\<CC>\"\n  shows \":\\<rightarrow>: I F \\<CC> : \\<AA>' \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>'\"\n  unfolding assms by (rule cf_discrete_the_cf_discrete_is_functor)\n\nlemmas [cat_discrete_cs_intros] = \n  cf_discrete.cf_discrete_the_cf_discrete_is_functor'\n\n\nsubsubsection\\<open>Uniqueness of the discrete category\\<close>\n\nlemma (in cat_discrete) cat_discrete_iso_the_cat_discrete:\n  assumes \"I \\<subseteq>\\<^sub>\\<circ> Vset \\<alpha>\" and \"I \\<approx>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n  obtains F where \":\\<rightarrow>: I F \\<CC> : :\\<^sub>C I \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof-\n\n  from assms obtain F where v11_f: \"v11 F\" \n    and dr[simp]: \"\\<D>\\<^sub>\\<circ> F = I\" \"\\<R>\\<^sub>\\<circ> F = \\<CC>\\<lparr>Obj\\<rparr>\" \n    by auto\n  let ?F = \"\\<lambda>i. F\\<lparr>i\\<rparr>\"\n  interpret F: v11 F by (rule v11_f)\n  from assms(1) interpret \\<CC>: cf_discrete \\<alpha> I ?F \\<CC> \n    apply(intro cf_discreteI) \n    unfolding dr[symmetric] \n    by (cs_concl cs_shallow cs_intro: V_cs_intros cat_cs_intros)+\n  have \":\\<rightarrow>: I ?F \\<CC> : :\\<^sub>C I \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  proof(intro is_iso_functorI')\n    from \\<CC>.cf_discrete_selector_vrange show  \n      \":\\<rightarrow>: I ?F \\<CC> : :\\<^sub>C I \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \n      by (intro cf_discrete.cf_discrete_the_cf_discrete_is_functor cf_discreteI)\n        (auto simp: category_axioms assms(1))\n    show \"v11 (:\\<rightarrow>: I ?F \\<CC>\\<lparr>ArrMap\\<rparr>)\"\n    proof(rule vsv.vsv_valeq_v11I, unfold the_cf_discrete_ArrMap_vdomain)\n      fix i j assume prems:\n        \"i \\<in>\\<^sub>\\<circ> I\" \"j \\<in>\\<^sub>\\<circ> I\" \":\\<rightarrow>: I ?F \\<CC>\\<lparr>ArrMap\\<rparr>\\<lparr>i\\<rparr> = :\\<rightarrow>: I ?F \\<CC>\\<lparr>ArrMap\\<rparr>\\<lparr>j\\<rparr>\"\n      from prems(3) have \"\\<CC>\\<lparr>CId\\<rparr>\\<lparr>?F i\\<rparr> = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>?F j\\<rparr>\"\n        unfolding \n          the_cf_discrete_ArrMap_app[OF prems(1)]\n          the_cf_discrete_ArrMap_app[OF prems(2)].\n      then have \"?F i = ?F j\"\n        by \n          (\n            metis \n              \\<CC>.cf_discrete_is_functor_cf_CId_selector_is_arr \n              prems(1,2) \n              cat_is_arrD(4)\n          )\n      with F.v11_eq_iff prems show \"i = j\" by simp\n    qed (simp add: the_cf_discrete_components)\n    show \"\\<R>\\<^sub>\\<circ> (:\\<rightarrow>: I ?F \\<CC>\\<lparr>ArrMap\\<rparr>) = \\<CC>\\<lparr>Arr\\<rparr>\"\n    proof(intro vsubset_antisym vsubsetI)\n      fix f assume \"f \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (:\\<rightarrow>: I ?F \\<CC>\\<lparr>ArrMap\\<rparr>)\"\n      with \\<CC>.cf_discrete_the_cf_discrete_ArrMap_vrange show \"f \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr>\" \n        by auto\n    next\n      fix f assume \"f \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr>\"\n      then obtain a b where \"f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\" by auto\n      then obtain a where f_def: \"f = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>a\\<rparr>\" and a: \"a \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\n      from a F.vrange_atD dr obtain i where a_def: \"a = ?F i\" and i: \"i \\<in>\\<^sub>\\<circ> I\"\n        by blast\n      from a i show \"f \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (:\\<rightarrow>: I ?F \\<CC>\\<lparr>ArrMap\\<rparr>)\"\n        unfolding a_def f_def the_cf_discrete_components by auto\n    qed\n  qed (auto simp: v11_f the_cf_discrete_components)\n  with that show ?thesis by simp\n\nqed\n\n\nsubsubsection\\<open>Opposite discrete functor\\<close>\n\nlemma (in cf_discrete) cf_discrete_the_cf_discrete_op[cat_op_simps]:\n  \"op_cf (:\\<rightarrow>: I F \\<CC>) = :\\<rightarrow>: I F (op_cat \\<CC>)\"\nproof(rule cf_eqI)\n  from cf_discrete_vdomain_vsubset_Vset show \n    \"op_cf (:\\<rightarrow>: I F \\<CC>) : :\\<^sub>C I \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<CC>\"\n    by \n      (\n        cs_concl cs_shallow\n          cs_simp: cat_op_simps cs_intro: cat_op_intros cat_discrete_cs_intros\n      )\n  show \":\\<rightarrow>: I F (op_cat \\<CC>) : :\\<^sub>C I \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<CC>\"\n  proof(intro cf_discrete.cf_discrete_the_cf_discrete_is_functor cf_discreteI)\n    fix i assume \"i \\<in>\\<^sub>\\<circ> I\"\n    then show \"F i \\<in>\\<^sub>\\<circ> op_cat \\<CC>\\<lparr>Obj\\<rparr>\"\n      by (simp add: cat_op_simps cf_discrete_selector_vrange)\n  qed (intro cf_discrete_vdomain_vsubset_Vset cat_cs_intros)+\nqed (unfold cat_op_simps the_cf_discrete_components, simp_all)\n\nlemmas [cat_op_simps] = cf_discrete.cf_discrete_the_cf_discrete_op\n\nlemma (in cf_discrete) cf_discrete_op[cat_op_intros]: \n  \"cf_discrete \\<alpha> I F (op_cat \\<CC>)\"\nproof(intro cf_discreteI)\n  show \"category \\<alpha> (op_cat \\<CC>)\" \n    by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n  fix i assume \"i \\<in>\\<^sub>\\<circ> I\"\n  then show \"F i \\<in>\\<^sub>\\<circ> op_cat \\<CC>\\<lparr>Obj\\<rparr>\"\n    by \n      (\n        cs_concl cs_shallow \n          cs_simp: cat_op_simps cs_intro: cat_discrete_cs_intros\n      )\nqed (intro cf_discrete_vdomain_vsubset_Vset)\n\nlemmas [cat_op_intros] = cf_discrete.cf_discrete_op\n\n\n\nsubsection\\<open>Tiny discrete category\\<close>\n\n\nsubsubsection\\<open>Background\\<close>\n\nnamed_theorems cat_small_discrete_cs_simps\nnamed_theorems cat_small_discrete_cs_intros\n\nlemmas [cat_small_discrete_cs_simps] = cat_discrete_cs_simps\nlemmas [cat_small_discrete_cs_intros] = cat_discrete_cs_intros\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\nlocale tiny_cat_discrete = cat_discrete \\<alpha> \\<CC> + tiny_category \\<alpha> \\<CC> for \\<alpha> \\<CC>\n\n\ntext\\<open>Rules.\\<close>\n\nlemma (in tiny_cat_discrete) tiny_cat_discrete_axioms'[cat_discrete_cs_intros]:\n  assumes \"\\<alpha>' = \\<alpha>\" and \"\\<CC>' = \\<CC>\"\n  shows \"tiny_cat_discrete \\<alpha>' \\<CC>'\"\n  unfolding assms by (rule tiny_cat_discrete_axioms)\n\nmk_ide rf tiny_cat_discrete_def\n  |intro tiny_cat_discreteI|\n  |dest tiny_cat_discreteD[dest]|\n  |elim tiny_cat_discreteE[elim]|\n\nlemmas [cat_small_discrete_cs_intros] = tiny_cat_discreteD\n\nlemma tiny_cat_discreteI':\n  assumes \"tiny_category \\<alpha> \\<CC>\" and \"\\<And>f. f \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr> \\<Longrightarrow> f \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (\\<CC>\\<lparr>CId\\<rparr>)\"\n  shows \"tiny_cat_discrete \\<alpha> \\<CC>\"\nproof(intro tiny_cat_discreteI cat_discreteI)\n  interpret tiny_category \\<alpha> \\<CC> by (rule assms(1))\n  show \"category \\<alpha> \\<CC>\" by (auto intro: tiny_cat_category)\n  show \"f \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (\\<CC>\\<lparr>CId\\<rparr>)\" if \"f \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr>\" for f using that by (rule assms(2))\nqed (auto intro: assms(1))\n\n\nsubsubsection\\<open>The discrete category is a tiny category\\<close>\n\nlemma (in \\<Z>) tiny_cat_discrete_the_cat_discrete[cat_small_discrete_cs_intros]:\n  assumes \"I \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"tiny_cat_discrete \\<alpha> (:\\<^sub>C I)\"\nproof(intro tiny_cat_discreteI cat_discrete_the_cat_discrete)\n  from assms show \"I \\<subseteq>\\<^sub>\\<circ> Vset \\<alpha>\" by auto\n  then interpret cat_discrete \\<alpha> \\<open>:\\<^sub>C I\\<close> by (intro cat_discrete_the_cat_discrete)\n  show \"tiny_category \\<alpha> (:\\<^sub>C I)\"\n    by (intro tiny_categoryI', unfold the_cat_discrete_components)\n      (auto intro: cat_cs_intros assms)\nqed\n\nlemmas [cat_small_discrete_cs_intros] = \\<Z>.cat_discrete_the_cat_discrete\n\n\n\nsubsection\\<open>Discrete functor with tiny maps\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\nlocale tm_cf_discrete = category \\<alpha> \\<CC> for \\<alpha> I F \\<CC> +\n  assumes tm_cf_discrete_selector_vrange[cat_small_discrete_cs_intros]: \n    \"i \\<in>\\<^sub>\\<circ> I \\<Longrightarrow> F i \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    and tm_cf_discrete_ObjMap_in_Vset: \"VLambda I F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and tm_cf_discrete_ArrMap_in_Vset: \"(\\<lambda>i\\<in>\\<^sub>\\<circ>I. \\<CC>\\<lparr>CId\\<rparr>\\<lparr>F i\\<rparr>) \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n\n\ntext\\<open>Rules.\\<close>\n\nlemma (in tm_cf_discrete) tm_cf_discrete_axioms'[cat_small_discrete_cs_intros]:\n  assumes \"\\<alpha>' = \\<alpha>\" and \"I' = I\" and \"F' = F\" \n  shows \"tm_cf_discrete \\<alpha>' I' F' \\<CC>\"\n  unfolding assms by (rule tm_cf_discrete_axioms)\n\nmk_ide rf tm_cf_discrete_def[unfolded tm_cf_discrete_axioms_def]\n  |intro tm_cf_discreteI|\n  |dest tm_cf_discreteD[dest]|\n  |elim tm_cf_discreteE[elim]|\n\nlemma tm_cf_discreteI': \n  assumes \"cf_discrete \\<alpha> I F \\<CC>\"\n    and \"(\\<lambda>i\\<in>\\<^sub>\\<circ>I. F i) \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and \"(\\<lambda>i\\<in>\\<^sub>\\<circ>I. \\<CC>\\<lparr>CId\\<rparr>\\<lparr>F i\\<rparr>) \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"tm_cf_discrete \\<alpha> I F \\<CC>\"\nproof-\n  interpret cf_discrete \\<alpha> I F \\<CC> by (rule assms(1))\n  show ?thesis\n    by (intro tm_cf_discreteI)\n      (auto intro: assms cf_discrete_selector_vrange cat_cs_intros)\nqed\n\n\ntext\\<open>Elementary properties.\\<close>\n\nsublocale tm_cf_discrete \\<subseteq> cf_discrete\nproof(intro cf_discreteI)\n  from tm_cf_discrete_ObjMap_in_Vset have \"\\<D>\\<^sub>\\<circ> (\\<lambda>i\\<in>\\<^sub>\\<circ>I. F i) \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    by (cs_concl cs_shallow cs_intro: vdomain_in_VsetI)\n  then show \"I \\<subseteq>\\<^sub>\\<circ> Vset \\<alpha>\" by auto\nqed (auto intro: cat_cs_intros tm_cf_discrete_selector_vrange)\n\nlemmas (in tm_cf_discrete) tm_cf_discrete_is_cf_discrete_axioms = \n  cf_discrete_axioms\n\nlemmas [cat_small_discrete_cs_intros] = \n  tm_cf_discrete.tm_cf_discrete_is_cf_discrete_axioms\n\nlemma (in tm_cf_discrete) \n  tm_cf_discrete_index_in_Vset[cat_small_discrete_cs_intros]: \n  \"I \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\nproof-\n  from tm_cf_discrete_ObjMap_in_Vset have \"\\<D>\\<^sub>\\<circ> (\\<lambda>i\\<in>\\<^sub>\\<circ>I. F i) \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    by (cs_concl cs_shallow cs_intro: vdomain_in_VsetI)\n  then show ?thesis by simp\nqed\n\n\nsubsubsection\\<open>Opposite discrete functor with tiny maps\\<close>\n\nlemma (in tm_cf_discrete) tm_cf_discrete_op[cat_op_intros]: \n  \"tm_cf_discrete \\<alpha> I F (op_cat \\<CC>)\"\n  using tm_cf_discrete_ObjMap_in_Vset tm_cf_discrete_ArrMap_in_Vset \n  by (intro tm_cf_discreteI' cf_discrete_op) (auto simp: cat_op_simps)\n\nlemmas [cat_op_intros] = tm_cf_discrete.tm_cf_discrete_op\n\n\nsubsubsection\\<open>Discrete functor with tiny maps is a functor with tiny maps\\<close>\n\nlemma (in tm_cf_discrete) tm_cf_discrete_the_cf_discrete_is_tm_functor: \n  \":\\<rightarrow>: I F \\<CC> : :\\<^sub>C I \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  by (intro is_tm_functorI' cf_discrete_the_cf_discrete_is_functor)\n    (\n      auto simp: \n        the_cf_discrete_components \n        tm_cf_discrete_ObjMap_in_Vset \n        tm_cf_discrete_ArrMap_in_Vset\n    )\n\nlemma (in tm_cf_discrete) tm_cf_discrete_the_cf_discrete_is_tm_functor':\n  assumes \"\\<AA>' = :\\<^sub>C I\" and \"\\<CC>' = \\<CC>\"\n  shows \":\\<rightarrow>: I F \\<CC> : \\<AA>' \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>'\"\n  unfolding assms by (rule tm_cf_discrete_the_cf_discrete_is_tm_functor)\n\nlemmas [cat_discrete_cs_intros] = \n  tm_cf_discrete.tm_cf_discrete_the_cf_discrete_is_tm_functor'\n\ntext\\<open>\\newpage\\<close>\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Elementary_Categories/czh_ecategories/CZH_ECAT_Discrete.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5926665999540697, "lm_q1q2_score": 0.33318323535406197}}
{"text": "theory Scratch\n  imports AssumeGuarantee\nbegin\n\ndatatype n = None\n\ndefinition X :: char where \"X = CHR ''x''\"\n\ndefinition P1 :: \"n proc\" where \n\"P1 = Rep (Interrupt (ODE ((\\<lambda>_ _. 0)(X := (\\<lambda>_ . 1)))) (\\<lambda>_ . True) [(''ch1''[!](\\<lambda> (a,s). s X) ,Cm (''ch2''[?]X))])\"\n\ndefinition P2 :: \"n proc\" where\n\"P2 = Rep (Wait (\\<lambda> s. 1);Cm (''ch1''[?]X);Cm (''ch2''[!](\\<lambda> (a,s). s X - 1)))\"\n\ninductive p1_assn :: \"state \\<Rightarrow> (real \\<times> real) list \\<Rightarrow> n tassn\" where\n  \"p1_assn s [] []\"\n| \"(d = 1 \\<and> x = s X) \\<longrightarrow> p1_assn (s(X := x)) rest tr3 \\<Longrightarrow>\n   (WaitOut\\<^sub>t d None (\\<lambda> t. s(X := s X + t)) (''ch1'') (\\<lambda> (a,s). s X) ({''ch1''},{}) tr1 \\<and>\n   In\\<^sub>t (EState (None,s(X := s X + d))) (''ch2'') x tr2) \\<Longrightarrow>\n   p1_assn s ((d,x)#rest) (tr1@tr2@tr3)\"\n\n\nlemma p1_0:\n\"p1_assn s [] = emp\\<^sub>t\"\n   using p1_assn.cases\n   apply(auto simp add: emp_assn_def)\n   using p1_assn.intros(1) by blast\n\nlemma p1_1:\n  assumes \"d = 1 \\<and> x = s X\"\n  shows \"p1_assn s ((d,x)#rest) = \n    WaitOut\\<^sub>t d None (\\<lambda> t. s(X := s X + t)) (''ch1'') (\\<lambda> (a,s). s X) ({''ch1''},{}) @\\<^sub>t\n    In\\<^sub>t (EState (None,s(X := s X + d))) (''ch2'') x @\\<^sub>t \n    p1_assn (s(X := x)) rest\"\n  apply (rule ext)\n  subgoal for tr\n  proof-\n    have 1:\"p1_assn s ((d, x) # rest) tr \\<Longrightarrow>\n    (WaitOut\\<^sub>t d n.None (\\<lambda>t. s(X := s X + t)) ''ch1'' (\\<lambda>(a, s). s X) ({''ch1''}, {}) @\\<^sub>t\n     In\\<^sub>t (EState (n.None, s(X := s X + d))) ''ch2'' x @\\<^sub>t p1_assn (s(X := x)) rest) tr \"\n      apply(rule p1_assn.cases[of s \"((d, x) # rest)\" tr])\n      by (auto simp add: assms join_assn_def) \n    have 2:\"(WaitOut\\<^sub>t d n.None (\\<lambda>t. s(X := s X + t)) ''ch1'' (\\<lambda>(a, s). s X) ({''ch1''}, {}) @\\<^sub>t\n     In\\<^sub>t (EState (n.None, s(X := s X + d))) ''ch2'' x @\\<^sub>t p1_assn (s(X := x)) rest) tr \n            \\<Longrightarrow> p1_assn s ((d, x) # rest) tr\"\n      apply (auto simp add: join_assn_def)\n      subgoal for tr1 tr2 tr3\n        using p1_assn.intros(2)[of d x s rest tr3 tr1 tr2]\n        using assms by auto\n      done\n    show ?thesis \n      using 1 2 by auto\n  qed\n  done\n\n\nlemma p1_3:\n  \"p1_assn s ((d,x)#rest) = \n   WaitOut\\<^sub>t d None (\\<lambda> t. s(X := s X + t)) (''ch1'') (\\<lambda> (a,s). s X) ({''ch1''},{}) @\\<^sub>t\n   In\\<^sub>t (EState (None,s(X := s X + d))) (''ch2'') x @\\<^sub>t \n   (\\<up>(d = 1 \\<and> x = s X) \\<longrightarrow>\\<^sub>t p1_assn (s(X := x)) rest)\"\n  apply(rule ext)\n  subgoal for tr\n  proof-\n    have 1:\"p1_assn s ((d, x) # rest) tr \\<Longrightarrow>\n    (WaitOut\\<^sub>t d n.None (\\<lambda>t. s(X := s X + t)) ''ch1'' (\\<lambda>(a, s). s X) ({''ch1''}, {}) @\\<^sub>t\n     In\\<^sub>t (EState (n.None, s(X := s X + d))) ''ch2'' x @\\<^sub>t\n     (\\<up> (d = 1 \\<and> x = s X) \\<longrightarrow>\\<^sub>t p1_assn (s(X := x)) rest)) tr \"\n      apply(rule p1_assn.cases[of s \"(d, x) # rest\" tr])\n        apply simp\n      subgoal by auto\n      by (auto simp add: pure_assn_def imp_assn_def join_assn_def)\n    have 2:\"(WaitOut\\<^sub>t d n.None (\\<lambda>t. s(X := s X + t)) ''ch1'' (\\<lambda>(a, s). s X) ({''ch1''}, {}) @\\<^sub>t\n     In\\<^sub>t (EState (n.None, s(X := s X + d))) ''ch2'' x @\\<^sub>t\n     (\\<up> (d = 1 \\<and> x = s X) \\<longrightarrow>\\<^sub>t p1_assn (s(X := x)) rest)) tr \n          \\<Longrightarrow> p1_assn s ((d, x) # rest) tr \"\n      apply(auto simp add:join_assn_def)\n      subgoal for tr1 tr2 tr3\n        using p1_assn.intros(2)[of d x s rest tr3 tr1 tr2]\n        by(auto simp add: pure_assn_def imp_assn_def)\n      done\n    show ?thesis\n      using 1 2 by auto\n  qed\n  done\n\nlemma P1_rep:\n\"\\<Turnstile> {\\<lambda> s tr. s = (None,ss) \\<and> emp\\<^sub>t tr}\n    P1\n    {\\<lambda> s tr. \\<exists> l. s = (None,ss(X := snd(last ((0,ss X)#l)))) \\<and> p1_assn ss l tr}\"\n  unfolding P1_def\n  apply(rule Valid_weaken_pre)\n  prefer 2\n   apply(rule Valid_rep)\n  subgoal\n    apply(rule Valid_ex_pre)\n    subgoal for l\n      sorry\n    done\n  sorry\n\n      \n\ninductive p2_assn :: \"state \\<Rightarrow> real list \\<Rightarrow> n tassn\" where\n  \"p2_assn s [] []\"\n| \"p2_assn (s(X:=x)) rest tr4 \\<Longrightarrow>\n   Wait\\<^sub>t 1 (\\<lambda> _ . EState (None,s)) ({},{}) tr1 \\<and> \n   In\\<^sub>t (EState (None,s)) (''ch1'') x tr2 \\<and>\n   Out\\<^sub>t (EState (None,s(X:=x))) (''ch2'') (x-1) tr3 \\<Longrightarrow>\n   p2_assn s (x#rest)(tr1@tr2@tr3@tr4)\"\n\n\nlemma p2_0:\n\"p2_assn s [] = emp\\<^sub>t\"\n   using p2_assn.cases\n   apply(auto simp add: emp_assn_def)\n   using p2_assn.intros(1) by blast\n\nlemma p2_1: \n\"p2_assn s (x#l2) = Wait\\<^sub>t 1 (\\<lambda> _ . EState (None,s)) ({},{}) @\\<^sub>t\n   In\\<^sub>t (EState (None,s)) (''ch1'') x @\\<^sub>t\n   Out\\<^sub>t (EState (None,s(X:=x))) (''ch2'') (x-1) @\\<^sub>t\n   p2_assn (s(X:=x)) l2\"\n  apply(rule ext)\n  subgoal for tr\n  proof-\n    have 1:\"p2_assn s (x # l2) tr \\<Longrightarrow>\n    (Wait\\<^sub>t 1 (\\<lambda>_. EState (n.None, s)) ({}, {}) @\\<^sub>t\n     In\\<^sub>t (EState (n.None, s)) ''ch1'' x @\\<^sub>t\n     Out\\<^sub>t (EState (n.None, s(X := x))) ''ch2'' (x - 1) @\\<^sub>t p2_assn (s(X := x)) l2) tr\"\n      apply(rule p2_assn.cases[of s \"(x # l2)\" tr])\n        apply auto\n      apply(auto simp add:join_assn_def) by blast\n    have 2:\"(Wait\\<^sub>t 1 (\\<lambda>_. EState (n.None, s)) ({}, {}) @\\<^sub>t\n     In\\<^sub>t (EState (n.None, s)) ''ch1'' x @\\<^sub>t\n     Out\\<^sub>t (EState (n.None, s(X := x))) ''ch2'' (x - 1) @\\<^sub>t p2_assn (s(X := x)) l2) tr \n            \\<Longrightarrow> p2_assn s (x # l2) tr\"\n      apply (auto simp add: join_assn_def)\n      subgoal for tr1 tr2 tr3 tr4\n        using p2_assn.intros(2)[of s x l2 tr4 tr1 tr2 tr3] by auto\n      done\n    show ?thesis using 1 2 by auto\n  qed\n  done\n\ninductive t_assn :: \"state \\<Rightarrow> state \\<Rightarrow> nat \\<Rightarrow> n tassn\" where\n  \"t_assn s s' 0 []\"\n| \"t_assn s (s'(X := s X + 1)) m tr4 \\<Longrightarrow>\n   Wait\\<^sub>t 1 (\\<lambda> t . ParState (EState (None,s(X:= s X + t))) (EState (None,s'))) ({''ch1''},{}) tr1 \\<and> \n   IO\\<^sub>t (''ch1'') (s X + 1) tr2 \\<and>\n   IO\\<^sub>t (''ch2'') (s X) tr3 \\<Longrightarrow>\n   t_assn s s' (m+1) (tr1@tr2@tr3@tr4)\"\n\nlemma t_0:\n\"t_assn s s' 0 = emp\\<^sub>t\"\n   using t_assn.cases\n   apply(auto simp add: emp_assn_def)\n   using t_assn.intros(1) by blast\n\nlemma t_1:\n\"t_assn s s' (Suc n) = \n   Wait\\<^sub>t 1 (\\<lambda> t . ParState (EState (None,s(X:= s X + t))) (EState (None,s'))) ({''ch1''},{}) @\\<^sub>t\n   IO\\<^sub>t (''ch1'') (s X + 1) @\\<^sub>t\n   IO\\<^sub>t (''ch2'') (s X) @\\<^sub>t\n   t_assn s (s'(X := s X + 1)) n\"\n  apply(rule ext)\n  subgoal for tr\n  proof-\n    have 1:\"t_assn s s' (Suc n) tr \\<Longrightarrow>\n    (Wait\\<^sub>t 1 (\\<lambda>t. ParState (EState (n.None, s(X := s X + t))) (EState (n.None, s')))\n      ({''ch1''}, {}) @\\<^sub>t\n     IO\\<^sub>t ''ch1'' (s X + 1) @\\<^sub>t IO\\<^sub>t ''ch2'' (s X) @\\<^sub>t t_assn s (s'(X := s X + 1)) n)tr \"\n      apply(rule t_assn.cases[of s s'\"Suc n\" tr])\n        apply(auto simp add:join_assn_def) by blast\n    have 2:\"(Wait\\<^sub>t 1 (\\<lambda>t. ParState (EState (n.None, s(X := s X + t))) (EState (n.None, s')))\n      ({''ch1''}, {}) @\\<^sub>t\n     IO\\<^sub>t ''ch1'' (s X + 1) @\\<^sub>t IO\\<^sub>t ''ch2'' (s X) @\\<^sub>t t_assn s (s'(X := s X + 1)) n) tr\n            \\<Longrightarrow> t_assn s s' (Suc n) tr\"\n      apply(auto simp add: join_assn_def)\n      subgoal for tr1 tr2 tr3 tr4\n        using t_assn.intros(2)[of s s' n tr4 tr1 tr2 tr3]\n        by auto\n      done\n    show ?thesis\n      using 1 2 by auto\n  qed\n  done\n\nlemma combine:\n\"combine_assn {''ch1'',''ch2''} (p1_assn s l1) (p2_assn s' l2) \\<Longrightarrow>\\<^sub>t t_assn s s' (length l1)\"\nproof(induction l1 arbitrary: s s' l2)\n  case Nil\n  then show ?case \n  proof(cases l2)\n    case Nil\n    then show ?thesis \n      apply (auto simp add:entails_tassn_def)\n      subgoal for tr\n        using p1_0 p2_0 t_0  by simp\n      done\n  next\n    case (Cons a list)\n    then show ?thesis\n      apply (auto simp add:p1_0 p2_1)\n      apply (subst combine_assn_emp_wait)\n      apply simp\n      by (rule false_assn_entails)\n  qed\nnext\n  case (Cons a l1')\n  note Cons1 = Cons\n  then show ?case \n  proof (cases l2)\n    case Nil\n    then show ?thesis \n      apply(cases a)\n      apply(auto simp add:p1_3 p2_0)\n      apply(rule entails_tassn_trans)\n       apply(rule combine_assn_waitout_emp)\n      by auto\n  next\n    case (Cons b l2')\n    then show ?thesis\n      apply auto\n      apply(cases a)\n      subgoal for d x\n        apply (auto simp add:p1_3 p2_1 t_1)\n        apply(rule entails_tassn_trans)\n         apply(rule combine_assn_waitout_wait)\n           apply auto\n        apply(rule entails_tassn_cancel_left)\n        apply(rule entails_tassn_trans)\n         apply(rule combine_assn_waitout_in)\n          apply auto\n        apply(rule entails_tassn_cancel_left)\n        apply(rule entails_tassn_trans)\n         apply(rule combine_assn_in_out)\n         apply auto\n        apply(rule entails_tassn_cancel_left)\n        using Cons1[of s \"(s'(X := s X + 1))\" l2']\n        apply (auto simp add: pure_assn_def imp_assn_def) \n        using \\<open>combine_assn {''ch1'', ''ch2''} (p1_assn s l1') (p2_assn (s'(X := s X + 1)) l2') \\<Longrightarrow>\\<^sub>t t_assn s (s'(X := s X + 1)) (length l1')\\<close> by force\n      done\n  qed\nqed\n\n\nfun p1_assn' :: \"nat \\<Rightarrow> state \\<Rightarrow> n tassn\" where\n  \"p1_assn' 0 s tr \\<longleftrightarrow> (emp\\<^sub>t tr)\"\n| \"p1_assn' (Suc k) s tr \\<longleftrightarrow>\n   waitout_assm_assn {1} (\\<lambda>t. EState(None, s(X := s X + t))) ({''ch1''},{}) ''ch1'' (\\<lambda>_ .1)\n   (in_orig_assn ''ch2'' 0 (EState(None,s(X := s X + 1))) (p1_assn' k (s(X:=0)))) tr\"\n\nfun p2_assn' :: \"nat \\<Rightarrow> state \\<Rightarrow> n tassn\" where\n  \"p2_assn' 0 s tr \\<longleftrightarrow> (emp\\<^sub>t tr)\"\n| \"p2_assn' (Suc k) s tr \\<longleftrightarrow>\n   wait_orig_assn 1 (\\<lambda> _ . EState (None,s)) ({},{}) \n   (in_orig_assn ''ch1'' 1 (EState (None,s)) (out_orig_assn ''ch2'' 0 (EState (None,s(X:=1))) (p2_assn' k (s(X:=1))))) tr\n   \"\n\nfun t_assn' :: \"nat \\<Rightarrow> state \\<Rightarrow> state \\<Rightarrow> n tassn\" where\n  \"t_assn' 0 s s' tr \\<longleftrightarrow> (emp\\<^sub>t tr)\"\n| \"t_assn' (Suc k) s s' tr \\<longleftrightarrow>\n   wait_orig_assn 1 (\\<lambda> t . ParState (EState(None, s(X := s X + t))) (EState (None,s'))) ({''ch1''},{}) \n   (io_orig_assn ''ch1'' 1  \n   (io_orig_assn ''ch2'' 0 (t_assn' k (s(X:=0)) (s'(X:=1))))) tr\n   \"\n\n\n\nlemma combine':\n\"combine_assn {''ch1'',''ch2''} (p1_assn' m1 s1) (p2_assn' m2 s2) \\<Longrightarrow>\\<^sub>t t_assn' m1 s1 s2\"\nproof(induction m1 arbitrary: s1 s2 m2)\n  case 0\n  then show ?case \n  proof(cases m2)\n    case 0\n    then show ?thesis \n      by auto \n  next\n    case (Suc nat)\n    then show ?thesis \n      apply auto \n      apply(rule combine_emp_wait_orig1)\n      by auto\n  qed\nnext\n  case (Suc m1)\n  note suc = Suc\n  then show ?case\n  proof(cases m2)\n    case 0\n    then show ?thesis\n      apply auto\n      apply(rule combine_waitout_assm_emp1)\n      by auto\n  next\n    case (Suc nat)\n    then show ?thesis \n      apply auto \n      apply(subst wait_orig_to_guard)\n      apply(rule entails_tassn_trans)\n       apply(rule combine_waitout_assm_wait_guar1)\n        apply auto\n      apply(subst wait_orig_to_guard')\n      apply(rule wait_guar'_assn_tran)\n      apply auto\n      apply(rule entails_tassn_trans)\n       apply(rule combine_waitout_assm_in_orig1)\n      apply(auto simp add:wait_set_minus_def)\n      apply(rule io_orig_assn_tran)\n      apply(rule entails_tassn_trans)\n       apply(rule combine_in_orig_out_orig1)\n      apply auto\n      apply(rule io_orig_assn_tran)\n      using suc by auto\n  qed\nqed\n\n\n\nend", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/lunarlander_sl/ext1/Scratch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.33307701001008394}}
{"text": "section \\<open>Implementations of the H-Method\\<close>\n\ntheory H_Method_Implementations\nimports Intermediate_Frameworks Pair_Framework \"../Distinguishability\" Test_Suite_Representations \"../OFSM_Tables_Refined\" \"HOL-Library.List_Lexorder\"\nbegin\n\nsubsection \\<open>Using the H-Framework\\<close>\n\ndefinition h_method_via_h_framework :: \"('a::linorder,'b::linorder,'c::linorder) fsm \\<Rightarrow> nat \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> ('b\\<times>'c) prefix_tree\" where\n  \"h_method_via_h_framework = h_framework_dynamic (\\<lambda> M V t X l . False)\"\n\ndefinition h_method_via_h_framework_lists :: \"('a::linorder,'b::linorder,'c::linorder) fsm \\<Rightarrow> nat \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> (('b\\<times>'c) \\<times> bool) list list\" where\n  \"h_method_via_h_framework_lists M m completeInputTraces useInputHeuristic = sorted_list_of_maximal_sequences_in_tree (test_suite_from_io_tree M (initial M) (h_method_via_h_framework M m completeInputTraces useInputHeuristic))\"\n\nlemma h_method_via_h_framework_completeness_and_finiteness :\n  fixes M1 :: \"('a::linorder,'b::linorder,'c::linorder) fsm\"\n  fixes M2 :: \"('e,'b,'c) fsm\"\n  assumes \"observable M1\"\n  and     \"observable M2\"\n  and     \"minimal M1\"\n  and     \"minimal M2\"\n  and     \"size_r M1 \\<le> m\"\n  and     \"size M2 \\<le> m\"\n  and     \"inputs M2 = inputs M1\"\n  and     \"outputs M2 = outputs M1\"\nshows \"(L M1 = L M2) \\<longleftrightarrow> ((L M1 \\<inter> set (h_method_via_h_framework M1 m completeInputTraces useInputHeuristic)) = (L M2 \\<inter> set (h_method_via_h_framework M1 m completeInputTraces useInputHeuristic)))\"\nand \"finite_tree (h_method_via_h_framework M1 m completeInputTraces useInputHeuristic)\"\n  using h_framework_dynamic_completeness_and_finiteness[OF assms]\n  unfolding h_method_via_h_framework_def \n  by blast+\n\nlemma h_method_via_h_framework_lists_completeness :\n  fixes M1 :: \"('a::linorder,'b::linorder,'c::linorder) fsm\"\n  fixes M2 :: \"('d,'b,'c) fsm\"\n  assumes \"observable M1\"\n  and     \"observable M2\"\n  and     \"minimal M1\"\n  and     \"minimal M2\"\n  and     \"size_r M1 \\<le> m\"\n  and     \"size M2 \\<le> m\"\n  and     \"inputs M2 = inputs M1\"\n  and     \"outputs M2 = outputs M1\"\nshows \"(L M1 = L M2) \\<longleftrightarrow> list_all (passes_test_case M2 (initial M2)) (h_method_via_h_framework_lists M1 m completeInputTraces useInputHeuristic)\"\n  using h_framework_dynamic_lists_completeness[OF assms]\n  unfolding h_method_via_h_framework_lists_def h_framework_dynamic_lists_def h_method_via_h_framework_def\n  by blast\n\n\n\nsubsection \\<open>Using the Pair-Framework\\<close>\n\nsubsubsection \\<open>Selection of Distinguishing Traces\\<close>\n\nfun add_distinguishing_sequence_if_required :: \"('a \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 'c) list) \\<Rightarrow> ('a,'b::linorder,'c::linorder) fsm \\<Rightarrow> (('b\\<times>'c) list \\<times> 'a) \\<times> (('b\\<times>'c) list \\<times> 'a) \\<Rightarrow> ('b\\<times>'c) prefix_tree \\<Rightarrow> ('b\\<times>'c) prefix_tree\" where\n  \"add_distinguishing_sequence_if_required dist_fun M ((\\<alpha>,q1), (\\<beta>,q2)) t = (if intersection_is_distinguishing M (after t \\<alpha>) q1 (after t \\<beta>) q2\n    then empty\n    else insert empty (dist_fun q1 q2))\"\n\nlemma add_distinguishing_sequence_if_required_distinguishes :\n  assumes \"observable M\"\n  and     \"minimal M\"\n  and     \"\\<alpha> \\<in> L M\"\n  and     \"\\<beta> \\<in> L M\" \n  and     \"after_initial M \\<alpha> \\<noteq> after_initial M \\<beta>\" \n  and     \"\\<And> q1 q2 . q1 \\<in> states M \\<Longrightarrow> q2 \\<in> states M \\<Longrightarrow> q1 \\<noteq> q2 \\<Longrightarrow> distinguishes M q1 q2 (dist_fun q1 q2)\"\nshows \"\\<exists> io \\<in> set ((add_distinguishing_sequence_if_required dist_fun M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) \\<union> (set (after t \\<alpha>) \\<inter> set (after t \\<beta>)) .  distinguishes M (after_initial M \\<alpha>) (after_initial M \\<beta>) io\"\nproof (cases \"intersection_is_distinguishing M (after t \\<alpha>) (after_initial M \\<alpha>) (after t \\<beta>) (after_initial M \\<beta>)\")\n  case True\n  then have \"(add_distinguishing_sequence_if_required dist_fun M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t = empty\"\n    by auto\n  then have \"set ((add_distinguishing_sequence_if_required dist_fun M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) \\<union> (set (after t \\<alpha>) \\<inter> set (after t \\<beta>)) = (set (after t \\<alpha>) \\<inter> set (after t \\<beta>))\"\n    using Prefix_Tree.set_empty\n    by (metis Int_insert_right inf.absorb_iff2 inf_bot_right insert_is_Un set_Nil sup_absorb2) \n  moreover have \"\\<exists> io \\<in> (set (after t \\<alpha>) \\<inter> set (after t \\<beta>)) .  distinguishes M (after_initial M \\<alpha>) (after_initial M \\<beta>) io\"\n    using True unfolding intersection_is_distinguishing_correctness[OF assms(1) after_is_state[OF assms(1,3)] after_is_state[OF assms(1,4)]]\n    by auto \n  ultimately show ?thesis \n    by blast\nnext\n  case False\n  then have \"set ((add_distinguishing_sequence_if_required dist_fun M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) = set (insert empty (dist_fun (after_initial M \\<alpha>) (after_initial M \\<beta>)))\"\n    by auto\n  then have \"dist_fun (after_initial M \\<alpha>) (after_initial M \\<beta>) \\<in> set ((add_distinguishing_sequence_if_required dist_fun M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) \\<union> (set (after t \\<alpha>) \\<inter> set (after t \\<beta>))\"\n    unfolding insert_set by auto\n  then show ?thesis \n    using assms(6)[OF after_is_state[OF assms(1,3)] after_is_state[OF assms(1,4)] assms(5)] by blast\nqed\n\nlemma add_distinguishing_sequence_if_required_finite : \n  \"finite_tree ((add_distinguishing_sequence_if_required dist_fun M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t)\"\nproof (cases \"intersection_is_distinguishing M (after t \\<alpha>) (after_initial M \\<alpha>) (after t \\<beta>) (after_initial M \\<beta>)\")\n  case True\n  then have \"((add_distinguishing_sequence_if_required dist_fun M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) = empty\"\n    by auto\n  then show ?thesis\n    using empty_finite_tree by simp\nnext\n  case False\n  then have \"((add_distinguishing_sequence_if_required dist_fun M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) = (insert empty (dist_fun (after_initial M \\<alpha>) (after_initial M \\<beta>)))\"\n    by auto\n  then show ?thesis\n    using insert_finite_tree[OF empty_finite_tree] by metis\nqed\n\nfun add_distinguishing_sequence_and_complete_if_required :: \"('a \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 'c) list) \\<Rightarrow> bool \\<Rightarrow> ('a::linorder,'b::linorder,'c::linorder) fsm \\<Rightarrow> (('b\\<times>'c) list \\<times> 'a) \\<times> (('b\\<times>'c) list \\<times> 'a) \\<Rightarrow> ('b\\<times>'c) prefix_tree \\<Rightarrow> ('b\\<times>'c) prefix_tree\" where\n  \"add_distinguishing_sequence_and_complete_if_required distFun completeInputTraces M ((\\<alpha>,q1), (\\<beta>,q2)) t = \n    (if intersection_is_distinguishing M (after t \\<alpha>) q1 (after t \\<beta>) q2\n      then empty\n      else let w = distFun q1 q2;\n               T = insert empty w\n            in if completeInputTraces \n              then let T1 = from_list (language_for_input M q1 (map fst w));\n                       T2 = from_list (language_for_input M q2 (map fst w))\n                   in Prefix_Tree.combine T (Prefix_Tree.combine T1 T2)\n              else T)\" \n\nlemma add_distinguishing_sequence_and_complete_if_required_distinguishes :\n  assumes \"observable M\"\n  and     \"minimal M\"\n  and     \"\\<alpha> \\<in> L M\"\n  and     \"\\<beta> \\<in> L M\" \n  and     \"after_initial M \\<alpha> \\<noteq> after_initial M \\<beta>\" \n  and     \"\\<And> q1 q2 . q1 \\<in> states M \\<Longrightarrow> q2 \\<in> states M \\<Longrightarrow> q1 \\<noteq> q2 \\<Longrightarrow> distinguishes M q1 q2 (dist_fun q1 q2)\"\nshows \"\\<exists> io \\<in> set ((add_distinguishing_sequence_and_complete_if_required dist_fun c M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) \\<union> (set (after t \\<alpha>) \\<inter> set (after t \\<beta>)) .  distinguishes M (after_initial M \\<alpha>) (after_initial M \\<beta>) io\"\nproof (cases \"intersection_is_distinguishing M (after t \\<alpha>) (after_initial M \\<alpha>) (after t \\<beta>) (after_initial M \\<beta>)\")\n  case True\n  then have \"(add_distinguishing_sequence_if_required dist_fun M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t = empty\"\n    by auto\n  then have \"set ((add_distinguishing_sequence_if_required dist_fun M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) \\<union> (set (after t \\<alpha>) \\<inter> set (after t \\<beta>)) = (set (after t \\<alpha>) \\<inter> set (after t \\<beta>))\"\n    using Prefix_Tree.set_empty\n    by (metis Int_insert_right inf.absorb_iff2 inf_bot_right insert_is_Un set_Nil sup_absorb2) \n  moreover have \"\\<exists> io \\<in> (set (after t \\<alpha>) \\<inter> set (after t \\<beta>)) .  distinguishes M (after_initial M \\<alpha>) (after_initial M \\<beta>) io\"\n    using True unfolding intersection_is_distinguishing_correctness[OF assms(1) after_is_state[OF assms(1,3)] after_is_state[OF assms(1,4)]]\n    by auto \n  ultimately show ?thesis \n    by blast\nnext\n  case False\n  then have \"set (insert empty (dist_fun (after_initial M \\<alpha>) (after_initial M \\<beta>))) \\<subseteq> set ((add_distinguishing_sequence_and_complete_if_required dist_fun c M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t)\"\n    using combine_set[of \"insert empty (dist_fun (after_initial M \\<alpha>) (after_initial M \\<beta>))\"] \n    unfolding add_distinguishing_sequence_and_complete_if_required.simps Let_def \n    by (cases c; fastforce)\n  moreover have \"dist_fun (after_initial M \\<alpha>) (after_initial M \\<beta>) \\<in> set (insert empty (dist_fun (after_initial M \\<alpha>) (after_initial M \\<beta>)))\"\n    unfolding insert_set by auto\n  ultimately have \"dist_fun (after_initial M \\<alpha>) (after_initial M \\<beta>) \\<in> set ((add_distinguishing_sequence_and_complete_if_required dist_fun c M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) \\<union> (set (after t \\<alpha>) \\<inter> set (after t \\<beta>))\"\n    by blast\n  then show ?thesis \n    using assms(6)[OF after_is_state[OF assms(1,3)] after_is_state[OF assms(1,4)] assms(5)] \n    by (meson distinguishes_def) \nqed\n\nlemma add_distinguishing_sequence_and_complete_if_required_finite : \n  \"finite_tree ((add_distinguishing_sequence_and_complete_if_required dist_fun c M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t)\"\nproof (cases \"intersection_is_distinguishing M (after t \\<alpha>) (after_initial M \\<alpha>) (after t \\<beta>) (after_initial M \\<beta>)\")\n  case True\n  then have \"((add_distinguishing_sequence_and_complete_if_required dist_fun c M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) = empty\"\n    by auto\n  then show ?thesis\n    using empty_finite_tree by simp\nnext\n  case False\n\n  define w where w: \"w = dist_fun (after_initial M \\<alpha>) (after_initial M \\<beta>)\"\n  define T where T: \"T = insert empty w\"\n  define T1 where T1: \"T1 = from_list (language_for_input M (after_initial M \\<alpha>) (map fst w))\"\n  define T2 where T2: \"T2 = from_list (language_for_input M (after_initial M \\<beta>) (map fst w))\"\n\n  have \"finite_tree T\"\n    using insert_finite_tree[OF empty_finite_tree]\n    unfolding T by auto\n  moreover have \"finite_tree (Prefix_Tree.combine T (Prefix_Tree.combine T1 T2))\"\n    using combine_finite_tree[OF \\<open>finite_tree T\\<close> combine_finite_tree[OF from_list_finite_tree from_list_finite_tree]]\n    unfolding T1 T2\n    by auto\n  ultimately show ?thesis\n    using False\n    unfolding add_distinguishing_sequence_and_complete_if_required.simps w T T1 T2 Let_def\n    by presburger\nqed\n\n\n\n\nfunction find_cheapest_distinguishing_trace :: \"('a,'b::linorder,'c::linorder) fsm \\<Rightarrow> ('a \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 'c) list) \\<Rightarrow> ('b\\<times>'c) list \\<Rightarrow> ('b\\<times>'c) prefix_tree \\<Rightarrow> 'a \\<Rightarrow> ('b\\<times>'c) prefix_tree \\<Rightarrow> 'a \\<Rightarrow> (('b\\<times>'c) list \\<times> nat \\<times> nat)\" where\n  \"find_cheapest_distinguishing_trace M distFun ios (PT m1) q1 (PT m2) q2 = \n    (let\n      f = (\\<lambda> (\\<omega>,l,w) (x,y) . if (x,y) \\<notin> list.set ios then (\\<omega>,l,w) else  \n            (let \n              w1L = if (PT m1) = empty then 0 else 1;\n              w1C = if (x,y) \\<in> dom m1 then 0 else 1;\n              w1 = min w1L w1C;\n              w2L = if (PT m2) = empty then 0 else 1;\n              w2C = if (x,y) \\<in> dom m2 then 0 else 1;\n              w2 = min w2L w2C;\n              w' = w1 + w2\n            in \n              case h_obs M q1 x y of\n                None \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> (\\<omega>,l,w) |\n                  Some _ \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w)) |\n                Some q1' \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w) |\n                  Some q2' \\<Rightarrow> (if q1' = q2' \n                    then (\\<omega>,l,w)\n                    else (case m1 (x,y) of\n                      None \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let \\<omega>' = distFun q1' q2';\n                                    l' = 2 + 2 * length \\<omega>'\n                                in if (w' < w) \\<or> (w' = w \\<and> l' < l) then ((x,y)#\\<omega>',l',w') else (\\<omega>,l,w) | \n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios empty q1' t2' q2' \n                                    in if (w'' + w1 < w) \\<or> (w'' + w1 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w1) else (\\<omega>,l,w)) |\n                      Some t1' \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2' \n                                in if (w'' + w2 < w) \\<or> (w'' + w2 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w2) else (\\<omega>,l,w) |\n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2' \n                                    in if (w'' < w) \\<or> (w'' = w \\<and> l'' < l) then ((x,y)#\\<omega>'',l'',w'') else (\\<omega>,l,w)))))))\n     in \n       foldl f (distFun q1 q2, 0, 3) ios)\"\n  by pat_completeness auto\ntermination   \nproof -\n\n  let ?f = \"(\\<lambda>(M, dF, ios, t1, q1, t2, q2). height_over ios t1 + height_over ios t2)\"\n\n  have \"\\<And>(M::('a,'b::linorder,'c::linorder) fsm) \n          (distFun :: ('a \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 'c) list)) \n          (ios :: ('b\\<times>'c) list)\n           m1 (q1::'a) m2 (q2::'a) x y t2' q1' q2'.\n       \\<not> (x, y) \\<notin> list.set ios \\<Longrightarrow>\n       m1 (x, y) = None \\<Longrightarrow>\n       m2 (x, y) = Some t2' \\<Longrightarrow>\n       ((M, distFun, ios, Prefix_Tree.empty, q1', t2', q2'), M, distFun, ios,\n        PT m1, q1, PT m2, q2)\n       \\<in> measure (\\<lambda>(M, dF, ios, t1, q1, t2, q2). height_over ios t1 + height_over ios t2)\"\n  proof -\n    fix M::\"('a,'b::linorder,'c::linorder) fsm\" \n    fix distFun :: \"('a \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 'c) list)\"\n    fix ios :: \"('b\\<times>'c) list\"\n    fix m1 m2 :: \"('b\\<times>'c) \\<rightharpoonup> ('b\\<times>'c) prefix_tree\"\n    fix t2'\n    fix q1 q2 q1' q2' :: 'a\n    fix x \n    fix y \n\n    assume \"m1 (x, y) = None\"\n    assume \"m2 (x, y) = Some t2'\"\n    assume \"\\<not> (x, y) \\<notin> list.set ios\"\n\n    define pre where \"pre = (M, distFun, ios, PT m1, q1, PT m2, q2)\"\n    define post where \"post = (M, distFun, ios, Prefix_Tree.empty::('b\\<times>'c) prefix_tree, q1', t2', q2')\"\n\n    have \"height_over ios empty \\<le> height_over ios (PT m1)\"\n      unfolding height_over.simps height_over_empty by auto\n    then have \"?f post < ?f pre\" \n      unfolding pre_def post_def case_prod_conv\n      by (meson \\<open>\\<not> (x, y) \\<notin> list.set ios\\<close> \\<open>m2 (x, y) = Some t2'\\<close> add_le_less_mono height_over_subtree_less) \n    then show \"((M, distFun, ios, Prefix_Tree.empty, q1', t2', q2'), M, distFun, ios,\n        PT m1, q1, PT m2, q2)\n       \\<in> measure (\\<lambda>(M, dF, ios, t1, q1, t2, q2). height_over ios t1 + height_over ios t2)\"\n      unfolding pre_def[symmetric] post_def[symmetric]\n      by simp \n  qed\n\n  moreover have \"\\<And>(M::('a,'b::linorder,'c::linorder) fsm) \n          (distFun :: ('a \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 'c) list)) \n          (ios :: ('b\\<times>'c) list)\n           m1 (q1::'a) m2 (q2::'a) x y t1' q1' q2'.\n       \\<not> (x, y) \\<notin> list.set ios \\<Longrightarrow>\n       m1 (x, y) = Some t1' \\<Longrightarrow>\n       m2 (x, y) = None \\<Longrightarrow>\n       ((M, distFun, ios, t1', q1', empty, q2'), M, distFun, ios,\n        PT m1, q1, PT m2, q2)\n       \\<in> measure (\\<lambda>(M, dF, ios, t1, q1, t2, q2). height_over ios t1 + height_over ios t2)\"\n  proof -\n    fix M::\"('a,'b::linorder,'c::linorder) fsm\" \n    fix distFun :: \"('a \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 'c) list)\"\n    fix ios :: \"('b\\<times>'c) list\"\n    fix m1 m2 :: \"('b\\<times>'c) \\<rightharpoonup> ('b\\<times>'c) prefix_tree\"\n    fix t1'\n    fix q1 q2 q1' q2' :: 'a\n    fix x :: 'b\n    fix y :: 'c\n\n    assume \"m1 (x, y) = Some t1'\"\n    assume \"m2 (x, y) = None\"\n    assume \"\\<not> (x, y) \\<notin> list.set ios\"\n\n\n    define pre where \"pre = (M, distFun, ios, PT m1, q1, PT m2, q2)\"\n    define post where \"post = (M, distFun, ios, t1', q1',  Prefix_Tree.empty::('b\\<times>'c) prefix_tree, q2')\"\n\n    have \"height_over ios empty \\<le> height_over ios (PT m2)\"\n      unfolding height_over.simps height_over_empty by auto\n    then have \"?f post < ?f pre\" \n      unfolding pre_def post_def case_prod_conv\n      by (meson \\<open>\\<not> (x, y) \\<notin> list.set ios\\<close> \\<open>m1 (x, y) = Some t1'\\<close> add_mono_thms_linordered_field(3) height_over_subtree_less)\n    then show \"((M, distFun, ios, t1', q1', Prefix_Tree.empty, q2'), M, distFun, ios,\n        PT m1, q1, PT m2, q2)\n       \\<in> measure (\\<lambda>(M, dF, ios, t1, q1, t2, q2). height_over ios t1 + height_over ios t2)\"\n      unfolding pre_def[symmetric] post_def[symmetric]\n      by simp \n  qed\n\n\n  moreover have \"\\<And>(M::('a,'b::linorder,'c::linorder) fsm) \n          (distFun :: ('a \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 'c) list)) \n          (ios :: ('b\\<times>'c) list)\n           m1 (q1::'a) m2 (q2::'a) x y t1' t2' q1' q2'.\n       \\<not> (x, y) \\<notin> list.set ios \\<Longrightarrow>\n       m1 (x, y) = Some t1' \\<Longrightarrow>\n       m2 (x, y) = Some t2' \\<Longrightarrow>\n       ((M, distFun, ios, t1', q1', t2', q2'), M, distFun, ios,\n        PT m1, q1, PT m2, q2)\n       \\<in> measure (\\<lambda>(M, dF, ios, t1, q1, t2, q2). height_over ios t1 + height_over ios t2)\"\n  proof -\n    fix M::\"('a,'b::linorder,'c::linorder) fsm\" \n    fix distFun :: \"('a \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 'c) list)\"\n    fix ios :: \"('b\\<times>'c) list\"\n    fix m1 m2 :: \"('b\\<times>'c) \\<rightharpoonup> ('b\\<times>'c) prefix_tree\"\n    fix t1' t2' :: \"('b\\<times>'c) prefix_tree\"\n    fix q1 q2 q1' q2' :: 'a\n    fix x :: 'b\n    fix y :: 'c\n\n    define pre where \"pre = (M, distFun, ios, PT m1, q1, PT m2, q2)\"\n    define post where \"post = (M, distFun, ios, t1', q1', t2', q2')\"\n\n    assume \"m1 (x, y) = Some t1'\"\n    moreover assume \"m2 (x, y) = Some t2'\"\n    moreover assume \"\\<not> (x, y) \\<notin> list.set ios\"\n    ultimately have \"?f post < ?f pre\" \n      unfolding pre_def post_def case_prod_conv\n      by (meson add_less_mono height_over_subtree_less)\n    then show \"((M, distFun, ios, t1', q1',t2', q2'), M, distFun, ios,\n        PT m1, q1, PT m2, q2)\n       \\<in> measure (\\<lambda>(M, dF, ios, t1, q1, t2, q2). height_over ios t1 + height_over ios t2)\"\n      unfolding pre_def[symmetric] post_def[symmetric]\n      by simp \n  qed\n\n  ultimately show ?thesis\n    by (relation \"measure (\\<lambda> (M,dF,ios,t1,q1,t2,q2) . height_over ios t1 + height_over ios t2)\"; simp)\nqed\n\n\n\n\n(* removes the elem-check on (x,y) and ios *)\nlemma find_cheapest_distinguishing_trace_alt_def :\n  \"find_cheapest_distinguishing_trace M distFun ios (PT m1) q1 (PT m2) q2 = \n    (let\n      f = (\\<lambda> (\\<omega>,l,w) (x,y). \n            (let \n              w1L = if (PT m1) = empty then 0 else 1;\n              w1C = if (x,y) \\<in> dom m1 then 0 else 1;\n              w1 = min w1L w1C;\n              w2L = if (PT m2) = empty then 0 else 1;\n              w2C = if (x,y) \\<in> dom m2 then 0 else 1;\n              w2 = min w2L w2C;\n              w' = w1 + w2\n            in  \n              case h_obs M q1 x y of\n                None \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> (\\<omega>,l,w) |\n                  Some _ \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w)) |\n                Some q1' \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w) |\n                  Some q2' \\<Rightarrow> (if q1' = q2' \n                    then (\\<omega>,l,w)\n                    else (case m1 (x,y) of\n                      None \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let \\<omega>' = distFun q1' q2';\n                                    l' = 2 + 2 * length \\<omega>'\n                                in if (w' < w) \\<or> (w' = w \\<and> l' < l) then ((x,y)#\\<omega>',l',w') else (\\<omega>,l,w) | \n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios empty q1' t2' q2' \n                                    in if (w'' + w1 < w) \\<or> (w'' + w1 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w1) else (\\<omega>,l,w)) |\n                      Some t1' \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2' \n                                in if (w'' + w2 < w) \\<or> (w'' + w2 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w2) else (\\<omega>,l,w) |\n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2'  \n                                    in if (w'' < w) \\<or> (w'' = w \\<and> l'' < l) then ((x,y)#\\<omega>'',l'',w'') else (\\<omega>,l,w)))))))\n     in \n       foldl f (distFun q1 q2, 0, 3) ios)\"\n  (is \"find_cheapest_distinguishing_trace M distFun ios (PT m1) q1 (PT m2) q2 = ?find_cheapest_distinguishing_trace\")\n\nproof -\n  define f' where \"f' = (\\<lambda> (\\<omega>,l,w) (x,y) . \n            (let \n              w1L = if (PT m1) = empty then 0 else 1;\n              w1C = if (x,y) \\<in> dom m1 then 0 else 1;\n              w1 = min w1L w1C;\n              w2L = if (PT m2) = empty then 0 else 1;\n              w2C = if (x,y) \\<in> dom m2 then 0 else 1;\n              w2 = min w2L w2C;\n              w' = w1 + w2\n            in  \n              case h_obs M q1 x y of\n                None \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> (\\<omega>,l,w) |\n                  Some _ \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w)) |\n                Some q1' \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w) |\n                  Some q2' \\<Rightarrow> (if q1' = q2' \n                    then (\\<omega>,l,w)\n                    else (case m1 (x,y) of\n                      None \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let \\<omega>' = distFun q1' q2';\n                                    l' = 2 + 2 * length \\<omega>'\n                                in if (w' < w) \\<or> (w' = w \\<and> l' < l) then ((x,y)#\\<omega>',l',w') else (\\<omega>,l,w) | \n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios empty q1' t2' q2'\n                                    in if (w'' + w1 < w) \\<or> (w'' + w1 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w1) else (\\<omega>,l,w)) |\n                      Some t1' \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2' \n                                in if (w'' + w2 < w) \\<or> (w'' + w2 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w2) else (\\<omega>,l,w) |\n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2' \n                                    in if (w'' < w) \\<or> (w'' = w \\<and> l'' < l) then ((x,y)#\\<omega>'',l'',w'') else (\\<omega>,l,w)))))))\"\n\n  define f where \"f = (\\<lambda> (\\<omega>,l,w) (x,y) . if (x,y) \\<notin> list.set ios then (\\<omega>,l,w) else  \n            (let \n              w1L = if (PT m1) = empty then 0 else 1;\n              w1C = if (x,y) \\<in> dom m1 then 0 else 1;\n              w1 = min w1L w1C;\n              w2L = if (PT m2) = empty then 0 else 1;\n              w2C = if (x,y) \\<in> dom m2 then 0 else 1;\n              w2 = min w2L w2C;\n              w' = w1 + w2\n            in \n              case h_obs M q1 x y of\n                None \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> (\\<omega>,l,w) |\n                  Some _ \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w)) |\n                Some q1' \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w) |\n                  Some q2' \\<Rightarrow> (if q1' = q2' \n                    then (\\<omega>,l,w)\n                    else (case m1 (x,y) of\n                      None \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let \\<omega>' = distFun q1' q2';\n                                    l' = 2 + 2 * length \\<omega>'\n                                in if (w' < w) \\<or> (w' = w \\<and> l' < l) then ((x,y)#\\<omega>',l',w') else (\\<omega>,l,w) | \n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios empty q1' t2' q2'\n                                    in if (w'' + w1 < w) \\<or> (w'' + w1 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w1) else (\\<omega>,l,w)) |\n                      Some t1' \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2'\n                                in if (w'' + w2 < w) \\<or> (w'' + w2 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w2) else (\\<omega>,l,w) |\n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2'\n                                    in if (w'' < w) \\<or> (w'' = w \\<and> l'' < l) then ((x,y)#\\<omega>'',l'',w'') else (\\<omega>,l,w)))))))\"\n  then have \"f = (\\<lambda> y x . if x \\<notin> list.set ios then y else f' y x)\"\n    unfolding f'_def by fast\n  moreover have \"find_cheapest_distinguishing_trace M distFun ios (PT m1) q1 (PT m2) q2 = foldl f (distFun q1 q2, 0, 3) ios\"\n    unfolding find_cheapest_distinguishing_trace.simps f_def[symmetric] by auto\n  ultimately have \"find_cheapest_distinguishing_trace M distFun ios (PT m1) q1 (PT m2) q2 = foldl (\\<lambda> y x . if x \\<notin> list.set ios then y else f' y x) (distFun q1 q2, 0, 3) ios\"\n    by auto\n  then show ?thesis\n    unfolding f'_def[symmetric]  \n    using foldl_elem_check[of ios \"list.set ios\"]\n    by auto\nqed\n\n\nlemma find_cheapest_distinguishing_trace_code[code] :\n  \"find_cheapest_distinguishing_trace M distFun ios (MPT m1) q1 (MPT m2) q2 = \n    (let\n      f = (\\<lambda> (\\<omega>,l,w) (x,y) . \n            (let \n              w1L = if is_leaf (MPT m1) then 0 else 1;\n              w1C = if (x,y) \\<in> Mapping.keys m1 then 0 else 1;\n              w1 = min w1L w1C;\n              w2L = if is_leaf (MPT m2) then 0 else 1;\n              w2C = if(x,y) \\<in> Mapping.keys m2 then 0 else 1;\n              w2 = min w2L w2C;\n              w' = w1 + w2\n            in  \n              case h_obs M q1 x y of\n                None \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> (\\<omega>,l,w) |\n                  Some _ \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w)) |\n                Some q1' \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w) |\n                  Some q2' \\<Rightarrow> (if q1' = q2' \n                    then (\\<omega>,l,w)\n                    else (case Mapping.lookup m1 (x,y) of\n                      None \\<Rightarrow> (case Mapping.lookup m2 (x,y) of\n                        None \\<Rightarrow> let \\<omega>' = distFun q1' q2';\n                                    l' = 2 + 2 * length \\<omega>'\n                                in if (w' < w) \\<or> (w' = w \\<and> l' < l) then ((x,y)#\\<omega>',l',w') else (\\<omega>,l,w) | \n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios empty q1' t2' q2' \n                                    in if (w'' + w1 < w) \\<or> (w'' + w1 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w1) else (\\<omega>,l,w)) |\n                      Some t1' \\<Rightarrow> (case Mapping.lookup m2 (x,y) of\n                        None \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2' \n                                in if (w'' + w2 < w) \\<or> (w'' + w2 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w2) else (\\<omega>,l,w) |\n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2'  \n                                    in if (w'' < w) \\<or> (w'' = w \\<and> l'' < l) then ((x,y)#\\<omega>'',l'',w'') else (\\<omega>,l,w)))))))\n     in \n       foldl f (distFun q1 q2, 0, 3) ios)\"\n  unfolding find_cheapest_distinguishing_trace_alt_def MPT_def\n  by (simp add: keys_dom_lookup) \n\n\n\nlemma find_cheapest_distinguishing_trace_is_distinguishing_trace :\n  assumes \"observable M\"\n  and     \"minimal M\"\n  and     \"q1 \\<in> states M\"\n  and     \"q2 \\<in> states M\" \n  and     \"q1 \\<noteq> q2\"   \n  and     \"\\<And> q1 q2 . q1 \\<in> states M \\<Longrightarrow> q2 \\<in> states M \\<Longrightarrow> q1 \\<noteq> q2 \\<Longrightarrow> distinguishes M q1 q2 (distFun q1 q2)\"\nshows \"distinguishes M q1 q2 (fst (find_cheapest_distinguishing_trace M distFun ios t1 q1 t2 q2))\"\n  using assms(3,4,5)\nproof (induction \"height_over ios t1 + height_over ios t2\" arbitrary: t1 q1 t2 q2 rule: less_induct)\n  case less\n\n  obtain m1 where \"t1 = PT m1\"\n    using prefix_tree.exhaust by blast\n  obtain m2 where \"t2 = PT m2\"\n    using prefix_tree.exhaust by blast\n\n\n  define f where \"f = (\\<lambda> (\\<omega>,l,w) (x,y) . \n            (let \n              w1L = if (PT m1) = empty then 0 else 1;\n              w1C = if (x,y) \\<in> dom m1 then 0 else 1;\n              w1 = min w1L w1C;\n              w2L = if (PT m2) = empty then 0 else 1;\n              w2C = if (x,y) \\<in> dom m2 then 0 else 1;\n              w2 = min w2L w2C;\n              w' = w1 + w2\n            in  \n              case h_obs M q1 x y of\n                None \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> (\\<omega>,l,w) |\n                  Some _ \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w)) |\n                Some q1' \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w) |\n                  Some q2' \\<Rightarrow> (if q1' = q2' \n                    then (\\<omega>,l,w)\n                    else (case m1 (x,y) of\n                      None \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let \\<omega>' = distFun q1' q2';\n                                    l' = 2 + 2 * length \\<omega>'\n                                in if (w' < w) \\<or> (w' = w \\<and> l' < l) then ((x,y)#\\<omega>',l',w') else (\\<omega>,l,w) | \n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios empty q1' t2' q2'\n                                    in if (w'' + w1 < w) \\<or> (w'' + w1 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w1) else (\\<omega>,l,w)) |\n                      Some t1' \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2' \n                                in if (w'' + w2 < w) \\<or> (w'' + w2 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w2) else (\\<omega>,l,w) |\n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2' \n                                    in if (w'' < w) \\<or> (w'' = w \\<and> l'' < l) then ((x,y)#\\<omega>'',l'',w'') else (\\<omega>,l,w)))))))\"\n\n  then have \"find_cheapest_distinguishing_trace M distFun ios t1 q1 t2 q2 = foldl f (distFun q1 q2, 0, 3) ios\"\n    unfolding \\<open>t1 = PT m1\\<close> \\<open>t2 = PT m2\\<close> \n    unfolding find_cheapest_distinguishing_trace_alt_def Let_def\n    by fast\n\n  define ios' where \"ios'=ios\"\n\n  have \"list.set ios' \\<subseteq> list.set ios \\<Longrightarrow> distinguishes M q1 q2 (fst (foldl f (distFun q1 q2, 0, 3) ios'))\"\n  proof (induction ios' rule: rev_induct)\n    case Nil\n    then show ?case using assms(6)[OF less.prems] by auto\n  next\n    case (snoc xy ios')\n\n    obtain x y where \"xy = (x,y)\"\n      using prod.exhaust by metis\n    moreover obtain \\<omega> l w where \"(foldl f (distFun q1 q2, 0, 3) ios') = (\\<omega>,l,w)\"\n      using prod.exhaust by metis\n    ultimately have \"foldl f (distFun q1 q2, 0, 3) (ios'@[xy]) = f (\\<omega>,l,w) (x,y)\"\n      by auto\n    \n    have \"distinguishes M q1 q2 \\<omega>\"\n      using \\<open>(foldl f (distFun q1 q2, 0, 3) ios') = (\\<omega>,l,w)\\<close> snoc by auto\n\n    have \"(x,y) \\<in> list.set ios\"\n      using snoc.prems unfolding \\<open>xy = (x,y)\\<close> by auto\n\n    define w1L where \"w1L = (if (PT m1) = empty then 0 else 1::nat)\"\n    define w1C where \"w1C = (if (x,y) \\<in> dom m1 then 0 else 1::nat)\"\n    define w1 where \"w1 = min w1L w1C\"\n    define w2L where \"w2L = (if (PT m2) = empty then 0 else 1::nat)\"\n    define w2C where \"w2C = (if (x,y) \\<in> dom m2 then 0 else 1::nat)\"\n    define w2 where \"w2 = min w2L w2C\"\n    define w' where \"w' = w1 + w2\"\n\n    have *:\"f (\\<omega>,l,w) (x,y) = (case h_obs M q1 x y of\n                None \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> (\\<omega>,l,w) |\n                  Some _ \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w)) |\n                Some q1' \\<Rightarrow> (case h_obs M q2 x y of \n                  None \\<Rightarrow> if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w) |\n                  Some q2' \\<Rightarrow> (if q1' = q2' \n                    then (\\<omega>,l,w)\n                    else (case m1 (x,y) of\n                      None \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let \\<omega>' = distFun q1' q2';\n                                    l' = 2 + 2 * length \\<omega>'\n                                in if (w' < w) \\<or> (w' = w \\<and> l' < l) then ((x,y)#\\<omega>',l',w') else (\\<omega>,l,w) | \n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios empty q1' t2' q2'\n                                    in if (w'' + w1 < w) \\<or> (w'' + w1 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w1) else (\\<omega>,l,w)) |\n                      Some t1' \\<Rightarrow> (case m2 (x,y) of\n                        None \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2' \n                                in if (w'' + w2 < w) \\<or> (w'' + w2 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w2) else (\\<omega>,l,w) |\n                        Some t2' \\<Rightarrow> let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2' \n                                    in if (w'' < w) \\<or> (w'' = w \\<and> l'' < l) then ((x,y)#\\<omega>'',l'',w'') else (\\<omega>,l,w))))))\"\n      unfolding w1_def w2_def w'_def w1L_def w1C_def w2L_def w2C_def\n      unfolding f_def case_prod_conv Let_def \n      by fast\n\n    have \"distinguishes M q1 q2 (fst (f (\\<omega>,l,w) (x,y)))\"\n    proof (cases \"h_obs M q1 x y\")\n      case None\n      then show ?thesis proof (cases \"h_obs M q2 x y\")\n        case None\n        have \"f (\\<omega>,l,w) (x,y) = (\\<omega>,l,w)\"\n          unfolding *\n          unfolding \\<open>h_obs M q1 x y = None\\<close> None by auto\n        then show ?thesis \n          using \\<open>distinguishes M q1 q2 \\<omega>\\<close> by auto\n      next\n        case (Some a)\n        have \"f (\\<omega>,l,w) (x,y) = (if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w))\"\n          unfolding * None Some by auto\n        moreover have \"distinguishes M q1 q2 [(x,y)]\"\n          using distinguishes_sym[OF h_obs_distinguishes[OF assms(1) Some None]] .\n        ultimately show ?thesis\n          using \\<open>distinguishes M q1 q2 \\<omega>\\<close> by auto\n      qed\n    next\n      case (Some q1')\n      then have \"q1' \\<in> states M\"\n        by (meson h_obs_state)\n      \n      show ?thesis proof (cases \"h_obs M q2 x y\")\n        case None\n        have \"f (\\<omega>,l,w) (x,y) = (if w' = 0 \\<or> w' \\<le> w then ([(x,y)],w1C+w2C,w') else (\\<omega>,l,w))\"\n          unfolding * None Some by auto\n        moreover have \"distinguishes M q1 q2 [(x,y)]\"\n          using h_obs_distinguishes[OF assms(1) Some None] .\n        ultimately show ?thesis\n          using \\<open>distinguishes M q1 q2 \\<omega>\\<close> by auto\n      next\n        case (Some q2')     \n        then have \"q2' \\<in> states M\"\n          by (meson h_obs_state)\n        \n        show ?thesis proof (cases \"q1' = q2'\")\n          case True\n          have \"f (\\<omega>,l,w) (x,y) = (\\<omega>,l,w)\"\n            unfolding *\n            unfolding \\<open>h_obs M q1 x y = Some q1'\\<close> Some True by auto\n          then show ?thesis \n            using \\<open>distinguishes M q1 q2 \\<omega>\\<close> by auto\n        next\n          case False\n          \n          have dist': \"\\<And> \\<omega> . distinguishes M q1' q2' \\<omega> \\<Longrightarrow> distinguishes M q1 q2 ((x,y)#\\<omega>)\"\n            using distinguishes_after_prepend[OF assms(1), of q1 x y q2]\n            using \\<open>h_obs M q1 x y = Some q1'\\<close> \\<open>h_obs M q2 x y = Some q2'\\<close>\n            unfolding after_h_obs[OF assms(1) \\<open>h_obs M q1 x y = Some q1'\\<close>]\n            unfolding after_h_obs[OF assms(1) \\<open>h_obs M q2 x y = Some q2'\\<close>] \n            by auto\n          \n          show ?thesis proof (cases \"m1 (x,y)\")\n            case None\n            show ?thesis proof (cases \"m2 (x,y)\")\n              case None\n\n              have **: \"f (\\<omega>,l,w) (x,y) = (let \\<omega>' = distFun q1' q2';  l' = 2 + 2 * length \\<omega>'\n                                       in if (w' < w) \\<or> (w' = w \\<and> l' < l) then ((x,y)#\\<omega>',l',w') else (\\<omega>,l,w))\"\n                unfolding *\n                unfolding \\<open>h_obs M q1 x y = Some q1'\\<close> \\<open>h_obs M q2 x y = Some q2'\\<close> \\<open>m1 (x, y) = None\\<close> \\<open>m2 (x, y) = None\\<close>\n                using False\n                by auto\n\n              have \"distinguishes M q1' q2' (distFun q1' q2')\"\n                using \\<open>q1' \\<in> states M\\<close> \\<open>q2' \\<in> states M\\<close> assms(6) False by blast\n              then have \"distinguishes M q1 q2 ((x,y)#(distFun q1' q2'))\"\n                using dist' by auto\n              then  show ?thesis \n                using \\<open>distinguishes M q1 q2 \\<omega>\\<close>\n                unfolding ** Let_def by auto\n            next\n              case (Some t2')\n\n              have **: \"f (\\<omega>,l,w) (x,y) = (let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios empty q1' t2' q2'\n                                    in if (w'' + w1 < w) \\<or> (w'' + w1 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w1) else (\\<omega>,l,w))\"\n                unfolding *\n                unfolding \\<open>h_obs M q1 x y = Some q1'\\<close> \\<open>h_obs M q2 x y = Some q2'\\<close> \\<open>m1 (x, y) = None\\<close> \\<open>m2 (x, y) = Some t2'\\<close>\n                using False\n                by auto\n\n              obtain \\<omega>'' l'' w'' where ***:\"find_cheapest_distinguishing_trace M distFun ios Prefix_Tree.empty q1' t2' q2' = (\\<omega>'', l'', w'')\"\n                using prod.exhaust by metis\n\n              have \"distinguishes M q1' q2' (fst (find_cheapest_distinguishing_trace M distFun ios empty q1' t2' q2'))\"\n              proof -\n\n                have \"height_over ios empty + height_over ios t2' < height_over ios t1 + height_over ios t2\"\n                  using height_over_subtree_less[of m2 \"(x,y)\", OF \\<open>m2 (x,y) = Some t2'\\<close> \\<open>(x,y) \\<in> list.set ios\\<close> ]\n                  unfolding height_over_empty \\<open>t2 = PT m2\\<close>[symmetric]\n                  by (simp add: \\<open>t1 = PT m1\\<close>)\n                then show ?thesis\n                  using less.hyps[OF _ \\<open>q1' \\<in> states M\\<close> \\<open>q2' \\<in> states M\\<close> False]\n                  by blast\n              qed\n              then have \"distinguishes M q1 q2 ((x,y)#(fst (find_cheapest_distinguishing_trace M distFun ios empty q1' t2' q2')))\"\n                using dist' by blast\n              then  show ?thesis \n                using \\<open>distinguishes M q1 q2 \\<omega>\\<close>                \n                unfolding ** *** Let_def fst_conv case_prod_conv by auto\n            qed\n          next\n            case (Some t1')\n            show ?thesis proof (cases \"m2 (x,y)\")\n              case None\n\n              have **: \"f (\\<omega>,l,w) (x,y) = (let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2' \n                                in if (w'' + w2 < w) \\<or> (w'' + w2 = w \\<and> l''+1 < l) then ((x,y)#\\<omega>'',l''+1,w''+w2) else (\\<omega>,l,w))\"\n                unfolding *\n                unfolding \\<open>h_obs M q1 x y = Some q1'\\<close> \\<open>h_obs M q2 x y = Some q2'\\<close> \\<open>m1 (x, y) = Some t1'\\<close> \\<open>m2 (x, y) = None\\<close>\n                using False\n                by auto\n\n              obtain \\<omega>'' l'' w'' where ***:\"find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2' = (\\<omega>'', l'', w'')\"\n                using prod.exhaust by metis\n\n              have \"distinguishes M q1' q2' (fst (find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2'))\"\n              proof -\n\n                have \"height_over ios t1' + height_over ios empty < height_over ios t1 + height_over ios t2\"\n                  using height_over_subtree_less[of m1 \"(x,y)\", OF \\<open>m1 (x,y) = Some t1'\\<close> \\<open>(x,y) \\<in> list.set ios\\<close> ]\n                  unfolding height_over_empty \\<open>t1 = PT m1\\<close>[symmetric]\n                  by (simp add: \\<open>t2 = PT m2\\<close>)\n                then show ?thesis\n                  using less.hyps[OF _ \\<open>q1' \\<in> states M\\<close> \\<open>q2' \\<in> states M\\<close> False]\n                  by blast\n              qed\n              then have \"distinguishes M q1 q2 ((x,y)#(fst (find_cheapest_distinguishing_trace M distFun ios t1' q1' empty q2')))\"\n                using dist' by blast\n              then  show ?thesis \n                using \\<open>distinguishes M q1 q2 \\<omega>\\<close>                \n                unfolding ** *** Let_def fst_conv case_prod_conv by auto\n            next\n              case (Some t2')\n\n              have **: \"f (\\<omega>,l,w) (x,y) = (let (\\<omega>'',l'',w'') = find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2' \n                                    in if (w'' < w) \\<or> (w'' = w \\<and> l'' < l) then ((x,y)#\\<omega>'',l'',w'') else (\\<omega>,l,w))\"\n                unfolding *\n                unfolding \\<open>h_obs M q1 x y = Some q1'\\<close> \\<open>h_obs M q2 x y = Some q2'\\<close> \\<open>m1 (x, y) = Some t1'\\<close> \\<open>m2 (x, y) = Some t2'\\<close>\n                using False\n                by auto\n              obtain \\<omega>'' l'' w'' where ***:\"find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2' = (\\<omega>'', l'', w'')\"\n                using prod.exhaust by metis\n\n              have \"distinguishes M q1' q2' (fst (find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2'))\"\n              proof -\n\n                have \"height_over ios t1' + height_over ios t2' < height_over ios t1 + height_over ios t2\"\n                  using height_over_subtree_less[of m1 \"(x,y)\", OF \\<open>m1 (x,y) = Some t1'\\<close> \\<open>(x,y) \\<in> list.set ios\\<close> ]\n                  using height_over_subtree_less[of m2 \"(x,y)\", OF \\<open>m2 (x,y) = Some t2'\\<close> \\<open>(x,y) \\<in> list.set ios\\<close> ]\n                  unfolding \\<open>t1 = PT m1\\<close>[symmetric] \\<open>t2 = PT m2\\<close>[symmetric]\n                  by auto\n                then show ?thesis\n                  using less.hyps[OF _ \\<open>q1' \\<in> states M\\<close> \\<open>q2' \\<in> states M\\<close> False]\n                  by blast\n              qed\n              then have \"distinguishes M q1 q2 ((x,y)#(fst (find_cheapest_distinguishing_trace M distFun ios t1' q1' t2' q2')))\"\n                using dist' by blast\n              then  show ?thesis \n                using \\<open>distinguishes M q1 q2 \\<omega>\\<close>                \n                unfolding ** *** Let_def fst_conv case_prod_conv by auto\n            qed\n          qed\n        qed\n      qed\n    qed\n    then show ?case \n      unfolding \\<open>foldl f (distFun q1 q2, 0, 3) (ios'@[xy]) = f (\\<omega>,l,w) (x,y)\\<close> .\n  qed \n      \n\n  then show ?case \n    unfolding \\<open>find_cheapest_distinguishing_trace M distFun ios t1 q1 t2 q2 = foldl f (distFun q1 q2, 0, 3) ios\\<close>\n              \\<open>ios' = ios\\<close>\n    by blast\nqed\n\n\nfun add_cheapest_distinguishing_trace :: \"('a \\<Rightarrow> 'a \\<Rightarrow> ('b \\<times> 'c) list) \\<Rightarrow> bool \\<Rightarrow> ('a::linorder,'b::linorder,'c::linorder) fsm \\<Rightarrow> (('b\\<times>'c) list \\<times> 'a) \\<times> (('b\\<times>'c) list \\<times> 'a) \\<Rightarrow> ('b\\<times>'c) prefix_tree \\<Rightarrow> ('b\\<times>'c) prefix_tree\" where\n  \"add_cheapest_distinguishing_trace distFun completeInputTraces M ((\\<alpha>,q1), (\\<beta>,q2)) t = \n    (let w = (fst (find_cheapest_distinguishing_trace M distFun (List.product (inputs_as_list M) (outputs_as_list M)) (after t \\<alpha>) q1 (after t \\<beta>) q2));\n         T = insert empty w\n      in if completeInputTraces \n        then let T1 = complete_inputs_to_tree M q1 (outputs_as_list M) (map fst w);\n                 T2 = complete_inputs_to_tree M q2 (outputs_as_list M) (map fst w)\n             in Prefix_Tree.combine T (Prefix_Tree.combine T1 T2)\n        else T)\" \n\n\nlemma add_cheapest_distinguishing_trace_distinguishes :\n  assumes \"observable M\"\n  and     \"minimal M\"\n  and     \"\\<alpha> \\<in> L M\"\n  and     \"\\<beta> \\<in> L M\" \n  and     \"after_initial M \\<alpha> \\<noteq> after_initial M \\<beta>\" \n  and     \"\\<And> q1 q2 . q1 \\<in> states M \\<Longrightarrow> q2 \\<in> states M \\<Longrightarrow> q1 \\<noteq> q2 \\<Longrightarrow> distinguishes M q1 q2 (dist_fun q1 q2)\"\nshows \"\\<exists> io \\<in> set ((add_cheapest_distinguishing_trace dist_fun c M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) \\<union> (set (after t \\<alpha>) \\<inter> set (after t \\<beta>)) .  distinguishes M (after_initial M \\<alpha>) (after_initial M \\<beta>) io\"\nproof -\n  define w where \"w = (fst (find_cheapest_distinguishing_trace M dist_fun (List.product (inputs_as_list M) (outputs_as_list M)) (after t \\<alpha>) (after_initial M \\<alpha>) (after t \\<beta>) (after_initial M \\<beta>)))\"\n\n  have \"set (insert empty w) \\<subseteq> set ((add_cheapest_distinguishing_trace dist_fun c M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t)\"\n    using combine_set[of \"insert empty w\"] w_def\n    unfolding add_cheapest_distinguishing_trace.simps Let_def \n    by (cases c; fastforce)\n  moreover have \"w \\<in> set (insert empty w)\"\n    unfolding insert_set by auto\n  ultimately have \"w \\<in> set ((add_cheapest_distinguishing_trace dist_fun c M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t) \\<union> (set (after t \\<alpha>) \\<inter> set (after t \\<beta>))\"\n    by blast\n  moreover have \"distinguishes M (after_initial M \\<alpha>) (after_initial M \\<beta>) w\"\n    using find_cheapest_distinguishing_trace_is_distinguishing_trace[OF assms(1,2) after_is_state[OF assms(1,3)] after_is_state[OF assms(1,4)] assms(5,6)]\n    unfolding w_def \n    by blast\n  ultimately show ?thesis \n    by blast \nqed\n\nlemma add_cheapest_distinguishing_trace_finite : \n  \"finite_tree ((add_cheapest_distinguishing_trace dist_fun c M) ((\\<alpha>,after_initial M \\<alpha>),(\\<beta>,after_initial M \\<beta>)) t)\"\nproof -\n\n  define w where w: \"w = (fst (find_cheapest_distinguishing_trace M dist_fun (List.product (inputs_as_list M) (outputs_as_list M)) (after t \\<alpha>) (after_initial M \\<alpha>) (after t \\<beta>) (after_initial M \\<beta>)))\"\n  define T where T: \"T = insert empty w\"\n  define T1 where T1: \"T1 = complete_inputs_to_tree M (after_initial M \\<alpha>) (outputs_as_list M) (map fst w)\"\n  define T2 where T2: \"T2 = complete_inputs_to_tree M (after_initial M \\<beta>) (outputs_as_list M) (map fst w)\"\n\n  have \"finite_tree T\"\n    using insert_finite_tree[OF empty_finite_tree]\n    unfolding T by auto\n  moreover have \"finite_tree (Prefix_Tree.combine T (Prefix_Tree.combine T1 T2))\"\n    using combine_finite_tree[OF \\<open>finite_tree T\\<close> combine_finite_tree[OF complete_inputs_to_tree_finite_tree complete_inputs_to_tree_finite_tree]]\n    unfolding T1 T2\n    by auto\n  ultimately show ?thesis\n    unfolding add_cheapest_distinguishing_trace.simps w T T1 T2 Let_def\n    by presburger\nqed\n\n\n\n\n\nsubsubsection \\<open>Implementation\\<close>\n\ndefinition h_method_via_pair_framework :: \"('a::linorder,'b::linorder,'c::linorder) fsm \\<Rightarrow> nat \\<Rightarrow> ('b\\<times>'c) prefix_tree\" where\n  \"h_method_via_pair_framework M m = pair_framework_h_components M m (add_distinguishing_sequence_if_required (get_distinguishing_sequence_from_ofsm_tables M))\"\n\nlemma h_method_via_pair_framework_completeness_and_finiteness :\n  assumes \"observable M\"\n  and     \"observable I\"\n  and     \"minimal M\"\n  and     \"size I \\<le> m\"\n  and     \"m \\<ge> size_r M\"\n  and     \"inputs I = inputs M\"\n  and     \"outputs I = outputs M\"\nshows \"(L M = L I) \\<longleftrightarrow> (L M \\<inter> set (h_method_via_pair_framework M m) = L I \\<inter> set (h_method_via_pair_framework M m))\"\nand   \"finite_tree (h_method_via_pair_framework M m)\"\n  using pair_framework_h_components_completeness_and_finiteness[OF assms(1,2,3,5,4,6,7), where get_separating_traces=\"(add_distinguishing_sequence_if_required (get_distinguishing_sequence_from_ofsm_tables M))\", OF add_distinguishing_sequence_if_required_distinguishes[OF assms(1,3), where dist_fun=\"(get_distinguishing_sequence_from_ofsm_tables M)\"] add_distinguishing_sequence_if_required_finite[where dist_fun=\"(get_distinguishing_sequence_from_ofsm_tables M)\"] ]\n  using get_distinguishing_sequence_from_ofsm_tables_distinguishes[OF assms(1,3)]\n  unfolding h_method_via_pair_framework_def[symmetric]\n  by blast+\n\ndefinition h_method_via_pair_framework_2 :: \"('a::linorder,'b::linorder,'c::linorder) fsm \\<Rightarrow> nat \\<Rightarrow> bool \\<Rightarrow> ('b\\<times>'c) prefix_tree\" where\n  \"h_method_via_pair_framework_2 M m c = pair_framework_h_components M m (add_distinguishing_sequence_and_complete_if_required (get_distinguishing_sequence_from_ofsm_tables M) c)\"\n\nlemma h_method_via_pair_framework_2_completeness_and_finiteness :\n  assumes \"observable M\"\n  and     \"observable I\"\n  and     \"minimal M\"\n  and     \"size I \\<le> m\"\n  and     \"m \\<ge> size_r M\"\n  and     \"inputs I = inputs M\"\n  and     \"outputs I = outputs M\"\nshows \"(L M = L I) \\<longleftrightarrow> (L M \\<inter> set (h_method_via_pair_framework_2 M m c) = L I \\<inter> set (h_method_via_pair_framework_2 M m c))\"\nand   \"finite_tree (h_method_via_pair_framework_2 M m c)\"\n  using pair_framework_h_components_completeness_and_finiteness[OF assms(1,2,3,5,4,6,7), where get_separating_traces=\"(add_distinguishing_sequence_and_complete_if_required (get_distinguishing_sequence_from_ofsm_tables M) c)\", OF add_distinguishing_sequence_and_complete_if_required_distinguishes[OF assms(1,3), where dist_fun=\"(get_distinguishing_sequence_from_ofsm_tables M)\"] add_distinguishing_sequence_and_complete_if_required_finite[where dist_fun=\"(get_distinguishing_sequence_from_ofsm_tables M)\"] ]\n  using get_distinguishing_sequence_from_ofsm_tables_distinguishes[OF assms(1,3)]\n  unfolding h_method_via_pair_framework_2_def[symmetric]\n  by blast+\n\ndefinition h_method_via_pair_framework_3 :: \"('a::linorder,'b::linorder,'c::linorder) fsm \\<Rightarrow> nat \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> ('b\\<times>'c) prefix_tree\" where\n  \"h_method_via_pair_framework_3 M m c1 c2 = pair_framework_h_components_2 M m (add_cheapest_distinguishing_trace (get_distinguishing_sequence_from_ofsm_tables M) c2) c1\"\n\nlemma h_method_via_pair_framework_3_completeness_and_finiteness :\n  assumes \"observable M\"\n  and     \"observable I\"\n  and     \"minimal M\"\n  and     \"size I \\<le> m\"\n  and     \"m \\<ge> size_r M\"\n  and     \"inputs I = inputs M\"\n  and     \"outputs I = outputs M\"\nshows \"(L M = L I) \\<longleftrightarrow> (L M \\<inter> set (h_method_via_pair_framework_3 M m c1 c2) = L I \\<inter> set (h_method_via_pair_framework_3 M m c1 c2))\"\nand   \"finite_tree (h_method_via_pair_framework_3 M m c1 c2)\"\n  using pair_framework_h_components_2_completeness_and_finiteness[OF assms(1,2,3,5,4,6,7), where get_separating_traces=\"(add_cheapest_distinguishing_trace (get_distinguishing_sequence_from_ofsm_tables M) c2)\", OF add_cheapest_distinguishing_trace_distinguishes[OF assms(1,3), where dist_fun=\"(get_distinguishing_sequence_from_ofsm_tables M)\"] add_cheapest_distinguishing_trace_finite[where dist_fun=\"(get_distinguishing_sequence_from_ofsm_tables M)\"] ]\n  using get_distinguishing_sequence_from_ofsm_tables_distinguishes[OF assms(1,3)]\n  unfolding h_method_via_pair_framework_3_def[symmetric]\n  by blast+\n\n\ndefinition h_method_via_pair_framework_lists :: \"('a::linorder,'b::linorder,'c::linorder) fsm \\<Rightarrow> nat \\<Rightarrow> (('b\\<times>'c) \\<times> bool) list list\" where\n  \"h_method_via_pair_framework_lists M m = sorted_list_of_maximal_sequences_in_tree (test_suite_from_io_tree M (initial M) (h_method_via_pair_framework M m))\"\n\nlemma h_method_implementation_lists_completeness :\n  assumes \"observable M\"\n  and     \"observable I\"\n  and     \"minimal M\"\n  and     \"size I \\<le> m\"\n  and     \"m \\<ge> size_r M\"\n  and     \"inputs I = inputs M\"\n  and     \"outputs I = outputs M\"\nshows \"(L M = L I) \\<longleftrightarrow> list_all (passes_test_case I (initial I)) (h_method_via_pair_framework_lists M m)\"\nunfolding h_method_via_pair_framework_lists_def\n            h_method_via_pair_framework_completeness_and_finiteness(1)[OF assms]\n            passes_test_cases_from_io_tree[OF assms(1,2) fsm_initial fsm_initial h_method_via_pair_framework_completeness_and_finiteness(2)[OF assms]]\n  by blast\n\nsubsubsection \\<open>Code Equations\\<close>\n\n(* to avoid repeated computation of the same OFSM-tables by get_distinguishing_sequence_from_ofsm_tables,\n   we pre-compute all distinguishing traces *)\nlemma h_method_via_pair_framework_code[code] :\n  \"h_method_via_pair_framework M m = (let \n    tables = (compute_ofsm_tables M (size M - 1));\n    distMap = mapping_of (map (\\<lambda> (q1,q2) . ((q1,q2), get_distinguishing_sequence_from_ofsm_tables_with_provided_tables tables M q1 q2))\n                      (filter (\\<lambda> qq . fst qq \\<noteq> snd qq) (List.product (states_as_list M) (states_as_list M))));\n    distHelper = (\\<lambda> q1 q2 . if q1 \\<in> states M \\<and> q2 \\<in> states M \\<and> q1 \\<noteq> q2 then the (Mapping.lookup distMap (q1,q2)) else get_distinguishing_sequence_from_ofsm_tables M q1 q2);\n    distFun = add_distinguishing_sequence_if_required distHelper \n  in pair_framework_h_components M m distFun)\"\n  unfolding h_method_via_pair_framework_def\n  apply (subst get_distinguishing_sequence_from_ofsm_tables_precomputed[of M])\n  unfolding Let_def\n  by presburger\n\nlemma h_method_via_pair_framework_2_code[code] :\n  \"h_method_via_pair_framework_2 M m c = (let \n    tables = (compute_ofsm_tables M (size M - 1));\n    distMap = mapping_of (map (\\<lambda> (q1,q2) . ((q1,q2), get_distinguishing_sequence_from_ofsm_tables_with_provided_tables tables M q1 q2))\n                      (filter (\\<lambda> qq . fst qq \\<noteq> snd qq) (List.product (states_as_list M) (states_as_list M))));\n    distHelper = (\\<lambda> q1 q2 . if q1 \\<in> states M \\<and> q2 \\<in> states M \\<and> q1 \\<noteq> q2 then the (Mapping.lookup distMap (q1,q2)) else get_distinguishing_sequence_from_ofsm_tables M q1 q2);\n    distFun = add_distinguishing_sequence_and_complete_if_required distHelper c\n  in pair_framework_h_components M m distFun)\"\n  unfolding h_method_via_pair_framework_2_def\n  apply (subst get_distinguishing_sequence_from_ofsm_tables_precomputed[of M])\n  unfolding Let_def\n  by presburger\n\nlemma h_method_via_pair_framework_3_code[code] :\n  \"h_method_via_pair_framework_3 M m c1 c2 = (let \n    tables = (compute_ofsm_tables M (size M - 1));\n    distMap = mapping_of (map (\\<lambda> (q1,q2) . ((q1,q2), get_distinguishing_sequence_from_ofsm_tables_with_provided_tables tables M q1 q2))\n                      (filter (\\<lambda> qq . fst qq \\<noteq> snd qq) (List.product (states_as_list M) (states_as_list M))));\n    distHelper = (\\<lambda> q1 q2 . if q1 \\<in> states M \\<and> q2 \\<in> states M \\<and> q1 \\<noteq> q2 then the (Mapping.lookup distMap (q1,q2)) else get_distinguishing_sequence_from_ofsm_tables M q1 q2);\n    distFun = add_cheapest_distinguishing_trace distHelper c2 \n  in pair_framework_h_components_2 M m distFun c1)\"\n  unfolding h_method_via_pair_framework_3_def \n  apply (subst get_distinguishing_sequence_from_ofsm_tables_precomputed[of M])\n  unfolding Let_def\n  by presburger\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/FSM_Tests/EquivalenceTesting/H_Method_Implementations.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593171945416, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.33307700251479283}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * Contributions by:\n *   2012 Lars Noschinski <noschinl@in.tum.de>\n *     Option monad while loop formalisation.\n *)\n\ntheory OptionMonad\nimports \"../Lib\" (* FIXME: reduce dependencies *)\nbegin\n\ntype_synonym ('s,'a) lookup = \"'s \\<Rightarrow> 'a option\"\n\ntext {* Similar to map_option but the second function returns option as well *}\ndefinition\n  opt_map :: \"('s,'a) lookup \\<Rightarrow> ('a \\<Rightarrow> 'b option) \\<Rightarrow> ('s,'b) lookup\" (infixl \"|>\" 54)\nwhere\n  \"f |> g \\<equiv> \\<lambda>s. case f s of None \\<Rightarrow> None | Some x \\<Rightarrow> g x\"\n\nlemma opt_map_cong [fundef_cong]:\n  \"\\<lbrakk> f = f'; \\<And>v s. f s = Some v \\<Longrightarrow> g v = g' v\\<rbrakk> \\<Longrightarrow> f |> g = f' |> g'\"\n  by (rule ext) (simp add: opt_map_def split: option.splits)\n\nlemma in_opt_map_eq:\n  \"((f |> g) s = Some v) = (\\<exists>v'. f s = Some v' \\<and> g v' = Some v)\"\n  by (simp add: opt_map_def split: option.splits)\n\nlemma opt_mapE:\n  \"\\<lbrakk> (f |> g) s = Some v; \\<And>v'. \\<lbrakk>f s = Some v'; g v' = Some v \\<rbrakk> \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp: in_opt_map_eq)\n\n\ndefinition\n  obind :: \"('s,'a) lookup \\<Rightarrow> ('a \\<Rightarrow> ('s,'b) lookup) \\<Rightarrow> ('s,'b) lookup\" (infixl \"|>>\" 53)\nwhere\n  \"f |>> g \\<equiv> \\<lambda>s. case f s of None \\<Rightarrow> None | Some x \\<Rightarrow> g x s\"\n\ndefinition\n  \"ofail = K None\"\n\ndefinition\n  \"oreturn = K o Some\"\n\ndefinition\n  \"oassert P \\<equiv> if P then oreturn () else ofail\"\n\ntext {*\n  If the result can be an exception.\n  Corresponding bindE would be analogous to lifting in NonDetMonad.\n*}\n\ndefinition\n  \"oreturnOk x = K (Some (Inr x))\"\n\ndefinition\n  \"othrow e = K (Some (Inl e))\"\n\ndefinition\n  \"oguard G \\<equiv> (\\<lambda>s. if G s then Some () else None)\"\n\ndefinition\n  \"ocondition c L R \\<equiv> (\\<lambda>s. if c s then L s else R s)\"\n\ndefinition\n  \"oskip \\<equiv> oreturn ()\"\n\ntext {* Monad laws *}\nlemma oreturn_bind [simp]: \"(oreturn x |>> f) = f x\"\n  by (auto simp add: oreturn_def obind_def K_def)\n\nlemma obind_return [simp]: \"(m |>> oreturn) = m\"\n  by (auto simp add: oreturn_def obind_def K_def split: option.splits)\n\nlemma obind_assoc:\n  \"(m |>> f) |>> g  =  m |>> (\\<lambda>x. f x |>> g)\"\n  by (auto simp add: oreturn_def obind_def K_def split: option.splits)\n\n\ntext {* Binding fail *}\n\nlemma obind_fail [simp]:\n  \"f |>> (\\<lambda>_. ofail) = ofail\"\n  by (auto simp add: ofail_def obind_def K_def split: option.splits)\n\nlemma ofail_bind [simp]:\n  \"ofail |>> m = ofail\"\n  by (auto simp add: ofail_def obind_def K_def split: option.splits)\n\n\n\ntext {* Function package setup *}\nlemma opt_bind_cong [fundef_cong]:\n  \"\\<lbrakk> f = f'; \\<And>v s. f' s = Some v \\<Longrightarrow> g v s = g' v s \\<rbrakk> \\<Longrightarrow> f |>> g = f' |>> g'\"\n  by (rule ext) (simp add: obind_def split: option.splits)\n\nlemma opt_bind_cong_apply [fundef_cong]:\n  \"\\<lbrakk> f s = f' s; \\<And>v. f' s = Some v \\<Longrightarrow> g v s = g' v s \\<rbrakk> \\<Longrightarrow> (f |>> g) s = (f' |>> g') s\"\n  by (simp add: obind_def split: option.splits)\n\nlemma oassert_bind_cong [fundef_cong]:\n  \"\\<lbrakk> P = P'; P' \\<Longrightarrow> m = m' \\<rbrakk> \\<Longrightarrow> oassert P |>> m = oassert P' |>> m'\"\n  by (auto simp: oassert_def)\n\nlemma oassert_bind_cong_apply [fundef_cong]:\n  \"\\<lbrakk> P = P'; P' \\<Longrightarrow> m () s = m' () s \\<rbrakk> \\<Longrightarrow> (oassert P |>> m) s = (oassert P' |>> m') s\"\n  by (auto simp: oassert_def)\n\nlemma oreturn_bind_cong [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' = m' x' \\<rbrakk> \\<Longrightarrow> oreturn x |>> m = oreturn x' |>> m'\"\n  by simp\n\nlemma oreturn_bind_cong_apply [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' s = m' x' s \\<rbrakk> \\<Longrightarrow> (oreturn x |>> m) s = (oreturn x' |>> m') s\"\n  by simp\n\nlemma oreturn_bind_cong2 [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' = m' x' \\<rbrakk> \\<Longrightarrow> (oreturn $ x) |>> m = (oreturn $ x') |>> m'\"\n  by simp\n\nlemma oreturn_bind_cong2_apply [fundef_cong]:\n  \"\\<lbrakk> x = x'; m x' s = m' x' s \\<rbrakk> \\<Longrightarrow> ((oreturn $ x) |>> m) s = ((oreturn $ x') |>> m') s\"\n  by simp\n\nlemma ocondition_cong [fundef_cong]:\n\"\\<lbrakk>c = c'; \\<And>s. c' s \\<Longrightarrow> l s = l' s; \\<And>s. \\<not>c' s \\<Longrightarrow> r s = r' s\\<rbrakk>\n  \\<Longrightarrow> ocondition c l r = ocondition c' l' r'\"\n  by (auto simp: ocondition_def)\n\n\ntext {* Decomposition *}\n\nlemma ocondition_K_true [simp]:\n  \"ocondition (\\<lambda>_. True) T F = T\"\n  by (simp add: ocondition_def)\n\nlemma ocondition_K_false [simp]:\n  \"ocondition (\\<lambda>_. False) T F = F\"\n  by (simp add: ocondition_def)\n\nlemma ocondition_False:\n    \"\\<lbrakk> \\<And>s. \\<not> P s \\<rbrakk> \\<Longrightarrow> ocondition P L R = R\"\n  by (rule ext, clarsimp simp: ocondition_def)\n\nlemma ocondition_True:\n    \"\\<lbrakk> \\<And>s. P s \\<rbrakk> \\<Longrightarrow> ocondition P L R = L\"\n  by (rule ext, clarsimp simp: ocondition_def)\n\nlemma in_oreturn [simp]:\n  \"(oreturn x s = Some v) = (v = x)\"\n  by (auto simp: oreturn_def K_def)\n\nlemma oreturnE:\n  \"\\<lbrakk>oreturn x s = Some v; v = x \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by simp\n\nlemma in_ofail [simp]:\n  \"ofail s \\<noteq> Some v\"\n  by (auto simp: ofail_def K_def)\n\nlemma ofailE:\n  \"ofail s = Some v \\<Longrightarrow> P\"\n  by simp\n\nlemma in_oassert_eq [simp]:\n  \"(oassert P s = Some v) = P\"\n  by (simp add: oassert_def)\n\nlemma oassertE:\n  \"\\<lbrakk> oassert P s = Some v; P \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\n  by simp\n\nlemma in_obind_eq:\n  \"((f |>> g) s = Some v) = (\\<exists>v'. f s = Some v' \\<and> g v' s = Some v)\"\n  by (simp add: obind_def split: option.splits)\n\nlemma obindE:\n  \"\\<lbrakk> (f |>> g) s = Some v;\n     \\<And>v'. \\<lbrakk>f s = Some v'; g v' s = Some v\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp: in_obind_eq)\n\nlemma in_othrow_eq [simp]:\n  \"(othrow e s = Some v) = (v = Inl e)\"\n  by (auto simp: othrow_def K_def)\n\nlemma othrowE:\n  \"\\<lbrakk>othrow e s = Some v; v = Inl e \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by simp\n\nlemma in_oreturnOk_eq [simp]:\n  \"(oreturnOk x s = Some v) = (v = Inr x)\"\n  by (auto simp: oreturnOk_def K_def)\n\nlemma oreturnOkE:\n  \"\\<lbrakk>oreturnOk x s = Some v; v = Inr x \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by simp\n\nlemmas omonadE [elim!] =\n  opt_mapE obindE oreturnE ofailE othrowE oreturnOkE oassertE\n\nsection {* \"While\" loops over option monad. *}\n\ntext {*\n  This is an inductive definition of a while loop over the plain option monad\n  (without passing through a state)\n*}\n\ninductive_set\n  option_while' :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'a option) \\<Rightarrow> 'a option rel\"\n  for C B\nwhere\n    final: \"\\<not> C r \\<Longrightarrow> (Some r, Some r) \\<in> option_while' C B\"\n  | fail: \"\\<lbrakk> C r; B r = None \\<rbrakk> \\<Longrightarrow> (Some r, None) \\<in> option_while' C B\"\n  | step: \"\\<lbrakk> C r;  B r = Some r'; (Some r', sr'') \\<in> option_while' C B \\<rbrakk>\n           \\<Longrightarrow> (Some r, sr'') \\<in> option_while' C B\"\n\ndefinition\n  \"option_while C B r \\<equiv>\n    (if (\\<exists>s. (Some r, s) \\<in> option_while' C B) then\n      (THE s. (Some r, s) \\<in> option_while' C B) else None)\"\n\nlemma option_while'_inj:\n  assumes \"(s,s') \\<in> option_while' C B\" \"(s, s'') \\<in> option_while' C B\"\n  shows \"s' = s''\"\n  using assms by (induct rule: option_while'.induct) (auto elim: option_while'.cases)\n\n\n\nlemma option_while'_THE:\n  assumes \"(Some r, sr') \\<in> option_while' C B\"\n  shows \"(THE s. (Some r, s) \\<in> option_while' C B) = sr'\"\n  using assms by (blast dest: option_while'_inj)\n\nlemma option_while_simps:\n  \"\\<not> C s \\<Longrightarrow> option_while C B s = Some s\"\n  \"C s \\<Longrightarrow> B s = None \\<Longrightarrow> option_while C B s = None\"\n  \"C s \\<Longrightarrow> B s = Some s' \\<Longrightarrow> option_while C B s = option_while C B s'\"\n  \"(Some s, ss') \\<in> option_while' C B \\<Longrightarrow> option_while C B s = ss'\"\n  using option_while'_inj_step[of C s B s']\n  by (auto simp: option_while_def option_while'_THE\n      intro: option_while'.intros\n      dest: option_while'_inj\n      elim: option_while'.cases)\n\nlemma option_while_rule:\n  assumes \"option_while C B s = Some s'\"\n  assumes \"I s\"\n  assumes istep: \"\\<And>s s'. C s \\<Longrightarrow> I s \\<Longrightarrow> B s = Some s' \\<Longrightarrow> I s'\"\n  shows \"I s' \\<and> \\<not> C s'\"\nproof -\n  { fix ss ss' assume \"(ss, ss') \\<in> option_while' C B\" \"ss = Some s\" \"ss' = Some s'\"\n    then have ?thesis using `I s`\n      by (induct arbitrary: s) (auto intro: istep) }\n  then show ?thesis using assms(1)\n    by (auto simp: option_while_def option_while'_THE split: if_split_asm)\nqed\n\nlemma option_while'_term:\n  assumes \"I r\"\n  assumes \"wf M\"\n  assumes step_less: \"\\<And>r r'. \\<lbrakk>I r; C r; B r = Some r'\\<rbrakk> \\<Longrightarrow> (r',r) \\<in> M\"\n  assumes step_I: \"\\<And>r r'. \\<lbrakk>I r; C r; B r = Some r'\\<rbrakk> \\<Longrightarrow> I r'\"\n  obtains sr' where \"(Some r, sr') \\<in> option_while' C B\"\n  apply atomize_elim\n  using assms(2,1)\nproof induct\n  case (less r)\n  show ?case\n  proof (cases \"C r\" \"B r\" rule: bool.exhaust[case_product option.exhaust])\n    case (True_Some r')\n    then have \"(r',r) \\<in> M\" \"I r'\"\n      by (auto intro: less step_less step_I)\n    then obtain sr' where \"(Some r', sr') \\<in> option_while' C B\"\n      by atomize_elim (rule less)\n    then have \"(Some r, sr') \\<in> option_while' C B\"\n      using True_Some by (auto intro: option_while'.intros)\n    then show ?thesis ..\n  qed (auto intro: option_while'.intros)\nqed\n\nlemma option_while_rule':\n  assumes \"option_while C B s = ss'\"\n  assumes \"wf M\"\n  assumes \"I (Some s)\"\n  assumes less: \"\\<And>s s'. C s \\<Longrightarrow> I (Some s) \\<Longrightarrow> B s = Some s' \\<Longrightarrow> (s', s) \\<in> M\"\n  assumes step: \"\\<And>s s'. C s \\<Longrightarrow> I (Some s) \\<Longrightarrow> B s = Some s' \\<Longrightarrow> I (Some s')\"\n  assumes final: \"\\<And>s. C s \\<Longrightarrow> I (Some s) \\<Longrightarrow> B s = None \\<Longrightarrow> I None\"\n  shows \"I ss' \\<and> (case ss' of Some s' \\<Rightarrow> \\<not> C s' | _ \\<Rightarrow> True)\"\nproof -\n  def ss \\<equiv> \"Some s\"\n  obtain ss1' where \"(Some s, ss1') \\<in> option_while' C B\"\n    using assms(3,2,4,5) by (rule option_while'_term)\n  then have *: \"(ss, ss') \\<in> option_while' C B\" using `option_while C B s = ss'`\n    by (auto simp: option_while_simps ss_def)\n  show ?thesis\n  proof (cases ss')\n    case (Some s') with * ss_def show ?thesis using `I _`\n      by (induct arbitrary:s) (auto intro: step)\n  next\n    case None with * ss_def show ?thesis using `I _`\n      by (induct arbitrary:s) (auto intro: step final)\n  qed\nqed\n\nsection {* Lift @{term option_while} to the @{typ \"('a,'s) lookup\"} monad  *}\n\ndefinition\n  owhile :: \"('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> ('s,'a) lookup) \\<Rightarrow> 'a \\<Rightarrow> ('s,'a) lookup\"\nwhere\n \"owhile c b a \\<equiv> \\<lambda>s. option_while (\\<lambda>a. c a s) (\\<lambda>a. b a s) a\"\n\nlemma owhile_unroll:\n  \"owhile C B r = ocondition (C r) (B r |>> owhile C B) (oreturn r)\"\n  by (auto simp: ocondition_def obind_def oreturn_def owhile_def\n           option_while_simps K_def split: option.split)\n\ntext {* rule for terminating loops *}\n\nlemma owhile_rule:\n  assumes \"I r s\"\n  assumes \"wf M\"\n  assumes less: \"\\<And>r r'. \\<lbrakk>I r s; C r s; B r s = Some r'\\<rbrakk> \\<Longrightarrow> (r',r) \\<in> M\"\n  assumes step: \"\\<And>r r'. \\<lbrakk>I r s; C r s; B r s = Some r'\\<rbrakk> \\<Longrightarrow> I r' s\"\n  assumes fail: \"\\<And>r r'. \\<lbrakk>I r s; C r s; B r s = None\\<rbrakk> \\<Longrightarrow> Q None\"\n  assumes final: \"\\<And>r. \\<lbrakk>I r s; \\<not>C r s\\<rbrakk> \\<Longrightarrow> Q (Some r)\"\n  shows \"Q (owhile C B r s)\"\nproof -\n  let ?rs' = \"owhile C B r s\"\n  have \"(case ?rs' of Some r \\<Rightarrow> I r s | _ \\<Rightarrow> Q None)\n      \\<and> (case ?rs' of Some r' \\<Rightarrow> \\<not> C r' s | _ \\<Rightarrow> True)\"\n    by (rule option_while_rule'[where B=\"\\<lambda>r. B r s\" and s=r, OF _ `wf _`])\n       (auto simp: owhile_def intro: assms)\n  then show ?thesis by (auto intro: final split: option.split_asm)\nqed\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/lib/Monad_WP/OptionMonad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5964331462646255, "lm_q1q2_score": 0.3330047258759191}}
{"text": "theory GTT_Compose\n  imports GTT\nbegin\n\nsubsection \\<open>GTT closure under composition\\<close>\n\ninductive_set \\<Delta>\\<^sub>\\<epsilon>_set :: \"('q, 'f) ta \\<Rightarrow> ('q, 'f) ta \\<Rightarrow> ('q \\<times> 'q) set\" for \\<A> \\<B> where\n  \\<Delta>\\<^sub>\\<epsilon>_set_cong: \"TA_rule f ps p |\\<in>| rules \\<A> \\<Longrightarrow> TA_rule f qs q |\\<in>| rules \\<B> \\<Longrightarrow> length ps = length qs \\<Longrightarrow>\n   (\\<And>i. i < length qs \\<Longrightarrow> (ps ! i, qs ! i) \\<in> \\<Delta>\\<^sub>\\<epsilon>_set \\<A> \\<B>) \\<Longrightarrow> (p, q) \\<in> \\<Delta>\\<^sub>\\<epsilon>_set \\<A> \\<B>\"\n| \\<Delta>\\<^sub>\\<epsilon>_set_eps1: \"(p, p') |\\<in>| eps \\<A> \\<Longrightarrow> (p, q) \\<in> \\<Delta>\\<^sub>\\<epsilon>_set \\<A> \\<B> \\<Longrightarrow> (p', q) \\<in> \\<Delta>\\<^sub>\\<epsilon>_set \\<A> \\<B>\"\n| \\<Delta>\\<^sub>\\<epsilon>_set_eps2: \"(q, q') |\\<in>| eps \\<B> \\<Longrightarrow> (p, q) \\<in> \\<Delta>\\<^sub>\\<epsilon>_set \\<A> \\<B> \\<Longrightarrow> (p, q') \\<in> \\<Delta>\\<^sub>\\<epsilon>_set \\<A> \\<B>\"\n\nlemma \\<Delta>\\<^sub>\\<epsilon>_states: \"\\<Delta>\\<^sub>\\<epsilon>_set \\<A> \\<B> \\<subseteq> fset (\\<Q> \\<A> |\\<times>| \\<Q> \\<B>)\"\nproof -\n  {fix p q assume \"(p, q) \\<in> \\<Delta>\\<^sub>\\<epsilon>_set \\<A> \\<B>\" then have \"(p, q) \\<in> fset (\\<Q> \\<A> |\\<times>| \\<Q> \\<B>)\"\n      by (induct) (auto dest: rule_statesD eps_statesD simp flip: fmember_iff_member_fset)}\n  then show ?thesis by auto\nqed\n\nlemma finite_\\<Delta>\\<^sub>\\<epsilon> [simp]: \"finite (\\<Delta>\\<^sub>\\<epsilon>_set \\<A> \\<B>)\"\n  using finite_subset[OF \\<Delta>\\<^sub>\\<epsilon>_states]\n  by simp\n\ncontext\nincludes fset.lifting\nbegin\nlift_definition \\<Delta>\\<^sub>\\<epsilon> :: \"('q, 'f) ta \\<Rightarrow> ('q, 'f) ta \\<Rightarrow> ('q \\<times> 'q) fset\" is \\<Delta>\\<^sub>\\<epsilon>_set by simp\nlemmas \\<Delta>\\<^sub>\\<epsilon>_cong = \\<Delta>\\<^sub>\\<epsilon>_set_cong [Transfer.transferred]\nlemmas \\<Delta>\\<^sub>\\<epsilon>_eps1 = \\<Delta>\\<^sub>\\<epsilon>_set_eps1 [Transfer.transferred]\nlemmas \\<Delta>\\<^sub>\\<epsilon>_eps2 = \\<Delta>\\<^sub>\\<epsilon>_set_eps2 [Transfer.transferred]\nlemmas \\<Delta>\\<^sub>\\<epsilon>_cases = \\<Delta>\\<^sub>\\<epsilon>_set.cases[Transfer.transferred]\nlemmas \\<Delta>\\<^sub>\\<epsilon>_induct [consumes 1, case_names \\<Delta>\\<^sub>\\<epsilon>_cong \\<Delta>\\<^sub>\\<epsilon>_eps1  \\<Delta>\\<^sub>\\<epsilon>_eps2] = \\<Delta>\\<^sub>\\<epsilon>_set.induct[Transfer.transferred]\nlemmas \\<Delta>\\<^sub>\\<epsilon>_intros = \\<Delta>\\<^sub>\\<epsilon>_set.intros[Transfer.transferred]\nlemmas \\<Delta>\\<^sub>\\<epsilon>_simps = \\<Delta>\\<^sub>\\<epsilon>_set.simps[Transfer.transferred]\nend\n\nlemma finite_alt_def [simp]:\n  \"finite {(\\<alpha>, \\<beta>). (\\<exists>t. ground t \\<and> \\<alpha> |\\<in>| ta_der \\<A> t \\<and> \\<beta> |\\<in>| ta_der \\<B> t)}\" (is \"finite ?S\")\n  by (auto dest: ground_ta_der_states[THEN fsubsetD] simp flip: fmember_iff_member_fset\n           intro!: finite_subset[of ?S \"fset (\\<Q> \\<A> |\\<times>| \\<Q> \\<B>)\"])\n\nlemma \\<Delta>\\<^sub>\\<epsilon>_def':\n  \"\\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B> = {|(\\<alpha>, \\<beta>). (\\<exists>t. ground t \\<and> \\<alpha> |\\<in>| ta_der \\<A> t \\<and> \\<beta> |\\<in>| ta_der \\<B> t)|}\"\nproof (intro fset_eqI iffI, goal_cases lr rl)\n  case (lr x) obtain p q where x [simp]: \"x = (p, q)\" by (cases x)\n  have \"\\<exists>t. ground t \\<and> p |\\<in>| ta_der \\<A> t \\<and> q |\\<in>| ta_der \\<B> t\" using lr unfolding x\n  proof (induct rule: \\<Delta>\\<^sub>\\<epsilon>_induct)\n    case (\\<Delta>\\<^sub>\\<epsilon>_cong f ps p qs q)\n    obtain ts where ts: \"ground (ts i) \\<and> ps ! i |\\<in>| ta_der \\<A> (ts i) \\<and> qs ! i |\\<in>| ta_der \\<B> (ts i)\"\n      if \"i < length qs\" for i using \\<Delta>\\<^sub>\\<epsilon>_cong(5) by metis\n    then show ?case using \\<Delta>\\<^sub>\\<epsilon>_cong(1-3)\n      by (auto intro!: exI[of _ \"Fun f (map ts [0..<length qs])\"]) blast+\n  qed (meson ta_der_eps)+\n  then show ?case by auto\nnext\n  case (rl x) obtain p q where x [simp]: \"x = (p, q)\" by (cases x)\n  obtain t where \"ground t\" \"p |\\<in>| ta_der \\<A> t\" \"q |\\<in>| ta_der \\<B> t\" using rl by auto\n  then show ?case unfolding x\n  proof (induct t arbitrary: p q)\n    case (Fun f ts)\n    obtain p' ps where p': \"TA_rule f ps p' |\\<in>| rules \\<A>\" \"p' = p \\<or> (p', p) |\\<in>| (eps \\<A>)|\\<^sup>+|\" \"length ps = length ts\"\n      \"\\<And>i. i < length ts \\<Longrightarrow> ps ! i |\\<in>| ta_der \\<A> (ts ! i)\" using Fun(3) by auto\n    obtain q' qs where q': \"f qs \\<rightarrow> q' |\\<in>| rules \\<B>\" \"q' = q \\<or> (q', q) |\\<in>| (eps \\<B>)|\\<^sup>+|\" \"length qs = length ts\"\n      \"\\<And>i. i < length ts \\<Longrightarrow> qs ! i |\\<in>| ta_der \\<B> (ts ! i)\" using Fun(4) by auto\n    have st: \"(p', q') |\\<in>| \\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B>\"\n      using Fun(1)[OF nth_mem _ p'(4) q'(4)] Fun(2) p'(3) q'(3)\n      by (intro \\<Delta>\\<^sub>\\<epsilon>_cong[OF p'(1) q'(1)]) auto\n    {assume \"(p', p) |\\<in>| (eps \\<A>)|\\<^sup>+|\" then have \"(p, q') |\\<in>| \\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B>\" using st\n        by (induct rule: ftrancl_induct) (auto intro: \\<Delta>\\<^sub>\\<epsilon>_eps1)}\n    from st this p'(2) have st: \"(p, q') |\\<in>| \\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B>\" by auto\n   {assume \"(q', q) |\\<in>| (eps \\<B>)|\\<^sup>+|\" then have \"(p, q) |\\<in>| \\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B>\" using st\n        by (induct rule: ftrancl_induct) (auto intro: \\<Delta>\\<^sub>\\<epsilon>_eps2)}\n    from st this q'(2) show \"(p, q) |\\<in>| \\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B>\" by auto\n  qed auto\nqed\n\nlemma \\<Delta>\\<^sub>\\<epsilon>_fmember:\n  \"(p, q) |\\<in>| \\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B> \\<longleftrightarrow> (\\<exists>t. ground t \\<and> p |\\<in>| ta_der \\<A> t \\<and> q |\\<in>| ta_der \\<B> t)\"\n  by (auto simp: \\<Delta>\\<^sub>\\<epsilon>_def')\n\ndefinition GTT_comp :: \"('q, 'f) gtt \\<Rightarrow> ('q, 'f) gtt \\<Rightarrow> ('q, 'f) gtt\" where\n  \"GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2 =\n    (let \\<Delta> = \\<Delta>\\<^sub>\\<epsilon> (snd \\<G>\\<^sub>1) (fst \\<G>\\<^sub>2) in\n    (TA (gtt_rules (fst \\<G>\\<^sub>1, fst \\<G>\\<^sub>2)) (eps (fst \\<G>\\<^sub>1) |\\<union>| eps (fst \\<G>\\<^sub>2) |\\<union>| \\<Delta>),\n     TA (gtt_rules (snd \\<G>\\<^sub>1, snd \\<G>\\<^sub>2)) (eps (snd \\<G>\\<^sub>1) |\\<union>| eps (snd \\<G>\\<^sub>2) |\\<union>| (\\<Delta>|\\<inverse>|))))\"\n\nlemma gtt_syms_GTT_comp:\n  \"gtt_syms (GTT_comp A B) = gtt_syms A |\\<union>| gtt_syms B\"\n  by (auto simp: GTT_comp_def ta_sig_def Let_def)\n\nlemma \\<Delta>\\<^sub>\\<epsilon>_statesD:\n  \"(p, q) |\\<in>| \\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B> \\<Longrightarrow> p |\\<in>| \\<Q> \\<A>\"\n  \"(p, q) |\\<in>| \\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B> \\<Longrightarrow> q |\\<in>| \\<Q> \\<B>\"\n  using subsetD[OF \\<Delta>\\<^sub>\\<epsilon>_states, of \"(p, q)\" \\<A> \\<B>]\n  by (auto simp flip: \\<Delta>\\<^sub>\\<epsilon>.rep_eq fmember_iff_member_fset)\n\nlemma \\<Delta>\\<^sub>\\<epsilon>_statesD':\n  \"q |\\<in>| eps_states (\\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B>) \\<Longrightarrow> q |\\<in>| \\<Q> \\<A> |\\<union>| \\<Q> \\<B>\"\n  by (auto simp: eps_states_def fmember.abs_eq dest: \\<Delta>\\<^sub>\\<epsilon>_statesD)\n\nlemma \\<Delta>\\<^sub>\\<epsilon>_swap:\n  \"prod.swap p |\\<in>| \\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B> \\<longleftrightarrow> p |\\<in>| \\<Delta>\\<^sub>\\<epsilon> \\<B> \\<A>\"\n  by (auto simp: \\<Delta>\\<^sub>\\<epsilon>_def')\n\nlemma \\<Delta>\\<^sub>\\<epsilon>_inverse [simp]:\n  \"(\\<Delta>\\<^sub>\\<epsilon> \\<A> \\<B>)|\\<inverse>| = \\<Delta>\\<^sub>\\<epsilon> \\<B> \\<A>\"\n  by (auto simp: \\<Delta>\\<^sub>\\<epsilon>_def')\n\n\nlemma gtt_states_comp_union:\n  \"gtt_states (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2) |\\<subseteq>| gtt_states \\<G>\\<^sub>1 |\\<union>| gtt_states \\<G>\\<^sub>2\"\nproof (intro fsubsetI, goal_cases lr)\n  case (lr q) then show ?case\n    by (auto simp: GTT_comp_def gtt_states_def \\<Q>_def dest: \\<Delta>\\<^sub>\\<epsilon>_statesD')\nqed\n\nlemma GTT_comp_swap [simp]:\n  \"GTT_comp (prod.swap \\<G>\\<^sub>2) (prod.swap \\<G>\\<^sub>1) = prod.swap (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)\"\n  by (simp add: GTT_comp_def ac_simps)\n\nlemma gtt_comp_complete_semi:\n  assumes s: \"q |\\<in>| gta_der (fst \\<G>\\<^sub>1) s\" and u: \"q |\\<in>| gta_der (snd \\<G>\\<^sub>1) u\" and ut: \"gtt_accept \\<G>\\<^sub>2 u t\"\n  shows \"q |\\<in>| gta_der (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) s\" \"q |\\<in>| gta_der (snd (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) t\"\nproof (goal_cases L R)\n  let ?\\<G> = \"GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2\"\n  have  sub1l: \"rules (fst \\<G>\\<^sub>1) |\\<subseteq>| rules (fst ?\\<G>)\" \"eps (fst \\<G>\\<^sub>1) |\\<subseteq>| eps (fst ?\\<G>)\"\n    and sub1r: \"rules (snd \\<G>\\<^sub>1) |\\<subseteq>| rules (snd ?\\<G>)\" \"eps (snd \\<G>\\<^sub>1) |\\<subseteq>| eps (snd ?\\<G>)\" \n    and sub2r: \"rules (snd \\<G>\\<^sub>2) |\\<subseteq>| rules (snd ?\\<G>)\" \"eps (snd \\<G>\\<^sub>2) |\\<subseteq>| eps (snd ?\\<G>)\"\n    by (auto simp: GTT_comp_def)\n  { case L then show ?case using s ta_der_mono[OF sub1l]\n      by (auto simp: gta_der_def)\n  next\n    case R then show ?case using ut u unfolding gtt_accept_def\n    proof (induct arbitrary: q s)\n      case (base s t)\n      from base(1) obtain p where p: \"p |\\<in>| gta_der (fst \\<G>\\<^sub>2) s\" \"p |\\<in>| gta_der (snd \\<G>\\<^sub>2) t\"\n        by (auto simp: agtt_lang_def)\n      then have \"(p, q) |\\<in>| eps (snd (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2))\"\n        using \\<Delta>\\<^sub>\\<epsilon>_fmember[of p q \"fst \\<G>\\<^sub>2\" \"snd \\<G>\\<^sub>1\"] base(2)\n        by (auto simp: GTT_comp_def gta_der_def)\n      from ta_der_eps[OF this] show ?case using p ta_der_mono[OF sub2r]\n        by (auto simp add: gta_der_def)\n    next\n      case (step ss ts f)\n      from step(1, 4) obtain ps p where \"TA_rule f ps p |\\<in>| rules (snd \\<G>\\<^sub>1)\" \"p = q \\<or> (p, q) |\\<in>| (eps (snd \\<G>\\<^sub>1))|\\<^sup>+|\"\n        \"length ps = length ts\" \"\\<And>i. i < length ts \\<Longrightarrow> ps ! i |\\<in>| gta_der (snd \\<G>\\<^sub>1) (ss ! i)\"\n        unfolding gta_der_def by auto\n      then show ?case using step(1, 2) sub1r(1) ftrancl_mono[OF _ sub1r(2)]\n        by (auto simp: gta_der_def intro!: exI[of _ p] exI[of _ ps])\n    qed}\nqed\n\nlemmas gtt_comp_complete_semi' = gtt_comp_complete_semi[of _ \"prod.swap \\<G>\\<^sub>2\" _ _ \"prod.swap \\<G>\\<^sub>1\" for \\<G>\\<^sub>1 \\<G>\\<^sub>2,\n  unfolded fst_swap snd_swap GTT_comp_swap gtt_accept_swap]\n\nlemma gtt_comp_acomplete:\n  \"gcomp_rel UNIV (agtt_lang \\<G>\\<^sub>1) (agtt_lang \\<G>\\<^sub>2) \\<subseteq> agtt_lang (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)\"\nproof (intro subrelI, goal_cases LR)\n  case (LR s t)\n  then consider\n      q u where \"q |\\<in>| gta_der (fst \\<G>\\<^sub>1) s\" \"q |\\<in>| gta_der (snd \\<G>\\<^sub>1) u\" \"gtt_accept \\<G>\\<^sub>2 u t\"\n    | q u where \"q |\\<in>| gta_der (snd \\<G>\\<^sub>2) t\" \"q |\\<in>| gta_der (fst \\<G>\\<^sub>2) u\" \"gtt_accept \\<G>\\<^sub>1 s u\"\n    by (auto simp: gcomp_rel_def gtt_accept_def elim!: agtt_langE)\n  then show ?case\n  proof (cases)\n    case 1 show ?thesis using gtt_comp_complete_semi[OF 1]\n      by (auto simp: agtt_lang_def gta_der_def)\n  next\n    case 2 show ?thesis using gtt_comp_complete_semi'[OF 2]\n      by (auto simp: agtt_lang_def gta_der_def)\n  qed\nqed\n\nlemma \\<Delta>\\<^sub>\\<epsilon>_steps_from_\\<G>\\<^sub>2:\n  assumes \"(q, q') |\\<in>| (eps (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)))|\\<^sup>+|\" \"q |\\<in>| gtt_states \\<G>\\<^sub>2\"\n    \"gtt_states \\<G>\\<^sub>1 |\\<inter>| gtt_states \\<G>\\<^sub>2 = {||}\"\n  shows \"(q, q') |\\<in>| (eps (fst \\<G>\\<^sub>2))|\\<^sup>+| \\<and> q' |\\<in>| gtt_states \\<G>\\<^sub>2\"\n  using assms(1-2)\nproof (induct rule: converse_ftrancl_induct)\n  case (Base y)\n  then show ?case using assms(3)\n    by (fastforce simp: GTT_comp_def gtt_states_def fmember.abs_eq dest: eps_statesD \\<Delta>\\<^sub>\\<epsilon>_statesD(1))\nnext\n  case (Step q p)\n  have \"(q, p) |\\<in>| (eps (fst \\<G>\\<^sub>2))|\\<^sup>+|\" \"p |\\<in>| gtt_states \\<G>\\<^sub>2\"\n    using Step(1, 4) assms(3)\n    by (auto simp: GTT_comp_def gtt_states_def fmember.abs_eq dest: eps_statesD \\<Delta>\\<^sub>\\<epsilon>_statesD(1))\n  then show ?case using Step(3)\n    by (auto intro: ftrancl_trans)\nqed\n\nlemma \\<Delta>\\<^sub>\\<epsilon>_steps_from_\\<G>\\<^sub>1:\n  assumes \"(p, r) |\\<in>| (eps (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)))|\\<^sup>+|\" \"p |\\<in>| gtt_states \\<G>\\<^sub>1\"\n    \"gtt_states \\<G>\\<^sub>1 |\\<inter>| gtt_states \\<G>\\<^sub>2 = {||}\"\n  obtains \"r |\\<in>| gtt_states \\<G>\\<^sub>1\" \"(p, r) |\\<in>| (eps (fst \\<G>\\<^sub>1))|\\<^sup>+|\"\n  | q p' where \"r |\\<in>| gtt_states \\<G>\\<^sub>2\" \"p = p' \\<or> (p, p') |\\<in>| (eps (fst \\<G>\\<^sub>1))|\\<^sup>+|\" \"(p', q) |\\<in>| \\<Delta>\\<^sub>\\<epsilon> (snd \\<G>\\<^sub>1) (fst \\<G>\\<^sub>2)\"\n    \"q = r \\<or> (q, r) |\\<in>| (eps (fst \\<G>\\<^sub>2))|\\<^sup>+|\"\n  using assms(1,2)\nproof (induct arbitrary: thesis rule: converse_ftrancl_induct)\n  case (Base p)\n  from Base(1) consider (a) \"(p, r) |\\<in>| eps (fst \\<G>\\<^sub>1)\" | (b) \"(p, r) |\\<in>| eps (fst \\<G>\\<^sub>2)\" |\n    (c) \"(p, r) |\\<in>| (\\<Delta>\\<^sub>\\<epsilon> (snd \\<G>\\<^sub>1) (fst \\<G>\\<^sub>2))\"\n    by (auto simp: GTT_comp_def fmember.abs_eq)\n  then show ?case using assms(3) Base\n    by cases (auto simp: GTT_comp_def gtt_states_def fmember.abs_eq dest: eps_statesD \\<Delta>\\<^sub>\\<epsilon>_statesD)\nnext\n  case (Step q p)\n  consider \"(q, p) |\\<in>| (eps (fst \\<G>\\<^sub>1))|\\<^sup>+|\" \"p |\\<in>| gtt_states \\<G>\\<^sub>1\"\n    | \"(q, p) |\\<in>| \\<Delta>\\<^sub>\\<epsilon> (snd \\<G>\\<^sub>1) (fst \\<G>\\<^sub>2)\" \"p |\\<in>| gtt_states \\<G>\\<^sub>2\" using assms(3) Step(1, 6)\n    by (auto simp: GTT_comp_def gtt_states_def fmember.abs_eq dest: eps_statesD \\<Delta>\\<^sub>\\<epsilon>_statesD)\n  then show ?case\n  proof (cases)\n    case 1 note a = 1 show ?thesis\n    proof (cases rule: Step(3))\n      case (2 p' q)\n      then show ?thesis using assms a\n        by (auto intro: Step(5) ftrancl_trans)\n    qed (auto simp: a(2) intro: Step(4) ftrancl_trans[OF a(1)])\n  next\n    case 2 show ?thesis using \\<Delta>\\<^sub>\\<epsilon>_steps_from_\\<G>\\<^sub>2[OF Step(2) 2(2) assms(3)] Step(5)[OF _ _ 2(1)] by auto\n  qed\nqed\n\nlemma \\<Delta>\\<^sub>\\<epsilon>_steps_from_\\<G>\\<^sub>1_\\<G>\\<^sub>2:\n  assumes \"(q, q') |\\<in>| (eps (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)))|\\<^sup>+|\" \"q |\\<in>| gtt_states \\<G>\\<^sub>1 |\\<union>| gtt_states \\<G>\\<^sub>2\"\n    \"gtt_states \\<G>\\<^sub>1 |\\<inter>| gtt_states \\<G>\\<^sub>2 = {||}\"\n  obtains \"q |\\<in>| gtt_states \\<G>\\<^sub>1\" \"q' |\\<in>| gtt_states \\<G>\\<^sub>1\" \"(q, q') |\\<in>| (eps (fst \\<G>\\<^sub>1))|\\<^sup>+|\"\n  | p p' where \"q |\\<in>| gtt_states \\<G>\\<^sub>1\" \"q' |\\<in>| gtt_states \\<G>\\<^sub>2\" \"q = p \\<or> (q, p) |\\<in>| (eps (fst \\<G>\\<^sub>1))|\\<^sup>+|\"\n    \"(p, p') |\\<in>| \\<Delta>\\<^sub>\\<epsilon> (snd \\<G>\\<^sub>1) (fst \\<G>\\<^sub>2)\" \"p' = q' \\<or> (p', q') |\\<in>| (eps (fst \\<G>\\<^sub>2))|\\<^sup>+|\"\n  | \"q |\\<in>| gtt_states \\<G>\\<^sub>2\" \"(q, q') |\\<in>| (eps (fst \\<G>\\<^sub>2))|\\<^sup>+| \\<and> q' |\\<in>| gtt_states \\<G>\\<^sub>2\"\n  using assms \\<Delta>\\<^sub>\\<epsilon>_steps_from_\\<G>\\<^sub>1 \\<Delta>\\<^sub>\\<epsilon>_steps_from_\\<G>\\<^sub>2\n  by (metis funion_iff)\n\nlemma GTT_comp_eps_fst_statesD:\n  \"(p, q) |\\<in>| eps (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) \\<Longrightarrow> p |\\<in>| gtt_states \\<G>\\<^sub>1 |\\<union>| gtt_states \\<G>\\<^sub>2\"\n  \"(p, q) |\\<in>| eps (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) \\<Longrightarrow> q |\\<in>| gtt_states \\<G>\\<^sub>1 |\\<union>| gtt_states \\<G>\\<^sub>2\"\n  by (auto simp: GTT_comp_def gtt_states_def fmember.abs_eq dest: eps_statesD \\<Delta>\\<^sub>\\<epsilon>_statesD)\n\nlemma GTT_comp_eps_ftrancl_fst_statesD:\n  \"(p, q) |\\<in>| (eps (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)))|\\<^sup>+| \\<Longrightarrow> p |\\<in>| gtt_states \\<G>\\<^sub>1 |\\<union>| gtt_states \\<G>\\<^sub>2\"\n  \"(p, q) |\\<in>| (eps (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)))|\\<^sup>+| \\<Longrightarrow> q |\\<in>| gtt_states \\<G>\\<^sub>1 |\\<union>| gtt_states \\<G>\\<^sub>2\"\n  using GTT_comp_eps_fst_statesD[of _ _ \\<G>\\<^sub>1 \\<G>\\<^sub>2]\n  by (meson converse_ftranclE ftranclE)+\n\nlemma GTT_comp_first:\n  assumes \"q |\\<in>| ta_der (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) t\" \"q |\\<in>| gtt_states \\<G>\\<^sub>1\"\n    \"gtt_states \\<G>\\<^sub>1 |\\<inter>| gtt_states \\<G>\\<^sub>2 = {||}\"\n  shows \"q |\\<in>| ta_der (fst \\<G>\\<^sub>1) t\"\n  using assms(1,2)\nproof (induct t arbitrary: q)\n  case (Var q')\n  have \"q \\<noteq> q' \\<Longrightarrow> q' |\\<in>| gtt_states \\<G>\\<^sub>1 |\\<union>| gtt_states \\<G>\\<^sub>2\" using Var\n    by (auto dest: GTT_comp_eps_ftrancl_fst_statesD)\n  then show ?case using Var assms(3)\n    by (auto elim: \\<Delta>\\<^sub>\\<epsilon>_steps_from_\\<G>\\<^sub>1_\\<G>\\<^sub>2)\nnext\n  case (Fun f ts)\n  obtain q' qs where q': \"TA_rule f qs q' |\\<in>| rules (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2))\"\n    \"q' = q \\<or> (q', q) |\\<in>| (eps (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)))|\\<^sup>+|\" \"length qs = length ts\"\n    \"\\<And>i. i < length ts \\<Longrightarrow> qs ! i |\\<in>| ta_der (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) (ts ! i)\"\n    using Fun(2) by auto\n  have \"q' |\\<in>| gtt_states \\<G>\\<^sub>1 |\\<union>| gtt_states \\<G>\\<^sub>2\" using q'(1)\n    by (auto simp: GTT_comp_def gtt_states_def dest: rule_statesD)\n  then have st: \"q' |\\<in>| gtt_states \\<G>\\<^sub>1\" and eps:\"q' = q \\<or> (q', q) |\\<in>| (eps (fst \\<G>\\<^sub>1))|\\<^sup>+|\"\n    using q'(2) Fun(3) assms(3)\n    by (auto elim!: \\<Delta>\\<^sub>\\<epsilon>_steps_from_\\<G>\\<^sub>1_\\<G>\\<^sub>2)\n  from st have rule: \"TA_rule f qs q' |\\<in>| rules (fst \\<G>\\<^sub>1)\" using assms(3) q'(1)\n    by (auto simp: GTT_comp_def gtt_states_def dest: rule_statesD)\n  have \"i < length ts \\<Longrightarrow> qs ! i |\\<in>| ta_der (fst \\<G>\\<^sub>1) (ts ! i)\" for i\n    using rule q'(3, 4)\n    by (intro Fun(1)[OF nth_mem]) (auto simp: gtt_states_def dest!: rule_statesD(4))\n  then show ?case using q'(3) rule eps\n    by auto\nqed\n\nlemma GTT_comp_second:\n  assumes \"gtt_states \\<G>\\<^sub>1 |\\<inter>| gtt_states \\<G>\\<^sub>2 = {||}\" \"q |\\<in>| gtt_states \\<G>\\<^sub>2\"\n    \"q |\\<in>| ta_der (snd (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) t\"\n  shows \"q |\\<in>| ta_der (snd \\<G>\\<^sub>2) t\"\n  using assms GTT_comp_first[of q \"prod.swap \\<G>\\<^sub>2\" \"prod.swap \\<G>\\<^sub>1\"]\n  by (auto simp: gtt_states_def)\n\nlemma gtt_comp_sound_semi:\n  fixes \\<G>\\<^sub>1 \\<G>\\<^sub>2 :: \"('f, 'q) gtt\"\n  assumes as2: \"gtt_states \\<G>\\<^sub>1 |\\<inter>| gtt_states \\<G>\\<^sub>2 = {||}\"\n  and 1: \"q |\\<in>| gta_der (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) s\" \"q |\\<in>| gta_der (snd (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) t\" \"q |\\<in>| gtt_states \\<G>\\<^sub>1\"\n  shows \"\\<exists>u. q |\\<in>| gta_der (snd \\<G>\\<^sub>1) u \\<and> gtt_accept \\<G>\\<^sub>2 u t\" using 1(2,3) unfolding gta_der_def\nproof (induct rule: ta_der_gterm_induct)\n  case (GFun f ts ps p q)\n  show ?case\n  proof (cases \"p |\\<in>| gtt_states \\<G>\\<^sub>1\")\n    case True\n    then have *: \"TA_rule f ps p |\\<in>| rules (snd \\<G>\\<^sub>1)\" using GFun(1, 6) as2\n      by (auto simp: GTT_comp_def gtt_states_def dest: rule_statesD)\n    moreover have st: \"i < length ps \\<Longrightarrow> ps ! i |\\<in>| gtt_states \\<G>\\<^sub>1\" for i using *\n      by (force simp: gtt_states_def dest: rule_statesD)\n    moreover have \"i < length ps \\<Longrightarrow> \\<exists>u. ps ! i |\\<in>| ta_der (snd \\<G>\\<^sub>1) (term_of_gterm u) \\<and> gtt_accept \\<G>\\<^sub>2 u (ts ! i)\" for i\n      using st GFun(2) by (intro GFun(5)) simp\n    then obtain us where\n      \"\\<And>i. i < length ps \\<Longrightarrow> ps ! i |\\<in>| ta_der (snd \\<G>\\<^sub>1) (term_of_gterm (us i)) \\<and> gtt_accept \\<G>\\<^sub>2 (us i) (ts ! i)\"\n      by metis\n    moreover have \"p = q \\<or> (p, q) |\\<in>| (eps (snd \\<G>\\<^sub>1))|\\<^sup>+|\" using GFun(3, 6) True as2\n      by (auto simp: gtt_states_def  elim!: \\<Delta>\\<^sub>\\<epsilon>_steps_from_\\<G>\\<^sub>1_\\<G>\\<^sub>2[of p q \"prod.swap \\<G>\\<^sub>2\" \"prod.swap \\<G>\\<^sub>1\", simplified])\n    ultimately show ?thesis using GFun(2)\n      by (intro exI[of _ \"GFun f (map us [0..<length ts])\"])\n         (auto simp: gtt_accept_def intro!: exI[of _ ps] exI[of _ p])\n  next\n    case False note nt_st = this\n    then have False: \"p \\<noteq> q\" using GFun(6) by auto\n    then have eps: \"(p, q) |\\<in>| (eps (snd (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)))|\\<^sup>+|\" using GFun(3) by simp\n    show ?thesis using \\<Delta>\\<^sub>\\<epsilon>_steps_from_\\<G>\\<^sub>1_\\<G>\\<^sub>2[of p q \"prod.swap \\<G>\\<^sub>2\" \"prod.swap \\<G>\\<^sub>1\", simplified, OF eps]\n    proof (cases, goal_cases)\n      case 1 then show ?case using False GFun(3)\n        by (metis GTT_comp_eps_ftrancl_fst_statesD(1) GTT_comp_swap fst_swap funion_iff)\n    next\n      case 2 then show ?case using as2 by (auto simp: gtt_states_def)\n    next\n      case 3 then show ?case using as2 GFun(6) by (auto simp: gtt_states_def)\n    next\n      case (4 r p')\n      have meet: \"r |\\<in>| ta_der (snd (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) (Fun f (map term_of_gterm ts))\"\n        using GFun(1 - 4) 4(3) False\n        by (auto simp: GTT_comp_def in_ftrancl_UnI intro!: exI[ of _ ps] exI[ of _ p])\n      then obtain u where wit: \"ground u\" \"p' |\\<in>| ta_der (snd \\<G>\\<^sub>1) u\" \"r |\\<in>| ta_der (fst \\<G>\\<^sub>2) u\"\n        using 4(4-) unfolding \\<Delta>\\<^sub>\\<epsilon>_def' by blast\n      from wit(1, 3) have \"gtt_accept \\<G>\\<^sub>2 (gterm_of_term u) (GFun f ts)\"\n        using GTT_comp_second[OF as2 _ meet] unfolding gtt_accept_def\n        by (intro gmctxt_cl.base agtt_langI[of r])\n           (auto simp add: gta_der_def gtt_states_def simp del: ta_der_Fun dest: ground_ta_der_states)\n      then show ?case using 4(5) wit(1, 2)\n        by (intro exI[of _ \"gterm_of_term u\"]) (auto simp add: ta_der_trancl_eps)\n    next\n      case 5\n      then show ?case using nt_st as2\n        by (simp add: gtt_states_def)  \n    qed\n  qed\nqed\n\nlemma gtt_comp_asound:\n  assumes \"gtt_states \\<G>\\<^sub>1 |\\<inter>| gtt_states \\<G>\\<^sub>2 = {||}\"\n  shows \"agtt_lang (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2) \\<subseteq> gcomp_rel UNIV (agtt_lang \\<G>\\<^sub>1) (agtt_lang \\<G>\\<^sub>2)\"\nproof (intro subrelI, goal_cases LR)\n  case (LR s t)\n  obtain q where q: \"q |\\<in>| gta_der (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) s\" \"q |\\<in>| gta_der (snd (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) t\"\n    using LR by (auto simp: agtt_lang_def)\n  { (* prepare symmetric cases: q |\\<in>| gtt_states \\<G>\\<^sub>1 and q |\\<in>| gtt_states \\<G>\\<^sub>2 *)\n    fix \\<G>\\<^sub>1 \\<G>\\<^sub>2 s t assume as2: \"gtt_states \\<G>\\<^sub>1 |\\<inter>| gtt_states \\<G>\\<^sub>2 = {||}\"\n      and 1: \"q |\\<in>| ta_der (fst (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) (term_of_gterm s)\"\n        \"q |\\<in>| ta_der (snd (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)) (term_of_gterm t)\" \"q |\\<in>| gtt_states \\<G>\\<^sub>1\"\n    note st = GTT_comp_first[OF 1(1,3) as2]\n    obtain u where u: \"q |\\<in>| ta_der (snd \\<G>\\<^sub>1) (term_of_gterm u)\" \"gtt_accept \\<G>\\<^sub>2 u t\"\n      using gtt_comp_sound_semi[OF as2 1[folded gta_der_def]] by (auto simp: gta_der_def)\n    have \"(s, u) \\<in> agtt_lang \\<G>\\<^sub>1\" using st u(1)\n      by (auto simp: agtt_lang_def gta_der_def)\n    moreover have \"(u, t) \\<in> gtt_lang \\<G>\\<^sub>2\" using u(2)\n      by (auto simp: gtt_accept_def)\n    ultimately have \"(s, t) \\<in> agtt_lang \\<G>\\<^sub>1 O gmctxt_cl UNIV (agtt_lang \\<G>\\<^sub>2)\"\n      by auto}\n  note base = this\n  consider \"q |\\<in>| gtt_states \\<G>\\<^sub>1\" | \"q |\\<in>| gtt_states \\<G>\\<^sub>2\" | \"q |\\<notin>| gtt_states \\<G>\\<^sub>1 |\\<union>| gtt_states \\<G>\\<^sub>2\" by blast\n  then show ?case using q assms\n  proof (cases, goal_cases)\n    case 1 then show ?case using base[of \\<G>\\<^sub>1 \\<G>\\<^sub>2 s t]\n      by (auto simp: gcomp_rel_def gta_der_def)\n  next\n    case 2 then show ?case using base[of \"prod.swap \\<G>\\<^sub>2\" \"prod.swap \\<G>\\<^sub>1\" t s, THEN converseI]\n      by (auto simp: gcomp_rel_def converse_relcomp converse_agtt_lang gta_der_def gtt_states_def)\n         (simp add: finter_commute funion_commute gtt_lang_swap prod.swap_def)+\n  next\n    case 3 then show ?case using fsubsetD[OF gtt_states_comp_union[of \\<G>\\<^sub>1 \\<G>\\<^sub>2], of q]\n      by (auto simp: gta_der_def gtt_states_def)\n  qed\nqed\n\nlemma gtt_comp_lang_complete:\n  shows \"gtt_lang \\<G>\\<^sub>1 O gtt_lang \\<G>\\<^sub>2 \\<subseteq> gtt_lang (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2)\"\n  using gmctxt_cl_mono_rel[OF gtt_comp_acomplete, of UNIV \\<G>\\<^sub>1 \\<G>\\<^sub>2]\n  by (simp only: gcomp_rel[symmetric])\n\nlemma gtt_comp_alang:\n  assumes \"gtt_states \\<G>\\<^sub>1 |\\<inter>| gtt_states \\<G>\\<^sub>2 = {||}\"\n  shows \"agtt_lang (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2) = gcomp_rel UNIV (agtt_lang \\<G>\\<^sub>1) (agtt_lang \\<G>\\<^sub>2)\"\n  by (intro equalityI gtt_comp_asound[OF assms] gtt_comp_acomplete)\n\nlemma gtt_comp_lang:\n  assumes \"gtt_states \\<G>\\<^sub>1 |\\<inter>| gtt_states \\<G>\\<^sub>2 = {||}\"\n  shows \"gtt_lang (GTT_comp \\<G>\\<^sub>1 \\<G>\\<^sub>2) = gtt_lang \\<G>\\<^sub>1 O gtt_lang \\<G>\\<^sub>2\"\n  by (simp only: arg_cong[OF gtt_comp_alang[OF assms], of \"gmctxt_cl UNIV\"] gcomp_rel)\n\nabbreviation GTT_comp' where\n  \"GTT_comp' \\<G>\\<^sub>1 \\<G>\\<^sub>2 \\<equiv> GTT_comp (fmap_states_gtt Inl \\<G>\\<^sub>1) (fmap_states_gtt Inr \\<G>\\<^sub>2)\"\n\nlemma gtt_comp'_alang:\n  shows \"agtt_lang (GTT_comp' \\<G>\\<^sub>1 \\<G>\\<^sub>2) = gcomp_rel UNIV (agtt_lang \\<G>\\<^sub>1) (agtt_lang \\<G>\\<^sub>2)\"\nproof -\n  have [simp]: \"finj_on Inl (gtt_states \\<G>\\<^sub>1)\" \"finj_on Inr (gtt_states \\<G>\\<^sub>2)\"\n    by (auto simp add: finj_on.rep_eq)\n  then show ?thesis                                        \n    by (subst gtt_comp_alang) (auto simp: agtt_lang_fmap_states_gtt)\nqed\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Regular_Tree_Relations/GTT_Compose.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5964331462646254, "lm_q1q2_score": 0.33300472587591906}}
{"text": "theory Replace_Constant\n  imports Rewriting\nbegin\n\nsubsection \\<open>Removing/Replacing constants in a rewrite sequence that do not appear in the rewrite system\\<close>\nlemma funas_term_const_subst_conv:\n  \"(c, 0) \\<notin> funas_term l \\<longleftrightarrow> \\<not> (l \\<unrhd> constT c)\"\nproof (induct l)\n  case (Fun f ts) then show ?case\n    by auto (metis Fun_supt supteq_supt_conv term.inject(2))+\nqed (auto simp add: supteq_var_imp_eq)\n\nlemma fresh_const_single_step_replace:\n  assumes lin: \"linear_sys \\<R>\" and fresh: \"(c, 0) \\<notin> funas_rel \\<R>\"\n    and occ: \"p \\<in> poss_of_term (constT c) s\" and step: \"(s, t) \\<in> rstep \\<R>\"\n  shows \"(s[p \\<leftarrow> u], t) \\<in> rstep \\<R> \\<or>\n    (\\<exists> q. q \\<in> poss_of_term (constT c) t \\<and> (s[p \\<leftarrow> u], t[q \\<leftarrow> u]) \\<in> rstep \\<R>)\"\nproof -\n  from occ have const: \"p \\<in> poss s \\<and> s |_ p = constT c\" by auto\n  from step obtain C l r \\<sigma> where t [simp]: \"s = C\\<langle>l \\<cdot> \\<sigma>\\<rangle>\" \"t = C\\<langle>r \\<cdot> \\<sigma>\\<rangle>\"\n    and rule: \"(l, r) \\<in> \\<R>\" by blast\n  from rule lin have lin: \"linear_term l\" \"linear_term r\" by fastforce+\n  from fresh rule have nt_lhs: \"(c, 0) \\<notin> funas_term l\" by (auto simp: funas_rel_def)\n  consider (par) \"p \\<bottom> (hole_pos C)\" | (below) \"hole_pos C \\<le>\\<^sub>p p\" using occ\n    by (auto dest: poss_of_term_const_ctxt_apply)\n  then show ?thesis\n  proof cases\n    case par\n    then have possc: \"p \\<in> possc C\" using const t possc_def by blast \n    then have \"p \\<in> poss_of_term (constT c) t\" \"(s[p \\<leftarrow> u], t[p \\<leftarrow> u]) \\<in> rstep \\<R>\"\n      using const par_hole_pos_replace_term_context_at[OF par]\n      using possc_subt_at_ctxt_apply[OF possc par, of \"r \\<cdot> \\<sigma>\" \"l \\<cdot> \\<sigma>\"] rule\n      by auto (metis par par_pos_replace_pres replace_at_hole_pos) \n    then show ?thesis by blast\n  next\n    case below\n    then obtain q where [simp]:\"p = hole_pos C @ q\" and poss: \"q \\<in> poss (l \\<cdot> \\<sigma>)\"\n      using const position_less_eq_def\n      by (metis (full_types) ctxt_at_pos_hole_pos ctxt_at_pos_subt_at_pos poss_append_poss t(1))\n    have const: \"l \\<cdot> \\<sigma> |_ q = constT c\" using const by auto\n    from nt_lhs have \"\\<exists> r. r \\<in> varposs l \\<and> r \\<le>\\<^sub>p q\" using const poss\n    proof (induct l arbitrary: q)\n      case (Var x)\n      then show ?case by auto\n    next\n      case (Fun f ts)\n      from Fun(1)[OF nth_mem, of \"hd q\" \"tl q\"] Fun(2-) obtain r where\n        \"r \\<in> varposs (ts ! hd q) \\<and> r \\<le>\\<^sub>p tl q\"\n        by (cases q) auto\n      then show ?case using Fun(2- 4)\n        by (intro exI[of _ \"hd q # r\"]) auto\n    qed\n    then obtain x v where varposs: \"v \\<in> varposs l\" \"v \\<le>\\<^sub>p q\" \"l |_ v = Var x\"\n      unfolding varposs_def by blast\n    let ?\\<tau> = \"\\<lambda>x. if Var x = l |_ v then (\\<sigma> x)[q -\\<^sub>p v \\<leftarrow> u] else \\<sigma> x\"\n    show ?thesis\n    proof (cases \"x \\<in> vars_term r\")\n      case True\n      then obtain q' where varposs_r: \"q' \\<in> varposs r\" \"r |_ q' = Var x\"\n        by (metis vars_term_varposs_iff)\n      have \"(s[p \\<leftarrow> u], t[(hole_pos C) @ q' @ (q -\\<^sub>p v) \\<leftarrow> u]) \\<in> rstep \\<R>\"\n        using lin varposs rule varposs_r\n        by (auto simp: linear_term_varposs_subst_replace_term intro!: rstep_ctxtI)\n          (smt (verit, ccfv_SIG) pos_diff_append_itself rrstep.intros rrstep_rstep_mono subset_eq term_subst_eq)\n      moreover have \"(hole_pos C) @ q' @ q -\\<^sub>p v \\<in> poss_of_term (constT c) t\"\n        using varposs_r varposs poss const poss_pos_diffI[OF varposs(2) poss]\n        using subt_at_append_dist[of q' \"q -\\<^sub>p v\" \"r \\<cdot> \\<sigma>\"]\n        by (auto simp: poss_append_poss varposs_imp_poss[THEN subst_subt_at_dist] varposs_imp_poss[THEN subsetD[OF subst_poss_mono]])\n          (metis pos_les_eq_append_diff subst_apply_term.simps(1) subst_subt_at_dist subt_at_append_dist varposs_imp_poss)\n      ultimately show ?thesis by auto\n    next\n      case False\n      then have [simp]: \"r \\<cdot> \\<sigma> = r \\<cdot> ?\\<tau>\" using varposs\n        by (auto simp add: term_subst_eq_conv)\n      have \"(s[p \\<leftarrow> u], t) \\<in> rstep \\<R>\" using rule varposs lin\n        by (auto simp: linear_term_varposs_subst_replace_term)\n      then show ?thesis by auto\n    qed\n  qed\nqed\n\nlemma fresh_const_steps_replace:\n  assumes lin: \"linear_sys \\<R>\" and fresh: \"(c, 0) \\<notin> funas_rel \\<R>\"\n    and occ: \"p \\<in> poss_of_term (constT c) s\" and steps: \"(s, t) \\<in> (rstep \\<R>)\\<^sup>+\"\n  shows \"(s[p \\<leftarrow> u], t) \\<in> (rstep \\<R>)\\<^sup>+ \\<or>\n    (\\<exists> q. q \\<in> poss_of_term (constT c) t \\<and> (s[p \\<leftarrow> u], t[q \\<leftarrow> u]) \\<in> (rstep \\<R>)\\<^sup>+)\"\n  using steps occ\nproof (induct arbitrary: p rule: converse_trancl_induct)\n  case (base s)\n  from fresh_const_single_step_replace[OF lin fresh base(2, 1)] show ?case\n    by (meson r_into_trancl')\nnext\n  case (step s t)\n  from fresh_const_single_step_replace[OF lin fresh step(4, 1)]\n  consider (a) \"(s[p \\<leftarrow> u], t) \\<in> rstep \\<R>\" | (b) \"\\<exists>q. q \\<in> poss_of_term (constT c) t \\<and> (s[p \\<leftarrow> u], t[q \\<leftarrow> u]) \\<in> rstep \\<R>\" by blast\n  then show ?case\n  proof cases\n    case a then show ?thesis using step(2)\n      by auto\n  next\n    case b\n    then obtain q where \"q \\<in> poss_of_term (constT c) t\" \"(s[p \\<leftarrow> u], t[q \\<leftarrow> u]) \\<in> rstep \\<R>\" by blast\n    from step(3)[OF this(1)] this(2) show ?thesis\n      by (metis trancl_into_trancl2)\n  qed\nqed\n\nlemma remove_const_lhs_steps:\n  assumes lin: \"linear_sys \\<R>\" and fresh: \"(c, 0) \\<notin> funas_rel \\<R>\"\n    and const: \"(c, 0) \\<notin> funas_term t\"\n    and pos: \"p \\<in> poss_of_term (constT c) s\" \n    and steps: \"(s, t) \\<in> (rstep \\<R>)\\<^sup>+\"\n  shows \"(s[p \\<leftarrow> u], t) \\<in> (rstep \\<R>)\\<^sup>+\" using steps pos const fresh_const_steps_replace\n  by (metis fresh funas_term_const_subst_conv lin poss_of_termE subt_at_imp_supteq)\n\n\ntext \\<open>Now we can show that we may remove a constant substitution\\<close>\n\ndefinition const_replace_closed where\n  \"const_replace_closed c U = (\\<forall> s t u p.\n    p \\<in> poss_of_term (constT c) s \\<longrightarrow> (s, t) \\<in> U \\<longrightarrow>\n    (\\<exists> q. q \\<in> poss_of_term (constT c) t \\<and> (s[p \\<leftarrow> u], t[q \\<leftarrow> u]) \\<in> U) \\<or> (s[p \\<leftarrow> u], t) \\<in> U)\"\n\nlemma const_replace_closedD:\n  assumes \"const_replace_closed c U\" \"p \\<in> poss_of_term (constT c) s\" \"(s, t) \\<in> U\"\n  shows \"(s[p \\<leftarrow> u], t) \\<in> U \\<or> (\\<exists> q. q \\<in> poss_of_term (constT c) t \\<and> (s[p \\<leftarrow> u], t[q \\<leftarrow> u]) \\<in> U)\" using assms\n  unfolding const_replace_closed_def by blast\n\nlemma const_replace_closedI:\n  assumes \"\\<And> s t u p. p \\<in> poss_of_term (constT c) s \\<Longrightarrow> (s, t) \\<in> U \\<Longrightarrow>\n       (\\<exists> q. q \\<in> poss_of_term (constT c) t \\<and> (s[p \\<leftarrow> u], t[q \\<leftarrow> u]) \\<in> U) \\<or> (s[p \\<leftarrow> u], t) \\<in> U\"\n  shows \"const_replace_closed c U\" using assms\n  unfolding const_replace_closed_def\n  by auto\n\nabbreviation const_subst :: \"'f \\<Rightarrow> 'v \\<Rightarrow> ('f, 'v) Term.term\" where\n  \"const_subst c \\<equiv> (\\<lambda> x. Fun c [])\"\n\nlemma lin_fresh_rstep_const_replace_closed:\n  \"linear_sys \\<R> \\<Longrightarrow> (c, 0) \\<notin> funas_rel \\<R> \\<Longrightarrow> const_replace_closed c (rstep \\<R>)\"\n  using fresh_const_single_step_replace[of \\<R> c]\n  by (intro const_replace_closedI) (auto simp: constT_nfunas_term_poss_of_term_empty, blast)\n\nlemma const_replace_closed_symcl:\n  \"const_replace_closed c U \\<Longrightarrow> const_replace_closed c (U\\<^sup>=)\"\n  unfolding const_replace_closed_def\n  by (metis Un_iff pair_in_Id_conv)\n\nlemma const_replace_closed_trancl:\n  \"const_replace_closed c U \\<Longrightarrow> const_replace_closed c (U\\<^sup>+)\"\nproof (intro const_replace_closedI)\n  fix s t u p\n  assume const: \"const_replace_closed c U\" and wit: \"p \\<in> poss_of_term (constT c) s\"\n    and steps :\"(s, t) \\<in> U\\<^sup>+\"\n  show \"(\\<exists>q. q \\<in> poss_of_term (constT c) t \\<and> (s[p \\<leftarrow> u], t[q \\<leftarrow> u]) \\<in> U\\<^sup>+) \\<or> (s[p \\<leftarrow> u], t) \\<in> U\\<^sup>+\" using steps wit\n  proof (induct arbitrary: p rule: converse_trancl_induct)\n    case (base s)\n    show ?case using const_replace_closedD[OF const base(2, 1)]\n      by blast\n  next\n    case (step s v)\n    from const_replace_closedD[OF const step(4, 1)]\n    consider (a) \"(s[p \\<leftarrow> u], v) \\<in> U\" | (b) \"\\<exists> q. q \\<in> poss_of_term (constT c) v \\<and> (s[p \\<leftarrow> u], v[q \\<leftarrow> u]) \\<in> U\" by auto\n    then show ?case\n    proof cases\n      case a then show ?thesis using step(2)\n        by (meson trancl_into_trancl2)\n    next\n      case b\n      then show ?thesis using step(3, 4) by (meson trancl_into_trancl2) \n    qed\n  qed\nqed\n\nlemma const_replace_closed_rtrancl:\n  \"const_replace_closed c U \\<Longrightarrow> const_replace_closed c (U\\<^sup>*)\"\nproof (intro const_replace_closedI)\n  fix s t u p\n  assume const: \"const_replace_closed c U\" and wit: \"p \\<in> poss_of_term (constT c) s\"\n    and steps :\"(s, t) \\<in> U\\<^sup>*\"\n  show \"(\\<exists>q. q \\<in> poss_of_term (constT c) t \\<and> (s[p \\<leftarrow> u], t[q \\<leftarrow> u]) \\<in> U\\<^sup>*) \\<or> (s[p \\<leftarrow> u], t) \\<in> U\\<^sup>*\"\n    using const_replace_closed_trancl[OF const] wit steps\n    by (metis const_replace_closedD rtrancl_eq_or_trancl)\nqed\n\nlemma const_replace_closed_relcomp:\n  \"const_replace_closed c U \\<Longrightarrow> const_replace_closed c V \\<Longrightarrow> const_replace_closed c (U O V)\"\nproof (intro const_replace_closedI)\n  fix s t u p\n  assume const: \"const_replace_closed c U\" \"const_replace_closed c V\"\n   and wit: \"p \\<in> poss_of_term (constT c) s\" and step: \"(s, t) \\<in> U O V\"\n  from step obtain w where w: \"(s, w) \\<in> U\" \"(w, t) \\<in> V\" by auto\n  from const_replace_closedD[OF const(1) wit this(1)]\n  consider (a) \"(s[p \\<leftarrow> u], w) \\<in> U\" | (b) \"(\\<exists>q. q \\<in> poss_of_term (constT c) w \\<and> (s[p \\<leftarrow> u], w[q \\<leftarrow> u]) \\<in> U)\"\n    by auto  \n  then show \"(\\<exists>q. q \\<in> poss_of_term (constT c) t \\<and> (s[p \\<leftarrow> u], t[q \\<leftarrow> u]) \\<in> U O V) \\<or> (s[p \\<leftarrow> u], t) \\<in> U O V\"\n  proof cases\n    case a\n    then show ?thesis using w(2) by auto\n  next\n    case b\n    then show ?thesis using const_replace_closedD[OF const(2) _ w(2)]\n      by (meson relcomp.simps)\n  qed\nqed\n\n\ntext \\<open>@{const const_replace_closed} allow the removal of a fresh constant substitution\\<close>\nlemma const_replace_closed_remove_subst_lhs:\n  assumes repcl: \"const_replace_closed c U\"\n    and const: \"(c, 0) \\<notin> funas_term t\"\n    and steps: \"(s \\<cdot> const_subst c, t) \\<in> U\"\n  shows \"(s, t) \\<in> U\" using steps\nproof (induct \"card (varposs s)\" arbitrary: s)\n  case (Suc n)\n  obtain p ps where vl: \"varposs s = insert p ps\" \"p \\<notin> ps\" using Suc(2)\n    by (metis card_le_Suc_iff dual_order.refl)\n  let ?s = \"s[p \\<leftarrow> Fun c []]\" have vp: \"p \\<in> varposs s\" using vl by auto\n  then have [simp]: \"?s \\<cdot> const_subst c = s \\<cdot> const_subst c\"\n    by (induct s arbitrary: p) (auto simp: nth_list_update map_update intro!: nth_equalityI)\n  have \"varposs ?s = ps\" using vl varposs_ground_replace_at[of p s \"constT c\"]\n    by auto\n  then have \"n = card (varposs ?s)\" using vl Suc(2) by (auto simp: card_insert_if finite_varposs)\n  from Suc(1)[OF this] have IH: \"(s[p \\<leftarrow> constT c], t) \\<in> U\" \"p \\<in> poss_of_term (constT c) s[p \\<leftarrow> constT c]\"\n    using Suc(2, 3) vl poss_of_term_replace_term_at varposs_imp_poss vp\n    using \\<open>s[p \\<leftarrow> constT c] \\<cdot> const_subst c = s \\<cdot> const_subst c\\<close>\n    by fastforce+\n  show ?case using const_replace_closedD[OF repcl] const IH(2, 1)\n    by (metis constT_nfunas_term_poss_of_term_empty empty_iff replace_term_at_same_pos replace_term_at_subt_at_id)\nqed (auto simp: ground_subst_apply card_eq_0_iff finite_varposs varposs_empty_gound)\n\n\nsubsubsection \\<open>Removal lemma applied to various rewrite relations\\<close>\n\nlemma remove_const_subst_step_lhs:\n  assumes lin: \"linear_sys \\<R>\" and fresh: \"(c, 0) \\<notin> funas_rel \\<R>\"\n    and const: \"(c, 0) \\<notin> funas_term t\"\n    and step: \"(s \\<cdot> const_subst c, t) \\<in> (rstep \\<R>)\"\n  shows \"(s, t) \\<in> (rstep \\<R>)\"\n  using lin_fresh_rstep_const_replace_closed[OF lin fresh, THEN const_replace_closed_remove_subst_lhs] const step\n  by blast\n\nlemma remove_const_subst_steps_lhs:\n  assumes lin: \"linear_sys \\<R>\" and fresh: \"(c, 0) \\<notin> funas_rel \\<R>\"\n    and const: \"(c, 0) \\<notin> funas_term t\"\n    and steps: \"(s \\<cdot> const_subst c, t) \\<in> (rstep \\<R>)\\<^sup>+\"\n  shows \"(s, t) \\<in> (rstep \\<R>)\\<^sup>+\"\n  using lin_fresh_rstep_const_replace_closed[THEN const_replace_closed_trancl,\n    OF lin fresh, THEN const_replace_closed_remove_subst_lhs]\n  using const steps\n  by blast\n\nlemma remove_const_subst_steps_eq_lhs:\n  assumes lin: \"linear_sys \\<R>\" and fresh: \"(c, 0) \\<notin> funas_rel \\<R>\"\n    and const: \"(c, 0) \\<notin> funas_term t\"\n    and steps: \"(s \\<cdot> const_subst c, t) \\<in> (rstep \\<R>)\\<^sup>*\"\n  shows \"(s, t) \\<in> (rstep \\<R>)\\<^sup>*\" using steps const \n  by (cases \"s = t\") (auto simp: rtrancl_eq_or_trancl funas_term_subst ground_subst_apply vars_term_empty_ground\n      dest: remove_const_subst_steps_lhs[OF lin fresh const] split: if_splits)\n\nlemma remove_const_subst_steps_rhs:\n  assumes lin: \"linear_sys \\<R>\" and fresh: \"(c, 0) \\<notin> funas_rel \\<R>\"\n    and const: \"(c, 0) \\<notin> funas_term s\"\n    and steps: \"(s, t \\<cdot> const_subst c) \\<in> (rstep \\<R>)\\<^sup>+\"\n  shows \"(s, t) \\<in> (rstep \\<R>)\\<^sup>+\"\nproof -\n  from steps have revs: \"(t \\<cdot> const_subst c, s) \\<in> (rstep (\\<R>\\<inverse>))\\<^sup>+\"\n    unfolding rew_converse_outwards by auto\n  have \"(t, s) \\<in> (rstep (\\<R>\\<inverse>))\\<^sup>+\" using assms\n    by (intro remove_const_subst_steps_lhs[OF _ _ _ revs]) (auto simp: funas_rel_def)\n  then show ?thesis unfolding rew_converse_outwards by auto\nqed\n\nlemma remove_const_subst_steps_eq_rhs:\n  assumes lin: \"linear_sys \\<R>\" and fresh: \"(c, 0) \\<notin> funas_rel \\<R>\"\n    and const: \"(c, 0) \\<notin> funas_term s\"\n    and steps: \"(s, t \\<cdot> const_subst c) \\<in> (rstep \\<R>)\\<^sup>*\"\n  shows \"(s, t) \\<in> (rstep \\<R>)\\<^sup>*\"\n  using steps const\n  by (cases \"s = t\") (auto simp: rtrancl_eq_or_trancl funas_term_subst ground_subst_apply vars_term_empty_ground\n      dest!: remove_const_subst_steps_rhs[OF lin fresh const] split: if_splits)\n\n\ntext \\<open>Main lemmas\\<close>\nlemma const_subst_eq_ground_eq:\n  assumes \"s \\<cdot> const_subst c = t \\<cdot> const_subst d\" \"c \\<noteq> d\"\n    and \"(c, 0) \\<notin> funas_term t\" \"(d, 0) \\<notin> funas_term s\"\n  shows \"s = t\" using assms\nproof (induct s arbitrary: t)\n  case (Var x) then show ?case by (cases t) auto\nnext\n  case (Fun f ts)\n  from Fun(2-) obtain g us where [simp]: \"t = Fun g us\" by (cases t) auto\n  have [simp]: \"g = f\" and l: \"length ts = length us\" using Fun(2)\n    by (auto intro: map_eq_imp_length_eq)\n  have \"i < length ts \\<Longrightarrow> ts ! i = us ! i\" for i\n    using Fun(1)[OF nth_mem, of i \"us ! i\" for i] Fun(2-) l\n    by (auto simp: map_eq_conv')\n  then show ?case using l\n    by (auto intro: nth_equalityI)\nqed\n\n\nlemma remove_const_subst_steps:\n  assumes \"linear_sys \\<R>\" and  \"(c, 0) \\<notin> funas_rel \\<R>\" and \"(d, 0) \\<notin> funas_rel \\<R>\"\n    and \"c \\<noteq> d\" \"(c, 0) \\<notin> funas_term t\" \"(d, 0) \\<notin> funas_term s\"\n    and \"(s \\<cdot> const_subst c, t \\<cdot> const_subst d) \\<in> (rstep \\<R>)\\<^sup>*\"\n  shows \"(s, t) \\<in> (rstep \\<R>)\\<^sup>*\"\nproof (cases \"s \\<cdot> const_subst c = t \\<cdot> const_subst d\")\n  case True\n  from const_subst_eq_ground_eq[OF this] assms(4 - 6) show ?thesis by auto\nnext\n  case False\n  then have step: \"(s \\<cdot> const_subst c, t \\<cdot> const_subst d) \\<in> (rstep \\<R>)\\<^sup>+\" using assms(7)\n    by (auto simp: rtrancl_eq_or_trancl)\n  then have \"(s, t \\<cdot> const_subst d) \\<in> (rstep \\<R>)\\<^sup>+\" using assms\n    by (intro remove_const_subst_steps_lhs[OF _ _ _ step]) (auto simp: funas_term_subst)\n  from remove_const_subst_steps_rhs[OF _ _ _ this] show ?thesis using assms\n    by auto\nqed\n\nlemma remove_const_subst_relcomp_lhs:\n  assumes sys: \"linear_sys \\<R>\" \"linear_sys \\<S>\"\n    and fr: \"(c, 0) \\<notin> funas_rel \\<R>\" and fs:\"(c, 0) \\<notin> funas_rel \\<S>\"\n    and funas: \"(c, 0) \\<notin> funas_term t\"\n    and seq: \"(s \\<cdot> const_subst c, t) \\<in> (rstep \\<R>)\\<^sup>* O (rstep \\<S>)\\<^sup>*\"\n  shows \"(s, t) \\<in> (rstep \\<R>)\\<^sup>* O (rstep \\<S>)\\<^sup>*\" using seq\n  using lin_fresh_rstep_const_replace_closed[OF sys(1) fr, THEN const_replace_closed_rtrancl]\n  using lin_fresh_rstep_const_replace_closed[OF sys(2) fs, THEN const_replace_closed_rtrancl]\n  using const_replace_closed_relcomp\n  by (intro const_replace_closed_remove_subst_lhs[OF _ funas seq]) force\n\nlemma remove_const_subst_relcomp_rhs:\n  assumes sys: \"linear_sys \\<R>\" \"linear_sys \\<S>\"\n    and fr: \"(c, 0) \\<notin> funas_rel \\<R>\" and fs:\"(c, 0) \\<notin> funas_rel \\<S>\"\n    and funas: \"(c, 0) \\<notin> funas_term s\"\n    and seq: \"(s, t \\<cdot> const_subst c) \\<in> (rstep \\<R>)\\<^sup>* O (rstep \\<S>)\\<^sup>*\"\n  shows \"(s, t) \\<in> (rstep \\<R>)\\<^sup>* O (rstep \\<S>)\\<^sup>*\"\nproof -\n  from seq have \"(t \\<cdot> const_subst c,s) \\<in> ((rstep \\<R>)\\<^sup>* O (rstep \\<S>)\\<^sup>*)\\<inverse>\"\n    by auto\n  then have \"(t \\<cdot> const_subst c,s) \\<in> ((rstep \\<S>)\\<^sup>*)\\<inverse> O ((rstep \\<R>)\\<^sup>*)\\<inverse>\"\n    using converse_relcomp by blast\n  note seq = this[unfolded rtrancl_converse[symmetric] rew_converse_inwards]\n  from sys fr fs have \"linear_sys (\\<S>\\<inverse>)\" \"linear_sys (\\<R>\\<inverse>)\" \"(c, 0) \\<notin> funas_rel (\\<S>\\<inverse>)\" \"(c, 0) \\<notin> funas_rel (\\<R>\\<inverse>)\"\n    by (auto simp: funas_rel_def)\n  from remove_const_subst_relcomp_lhs[OF this funas seq]\n  have \"(t, s) \\<in> (rstep (\\<S>\\<inverse>))\\<^sup>* O (rstep (\\<R>\\<inverse>))\\<^sup>*\" by simp\n  then show ?thesis\n    unfolding rew_converse_outwards converse_relcomp[symmetric]\n    by simp\nqed\n\n\nlemma remove_const_subst_relcomp:\n  assumes sys: \"linear_sys \\<R>\" \"linear_sys \\<S>\"\n    and fr: \"(c, 0) \\<notin> funas_rel \\<R>\" \"(d, 0) \\<notin> funas_rel \\<R>\"\n    and fs:\"(c, 0) \\<notin> funas_rel \\<S>\" \"(d, 0) \\<notin> funas_rel \\<S>\"\n    and diff: \"c \\<noteq> d\" and funas: \"(c, 0) \\<notin> funas_term t\" \"(d, 0) \\<notin> funas_term s\"\n    and seq: \"(s \\<cdot> const_subst c, t \\<cdot> const_subst d) \\<in> (rstep \\<R>)\\<^sup>* O (rstep \\<S>)\\<^sup>*\"\n  shows \"(s, t) \\<in> (rstep \\<R>)\\<^sup>* O (rstep \\<S>)\\<^sup>*\"\nproof -\n  from diff funas(1) have *: \"(c, 0) \\<notin> funas_term (t \\<cdot> const_subst d)\"\n    by (auto simp: funas_term_subst)\n  show ?thesis using remove_const_subst_relcomp_rhs[OF sys fr(2) fs(2) funas(2)\n        remove_const_subst_relcomp_lhs[OF sys fr(1) fs(1) * seq]]\n    by blast\nqed\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Rewrite_Properties_Reduction/Rewriting/Replace_Constant.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.33300471786567054}}
{"text": "theory GasAnalysis\n  imports \"RoboChart-Circus.RoboChart_Circus\"\nbegin\n\nutp_lit_vars\ntypedecl Chem\ntype_synonym Intensity = real\n\nsubsection \\<open> Enumerated Types \\<close>\n\ndatatype Angle = Left | Right | Back | Front\ndatatype Status = noGas | gasD\n\nsubsection \\<open> Data Types \\<close>\n\nrecord GasSensor =\n  c :: Chem\n  i :: Intensity\n\nsubsection \\<open> Functions \\<close>\n \nfunc analysis(gs :: \"GasSensor list\"):: Status\n\nfunc goreq(i1 :: Intensity, i2 :: Intensity):: bool  \n\nfunc angle(x :: nat) :: Angle\n\nfunc intensity(gs :: \"GasSensor list\") :: real\n  precondition \"#gs \\<ge> 0\"\n  postcondition \"\\<forall> x :: nat. 0 \\<le> x \\<and> x \\<le> #gs \\<longrightarrow> goreq(result, (i (gs ! x)))\"\n  postcondition \"\\<exists> y :: nat. 0 \\<le> y \\<and> y \\<le> #gs \\<longrightarrow> result = (i (gs ! y))\"\n\nfunc location(gs :: \"GasSensor list\") :: Angle\n  precondition \"#gs \\<ge> 0\"\n  postcondition \"\\<exists> x :: nat. 0 \\<le> x \\<and> x \\<le> #gs \\<longrightarrow> i (gs ! x) = intensity gs \\<and> result = angle(x)\"\n\nstm GasAnalysis =\n  const thr :: Intensity\n  var sts::Status gs::\"GasSensor list\"  ins::Intensity  anl::Angle\n  event resume stop  turn::Angle  gas::\"GasSensor list\"\n  initial InitState\n  state NoGas\n  state Reading\n  final FinalState\n  state Analysis [entry \"sts := analysis(gs)\"]\n  state GasDetected [entry \"ins := intensity(gs)\"]\n  transition t1 [frm InitState to NoGas action \"gs := [] ; anl := Front\"]\n  transition t2 [frm NoGas to Analysis trigger \"gas?(gs)\"]\n  transition t3 [frm Analysis to NoGas condition \"sts = noGas\" \n                 action \"resume\"]\n  transition t4 [frm Analysis to GasDetected condition \"sts = gasD\"]\n  transition t5 [frm GasDetected to FinalState \n                 condition \"goreq(ins, thr)\" action \"stop\"]\n  transition t6 [frm GasDetected to Reading condition \"\\<not> goreq(ins, thr)\" \n                 action \"anl := location(gs) ; turn!(anl)\"]\n  transition t7 [frm Reading to Analysis trigger \"gas?(gs)\"]\n\ncontext GasAnalysis\nbegin\n\nthm transitions\nthm nodes\nthm machine\nthm sm_defs\n\nthm nodes\n\nlemma \"dlockf \\<sqsubseteq> action\"\n  apply (simp add: action_def action_simp sm_sem Let_unfold usubst)\n  apply (simp add: action_rep_eq closure)\n  oops\n\n\nterm thr\n\nthm Analysis_def\n\nterm machine\nterm \"action\"\nterm sm_inters\n\nthm action_def\nthm sm_semantics_def\nthm machine_def\n\n\n\n\nend\n\n\nend", "meta": {"author": "isabelle-utp", "repo": "RoboChart-Isabelle", "sha": "4d7306d6791c195c081a918e5e249c3a9712be5c", "save_path": "github-repos/isabelle/isabelle-utp-RoboChart-Isabelle", "path": "github-repos/isabelle/isabelle-utp-RoboChart-Isabelle/RoboChart-Isabelle-4d7306d6791c195c081a918e5e249c3a9712be5c/Semantics/Circus_Semantics/examples/GasAnalysis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3328239933253469}}
{"text": "(*<*)\n(*\n * Copyright 2015, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory MarkObject\nimports\n  Handshakes\nbegin\n\n(*>*)\nsubsection\\<open>Object colours, reference validity, worklist validity\\<close>\n\ntext\\<open>\n\nWe adopt the classical tricolour scheme for object colours due to\n@{cite [cite_macro=citet] \"DBLP:journals/cacm/DijkstraLMSS78\"}, but\ntweak it somewhat in the presence of worklists and TSO. Intuitively:\n\\begin{description}\n\\item[White] potential garbage, not yet reached\n\\item[Grey] reached, presumed live, a source of possible new references (work)\n\\item[Black] reached, presumed live, not a source of new references\n\\end{description}\n\nIn this particular setting we use the following interpretation:\n\\begin{description}\n\\item[White:] not marked\n\\item[Grey:] on a worklist\n\\item[Black:] marked and not on a worklist\n\\end{description}\n\nNote that this allows the colours to overlap: an object being marked\nmay be white (on the heap) and in @{const \"ghost_honorary_grey\"} for\nsome process, i.e. grey.\n\n\\<close>\n\nabbreviation marked :: \"'ref \\<Rightarrow> ('field, 'mut, 'ref) lsts_pred\" where\n  \"marked r s \\<equiv> obj_at (\\<lambda>obj. obj_mark obj = sys_fM s) r s\"\n\nabbreviation white :: \"'ref \\<Rightarrow> ('field, 'mut, 'ref) lsts_pred\" where\n  \"white r s \\<equiv> obj_at (\\<lambda>obj. obj_mark obj = (\\<not>sys_fM s)) r s\"\n\ndefinition WL :: \"'mut process_name \\<Rightarrow> ('field, 'mut, 'ref) lsts \\<Rightarrow> 'ref set\" where\n  \"WL p \\<equiv> \\<lambda>s. W (s p) \\<union> ghost_honorary_grey (s p)\"\n\ndefinition grey :: \"'ref \\<Rightarrow> ('field, 'mut, 'ref) lsts_pred\" where\n  \"grey r \\<equiv> \\<^bold>\\<exists>p. \\<langle>r\\<rangle> \\<^bold>\\<in> WL p\"\n\ndefinition black :: \"'ref \\<Rightarrow> ('field, 'mut, 'ref) lsts_pred\" where\n  \"black r \\<equiv> marked r \\<^bold>\\<and> \\<^bold>\\<not>(grey r)\"\n\ntext\\<open>\n\nWe show that if a mutator can load a reference into its roots (its\nworking set of references), then there is an object in the heap at\nthat reference.\n\nIn this particular collector, we can think of grey references and\npending TSO heap mutations as extra mutator roots; in particular the\nGC holds no roots itself but marks everything reachable from its\nworklist, and so we need to know these objects exist. By the strong\ntricolour invariant (\\S\\ref{sec:strong-tricolour-invariant}), black\nobjects point to black or grey objects, and so we do not need to treat\nthese specially.\n\n\\<close>\n\nabbreviation write_refs :: \"('field, 'ref) mem_write_action \\<Rightarrow> 'ref set\" where\n  \"write_refs w \\<equiv> case w of mw_Mutate r f r' \\<Rightarrow> {r} \\<union> Option.set_option r' | _ \\<Rightarrow> {}\"\n\ndefinition (in mut_m) tso_write_refs :: \"('field, 'mut, 'ref) lsts \\<Rightarrow> 'ref set\" where\n  \"tso_write_refs = (\\<lambda>s. \\<Union>w \\<in> set (sys_mem_write_buffers (mutator m) s). write_refs w)\"\n\ndefinition (in mut_m) reachable :: \"'ref \\<Rightarrow> ('field, 'mut, 'ref) lsts_pred\" where\n  \"reachable y = (\\<^bold>\\<exists>x. \\<langle>x\\<rangle> \\<^bold>\\<in> mut_roots \\<^bold>\\<union> mut_ghost_honorary_root \\<^bold>\\<union> tso_write_refs\n                    \\<^bold>\\<and> x reaches y)\"\n\ndefinition grey_reachable :: \"'ref \\<Rightarrow> ('field, 'mut, 'ref) lsts_pred\" where\n  \"grey_reachable y = (\\<^bold>\\<exists>g. grey g \\<^bold>\\<and> g reaches y)\"\n\ndefinition valid_refs_inv :: \"('field, 'mut, 'ref) lsts_pred\" where\n \"valid_refs_inv = (\\<^bold>\\<forall>x. ((\\<^bold>\\<exists>m. mut_m.reachable m x) \\<^bold>\\<or> grey_reachable x) \\<^bold>\\<longrightarrow> valid_ref x)\"\n\ntext\\<open>\n\n\\label{def:valid_W_inv}\n\nThe worklists track the grey objects. The following invariant asserts\nthat grey objects are marked on the heap except for a few steps near\nthe end of @{const \"mark_object_fn\"}, the processes' worklists and\n@{const \"ghost_honorary_grey\"}s are disjoint, and that pending marks\nare sensible.\n\nThe safety of the collector does not to depend on disjointness; we\ninclude it as proof that the single-threading of grey objects in the\nimplementation is sound.\n\n\\<close>\n\ndefinition valid_W_inv :: \"('field, 'mut, 'ref) lsts_pred\" where\n  \"valid_W_inv = (\\<^bold>\\<forall>p q r fl.\n    (r in_W p \\<^bold>\\<or> (sys_mem_lock \\<^bold>\\<noteq> \\<langle>Some p\\<rangle> \\<^bold>\\<and> r in_ghost_honorary_grey p) \\<^bold>\\<longrightarrow> marked r)\n  \\<^bold>\\<and> (\\<langle>p \\<noteq> q\\<rangle> \\<^bold>\\<longrightarrow> \\<^bold>\\<not>(\\<langle>r\\<rangle> \\<^bold>\\<in> WL p \\<^bold>\\<and> \\<langle>r\\<rangle> \\<^bold>\\<in> WL q))\n  \\<^bold>\\<and> (\\<^bold>\\<not>(r in_ghost_honorary_grey p \\<^bold>\\<and> r in_W q))\n  \\<^bold>\\<and> (EMPTY sys_ghost_honorary_grey)\n  \\<^bold>\\<and> (tso_pending_write p (mw_Mark r fl)\n       \\<^bold>\\<longrightarrow> ( \\<langle>fl\\<rangle> \\<^bold>= sys_fM\n             \\<^bold>\\<and> r in_ghost_honorary_grey p\n             \\<^bold>\\<and> tso_locked_by p\n             \\<^bold>\\<and> white r\n             \\<^bold>\\<and> tso_pending_mark p \\<^bold>= \\<langle>[mw_Mark r fl]\\<rangle> )))\"\n\n(*<*)\n\nlemma obj_at_mark_dequeue[simp]:\n  \"obj_at P r (s(sys := s sys\\<lparr> heap := (sys_heap s)(r' := Option.map_option (obj_mark_update (\\<lambda>_. fl)) (sys_heap s r')), mem_write_buffers := wb' \\<rparr>))\n\\<longleftrightarrow> (r = r' \\<longrightarrow> obj_at (\\<lambda>obj. (P (obj\\<lparr> obj_mark := fl \\<rparr>))) r s) \\<and> (r \\<noteq> r' \\<longrightarrow> obj_at P r s)\"\nby (clarsimp split: obj_at_splits)\n\nlemma marked_not_white:\n  \"white r s \\<Longrightarrow> \\<not>marked r s\"\nby (clarsimp split: obj_at_splits)\n\nlemma valid_ref_valid_null_ref_simps[simp]:\n  \"valid_ref r (s(sys := do_write_action w (s sys)\\<lparr>mem_write_buffers := (mem_write_buffers (s sys))(p := ws)\\<rparr>)) \\<longleftrightarrow> valid_ref r s\"\n  \"valid_null_ref r' (s(sys := do_write_action w (s sys)\\<lparr>mem_write_buffers := (mem_write_buffers (s sys))(p := ws)\\<rparr>)) \\<longleftrightarrow> valid_null_ref r' s\"\n  \"valid_null_ref r' (s(mutator m := mut_s', sys := (s sys)\\<lparr> heap := (heap (s sys))(r'' \\<mapsto> obj) \\<rparr>)) \\<longleftrightarrow> valid_null_ref r' s \\<or> r' = Some r''\"\nby (auto simp: do_write_action_def valid_null_ref_def\n        split: mem_write_action.splits obj_at_splits option.splits)\n\ntext\\<open>points to, reaches, reachable mut, reachable grey\\<close>\n\nlemma reaches_fields:\n  assumes \"(x reaches y) s'\"\n  assumes \"\\<forall>r. (Option.set_option (sys_heap s' r) \\<bind> ran \\<circ> obj_fields) = (Option.set_option (sys_heap s r) \\<bind> ran \\<circ> obj_fields)\"\n  shows \"(x reaches y) s\"\nusing assms\nproof induct\n  case (step y z)\n  then have \"(y points_to z) s\"\n    by (cases \"sys_heap s y\")\n       (auto simp: ran_def obj_at_def split: option.splits dest!: spec[where x=y])\n  with step show ?case by (blast intro: rtranclp.intros(2))\nqed simp\n\nlemma reaches_eq_imp:\n  \"eq_imp (\\<lambda>r s. Option.set_option (sys_heap s r) \\<bind> ran \\<circ> obj_fields)\n          (x reaches y)\"\nby (auto simp: eq_imp_def elim: reaches_fields)\n\nlemmas reaches_fun_upd[simp] = eq_imp_fun_upd[OF reaches_eq_imp, simplified eq_imp_simps, rule_format]\n\nlemma (in mut_m) reachable_eq_imp:\n  \"eq_imp (\\<lambda>r'. mut_roots \\<^bold>\\<otimes> mut_ghost_honorary_root \\<^bold>\\<otimes> (\\<lambda>s. Option.set_option (sys_heap s r') \\<bind> ran \\<circ> obj_fields) \\<^bold>\\<otimes> tso_pending_mutate (mutator m))\n          (reachable r)\"\napply (clarsimp simp: eq_imp_def reachable_def tso_write_refs_def ex_disj_distrib)\napply (rename_tac s s')\napply (subgoal_tac \"\\<forall>r'. (\\<exists>w\\<in>set (sys_mem_write_buffers (mutator m) s). r' \\<in> write_refs w) \\<longleftrightarrow> (\\<exists>w\\<in>set (sys_mem_write_buffers (mutator m) s'). r' \\<in> write_refs w)\")\n apply (subgoal_tac \"\\<forall>x. (x reaches r) s \\<longleftrightarrow> (x reaches r) s'\")\n  apply clarsimp\n apply (auto simp: reaches_fields)[1]\napply (drule arg_cong[where f=set])\napply (clarsimp simp: set_eq_iff)\napply (rule iffI)\n apply clarsimp\n apply (rename_tac s s' r' w)\n apply (drule_tac x=w in spec)\n apply (rule_tac x=w in bexI)\n  apply clarsimp\n apply (case_tac w, simp_all)\napply clarsimp\napply (rename_tac s s' r' w)\napply (drule_tac x=w in spec)\napply (rule_tac x=w in bexI)\n apply clarsimp\napply (case_tac w, simp_all)\ndone\n\nlemmas reachable_fun_upd[simp] = eq_imp_fun_upd[OF mut_m.reachable_eq_imp, simplified eq_imp_simps, rule_format]\n\nlemma reachableI[intro]:\n  \"x \\<in> mut_m.mut_roots m s \\<Longrightarrow> mut_m.reachable m x s\"\n  \"x \\<in> mut_m.tso_write_refs m s \\<Longrightarrow> mut_m.reachable m x s\"\nby (auto simp: mut_m.reachable_def)\n\nlemma reachableE:\n  \"\\<lbrakk> (x points_to y) s; mut_m.reachable m x s \\<rbrakk> \\<Longrightarrow> mut_m.reachable m y s\"\nby (auto simp: mut_m.reachable_def\n         elim: rtranclp.intros(2))\n\nlemma (in mut_m) reachable_induct[consumes 1, case_names root ghost_honorary_root tso_root reaches]:\n  assumes r: \"reachable y s\"\n  assumes root: \"\\<And>x. \\<lbrakk> x \\<in> mut_roots s \\<rbrakk> \\<Longrightarrow> P x\"\n  assumes ghost_honorary_root: \"\\<And>x. \\<lbrakk> x \\<in> mut_ghost_honorary_root s \\<rbrakk> \\<Longrightarrow> P x\"\n  assumes tso_root: \"\\<And>x. \\<lbrakk> x \\<in> tso_write_refs s \\<rbrakk> \\<Longrightarrow> P x\"\n  assumes reaches: \"\\<And>x y. \\<lbrakk> reachable x s; (x points_to y) s; P x \\<rbrakk> \\<Longrightarrow> P y\"\n  shows \"P y\"\nusing r unfolding reachable_def\nproof(clarify)\n  fix x\n  assume xy: \"(x reaches y) s\" and xr: \"x \\<in> mut_roots s \\<union> mut_ghost_honorary_root s \\<union> tso_write_refs s\"\n  then show \"P y\"\n  proof induct\n    case base with root ghost_honorary_root tso_root show ?case by blast\n  next\n    case (step y z) with reaches show ?case\n      unfolding reachable_def by blast\n  qed\nqed\n\nlemmas reachable_induct = mut_m.reachable_induct[consumes 1, case_names root ghost_honorary_root tso_root reaches]\n\nlemma (in mut_m) mut_reachableE[consumes 1, case_names mut_root tso_write_refs]:\n  \"\\<lbrakk> reachable y s;\n     \\<And>x. \\<lbrakk> (x reaches y) s; x \\<in> mut_roots s \\<rbrakk> \\<Longrightarrow> Q;\n     \\<And>x. \\<lbrakk> (x reaches y) s; x \\<in> mut_ghost_honorary_root s \\<rbrakk> \\<Longrightarrow> Q;\n     \\<And>x. \\<lbrakk> (x reaches y) s; x \\<in> tso_write_refs s \\<rbrakk> \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\nby (auto simp: reachable_def)\n\nlemma grey_reachable_eq_imp:\n  \"eq_imp (\\<lambda>r'. (\\<lambda>s. \\<Union>p. WL p s) \\<^bold>\\<otimes> (\\<lambda>s. Option.set_option (sys_heap s r') \\<bind> ran \\<circ> obj_fields))\n          (grey_reachable r)\"\nby (auto simp: eq_imp_def grey_reachable_def grey_def set_eq_iff reaches_fields)\n\nlemmas grey_reachable_fun_upd[simp] = eq_imp_fun_upd[OF grey_reachable_eq_imp, simplified eq_imp_simps, rule_format]\n\nlemma grey_reachableI[intro]:\n  \"grey g s \\<Longrightarrow> grey_reachable g s\"\nby (auto simp: grey_reachable_def)\n\nlemma grey_reachableE:\n  \"\\<lbrakk> (g points_to y) s; grey_reachable g s \\<rbrakk> \\<Longrightarrow> grey_reachable y s\"\nby (auto simp: grey_reachable_def\n         elim: rtranclp.intros(2))\n\ntext\\<open>colours and work lists\\<close>\n\nlemma black_eq_imp:\n  \"eq_imp (\\<lambda>_::unit. (\\<lambda>s. r \\<in> (\\<Union>p. WL p s)) \\<^bold>\\<otimes> sys_fM \\<^bold>\\<otimes> (\\<lambda>s. Option.map_option obj_mark (sys_heap s r)))\n          (black r)\"\nby (auto simp add: eq_imp_def black_def grey_def obj_at_def split: option.splits)\n\nlemma white_eq_imp:\n  \"eq_imp (\\<lambda>_::unit. sys_fM \\<^bold>\\<otimes> (\\<lambda>s. Option.map_option obj_mark (sys_heap s r)))\n          (white r)\"\nby (auto simp add: eq_imp_def obj_at_def split: option.splits)\n\nlemma grey_eq_imp:\n  \"eq_imp (\\<lambda>_::unit. (\\<lambda>s. r \\<in> (\\<Union>p. WL p s)))\n          (grey r)\"\nby (auto simp add: eq_imp_def grey_def)\n\nlemmas black_fun_upd[simp] = eq_imp_fun_upd[OF black_eq_imp, simplified eq_imp_simps, rule_format]\nlemmas grey_fun_upd[simp] = eq_imp_fun_upd[OF grey_eq_imp, simplified eq_imp_simps, rule_format]\nlemmas white_fun_upd[simp] = eq_imp_fun_upd[OF white_eq_imp, simplified eq_imp_simps, rule_format]\n\ntext\\<open> These demonstrate the overlap in colours. \\<close>\n\nlemma colours_distinct[dest]:\n  \"black r s \\<Longrightarrow> \\<not>grey r s\"\n  \"black r s \\<Longrightarrow> \\<not>white r s\"\n  \"grey r s  \\<Longrightarrow> \\<not>black r s\"\n  \"white r s \\<Longrightarrow> \\<not>black r s\"\nby (auto simp: black_def split: obj_at_splits)\n\nlemma marked_imp_black_or_grey:\n  \"marked r s \\<Longrightarrow> black r s \\<or> grey r s\"\n  \"\\<not> white r s \\<Longrightarrow> \\<not> valid_ref r s \\<or> black r s \\<or> grey r s\"\nby (auto simp: black_def grey_def split: obj_at_splits)\n\nlemma blackD[dest]:\n  \"black r s \\<Longrightarrow> marked r s\"\n  \"black r s \\<Longrightarrow> r \\<notin> WL p s\"\nby (simp_all add: black_def grey_def)\n\ntext\\<open>valid refs inv\\<close>\n\nlemma valid_refs_inv_eq_imp:\n  \"eq_imp (\\<lambda>(m', r'). (\\<lambda>s. roots (s (mutator m'))) \\<^bold>\\<otimes> (\\<lambda>s. ghost_honorary_root (s (mutator m'))) \\<^bold>\\<otimes> (\\<lambda>s. Option.map_option obj_fields (sys_heap s r')) \\<^bold>\\<otimes> tso_pending_mutate (mutator m') \\<^bold>\\<otimes> (\\<lambda>s. \\<Union>p. WL p s))\n          valid_refs_inv\"\napply (clarsimp simp: eq_imp_def valid_refs_inv_def grey_reachable_def all_conj_distrib)\napply (rename_tac s s')\napply (subgoal_tac \"\\<forall>r. valid_ref r s \\<longleftrightarrow> valid_ref r s'\")\n apply (subgoal_tac \"\\<forall>x. Option.set_option (sys_heap s x) \\<bind> ran \\<circ> obj_fields = Option.set_option (sys_heap s' x) \\<bind> ran \\<circ> obj_fields\")\n  apply (subst eq_impD[OF mut_m.reachable_eq_imp])\n   defer\n   apply (subst eq_impD[OF grey_eq_imp])\n    defer\n    apply (subst eq_impD[OF reaches_eq_imp])\n     defer\n     apply force\n    apply clarsimp\n    apply (rename_tac x)\n    apply (drule_tac x=x in spec)\n    apply (clarsimp simp: set_eq_iff ran_def)\n    apply (case_tac \"sys_heap s x\", simp_all)[1]\n    apply (metis (hide_lams, no_types) elem_set not_Some_eq option.inject map_option_eq_Some)\n   apply (clarsimp split: obj_at_splits)\n   apply (rule conjI)\n    apply (metis map_option_is_None)\n   apply (metis map_option_eq_Some)\n  apply clarsimp\n apply clarsimp\napply clarsimp\ndone\n\nlemmas valid_refs_inv_fun_upd[simp] = eq_imp_fun_upd[OF valid_refs_inv_eq_imp, simplified eq_imp_simps, rule_format]\n\nlemma valid_refs_invD[elim]:\n  \"\\<lbrakk> x \\<in> mut_m.mut_roots m s; (x reaches y) s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> valid_ref y s\"\n  \"\\<lbrakk> x \\<in> mut_m.mut_roots m s; (x reaches y) s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> \\<exists>obj. sys_heap s y = Some obj\"\n  \"\\<lbrakk> x \\<in> mut_m.tso_write_refs m s; (x reaches y) s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> valid_ref y s\"\n  \"\\<lbrakk> x \\<in> mut_m.tso_write_refs m s; (x reaches y) s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> \\<exists>obj. sys_heap s y = Some obj\"\n  \"\\<lbrakk> w \\<in> set (sys_mem_write_buffers (mutator m) s); x \\<in> write_refs w; (x reaches y) s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> valid_ref y s\"\n  \"\\<lbrakk> w \\<in> set (sys_mem_write_buffers (mutator m) s); x \\<in> write_refs w; (x reaches y) s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> \\<exists>obj. sys_heap s y = Some obj\"\n  \"\\<lbrakk> grey x s; (x reaches y) s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> valid_ref y s\"\n  \"\\<lbrakk> mut_m.reachable m x s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> valid_ref x s\"\n  \"\\<lbrakk> mut_m.reachable m x s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> \\<exists>obj. sys_heap s x = Some obj\"\n  \"\\<lbrakk> x \\<in> mut_m.mut_ghost_honorary_root m s; (x reaches y) s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> valid_ref y s\"\n  \"\\<lbrakk> x \\<in> mut_m.mut_ghost_honorary_root m s; (x reaches y) s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> \\<exists>obj. sys_heap s y = Some obj\"\nby (fastforce simp: valid_refs_inv_def grey_reachable_def mut_m.reachable_def mut_m.tso_write_refs_def\n             split: obj_at_splits)+\n\nlemma valid_refs_invD2[elim]:\n  \"\\<lbrakk> mut_m.reachable m x s;  valid_refs_inv s; (x reaches y) s \\<rbrakk> \\<Longrightarrow> valid_ref y s\"\napply (clarsimp simp: valid_refs_inv_def mut_m.reachable_def)\napply (frule (1) rtranclp_trans)\napply auto\ndone\n\nlemma valid_refs_invD3:\n  \"\\<lbrakk> sys_mem_write_buffers (mutator m) s = mw_Mutate r f opt_r' # ws; (r reaches y) s; valid_refs_inv s \\<rbrakk> \\<Longrightarrow> valid_ref y s\"\napply (clarsimp simp: valid_refs_inv_def mut_m.reachable_def mut_m.tso_write_refs_def)\napply (fastforce dest: spec[where x=y] spec[where x=m])\ndone\n\ntext\\<open>WL\\<close>\n\nlemma WLI[intro]:\n  \"r \\<in> W (s p) \\<Longrightarrow> r \\<in> WL p s\"\n  \"r \\<in> ghost_honorary_grey (s p) \\<Longrightarrow> r \\<in> WL p s\"\nby (simp_all add: WL_def)\n\nlemma WL_eq_imp:\n  \"eq_imp (\\<lambda>(_::unit) s. (ghost_honorary_grey (s p), W (s p)))\n          (WL p)\"\nby (clarsimp simp: eq_imp_def WL_def)\n\nlemmas WL_fun_upd[simp] = eq_imp_fun_upd[OF WL_eq_imp, simplified eq_imp_simps, rule_format]\n\nlemma greyI[intro]:\n  \"r \\<in> ghost_honorary_grey (s p) \\<Longrightarrow> grey r s\"\n  \"r \\<in> W (s p) \\<Longrightarrow> grey r s\"\n  \"r \\<in> WL p s \\<Longrightarrow> grey r s\"\nby (case_tac [!] p) (auto simp: grey_def WL_def)\n\ntext\\<open>@{const \"valid_W_inv\"}\\<close>\n\nlemma valid_W_inv_eq_imp:\n  \"eq_imp (\\<lambda>(p, r). (\\<lambda>s. W (s p)) \\<^bold>\\<otimes> (\\<lambda>s. ghost_honorary_grey (s p)) \\<^bold>\\<otimes> sys_fM \\<^bold>\\<otimes> (\\<lambda>s. Option.map_option obj_mark (sys_heap s r)) \\<^bold>\\<otimes> sys_mem_lock \\<^bold>\\<otimes> tso_pending_mark p)\n          valid_W_inv\"\napply (clarsimp simp: eq_imp_def valid_W_inv_def fun_eq_iff all_conj_distrib)\napply (rename_tac s s')\napply (subgoal_tac \"\\<forall>p. WL p s = WL p s'\")\n apply (subgoal_tac \"\\<forall>x. obj_at (\\<lambda>obj. obj_mark obj = sys_fM s') x s \\<longleftrightarrow> obj_at (\\<lambda>obj. obj_mark obj = sys_fM s') x s'\")\n  apply (subgoal_tac \"\\<forall>x. obj_at (\\<lambda>obj. obj_mark obj = (\\<not>sys_fM s')) x s \\<longleftrightarrow> obj_at (\\<lambda>obj. obj_mark obj = (\\<not>sys_fM s')) x s'\")\n   apply (subgoal_tac \"\\<forall>x xa xb. mw_Mark xa xb \\<in> set (sys_mem_write_buffers x s) \\<longleftrightarrow> mw_Mark xa xb \\<in> set (sys_mem_write_buffers x s')\")\n    apply simp\n   apply clarsimp\n   apply (rename_tac x xa xb)\n   apply (drule_tac x=x in spec, drule arg_cong[where f=set], fastforce)\n  apply (clarsimp split: obj_at_splits)\n  apply (rename_tac x)\n  apply ( (drule_tac x=x in spec)+ )[1]\n  apply (case_tac \"sys_heap s x\", simp_all)\n   apply (case_tac \"sys_heap s' x\", auto)[1]\n apply (clarsimp split: obj_at_splits)\n apply (rename_tac x)\n apply (drule_tac x=x in spec)\n apply (case_tac \"sys_heap s x\", simp_all)\n apply (case_tac \"sys_heap s' x\", simp_all)\napply (simp add: WL_def)\ndone\n\nlemmas valid_W_inv_fun_upd[simp] = eq_imp_fun_upd[OF valid_W_inv_eq_imp, simplified eq_imp_simps, rule_format]\n\nlemma valid_W_invD[dest]:\n  \"\\<lbrakk> r \\<in> W (s p); valid_W_inv s \\<rbrakk> \\<Longrightarrow> marked r s\"\n  \"\\<lbrakk> r \\<in> W (s p); valid_W_inv s \\<rbrakk> \\<Longrightarrow> valid_ref r s\"\n  \"\\<lbrakk> r \\<in> WL p s;  valid_W_inv s; p \\<noteq> q \\<rbrakk> \\<Longrightarrow> r \\<notin> WL q s\"\n  \"\\<lbrakk> r \\<in> W (s p); valid_W_inv s; p \\<noteq> q \\<rbrakk> \\<Longrightarrow> r \\<notin> WL q s\"\n  \"\\<lbrakk> r \\<in> W (s p); valid_W_inv s \\<rbrakk> \\<Longrightarrow> r \\<notin> ghost_honorary_grey (s q)\"\n  \"\\<lbrakk> r \\<in> ghost_honorary_grey (s p); valid_W_inv s \\<rbrakk> \\<Longrightarrow> r \\<notin> W (s q)\"\n  \"\\<lbrakk> r \\<in> ghost_honorary_grey (s p); valid_W_inv s; p \\<noteq> q \\<rbrakk> \\<Longrightarrow> r \\<notin> WL q s\"\nby (auto simp: valid_W_inv_def WL_def split: obj_at_splits)\n\n(* FIXME horrible but effective (?) *)\nlemma valid_W_invD2[dest]:\n  \"\\<lbrakk> sys_mem_write_buffers p s = mw_Mark r fl # ws; valid_W_inv s \\<rbrakk>\n     \\<Longrightarrow> fl = sys_fM s \\<and> r \\<in> ghost_honorary_grey (s p) \\<and> tso_locked_by p s \\<and> white r s \\<and> filter is_mw_Mark ws = []\"\n  \"\\<lbrakk> mw_Mark r fl \\<in> set (sys_mem_write_buffers p s); valid_W_inv s \\<rbrakk>\n     \\<Longrightarrow> fl = sys_fM s \\<and> r \\<in> ghost_honorary_grey (s p) \\<and> tso_locked_by p s \\<and> white r s \\<and> filter is_mw_Mark (sys_mem_write_buffers p s) = [mw_Mark r fl]\"\nby (clarsimp simp: valid_W_inv_def dest!: spec[where x=p], blast)+\n\nlemma valid_W_invD3[elim]:\n  \"\\<lbrakk> mw_Mark r fl \\<in> set (sys_mem_write_buffers p s); valid_W_inv s \\<rbrakk> \\<Longrightarrow> r \\<in> ghost_honorary_grey (s p)\"\n  \"\\<lbrakk> r \\<in> ghost_honorary_grey (s p); sys_mem_lock s \\<noteq> Some p; valid_W_inv s \\<rbrakk> \\<Longrightarrow> marked r s\"\n  \"\\<lbrakk> r \\<in> ghost_honorary_grey (s p); sys_mem_lock s \\<noteq> Some p; valid_W_inv s \\<rbrakk> \\<Longrightarrow> valid_ref r s\"\napply (simp_all add: valid_W_inv_def)\napply (clarsimp split: obj_at_splits)\napply blast\ndone\n\nlemma valid_W_invD4:\n  \"\\<lbrakk> sys_mem_write_buffers p s = mw_Mutate r' f r'' # ws; mw_Mark r fl \\<in> set ws; valid_W_inv s \\<rbrakk>\n     \\<Longrightarrow> fl = sys_fM s \\<and> r \\<in> ghost_honorary_grey (s p) \\<and> tso_locked_by p s \\<and> white r s \\<and> filter is_mw_Mark ws = [mw_Mark r fl]\"\n  \"\\<lbrakk> sys_mem_write_buffers p s = mw_fA fl' # ws; mw_Mark r fl \\<in> set ws; valid_W_inv s \\<rbrakk>\n     \\<Longrightarrow> fl = sys_fM s \\<and> r \\<in> ghost_honorary_grey (s p) \\<and> tso_locked_by p s \\<and> white r s \\<and> filter is_mw_Mark ws = [mw_Mark r fl]\"\n  \"\\<lbrakk> sys_mem_write_buffers p s = mw_fM fl' # ws; mw_Mark r fl \\<in> set ws; valid_W_inv s \\<rbrakk>\n     \\<Longrightarrow> fl = sys_fM s \\<and> r \\<in> ghost_honorary_grey (s p) \\<and> tso_locked_by p s \\<and> white r s \\<and> filter is_mw_Mark ws = [mw_Mark r fl]\"\n  \"\\<lbrakk> sys_mem_write_buffers p s = mw_Phase ph # ws; mw_Mark r fl \\<in> set ws; valid_W_inv s \\<rbrakk>\n     \\<Longrightarrow> fl = sys_fM s \\<and> r \\<in> ghost_honorary_grey (s p) \\<and> tso_locked_by p s \\<and> white r s \\<and> filter is_mw_Mark ws = [mw_Mark r fl]\"\nby (clarsimp simp: valid_W_inv_def dest!: spec[where x=p], blast)+\n\nlemma valid_W_iff[iff]:\n  \"valid_W_inv s \\<Longrightarrow> sys_ghost_honorary_grey s = {}\"\nby (simp add: valid_W_inv_def)\n\nlemma valid_W_inv_no_mark_writes_invD:\n  \"\\<lbrakk> sys_mem_lock s \\<noteq> Some p; valid_W_inv s \\<rbrakk>\n     \\<Longrightarrow> tso_pending p is_mw_Mark s = []\"\nby (auto intro!: filter_False)\n\nlemma valid_W_inv_sys_read[simp]:\n  \"\\<lbrakk> sys_mem_lock s \\<noteq> Some p; valid_W_inv s \\<rbrakk>\n     \\<Longrightarrow> sys_read p (mr_Mark r) (s sys) = mv_Mark (Option.map_option obj_mark (sys_heap s r))\"\napply (clarsimp simp: sys_read_def fold_writes_def)\napply (rule fold_invariant[where P=\"\\<lambda>fr. Option.map_option obj_mark (heap (fr (s sys)) r) = Option.map_option obj_mark (sys_heap s r)\"\n                             and Q=\"\\<lambda>w. \\<forall>r fl. w \\<noteq> mw_Mark r fl\"])\n  apply (auto simp: Option.map_option_case do_write_action_def filter_empty_conv\n             split: mem_write_action.splits option.splits)\ndone\n\n(*>*)\nsubsection\\<open>Mark Object\\<close>\n\ntext\\<open>\n\nLocal invariants for @{const \"mark_object_fn\"}. Invoking this code in\nphases where @{const \"sys_fM\"} is constant marks the reference in\n@{const \"ref\"}. When @{const \"sys_fM\"} could vary this code is not\ncalled. The two cases are distinguished by @{term \"p_ph_enabled\"}.\n\nEach use needs to provide extra facts to justify validity of\nreferences, etc.  We do not include a post-condition for @{const\n\"mark_object_fn\"} here as it is different at each call site.\n\n\\<close>\n\nlocale mark_object =\n  fixes p :: \"'mut process_name\"\n  fixes l :: \"location\"\n  fixes p_ph_enabled :: \"('field, 'mut, 'ref) lsts_pred\"\n  assumes p_ph_enabled_eq_imp: \"eq_imp (\\<lambda>(_::unit) s. s p) p_ph_enabled\"\nbegin\n\nabbreviation (input) \"p_cas_mark s \\<equiv> cas_mark (s p)\"\nabbreviation (input) \"p_mark s \\<equiv> mark (s p)\"\nabbreviation (input) \"p_fM s \\<equiv> fM (s p)\"\nabbreviation (input) \"p_ghost_handshake_phase s \\<equiv> ghost_handshake_phase (s p)\"\nabbreviation (input) \"p_ghost_honorary_grey s \\<equiv> ghost_honorary_grey (s p)\"\nabbreviation (input) \"p_ghost_handshake_in_sync s \\<equiv> ghost_handshake_in_sync (s p)\"\nabbreviation (input) \"p_phase s \\<equiv> phase (s p)\"\nabbreviation (input) \"p_ref s \\<equiv> ref (s p)\"\nabbreviation (input) \"p_the_ref \\<equiv> the \\<circ> p_ref\"\nabbreviation (input) \"p_W s \\<equiv> W (s p)\"\n\nabbreviation at_p :: \"location \\<Rightarrow> ('field, 'mut, 'ref) lsts_pred \\<Rightarrow> ('field, 'mut, 'ref) gc_pred\" where\n  \"at_p l' P \\<equiv> at p (l @ l') \\<^bold>\\<longrightarrow> LSTP P\"\n\nabbreviation (input) \"p_en_cond P \\<equiv> p_ph_enabled \\<^bold>\\<longrightarrow> P\"\n\nabbreviation (input) \"p_valid_ref \\<equiv> \\<^bold>\\<not>(NULL p_ref) \\<^bold>\\<and> valid_ref \\<^bold>$ p_the_ref\"\nabbreviation (input) \"p_tso_no_pending_mark \\<equiv> LIST_NULL (tso_pending_mark p)\"\nabbreviation (input) \"p_tso_no_pending_mutate \\<equiv> LIST_NULL (tso_pending_mutate p)\"\n\nabbreviation (input)\n  \"p_valid_W_inv \\<equiv> ((p_cas_mark \\<^bold>\\<noteq> p_mark \\<^bold>\\<or> p_tso_no_pending_mark) \\<^bold>\\<longrightarrow> marked \\<^bold>$ p_the_ref)\n                \\<^bold>\\<and> (tso_pending_mark p \\<^bold>\\<in> (\\<lambda>s. {[], [mw_Mark (p_the_ref s) (p_fM s)]}) )\"\n\nabbreviation (input)\n  \"p_mark_inv \\<equiv> \\<^bold>\\<not>(NULL p_mark)\n            \\<^bold>\\<and> ((\\<lambda>s. obj_at (\\<lambda>obj. Some (obj_mark obj) = p_mark s) (p_the_ref s) s)\n              \\<^bold>\\<or> marked \\<^bold>$ p_the_ref)\"\n\nabbreviation (input)\n  \"p_cas_mark_inv \\<equiv> (\\<lambda>s. obj_at (\\<lambda>obj. Some (obj_mark obj) = p_cas_mark s) (p_the_ref s) s)\"\n\nabbreviation (input) \"p_valid_fM \\<equiv> p_fM \\<^bold>= sys_fM\"\n\nabbreviation (input)\n  \"p_ghg_eq_ref \\<equiv> p_ghost_honorary_grey \\<^bold>= pred_singleton (the \\<circ> p_ref)\"\nabbreviation (input)\n  \"p_ghg_inv \\<equiv> If p_cas_mark \\<^bold>= p_mark Then p_ghg_eq_ref Else EMPTY p_ghost_honorary_grey\"\n\ndefinition mark_object_invL :: \"('field, 'mut, 'ref) gc_pred\" where\n  \"mark_object_invL =\n   (at_p ''_mo_null''        \\<langle>True\\<rangle>\n  \\<^bold>\\<and> at_p ''_mo_mark''        (p_valid_ref)\n  \\<^bold>\\<and> at_p ''_mo_fM''          (p_valid_ref \\<^bold>\\<and> p_en_cond (p_mark_inv))\n  \\<^bold>\\<and> at_p ''_mo_mtest''       (p_valid_ref \\<^bold>\\<and> p_en_cond (p_mark_inv \\<^bold>\\<and> p_valid_fM))\n  \\<^bold>\\<and> at_p ''_mo_phase''       (p_valid_ref \\<^bold>\\<and> p_mark \\<^bold>\\<noteq> Some \\<circ> p_fM \\<^bold>\\<and> p_en_cond (p_mark_inv \\<^bold>\\<and> p_valid_fM))\n  \\<^bold>\\<and> at_p ''_mo_ptest''       (p_valid_ref \\<^bold>\\<and> p_mark \\<^bold>\\<noteq> Some \\<circ> p_fM \\<^bold>\\<and> p_en_cond (p_mark_inv \\<^bold>\\<and> p_valid_fM))\n  \\<^bold>\\<and> at_p ''_mo_co_lock''     (p_valid_ref \\<^bold>\\<and> p_mark_inv \\<^bold>\\<and> p_valid_fM \\<^bold>\\<and> p_mark \\<^bold>\\<noteq> Some \\<circ> p_fM \\<^bold>\\<and> p_tso_no_pending_mark)\n  \\<^bold>\\<and> at_p ''_mo_co_cmark''    (p_valid_ref \\<^bold>\\<and> p_mark_inv \\<^bold>\\<and> p_valid_fM \\<^bold>\\<and> p_mark \\<^bold>\\<noteq> Some \\<circ> p_fM \\<^bold>\\<and> p_tso_no_pending_mark)\n  \\<^bold>\\<and> at_p ''_mo_co_ctest''    (p_valid_ref \\<^bold>\\<and> p_mark_inv \\<^bold>\\<and> p_valid_fM \\<^bold>\\<and> p_mark \\<^bold>\\<noteq> Some \\<circ> p_fM \\<^bold>\\<and> p_cas_mark_inv \\<^bold>\\<and> p_tso_no_pending_mark)\n  \\<^bold>\\<and> at_p ''_mo_co_mark''     (p_cas_mark \\<^bold>= p_mark \\<^bold>\\<and> p_valid_ref \\<^bold>\\<and> p_valid_fM \\<^bold>\\<and> white \\<^bold>$ p_the_ref \\<^bold>\\<and> p_tso_no_pending_mark)\n  \\<^bold>\\<and> at_p ''_mo_co_unlock''   (p_ghg_inv \\<^bold>\\<and> p_valid_ref \\<^bold>\\<and> p_valid_fM \\<^bold>\\<and> p_valid_W_inv)\n  \\<^bold>\\<and> at_p ''_mo_co_won''      (p_ghg_inv \\<^bold>\\<and> p_valid_ref \\<^bold>\\<and> p_valid_fM \\<^bold>\\<and> marked \\<^bold>$ p_the_ref \\<^bold>\\<and> p_tso_no_pending_mutate)\n  \\<^bold>\\<and> at_p ''_mo_co_W''        (p_ghg_eq_ref \\<^bold>\\<and> p_valid_ref \\<^bold>\\<and> p_valid_fM \\<^bold>\\<and> marked \\<^bold>$ p_the_ref \\<^bold>\\<and> p_tso_no_pending_mutate))\"\n(*<*)\n\nlemma mark_object_invL_eq_imp:\n  \"eq_imp (\\<lambda>(_::unit) s. (AT s p, s\\<down> p, sys_heap s\\<down>, sys_fM s\\<down>, sys_mem_write_buffers p s\\<down>))\n          mark_object_invL\"\napply (clarsimp simp: eq_imp_def)\napply (rename_tac s s')\napply (cut_tac s=\"s\\<down>\" and s'=\"s'\\<down>\" in eq_impD[OF p_ph_enabled_eq_imp], simp)\napply (clarsimp simp: mark_object_invL_def obj_at_def\n                cong: option.case_cong)\ndone\n\nlemmas mark_object_invL_niE[nie] =\n  iffD1[OF mark_object_invL_eq_imp[simplified eq_imp_simps, rule_format, unfolded conj_explode], rotated -1]\n(*>*)\n\nend\n\ntext\\<open>\n\nThe uses of @{const \"mark_object_fn\"} in the GC and during the root\nmarking are straightforward.\n\n\\<close>\n(* FIXME we'd like:\n\nsublocale mut < get_roots: mark_object \"mutator mut\" \"''hs_get_roots_loop''\" .\n\nbut this doesn't seem to get promoted to the top-level, so we can't\nuse it in the other process locales.\n\nThis interpretation promotes the [inv] attribute to the top-level.\n\n*)\ninterpretation gc_mark: mark_object \"gc\" \"''mark_loop''\" \"\\<langle>True\\<rangle>\"\n  by standard (simp add: eq_imp_def)\n\nlemmas gc_mark_mark_object_invL_def2[inv] = gc_mark.mark_object_invL_def[simplified]\n\ninterpretation mut_get_roots: mark_object \"mutator m\" \"''hs_get_roots_loop''\" \"\\<langle>True\\<rangle>\" for m\n  by standard (simp add: eq_imp_def)\n\nlemmas mut_get_roots_mark_object_invL_def2[inv] = mut_get_roots.mark_object_invL_def[simplified]\n\ntext\\<open>\n\nThe most interesting cases are the two asynchronous uses of @{const\n\"mark_object_fn\"} in the mutators: we need something that holds even\nbefore we read the phase. In particular we need to avoid interference\nby an @{const \"fM\"} flip.\n\n\\<close>\n\ninterpretation mut_store_del: mark_object \"mutator m\" \"''store_del''\" \"mut_m.mut_ghost_handshake_phase m \\<^bold>\\<noteq> \\<langle>hp_Idle\\<rangle>\" for m\n  by standard (simp add: eq_imp_def)\n\nlemmas mut_store_del_mark_object_invL_def2[inv] = mut_store_del.mark_object_invL_def[simplified]\n\ninterpretation mut_store_ins: mark_object \"mutator m\" \"''store_ins''\"  \"mut_m.mut_ghost_handshake_phase m \\<^bold>\\<noteq> \\<langle>hp_Idle\\<rangle>\" for m\n  by standard (simp add: eq_imp_def)\n\nlemmas mut_store_ins_mark_object_invL_def2[inv] = mut_store_ins.mark_object_invL_def[simplified]\n\ntext\\<open>\n\nLocal invariant for the mutator's uses of @{term \"mark_object\"}.\n\n\\<close>\n\nlocset_definition \"mut_hs_get_roots_loop_locs = prefixed ''hs_get_roots_loop''\"\nlocset_definition \"mut_hs_get_roots_loop_mo_locs =\n  prefixed ''hs_get_roots_loop_mo'' \\<union> {''hs_get_roots_loop_done''}\"\n\nabbreviation \"mut_async_mark_object_prefixes \\<equiv> { ''store_del'', ''store_ins'' }\"\n\nlocset_definition \"mut_hs_not_hp_Idle_locs =\n  (\\<Union>pref\\<in>mut_async_mark_object_prefixes.\n     \\<Union>l\\<in>{''mo_co_lock'', ''mo_co_cmark'', ''mo_co_ctest'', ''mo_co_mark'', ''mo_co_unlock'', ''mo_co_won'', ''mo_co_W''}. {pref @ ''_'' @ l})\"\n\nlocset_definition \"mut_async_mo_ptest_locs =\n  (\\<Union>pref\\<in>mut_async_mark_object_prefixes. {pref @ ''_mo_ptest''})\"\n\nlocset_definition \"mut_mo_ptest_locs =\n  (\\<Union>pref\\<in>mut_async_mark_object_prefixes. {pref @ ''_mo_ptest''})\"\n\nlocset_definition \"mut_mo_valid_ref_locs =\n  (prefixed ''store_del'' \\<union> prefixed ''store_ins'' \\<union> { ''deref_del'', ''lop_store_ins''})\"\n(*<*)\n\nlemma mut_hs_get_roots_loop_locs_subseteq_hs_get_roots:\n  \"mut_hs_get_roots_loop_locs \\<subseteq> prefixed ''hs_get_roots_''\"\nby (auto simp: mut_hs_get_roots_loop_locs_def intro: append_prefixD)\n\nlemma mut_m_ghost_handshake_phase_not_hp_Idle:\n  \"\\<lbrakk> atS (mutator m) mut_hs_get_roots_loop_locs s; mut_m.handshake_invL m s; handshake_phase_inv s\\<down> \\<rbrakk>\n     \\<Longrightarrow> ghost_handshake_phase (s\\<down> (mutator m)) \\<noteq> hp_Idle\"\nunfolding mut_m.handshake_invL_def\napply (elim conjE)\napply (drule mut_m.handshake_phase_invD[where m=m])\napply (drule mp, erule atS_mono[OF _ mut_hs_get_roots_loop_locs_subseteq_hs_get_roots])\napply (clarsimp simp: hp_step_rel_def)\ndone\n\n(*>*)\ntext\\<open>\n\nThis local invariant for the mutators illustrates the handshake\nstructure: we can rely on the insertion barrier earlier than on the\ndeletion barrier. Both need to be installed before \\<open>get_roots\\<close>\nto ensure we preserve the strong tricolour invariant. All black\nobjects at that point are allocated: we need to know that the\ninsertion barrier is installed to preserve it. This limits when \\<open>fA\\<close> can be set.\n\nIt is interesting to contrast the two barriers. Intuitively a mutator\ncan locally guarantee that it, in the relevant phases, will insert\nonly marked references. Less often can it be sure that the reference\nit is overwriting is marked. We also need to consider writes pending\nin TSO buffers: it is key that after the \\<open>''init_noop''\\<close>\nhandshake there are no pending white insertions\n(mutations that insert unmarked references). This ensures the deletion barrier\ndoes its job.\n\n\\<close>\n\nlocset_definition\n  \"ghost_honorary_grey_empty_locs \\<equiv>\n     - (\\<Union>pref\\<in>{ ''mark_loop'', ''hs_get_roots_loop'', ''store_del'', ''store_ins'' }.\n        \\<Union>l\\<in>{ ''mo_co_unlock'', ''mo_co_won'', ''mo_co_W'' }. {pref @ ''_'' @ l})\"\n\nlocset_definition\n  \"ghost_honorary_root_empty_locs \\<equiv>\n     - (prefixed ''store_del'' \\<union> {''lop_store_ins''} \\<union> prefixed ''store_ins'')\"\n\ninv_definition (in mut_m) mark_object_invL :: \"('field, 'mut, 'ref) gc_pred\" where\n  \"mark_object_invL =\n   (atS_mut mut_hs_get_roots_loop_locs    (mut_refs \\<^bold>\\<subseteq> mut_roots \\<^bold>\\<and> (\\<^bold>\\<forall>r. \\<langle>r\\<rangle> \\<^bold>\\<in> mut_roots \\<^bold>- mut_refs \\<^bold>\\<longrightarrow> marked r))\n  \\<^bold>\\<and> atS_mut mut_hs_get_roots_loop_mo_locs (\\<^bold>\\<not>(NULL mut_ref) \\<^bold>\\<and> mut_the_ref \\<^bold>\\<in> mut_roots)\n  \\<^bold>\\<and> at_mut ''hs_get_roots_loop_done''     (marked \\<^bold>$ mut_the_ref)\n  \\<^bold>\\<and> at_mut ''hs_get_roots_loop_mo_ptest'' (mut_phase \\<^bold>\\<noteq> \\<langle>ph_Idle\\<rangle>)\n  \\<^bold>\\<and> at_mut ''hs_get_roots_done''          (\\<^bold>\\<forall>r. \\<langle>r\\<rangle> \\<^bold>\\<in> mut_roots \\<^bold>\\<longrightarrow> marked r)\n\n  \\<^bold>\\<and> atS_mut mut_mo_valid_ref_locs         ( (\\<^bold>\\<not>(NULL mut_new_ref) \\<^bold>\\<longrightarrow> mut_the_new_ref \\<^bold>\\<in> mut_roots)\n                                          \\<^bold>\\<and> (mut_tmp_ref \\<^bold>\\<in> mut_roots) )\n  \\<^bold>\\<and> at_mut ''store_del_mo_null''          (\\<^bold>\\<not>(NULL mut_ref) \\<^bold>\\<longrightarrow> mut_the_ref \\<^bold>\\<in> mut_ghost_honorary_root)\n  \\<^bold>\\<and> atS_mut (prefixed ''store_del'' - {''store_del_mo_null''}) (mut_the_ref \\<^bold>\\<in> mut_ghost_honorary_root)\n  \\<^bold>\\<and> atS_mut (prefixed ''store_ins'')      (mut_ref \\<^bold>= mut_new_ref)\n\n  \\<^bold>\\<and> atS_mut (suffixed ''_mo_ptest'')      (mut_phase \\<^bold>\\<noteq> \\<langle>ph_Idle\\<rangle> \\<^bold>\\<longrightarrow> mut_ghost_handshake_phase \\<^bold>\\<noteq> \\<langle>hp_Idle\\<rangle>)\n  \\<^bold>\\<and> atS_mut mut_hs_not_hp_Idle_locs       (mut_ghost_handshake_phase \\<^bold>\\<noteq> \\<langle>hp_Idle\\<rangle>)\n\n  \\<^bold>\\<and> atS_mut mut_mo_ptest_locs             (mut_phase \\<^bold>= \\<langle>ph_Idle\\<rangle> \\<^bold>\\<longrightarrow> (mut_ghost_handshake_phase \\<^bold>\\<in> \\<langle>{hp_Idle, hp_IdleInit}\\<rangle>\n                                                                          \\<^bold>\\<or> (mut_ghost_handshake_phase \\<^bold>= \\<langle>hp_IdleMarkSweep\\<rangle>\n                                                                                \\<^bold>\\<and> sys_phase \\<^bold>= \\<langle>ph_Idle\\<rangle>)))\n  \\<^bold>\\<and> atS_mut ghost_honorary_grey_empty_locs (EMPTY mut_ghost_honorary_grey)\n\\<comment> \\<open>insertion barrier\\<close>\n  \\<^bold>\\<and> at_mut ''store_ins''                  ( (mut_ghost_handshake_phase \\<^bold>\\<in> \\<langle>{hp_InitMark, hp_Mark}\\<rangle>\n                                            \\<^bold>\\<or> (mut_ghost_handshake_phase \\<^bold>= \\<langle>hp_IdleMarkSweep\\<rangle> \\<^bold>\\<and> sys_phase \\<^bold>\\<noteq> \\<langle>ph_Idle\\<rangle>))\n                                           \\<^bold>\\<and> \\<^bold>\\<not>(NULL mut_new_ref)\n                                           \\<^bold>\\<longrightarrow> marked \\<^bold>$ mut_the_new_ref )\n\\<comment> \\<open>deletion barrier\\<close>\n  \\<^bold>\\<and> atS_mut (prefixed ''store_del_mo'' \\<union> {''lop_store_ins''})\n                                          ( (mut_ghost_handshake_phase \\<^bold>= \\<langle>hp_Mark\\<rangle>\n                                            \\<^bold>\\<or> (mut_ghost_handshake_phase \\<^bold>= \\<langle>hp_IdleMarkSweep\\<rangle> \\<^bold>\\<and> sys_phase \\<^bold>\\<noteq> \\<langle>ph_Idle\\<rangle>))\n                                           \\<^bold>\\<and> (\\<lambda>s. \\<forall>opt_r'. \\<not>tso_pending_write (mutator m) (mw_Mutate (mut_tmp_ref s) (mut_field s) opt_r') s)\n                                          \\<^bold>\\<longrightarrow> (\\<lambda>s. obj_at_field_on_heap (\\<lambda>r. mut_ref s = Some r \\<or> marked r s) (mut_tmp_ref s) (mut_field s) s))\n  \\<^bold>\\<and> at_mut ''lop_store_ins''              ( (mut_ghost_handshake_phase \\<^bold>= \\<langle>hp_Mark\\<rangle>\n                                             \\<^bold>\\<or> (mut_ghost_handshake_phase \\<^bold>= \\<langle>hp_IdleMarkSweep\\<rangle> \\<^bold>\\<and> sys_phase \\<^bold>\\<noteq> \\<langle>ph_Idle\\<rangle>))\n                                           \\<^bold>\\<and> \\<^bold>\\<not>(NULL mut_ref)\n                                          \\<^bold>\\<longrightarrow> marked \\<^bold>$ mut_the_ref )\n  \\<^bold>\\<and> atS_mut (prefixed ''store_ins'')\n                                            ( (mut_ghost_handshake_phase \\<^bold>= \\<langle>hp_Mark\\<rangle>\n                                             \\<^bold>\\<or> (mut_ghost_handshake_phase \\<^bold>= \\<langle>hp_IdleMarkSweep\\<rangle> \\<^bold>\\<and> sys_phase \\<^bold>\\<noteq> \\<langle>ph_Idle\\<rangle>))\n                                          \\<^bold>\\<and> (\\<lambda>s. \\<forall>opt_r'. \\<not>tso_pending_write (mutator m) (mw_Mutate (mut_tmp_ref s) (mut_field s) opt_r') s)\n                                          \\<^bold>\\<longrightarrow> (\\<lambda>s. obj_at_field_on_heap (\\<lambda>r'. marked r' s) (mut_tmp_ref s) (mut_field s) s) )\n\\<comment>\\<open>after \\<open>''init_noop''\\<close>\\<close>\n  \\<^bold>\\<and> at_mut ''load''         (mut_tmp_ref \\<^bold>\\<in> mut_roots)\n  \\<^bold>\\<and> at_mut ''hs_noop_done'' (LIST_NULL (tso_pending_mutate (mutator m))) \\<comment>\\<open> key: no pending white insertions \\<close>\n  \\<^bold>\\<and> atS_mut ghost_honorary_root_empty_locs (EMPTY mut_ghost_honorary_root) )\"\n(*<*)\n\nlemma get_roots_get_work_subseteq_ghost_honorary_grey_empty_locs:\n  \"hs_get_roots_locs \\<union> hs_get_work_locs \\<subseteq> ghost_honorary_grey_empty_locs\"\nunfolding ghost_honorary_grey_empty_locs_def hs_get_roots_locs_def hs_get_work_locs_def\napply (clarsimp simp: subset_eq)\napply (intro conjI conjI; force)\ndone\n\nlemma (in mut_m) mark_object_invL_eq_imp:\n  \"eq_imp (\\<lambda>r s. (AT s (mutator m), s\\<down> (mutator m), sys_heap s\\<down> r, sys_fM s\\<down>, sys_phase s\\<down>, tso_pending_mutate (mutator m) s\\<down>))\n          mark_object_invL\"\napply (clarsimp simp: eq_imp_def mark_object_invL_def fun_eq_iff[symmetric] obj_at_field_on_heap_def\n                cong: option.case_cong)\napply (rename_tac s s')\napply (subgoal_tac \"\\<forall>r. marked r s\\<down> \\<longleftrightarrow> marked r s'\\<down>\")\n apply (subgoal_tac \"\\<forall>r. valid_null_ref r s\\<down> \\<longleftrightarrow> valid_null_ref r s'\\<down>\")\n  apply (subgoal_tac \"\\<forall>r f opt_r'. mw_Mutate r f opt_r' \\<notin> set (sys_mem_write_buffers (mutator m) s\\<down>) \\<longleftrightarrow> mw_Mutate r f opt_r' \\<notin> set (sys_mem_write_buffers (mutator m) s'\\<down>)\")\n   apply (clarsimp cong: option.case_cong)\n  apply (drule arg_cong[where f=set])\n  apply auto[1]\n apply (clarsimp simp: obj_at_def valid_null_ref_def split: option.splits)\napply (clarsimp simp: obj_at_def valid_null_ref_def split: option.splits)\ndone\n\nlemmas mut_m_mark_object_invL_niE[nie] =\n  iffD1[OF mut_m.mark_object_invL_eq_imp[simplified eq_imp_simps, rule_format, unfolded conj_explode], rotated -1]\n\nlemma (in mut_m) mark_object_invL[intro]:\n  \"\\<lbrace> handshake_invL \\<^bold>\\<and> mark_object_invL\n      \\<^bold>\\<and> mut_get_roots.mark_object_invL m\n      \\<^bold>\\<and> mut_store_del.mark_object_invL m\n      \\<^bold>\\<and> mut_store_ins.mark_object_invL m\n      \\<^bold>\\<and> LSTP (phase_rel_inv \\<^bold>\\<and> handshake_phase_inv \\<^bold>\\<and> phase_rel_inv \\<^bold>\\<and> tso_writes_inv \\<^bold>\\<and> valid_refs_inv) \\<rbrace>\n     mutator m\n   \\<lbrace> mark_object_invL \\<rbrace>\"\napply vcg_jackhammer\n\n(* store_ins_mo_ptest *)\nsubgoal by (elim disjE; fastforce)\n\n(* store_ins_mo_ptest *)\nsubgoal for s s' y\n apply (drule handshake_phase_invD)\n apply (drule phase_rel_invD)\n apply (clarsimp simp: phase_rel_def)\n apply (case_tac \"sys_ghost_handshake_phase s\\<down>\"; simp add: hp_step_rel_def; elim disjE; simp; force)\n done\n\nsubgoal by fastforce\nsubgoal by fastforce\nsubgoal by fastforce\n\nsubgoal for s s' y\n apply (drule handshake_phase_invD)\n apply (drule phase_rel_invD)\n apply (clarsimp simp: phase_rel_def)\n apply (case_tac \"sys_ghost_handshake_phase s\\<down>\"; simp add: hp_step_rel_def; elim disjE; simp; force)\n done\n\nsubgoal by fastforce\n\nsubgoal by (auto dest: obj_at_field_on_heap_no_pending_writes)\n\n(* hs get roots loop done *)\nsubgoal by force\n\n(* hs get roots loop mo phase *)\nsubgoal\n apply (drule handshake_phase_invD)\n apply (drule phase_rel_invD)\n apply (clarsimp simp: phase_rel_def hp_step_rel_def)\n done\n\n(* hs get roots loop choose ref *)\nsubgoal by blast\n\ndone\n\nlemma (in mut_m') mut_mark_object_invL[intro]:\n  \"\\<lbrace> mark_object_invL \\<rbrace> mutator m'\"\napply vcg_nihe\napply vcg_ni\n apply (clarsimp simp: obj_at_field_on_heap_def split: option.splits)\n apply (clarsimp simp: obj_at_field_on_heap_def split: option.splits)\ndone\n\nlemma (in mut_m) mut_store_ins_mark_object_invL[intro]:\n  \"\\<lbrace> mut_store_ins.mark_object_invL m \\<^bold>\\<and> mark_object_invL \\<^bold>\\<and> handshake_invL \\<^bold>\\<and> tso_lock_invL\n       \\<^bold>\\<and> LSTP (handshake_phase_inv \\<^bold>\\<and> valid_W_inv \\<^bold>\\<and> tso_writes_inv \\<^bold>\\<and> valid_refs_inv) \\<rbrace>\n     mutator m\n   \\<lbrace> mut_store_ins.mark_object_invL m \\<rbrace>\"\napply vcg_jackhammer\napply (auto dest: valid_refs_invD valid_W_inv_no_mark_writes_invD\n           split: obj_at_splits)\ndone\n\nlemma mut_m_not_idle_no_fM_writeD:\n  \"\\<lbrakk> sys_mem_write_buffers p s = mw_fM fl # ws; ghost_handshake_phase (s (mutator m)) \\<noteq> hp_Idle; fM_rel_inv s; handshake_phase_inv s; tso_writes_inv s; p \\<noteq> sys \\<rbrakk>\n     \\<Longrightarrow> False\"\napply (drule mut_m.handshake_phase_invD[where m=m])\napply (drule fM_rel_invD)\napply (fastforce simp: hp_step_rel_def fM_rel_def filter_empty_conv p_not_sys)\ndone\n\nlemma (in sys) mut_store_ins_mark_object_invL[intro]:\n  notes mut_m.mark_object_invL_def[inv]\n  notes mut_m.tso_lock_invL_def[inv]\n  notes mut_m_not_idle_no_fM_writeD[where m=m, dest!]\n  notes map_option.compositionality[simp] o_def[simp]\n  shows\n  \"\\<lbrace> mut_m.tso_lock_invL m \\<^bold>\\<and> mut_m.mark_object_invL m \\<^bold>\\<and> mut_store_ins.mark_object_invL m\n       \\<^bold>\\<and> LSTP (fM_rel_inv \\<^bold>\\<and> handshake_phase_inv \\<^bold>\\<and> valid_W_inv \\<^bold>\\<and> tso_writes_inv) \\<rbrace>\n     sys\n   \\<lbrace> mut_store_ins.mark_object_invL m \\<rbrace>\"\napply (vcg_ni simp: not_blocked_def)\n\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\ndone\n\nlemma (in sys) mut_get_roots_mark_object_invL[intro]:\n  notes mut_m.handshake_invL_def[inv]\n  notes mut_m.tso_lock_invL_def[inv]\n  notes map_option.compositionality[simp] o_def[simp]\n  shows\n  \"\\<lbrace> mut_m.tso_lock_invL m \\<^bold>\\<and> mut_m.handshake_invL m \\<^bold>\\<and> mut_get_roots.mark_object_invL m\n       \\<^bold>\\<and> LSTP (fM_rel_inv \\<^bold>\\<and> handshake_phase_inv \\<^bold>\\<and> valid_W_inv \\<^bold>\\<and> tso_writes_inv) \\<rbrace>\n     sys\n   \\<lbrace> mut_get_roots.mark_object_invL m \\<rbrace>\"\napply (vcg_ni simp: not_blocked_def p_not_sys\n             dest!: mut_m.handshake_phase_invD[where m=m])\n\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def fM_rel_inv_def fM_rel_def hp_step_rel_def filter_empty_conv\n                split: mem_write_action.splits if_splits obj_at_splits)\ndone\n\nlemma (in sys) mut_store_del_mark_object_invL[intro]:\n  notes mut_m.mark_object_invL_def[inv]\n  notes mut_m.tso_lock_invL_def[inv]\n  notes mut_m_not_idle_no_fM_writeD[where m=m, dest!]\n  notes map_option.compositionality[simp] o_def[simp]\n  shows\n  \"\\<lbrace> mut_m.tso_lock_invL m \\<^bold>\\<and> mut_m.mark_object_invL m \\<^bold>\\<and> mut_store_del.mark_object_invL m\n       \\<^bold>\\<and> LSTP (fM_rel_inv \\<^bold>\\<and> handshake_phase_inv \\<^bold>\\<and> valid_W_inv \\<^bold>\\<and> tso_writes_inv) \\<rbrace>\n     sys\n   \\<lbrace> mut_store_del.mark_object_invL m \\<rbrace>\"\napply (vcg_ni simp: not_blocked_def)\n\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (fastforce simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\nsubgoal by (auto simp: do_write_action_def split: mem_write_action.splits obj_at_splits)\ndone\n\nlemma (in mut_m) mut_store_del_mark_object_invL[intro]:\n  \"\\<lbrace> mut_store_del.mark_object_invL m \\<^bold>\\<and> mark_object_invL \\<^bold>\\<and> handshake_invL \\<^bold>\\<and> tso_lock_invL\n       \\<^bold>\\<and> LSTP (handshake_phase_inv \\<^bold>\\<and> valid_W_inv \\<^bold>\\<and> tso_writes_inv \\<^bold>\\<and> valid_refs_inv) \\<rbrace>\n     mutator m\n   \\<lbrace> mut_store_del.mark_object_invL m \\<rbrace>\"\nby vcg_jackhammer (auto dest: valid_refs_invD valid_W_inv_no_mark_writes_invD split: obj_at_splits)\n\nlemma (in mut_m) mut_get_roots_mark_object_invL[intro]:\n  \"\\<lbrace> mut_get_roots.mark_object_invL m \\<^bold>\\<and> mark_object_invL \\<^bold>\\<and> handshake_invL \\<^bold>\\<and> tso_lock_invL\n       \\<^bold>\\<and> LSTP (handshake_phase_inv \\<^bold>\\<and> valid_W_inv \\<^bold>\\<and> tso_writes_inv \\<^bold>\\<and> valid_refs_inv) \\<rbrace>\n     mutator m\n   \\<lbrace> mut_get_roots.mark_object_invL m \\<rbrace>\"\nby vcg_jackhammer (auto dest: valid_W_inv_no_mark_writes_invD split: obj_at_splits)\n\nlemma (in mut_m') mut_get_roots_mark_object_invL[intro]:\n  \"\\<lbrace> mut_get_roots.mark_object_invL m \\<rbrace> mutator m'\"\nby vcg_nihe vcg_ni\n\nlemma (in mut_m') mut_store_ins_mark_object_invL[intro]:\n  \"\\<lbrace> mut_store_ins.mark_object_invL m \\<rbrace> mutator m'\"\nby vcg_nihe vcg_ni\n\nlemma (in mut_m') mut_store_del_mark_object_invL[intro]:\n  \"\\<lbrace> mut_store_del.mark_object_invL m \\<rbrace> mutator m'\"\nby vcg_nihe vcg_ni\n\nlemma (in gc) mut_get_roots_mark_object_invL[intro]:\n  notes mut_m.handshake_invL_def[inv]\n  shows \"\\<lbrace> handshake_invL \\<^bold>\\<and> mut_m.handshake_invL m \\<^bold>\\<and> mut_get_roots.mark_object_invL m \\<rbrace> gc \\<lbrace> mut_get_roots.mark_object_invL m \\<rbrace>\"\nby vcg_nihe vcg_ni\n\n(*>*)\ntext\\<open>\n\nWe now show that the GC's use of @{const \"mark_object_fn\"} is correct.\n\nWhen we take grey @{const \"tmp_ref\"} to black, all of the objects it\npoints to are marked, ergo the new black does not point to white, and\nso we preserve the strong tricolour invariant.\n\n\\<close>\n\ndefinition (in gc) obj_fields_marked_inv :: \"('field, 'mut, 'ref) lsts_pred\" where\n  \"obj_fields_marked_inv =\n     (\\<^bold>\\<forall>f. \\<langle>f\\<rangle> \\<^bold>\\<in> (- gc_field_set) \\<^bold>\\<longrightarrow> (\\<lambda>s. obj_at_field_on_heap (\\<lambda>r. marked r s) (gc_tmp_ref s) f s))\"\n(*<*)\n\nlemma (in gc) obj_fields_marked_inv_eq_imp:\n  \"eq_imp (\\<lambda>_::unit. gc_field_set \\<^bold>\\<otimes> gc_tmp_ref \\<^bold>\\<otimes> sys_heap \\<^bold>\\<otimes> sys_fM \\<^bold>\\<otimes> tso_pending_mutate gc)\n          obj_fields_marked_inv\"\nby (clarsimp simp: eq_imp_def obj_fields_marked_inv_def obj_at_field_on_heap_def obj_at_def\n             cong: option.case_cong)\n\nlemmas gc_obj_fields_marked_inv_fun_upd[simp] = eq_imp_fun_upd[OF gc.obj_fields_marked_inv_eq_imp, simplified eq_imp_simps, rule_format]\n\nlemma (in gc) obj_fields_marked_inv_UNIV[iff]:\n  \"obj_fields_marked_inv (s(gc := (s gc)\\<lparr> field_set := UNIV \\<rparr>))\"\nby (simp_all add: obj_fields_marked_inv_def)\n\nlemma (in gc) obj_fields_marked_inv_mark_field_done[iff]:\n  \"\\<lbrakk> obj_at_field_on_heap (\\<lambda>r. marked r s) (gc_tmp_ref s) (gc_field s) s; obj_fields_marked_inv s \\<rbrakk>\n     \\<Longrightarrow> obj_fields_marked_inv (s(gc := (s gc)\\<lparr>field_set := gc_field_set s - {gc_field s}\\<rparr>))\"\nby (force simp: obj_fields_marked_inv_def obj_at_field_on_heap_def split: option.splits obj_at_splits)\n(*>*)\ntext\\<open>\\<close>\n\nlocset_definition\n  \"obj_fields_marked_locs \\<equiv>\n     { ''mark_loop_mark_object_loop'', ''mark_loop_mark_choose_field'', ''mark_loop_mark_deref'', ''mark_loop_mark_field_done'', ''mark_loop_blacken'' }\n   \\<union> prefixed ''mark_loop_mo''\"\n\ninv_definition (in gc) obj_fields_marked_invL :: \"('field, 'mut, 'ref) gc_pred\" where\n  \"obj_fields_marked_invL \\<equiv>\n    (atS_gc obj_fields_marked_locs       (obj_fields_marked_inv \\<^bold>\\<and> gc_tmp_ref \\<^bold>\\<in> gc_W)\n  \\<^bold>\\<and> atS_gc (prefixed ''mark_loop_mo'' \\<union> { ''mark_loop_mark_field_done'' })\n                                          (\\<lambda>s. obj_at_field_on_heap (\\<lambda>r. gc_ref s = Some r \\<or> marked r s) (gc_tmp_ref s) (gc_field s) s)\n  \\<^bold>\\<and> atS_gc (prefixed ''mark_loop_mo'')  (\\<^bold>\\<forall>y. \\<^bold>\\<not>(NULL gc_ref) \\<^bold>\\<and> (\\<lambda>s. ((gc_the_ref s) reaches y) s) \\<^bold>\\<longrightarrow> valid_ref y)\n  \\<^bold>\\<and> at_gc ''mark_loop_fields''          (gc_tmp_ref \\<^bold>\\<in> gc_W)\n  \\<^bold>\\<and> at_gc ''mark_loop_mark_field_done'' (\\<^bold>\\<not>(NULL gc_ref) \\<^bold>\\<longrightarrow> marked \\<^bold>$ gc_the_ref)\n  \\<^bold>\\<and> at_gc ''mark_loop_blacken''         (EMPTY gc_field_set)\n  \\<^bold>\\<and> atS_gc ghost_honorary_grey_empty_locs (EMPTY gc_ghost_honorary_grey))\"\n(*<*)\n\nlemma (in gc) obj_fields_marked_invL_eq_imp:\n  \"eq_imp (\\<lambda>(_::unit) (s :: ('field, 'mut, 'ref) gc_pred_state). (AT s gc, s\\<down> gc, sys_heap s\\<down>, sys_fM s\\<down>, sys_W s\\<down>, tso_pending_mutate gc s\\<down>))\n          obj_fields_marked_invL\"\nby (clarsimp simp: eq_imp_def inv obj_at_def obj_fields_marked_inv_def obj_at_field_on_heap_def\n             cong: option.case_cong)\n\nlemmas gc_obj_fields_marked_invL_niE[nie] =\n  iffD1[OF gc.obj_fields_marked_invL_eq_imp[simplified eq_imp_simps, rule_format, unfolded conj_explode], rotated -1]\n\nlemma (in gc) gc_mark_mark_object_invL[intro]:\n  \"\\<lbrace> fM_fA_invL \\<^bold>\\<and> gc_mark.mark_object_invL \\<^bold>\\<and> obj_fields_marked_invL \\<^bold>\\<and> tso_lock_invL\n        \\<^bold>\\<and> LSTP valid_W_inv \\<rbrace>\n     gc\n   \\<lbrace> gc_mark.mark_object_invL \\<rbrace>\"\nby vcg_jackhammer (auto dest: valid_W_inv_no_mark_writes_invD split: obj_at_splits)\n\nlemma (in gc) obj_fields_marked_invL[intro]:\n  \"\\<lbrace> fM_fA_invL \\<^bold>\\<and> phase_invL \\<^bold>\\<and> obj_fields_marked_invL \\<^bold>\\<and> gc_mark.mark_object_invL\n       \\<^bold>\\<and> LSTP (tso_writes_inv \\<^bold>\\<and> valid_W_inv \\<^bold>\\<and> valid_refs_inv) \\<rbrace>\n     gc\n   \\<lbrace> obj_fields_marked_invL \\<rbrace>\"\napply vcg_jackhammer\n\n(* mark_loop_mark_field_done *)\napply (rule obj_fields_marked_inv_mark_field_done, auto)[1]\n\n(* mark_loop_mark_deref *)\napply (rename_tac s s')\napply (subgoal_tac \"grey (gc_tmp_ref s\\<down>) s\\<down>\") (* FIXME rule *)\n apply (clarsimp simp: obj_at_field_on_heap_def split: option.splits)\n apply (frule valid_refs_invD, fastforce, fastforce)\n apply (rule conjI)\n  apply (clarsimp split: obj_at_splits)\n apply clarsimp\n apply (rename_tac x)\n apply (subgoal_tac \"(gc_tmp_ref s\\<down> reaches x) s\\<down>\")\n  apply (erule valid_refs_invD, fastforce, fastforce)\n apply (fastforce elim: converse_rtranclp_into_rtranclp[rotated]\n                  simp: ran_def split: obj_at_splits)\napply blast\ndone\n\nlemma (in mut_m) gc_obj_fields_marked_invL[intro]:\n  notes gc.obj_fields_marked_invL_def[inv]\n  notes gc.handshake_invL_def[inv]\n  shows \"\\<lbrace> handshake_invL \\<^bold>\\<and> gc.handshake_invL \\<^bold>\\<and> gc.obj_fields_marked_invL\n             \\<^bold>\\<and> LSTP (tso_writes_inv \\<^bold>\\<and> valid_refs_inv) \\<rbrace>\n           mutator m\n         \\<lbrace> gc.obj_fields_marked_invL \\<rbrace>\"\napply vcg_nihe\napply vcg_ni\n(* FIXME rules *)\n apply (clarsimp simp: gc.obj_fields_marked_inv_def)\n apply (rename_tac s s' ra x)\n apply (drule_tac x=x in spec)\n apply clarsimp\n apply (erule obj_at_field_on_heapE)\n  apply (subgoal_tac \"grey (gc_tmp_ref s\\<down>) s\\<down>\")\n   apply (drule_tac y=\"gc_tmp_ref s\\<down>\" in valid_refs_invD(7), simp+)\n   apply (clarsimp split: obj_at_splits)\n  apply (erule greyI)\n apply (clarsimp split: obj_at_splits)\napply (clarsimp simp: obj_at_field_on_heap_def split: option.splits)\napply vcg_ni+\ndone\n\nlemma (in mut_m) gc_mark_mark_object_invL[intro]:\n  \"\\<lbrace> gc_mark.mark_object_invL \\<rbrace> mutator m\"\nby vcg_nihe vcg_ni\n\nlemma (in sys) gc_mark_mark_object_invL[intro]:\n  notes gc.tso_lock_invL_def[inv]\n  notes gc.phase_invL_def[inv]\n  notes gc.fM_fA_invL_def[inv]\n  notes gc.handshake_invL_def[inv]\n  notes map_option.compositionality[simp] o_def[simp]\n  shows\n  \"\\<lbrace> gc.fM_fA_invL \\<^bold>\\<and> gc.handshake_invL \\<^bold>\\<and> gc.phase_invL \\<^bold>\\<and> gc_mark.mark_object_invL \\<^bold>\\<and> gc.tso_lock_invL\n       \\<^bold>\\<and> LSTP (handshake_phase_inv \\<^bold>\\<and> phase_rel_inv \\<^bold>\\<and> valid_W_inv \\<^bold>\\<and> tso_writes_inv) \\<rbrace>\n     sys\n   \\<lbrace> gc_mark.mark_object_invL \\<rbrace>\"\napply vcg_ni\n\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\nsubgoal by (auto dest!: valid_W_invD2\n                  simp: do_write_action_def not_blocked_def fM_rel_def filter_empty_conv p_not_sys\n                 split: mem_write_action.split if_splits)\ndone\n\n(*>*)\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/ConcurrentGC/MarkObject.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3328239933253469}}
{"text": "(*\n    Authors:      Jose Divasón\n                  Sebastiaan Joosten\n                  René Thiemann\n                  Akihisa Yamada\n*)\nsubsection \\<open>Iteration of Subsets of Factors\\<close>\ntheory Sublist_Iteration\nimports \n  Polynomial_Factorization.Missing_Multiset\n  Polynomial_Factorization.Missing_List\n  \"HOL-Library.IArray\"\nbegin\n\nparagraph \\<open>Misc lemmas\\<close>\n\nlemma mem_snd_map: \"(\\<exists>x. (x, y) \\<in> S) \\<longleftrightarrow> y \\<in> snd ` S\" by force\n\nlemma filter_upt: assumes \"l \\<le> m\" \"m < n\" shows \"filter ((\\<le>) m) [l..<n] = [m..<n]\"\nproof(insert assms, induct n)\n  case 0 then show ?case by auto\nnext\n  case (Suc n) then show ?case by (cases \"m = n\", auto)\nqed\n\nlemma upt_append: \"i < j \\<Longrightarrow> j < k \\<Longrightarrow> [i..<j]@[j..<k] = [i..<k]\"\nproof(induct k arbitrary: j)\n  case 0 then show ?case by auto\nnext\n  case (Suc k) then show ?case by (cases \"j = k\", auto)\nqed\n\nlemma IArray_sub[simp]: \"(!!) as = (!) (IArray.list_of as)\" by auto\ndeclare IArray.sub_def[simp del]\n\ntext \\<open>Following lemmas in this section are for @{const subseqs}\\<close>\n\nlemma subseqs_Cons[simp]: \"subseqs (x#xs) = map (Cons x) (subseqs xs) @ subseqs xs\"\n  by (simp add: Let_def)\n\ndeclare subseqs.simps(2) [simp del]\n\nlemma singleton_mem_set_subseqs [simp]: \"[x] \\<in> set (subseqs xs) \\<longleftrightarrow> x \\<in> set xs\" by (induct xs, auto)\n\nlemma Cons_mem_set_subseqsD: \"y#ys \\<in> set (subseqs xs) \\<Longrightarrow> y \\<in> set xs\" by (induct xs, auto)\n\nlemma subseqs_subset: \"ys \\<in> set (subseqs xs) \\<Longrightarrow> set ys \\<subseteq> set xs\"\n  by (metis Pow_iff image_eqI subseqs_powset)\n\nlemma Cons_mem_set_subseqs_Cons:\n  \"y#ys \\<in> set (subseqs (x#xs)) \\<longleftrightarrow> (y = x \\<and> ys \\<in> set (subseqs xs)) \\<or> y#ys \\<in> set (subseqs xs)\"\n  by auto\n\nlemma sorted_subseqs_sorted:\n  \"sorted xs \\<Longrightarrow> ys \\<in> set (subseqs xs) \\<Longrightarrow> sorted ys\"\nproof(induct xs arbitrary: ys)\n  case Nil thus ?case by simp\nnext\n  case Cons thus ?case using subseqs_subset by fastforce\nqed\n\n\nlemma subseqs_of_subseq: \"ys \\<in> set (subseqs xs) \\<Longrightarrow> set (subseqs ys) \\<subseteq> set (subseqs xs)\"\nproof(induct xs arbitrary: ys)\n  case Nil then show ?case by auto\nnext\n  case IHx: (Cons x xs)\n  from IHx.prems show ?case\n  proof(induct ys)\n    case Nil then show ?case by auto\n  next\n    case IHy: (Cons y ys)\n    from IHy.prems[unfolded subseqs_Cons]\n    consider \"y = x\" \"ys \\<in> set (subseqs xs)\" | \"y # ys \\<in> set (subseqs xs)\" by auto\n    then show ?case\n    proof(cases)\n      case 1 with IHx.hyps show ?thesis by auto\n    next\n      case 2 from IHx.hyps[OF this] show ?thesis by auto\n    qed\n  qed\nqed\n\nlemma mem_set_subseqs_append: \"xs \\<in> set (subseqs ys) \\<Longrightarrow> xs \\<in> set (subseqs (zs @ ys))\"\n  by (induct zs, auto)\n\nlemma Cons_mem_set_subseqs_append:\n  \"x \\<in> set ys \\<Longrightarrow> xs \\<in> set (subseqs zs) \\<Longrightarrow> x#xs \\<in> set (subseqs (ys@zs))\"\nproof(induct ys)\n  case Nil then show ?case by auto\nnext\n  case IH: (Cons y ys)\n  then consider \"x = y\" | \"x \\<in> set ys\" by auto\n  then show ?case\n  proof(cases)\n    case 1 with IH show ?thesis by (auto intro: mem_set_subseqs_append)\n  next\n    case 2 from IH.hyps[OF this IH.prems(2)] show ?thesis by auto\n  qed\nqed\n\nlemma Cons_mem_set_subseqs_sorted:\n  \"sorted xs \\<Longrightarrow> y#ys \\<in> set (subseqs xs) \\<Longrightarrow> y#ys \\<in> set (subseqs (filter (\\<lambda>x. y \\<le> x) xs))\"\nby (induct xs) (auto simp: Let_def)\n\nlemma subseqs_map[simp]: \"subseqs (map f xs) = map (map f) (subseqs xs)\" by (induct xs, auto)\n\nlemma subseqs_of_indices: \"map (map (nth xs)) (subseqs [0..<length xs]) = subseqs xs\"\nproof (induct xs)\n  case Nil then show ?case by auto\nnext\n  case (Cons x xs)\n  from this[symmetric]\n  have \"subseqs xs = map (map ((!) (x#xs))) (subseqs [Suc 0..<Suc (length xs)])\"\n    by (fold map_Suc_upt, simp)\n  then show ?case by (unfold length_Cons upt_conv_Cons[OF zero_less_Suc], simp)\nqed\n\n\nparagraph \\<open>Specification\\<close>\n\ndefinition \"subseq_of_length n xs ys \\<equiv> ys \\<in> set (subseqs xs) \\<and> length ys = n\"\n\nlemma subseq_of_lengthI[intro]:\n  assumes \"ys \\<in> set (subseqs xs)\" \"length ys = n\"\n  shows \"subseq_of_length n xs ys\"\nby (insert assms, unfold subseq_of_length_def, auto)\n\nlemma subseq_of_lengthD[dest]:\n  assumes \"subseq_of_length n xs ys\"\n  shows \"ys \\<in> set (subseqs xs)\" \"length ys = n\"\n  by (insert assms, unfold subseq_of_length_def, auto)\n\nlemma subseq_of_length0[simp]: \"subseq_of_length 0 xs ys \\<longleftrightarrow> ys = []\" by auto\n\nlemma subseq_of_length_Nil[simp]: \"subseq_of_length n [] ys \\<longleftrightarrow> n = 0 \\<and> ys = []\"\n  by (auto simp: subseq_of_length_def)\n\nlemma subseq_of_length_Suc_upt:\n  \"subseq_of_length (Suc n) [0..<m] xs \\<longleftrightarrow>\n   (if n = 0 then length xs = Suc 0 \\<and> hd xs < m\n    else hd xs < hd (tl xs) \\<and> subseq_of_length n [0..<m] (tl xs))\" (is \"?l \\<longleftrightarrow> ?r\")\nproof(cases \"n\")\n  case 0\n  show ?thesis\n  proof(intro iffI)\n    assume l: \"?l\"\n    with 0 have 1: \"length xs = Suc 0\" by auto\n    then have xs: \"xs = [hd xs]\" by (metis length_0_conv length_Suc_conv list.sel(1))\n    with l have \"[hd xs] \\<in> set (subseqs [0..<m])\" by auto\n    with 1 show \"?r\" by (unfold 0, auto)\n  next\n    assume ?r\n    with 0 have 1: \"length xs = Suc 0\" and 2: \"hd xs < m\" by auto\n    then have xs: \"xs = [hd xs]\" by (metis length_0_conv length_Suc_conv list.sel(1))\n    from 2 show \"?l\" by (subst xs, auto simp: 0)\n  qed\nnext\n  case n: (Suc n')\n  show ?thesis\n  proof (intro iffI)\n    assume \"?l\"\n    with n have 1: \"length xs = Suc (Suc n')\" and 2: \"xs \\<in> set (subseqs [0..<m])\" by auto\n    from 1[unfolded length_Suc_conv]\n    obtain x y ys where xs: \"xs = x#y#ys\" and n': \"length ys = n'\" by auto\n    have \"sorted xs\" by(rule sorted_subseqs_sorted[OF _ 2], auto)\n    from this[unfolded xs] have \"x \\<le> y\" by auto\n    moreover\n      from 2 have \"distinct xs\" by (rule subseqs_distinctD, auto)\n      from this[unfolded xs] have \"x \\<noteq> y\" by auto\n    ultimately have \"x < y\" by auto\n    moreover\n      from 2 have \"y#ys \\<in> set (subseqs [0..<m])\" by (unfold xs, auto dest: Cons_in_subseqsD)\n      with n n' have \"subseq_of_length n [0..<m] (y#ys)\" by auto\n    ultimately show ?r by (auto simp: xs)\n  next\n    assume r: \"?r\"\n    with n have len: \"length xs = Suc (Suc n')\"\n     and *: \"hd xs < hd (tl xs)\" \"tl xs \\<in> set (subseqs [0..<m])\" by auto\n    from len[unfolded length_Suc_conv] obtain x y ys\n    where xs: \"xs = x#y#ys\" and n': \"length ys = n'\" by auto\n    with * have xy: \"x < y\" and yys: \"y#ys \\<in> set (subseqs [0..<m])\" by auto\n    from Cons_mem_set_subseqs_sorted[OF _ yys]\n    have \"y#ys \\<in> set (subseqs (filter ((\\<le>) y) [0..<m]))\" by auto\n    also from Cons_mem_set_subseqsD[OF yys] have ym: \"y < m\" by auto\n      then have \"filter ((\\<le>) y) [0..<m] = [y..<m]\" by (auto intro: filter_upt)\n    finally have \"y#ys \\<in> set (subseqs [y..<m])\" by auto\n    with xy have \"x#y#ys \\<in> set (subseqs (x#[y..<m]))\" by auto\n    also from xy have \"... \\<subseteq> set (subseqs ([0..<y] @ [y..<m]))\"\n      by (intro subseqs_of_subseq Cons_mem_set_subseqs_append, auto intro: subseqs_refl)\n    also from xy ym have \"[0..<y] @ [y..<m] = [0..<m]\" by (auto intro: upt_append)\n    finally have \"xs \\<in> set (subseqs [0..<m])\" by (unfold xs)\n    with len[folded n] show ?l by auto\n  qed\nqed\n\nlemma subseqs_of_length_of_indices:\n  \"{ ys. subseq_of_length n xs ys } = { map (nth xs) is | is. subseq_of_length n [0..<length xs] is }\"\n  by(unfold subseq_of_length_def, subst subseqs_of_indices[symmetric], auto)\n\nlemma subseqs_of_length_Suc_Cons:\n  \"{ ys. subseq_of_length (Suc n) (x#xs) ys } =\n   Cons x ` { ys. subseq_of_length n xs ys } \\<union> { ys. subseq_of_length (Suc n) xs ys }\"\n  by (unfold subseq_of_length_def, auto)\n\n\ndatatype ('a,'b,'state)subseqs_impl = Sublists_Impl\n  (create_subseqs: \"'b \\<Rightarrow> 'a list \\<Rightarrow> nat \\<Rightarrow> ('b \\<times> 'a list)list \\<times> 'state\")\n  (next_subseqs: \"'state \\<Rightarrow> ('b \\<times> 'a list)list \\<times> 'state\")\n\nlocale subseqs_impl = \n  fixes f :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'b\"\n  and sl_impl :: \"('a,'b,'state)subseqs_impl\"\nbegin\n\ndefinition S :: \"'b \\<Rightarrow> 'a list \\<Rightarrow> nat \\<Rightarrow> ('b \\<times> 'a list)set\" where\n  \"S base elements n = { (foldr f ys base, ys) | ys. subseq_of_length n elements ys }\"\n\nend\n\nlocale correct_subseqs_impl = subseqs_impl f sl_impl\n  for f :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'b\" \n  and sl_impl :: \"('a,'b,'state)subseqs_impl\" +\n  fixes invariant :: \"'b \\<Rightarrow> 'a list \\<Rightarrow> nat \\<Rightarrow> 'state \\<Rightarrow> bool\" \n  assumes create_subseqs: \"create_subseqs sl_impl base elements n = (out, state) \\<Longrightarrow> invariant base elements n state \\<and> set out = S base elements n\" \n  and next_subseqs:\n    \"invariant base elements n state \\<Longrightarrow> \n     next_subseqs sl_impl state = (out, state') \\<Longrightarrow> \n     invariant base elements (Suc n) state' \\<and> set out = S base elements (Suc n)\"  \n\n\n(* **** old implementation *********** *)\nparagraph \\<open>Basic Implementation\\<close>\nfun subseqs_i_n_main :: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'b) \\<Rightarrow> 'b \\<Rightarrow> 'a list \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ('b \\<times> 'a list) list\" where\n  \"subseqs_i_n_main f b xs i n = (if i = 0 then [(b,[])] else if i = n then [(foldr f xs b, xs)]\n    else case xs of \n      (y # ys) \\<Rightarrow> map (\\<lambda> (c,zs) \\<Rightarrow> (c,y # zs)) (subseqs_i_n_main f (f y b) ys (i - 1) (n - 1)) \n        @ subseqs_i_n_main f b ys i (n - 1))\"\ndeclare subseqs_i_n_main.simps[simp del]\n\ndefinition subseqs_length :: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'b) \\<Rightarrow> 'b \\<Rightarrow> nat \\<Rightarrow> 'a list \\<Rightarrow> ('b \\<times> 'a list) list\" where\n  \"subseqs_length f b i xs = (\n    let n = length xs in if i > n then [] else subseqs_i_n_main f b xs i n)\"\n\nlemma subseqs_length: assumes f_ac: \"\\<And> x y z. f x (f y z) = f y (f x z)\" \n  shows \"set (subseqs_length f a n xs) = \n  { (foldr f ys a, ys) | ys. ys \\<in> set (subseqs xs) \\<and> length ys = n}\" \nproof -\n  show ?thesis \n  proof (cases \"length xs < n\")\n    case True\n    thus ?thesis unfolding subseqs_length_def Let_def\n      using length_subseqs[of xs] subseqs_length_simple_False by auto \n  next\n    case False\n    hence id: \"(length xs < n) = False\" and \"n \\<le> length xs\" by auto\n    from this(2) show ?thesis unfolding subseqs_length_def Let_def id if_False\n    proof (induct xs arbitrary: n a rule: length_induct[rule_format])\n      case (1 xs n a)\n      note n = 1(2)\n      note IH = 1(1)\n      note simp[simp] = subseqs_i_n_main.simps[of f _ xs n]\n      show ?case\n      proof (cases \"n = 0\")\n        case True\n        thus ?thesis unfolding simp by simp\n      next\n        case False note 0 = this\n        show ?thesis\n        proof (cases \"n = length xs\")\n          case True\n          have \"?thesis = ({(foldr f xs a, xs)} = (\\<lambda> ys. (foldr f ys a, ys)) ` {ys. ys \\<in> set (subseqs xs) \\<and> length ys = length xs})\" \n            unfolding simp using 0 True by auto\n          from this[unfolded full_list_subseqs] show ?thesis by auto\n        next\n          case False\n          with n have n: \"n < length xs\" by auto\n          from 0 obtain m where m: \"n = Suc m\" by (cases n, auto)\n          from n 0 obtain y ys where xs: \"xs = y # ys\" by (cases xs, auto)\n          from n m xs have le: \"m \\<le> length ys\" \"n \\<le> length ys\" by auto\n          from xs have lt: \"length ys < length xs\" by auto\n          have sub: \"set (subseqs_i_n_main f a xs n (length xs)) = \n            (\\<lambda>(c, zs). (c, y # zs)) ` set (subseqs_i_n_main f (f y a) ys m (length ys)) \\<union>\n            set (subseqs_i_n_main f a ys n (length ys))\" \n            unfolding simp using 0 False by (simp add: xs m)\n          have fold: \"\\<And> ys. foldr f ys (f y a) = f y (foldr f ys a)\" \n            by (induct_tac ys, auto simp: f_ac)\n          show ?thesis unfolding sub IH[OF lt le(1)] IH[OF lt le(2)]\n            unfolding m xs by (auto simp: Let_def fold)\n        qed\n      qed\n    qed\n  qed\nqed\n\ndefinition basic_subseqs_impl :: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'b) \\<Rightarrow> ('a, 'b, 'b \\<times> 'a list \\<times> nat)subseqs_impl\" where\n  \"basic_subseqs_impl f = Sublists_Impl \n    (\\<lambda> a xs n. (subseqs_length f a n xs, (a,xs,n)))\n    (\\<lambda> (a,xs,n). (subseqs_length f a (Suc n) xs, (a,xs,Suc n)))\"\n  \nlemma basic_subseqs_impl: assumes f_ac: \"\\<And> x y z. f x (f y z) = f y (f x z)\"\n  shows \"correct_subseqs_impl f (basic_subseqs_impl f) \n    (\\<lambda> a xs n triple. (a,xs,n) = triple)\"\n  by (unfold_locales; unfold subseqs_impl.S_def basic_subseqs_impl_def subseq_of_length_def,\n      insert subseqs_length[of f, OF f_ac], auto)\n\n(******** new implementation ********)\nparagraph \\<open>Improved Implementation\\<close>\n\ndatatype ('a,'b,'state) subseqs_foldr_impl = Sublists_Foldr_Impl\n  (subseqs_foldr: \"'b \\<Rightarrow> 'a list \\<Rightarrow> nat \\<Rightarrow> 'b list \\<times> 'state\")\n  (next_subseqs_foldr: \"'state \\<Rightarrow> 'b list \\<times> 'state\")\n\nlocale subseqs_foldr_impl =\n  fixes f :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'b\"\n  and impl :: \"('a,'b,'state) subseqs_foldr_impl\"\nbegin\ndefinition S where \"S base elements n \\<equiv> { foldr f ys base | ys. subseq_of_length n elements ys }\"\nend\n\nlocale correct_subseqs_foldr_impl = subseqs_foldr_impl f impl\n  for f and impl :: \"('a,'b,'state) subseqs_foldr_impl\" +\n  fixes invariant :: \"'b \\<Rightarrow> 'a list \\<Rightarrow> nat \\<Rightarrow> 'state \\<Rightarrow> bool\"\n  assumes subseqs_foldr:\n    \"subseqs_foldr impl base elements n = (out, state) \\<Longrightarrow>\n     invariant base elements n state \\<and> set out = S base elements n\" \n  and next_subseqs_foldr:\n    \"next_subseqs_foldr impl state = (out, state') \\<Longrightarrow> invariant base elements n state \\<Longrightarrow>\n     invariant base elements (Suc n) state' \\<and> set out = S base elements (Suc n)\"\n\nlocale my_subseqs =\n  fixes f :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'b\"\nbegin\n\ncontext fixes head :: \"'a\" and tail :: \"'a iarray\"\nbegin\n\nfun next_subseqs1 and next_subseqs2\nwhere \"next_subseqs1 ret0 ret1 [] = (ret0, (head, tail, ret1))\"\n  |   \"next_subseqs1 ret0 ret1 ((i,v)#prevs) = next_subseqs2 (f head v # ret0) ret1 prevs v [0..<i]\"\n  |   \"next_subseqs2 ret0 ret1 prevs v [] = next_subseqs1 ret0 ret1 prevs\"\n  |   \"next_subseqs2 ret0 ret1 prevs v (j#js) =\n       (let v' = f (tail !! j) v in next_subseqs2 (v' # ret0) ((j,v') # ret1) prevs v js)\"\n\ndefinition \"next_subseqs2_set v js \\<equiv> { (j, f (tail !! j) v) | j. j \\<in> set js }\"\n\ndefinition \"out_subseqs2_set v js \\<equiv> { f (tail !! j) v | j. j \\<in> set js }\"\n\ndefinition \"next_subseqs1_set prevs \\<equiv> \\<Union> { next_subseqs2_set v [0..<i] | v i. (i,v) \\<in> set prevs }\"\n\ndefinition \"out_subseqs1_set prevs \\<equiv>\n  (f head \\<circ> snd) ` set prevs \\<union> (\\<Union> { out_subseqs2_set v [0..<i] | v i. (i,v) \\<in> set prevs })\"\n\nfun next_subseqs1_spec where\n  \"next_subseqs1_spec out nexts prevs (out', (head',tail',nexts')) \\<longleftrightarrow>\n   set nexts' = set nexts \\<union> next_subseqs1_set prevs \\<and>\n   set out' = set out \\<union> out_subseqs1_set prevs\"\n\nfun next_subseqs2_spec where\n  \"next_subseqs2_spec out nexts prevs v js (out', (head',tail',nexts')) \\<longleftrightarrow>\n   set nexts' = set nexts \\<union> next_subseqs1_set prevs \\<union> next_subseqs2_set v js \\<and>\n   set out' = set out \\<union> out_subseqs1_set prevs \\<union> out_subseqs2_set v js\"\n\nlemma next_subseqs2_Cons:\n  \"next_subseqs2_set v (j#js) = insert (j, f (tail!!j) v) (next_subseqs2_set v js)\"\n  by (auto simp: next_subseqs2_set_def)\n\nlemma out_subseqs2_Cons:\n  \"out_subseqs2_set v (j#js) = insert (f (tail!!j) v) (out_subseqs2_set v js)\"\n  by (auto simp: out_subseqs2_set_def)\n\nlemma next_subseqs1_set_as_next_subseqs2_set:\n  \"next_subseqs1_set ((i,v) # prevs) = next_subseqs1_set prevs \\<union> next_subseqs2_set v [0..<i]\"\n  by (auto simp: next_subseqs1_set_def)\n\nlemma out_subseqs1_set_as_out_subseqs2_set:\n  \"out_subseqs1_set ((i,v) # prevs) =\n   { f head v } \\<union> out_subseqs1_set prevs \\<union> out_subseqs2_set v [0..<i]\"\n  by (auto simp: out_subseqs1_set_def)\n\nlemma next_subseqs1_spec:\n  shows \"\\<And>out nexts. next_subseqs1_spec out nexts prevs (next_subseqs1 out nexts prevs)\"\n    and \"\\<And>out nexts. next_subseqs2_spec out nexts prevs v js (next_subseqs2 out nexts prevs v js)\"\nproof(induct rule: next_subseqs1_next_subseqs2.induct)\n  case (1 ret0 ret1)\n  then show ?case by (simp add: next_subseqs1_set_def out_subseqs1_set_def)\nnext\n  case (2 ret0 ret1 i v prevs)\n  show ?case\n  proof(cases \"next_subseqs1 out nexts ((i, v) # prevs)\")\n    case split: (fields out' head' tail' nexts')\n    have \"next_subseqs2_spec (f head v # out) nexts prevs v [0..<i] (out', (head',tail',nexts'))\"\n      by (fold split, unfold next_subseqs1.simps, rule 2)\n    then show ?thesis\n      apply (unfold next_subseqs2_spec.simps split)\n      by (auto simp: next_subseqs1_set_as_next_subseqs2_set out_subseqs1_set_as_out_subseqs2_set)\n  qed\nnext\n  case (3 ret0 ret1 prevs v)\n  show ?case\n  proof (cases \"next_subseqs1 out nexts prevs\")\n    case split: (fields out' head' tail' nexts')\n    from 3[of out nexts] show ?thesis by(simp add: split next_subseqs2_set_def out_subseqs2_set_def)\n  qed\nnext\n  case (4 ret0 ret1 prevs v j js)\n  define tj where \"tj = tail !! j\"\n  define nexts'' where \"nexts'' = (j, f tj v) # nexts\"\n  define out'' where \"out'' = (f tj v) # out\"\n  let ?n = \"next_subseqs2 out'' nexts'' prevs v js\"\n  show ?case\n  proof (cases ?n)\n    case split: (fields out' head' tail' nexts')\n    show ?thesis\n      apply (unfold next_subseqs2.simps Let_def)\n      apply (fold tj_def)\n      apply (fold out''_def nexts''_def)\n      apply (unfold split next_subseqs2_spec.simps next_subseqs2_Cons out_subseqs2_Cons)\n      using 4[OF refl, of out'' nexts'', unfolded split]\n      apply (auto simp: tj_def nexts''_def out''_def)\n      done\n  qed\nqed\n\nend\n\nfun next_subseqs where \"next_subseqs (head,tail,prevs) = next_subseqs1 head tail [] [] prevs\"\n\nfun create_subseqs\nwhere \"create_subseqs base elements 0 = (\n       if elements = [] then ([base],(undefined, IArray [], []))\n       else let head = hd elements; tail = IArray (tl elements) in\n         ([base], (head, tail, [(IArray.length tail, base)])))\"\n  |   \"create_subseqs base elements (Suc n) =\n       next_subseqs (snd (create_subseqs base elements n))\"\n\ndefinition impl where \"impl = Sublists_Foldr_Impl create_subseqs next_subseqs\"\n\nsublocale subseqs_foldr_impl f impl .\n\ndefinition set_prevs where \"set_prevs base tail n \\<equiv>\n  { (i, foldr f (map ((!) tail) is) base) | i is.\n   subseq_of_length n [0..<length tail] is \\<and> i = (if n = 0 then length tail else hd is) }\"\n\nlemma snd_set_prevs:\n  \"snd ` (set_prevs base tail n) = (\\<lambda>as. foldr f as base) ` { as. subseq_of_length n tail as }\"\n  by (subst subseqs_of_length_of_indices, auto simp: set_prevs_def image_Collect)\n\n\nfun invariant where \"invariant base elements n (head,tail,prevs) =\n  (if elements = [] then prevs = []\n   else head = hd elements \\<and> tail = IArray (tl elements) \\<and> set prevs = set_prevs base (tl elements) n)\"\n\n\nlemma next_subseq_preserve:\n  assumes \"next_subseqs (head,tail,prevs) = (out, (head',tail',prevs'))\"\n  shows \"head' = head\" \"tail' = tail\"\nproof-\n  define P :: \"'b list \\<times> _ \\<times> _ \\<times> (nat \\<times> 'b) list \\<Rightarrow> bool\"\n  where \"P \\<equiv> \\<lambda> (out, (head',tail',prevs')). head' = head \\<and> tail' = tail\"\n  { fix ret0 ret1 v js\n    have *: \"P (next_subseqs1 head tail ret0 ret1 prevs)\"\n     and  \"P (next_subseqs2 head tail ret0 ret1 prevs v js)\"\n    by(induct rule: next_subseqs1_next_subseqs2.induct, simp add: P_def, auto simp: Let_def)\n  }\n  from this(1)[unfolded P_def, of \"[]\" \"[]\", folded next_subseqs.simps] assms\n  show \"head' = head\" \"tail' = tail\" by auto\nqed\n\nlemma next_subseqs_spec:\n  assumes nxt: \"next_subseqs (head,tail,prevs) = (out, (head',tail',prevs'))\"\n  shows \"set prevs' = { (j, f (tail !! j) v) | v i j. (i,v) \\<in> set prevs \\<and> j < i }\" (is \"?g1\")\n    and \"set out = (f head \\<circ> snd) ` set prevs \\<union> snd ` set prevs'\" (is \"?g2\")\nproof-\n  note next_subseqs1_spec(1)[of head tail Nil Nil prevs]\n  note this[unfolded nxt[simplified]]\n  note this[unfolded next_subseqs1_spec.simps]\n  note this[unfolded next_subseqs1_set_def out_subseqs1_set_def]\n  note * = this[unfolded next_subseqs2_set_def out_subseqs2_set_def]\n  then show g1: ?g1 by auto\n  also have \"snd ` ... =  (\\<Union> {{(f (tail !! j) v) | j. j < i} | v i. (i, v) \\<in> set prevs})\"\n     by (unfold image_Collect, auto)\n  finally have **: \"snd ` set prevs' = ...\".\n  with conjunct2[OF *] show ?g2 by simp\nqed\n\nlemma next_subseq_prevs:\n  assumes nxt: \"next_subseqs (head,tail,prevs) = (out, (head',tail',prevs'))\"\n      and inv_prevs: \"set prevs = set_prevs base (IArray.list_of tail) n\"\n  shows \"set prevs' = set_prevs base (IArray.list_of tail) (Suc n)\" (is \"?l = ?r\")\nproof(intro equalityI subsetI)\n  fix t\n  assume r: \"t \\<in> ?r\"\n  from this[unfolded set_prevs_def] obtain iis\n  where t: \"t = (hd iis, foldr f (map ((!!) tail) iis) base)\"\n    and sl: \"subseq_of_length (Suc n) [0..<IArray.length tail] iis\" by auto\n  from sl have \"length iis > 0\" by auto\n  then obtain i \"is\" where iis: \"iis = i#is\" by (meson list.set_cases nth_mem)\n  define v where \"v = foldr f (map ((!!) tail) is) base\"\n  note sl[unfolded subseq_of_length_Suc_upt]\n  note nxt = next_subseqs_spec[OF nxt]\n  show \"t \\<in> ?l\"\n  proof(cases \"n = 0\")\n    case True\n    from sl[unfolded subseq_of_length_Suc_upt] t\n    show ?thesis by (unfold nxt[unfolded inv_prevs] True set_prevs_def length_Suc_conv, auto)\n  next\n    case [simp]: False\n    from sl[unfolded subseq_of_length_Suc_upt iis,simplified]\n    have i: \"i < hd is\" and \"is\": \"subseq_of_length n [0..<IArray.length tail] is\" by auto\n    then have *: \"(hd is, v) \\<in> set_prevs base (IArray.list_of tail) n\"\n      by (unfold set_prevs_def, auto intro!: exI[of _ \"is\"] simp: v_def)\n    with i have \"(i, f (tail !! i) v) \\<in> {(j, f (tail !! j) v) | j. j < hd is}\" by auto\n    with t[unfolded iis] have \"t \\<in> ...\" by (auto simp: v_def)\n    with * show ?thesis by (unfold nxt[unfolded inv_prevs], auto)\n  qed\nnext\n  fix t\n  assume l: \"t \\<in> ?l\"\n  from l[unfolded next_subseqs_spec(1)[OF nxt]]\n  obtain j v i\n  where t: \"t = (j, f (tail!!j) v)\"\n    and j: \"j < i\"\n    and iv: \"(i,v) \\<in> set prevs\" by auto\n  from iv[unfolded inv_prevs set_prevs_def, simplified]\n  obtain \"is\"\n  where v: \"v = foldr f (map ((!!) tail) is) base\"\n    and \"is\": \"subseq_of_length n [0..<IArray.length tail] is\"\n    and i: \"if n = 0 then i = IArray.length tail else i = hd is\" by auto\n  from \"is\" j i have jis: \"subseq_of_length (Suc n) [0..<IArray.length tail] (j#is)\"\n    by (unfold subseq_of_length_Suc_upt, auto)\n  then show \"t \\<in> ?r\" by (auto intro!: exI[of _ \"j#is\"] simp: set_prevs_def t v)\nqed\n\nlemma invariant_next_subseqs:\n  assumes inv: \"invariant base elements n state\"\n      and nxt: \"next_subseqs state = (out, state')\"\n  shows \"invariant base elements (Suc n) state'\"\nproof(cases \"elements = []\")\n  case True with inv nxt show ?thesis by(cases state, auto)\nnext\n  case False with inv nxt show ?thesis\n  proof (cases state)\n    case state: (fields head tail prevs)\n    note inv = inv[unfolded state]\n    show ?thesis\n    proof (cases state')\n      case state': (fields head' tail' prevs')\n      note nxt = nxt[unfolded state state']\n      note [simp] = next_subseq_preserve[OF nxt]\n      from False inv\n      have \"set prevs = set_prevs base (IArray.list_of tail) n\" by auto\n      from False next_subseq_prevs[OF nxt this] inv\n      show ?thesis by(auto simp: state')\n    qed\n  qed\nqed\n\nlemma out_next_subseqs:\n  assumes inv: \"invariant base elements n state\"\n      and nxt: \"next_subseqs state = (out, state')\"\n  shows \"set out = S base elements (Suc n)\"\nproof (cases state)\n  case state: (fields head tail prevs)\n  show ?thesis\n  proof(cases \"elements = []\")\n    case True\n    with inv nxt show ?thesis by (auto simp: state S_def)\n  next\n    case elements: False\n    show ?thesis\n    proof(cases state')\n      case state': (fields head' tail' prevs')\n      from elements inv[unfolded state,simplified]\n      have \"head = hd elements\"\n       and \"tail = IArray (tl elements)\"\n       and prevs: \"set prevs = set_prevs base (tl elements) n\" by auto\n      with elements have elements2: \"elements = head # IArray.list_of tail\"  by auto\n      let ?f = \"\\<lambda>as. (foldr f as base)\"\n      have \"set out = ?f ` {ys. subseq_of_length (Suc n) elements ys}\"\n      proof-\n        from invariant_next_subseqs[OF inv nxt, unfolded state' invariant.simps if_not_P[OF elements]]\n        have tail': \"tail' = IArray (tl elements)\"\n         and prevs': \"set prevs' = set_prevs base (tl elements) (Suc n)\" by auto\n        note next_subseqs_spec(2)[OF nxt[unfolded state state'], unfolded this]\n        note this[folded image_comp, unfolded snd_set_prevs]\n        also note prevs\n        also note snd_set_prevs\n        also have \"f head ` ?f ` { as. subseq_of_length n (tl elements) as } =\n          ?f ` Cons head ` { as. subseq_of_length n (tl elements) as }\" by (auto simp: image_def)\n        also note image_Un[symmetric]\n        also have\n          \"((#) head ` {as. subseq_of_length n (tl elements) as} \\<union>\n           {as. subseq_of_length (Suc n) (tl elements) as}) =\n           {as. subseq_of_length (Suc n) elements as}\"\n        by (unfold subseqs_of_length_Suc_Cons elements2, auto)\n        finally show ?thesis.\n      qed\n      then show ?thesis by (auto simp: S_def)\n    qed\n  qed\nqed\n\nlemma create_subseqs:\n  \"create_subseqs base elements n = (out, state) \\<Longrightarrow>\n   invariant base elements n state \\<and> set out = S base elements n\"\nproof(induct n arbitrary: out state)\n  case 0 then show ?case by (cases \"elements\", cases state, auto simp: S_def Let_def set_prevs_def)\nnext\n  case (Suc n) show ?case\n  proof (cases \"create_subseqs base elements n\")\n    case 1: (fields out'' head tail prevs)\n    show ?thesis\n    proof (cases \"next_subseqs (head, tail, prevs)\")\n      case (fields out' head' tail' prevs')\n      note 2 = this[unfolded next_subseq_preserve[OF this]]\n      from Suc(2)[unfolded create_subseqs.simps 1 snd_conv 2]\n      have 3: \"out' = out\" \"state = (head,tail,prevs')\" by auto\n      from Suc(1)[OF 1]\n      have inv: \"invariant base elements n (head, tail, prevs)\" by auto\n      from out_next_subseqs[OF inv 2] invariant_next_subseqs[OF inv 2]\n      show ?thesis by (auto simp: 3)\n    qed\n  qed\nqed\n\nsublocale correct_subseqs_foldr_impl f impl invariant\n  by (unfold_locales; auto simp: impl_def invariant_next_subseqs out_next_subseqs create_subseqs)\n\nlemma impl_correct: \"correct_subseqs_foldr_impl f impl invariant\" ..\nend\n\nlemmas [code] =\n  my_subseqs.next_subseqs.simps\n  my_subseqs.next_subseqs1.simps\n  my_subseqs.next_subseqs2.simps\n  my_subseqs.create_subseqs.simps\n  my_subseqs.impl_def\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Berlekamp_Zassenhaus/Sublist_Iteration.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.640635847978761, "lm_q1q2_score": 0.332823982631826}}
{"text": "(*  Title:        Notions of Communication for C2KA\n    Author:       Maxime Buyse <maxime.buyse at polytechnique.edu>, 2019\n    Maintainers:  Maxime Buyse <maxime.buyse at polytechnique.edu> and Jason Jaskolka <jason.jaskolka at carleton.ca>\n*)\n\nsection \\<open>Notions of Communication for \\CCKAabbrv \\label{sec:communication}\\<close>\n\ntext \\<open>\nDistributed systems contain a significant number of interactions among their constituent agents. Any interaction, \ndirect or indirect, of an agent with its neighbouring agents can be understood as a \\emph{communication}~\\cite{Milner1989aa}. \nTherefore, any potential for communication between two system agents can be characterized by the existence of a communication \npath allowing for the transfer of data or control from one agent to another. Potential for communication allows system\nagents to have an \\emph{influence} over each other. The study of agent influence allows for the \ndetermination of the overall structure of the distributed system of which the agents comprise. A full treatment of the potential \nfor communication within distributed systems specified using \\CCKAabbrv has been given in~\\cite{Jaskolka2015ab} \nand~\\cite{Jaskolka2014ac} and is highlighted below.\n\nConsider a distributed system with~$\\Agent{A}, \\Agent{B} \\in \\A$ such that~$\\Agent{A} \\neq \\Agent{B}$. We write~$\\agent{A}{a}$ \nwhere~$\\Agent{A}$ is the name given to the agent and~$a \\in \\CKAset$ is the agent behaviour. For~$\\agent{A}{a}$ and~$\\agent{B}{b}$, \nwe write~$\\Agent{A+B}$ to denote the agent~$\\bigA{a+b}$. In a sense, we extend the operators on behaviours of~$\\CKAset$ to their \ncorresponding agents. \n\nCommunication via stimuli from agent~$\\Agent{A}$ to agent~$\\Agent{B}$ is said to have taken place only when \na stimulus generated by~$\\Agent{A}$ \\emph{influences} (i.e., causes an observable change in, directly or indirectly) the behaviour \nof~$\\Agent{B}$. Note that it is possible that more than one agent is influenced by the generation of the same stimulus by another \nagent in the system. Formally, we say that agent~$\\agent{A}{a}$ has the \\emph{potential for direct communication via stimuli} with \nagent~$\\agent{B}{b}$ (denoted by~$\\STIMcommD{\\Agent{A}}{\\Agent{B}}$) if and only \nif~$\\biglnotation{\\exists}{s,t}{s,t \\in \\STIMbasic \\nAnd t \\STIMle \\lOut{a}{s} }{\\lAct{b}{t} \\neq b}$ where~$\\STIMbasic$ is the \nset of all basic stimuli. A stimulus is called \\emph{basic} if it is indivisible with regard to the sequential composition \noperator~$\\STIMdot$ of a stimulus structure. Similarly, we say that agent~$\\Agent{A}$ has the \\emph{potential for communication \nvia stimuli with agent~$\\Agent{B}$ using at most~$n$ basic stimuli} (denoted by~$\\STIMcommN{\\Agent{A}}{\\Agent{B}}{n}$) if and only \nif~$\\biglnotation{\\exists}{\\Agent{C}}{\\Agent{C} \\in \\A \\nAnd \\Agent{C} \\neq \\Agent{A} \\nAnd \\Agent{C} \\neq \\Agent{B}}{\\STIMcommN{\\Agent{A}}{\\Agent{C}}{(n-1)} \\nAnd \\STIMcommD{\\Agent{C}}{\\Agent{B}}}$. \nMore generally, we say that agent~$\\Agent{A}$ has the \\emph{potential for communication via stimuli} with agent~$\\Agent{B}$ \n(denoted by~$\\STIMcomm{\\Agent{A}}{\\Agent{B}}$) if and only if~$\\biglnotation{\\exists}{n}{n \\ge 1}{\\STIMcommN{\\Agent{A}}{\\Agent{B}}{n}}$. \nWhen~$\\STIMcomm{\\Agent{A}}{\\Agent{B}}$, there is a sequence of stimuli of arbitrary length which allows for the transfer of data or \ncontrol from agent~$\\Agent{A}$ to agent~$\\Agent{B}$ in the system. To simplify the Isabelle theory, we do not implement \nthe potential for communication using at most~$n$ basic stimuli. Instead, we give the definition of potential for direct communication \nvia stimuli and the fact that~$\\STIMcommD{\\Agent{A}}{\\Agent{B}} \\Longrightarrow \\STIMcomm{\\Agent{A}}{\\Agent{B}}$ as axioms because \nthese are the only properties that we use about potential for communication via stimuli.\n\nCommunication via shared environments from agent~$\\Agent{A}$ to agent~$\\Agent{B}$ (denoted by~$\\ENVcomm{\\Agent{A}}{\\Agent{B}}$) is \nsaid to have taken place only when~$\\Agent{A}$ has the ability to alter an element of the environment that it shares with~$\\Agent{B}$ \nsuch that~$\\Agent{B}$ is able to observe the alteration that was made. Formally, we say that agent~$\\agent{A}{a}$ has the \n\\emph{potential for direct communication via shared environments} with agent~$\\agent{B}{b}$ (denoted by~$\\ENVcommD{\\Agent{A}}{\\Agent{B}}$) \nif and only if~$\\dep{b}{a}$ where~$\\depOp$ is a given dependence relation. More generally, agent~$\\Agent{A}$ has the \n\\emph{potential for communication via shared environments} with agent~$\\Agent{B}$ (denoted by~$\\ENVcomm{\\Agent{A}}{\\Agent{B}}$) if and \nonly if~$\\depTC{b}{a}$ where~$\\depOpTC$ is the transitive closure of the given dependence relation. This means that if two agents respect \nthe given dependence relation, then there is a potential for communication via shared environments.\n\\<close>\n\ntheory Communication_C2KA\n  imports Topology_C2KA\nbegin\n\ntext \\<open>\nThe locale \\emph{communication-c2ka} extends \\emph{topology-c2ka} to include aspects of potential for communication \namong distributed system agents.\n\\<close>\n\nlocale communication_c2ka = topology_c2ka +\n  fixes dcs :: \"'a::cka \\<Rightarrow> 'a::cka \\<Rightarrow> bool\" (infix \"\\<rightarrow>\\<^sub>\\<S>\" 50)\n  and pcs :: \"'a::cka \\<Rightarrow> 'a::cka \\<Rightarrow> bool\" (infix \"\\<rightarrow>\\<^sub>\\<S>\\<^sup>+\" 50)\n  and dce :: \"'a::cka \\<Rightarrow> 'a::cka \\<Rightarrow> bool\" (infix \"\\<rightarrow>\\<^sub>\\<E>\" 50)\n  and pce :: \"'a::cka \\<Rightarrow> 'a::cka \\<Rightarrow> bool\" (infix \"\\<rightarrow>\\<^sub>\\<E>\\<^sup>+\" 50)\n  and pdc :: \"'a::cka \\<Rightarrow> 'a::cka \\<Rightarrow> bool\" (infix \"\\<leadsto>\" 50)\n  and pfc :: \"'a::cka \\<Rightarrow> 'a::cka \\<Rightarrow> bool\" (infix \"\\<leadsto>\\<^sup>+\" 50)\n  and stimuli_connected :: \"'a set \\<Rightarrow> bool\"\n  and universally_influential :: \"'a::cka \\<times> 'a set \\<Rightarrow> bool\"\n  assumes dcs_def: \"a \\<rightarrow>\\<^sub>\\<S> b \\<longleftrightarrow> \n  (\\<exists> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,a) \\<and> t \\<circ> b \\<noteq> b)\"\n  and pdc_def: \"a \\<leadsto> b \\<longleftrightarrow> (a \\<rightarrow>\\<^sub>\\<S> b \\<or> a \\<rightarrow>\\<^sub>\\<E> b)\"\n  and zero_dce: \"\\<not>(0 \\<rightarrow>\\<^sub>\\<E> a)\"\n  and one_dce: \"\\<not>(1 \\<rightarrow>\\<^sub>\\<E> a)\"\n  and dce_zero: \"\\<not>(a \\<rightarrow>\\<^sub>\\<E> 0)\"\n  and dce_one: \"\\<not>(a \\<rightarrow>\\<^sub>\\<E> 1)\"\n  and sum_dce: \"(A + B \\<rightarrow>\\<^sub>\\<E> C) \\<longleftrightarrow> (A \\<rightarrow>\\<^sub>\\<E> C \\<or> B \\<rightarrow>\\<^sub>\\<E> C)\"\n  and dce_sum: \"(A \\<rightarrow>\\<^sub>\\<E> B + C) \\<longleftrightarrow> (A \\<rightarrow>\\<^sub>\\<E> B \\<or> A \\<rightarrow>\\<^sub>\\<E> C)\"\n  and dcs_pcs: \"A \\<rightarrow>\\<^sub>\\<S> B \\<Longrightarrow> A \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B\"\n  and stimuli_connected_def: \"stimuli_connected(\\<C>) \\<longleftrightarrow> \n(\\<forall> X\\<^sub>1 X\\<^sub>2. X\\<^sub>1 \\<inter> X\\<^sub>2 = {} \\<and> X\\<^sub>1 \\<union> X\\<^sub>2 = \\<C> \\<and> X\\<^sub>1 \\<noteq> {} \\<and> X\\<^sub>2 \\<noteq> {} \\<longrightarrow> \n(\\<exists> A B. A \\<in> X\\<^sub>1 \\<and> B \\<in> X\\<^sub>2 \\<and> (A \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B \\<or> B \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ A)))\"\n  and universally_influential_def: \"universally_influential(A,\\<C>) \\<longleftrightarrow>\nA \\<in> \\<C> \\<and> (\\<forall> B. B \\<in> \\<C> \\<and> B \\<noteq> A \\<longrightarrow> A \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B)\"\nbegin\n\nsubsection \\<open>Stimuli-Connected Systems \\& Universally Influential Agents \\label{sub:stimuli_connected_universally_influential}\\<close>\n\ntext \\<open>\nTwo subsets~$X_1$ and~$X_2$ of~$\\A$ form a partition of~$\\A$ if and only if~$X_1 \\cap X_2 = \\STbot$ and~$X_1 \\cup X_2 = \\A$. A distributed system \nof agents~$\\A$ is called \\emph{stimuli-connected} if and only if for every~$X_1$ and~$X_2$ nonempty that form a partition of~$\\A$, we \nhave~$\\lnotation{\\exists}{\\Agent{A},\\Agent{B}}{\\Agent{A} \\in X_1 \\nAnd \\Agent{B} \\in X_2}{\\STIMcomm{\\Agent{A}}{\\Agent{B}} \\Ors \\STIMcomm{\\Agent{B}}{\\Agent{A}}}$. \nOtherwise,~$\\A$ is called \\emph{stimuli-disconnected}. In a stimuli-connected system, every agent is a participant, either as the source or sink, \nof at least one direct communication via stimuli.\n\\<close>\n\ntext \\<open>\nAn agent~$\\Agent{A} \\in \\A$ is called \\emph{universally influential} if and only \nif~$\\biglnotation{\\forall}{\\Agent{B}}{\\Agent{B} \\in \\A \\STdiff \\set{\\Agent{A}}}{\\STIMcomm{\\Agent{A}}{\\Agent{B}}}$. \nA universally influential agent is able to generate some stimuli that influences the behaviour, either directly or \nindirectly, of each other agent in the system. \n\\<close>\n\ntext \\<open>\nLemma \\emph{universally-influential-stimuli-connected} shows that the existence of a universally influential agent yields a stimuli-connected system. \n\\<close>\n\nlemma universally_influential_stimuli_connected: \n\"(\\<exists> A. universally_influential(A,\\<C>)) \\<longrightarrow> stimuli_connected(\\<C>)\"\n  unfolding universally_influential_def stimuli_connected_def\nproof (intro allI impI)\n  fix X\\<^sub>1 X\\<^sub>2\n  show \"(\\<exists>A. A \\<in> \\<C> \\<and> (\\<forall>B. B \\<in> \\<C> \\<and> B \\<noteq> A \\<longrightarrow> A \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B)) \\<Longrightarrow>\nX\\<^sub>1 \\<inter> X\\<^sub>2 = {} \\<and> X\\<^sub>1 \\<union> X\\<^sub>2 = \\<C> \\<and> X\\<^sub>1 \\<noteq> {} \\<and> X\\<^sub>2 \\<noteq> {} \\<Longrightarrow> \n(\\<exists> A B. A \\<in> X\\<^sub>1 \\<and> B \\<in> X\\<^sub>2 \\<and> (A \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B \\<or> B \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ A))\"\n  proof -\n    assume \"(\\<exists>A. A \\<in> \\<C> \\<and> (\\<forall>B. B \\<in> \\<C> \\<and> B \\<noteq> A \\<longrightarrow> A \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B))\"\n    from this obtain A where Aui: \"A \\<in> \\<C> \\<and> (\\<forall>B. B \\<in> \\<C> \\<and> B \\<noteq> A \\<longrightarrow> \nA \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B)\" by auto\n    show \"X\\<^sub>1 \\<inter> X\\<^sub>2 = {} \\<and> X\\<^sub>1 \\<union> X\\<^sub>2 = \\<C> \\<and> X\\<^sub>1 \\<noteq> {} \\<and> X\\<^sub>2 \\<noteq> {} \\<Longrightarrow>\n(\\<exists>A B. A \\<in> X\\<^sub>1 \\<and> B \\<in> X\\<^sub>2 \\<and> (A \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B \\<or> B \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ A))\"\n    proof -\n      assume partition:\"X\\<^sub>1 \\<inter> X\\<^sub>2 = {} \\<and> X\\<^sub>1 \\<union> X\\<^sub>2 = \\<C> \\<and> X\\<^sub>1 \\<noteq> {} \\<and> X\\<^sub>2 \\<noteq> {}\"\n      show \"(\\<exists>A B. A \\<in> X\\<^sub>1 \\<and> B \\<in> X\\<^sub>2 \\<and> (A \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B \\<or> B \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ A))\"\n      proof cases \n        assume in1: \"A \\<in> X\\<^sub>1\"\n        from partition obtain B where in2: \"B \\<in> X\\<^sub>2\" by auto\n        have \"A = B \\<Longrightarrow> False\"\n        proof -\n          assume \"A = B\"\n          hence \"A \\<in> X\\<^sub>2\" by (simp add: in2)\n          moreover have \"A \\<in> X\\<^sub>1\" by (rule in1)\n          ultimately have \"A \\<in> X\\<^sub>1 \\<inter> X\\<^sub>2\" by simp\n          hence \"A \\<in> {}\" by (simp add: partition)\n          thus \"False\" by simp\n        qed\n        hence \"A \\<noteq> B\" by auto\n        moreover have \"B \\<in> \\<C>\" \n        proof -\n          from partition have \"\\<C> = X\\<^sub>1 \\<union> X\\<^sub>2\" by auto\n          hence \"X\\<^sub>2 \\<subseteq> \\<C>\" by simp\n          thus ?thesis by (auto simp add: in2)\n        qed\n        ultimately have \"A \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B\" by (auto simp add: Aui in2)\n        thus ?thesis \n          by (rule_tac x=\"A\" in exI, rule_tac x=\"B\" in exI, simp add: in1 in2)\n      next\n        assume notin1: \"A \\<notin> X\\<^sub>1\"\n        moreover have \"A \\<in> \\<C>\" by (simp add: Aui)\n        moreover have \"X\\<^sub>1 \\<union> X\\<^sub>2 = \\<C>\" by (simp add: partition)\n        ultimately have in2: \"A \\<in> X\\<^sub>2\" by auto\n        from partition obtain B where in1: \"B \\<in> X\\<^sub>1\" by auto\n        have \"B = A \\<Longrightarrow> False\"\n        proof -\n          assume \"B = A\"\n          hence \"B \\<in> X\\<^sub>2\" by (simp add: in2)\n          moreover have \"B \\<in> X\\<^sub>1\" by (rule in1)\n          ultimately have \"B \\<in> X\\<^sub>1 \\<inter> X\\<^sub>2\" by simp\n          hence \"B \\<in> {}\" by (simp add: partition)\n          thus \"False\" by simp\n        qed\n        hence \"B \\<noteq> A\" by auto\n        moreover have \"B \\<in> \\<C>\" \n        proof -\n          from partition have \"\\<C> = X\\<^sub>1 \\<union> X\\<^sub>2\" by auto\n          hence \"X\\<^sub>1 \\<subseteq> \\<C>\" by simp\n          thus ?thesis by (auto simp add: in1)\n        qed\n        ultimately have \"A \\<rightarrow>\\<^sub>\\<S>\\<^sup>+ B\" by (auto simp add: Aui in2)\n        thus ?thesis \n          by (rule_tac x=\"B\" in exI, rule_tac x=\"A\" in exI, simp add: in1 in2)\n      qed\n    qed\n  qed\nqed\n\ntext \\<open>\nLemma \\emph{fixed-no-stimcomm} shows that no agent has the potential for communication via stimuli with an agent that has a fixed point behaviour.\n\\<close>\n\nlemma fixed_no_stimcomm: \"fixed(A) \\<longrightarrow> (\\<forall> B. \\<not>(B \\<rightarrow>\\<^sub>\\<S> A))\"\n  unfolding fixed_def \nproof (rule impI)\n  assume hyp: \"\\<forall>s. s \\<noteq> \\<dd> \\<longrightarrow> s \\<circ> A = A\"\n  have \"\\<exists> B. B \\<rightarrow>\\<^sub>\\<S> A \\<Longrightarrow> False\"\n  proof -\n    assume \"\\<exists> B. B \\<rightarrow>\\<^sub>\\<S> A\"\n    then obtain B where \"B \\<rightarrow>\\<^sub>\\<S> A\" by auto\n    hence \"\\<exists> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,B) \\<and> t \\<circ> A \\<noteq> A\" \n      by (simp only: dcs_def)\n    then obtain s t where st: \"s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,B) \\<and> t \\<circ> A \\<noteq> A\" \n      by auto\n    hence \"t \\<noteq> \\<dd>\" by (auto simp only: zero_not_basic)\n    hence \"t \\<circ> A = A\" by (simp add: hyp)\n    thus False by (auto simp add: st)\n  qed\n  thus \"(\\<forall> B. \\<not>(B \\<rightarrow>\\<^sub>\\<S> A))\" by auto\nqed\n\nsubsection \\<open>Preserving the Potential for Communication under Non-Determinism \\label{sub:non_determinism}\\<close>\n\nsubsubsection \\<open>Potential for Communication via Stimuli \\label{ssub:pfc_stim}\\<close>\n\ntext \\<open>\nThe following results show how the potential for communication via stimuli can be preserved when non-determinism is introduced among agents. \nSpecifically, Lemma \\emph{source-nondet-stimcomm} states that when non-determinism is added at the source of a potential communication path via stimuli, the potential \nfor communication via stimuli is always preserved. On the other hand, Lemma \\emph{sink-nondet-stimcomm} states that when non-determinism is added at the sink of a \npotential communication path via stimuli, the potential for communication is preserved only if there does not exist any basic stimulus that is \ngenerated by the source that influences agent~$\\Agent{B}$ and agent~$\\Agent{C}$ to behave as a sub-behaviour of agent~$\\Agent{B + C}$. This \ncondition ensures that agent~$\\Agent{B + C}$ cannot have a fixed point behaviour.\n\\<close>\n\nlemma source_nondet_stimcomm: \"(B \\<rightarrow>\\<^sub>\\<S> C) \\<Longrightarrow> ((A + B) \\<rightarrow>\\<^sub>\\<S> C)\"\nproof -\n  assume \"B \\<rightarrow>\\<^sub>\\<S> C\"\n  then obtain s t where st: \"s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,B) \\<and> t \\<circ> C \\<noteq> C\" \n    by (auto simp only: dcs_def)\n  show \"(A + B) \\<rightarrow>\\<^sub>\\<S> C\"\n    unfolding dcs_def \n    by (rule_tac x=\"s\" in exI, rule_tac x=\"t\" in exI, auto simp add: st inf_add_S_left)\nqed\n\nlemma comm_source_nondet_stimcomm: \"(B \\<rightarrow>\\<^sub>\\<S> C) \\<Longrightarrow> ((B + A) \\<rightarrow>\\<^sub>\\<S> C)\"\n  by (simp add: source_nondet_stimcomm algebra_simps)\n\nlemma sink_sum_stimcomm: \"(\\<exists> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \\<and> \n\\<not>(t \\<circ> B \\<le>\\<^sub>\\<K> B + C \\<and> t \\<circ> C \\<le>\\<^sub>\\<K> B + C)) \\<Longrightarrow> (A \\<rightarrow>\\<^sub>\\<S> B + C)\"\nproof -\n  assume \"\\<exists> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \\<and> \n\\<not>(t \\<circ> B \\<le>\\<^sub>\\<K> B + C \\<and> t \\<circ> C \\<le>\\<^sub>\\<K> B + C)\"\n  then obtain s t where st: \"s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \\<and> \n\\<not>(t \\<circ> B \\<le>\\<^sub>\\<K> B + C \\<and> t \\<circ> C \\<le>\\<^sub>\\<K> B + C)\" by auto\n  have \"t \\<circ> (B + C) = B + C \\<Longrightarrow> False\"\n  proof -\n    assume fixbc: \"t \\<circ> (B + C) = B + C\"\n    have \"t \\<circ> B  \\<le>\\<^sub>\\<K> t \\<circ> (B + C)\"\n      by (simp, rule inf_add_K_right)\n    moreover have \"t \\<circ> C  \\<le>\\<^sub>\\<K> t \\<circ> (B + C)\"\n      by (simp, rule inf_add_K_left)\n    ultimately have \"t \\<circ> B \\<le>\\<^sub>\\<K> B + C \\<and> t \\<circ> C \\<le>\\<^sub>\\<K> B + C\" \n      by (simp only: fixbc)\n    thus False by (simp only: st) \n  qed\n  thus \"A \\<rightarrow>\\<^sub>\\<S> B + C\"\n    unfolding dcs_def\n    by (rule_tac x=\"s\" in exI, rule_tac x=\"t\" in exI, auto simp only: st)\nqed\n\nlemma sink_nondet_stimcomm: \"A \\<rightarrow>\\<^sub>\\<S> B \\<Longrightarrow> (\\<forall> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \n\\<longrightarrow> \\<not>(t \\<circ> B \\<le>\\<^sub>\\<K> B + C \\<and> t \\<circ> C \\<le>\\<^sub>\\<K> B + C)) \\<Longrightarrow> (A \\<rightarrow>\\<^sub>\\<S> B + C)\"\nproof (rule sink_sum_stimcomm)\n  assume h1: \"A \\<rightarrow>\\<^sub>\\<S> B\"\n  assume h2: \"(\\<forall> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \\<longrightarrow> \n\\<not>(t \\<circ> B \\<le>\\<^sub>\\<K> B + C \\<and> t \\<circ> C \\<le>\\<^sub>\\<K> B + C))\"\n  show \"\\<exists> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \\<and> \n\\<not>(t \\<circ> B \\<le>\\<^sub>\\<K> B + C \\<and> t \\<circ> C \\<le>\\<^sub>\\<K> B + C)\"\n  proof -\n    from h1 obtain s t where \"s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \\<and> t \\<circ> B \\<noteq> B\"\n      by (auto simp only: dcs_def)\n    from this h2 have \"s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \\<and> \n\\<not>(t \\<circ> B \\<le>\\<^sub>\\<K> B + C \\<and> t \\<circ> C \\<le>\\<^sub>\\<K> B + C)\" by auto\n    thus ?thesis\n      by (rule_tac x=\"s\" in exI, rule_tac x=\"t\" in exI, auto)\n  qed\nqed\n\nsubsubsection \\<open>Potential for Communication via Shared Environments \\label{ssub:pfc_env}\\<close>\n\ntext \\<open>\nLemmas \\emph{source-nondet-envcomm} and \\emph{sink-nondet-envcomm} show how the potential for communication via shared environments is preserved when non-determinism is \nintroduced at the source or the sink of a potential communication path via shared environments.\n\\<close>\n\nlemma source_nondet_envcomm: \"B \\<rightarrow>\\<^sub>\\<E> C \\<Longrightarrow> (A + B) \\<rightarrow>\\<^sub>\\<E> C\"\n  by (simp add: sum_dce)\n\nlemma sink_nondet_envcomm: \"A \\<rightarrow>\\<^sub>\\<E> B \\<Longrightarrow> A \\<rightarrow>\\<^sub>\\<E> (B + C)\"\n  by (simp add: dce_sum)\n\n \nsubsection \\<open>Preserving the Potential for Communication with Agent Behaviour Modifications\\label{sub:preservation}\\<close>\n\ntext \\<open>\nThe following results identify the conditions constraining the modifications that can be made to the source or sink agent involved in a direct potential for communication to \npreserve the communication in a distributed system. In this way, it demonstrates the conditions under which a modification to an agent behaviour can be made while maintaining \nthe communicating behaviour of the agents in the system.\n\nSpecifically, Lemma \\emph{sink-seq-stimcomm} shows how the sequential composition of an additional behaviour on the left of a sink agent will not affect the potential for communication \nprovided that every stimulus that is generated by the source agent either does not fix the behaviour of the first component of the sequential composition, or causes the \nfirst component of the sequential composition to generate a stimulus that does not fix the behaviour of the second component of the sequential composition. Alternatively, \nLemma \\emph{nondet-right-source-communication} shows how non-determinism added on the right of a source agent will not affect the potential for communication provided that \nthe non-deterministic behaviours can be influenced by the source agent to stop being a sub-behaviour of the non-deterministic behaviour.\n\\<close>\n\n\nlemma sink_seq_stimcomm: \"A \\<rightarrow>\\<^sub>\\<S> B \n\\<Longrightarrow> \\<forall> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \\<longrightarrow> \\<lambda>(t,C) = t \\<Longrightarrow> A;C \\<rightarrow>\\<^sub>\\<S> B\"\nproof -\n  assume \"A \\<rightarrow>\\<^sub>\\<S> B\"\n  then obtain s t where st: \"s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \\<and> t \\<circ> B \\<noteq> B\" \n    unfolding dcs_def by auto\n  assume \"\\<forall> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \\<longrightarrow> \\<lambda>(t,C) = t\"\n  from this st have tfix: \"\\<lambda>(t,C) = t\" by auto\n  have \"\\<lambda>(t,C) \\<le>\\<^sub>\\<S>  \\<lambda>(\\<lambda>(s,A),C)\" by (simp add: inf_S_next_stimulus st)\n  hence \"t \\<le>\\<^sub>\\<S> \\<lambda> (\\<lambda> (s, A), C)\" by (simp add: tfix)\n  thus \"A;C \\<rightarrow>\\<^sub>\\<S> B\" \n    unfolding dcs_def\n    by (rule_tac x=\"s\" in exI, rule_tac x=\"t\" in exI, simp add: st)\nqed\n\nlemma nondet_right_source_communication: \"A \\<leadsto> C \\<and> C \\<leadsto> B \\<Longrightarrow> (\\<forall> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \n\\<longrightarrow> \\<not>(t \\<circ> C \\<le>\\<^sub>\\<K> C + D \\<and> t \\<circ> D \\<le>\\<^sub>\\<K> C + D)) \\<Longrightarrow> A \\<leadsto> C+D \\<and> C+D \\<leadsto> B\"\nproof -\n  assume h1:\"A \\<leadsto> C \\<and> C \\<leadsto> B\"\n  assume h2:\"(\\<forall> s t. s \\<in> \\<S>\\<^sub>a \\<and> t \\<in> \\<S>\\<^sub>a \\<and> t \\<le>\\<^sub>\\<S> \\<lambda>(s,A) \n\\<longrightarrow> \\<not>(t \\<circ> C \\<le>\\<^sub>\\<K> C + D \\<and> t \\<circ> D \\<le>\\<^sub>\\<K> C + D))\"\n  from h2 have hs: \"A \\<rightarrow>\\<^sub>\\<S> C \\<Longrightarrow> A \\<rightarrow>\\<^sub>\\<S> C+D\" \n    by (auto simp add: sink_nondet_stimcomm)\n  have \"A \\<leadsto> C \\<Longrightarrow> A \\<leadsto> C+D\"\n    unfolding pdc_def\n    using dce_sum hs by blast\n  moreover have \"C \\<leadsto> B \\<Longrightarrow> C + D \\<leadsto> B\"\n    unfolding pdc_def\n    using comm_source_nondet_stimcomm sum_dce by blast\n  ultimately show \"A \\<leadsto> C+D \\<and> C+D \\<leadsto> B\"\n    by (simp add: h1)\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/C2KA_DistributedSystems/Communication_C2KA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.33278672746020266}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Plus\nimports\n  \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"plus.c\"\ninstall_C_file \"plus.c\"\n\nautocorres [ ts_force nondet = plus2 ] \"plus.c\"\n\ncontext plus begin\n\n(* 3 + 2 should be 5 *)\nlemma \"plus' 3 2 = 5\"\n  unfolding plus'_def\n  by eval\n\n(* plus does what it says on the box *)\nlemma plus_correct: \"plus' a b = a + b\"\n  unfolding plus'_def\n  apply (rule refl)\n  done\n\n(* Compare pre-lifting to post-lifting *)\nthm plus_global_addresses.plus2_body_def\nthm plus2'_def\n\n(* plus2 does what it says on the box *)\nlemma plus2_correct: \"\\<lbrace>\\<lambda>s. True\\<rbrace> plus2' a b \\<lbrace> \\<lambda>r s. r = a + b\\<rbrace>\"\n  unfolding plus2'_def\n  apply (subst whileLoop_add_inv\n   [where I=\"\\<lambda>(a', b') s. a' + b' = a + b\"\n      and M=\"\\<lambda>((a', b'), s). b'\"])\n  apply (wp, auto simp: not_less)\n  done\n\n(* plus2 does what it says on plus's box *)\nlemma plus2_is_plus: \"\\<lbrace> \\<lambda>s. True \\<rbrace> plus2' a b \\<lbrace> \\<lambda>r s. r = plus' a b \\<rbrace>\"\n  unfolding plus'_def\n  apply (simp add:plus2_correct)\n  done\n\n(* Prove plus2 with no failure *)\nlemma plus2_valid:\"\\<lbrace> \\<lambda>s. True \\<rbrace> plus2' a b \\<lbrace> \\<lambda>r s. r = a + b \\<rbrace>!\"\n  unfolding plus2'_def\n  apply (subst whileLoop_add_inv\n   [where I=\"\\<lambda>(a', b') s. a' + b' = a + b\"\n      and M=\"\\<lambda>((a', b'), s). b'\"])\n  apply wp\n    apply clarsimp\n    apply unat_arith\n   apply clarsimp\n   apply unat_arith\n  apply clarsimp\n  done\n\nend\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/autocorres/tests/examples/Plus.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3327867186228418}}
{"text": "theory flash44Bra  imports flash44Rev\n \n  begin\nlemma onInv44:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv44  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv44  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv44 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash44Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.5, "lm_q1q2_score": 0.332705279373407}}
{"text": "theory CoCallAnalysisBinds\nimports CoCallAnalysisSig AEnv  \"AList-Utils-HOLCF\" \"Arity-Nominal\" \"CoCallGraph-Nominal\"\nbegin\n\ncontext CoCallAnalysis\nbegin\ndefinition ccBind :: \"var \\<Rightarrow> exp \\<Rightarrow> ((AEnv \\<times> CoCalls) \\<rightarrow> CoCalls)\"\n  where \"ccBind v e = (\\<Lambda> (ae, G).  if (v--v\\<notin>G) \\<or> \\<not> isVal e then cc_restr (fv e) (fup\\<cdot>(ccExp e)\\<cdot>(ae v)) else ccSquare (fv e))\"\n(* paper has:  \\<or> ae v = up\\<cdot>0, but that is not monotone! But should give the same result. *)\n\nlemma ccBind_eq:\n  \"ccBind v e\\<cdot>(ae, G) = (if v--v\\<notin>G \\<or> \\<not> isVal e then \\<G>\\<^sup>\\<bottom>\\<^bsub>ae v\\<^esub> e G|` fv e else (fv e)²)\"\n  unfolding ccBind_def\n  apply (rule cfun_beta_Pair)\n  apply (rule cont_if_else_above)\n  apply simp\n  apply simp\n  apply (auto dest: set_mp[OF ccField_cc_restr])[1]\n  (* Abstraction broken! Fix this. *)\n  apply (case_tac p, auto, transfer, auto)[1]\n  apply (rule adm_subst[OF cont_snd])\n  apply (rule admI, thin_tac \"chain _\", transfer, auto)\n  done\n\nlemma ccBind_strict[simp]: \"ccBind v e \\<cdot> \\<bottom> = \\<bottom>\"\n  by (auto simp add: inst_prod_pcpo ccBind_eq simp del: Pair_strict)\n\nlemma ccField_ccBind: \"ccField (ccBind v e\\<cdot>(ae,G)) \\<subseteq> fv e\"\n  by (auto simp add: ccBind_eq dest: set_mp[OF ccField_cc_restr])\n\ndefinition ccBinds :: \"heap \\<Rightarrow> ((AEnv \\<times> CoCalls) \\<rightarrow> CoCalls)\"\n  where \"ccBinds \\<Gamma> = (\\<Lambda> i. (\\<Squnion>v\\<mapsto>e\\<in>map_of \\<Gamma>. ccBind v e\\<cdot>i))\"\n\nlemma ccBinds_eq:\n  \"ccBinds \\<Gamma>\\<cdot>i = (\\<Squnion>v\\<mapsto>e\\<in>map_of \\<Gamma>. ccBind v e\\<cdot>i)\"\n  unfolding ccBinds_def\n  by simp\n\nlemma ccBinds_strict[simp]: \"ccBinds \\<Gamma>\\<cdot>\\<bottom>=\\<bottom>\"\n  unfolding ccBinds_eq\n  by (cases \"\\<Gamma> = []\") simp_all\n\nlemma ccBinds_strict'[simp]: \"ccBinds \\<Gamma>\\<cdot>(\\<bottom>,\\<bottom>)=\\<bottom>\"\n  by (metis CoCallAnalysis.ccBinds_strict Pair_bottom_iff)\n\nlemma ccBinds_reorder1:\n  assumes \"map_of \\<Gamma> v = Some e\"\n  shows \"ccBinds \\<Gamma> = ccBind v e \\<squnion> ccBinds (delete v \\<Gamma>)\"\nproof-\n  from assms \n  have \"map_of \\<Gamma> = map_of ((v,e) # delete v \\<Gamma>)\" by (metis map_of_delete_insert)\n  thus ?thesis\n    by (auto intro: cfun_eqI simp add: ccBinds_eq delete_set_none)\nqed\n\nlemma ccBinds_Nil[simp]:\n  \"ccBinds [] = \\<bottom>\"\n  unfolding ccBinds_def by simp\n\nlemma ccBinds_Cons[simp]:\n   \"ccBinds ((x,e)#\\<Gamma>) = ccBind x e \\<squnion> ccBinds (delete x \\<Gamma>)\"\n   by (subst ccBinds_reorder1[where v = x and e = e]) auto\n\nlemma ccBind_below_ccBinds: \"map_of \\<Gamma> x = Some e \\<Longrightarrow> ccBind x e\\<cdot>ae \\<sqsubseteq> (ccBinds \\<Gamma>\\<cdot>ae)\"\n  by (auto simp add: ccBinds_eq)\n\nlemma ccField_ccBinds: \"ccField (ccBinds \\<Gamma>\\<cdot>(ae,G)) \\<subseteq> fv \\<Gamma>\"\n  by (auto simp add: ccBinds_eq dest: set_mp[OF ccField_ccBind] intro: set_mp[OF map_of_Some_fv_subset])\n\ndefinition ccBindsExtra :: \"heap \\<Rightarrow> ((AEnv \\<times> CoCalls) \\<rightarrow> CoCalls)\"\n  where \"ccBindsExtra \\<Gamma> = (\\<Lambda> i.  snd i \\<squnion> ccBinds \\<Gamma> \\<cdot> i  \\<squnion> (\\<Squnion>x\\<mapsto>e\\<in>map_of \\<Gamma>. ccProd (fv e) (ccNeighbors x (snd i))))\"\n\nlemma ccBindsExtra_simp: \"ccBindsExtra \\<Gamma> \\<cdot> i =snd i \\<squnion> ccBinds \\<Gamma> \\<cdot> i \\<squnion> (\\<Squnion>x\\<mapsto>e\\<in>map_of \\<Gamma>. ccProd (fv e) (ccNeighbors x (snd i)))\"\n  unfolding ccBindsExtra_def by simp\n\nlemma ccBindsExtra_eq: \"ccBindsExtra \\<Gamma>\\<cdot>(ae,G) =\n  G \\<squnion> ccBinds \\<Gamma>\\<cdot>(ae,G) \\<squnion> (\\<Squnion>x\\<mapsto>e\\<in>map_of \\<Gamma>. fv e G\\<times> ccNeighbors x G)\"\n  unfolding ccBindsExtra_def by simp\n\nlemma ccBindsExtra_strict[simp]: \"ccBindsExtra \\<Gamma> \\<cdot> \\<bottom> = \\<bottom>\"\n  by (auto simp add: ccBindsExtra_simp inst_prod_pcpo simp del: Pair_strict)\n\nlemma ccField_ccBindsExtra:\n  \"ccField (ccBindsExtra \\<Gamma>\\<cdot>(ae,G)) \\<subseteq> fv \\<Gamma> \\<union> ccField G\"\n  by (auto simp add: ccBindsExtra_simp elem_to_ccField\n      dest!:  set_mp[OF ccField_ccBinds]  set_mp[OF ccField_ccProd_subset] map_of_Some_fv_subset)\n\nend\n\nlemma ccBind_eqvt[eqvt]: \"\\<pi> \\<bullet> (CoCallAnalysis.ccBind cccExp x e) = CoCallAnalysis.ccBind (\\<pi> \\<bullet> cccExp) (\\<pi> \\<bullet> x) (\\<pi> \\<bullet> e)\"\nproof-\n  {\n  fix \\<pi> ae G\n  have \"\\<pi> \\<bullet> ((CoCallAnalysis.ccBind cccExp x e) \\<cdot> (ae,G)) = CoCallAnalysis.ccBind (\\<pi> \\<bullet> cccExp) (\\<pi> \\<bullet> x) (\\<pi> \\<bullet> e) \\<cdot> (\\<pi> \\<bullet> ae, \\<pi> \\<bullet> G)\"\n    unfolding CoCallAnalysis.ccBind_eq\n    by perm_simp (simp add: Abs_cfun_eqvt)\n  }\n  thus ?thesis by (auto intro: cfun_eqvtI)\nqed\n\nlemma ccBinds_eqvt[eqvt]: \"\\<pi> \\<bullet> (CoCallAnalysis.ccBinds cccExp \\<Gamma>) = CoCallAnalysis.ccBinds (\\<pi> \\<bullet> cccExp) (\\<pi> \\<bullet> \\<Gamma>)\"\n  apply (rule cfun_eqvtI)\n  unfolding CoCallAnalysis.ccBinds_eq\n  apply (perm_simp) \n  apply rule\n  done\n\nlemma ccBindsExtra_eqvt[eqvt]: \"\\<pi> \\<bullet> (CoCallAnalysis.ccBindsExtra cccExp \\<Gamma>) = CoCallAnalysis.ccBindsExtra (\\<pi> \\<bullet> cccExp) (\\<pi> \\<bullet> \\<Gamma>)\"\n  by (rule cfun_eqvtI) (simp add: CoCallAnalysis.ccBindsExtra_def)\n\nlemma ccBind_cong[fundef_cong]:\n  \"cccexp1 e = cccexp2 e \\<Longrightarrow> CoCallAnalysis.ccBind cccexp1 x e = CoCallAnalysis.ccBind cccexp2 x e \"\n  apply (rule cfun_eqI)\n  apply (case_tac xa)\n  apply (auto simp add: CoCallAnalysis.ccBind_eq)\n  done\n\nlemma ccBinds_cong[fundef_cong]:\n  \"\\<lbrakk> (\\<And> e. e \\<in> snd ` set heap2 \\<Longrightarrow> cccexp1 e = cccexp2 e); heap1 = heap2 \\<rbrakk>\n      \\<Longrightarrow> CoCallAnalysis.ccBinds cccexp1 heap1 = CoCallAnalysis.ccBinds cccexp2 heap2\"\n  apply (rule cfun_eqI)\n  unfolding CoCallAnalysis.ccBinds_eq\n  apply (rule arg_cong[OF mapCollect_cong])\n  apply (rule arg_cong[OF ccBind_cong])\n  apply auto\n  by (metis imageI map_of_SomeD snd_conv)\n\nlemma ccBindsExtra_cong[fundef_cong]:\n  \"\\<lbrakk> (\\<And> e. e \\<in> snd ` set heap2 \\<Longrightarrow> cccexp1 e = cccexp2 e); heap1 = heap2 \\<rbrakk>\n      \\<Longrightarrow> CoCallAnalysis.ccBindsExtra cccexp1 heap1 = CoCallAnalysis.ccBindsExtra cccexp2 heap2\"\n  apply (rule cfun_eqI)\n  unfolding CoCallAnalysis.ccBindsExtra_simp\n  apply (rule arg_cong2[OF ccBinds_cong mapCollect_cong]) \n  apply simp+\n  done\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/CoCallAnalysisBinds.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.33260331916167224}}
{"text": "theory FWBisimLift imports\n  FWInitFinLift\n  FWBisimulation\nbegin\n\ncontext FWbisimulation_base begin\n\ninductive init_fin_bisim :: \"'t \\<Rightarrow> ((status \\<times> 'x1) \\<times> 'm1, (status \\<times> 'x2) \\<times> 'm2) bisim\"\n  (\"_ \\<turnstile> _ \\<approx>i _\"[50,50,50] 60)\nfor t :: 't\nwhere\n  PreStart: \"t \\<turnstile> (x1, m1) \\<approx> (x2, m2) \\<Longrightarrow> t \\<turnstile> ((PreStart, x1), m1) \\<approx>i ((PreStart, x2), m2)\"\n| Running: \"t \\<turnstile> (x1, m1) \\<approx> (x2, m2) \\<Longrightarrow> t \\<turnstile> ((Running, x1), m1) \\<approx>i ((Running, x2), m2)\"\n| Finished: \n    \"\\<lbrakk> t \\<turnstile> (x1, m1) \\<approx> (x2, m2); final1 x1; final2 x2 \\<rbrakk>\n    \\<Longrightarrow> t \\<turnstile> ((Finished, x1), m1) \\<approx>i ((Finished, x2), m2)\"\n\ndefinition init_fin_bisim_wait :: \"(status \\<times> 'x1, status \\<times> 'x2) bisim\" (\"_ \\<approx>iw _\" [50,50] 60)\nwhere \n  \"init_fin_bisim_wait = (\\<lambda>(status1, x1) (status2, x2). status1 = Running \\<and> status2 = Running \\<and> x1 \\<approx>w x2)\"\n\ninductive_simps init_fin_bisim_simps [simp]:\n  \"t \\<turnstile> ((PreStart, x1), m1) \\<approx>i ((s2, x2), m2)\"\n  \"t \\<turnstile> ((Running, x1), m1) \\<approx>i ((s2, x2), m2)\"\n  \"t \\<turnstile> ((Finished, x1), m1) \\<approx>i ((s2, x2), m2)\"\n  \"t \\<turnstile> ((s1, x1), m1) \\<approx>i ((PreStart, x2), m2)\"\n  \"t \\<turnstile> ((s1, x1), m1) \\<approx>i ((Running, x2), m2)\"\n  \"t \\<turnstile> ((s1, x1), m1) \\<approx>i ((Finished, x2), m2)\"\n\nlemma init_fin_bisim_iff:\n  \"t \\<turnstile> ((s1, x1), m1) \\<approx>i ((s2, x2), m2) \\<longleftrightarrow> \n   s1 = s2 \\<and> t \\<turnstile> (x1, m1) \\<approx> (x2, m2) \\<and> (s2 = Finished \\<longrightarrow> final1 x1 \\<and> final2 x2)\"\nby(cases s1) auto\n\nlemma nta_bisim_init_fin_bisim [simp]:\n  \"nta_bisim init_fin_bisim (convert_new_thread_action (Pair PreStart) nt1)\n      (convert_new_thread_action (Pair PreStart) nt2) =\n   nta_bisim bisim nt1 nt2\"\nby(cases nt1) simp_all\n\nlemma ta_bisim_init_fin_bisim_convert [simp]:\n  \"ta_bisim init_fin_bisim (convert_TA_initial (convert_obs_initial ta1)) (convert_TA_initial (convert_obs_initial ta2)) \\<longleftrightarrow> ta1 \\<sim>m ta2\"\nby(auto simp add: ta_bisim_def list_all2_map1 list_all2_map2)\n\nlemma ta_bisim_init_fin_bisim_InitialThreadAction [simp]:\n  \"ta_bisim init_fin_bisim \\<lbrace>InitialThreadAction\\<rbrace> \\<lbrace>InitialThreadAction\\<rbrace>\"\nby(simp add: ta_bisim_def)\n\nlemma ta_bisim_init_fin_bisim_ThreadFinishAction [simp]:\n  \"ta_bisim init_fin_bisim \\<lbrace>ThreadFinishAction\\<rbrace> \\<lbrace>ThreadFinishAction\\<rbrace>\"\nby(simp add: ta_bisim_def)\n\nlemma init_fin_bisim_wait_simps [simp]:\n  \"(status1, x1) \\<approx>iw (status2, x2) \\<longleftrightarrow> status1 = Running \\<and> status2 = Running \\<and> x1 \\<approx>w x2\"\nby(simp add: init_fin_bisim_wait_def)\n\nlemma init_fin_lift_state_mbisimI:\n  \"s \\<approx>m s' \\<Longrightarrow>\n  FWbisimulation_base.mbisim init_fin_bisim init_fin_bisim_wait (init_fin_lift_state Running s) (init_fin_lift_state Running s')\"\napply(rule FWbisimulation_base.mbisimI)\n      apply(simp add: thr_init_fin_list_state' o_def dom_map_option mbisim_finite1)\n     apply(simp add: locks_init_fin_lift_state mbisim_def)\n    apply(simp add: wset_init_fin_lift_state mbisim_def)\n   apply(simp add: interrupts_init_fin_lift_stae mbisim_def)\n  apply(clarsimp simp add: wset_init_fin_lift_state mbisim_def thr_init_fin_list_state' o_def wset_thread_ok_conv_dom dom_map_option del: subsetI)\n apply(drule_tac t=t in mbisim_thrNone_eq)\n apply(simp add: thr_init_fin_list_state)\napply(clarsimp simp add: thr_init_fin_list_state shr_init_fin_lift_state wset_init_fin_lift_state init_fin_bisim_iff)\napply(frule (1) mbisim_thrD1)\napply(simp add: mbisim_def)\ndone\n\nend\n\ncontext FWdelay_bisimulation_base begin\n\nlemma init_fin_delay_bisimulation_final_base:\n  \"delay_bisimulation_final_base (r1.init_fin t) (r2.init_fin t) (init_fin_bisim t) \n     r1.init_fin_\\<tau>move r2.init_fin_\\<tau>move (\\<lambda>(x1, m). r1.init_fin_final x1) (\\<lambda>(x2, m). r2.init_fin_final x2)\"\nby(unfold_locales)(auto 4 3)\n\nend\n\nlemma init_fin_bisim_flip [flip_simps]:\n  \"FWbisimulation_base.init_fin_bisim final2 final1 (\\<lambda>t. flip (bisim t)) =\n   (\\<lambda>t. flip (FWbisimulation_base.init_fin_bisim final1 final2 bisim t))\"\nby(auto simp only: FWbisimulation_base.init_fin_bisim_iff flip_simps fun_eq_iff split_paired_Ex)\n\nlemma init_fin_bisim_wait_flip [flip_simps]:\n  \"FWbisimulation_base.init_fin_bisim_wait (flip bisim_wait) =\n   flip (FWbisimulation_base.init_fin_bisim_wait bisim_wait)\"\nby(auto simp add: fun_eq_iff FWbisimulation_base.init_fin_bisim_wait_simps flip_simps)\n\ncontext FWdelay_bisimulation_lift_aux begin\n\nlemma init_fin_FWdelay_bisimulation_lift_aux:\n  \"FWdelay_bisimulation_lift_aux r1.init_fin_final r1.init_fin r2.init_fin_final r2.init_fin r1.init_fin_\\<tau>move r2.init_fin_\\<tau>move\"\nby(intro FWdelay_bisimulation_lift_aux.intro r1.\\<tau>multithreaded_wf_init_fin r2.\\<tau>multithreaded_wf_init_fin)\n\nlemma init_fin_FWdelay_bisimulation_final_base:\n  \"FWdelay_bisimulation_final_base \n     r1.init_fin_final r1.init_fin r2.init_fin_final r2.init_fin \n     init_fin_bisim r1.init_fin_\\<tau>move r2.init_fin_\\<tau>move\"\nby(intro FWdelay_bisimulation_final_base.intro init_fin_FWdelay_bisimulation_lift_aux FWdelay_bisimulation_final_base_axioms.intro init_fin_delay_bisimulation_final_base)\n\nend\n\ncontext FWdelay_bisimulation_obs begin\n\nlemma init_fin_simulation1:\n  assumes bisim: \"t \\<turnstile> s1 \\<approx>i s2\"\n    and red1: \"r1.init_fin t s1 tl1 s1'\"\n    and \\<tau>1: \"\\<not> r1.init_fin_\\<tau>move s1 tl1 s1'\"\n  shows \"\\<exists>s2' s2'' tl2. (\\<tau>trsys.silent_move (r2.init_fin t) r2.init_fin_\\<tau>move)\\<^sup>*\\<^sup>* s2 s2' \\<and>\n             r2.init_fin t s2' tl2 s2'' \\<and> \\<not> r2.init_fin_\\<tau>move s2' tl2 s2'' \\<and>\n             t \\<turnstile> s1' \\<approx>i s2'' \\<and> ta_bisim init_fin_bisim tl1 tl2\"\nproof -\n  from bisim obtain status x1 m1 x2 m2 \n    where s1: \"s1 = ((status, x1), m1)\"\n    and s2: \"s2 = ((status, x2), m2)\"\n    and bisim: \"t \\<turnstile> (x1, m1) \\<approx> (x2, m2)\"\n    and finished: \"status = Finished \\<Longrightarrow> final1 x1 \\<and> final2 x2\"\n    by(cases s1)(cases s2, fastforce simp add: init_fin_bisim_iff)\n  from red1 show ?thesis unfolding s1\n  proof(cases)\n    case (NormalAction ta1 x1' m1')\n    with \\<tau>1 s1 have \"\\<not> \\<tau>move1 (x1, m1) ta1 (x1', m1')\" by(simp)\n    from simulation1[OF bisim \\<open>t \\<turnstile> (x1, m1) -1-ta1\\<rightarrow> (x1', m1')\\<close> this]\n    obtain x2' m2' x2'' m2'' ta2\n      where red2: \"r2.silent_moves t (x2, m2) (x2', m2')\"\n      and red2': \"t \\<turnstile> (x2', m2') -2-ta2\\<rightarrow> (x2'', m2'')\"\n      and \\<tau>2: \"\\<not> \\<tau>move2 (x2', m2') ta2 (x2'', m2'')\"\n      and bisim': \"t \\<turnstile> (x1', m1') \\<approx> (x2'', m2'')\"\n      and tasim: \"ta1 \\<sim>m ta2\" by auto\n    let ?s2' = \"((Running, x2'), m2')\"\n    let ?s2'' = \"((Running, x2''), m2'')\"\n    let ?ta2 = \"(convert_TA_initial (convert_obs_initial ta2))\"\n    from red2 have \"\\<tau>trsys.silent_moves (r2.init_fin t) r2.init_fin_\\<tau>move s2 ?s2'\"\n      unfolding s2 \\<open>status = Running\\<close> by(rule r2.init_fin_silent_moves_RunningI)\n    moreover from red2' have \"r2.init_fin t ?s2' ?ta2 ?s2''\" by(rule r2.init_fin.NormalAction)\n    moreover from \\<tau>2 have \"\\<not> r2.init_fin_\\<tau>move ?s2' ?ta2 ?s2''\" by simp\n    moreover from bisim' have \"t \\<turnstile> s1' \\<approx>i ?s2''\"using \\<open>s1' = ((Running, x1'), m1')\\<close> by simp\n    moreover from tasim \\<open>tl1 = convert_TA_initial (convert_obs_initial ta1)\\<close>\n    have \"ta_bisim init_fin_bisim tl1 ?ta2\" by simp\n    ultimately show ?thesis by blast\n  next\n    case InitialThreadAction\n    with s1 s2 bisim show ?thesis by(auto simp del: split_paired_Ex)\n  next\n    case ThreadFinishAction\n    from final1_simulation[OF bisim] \\<open>final1 x1\\<close>\n    obtain x2' m2' where red2: \"r2.silent_moves t (x2, m2) (x2', m2')\"\n      and bisim': \"t \\<turnstile> (x1, m1) \\<approx> (x2', m2')\"\n      and fin2: \"final2 x2'\" by auto\n    let ?s2' = \"((Running, x2'), m2')\"\n    let ?s2'' = \"((Finished, x2'), m2')\"\n    from red2 have \"\\<tau>trsys.silent_moves (r2.init_fin t) r2.init_fin_\\<tau>move s2 ?s2'\"\n      unfolding s2 \\<open>status = Running\\<close> by(rule r2.init_fin_silent_moves_RunningI)\n    moreover from fin2 have \"r2.init_fin t ?s2' \\<lbrace>ThreadFinishAction\\<rbrace> ?s2''\" ..\n    moreover have \"\\<not> r2.init_fin_\\<tau>move ?s2' \\<lbrace>ThreadFinishAction\\<rbrace> ?s2''\" by simp\n    moreover have \"t \\<turnstile> s1' \\<approx>i ?s2''\"\n      using \\<open>s1' = ((Finished, x1), m1)\\<close> fin2 \\<open>final1 x1\\<close> bisim' by simp\n    ultimately show ?thesis unfolding \\<open>tl1 = \\<lbrace>ThreadFinishAction\\<rbrace>\\<close>\n      by(blast intro: ta_bisim_init_fin_bisim_ThreadFinishAction)\n  qed\nqed\n\nlemma init_fin_simulation2:\n  \"\\<lbrakk> t \\<turnstile> s1 \\<approx>i s2; r2.init_fin t s2 tl2 s2'; \\<not> r2.init_fin_\\<tau>move s2 tl2 s2' \\<rbrakk>\n  \\<Longrightarrow> \\<exists>s1' s1'' tl1. (\\<tau>trsys.silent_move (r1.init_fin t) r1.init_fin_\\<tau>move)\\<^sup>*\\<^sup>* s1 s1' \\<and>\n             r1.init_fin t s1' tl1 s1'' \\<and> \\<not> r1.init_fin_\\<tau>move s1' tl1 s1'' \\<and>\n             t \\<turnstile> s1'' \\<approx>i s2' \\<and> ta_bisim init_fin_bisim tl1 tl2\"\nusing FWdelay_bisimulation_obs.init_fin_simulation1[OF FWdelay_bisimulation_obs_flip]\nunfolding flip_simps .\n\nlemma init_fin_simulation_Wakeup1:\n  assumes bisim: \"t \\<turnstile> (sx1, m1) \\<approx>i (sx2, m2)\"\n  and wait: \"sx1 \\<approx>iw sx2\"\n  and red1: \"r1.init_fin t (sx1, m1) ta1 (sx1', m1')\"\n  and wakeup: \"Notified \\<in> set \\<lbrace>ta1\\<rbrace>\\<^bsub>w\\<^esub> \\<or> WokenUp \\<in> set \\<lbrace>ta1\\<rbrace>\\<^bsub>w\\<^esub>\"\n  shows \"\\<exists>ta2 sx2' m2'. r2.init_fin t (sx2, m2) ta2 (sx2', m2') \\<and> t \\<turnstile> (sx1', m1') \\<approx>i (sx2', m2') \\<and> \n                        ta_bisim init_fin_bisim ta1 ta2\"\nproof -\n  from bisim wait obtain status x1 x2 \n    where sx1: \"sx1 = (status, x1)\"\n    and sx2: \"sx2 = (status, x2)\"\n    and Bisim: \"t \\<turnstile> (x1, m1) \\<approx> (x2, m2)\"\n    and Wait: \"x1 \\<approx>w x2\" by cases auto\n  from red1 wakeup sx1 obtain x1' ta1' \n    where sx1': \"sx1' = (Running, x1')\"\n    and status: \"status = Running\"\n    and Red1: \"t \\<turnstile> (x1, m1) -1-ta1'\\<rightarrow> (x1', m1')\"\n    and ta1: \"ta1 = convert_TA_initial (convert_obs_initial ta1')\"\n    and Wakeup: \"Notified \\<in> set \\<lbrace>ta1'\\<rbrace>\\<^bsub>w\\<^esub> \\<or> WokenUp \\<in> set \\<lbrace>ta1'\\<rbrace>\\<^bsub>w\\<^esub>\"\n    by cases auto\n  from simulation_Wakeup1[OF Bisim Wait Red1 Wakeup] obtain ta2' x2' m2'\n    where red2: \"t \\<turnstile> (x2, m2) -2-ta2'\\<rightarrow> (x2', m2')\"\n    and bisim': \"t \\<turnstile> (x1', m1') \\<approx> (x2', m2')\" \n    and tasim: \"ta1' \\<sim>m ta2'\" by blast\n  let ?sx2' = \"(Running, x2')\"\n  let ?ta2 = \"convert_TA_initial (convert_obs_initial ta2')\"\n  from red2 have \"r2.init_fin t (sx2, m2) ?ta2 (?sx2', m2')\" unfolding sx2 status ..\n  moreover from bisim' sx1' have \"t \\<turnstile> (sx1', m1') \\<approx>i (?sx2', m2')\" by simp\n  moreover from tasim ta1 have \"ta_bisim init_fin_bisim ta1 ?ta2\" by simp\n  ultimately show ?thesis by blast\nqed\n\nlemma init_fin_simulation_Wakeup2:\n  \"\\<lbrakk> t \\<turnstile> (sx1, m1) \\<approx>i (sx2, m2); sx1 \\<approx>iw sx2; r2.init_fin t (sx2, m2) ta2 (sx2', m2');\n    Notified \\<in> set \\<lbrace>ta2\\<rbrace>\\<^bsub>w\\<^esub> \\<or> WokenUp \\<in> set \\<lbrace>ta2\\<rbrace>\\<^bsub>w\\<^esub> \\<rbrakk>\n  \\<Longrightarrow> \\<exists>ta1 sx1' m1'. r1.init_fin t (sx1, m1) ta1 (sx1', m1') \\<and> t \\<turnstile> (sx1', m1') \\<approx>i (sx2', m2') \\<and> \n                     ta_bisim init_fin_bisim ta1 ta2\"\nusing FWdelay_bisimulation_obs.init_fin_simulation_Wakeup1[OF FWdelay_bisimulation_obs_flip]\nunfolding flip_simps .\n\nlemma init_fin_delay_bisimulation_obs:\n  \"delay_bisimulation_obs (r1.init_fin t) (r2.init_fin t) (init_fin_bisim t) (ta_bisim init_fin_bisim)\n         r1.init_fin_\\<tau>move r2.init_fin_\\<tau>move\"\nby(unfold_locales)(erule (2) init_fin_simulation1 init_fin_simulation2)+\n\nlemma init_fin_FWdelay_bisimulation_obs:\n  \"FWdelay_bisimulation_obs r1.init_fin_final r1.init_fin r2.init_fin_final r2.init_fin init_fin_bisim init_fin_bisim_wait r1.init_fin_\\<tau>move r2.init_fin_\\<tau>move\"\nproof(intro FWdelay_bisimulation_obs.intro init_fin_FWdelay_bisimulation_final_base FWdelay_bisimulation_obs_axioms.intro init_fin_delay_bisimulation_obs)\n  fix t' sx m1 sxx m2 t sx1 sx2 sx1' ta1 sx1'' m1' sx2' ta2 sx2'' m2'\n  assume bisim: \"t' \\<turnstile> (sx, m1) \\<approx>i (sxx, m2)\" \n    and bisim1: \"t \\<turnstile> (sx1, m1) \\<approx>i (sx2, m2)\"\n    and red1: \"\\<tau>trsys.silent_moves (r1.init_fin t) r1.init_fin_\\<tau>move (sx1, m1) (sx1', m1)\"\n    and red1': \"r1.init_fin t (sx1', m1) ta1 (sx1'', m1')\"\n    and \\<tau>1: \"\\<not> r1.init_fin_\\<tau>move (sx1', m1) ta1 (sx1'', m1')\"\n    and red2: \"\\<tau>trsys.silent_moves (r2.init_fin t) r2.init_fin_\\<tau>move (sx2, m2) (sx2', m2)\"\n    and red2':\"r2.init_fin t (sx2', m2) ta2 (sx2'', m2')\"\n    and \\<tau>2: \"\\<not> r2.init_fin_\\<tau>move (sx2', m2) ta2 (sx2'', m2')\"\n    and bisim1': \"t \\<turnstile> (sx1'', m1') \\<approx>i (sx2'', m2')\"\n    and tasim: \"ta_bisim init_fin_bisim ta1 ta2\"\n  from bisim obtain status x xx \n    where sx:\"sx = (status, x)\"\n    and sxx: \"sxx = (status, xx)\"\n    and Bisim: \"t' \\<turnstile> (x, m1) \\<approx> (xx, m2)\"\n    and Finish: \"status = Finished \\<Longrightarrow> final1 x \\<and> final2 xx\"\n    by(cases sx)(cases sxx, auto simp add: init_fin_bisim_iff)\n  from bisim1 obtain status1 x1 x2\n    where sx1: \"sx1 = (status1, x1)\"\n    and sx2: \"sx2 = (status1, x2)\"\n    and Bisim1: \"t \\<turnstile> (x1, m1) \\<approx> (x2, m2)\"\n    by(cases sx1)(cases sx2, auto simp add: init_fin_bisim_iff)\n  from bisim1' obtain status1' x1'' x2''\n    where sx1'': \"sx1'' = (status1', x1'')\"\n    and sx2'': \"sx2'' = (status1', x2'')\"\n    and Bisim1': \"t \\<turnstile> (x1'', m1') \\<approx> (x2'', m2')\"\n     by(cases sx1'')(cases sx2'', auto simp add: init_fin_bisim_iff)\n  from red1 sx1 obtain x1' where sx1': \"sx1' = (status1, x1')\"\n    and Red1: \"r1.silent_moves t (x1, m1) (x1', m1)\"\n    by(cases sx1')(auto dest: r1.init_fin_silent_movesD)\n  from red2 sx2 obtain x2' where sx2': \"sx2' = (status1, x2')\"\n    and Red2: \"r2.silent_moves t (x2, m2) (x2', m2)\"\n    by(cases sx2')(auto dest: r2.init_fin_silent_movesD)\n  show \"t' \\<turnstile> (sx, m1') \\<approx>i (sxx, m2')\"\n  proof(cases \"status1 = Running \\<and> status1' = Running\")\n    case True\n    with red1' sx1' sx1'' obtain ta1'\n      where Red1': \"t \\<turnstile> (x1', m1) -1-ta1'\\<rightarrow> (x1'', m1')\"\n      and ta1: \"ta1 = convert_TA_initial (convert_obs_initial ta1')\"\n      by cases auto\n    from red2' sx2' sx2'' True obtain ta2'\n      where Red2': \"t \\<turnstile> (x2', m2) -2-ta2'\\<rightarrow> (x2'', m2')\"\n      and ta2: \"ta2 = convert_TA_initial (convert_obs_initial ta2')\"\n      by cases auto\n    from \\<tau>1 sx1' sx1'' ta1 True have \\<tau>1':\"\\<not> \\<tau>move1 (x1', m1) ta1' (x1'', m1')\" by simp\n    from \\<tau>2 sx2' sx2'' ta2 True have \\<tau>2':\"\\<not> \\<tau>move2 (x2', m2) ta2' (x2'', m2')\" by simp\n    from tasim ta1 ta2 have \"ta1' \\<sim>m ta2'\" by simp\n    with Bisim Bisim1 Red1 Red1' \\<tau>1' Red2 Red2' \\<tau>2' Bisim1'\n    have \"t' \\<turnstile> (x, m1') \\<approx> (xx, m2')\" by(rule bisim_inv_red_other)\n    with True Finish show ?thesis unfolding sx sxx by(simp add: init_fin_bisim_iff)\n  next\n    case False\n    with red1' sx1' sx1'' have \"m1' = m1\" by cases auto\n    moreover from red2' sx2' sx2'' False have \"m2' = m2\" by cases auto\n    ultimately show ?thesis using bisim by simp\n  qed\nnext\n  fix t sx1 m1 sx2 m2 sx1' ta1 sx1'' m1' sx2' ta2 sx2'' m2' w\n  assume bisim: \"t \\<turnstile> (sx1, m1) \\<approx>i (sx2, m2)\"\n    and red1: \"\\<tau>trsys.silent_moves (r1.init_fin t) r1.init_fin_\\<tau>move (sx1, m1) (sx1', m1)\"\n    and red1': \"r1.init_fin t (sx1', m1) ta1 (sx1'', m1')\"\n    and \\<tau>1: \"\\<not> r1.init_fin_\\<tau>move (sx1', m1) ta1 (sx1'', m1')\"\n    and red2: \"\\<tau>trsys.silent_moves (r2.init_fin t) r2.init_fin_\\<tau>move (sx2, m2) (sx2', m2)\"\n    and red2': \"r2.init_fin t (sx2', m2) ta2 (sx2'', m2')\"\n    and \\<tau>2: \"\\<not> r2.init_fin_\\<tau>move (sx2', m2) ta2 (sx2'', m2')\"\n    and bisim': \"t \\<turnstile> (sx1'', m1') \\<approx>i (sx2'', m2')\"\n    and tasim: \"ta_bisim init_fin_bisim ta1 ta2\"\n    and suspend1: \"Suspend w \\<in> set \\<lbrace>ta1\\<rbrace>\\<^bsub>w\\<^esub>\"\n    and suspend2: \"Suspend w \\<in> set \\<lbrace>ta2\\<rbrace>\\<^bsub>w\\<^esub>\"\n  from bisim obtain status x1 x2\n    where sx1: \"sx1 = (status, x1)\"\n    and sx2: \"sx2 = (status, x2)\"\n    and Bisim: \"t \\<turnstile> (x1, m1) \\<approx> (x2, m2)\"\n    by(cases sx1)(cases sx2, auto simp add: init_fin_bisim_iff)\n  from bisim' obtain status' x1'' x2''\n    where sx1'': \"sx1'' = (status', x1'')\"\n    and sx2'': \"sx2'' = (status', x2'')\"\n    and Bisim': \"t \\<turnstile> (x1'', m1') \\<approx> (x2'', m2')\"\n     by(cases sx1'')(cases sx2'', auto simp add: init_fin_bisim_iff)\n  from red1 sx1 obtain x1' where sx1': \"sx1' = (status, x1')\"\n    and Red1: \"r1.silent_moves t (x1, m1) (x1', m1)\"\n    by(cases sx1')(auto dest: r1.init_fin_silent_movesD)\n  from red2 sx2 obtain x2' where sx2': \"sx2' = (status, x2')\"\n    and Red2: \"r2.silent_moves t (x2, m2) (x2', m2)\"\n    by(cases sx2')(auto dest: r2.init_fin_silent_movesD)\n  from red1' sx1' sx1'' suspend1 obtain ta1'\n    where Red1': \"t \\<turnstile> (x1', m1) -1-ta1'\\<rightarrow> (x1'', m1')\"\n    and ta1: \"ta1 = convert_TA_initial (convert_obs_initial ta1')\"\n    and Suspend1: \"Suspend w \\<in> set \\<lbrace>ta1'\\<rbrace>\\<^bsub>w\\<^esub>\"\n    and status: \"status = Running\" \"status' = Running\" by cases auto\n  from red2' sx2' sx2'' suspend2 obtain ta2'\n    where Red2': \"t \\<turnstile> (x2', m2) -2-ta2'\\<rightarrow> (x2'', m2')\"\n    and ta2: \"ta2 = convert_TA_initial (convert_obs_initial ta2')\"\n    and Suspend2: \"Suspend w \\<in> set \\<lbrace>ta2'\\<rbrace>\\<^bsub>w\\<^esub>\" by cases auto\n  from \\<tau>1 sx1' sx1'' ta1 status have \\<tau>1':\"\\<not> \\<tau>move1 (x1', m1) ta1' (x1'', m1')\" by simp\n  from \\<tau>2 sx2' sx2'' ta2 status have \\<tau>2':\"\\<not> \\<tau>move2 (x2', m2) ta2' (x2'', m2')\" by simp\n  from tasim ta1 ta2 have \"ta1' \\<sim>m ta2'\" by simp\n  with Bisim Red1 Red1' \\<tau>1' Red2 Red2' \\<tau>2' Bisim' have \"x1'' \\<approx>w x2''\" \n    using Suspend1 Suspend2 by(rule bisim_waitI)\n  thus \"sx1'' \\<approx>iw sx2''\" using sx1'' sx2'' status by simp\nnext\n  fix t sx1 m1 sx2 m2 ta1 sx1' m1'\n  assume \"t \\<turnstile> (sx1, m1) \\<approx>i (sx2, m2)\" and \"sx1 \\<approx>iw sx2\"\n    and \"r1.init_fin t (sx1, m1) ta1 (sx1', m1')\"\n    and \"Notified \\<in> set \\<lbrace>ta1\\<rbrace>\\<^bsub>w\\<^esub> \\<or> WokenUp \\<in> set \\<lbrace>ta1\\<rbrace>\\<^bsub>w\\<^esub>\"\n  thus \"\\<exists>ta2 sx2' m2'. r2.init_fin t (sx2, m2) ta2 (sx2', m2') \\<and> t \\<turnstile> (sx1', m1') \\<approx>i (sx2', m2') \\<and> \n                       ta_bisim init_fin_bisim ta1 ta2\"\n    by(rule init_fin_simulation_Wakeup1)\nnext\n  fix t sx1 m1 sx2 m2 ta2 sx2' m2'\n  assume \"t \\<turnstile> (sx1, m1) \\<approx>i (sx2, m2)\" and \"sx1 \\<approx>iw sx2\"\n    and \"r2.init_fin t (sx2, m2) ta2 (sx2', m2')\"\n    and \"Notified \\<in> set \\<lbrace>ta2\\<rbrace>\\<^bsub>w\\<^esub> \\<or> WokenUp \\<in> set \\<lbrace>ta2\\<rbrace>\\<^bsub>w\\<^esub>\"\n  thus \"\\<exists>ta1 sx1' m1'. r1.init_fin t (sx1, m1) ta1 (sx1', m1') \\<and> t \\<turnstile> (sx1', m1') \\<approx>i (sx2', m2') \\<and> \n                       ta_bisim init_fin_bisim ta1 ta2\"\n    by(rule init_fin_simulation_Wakeup2)\nnext\n  show \"(\\<exists>sx1. r1.init_fin_final sx1) = (\\<exists>sx2. r2.init_fin_final sx2)\"\n    using ex_final1_conv_ex_final2 by(auto)\nqed\n\nend\n\ncontext FWdelay_bisimulation_diverge begin\n\nlemma init_fin_simulation_silent1:\n  \"\\<lbrakk> t \\<turnstile> sxm1 \\<approx>i sxm2; \\<tau>trsys.silent_move (r1.init_fin t) r1.init_fin_\\<tau>move sxm1 sxm1' \\<rbrakk>\n  \\<Longrightarrow> \\<exists>sxm2'. \\<tau>trsys.silent_moves (r2.init_fin t) r2.init_fin_\\<tau>move sxm2 sxm2' \\<and> t \\<turnstile> sxm1' \\<approx>i sxm2'\"\nby(cases sxm1')(auto 4 4 elim!: init_fin_bisim.cases dest!: r1.init_fin_silent_moveD dest: simulation_silent1 intro!: r2.init_fin_silent_moves_RunningI)\n\nlemma init_fin_simulation_silent2:\n  \"\\<lbrakk> t \\<turnstile> sxm1 \\<approx>i sxm2; \\<tau>trsys.silent_move (r2.init_fin t) r2.init_fin_\\<tau>move sxm2 sxm2' \\<rbrakk>\n  \\<Longrightarrow> \\<exists>sxm1'. \\<tau>trsys.silent_moves (r1.init_fin t) r1.init_fin_\\<tau>move sxm1 sxm1' \\<and> t \\<turnstile> sxm1' \\<approx>i sxm2'\"\nusing FWdelay_bisimulation_diverge.init_fin_simulation_silent1[OF FWdelay_bisimulation_diverge_flip]\nunfolding flip_simps .\n\nlemma init_fin_\\<tau>diverge_bisim_inv:\n  \"t \\<turnstile> sxm1 \\<approx>i sxm2 \n  \\<Longrightarrow> \\<tau>trsys.\\<tau>diverge (r1.init_fin t) r1.init_fin_\\<tau>move sxm1 =\n      \\<tau>trsys.\\<tau>diverge (r2.init_fin t) r2.init_fin_\\<tau>move sxm2\"\nby(cases sxm1)(cases sxm2, auto simp add: r1.init_fin_\\<tau>diverge_conv r2.init_fin_\\<tau>diverge_conv init_fin_bisim_iff \\<tau>diverge_bisim_inv)\n\nlemma init_fin_delay_bisimulation_diverge:\n  \"delay_bisimulation_diverge (r1.init_fin t) (r2.init_fin t) (init_fin_bisim t) (ta_bisim init_fin_bisim)\n         r1.init_fin_\\<tau>move r2.init_fin_\\<tau>move\"\nby(blast intro: delay_bisimulation_diverge.intro init_fin_delay_bisimulation_obs delay_bisimulation_diverge_axioms.intro init_fin_simulation_silent1 init_fin_simulation_silent2 init_fin_\\<tau>diverge_bisim_inv del: iffI)+\n\nlemma init_fin_FWdelay_bisimulation_diverge:\n  \"FWdelay_bisimulation_diverge r1.init_fin_final r1.init_fin r2.init_fin_final r2.init_fin init_fin_bisim init_fin_bisim_wait r1.init_fin_\\<tau>move r2.init_fin_\\<tau>move\"\nby(intro FWdelay_bisimulation_diverge.intro init_fin_FWdelay_bisimulation_obs FWdelay_bisimulation_diverge_axioms.intro init_fin_delay_bisimulation_diverge)\n\nend\n\ncontext FWbisimulation begin\n\nlemma init_fin_simulation1:\n  assumes \"t \\<turnstile> s1 \\<approx>i s2\" and \"r1.init_fin t s1 tl1 s1'\"\n  shows \"\\<exists>s2' tl2. r2.init_fin t s2 tl2 s2' \\<and> t \\<turnstile> s1' \\<approx>i s2' \\<and> ta_bisim init_fin_bisim tl1 tl2\"\nusing init_fin_simulation1[OF assms] by(auto simp add: \\<tau>moves_False init_fin_\\<tau>moves_False)\n\nlemma init_fin_simulation2:\n  \"\\<lbrakk> t \\<turnstile> s1 \\<approx>i s2; r2.init_fin t s2 tl2 s2' \\<rbrakk>\n  \\<Longrightarrow> \\<exists>s1' tl1. r1.init_fin t s1 tl1 s1' \\<and> t \\<turnstile> s1' \\<approx>i s2' \\<and> ta_bisim init_fin_bisim tl1 tl2\"\nusing FWbisimulation.init_fin_simulation1[OF FWbisimulation_flip]\nunfolding flip_simps .\n\nlemma init_fin_bisimulation: \n  \"bisimulation (r1.init_fin t) (r2.init_fin t)  (init_fin_bisim t) (ta_bisim init_fin_bisim)\"\nby(unfold_locales)(erule (1) init_fin_simulation1 init_fin_simulation2)+\n\nlemma init_fin_FWbisimulation:\n  \"FWbisimulation r1.init_fin_final r1.init_fin r2.init_fin_final r2.init_fin init_fin_bisim\"\nproof(intro FWbisimulation.intro r1.multithreaded_init_fin r2.multithreaded_init_fin FWbisimulation_axioms.intro init_fin_bisimulation)\n  fix t sx1 m1 sx2 m2\n  assume \"t \\<turnstile> (sx1, m1) \\<approx>i (sx2, m2)\"\n  thus \"r1.init_fin_final sx1 = r2.init_fin_final sx2\"\n    by cases simp_all\nnext\n  fix t' sx m1 sxx m2 t sx1 sx2 ta1 sx1' m1' ta2 sx2' m2'\n  assume \"t' \\<turnstile> (sx, m1) \\<approx>i (sxx, m2)\" \"t \\<turnstile> (sx1, m1) \\<approx>i (sx2, m2)\"\n    and \"r1.init_fin t (sx1, m1) ta1 (sx1', m1')\"\n    and \"r2.init_fin t (sx2, m2) ta2 (sx2', m2')\"\n    and \"t \\<turnstile> (sx1', m1') \\<approx>i (sx2', m2')\"\n    and \"ta_bisim init_fin_bisim ta1 ta2\"\n  from FWdelay_bisimulation_obs.bisim_inv_red_other\n  [OF init_fin_FWdelay_bisimulation_obs, OF this(1-2) _ this(3) _ _ this(4) _ this(5-6)]\n  show \"t' \\<turnstile> (sx, m1') \\<approx>i (sxx, m2')\" by(simp add: init_fin_\\<tau>moves_False)\nnext\n  show \"(\\<exists>sx1. r1.init_fin_final sx1) = (\\<exists>sx2. r2.init_fin_final sx2)\"\n    using ex_final1_conv_ex_final2 by(auto)\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Framework/FWBisimLift.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6261241772283035, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3326030318396058}}
{"text": "theory (*calc_name_core*)\nimports Main \"~~/src/HOL/Library/Code_Char\" \"~~/src/HOL/Code_Numeral\" (*always keep Code_char import last! its added for code generator to output Haskell strings instead of the isabelle nibble stuff *)\nbegin\n\n\n(*calc_structure*)\n\nclass Varmatch =\n  (* match takes a string occurring in a pattern and a term and returns the string \n     with a matching subterm. Never returns a list longer than 1. *)  \n  fixes \"match\" :: \"'a \\<Rightarrow> 'a \\<Rightarrow> ('a * 'a) list\"\n  fixes \"freevars\" :: \"'a \\<Rightarrow> 'a set\"\n  (* first argument matches return-type of match *)\n  fixes \"replace\" :: \"('a * 'a) \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n\n\ndefinition m_clash :: \"'a \\<times> 'b \\<Rightarrow> ('a \\<times> 'b) list \\<Rightarrow> bool\" (infix \"\\<inter>m\" 400) where \n\"x \\<inter>m y \\<equiv> \\<exists>a \\<in> set y. fst a = fst x \\<and> snd a \\<noteq> snd x\"\n\nlemma m_clash_simp[simp] : \"set (map fst m1) \\<inter> set (map fst m2) = {} \\<longrightarrow> (\\<forall>x \\<in> set m1. \\<not>(x \\<inter>m m2))\"\nunfolding m_clash_def by auto\n\nfun merge :: \"('a * 'b) list \\<Rightarrow> ('a * 'b) list  \\<Rightarrow> ('a * 'b) list \" (infix \"@m\" 400) where\n\"[] @m y = y\" |\n\"(x#xs) @m y = ( if x \\<inter>m y\n                 then [a \\<leftarrow> xs. fst a \\<noteq> fst x] @m [a \\<leftarrow> y . fst a \\<noteq> fst x] \n                 else x#(xs @m y) )\"\n\nlemma merge_simp[simp] :\n  fixes m1 m2\n  assumes \"(\\<forall>a\\<in>set m1. case a of (x, y) \\<Rightarrow> x = y)\"\n  and \"\\<forall>a\\<in>set m2. case a of (x, y) \\<Rightarrow> x = y\"\n  shows \"set (m1 @m m2) = set m1 \\<union> set m2\"\nusing assms(1)\nproof (induct m1)\n  case Nil\n    show ?case by simp\nnext\n  case (Cons x xs)\n    have \"\\<forall>a\\<in>set xs. case a of (a, b) \\<Rightarrow> a = b\"\n      by (metis Cons.prems(1) contra_subsetD set_subset_Cons)\n    with Cons(1) have 1: \"set (xs @m m2) = set xs \\<union> set m2\" by simp\n    { assume \"\\<not>(x \\<inter>m m2)\"\n      then have \"set ((x # xs) @m m2) = set (x#xs @m m2)\" by simp\n      with 1 have ?case by simp }\n    { assume \"(x \\<inter>m m2)\"\n      then have \"\\<exists>a \\<in> set m2. fst a = fst x \\<and> snd a \\<noteq> snd x\" unfolding m_clash_def by simp\n      then obtain a where 2: \"a \\<in> set m2\" and 3: \"fst a = fst x\" and 4: \"snd a \\<noteq> snd x\" by auto\n      then have False by (metis (full_types) Cons.prems(1) assms(2) fst_conv insertI1 old.prod.exhaust set_simps(2) snd_eqD split_beta)\n      then have ?case .. }\n    thus ?case\n      by (metis `\\<not> x \\<inter>m m2 \\<Longrightarrow> set ((x # xs) @m m2) = set (x # xs) \\<union> set m2`)\nqed \n\n\nlemma merge_simp2[simp] :\n  fixes m1 m2\n  assumes \"set (map fst m1) \\<inter> set (map fst m2) = {}\"\n  shows \"set (m1 @m m2) = set m1 \\<union> set m2\"\nusing assms\nproof (induct m1)\ncase Nil\n  show ?case by simp\nnext\ncase (Cons x xs)\n  then have \"set (map fst xs) \\<inter> set (map fst m2) = {}\" by simp\n  with Cons(1) have 1: \"set (xs @m m2) = set xs \\<union> set m2\" by simp\n  with Cons(2) have \"\\<not>(x \\<inter>m m2)\" by (metis insertCI m_clash_simp set_simps(2))\n  then have \"set ((x # xs) @m m2) = set( x#(xs @m m2) )\" by simp\n  then have \"set ((x # xs) @m m2) = set(xs @m m2) \\<union> {x}\" by simp\n  with 1 have \"set ((x # xs) @m m2) = set xs \\<union> set m2 \\<union> {x}\" by simp\n  thus ?case by simp\nqed\n\nfun(in Varmatch) replaceAll :: \"('a * 'a) list \\<Rightarrow> 'a \\<Rightarrow> 'a\"\nwhere\n  \"replaceAll Nil mtch = mtch\"\n| \"replaceAll (x # xs) mtch = replaceAll xs (replace x mtch)\"\n\nlemma replaceAll_simp: \"(replaceAll [(x, r)] m) \\<equiv> (replace (x, r) m)\" by auto\n\n\ndefinition(in Varmatch) ruleMatch :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\" where\n\"ruleMatch r m = (if freevars m = {} then (replaceAll (match r m) r) = m else False)\"\n\n(*lemma(in Varmatch) ruleMatch_simp[simp]: \"freevars m = {} \\<longrightarrow> ruleMatch r m \\<equiv> (replaceAll (match r m) r) = m\"*)\n\n\n\nclass Varmatch_preserving = Varmatch +\n  assumes inv: \"a = (replaceAll (match a a) a)\"\n\ninstantiation Atprop :: Varmatch\nbegin   \n  fun match_Atprop :: \"Atprop \\<Rightarrow> Atprop \\<Rightarrow> (Atprop * Atprop) list\"\n  where\n    \"match_Atprop (Atprop_Freevar free) mtch = [((Atprop_Freevar free), mtch)]\" |\n    \"match_Atprop _ _ = []\"\n\n  fun freevars_Atprop :: \"Atprop \\<Rightarrow> Atprop set\"\n  where\n    \"freevars_Atprop (Atprop_Freevar var) = {(Atprop_Freevar var)}\" |\n    \"freevars_Atprop _ = {}\" \n  \n  fun replace_Atprop :: \"(Atprop * Atprop) \\<Rightarrow> Atprop \\<Rightarrow> Atprop\"\n  where\n    \"replace_Atprop ((Atprop_Freevar x), mtch) (Atprop_Freevar free) = (if x = free then mtch else (Atprop_Freevar free))\" |\n    \"replace_Atprop _ pttrn = pttrn\"\n\n  \ninstance ..\nend\n\ninstantiation Action :: Varmatch\nbegin   \n  fun match_Action :: \"Action \\<Rightarrow> Action \\<Rightarrow> (Action * Action) list\"\n  where\n    \"match_Action (Action_Freevar free) mtch = [((Action_Freevar free), mtch)]\" |\n    \"match_Action _ _ = []\"\n\n  fun freevars_Action :: \"Action \\<Rightarrow> Action set\"\n  where\n    \"freevars_Action (Action_Freevar var) = {(Action_Freevar var)}\" |\n    \"freevars_Action _ = {}\" \n  \n  fun replace_Action :: \"(Action * Action) \\<Rightarrow> Action \\<Rightarrow> Action\"\n  where\n    \"replace_Action ((Action_Freevar x), mtch) (Action_Freevar free) = (if x = free then mtch else (Action_Freevar free))\" |\n    \"replace_Action _ pttrn = pttrn\"\n\n  \ninstance ..\nend\n\ninstantiation Agent :: Varmatch\nbegin   \n  fun match_Agent :: \"Agent \\<Rightarrow> Agent \\<Rightarrow> (Agent * Agent) list\"\n  where\n    \"match_Agent (Agent_Freevar free) mtch = [((Agent_Freevar free), mtch)]\" |\n    \"match_Agent _ _ = []\"\n\n  fun freevars_Agent :: \"Agent \\<Rightarrow> Agent set\"\n  where\n    \"freevars_Agent (Agent_Freevar var) = {(Agent_Freevar var)}\" |\n    \"freevars_Agent _ = {}\" \n  \n  fun replace_Agent :: \"(Agent * Agent) \\<Rightarrow> Agent \\<Rightarrow> Agent\"\n  where\n    \"replace_Agent ((Agent_Freevar x), mtch) (Agent_Freevar free) = (if x = free then mtch else (Agent_Freevar free))\" |\n    \"replace_Agent _ pttrn = pttrn\"\n\n  \ninstance ..\nend\n\n\ninstantiation Formula :: Varmatch\nbegin   \n  fun match_Formula :: \"Formula \\<Rightarrow> Formula \\<Rightarrow> (Formula * Formula) list\"\n  where\n    \"match_Formula (Formula_Atprop rule) (Formula_Atprop atprop) = map (\\<lambda>(x,y). (Formula_Atprop x, Formula_Atprop y)) (match rule atprop)\"\n  | \"match_Formula (Formula_Bin var11 op1 var12) (Formula_Bin var21 op2 var22) = (if op1 = op2 then (match var11 var21) @m (match var12 var22) else [])\"\n  | \"match_Formula (Formula_Freevar free) mtch = [((Formula_Freevar free), mtch)]\"\n\n  | \"match_Formula (Formula_Action_Formula op1 act1 form1) (Formula_Action_Formula op2 act2 form2) = (if op1 = op2 then map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match act1 act2) @m (match form1 form2) else [])\"\n  | \"match_Formula (Formula_Agent_Formula op1 ag1 form1) (Formula_Agent_Formula op2 ag2 form2) = (if op1 = op2 then map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match ag1 ag2) @m (match form1 form2) else [])\"\n  | \"match_Formula (Formula_Precondition act1) (Formula_Precondition act2) = map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match act1 act2)\"\n  | \"match_Formula _ _ = []\"\n  \n  fun freevars_Formula :: \"Formula \\<Rightarrow> Formula set\"\n  where\n    \"freevars_Formula (Formula_Atprop var) = image (\\<lambda>x. Formula_Atprop x) (freevars var)\"\n  | \"freevars_Formula (Formula_Bin var1 _ var2) = (freevars var1) \\<union> (freevars var2)\"\n  | \"freevars_Formula (Formula_Freevar var) = {(Formula_Freevar var)}\"\n\n  | \"freevars_Formula (Formula_Action_Formula _ act1 form1) = image (\\<lambda>x. Formula_Action x) (freevars act1) \\<union> (freevars form1)\"\n  | \"freevars_Formula (Formula_Agent_Formula _ ag1 form1) = image (\\<lambda>x. Formula_Agent x) (freevars ag1) \\<union> (freevars form1)\"\n  | \"freevars_Formula (Formula_Precondition act1) = image (\\<lambda>x. Formula_Action x) (freevars act1)\"\n  | \"freevars_Formula _ = {}\"\n\n  fun replace_Formula :: \"(Formula * Formula) \\<Rightarrow> Formula \\<Rightarrow> Formula\"\n  where\n    \"replace_Formula ((Formula_Atprop x), (Formula_Atprop rep)) (Formula_Atprop atprop) = Formula_Atprop (replace (x, rep) atprop)\"\n  | \"replace_Formula (x, rep) (Formula_Bin var1 op1 var2) = Formula_Bin (replace (x, rep) var1) op1 (replace (x, rep) var2)\"\n  | \"replace_Formula (x, mtch) (Formula_Freevar free) = (if x = (Formula_Freevar free) then mtch else (Formula_Freevar free))\"\n\n  | \"replace_Formula ((Formula_Action x), (Formula_Action rep)) (Formula_Action_Formula op1 act1 form1) = Formula_Action_Formula op1 (replace (x, rep) act1) (replace ((Formula_Action x), (Formula_Action rep)) form1)\"\n  | \"replace_Formula ((Formula_Agent x), (Formula_Agent rep)) (Formula_Agent_Formula op1 ag1 form1) = Formula_Agent_Formula op1 (replace (x, rep) ag1) (replace ((Formula_Agent x), (Formula_Agent rep)) form1)\"\n\n  | \"replace_Formula (x, rep) (Formula_Action_Formula op1 act1 form1) = Formula_Action_Formula op1 act1 (replace (x, rep) form1)\"\n  | \"replace_Formula (x, rep) (Formula_Agent_Formula op1 ag1 form1) = Formula_Agent_Formula op1 ag1 (replace (x, rep) form1)\"\n\n  | \"replace_Formula ((Formula_Action x), (Formula_Action rep)) (Formula_Precondition act1) = Formula_Precondition (replace (x, rep) act1)\"\n\n  | \"replace_Formula (_, _) y = y\" \ninstance ..\nend\n\ninstantiation Structure :: Varmatch\nbegin   \n  fun match_Structure :: \"Structure \\<Rightarrow> Structure \\<Rightarrow> (Structure * Structure) list\"\n  where\n(*(*uncommentL?Structure_Formula*)  \"match_Structure (Structure_Formula rule) (Structure_Formula form) = map (\\<lambda>(x,y). (Structure_Formula x, Structure_Formula y)) (match rule form)\" |(*uncommentR?Structure_Formula*)*)\n(*(*uncommentL?Structure_Bin*)  \"match_Structure (Structure_Bin var11 op1 var12) (Structure_Bin var21 op2 var22) = (if op1 = op2 then (match var11 var21) @m (match var12 var22) else [])\" |(*uncommentR?Structure_Bin*)*)\n(*(*uncommentL?Structure_Freevar*)  \"match_Structure (Structure_Freevar free) mtch = [((Structure_Freevar free), mtch)]\" |(*uncommentR?Structure_Freevar*)*)\n  \n  \"match_Structure (Structure_Action_Structure op1 act1 struct1) (Structure_Action_Structure op2 act2 struct2) = (if op1 = op2 then map (\\<lambda>(x,y). (Structure_Formula (Formula_Action x), Structure_Formula (Formula_Action y))) (match act1 act2) @m (match struct1 struct2) else [])\" |\n  \"match_Structure (Structure_Agent_Structure op1 ag1 struct1) (Structure_Agent_Structure op2 ag2 struct2) = (if op1 = op2 then map (\\<lambda>(x,y). (Structure_Formula (Formula_Agent x), Structure_Formula (Formula_Agent y))) (match ag1 ag2) @m (match struct1 struct1) else [])\" |\n  \"match_Structure (Structure_Phi act1) (Structure_Phi act2) = map (\\<lambda>(x,y). (Structure_Formula (Formula_Action x), Structure_Formula (Formula_Action y))) (match act1 act2)\" |\n\n  \"match_Structure _ _ = []\"\n  \n  fun freevars_Structure :: \"Structure \\<Rightarrow> Structure set\"\n  where\n(*(*uncommentL?Structure_Formula*)  \"freevars_Structure (Structure_Formula var) = image (\\<lambda>x. Structure_Formula x) (freevars var)\" |(*uncommentR?Structure_Formula*)*)\n(*(*uncommentL?Structure_Bin*)  \"freevars_Structure (Structure_Bin var1 _ var2) = (freevars var1) \\<union> (freevars var2)\" |(*uncommentR?Structure_Bin*)*)\n(*(*uncommentL?Structure_Freevar*)  \"freevars_Structure (Structure_Freevar var) = {(Structure_Freevar var)}\" |(*uncommentR?Structure_Freevar*)*)\n  \"freevars_Structure (Structure_Action_Structure _ act1 struct) = image (\\<lambda>x. Structure_Formula (Formula_Action x)) (freevars act1) \\<union> (freevars struct)\" |\n  \"freevars_Structure (Structure_Agent_Structure _ ag1 struct) = image (\\<lambda>x. Structure_Formula (Formula_Agent x)) (freevars ag1) \\<union> (freevars struct)\" |\n  \"freevars_Structure (Structure_Phi act1) = image (\\<lambda>x. Structure_Formula (Formula_Action x)) (freevars act1)\" |\n\n  \"freevars_Structure _ = {}\"\n\n  fun replace_Structure :: \"(Structure * Structure) \\<Rightarrow> Structure \\<Rightarrow> Structure\"\n  where\n(*(*uncommentL?Structure_Formula*)  \"replace_Structure ((Structure_Formula x), (Structure_Formula rep)) (Structure_Formula form) = Structure_Formula (replace (x, rep) form)\" |(*uncommentR?Structure_Formula*)*)\n(*(*uncommentL?Structure_Bin*)  \"replace_Structure (x, rep) (Structure_Bin var1 op1 var2) = Structure_Bin (replace (x, rep) var1) op1 (replace (x, rep) var2)\" |(*uncommentR?Structure_Bin*)*)\n(*(*uncommentL?Structure_Freevar*)  \"replace_Structure (x, mtch) (Structure_Freevar free) = (if x = (Structure_Freevar free) then mtch else (Structure_Freevar free))\" |(*uncommentR?Structure_Freevar*)*)\n\n  \"replace_Structure ((Structure_Formula (Formula_Action x)), (Structure_Formula (Formula_Action rep))) (Structure_Action_Structure op1 act1 struct) = Structure_Action_Structure op1 (replace (x, rep) act1) (replace ((Structure_Formula (Formula_Action x)), (Structure_Formula (Formula_Action rep))) struct)\" |\n  \"replace_Structure ((Structure_Formula (Formula_Agent x)), (Structure_Formula (Formula_Agent rep))) (Structure_Agent_Structure op1 ag1 struct) = Structure_Agent_Structure op1 (replace (x, rep) ag1) (replace ((Structure_Formula (Formula_Agent x)), (Structure_Formula (Formula_Agent rep))) struct)\" |\n\n  \"replace_Structure (x, rep) (Structure_Action_Structure op1 act1 struct) = Structure_Action_Structure op1 act1 (replace (x, rep) struct)\" |\n  \"replace_Structure (x, rep) (Structure_Agent_Structure op1 ag1 struct) = Structure_Agent_Structure op1 ag1 (replace (x, rep) struct)\" |\n\n  \"replace_Structure ((Structure_Formula (Formula_Action x)), (Structure_Formula (Formula_Action rep))) (Structure_Phi act1) = Structure_Phi (replace (x, rep) act1)\" |\n  \"replace_Structure (_, _) y = y\"\n\ninstance ..\nend\n\nlemma inv_Atprop[simp]:\n  fixes a::Atprop\n  assumes \"free \\<in> set (match a a)\"\n  shows \"a = replace free a\"\nby (cases a, metis replace_Atprop.simps(3))\n(metis assms in_set_insert insert_Nil match_Atprop.simps(1) not_Cons_self2 replace_Atprop.simps(1) set_ConsD)\n\n\nlemma inv_Atprop_2[simp]:\n  fixes a::Atprop\n  shows \"a = replaceAll (match a a) a\"\nby (cases a, metis match_Atprop.simps(2) replaceAll.simps(1), simp)\n\n\nlemma freevars_replace_Atprop_simp[simp]: \"free \\<notin> freevars (a::Atprop) \\<longrightarrow> replace (free,free) a = a\" \nby (induct a) (cases free, auto, metis Atprop.exhaust replace_Atprop.simps(1) replace_Atprop.simps(2))\n\n\nlemma freevars_replace_Atprop_simp2 : \"free \\<in> freevars (a::Atprop) \\<longrightarrow> replace (free,free) a = a\"\nby (induct a) (cases free, auto)\n\nlemma match_Atprop_simp : \"\\<forall>(x, y) \\<in> set (match (a::Atprop) a). x = y\"\nby (cases a) auto\n\n\n\nlemma inv_Action[simp]:\n  fixes a::Action\n  assumes \"free \\<in> set (match a a)\"\n  shows \"a = replace free a\"\nby (cases a, metis replace_Action.simps(3))\n(metis assms in_set_insert insert_Nil match_Action.simps(1) not_Cons_self2 replace_Action.simps(1) set_ConsD)\n\n\nlemma inv_Action_2[simp]:\n  fixes a::Action\n  shows \"a = replaceAll (match a a) a\"\nby (cases a, metis match_Action.simps(2) replaceAll.simps(1), simp)\n\n\nlemma freevars_replace_Action_simp[simp]: \"free \\<notin> freevars (a::Action) \\<longrightarrow> replace (free,free) a = a\" \nby (induct a) (cases free, auto, metis Action.exhaust replace_Action.simps(1) replace_Action.simps(2))\n\nlemma freevars_replace_Action_simp2 : \"free \\<in> freevars (a::Action) \\<longrightarrow> replace (free,free) a = a\"\nby (induct a) (cases free, auto)\n\nlemma match_Action_simp : \"\\<forall>(x, y) \\<in> set (match (a::Action) a). x = y\"\nby (cases a) auto\n\n\n\n\n\nlemma inv_Agent[simp]:\n  fixes a::Agent\n  assumes \"free \\<in> set (match a a)\"\n  shows \"a = replace free a\"\nby (cases a, metis replace_Agent.simps(3))\n(metis assms in_set_insert insert_Nil match_Agent.simps(1) not_Cons_self2 replace_Agent.simps(1) set_ConsD)\n\n\nlemma inv_Agent_2[simp]:\n  fixes a::Agent\n  shows \"a = replaceAll (match a a) a\"\nby (cases a, metis match_Agent.simps(2) replaceAll.simps(1), simp)\n\n\nlemma freevars_replace_Agent_simp[simp]: \"free \\<notin> freevars (a::Agent) \\<longrightarrow> replace (free,free) a = a\" \nby (induct a) (cases free, auto, metis Agent.exhaust replace_Agent.simps(1) replace_Agent.simps(2))\n\nlemma freevars_replace_Agent_simp2 : \"free \\<in> freevars (a::Agent) \\<longrightarrow> replace (free,free) a = a\"\nby (induct a) (cases free, auto)\n\nlemma match_Agent_simp : \"\\<forall>(x, y) \\<in> set (match (a::Agent) a). x = y\"\nby (cases a) auto\n\n\n\n\n\nlemma freevars_replace_Formula_simp[simp]: \"free \\<notin> freevars (a::Formula) \\<longrightarrow> replace (free,free) a = a\" \napply (induct a)\napply (cases a)\napply (simp_all)\napply (cases free)\napply auto\napply (metis freevars_replace_Action_simp freevars_replace_Action_simp2)\napply (cases free)\napply auto\napply (metis freevars_replace_Agent_simp freevars_replace_Agent_simp2)\napply (cases free)\napply auto\napply (metis freevars_replace_Atprop_simp freevars_replace_Atprop_simp2)\napply (cases free)\napply auto\napply (metis freevars_replace_Action_simp freevars_replace_Action_simp2)\ndone\n\nlemma freevars_replace_Formula_simp2 : \"free \\<in> freevars (a::Formula) \\<longrightarrow> replace (free,free) a = a\"\nproof (rule, induct a)\n  case (Formula_Atprop x)\n    have 0: \"freevars (Formula_Atprop x) = image (\\<lambda>x. Formula_Atprop x) (freevars x)\" by simp\n    then obtain afree where \"afree \\<in> freevars x\" \"Formula_Atprop afree = free\"\n      by (metis Formula_Atprop.prems freevars_Formula.simps(1) imageE)\n    then have \"replace (free, free) (Formula_Atprop x) = Formula_Atprop (replace (afree, afree) x)\" by (metis replace_Formula.simps(1))\n    thus ?case\n      by (metis freevars_replace_Atprop_simp freevars_replace_Atprop_simp2)\nnext\n  case (Formula_Freevar x)\n    show ?case by simp\nnext\n  case (Formula_Bin x c y)\n    have 1: \"free \\<in> freevars (Formula_Bin x c y) \\<longrightarrow> replace (free, free) x = x\"\n    proof rule\n      assume \"free \\<in> freevars (Formula_Bin x c y)\"\n    { assume \"free \\<notin> freevars x\" then have \"replace (free, free) x = x\" using freevars_replace_Formula_simp by simp }\n      thus \"replace (free, free) x = x\" by (metis Formula_Bin.hyps(1))\n    qed\n    have 2: \"free \\<in> freevars (Formula_Bin x c y) \\<longrightarrow> replace (free, free) y = y\"\n    proof \n      assume \"free \\<in> freevars (Formula_Bin x c y)\"\n    { assume \"free \\<notin> freevars y\" then have \"replace (free, free) y = y\" using freevars_replace_Formula_simp by simp }\n      thus \"replace (free, free) y = y\" by (metis Formula_Bin.hyps(2))\n    qed\n    have \"free \\<in> freevars (Formula_Bin x c y) \\<longrightarrow> replace (free, free) (Formula_Bin x c y) = Formula_Bin (replace (free, free) x) c (replace (free, free) y)\" by (metis replace_Formula.simps)\n    with 1 2 show ?case by (metis Formula_Bin.prems)\nnext\n    case (Formula_Action x)\n    show ?case by simp\nnext\n  case (Formula_Agent x)\n    show ?case by simp\nnext\n  case (Formula_Precondition x)\n    have 0: \"freevars (Formula_Precondition x) = image (\\<lambda>x. Formula_Action x) (freevars x)\" by simp\n    then obtain afree where \"afree \\<in> freevars x\" \"Formula_Action afree = free\" \n      by (metis Formula_Precondition.prems freevars_Formula.simps(6) imageE)\n    then have \"replace (free, free) (Formula_Precondition x) = Formula_Precondition (replace (afree, afree) x)\" by (metis replace_Formula.simps(34))\n    thus ?case by (metis freevars_replace_Action_simp freevars_replace_Action_simp2)\nnext\n  case (Formula_Action_Formula c x y)\n    have 1: \"free \\<in> freevars (Formula_Action_Formula c x y) \\<longrightarrow> replace (free, free) (Formula_Action x) = (Formula_Action x)\" by simp\n    have 2: \"free \\<in> freevars (Formula_Action_Formula c x y) \\<longrightarrow> replace (free, free) y = y\"\n    proof \n      assume \"free \\<in> freevars (Formula_Action_Formula c x y)\"\n    { assume \"free \\<notin> freevars y\" then have \"replace (free, free) y = y\" using freevars_replace_Formula_simp by simp }\n      thus \"replace (free, free) y = y\" by (metis Formula_Action_Formula.hyps)\n    qed\n    with 1 have \"free \\<in> freevars (Formula_Action_Formula c x y) \\<longrightarrow> replace (free, free) (Formula_Action_Formula c x y) = Formula_Action_Formula c x (replace (free, free) y)\"\n      by (cases free, simp_all) (metis freevars_replace_Action_simp freevars_replace_Action_simp2)\n    with 2 show ?case by (metis Formula_Action_Formula.prems)\nnext\n  case (Formula_Agent_Formula c x y)\n    have 1: \"free \\<in> freevars (Formula_Agent_Formula c x y) \\<longrightarrow> replace (free, free) (Formula_Agent x) = (Formula_Agent x)\" by simp\n    have 2: \"free \\<in> freevars (Formula_Agent_Formula c x y) \\<longrightarrow> replace (free, free) y = y\"\n    proof \n      assume \"free \\<in> freevars (Formula_Agent_Formula c x y)\"\n    { assume \"free \\<notin> freevars y\" then have \"replace (free, free) y = y\" using freevars_replace_Formula_simp by simp }\n      thus \"replace (free, free) y = y\" by (metis Formula_Agent_Formula.hyps)\n    qed\n    with 1 have \"free \\<in> freevars (Formula_Agent_Formula c x y) \\<longrightarrow> replace (free, free) (Formula_Agent_Formula c x y) = Formula_Agent_Formula c x (replace (free, free) y)\"\n      by (cases free, simp_all) (metis freevars_replace_Agent_simp freevars_replace_Agent_simp2)\n    with 2 show ?case by (metis Formula_Agent_Formula.prems)\nqed\n\n\n\nlemma match_Formula_simp : \"\\<forall>(x, y) \\<in> set (match (a::Formula) a). x = y\"\nproof (induct a)\n  case (Formula_Atprop x)\n    have 0: \"match (Formula_Atprop x) (Formula_Atprop x) = map (\\<lambda>(x,y). (Formula_Atprop x, Formula_Atprop y)) (match x x)\" by simp\n    have \"\\<forall>a\\<in>set (match x x). case a of (x, y) \\<Rightarrow> x = y\" by (metis match_Atprop_simp)\n    then have \"\\<forall>a\\<in>set( map (\\<lambda>(x,y). (Formula_Atprop x, Formula_Atprop y)) (match x x)). case a of (x, y) \\<Rightarrow> x = y\" by auto\n    with 0 show ?case using match_Atprop_simp by simp\nnext\n  case (Formula_Freevar x)\n    show ?case by auto\nnext\n  case (Formula_Bin x c y)\n    have assms: \"\\<forall>(a, b) \\<in> set (match x x). a = b\" \"\\<forall>(a, b) \\<in> set (match y y). a = b\" \n      by (metis Formula_Bin.hyps(1)) (metis Formula_Bin.hyps(2))\n    have 0: \"set (match (Formula_Bin x c y) (Formula_Bin x c y)) = set ((match x x) @m (match y y))\" by simp\n    from Formula_Bin have \"set ((match x x) @m (match y y)) = set (match x x) \\<union> set (match y y)\" by simp\n    with assms 0 show ?case by auto\nnext\n  case (Formula_Action x)\n    show ?case by simp\nnext\n  case (Formula_Agent x)\n    show ?case by simp\nnext\n  case (Formula_Precondition x)\n    have 0: \"match (Formula_Precondition x) (Formula_Precondition x) = map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x)\" by simp\n    have \"\\<forall>a\\<in>set (match x x). case a of (x, y) \\<Rightarrow> x = y\" by (metis match_Action_simp)\n    then have \"\\<forall>a\\<in>set( map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x)). case a of (x, y) \\<Rightarrow> x = y\" by auto\n    with 0 show ?case using match_Atprop_simp by simp\nnext\n  case (Formula_Action_Formula c x y)\n    have assms: \"\\<forall>(a, b) \\<in> set (match x x). a = b\" using match_Action_simp by simp\n    then have a: \"\\<forall>a\\<in>set ( map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x) ). case a of (x, y) \\<Rightarrow> x = y\" by auto\n    have 0: \"set (match (Formula_Action_Formula c x y) (Formula_Action_Formula c x y)) = set ( map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x) @m (match y y) )\" by simp\n    with a Formula_Action_Formula have \"set ( map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x) @m (match y y)) = \n      set ( map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x) ) \\<union> set (match y y)\" by simp\n    with assms 0 show ?case by (metis Formula_Action_Formula.hyps Un_iff a)\nnext\n  case (Formula_Agent_Formula c x y)\n    have assms: \"\\<forall>(a, b) \\<in> set (match x x). a = b\" using match_Agent_simp by simp\n    then have a: \"\\<forall>a\\<in>set ( map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x) ). case a of (x, y) \\<Rightarrow> x = y\" by auto\n    have 0: \"set (match (Formula_Agent_Formula c x y) (Formula_Agent_Formula c x y)) = set ( map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x) @m (match y y) )\" by simp\n    with a Formula_Agent_Formula have \"set ( map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x) @m (match y y)) = \n      set ( map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x) ) \\<union> set (match y y)\" by simp\n    with assms 0 show ?case by (metis Formula_Agent_Formula.hyps Un_iff a)\nqed\n\nlemma inv_Formula[simp]:\n  fixes a::Formula\n  shows \"\\<forall>free \\<in> set (match a a). a = replace free a\"\nproof (induct a)\n  case (Formula_Atprop x)\n    show ?case by auto\nnext\n  case (Formula_Bin x c y)\n    obtain z where 0: \"z = (Formula_Bin x c y)\" by simp\n    have 1: \"\\<forall>free \\<in> set (match z z). replace free z = Formula_Bin (replace free x) c (replace free y)\"\n      by (metis \"0\" old.prod.exhaust replace_Formula.simps)\n    have \"\\<forall>free \\<in> set (match z z). replace free x = x\" \"\\<forall>free \\<in> set (match z z). replace free y = y\"\n    proof auto\n      fix a b\n      assume \"(a, b) \\<in> set (match z z)\"\n      then have eq: \"a = b\" using match_Formula_simp by (metis (full_types) splitD)\n      have x: \"a \\<notin> freevars x \\<longrightarrow> replace (a,b) x = x\" and \"a \\<in> freevars x \\<longrightarrow> replace (a,b) x = x\"\n        by (metis eq freevars_replace_Formula_simp) (metis freevars_replace_Formula_simp2 eq)\n      thus \"replace (a, b) x = x\" by auto\n      from eq have \"a \\<notin> freevars y \\<longrightarrow> replace (a,b) y = y\" \"a \\<in> freevars y \\<longrightarrow> replace (a,b) y = y\"\n        by (metis eq freevars_replace_Formula_simp) (metis freevars_replace_Formula_simp2 eq)\n      thus \"replace (a, b) y = y\" by auto\n    qed\n    thus ?case by (metis \"0\" \"1\")\nnext\n  case (Formula_Freevar x)\n    show ?case by simp\nnext\n  case (Formula_Action x)\n    show ?case by simp\nnext\n  case (Formula_Agent x)\n    show ?case by simp\nnext\n  case (Formula_Precondition x)\n    show ?case by auto\nnext\n  case (Formula_Action_Formula c x y)\n    obtain z where 0: \"z = (Formula_Action_Formula c x y)\" by simp\n\n    have 1: \"\\<forall>free \\<in> set (match z z). replace free (Formula_Action x) = (Formula_Action x)\" by auto\n    have 2: \"\\<forall>free \\<in> set (match z z). replace free y = y\"\n    proof auto\n      fix a b\n      assume \"(a, b) \\<in> set (match z z)\"\n      then have eq: \"a = b\" using match_Formula_simp by (metis (full_types) splitD)\n      from eq have \"a \\<notin> freevars y \\<longrightarrow> replace (a,b) y = y\" \"a \\<in> freevars y \\<longrightarrow> replace (a,b) y = y\"\n        by (metis eq freevars_replace_Formula_simp) (metis freevars_replace_Formula_simp2 eq)\n      thus \"replace (a, b) y = y\" by auto\n    qed\n    \n    have \"\\<forall>free \\<in> set (match z z). replace free (Formula_Action_Formula c x y) = Formula_Action_Formula c x (replace free y)\"\n    proof auto\n      fix a b\n      assume assm: \"(a,b) \\<in> set (match z z)\"\n      then have eq: \"a = b\" using match_Formula_simp by (metis (full_types) splitD)\n\n      from 0 have \"match z z = map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x) @m match y y\" by simp \n      then have 3: \"set (match z z) = set (map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x) @m (match y y))\" by simp \n\n      have assms: \"\\<forall>(a, b) \\<in> set (match x x). a = b\" using match_Action_simp by simp\n      then have a: \"\\<forall>a\\<in>set ( map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x) ). case a of (x, y) \\<Rightarrow> x = y\" by auto\n      have 0: \"set (match (Formula_Action_Formula c x y) (Formula_Action_Formula c x y)) = set ( map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x) @m (match y y) )\" by simp\n      with a match_Formula_simp have \"set ( map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x) @m (match y y)) = \n      set ( map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x) ) \\<union> set (match y y)\" by simp\n      with 3 eq 0 assm have ab_in_z: \"(a,b) \\<in> set (map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x)) \\<union> set (match y y)\" by simp\n\n      { assume \"(a,b) \\<in> set (map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x))\"\n        then obtain a' b' where \"Formula_Action a' = a\" \"Formula_Action b' = b\" by auto\n        then have 1: \"replace (a,b) (Formula_Action_Formula c x y) = Formula_Action_Formula c (replace (a',b') x) (replace (a,b) y)\" by auto\n        have \"(replace (a',b') x) = x\" by (metis Formula.inject(1) `Formula_Action a' = a` `Formula_Action b' = b` eq freevars_replace_Action_simp freevars_replace_Action_simp2)\n        with 1 have \"replace (a,b) (Formula_Action_Formula c x y) = Formula_Action_Formula c x (replace (a,b) y)\" by simp }\n      { assume \"(a,b) \\<notin> set (map (\\<lambda>(x,y). (Formula_Action x, Formula_Action y)) (match x x))\"\n        with ab_in_z have \"(a,b) \\<in> set (match y y)\" by simp\n        then have 1: \"replace (a,b) (Formula_Action_Formula c x y) = Formula_Action_Formula c x (replace (a,b) y)\"\n          by (cases a, cases b, auto) (metis Formula.inject(1) eq freevars_replace_Action_simp freevars_replace_Action_simp2) }\n      thus \"replace (a,b) (Formula_Action_Formula c x y) = Formula_Action_Formula c x (replace (a,b) y)\" \n        by (metis `(a, b) \\<in> set (map (\\<lambda>(x, y). (Formula_Action x, Formula_Action y)) (match x x)) \\<Longrightarrow> replace (a, b) (ActF\\<^sub>F c x y) = ActF\\<^sub>F c x replace (a, b) y`)\n    qed\n    with 0 1 2 show ?case by simp\nnext\n  case (Formula_Agent_Formula c x y)\n    obtain z where 0: \"z = (Formula_Agent_Formula c x y)\" by simp\n\n    have 1: \"\\<forall>free \\<in> set (match z z). replace free (Formula_Agent x) = (Formula_Agent x)\" by auto\n    have 2: \"\\<forall>free \\<in> set (match z z). replace free y = y\"\n    proof auto\n      fix a b\n      assume \"(a, b) \\<in> set (match z z)\"\n      then have eq: \"a = b\" using match_Formula_simp by (metis (full_types) splitD)\n      from eq have \"a \\<notin> freevars y \\<longrightarrow> replace (a,b) y = y\" \"a \\<in> freevars y \\<longrightarrow> replace (a,b) y = y\"\n        by (metis eq freevars_replace_Formula_simp) (metis freevars_replace_Formula_simp2 eq)\n      thus \"replace (a, b) y = y\" by auto\n    qed\n    \n    have \"\\<forall>free \\<in> set (match z z). replace free (Formula_Agent_Formula c x y) = Formula_Agent_Formula c x (replace free y)\"\n    proof auto\n      fix a b\n      assume assm: \"(a,b) \\<in> set (match z z)\"\n      then have eq: \"a = b\" using match_Formula_simp by (metis (full_types) splitD)\n\n      from 0 have \"match z z = map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x) @m match y y\" by simp \n      then have 3: \"set (match z z) = set (map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x) @m (match y y))\" by simp \n\n      have assms: \"\\<forall>(a, b) \\<in> set (match x x). a = b\" using match_Agent_simp by simp\n      then have a: \"\\<forall>a\\<in>set ( map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x) ). case a of (x, y) \\<Rightarrow> x = y\" by auto\n      have 0: \"set (match (Formula_Agent_Formula c x y) (Formula_Agent_Formula c x y)) = set ( map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x) @m (match y y) )\" by simp\n      with a match_Formula_simp have \"set ( map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x) @m (match y y)) = \n      set ( map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x) ) \\<union> set (match y y)\" by simp\n      with 3 eq 0 assm have ab_in_z: \"(a,b) \\<in> set (map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x)) \\<union> set (match y y)\" by simp\n\n      { assume \"(a,b) \\<in> set (map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x))\"\n        then obtain a' b' where \"Formula_Agent a' = a\" \"Formula_Agent b' = b\" by auto\n        then have 1: \"replace (a,b) (Formula_Agent_Formula c x y) = Formula_Agent_Formula c (replace (a',b') x) (replace (a,b) y)\" by auto\n        have \"(replace (a',b') x) = x\" by (metis Formula.inject(3) `Formula_Agent a' = a` `Formula_Agent b' = b` eq freevars_replace_Agent_simp freevars_replace_Agent_simp2)\n        with 1 have \"replace (a,b) (Formula_Agent_Formula c x y) = Formula_Agent_Formula c x (replace (a,b) y)\" by simp }\n      { assume \"(a,b) \\<notin> set (map (\\<lambda>(x,y). (Formula_Agent x, Formula_Agent y)) (match x x))\"\n        with ab_in_z have \"(a,b) \\<in> set (match y y)\" by simp\n        then have 1: \"replace (a,b) (Formula_Agent_Formula c x y) = Formula_Agent_Formula c x (replace (a,b) y)\"\n          by (cases a, auto, cases b, auto) (metis Formula.inject(3) eq freevars_replace_Agent_simp freevars_replace_Agent_simp2) }\n      thus \"replace (a,b) (Formula_Agent_Formula c x y) = Formula_Agent_Formula c x (replace (a,b) y)\"\n        by (metis `(a, b) \\<in> set (map (\\<lambda>(x, y). (Formula_Agent x, Formula_Agent y)) (match x x)) \\<Longrightarrow> replace (a, b) (AgF\\<^sub>F c x y) = AgF\\<^sub>F c x replace (a, b) y` eq)\n    qed\n    with 0 1 2 show ?case by simp\nqed\n\n\nlemma inv_Formula2_aux[simp]: \nfixes a::Formula and list\nassumes \"set list \\<subseteq> set (match a a)\"\nshows \"replaceAll list a = a\"\nusing assms\nby (induct list a rule:replaceAll.induct, simp) (metis insert_subset inv_Formula replaceAll.simps(2) set_simps(2))\n\nlemma inv_Formula2: \"replaceAll (match a a) a = (a::Formula)\" by simp\n\n\n\n\n\nlemma freevars_replace_Structure_simp : \"free \\<notin> freevars (a::Structure) \\<longrightarrow> replace (free,free) a = a\"\nproof (rule, induct a)\n  case Structure_Formula thus ?case by (cases free, auto) (metis freevars_replace_Formula_simp freevars_replace_Formula_simp2)\nnext\n  case Structure_Zer thus ?case by simp\nnext\n  case Structure_Bin thus ?case by simp\nnext\n  case Structure_Freevar thus ?case by simp\nnext\n  case (Structure_Phi act)\n    thus ?case\n    apply(cases free, cases act, simp_all, case_tac Formula, simp_all, case_tac Action, simp_all)\n    by (metis freevars_replace_Action_simp freevars_replace_Action_simp2)\nnext\n  case (Structure_Action_Structure op a s)\n    thus ?case \n    apply(cases free, cases s, cases a, simp_all, case_tac Formula, simp_all, case_tac Action, simp_all)\n    by (metis freevars_replace_Action_simp freevars_replace_Action_simp2)\nnext\n  case (Structure_Agent_Structure op a s)\n    thus ?case \n    apply(cases free, cases s, cases a, simp_all, case_tac Formula, simp_all, case_tac Agent, simp_all)\n    by (metis freevars_replace_Agent_simp freevars_replace_Agent_simp2)\nqed\n\nlemma freevars_replace_Structure_simp2 : \"free \\<in> freevars (a::Structure) \\<longrightarrow> replace (free,free) a = a\"\nproof (rule, induct a)\n(*(*uncommentL?Structure_Formula*)\n  case (Structure_Formula x)\n    have 0: \"freevars (Structure_Formula x) = image (\\<lambda>x. Structure_Formula x) (freevars x)\" by simp\n    then obtain ffree where \"ffree \\<in> freevars x\"\n      by (metis Structure_Formula.prems freevars_Structure.simps(1) imageE)\n    with 0 have \"replace (free, free) (Structure_Formula x) = Structure_Formula (replace (ffree, ffree) x)\" \n    proof -\n      have \"replace (ffree, ffree) x = x\" by (metis `ffree \\<in> freevars x` freevars_replace_Formula_simp2)\n      thus \"replace (free, free) (x \\<^sub>S) = replace (ffree, ffree) x \\<^sub>S\" using Structure_Formula.prems freevars_replace_Formula_simp2 by auto\n    qed\n    thus ?case\n      by (metis freevars_replace_Formula_simp freevars_replace_Formula_simp2)\n(*uncommentR?Structure_Formula*)*)\n(*(*uncommentL?Structure_Zer*)\nnext\n  case (Structure_Zer c)\n    thus ?case by simp\n(*uncommentR?Structure_Zer*)*)\nnext\n  case (Structure_Freevar x)\n    thus ?case by simp\nnext\n  case (Structure_Bin x c y)\n    have 1: \"free \\<in> freevars (Structure_Bin x c y) \\<longrightarrow> (replace (free, free) x) = x\"\n    proof rule\n      assume \"free \\<in> freevars (Structure_Bin x c y)\"\n    { assume \"free \\<notin> freevars x\" then have \"replace (free, free) x = x\" using freevars_replace_Structure_simp by simp }\n      thus \"replace (free, free) x = x\" by (metis Structure_Bin.hyps(1))\n    qed\n    have 2: \"free \\<in> freevars (Structure_Bin x c y) \\<longrightarrow> replace (free, free) y = y\"\n    proof \n      assume \"free \\<in> freevars (Structure_Bin x c y)\"\n    { assume \"free \\<notin> freevars y\" then have \"replace (free, free) y = y\" using freevars_replace_Structure_simp by simp }\n      thus \"replace (free, free) y = y\" by (metis Structure_Bin.hyps(2))\n    qed\n    have \"free \\<in> freevars (Structure_Bin x c y) \\<longrightarrow> replace (free, free) (Structure_Bin x c y) = Structure_Bin (replace (free, free) x) c (replace (free, free) y)\" by (metis replace_Structure.simps(2))\n    thus ?case by (metis \"1\" \"2\" Structure_Bin.prems)\nnext\n  case (Structure_Phi a)\n    thus ?case by(cases free, simp_all, case_tac Formula, simp_all, case_tac Action, simp_all) (metis freevars_replace_Action_simp freevars_replace_Action_simp2)\nnext\n  case (Structure_Action_Structure c x y)\n    have 1: \"free \\<in> freevars (Structure_Action_Structure c x y) \\<longrightarrow> replace (free, free) (Structure_Formula (Formula_Action x)) = (Structure_Formula (Formula_Action x))\" by(cases free, simp_all)\n    have 2: \"free \\<in> freevars (Structure_Action_Structure c x y) \\<longrightarrow> replace (free, free) y = y\"\n    proof \n      assume \"free \\<in> freevars (Structure_Action_Structure c x y)\"\n    { assume \"free \\<notin> freevars y\" then have \"replace (free, free) y = y\" using freevars_replace_Structure_simp by simp }\n      thus \"replace (free, free) y = y\" by (metis Structure_Action_Structure.hyps)\n    qed\n    with 1 have \"free \\<in> freevars (Structure_Action_Structure c x y) \\<longrightarrow> replace (free, free) (Structure_Action_Structure c x y) = Structure_Action_Structure c x (replace (free, free) y)\"\n      by (cases free, simp_all, case_tac Formula, simp_all, case_tac Action, simp_all) (metis freevars_replace_Action_simp freevars_replace_Action_simp2)\n    with 2 show ?case by (metis Structure_Action_Structure.prems)\nnext\n  case (Structure_Agent_Structure c x y)\n    have 1: \"free \\<in> freevars (Structure_Agent_Structure c x y) \\<longrightarrow> replace (free, free) (Structure_Formula (Formula_Agent x)) = (Structure_Formula (Formula_Agent x))\" by(cases free, simp_all)\n    have 2: \"free \\<in> freevars (Structure_Agent_Structure c x y) \\<longrightarrow> replace (free, free) y = y\"\n    proof \n      assume \"free \\<in> freevars (Structure_Agent_Structure c x y)\"\n    { assume \"free \\<notin> freevars y\" then have \"replace (free, free) y = y\" using freevars_replace_Structure_simp by simp }\n      thus \"replace (free, free) y = y\" by (metis Structure_Agent_Structure.hyps)\n    qed\n    with 1 have \"free \\<in> freevars (Structure_Agent_Structure c x y) \\<longrightarrow> replace (free, free) (Structure_Agent_Structure c x y) = Structure_Agent_Structure c x (replace (free, free) y)\"\n      by (cases free, simp_all, case_tac Formula, simp_all, case_tac Agent, simp_all) (metis freevars_replace_Agent_simp freevars_replace_Agent_simp2)\n    with 2 show ?case by (metis Structure_Agent_Structure.prems)\nqed\n\n\nlemma match_Structure_simp : \"\\<forall>(x, y) \\<in> set (match (a::Structure) a). x = y\"\nproof (induct a)\n  case (Structure_Formula x)\n    have 0: \"match (Structure_Formula x) (Structure_Formula x) = map (\\<lambda>(x,y). (Structure_Formula x, Structure_Formula y)) (match x x)\" by simp\n    have \"\\<forall>a\\<in>set (match x x). case a of (x, y) \\<Rightarrow> x = y\" by (metis match_Formula_simp)\n    then have \"\\<forall>a\\<in>set( map (\\<lambda>(x,y). (Structure_Formula x, Structure_Formula y)) (match x x)). case a of (x, y) \\<Rightarrow> x = y\" by auto\n    with 0 show ?case using match_Formula_simp by simp\nnext\n  case (Structure_Zer x)\n    show ?case by auto\nnext\n  case (Structure_Freevar x)\n    show ?case by auto\nnext\n  case (Structure_Bin x c y)\n    have assms: \"\\<forall>(a, b) \\<in> set (match x x). a = b\" \"\\<forall>(a, b) \\<in> set (match y y). a = b\" \n      by (metis Structure_Bin.hyps(1)) (metis Structure_Bin.hyps(2))\n    have 0: \"set (match (Structure_Bin x c y) (Structure_Bin x c y)) = set ((match x x) @m (match y y))\" by simp\n    from Structure_Bin have \"set ((match x x) @m (match y y)) = set (match x x) \\<union> set (match y y)\" by simp\n    with assms 0 show ?case by auto\nnext\n  case (Structure_Phi x)\n    have 0: \"match (Structure_Phi x) (Structure_Phi x) = map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y))) (match x x)\" by simp\n    have \"\\<forall>a\\<in>set (match x x). case a of (x, y) \\<Rightarrow> x = y\" by (metis match_Action_simp)\n    then have \"\\<forall>a\\<in>set( map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y))) (match x x) ). case a of (x, y) \\<Rightarrow> x = y\" by auto\n    with 0 show ?case using match_Atprop_simp by simp\nnext\n  case (Structure_Action_Structure c x y)\n    have assms: \"\\<forall>(a, b) \\<in> set (match x x). a = b\" using match_Action_simp by simp\n    then have a: \"\\<forall>a\\<in>set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y))) (match x x) ). case a of (x, y) \\<Rightarrow> x = y\" by auto\n    have 0: \"set (match (Structure_Action_Structure c x y) (Structure_Action_Structure c x y)) = set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y))) (match x x) @m (match y y) )\" by simp\n    with a Structure_Action_Structure have \"set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y))) (match x x) @m (match y y)) = \n      set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y))) (match x x) ) \\<union> set (match y y)\" by simp\n    with assms 0 show ?case by (metis Structure_Action_Structure.hyps Un_iff a)\nnext\n  case (Structure_Agent_Structure c x y)\n    have assms: \"\\<forall>(a, b) \\<in> set (match x x). a = b\" using match_Agent_simp by simp\n    then have a: \"\\<forall>a\\<in>set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y))) (match x x) ). case a of (x, y) \\<Rightarrow> x = y\" by auto\n    have 0: \"set (match (Structure_Agent_Structure c x y) (Structure_Agent_Structure c x y)) = set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y))) (match x x) @m (match y y) )\" by simp\n    with a Structure_Agent_Structure have \"set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y))) (match x x) @m (match y y)) = \n      set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y))) (match x x) ) \\<union> set (match y y)\" by simp\n    with assms 0 show ?case by (metis Structure_Agent_Structure.hyps Un_iff a)\nqed\n\nlemma inv_Structure[simp]:\n  fixes a::Structure\n  shows \"\\<forall>free \\<in> set (match a a). a = replace free a\"\nproof (induct a)\n  case (Structure_Formula x)\n    thus ?case by auto\nnext\n  case (Structure_Zer x)\n    show ?case by simp\nnext\n  case (Structure_Bin x c y)\n    obtain z where 0: \"z = (Structure_Bin x c y)\" by simp\n    have 1: \"\\<forall>free \\<in> set (match z z). replace free z = Structure_Bin (replace free x) c (replace free y)\"\n      by (metis \"0\" old.prod.exhaust replace_Structure.simps(2))\n    have \"\\<forall>free \\<in> set (match z z). replace free x = x\" \"\\<forall>free \\<in> set (match z z). replace free y = y\"\n    proof auto\n      fix a b\n      assume \"(a, b) \\<in> set (match z z)\"\n      then have eq: \"a = b\" using match_Structure_simp by (metis (full_types) splitD)\n      have x: \"a \\<notin> freevars x \\<longrightarrow> replace (a,b) x = x\" and \"a \\<in> freevars x \\<longrightarrow> replace (a,b) x = x\"\n        by (metis eq freevars_replace_Structure_simp) (metis freevars_replace_Structure_simp2 eq)\n      thus \"replace (a, b) x = x\" by auto\n      from eq have \"a \\<notin> freevars y \\<longrightarrow> replace (a,b) y = y\" \"a \\<in> freevars y \\<longrightarrow> replace (a,b) y = y\"\n        by (metis eq freevars_replace_Structure_simp) (metis freevars_replace_Structure_simp2 eq)\n      thus \"replace (a, b) y = y\" by auto\n    qed\n    thus ?case by (metis \"0\" \"1\")\nnext\n  case (Structure_Freevar x)\n    show ?case by simp\nnext\n  case(Structure_Phi x)\n    show ?case by auto\nnext\n  case (Structure_Action_Structure c x y)\n    obtain z where 0: \"z = (Structure_Action_Structure c x y)\" by simp\n\n    have 1: \"\\<forall>free \\<in> set (match z z). replace free (Structure_Formula(Formula_Action x)) = (Structure_Formula(Formula_Action x))\"\n    apply (rule)\n    apply(case_tac free, auto)\n    apply(case_tac aa, auto)\n    apply(case_tac ba, auto)\n    done\n\n    have 2: \"\\<forall>free \\<in> set (match z z). replace free y = y\"\n    proof auto\n      fix a b\n      assume \"(a, b) \\<in> set (match z z)\"\n      then have eq: \"a = b\" using match_Structure_simp by (metis (full_types) splitD)\n      from eq have \"a \\<notin> freevars y \\<longrightarrow> replace (a,b) y = y\" \"a \\<in> freevars y \\<longrightarrow> replace (a,b) y = y\"\n        by (metis eq freevars_replace_Structure_simp) (metis freevars_replace_Structure_simp2 eq)\n      thus \"replace (a, b) y = y\" by auto\n    qed\n    \n    have \"\\<forall>free \\<in> set (match z z). replace free (Structure_Action_Structure c x y) = Structure_Action_Structure c x (replace free y)\"\n    proof auto\n      fix a b\n      assume assm: \"(a,b) \\<in> set (match z z)\"\n      then have eq: \"a = b\" using match_Structure_simp by (metis (full_types) splitD)\n\n      from 0 have \"match z z = map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y)) ) (match x x) @m match y y\" by simp \n      then have 3: \"set (match z z) = set (map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y)) ) (match x x) @m (match y y))\" by simp \n\n      have assms: \"\\<forall>(a, b) \\<in> set (match x x). a = b\" using match_Action_simp by simp\n      then have a: \"\\<forall>a\\<in>set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y)) ) (match x x) ). case a of (x, y) \\<Rightarrow> x = y\" by auto\n      have 0: \"set (match (Structure_Action_Structure c x y) (Structure_Action_Structure c x y)) = set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y)) ) (match x x) @m (match y y) )\" by simp\n      with a match_Structure_simp have \"set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y)) ) (match x x) @m (match y y)) = \n      set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y)) ) (match x x) ) \\<union> set (match y y)\" by simp\n      with 3 eq 0 assm have ab_in_z: \"(a,b) \\<in> set (map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y)) ) (match x x)) \\<union> set (match y y)\" by simp\n\n      { assume \"(a,b) \\<in> set (map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y)) ) (match x x))\"\n        then obtain a' b' where fact: \"Structure_Formula(Formula_Action a') = a\" \"Structure_Formula (Formula_Action b') = b\" by auto\n        then have 1: \"replace (a,b) (Structure_Action_Structure c x y) = Structure_Action_Structure c (replace (a',b') x) (replace (a,b) y)\" by auto\n        with fact have \"(replace (a',b') x) = x\" by (metis Formula.inject(1) Structure.inject(4) eq freevars_replace_Action_simp freevars_replace_Action_simp2)\n        with 1 have \"replace (a,b) (Structure_Action_Structure c x y) = Structure_Action_Structure c x (replace (a,b) y)\" by simp }\n      { assume \"(a,b) \\<notin> set (map (\\<lambda>(x,y). (Structure_Formula(Formula_Action x), Structure_Formula(Formula_Action y)) ) (match x x))\"\n        with ab_in_z have \"(a,b) \\<in> set (match y y)\" by simp\n        then have 1: \"replace (a,b) (Structure_Action_Structure c x y) = Structure_Action_Structure c x (replace (a,b) y)\"\n          apply (cases a, auto, case_tac Formula, simp_all)\n          apply (cases b, auto, case_tac Formulaa, simp_all) by (metis Formula.inject(1) Structure.inject(4) eq freevars_replace_Action_simp freevars_replace_Action_simp2) }\n      thus \"replace (a,b) (Structure_Action_Structure c x y) = Structure_Action_Structure c x (replace (a,b) y)\" \n        by (metis `(a, b) \\<in> set (map (\\<lambda>(x, y). (Formula_Action x \\<^sub>S, Formula_Action y \\<^sub>S)) (match x x)) \\<Longrightarrow> replace (a, b) (ActS\\<^sub>S c x y) = ActS\\<^sub>S c x replace (a, b) y`)\n    qed\n    with 0 1 2 show ?case by simp\nnext\n    case (Structure_Agent_Structure c x y)\n    obtain z where 0: \"z = (Structure_Agent_Structure c x y)\" by simp\n\n    have 1: \"\\<forall>free \\<in> set (match z z). replace free (Structure_Formula(Formula_Agent x)) = (Structure_Formula(Formula_Agent x))\"\n    apply (rule)\n    apply(case_tac free, auto)\n    apply(case_tac aa, auto)\n    apply(case_tac ba, auto)\n    done\n\n    have 2: \"\\<forall>free \\<in> set (match z z). replace free y = y\"\n    proof auto\n      fix a b\n      assume \"(a, b) \\<in> set (match z z)\"\n      then have eq: \"a = b\" using match_Structure_simp by (metis (full_types) splitD)\n      from eq have \"a \\<notin> freevars y \\<longrightarrow> replace (a,b) y = y\" \"a \\<in> freevars y \\<longrightarrow> replace (a,b) y = y\"\n        by (metis eq freevars_replace_Structure_simp) (metis freevars_replace_Structure_simp2 eq)\n      thus \"replace (a, b) y = y\" by auto\n    qed\n    \n    have \"\\<forall>free \\<in> set (match z z). replace free (Structure_Agent_Structure c x y) = Structure_Agent_Structure c x (replace free y)\"\n    proof auto\n      fix a b\n      assume assm: \"(a,b) \\<in> set (match z z)\"\n      then have eq: \"a = b\" using match_Structure_simp by (metis (full_types) splitD)\n\n      from 0 have \"match z z = map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y)) ) (match x x) @m match y y\" by simp \n      then have 3: \"set (match z z) = set (map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y)) ) (match x x) @m (match y y))\" by simp \n\n      have assms: \"\\<forall>(a, b) \\<in> set (match x x). a = b\" using match_Agent_simp by simp\n      then have a: \"\\<forall>a\\<in>set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y)) ) (match x x) ). case a of (x, y) \\<Rightarrow> x = y\" by auto\n      have 0: \"set (match (Structure_Agent_Structure c x y) (Structure_Agent_Structure c x y)) = set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y)) ) (match x x) @m (match y y) )\" by simp\n      with a match_Structure_simp have \"set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y)) ) (match x x) @m (match y y)) = \n      set ( map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y)) ) (match x x) ) \\<union> set (match y y)\" by simp\n      with 3 eq 0 assm have ab_in_z: \"(a,b) \\<in> set (map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y)) ) (match x x)) \\<union> set (match y y)\" by simp\n\n      { assume \"(a,b) \\<in> set (map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y)) ) (match x x))\"\n        then obtain a' b' where fact: \"Structure_Formula(Formula_Agent a') = a\" \"Structure_Formula (Formula_Agent b') = b\" by auto\n        then have 1: \"replace (a,b) (Structure_Agent_Structure c x y) = Structure_Agent_Structure c (replace (a',b') x) (replace (a,b) y)\" by auto\n        with fact have \"(replace (a',b') x) = x\" by (metis Formula.inject(3) Structure.inject(4) eq freevars_replace_Agent_simp freevars_replace_Agent_simp2)\n        with 1 have \"replace (a,b) (Structure_Agent_Structure c x y) = Structure_Agent_Structure c x (replace (a,b) y)\" by simp }\n      { assume \"(a,b) \\<notin> set (map (\\<lambda>(x,y). (Structure_Formula(Formula_Agent x), Structure_Formula(Formula_Agent y)) ) (match x x))\"\n        with ab_in_z have \"(a,b) \\<in> set (match y y)\" by simp\n        then have 1: \"replace (a,b) (Structure_Agent_Structure c x y) = Structure_Agent_Structure c x (replace (a,b) y)\"\n          apply (cases a, auto, case_tac Formula, simp_all)\n          apply (cases b, auto, case_tac Formulaa, simp_all) by (metis Formula.inject(3) Structure.inject(4) eq freevars_replace_Agent_simp freevars_replace_Agent_simp2) }\n      thus \"replace (a,b) (Structure_Agent_Structure c x y) = Structure_Agent_Structure c x (replace (a,b) y)\" \n        by (metis `(a, b) \\<in> set (map (\\<lambda>(x, y). (Formula_Agent x \\<^sub>S, Formula_Agent y \\<^sub>S)) (match x x)) \\<Longrightarrow> replace (a, b) (AgS\\<^sub>S c x y) = AgS\\<^sub>S c x replace (a, b) y`)\n    qed\n    with 0 1 2 show ?case by simp\nqed\n\n\nlemma inv_Structure2_aux[simp]: \nfixes a::Structure and list\nassumes \"set list \\<subseteq> set (match a a)\"\nshows \"replaceAll list a = a\"\nusing assms\nby (induct list a rule:replaceAll.induct, simp) (metis insert_subset inv_Structure replaceAll.simps(2) set_simps(2))\n\nlemma inv_Structure2: \"replaceAll (match a a) a = (a::Structure)\" by simp\n\n\n\n\ninstantiation Sequent :: Varmatch\nbegin   \n  fun match_Sequent :: \"Sequent \\<Rightarrow> Sequent \\<Rightarrow> (Sequent * Sequent) list\"\n  where\n    \"match_Sequent (Sequent var11 var12) (Sequent var21 var22) = (map (\\<lambda>(x,y). (Sequent_Structure x, Sequent_Structure y)) ((match var11 var21) @m (match var12 var22)))\"\n  | \"match_Sequent _ _ = []\"\n  \n  fun freevars_Sequent :: \"Sequent \\<Rightarrow> Sequent set\"\n  where\n    \"freevars_Sequent (Sequent var1 var2) = image (\\<lambda>x. Sequent_Structure x) (freevars var1 \\<union> freevars var2)\"\n  | \"freevars_Sequent _ = {}\"\n\n  fun replace_Sequent :: \"(Sequent * Sequent) \\<Rightarrow> Sequent \\<Rightarrow> Sequent\"\n  where\n    \"replace_Sequent ((Sequent_Structure x), (Sequent_Structure rep))  (Sequent var1 var2) = Sequent (replace (x, rep) var1) (replace (x, rep) var2)\"\n  | \"replace_Sequent (_, _) y = y\" \ninstance ..\nend\n\n\nlemma inv_Sequent[simp]:\n  fixes a::Sequent\n  shows \"\\<forall>free \\<in> set (match a a). a = replace free a\"\nproof (induct a)\n  case (Sequent_Structure x)\n    thus ?case by auto\nnext\n  case (Sequent x y)\n    have \"\\<forall>(a, b) \\<in> set (match x x @m match y y). replace (a, b) x = x\"  \"\\<forall>(a, b) \\<in> set (match x x @m match y y). replace (a, b) y = y\"\n    proof auto\n      fix a b\n      assume 0: \"(a, b) \\<in> set (match x x @m match y y)\"\n      have \"\\<forall>(a, b) \\<in> set (match x x). a = b\" \"\\<forall>(a, b) \\<in> set (match y y). a = b\" by (metis match_Structure_simp)+\n      with 0 have eq: \"a = b\" by auto\n      have \"a \\<notin> freevars x \\<longrightarrow> replace (a, b) x = x\" and \"a \\<in> freevars x \\<longrightarrow> replace (a, b) x = x\"\n        by (metis eq freevars_replace_Structure_simp) (metis freevars_replace_Structure_simp2 eq)\n      thus \"replace (a, b) x = x\" by auto\n      from eq have \"a \\<notin> freevars y \\<longrightarrow> replace (a,b) y = y\" \"a \\<in> freevars y \\<longrightarrow> replace (a,b) y = y\"\n        by (metis eq freevars_replace_Structure_simp) (metis freevars_replace_Structure_simp2 eq)\n      thus \"replace (a, b) y = y\" by auto\n    qed\n    thus ?case by auto\nqed\n\n\nlemma inv_Sequent2_aux[simp]: \nfixes a::Sequent and list\nassumes \"set list \\<subseteq> set (match a a)\"\nshows \"replaceAll list a = a\"\nusing assms\nby (induct list a rule:replaceAll.induct, simp) (metis insert_subset inv_Sequent replaceAll.simps(2) set_simps(2))\n\nlemma inv_Sequent2: \"replaceAll (match a a) a = (a::Sequent)\" by simp\n\ndefinition \"export = (Atprop ''A'')\\<^sub>F\\<^sub>S \\<turnstile>\\<^sub>S (Atprop ''A'')\\<^sub>F\\<^sub>S\"\n\nexport_code open export in Scala\nmodule_name (*calc_name*) file (*export_path*)\nend\n", "meta": {"author": "goodlyrottenapple", "repo": "calculus-toolbox", "sha": "1c0009f1bf2b08e8a7466e024fdb02f62e34ee91", "save_path": "github-repos/isabelle/goodlyrottenapple-calculus-toolbox", "path": "github-repos/isabelle/goodlyrottenapple-calculus-toolbox/calculus-toolbox-1c0009f1bf2b08e8a7466e024fdb02f62e34ee91/template/Calc_Core_slow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.3326030318396057}}
{"text": "theory Preliminaries\n  imports Computation\nbegin\n\ncontext NFT\nbegin\n\ndefinition \"bv' t \\<longleftrightarrow> (\\<forall>f1 f2 q1 q2 a b1 b2 v1 v2 w1 w2.\n  accept f1 \\<and> accept f2 \\<and> q1 \\<in> Q \\<and> q2 \\<in> Q \\<and>\n  init \\<leadsto>(a, v1) q1 \\<and> q1 \\<leadsto>(b1, w1) f1 \\<and>\n  init \\<leadsto>(a, v2) q2 \\<and> q2 \\<leadsto>(b2, w2) f2 \\<longrightarrow> lcp_dist v1 v2 \\<le> t)\"\n\n(* Lemma 7 *)\n\nlemma bv_prop: \"(\\<forall>k. \\<exists>t. bv k t) \\<longleftrightarrow> (\\<exists>t. bv' t)\"\nproof (rule iffI)\n  assume \"\\<forall>k. \\<exists>t. bv k t\"\n  then obtain t where t_def:\n    \"\\<And>f1 f2 q1 q2 a b1 b2 u v1 v2 w1 w2. accept f1 \\<Longrightarrow> accept f2 \\<Longrightarrow> q1 \\<in> Q \\<Longrightarrow> q2 \\<in> Q \\<Longrightarrow>\n      init \\<leadsto>(a, u @ v1) q1 \\<Longrightarrow> q1 \\<leadsto>(b1, w1) f1 \\<Longrightarrow>\n      init \\<leadsto>(a, u @ v2) q2 \\<Longrightarrow> q2 \\<leadsto>(b2, w2) f2 \\<Longrightarrow>\n      length b1 + length b2 \\<le> sg + sg \\<Longrightarrow> lcp_dist (v1 @ w1) (v2 @ w2) \\<le> t\"\n    unfolding bv_def\n    by metis\n  {\n    fix k\n    fix f1 f2 q1 q2 a b1 b2 v1 v2 w1 w2\n    assume assms: \"accept f1\" \"accept f2\" \"q1 \\<in> Q\" \"q2 \\<in> Q\"\n      \"init \\<leadsto>(a, [] @ v1) q1\" \"q1 \\<leadsto>(b1, w1) f1\"\n      \"init \\<leadsto>(a, [] @ v2) q2\" \"q2 \\<leadsto>(b2, w2) f2\"\n    obtain b1' w1' f1' where sg1: \"q1 \\<leadsto>(b1', w1') f1'\" \"accept f1'\" \"length b1' \\<le> sg\"\n      using active_Nil_dest_sg[OF _ assms(3)] assms(1,6)\n      by (auto simp: active_def)\n    obtain b2' w2' f2' where sg2: \"q2 \\<leadsto>(b2', w2') f2'\" \"accept f2'\" \"length b2' \\<le> sg\"\n      using active_Nil_dest_sg[OF _ assms(4)] assms(2,8)\n      by (auto simp: active_def)\n    have \"lcp_dist (v1 @ w1') (v2 @ w2') \\<le> t\"\n      using t_def[OF sg1(2) sg2(2) assms(3,4,5) sg1(1) assms(7) sg2(1)] sg1(3) sg2(3)\n      by auto\n    then have \"lcp_dist v1 v2 \\<le> t + length w1' + length w2'\"\n      using lcp_dist_le_app_sum[of v1 v2 w1' w2']\n      by auto\n    also have \"\\<dots> \\<le> t + length b1' * output_speed + length b2' * output_speed\"\n      using output_speed_computation[OF sg1(1) assms(3)]\n        output_speed_computation[OF sg2(1) assms(4)]\n      by auto\n    also have \"\\<dots> \\<le> t + sg * output_speed + sg * output_speed\"\n      using sg1(3) sg2(3)\n      by (auto simp add: add_mono)\n    finally have \"lcp_dist v1 v2 \\<le> t + sg * output_speed + sg * output_speed\" .\n  }\n  then show \"\\<exists>t. bv' t\"\n    unfolding bv'_def\n    by auto blast\nnext\n  assume \"\\<exists>t. bv' t\"\n  then obtain t where t_def:\n    \"\\<And>f1 f2 q1 q2 a b1 b2 v1 v2 w1 w2. accept f1 \\<Longrightarrow> accept f2 \\<Longrightarrow> q1 \\<in> Q \\<Longrightarrow> q2 \\<in> Q \\<Longrightarrow>\n      init \\<leadsto>(a, v1) q1 \\<Longrightarrow> q1 \\<leadsto>(b1, w1) f1 \\<Longrightarrow>\n      init \\<leadsto>(a, v2) q2 \\<Longrightarrow> q2 \\<leadsto>(b2, w2) f2 \\<Longrightarrow> lcp_dist v1 v2 \\<le> t\"\n    unfolding bv'_def\n    by metis\n  {\n    fix k\n    fix f1 f2 q1 q2 a b1 b2 u v1 v2 w1 w2\n    assume assms: \"accept f1\" \"accept f2\" \"q1 \\<in> Q\" \"q2 \\<in> Q\"\n      \"init \\<leadsto>(a, u @ v1) q1\" \"q1 \\<leadsto>(b1, w1) f1\"\n      \"init \\<leadsto>(a, u @ v2) q2\" \"q2 \\<leadsto>(b2, w2) f2\"\n      \"length b1 + length b2 \\<le> k\"\n    have \"lcp_dist (v1 @ w1) (v2 @ w2) \\<le> t + length b1 * output_speed + length b2 * output_speed\"\n      using lcp_dist_app_le_sum[of v1 w1 v2 w2] t_def[OF assms(1,2,3,4,5,6,7,8)]\n        output_speed_computation[OF assms(6,3)] output_speed_computation[OF assms(8,4)]\n      unfolding lcp_dist_same_pref\n      by auto\n    also have \"\\<dots> \\<le> t + k * output_speed\"\n      using assms(9)\n      by auto (metis add_mult_distrib mult_le_mono1)\n    finally have \"lcp_dist (v1 @ w1) (v2 @ w2) \\<le> t + k * output_speed\" .\n  }\n  then show \"\\<forall>k. \\<exists>t. bv k t\"\n    unfolding bv_def\n    by blast\nqed\n\nlemma bv'_bounded:\n  assumes \"bv' t\"\n  shows \"bounded t\"\nproof -\n  have bv': \"\\<And>f1 f2 q1 q2 a b1 b2 v1 v2 w1 w2. accept f1 \\<Longrightarrow> accept f2 \\<Longrightarrow> q1 \\<in> Q \\<Longrightarrow> q2 \\<in> Q \\<Longrightarrow>\n    init \\<leadsto>(a, v1) q1 \\<Longrightarrow> q1 \\<leadsto>(b1, w1) f1 \\<Longrightarrow>\n    init \\<leadsto>(a, v2) q2 \\<Longrightarrow> q2 \\<leadsto>(b2, w2) f2 \\<Longrightarrow> lcp_dist v1 v2 \\<le> t\"\n    using assms\n    by (fastforce simp: bv'_def)\n  {\n    fix q q' u v v'\n    assume prems: \"init \\<leadsto>(u, v @ v') q\" \"active q []\"\n      \"init \\<leadsto>(u, v) q'\" \"active q' v'\"\n    obtain r as bs where tail: \"q \\<leadsto>(as, bs) r\" \"accept r\"\n      using prems(2)\n      by (auto simp: active_def)\n    obtain r' as' bs' where tail': \"q' \\<leadsto>(as', v' @ bs') r'\" \"accept r'\"\n      using prems(4)\n      by (auto simp: active_def)\n    note q_Q = comp_closed[OF prems(1) init_in_Q]\n    note q'_Q = comp_closed[OF prems(3) init_in_Q]\n    have \"lcp_dist (v @ v') v = lcp_dist (v @ v') (v @ [])\"\n      by auto\n    moreover have \"\\<dots> = length v'\"\n      unfolding lcp_dist_same_pref\n      by simp\n    finally have \"length v' \\<le> t\"\n      using bv'[OF tail(2) tail'(2) q_Q q'_Q prems(1) tail(1) prems(3) tail'(1)]\n      by auto\n  }\n  then show ?thesis\n    by (auto simp: bounded_def)\nqed\n\nend\n\nend", "meta": {"author": "stacs21", "repo": "automata", "sha": "ad3f66175122479d075b5ad9d996511035ea775a", "save_path": "github-repos/isabelle/stacs21-automata", "path": "github-repos/isabelle/stacs21-automata/automata-ad3f66175122479d075b5ad9d996511035ea775a/thys/Preliminaries.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6548947290421276, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3325633132615073}}
{"text": "chapter \\<open>Obliviousness\\label{s:oblivious}\\<close>\n\ntext \\<open>\nIn order to show that \\SAT{} is $\\NP$-hard we will eventually show how to reduce\nan arbitrary language $L \\in \\NP$ to \\SAT{}. The proof can only use properties\nof $L$ common to all languages in $\\NP$. The definition of $\\NP$ provides us\nwith a verifier Turing machine $M$ for $L$, of which we only know that it is\nrunning in polynomial time. In addition by lemma~@{text NP_output_len_1} we can\nassume that $M$ outputs a single bit symbol. In this chapter we are going to\nshow that we can make additional assumptions about $M$, namely:\n\n\\begin{enumerate}\n  \\item $M$ has only two tapes.\n  \\item $M$ halts on $\\langle x, u\\rangle$ with the output tape head on the\n    symbol \\textbf{1} iff.\\ $u$ is a certificate for $x$.\n  \\item $M$ is \\emph{oblivious}, which means that on any input $x$ the head\n  positions of $M$ on all its tapes depend only on the \\emph{length} of $x$, not\n  on the symbols in $x$~\\cite[Remark~1.7]{ccama}.\n\\end{enumerate}\n\nThese additional properties will somewhat simplify the reduction of $L$ to\n\\SAT{}, more precisely the construction of the CNF formulas (see\nChapter~\\ref{s:Reducing}).\n\nIn order to achieve this goal we will show how to simulate any polynomial-time\nmulti-tape TM in polynomial time on a two-tape oblivious TM that halts with\nthe output tape head on cell~1.\n\nGiven a polynomial-time $k$-tape TM $M$, the basic approach is to construct a\ntwo-tape TM that encodes the $k$ tapes of $M$ on its output tape in such a way\nthat every cell encodes $k$ symbols of $M$ and flags for $M$'s tape heads.  This\nis the same idea as used by Dalvit and\nThiemann~\\cite{Multitape_To_Singletape_TM-AFP} and originally Hartmanis and\nStearns~\\cite{hs65} for simulating a multi-tape TM on a single-tape TM. After\nall our two-tape simulator can only properly use a single tape (the output/work\ntape). This simulator has roughly a quadratic running time overhead and so keeps\nthe running time polynomial. However, it is not generally an oblivious TM.\n\nTo make the simulator TM oblivious, we have it initially ``format'' a section on\nthe output tape that is long enough to hold everything $M$ is going to write and\nwhose length only depends on the input length. To simulate one step of $M$, the\nsimulator then sweeps its output tape head all the way from the start of the\ntape to the end of the formatted space and back again, moving one cell per step.\nDuring these sweeps it executes one step of the simulation of $M$. Since the\nsize of the formatted space only depends on the input length, the simulator\nperforms the same head movements on inputs of the same length, resulting in an\noblivious behavior. Moreover, it is easy to make it halt with the output tape\nhead on cell number~1.\n\nThe formatter TM is described in Section~~\\ref{s:oblivious-polynomial}. The\nsimulator TM is then constructed in Section~\\ref{s:oblivious-two-tape}. Finally\nSection~\\ref{s:oblivious-np} states the main result of this chapter.\n\nBefore any of this, however, we have to define some basic concepts surrounding\nobliviousness.\n\\<close>\n\n\nsection \\<open>Oblivious Turing machines\\label{s:oblivious-tm}\\<close>\n\ntheory Oblivious\n  imports Memorizing\nbegin\n\ntext \\<open>\nThis section provides us with the tools for showing that a Turing machine is\noblivious and for combining oblivious TMs into more complex oblivious TMs.\n\nSo far our analysis of Turing machines involved their semantics and running time\nbounds. For this we mainly used the @{const transforms} predicate, which relates\na start configuration and a halting configuration and an upper bound for the\nrunning time of a TM to transit from the one configuration to the other. To deal\nwith obliviousness, we need to look more closely and inspect the sequence of\ntape head positions during the TM's execution, rather than only the running\ntime.\n\nThe subsections in this section roughly correspond to Sections~\\ref{s:tm-basic}\nto~\\ref{s:tm-memorizing}. In the first subsection we introduce a predicate\n@{term trace} analogous to @{const transforms} and show its behavior under\nsequential composition of TMs and loops (we will not need branches). The next\nsubsection shows the head position sequences for those few elementary TMs from\nSection~\\ref{s:tm-elementary} that we need for our more complex oblivious TMs\nlater. These constructions will also heavily use the memorization-in-states\ntechnique from Section~\\ref{s:tm-memorizing}, which we adapt to this chapter's\nneeds in the final subsection.\n\\<close>\n\n\nsubsection \\<open>Traces and head positions\\<close>\n\ntext \\<open>\nIn order to show that a Turing machine is oblivious we need to keep track of its\nhead positions. Consider a machine $M$ that transits from a configuration @{term\ncfg1} to a configuration @{term cfg2} in $t$ steps.  We call the sequence of\nhead positions on the first two tapes a \\emph{trace}. If we ignore the initial\nhead positions, the length of a trace equals $t$. Moreover we will only\nconsider traces where $M$ either does not halt or halts in the very last step.\nThese two properties mean, for example, that we can simply concatenate a trace\nof a TM that halts and trace of another TM and get the trace of the sequential\nexecution of both TMs.  Similarly, analysing while loops is simplified by these\ntwo extra assumptions. The next predicate defines what it means for a list\n@{term \"es :: (nat \\<times> nat) list\"} to be a trace.\n\\<close>\n\ndefinition trace :: \"machine \\<Rightarrow> config \\<Rightarrow> (nat \\<times> nat) list \\<Rightarrow> config \\<Rightarrow> bool\" where\n  \"trace M cfg1 es cfg2 \\<equiv>\n     execute M cfg1 (length es) = cfg2 \\<and>\n     (\\<forall>i<length es. fst (execute M cfg1 i) < length M) \\<and>\n     (\\<forall>i<length es. execute M cfg1 (Suc i) <#> 0 = fst (es ! i)) \\<and>\n     (\\<forall>i<length es. execute M cfg1 (Suc i) <#> 1 = snd (es ! i))\"\n\ntext \\<open>\nWe will consider traces for machines with more than two tapes, too, but only for\nauxiliary constructions in combination with the memorizing-in-states technique.\nTherefore our definition is limited to start configurations with two tapes. A\nmachine is \\emph{oblivious} if there is a function mapping the input length\nto the trace that takes the machine from the start configuration with that\ninput to a halting configuration.\n\\<close>\n\ndefinition oblivious :: \"machine \\<Rightarrow> bool\" where\n  \"oblivious M \\<equiv> \\<exists>e.\n    (\\<forall>zs. bit_symbols zs \\<longrightarrow> (\\<exists>tps. trace M (start_config 2 zs) (e (length zs)) (length M, tps)))\"\n\nlemma trace_Nil: \"trace M cfg [] cfg\"\n  unfolding trace_def by simp\n\nlemma traceI:\n  assumes \"execute M (q1, tps1) (length es) = (q2, tps2)\"\n    and \"\\<And>i. i < length es \\<Longrightarrow> fst (execute M (q1, tps1) i) < length M\"\n    and \"\\<And>i. i < length es \\<Longrightarrow>\n      execute M (q1, tps1) (Suc i) <#> 0 = fst (es ! i) \\<and>\n      execute M (q1, tps1) (Suc i) <#> 1 = snd (es ! i)\"\n  shows \"trace M (q1, tps1) es (q2, tps2)\"\n  using trace_def assms by simp\n\nlemma traceI':\n  assumes \"execute M cfg1 (length es) = cfg2\"\n    and \"\\<And>i. i < length es \\<Longrightarrow> fst (execute M cfg1 i) < length M\"\n    and \"\\<And>i. i < length es \\<Longrightarrow>\n      execute M cfg1 (Suc i) <#> 0 = fst (es ! i) \\<and>\n      execute M cfg1 (Suc i) <#> 1 = snd (es ! i)\"\n  shows \"trace M cfg1 es cfg2\"\n  using trace_def assms by simp\n\nlemma trace_additive:\n  assumes \"trace M (q1, tps1) es1 (q2, tps2)\" and \"trace M (q2, tps2) es2 (q3, tps3)\"\n  shows \"trace M (q1, tps1) (es1 @ es2) (q3, tps3)\"\nproof (rule traceI)\n  let ?es = \"es1 @ es2\"\n  show \"execute M (q1, tps1) (length (es1 @ es2)) = (q3, tps3)\"\n    using trace_def assms by (simp add: execute_additive)\n  show \"fst (execute M (q1, tps1) i) < length M\" if \"i < length ?es\" for i\n  proof (cases \"i < length es1\")\n    case True\n    then show ?thesis\n      using that assms(1) trace_def by simp\n  next\n    case False\n    have \"execute M (q1, tps1) (length es1 + (i - length es1)) = execute M (q2, tps2) (i - length es1)\"\n      using execute_additive that assms(1) trace_def by blast\n    then have *: \"execute M (q1, tps1) i = execute M (q2, tps2) (i - length es1)\"\n      using False by simp\n    have \"i - length es1 < length es2\"\n      using that False by simp\n    then have \"fst (execute M (q2, tps2) (i - length es1)) < length M\"\n      using assms(2) trace_def by simp\n    then show ?thesis\n      using * by simp\n  qed\n  show \"execute M (q1, tps1) (Suc i) <#> 0 = fst (?es ! i) \\<and>\n        execute M (q1, tps1) (Suc i) <#> 1 = snd (?es ! i)\"\n    if \"i < length ?es\" for i\n  proof (cases \"i < length es1\")\n    case True\n    then show ?thesis\n      using that assms(1) trace_def by (simp add: nth_append)\n  next\n    case False\n    have \"execute M (q1, tps1) (length es1 + (Suc i - length es1)) = execute M (q2, tps2) (Suc i - length es1)\"\n      using execute_additive that assms(1) trace_def by blast\n    then have *: \"execute M (q1, tps1) (Suc i) = execute M (q2, tps2) (Suc (i - length es1))\"\n      using False by (simp add: Suc_diff_le)\n    have \"i - length es1 < length es2\"\n      using that False by simp\n    then have \"execute M (q2, tps2) (Suc (i - length es1)) <#> 0 = fst (es2 ! (i - length es1))\"\n      and \"execute M (q2, tps2) (Suc (i - length es1)) <#> 1 = snd (es2 ! (i - length es1))\"\n      using assms(2) trace_def by simp_all\n    then show ?thesis\n      using * by (simp add: False nth_append)\n  qed\nqed\n\nlemma trace_additive':\n  assumes \"trace M cfg1 es1 cfg2\" and \"trace M cfg2 es2 cfg3\"\n  shows \"trace M cfg1 (es1 @ es2) cfg3\"\n  using trace_additive assms by (metis prod.collapse)\n\ntext \\<open>\nWe mostly consider traces from the start state to the halting state, for which\nwe introduce the next predicate.\n\\<close>\n\ndefinition traces :: \"machine \\<Rightarrow> tape list \\<Rightarrow> (nat \\<times> nat) list \\<Rightarrow> tape list \\<Rightarrow> bool\" where\n  \"traces M tps1 es tps2 \\<equiv> trace M (0, tps1) es (length M, tps2)\"\n\ntext \\<open>\nThe relation between @{const traces} and @{const trace} is like that between\n@{const transforms} and @{const transits}.\n\\<close>\n\nlemma tracesI [intro]:\n  assumes \"execute M (0, tps1) (length es) = (length M, tps2)\"\n    and \"\\<And>i. i < length es \\<Longrightarrow> fst (execute M (0, tps1) i) < length M\"\n    and \"\\<And>i. i < length es \\<Longrightarrow>\n      execute M (0, tps1) (Suc i) <#> 0 = fst (es ! i) \\<and>\n      execute M (0, tps1) (Suc i) <#> 1 = snd (es ! i)\"\n  shows \"traces M tps1 es tps2\"\n  using traces_def trace_def assms by simp\n\nlemma traces_additive:\n  assumes \"trace M (0, tps1) es1 (0, tps2)\"\n    and \"traces M tps2 es2 tps3\"\n  shows \"traces M tps1 (es1 @ es2) tps3\"\n  using assms traces_def trace_additive by simp\n\nlemma execute_trace_append:\n  assumes \"trace M1 (0, tps1) es1 (length M1, tps2)\" (is \"trace _ ?cfg1 _ _\")\n    and \"t \\<le> length es1\"\n  shows \"execute (M1 @ M2) (0, tps1) t = execute M1 (0, tps1) t\"\n    (is \"execute ?M _ _ = _\")\n  using assms(2)\nproof (induction t)\n  case 0\n  then show ?case\n    by simp\nnext\n  case (Suc t)\n  then have \"t < length es1\"\n    by simp\n  then have 1: \"fst (execute M1 ?cfg1 t) < length M1\"\n    using traces_def trace_def assms(1) by simp\n  have 2: \"length ?M = length M1 + length M2\"\n    using length_turing_machine_sequential by simp\n  have \"execute ?M ?cfg1 (Suc t) = exe ?M (execute ?M ?cfg1 t)\"\n    by simp\n  also have \"... = exe ?M (execute M1 ?cfg1 t)\" (is \"_ = exe _ ?cfg\")\n    using Suc by simp\n  also have \"... = sem (?M ! (fst ?cfg)) ?cfg\"\n    using 1 2 exe_def by simp\n  also have \"... = sem (M1 ! (fst ?cfg)) ?cfg\"\n    using 1 by (simp add: nth_append turing_machine_sequential_def)\n  also have \"... = exe M1 (execute M1 ?cfg1 t)\"\n    using exe_def 1 by simp\n  also have \"... = execute M1 ?cfg1 (Suc t)\"\n    by simp\n  finally show ?case .\nqed\n\n\nsubsection \\<open>Increasing the number of tapes\\<close>\n\ntext \\<open>\nThis is lemma @{thm [source] transforms_append_tapes} adapted for @{const\ntraces}.\n\\<close>\n\nlemma traces_append_tapes:\n  assumes \"turing_machine 2 G M\" and \"length tps1 = 2\" and \"traces M tps1 es tps2\"\n  shows \"traces (append_tapes 2 (2 + length tps') M) (tps1 @ tps') es (tps2 @ tps')\"\nproof\n  let ?M = \"append_tapes 2 (2 + length tps') M\"\n  show \"execute ?M (0, tps1 @ tps') (length es) = (length ?M, tps2 @ tps')\"\n  proof -\n    have \"execute M (0, tps1) (length es) = (length M, tps2)\"\n      using assms(3) by (simp add: trace_def traces_def)\n    moreover have \"execute ?M (0, tps1 @ tps') (length es) =\n        (fst (execute M (0, tps1) (length es)), snd (execute M (0, tps1) (length es)) @ tps')\"\n      using execute_append_tapes'[OF assms(1-2)] by simp\n    ultimately show ?thesis\n      by (simp add: length_append_tapes)\n  qed\n  show \"fst (execute ?M (0, tps1 @ tps') i) < length ?M\" if \"i < length es\" for i\n  proof -\n    have \"fst (execute M (0, tps1) i) < length M\"\n      using that assms(3) trace_def traces_def by blast\n    then show \"fst (execute ?M (0, tps1 @ tps') i) < length ?M\"\n      by (metis (no_types) assms(1,2) execute_append_tapes' fst_conv length_append_tapes)\n  qed\n  show \"snd (execute ?M (0, tps1 @ tps') (Suc i)) :#: 0 = fst (es ! i) \\<and>\n        snd (execute ?M (0, tps1 @ tps') (Suc i)) :#: 1 = snd (es ! i)\"\n    if \"i < length es\" for i\n  proof -\n    have \"snd (execute ?M (0, tps1 @ tps') (Suc i)) = snd (execute M (0, tps1) (Suc i)) @ tps'\"\n      using execute_append_tapes' assms by (metis snd_conv)\n    moreover have \"||execute M (0, tps1) (Suc i)|| = 2\"\n      using assms(1,2) by (metis execute_num_tapes snd_conv)\n    ultimately show ?thesis\n      using that assms by (simp add: nth_append trace_def traces_def)\n  qed\nqed\n\n\nsubsection \\<open>Combining Turing machines\\<close>\n\ntext \\<open>\nTraces for sequentially composed Turing machines are just concatenated traces of\nthe individual machines.\n\\<close>\n\nlemma traces_sequential:\n  assumes \"traces M1 tps1 es1 tps2\" and \"traces M2 tps2 es2 tps3\"\n  shows \"traces (M1 ;; M2) tps1 (es1 @ es2) tps3\"\nproof\n  let ?M = \"M1 ;; M2\"\n  let ?cfg1 = \"(0, tps1)\"\n  let ?cfg1' = \"(length M1, tps2)\"\n  let ?cfg2 = \"(0, tps2)\"\n  let ?cfg2' = \"(length M2, tps3)\"\n  let ?es = \"es1 @ es2\"\n  have 3: \"execute M1 ?cfg1 (length es1) = ?cfg1'\"\n    using assms(1) traces_def trace_def by simp\n  have \"fst ?cfg1 = 0\"\n    by simp\n  have 4: \"execute M2 ?cfg2 (length es2) = ?cfg2'\"\n    using assms(2) traces_def trace_def by auto\n  have \"?cfg1' = ?cfg2 <+=> length M1\"\n    by simp\n  have 2: \"length ?M = length M1 + length M2\"\n    using length_turing_machine_sequential by simp\n  have t_le: \"execute ?M ?cfg1 t = execute M1 ?cfg1 t\" if \"t \\<le> length es1\" for t\n    using that\n  proof (induction t)\n    case 0\n    then show ?case\n      by simp\n  next\n    case (Suc t)\n    then have \"t < length es1\"\n      by simp\n    then have 1: \"fst (execute M1 ?cfg1 t) < length M1\"\n      using traces_def trace_def assms(1) by simp\n    have \"execute ?M ?cfg1 (Suc t) = exe ?M (execute ?M ?cfg1 t)\"\n      by simp\n    also have \"... = exe ?M (execute M1 ?cfg1 t)\" (is \"_ = exe _ ?cfg\")\n      using Suc by simp\n    also have \"... = sem (?M ! (fst ?cfg)) ?cfg\"\n      using 1 2 exe_def by simp\n    also have \"... = sem (M1 ! (fst ?cfg)) ?cfg\"\n      using 1 by (simp add: nth_append turing_machine_sequential_def)\n    also have \"... = exe M1 (execute M1 ?cfg1 t)\"\n      using exe_def 1 by simp\n    also have \"... = execute M1 ?cfg1 (Suc t)\"\n      by simp\n    finally show ?case .\n  qed\n  have t_ge: \"execute ?M ?cfg1 (length es1 + t) = execute M2 ?cfg2 t <+=> length M1\"\n      if \"t \\<le> length es2\" for t\n    using that\n  proof (induction t)\n    case 0\n    then show ?case\n      using t_le 3 by simp\n  next\n    case (Suc t)\n    have \"execute ?M ?cfg1 (length es1 + Suc t) = execute ?M ?cfg1 (Suc (length es1 + t))\"\n      by simp\n    also have \"... = exe ?M (execute ?M ?cfg1 (length es1 + t))\"\n      by simp\n    also have \"... = exe ?M (execute M2 ?cfg2 t <+=> length M1)\"\n        (is \"_ = exe _ (?cfg <+=> _)\")\n      using Suc by simp\n    also have \"... = (exe M2 (execute M2 ?cfg2 t)) <+=> length M1\"\n      using exe_relocate by simp\n    also have \"... = execute M2 ?cfg2 (Suc t) <+=> length M1\"\n      by simp\n    finally show ?case .\n  qed\n  show \"fst (execute ?M ?cfg1 i) < length ?M\" if \"i < length ?es\" for i\n  proof (cases \"i < length es1\")\n    case True\n    then show ?thesis\n      using t_le assms(1) traces_def trace_def 2 by auto\n  next\n    case False\n    then obtain i' where \"i = length es1 + i'\" \"i' \\<le> length es2\"\n      by (metis \\<open>i < length (es1 @ es2)\\<close> add_diff_inverse_nat add_le_cancel_left length_append less_or_eq_imp_le)\n    then show ?thesis\n      using t_ge assms(2) traces_def trace_def that 2 by simp\n  qed\n  show \"execute ?M ?cfg1 (length ?es) = (length ?M, tps3)\"\n    by (simp add: 2 4 t_ge)\n  show \"execute ?M ?cfg1 (Suc i) <#> 0 = fst (?es ! i) \\<and>\n        execute ?M ?cfg1 (Suc i) <#> 1 = snd (?es ! i)\"\n        if \"i < length ?es\" for i\n  proof (cases \"i < length es1\")\n    case True\n    then have \"Suc i \\<le> length es1\"\n      by simp\n    then have \"execute ?M ?cfg1 (Suc i) = execute M1 ?cfg1 (Suc i)\"\n      using t_le by blast\n    then show ?thesis\n      using assms(1) traces_def trace_def by (simp add: True nth_append)\n  next\n    case False\n    have 8: \"i - length es1 < length es2\"\n      using False that by simp\n    with False have \"Suc i - length es1 \\<le> length es2\"\n      by simp\n    then have \"execute ?M ?cfg1 (Suc i) = execute M2 ?cfg2 (Suc i - length es1) <+=> length M1\"\n      using t_ge False by fastforce\n    moreover have \"?es ! i = es2 ! (i - length es1)\"\n      by (simp add: False nth_append)\n    moreover have \"execute M2 ?cfg2 (Suc i) <#> 0 = fst (es2 ! i) \\<and>\n        execute M2 ?cfg2 (Suc i) <#> 1 = snd (es2 ! i)\" if \"i < length es2\" for i\n        using that assms(2) traces_def trace_def by simp\n    ultimately show ?thesis\n      by (metis \"8\" False Nat.add_diff_assoc le_less_linear plus_1_eq_Suc snd_conv)\n  qed\nqed\n\ntext \\<open>\nNext we show how to derive traces for machines created by the @{text WHILE}\noperation. If the condition is false, the trace of the loop is the trace for the\nmachine computing the condition plus a singleton trace for the jump.\n\\<close>\n\nlemma tm_loop_sem_false_trace:\n  assumes \"traces M1 tps0 es1 tps1\"\n    and \"\\<not> cond (read tps1)\"\n  shows \"trace\n            (WHILE M1 ; cond DO M2 DONE)\n            (0, tps0)\n            (es1 @ [(tps1 :#: 0, tps1 :#: 1)])\n            (length M1 + length M2 + 2, tps1)\"\n    (is \"trace ?M _ _ _\")\nproof (rule traceI)\n  let ?C1 = \"M1\"\n  let ?C2 = \"[cmd_jump cond (length M1 + 1) (length M1 + length M2 + 2)]\"\n  let ?C3 = \"relocate (length M1 + 1) M2\"\n  let ?C4 = \"[cmd_jump (\\<lambda>_. True) 0 0]\"\n  let ?C34 = \"?C3 @ ?C4\"\n  have parts: \"?M = ?C1 @ ?C2 @ ?C3 @ ?C4\"\n    using turing_machine_loop_def by simp\n  then have 1: \"?M ! (length M1) = cmd_jump cond (length M1 + 1) (length M1 + length M2 + 2)\"\n    by simp\n  let ?es = \"es1 @ [(tps1 :#: 0, tps1 :#: 1)]\"\n  show goal1: \"execute ?M (0, tps0) (length ?es) = (length M1 + length M2 + 2, tps1)\"\n  proof -\n    have \"execute ?M (0, tps0) (length es1) = execute M1 (0, tps0) (length es1)\"\n      using execute_trace_append assms by (simp add: traces_def turing_machine_loop_def)\n    then have 2: \"execute ?M (0, tps0) (length es1) = (length M1, tps1) \"\n      using assms trace_def traces_def by simp\n    have \"execute ?M (0, tps0) (length ?es) = execute ?M (0, tps0) (Suc (length es1))\"\n      by simp\n    also have \"... = exe ?M (execute ?M (0, tps0) (length es1))\"\n      by simp\n    also have \"... = exe ?M (length M1, tps1)\"\n      using 2 by simp\n    also have \"... = sem (cmd_jump cond (length M1 + 1) (length M1 + length M2 + 2)) (length M1, tps1)\"\n      by (simp add: \"1\" exe_lt_length turing_machine_loop_len)\n    also have \"... = (length M1 + length M2 + 2, tps1)\"\n      using assms(2) sem_jump by simp\n    finally show ?thesis .\n  qed\n  show \"fst (execute ?M (0, tps0) i) < length ?M\" if \"i < length ?es\" for i\n  proof (cases \"i < length es1\")\n    case True\n    then have \"execute ?M (0, tps0) i = execute M1 (0, tps0) i\"\n      using execute_trace_append assms parts by (simp add: traces_def)\n    then show ?thesis\n      using assms(1) trace_def traces_def True turing_machine_loop_len by auto\n  next\n    case False\n    with that have \"i = length es1\"\n      by simp\n    then show ?thesis\n      using assms(1) trace_def traces_def turing_machine_loop_len\n      by (simp add: execute_trace_append parts)\n  qed\n  show \"execute ?M (0, tps0) (Suc i) <#> 0 = fst (?es ! i) \\<and>\n        execute ?M (0, tps0) (Suc i) <#> 1 = snd (?es ! i)\"\n    if \"i < length ?es\" for i\n  proof (cases \"i < length es1\")\n    case True\n    then have \"Suc i \\<le> length es1\"\n      by simp\n    then have \"execute ?M (0, tps0) (Suc i) = execute M1 (0, tps0) (Suc i)\"\n      using execute_trace_append assms parts by (metis traces_def)\n    then show ?thesis\n      using assms(1) trace_def traces_def True by (simp add: nth_append)\n  next\n    case False\n    with that have \"Suc i = length ?es\"\n      by simp\n    then show ?thesis\n      using goal1 by simp\n  qed\nqed\n\nlemma tm_loop_sem_false_traces:\n  assumes \"traces M1 tps0 es1 tps1\"\n    and \"\\<not> cond (read tps1)\"\n    and \"es = es1 @ [(tps1 :#: 0, tps1 :#: 1)]\"\n  shows \"traces (WHILE M1 ; cond DO M2 DONE) tps0 es tps1\"\n  using tm_loop_sem_false_trace assms traces_def turing_machine_loop_len by fastforce\n\ntext \\<open>\nIf the loop condition evaluates to true, the trace of one iteration is the\nconcatenation of the traces of the condition machine and the loop body machine\nwith two additional singleton traces for the jumps.\n\\<close>\n\nlemma tm_loop_sem_true_traces:\n  assumes \"traces M1 tps0 es1 tps1\"\n    and \"traces M2 tps1 es2 tps2\"\n    and \"cond (read tps1)\"\n  shows \"trace\n            (WHILE M1 ; cond DO M2 DONE)\n            (0, tps0)\n            (es1 @ [(tps1 :#: 0, tps1 :#: 1)] @ es2 @ [(tps2 :#: 0, tps2 :#: 1)])\n            (0, tps2)\"\n    (is \"trace ?M _ ?es _\")\nproof (rule traceI)\n  let ?C1 = \"M1\"\n  let ?C2 = \"[cmd_jump cond (length M1 + 1) (length M1 + length M2 + 2)]\"\n  let ?C3 = \"relocate (length M1 + 1) M2\"\n  let ?C4 = \"[cmd_jump (\\<lambda>_. True) 0 0]\"\n  let ?C34 = \"?C3 @ ?C4\"\n  have parts: \"?M = ?C1 @ ?C2 @ ?C3 @ ?C4\"\n    using turing_machine_loop_def by simp\n  then have 1: \"?M ! (length M1) = cmd_jump cond (length M1 + 1) (length M1 + length M2 + 2)\"\n    by simp\n  from parts have parts': \"?M = ((?C1 @ ?C2) @ ?C3) @ ?C4\"\n    by simp\n  have len_M: \"length ?M = length M1 + length M2 + 2\"\n    using turing_machine_loop_len assms by simp\n  have len_es: \"length ?es = length es1 + length es2 + 2\"\n    by simp\n\n  have exec_1: \"execute ?M (0, tps0) t = execute M1 (0, tps0) t\" if \"t \\<le> length es1\" for t\n    using execute_trace_append assms by (simp add: parts that traces_def)\n\n  have exec_2: \"execute ?M (0, tps0) (length es1 + 1) = (length M1 + 1, tps1)\"\n  proof -\n    have \"execute ?M (0, tps0) (length es1) = execute M1 (0, tps0) (length es1)\"\n      using execute_trace_append assms by (simp add: traces_def turing_machine_loop_def)\n    then have 2: \"execute ?M (0, tps0) (length es1) = (length M1, tps1) \"\n      using assms trace_def traces_def by simp\n    have \"execute ?M (0, tps0) (length es1 + 1) = execute ?M (0, tps0) (Suc (length es1))\"\n      by simp\n    also have \"... = exe ?M (execute ?M (0, tps0) (length es1))\"\n      by simp\n    also have \"... = exe ?M (length M1, tps1)\"\n      using 2 by simp\n    also have \"... = sem (cmd_jump cond (length M1 + 1) (length M1 + length M2 + 2)) (length M1, tps1)\"\n      by (simp add: \"1\" exe_lt_length turing_machine_loop_len)\n    also have \"... = (length M1 + 1, tps1)\"\n      using assms(3) sem_jump by simp\n    finally show ?thesis .\n  qed\n\n  have exec_3': \"execute ?M (0, tps0) (length es1 + 1 + t) = execute M2 (0, tps1) t <+=> (length M1 + 1)\"\n    if \"t \\<le> length es2\" for t\n    using that\n  proof (induction t)\n    case 0\n    then show ?case\n      using exec_2 by simp\n  next\n    case (Suc t)\n    then have 2: \"fst (execute M2 (0, tps1) t) < length M2\"\n      using assms(2) trace_def traces_def by simp\n    then have 3: \"fst (execute M2 (0, tps1) t <+=> (length M1 + 1)) < length M1 + length M2 + 1\"\n      by simp\n    have 4: \"fst (execute M2 (0, tps1) t <+=> (length M1 + 1)) \\<ge> length M1 + 1\"\n      by simp\n\n    have \"?M = (?C1 @ ?C2) @ (?C3 @ ?C4)\"\n      using parts by simp\n    moreover have \"length (?C1 @ ?C2) = length M1 + 1\"\n      by simp\n    ultimately have \"?M ! i = (?C3 @ ?C4) ! (i - (length M1 + 1))\"\n        if \"i \\<ge> length M1 + 1\" and \"i < length M1 + length M2 + 1\" for i\n      using that by (simp add: nth_append)\n    then have \"?M ! i = ?C3 ! (i - (length M1 + 1))\"\n        if \"i \\<ge> length M1 + 1\" and \"i < length M1 + length M2 + 1\" for i\n      using that\n      by (smt One_nat_def \\<open>length (?C1 @ ?C2) = length M1 + 1\\<close>\n        add.right_neutral add_Suc_right append.assoc length_append not_le nth_append plus_nat.simps(2) length_relocate)\n    with 3 4 have \"?M ! (fst (execute M2 (0, tps1) t <+=> (length M1 + 1))) =\n        ?C3 ! ((fst (execute M2 (0, tps1) t <+=> (length M1 + 1))) - (length M1 + 1))\"\n      by simp\n    then have in_C3: \"?M ! (fst (execute M2 (0, tps1) t <+=> (length M1 + 1))) =\n        ?C3 ! ((fst (execute M2 (0, tps1) t)))\"\n      by simp\n\n    have \"execute ?M (0, tps0) (length es1 + 1 + Suc t) = execute ?M (0, tps0) (Suc (length es1 + 1 + t))\"\n      by simp\n    also have \"... = exe ?M (execute ?M (0, tps0) (length es1 + 1 + t))\"\n      by simp\n    also have \"... = exe ?M (execute M2 (0, tps1) t <+=> (length M1 + 1))\"\n        (is \"_ = exe ?M ?cfg\")\n      using Suc by simp\n    also have \"... = sem (?M ! (fst ?cfg)) ?cfg\"\n      using exe_def \"3\" len_M by simp\n    also have \"... = sem (?C3 ! (fst (execute M2 (0, tps1) t))) (execute M2 (0, tps1) t)\"\n      using in_C3 sem by simp\n    also have \"... = sem (M2 ! (fst (execute M2 (0, tps1) t))) (execute M2 (0, tps1) t) <+=> (length M1 + 1)\"\n      using sem_relocate 2 by simp\n    also have \"... = exe M2 (execute M2 (0, tps1) t) <+=> (length M1 + 1)\"\n      by (simp add: 2 exe_def)\n    also have \"... = (execute M2 (0, tps1) (Suc t)) <+=> (length M1 + 1)\"\n      by simp\n    finally show ?case .\n  qed\n  then have exec_3: \"execute ?M (0, tps0) t = execute M2 (0, tps1) (t - (length es1 + 1)) <+=> (length M1 + 1)\"\n      if \"t \\<ge> length es1 + 1 \" and \"t \\<le> length es1 + length es2 + 1\" for t\n    using that\n    by (smt Nat.add_diff_assoc2 Nat.diff_diff_right add_diff_cancel_left' add_diff_cancel_right' le_Suc_ex le_add2)\n\n  have exec_4: \"execute ?M (0, tps0) (length es1 + length es2 + 2) = (0, tps2)\"\n  proof -\n    have \"execute ?M (0, tps0) (length es1 + length es2 + 2) = execute ?M (0, tps0) (Suc (length es1 + length es2 + 1))\"\n      by simp\n    also have \"... = exe ?M (execute ?M (0, tps0) (length es1 + length es2 + 1))\"\n      by simp\n    also have \"... = exe ?M (execute M2 (0, tps1) (length es2) <+=> (length M1 + 1))\"\n        (is \"_ = exe ?M ?cfg\")\n      using exec_3' by simp\n    also have \"... = sem (?M ! (fst ?cfg)) ?cfg\"\n      using exe_def assms(2) len_M trace_def traces_def by auto\n    also have \"... = sem (cmd_jump (\\<lambda>_. True) 0 0) ?cfg\"\n    proof -\n      have \"fst ?cfg = length M1 + length M2 + 1\"\n        using assms(2) len_M trace_def traces_def by simp\n      then have \"?M ! (fst ?cfg) = cmd_jump (\\<lambda>_. True) 0 0\"\n        by (metis (no_types, lifting) add.right_neutral add_Suc_right length_Cons\n          list.size(3) nth_append_length nth_append_length_plus parts plus_1_eq_Suc length_relocate)\n      then show ?thesis\n        by simp\n    qed\n    also have \"... = (0, tps2)\"\n      using assms(2) sem_jump trace_def traces_def by auto\n    finally show ?thesis\n      by simp\n  qed\n\n  show \"execute ?M (0, tps0) (length ?es) = (0, tps2)\"\n    using exec_4 by auto\n  show \" fst (execute ?M (0, tps0) i) < length ?M\"\n      if \"i < length ?es\" for i\n  proof -\n    consider\n       \"i < length es1\"\n     | \"i = length es1\"\n     | \"i \\<ge> length es1 + 1 \" and \"i \\<le> length es1 + length es2 + 1\"\n     | \"i = length es1 + length es2 + 2\"\n     using `i < length ?es` by fastforce\n    then show ?thesis\n    proof (cases)\n      case 1\n      then have \"fst (execute ?M (0, tps0) i) = fst (execute M1 (0, tps0) i)\"\n        using exec_1 by simp\n      moreover have \"\\<forall>i<length es1. fst (execute M1 (0, tps0) i) < length M1\"\n        using assms trace_def traces_def by simp\n      ultimately have \"fst (execute ?M (0, tps0) i) < length M1\"\n        using 1 by simp\n      then show ?thesis\n        using len_M by simp\n    next\n      case 2\n      then have \"fst (execute ?M (0, tps0) i) = fst (execute M1 (0, tps0) i)\"\n        using exec_1 by simp\n      moreover have \"execute M1 (0, tps0) (length es1) = (length M1, tps1)\"\n        using assms trace_def traces_def by simp\n      ultimately show ?thesis\n        using 2 by (simp add: len_M)\n    next\n      case 3\n      then have eq: \"execute ?M (0, tps0) i = execute M2 (0, tps1) (i - (length es1 + 1)) <+=> (length M1 + 1)\"\n        using exec_3 by simp\n      have a: \"\\<forall>i<length es2. fst (execute M2 (0, tps1) i) < length M2\"\n        using assms(2) trace_def traces_def that by simp\n      have b: \"fst (execute M2 (0, tps1) (length es2)) = length M2\"\n        using assms(2) trace_def traces_def that by simp\n      have \"i - (length es1 + 1) \\<le> length es2\"\n        using 3 by simp\n      then have \"fst (execute M2 (0, tps1) (i - (length es1 + 1))) \\<le> length M2\"\n        using a b that using le_eq_less_or_eq by auto\n      then have \"fst (execute M2 (0, tps1) (i - (length es1 + 1)) <+=> (length M1 + 1)) < length ?M\"\n        by (simp add: len_M)\n      then show ?thesis\n        using eq by simp\n    next\n      case 4\n      then show ?thesis\n        using exec_4 using len_es that by linarith\n    qed\n  qed\n  show \"execute ?M (0, tps0) (Suc i) <#> 0 = fst (?es ! i) \\<and>\n        execute ?M (0, tps0) (Suc i) <#> 1 = snd (?es ! i)\"\n    if \"i < length ?es\" for i\n  proof -\n    consider\n       \"i < length es1\"\n     | \"i = length es1\"\n     | \"i \\<ge> length es1 + 1 \" and \"i < length es1 + length es2 + 1\"\n     | \"i = length es1 + length es2 + 1\"\n     using `i < length ?es` by fastforce\n    then show ?thesis\n    proof (cases)\n      case 1\n      then have \"Suc i \\<le> length es1\"\n        by simp\n      then have \"execute ?M (0, tps0) (Suc i) = execute M1 (0, tps0) (Suc i)\"\n        using exec_1 by blast\n      then show ?thesis\n        using assms(1) trace_def traces_def by (simp add: \"1\" nth_append)\n    next\n      case 2\n      then have \"execute ?M (0, tps0) (Suc i) = (length M1 + 1, tps1)\"\n        using exec_2 by simp\n      then show ?thesis\n        using 2 by simp\n    next\n      case 3\n      then have Suc_i: \"Suc i \\<ge> length es1 + 1 \" \"Suc i \\<le> length es1 + length es2 + 1\"\n        by simp_all\n      then have *: \"execute ?M (0, tps0) (Suc i) =\n          execute M2 (0, tps1) (Suc i - (length es1 + 1)) <+=> (length M1 + 1)\"\n        using exec_3 by blast\n      from 3 have i: \"i - (length es1 + 1) < length es2\" (is \"?j < length es2\")\n        by simp\n      then have **: \"execute M2 (0, tps1) (Suc ?j) <#> 0 = fst (es2 ! ?j) \\<and>\n                 execute M2 (0, tps1) (Suc ?j) <#> 1 = snd (es2 ! ?j)\"\n        using assms(2) trace_def traces_def by simp\n      have \"((es1 @ [(tps1 :#: 0, tps1 :#: 1)]) @ es2) ! i = es2 ! ?j\"\n        using i 3 by (simp add: nth_append)\n      then have \"es2 ! ?j = ?es ! i\"\n        by (metis Suc_eq_plus1 append.assoc i length_append_singleton nth_append)\n      then show ?thesis\n        using * ** using \"3\"(1) Suc_diff_le by fastforce\n    next\n      case 4\n      then have \"execute ?M (0, tps0) (Suc i) = (0, tps2)\"\n        using exec_4 by simp\n      then show ?thesis\n        by (simp add: \"4\" nth_append)\n    qed\n  qed\nqed\n\nlemma tm_loop_sem_true_tracesI:\n  assumes \"traces M1 tps0 es1 tps1\"\n    and \"traces M2 tps1 es2 tps2\"\n    and \"cond (read tps1)\"\n    and \"es = es1 @ [(tps1 :#: 0, tps1 :#: 1)] @ es2 @ [(tps2 :#: 0, tps2 :#: 1)]\"\n  shows \"trace (WHILE M1 ; cond DO M2 DONE) (0, tps0) es (0, tps2)\"\n  using assms tm_loop_sem_true_traces by blast\n\ntext \\<open>\nCombining traces for $m$ iterations of a loop. Typically $m$ will be the total\nnumber of iterations.\n\\<close>\n\nlemma tm_loop_trace_simple:\n  fixes m :: nat\n    and M :: machine\n    and tps :: \"nat \\<Rightarrow> tape list\"\n    and es :: \"nat \\<Rightarrow> (nat \\<times> nat) list\"\n  assumes \"\\<And>i. i < m \\<Longrightarrow> trace M (0, tps i) (es i) (0, tps (Suc i))\"\n  shows \"trace M (0, tps 0) (concat (map es [0..<m])) (0, tps m)\"\n  using assms trace_Nil trace_additive by (induction m) simp_all\n\ntext \\<open>\nFor simple loops, where we have an upper bound for the length of traces\nindependent of the iteration, there is a trivial upper bound for the length of\nthe trace of $m$ iterations. This is the only situation we will encounter.\n\\<close>\n\nlemma length_concat_le:\n  assumes \"\\<And>i. i < m \\<Longrightarrow> length (es i) \\<le> b\"\n  shows \"length (concat (map es [0..<m])) \\<le> m * b\"\n  using assms\nproof (induction m)\n  case 0\n  then show ?case\n    by simp\nnext\n  case (Suc m)\n  have \"length (concat (map es [0..<Suc m])) = length (concat (map es [0..<m])) + length (es m)\"\n    by simp\n  also have \"... \\<le> m * b + length (es m)\"\n    using Suc by simp\n  also have \"... \\<le> m * b + b\"\n    using Suc by simp\n  also have \"... = (Suc m) * b\"\n    by simp\n  finally show ?case .\nqed\n\n\nsubsection \\<open>Traces for elementary Turing machines\\label{s:oblivious-traces}\\<close>\n\ntext \\<open>\nJust like the not necessarily oblivious Turing machines considered so far, our\noblivious Turing machines will be built from elementary ones from\nSection~\\ref{s:tm-elementary}. In this subsection we show the traces of all the\nelementary machines we will need.\n\\<close>\n\nlemma tm_left_0_traces:\n  assumes \"length tps > 1\"\n  shows \"traces\n    (tm_left 0)\n    tps\n    [(tps :#: 0 - 1, tps :#: 1)]\n    (tps[0:=(fst (tps ! 0), snd (tps ! 0) - 1)])\"\nproof -\n  from assms have \"length tps > 0\"\n    by auto\n  with assms show ?thesis\n    using execute_tm_left assms tm_left_def by (intro tracesI) simp_all\nqed\n\nlemma traces_tm_left_0I:\n  assumes \"length tps > 1\"\n    and \"es = [(tps :#: 0 - 1, tps :#: 1)]\"\n    and \"tps' = (tps[0:=(fst (tps ! 0), snd (tps ! 0) - 1)])\"\n  shows \"traces (tm_left 0) tps es tps'\"\n  using tm_left_0_traces assms by simp\n\nlemma tm_left_1_traces:\n  assumes \"length tps > 1\"\n  shows \"traces\n    (tm_left 1)\n    tps\n    [(tps :#: 0, tps :#: 1 - 1)]\n    (tps[1:=(fst (tps ! 1), snd (tps ! 1) - 1)])\"\nproof -\n  from assms have \"length tps > 0\"\n    by auto\n  with assms show ?thesis\n    using execute_tm_left assms tm_left_def by (intro tracesI) simp_all\nqed\n\nlemma traces_tm_left_1I:\n  assumes \"length tps > 1\"\n    and \"es = [(tps :#: 0, tps :#: 1 - 1)]\"\n    and \"tps' = (tps[1:=(fst (tps ! 1), snd (tps ! 1) - 1)])\"\n  shows \"traces (tm_left 1) tps es tps'\"\n  using tm_left_1_traces assms by simp\n\nlemma tm_right_0_traces:\n  assumes \"length tps > 1\"\n  shows \"traces\n    (tm_right 0)\n    tps\n    [(tps :#: 0 + 1, tps :#: 1)]\n    (tps[0:=(fst (tps ! 0), snd (tps ! 0) + 1)])\"\nproof -\n  from assms have \"length tps > 0\"\n    by auto\n  with assms show ?thesis\n    using execute_tm_right assms tm_right_def by (intro tracesI) simp_all\nqed\n\nlemma traces_tm_right_0I:\n  assumes \"length tps > 1\"\n    and \"es = [(tps :#: 0 + 1, tps :#: 1)]\"\n    and \"tps' = (tps[0:=(fst (tps ! 0), snd (tps ! 0) + 1)])\"\n  shows \"traces (tm_right 0) tps es tps'\"\n  using tm_right_0_traces assms by simp\n\nlemma tm_right_1_traces:\n  assumes \"length tps > 1\"\n  shows \"traces\n    (tm_right 1)\n    tps\n    [(tps :#: 0, tps :#: 1 + 1)]\n    (tps[1:=(fst (tps ! 1), snd (tps ! 1) + 1)])\"\nproof -\n  from assms have \"length tps > 0\"\n    by auto\n  with assms show ?thesis\n    using execute_tm_right assms tm_right_def by (intro tracesI) simp_all\nqed\n\nlemma tm_rtrans_1_traces:\n  assumes \"1 < length tps\"\n  shows \"traces\n    (tm_rtrans 1 f)\n    tps\n    [(tps :#: 0, tps :#: 1 + 1)]\n    (tps[1 := tps ! 1 |:=| f (tps :.: 1) |+| 1])\"\n  using execute_tm_rtrans assms tm_rtrans_def by (intro tracesI) simp_all\n\nlemma traces_tm_right_1I:\n  assumes \"length tps > 1\"\n    and \"es = [(tps :#: 0, tps :#: 1 + 1)]\"\n    and \"tps' = (tps[1:=(fst (tps ! 1), snd (tps ! 1) + 1)])\"\n  shows \"traces (tm_right 1) tps es tps'\"\n  using tm_right_1_traces assms by simp\n\nlemma traces_tm_rtrans_1I:\n  assumes \"1 < length tps\"\n    and \"es = [(tps :#: 0, tps :#: 1 + 1)]\"\n    and \"tps' = (tps[1 := tps ! 1 |:=| f (tps :.: 1) |+| 1])\"\n  shows \"traces (tm_rtrans 1 f) tps es tps'\"\n  using tm_rtrans_1_traces assms by simp\n\nlemma tm_left_until_1_traces:\n  assumes \"length tps > 1\" and \"begin_tape H (tps ! 1)\"\n  shows \"traces\n    (tm_left_until H 1)\n    tps\n    (map (\\<lambda>i. (tps :#: 0, i)) (rev [0..<tps :#: 1]) @ [(tps :#: 0, 0)])\n    (tps[1 := tps ! 1 |#=| 0])\"\nproof\n  let ?es = \"map (\\<lambda>i. (tps :#: 0, i)) (rev [0..<tps :#: 1]) @ [(tps :#: 0, 0)]\"\n  show \"execute (tm_left_until H 1) (0, tps) (length ?es) = (length (tm_left_until H 1), tps[1 := tps ! 1 |#=| 0])\"\n    using execute_tm_left_until assms tm_left_until_def by simp\n  show \"\\<And>i. i < length ?es \\<Longrightarrow> fst (execute (tm_left_until H 1) (0, tps) i) < length (tm_left_until H 1)\"\n    using execute_tm_left_until_less assms tm_left_until_def by simp\n  show \"execute (tm_left_until H 1) (0, tps) (Suc i) <#> 0 = fst (?es ! i) \\<and>\n        execute (tm_left_until H 1) (0, tps) (Suc i) <#> 1 = snd (?es ! i)\"\n      if \"i < length ?es\" for i\n  proof (cases \"i < tps :#: 1\")\n    case True\n    then have i: \"Suc i \\<le> tps :#: 1\"\n      by simp\n    then have \"execute (tm_left_until H 1) (0, tps) (Suc i) = (0, tps[1 := tps ! 1 |-| Suc i])\"\n      using execute_tm_left_until_less assms by presburger\n    moreover have \"?es ! i = (tps :#: 0, tps :#: 1 - Suc i)\"\n    proof -\n      have \"?es ! i = (map (\\<lambda>i. (tps :#: 0, i)) (rev [0..<tps :#: 1])) ! i\"\n        using True by (simp add: nth_append)\n      moreover have \"(rev [0..<tps :#: 1]) ! i = tps :#: 1 - Suc i\"\n        using True by (simp add: rev_nth)\n      ultimately show ?thesis\n        using True by simp\n    qed\n    ultimately show ?thesis\n      using assms(1) by simp\n  next\n    case False\n    then have i: \"i = tps :#: 1\"\n      using that by simp\n    then have \"execute (tm_left_until H 1) (0, tps) (Suc (tps :#: 1)) = (1, tps[1 := tps ! 1 |#=| 0])\"\n      using execute_tm_left_until assms by simp\n    then have \"execute (tm_left_until H 1) (0, tps) (Suc i) = (1, tps[1 := tps ! 1 |#=| 0])\"\n      using i by simp\n    moreover have \"?es ! i = (tps :#: 0, 0)\"\n      using i by (metis diff_zero length_map length_rev length_upt nth_append_length)\n    ultimately show ?thesis\n      using assms(1) by simp\n  qed\nqed\n\nlemma traces_tm_left_until_1I:\n  assumes \"length tps > 1\"\n    and \"begin_tape H (tps ! 1)\"\n    and \"es = map (\\<lambda>i. (tps :#: 0, i)) (rev [0..<tps :#: 1]) @ [(tps :#: 0, 0)]\"\n    and \"tps' = tps[1 := tps ! 1 |#=| 0]\"\n  shows \"traces (tm_left_until H 1) tps es tps'\"\n  using tm_left_until_1_traces assms by simp\n\nlemma tm_left_until_0_traces:\n  assumes \"length tps > 1\" and \"begin_tape H (tps ! 0)\"\n  shows \"traces\n    (tm_left_until H 0)\n    tps\n    (map (\\<lambda>i. (i, tps :#: 1)) (rev [0..<tps :#: 0]) @ [(0, tps :#: 1)])\n    (tps[0 := tps ! 0 |#=| 0])\"\nproof\n  have len: \"length tps > 0\"\n    using assms(1) by auto\n  let ?es = \"map (\\<lambda>i. (i, tps :#: 1)) (rev [0..<tps :#: 0]) @ [(0, tps :#: 1)]\"\n  show \"execute (tm_left_until H 0) (0, tps) (length ?es) = (length (tm_left_until H 0), tps[0 := tps ! 0 |#=| 0])\"\n    using execute_tm_left_until assms(2) tm_left_until_def len by simp\n  show \"\\<And>i. i < length ?es \\<Longrightarrow> fst (execute (tm_left_until H 0) (0, tps) i) < length (tm_left_until H 0)\"\n    using execute_tm_left_until_less len assms(2) tm_left_until_def by simp\n  show \"execute (tm_left_until H 0) (0, tps) (Suc i) <#> 0 = fst (?es ! i) \\<and>\n        execute (tm_left_until H 0) (0, tps) (Suc i) <#> 1 = snd (?es ! i)\"\n      if \"i < length ?es\" for i\n  proof (cases \"i < tps :#: 0\")\n    case True\n    then have i: \"Suc i \\<le> tps :#: 0\"\n      by simp\n    then have \"execute (tm_left_until H 0) (0, tps) (Suc i) = (0, tps[0 := tps ! 0 |-| Suc i])\"\n      using execute_tm_left_until_less assms(2) len by blast\n    moreover have \"?es ! i = (tps :#: 0 - Suc i, tps :#: 1)\"\n    proof -\n      have \"?es ! i = (map (\\<lambda>i. (i, tps :#: 1)) (rev [0..<tps :#: 0])) ! i\"\n        using True by (simp add: nth_append)\n      moreover have \"(rev [0..<tps :#: 0]) ! i = tps :#: 0 - Suc i\"\n        using True by (simp add: rev_nth)\n      ultimately show ?thesis\n        using True by simp\n    qed\n    ultimately show ?thesis\n      using len by simp\n  next\n    case False\n    then have i: \"i = tps :#: 0\"\n      using that by simp\n    then have \"execute (tm_left_until H 0) (0, tps) (Suc (tps :#: 0)) = (1, tps[0 := tps ! 0 |#=| 0])\"\n      using execute_tm_left_until assms len by simp\n    then have \"execute (tm_left_until H 0) (0, tps) (Suc i) = (1, tps[0 := tps ! 0 |#=| 0])\"\n      using i by simp\n    moreover have \"?es ! i = (0, tps :#: 1)\"\n        using i by (metis One_nat_def diff_Suc_1 diff_Suc_Suc length_map length_rev length_upt nth_append_length)\n    ultimately show ?thesis\n      using len by simp\n  qed\nqed\n\nlemma traces_tm_left_until_0I:\n  assumes \"length tps > 1\"\n    and \"begin_tape H (tps ! 0)\"\n    and \"es = map (\\<lambda>i. (i, tps :#: 1)) (rev [0..<tps :#: 0]) @ [(0, tps :#: 1)]\"\n    and \"tps' = tps[0 := tps ! 0 |#=| 0]\"\n  shows \"traces (tm_left_until H 0) tps es tps'\"\n  using tm_left_until_0_traces assms by simp\n\nlemma tm_start_0_traces:\n  assumes \"length tps > 1\" and \"clean_tape (tps ! 0)\"\n  shows \"traces\n    (tm_start 0)\n    tps\n    (map (\\<lambda>i. (i, tps :#: 1)) (rev [0..<tps :#: 0]) @ [(0, tps :#: 1)])\n    (tps[0 := tps ! 0 |#=| 0])\"\nproof -\n  have \"begin_tape {1} (tps ! 0)\"\n    using clean_tape_def begin_tape_def assms(2) by simp\n  then show ?thesis\n    using tm_left_until_0_traces tm_start_def assms(1) by metis\nqed\n\nlemma tm_start_1_traces:\n  assumes \"length tps > 1\" and \"clean_tape (tps ! 1)\"\n  shows \"traces\n    (tm_start 1)\n    tps\n    (map (\\<lambda>i. (tps :#: 0, i)) (rev [0..<tps :#: 1]) @ [(tps :#: 0, 0)])\n    (tps[1 := tps ! 1 |#=| 0])\"\nproof -\n  have \"begin_tape {1} (tps ! 1)\"\n    using clean_tape_def begin_tape_def assms(2) by simp\n  then show ?thesis\n    using tm_left_until_1_traces tm_start_def assms(1) by metis\nqed\n\nlemma traces_tm_start_1I:\n  assumes \"length tps > 1\"\n    and \"clean_tape (tps ! 1)\"\n    and \"es = map (\\<lambda>i. (tps :#: 0, i)) (rev [0..<tps :#: 1]) @ [(tps :#: 0, 0)]\"\n    and \"tps' = tps[1 := tps ! 1 |#=| 0]\"\n  shows \"traces (tm_start 1) tps es tps'\"\n  using tm_start_1_traces assms by simp\n\nlemma tm_cr_0_traces:\n  assumes \"length tps > 1\" and \"clean_tape (tps ! 0)\"\n  shows \"traces\n    (tm_cr 0)\n    tps\n    ((map (\\<lambda>i. (i, tps :#: 1)) (rev [0..<tps :#: 0]) @ [(0, tps :#: 1)]) @ [(1, tps :#: 1)])\n    (tps[0 := tps ! 0 |#=| 1])\"\n  unfolding tm_cr_def\nproof (rule traces_sequential[where ?tps2.0=\"tps[0 := tps ! 0 |#=| 0]\"])\n  from assms(1) have len: \"length tps > 0\"\n    by auto\n  show \"traces (tm_start 0) tps\n     (map (\\<lambda>i. (i, tps :#: 1)) (rev [0..<tps :#: 0]) @ [(0, tps :#: 1)])\n     (tps[0 := tps ! 0 |#=| 0])\"\n    using assms tm_start_0_traces by simp\n  show \"traces (tm_right 0) (tps[0 := tps ! 0 |#=| 0])\n     [(1, tps :#: 1)] (tps[0 := tps ! 0 |#=| 1])\"\n    using assms tm_right_0_traces len\n    by (smt One_nat_def add.commute fst_conv length_list_update list_update_overwrite neq0_conv\n      nth_list_update_eq nth_list_update_neq plus_1_eq_Suc snd_conv zero_less_one)\nqed\n\nlemma traces_tm_cr_0I:\n  assumes \"length tps > 1\" and \"clean_tape (tps ! 0)\"\n    and \"es = map (\\<lambda>i. (i, tps :#: 1)) (rev [0..<tps :#: 0]) @ [(0, tps :#: 1), (1, tps :#: 1)]\"\n    and \"tps' = tps[0 := tps ! 0 |#=| 1]\"\n  shows \"traces (tm_cr 0) tps es tps'\"\n  using tm_cr_0_traces assms by simp\n\nlemma tm_cr_1_traces:\n  assumes \"length tps > 1\" and \"clean_tape (tps ! 1)\"\n  shows \"traces\n    (tm_cr 1)\n    tps\n    ((map (\\<lambda>i. (tps :#: 0, i)) (rev [0..<tps :#: 1]) @ [(tps :#: 0, 0)]) @ [(tps :#: 0, 1)])\n    (tps[1 := tps ! 1 |#=| 1])\"\n  unfolding tm_cr_def\nproof (rule traces_sequential[where ?tps2.0=\"tps[1 := tps ! 1 |#=| 0]\"])\n  show \"traces (tm_start 1) tps\n     (map (Pair (tps :#: 0)) (rev [0..<tps :#: 1]) @ [(tps :#: 0, 0)])\n     (tps[1 := tps ! 1 |#=| 0])\"\n    using assms tm_start_1_traces by simp\n  show \"traces (tm_right 1) (tps[1 := tps ! 1 |#=| 0])\n     [(tps :#: 0, 1)] (tps[1 := tps ! 1 |#=| 1])\"\n    using assms tm_right_1_traces\n    by (smt One_nat_def add.commute fst_conv length_list_update list_update_overwrite neq0_conv\n      nth_list_update_eq nth_list_update_neq plus_1_eq_Suc snd_conv zero_less_one)\nqed\n\nlemma traces_tm_cr_1I:\n  assumes \"length tps > 1\" and \"clean_tape (tps ! 1)\"\n    and \"es = map (\\<lambda>i. (tps :#: 0, i)) (rev [0..<tps :#: 1]) @ [(tps :#: 0, 0), (tps :#: 0, 1)]\"\n    and \"tps' = tps[1 := tps ! 1 |#=| 1]\"\n  shows \"traces (tm_cr 1) tps es tps'\"\n  using tm_cr_1_traces assms by simp\n\nlemma heads_tm_trans_until_less:\n  assumes \"j1 < k\" \"j2 < k\" and \"length tps = k\"\n    and \"rneigh (tps ! j1) H n\"\n    and \"t \\<le> n\"\n  shows \"execute (tm_trans_until j1 j2 H f) (0, tps) t <#> j1 = tps :#: j1 + t\"\n    and \"execute (tm_trans_until j1 j2 H f) (0, tps) t <#> j2 = tps :#: j2 + t\"\n  using assms execute_tm_trans_until_less[OF assms]\n  by ((metis (no_types, lifting) length_list_update nth_list_update_eq nth_list_update_neq sndI transplant_def),\n      (metis (no_types, lifting) length_list_update nth_list_update_eq sndI transplant_def))\n\nlemma heads_tm_ltrans_until_less:\n  assumes \"j1 < k\" and \"j2 < k\" and \"length tps = k\"\n    and \"lneigh (tps ! j1) H n\"\n    and \"t \\<le> n\"\n    and \"n \\<le> tps :#: j1\"\n    and \"n \\<le> tps :#: j2\"\n  shows \"execute (tm_ltrans_until j1 j2 H f) (0, tps) t <#> j1 = tps :#: j1 - t\"\n    and \"execute (tm_ltrans_until j1 j2 H f) (0, tps) t <#> j2 = tps :#: j2 - t\"\n  using assms execute_tm_ltrans_until_less[OF assms]\n  by ((metis (no_types, lifting) length_list_update nth_list_update_eq nth_list_update_neq sndI ltransplant_def),\n      (metis (no_types, lifting) length_list_update nth_list_update_eq sndI ltransplant_def))\n\nlemma heads_tm_trans_until_less':\n  assumes \"j1 < k\" and \"j2 < k\" and \"length tps = k\"\n    and \"rneigh (tps ! j1) H n\"\n    and \"t \\<le> n\"\n    and \"j \\<noteq> j1\" and \"j \\<noteq> j2\"\n  shows \"execute (tm_trans_until j1 j2 H f) (0, tps) t <#> j = tps :#: j\"\n  using assms execute_tm_trans_until_less[OF assms(1-5)] by simp\n\nlemma heads_tm_ltrans_until_less':\n  assumes \"j1 < k\" and \"j2 < k\" and \"length tps = k\"\n    and \"lneigh (tps ! j1) H n\"\n    and \"t \\<le> n\"\n    and \"n \\<le> tps :#: j1\"\n    and \"n \\<le> tps :#: j2\"\n    and \"j \\<noteq> j1\" and \"j \\<noteq> j2\"\n  shows \"execute (tm_ltrans_until j1 j2 H f) (0, tps) t <#> j = tps :#: j\"\n  using assms execute_tm_ltrans_until_less[OF assms(1-7)] by simp\n\nlemma heads_tm_trans_until:\n  assumes \"j1 < k\" and \"j2 < k\" and \"length tps = k\" and \"rneigh (tps ! j1) H n\"\n  shows \"execute (tm_trans_until j1 j2 H f) (0, tps) (Suc n) <#> j1 = tps :#: j1 + n\"\n    and \"execute (tm_trans_until j1 j2 H f) (0, tps) (Suc n) <#> j2 = tps :#: j2 + n\"\n  using assms execute_tm_trans_until[OF assms]\n    by ((metis (no_types, lifting) length_list_update nth_list_update_eq nth_list_update_neq snd_conv transplant_def),\n        (metis (no_types, lifting) length_list_update nth_list_update_eq snd_conv transplant_def))\n\nlemma heads_tm_ltrans_until:\n  assumes \"j1 < k\" and \"j2 < k\" and \"length tps = k\"\n    and \"lneigh (tps ! j1) H n\"\n    and \"n \\<le> tps :#: j1\"\n    and \"n \\<le> tps :#: j2\"\n  shows \"execute (tm_ltrans_until j1 j2 H f) (0, tps) (Suc n) <#> j1 = tps :#: j1 - n\"\n    and \"execute (tm_ltrans_until j1 j2 H f) (0, tps) (Suc n) <#> j2 = tps :#: j2 - n\"\n  using assms execute_tm_ltrans_until[OF assms]\n    by ((metis (no_types, lifting) length_list_update nth_list_update_eq nth_list_update_neq snd_conv ltransplant_def),\n        (metis (no_types, lifting) length_list_update nth_list_update_eq snd_conv ltransplant_def))\n\nlemma heads_tm_trans_until':\n  assumes \"j1 < k\" and \"j2 < k\" and \"length tps = k\"\n    and \"rneigh (tps ! j1) H n\"\n    and \"j \\<noteq> j1\" and \"j \\<noteq> j2\"\n  shows \"execute (tm_trans_until j1 j2 H f) (0, tps) (Suc n) <#> j = tps :#: j\"\n  using assms execute_tm_trans_until[OF assms(1-4)] by simp\n\nlemma heads_tm_ltrans_until':\n  assumes \"j1 < k\" and \"j2 < k\" and \"length tps = k\"\n    and \"lneigh (tps ! j1) H n\"\n    and \"n \\<le> tps :#: j1\"\n    and \"n \\<le> tps :#: j2\"\n    and \"j \\<noteq> j1\" and \"j \\<noteq> j2\"\n  shows \"execute (tm_ltrans_until j1 j2 H f) (0, tps) (Suc n) <#> j = tps :#: j\"\n  using assms execute_tm_ltrans_until[OF assms(1-6)] by simp\n\nlemma traces_tm_trans_until_11:\n  assumes \"1 < k\" and \"length tps = k\" and \"rneigh (tps ! 1) H n\"\n  shows \"traces (tm_trans_until 1 1 H f)\n    tps\n    (map (\\<lambda>i. (tps :#: 0, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0, tps :#: 1 + n)])\n    (tps[1 := transplant (tps ! 1) (tps ! 1) f n])\"\nproof\n  let ?es = \"map (\\<lambda>i. (tps :#: 0, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0, tps :#: 1 + n)]\"\n  let ?tps = \"tps [1 := transplant (tps ! 1) (tps ! 1) f n]\"\n  let ?M = \"tm_trans_until 1 1 H f\"\n  have len: \"length ?es = Suc n\"\n    by simp\n  show \"execute ?M (0, tps) (length ?es) = (length ?M, ?tps)\"\n    using tm_trans_until_def len execute_tm_trans_until assms by simp\n  show \"fst (execute ?M (0, tps) i) < length ?M\" if \"i < length ?es\" for i\n  proof -\n    from that len have \"i \\<le> n\"\n      by simp\n    then have \"fst (execute ?M (0, tps) i) = 0\"\n      using execute_tm_trans_until_less assms by simp\n    then show ?thesis\n      using tm_trans_until_def by simp\n  qed\n  show \"execute ?M (0, tps) (Suc i) <#> 0 = fst (?es ! i) \\<and>\n        execute ?M (0, tps) (Suc i) <#> 1 = snd (?es ! i)\"\n    if \"i < length ?es\" for i\n  proof (cases \"i < n\")\n    case True\n    then have \"?es ! i = (tps :#: 0, tps :#: 1 + Suc i)\"\n      by (simp add: nth_append)\n    moreover from True have \"Suc i \\<le> n\"\n      by simp\n    ultimately show ?thesis\n      using heads_tm_trans_until_less' heads_tm_trans_until_less assms\n      by (metis One_nat_def Suc_neq_Zero fst_conv snd_conv)\n  next\n    case False\n    then have \"i = n\"\n      using that by simp\n    then have \"?es ! i = (tps :#: 0, tps :#: 1 + n)\"\n      by (metis (no_types, lifting) diff_zero length_map length_upt nth_append_length)\n    then show ?thesis\n      using heads_tm_trans_until' heads_tm_trans_until assms `i = n` by simp\n  qed\nqed\n\nlemma traces_tm_ltrans_until_11:\n  assumes \"1 < k\" and \"length tps = k\" and \"lneigh (tps ! 1) H n\" and \"n \\<le> tps :#: 1\"\n  shows \"traces (tm_ltrans_until 1 1 H f)\n    tps\n    (map (\\<lambda>i. (tps :#: 0, tps :#: 1 - Suc i)) [0..<n] @ [(tps :#: 0, tps :#: 1 - n)])\n    (tps[1 := ltransplant (tps ! 1) (tps ! 1) f n])\"\nproof\n  let ?es = \"map (\\<lambda>i. (tps :#: 0, tps :#: 1 - Suc i)) [0..<n] @ [(tps :#: 0, tps :#: 1 - n)]\"\n  let ?tps = \"tps [1 := ltransplant (tps ! 1) (tps ! 1) f n]\"\n  let ?M = \"tm_ltrans_until 1 1 H f\"\n  have len: \"length ?es = Suc n\"\n    by simp\n  show \"execute ?M (0, tps) (length ?es) = (length ?M, ?tps)\"\n    using tm_ltrans_until_def len execute_tm_ltrans_until assms by simp\n  show \"fst (execute ?M (0, tps) i) < length ?M\" if \"i < length ?es\" for i\n  proof -\n    from that len have \"i \\<le> n\"\n      by simp\n    then have \"fst (execute ?M (0, tps) i) = 0\"\n      using execute_tm_ltrans_until_less assms by simp\n    then show ?thesis\n      using tm_ltrans_until_def by simp\n  qed\n  show \"execute ?M (0, tps) (Suc i) <#> 0 = fst (?es ! i) \\<and>\n        execute ?M (0, tps) (Suc i) <#> 1 = snd (?es ! i)\"\n    if \"i < length ?es\" for i\n  proof (cases \"i < n\")\n    case True\n    then have \"?es ! i = (tps :#: 0, tps :#: 1 - Suc i)\"\n      by (simp add: nth_append)\n    moreover from True have \"Suc i \\<le> n\"\n      by simp\n    ultimately show ?thesis\n      using heads_tm_ltrans_until_less' heads_tm_ltrans_until_less assms\n      by (metis One_nat_def Suc_neq_Zero fst_conv snd_conv)\n  next\n    case False\n    then have \"i = n\"\n      using that by simp\n    then have \"?es ! i = (tps :#: 0, tps :#: 1 - n)\"\n      by (metis (no_types, lifting) diff_zero length_map length_upt nth_append_length)\n    then show ?thesis\n      using heads_tm_ltrans_until' heads_tm_ltrans_until assms `i = n` by simp\n  qed\nqed\n\nlemma traces_tm_trans_until_01:\n  assumes \"0 < k\" and \"1 < k\" and \"length tps = k\" and \"rneigh (tps ! 0) H n\"\n  shows \"traces (tm_trans_until 0 1 H f)\n    tps\n    (map (\\<lambda>i. (tps :#: 0 + Suc i, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0 + n, tps :#: 1 + n)])\n    (tps[0 := tps ! 0 |+| n, 1 := transplant (tps ! 0) (tps ! 1) f n])\"\nproof\n  let ?es = \"map (\\<lambda>i. (tps :#: 0 + Suc i, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0 + n, tps :#: 1 + n)]\"\n  let ?tps = \"tps [0 := tps ! 0 |+| n, 1 := transplant (tps ! 0) (tps ! 1) f n]\"\n  let ?M = \"tm_trans_until 0 1 H f\"\n  have len: \"length ?es = Suc n\"\n    by simp\n  show \"execute ?M (0, tps) (length ?es) = (length ?M, ?tps)\"\n    using tm_trans_until_def len execute_tm_trans_until[of 0 k 1] assms by simp\n  show \"fst (execute ?M (0, tps) i) < length ?M\" if \"i < length ?es\" for i\n  proof -\n    from that len have \"i \\<le> n\"\n      by simp\n    then have \"fst (execute ?M (0, tps) i) = 0\"\n      using execute_tm_trans_until_less[of 0 k 1] assms by simp\n    then show ?thesis\n      using tm_trans_until_def by simp\n  qed\n  show \"execute ?M (0, tps) (Suc i) <#> 0 = fst (?es ! i) \\<and>\n        execute ?M (0, tps) (Suc i) <#> 1 = snd (?es ! i)\"\n    if \"i < length ?es\" for i\n  proof (cases \"i < n\")\n    case True\n    then have \"?es ! i = (tps :#: 0 + Suc i, tps :#: 1 + Suc i)\"\n      by (simp add: nth_append)\n    moreover from True have \"Suc i \\<le> n\"\n      by simp\n    ultimately show ?thesis\n      using heads_tm_trans_until_less[of 0 k 1 tps H n \"Suc i\" f] assms by simp\n  next\n    case False\n    then have \"i = n\"\n      using that by simp\n    then have \"?es ! i = (tps :#: 0 + n, tps :#: 1 + n)\"\n      by (metis (no_types, lifting) diff_zero length_map length_upt nth_append_length)\n    then show ?thesis\n      using heads_tm_trans_until[of 0 k 1 tps H n f] assms `i = n` by simp\n  qed\nqed\n\nlemma traces_tm_trans_until_01I:\n  assumes \"1 < length tps\"\n    and \"rneigh (tps ! 0) H n\"\n    and \"es = map (\\<lambda>i. (tps :#: 0 + Suc i, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0 + n, tps :#: 1 + n)]\"\n    and \"tps' = tps[0 := tps ! 0 |+| n, 1 := transplant (tps ! 0) (tps ! 1) f n]\"\n  shows \"traces (tm_trans_until 0 1 H f) tps es tps'\"\n  using assms traces_tm_trans_until_01 by simp\n\nlemma traces_tm_trans_until_11I:\n  assumes \"1 < length tps\"\n    and \"rneigh (tps ! 1) H n\"\n    and \"es = map (\\<lambda>i. (tps :#: 0, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0, tps :#: 1 + n)]\"\n    and \"tps' = tps[1 := transplant (tps ! 1) (tps ! 1) f n]\"\n  shows \"traces (tm_trans_until 1 1 H f) tps es tps'\"\n  using assms traces_tm_trans_until_11 by simp\n\nlemma traces_tm_ltrans_until_11I:\n  assumes \"1 < length tps\" and \"\\<forall>h<G. f h < G\"\n    and \"lneigh (tps ! 1) H n\"\n    and \"n \\<le> tps :#: 1\"\n    and \"es = map (\\<lambda>i. (tps :#: 0, tps :#: 1 - Suc i)) [0..<n] @ [(tps :#: 0, tps :#: 1 - n)]\"\n    and \"tps' = tps[1 := ltransplant (tps ! 1) (tps ! 1) f n]\"\n  shows \"traces (tm_ltrans_until 1 1 H f) tps es tps'\"\n  using assms traces_tm_ltrans_until_11 by simp\n\nlemma traces_tm_const_until_01I:\n  assumes \"1 < length tps\"\n    and \"rneigh (tps ! 0) H n\"\n    and \"es = map (\\<lambda>i. (tps :#: 0 + Suc i, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0 + n, tps :#: 1 + n)]\"\n    and \"tps' = tps[0 := tps ! 0 |+| n, 1 := constplant (tps ! 1) h n]\"\n  shows \"traces (tm_const_until 0 1 H h) tps es tps'\"\n  using assms traces_tm_trans_until_01 tm_const_until_def constplant_transplant[of _ _ _ \"tps ! 0\"] by simp\n\nlemma traces_tm_const_until_11I:\n  assumes \"1 < length tps\" and \"h < G\"\n    and \"rneigh (tps ! 1) H n\"\n    and \"es = map (\\<lambda>i. (tps :#: 0, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0, tps :#: 1 + n)]\"\n    and \"tps' = tps[1 := constplant (tps ! 1) h n]\"\n  shows \"traces (tm_const_until 1 1 H h) tps es tps'\"\n  using assms traces_tm_trans_until_11 tm_const_until_def constplant_transplant[of _ _ _ \"tps ! 1\"] by simp\n\nlemma traces_tm_cp_until_01I:\n  assumes \"1 < length tps\"\n    and \"rneigh (tps ! 0) H n\"\n    and \"es = map (\\<lambda>i. (tps :#: 0 + Suc i, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0 + n, tps :#: 1 + n)]\"\n    and \"tps' = tps[0 := tps ! 0 |+| n, 1 := implant (tps ! 0) (tps ! 1) n]\"\n  shows \"traces (tm_cp_until 0 1 H) tps es tps'\"\n  using assms traces_tm_trans_until_01 tm_cp_until_def by simp\n\nlemma traces_tm_cp_until_11I:\n  assumes \"1 < length tps\"\n    and \"rneigh (tps ! 1) H n\"\n    and \"es = map (\\<lambda>i. (tps :#: 0, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0, tps :#: 1 + n)]\"\n    and \"tps' = tps[1 := implant (tps ! 1) (tps ! 1) n]\"\n  shows \"traces (tm_cp_until 1 1 H) tps es tps'\"\n  using assms traces_tm_trans_until_11 tm_cp_until_def by simp\n\nlemma traces_tm_right_until_1I:\n  assumes \"1 < length tps\"\n    and \"rneigh (tps ! 1) H n\"\n    and \"es = map (\\<lambda>i. (tps :#: 0, tps :#: 1 + Suc i)) [0..<n] @ [(tps :#: 0, tps :#: 1 + n)]\"\n    and \"tps' = tps[1 := (tps ! 1) |+| n]\"\n  shows \"traces (tm_right_until 1 H) tps es tps'\"\n  using assms traces_tm_cp_until_11I tm_right_until_def implant_self by simp\n\nlemma execute_tm_write:\n  shows \"execute (tm_write j h) (0, tps) 1 = (1, tps[j := tps ! j |:=| h])\"\n  using sem_cmd_write exe_lt_length tm_write_def by simp\n\nlemma traces_tm_writeI:\n  assumes \"j > 0\" and \"j < length tps\"\n    and \"es = [(tps :#: 0, tps :#: 1)]\"\n    and \"tps' = tps[j := tps ! j |:=| h]\"\n  shows \"traces (tm_write j h) tps es tps'\"\n  using assms execute_tm_write tm_write_def by (intro tracesI) (auto simp add: nth_list_update)\n\ncorollary traces_tm_write_1I:\n  assumes \"1 < length tps\"\n    and \"es = [(tps :#: 0, tps :#: 1)]\"\n    and \"tps' = tps[1 := tps ! 1 |:=| h]\"\n  shows \"traces (tm_write 1 h) tps es tps'\"\n  using assms traces_tm_writeI by simp\n\ncorollary traces_tm_write_ge2I:\n  assumes \"j \\<ge> 2\"\n    and \"j < length tps\"\n    and \"es = [(tps :#: 0, tps :#: 1)]\"\n    and \"tps' = tps[j := tps ! j |:=| h]\"\n  shows \"traces (tm_write j h) tps es tps'\"\n  using assms traces_tm_writeI by simp\n\nlemma execute_tm_write_manyI:\n  assumes \"0 \\<notin> J\" and \"\\<forall>j\\<in>J. j < k\" and \"k \\<ge> 2\" and \"length tps = k\"\n    and \"length tps' = k\"\n    and \"\\<And>j. j \\<in> J \\<Longrightarrow> tps' ! j = tps ! j |:=| h\"\n    and \"\\<And>j. j < k \\<Longrightarrow> j \\<notin> J \\<Longrightarrow> tps' ! j = tps ! j\"\n  shows \"execute (tm_write_many J h) (0, tps) 1 = (1, tps')\"\nproof -\n  have \"tps' = map (\\<lambda>j. if j \\<in> J then tps ! j |:=| h else tps ! j) [0..<length tps]\" (is \"_ = ?rhs\")\n    using assms by (intro nth_equalityI) simp_all\n  then show ?thesis\n    using assms execute_tm_write_many by simp\nqed\n\nlemma traces_tm_write_manyI:\n  assumes \"0 \\<notin> J\" and \"\\<forall>j\\<in>J. j < k\" and \"k \\<ge> 2\" and \"length tps = k\"\n    and \"length tps' = k\"\n    and \"\\<And>j. j \\<in> J \\<Longrightarrow> tps' ! j = tps ! j |:=| h\"\n    and \"\\<And>j. j < k \\<Longrightarrow> j \\<notin> J \\<Longrightarrow> tps' ! j = tps ! j\"\n    and \"es = [(tps :#: 0, tps :#: 1)]\"\n  shows \"traces (tm_write_many J h) tps es tps'\"\nproof\n  show \"execute (tm_write_many J h) (0, tps) (length es) = (length (tm_write_many J h), tps')\"\n    using execute_tm_write_manyI[OF assms(1-7)] tm_write_many_def assms(8) by simp\n  show \"\\<And>i. i < length es \\<Longrightarrow>\n          fst (execute (tm_write_many J h) (0, tps) i) < length (tm_write_many J h)\"\n    using assms(8) tm_write_many_def by simp\n  show \"\\<And>i. i < length es \\<Longrightarrow>\n        snd (execute (tm_write_many J h) (0, tps) (Suc i)) :#: 0 = fst (es ! i) \\<and>\n        snd (execute (tm_write_many J h) (0, tps) (Suc i)) :#: 1 = snd (es ! i)\"\n    using execute_tm_write_manyI[OF assms(1-7)] tm_write_many_def assms(3,6,7,8)\n    by (metis One_nat_def Suc_1 Suc_lessD fst_conv length_Cons less_Suc0\n      less_eq_Suc_le list.size(3) nth_Cons_0 snd_conv)\nqed\n\nlemma traces_tm_write_repeat_1I:\n  assumes \"1 < length tps\"\n    and \"es = map (\\<lambda>i. (tps :#: 0, tps :#: 1 + Suc i)) [0..<m]\"\n    and \"tps' = tps[1 := overwrite (tps ! 1) h m]\"\n  shows \"traces (tm_write_repeat 1 h m) tps es tps'\"\nproof\n  let ?M = \"tm_write_repeat 1 h m\"\n  have \"length es = m\"\n    using assms(2) by simp\n  moreover have \"length ?M = m\"\n    using tm_write_repeat_def by simp\n  ultimately show \"execute ?M (0, tps) (length es) = (length ?M, tps')\"\n    using assms by (simp add: execute_tm_write_repeat)\n  show \"\\<And>i. i < length es \\<Longrightarrow> fst (execute ?M (0, tps) i) < length ?M\"\n    using assms execute_tm_write_repeat tm_write_repeat_def by simp\n  show \"execute ?M (0, tps) (Suc i) <#> 0 = fst (es ! i) \\<and>\n        execute ?M (0, tps) (Suc i) <#> 1 = snd (es ! i)\"\n      if \"i < length es\" for i\n  proof -\n    have \"Suc i \\<le> m\"\n      using assms \\<open>length es = m\\<close> that by linarith\n    then have \"execute ?M (0, tps) (Suc i) = (Suc i, tps[1 := overwrite (tps ! 1) h (Suc i)])\"\n      using that execute_tm_write_repeat assms by blast\n    then show ?thesis\n      using overwrite_def assms(1,2) that by simp\n  qed\nqed\n\n\nsubsection \\<open>Memorizing in states\\<close>\n\ntext \\<open>\nWe need some results for the traces of ``cartesian'' machines used for the\nmemorizing-in-states technique introduced in Section~\\ref{s:tm-memorizing}.\n\\<close>\n\nlemma cartesian_trace:\n  assumes \"turing_machine (Suc k) G M\"\n    and \"immobile M k (Suc k)\"\n    and \"M' = cartesian M G\"\n    and \"k \\<ge> 2\"\n    and \"\\<forall>i<length zs. zs ! i < G\"\n    and \"trace M (start_config (Suc k) zs) es cfg\"\n  shows \"trace M' (start_config k zs) es (squish G (length M) cfg)\"\nproof (rule traceI')\n  show \"execute M' (start_config k zs) (length es) = squish G (length M) cfg\"\n    using assms cartesian_execute_start_config trace_def by auto\n  have len: \"length M' = G * length M\"\n    by (simp add: assms(3) length_cartesian)\n  have \"G > 0\"\n    using assms(1) turing_machine_sequential_def by (simp add: turing_machine_def)\n  show \"fst (execute M' (start_config k zs) i) < length M'\"\n      if \"i < length es\" for i\n  proof (rule ccontr)\n    assume \"\\<not> fst (execute M' (start_config k zs) i) < length M'\"\n    then have \"fst (execute M' (start_config k zs) i) \\<ge> length M'\"\n      by simp\n    then have \"fst (execute M' (start_config k zs) i) = length M'\"\n      using assms(1,3) cartesian_tm'\n      by (metis (no_types, lifting) Suc_1 Suc_le_D assms(4) start_config_def start_config_length\n        le_add2 le_add_same_cancel2 le_antisym less_Suc_eq_0_disj prod.sel(1) turing_machine_execute_states)\n    then have \"fst (squish G (length M) (execute M (start_config (Suc k) zs) i)) = G * length M\"\n      using assms cartesian_execute_start_config len by simp\n    moreover have \"fst (execute M (start_config (Suc k) zs) i) \\<le> length M\"\n      using assms(1) assms(6) that trace_def by auto\n    ultimately have \"fst (execute M (start_config (Suc k) zs) i) = length M\"\n      using squish_halt_state `0 < G` by simp\n    then show False\n      using that assms(6) trace_def by auto\n  qed\n  show \"execute M' (start_config k zs) (Suc i) <#> 0 = fst (es ! i) \\<and>\n        execute M' (start_config k zs) (Suc i) <#> 1 = snd (es ! i)\"\n    if \"i < length es\" for i\n  proof (rule ccontr)\n    assume a: \"\\<not> (snd (execute M' (start_config k zs) (Suc i)) :#: 0 = fst (es ! i) \\<and>\n       snd (execute M' (start_config k zs) (Suc i)) :#: 1 = snd (es ! i))\"\n    have *: \"execute M' (start_config k zs) (Suc i) =\n        squish G (length M) (execute M (start_config (Suc k) zs) (Suc i))\"\n      using assms cartesian_execute_start_config by blast\n    then have \"execute M' (start_config k zs) (Suc i) <#> 0 =\n        squish G (length M) (execute M (start_config (Suc k) zs) (Suc i)) <#> 0\"\n      by simp\n    also have \"... = execute M (start_config (Suc k) zs) (Suc i) <#> 0\"\n      using squish_head_pos assms execute_num_tapes start_config_length le_imp_less_Suc zero_less_Suc\n      by presburger\n    also have \"... = fst (es ! i)\"\n      using that assms trace_def by simp\n    finally have fst: \"execute M' (start_config k zs) (Suc i) <#> 0 = fst (es ! i)\" .\n\n    from * have \"execute M' (start_config k zs) (Suc i) <#> 1 =\n        squish G (length M) (execute M (start_config (Suc k) zs) (Suc i)) <#> 1\"\n      by simp\n    also have \"... = execute M (start_config (Suc k) zs) (Suc i) <#> 1\"\n      using squish_head_pos assms execute_num_tapes start_config_length le_imp_less_Suc zero_less_Suc\n      by presburger\n    also have \"... = snd (es ! i)\"\n      using that assms trace_def by simp\n    finally have \"execute M' (start_config k zs) (Suc i) <#> 1 = snd (es ! i)\" .\n    then show False\n      using fst a by simp\n  qed\nqed\n\nlemma cartesian_traces:\n  assumes \"turing_machine (Suc k) G M\"\n    and \"immobile M k (Suc k)\"\n    and \"M' = cartesian M G\"\n    and \"k \\<ge> 2\"\n    and \"\\<forall>i<length zs. zs ! i < G\"\n    and \"traces M (snd (start_config (Suc k) zs)) es tps\"\n  shows \"traces M' (snd (start_config k zs)) es (butlast tps)\"\nproof -\n  have \"trace M (start_config (Suc k) zs) es (length M, tps)\"\n    using assms(6) traces_def by (simp add: start_config_def)\n  then have \"trace M' (start_config k zs) es (squish G (length M) (length M, tps))\"\n    using assms cartesian_trace by simp\n  then show ?thesis\n    using squish traces_def by (simp add: assms(3) start_config_def length_cartesian)\nqed\n\nlemma traces_tapes_length:\n  assumes \"turing_machine k G M\"\n    and \"length tps = k\"\n    and \"traces M tps es tps'\"\n  shows \"length tps' = k\"\n  using assms traces_def execute_num_tapes by (metis snd_conv trace_def)\n\nlemma icartesian:\n  assumes \"turing_machine (k + 2) G M\"\n    and \"\\<And>j. j < k \\<Longrightarrow> immobile M (j + 2) (k + 2)\"\n    and \"\\<forall>i<length zs. zs ! i < G\"\n    and \"traces M (snd (start_config (k + 2) zs)) es tps\"\n  shows \"traces (icartesian k M G) (snd (start_config 2 zs)) es (take 2 tps)\"\n  using assms(1,2,4)\nproof (induction k arbitrary: M tps)\n  case 0\n  let ?M = \"icartesian 0 M G\"\n  have \"||start_config (0 + 2) zs|| = 2\"\n    using 0 start_config_length by simp\n  then have \"length tps = 2\"\n    using 0 traces_tapes_length by (metis One_nat_def Suc_1 add_2_eq_Suc')\n  then have \"tps = take 2 tps\"\n    by simp\n  then have \"traces ?M (snd (start_config 2 zs)) es (take 2 tps)\"\n   using 0 by (metis icartesian.simps(1) plus_nat.add_0)\n  then show ?case\n    by auto\nnext\n  case (Suc k)\n  let ?M = \"cartesian M G\"\n  have \"turing_machine (Suc (k + 2)) G M\"\n    using Suc by simp\n  moreover have \"immobile M (k + 2) (Suc (k + 2))\"\n    using Suc by simp\n  moreover have \"k + 2 \\<ge> 2\"\n    by simp\n  moreover have \"traces M (snd (start_config (Suc (k + 2)) zs)) es tps\"\n    using Suc by simp\n  ultimately have *: \"traces ?M (snd (start_config (k + 2) zs)) es (butlast tps)\"\n    using assms(3) cartesian_traces by simp\n\n  have \"turing_machine (k + 2) G ?M\"\n    using \\<open>2 \\<le> k + 2\\<close> \\<open>turing_machine (Suc (k + 2)) G M\\<close> cartesian_tm' by blast\n  moreover have \"\\<And>j. j < k \\<Longrightarrow> immobile ?M (j + 2) (k + 2)\"\n    using cartesian_immobile Suc by simp\n  ultimately have \"traces (icartesian k ?M G) (snd (start_config 2 zs)) es (take 2 (butlast tps))\"\n    using * Suc by simp\n  moreover have \"take 2 (butlast tps) = take 2 tps\"\n  proof -\n    have \"length tps = Suc k + 2\"\n      using start_config_length traces_tapes_length Suc\n      by (metis (mono_tags, lifting) add_gr_0 zero_less_Suc)\n    then show ?thesis\n      by (simp add: take_butlast)\n  qed\n  ultimately show ?case\n    by simp\nqed\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Cook_Levin/Oblivious.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073802837477, "lm_q2_score": 0.6039318337259583, "lm_q1q2_score": 0.3325293248378098}}
{"text": "(******************************************************************************\n * Orca: A Functional Correctness Verifier for Imperative Programs\n *       Based on Isabelle/UTP\n *\n * Copyright (c) 2016-2018 Virginia Tech, USA\n *               2016-2018 Technische Universität München, Germany\n *               2016-2018 University of York, UK\n *               2016-2018 Université Paris-Saclay, Univ. Paris-Sud, France\n *\n * This software may be distributed and modified according to the terms of\n * the GNU Lesser General Public License version 3.0 or any later version.\n * Note that NO WARRANTY is provided.\n *\n * See CONTRIBUTORS, LICENSE and CITATION files for details.\n ******************************************************************************)\n\ntheory utp_hoare_des\n\nimports \"../../utp/utp_rec_total_des\"\n\nbegin\nsection {*Hoare logic for designs*}  \nnamed_theorems hoare_des\n \n    \nsubsection {*Hoare triple definition*}\n\ndefinition hoare_d :: \"'\\<alpha> cond \\<Rightarrow> '\\<alpha> hrel_des \\<Rightarrow> '\\<alpha> cond \\<Rightarrow> bool\" (\"\\<lbrace>_\\<rbrace>_\\<lbrace>_\\<rbrace>\\<^sub>D\") where\n[upred_defs]:\"\\<lbrace>p\\<rbrace>Q\\<lbrace>r\\<rbrace>\\<^sub>D = ((p \\<turnstile>\\<^sub>n \\<lceil>r\\<rceil>\\<^sub>>) \\<sqsubseteq> Q)\"\n\nlemma assisgns_d_true_hoare_ndes[hoare_des]: \n  \"\\<lbrace>p\\<rbrace>\\<langle>\\<sigma>\\<rangle>\\<^sub>D\\<lbrace>true\\<rbrace>\\<^sub>D\"\n  by rel_auto\n\nlemma skip_d_true_hoare_ndes[hoare_des]: \n  \"\\<lbrace>p\\<rbrace>SKIP\\<^sub>D\\<lbrace>true\\<rbrace>\\<^sub>D\"\n  by rel_auto\n\nlemma false_hoare_ndes[hoare_des]: \n  \"\\<lbrace>false\\<rbrace>C\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  by rel_auto\n\nsubsection {*Precondition strengthening*}\n\nlemma pre_str_hoare_ndes[hoare_des]:\n  assumes \"`p\\<^sub>1 \\<Rightarrow> p\\<^sub>2`\" and \"\\<lbrace>p\\<^sub>2\\<rbrace>C\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  shows \"\\<lbrace>p\\<^sub>1\\<rbrace>C\\<lbrace>q\\<rbrace>\\<^sub>D\" \n  by (insert assms) rel_auto\n\nsubsection {*Post-condition weakening*}\n\nlemma post_weak_hoare_ndes[hoare_des]:\n  assumes \"\\<lbrace>p\\<rbrace>C\\<lbrace>q\\<^sub>2\\<rbrace>\\<^sub>D\" and \"`q\\<^sub>2 \\<Rightarrow> q\\<^sub>1`\"\n  shows \"\\<lbrace>p\\<rbrace>C\\<lbrace>q\\<^sub>1\\<rbrace>\\<^sub>D\" \n by (insert assms) rel_auto\n\nsubsection {*Consequence rule*}\n  \nlemma consequence_hoare_ndes[hoare_des]:\n  assumes I0': \"`p \\<Rightarrow> p'`\" \n  assumes induct_step:\"\\<lbrace>p'\\<rbrace> C \\<lbrace>q'\\<rbrace>\\<^sub>D\" \n  assumes I0 :\"`q' \\<Rightarrow> q`\"  \n  shows \"\\<lbrace>p\\<rbrace>C\\<lbrace>q\\<rbrace>\\<^sub>D\"\nproof(rule post_weak_hoare_ndes[OF _ I0], goal_cases)\n  case 1\n  then show ?case by (rule pre_str_hoare_ndes[OF I0' induct_step ]) \nqed   \n    \nsubsection {*Hoare and assertion logic*}\n\nlemma conj_hoare_ndes[hoare_des]: \n  assumes\"\\<lbrace>p\\<rbrace>C\\<lbrace>r\\<rbrace>\\<^sub>D\" and \"\\<lbrace>p\\<rbrace>C\\<lbrace>s\\<rbrace>\\<^sub>D\"\n  shows \"\\<lbrace>p\\<rbrace>C\\<lbrace>r \\<and> s\\<rbrace>\\<^sub>D\"\n  by (insert assms) rel_auto\n\nsubsection {*Hoare SKIP*}\n\nlemma skip_d_hoare_ndes[hoare_des]: \n  \"\\<lbrace>p\\<rbrace>SKIP\\<^sub>D\\<lbrace>p\\<rbrace>\\<^sub>D\"\n  by rel_auto\n    \nlemma skip_d_hoare_ndes_intro[hoare_des]: \n  \"`p \\<Rightarrow> q`\\<Longrightarrow>\\<lbrace>p\\<rbrace>SKIP\\<^sub>D\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  by rel_auto\n    \nsubsection {*Hoare for assignment*}\n\nlemma assigns_d_hoare_ndes [hoare_des]: \n  assumes\"`p \\<Rightarrow> \\<sigma> \\<dagger> q`\" \n  shows  \"\\<lbrace>p\\<rbrace>\\<langle>\\<sigma>\\<rangle>\\<^sub>D\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  by (insert assms) rel_auto\n\nlemma assigns_d_hoare_ndes'[hoare_des]: \n  \"\\<lbrace>\\<sigma> \\<dagger> p\\<rbrace>\\<langle>\\<sigma>\\<rangle>\\<^sub>D\\<lbrace>p\\<rbrace>\\<^sub>D\"\n  by rel_auto\n\nlemma assigns_d_floyd_ndes[hoare_des]:\n  assumes \"vwb_lens x\"\n  shows \\<open>\\<lbrace>p\\<rbrace>x :=\\<^sub>D e\\<lbrace>\\<^bold>\\<exists>v \\<bullet> p\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/x\\<rbrakk> \\<and> &x =\\<^sub>u e\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/x\\<rbrakk>\\<rbrace>\\<^sub>D\\<close>\n    using assms\n  apply rel_simp\n  apply transfer\n  apply (rule_tac x = \\<open>get\\<^bsub>x\\<^esub> more\\<close> in exI)\n  apply auto\n  done\n\nsubsection {*Hoare for Sequential Composition*}\n\nlemma seq_hoare_ndes[hoare_des]: \n  assumes\"\\<lbrace>p\\<rbrace>C\\<^sub>1\\<lbrace>s\\<rbrace>\\<^sub>D\" and \"\\<lbrace>s\\<rbrace>C\\<^sub>2\\<lbrace>r\\<rbrace>\\<^sub>D\" \n  shows\"\\<lbrace>p\\<rbrace>C\\<^sub>1 ;; C\\<^sub>2\\<lbrace>r\\<rbrace>\\<^sub>D\"\n  by (insert assms, rel_auto) metis+ \n\nsubsection {*Hoare for Conditional*}\n\nlemma cond_d_hoare_ndes[hoare_des]: \n  assumes \"\\<lbrace>b \\<and> p\\<rbrace>C\\<^sub>1\\<lbrace>q\\<rbrace>\\<^sub>D\" and \"\\<lbrace>\\<not>b \\<and> p\\<rbrace>C\\<^sub>2\\<lbrace>q\\<rbrace>\\<^sub>D\" \n  shows \"\\<lbrace>p\\<rbrace>C\\<^sub>1 \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>D\\<^sub>< \\<triangleright> C\\<^sub>2\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  by (insert assms, rel_auto) metis+ \n\nlemma if_d_hoare_ndes[hoare_des]: \n  assumes \"\\<lbrace>p\\<rbrace>\\<lceil>b\\<rceil>\\<^sub>D\\<^sub>< \\<and> C\\<^sub>1\\<lbrace>q\\<rbrace>\\<^sub>D\" and \"\\<lbrace>p\\<rbrace>\\<lceil>\\<not>b\\<rceil>\\<^sub>D\\<^sub>< \\<and> C\\<^sub>2\\<lbrace>q\\<rbrace>\\<^sub>D\" \n  shows \"\\<lbrace>p\\<rbrace>bif\\<^sub>D b then C\\<^sub>1 else C\\<^sub>2 eif \\<lbrace>q\\<rbrace>\\<^sub>D\"\n  by (insert assms, rel_auto) \n    \nlemma if_d_hoare_ndes'[hoare_des]:\n  assumes \\<open>\\<lbrace>b \\<and> p\\<rbrace>C\\<^sub>1\\<lbrace>q\\<rbrace>\\<^sub>D\\<close> and \\<open>\\<lbrace>\\<not>b \\<and> p\\<rbrace>C\\<^sub>2\\<lbrace>s\\<rbrace>\\<^sub>D\\<close>\n  shows \\<open>\\<lbrace>p\\<rbrace>bif\\<^sub>D b then C\\<^sub>1 else C\\<^sub>2 eif\\<lbrace>q \\<or> s\\<rbrace>\\<^sub>D\\<close>\n  by (insert assms, rel_auto) metis+\n    \nsubsection {*Hoare for recursion*}\n  \nlemma nu_des_hoare_ndes_partial[hoare_des]:\n  assumes induct_step:\n  \"\\<And> P. P is \\<^bold>H \\<Longrightarrow> \\<lbrace>p\\<rbrace>P\\<lbrace>q\\<rbrace>\\<^sub>D \\<Longrightarrow> \\<lbrace>p\\<rbrace>F P\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>\\<nu>\\<^sub>D F\\<lbrace>q\\<rbrace>\\<^sub>D\" \nproof -\n  have is_ndesign: \"\\<lceil>p\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r \\<lceil>q\\<rceil>\\<^sub>> is \\<^bold>H\"\n    using rdesign_is_H1_H2[of \"\\<lceil>p\\<rceil>\\<^sub><\" \"\\<lceil>q\\<rceil>\\<^sub>>\"]\n    by simp \n  also have fp_refine_spec:\"\\<lceil>p\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r \\<lceil>q\\<rceil>\\<^sub>> \\<sqsubseteq> F (\\<lceil>p\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r \\<lceil>q\\<rceil>\\<^sub>>)\"\n    by (rule induct_step[unfolded hoare_d_def ndesign_def, OF is_ndesign, simplified])\n  ultimately show ?thesis \n    unfolding hoare_d_def ndesign_def\n    by (rule design_theory_continuous.GFP_upperbound)\nqed  \n   \nlemma nu_ndes_hoare_ndes_partial[hoare_des]:\n  assumes induct_step:\n  \"\\<And> P. P is \\<^bold>N \\<Longrightarrow> \\<lbrace>p\\<rbrace>P\\<lbrace>q\\<rbrace>\\<^sub>D \\<Longrightarrow> \\<lbrace>p\\<rbrace>F P\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>\\<nu>\\<^sub>N F\\<lbrace>q\\<rbrace>\\<^sub>D\" \nproof -\n  have is_ndesign: \"p \\<turnstile>\\<^sub>n \\<lceil>q\\<rceil>\\<^sub>> is \\<^bold>N\"\n    using ndesign_H1_H3[of p \"\\<lceil>q\\<rceil>\\<^sub>>\"]\n    by simp \n  also have fp_refine_spec:\"p \\<turnstile>\\<^sub>n \\<lceil>q\\<rceil>\\<^sub>> \\<sqsubseteq> F (p \\<turnstile>\\<^sub>n \\<lceil>q\\<rceil>\\<^sub>>)\"\n    by (rule induct_step[unfolded hoare_d_def, OF is_ndesign, simplified]) \n  ultimately show ?thesis \n    unfolding hoare_d_def\n    by (rule normal_design_theory_continuous.GFP_upperbound)\nqed\n  \nlemma nu_ndes_hoare_ndes[hoare_des]:\n  assumes  H: \"F \\<in> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H\"\n  assumes WF: \"wf R\"\n  assumes  M: \"Mono\\<^bsub>uthy_order NDES\\<^esub> F\"  \n  assumes induct_step:\n    \"\\<And>st P. P is \\<^bold>N \\<Longrightarrow> \\<lbrace>p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>P\\<lbrace>q\\<rbrace>\\<^sub>D \\<Longrightarrow> \\<lbrace>p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>F P\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>\\<nu>\\<^sub>N F\\<lbrace>q\\<rbrace>\\<^sub>D\" \nproof -\n  { fix st \n    have \"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>n \\<lceil>q\\<rceil>\\<^sub>> \\<sqsubseteq> F ((p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>n \\<lceil>q\\<rceil>\\<^sub>>)\"\n      by (rule induct_step[unfolded hoare_d_def, \n                           OF ndesign_H1_H3[of \"(p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>)\" \"\\<lceil>q\\<rceil>\\<^sub>>\"] order_refl]) \n  }\n  then show ?thesis  \n    unfolding hoare_d_def \n    by (rule ndesign_nu_wf_refine_intro[OF WF M H, of _ e])\nqed  \n  \nlemma mu_ndes_hoare_ndes[hoare_des]:\n  assumes  H: \"F \\<in> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H\"\n  assumes WF: \"wf R\"\n  assumes  M: \"Mono\\<^bsub>uthy_order NDES\\<^esub> F\"  \n  assumes induct_step:\n    \"\\<And>st P. P is \\<^bold>N \\<Longrightarrow> \\<lbrace>(p \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>)\\<rbrace>P\\<lbrace>q\\<rbrace>\\<^sub>D \\<Longrightarrow> \\<lbrace>p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>F P\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>\\<mu>\\<^sub>N F\\<lbrace>q\\<rbrace>\\<^sub>D\" \nproof -\n  { fix st\n    have \"(p \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>) \\<turnstile>\\<^sub>n \\<lceil>q\\<rceil>\\<^sub>> \\<sqsubseteq> F ((p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>) \\<turnstile>\\<^sub>n \\<lceil>q\\<rceil>\\<^sub>>)\"\n      by (rule induct_step[unfolded hoare_d_def, \n                           OF ndesign_H1_H3[of \"(p \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>)\" \"\\<lceil>q\\<rceil>\\<^sub>>\"] order_refl]) \n  }\n  then show ?thesis  \n    unfolding hoare_d_def \n    by (rule ndesign_mu_wf_refine_intro[OF WF M H, of _ e])\nqed\n\n  \nsubsection {*Hoare for frames*}\n\nlemma antiframe_hoare_ndes[hoare_des]:\n  assumes \"vwb_lens a\"\n  assumes \"a \\<sharp> r\" \n  assumes \"a \\<natural> q\"    \n  assumes \"\\<lbrace>p\\<rbrace>P\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p \\<and> r\\<rbrace>antiframe\\<^sub>D a P\\<lbrace>q \\<and> r\\<rbrace>\\<^sub>D\"\n  using assms by (rel_simp)\n\nlemma antiframe_hoare_ndes_stronger[hoare_des]:\n  assumes \"vwb_lens a\"\n  assumes \"a \\<sharp> r\" \n  assumes \"a \\<natural> q\"    \n  assumes \"\\<lbrace>p \\<and> r\\<rbrace>P\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p \\<and> r\\<rbrace>antiframe\\<^sub>D a P\\<lbrace>q \\<and> r\\<rbrace>\\<^sub>D\"\n  using assms by (rel_simp)\n        \nlemma frame_hoare_ndes[hoare_des]:\n  assumes \"vwb_lens a\"\n  assumes \"a \\<natural> r\" \n  assumes \"a \\<sharp> q\"    \n  assumes \"\\<lbrace>p\\<rbrace>P\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p \\<and> r\\<rbrace>frame\\<^sub>D a P\\<lbrace>q \\<and> r\\<rbrace>\\<^sub>D\"\n  using assms by (rel_simp)  \n\nlemma frame_hoare_ndes_stronger[hoare_des]:\n  assumes \"vwb_lens a\"\n  assumes \"a \\<natural> r\" \n  assumes \"a \\<sharp> q\"    \n  assumes \"\\<lbrace>p \\<and> r\\<rbrace>P\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p \\<and> r\\<rbrace>frame\\<^sub>D a P\\<lbrace>q \\<and> r\\<rbrace>\\<^sub>D\"\n  using assms by (rel_simp) \n\nsubsection {*Hoare for from_until-loop*} \n(*Besides assumptions related to the healthiness conditions,\n  The order of the assumption forms the control flow of the iteration*)\nlemma from_until_gfp_hoare_ndes_minimal[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step:\"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sup>\\<top>\\<^sup>N init until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding  from_until_gfp_invr_ndes_def from_until_gfp_ndes_def  \nproof (rule seq_hoare_ndes [OF seq_step], goal_cases)\n  case 1\n  then show ?case\n  proof (rule nu_ndes_hoare_ndes [OF _ WF, where e = \"e\" and p= \"invar\"], goal_cases)\n    case 1\n    then show ?case by (rule stronger_if_d_seq_r_H1_H3_closed[OF BH skip_d_is_H1_H3]) \n  next\n    case 2\n    then show ?case by (rule mono_Monotone_utp_order [OF if_d_mono])\n  next\n    case (3 st P)\n    assume P_is_N: \"P is \\<^bold>N \" \n    assume P_is_wf:\"\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>\\<rbrace>P\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"  \n    show ?case\n    proof (rule cond_d_hoare_ndes, goal_cases)\n      case 1\n      then show ?case\n      proof (rule seq_hoare_ndes[of _ _ \"invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\"], goal_cases)\n        case 1\n        then show ?case using induct_step[of st] by assumption\n      next\n        case 2\n        then show ?case using P_is_wf by assumption \n      qed\n    next\n      case 2\n      then show ?case \n      proof (rule pre_str_hoare_ndes[of _ \"exit \\<and> invar\"], goal_cases)\n        case 1\n        then show ?case by pred_simp \n      next\n        case 2\n        then show ?case by (rule skip_d_hoare_ndes) \n      qed\n    qed\n  qed\nqed\n\nlemma from_until_gfp_invr_hoare_ndes_minimal[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step:\"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sup>\\<top>\\<^sup>N init invr invar until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding from_until_gfp_invr_ndes_def  \n  using from_until_gfp_hoare_ndes_minimal assms\n  by blast\n    \nlemma from_until_gfp_invr_vrt_hoare_ndes_minimal[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step:\"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sup>\\<top>\\<^sup>N init invr invar vrt \\<guillemotleft>R\\<guillemotright>until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding from_until_gfp_invr_vrt_ndes_def  \n  using from_until_gfp_hoare_ndes_minimal assms\n  by blast\n\nlemma from_until_lfp_hoare_ndes_minimal[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sub>\\<bottom>\\<^sub>N init until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding  from_until_lfp_invr_ndes_def from_until_lfp_ndes_def  \nproof (rule seq_hoare_ndes, rule seq_step, goal_cases)\n  case 1\n  then show ?case\n  proof (rule mu_ndes_hoare_ndes[OF _ WF, where e = \"e\" and p= \"invar\"], goal_cases)\n    case 1\n    then show ?case by (rule stronger_if_d_seq_r_H1_H3_closed[OF BH skip_d_is_H1_H3]) \n  next\n    case 2\n    then show ?case by (rule mono_Monotone_utp_order [OF if_d_mono]) \n  next\n    case (3 st P)\n    assume P_is_N: \"P is \\<^bold>N \" \n    assume P_is_wf:\"\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u \\<in>\\<^sub>u \\<guillemotleft>R\\<guillemotright>\\<rbrace>P\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"  \n    show ?case\n    proof (rule cond_d_hoare_ndes, goal_cases)\n      case 1\n      then show ?case\n      proof (rule seq_hoare_ndes[of _ _ \"invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\"], goal_cases)\n        case 1\n        then show ?case using induct_step[of st]  using pre_str_hoare_ndes by blast\n      next\n        case 2\n        then show ?case using P_is_wf by assumption \n      qed\n    next\n      case 2\n      then show ?case \n      proof (rule pre_str_hoare_ndes[of _ \"exit \\<and> invar\"], goal_cases)\n        case 1\n        then show ?case by pred_simp \n      next\n        case 2\n        then show ?case by (rule skip_d_hoare_ndes) \n      qed\n    qed\n  qed\nqed\n  \nlemma from_until_lfp_invr_hoare_ndes_minimal[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sub>\\<bottom>\\<^sub>N init invr invar until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding from_until_lfp_invr_ndes_def  \n  using from_until_lfp_hoare_ndes_minimal assms\n  by blast\n\nlemma from_until_lfp_invr_vrt_hoare_ndes_minimal[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sub>\\<bottom>\\<^sub>N init invr invar vrt \\<guillemotleft>R\\<guillemotright> until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding from_until_lfp_invr_vrt_ndes_def  \n  using from_until_lfp_hoare_ndes_minimal assms\n  by blast\n    \nlemma from_until_gfp_hoare_ndes_consequence[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace>init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI:\"`(exit \\<and> invar) \\<Rightarrow> q`\"  \n  assumes I0': \"\\<And> st. `\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"\n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"         \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sup>\\<top>\\<^sup>N init until exit do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  by (blast intro: consequence_hoare_ndes [of p,OF uimp_refl _ PHI]\n                   from_until_gfp_hoare_ndes_minimal[OF BH WF seq_step]\n                   consequence_hoare_ndes[OF I0' induct_step I0 ])\n                 \nlemma from_until_lfp_hoare_ndes_consequence[hoare_des]:  \n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`(exit \\<and> invar) \\<Rightarrow> q`\"    \n  assumes I0': \"\\<And> st. `\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\" \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"   \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sub>\\<bottom>\\<^sub>N init until exit do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  by (blast intro: consequence_hoare_ndes [of p,OF uimp_refl _ PHI ]\n                   from_until_lfp_hoare_ndes_minimal[OF BH WF seq_step ]\n                   consequence_hoare_ndes[OF I0' induct_step I0 ])  \n\nlemma from_until_gfp_hoare_ndes_sp[hoare_des]:  \n  assumes BH :\"body is H1\" \n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sup>\\<top>\\<^sup>N init until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  by (rule from_until_gfp_hoare_ndes_consequence [OF BH WF seq_step uimp_refl  uimp_refl induct_step I0])  \n                                  \nlemma from_until_lfp_hoare_ndes_sp[hoare_des]:  \n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sub>\\<bottom>\\<^sub>N init until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  by (rule from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step uimp_refl uimp_refl induct_step I0 ])  \n\nlemma from_until_gfp_invr_hoare_ndes_sp[hoare_des]:  \n  assumes BH :\"body is H1\" \n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sup>\\<top>\\<^sup>N init invr invar until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding from_until_gfp_invr_ndes_def \n  using from_until_gfp_hoare_ndes_sp[OF BH WF seq_step induct_step I0] .\n    \nlemma from_until_lfp_invr_hoare_ndes_sp[hoare_des]:  \n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sub>\\<bottom>\\<^sub>N init invr invar until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding from_until_lfp_invr_ndes_def \n  using from_until_lfp_hoare_ndes_sp[OF BH WF seq_step induct_step I0] .\n\nlemma from_until_gfp_invr_vrt_hoare_ndes_sp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sup>\\<top>\\<^sup>N init invr invar vrt \\<guillemotleft>R\\<guillemotright> until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding from_until_gfp_invr_vrt_ndes_def \n  using from_until_gfp_hoare_ndes_sp[OF BH WF seq_step induct_step I0] .\n    \nlemma from_until_lfp_invr_vrt_hoare_ndes_sp[hoare_des]:  \n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sub>\\<bottom>\\<^sub>N init invr invar vrt \\<guillemotleft>R\\<guillemotright> until exit do body od\\<lbrace>exit \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding from_until_lfp_invr_vrt_ndes_def \n  using from_until_lfp_hoare_ndes_sp[OF BH WF seq_step induct_step I0] .\n\nlemma from_until_gfp_hoare_ndes_wp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI:\"`(exit \\<and> invar) \\<Rightarrow> q`\"    \n  assumes I0': \"\\<And> st. `\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"   \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sup>\\<top>\\<^sup>N init until exit do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  by (rule from_until_gfp_hoare_ndes_consequence[OF BH WF seq_step PHI I0' induct_step uimp_refl])  \n    \nlemma from_until_lfp_hoare_ndes_wp[hoare_des]:  \n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"     \n  assumes PHI:\"`(exit \\<and> invar) \\<Rightarrow> q`\"      \n  assumes I0': \"\\<And> st. `\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and> (e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sub>\\<bottom>\\<^sub>N init until exit do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  by (rule from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step PHI I0' induct_step uimp_refl]) \n\nlemma from_until_gfp_invr_hoare_ndes_wp[hoare_des]:  \n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI:\"`(exit \\<and> invar) \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"   \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"      \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sup>\\<top>\\<^sup>N init invr invar until exit do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding from_until_gfp_invr_ndes_def     \n  using from_until_gfp_hoare_ndes_wp[OF BH WF seq_step PHI I0' induct_step] .\n    \nlemma from_until_lfp_invr_hoare_ndes_wp[hoare_des]:  \n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI:\"`(exit \\<and> invar) \\<Rightarrow> q`\"    \n  assumes I0': \"\\<And> st. `\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"    \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sub>\\<bottom>\\<^sub>N init invr invar until exit do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding from_until_lfp_invr_ndes_def \n  using from_until_lfp_hoare_ndes_wp[OF BH WF seq_step PHI I0' induct_step] . \n\nlemma from_until_gfp_invr_vrt_hoare_ndes_wp[hoare_des]:  \n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace> init \\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI:\"`(exit \\<and> invar) \\<Rightarrow> q`\"  \n  assumes I0': \"\\<And> st. `\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"    \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sup>\\<top>\\<^sup>N init invr invar vrt \\<guillemotleft>R\\<guillemotright>until exit do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding from_until_gfp_invr_vrt_ndes_def \n  using from_until_gfp_hoare_ndes_wp[OF BH WF seq_step  PHI I0' induct_step ] . \n     \nlemma from_until_lfp_invr_vrt_hoare_ndes_wp[hoare_des]:  \n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step:\"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI:\"`(exit \\<and> invar) \\<Rightarrow> q`\"    \n  assumes I0': \"\\<And> st. `\\<not>exit \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace>body\\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows \"\\<lbrace>p\\<rbrace>from\\<^sub>\\<bottom>\\<^sub>N init invr invar vrt \\<guillemotleft>R\\<guillemotright>until exit do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding from_until_lfp_invr_vrt_ndes_def \n  using from_until_lfp_hoare_ndes_wp[OF BH WF seq_step PHI I0' induct_step] . \n    \nsubsection {*Laws for while-loop*}  \n  \nlemma while_gfp_hoare_ndes_minimal[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes I0: \"`p\\<Rightarrow> invar`\"\n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b do body od\\<lbrace>\\<not> b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding while_gfp_ndes_def\n  by (simp add: from_until_gfp_hoare_ndes_minimal[OF BH WF, where e=e]\n                skip_d_hoare_ndes_intro[OF I0] induct_step)  \n\nlemma while_gfp_invr_hoare_ndes_minimal [hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes I0: \"`p\\<Rightarrow> invar`\"\n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b invr invar do body od\\<lbrace>\\<not> b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding while_gfp_invr_ndes_def  \n  using while_gfp_hoare_ndes_minimal assms\n  by blast\n\nlemma while_gfp_invr_vrt_hoare_ndes_minimal [hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes I0: \"`p\\<Rightarrow> invar`\"\n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>\\<not> b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding while_gfp_invr_vrt_ndes_def  \n  using while_gfp_hoare_ndes_minimal assms\n  by blast\n    \nlemma while_lfp_hoare_ndes_minimal [hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes I0: \"`p\\<Rightarrow> invar`\"\n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b do body od\\<lbrace>\\<not> b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding while_lfp_ndes_def\n  by (simp add: from_until_lfp_hoare_ndes_minimal[OF BH WF, where e=e]\n                skip_d_hoare_ndes_intro[OF I0] induct_step)  \n\nlemma while_lfp_invr_hoare_ndes_minimal [hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes I0: \"`p\\<Rightarrow> invar`\"\n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b invr invar do body od\\<lbrace>\\<not> b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding while_lfp_invr_ndes_def\n  using while_lfp_hoare_ndes_minimal assms\n  by blast  \n\nlemma while_lfp_invr_vrt_hoare_ndes_minimal [hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes I0: \"`p\\<Rightarrow> invar`\"\n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>\\<not> b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding while_lfp_invr_vrt_ndes_def\n  using while_lfp_hoare_ndes_minimal assms\n  by blast    \n\nlemma while_gfp_hoare_ndes_consequence[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding while_gfp_ndes_def\n  by (simp add: I0' \n      from_until_gfp_hoare_ndes_consequence[OF BH WF skip_d_hoare_ndes_intro[OF seq_step] \n                                               PHI _ induct_step I0])  \n\nlemma while_gfp_invr_hoare_ndes_consequence[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b invr invar do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding while_gfp_invr_ndes_def\n  by (rule while_gfp_hoare_ndes_consequence[OF BH WF seq_step PHI I0' induct_step I0])\n\nlemma while_gfp_invr_vrt_hoare_ndes_consequence[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b invr invar vrt \\<guillemotleft>R\\<guillemotright>do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding while_gfp_invr_vrt_ndes_def  \n  by (rule while_gfp_hoare_ndes_consequence[OF BH WF seq_step PHI I0' induct_step I0])\n  \nlemma while_lfp_hoare_ndes_consequence[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding while_lfp_ndes_def\n  by (simp add: I0' \n      from_until_lfp_hoare_ndes_consequence[OF BH WF skip_d_hoare_ndes_intro[OF seq_step] \n                                               PHI _ induct_step I0])  \n\nlemma while_lfp_invr_hoare_ndes_consequence[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b invr invar  do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding while_lfp_invr_ndes_def  \n  using while_lfp_hoare_ndes_consequence assms \n  by blast\n\nlemma while_lfp_invr_vrt_hoare_ndes_consequence[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding while_lfp_invr_vrt_ndes_def  \n  using while_lfp_hoare_ndes_consequence assms \n  by blast\n    \nlemma while_gfp_hoare_ndes_sp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  by (rule while_gfp_hoare_ndes_consequence [OF BH WF seq_step uimp_refl uimp_refl induct_step I0])  \n\nlemma while_gfp_invr_hoare_ndes_sp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b invr invar do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding while_gfp_invr_ndes_def  \n  by (rule while_gfp_hoare_ndes_consequence [OF BH WF seq_step uimp_refl uimp_refl induct_step I0])  \n\nlemma while_gfp_invr_vrt_hoare_ndes_sp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b invr invar vrt \\<guillemotleft>R\\<guillemotright>do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding while_gfp_invr_vrt_ndes_def  \n  by (rule while_gfp_hoare_ndes_consequence [OF BH WF seq_step uimp_refl uimp_refl induct_step I0])  \n      \nlemma while_lfp_hoare_ndes_sp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  by (rule while_lfp_hoare_ndes_consequence [OF BH WF seq_step uimp_refl uimp_refl induct_step I0])  \n    \nlemma while_lfp_invr_hoare_ndes_sp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace> body \\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b invr invar do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding while_lfp_invr_ndes_def  \n  by (rule while_lfp_hoare_ndes_consequence [OF BH WF seq_step uimp_refl uimp_refl induct_step I0]) \n    \nlemma while_lfp_invr_vrt_hoare_ndes_sp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0 :\"\\<And> st. `q' st  \\<Rightarrow> invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding while_lfp_invr_vrt_ndes_def  \n  by (rule while_lfp_hoare_ndes_consequence [OF BH WF seq_step uimp_refl uimp_refl induct_step I0])  \n\nlemma while_gfp_hoare_ndes_wp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  by (rule while_gfp_hoare_ndes_consequence[OF BH WF seq_step PHI I0' induct_step uimp_refl])\n\nlemma while_gfp_invr_hoare_ndes_wp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b invr invar do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  unfolding while_gfp_invr_ndes_def  \n  using while_gfp_hoare_ndes_wp assms\n  by blast  \n\nlemma while_gfp_invr_vrt_hoare_ndes_wp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows \"\\<lbrace>p\\<rbrace>while\\<^sup>\\<top>\\<^sup>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  unfolding while_gfp_invr_vrt_ndes_def  \n  using while_gfp_hoare_ndes_wp assms\n  by blast  \n    \nlemma while_lfp_hoare_ndes_wp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  by (rule while_lfp_hoare_ndes_consequence[OF BH WF seq_step PHI I0' induct_step uimp_refl])\n\nlemma while_lfp_invr_hoare_ndes_wp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b invr invar do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding while_lfp_invr_ndes_def  \n  using while_lfp_hoare_ndes_wp assms\n  by blast  \n\nlemma while_lfp_invr_vrt_hoare_ndes_wp[hoare_des]:\n  assumes BH :\"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"`p \\<Rightarrow> invar`\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"\n  assumes I0': \"\\<And> st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"      \n  assumes induct_step:\"\\<And> st. \\<lbrace>p' st\\<rbrace> body \\<lbrace>invar \\<and>(e,\\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows \"\\<lbrace>p\\<rbrace>while\\<^sub>\\<bottom>\\<^sub>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding while_lfp_invr_vrt_ndes_def  \n  using while_lfp_hoare_ndes_wp assms\n  by blast   \n    \nsubsection {*Hoare for do_while-loop*}   \n\n(*TODO: ADD LAWS FOR DO_WHILE*)\n\nlemma do_while_gfp_hoare_ndes_minimal[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright> \\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_ndes_def\n  by (simp add: from_until_gfp_hoare_ndes_minimal [OF BH WF seq_step, where e=e] induct_step)\n\nlemma do_while_lfp_hoare_ndes_minimal[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright> \\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_ndes_def\n  by (simp add: from_until_lfp_hoare_ndes_minimal [OF BH WF seq_step, where e=e] induct_step)\n\nlemma do_while_gfp_invr_hoare_ndes_minimal[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright> \\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b invr invar od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_invr_ndes_def\n  by (simp add: from_until_gfp_hoare_ndes_minimal [OF BH WF seq_step, where e=e] induct_step)\n\nlemma do_while_lfp_invr_hoare_ndes_minimal[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright> \\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b invr invar od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_invr_ndes_def\n  by (simp add: from_until_lfp_hoare_ndes_minimal [OF BH WF seq_step, where e=e] induct_step)\n    \nlemma do_while_gfp_invr_vrt_hoare_ndes_minimal[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright> \\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_invr_vrt_ndes_def\n  by (simp add: from_until_gfp_hoare_ndes_minimal [OF BH WF seq_step, where e=e] induct_step)\n\nlemma do_while_lfp_invr_vrt_hoare_ndes_minimal[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\" \n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright> \\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_invr_vrt_ndes_def\n  by (simp add: from_until_lfp_hoare_ndes_minimal [OF BH WF seq_step, where e=e] induct_step)\n    \nlemma do_while_gfp_hoare_ndes_consequence[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_ndes_def\n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step I0'])   \n\nlemma do_while_lfp_hoare_ndes_consequence[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_ndes_def\n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step I0'])   \n    \nlemma do_while_gfp_invr_hoare_ndes_consequence[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b invr invar od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_invr_ndes_def\n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step I0'])   \n\nlemma do_while_lfp_invr_hoare_ndes_consequence[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b invr invar od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_invr_ndes_def\n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step I0'])   \n\nlemma do_while_gfp_invr_vrt_hoare_ndes_consequence[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_invr_vrt_ndes_def\n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step I0'])   \n\nlemma do_while_lfp_invr_vrt_hoare_ndes_consequence[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_invr_vrt_ndes_def\n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step I0'])   \n\nlemma do_while_gfp_hoare_ndes_sp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"     \n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_ndes_def    \n  by (simp add: from_until_gfp_hoare_ndes_consequence[OF BH WF seq_step uimp_refl _ induct_step I0'])   \n    \nlemma do_while_lfp_hoare_ndes_sp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"     \n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_ndes_def    \n  by (simp add: from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step uimp_refl _ induct_step I0'])   \n    \nlemma do_while_gfp_invr_hoare_ndes_sp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"     \n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b invr invar od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_invr_ndes_def    \n  by (simp add: from_until_gfp_hoare_ndes_consequence[OF BH WF seq_step uimp_refl _ induct_step I0'])   \n    \nlemma do_while_lfp_invr_hoare_ndes_sp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"     \n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b invr invar od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_invr_ndes_def    \n  by (simp add: from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step uimp_refl _ induct_step I0'])   \n\nlemma do_while_gfp_invr_vrt_hoare_ndes_sp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"     \n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_invr_vrt_ndes_def    \n  by (simp add: from_until_gfp_hoare_ndes_consequence[OF BH WF seq_step uimp_refl _ induct_step I0'])   \n    \nlemma do_while_lfp_invr_vrt_hoare_ndes_sp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"     \n  assumes induct_step:\"\\<And>st.\\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0':\"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"  \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_invr_vrt_ndes_def    \n  by (simp add: from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step uimp_refl _ induct_step I0'])   \n\nlemma do_while_gfp_hoare_ndes_wp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_ndes_def\n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step uimp_refl])   \n    \nlemma do_while_lfp_hoare_ndes_wp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_ndes_def\n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step uimp_refl])   \n\nlemma do_while_gfp_invr_hoare_ndes_wp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b invr invar od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_invr_ndes_def\n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step uimp_refl])   \n    \nlemma do_while_lfp_invr_hoare_ndes_wp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b invr invar od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_invr_ndes_def\n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step uimp_refl])   \n     \nlemma do_while_gfp_invr_vrt_hoare_ndes_wp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sup>\\<top>\\<^sup>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_gfp_invr_vrt_ndes_def\n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step uimp_refl])   \n    \nlemma do_while_lfp_invr_vrt_hoare_ndes_wp[hoare_des]:\n  assumes BH: \"body is H1\"\n  assumes WF: \"wf R\"\n  assumes seq_step: \"\\<lbrace>p\\<rbrace>body\\<lbrace>invar\\<rbrace>\\<^sub>D\"\n  assumes PHI:\"`\\<not>b \\<and> invar \\<Rightarrow> q`\"   \n  assumes I0:\"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step:\"\\<And>st.\\<lbrace>p' st\\<rbrace>body\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"    \n  shows  \"\\<lbrace>p\\<rbrace>do body while\\<^sub>\\<bottom>\\<^sub>N b invr invar vrt \\<guillemotleft>R\\<guillemotright> od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding do_while_lfp_invr_vrt_ndes_def\n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence[OF BH WF seq_step PHI _ induct_step uimp_refl])   \n\nsubsection {*Hoare for for-loop*}   \n(*TODO: ADD LAWS FOR FOR_loops*)    \n\nlemma for_gfp_hoare_ndes_minimal:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr)do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_gfp_ndes_def  \n  by (simp add: from_until_gfp_hoare_ndes_minimal[OF seq_is_H1[OF BH INCRH] WF seq_step, where e=e] induct_step)  \n\nlemma for_lfp_hoare_ndes_minimal:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr)do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_lfp_ndes_def  \n  by (simp add: from_until_lfp_hoare_ndes_minimal[OF seq_is_H1[OF BH INCRH] WF seq_step, where e=e] induct_step)  \n    \nlemma for_gfp_invr_hoare_ndes_minimal:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr) invr invar do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_gfp_invr_ndes_def  \n  by (simp add: from_until_gfp_hoare_ndes_minimal[OF seq_is_H1[OF BH INCRH] WF seq_step, where e=e] induct_step)  \n\nlemma for_lfp_invr_hoare_ndes_minimal:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr) invr invar do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_lfp_invr_ndes_def  \n  by (simp add: from_until_lfp_hoare_ndes_minimal[OF seq_is_H1[OF BH INCRH] WF seq_step, where e=e] induct_step)  \n\nlemma for_gfp_invr_vrt_hoare_ndes_minimal:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr) invr invar vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_gfp_invr_vrt_ndes_def  \n  by (simp add: from_until_gfp_hoare_ndes_minimal[OF seq_is_H1[OF BH INCRH] WF seq_step, where e=e] induct_step)  \n\nlemma for_lfp_invr_vrt_hoare_ndes_minimal:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"  \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr) invr invar vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_lfp_invr_vrt_ndes_def  \n  by (simp add: from_until_lfp_hoare_ndes_minimal[OF seq_is_H1[OF BH INCRH] WF seq_step, where e=e] induct_step)  \n\nlemma for_gfp_hoare_ndes_consequence:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr)do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  unfolding for_gfp_ndes_def  \n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                             WF seq_step PHI _ induct_step I0'])\n\nlemma for_lfp_hoare_ndes_consequence:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr)do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  unfolding for_lfp_ndes_def  \n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                             WF seq_step PHI _ induct_step I0'])\n                                                         \nlemma for_gfp_invr_hoare_ndes_consequence:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr) invr invar do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  unfolding for_gfp_invr_ndes_def  \n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                             WF seq_step PHI _ induct_step I0'])\n\nlemma for_lfp_invr_hoare_ndes_consequence:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr) invr invar do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  unfolding for_lfp_invr_ndes_def  \n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                             WF seq_step PHI _ induct_step I0'])\n                                                         \nlemma for_gfp_invr_vrt_hoare_ndes_consequence:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr) invr invar vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  unfolding for_gfp_invr_vrt_ndes_def  \n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                             WF seq_step PHI _ induct_step I0'])\n\nlemma for_lfp_invr_vrt_hoare_ndes_consequence:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr) invr invar vrt \\<guillemotleft>R\\<guillemotright>do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"  \n  unfolding for_lfp_invr_vrt_ndes_def  \n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                             WF seq_step PHI _ induct_step I0'])\n\nlemma for_gfp_hoare_ndes_sp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"   \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr)do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_gfp_ndes_def  \n  by (simp add: from_until_gfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                          WF seq_step uimp_refl _ induct_step I0'])\n                                                         \nlemma for_lfp_hoare_ndes_sp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"   \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr)do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_lfp_ndes_def  \n  by (simp add: from_until_lfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                          WF seq_step uimp_refl _ induct_step I0'])\n   \nlemma for_gfp_invr_hoare_ndes_sp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"   \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr) invr invar do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_gfp_invr_ndes_def  \n  by (simp add: from_until_gfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                          WF seq_step uimp_refl _ induct_step I0'])\n\nlemma for_lfp_invr_hoare_ndes_sp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"   \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr) invr invar do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_lfp_invr_ndes_def  \n  by (simp add:  from_until_lfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                           WF seq_step uimp_refl _ induct_step I0'])\n\nlemma for_gfp_invr_vrt_hoare_ndes_sp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"   \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr) invr invar vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_gfp_invr_vrt_ndes_def  \n  by (simp add: from_until_gfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                          WF seq_step uimp_refl _ induct_step I0'])\n                                                         \nlemma for_lfp_invr_vrt_hoare_ndes_sp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"   \n  assumes induct_step: \"\\<And>st. \\<lbrace>b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright>\\<rbrace>body;; incr\\<lbrace>q' st\\<rbrace>\\<^sub>D\"  \n  assumes I0': \"\\<And>st. `q' st \\<Rightarrow> invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>`\"    \n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr) invr invar vrt \\<guillemotleft>R\\<guillemotright>do body od\\<lbrace>\\<not>b \\<and> invar\\<rbrace>\\<^sub>D\"  \n  unfolding for_lfp_invr_vrt_ndes_def  \n  by (simp add: from_until_lfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                           WF seq_step uimp_refl _ induct_step I0'])\n\nlemma for_gfp_hoare_ndes_wp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr)do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding for_gfp_ndes_def     \n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                           WF seq_step PHI  _ induct_step uimp_refl])\n   \nlemma for_lfp_hoare_ndes_wp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr)do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding for_lfp_ndes_def     \n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                           WF seq_step PHI  _ induct_step uimp_refl])\n\nlemma for_gfp_invr_hoare_ndes_wp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr) invr invar do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding for_gfp_invr_ndes_def     \n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                           WF seq_step PHI  _ induct_step uimp_refl])\n   \nlemma for_lfp_invr_hoare_ndes_wp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr) invr invar do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding for_lfp_invr_ndes_def     \n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                           WF seq_step PHI  _ induct_step uimp_refl])\n                                                       \nlemma for_gfp_invr_vrt_hoare_ndes_wp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sup>\\<top>\\<^sup>N (init, b, incr) invr invar vrt \\<guillemotleft>R\\<guillemotright>do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding for_gfp_invr_vrt_ndes_def     \n  by (simp add: I0 from_until_gfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                           WF seq_step PHI  _ induct_step uimp_refl])\n   \nlemma for_lfp_invr_vrt_hoare_ndes_wp:\n  assumes BH: \"body is H1\"\n  assumes INCRH: \"incr is H1\"\n  assumes WF: \"wf R\"  \n  assumes seq_step: \"\\<lbrace>p\\<rbrace>init\\<lbrace>invar\\<rbrace>\\<^sub>D\"  \n  assumes PHI: \"`\\<not>b \\<and> invar \\<Rightarrow> q`\"  \n  assumes I0: \"\\<And>st. `b \\<and> invar \\<and> e =\\<^sub>u \\<guillemotleft>st\\<guillemotright> \\<Rightarrow> p' st`\"  \n  assumes induct_step: \"\\<And>st. \\<lbrace>p' st\\<rbrace>body;; incr\\<lbrace>invar \\<and> (e, \\<guillemotleft>st\\<guillemotright>)\\<^sub>u\\<in>\\<^sub>u\\<guillemotleft>R\\<guillemotright>\\<rbrace>\\<^sub>D\"\n  shows  \"\\<lbrace>p\\<rbrace>for\\<^sub>\\<bottom>\\<^sub>N (init, b, incr) invr invar  vrt \\<guillemotleft>R\\<guillemotright> do body od\\<lbrace>q\\<rbrace>\\<^sub>D\"\n  unfolding for_lfp_invr_vrt_ndes_def     \n  by (simp add: I0 from_until_lfp_hoare_ndes_consequence [OF seq_is_H1[OF BH INCRH] \n                                                           WF seq_step PHI  _ induct_step uimp_refl])\n\nend\n\n", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP-Extended/HoareLogic/TotalCorrectness/utp_hoare_des.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318479832805, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.33252932378090333}}
{"text": "theory Bisimulation\n  imports Simulation\nbegin\n\ncontext env begin\n\nlemma mono_coinduct: \"\\<And>x y xa xb xc P Q \\<Psi>.\n                      x \\<le> y \\<Longrightarrow>\n                      (\\<Psi> \\<rhd> Q \\<leadsto>[{(xc, xb, xa). x xc xb xa}] P) \\<longrightarrow>\n                     (\\<Psi> \\<rhd> Q \\<leadsto>[{(xb, xa, xc). y xb xa xc}] P)\"\napply auto\napply(rule monotonic)\nby(auto dest: le_funE)\n\ncoinductive_set bisim :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\" \nwhere\n  step: \"\\<lbrakk>(insert_assertion (extract_frame P)) \\<Psi> \\<simeq>\\<^sub>F (insert_assertion (extract_frame Q) \\<Psi>);\n          \\<Psi> \\<rhd> P \\<leadsto>[bisim] Q;\n          \\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>',  P, Q) \\<in> bisim; (\\<Psi>, Q, P) \\<in> bisim\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, Q) \\<in> bisim\"\nmonos mono_coinduct\n\nabbreviation\n  bisim_judge (\"_ \\<rhd> _ \\<sim> _\" [70, 70, 70] 65) where \"\\<Psi> \\<rhd> P \\<sim> Q \\<equiv> (\\<Psi>, P, Q) \\<in> bisim\"\nabbreviation\n  bisim_nil_judge (\"_ \\<sim> _\" [70, 70] 65) where \"P \\<sim> Q \\<equiv> S_bottom' \\<rhd> P \\<sim> Q\"\n\nlemma bisim_coinduct_aux[consumes 1]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi> \\<and>\n                                    (\\<Psi> \\<rhd> P \\<leadsto>[(X \\<union> bisim)] Q) \\<and>\n                                    (\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X \\<or> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> bisim) \\<and>\n                                    ((\\<Psi>, Q, P) \\<in> X \\<or> (\\<Psi>, Q, P) \\<in> bisim)\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nproof -\n  have \"X \\<union> bisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> bisim}\" by auto\n  with assms show ?thesis\n    by coinduct simp\nqed\n\nlemma bisim_coinduct[consumes 1, case_names c_stat_eq c_sim c_ext c_sym]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame R) \\<Psi>' \\<simeq>\\<^sub>F insert_assertion (extract_frame S) \\<Psi>'\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> \\<Psi>' \\<rhd> R \\<leadsto>[(X \\<union> bisim)] S\"\n  and     \"\\<And>\\<Psi>' R S \\<Psi>''. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>' \\<otimes> \\<Psi>'', R, S) \\<in> X \\<or> (\\<Psi>' \\<otimes> \\<Psi>'', R, S) \\<in> bisim\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>', S, R) \\<in> X \\<or> (\\<Psi>', S, R) \\<in> bisim\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nproof -\n  have \"X \\<union> bisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> bisim}\" by auto\n  with assms show ?thesis\n    by coinduct simp\nqed\n\nlemma bisim_weak_coinduct_aux[consumes 1]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi> \\<and>\n                                     \\<Psi> \\<rhd> P \\<leadsto>[X] Q \\<and>\n                                    (\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X) \\<and> (\\<Psi>, Q, P) \\<in> X\" \n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nusing assms\nby(coinduct rule: bisim_coinduct_aux) (blast intro: monotonic)\n\nlemma bisim_weak_coinduct[consumes 1, case_names c_stat_eq c_sim c_ext c_sym]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[X] Q\"\n  and     \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi>, Q, P) \\<in> X\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nproof -\n  have \"X \\<union> bisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> bisim}\" by auto\n  with assms show ?thesis\n  by(coinduct rule: bisim_coinduct) (blast intro: monotonic)+\nqed\n\n(*lemma bisim_weak_coinduct[consumes 1, case_names c_stat_eq c_sim c_ext c_sym]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[X] Q\"\n  and     \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi>, Q, P) \\<in> X\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nproof -\n  have \"X \\<union> bisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> bisim}\" by auto\n  with assms show ?thesis\n  by(coinduct rule: bisim_coinduct) (blast intro: monotonic)+\nqed*)\n\nlemma bisimE:\n  fixes P  :: \"('a, 'b, 'c) psi\"\n  and   Q  :: \"('a, 'b, 'c) psi\"\n  and   \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n\n  assumes \"(\\<Psi>, P, Q) \\<in> bisim\"\n\n  shows \"insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n  and   \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] Q\"\n  and   \"(\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> bisim\"\n  and   \"(\\<Psi>, Q, P) \\<in> bisim\"\nusing assms\nby(auto simp add: intro: bisim.cases)\n\nlemma bisimI:\n  fixes P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   \\<Psi> :: 'b\n\n  assumes \"insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n  and     \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] Q\"\n  and     \"\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> bisim\"\n  and     \"(\\<Psi>, Q, P) \\<in> bisim\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nusing assms\nby(auto intro: bisim.step)\n\nlemma bisim_reflexive:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> P\"\nproof -\n  let ?X = \"{(\\<Psi>, P, P) | \\<Psi> P. True}\"\n  have \"(\\<Psi>, P, P) \\<in> ?X\" by simp\n  thus ?thesis\n    by(coinduct rule: bisim_weak_coinduct, auto intro: reflexive)\nqed\n\nlemma bisim_closed:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   p :: \"name prm\"\n  \n  assumes P_bisimQ: \"\\<Psi> \\<rhd> P \\<sim> Q\"\n\n  shows \"(p \\<bullet> \\<Psi>) \\<rhd>  (p \\<bullet> P) \\<sim> (p \\<bullet> Q)\"\nproof -\n  let ?X = \"{(p \\<bullet> \\<Psi>, p \\<bullet> P, p \\<bullet> Q) | (p::name prm) \\<Psi>  P Q. \\<Psi> \\<rhd> P \\<sim> Q}\"\n  from P_bisimQ have \"(p \\<bullet> \\<Psi>, p \\<bullet> P, p \\<bullet> Q) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: bisim_weak_coinduct)\n    case(c_stat_eq \\<Psi> P Q)\n    have \"\\<And>\\<Psi> P Q (p::name prm). insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi> \\<Longrightarrow>\n          insert_assertion (extract_frame(p \\<bullet> P)) (p \\<bullet> \\<Psi>) \\<simeq>\\<^sub>F insert_assertion (extract_frame(p \\<bullet> Q))  (p \\<bullet> \\<Psi>)\"\n      by(drule_tac p = p in Frame_stat_eq_closed) (simp add: eqvts)\n      \n    with `(\\<Psi>, P, Q) \\<in> ?X` show ?case by(blast dest: bisimE)\n  next\n    case(c_sim \\<Psi> P Q)\n    {\n      fix p :: \"name prm\"\n      fix \\<Psi> P Q\n      have \"eqvt ?X\"\n\tapply(auto simp add: eqvt_def)\n\tapply(rule_tac x=\"pa@p\" in exI)\n\tby(auto simp add: pt2[OF pt_name_inst])\n      moreover assume \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] Q\"\n      hence \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q\"\n\tapply(rule_tac A=bisim in monotonic, auto)\n\tby(rule_tac x=\"[]::name prm\" in exI) auto\n      ultimately have \"((p::name prm) \\<bullet> \\<Psi>) \\<rhd> (p \\<bullet> P) \\<leadsto>[?X] (p \\<bullet> Q)\"\n\tby(rule_tac sim_closed)\n    }\n    with `(\\<Psi>, P, Q) \\<in> ?X` show ?case\n      by(blast dest: bisimE)\n  next\n    case(c_ext \\<Psi> P Q \\<Psi>')\n    {\n      fix p :: \"name prm\"\n      fix \\<Psi> P Q \\<Psi>'\n      assume \"\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> bisim\"\n      hence \"((p \\<bullet> \\<Psi>) \\<otimes> \\<Psi>', p \\<bullet> P, p \\<bullet> Q) \\<in> ?X\"  \n\tapply(auto, rule_tac x=p in exI)\n\tapply(rule_tac x=\"\\<Psi> \\<otimes> (rev p \\<bullet> \\<Psi>')\" in exI)\n\tby(auto simp add: eqvts)\n    }\n    with `(\\<Psi>, P, Q) \\<in> ?X` show ?case\n      by(blast dest: bisimE)\n  next\n    case(c_sym \\<Psi> P Q)\n    thus ?case\n      by(blast dest: bisimE)\n  qed\nqed\n\nlemma bisim_eqvt[simp]:\n  shows \"eqvt bisim\"\nby(auto simp add: eqvt_def bisim_closed)\n\nlemma stat_eq_bisim:\n  fixes \\<Psi>  :: 'b\n  and   P  :: \"('a, 'b, 'c) psi\"\n  and   Q  :: \"('a, 'b, 'c) psi\"\n  and   \\<Psi>' :: 'b\n  \n  assumes \"\\<Psi> \\<rhd> P \\<sim> Q\"\n  and     \"\\<Psi> \\<simeq> \\<Psi>'\"\n\n  shows \"\\<Psi>' \\<rhd> P \\<sim> Q\"\nproof -\n  let ?X = \"{(\\<Psi>', P, Q) | \\<Psi> P Q \\<Psi>'. \\<Psi> \\<rhd> P \\<sim> Q \\<and> \\<Psi> \\<simeq> \\<Psi>'}\"\n  from `\\<Psi> \\<rhd> P \\<sim> Q` `\\<Psi> \\<simeq> \\<Psi>'` have \"(\\<Psi>', P, Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: bisim_coinduct)\n    case(c_stat_eq \\<Psi>' P Q)\n    from `(\\<Psi>', P, Q) \\<in> ?X` obtain \\<Psi> where \"\\<Psi> \\<rhd> P \\<sim> Q\" and \"\\<Psi> \\<simeq> \\<Psi>'\"\n      by auto\n    from `\\<Psi> \\<rhd> P \\<sim> Q` have PeqQ: \"insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n      by(rule bisimE)\n\n    obtain A\\<^sub>P \\<Psi>\\<^sub>P where FrP: \"extract_frame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>'\"\n      by(rule_tac C=\"(\\<Psi>, \\<Psi>')\" in fresh_frame) auto\n    obtain A\\<^sub>Q \\<Psi>\\<^sub>Q where FrQ: \"extract_frame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>'\"\n      by(rule_tac C=\"(\\<Psi>, \\<Psi>')\" in fresh_frame) auto\n\n    from PeqQ FrP FrQ `A\\<^sub>P \\<sharp>* \\<Psi>` `A\\<^sub>Q \\<sharp>* \\<Psi>` `\\<Psi> \\<simeq> \\<Psi>'`\n    have \"\\<langle>A\\<^sub>P, \\<Psi>' \\<otimes> \\<Psi>\\<^sub>P\\<rangle> \\<simeq>\\<^sub>F \\<langle>A\\<^sub>Q, \\<Psi>' \\<otimes> \\<Psi>\\<^sub>Q\\<rangle>\"\n      by simp (metis frame_int_composition Frame_stat_eq_trans Frame_stat_eq_sym)\n    with FrP FrQ `A\\<^sub>P \\<sharp>* \\<Psi>'` `A\\<^sub>Q \\<sharp>* \\<Psi>'` show ?case by simp\n  next\n    case(c_sim \\<Psi>' P Q)\n    from `(\\<Psi>', P, Q) \\<in> ?X` obtain \\<Psi> where \"\\<Psi> \\<rhd> P \\<sim> Q\" and \"\\<Psi> \\<simeq> \\<Psi>'\"\n      by auto\n    from `\\<Psi> \\<rhd> P \\<sim> Q` have \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] Q\" by(blast dest: bisimE)\n    moreover have \"eqvt ?X\"\n      by(auto simp add: eqvt_def) (metis bisim_closed Assertion_stat_eq_closed)\n    hence \"eqvt(?X \\<union> bisim)\" by auto\n    moreover note `\\<Psi> \\<simeq> \\<Psi>'`\n    moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. \\<lbrakk>\\<Psi> \\<rhd> P \\<sim> Q; \\<Psi> \\<simeq> \\<Psi>'\\<rbrakk> \\<Longrightarrow> (\\<Psi>', P, Q) \\<in> ?X \\<union> bisim\"\n      by auto\n    ultimately show ?case\n      by(rule stat_eq_sim)\n  next\n    case(c_ext \\<Psi>' P Q \\<Psi>'')\n    from `(\\<Psi>', P, Q) \\<in> ?X` obtain \\<Psi> where \"\\<Psi> \\<rhd> P \\<sim> Q\" and \"\\<Psi> \\<simeq> \\<Psi>'\"\n      by auto\n    from `\\<Psi> \\<rhd> P \\<sim> Q` have \"\\<Psi> \\<otimes> \\<Psi>'' \\<rhd> P \\<sim> Q\" by(rule bisimE)\n    moreover from `\\<Psi> \\<simeq> \\<Psi>'` have \"\\<Psi> \\<otimes> \\<Psi>'' \\<simeq> \\<Psi>' \\<otimes> \\<Psi>''\" by(rule Composition)\n    ultimately show ?case by blast\n  next\n    case(c_sym \\<Psi>' P Q)\n    from `(\\<Psi>', P, Q) \\<in> ?X` obtain \\<Psi> where \"\\<Psi> \\<rhd> P \\<sim> Q\" and \"\\<Psi> \\<simeq> \\<Psi>'\"\n      by auto\n    from `\\<Psi> \\<rhd> P \\<sim> Q` have \"\\<Psi> \\<rhd> Q \\<sim> P\" by(rule bisimE)\n    thus ?case using `\\<Psi> \\<simeq> \\<Psi>'` by auto\n  qed\nqed\n\nlemma bisim_transitive:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  assumes PQ: \"\\<Psi> \\<rhd> P \\<sim> Q\"\n  and     QR: \"\\<Psi> \\<rhd> Q \\<sim> R\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> R\"\nproof -\n  let ?X = \"{(\\<Psi>, P, R) | \\<Psi> P Q R. \\<Psi> \\<rhd> P \\<sim> Q \\<and> \\<Psi> \\<rhd> Q \\<sim> R}\" \n  from PQ QR have \"(\\<Psi>, P, R) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: bisim_coinduct)\n    case(c_stat_eq \\<Psi> P R)\n    thus ?case by(blast dest: bisimE Frame_stat_eq_trans)\n  next\n    case(c_sim \\<Psi> P R)\n    {\n      fix \\<Psi> P Q R\n      assume \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] Q\" and \"\\<Psi> \\<rhd> Q \\<leadsto>[bisim] R\"\n      moreover have \"eqvt ?X\"\n\tby(force simp add: eqvt_def dest: bisim_closed)\n      with bisim_eqvt have \"eqvt (?X \\<union> bisim)\" by blast\n      moreover have \"?X \\<subseteq> ?X \\<union> bisim\" by auto\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[(?X \\<union> bisim)] R\"\n\tby(force intro: transitive)\n    }\n    with `(\\<Psi>, P, R) \\<in> ?X` show ?case\n      by(blast dest: bisimE)\n  next\n    case(c_ext \\<Psi> P R \\<Psi>')\n    thus ?case by(blast dest: bisimE)\n  next\n    case(c_sym \\<Psi> P R)\n    thus ?case by(blast dest: bisimE)\n  qed\nqed\n\nlemma weak_transitive_coinduct[case_names c_stat_eq c_sim c_ext c_sym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and r_stat_eq: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n  and r_sim: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[({(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and>\n                                                                        (\\<Psi>, P', Q') \\<in> X \\<and>\n                                                                        \\<Psi> \\<rhd> Q' \\<sim> Q})] Q\"\n  and r_ext: \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X\"\n  and r_sym: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi>, Q, P) \\<in> X\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\nproof -\n  let ?X = \"{(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n  from p have \"(\\<Psi>, P, Q) \\<in> ?X\"\n    by(blast intro: bisim_reflexive)\n  thus ?thesis\n  proof(coinduct rule: bisim_weak_coinduct)\n    case(c_stat_eq \\<Psi> P Q)\n    thus ?case\n      by(blast dest: r_stat_eq bisimE Frame_stat_eq_trans)\n  next\n    case(c_sim \\<Psi> P Q)\n    {\n      fix \\<Psi> P P' Q' Q\n      assume \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] P'\"\n      moreover assume P'_rel_q': \"(\\<Psi>, P', Q') \\<in> X\"\n      hence \"\\<Psi> \\<rhd> P' \\<leadsto>[?X] Q'\" by(rule r_sim)\n      moreover from `eqvt X` P'_rel_q' have \"eqvt ?X\"\n\tapply(auto simp add: eqvt_def)\n\tapply(drule_tac p=p in bisim_closed)\n\tapply(drule_tac p=p in bisim_closed)\n\tapply(rule_tac x=\"p \\<bullet> P'a\" in exI, simp)\n\tby(rule_tac x=\"p \\<bullet> Q'a\" in exI, auto)\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q'\"\n\tby(force intro: transitive dest: bisim_transitive)\n      moreover assume \"\\<Psi> \\<rhd> Q' \\<leadsto>[bisim] Q\"\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q\" using `eqvt ?X`\n\tby(force intro: transitive dest: bisim_transitive)\n    }\n    with `(\\<Psi>, P, Q) \\<in> ?X` show ?case\n      by(blast dest: bisimE)\n  next\n    case(c_ext \\<Psi> P Q \\<Psi>')\n    thus ?case by(blast dest: bisimE intro: r_ext)\n  next\n    case(c_sym \\<Psi> P Q)\n    thus ?case by(blast dest: bisimE intro: r_sym)\n  qed\nqed\n\nlemma weak_transitive_coinduct'[case_names c_stat_eq c_sim c_ext c_sym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and r_stat_eq: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n  and r_sim: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[({(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and>\n                                                                        (\\<Psi>, P', Q') \\<in> X \\<and>\n                                                                        \\<Psi> \\<rhd> Q' \\<sim> Q})] Q\"\n  and r_ext: \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X\"\n  and r_sym: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow>\n                      (\\<Psi>, Q, P) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\nproof -\n  let ?X = \"{(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n  from p have \"(\\<Psi>, P, Q) \\<in> ?X\"\n    by(blast intro: bisim_reflexive)\n  thus ?thesis\n  proof(coinduct rule: bisim_weak_coinduct)\n    case(c_stat_eq \\<Psi> P Q)\n    thus ?case\n      by(blast dest: r_stat_eq bisimE Frame_stat_eq_trans)\n  next\n    case(c_sim \\<Psi> P Q)\n    {\n      fix \\<Psi> P P' Q' Q\n      assume \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] P'\"\n      moreover assume P'_rel_q': \"(\\<Psi>, P', Q') \\<in> X\"\n      hence \"\\<Psi> \\<rhd> P' \\<leadsto>[?X] Q'\" by(rule r_sim)\n      moreover from `eqvt X` P'_rel_q' have \"eqvt ?X\"\n\tapply(auto simp add: eqvt_def)\n\tapply(drule_tac p=p in bisim_closed)\n\tapply(drule_tac p=p in bisim_closed)\n\tapply(rule_tac x=\"p \\<bullet> P'a\" in exI, simp)\n\tby(rule_tac x=\"p \\<bullet> Q'a\" in exI, auto)\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q'\"\n\tby(force intro: transitive dest: bisim_transitive)\n      moreover assume \"\\<Psi> \\<rhd> Q' \\<leadsto>[bisim] Q\"\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q\" using `eqvt ?X`\n\tby(force intro: transitive dest: bisim_transitive)\n    }\n    with `(\\<Psi>, P, Q) \\<in> ?X` show ?case\n      by(blast dest: bisimE)\n  next\n    case(c_ext \\<Psi> P Q \\<Psi>')\n    thus ?case by(blast dest: bisimE intro: r_ext)\n  next\n    case(c_sym \\<Psi> P Q)\n    thus ?case\n      apply auto\n      apply(drule r_sym)\n      apply auto\n      by(metis bisim_transitive bisimE(4))\n  qed\nqed\n\nlemma weak_transitive_coinduct''[case_names c_stat_eq c_sim c_ext c_sym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and r_stat_eq: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n  and r_sim: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[({(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and>\n                                                                        (\\<Psi>, P', Q') \\<in> X \\<and>\n                                                                        \\<Psi> \\<rhd> Q' \\<sim> Q})] Q\"\n  and r_ext: \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q} \\<Longrightarrow> \n                         (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n  and r_sym: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q} \\<Longrightarrow> \n                      (\\<Psi>, Q, P) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\nproof -\n  let ?X = \"{(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n  from p have \"(\\<Psi>, P, Q) \\<in> ?X\"\n    by(blast intro: bisim_reflexive)\n  thus ?thesis\n  proof(coinduct rule: bisim_weak_coinduct)\n    case(c_stat_eq \\<Psi> P Q)\n    thus ?case\n      by(blast dest: r_stat_eq bisimE Frame_stat_eq_trans)\n  next\n    case(c_sim \\<Psi> P Q)\n    {\n      fix \\<Psi> P P' Q' Q\n      assume \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] P'\"\n      moreover assume P'_rel_q': \"(\\<Psi>, P', Q') \\<in> X\"\n      hence \"\\<Psi> \\<rhd> P' \\<leadsto>[?X] Q'\" by(rule r_sim)\n      moreover from `eqvt X` P'_rel_q' have \"eqvt ?X\"\n\tapply(auto simp add: eqvt_def)\n\tapply(drule_tac p=p in bisim_closed)\n\tapply(drule_tac p=p in bisim_closed)\n\tapply(rule_tac x=\"p \\<bullet> P'a\" in exI, simp)\n\tby(rule_tac x=\"p \\<bullet> Q'a\" in exI, auto)\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q'\"\n\tby(force intro: transitive dest: bisim_transitive)\n      moreover assume \"\\<Psi> \\<rhd> Q' \\<leadsto>[bisim] Q\"\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q\" using `eqvt ?X`\n\tby(force intro: transitive dest: bisim_transitive)\n    }\n    with `(\\<Psi>, P, Q) \\<in> ?X` show ?case\n      by(blast dest: bisimE)\n  next\n    case(c_ext \\<Psi> P Q \\<Psi>')\n    thus ?case by(rule_tac r_ext)\n  next\n    case(c_sym \\<Psi> P Q)\n    thus ?case by(rule_tac r_sym)\n  qed\nqed\n\nlemma transitive_coinduct[case_names c_stat_eq c_sim c_ext c_sym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and r_stat_eq: \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame R) \\<Psi>' \\<simeq>\\<^sub>F insert_assertion (extract_frame S) \\<Psi>'\"\n  and r_sim: \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> \\<Psi>' \\<rhd> R \\<leadsto>[({(\\<Psi>', R, S) | \\<Psi>' R R' S' S. \\<Psi>' \\<rhd> R \\<sim> R' \\<and>\n                                                                        ((\\<Psi>', R', S') \\<in> X \\<or> \\<Psi>' \\<rhd> R' \\<sim> S') \\<and>\n                                                                        \\<Psi>' \\<rhd> S' \\<sim> S})] S\"\n  and r_ext: \"\\<And>\\<Psi>' R S \\<Psi>''. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>' \\<otimes> \\<Psi>'', R, S) \\<in> X \\<or> \\<Psi>' \\<otimes> \\<Psi>'' \\<rhd> R \\<sim> S\"\n  and r_sym: \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>', S, R) \\<in> X \\<or> \\<Psi>' \\<rhd> S \\<sim> R\"\n\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\nproof -\n  from p have \"(\\<Psi>, P, Q) \\<in> (X \\<union> bisim)\"\n    by blast\n  moreover from `eqvt X` bisim_eqvt have \"eqvt (X \\<union> bisim)\"\n    by auto\n  ultimately show ?thesis\n  proof(coinduct rule: weak_transitive_coinduct')\n    case(c_stat_eq \\<Psi> P Q)\n    thus ?case\n      by(blast intro: r_stat_eq dest: bisimE)\n  next\n    case(c_sim \\<Psi> P Q)\n    thus ?case\n      apply auto\n      apply(blast intro: r_sim)\n      apply(drule bisimE(2))\n      apply(rule_tac A=bisim in monotonic, simp)\n      by(force intro: bisim_reflexive)\n  next\n    case(c_ext \\<Psi> P Q \\<Psi>')\n    thus ?case\n      by(blast dest: bisimE r_ext)\n  next\n    case(c_sym \\<Psi> P Q)\n    thus ?case by(blast dest: bisimE r_sym intro: bisim_reflexive)\n  qed\nqed\n\nlemma transitive_coinduct'[case_names c_stat_eq c_sim c_ext c_sym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and r_stat_eq: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n  and r_sim: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[({(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and>\n                                                                        (\\<Psi>, P', Q') \\<in> (X \\<union> bisim) \\<and>\n                                                                        \\<Psi> \\<rhd> Q' \\<sim> Q})] Q\"\n  and r_ext: \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X \\<or> \\<Psi> \\<otimes> \\<Psi>' \\<rhd> P \\<sim> Q\"\n  and r_sym: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow>\n                      (\\<Psi>, Q, P) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> ((\\<Psi>, P', Q') \\<in> (X \\<union> bisim)) \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\nproof -\n  from p have \"(\\<Psi>, P, Q) \\<in> (X \\<union> bisim)\"\n    by blast\n  moreover from `eqvt X` bisim_eqvt have \"eqvt (X \\<union> bisim)\"\n    by auto\n  ultimately show ?thesis\n  proof(coinduct rule: weak_transitive_coinduct')\n    case(c_stat_eq \\<Psi> P Q)\n    thus ?case\n      by(blast intro: r_stat_eq dest: bisimE)\n  next\n    case(c_sim \\<Psi> P Q)\n    thus ?case\n      apply -\n      apply(case_tac \"(\\<Psi>, P, Q) \\<in> X\")\n      apply(rule_tac r_sim)\n      apply simp\n      apply(clarify)\n      apply(drule bisimE(2))\n      apply(rule_tac A=bisim in monotonic, simp)\n      by(force intro: bisim_reflexive)\n  next\n    case(c_ext \\<Psi> P Q \\<Psi>')\n    thus ?case\n      by(blast dest: bisimE r_ext)\n  next\n    case(c_sym \\<Psi> P Q)\n    thus ?case\n      apply auto\n      apply(drule r_sym)\n      apply auto\n      apply(rule_tac x=Q in exI)\n      apply(auto intro: bisim_reflexive)\n      apply(rule_tac x=P in exI)\n      by(auto intro: bisim_reflexive dest: bisimE(4))\n  qed\nqed\n\nlemma bisim_symmetric:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<sim> Q\"\n  \n  shows \"\\<Psi> \\<rhd> Q \\<sim> P\"\nusing assms\nby(rule bisimE)\n\nlemma eqvt_trans[intro]:\n  assumes \"eqvt X\"\n\n  shows \"eqvt {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> ((\\<Psi>, P', Q') \\<in> X \\<or> \\<Psi> \\<rhd> P' \\<sim> Q') \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\nusing assms\napply(auto simp add: eqvt_def eqvts)\napply(erule_tac x=\"(a, P', Q')\" in ballE, auto)\nby(blast dest: bisim_closed)+\n\nlemma eqvt_weak_trans[intro]:\n  assumes \"eqvt X\"\n\n  shows \"eqvt {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\nusing assms\napply(auto simp add: eqvt_def eqvts)\napply(erule_tac x=\"(a, P', Q')\" in ballE, auto)\nby(blast dest: bisim_closed)+\n\nend\n\nend\n\n\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Bisimulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5506073655352403, "lm_q1q2_score": 0.3325293159307167}}
{"text": "theory flash93Bra  imports flash93Rev\n \n  begin\nlemma onInv93:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv93 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv93 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv93 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash93Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7461389930307512, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.33242695863988553}}
{"text": "theory Ex_Untyped\nimports Monad2\nbegin\n\n  typedecl global_state\n  typedecl val\n\n  datatype err = STATIC_ERROR\n\n  datatype label_name = LABEL_NAME string\n  datatype proc_name = PROC_NAME string\n  datatype lvar_name = LVAR_NAME string\n\n\n  datatype nt_instr =\n    BASIC (resvar: lvar_name) \"global_state \\<Rightarrow> (val\\<times>global_state)\"\n  | CALL (resvar: lvar_name) proc_name \"lvar_name list\"\n  hide_const (open) resvar\n\n  datatype t_instr =\n    RETURN lvar_name\n  | BR label_name\n  | CBR lvar_name label_name label_name\n\n  datatype basic_block = BBLOCK \"nt_instr list\" t_instr\n\n  datatype procedure = PROC\n    (params: \"lvar_name list\")\n    (prologue: basic_block)\n    (blocks: \"(label_name\\<times>basic_block) list\")\n  hide_const (open) params prologue blocks\n\n  datatype program = PROG (procedures: \"(proc_name \\<times> procedure) list\")\n  hide_const (open) procedures\n\n\n  locale program_loc =\n    fixes \\<pi> :: program\n  begin\n    definition \"proc_map \\<equiv> map_of (program.procedures \\<pi>)\"\n\n\n  end\n\n  locale procedure_loc = program_loc +\n    fixes p :: procedure\n  begin\n    definition \"block_map \\<equiv> map_of (procedure.blocks p)\"\n  end\n\n\nsection \\<open>Semantics\\<close>\n\naxiomatization val_to_bool :: \"val \\<Rightarrow> bool\"\n\ntype_synonym local_state = \"lvar_name \\<rightharpoonup> val\"\ndefinition fresh_local_state :: local_state where \"fresh_local_state \\<equiv> Map.empty\"\n\nlemma fresh_local_state_empty[simp]:\n  \"fresh_local_state x = None\"\n  \"dom fresh_local_state = {}\"\n  by (auto simp: fresh_local_state_def)\n\nlocale sem_program = program_loc +\n  fixes execute_proc :: \"proc_name \\<times> val list \\<Rightarrow> (val,unit,global_state,err) M\"\n\nlocale sem_procedure = sem_program + procedure_loc\n\n\n(* TODO: If we have lenses, use zoom fst\\<^sub>L here! *)\ndefinition define_lvar where\n  \"define_lvar name val \\<equiv> doM {\n    (l,g)\\<leftarrow>get;\n    fcheck STATIC_ERROR (name\\<notin>dom l);\n    let l = l(name\\<mapsto>val);\n    set (l,g)\n  }\"\n\ndefinition get_lvar where\n  \"get_lvar name \\<equiv> doM {\n    (l,g)\\<leftarrow>get;\n    lookup STATIC_ERROR l name\n  }\"\n\ndefinition \"zoom_global m \\<equiv> doM {\n  (l,_)\\<leftarrow>get;\n  mblock (snd) (Pair l) m\n}\"\n\n\nlemma zoom_global_alt: \"zoom_global m = zoom (lift_lens STATIC_ERROR snd\\<^sub>L) m\"\n  unfolding zoom_global_def zoom_def\n  apply (rule M_eqI)\n  by (auto simp: run_simps split: prod.splits mres.splits option.splits simp: mwp_def)\n\n\ndefinition \"noexcept m \\<equiv> handle m (\\<lambda>_. fail STATIC_ERROR)\"\n\nlemma noexcept_mono[partial_function_mono]: \"\\<And>x. M_mono (\\<lambda>f. noexcept (f x))\"\n  unfolding noexcept_def by pf_mono_prover\n\n\ncontext sem_procedure begin\n\n  definition execute_nt_instr :: \"nt_instr \\<Rightarrow> (unit,val,local_state\\<times>global_state,err) M\"\n    where \"execute_nt_instr \\<equiv> \\<lambda>\n      BASIC rvar f \\<Rightarrow> doM {\n        (l,g)\\<leftarrow>get;\n        let (r,g) = f g;\n        set (l,g);\n        define_lvar rvar r\n      }\n    | CALL rvar n args \\<Rightarrow> doM {\n        argvs \\<leftarrow> mmap get_lvar args;\n        r \\<leftarrow> zoom_global (noexcept (execute_proc (n,argvs)));\n        define_lvar rvar r\n      }\n    \"\n\n  definition execute_t_instr :: \"t_instr \\<Rightarrow> (label_name,val,local_state\\<times>global_state,err) M\"\n    where \"execute_t_instr \\<equiv> \\<lambda>\n      RETURN v \\<Rightarrow> doM { v\\<leftarrow>get_lvar v; raise v }\n    | BR label \\<Rightarrow> doM { return label }\n    | CBR cond iftrue iffalse \\<Rightarrow> doM { v\\<leftarrow>get_lvar cond; if val_to_bool v then return iftrue else return iffalse }\n    \"\n\n  definition \"execute_block \\<equiv> \\<lambda>BBLOCK ntis ti\\<Rightarrow> doM {\n    (* Execute nonterminal instructions *)\n    mfold' execute_nt_instr ntis;\n    (* Execute terminal instruction *)\n    execute_t_instr ti\n  }\"\n\n  definition \"execute_block_reset block \\<equiv> doM {\n    (* Save local definitions *)\n    (l,_)\\<leftarrow>get;\n    (* Execute block and obtain next label *)\n    label \\<leftarrow> execute_block block;\n    (* Restore local definitions after block execution *)\n    map_state (apfst (\\<lambda>_. l));\n\n    return label\n  }\"\n\n  definition \"execute args \\<equiv> doM {\n    fcheck STATIC_ERROR (length (procedure.params p) = length args);\n    mblock (Pair fresh_local_state) (snd) (doM {\n      (* Define Parameters*)\n      mfold' (uncurry define_lvar) (zip (procedure.params p) args);\n\n      handle (doM {\n        (* Execute Prologue *)\n        label \\<leftarrow> execute_block (procedure.prologue p);\n\n        (* Execute Blocks *)\n        mwhile (\\<lambda>_. return True) (\\<lambda>label. doM {\n          (* Lookup label *)\n          block \\<leftarrow> lookup STATIC_ERROR block_map label;\n          execute_block_reset block\n        }) label;\n\n        fail STATIC_ERROR (* Unreachable *)\n      }) (\\<lambda>r. return r)\n    })\n  }\"\n\nend\n\ncontext sem_program begin\n\n  term \"sem_procedure.execute execute_proc\"\n\n  definition execute_proc_body :: \"proc_name \\<times> val list \\<Rightarrow> (val, unit, global_state, err) M\"\n    where\n  \"execute_proc_body \\<equiv> \\<lambda>(name,args). doM {\n    proc \\<leftarrow> lookup STATIC_ERROR proc_map name;\n    sem_procedure.execute execute_proc proc args\n  }\"\n\nend\n\n\n\n\n\n\ncontext program_loc begin\n  term \"sem_program.execute_proc_body \\<pi>\"\n\n  definition \"execute_proc \\<equiv> REC (sem_program.execute_proc_body \\<pi>)\"\n\n  lemma proc_execute_mono[partial_function_mono]:\n    \"M_mono (\\<lambda>fa. sem_procedure.execute fa p args)\"\n  proof -\n    interpret sem_procedure \\<pi> f p for f .\n\n    show ?thesis\n      unfolding execute_def execute_block_def execute_block_reset_def execute_nt_instr_def zoom_global_def\n      by pf_mono_prover\n  qed\n\n\n  lemma execute_proc_body_mono[partial_function_mono]:\n    \"M.mono_body (\\<lambda>fa. sem_program.execute_proc_body \\<pi> fa x)\"\n    unfolding sem_program.execute_proc_body_def\n    by pf_mono_prover\n\n\n\n  lemmas execute_proc_unfold = REC_unfold[OF execute_proc_def, discharge_monos]\n     and execute_proc_partial = lrmwpe_REC_partial[OF execute_proc_def, discharge_monos, consumes 1, case_names nterm step]\n     and execute_proc_total = lrmwpe_REC_total[OF execute_proc_def, discharge_monos, consumes 1, case_names wf step]\n\nend\n\nterm program_loc.execute_proc\n\nlemma sim_zoom_global[sim_rules]: \"sim m m' \\<Longrightarrow> sim (zoom_global m) (zoom_global m')\"\n  by (auto simp: zoom_global_def intro!: sim_rules)\n\nlemma sim_noexcept[sim_rules]: \"sim m m' \\<Longrightarrow> sim (noexcept m) (noexcept m')\"\n  by (auto intro!: sim_rules simp: noexcept_def)\n\nlocale prog_sim = \\<pi>: program_loc \\<pi> + \\<pi>': program_loc \\<pi>' for \\<pi> \\<pi>' +\n  assumes proc_map_le: \"\\<pi>.proc_map \\<subseteq>\\<^sub>m \\<pi>'.proc_map\"\nbegin\n\n  lemmas execute_proc_sim_aux = sim_REC[OF \\<pi>.execute_proc_def \\<pi>'.execute_proc_def, discharge_monos]\n\n  lemma execute_block_sim[sim_rules]:\n    \"(\\<And>x. sim (f x) (f' x)) \\<Longrightarrow> sim (sem_procedure.execute_block f b) (sem_procedure.execute_block f' b)\"\n    by (auto\n      intro!: sim_rules\n      simp: sem_procedure.execute_block_def sem_procedure.execute_nt_instr_def\n      split: basic_block.splits nt_instr.splits)\n\n  lemma execute_proc_sim[sim_rules]:\n    shows \"sim (\\<pi>.execute_proc (p,args)) (\\<pi>'.execute_proc (p,args))\"\n    by (auto\n      intro!: sim_rules execute_proc_sim_aux\n      simp: sem_program.execute_proc_body_def sem_procedure.execute_def sem_procedure.execute_block_reset_def\n      simp: proc_map_le\n    )\n\nend\n\n\ncontext procedure_loc begin\n\n  definition \"wt_args args \\<equiv> fcheck () (length args = length (procedure.params p))\"\n\nend\n\ncontext program_loc begin\n\n  definition wt_execute_proc :: \"proc_name \\<times> unit list \\<Rightarrow> (unit, unit, unit, unit) M\"\n    where \"wt_execute_proc \\<equiv> \\<lambda>(n,args). doM {\n      p\\<leftarrow>lookup () proc_map n;\n      procedure_loc.wt_args p args\n    }\"\n\nend\n\ndefinition \"wt_define_lvar name = doM {\n  l\\<leftarrow>get;\n  fcheck () (name\\<notin>l);\n  let l = insert name l;\n  set l\n}\"\n\ndefinition wt_get_lvar where\n  \"wt_get_lvar name \\<equiv> doM {\n    l\\<leftarrow>get;\n    fcheck () (name\\<in>l)\n  }\"\n\n\nlemma lrmwp_define_lvar[THEN mwp_cons, intro!]:\n  assumes \"run (wt_define_lvar n) (dom l) = (SUCC () L')\"\n  shows \"mwp (run (define_lvar n v) (l, g)) bot bot bot (\\<lambda>_ (l',g'). g'=g \\<and> l'=l(n\\<mapsto>v) \\<and> L'=insert n (dom l))\"\n  using assms\n  by (auto\n    simp: run_simps define_lvar_def wt_define_lvar_def\n    split: if_splits\n    )\n\nlemma lrmwp_get_lvar[THEN mwp_cons, intro!]:\n  assumes \"run (wt_get_lvar n) (dom l) = SUCC () L'\"\n  shows \"mwp (run (get_lvar n) (l, g)) bot bot bot (\\<lambda>r lg'. lg'=(l,g) \\<and> L'=dom l \\<and> l n = Some r)\"\n  using assms\n  by (auto\n    simp: get_lvar_def wt_get_lvar_def run_simps\n    split: if_splits option.splits\n    )\n\ndefinition \"wt_zoom_global m \\<equiv> doM {\n  L\\<leftarrow>get;\n  mblock (\\<lambda>_. ()) (\\<lambda>_. L) m\n}\"\n\n\ncontext procedure_loc begin\n\n  abbreviation \"params \\<equiv> procedure.params p\"\n  abbreviation \"prologue \\<equiv> procedure.prologue p\"\n  abbreviation \"blocks \\<equiv> procedure.blocks p\"\n\n\n\n\n\n  fun wt_nt_instr where\n    \"wt_nt_instr (BASIC rvar f) = doM {\n      wt_define_lvar rvar\n    }\"\n  | \"wt_nt_instr (CALL rvar n args) = doM {\n      argvs \\<leftarrow> mmap wt_get_lvar args;\n      r \\<leftarrow> wt_zoom_global (wt_execute_proc (n,argvs));\n      wt_define_lvar rvar\n    }\"\n\n\n  fun wt_t_instr where\n    \"wt_t_instr (RETURN v) = doM { wt_get_lvar v}\"\n  | \"wt_t_instr (BR label) = doM { fcheck () (label\\<in>dom block_map) }\"\n  | \"wt_t_instr (CBR cond iftrue iffalse) = doM { wt_get_lvar cond; fcheck () ({iftrue,iffalse}\\<subseteq>dom block_map) }\"\n\n  fun wt_block where\n    \"wt_block (BBLOCK ntis ti) = doM {\n      mfold' wt_nt_instr ntis;\n      wt_t_instr ti\n    }\"\n\n  definition wt_blocks where\n    \"wt_blocks \\<equiv> doM {\n      l\\<leftarrow>get;\n\n      mmap (\\<lambda>(_,block). doM {\n        set l;\n        wt_block block\n      }) blocks;\n\n      return ()\n    }\"\n\n  definition wt_proc :: \"(unit,unit,unit,unit) M\" where \"wt_proc \\<equiv> doM {\n    fcheck () (distinct (map fst blocks));\n\n    mblock (\\<lambda>_. {}) (\\<lambda>_. ()) (doM {\n      mfold' wt_define_lvar params;\n\n      wt_block prologue;\n\n      wt_blocks;\n\n      return ()\n    })\n  }\"\n\nend\n\n\nlemma mwp_eq_splitE:\n  assumes \"mwp m N F E S = r\"\n  obtains \"m=NTERM\" \"N = r\"\n    | msg where \"m = FAIL msg\" \"F msg = r\"\n    | e s where \"m = EXC e s\" \"E e s = r\"\n    | x s where \"m = SUCC x s\" \"S x s = r\"\n  using assms apply (cases m) by auto\n\n\ncontext procedure_loc begin\n\n\n\n  lemma lrmwp_wt_define_args[THEN mwp_cons, intro!]:\n    fixes args :: \"'a list\"\n    assumes \"run (mfold' wt_define_lvar params) (dom l) = (SUCC () L')\"\n    assumes \"length args = length params\"\n    shows \"mwp (run (mfold' (uncurry define_lvar) (zip params args)) (l, g)) bot bot bot (\\<lambda>_ (l',g'). L'=dom l' \\<and> g'=g)\"\n  proof -\n    {\n      fix p and a :: \"'a list\"\n      assume\n          \"length a = length p\"\n      and \"run (mfold' wt_define_lvar p) (dom l) = (SUCC () L')\"\n      then have \"mwp (run (mfold' (uncurry define_lvar) (zip p a)) (l, g)) bot bot bot (\\<lambda>_ (l',g'). L'=dom l' \\<and> g'=g)\"\n        apply (induction a p arbitrary: l g L' rule: list_induct2)\n        apply (auto simp: run_simps elim!: mwp_eq_splitE)\n        done\n    }\n    with assms show ?thesis by auto\n  qed\n\nend\n\nlemma run_mmap_get_lvar[THEN mwp_cons]:\n  assumes \"run (mmap wt_get_lvar xs) (dom l) = (SUCC ys L')\"\n  shows \"mwp (run (mmap get_lvar xs) (l, g)) bot bot bot (\\<lambda>vs lg'. lg'=(l,g) \\<and> L'=dom l \\<and> length vs = length xs \\<and> length ys = length xs)\"\n  using assms\nproof (induction xs arbitrary: l g ys L')\n  case Nil\n  then show ?case by (auto simp: run_simps)\nnext\n  case (Cons a xs)\n  note IH = Cons.IH[THEN mwp_cons]\n  from Cons.prems show ?case\n    apply (auto simp: run_simps elim!: mwp_eq_splitE IH)\n    done\n\nqed\n\n\nlemma run_noexcept[run_simps]:\n  \"run (noexcept m) s = mwp (run m s) NTERM (\\<lambda>msg. FAIL msg) (\\<lambda>_ _. FAIL STATIC_ERROR) (\\<lambda>x s. SUCC x s)\"\n  by (auto simp: noexcept_def run_simps mwp_def split: mres.split)\n\n\nlemma run_mmap_length_eq:\n  assumes \"run (mmap f xs) s = SUCC ys s'\"\n  shows \"length ys = length xs\"\n  using assms apply (induction xs arbitrary: ys s)\n  by (auto simp: run_simps elim!: mwp_eq_splitE)\n\nlemma run_mmap_unit_state_idxD:\n  assumes \"run (mmap f xs) () = SUCC ys ()\"\n  assumes \"i<length xs\"\n  shows \"run (f (xs!i)) () = SUCC (ys!i) ()\"\n  using assms apply (induction xs arbitrary: i ys)\n  by (auto simp: run_simps nth_Cons split: nat.splits elim!: mwp_eq_splitE)\n\nlemma run_mmap_unit_state_elemD:\n  assumes \"run (mmap f xs) () = SUCC ys ()\"\n  assumes \"x\\<in>List.set xs\"\n  shows \"\\<exists>y\\<in>List.set ys. run (f x) () = SUCC y ()\"\n  using assms\n  by (auto simp: in_set_conv_nth Bex_def run_mmap_unit_state_idxD run_mmap_length_eq)\n\nlemma run_mmap_idxD:\n  assumes \"run (mmap f xs) s = SUCC ys s'\"\n  assumes \"i<length xs\"\n  shows \"\\<exists>s s'. run (f (xs!i)) s = SUCC (ys!i) s'\"\n  using assms apply (induction xs arbitrary: i ys s s')\n  by (auto 0 5 simp: run_simps nth_Cons split: nat.splits elim!: mwp_eq_splitE)\n\nlemma run_mmap_elemD:\n  assumes \"run (mmap f xs) s = SUCC ys s'\"\n  assumes \"x\\<in>List.set xs\"\n  shows \"\\<exists>s s'. \\<exists>y\\<in>List.set ys. run (f x) s = SUCC y s'\"\n  using assms\n  by (auto simp: in_set_conv_nth Bex_def run_mmap_length_eq dest!: run_mmap_idxD)\n\n\n(* TODO: Move *)\nlemma mwp_map_state[simp]:\n  \"mwp (map_mres_state f m) N F E S = mwp m N F (\\<lambda>e s. E e (f s)) (\\<lambda>x s. S x (f s))\"\n  by (cases m) auto\n\n\ncontext program_loc begin\n\n\n  definition \"wt_program \\<equiv> doM {\n    fcheck () (distinct (map fst (program.procedures \\<pi>)));\n    mmap (procedure_loc.wt_proc \\<pi> o snd) (program.procedures \\<pi>);\n    return ()\n  }\"\n\n\n\n\n  lemma\n    assumes \"(run (execute_proc (n,args)) s) = r\"\n    assumes \"run (wt_execute_proc (n,argTs)) () = (SUCC () ())\"\n    assumes \"length args = length argTs\"\n    assumes WTP: \"run wt_program () = (SUCC () ())\"\n    shows \"mwp r top bot bot top\"\n    using assms(1,2,3)\n  proof (induction \"(n,args)\" s r arbitrary: n args argTs rule: execute_proc_partial)\n    case (nterm x s)\n    then show ?case by simp\n  next\n    case (step execute_proc_rec s r)\n\n    note IH = step.hyps(1)[OF refl,THEN mwp_cons]\n\n\n    interpret sem_program \\<pi> execute_proc_rec .\n\n    obtain p where PMN: \"proc_map n = Some p\"\n      using step.prems unfolding wt_execute_proc_def\n      by (auto simp: run_simps split: option.splits)\n\n    interpret procedure_loc \\<pi> p .\n    interpret sem_procedure \\<pi> execute_proc_rec p .\n\n    from WTP PMN have WT_PROC: \"run wt_proc () = (SUCC () ())\"\n      by (auto simp: wt_program_def proc_map_def run_simps\n        split: if_splits\n        dest!: run_mmap_unit_state_elemD\n        elim!: mwp_eq_splitE)\n\n    note PMN[simp]\n\n    from step.prems have [simp]: \"length args = length params\"\n      by (auto simp: wt_execute_proc_def run_simps  wt_args_def split: if_splits)\n\n    have [THEN mwp_cons, elim!]:\n      \"mwp (run (execute_nt_instr i) (l, g)) top bot top (\\<lambda>_ (l',g'). L'=dom l')\"\n      if \"run (wt_nt_instr i) (dom l) = (SUCC () L')\"\n      for L' i l g\n      using that\n      by (fastforce\n        simp:  run_simps execute_nt_instr_def zoom_global_alt wt_zoom_global_def\n        elim!: IH mwp_eq_splitE run_mmap_get_lvar\n        split: nt_instr.splits prod.splits option.splits)\n\n\n    have [THEN mwp_cons, elim!]:\n      \"mwp (run (mfold' execute_nt_instr ins) (l, g)) top bot top (\\<lambda>_ (l',g'). L'=dom l')\"\n      if \"run (mfold' wt_nt_instr ins) (dom l) = (SUCC () L')\"\n      for L' ins l g\n      using that\n      apply (induction ins arbitrary: L' l g)\n      by (auto simp: run_simps elim!: mwp_eq_splitE)\n\n    have [THEN mwp_cons, elim!]:\n      \"mwp (run (execute_t_instr block) (l, g)) True bot top (\\<lambda>label (l', g'). L' = dom l' \\<and> label \\<in> dom block_map)\"\n      if \"run (wt_t_instr block) (dom l) = (SUCC () L')\"\n      for L' block l g\n      using that\n      by (auto\n        simp: execute_t_instr_def run_simps\n        elim!: mwp_eq_splitE\n        split: t_instr.splits if_splits\n      )\n\n\n    have [THEN mwp_cons, elim!]:\n      \"mwp (run (execute_block block) (l, g)) top bot top (\\<lambda>label (l',g'). L'=dom l' \\<and> label\\<in>dom block_map)\"\n      if \"run (wt_block block) (dom l) = (SUCC () L')\"\n      for L' l g block\n      using that\n      by (auto\n        simp: execute_block_def run_simps\n        elim!: mwp_eq_splitE\n        split: basic_block.splits)\n\n    (*\n    note EB_WRULE = lrmwpe_mwhile[where\n          I=\"\\<lambda>label (l,g). l=l\\<^sub>0 \\<and> label \\<in> dom block_map\"\n      and s=\"(l\\<^sub>0,g\\<^sub>0)\" for l\\<^sub>0 g\\<^sub>0\n    ]*)\n\n    have [THEN mwp_cons, intro!]:\n      \"mwp (run (execute_block_reset block) (l, g)) top bot top (\\<lambda>label (l',g'). l'=l \\<and> label\\<in>dom block_map)\"\n      if \"run wt_blocks (dom l) = (SUCC () L')\"\n      and \"block_map label = Some block\"\n      for l block g label L'\n    proof -\n      from that(2) have \"(label,block)\\<in>list.set blocks\"\n        by (auto simp: block_map_def map_of_SomeD)\n      with that(1) obtain L'' where \"run (wt_block block) (dom l) = (SUCC () L'')\"\n        by (auto\n          simp: wt_blocks_def run_simps\n          split!: prod.splits\n          elim!: mwp_eq_splitE\n          dest!: run_mmap_elemD)\n      with that(1) show ?thesis\n        unfolding execute_block_reset_def\n        by (auto elim!: simp: run_simps map_state_def)\n\n    qed\n\n    note EB_WRULE = mwhile_invar_rule[where\n          I=\"\\<lambda>label (l,g). l=l\\<^sub>0 \\<and> label \\<in> dom block_map\"\n      and s=\"(l\\<^sub>0,g\\<^sub>0)\" for l\\<^sub>0 g\\<^sub>0]\n\n    note EB_WRULE = EB_WRULE[OF refl, where P=\"\\<lambda>r. mwp r N F E S\"  for N F E S, simplified]\n\n    have \"mwp (run (execute args) s) top bot bot top\"\n      using WT_PROC\n      apply (auto\n        simp: execute_def wt_proc_def run_simps\n        split: if_splits prod.splits\n        elim!: mwp_eq_splitE\n        intro!: EB_WRULE\n        )\n      by simp_all\n\n    with step.hyps(2) show ?case\n      by (auto simp: execute_proc_body_def run_simps)\n\n  qed\n\n\nend\n\nend\n\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/others/simple/Ex_Untyped.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.685949467848392, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.3322602610461567}}
{"text": "\\<^marker>\\<open>creator \"Maximilian P. L. Haslbeck\"\\<close>\nchapter \\<open>Quantitative Separation Logic for other domains\\<close>\ntheory QSL_For_Experimental_Domains\nimports Quantitative_Separation_Connectives \"NREST.NREST\"\n begin\n\n\nparagraph \\<open>Summary\\<close>                 \n\ntext \\<open>This experimental theory tries to instantiate the quantitative separation logic\n      with (enat option,>=,+,-).\n\n      Apparently the theory still fails, maybe this domain is not really quantale?\n    \\<close>\n\n\n term mm2\n\nfun eo_plus :: \"enat option \\<Rightarrow> enat option \\<Rightarrow> enat option\" where\n  \"eo_plus None _ = None\"\n| \"eo_plus _ None = None\"\n| \"eo_plus (Some a) (Some b) = Some (a+b)\"\n\nlemma eo_plus_comm: \"eo_plus a b = eo_plus b a\"\n  apply(cases a; cases b) apply auto done\n\nlemma \"mm2 (Some (a+enat b)) (Some (enat b)) = Some a\"\n  unfolding mm2_def \n  apply simp  \n  by (metis add.commute add_diff_cancel_enat enat.distinct(2))\n\nlemma \"(a<\\<infinity>\\<or>b<\\<infinity>) \\<Longrightarrow>\n  mm2 (Some (a+b)) (Some (b)) = Some a\"\n  unfolding mm2_def \n  apply simp   \n  oops\n\n\n\nlemma GC: \"(A \\<le> mm2 B C) \\<longleftrightarrow> eo_plus C A \\<le> B\"\n  apply(cases C)\n  subgoal unfolding mm2_def  by simp\n  subgoal for c apply(cases c)\n    subgoal unfolding mm2_def apply simp\n      apply(cases A; cases B) apply auto\n      subgoal  \n        using le_less_trans by fastforce  \n      subgoal  \n        by (simp add: enat_plus_minus_aux2)  \n      subgoal  \n        by (simp add: enat_plus_minus_aux1)  \n      done\n    subgoal unfolding mm2_def\n      apply(cases A) apply simp apply simp\n      apply(cases B) apply simp apply simp done\n    done\n  done \n\nlemma f_GC_antimono:\n  fixes x y :: \"(enat option)\"\n    and f :: \"_ \\<Rightarrow> _ \\<Rightarrow> (enat option)\"\n  assumes GC: \"(\\<And>A B C. (A \\<le> f B C) = (g C A \\<le> B))\"\n     and *: \"x \\<le> y\"\n   shows \"f q x \\<ge> f q y\"\n  oops  \n\nlemma f_GC_mono:\n  fixes x y :: \"('b::{order})\"\n    and f :: \"_ \\<Rightarrow> _ \\<Rightarrow> ('a::{order})\"\n  assumes GC: \"(\\<And>A B C. (A \\<le> f B C) = (g C A \\<le> B))\"\n     and *: \"x \\<le> y\"\n  shows \"f x q \\<le> f y q\"\n  apply(subst GC)\n  apply(rule order.trans) \n   apply(subst GC[symmetric])\n   defer apply (rule *)  by simp  \n\n \n\n\nlemma mm2_mono: \" x \\<le> y \\<Longrightarrow> mm2 x q \\<le> mm2 y q\"\n  using GC\n      by (metis order.trans order_mono_setup.refl) \n\nlemma mm2_mono_miraculous: \"x \\<le> y \\<Longrightarrow> mm2 x q \\<le> mm2 y q\"\n  apply(subst GC)\n  apply(rule order.trans) \n   apply(subst GC[symmetric])\n  defer apply simp by simp \n\n\n\nlemma mm2_mono': \"x \\<le> y \\<Longrightarrow> mm2 x q \\<le> mm2 y q\"\n  unfolding mm2_def apply(cases q) apply (auto split: option.splits)\n  using le_some_optE apply blast apply(rule helper) by auto\n \n\n\n\nlemma mm_continous: \"mm (\\<lambda>x. Inf {u. \\<exists>y. u = f y x}) m x = Inf {u. \\<exists>y. u = mm (f y) m x}\" \n  apply(rule antisym)\n  subgoal apply(rule Inf_greatest) apply clarsimp\n  proof (cases \"Inf {u. \\<exists>y. u = f y x}\")\n    case None\n    have f: \"m x \\<noteq> None \\<Longrightarrow> mm (\\<lambda>x. Inf {u. \\<exists>y. u = f y x}) m x = None\" unfolding mm_def None apply(cases \"m x\") by (auto ) \n    then show \"\\<And>y. mm (\\<lambda>x. Inf {u. \\<exists>y. u = f y x}) m x \\<le> mm (f y) m x\"\n      apply(cases \"m x\") apply(auto simp: f) unfolding mm_def by auto\n  next\n    case (Some l)\n    then show \"\\<And>y. mm (\\<lambda>x. Inf {u. \\<exists>y. u = f y x}) m x \\<le> mm (f y) m x\"\n      apply(cases \"m x\") subgoal unfolding mm_def by auto\n    proof -\n      fix y a assume I: \"Inf {u. \\<exists>y. u = f y x} = Some l\" \" m x = Some a\"\n      from I have i: \"\\<And>y. f y x \\<ge> Some l\"\n        by (metis (mono_tags, lifting) Inf_lower mem_Collect_eq) \n      show \"mm (\\<lambda>x. Inf {u. \\<exists>y. u = f y x}) m x \\<le> mm (f y) m x\"\n        apply(rule mm_mono) unfolding I apply(rule i) .\n    qed \n  qed\n  subgoal   apply(rule Inf_lower) apply clarsimp \n  proof -\n    have \"\\<exists>y. Inf {u. \\<exists>y. u = f y x} = f y x\"\n      unfolding Inf_option_def apply auto unfolding Inf_enat_def apply auto\n      apply (metis (mono_tags) empty_iff in_these_eq mem_Collect_eq option.exhaust)\n      by (smt LeastI in_these_eq mem_Collect_eq)\n    then obtain y where z: \"Inf {u. \\<exists>y. u = f y x} = f y x\" by blast\n    show \"\\<exists>y. mm (\\<lambda>x. Inf {u. \\<exists>y. u = f y x}) m x = mm (f y) m x\"\n      apply(rule exI[where x=y]) unfolding mm_def z ..\n  qed\n  done\n\n\n\nlemma enat_plus_Sup_distrib:\n  \"A\\<noteq>{} \\<Longrightarrow> (a::enat) + Sup A = Sup ((+) a ` A)\"\n  apply(cases a)\n  subgoal \n  unfolding Sup_enat_def apply auto\n   apply (metis Max.hom_commute empty_iff enat_add_left_cancel_le max_def plus_enat_simps(2))\n  apply(subst (asm) finite_image_iff)\n  subgoal unfolding inj_on_def by auto\n  subgoal apply simp done\n  done\n  subgoal by simp\n  done\n\n\nlemma eo_plus_Sup_distrib:\n  \"eo_plus (c::enat option) (Sup A) = Sup (eo_plus c ` A)\"\nproof (cases c)\n  case None\n  then show ?thesis apply auto  \n    by (metis SUP_bot_conv(2) Sup_empty empty_Sup) \nnext\n  case (Some a)\n  then show ?thesis\n  proof (cases \"A = {} \\<or> A = {None} \")\n    case True\n    then show ?thesis \n      unfolding Sup_option_def  apply(cases c) by auto\n  next\n    case False\n    then have *: \"A\\<noteq>{}\" \"A \\<noteq> {None}\" by auto\n    have 2: \"A\\<subseteq>UNIV\" by auto \n    have 3: \"\\<exists>x. Some x \\<in> A\"\n      using *  2 unfolding UNIV_option_conv by blast\n    then have \"\\<exists>x. Some x \\<in> eo_plus c ` A\"\n      using Some apply auto\n      subgoal for x apply(rule exI[where x=\"a+x\"])\n        apply(rule image_eqI[where x=\"Some x\"]) by auto\n      done\n    then have nn: \"eo_plus c ` A \\<noteq> {None}\" by auto\n    from * have ne: \"eo_plus c ` A \\<noteq> {}\" by simp\n    from 3 have \"Option.these A \\<noteq>{}\"\n      unfolding Option.these_def by auto\n\n    have k: \"Option.these (eo_plus (Some a) ` A)\n            = ((+) a) ` (Option.these A)\"\n      apply rule \n      subgoal apply rule\n        subgoal   for x\n          unfolding Option.these_def apply clarsimp\n          subgoal for xa\n            apply(cases xa)\n             apply simp \n            subgoal for v\n              apply(rule image_eqI[where x=v]) apply simp\n              apply(rule image_eqI[where x=\"Some v\"]) by auto\n            done\n          done\n        done\n      subgoal apply rule\n        subgoal   for x\n          unfolding Option.these_def\n          apply clarsimp\n          subgoal for v  \n            apply(rule image_eqI[where x=\"eo_plus (Some a) (Some v)\"])\n             apply simp\n            by force \n          done\n        done\n      done \n\n    show ?thesis\n      unfolding Sup_option_def \n      using * nn ne Some apply simp \n      unfolding k\n      by (simp add: \\<open>Option.these A \\<noteq> {}\\<close> enat_plus_Sup_distrib)\n  qed\nqed\n\n\n\nlemma mm2_continous: \"mm2 (Inf A) m = Inf ((\\<lambda>x. mm2 x m) ` A)\"\n  using eo_plus_Sup_distrib GC \n  using dual_order.trans order_mono_setup.refl\n  sorry\n\n\ninterpretation ENOPT_PLUS:\n quant_sep_con_one Inf Sup inf \"(\\<le>)\" \"(<)\" sup top bot \"eo_plus\" \"mm2\" \"(Some 0)::(enat option)\" \n  unfolding quant_sep_con_def quant_sep_con_one_def comm_quantale_def apply safe\n  subgoal by standard\n  subgoal apply standard\n    subgoal for a b c by (cases a; cases b; cases c) auto\n    subgoal for a b by (cases a; cases b) auto\n    subgoal for a apply(cases a) by auto  \n    done\n  subgoal apply standard\n    apply(subst eo_plus_Sup_distrib) by simp\n  subgoal apply standard\n    subgoal by auto\n    subgoal  by(simp add: mm2_mono)\n    subgoal by (simp add: mm2_antimono)  \n    subgoal apply(subst GC)  apply(subst eo_plus_comm) ..\n    subgoal unfolding bot_option_def by simp  \n    done\n  subgoal apply standard apply (auto simp: bot_option_def top_option_def top_enat_def)\n    oops\n\n\nend", "meta": {"author": "maxhaslbeck", "repo": "QuantSepCon", "sha": "9e3bef4589d5c4bde52bc95fff52b73268bb9761", "save_path": "github-repos/isabelle/maxhaslbeck-QuantSepCon", "path": "github-repos/isabelle/maxhaslbeck-QuantSepCon/QuantSepCon-9e3bef4589d5c4bde52bc95fff52b73268bb9761/QSL_For_Experimental_Domains.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494550081925, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.33226025482661975}}
{"text": "(* \n   Title: Psi-calculi   \n   Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Bisim_Struct_Cong\n  imports Bisim_Pres Sim_Struct_Cong Structural_Congruence\nbegin\n\ncontext env begin\n\nlemma bisimParComm:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  \n  shows \"\\<Psi> \\<rhd> P \\<parallel> Q \\<sim> Q \\<parallel> P\"\nproof -\n  let ?X = \"{((\\<Psi>::'b), \\<lparr>\\<nu>*xvec\\<rparr>((P::('a, 'b, 'c) psi) \\<parallel> Q), \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> P)) | xvec \\<Psi> P Q. xvec \\<sharp>* \\<Psi>}\"\n  \n  have \"eqvt ?X\"\n    by(force simp add: eqvt_def pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst] eqvts)\n\n  have \"(\\<Psi>, P \\<parallel> Q, Q \\<parallel> P) \\<in> ?X\"\n    apply auto by(rule_tac x=\"[]\" in exI) auto\n  thus ?thesis\n  proof(coinduct rule: bisimWeakCoinduct)\n    case(cStatEq \\<Psi> PQ QP)\n    from \\<open>(\\<Psi>, PQ, QP) \\<in> ?X\\<close>\n    obtain xvec P Q where PFrQ: \"PQ = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q)\" and QFrP: \"QP = \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> P)\" and \"xvec \\<sharp>* \\<Psi>\"\n      by auto\n\n    obtain A\\<^sub>P \\<Psi>\\<^sub>P where FrP: \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\" and \"A\\<^sub>P \\<sharp>* Q\"\n      by(rule_tac C=\"(\\<Psi>, Q)\" in freshFrame) auto\n    obtain A\\<^sub>Q \\<Psi>\\<^sub>Q where FrQ: \"extractFrame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\" and \"A\\<^sub>Q \\<sharp>* A\\<^sub>P\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\\<^sub>P\"\n      by(rule_tac C=\"(\\<Psi>, A\\<^sub>P, \\<Psi>\\<^sub>P)\" in freshFrame) auto\n    from FrQ \\<open>A\\<^sub>Q \\<sharp>* A\\<^sub>P\\<close> \\<open>A\\<^sub>P \\<sharp>* Q\\<close> have \"A\\<^sub>P \\<sharp>* \\<Psi>\\<^sub>Q\" by(force dest: extractFrameFreshChain)\n    have \"\\<langle>(xvec@A\\<^sub>P@A\\<^sub>Q), \\<Psi> \\<otimes> \\<Psi>\\<^sub>P \\<otimes> \\<Psi>\\<^sub>Q\\<rangle> \\<simeq>\\<^sub>F \\<langle>(xvec@A\\<^sub>Q@A\\<^sub>P), \\<Psi> \\<otimes> \\<Psi>\\<^sub>Q \\<otimes> \\<Psi>\\<^sub>P\\<rangle>\"\n      by(simp add: frameChainAppend)\n        (metis frameResChainPres frameResChainComm frameNilStatEq compositionSym Associativity Commutativity FrameStatEqTrans)\n    with FrP FrQ PFrQ QFrP \\<open>A\\<^sub>P \\<sharp>* \\<Psi>\\<^sub>Q\\<close> \\<open>A\\<^sub>Q \\<sharp>* \\<Psi>\\<^sub>P\\<close> \\<open>A\\<^sub>Q \\<sharp>* A\\<^sub>P\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>A\\<^sub>P \\<sharp>* \\<Psi>\\<close> \\<open>A\\<^sub>Q \\<sharp>* \\<Psi>\\<close>\n    show ?case by(auto simp add: frameChainAppend)\n  next\n    case(cSim \\<Psi> PQ QP)\n    from \\<open>(\\<Psi>, PQ, QP) \\<in> ?X\\<close>    \n    obtain xvec P Q where PFrQ: \"PQ = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q)\" and QFrP: \"QP = \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> P)\"\n                      and \"xvec \\<sharp>* \\<Psi>\"\n      by auto\n    moreover have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q) \\<leadsto>[?X] \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> P)\"\n    proof -\n      have \"\\<Psi> \\<rhd> P \\<parallel> Q \\<leadsto>[?X] Q \\<parallel> P\"\n      proof -\n        note \\<open>eqvt ?X\\<close>\n        moreover have \"\\<And>\\<Psi> P Q. (\\<Psi>, P \\<parallel> Q, Q \\<parallel> P) \\<in> ?X\"\n          apply auto by(rule_tac x=\"[]\" in exI) auto\n        moreover have \"\\<And>\\<Psi> P Q xvec. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?X; xvec \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>P, \\<lparr>\\<nu>*xvec\\<rparr>Q) \\<in> ?X\"\n          apply(induct xvec, auto)\n          by(rule_tac x=\"xvec@xveca\" in exI) (auto simp add: resChainAppend)\n        ultimately show ?thesis by(rule simParComm) \n      qed\n      moreover note \\<open>eqvt ?X\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close>\n      moreover have \"\\<And>\\<Psi> P Q x. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?X; x \\<sharp> \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X\"\n        apply auto\n        by(rule_tac x=\"x#xvec\" in exI) auto\n      ultimately show ?thesis by(rule resChainPres) \n    qed\n    ultimately show ?case by simp\n  next\n    case(cExt \\<Psi> PQ QP \\<Psi>')\n    from \\<open>(\\<Psi>, PQ, QP) \\<in> ?X\\<close>\n    obtain xvec P Q where PFrQ: \"PQ = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q)\" and QFrP: \"QP = \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> P)\"\n                      and \"xvec \\<sharp>* \\<Psi>\"\n      by auto\n    \n    obtain p where \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>\"\n               and \"(p \\<bullet> xvec) \\<sharp>* P\"\n               and \"(p \\<bullet> xvec) \\<sharp>* Q\"\n               and \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\"\n               and S: \"(set p) \\<subseteq> (set xvec) \\<times> (set(p \\<bullet> xvec))\" and \"distinctPerm p\"\n      by(rule_tac c=\"(\\<Psi>, P, Q, \\<Psi>')\" in name_list_avoiding) auto\n\n    from \\<open>(p \\<bullet> xvec) \\<sharp>* P\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* Q\\<close> S have \"\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(p \\<bullet> (P \\<parallel> Q))\"\n      by(subst resChainAlpha) auto\n    hence PQAlpha: \"\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> (p \\<bullet> Q))\"\n      by(simp add: eqvts)\n\n    from \\<open>(p \\<bullet> xvec) \\<sharp>* P\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* Q\\<close> S have \"\\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> P) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(p \\<bullet> (Q \\<parallel> P))\"\n      by(subst resChainAlpha) auto\n    hence QPAlpha: \"\\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> P) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> Q) \\<parallel> (p \\<bullet> P))\"\n      by(simp add: eqvts)\n\n    from \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\\<close> have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> (p \\<bullet> Q)), \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> Q) \\<parallel> (p \\<bullet> P))) \\<in> ?X\"\n      by auto\n    with PFrQ QFrP PQAlpha QPAlpha show ?case by simp\n  next\n    case(cSym \\<Psi> PR QR)\n    thus ?case by blast\n  qed\nqed\n\nlemma bisimResComm:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   y :: name\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P) \\<sim> \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\"\nproof(cases \"x=y\")\n  case True\n  thus ?thesis by(blast intro: bisimReflexive)\nnext\n  case False\n  {\n    fix x::name and y::name and P::\"('a, 'b, 'c) psi\"\n    assume \"x \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>\"\n    let ?X = \"{((\\<Psi>::'b), \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>(P::('a, 'b, 'c) psi)), \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)) | \\<Psi> x y P. x \\<sharp> \\<Psi> \\<and> y \\<sharp> \\<Psi>}\"\n    from \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P), \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)) \\<in> ?X\" by auto\n    hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P) \\<sim> \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\"\n    proof(coinduct rule: bisimCoinduct)\n      case(cStatEq \\<Psi> xyP yxP)\n      from \\<open>(\\<Psi>, xyP, yxP) \\<in> ?X\\<close> obtain x y P where \"x \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>\" and \"xyP = \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P)\" and \"yxP = \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\" by auto\n      moreover obtain A\\<^sub>P \\<Psi>\\<^sub>P where \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\" and \"x \\<sharp> A\\<^sub>P\" and \"y \\<sharp> A\\<^sub>P\"\n        by(rule_tac C=\"(x, y, \\<Psi>)\" in freshFrame) auto\n      ultimately show ?case by(force intro: frameResComm FrameStatEqTrans)\n    next\n      case(cSim \\<Psi> xyP yxP)\n      from \\<open>(\\<Psi>, xyP, yxP) \\<in> ?X\\<close> obtain x y P where \"x \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>\" and \"xyP = \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P)\" and \"yxP = \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\" by auto\n      note \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>\\<close>\n      moreover have \"eqvt ?X\" by(force simp add: eqvt_def pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n      hence \"eqvt(?X \\<union> bisim)\" by auto\n      moreover have \"\\<And>\\<Psi> P. (\\<Psi>, P, P) \\<in> ?X \\<union> bisim\" by(blast intro: bisimReflexive)\n      moreover have \"\\<And>\\<Psi> x y P. \\<lbrakk>x \\<sharp> \\<Psi>; y \\<sharp> \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P), \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)) \\<in> ?X \\<union> bisim\" by auto\n      ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P) \\<leadsto>[(?X \\<union> bisim)] \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\" by(rule resComm)\n      with \\<open>xyP = \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P)\\<close> \\<open>yxP = \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\\<close> show ?case\n        by simp\n    next\n      case(cExt \\<Psi> xyP yxP \\<Psi>')\n      from \\<open>(\\<Psi>, xyP, yxP) \\<in> ?X\\<close> obtain x y P where \"x \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>\" and xyPeq: \"xyP = \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P)\" and yxPeq: \"yxP = \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\" by auto\n      show ?case\n      proof(case_tac \"x=y\")\n        assume \"x = y\"\n        with xyPeq yxPeq show ?case\n          by(blast intro: bisimReflexive)\n      next\n        assume \"x \\<noteq> y\"\n        obtain x' where \"x' \\<sharp> \\<Psi>\" and \"x' \\<sharp> \\<Psi>'\" and \"x' \\<noteq> x\" and \"x' \\<noteq> y\" and \"x' \\<sharp> P\" by(generate_fresh \"name\") (auto simp add: fresh_prod)\n        obtain y' where \"y' \\<sharp> \\<Psi>\" and \"y' \\<sharp> \\<Psi>'\" and \"y' \\<noteq> x\" and \"x' \\<noteq> y'\" and \"y' \\<noteq> y\" and \"y' \\<sharp> P\" by(generate_fresh \"name\") (auto simp add: fresh_prod)\n        with xyPeq \\<open>y' \\<sharp> P\\<close> \\<open>x' \\<sharp> P\\<close> \\<open>x \\<noteq> y\\<close> \\<open>x' \\<noteq> y\\<close> \\<open>y' \\<noteq> x\\<close> have \"\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P) = \\<lparr>\\<nu>x'\\<rparr>(\\<lparr>\\<nu>y'\\<rparr>([(x, x')] \\<bullet> [(y, y')] \\<bullet> P))\"\n          apply(subst alphaRes[of x']) apply(simp add: abs_fresh) by(subst alphaRes[of y' _ y]) (auto simp add: eqvts calc_atm)\n        moreover with yxPeq \\<open>y' \\<sharp> P\\<close> \\<open>x' \\<sharp> P\\<close> \\<open>x \\<noteq> y\\<close> \\<open>x' \\<noteq> y\\<close> \\<open>y' \\<noteq> x\\<close> \\<open>x' \\<noteq> y'\\<close> have \"\\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P) = \\<lparr>\\<nu>y'\\<rparr>(\\<lparr>\\<nu>x'\\<rparr>([(y, y')] \\<bullet> [(x, x')] \\<bullet> P))\"\n          apply(subst alphaRes[of y']) apply(simp add: abs_fresh) by(subst alphaRes[of x' _ x]) (auto simp add: eqvts calc_atm)\n        with \\<open>x \\<noteq> y\\<close> \\<open>x' \\<noteq> y\\<close> \\<open>y' \\<noteq> y\\<close> \\<open>x' \\<noteq> x\\<close> \\<open>y' \\<noteq> x\\<close> \\<open>x' \\<noteq> y'\\<close> have \"\\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P) = \\<lparr>\\<nu>y'\\<rparr>(\\<lparr>\\<nu>x'\\<rparr>([(x, x')] \\<bullet> [(y, y')] \\<bullet> P))\"\n          by(subst perm_compose) (simp add: calc_atm)\n        moreover from \\<open>x' \\<sharp> \\<Psi>\\<close> \\<open>x' \\<sharp> \\<Psi>'\\<close> \\<open>y' \\<sharp> \\<Psi>\\<close> \\<open>y' \\<sharp> \\<Psi>'\\<close> have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>x'\\<rparr>(\\<lparr>\\<nu>y'\\<rparr>([(x, x')] \\<bullet> [(y, y')] \\<bullet> P)), \\<lparr>\\<nu>y'\\<rparr>(\\<lparr>\\<nu>x'\\<rparr>([(x, x')] \\<bullet> [(y, y')] \\<bullet> P))) \\<in> ?X\"\n          by auto\n        ultimately show ?case using xyPeq yxPeq by simp\n      qed\n    next\n      case(cSym \\<Psi> xyP yxP)\n      thus ?case by auto\n    qed\n  }\n  moreover obtain x'::name where \"x' \\<sharp> \\<Psi>\" and \"x' \\<sharp> P\" and \"x' \\<noteq> x\" and \"x' \\<noteq> y\"\n    by(generate_fresh \"name\") auto\n  moreover obtain y'::name where \"y' \\<sharp> \\<Psi>\" and \"y' \\<sharp> P\" and \"y' \\<noteq> x\" and \"y' \\<noteq> y\" and \"y' \\<noteq> x'\"\n    by(generate_fresh \"name\") auto\n  ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x'\\<rparr>(\\<lparr>\\<nu>y'\\<rparr>([(y, y'), (x, x')] \\<bullet> P)) \\<sim> \\<lparr>\\<nu>y'\\<rparr>(\\<lparr>\\<nu>x'\\<rparr>([(y, y'), (x, x')] \\<bullet> P))\" by auto\n  thus ?thesis using \\<open>x' \\<sharp> P\\<close> \\<open>x' \\<noteq> x\\<close> \\<open>x' \\<noteq> y\\<close> \\<open>y' \\<sharp> P\\<close> \\<open>y' \\<noteq> x\\<close> \\<open>y' \\<noteq> y\\<close> \\<open>y' \\<noteq> x'\\<close> \\<open>x \\<noteq> y\\<close>\n    apply(subst alphaRes[where x=x and y=x' and P=P], auto)\n    apply(subst alphaRes[where x=y and y=y' and P=P], auto)\n    apply(subst alphaRes[where x=x and y=x' and P=\"\\<lparr>\\<nu>y'\\<rparr>([(y, y')] \\<bullet> P)\"], auto simp add: abs_fresh fresh_left)\n    apply(subst alphaRes[where x=y and y=y' and P=\"\\<lparr>\\<nu>x'\\<rparr>([(x, x')] \\<bullet> P)\"], auto simp add: abs_fresh fresh_left)\n    by(subst perm_compose) (simp add: eqvts calc_atm)\nqed\n\nlemma bisimResComm':\n  fixes x    :: name\n  and   \\<Psi>   :: 'b\n  and   xvec :: \"name list\"\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"xvec \\<sharp>* \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>P) \\<sim> \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\"\nusing assms\nby(induct xvec) (auto intro: bisimResComm bisimReflexive bisimResPres bisimTransitive)\n\nlemma bisimScopeExt:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> P\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q) \\<sim> P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q\"\nproof -\n  {\n    fix x::name and Q :: \"('a, 'b, 'c) psi\"\n    assume \"x \\<sharp> \\<Psi>\" and \"x \\<sharp> P\"\n    let ?X1 = \"{((\\<Psi>::'b), \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>((P::('a, 'b, 'c) psi) \\<parallel> Q)), \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)) | \\<Psi> xvec x P Q. x \\<sharp> \\<Psi> \\<and> x \\<sharp> P \\<and> xvec \\<sharp>* \\<Psi>}\"\n    let ?X2 = \"{((\\<Psi>::'b), \\<lparr>\\<nu>*xvec\\<rparr>((P::('a, 'b, 'c) psi) \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q), \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))) | \\<Psi> xvec x P Q. x \\<sharp> \\<Psi> \\<and> x \\<sharp> P \\<and> xvec \\<sharp>* \\<Psi>}\"\n    let ?X = \"?X1 \\<union> ?X2\"\n\n    from \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>x \\<sharp> P\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q), P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X\"\n      by(auto, rule_tac x=\"[]\" in exI) (auto simp add: fresh_list_nil)\n    moreover have \"eqvt ?X\"\n      by(rule eqvtUnion)\n    (fastforce simp add: eqvt_def eqvts pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst] pt_fresh_bij[OF pt_name_inst, OF at_name_inst])+\n    ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q) \\<sim> P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q\"\n    proof(coinduct rule: transitiveCoinduct)\n      case(cStatEq \\<Psi> R T)\n      show ?case\n      proof(case_tac \"(\\<Psi>, R, T) \\<in> ?X1\")\n        assume \"(\\<Psi>, R, T) \\<in> ?X1\"\n        then obtain xvec x P Q where \"R = \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))\" and \"T = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)\" and \"xvec \\<sharp>* \\<Psi>\" and \"x \\<sharp> P\" and \"x \\<sharp> \\<Psi>\"\n          by auto\n        moreover obtain A\\<^sub>P \\<Psi>\\<^sub>P where FrP: \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\" and \"x \\<sharp> A\\<^sub>P\" and \"A\\<^sub>P \\<sharp>* Q\"\n          by(rule_tac C=\"(\\<Psi>, x, Q)\" in freshFrame) auto\n        moreover obtain A\\<^sub>Q \\<Psi>\\<^sub>Q where FrQ: \"extractFrame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\" and \"x \\<sharp> A\\<^sub>Q\" and \"A\\<^sub>Q \\<sharp>* A\\<^sub>P\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\\<^sub>P\"\n          by(rule_tac C=\"(\\<Psi>, x, A\\<^sub>P, \\<Psi>\\<^sub>P)\" in freshFrame) auto\n        moreover from FrQ \\<open>A\\<^sub>P \\<sharp>* Q\\<close> \\<open>A\\<^sub>Q \\<sharp>* A\\<^sub>P\\<close> have \"A\\<^sub>P \\<sharp>* \\<Psi>\\<^sub>Q\"\n          by(drule_tac extractFrameFreshChain) auto\n        moreover from \\<open>x \\<sharp> P\\<close> \\<open>x \\<sharp> A\\<^sub>P\\<close> FrP have \"x \\<sharp> \\<Psi>\\<^sub>P\" by(drule_tac extractFrameFresh) auto\n        ultimately show ?case\n          by(force simp add: frameChainAppend intro: frameResComm' FrameStatEqTrans frameResChainPres)\n      next\n        assume \"(\\<Psi>, R, T) \\<notin> ?X1\"\n        with \\<open>(\\<Psi>, R, T) \\<in> ?X\\<close> have \"(\\<Psi>, R, T) \\<in> ?X2\" by blast\n        then obtain xvec x P Q where \"T = \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))\" and \"R = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)\" and \"xvec \\<sharp>* \\<Psi>\" and \"x \\<sharp> P\" and \"x \\<sharp> \\<Psi>\"\n          by auto\n        moreover obtain A\\<^sub>P \\<Psi>\\<^sub>P where FrP: \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\" and \"x \\<sharp> A\\<^sub>P\" and \"A\\<^sub>P \\<sharp>* Q\"\n          by(rule_tac C=\"(\\<Psi>, x, Q)\" in freshFrame) auto\n        moreover obtain A\\<^sub>Q \\<Psi>\\<^sub>Q where FrQ: \"extractFrame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\" and \"x \\<sharp> A\\<^sub>Q\" and \"A\\<^sub>Q \\<sharp>* A\\<^sub>P\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\\<^sub>P\"\n          by(rule_tac C=\"(\\<Psi>, x, A\\<^sub>P, \\<Psi>\\<^sub>P)\" in freshFrame) auto\n        moreover from FrQ \\<open>A\\<^sub>P \\<sharp>* Q\\<close> \\<open>A\\<^sub>Q \\<sharp>* A\\<^sub>P\\<close> have \"A\\<^sub>P \\<sharp>* \\<Psi>\\<^sub>Q\"\n          by(drule_tac extractFrameFreshChain) auto\n        moreover from \\<open>x \\<sharp> P\\<close> \\<open>x \\<sharp> A\\<^sub>P\\<close> FrP have \"x \\<sharp> \\<Psi>\\<^sub>P\" by(drule_tac extractFrameFresh) auto\n        ultimately show ?case\n          apply auto\n          by(force simp add: frameChainAppend intro: frameResComm' FrameStatEqTrans frameResChainPres FrameStatEqSym)\n      qed\n    next\n      case(cSim \\<Psi> R T)\n      let ?Y = \"{(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> ((\\<Psi>, P', Q') \\<in> ?X \\<or> \\<Psi> \\<rhd> P' \\<sim> Q') \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n      from \\<open>eqvt ?X\\<close> have \"eqvt ?Y\" by blast\n      have C1: \"\\<And>\\<Psi> R T y. \\<lbrakk>(\\<Psi>, R, T) \\<in> ?Y; (y::name) \\<sharp> \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>y\\<rparr>R, \\<lparr>\\<nu>y\\<rparr>T) \\<in> ?Y\"\n      proof -\n        fix \\<Psi> R T y\n        assume \"(\\<Psi>, R, T) \\<in> ?Y\"\n        then obtain R' T' where \"\\<Psi> \\<rhd> R \\<sim> R'\" and \"(\\<Psi>, R', T') \\<in> (?X \\<union> bisim)\" and \"\\<Psi> \\<rhd> T' \\<sim> T\" by fastforce\n        assume \"(y::name) \\<sharp> \\<Psi>\" \n        show \"(\\<Psi>, \\<lparr>\\<nu>y\\<rparr>R, \\<lparr>\\<nu>y\\<rparr>T) \\<in> ?Y\"\n        proof(case_tac \"(\\<Psi>, R', T') \\<in> ?X\")\n          assume \"(\\<Psi>, R', T') \\<in> ?X\"\n          show ?thesis\n          proof(case_tac \"(\\<Psi>, R', T') \\<in> ?X1\")\n            assume \"(\\<Psi>, R', T') \\<in> ?X1\"\n            then obtain xvec x P Q where R'eq: \"R' = \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))\" and T'eq: \"T' = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)\"\n                                     and \"xvec \\<sharp>* \\<Psi>\" and \"x \\<sharp> P\" and \"x \\<sharp> \\<Psi>\"\n              by auto\n            from \\<open>\\<Psi> \\<rhd> R \\<sim> R'\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>R \\<sim> \\<lparr>\\<nu>y\\<rparr>R'\" by(rule bisimResPres)\n            moreover from \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> \\<open>x \\<sharp> P\\<close> \\<open>x \\<sharp> \\<Psi>\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>*(y#xvec)\\<rparr>\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q), \\<lparr>\\<nu>*(y#xvec)\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)) \\<in> ?X1\"\n              by(force simp del: resChain.simps)\n            with R'eq T'eq have \"(\\<Psi>, \\<lparr>\\<nu>y\\<rparr>R', \\<lparr>\\<nu>y\\<rparr>T') \\<in> ?X \\<union> bisim\" by simp\n            moreover from \\<open>\\<Psi> \\<rhd> T' \\<sim> T\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>T' \\<sim> \\<lparr>\\<nu>y\\<rparr>T\" by(rule bisimResPres)\n            ultimately show ?thesis by blast\n          next\n            assume \"(\\<Psi>, R', T') \\<notin> ?X1\"\n            with \\<open>(\\<Psi>, R', T') \\<in> ?X\\<close> have \"(\\<Psi>, R', T') \\<in> ?X2\" by blast\n            then obtain xvec x P Q where T'eq: \"T' = \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))\" and R'eq: \"R' = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)\" and \"xvec \\<sharp>* \\<Psi>\" and \"x \\<sharp> P\" and \"x \\<sharp> \\<Psi>\"\n              by auto\n            from \\<open>\\<Psi> \\<rhd> R \\<sim> R'\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>R \\<sim> \\<lparr>\\<nu>y\\<rparr>R'\" by(rule bisimResPres)\n            moreover from \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> \\<open>x \\<sharp> P\\<close> \\<open>x \\<sharp> \\<Psi>\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>*(y#xvec)\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q), \\<lparr>\\<nu>*(y#xvec)\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))) \\<in> ?X2\"\n              by(force simp del: resChain.simps)\n            with R'eq T'eq have \"(\\<Psi>, \\<lparr>\\<nu>y\\<rparr>R', \\<lparr>\\<nu>y\\<rparr>T') \\<in> ?X \\<union> bisim\" by simp\n            moreover from \\<open>\\<Psi> \\<rhd> T' \\<sim> T\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>T' \\<sim> \\<lparr>\\<nu>y\\<rparr>T\" by(rule bisimResPres)\n            ultimately show ?thesis by blast\n          qed\n        next\n          assume \"(\\<Psi>, R', T') \\<notin> ?X\"\n          with \\<open>(\\<Psi>, R', T') \\<in> ?X \\<union> bisim\\<close> have \"\\<Psi> \\<rhd> R' \\<sim> T'\" by blast\n          with \\<open>\\<Psi> \\<rhd> R \\<sim> R'\\<close> \\<open>\\<Psi> \\<rhd> T' \\<sim> T\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> show ?thesis\n            by(blast dest: bisimResPres)\n        qed\n      qed\n      \n      show ?case\n      proof(case_tac \"(\\<Psi>, R, T) \\<in> ?X1\")\n        assume \"(\\<Psi>, R, T) \\<in> ?X1\"\n        then obtain xvec x P Q where Req: \"R = \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))\" and Teq: \"T = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)\" and \"xvec \\<sharp>* \\<Psi>\" and \"x \\<sharp> P\" and \"x \\<sharp> \\<Psi>\"\n          by auto\n        have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q)) \\<leadsto>[?Y] \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)\"\n        proof -\n          have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q) \\<leadsto>[?Y] P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q\"\n          proof -\n            note \\<open>x \\<sharp> P\\<close> \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>eqvt ?Y\\<close>\n            moreover have \"\\<And>\\<Psi> P. (\\<Psi>, P, P) \\<in> ?Y\" by(blast intro: bisimReflexive)\n            moreover have \"\\<And>x \\<Psi> P Q xvec. \\<lbrakk>x \\<sharp> \\<Psi>; x \\<sharp> P; xvec \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q)), \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)) \\<in> ?Y\"\n            proof -\n              fix x \\<Psi> P Q xvec\n              assume \"(x::name) \\<sharp> (\\<Psi>::'b)\" and \"x \\<sharp> (P::('a, 'b, 'c) psi)\" and \"(xvec::name list) \\<sharp>* \\<Psi>\"\n              from \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q)) \\<sim> \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))\"\n                by(rule bisimResComm')\n              moreover from \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>x \\<sharp> P\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q)), \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)) \\<in> ?X \\<union> bisim\"\n                by blast\n              ultimately show \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q)), \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)) \\<in> ?Y\" \n                by(blast intro: bisimReflexive)\n            qed\n            moreover have \"\\<And>\\<Psi> xvec P x. \\<lbrakk>x \\<sharp> \\<Psi>; xvec \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>P), \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)) \\<in> ?Y\"\n              by(blast intro: bisimResComm' bisimReflexive)\n            ultimately show ?thesis by(rule scopeExtLeft)\n          qed\n          thus ?thesis using \\<open>eqvt ?Y\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> C1 \n            by(rule resChainPres)\n        qed\n        with Req Teq show ?case by simp\n      next\n        assume \"(\\<Psi>, R, T) \\<notin> ?X1\"\n        with \\<open>(\\<Psi>, R, T) \\<in> ?X\\<close> have \"(\\<Psi>, R, T) \\<in> ?X2\" by blast\n        then obtain xvec x P Q where Teq: \"T = \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))\" and Req: \"R = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)\" and \"xvec \\<sharp>* \\<Psi>\" and \"x \\<sharp> P\" and \"x \\<sharp> \\<Psi>\"\n          by auto\n        have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q) \\<leadsto>[?Y] \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))\"\n        proof -\n          have \"\\<Psi> \\<rhd> P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q \\<leadsto>[?Y] \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q)\"\n          proof -\n            note \\<open>x \\<sharp> P\\<close> \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>eqvt ?Y\\<close>\n            moreover have \"\\<And>\\<Psi> P. (\\<Psi>, P, P) \\<in> ?Y\" by(blast intro: bisimReflexive)\n            moreover have \"\\<And>x \\<Psi> P Q xvec. \\<lbrakk>x \\<sharp> \\<Psi>; x \\<sharp> P; xvec \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q), \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q))) \\<in> ?Y\"\n            proof -\n              fix x \\<Psi> P Q xvec\n              assume \"(x::name) \\<sharp> (\\<Psi>::'b)\" and \"x \\<sharp> (P::('a, 'b, 'c) psi)\" and \"(xvec::name list) \\<sharp>* \\<Psi>\"\n              from \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>x \\<sharp> P\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q), \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))) \\<in> ?X \\<union> bisim\"\n                by blast\n              moreover from \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q)) \\<sim> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q))\"\n                by(blast intro: bisimResComm' bisimE)\n              ultimately show \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q), \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q))) \\<in> ?Y\" \n                by(blast intro: bisimReflexive)\n            qed\n            ultimately show ?thesis by(rule scopeExtRight)\n          qed\n          thus ?thesis using \\<open>eqvt ?Y\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> C1 \n            by(rule resChainPres)\n        qed\n        with Req Teq show ?case by simp\n      qed\n    next\n      case(cExt \\<Psi> R T \\<Psi>')\n      show ?case\n      proof(case_tac \"(\\<Psi>, R, T) \\<in> ?X1\")\n        assume \"(\\<Psi>, R, T) \\<in> ?X1\"\n        then obtain xvec x P Q where Req: \"R = \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))\" and Teq: \"T = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)\" and \"xvec \\<sharp>* \\<Psi>\" and \"x \\<sharp> P\" and \"x \\<sharp> \\<Psi>\"\n          by auto\n        obtain y::name where \"y \\<sharp> P\" and \"y \\<sharp> Q\" and \"y \\<sharp> xvec\" and \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\"\n          by(generate_fresh \"name\", auto simp add: fresh_prod)\n\n        obtain p where \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>\" and \"(p \\<bullet> xvec) \\<sharp>* P\" and \"(p \\<bullet> xvec) \\<sharp>* Q\" and \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\"\n                  and \"x \\<sharp> (p \\<bullet> xvec)\" and \"y \\<sharp> (p \\<bullet> xvec)\"\n                   and S: \"(set p) \\<subseteq> (set xvec) \\<times> (set(p \\<bullet> xvec))\" and \"distinctPerm p\"\n          by(rule_tac c=\"(\\<Psi>, P, Q, x, y, \\<Psi>')\" in name_list_avoiding) auto\n        \n        \n        from \\<open>y \\<sharp> P\\<close> have \"(p \\<bullet> y) \\<sharp> (p \\<bullet> P)\" by(simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n        with S \\<open>y \\<sharp> xvec\\<close> \\<open>y \\<sharp> (p \\<bullet> xvec)\\<close> have \"y \\<sharp> (p \\<bullet> P)\" by simp\n        with \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\\<close> \\<open>y \\<sharp> \\<Psi>'\\<close>\n        have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(\\<lparr>\\<nu>y\\<rparr>((p \\<bullet> P) \\<parallel> (p \\<bullet> [(x, y)] \\<bullet> Q))), \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> (\\<lparr>\\<nu>y\\<rparr>(p \\<bullet> [(x, y)] \\<bullet> Q)))) \\<in> ?X\"\n          by auto\n        moreover from Req \\<open>(p \\<bullet> xvec) \\<sharp>* P\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* Q\\<close> \\<open>y \\<sharp> xvec\\<close> \\<open>y \\<sharp> (p \\<bullet> xvec)\\<close> \\<open>x \\<sharp> (p \\<bullet> xvec)\\<close> \\<open>y \\<sharp> P\\<close> \\<open>y \\<sharp> Q\\<close> \\<open>x \\<sharp> P\\<close> S\n        have \"R = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(\\<lparr>\\<nu>y\\<rparr>((p \\<bullet> P) \\<parallel> (p \\<bullet> [(x, y)] \\<bullet> Q)))\"\n          apply(erule_tac rev_mp)\n          apply(subst alphaRes[of y])\n          apply(clarsimp simp add: eqvts)\n          apply(subst resChainAlpha[of p])\n          by(auto simp add: eqvts)\n        moreover from Teq \\<open>(p \\<bullet> xvec) \\<sharp>* P\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* Q\\<close> \\<open>y \\<sharp> xvec\\<close> \\<open>y \\<sharp> (p \\<bullet> xvec)\\<close> \\<open>x \\<sharp> (p \\<bullet> xvec)\\<close> \\<open>y \\<sharp> P\\<close> \\<open>y \\<sharp> Q\\<close> \\<open>x \\<sharp> P\\<close> S\n        have \"T = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> \\<lparr>\\<nu>y\\<rparr>(p \\<bullet> [(x, y)] \\<bullet> Q))\"\n          apply(erule_tac rev_mp)\n          apply(subst alphaRes[of y])\n          apply(clarsimp simp add: eqvts)\n          apply(subst resChainAlpha[of p])\n          by(auto simp add: eqvts)\n        ultimately show ?case\n          by blast\n      next\n        assume \"(\\<Psi>, R, T) \\<notin> ?X1\"\n        with \\<open>(\\<Psi>, R, T) \\<in> ?X\\<close> have \"(\\<Psi>, R, T) \\<in> ?X2\" by blast\n        then obtain xvec x P Q where Teq: \"T = \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))\" and Req: \"R = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)\" and \"xvec \\<sharp>* \\<Psi>\" and \"x \\<sharp> P\" and \"x \\<sharp> \\<Psi>\"\n          by auto\n        obtain y::name where \"y \\<sharp> P\" and \"y \\<sharp> Q\" and \"y \\<sharp> xvec\" and \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\"\n          by(generate_fresh \"name\", auto simp add: fresh_prod)\n\n        obtain p where \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>\" and \"(p \\<bullet> xvec) \\<sharp>* P\" and \"(p \\<bullet> xvec) \\<sharp>* Q\" and \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\"\n                   and \"x \\<sharp> (p \\<bullet> xvec)\" and \"y \\<sharp> (p \\<bullet> xvec)\"\n                   and S: \"(set p) \\<subseteq> (set xvec) \\<times> (set(p \\<bullet> xvec))\" and \"distinctPerm p\"\n          by(rule_tac c=\"(\\<Psi>, P, Q, x, y, \\<Psi>')\" in name_list_avoiding) auto\n        \n        from \\<open>y \\<sharp> P\\<close> have \"(p \\<bullet> y) \\<sharp> (p \\<bullet> P)\" by(simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n        with S \\<open>y \\<sharp> xvec\\<close> \\<open>y \\<sharp> (p \\<bullet> xvec)\\<close> have \"y \\<sharp> (p \\<bullet> P)\" by simp\n        with \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\\<close> \\<open>y \\<sharp> \\<Psi>'\\<close>\n        have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> \\<lparr>\\<nu>y\\<rparr>(p \\<bullet> [(x, y)] \\<bullet> Q)), \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(\\<lparr>\\<nu>y\\<rparr>((p \\<bullet> P) \\<parallel> (p \\<bullet> [(x, y)] \\<bullet> Q)))) \\<in> ?X2\"\n          by auto\n        moreover from Teq \\<open>(p \\<bullet> xvec) \\<sharp>* P\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* Q\\<close> \\<open>y \\<sharp> xvec\\<close> \\<open>y \\<sharp> (p \\<bullet> xvec)\\<close> \\<open>x \\<sharp> (p \\<bullet> xvec)\\<close> \\<open>y \\<sharp> P\\<close> \\<open>y \\<sharp> Q\\<close> \\<open>x \\<sharp> P\\<close> S\n        have \"T = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(\\<lparr>\\<nu>y\\<rparr>((p \\<bullet> P) \\<parallel> (p \\<bullet> [(x, y)] \\<bullet> Q)))\"\n          apply(erule_tac rev_mp)\n          apply(subst alphaRes[of y])\n          apply(clarsimp simp add: eqvts)\n          apply(subst resChainAlpha[of p])\n          by(auto simp add: eqvts)\n        moreover from Req \\<open>(p \\<bullet> xvec) \\<sharp>* P\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* Q\\<close> \\<open>y \\<sharp> xvec\\<close> \\<open>y \\<sharp> (p \\<bullet> xvec)\\<close> \\<open>x \\<sharp> (p \\<bullet> xvec)\\<close> \\<open>y \\<sharp> P\\<close> \\<open>y \\<sharp> Q\\<close> \\<open>x \\<sharp> P\\<close> S\n        have \"R = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> \\<lparr>\\<nu>y\\<rparr>(p \\<bullet> [(x, y)] \\<bullet> Q))\"\n          apply(erule_tac rev_mp)\n          apply(subst alphaRes[of y])\n          apply(clarsimp simp add: eqvts)\n          apply(subst resChainAlpha[of p])\n          by(auto simp add: eqvts)\n        ultimately show ?case\n          by blast\n      qed\n    next\n      case(cSym \\<Psi> P Q)\n      thus ?case\n        by(blast dest: bisimE)\n    qed\n  }\n  moreover obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> P\" \"y \\<sharp> Q\"\n    by(generate_fresh \"name\") auto\n  ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>(P \\<parallel> ([(x, y)] \\<bullet> Q)) \\<sim> P \\<parallel> \\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> Q)\" by auto\n  thus ?thesis using assms \\<open>y \\<sharp> P\\<close> \\<open>y \\<sharp> Q\\<close>\n    apply(subst alphaRes[where x=x and y=y and P=Q], auto)\n    by(subst alphaRes[where x=x and y=y and P=\"P \\<parallel> Q\"]) auto\nqed\n\nlemma bisimScopeExtChain:\n  fixes xvec :: \"name list\"\n  and   \\<Psi>    :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"xvec \\<sharp>* \\<Psi>\"\n  and     \"xvec \\<sharp>* P\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q) \\<sim> P \\<parallel> (\\<lparr>\\<nu>*xvec\\<rparr>Q)\"\nusing assms\nby(induct xvec) (auto intro: bisimScopeExt bisimReflexive bisimTransitive bisimResPres) \n\nlemma bisimParAssoc:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> (P \\<parallel> Q) \\<parallel> R \\<sim> P \\<parallel> (Q \\<parallel> R)\"\nproof -\n  let ?X = \"{(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R))) | \\<Psi> xvec P Q R. xvec \\<sharp>* \\<Psi>}\"\n  let ?Y = \"{(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> ?X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n\n  have \"(\\<Psi>, (P \\<parallel> Q) \\<parallel> R, P \\<parallel> (Q \\<parallel> R)) \\<in> ?X\"\n    by(auto, rule_tac x=\"[]\" in exI) auto\n  moreover have \"eqvt ?X\" by(force simp add: eqvt_def simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst] eqvts)\n  ultimately show ?thesis\n  proof(coinduct rule: weakTransitiveCoinduct')\n    case(cStatEq \\<Psi> PQR PQR')\n    from \\<open>(\\<Psi>, PQR, PQR') \\<in> ?X\\<close> obtain xvec P Q R where \"xvec \\<sharp>* \\<Psi>\" and \"PQR = \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R)\" and \"PQR' = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R))\"\n      by auto\n    moreover obtain A\\<^sub>P \\<Psi>\\<^sub>P where FrP: \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\" and \"A\\<^sub>P \\<sharp>* Q\" and \"A\\<^sub>P \\<sharp>* R\"\n      by(rule_tac C=\"(\\<Psi>, Q, R)\" in freshFrame) auto\n    moreover obtain A\\<^sub>Q \\<Psi>\\<^sub>Q where FrQ: \"extractFrame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\" and \"A\\<^sub>Q \\<sharp>* A\\<^sub>P\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\\<^sub>P\" and \"A\\<^sub>Q \\<sharp>* R\"\n      by(rule_tac C=\"(\\<Psi>, A\\<^sub>P, \\<Psi>\\<^sub>P, R)\" in freshFrame) auto\n    moreover obtain A\\<^sub>R \\<Psi>\\<^sub>R where FrR: \"extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\" and \"A\\<^sub>R \\<sharp>* \\<Psi>\" and \"A\\<^sub>R \\<sharp>* A\\<^sub>P\" and \"A\\<^sub>R \\<sharp>* \\<Psi>\\<^sub>P\" and \"A\\<^sub>R \\<sharp>* A\\<^sub>Q\" and \"A\\<^sub>R \\<sharp>* \\<Psi>\\<^sub>Q\"\n      by(rule_tac C=\"(\\<Psi>, A\\<^sub>P, \\<Psi>\\<^sub>P, A\\<^sub>Q, \\<Psi>\\<^sub>Q)\" in freshFrame) auto\n    moreover from FrQ \\<open>A\\<^sub>P \\<sharp>* Q\\<close> \\<open>A\\<^sub>Q \\<sharp>* A\\<^sub>P\\<close> have \"A\\<^sub>P \\<sharp>* \\<Psi>\\<^sub>Q\"\n      by(drule_tac extractFrameFreshChain) auto\n    moreover from FrR \\<open>A\\<^sub>P \\<sharp>* R\\<close> \\<open>A\\<^sub>R \\<sharp>* A\\<^sub>P\\<close> have \"A\\<^sub>P \\<sharp>* \\<Psi>\\<^sub>R\"\n      by(drule_tac extractFrameFreshChain) auto\n    moreover from FrR \\<open>A\\<^sub>Q \\<sharp>* R\\<close> \\<open>A\\<^sub>R \\<sharp>* A\\<^sub>Q\\<close> have \"A\\<^sub>Q \\<sharp>* \\<Psi>\\<^sub>R\"\n      by(drule_tac extractFrameFreshChain) auto\n    ultimately show ?case using freshCompChain\n      by auto (metis frameChainAppend compositionSym Associativity frameNilStatEq frameResChainPres)\n  next\n    case(cSim \\<Psi> T S)\n    from \\<open>(\\<Psi>, T, S) \\<in> ?X\\<close> obtain xvec P Q R where \"xvec \\<sharp>* \\<Psi>\" and TEq: \"T = \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R)\"\n                                               and SEq: \"S = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R))\"\n      by auto\n    from \\<open>eqvt ?X\\<close>have \"eqvt ?Y\" by blast\n    have C1: \"\\<And>\\<Psi> T S yvec. \\<lbrakk>(\\<Psi>, T, S) \\<in> ?Y; yvec \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>*yvec\\<rparr>T, \\<lparr>\\<nu>*yvec\\<rparr>S) \\<in> ?Y\"\n    proof -\n      fix \\<Psi> T S yvec\n      assume \"(\\<Psi>, T, S) \\<in> ?Y\"\n      then obtain T' S' where \"\\<Psi> \\<rhd> T \\<sim> T'\" and \"(\\<Psi>, T', S') \\<in> ?X\" and \"\\<Psi> \\<rhd> S' \\<sim> S\" by fastforce\n      assume \"(yvec::name list) \\<sharp>* \\<Psi>\" \n      from \\<open>(\\<Psi>, T', S') \\<in> ?X\\<close> obtain xvec P Q R where T'eq: \"T' = \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R)\" and S'eq: \"S' = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R))\"\n                                                  and \"xvec \\<sharp>* \\<Psi>\"\n        by auto\n      from \\<open>\\<Psi> \\<rhd> T \\<sim> T'\\<close> \\<open>yvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*yvec\\<rparr>T \\<sim> \\<lparr>\\<nu>*yvec\\<rparr>T'\" by(rule bisimResChainPres)\n      moreover from \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>yvec \\<sharp>* \\<Psi>\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>*(yvec@xvec)\\<rparr>((P \\<parallel> Q) \\<parallel> R), \\<lparr>\\<nu>*(yvec@xvec)\\<rparr>(P \\<parallel> (Q \\<parallel> R))) \\<in> ?X\"\n        by force\n      with T'eq S'eq have \"(\\<Psi>, \\<lparr>\\<nu>*yvec\\<rparr>T', \\<lparr>\\<nu>*yvec\\<rparr>S') \\<in> ?X\" by(simp add: resChainAppend)\n      moreover from \\<open>\\<Psi> \\<rhd> S' \\<sim> S\\<close> \\<open>yvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*yvec\\<rparr>S' \\<sim> \\<lparr>\\<nu>*yvec\\<rparr>S\" by(rule bisimResChainPres)\n      ultimately show \"(\\<Psi>, \\<lparr>\\<nu>*yvec\\<rparr>T, \\<lparr>\\<nu>*yvec\\<rparr>S) \\<in> ?Y\" by blast\n    qed\n    have C2: \"\\<And>\\<Psi> T S y. \\<lbrakk>(\\<Psi>, T, S) \\<in> ?Y; y \\<sharp> \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>y\\<rparr>T, \\<lparr>\\<nu>y\\<rparr>S) \\<in> ?Y\"\n      by(drule_tac yvec2=\"[y]\" in C1) auto\n\n    have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R) \\<leadsto>[?Y] \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R))\"\n    proof -\n      have \"\\<Psi> \\<rhd> (P \\<parallel> Q) \\<parallel> R \\<leadsto>[?Y] P \\<parallel> (Q \\<parallel> R)\" \n      proof -\n        note \\<open>eqvt ?Y\\<close>\n        moreover have \"\\<And>\\<Psi> P Q R. (\\<Psi>, (P \\<parallel> Q) \\<parallel> R, P \\<parallel> (Q \\<parallel> R)) \\<in> ?Y\"\n        proof -\n          fix \\<Psi> P Q R\n          have \"(\\<Psi>::'b, ((P::('a, 'b, 'c) psi) \\<parallel> Q) \\<parallel> R, P \\<parallel> (Q \\<parallel> R)) \\<in> ?X\"\n            by(auto, rule_tac x=\"[]\" in exI) auto\n          thus \"(\\<Psi>, (P \\<parallel> Q) \\<parallel> R, P \\<parallel> (Q \\<parallel> R)) \\<in> ?Y\"\n            by(blast intro: bisimReflexive)\n        qed\n        moreover have \"\\<And>xvec \\<Psi> P Q R. \\<lbrakk>xvec \\<sharp>* \\<Psi>; xvec \\<sharp>* P\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R), P \\<parallel> (\\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R))) \\<in> ?Y\"\n        proof -\n          fix xvec \\<Psi> P Q R\n          assume \"(xvec::name list) \\<sharp>* (\\<Psi>::'b)\" and \"xvec \\<sharp>* (P::('a, 'b, 'c) psi)\"\n          from \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R))) \\<in> ?X\" by blast\n          moreover from \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>xvec \\<sharp>* P\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R)) \\<sim> P \\<parallel> (\\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R))\"\n            by(rule bisimScopeExtChain)\n          ultimately show \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R), P \\<parallel> (\\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R))) \\<in> ?Y\"\n            by(blast intro: bisimReflexive)\n        qed\n        moreover have \"\\<And>xvec \\<Psi> P Q R. \\<lbrakk>xvec \\<sharp>* \\<Psi>; xvec \\<sharp>* R\\<rbrakk> \\<Longrightarrow> (\\<Psi>, (\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q)) \\<parallel> R, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R))) \\<in> ?Y\"\n        proof -\n          fix xvec \\<Psi> P Q R\n          assume \"(xvec::name list) \\<sharp>* (\\<Psi>::'b)\" and \"xvec \\<sharp>* (R::('a, 'b, 'c) psi)\"\n          have \"\\<Psi> \\<rhd> (\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q)) \\<parallel> R \\<sim> R \\<parallel> (\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q))\" by(rule bisimParComm)\n          moreover from \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>xvec \\<sharp>* R\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(R \\<parallel> (P \\<parallel> Q)) \\<sim> R \\<parallel> (\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q))\" by(rule bisimScopeExtChain)\n          hence \"\\<Psi> \\<rhd> R \\<parallel> (\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q)) \\<sim> \\<lparr>\\<nu>*xvec\\<rparr>(R \\<parallel> (P \\<parallel> Q))\" by(rule bisimE)\n          moreover from \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(R \\<parallel> (P \\<parallel> Q)) \\<sim> \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R)\"\n            by(metis bisimResChainPres bisimParComm)\n          moreover from \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R))) \\<in> ?X\" by blast\n          ultimately show \"(\\<Psi>, (\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q)) \\<parallel> R, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R))) \\<in> ?Y\"  by(blast dest: bisimTransitive intro: bisimReflexive)\n        qed\n        ultimately show ?thesis using C1\n          by(rule parAssocLeft)\n      qed\n      thus ?thesis using \\<open>eqvt ?Y\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> C2\n        by(rule resChainPres)\n    qed\n    with TEq SEq show ?case by simp\n  next\n    case(cExt \\<Psi> T S \\<Psi>')\n    from \\<open>(\\<Psi>, T, S) \\<in> ?X\\<close> obtain xvec P Q R where \"xvec \\<sharp>* \\<Psi>\" and TEq: \"T = \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R)\"\n                                               and SEq: \"S = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R))\"\n      by auto\n    obtain p where \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>\" and \"(p \\<bullet> xvec) \\<sharp>* P\" and \"(p \\<bullet> xvec) \\<sharp>* Q\" and \"(p \\<bullet> xvec) \\<sharp>* R\" and \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\"\n               and S: \"(set p) \\<subseteq> (set xvec) \\<times> (set(p \\<bullet> xvec))\" and \"distinctPerm p\"\n      by(rule_tac c=\"(\\<Psi>, P, Q, R, \\<Psi>')\" in name_list_avoiding) auto\n\n    from \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\\<close> have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(((p \\<bullet> P) \\<parallel> (p \\<bullet> Q)) \\<parallel> (p \\<bullet> R)), \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> ((p \\<bullet> Q) \\<parallel> (p \\<bullet> R)))) \\<in> ?X\"\n      by auto\n    moreover from TEq \\<open>(p \\<bullet> xvec) \\<sharp>* P\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* Q\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* R\\<close> S have \"T = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(((p \\<bullet> P) \\<parallel> (p \\<bullet> Q)) \\<parallel> (p \\<bullet> R))\"\n      apply auto by(subst resChainAlpha[of p]) auto\n    moreover from SEq \\<open>(p \\<bullet> xvec) \\<sharp>* P\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* Q\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* R\\<close> S have \"S = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> ((p \\<bullet> Q) \\<parallel> (p \\<bullet> R)))\"\n      apply auto by(subst resChainAlpha[of p]) auto\n    ultimately show ?case by simp\n  next\n    case(cSym \\<Psi> T S)\n    from \\<open>(\\<Psi>, T, S) \\<in> ?X\\<close> obtain xvec P Q R where \"xvec \\<sharp>* \\<Psi>\" and TEq: \"T = \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R)\"\n                                               and SEq: \"\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R)) = S\"\n      by auto\n    \n    from \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> (Q \\<parallel> R)) \\<sim> \\<lparr>\\<nu>*xvec\\<rparr>((R \\<parallel> Q) \\<parallel> P)\"\n      by(metis bisimParComm bisimParPres bisimTransitive bisimResChainPres)\n    moreover from \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>((R \\<parallel> Q) \\<parallel> P), \\<lparr>\\<nu>*xvec\\<rparr>(R \\<parallel> (Q \\<parallel> P))) \\<in> ?X\" by blast\n    moreover from \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(R \\<parallel> (Q \\<parallel> P)) \\<sim> \\<lparr>\\<nu>*xvec\\<rparr>((P \\<parallel> Q) \\<parallel> R)\"\n      by(metis bisimParComm bisimParPres bisimTransitive bisimResChainPres)\n    ultimately show ?case using TEq SEq by(blast dest: bisimTransitive)\n  qed\nqed    \n\nlemma bisimParNil:\n  fixes P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> \\<zero> \\<sim> P\"\nproof -\n  let ?X1 = \"{(\\<Psi>, P \\<parallel> \\<zero>, P) | \\<Psi> P. True}\"\n  let ?X2 = \"{(\\<Psi>, P, P \\<parallel> \\<zero>) | \\<Psi> P. True}\"\n  let ?X = \"?X1 \\<union> ?X2\"\n  have \"eqvt ?X\" by(auto simp add: eqvt_def)\n  have \"(\\<Psi>, P \\<parallel> \\<zero>, P) \\<in> ?X\" by simp\n  thus ?thesis\n  proof(coinduct rule: bisimWeakCoinduct)\n    case(cStatEq \\<Psi> Q R)\n    show ?case\n    proof(case_tac \"(\\<Psi>, Q, R) \\<in> ?X1\")\n      assume \"(\\<Psi>, Q, R) \\<in> ?X1\"\n      then obtain P where \"Q = P \\<parallel> \\<zero>\" and \"R = P\" by auto\n      moreover obtain A\\<^sub>P \\<Psi>\\<^sub>P where \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\"\n        by(rule freshFrame)\n      ultimately show ?case\n        apply auto by(metis frameResChainPres frameNilStatEq Identity Associativity AssertionStatEqTrans Commutativity)\n    next\n      assume \"(\\<Psi>, Q, R) \\<notin> ?X1\"\n      with \\<open>(\\<Psi>, Q, R) \\<in> ?X\\<close> have \"(\\<Psi>, Q, R) \\<in> ?X2\" by blast\n      then obtain P where \"Q = P\" and \"R = P \\<parallel> \\<zero>\" by auto\n      moreover obtain A\\<^sub>P \\<Psi>\\<^sub>P where \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\"\n        by(rule freshFrame)\n      ultimately show ?case\n        apply auto by(metis frameResChainPres frameNilStatEq Identity Associativity AssertionStatEqTrans AssertionStatEqSym Commutativity)\n    qed\n  next\n    case(cSim \\<Psi> Q R)\n    thus ?case using \\<open>eqvt ?X\\<close>\n      by(auto intro: parNilLeft parNilRight)\n  next\n    case(cExt \\<Psi> Q R \\<Psi>')\n    thus ?case by auto\n  next\n    case(cSym \\<Psi> Q R)\n    thus ?case by auto\n  qed\nqed\n\nlemma bisimResNil:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  \n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>\\<zero> \\<sim> \\<zero>\"\nproof -\n  {\n    fix x::name\n    assume \"x \\<sharp> \\<Psi>\"\n    have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>\\<zero> \\<sim> \\<zero>\"\n    proof -\n      let ?X1 = \"{(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>\\<zero>, \\<zero>) | \\<Psi> x. x \\<sharp> \\<Psi>}\"\n      let ?X2 = \"{(\\<Psi>, \\<zero>, \\<lparr>\\<nu>x\\<rparr>\\<zero>) | \\<Psi> x. x \\<sharp> \\<Psi>}\"\n      let ?X = \"?X1 \\<union> ?X2\"\n\n      from \\<open>x \\<sharp> \\<Psi>\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>\\<zero>, \\<zero>) \\<in> ?X\" by auto\n      thus ?thesis\n      proof(coinduct rule: bisimWeakCoinduct)\n        case(cStatEq \\<Psi> P Q)\n        thus ?case using freshComp by(force intro: frameResFresh FrameStatEqSym)\n      next\n        case(cSim \\<Psi> P Q)\n        thus ?case\n          by(force intro: resNilLeft resNilRight)\n      next\n        case(cExt \\<Psi> P Q \\<Psi>')\n        obtain y where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\" and \"y \\<noteq> x\"\n          by(generate_fresh \"name\") (auto simp add: fresh_prod)\n        show ?case\n        proof(case_tac \"(\\<Psi>, P, Q) \\<in> ?X1\")\n          assume \"(\\<Psi>, P, Q) \\<in> ?X1\"\n          then obtain x where \"P = \\<lparr>\\<nu>x\\<rparr>\\<zero>\" and \"Q = \\<zero>\" by auto\n          moreover have \"\\<lparr>\\<nu>x\\<rparr>\\<zero> = \\<lparr>\\<nu>y\\<rparr> \\<zero>\" by(subst alphaRes) auto\n          ultimately show ?case using \\<open>y \\<sharp> \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>'\\<close> by auto\n        next\n          assume \"(\\<Psi>, P, Q) \\<notin> ?X1\"\n          with \\<open>(\\<Psi>, P, Q) \\<in> ?X\\<close> have \"(\\<Psi>, P, Q) \\<in> ?X2\" by auto\n          then obtain x where \"Q = \\<lparr>\\<nu>x\\<rparr>\\<zero>\" and \"P = \\<zero>\" by auto\n          moreover have \"\\<lparr>\\<nu>x\\<rparr>\\<zero> = \\<lparr>\\<nu>y\\<rparr> \\<zero>\" by(subst alphaRes) auto\n          ultimately show ?case using \\<open>y \\<sharp> \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>'\\<close> by auto\n        qed\n      next\n        case(cSym \\<Psi> P Q)\n        thus ?case by auto\n      qed\n    qed\n  }\n  moreover obtain y::name where \"y \\<sharp> \\<Psi>\" by(generate_fresh \"name\") auto\n  ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>\\<zero> \\<sim> \\<zero>\" by auto\n  thus ?thesis by(subst alphaRes[where x=x and y=y]) auto\nqed\n\nlemma bisimOutputPushRes:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   M :: 'a\n  and   N :: 'a\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> M\"\n  and     \"x \\<sharp> N\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P) \\<sim> M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P\"\nproof -\n  {\n    fix x::name and P::\"('a, 'b, 'c) psi\"\n    assume \"x \\<sharp> \\<Psi>\" and \"x \\<sharp> M\" and \"x \\<sharp> N\"\n    let ?X1 = \"{(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P), M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P) | \\<Psi> x M N P. x \\<sharp> \\<Psi> \\<and> x \\<sharp> M \\<and> x \\<sharp> N}\"\n    let ?X2 = \"{(\\<Psi>, M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P)) | \\<Psi> x M N P. x \\<sharp> \\<Psi> \\<and> x \\<sharp> M \\<and> x \\<sharp> N}\"\n    let ?X = \"?X1 \\<union> ?X2\"\n  \n    have \"eqvt ?X\" by(rule_tac eqvtUnion) (force simp add: eqvt_def pt_fresh_bij[OF pt_name_inst, OF at_name_inst] eqvts)+\n    from \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>x \\<sharp> M\\<close> \\<open>x \\<sharp> N\\<close>  have \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P), M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P) \\<in> ?X\" by auto\n    hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P) \\<sim> M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P\"\n    proof(coinduct rule: bisimCoinduct)\n      case(cStatEq \\<Psi> Q R)\n      thus ?case using freshComp by(force intro: frameResFresh FrameStatEqSym)\n    next\n      case(cSim \\<Psi> Q R)\n      thus ?case using \\<open>eqvt ?X\\<close>\n        by(fastforce intro: outputPushResLeft outputPushResRight bisimReflexive)\n    next\n      case(cExt \\<Psi> Q R \\<Psi>')\n      show ?case\n      proof(case_tac \"(\\<Psi>, Q, R) \\<in> ?X1\")\n        assume \"(\\<Psi>, Q, R) \\<in> ?X1\"\n        then obtain x M N P where Qeq: \"Q = \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P)\" and Req: \"R = M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P\" and \"x \\<sharp> \\<Psi>\" and \"x \\<sharp> M\" and \"x \\<sharp> N\" by auto\n        obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\" and \"y \\<sharp> M\" and \"y \\<sharp> N\" and \"y \\<sharp> P\"\n          by(generate_fresh \"name\") (auto simp add: fresh_prod)\n        \n        moreover hence \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>y\\<rparr>(M\\<langle>N\\<rangle>.([(x, y)] \\<bullet> P)), M\\<langle>N\\<rangle>.\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)) \\<in> ?X\" by auto\n        moreover from Qeq \\<open>x \\<sharp> M\\<close> \\<open>y \\<sharp> M\\<close> \\<open>x \\<sharp> N\\<close> \\<open>y \\<sharp> N\\<close> \\<open>y \\<sharp> P\\<close> have \"Q = \\<lparr>\\<nu>y\\<rparr>(M\\<langle>N\\<rangle>.([(x, y)] \\<bullet> P))\"\n          apply auto by(subst alphaRes[of y]) (auto simp add: eqvts)\n        moreover from Req \\<open>y \\<sharp> P\\<close> have \"R = M\\<langle>N\\<rangle>.\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)\"\n          apply auto by(subst alphaRes[of y]) (auto simp add: eqvts)\n        ultimately show ?case by blast\n      next\n        assume \"(\\<Psi>, Q, R) \\<notin> ?X1\"\n        with \\<open>(\\<Psi>, Q, R) \\<in> ?X\\<close> have \"(\\<Psi>, Q, R) \\<in> ?X2\" by blast\n        then obtain x M N P where Req: \"R = \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P)\" and Qeq: \"Q = M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P\" and \"x \\<sharp> \\<Psi>\" and \"x \\<sharp> M\" and \"x \\<sharp> N\" by auto\n        obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\" and \"y \\<sharp> M\" and \"y \\<sharp> N\" and \"y \\<sharp> P\"\n          by(generate_fresh \"name\") (auto simp add: fresh_prod)\n        \n        moreover hence \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>y\\<rparr>(M\\<langle>N\\<rangle>.([(x, y)] \\<bullet> P)), M\\<langle>N\\<rangle>.\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)) \\<in> ?X\" by auto\n        moreover from Req \\<open>x \\<sharp> M\\<close> \\<open>y \\<sharp> M\\<close> \\<open>x \\<sharp> N\\<close> \\<open>y \\<sharp> N\\<close> \\<open>y \\<sharp> P\\<close> have \"R = \\<lparr>\\<nu>y\\<rparr>(M\\<langle>N\\<rangle>.([(x, y)] \\<bullet> P))\"\n          apply auto by(subst alphaRes[of y]) (auto simp add: eqvts)\n        moreover from Qeq \\<open>y \\<sharp> P\\<close> have \"Q = M\\<langle>N\\<rangle>.\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)\"\n          apply auto by(subst alphaRes[of y]) (auto simp add: eqvts)\n        ultimately show ?case by blast\n      qed\n    next\n      case(cSym \\<Psi> R Q)\n      thus ?case by blast\n    qed\n  }\n  moreover obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> M\" and \"y \\<sharp> N\" \"y \\<sharp> P\"\n    by(generate_fresh \"name\") auto\n  ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>(M\\<langle>N\\<rangle>.([(x, y)] \\<bullet> P)) \\<sim> M\\<langle>N\\<rangle>.\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)\" by auto\n  thus ?thesis using assms \\<open>y \\<sharp> P\\<close> \\<open>y \\<sharp> M\\<close> \\<open>y \\<sharp> N\\<close>\n    apply(subst alphaRes[where x=x and y=y and P=P], auto)\n    by(subst alphaRes[where x=x and y=y and P=\"M\\<langle>N\\<rangle>.P\"]) auto\nqed\n\nlemma bisimInputPushRes:\n  fixes x    :: name\n  and   \\<Psi>    :: 'b\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> M\"\n  and     \"x \\<sharp> xvec\"\n  and     \"x \\<sharp> N\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P) \\<sim> M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P\"\nproof -\n  {\n    fix x::name and P::\"('a, 'b, 'c) psi\"\n    assume \"x \\<sharp> \\<Psi>\" and \"x \\<sharp> M\" and \"x \\<sharp> N\" and \"x \\<sharp> xvec\"\n    let ?X1 = \"{(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P), M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P) | \\<Psi> x M xvec N P. x \\<sharp> \\<Psi> \\<and> x \\<sharp> M \\<and> x \\<sharp> xvec \\<and> x \\<sharp> N}\"\n    let ?X2 = \"{(\\<Psi>, M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P)) | \\<Psi> x M xvec N P. x \\<sharp> \\<Psi> \\<and> x \\<sharp> M \\<and> x \\<sharp> xvec \\<and> x \\<sharp> N}\"\n    let ?X = \"?X1 \\<union> ?X2\"\n  \n    have \"eqvt ?X\" by(rule_tac eqvtUnion) (force simp add: eqvt_def pt_fresh_bij[OF pt_name_inst, OF at_name_inst] eqvts)+\n\n    from \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>x \\<sharp> M\\<close> \\<open>x \\<sharp> xvec\\<close> \\<open>x \\<sharp> N\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P), M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P) \\<in> ?X\" by blast\n    hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P) \\<sim> M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P\"\n    proof(coinduct rule: bisimCoinduct)\n      case(cStatEq \\<Psi> Q R)\n      thus ?case using freshComp by(force intro: frameResFresh FrameStatEqSym)\n    next\n      case(cSim \\<Psi> Q R)\n      thus ?case using \\<open>eqvt ?X\\<close>\n        by(fastforce intro: inputPushResLeft inputPushResRight bisimReflexive)\n    next\n      case(cExt \\<Psi> Q R \\<Psi>')\n      show ?case\n      proof(case_tac \"(\\<Psi>, Q, R) \\<in> ?X1\")\n        assume \"(\\<Psi>, Q, R) \\<in> ?X1\"\n        then obtain x M xvec N P where Qeq: \"Q = \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P)\" and Req: \"R = M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P\" and \"x \\<sharp> \\<Psi>\"\n                                   and \"x \\<sharp> M\" and \"x \\<sharp> xvec\" and \"x \\<sharp> N\" by auto\n        obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\" and \"y \\<sharp> M\" and \"y \\<sharp> N\" and \"y \\<sharp> P\" and \"y \\<sharp> xvec\"\n          by(generate_fresh \"name\") (auto simp add: fresh_prod)\n        \n        moreover hence \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>y\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.([(x, y)] \\<bullet> P)), M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)) \\<in> ?X\" by fastforce\n        moreover from Qeq \\<open>x \\<sharp> M\\<close> \\<open>y \\<sharp> M\\<close> \\<open>x \\<sharp> xvec\\<close> \\<open>y \\<sharp> xvec\\<close> \\<open>x \\<sharp> N\\<close> \\<open>y \\<sharp> N\\<close> \\<open>y \\<sharp> P\\<close> have \"Q = \\<lparr>\\<nu>y\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.([(x, y)] \\<bullet> P))\"\n          apply auto by(subst alphaRes[of y]) (auto simp add: eqvts inputChainFresh)\n        moreover from Req \\<open>y \\<sharp> P\\<close> have \"R = M\\<lparr>\\<lambda>*xvec N \\<rparr>.\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)\"\n          apply auto by(subst alphaRes[of y]) (auto simp add: eqvts)\n        ultimately show ?case by blast\n      next\n        assume \"(\\<Psi>, Q, R) \\<notin> ?X1\"\n        with \\<open>(\\<Psi>, Q, R) \\<in> ?X\\<close> have \"(\\<Psi>, Q, R) \\<in> ?X2\" by blast\n        then obtain x M xvec N P where Req: \"R = \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P)\" and Qeq: \"Q = M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P\" and \"x \\<sharp> \\<Psi>\"\n                                   and \"x \\<sharp> M\" and \"x \\<sharp> xvec\" and \"x \\<sharp> N\" by auto\n        obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\" and \"y \\<sharp> M\" and \"y \\<sharp> N\" and \"y \\<sharp> P\" and \"y \\<sharp> xvec\"\n          by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\n        moreover hence \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>y\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.([(x, y)] \\<bullet> P)), M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)) \\<in> ?X\" by fastforce\n        moreover from Req \\<open>x \\<sharp> M\\<close> \\<open>y \\<sharp> M\\<close> \\<open>x \\<sharp> xvec\\<close> \\<open>y \\<sharp> xvec\\<close> \\<open>x \\<sharp> N\\<close> \\<open>y \\<sharp> N\\<close> \\<open>y \\<sharp> P\\<close> have \"R = \\<lparr>\\<nu>y\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.([(x, y)] \\<bullet> P))\"\n          apply auto by(subst alphaRes[of y]) (auto simp add: eqvts inputChainFresh)\n        moreover from Qeq \\<open>y \\<sharp> P\\<close> have \"Q = M\\<lparr>\\<lambda>*xvec N \\<rparr>.\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)\"\n          apply auto by(subst alphaRes[of y]) (auto simp add: eqvts)\n        ultimately show ?case by blast\n      qed\n    next\n      case(cSym \\<Psi> R Q)\n      thus ?case by blast\n    qed\n  }\n  moreover obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> M\" and \"y \\<sharp> N\" and \"y \\<sharp> P\" and \"y \\<sharp> xvec\"\n    by(generate_fresh \"name\") auto\n  ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.([(x, y)] \\<bullet> P)) \\<sim> M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)\" by auto\n  thus ?thesis using assms \\<open>y \\<sharp> P\\<close> \\<open>y \\<sharp> M\\<close> \\<open>y \\<sharp> N\\<close> \\<open>y \\<sharp> xvec\\<close>\n    apply(subst alphaRes[where x=x and y=y and P=P], auto)\n    by(subst alphaRes[where x=x and y=y and P=\"M\\<lparr>\\<lambda>*xvec N\\<rparr>.P\"]) (auto simp add: inputChainFresh eqvts)\nqed\n\nlemma bisimCasePushRes:\n  fixes x  :: name\n  and   \\<Psi>  :: 'b\n  and   Cs :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n\n  assumes \"x \\<sharp> (map fst Cs)\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(Cases Cs) \\<sim> Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)\"\nproof -\n  {\n    fix x::name and Cs::\"('c \\<times> ('a, 'b, 'c) psi) list\"\n    assume \"x \\<sharp> \\<Psi>\" and \"x \\<sharp> (map fst Cs)\"\n    let ?X1 = \"{(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(Cases Cs), Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)) | \\<Psi> x Cs. x \\<sharp> \\<Psi> \\<and> x \\<sharp> (map fst Cs)}\"\n    let ?X2 = \"{(\\<Psi>, Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs), \\<lparr>\\<nu>x\\<rparr>(Cases Cs)) | \\<Psi> x Cs. x \\<sharp> \\<Psi> \\<and> x \\<sharp> (map fst Cs)}\"\n    let ?X = \"?X1 \\<union> ?X2\"\n  \n    have \"eqvt ?X\" apply(rule_tac eqvtUnion) \n      apply(auto simp add: eqvt_def eqvts)\n      apply(rule_tac x=\"p \\<bullet> x\" in exI)\n      apply(rule_tac x=\"p \\<bullet> Cs\" in exI)\n      apply(perm_extend_simp)\n      apply(auto simp add: eqvts)\n      apply(simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n      apply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n      apply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n      apply(simp add: eqvts)\n      apply(perm_extend_simp)\n      apply(simp add: eqvts)\n      apply(rule_tac x=\"p \\<bullet> x\" in exI)\n      apply(rule_tac x=\"p \\<bullet> Cs\" in exI)\n      apply auto\n      apply(perm_extend_simp)\n      apply(simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n      apply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n      apply(drule_tac pi=p in pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n      apply(simp add: eqvts)\n      apply(perm_extend_simp)\n      by(simp add: eqvts)    \n    \n    from \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>x \\<sharp> map fst Cs\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>(Cases Cs), Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)) \\<in> ?X\" by auto\n    hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(Cases Cs) \\<sim> Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)\"\n    proof(coinduct rule: bisimCoinduct)\n      case(cStatEq \\<Psi> Q R)\n      thus ?case using freshComp by(force intro: frameResFresh FrameStatEqSym)\n    next\n      case(cSim \\<Psi> Q R)\n      thus ?case using \\<open>eqvt ?X\\<close>\n        by(fastforce intro: casePushResLeft casePushResRight bisimReflexive)\n    next\n      case(cExt \\<Psi> Q R \\<Psi>')\n      show ?case\n      proof(case_tac \"(\\<Psi>, Q, R) \\<in> ?X1\")\n        assume \"(\\<Psi>, Q, R) \\<in> ?X1\"\n        then obtain x Cs where Qeq: \"Q = \\<lparr>\\<nu>x\\<rparr>(Cases Cs)\" and Req: \"R = Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)\"\n                           and \"x \\<sharp> \\<Psi>\" and \"x \\<sharp> (map fst Cs)\" by blast\n        obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\" and \"y \\<sharp> Cs\"\n          by(generate_fresh \"name\") (auto simp add: fresh_prod)\n        from \\<open>y \\<sharp> Cs\\<close> \\<open>x \\<sharp> (map fst Cs)\\<close> have \"y \\<sharp> map fst ([(x, y)] \\<bullet> Cs)\" by(induct Cs) (auto simp add: fresh_list_cons fresh_list_nil)\n\n        moreover with \\<open>y \\<sharp> \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>'\\<close> have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>y\\<rparr>(Cases ([(x, y)] \\<bullet> Cs)), Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>y\\<rparr>P)) ([(x, y)] \\<bullet> Cs))) \\<in> ?X\"\n          by auto\n        moreover from Qeq \\<open>y \\<sharp> Cs\\<close> have \"Q = \\<lparr>\\<nu>y\\<rparr>(Cases([(x, y)] \\<bullet> Cs))\"\n          apply auto by(subst alphaRes[of y]) (auto simp add: eqvts)\n        moreover from Req \\<open>y \\<sharp> Cs\\<close> \\<open>x \\<sharp> (map fst Cs)\\<close> have \"R = Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>y\\<rparr>P)) ([(x, y)] \\<bullet> Cs))\" \n          by(induct Cs arbitrary: R) (auto simp add: fresh_list_cons fresh_prod alphaRes)\n        ultimately show ?case by blast\n      next\n        assume \"(\\<Psi>, Q, R) \\<notin> ?X1\"\n        with \\<open>(\\<Psi>, Q, R) \\<in> ?X\\<close> have \"(\\<Psi>, Q, R) \\<in> ?X2\" by blast\n        then obtain x Cs where Req: \"R = \\<lparr>\\<nu>x\\<rparr>(Cases Cs)\" and Qeq: \"Q = Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)\"\n                           and \"x \\<sharp> \\<Psi>\" and \"x \\<sharp> (map fst Cs)\" by blast\n        obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\" and \"y \\<sharp> Cs\"\n          by(generate_fresh \"name\") (auto simp add: fresh_prod)\n        from \\<open>y \\<sharp> Cs\\<close> \\<open>x \\<sharp> (map fst Cs)\\<close> have \"y \\<sharp> map fst ([(x, y)] \\<bullet> Cs)\" by(induct Cs) (auto simp add: fresh_list_cons fresh_list_nil)\n        \n        moreover with \\<open>y \\<sharp> \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>'\\<close> have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>y\\<rparr>(Cases ([(x, y)] \\<bullet> Cs)), Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>y\\<rparr>P)) ([(x, y)] \\<bullet> Cs))) \\<in> ?X\"\n          by auto\n        moreover from Req \\<open>y \\<sharp> Cs\\<close> have \"R = \\<lparr>\\<nu>y\\<rparr>(Cases([(x, y)] \\<bullet> Cs))\"\n          apply auto by(subst alphaRes[of y]) (auto simp add: eqvts)\n        moreover from Qeq \\<open>y \\<sharp> Cs\\<close> \\<open>x \\<sharp> (map fst Cs)\\<close> have \"Q = Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>y\\<rparr>P)) ([(x, y)] \\<bullet> Cs))\" \n          by(induct Cs arbitrary: Q) (auto simp add: fresh_list_cons fresh_prod alphaRes)\n        ultimately show ?case by blast\n      qed\n    next\n      case(cSym \\<Psi> R Q)\n      thus ?case by blast\n    qed\n  }\n  moreover obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> Cs\" by(generate_fresh \"name\") auto\n  moreover from \\<open>x \\<sharp> map fst Cs\\<close> have \"y \\<sharp> map fst([(x, y)] \\<bullet> Cs)\" \n    by(induct Cs) (auto simp add: fresh_left calc_atm)\n  ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>(Cases ([(x, y)] \\<bullet> Cs)) \\<sim> Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>y\\<rparr>P)) ([(x, y)] \\<bullet> Cs))\"\n    by auto\n  moreover from \\<open>y \\<sharp> Cs\\<close> have \"\\<lparr>\\<nu>y\\<rparr>(Cases ([(x, y)] \\<bullet> Cs)) =  \\<lparr>\\<nu>x\\<rparr>(Cases Cs)\"\n    by(simp add: alphaRes eqvts)\n  moreover from \\<open>x \\<sharp> map fst Cs\\<close> \\<open>y \\<sharp> Cs\\<close> have \"Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>y\\<rparr>P)) ([(x, y)] \\<bullet> Cs)) = Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)\"\n    by(induct Cs) (auto simp add: alphaRes)\n  ultimately show ?thesis by auto\nqed\n\nlemma bangExt:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"guarded P\"\n\n  shows \"\\<Psi> \\<rhd> !P \\<sim> P \\<parallel> !P\"\nproof -\n  let ?X = \"{(\\<Psi>, !P, P \\<parallel> !P) | \\<Psi> P. guarded P} \\<union> {(\\<Psi>, P \\<parallel> !P, !P) | \\<Psi> P. guarded P}\"\n  from \\<open>guarded P\\<close> have \"(\\<Psi>, !P, P \\<parallel> !P) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cStatEq \\<Psi> Q R)\n    from \\<open>(\\<Psi>, Q, R) \\<in> ?X\\<close> obtain P where Eq: \"(Q = !P \\<and> R = P \\<parallel> !P) \\<or> (Q = P \\<parallel> !P \\<and> R = !P)\" and \"guarded P\"\n      by auto\n    obtain A\\<^sub>P \\<Psi>\\<^sub>P where FrP: \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\" by(rule freshFrame)\n    from FrP \\<open>guarded P\\<close> have \"\\<Psi>\\<^sub>P \\<simeq> SBottom'\" by(blast dest: guardedStatEq)\n    from \\<open>\\<Psi>\\<^sub>P \\<simeq> SBottom'\\<close> have \"\\<Psi> \\<otimes> SBottom' \\<simeq> \\<Psi> \\<otimes> \\<Psi>\\<^sub>P \\<otimes> SBottom'\" by(metis Identity Composition AssertionStatEqTrans Commutativity AssertionStatEqSym)\n    hence \"\\<langle>A\\<^sub>P, \\<Psi> \\<otimes> SBottom'\\<rangle> \\<simeq>\\<^sub>F \\<langle>A\\<^sub>P, \\<Psi> \\<otimes> \\<Psi>\\<^sub>P \\<otimes> SBottom'\\<rangle>\"\n      by(force intro: frameResChainPres)\n    moreover from \\<open>A\\<^sub>P \\<sharp>* \\<Psi>\\<close> have \"\\<langle>\\<epsilon>, \\<Psi> \\<otimes> SBottom'\\<rangle> \\<simeq>\\<^sub>F \\<langle>A\\<^sub>P, \\<Psi> \\<otimes> SBottom'\\<rangle>\"\n      by(rule_tac FrameStatEqSym) (fastforce intro: frameResFreshChain)\n    ultimately show ?case using Eq \\<open>A\\<^sub>P \\<sharp>* \\<Psi>\\<close> FrP\n      by auto (blast dest: FrameStatEqTrans FrameStatEqSym)+\n  next\n    case(cSim \\<Psi> Q R)\n    thus ?case by(auto intro: bangExtLeft bangExtRight bisimReflexive)\n  next\n    case(cExt \\<Psi> Q R)\n    thus ?case by auto\n  next\n    case(cSym \\<Psi> Q R)\n    thus ?case by auto\n  qed\nqed\n  \nlemma bisimParPresSym:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<sim> Q\"\n\n  shows \"\\<Psi> \\<rhd> R \\<parallel> P \\<sim> R \\<parallel> Q\"\nusing assms\nby(metis bisimParComm bisimParPres bisimTransitive)\n\nlemma bisimScopeExtSym:\n  fixes x :: name\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> Q\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q) \\<sim> (\\<lparr>\\<nu>x\\<rparr>P) \\<parallel> Q\"\nusing assms\nby(metis bisimScopeExt bisimTransitive bisimParComm bisimSymmetric bisimResPres)\n\nlemma bisimScopeExtChainSym:\n  fixes xvec :: \"name list\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"xvec \\<sharp>* \\<Psi>\"\n  and     \"xvec \\<sharp>* Q\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q) \\<sim> (\\<lparr>\\<nu>*xvec\\<rparr>P) \\<parallel> Q\"\nusing assms\nby(induct xvec) (auto intro: bisimScopeExtSym bisimReflexive bisimTransitive bisimResPres)\n\nlemma bisimParPresAuxSym:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<sim> Q\"\n  and     \"extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\"\n  and     \"A\\<^sub>R \\<sharp>* \\<Psi>\"\n  and     \"A\\<^sub>R \\<sharp>* P\"\n  and     \"A\\<^sub>R \\<sharp>* Q\"\n\n  shows \"\\<Psi> \\<rhd> R \\<parallel> P \\<sim> R \\<parallel> Q\"\nusing assms\nby(metis bisimParComm bisimParPresAux bisimTransitive)\n\nlemma bangDerivative:\n  fixes \\<Psi>   :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n  and   \\<alpha>    :: \"'a action\"\n  and   P'   :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> !P \\<longmapsto>\\<alpha> \\<prec> P'\"\n  and     \"\\<Psi> \\<rhd> P \\<sim> Q\"\n  and     \"bn \\<alpha> \\<sharp>* \\<Psi>\"\n  and     \"bn \\<alpha> \\<sharp>* P\"\n  and     \"bn \\<alpha> \\<sharp>* Q\"\n  and     \"bn \\<alpha> \\<sharp>* subject \\<alpha>\"\n  and     \"guarded Q\"\n\n  obtains Q' R T where \"\\<Psi> \\<rhd> !Q \\<longmapsto>\\<alpha> \\<prec> Q'\" and \"\\<Psi> \\<rhd> P' \\<sim> R \\<parallel> !P\" and \"\\<Psi> \\<rhd> Q' \\<sim> T \\<parallel> !Q\" and \"\\<Psi> \\<rhd> R \\<sim> T\"\n                   and \"((supp R)::name set) \\<subseteq> supp P'\" and \"((supp T)::name set) \\<subseteq> supp Q'\"\nproof -\n  from \\<open>\\<Psi> \\<rhd> !P \\<longmapsto>\\<alpha> \\<prec> P'\\<close> have \"guarded P\" apply - by(ind_cases \"\\<Psi> \\<rhd> !P \\<longmapsto>\\<alpha> \\<prec> P'\") (auto simp add: psi.inject)\n  assume \"\\<And>Q' R T. \\<lbrakk>\\<Psi> \\<rhd> !Q \\<longmapsto>\\<alpha> \\<prec> Q'; \\<Psi> \\<rhd> P' \\<sim> R \\<parallel> !P; \\<Psi> \\<rhd> Q' \\<sim> T \\<parallel> !Q; \\<Psi> \\<rhd> R \\<sim> T; ((supp R)::name set) \\<subseteq> supp P';\n                    ((supp T)::name set) \\<subseteq> supp Q'\\<rbrakk> \\<Longrightarrow> thesis\"\n  moreover from \\<open>\\<Psi> \\<rhd> !P \\<longmapsto>\\<alpha> \\<prec> P'\\<close> \\<open>bn \\<alpha> \\<sharp>* subject \\<alpha>\\<close> \\<open>bn \\<alpha> \\<sharp>* \\<Psi>\\<close> \\<open>bn \\<alpha> \\<sharp>* P\\<close> \\<open>bn \\<alpha> \\<sharp>* Q\\<close> \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> \\<open>guarded Q\\<close> \n  have \"\\<exists>Q' T R . \\<Psi> \\<rhd> !Q \\<longmapsto>\\<alpha>  \\<prec> Q' \\<and> \\<Psi> \\<rhd> P' \\<sim> R \\<parallel> !P \\<and> \\<Psi> \\<rhd> Q' \\<sim> T \\<parallel> !Q \\<and> \\<Psi> \\<rhd> R \\<sim> T \\<and>\n                  ((supp R)::name set) \\<subseteq> supp P' \\<and> ((supp T)::name set) \\<subseteq> supp Q'\"\n  proof(nominal_induct avoiding: Q rule: bangInduct')\n    case(cAlpha \\<alpha> P' p Q)\n    then obtain Q' T R where QTrans: \"\\<Psi> \\<rhd> !Q \\<longmapsto>\\<alpha> \\<prec> Q'\" and \"\\<Psi> \\<rhd> P' \\<sim> R \\<parallel> (P \\<parallel> !P)\" and \"\\<Psi> \\<rhd> Q' \\<sim> T \\<parallel> !Q\" and \"\\<Psi> \\<rhd> R \\<sim> T\"\n                         and suppR: \"((supp R)::name set) \\<subseteq> supp P'\" and suppT: \"((supp T)::name set) \\<subseteq> supp Q'\"\n      by blast\n    from QTrans have \"distinct(bn \\<alpha>)\" by(rule boundOutputDistinct)\n    have S: \"set p \\<subseteq> set(bn \\<alpha>) \\<times> set(bn(p \\<bullet> \\<alpha>))\" by fact\n    from QTrans \\<open>bn(p \\<bullet> \\<alpha>) \\<sharp>* Q\\<close> \\<open>bn(p \\<bullet> \\<alpha>) \\<sharp>* \\<alpha>\\<close> \\<open>bn \\<alpha> \\<sharp>* subject \\<alpha>\\<close> \\<open>distinct(bn \\<alpha>)\\<close> have \"bn(p \\<bullet> \\<alpha>) \\<sharp>* Q'\"\n      by(drule_tac freeFreshChainDerivative) simp+\n    with QTrans \\<open>bn(p \\<bullet> \\<alpha>) \\<sharp>* \\<alpha>\\<close> S \\<open>bn \\<alpha> \\<sharp>* subject \\<alpha>\\<close> have \"\\<Psi> \\<rhd> !Q \\<longmapsto>(p \\<bullet> \\<alpha>) \\<prec> (p \\<bullet> Q')\"\n      by(force simp add: residualAlpha)\n    moreover from \\<open>\\<Psi> \\<rhd> P' \\<sim> R \\<parallel> (P \\<parallel> !P)\\<close> have \"(p \\<bullet> \\<Psi>) \\<rhd> (p \\<bullet> P') \\<sim> (p \\<bullet> (R \\<parallel> (P \\<parallel> !P)))\"\n      by(rule bisimClosed)\n    with \\<open>bn \\<alpha> \\<sharp>* \\<Psi>\\<close> \\<open>bn \\<alpha> \\<sharp>* P\\<close> \\<open>bn(p \\<bullet> \\<alpha>) \\<sharp>* \\<Psi>\\<close> \\<open>bn(p \\<bullet> \\<alpha>) \\<sharp>* P\\<close> S have \"\\<Psi> \\<rhd> (p \\<bullet> P') \\<sim> (p \\<bullet> R) \\<parallel> (P \\<parallel> !P)\"\n      by(simp add: eqvts)\n    moreover from \\<open>\\<Psi> \\<rhd> Q' \\<sim> T \\<parallel> !Q\\<close> have \"(p \\<bullet> \\<Psi>) \\<rhd> (p \\<bullet> Q') \\<sim> (p \\<bullet> (T \\<parallel> !Q))\"\n      by(rule bisimClosed)\n    with \\<open>bn \\<alpha> \\<sharp>* \\<Psi>\\<close> \\<open>bn \\<alpha> \\<sharp>* Q\\<close> \\<open>bn(p \\<bullet> \\<alpha>) \\<sharp>* \\<Psi>\\<close> \\<open>bn(p \\<bullet> \\<alpha>) \\<sharp>* Q\\<close> S have \"\\<Psi> \\<rhd> (p \\<bullet> Q') \\<sim> (p \\<bullet> T) \\<parallel> !Q\"\n      by(simp add: eqvts)\n    moreover from \\<open>\\<Psi> \\<rhd> R \\<sim> T\\<close> have \"(p \\<bullet> \\<Psi>) \\<rhd> (p \\<bullet> R) \\<sim> (p \\<bullet> T)\"\n      by(rule bisimClosed)\n    with \\<open>bn \\<alpha> \\<sharp>* \\<Psi>\\<close> \\<open>bn(p \\<bullet> \\<alpha>) \\<sharp>* \\<Psi>\\<close> S have \"\\<Psi> \\<rhd> (p \\<bullet> R) \\<sim> (p \\<bullet> T)\"\n      by(simp add: eqvts)\n    moreover from suppR have \"((supp(p \\<bullet> R))::name set) \\<subseteq> supp(p \\<bullet> P')\"\n      apply(erule_tac rev_mp)\n      by(subst subsetClosed[of p, symmetric]) (simp add: eqvts)\n    moreover from suppT have \"((supp(p \\<bullet> T))::name set) \\<subseteq> supp(p \\<bullet> Q')\"\n      apply(erule_tac rev_mp)\n      by(subst subsetClosed[of p, symmetric]) (simp add: eqvts)\n    ultimately show ?case by blast\n  next\n    case(cPar1 \\<alpha> P' Q)\n    from \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> \\<open>\\<Psi> \\<rhd> P \\<longmapsto>\\<alpha> \\<prec> P'\\<close> \\<open>bn \\<alpha> \\<sharp>* \\<Psi>\\<close> \\<open>bn \\<alpha> \\<sharp>* Q\\<close> \n    obtain Q' where QTrans: \"\\<Psi> \\<rhd> Q \\<longmapsto>\\<alpha> \\<prec> Q'\" and \"\\<Psi> \\<rhd> P' \\<sim> Q'\"\n      by(blast dest: bisimE simE)\n    from QTrans have \"\\<Psi> \\<otimes> SBottom' \\<rhd> Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by(metis statEqTransition Identity AssertionStatEqSym)\n    hence \"\\<Psi> \\<rhd> Q \\<parallel> !Q \\<longmapsto>\\<alpha> \\<prec> (Q' \\<parallel> !Q)\" using \\<open>bn \\<alpha> \\<sharp>* Q\\<close> by(rule_tac Par1) (assumption | simp)+\n    hence \"\\<Psi> \\<rhd> !Q \\<longmapsto>\\<alpha> \\<prec> (Q' \\<parallel> !Q)\" using \\<open>guarded Q\\<close> by(rule Bang)\n    moreover from \\<open>guarded P\\<close> have \"\\<Psi> \\<rhd> P' \\<parallel> !P \\<sim> P' \\<parallel> (P \\<parallel> !P)\" by(metis bangExt bisimParPresSym)\n    moreover have \"\\<Psi> \\<rhd> Q' \\<parallel> !Q \\<sim> Q' \\<parallel> !Q\" by(rule bisimReflexive)\n    ultimately show ?case using \\<open>\\<Psi> \\<rhd> P' \\<sim> Q'\\<close> by(force simp add: psi.supp)\n  next\n    case(cPar2 \\<alpha> P' Q)\n    then obtain Q' T R where QTrans: \"\\<Psi> \\<rhd> !Q \\<longmapsto>\\<alpha> \\<prec> Q'\" and \"\\<Psi> \\<rhd> P' \\<sim> R \\<parallel> !P\" and \"\\<Psi> \\<rhd> Q' \\<sim> T \\<parallel> !Q\" and \"\\<Psi> \\<rhd> R \\<sim> T\"\n                         and suppR: \"((supp R)::name set) \\<subseteq> supp P'\" and suppT: \"((supp T)::name set) \\<subseteq> supp Q'\"\n      by blast\n    note QTrans\n    from \\<open>\\<Psi> \\<rhd> P' \\<sim> R \\<parallel> !P\\<close> have \"\\<Psi> \\<rhd> P \\<parallel> P' \\<sim> R \\<parallel> (P \\<parallel> !P)\"\n      by(metis bisimParPresSym bisimParComm bisimTransitive bisimParAssoc)\n    with QTrans show ?case using \\<open>\\<Psi> \\<rhd> Q' \\<sim> T \\<parallel> !Q\\<close> \\<open>\\<Psi> \\<rhd> R \\<sim> T\\<close> suppR suppT\n      by(force simp add: psi.supp)\n  next\n    case(cComm1 M N P' K xvec P'' Q)\n    from \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> have \"\\<Psi> \\<rhd> Q \\<leadsto>[bisim] P\" by(metis bisimE)\n    with \\<open>\\<Psi> \\<rhd> P \\<longmapsto>M\\<lparr>N\\<rparr> \\<prec> P'\\<close> obtain Q' where QTrans: \"\\<Psi> \\<rhd> Q \\<longmapsto>M\\<lparr>N\\<rparr> \\<prec> Q'\" and \"\\<Psi> \\<rhd> Q' \\<sim> P'\"\n      by(force dest: simE)\n    from QTrans have \"\\<Psi> \\<otimes> SBottom' \\<rhd> Q \\<longmapsto>M\\<lparr>N\\<rparr> \\<prec> Q'\" by(metis statEqTransition Identity AssertionStatEqSym)\n    moreover obtain A\\<^sub>Q \\<Psi>\\<^sub>Q where FrQ: \"extractFrame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\" and \"A\\<^sub>Q \\<sharp>* Q\" and \"A\\<^sub>Q \\<sharp>* M\" \n      by(rule_tac C=\"(\\<Psi>, Q, M)\" in freshFrame) auto\n    note FrQ\n    moreover from FrQ \\<open>guarded Q\\<close> have \"\\<Psi>\\<^sub>Q \\<simeq> SBottom'\" by(blast dest: guardedStatEq)\n    from \\<open>\\<Psi> \\<rhd> !P \\<longmapsto>K\\<lparr>\\<nu>*xvec\\<rparr>\\<langle>N\\<rangle> \\<prec> P''\\<close> \\<open>xvec \\<sharp>* K\\<close> \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>xvec \\<sharp>* P\\<close> \\<open>xvec \\<sharp>* Q\\<close> \\<open>guarded Q\\<close>\n    obtain Q'' T R where QTrans': \"\\<Psi> \\<rhd> !Q \\<longmapsto>K\\<lparr>\\<nu>*xvec\\<rparr>\\<langle>N\\<rangle> \\<prec> Q''\" and \"\\<Psi> \\<rhd> P'' \\<sim> R \\<parallel> !P\" and \"\\<Psi> \\<rhd> Q'' \\<sim> T \\<parallel> !Q\" and \"\\<Psi> \\<rhd> R \\<sim> T\"\n                     and suppR: \"((supp R)::name set) \\<subseteq> supp P''\" and suppT: \"((supp T)::name set) \\<subseteq> supp Q''\" using cComm1\n      by fastforce\n    from QTrans' \\<open>\\<Psi>\\<^sub>Q \\<simeq> SBottom'\\<close> have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>Q \\<rhd> !Q \\<longmapsto>K\\<lparr>\\<nu>*xvec\\<rparr>\\<langle>N\\<rangle> \\<prec> Q''\" \n      by(metis statEqTransition Identity compositionSym AssertionStatEqSym)\n    moreover from \\<open>\\<Psi> \\<turnstile> M \\<leftrightarrow> K\\<close> \\<open>\\<Psi>\\<^sub>Q \\<simeq> SBottom'\\<close> have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>Q \\<otimes> SBottom' \\<turnstile> M \\<leftrightarrow> K\" by(metis statEqEnt Identity compositionSym AssertionStatEqSym)\n    ultimately have \"\\<Psi> \\<rhd> Q \\<parallel> !Q \\<longmapsto>\\<tau> \\<prec> (\\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> Q''))\" using \\<open>A\\<^sub>Q \\<sharp>* \\<Psi>\\<close> \\<open>A\\<^sub>Q \\<sharp>* Q\\<close> \\<open>A\\<^sub>Q \\<sharp>* M\\<close> \\<open>xvec \\<sharp>* Q\\<close>\n      by(rule_tac Comm1) (assumption | simp)+\n    hence \"\\<Psi> \\<rhd> !Q \\<longmapsto>\\<tau> \\<prec> (\\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> Q''))\" using \\<open>guarded Q\\<close> by(rule Bang)\n    moreover from \\<open>\\<Psi> \\<rhd> P'' \\<sim> R \\<parallel> !P\\<close> \\<open>guarded P\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> P'') \\<sim> \\<lparr>\\<nu>*xvec\\<rparr>((P' \\<parallel> R) \\<parallel> (P \\<parallel> !P))\"\n      by(metis bisimParPresSym bangExt bisimTransitive bisimParAssoc bisimSymmetric bisimResChainPres)\n    with \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>xvec \\<sharp>* P\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> P'') \\<sim> (\\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> R)) \\<parallel> (P \\<parallel> !P)\"\n      by(metis bisimScopeExtChainSym bisimTransitive psiFreshVec)\n    moreover from \\<open>\\<Psi> \\<rhd> Q'' \\<sim> T \\<parallel> !Q\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>xvec \\<sharp>* Q\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> Q'') \\<sim> (\\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> T)) \\<parallel> !Q\"\n      by(metis bisimParPresSym bisimTransitive bisimParAssoc bisimSymmetric bisimResChainPres bisimScopeExtChainSym psiFreshVec)\n    moreover from \\<open>\\<Psi> \\<rhd> R \\<sim> T\\<close> \\<open>\\<Psi> \\<rhd> Q' \\<sim> P'\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> R) \\<sim> \\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> T)\"\n      by(metis bisimParPresSym bisimTransitive bisimResChainPres bisimParComm bisimE(4))\n    moreover from suppR have \"((supp(\\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> R)))::name set) \\<subseteq>  supp((\\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> P'')))\"\n      by(auto simp add: psi.supp resChainSupp)\n    moreover from suppT have \"((supp(\\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> T)))::name set) \\<subseteq>  supp((\\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> Q'')))\"\n      by(auto simp add: psi.supp resChainSupp)\n    ultimately show ?case by blast\n  next\n    case(cComm2 M xvec N P' K P'' Q)\n    from \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> \\<open>\\<Psi> \\<rhd> P \\<longmapsto>M\\<lparr>\\<nu>*xvec\\<rparr>\\<langle>N\\<rangle> \\<prec> P'\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>xvec \\<sharp>* Q\\<close> \n    obtain Q' where QTrans: \"\\<Psi> \\<rhd> Q \\<longmapsto>M\\<lparr>\\<nu>*xvec\\<rparr>\\<langle>N\\<rangle> \\<prec> Q'\" and \"\\<Psi> \\<rhd> P' \\<sim> Q'\"\n      by(metis bisimE simE bn.simps)\n    from QTrans have \"\\<Psi> \\<otimes> SBottom' \\<rhd> Q \\<longmapsto>M\\<lparr>\\<nu>*xvec\\<rparr>\\<langle>N\\<rangle> \\<prec> Q'\" by(metis statEqTransition Identity AssertionStatEqSym)\n    moreover obtain A\\<^sub>Q \\<Psi>\\<^sub>Q where FrQ: \"extractFrame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\" and \"A\\<^sub>Q \\<sharp>* Q\" and \"A\\<^sub>Q \\<sharp>* M\" \n      by(rule_tac C=\"(\\<Psi>, Q, M)\" in freshFrame) auto\n    note FrQ\n    moreover from FrQ \\<open>guarded Q\\<close> have \"\\<Psi>\\<^sub>Q \\<simeq> SBottom'\" by(blast dest: guardedStatEq)\n    from \\<open>\\<Psi> \\<rhd> !P \\<longmapsto>K\\<lparr>N\\<rparr> \\<prec> P''\\<close> \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> \\<open>guarded Q\\<close>\n   obtain Q'' T R where QTrans': \"\\<Psi> \\<rhd> !Q \\<longmapsto>K\\<lparr>N\\<rparr> \\<prec> Q''\" and \"\\<Psi> \\<rhd> P'' \\<sim> R \\<parallel> !P\" and \"\\<Psi> \\<rhd> Q'' \\<sim> T \\<parallel> !Q\" and \"\\<Psi> \\<rhd> R \\<sim> T\"\n                    and suppR: \"((supp R)::name set) \\<subseteq> supp P''\" and suppT: \"((supp T)::name set) \\<subseteq> supp Q''\" using cComm2\n     by fastforce\n    from QTrans' \\<open>\\<Psi>\\<^sub>Q \\<simeq> SBottom'\\<close> have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>Q \\<rhd> !Q \\<longmapsto>K\\<lparr>N\\<rparr> \\<prec> Q''\" \n      by(metis statEqTransition Identity compositionSym AssertionStatEqSym)\n    moreover from \\<open>\\<Psi> \\<turnstile> M \\<leftrightarrow> K\\<close> \\<open>\\<Psi>\\<^sub>Q \\<simeq> SBottom'\\<close> have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>Q \\<otimes> SBottom' \\<turnstile> M \\<leftrightarrow> K\" by(metis statEqEnt Identity compositionSym AssertionStatEqSym)\n    ultimately have \"\\<Psi> \\<rhd> Q \\<parallel> !Q \\<longmapsto>\\<tau> \\<prec> (\\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> Q''))\" using \\<open>A\\<^sub>Q \\<sharp>* \\<Psi>\\<close> \\<open>A\\<^sub>Q \\<sharp>* Q\\<close> \\<open>A\\<^sub>Q \\<sharp>* M\\<close> \\<open>xvec \\<sharp>* Q\\<close>\n      by(rule_tac Comm2) (assumption | simp)+\n    hence \"\\<Psi> \\<rhd> !Q \\<longmapsto>\\<tau> \\<prec> (\\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> Q''))\" using \\<open>guarded Q\\<close> by(rule Bang)\n    moreover from \\<open>\\<Psi> \\<rhd> P'' \\<sim> R \\<parallel> !P\\<close> \\<open>guarded P\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> P'') \\<sim> \\<lparr>\\<nu>*xvec\\<rparr>((P' \\<parallel> R) \\<parallel> (P \\<parallel> !P))\"\n      by(metis bisimParPresSym bangExt bisimTransitive bisimParAssoc bisimSymmetric bisimResChainPres)\n    with \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>xvec \\<sharp>* P\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> P'') \\<sim> (\\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> R)) \\<parallel> (P \\<parallel> !P)\"\n      by(metis bisimScopeExtChainSym bisimTransitive psiFreshVec)\n    moreover from \\<open>\\<Psi> \\<rhd> Q'' \\<sim> T \\<parallel> !Q\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>xvec \\<sharp>* Q\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> Q'') \\<sim> (\\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> T)) \\<parallel> !Q\"\n      by(metis bisimParPresSym bisimTransitive bisimParAssoc bisimSymmetric bisimResChainPres bisimScopeExtChainSym psiFreshVec)\n    moreover from \\<open>\\<Psi> \\<rhd> R \\<sim> T\\<close> \\<open>\\<Psi> \\<rhd> P' \\<sim> Q'\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> R) \\<sim> \\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> T)\"\n      by(metis bisimParPresSym bisimTransitive bisimResChainPres bisimParComm)\n    moreover from suppR have \"((supp(\\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> R)))::name set) \\<subseteq>  supp((\\<lparr>\\<nu>*xvec\\<rparr>(P' \\<parallel> P'')))\"\n      by(auto simp add: psi.supp resChainSupp)\n    moreover from suppT have \"((supp(\\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> T)))::name set) \\<subseteq>  supp((\\<lparr>\\<nu>*xvec\\<rparr>(Q' \\<parallel> Q'')))\"\n      by(auto simp add: psi.supp resChainSupp)\n    ultimately show ?case by blast\n  next\n    case(cBang \\<alpha> P' Q)\n    then obtain Q' T R where QTrans: \"\\<Psi> \\<rhd> !Q \\<longmapsto>\\<alpha> \\<prec> Q'\" and \"\\<Psi> \\<rhd> P' \\<sim> R \\<parallel> (P \\<parallel> !P)\" and \"\\<Psi> \\<rhd> Q' \\<sim> T \\<parallel> !Q\" and \"\\<Psi> \\<rhd> R \\<sim> T\"\n                         and suppR: \"((supp R)::name set) \\<subseteq> supp P'\" and suppT: \"((supp T)::name set) \\<subseteq> supp Q'\"\n      by blast\n    from \\<open>\\<Psi> \\<rhd> P' \\<sim> R \\<parallel> (P \\<parallel> !P)\\<close> \\<open>guarded P\\<close> have \"\\<Psi> \\<rhd> P' \\<sim> R \\<parallel> !P\" by(metis bangExt bisimParPresSym bisimTransitive bisimSymmetric)\n    with QTrans show ?case using \\<open>\\<Psi> \\<rhd> Q' \\<sim> T \\<parallel> !Q\\<close> \\<open>\\<Psi> \\<rhd> R \\<sim> T\\<close> suppR suppT\n      by blast\n  qed\n  ultimately show ?thesis by blast\nqed\n\nlemma structCongBisim:\n  fixes P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"P \\<equiv>\\<^sub>s Q\"\n\n  shows \"P \\<sim> Q\"\nusing assms\nby(induct rule: structCong.induct)\n  (auto intro: bisimReflexive bisimSymmetric bisimTransitive bisimParComm bisimParAssoc bisimParNil bisimResNil bisimResComm bisimScopeExt bisimCasePushRes bisimInputPushRes bisimOutputPushRes bangExt)\n\nlemma bisimBangPres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<sim> Q\"\n  and     \"guarded P\"\n  and     \"guarded Q\"\n\n  shows \"\\<Psi> \\<rhd> !P \\<sim> !Q\"\nproof -\n  let ?X = \"{(\\<Psi>, R \\<parallel> !P, R \\<parallel> !Q) | \\<Psi> P Q R. \\<Psi> \\<rhd> P \\<sim> Q \\<and> guarded P \\<and> guarded Q}\"\n  let ?Y = \"{(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> ?X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n  from assms have \"(\\<Psi>, \\<zero> \\<parallel> !P, \\<zero> \\<parallel> !Q) \\<in> ?X\" by(blast intro: bisimReflexive)\n\n  moreover have \"eqvt ?X\" \n    apply(auto simp add: eqvt_def)\n    apply(drule_tac p=p in bisimClosed)\n    by fastforce\n  ultimately have \"\\<Psi> \\<rhd> \\<zero> \\<parallel> !P \\<sim> \\<zero> \\<parallel> !Q\"\n  proof(coinduct rule: weakTransitiveCoinduct)\n    case(cStatEq \\<Psi> P Q)\n    thus ?case by auto\n  next\n    case(cSim \\<Psi> RP RQ)\n    from \\<open>(\\<Psi>, RP, RQ) \\<in> ?X\\<close> obtain P Q R where \"\\<Psi> \\<rhd> P \\<sim> Q\" and \"guarded P\" and \"guarded Q\"\n                                           and \"RP = R \\<parallel> !P\" and \"RQ = R \\<parallel> !Q\"\n      by auto\n    note \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> \n    moreover from \\<open>eqvt ?X\\<close> have \"eqvt ?Y\" by blast\n    moreover note \\<open>guarded P\\<close> \\<open>guarded Q\\<close> bisimE(2) bisimE(3) bisimE(4) statEqBisim bisimClosed bisimParAssoc[THEN bisimSymmetric] \n                  bisimParPres bisimParPresAuxSym bisimResChainPres bisimScopeExtChainSym bisimTransitive\n    moreover have \"\\<And>\\<Psi> P Q R T. \\<lbrakk>\\<Psi> \\<rhd> P \\<sim> Q; (\\<Psi>, Q, R) \\<in> ?Y; \\<Psi> \\<rhd> R \\<sim> T\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, T) \\<in> ?Y\"\n      by auto (metis bisimTransitive)\n    moreover have \"\\<And>\\<Psi> P Q R. \\<lbrakk>\\<Psi> \\<rhd> P \\<sim> Q; guarded P; guarded Q\\<rbrakk> \\<Longrightarrow> (\\<Psi>, R \\<parallel> !P, R \\<parallel> !Q) \\<in> ?Y\" by(blast intro: bisimReflexive)\n    moreover have \"\\<And>\\<Psi> P \\<alpha> P' Q. \\<lbrakk>\\<Psi> \\<rhd> !P \\<longmapsto>\\<alpha> \\<prec> P'; \\<Psi> \\<rhd> P \\<sim> Q; bn \\<alpha> \\<sharp>* \\<Psi>;  bn \\<alpha> \\<sharp>* P;  bn \\<alpha> \\<sharp>* Q; guarded Q; bn \\<alpha> \\<sharp>* subject \\<alpha>\\<rbrakk> \\<Longrightarrow>\n                                         \\<exists>Q' R T.  \\<Psi> \\<rhd> !Q \\<longmapsto>\\<alpha> \\<prec> Q' \\<and> \\<Psi> \\<rhd> P' \\<sim> R \\<parallel> !P \\<and>  \\<Psi> \\<rhd> Q' \\<sim> T \\<parallel> !Q \\<and>\n                                                   \\<Psi> \\<rhd> R \\<sim> T \\<and> ((supp R)::name set) \\<subseteq> supp P' \\<and> \n                                                   ((supp T)::name set) \\<subseteq> supp Q'\"\n      by(blast elim: bangDerivative)\n    ultimately have \"\\<Psi> \\<rhd> R \\<parallel> !P \\<leadsto>[?Y] R \\<parallel> !Q\"\n      by(rule bangPres)\n    with \\<open>RP = R \\<parallel> !P\\<close> \\<open>RQ = R \\<parallel> !Q\\<close> show ?case\n      by blast\n  next\n    case(cExt \\<Psi> RP RQ \\<Psi>')\n    thus ?case by(blast dest: bisimE)\n  next\n    case(cSym \\<Psi> RP RQ)\n    thus ?case by(blast dest: bisimE)\n  qed\n  thus ?thesis\n    by(metis bisimTransitive bisimParNil bisimSymmetric bisimParComm)\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Bisim_Struct_Cong.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.607663184043154, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3322326462728403}}
{"text": "theory Type_Instances_Impl\n  imports Bot_Terms\n    TA_Clousure_Const\n    Regular_Tree_Relations.Tree_Automata_Class_Instances_Impl\nbegin\n\n\nsection \\<open>Type class instantiations for the implementation\\<close>\n\nderive linorder sum\nderive linorder bot_term\nderive linorder cl_states\n\nderive compare bot_term\nderive compare cl_states\n\nderive (eq) ceq bot_term mctxt cl_states\n\nderive (compare) ccompare bot_term cl_states\n\nderive (rbt) set_impl bot_term cl_states\n\nderive (no) cenum bot_term\n\ninstantiation cl_states :: cenum\nbegin\nabbreviation \"cl_all_list \\<equiv> [cl_state, tr_state, fin_state, fin_clstate]\"\ndefinition cEnum_cl_states :: \"(cl_states list \\<times> ((cl_states \\<Rightarrow> bool) \\<Rightarrow> bool) \\<times> ((cl_states \\<Rightarrow> bool) \\<Rightarrow> bool)) option\"\n  where \"cEnum_cl_states = Some (cl_all_list, (\\<lambda> P. list_all P cl_all_list),  (\\<lambda> P. list_ex P cl_all_list))\"\ninstance\n  apply intro_classes apply (auto simp: cEnum_cl_states_def elim!: cl_states.induct)\n  using cl_states.exhaust apply blast\n  by (metis cl_states.exhaust)\nend\n\nlemma infinite_bot_term_UNIV[simp, intro]: \"infinite (UNIV :: 'f bot_term set)\"\nproof -\n  fix f :: 'f\n  let ?inj = \"\\<lambda>n. BFun f (replicate n Bot)\"\n  have \"inj ?inj\" unfolding inj_on_def by auto\n  from infinite_super[OF _ range_inj_infinite[OF this]]\n  show ?thesis by blast\nqed\n\nlemma finite_cl_states: \"(UNIV :: cl_states set) = {cl_state, tr_state, fin_state, fin_clstate}\"\n  using cl_states.exhaust\n  by auto\n\ninstantiation cl_states :: card_UNIV begin\ndefinition \"finite_UNIV = Phantom(cl_states) True\"\ndefinition \"card_UNIV = Phantom(cl_states) 4\"\ninstance\n  by intro_classes (simp_all add: card_UNIV_cl_states_def finite_UNIV_cl_states_def finite_cl_states)\nend\n\ninstantiation bot_term :: (type) finite_UNIV\nbegin\ndefinition \"finite_UNIV = Phantom('a bot_term) False\"\ninstance\n  by (intro_classes, unfold finite_UNIV_bot_term_def, simp)\nend\n\n\ninstantiation bot_term :: (compare) cproper_interval\nbegin\ndefinition \"cproper_interval = (\\<lambda> ( _ :: 'a bot_term option) _ . False)\"\ninstance by (intro_classes, auto)\nend\n\ninstantiation cl_states :: cproper_interval\nbegin\n\n(* cl_all_list *)\ndefinition cproper_interval_cl_states :: \"cl_states option \\<Rightarrow> cl_states option \\<Rightarrow> bool\"\n  where \"cproper_interval_cl_states x y =\n   (case ID CCOMPARE(cl_states) of Some f \\<Rightarrow>\n   (case x of None \\<Rightarrow>\n     (case y of None \\<Rightarrow> True | Some c \\<Rightarrow> list_ex (\\<lambda> x. (lt_of_comp f) x c) cl_all_list)\n   | Some c \\<Rightarrow>\n     (case y of None \\<Rightarrow> list_ex (\\<lambda> x. (lt_of_comp f) c x) cl_all_list\n      | Some d \\<Rightarrow> (filter (\\<lambda> x. (lt_of_comp f) x d \\<and> (lt_of_comp f) c x) cl_all_list) \\<noteq> [])))\"\n\ninstance\nproof (intro_classes)\n  assume ass: \"(ID ccompare :: (cl_states \\<Rightarrow> cl_states \\<Rightarrow> order) option) \\<noteq> None\"\n  from ass obtain f where comp: \"(ID ccompare :: (cl_states \\<Rightarrow> cl_states \\<Rightarrow> order) option) = Some f\" by auto\n  let ?g = \"cproper_interval :: cl_states option \\<Rightarrow> cl_states option \\<Rightarrow> bool\"\n  have [simp]: \"x < y \\<longleftrightarrow> lt_of_comp f x y\" for x y\n    by (metis ID_Some ccompare_cl_states_def comp compare_cl_states_def less_cl_states_def option.sel)\n  {fix c d x assume \"lt_of_comp f x d\" \"lt_of_comp f c x\"\n    then have \"c < x\" \"x < d\" by simp_all}\n  moreover\n  {fix c d assume \"\\<exists> z. (c ::cl_states) < z \\<and> z < d\"\n    then obtain z where w: \"c < z \\<and> z < d\" by blast\n    then have \"z \\<in> set cl_all_list\" by (cases z) auto\n    moreover have \"lt_of_comp f z d \\<and> lt_of_comp f c z\" using w comp\n      by auto\n    ultimately have \"filter (\\<lambda>x. lt_of_comp f x d \\<and> lt_of_comp f c x) cl_all_list \\<noteq> []\" using w\n      by auto}\n  ultimately have \"filter (\\<lambda>x. lt_of_comp f x d \\<and> lt_of_comp f c x) cl_all_list \\<noteq> [] \\<longleftrightarrow> (\\<exists> z. c < z \\<and> z < d)\" for d c using comp\n    unfolding filter_empty_conv by simp blast\n  then have \"?g (Some x) (Some y) = (\\<exists> z. x < z \\<and> z < y)\" for x y\n    by (simp add: comp cproper_interval_cl_states_def)\n  moreover have \"?g None None = True\" by (simp add: comp cproper_interval_cl_states_def)\n  moreover have \"?g None (Some y) = (\\<exists>z. z < y)\" for y using comp\n    by (auto simp add: cproper_interval_cl_states_def ccompare_cl_states_def) (metis cl_states.exhaust)+\n  moreover have \"?g (Some y) None = (\\<exists>z. y < z)\" for y using comp\n    by (auto simp add: cproper_interval_cl_states_def) (metis cl_states.exhaust)+\n  ultimately show \"class.proper_interval cless ?g\"\n    unfolding class.proper_interval_def comp\n    by simp\nqed\nend\n\nderive (rbt) mapping_impl cl_states\nderive (rbt) mapping_impl bot_term\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/FO_Theory_Rewriting/Type_Instances_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.546738151984614, "lm_q1q2_score": 0.33223263850354784}}
{"text": "(*  Title:      Construct_SSA.thy\n    Author:     Sebastian Ullrich\n*)\n\nsection {* SSA Construction *}\nsubsection {* CFG to SSA CFG *}\n\ntheory Construct_SSA imports SSA_CFG\n  \"~~/src/HOL/Library/While_Combinator\"\n  \"~~/src/HOL/Library/Product_Lexorder\"\nbegin\n\ntype_synonym ('node, 'var) ssaVal = \"'var \\<times> 'node\"\n\nlocale CFG_Construct = CFG \\<alpha>n predecessors Entry \"defs\" \"uses\"\nfor\n  \\<alpha>n :: \"'node::linorder list\" and\n  predecessors :: \"'node \\<Rightarrow> 'node list\" and\n  Entry::\"'node\" and\n  \"defs\" :: \"'node \\<Rightarrow> 'var::linorder set\" and\n  \"uses\" :: \"'node \\<Rightarrow> 'var set\"\nbegin\n  fun phiDefNodes_aux :: \"'var \\<Rightarrow> 'node list \\<Rightarrow> 'node \\<Rightarrow> 'node set\" where\n    \"phiDefNodes_aux v unvisited n =(\n        if n \\<notin> set unvisited \\<or> v \\<in> defs n then {}\n        else fold (op \\<union>)\n          [phiDefNodes_aux v (removeAll n unvisited) m . m \\<leftarrow> predecessors n]\n          (if length (predecessors n) \\<noteq> 1 then {n} else {})\n    )\"\n\n  definition phiDefNodes :: \"'var \\<Rightarrow> 'node set\" where\n    \"phiDefNodes v \\<equiv> fold (op \\<union>)\n      [phiDefNodes_aux v \\<alpha>n n . n \\<leftarrow> \\<alpha>n, v \\<in> uses n]\n      {}\"\n\n  definition var :: \" ('node, 'var) ssaVal \\<Rightarrow> 'var\" where \"var \\<equiv> fst\"\n  abbreviation defNode :: \"('node, 'var) ssaVal \\<Rightarrow> 'node\" where \"defNode \\<equiv> snd\"\n\n  declare var_def[simp]\n\n  function lookupDef :: \"'node \\<Rightarrow> 'var \\<Rightarrow> ('node, 'var) ssaVal\" where\n    \"lookupDef n v =(\n        if n \\<notin> set \\<alpha>n then undefined\n        else if v \\<in> defs n then (v,n)\n        else case predecessors n of\n          [m] \\<Rightarrow> lookupDef m v\n          | _ \\<Rightarrow> (v,n)\n    )\"\n  by auto\n\n  termination by (relation \"measure (\\<lambda>(n,_). shortestPath n)\") (auto elim: shortestPath_single_predecessor)\n  declare lookupDef.simps [code]\n\n  definition defs' :: \"'node \\<Rightarrow> ('node, 'var) ssaVal set\" where\n    \"defs' n \\<equiv> (\\<lambda>v. (v,n)) ` defs n\"\n  definition uses' :: \"'node \\<Rightarrow> ('node, 'var) ssaVal set\" where\n    \"uses' n \\<equiv> lookupDef n ` uses n\"\n  definition phis' :: \" ('node, ('node, 'var) ssaVal) phis\" where\n    \"phis' \\<equiv> \\<lambda>(n,(v,m)).\n      if m = n \\<and> n \\<in> phiDefNodes v \\<and> v \\<in> vars then\n        Some [lookupDef m v . m \\<leftarrow> predecessors n]\n      else None\"\n  declare uses'_def [code] defs'_def [code] phis'_def [code]\n\n  abbreviation \"lookupDefNode n v \\<equiv> defNode (lookupDef n v)\"\n  declare lookupDef.simps [simp del]\n  declare phiDefNodes_aux.simps [simp del]\n\n  lemma phiDefNodes_aux_cases:\n    obtains (nonrec) \"phiDefNodes_aux v unvisited n = {}\" \"(n \\<notin> set unvisited \\<or> v \\<in> defs n)\"\n    | (rec) \"phiDefNodes_aux v unvisited n = fold union (map (phiDefNodes_aux v (removeAll n unvisited)) (predecessors n))\n          (if length (predecessors n) = 1 then {} else {n})\"\n       \"n \\<in> set unvisited\" \"v \\<notin> defs n\"\n  proof (cases \"n \\<in> set unvisited \\<and> v \\<notin> defs n\")\n    case True\n    thus ?thesis using rec by (simp add:phiDefNodes_aux.simps)\n  next\n    case False\n    thus ?thesis using nonrec by (simp add:phiDefNodes_aux.simps)\n  qed\n\n  lemma phiDefNode_aux_is_join_node:\n    assumes \"n \\<in> phiDefNodes_aux v un m\"\n    shows \"length (predecessors n) \\<noteq> 1\"\n  using assms proof (induction un arbitrary: m rule:removeAll_induct)\n    case (1 un m)\n    thus ?case\n    proof (cases un v m rule:phiDefNodes_aux_cases)\n      case rec\n      with 1 show ?thesis by (fastforce elim!:fold_union_elem split:split_if_asm)\n    qed auto\n  qed\n\n  lemma phiDefNode_is_join_node:\n    assumes \"n \\<in> phiDefNodes v\"\n    shows \"length (predecessors n) \\<noteq> 1\"\n  using assms unfolding phiDefNodes_def\n  by (auto elim!:fold_union_elem dest!:phiDefNode_aux_is_join_node)\n\n  abbreviation unvisitedPath :: \"'node list \\<Rightarrow> 'node list \\<Rightarrow> bool\" where\n    \"unvisitedPath un ns \\<equiv> distinct ns \\<and> set ns \\<subseteq> set un\"\n\n  lemma unvisitedPath_removeLast:\n    assumes \"unvisitedPath un ns\" \"length ns \\<ge> 2\"\n    shows \"unvisitedPath (removeAll (last ns) un) (butlast ns)\"\n  proof-\n    let ?n = \"last ns\"\n    let ?ns' = \"butlast ns\"\n    let ?un' = \"removeAll ?n un\"\n    let ?n' = \"last ?ns'\"\n    from assms(2) have [simp]: \"?n = ns ! (length ns - 1)\" by -(rule last_conv_nth, auto)\n    from assms(1) have \"distinct ?ns'\" by -(rule distinct_butlast, simp)\n    moreover\n    have \"set ?ns' \\<subseteq> set ?un'\"\n    proof\n      fix n\n      assume assm: \"n \\<in> set ?ns'\"\n      then obtain i where \"n = ?ns' ! i\" \"i < length ?ns'\" by (auto simp add:in_set_conv_nth)\n      hence i: \"n = ns ! i\" \"i < length ns - 1\" by (auto simp add:nth_butlast)\n      with assms have 1: \"n \\<noteq> ?n\" by (auto iff:nth_eq_iff_index_eq)\n      from i assms(1) have \"n \\<in> set un\" by auto\n      with `n \\<in> set ?ns'` assms(1) 1 show \"n \\<in> set ?un'\" by auto\n    qed\n    ultimately show ?thesis by simp\n  qed\n\n  lemma phiDefNodes_auxI:\n    assumes \"n\\<comment>ns\\<rightarrow>m\" \"unvisitedPath un ns\" \"\\<forall>n \\<in> set ns. v \\<notin> defs n\" \"length (predecessors n) \\<noteq> 1\"\n    shows \"n \\<in> phiDefNodes_aux v un m\"\n  using assms(1,2,3) proof (induction un arbitrary: m ns rule:removeAll_induct)\n    case (1 un)\n    show ?case\n    proof (cases un v m rule:phiDefNodes_aux_cases)\n      case nonrec\n      from \"1.prems\"(1) have \"m \\<in> set ns\" unfolding path2_def by auto\n      with nonrec show ?thesis using \"1.prems\"(2,3) by auto\n    next\n      case rec\n      show ?thesis\n      proof (cases \"n = m\")\n        case True\n        thus ?thesis using rec assms(4) by -(subst rec(1), rule fold_union_elemI[of _ \"{m}\"], auto)\n      next\n        case False\n        let ?ns' = \"butlast ns\"\n        let ?m' = \"last ?ns'\"\n        from \"1.prems\"(1) have [simp]: \"m = last ns\" unfolding path2_def by simp\n        with 1(2) False have ns': \"n\\<comment>?ns'\\<rightarrow>?m'\" \"?m' \\<in> set (predecessors m)\" by (auto intro: path2_unsnoc)\n\n        have \"n \\<in> phiDefNodes_aux v (removeAll m un) ?m'\"\n        using rec(2) ns'\n        apply-\n        proof (rule \"1.IH\")\n          from \"1.prems\"(1) False have \"length ns \\<ge> 2\" by (auto simp del:`m = last ns`)\n          with \"1.prems\"(2) show \"unvisitedPath (removeAll m un) ?ns'\" by (subst `m = last ns`, rule unvisitedPath_removeLast)\n          from \"1.prems\"(3) show \"\\<forall>n \\<in> set ?ns'. v \\<notin> defs n\" by (auto intro:in_set_butlastD)\n        qed\n        with ns'(2) show ?thesis by -(subst rec, rule fold_union_elemI, auto)\n      qed\n    qed\n  qed\n\n  lemma phiDefNodes_auxE:\n    assumes \"n \\<in> phiDefNodes_aux v un m\" \"m \\<in> set \\<alpha>n\"\n    obtains ns where \"n\\<comment>ns\\<rightarrow>m\" \"\\<forall>n \\<in> set ns. v \\<notin> defs n\" \"length (predecessors n) \\<noteq> 1\" \"unvisitedPath un ns\"\n  using assms proof (atomize_elim, induction un arbitrary:m rule:removeAll_induct)\n    case (1 un)\n    show ?case\n    proof (cases un v m rule:phiDefNodes_aux_cases)\n      case nonrec\n      thus ?thesis using \"1.prems\" by simp\n    next\n      case rec\n      show ?thesis\n      proof (cases \"n \\<in> (if length (predecessors m) = 1 then {} else {m})\")\n        case True\n        hence \"n = m\" by (simp split:split_if_asm)\n        thus ?thesis using \"1.prems\"(2) rec True by auto\n      next\n        case False\n        with rec \"1.prems\"(1) obtain m' where m': \"n \\<in> phiDefNodes_aux v (removeAll m un) m'\" \"m' \\<in> set (predecessors m)\"\n          by (auto elim!:fold_union_elem)\n        with \"1.prems\"(2) have \"m' \\<in> set \\<alpha>n\" by auto\n        with \"1.IH\"[of m m'] m' rec obtain ns where \"n\\<comment>ns\\<rightarrow>m'\" \"\\<forall>n \\<in> set ns. v \\<notin> defs n\" \"length (predecessors n) \\<noteq> 1\" \"unvisitedPath (removeAll m un) ns\" by auto\n        thus ?thesis using m' rec by -(rule exI, auto)\n      qed\n    qed\n  qed\n\n  lemma phiDefNodesE:\n    assumes \"n \\<in> phiDefNodes v\"\n    obtains ns m where \"n\\<comment>ns\\<rightarrow>m\" \"v \\<in> uses m\" \"\\<forall>n \\<in> set ns. v \\<notin> defs n\" \"length (predecessors n) \\<noteq> 1\"\n  using assms\n  by (auto elim!:phiDefNodes_auxE elim!:fold_union_elem simp:phiDefNodes_def)\n\n  lemma phiDefNodes_\\<alpha>n[dest]: \"n \\<in> phiDefNodes v \\<Longrightarrow> n \\<in> set \\<alpha>n\"\n  by (erule phiDefNodesE, auto)\n\n  lemma phiDefNodesI:\n    assumes \"n\\<comment>ns\\<rightarrow>m\" \"v \\<in> uses m\" \"\\<forall>n \\<in> set ns. v \\<notin> defs n\" \"length (predecessors n) \\<noteq> 1\"\n    shows \"n \\<in> phiDefNodes v\"\n  proof-\n    from assms(1) have \"m \\<in> set \\<alpha>n\" by (rule path2_in_\\<alpha>n, auto)\n    from assms obtain ns' where \"n\\<comment>ns'\\<rightarrow>m\" \"distinct ns'\" \"\\<forall>n \\<in> set ns'. v \\<notin> defs n\" by -(rule simple_path2, auto)\n    with assms(4) have 1: \"n \\<in> phiDefNodes_aux v \\<alpha>n m\" by -(rule phiDefNodes_auxI, auto intro:path2_in_\\<alpha>n)\n    thus ?thesis using assms(2) `m \\<in> set \\<alpha>n`\n    unfolding phiDefNodes_def\n    by -(rule fold_union_elemI, auto)\n  qed\n\n lemma phiDefNodes:\n    \"n \\<in> phiDefNodes v \\<longleftrightarrow> (\\<exists>ns m. n\\<comment>ns\\<rightarrow>m \\<and> v \\<in> uses m \\<and> (\\<forall>n \\<in> set ns. v \\<notin> defs n) \\<and> length (predecessors n) \\<noteq> 1)\"\n  by (auto intro!: phiDefNodesI exI elim!: phiDefNodesE)\n\n  lemma lookupDef_cases[consumes 1]:\n    assumes \"n \\<in> set \\<alpha>n\"\n    obtains (SimpleDef) \"v \\<in> defs n\" \"lookupDef n v = (v,n)\"\n          | (PhiDef)    \"v \\<notin> defs n\" \"length (predecessors n) \\<noteq> 1\" \"lookupDef n v = (v,n)\"\n          | (rec) m where \"v \\<notin> defs n\" \"predecessors n = [m]\" \"m \\<in> set \\<alpha>n\" \"lookupDef n v = lookupDef m v\"\n  proof (cases \"v \\<in> defs n\")\n    case True\n    thus thesis using assms SimpleDef by (simp add:lookupDef.simps)\n  next\n    case False\n    thus thesis\n    proof (cases \"length (predecessors n) = 1\")\n      case True\n      then obtain m where m: \"predecessors n = [m]\" by (cases \"predecessors n\", auto)\n      hence \"m \\<in> set (predecessors n)\" by simp\n      thus thesis using False rec assms m by -(subst(asm) lookupDef.simps, drule predecessor_is_node, auto)\n    next\n      case False\n      thus thesis using `v \\<notin> defs n` assms by -(rule PhiDef, assumption, assumption, subst lookupDef.simps, auto split:list.split)\n    qed\n  qed\n\n  lemma lookupDef_cases'[consumes 1]:\n    assumes \"n \\<in> set \\<alpha>n\"\n    obtains (SimpleDef) \"v \\<in> defs n\" \"defNode (lookupDef n v) = n\"\n          | (PhiDef)    \"v \\<notin> defs n\" \"length (predecessors n) \\<noteq> 1\" \"lookupDefNode n v = n\"\n          | (rec) m where \"v \\<notin> defs n\" \"predecessors n = [m]\" \"m \\<in> set \\<alpha>n\" \"lookupDef n v = lookupDef m v\"\n  using assms\n  by (rule lookupDef_cases[of n v]) simp_all\n\n  lemma lookupDefE:\n    assumes \"lookupDef n v = v'\" \"n \\<in> set \\<alpha>n\"\n    obtains (SimpleDef) \"v \\<in> defs n\" \"v' = (v,n)\"\n          | (PhiDef)    \"v \\<notin> defs n\" \"length (predecessors n) \\<noteq> 1\" \"v' = (v,n)\"\n          | (rec) m where \"v \\<notin> defs n\" \"predecessors n = [m]\" \"m \\<in> set \\<alpha>n\" \"v' = lookupDef m v\"\n  using assms by -(atomize_elim, cases rule:lookupDef_cases[of n v], auto)\n\n  lemma lookupDef_induct[consumes 1, case_names SimpleDef PhiDef rec]:\n    assumes \"n \\<in> set \\<alpha>n\"\n            \"\\<And>n. \\<lbrakk>n \\<in> set \\<alpha>n; v \\<in> defs n; lookupDef n v = (v,n)\\<rbrakk> \\<Longrightarrow> P n\"\n            \"\\<And>n. \\<lbrakk>n \\<in> set \\<alpha>n; v \\<notin> defs n; length (predecessors n) \\<noteq> 1; lookupDef n v = (v,n)\\<rbrakk> \\<Longrightarrow> P n\"\n            \"\\<And>n m. \\<lbrakk>v \\<notin> defs n; predecessors n = [m]; m \\<in> set \\<alpha>n; lookupDef n v = lookupDef m v; P m\\<rbrakk> \\<Longrightarrow> P n\"\n    shows \"P n\"\n  apply (induct rule:lookupDef.induct[where P = \"\\<lambda>n v'. v'=v \\<and> n \\<in> set \\<alpha>n \\<longrightarrow> P n\", of v n, simplified (no_asm), THEN mp])\n   apply clarsimp\n   apply (rule_tac v=v and n=n in lookupDef_cases; auto intro: assms lookupDef_cases)\n  by (rule assms(1))\n\n  lemma lookupDef_induct'[consumes 2, case_names SimpleDef PhiDef rec]:\n    assumes \"n \\<in> set \\<alpha>n\" \"lookupDef n v = (v,n')\"\n            \"\\<lbrakk>v \\<in> defs n'\\<rbrakk> \\<Longrightarrow> P n'\"\n            \"\\<lbrakk>v \\<notin> defs n'; length (predecessors n') \\<noteq> 1\\<rbrakk> \\<Longrightarrow> P n'\"\n            \"\\<And>n m. \\<lbrakk>v \\<notin> defs n; predecessors n = [m]; m \\<in> set \\<alpha>n; lookupDef n v = lookupDef m v; P m\\<rbrakk> \\<Longrightarrow> P n\"\n    shows \"P n\"\n    using assms(1,2)\n    proof (induction rule:lookupDef_induct[where v=v])\n      case (SimpleDef n)\n      with assms(2) have \"n = n'\" by auto\n      with SimpleDef assms(3) show ?case by simp\n    next\n      case (PhiDef n)\n      with assms(2) have \"n = n'\" by auto\n      with PhiDef assms(4) show ?case by simp\n    qed (rule assms(5), simp_all)\n\n  lemma lookupDef_looksup[dest?]:\n    assumes \"lookupDef n v = (v',n')\" \"n \\<in> set \\<alpha>n\"\n    shows \"v' = v\"\n  using assms(1) assms(2) by (induction rule:lookupDef.induct) (auto elim:lookupDefE)\n\n  lemma lookupDef_looksup':\n    assumes \"(v',n') = lookupDef n v\" \"n \\<in> set \\<alpha>n\"\n    shows \"v' = v\"\n  using assms(1)[symmetric] assms(2) by (rule lookupDef_looksup)\n\n  \n\n  lemma lookupDef_fst[simp]: \"n \\<in> set \\<alpha>n \\<Longrightarrow> fst (lookupDef n v) = v\"\n  by (metis fst_conv lookupDef_looksup'')\n\n  lemma lookupDef_to_\\<alpha>n:\n    assumes \"lookupDef n v = (v',n')\" \"n \\<in> set \\<alpha>n\"\n    shows \"n' \\<in> set \\<alpha>n\"\n  using assms(2,1)\n  by (induction rule:lookupDef_induct[of n v]) simp_all\n\n  lemma lookupDef_to_\\<alpha>n':\n    assumes \"lookupDef n v = val\" \"n \\<in> set \\<alpha>n\"\n    shows \"defNode val \\<in> set \\<alpha>n\"\n  using assms by (cases val) (auto simp:lookupDef_to_\\<alpha>n)\n\n  lemma lookupDef_induct''[consumes 2, case_names SimpleDef PhiDef rec]:\n    assumes \"lookupDef n v = val\" \"n \\<in> set \\<alpha>n\"\n            \"\\<lbrakk>v \\<in> defs (defNode val)\\<rbrakk> \\<Longrightarrow> P (defNode val)\"\n            \"\\<lbrakk>v \\<notin> defs (defNode val); length (predecessors (defNode val)) \\<noteq> 1\\<rbrakk> \\<Longrightarrow> P (defNode val)\"\n            \"\\<And>n m. \\<lbrakk>v \\<notin> defs n; predecessors n = [m]; m \\<in> set \\<alpha>n; lookupDef n v = lookupDef m v; P m\\<rbrakk> \\<Longrightarrow> P n\"\n    shows \"P n\"\n  using assms\n  apply (cases val)\n  apply (simp)\n  apply (erule lookupDef_induct')\n  using assms(2) by (auto dest: lookupDef_looksup)\n\n  sublocale braun_ssa: CFG_SSA_base \\<alpha>n predecessors Entry defs' uses' phis'\n    by unfold_locales\n\n  lemma defs'_finite: \"finite (defs' n)\"\n  unfolding defs'_def using defs_finite\n  by simp\n\n  lemma uses'_finite: \"finite (uses' n)\"\n  unfolding uses'_def using uses_finite\n  by simp\n\n  lemma defs'_uses'_disjoint: \"n \\<in> set \\<alpha>n \\<Longrightarrow> defs' n \\<inter> uses' n = {}\"\n  unfolding defs'_def uses'_def using defs_uses_disjoint\n  by (auto dest:lookupDef_looksup')\n\n  \n\n  lemma phiDefNodes_aux_finite: \"finite (phiDefNodes_aux v un m)\"\n  proof (induction un arbitrary:m rule:removeAll_induct)\n    case (1 un)\n    thus ?case by (cases un v m rule:phiDefNodes_aux_cases) auto\n  qed\n\n  lemma phis'_finite: \"finite (dom (phis'))\"\n  proof-\n    let ?super = \"set \\<alpha>n \\<times> vars \\<times> set \\<alpha>n\"\n    have \"finite ?super\" by auto\n    thus ?thesis\n    by - (rule finite_subset[of _ ?super], auto simp:phis'_def split:split_if_asm)\n  qed\n\n  lemma phis'_wf: \"phis' (n, v) = Some args \\<Longrightarrow> length (predecessors n) = length args\"\n  unfolding phis'_def by (auto split:prod.splits split_if_asm)\n\n  lemma simpleDefs_phiDefs_disjoint: \"n \\<in> set \\<alpha>n \\<Longrightarrow> defs' n \\<inter> braun_ssa.phiDefs n = {}\"\n  unfolding braun_ssa.phiDefs_def\n  unfolding phis'_def defs'_def\n  by (auto elim!: phiDefNodesE dest!: path2_hd_in_ns split: split_if_asm)\n\n  lemma oldDefs_correct: \"defs n = var ` defs' n\"\n  by (simp add:defs'_def image_image)\n\n  lemma oldUses_correct: \"n \\<in> set \\<alpha>n \\<Longrightarrow> uses n = var ` uses' n\"\n  by (simp add:uses'_def image_image)\n\n  sublocale braun_ssa: CFG_SSA \\<alpha>n predecessors Entry defs' uses' phis'\n  apply unfold_locales\n          apply (rule defs'_uses'_disjoint, simp_all)\n         apply (rule defs'_finite)\n        apply (auto simp add: uses'_def uses_in_\\<alpha>n)[1]\n       apply (rule uses'_finite)\n      apply (rule phis'_finite)\n     apply (auto simp: phis'_def split: split_if_asm)[1]\n    apply (erule phis'_wf)\n   apply (erule simpleDefs_phiDefs_disjoint)\n  by (erule allDefs'_disjoint)\nend\n\ncontext CFG_Construct\nbegin\n  lemma no_disjoint_cycle[simp]:\n    assumes \"n\\<comment>ns\\<rightarrow>n\" \"distinct ns\"\n    shows \"ns = [n]\"\n  using assms unfolding path2_def\n  by (metis distinct.simps(2) hd_Cons_tl last_in_set last_tl path_not_Nil)\n\n  lemma lookupDef_path:\n    assumes \"m \\<in> set \\<alpha>n\"\n    obtains ns where  \"lookupDefNode m v\\<comment>ns\\<rightarrow>m\" \"(\\<forall>x \\<in> set (tl ns). v \\<notin> defs x)\"\n  apply atomize_elim\n  using assms proof (induction rule:lookupDef_induct[of m v])\n    case (SimpleDef n)\n    thus ?case by -(rule exI[of _ \"[n]\"], auto)\n  next\n    case (PhiDef n)\n    thus ?case by -(rule exI[of _ \"[n]\"], auto)\n  next\n    case (rec m m')\n    then obtain ns where \"lookupDefNode m v\\<comment>ns\\<rightarrow>m'\" \"\\<forall>x \\<in> set (tl ns). v \\<notin> defs x\" by auto\n    with rec.hyps(1,2) show ?case by - (rule exI[of _ \"ns@[m]\"], auto simp: path2_not_Nil)\n  qed\n\n  lemma lookupDef_path_conventional:\n    assumes \"n\\<comment>ns\\<rightarrow>m\" \"n = lookupDefNode m v\" \"n \\<notin> set (tl ns)\" \"x \\<in> set (tl ns)\" \"v' \\<in> braun_ssa.allDefs x\"\n    shows \"var v' \\<noteq> v\"\n  using assms(1-4) proof (induction rule:path2_rev_induct)\n    case empty\n    from empty.prems(3) have False by simp\n    thus ?case ..\n  next\n    case (snoc ns m m')\n    note snoc.prems(1)[simp]\n    from snoc.hyps have p: \"n\\<comment>ns@[m']\\<rightarrow>m'\" by auto\n    hence \"m' \\<in> set \\<alpha>n\" by auto\n    thus ?thesis\n    proof (cases rule:lookupDef_cases'[of m' v])\n      case SimpleDef\n      with snoc.prems(2,3) have False by (simp add:tl_append split:list.split_asm)\n      thus ?thesis ..\n    next\n      case PhiDef\n      with snoc.prems(2,3) have False by (simp add:tl_append split:list.split_asm)\n      thus ?thesis ..\n    next\n      case (rec m\\<^sub>2)\n      from this(2) snoc.hyps(2) have[simp]: \"m\\<^sub>2 = m\" by simp\n      show ?thesis\n      proof (cases \"x \\<in> set (tl ns)\")\n        case True\n        with rec(4) snoc.prems(2) show ?thesis by - (rule snoc.IH, simp_all add:tl_append split:list.split_asm)\n      next\n        case False\n        with snoc.prems(3) have[simp]: \"x = m'\" by (simp add:tl_append split:list.split_asm)\n\n        show ?thesis\n        proof (cases \"v' \\<in> defs' x\")\n          case True\n          with rec(1) show ?thesis by (auto simp add:defs'_def)\n        next\n          case False\n          with assms(5) have \"v' \\<in> braun_ssa.phiDefs m'\" by (simp add:braun_ssa.allDefs_def)\n          hence \"m' \\<in> phiDefNodes (fst v')\"\n            unfolding braun_ssa.phiDefs_def by (auto simp add: phis'_def split:prod.split_asm split_if_asm)\n          with rec(2) show ?thesis by (auto dest:phiDefNode_is_join_node)\n        qed\n      qed\n    qed\n  qed\n\n  lemma allUse_lookupDef:\n    assumes \"v \\<in> braun_ssa.allUses m\" \"m \\<in> set \\<alpha>n\"\n    shows \"lookupDef m (var v) = v\"\n  proof (cases \"v \\<in> uses' m\")\n    case True\n    then obtain v' where v': \"v = lookupDef m v'\" \"v' \\<in> uses m\" by (auto simp add:uses'_def)\n    with assms(2) have \"var v = v'\" unfolding var_def by (metis lookupDef_fst)\n    with v' show ?thesis by simp\n  next\n    case False\n    with assms(1) obtain  m' v' vs where \"(m,v) \\<in> set (zip (predecessors m') vs)\" \"phis' (m', v') = Some vs\"\n      by (auto simp add:braun_ssa.allUses_def elim:braun_ssa.phiUsesE)\n    hence l: \"v = lookupDef m (var v')\" by (auto simp add:phis'_def split:prod.split_asm split_if_asm elim:in_set_zip_map)\n    with assms(2) have \"var v = var v'\" unfolding var_def by (metis lookupDef_fst)\n    with l show ?thesis by simp\n  qed\n\n  lemma phis'_fst:\n    assumes \"phis' (n,v) = Some vs\" \"v' \\<in> set vs\"\n    shows \"var v' = var v\"\n  using assms by (auto intro!:lookupDef_fst dest!:phiDefNodes_\\<alpha>n simp add:phis'_def split:prod.split_asm split_if_asm)\n\n  lemma allUse_simpleUse:\n    assumes \"v \\<in> braun_ssa.allUses m\" \"m \\<in> set \\<alpha>n\"\n    obtains ms m' where \"m\\<comment>ms\\<rightarrow>m'\" \"var v \\<in> uses m'\" \"\\<forall>x \\<in> set (tl ms). var v \\<notin> defs x\"\n  proof (cases \"v \\<in> uses' m\")\n    case True\n    then obtain v' where v': \"v = lookupDef m v'\" \"v' \\<in> uses m\" by (auto simp add:uses'_def)\n    with assms(2) have \"var v = v'\" unfolding var_def by (metis lookupDef_fst)\n    with v' assms(2) show ?thesis by - (rule that, auto)\n  next\n    case False\n    with assms(1) obtain  m' v' vs where phi: \"(m,v) \\<in> set (zip (predecessors m') vs)\" \"phis' (m', v') = Some vs\"\n      by (auto simp add:braun_ssa.allUses_def elim:braun_ssa.phiUsesE)\n    hence m': \"m' \\<in> phiDefNodes (var v')\" by (auto simp add:phis'_def split:prod.split_asm split_if_asm)\n    from phi have[simp]: \"var v = var v'\" by - (rule phis'_fst, auto)\n    from m' obtain m'' ms where \"m'\\<comment>ms\\<rightarrow>m''\" \"\\<forall>x \\<in> set ms. var v' \\<notin> defs x\" \"var v' \\<in> uses m''\" by (rule phiDefNodesE)\n    with phi(1) show ?thesis by - (rule that[of \"m#ms\" m''], auto simp del:var_def)\n  qed\n\n  lemma defs': \"v \\<in> defs' n \\<longleftrightarrow> var v \\<in> defs n \\<and> defNode v = n\"\n  by (cases v, auto simp add:defs'_def)\n\n  lemma use_implies_allDef:\n    assumes \"lookupDef m (var v) = v\"  \"m \\<in> set \\<alpha>n\" \"var v \\<in> uses m'\" \"m\\<comment>ms\\<rightarrow>m'\" \"\\<forall>x \\<in> set (tl ms). var v \\<notin> defs x\"\n    shows \"v \\<in> braun_ssa.allDefs (defNode v)\"\n  using assms proof (induction arbitrary:ms rule:lookupDef_induct'')\n      case SimpleDef\n      hence \"v \\<in> defs' (defNode v)\" by (simp add:defs')\n      thus ?case by (simp add:braun_ssa.allDefs_def)\n    next\n      case PhiDef\n      from PhiDef.prems(1,2) have vars: \"var v \\<in> vars\" by auto\n      from PhiDef.hyps(1) PhiDef.prems(2,3) have \"\\<forall>n\\<in>set ms. var v \\<notin> defs n\" by (metis hd_Cons_tl path2_def path2_not_Nil set_ConsD)\n      with PhiDef have \"defNode v \\<in> phiDefNodes (var v)\" by - (rule phiDefNodesI)\n      with vars have \"v \\<in> braun_ssa.phiDefs (defNode v)\" unfolding braun_ssa.phiDefs_def by (auto simp add: phis'_def split: prod.split)\n      thus ?case by (simp add:braun_ssa.allDefs_def)\n    next\n      case (rec n m)\n      from rec.hyps(1) rec.prems(2,3) have \"\\<forall>n\\<in>set ms. var v \\<notin> defs n\" by (metis hd_Cons_tl path2_def path2_not_Nil set_ConsD)\n      with rec show ?case by - (rule rec.IH[of \"m#ms\"], auto)\n    qed\n\n  lemma allUse_defNode_in_\\<alpha>n:\n    assumes \"v \\<in> braun_ssa.allUses m\" \"m \\<in> set \\<alpha>n\"\n    shows \"defNode v \\<in> set \\<alpha>n\"\n  proof-\n    let ?n = \"defNode (lookupDef m (var v))\"\n    from assms(1,2) have l: \"lookupDef m (var v) = v\" by (rule allUse_lookupDef)\n    from assms obtain ns where ns: \"?n\\<comment>ns\\<rightarrow>m\" by - (rule lookupDef_path, auto)\n    with l show ?thesis by auto\n  qed\n\n  lemma allUse_implies_allDef:\n    assumes \"v \\<in> braun_ssa.allUses m\" \"m \\<in> set \\<alpha>n\"\n    shows \"v \\<in> braun_ssa.allDefs (defNode v)\"\n  proof-\n    let ?n = \"defNode (lookupDef m (var v))\"\n    from assms(1,2) have l: \"lookupDef m (var v) = v\" by (rule allUse_lookupDef)\n    from assms obtain ns where ns: \"?n\\<comment>ns\\<rightarrow>m\" \"\\<forall>x \\<in> set (tl ns). var v \\<notin> defs x\" by - (rule lookupDef_path, auto)\n    from assms obtain ms m' where \"m\\<comment>ms\\<rightarrow>m'\" \"var v \\<in> uses m'\" \"\\<forall>x \\<in> set (tl ms). var v \\<notin> defs x\" by - (rule allUse_simpleUse)\n    hence \"v \\<in> braun_ssa.allDefs (defNode v)\" using ns assms(2) l by - (rule use_implies_allDef, auto)\n    with assms(2) l show ?thesis by simp\n  qed\n\n  lemma conventional:\n    assumes \"n\\<comment>ns\\<rightarrow>m\" \"n \\<notin> set (tl ns)\" \"v \\<in> braun_ssa.allDefs n\" \"v \\<in> braun_ssa.allUses m\"\n      \"x \\<in> set (tl ns)\" \"v' \\<in> braun_ssa.allDefs x\"\n    shows \"var v' \\<noteq> var v\"\n  proof-\n    from assms(1) have[simp]: \"m \\<in> set \\<alpha>n\" by auto\n    from assms(4) have[simp]: \"lookupDef m (var v) = v\" by - (rule allUse_lookupDef, auto)\n\n    from assms(1,4) have \"v \\<in> braun_ssa.allDefs (defNode v)\" by - (rule allUse_implies_allDef, auto)\n    with assms(1,3,4) braun_ssa.allDefs_disjoint[of n \"defNode v\"] have[simp]: \"defNode v = n\" by - (rule braun_ssa.allDefs_disjoint', auto elim: allUse_defNode_in_\\<alpha>n)\n\n    from assms show ?thesis by - (rule lookupDef_path_conventional[where m=m], simp_all add:uses'_def del:var_def)\n  qed\n\n  lemma allDefs_var_disjoint_aux: \"n \\<in> set \\<alpha>n \\<Longrightarrow> v \\<in> defs n \\<Longrightarrow> n \\<notin> phiDefNodes v\"\n    by (auto elim!:phiDefNodesE dest:path2_hd_in_ns)\n\n  lemma allDefs_var_disjoint: \"\\<lbrakk>n \\<in> set \\<alpha>n; v \\<in> braun_ssa.allDefs n; v' \\<in> braun_ssa.allDefs n; v \\<noteq> v'\\<rbrakk> \\<Longrightarrow> var v' \\<noteq> var v\"\n    unfolding braun_ssa.allDefs_def braun_ssa.phiDefs_def\n    by (auto simp: defs'_def phis'_def intro: allDefs_var_disjoint_aux split:prod.splits split_if_asm)\n\n  \n\n  lemma[simp]: \"n \\<in> set \\<alpha>n \\<Longrightarrow> length (predecessors n) \\<noteq> 1 \\<Longrightarrow> lookupDefNode n v = n\"\n  by (cases rule:lookupDef_cases[of n v]) simp_all\n\n  lemma lookupDef_idem[simp]:\n    assumes \"n \\<in> set \\<alpha>n\"\n    shows \"lookupDef (lookupDefNode n v) v = lookupDef n v\"\n  using assms by (induction rule:lookupDef_induct''[of n v, OF refl]) (simp_all add:assms)\nend\n\nlocale CFG_Construct_wf = CFG_Construct \\<alpha>n predecessors Entry \"defs\" \"uses\" + CFG_wf \\<alpha>n predecessors Entry \"defs\" \"uses\"\nfor\n  \\<alpha>n :: \"'node::linorder list\" and\n  predecessors :: \"'node \\<Rightarrow> 'node list\" and\n  Entry::\"'node\" and\n  \"defs\" :: \"'node \\<Rightarrow> 'var::linorder set\" and\n  \"uses\" :: \"'node \\<Rightarrow> 'var set\"\nbegin\n  lemma def_ass_allUses_aux:\n    assumes \"Entry\\<comment>ns\\<rightarrow>n\"\n    shows \"lookupDefNode n (var v) \\<in> set ns\"\n  proof-\n    from assms have[simp]: \"n \\<in> set \\<alpha>n\" by auto\n    thus ?thesis using assms\n    proof (induction arbitrary:ns rule:lookupDef_induct''[of n \"var v\", OF refl, consumes 1])\n      case (3 m m' ns)\n      show ?case\n      proof (cases \"length ns \\<ge> 2\")\n        case False\n        with \"3.prems\" have \"m = Entry\" by (metis path2_nontrivial)\n        with \"3.hyps\"(2) have False by simp\n        thus ?thesis ..\n      next\n        case True\n        with \"3.prems\" have \"Entry\\<comment>butlast ns\\<rightarrow>m'\"\n        by (rule path2_unsnoc) (simp add:\"3.hyps\"(2))\n        with \"3.hyps\" \"3.IH\"[of \"butlast ns\"] show ?thesis by (simp add:in_set_butlastD)\n      qed\n    qed auto\n  qed\n\n  lemma def_ass_allUses:\n    assumes \"v \\<in> braun_ssa.allUses n\" \"n \\<in> set \\<alpha>n\"\n    shows \"braun_ssa.defAss n v\"\n  proof (rule braun_ssa.defAssI)\n    fix ns\n    assume asm: \"Entry\\<comment>ns\\<rightarrow>n\"\n    let ?m = \"lookupDefNode n (var v)\"\n    from asm have \"?m \\<in> set ns\" by (rule def_ass_allUses_aux)\n    moreover from assms allUse_lookupDef have \"?m = defNode v\" by simp\n    moreover from assms allUse_implies_allDef have \"v \\<in> braun_ssa.allDefs (defNode v)\" by simp\n    ultimately show \"\\<exists>n\\<in>set ns. v \\<in> braun_ssa.allDefs n\" by auto\n  qed\n\n  lemma Empty_no_phis:\n    shows \"phis' (Entry, v) = None\"\n  proof-\n    have \"\\<And>v. Entry \\<notin> phiDefNodes v\"\n    proof (rule, rule phiDefNodesE, assumption)\n      fix v ns m\n      assume asm: \"Entry\\<comment>ns\\<rightarrow>m\" \"\\<forall>n\\<in>set ns. v \\<notin> defs n\" \"v \\<in> uses m\"\n      hence \"m \\<in> set \\<alpha>n\" by auto\n      from def_ass_uses[of, THEN bspec[OF _ this], THEN bspec[OF _ asm(3)]] asm\n      show False by (auto elim!:defAss'E)\n    qed\n    thus ?thesis by (auto simp:phis'_def split:prod.split)\n  qed\n\n  lemma braun_ssa_CFG_SSA_wf:\n    \"CFG_SSA_wf \\<alpha>n predecessors Entry defs' uses' phis'\"\n  apply unfold_locales\n   apply (erule def_ass_allUses, assumption)\n  apply (rule Empty_no_phis)\n  done\n\n  sublocale braun_ssa: CFG_SSA_wf \\<alpha>n predecessors Entry defs' uses' phis'\n  by (rule braun_ssa_CFG_SSA_wf)\n\n  lemma braun_ssa_CFG_SSA_Transformed:\n    \"CFG_SSA_Transformed \\<alpha>n predecessors Entry defs uses defs' uses' phis' var\"\n  apply unfold_locales\n      apply (rule oldDefs_correct)\n     apply (erule oldUses_correct)\n    apply (erule conventional, simp, simp, simp, simp, simp)\n   apply (erule phis'_fst, simp)\n  apply (erule allDefs_var_disjoint, simp, simp, simp)\n  done\n\n  sublocale braun_ssa: CFG_SSA_Transformed \\<alpha>n predecessors Entry \"defs\" \"uses\" defs' uses' phis' var\n  by (rule braun_ssa_CFG_SSA_Transformed)\n\n  lemma PhiDef_defNode_eq:\n    assumes \"n \\<in> set \\<alpha>n\" \"n \\<in> phiDefNodes v\" \"v \\<in> vars\"\n    shows \"braun_ssa.defNode (v,n) = n\"\n  using assms by - (rule braun_ssa.defNode_eq, rule assms(1), subst braun_ssa.allDefs_def, subst braun_ssa.phiDefs_def, auto simp: phis'_def)\n\n  lemma phiDefNodes_aux_pruned_aux:\n    assumes \"n \\<in> phiDefNodes_aux v \\<alpha>n nUse\" \"v \\<in> uses nUse\" \"n\\<comment>ns\\<rightarrow>m\" \"m\\<comment>ms\\<rightarrow>nUse\" \"braun_ssa.liveVal (lookupDef m v)\" \"\\<forall>n \\<in> set (ns@ms). v \\<notin> defs n\"\n    shows \"braun_ssa.liveVal (v,n)\"\n  using assms(3-) proof (induction n ns m arbitrary:ms rule:path2_rev_induct)\n    case empty\n    with assms(1) have \"lookupDef n v = (v,n)\"\n      by -(drule phiDefNode_aux_is_join_node, cases rule:lookupDef_cases, auto)\n    with empty.prems(2) show ?case by simp\n  next\n    case (snoc ns m m')\n    from snoc.prems have \"m' \\<in> set \\<alpha>n\" by auto\n    thus ?case\n    proof (cases rule:lookupDef_cases[where v=v])\n      case SimpleDef\n      with snoc.prems(3) have False by simp\n      thus ?thesis..\n    next\n      have step: \"braun_ssa.liveVal (lookupDef m v) \\<Longrightarrow> ?thesis\"\n      proof (rule snoc.IH)\n        from snoc.prems(1) snoc.hyps(2) show \"m\\<comment>m#ms\\<rightarrow>nUse\" by auto\n        from snoc.prems(3) snoc.hyps(1) show \"\\<forall>n\\<in> set(ns @ m # ms). v \\<notin> defs n\" by auto\n      qed\n      {\n        case rec\n        from snoc.hyps(2) rec(2) have[simp]: \"predecessors m' = [m]\" by auto\n        with rec snoc.prems(2) have \"braun_ssa.liveVal (lookupDef m v)\" by auto\n        with step show ?thesis.\n      next\n        case PhiDef\n        with snoc assms(2) have phiDefNode: \"m' \\<in> phiDefNodes v\" by -(rule phiDefNodesI, auto)\n        from assms(2,4) have vars: \"v \\<in> vars\" by auto\n        have \"braun_ssa.liveVal (lookupDef m v)\"\n        proof (rule braun_ssa.livePhi)\n          from PhiDef(3) snoc.prems(2) show \"braun_ssa.liveVal (v,m')\" by simp\n          from phiDefNode snoc.hyps(2) vars show \"braun_ssa.phiArg (v,m') (lookupDef m v)\"\n            by (subst braun_ssa.phiArg_def, subst braun_ssa.phi_def, subst PhiDef_defNode_eq, auto simp: phis'_def)\n        qed\n        thus ?thesis by (rule step)\n      }\n    qed\n  qed\n\n  lemma phiDefNodes_aux_pruned:\n    assumes \"m \\<in> phiDefNodes_aux v \\<alpha>n n\" \"n \\<in> set \\<alpha>n\" \"v \\<in> uses n\"\n    shows \"braun_ssa.liveVal (v, m)\"\n  proof-\n    from assms(1,2) obtain ns where ns: \"m\\<comment>ns\\<rightarrow>n\" \"\\<forall>n \\<in> set ns. v \\<notin> defs n\" by (rule phiDefNodes_auxE)\n    hence \"v \\<notin> defs n\" by (auto dest:path2_last simp: path2_not_Nil)\n    with ns assms(1,3) show ?thesis\n    apply-\n    proof (rule phiDefNodes_aux_pruned_aux)\n      from assms(2,3) show \"braun_ssa.liveVal (lookupDef n v)\" by -(rule braun_ssa.liveSimple, auto simp add:uses'_def)\n    qed auto\n  qed\n\n  theorem phis'_pruned: \"braun_ssa.pruned\"\n  unfolding braun_ssa.pruned_def braun_ssa.phiDefs_def\n  apply (subst phis'_def)\n  by (auto split:prod.splits split_if_asm simp add:phiDefNodes_def elim!:fold_union_elem phiDefNodes_aux_pruned)\n\n  declare var_def[simp del]\n\n  declare no_disjoint_cycle [simp del]\n\n  declare lookupDef.simps [code]\n  declare phiDefNodes_aux.simps [code]\n  declare phiDefNodes_def [code]\n  declare defs'_def [code]\n  declare uses'_def [code]\n  declare phis'_def [code]\nend\n\nend\n", "meta": {"author": "lohner", "repo": "FormalSSA", "sha": "34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e", "save_path": "github-repos/isabelle/lohner-FormalSSA", "path": "github-repos/isabelle/lohner-FormalSSA/FormalSSA-34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e/Construct_SSA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3322326385035477}}
{"text": "(*<*)\ntheory Simulation imports HOTL\nbegin\n(*>*)\nsubsection \\<open>Simulation \\label{subsec:Simulation}\\<close>\n\ntext\\<open>\\noindent %\nThis section is made up of four parts. \nIn \\ref{subsubsec:pre} basic notions are defined that will be\nused throughout the remainder of the section.\nPart \\ref{subsubsec:t1} gives an axiomatization of what is valid at @{text \"t\\<^sub>1\"} and some proofs on\nthe basis of those axioms. \nThe same holds for \\ref{subsubsec:t2} and \\ref{subsubsec:t3}, only they describe\nthe state at @{text \"t\\<^sub>2\"} and @{text \"t\\<^sub>3\"} respectively. \\<close>\n\n(* Preliminaries *)\nsubsubsection \\<open> Preliminaries \\label{subsubsec:pre}\\<close>\n\ntext\\<open>\\noindent %\nWe begin with definitions for governmental institutions @{text \"g\"}. They express that @{text \"g\"} is a certain branch of government.\n\nThis is a very simplified version of the Constitution, stripped off anything not relevant to the argument.\nFor instance, rather than saying that some @{text \"g\"} has executive powers and is thus entitled to command the army,\ngrant and reprieve pardons\\footnote{S. \\usc{2}{2}{}}, we simply state that @{text \"g\"} \\emph{is} the executive.\\<close>\nconsts (*predicates for branches of government *)\n       is_leg::\"g\\<Rightarrow>\\<sigma>\"     \\<comment> \\<open>g is the legislative\\<close>\n       is_exe::\"g\\<Rightarrow>\\<sigma>\"     \\<comment> \\<open>g is the executive\\<close>\n       is_jud::\"g\\<Rightarrow>\\<sigma>\"     \\<comment> \\<open>g is the judiciary\\<close>\n\ntext\\<open>\\noindent %\nWe require the branches to be unique, i.e. each branch has to have a unique governmental institution associated with it.\n\nOne could imagine a distribution of one branch over several governmental institutions. In fact, governmental institution\n@{text \"Courts\"} represents a collection of courts and thus several different governmental institutions. To Isabelle, however, \nit is a single instance of type @{text \"g\"}. Only we know that @{text \"Courts\"} isn't just one institution.\n\nWe choose to demand uniqueness because it keeps the model simple without taking\naway any concepts necessary to the argument. If we didn't demand uniqueness, we would have to explicitly state which\ninstitutions represent which branches \\emph{and} which they do not represent. Otherwise, the fact that for example @{text \"Congress\"}\nis legislative would not imply that @{text \"P\"} isn't. So @{text \"P\"} could be both legislative and executive. To then prove\n non-dictatorship for @{text \"t\\<^sub>1\"} and @{text \"t\\<^sub>2\"} would be impossible since any institution could be all of the branches.\n\nGiven that we do not need to model an institution representing several branches we may as well simplify things and demand uniqueness.\n\\<close>\n\naxiomatization where\n       unique_is_leg: \"\\<lfloor>\\<^bold>\\<forall>\\<^sub>gg1. \\<^bold>\\<forall>\\<^sub>gg2. (((is_leg g1)\\<^bold>\\<and>(is_leg g2))\\<^bold>\\<longrightarrow>(g1 \\<^bold>= g2))\\<rfloor>\" and\n       unique_is_exe: \"\\<lfloor>\\<^bold>\\<forall>\\<^sub>gg1. \\<^bold>\\<forall>\\<^sub>gg2. (((is_exe g1)\\<^bold>\\<and>(is_exe g2))\\<^bold>\\<longrightarrow>(g1 \\<^bold>= g2))\\<rfloor>\" and\n       unique_is_jud: \"\\<lfloor>\\<^bold>\\<forall>\\<^sub>gg1. \\<^bold>\\<forall>\\<^sub>gg2. (((is_jud g1)\\<^bold>\\<and>(is_jud g2))\\<^bold>\\<longrightarrow>(g1 \\<^bold>= g2))\\<rfloor>\" \n(*<*)\nnamed_theorems Unique declare unique_is_leg[Unique] unique_is_exe[Unique] unique_is_jud[Unique]\n(*>*)\n\ntext\\<open>\\noindent %\n There is a dictatorship at @{text \"t\"} if at that instance of time a dictator @{text \"d\"} exists that represents\nall branches of government.\\<close>\n\ndefinition Dictatorship::\"\\<sigma>\" \n  where \"Dictatorship \\<equiv> \\<lambda>t. \\<exists>d. \\<lfloor>(is_leg d) \\<^bold>\\<and> (is_exe d) \\<^bold>\\<and> (is_jud d)\\<rfloor>\\<^sub>t\"\n\ntext\\<open>\\noindent %\nBelow follow some predicates for formulas @{text \"\\<phi>::\\<sigma>\"}. Based on these we also define predicates that are only dependant on time, and thus\nare either valid or not valid for a certain instance of time. These will serve as properties of the Constitution at different points in time.\n\\<close>\n\nconsts  (*predicates for branches of government *)\n      is_amd::\"\\<sigma>\\<Rightarrow>\\<sigma>\"       \\<comment> \\<open>@{text \"\\<phi>\"} is an amendment\\<close>\n      is_prop::\"\\<sigma>\\<Rightarrow>\\<sigma>\"       \\<comment> \\<open>@{text \"\\<phi>\"} is proposed\\<close>\n      is_rat::\"\\<sigma>\\<Rightarrow>\\<sigma>\"         \\<comment> \\<open>@{text \"\\<phi>\"} is ratified\\<close>\n      sup_prop::\"g\\<Rightarrow>\\<sigma>\\<Rightarrow>\\<sigma>\" \\<comment> \\<open>@{text \"\\<phi>\"} has support by @{text \"g\"} to be proposed\\<close>\n      sup_rat::\"\\<sigma>\\<Rightarrow>\\<sigma>\"       \\<comment> \\<open>@{text \"\\<phi>\"} has support to be ratified\\<close>\n      maint_suf::\"\\<sigma>\\<Rightarrow>\\<sigma>\"   \\<comment> \\<open>@{text \"\\<phi>\"} maintains suffrage in Senate for all states\\<close>\n\ntext\\<open>\\noindent %\nWe shall now define the following concepts:\n\\begin{labeling}{@{text \"omsp\"}}\n\\item[@{text \"oap\"}] Only amendments may be proposed. \\\\This time dependant formula is used for technical reasons.\nIt helps to distinguish between generic formulas @{text \"\\<phi>\"} of type @{text \"\\<sigma>\"} and what we call amendment. For example\n@{text \"oap\"} itself may not be proposed if it isn't also declared an amendment.\n\\item[@{text \"osp\"}] Only if an amendment has the support of the legislative, can it be proposed. \n\\\\This is a simplified version of what Art. V says. Basically @{text \"osp\"} requires an amendment to have support by two thirds\nof both houses of Congress. As mentioned above we omit the option of support by a specific convention, so we can concentrate solely on\nhorizontal division of power.\\\\\nAnother reason why this simplified version is preferable is because it is more generic and allows for a change of interpretation. That is, \n we can make a statement about the legislative supporting an amendment, no matter if the current constitution stipulates\nCongress to be the legislative or not.\n\\item[@{text \"omsp\"}] Only amendments that maintain suffrage may be proposed.\n\\item[@{text \"opr\"}] Only proposed amendments may be ratified at the next time instance.  \n\\item[@{text \"osr\"}] Only if an amendment has the support for ratification, can it be ratified in the future.\n\\item[@{text \"psr\"}] If an amendment is proposed and has the support for ratification, it will be ratified at the next\ntime instance.\\\\\nThis will be used to show that an amendment proposed at @{text \"t\\<^sub>i\"} is ratified and thus valid at @{text \"t\\<^sub>i\\<^sub>+\\<^sub>1\"}, given that\nit also has support for ratification at @{text \"t\\<^sub>i\"}.\n\\\\Note that together with @{text \"opr\"} this makes proposition and ratification of an amendment a two-step process. \n\\item[@{text \"rv\"}] If an amendment is ratified, it is also valid.\n\\\\Here the framework for reasoning about amendments is entwined with the the content of the amendments. In combination with @{text \"psr\"} this property is a\n precarious one to work with for, as soon as @{text \"rv\"} is declared to be valid for some @{text \"t\"}, \nit will be possible to prove anything as long as it has been proposed with support for ratification in the preceding instance of time.\n\\end{labeling}\\<close>\n\nabbreviation oap::\"\\<sigma>\"\n  where \"oap \\<equiv> \\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (\\<^bold>\\<not>(is_amd \\<phi>))\\<^bold>\\<longrightarrow>(\\<^bold>\\<not>(is_prop \\<phi>))\" \n(**)\nabbreviation osp::\"\\<sigma>\" \n  where \"osp \\<equiv> \\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. \\<^bold>\\<forall>\\<^sub>gg.(is_leg g)\\<^bold>\\<longrightarrow>((\\<^bold>\\<not>(sup_prop g \\<phi>))\\<^bold>\\<longrightarrow>(\\<^bold>\\<not>(is_prop \\<phi>)))\"\n(**)\nabbreviation omsp::\"\\<sigma>\"\n  where \"omsp \\<equiv> \\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (\\<^bold>\\<not>(maint_suf \\<phi>))\\<^bold>\\<longrightarrow>(\\<^bold>\\<not>(is_prop \\<phi>))\"\n(**)\nabbreviation opr::\"\\<sigma>\" \n  where \"opr \\<equiv> \\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (\\<^bold>\\<not>(is_prop \\<phi>))\\<^bold>\\<longrightarrow>(\\<^bold>\\<not>(\\<^bold>X(is_rat \\<phi>)))\"\n(**)\nabbreviation osr::\"\\<sigma>\"\n  where \"osr \\<equiv> \\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. \\<^bold>\\<forall>\\<^sub>gg. (\\<^bold>\\<not>(sup_rat \\<phi>))\\<^bold>\\<longrightarrow>(\\<^bold>\\<not>(\\<^bold>X(is_rat \\<phi>)))\"\n(**)\nabbreviation psr::\"\\<sigma>\"\n  where \"psr \\<equiv> \\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (is_prop \\<phi> \\<^bold>\\<and> (sup_rat \\<phi>))\\<^bold>\\<longrightarrow> (\\<^bold>X(is_rat \\<phi>))\"\n(**)\nabbreviation rv::\"\\<sigma>\"\n  where \"rv \\<equiv> \\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (is_rat \\<phi>) \\<^bold>\\<longrightarrow> \\<phi>\"\n\n\n(* Time instance t1*)\nsubsubsection \\<open> Time instance @{term \"t\\<^sub>1\"} \\label{subsubsec:t1}\\<close>\ntext\\<open>\\noindent %\n The following section starts with an axiomatic description of the Constitution's state at @{text \"t\\<^sub>1\"}. This also includes\nsome preparation for @{text \"t\\<^sub>2\"}, namely defining amendment @{text \"amd1\"} and giving axioms on what ought to be valid\nat @{text \"t\\<^sub>2\"}.\n\nBefore proceeding to @{text \"t\\<^sub>2\"}, we will prove some properties valid at @{text \"t\\<^sub>1\"}, in particular that there is no dictatorship\nat @{text \"t\\<^sub>1\"} with the given axioms.\n\\<close> \n(* State of constitution at t1*)\ntext\\<open>\\noindent %\n At @{text \"t\\<^sub>1\"} @{text \"Congress\"} is the legislative, the @{text \"President\"} is the executive and the @{text \"Courts\"} are the judiciary.\nWe write @{text \"President\"} for constant @{text \"P\"} in continuous text for better readability but use @{text \"P\"} in commands to keep names\nshort.\n\\<close>\naxiomatization where\n    Con_Leg_t1: \"\\<lfloor>is_leg Congress\\<rfloor>\\<^sub>t\\<^sub>1\" and\n    P_Exe_t1: \"\\<lfloor>is_exe P\\<rfloor>\\<^sub>t\\<^sub>1\" and\n    Cou_Jud_t1: \"\\<lfloor>is_jud Courts\\<rfloor>\\<^sub>t\\<^sub>1\" \n\ntext\\<open>\\noindent %\nAll of the above defined properties for an instance of time are valid at @{text \"t\\<^sub>1\"}.\\<close>\naxiomatization where\n    oap_t1: \"\\<lfloor>oap\\<rfloor>\\<^sub>t\\<^sub>1\" and \n    osp_t1: \"\\<lfloor>osp\\<rfloor>\\<^sub>t\\<^sub>1\" and\n    omsp_t1:\"\\<lfloor>omsp\\<rfloor>\\<^sub>t\\<^sub>1\" and\n    opr_t1: \"\\<lfloor>opr\\<rfloor>\\<^sub>t\\<^sub>1\" and\n    rv_t1:  \"\\<lfloor>rv\\<rfloor>\\<^sub>t\\<^sub>1\" and\n    osr_t1: \"\\<lfloor>osr\\<rfloor>\\<^sub>t\\<^sub>1\" and\n    psr_t1: \"\\<lfloor>psr\\<rfloor>\\<^sub>t\\<^sub>1\"\n\n\n(*Preparation for t2 *)\n\ntext\\<open>\\noindent %\n Here are two suggestions of what @{text \"amd1\"} might look like.\\<close>\n\ndefinition amd1a::\\<sigma>\n  where \"amd1a \\<equiv> \\<^bold>\\<exists>\\<^sub>\\<sigma>\\<phi>. (\\<^bold>\\<not>(maint_suf \\<phi>))\\<^bold>\\<and>((is_prop \\<phi>))\"\ndefinition amd1b::\\<sigma>\n  where \"amd1b \\<equiv> \\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (is_prop \\<phi>)\\<^bold>\\<longrightarrow> ((maint_suf \\<phi>) \\<^bold>\\<or> \\<^bold>\\<not>(maint_suf \\<phi>))\"\n\ntext\\<open>\\noindent %\n Neither are optimal solutions.\nIndeed, there is no optimal solution for the presented framework.\n\nThis is because what we want @{text \"amd1\"} to say is that it is not necessary for all proposed amendments \nto maintain all states' suffrage in Senate.\nIn other words we want condition \n\\[ \\text{@{text \"omsp \\<equiv> \\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (\\<^bold>\\<not>(maint_suf \\<phi>))\\<^bold>\\<longrightarrow>(\\<^bold>\\<not>(is_prop \\<phi>))\"}} \\]\nto be omitted at @{text \"t\\<^sub>2\"}.\nThis, however is not the same as requiring the amendment to be the negation of @{text \"osmp\"} as @{text \"amd1a\"} does.\nThe negation would require at least one @{text \"\\<phi>::\\<sigma>\"} to expressly \\emph{not} maintain suffrage rights for some state \\emph{and} \nbe proposed. Yet, it were acceptable both if such a @{text \"\\<phi>\"} existed and if it didn't. We do not want to demand\nsuch a @{text \"\\<phi>\"} into existence.\n\nOne could therefore choose to use @{text \"amd1b\"} that states a proposed @{text \"\\<phi>\"} may either satisfy the @{text \"maint_suf\"}\ncondition or it may not. Unfortunately, this is a tautology since @{term \"a \\<longrightarrow> b\"} is always true if @{text \"b\"} is always true.\nThe @{text \"b\"} in this case is tautology @{text \"(maint_suf \\<phi>) \\<^bold>\\<or> \\<^bold>\\<not>(maint_suf \\<phi>)\"} and thus always true.\n\nAlthough the suggested amendments do not constitute ideal amendments for the desired outcome, we shall still use them.\nThey help to illustrate how one can reason about amendments within this framework.\n\nNotice that one could introduce deontic logic%\n\\footnote{For an overview of deontic logic, see \\cite{sep-logic-deontic}}\n to argue about the \\emph{necessity} of @{text \"omsp\"}. We choose not to do this\nin order to avoid inadvertent errors due to a mixture of deontic and temporal logic.\n\\<close>\n\ntext\\<open>\\noindent %\n Next there are a few axioms that pave the way for the state at @{text \"t\\<^sub>2\"}.\\<close>\n\ntext\\<open>\\noindent %\n Amendments @{text \"amd1a\"} and @{text \"amd1b\"} are both proposed and have support for ratification at @{text \"t\\<^sub>1\"}, so\nthey may be ratified at the next instance.\n\\<close>\naxiomatization where\n  amd1a_prop_t1:    \"\\<lfloor>is_prop amd1a\\<rfloor>\\<^sub>t\\<^sub>1\" and\n  amd1a_sup_rat_t1: \"\\<lfloor>sup_rat amd1a\\<rfloor>\\<^sub>t\\<^sub>1\" and\n  amd1b_prop_t1:    \"\\<lfloor>is_prop amd1b\\<rfloor>\\<^sub>t\\<^sub>1\" and\n  amd1b_sup_rat_t1: \"\\<lfloor>sup_rat amd1b\\<rfloor>\\<^sub>t\\<^sub>1\"  \n\ntext\\<open>\\noindent %\n The distribution of powers stays the same at the next instance: @{text \"Congress\"} is the legislative,\nthe @{text \"President\"} the executive and @{text \"Courts\"} are the judiciary.\\<close>\naxiomatization where\n  XCon_Leg_t1: \"\\<lfloor>\\<^bold>X(is_leg Congress)\\<rfloor>\\<^sub>t\\<^sub>1\" and\n  XP_Exe_t1:   \"\\<lfloor>\\<^bold>X(is_exe P)\\<rfloor>\\<^sub>t\\<^sub>1\"         and\n  XCou_Jud_t1: \"\\<lfloor>\\<^bold>X(is_jud Courts)\\<rfloor>\\<^sub>t\\<^sub>1\" \n\ntext\\<open>\\noindent %\n All properties defined in \\ref{subsubsec:pre} are valid next time, except for @{text \"maint_suf\"}. This is\nto ensure that we can introduce an amendment at @{text \"t\\<^sub>2\"} that does not satisfy @{text \"maint_suf\"}.\n\n\\noindent In a way the amendment to Art. V is implemented by simply not using @{text \"\\<lfloor>\\<^bold>X omsp\\<rfloor>\\<^sub>t\\<^sub>1\"} as axiom, \nrather than by working with one of the above suggested amendments @{text \"amd1a\"} and @{text \"amd1b\"}.\n\nOne could criticize two aspects of this approach. \\textbf{Firstly}, the fact that not an actual amendment\nis used to bring about the change but rather the lack of an axiom. As argued above this is not possible, however.\n\\textbf{Secondly}, it shouldn't be necessary for us to explicitly state which axioms to keep and which to give up when transitioning to\nthe next time point. It would be preferable if the logical system automatically kept all axioms that do not lead to contradictions \nand discarded the problematic ones. We will see in \\ref{subsubsec:HOQu} why this is not easily done and content ourselves with \nthe solution at hand.\n\nObserve that our logic is suitable to express this problem in the sense that we would run into inconsistencies, \nwere we to keep condition @{text \"omsp\"} for @{text \"t\\<^sub>2\"} and also introduce an amendment @{text \"amd2\"} with @{text \"\\<^bold>\\<not>(maint_suf amd2)\"}. \n\n\\<close>\naxiomatization where\n  Xoap_t1:\"\\<lfloor>\\<^bold>X oap\\<rfloor>\\<^sub>t\\<^sub>1\" and\n  Xosp_t1:\"\\<lfloor>\\<^bold>X osp\\<rfloor>\\<^sub>t\\<^sub>1\" and\n  Xopr_t1:\"\\<lfloor>\\<^bold>X opr\\<rfloor>\\<^sub>t\\<^sub>1\" and\n  Xrv_t1: \"\\<lfloor>\\<^bold>X rv\\<rfloor>\\<^sub>t\\<^sub>1\"  and\n  Xosr_t1:\"\\<lfloor>\\<^bold>X osr\\<rfloor>\\<^sub>t\\<^sub>1\" and\n  Xpsr_t1:\"\\<lfloor>\\<^bold>X psr\\<rfloor>\\<^sub>t\\<^sub>1\" \n\n(* No dictatorship at t1*)\ntext\\<open>\\noindent %\n Using the axioms provided above, we shall prove that there is no dictatorship at @{text \"t\\<^sub>1\"}.\nThis requires the proof of facts @{text \"only_g_power_t1\"} meaning that @{text \"g\"}  is the only governmental\ninstitution with @{text \"power\"}(legislative, executive, judicial) at @{text \"t\\<^sub>1\"}. Since @{text \"g\"} is different for each @{text \"power\"}\n no dictatorship can be in place at @{text \"t\\<^sub>1\"}. \n\\<close>\n\nlemma only_Con_Leg_t1: \"\\<lfloor>\\<^bold>\\<forall>\\<^sub>gg. (is_leg g)\\<^bold>\\<longrightarrow>(g \\<^bold>= Congress)\\<rfloor>\\<^sub>t\\<^sub>1\" \n  unfolding Defs using unique_is_leg Con_Leg_t1\n  by (simp add: global_valid_def local_valid_def tallB_g_def tall_g_def tand_def teq_def timp_def)\n\nlemma only_P_Exe_t1:\"\\<lfloor>\\<^bold>\\<forall>\\<^sub>gg. (is_exe g)\\<^bold>\\<longrightarrow>(g \\<^bold>= P)\\<rfloor>\\<^sub>t\\<^sub>1\"\n  unfolding Defs using unique_is_exe P_Exe_t1 \n  by (simp add: global_valid_def local_valid_def tallB_g_def tall_g_def tand_def teq_def timp_def)\n\nlemma only_Cou_Jud_t1:\"\\<lfloor>\\<^bold>\\<forall>\\<^sub>gg. (is_jud g)\\<^bold>\\<longrightarrow>(g \\<^bold>= Courts)\\<rfloor>\\<^sub>t\\<^sub>1\"\n  unfolding Defs using unique_is_jud Cou_Jud_t1\n  by (simp add: global_valid_def local_valid_def tallB_g_def tall_g_def tand_def teq_def timp_def)\n\ntext\\<open>\\noindent %\n With these we can prove theorem @{text \"noDictatorship_t1\"}.\\<close>\n\ntheorem noDictatorship_t1: \"\\<lfloor>\\<^bold>\\<not> Dictatorship\\<rfloor>\\<^sub>t\\<^sub>1\" \n  unfolding Defs using only_Con_Leg_t1 only_P_Exe_t1 only_Cou_Jud_t1\n  by (metis (no_types, lifting) Dictatorship_def g.distinct(1) local_valid_def tallB_g_def tall_g_def tand_def teq_def timp_def)(*\n\n List of theorems at  t1*)\n(*<*)\nnamed_theorems t1_state and t1_prep_t2  declare \n (* t1_state -ax *) Con_Leg_t1[t1_state] P_Exe_t1[t1_state] Cou_Jud_t1[t1_state]\n                oap_t1[t1_state] osp_t1[t1_state] omsp_t1[t1_state] opr_t1[t1_state] rv_t1[t1_state] osr_t1[t1_state] psr_t1[t1_state] \n (* t1_state -derived *) noDictatorship_t1[t1_state]\n (* t1_prep_t2 *) amd1b_prop_t1[t1_prep_t2] amd1b_sup_rat_t1[t1_prep_t2] Xoap_t1[t1_prep_t2] Xosp_t1[t1_prep_t2] Xopr_t1[t1_prep_t2] Xrv_t1[t1_prep_t2] Xosr_t1[t1_prep_t2] Xpsr_t1[t1_prep_t2]\n(*>*)(*\n*)(*<*)\n (*just some tests for t1*)\nlemma T_is_prop_cond: \"\\<lfloor>\\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (\\<^bold>\\<not>((is_amd \\<phi>) \\<^bold>\\<and> (maint_suf \\<phi>) \\<^bold>\\<and> (sup_prop Congress \\<phi>)))\\<^bold>\\<longrightarrow>(\\<^bold>\\<not>(is_prop \\<phi>))\\<rfloor>\\<^sub>t\\<^sub>1\"\n  using oap_t1 osp_t1 omsp_t1 unfolding Defs \n  using Con_Leg_t1 local_valid_def by blast\n  \\<comment> \\<open>can axioms for proposition-conditions be generalised to one?\\<close>\nlemma T_is_rat_cond: \"\\<lfloor>\\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (\\<^bold>\\<not>((is_prop \\<phi>) \\<^bold>\\<and> (sup_rat \\<phi>)))\\<^bold>\\<longrightarrow>(\\<^bold>\\<not>(\\<^bold>X(is_rat \\<phi>)))\\<rfloor>\\<^sub>t\\<^sub>1\"\n  using oap_t1 opr_t1 osr_t1 unfolding Defs\n  by blast\n  \\<comment> \\<open>can axioms for ratification-conditions be generalised to one?\\<close>\nlemma T_is_rat_ind_cond: \"\\<lfloor>\\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (\\<^bold>\\<not>((is_amd \\<phi>) \\<^bold>\\<and> (maint_suf \\<phi>) \\<^bold>\\<and> (sup_prop Congress \\<phi>)))\\<^bold>\\<longrightarrow>(\\<^bold>\\<not>(\\<^bold>X(is_rat \\<phi>)))\\<rfloor>\\<^sub>t\\<^sub>1\" \n  using oap_t1 opr_t1 osp_t1 omsp_t1 unfolding Defs\n  using Con_Leg_t1 local_valid_def by blast\n  \\<comment> \\<open>are prop-conditions also X-rat-conditions? They should be since rat only possible if prop.\\<close>\nlemma T_amd1b_is_amd:\"\\<lfloor>is_amd amd1b\\<rfloor>\\<^sub>t\\<^sub>1\" \n  unfolding Defs using oap_t1 amd1b_prop_t1\n  using local_valid_def tallB_s_def tall_s_def timp_def tneg_def by auto\nlemma T_amd1b_sup_prop:\"\\<lfloor>sup_prop Congress amd1b\\<rfloor>\\<^sub>t\\<^sub>1\" \n  unfolding Defs using osp_t1 amd1b_prop_t1 Con_Leg_t1\n  using local_valid_def tallB_s_def tall_s_def tallB_g_def tall_g_def tand_def timp_def tneg_def by auto\nlemma T_amd1b_maint_suf:\"\\<lfloor>maint_suf amd1b\\<rfloor>\\<^sub>t\\<^sub>1\" \n  unfolding Defs using omsp_t1 amd1b_prop_t1\n  using local_valid_def tallB_s_def tall_s_def timp_def tneg_def by auto                                    \n(*>*)(*\n*)\ntext\\<open>\\noindent %\n Finally we check whether the axioms so far are even satisfiable by asking Nitpick to find a satisfiable model for @{text \"True\"},\n which it does.\\<close>\nlemma T_basic_sat_t1: \"True\" nitpick[satisfy,user_axioms,show_all,card time = 4]oops\n\n(* Time instance t2*)\nsubsubsection \\<open>Time instance @{term \"t\\<^sub>2\"} \\label{subsubsec:t2}\\<close>\ntext\\<open>\\noindent %\n As before there are three parts to @{text \"t\\<^sub>2\"}. This time they differ a little in structure.\n\nThe description of the current state is not given by a set of axioms but rather conclusions drawn from the preparation\nat @{text \"t\\<^sub>1\"}. This also includes proofs for the validity of @{text \"amd1a\"} and @{text \"amd1b\"}.\nThe preparation for the next instance of time introduces the new amendment @{text \"amd2\"}.\nThe proof for the non-existence of dictatorship at @{text \"t\\<^sub>2\"} is practically the same as in @{text \"t\\<^sub>1\"}.\n\\<close>\n(* State of constitution at t2*)\ntext\\<open>\\noindent %\n Based on axioms @{text \" XCon_Leg_t1\"}, @{text \"XP_Exe_t1\"} and @{text \"XCou_Jud_t1\"} we can now deduct that @{text \"Congress\"} is still the \nlegislative, the @{text \"President\"} the executive and @{text \"Courts\"} are the judiciary.\\<close>\nlemma Con_Leg_t2:\"\\<lfloor>is_leg Congress\\<rfloor>\\<^sub>t\\<^sub>2\" \n  unfolding Defs\n  using XCon_Leg_t1 local_valid_def tnext_def t1_s_t2 by auto\n\nlemma P_Exe_t2:\"\\<lfloor>is_exe P\\<rfloor>\\<^sub>t\\<^sub>2\" \n  unfolding Defs using tnext_def XP_Exe_t1\n  using XP_Exe_t1 local_valid_def tnext_def t1_s_t2 by auto\n\nlemma Cou_Jud_t2:\"\\<lfloor>is_jud Courts\\<rfloor>\\<^sub>t\\<^sub>2\"\n  using XCou_Jud_t1 local_valid_def tnext_def t1_s_t2 by auto\n\ntext\\<open>\\noindent %\n Analogously, we can refer to axioms @{text \"Xproperty_t1\"} to conclude that @{text \"property\"} is valid at\n@{text \"t\\<^sub>2\"}. These are the same properties we had for @{text \"t\\<^sub>1\"} with the exception of @{text \"omsp\"}.\n\\<close>\nlemma oap_t2:\"\\<lfloor>oap\\<rfloor>\\<^sub>t\\<^sub>2\"\n  using Xoap_t1 local_valid_def tnext_def t1_s_t2 by auto\nlemma osp_t2:\"\\<lfloor>osp\\<rfloor>\\<^sub>t\\<^sub>2\"\n  using Xosp_t1 local_valid_def tnext_def t1_s_t2 by auto\nlemma opr_t2:\"\\<lfloor>opr\\<rfloor>\\<^sub>t\\<^sub>2\"\n  using Xopr_t1 local_valid_def tnext_def t1_s_t2 by auto\nlemma rv_t2:\"\\<lfloor>rv\\<rfloor>\\<^sub>t\\<^sub>2\"\n  using Xrv_t1 local_valid_def tnext_def t1_s_t2 by auto\nlemma osr_t2:\"\\<lfloor>osr\\<rfloor>\\<^sub>t\\<^sub>2\"\n  using Xosr_t1 local_valid_def tnext_def t1_s_t2 by auto\nlemma psr_t2:\"\\<lfloor>psr\\<rfloor>\\<^sub>t\\<^sub>2\"\n  using Xpsr_t1 local_valid_def tnext_def t1_s_t2 by auto\n\n(* amds now valid  t2*)\ntext\\<open>\\noindent %\nBelow are proofs for the amendments proposed previously.\n\nAs discussed above, the outline for a validity proof where an amendment @{text \"amd\"} is concerned is as follows:\n\\begin{center}\n\\begin{tabularx}{0.7\\textwidth}{c  c}\n$t_i$&  $t_{i+1}$ \\\\ \\midrule\n@{text \"psr_t\\<^sub>i\"}& @{text \"rv_t\\<^sub>i\\<^sub>+\\<^sub>1\"} \\\\ \\hline\n @{text \"is_prop amd\"}& \\rdelim\\}{2}{1.8cm}[$\\underset{\\text{@{text \"psr_t\\<^sub>i\"}}}{\\Rightarrow}$ @{text \"is_rat amd\"} $~~~\\underset{\\text{@{text \"rv_t\\<^sub>i\\<^sub>+\\<^sub>1\"}}}{\\Rightarrow}$ @{text \"amd\"}]\\\\\n@{text \"sup_rat amd\"} & \\\\\n\\end{tabularx}\n\\end{center}\n\n\\noindent This is exactly what we do with @{text \"amd1a\"}. Using @{text \" amd1a_prop_t1\"}, @{text \" amd1a_sup_rat_t1\"} and @{text \"psr_t1\"}\n we get that @{text \"\\<lfloor>\\<^bold>X(is_rat amd1a)\\<rfloor>\\<^sub>t\\<^sub>1\"}. By definition of @{text \"\\<^bold>X\"}\nthis means that @{text \"\\<lfloor>is_rat amd1a\\<rfloor>\\<^sub>t\\<^sub>2\"} is true and by @{text \"rv_t2\"} that @{text \"\\<lfloor>amd1a\\<rfloor>\\<^sub>t\\<^sub>2\"} is true.\n\\<close>\n\n(*amd1a*)\nlemma amd1a_val_t2:\"\\<lfloor>amd1a\\<rfloor>\\<^sub>t\\<^sub>2\"\nproof -\n  have \"\\<lfloor>\\<^bold>X(is_rat amd1a)\\<rfloor>\\<^sub>t\\<^sub>1\"  \n    using amd1a_prop_t1 amd1a_sup_rat_t1 psr_t1 local_valid_def tallB_s_def tall_s_def tand_def timp_def tnext_def \n    by auto\n  thus \"\\<lfloor>amd1a\\<rfloor>\\<^sub>t\\<^sub>2\" \n    using local_valid_def tallB_s_def tall_s_def timp_def tnext_def rv_t2 t1_s_t2 \n    by auto\nqed\n\ntext\\<open>\\noindent %\nSee below that we can prove @{text \"\\<lfloor>amd1b\\<rfloor>\\<^sub>t\\<^sub>2\"} with or without these axioms.\n We do not need to use the deduction rules provided by our axioms because\n @{text \"amd1b\"} is a tautology. Indeed, we can also show @{text \"amd1b\"}'s validity for @{text \"t\\<^sub>1\"} and its global validity.\nThis is not possible with @{text \"amd1a\"}.\n \\<close>\n\n(*amd1b*)\nlemma amd1b_val_t2:\"\\<lfloor>amd1b\\<rfloor>\\<^sub>t\\<^sub>2\" \n  unfolding Defs\n  by (simp add: amd1b_def tallB_s_def tall_s_def timp_def tneg_def tor_def)\n\nlemma amd1b_val_t2_2:\"\\<lfloor>amd1b\\<rfloor>\\<^sub>t\\<^sub>2\" \n  unfolding Defs using amd1b_sup_rat_t1 amd1b_prop_t1 psr_t1 rv_t2\n  by (simp add: amd1b_def tallB_s_def tall_s_def timp_def tneg_def tor_def)\n\nlemma amd1b_val_t1:\"\\<lfloor>amd1b\\<rfloor>\\<^sub>t\\<^sub>1\"\n  unfolding Defs \n  by (simp add: amd1b_def tallB_s_def tall_s_def timp_def tneg_def tor_def)\n\nlemma amd1b_val:\"\\<lfloor>amd1b\\<rfloor>\"\n  unfolding Defs \n  by (simp add: amd1b_def tallB_s_def tall_s_def timp_def tneg_def tor_def)\n\n(*Preparation for t3 at t2*)\n\ntext\\<open>\\noindent %\n Now we introduce @{text \"amd2\"} which will transfer all governmental power to the @{text \"President\"}.\nTechnically @{text \"amd2\"} does not bereave any state of its votes in Senate and would thus satifsy @{text \"maint_suf\"}.\nHowever, if Congress does not have any real power any more, then neither do its members, which would render any state's\nvotes inane. So, in effect, we have that @{text \"\\<not>(maint_suf amd2)\"}.\n\nNotice that we cannot declare @{text \"\\<not>(maint_suf amd2)\"} to be globally valid since a state's votes in Senate depend on\nwhat the Constitution currently looks like. Were we to consider predicate @{text \"maint_suf\"} for @{text \"amd2\"} at a time when\nstates have no suffrage in Senate  @{text \"(maint_suf amd2)\"} would be true.\n\\<close>\n\ndefinition amd2::\\<sigma> where \" amd2 \\<equiv> is_leg P \\<^bold>\\<and> is_exe P \\<^bold>\\<and> is_jud P\"\naxiomatization where\n  amd2_prop_t2:\"\\<lfloor>is_prop amd2\\<rfloor>\\<^sub>t\\<^sub>2\" and\n  amd2_sup_rat_t2:\"\\<lfloor>sup_rat amd2\\<rfloor>\\<^sub>t\\<^sub>2\" and\n  amd2_not_maint_suf_t2:\"\\<lfloor>\\<^bold>\\<not>(maint_suf amd2)\\<rfloor>\\<^sub>t\\<^sub>2\" \n\ntext\\<open>\\noindent %\n As before we intend to keep all time dependant conditions except for @{text \"omsp\"} when transitioning to @{text \"t\\<^sub>3\"}.\n\\<close>\n\naxiomatization where\n  Xoap_t2:\"\\<lfloor>\\<^bold>X oap\\<rfloor>\\<^sub>t\\<^sub>2\" and\n  Xosp_t2:\"\\<lfloor>\\<^bold>X osp\\<rfloor>\\<^sub>t\\<^sub>2\" and\n  Xopr_t2:\"\\<lfloor>\\<^bold>X opr\\<rfloor>\\<^sub>t\\<^sub>2\" and\n  Xrv_t2:\"\\<lfloor>\\<^bold>X rv\\<rfloor>\\<^sub>t\\<^sub>2\" and\n  Xosr_t2:\"\\<lfloor>\\<^bold>X osr\\<rfloor>\\<^sub>t\\<^sub>2\" and\n  Xpsr_t2:\"\\<lfloor>\\<^bold>X psr\\<rfloor>\\<^sub>t\\<^sub>2\"\n\ntext\\<open>\\noindent %\nIn \\ref{subsubsec:types} we mentioned that we needed @{text \"t\\<^sub>e\"} for technical reasons.\nThis is because we want to use above given axiom @{term \"\\<lfloor>\\<^bold>X opr\\<rfloor>\\<^sub>t\\<^sub>2\"} without creating inconsistencies due to a missing successor for @{term \"t\\<^sub>3\"}.\n\\begin{align*}\n\\text{@{term \"\\<lfloor>\\<^bold>X opr\\<rfloor>\\<^sub>t\\<^sub>2\"}} &\\Rightarrow \\text{@{term \"\\<lfloor>opr\\<rfloor>\\<^sub>t\\<^sub>3\"}} \\\\\n&\\Leftrightarrow \\text{@{text \"\\<lfloor>\\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (\\<^bold>\\<not>(is_prop \\<phi>))\\<^bold>\\<longrightarrow>(\\<^bold>\\<not>(\\<^bold>X(is_rat \\<phi>)))\\<rfloor>\\<^sub>t\\<^sub>3\"}}\\\\\n&\\Leftrightarrow \\text{@{text \"\\<lfloor>\\<^bold>\\<forall>\\<^sub>\\<sigma>\\<phi>. (\\<^bold>X(is_rat \\<phi>))\\<^bold>\\<longrightarrow>(is_prop \\<phi>)\\<rfloor>\\<^sub>t\\<^sub>3\"}} \\\\\n&\\Leftrightarrow \\text{@{text \"\\<forall>\\<phi>. ((\\<^bold>X(is_rat \\<phi>))t\\<^sub>3)\\<longrightarrow>(is_prop \\<phi>) t\\<^sub>3\"}} \\\\\n&\\Leftrightarrow \\text{@{text \"\\<forall>\\<phi>. \\<forall>t'.((succ t\\<^sub>3 t')\\<longrightarrow>(is_rat \\<phi>) t')\\<longrightarrow>(is_prop \\<phi>) t\\<^sub>3\"}} \\\\\n\\end{align*}\nIf @{text \"t\\<^sub>3\"} does not have a successor @{text \"(succ t\\<^sub>3 t')\"} will always be false, making @{text \"(succ t\\<^sub>3 t')\\<longrightarrow>(is_rat \\<phi>) t'\"}\nalways true which it shouldn't be. As soon as term @{text \"(is_prop \\<phi>) t\\<^sub>3\"} is not true for some @{text \"\\<phi>\"}, axiom @{term \"\\<lfloor>\\<^bold>X opr\\<rfloor>\\<^sub>t\\<^sub>2\"}\nwill cause an inconsistency.\n\nWe therefore want @{text \"t\\<^sub>3\"} to have a successor. In order to avoid circular succession we introduce dummy instance @{text \"t\\<^sub>e\"}.\n\\<close>\n\n(* No dictatorship at  t2*)\ntext\\<open>\\noindent %\n Analogously to the proof at \\ref{subsubsec:t1}, we prove properties @{text \"only_g_power_t2\"} for @{text \"g\"}, governmental institution\nand @{text \"power \\<in> {legilslative power, executive power, judicial power}\"} to use them in the proof for @{text \"noDictatorship_t2\"}.\\<close>\nlemma only_Con_Leg_t2:\"\\<lfloor>\\<^bold>\\<forall>\\<^sub>gg. (is_leg g)\\<^bold>\\<longrightarrow>(g \\<^bold>= Congress)\\<rfloor>\\<^sub>t\\<^sub>2\" \n  using unique_is_leg Con_Leg_t2 global_valid_def local_valid_def tallB_g_def tall_g_def tand_def teq_def timp_def \n  by simp\n\nlemma only_P_Exe_t2:\"\\<lfloor>\\<^bold>\\<forall>\\<^sub>gg. (is_exe g)\\<^bold>\\<longrightarrow>(g \\<^bold>= P)\\<rfloor>\\<^sub>t\\<^sub>2\"\n  unfolding Defs using unique_is_exe P_Exe_t2\n  by (simp add: global_valid_def local_valid_def tallB_g_def tall_g_def tand_def teq_def timp_def)\n\nlemma only_Cou_Jud_t2:\"\\<lfloor>\\<^bold>\\<forall>\\<^sub>gg. (is_jud g)\\<^bold>\\<longrightarrow>(g \\<^bold>= Courts)\\<rfloor>\\<^sub>t\\<^sub>2\" \n  unfolding Defs using unique_is_jud Cou_Jud_t2\n  by (simp add: global_valid_def local_valid_def tallB_g_def tall_g_def tand_def teq_def timp_def)\n\ntheorem noDictatorship_t2: \"\\<lfloor>\\<^bold>\\<not> Dictatorship\\<rfloor>\\<^sub>t\\<^sub>2\" \n  unfolding Defs using only_Con_Leg_t2 only_P_Exe_t2 only_Cou_Jud_t2 Dictatorship_def\n  by (metis (mono_tags, lifting) g.distinct(3) local_valid_def tallB_g_def tall_g_def  tand_def teq_def timp_def)\n\n(* List of theorems at  t2*)\n(*<*)\nnamed_theorems t2_state and t2_prep_t3  declare \n (* t2_state -derived *) Con_Leg_t2[t2_state] P_Exe_t2[t2_state] Cou_Jud_t2[t2_state]\n                oap_t2[t2_state] osp_t2[t2_state] opr_t2[t2_state] rv_t2[t2_state] osr_t2[t2_state] psr_t2[t2_state]\n                amd1b_val_t2[t2_state] amd1a_val_t2[t2_state] \n                only_Con_Leg_t2[t2_state] only_P_Exe_t2[t2_state] only_Cou_Jud_t2[t2_state]\n                noDictatorship_t2[t2_state]\n (* t2_prep_t3 *) amd2_prop_t2[t2_prep_t3] amd2_sup_rat_t2[t2_prep_t3]  amd2_not_maint_suf_t2[t2_prep_t3] \n                Xoap_t2[t2_prep_t3]  Xopr_t2[t2_prep_t3] Xrv_t2[t2_prep_t3]  Xpsr_t2[t2_prep_t3]\n(*>*)\n\ntext\\<open>\\noindent %\n Also, analogously we make sure that Nitpick can still find a satisfiable model for our axioms.\\<close>\nlemma T_basic_sat_t2: \"True\" nitpick[satisfy,user_axioms,show_all,card time = 4]oops\n\n(* Time instance t3*)\nsubsubsection \\<open>Time instance @{term \"t\\<^sub>3\"} \\label{subsubsec:t3}\\<close>\n(*State of constitution at t3*)\n\ntext\\<open>\\noindent %\n The remainder of this section is rather simple. We prove properties for new time instance @{text \"t\\<^sub>3\"} using\npreviously provided axioms @{text \"Xproperty_t2\"}. We then proceed to show that @{text \"amd2\"} is valid with the\nreasoning given above and use it to prove that there is now a dictatorship.\n\\<close>\n\nlemma oap_t3:\"\\<lfloor>oap\\<rfloor>\\<^sub>t\\<^sub>3\" \n  using Xoap_t2 local_valid_def tnext_def t2_s_t3 by auto\nlemma osp_t3:\"\\<lfloor>osp\\<rfloor>\\<^sub>t\\<^sub>3\" \n  using Xosp_t2 local_valid_def tnext_def t2_s_t3 by auto\nlemma opr_t3:\"\\<lfloor>opr\\<rfloor>\\<^sub>t\\<^sub>3\"\n  using Xopr_t2 local_valid_def tnext_def t2_s_t3 by auto\nlemma rv_t3:\"\\<lfloor>rv\\<rfloor>\\<^sub>t\\<^sub>3\" \n  using Xrv_t2 local_valid_def tnext_def t2_s_t3 by auto\nlemma osr_t3:\"\\<lfloor>osr\\<rfloor>\\<^sub>t\\<^sub>3\" \n  using Xosr_t2 local_valid_def tnext_def t2_s_t3 by auto\nlemma psr_t3:\"\\<lfloor>psr\\<rfloor>\\<^sub>t\\<^sub>3\" \n  using Xpsr_t2 local_valid_def tnext_def t2_s_t3 by auto\n\nlemma amd2_val_t3:\"\\<lfloor>amd2\\<rfloor>\\<^sub>t\\<^sub>3\" \nproof -\n  have \"\\<lfloor>\\<^bold>X(is_rat amd2)\\<rfloor>\\<^sub>t\\<^sub>2\"  \n    using amd2_prop_t2 amd2_sup_rat_t2 local_valid_def tallB_s_def tall_s_def tand_def timp_def tnext_def psr_t2 \n    by auto\n  thus  \"\\<lfloor>amd2\\<rfloor>\\<^sub>t\\<^sub>3\" \n    using local_valid_def tallB_s_def tall_s_def timp_def tnext_def rv_t3 t2_s_t3 \n    by auto\nqed\n\n(* Dictatorship at t3 *)\n\ntext\\<open>\\noindent %\nSince @{text \"amd2 \\<equiv> is_leg P \\<^bold>\\<and> is_exe P \\<^bold>\\<and> is_jud P\"} we can easily show that the condition for @{text \"Dictatorship\"}\nis satisfied.\n\\<close>\n\ntheorem Dictatorship_t3:\"\\<lfloor>Dictatorship\\<rfloor>\\<^sub>t\\<^sub>3\"  \nproof -\n  have \"\\<lfloor>is_leg P \\<^bold>\\<and> is_exe P \\<^bold>\\<and> is_jud P\\<rfloor>\\<^sub>t\\<^sub>3\"\n    using amd2_val_t3 amd2_def \n    by ( simp add: local_valid_def tand_def)\n  thus \"\\<lfloor>Dictatorship\\<rfloor>\\<^sub>t\\<^sub>3\"\n    by (meson Dictatorship_def local_valid_def)\nqed\n\ntext\\<open>\\noindent %\nTo conclude we check for satisfiability again. \n\\<close>\n\nlemma T_basic_sat_t3: \"True\" nitpick[satisfy,user_axioms,show_all,card time = 4]oops\n\n(*<*)\nend\n(*>*)", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/2020-DataInBrief-Data/US-Constitution-Loophole/Simulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3322326385035477}}
{"text": "theory HEAP0ProofsIJW\nimports HEAP0\nbegin\n\n\ntheorem (in level0_new)\n  locale0_new_FSB: \"PO_new0_feasibility\"\nunfolding PO_new0_feasibility_def  new0_postcondition_def new0_post_def\nproof -  \n from l0_new0_precondition_def new0_pre_def obtain f0new r \n   where f0wit: \"f0new = f0 - locs_of r s0\" and isb: \"is_block r s0 f0\"\n   by auto\n moreover have \"F0_inv f0new\" using l0_invariant_def F0_inv_def f0wit by simp\n ultimately show \"\\<exists>f' r'. (is_block r' s0 f0 \\<and> f' = f0 - locs_of r' s0) \\<and> F0_inv f'\" by blast\nqed\n\n\ntheorem (in level0_dispose)\n  locale0_dispose_FSB: \"PO_dispose0_feasibility\"\nunfolding PO_dispose0_feasibility_def dispose0_postcondition_def dispose0_post_def\nproof -\n  from l0_dispose0_precondition_def dispose0_pre_def obtain f0new \n    where f0wit: \"f0new = (f0 \\<union> locs_of d0 s0)\" by auto\n  moreover have \"F0_inv f0new\"\n  proof -\n  \thave \"finite (locs_of d0 s0)\" using locs_of_def l0_input_notempty_def by auto\n  \tthen have \"F0_inv (f0 \\<union> locs_of d0 s0)\"\n  \t using l0_invariant_def F0_inv_def by simp\n  \tthus \"F0_inv f0new\" \n  \t\tusing f0wit dispose0_post_def by auto  \n  qed\n  ultimately show \"\\<exists>f'. f' = f0 \\<union> locs_of d0 s0 \\<and> F0_inv f'\" by blast\nqed\n\n\n\n(* The above proofs are straightforward, but there is a wee bit of clutter due to the depth of\n   definitions that are being unfolded. Possibly this is overkill for Isar-style proofs where\n   we can use forwards proof to control the zoom level? Of course, it is useful for the metis\n   style of proof!\n*)\n\nend\n", "meta": {"author": "leouk", "repo": "VDM_Toolkit", "sha": "791013909961d45949fcd96d937ae18f0174c7ec", "save_path": "github-repos/isabelle/leouk-VDM_Toolkit", "path": "github-repos/isabelle/leouk-VDM_Toolkit/VDM_Toolkit-791013909961d45949fcd96d937ae18f0174c7ec/experiments/vdm/Heap/isa/HEAP0ProofsIJW.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.6076631698328916, "lm_q1q2_score": 0.3322326385035477}}
{"text": "(*  Title:      Uint_Userguide.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nchapter {* User guide for native words *}\n\n(*<*)\ntheory Uint_Userguide imports\n  Uint32\n  Uint16\n  Code_Target_Bits_Int\nbegin\n(*>*)\n\ntext {*\n  This tutorial explains how to best use the types for native\n  words like @{typ \"uint32\"} in your formalisation.\n  You can base your formalisation\n  \\begin{enumerate}\n  \\item either directly on these types,\n  \\item or on the generic @{typ \"'a word\"} and only introduce native\n    words a posteriori via code generator refinement.\n  \\end{enumerate}\n\n  The first option causes the least overhead if you have to prove only\n  little about the words you use and start a fresh formalisation.\n  Just use the native type @{typ uint32} instead of @{typ \"32 word\"}\n  and similarly for @{text uint64}, @{text uint16}, and @{text uint8}.\n  As native word types are meant only for code generation, the lemmas\n  about @{typ \"'a word\"}  have not been duplicated, but you can transfer\n  theorems between native word types and @{typ \"'a word\"} using the\n  transfer package.\n\n  Note, however, that this option restricts your work a bit:\n  your own functions cannot be ``polymorphic'' in the word length,\n  but you have to define a separate function for every word length you need.\n\n  The second option is recommended if you already have a formalisation\n  based on @{typ \"'a word\"} or if your proofs involve words and their\n  properties. It separates code generation from modelling and proving,\n  i.e., you can work with words as usual. Consequently, you have to\n  manually setup the code generator to use the native types wherever\n  you want. The following describes how to achieve this with moderate\n  effort.\n\n  Note, however, that some target languages of the code generator\n  (especially OCaml) do not support all the native word types provided.\n  Therefore, you should only import those types that you need -- the\n  theory file for each type mentions at the top the restrictions for\n  code generation. For example, PolyML does not provide the Word16\n  structure, and OCaml provides neither Word8 nor Word16.\n  You can still use these theories provided that you also import\n  the theory @{theory \"Code_Target_Bits_Int\"} (which implements\n  @{typ int} by target-language integers), but these words will\n  be implemented via Isabelle's @{text \"HOL-Word\"} library, i.e.,\n  you do not gain anything in terms of efficiency.\n\n  \\textbf{There is a separate code target @{text \"SML_word\"} for SML.}\n  If you use one of the native words that PolyML does not support\n  (such as @{text \"uint16\"} and @{text uint64} in 32-bit mode), but would\n  like to map its operations to the Standard Basis Library functions,\n  make sure to use the target @{text \"SML_word\"} instead of @{text \"SML\"};\n  if you only use native word sizes that PolyML supports, you can stick\n  with @{text \"SML\"}.  This ensures that code generation within Isabelle\n  as used by @{text Quickcheck}, @{text value} and @\\{code\\} in ML blocks\n  continues to work.\n*}\n\nsection {* Lifting functions from @{typ \"'a word\"} to native words *}\n\ntext {*\n  This section shows how to convert functions from @{typ \"'a word\"} to native \n  words. For example, the following function @{text sum_squares} computes \n  the sum of the first @{term n} square numbers in 16 bit arithmetic using\n  a tail-recursive function @{text gen_sum_squares} with accumulator;\n  for convenience, @{text sum_squares_int} takes an integer instead of a word.\n*}\n\nfunction gen_sum_squares :: \"16 word \\<Rightarrow> 16 word \\<Rightarrow> 16 word\" where (*<*)[simp del]:(*>*)\n\n  \"gen_sum_squares accum n =\n   (if n = 0 then accum else gen_sum_squares (accum + n * n) (n - 1))\"\n(*<*)by pat_completeness simp\ntermination by(relation \"measure (nat \\<circ> uint \\<circ> snd)\")\n  (simp_all, metis (hide_lams, mono_tags) uint_1 uint_eq_0 uint_minus_simple_alt uint_sub_ge word_le_sub1 word_less_def word_neq_0_conv word_zero_le zle_diff1_eq)(*>*)\n\n\ndefinition sum_squares :: \"16 word \\<Rightarrow> 16 word\" where\n   \"sum_squares = gen_sum_squares 0\"\n\ndefinition sum_squares_int :: \"int \\<Rightarrow> 16 word\" where\n  \"sum_squares_int n = sum_squares (word_of_int n)\"\n\ntext {*\n  The generated code for @{term sum_squares} and @{term sum_squares_int} \n  emulates words with unbounded integers and explicit modulus as specified \n  in the theory @{theory Word}. But for efficiency, we want that the\n  generated code uses machine words and machine arithmetic. Unfortunately,\n  as @{typ \"'a word\"} is polymorphic in the word length, the code generator\n  can only do this if we use another type for machine words. The theory\n  @{theory Uint16} defines the type @{typ uint16} for machine words of\n  16~bits. We just have to follow two steps to use it:\n  \n  First, we lift all our functions from @{typ \"16 word\"} to @{typ uint16},\n  i.e., @{term sum_squares}, @{term gen_sum_squares}, and \n  @{term sum_squares_int} in our case. The theory @{theory Uint16} sets\n  up the lifting package for this and has already taken care of the\n  arithmetic and bit-wise operations.\n*}\nlift_definition gen_sum_squares_uint :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" \n  is gen_sum_squares .\nlift_definition sum_squares_uint :: \"uint16 \\<Rightarrow> uint16\" is sum_squares .\nlift_definition sum_squares_int_uint :: \"int \\<Rightarrow> uint16\" is sum_squares_int .\n\ntext {*\n  Second, we also have to transfer the code equations for our functions.\n  The attribute @{text Transfer.transferred} takes care of that, but it is\n  better to check that the transfer succeeded: inspect the theorem to check\n  that the new constants are used throughout.\n*}\n\nlemmas [Transfer.transferred, code] =\n  gen_sum_squares.simps\n  sum_squares_def\n  sum_squares_int_def\n\ntext {*\n  Finally, we export the code to standard ML.  We use the target\n  @{text \"SML_word\"} instead of @{text \"SML\"} to have the operations\n  on @{typ uint16} mapped to the Standard Basis Library. As PolyML\n  does not provide a Word16 type, the mapping for @{typ uint16} is only\n  active in the refined target @{text \"SML_word\"}.\n*}\nexport_code sum_squares_int_uint in SML_word\n\ntext {*\n  Nevertheless, we can still evaluate terms with @{term \"uint16\"} within \n  Isabelle, i.e., PolyML, but this will be translated to @{typ \"16 word\"}\n  and therefore less efficient.\n*}\n\nvalue \"sum_squares_int_uint 40\"\n\nsection {* Storing native words in datatypes *}\n\ntext {*\n  The above lifting is necessary for all functions whose type mentions\n  the word type. Fortunately, we do not have to duplicate functions that\n  merely operate on datatypes that contain words. Nevertheless, we have\n  to tell the code generator that these functions should call the new ones,\n  which operate on machine words. This section shows how to achieve this\n  with data refinement.\n*}\n\nsubsection {* Example: expressions and two semantics *}\n\ntext {*\n  As the running example, we consider a language of expressions (literal values, less-than comparisions and conditional) where values are either booleans or 32-bit words.\n  The original specification uses the type @{typ \"32 word\"}.\n*}\n\ndatatype val = Bool bool | Word \"32 word\"\ndatatype expr = Lit val | LT expr expr | IF expr expr expr\n\nabbreviation (input) word :: \"32 word \\<Rightarrow> expr\" where \"word i \\<equiv> Lit (Word i)\"\nabbreviation (input) bool :: \"bool \\<Rightarrow> expr\" where \"bool i \\<equiv> Lit (Bool i)\"\n\n-- {* Denotational semantics of expressions, @{term None} denotes a type error *}\nfun eval :: \"expr \\<Rightarrow> val option\" where\n  \"eval (Lit v) = Some v\"\n| \"eval (LT e\\<^sub>1 e\\<^sub>2) = \n  (case (eval e\\<^sub>1, eval e\\<^sub>2) \n   of (Some (Word i\\<^sub>1), Some (Word i\\<^sub>2)) \\<Rightarrow> Some (Bool (i\\<^sub>1 < i\\<^sub>2))\n   | _ \\<Rightarrow> None)\"\n| \"eval (IF e\\<^sub>1 e\\<^sub>2 e\\<^sub>3) =\n  (case eval e\\<^sub>1 of Some (Bool b) \\<Rightarrow> if b then eval e\\<^sub>2 else eval e\\<^sub>3\n   | _ \\<Rightarrow> None)\"\n\n-- {* Small-step semantics of expressions, it gets stuck upon type errors. *}\ninductive step :: \"expr \\<Rightarrow> expr \\<Rightarrow> bool\" (\"_ \\<rightarrow> _\" [50, 50] 60) where\n  \"e \\<rightarrow> e' \\<Longrightarrow> LT e e\\<^sub>2 \\<rightarrow> LT e' e\\<^sub>2\"\n| \"e \\<rightarrow> e' \\<Longrightarrow> LT (word i) e \\<rightarrow> LT (word i) e'\"\n| \"LT (word i\\<^sub>1) (word i\\<^sub>2) \\<rightarrow> bool (i\\<^sub>1 < i\\<^sub>2)\"\n| \"e \\<rightarrow> e' \\<Longrightarrow> IF e e\\<^sub>1 e\\<^sub>2 \\<rightarrow> IF e' e\\<^sub>1 e\\<^sub>2\"\n| \"IF (bool True) e\\<^sub>1 e\\<^sub>2 \\<rightarrow> e\\<^sub>1\"\n| \"IF (bool False) e\\<^sub>1 e\\<^sub>2 \\<rightarrow> e\\<^sub>2\"\n\n-- {* Compile the inductive definition with the predicate compiler *}\ncode_pred (modes: i \\<Rightarrow> o \\<Rightarrow> bool as reduce, i \\<Rightarrow> i \\<Rightarrow> bool as step') step .\n\nsubsection {* Change the datatype to use machine words *}\n\ntext {* \n  Now, we want to use @{typ uint32} instead of @{typ \"32 word\"}.\n  The goal is to make the code generator use the new type without\n  duplicating any of the types (@{typ val}, @{typ expr}) or the\n  functions (@{term eval}, @{term reduce}) on such types.\n\n  The constructor @{term Word} has @{typ \"32 word\"} in its type, so\n  we have to lift it to @{text \"Word'\"}, and the same holds for the\n  case combinator @{term case_val}, which @{term case_val'} replaces.%\n  \\footnote{%\n    Note that we should not declare a case translation for the new\n    case combinator because this will break parsing case expressions\n    with old case combinator.\n  }\n  Next, we set up the code generator accordingly:\n  @{term Bool} and @{term Word'} are the new constructors for @{typ val},\n  and @{term case_val'} is the new case combinator with an appropriate \n  case certificate.%\n  \\footnote{%\n    Case certificates tell the code generator to replace the HOL\n    case combinator for a datatype with the case combinator of the\n    target language.  Without a case certificate, the code generator\n    generates a function that re-implements the case combinator; \n    in a strict languages like ML or Scala, this means that the code\n    evaluates all possible cases before it decides which one is taken.\n\n    Case certificates are described in Haftmann's PhD thesis\n    \\cite[Def.\\ 27]{Haftmann2009PhD}. For a datatype @{text dt}\n    with constructors @{text \"C\\<^sub>1\"} to @{text \"C\\<^sub>n\"}\n    where each constructor @{text \"C\\<^sub>i\"} takes @{text \"k\\<^sub>i\"} parameters,\n    the certificate for the case combinator @{text \"case_dt\"}\n    looks as follows:\n\n    {\n      \\isamarkuptrue\\isacommand{lemma}\\isamarkupfalse\\isanewline%\n      \\ \\ \\isakeyword{assumes}\\ {\\isachardoublequoteopen}CASE\\ {\\isasymequiv}\\ dt{\\isacharunderscore}case\\ c\\isactrlsub {\\isadigit{1}}\\ c\\isactrlsub {\\isadigit{2}}\\ \\ldots\\ c\\isactrlsub{n}{\\isachardoublequoteclose}\\isanewline\n      \\ \\ \\isakeyword{shows}\\ {\\isachardoublequoteopen}{\\isacharparenleft}CASE\\ {\\isacharparenleft}C\\isactrlsub {\\isadigit{1}}\\ a\\isactrlsub {\\isadigit{1}}\\isactrlsub {\\isadigit{1}}\\ a\\isactrlsub {\\isadigit{1}}\\isactrlsub {\\isadigit{2}}\\ \\ldots\\ a\\isactrlsub {\\isadigit{1}}\\isactrlsub {k\\ensuremath{{}_1}}{\\isacharparenright}\\ {\\isasymequiv}\\ c\\isactrlsub {\\isadigit{1}}\\ a\\isactrlsub {\\isadigit{1}}\\isactrlsub {\\isadigit{1}}\\ a\\isactrlsub {\\isadigit{1}}\\isactrlsub {\\isadigit{2}}\\ \\ldots\\ a\\isactrlsub {\\isadigit{1}}\\isactrlsub {k\\ensuremath{{}_1}}{\\isacharparenright}\\isanewline\n      \\ \\ \\ \\ {\\isacharampersand}{\\isacharampersand}{\\isacharampersand}\\ {\\isacharparenleft}CASE\\ {\\isacharparenleft}C\\isactrlsub {\\isadigit{2}}\\ a\\isactrlsub {\\isadigit{2}}\\isactrlsub {\\isadigit{1}}\\ a\\isactrlsub {\\isadigit{2}}\\isactrlsub {\\isadigit{2}}\\ \\ldots\\ a\\isactrlsub {\\isadigit{2}}\\isactrlsub {k\\ensuremath{{}_2}}{\\isacharparenright}\\ {\\isasymequiv}\\ c\\isactrlsub {\\isadigit{2}}\\ a\\isactrlsub {\\isadigit{2}}\\isactrlsub {\\isadigit{1}}\\ a\\isactrlsub {\\isadigit{2}}\\isactrlsub {\\isadigit{2}}\\ \\ldots\\ a\\isactrlsub {\\isadigit{2}}\\isactrlsub {k\\ensuremath{{}_2}}{\\isacharparenright}\\isanewline\n      \\ \\ \\ \\ {\\isacharampersand}{\\isacharampersand}{\\isacharampersand}\\ \\ldots\\isanewline\n      \\ \\ \\ \\ {\\isacharampersand}{\\isacharampersand}{\\isacharampersand}\\ {\\isacharparenleft}CASE\\ {\\isacharparenleft}C\\isactrlsub {n}\\ a\\isactrlsub {n}\\isactrlsub {\\isadigit{1}}\\ a\\isactrlsub {n}\\isactrlsub {\\isadigit{2}}\\ \\ldots\\ a\\isactrlsub {n}\\isactrlsub {k\\ensuremath{{}_n}}{\\isacharparenright}\\ {\\isasymequiv}\\ c\\isactrlsub {n}\\ a\\isactrlsub {n}\\isactrlsub {\\isadigit{1}}\\ a\\isactrlsub {n}\\isactrlsub {\\isadigit{2}}\\ \\ldots\\ a\\isactrlsub {n}\\isactrlsub {k\\ensuremath{{}_n}}{\\isacharparenright}{\\isachardoublequoteclose}\\isanewline\n    }\n  }\n  We delete the code equations for the old constructor @{term Word}\n  and case combinator @{term case_val} such that the code generator\n  reports missing adaptations.\n*}\n\nlift_definition Word' :: \"uint32 \\<Rightarrow> val\" is Word .\n\ncode_datatype Bool Word'\n\nlift_definition case_val' :: \"(bool \\<Rightarrow> 'a) \\<Rightarrow> (uint32 \\<Rightarrow> 'a) \\<Rightarrow> val \\<Rightarrow> 'a\" is case_val .\n\nlemmas [code, simp] = val.case [Transfer.transferred]\n\nlemma case_val'_cert:\n  fixes bool word' b w\n  assumes \"CASE \\<equiv> case_val' bool word'\"\n  shows \"(CASE (Bool b) \\<equiv> bool b) &&& (CASE (Word' w) \\<equiv> word' w)\"\n  by (simp_all add: assms)\n\nsetup \\<open>Code.declare_case_global @{thm case_val'_cert}\\<close>\n\ndeclare [[code drop: case_val Word]]\n\n\nsubsection {* Make functions use functions on machine words *}\n\ntext {*\n  Finally, we merely have to change the code equations to use the \n  new functions that operate on @{typ uint32}. As before, the\n  attribute @{text Transfer.transferred} does the job. In our example,\n  we adapt the equality test on @{typ val} (code equations\n  @{thm [source] val.eq.simps}) and the denotational and small-step \n  semantics (code equations @{thm [source] eval.simps} and\n  @{thm [source] step.equation}, respectively).\n\n  We check that the adaptation has suceeded by exporting the functions.\n  As we only use native word sizes that PolyML supports, we can use \n  the usual target @{text \"SML\"} instead of @{text \"SML_word\"}.\n*}\n\nlemmas [code] = \n  val.eq.simps[THEN meta_eq_to_obj_eq, Transfer.transferred, THEN eq_reflection]\n  eval.simps[Transfer.transferred]\n  step.equation[Transfer.transferred]\n\nexport_code reduce step' eval in SML\n\nsection {* Troubleshooting *}\n\ntext {*\n  This section explains some possible problems when using native words.\n  If you experience other difficulties, please contact the author.\n*}\n\nsubsection {* @{text export_code} raises an exception \\label{section:export_code:exception} *}\n\ntext {*\n  Probably, you have defined and are using a function on a native word type,\n  but the code equation refers to emulated words. For example, the following\n  defines a function @{text double} that doubles a word. When we try to export\n  code for @{text double} without any further setup, @{text export_code} will\n  raise an exception or generate code that does not compile.\n*}\n\nlift_definition double :: \"uint32 \\<Rightarrow> uint32\" is \"\\<lambda>x. x + x\" .\n\ntext {*\n  We have to prove a code equation that only uses the existing operations on\n  @{typ uint32}. Then, @{text export_code} works again.\n*}\n\nlemma double_code [code]: \"double n = n + n\"\nby transfer simp\n\nsubsection {* The generated code does not compile *}\n\ntext {*\n  Probably, you have been exporting to a target language for which there\n  is no setup, or your compiler does not provide the required API. Every\n  theory for native words mentions at the start the limitations on code\n  generation. Check that your concrete application meets all the\n  requirements.\n\n  Alternatively, this might be an instance of the problem described \n  in \\S\\ref{section:export_code:exception}.\n\n  For Haskell, you have to enable the extension TypeSynonymInstances with \\texttt{-XTypeSynonymInstances}\n  if you are using polymorphic bit operations on the native word types.\n*}\n\nsubsection {* The generated code is too slow *}\n\ntext {*\n  The generated code will most likely not be as fast as a direct implementation in the target language with manual tuning.\n  This is because we want the configuration of the code generation to be sound (as it can be used to prove theorems in Isabelle).\n  Therefore, the bit operations sometimes perform range checks before they call the target language API.\n  Here are some examples:\n  \\begin{itemize}\n  \\item Shift distances and bit indices in target languages are often expected to fit into a bounded integer or word.\n    However, the size of these types varies across target languages and platforms.\n    Hence, no Isabelle/HOL type can model uniformly all of them.\n    Instead, the bit operations use arbitrary-precision integers for such quantities and check at run-time that the values fit into a bounded integer or word, respectively -- if not, they raise an exception.\n  \n  \\item Division and modulo operations explicitly test whether the divisor is $0$ and return the HOL value of division by $0$ in that case.\n    This is necessary because some languages leave the behaviour of division by 0 unspecified.\n  \\end{itemize}\n  \n  If you have better ideas how to eliminate such checks and speed up the generated code without sacrificing soundness, please contact the author!\n*}\n\n(*<*)end(*>*)\n", "meta": {"author": "PLSysSec", "repo": "ct-wasm-proofs", "sha": "3fa5c38ecda3d05c351096ba5e6d7ba1df793c21", "save_path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs", "path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs/ct-wasm-proofs-3fa5c38ecda3d05c351096ba5e6d7ba1df793c21/CT-WASM_model/AFP/Native_Word/Uint_Userguide.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.6442251133170357, "lm_q1q2_score": 0.3321752986351802}}
{"text": "section \\<open>Soundness Theorems\\<close>\n\ntheory Wasm_Soundness imports Main Wasm_Properties begin\n\ntheorem preservation:\n  assumes \"\\<turnstile>_i s;vs;es : ts\"\n          \"\\<lparr>s;vs;es\\<rparr> \\<leadsto>_i \\<lparr>s';vs';es'\\<rparr>\"\n  shows \"\\<turnstile>_i s';vs';es' : ts\"\nproof -\n  obtain \\<S> where \"store_typing s \\<S>\" \"\\<S>\\<bullet>None \\<tturnstile>_i vs;es : ts\"\n    using assms(1) config_typing.simps\n    by blast\n  hence \"store_typing s' \\<S>\" \"\\<S>\\<bullet>None \\<tturnstile>_i vs';es' : ts\"\n    using assms(2) store_preserved types_preserved_e\n    by simp_all\n  thus ?thesis\n    using config_typing.intros\n    by blast\nqed\n\ntheorem progress:\n  assumes \"\\<turnstile>_i s;vs;es : ts\"\n  shows \"const_list es \\<or> es = [Trap] \\<or> (\\<exists>a s' vs' es'. \\<lparr>s;vs;es\\<rparr> \\<leadsto>_i \\<lparr>s';vs';es'\\<rparr>)\"\nproof -\n  obtain \\<S> where \"store_typing s \\<S>\" \"\\<S>\\<bullet>None \\<tturnstile>_i vs;es : ts\"\n    using assms config_typing.simps\n    by blast\n  thus ?thesis\n    using progress_e4\n    by blast\nqed\n\nend", "meta": {"author": "jacobmischka", "repo": "wasm-isabelle", "sha": "a7c0395023d06d701848ddaf850e6997206489a5", "save_path": "github-repos/isabelle/jacobmischka-wasm-isabelle", "path": "github-repos/isabelle/jacobmischka-wasm-isabelle/wasm-isabelle-a7c0395023d06d701848ddaf850e6997206489a5/WebAssembly/Wasm_Soundness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442250928250375, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.33217528806909774}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Strong_Late_Bisim_Pres\n  imports Strong_Late_Bisim Strong_Late_Sim_Pres\nbegin\n\nlemma tauPres:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"\\<tau>.(P) \\<sim> \\<tau>.(Q)\"\nproof -\n  let ?X = \"{(\\<tau>.(P), \\<tau>.(Q)), (\\<tau>.(Q), \\<tau>.(P))}\"\n  have \"(\\<tau>.(P), \\<tau>.(Q)) \\<in> ?X\" by auto\n  thus ?thesis using `P \\<sim> Q`\n    by(coinduct rule: bisimCoinduct)\n      (auto intro: Strong_Late_Sim_Pres.tauPres dest: symmetric)\nqed\n\nlemma inputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   x :: name\n\n  assumes PSimQ: \"\\<forall>y. P[x::=y] \\<sim> Q[x::=y]\"\n  \n  shows \"a<x>.P \\<sim> a<x>.Q\"\nproof -\n  let ?X = \"{(a<x>.P, a<x>.Q) | a x P Q. \\<forall>y. P[x::=y] \\<sim> Q[x::=y]}\"\n  {\n    fix axP axQ p\n    assume \"(axP, axQ) \\<in> ?X\"\n    then obtain a x P Q where A: \"\\<forall>y. P[x::=y] \\<sim> Q[x::=y]\" and B: \"axP = a<x>.P\" and C: \"axQ = a<x>.Q\"\n      by auto\n    have \"\\<And>y. ((p::name prm) \\<bullet> P)[(p \\<bullet> x)::=y] \\<sim> (p \\<bullet> Q)[(p \\<bullet> x)::=y]\"\n    proof -\n      fix y\n      from A have \"P[x::=(rev p \\<bullet> y)] \\<sim> Q[x::=(rev p \\<bullet> y)]\"\n        by blast\n      hence \"(p \\<bullet> (P[x::=(rev p \\<bullet> y)])) \\<sim> p \\<bullet> (Q[x::=(rev p \\<bullet> y)])\"\n        by(rule bisimClosed)\n      thus \"(p \\<bullet> P)[(p \\<bullet> x)::=y] \\<sim> (p \\<bullet> Q)[(p \\<bullet> x)::=y]\"\n        by(simp add: eqvts pt_pi_rev[OF pt_name_inst, OF at_name_inst])\n    qed\n    hence \"((p::name prm) \\<bullet> axP, p \\<bullet> axQ) \\<in> ?X\" using B C\n      by auto\n  }\n  hence \"eqvt ?X\" by(simp add: eqvt_def)\n\n  from PSimQ have \"(a<x>.P, a<x>.Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cSim P Q)\n    thus ?case using `eqvt ?X`\n      by(force intro: inputPres)\n  next\n    case(cSym P Q)\n    thus ?case\n      by(blast dest: symmetric)\n  qed\nqed\n\nlemma outputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"a{b}.P \\<sim> a{b}.Q\"\nproof -\n  let ?X = \"{(a{b}.P, a{b}.Q), (a{b}.Q, a{b}.P)}\"\n  have \"(a{b}.P, a{b}.Q) \\<in> ?X\" by auto\n  thus ?thesis using `P \\<sim> Q`\n    by(coinduct rule: bisimCoinduct)\n      (auto intro: Strong_Late_Sim_Pres.outputPres dest: symmetric)\nqed\n\n\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"[a\\<frown>b]P \\<sim> [a\\<frown>b]Q\"\nproof -\n  let ?X = \"{([a\\<frown>b]P, [a\\<frown>b]Q), ([a\\<frown>b]Q, [a\\<frown>b]P)}\"\n  have \"([a\\<frown>b]P, [a\\<frown>b]Q) \\<in> ?X\" by auto\n  thus ?thesis using `P \\<sim> Q`\n    by(coinduct rule: bisimCoinduct)\n      (auto intro: Strong_Late_Sim_Pres.matchPres dest: symmetric bisimE)\nqed\n\nlemma mismatchPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"[a\\<noteq>b]P \\<sim> [a\\<noteq>b]Q\"\nproof -\n  let ?X = \"{([a\\<noteq>b]P, [a\\<noteq>b]Q), ([a\\<noteq>b]Q, [a\\<noteq>b]P)}\"\n  have \"([a\\<noteq>b]P, [a\\<noteq>b]Q) \\<in> ?X\" by auto\n  thus ?thesis using `P \\<sim> Q`\n    by(coinduct rule: bisimCoinduct)\n      (auto intro: Strong_Late_Sim_Pres.mismatchPres dest: symmetric bisimE)\nqed\n\nlemma sumPres: \n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"P \\<oplus> R \\<sim> Q \\<oplus> R\"\nproof -\n  let ?X = \"{(P \\<oplus> R, Q \\<oplus> R), (Q \\<oplus> R, P \\<oplus> R)}\"\n  have \"(P \\<oplus> R, Q \\<oplus> R) \\<in> ?X\" by auto\n  thus ?thesis using `P \\<sim> Q`\n    by(coinduct rule: bisimCoinduct)\n      (auto intro: Strong_Late_Sim_Pres.sumPres reflexive dest: symmetric bisimE)\nqed\n\n\n\n  shows \"<\\<nu>x>P \\<sim> <\\<nu>x>Q\"\nproof -\n  let ?X = \"{x. \\<exists>P Q. P \\<sim> Q \\<and> (\\<exists>a. x = (<\\<nu>a>P, <\\<nu>a>Q))}\"\n  from `P \\<sim> Q` have \"(<\\<nu>x>P, <\\<nu>x>Q) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cSim xP xQ)\n    {\n      fix P Q a\n      assume PSimQ: \"P \\<leadsto>[bisim] Q\"\n      moreover have \"\\<And>P Q a. P \\<sim> Q \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> ?X \\<union> bisim\" by blast\n      moreover have \"bisim \\<subseteq> ?X \\<union> bisim\" by blast\n      moreover have \"eqvt bisim\" by simp\n      moreover have \"eqvt ?X\"\n        by(auto simp add: eqvt_def) (blast intro: bisimClosed)\n      hence \"eqvt (?X \\<union> bisim)\" by auto\n      ultimately have \"<\\<nu>a>P \\<leadsto>[(?X \\<union> bisim)] <\\<nu>a>Q\"\n        by(rule Strong_Late_Sim_Pres.resPres)\n    }\n    with `(xP, xQ) \\<in> ?X` show ?case\n      by(auto dest: bisimE)\n  next\n    case(cSym xP xQ)\n    thus ?case by(auto dest: symmetric)\n  qed\nqed\n\nlemma parPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"P \\<parallel> R \\<sim> Q \\<parallel> R\"\nproof -\n  let ?X = \"{(resChain lst (P \\<parallel> R), resChain lst (Q \\<parallel> R)) | lst P R Q. P \\<sim> Q}\"\n  have EmptyChain: \"\\<And>P Q. P \\<parallel> Q = resChain [] (P \\<parallel> Q)\" by auto\n  with `P \\<sim> Q` have \"(P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cSim PR QR)\n    {\n      fix P Q R lst\n\n      assume \"P \\<sim> Q\"\n\n      hence \"P \\<leadsto>[bisim] Q\" by(rule bisimE)\n      moreover note `P \\<sim> Q`\n      moreover have \"\\<And>P Q R. P \\<sim> Q \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\"\n        by auto (blast intro: EmptyChain)\n      moreover \n      {\n        fix xP xQ x\n        assume \"(xP, xQ) \\<in> ?X\"\n        then obtain P Q R lst \n          where \"P \\<sim> Q\" and \"xP = resChain lst (P \\<parallel> R)\" and xQeq: \"xQ = resChain lst (Q \\<parallel> R)\"\n          by auto\n        moreover hence \"(resChain (x#lst) (P \\<parallel> R), resChain (x#lst) (Q \\<parallel> R)) \\<in> ?X\"\n          by blast\n        ultimately have \"(<\\<nu>x>xP, <\\<nu>x>xQ) \\<in> ?X\" by auto\n      }\n      note ResPres = this\n      moreover have \"eqvt bisim\" by simp\n      moreover have \"eqvt ?X\"\n        by(auto simp add: eqvt_def) (blast intro: bisimClosed)\n      ultimately have \"P \\<parallel> R \\<leadsto>[(?X)] Q \\<parallel> R\" by(rule parPres)\n      hence \"resChain lst (P \\<parallel> R) \\<leadsto>[?X] (resChain lst (Q \\<parallel> R))\" using `eqvt ?X` ResPres \n        by(rule resChainI)\n      hence \"resChain lst (P \\<parallel> R) \\<leadsto>[(?X \\<union> bisim)] (resChain lst (Q \\<parallel> R))\"\n        by(force intro: Strong_Late_Sim.monotonic)\n    }\n    with `(PR, QR) \\<in> ?X` show ?case\n      by auto\n  next\n    case(cSym PR QR)\n    thus ?case by(blast dest: symmetric)\n  qed\nqed\n\n\n\n\n  assumes PBiSimQ: \"P \\<sim> Q\"\n\n  shows \"!P \\<sim> !Q\"\nproof -\n  let ?X = \"bangRel bisim\"\n  from PBiSimQ have \"(!P, !Q) \\<in> ?X\" by(rule Rel.BRBang)\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cSim bP bQ)\n    {\n      fix P Q\n      assume \"(P, Q) \\<in> ?X\"\n      hence \"P \\<leadsto>[?X] Q\"\n      proof(induct)\n        fix P Q\n        assume \"P \\<sim> Q\"\n        thus \"!P \\<leadsto>[?X] !Q\" using bisimE bisimEqvt\n          by(rule Strong_Late_Sim_Pres.bangPres)\n      next\n        fix P Q R T\n        assume RBiSimT: \"R \\<sim> T\"\n        assume PBangRelQ: \"(P, Q) \\<in> ?X\"\n        assume PSimQ: \"P \\<leadsto>[?X] Q\"\n        from RBiSimT  have \"R \\<leadsto>[bisim] T\" by(blast dest: bisimE)\n        thus \"R \\<parallel> P \\<leadsto>[?X] T \\<parallel> Q\" using PSimQ RBiSimT PBangRelQ Rel.BRPar Rel.BRRes bisimEqvt eqvtBangRel\n          by(blast intro: Strong_Late_Sim_Pres.parCompose)\n      next\n        fix P Q a\n        assume \"P \\<leadsto>[?X] Q\"\n        moreover from eqvtBangRel bisimEqvt have \"eqvt ?X\" by blast \n        ultimately show \"<\\<nu>a>P \\<leadsto>[?X] <\\<nu>a>Q\" using Rel.BRRes by(blast intro: Strong_Late_Sim_Pres.resPres)\n      qed\n      hence \"P \\<leadsto>[((bangRel bisim) \\<union> bisim)] Q\" by(rule_tac Strong_Late_Sim.monotonic) auto\n    }\n    with `(bP, bQ) \\<in> ?X` show ?case by auto\n  next\n    case(cSym bP bQ)\n    thus ?case by(metis bangRelSymetric symmetric)\n  qed\nqed\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Strong_Late_Bisim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.6297745935070808, "lm_q1q2_score": 0.33209054916093395}}
{"text": "(*  Title:      HOL/MicroJava/BV/BVSpec.thy\n\n    Author:     Cornelia Pusch, Gerwin Klein\n    Copyright   1999 Technische Universitaet Muenchen\n\n*)\n\nheader {* \\isaheader{The Bytecode Verifier}\\label{sec:BVSpec} *}\n\ntheory BVSpec\nimports Effect\nbegin\n\ntext {*\n  This theory contains a specification of the BV. The specification\n  describes correct typings of method bodies; it corresponds \n  to type \\emph{checking}.\n*}\n\n\ndefinition\n  -- \"The method type only contains declared classes:\"\n  check_types :: \"'m prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> bool\"\nwhere \n  \"check_types P mxs mxl \\<tau>s \\<equiv> set \\<tau>s \\<subseteq> states P mxs mxl\"\n\n  -- \"An instruction is welltyped if it is applicable and its effect\"\n  -- \"is compatible with the type at all successor instructions:\"\ndefinition\n  wt_instr :: \"['m prog,ty,nat,pc,ex_table,instr,pc,ty\\<^sub>m] \\<Rightarrow> bool\"\n  (\"_,_,_,_,_ \\<turnstile> _,_ :: _\" [60,0,0,0,0,0,0,61] 60)\nwhere\n  \"P,T,mxs,mpc,xt \\<turnstile> i,pc :: \\<tau>s \\<equiv>\n  app i P mxs T pc mpc xt (\\<tau>s!pc) \\<and> \n  (\\<forall>(pc',\\<tau>') \\<in> set (eff i P pc xt (\\<tau>s!pc)). P \\<turnstile> \\<tau>' \\<le>' \\<tau>s!pc')\"\n\n  -- {* The type at @{text \"pc=0\"} conforms to the method calling convention: *}\ndefinition wt_start :: \"['m prog,cname,ty list,nat,ty\\<^sub>m] \\<Rightarrow> bool\"\nwhere\n  \"wt_start P C Ts mxl\\<^sub>0 \\<tau>s \\<equiv>\n  P \\<turnstile> Some ([],OK (Class C)#map OK Ts@replicate mxl\\<^sub>0 Err) \\<le>' \\<tau>s!0\"\n\n  -- \"A method is welltyped if the body is not empty,\"\n  -- \"if the method type covers all instructions and mentions\"\n  -- \"declared classes only, if the method calling convention is respected, and\"\n  -- \"if all instructions are welltyped.\"\ndefinition wt_method :: \"['m prog,cname,ty list,ty,nat,nat,instr list,\n                 ex_table,ty\\<^sub>m] \\<Rightarrow> bool\"\nwhere\n  \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s \\<equiv>\n  0 < size is \\<and> size \\<tau>s = size is \\<and>\n  check_types P mxs (1+size Ts+mxl\\<^sub>0) (map OK \\<tau>s) \\<and>\n  wt_start P C Ts mxl\\<^sub>0 \\<tau>s \\<and>\n  (\\<forall>pc < size is. P,T\\<^sub>r,mxs,size is,xt \\<turnstile> is!pc,pc :: \\<tau>s)\"\n\n  -- \"A program is welltyped if it is wellformed and all methods are welltyped\"\ndefinition  wf_jvm_prog_phi :: \"ty\\<^sub>P \\<Rightarrow> jvm_prog \\<Rightarrow> bool\" (\"wf'_jvm'_prog\\<^bsub>_\\<^esub>\")\nwhere\n  \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> \\<equiv>\n    wf_prog (\\<lambda>P C (M,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). \n      wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (\\<Phi> C M))\"\n\ndefinition wf_jvm_prog :: \"jvm_prog \\<Rightarrow> bool\"\nwhere\n  \"wf_jvm_prog P \\<equiv> \\<exists>\\<Phi>. wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\"\n\nlemma wt_jvm_progD:\n  \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P \\<Longrightarrow> \\<exists>wt. wf_prog wt P\"\n(*<*) by (unfold wf_jvm_prog_phi_def, blast) (*>*)\n\nlemma wt_jvm_prog_impl_wt_instr:\n  \"\\<lbrakk> wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P; \n      P \\<turnstile> C sees M:Ts \\<rightarrow> T = (mxs,mxl\\<^sub>0,ins,xt) in C; pc < size ins \\<rbrakk> \n  \\<Longrightarrow> P,T,mxs,size ins,xt \\<turnstile> ins!pc,pc :: \\<Phi> C M\"\n(*<*)\n  apply (unfold wf_jvm_prog_phi_def)\n  apply (drule (1) sees_wf_mdecl)\n  apply (simp add: wf_mdecl_def wt_method_def)\n  done\n(*>*)\n\nlemma wt_jvm_prog_impl_wt_start:\n  \"\\<lbrakk> wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P; \n     P \\<turnstile> C sees M:Ts \\<rightarrow> T = (mxs,mxl\\<^sub>0,ins,xt) in C \\<rbrakk> \\<Longrightarrow> \n  0 < size ins \\<and> wt_start P C Ts mxl\\<^sub>0 (\\<Phi> C M)\"\n(*<*)\n  apply (unfold wf_jvm_prog_phi_def)\n  apply (drule (1) sees_wf_mdecl)\n  apply (simp add: wf_mdecl_def wt_method_def)\n  done\n(*>*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Jinja/BV/BVSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300573952054, "lm_q2_score": 0.4726834766204329, "lm_q1q2_score": 0.33207434995991797}}
{"text": "(* Title: Partial_Function_Set.thy\n  Author: Andreas Lochbihler, ETH Zurich *)\n\ntheory Partial_Function_Set imports Main begin\n\nsubsection \\<open>Setup for \\<open>partial_function\\<close> for sets\\<close>\n\nlemma (in complete_lattice) lattice_partial_function_definition:\n  \"partial_function_definitions (\\<le>) Sup\"\nby(unfold_locales)(auto intro: Sup_upper Sup_least)\n\ninterpretation set: partial_function_definitions \"(\\<subseteq>)\" Union\nby(rule lattice_partial_function_definition)\n\n\n\nlemma set_admissible: \"set.admissible (\\<lambda>f :: 'a \\<Rightarrow> 'b set. \\<forall>x y. y \\<in> f x \\<longrightarrow> P x y)\"\nby(rule ccpo.admissibleI)(auto simp add: fun_lub_Sup)\n\nabbreviation \"mono_set \\<equiv> monotone (fun_ord (\\<subseteq>)) (\\<subseteq>)\"\n\nlemma fixp_induct_set_scott:\n  fixes F :: \"'c \\<Rightarrow> 'c\"\n  and U :: \"'c \\<Rightarrow> 'b \\<Rightarrow> 'a set\"\n  and C :: \"('b \\<Rightarrow> 'a set) \\<Rightarrow> 'c\"\n  and P :: \"'b \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  and x and y\n  assumes mono: \"\\<And>x. mono_set (\\<lambda>f. U (F (C f)) x)\"\n  and eq: \"f \\<equiv> C (ccpo.fixp (fun_lub Sup) (fun_ord (\\<le>)) (\\<lambda>f. U (F (C f))))\"\n  and inverse2: \"\\<And>f. U (C f) = f\"\n  and step: \"\\<And>f x y. \\<lbrakk> \\<And>x y. y \\<in> U f x \\<Longrightarrow> P x y; y \\<in> U (F f) x \\<rbrakk> \\<Longrightarrow> P x y\"\n  and enforce_variable_ordering: \"x = x\"\n  and elem: \"y \\<in> U f x\"\n  shows \"P x y\"\nusing step elem set.fixp_induct_uc[of U F C, OF mono eq inverse2 set_admissible, of P]\nby blast\n\n\nlemma fixp_Sup_le:\n  defines \"le \\<equiv> ((\\<le>) :: _ :: complete_lattice \\<Rightarrow> _)\"\n  shows \"ccpo.fixp Sup le = ccpo_class.fixp\"\nproof -\n  have \"class.ccpo Sup le (<)\" unfolding le_def by unfold_locales\n  thus ?thesis\n    by(simp add: ccpo.fixp_def fixp_def ccpo.iterates_def iterates_def ccpo.iteratesp_def iteratesp_def fun_eq_iff le_def)\nqed\n\nlemma fun_ord_le: \"fun_ord (\\<le>) = (\\<le>)\"\nby(auto simp add: fun_ord_def fun_eq_iff le_fun_def)\n\nlemma monotone_le_le: \"monotone (\\<le>) (\\<le>) = mono\"\nby(simp add: monotone_def[abs_def] mono_def[abs_def])\n\nlemma fixp_induct_set:\n  fixes F :: \"'c \\<Rightarrow> 'c\"\n  and U :: \"'c \\<Rightarrow> 'b \\<Rightarrow> 'a set\"\n  and C :: \"('b \\<Rightarrow> 'a set) \\<Rightarrow> 'c\"\n  and P :: \"'b \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  and x and y\n  assumes mono: \"\\<And>x. mono_set (\\<lambda>f. U (F (C f)) x)\"\n  and eq: \"f \\<equiv> C (ccpo.fixp (fun_lub Sup) (fun_ord (\\<le>)) (\\<lambda>f. U (F (C f))))\"\n  and inverse2: \"\\<And>f. U (C f) = f\"\n\n  and step: \"\\<And>f' x y. \\<lbrakk> \\<And>x. U f' x = U f' x; y \\<in> U (F (C (inf (U f) (\\<lambda>x. {y. P x y})))) x \\<rbrakk> \\<Longrightarrow> P x y\"\n    \\<comment> \\<open>partial\\_function requires a quantifier over f', so let's have a fake one\\<close>\n  and elem: \"y \\<in> U f x\"\n  shows \"P x y\"\nproof -\n  from mono\n  have mono': \"mono (\\<lambda>f. U (F (C f)))\"\n    by(simp add: fun_ord_le monotone_le_le mono_def le_fun_def)\n  hence eq': \"f \\<equiv> C (lfp (\\<lambda>f. U (F (C f))))\"\n    using eq unfolding fun_ord_le fun_lub_Sup fixp_Sup_le by(simp add: lfp_eq_fixp)\n\n  let ?f = \"C (lfp (\\<lambda>f. U (F (C f))))\"\n  have step': \"\\<And>x y. \\<lbrakk> y \\<in> U (F (C (inf (U ?f) (\\<lambda>x. {y. P x y})))) x \\<rbrakk> \\<Longrightarrow> P x y\"\n    unfolding eq'[symmetric] by(rule step[OF refl])\n\n  let ?P = \"\\<lambda>x. {y. P x y}\"\n  from mono' have \"lfp (\\<lambda>f. U (F (C f))) \\<le> ?P\"\n    by(rule lfp_induct)(auto intro!: le_funI step' simp add: inverse2)\n  with elem show ?thesis\n    by(subst (asm) eq')(auto simp add: inverse2 le_fun_def)\nqed\n\ndeclaration \\<open>Partial_Function.init \"set\" @{term set.fixp_fun}\n  @{term set.mono_body} @{thm set.fixp_rule_uc} @{thm set.fixp_induct_uc}\n  (SOME @{thm fixp_induct_set})\\<close>\n\n\n\npartial_function (set) test :: \"'a list \\<Rightarrow> nat \\<Rightarrow> bool \\<Rightarrow> int set\"\nwhere\n  \"test xs i j = insert 4 (test [] 0 j \\<union> test [] 1 True \\<inter> test [] 2 False - {5} \\<union> uminus ` test [undefined] 0 True \\<union> uminus -` test [] 1 False)\"\n\ninterpretation coset: partial_function_definitions \"(\\<supseteq>)\" Inter\nby(rule complete_lattice.lattice_partial_function_definition[OF dual_complete_lattice])\n\nlemma fun_lub_Inf: \"fun_lub Inf = (Inf :: _ \\<Rightarrow> _ :: complete_lattice)\"\nby(auto simp add: fun_lub_def fun_eq_iff Inf_fun_def intro: Inf_eqI INF_lower INF_greatest)\n\nlemma fun_ord_ge: \"fun_ord (\\<ge>) = (\\<ge>)\"\nby(auto simp add: fun_ord_def fun_eq_iff le_fun_def)\n\nlemma coset_admissible: \"coset.admissible (\\<lambda>f :: 'a \\<Rightarrow> 'b set. \\<forall>x y. P x y \\<longrightarrow> y \\<in> f x)\"\nby(rule ccpo.admissibleI)(auto simp add: fun_lub_Inf)\n\nabbreviation \"mono_coset \\<equiv> monotone (fun_ord (\\<supseteq>)) (\\<supseteq>)\"\n\nlemma gfp_eq_fixp:\n  fixes f :: \"'a :: complete_lattice \\<Rightarrow> 'a\"\n  assumes f: \"monotone (\\<ge>) (\\<ge>) f\"\n  shows \"gfp f = ccpo.fixp Inf (\\<ge>) f\"\nproof (rule antisym)\n  from f have f': \"mono f\" by(simp add: mono_def monotone_def)\n\n  interpret ccpo Inf \"(\\<ge>)\" \"mk_less (\\<ge>) :: 'a \\<Rightarrow> _\"\n    by(rule ccpo)(rule complete_lattice.lattice_partial_function_definition[OF dual_complete_lattice])\n  show \"ccpo.fixp Inf (\\<ge>) f \\<le> gfp f\"\n    by(rule gfp_upperbound)(subst fixp_unfold[OF f], rule order_refl)\n\n  show \"gfp f \\<le> ccpo.fixp Inf (\\<ge>) f\"\n    by(rule fixp_lowerbound[OF f])(subst gfp_unfold[OF f'], rule order_refl)\nqed\n\nlemma fixp_coinduct_set:\n  fixes F :: \"'c \\<Rightarrow> 'c\"\n  and U :: \"'c \\<Rightarrow> 'b \\<Rightarrow> 'a set\"\n  and C :: \"('b \\<Rightarrow> 'a set) \\<Rightarrow> 'c\"\n  and P :: \"'b \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  and x and y\n  assumes mono: \"\\<And>x. mono_coset (\\<lambda>f. U (F (C f)) x)\"\n  and eq: \"f \\<equiv> C (ccpo.fixp (fun_lub Inter) (fun_ord (\\<ge>)) (\\<lambda>f. U (F (C f))))\"\n  and inverse2: \"\\<And>f. U (C f) = f\"\n\n  and step: \"\\<And>f' x y. \\<lbrakk> \\<And>x. U f' x = U f' x; \\<not> P x y \\<rbrakk> \\<Longrightarrow> y \\<in> U (F (C (sup (\\<lambda>x. {y. \\<not> P x y}) (U f)))) x\"\n    \\<comment> \\<open>partial\\_function requires a quantifier over f', so let's have a fake one\\<close>\n  and elem: \"y \\<notin> U f x\"\n  shows \"P x y\"\nusing elem\nproof(rule contrapos_np)\n  have mono': \"monotone (\\<ge>) (\\<ge>) (\\<lambda>f. U (F (C f)))\"\n    and mono'': \"mono (\\<lambda>f. U (F (C f)))\"\n    using mono by(simp_all add: monotone_def fun_ord_def le_fun_def mono_def)\n  hence eq': \"U f = gfp (\\<lambda>f. U (F (C f)))\"\n    by(subst eq)(simp add: fun_lub_Inf fun_ord_ge gfp_eq_fixp inverse2)\n\n  let ?P = \"\\<lambda>x. {y. \\<not> P x y}\"\n  have \"?P \\<le> gfp (\\<lambda>f. U (F (C f)))\"\n    using mono'' by(rule coinduct)(auto intro!:  le_funI dest: step[OF refl] simp add: eq')\n  moreover\n  assume \"\\<not> P x y\"\n  ultimately show \"y \\<in> U f x\" by(auto simp add: le_fun_def eq')\nqed\n\ndeclaration \\<open>Partial_Function.init \"coset\" @{term coset.fixp_fun}\n  @{term coset.mono_body} @{thm coset.fixp_rule_uc} @{thm coset.fixp_induct_uc}\n  (SOME @{thm fixp_coinduct_set})\\<close>\n\nabbreviation \"mono_set' \\<equiv> monotone (fun_ord (\\<supseteq>)) (\\<supseteq>)\"\n\nlemma [partial_function_mono]:\n  shows insert_mono': \"mono_set' A \\<Longrightarrow> mono_set' (\\<lambda>f. insert x (A f))\"\n  and UNION_mono': \"\\<lbrakk>mono_set' B; \\<And>y. mono_set' (\\<lambda>f. C y f)\\<rbrakk> \\<Longrightarrow> mono_set' (\\<lambda>f. \\<Union>y\\<in>B f. C y f)\"\n  and set_bind_mono': \"\\<lbrakk>mono_set' B; \\<And>y. mono_set' (\\<lambda>f. C y f)\\<rbrakk> \\<Longrightarrow> mono_set' (\\<lambda>f. Set.bind (B f) (\\<lambda>y. C y f))\"\n  and Un_mono': \"\\<lbrakk> mono_set' A; mono_set' B \\<rbrakk> \\<Longrightarrow> mono_set' (\\<lambda>f. A f \\<union> B f)\"\n  and Int_mono': \"\\<lbrakk> mono_set' A; mono_set' B \\<rbrakk> \\<Longrightarrow> mono_set' (\\<lambda>f. A f \\<inter> B f)\"\nunfolding bind_UNION by(fast intro!: monotoneI dest: monotoneD)+\n\ncontext begin\nprivate partial_function (coset) test2 :: \"nat \\<Rightarrow> nat set\"\nwhere \"test2 x = insert x (test2 (Suc x))\"\n\nprivate lemma test2_coinduct:\n  assumes \"P x y\"\n  and *: \"\\<And>x y. P x y \\<Longrightarrow> y = x \\<or> (P (Suc x) y \\<or> y \\<in> test2 (Suc x))\"\n  shows \"y \\<in> test2 x\"\nusing \\<open>P x y\\<close>\napply(rule contrapos_pp)\napply(erule test2.raw_induct[rotated])\napply(simp add: *)\ndone\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CryptHOL/Partial_Function_Set.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300573952052, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.33207434995991786}}
{"text": "(*\n * @TAG(OTHER_LGPL)\n *)\n\n(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      VcgEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Examples using Statespaces *}\n\ntheory VcgExSP imports \"../HeapList\" \"../Vcg\" begin\n\n\nsubsection {* State Spaces *}\n\ntext {*\n First of all we provide a store of program variables that\n occur in the programs considered later.  Slightly unexpected\n things may happen when attempting to work with undeclared variables.\n*}\n\n\nhoarestate state_space = \n  A :: nat\n  I :: nat\n  M :: nat\n  N :: nat\n  R :: nat\n  S :: nat\n  B :: bool\n  Abr:: string\n\nlemma (in state_space)\"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n\\<rbrace> LOC \\<acute>N :== 10;; \\<acute>N :== \\<acute>N + 2 COL \\<lbrace>\\<acute>N = n\\<rbrace>\"\n  by vcg\n\ntext {* Internally we decorate the state components in the statespace with the \nsuffix @{text \"_'\"},\nto avoid cluttering the namespace with the simple names that could no longer\nbe used for logical variables otherwise. \n*}\n\ntext {* We will first consider programs without procedures, later on\nwe will regard procedures without global variables and finally we\nwill get the full pictures: mutually recursive procedures with global\nvariables (including heap).\n*}\n\nsubsection {* Basic Examples *}\n\ntext {*\n We look at few trivialities involving assignment and sequential\n composition, in order to get an idea of how to work with our\n formulation of Hoare Logic.\n*}\n\ntext {*\n Using the basic rule directly is a bit cumbersome.\n*}\n \nlemma (in state_space) \"\\<Gamma>\\<turnstile> {|\\<acute>N = 5|} \\<acute>N :== 2 * \\<acute>N {|\\<acute>N = 10|}\"\n  apply (rule HoarePartial.Basic)  \n  apply simp\n  done\n \nlemma (in state_space) \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \\<acute>N :== 10 \\<lbrace>\\<acute>N = 10\\<rbrace>\"\n  by vcg\n\nlemma (in state_space) \"\\<Gamma>\\<turnstile> \\<lbrace>2 * \\<acute>N = 10\\<rbrace> \\<acute>N :== 2 * \\<acute>N \\<lbrace>\\<acute>N = 10\\<rbrace>\"\n  by vcg\n\nlemma (in state_space) \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = 5\\<rbrace> \\<acute>N :== 2 * \\<acute>N \\<lbrace>\\<acute>N = 10\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\nlemma (in state_space) \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N + 1 = a + 1\\<rbrace> \\<acute>N :== \\<acute>N + 1 \\<lbrace>\\<acute>N = a + 1\\<rbrace>\"\n  by vcg \n\nlemma (in state_space) \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = a\\<rbrace> \\<acute>N :== \\<acute>N + 1 \\<lbrace>\\<acute>N = a + 1\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n \n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>a = a \\<and> b = b\\<rbrace> \\<acute>M :== a;; \\<acute>N :== b \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\"\n  by vcg\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \\<acute>M :== a;; \\<acute>N :== b \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\"\n  apply vcg \n  apply simp\n  done\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\n                \\<acute>I :== \\<acute>M;; \\<acute>M :== \\<acute>N;; \\<acute>N :== \\<acute>I\n              \\<lbrace>\\<acute>M = b \\<and> \\<acute>N = a\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\ntext {*\nWe can also perform verification conditions generation step by step by using\nthe @{text vcg_step} method.\n*}\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\n               \\<acute>I :== \\<acute>M;; \\<acute>M :== \\<acute>N;; \\<acute>N :== \\<acute>I\n              \\<lbrace>\\<acute>M = b \\<and> \\<acute>N = a\\<rbrace>\"\n  apply vcg_step\n  apply vcg_step\n  apply vcg_step\n  apply vcg_step\n  apply simp\n  done\n\n\ntext {*\n In the following assignments we make use of the consequence rule in\n order to achieve the intended precondition.  Certainly, the\n @{text vcg} method is able to handle this case, too.\n*}\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\nproof -\n  have \"\\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>M + 1 \\<noteq> \\<acute>N\\<rbrace>\"\n    by auto\n  also have \"\\<Gamma>\\<turnstile> \\<dots> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\n    by vcg\n  finally show ?thesis .\nqed\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\nproof -\n  have \"\\<And>m n::nat. m = n \\<longrightarrow> m + 1 \\<noteq> n\"\n      -- {* inclusion of assertions expressed in ``pure'' logic, *}\n      -- {* without mentioning the state space *}\n    by simp\n  also have \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M + 1 \\<noteq> \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\n    by vcg\n  finally show ?thesis .\nqed\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\nsubsection {* Multiplication by Addition *}\n\ntext {*\n We now do some basic examples of actual \\texttt{WHILE} programs.\n This one is a loop for calculating the product of two natural\n numbers, by iterated addition.  We first give detailed structured\n proof based on single-step Hoare rules.\n*}\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n      WHILE \\<acute>M \\<noteq> a\n      DO \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 OD\n      \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\nproof -\n  let \"\\<Gamma>\\<turnstile> _ ?while _\" = ?thesis\n  let \"\\<lbrace>\\<acute>?inv\\<rbrace>\" = \"\\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\"\n\n  have \"\\<lbrace>\\<acute>M = 0 & \\<acute>S = 0\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>?inv\\<rbrace>\" by auto\n  also have \"\\<Gamma>\\<turnstile> \\<dots> ?while \\<lbrace>\\<acute>?inv \\<and> \\<not> (\\<acute>M \\<noteq> a)\\<rbrace>\"\n  proof\n    let ?c = \"\\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1\"\n    have \"\\<lbrace>\\<acute>?inv \\<and> \\<acute>M \\<noteq> a\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>S + b = (\\<acute>M + 1) * b\\<rbrace>\"\n      by auto\n    also have \"\\<Gamma>\\<turnstile> \\<dots> ?c \\<lbrace>\\<acute>?inv\\<rbrace>\" by vcg\n    finally show \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>?inv \\<and> \\<acute>M \\<noteq> a\\<rbrace> ?c \\<lbrace>\\<acute>?inv\\<rbrace>\" .\n  qed\n  also have \"\\<lbrace>\\<acute>?inv \\<and> \\<not> (\\<acute>M \\<noteq> a)\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>S = a * b\\<rbrace>\" by auto\n  finally show ?thesis by blast\nqed\n\n\ntext {*\n The subsequent version of the proof applies the @{text vcg} method\n to reduce the Hoare statement to a purely logical problem that can be\n solved fully automatically.  Note that we have to specify the\n \\texttt{WHILE} loop invariant in the original statement.\n*}\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          WHILE \\<acute>M \\<noteq> a\n          INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n          DO \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 OD\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\n  apply vcg\n  apply auto\n  done\n\ntext {* Here some examples of ``breaking'' out of a loop *}\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          TRY       \n            WHILE True\n            INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n            DO IF \\<acute>M = a THEN THROW ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 FI OD\n          CATCH\n            SKIP\n          END\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          TRY       \n            WHILE True\n            INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n            DO IF \\<acute>M = a THEN \\<acute>Abr :== ''Break'';;THROW \n               ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 \n               FI \n            OD\n          CATCH\n            IF \\<acute>Abr = ''Break'' THEN SKIP ELSE Throw FI\n          END\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\n\n\n\n\n\n\ntext {* Some more syntactic sugar, the label statement @{text \"\\<dots> \\<bullet> \\<dots>\"} as shorthand\nfor the @{text \"TRY-CATCH\"} above, and the @{text \"RAISE\"} for an state-update followed\nby a @{text \"THROW\"}. \n*}\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          \\<lbrace>\\<acute>Abr = ''Break''\\<rbrace>\\<bullet> WHILE True INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n           DO IF \\<acute>M = a THEN RAISE \\<acute>Abr :== ''Break'' \n              ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 \n              FI \n           OD\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          TRY       \n            WHILE True\n            INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n            DO IF \\<acute>M = a THEN RAISE \\<acute>Abr :== ''Break'' \n               ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 \n               FI \n            OD\n          CATCH\n            IF \\<acute>Abr = ''Break'' THEN SKIP ELSE Throw FI\n          END\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          \\<lbrace>\\<acute>Abr = ''Break''\\<rbrace> \\<bullet> WHILE True\n          INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n          DO IF \\<acute>M = a THEN RAISE \\<acute>Abr :== ''Break'' \n               ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 \n               FI \n          OD\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\ntext {* Blocks *}\n\nlemma  (in state_space)\n  shows \"\\<Gamma>\\<turnstile>\\<lbrace>\\<acute>I = i\\<rbrace> LOC \\<acute>I;; \\<acute>I :== 2  COL \\<lbrace>\\<acute>I \\<le> i\\<rbrace>\"\n  apply vcg\n  by simp\n\n \nsubsection {* Summing Natural Numbers *}\n\ntext {*\n We verify an imperative program to sum natural numbers up to a given\n limit.  First some functional definition for proper specification of\n the problem.\n*}\n\nprimrec\n  sum :: \"(nat => nat) => nat => nat\"\nwhere\n  \"sum f 0 = 0\"\n| \"sum f (Suc n) = f n + sum f n\"\n\nsyntax\n  \"_sum\" :: \"idt => nat => nat => nat\"\n    (\"SUMM _<_. _\" [0, 0, 10] 10)\ntranslations\n  \"SUMM j<k. b\" == \"CONST sum (\\<lambda>j. b) k\"\n\ntext {*\n The following proof is quite explicit in the individual steps taken,\n with the @{text vcg} method only applied locally to take care of\n assignment and sequential composition.  Note that we express\n intermediate proof obligation in pure logic, without referring to the\n state space.\n*}\n\ntheorem (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n           \\<acute>S :== 0;; \\<acute>I :== 1;;\n           WHILE \\<acute>I \\<noteq> n\n           DO\n             \\<acute>S :== \\<acute>S + \\<acute>I;;\n             \\<acute>I :== \\<acute>I + 1\n           OD\n           \\<lbrace>\\<acute>S = (SUMM j<n. j)\\<rbrace>\"\n  (is \"\\<Gamma>\\<turnstile> _ (_;; ?while) _\")\nproof -\n  let ?sum = \"\\<lambda>k. SUMM j<k. j\"\n  let ?inv = \"\\<lambda>s i. s = ?sum i\"\n\n  have \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \\<acute>S :== 0;; \\<acute>I :== 1 \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\"\n  proof -\n    have \"True \\<longrightarrow> 0 = ?sum 1\"\n      by simp\n    also have \"\\<Gamma>\\<turnstile> \\<lbrace>\\<dots>\\<rbrace> \\<acute>S :== 0;; \\<acute>I :== 1 \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\"\n      by vcg\n    finally show ?thesis .\n  qed\n  also have \"\\<Gamma>\\<turnstile> \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace> ?while \\<lbrace>?inv \\<acute>S \\<acute>I \\<and> \\<not> \\<acute>I \\<noteq> n\\<rbrace>\"\n  proof\n    let ?body = \"\\<acute>S :== \\<acute>S + \\<acute>I;; \\<acute>I :== \\<acute>I + 1\"\n    have \"\\<And>s i. ?inv s i \\<and> i \\<noteq> n \\<longrightarrow>  ?inv (s + i) (i + 1)\"\n      by simp\n    also have \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>S + \\<acute>I = ?sum (\\<acute>I + 1)\\<rbrace> ?body \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\"\n      by vcg\n    finally show \"\\<Gamma>\\<turnstile> \\<lbrace>?inv \\<acute>S \\<acute>I \\<and> \\<acute>I \\<noteq> n\\<rbrace> ?body \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\" .\n  qed\n  also have \"\\<And>s i. s = ?sum i \\<and> \\<not> i \\<noteq> n \\<longrightarrow> s = ?sum n\"\n    by simp \n  finally show ?thesis .\nqed\n\ntext {*\n The next version uses the @{text vcg} method, while still explaining\n the resulting proof obligations in an abstract, structured manner.\n*}\n\ntheorem (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n           \\<acute>S :== 0;; \\<acute>I :== 1;;\n           WHILE \\<acute>I \\<noteq> n\n           INV \\<lbrace>\\<acute>S = (SUMM j<\\<acute>I. j)\\<rbrace>\n           DO\n             \\<acute>S :== \\<acute>S + \\<acute>I;;\n             \\<acute>I :== \\<acute>I + 1\n           OD\n          \\<lbrace>\\<acute>S = (SUMM j<n. j)\\<rbrace>\"\nproof -\n  let ?sum = \"\\<lambda>k. SUMM j<k. j\"\n  let ?inv = \"\\<lambda>s i. s = ?sum i\"\n\n  show ?thesis\n  proof vcg\n    show \"?inv 0 1\" by simp\n  next\n    fix i s assume \"?inv s i\" \"i \\<noteq> n\"\n    thus \"?inv (s + i) (i + 1)\" by simp\n  next \n    fix i s assume x: \"?inv s i\" \"\\<not> i \\<noteq> n\"  \n    thus \"s = ?sum n\" by simp\n  qed\nqed\n\ntext {*\n Certainly, this proof may be done fully automatically as well, provided\n that the invariant is given beforehand.\n*}\n\ntheorem (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n           \\<acute>S :== 0;; \\<acute>I :== 1;;\n           WHILE \\<acute>I \\<noteq> n\n           INV \\<lbrace>\\<acute>S = (SUMM j<\\<acute>I. j)\\<rbrace>\n           DO\n             \\<acute>S :== \\<acute>S + \\<acute>I;;\n             \\<acute>I :== \\<acute>I + 1\n           OD\n           \\<lbrace>\\<acute>S = (SUMM j<n. j)\\<rbrace>\"\n  apply vcg \n  apply auto\n  done\n\nsubsection {* SWITCH *}\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = 5\\<rbrace> SWITCH \\<acute>B \n                        {True} \\<Rightarrow> \\<acute>N :== 6\n                      | {False} \\<Rightarrow> \\<acute>N :== 7\n                     END\n          \\<lbrace>\\<acute>N > 5\\<rbrace>\"\napply vcg\napply simp\ndone\n\nlemma (in state_space)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = 5\\<rbrace> SWITCH \\<acute>N \n                        {v. v < 5} \\<Rightarrow> \\<acute>N :== 6\n                      | {v. v \\<ge> 5} \\<Rightarrow> \\<acute>N :== 7\n                     END\n          \\<lbrace>\\<acute>N > 5\\<rbrace>\"\napply vcg\napply simp\ndone\n\nsubsection {* (Mutually) Recursive Procedures *}\n\nsubsubsection {* Factorial *}\n\ntext {* We want to define a procedure for the factorial. We first\ndefine a HOL functions that calculates it to specify the procedure later on.\n*}\n\nprimrec fac:: \"nat \\<Rightarrow> nat\"\nwhere\n\"fac 0 = 1\" |\n\"fac (Suc n) = (Suc n) * fac n\"\n\nlemma fac_simp [simp]: \"0 < i \\<Longrightarrow>  fac i = i * fac (i - 1)\"\n  by (cases i) simp_all\n\ntext {* Now we define the procedure *}\n\n\nprocedures \n  Fac (N::nat|R::nat)  \n  \"IF \\<acute>N = 0 THEN \\<acute>R :== 1\n   ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);;\n        \\<acute>R :== \\<acute>N * \\<acute>R\n   FI\"\n\nprint_locale Fac_impl\n\ntext {*\nTo see how a call is syntactically translated you can switch off the\nprinting translation via the configuration option @{text hoare_use_call_tr'}\n*}\n\ncontext Fac_impl \nbegin\ntext {*\n@{term \"CALL Fac(\\<acute>N,\\<acute>R)\"} is internally:\n*}\ndeclare [[hoare_use_call_tr' = false]]\ntext {*\n@{term \"CALL Fac(\\<acute>N,\\<acute>R)\"}\n*}\nterm \"CALL Fac(\\<acute>N,\\<acute>R)\"\ndeclare [[hoare_use_call_tr' = true]]\n\n\ntext {*\nNow let us prove that @{term \"Fac\"} meets its specification. \n*}\n\nend\n\n\nlemma (in Fac_impl) Fac_spec':\n  shows \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>{\\<sigma>} PROC Fac(\\<acute>N,\\<acute>R) \\<lbrace>\\<acute>R = fac \\<^bsup>\\<sigma>\\<^esup>N\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply vcg\n  apply simp\n  done\n\n\ntext {* \nSince the factorial was implemented recursively,\nthe main ingredient of this proof is, to assume that the specification holds for \nthe recursive call of @{term Fac} and prove the body correct.\nThe assumption for recursive calls is added to the context by\nthe rule @{thm [source] HoarePartial.ProcRec1} \n(also derived from general rule for mutually recursive procedures):\n@{thm [display] HoarePartial.ProcRec1 [no_vars]}\nThe verification condition generator will infer the specification out of the\ncontext when it encounters a recursive call of the factorial.\n*}\n\ntext {* We can also step through verification condition generation. When\nthe verification condition generator encounters a procedure call it tries to\n  use the rule @{text ProcSpec}. To be successful there must be a specification\nof the procedure in the context.  \n*}\n\nlemma (in Fac_impl) Fac_spec1:\n  shows \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>{\\<sigma>} \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac \\<^bsup>\\<sigma>\\<^esup>N\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply vcg_step\n  apply   vcg_step\n  apply  vcg_step\n  apply vcg_step\n  apply vcg_step\n  apply simp\n  done\n\n\ntext {* Here some Isar style version of the proof *}\nlemma (in Fac_impl) Fac_spec2:\n  \n  shows \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>{\\<sigma>} \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac \\<^bsup>\\<sigma>\\<^esup>N\\<rbrace>\"\nproof (hoare_rule HoarePartial.ProcRec1)\n  have Fac_spec: \"\\<forall>\\<sigma>. \\<Gamma>,(\\<Theta>\\<union>(\\<Union>\\<sigma>. {({\\<sigma>}, Fac_'proc, \\<lbrace>\\<acute>R = fac \\<^bsup>\\<sigma>\\<^esup>N\\<rbrace>,{})}))\n                       \\<turnstile> {\\<sigma>} \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac \\<^bsup>\\<sigma>\\<^esup>N\\<rbrace>\"\n    apply (rule allI)\n    apply (rule hoarep.Asm) \n    by simp\n  show \"\\<forall>\\<sigma>. \\<Gamma>,(\\<Theta>\\<union>(\\<Union>\\<sigma>. {({\\<sigma>}, Fac_'proc, \\<lbrace>\\<acute>R = fac \\<^bsup>\\<sigma>\\<^esup>N\\<rbrace>,{})}))\n            \\<turnstile> {\\<sigma>} IF \\<acute>N = 0 THEN \\<acute>R :== 1\n            ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);; \\<acute>R :== \\<acute>N * \\<acute>R FI \\<lbrace>\\<acute>R = fac \\<^bsup>\\<sigma>\\<^esup>N\\<rbrace>\"\n    apply vcg\n    apply simp\n    done\nqed\n\ntext {* To avoid retyping of potentially large pre and postconditions in \nthe previous proof we can use the casual term abbreviations of the Isar \nlanguage.\n*}\n\nlemma (in Fac_impl) Fac_spec3:\n  shows \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>{\\<sigma>} \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac \\<^bsup>\\<sigma>\\<^esup>N\\<rbrace>\" \n  (is \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>(?Pre \\<sigma>) ?Fac (?Post \\<sigma>)\")\nproof (hoare_rule HoarePartial.ProcRec1)\n  have Fac_spec: \"\\<forall>\\<sigma>. \\<Gamma>,(\\<Theta>\\<union>(\\<Union>\\<sigma>. {(?Pre \\<sigma>, Fac_'proc, ?Post \\<sigma>,{})}))\n                       \\<turnstile>(?Pre \\<sigma>) ?Fac (?Post \\<sigma>)\"\n    apply (rule allI)\n    apply (rule hoarep.Asm) \n    by simp\n  show \"\\<forall>\\<sigma>. \\<Gamma>,(\\<Theta>\\<union>(\\<Union>\\<sigma>. {(?Pre \\<sigma>, Fac_'proc, ?Post \\<sigma>,{})}))\n            \\<turnstile> (?Pre \\<sigma>) IF \\<acute>N = 0 THEN \\<acute>R :== 1\n            ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);; \\<acute>R :== \\<acute>N * \\<acute>R FI (?Post \\<sigma>)\"\n    apply vcg\n    apply simp\n    done\nqed\n\ntext {* The previous proof pattern has still some kind of inconvenience.\nThe augmented context is always printed in the proof state. That can\nmess up the state, especially if we have large specifications. This may\nbe annoying if we want to develop single step or structured proofs. In this\ncase it can be a good idea to introduce a new variable for the augmented\ncontext.\n*}\n\nlemma (in Fac_impl) Fac_spec4:\n  shows \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>{\\<sigma>} \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac \\<^bsup>\\<sigma>\\<^esup>N\\<rbrace>\" \n  (is \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>(?Pre \\<sigma>) ?Fac (?Post \\<sigma>)\")\nproof (hoare_rule HoarePartial.ProcRec1)\n  def \"\\<Theta>'\"==\"(\\<Theta>\\<union>(\\<Union>\\<sigma>. {(?Pre \\<sigma>, Fac_'proc, ?Post \\<sigma>,{})}))\"\n  have Fac_spec: \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>'\\<turnstile>(?Pre \\<sigma>) ?Fac (?Post \\<sigma>)\"\n    by (unfold \\<Theta>'_def, rule allI, rule hoarep.Asm) simp\n  txt {* We have to name the fact @{text \"Fac_spec\"}, so that the vcg can\n   use the specification for the recursive call, since it cannot infer it\n   from the opaque @{term \"\\<Theta>'\"}. *}\n  show \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>'\\<turnstile> (?Pre \\<sigma>) IF \\<acute>N = 0 THEN \\<acute>R :== 1\n            ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);; \\<acute>R :== \\<acute>N * \\<acute>R FI (?Post \\<sigma>)\"\n    apply vcg\n    apply simp\n    done\nqed\n\ntext {* There are different rules available to prove procedure calls,\ndepending on the kind of postcondition and whether or not the\nprocedure is recursive or even mutually recursive. \nSee for example @{thm [source] HoareTotal.ProcRec1}, \n@{thm [source] HoareTotal.ProcNoRec1}. \nThey are all derived from the most general rule\n@{thm [source] HoareTotal.ProcRec}. \nAll of them have some side-conditions concerning the parameter\npassing protocol and its relation to the pre and postcondition. They can be\nsolved in a uniform fashion. Thats why we have created the method \n@{text \"hoare_rule\"}, which behaves like the method @{text \"rule\"} but automatically\ntries to solve the side-conditions.\n*}\n\nsubsubsection {* Odd and Even *}\n\ntext {* Odd and even are defined mutually recursive here. In the \n@{text \"procedures\"} command we conjoin both definitions with @{text \"and\"}.\n*}\n\nprocedures \n odd(N::nat | A::nat) \"IF \\<acute>N=0 THEN \\<acute>A:==0\n                     ELSE IF \\<acute>N=1 THEN CALL even (\\<acute>N - 1,\\<acute>A)\n                          ELSE CALL odd (\\<acute>N - 2,\\<acute>A)\n                          FI\n                     FI\"\n   \nand\n  even(N::nat | A::nat) \"IF \\<acute>N=0 THEN \\<acute>A:==1\n                        ELSE IF \\<acute>N=1 THEN CALL odd (\\<acute>N - 1,\\<acute>A)\n                             ELSE CALL even (\\<acute>N - 2,\\<acute>A)\n                             FI\n                        FI\"\nprint_theorems\nprint_locale! odd_even_clique\n\n\ntext {* To prove the procedure calls to @{term \"odd\"} respectively \n@{term \"even\"} correct we first derive a rule to justify that we\ncan assume both specifications to verify the bodies. This rule can\nbe derived from the general @{thm [source] HoareTotal.ProcRec} rule. An ML function will\ndo this work:\n*}\n\n\n\nML {* bind_thm (\"ProcRec2\", Hoare.gen_proc_rec Hoare.Partial 2) *}\n\n\nlemma (in odd_even_clique)\n  shows odd_spec: \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile>{\\<sigma>} \\<acute>A :== PROC odd(\\<acute>N) \n                  \\<lbrace>(\\<exists>b. \\<^bsup>\\<sigma>\\<^esup>N = 2 * b + \\<acute>A) \\<and> \\<acute>A < 2 \\<rbrace>\" (is ?P1)\n   and even_spec: \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile>{\\<sigma>} \\<acute>A :== PROC even(\\<acute>N)\n                  \\<lbrace>(\\<exists>b. \\<^bsup>\\<sigma>\\<^esup>N + 1 = 2 * b + \\<acute>A) \\<and> \\<acute>A < 2 \\<rbrace>\" (is ?P2)\nproof -\n  have \"?P1 \\<and> ?P2\"\n    apply (hoare_rule ProcRec2)\n    apply  vcg\n    apply  clarsimp\n    apply  (rule_tac x=\"b + 1\" in exI)\n    apply  arith\n    apply vcg\n    apply clarsimp\n    apply arith\n    done\n  thus \"?P1\" \"?P2\"\n    by iprover+\nqed\n\nsubsection {*Expressions With Side Effects *}\n\n\n(* R := N++ + M++*) \nlemma (in state_space) shows \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \n  \\<acute>N \\<ggreater> n. \\<acute>N :== \\<acute>N + 1 \\<ggreater>  \n  \\<acute>M \\<ggreater> m. \\<acute>M :== \\<acute>M + 1 \\<ggreater>\n  \\<acute>R :== n + m\n  \\<lbrace>\\<acute>R = \\<acute>N + \\<acute>M - 2\\<rbrace>\"\napply vcg\napply simp\ndone\n\n(* R := Fac (N) + Fac (N) *)\nlemma (in Fac_impl) shows \n  \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \n  CALL Fac(\\<acute>N) \\<ggreater> n. CALL Fac(\\<acute>N) \\<ggreater> m. \n  \\<acute>R :== n + m\n  \\<lbrace>\\<acute>R = fac \\<acute>N + fac \\<acute>N\\<rbrace>\"\nproof -\n  note Fac_spec = Fac_spec4\n  show ?thesis\n    apply vcg\n    done\nqed\n\n(* R := Fac (N) + Fac (M) *)\nlemma (in Fac_impl) shows \n  \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \n  CALL Fac(\\<acute>N) \\<ggreater> n. CALL Fac(n) \\<ggreater> m. \n  \\<acute>R :== m\n  \\<lbrace>\\<acute>R = fac (fac \\<acute>N)\\<rbrace>\"\nproof -\n  note Fac_spec = Fac_spec4\n  show ?thesis\n    apply vcg\n    done\nqed\n\n\nsubsection {* Global Variables and Heap *}\n\n\ntext {*\nNow we will define and verify some procedures on heap-lists. We consider\nlist structures consisting of two fields, a content element @{term \"cont\"} and\na reference to the next list element @{term \"next\"}. We model this by the \nfollowing state space where every field has its own heap.\n*}\n\n\nhoarestate globals_list = \n  \"next\" :: \"ref \\<Rightarrow> ref\"\n  cont :: \"ref \\<Rightarrow> nat\"\n\n\n\n\ntext {* Updates to global components inside a procedure will\nalways be propagated to the caller. This is implicitly done by the\nparameter passing syntax translations. The record containing the global variables must begin with the prefix \"globals\".\n*}\n\ntext {* We will first define an append function on lists. It takes two \nreferences as parameters. It appends the list referred to by the first\nparameter with the list referred to by the second parameter, and returns\nthe result right into the first parameter.\n*}\n\nprocedures (imports globals_list)\n  append(p::ref,q::ref|p::ref) \n    \"IF \\<acute>p=Null THEN \\<acute>p :== \\<acute>q ELSE \\<acute>p \\<rightarrow>\\<acute>next:== CALL append(\\<acute>p\\<rightarrow>\\<acute>next,\\<acute>q) FI\"\n\n\n\ndeclare [[hoare_use_call_tr' = false]]\ncontext append_impl\nbegin \nterm \"CALL append(\\<acute>p,\\<acute>q,\\<acute>p\\<rightarrow>\\<acute>next)\"\nend\ndeclare [[hoare_use_call_tr' = true]]\n\ntext {* Below we give two specifications this time..\nThe first one captures the functional behaviour and focuses on the\nentities that are potentially modified by the procedure, the second one\nis a pure frame condition.\nThe list in the modifies clause has to list all global state components that\nmay be changed by the procedure. Note that we know from the modifies clause\nthat the @{term cont} parts of the lists will not be changed. Also a small\nside note on the syntax. We use ordinary brackets in the postcondition\nof the modifies clause, and also the state components do not carry the\nacute, because we explicitly note the state @{term t} here. \n\nThe functional specification now introduces two logical variables besides the\nstate space variable @{term \"\\<sigma>\"}, namely @{term \"Ps\"} and @{term \"Qs\"}.\nThey are universally quantified and range over both the pre and the postcondition, so \nthat we are able to properly instantiate the specification\nduring the proofs. The syntax @{text \"\\<lbrace>\\<sigma>. \\<dots>\\<rbrace>\"} is a shorthand to fix the current \nstate: @{text \"{s. \\<sigma> = s \\<dots>}\"}.  \n*}\n\nlemma (in append_impl) append_spec:\n  shows \"\\<forall>\\<sigma> Ps Qs. \\<Gamma>\\<turnstile> \n            \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<and>  List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {}\\<rbrace>\n                \\<acute>p :== PROC append(\\<acute>p,\\<acute>q) \n            \\<lbrace>List \\<acute>p \\<acute>next (Ps@Qs) \\<and> (\\<forall>x. x\\<notin>set Ps \\<longrightarrow> \\<acute>next x = \\<^bsup>\\<sigma>\\<^esup>next x)\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply vcg\n  apply fastforce\n  done\n\n\ntext {* The modifies clause is equal to a proper record update specification\nof the following form. \n*}\n\nlemma (in append_impl) shows \"{t. t may_only_modify_globals Z in [next]} \n       = \n       {t. \\<exists>next. globals t=update id id next_' (K_statefun next) (globals Z)}\"\n  apply (unfold mex_def meq_def)\n  apply simp\n  done\n\ntext {* If the verification condition generator works on a procedure call\nit checks whether it can find a modifies clause in the context. If one\nis present the procedure call is simplified before the Hoare rule \n@{thm [source] HoareTotal.ProcSpec} is applied. Simplification of the procedure call means,\nthat the ``copy back'' of the global components is simplified. Only those\ncomponents that occur in the modifies clause will actually be copied back.\nThis simplification is justified by the rule @{thm [source] HoareTotal.ProcModifyReturn}. \nSo after this simplification all global components that do not appear in\nthe modifies clause will be treated as local variables. \n*}\n\ntext {* You can study the effect of the modifies clause on the following two\nexamples, where we want to prove that @{term \"append\"} does not change\nthe @{term \"cont\"} part of the heap.\n*}\nlemma (in append_impl)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>p=Null \\<and> \\<acute>cont=c\\<rbrace> \\<acute>p :== CALL append(\\<acute>p,Null) \\<lbrace>\\<acute>cont=c\\<rbrace>\" \n  apply vcg\n  oops\n\ntext {* To prove the frame condition, \nwe have to tell the verification condition generator to use only the\nmodifies clauses and not to search for functional specifications by \nthe parameter @{text \"spec=modifies\"} It will also try to solve the \nverification conditions automatically.\n*}\n\nlemma (in append_impl) append_modifies: \n  shows\n   \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC append(\\<acute>p,\\<acute>q){t. t may_only_modify_globals \\<sigma> in [next]}\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply (vcg spec=modifies) \n  done\n\nlemma (in append_impl)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>p=Null \\<and> \\<acute>cont=c\\<rbrace> \\<acute>p\\<rightarrow>\\<acute>next :== CALL append(\\<acute>p,Null) \\<lbrace>\\<acute>cont=c\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\ntext {*\nOf course we could add the modifies clause to the functional specification as \nwell. But separating both has the advantage that we split up the verification\nwork. We can make use of the modifies clause before we apply the\nfunctional specification in a fully automatic fashion.\n*}\n \n\ntext {* To verify the body of @{term \"append\"} we do not need the modifies\nclause, since the specification does not talk about @{term \"cont\"} at all, and\nwe don't access @{term \"cont\"} inside the body. This may be different for \nmore complex procedures.\n*}\n\ntext {* \nTo prove that a procedure respects the modifies clause, we only need\nthe modifies clauses of the procedures called in the body. We do not need\nthe functional specifications. So we can always prove the modifies\nclause without functional specifications, but me may need the modifies\nclause to prove the functional specifications.\n*}\n\n\n\n \nsubsubsection {*Insertion Sort*}\n\nprimrec sorted:: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a list  \\<Rightarrow> bool\"\nwhere\n\"sorted le [] = True\" |\n\"sorted le (x#xs) = ((\\<forall>y\\<in>set xs. le x y) \\<and> sorted le xs)\"\n\n\n \nprocedures (imports globals_list)\n  insert(r::ref,p::ref | p::ref) \n    \"IF \\<acute>r=Null THEN SKIP\n     ELSE IF \\<acute>p=Null THEN \\<acute>p :== \\<acute>r;; \\<acute>p\\<rightarrow>\\<acute>next :== Null\n          ELSE IF \\<acute>r\\<rightarrow>\\<acute>cont \\<le> \\<acute>p\\<rightarrow>\\<acute>cont \n               THEN \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>p;; \\<acute>p:==\\<acute>r\n               ELSE \\<acute>p\\<rightarrow>\\<acute>next :== CALL insert(\\<acute>r,\\<acute>p\\<rightarrow>\\<acute>next)\n               FI\n          FI\n     FI\"\n\n\ntext {*\nIn the postcondition of the functional specification there is a small but \nimportant subtlety. Whenever we talk about the @{term \"cont\"} part we refer to \nthe one of the pre-state, even in the conclusion of the implication.\nThe reason is, that we have separated out, that @{term \"cont\"} is not modified\nby the procedure, to the modifies clause. So whenever we talk about unmodified\nparts in the postcondition we have to use the pre-state part, or explicitely\nstate an equality in the postcondition.\nThe reason is simple. If the postcondition would talk about @{text \"\\<acute>cont\"}\ninstead of @{text \"\\<^bsup>\\<sigma>\\<^esup>cont\"}, we will get a new instance of @{text \"cont\"} during\nverification and the postcondition would only state something about this\nnew instance. But as the verification condition generator will use the\nmodifies clause the caller of @{text \"insert\"} instead will still have the\nold @{text \"cont\"} after the call. Thats the sense of the modifies clause.\nSo the caller and the specification will simply talk about two different things,\nwithout being able to relate them (unless an explicit equality is added to\nthe specification). \n*}\n\nlemma (in insert_impl) insert_modifies:\n  \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC insert(\\<acute>r,\\<acute>p){t. t may_only_modify_globals \\<sigma> in [next]}\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\n\nlemma (in insert_impl) insert_spec:\n    \"\\<forall>\\<sigma> Ps . \\<Gamma>\\<turnstile> \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<and> sorted (op \\<le>) (map \\<acute>cont Ps) \\<and> \n                  \\<acute>r \\<noteq> Null \\<and> \\<acute>r \\<notin> set Ps\\<rbrace>  \n         \\<acute>p :== PROC insert(\\<acute>r,\\<acute>p) \n   \\<lbrace>\\<exists>Qs. List \\<acute>p \\<acute>next Qs \\<and> sorted (op \\<le>) (map \\<^bsup>\\<sigma>\\<^esup>cont  Qs) \\<and>\n           set Qs = insert \\<^bsup>\\<sigma>\\<^esup>r (set Ps) \\<and>\n           (\\<forall>x. x \\<notin> set Qs \\<longrightarrow> \\<acute>next x = \\<^bsup>\\<sigma>\\<^esup>next x)\\<rbrace>\"\n\napply (hoare_rule HoarePartial.ProcRec1)\napply vcg\napply (intro conjI impI)\napply    fastforce\napply   fastforce\napply  fastforce\napply (clarsimp) \napply force\ndone\n\nprocedures (imports globals_list)\n  insertSort(p::ref | p::ref) \n  where r::ref q::ref\n  in\n    \"\\<acute>r:==Null;;\n     WHILE (\\<acute>p \\<noteq> Null) DO\n       \\<acute>q :== \\<acute>p;;\n       \\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;;\n       \\<acute>r :== CALL insert(\\<acute>q,\\<acute>r)\n     OD;;\n     \\<acute>p:==\\<acute>r\"\n\nprint_locale insertSort_impl\n\n\nlemma (in insertSort_impl) insertSort_modifies: \n  shows\n   \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC insertSort(\\<acute>p)\n              {t. t may_only_modify_globals \\<sigma> in [next]}\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\n\ntext {* Insertion sort is not implemented recursively here but with a while\nloop. Note that the while loop is not annotated with an invariant in the\nprocedure definition. The invariant only comes into play during verification.\nTherefore we will annotate the body during the proof with the\nrule @{thm [source] HoareTotal.annotateI}.\n*}\n\n\nlemma (in insertSort_impl) insertSort_body_spec:\n  shows \"\\<forall>\\<sigma> Ps. \\<Gamma>,\\<Theta>\\<turnstile> \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<rbrace> \n              \\<acute>p :== PROC insertSort(\\<acute>p)\n          \\<lbrace>\\<exists>Qs. List \\<acute>p \\<acute>next Qs \\<and> sorted (op \\<le>) (map \\<^bsup>\\<sigma>\\<^esup>cont Qs) \\<and>\n           set Qs = set Ps\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)  \n  apply (hoare_rule anno= \n         \"\\<acute>r :== Null;;\n         WHILE \\<acute>p \\<noteq> Null\n         INV \\<lbrace>\\<exists>Qs Rs. List \\<acute>p \\<acute>next Qs \\<and> List \\<acute>r \\<acute>next Rs \\<and> \n                  set Qs \\<inter> set Rs = {} \\<and>\n                  sorted (op \\<le>) (map \\<acute>cont Rs) \\<and> set Qs \\<union> set Rs = set Ps \\<and>\n                  \\<acute>cont = \\<^bsup>\\<sigma>\\<^esup>cont \\<rbrace>\n          DO \\<acute>q :== \\<acute>p;; \\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;; \\<acute>r :== CALL insert(\\<acute>q,\\<acute>r) OD;;\n          \\<acute>p :== \\<acute>r\" in HoarePartial.annotateI)\n  apply vcg\n  apply   fastforce\n  prefer 2\n  apply  fastforce\n  apply (clarsimp)\n  apply (rule_tac x=ps in exI)\n  apply (intro conjI)\n  apply    (rule heap_eq_ListI1)\n  apply     assumption\n  apply    clarsimp\n  apply    (subgoal_tac \"x\\<noteq>p \\<and> x \\<notin> set Rs\")\n  apply     auto\n  done\n\nsubsubsection \"Memory Allocation and Deallocation\"\n\ntext {* The basic idea of memory management is to keep a list of allocated\nreferences in the state space. Allocation of a new reference adds a\nnew reference to the list deallocation removes a reference. Moreover\nwe keep a counter \"free\" for the free memory.\n*}\n\n(*\nrecord globals_list_alloc = globals_list +\n  alloc_'::\"ref list\"\n  free_'::nat \n\nrecord 'g list_vars' = \"'g list_vars\" +\n  i_'::nat\n  first_'::ref\n*)\n\nhoarestate globals_list_alloc =\n  alloc::\"ref list\"\n  free::nat \n  \"next\"::\"ref \\<Rightarrow> ref\"\n  cont::\"ref \\<Rightarrow> nat\"\nhoarestate locals_list_alloc =\n  i::nat\n  first::ref\n  p::ref\n  q::ref\n  r::ref\n  root::ref\n  tmp::ref \nlocale list_alloc = globals_list_alloc + locals_list_alloc\n\ndefinition \"sz = (2::nat)\"\n\nlemma (in list_alloc)\n shows  \n  \"\\<Gamma>,\\<Theta>\\<turnstile> \\<lbrace>\\<acute>i = 0 \\<and> \\<acute>first = Null \\<and> n*sz \\<le> \\<acute>free\\<rbrace>\n       WHILE \\<acute>i < n \n       INV \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next Ps \\<and> length Ps = \\<acute>i \\<and> \\<acute>i \\<le> n \\<and> \n             set Ps \\<subseteq> set \\<acute>alloc \\<and> (n - \\<acute>i)*sz \\<le> \\<acute>free\\<rbrace>\n       DO\n         \\<acute>p :== NEW sz [\\<acute>cont:==0,\\<acute>next:== Null];;\n         \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>first;;\n         \\<acute>first :== \\<acute>p;;\n         \\<acute>i :== \\<acute>i+ 1 \n       OD\n       \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next  Ps \\<and> length Ps = n \\<and> set Ps \\<subseteq> set \\<acute>alloc\\<rbrace>\"\napply (vcg)\napply   simp\napply  clarsimp\napply  (rule conjI)\napply   clarsimp\napply   (rule_tac x=\"new (set alloc)#Ps\" in exI)\napply   clarsimp\napply   (rule conjI)\napply    fastforce\napply   (simp add: sz_def)\napply  (simp add: sz_def)\napply fastforce\ndone\n\n\nlemma (in list_alloc)\n shows  \n  \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>i = 0 \\<and> \\<acute>first = Null \\<and> n*sz \\<le> \\<acute>free\\<rbrace>\n       WHILE \\<acute>i < n \n       INV \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next Ps \\<and> length Ps = \\<acute>i \\<and> \\<acute>i \\<le> n \\<and> \n             set Ps \\<subseteq> set \\<acute>alloc \\<and> (n - \\<acute>i)*sz \\<le> \\<acute>free\\<rbrace>\n       DO\n         \\<acute>p :== NNEW sz [\\<acute>cont:==0,\\<acute>next:== Null];;\n         \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>first;;\n         \\<acute>first :== \\<acute>p;;\n         \\<acute>i :== \\<acute>i+ 1 \n       OD\n       \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next  Ps \\<and> length Ps = n \\<and> set Ps \\<subseteq> set \\<acute>alloc\\<rbrace>\"\n\napply (vcg)\napply   simp\napply  clarsimp\napply  (rule conjI)\napply   clarsimp\napply   (rule_tac x=\"new (set alloc)#Ps\" in exI)\napply   clarsimp\napply   (rule conjI)\napply    fastforce\napply   (simp add: sz_def)\napply  (simp add: sz_def)\napply fastforce\ndone\n\nsubsection {* Fault Avoiding Semantics *}\n\ntext {*\nIf we want to ensure that no runtime errors occur we can insert guards into\nthe code. We will not be able to prove any nontrivial Hoare triple \nabout code with guards, if we cannot show that the guards will never fail.\nA trivial Hoare triple is one with an empty precondtion. \n*}\n\n\nlemma (in list_alloc) \"\\<Gamma>,\\<Theta>\\<turnstile> \\<lbrace>True\\<rbrace>  \\<lbrace>\\<acute>p\\<noteq>Null\\<rbrace>\\<longmapsto> \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>p \\<lbrace>True\\<rbrace>\"\napply vcg\noops\n\nlemma (in list_alloc) \"\\<Gamma>,\\<Theta>\\<turnstile> {}  \\<lbrace>\\<acute>p\\<noteq>Null\\<rbrace>\\<longmapsto> \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>p \\<lbrace>True\\<rbrace>\"\napply vcg\ndone\n\ntext {* Let us consider this small program that reverts a list. At\nfirst without guards. \n*}\nlemma (in list_alloc)\n  shows \n  \"\\<Gamma>,\\<Theta>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and> \n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;; \n     \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;; \n     \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;; \n     \\<acute>q :== \\<acute>r OD\n  \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps\\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\napply (vcg)\napply fastforce+\ndone\n\ntext {* If we want to ensure that we do not dereference @{term \"Null\"} or\naccess unallocated memory, we have to add some guards.\n*}\nlemma (in list_alloc)\n  shows \n  \"\\<Gamma>,\\<Theta>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and> \n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;; \n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;; \n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;; \n     \\<acute>q :== \\<acute>r OD\n \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\napply (vcg)\napply fastforce+\ndone\n\n\ntext {* We can also just prove that no faults will occur, by giving the\ntrivial postcondition.\n*}\nlemma (in list_alloc) rev_noFault:\n  shows \n  \"\\<Gamma>,\\<Theta>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and> \n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;; \n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;; \n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;; \n     \\<acute>q :== \\<acute>r OD\n  UNIV,UNIV\"\napply (vcg)\napply fastforce+\ndone\n\nlemma (in list_alloc) rev_moduloGuards: \n  \n  shows \n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and> \n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;; \n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<surd> \\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;; \n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<surd> \\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;; \n     \\<acute>q :== \\<acute>r OD\n \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\napply vcg\napply fastforce+\ndone\n\n\n\n\nlemma CombineStrip': \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c' Q,A\"\n  assumes deriv_strip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n  assumes c'': \"c''= mark_guards False (strip_guards (-F) c')\"\n  assumes c: \"c = mark_guards False c'\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof -\n  from deriv_strip [simplified c'']\n  have \"\\<Gamma>,\\<Theta>\\<turnstile> P (strip_guards (- F) c') UNIV,UNIV\"\n    by (rule HoarePartialProps.MarkGuardsD)\n  with deriv \n  have \"\\<Gamma>,\\<Theta>\\<turnstile> P c' Q,A\"\n    by (rule HoarePartialProps.CombineStrip)\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile> P mark_guards False c' Q,A\"\n    by (rule HoarePartialProps.MarkGuardsI)\n  thus ?thesis\n    by (simp add: c)\nqed\n\n\ntext {* We can then combine the prove that no fault will occur with the\nfunctional prove of the programm without guards to get the full proove by\nthe rule @{thm HoarePartialProps.CombineStrip}\n*}\n\n\nlemma (in list_alloc)\n  shows \n  \"\\<Gamma>,\\<Theta>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and> \n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;; \n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;; \n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;; \n     \\<acute>q :== \\<acute>r OD\n \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\n\napply (rule CombineStrip' [OF rev_moduloGuards rev_noFault])\napply  simp\napply simp\ndone\n\n\ntext {* In the previous example the effort to split up the prove did not\nreally pay off. But when we think of programs with a lot of guards and\ncomplicated specifications it may be better to first focus on a prove without\nthe messy guards. Maybe it is possible to automate the no fault proofs so\nthat it suffices to focus on the stripped program. \n*}\n\ncontext list_alloc\nbegin\ntext {*\nThe purpose of guards is to watch for faults that can occur during \nevaluation of expressions. In the example before we watched for null pointer\ndereferencing or memory faults. We can also look for array index bounds or\ndivision by zero. As the condition of a while loop is evaluated in each\niteration we cannot just add a guard before the while loop. Instead we need\na special guard for the condition.\nExample: @{term \"WHILE  \\<lbrace>\\<acute>p\\<noteq>Null\\<rbrace>\\<longmapsto> \\<acute>p\\<rightarrow>\\<acute>next\\<noteq>Null DO SKIP OD\"}\n*}\nend\n\nsubsection {* Cicular Lists *}\ndefinition\n  distPath :: \"ref \\<Rightarrow> (ref \\<Rightarrow> ref) \\<Rightarrow> ref \\<Rightarrow> ref list \\<Rightarrow> bool\" where\n  \"distPath x next y as = (Path x next y as  \\<and>  distinct as)\"\n\n\nlemma neq_dP: \"\\<lbrakk>p \\<noteq> q; Path p h q Ps; distinct Ps\\<rbrakk> \\<Longrightarrow>\n \\<exists>Qs. p\\<noteq>Null \\<and> Ps = p#Qs \\<and> p \\<notin> set Qs\"\nby (cases Ps, auto)\n\nlemma (in list_alloc) circular_list_rev_I:\n  \"\\<Gamma>,\\<Theta>\\<turnstile> \\<lbrace>\\<acute>root = r \\<and>  distPath \\<acute>root \\<acute>next \\<acute>root (r#Ps)\\<rbrace>\n   \\<acute>p :== \\<acute>root;; \\<acute>q :== \\<acute>root\\<rightarrow>\\<acute>next;;\n  WHILE \\<acute>q \\<noteq> \\<acute>root\n  INV \\<lbrace>\\<exists> ps qs. distPath \\<acute>p \\<acute>next \\<acute>root ps  \\<and> distPath \\<acute>q \\<acute>next \\<acute>root qs \\<and> \n             \\<acute>root = r \\<and> r\\<noteq>Null \\<and> r \\<notin> set Ps  \\<and> set ps \\<inter> set qs = {} \\<and> \n             Ps = (rev ps) @ qs \\<rbrace>\n  DO \\<acute>tmp :== \\<acute>q;; \\<acute>q :== \\<acute>q\\<rightarrow>\\<acute>next;; \\<acute>tmp\\<rightarrow>\\<acute>next :== \\<acute>p;; \\<acute>p:==\\<acute>tmp OD;;\n  \\<acute>root\\<rightarrow>\\<acute>next :== \\<acute>p\n  \\<lbrace>\\<acute>root = r \\<and> distPath \\<acute>root \\<acute>next \\<acute>root (r#rev Ps)\\<rbrace>\"\napply (simp only:distPath_def)\napply vcg\napply   (rule_tac x=\"[]\" in exI)\napply   fastforce\napply  clarsimp\napply  (drule (2) neq_dP)\napply  (rule_tac x=\"q # ps\" in exI)\napply  clarsimp\napply fastforce\ndone\n\n\n\nlemma path_is_list:\"\\<And>a next b. \\<lbrakk>Path b next a Ps ; a \\<notin> set Ps; a\\<noteq>Null\\<rbrakk> \n\\<Longrightarrow> List b (next(a := Null)) (Ps @ [a])\"\napply (induct Ps)\napply (auto simp add:fun_upd_apply)\ndone\n\ntext {*\nThe simple algorithm for acyclic list reversal, with modified\nannotations, works for cyclic lists as well.: \n*}\n\nlemma (in list_alloc) circular_list_rev_II:\n \"\\<Gamma>,\\<Theta>\\<turnstile>\n \\<lbrace>\\<acute>p = r \\<and> distPath \\<acute>p \\<acute>next \\<acute>p (r#Ps)\\<rbrace>\n\\<acute>q:==Null;;\nWHILE \\<acute>p \\<noteq> Null\nINV\n \\<lbrace> ((\\<acute>q = Null) \\<longrightarrow> (\\<exists>ps. distPath \\<acute>p \\<acute>next r ps  \\<and>  ps = r#Ps)) \\<and>\n  ((\\<acute>q \\<noteq> Null) \\<longrightarrow> (\\<exists>ps qs. distPath \\<acute>q \\<acute>next r qs  \\<and> List \\<acute>p \\<acute>next ps  \\<and>\n                   set ps \\<inter> set qs = {} \\<and> rev qs @ ps = Ps@[r])) \\<and>\n  \\<not> (\\<acute>p = Null \\<and> \\<acute>q = Null \\<and> r = Null )\n   \\<rbrace>\nDO\n  \\<acute>tmp :== \\<acute>p;; \\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;; \\<acute>tmp\\<rightarrow>\\<acute>next :== \\<acute>q;; \\<acute>q:==\\<acute>tmp\nOD\n \\<lbrace>\\<acute>q = r \\<and> distPath \\<acute>q \\<acute>next \\<acute>q (r # rev Ps)\\<rbrace>\"\n\napply (simp only:distPath_def)\napply vcg\napply   clarsimp\napply  clarsimp\napply  (case_tac \"(q = Null)\")\napply   (fastforce intro: path_is_list)\napply  clarify\napply  (rule_tac x=\"psa\" in exI)\napply  (rule_tac x=\" p # qs\" in exI) \napply  force\napply fastforce\ndone\n\ntext{* Although the above algorithm is more succinct, its invariant\nlooks more involved. The reason for the case distinction on @{term q}\nis due to the fact that during execution, the pointer variables can\npoint to either cyclic or acyclic structures.\n*}\n\ntext {*\nWhen working on lists, its sometimes better to remove\n@{thm[source] fun_upd_apply} from the simpset, and instead include @{thm[source] fun_upd_same} and @{thm[source] fun_upd_other} to\nthe simpset\n*}\n\n(*\ndeclare fun_upd_apply[simp del]fun_upd_same[simp] fun_upd_other[simp]\n*)\n\n\nlemma (in state_space) \"\\<Gamma>\\<turnstile> {\\<sigma>}\n            \\<acute>I :== \\<acute>M;; \n            ANNO \\<tau>. \\<lbrace>\\<tau>. \\<acute>I = \\<^bsup>\\<sigma>\\<^esup>M\\<rbrace>\n                      \\<acute>M :== \\<acute>N;; \\<acute>N :== \\<acute>I \n                    \\<lbrace>\\<acute>M = \\<^bsup>\\<tau>\\<^esup>N \\<and> \\<acute>N = \\<^bsup>\\<tau>\\<^esup>I\\<rbrace>\n            \\<lbrace>\\<acute>M = \\<^bsup>\\<sigma>\\<^esup>N \\<and> \\<acute>N = \\<^bsup>\\<sigma>\\<^esup>M\\<rbrace>\"\napply vcg\napply auto\ndone\n\ncontext state_space\nbegin\nterm \"ANNO (\\<tau>,m,k). (\\<lbrace>\\<tau>. \\<acute>M = m\\<rbrace>) \\<acute>M :== \\<acute>N;; \\<acute>N :== \\<acute>I \\<lbrace>\\<acute>M = \\<^bsup> \\<tau>\\<^esup>N & \\<acute>N = \\<^bsup>\\<tau>\\<^esup>I\\<rbrace>,{}\"\nend\n\nlemma (in state_space) \"\\<Gamma>\\<turnstile> ({\\<sigma>} \\<inter> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>)\n      (ANNO \\<tau>. ({\\<tau>} \\<inter> \\<lbrace>\\<acute>A=\\<^bsup>\\<sigma>\\<^esup>A \\<and> \\<acute>I=\\<^bsup>\\<sigma>\\<^esup>I \\<and> \\<acute>M=0 \\<and> \\<acute>S=0\\<rbrace>)\n      WHILE \\<acute>M \\<noteq> \\<acute>A\n      INV \\<lbrace>\\<acute>S = \\<acute>M * \\<acute>I \\<and> \\<acute>A=\\<^bsup>\\<tau>\\<^esup>A \\<and> \\<acute>I=\\<^bsup>\\<tau>\\<^esup>I\\<rbrace>\n      DO \\<acute>S :== \\<acute>S + \\<acute>I;; \\<acute>M :== \\<acute>M + 1 OD\n      \\<lbrace>\\<acute>S = \\<^bsup>\\<tau>\\<^esup>A * \\<^bsup>\\<tau>\\<^esup>I\\<rbrace>)\n      \\<lbrace>\\<acute>S = \\<^bsup>\\<sigma>\\<^esup>A * \\<^bsup>\\<sigma>\\<^esup>I\\<rbrace>\"\napply vcg_step\napply vcg_step\napply simp\napply vcg_step\napply vcg_step\napply simp\napply vcg\napply simp\napply simp\napply vcg_step\napply auto\ndone\n\ntext {* Just some test on marked, guards *}\nlemma (in state_space) \"\\<Gamma>\\<turnstile>\\<lbrace>True\\<rbrace> WHILE \\<lbrace>P \\<acute>N \\<rbrace>\\<surd>, \\<lbrace>Q \\<acute>M\\<rbrace>#, \\<lbrace>R \\<acute>N\\<rbrace>\\<longmapsto> \\<acute>N < \\<acute>M \n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace> DO\n                    \\<acute>N :== \\<acute>M\n                  OD \n           \\<lbrace>hard\\<rbrace>\"\napply vcg\noops\n\nlemma (in state_space) \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>True\\<rbrace> WHILE \\<lbrace>P \\<acute>N \\<rbrace>\\<surd>, \\<lbrace>Q \\<acute>M\\<rbrace>#, \\<lbrace>R \\<acute>N\\<rbrace>\\<longmapsto> \\<acute>N < \\<acute>M \n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace> DO\n                    \\<acute>N :== \\<acute>M\n                  OD \n           \\<lbrace>hard\\<rbrace>\"\napply vcg\noops\n\nend \n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/hoare-package/ex/VcgExSP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819591324416, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3318968176070757}}
{"text": "theory Prelude_NumericClasses\nimports \"$HETS_LIB/Isabelle/MainHC\"\nuses \"$HETS_LIB/Isabelle/prelude\"\nbegin\n\nML \"Header.initialize\n    [\\\"NotFalse\\\", \\\"NotTrue\\\", \\\"AndFalse\\\", \\\"AndTrue\\\", \\\"AndSym\\\",\n     \\\"OrDef\\\", \\\"OtherwiseDef\\\", \\\"NotFalse1\\\", \\\"NotTrue1\\\",\n     \\\"notNot1\\\", \\\"notNot2\\\", \\\"EqualTDef\\\", \\\"EqualSymDef\\\",\n     \\\"EqualReflex\\\", \\\"EqualTransT\\\", \\\"DiffDef\\\", \\\"DiffSymDef\\\",\n     \\\"DiffTDef\\\", \\\"DiffFDef\\\", \\\"TE1\\\", \\\"TE2\\\", \\\"TE3\\\", \\\"TE4\\\",\n     \\\"IUE1\\\", \\\"IUE2\\\", \\\"IBE1\\\", \\\"IBE2\\\", \\\"IBE3\\\", \\\"IBE4\\\",\n     \\\"IBE5\\\", \\\"IBE6\\\", \\\"IBE7\\\", \\\"IBE8\\\", \\\"IOE01\\\", \\\"IOE02\\\",\n     \\\"IOE03\\\", \\\"IOE04\\\", \\\"IOE05\\\", \\\"IOE06\\\", \\\"IOE07\\\", \\\"IOE08\\\",\n     \\\"IOE09\\\", \\\"LeIrreflexivity\\\", \\\"LeTAsymmetry\\\",\n     \\\"LeTTransitive\\\", \\\"LeTTotal\\\", \\\"GeDef\\\", \\\"GeIrreflexivity\\\",\n     \\\"GeTAsymmetry\\\", \\\"GeTTransitive\\\", \\\"GeTTotal\\\", \\\"LeqDef\\\",\n     \\\"LeqReflexivity\\\", \\\"LeqTTransitive\\\", \\\"LeqTTotal\\\", \\\"GeqDef\\\",\n     \\\"GeqReflexivity\\\", \\\"GeqTTransitive\\\", \\\"GeqTTotal\\\",\n     \\\"EqTSOrdRel\\\", \\\"EqFSOrdRel\\\", \\\"EqTOrdRel\\\", \\\"EqFOrdRel\\\",\n     \\\"EqTOrdTSubstE\\\", \\\"EqTOrdFSubstE\\\", \\\"EqTOrdTSubstD\\\",\n     \\\"EqTOrdFSubstD\\\", \\\"LeTGeFEqFRel\\\", \\\"LeFGeTEqTRel\\\",\n     \\\"LeTGeTRel\\\", \\\"LeFGeFRel\\\", \\\"LeqTGetTRel\\\", \\\"LeqFGetFRel\\\",\n     \\\"GeTLeTRel\\\", \\\"GeFLeFRel\\\", \\\"GeqTLeqTRel\\\", \\\"GeqFLeqFRel\\\",\n     \\\"LeqTGeFRel\\\", \\\"LeqFGeTRel\\\", \\\"GeTLeFEqFRel\\\", \\\"GeFLeTEqTRel\\\",\n     \\\"GeqTLeFRel\\\", \\\"GeqFLeTRel\\\", \\\"LeqTLeTEqTRel\\\",\n     \\\"LeqFLeFEqFRel\\\", \\\"GeqTGeTEqTRel\\\", \\\"GeqFGeFEqFRel\\\",\n     \\\"LeTGeqFRel\\\", \\\"GeTLeqFRel\\\", \\\"LeLeqDiff\\\", \\\"CmpLTDef\\\",\n     \\\"CmpEQDef\\\", \\\"CmpGTDef\\\", \\\"MaxYDef\\\", \\\"MaxXDef\\\", \\\"MinXDef\\\",\n     \\\"MinYDef\\\", \\\"MaxSym\\\", \\\"MinSym\\\", \\\"TO1\\\", \\\"TO2\\\", \\\"TO3\\\",\n     \\\"TO4\\\", \\\"TO5\\\", \\\"TO6\\\", \\\"TO7\\\", \\\"IUO01\\\", \\\"IUO02\\\",\n     \\\"IUO03\\\", \\\"IUO04\\\", \\\"IUO05\\\", \\\"IUO06\\\", \\\"IUO07\\\", \\\"IOO13\\\",\n     \\\"IOO14\\\", \\\"IOO15\\\", \\\"IOO16\\\", \\\"IOO17\\\", \\\"IOO18\\\", \\\"IOO19\\\",\n     \\\"IOO20\\\", \\\"IOO21\\\", \\\"IOO22\\\", \\\"IOO23\\\", \\\"IOO24\\\", \\\"IOO25\\\",\n     \\\"IOO26\\\", \\\"IOO27\\\", \\\"IOO28\\\", \\\"IOO29\\\", \\\"IOO30\\\", \\\"IOO31\\\",\n     \\\"IOO32\\\", \\\"IOO33\\\", \\\"IBO5\\\", \\\"IBO6\\\", \\\"IBO7\\\", \\\"IBO8\\\",\n     \\\"IBO9\\\", \\\"IBO10\\\", \\\"IBO11\\\", \\\"IBO12\\\", \\\"ga_selector_pre\\\",\n     \\\"ga_injective_suc\\\", \\\"ga_disjoint_0_suc\\\",\n     \\\"ga_selector_undef_pre_0\\\", \\\"X1_def_Nat\\\", \\\"X2_def_Nat\\\",\n     \\\"X3_def_Nat\\\", \\\"X4_def_Nat\\\", \\\"X5_def_Nat\\\", \\\"X6_def_Nat\\\",\n     \\\"X7_def_Nat\\\", \\\"X8_def_Nat\\\", \\\"X9_def_Nat\\\", \\\"decimal_def\\\",\n     \\\"ga_comm___XPlus__\\\", \\\"ga_assoc___XPlus__\\\",\n     \\\"ga_right_unit___XPlus__\\\", \\\"ga_left_unit___XPlus__\\\",\n     \\\"ga_left_comm___XPlus__\\\", \\\"ga_comm___Xx__\\\",\n     \\\"ga_assoc___Xx__\\\", \\\"ga_right_unit___Xx__\\\",\n     \\\"ga_left_unit___Xx__\\\", \\\"ga_left_comm___Xx__\\\", \\\"ga_comm_min\\\",\n     \\\"ga_assoc_min\\\", \\\"ga_left_comm_min\\\", \\\"ga_comm_max\\\",\n     \\\"ga_assoc_max\\\", \\\"ga_right_unit_max\\\", \\\"ga_left_unit_max\\\",\n     \\\"ga_left_comm_max\\\", \\\"leq_def1_Nat\\\", \\\"dvd_def_Nat\\\",\n     \\\"leq_def2_Nat\\\", \\\"leq_def3_Nat\\\", \\\"geq_def_Nat\\\",\n     \\\"less_def_Nat\\\", \\\"greater_def_Nat\\\", \\\"even_0_Nat\\\",\n     \\\"even_suc_Nat\\\", \\\"odd_def_Nat\\\", \\\"factorial_0\\\",\n     \\\"factorial_suc\\\", \\\"add_0_Nat\\\", \\\"add_suc_Nat\\\", \\\"mult_0_Nat\\\",\n     \\\"mult_suc_Nat\\\", \\\"power_0_Nat\\\", \\\"power_suc_Nat\\\",\n     \\\"min_def_Nat\\\", \\\"max_def_Nat\\\", \\\"subTotal_def1_Nat\\\",\n     \\\"subTotal_def2_Nat\\\", \\\"sub_dom_Nat\\\", \\\"sub_def_Nat\\\",\n     \\\"divide_dom_Nat\\\", \\\"divide_0_Nat\\\", \\\"divide_Pos_Nat\\\",\n     \\\"div_dom_Nat\\\", \\\"div_Nat\\\", \\\"mod_dom_Nat\\\", \\\"mod_Nat\\\",\n     \\\"distr1_Nat\\\", \\\"distr2_Nat\\\", \\\"Pos_def\\\", \\\"X1_as_Pos_def\\\",\n     \\\"min_0\\\", \\\"div_mod_Nat\\\", \\\"power_Nat\\\", \\\"ga_generated_Int\\\",\n     \\\"equality_Int\\\", \\\"Nat2Int_embedding\\\", \\\"ga_comm___XPlus___1\\\",\n     \\\"ga_assoc___XPlus___1\\\", \\\"ga_right_unit___XPlus___1\\\",\n     \\\"ga_left_unit___XPlus___1\\\", \\\"ga_left_comm___XPlus___1\\\",\n     \\\"ga_comm___Xx___1\\\", \\\"ga_assoc___Xx___1\\\",\n     \\\"ga_right_unit___Xx___1\\\", \\\"ga_left_unit___Xx___1\\\",\n     \\\"ga_left_comm___Xx___1\\\", \\\"ga_comm_min_1\\\", \\\"ga_comm_max_1\\\",\n     \\\"ga_assoc_min_1\\\", \\\"ga_assoc_max_1\\\", \\\"ga_left_comm_min_1\\\",\n     \\\"ga_left_comm_max_1\\\", \\\"leq_def_Int\\\", \\\"geq_def_Int\\\",\n     \\\"less_def_Int\\\", \\\"greater_def_Int\\\", \\\"even_def_Int\\\",\n     \\\"odd_def_Int\\\", \\\"odd_alt_Int\\\", \\\"neg_def_Int\\\",\n     \\\"sign_def_Int\\\", \\\"abs_def_Int\\\", \\\"add_def_Int\\\",\n     \\\"mult_def_Int\\\", \\\"sub_def_Int\\\", \\\"min_def_Int\\\",\n     \\\"max_def_Int\\\", \\\"power_neg1_Int\\\", \\\"power_others_Int\\\",\n     \\\"divide_dom2_Int\\\", \\\"divide_alt_Int\\\", \\\"divide_Int\\\",\n     \\\"div_dom_Int\\\", \\\"div_Int\\\", \\\"quot_dom_Int\\\", \\\"quot_neg_Int\\\",\n     \\\"quot_nonneg_Int\\\", \\\"rem_dom_Int\\\", \\\"quot_rem_Int\\\",\n     \\\"rem_nonneg_Int\\\", \\\"mod_dom_Int\\\", \\\"mod_Int\\\", \\\"distr1_Int\\\",\n     \\\"distr2_Int\\\", \\\"Int_Nat_sub_compat\\\", \\\"abs_decomp_Int\\\",\n     \\\"mod_abs_Int\\\", \\\"div_mod_Int\\\", \\\"quot_abs_Int\\\",\n     \\\"rem_abs_Int\\\", \\\"quot_rem_Int_1\\\", \\\"power_Int\\\",\n     \\\"ga_generated_Rat\\\", \\\"equality_Rat\\\", \\\"Int2Rat_embedding\\\",\n     \\\"ga_comm___XPlus___2_1\\\", \\\"ga_assoc___XPlus___2_1\\\",\n     \\\"ga_right_unit___XPlus___2_1\\\", \\\"ga_left_unit___XPlus___2_1\\\",\n     \\\"ga_left_comm___XPlus___2_1\\\", \\\"ga_comm___Xx___2_1\\\",\n     \\\"ga_assoc___Xx___2_1\\\", \\\"ga_right_unit___Xx___2_1\\\",\n     \\\"ga_left_unit___Xx___2_1\\\", \\\"ga_left_comm___Xx___2_1\\\",\n     \\\"ga_comm_min_2_1\\\", \\\"ga_comm_max_2_1\\\", \\\"ga_assoc_min_2_1\\\",\n     \\\"ga_assoc_max_2_1\\\", \\\"ga_left_comm_min_2_1\\\",\n     \\\"ga_left_comm_max_2_1\\\", \\\"leq_def_Rat\\\", \\\"geq_def_Rat\\\",\n     \\\"less_def_Rat\\\", \\\"greater_def_Rat\\\", \\\"minus_def_Rat\\\",\n     \\\"abs_def_Rat\\\", \\\"add_def_Rat\\\", \\\"sub_def_Rat\\\",\n     \\\"mult_def_Rat\\\", \\\"min_def_Rat\\\", \\\"max_def_Rat\\\",\n     \\\"divide_def1_Rat\\\", \\\"divide_def2_Rat\\\", \\\"power_0_Rat\\\",\n     \\\"power_suc_Rat\\\", \\\"power_neg_Rat\\\", \\\"distr1_Rat\\\",\n     \\\"distr2_Rat\\\", \\\"sub_rule_Rat\\\", \\\"divide_dom_Rat\\\",\n     \\\"divide_rule_Rat\\\", \\\"power_Rat\\\", \\\"IPN01\\\", \\\"IPN02\\\",\n     \\\"IPN03\\\", \\\"IPN04\\\", \\\"IPN05\\\", \\\"IPN06\\\", \\\"IPN07\\\", \\\"INN01\\\",\n     \\\"INN02\\\", \\\"INN03\\\", \\\"INN04\\\", \\\"INN05\\\", \\\"INN06\\\", \\\"INN07\\\",\n     \\\"IIN01\\\", \\\"IIN02\\\", \\\"IIN03\\\", \\\"IIN04\\\", \\\"IIN05\\\", \\\"IIN06\\\",\n     \\\"IIN07\\\", \\\"IIN07_1\\\", \\\"IIN08\\\", \\\"IIN09\\\", \\\"IRN01\\\", \\\"IRN02\\\",\n     \\\"IRN03\\\", \\\"IRN04\\\", \\\"IRN05\\\", \\\"IRN06\\\", \\\"IRN07\\\", \\\"IRN07_1\\\",\n     \\\"IRN08\\\", \\\"IRN09\\\", \\\"IRI01\\\", \\\"IRI02\\\", \\\"IRI03\\\", \\\"IRI04\\\",\n     \\\"IRI05\\\", \\\"IRI06\\\", \\\"IRI01_1\\\", \\\"IRI02_1\\\", \\\"IRF01\\\",\n     \\\"IRF02\\\", \\\"AbsSignumLaw\\\"]\"\n\ntypedecl Bool\ntypedecl Pos\ntypedecl Rat\ntypedecl Unit\ntypedecl X_Int\n\ndatatype Ordering = EQ | GT | LT\ndatatype X_Nat = X0X2 (\"0''''\") | sucX1 \"X_Nat\" (\"suc''/'(_')\" [3] 999)\n\nconsts\nNot__X :: \"bool => bool\" (\"(Not''/ _)\" [56] 56)\nX0X1 :: \"X_Int\" (\"0''\")\nX0X3 :: \"Rat\" (\"0'_3\")\nX1X1 :: \"X_Int\" (\"1''\")\nX1X2 :: \"X_Nat\" (\"1''''\")\nX1X3 :: \"Pos\" (\"1'_3\")\nX1X4 :: \"Rat\" (\"1'_4\")\nX2X1 :: \"X_Int\" (\"2''\")\nX2X2 :: \"X_Nat\" (\"2''''\")\nX2X3 :: \"Rat\" (\"2'_3\")\nX3X1 :: \"X_Int\" (\"3''\")\nX3X2 :: \"X_Nat\" (\"3''''\")\nX3X3 :: \"Rat\" (\"3'_3\")\nX4X1 :: \"X_Int\" (\"4''\")\nX4X2 :: \"X_Nat\" (\"4''''\")\nX4X3 :: \"Rat\" (\"4'_3\")\nX5X1 :: \"X_Int\" (\"5''\")\nX5X2 :: \"X_Nat\" (\"5''''\")\nX5X3 :: \"Rat\" (\"5'_3\")\nX6X1 :: \"X_Int\" (\"6''\")\nX6X2 :: \"X_Nat\" (\"6''''\")\nX6X3 :: \"Rat\" (\"6'_3\")\nX7X1 :: \"X_Int\" (\"7''\")\nX7X2 :: \"X_Nat\" (\"7''''\")\nX7X3 :: \"Rat\" (\"7'_3\")\nX8X1 :: \"X_Int\" (\"8''\")\nX8X2 :: \"X_Nat\" (\"8''''\")\nX8X3 :: \"Rat\" (\"8'_3\")\nX9X1 :: \"X_Int\" (\"9''\")\nX9X2 :: \"X_Nat\" (\"9''''\")\nX9X3 :: \"Rat\" (\"9'_3\")\nXMinus__XX1 :: \"X_Int => X_Int\" (\"(-''/ _)\" [56] 56)\nXMinus__XX2 :: \"Rat => Rat\" (\"(-''''/ _)\" [56] 56)\nX__XAmpXAmp__X :: \"bool => bool => bool\" (\"(_/ &&/ _)\" [54,54] 52)\nX__XAtXAt__X :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ @@/ _)\" [54,54] 52)\nX__XCaret__XX1 :: \"X_Int => X_Nat => X_Int\" (\"(_/ ^''/ _)\" [54,54] 52)\nX__XCaret__XX2 :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ ^''''/ _)\" [54,54] 52)\nX__XCaret__XX3 :: \"Rat => X_Int => Rat partial\" (\"(_/ ^'_3/ _)\" [54,54] 52)\nX__XEqXEq__X :: \"'a partial => 'a partial => bool\" (\"(_/ ==''/ _)\" [54,54] 52)\nX__XExclam :: \"X_Nat => X_Nat\" (\"(_/ !'')\" [58] 58)\nX__XGtXEq__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ >=''/ _)\" [44,44] 42)\nX__XGtXEq__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ >=''''/ _)\" [44,44] 42)\nX__XGtXEq__XX3 :: \"Rat => Rat => bool\" (\"(_/ >='_3/ _)\" [44,44] 42)\nX__XGtXEq__XX4 :: \"'a partial => 'a partial => bool\" (\"(_/ >='_4/ _)\" [54,54] 52)\nX__XGt__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ >''/ _)\" [44,44] 42)\nX__XGt__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ >''''/ _)\" [44,44] 42)\nX__XGt__XX3 :: \"Rat => Rat => bool\" (\"(_/ >'_3/ _)\" [44,44] 42)\nX__XGt__XX4 :: \"'a partial => 'a partial => bool\" (\"(_/ >'_4/ _)\" [54,54] 52)\nX__XLtXEq__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ <=''/ _)\" [44,44] 42)\nX__XLtXEq__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ <=''''/ _)\" [44,44] 42)\nX__XLtXEq__XX3 :: \"Rat => Rat => bool\" (\"(_/ <='_3/ _)\" [44,44] 42)\nX__XLtXEq__XX4 :: \"'a partial => 'a partial => bool\" (\"(_/ <='_4/ _)\" [54,54] 52)\nX__XLt__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ <''/ _)\" [44,44] 42)\nX__XLt__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ <''''/ _)\" [44,44] 42)\nX__XLt__XX3 :: \"Rat => Rat => bool\" (\"(_/ <'_3/ _)\" [44,44] 42)\nX__XLt__XX4 :: \"'a partial => 'a partial => bool\" (\"(_/ <'_4/ _)\" [54,54] 52)\nX__XMinusXExclam__X :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ -!/ _)\" [54,54] 52)\nX__XMinusXQuest__X :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ -?/ _)\" [54,54] 52)\nX__XMinus__XX1 :: \"X_Int => X_Int => X_Int\" (\"(_/ -''/ _)\" [54,54] 52)\nX__XMinus__XX2 :: \"X_Nat => X_Nat => X_Int\" (\"(_/ -''''/ _)\" [54,54] 52)\nX__XMinus__XX3 :: \"Rat => Rat => Rat\" (\"(_/ -'_3/ _)\" [54,54] 52)\nX__XMinus__XX4 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ -'_4/ _)\" [54,54] 52)\nX__XPlus__XX1 :: \"X_Int => X_Int => X_Int\" (\"(_/ +''/ _)\" [54,54] 52)\nX__XPlus__XX2 :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ +''''/ _)\" [54,54] 52)\nX__XPlus__XX3 :: \"X_Nat => Pos => Pos\" (\"(_/ +'_3/ _)\" [54,54] 52)\nX__XPlus__XX4 :: \"Pos => X_Nat => Pos\" (\"(_/ +'_4/ _)\" [54,54] 52)\nX__XPlus__XX5 :: \"Rat => Rat => Rat\" (\"(_/ +'_5/ _)\" [54,54] 52)\nX__XPlus__XX6 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ +'_6/ _)\" [54,54] 52)\nX__XSlashXEq__X :: \"'a partial => 'a partial => bool\" (\"(_/ '/=/ _)\" [54,54] 52)\nX__XSlashXQuest__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ '/?''/ _)\" [54,54] 52)\nX__XSlashXQuest__XX2 :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ '/?''''/ _)\" [54,54] 52)\nX__XSlash__XX1 :: \"X_Int => Pos => Rat\" (\"(_/ '/''/ _)\" [54,54] 52)\nX__XSlash__XX2 :: \"Rat => Rat => Rat partial\" (\"(_/ '/''''/ _)\" [54,54] 52)\nX__XSlash__XX3 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ '/'_3/ _)\" [54,54] 52)\nX__XVBarXVBar__X :: \"bool => bool => bool\" (\"(_/ ||/ _)\" [54,54] 52)\nX__Xx__XX1 :: \"X_Int => X_Int => X_Int\" (\"(_/ *''/ _)\" [54,54] 52)\nX__Xx__XX2 :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ *''''/ _)\" [54,54] 52)\nX__Xx__XX3 :: \"Pos => Pos => Pos\" (\"(_/ *'_3/ _)\" [54,54] 52)\nX__Xx__XX4 :: \"Rat => Rat => Rat\" (\"(_/ *'_4/ _)\" [54,54] 52)\nX__Xx__XX5 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ *'_5/ _)\" [54,54] 52)\nX__div__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ div''/ _)\" [54,54] 52)\nX__div__XX2 :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ div''''/ _)\" [54,54] 52)\nX__div__XX3 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ div'_3/ _)\" [54,54] 52)\nX__dvd__X :: \"X_Nat => X_Nat => bool\" (\"(_/ dvd''/ _)\" [44,44] 42)\nX__mod__XX1 :: \"X_Int => X_Int => X_Nat partial\" (\"(_/ mod''/ _)\" [54,54] 52)\nX__mod__XX2 :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ mod''''/ _)\" [54,54] 52)\nX__mod__XX3 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ mod'_3/ _)\" [54,54] 52)\nX__quot__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ quot''/ _)\" [54,54] 52)\nX__quot__XX2 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ quot''''/ _)\" [54,54] 52)\nX__rem__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ rem''/ _)\" [54,54] 52)\nX__rem__XX2 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ rem''''/ _)\" [54,54] 52)\nX_absX1 :: \"X_Int => X_Nat\" (\"abs''/'(_')\" [3] 999)\nX_absX2 :: \"Rat => Rat\" (\"abs''''/'(_')\" [3] 999)\nX_absX3 :: \"'a partial => 'a partial\" (\"abs'_3/'(_')\" [3] 999)\nX_evenX1 :: \"X_Int => bool\" (\"even''/'(_')\" [3] 999)\nX_evenX2 :: \"X_Nat => bool\" (\"even''''/'(_')\" [3] 999)\nX_fromInteger :: \"X_Int => 'a partial\" (\"fromInteger/'(_')\" [3] 999)\nX_gn_inj :: \"'a => 'b\" (\"gn'_inj/'(_')\" [3] 999)\nX_gn_proj :: \"'a => 'b partial\" (\"gn'_proj/'(_')\" [3] 999)\nX_maxX1 :: \"X_Int => X_Int => X_Int\" (\"max''/'(_,/ _')\" [3,3] 999)\nX_maxX2 :: \"X_Nat => X_Nat => X_Nat\" (\"max''''/'(_,/ _')\" [3,3] 999)\nX_maxX3 :: \"Rat => Rat => Rat\" (\"max'_3/'(_,/ _')\" [3,3] 999)\nX_maxX4 :: \"'a partial => 'a partial => 'a partial\"\nX_minX1 :: \"X_Int => X_Int => X_Int\" (\"min''/'(_,/ _')\" [3,3] 999)\nX_minX2 :: \"X_Nat => X_Nat => X_Nat\" (\"min''''/'(_,/ _')\" [3,3] 999)\nX_minX3 :: \"Rat => Rat => Rat\" (\"min'_3/'(_,/ _')\" [3,3] 999)\nX_minX4 :: \"'a partial => 'a partial => 'a partial\"\nX_negate :: \"'a partial => 'a partial\" (\"negate/'(_')\" [3] 999)\nX_oddX1 :: \"X_Int => bool\" (\"odd''/'(_')\" [3] 999)\nX_oddX2 :: \"X_Nat => bool\" (\"odd''''/'(_')\" [3] 999)\nX_pre :: \"X_Nat => X_Nat partial\" (\"pre/'(_')\" [3] 999)\nX_recip :: \"'a partial => 'a partial\" (\"recip/'(_')\" [3] 999)\nX_sign :: \"X_Int => X_Int\" (\"sign/'(_')\" [3] 999)\nX_signum :: \"'a partial => 'a partial\" (\"signum/'(_')\" [3] 999)\nX_toInteger :: \"'a partial => X_Int\" (\"toInteger/'(_')\" [3] 999)\ncompare :: \"'a partial => 'a partial => Ordering partial\"\ndivMod :: \"'a partial => 'a partial => 'a partial * 'a partial\"\notherwiseH :: \"bool\"\nquotRem :: \"'a partial => 'a partial => 'a partial * 'a partial\"\nsucX2 :: \"X_Nat => Pos\" (\"suc''''/'(_')\" [3] 999)\n\naxioms\nNotFalse [rule_format] : \"Not' False\"\n\nNotTrue [rule_format] : \"~ Not' True\"\n\nAndFalse [rule_format] : \"ALL x. ~ False && x\"\n\nAndTrue [rule_format] : \"ALL x. True && x = x\"\n\nAndSym [rule_format] : \"ALL x. ALL y. x && y = y && x\"\n\nOrDef [rule_format] :\n\"ALL x. ALL y. x || y = Not' (Not' x && Not' y)\"\n\nOtherwiseDef [rule_format] : \"otherwiseH\"\n\nNotFalse1 [rule_format] : \"ALL x. Not' x = (~ x)\"\n\nNotTrue1 [rule_format] : \"ALL x. ~ Not' x = x\"\n\nnotNot1 [rule_format] : \"ALL x. (~ x) = Not' x\"\n\nnotNot2 [rule_format] : \"ALL x. (~ ~ x) = (~ Not' x)\"\n\nEqualTDef [rule_format] : \"ALL x. ALL y. x = y --> x ==' y\"\n\nEqualSymDef [rule_format] : \"ALL x. ALL y. x ==' y = y ==' x\"\n\nEqualReflex [rule_format] : \"ALL x. x ==' x\"\n\nEqualTransT [rule_format] :\n\"ALL x. ALL y. ALL z. x ==' y & y ==' z --> x ==' z\"\n\nDiffDef [rule_format] : \"ALL x. ALL y. x /= y = Not' (x ==' y)\"\n\nDiffSymDef [rule_format] : \"ALL x. ALL y. x /= y = y /= x\"\n\nDiffTDef [rule_format] : \"ALL x. ALL y. x /= y = Not' (x ==' y)\"\n\nDiffFDef [rule_format] : \"ALL x. ALL y. (~ x /= y) = x ==' y\"\n\nTE1 [rule_format] : \"ALL x. ALL y. ~ x ==' y --> ~ x = y\"\n\nTE2 [rule_format] : \"ALL x. ALL y. Not' (x ==' y) = (~ x ==' y)\"\n\nTE3 [rule_format] : \"ALL x. ALL y. (~ Not' (x ==' y)) = x ==' y\"\n\nTE4 [rule_format] : \"ALL x. ALL y. (~ x ==' y) = (~ x ==' y)\"\n\nIUE1 [rule_format] : \"makePartial () ==' makePartial ()\"\n\nIUE2 [rule_format] : \"~ makePartial () /= makePartial ()\"\n\nIBE1 [rule_format] : \"makePartial () ==' makePartial ()\"\n\nIBE2 [rule_format] : \"undefinedOp ==' undefinedOp\"\n\nIBE3 [rule_format] : \"~ undefinedOp ==' makePartial ()\"\n\nIBE4 [rule_format] : \"~ makePartial () ==' undefinedOp\"\n\nIBE5 [rule_format] : \"makePartial () /= undefinedOp\"\n\nIBE6 [rule_format] : \"undefinedOp /= makePartial ()\"\n\nIBE7 [rule_format] : \"Not' (makePartial () ==' undefinedOp)\"\n\nIBE8 [rule_format] : \"~ Not' Not' (makePartial () ==' undefinedOp)\"\n\nIOE01 [rule_format] : \"makePartial LT ==' makePartial LT\"\n\nIOE02 [rule_format] : \"makePartial EQ ==' makePartial EQ\"\n\nIOE03 [rule_format] : \"makePartial GT ==' makePartial GT\"\n\nIOE04 [rule_format] : \"~ makePartial LT ==' makePartial EQ\"\n\nIOE05 [rule_format] : \"~ makePartial LT ==' makePartial GT\"\n\nIOE06 [rule_format] : \"~ makePartial EQ ==' makePartial GT\"\n\nIOE07 [rule_format] : \"makePartial LT /= makePartial EQ\"\n\nIOE08 [rule_format] : \"makePartial LT /= makePartial GT\"\n\nIOE09 [rule_format] : \"makePartial EQ /= makePartial GT\"\n\nLeIrreflexivity [rule_format] :\n\"ALL x. ALL y. x ==' y --> ~ x <_4 y\"\n\nLeTAsymmetry [rule_format] : \"ALL x. ALL y. x <_4 y --> ~ y <_4 x\"\n\nLeTTransitive [rule_format] :\n\"ALL x. ALL y. ALL z. x <_4 y & y <_4 z --> x <_4 z\"\n\nLeTTotal [rule_format] :\n\"ALL x. ALL y. (x <_4 y | y <_4 x) | x ==' y\"\n\nGeDef [rule_format] : \"ALL x. ALL y. x >_4 y = y <_4 x\"\n\nGeIrreflexivity [rule_format] :\n\"ALL x. ALL y. x ==' y --> ~ x >_4 y\"\n\nGeTAsymmetry [rule_format] : \"ALL x. ALL y. x >_4 y --> ~ y >_4 x\"\n\nGeTTransitive [rule_format] :\n\"ALL x. ALL y. ALL z. (x >_4 y) && (y >_4 z) --> x >_4 z\"\n\nGeTTotal [rule_format] :\n\"ALL x. ALL y. ((x >_4 y) || (y >_4 x)) || (x ==' y)\"\n\nLeqDef [rule_format] :\n\"ALL x. ALL y. x <=_4 y = (x <_4 y) || (x ==' y)\"\n\nLeqReflexivity [rule_format] : \"ALL x. x <=_4 x\"\n\nLeqTTransitive [rule_format] :\n\"ALL x. ALL y. ALL z. (x <=_4 y) && (y <=_4 z) --> x <=_4 z\"\n\nLeqTTotal [rule_format] :\n\"ALL x. ALL y. (x <=_4 y) && (y <=_4 x) = x ==' y\"\n\nGeqDef [rule_format] :\n\"ALL x. ALL y. x >=_4 y = (x >_4 y) || (x ==' y)\"\n\nGeqReflexivity [rule_format] : \"ALL x. x >=_4 x\"\n\nGeqTTransitive [rule_format] :\n\"ALL x. ALL y. ALL z. (x >=_4 y) && (y >=_4 z) --> x >=_4 z\"\n\nGeqTTotal [rule_format] :\n\"ALL x. ALL y. (x >=_4 y) && (y >=_4 x) = x ==' y\"\n\nEqTSOrdRel [rule_format] :\n\"ALL x. ALL y. x ==' y = (~ x <_4 y & ~ x >_4 y)\"\n\nEqFSOrdRel [rule_format] :\n\"ALL x. ALL y. (~ x ==' y) = (x <_4 y | x >_4 y)\"\n\nEqTOrdRel [rule_format] :\n\"ALL x. ALL y. x ==' y = (x <=_4 y & x >=_4 y)\"\n\nEqFOrdRel [rule_format] :\n\"ALL x. ALL y. (~ x ==' y) = (x <=_4 y | x >=_4 y)\"\n\nEqTOrdTSubstE [rule_format] :\n\"ALL x. ALL y. ALL z. x ==' y & y <_4 z --> x <_4 z\"\n\nEqTOrdFSubstE [rule_format] :\n\"ALL x. ALL y. ALL z. x ==' y & ~ y <_4 z --> ~ x <_4 z\"\n\nEqTOrdTSubstD [rule_format] :\n\"ALL x. ALL y. ALL z. x ==' y & z <_4 y --> z <_4 x\"\n\nEqTOrdFSubstD [rule_format] :\n\"ALL x. ALL y. ALL z. x ==' y & ~ z <_4 y --> ~ z <_4 x\"\n\nLeTGeFEqFRel [rule_format] :\n\"ALL x. ALL y. x <_4 y = (~ x >_4 y & ~ x ==' y)\"\n\nLeFGeTEqTRel [rule_format] :\n\"ALL x. ALL y. (~ x <_4 y) = (x >_4 y | x ==' y)\"\n\nLeTGeTRel [rule_format] : \"ALL x. ALL y. x <_4 y = y >_4 x\"\n\nLeFGeFRel [rule_format] : \"ALL x. ALL y. (~ x <_4 y) = (~ y >_4 x)\"\n\nLeqTGetTRel [rule_format] : \"ALL x. ALL y. x <=_4 y = y >=_4 x\"\n\nLeqFGetFRel [rule_format] :\n\"ALL x. ALL y. (~ x <=_4 y) = (~ y >=_4 x)\"\n\nGeTLeTRel [rule_format] : \"ALL x. ALL y. x >_4 y = y <_4 x\"\n\nGeFLeFRel [rule_format] : \"ALL x. ALL y. (~ x >_4 y) = (~ y <_4 x)\"\n\nGeqTLeqTRel [rule_format] : \"ALL x. ALL y. x >=_4 y = y <=_4 x\"\n\nGeqFLeqFRel [rule_format] :\n\"ALL x. ALL y. (~ x >=_4 y) = (~ y <=_4 x)\"\n\nLeqTGeFRel [rule_format] : \"ALL x. ALL y. x <=_4 y = (~ x >_4 y)\"\n\nLeqFGeTRel [rule_format] : \"ALL x. ALL y. (~ x <=_4 y) = x >_4 y\"\n\nGeTLeFEqFRel [rule_format] :\n\"ALL x. ALL y. x >_4 y = (~ x <_4 y & ~ x ==' y)\"\n\nGeFLeTEqTRel [rule_format] :\n\"ALL x. ALL y. (~ x >_4 y) = (x <_4 y | x ==' y)\"\n\nGeqTLeFRel [rule_format] : \"ALL x. ALL y. x >=_4 y = (~ x <_4 y)\"\n\nGeqFLeTRel [rule_format] : \"ALL x. ALL y. (~ x >=_4 y) = x <_4 y\"\n\nLeqTLeTEqTRel [rule_format] :\n\"ALL x. ALL y. x <=_4 y = (x <_4 y | x ==' y)\"\n\nLeqFLeFEqFRel [rule_format] :\n\"ALL x. ALL y. (~ x <=_4 y) = (~ x <_4 y & ~ x ==' y)\"\n\nGeqTGeTEqTRel [rule_format] :\n\"ALL x. ALL y. x >=_4 y = (x >_4 y | x ==' y)\"\n\nGeqFGeFEqFRel [rule_format] :\n\"ALL x. ALL y. (~ x >=_4 y) = (~ x >_4 y & ~ x ==' y)\"\n\nLeTGeqFRel [rule_format] : \"ALL x. ALL y. x <_4 y = (~ x >=_4 y)\"\n\nGeTLeqFRel [rule_format] : \"ALL x. ALL y. x >_4 y = (~ x <=_4 y)\"\n\nLeLeqDiff [rule_format] :\n\"ALL x. ALL y. x <_4 y = (x <=_4 y) && (x /= y)\"\n\nCmpLTDef [rule_format] :\n\"ALL x. ALL y. compare x y ==' makePartial LT = x <_4 y\"\n\nCmpEQDef [rule_format] :\n\"ALL x. ALL y. compare x y ==' makePartial EQ = x ==' y\"\n\nCmpGTDef [rule_format] :\n\"ALL x. ALL y. compare x y ==' makePartial GT = x >_4 y\"\n\nMaxYDef [rule_format] :\n\"ALL x. ALL y. X_maxX4 x y ==' y = x <=_4 y\"\n\nMaxXDef [rule_format] :\n\"ALL x. ALL y. X_maxX4 x y ==' x = y <=_4 x\"\n\nMinXDef [rule_format] :\n\"ALL x. ALL y. X_minX4 x y ==' x = x <=_4 y\"\n\nMinYDef [rule_format] :\n\"ALL x. ALL y. X_minX4 x y ==' y = y <=_4 x\"\n\nMaxSym [rule_format] :\n\"ALL x. ALL y. X_maxX4 x y ==' y = X_maxX4 y x ==' y\"\n\nMinSym [rule_format] :\n\"ALL x. ALL y. X_minX4 x y ==' y = X_minX4 y x ==' y\"\n\nTO1 [rule_format] : \"ALL x. ALL y. (x ==' y | x <_4 y) = x <=_4 y\"\n\nTO2 [rule_format] : \"ALL x. ALL y. x ==' y --> ~ x <_4 y\"\n\nTO3 [rule_format] :\n\"ALL x. ALL y. Not' Not' (x <_4 y) | Not' (x <_4 y)\"\n\nTO4 [rule_format] : \"ALL x. ALL y. x <_4 y --> Not' (x ==' y)\"\n\nTO5 [rule_format] :\n\"ALL w.\n ALL x. ALL y. ALL z. (x <_4 y & y <_4 z) & z <_4 w --> x <_4 w\"\n\nTO6 [rule_format] : \"ALL x. ALL z. z <_4 x --> Not' (x <_4 z)\"\n\nTO7 [rule_format] : \"ALL x. ALL y. x <_4 y = y >_4 x\"\n\nIUO01 [rule_format] : \"makePartial () <=_4 makePartial ()\"\n\nIUO02 [rule_format] : \"~ makePartial () <_4 makePartial ()\"\n\nIUO03 [rule_format] : \"makePartial () >=_4 makePartial ()\"\n\nIUO04 [rule_format] : \"~ makePartial () >_4 makePartial ()\"\n\nIUO05 [rule_format] :\n\"X_maxX4 (makePartial ()) (makePartial ()) ==' makePartial ()\"\n\nIUO06 [rule_format] :\n\"X_minX4 (makePartial ()) (makePartial ()) ==' makePartial ()\"\n\nIUO07 [rule_format] :\n\"compare (makePartial ()) (makePartial ()) ==' makePartial EQ\"\n\nIOO13 [rule_format] : \"makePartial LT <_4 makePartial EQ\"\n\nIOO14 [rule_format] : \"makePartial EQ <_4 makePartial GT\"\n\nIOO15 [rule_format] : \"makePartial LT <_4 makePartial GT\"\n\nIOO16 [rule_format] : \"makePartial LT <=_4 makePartial EQ\"\n\nIOO17 [rule_format] : \"makePartial EQ <=_4 makePartial GT\"\n\nIOO18 [rule_format] : \"makePartial LT <=_4 makePartial GT\"\n\nIOO19 [rule_format] : \"makePartial EQ >=_4 makePartial LT\"\n\nIOO20 [rule_format] : \"makePartial GT >=_4 makePartial EQ\"\n\nIOO21 [rule_format] : \"makePartial GT >=_4 makePartial LT\"\n\nIOO22 [rule_format] : \"makePartial EQ >_4 makePartial LT\"\n\nIOO23 [rule_format] : \"makePartial GT >_4 makePartial EQ\"\n\nIOO24 [rule_format] : \"makePartial GT >_4 makePartial LT\"\n\nIOO25 [rule_format] :\n\"X_maxX4 (makePartial LT) (makePartial EQ) ==' makePartial EQ\"\n\nIOO26 [rule_format] :\n\"X_maxX4 (makePartial EQ) (makePartial GT) ==' makePartial GT\"\n\nIOO27 [rule_format] :\n\"X_maxX4 (makePartial LT) (makePartial GT) ==' makePartial GT\"\n\nIOO28 [rule_format] :\n\"X_minX4 (makePartial LT) (makePartial EQ) ==' makePartial LT\"\n\nIOO29 [rule_format] :\n\"X_minX4 (makePartial EQ) (makePartial GT) ==' makePartial EQ\"\n\nIOO30 [rule_format] :\n\"X_minX4 (makePartial LT) (makePartial GT) ==' makePartial LT\"\n\nIOO31 [rule_format] :\n\"compare (makePartial LT) (makePartial LT) ==' makePartial EQ\"\n\nIOO32 [rule_format] :\n\"compare (makePartial EQ) (makePartial EQ) ==' makePartial EQ\"\n\nIOO33 [rule_format] :\n\"compare (makePartial GT) (makePartial GT) ==' makePartial EQ\"\n\nIBO5 [rule_format] : \"undefinedOp <_4 makePartial ()\"\n\nIBO6 [rule_format] : \"~ undefinedOp >=_4 makePartial ()\"\n\nIBO7 [rule_format] : \"makePartial () >=_4 undefinedOp\"\n\nIBO8 [rule_format] : \"~ makePartial () <_4 undefinedOp\"\n\nIBO9 [rule_format] :\n\"X_maxX4 undefinedOp (makePartial ()) ==' makePartial ()\"\n\nIBO10 [rule_format] :\n\"X_minX4 undefinedOp (makePartial ()) ==' undefinedOp\"\n\nIBO11 [rule_format] :\n\"compare (makePartial ()) (makePartial ()) ==' makePartial EQ\"\n\nIBO12 [rule_format] :\n\"compare undefinedOp undefinedOp ==' makePartial EQ\"\n\nga_selector_pre [rule_format] :\n\"ALL XX1. pre(suc'(XX1)) = makePartial XX1\"\n\nga_injective_suc [rule_format] :\n\"ALL XX1. ALL Y1. suc'(XX1) = suc'(Y1) = (XX1 = Y1)\"\n\nga_disjoint_0_suc [rule_format] : \"ALL Y1. ~ 0'' = suc'(Y1)\"\n\nga_selector_undef_pre_0 [rule_format] : \"~ defOp (pre(0''))\"\n\nX1_def_Nat [rule_format] : \"1'' = suc'(0'')\"\n\nX2_def_Nat [rule_format] : \"2'' = suc'(1'')\"\n\nX3_def_Nat [rule_format] : \"3'' = suc'(2'')\"\n\nX4_def_Nat [rule_format] : \"4'' = suc'(3'')\"\n\nX5_def_Nat [rule_format] : \"5'' = suc'(4'')\"\n\nX6_def_Nat [rule_format] : \"6'' = suc'(5'')\"\n\nX7_def_Nat [rule_format] : \"7'' = suc'(6'')\"\n\nX8_def_Nat [rule_format] : \"8'' = suc'(7'')\"\n\nX9_def_Nat [rule_format] : \"9'' = suc'(8'')\"\n\ndecimal_def [rule_format] :\n\"ALL m. ALL X_n. m @@ X_n = (m *'' suc'(9'')) +'' X_n\"\n\nga_comm___XPlus__ [rule_format] : \"ALL x. ALL y. x +'' y = y +'' x\"\n\nga_assoc___XPlus__ [rule_format] :\n\"ALL x. ALL y. ALL z. (x +'' y) +'' z = x +'' (y +'' z)\"\n\nga_right_unit___XPlus__ [rule_format] : \"ALL x. x +'' 0'' = x\"\n\nga_left_unit___XPlus__ [rule_format] : \"ALL x. 0'' +'' x = x\"\n\nga_left_comm___XPlus__ [rule_format] :\n\"ALL x. ALL y. ALL z. x +'' (y +'' z) = y +'' (x +'' z)\"\n\nga_comm___Xx__ [rule_format] : \"ALL x. ALL y. x *'' y = y *'' x\"\n\nga_assoc___Xx__ [rule_format] :\n\"ALL x. ALL y. ALL z. (x *'' y) *'' z = x *'' (y *'' z)\"\n\nga_right_unit___Xx__ [rule_format] : \"ALL x. x *'' 1'' = x\"\n\nga_left_unit___Xx__ [rule_format] : \"ALL x. 1'' *'' x = x\"\n\nga_left_comm___Xx__ [rule_format] :\n\"ALL x. ALL y. ALL z. x *'' (y *'' z) = y *'' (x *'' z)\"\n\nga_comm_min [rule_format] :\n\"ALL x. ALL y. min''(x, y) = min''(y, x)\"\n\nga_assoc_min [rule_format] :\n\"ALL x.\n ALL y. ALL z. min''(min''(x, y), z) = min''(x, min''(y, z))\"\n\nga_left_comm_min [rule_format] :\n\"ALL x.\n ALL y. ALL z. min''(x, min''(y, z)) = min''(y, min''(x, z))\"\n\nga_comm_max [rule_format] :\n\"ALL x. ALL y. max''(x, y) = max''(y, x)\"\n\nga_assoc_max [rule_format] :\n\"ALL x.\n ALL y. ALL z. max''(max''(x, y), z) = max''(x, max''(y, z))\"\n\nga_right_unit_max [rule_format] : \"ALL x. max''(x, 0'') = x\"\n\nga_left_unit_max [rule_format] : \"ALL x. max''(0'', x) = x\"\n\nga_left_comm_max [rule_format] :\n\"ALL x.\n ALL y. ALL z. max''(x, max''(y, z)) = max''(y, max''(x, z))\"\n\nleq_def1_Nat [rule_format] : \"ALL X_n. 0'' <='' X_n\"\n\ndvd_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m dvd' X_n) = (EX k. X_n = m *'' k)\"\n\nleq_def2_Nat [rule_format] : \"ALL X_n. ~ suc'(X_n) <='' 0''\"\n\nleq_def3_Nat [rule_format] :\n\"ALL m. ALL X_n. (suc'(m) <='' suc'(X_n)) = (m <='' X_n)\"\n\ngeq_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m >='' X_n) = (X_n <='' m)\"\n\nless_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m <'' X_n) = (m <='' X_n & ~ m = X_n)\"\n\ngreater_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m >'' X_n) = (X_n <'' m)\"\n\neven_0_Nat [rule_format] : \"even''(0'')\"\n\neven_suc_Nat [rule_format] : \"ALL m. even''(suc'(m)) = odd''(m)\"\n\nodd_def_Nat [rule_format] : \"ALL m. odd''(m) = (~ even''(m))\"\n\nfactorial_0 [rule_format] : \"0'' !' = 1''\"\n\nfactorial_suc [rule_format] :\n\"ALL X_n. suc'(X_n) !' = suc'(X_n) *'' X_n !'\"\n\nadd_0_Nat [rule_format] : \"ALL m. 0'' +'' m = m\"\n\nadd_suc_Nat [rule_format] :\n\"ALL m. ALL X_n. suc'(X_n) +'' m = suc'(X_n +'' m)\"\n\nmult_0_Nat [rule_format] : \"ALL m. 0'' *'' m = 0''\"\n\nmult_suc_Nat [rule_format] :\n\"ALL m. ALL X_n. suc'(X_n) *'' m = (X_n *'' m) +'' m\"\n\npower_0_Nat [rule_format] : \"ALL m. m ^'' 0'' = 1''\"\n\npower_suc_Nat [rule_format] :\n\"ALL m. ALL X_n. m ^'' suc'(X_n) = m *'' (m ^'' X_n)\"\n\nmin_def_Nat [rule_format] :\n\"ALL m. ALL X_n. min''(m, X_n) = (if m <='' X_n then m else X_n)\"\n\nmax_def_Nat [rule_format] :\n\"ALL m. ALL X_n. max''(m, X_n) = (if m <='' X_n then X_n else m)\"\n\nsubTotal_def1_Nat [rule_format] :\n\"ALL m. ALL X_n. m >'' X_n --> X_n -! m = 0''\"\n\nsubTotal_def2_Nat [rule_format] :\n\"ALL m. ALL X_n. m <='' X_n --> makePartial (X_n -! m) = X_n -? m\"\n\nsub_dom_Nat [rule_format] :\n\"ALL m. ALL X_n. defOp (m -? X_n) = (m >='' X_n)\"\n\nsub_def_Nat [rule_format] :\n\"ALL m. ALL X_n. ALL r. m -? X_n = makePartial r = (m = r +'' X_n)\"\n\ndivide_dom_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n defOp (m /?'' X_n) = (~ X_n = 0'' & m mod'' X_n = makePartial 0'')\"\n\ndivide_0_Nat [rule_format] : \"ALL m. ~ defOp (m /?'' 0'')\"\n\ndivide_Pos_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n X_n >'' 0'' --> m /?'' X_n = makePartial r = (m = r *'' X_n)\"\n\ndiv_dom_Nat [rule_format] :\n\"ALL m. ALL X_n. defOp (m div'' X_n) = (~ X_n = 0'')\"\n\ndiv_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m div'' X_n = makePartial r =\n (EX s. m = (X_n *'' r) +'' s & s <'' X_n)\"\n\nmod_dom_Nat [rule_format] :\n\"ALL m. ALL X_n. defOp (m mod'' X_n) = (~ X_n = 0'')\"\n\nmod_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL s.\n m mod'' X_n = makePartial s =\n (EX r. m = (X_n *'' r) +'' s & s <'' X_n)\"\n\ndistr1_Nat [rule_format] :\n\"ALL r. ALL s. ALL t. (r +'' s) *'' t = (r *'' t) +'' (s *'' t)\"\n\ndistr2_Nat [rule_format] :\n\"ALL r. ALL s. ALL t. t *'' (r +'' s) = (t *'' r) +'' (t *'' s)\"\n\nPos_def [rule_format] : \"ALL p. defOp (gn_proj(p)) = (p >'' 0'')\"\n\nX1_as_Pos_def [rule_format] : \"1_3 = suc''(0'')\"\n\nmin_0 [rule_format] : \"ALL m. min''(m, 0'') = 0''\"\n\ndiv_mod_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ~ X_n = 0'' -->\n makePartial m =\n restrictOp\n (makePartial\n  ((makeTotal (m div'' X_n) *'' X_n) +'' makeTotal (m mod'' X_n)))\n (defOp (m div'' X_n) & defOp (m mod'' X_n))\"\n\npower_Nat [rule_format] :\n\"ALL m. ALL r. ALL s. m ^'' (r +'' s) = (m ^'' r) *'' (m ^'' s)\"\n\nga_generated_Int [rule_format] :\n\"ALL p_Int.\n (ALL x_1. ALL x_2. p_Int (x_1 -'' x_2)) --> (ALL x. p_Int x)\"\n\nequality_Int [rule_format] :\n\"ALL a.\n ALL b. ALL c. ALL d. a -'' b = c -'' d = (a +'' d = c +'' b)\"\n\nNat2Int_embedding [rule_format] : \"ALL a. gn_inj(a) = a -'' 0''\"\n\nga_comm___XPlus___1 [rule_format] : \"ALL x. ALL y. x +' y = y +' x\"\n\nga_assoc___XPlus___1 [rule_format] :\n\"ALL x. ALL y. ALL z. (x +' y) +' z = x +' (y +' z)\"\n\nga_right_unit___XPlus___1 [rule_format] :\n\"ALL x. x +' gn_inj(0'') = x\"\n\nga_left_unit___XPlus___1 [rule_format] :\n\"ALL x. gn_inj(0'') +' x = x\"\n\nga_left_comm___XPlus___1 [rule_format] :\n\"ALL x. ALL y. ALL z. x +' (y +' z) = y +' (x +' z)\"\n\nga_comm___Xx___1 [rule_format] : \"ALL x. ALL y. x *' y = y *' x\"\n\nga_assoc___Xx___1 [rule_format] :\n\"ALL x. ALL y. ALL z. (x *' y) *' z = x *' (y *' z)\"\n\nga_right_unit___Xx___1 [rule_format] :\n\"ALL x. x *' gn_inj(1_3) = x\"\n\nga_left_unit___Xx___1 [rule_format] : \"ALL x. gn_inj(1_3) *' x = x\"\n\nga_left_comm___Xx___1 [rule_format] :\n\"ALL x. ALL y. ALL z. x *' (y *' z) = y *' (x *' z)\"\n\nga_comm_min_1 [rule_format] :\n\"ALL x. ALL y. min'(x, y) = min'(y, x)\"\n\nga_comm_max_1 [rule_format] :\n\"ALL x. ALL y. max'(x, y) = max'(y, x)\"\n\nga_assoc_min_1 [rule_format] :\n\"ALL x. ALL y. ALL z. min'(min'(x, y), z) = min'(x, min'(y, z))\"\n\nga_assoc_max_1 [rule_format] :\n\"ALL x. ALL y. ALL z. max'(max'(x, y), z) = max'(x, max'(y, z))\"\n\nga_left_comm_min_1 [rule_format] :\n\"ALL x. ALL y. ALL z. min'(x, min'(y, z)) = min'(y, min'(x, z))\"\n\nga_left_comm_max_1 [rule_format] :\n\"ALL x. ALL y. ALL z. max'(x, max'(y, z)) = max'(y, max'(x, z))\"\n\nleq_def_Int [rule_format] :\n\"ALL m. ALL X_n. (m <=' X_n) = defOp (gn_proj(X_n -' m))\"\n\ngeq_def_Int [rule_format] :\n\"ALL m. ALL X_n. (m >=' X_n) = (X_n <=' m)\"\n\nless_def_Int [rule_format] :\n\"ALL m. ALL X_n. (m <' X_n) = (m <=' X_n & ~ m = X_n)\"\n\ngreater_def_Int [rule_format] :\n\"ALL m. ALL X_n. (m >' X_n) = (X_n <' m)\"\n\neven_def_Int [rule_format] : \"ALL m. even'(m) = even''(abs'(m))\"\n\nodd_def_Int [rule_format] : \"ALL m. odd'(m) = (~ even'(m))\"\n\nodd_alt_Int [rule_format] : \"ALL m. odd'(m) = odd''(abs'(m))\"\n\nneg_def_Int [rule_format] : \"ALL a. ALL b. -' (a -'' b) = b -'' a\"\n\nsign_def_Int [rule_format] :\n\"ALL m.\n sign(m) =\n (if m = gn_inj(0'') then gn_inj(0'')\n     else if m >' gn_inj(0'') then gn_inj(1_3) else -' gn_inj(1_3))\"\n\nabs_def_Int [rule_format] :\n\"ALL m. gn_inj(abs'(m)) = (if m <' gn_inj(0'') then -' m else m)\"\n\nadd_def_Int [rule_format] :\n\"ALL a.\n ALL b.\n ALL c. ALL d. (a -'' b) +' (c -'' d) = (a +'' c) -'' (b +'' d)\"\n\nmult_def_Int [rule_format] :\n\"ALL a.\n ALL b.\n ALL c.\n ALL d.\n (a -'' b) *' (c -'' d) =\n ((a *'' c) +'' (b *'' d)) -'' ((b *'' c) +'' (a *'' d))\"\n\nsub_def_Int [rule_format] :\n\"ALL m. ALL X_n. m -' X_n = m +' -' X_n\"\n\nmin_def_Int [rule_format] :\n\"ALL m. ALL X_n. min'(m, X_n) = (if m <=' X_n then m else X_n)\"\n\nmax_def_Int [rule_format] :\n\"ALL m. ALL X_n. max'(m, X_n) = (if m <=' X_n then X_n else m)\"\n\npower_neg1_Int [rule_format] :\n\"ALL a.\n -' gn_inj(1_3) ^' a =\n (if even''(a) then gn_inj(1_3) else -' gn_inj(1_3))\"\n\npower_others_Int [rule_format] :\n\"ALL m.\n ALL a.\n ~ m = -' gn_inj(1_3) -->\n m ^' a = (sign(m) ^' a) *' gn_inj(abs'(m) ^'' a)\"\n\ndivide_dom2_Int [rule_format] :\n\"ALL m.\n ALL X_n. defOp (m /?' X_n) = (m mod' X_n = makePartial 0'')\"\n\ndivide_alt_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m /?' X_n = makePartial r = (~ X_n = gn_inj(0'') & X_n *' r = m)\"\n\ndivide_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n m /?' X_n =\n restrictOp\n (makePartial\n  ((sign(m) *' sign(X_n)) *'\n   gn_inj(makeTotal (abs'(m) /?'' abs'(X_n)))))\n (defOp (abs'(m) /?'' abs'(X_n)))\"\n\ndiv_dom_Int [rule_format] :\n\"ALL m. ALL X_n. defOp (m div' X_n) = (~ X_n = gn_inj(0''))\"\n\ndiv_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m div' X_n = makePartial r =\n (EX a. m = (X_n *' r) +' gn_inj(a) & a <'' abs'(X_n))\"\n\nquot_dom_Int [rule_format] :\n\"ALL m. ALL X_n. defOp (m quot' X_n) = (~ X_n = gn_inj(0''))\"\n\nquot_neg_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m <' gn_inj(0'') -->\n m quot' X_n = makePartial r =\n (EX s.\n  m = (X_n *' r) +' s &\n  gn_inj(0'') >=' s & s >' -' gn_inj(abs'(X_n)))\"\n\nquot_nonneg_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m >=' gn_inj(0'') -->\n m quot' X_n = makePartial r =\n (EX s.\n  m = (X_n *' r) +' s & gn_inj(0'') <=' s & s <' gn_inj(abs'(X_n)))\"\n\nrem_dom_Int [rule_format] :\n\"ALL m. ALL X_n. defOp (m rem' X_n) = (~ X_n = gn_inj(0''))\"\n\nquot_rem_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL s.\n m <' gn_inj(0'') -->\n m rem' X_n = makePartial s =\n (EX r.\n  m = (X_n *' r) +' s &\n  gn_inj(0'') >=' s & s >' -' gn_inj(abs'(X_n)))\"\n\nrem_nonneg_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL s.\n m >=' gn_inj(0'') -->\n m rem' X_n = makePartial s =\n (EX r.\n  m = (X_n *' r) +' s & gn_inj(0'') <=' s & s <' gn_inj(abs'(X_n)))\"\n\nmod_dom_Int [rule_format] :\n\"ALL m. ALL X_n. defOp (m mod' X_n) = (~ X_n = gn_inj(0''))\"\n\nmod_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL a.\n m mod' X_n = makePartial a =\n (EX r. m = (X_n *' r) +' gn_inj(a) & a <'' abs'(X_n))\"\n\ndistr1_Int [rule_format] :\n\"ALL r. ALL s. ALL t. (r +' s) *' t = (r *' t) +' (s *' t)\"\n\ndistr2_Int [rule_format] :\n\"ALL r. ALL s. ALL t. t *' (r +' s) = (t *' r) +' (t *' s)\"\n\nInt_Nat_sub_compat [rule_format] :\n\"ALL a.\n ALL b.\n defOp (a -? b) -->\n restrictOp (makePartial (gn_inj(makeTotal (a -? b))))\n (defOp (a -? b)) =\n makePartial (a -'' b)\"\n\nabs_decomp_Int [rule_format] :\n\"ALL m. m = sign(m) *' gn_inj(abs'(m))\"\n\nmod_abs_Int [rule_format] :\n\"ALL m. ALL X_n. m mod' X_n = m mod' gn_inj(abs'(X_n))\"\n\ndiv_mod_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ~ X_n = gn_inj(0'') -->\n makePartial m =\n restrictOp\n (makePartial\n  ((makeTotal (m div' X_n) *' X_n) +'\n   gn_inj(makeTotal (m mod' X_n))))\n (defOp (m div' X_n) & defOp (m mod' X_n))\"\n\nquot_abs_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n restrictOp (makePartial (gn_inj(abs'(makeTotal (m quot' X_n)))))\n (defOp (m quot' X_n)) =\n gn_inj(abs'(m)) quot' gn_inj(abs'(X_n))\"\n\nrem_abs_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n restrictOp (makePartial (gn_inj(abs'(makeTotal (m rem' X_n)))))\n (defOp (m rem' X_n)) =\n gn_inj(abs'(m)) rem' gn_inj(abs'(X_n))\"\n\nquot_rem_Int_1 [rule_format] :\n\"ALL m.\n ALL X_n.\n ~ X_n = gn_inj(0'') -->\n makePartial m =\n restrictOp\n (makePartial\n  ((makeTotal (m quot' X_n) *' X_n) +' makeTotal (m rem' X_n)))\n (defOp (m quot' X_n) & defOp (m rem' X_n))\"\n\npower_Int [rule_format] :\n\"ALL m. ALL a. ALL b. m ^' (a +'' b) = (m ^' a) *' (m ^' b)\"\n\nga_generated_Rat [rule_format] :\n\"ALL p_Rat.\n (ALL x_1. ALL x_2. p_Rat (x_1 /' x_2)) --> (ALL x. p_Rat x)\"\n\nequality_Rat [rule_format] :\n\"ALL i.\n ALL j.\n ALL p. ALL q. i /' p = j /' q = (i *' gn_inj(q) = j *' gn_inj(p))\"\n\nInt2Rat_embedding [rule_format] : \"ALL i. gn_inj(i) = i /' 1_3\"\n\nga_comm___XPlus___2_1 [rule_format] :\n\"ALL x. ALL y. x +_5 y = y +_5 x\"\n\nga_assoc___XPlus___2_1 [rule_format] :\n\"ALL x. ALL y. ALL z. (x +_5 y) +_5 z = x +_5 (y +_5 z)\"\n\nga_right_unit___XPlus___2_1 [rule_format] :\n\"ALL x. x +_5 gn_inj(0'') = x\"\n\nga_left_unit___XPlus___2_1 [rule_format] :\n\"ALL x. gn_inj(0'') +_5 x = x\"\n\nga_left_comm___XPlus___2_1 [rule_format] :\n\"ALL x. ALL y. ALL z. x +_5 (y +_5 z) = y +_5 (x +_5 z)\"\n\nga_comm___Xx___2_1 [rule_format] :\n\"ALL x. ALL y. x *_4 y = y *_4 x\"\n\nga_assoc___Xx___2_1 [rule_format] :\n\"ALL x. ALL y. ALL z. (x *_4 y) *_4 z = x *_4 (y *_4 z)\"\n\nga_right_unit___Xx___2_1 [rule_format] :\n\"ALL x. x *_4 gn_inj(1_3) = x\"\n\nga_left_unit___Xx___2_1 [rule_format] :\n\"ALL x. gn_inj(1_3) *_4 x = x\"\n\nga_left_comm___Xx___2_1 [rule_format] :\n\"ALL x. ALL y. ALL z. x *_4 (y *_4 z) = y *_4 (x *_4 z)\"\n\nga_comm_min_2_1 [rule_format] :\n\"ALL x. ALL y. min_3(x, y) = min_3(y, x)\"\n\nga_comm_max_2_1 [rule_format] :\n\"ALL x. ALL y. max_3(x, y) = max_3(y, x)\"\n\nga_assoc_min_2_1 [rule_format] :\n\"ALL x.\n ALL y. ALL z. min_3(min_3(x, y), z) = min_3(x, min_3(y, z))\"\n\nga_assoc_max_2_1 [rule_format] :\n\"ALL x.\n ALL y. ALL z. max_3(max_3(x, y), z) = max_3(x, max_3(y, z))\"\n\nga_left_comm_min_2_1 [rule_format] :\n\"ALL x.\n ALL y. ALL z. min_3(x, min_3(y, z)) = min_3(y, min_3(x, z))\"\n\nga_left_comm_max_2_1 [rule_format] :\n\"ALL x.\n ALL y. ALL z. max_3(x, max_3(y, z)) = max_3(y, max_3(x, z))\"\n\nleq_def_Rat [rule_format] :\n\"ALL p.\n ALL q.\n ALL i.\n ALL j. (i /' p <=_3 j /' q) = (i *' gn_inj(q) <=' j *' gn_inj(p))\"\n\ngeq_def_Rat [rule_format] : \"ALL x. ALL y. (x >=_3 y) = (y <=_3 x)\"\n\nless_def_Rat [rule_format] :\n\"ALL x. ALL y. (x <_3 y) = (x <=_3 y & ~ x = y)\"\n\ngreater_def_Rat [rule_format] :\n\"ALL x. ALL y. (x >_3 y) = (y <_3 x)\"\n\nminus_def_Rat [rule_format] :\n\"ALL p. ALL i. -'' (i /' p) = -' i /' p\"\n\nabs_def_Rat [rule_format] :\n\"ALL p. ALL i. abs''(i /' p) = gn_inj(abs'(i)) /' p\"\n\nadd_def_Rat [rule_format] :\n\"ALL p.\n ALL q.\n ALL i.\n ALL j.\n (i /' p) +_5 (j /' q) =\n ((i *' gn_inj(q)) +' (j *' gn_inj(p))) /' (p *_3 q)\"\n\nsub_def_Rat [rule_format] : \"ALL x. ALL y. x -_3 y = x +_5 -'' y\"\n\nmult_def_Rat [rule_format] :\n\"ALL p.\n ALL q. ALL i. ALL j. (i /' p) *_4 (j /' q) = (i *' j) /' (p *_3 q)\"\n\nmin_def_Rat [rule_format] :\n\"ALL x. ALL y. min_3(x, y) = (if x <=_3 y then x else y)\"\n\nmax_def_Rat [rule_format] :\n\"ALL x. ALL y. max_3(x, y) = (if x <=_3 y then y else x)\"\n\ndivide_def1_Rat [rule_format] :\n\"ALL x. ~ defOp (x /'' gn_inj(0''))\"\n\ndivide_def2_Rat [rule_format] :\n\"ALL x.\n ALL y.\n ALL z.\n ~ y = gn_inj(0'') --> x /'' y = makePartial z = (x = z *_4 y)\"\n\npower_0_Rat [rule_format] :\n\"ALL x. x ^_3 gn_inj(0'') = makePartial (gn_inj(1_3))\"\n\npower_suc_Rat [rule_format] :\n\"ALL X_n.\n ALL x.\n x ^_3 gn_inj(suc''(X_n)) =\n restrictOp (makePartial (x *_4 makeTotal (x ^_3 gn_inj(X_n))))\n (defOp (x ^_3 gn_inj(X_n)))\"\n\npower_neg_Rat [rule_format] :\n\"ALL p.\n ALL x.\n x ^_3 -' gn_inj(p) =\n restrictOp (gn_inj(1_3) /'' makeTotal (x ^_3 gn_inj(p)))\n (defOp (x ^_3 gn_inj(p)))\"\n\ndistr1_Rat [rule_format] :\n\"ALL x. ALL y. ALL z. (x +_5 y) *_4 z = (x *_4 z) +_5 (y *_4 z)\"\n\ndistr2_Rat [rule_format] :\n\"ALL x. ALL y. ALL z. z *_4 (x +_5 y) = (z *_4 x) +_5 (z *_4 y)\"\n\nsub_rule_Rat [rule_format] :\n\"ALL i.\n ALL j.\n ALL p.\n ALL q.\n (i /' p) -_3 (j /' q) =\n ((i *' gn_inj(q)) -' (j *' gn_inj(p))) /' (p *_3 q)\"\n\ndivide_dom_Rat [rule_format] :\n\"ALL x. ALL y. defOp (x /'' y) = (~ y = gn_inj(0''))\"\n\ndivide_rule_Rat [rule_format] :\n\"ALL i.\n ALL j.\n ALL p.\n ALL q.\n ~ j = gn_inj(0'') -->\n (i /' p) /'' (j /' q) =\n gn_inj(i *' gn_inj(q)) /'' gn_inj(gn_inj(p) *' j)\"\n\npower_Rat [rule_format] :\n\"ALL i.\n ALL j.\n ALL x.\n x ^_3 (i +' j) =\n restrictOp\n (makePartial (makeTotal (x ^_3 i) *_4 makeTotal (x ^_3 j)))\n (defOp (x ^_3 i) & defOp (x ^_3 j))\"\n\nIPN01 [rule_format] :\n\"ALL x.\n ALL y.\n makePartial (gn_inj(x) +' gn_inj(y)) =\n gn_inj(gn_inj(x) +'' gn_inj(y))\"\n\nIPN02 [rule_format] :\n\"ALL x.\n ALL y.\n makePartial (gn_inj(x) *' gn_inj(y)) =\n gn_inj(gn_inj(x) *'' gn_inj(y))\"\n\nIPN03 [rule_format] :\n\"ALL x.\n ALL y.\n makePartial (gn_inj(x) -' gn_inj(y)) =\n gn_inj(gn_inj(x) -! gn_inj(y))\"\n\nIPN04 [rule_format] :\n\"ALL x.\n gn_inj(negate(makePartial x)) = makePartial (0'' -! gn_inj(x))\"\n\nIPN05 [rule_format] : \"ALL x. abs_3(makePartial x) = makePartial x\"\n\nIPN06 [rule_format] :\n\"ALL x. signum(makePartial x) = makePartial 1_3\"\n\nIPN07 [rule_format] : \"ALL z. fromInteger(z) = gn_proj(z)\"\n\nINN01 [rule_format] :\n\"ALL x.\n ALL y. makePartial (gn_inj(x) +' gn_inj(y)) = gn_inj(x +'' y)\"\n\nINN02 [rule_format] :\n\"ALL x.\n ALL y. makePartial (gn_inj(x) *' gn_inj(y)) = gn_inj(x *'' y)\"\n\nINN03 [rule_format] :\n\"ALL x.\n ALL y. makePartial (gn_inj(x) -' gn_inj(y)) = gn_inj(x -! y)\"\n\nINN04 [rule_format] :\n\"ALL x. negate(makePartial x) = makePartial (0'' -! x)\"\n\nINN05 [rule_format] : \"ALL x. abs_3(makePartial x) = makePartial x\"\n\nINN06 [rule_format] : \"ALL x. signum(makePartial x) = gn_inj(1_3)\"\n\nINN07 [rule_format] : \"ALL z. fromInteger(z) = gn_proj(z)\"\n\nIIN01 [rule_format] : \"ALL x. ALL y. x +' y = x +' y\"\n\nIIN02 [rule_format] : \"ALL x. ALL y. x *' y = x *' y\"\n\nIIN03 [rule_format] : \"ALL x. ALL y. x -' y = x -' y\"\n\nIIN04 [rule_format] :\n\"ALL x. negate(makePartial x) = makePartial (gn_inj(0'') -' x)\"\n\nIIN05 [rule_format] :\n\"ALL x.\n gn_inj(x) >=_3 gn_inj(0'') -->\n abs_3(makePartial x) = makePartial x\"\n\nIIN06 [rule_format] :\n\"ALL x.\n gn_inj(x) <_3 gn_inj(0'') -->\n abs_3(makePartial x) = negate(makePartial x)\"\n\nIIN07 [rule_format] :\n\"ALL x.\n gn_inj(x) >_3 gn_inj(0'') --> signum(makePartial x) = gn_inj(1_3)\"\n\nIIN07_1 [rule_format] :\n\"ALL x.\n makePartial x ==' gn_inj(0'') -->\n signum(makePartial x) = gn_inj(0'')\"\n\nIIN08 [rule_format] :\n\"ALL x.\n gn_inj(x) <_3 gn_inj(0'') -->\n signum(makePartial x) = makePartial (-' gn_inj(1_3))\"\n\nIIN09 [rule_format] : \"ALL x. fromInteger(x) = makePartial x\"\n\nIRN01 [rule_format] : \"ALL x. ALL y. x +_5 y = x +_5 y\"\n\nIRN02 [rule_format] : \"ALL x. ALL y. x *_4 y = x *_4 y\"\n\nIRN03 [rule_format] : \"ALL x. ALL y. x -_3 y = x -_3 y\"\n\nIRN04 [rule_format] :\n\"ALL x. negate(makePartial x) = makePartial (gn_inj(0'') -_3 x)\"\n\nIRN05 [rule_format] :\n\"ALL x.\n x >=_3 gn_inj(0'') --> abs_3(makePartial x) = makePartial x\"\n\nIRN06 [rule_format] :\n\"ALL x.\n x <_3 gn_inj(0'') --> abs_3(makePartial x) = negate(makePartial x)\"\n\nIRN07 [rule_format] :\n\"ALL x. x >_3 gn_inj(0'') --> signum(makePartial x) = gn_inj(1_3)\"\n\nIRN07_1 [rule_format] :\n\"ALL x.\n makePartial x ==' gn_inj(0'') -->\n signum(makePartial x) = gn_inj(0'')\"\n\nIRN08 [rule_format] :\n\"ALL x.\n x <_3 gn_inj(0'') -->\n signum(makePartial x) = gn_inj(-' gn_inj(1_3))\"\n\nIRN09 [rule_format] :\n\"ALL z. fromInteger(z) = makePartial (z /' 1_3)\"\n\nIRI01 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (quotRem x y))) -->\n x quot'' y = z\"\n\nIRI02 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (quotRem x y))) -->\n x rem'' y = w\"\n\nIRI03 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (divMod x y))) -->\n x div_3 y = z\"\n\nIRI04 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (divMod x y))) -->\n x mod_3 y = w\"\n\nIRI05 [rule_format] :\n\"ALL s.\n ALL w.\n ALL x.\n ALL y.\n ALL z.\n signum(w) = negate(signum(y)) &\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (quotRem x y))) -->\n makePartial (mapSnd makeTotal (mapFst makeTotal (divMod x y))) =\n restrictOp\n (makePartial\n  (makeTotal\n   (z -_4 fromInteger(toInteger(makePartial (gn_inj(1_3))))),\n   makeTotal (w +_6 s)))\n (defOp (z -_4 fromInteger(toInteger(makePartial (gn_inj(1_3))))) &\n  defOp (w +_6 s))\"\n\nIRI06 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n ~ signum(w) = negate(signum(y)) &\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (quotRem x y))) -->\n makePartial (mapSnd makeTotal (mapFst makeTotal (divMod x y))) =\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w)\"\n\nIRI01_1 [rule_format] :\n\"ALL x. gn_inj(recip(makePartial x)) = gn_inj(1_3) /'' gn_inj(x)\"\n\nIRI02_1 [rule_format] :\n\"ALL x.\n ALL y.\n gn_inj(x) /'' gn_inj(y) =\n restrictOp (gn_inj(x *' makeTotal (recip(makePartial y))))\n (defOp (recip(makePartial y)))\"\n\nIRF01 [rule_format] :\n\"ALL x. recip(makePartial x) = gn_inj(1_3) /'' x\"\n\nIRF02 [rule_format] :\n\"ALL x.\n ALL y.\n x /'' y =\n restrictOp (makePartial (x *_4 makeTotal (recip(makePartial y))))\n (defOp (recip(makePartial y)))\"\n\ndeclare NotFalse [simp]\ndeclare NotTrue [simp]\ndeclare AndFalse [simp]\ndeclare AndTrue [simp]\ndeclare OtherwiseDef [simp]\ndeclare NotTrue1 [simp]\ndeclare EqualReflex [simp]\ndeclare IUE1 [simp]\ndeclare IUE2 [simp]\ndeclare IBE1 [simp]\ndeclare IBE2 [simp]\ndeclare IBE3 [simp]\ndeclare IBE4 [simp]\ndeclare IBE5 [simp]\ndeclare IBE6 [simp]\ndeclare IBE7 [simp]\ndeclare IBE8 [simp]\ndeclare IOE01 [simp]\ndeclare IOE02 [simp]\ndeclare IOE03 [simp]\ndeclare IOE04 [simp]\ndeclare IOE05 [simp]\ndeclare IOE06 [simp]\ndeclare IOE07 [simp]\ndeclare IOE08 [simp]\ndeclare IOE09 [simp]\ndeclare LeIrreflexivity [simp]\ndeclare LeTAsymmetry [simp]\ndeclare GeIrreflexivity [simp]\ndeclare GeTAsymmetry [simp]\ndeclare GeTTransitive [simp]\ndeclare GeTTotal [simp]\ndeclare LeqReflexivity [simp]\ndeclare LeqTTransitive [simp]\ndeclare LeqTTotal [simp]\ndeclare GeqReflexivity [simp]\ndeclare GeqTTransitive [simp]\ndeclare GeqTTotal [simp]\ndeclare CmpLTDef [simp]\ndeclare CmpEQDef [simp]\ndeclare CmpGTDef [simp]\ndeclare MaxYDef [simp]\ndeclare MaxXDef [simp]\ndeclare MinXDef [simp]\ndeclare MinYDef [simp]\ndeclare TO2 [simp]\ndeclare TO4 [simp]\ndeclare TO6 [simp]\ndeclare IUO01 [simp]\ndeclare IUO02 [simp]\ndeclare IUO03 [simp]\ndeclare IUO04 [simp]\ndeclare IUO05 [simp]\ndeclare IUO06 [simp]\ndeclare IUO07 [simp]\ndeclare IOO13 [simp]\ndeclare IOO14 [simp]\ndeclare IOO15 [simp]\ndeclare IOO16 [simp]\ndeclare IOO17 [simp]\ndeclare IOO18 [simp]\ndeclare IOO19 [simp]\ndeclare IOO20 [simp]\ndeclare IOO21 [simp]\ndeclare IOO22 [simp]\ndeclare IOO23 [simp]\ndeclare IOO24 [simp]\ndeclare IOO25 [simp]\ndeclare IOO26 [simp]\ndeclare IOO27 [simp]\ndeclare IOO28 [simp]\ndeclare IOO29 [simp]\ndeclare IOO30 [simp]\ndeclare IOO31 [simp]\ndeclare IOO32 [simp]\ndeclare IOO33 [simp]\ndeclare IBO5 [simp]\ndeclare IBO6 [simp]\ndeclare IBO7 [simp]\ndeclare IBO8 [simp]\ndeclare IBO9 [simp]\ndeclare IBO10 [simp]\ndeclare IBO11 [simp]\ndeclare IBO12 [simp]\ndeclare ga_selector_pre [simp]\ndeclare ga_selector_undef_pre_0 [simp]\ndeclare ga_comm___XPlus__ [simp]\ndeclare ga_assoc___XPlus__ [simp]\ndeclare ga_right_unit___XPlus__ [simp]\ndeclare ga_left_unit___XPlus__ [simp]\ndeclare ga_left_comm___XPlus__ [simp]\ndeclare ga_comm___Xx__ [simp]\ndeclare ga_assoc___Xx__ [simp]\ndeclare ga_right_unit___Xx__ [simp]\ndeclare ga_left_unit___Xx__ [simp]\ndeclare ga_left_comm___Xx__ [simp]\ndeclare ga_comm_min [simp]\ndeclare ga_assoc_min [simp]\ndeclare ga_left_comm_min [simp]\ndeclare ga_comm_max [simp]\ndeclare ga_assoc_max [simp]\ndeclare ga_right_unit_max [simp]\ndeclare ga_left_unit_max [simp]\ndeclare ga_left_comm_max [simp]\ndeclare leq_def1_Nat [simp]\ndeclare dvd_def_Nat [simp]\ndeclare leq_def2_Nat [simp]\ndeclare leq_def3_Nat [simp]\ndeclare geq_def_Nat [simp]\ndeclare less_def_Nat [simp]\ndeclare greater_def_Nat [simp]\ndeclare even_0_Nat [simp]\ndeclare even_suc_Nat [simp]\ndeclare odd_def_Nat [simp]\ndeclare factorial_0 [simp]\ndeclare factorial_suc [simp]\ndeclare add_0_Nat [simp]\ndeclare add_suc_Nat [simp]\ndeclare mult_0_Nat [simp]\ndeclare mult_suc_Nat [simp]\ndeclare power_0_Nat [simp]\ndeclare power_suc_Nat [simp]\ndeclare subTotal_def1_Nat [simp]\ndeclare subTotal_def2_Nat [simp]\ndeclare sub_dom_Nat [simp]\ndeclare divide_0_Nat [simp]\ndeclare min_0 [simp]\ndeclare ga_comm___XPlus___1 [simp]\ndeclare ga_assoc___XPlus___1 [simp]\ndeclare ga_right_unit___XPlus___1 [simp]\ndeclare ga_left_unit___XPlus___1 [simp]\ndeclare ga_left_comm___XPlus___1 [simp]\ndeclare ga_comm___Xx___1 [simp]\ndeclare ga_assoc___Xx___1 [simp]\ndeclare ga_right_unit___Xx___1 [simp]\ndeclare ga_left_unit___Xx___1 [simp]\ndeclare ga_left_comm___Xx___1 [simp]\ndeclare ga_comm_min_1 [simp]\ndeclare ga_comm_max_1 [simp]\ndeclare ga_assoc_min_1 [simp]\ndeclare ga_assoc_max_1 [simp]\ndeclare ga_left_comm_min_1 [simp]\ndeclare ga_left_comm_max_1 [simp]\ndeclare leq_def_Int [simp]\ndeclare even_def_Int [simp]\ndeclare odd_alt_Int [simp]\ndeclare neg_def_Int [simp]\ndeclare sign_def_Int [simp]\ndeclare abs_def_Int [simp]\ndeclare add_def_Int [simp]\ndeclare mult_def_Int [simp]\ndeclare sub_def_Int [simp]\ndeclare min_def_Int [simp]\ndeclare max_def_Int [simp]\ndeclare power_neg1_Int [simp]\ndeclare power_others_Int [simp]\ndeclare divide_Int [simp]\ndeclare div_Int [simp]\ndeclare quot_neg_Int [simp]\ndeclare quot_nonneg_Int [simp]\ndeclare quot_rem_Int [simp]\ndeclare rem_nonneg_Int [simp]\ndeclare mod_Int [simp]\ndeclare Int_Nat_sub_compat [simp]\ndeclare quot_abs_Int [simp]\ndeclare rem_abs_Int [simp]\ndeclare ga_comm___XPlus___2_1 [simp]\ndeclare ga_assoc___XPlus___2_1 [simp]\ndeclare ga_right_unit___XPlus___2_1 [simp]\ndeclare ga_left_unit___XPlus___2_1 [simp]\ndeclare ga_left_comm___XPlus___2_1 [simp]\ndeclare ga_comm___Xx___2_1 [simp]\ndeclare ga_assoc___Xx___2_1 [simp]\ndeclare ga_right_unit___Xx___2_1 [simp]\ndeclare ga_left_unit___Xx___2_1 [simp]\ndeclare ga_left_comm___Xx___2_1 [simp]\ndeclare ga_comm_min_2_1 [simp]\ndeclare ga_comm_max_2_1 [simp]\ndeclare ga_assoc_min_2_1 [simp]\ndeclare ga_assoc_max_2_1 [simp]\ndeclare ga_left_comm_min_2_1 [simp]\ndeclare ga_left_comm_max_2_1 [simp]\ndeclare divide_def1_Rat [simp]\ndeclare power_0_Rat [simp]\ndeclare IPN05 [simp]\ndeclare IPN06 [simp]\ndeclare INN01 [simp]\ndeclare INN02 [simp]\ndeclare INN03 [simp]\ndeclare INN05 [simp]\ndeclare INN06 [simp]\ndeclare IIN05 [simp]\ndeclare IIN07 [simp]\ndeclare IIN07_1 [simp]\ndeclare IRN05 [simp]\ndeclare IRN07 [simp]\ndeclare IRN07_1 [simp]\n\ntheorem AbsSignumLaw : \"ALL x. abs_3(x) *_5 signum(x) = x\"\nusing X1_def_Nat X2_def_Nat X3_def_Nat X4_def_Nat X5_def_Nat\n      X6_def_Nat X7_def_Nat X8_def_Nat X9_def_Nat decimal_def Pos_def\n      X1_as_Pos_def\nby (auto)\n\nML \"Header.record \\\"AbsSignumLaw\\\"\"\n\nend\n", "meta": {"author": "glaubersp", "repo": "HasCASL-Library_Source", "sha": "be605b06acfc124d8e88829cc931a1148ea30460", "save_path": "github-repos/isabelle/glaubersp-HasCASL-Library_Source", "path": "github-repos/isabelle/glaubersp-HasCASL-Library_Source/HasCASL-Library_Source-be605b06acfc124d8e88829cc931a1148ea30460/Prelude.Lazy/Prelude_NumericClasses.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.33182736982495936}}
{"text": "theory flash26Bra  imports flash26Rev\n \n  begin\nlemma onInv26:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv26  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv26  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv26 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash26Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3318273698249593}}
{"text": "theory flash55Bra  imports flash55Rev\n \n  begin\nlemma onInv55:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv55  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv55  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv55 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash55Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710085, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3318273698249593}}
{"text": "(*  Title:      JinjaDCI/Compiler/Correctness2.thy\n    Author:     Tobias Nipkow, Susannah Mansky\n    Copyright   TUM 2003, UIUC 2019-20\n\n    Based on the Jinja theory Compiler/Correctness2.thy by Tobias Nipkow\n*)\n\nsection \\<open> Correctness of Stage 2 \\<close>\n\ntheory Correctness2\nimports \"HOL-Library.Sublist\" Compiler2 J1WellForm \"../J/EConform\"\nbegin\n\n(*<*)hide_const (open) Throw(*>*)\n\nsubsection\\<open> Instruction sequences \\<close>\n\ntext\\<open> How to select individual instructions and subsequences of\ninstructions from a program given the class, method and program\ncounter. \\<close>\n\ndefinition before :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> nat \\<Rightarrow> instr list \\<Rightarrow> bool\"\n   (\"(_,_,_,_/ \\<rhd> _)\" [51,0,0,0,51] 50) where\n \"P,C,M,pc \\<rhd> is \\<longleftrightarrow> prefix is (drop pc (instrs_of P C M))\"\n\ndefinition at :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> nat \\<Rightarrow> instr \\<Rightarrow> bool\"\n   (\"(_,_,_,_/ \\<triangleright> _)\" [51,0,0,0,51] 50) where\n \"P,C,M,pc \\<triangleright> i \\<longleftrightarrow> (\\<exists>is. drop pc (instrs_of P C M) = i#is)\"\n\n\n\n\nlemma [simp]: \"P,C,M,pc \\<rhd> (i#is) = (P,C,M,pc \\<triangleright> i \\<and> P,C,M,pc + 1 \\<rhd> is)\"\n(*<*)by(fastforce simp add:before_def at_def prefix_def drop_Suc drop_tl)(*>*)\n\n(*<*)\ndeclare drop_drop[simp del]\n(*>*)\n\n\nlemma [simp]: \"P,C,M,pc \\<rhd> (is\\<^sub>1 @ is\\<^sub>2) = (P,C,M,pc \\<rhd> is\\<^sub>1 \\<and> P,C,M,pc + size is\\<^sub>1 \\<rhd> is\\<^sub>2)\"\n(*<*)\napply(simp add:before_def prefix_def)\napply(subst add.commute)\napply(simp add: drop_drop[symmetric])\napply fastforce\ndone\n(*>*)\n\n(*<*)\ndeclare drop_drop[simp]\n(*>*)\n\n\nlemma [simp]: \"P,C,M,pc \\<triangleright> i \\<Longrightarrow> instrs_of P C M ! pc = i\"\n(*<*)by(clarsimp simp add:at_def strict_prefix_def nth_via_drop)(*>*)\n\nlemma beforeM:\n  \"P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = body in D \\<Longrightarrow>\n  compP\\<^sub>2 P,D,M,0 \\<rhd> compE\\<^sub>2 body @ [Return]\"\n(*<*)\napply(drule sees_method_idemp)\napply(simp add:before_def compP\\<^sub>2_def compMb\\<^sub>2_def)\ndone\n(*>*)\n\ntext\\<open> This lemma executes a single instruction by rewriting: \\<close>\n\nlemma [simp]:\n  \"P,C,M,pc \\<triangleright> instr \\<Longrightarrow>\n  (P \\<turnstile> (None, h, (vs,ls,C,M,pc,ics) # frs, sh) -jvm\\<rightarrow> \\<sigma>') =\n  ((None, h, (vs,ls,C,M,pc,ics) # frs, sh) = \\<sigma>' \\<or>\n   (\\<exists>\\<sigma>. exec(P,(None, h, (vs,ls,C,M,pc,ics) # frs, sh)) = Some \\<sigma> \\<and> P \\<turnstile> \\<sigma> -jvm\\<rightarrow> \\<sigma>'))\"\n(*<*)\napply(simp only: exec_all_def)\napply(blast intro: converse_rtranclE converse_rtrancl_into_rtrancl)\ndone\n(*>*)\n\n\nsubsection\\<open> Exception tables \\<close>\n\ndefinition pcs :: \"ex_table \\<Rightarrow> nat set\"\nwhere\n  \"pcs xt  \\<equiv>  \\<Union>(f,t,C,h,d) \\<in> set xt. {f ..< t}\"\n\nlemma pcs_subset:\nshows \"(\\<And>pc d. pcs(compxE\\<^sub>2 e pc d) \\<subseteq> {pc..<pc+size(compE\\<^sub>2 e)})\"\nand \"(\\<And>pc d. pcs(compxEs\\<^sub>2 es pc d) \\<subseteq> {pc..<pc+size(compEs\\<^sub>2 es)})\"\n(*<*)\napply(induct e and es rule: compxE\\<^sub>2.induct compxEs\\<^sub>2.induct)\napply (simp_all add:pcs_def)\napply (fastforce split:bop.splits)+\ndone\n(*>*)\n\n\nlemma [simp]: \"pcs [] = {}\"\n(*<*)by(simp add:pcs_def)(*>*)\n\n\nlemma [simp]: \"pcs (x#xt) = {fst x ..< fst(snd x)} \\<union> pcs xt\"\n(*<*)by(auto simp add: pcs_def)(*>*)\n\n\nlemma [simp]: \"pcs(xt\\<^sub>1 @ xt\\<^sub>2) = pcs xt\\<^sub>1 \\<union> pcs xt\\<^sub>2\"\n(*<*)by(simp add:pcs_def)(*>*)\n\n\nlemma [simp]: \"pc < pc\\<^sub>0 \\<or> pc\\<^sub>0+size(compE\\<^sub>2 e) \\<le> pc \\<Longrightarrow> pc \\<notin> pcs(compxE\\<^sub>2 e pc\\<^sub>0 d)\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]: \"pc < pc\\<^sub>0 \\<or> pc\\<^sub>0+size(compEs\\<^sub>2 es) \\<le> pc \\<Longrightarrow> pc \\<notin> pcs(compxEs\\<^sub>2 es pc\\<^sub>0 d)\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]: \"pc\\<^sub>1 + size(compE\\<^sub>2 e\\<^sub>1) \\<le> pc\\<^sub>2 \\<Longrightarrow> pcs(compxE\\<^sub>2 e\\<^sub>1 pc\\<^sub>1 d\\<^sub>1) \\<inter> pcs(compxE\\<^sub>2 e\\<^sub>2 pc\\<^sub>2 d\\<^sub>2) = {}\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]: \"pc\\<^sub>1 + size(compE\\<^sub>2 e) \\<le> pc\\<^sub>2 \\<Longrightarrow> pcs(compxE\\<^sub>2 e pc\\<^sub>1 d\\<^sub>1) \\<inter> pcs(compxEs\\<^sub>2 es pc\\<^sub>2 d\\<^sub>2) = {}\"\n(*<*)using pcs_subset by fastforce(*>*)\n\n\nlemma [simp]:\n \"pc \\<notin> pcs xt\\<^sub>0 \\<Longrightarrow> match_ex_table P C pc (xt\\<^sub>0 @ xt\\<^sub>1) = match_ex_table P C pc xt\\<^sub>1\"\n(*<*)by (induct xt\\<^sub>0) (auto simp: matches_ex_entry_def)(*>*)\n\n\nlemma [simp]: \"\\<lbrakk> x \\<in> set xt; pc \\<notin> pcs xt \\<rbrakk> \\<Longrightarrow> \\<not> matches_ex_entry P D pc x\"\n(*<*)by(auto simp:matches_ex_entry_def pcs_def)(*>*)\n\n\nlemma [simp]:\nassumes xe: \"xe \\<in> set(compxE\\<^sub>2 e pc d)\" and outside: \"pc' < pc \\<or> pc+size(compE\\<^sub>2 e) \\<le> pc'\"\nshows \"\\<not> matches_ex_entry P C pc' xe\"\n(*<*)\nproof\n  assume \"matches_ex_entry P C pc' xe\"\n  with xe have \"pc' \\<in> pcs(compxE\\<^sub>2 e pc d)\"\n    by(force simp add:matches_ex_entry_def pcs_def)\n  with outside show False by simp\nqed\n(*>*)\n\n\nlemma [simp]:\nassumes xe: \"xe \\<in> set(compxEs\\<^sub>2 es pc d)\" and outside: \"pc' < pc \\<or> pc+size(compEs\\<^sub>2 es) \\<le> pc'\"\nshows \"\\<not> matches_ex_entry P C pc' xe\"\n(*<*)\nproof\n  assume \"matches_ex_entry P C pc' xe\"\n  with xe have \"pc' \\<in> pcs(compxEs\\<^sub>2 es pc d)\"\n    by(force simp add:matches_ex_entry_def pcs_def)\n  with outside show False by simp\nqed\n(*>*)\n\n\nlemma match_ex_table_app[simp]:\n  \"\\<forall>xte \\<in> set xt\\<^sub>1. \\<not> matches_ex_entry P D pc xte \\<Longrightarrow>\n  match_ex_table P D pc (xt\\<^sub>1 @ xt) = match_ex_table P D pc xt\"\n(*<*)by(induct xt\\<^sub>1) simp_all(*>*)\n\n\nlemma [simp]:\n  \"\\<forall>x \\<in> set xtab. \\<not> matches_ex_entry P C pc x \\<Longrightarrow>\n  match_ex_table P C pc xtab = None\"\n(*<*)using match_ex_table_app[where ?xt = \"[]\"] by fastforce(*>*)\n\n\nlemma match_ex_entry:\n  \"matches_ex_entry P C pc (start, end, catch_type, handler) =\n  (start \\<le> pc \\<and> pc < end \\<and>  P \\<turnstile> C \\<preceq>\\<^sup>* catch_type)\"\n(*<*)by(simp add:matches_ex_entry_def)(*>*)\n\n\ndefinition caught :: \"jvm_prog \\<Rightarrow> pc \\<Rightarrow> heap \\<Rightarrow> addr \\<Rightarrow> ex_table \\<Rightarrow> bool\" where\n  \"caught P pc h a xt \\<longleftrightarrow>\n  (\\<exists>entry \\<in> set xt. matches_ex_entry P (cname_of h a) pc entry)\"\n\ndefinition beforex :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> ex_table \\<Rightarrow> nat set \\<Rightarrow> nat \\<Rightarrow> bool\"\n              (\"(2_,/_,/_ \\<rhd>/ _ /'/ _,/_)\" [51,0,0,0,0,51] 50) where\n  \"P,C,M \\<rhd> xt / I,d \\<longleftrightarrow>\n  (\\<exists>xt\\<^sub>0 xt\\<^sub>1. ex_table_of P C M = xt\\<^sub>0 @ xt @ xt\\<^sub>1 \\<and> pcs xt\\<^sub>0 \\<inter> I = {} \\<and> pcs xt \\<subseteq> I \\<and>\n    (\\<forall>pc \\<in> I. \\<forall>C pc' d'. match_ex_table P C pc xt\\<^sub>1 = \\<lfloor>(pc',d')\\<rfloor> \\<longrightarrow> d' \\<le> d))\"\n\ndefinition dummyx :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> ex_table \\<Rightarrow> nat set \\<Rightarrow> nat \\<Rightarrow> bool\"  (\"(2_,_,_ \\<triangleright>/ _ '/_,_)\" [51,0,0,0,0,51] 50) where\n  \"P,C,M \\<triangleright> xt/I,d \\<longleftrightarrow> P,C,M \\<rhd> xt/I,d\"\n\nlemma beforexD1: \"P,C,M \\<rhd> xt / I,d \\<Longrightarrow> pcs xt \\<subseteq> I\"\n(*<*)by(auto simp add:beforex_def)(*>*)\n\n\nlemma beforex_mono: \"\\<lbrakk> P,C,M \\<rhd> xt/I,d'; d' \\<le> d \\<rbrakk> \\<Longrightarrow> P,C,M \\<rhd> xt/I,d\"\n(*<*)by(fastforce simp:beforex_def)(*>*)\n\n\nlemma [simp]: \"P,C,M \\<rhd> xt/I,d \\<Longrightarrow> P,C,M \\<rhd> xt/I,Suc d\"\n(*<*)by(fastforce intro:beforex_mono)(*>*)\n\n\nlemma beforex_append[simp]:\n  \"pcs xt\\<^sub>1 \\<inter> pcs xt\\<^sub>2 = {} \\<Longrightarrow>\n  P,C,M \\<rhd> xt\\<^sub>1 @ xt\\<^sub>2/I,d =\n  (P,C,M \\<rhd> xt\\<^sub>1/I-pcs xt\\<^sub>2,d  \\<and>  P,C,M \\<rhd> xt\\<^sub>2/I-pcs xt\\<^sub>1,d \\<and> P,C,M \\<triangleright> xt\\<^sub>1@xt\\<^sub>2/I,d)\"\n(*<*)\napply(rule iffI)\n prefer 2\n apply(simp add:dummyx_def)\napply(auto simp add: beforex_def dummyx_def)\n apply(rule_tac x = xt\\<^sub>0 in exI)\n apply auto\napply(rule_tac x = \"xt\\<^sub>0@xt\\<^sub>1\" in exI)\napply auto\ndone\n(*>*)\n\n\nlemma beforex_appendD1:\n  \"\\<lbrakk> P,C,M \\<rhd> xt\\<^sub>1 @ xt\\<^sub>2 @ [(f,t,D,h,d)] / I,d;\n    pcs xt\\<^sub>1 \\<subseteq> J; J \\<subseteq> I; J \\<inter> pcs xt\\<^sub>2 = {} \\<rbrakk>\n  \\<Longrightarrow> P,C,M \\<rhd> xt\\<^sub>1 / J,d\"\n(*<*)\napply(auto simp:beforex_def)\napply(rule exI,rule exI,rule conjI, rule refl)\napply(rule conjI, blast)\napply(auto)\napply(subgoal_tac \"pc \\<notin> pcs xt\\<^sub>2\")\n prefer 2 apply blast\napply (auto split:if_split_asm)\ndone\n(*>*)\n\n\nlemma beforex_appendD2:\n  \"\\<lbrakk> P,C,M \\<rhd> xt\\<^sub>1 @ xt\\<^sub>2 @ [(f,t,D,h,d)] / I,d;\n    pcs xt\\<^sub>2 \\<subseteq> J; J \\<subseteq> I; J \\<inter> pcs xt\\<^sub>1 = {} \\<rbrakk>\n  \\<Longrightarrow> P,C,M \\<rhd> xt\\<^sub>2 / J,d\"\n(*<*)\napply(auto simp:beforex_def)\napply(rule_tac x = \"xt\\<^sub>0 @ xt\\<^sub>1\" in exI)\napply fastforce\ndone\n(*>*)\n\n\nlemma beforexM:\n  \"P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = body in D \\<Longrightarrow> compP\\<^sub>2 P,D,M \\<rhd> compxE\\<^sub>2 body 0 0/{..<size(compE\\<^sub>2 body)},0\"\n(*<*)\napply(drule sees_method_idemp)\napply(drule sees_method_compP[where f = compMb\\<^sub>2])\napply(simp add:beforex_def compP\\<^sub>2_def compMb\\<^sub>2_def)\napply(rule_tac x = \"[]\" in exI)\nusing pcs_subset apply fastforce\ndone\n(*>*)\n\n\nlemma match_ex_table_SomeD2:\n \"\\<lbrakk> match_ex_table P D pc (ex_table_of P C M) = \\<lfloor>(pc',d')\\<rfloor>;\n    P,C,M \\<rhd> xt/I,d; \\<forall>x \\<in> set xt. \\<not> matches_ex_entry P D pc x; pc \\<in> I \\<rbrakk>\n \\<Longrightarrow> d' \\<le> d\"\n(*<*)\napply(auto simp:beforex_def)\napply(subgoal_tac \"pc \\<notin> pcs xt\\<^sub>0\")\napply auto\ndone\n(*>*)\n\n\nlemma match_ex_table_SomeD1:\n  \"\\<lbrakk> match_ex_table P D pc (ex_table_of P C M) = \\<lfloor>(pc',d')\\<rfloor>;\n     P,C,M \\<rhd> xt / I,d; pc \\<in> I; pc \\<notin> pcs xt \\<rbrakk> \\<Longrightarrow> d' \\<le> d\"\n(*<*)by(auto elim: match_ex_table_SomeD2)(*>*)\n\n\nsubsection\\<open> The correctness proof \\<close>\n\n(*<*)\ndeclare nat_add_distrib[simp] caught_def[simp]\ndeclare fun_upd_apply[simp del]\n(*>*)\n\ndefinition\n  handle :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> addr \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> nat \\<Rightarrow> init_call_status \\<Rightarrow> frame list \\<Rightarrow> sheap\n                \\<Rightarrow> jvm_state\" where\n  \"handle P C M a h vs ls pc ics frs sh = find_handler P a h ((vs,ls,C,M,pc,ics) # frs) sh\"\n\nlemma aux_isin[simp]: \"\\<lbrakk> B \\<subseteq> A; a \\<in> B \\<rbrakk> \\<Longrightarrow> a \\<in> A\"\n(*<*)by blast(*>*)\n\nlemma handle_frs_tl_neq:\n \"ics_of f \\<noteq> No_ics\n  \\<Longrightarrow> (xp, h, f#frs, sh) \\<noteq> handle P C M xa h' vs l pc ics frs sh'\"\n by(simp add: handle_def find_handler_frs_tl_neq del: find_handler.simps)\n\nsubsubsection \"Correctness proof inductive hypothesis\"\n\n\\<comment> \\<open> frame definitions for use by correctness proof inductive hypothesis \\<close>\nfun calling_to_called :: \"frame \\<Rightarrow> frame\" where\n\"calling_to_called (stk,loc,D,M,pc,ics) = (stk,loc,D,M,pc,case ics of Calling C Cs \\<Rightarrow> Called (C#Cs))\"\n\nfun calling_to_scalled :: \"frame \\<Rightarrow> frame\" where\n\"calling_to_scalled (stk,loc,D,M,pc,ics) = (stk,loc,D,M,pc,case ics of Calling C Cs \\<Rightarrow> Called Cs)\"\n\nfun calling_to_calling :: \"frame \\<Rightarrow> cname \\<Rightarrow> frame\" where\n\"calling_to_calling (stk,loc,D,M,pc,ics) C' = (stk,loc,D,M,pc,case ics of Calling C Cs \\<Rightarrow> Calling C' (C#Cs))\"\n\nfun calling_to_throwing :: \"frame \\<Rightarrow> addr \\<Rightarrow> frame\" where\n\"calling_to_throwing (stk,loc,D,M,pc,ics) a = (stk,loc,D,M,pc,case ics of Calling C Cs \\<Rightarrow> Throwing (C#Cs) a)\"\n\nfun calling_to_sthrowing :: \"frame \\<Rightarrow> addr \\<Rightarrow> frame\" where\n\"calling_to_sthrowing (stk,loc,D,M,pc,ics) a = (stk,loc,D,M,pc,case ics of Calling C Cs \\<Rightarrow> Throwing Cs a)\"\n\n\n\\<comment> \\<open> pieces of the correctness proof's inductive hypothesis, which depend on the\n expression being compiled) \\<close>\n\nfun Jcc_cond :: \"J\\<^sub>1_prog \\<Rightarrow> ty list \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> val list \\<Rightarrow> pc \\<Rightarrow> init_call_status\n   \\<Rightarrow> nat set \\<Rightarrow> heap \\<Rightarrow> sheap \\<Rightarrow> expr\\<^sub>1 \\<Rightarrow> bool\" where\n\"Jcc_cond P E C M vs pc ics I h sh (INIT C\\<^sub>0 (Cs,b) \\<leftarrow> e')\n  = ((\\<exists>T. P,E,h,sh \\<turnstile>\\<^sub>1 INIT C\\<^sub>0 (Cs,b) \\<leftarrow> e' : T) \\<and> unit = e' \\<and> ics = No_ics)\" |\n\"Jcc_cond P E C M vs pc ics I h sh (RI(C',e\\<^sub>0);Cs \\<leftarrow> e')\n  = (((e\\<^sub>0 = C'\\<bullet>\\<^sub>sclinit([]) \\<and> (\\<exists>T. P,E,h,sh \\<turnstile>\\<^sub>1 RI(C',e\\<^sub>0);Cs \\<leftarrow> e':T))\n         \\<or> ((\\<exists>a. e\\<^sub>0 = Throw a) \\<and> (\\<forall>C \\<in> set(C'#Cs). is_class P C)))\n      \\<and> unit = e' \\<and> ics = No_ics)\" |\n\"Jcc_cond P E C M vs pc ics I h sh (C'\\<bullet>\\<^sub>sM'(es))\n  = (let e = (C'\\<bullet>\\<^sub>sM'(es))\n     in if M' = clinit \\<and> es = [] then (\\<exists>T. P,E,h,sh \\<turnstile>\\<^sub>1 e:T) \\<and> (\\<exists>Cs. ics = Called Cs)\n        else (compP\\<^sub>2 P,C,M,pc \\<rhd> compE\\<^sub>2 e \\<and> compP\\<^sub>2 P,C,M \\<rhd> compxE\\<^sub>2 e pc (size vs)/I,size vs\n                  \\<and> {pc..<pc+size(compE\\<^sub>2 e)} \\<subseteq> I \\<and> \\<not>sub_RI e \\<and> ics = No_ics)\n    )\" |\n\"Jcc_cond P E C M vs pc ics I h sh e\n  = (compP\\<^sub>2 P,C,M,pc \\<rhd> compE\\<^sub>2 e \\<and> compP\\<^sub>2 P,C,M \\<rhd> compxE\\<^sub>2 e pc (size vs)/I,size vs\n                  \\<and> {pc..<pc+size(compE\\<^sub>2 e)} \\<subseteq> I \\<and> \\<not>sub_RI e \\<and> ics = No_ics)\"\n\n\nfun Jcc_frames :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> pc \\<Rightarrow> init_call_status\n  \\<Rightarrow> frame list \\<Rightarrow> expr\\<^sub>1 \\<Rightarrow> frame list\" where\n\"Jcc_frames P C M vs ls pc ics frs (INIT C\\<^sub>0 (C'#Cs,b) \\<leftarrow> e')\n  = (case b of False \\<Rightarrow> (vs,ls,C,M,pc,Calling C' Cs) # frs\n             | True \\<Rightarrow> (vs,ls,C,M,pc,Called (C'#Cs)) # frs\n    )\" |\n\"Jcc_frames P C M vs ls pc ics frs (INIT C\\<^sub>0 (Nil,b) \\<leftarrow> e')\n  = (vs,ls,C,M,pc,Called [])#frs\" |\n\"Jcc_frames P C M vs ls pc ics frs (RI(C',e\\<^sub>0);Cs \\<leftarrow> e')\n  = (case e\\<^sub>0 of Throw a \\<Rightarrow> (vs,ls,C,M,pc,Throwing (C'#Cs) a) # frs\n              | _ \\<Rightarrow> (vs,ls,C,M,pc,Called (C'#Cs)) # frs )\" |\n\"Jcc_frames P C M vs ls pc ics frs (C'\\<bullet>\\<^sub>sM'(es))\n  = (if M' = clinit \\<and> es = []\n     then create_init_frame P C'#(vs,ls,C,M,pc,ics)#frs\n     else (vs,ls,C,M,pc,ics)#frs\n    )\" |\n\"Jcc_frames P C M vs ls pc ics frs e\n  = (vs,ls,C,M,pc,ics)#frs\"\n\nfun Jcc_rhs :: \"J\\<^sub>1_prog \\<Rightarrow> ty list \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> pc \\<Rightarrow> init_call_status\n  \\<Rightarrow> frame list \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> sheap \\<Rightarrow> val \\<Rightarrow> expr\\<^sub>1 \\<Rightarrow> jvm_state\" where\n\"Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v (INIT C\\<^sub>0 (Cs,b) \\<leftarrow> e')\n  = (None,h',(vs,ls,C,M,pc,Called [])#frs,sh')\" |\n\"Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v (RI(C',e\\<^sub>0);Cs \\<leftarrow> e')\n  = (None,h',(vs,ls,C,M,pc,Called [])#frs,sh')\" |\n\"Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v (C'\\<bullet>\\<^sub>sM'(es))\n  = (let e = (C'\\<bullet>\\<^sub>sM'(es))\n     in if M' = clinit \\<and> es = []\n        then (None,h',(vs,ls,C,M,pc,ics)#frs,sh'(C'\\<mapsto>(fst(the(sh' C')),Done)))\n        else (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 e),ics)#frs,sh')\n    )\" |\n\"Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v e\n  = (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 e),ics)#frs,sh')\"\n\nfun Jcc_err :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> pc \\<Rightarrow> init_call_status\n  \\<Rightarrow> frame list \\<Rightarrow> sheap \\<Rightarrow> nat set \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> sheap \\<Rightarrow> addr \\<Rightarrow> expr\\<^sub>1\n  \\<Rightarrow> bool\" where\n\"Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa (INIT C\\<^sub>0 (Cs,b) \\<leftarrow> e')\n  = (\\<exists>vs'. P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs (INIT C\\<^sub>0 (Cs,b) \\<leftarrow> e'),sh)\n           -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls pc ics frs sh')\" |\n\"Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa (RI(C',e\\<^sub>0);Cs \\<leftarrow> e')\n  = (\\<exists>vs'. P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs (RI(C',e\\<^sub>0);Cs \\<leftarrow> e'),sh)\n           -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls pc ics frs sh')\" |\n\"Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa (C'\\<bullet>\\<^sub>sM'(es))\n  = (let e = (C'\\<bullet>\\<^sub>sM'(es))\n     in if M' = clinit \\<and> es = []\n        then case ics of\n               Called Cs \\<Rightarrow> P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs e,sh)\n                       -jvm\\<rightarrow> (None,h',(vs,ls,C,M,pc,Throwing Cs xa)#frs,(sh'(C' \\<mapsto> (fst(the(sh' C')),Error))))\n        else (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\<and>\n               \\<not> caught P pc\\<^sub>1 h' xa (compxE\\<^sub>2 e pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs e,sh)\n                      -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\\<^sub>1 ics frs sh'))\n    )\" |\n\"Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa e\n  = (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\<and>\n               \\<not> caught P pc\\<^sub>1 h' xa (compxE\\<^sub>2 e pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs e,sh)\n                      -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\\<^sub>1 ics frs sh'))\"\n\nfun Jcc_pieces :: \"J\\<^sub>1_prog \\<Rightarrow> ty list \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> pc \\<Rightarrow> init_call_status\n  \\<Rightarrow> frame list \\<Rightarrow> sheap \\<Rightarrow> nat set \\<Rightarrow> heap \\<Rightarrow> val list \\<Rightarrow> sheap \\<Rightarrow> val \\<Rightarrow> addr \\<Rightarrow> expr\\<^sub>1\n  \\<Rightarrow> bool \\<times> frame list \\<times> jvm_state \\<times> bool\" where\n\"Jcc_pieces P E C M h vs ls pc ics frs sh I h' ls' sh' v xa e\n  = (Jcc_cond P E C M vs pc ics I h sh e, Jcc_frames (compP\\<^sub>2 P) C M vs ls pc ics frs e,\n      Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v e,\n      Jcc_err (compP\\<^sub>2 P) C M h vs ls pc ics frs sh I h' ls' sh' xa e)\"\n\n\\<comment> \\<open> @{text Jcc_pieces} lemmas \\<close>\n\nlemma nsub_RI_Jcc_pieces:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n  and nsub: \"\\<not>sub_RI e\"\nshows \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa e \n  = (let cond = P,C,M,pc \\<rhd> compE\\<^sub>2 e \\<and> P,C,M \\<rhd> compxE\\<^sub>2 e pc (size vs)/I,size vs\n                  \\<and> {pc..<pc+size(compE\\<^sub>2 e)} \\<subseteq> I \\<and> ics = No_ics;\n         frs' = (vs,ls,C,M,pc,ics)#frs;\n         rhs = (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 e),ics)#frs,sh');\n         err = (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\<and>\n               \\<not> caught P pc\\<^sub>1 h' xa (compxE\\<^sub>2 e pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\\<^sub>1 ics frs sh'))\n     in (cond, frs',rhs, err)\n    )\"\nproof -\n  have NC: \"\\<forall>C'. e \\<noteq> C'\\<bullet>\\<^sub>sclinit([])\" using assms(2) proof(cases e) qed(simp_all)\n  then show ?thesis using assms\n  proof(cases e)\n    case (SCall C M es)\n    then have \"M \\<noteq> clinit\" using nsub by simp\n    then show ?thesis using SCall nsub proof(cases es) qed(simp_all)\n  qed(simp_all)\nqed\n\nlemma Jcc_pieces_Cast:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (Cast C' e)\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h',(v'#vs',ls',C\\<^sub>0,M',pc' - 1,ics')#frs',sh'),\n        (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\<and>\n               \\<not> caught P pc\\<^sub>1 h\\<^sub>1 xa (compxE\\<^sub>2 e pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>0,frs\\<^sub>0,sh\\<^sub>0) -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1)))\"\nproof -\n  have pc: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using assms by clarsimp\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] pc by clarsimp\nqed\n\nlemma Jcc_pieces_BinOp1:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e \\<guillemotleft>bop\\<guillemotright> e')\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0\n (I - pcs (compxE\\<^sub>2 e' (pc + length (compE\\<^sub>2 e)) (Suc (length vs')))) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h\\<^sub>1,(v'#vs',ls\\<^sub>1,C\\<^sub>0,M',pc' - size (compE\\<^sub>2 e') - 1,ics')#frs',sh\\<^sub>1), err)\"\nproof -\n  have bef: \"compP compMb\\<^sub>2 P,C\\<^sub>0,M' \\<rhd> compxE\\<^sub>2 e pc (length vs) \n         / I - pcs (compxE\\<^sub>2 e' (pc + length (compE\\<^sub>2 e)) (Suc (length vs'))),length vs\"\n    using assms by clarsimp\n  have vs: \"vs = vs'\" using assms by simp\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] bef vs by clarsimp\nqed\n\nlemma Jcc_pieces_BinOp2:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e \\<guillemotleft>bop\\<guillemotright> e')\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 (v\\<^sub>1#vs) ls\\<^sub>1 (pc + size (compE\\<^sub>2 e)) ics frs sh\\<^sub>1\n   (I - pcs (compxE\\<^sub>2 e pc (length vs'))) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v' xa e'\n   = (True, (v\\<^sub>1#vs,ls\\<^sub>1,C,M,pc + size (compE\\<^sub>2 e),ics)#frs,\n       (xp',h',(v'#v\\<^sub>1#vs',ls',C\\<^sub>0,M',pc' - 1,ics')#frs',sh'),\n          (\\<exists>pc\\<^sub>1. pc + size (compE\\<^sub>2 e) \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size (compE\\<^sub>2 e) + length (compE\\<^sub>2 e') \\<and>\n               \\<not> caught P pc\\<^sub>1 h\\<^sub>2 xa (compxE\\<^sub>2 e' (pc + size (compE\\<^sub>2 e)) (Suc (length vs))) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,pc + size (compE\\<^sub>2 e),ics)#frs,sh\\<^sub>1)\n                       -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@v\\<^sub>1#vs) ls\\<^sub>2 pc\\<^sub>1 ics frs sh\\<^sub>2)))\"\nproof -\n  have bef: \"compP compMb\\<^sub>2 P\\<^sub>1,C\\<^sub>0,M' \\<rhd> compxE\\<^sub>2 e pc (length vs) \n         / I - pcs (compxE\\<^sub>2 e' (pc + length (compE\\<^sub>2 e)) (Suc (length vs'))),length vs\"\n    using assms by clarsimp\n  have vs: \"vs = vs'\" using assms by simp\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e'] bef vs by clarsimp\nqed\n\nlemma Jcc_pieces_FAcc:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h',(v'#vs',ls',C\\<^sub>0,M',pc' - 1,ics')#frs',sh'), err)\"\nproof -\n  have pc: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using assms by clarsimp\n  then show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by clarsimp\nqed\n\nlemma Jcc_pieces_LAss:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (i:=e)\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h',(v'#vs',ls',C\\<^sub>0,M',pc' - 2,ics')#frs',sh'),\n        (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 e) \\<and>\n               \\<not> caught P pc\\<^sub>1 h\\<^sub>1 xa (compxE\\<^sub>2 e pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>0,frs\\<^sub>0,sh\\<^sub>0) -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1)))\"\nproof -\n  have pc: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using assms by clarsimp\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] pc by clarsimp\nqed\n\nlemma Jcc_pieces_FAss1:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>F{D}:=e')\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0\n (I - pcs (compxE\\<^sub>2 e' (pc + length (compE\\<^sub>2 e)) (Suc (length vs')))) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h\\<^sub>1,(v'#vs',ls\\<^sub>1,C\\<^sub>0,M',pc' - size (compE\\<^sub>2 e') - 2,ics')#frs',sh\\<^sub>1), err)\"\nproof -\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by clarsimp\nqed\n\nlemma Jcc_pieces_FAss2:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>F{D}:=e')\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"Jcc_pieces P E C M h\\<^sub>1 (v\\<^sub>1#vs) ls\\<^sub>1 (pc + size (compE\\<^sub>2 e)) ics frs sh\\<^sub>1\n   (I - pcs (compxE\\<^sub>2 e pc (length vs'))) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v' xa e'\n   = (True, (v\\<^sub>1#vs,ls\\<^sub>1,C,M,pc + size (compE\\<^sub>2 e),ics)#frs,\n       (xp',h',(v'#v\\<^sub>1#vs',ls',C\\<^sub>0,M',pc' - 2,ics')#frs',sh'),\n        (\\<exists>pc\\<^sub>1. (pc + size (compE\\<^sub>2 e)) \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size (compE\\<^sub>2 e) + size(compE\\<^sub>2 e') \\<and>\n               \\<not> caught (compP\\<^sub>2 P) pc\\<^sub>1 h\\<^sub>2 xa (compxE\\<^sub>2 e' (pc + size (compE\\<^sub>2 e)) (size (v\\<^sub>1#vs))) \\<and>\n               (\\<exists>vs'. (compP\\<^sub>2 P) \\<turnstile> (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,pc + size (compE\\<^sub>2 e),ics)#frs,sh\\<^sub>1)\n                                   -jvm\\<rightarrow> handle (compP\\<^sub>2 P) C M xa h\\<^sub>2 (vs'@v\\<^sub>1#vs) ls\\<^sub>2 pc\\<^sub>1 ics frs sh\\<^sub>2)))\"\nproof -\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e'] by clarsimp\nqed\n\nlemma Jcc_pieces_SFAss:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h' ls' sh' v xa (C'\\<bullet>\\<^sub>sF{D}:=e)\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C\\<^sub>0,M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0, (xp',h\\<^sub>1,(v'#vs',ls\\<^sub>1,C\\<^sub>0,M',pc' - 2,ics')#frs',sh\\<^sub>1), err)\"\nproof -\n  have pc: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using assms by clarsimp\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] pc by clarsimp\nqed\n\nlemma Jcc_pieces_Call1:\nassumes\n \"Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 v xa (e\\<bullet>M\\<^sub>0(es))\n   = (True, frs\\<^sub>0, (xp',h',(v#vs',ls',C',M',pc',ics')#frs',sh'), err)\"\nshows \"\\<exists>err. Jcc_pieces P E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs')))) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v' xa e\n   = (True, frs\\<^sub>0,\n       (xp',h\\<^sub>1,(v'#vs',ls\\<^sub>1,C',M',pc' - size (compEs\\<^sub>2 es) - 1,ics')#frs',sh\\<^sub>1), err)\"\nproof -\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by clarsimp\nqed\n\nlemma Jcc_pieces_clinit:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n  and cond: \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (C1\\<bullet>\\<^sub>sclinit([]))\"\nshows \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C1\\<bullet>\\<^sub>sclinit([]))\n     = (True, create_init_frame P C1 # (vs,ls,C,M,pc,ics)#frs,\n          (None, h', (vs,ls,C,M,pc,ics)#frs, sh'(C1\\<mapsto>(fst(the(sh' C1)),Done))), \n      P \\<turnstile> (None,h,create_init_frame P C1 # (vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow>\n     (case ics of Called Cs \\<Rightarrow> (None,h',(vs,ls,C,M,pc,Throwing Cs xa)#frs,(sh'(C1 \\<mapsto> (fst(the(sh' C1)),Error))))))\"\nusing assms by(auto split: init_call_status.splits list.splits bool.splits)\n\nlemma Jcc_pieces_SCall_clinit_body:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\" and wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>3 ls\\<^sub>2 sh\\<^sub>3 v xa (C1\\<bullet>\\<^sub>sclinit([]))\n         = (True, frs', rhs', err')\"\n and method: \"P\\<^sub>1 \\<turnstile> C1 sees clinit,Static: []\\<rightarrow>Void = body in D\"\nshows \"Jcc_pieces P\\<^sub>1 [] D clinit h\\<^sub>2 [] (replicate (max_vars body) undefined) 0\n          No_ics (tl frs') sh\\<^sub>2 {..<length (compE\\<^sub>2 body)} h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 v xa body\n           = (True, frs', \n                (None,h\\<^sub>3,([v],ls\\<^sub>3,D,clinit,size(compE\\<^sub>2 body), No_ics)#tl frs',sh\\<^sub>3),\n                    \\<exists>pc\\<^sub>1. 0 \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < size(compE\\<^sub>2 body) \\<and>\n                      \\<not> caught P pc\\<^sub>1 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0) \\<and>\n                      (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>2,frs',sh\\<^sub>2) -jvm\\<rightarrow> handle P D clinit xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>1\n                            No_ics (tl frs') sh\\<^sub>3))\"\nproof -\n  have M_in_D: \"P\\<^sub>1 \\<turnstile> D sees clinit,Static: []\\<rightarrow>Void = body in D\"\n    using method by(rule sees_method_idemp) \n  hence M_code: \"compP\\<^sub>2 P\\<^sub>1,D,clinit,0 \\<rhd> compE\\<^sub>2 body @ [Return]\"\n    and M_xtab: \"compP\\<^sub>2 P\\<^sub>1,D,clinit \\<rhd> compxE\\<^sub>2 body 0 0/{..<size(compE\\<^sub>2 body)},0\"\n    by(rule beforeM, rule beforexM)\n  have nsub: \"\\<not>sub_RI body\" by(rule sees_wf\\<^sub>1_nsub_RI[OF wf method])\n  then show ?thesis using assms nsub_RI_Jcc_pieces M_code M_xtab by clarsimp\nqed\n\nlemma Jcc_pieces_Cons:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"P,C,M,pc \\<rhd> compEs\\<^sub>2 (e#es)\" and \"P,C,M \\<rhd> compxEs\\<^sub>2 (e#es) pc (size vs)/I,size vs\"\n and \"{pc..<pc+size(compEs\\<^sub>2 (e#es))} \\<subseteq> I\"\n and \"ics = No_ics\"\n and \"\\<not>sub_RIs (e#es)\"\nshows \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh\n  (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs)))) h' ls' sh' v xa e\n  = (True, (vs, ls, C, M, pc, ics) # frs,\n        (None, h', (v#vs, ls', C, M, pc + length (compE\\<^sub>2 e), ics) # frs, sh'),\n          \\<exists>pc\\<^sub>1\\<ge>pc. pc\\<^sub>1 < pc + length (compE\\<^sub>2 e) \\<and> \\<not> caught P pc\\<^sub>1 h' xa (compxE\\<^sub>2 e pc (length vs))\n                   \\<and> (\\<exists>vs'. P \\<turnstile> (None, h, (vs, ls, C, M, pc, ics) # frs, sh)\n                         -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\\<^sub>1 ics frs sh'))\"\nproof -\n  show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by auto\nqed\n\nlemma Jcc_pieces_InitNone:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs (sh(C\\<^sub>0 \\<mapsto> (sblank P C\\<^sub>0, Prepared)))\n     I h' l' sh' v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),\n        \\<exists>vs'. P \\<turnstile> (None,h,frs',(sh(C\\<^sub>0 \\<mapsto> (sblank P\\<^sub>1 C\\<^sub>0, Prepared))))\n            -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')\"\nproof -\n  have  \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\" using assms by simp\n  then obtain T where \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\" by fastforce\n  then have \"P\\<^sub>1,E,h,sh(C\\<^sub>0 \\<mapsto> (sblank P\\<^sub>1 C\\<^sub>0, Prepared)) \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\"\n    by(auto simp: fun_upd_apply)\n  then have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h (sh(C\\<^sub>0 \\<mapsto> (sblank P\\<^sub>1 C\\<^sub>0, Prepared))) (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit))\"\n    by(simp only: exI)\n  then show ?thesis using assms by clarsimp\nqed\n\nlemma Jcc_pieces_InitDP:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (Cs,True) \\<leftarrow> e)\n    = (True, (calling_to_scalled (hd frs'))#(tl frs'),\n         (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),\n             \\<exists>vs'. P \\<turnstile> (None,h,calling_to_scalled (hd frs')#(tl frs'),sh)\n                        -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')\"\nproof -\n  have \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\" using assms by simp\n  then obtain T where \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\" by fastforce\n  then have \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (Cs,True) \\<leftarrow> unit : T\"\n    by (auto; metis list.sel(2) list.set_sel(2))\n  then have wtrt: \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT C' (Cs,True) \\<leftarrow> unit))\" by(simp only: exI)\n  show ?thesis using assms wtrt\n  proof(cases Cs)\n    case (Cons C1 Cs1)\n    then show ?thesis using assms wtrt\n      by(case_tac \"method P C1 clinit\") clarsimp\n  qed(clarsimp)\nqed\n\nlemma Jcc_pieces_InitError:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n and err: \"sh C\\<^sub>0 = Some(sfs,Error)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (RI (C\\<^sub>0, THROW NoClassDefFoundError);Cs \\<leftarrow> e)\n    = (True, (calling_to_throwing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs'),\n         (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),\n             \\<exists>vs'. P \\<turnstile> (None,h, (calling_to_throwing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs'),sh)\n                        -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')\"\nproof -\n  show ?thesis using assms\n  proof(cases Cs)\n    case (Cons C1 Cs1)\n    then show ?thesis using assms\n      by(case_tac \"method P C1 clinit\", case_tac \"method P C\\<^sub>0 clinit\") clarsimp\n  qed(clarsimp)\nqed\n\nlemma Jcc_pieces_InitObj:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) I h' l' sh'' v xa (INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> e)\n    = (True, calling_to_called (hd frs')#(tl frs'),\n         (None, h', (vs, l, C, M, pc, Called []) # frs, sh''),\n             \\<exists>vs'. P \\<turnstile> (None,h,calling_to_called (hd frs')#(tl frs'),sh')\n                        -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'')\"\nproof -\n  have \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\" using assms by simp\n  then obtain T where \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\" by fastforce\n  then have \"P\\<^sub>1,E,h,sh(C\\<^sub>0 \\<mapsto> (sfs,Processing)) \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> unit : T\"\n    using assms by clarsimp (auto simp: fun_upd_apply)\n  then have wtrt: \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) (INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> unit))\"\n    by(simp only: exI)\n  show ?thesis using assms wtrt by clarsimp\nqed\n\nlemma Jcc_pieces_InitNonObj:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"is_class P\\<^sub>1 D\" and \"D \\<notin> set (C\\<^sub>0#Cs)\" and \"\\<forall>C \\<in> set (C\\<^sub>0#Cs). P\\<^sub>1 \\<turnstile> C \\<preceq>\\<^sup>* D\"\n and pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) I h' l' sh'' v xa (INIT C' (D # C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, calling_to_calling (hd frs') D#(tl frs'),\n         (None, h', (vs, l, C, M, pc, Called []) # frs, sh''),\n             \\<exists>vs'. P \\<turnstile> (None,h,calling_to_calling (hd frs') D#(tl frs'),sh')\n                        -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'')\"\nproof -\n  have \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\" using assms by simp\n  then obtain T where \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\" by fastforce\n  then have \"P\\<^sub>1,E,h,sh(C\\<^sub>0 \\<mapsto> (sfs,Processing)) \\<turnstile>\\<^sub>1 INIT C' (D # C\\<^sub>0 # Cs,False) \\<leftarrow> unit : T\"\n    using assms by clarsimp (auto simp: fun_upd_apply)\n  then have wtrt: \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) (INIT C' (D # C\\<^sub>0 # Cs,False) \\<leftarrow> unit))\"\n    by(simp only: exI)\n  show ?thesis using assms wtrt by clarsimp\nqed\n\nlemma Jcc_pieces_InitRInit:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\" and wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> e)\n    = (True, frs',\n         (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),\n             \\<exists>vs'. P \\<turnstile> (None,h,frs',sh)\n                        -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')\"\nproof -\n  have cond: \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> e)\" using assms by simp\n  then have clinit: \"\\<exists>T. P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 C\\<^sub>0\\<bullet>\\<^sub>sclinit([]) : T\" using wf\n    by clarsimp (auto simp: is_class_def intro: wf\\<^sub>1_types_clinit)\n  then obtain T where cT: \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 C\\<^sub>0\\<bullet>\\<^sub>sclinit([]) : T\" by blast\n  obtain T where \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> unit : T\" using cond by fastforce\n  then have \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> unit : T\"\n    using assms by (auto intro: cT)\n  then have wtrt: \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> unit))\"\n    by(simp only: exI)\n  then show ?thesis using assms by simp\nqed\n\nlemma Jcc_pieces_RInit_clinit:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\" and wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([]));Cs \\<leftarrow> e)\n    = (True, frs',\n         (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h vs l pc (Called Cs) (tl frs') sh I h' l' sh' v xa (C\\<^sub>0\\<bullet>\\<^sub>sclinit([]))\n    = (True, create_init_frame P C\\<^sub>0#(vs,l,C,M,pc,Called Cs)#tl frs',\n         (None, h', (vs,l,C,M,pc,Called Cs)#tl frs', sh'(C\\<^sub>0\\<mapsto>(fst(the(sh' C\\<^sub>0)),Done))),\n             P \\<turnstile> (None,h,create_init_frame P C\\<^sub>0#(vs,l,C,M,pc,Called Cs)#tl frs',sh)\n   -jvm\\<rightarrow> (None,h',(vs, l, C, M, pc, Throwing Cs xa) # tl frs',sh'(C\\<^sub>0 \\<mapsto> (fst(the(sh' C\\<^sub>0)),Error))))\"\nproof -\n  have cond: \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([]));Cs \\<leftarrow> e)\" using assms by simp\n  then have wtrt: \"\\<exists>T. P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 C\\<^sub>0\\<bullet>\\<^sub>sclinit([]) : T\" using wf\n    by clarsimp (auto simp: is_class_def intro: wf\\<^sub>1_types_clinit)\n  then show ?thesis using assms by clarsimp\nqed\n\nlemma Jcc_pieces_RInit_Init:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\" and wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\n and proc: \"\\<forall>C' \\<in> set Cs. \\<exists>sfs. sh'' C' = \\<lfloor>(sfs,Processing)\\<rfloor>\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([]));Cs \\<leftarrow> e)\n    = (True, frs',\n         (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1), err)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h' vs l pc ics frs sh'' I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa (INIT (last (C\\<^sub>0#Cs)) (Cs,True) \\<leftarrow> e)\n    = (True, (vs, l, C, M, pc, Called Cs) # frs,\n         (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1),\n             \\<exists>vs'. P \\<turnstile> (None,h',(vs, l, C, M, pc, Called Cs) # frs,sh'')\n                        -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) l pc ics frs sh\\<^sub>1)\"\nproof -\n  have \"Jcc_cond P\\<^sub>1 E C M vs pc ics I h sh (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([]));Cs \\<leftarrow> e)\" using assms by simp\n  then have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> unit))\" by simp\n  then obtain T where riwt: \"P\\<^sub>1,E,h,sh \\<turnstile>\\<^sub>1 RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([]));Cs \\<leftarrow> unit : T\" by meson\n  then have \"P\\<^sub>1,E,h',sh'' \\<turnstile>\\<^sub>1 INIT (last (C\\<^sub>0#Cs)) (Cs,True) \\<leftarrow> unit : T\" using proc\n  proof(cases Cs) qed(auto)\n  then have wtrt: \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h' sh'' (INIT (last (C\\<^sub>0#Cs)) (Cs,True) \\<leftarrow> unit))\" by(simp only: exI)\n  show ?thesis using assms wtrt\n  proof(cases Cs)\n    case (Cons C1 Cs1)\n    then show ?thesis using assms wtrt\n      by(case_tac \"method P C1 clinit\") clarsimp\n  qed(clarsimp)\nqed\n\nlemma Jcc_pieces_RInit_RInit:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa (RI (C\\<^sub>0,e);D#Cs \\<leftarrow> e')\n    = (True, frs', rhs, err)\"\n and hd: \"hd frs' = (vs1,l1,C1,M1,pc1,ics1)\"\nshows\n \"Jcc_pieces P\\<^sub>1 E C M h' vs l pc ics frs sh'' I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa (RI (D,Throw xa) ; Cs \\<leftarrow> e')\n    = (True, (vs1, l1, C1, M1, pc1, Throwing (D#Cs) xa) # tl frs',\n         (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1),\n             \\<exists>vs'. P \\<turnstile> (None,h',(vs1, l1, C1, M1, pc1, Throwing (D#Cs) xa) # tl frs',sh'')\n                        -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) l pc ics frs sh\\<^sub>1)\"\nusing assms by(case_tac \"method P D clinit\", cases \"e = C\\<^sub>0\\<bullet>\\<^sub>sclinit([])\") clarsimp+\n\n\nsubsubsection \"JVM stepping lemmas\"\n\nlemma jvm_Invoke:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"P,C,M,pc \\<triangleright> Invoke M' (length Ts)\"\n and ha: \"h\\<^sub>2 a = \\<lfloor>(Ca, fs)\\<rfloor>\" and method: \"P\\<^sub>1 \\<turnstile> Ca sees M', NonStatic :  Ts\\<rightarrow>T = body in D\"\n and len: \"length pvs = length Ts\" and \"ls\\<^sub>2' = Addr a # pvs @ replicate (max_vars body) undefined\"\nshows \"P \\<turnstile> (None, h\\<^sub>2, (rev pvs @ Addr a # vs, ls\\<^sub>2, C, M, pc, No_ics) # frs, sh\\<^sub>2) -jvm\\<rightarrow>\n    (None, h\\<^sub>2, ([], ls\\<^sub>2', D, M', 0, No_ics) # (rev pvs @ Addr a # vs, ls\\<^sub>2, C, M, pc, No_ics) # frs, sh\\<^sub>2)\"\nproof -\n  have cname: \"cname_of h\\<^sub>2 (the_Addr ((rev pvs @ Addr a # vs) ! length Ts)) = Ca\"\n    using ha method len by(auto simp: nth_append)\n  have r: \"(rev pvs @ Addr a # vs) ! (length Ts) = Addr a\" using len by(auto simp: nth_append)\n  have exm: \"\\<exists>Ts T m D b. P \\<turnstile> Ca sees M',b:Ts \\<rightarrow> T = m in D\"\n    using sees_method_compP[OF method] by fastforce\n  show ?thesis using assms cname r exm by simp\nqed\n\nlemma jvm_Invokestatic:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\n and \"P,C,M,pc \\<triangleright> Invokestatic C' M' (length Ts)\"\n and sh: \"sh\\<^sub>2 D = Some(sfs,Done)\"\n and method: \"P\\<^sub>1 \\<turnstile> C' sees M', Static :  Ts\\<rightarrow>T = body in D\"\n and len: \"length pvs = length Ts\" and \"ls\\<^sub>2' = pvs @ replicate (max_vars body) undefined\"\nshows \"P \\<turnstile> (None, h\\<^sub>2, (rev pvs @ vs, ls\\<^sub>2, C, M, pc, No_ics) # frs, sh\\<^sub>2) -jvm\\<rightarrow>\n    (None, h\\<^sub>2, ([], ls\\<^sub>2', D, M', 0, No_ics) # (rev pvs @ vs, ls\\<^sub>2, C, M, pc, No_ics) # frs, sh\\<^sub>2)\"\nproof -\n  have exm: \"\\<exists>Ts T m D b. P \\<turnstile> C' sees M',b:Ts \\<rightarrow> T = m in D\"\n    using sees_method_compP[OF method] by fastforce\n  show ?thesis using assms exm by simp\nqed\n\nlemma jvm_Invokestatic_Called:\nassumes [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"                       \n and \"P,C,M,pc \\<triangleright> Invokestatic C' M' (length Ts)\"\n and sh: \"sh\\<^sub>2 D = Some(sfs,i)\"\n and method: \"P\\<^sub>1 \\<turnstile> C' sees M', Static :  Ts\\<rightarrow>T = body in D\"\n and len: \"length pvs = length Ts\" and \"ls\\<^sub>2' = pvs @ replicate (max_vars body) undefined\"\nshows \"P \\<turnstile> (None, h\\<^sub>2, (rev pvs @ vs, ls\\<^sub>2, C, M, pc, Called []) # frs, sh\\<^sub>2) -jvm\\<rightarrow>\n    (None, h\\<^sub>2, ([], ls\\<^sub>2', D, M', 0, No_ics) # (rev pvs @ vs, ls\\<^sub>2, C, M, pc, No_ics) # frs, sh\\<^sub>2)\"\nproof -\n  have exm: \"\\<exists>Ts T m D b. P \\<turnstile> C' sees M',b:Ts \\<rightarrow> T = m in D\"\n    using sees_method_compP[OF method] by fastforce\n  show ?thesis using assms exm by simp\nqed\n\nlemma jvm_Return_Init:\n\"P,D,clinit,0 \\<rhd> compE\\<^sub>2 body @ [Return]\n  \\<Longrightarrow> P \\<turnstile> (None, h, (vs, ls, D, clinit, size(compE\\<^sub>2 body), No_ics) # frs, sh)\n              -jvm\\<rightarrow> (None, h, frs, sh(D\\<mapsto>(fst(the(sh D)),Done)))\"\napply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)\napply(cases frs, auto)\ndone\n\nlemma jvm_InitNone:\n \"\\<lbrakk> ics_of f = Calling C Cs;\n    sh C = None \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> (None,h,f#frs,sh) -jvm\\<rightarrow> (None,h,f#frs,sh(C \\<mapsto> (sblank P C, Prepared)))\"\napply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)\napply(cases f) apply(rename_tac ics, case_tac ics, simp_all)\ndone\n\nlemma jvm_InitDP:\n \"\\<lbrakk> ics_of f = Calling C Cs;\n    sh C = \\<lfloor>(sfs,i)\\<rfloor>; i = Done \\<or> i = Processing \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> (None,h,f#frs,sh) -jvm\\<rightarrow> (None,h,(calling_to_scalled f)#frs,sh)\"\napply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)\napply(cases f)\napply(erule_tac P = \"i = Done\" in disjE)\n apply simp_all\ndone\n\nlemma jvm_InitError:\n \"sh C = \\<lfloor>(sfs,Error)\\<rfloor>\n  \\<Longrightarrow> P \\<turnstile> (None,h,(vs,ls,C\\<^sub>0,M,pc,Calling C Cs)#frs,sh)\n   -jvm\\<rightarrow> (None,h,(vs,ls,C\\<^sub>0,M,pc,Throwing Cs (addr_of_sys_xcpt NoClassDefFoundError))#frs,sh)\"\n by(clarsimp simp: exec_all_def1 intro!: r_into_rtrancl exec_1I)\n\nlemma exec_ErrorThrowing:\n \"sh C = \\<lfloor>(sfs,Error)\\<rfloor>\n  \\<Longrightarrow> exec (P, (None,h,calling_to_throwing (stk,loc,D,M,pc,Calling C Cs) a#frs,sh))\n   = Some (None,h,calling_to_sthrowing (stk,loc,D,M,pc,Calling C Cs) a #frs,sh)\"\n by(clarsimp simp: exec_all_def1 fun_upd_idem_iff intro!: r_into_rtrancl exec_1I)\n\nlemma jvm_InitObj:\n \"\\<lbrakk> sh C = Some(sfs,Prepared);\n     C = Object;\n     sh' = sh(C \\<mapsto> (sfs,Processing)) \\<rbrakk>\n\\<Longrightarrow> P \\<turnstile> (None, h, (vs,ls,C\\<^sub>0,M,pc,Calling C Cs)#frs, sh) -jvm\\<rightarrow>\n    (None, h, (vs,ls,C\\<^sub>0,M,pc,Called (C#Cs))#frs,sh')\"\napply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)\napply(case_tac \"method P C clinit\", simp)\ndone\n\nlemma jvm_InitNonObj:\n \"\\<lbrakk> sh C = Some(sfs,Prepared);\n     C \\<noteq> Object;\n     class P C = Some (D,r);\n     sh' = sh(C \\<mapsto> (sfs,Processing)) \\<rbrakk>\n\\<Longrightarrow> P \\<turnstile> (None, h, (vs,ls,C\\<^sub>0,M,pc,Calling C Cs)#frs, sh) -jvm\\<rightarrow>\n    (None, h, (vs,ls,C\\<^sub>0,M,pc,Calling D (C#Cs))#frs, sh')\"\napply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)\napply(case_tac \"method P C clinit\", simp)\ndone\n\nlemma jvm_RInit_throw:\n \"P \\<turnstile> (None,h,(vs,l,C,M,pc,Throwing [] xa) # frs,sh)\n        -jvm\\<rightarrow> handle P C M xa h vs l pc No_ics frs sh\"\napply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)\napply(simp add: handle_def split: bool.splits)\ndone\n\nlemma jvm_RInit_throw':\n \"P \\<turnstile> (None,h,(vs,l,C,M,pc,Throwing [C'] xa) # frs,sh)\n        -jvm\\<rightarrow> handle P C M xa h vs l pc No_ics frs (sh(C':=Some(fst(the(sh C')), Error)))\"\napply(simp add: exec_all_def1)\napply(rule_tac y = \"(None,h,(vs,l,C,M,pc,Throwing [] xa) # frs,sh(C':=Some(fst(the(sh C')), Error)))\" in rtrancl_trans)\n apply(rule r_into_rtrancl, rule exec_1I)\n apply(simp add: handle_def)\napply(cut_tac jvm_RInit_throw)\napply(simp add: exec_all_def1)\ndone\n\nlemma jvm_Called:\n \"P \\<turnstile> (None, h, (vs, l, C, M, pc, Called (C\\<^sub>0 # Cs)) # frs, sh) -jvm\\<rightarrow>\n    (None, h, create_init_frame P C\\<^sub>0 # (vs, l, C, M, pc, Called Cs) # frs, sh)\"\n by(simp add: exec_all_def1 r_into_rtrancl exec_1I)\n\nlemma jvm_Throwing:\n \"P \\<turnstile> (None, h, (vs, l, C, M, pc, Throwing (C\\<^sub>0#Cs) xa') # frs, sh) -jvm\\<rightarrow>\n    (None, h, (vs, l, C, M, pc, Throwing Cs xa') # frs, sh(C\\<^sub>0 \\<mapsto> (fst (the (sh C\\<^sub>0)), Error)))\"\n by(simp add: exec_all_def1 r_into_rtrancl exec_1I)\n\nsubsubsection \"Other lemmas for correctness proof\"\n\nlemma assumes wf:\"wf_prog wf_md P\"\n and ex: \"class P C = Some a\"\nshows create_init_frame_wf_eq: \"create_init_frame (compP\\<^sub>2 P) C = (stk,loc,D,M,pc,ics) \\<Longrightarrow> D=C\"\nusing wf_sees_clinit[OF wf ex] by(cases \"method P C clinit\", auto)\n\nlemma beforex_try:\n \"\\<lbrakk> {pc..<pc+size(compE\\<^sub>2(try e\\<^sub>1 catch(Ci i) e\\<^sub>2))} \\<subseteq> I;\n    P,C,M \\<rhd> compxE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2) pc (size vs) / I,size vs \\<rbrakk>\n   \\<Longrightarrow> P,C,M \\<rhd> compxE\\<^sub>2 e\\<^sub>1 pc (size vs) / {pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)},size vs\"\napply(clarsimp simp:beforex_def split:if_split_asm)\napply(rename_tac xt\\<^sub>0 xt\\<^sub>1) apply(rule_tac x=xt\\<^sub>0 in exI)\napply(auto simp: pcs_subset(1))\nusing atLeastLessThan_iff by blast\n\n\\<comment> \\<open> Evaluation of initialization expressions \\<close>\n\n(* --needs J1 and EConform; version for eval found in Equivalence *)\nlemma\nshows eval\\<^sub>1_init_return: \"P \\<turnstile>\\<^sub>1 \\<langle>e,s\\<rangle> \\<Rightarrow> \\<langle>e',s'\\<rangle>\n  \\<Longrightarrow> iconf (shp\\<^sub>1 s) e\n  \\<Longrightarrow> (\\<exists>Cs b. e = INIT C' (Cs,b) \\<leftarrow> unit) \\<or> (\\<exists>C e\\<^sub>0 Cs e\\<^sub>i. e = RI(C,e\\<^sub>0);Cs@[C'] \\<leftarrow> unit)\n     \\<or> (\\<exists>e\\<^sub>0. e = RI(C',e\\<^sub>0);Nil \\<leftarrow> unit)\n  \\<Longrightarrow> (val_of e' = Some v \\<longrightarrow> (\\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,i)\\<rfloor> \\<and> (i = Done \\<or> i = Processing)))\n   \\<and> (throw_of e' = Some a \\<longrightarrow> (\\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,Error)\\<rfloor>))\"\nand \"P \\<turnstile>\\<^sub>1 \\<langle>es,s\\<rangle> [\\<Rightarrow>] \\<langle>es',s'\\<rangle> \\<Longrightarrow> True\"\nproof(induct rule: eval\\<^sub>1_evals\\<^sub>1.inducts)\n  case (InitFinal\\<^sub>1 e s e' s' C b) then show ?case\n    by(auto simp: initPD_def dest: eval\\<^sub>1_final_same)\nnext\n  case (InitDone\\<^sub>1 sh C sfs C' Cs e h l e' s')\n  then have \"final e'\" using eval\\<^sub>1_final by simp\n  then show ?case\n  proof(rule finalE)\n    fix v assume e': \"e' = Val v\" then show ?thesis using InitDone\\<^sub>1 initPD_def\n    proof(cases Cs) qed(auto)\n  next\n    fix a assume e': \"e' = throw a\" then show ?thesis using InitDone\\<^sub>1 initPD_def\n    proof(cases Cs) qed(auto)\n  qed\nnext\n  case (InitProcessing\\<^sub>1 sh C sfs C' Cs e h l e' s')\n  then have \"final e'\" using eval\\<^sub>1_final by simp\n  then show ?case\n  proof(rule finalE)\n    fix v assume e': \"e' = Val v\" then show ?thesis using InitProcessing\\<^sub>1 initPD_def\n    proof(cases Cs) qed(auto)\n  next\n    fix a assume e': \"e' = throw a\" then show ?thesis using InitProcessing\\<^sub>1 initPD_def\n    proof(cases Cs) qed(auto)\n  qed\nnext\n  case (InitError\\<^sub>1 sh C sfs Cs e h l e' s' C') show ?case\n  proof(cases Cs)\n    case Nil then show ?thesis using InitError\\<^sub>1 by simp\n  next\n    case (Cons C2 list)\n    then have \"final e'\" using InitError\\<^sub>1 eval\\<^sub>1_final by simp\n    then show ?thesis\n    proof(rule finalE)\n      fix v assume e': \"e' = Val v\" show ?thesis\n        using InitError\\<^sub>1.hyps(2) e' rinit\\<^sub>1_throwE by blast\n    next\n      fix a assume e': \"e' = throw a\"\n      then show ?thesis using Cons InitError\\<^sub>1 cons_to_append[of list] by clarsimp\n    qed\n  qed\nnext\n  case (InitRInit\\<^sub>1 C Cs h l sh e' s' C') show ?case\n  proof(cases Cs)\n    case Nil then show ?thesis using InitRInit\\<^sub>1 by simp\n  next\n    case (Cons C' list) then show ?thesis\n      using InitRInit\\<^sub>1 Cons cons_to_append[of list] by clarsimp\n  qed\nnext\n  case (RInit\\<^sub>1 e s v h' l' sh' C sfs i sh'' C' Cs e' e\\<^sub>1 s\\<^sub>1)\n  then have final: \"final e\\<^sub>1\" using eval\\<^sub>1_final by simp\n  then show ?case\n  proof(cases Cs)\n    case Nil show ?thesis using final\n    proof(rule finalE)\n      fix v assume e': \"e\\<^sub>1 = Val v\" show ?thesis\n      using RInit\\<^sub>1 Nil by(clarsimp, meson fun_upd_same initPD_def)\n    next\n      fix a assume e': \"e\\<^sub>1 = throw a\" show ?thesis\n      using RInit\\<^sub>1 Nil by(clarsimp, meson fun_upd_same initPD_def)\n    qed\n  next\n    case (Cons a list) show ?thesis using final\n    proof(rule finalE)\n      fix v assume e': \"e\\<^sub>1 = Val v\" then show ?thesis\n      using RInit\\<^sub>1 Cons by(clarsimp, metis last.simps last_appendR list.distinct(1))\n    next\n      fix a assume e': \"e\\<^sub>1 = throw a\" then show ?thesis\n      using RInit\\<^sub>1 Cons by(clarsimp, metis last.simps last_appendR list.distinct(1))\n    qed\n  qed\nnext\n  case (RInitInitFail\\<^sub>1 e s a h' l' sh' C sfs i sh'' D Cs e' e\\<^sub>1 s\\<^sub>1)\n  then have final: \"final e\\<^sub>1\" using eval\\<^sub>1_final by simp\n  then show ?case\n  proof(rule finalE)\n    fix v assume e': \"e\\<^sub>1 = Val v\" then show ?thesis\n    using RInitInitFail\\<^sub>1 by(clarsimp, meson exp.distinct(101) rinit\\<^sub>1_throwE)\n  next\n    fix a' assume e': \"e\\<^sub>1 = Throw a'\"\n    then have \"iconf (sh'(C \\<mapsto> (sfs, Error))) a\"\n      using RInitInitFail\\<^sub>1.hyps(1) eval\\<^sub>1_final by fastforce\n    then show ?thesis using RInitInitFail\\<^sub>1 e'\n      by(clarsimp, meson Cons_eq_append_conv list.inject)\n  qed\nqed(auto simp: fun_upd_same)\n\nlemma init\\<^sub>1_Val_PD: \"P \\<turnstile>\\<^sub>1 \\<langle>INIT C' (Cs,b) \\<leftarrow> unit,s\\<rangle> \\<Rightarrow> \\<langle>Val v,s'\\<rangle>\n  \\<Longrightarrow> iconf (shp\\<^sub>1 s) (INIT C' (Cs,b) \\<leftarrow> unit)\n  \\<Longrightarrow> \\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,i)\\<rfloor> \\<and> (i = Done \\<or> i = Processing)\"\n by(drule_tac v = v in eval\\<^sub>1_init_return, simp+)\n\nlemma init\\<^sub>1_throw_PD: \"P \\<turnstile>\\<^sub>1 \\<langle>INIT C' (Cs,b) \\<leftarrow> unit,s\\<rangle> \\<Rightarrow> \\<langle>throw a,s'\\<rangle>\n  \\<Longrightarrow> iconf (shp\\<^sub>1 s) (INIT C' (Cs,b) \\<leftarrow> unit)\n  \\<Longrightarrow> \\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,Error)\\<rfloor>\"\n by(drule_tac a = a in eval\\<^sub>1_init_return, simp+)\n\nlemma rinit\\<^sub>1_Val_PD: \"P \\<turnstile>\\<^sub>1 \\<langle>RI(C,e\\<^sub>0);Cs \\<leftarrow> unit,s\\<rangle> \\<Rightarrow> \\<langle>Val v,s'\\<rangle>\n  \\<Longrightarrow> iconf (shp\\<^sub>1 s) (RI(C,e\\<^sub>0);Cs \\<leftarrow> unit) \\<Longrightarrow> last(C#Cs) = C'\n  \\<Longrightarrow> \\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,i)\\<rfloor> \\<and> (i = Done \\<or> i = Processing)\"\napply(drule_tac C' = C' and v = v in eval\\<^sub>1_init_return, simp_all)\napply (metis append_butlast_last_id)\ndone\n\nlemma rinit\\<^sub>1_throw_PD: \"P \\<turnstile>\\<^sub>1 \\<langle>RI(C,e\\<^sub>0);Cs \\<leftarrow> unit,s\\<rangle> \\<Rightarrow> \\<langle>throw a,s'\\<rangle>\n  \\<Longrightarrow> iconf (shp\\<^sub>1 s) (RI(C,e\\<^sub>0);Cs \\<leftarrow> unit) \\<Longrightarrow> last(C#Cs) = C'\n  \\<Longrightarrow> \\<exists>sfs i. shp\\<^sub>1 s' C' = \\<lfloor>(sfs,Error)\\<rfloor>\"\napply(drule_tac C' = C' and a = a in eval\\<^sub>1_init_return, simp_all)\napply (metis append_butlast_last_id)\ndone\n\nsubsubsection \"The proof\"\n\nlemma fixes P\\<^sub>1 defines [simp]: \"P \\<equiv> compP\\<^sub>2 P\\<^sub>1\"\nassumes wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\nshows Jcc: \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>e,(h\\<^sub>0,ls\\<^sub>0,sh\\<^sub>0)\\<rangle> \\<Rightarrow> \\<langle>ef,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\<rangle> \\<Longrightarrow>\n  (\\<And>E C M pc ics v xa vs frs I.\n     \\<lbrakk> Jcc_cond P\\<^sub>1 E C M vs pc ics I h\\<^sub>0 sh\\<^sub>0 e \\<rbrakk> \\<Longrightarrow>\n     (ef = Val v \\<longrightarrow>\n         P \\<turnstile> (None,h\\<^sub>0,Jcc_frames P C M vs ls\\<^sub>0 pc ics frs e,sh\\<^sub>0)\n                -jvm\\<rightarrow> Jcc_rhs P\\<^sub>1 E C M vs ls\\<^sub>0 pc ics frs h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v e)\n     \\<and>\n     (ef = Throw xa \\<longrightarrow> Jcc_err P C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 xa e)\n  )\"\n(*<*)\n  (is \"_ \\<Longrightarrow> (\\<And>E C M pc ics v xa vs frs I.\n                  PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 ef h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs I)\")\n(*>*)\nand \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>0,ls\\<^sub>0,sh\\<^sub>0)\\<rangle> [\\<Rightarrow>] \\<langle>fs,(h\\<^sub>1,ls\\<^sub>1,sh\\<^sub>1)\\<rangle> \\<Longrightarrow>\n    (\\<And>C M pc ics ws xa es' vs frs I.\n      \\<lbrakk> P,C,M,pc \\<rhd> compEs\\<^sub>2 es; P,C,M \\<rhd> compxEs\\<^sub>2 es pc (size vs)/I,size vs;\n       {pc..<pc+size(compEs\\<^sub>2 es)} \\<subseteq> I; ics = No_ics;\n       \\<not>sub_RIs es \\<rbrakk> \\<Longrightarrow>\n      (fs = map Val ws \\<longrightarrow>\n       P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(rev ws @ vs,ls\\<^sub>1,C,M,pc+size(compEs\\<^sub>2 es),ics)#frs,sh\\<^sub>1))\n      \\<and>\n      (fs = map Val ws @ Throw xa # es' \\<longrightarrow>\n       (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compEs\\<^sub>2 es) \\<and>\n                \\<not> caught P pc\\<^sub>1 h\\<^sub>1 xa (compxEs\\<^sub>2 es pc (size vs)) \\<and>\n                (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\n                                     -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1))))\"\n(*<*)\n  (is \"_ \\<Longrightarrow> (\\<And>C M pc ics ws xa es' vs frs I.\n                  PROP ?Ps es h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 fs h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C M pc ics ws xa es' vs frs I)\")\nproof (induct rule:eval\\<^sub>1_evals\\<^sub>1_inducts)\n  case New\\<^sub>1 thus ?case by auto\nnext\n  case (NewFail\\<^sub>1 sh C' sfs h ls)\n  let ?xa = \"addr_of_sys_xcpt OutOfMemory\"\n  have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> handle P C M ?xa h vs ls pc ics frs sh\"\n    using NewFail\\<^sub>1 by(clarsimp simp: handle_def)\n  then show ?case by(auto intro!: exI[where x=\"[]\"])\nnext\n  case (NewInit\\<^sub>1 sh C' h ls v' h' ls' sh' a FDTs h'')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (new C')\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (new C')),ics)#frs,sh'), err)\"\n    using NewInit\\<^sub>1.prems(1) by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT C' ([C'],False) \\<leftarrow> unit))\"\n    using has_fields_is_class[OF NewInit\\<^sub>1.hyps(5)] by auto\n  then obtain err' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v' xa (INIT C' ([C'],False) \\<leftarrow> unit)\n    = (True, (vs,ls,C,M,pc,Calling C' []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'), err')\"\n    using NewInit\\<^sub>1.prems(1) by auto\n  have IH: \"PROP ?P (INIT C' ([C'],False) \\<leftarrow> unit) h ls sh (Val v')\n             h' ls' sh' E C M pc ics v' xa vs frs I\" by fact\n  have ls: \"ls = ls'\" by(rule init\\<^sub>1_same_loc[OF NewInit\\<^sub>1.hyps(2)])\n  obtain sfs i where sh': \"sh' C' = Some(sfs,i)\"\n    using init\\<^sub>1_Val_PD[OF NewInit\\<^sub>1.hyps(2)] by clarsimp\n  have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling C' [])#frs,sh)\"\n  proof(cases \"sh C'\")\n    case None then show ?thesis using NewInit\\<^sub>1.prems by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using NewInit\\<^sub>1.hyps(1) NewInit\\<^sub>1.prems Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h', (vs, ls, C, M, pc, Called []) # frs, sh')\"\n    using IH pcs' by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h'', (Addr a#vs, ls, C, M, Suc pc, ics) # frs, sh')\"\n    using NewInit\\<^sub>1.hyps(1,2,4-6) NewInit\\<^sub>1.prems sh' by(cases ics) auto\n  finally show ?case using pcs ls by clarsimp\nnext\n  case (NewInitOOM\\<^sub>1 sh C' h ls v' h' ls' sh')\n  let ?xa = \"addr_of_sys_xcpt OutOfMemory\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (new C')\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (new C')),ics)#frs,sh'), err)\"\n    using NewInitOOM\\<^sub>1.prems(1) by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT C' ([C'],False) \\<leftarrow> unit))\" using NewInitOOM\\<^sub>1.hyps(5) by auto\n  then obtain err' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v' xa (INIT C' ([C'],False) \\<leftarrow> unit)\n    = (True, (vs,ls,C,M,pc,Calling C' []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'), err')\"\n    using NewInitOOM\\<^sub>1.prems(1) by auto\n  have IH: \"PROP ?P (INIT C' ([C'],False) \\<leftarrow> unit) h ls sh (Val v')\n             h' ls' sh' E C M pc ics v' xa vs frs I\" by fact\n  have ls: \"ls = ls'\" by(rule init\\<^sub>1_same_loc[OF NewInitOOM\\<^sub>1.hyps(2)])\n  have \"iconf (shp\\<^sub>1 (h, ls, sh)) (INIT C' ([C'],False) \\<leftarrow> unit)\" by simp\n  then obtain sfs i where sh': \"sh' C' = Some(sfs,i)\"\n    using init\\<^sub>1_Val_PD[OF NewInitOOM\\<^sub>1.hyps(2)] by clarsimp\n  have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling C' [])#frs,sh)\"\n  proof(cases \"sh C'\")\n    case None then show ?thesis using NewInitOOM\\<^sub>1.prems by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using NewInitOOM\\<^sub>1.hyps(1) NewInitOOM\\<^sub>1.prems Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h', (vs, ls, C, M, pc, Called []) # frs, sh')\"\n    using IH pcs' by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h' vs ls pc ics frs sh'\"\n    using NewInitOOM\\<^sub>1.hyps(1,2,4,5) NewInitOOM\\<^sub>1.prems sh' by(auto simp: handle_def)\n  finally show ?case using pcs ls by(simp, metis (no_types) append_Nil le_refl lessI)\nnext\n  case (NewInitThrow\\<^sub>1 sh C' h ls a h' ls' sh')\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (new C')\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (new C')),ics)#frs,sh'), err)\"\n    using NewInitThrow\\<^sub>1.prems(1) by clarsimp\n  obtain a' where throw: \"throw a = Throw a'\" using eval\\<^sub>1_final[OF NewInitThrow\\<^sub>1.hyps(2)] by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT C' ([C'],False) \\<leftarrow> unit))\" using NewInitThrow\\<^sub>1.hyps(4) by auto\n  then obtain vs' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v a' (INIT C' ([C'],False) \\<leftarrow> unit)\n    = (True, (vs,ls,C,M,pc,Calling C' []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'),\n        P \\<turnstile> (None,h,(vs,ls,C,M,pc,Calling C' []) # frs,sh)\n               -jvm\\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh')\"\n    using NewInitThrow\\<^sub>1.prems(1) by simp blast\n  have IH: \"PROP ?P (INIT C' ([C'],False) \\<leftarrow> unit) h ls sh (throw a)\n             h' ls' sh' E C M pc ics v a' vs frs I\" by fact\n  have ls: \"ls = ls'\" by(rule init\\<^sub>1_same_loc[OF NewInitThrow\\<^sub>1.hyps(2)])\n  then have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling C' []) # frs,sh)\"\n  proof(cases \"sh C'\")\n    case None then show ?thesis using NewInitThrow\\<^sub>1.prems by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using NewInitThrow\\<^sub>1.hyps(1) NewInitThrow\\<^sub>1.prems Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh'\" using IH pcs' throw by auto\n  finally show ?case using throw ls by auto\nnext\n  case (Cast\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 D fs C')\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (Cast C' e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (Cast C' e)),ics)#frs,sh\\<^sub>1), err)\"\n    using Cast\\<^sub>1.prems(1) by auto\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs I\" by fact\n  then have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using Jcc_pieces_Cast[OF assms(1) pcs, of \"Addr a\"] Cast\\<^sub>1.prems pcs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1)\"\n    using Cast\\<^sub>1 by (auto simp add:cast_ok_def)\n  finally show ?case by auto\nnext\n  case (CastNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C')\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (Cast C' e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (Cast C' e)),ics)#frs,sh\\<^sub>1), err)\"\n    using CastNull\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 null h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics Null xa vs frs I\" by fact\n  then have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using Jcc_pieces_Cast[OF assms(1) pcs, of Null] CastNull\\<^sub>1.prems pcs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1)\"\n    using CastNull\\<^sub>1 by (auto simp add:cast_ok_def)\n  finally show ?case by auto\nnext\n  case (CastFail\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 D fs C')\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?xa = \"addr_of_sys_xcpt ClassCast\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (Cast C' e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (Cast C' e)),ics)#frs,sh\\<^sub>1), err)\"\n    using CastFail\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs I\" by fact\n  then have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using Jcc_pieces_Cast[OF assms(1) pcs, of \"Addr a\"] CastFail\\<^sub>1.prems pcs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (Addr a#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using CastFail\\<^sub>1 by (auto simp add:handle_def cast_ok_def)\n  finally have exec: \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow> \\<dots>\".\n  show ?case (is \"?N \\<and> (?eq \\<longrightarrow> ?err)\")\n  proof\n    show ?N by simp\n  next\n    { assume ?eq\n      then have ?err using exec by (auto intro!: exI[where x=\"?pc\"] exI[where x=\"[Addr a]\"])\n    }\n    thus \"?eq \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (CastThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e' h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C')\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (Cast C' e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (Cast C' e)),ics)#frs,sh\\<^sub>1), err)\"\n    using CastThrow\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e') h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs I\" by fact\n  show ?case using IH Jcc_pieces_Cast[OF assms(1) pcs, of v] CastThrow\\<^sub>1.prems pcs less_SucI\n   by(simp, blast)\nnext\n  case Val\\<^sub>1 thus ?case by auto\nnext\n  case Var\\<^sub>1 thus ?case by auto\nnext\n  case (BinOp\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 v\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 v\\<^sub>2 h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 bop w)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using BinOp\\<^sub>1.prems(1) by clarsimp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val v\\<^sub>1) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v\\<^sub>1 xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val v\\<^sub>2) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics v\\<^sub>2 xa (v\\<^sub>1#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using IH\\<^sub>1 Jcc_pieces_BinOp1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v\\<^sub>1] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(v\\<^sub>2#v\\<^sub>1#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using IH\\<^sub>2 Jcc_pieces_BinOp2[OF assms(1) pcs, of h\\<^sub>1 v\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v\\<^sub>2] by (simp add: add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(w#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>2)\"\n    using BinOp\\<^sub>1 by(cases bop) auto\n  finally show ?case using pcs by (auto split: bop.splits simp:add.assoc)\nnext\n  case (BinOpThrow\\<^sub>1\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 bop e\\<^sub>2)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using BinOpThrow\\<^sub>1\\<^sub>1.prems(1) by clarsimp\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  show ?case using IH\\<^sub>1 Jcc_pieces_BinOp1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v] BinOpThrow\\<^sub>1\\<^sub>1.prems nsub_RI_Jcc_pieces\n    by auto\nnext\n  case (BinOpThrow\\<^sub>2\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 v\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 e h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 bop)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using BinOpThrow\\<^sub>2\\<^sub>1.prems(1) by clarsimp\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val v\\<^sub>1) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v\\<^sub>1 xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw e) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc ics v xa (v\\<^sub>1#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n  have 1: \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\"\n    using IH\\<^sub>1 Jcc_pieces_BinOp1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v\\<^sub>1] by simp\n  have \"(throw e = Val v \\<longrightarrow>  P \\<turnstile> (None, h\\<^sub>0, Jcc_frames P C M vs ls\\<^sub>0 pc ics frs (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2), sh\\<^sub>0) -jvm\\<rightarrow>\n     Jcc_rhs P\\<^sub>1 E C M vs ls\\<^sub>0 pc ics frs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2))\n   \\<and> (throw e = Throw xa \\<longrightarrow> (\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < pc + size(compE\\<^sub>2 (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2)) \\<and>\n               \\<not> caught P pc\\<^sub>1 h\\<^sub>2 xa (compxE\\<^sub>2 (e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2) pc (size vs)) \\<and>\n               (\\<exists>vs'. P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>1 ics frs sh\\<^sub>2)))\"\n   (is \"?N \\<and> (?eq \\<longrightarrow> (\\<exists>pc\\<^sub>2. ?H pc\\<^sub>2))\")\n  proof\n    show ?N by simp\n  next\n    { assume ?eq\n      then obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc + size(compE\\<^sub>2 e\\<^sub>2) \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc (size vs + 1))\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@v\\<^sub>1#vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using IH\\<^sub>2 Jcc_pieces_BinOp2[OF assms(1) pcs, of h\\<^sub>1 v\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v] BinOpThrow\\<^sub>2\\<^sub>1.prems by clarsimp\n      then have \"?H pc\\<^sub>2\" using jvm_trans[OF 1 2] by(auto intro!: exI[where x=\"vs'@[v\\<^sub>1]\"])\n      hence \"\\<exists>pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n    }\n    thus \"?eq \\<longrightarrow> (\\<exists>pc\\<^sub>2. ?H pc\\<^sub>2)\" by iprover\n  qed\n  then show ?case using pcs by simp blast\nnext\n  case (FAcc\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' fs F T D w)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<bullet>F{D})),ics)#frs,sh\\<^sub>1), err)\"\n    using FAcc\\<^sub>1.prems(1) by clarsimp\n  have \"P\\<^sub>1 \\<turnstile> D sees F,NonStatic:T in D\" by(rule has_field_sees[OF has_field_idemp[OF FAcc\\<^sub>1.hyps(4)]])\n  then have field: \"field P D F = (D,NonStatic,T)\" by simp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_FAcc[OF pcs, of \"Addr a\"] pcs by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1)\"\n    using FAcc\\<^sub>1 field by auto\n  finally have \"P \\<turnstile> (None, h\\<^sub>0, frs', sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1)\"\n    by auto\n  then show ?case using pcs by auto\nnext\n  case (FAccNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 F D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<bullet>F{D})),ics)#frs,sh\\<^sub>1), err)\"\n    using FAccNull\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 null h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics Null xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?xa = \"addr_of_sys_xcpt NullPointer\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_FAcc[OF pcs, of Null] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (Null#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using FAccNull\\<^sub>1.prems\n    by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x=\"[Null]\"])\nnext\n  case (FAccThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e' h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 F D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<bullet>F{D})),ics)#frs,sh\\<^sub>1), err)\"\n    using FAccThrow\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e') h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs I\" by fact\n  show ?case using IH Jcc_pieces_FAcc[OF pcs, of v] FAccThrow\\<^sub>1.prems nsub_RI_Jcc_pieces\n    less_Suc_eq by auto\nnext\n  case (FAccNone\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C fs F D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<bullet>F{D})),ics)#frs,sh\\<^sub>1), err)\"\n    using FAccNone\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?xa = \"addr_of_sys_xcpt NoSuchFieldError\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_FAcc[OF pcs, of \"Addr a\"] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (Addr a#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using FAccNone\\<^sub>1\n    by(cases ics; clarsimp simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x=\"[Addr a]\"])\nnext\n  case (FAccStatic\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' fs F T D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<bullet>F{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<bullet>F{D})),ics)#frs,sh\\<^sub>1), err)\"\n    using FAccStatic\\<^sub>1.prems(1) by clarsimp\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:T in D\" by(rule has_field_sees[OF has_field_idemp[OF FAccStatic\\<^sub>1.hyps(4)]])\n  then have field: \"field P D F = (D,Static,T)\" by simp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_FAcc[OF pcs, of \"Addr a\"] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (Addr a#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using FAccStatic\\<^sub>1 field by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x=\"[Addr a]\"])\nnext\n  case (SFAcc\\<^sub>1 C' F t D sh sfs v' h ls)\n  have has: \"P\\<^sub>1 \\<turnstile> D has F,Static:t in D\" by(rule has_field_idemp[OF SFAcc\\<^sub>1.hyps(1)])\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:t in D\" by(rule has_field_sees[OF has])\n  then have field: \"field P D F = (D,Static,t)\" by simp\n  then have \"P \\<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs (C'\\<bullet>\\<^sub>sF{D}),sh) -jvm\\<rightarrow>\n             (None,h,(v'#vs,ls,C,M,Suc pc,ics)#frs,sh)\"\n    using SFAcc\\<^sub>1 has by(cases ics) auto\n  then show ?case by clarsimp\nnext\n  case (SFAccInit\\<^sub>1 C' F t D sh h ls v' h' ls' sh' sfs i v'')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C'\\<bullet>\\<^sub>sF{D})\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D})),ics)#frs,sh'), err)\"\n    using SFAccInit\\<^sub>1.prems(1) by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT D ([D],False) \\<leftarrow> unit))\"\n    using has_field_is_class'[OF SFAccInit\\<^sub>1.hyps(1)] by auto\n  then obtain err' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v' xa (INIT D ([D],False) \\<leftarrow> unit)\n    = (True, (vs,ls,C,M,pc,Calling D []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'), err')\"\n    using SFAccInit\\<^sub>1.prems(1) by auto\n  have IH: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h ls sh (Val v')\n             h' ls' sh' E C M pc ics v' xa vs frs I\" by fact\n  have ls: \"ls = ls'\" by(rule init\\<^sub>1_same_loc[OF SFAccInit\\<^sub>1.hyps(3)])\n  have has: \"P\\<^sub>1 \\<turnstile> D has F,Static:t in D\" by(rule has_field_idemp[OF SFAccInit\\<^sub>1.hyps(1)])\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:t in D\" by(rule has_field_sees[OF has])\n  then have field: \"field P D F = (D,Static,t)\" by simp\n  have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling D [])#frs,sh)\"\n  proof(cases \"sh D\")\n    case None then show ?thesis using SFAccInit\\<^sub>1.hyps(1,2,5,6) SFAccInit\\<^sub>1.prems field\n      by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using SFAccInit\\<^sub>1.hyps(1,2,5,6) SFAccInit\\<^sub>1.prems field Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None, h', (vs, ls, C, M, pc, Called []) # frs, sh')\"\n    using IH pcs' by auto\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None, h', (v''#vs, ls, C, M, Suc pc, ics) # frs, sh')\"\n    using SFAccInit\\<^sub>1.hyps(1,2,5,6) SFAccInit\\<^sub>1.prems has field by(cases ics) auto\n  finally show ?case using pcs ls by clarsimp\nnext\n  case (SFAccInitThrow\\<^sub>1 C' F t D sh h ls a h' ls' sh')\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C'\\<bullet>\\<^sub>sF{D})\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D})),ics)#frs,sh'), err)\"\n    using SFAccInitThrow\\<^sub>1.prems(1) by clarsimp\n  obtain a' where throw: \"throw a = Throw a'\" using eval\\<^sub>1_final[OF SFAccInitThrow\\<^sub>1.hyps(3)] by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h sh (INIT D ([D],False) \\<leftarrow> unit))\"\n    using has_field_is_class'[OF SFAccInitThrow\\<^sub>1.hyps(1)] by auto\n  then obtain vs' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v a' (INIT D ([D],False) \\<leftarrow> unit)\n    = (True, (vs,ls,C,M,pc,Calling D []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'),\n        P \\<turnstile> (None,h,(vs,ls,C,M,pc,Calling D []) # frs,sh)\n               -jvm\\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh')\"\n    using SFAccInitThrow\\<^sub>1.prems(1) by simp blast\n  have IH: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h ls sh (throw a)\n             h' ls' sh' E C M pc ics v a' vs frs I\" by fact\n  have ls: \"ls = ls'\" by(rule init\\<^sub>1_same_loc[OF SFAccInitThrow\\<^sub>1.hyps(3)])\n  have has: \"P\\<^sub>1 \\<turnstile> D has F,Static:t in D\" by(rule has_field_idemp[OF SFAccInitThrow\\<^sub>1.hyps(1)])\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:t in D\" by(rule has_field_sees[OF has])\n  then have field: \"field P D F = (D,Static,t)\" by simp\n  then have \"P \\<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling D []) # frs,sh)\"\n  proof(cases \"sh D\")\n    case None then show ?thesis using SFAccInitThrow\\<^sub>1.hyps(1,2) SFAccInitThrow\\<^sub>1.prems field\n      by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using SFAccInitThrow\\<^sub>1.hyps(1,2) SFAccInitThrow\\<^sub>1.prems field Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh'\"\n    using IH pcs' throw by auto\n  finally show ?case using throw ls by auto\nnext\n  case (SFAccNone\\<^sub>1 C' F D h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1)\n  then obtain frs' err where pcs:\n   \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 vs ls\\<^sub>1 pc ics frs sh\\<^sub>1 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (C'\\<bullet>\\<^sub>sF{D})\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D})),ics)#frs,sh\\<^sub>1), err)\"\n    by clarsimp\n  let ?xa = \"addr_of_sys_xcpt NoSuchFieldError\"\n  have \"P \\<turnstile> (None,h\\<^sub>1,frs',sh\\<^sub>1) -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 vs ls\\<^sub>1 pc ics frs sh\\<^sub>1\"\n    using SFAccNone\\<^sub>1 pcs\n    by(cases ics; clarsimp simp:split_beta handle_def simp del: split_paired_Ex)\n  then show ?case using pcs by(auto intro!: exI[where x = pc] exI[where x=\"[]\"])\nnext\n  case (SFAccNonStatic\\<^sub>1 C' F t D h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1)\n  let ?frs' = \"(vs, ls\\<^sub>1, C, M, pc, ics) # frs\"\n  let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n  have \"P\\<^sub>1 \\<turnstile> D sees F,NonStatic:t in D\"\n    by(rule has_field_sees[OF has_field_idemp[OF SFAccNonStatic\\<^sub>1.hyps(1)]])\n  then have field: \"field P D F = (D,NonStatic,t)\" by simp\n  have \"P \\<turnstile> (None,h\\<^sub>1,?frs',sh\\<^sub>1) -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 vs ls\\<^sub>1 pc ics frs sh\\<^sub>1\"\n    using SFAccNonStatic\\<^sub>1\n    proof(cases ics)\n      case No_ics\n      then show ?thesis using SFAccNonStatic\\<^sub>1 field\n       by (auto simp:split_beta handle_def simp del: split_paired_Ex)\n    qed(simp_all)\n  then show ?case by (auto intro!: exI[where x = pc] exI[where x=\"[]\"])\nnext\n  case (LAss\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 i ls\\<^sub>2)\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (i:=e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (i:=e)),ics)#frs,sh\\<^sub>1), err)\"\n    using LAss\\<^sub>1.prems(1) by auto\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  then have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using Jcc_pieces_LAss[OF assms(1) pcs, of w] LAss\\<^sub>1.prems pcs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(Unit#vs,ls\\<^sub>2,C,M,?pc+2,ics)#frs,sh\\<^sub>1)\"\n    using LAss\\<^sub>1 by (auto simp add:cast_ok_def)\n  finally show ?case by auto\nnext\n  case (LAssThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 i)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (i:=e)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (i:=e)),ics)#frs,sh\\<^sub>1), err)\"\n    using LAssThrow\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs I\" by fact\n  show ?case using IH Jcc_pieces_LAss[OF assms(1) pcs, of v] LAssThrow\\<^sub>1.prems pcs less_SucI\n    by(simp, blast)\nnext\n  case (FAss\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 w h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' fs F T D fs' h\\<^sub>2')\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using FAss\\<^sub>1.prems(1) by clarsimp\n  have \"P\\<^sub>1 \\<turnstile> D sees F,NonStatic:T in D\" by(rule has_field_sees[OF has_field_idemp[OF FAss\\<^sub>1.hyps(6)]])\n  then have field: \"field P D F = (D,NonStatic,T)\" by simp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val w) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics w xa (Addr a#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 \"Addr a\"] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(w#Addr a#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using IH\\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 \"Addr a\" ls\\<^sub>1 sh\\<^sub>1 w] by (simp add: add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2',(Unit#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2+2,ics)#frs,sh\\<^sub>2)\"\n    using FAss\\<^sub>1 field by auto\n  finally show ?case using pcs by (auto simp:add.assoc)\nnext\n  case (FAssNull\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 w h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 F D)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using FAssNull\\<^sub>1.prems(1) by clarsimp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt NullPointer\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 null h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics Null xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val w) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics w xa (Null#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 Null] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(w#Null#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using IH\\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 Null ls\\<^sub>1 sh\\<^sub>1 w] by (simp add: add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (w#Null#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using FAssNull\\<^sub>1 by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"w#[Null]\"])\nnext\n  case (FAssThrow\\<^sub>2\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 F D)\n  let ?frs' = \"(vs, ls\\<^sub>0, C, M, pc, ics) # frs\"\n  obtain err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, ?frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using FAssThrow\\<^sub>2\\<^sub>1.prems(1) by clarsimp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw e') h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics v xa (w#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have 1: \"P \\<turnstile> (None,h\\<^sub>0,?frs',sh\\<^sub>0) -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\"\n    using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 w] by simp\n  show ?case (is \"?N \\<and> (?eq \\<longrightarrow> ?err)\")\n  proof\n    show ?N by simp\n  next\n    { assume ?eq\n      moreover\n      have \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw e') h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics v xa (w#vs) frs\n                    (I - pcs (compxE\\<^sub>2 e\\<^sub>1 pc (length vs)))\" by fact\n      ultimately obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>1 + size(compE\\<^sub>2 e\\<^sub>2) \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>1 (size vs + 1))\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@w#vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using FAssThrow\\<^sub>2\\<^sub>1.prems Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 w ls\\<^sub>1 sh\\<^sub>1] by auto\n      have ?err using Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 w ls\\<^sub>1 sh\\<^sub>1] pc\\<^sub>2 jvm_trans[OF 1 2]\n        by(auto intro!: exI[where x=pc\\<^sub>2] exI[where x=\"vs'@[w]\"])\n    }\n    thus \"?eq \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (FAssThrow\\<^sub>1\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e' h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 F D e\\<^sub>2)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using FAssThrow\\<^sub>1\\<^sub>1.prems(1) by clarsimp\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e') h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  show ?case using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v] FAssThrow\\<^sub>1\\<^sub>1.prems nsub_RI_Jcc_pieces\n    by auto\nnext\n  case (FAssNone\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 w h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' fs F D)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using FAssNone\\<^sub>1.prems(1) by clarsimp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt NoSuchFieldError\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val w) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics w xa (Addr a#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 \"Addr a\"] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(w#Addr a#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using IH\\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 \"Addr a\" ls\\<^sub>1 sh\\<^sub>1 w] by (simp add: add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (w#Addr a#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using FAssNone\\<^sub>1 by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"w#[Addr a]\"])\nnext\n  case (FAssStatic\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 w h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' fs F T D)\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,pc+size(compE\\<^sub>2 (e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>2), err)\"\n    using FAssStatic\\<^sub>1.prems(1) by clarsimp\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:T in D\" by(rule has_field_sees[OF has_field_idemp[OF FAssStatic\\<^sub>1.hyps(6)]])\n  then have field: \"field P D F = (D,Static,T)\" by simp\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n  have IH\\<^sub>1: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n                     (I - pcs (compxE\\<^sub>2 e\\<^sub>2 (pc + length (compE\\<^sub>2 e\\<^sub>1)) (Suc (length vs))))\" by fact\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val w) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics w xa (Addr a#vs) frs\n                     (I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(Addr a#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using IH\\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 \"Addr a\"] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(w#Addr a#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using IH\\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\\<^sub>1 \"Addr a\" ls\\<^sub>1 sh\\<^sub>1 w] by (simp add: add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (w#Addr a#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using FAssStatic\\<^sub>1 field by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"w#[Addr a]\"])\nnext\n  case (SFAss\\<^sub>1 e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F T D sfs sfs' sh\\<^sub>1')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using SFAss\\<^sub>1.prems(1) by clarsimp\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:T in D\" by(rule has_field_sees[OF has_field_idemp[OF SFAss\\<^sub>1.hyps(3)]])\n  then have field: \"field P D F = (D,Static,T)\" by simp\n  have IH: \"PROP ?P e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>2)\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1')\"\n    using SFAss\\<^sub>1.hyps(3-6) SFAss\\<^sub>1.prems(1) field by auto\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None,h\\<^sub>1,(Unit#vs,ls\\<^sub>1,C,M,?pc+2,ics)#frs,sh\\<^sub>1')\"\n    using SFAss\\<^sub>1 by auto\n  finally show ?case using pcs by auto\nnext\n  case (SFAssInit\\<^sub>1 e\\<^sub>2 h ls sh w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F t D v' h' ls' sh' sfs i sfs' sh'')\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>2)\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh'' v xa (C'\\<bullet>\\<^sub>sF{D}:=e\\<^sub>2)\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D}:=e\\<^sub>2)),ics)#frs,sh''), err)\"\n    using SFAssInit\\<^sub>1.prems(1) by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h\\<^sub>1 sh\\<^sub>1 (INIT D ([D],False) \\<leftarrow> unit))\"\n    using has_field_is_class'[OF SFAssInit\\<^sub>1.hyps(3)] by auto\n  then obtain err' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 (w#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1 I h' ls' sh' v' xa (INIT D ([D],False) \\<leftarrow> unit)\n    = (True, (w#vs,ls\\<^sub>1,C,M,?pc,Calling D []) # frs,\n       (None,h',(w#vs,ls\\<^sub>1,C,M,?pc,Called [])#frs,sh'), err')\"\n    using SFAssInit\\<^sub>1.prems(1) by simp\n  have ls: \"ls\\<^sub>1 = ls'\" by(rule init\\<^sub>1_same_loc[OF SFAssInit\\<^sub>1.hyps(5)])\n  have has: \"P\\<^sub>1 \\<turnstile> D has F,Static:t in D\" by(rule has_field_idemp[OF SFAssInit\\<^sub>1.hyps(3)])\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:t in D\" by(rule has_field_sees[OF has])\n  then have field: \"field P D F = (D,Static,t)\" by simp\n  have IH: \"PROP ?P e\\<^sub>2 h ls sh (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  have IHI: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val v')\n             h' ls' sh' E C M ?pc ics v' xa (w#vs) frs I\" by fact\n  have \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_SFAss[OF pcs, where v'=w] by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,Calling D [])#frs,sh\\<^sub>1)\"\n  proof(cases \"sh\\<^sub>1 D\")\n    case None then show ?thesis using None SFAssInit\\<^sub>1.hyps(1,3-5,7-9) SFAssInit\\<^sub>1.prems field\n      by(cases ics, auto)\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using SFAssInit\\<^sub>1.hyps(1,3-5,7-9) SFAssInit\\<^sub>1.prems field Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None, h', (w#vs, ls\\<^sub>1, C, M, ?pc, Called []) # frs, sh')\"\n    using IHI pcs' by clarsimp\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None, h', (vs, ls\\<^sub>1, C, M, ?pc + 1, ics) # frs, sh'')\"\n    using SFAssInit\\<^sub>1.hyps(1,3-5,7-9) SFAssInit\\<^sub>1.prems has field by(cases ics) auto\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> (None, h', (Unit#vs, ls\\<^sub>1, C, M, ?pc + 2, ics) # frs, sh'')\"\n    using SFAssInit\\<^sub>1.hyps(1,3-5,7-9) SFAssInit\\<^sub>1.prems has field by(cases ics) auto\n  finally show ?case using pcs ls by simp blast\nnext\n  case (SFAssInitThrow\\<^sub>1 e\\<^sub>2 h ls sh w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F t D a h' ls' sh')\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>2)\"\n  obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C'\\<bullet>\\<^sub>sF{D}:=e\\<^sub>2)\n    = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D}:=e\\<^sub>2)),ics)#frs,sh'), err)\"\n    using SFAssInitThrow\\<^sub>1.prems(1) by clarsimp\n  obtain a' where throw: \"throw a = Throw a'\" using eval\\<^sub>1_final[OF SFAssInitThrow\\<^sub>1.hyps(5)] by clarsimp\n  have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h\\<^sub>1 sh\\<^sub>1 (INIT D ([D],False) \\<leftarrow> unit))\"\n    using has_field_is_class'[OF SFAssInitThrow\\<^sub>1.hyps(3)] by auto\n  then obtain vs' where pcs':\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 (w#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1 I h' ls' sh' v a' (INIT D ([D],False) \\<leftarrow> unit)\n    = (True, (w#vs,ls\\<^sub>1,C,M,?pc,Calling D []) # frs, (None,h',(w#vs,ls\\<^sub>1,C,M,?pc,Called [])#frs,sh'),\n         P \\<turnstile> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,Calling D []) # frs,sh\\<^sub>1)\n               -jvm\\<rightarrow> handle P C M a' h' (vs'@w#vs) ls\\<^sub>1 ?pc ics frs sh')\"\n    using SFAssInitThrow\\<^sub>1.prems(1) by simp blast\n  have ls: \"ls\\<^sub>1 = ls'\" by(rule init\\<^sub>1_same_loc[OF SFAssInitThrow\\<^sub>1.hyps(5)])\n  have has: \"P\\<^sub>1 \\<turnstile> D has F,Static:t in D\" by(rule has_field_idemp[OF SFAssInitThrow\\<^sub>1.hyps(3)])\n  have \"P\\<^sub>1 \\<turnstile> D sees F,Static:t in D\" by(rule has_field_sees[OF has])\n  then have field: \"field P D F = (D,Static,t)\" by simp\n  have IH: \"PROP ?P e\\<^sub>2 h ls sh (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  have IHI: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw a)\n             h' ls' sh' E C M ?pc ics v a' (w#vs) frs I\" by fact\n  have \"P \\<turnstile> (None,h,(vs, ls, C, M, pc, ics) # frs,sh) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp blast\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,Calling D [])#frs,sh\\<^sub>1)\"\n  proof(cases \"sh\\<^sub>1 D\")\n    case None then show ?thesis using SFAssInitThrow\\<^sub>1.hyps(1,3,4,5) SFAssInitThrow\\<^sub>1.prems field\n      by(cases ics) auto\n  next\n    case (Some a)\n    then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n    then show ?thesis using SFAssInitThrow\\<^sub>1.hyps(1,3,4,5) SFAssInitThrow\\<^sub>1.prems field Some\n      by(cases ics; case_tac i) auto\n  qed\n  also have \"P \\<turnstile> ... -jvm\\<rightarrow> handle P C M a' h' (vs'@w#vs) ls\\<^sub>1 ?pc ics frs sh'\"\n    using IHI pcs' throw by auto\n  finally show ?case using throw ls by(auto intro!: exI[where x = ?pc] exI[where x=\"vs'@[w]\"])\nnext\n  case (SFAssThrow\\<^sub>1 e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e' h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using SFAssThrow\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e') h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs I\" by fact\n  show ?case using IH Jcc_pieces_SFAss[OF pcs, where v'=v] SFAssThrow\\<^sub>1.prems nsub_RI_Jcc_pieces\n    less_Suc_eq by auto\nnext\n  case (SFAssNone\\<^sub>1 e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using SFAssNone\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt NoSuchFieldError\"\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (w#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using SFAssNone\\<^sub>1 by(cases ics; clarsimp simp add: handle_def)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x=\"[w]\"])\nnext\n  case (SFAssNonStatic\\<^sub>1 e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' F T D)\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 v xa (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)\n    = (True, frs', (None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,pc+size(compE\\<^sub>2 (C'\\<bullet>\\<^sub>sF{D} := e\\<^sub>2)),ics)#frs,sh\\<^sub>1), err)\"\n    using SFAssNonStatic\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e\\<^sub>2 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs I\" by fact\n  let ?pc = \"pc + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n  have \"P\\<^sub>1 \\<turnstile> D sees F,NonStatic:T in D\"\n    by(rule has_field_sees[OF has_field_idemp[OF SFAssNonStatic\\<^sub>1.hyps(3)]])\n  then have field: \"field P D F = (D,NonStatic,T)\" by simp\n  have \"P \\<turnstile> (None,h\\<^sub>0,frs',sh\\<^sub>0) -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>1 (w#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n    using SFAssNonStatic\\<^sub>1\n    proof(cases ics)\n      case No_ics\n      then show ?thesis using SFAssNonStatic\\<^sub>1 field\n       by (auto simp:split_beta handle_def simp del: split_paired_Ex)\n    qed(simp_all)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x=\"[w]\"])\nnext\n  case (Call\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 Ca fs M' Ts T body D ls\\<^sub>2' f h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3)\n  let ?frs\\<^sub>0 = \"(vs, ls\\<^sub>0, C,M,pc,ics)#frs\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,?frs\\<^sub>0,sh\\<^sub>0)\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(Addr a#vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  let ?frs\\<^sub>2 = \"(rev pvs @ Addr a # vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n  let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n  let ?frs\\<^sub>2' = \"([], ls\\<^sub>2', D,M',0,No_ics) # ?frs\\<^sub>2\"\n  let ?\\<sigma>\\<^sub>2' = \"(None, h\\<^sub>2, ?frs\\<^sub>2', sh\\<^sub>2)\"\n  have nclinit: \"M' \\<noteq> clinit\" using wf_sees_clinit1[OF wf] visible_method_exists[OF Call\\<^sub>1.hyps(6)]\n    sees_method_idemp[OF Call\\<^sub>1.hyps(6)] by fastforce\n  have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n  hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n  have invoke: \"P,C,M,?pc\\<^sub>2 \\<triangleright> Invoke M' (length Ts)\"\n    using Call\\<^sub>1.hyps(7) Call\\<^sub>1.prems(1) by clarsimp\n  have nsub: \"\\<not> sub_RI body\" by(rule sees_wf\\<^sub>1_nsub_RI[OF wf Call\\<^sub>1.hyps(6)])\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>3 ls\\<^sub>2 sh\\<^sub>3 v xa (e\\<bullet>M'(es)) =\n    (True, ?frs\\<^sub>0, (None, h\\<^sub>3, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>3), err)\"\n   using Call\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics pvs xa\n                    (map Val pvs) (Addr a#vs) frs (I - pcs(compxE\\<^sub>2 e pc (size vs)))\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Jcc_pieces_Call1[OF pcs] IH by clarsimp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es Call\\<^sub>1.prems by fastforce\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\"\n    using jvm_Invoke[OF assms(1) invoke _ Call\\<^sub>1.hyps(6-8)] Call\\<^sub>1.hyps(5) Call\\<^sub>1.prems(1) by simp\n  finally have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\".\n  have \"P\\<^sub>1 \\<turnstile> Ca sees M',NonStatic: Ts\\<rightarrow>T = body in D\" by fact\n  then have M'_in_D: \"P\\<^sub>1 \\<turnstile> D sees M',NonStatic: Ts\\<rightarrow>T = body in D\"\n    by(rule sees_method_idemp) \n  have M'_code: \"compP\\<^sub>2 P\\<^sub>1,D,M',0 \\<rhd> compE\\<^sub>2 body @ [Return]\" using beforeM M'_in_D by simp\n  have M'_xtab: \"compP\\<^sub>2 P\\<^sub>1,D,M' \\<rhd> compxE\\<^sub>2 body 0 0/{..<size(compE\\<^sub>2 body)},0\"\n    using M'_in_D by(rule beforexM)\n  have IH_body: \"PROP ?P body h\\<^sub>2 ls\\<^sub>2' sh\\<^sub>2 f h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 (Class D # Ts) D M' 0 No_ics v xa [] ?frs\\<^sub>2\n    ({..<size(compE\\<^sub>2 body)})\" by fact\n  have cond: \"Jcc_cond P\\<^sub>1 (Class D # Ts) D M' [] 0 No_ics {..<length (compE\\<^sub>2 body)} h\\<^sub>2 sh\\<^sub>2 body\"\n    using nsub_RI_Jcc_pieces[OF assms(1) nsub] M'_code M'_xtab by clarsimp\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note 1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> (None,h\\<^sub>3,([v],ls\\<^sub>3,D,M',size(compE\\<^sub>2 body),No_ics)#?frs\\<^sub>2,sh\\<^sub>3)\"\n        using val IH_body Call\\<^sub>1.prems M'_code cond nsub_RI_Jcc_pieces nsub by auto\n      also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h\\<^sub>3, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>3)\"\n        using Call\\<^sub>1.hyps(7) M'_code M'_in_D nclinit by(cases T, auto)\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      with IH_body obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"0 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < size(compE\\<^sub>2 body) \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0)\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>2 sh\\<^sub>3\"\n        using Call\\<^sub>1.prems M'_code M'_xtab cond nsub_RI_Jcc_pieces nsub\n         by (auto simp del:split_paired_Ex)\n      have \"handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>2 sh\\<^sub>3 =\n            handle P C M xa h\\<^sub>3 (rev pvs @ Addr a # vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>3\"\n        using pc\\<^sub>2 M'_in_D nclinit by(auto simp add:handle_def)\n      then show \"?err\" using pc\\<^sub>2 jvm_trans[OF 1 2]\n       by(auto intro!:exI[where x=\"?pc\\<^sub>2\"] exI[where x=\"rev pvs@[Addr a]\"])\n    qed\n  qed\nnext\n  case (CallParamsThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es es' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 pvs ex es'' M')\n  let ?frs\\<^sub>0 = \"(vs, ls\\<^sub>0, C,M,pc,ics)#frs\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs, ls\\<^sub>0, C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(w # vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>M'(es)) =\n    (True, ?frs\\<^sub>0, (None, h\\<^sub>2, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>2), err)\"\n   using CallParamsThrow\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Jcc_pieces_Call1[OF pcs] IH by clarsimp\n  have Isubs: \"{?pc\\<^sub>1..<?pc\\<^sub>2} \\<subseteq> I - pcs (compxE\\<^sub>2 e pc (length vs))\"\n    using CallParamsThrow\\<^sub>1.prems by clarsimp\n  show ?case (is \"?N \\<and> (?eq \\<longrightarrow> ?err)\")\n  proof\n    show ?N by simp\n  next\n    { assume ?eq\n      moreover\n      have \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics pvs xa es'' (w#vs) frs\n        (I - pcs (compxE\\<^sub>2 e pc (length vs)))\" by fact\n      ultimately obtain vs' where \"\\<exists>pc\\<^sub>2.\n        (?pc\\<^sub>1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>1 + size(compEs\\<^sub>2 es) \\<and>\n         \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxEs\\<^sub>2 es ?pc\\<^sub>1 (size vs + 1))) \\<and>\n        P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@w#vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        (is \"\\<exists>pc\\<^sub>2. ?PC pc\\<^sub>2 \\<and> ?Exec pc\\<^sub>2\")\n        using CallParamsThrow\\<^sub>1 Isubs by auto\n      then obtain pc\\<^sub>2 where pc\\<^sub>2: \"?PC pc\\<^sub>2\" and 2: \"?Exec pc\\<^sub>2\" by iprover\n      then have \"?err\" using pc\\<^sub>2 jvm_trans[OF 1 2]\n       by(auto intro!: exI[where x=\"pc\\<^sub>2\"] exI[where x=\"vs'@[w]\"])\n    }\n    thus \"?eq \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (CallNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 M')\n  have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n  hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n  let ?frs\\<^sub>0 = \"(vs, ls\\<^sub>0, C,M,pc,ics)#frs\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  let ?xa = \"addr_of_sys_xcpt NullPointer\"\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>M'(es)) =\n    (True, ?frs\\<^sub>0, (None, h\\<^sub>2, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>2), err)\"\n   using CallNull\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 null h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics Null xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics pvs xa\n                    (map Val pvs) (Null#vs) frs (I - pcs(compxE\\<^sub>2 e pc (size vs)))\" by fact\n  have Isubs: \"{pc + length (compE\\<^sub>2 e)..<pc + length (compE\\<^sub>2 e) + length (compEs\\<^sub>2 es)}\n     \\<subseteq> I - pcs (compxE\\<^sub>2 e pc (length vs))\" using CallNull\\<^sub>1.prems by clarsimp\n  have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(Null#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using Jcc_pieces_Call1[OF pcs] IH by clarsimp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(rev pvs@Null#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n    using CallNull\\<^sub>1 IH_es Isubs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (rev pvs@Null#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using CallNull\\<^sub>1.prems\n    by(auto simp:split_beta handle_def nth_append simp del: split_paired_Ex)\n  finally show ?case by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"rev pvs@[Null]\"])\nnext\n  case (CallObjThrow\\<^sub>1 e h ls sh e' h' ls' sh' M' es)\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (e\\<bullet>M'(es)) =\n    (True, (vs, ls, C,M,pc,ics)#frs,\n       (None, h', (v#vs, ls', C,M,pc+size(compE\\<^sub>2 (e\\<bullet>M'(es))),ics)#frs,sh'), err)\"\n   using CallObjThrow\\<^sub>1.prems(1) by clarsimp\n  obtain a' where throw: \"throw e' = Throw a'\"\n    using eval\\<^sub>1_final[OF CallObjThrow\\<^sub>1.hyps(1)] by clarsimp\n  have IH: \"PROP ?P e h ls sh (throw e') h' ls' sh' E C M pc ics v a' vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  show ?case using IH Jcc_pieces_Call1[OF pcs] throw CallObjThrow\\<^sub>1.prems nsub_RI_Jcc_pieces\n    by auto\nnext\n  case (CallNone\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' fs M')\n  let ?frs\\<^sub>0 = \"(vs, ls\\<^sub>0, C,M,pc,ics)#frs\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,?frs\\<^sub>0,sh\\<^sub>0)\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(Addr a#vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  let ?frs\\<^sub>2 = \"(rev pvs @ Addr a # vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n  let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt NoSuchMethodError\"\n  have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n  hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n  have aux: \"(rev pvs @ Addr a # vs) ! length pvs = Addr a\"\n    by (metis length_rev nth_append_length)\n  have nmeth: \"\\<not>(\\<exists>b Ts T body D. P \\<turnstile> C' sees M', b :  Ts\\<rightarrow>T = body in D)\"\n    using sees_method_compPD CallNone\\<^sub>1.hyps(6) by fastforce\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>M'(es)) =\n    (True, ?frs\\<^sub>0, (None, h\\<^sub>2, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>2), err)\"\n   using CallNone\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics pvs xa\n                    (map Val pvs) (Addr a#vs) frs (I - pcs(compxE\\<^sub>2 e pc (size vs)))\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Jcc_pieces_Call1[OF pcs] IH by clarsimp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es CallNone\\<^sub>1.prems by fastforce\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (rev pvs@Addr a#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using CallNone\\<^sub>1.hyps(5) CallNone\\<^sub>1.prems aux nmeth\n     by(cases \"method P C' M'\", cases \"find_handler P ?xa h\\<^sub>2 frs sh\\<^sub>2\", auto simp: handle_def)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"rev pvs@[Addr a]\"])\nnext\n  case (CallStatic\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' fs M' Ts T body D)\n  let ?frs\\<^sub>0 = \"(vs, ls\\<^sub>0, C,M,pc,ics)#frs\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,?frs\\<^sub>0,sh\\<^sub>0)\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(Addr a#vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  let ?frs\\<^sub>2 = \"(rev pvs @ Addr a # vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n  let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n  let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n  have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n  hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n  have aux: \"(rev pvs @ Addr a # vs) ! length pvs = Addr a\"\n    by (metis length_rev nth_append_length)\n  obtain body' where method: \"P \\<turnstile> C' sees M', Static :  Ts\\<rightarrow>T = body' in D\"\n    by (metis CallStatic\\<^sub>1.hyps(6) P_def compP\\<^sub>2_def sees_method_compP)\n  obtain err where pcs:\n    \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>0 vs ls\\<^sub>0 pc ics frs sh\\<^sub>0 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (e\\<bullet>M'(es)) =\n    (True, ?frs\\<^sub>0, (None, h\\<^sub>2, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>2), err)\"\n   using CallStatic\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es (pc + length (compE\\<^sub>2 e)) (Suc (length vs))))\" by fact\n  have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics pvs xa\n                    (map Val pvs) (Addr a#vs) frs (I - pcs(compxE\\<^sub>2 e pc (size vs)))\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Jcc_pieces_Call1[OF pcs] IH by clarsimp\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es CallStatic\\<^sub>1.prems by fastforce\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (rev pvs@Addr a#vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n    using CallStatic\\<^sub>1.hyps(5) CallStatic\\<^sub>1.prems aux method\n     by(cases \"method P C' M'\", cases \"find_handler P ?xa h\\<^sub>2 frs sh\\<^sub>2\")\n       (auto simp: handle_def; meson frames_of.cases)\n  finally show ?case using pcs by (auto intro!: exI[where x = ?pc\\<^sub>2] exI[where x=\"rev pvs@[Addr a]\"])\nnext\n  case (SCallParamsThrow\\<^sub>1 es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 pvs ex es'' C' M')\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True then show ?thesis\n      using SCallParamsThrow\\<^sub>1.hyps(1,3) evals\\<^sub>1_cases(1) by fastforce\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs, ls\\<^sub>1, C,M,pc,ics)#frs,sh\\<^sub>1)\"\n    let ?pc\\<^sub>2 = \"pc + length(compEs\\<^sub>2 es)\"\n    have Isubs: \"{pc..<pc + length (compEs\\<^sub>2 es)} \\<subseteq> I\" using SCallParamsThrow\\<^sub>1.prems nclinit by clarsimp\n    show ?thesis (is \"?N \\<and> (?eq \\<longrightarrow> ?err)\")\n    proof\n      show ?N by simp\n    next\n      { assume ?eq\n        moreover\n        have \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M pc ics pvs xa es'' vs frs I\" by fact\n        ultimately have \"\\<exists>pc\\<^sub>2.\n          (pc \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < pc + size(compEs\\<^sub>2 es) \\<and>\n           \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxEs\\<^sub>2 es pc (size vs))) \\<and>\n          (\\<exists>vs'. P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2)\"\n          (is \"\\<exists>pc\\<^sub>2. ?PC pc\\<^sub>2 \\<and> ?Exec pc\\<^sub>2\")\n          using SCallParamsThrow\\<^sub>1 Isubs nclinit by auto\n        then obtain pc\\<^sub>2 where pc\\<^sub>2: \"?PC pc\\<^sub>2\" and 2: \"?Exec pc\\<^sub>2\" by iprover\n        then have \"?err\" using pc\\<^sub>2 2 by(auto intro: exI[where x=\"pc\\<^sub>2\"])\n      }\n      thus \"?eq \\<longrightarrow> ?err\" by iprover\n    qed\n  qed\nnext\n  case (SCallNone\\<^sub>1 es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' M')\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True then show ?thesis using SCallNone\\<^sub>1.hyps(3) SCallNone\\<^sub>1.prems by auto\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs, ls\\<^sub>1, C,M,pc,ics)#frs,sh\\<^sub>1)\"\n    let ?pc\\<^sub>2 = \"pc + length(compEs\\<^sub>2 es)\"\n    let ?frs\\<^sub>2 = \"(rev pvs @ vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n    let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n    let ?xa = \"addr_of_sys_xcpt NoSuchMethodError\"\n    have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n    hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n    have nmeth: \"\\<not>(\\<exists>b Ts T body D. P \\<turnstile> C' sees M', b :  Ts\\<rightarrow>T = body in D)\"\n      using sees_method_compPD SCallNone\\<^sub>1.hyps(3) by fastforce\n    have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M pc ics pvs xa\n                      (map Val pvs) vs frs I\" by fact\n    have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es SCallNone\\<^sub>1.prems nclinit by auto fastforce+\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (rev pvs@vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n      using SCallNone\\<^sub>1.prems nmeth nclinit\n       by(cases \"method P C' M'\", cases \"find_handler P ?xa h\\<^sub>2 frs sh\\<^sub>2\", auto simp: handle_def)\n    finally show ?thesis using nclinit by (auto intro: exI[where x = ?pc\\<^sub>2])\n  qed\nnext\n  case (SCallNonStatic\\<^sub>1 es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' M' Ts T body D)\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True then show ?thesis\n      using SCallNonStatic\\<^sub>1.hyps(3) SCallNonStatic\\<^sub>1.prems sees_method_fun by fastforce\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs, ls\\<^sub>1, C,M,pc,ics)#frs,sh\\<^sub>1)\"\n    let ?pc\\<^sub>2 = \"pc + length(compEs\\<^sub>2 es)\"\n    let ?frs\\<^sub>2 = \"(rev pvs @ vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n    let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n    let ?xa = \"addr_of_sys_xcpt IncompatibleClassChangeError\"\n    have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n    hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n    obtain body' where method: \"P \\<turnstile> C' sees M', NonStatic :  Ts\\<rightarrow>T = body' in D\"\n      by (metis SCallNonStatic\\<^sub>1.hyps(3) P_def compP\\<^sub>2_def sees_method_compP)\n    have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M pc ics pvs xa\n                      (map Val pvs) vs frs I\" by fact\n    have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es SCallNonStatic\\<^sub>1.prems nclinit by auto fastforce+\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M ?xa h\\<^sub>2 (rev pvs@vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>2\"\n      using SCallNonStatic\\<^sub>1.prems method nclinit\n       by(cases \"method P C' M'\", cases \"find_handler P ?xa h\\<^sub>2 frs sh\\<^sub>2\")\n         (auto simp: handle_def; meson frames_of.cases)\n    finally show ?thesis using nclinit by (auto intro: exI[where x = ?pc\\<^sub>2])\n  qed\nnext\n  case (SCallInitThrow\\<^sub>1 es h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 pvs h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' M' Ts T body D a h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2)\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True then show ?thesis using SCallInitThrow\\<^sub>1 by simp\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs, ls\\<^sub>0, C,M,pc,ics)#frs,sh\\<^sub>0)\"\n    let ?pc\\<^sub>1 = \"pc + length(compEs\\<^sub>2 es)\"\n    let ?frs\\<^sub>1 = \"(rev pvs @ vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs\"\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,?frs\\<^sub>1,sh\\<^sub>1)\"\n    let ?frs\\<^sub>1' = \"(rev pvs@vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,Calling D [])#frs\"\n    let ?\\<sigma>\\<^sub>1' = \"(None,h\\<^sub>1,?frs\\<^sub>1',sh\\<^sub>1)\"\n    let ?frs\\<^sub>2 = \"(rev pvs@vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,Called [])#frs\"\n    let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n    have ls: \"ls\\<^sub>1 = ls\\<^sub>2\" by(rule init\\<^sub>1_same_loc[OF SCallInitThrow\\<^sub>1.hyps(6)])\n    have method: \"\\<exists>m'. P \\<turnstile> C' sees M',Static:Ts\\<rightarrow>T = m' in D\" using SCallInitThrow\\<^sub>1.hyps(3)\n      by (metis P_def compP\\<^sub>2_def sees_method_compP)\n    obtain a' where throw: \"throw a = Throw a'\" using eval\\<^sub>1_final[OF SCallInitThrow\\<^sub>1.hyps(6)] by clarsimp\n    have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h\\<^sub>1 sh\\<^sub>1 (INIT D ([D],False) \\<leftarrow> unit))\"\n      using sees_method_is_class'[OF SCallInitThrow\\<^sub>1.hyps(3)] by auto\n    then obtain err' where pcs':\n      \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 (rev pvs@vs) ls\\<^sub>1 ?pc\\<^sub>1 ics frs sh\\<^sub>1 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v xa (INIT D ([D],False) \\<leftarrow> unit)\n      = (True, ?frs\\<^sub>1', (None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2), err')\"\n      using SCallInitThrow\\<^sub>1.prems(1) nclinit by auto\n    have IHI: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw a)\n               h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics v a' (rev pvs@vs) frs I\" by fact\n    have IH_es: \"PROP ?Ps es h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (map Val pvs) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C M pc ics pvs xa\n                      (map Val pvs) vs frs I\" by fact\n    have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using IH_es SCallInitThrow\\<^sub>1.prems nclinit by auto fastforce+\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1'\"\n    proof(cases \"sh\\<^sub>1 D\")\n      case None then show ?thesis using SCallInitThrow\\<^sub>1.hyps(1,3-6) SCallInitThrow\\<^sub>1.prems method\n        by(cases ics) auto\n    next\n      case (Some a)\n      then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n      then show ?thesis using SCallInitThrow\\<^sub>1.hyps(1,3-6) SCallInitThrow\\<^sub>1.prems method Some\n        by(cases ics; case_tac i, auto)\n    qed\n    also obtain vs' where \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M a' h\\<^sub>2 (vs'@rev pvs@vs) ls\\<^sub>1 ?pc\\<^sub>1 ics frs sh\\<^sub>2\"\n      using IHI pcs' throw by auto\n    finally show ?thesis using nclinit throw ls\n     by(auto intro!: exI[where x=\"?pc\\<^sub>1\"] exI[where x=\"vs'@rev pvs\"])\n  qed\nnext\n  case (SCallInit\\<^sub>1 es h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 pvs h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C' M' Ts T body D v' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 ls\\<^sub>2' e' h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3)\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True then show ?thesis using SCallInit\\<^sub>1 by simp\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs, ls\\<^sub>0, C,M,pc,ics)#frs,sh\\<^sub>0)\"\n    let ?pc\\<^sub>1 = \"pc + length(compEs\\<^sub>2 es)\"\n    let ?frs\\<^sub>1 = \"(rev pvs @ vs, ls\\<^sub>1, C,M,?pc\\<^sub>1,ics)#frs\"\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,?frs\\<^sub>1,sh\\<^sub>1)\"\n    let ?frs\\<^sub>1' = \"(rev pvs@vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,Calling D [])#frs\"\n    let ?\\<sigma>\\<^sub>1' = \"(None,h\\<^sub>1,?frs\\<^sub>1',sh\\<^sub>1)\"\n    let ?frs\\<^sub>2 = \"(rev pvs@vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,Called [])#frs\"\n    let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n    let ?frs\\<^sub>2' = \"([], ls\\<^sub>2', D,M',0,No_ics) # ?frs\\<^sub>1\"\n    let ?\\<sigma>\\<^sub>2' = \"(None, h\\<^sub>2, ?frs\\<^sub>2', sh\\<^sub>2)\"\n    have nclinit': \"M' \\<noteq> clinit\" by fact\n    have ics: \"ics = No_ics\" using SCallInit\\<^sub>1.hyps(5) SCallInit\\<^sub>1.prems by simp\n    have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>0, ls\\<^sub>0, sh\\<^sub>0)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle>\" by fact\n    hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n    have invoke: \"P,C,M,?pc\\<^sub>1 \\<triangleright> Invokestatic C' M' (length Ts)\"\n      using SCallInit\\<^sub>1.hyps(8) SCallInit\\<^sub>1.prems nclinit by(auto simp: add.assoc)\n    have nsub: \"\\<not> sub_RI body\" by(rule sees_wf\\<^sub>1_nsub_RI[OF wf SCallInit\\<^sub>1.hyps(3)])\n    have ls: \"ls\\<^sub>1 = ls\\<^sub>2\" by(rule init\\<^sub>1_same_loc[OF SCallInit\\<^sub>1.hyps(6)])\n    obtain sfs i where sh\\<^sub>2: \"sh\\<^sub>2 D = Some(sfs,i)\"\n      using init\\<^sub>1_Val_PD[OF SCallInit\\<^sub>1.hyps(6)] by clarsimp\n    have method: \"\\<exists>m'. P \\<turnstile> C' sees M',Static:Ts\\<rightarrow>T = m' in D\" using SCallInit\\<^sub>1.hyps(3)\n      by (metis P_def compP\\<^sub>2_def sees_method_compP)\n    have \"Ex (WTrt2\\<^sub>1 P\\<^sub>1 E h\\<^sub>1 sh\\<^sub>1 (INIT D ([D],False) \\<leftarrow> unit))\"\n      using sees_method_is_class'[OF SCallInit\\<^sub>1.hyps(3)] by auto\n    then obtain err' where pcs':\n      \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 (rev pvs@vs) ls\\<^sub>1 ?pc\\<^sub>1 ics frs sh\\<^sub>1 I h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 v' xa (INIT D ([D],False) \\<leftarrow> unit)\n      = (True, ?frs\\<^sub>1', (None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2), err')\"\n      using SCallInit\\<^sub>1.prems(1) nclinit by auto\n    have IHI: \"PROP ?P (INIT D ([D],False) \\<leftarrow> unit) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val v')\n               h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1 ics v' xa (rev pvs@vs) frs I\" by fact\n    have IH_es: \"PROP ?Ps es h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (map Val pvs) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 C M pc ics pvs xa\n                      (map Val pvs) vs frs I\" by fact\n    have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using IH_es SCallInit\\<^sub>1.prems nclinit by auto fastforce+\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1'\"\n    proof(cases \"sh\\<^sub>1 D\")\n      case None then show ?thesis using SCallInit\\<^sub>1.hyps(1,3-6,8-10) SCallInit\\<^sub>1.prems method\n        by(cases ics) auto\n    next\n      case (Some a)\n      then obtain sfs i where \"a = (sfs,i)\" by(cases a)\n      then show ?thesis using SCallInit\\<^sub>1.hyps(1,3-6,8-10) SCallInit\\<^sub>1.prems method Some\n        by(cases ics; case_tac i, auto)\n    qed\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IHI pcs' by auto\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\"\n      using jvm_Invokestatic_Called[OF assms(1) invoke _ SCallInit\\<^sub>1.hyps(3,8,9)] sh\\<^sub>2 ics by auto\n    finally have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\".\n    have \"P\\<^sub>1 \\<turnstile> C' sees M',Static: Ts\\<rightarrow>T = body in D\" by fact\n    then have M'_in_D: \"P\\<^sub>1 \\<turnstile> D sees M',Static: Ts\\<rightarrow>T = body in D\"\n      by(rule sees_method_idemp) \n    have M'_code: \"compP\\<^sub>2 P\\<^sub>1,D,M',0 \\<rhd> compE\\<^sub>2 body @ [Return]\" using beforeM M'_in_D by simp\n    have M'_xtab: \"compP\\<^sub>2 P\\<^sub>1,D,M' \\<rhd> compxE\\<^sub>2 body 0 0/{..<size(compE\\<^sub>2 body)},0\"\n      using M'_in_D by(rule beforexM)\n    have IH_body: \"PROP ?P body h\\<^sub>2 ls\\<^sub>2' sh\\<^sub>2 e' h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 (Class D # Ts) D M' 0 No_ics v xa [] ?frs\\<^sub>1\n      ({..<size(compE\\<^sub>2 body)})\" by fact\n    have cond: \"Jcc_cond P\\<^sub>1 (Class D # Ts) D M' [] 0 No_ics {..<length (compE\\<^sub>2 body)} h\\<^sub>2 sh\\<^sub>2 body\"\n      using nsub_RI_Jcc_pieces[OF assms(1) nsub] M'_code M'_xtab by clarsimp\n    show ?thesis (is \"?Norm \\<and> ?Err\")\n    proof\n      show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n      proof\n        assume val: ?val\n        note 1\n        also have \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> (None,h\\<^sub>3,([v],ls\\<^sub>3,D,M',size(compE\\<^sub>2 body),No_ics)#?frs\\<^sub>1,sh\\<^sub>3)\"\n          using val IH_body SCallInit\\<^sub>1.prems M'_code cond nsub_RI_Jcc_pieces nsub by auto\n        also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h\\<^sub>3, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>1+1,ics)#frs,sh\\<^sub>3)\"\n          using SCallInit\\<^sub>1.hyps(8) M'_code M'_in_D ls nclinit' by(cases T, auto)\n        finally show ?trans using nclinit by(auto simp:add.assoc)\n      qed\n    next\n      show ?Err (is \"?throw \\<longrightarrow> ?err\")\n      proof\n        assume throw: ?throw\n        with IH_body obtain pc\\<^sub>2 vs' where\n          pc\\<^sub>2: \"0 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < size(compE\\<^sub>2 body) \\<and>\n                \\<not> caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0)\" and\n          2: \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>1 sh\\<^sub>3\"\n          using SCallInit\\<^sub>1.prems M'_code M'_xtab cond nsub_RI_Jcc_pieces nsub\n           by (auto simp del:split_paired_Ex)\n        have \"handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>1 sh\\<^sub>3 =\n              handle P C M xa h\\<^sub>3 (rev pvs @ vs) ls\\<^sub>2 ?pc\\<^sub>1 ics frs sh\\<^sub>3\"\n          using pc\\<^sub>2 M'_in_D ls nclinit' by(auto simp add:handle_def)\n        then show \"?err\" using pc\\<^sub>2 jvm_trans[OF 1 2] nclinit\n         by(auto intro!:exI[where x=\"?pc\\<^sub>1\"] exI[where x=\"rev pvs\"])\n      qed\n    qed\n  qed\nnext\n  case (SCall\\<^sub>1 es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 pvs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C' M' Ts T body D sfs ls\\<^sub>2' e' h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3)\n  show ?case\n  proof(cases \"M' = clinit \\<and> es = []\")\n    case clinit: True\n    then have s1: \"pvs = []\" \"h\\<^sub>1 = h\\<^sub>2\" \"ls\\<^sub>1 = ls\\<^sub>2\" \"sh\\<^sub>1 = sh\\<^sub>2\"\n      using SCall\\<^sub>1.hyps(1) evals\\<^sub>1_cases(1) by blast+\n    then have ls\\<^sub>2': \"ls\\<^sub>2' = replicate (max_vars body) undefined\" using SCall\\<^sub>1.hyps(6) clinit by simp\n    let ?frs = \"create_init_frame P C' # (vs, ls\\<^sub>1, C,M,pc,ics)#frs\"\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,?frs,sh\\<^sub>1)\"\n    have method: \"P\\<^sub>1 \\<turnstile> C' sees clinit,Static: []\\<rightarrow>Void = body in C'\"\n      using SCall\\<^sub>1.hyps(3) clinit s1(1) wf_sees_clinit[OF wf]\n        by (metis is_class_def option.collapse sees_method_fun sees_method_is_class)\n    then have M_code: \"compP\\<^sub>2 P\\<^sub>1,C',clinit,0 \\<rhd> compE\\<^sub>2 body @ [Return]\" by(rule beforeM)\n    have pcs: \"Jcc_pieces P\\<^sub>1 E C M h\\<^sub>1 vs ls\\<^sub>1 pc ics frs sh\\<^sub>1 I h\\<^sub>3 ls\\<^sub>2 sh\\<^sub>3 v xa (C'\\<bullet>\\<^sub>sclinit([]))\n         = (True, ?frs, (None, h\\<^sub>3, tl ?frs, sh\\<^sub>3(C'\\<mapsto>(fst(the(sh\\<^sub>3 C')),Done))),\n        P \\<turnstile> (None, h\\<^sub>1, ?frs, sh\\<^sub>1) -jvm\\<rightarrow>\n        (case ics of\n     Called Cs \\<Rightarrow> (None, h\\<^sub>3, (vs, ls\\<^sub>1, C, M, pc, Throwing Cs xa) # frs, sh\\<^sub>3(C' \\<mapsto> (fst (the (sh\\<^sub>3 C')), Error)))))\"\n      using Jcc_pieces_clinit[OF assms(1),of E C M vs pc ics I h\\<^sub>1 sh\\<^sub>1 C' ls\\<^sub>1 frs h\\<^sub>3 ls\\<^sub>2 sh\\<^sub>3 v xa]\n         SCall\\<^sub>1.prems(1) clinit s1(1) by clarsimp\n    have IH_body: \"PROP ?P body h\\<^sub>2 ls\\<^sub>2' sh\\<^sub>2 e' h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 [] C' clinit 0 No_ics v xa [] (tl ?frs)\n     ({..<size(compE\\<^sub>2 body)})\" by fact\n    show ?thesis (is \"?Norm \\<and> ?Err\")\n    proof\n      show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n      proof\n        assume val: ?val\n        then have \"P \\<turnstile> ?\\<sigma>\\<^sub>1\n           -jvm\\<rightarrow> (None, h\\<^sub>3, ([v], ls\\<^sub>3, C', clinit, size(compE\\<^sub>2 body), No_ics) # tl ?frs,sh\\<^sub>3)\"\n          using IH_body Jcc_pieces_SCall_clinit_body[OF assms(1) wf pcs method] s1 ls\\<^sub>2' by clarsimp\n        also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h\\<^sub>3, tl ?frs, sh\\<^sub>3(C'\\<mapsto>(fst(the(sh\\<^sub>3 C')),Done)))\"\n          using jvm_Return_Init[OF M_code] by simp\n        finally show ?trans using pcs s1 clinit by simp\n      qed\n    next\n      show ?Err (is \"?throw \\<longrightarrow> ?err\")\n      proof\n        assume throw: ?throw\n        with IH_body obtain pc\\<^sub>2 vs2 where\n          pc\\<^sub>2: \"0 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < size(compE\\<^sub>2 body) \\<and>\n                \\<not> caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0)\" and\n          2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C' clinit xa h\\<^sub>3 vs2 ls\\<^sub>3 pc\\<^sub>2 No_ics (tl ?frs) sh\\<^sub>3\"\n          using SCall\\<^sub>1.prems Jcc_pieces_SCall_clinit_body[OF assms(1) wf pcs method] s1 ls\\<^sub>2' by clarsimp\n        show ?err using SCall\\<^sub>1.prems(1) clinit\n        proof(cases ics)\n          case (Called Cs)\n          note 2\n          also have \"handle P C' clinit xa h\\<^sub>3 vs2 ls\\<^sub>3 pc\\<^sub>2 No_ics (tl ?frs) sh\\<^sub>3\n             = (None, h\\<^sub>3, (vs, ls\\<^sub>1, C, M, pc, Throwing (C'#Cs) xa) # frs, sh\\<^sub>3)\"\n            using Called pc\\<^sub>2 method by(simp add: handle_def)\n          also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h\\<^sub>3, (vs, ls\\<^sub>1, C, M, pc, Throwing Cs xa) # frs,\n             sh\\<^sub>3(C' \\<mapsto> (fst (the (sh\\<^sub>3 C')), Error)))\" using Called jvm_Throwing by simp\n          finally show ?thesis using pcs clinit Called by(clarsimp intro!: exI[where x=\"[]\"])\n        qed(auto)\n      qed\n    qed\n  next\n    case nclinit: False\n    let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs, ls\\<^sub>1, C,M,pc,ics)#frs,sh\\<^sub>1)\"\n    let ?pc\\<^sub>2 = \"pc + length(compEs\\<^sub>2 es)\"\n    let ?frs\\<^sub>2 = \"(rev pvs @ vs, ls\\<^sub>2, C,M,?pc\\<^sub>2,ics)#frs\"\n    let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,?frs\\<^sub>2,sh\\<^sub>2)\"\n    let ?frs\\<^sub>2' = \"([], ls\\<^sub>2', D,M',0,No_ics) # ?frs\\<^sub>2\"\n    let ?\\<sigma>\\<^sub>2' = \"(None, h\\<^sub>2, ?frs\\<^sub>2', sh\\<^sub>2)\"\n    have nclinit': \"M' \\<noteq> clinit\"\n     using wf_sees_clinit1[OF wf] visible_method_exists[OF SCall\\<^sub>1.hyps(3)]\n       sees_method_idemp[OF SCall\\<^sub>1.hyps(3)] nclinit SCall\\<^sub>1.hyps(5)\n       evals\\<^sub>1_preserves_elen[OF SCall\\<^sub>1.hyps(1)] by fastforce\n    have \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>es,(h\\<^sub>1, ls\\<^sub>1, sh\\<^sub>1)\\<rangle> [\\<Rightarrow>] \\<langle>map Val pvs,(h\\<^sub>2, ls\\<^sub>2, sh\\<^sub>2)\\<rangle>\" by fact\n    hence [simp]: \"length es = length pvs\" by(auto dest:evals\\<^sub>1_preserves_elen)\n    have invoke: \"P,C,M,?pc\\<^sub>2 \\<triangleright> Invokestatic C' M' (length Ts)\"\n      using SCall\\<^sub>1.hyps(5) SCall\\<^sub>1.prems nclinit by(auto simp: add.assoc)\n    have nsub: \"\\<not> sub_RI body\" by(rule sees_wf\\<^sub>1_nsub_RI[OF wf SCall\\<^sub>1.hyps(3)])\n    have IH_es: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (map Val pvs) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M pc ics pvs xa\n                      (map Val pvs) vs frs I\" by fact\n    have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using IH_es SCall\\<^sub>1.prems nclinit by auto fastforce+\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\" using jvm_Invokestatic[OF assms(1) invoke _ SCall\\<^sub>1.hyps(3,5,6)]\n         SCall\\<^sub>1.hyps(4) SCall\\<^sub>1.prems nclinit by auto\n    finally have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2'\".\n    have \"P\\<^sub>1 \\<turnstile> C' sees M',Static: Ts\\<rightarrow>T = body in D\" by fact\n    then have M'_in_D: \"P\\<^sub>1 \\<turnstile> D sees M',Static: Ts\\<rightarrow>T = body in D\"\n      by(rule sees_method_idemp) \n    have M'_code: \"compP\\<^sub>2 P\\<^sub>1,D,M',0 \\<rhd> compE\\<^sub>2 body @ [Return]\" using beforeM M'_in_D by simp\n    have M'_xtab: \"compP\\<^sub>2 P\\<^sub>1,D,M' \\<rhd> compxE\\<^sub>2 body 0 0/{..<size(compE\\<^sub>2 body)},0\"\n      using M'_in_D by(rule beforexM)\n    have IH_body: \"PROP ?P body h\\<^sub>2 ls\\<^sub>2' sh\\<^sub>2 e' h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 (Class D # Ts) D M' 0 No_ics v xa [] ?frs\\<^sub>2\n      ({..<size(compE\\<^sub>2 body)})\" by fact\n    have cond: \"Jcc_cond P\\<^sub>1 (Class D # Ts) D M' [] 0 No_ics {..<length (compE\\<^sub>2 body)} h\\<^sub>2 sh\\<^sub>2 body\"\n      using nsub_RI_Jcc_pieces[OF assms(1) nsub] M'_code M'_xtab by clarsimp\n    show ?thesis (is \"?Norm \\<and> ?Err\")\n    proof\n      show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n      proof\n        assume val: ?val\n        note 1\n        also have \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> (None,h\\<^sub>3,([v],ls\\<^sub>3,D,M',size(compE\\<^sub>2 body),No_ics)#?frs\\<^sub>2,sh\\<^sub>3)\"\n          using val IH_body SCall\\<^sub>1.prems M'_code cond nsub_RI_Jcc_pieces nsub by auto\n        also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None, h\\<^sub>3, (v#vs, ls\\<^sub>2, C,M,?pc\\<^sub>2+1,ics)#frs,sh\\<^sub>3)\"\n          using SCall\\<^sub>1.hyps(5) M'_code M'_in_D nclinit' by(cases T, auto)\n        finally show ?trans using nclinit by(auto simp:add.assoc)\n      qed\n    next\n      show ?Err (is \"?throw \\<longrightarrow> ?err\")\n      proof\n        assume throw: ?throw\n        with IH_body obtain pc\\<^sub>2 vs' where\n          pc\\<^sub>2: \"0 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < size(compE\\<^sub>2 body) \\<and>\n                \\<not> caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 body 0 0)\" and\n          2: \"P \\<turnstile> ?\\<sigma>\\<^sub>2' -jvm\\<rightarrow> handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>2 sh\\<^sub>3\"\n          using SCall\\<^sub>1.prems M'_code M'_xtab cond nsub_RI_Jcc_pieces nsub\n           by (auto simp del:split_paired_Ex)\n        have \"handle P D M' xa h\\<^sub>3 vs' ls\\<^sub>3 pc\\<^sub>2 No_ics ?frs\\<^sub>2 sh\\<^sub>3 =\n              handle P C M xa h\\<^sub>3 (rev pvs @ vs) ls\\<^sub>2 ?pc\\<^sub>2 ics frs sh\\<^sub>3\"\n          using pc\\<^sub>2 M'_in_D nclinit' by(auto simp add:handle_def)\n        then show \"?err\" using pc\\<^sub>2 jvm_trans[OF 1 2] nclinit by(auto intro:exI[where x=\"?pc\\<^sub>2\"])\n      qed\n    qed\n  qed\nnext\n  case Block\\<^sub>1 then show ?case using nsub_RI_Jcc_pieces by auto\nnext\n  case (Seq\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 w h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>1+1,ics)#frs,sh\\<^sub>1)\"\n  let ?I = \"I - pcs (compxE\\<^sub>2 e\\<^sub>2 (Suc ?pc\\<^sub>1) (length vs))\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)} \\<subseteq> ?I\" using Seq\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val w) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics w xa vs frs ?I\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,(w#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using Seq\\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Seq\\<^sub>1 by auto\n  finally have eval\\<^sub>1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\".\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?I' = \"I - pcs(compxE\\<^sub>2 e\\<^sub>1 pc (size vs))\"\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M (?pc\\<^sub>1+1) ics v xa vs frs\n                     ?I'\" by fact\n  have Isub2: \"{Suc (pc + length (compE\\<^sub>2 e\\<^sub>1))..<Suc (pc + length (compE\\<^sub>2 e\\<^sub>1) + length (compE\\<^sub>2 e\\<^sub>2))}\n     \\<subseteq> ?I'\" using Seq\\<^sub>1.prems by clarsimp\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note eval\\<^sub>1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n        using val Seq\\<^sub>1.prems nsub_RI_Jcc_pieces IH\\<^sub>2 Isub2 by auto\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      then obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1+1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>2 \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 (?pc\\<^sub>1+1) (size vs))\" and\n        eval\\<^sub>2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using IH\\<^sub>2 Seq\\<^sub>1.prems nsub_RI_Jcc_pieces Isub2 by auto\n      show \"?err\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by(auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (SeqThrow\\<^sub>1 e\\<^sub>0 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 e h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>1)\n  let ?I = \"I - pcs (compxE\\<^sub>2 e\\<^sub>1 (Suc (pc + length (compE\\<^sub>2 e\\<^sub>0))) (length vs))\"\n  obtain a' where throw: \"throw e = Throw a'\" using eval\\<^sub>1_final[OF SeqThrow\\<^sub>1.hyps(1)] by clarsimp\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e\\<^sub>0)} \\<subseteq> ?I\" using SeqThrow\\<^sub>1.prems by clarsimp\n  have \"PROP ?P e\\<^sub>0 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw e) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v a' vs frs ?I\" by fact\n  then show ?case using SeqThrow\\<^sub>1.prems throw nsub_RI_Jcc_pieces Isub by auto\nnext\n  case (CondT\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>1 e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 e\\<^sub>2)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>1+1,ics)#frs,sh\\<^sub>1)\"\n  let ?d = \"size vs\"\n  let ?xt\\<^sub>1 = \"compxE\\<^sub>2 e\\<^sub>1 (pc+size(compE\\<^sub>2 e)+1) ?d\"\n  let ?xt\\<^sub>2 = \"compxE\\<^sub>2 e\\<^sub>2 (pc+size(compE\\<^sub>2 e)+size(compE\\<^sub>2 e\\<^sub>1)+2) ?d\"\n  let ?I = \"I - (pcs ?xt\\<^sub>1 \\<union> pcs ?xt\\<^sub>2)\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> ?I\" using CondT\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 true h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Bool True) xa vs frs ?I\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,(Bool(True)#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using CondT\\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by(auto simp: Int_Un_distrib)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using CondT\\<^sub>1 by auto\n  finally have eval\\<^sub>1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\".\n  let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>2' = \"?pc\\<^sub>1' + 1 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?I' = \"I - pcs(compxE\\<^sub>2 e pc ?d) - pcs(compxE\\<^sub>2 e\\<^sub>2 (?pc\\<^sub>1'+1) ?d)\"\n  have IH2: \"PROP ?P e\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M (?pc\\<^sub>1+1) ics v xa vs frs ?I'\" by fact\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note eval\\<^sub>1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>1',ics)#frs,sh\\<^sub>2)\"\n        using val CondT\\<^sub>1.prems nsub_RI_Jcc_pieces IH2 by(fastforce simp:Int_Un_distrib)\n      also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2',ics)#frs,sh\\<^sub>2)\"\n        using CondT\\<^sub>1 nsub_RI_Jcc_pieces by(auto simp:add.assoc)\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      moreover\n      note IH2\n      ultimately obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1+1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>1' \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>1 (?pc\\<^sub>1+1) (size vs))\" and\n        eval\\<^sub>2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using CondT\\<^sub>1.prems nsub_RI_Jcc_pieces by (fastforce simp:Int_Un_distrib)\n      show \"?err\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by(auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (CondF\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2 e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 e\\<^sub>1)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 e\\<^sub>1)+ 1\"\n  let ?pc\\<^sub>2' = \"?pc\\<^sub>2 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>1)\"\n  let ?d = \"size vs\"\n  let ?xt\\<^sub>1 = \"compxE\\<^sub>2 e\\<^sub>1 (pc+size(compE\\<^sub>2 e)+1) ?d\"\n  let ?xt\\<^sub>2 = \"compxE\\<^sub>2 e\\<^sub>2 (pc+size(compE\\<^sub>2 e)+size(compE\\<^sub>2 e\\<^sub>1)+2) ?d\"\n  let ?I = \"I - (pcs ?xt\\<^sub>1 \\<union> pcs ?xt\\<^sub>2)\"\n  let ?I' = \"I - pcs(compxE\\<^sub>2 e pc ?d) - pcs(compxE\\<^sub>2 e\\<^sub>1 (?pc\\<^sub>1+1) ?d)\"\n  have pcs: \"pcs(compxE\\<^sub>2 e pc ?d) \\<inter> pcs(?xt\\<^sub>1 @ ?xt\\<^sub>2) = {}\"\n    using CondF\\<^sub>1.prems by (simp add:Int_Un_distrib)\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> ?I\" using CondF\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 false h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Bool False) xa vs frs ?I\" by fact\n  have IH2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>2 ics v xa vs frs ?I'\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,(Bool(False)#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using CondF\\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub pcs by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using CondF\\<^sub>1 by auto\n  finally have eval\\<^sub>1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\".\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note eval\\<^sub>1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2',ics)#frs,sh\\<^sub>2)\"\n        using val CondF\\<^sub>1.prems nsub_RI_Jcc_pieces IH2 by(fastforce simp:Int_Un_distrib)\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      let ?I' = \"I - pcs(compxE\\<^sub>2 e pc ?d) - pcs(compxE\\<^sub>2 e\\<^sub>1 (?pc\\<^sub>1+1) ?d)\"\n      assume throw: ?throw\n      then obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>2 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>2' \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>2 ?d)\" and\n        eval\\<^sub>2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using CondF\\<^sub>1.prems nsub_RI_Jcc_pieces IH2 by(fastforce simp:Int_Un_distrib)\n      show \"?err\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by(auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (CondThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 f h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>1 e\\<^sub>2)\n  let ?d = \"size vs\"\n  let ?xt\\<^sub>1 = \"compxE\\<^sub>2 e\\<^sub>1 (pc+size(compE\\<^sub>2 e)+1) ?d\"\n  let ?xt\\<^sub>2 = \"compxE\\<^sub>2 e\\<^sub>2 (pc+size(compE\\<^sub>2 e)+size(compE\\<^sub>2 e\\<^sub>1)+2) ?d\"\n  let ?I = \"I - (pcs ?xt\\<^sub>1 \\<union> pcs ?xt\\<^sub>2)\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> ?I\" using CondThrow\\<^sub>1.prems by clarsimp\n  have \"pcs(compxE\\<^sub>2 e pc ?d) \\<inter> pcs(?xt\\<^sub>1 @ ?xt\\<^sub>2) = {}\"\n    using CondThrow\\<^sub>1.prems by (simp add:Int_Un_distrib)\n  moreover have \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (throw f) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v xa vs frs ?I\" by fact\n  ultimately show ?case using CondThrow\\<^sub>1.prems nsub_RI_Jcc_pieces Isub by auto\nnext\n  case (WhileF\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 c)\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?pc' = \"?pc + length(compE\\<^sub>2 c) + 3\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs))\"\n    using WhileF\\<^sub>1.prems by clarsimp\n  have Isub2: \"{Suc (pc + length (compE\\<^sub>2 e))..<Suc (pc + length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c))}\n     \\<subseteq> I - pcs (compxE\\<^sub>2 e pc (length vs))\" using WhileF\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 false h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Bool False) xa vs frs\n    (I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs)))\" by fact\n  have \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n            (None,h\\<^sub>1,(Bool False#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using WhileF\\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc',ics)#frs,sh\\<^sub>1)\"\n    using WhileF\\<^sub>1 by (auto simp:add.assoc)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(Unit#vs,ls\\<^sub>1,C,M,?pc'+1,ics)#frs,sh\\<^sub>1)\"\n    using WhileF\\<^sub>1.prems by (auto simp:eval_nat_numeral)\n  finally show ?case by (simp add:add.assoc eval_nat_numeral)\nnext\n  case (WhileT\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 c v\\<^sub>1 h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 e\\<^sub>3 h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3)\n  let ?pc = \"pc + length(compE\\<^sub>2 e)\"\n  let ?pc' = \"?pc + length(compE\\<^sub>2 c) + 1\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>2 = \"(None,h\\<^sub>2,(vs,ls\\<^sub>2,C,M,pc,ics)#frs,sh\\<^sub>2)\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs))\"\n    using WhileT\\<^sub>1.prems by clarsimp\n  have Isub2: \"{Suc (pc + length (compE\\<^sub>2 e))..<Suc (pc + length (compE\\<^sub>2 e) + length (compE\\<^sub>2 c))}\n     \\<subseteq> I - pcs (compxE\\<^sub>2 e pc (length vs))\" using WhileT\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 true h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Bool True) xa vs frs\n    (I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs)))\" by fact\n  have IH2: \"PROP ?P c h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (Val v\\<^sub>1) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M (Suc ?pc) ics v\\<^sub>1 xa vs frs\n    (I - pcs (compxE\\<^sub>2 e pc (length vs)))\" by fact\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,(Bool True#vs,ls\\<^sub>1,C,M,?pc,ics)#frs,sh\\<^sub>1)\"\n    using WhileT\\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc+1,ics)#frs,sh\\<^sub>1)\"\n    using WhileT\\<^sub>1.prems by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>2,(v\\<^sub>1#vs,ls\\<^sub>2,C,M,?pc',ics)#frs,sh\\<^sub>2)\"\n    using WhileT\\<^sub>1.prems nsub_RI_Jcc_pieces IH2 Isub2 by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\" using WhileT\\<^sub>1.prems by auto\n  finally have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>2\".\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note 1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>2 -jvm\\<rightarrow> (None,h\\<^sub>3,(v#vs,ls\\<^sub>3,C,M,?pc'+3,ics)#frs,sh\\<^sub>3)\"\n        using val WhileT\\<^sub>1 by (auto simp add:add.assoc eval_nat_numeral)\n      finally show ?trans by(simp add:add.assoc eval_nat_numeral)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      moreover\n      have \"PROP ?P (while (e) c) h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 e\\<^sub>3 h\\<^sub>3 ls\\<^sub>3 sh\\<^sub>3 E C M pc ics v xa vs frs I\" by fact\n      ultimately obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"pc \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc'+3 \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>3 xa (compxE\\<^sub>2 (while (e) c) pc (size vs))\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>2 -jvm\\<rightarrow> handle P C M xa h\\<^sub>3 (vs'@vs) ls\\<^sub>3 pc\\<^sub>2 ics frs sh\\<^sub>3\"\n        using WhileT\\<^sub>1.prems by (auto simp:add.assoc eval_nat_numeral)\n      show \"?err\" using pc\\<^sub>2 jvm_trans[OF 1 2] by(auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (WhileCondThrow\\<^sub>1 e h ls sh e' h' ls' sh' c)\n  let ?I = \"I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs))\"\n  obtain a' where throw: \"throw e' = Throw a'\" using eval\\<^sub>1_final[OF WhileCondThrow\\<^sub>1.hyps(1)] by clarsimp\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> ?I\" using WhileCondThrow\\<^sub>1.prems by clarsimp\n  have \"PROP ?P e h ls sh (throw e') h' ls' sh' E C M pc ics v a' vs frs ?I\" by fact\n  then show ?case using WhileCondThrow\\<^sub>1.prems throw nsub_RI_Jcc_pieces Isub by auto\nnext\n  case (WhileBodyThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 c e' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs,ls\\<^sub>1,C,M,?pc\\<^sub>1+1,ics)#frs,sh\\<^sub>1)\"\n  let ?I = \"I - pcs (compxE\\<^sub>2 c (Suc (pc + length (compE\\<^sub>2 e))) (length vs))\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> ?I\"\n    using WhileBodyThrow\\<^sub>1.prems by clarsimp\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 true h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Bool True) xa vs frs ?I\" by fact\n  then have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,(Bool(True)#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using WhileBodyThrow\\<^sub>1.prems nsub_RI_Jcc_pieces Isub by auto\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using  WhileBodyThrow\\<^sub>1 by auto\n  finally have eval\\<^sub>1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\".\n  let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 1 + length(compE\\<^sub>2 c)\"\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm by simp\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      moreover\n      have \"PROP ?P c h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 (throw e') h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M (?pc\\<^sub>1+1) ics v xa vs frs\n                    (I - pcs (compxE\\<^sub>2 e pc (size vs)))\" by fact\n      ultimately obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1+1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>1' \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 c (?pc\\<^sub>1+1) (size vs))\" and\n        eval\\<^sub>2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using WhileBodyThrow\\<^sub>1.prems nsub_RI_Jcc_pieces by (fastforce simp:Int_Un_distrib)\n      show \"?err\" using pc\\<^sub>2 jvm_trans[OF eval\\<^sub>1 eval\\<^sub>2] by(auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (Throw\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1)\n  let ?pc = \"pc + size(compE\\<^sub>2 e)\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using Throw\\<^sub>1.prems by clarsimp\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm by simp\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw:?throw\n      have \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (addr a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics (Addr a) a vs frs I\" by fact\n      then have \"P \\<turnstile> (None, h\\<^sub>0, (vs, ls\\<^sub>0, C, M, pc, ics) # frs, sh\\<^sub>0) -jvm\\<rightarrow>\n                 (None, h\\<^sub>1, (Addr xa#vs, ls\\<^sub>1, C, M, ?pc, ics) # frs, sh\\<^sub>1)\"\n        using Throw\\<^sub>1 nsub_RI_Jcc_pieces Isub throw by auto\n      also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (Addr xa#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n        using Throw\\<^sub>1.prems by(auto simp add:handle_def)\n      finally show \"?err\" by(auto intro!: exI[where x=\"?pc\"] exI[where x=\"[Addr xa]\"])\n    qed\n  qed\nnext\n  case (ThrowNull\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1)\n  let ?pc = \"pc + size(compE\\<^sub>2 e)\"\n  let ?xa = \"addr_of_sys_xcpt NullPointer\"\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using ThrowNull\\<^sub>1.prems by clarsimp\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm by simp\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      have \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 null h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics Null xa vs frs I\" by fact\n      then have \"P \\<turnstile> (None, h\\<^sub>0, (vs, ls\\<^sub>0, C, M, pc, ics) # frs, sh\\<^sub>0) -jvm\\<rightarrow>\n                 (None, h\\<^sub>1, (Null#vs, ls\\<^sub>1, C, M, ?pc, ics) # frs, sh\\<^sub>1)\"\n        using ThrowNull\\<^sub>1.prems nsub_RI_Jcc_pieces Isub by auto\n      also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow>  handle P C M ?xa h\\<^sub>1 (Null#vs) ls\\<^sub>1 ?pc ics frs sh\\<^sub>1\"\n        using ThrowNull\\<^sub>1.prems by(auto simp add:handle_def)\n      finally show \"?err\" using throw by(auto intro!: exI[where x=\"?pc\"] exI[where x=\"[Null]\"])\n    qed\n  qed\nnext\n  case (ThrowThrow\\<^sub>1 e h ls sh e' h' ls' sh')\n  obtain a' where throw: \"throw e' = Throw a'\" using eval\\<^sub>1_final[OF ThrowThrow\\<^sub>1.hyps(1)] by clarsimp\n  have Isub: \"{pc..<pc + length (compE\\<^sub>2 e)} \\<subseteq> I\" using ThrowThrow\\<^sub>1.prems by clarsimp\n  have \"PROP ?P e h ls sh (throw e') h' ls' sh' E C M pc ics v a' vs frs I\" by fact\n  then show ?case using ThrowThrow\\<^sub>1.prems throw nsub_RI_Jcc_pieces Isub by auto\nnext\n  case (Try\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 v\\<^sub>1 h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 Ci i e\\<^sub>2)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 2 + length(compE\\<^sub>2 e\\<^sub>2)\"\n  have \"{pc..<pc+size(compE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2))} \\<subseteq> I\" using Try\\<^sub>1.prems by simp\n  also have \"P,C,M \\<rhd> compxE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2) pc (size vs) / I,size vs\"\n    using Try\\<^sub>1.prems by simp\n  ultimately have \"P,C,M \\<rhd> compxE\\<^sub>2 e\\<^sub>1 pc (size vs) / {pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)},size vs\"\n    by(rule beforex_try)\n  hence \"P \\<turnstile> (None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0) -jvm\\<rightarrow>\n             (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n    using Try\\<^sub>1 nsub_RI_Jcc_pieces by auto blast\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h\\<^sub>1,(v\\<^sub>1#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1',ics)#frs,sh\\<^sub>1)\"\n    using Try\\<^sub>1.prems by auto\n  finally show ?case by (auto simp:add.assoc)\nnext\n  case (TryCatch\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 D fs Ci i e\\<^sub>2 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2)\n  let ?e = \"try e\\<^sub>1 catch(Ci i) e\\<^sub>2\"\n  let ?xt = \"compxE\\<^sub>2 ?e pc (size vs)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?ls\\<^sub>1 = \"ls\\<^sub>1[i := Addr a]\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?pc\\<^sub>1' = \"?pc\\<^sub>1 + 2\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(vs,?ls\\<^sub>1,C,M, ?pc\\<^sub>1',ics) # frs,sh\\<^sub>1)\"\n  have I: \"{pc..<pc + length (compE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2))} \\<subseteq> I\"\n   and beforex: \"P,C,M \\<rhd> ?xt/I,size vs\" using TryCatch\\<^sub>1.prems by simp+\n  have \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h\\<^sub>1,((Addr a)#vs,ls\\<^sub>1,C,M, ?pc\\<^sub>1+1,ics) # frs,sh\\<^sub>1)\"\n  proof -\n    have ics: \"ics = No_ics\" using TryCatch\\<^sub>1.prems by auto\n    have \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Throw a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v a vs frs {pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)}\"\n      by fact\n    moreover have \"P,C,M \\<rhd> compxE\\<^sub>2 e\\<^sub>1 pc (size vs)/{pc..<?pc\\<^sub>1},size vs\"\n      using beforex I pcs_subset by(force elim!: beforex_appendD1)\n    ultimately have\n      \"\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < ?pc\\<^sub>1 \\<and>\n             \\<not> caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs)) \\<and>\n             (\\<exists>vs'. P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> handle P C M a h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1)\"\n      using  TryCatch\\<^sub>1.prems nsub_RI_Jcc_pieces by auto\n    then obtain pc\\<^sub>1 vs' where\n      pc\\<^sub>1_in_e\\<^sub>1: \"pc \\<le> pc\\<^sub>1\" \"pc\\<^sub>1 < ?pc\\<^sub>1\" and\n      pc\\<^sub>1_not_caught: \"\\<not> caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs))\" and\n      0: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> handle P C M a h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1\" by iprover\n    from beforex obtain xt\\<^sub>0 xt\\<^sub>1\n      where ex_tab: \"ex_table_of P C M = xt\\<^sub>0 @ ?xt @ xt\\<^sub>1\"\n      and disj: \"pcs xt\\<^sub>0 \\<inter> I = {}\" by(auto simp:beforex_def)\n    have hp: \"h\\<^sub>1 a = Some (D, fs)\" \"P\\<^sub>1 \\<turnstile> D \\<preceq>\\<^sup>* Ci\" by fact+\n    have \"pc\\<^sub>1 \\<notin> pcs xt\\<^sub>0\" using pc\\<^sub>1_in_e\\<^sub>1 I disj by auto\n    with pc\\<^sub>1_in_e\\<^sub>1 pc\\<^sub>1_not_caught hp\n    show ?thesis using ex_tab 0 ics by(simp add:handle_def matches_ex_entry_def)\n  qed\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using TryCatch\\<^sub>1 by auto\n  finally have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" .\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1' + length(compE\\<^sub>2 e\\<^sub>2)\"\n  let ?I\\<^sub>2 = \"{?pc\\<^sub>1' ..< ?pc\\<^sub>2}\"\n  have \"P,C,M \\<rhd> compxE\\<^sub>2 ?e pc (size vs) / I,size vs\" by fact\n  hence beforex\\<^sub>2: \"P,C,M \\<rhd> compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>1' (size vs) / ?I\\<^sub>2, size vs\"\n    using I pcs_subset[of _ ?pc\\<^sub>1'] by(auto elim!:beforex_appendD2)\n  have IH\\<^sub>2: \"PROP ?P e\\<^sub>2 h\\<^sub>1 ?ls\\<^sub>1 sh\\<^sub>1 e\\<^sub>2' h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 E C M ?pc\\<^sub>1' ics v xa vs frs ?I\\<^sub>2\" by fact\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note 1 also have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> (None,h\\<^sub>2,(v#vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n        using val beforex\\<^sub>2 IH\\<^sub>2 TryCatch\\<^sub>1.prems nsub_RI_Jcc_pieces by auto\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> ?err\")\n    proof\n      assume throw: ?throw\n      then obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1+2 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>2 \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxE\\<^sub>2 e\\<^sub>2 ?pc\\<^sub>1' (size vs))\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using IH\\<^sub>2 beforex\\<^sub>2 TryCatch\\<^sub>1.prems nsub_RI_Jcc_pieces by auto\n      show ?err using pc\\<^sub>2 jvm_trans[OF 1 2]\n       by (simp add:match_ex_entry) (auto intro: exI[where x=pc\\<^sub>2])\n    qed\n  qed\nnext\n  case (TryThrow\\<^sub>1 e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 D fs Ci i e\\<^sub>2)\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e\\<^sub>1)\"\n  let ?e = \"try e\\<^sub>1 catch(Ci i) e\\<^sub>2\"\n  let ?xt = \"compxE\\<^sub>2 ?e pc (size vs)\"\n  have I: \"{pc..<pc + length (compE\\<^sub>2 (try e\\<^sub>1 catch(Ci i) e\\<^sub>2))} \\<subseteq> I\"\n   and beforex: \"P,C,M \\<rhd> ?xt/I,size vs\" using TryThrow\\<^sub>1.prems by simp+\n  have \"PROP ?P e\\<^sub>1 h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Throw a) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 E C M pc ics v a vs frs \n   {pc..<pc + length (compE\\<^sub>2 e\\<^sub>1)}\" by fact\n  moreover have \"P,C,M \\<rhd> compxE\\<^sub>2 e\\<^sub>1 pc (size vs)/{pc..<?pc\\<^sub>1},size vs\"\n    using beforex I pcs_subset by(force elim!: beforex_appendD1)\n    ultimately have\n      \"\\<exists>pc\\<^sub>1. pc \\<le> pc\\<^sub>1 \\<and> pc\\<^sub>1 < ?pc\\<^sub>1 \\<and>\n             \\<not> caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs)) \\<and>\n             (\\<exists>vs'. P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> handle P C M a h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1)\"\n      using TryThrow\\<^sub>1.prems nsub_RI_Jcc_pieces by auto\n    then obtain pc\\<^sub>1 vs' where\n      pc\\<^sub>1_in_e\\<^sub>1: \"pc \\<le> pc\\<^sub>1\" \"pc\\<^sub>1 < ?pc\\<^sub>1\" and\n      pc\\<^sub>1_not_caught: \"\\<not> caught P pc\\<^sub>1 h\\<^sub>1 a (compxE\\<^sub>2 e\\<^sub>1 pc (size vs))\" and\n      0: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> handle P C M a h\\<^sub>1 (vs'@vs) ls\\<^sub>1 pc\\<^sub>1 ics frs sh\\<^sub>1\" by iprover\n  show ?case (is \"?N \\<and> (?eq \\<longrightarrow> ?err)\")\n  proof\n    show ?N by simp\n  next\n    { assume ?eq\n      with TryThrow\\<^sub>1 pc\\<^sub>1_in_e\\<^sub>1 pc\\<^sub>1_not_caught 0\n      have \"?err\" by (simp add:match_ex_entry) auto\n    }\n    thus \"?eq \\<longrightarrow> ?err\" by iprover\n  qed\nnext\n  case Nil\\<^sub>1 thus ?case by simp\nnext\n  case (Cons\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 v h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es fs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2)\n  let ?pc\\<^sub>1 = \"pc + length(compE\\<^sub>2 e)\"\n  let ?\\<sigma>\\<^sub>0 = \"(None,h\\<^sub>0,(vs,ls\\<^sub>0,C,M,pc,ics)#frs,sh\\<^sub>0)\"\n  let ?\\<sigma>\\<^sub>1 = \"(None,h\\<^sub>1,(v#vs,ls\\<^sub>1,C,M,?pc\\<^sub>1,ics)#frs,sh\\<^sub>1)\"\n  have IH: \"PROP ?P e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 (Val v) h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 [] C M pc ics v xa vs frs\n    (I - pcs (compxEs\\<^sub>2 es ?pc\\<^sub>1 (Suc (length vs))))\" by fact\n  then have 1: \"P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using Jcc_pieces_Cons[OF _ Cons\\<^sub>1.prems(1-5)] by auto\n  let ?pc\\<^sub>2 = \"?pc\\<^sub>1 + length(compEs\\<^sub>2 es)\"\n  have IHs: \"PROP ?Ps es h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 fs h\\<^sub>2 ls\\<^sub>2 sh\\<^sub>2 C M ?pc\\<^sub>1 ics (tl ws) xa es' (v#vs) frs\n    (I - pcs (compxE\\<^sub>2 e pc (length vs)))\" by fact\n  show ?case (is \"?Norm \\<and> ?Err\")\n  proof\n    show ?Norm (is \"?val \\<longrightarrow> ?trans\")\n    proof\n      assume val: ?val\n      note 1\n      also have \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> (None,h\\<^sub>2,(rev(ws) @ vs,ls\\<^sub>2,C,M,?pc\\<^sub>2,ics)#frs,sh\\<^sub>2)\"\n        using val IHs Cons\\<^sub>1.prems by fastforce\n      finally show ?trans by(simp add:add.assoc)\n    qed\n  next\n    show ?Err (is \"?throw \\<longrightarrow> (\\<exists>pc\\<^sub>2. ?H pc\\<^sub>2)\")\n    proof\n      assume throw: ?throw\n      then obtain pc\\<^sub>2 vs' where\n        pc\\<^sub>2: \"?pc\\<^sub>1 \\<le> pc\\<^sub>2 \\<and> pc\\<^sub>2 < ?pc\\<^sub>2 \\<and>\n              \\<not> caught P pc\\<^sub>2 h\\<^sub>2 xa (compxEs\\<^sub>2 es ?pc\\<^sub>1 (size vs + 1))\" and\n        2: \"P \\<turnstile> ?\\<sigma>\\<^sub>1 -jvm\\<rightarrow> handle P C M xa h\\<^sub>2 (vs'@v#vs) ls\\<^sub>2 pc\\<^sub>2 ics frs sh\\<^sub>2\"\n        using IHs Cons\\<^sub>1.prems by(fastforce simp:Cons_eq_append_conv neq_Nil_conv)\n      have \"?H pc\\<^sub>2\" using Cons\\<^sub>1.prems pc\\<^sub>2 jvm_trans[OF 1 2] by(auto intro!: exI[where x=\"vs'@[v]\"])\n      thus \"\\<exists>pc\\<^sub>2. ?H pc\\<^sub>2\" by iprover\n    qed\n  qed\nnext\n  case (ConsThrow\\<^sub>1 e h\\<^sub>0 ls\\<^sub>0 sh\\<^sub>0 a h\\<^sub>1 ls\\<^sub>1 sh\\<^sub>1 es)\n  then show ?case using Jcc_pieces_Cons[OF _ ConsThrow\\<^sub>1.prems(1-5)]\n    by (fastforce simp:Cons_eq_append_conv)\nnext\n  case InitFinal\\<^sub>1 then show ?case using eval\\<^sub>1_final_same[OF InitFinal\\<^sub>1.hyps(1)] by clarsimp\nnext\n  case (InitNone\\<^sub>1 sh C\\<^sub>0 C' Cs e h l e' h' l' sh')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa\n     (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitNone\\<^sub>1.prems(1) by clarsimp\n  let ?sh = \"(sh(C\\<^sub>0 \\<mapsto> (sblank P\\<^sub>1 C\\<^sub>0, Prepared)))\"\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,frs',?sh)\"\n    using InitNone\\<^sub>1 jvm_InitNone[where P = P] by(cases frs', simp+)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note 1\n      also have \"P \\<turnstile> (None,h,frs',?sh) -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')\"\n        using InitNone\\<^sub>1.hyps(3)[of E] Jcc_pieces_InitNone[OF assms(1) pcs] InitNone\\<^sub>1.prems val\n         by clarsimp\n      finally have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note 1\n      also obtain vs' where \"P \\<turnstile> (None,h,frs',?sh)\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using InitNone\\<^sub>1.hyps(3)[of E] Jcc_pieces_InitNone[OF assms(1) pcs] throw\n         by clarsimp presburger\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitDone\\<^sub>1 sh C\\<^sub>0 sfs C' Cs e h l e' h' l' sh')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa\n     (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitDone\\<^sub>1.prems(1) by clarsimp\n  let ?frs' = \"(calling_to_scalled (hd frs'))#(tl frs')\"\n  have IH: \"PROP ?P (INIT C' (Cs,True) \\<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I\"\n    by fact\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,?frs',sh)\"\n    using InitDone\\<^sub>1 jvm_InitDP[where P = P] by(cases frs', simp+)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note 1\n      also have \"P \\<turnstile> (None,h,?frs',sh) -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')\"\n        using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitDone\\<^sub>1.prems val by clarsimp\n      finally have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note 1\n      also obtain vs' where \"P \\<turnstile> (None,h,?frs',sh)\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitDone\\<^sub>1.prems throw by clarsimp\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitProcessing\\<^sub>1 sh C\\<^sub>0 sfs C' Cs e h l e' h' l' sh')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa\n     (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitProcessing\\<^sub>1.prems(1) by clarsimp\n  let ?frs' = \"(calling_to_scalled (hd frs'))#(tl frs')\"\n  have IH: \"PROP ?P (INIT C' (Cs,True) \\<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I\"\n    by fact\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,?frs',sh)\"\n    using InitProcessing\\<^sub>1 jvm_InitDP[where P = P] by(cases frs', simp+)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note 1\n      also have \"P \\<turnstile> (None,h,?frs',sh) -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')\"\n        using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitProcessing\\<^sub>1.prems val by clarsimp\n      finally have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note 1\n      also obtain vs' where \"P \\<turnstile> (None,h,?frs',sh)\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitProcessing\\<^sub>1.prems throw by clarsimp\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitError\\<^sub>1 sh C\\<^sub>0 sfs Cs e h l e' h' l' sh' C')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa\n     (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitError\\<^sub>1.prems(1) by clarsimp\n  let ?e\\<^sub>0 = \"THROW NoClassDefFoundError\"\n  let ?frs' = \"(calling_to_sthrowing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs')\"\n  have IH: \"PROP ?P (RI (C\\<^sub>0,?e\\<^sub>0) ; Cs \\<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I\" by fact\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\"\n     and tl: \"tl frs' = frs\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,?frs',sh)\"\n  proof(cases frs')\n    case (Cons a list)\n    obtain vs' l' C' M' pc' ics' where a: \"a = (vs',l',C',M',pc',ics')\" by(cases a)\n    then have \"ics' = Calling C\\<^sub>0 Cs\" using Cons ics by simp\n    then show ?thesis\n     using Cons a IH InitError\\<^sub>1.prems jvm_InitError[where P = P] InitError\\<^sub>1.hyps(1) by simp\n  qed(simp)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      then have False using val rinit\\<^sub>1_throw[OF InitError\\<^sub>1.hyps(2)] by blast\n      then have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      let ?frs = \"(calling_to_throwing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs')\"\n      have exec: \"exec (P, (None,h,?frs,sh)) = Some (None,h,?frs',sh)\"\n        using exec_ErrorThrowing[where sh=sh, OF InitError\\<^sub>1.hyps(1)] ics by(cases \"hd frs'\", simp)\n      obtain vs' where 2: \"P \\<turnstile> (None,h,?frs,sh) -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using IH Jcc_pieces_InitError[OF assms(1) pcs InitError\\<^sub>1.hyps(1)] throw by clarsimp\n      have neq: \"(None, h, ?frs, sh) \\<noteq> handle P C M xa h' (vs' @ vs) l pc ics frs sh'\"\n        using tl ics by(cases \"hd frs'\", simp add: handle_frs_tl_neq)\n\n      note 1\n      also have \"P \\<turnstile> (None,h,?frs',sh) -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using exec_1_exec_all_conf[OF exec 2] neq by simp\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitObject\\<^sub>1 sh C\\<^sub>0 sfs sh' C' Cs e h l e' h' l' sh'')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l'\n    (sh(C\\<^sub>0 \\<mapsto> (sfs, Processing))) v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitObject\\<^sub>1.prems(1) by clarsimp\n  let ?frs' = \"(calling_to_called (hd frs'))#(tl frs')\"\n  have IH: \"PROP ?P (INIT C' (C\\<^sub>0#Cs,True) \\<leftarrow> e) h l sh' e' h' l' sh'' E C M pc ics v xa vs frs I\"\n    by fact\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,?frs',sh')\"\n  proof(cases frs')\n    case (Cons a list)\n    obtain vs' l' C' M' pc' ics' where a: \"a = (vs',l',C',M',pc',ics')\" by(cases a)\n    then have \"ics' = Calling C\\<^sub>0 Cs\" using Cons ics by simp\n    then show ?thesis\n     using Cons Nil a IH InitObject\\<^sub>1 jvm_InitObj[where P = P] by simp\n  qed(simp)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note 1\n      also have \"P \\<turnstile> (None,h,?frs',sh') -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh'')\"\n        using IH Jcc_pieces_InitObj[OF assms(1) pcs] InitObject\\<^sub>1 val by simp\n      finally have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note 1\n      also obtain vs' where \"P \\<turnstile> (None,h,?frs',sh')\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh''\"\n        using IH Jcc_pieces_InitObj[OF assms(1) pcs] InitObject\\<^sub>1 throw by clarsimp\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitNonObject\\<^sub>1 sh C\\<^sub>0 sfs D a b sh' C' Cs e h l e' h' l' sh'')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l'\n    (sh(C\\<^sub>0 \\<mapsto> (sfs,Processing))) v xa (INIT C' (C\\<^sub>0 # Cs,False) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitNonObject\\<^sub>1.prems(1) by clarsimp\n  let ?frs' = \"(calling_to_calling (hd frs') D)#(tl frs')\"\n  have cls1: \"is_class P\\<^sub>1 D\" using InitNonObject\\<^sub>1.hyps(2,3) class_wf wf wf_cdecl_supD by blast\n  have cls_aux: \"distinct (C\\<^sub>0#Cs) \\<and> supercls_lst P\\<^sub>1 (C\\<^sub>0#Cs)\" using InitNonObject\\<^sub>1.prems(1) by auto\n  then have cls2: \"D \\<notin> set (C\\<^sub>0 # Cs)\"\n  proof -\n    have \"distinct (D # C\\<^sub>0 # Cs)\"\n      using InitNonObject\\<^sub>1.hyps(2,3) cls_aux wf wf_supercls_distinct_app by blast\n    then show \"D \\<notin> set (C\\<^sub>0 # Cs)\"\n      by (metis distinct.simps(2))\n  qed\n  have cls3: \"\\<forall>C\\<in>set (C\\<^sub>0 # Cs). P\\<^sub>1 \\<turnstile> C \\<preceq>\\<^sup>* D\" using InitNonObject\\<^sub>1.hyps(2,3) cls_aux\n    by (metis r_into_rtrancl rtrancl_into_rtrancl set_ConsD subcls1.subcls1I supercls_lst.simps(1))\n  have IH: \"PROP ?P (INIT C' (D # C\\<^sub>0 # Cs,False) \\<leftarrow> e) h l sh' e' h' l' sh'' E C M pc ics v xa vs frs I\"\n    by fact\n  obtain r where cls: \"class P C\\<^sub>0 = \\<lfloor>(D, r)\\<rfloor>\" using InitNonObject\\<^sub>1.hyps(3)\n    by (metis assms class_compP compP\\<^sub>2_def)\n  obtain ics: \"ics_of(hd frs') = Calling C\\<^sub>0 Cs\"\n     and frs\\<^sub>1: \"frs' \\<noteq> Nil\" using pcs by clarsimp\n  then have 1: \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h,?frs',sh')\"\n  proof(cases frs')\n    case (Cons a list)\n    obtain vs' l' C' M' pc' ics' where a: \"a = (vs',l',C',M',pc',ics')\" by(cases a)\n    then have \"ics' = Calling C\\<^sub>0 Cs\" using Cons ics by simp\n    then show ?thesis\n     using Cons a IH InitNonObject\\<^sub>1 jvm_InitNonObj[OF _ _ cls] by simp\n  qed(simp)\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note 1\n      also have \"P \\<turnstile> (None,h,?frs',sh') -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh'')\"\n        using IH Jcc_pieces_InitNonObj[OF assms(1) cls1 cls2 cls3 pcs] InitNonObject\\<^sub>1 val by simp\n      finally have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note 1\n      also obtain vs' where \"P \\<turnstile> (None,h,?frs',sh')\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh''\"\n        using IH Jcc_pieces_InitNonObj[OF assms(1) cls1 cls2 cls3 pcs] InitNonObject\\<^sub>1 throw by clarsimp\n      finally have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (InitRInit\\<^sub>1 C\\<^sub>0 Cs e h l sh e' h' l' sh' C')\n  then obtain frs' err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa\n     (INIT C' (C\\<^sub>0 # Cs,True) \\<leftarrow> e)\n    = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)\"\n    using InitRInit\\<^sub>1.prems(1) by clarsimp\n  have IH: \"PROP ?P (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I\"\n    by fact\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      have \"P \\<turnstile> (None,h,frs',sh) -jvm\\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')\"\n        using IH Jcc_pieces_InitRInit[OF assms(1,2) pcs] InitRInit\\<^sub>1.prems val by simp\n      then have ?jvm1 using pcs by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      obtain vs' where \"P \\<turnstile> (None,h,frs',sh)\n                     -jvm\\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'\"\n        using IH Jcc_pieces_InitRInit[OF assms(1,2) pcs] InitRInit\\<^sub>1 throw by clarsimp\n      then have ?err using pcs by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (RInit\\<^sub>1 e h l sh v1 h' l' sh' C\\<^sub>0 sfs i sh'' C' Cs e' e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1)\n  let ?frs = \"(vs,l,C,M,pc,Called (C\\<^sub>0#Cs)) # frs\"\n  let ?frs' = \"(vs,l,C,M,pc,Called Cs) # frs\"\n  have clinit: \"e = C\\<^sub>0\\<bullet>\\<^sub>sclinit([])\" using RInit\\<^sub>1\n    by (metis Jcc_cond.simps(2) eval\\<^sub>1_final_same exp.distinct(101) final_def)\n  then obtain err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa\n     (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; Cs \\<leftarrow> e')\n    = (True, ?frs, (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1), err)\"\n    using RInit\\<^sub>1.prems(1) by simp\n  have shC: \"\\<forall>C'\\<in>set Cs. \\<exists>sfs. sh C' = \\<lfloor>(sfs, Processing)\\<rfloor>\" using RInit\\<^sub>1.prems(1) clinit by clarsimp\n  then have shC'': \"\\<forall>C'\\<in>set Cs. \\<exists>sfs. sh'' C' = \\<lfloor>(sfs, Processing)\\<rfloor>\"\n    using clinit\\<^sub>1_proc_pres[OF wf] RInit\\<^sub>1.hyps(1) clinit RInit\\<^sub>1.hyps(4) RInit\\<^sub>1.prems(1)\n      by (auto simp: fun_upd_apply)\n  have loc: \"l = l'\" using clinit\\<^sub>1_loc_pres RInit\\<^sub>1.hyps(1) clinit by simp\n  have IH: \"PROP ?P e h l sh (Val v1) h' l' sh' E C M pc (Called Cs) v1 xa vs (tl ?frs') I\" by fact\n  then have IH':\n   \"PROP ?P (C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) h l sh (Val v1) h' l' sh' E C M pc (Called Cs) v1 xa vs (tl ?frs') I\"\n    using clinit by simp\n  have IH2: \"PROP ?P (INIT C' (Cs,True) \\<leftarrow> e') h' l' sh'' e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 E C M\n    pc ics v xa vs frs I\" by fact\n  have \"P \\<turnstile> (None,h,?frs,sh) -jvm\\<rightarrow> (None,h,create_init_frame P C\\<^sub>0 # ?frs',sh)\" by(rule jvm_Called)\n  also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h',?frs',sh'')\"\n     using IH' Jcc_pieces_RInit_clinit[OF assms(1-2) pcs,of h' l' sh'] RInit\\<^sub>1.hyps(3,4) by simp\n  finally have jvm1: \"P \\<turnstile> (None,h,?frs,sh) -jvm\\<rightarrow> (None,h',?frs',sh'')\" .\n  show ?case (is \"(?e1 \\<longrightarrow> ?jvm1) \\<and> (?e2 \\<longrightarrow> ?err)\")\n  proof(rule conjI)\n    { assume val: ?e1\n      note jvm1\n      also have \"P \\<turnstile> (None,h',?frs',sh'') -jvm\\<rightarrow> (None,h\\<^sub>1,(vs,l,C,M,pc,Called [])#frs,sh\\<^sub>1)\"\n        using IH2 Jcc_pieces_RInit_Init[OF assms(1-2) shC'' pcs,of h'] RInit\\<^sub>1.hyps(5) loc val by auto\n      finally have ?jvm1 using pcs clinit by simp\n    }\n    thus \"?e1 \\<longrightarrow> ?jvm1\" by simp\n  next\n    { assume throw: ?e2\n      note jvm1\n      also obtain vs' where \"P \\<turnstile> (None,h',?frs',sh'')\n                     -jvm\\<rightarrow> handle P C M xa h\\<^sub>1 (vs'@vs) l pc ics frs sh\\<^sub>1\"\n        using IH2 Jcc_pieces_RInit_Init[OF assms(1-2) shC'' pcs,of h'] RInit\\<^sub>1.hyps(5) loc throw by auto\n      finally have ?err using pcs clinit by auto\n    }\n    thus \"?e2 \\<longrightarrow> ?err\" by simp\n  qed\nnext\n  case (RInitInitFail\\<^sub>1 e h l sh a h' l' sh' C\\<^sub>0 sfs i sh'' D Cs e' e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1)\n  let ?frs = \"(vs,l,C,M,pc,Called (C\\<^sub>0#D#Cs)) # frs\"\n  let ?frs' = \"(vs,l,C,M,pc,Called (D#Cs)) # frs\"\n  let \"?frsT\" = \"\\<lambda>xa1. (vs,l,C,M,pc,Throwing (C\\<^sub>0#D#Cs) xa1) # frs\"\n  let \"?frsT'\" = \"\\<lambda>xa1. (vs,l,C,M,pc,Throwing (D#Cs) xa1) # frs\"\n  obtain xa' where xa': \"throw a = Throw xa'\"\n    by (metis RInitInitFail\\<^sub>1.hyps(1) eval\\<^sub>1_final exp.distinct(101) final_def)\n  have e\\<^sub>1: \"e\\<^sub>1 = Throw xa'\" using xa' rinit\\<^sub>1_throw RInitInitFail\\<^sub>1.hyps(5) by simp\n  show ?case\n  proof(cases \"e = C\\<^sub>0\\<bullet>\\<^sub>sclinit([])\")\n    case clinit: True\n    then obtain err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 v xa'\n       (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; D # Cs \\<leftarrow> e')\n      = (True, ?frs, (None, h\\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\\<^sub>1), err)\"\n      using RInitInitFail\\<^sub>1.prems(1) by simp\n    have loc: \"l = l'\" using clinit\\<^sub>1_loc_pres RInitInitFail\\<^sub>1.hyps(1) clinit by simp\n    have IH: \"PROP ?P e h l sh (throw a) h' l' sh' E C M pc (Called (D#Cs)) v xa' vs frs I\"\n     by fact\n    then have IH':\n     \"PROP ?P (C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) h l sh (Throw xa') h' l' sh' E C M pc (Called (D#Cs)) v xa' vs\n       frs I\"  using clinit xa' by simp\n    have IH2: \"PROP ?P (RI (D,throw a) ; Cs \\<leftarrow> e') h' l' sh'' e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 E C M\n      pc ics v xa' vs frs I\" by fact\n    have \"P \\<turnstile> (None,h,?frs,sh) -jvm\\<rightarrow> (None,h,create_init_frame P C\\<^sub>0 # ?frs',sh)\" by(rule jvm_Called)\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h',(vs, l, C, M, pc, Throwing (D#Cs) xa') # frs,sh'')\"\n      using IH' Jcc_pieces_RInit_clinit[OF assms(1-2) pcs,of h' l' sh'] RInitInitFail\\<^sub>1.hyps(3,4)\n        by simp\n    also obtain vs'' where \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M xa' h\\<^sub>1 (vs''@vs) l pc ics frs sh\\<^sub>1\"\n      using IH2 pcs Jcc_pieces_RInit_RInit[OF assms(1) pcs] RInitInitFail\\<^sub>1.hyps(3,4)\n        xa' loc e\\<^sub>1 xa' by clarsimp\n    finally show ?thesis using pcs e\\<^sub>1 clinit by auto\n  next\n    case throw: False\n    then have eT: \"e = Throw xa'\" \"h = h'\" \"l = l'\" \"sh = sh'\" using xa' RInitInitFail\\<^sub>1.prems(1)\n      eval\\<^sub>1_final_same[OF RInitInitFail\\<^sub>1.hyps(1)] by clarsimp+\n    obtain a' where \"class P\\<^sub>1 C\\<^sub>0 = \\<lfloor>a'\\<rfloor>\" using RInitInitFail\\<^sub>1.prems by(auto simp: is_class_def)\n    then obtain stk' loc' M' pc' ics' where \"create_init_frame P C\\<^sub>0 = (stk',loc',C\\<^sub>0,M',pc',ics')\"\n      using create_init_frame_wf_eq[OF wf] by(cases \"create_init_frame P C\\<^sub>0\", simp)\n    then obtain rhs err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh'' v xa'\n       (RI (C\\<^sub>0,e) ; D#Cs \\<leftarrow> e') = (True, ?frsT xa', rhs, err)\"\n      using RInitInitFail\\<^sub>1.prems(1) eT by clarsimp\n    have IH2: \"PROP ?P (RI (D,throw a) ; Cs \\<leftarrow> e') h' l' sh'' e\\<^sub>1 h\\<^sub>1 l\\<^sub>1 sh\\<^sub>1 E C M\n      pc ics v xa' vs frs I\" by fact\n    have \"P \\<turnstile> (None,h,?frsT xa',sh') -jvm\\<rightarrow> (None,h,?frsT' xa',sh'(C\\<^sub>0 \\<mapsto> (fst (the (sh' C\\<^sub>0)), Error)))\"\n      by(rule jvm_Throwing)\n    also obtain vs' where \"P \\<turnstile> ... -jvm\\<rightarrow> handle P C M xa' h\\<^sub>1 (vs'@vs) l pc ics frs sh\\<^sub>1\"\n      using IH2 Jcc_pieces_RInit_RInit[OF assms(1) pcs] RInitInitFail\\<^sub>1.hyps(3,4)\n       eT e\\<^sub>1 xa' by clarsimp\n    finally show ?thesis using pcs e\\<^sub>1 throw eT by auto\n  qed\nnext\n  case (RInitFailFinal\\<^sub>1 e h l sh a h' l' sh' C\\<^sub>0 sfs i sh'' e'')\n  let ?frs = \"(vs,l,C,M,pc,Called [C\\<^sub>0]) # frs\"\n  let ?frs' = \"(vs,l,C,M,pc,Called []) # frs\"\n  let \"?frsT\" = \"\\<lambda>xa1. (vs,l,C,M,pc,Throwing [C\\<^sub>0] xa1) # frs\"\n  let \"?frsT'\" = \"\\<lambda>xa1. (vs,l,C,M,pc,Throwing [] xa1) # frs\"\n  obtain xa' where xa': \"throw a = Throw xa'\"\n    by (metis RInitFailFinal\\<^sub>1.hyps(1) eval\\<^sub>1_final exp.distinct(101) final_def)\n  show ?case\n  proof(cases \"e = C\\<^sub>0\\<bullet>\\<^sub>sclinit([])\")\n    case clinit: True\n    then obtain err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh'' v xa'\n       (RI (C\\<^sub>0,C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) ; [] \\<leftarrow> unit) = (True, ?frs, (None, h', ?frs', sh''), err)\"\n      using RInitFailFinal\\<^sub>1.prems(1) by clarsimp\n    have IH: \"PROP ?P e h l sh (throw a) h' l' sh' E C M pc (Called []) v xa' vs frs I\" by fact\n    then have IH':\n     \"PROP ?P (C\\<^sub>0\\<bullet>\\<^sub>sclinit([])) h l sh (throw a) h' l' sh' E C M pc (Called []) v xa' vs frs I\"\n      using clinit by simp\n    have \"P \\<turnstile> (None,h,?frs,sh) -jvm\\<rightarrow> (None,h,create_init_frame P C\\<^sub>0 # ?frs',sh)\"\n      by(rule jvm_Called)\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> (None,h',?frsT' xa',sh'')\"\n      using IH' Jcc_pieces_RInit_clinit[OF assms(1-2) pcs,of h' l' sh'] xa'\n        RInitFailFinal\\<^sub>1.hyps(3,4) by simp\n    also have\n       \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle (compP compMb\\<^sub>2 P\\<^sub>1) C M xa' h' vs l pc No_ics frs sh''\"\n      using RInitFailFinal\\<^sub>1.hyps(3,4) jvm_RInit_throw[where h=h' and sh=sh''] by simp\n    finally show ?thesis using xa' pcs clinit by(clarsimp intro!: exI[where x=\"[]\"])\n  next\n    case throw: False\n    then have eT: \"e = Throw xa'\" \"h = h'\" \"sh = sh'\" using xa' RInitFailFinal\\<^sub>1.prems(1)\n      eval\\<^sub>1_final_same[OF RInitFailFinal\\<^sub>1.hyps(1)] by clarsimp+\n    obtain a where \"class P\\<^sub>1 C\\<^sub>0 = \\<lfloor>a\\<rfloor>\" using RInitFailFinal\\<^sub>1.prems by(auto simp: is_class_def)\n    then obtain stk' loc' M' pc' ics' where \"create_init_frame P C\\<^sub>0 = (stk',loc',C\\<^sub>0,M',pc',ics')\"\n      using create_init_frame_wf_eq[OF wf] by(cases \"create_init_frame P C\\<^sub>0\", simp)\n    then obtain rhs err where pcs: \"Jcc_pieces P\\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh'' v xa'\n       (RI (C\\<^sub>0,e) ; [] \\<leftarrow> unit) = (True, ?frsT xa', rhs, err)\"\n      using RInitFailFinal\\<^sub>1.prems(1) eT by clarsimp\n    have \"P \\<turnstile> (None,h,?frsT xa',sh) -jvm\\<rightarrow> (None,h,?frsT' xa',sh(C\\<^sub>0 \\<mapsto> (fst (the (sh C\\<^sub>0)), Error)))\"\n      by(rule jvm_Throwing)\n    also have \"P \\<turnstile> \\<dots> -jvm\\<rightarrow> handle P C M xa' h' vs l pc No_ics frs sh''\"\n      using RInitFailFinal\\<^sub>1.hyps(3,4) jvm_RInit_throw[where h=h and sh=sh''] eT by simp\n    finally show ?thesis using pcs xa' by(clarsimp intro!: exI[where x=\"[]\"])\n  qed\nqed\n(*>*)\n\n(*FIXME move! *)\nlemma atLeast0AtMost[simp]: \"{0::nat..n} = {..n}\"\nby auto\n\nlemma atLeast0LessThan[simp]: \"{0::nat..<n} = {..<n}\"\nby auto\n\nfun exception :: \"'a exp \\<Rightarrow> addr option\" where\n  \"exception (Throw a) = Some a\"\n| \"exception e = None\"\n\nlemma comp\\<^sub>2_correct:\nassumes wf: \"wf_J\\<^sub>1_prog P\\<^sub>1\"\n    and \"method\": \"P\\<^sub>1 \\<turnstile> C sees M,b:Ts\\<rightarrow>T = body in C\"\n    and eval:   \"P\\<^sub>1 \\<turnstile>\\<^sub>1 \\<langle>body,(h,ls,sh)\\<rangle> \\<Rightarrow> \\<langle>e',(h',ls',sh')\\<rangle>\"\n    and nclinit: \"M \\<noteq> clinit\"\nshows \"compP\\<^sub>2 P\\<^sub>1 \\<turnstile> (None,h,[([],ls,C,M,0,No_ics)],sh) -jvm\\<rightarrow> (exception e',h',[],sh')\"\n(*<*)\n      (is \"_ \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\")\nproof -\n  let ?P = \"compP\\<^sub>2 P\\<^sub>1\"\n  let ?E = \"case b of Static \\<Rightarrow> Ts | NonStatic \\<Rightarrow> Class C#Ts\"\n  have nsub: \"\\<not>sub_RI body\" using sees_wf\\<^sub>1_nsub_RI[OF wf method] by simp\n  have code: \"?P,C,M,0 \\<rhd> compE\\<^sub>2 body\" using beforeM[OF \"method\"] by auto\n  have xtab: \"?P,C,M \\<rhd> compxE\\<^sub>2 body 0 (size[])/{..<size(compE\\<^sub>2 body)},size[]\"\n    using beforexM[OF \"method\"] by auto\n  have cond: \"Jcc_cond P\\<^sub>1 ?E C M [] 0 No_ics {..<size(compE\\<^sub>2 body)} h sh body\"\n    using nsub_RI_Jcc_pieces nsub code xtab by auto\n  \\<comment> \\<open>Distinguish if e' is a value or an exception\\<close>\n  { fix v assume [simp]: \"e' = Val v\"\n    have \"?P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> (None,h',[([v],ls',C,M,size(compE\\<^sub>2 body),No_ics)],sh')\"\n      using Jcc[OF wf eval cond] nsub_RI_Jcc_pieces[OF _ nsub] by auto\n    also have \"?P \\<turnstile> \\<dots> -jvm\\<rightarrow> ?\\<sigma>\\<^sub>1\" using beforeM[OF \"method\"] nclinit by auto\n    finally have ?thesis .\n  }\n  moreover\n  { fix a assume [simp]: \"e' = Throw a\"\n    obtain pc vs' where pc: \"0 \\<le> pc \\<and> pc < size(compE\\<^sub>2 body) \\<and>\n          \\<not> caught ?P pc h' a (compxE\\<^sub>2 body 0 0)\"\n    and 1: \"?P \\<turnstile> ?\\<sigma>\\<^sub>0 -jvm\\<rightarrow> handle ?P C M a h' vs' ls' pc No_ics [] sh'\"\n      using Jcc[OF wf eval cond] nsub_RI_Jcc_pieces[OF _ nsub] by auto meson\n    from pc have \"handle ?P C M a h' vs' ls' pc No_ics [] sh' = ?\\<sigma>\\<^sub>1\" using xtab \"method\" nclinit\n      by(auto simp:handle_def compMb\\<^sub>2_def)\n    with 1 have ?thesis by simp\n  } \n  ultimately show ?thesis using eval\\<^sub>1_final[OF eval] by(auto simp:final_def)\nqed\n(*>*)\n\nend\n", "meta": {"author": "susannahej", "repo": "jinja-dci", "sha": "0969fa2c5966204b326395763d7a375e7dc6badf", "save_path": "github-repos/isabelle/susannahej-jinja-dci", "path": "github-repos/isabelle/susannahej-jinja-dci/jinja-dci-0969fa2c5966204b326395763d7a375e7dc6badf/Compiler/Correctness2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6584175139669997, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.33178064807238816}}
{"text": "theory SINVAR_NonInterference_impl\nimports SINVAR_NonInterference \"../TopoS_Interface_impl\"\nbegin\n\n\ncode_identifier code_module SINVAR_NonInterference_impl => (Scala) SINVAR_NonInterference\n\n\nsubsubsection \\<open>SecurityInvariant NonInterference List Implementation\\<close>\n\ndefinition undirected_reachable :: \"'v list_graph \\<Rightarrow> 'v => 'v list\" where\n  \"undirected_reachable G v = removeAll v (succ_tran (undirected G) v)\"\n\nlemma undirected_reachable_set: \"set (undirected_reachable G v) = {e2. (v,e2) \\<in> (set (edgesL (undirected G)))\\<^sup>+} - {v}\"\n  by(simp add: undirected_succ_tran_set undirected_nodes_set undirected_reachable_def)\n\nfun sinvar_set :: \"'v list_graph \\<Rightarrow> ('v \\<Rightarrow> node_config) \\<Rightarrow> bool\" where\n  \"sinvar_set G nP = (\\<forall> n \\<in> set (nodesL G). (nP n) = Interfering \\<longrightarrow> set (map nP (undirected_reachable G n)) \\<subseteq> {Unrelated})\"\n\n(* equal: lemma sinvar_list_eq_set*)\nfun sinvar :: \"'v list_graph \\<Rightarrow> ('v \\<Rightarrow> node_config) \\<Rightarrow> bool\" where\n  \"sinvar G nP = (\\<forall> n \\<in> set (nodesL G). (nP n) = Interfering \\<longrightarrow> (let result = remdups (map nP (undirected_reachable G n)) in result = [] \\<or> result = [Unrelated]))\"\n\nlemma \"P = Q \\<Longrightarrow> (\\<forall> x. P x) = (\\<forall> x. Q x)\"\n  by(erule arg_cong)\n\n\nlemma sinvar_eq_help1: \"nP ` set (undirected_reachable G n) = set (map nP (undirected_reachable G n))\"\n  by auto\nlemma sinvar_eq_help2: \"set l = {Unrelated} \\<Longrightarrow> remdups l = [Unrelated]\"\n apply(induction l)\n  apply simp\n apply(simp)\n  apply (metis empty_iff insertI1 set_empty2 subset_singletonD)\n done\nlemma sinvar_eq_help3: \"(let result = remdups (map nP (undirected_reachable G n)) in result = [] \\<or> result = [Unrelated]) = (set (map nP (undirected_reachable G n)) \\<subseteq> {Unrelated})\"\n  apply simp\n  apply(rule iffI)\n   apply(erule disjE)\n    apply simp\n   apply(simp only: set_map[symmetric]) \n   apply(subst set_remdups[symmetric])\n   apply simp\n  apply(case_tac \" nP ` set (undirected_reachable G n) = {}\")\n   apply fast\n  apply(case_tac \" nP ` set (undirected_reachable G n) = {Unrelated}\")\n   defer\n   apply(subgoal_tac \"nP ` set (undirected_reachable G n) \\<subseteq> {Unrelated} \\<Longrightarrow>\n    nP ` set (undirected_reachable G n) \\<noteq> {} \\<Longrightarrow>\n    nP ` set (undirected_reachable G n) \\<noteq> {Unrelated} \\<Longrightarrow> False\")\n    apply fast\n   apply (metis subset_singletonD)\n  apply simp\n  apply(rule disjI2)\n  apply(simp only: sinvar_eq_help1)\n  apply(simp add:sinvar_eq_help2)\n  done\n\nlemma sinvar_list_eq_set: \"sinvar = sinvar_set\"\n  apply(insert sinvar_eq_help3)\n  apply(simp add: fun_eq_iff)\n  apply(rule allI)+\n  apply fastforce\n  done\n\n\n\nvalue \"sinvar \n    \\<lparr> nodesL = [1::nat,2,3,4], edgesL = [(1,2), (2,3), (3,4), (8,9),(9,8)] \\<rparr>\n    (\\<lambda>e. SINVAR_NonInterference.default_node_properties)\"\nvalue \"sinvar \n    \\<lparr> nodesL = [1::nat,2,3,4,8,9,10], edgesL = [(1,2), (2,3), (3,4)] \\<rparr>\n    ((\\<lambda>e. SINVAR_NonInterference.default_node_properties)(1:= Interfering, 2:= Unrelated, 3:= Unrelated, 4:= Unrelated))\"\nvalue \"sinvar \n    \\<lparr> nodesL = [1::nat,2,3,4,5, 8,9,10], edgesL = [(1,2), (2,3), (3,4), (5,4), (8,9),(9,8)] \\<rparr>\n    ((\\<lambda>e. SINVAR_NonInterference.default_node_properties)(1:= Interfering, 2:= Unrelated, 3:= Unrelated, 4:= Unrelated))\"\nvalue \"sinvar \n    \\<lparr> nodesL = [1::nat], edgesL = [(1,1)] \\<rparr>\n    ((\\<lambda>e. SINVAR_NonInterference.default_node_properties)(1:= Interfering))\"\n\nvalue \"(undirected_reachable \\<lparr> nodesL = [1::nat], edgesL = [(1,1)] \\<rparr> 1) = []\" \n  (* apply(simp add: removeAll_def remdups_def undirected_reachable_def succ_tran_def trancl_list_impl_def trancl_impl_def) *)\n\n\n\n\n\ndefinition NonInterference_offending_list:: \"'v list_graph \\<Rightarrow> ('v \\<Rightarrow> node_config) \\<Rightarrow> ('v \\<times> 'v) list list\" where\n  \"NonInterference_offending_list = Generic_offending_list sinvar\"\n\n\n\ndefinition \"NetModel_node_props P = (\\<lambda> i. (case (node_properties P) i of Some property \\<Rightarrow> property | None \\<Rightarrow> SINVAR_NonInterference.default_node_properties))\"\n\n\ndefinition \"NonInterference_eval G P = (wf_list_graph G \\<and>\n  sinvar G (SecurityInvariant.node_props SINVAR_NonInterference.default_node_properties P))\"\n\n\n\nlemma sinvar_correct: \"wf_list_graph G \\<Longrightarrow> SINVAR_NonInterference.sinvar (list_graph_to_graph G) nP = sinvar G nP\"\n   apply(simp add: sinvar_list_eq_set)\n   apply(rule all_nodes_list_I)\n   by (simp add: SINVAR_NonInterference.undirected_reachable_def succ_tran_correct undirected_correct undirected_reachable_def)\n\n\n\ninterpretation NonInterference_impl:TopoS_List_Impl \n  where default_node_properties=SINVAR_NonInterference.default_node_properties\n  and sinvar_spec=SINVAR_NonInterference.sinvar\n  and sinvar_impl=sinvar\n  and receiver_violation=SINVAR_NonInterference.receiver_violation\n  and offending_flows_impl=NonInterference_offending_list\n  and node_props_impl=NetModel_node_props\n  and eval_impl=NonInterference_eval\n apply(unfold TopoS_List_Impl_def)\n apply(rule conjI)\n  apply(rule conjI)\n   apply(simp add: TopoS_NonInterference; fail)\n  apply(intro allI impI)\n  apply(fact sinvar_correct)\n apply(rule conjI)\n  apply(unfold NonInterference_offending_list_def)\n  apply(intro allI impI)\n  apply(rule Generic_offending_list_correct)\n   apply(assumption)\n  apply(simp only: sinvar_correct)\n apply(rule conjI)\n  apply(intro allI)\n  apply(simp only: NetModel_node_props_def)\n  apply(metis NonInterference.node_props.simps NonInterference.node_props_eq_node_props_formaldef)\n apply(simp only: NonInterference_eval_def)\n apply(intro allI impI)\n apply(rule TopoS_eval_impl_proofrule[OF TopoS_NonInterference])\n apply(simp only: sinvar_correct)\ndone\n\nsubsubsection \\<open>NonInterference packing\\<close>\n  definition SINVAR_LIB_NonInterference :: \"('v::vertex, node_config) TopoS_packed\" where\n    \"SINVAR_LIB_NonInterference \\<equiv> \n    \\<lparr> nm_name = ''NonInterference'', \n      nm_receiver_violation = SINVAR_NonInterference.receiver_violation,\n      nm_default = SINVAR_NonInterference.default_node_properties, \n      nm_sinvar = sinvar,\n      nm_offending_flows = NonInterference_offending_list, \n      nm_node_props = NetModel_node_props,\n      nm_eval = NonInterference_eval\n      \\<rparr>\"\n  interpretation SINVAR_LIB_NonInterference_interpretation: TopoS_modelLibrary SINVAR_LIB_NonInterference\n      SINVAR_NonInterference.sinvar\n    apply(unfold TopoS_modelLibrary_def SINVAR_LIB_NonInterference_def)\n    apply(rule conjI)\n     apply(simp)\n    apply(simp)\n    by(unfold_locales)\n\n\n\n\ntext \\<open>Example:\\<close>\ncontext begin\n  private definition \"example_graph = \\<lparr> nodesL = [1::nat,2,3,4,5, 8,9,10], edgesL = [(1,2), (2,3), (3,4), (5,4), (8,9), (9,8)] \\<rparr>\"\n  private definition\"example_conf = ((\\<lambda>e. SINVAR_NonInterference.default_node_properties)\n      (1:= Interfering, 2:= Unrelated, 3:= Unrelated, 4:= Unrelated, 8:= Unrelated, 9:= Unrelated))\"\n  \n  private lemma \"\\<not> sinvar example_graph example_conf\" by eval\n  private lemma \"NonInterference_offending_list example_graph example_conf =\n                     [[(1, 2)], [(2, 3)], [(3, 4)], [(5, 4)]]\" by eval\nend\n\n\nhide_const (open) NetModel_node_props\nhide_const (open) sinvar\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Security_Invariants/SINVAR_NonInterference_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3317806413173664}}
{"text": "section \\<open>Graph Type Class Instantiations\\<close>\n\ntheory\n  IRGraphSort\nimports\n  Graph.IRGraph\nbegin\n\ntext \\<open>\nAn @{typ IRGraph} can be treated as an instantiation of\nvarious type classes such as the equal type class.\n\nHere we define the instantiations for all type classes\nof which @{typ IRGraph} belongs.\n\\<close>\n\n\nsubsection \\<open>Equal Instance\\<close>\ntext \\<open>\nThe following is an incorrect definition of equality\nwhich is used to allow code generation of the Canonicalization\nphase. Without this we have to use the values command to generate\nall possible results of the canonicalization phase.\n\nNote that we should be able to find a correct equality definition\nin terms of the ids, kind, and stamp function. However, we are\nyet to find a satisfactory definition as yet.\n\\<close>\n(* Code generation issues\ndefinition IRGraph_equal :: \"IRGraph \\<Rightarrow> IRGraph \\<Rightarrow> bool\" where\n  \"IRGraph_equal g1 g2 = (as_list g1 = as_list g2)\"\n*)\ndefinition IRGraph_equal :: \"IRGraph \\<Rightarrow> IRGraph \\<Rightarrow> bool\" where\n  \"IRGraph_equal g1 g2 = True\"\n\n(*lemma graph_eq:\n  fixes g1 g2 :: IRGraph\n  shows \"g1 = g2 \\<longleftrightarrow> IRGraph_equal g1 g2\"\n  sorry*)\n\ninstantiation IRGraph :: equal\nbegin\n\ndefinition equal_IRGraph :: \"IRGraph \\<Rightarrow> IRGraph \\<Rightarrow> bool\" where\n  \"equal_IRGraph = IRGraph_equal\"\n\ninstance proof\n  fix g1 g2 :: IRGraph\n  show \"equal_class.equal g1 g2 \\<longleftrightarrow> (g1 = g2)\"\n    apply standard\n    unfolding equal_IRGraph_def IRGraph_equal_def\n    unfolding as_list_def\n    apply transfer\n    sorry\nqed\nend\n\nend", "meta": {"author": "uqcyber", "repo": "veriopt-releases", "sha": "4ffab3c91bbd699772889dbf263bb6d2582256d7", "save_path": "github-repos/isabelle/uqcyber-veriopt-releases", "path": "github-repos/isabelle/uqcyber-veriopt-releases/veriopt-releases-4ffab3c91bbd699772889dbf263bb6d2582256d7/Papers/Validation/IRGraphSort.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6584175005616829, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.33178064131736634}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_T_law_SKIP\nimports CSP_T_law_basic\nbegin\n\n(*****************************************************************\n\n         1. SKIP |[X]| SKIP\n         2. SKIP |[X]| P\n         3. P |[X]| SKIP\n         4. SKIP -- X\n         5. SKIP [[r]]\n         6. SKIP ;; P\n         7. P ;; SKIP\n         8. SKIP |. n\n\n *****************************************************************)\n\n(*********************************************************\n                    SKIP |[X]| SKIP\n *********************************************************)\n\nlemma cspT_Parallel_term:\n   \"SKIP |[X]| SKIP =T[M1,M2] SKIP\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp_all)\ndone\n\n(*********************************************************\n                      SKIP |[X]| P\n *********************************************************)\n\nlemma cspT_Parallel_preterm_l: \n   \"SKIP |[X]| (? :Y -> Qf) =T[M,M] ? x:(Y-X) -> (SKIP |[X]| Qf x)\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (elim disjE conjE exE)\n  apply (simp_all)\n\n  apply (drule_tac x=\"t\" in spec)\n  apply (erule disjE, simp)\n  apply (erule disjE, simp)\n  apply (elim conjE exE, simp)\n  apply (simp add: par_tr_head)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"sa\" in exI, simp)\n\n  apply (drule_tac x=\"t\" in spec)\n  apply (erule disjE, simp)\n  apply (erule disjE, simp)\n  apply (elim conjE exE, simp)\n  apply (simp add: par_tr_head)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (rule_tac x=\"sa\" in exI, simp)\n\n(* <= *)\n\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n  apply (simp_all)\n\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"<Ev a> ^^^ ta\" in exI, simp)\n  apply (simp add: par_tr_head)\n\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (rule_tac x=\"<Ev a> ^^^ ta\" in exI, simp)\n  apply (simp add: par_tr_head)\ndone\n\n(*********************************************************\n                      P |[X]| SKIP\n *********************************************************)\n\nlemma cspT_Parallel_preterm_r: \n   \"(? :Y -> Pf) |[X]| SKIP\n     =T[M,M] ? x:(Y-X) -> (Pf x |[X]| SKIP)\"\napply (rule cspT_trans)\napply (rule cspT_Parallel_commut)\napply (rule cspT_trans)\napply (rule cspT_Parallel_preterm_l)\napply (rule cspT_rm_head, simp)\napply (rule cspT_Parallel_commut)\ndone\n\nlemmas cspT_Parallel_preterm = cspT_Parallel_preterm_l cspT_Parallel_preterm_r\n\n(*********************************************************\n                      SKIP and Parallel\n *********************************************************)\n\n(* p.288 *)\n\nlemma cspT_SKIP_Parallel_Ext_choice_SKIP_l:\n  \"((? :Y -> Pf) [+] SKIP) |[X]| SKIP =T[M,M] \n   (? x:(Y - X) -> (Pf x |[X]| SKIP)) [+] SKIP\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (rule disjI2)\n  apply (rule disjI1)\n  apply (simp add: par_tr_nil_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n\n  apply (rule disjI2)\n  apply (rule disjI1)\n  apply (simp add: par_tr_Tick_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n\n(* <= *)\n apply (rule, simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (simp add: par_tr_nil_right)\n  apply (elim conjE)\n  apply (rule_tac x=\"<Ev a> ^^^ sa\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n  apply (simp add: image_iff)\n\n  apply (simp add: par_tr_Tick_right)\n  apply (elim conjE)\n  apply (rule_tac x=\"<Ev a> ^^^ sa\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n  apply (simp add: image_iff)\ndone\n\nlemma cspT_SKIP_Parallel_Ext_choice_SKIP_r:\n  \"SKIP |[X]| ((? :Y -> Pf) [+] SKIP)  =T[M,M] \n   (? x:(Y - X) -> (SKIP |[X]| Pf x)) [+] SKIP\"\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (rule cspT_rw_left)\napply (rule cspT_SKIP_Parallel_Ext_choice_SKIP_l)\napply (rule cspT_rw_left)\napply (rule cspT_decompo)\napply (rule cspT_decompo)\napply (simp)\napply (rule cspT_commut)\napply (rule cspT_reflex)\napply (rule cspT_reflex)\ndone\n\nlemmas cspT_SKIP_Parallel_Ext_choice_SKIP =\n       cspT_SKIP_Parallel_Ext_choice_SKIP_l\n       cspT_SKIP_Parallel_Ext_choice_SKIP_r\n\n(*********************************************************\n                      SKIP -- X\n *********************************************************)\n\nlemma cspT_SKIP_Hiding_Id: \n   \"SKIP -- X =T[M1,M2] SKIP\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp_all)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n apply (rule_tac x=\"<Tick>\" in exI)\n apply (simp)\ndone\n\n(*********************************************************\n                      SKIP and Hiding\n *********************************************************)\n\n(*           p.288 version \n\n  \"((? :Y -> Pf) [+] SKIP) -- X =T[M1,M2] \n       IF (Y Int X = {}) THEN ((? x:Y -> (Pf x -- X)) [+] SKIP)\n                         ELSE (((? x:(Y-X) -> (Pf x -- X)) [+] SKIP)\n                               |~| (! x:(Y Int X) .. (Pf x -- X)))\"\n*)\n\nlemma cspT_SKIP_Hiding_step:\n  \"((? :Y -> Pf) [+] SKIP) -- X =T[M,M] \n   ((? x:(Y-X) -> (Pf x -- X)) [+] SKIP) |~| (! x:(Y Int X) .. (Pf x -- X))\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (case_tac \"a : X\", force)\n  apply (force)\n\n(* <= *)\n apply (rule)\n\n  apply (simp add: in_traces)\n  apply (elim conjE exE bexE disjE)\n  apply (simp_all)\n\n   apply (force)\n\n   apply (rule_tac x=\"<Ev a> ^^^ sa\" in exI)\n   apply (simp)\n\n   apply (force)\n\n   apply (rule_tac x=\"<Tick>\" in exI)\n   apply (simp)\n\n   apply (force)\n\n   apply (rule_tac x=\"<Ev a> ^^^ s\" in exI)\n   apply (simp)\ndone\n\n(*********************************************************\n                      SKIP [[r]]\n *********************************************************)\n\nlemma cspT_SKIP_Renaming_Id: \n   \"SKIP [[r]] =T[M1,M2] SKIP\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (force)\ndone\n\n(*********************************************************\n                       SKIP ;; P\n *********************************************************)\n\nlemma cspT_Seq_compo_unit_l: \"SKIP ;; P =T[M,M] P\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_traces)\n apply (rule disjI2)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\ndone\n\n(*********************************************************\n                       P ;; SKIP\n *********************************************************)\n\nlemma cspT_Seq_compo_unit_r: \"P ;; SKIP =T[M,M] P\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (rule memT_prefix_closed, simp)\n apply (simp add: rmTick_prefix_rev)\n apply (rule memT_prefix_closed, simp, simp)\n\n(* <= *)\n apply (rule, simp add: in_traces)\n apply (insert trace_last_noTick_or_Tick)\n apply (drule_tac x=\"t\" in spec)\n apply (erule disjE)\n  apply (rule disjI1)\n  apply (rule_tac x=\"t\" in exI, simp)\n  (* *)\n  apply (rule disjI2)\n  apply (elim conjE exE)\n  apply (rule_tac x=\"s\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp)\ndone\n\nlemmas cspT_Seq_compo_unit = cspT_Seq_compo_unit_l cspT_Seq_compo_unit_r\n\n(*********************************************************\n               SKIP and Sequential composition\n *********************************************************)\n\n(* p.141 *)\n\nlemma cspT_SKIP_Seq_compo_step:\n  \"((? :X -> Pf) [> SKIP) ;; Q =T[M,M] (? x:X -> (Pf x ;; Q)) [> Q\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (rule disjI1)\n  apply (fast)\n\n  apply (rule disjI2)\n  apply (rule disjI1)\n  apply (insert trace_nil_or_Tick_or_Ev)\n  apply (drule_tac x=\"s\" in spec)\n\n  apply (elim disjE conjE exE)\n  apply (simp_all)\n\n  apply (simp add: appt_assoc)\n  apply (rule disjI2)\n\n  apply (rule_tac x=\"sb\" in exI)\n  apply (rule_tac x=\"ta\" in exI)\n  apply (simp)\n\n(* <= *)\n apply (rule, simp add: in_traces)\n\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n apply (rule disjI1)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n apply (rule disjI1)\n apply (rule_tac x=\"<Ev a> ^^^ sa\" in exI)\n apply (simp)\n\n apply (rule disjI2)\n apply (rule_tac x=\"<Ev a> ^^^ sa\" in exI)\n apply (rule_tac x=\"ta\" in exI)\n apply (simp add: appt_assoc)\n\n apply (rule disjI1)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\n\n apply (rule disjI2)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\ndone\n\n(*********************************************************\n                      SKIP |. n\n *********************************************************)\n\nlemma cspT_SKIP_Depth_rest: \n   \"SKIP |. (Suc n) =T[M1,M2] SKIP\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (force)\ndone\n\n(*********************************************************\n                      cspT_SKIP\n *********************************************************)\n\nlemmas cspT_SKIP =\n       cspT_Parallel_term\n       cspT_Parallel_preterm\n       cspT_SKIP_Parallel_Ext_choice_SKIP\n       cspT_SKIP_Hiding_Id\n       cspT_SKIP_Hiding_step\n       cspT_SKIP_Renaming_Id\n       cspT_Seq_compo_unit\n       cspT_SKIP_Seq_compo_step\n       cspT_SKIP_Depth_rest\n\n(*********************************************************\n                       P [+] SKIP\n *********************************************************)\n\n(* p.141 *)\n\nlemma cspT_Ext_choice_SKIP_resolve: \"P [+] SKIP =T[M,M] P [> SKIP\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces)\n\n(* <= *)\n apply (rule, simp add: in_traces)\ndone\n\nlemma cspT_Ext_choice_SKIP_resolve_sym: \"P [> SKIP =T[M,M] P [+] SKIP\"\napply (rule cspT_sym)\napply (simp add: cspT_Ext_choice_SKIP_resolve)\ndone\n\n(*********************************************************\n                    SKIP ||| P\n *********************************************************)\n\nlemma cspT_Interleave_unit_l: \n  \"SKIP ||| P =T[M,M] P\"\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces)\n apply (elim disjE conjE exE)\n apply (simp add: par_tr_nil_left)\n apply (simp add: par_tr_Tick_left)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces)\n apply (case_tac \"noTick t\")\n\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp)\n  apply (simp add: par_tr_nil_left) \n  apply (simp add: noTick_def)\n\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp)\n  apply (simp add: par_tr_Tick_left)\n  apply (simp add: noTick_def)\n\ndone\n\n(*********************************************************\n                    P ||| SKIP\n *********************************************************)\n\nlemma cspT_Interleave_unit_r: \n  \"P ||| SKIP =T[M,M] P\"\napply (rule cspT_rw_left)\napply (rule cspT_commut)\napply (simp add: cspT_Interleave_unit_l)\ndone\n\nlemmas cspT_Interleave_unit =\n       cspT_Interleave_unit_l\n       cspT_Interleave_unit_r\n\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/CSP_T_law_SKIP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.658417487156366, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.33178063456234447}}
{"text": "(*  Title:      JinjaThreads/Common/TypeRel.thy\n    Author:     Tobias Nipkow, Andreas Lochbihler\n\n    Based on the Jinja theory Common/Type.thy by Tobias Nipkow\n*)\n\nsection \\<open>Relations between Jinja Types\\<close>\n\ntheory TypeRel\nimports\n  Decl\nbegin\n\nsubsection\\<open>The subclass relations\\<close>\n\ninductive subcls1 :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<prec>\\<^sup>1 _\" [71, 71, 71] 70)\n  for P :: \"'m prog\"\nwhere subcls1I: \"\\<lbrakk> class P C = Some (D, rest); C \\<noteq> Object \\<rbrakk> \\<Longrightarrow> P \\<turnstile> C \\<prec>\\<^sup>1 D\"\n\nabbreviation subcls :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<preceq>\\<^sup>* _\"  [71,71,71] 70)\nwhere \"P \\<turnstile> C \\<preceq>\\<^sup>* D \\<equiv> (subcls1 P)\\<^sup>*\\<^sup>* C D\"\n\nlemma subcls1D:\n  \"P \\<turnstile> C \\<prec>\\<^sup>1 D \\<Longrightarrow> C \\<noteq> Object \\<and> (\\<exists>fs ms. class P C = Some (D,fs,ms))\"\nby(auto elim: subcls1.cases)\n\nlemma Object_subcls1 [iff]: \"\\<not> P \\<turnstile> Object \\<prec>\\<^sup>1 C\"\nby(simp add: subcls1.simps)\n\nlemma Object_subcls_conv [iff]: \"(P \\<turnstile> Object \\<preceq>\\<^sup>* C) = (C = Object)\"\nby(auto elim: converse_rtranclpE)\n\nlemma finite_subcls1: \"finite {(C, D). P \\<turnstile> C \\<prec>\\<^sup>1 D}\"\nproof -\n  let ?A = \"SIGMA C:{C. is_class P C}. {D. C\\<noteq>Object \\<and> fst (the (class P C))=D}\"\n  have \"finite ?A\" by(rule finite_SigmaI [OF finite_is_class]) auto\n  also have \"?A = {(C, D). P \\<turnstile> C \\<prec>\\<^sup>1 D}\"\n    by(fastforce simp:is_class_def dest: subcls1D elim: subcls1I)\n  finally show ?thesis .\nqed\n\nlemma finite_subcls1':\n  \"finite ({(D, C). P \\<turnstile> C \\<prec>\\<^sup>1 D})\"\nby(subst finite_converse[symmetric])\n  (simp add: converse_unfold finite_subcls1 del: finite_converse)\n\nlemma subcls_is_class: \"(subcls1 P)\\<^sup>+\\<^sup>+ C D \\<Longrightarrow> is_class P C\"\nby(auto elim: converse_tranclpE dest!: subcls1D simp add: is_class_def)\n\nlemma subcls_is_class1: \"\\<lbrakk> P \\<turnstile> C \\<preceq>\\<^sup>* D; is_class P D \\<rbrakk> \\<Longrightarrow> is_class P C\"\nby(auto elim: converse_rtranclpE dest!: subcls1D simp add: is_class_def)\n\nsubsection\\<open>The subtype relations\\<close>\n\ninductive widen :: \"'m prog \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<le> _\"   [71,71,71] 70)\n  for P :: \"'m prog\"\nwhere \n  widen_refl[iff]: \"P \\<turnstile> T \\<le> T\"\n| widen_subcls: \"P \\<turnstile> C \\<preceq>\\<^sup>* D  \\<Longrightarrow>  P \\<turnstile> Class C \\<le> Class D\"\n| widen_null[iff]: \"P \\<turnstile> NT \\<le> Class C\"\n| widen_null_array[iff]: \"P \\<turnstile> NT \\<le> Array A\"\n| widen_array_object: \"P \\<turnstile> Array A \\<le> Class Object\"\n| widen_array_array: \"P \\<turnstile> A \\<le> B \\<Longrightarrow> P \\<turnstile> Array A \\<le> Array B\"\n\nabbreviation\n  widens :: \"'m prog \\<Rightarrow> ty list \\<Rightarrow> ty list \\<Rightarrow> bool\" (\"_ \\<turnstile> _ [\\<le>] _\" [71,71,71] 70)\nwhere\n  \"P \\<turnstile> Ts [\\<le>] Ts' == list_all2 (widen P) Ts Ts'\"\n\n\n\nlemma [iff]: \"(P \\<turnstile> T \\<le> Boolean) = (T = Boolean)\"\n(*<*)by (auto elim: widen.cases)(*>*)\n\nlemma [iff]: \"(P \\<turnstile> T \\<le> Integer) = (T = Integer)\"\n(*<*)by (auto elim: widen.cases)(*>*)\n\nlemma [iff]: \"(P \\<turnstile> Void \\<le> T) = (T = Void)\"\n(*<*)by (auto elim: widen.cases)(*>*)\n\nlemma [iff]: \"(P \\<turnstile> Boolean \\<le> T) = (T = Boolean)\"\n(*<*)by (auto elim: widen.cases)(*>*)\n\nlemma [iff]: \"(P \\<turnstile> Integer \\<le> T) = (T = Integer)\"\n(*<*)by (auto elim: widen.cases)(*>*)\n\nlemma Class_widen: \"P \\<turnstile> Class C \\<le> T  \\<Longrightarrow>  \\<exists>D. T = Class D\"\nby(erule widen.cases, auto)\n\nlemma Array_Array_widen:\n  \"P \\<turnstile> Array T \\<le> Array U \\<Longrightarrow> P \\<turnstile> T \\<le> U\"\nby(auto elim: widen.cases)\n\nlemma widen_Array: \"(P \\<turnstile> T \\<le> U\\<lfloor>\\<rceil>) \\<longleftrightarrow> (T = NT \\<or> (\\<exists>V. T = V\\<lfloor>\\<rceil> \\<and> P \\<turnstile> V \\<le> U))\"\nby(induct T)(auto dest: Array_Array_widen elim: widen.cases intro: widen_array_array)\n\nlemma Array_widen: \"P \\<turnstile> Array A \\<le> T \\<Longrightarrow> (\\<exists>B. T = Array B \\<and> P \\<turnstile> A \\<le> B) \\<or> T = Class Object\"\nby(auto elim: widen.cases)\n\nlemma [iff]: \"(P \\<turnstile> T \\<le> NT) = (T = NT)\"\nby(induct T)(auto dest:Class_widen Array_widen)\n\nlemma Class_widen_Class [iff]: \"(P \\<turnstile> Class C \\<le> Class D) = (P \\<turnstile> C \\<preceq>\\<^sup>* D)\"\nby (auto elim: widen_subcls widen.cases)\n\nlemma widen_Class: \"(P \\<turnstile> T \\<le> Class C) = (T = NT \\<or> (\\<exists>D. T = Class D \\<and> P \\<turnstile> D \\<preceq>\\<^sup>* C) \\<or> (C = Object \\<and> (\\<exists>A. T = Array A)))\"\nby(induct T)(auto dest: Array_widen intro: widen_array_object)\n\nlemma NT_widen:\n  \"P \\<turnstile> NT \\<le> T = (T = NT \\<or> (\\<exists>C. T = Class C) \\<or> (\\<exists>U. T = U\\<lfloor>\\<rceil>))\"\nby(cases T) auto\n\nlemma Class_widen2: \"P \\<turnstile> Class C \\<le> T = (\\<exists>D. T = Class D \\<and> P \\<turnstile> C \\<preceq>\\<^sup>* D)\"\nby (cases T, auto elim: widen.cases)\n\nlemma Object_widen: \"P \\<turnstile> Class Object \\<le> T \\<Longrightarrow> T = Class Object\"\nby(cases T, auto elim: widen.cases)\n\nlemma NT_Array_widen_Object:\n  \"is_NT_Array T \\<Longrightarrow>  P \\<turnstile> T \\<le> Class Object\"\nby(induct T, auto intro: widen_array_object)\n\nlemma widen_trans[trans]: \n  assumes \"P \\<turnstile> S \\<le> U\" \"P \\<turnstile> U \\<le> T\"\n  shows \"P \\<turnstile> S \\<le> T\"\nusing assms\nproof(induct arbitrary: T)\n  case (widen_refl T T') thus \"P \\<turnstile> T \\<le> T'\" .\nnext\n  case (widen_subcls C D T)\n  then obtain E where \"T = Class E\" by (blast dest: Class_widen)\n  with widen_subcls show \"P \\<turnstile> Class C \\<le> T\" by (auto elim: rtrancl_trans)\nnext\n  case (widen_null C RT)\n  then obtain D where \"RT = Class D\" by (blast dest: Class_widen)\n  thus \"P \\<turnstile> NT \\<le> RT\" by auto\nnext\n  case widen_null_array thus ?case by(auto dest: Array_widen)\nnext\n  case (widen_array_object A T)\n  hence \"T = Class Object\" by(rule Object_widen)\n  with widen_array_object show \"P \\<turnstile> A\\<lfloor>\\<rceil> \\<le> T\"\n    by(auto intro: widen.widen_array_object)\nnext\n  case widen_array_array thus ?case\n    by(auto dest!: Array_widen intro: widen.widen_array_array widen_array_object)\nqed\n\nlemma widens_trans: \"\\<lbrakk>P \\<turnstile> Ss [\\<le>] Ts; P \\<turnstile> Ts [\\<le>] Us\\<rbrakk> \\<Longrightarrow> P \\<turnstile> Ss [\\<le>] Us\"\nby (rule list_all2_trans)(rule widen_trans)\n\nlemma class_type_of'_widenD:\n  \"class_type_of' T = \\<lfloor>C\\<rfloor> \\<Longrightarrow> P \\<turnstile> T \\<le> Class C\"\nby(cases T)(auto intro: widen_array_object)\n\nlemma widen_is_class_type_of:\n  assumes \"class_type_of' T = \\<lfloor>C\\<rfloor>\" \"P \\<turnstile> T' \\<le> T\" \"T' \\<noteq> NT\"\n  obtains C' where \"class_type_of' T' = \\<lfloor>C'\\<rfloor>\" \"P \\<turnstile> C' \\<preceq>\\<^sup>* C\"\nusing assms by(cases T)(auto simp add: widen_Class widen_Array)\n\nlemma widens_refl: \"P \\<turnstile> Ts [\\<le>] Ts\"\nby(rule list_all2_refl[OF widen_refl])\n\nlemma widen_append1:\n  \"P \\<turnstile> (xs @ ys) [\\<le>] Ts = (\\<exists>Ts1 Ts2. Ts = Ts1 @ Ts2 \\<and> length xs = length Ts1 \\<and> length ys = length Ts2 \\<and> P \\<turnstile> xs [\\<le>] Ts1 \\<and> P \\<turnstile> ys [\\<le>] Ts2)\"\nunfolding list_all2_append1 by fastforce\n\nlemmas widens_Cons [iff] = list_all2_Cons1 [of \"widen P\"] for P\n\nlemma widens_lengthD:\n  \"P \\<turnstile> xs [\\<le>] ys \\<Longrightarrow> length xs = length ys\"\nby(rule list_all2_lengthD)\n\nlemma widen_refT: \"\\<lbrakk> is_refT T; P \\<turnstile> U \\<le> T \\<rbrakk> \\<Longrightarrow> is_refT U\"\nby(erule refTE)(auto simp add: widen_Class widen_Array)\n\nlemma refT_widen: \"\\<lbrakk> is_refT T; P \\<turnstile> T \\<le> U \\<rbrakk> \\<Longrightarrow> is_refT U\"\nby(erule widen.cases) auto\n\ninductive is_lub :: \"'m prog \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> bool\" (\"_ \\<turnstile> lub'((_,/ _)') = _\" [51,51,51,51] 50)\nfor P :: \"'m prog\" and U :: ty and V :: ty and T ::  ty\nwhere \n  \"\\<lbrakk> P \\<turnstile> U \\<le> T; P \\<turnstile> V \\<le> T;\n     \\<And>T'. \\<lbrakk> P \\<turnstile> U \\<le> T'; P \\<turnstile> V \\<le> T' \\<rbrakk> \\<Longrightarrow> P \\<turnstile> T \\<le> T' \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> lub(U, V) = T\"\n\nlemma is_lub_upper:\n  \"P \\<turnstile> lub(U, V) = T \\<Longrightarrow> P \\<turnstile> U \\<le> T \\<and> P \\<turnstile> V \\<le> T\"\nby(auto elim: is_lub.cases)\n\nlemma is_lub_least:\n  \"\\<lbrakk> P \\<turnstile> lub(U, V) = T; P \\<turnstile> U \\<le> T'; P \\<turnstile> V \\<le> T' \\<rbrakk> \\<Longrightarrow> P \\<turnstile> T \\<le> T'\"\nby(auto elim: is_lub.cases)\n\nlemma is_lub_Void [iff]:\n  \"P \\<turnstile> lub(Void, Void) = T \\<longleftrightarrow> T = Void\"\nby(auto intro: is_lub.intros elim: is_lub.cases)\n\nlemma is_lubI [code_pred_intro]:\n  \"\\<lbrakk>P \\<turnstile> U \\<le> T; P \\<turnstile> V \\<le> T; \\<forall>T'. P \\<turnstile> U \\<le> T' \\<longrightarrow> P \\<turnstile> V \\<le> T' \\<longrightarrow> P \\<turnstile> T \\<le> T'\\<rbrakk> \\<Longrightarrow> P \\<turnstile> lub(U, V) = T\"\nby(blast intro: is_lub.intros)\n\nsubsection\\<open>Method lookup\\<close>\n\ninductive Methods :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> (mname \\<rightharpoonup> (ty list \\<times> ty \\<times> 'm option) \\<times> cname) \\<Rightarrow> bool\" \n  (\"_ \\<turnstile> _ sees'_methods _\" [51,51,51] 50)\n  for P :: \"'m prog\"\nwhere \nsees_methods_Object:\n \"\\<lbrakk> class P Object = Some(D,fs,ms); Mm = map_option (\\<lambda>m. (m,Object)) \\<circ> map_of ms \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> Object sees_methods Mm\"\n| sees_methods_rec:\n \"\\<lbrakk> class P C = Some(D,fs,ms); C \\<noteq> Object; P \\<turnstile> D sees_methods Mm;\n    Mm' = Mm ++ (map_option (\\<lambda>m. (m,C)) \\<circ> map_of ms) \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> C sees_methods Mm'\"\n\nlemma sees_methods_fun:\n  assumes \"P \\<turnstile> C sees_methods Mm\"\n  shows \"P \\<turnstile> C sees_methods Mm' \\<Longrightarrow> Mm' = Mm\"\nusing assms\nproof(induction arbitrary: Mm')\n  case sees_methods_Object thus ?case by(auto elim: Methods.cases)\nnext\n  case (sees_methods_rec C D fs ms Dres Cres Cres')\n  from \\<open>P \\<turnstile> C sees_methods Cres'\\<close> \\<open>C \\<noteq> Object\\<close> \\<open>class P C = \\<lfloor>(D, fs, ms)\\<rfloor>\\<close>\n  obtain Dres' where Dmethods': \"P \\<turnstile> D sees_methods Dres'\"\n    and Cres': \"Cres' = Dres' ++ (map_option (\\<lambda>m. (m,C)) \\<circ> map_of ms)\"\n    by cases auto\n  from sees_methods_rec.IH[OF Dmethods'] \\<open>Cres = Dres ++ (map_option (\\<lambda>m. (m,C)) \\<circ> map_of ms)\\<close> Cres'\n  show ?case by simp\nqed\n\nlemma visible_methods_exist:\n  \"P \\<turnstile> C sees_methods Mm \\<Longrightarrow> Mm M = Some(m,D) \\<Longrightarrow>\n   (\\<exists>D' fs ms. class P D = Some(D',fs,ms) \\<and> map_of ms M = Some m)\"\nby(induct rule:Methods.induct) auto\n\nlemma sees_methods_decl_above:\n  assumes \"P \\<turnstile> C sees_methods Mm\"\n  shows \"Mm M = Some(m,D) \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* D\"\nusing assms\nby induct(auto elim: converse_rtranclp_into_rtranclp[where r = \"subcls1 P\", OF subcls1I])\n\nlemma sees_methods_idemp:\n  assumes \"P \\<turnstile> C sees_methods Mm\" and \"Mm M = Some(m,D)\"\n  shows \"\\<exists>Mm'. (P \\<turnstile> D sees_methods Mm') \\<and> Mm' M = Some(m,D)\"\nusing assms\nby(induct arbitrary: m D)(fastforce dest: Methods.intros)+\n\nlemma sees_methods_decl_mono:\n  assumes sub: \"P \\<turnstile> C' \\<preceq>\\<^sup>* C\" and \"P \\<turnstile> C sees_methods Mm\"\n  shows \"\\<exists>Mm' Mm\\<^sub>2. P \\<turnstile> C' sees_methods Mm' \\<and> Mm' = Mm ++ Mm\\<^sub>2 \\<and> (\\<forall>M m D. Mm\\<^sub>2 M = Some(m,D) \\<longrightarrow> P \\<turnstile> D \\<preceq>\\<^sup>* C)\"\n      (is \"\\<exists>Mm' Mm2. ?Q C' C Mm' Mm2\")\nusing assms\nproof (induction rule: converse_rtranclp_induct)\n  case base\n  hence \"?Q C C Mm Map.empty\" by simp\n  thus \"\\<exists>Mm' Mm2. ?Q C C Mm' Mm2\" by blast\nnext\n  case (step C'' C')\n  note sub1 = \\<open>P \\<turnstile> C'' \\<prec>\\<^sup>1 C'\\<close> and sub = \\<open>P \\<turnstile> C' \\<preceq>\\<^sup>* C\\<close>\n    and Csees = \\<open>P \\<turnstile> C sees_methods Mm\\<close>\n  from step.IH[OF Csees] obtain Mm' Mm2 where C'sees: \"P \\<turnstile> C' sees_methods Mm'\"\n    and Mm': \"Mm' = Mm ++ Mm2\"\n    and subC: \"\\<forall>M m D. Mm2 M = Some(m,D) \\<longrightarrow> P \\<turnstile> D \\<preceq>\\<^sup>* C\" by blast\n  obtain fs ms where \"class\": \"class P C'' = Some(C',fs,ms)\" \"C'' \\<noteq> Object\"\n    using subcls1D[OF sub1] by blast\n  let ?Mm3 = \"map_option (\\<lambda>m. (m,C'')) \\<circ> map_of ms\"\n  have \"P \\<turnstile> C'' sees_methods (Mm ++ Mm2) ++ ?Mm3\"\n    using sees_methods_rec[OF \"class\" C'sees refl] Mm' by simp\n  hence \"?Q C'' C ((Mm ++ Mm2) ++ ?Mm3) (Mm2++?Mm3)\"\n    using converse_rtranclp_into_rtranclp[OF sub1 sub]\n    by simp (simp add:map_add_def subC split:option.split)\n  thus \"\\<exists>Mm' Mm2. ?Q C'' C Mm' Mm2\" by blast\nqed\n\ndefinition Method :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> 'm option \\<Rightarrow> cname \\<Rightarrow> bool\"\n            (\"_ \\<turnstile> _ sees _: _\\<rightarrow>_ = _ in _\" [51,51,51,51,51,51,51] 50)\nwhere\n  \"P \\<turnstile> C sees M: Ts\\<rightarrow>T = m in D  \\<equiv>\n  \\<exists>Mm. P \\<turnstile> C sees_methods Mm \\<and> Mm M = Some((Ts,T,m),D)\"\n\ntext \\<open>\n  Output translation to replace @{term \"None\"} with its notation \\<open>Native\\<close>\n  when used as method body in @{term \"Method\"}.\n\\<close>\nabbreviation (output)\n  Method_native :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> cname \\<Rightarrow> bool\"\n  (\"_ \\<turnstile> _ sees _: _\\<rightarrow>_ = Native in _\" [51,51,51,51,51,51] 50)\nwhere \"Method_native P C M Ts T D \\<equiv> Method P C M Ts T Native D\"\n\ndefinition has_method :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> bool\" (\"_ \\<turnstile> _ has _\" [51,0,51] 50)\nwhere\n  \"P \\<turnstile> C has M \\<equiv> \\<exists>Ts T m D. P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D\"\n\nlemma has_methodI:\n  \"P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D \\<Longrightarrow> P \\<turnstile> C has M\"\n  by (unfold has_method_def) blast\n\nlemma sees_method_fun:\n  \"\\<lbrakk>P \\<turnstile> C sees M:TS\\<rightarrow>T = m in D; P \\<turnstile> C sees M:TS'\\<rightarrow>T' = m' in D' \\<rbrakk>\n   \\<Longrightarrow> TS' = TS \\<and> T' = T \\<and> m' = m \\<and> D' = D\"\n (*<*)by(fastforce dest: sees_methods_fun simp:Method_def)(*>*)\n\nlemma sees_method_decl_above:\n  \"P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* D\"\n (*<*)by(clarsimp simp:Method_def sees_methods_decl_above)(*>*)\n\nlemma visible_method_exists:\n  \"P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D \\<Longrightarrow>\n  \\<exists>D' fs ms. class P D = Some(D',fs,ms) \\<and> map_of ms M = Some(Ts,T,m)\"\n(*<*)by(fastforce simp:Method_def dest!: visible_methods_exist)(*>*)\n\n\nlemma sees_method_idemp:\n  \"P \\<turnstile> C sees M:Ts\\<rightarrow>T=m in D \\<Longrightarrow> P \\<turnstile> D sees M:Ts\\<rightarrow>T=m in D\"\n (*<*)by(fastforce simp: Method_def intro:sees_methods_idemp)(*>*)\n\nlemma sees_method_decl_mono:\n  \"\\<lbrakk> P \\<turnstile> C' \\<preceq>\\<^sup>* C; P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D;\n     P \\<turnstile> C' sees M:Ts'\\<rightarrow>T' = m' in D' \\<rbrakk> \\<Longrightarrow> P \\<turnstile> D' \\<preceq>\\<^sup>* D\"\napply(frule sees_method_decl_above)\napply(unfold Method_def)\napply clarsimp\napply(drule (1) sees_methods_decl_mono)\napply clarsimp\napply(drule (1) sees_methods_fun)\napply clarsimp\napply(blast intro:rtranclp_trans)\ndone\n\nlemma sees_method_is_class:\n  \"P \\<turnstile> C sees M:Ts\\<rightarrow>T = m in D \\<Longrightarrow> is_class P C\"\nby (auto simp add: is_class_def Method_def elim: Methods.cases)\n\nsubsection\\<open>Field lookup\\<close>\n\ninductive Fields :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> ((vname \\<times> cname) \\<times> (ty \\<times> fmod)) list \\<Rightarrow> bool\"\n  (\"_ \\<turnstile> _ has'_fields _\" [51,51,51] 50)\n  for P :: \"'m prog\"\nwhere \n  has_fields_rec:\n  \"\\<lbrakk> class P C = Some(D,fs,ms); C \\<noteq> Object; P \\<turnstile> D has_fields FDTs;\n     FDTs' = map (\\<lambda>(F,Tm). ((F,C),Tm)) fs @ FDTs \\<rbrakk>\n   \\<Longrightarrow> P \\<turnstile> C has_fields FDTs'\"\n\n| has_fields_Object:\n  \"\\<lbrakk> class P Object = Some(D,fs,ms); FDTs = map (\\<lambda>(F,T). ((F,Object),T)) fs \\<rbrakk>\n   \\<Longrightarrow> P \\<turnstile> Object has_fields FDTs\"\n\nlemma has_fields_fun:\n  assumes \"P \\<turnstile> C has_fields FDTs\" and \"P \\<turnstile> C has_fields FDTs'\"\n  shows \"FDTs' = FDTs\"\nusing assms\nproof(induction arbitrary: FDTs')\n  case has_fields_Object thus ?case by(auto elim: Fields.cases)\nnext\n  case (has_fields_rec C D fs ms Dres Cres Cres')\n  from \\<open>P \\<turnstile> C has_fields Cres'\\<close> \\<open>C \\<noteq> Object\\<close> \\<open>class P C = Some (D, fs, ms)\\<close>\n  obtain Dres' where DFields': \"P \\<turnstile> D has_fields Dres'\"\n    and Cres': \"Cres' = map (\\<lambda>(F,Tm). ((F,C),Tm)) fs @ Dres'\"\n    by cases auto\n  from has_fields_rec.IH[OF DFields'] \\<open>Cres = map (\\<lambda>(F,Tm). ((F,C),Tm)) fs @ Dres\\<close> Cres'\n  show ?case by simp\nqed\n\nlemma all_fields_in_has_fields:\n  assumes \"P \\<turnstile> C has_fields FDTs\"\n  and \"P \\<turnstile> C \\<preceq>\\<^sup>* D\" \"class P D = Some(D',fs,ms)\" \"(F,Tm) \\<in> set fs\"\n  shows \"((F,D),Tm) \\<in> set FDTs\"\nusing assms\nby induct (auto 4 3 elim: converse_rtranclpE dest: subcls1D)\n\nlemma has_fields_decl_above:\n  assumes \"P \\<turnstile> C has_fields FDTs\" \"((F,D),Tm) \\<in> set FDTs\"\n  shows \"P \\<turnstile> C \\<preceq>\\<^sup>* D\"\nusing assms\nby induct (auto intro: converse_rtranclp_into_rtranclp subcls1I)\n\nlemma subcls_notin_has_fields:\n  assumes \"P \\<turnstile> C has_fields FDTs\" \"((F,D),Tm) \\<in> set FDTs\"\n  shows \"\\<not> (subcls1 P)\\<^sup>+\\<^sup>+ D C\"\nusing assms apply(induct)\n prefer 2 apply(fastforce dest: tranclpD)\napply clarsimp\napply(erule disjE)\n apply(clarsimp simp add:image_def)\n apply(drule tranclpD)\n apply clarify\n apply(frule subcls1D)\n apply(fastforce dest:tranclpD all_fields_in_has_fields)\napply(blast dest:subcls1I tranclp.trancl_into_trancl)\ndone\n\nlemma has_fields_mono_lem:\n  assumes \"P \\<turnstile> D \\<preceq>\\<^sup>* C\" \"P \\<turnstile> C has_fields FDTs\"\n  shows \"\\<exists>pre. P \\<turnstile> D has_fields pre@FDTs \\<and> dom(map_of pre) \\<inter> dom(map_of FDTs) = {}\"\nusing assms\napply(induct rule:converse_rtranclp_induct)\n apply(rule_tac x = \"[]\" in exI)\n apply simp\napply clarsimp\napply(rename_tac D' D pre)\napply(subgoal_tac \"(subcls1 P)^++ D' C\")\n prefer 2 apply(erule (1) rtranclp_into_tranclp2)\napply(drule subcls1D)\napply clarsimp\napply(rename_tac fs ms)\napply(drule (2) has_fields_rec)\n apply(rule refl)\napply(rule_tac x = \"map (\\<lambda>(F,Tm). ((F,D'),Tm)) fs @ pre\" in exI)\napply simp\napply(simp add:Int_Un_distrib2)\napply(rule equals0I)\napply(auto dest: subcls_notin_has_fields simp:dom_map_of_conv_image_fst image_def)\ndone\n\nlemma has_fields_is_class:\n  \"P \\<turnstile> C has_fields FDTs \\<Longrightarrow> is_class P C\"\nby (auto simp add: is_class_def elim: Fields.cases)\n\nlemma Object_has_fields_Object:\n  assumes \"P \\<turnstile> Object has_fields FDTs\"\n  shows \"snd ` fst ` set FDTs \\<subseteq> {Object}\"\nusing assms by cases auto\n\ndefinition\n  has_field :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> vname \\<Rightarrow> ty \\<Rightarrow> fmod \\<Rightarrow> cname \\<Rightarrow> bool\"\n                   (\"_ \\<turnstile> _ has _:_ '(_') in _\" [51,51,51,51,51,51] 50)\nwhere\n  \"P \\<turnstile> C has F:T (fm) in D  \\<equiv>\n  \\<exists>FDTs. P \\<turnstile> C has_fields FDTs \\<and> map_of FDTs (F,D) = Some (T, fm)\"\n\nlemma has_field_mono:\n  \"\\<lbrakk> P \\<turnstile> C has F:T (fm) in D; P \\<turnstile> C' \\<preceq>\\<^sup>* C \\<rbrakk> \\<Longrightarrow> P \\<turnstile> C' has F:T (fm) in D\"\nby(fastforce simp:has_field_def map_add_def dest: has_fields_mono_lem)\n\nlemma has_field_is_class:\n  \"P \\<turnstile> C has M:T (fm) in D \\<Longrightarrow> is_class P C\"\nby (auto simp add: is_class_def has_field_def elim: Fields.cases)\n\nlemma has_field_decl_above:\n  \"P \\<turnstile> C has F:T (fm) in D \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* D\"\nunfolding has_field_def\nby(auto dest: map_of_SomeD has_fields_decl_above)\n\nlemma has_field_fun:\n  \"\\<lbrakk>P \\<turnstile> C has F:T (fm) in D; P \\<turnstile> C has F:T' (fm') in D\\<rbrakk> \\<Longrightarrow> T' = T \\<and> fm = fm'\"\nby(auto simp:has_field_def dest:has_fields_fun)\n\ndefinition\n  sees_field :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> vname \\<Rightarrow> ty \\<Rightarrow> fmod \\<Rightarrow> cname \\<Rightarrow> bool\"\n                  (\"_ \\<turnstile> _ sees _:_ '(_') in _\" [51,51,51,51,51,51] 50)\nwhere\n  \"P \\<turnstile> C sees F:T (fm) in D  \\<equiv>\n  \\<exists>FDTs. P \\<turnstile> C has_fields FDTs \\<and>\n            map_of (map (\\<lambda>((F,D),Tm). (F,(D,Tm))) FDTs) F = Some(D,T,fm)\"\n\nlemma map_of_remap_SomeD:\n  \"map_of (map (\\<lambda>((k,k'),x). (k,(k',x))) t) k = Some (k',x) \\<Longrightarrow> map_of t (k, k') = Some x\"\nby (induct t) (auto simp:fun_upd_apply split: if_split_asm)\n\nlemma has_visible_field:\n  \"P \\<turnstile> C sees F:T (fm) in D \\<Longrightarrow> P \\<turnstile> C has F:T (fm) in D\"\nby(auto simp add:has_field_def sees_field_def map_of_remap_SomeD)\n\nlemma sees_field_fun:\n  \"\\<lbrakk>P \\<turnstile> C sees F:T (fm) in D; P \\<turnstile> C sees F:T' (fm') in D'\\<rbrakk> \\<Longrightarrow> T' = T \\<and> D' = D \\<and> fm = fm'\"\nby(fastforce simp:sees_field_def dest:has_fields_fun)\n\n\nlemma sees_field_decl_above:\n  \"P \\<turnstile> C sees F:T (fm) in D \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* D\"\nby(clarsimp simp add: sees_field_def)\n  (blast intro: has_fields_decl_above map_of_SomeD map_of_remap_SomeD)\n\nlemma sees_field_idemp:\n  assumes \"P \\<turnstile> C sees F:T (fm) in D\"\n  shows \"P \\<turnstile> D sees F:T (fm) in D\"\nproof -\n  from assms obtain FDTs where has: \"P \\<turnstile> C has_fields FDTs\"\n    and F: \"map_of (map (\\<lambda>((F, D), Tm). (F, D, Tm)) FDTs) F = \\<lfloor>(D, T, fm)\\<rfloor>\"\n    unfolding sees_field_def by blast\n  thus ?thesis\n  proof induct\n    case has_fields_rec thus ?case unfolding sees_field_def\n      by(auto)(fastforce dest: map_of_SomeD intro!: exI intro: Fields.has_fields_rec)\n  next\n    case has_fields_Object thus ?case unfolding sees_field_def\n      by(fastforce dest: map_of_SomeD intro: Fields.has_fields_Object intro!: exI)\n  qed\nqed\n\nsubsection \"Functional lookup\"\n\ndefinition \"method\" :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> cname \\<times> ty list \\<times> ty \\<times> 'm option\"\nwhere \"method P C M  \\<equiv>  THE (D,Ts,T,m). P \\<turnstile> C sees M:Ts \\<rightarrow> T = m in D\"\n\ndefinition field  :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> vname \\<Rightarrow> cname \\<times> ty \\<times> fmod\"\nwhere \"field P C F  \\<equiv>  THE (D,T,fm). P \\<turnstile> C sees F:T (fm) in D\"\n                                                        \ndefinition fields :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> ((vname \\<times> cname) \\<times> (ty \\<times> fmod)) list\" \nwhere \"fields P C  \\<equiv>  THE FDTs. P \\<turnstile> C has_fields FDTs\"                \n\n\n\nlemma field_def2 [simp]: \"P \\<turnstile> C sees F:T (fm) in D \\<Longrightarrow> field P C F = (D,T,fm)\"\n(*<*)by (unfold field_def) (auto dest: sees_field_fun)(*>*)\n\nlemma method_def2 [simp]: \"P \\<turnstile> C sees M: Ts\\<rightarrow>T = m in D \\<Longrightarrow> method P C M = (D,Ts,T,m)\"\n(*<*)by (unfold method_def) (auto dest: sees_method_fun)(*>*)\n\nlemma has_fields_b_fields: \n  \"P \\<turnstile> C has_fields FDTs \\<Longrightarrow> fields P C = FDTs\"\nunfolding fields_def\nby (blast intro: the_equality has_fields_fun)\n\nlemma has_field_map_of_fields [simp]:\n  \"P \\<turnstile> C has F:T (fm) in D \\<Longrightarrow> map_of (fields P C) (F, D) = \\<lfloor>(T, fm)\\<rfloor>\"\nby(auto simp add: has_field_def)\n\nsubsection \\<open>Code generation\\<close>\n\ntext \\<open>New introduction rules for subcls1\\<close>\n\ncode_pred\n  \\<comment> \\<open>Disallow mode @{text \"i_o_o\"} to force @{text code_pred} in subsequent predicates not to use this inefficient mode\\<close>\n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) \n  subcls1\n.\n\ntext \\<open>\n  Introduce proper constant \\<open>subcls'\\<close> for @{term \"subcls\"}\n  and generate executable equation for \\<open>subcls'\\<close> \n\\<close>\n\ndefinition subcls' where \"subcls' = subcls\"\n\ncode_pred\n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool)\n  [inductify]\n  subcls'\n.\n\nlemma subcls_conv_subcls' [code_unfold]:\n  \"(subcls1 P)^** = subcls' P\"\nby(simp add: subcls'_def)\n\ntext \\<open>\n  Change rule @{thm widen_array_object} such that predicate compiler\n  tests on class @{term Object} first. Otherwise \\<open>widen_i_o_i\\<close> never terminates.\n\\<close>\n\n\n\nlemmas [code_pred_intro] =\n  widen_refl widen_subcls widen_null widen_null_array widen_array_object_code widen_array_array\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool)\n  widen \nby(erule widen.cases) auto\n\ntext \\<open>\n  Readjust the code equations for @{term widen} such that @{term widen_i_i_i} is guaranteed to\n  contain @{term \"()\"} at most once (even in the code representation!). This is important\n  for the scheduler and the small-step semantics because of the weaker code equations\n  for @{term \"the\"}.\n\n  A similar problem cannot hit the subclass relation because, for acyclic subclass hierarchies, \n  the paths in the hieararchy are unique and cycle-free.\n\\<close>\n\ndefinition widen_i_i_i' where \"widen_i_i_i' = widen_i_i_i\"\n\ndeclare widen.equation [code del]\nlemmas widen_i_i_i'_equation [code] = widen.equation[folded widen_i_i_i'_def]\n\nlemma widen_i_i_i_code [code]:\n  \"widen_i_i_i P T T' = (if P \\<turnstile> T \\<le> T' then Predicate.single () else bot)\"\nby(auto intro!: pred_eqI intro: widen_i_i_iI elim: widen_i_i_iE)\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool)\n  Methods \n.\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> i \\<Rightarrow> bool)\n  [inductify]\n  Method\n.\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool)\n  [inductify]\n  has_method \n.\n\n(* FIXME: Necessary only because of bug in code_pred *)\ndeclare fun_upd_def [code_pred_inline]\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool)\n  Fields \n.\n\ncode_pred\n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> i \\<Rightarrow> bool)\n  [inductify, skip_proof]\n  has_field\n.\n\ncode_pred\n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> o \\<Rightarrow> i \\<Rightarrow> bool)\n  [inductify, skip_proof]\n  sees_field\n.\n\nlemma eval_Method_i_i_i_o_o_o_o_conv:\n  \"Predicate.eval (Method_i_i_i_o_o_o_o P C M) = (\\<lambda>(Ts, T, m, D). P \\<turnstile> C sees M:Ts\\<rightarrow>T=m in D)\"\nby(auto intro: Method_i_i_i_o_o_o_oI elim: Method_i_i_i_o_o_o_oE intro!: ext)\n\nlemma method_code [code]:\n  \"method P C M = \n  Predicate.the (Predicate.bind (Method_i_i_i_o_o_o_o P C M) (\\<lambda>(Ts, T, m, D). Predicate.single (D, Ts, T, m)))\"\napply (rule sym, rule the_eqI)\napply (simp add: method_def eval_Method_i_i_i_o_o_o_o_conv)\napply (rule arg_cong [where f=The])\napply (auto simp add: Sup_fun_def Sup_bool_def fun_eq_iff)\ndone\n\nlemma eval_sees_field_i_i_i_o_o_o_conv:\n  \"Predicate.eval (sees_field_i_i_i_o_o_o P C F) = (\\<lambda>(T, fm, D). P \\<turnstile> C sees F:T (fm) in D)\"\nby(auto intro!: ext intro: sees_field_i_i_i_o_o_oI elim: sees_field_i_i_i_o_o_oE)\n\nlemma eval_sees_field_i_i_i_o_i_conv:\n  \"Predicate.eval (sees_field_i_i_i_o_o_i P C F D) = (\\<lambda>(T, fm). P \\<turnstile> C sees F:T (fm) in D)\"\nby(auto intro!: ext intro: sees_field_i_i_i_o_o_iI elim: sees_field_i_i_i_o_o_iE)\n\nlemma field_code [code]:\n  \"field P C F = Predicate.the (Predicate.bind (sees_field_i_i_i_o_o_o P C F) (\\<lambda>(T, fm, D). Predicate.single (D, T, fm)))\"\napply (rule sym, rule the_eqI)\napply (simp add: field_def eval_sees_field_i_i_i_o_o_o_conv)\napply (rule arg_cong [where f=The])\napply (auto simp add: Sup_fun_def Sup_bool_def fun_eq_iff)\ndone\n\nlemma eval_Fields_conv:\n  \"Predicate.eval (Fields_i_i_o P C) = (\\<lambda>FDTs. P \\<turnstile> C has_fields FDTs)\"\nby(auto intro: Fields_i_i_oI elim: Fields_i_i_oE intro!: ext)\n\nlemma fields_code [code]:\n  \"fields P C = Predicate.the (Fields_i_i_o P C)\"\nby(simp add: fields_def Predicate.the_def eval_Fields_conv)\n\ncode_identifier\n  code_module TypeRel \\<rightharpoonup>\n    (SML) TypeRel and (Haskell) TypeRel and (OCaml) TypeRel\n| code_module Decl \\<rightharpoonup>\n    (SML) TypeRel and (Haskell) TypeRel and (OCaml) TypeRel\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Common/TypeRel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102775181399, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3315398284783987}}
{"text": "section \"Ignore Failures\"\n\ntheory ignore_fails\n  imports execution_invariants utils simulation_proofs\nbegin\n\n\ntext \"In this section we show that we do not handle crashes (action @{term ACrash}) in order to prove \ncorrectness.\nThe main idea is that we we cannot distinguish a crash from arbitrary long waiting.\"\n\n\ntext_raw \\<open>\\DefineSnippet{can_ignore_fails}{\\<close>\nlemma can_ignore_fails:\n  shows \"(\\<forall>tr\\<in>traces program. traceCorrect tr) \n  \\<longleftrightarrow> (\\<forall>tr\\<in>traces program. (\\<nexists>s. (s, ACrash) \\<in> set tr) \\<longrightarrow>  traceCorrect tr)\"\ntext_raw \\<open>}%EndSnippet\\<close>\nproof (rule iffI2; clarsimp)\n  fix tr\n  assume is_trace: \"tr \\<in> traces program\"\n    and tr_fail: \"\\<not> traceCorrect tr\"\n\n  from this obtain aFail S' \n    where \"aFail\\<in>set tr\" \n      and \"\\<not>actionCorrect (get_action aFail)\"\n      and \"initialState program ~~ tr \\<leadsto>* S'\"\n    by (auto simp add: traceCorrect_def traces_def)  \n\n\n  text \\<open>\n  Idea: a failed node and a node without progress are not really distinguishable in practice.\n  In our semantics there are two small differences:\n  \n  1) state is different after failure\n\\<close>\n\n  show \"\\<exists>tr\\<in>traces program. (\\<forall>s. (s, ACrash) \\<notin> set tr) \\<and> \\<not> traceCorrect tr\"\n  proof (rule bexI[where x=\"[x\\<leftarrow>tr . \\<not>isACrash (get_action x)]\"], intro conjI allI)\n\n    show \"\\<And>s. (s, ACrash) \\<notin> set [x\\<leftarrow>tr . \\<not>isACrash (get_action x)]\"\n      by (auto simp add: isACrash_def)\n\n    show \"\\<not> traceCorrect [tr\\<leftarrow>tr . \\<not> isACrash (get_action tr)]\"\n      using tr_fail by (auto simp add: traceCorrect_def isACrash_def actionCorrect_def, force+)\n\n\n\n    from \\<open>initialState program ~~ tr \\<leadsto>* S'\\<close>\n    have \"\\<exists>S''. (initialState program ~~ [tr\\<leftarrow>tr . \\<not> isACrash (get_action tr)] \\<leadsto>* S'') \n        \\<and> (\n           calls S'' = calls S'\n         \\<and> happensBefore S'' = happensBefore S'\n         \\<and> prog S'' = prog S'\n         \\<and> txStatus S'' = txStatus S' \n         \\<and> callOrigin S'' = callOrigin S' \n         \\<and> txOrigin S'' = txOrigin S' \n         \\<and> generatedIds S'' = generatedIds S' \n         \\<and> knownIds S'' = knownIds S' \n         \\<and> invocOp S'' = invocOp S' \n         \\<and> invocRes S'' = invocRes S'\n         \\<and> (\\<forall>s. (s, ACrash) \\<notin> set tr \\<longrightarrow> ( \n             localState S'' s = localState S' s\n           \\<and> currentTx S'' s = currentTx S' s\n           \\<and> currentProc S'' s = currentProc S' s\n           \\<and> visibleCalls S'' s = visibleCalls S' s \n         ))\n        )\"                      \n    proof (induct rule: trace_simulationProof)\n      case initial                    \n      then show ?case by auto\n    next\n      case f_empty_to_empty\n      then show ?case by auto\n    next\n      case (induct_step tr a S1 S2 S1')\n      from steps_append2[OF induct_step.steps2]\n      have [simp]: \"(initialState program ~~ [tr\\<leftarrow>tr . \\<not> isACrash (get_action tr)] @ trb \\<leadsto>* C) \\<longleftrightarrow> (S2 ~~ trb \\<leadsto>* C)\" for trb C .\n\n\n      from \\<open>S1 ~~ a \\<leadsto> S1'\\<close>\n      show ?case \n      proof (cases rule: step.cases)\n        case (local s ls f failed ls')\n\n        from \\<open>initialState program ~~ tr \\<leadsto>* S1\\<close> \\<open>localState S1 s \\<triangleq> ls\\<close>\n        have no_fail: \"(s, ACrash) \\<notin> set tr\"\n          by (metis (full_types) everything_starts_with_an_invocation in_set_conv_nth option.simps(3))\n\n        show ?thesis \n          by (rule exI[where x=\"S2\\<lparr>localState := localState S2(s \\<mapsto> ls')\\<rparr>\"],\n              intro conjI,\n              insert induct_step.coupling no_fail local,\n              auto simp add: step_simps state_ext local induct_step steps_single)\n      next\n        case (newId s ls f ls' uid uidv ls'')\n        from \\<open>initialState program ~~ tr \\<leadsto>* S1\\<close> \\<open>localState S1 s \\<triangleq> ls\\<close>\n        have no_fail: \"(s, ACrash) \\<notin> set tr\"\n          by (metis (full_types) everything_starts_with_an_invocation in_set_conv_nth option.simps(3))\n\n        show ?thesis \n          by (rule exI[where x=\"S2\\<lparr>localState := localState S2(s \\<mapsto> ls''), generatedIds := (generatedIds S2)(uid \\<mapsto> s )\\<rparr>\"],\n              insert induct_step.coupling no_fail newId,\n              auto simp add: step_simps state_ext  induct_step steps_single)\n\n      next\n        case (beginAtomic s ls f ls' t vis snapshot)\n        from \\<open>initialState program ~~ tr \\<leadsto>* S1\\<close> \\<open>localState S1 s \\<triangleq> ls\\<close>\n        have no_fail: \"(s, ACrash) \\<notin> set tr\"\n          by (metis (full_types) everything_starts_with_an_invocation in_set_conv_nth option.simps(3))\n\n\n        show ?thesis \n          by (rule exI[where x=\"S2\\<lparr>\n                  localState := localState S2(s \\<mapsto> ls'), \n                  currentTx := currentTx S2(s \\<mapsto> t), \n                  txStatus := txStatus S1(t \\<mapsto> Uncommitted),\n                  txOrigin := txOrigin S2(t \\<mapsto> s),\n                  visibleCalls := visibleCalls S2(s \\<mapsto> snapshot)\\<rparr>\"],\n              insert induct_step.coupling no_fail beginAtomic,\n              auto simp add: step_simps state_ext  induct_step steps_single )\n\n      next\n        case (endAtomic s ls f ls' t)\n        from \\<open>initialState program ~~ tr \\<leadsto>* S1\\<close> \\<open>localState S1 s \\<triangleq> ls\\<close>\n        have no_fail: \"(s, ACrash) \\<notin> set tr\"\n          by (metis (full_types) everything_starts_with_an_invocation in_set_conv_nth option.simps(3))\n\n        show ?thesis \n          by (rule exI[where x=\"S2\\<lparr>localState := localState S2(s \\<mapsto> ls'), currentTx := (currentTx S2)(s := None), txStatus := txStatus S1(t \\<mapsto> Committed)\\<rparr>\"],\n              insert induct_step.coupling no_fail endAtomic,\n              auto simp add: step_simps state_ext  induct_step steps_single)\n      next\n        case (dbop s ls f Op ls' t c res vis)\n        from \\<open>initialState program ~~ tr \\<leadsto>* S1\\<close> \\<open>localState S1 s \\<triangleq> ls\\<close>\n        have no_fail: \"(s, ACrash) \\<notin> set tr\"\n          by (metis (full_types) everything_starts_with_an_invocation in_set_conv_nth option.simps(3))\n\n        show ?thesis \n          by (rule exI[where x=\"S2\\<lparr>localState := localState S2(s \\<mapsto> ls' res), calls := calls S2(c \\<mapsto> Call Op res), callOrigin := callOrigin S1(c \\<mapsto> t), visibleCalls := visibleCalls S2(s \\<mapsto> vis \\<union> {c}), happensBefore := happensBefore S1 \\<union> vis \\<times> {c}\\<rparr>\"],\n              insert induct_step.coupling no_fail dbop,\n              auto simp add: step_simps state_ext  induct_step steps_single)\n\n      next\n        case (invocation s procName initialLocalState impl)\n        from \\<open>initialState program ~~ tr \\<leadsto>* S1\\<close> \\<open>invocOp S1 s = None\\<close>\n        have no_fail: \"(s, ACrash) \\<notin> set tr\"\n          by (meson everything_starts_with_an_invocation in_set_conv_nth)\n\n        show ?thesis \n          by (rule exI[where x=\"S2\\<lparr>localState := localState S2(s \\<mapsto> initialLocalState), currentProc := currentProc S2(s \\<mapsto> impl), visibleCalls := visibleCalls S2(s \\<mapsto> {}), invocOp := invocOp S2(s \\<mapsto> procName)\\<rparr>\"],\n              insert induct_step.coupling no_fail invocation,\n              auto simp add: step_simps state_ext  induct_step steps_single)\n      next\n        case (return s ls f res)\n        from \\<open>initialState program ~~ tr \\<leadsto>* S1\\<close> \\<open>localState S1 s \\<triangleq> ls\\<close>\n        have no_fail: \"(s, ACrash) \\<notin> set tr\"\n          by (metis (full_types) everything_starts_with_an_invocation in_set_conv_nth option.simps(3))\n\n        show ?thesis \n          by (rule exI[where x=\"S2\\<lparr>localState := (localState S2)(s := None), currentProc := (currentProc S2)(s := None), visibleCalls := (visibleCalls S2)(s := None), invocRes := invocRes S1(s \\<mapsto> res), knownIds := knownIds S1 \\<union> uniqueIds res\\<rparr>\"],\n              insert induct_step.coupling no_fail return,\n              auto simp add: step_simps state_ext  induct_step steps_single)\n      next\n        case (crash s ls)\n        from \\<open>initialState program ~~ tr \\<leadsto>* S1\\<close> \\<open>localState S1 s \\<triangleq> ls\\<close>\n        have no_fail: \"(s, ACrash) \\<notin> set tr\"\n          by (metis (full_types) everything_starts_with_an_invocation in_set_conv_nth option.simps(3))\n        show ?thesis \n          by (rule exI[where x=\"S2\"],\n              auto simp add: step_simps state_ext  induct_step  crash)\n\n      next\n        case (invCheck res s)\n\n        show ?thesis \n          by (rule exI[where x=\"S2\"],\n              insert  induct_step.coupling  invCheck,\n              auto simp add: step_simps state_ext  induct_step steps_single)\n      qed\n    qed\n\n\n    then show \"[tr\\<leftarrow>tr . \\<not> isACrash (get_action tr)] \\<in> traces program\"\n      by (auto simp add: traces_def)\n  qed\nqed\n\n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/ignore_fails.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102498375401, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3315398139898095}}
{"text": "theory Inca_to_Ubx_compiler\n  imports Inca_to_Ubx_simulation Result\n    \"VeriComp.Compiler\"\n    \"HOL-Library.Monad_Syntax\"\nbegin\n\nsection \\<open>Generic program rewriting\\<close>\n\nprimrec monadic_fold_map where\n  \"monadic_fold_map f acc [] = Some (acc, [])\" |\n  \"monadic_fold_map f acc (x # xs) = do {\n    (acc', x') \\<leftarrow> f acc x;\n    (acc'', xs') \\<leftarrow> monadic_fold_map f acc' xs;\n    Some (acc'', x' # xs')\n  }\"\n\nlemma monadic_fold_map_length:\n  \"monadic_fold_map f acc xs = Some (acc', xs') \\<Longrightarrow> length xs = length xs'\"\n  by (induction xs arbitrary: acc xs') (auto simp: bind_eq_Some_conv)\n\nlemma monadic_fold_map_ConsD[dest]:\n  assumes \"monadic_fold_map f a (x # xs) = Some (c, ys)\"\n  shows \"\\<exists>y ys' b. ys = y # ys' \\<and> f a x = Some (b, y) \\<and> monadic_fold_map f b xs = Some (c, ys')\"\n  using assms\n  by (auto simp add: bind_eq_Some_conv)\n\nlemma monadic_fold_map_list_all2:\n  assumes \"monadic_fold_map f acc xs = Some (acc', ys)\" and\n    \"\\<And>acc acc' x y. f acc x = Some (acc', y) \\<Longrightarrow> P x y\"\n  shows \"list_all2 P xs ys\"\n  using assms(1)\nproof (induction xs arbitrary: acc ys)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons x xs)\n  show ?case\n    using Cons.prems\n    by (auto simp: bind_eq_Some_conv intro: assms(2) Cons.IH)\nqed\n\nlemma monadic_fold_map_list_all:\n  assumes \"monadic_fold_map f acc xs = Some (acc', ys)\" and\n    \"\\<And>acc acc' x y. f acc x = Some (acc', y) \\<Longrightarrow> P y\"\n  shows \"list_all P ys\"\nproof -\n  have \"list_all2 (\\<lambda>_. P) xs ys\"\n    using assms\n    by (auto elim: monadic_fold_map_list_all2)\n  thus ?thesis\n    by (auto elim: list_rel_imp_pred2)\nqed\n\nfun gen_pop_push where\n  \"gen_pop_push instr (domain, codomain) \\<Sigma> = (\n    let ar = length domain in\n    if ar \\<le> length \\<Sigma> \\<and> take ar \\<Sigma> = domain then\n      Some (instr, codomain @ drop ar \\<Sigma>)\n    else\n      None\n  )\"\n\ncontext inca_to_ubx_simulation begin\n\nsection \\<open>Lifting\\<close>\n\nfun lift_instr where\n  \"lift_instr F L ret N (Inca.IPush d) \\<Sigma> = Some (IPush d, None # \\<Sigma>)\" |\n  \"lift_instr F L ret N Inca.IPop (_ # \\<Sigma>) = Some (IPop, \\<Sigma>)\" |\n  \"lift_instr F L ret N (Inca.IGet n) \\<Sigma> = (if n < N then Some (IGet n, None # \\<Sigma>) else None)\" |\n  \"lift_instr F L ret N (Inca.ISet n) (None # \\<Sigma>) = (if n < N then Some (ISet n, \\<Sigma>) else None)\" |\n  \"lift_instr F L ret N (Inca.ILoad x) (None # \\<Sigma>) = Some (ILoad x, None # \\<Sigma>)\" |\n  \"lift_instr F L ret N (Inca.IStore x) (None # None # \\<Sigma>) = Some (IStore x, \\<Sigma>)\" |\n  \"lift_instr F L ret N (Inca.IOp op) \\<Sigma> =\n    gen_pop_push (IOp op) (replicate (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> op) None, [None]) \\<Sigma>\" |\n  \"lift_instr F L ret N (Inca.IOpInl opinl) \\<Sigma> =\n    gen_pop_push (IOpInl opinl) (replicate (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl)) None, [None]) \\<Sigma>\" |\n  \"lift_instr F L ret N (Inca.ICJump l\\<^sub>t l\\<^sub>f) [None] =\n    (if List.member L l\\<^sub>t \\<and> List.member L l\\<^sub>f then Some (ICJump l\\<^sub>t l\\<^sub>f, []) else None)\" |\n  \"lift_instr F L ret N (Inca.ICall f) \\<Sigma> = do {\n    (ar, ret) \\<leftarrow> F f;\n    gen_pop_push (ICall f) (replicate ar None, replicate ret None) \\<Sigma>\n  }\" |\n  \"lift_instr F L ret N Inca.IReturn \\<Sigma> =\n    (if \\<Sigma> = replicate ret None then Some (IReturn, []) else None)\" |\n  \"lift_instr _ _ _ _ _ _ = None\"\n\ndefinition lift_instrs where\n  \"lift_instrs F L ret N \\<equiv>\n    monadic_fold_map (\\<lambda>\\<Sigma> instr. map_option prod.swap (lift_instr F L ret N instr \\<Sigma>))\"\n\nlemma lift_instrs_length:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"length xs = length ys\"\n  using assms unfolding lift_instrs_def\n  by (auto intro: monadic_fold_map_length)\n\nlemma lift_instrs_not_Nil: \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys) \\<Longrightarrow> xs \\<noteq> [] \\<longleftrightarrow> ys \\<noteq> []\"\n  using lift_instrs_length by fastforce\n\nlemma lift_instrs_NilD[dest]:\n  assumes \"lift_instrs F L ret N \\<Sigma>i [] = Some (\\<Sigma>o, ys)\"\n  shows \"\\<Sigma>o = \\<Sigma>i \\<and> ys = []\"\n  using assms\n  by (simp_all add: lift_instrs_def)\n\nlemmas Some_eq_bind_conv =\n  bind_eq_Some_conv[unfolded eq_commute[of \"Option.bind f g\" \"Some x\" for f g x]]\n\nlemma lift_instr_is_jump:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Inca.is_jump x \\<longleftrightarrow> Ubx.is_jump y\"\n  using assms\n  by (rule lift_instr.elims)\n    (auto simp add: if_split_eq2 Let_def Some_eq_bind_conv)\n\nlemma lift_instr_is_return:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Inca.is_return x \\<longleftrightarrow> Ubx.is_return y\"\n  using assms\n  by (rule lift_instr.elims)\n    (auto simp add: if_split_eq2 Let_def Some_eq_bind_conv)\n\nlemma lift_instrs_all_not_jump_not_return:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows\n    \"list_all (\\<lambda>i. \\<not> Inca.is_jump i \\<and> \\<not> Inca.is_return i) xs \\<longleftrightarrow>\n     list_all (\\<lambda>i. \\<not> Ubx.is_jump i \\<and> \\<not> Ubx.is_return i) ys\"\n  using assms\nproof (induction xs arbitrary: \\<Sigma>i \\<Sigma>o ys)\n  case Nil\n  then show ?case by (simp add: lift_instrs_def)\nnext\n  case (Cons x xs)\n  from Cons.prems show ?case\n    apply (simp add: lift_instrs_def bind_eq_Some_conv)\n    apply (fold lift_instrs_def)\n    by (auto simp add: Cons.IH lift_instr_is_jump lift_instr_is_return)\nqed\n\nlemma lift_instrs_all_butlast_not_jump_not_return:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows\n    \"list_all (\\<lambda>i. \\<not> Inca.is_jump i \\<and> \\<not> Inca.is_return i) (butlast xs) \\<longleftrightarrow>\n     list_all (\\<lambda>i. \\<not> Ubx.is_jump i \\<and> \\<not> Ubx.is_return i) (butlast ys)\"\n  using lift_instrs_length[OF assms(1)] assms unfolding lift_instrs_def\nproof (induction xs ys arbitrary: \\<Sigma>i \\<Sigma>o rule: list_induct2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons x xs y ys)\n  thus ?case\n    by (auto simp add: bind_eq_Some_conv lift_instr_is_jump lift_instr_is_return)\nqed\n\nlemma lift_instr_sp:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.sp_instr F ret y \\<Sigma>i \\<Sigma>o\"\n  using assms\n  apply (induction F L ret N x \\<Sigma>i rule: lift_instr.induct;\n      auto simp: Let_def intro: Subx.sp_instr.intros)\n    apply (rule Subx.sp_instr.Op, metis append_take_drop_id)\n   apply (rule Subx.sp_instr.OpInl, metis append_take_drop_id)\n  apply (auto simp add: bind_eq_Some_conv intro!: Subx.sp_instr.Call, metis append_take_drop_id)\n  done\n\nlemma lift_instrs_sp:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"Subx.sp_instrs F ret ys \\<Sigma>i \\<Sigma>o\"\n  using assms unfolding lift_instrs_def\nproof (induction xs arbitrary: \\<Sigma>i \\<Sigma>o ys)\n  case Nil\n  thus ?case by (auto intro: Subx.sp_instrs.Nil)\nnext\n  case (Cons x xs)\n  from Cons.prems show ?case\n    by (auto simp add: bind_eq_Some_conv intro: Subx.sp_instrs.Cons lift_instr_sp Cons.IH)\nqed\n\nlemma lift_instr_fun_call_in_range:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.fun_call_in_range F y\"\n  using assms\n  by (induction F L ret N x \\<Sigma>i rule: lift_instr.induct) (auto simp: Let_def bind_eq_Some_conv)\n\nlemma lift_instrs_all_fun_call_in_range:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.fun_call_in_range F) ys\"\n  using assms unfolding lift_instrs_def\n  by (auto intro!: monadic_fold_map_list_all intro: lift_instr_fun_call_in_range)\n\nlemma lift_instr_local_var_in_range:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.local_var_in_range N y\"\n  using assms\n  by (induction F L ret N x \\<Sigma>i rule: lift_instr.induct) (auto simp: Let_def bind_eq_Some_conv)\n\nlemma lift_instrs_all_local_var_in_range:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.local_var_in_range N) ys\"\n  using assms unfolding lift_instrs_def\n  by (auto intro!: monadic_fold_map_list_all intro: lift_instr_local_var_in_range)\n\nlemma lift_instr_jump_in_range:\n  assumes \"lift_instr F L ret N x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.jump_in_range (set L) y\"\n  using assms\n  by (induction F L ret N x \\<Sigma>i rule: lift_instr.induct)\n    (auto simp: Let_def bind_eq_Some_conv in_set_member)\n\nlemma lift_instrs_all_jump_in_range:\n  assumes \"lift_instrs F L ret N \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.jump_in_range (set L)) ys\"\n  using assms unfolding lift_instrs_def\n  by (auto intro!: monadic_fold_map_list_all intro: lift_instr_jump_in_range)\n\nlemma lift_instr_norm:\n  \"lift_instr F L ret N instr1 \\<Sigma>1 = Some (instr2, \\<Sigma>2) \\<Longrightarrow> norm_eq instr1 instr2\"\n  by (induction instr1 \\<Sigma>1 rule: lift_instr.induct) (auto simp: Let_def bind_eq_Some_conv)\n\nlemma lift_instrs_all_norm:\n  assumes \"lift_instrs F L ret N \\<Sigma>1 instrs1 = Some (\\<Sigma>2, instrs2)\"\n  shows \"list_all2 norm_eq instrs1 instrs2\"\n  using assms unfolding lift_instrs_def\n  by (auto simp: lift_instr_norm elim!: monadic_fold_map_list_all2)\n\n\nsection \\<open>Optimization\\<close>\n\ncontext\n  fixes load_oracle :: \"nat \\<Rightarrow> type option\"\nbegin\n\ndefinition orelse :: \"'a option \\<Rightarrow> 'a option \\<Rightarrow> 'a option\"  (infixr \"orelse\" 55) where\n  \"x orelse y = (case x of Some x' \\<Rightarrow> Some x' | None \\<Rightarrow> y)\"\n\nlemma orelse_eq_Some_conv:\n  \"x orelse y = Some z \\<longleftrightarrow> (x = Some z \\<or> x = None \\<and> y = Some z)\"\n  by (cases x) (simp_all add: orelse_def)\n\nlemma orelse_eq_SomeE:\n  assumes\n    \"x orelse y = Some z\" and\n    \"x = Some z \\<Longrightarrow> P\" and\n    \"x = None \\<Longrightarrow> y = Some z \\<Longrightarrow> P\"\n  shows \"P\"\n  using assms(1)\n  unfolding orelse_def\n  by (cases x; auto intro: assms(2,3))\n\nfun drop_prefix where\n  \"drop_prefix [] ys = Some ys\" |\n  \"drop_prefix (x # xs) (y # ys) = (if x = y then drop_prefix xs ys else None)\" |\n  \"drop_prefix _ _ = None \"\n\nlemma drop_prefix_eq_Some_conv: \"drop_prefix xs ys = Some zs \\<longleftrightarrow> ys = xs @ zs\"\n  by (induction xs ys arbitrary: zs rule: drop_prefix.induct)\n    (auto simp: if_split_eq1)\n\nfun optim_instr where\n  \"optim_instr _ _ _ (IPush d) \\<Sigma> =\n    Some Pair \\<diamondop> (Some IPushUbx1 \\<diamondop> (unbox_ubx1 d)) \\<diamondop> Some (Some Ubx1 # \\<Sigma>) orelse\n    Some Pair \\<diamondop> (Some IPushUbx2 \\<diamondop> (unbox_ubx2 d)) \\<diamondop> Some (Some Ubx2 # \\<Sigma>) orelse\n    Some (IPush d, None # \\<Sigma>)\n  \" |\n  \"optim_instr _ _ _ (IPushUbx1 n) \\<Sigma> = Some (IPushUbx1 n, Some Ubx1 # \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IPushUbx2 b) \\<Sigma> = Some (IPushUbx2 b, Some Ubx2 # \\<Sigma>)\" |\n  \"optim_instr _ _ _ IPop (_ # \\<Sigma>) = Some (IPop, \\<Sigma>)\" |\n  \"optim_instr _ _ pc (IGet n) \\<Sigma> =\n    map_option (\\<lambda>\\<tau>. (IGetUbx \\<tau> n, Some \\<tau> # \\<Sigma>)) (load_oracle pc) orelse\n    Some (IGet n, None # \\<Sigma>)\" |\n  \"optim_instr _ _ pc (IGetUbx \\<tau> n) \\<Sigma> = Some (IGetUbx \\<tau> n, Some \\<tau> # \\<Sigma>)\" |\n  \"optim_instr _ _ _ (ISet n) (None # \\<Sigma>) = Some (ISet n, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (ISet n) (Some \\<tau> # \\<Sigma>) = Some (ISetUbx \\<tau> n, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (ISetUbx _ n) (None # \\<Sigma>) = Some (ISet n, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (ISetUbx _ n) (Some \\<tau> # \\<Sigma>) = Some (ISetUbx \\<tau> n, \\<Sigma>)\" |\n  \"optim_instr _ _ pc (ILoad x) (None # \\<Sigma>) =\n    map_option (\\<lambda>\\<tau>. (ILoadUbx \\<tau> x, Some \\<tau> # \\<Sigma>)) (load_oracle pc) orelse\n    Some (ILoad x, None # \\<Sigma>)\" |\n  \"optim_instr _ _ _ (ILoadUbx \\<tau> x) (None # \\<Sigma>) = Some (ILoadUbx \\<tau> x, Some \\<tau> # \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IStore x) (None # None # \\<Sigma>) = Some (IStore x, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IStore x) (None # Some \\<tau> # \\<Sigma>) = Some (IStoreUbx \\<tau> x, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IStoreUbx _ x) (None # None # \\<Sigma>) = Some (IStore x, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IStoreUbx _ x) (None # Some \\<tau> # \\<Sigma>) = Some (IStoreUbx \\<tau> x, \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IOp op) \\<Sigma> =\n    map_option (\\<lambda>\\<Sigma>o. (IOp op, None # \\<Sigma>o)) (drop_prefix (replicate (\\<AA>\\<rr>\\<ii>\\<tt>\\<yy> op) None) \\<Sigma>)\" |\n  \"optim_instr _ _ _ (IOpInl opinl) \\<Sigma> = (\n    let ar = \\<AA>\\<rr>\\<ii>\\<tt>\\<yy> (\\<DD>\\<ee>\\<II>\\<nn>\\<ll> opinl) in\n    if ar \\<le> length \\<Sigma> then\n      case \\<UU>\\<bb>\\<xx> opinl (take ar \\<Sigma>) of\n        None \\<Rightarrow> map_option (\\<lambda>\\<Sigma>o. (IOpInl opinl, None # \\<Sigma>o)) (drop_prefix (replicate ar None) \\<Sigma>) |\n        Some opubx \\<Rightarrow> map_option (\\<lambda>\\<Sigma>o. (IOpUbx opubx, snd (\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp> opubx) # \\<Sigma>o))\n          (drop_prefix (fst (\\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp> opubx)) \\<Sigma>)\n    else\n      None\n  )\" |\n  \"optim_instr _ _ _ (IOpUbx opubx) \\<Sigma> =\n    (let p = \\<TT>\\<yy>\\<pp>\\<ee>\\<OO>\\<ff>\\<OO>\\<pp> opubx in\n     map_option (\\<lambda>\\<Sigma>o. (IOpUbx opubx, snd p # \\<Sigma>o)) (drop_prefix (fst p) \\<Sigma>))\" |\n  \"optim_instr _ _ _ (ICJump l\\<^sub>t l\\<^sub>f) [None] = Some (ICJump l\\<^sub>t l\\<^sub>f, []) \" |\n  \"optim_instr F _ _ (ICall f) \\<Sigma> = do {\n    (ar, ret) \\<leftarrow> F f;\n    \\<Sigma>o \\<leftarrow> drop_prefix (replicate ar None) \\<Sigma>;\n    Some (ICall f, replicate ret None @ \\<Sigma>o)\n  }\" |\n  \"optim_instr _ ret _ IReturn \\<Sigma> = (if \\<Sigma> = replicate ret None then Some (IReturn, []) else None)\" |\n  \"optim_instr _ _ _ _ _ = None\"\n\ndefinition optim_instrs where\n  \"optim_instrs F ret \\<equiv> \\<lambda>pc \\<Sigma>i instrs.\n    map_option (\\<lambda>((_, \\<Sigma>o), instrs'). (\\<Sigma>o, instrs'))\n      (monadic_fold_map (\\<lambda>(pc, \\<Sigma>) instr.\n        map_option (\\<lambda>(instr', \\<Sigma>o). ((Suc pc, \\<Sigma>o), instr')) (optim_instr F ret pc instr \\<Sigma>))\n      (pc, \\<Sigma>i) instrs)\"\n\nlemma optim_instrs_length:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"length xs = length ys\"\n  using assms unfolding optim_instrs_def\n  by (auto intro: monadic_fold_map_length)\n\nlemma optim_instrs_not_Nil: \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys) \\<Longrightarrow> xs \\<noteq> [] \\<longleftrightarrow> ys \\<noteq> []\"\n  using optim_instrs_length by fastforce\n\nlemma optim_instrs_NilD[dest]:\n  assumes \"optim_instrs F ret pc \\<Sigma>i [] = Some (\\<Sigma>o, ys)\"\n  shows \"\\<Sigma>o = \\<Sigma>i \\<and> ys = []\"\n  using assms\n  by (simp_all add: optim_instrs_def)\n\nlemma optim_instrs_ConsD[dest]:\n  assumes \"optim_instrs F ret pc \\<Sigma>i (x # xs) = Some (\\<Sigma>o, ys)\"\n  shows \"\\<exists>y ys' \\<Sigma>. ys = y # ys' \\<and>\n    optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>) \\<and>\n    optim_instrs F ret (Suc pc) \\<Sigma> xs = Some (\\<Sigma>o, ys')\"\n  using assms\n  unfolding optim_instrs_def\n  by (auto simp: bind_eq_Some_conv)\n\nlemma optim_instr_norm:\n  assumes \"optim_instr F ret pc instr1 \\<Sigma>1 = Some (instr2, \\<Sigma>2)\"\n  shows \"norm_instr instr1 = norm_instr instr2\"\n  using assms\n  by (cases \"(F, ret, pc, instr1, \\<Sigma>1)\" rule: optim_instr.cases)\n    (auto simp: ap_option_eq_Some_conv Let_def if_split_eq1 bind_eq_Some_conv option.case_eq_if\n      orelse_eq_Some_conv\n      dest!: Subx.box_unbox_inverse dest: Subx.\\<UU>\\<bb>\\<xx>_invertible)\n\nlemma optim_instrs_all_norm:\n  assumes \"optim_instrs F ret pc \\<Sigma>1 instrs1 = Some (\\<Sigma>2, instrs2)\"\n  shows \"list_all2 (\\<lambda>i1 i2. norm_instr i1 = norm_instr i2) instrs1 instrs2\"\n  using assms unfolding optim_instrs_def\n  by (auto simp: optim_instr_norm elim!: monadic_fold_map_list_all2)\n\nlemma optim_instr_is_jump:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"is_jump x \\<longleftrightarrow> is_jump y\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases;\n      simp add: orelse_eq_Some_conv ap_option_eq_Some_conv bind_eq_Some_conv\n        Let_def if_split_eq1 option.case_eq_if;\n      safe; simp)\n\nlemma optim_instr_is_return:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"is_return x \\<longleftrightarrow> is_return y\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases;\n      simp add: orelse_eq_Some_conv ap_option_eq_Some_conv bind_eq_Some_conv\n        Let_def if_split_eq1 option.case_eq_if;\n      safe; simp)\n\nlemma optim_instrs_all_butlast_not_jump_not_return:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows\n    \"list_all (\\<lambda>i. \\<not> is_jump i \\<and> \\<not> is_return i) (butlast xs) \\<longleftrightarrow>\n     list_all (\\<lambda>i. \\<not> is_jump i \\<and> \\<not> is_return i) (butlast ys)\"\n  using optim_instrs_length[OF assms(1)] assms\nproof (induction xs ys arbitrary: pc \\<Sigma>i \\<Sigma>o rule: list_induct2)\n  case Nil\n  thus ?case by simp\nnext\n  case (Cons x xs y ys)\n  from Cons.prems obtain \\<Sigma> where\n    optim_x: \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>)\" and\n    optim_xs: \"optim_instrs F ret (Suc pc) \\<Sigma> xs = Some (\\<Sigma>o, ys)\"\n    by auto\n  show ?case\n    using Cons.hyps\n    using optim_x optim_xs\n    apply (simp add: Cons.IH optim_instr_is_jump optim_instr_is_return)\n    by fastforce\nqed\n\nlemma optim_instr_jump_in_range:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.jump_in_range L x \\<longleftrightarrow> Subx.jump_in_range L y\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases)\n    (auto simp: ap_option_eq_Some_conv Let_def if_split_eq1 option.case_eq_if\n      bind_eq_Some_conv orelse_eq_Some_conv)\n\nlemma optim_instrs_all_jump_in_range:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.jump_in_range L) xs \\<longleftrightarrow> list_all (Subx.jump_in_range L) ys\"\n  using assms\n  by (induction xs arbitrary: pc \\<Sigma>i \\<Sigma>o ys) (auto simp: optim_instr_jump_in_range)\n\nlemma optim_instr_fun_call_in_range:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.fun_call_in_range F x \\<longleftrightarrow> Subx.fun_call_in_range F y\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases)\n    (auto simp: ap_option_eq_Some_conv Let_def if_split_eq1 option.case_eq_if\n      bind_eq_Some_conv orelse_eq_Some_conv)\n\nlemma optim_instrs_all_fun_call_in_range:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.fun_call_in_range F) xs \\<longleftrightarrow> list_all (Subx.fun_call_in_range F) ys\"\n  using assms\n  by (induction xs arbitrary: pc \\<Sigma>i \\<Sigma>o ys) (auto simp: optim_instr_fun_call_in_range)\n\nlemma optim_instr_local_var_in_range:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.local_var_in_range N x \\<longleftrightarrow> Subx.local_var_in_range N y\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases)\n    (auto simp: ap_option_eq_Some_conv Let_def if_split_eq1 option.case_eq_if\n      bind_eq_Some_conv orelse_eq_Some_conv)\n\nlemma optim_instrs_all_local_var_in_range:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"list_all (Subx.local_var_in_range N) xs \\<longleftrightarrow> list_all (Subx.local_var_in_range N) ys\"\n  using assms\n  by (induction xs arbitrary: pc \\<Sigma>i \\<Sigma>o ys) (auto simp: optim_instr_local_var_in_range)\n\nlemma optim_instr_sp:\n  assumes \"optim_instr F ret pc x \\<Sigma>i = Some (y, \\<Sigma>o)\"\n  shows \"Subx.sp_instr F ret y \\<Sigma>i \\<Sigma>o\"\n  using assms\n  by (cases \"(F, ret, pc, x, \\<Sigma>i)\" rule: optim_instr.cases)\n    (auto simp add: Let_def if_split_eq1 option.case_eq_if\n      simp: ap_option_eq_Some_conv orelse_eq_Some_conv drop_prefix_eq_Some_conv bind_eq_Some_conv\n      intro: Subx.sp_instr.intros)\n\nlemma optim_instrs_sp:\n  assumes \"optim_instrs F ret pc \\<Sigma>i xs = Some (\\<Sigma>o, ys)\"\n  shows \"Subx.sp_instrs F ret ys \\<Sigma>i \\<Sigma>o\"\n  using assms\n  by (induction xs arbitrary: pc \\<Sigma>i \\<Sigma>o ys)\n    (auto intro!: Subx.sp_instrs.intros optim_instr_sp)\n\n\nsection \\<open>Compilation of function definition\\<close>\n\ndefinition lift_basic_block where\n  \"lift_basic_block F L ret N \\<equiv>\n    ap_map_prod Some (\\<lambda>i1. do {\n      _ \\<leftarrow> if i1 \\<noteq> [] then Some () else None;\n      _ \\<leftarrow> if list_all (\\<lambda>i. \\<not> Inca.is_jump i \\<and> \\<not> Inca.is_return i) (butlast i1) then Some () else None;\n      (\\<Sigma>o, i2) \\<leftarrow> lift_instrs F L ret N ([] :: type option list) i1;\n      (\\<Sigma>o', i2') \\<leftarrow> optim_instrs F ret 0 ([] :: type option list) i2;\n      (if \\<Sigma>o' = [] then\n        Some i2'\n      else (if \\<Sigma>o = [] then\n        Some i2\n      else\n        None))\n    })\"\n\nlemma lift_basic_block_rel_prod_all_norm_eq:\n  assumes \"lift_basic_block F L ret N bblock1 = Some bblock2\"\n  shows \"rel_prod (=) (list_all2 norm_eq) bblock1 bblock2\"\n  using assms\n  unfolding lift_basic_block_def\n  apply (auto simp add: ap_map_prod_eq_Some_conv bind_eq_Some_conv\n      simp: if_split_eq1\n      intro: lift_instrs_all_norm\n      dest!: optim_instrs_all_norm lift_instrs_all_norm)\n  subgoal for _ xs zs ys\n    using list_all2_trans[of norm_eq \"\\<lambda>i. norm_eq (norm_instr i)\" norm_eq xs ys zs, simplified]\n    by simp\n  done\n\nlemma list_all_iff_butlast_last:\n  assumes \"xs \\<noteq> []\"\n  shows \"list_all P xs \\<longleftrightarrow> list_all P (butlast xs) \\<and> P (last xs)\"\n  using assms\n  by (induction xs) auto\n\nlemma lift_basic_block_wf:\n  assumes \"lift_basic_block F L ret N x = Some y\"\n  shows \"Subx.wf_basic_block F (set L) ret N y\"\nproof -\n  obtain f instrs1 \\<Sigma>2 instrs2 \\<Sigma>3 instrs3 instrs4 where\n    x_def: \"x = (f, instrs1)\" and\n    y_def: \"y = (f, instrs4)\" and\n    \"instrs1 \\<noteq> []\" and\n    all_not_jump_not_return_instrs1:\n      \"list_all (\\<lambda>i. \\<not> Inca.is_jump i \\<and> \\<not> Inca.is_return i) (butlast instrs1)\" and\n    lift_instrs1: \"lift_instrs F L ret N ([] :: type option list) instrs1 = Some (\\<Sigma>2, instrs2)\" and\n    optim_instrs2: \"optim_instrs F ret 0 ([] :: type option list) instrs2 = Some (\\<Sigma>3, instrs3)\" and\n    instr4_defs: \"instrs4 = instrs3 \\<and> \\<Sigma>3 = [] \\<or> instrs4 = instrs2 \\<and> \\<Sigma>2 = []\"\n    using assms\n    unfolding lift_basic_block_def ap_map_prod_eq_Some_conv\n    apply (auto simp: bind_eq_Some_conv if_split_eq1)\n    by auto\n\n  have \"instrs4 \\<noteq> []\"\n    using instr4_defs \\<open>instrs1 \\<noteq> []\\<close>\n    using lift_instrs_not_Nil[OF lift_instrs1]\n    using optim_instrs_not_Nil[OF optim_instrs2]\n    by meson\n  moreover have \"list_all (Subx.local_var_in_range N) instrs4\"\n    using instr4_defs lift_instrs1 optim_instrs2\n    by (auto dest: lift_instrs_all_local_var_in_range simp: optim_instrs_all_local_var_in_range)\n  moreover have \"list_all (Subx.fun_call_in_range F) instrs4\"\n    using instr4_defs lift_instrs1 optim_instrs2\n    by (auto dest: lift_instrs_all_fun_call_in_range simp: optim_instrs_all_fun_call_in_range)\n  moreover have \"list_all (Subx.jump_in_range (set L)) instrs4\"\n    using instr4_defs lift_instrs1 optim_instrs2\n    by (auto dest: lift_instrs_all_jump_in_range simp: optim_instrs_all_jump_in_range)\n  moreover have \"list_all (\\<lambda>i. \\<not> Ubx.instr.is_jump i \\<and> \\<not> Ubx.instr.is_return i) (butlast instrs4)\"\n    using instr4_defs lift_instrs1 optim_instrs2 all_not_jump_not_return_instrs1\n    by (auto simp:\n        lift_instrs_all_butlast_not_jump_not_return\n        optim_instrs_all_butlast_not_jump_not_return)\n  moreover have \"Subx.sp_instrs F ret instrs4 [] []\"\n    using instr4_defs lift_instrs1 optim_instrs2\n    by (auto intro: lift_instrs_sp optim_instrs_sp)\n  ultimately show ?thesis\n    by (auto simp: y_def intro!: Subx.wf_basic_blockI)\nqed\n\nfun compile_fundef where\n  \"compile_fundef F (Fundef bblocks1 ar ret locals) = do {\n    _ \\<leftarrow> if bblocks1 = [] then None else Some ();\n    bblocks2 \\<leftarrow> ap_map_list (lift_basic_block F (map fst bblocks1) ret (ar + locals)) bblocks1;\n    Some (Fundef bblocks2 ar ret locals)\n  }\"\n\nlemma compile_fundef_arities: \"compile_fundef F fd1 = Some fd2 \\<Longrightarrow> arity fd1 = arity fd2\"\n  by (cases fd1) (auto simp: bind_eq_Some_conv)\n\nlemma compile_fundef_returns: \"compile_fundef F fd1 = Some fd2 \\<Longrightarrow> return fd1 = return fd2\"\n  by (cases fd1) (auto simp: bind_eq_Some_conv)\n\nlemma compile_fundef_locals:\n  \"compile_fundef F fd1 = Some fd2 \\<Longrightarrow> fundef_locals fd1 = fundef_locals fd2\"\n  by (cases fd1) (auto simp: bind_eq_Some_conv)\n\nlemma if_then_None_else_Some_eq[simp]:\n  \"(if a then None else Some b) = Some c \\<longleftrightarrow> \\<not> a \\<and> b = c\"\n  \"(if a then None else Some b) = None \\<longleftrightarrow> a\"\n  by (cases a) simp_all\n\nlemma\n  assumes \"compile_fundef F fd1 = Some fd2\"\n  shows\n    rel_compile_fundef: \"rel_fundef (=) norm_eq fd1 fd2\" (is ?REL) and\n    wf_compile_fundef: \"Subx.wf_fundef F fd2\" (is ?WF)\n  unfolding atomize_conj\nproof (cases fd1)\n  case (Fundef bblocks1 ar ret locals)\n  with assms obtain bblocks2 where\n    \"bblocks1 \\<noteq> []\" and\n    lift_bblocks1:\n      \"ap_map_list (lift_basic_block F (map fst bblocks1) ret (ar + locals)) bblocks1 = Some bblocks2\" and\n    fd2_def: \"fd2 = Fundef bblocks2 ar ret locals\"\n    by (auto simp add: bind_eq_Some_conv)\n\n  show \"?REL \\<and> ?WF\"\n  proof (rule conjI)\n    show ?REL\n      unfolding Fundef fd2_def\n    proof (rule fundef.rel_intros)\n      show \"list_all2 (rel_prod (=) (list_all2 norm_eq)) bblocks1 bblocks2\"\n        using lift_bblocks1\n        unfolding ap_map_list_iff_list_all2\n        by (auto elim: list.rel_mono_strong intro: lift_basic_block_rel_prod_all_norm_eq)\n    qed simp_all\n  next\n    have \"bblocks2 \\<noteq> []\"\n      using \\<open>bblocks1 \\<noteq> []\\<close> length_ap_map_list[OF lift_bblocks1] by force\n    moreover have \"list_all (Subx.wf_basic_block F (fst ` set bblocks1) ret (ar + locals)) bblocks2\"\n      using lift_bblocks1\n      unfolding ap_map_list_iff_list_all2\n      by (auto elim!: list_rel_imp_pred2 dest: lift_basic_block_wf)\n    moreover have \"fst ` set bblocks1 = fst ` set bblocks2\"\n      using lift_bblocks1\n      unfolding ap_map_list_iff_list_all2\n      by (induction bblocks1 bblocks2 rule: list.rel_induct)\n        (auto simp add: lift_basic_block_def ap_map_prod_eq_Some_conv)\n    ultimately show ?WF\n      unfolding fd2_def\n      by (auto intro: Subx.wf_fundefI)\n  qed\nqed\n\nend\n\nend\n\nlocale inca_ubx_compiler =\n  inca_to_ubx_simulation Finca_empty Finca_get\n  for\n    Finca_empty and\n    Finca_get :: \"_ \\<Rightarrow> 'fun \\<Rightarrow> _ option\" +\n  fixes\n    load_oracle :: \"'fun \\<Rightarrow> nat \\<Rightarrow> type option\"\nbegin\n\n\nsection \\<open>Compilation of function environment\\<close>\n\ndefinition compile_env_entry where\n  \"compile_env_entry F \\<equiv> \\<lambda>p. ap_map_prod Some (compile_fundef (load_oracle (fst p)) F) p\"\n\nlemma rel_compile_env_entry:\n  assumes \"compile_env_entry F (f, fd1) = Some (f, fd2)\"\n  shows \"rel_fundef (=) norm_eq fd1 fd2\"\n  using assms unfolding compile_env_entry_def\n  by (auto simp: ap_map_prod_eq_Some_conv intro!: rel_compile_fundef)\n\ndefinition compile_env where\n  \"compile_env e \\<equiv> do {\n    let fundefs1 = Finca_to_list e;\n    fundefs2 \\<leftarrow> ap_map_list (compile_env_entry (map_option funtype \\<circ> Finca_get e)) fundefs1;\n    Some (Subx.Fenv.from_list fundefs2)\n  }\"\n\nlemma rel_ap_map_list_ap_map_list_compile_env_entries:\n  assumes \"ap_map_list (compile_env_entry F) xs = Some ys\"\n  shows \"rel_fundefs (Finca_get (Sinca.Fenv.from_list xs)) (Fubx_get (Subx.Fenv.from_list ys))\"\n  using assms\nproof (induction xs arbitrary: ys)\n  case Nil\n  thus ?case\n    using rel_fundefs_empty by simp\nnext\n  case (Cons x xs)\n  from Cons.prems obtain y ys' where\n    ys_def: \"ys = y # ys'\" and\n    compile_env_x: \"compile_env_entry F x = Some y\" and\n    compile_env_xs: \"ap_map_list (compile_env_entry F) xs = Some ys'\"\n    by (auto simp add: ap_option_eq_Some_conv)\n\n  obtain f fd1 fd2 where\n    prods: \"x = (f, fd1)\" \"y = (f, fd2)\" and \"compile_fundef (load_oracle f) F fd1 = Some fd2\"\n    using compile_env_x\n    by (cases x) (auto simp: compile_env_entry_def eq_fst_iff ap_map_prod_eq_Some_conv)\n\n  have \"rel_fundef (=) norm_eq fd1 fd2\"\n    using compile_env_x[unfolded prods]\n    by (auto intro: rel_compile_env_entry)\n  thus ?case\n    using Cons.IH[OF compile_env_xs, THEN rel_fundefsD]\n    unfolding prods ys_def\n    unfolding Sinca.Fenv.from_list_correct Subx.Fenv.from_list_correct\n    by (auto intro: rel_fundefsI)\nqed\n\nlemma rel_fundefs_compile_env:\n  assumes \"compile_env F1 = Some F2\"\n  shows \"rel_fundefs (Finca_get F1) (Fubx_get F2)\"\nproof -\n  from assms obtain xs where\n    ap_map_list_F1: \"ap_map_list (compile_env_entry (map_option funtype \\<circ> Finca_get F1)) (Finca_to_list F1) = Some xs\" and\n    F2_def: \"F2 = Subx.Fenv.from_list xs\"\n    by (auto simp: compile_env_def bind_eq_Some_conv)\n\n  show ?thesis\n    using rel_ap_map_list_ap_map_list_compile_env_entries[OF ap_map_list_F1]\n    unfolding F2_def Sinca.Fenv.get_from_list_to_list\n    by assumption\nqed\n\n\nsection \\<open>Compilation of program\\<close>\n\nfun compile where\n  \"compile (Prog F1 H f) = Some Prog \\<diamondop> compile_env F1 \\<diamondop> Some H \\<diamondop> Some f\"\n\nlemma ap_map_list_cong:\n  assumes \"\\<And>x. x \\<in> set ys \\<Longrightarrow> f x = g x\" and \"xs = ys\"\n  shows \"ap_map_list f xs = ap_map_list g ys\"\n  using assms\n  by (induction xs arbitrary: ys) auto\n\nlemma compile_env_wf_fundefs:\n  assumes \"compile_env F1 = Some F2\"\n  shows \"Subx.wf_fundefs (Fubx_get F2)\"\nproof (intro Subx.wf_fundefsI allI)\n  fix f\n  obtain xs where\n    ap_map_list_F1: \"ap_map_list (compile_env_entry (map_option funtype \\<circ> Finca_get F1)) (Finca_to_list F1) = Some xs\" and\n    F2_def: \"F2 = Subx.Fenv.from_list xs\"\n    using assms by (auto simp: compile_env_def bind_eq_Some_conv)\n\n  have rel_map_of_F1_xs:\n    \"\\<And>f. rel_option (\\<lambda>x y. compile_fundef (load_oracle f) (map_option funtype \\<circ> Finca_get F1) x = Some y)\n      (map_of (Finca_to_list F1) f) (map_of xs f)\"\n    using ap_map_list_F1\n    by (auto simp: compile_env_entry_def ap_map_prod_eq_Some_conv\n        dest: ap_map_list_imp_rel_option_map_of)\n\n  have funtype_F1_eq_funtype_F2:\n    \"map_option funtype \\<circ> Finca_get F1 = map_option funtype \\<circ> Fubx_get F2\"\n  proof (rule ext, simp)\n    fix x\n    show \"map_option funtype (Finca_get F1 x) = map_option funtype (Fubx_get F2 x)\"\n      unfolding F2_def Subx.Fenv.from_list_correct Sinca.Fenv.to_list_correct[symmetric]\n      using rel_map_of_F1_xs[of x]\n      by (cases rule: option.rel_cases)\n        (simp_all add: funtype_def compile_fundef_arities compile_fundef_returns)\n  qed\n\n  show \"pred_option (Subx.wf_fundef (map_option funtype \\<circ> Fubx_get F2)) (Fubx_get F2 f) \"\n  proof (cases \"map_of (Finca_to_list F1) f\")\n    case None\n    thus ?thesis\n      using rel_map_of_F1_xs[of f, unfolded None]\n      by (simp add: F2_def Subx.Fenv.from_list_correct)\n  next\n    case (Some fd1)\n    show ?thesis\n      using rel_map_of_F1_xs[of f, unfolded Some option_rel_Some1]\n      unfolding funtype_F1_eq_funtype_F2 F2_def Subx.Fenv.from_list_correct\n      by (auto intro: wf_compile_fundef)\n  qed\nqed\n\nlemma compile_load:\n  assumes\n    compile_p1: \"compile p1 = Some p2\" and\n    load: \"Subx.load p2 s2\"\n  shows \"\\<exists>s1. Sinca.load p1 s1 \\<and> match s1 s2\"\nproof -\n  obtain F1 H main where p1_def: \"p1 = Prog F1 H main\"\n    by (cases p1) simp\n  then obtain F2 where\n    compile_F1: \"compile_env F1 = Some F2\" and\n    p2_def: \"p2 = Prog F2 H main\"\n    using compile_p1\n    by (auto simp: ap_option_eq_Some_conv)\n\n  note rel_F1_F2 = rel_fundefs_compile_env[OF compile_F1]\n\n  show ?thesis\n    using assms(2) unfolding p2_def Subx.load_def\n  proof (cases _ _ _ s2 rule: Global.load.cases)\n    case (1 fd2)\n    then obtain fd1 where\n      F1_main: \"Finca_get F1 main = Some fd1\" and rel_fd1_fd2: \"rel_fundef (=) norm_eq fd1 fd2\"\n      using rel_fundefs_Some2[OF rel_F1_F2]\n      by auto\n      \n    let ?s1 = \"State F1 H [allocate_frame main fd1 [] uninitialized]\"\n\n    show ?thesis\n    proof (intro exI conjI)\n      show \"Sinca.load p1 ?s1\"\n        unfolding Sinca.load_def p1_def\n        using 1 F1_main rel_fd1_fd2\n        by (auto simp: rel_fundef_arities intro!: Global.load.intros dest: rel_fundef_body_length)\n    next\n      have \"Subx.wf_state s2\"\n        unfolding 1\n        using compile_F1\n        by (auto intro!: Subx.wf_stateI intro: compile_env_wf_fundefs)\n      then show \"match ?s1 s2\"\n        using 1 rel_F1_F2 rel_fd1_fd2\n        by (auto simp: allocate_frame_def rel_fundef_locals\n            simp: rel_fundef_rel_fst_hd_bodies[OF rel_fd1_fd2 disjI2]\n            intro!: match.intros rel_stacktraces.intros intro: Subx.sp_instrs.Nil)\n    qed\n  qed\nqed\n\ninterpretation std_to_inca_compiler:\n  compiler Sinca.step Subx.step \"final Finca_get Inca.IReturn\" \"final Fubx_get Ubx.IReturn\"\n    Sinca.load Subx.load\n    \"\\<lambda>_ _. False\" \"\\<lambda>_. match\" compile\nusing compile_load\n  by unfold_locales auto\n\nend\n\nend", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/Interpreter_Optimizations/Inca_to_Ubx_compiler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160666, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3315220333719305}}
{"text": "section \\<open>Data-flow Semantics\\<close>\n\ntheory IRTreeEval\n  imports\n    Graph.Stamp\nbegin\n\ntext \\<open>\nWe define a tree representation of data-flow nodes, as an abstraction of the graph view.\n\nData-flow trees are evaluated in the context of a method state\n(currently called MapState in the theories for historical reasons).\n\nThe method state consists of the values for each method parameter, references to\nmethod parameters use an index of the parameter within the parameter list, as such\nwe store a list of parameter values which are looked up at parameter references.\n\nThe method state also stores a mapping of node ids to values. The contents of this\nmapping is calculates during the traversal of the control flow graph.\n\nAs a concrete example, as the @{term SignedDivNode} can have side-effects\n(during division by zero), it is treated as part of the control-flow, since\nthe data-flow phase is specified to be side-effect free.\nAs a result, the control-flow semantics for @{term SignedDivNode} calculates the\nvalue of a node and maps the node identifier to the value within the method state.\nThe data-flow semantics then just reads the value stored in the method state for the node.\n\\<close>\n\ntype_synonym ID = nat\ntype_synonym MapState = \"ID \\<Rightarrow> Value\"\ntype_synonym Params = \"Value list\"\n\ndefinition new_map_state :: \"MapState\" where\n  \"new_map_state = (\\<lambda>x. UndefVal)\"\n\n\n(* ======================== START OF NEW TREE STUFF ==========================*)\nsubsection \\<open>Data-flow Tree Representation\\<close>\n\ndatatype IRUnaryOp =\n    UnaryAbs\n  | UnaryNeg\n  | UnaryNot\n  | UnaryLogicNegation\n  | UnaryNarrow (ir_inputBits: nat) (ir_resultBits: nat)\n  | UnarySignExtend (ir_inputBits: nat) (ir_resultBits: nat)\n  | UnaryZeroExtend (ir_inputBits: nat) (ir_resultBits: nat)\n\ndatatype IRBinaryOp =\n    BinAdd\n  | BinMul\n  | BinSub\n  | BinAnd\n  | BinOr\n  | BinXor\n  | BinShortCircuitOr\n  | BinLeftShift\n  | BinRightShift\n  | BinURightShift\n  | BinIntegerEquals\n  | BinIntegerLessThan\n  | BinIntegerBelow\n\ndatatype (discs_sels) IRExpr =\n    UnaryExpr (ir_uop: IRUnaryOp) (ir_value: IRExpr)\n  | BinaryExpr (ir_op: IRBinaryOp) (ir_x: IRExpr) (ir_y: IRExpr)\n  | ConditionalExpr (ir_condition: IRExpr) (ir_trueValue: IRExpr) (ir_falseValue: IRExpr)\n(* TODO\n  | IsNullNode (ir_value: IRExpr) \n  | RefNode ?\n*)\n  | ParameterExpr (ir_index: nat) (ir_stamp: Stamp)\n(* Not needed?\n  | PiNode (ir_object: IRExpr) (ir_guard_opt: \"IRExpr option\")\n  | ShortCircuitOrNode (ir_x: IRExpr) (ir_y: IRExpr)\n*)\n(* Not needed?\n  | UnwindNode (ir_exception: IRExpr) \n  | ValueProxyNode (ir_value: IRExpr) (ir_loopExit: IRExpr) \n*)\n  | LeafExpr (ir_nid: ID) (ir_stamp: Stamp)\n  (* LeafExpr is for pre-evaluated nodes, like LoadFieldNode, SignedDivNode. *) \n  | ConstantExpr (ir_const: Value) (* Ground constant *)\n  | ConstantVar (ir_name: string)  (* Pattern variable for constant *)\n  | VariableExpr (ir_name: string) (ir_stamp: Stamp) (* Pattern variable for expression *)\n\nfun is_ground :: \"IRExpr \\<Rightarrow> bool\" where\n  \"is_ground (UnaryExpr op e) = is_ground e\" |\n  \"is_ground (BinaryExpr op e1 e2) = (is_ground e1 \\<and> is_ground e2)\" |\n  \"is_ground (ConditionalExpr b e1 e2) = (is_ground b \\<and> is_ground e1 \\<and> is_ground e2)\" |\n  \"is_ground (ParameterExpr i s) = True\" |\n  \"is_ground (LeafExpr n s) = True\" |\n  \"is_ground (ConstantExpr v) = True\" |\n  \"is_ground (ConstantVar name) = False\" |\n  \"is_ground (VariableExpr name s) = False\"\n\ntypedef GroundExpr = \"{ e :: IRExpr . is_ground e }\"\n  using is_ground.simps(6) by blast\n\n\n\nsubsection \\<open>Functions for re-calculating stamps\\<close> \n\ntext \\<open>Note: in Java all integer calculations are done as 32 or 64 bit calculations.\n  However, here we generalise the operators to allow any size calculations.\n  Many operators have the same output bits as their inputs.\n  However, the unary integer operators that are not $normal\\_unary$ are narrowing \n  or widening operators, so the result bits is specified by the operator.\n  The binary integer operators are divided into three groups:\n  (1) $binary\\_fixed\\_32$ operators always output 32 bits,\n  (2) $binary\\_shift\\_ops$ operators output size is determined by their left argument,\n  and (3) other operators output the same number of bits as both their inputs.\n\\<close>\n\nabbreviation binary_fixed_32_ops :: \"IRBinaryOp set\" where\n  \"binary_fixed_32_ops \\<equiv> {BinShortCircuitOr, BinIntegerEquals, BinIntegerLessThan, BinIntegerBelow}\"\n\nabbreviation binary_shift_ops :: \"IRBinaryOp set\" where\n  \"binary_shift_ops \\<equiv> {BinLeftShift, BinRightShift, BinURightShift}\"\n\nabbreviation normal_unary :: \"IRUnaryOp set\" where\n  \"normal_unary \\<equiv> {UnaryAbs, UnaryNeg, UnaryNot, UnaryLogicNegation}\"\n\nfun stamp_unary :: \"IRUnaryOp \\<Rightarrow> Stamp \\<Rightarrow> Stamp\" where\n(* WAS:\n  \"stamp_unary op (IntegerStamp b lo hi) =\n    (let bits = (if op \\<in> normal_unary \n                 then (if b=64 then 64 else 32)\n                 else (ir_resultBits op)) in\n    unrestricted_stamp (IntegerStamp bits lo hi))\" |\n*)\n  \"stamp_unary op (IntegerStamp b lo hi) =\n     unrestricted_stamp (IntegerStamp (if op \\<in> normal_unary then b else (ir_resultBits op)) lo hi)\" |\n  (* for now... *)\n  \"stamp_unary op _ = IllegalStamp\"\n\nfun stamp_binary :: \"IRBinaryOp \\<Rightarrow> Stamp \\<Rightarrow> Stamp \\<Rightarrow> Stamp\" where\n  \"stamp_binary op (IntegerStamp b1 lo1 hi1) (IntegerStamp b2 lo2 hi2) =\n    (if op \\<in> binary_shift_ops then unrestricted_stamp (IntegerStamp b1 lo1 hi1)\n     else if b1 \\<noteq> b2 then IllegalStamp else\n      (if op \\<in> binary_fixed_32_ops\n       then unrestricted_stamp (IntegerStamp 32 lo1 hi1)\n       else unrestricted_stamp (IntegerStamp b1 lo1 hi1)))\" |\n  (* for now... *)\n  \"stamp_binary op _ _ = IllegalStamp\"\n\nfun stamp_expr :: \"IRExpr \\<Rightarrow> Stamp\" where\n  \"stamp_expr (UnaryExpr op x) = stamp_unary op (stamp_expr x)\" |\n  \"stamp_expr (BinaryExpr bop x y) = stamp_binary bop (stamp_expr x) (stamp_expr y)\" |\n  \"stamp_expr (ConstantExpr val) = constantAsStamp val\" |\n  \"stamp_expr (LeafExpr i s) = s\" |\n  \"stamp_expr (ParameterExpr i s) = s\" |\n  \"stamp_expr (ConditionalExpr c t f) = meet (stamp_expr t) (stamp_expr f)\"\n\nexport_code stamp_unary stamp_binary stamp_expr\n\nsubsection \\<open>Data-flow Tree Evaluation\\<close>\n\nfun unary_eval :: \"IRUnaryOp \\<Rightarrow> Value \\<Rightarrow> Value\" where\n  \"unary_eval UnaryAbs v = intval_abs v\" |\n  \"unary_eval UnaryNeg v = intval_negate v\" |\n  \"unary_eval UnaryNot v = intval_not v\" |\n  \"unary_eval UnaryLogicNegation v = intval_logic_negation v\" |\n  \"unary_eval (UnaryNarrow inBits outBits) v = intval_narrow inBits outBits v\" |\n  \"unary_eval (UnarySignExtend inBits outBits) v = intval_sign_extend inBits outBits v\" |\n  \"unary_eval (UnaryZeroExtend inBits outBits) v = intval_zero_extend inBits outBits v\"\n(*  \"unary_eval op v1 = UndefVal\" *)\n\nfun bin_eval :: \"IRBinaryOp \\<Rightarrow> Value \\<Rightarrow> Value \\<Rightarrow> Value\" where\n  \"bin_eval BinAdd v1 v2 = intval_add v1 v2\" |\n  \"bin_eval BinMul v1 v2 = intval_mul v1 v2\" |\n  \"bin_eval BinSub v1 v2 = intval_sub v1 v2\" |\n  \"bin_eval BinAnd v1 v2 = intval_and v1 v2\" |\n  \"bin_eval BinOr  v1 v2 = intval_or v1 v2\" |\n  \"bin_eval BinXor v1 v2 = intval_xor v1 v2\" |\n  \"bin_eval BinShortCircuitOr v1 v2 = intval_short_circuit_or v1 v2\" |\n  \"bin_eval BinLeftShift v1 v2 = intval_left_shift v1 v2\" |\n  \"bin_eval BinRightShift v1 v2 = intval_right_shift v1 v2\" |\n  \"bin_eval BinURightShift v1 v2 = intval_uright_shift v1 v2\" |\n  \"bin_eval BinIntegerEquals v1 v2 = intval_equals v1 v2\" |\n  \"bin_eval BinIntegerLessThan v1 v2 = intval_less_than v1 v2\" |\n  \"bin_eval BinIntegerBelow v1 v2 = intval_below v1 v2\"\n(*  \"bin_eval op v1 v2 = UndefVal\" *)\n\nlemmas eval_thms =\n  intval_abs.simps intval_negate.simps intval_not.simps\n  intval_logic_negation.simps intval_narrow.simps\n  intval_sign_extend.simps intval_zero_extend.simps\n  intval_add.simps intval_mul.simps intval_sub.simps\n  intval_and.simps intval_or.simps intval_xor.simps\n  intval_left_shift.simps intval_right_shift.simps\n  intval_uright_shift.simps intval_equals.simps\n  intval_less_than.simps intval_below.simps\n\ninductive not_undef_or_fail :: \"Value \\<Rightarrow> Value \\<Rightarrow> bool\" where\n  \"\\<lbrakk>value \\<noteq> UndefVal\\<rbrakk> \\<Longrightarrow> not_undef_or_fail value value\"\n\nnotation (latex output) (* we can pretend intval_* are partial functions *)\n  not_undef_or_fail (\"_ = _\")\n\ninductive\n  evaltree :: \"MapState \\<Rightarrow> Params \\<Rightarrow> IRExpr \\<Rightarrow> Value \\<Rightarrow> bool\" (\"[_,_] \\<turnstile> _ \\<mapsto> _\" 55)\n  for m p where\n\n  ConstantExpr:\n  \"\\<lbrakk>wf_value c\\<rbrakk>\n    \\<Longrightarrow> [m,p] \\<turnstile> (ConstantExpr c) \\<mapsto> c\" |\n\n  ParameterExpr:\n  \"\\<lbrakk>i < length p; valid_value (p!i) s\\<rbrakk>\n    \\<Longrightarrow> [m,p] \\<turnstile> (ParameterExpr i s) \\<mapsto> p!i\" |\n\n  (* We need to add this to prove certain optimizations\n     but it also requires more work to show monotonicity of refinement.\n  compatible (stamp_expr te) (stamp_expr fe);*)\n  ConditionalExpr:\n  \"\\<lbrakk>[m,p] \\<turnstile> ce \\<mapsto> cond;\n    cond \\<noteq> UndefVal;\n    branch = (if val_to_bool cond then te else fe);\n    [m,p] \\<turnstile> branch \\<mapsto> result;\n    result \\<noteq> UndefVal\\<rbrakk>\n    \\<Longrightarrow> [m,p] \\<turnstile> (ConditionalExpr ce te fe) \\<mapsto> result\" |\n\n  UnaryExpr:\n  \"\\<lbrakk>[m,p] \\<turnstile> xe \\<mapsto> x;\n    result = (unary_eval op x);\n    result \\<noteq> UndefVal\\<rbrakk>\n    \\<Longrightarrow> [m,p] \\<turnstile> (UnaryExpr op xe) \\<mapsto> result\" |\n\n  BinaryExpr:\n  \"\\<lbrakk>[m,p] \\<turnstile> xe \\<mapsto> x;\n    [m,p] \\<turnstile> ye \\<mapsto> y;\n    result = (bin_eval op x y);\n    result \\<noteq> UndefVal\\<rbrakk>\n    \\<Longrightarrow> [m,p] \\<turnstile> (BinaryExpr op xe ye) \\<mapsto> result\" |\n\n  LeafExpr:\n  \"\\<lbrakk>val = m n;\n    valid_value val s\\<rbrakk>\n    \\<Longrightarrow> [m,p] \\<turnstile> LeafExpr n s \\<mapsto> val\"\n\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool as evalT)\n  [show_steps,show_mode_inference,show_intermediate_results] \n  evaltree .\n\ninductive\n  evaltrees :: \"MapState \\<Rightarrow> Params \\<Rightarrow> IRExpr list \\<Rightarrow> Value list \\<Rightarrow> bool\" (\"[_,_] \\<turnstile> _ \\<mapsto>\\<^sub>L _\" 55)\n  for m p where\n\n  EvalNil:\n  \"[m,p] \\<turnstile> [] \\<mapsto>\\<^sub>L []\" |\n\n  EvalCons:\n  \"\\<lbrakk>[m,p] \\<turnstile> x \\<mapsto> xval;\n    [m,p] \\<turnstile> yy \\<mapsto>\\<^sub>L yyval\\<rbrakk>\n    \\<Longrightarrow> [m,p] \\<turnstile> (x#yy) \\<mapsto>\\<^sub>L (xval#yyval)\"\n\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool as evalTs)\n  evaltrees .\n\ndefinition sq_param0 :: IRExpr where\n  \"sq_param0 = BinaryExpr BinMul \n    (ParameterExpr 0 (IntegerStamp 32 (- 2147483648) 2147483647))\n    (ParameterExpr 0 (IntegerStamp 32 (- 2147483648) 2147483647))\"\n\nvalues \"{v. evaltree new_map_state [IntVal 32 5] sq_param0 v}\"\n\n(* We add all the inductive rules as unsafe intro rules. *)\ndeclare evaltree.intros [intro]\ndeclare evaltrees.intros [intro]\n\n(* We derive a safe elimination (forward) reasoning rule for each case.\n  Note that each pattern is as general as possible. *)\ninductive_cases ConstantExprE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"[m,p] \\<turnstile> (ConstantExpr c) \\<mapsto> val\"\ninductive_cases ParameterExprE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"[m,p] \\<turnstile> (ParameterExpr i s) \\<mapsto> val\"\ninductive_cases ConditionalExprE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"[m,p] \\<turnstile> (ConditionalExpr c t f) \\<mapsto> val\"\ninductive_cases UnaryExprE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"[m,p] \\<turnstile> (UnaryExpr op xe) \\<mapsto> val\"\ninductive_cases BinaryExprE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"[m,p] \\<turnstile> (BinaryExpr op xe ye) \\<mapsto> val\"\ninductive_cases LeafExprE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"[m,p] \\<turnstile> (LeafExpr n s) \\<mapsto> val\"\ninductive_cases ConstantVarE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"[m,p] \\<turnstile> (ConstantVar x) \\<mapsto> val\"\ninductive_cases VariableExprE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"[m,p] \\<turnstile> (VariableExpr x s) \\<mapsto> val\"\ninductive_cases EvalNilE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"[m,p] \\<turnstile> [] \\<mapsto>\\<^sub>L vals\"\ninductive_cases EvalConsE[elim!]:\\<^marker>\\<open>tag invisible\\<close>\n  \"[m,p] \\<turnstile> (x#yy) \\<mapsto>\\<^sub>L vals\"\n\n(* group these forward rules into a named set *)\nlemmas EvalTreeE\\<^marker>\\<open>tag invisible\\<close> = \n  ConstantExprE\n  ParameterExprE\n  ConditionalExprE\n  UnaryExprE\n  BinaryExprE\n  LeafExprE\n  ConstantVarE\n  VariableExprE\n  EvalNilE\n  EvalConsE\n\nsubsection \\<open>Data-flow Tree Refinement\\<close>\n\ntext \\<open>We define the induced semantic equivalence relation between expressions.\n  Note that syntactic equality implies semantic equivalence, but not vice versa.\n\\<close>\ndefinition equiv_exprs :: \"IRExpr \\<Rightarrow> IRExpr \\<Rightarrow> bool\" (\"_ \\<doteq> _\" 55) where\n  \"(e1 \\<doteq> e2) = (\\<forall> m p v. (([m,p] \\<turnstile> e1 \\<mapsto> v) \\<longleftrightarrow> ([m,p] \\<turnstile> e2 \\<mapsto> v)))\"\n\n\ntext \\<open>We also prove that this is a total equivalence relation (@{term \"equivp equiv_exprs\"})\n  (HOL.Equiv\\_Relations), so that we can reuse standard results about equivalence relations.\n\\<close>\nlemma \"equivp equiv_exprs\"\n  apply (auto simp add: equivp_def equiv_exprs_def)\n  by (metis equiv_exprs_def)+\n\n\ntext \\<open>We define a refinement ordering over IRExpr and show that it is a preorder.\n  Note that it is asymmetric because e2 may refer to fewer variables than e1.\n\\<close>\ninstantiation IRExpr :: preorder begin\n\nnotation less_eq (infix \"\\<sqsubseteq>\" 65)\n\ndefinition\n  le_expr_def [simp]:\n    \"(e\\<^sub>2 \\<le> e\\<^sub>1) \\<longleftrightarrow> (\\<forall> m p v. (([m,p] \\<turnstile> e\\<^sub>1 \\<mapsto> v) \\<longrightarrow> ([m,p] \\<turnstile> e\\<^sub>2 \\<mapsto> v)))\"\n\ndefinition\n  lt_expr_def [simp]:\n    \"(e\\<^sub>1 < e\\<^sub>2) \\<longleftrightarrow> (e\\<^sub>1 \\<le> e\\<^sub>2 \\<and> \\<not> (e\\<^sub>1 \\<doteq> e\\<^sub>2))\"\n\ninstance proof \n  fix x y z :: IRExpr\n  show \"x < y \\<longleftrightarrow> x \\<le> y \\<and> \\<not> (y \\<le> x)\" by (simp add: equiv_exprs_def; auto)\n  show \"x \\<le> x\" by simp\n  show \"x \\<le> y \\<Longrightarrow> y \\<le> z \\<Longrightarrow> x \\<le> z\" by simp \nqed\n\nend\n\nabbreviation (output) Refines :: \"IRExpr \\<Rightarrow> IRExpr \\<Rightarrow> bool\" (infix \"\\<sqsupseteq>\" 64)\n  where \"e\\<^sub>1 \\<sqsupseteq> e\\<^sub>2 \\<equiv> (e\\<^sub>2 \\<le> e\\<^sub>1)\"\n\n\nsubsection \\<open>Stamp Masks\\<close>\n\ntext \\<open>\nA stamp can contain additional range information in the form of masks.\nA stamp has an up mask and a down mask,\ncorresponding to a the bits that may be set and the bits that must be set.\n\nExamples:\n  A stamp where no range information is known will have;\n    an up mask of -1 as all bits may be set, and\n    a down mask of 0 as no bits must be set.\n\n  A stamp known to be one should have;\n    an up mask of 1 as only the first bit may be set, no others, and\n    a down mask of 1 as the first bit must be set and no others.\n\nWe currently don't carry mask information in stamps,\nand instead assume correct masks to prove optimizations.\n\\<close>\n\nlocale stamp_mask =\n  fixes up :: \"IRExpr \\<Rightarrow> int64\" (\"\\<up>\")\n  fixes down :: \"IRExpr \\<Rightarrow> int64\" (\"\\<down>\")\n  assumes up_spec: \"[m, p] \\<turnstile> e \\<mapsto> IntVal b v \\<Longrightarrow> (and v (not ((ucast (\\<up>e))))) = 0\"\n      and down_spec: \"[m, p] \\<turnstile> e \\<mapsto> IntVal b v \\<Longrightarrow> (and (not v) (ucast (\\<down>e))) = 0\"\nbegin\n\nlemma may_implies_either:\n  \"[m, p] \\<turnstile> e \\<mapsto> IntVal b v \\<Longrightarrow> bit (\\<up>e) n \\<Longrightarrow> bit v n = False \\<or> bit v n = True\"\n  by simp\n\nlemma not_may_implies_false:\n  \"[m, p] \\<turnstile> e \\<mapsto> IntVal b v \\<Longrightarrow> \\<not>(bit (\\<up>e) n) \\<Longrightarrow> bit v n = False\"\n  using up_spec\n  using bit_and_iff bit_eq_iff bit_not_iff bit_unsigned_iff down_spec\n  by (smt (verit, best) bit.double_compl)\n\nlemma must_implies_true:\n  \"[m, p] \\<turnstile> e \\<mapsto> IntVal b v \\<Longrightarrow> bit (\\<down>e) n \\<Longrightarrow> bit v n = True\"\n  using down_spec\n  by (metis bit.compl_one bit_and_iff bit_minus_1_iff bit_not_iff impossible_bit ucast_id)\n\nlemma not_must_implies_either:\n  \"[m, p] \\<turnstile> e \\<mapsto> IntVal b v \\<Longrightarrow> \\<not>(bit (\\<down>e) n) \\<Longrightarrow> bit v n = False \\<or> bit v n = True\"\n  by simp\n\nlemma must_implies_may:\n  \"[m, p] \\<turnstile> e \\<mapsto> IntVal b v \\<Longrightarrow> n < 32 \\<Longrightarrow> bit (\\<down>e) n \\<Longrightarrow> bit (\\<up>e) n\"\n  by (meson must_implies_true not_may_implies_false)\n\n\nlemma up_mask_and_zero_implies_zero:\n  assumes \"and (\\<up>x) (\\<up>y) = 0\"\n  assumes \"[m, p] \\<turnstile> x \\<mapsto> IntVal b xv\"\n  assumes \"[m, p] \\<turnstile> y \\<mapsto> IntVal b yv\"\n  shows \"and xv yv = 0\"\n  using assms\n  by (smt (z3) and.commute and.right_neutral and_zero_eq bit.compl_zero bit.conj_cancel_right bit.conj_disj_distribs(1) ucast_id up_spec word_bw_assocs(1) word_not_dist(2))\n\nlemma not_down_up_mask_and_zero_implies_zero:\n  assumes \"and (not (\\<down>x)) (\\<up>y) = 0\"\n  assumes \"[m, p] \\<turnstile> x \\<mapsto> IntVal b xv\"\n  assumes \"[m, p] \\<turnstile> y \\<mapsto> IntVal b yv\"\n  shows \"and xv yv = yv\"\n  using assms\n  by (smt (z3) and_zero_eq bit.conj_cancel_left bit.conj_disj_distribs(1) bit.conj_disj_distribs(2) bit.de_Morgan_disj down_spec or_eq_not_not_and ucast_id up_spec word_ao_absorbs(2) word_ao_absorbs(8) word_bw_lcs(1) word_not_dist(2))\n\nend\n\ndefinition IRExpr_up :: \"IRExpr \\<Rightarrow> int64\" where\n  \"IRExpr_up e = not 0\"\n\ndefinition IRExpr_down :: \"IRExpr \\<Rightarrow> int64\" where\n  \"IRExpr_down e = 0\"\n\nlemma ucast_zero: \"(ucast (0::int64)::int32) = 0\"\n  by simp\n\nlemma ucast_minus_one: \"(ucast (-1::int64)::int32) = -1\"\n  apply transfer by auto\n\ninterpretation simple_mask: stamp_mask\n  \"IRExpr_up :: IRExpr \\<Rightarrow> int64\"\n  \"IRExpr_down :: IRExpr \\<Rightarrow> int64\"\n  unfolding IRExpr_up_def IRExpr_down_def\n  apply unfold_locales\n  by (simp add: ucast_minus_one)+\n\nend\n", "meta": {"author": "uqcyber", "repo": "veriopt-releases", "sha": "4ffab3c91bbd699772889dbf263bb6d2582256d7", "save_path": "github-repos/isabelle/uqcyber-veriopt-releases", "path": "github-repos/isabelle/uqcyber-veriopt-releases/veriopt-releases-4ffab3c91bbd699772889dbf263bb6d2582256d7/Semantics/IRTreeEval.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3315220333719304}}
{"text": "(*  Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n\nDatatype of events; function \"spies\"; freshness\n\n\"bad\" agents have been broken by the Spy; their private keys and internal\n    stores are visible to him\n*)(*<*)\n\nsection{*Theory of Events for Security Protocols*}\n\ntheory Event imports Message begin\n\nconsts  (*Initial states of agents -- parameter of the construction*)\n  initState :: \"agent => msg set\"\n\ndatatype\n  event = Says  agent agent msg\n        | Gets  agent       msg\n        | Notes agent       msg\n       \nconsts \n  bad    :: \"agent set\"                         -- {* compromised agents *}\n\n\ntext{*The constant \"spies\" is retained for compatibility's sake*}\n\nprimrec\n  knows :: \"agent => event list => msg set\"\nwhere\n  knows_Nil:   \"knows A [] = initState A\"\n| knows_Cons:\n    \"knows A (ev # evs) =\n       (if A = Spy then \n        (case ev of\n           Says A' B X => insert X (knows Spy evs)\n         | Gets A' X => knows Spy evs\n         | Notes A' X  => \n             if A' \\<in> bad then insert X (knows Spy evs) else knows Spy evs)\n        else\n        (case ev of\n           Says A' B X => \n             if A'=A then insert X (knows A evs) else knows A evs\n         | Gets A' X    => \n             if A'=A then insert X (knows A evs) else knows A evs\n         | Notes A' X    => \n             if A'=A then insert X (knows A evs) else knows A evs))\"\n\nabbreviation (input)\n  spies  :: \"event list => msg set\" where\n  \"spies == knows Spy\"\n\ntext{*Spy has access to his own key for spoof messages, but Server is secure*}\nspecification (bad)\n  Spy_in_bad     [iff]: \"Spy \\<in> bad\"\n  Server_not_bad [iff]: \"Server \\<notin> bad\"\n    by (rule exI [of _ \"{Spy}\"], simp)\n\n(*\n  Case A=Spy on the Gets event\n  enforces the fact that if a message is received then it must have been sent,\n  therefore the oops case must use Notes\n*)\n\nprimrec\n  (*Set of items that might be visible to somebody:\n    complement of the set of fresh items*)\n  used :: \"event list => msg set\"\nwhere\n  used_Nil:   \"used []         = (UN B. parts (initState B))\"\n| used_Cons:  \"used (ev # evs) =\n                     (case ev of\n                        Says A B X => parts {X} \\<union> used evs\n                      | Gets A X   => used evs\n                      | Notes A X  => parts {X} \\<union> used evs)\"\n    --{*The case for @{term Gets} seems anomalous, but @{term Gets} always\n        follows @{term Says} in real protocols.  Seems difficult to change.\n        See @{text Gets_correct} in theory @{text \"Guard/Extensions.thy\"}. *}\n\nlemma Notes_imp_used [rule_format]: \"Notes A X \\<in> set evs --> X \\<in> used evs\"\napply (induct_tac evs)\napply (auto split: event.split) \ndone\n\nlemma Says_imp_used [rule_format]: \"Says A B X \\<in> set evs --> X \\<in> used evs\"\napply (induct_tac evs)\napply (auto split: event.split) \ndone\n\n\nsubsection{*Function @{term knows}*}\n\n(*Simplifying   \n parts(insert X (knows Spy evs)) = parts{X} \\<union> parts(knows Spy evs).\n  This version won't loop with the simplifier.*)\nlemmas parts_insert_knows_A = parts_insert [of _ \"knows A evs\"] for A evs\n\n\n\ntext{*Letting the Spy see \"bad\" agents' notes avoids redundant case-splits\n      on whether @{term \"A=Spy\"} and whether @{term \"A\\<in>bad\"}*}\nlemma knows_Spy_Notes [simp]:\n     \"knows Spy (Notes A X # evs) =  \n          (if A:bad then insert X (knows Spy evs) else knows Spy evs)\"\nby simp\n\nlemma knows_Spy_Gets [simp]: \"knows Spy (Gets A X # evs) = knows Spy evs\"\nby simp\n\nlemma knows_Spy_subset_knows_Spy_Says:\n     \"knows Spy evs \\<subseteq> knows Spy (Says A B X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_Spy_subset_knows_Spy_Notes:\n     \"knows Spy evs \\<subseteq> knows Spy (Notes A X # evs)\"\nby force\n\nlemma knows_Spy_subset_knows_Spy_Gets:\n     \"knows Spy evs \\<subseteq> knows Spy (Gets A X # evs)\"\nby (simp add: subset_insertI)\n\ntext{*Spy sees what is sent on the traffic*}\nlemma Says_imp_knows_Spy [rule_format]:\n     \"Says A B X \\<in> set evs --> X \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\nlemma Notes_imp_knows_Spy [rule_format]:\n     \"Notes A X \\<in> set evs --> A: bad --> X \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\n\ntext{*Elimination rules: derive contradictions from old Says events containing\n  items known to be fresh*}\nlemmas knows_Spy_partsEs =\n     Says_imp_knows_Spy [THEN parts.Inj, elim_format] \n     parts.Body [elim_format]\n\nlemmas Says_imp_analz_Spy = Says_imp_knows_Spy [THEN analz.Inj]\n\ntext{*Compatibility for the old \"spies\" function*}\nlemmas spies_partsEs = knows_Spy_partsEs\nlemmas Says_imp_spies = Says_imp_knows_Spy\nlemmas parts_insert_spies = parts_insert_knows_A [of _ Spy]\n\n\nsubsection{*Knowledge of Agents*}\n\nlemma knows_Says: \"knows A (Says A B X # evs) = insert X (knows A evs)\"\nby simp\n\nlemma knows_Notes: \"knows A (Notes A X # evs) = insert X (knows A evs)\"\nby simp\n\nlemma knows_Gets:\n     \"A \\<noteq> Spy --> knows A (Gets A X # evs) = insert X (knows A evs)\"\nby simp\n\n\nlemma knows_subset_knows_Says: \"knows A evs \\<subseteq> knows A (Says A' B X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_subset_knows_Notes: \"knows A evs \\<subseteq> knows A (Notes A' X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_subset_knows_Gets: \"knows A evs \\<subseteq> knows A (Gets A' X # evs)\"\nby (simp add: subset_insertI)\n\ntext{*Agents know what they say*}\nlemma Says_imp_knows [rule_format]: \"Says A B X \\<in> set evs --> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext{*Agents know what they note*}\nlemma Notes_imp_knows [rule_format]: \"Notes A X \\<in> set evs --> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext{*Agents know what they receive*}\nlemma Gets_imp_knows_agents [rule_format]:\n     \"A \\<noteq> Spy --> Gets A X \\<in> set evs --> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\n\ntext{*What agents DIFFERENT FROM Spy know \n  was either said, or noted, or got, or known initially*}\nlemma knows_imp_Says_Gets_Notes_initState [rule_format]:\n     \"[| X \\<in> knows A evs; A \\<noteq> Spy |] ==> EX B.  \n  Says A B X \\<in> set evs | Gets A X \\<in> set evs | Notes A X \\<in> set evs | X \\<in> initState A\"\napply (erule rev_mp)\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext{*What the Spy knows -- for the time being --\n  was either said or noted, or known initially*}\nlemma knows_Spy_imp_Says_Notes_initState [rule_format]:\n     \"[| X \\<in> knows Spy evs |] ==> EX A B.  \n  Says A B X \\<in> set evs | Notes A X \\<in> set evs | X \\<in> initState Spy\"\napply (erule rev_mp)\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\nlemma parts_knows_Spy_subset_used: \"parts (knows Spy evs) \\<subseteq> used evs\"\napply (induct_tac \"evs\", force)  \napply (simp add: parts_insert_knows_A knows_Cons add: event.split, blast) \ndone\n\nlemmas usedI = parts_knows_Spy_subset_used [THEN subsetD, intro]\n\nlemma initState_into_used: \"X \\<in> parts (initState B) ==> X \\<in> used evs\"\napply (induct_tac \"evs\")\napply (simp_all add: parts_insert_knows_A split: event.split, blast)\ndone\n\nlemma used_Says [simp]: \"used (Says A B X # evs) = parts{X} \\<union> used evs\"\nby simp\n\nlemma used_Notes [simp]: \"used (Notes A X # evs) = parts{X} \\<union> used evs\"\nby simp\n\nlemma used_Gets [simp]: \"used (Gets A X # evs) = used evs\"\nby simp\n\nlemma used_nil_subset: \"used [] \\<subseteq> used evs\"\napply simp\napply (blast intro: initState_into_used)\ndone\n\ntext{*NOTE REMOVAL--laws above are cleaner, as they don't involve \"case\"*}\ndeclare knows_Cons [simp del]\n        used_Nil [simp del] used_Cons [simp del]\n\n\ntext{*For proving theorems of the form @{term \"X \\<notin> analz (knows Spy evs) --> P\"}\n  New events added by induction to \"evs\" are discarded.  Provided \n  this information isn't needed, the proof will be much shorter, since\n  it will omit complicated reasoning about @{term analz}.*}\n\nlemmas analz_mono_contra =\n       knows_Spy_subset_knows_Spy_Says [THEN analz_mono, THEN contra_subsetD]\n       knows_Spy_subset_knows_Spy_Notes [THEN analz_mono, THEN contra_subsetD]\n       knows_Spy_subset_knows_Spy_Gets [THEN analz_mono, THEN contra_subsetD]\n\nlemmas analz_impI = impI [where P = \"Y \\<notin> analz (knows Spy evs)\"] for Y evs\n\nML\n{*\nfun analz_mono_contra_tac ctxt =\n  resolve_tac ctxt @{thms analz_impI} THEN' \n  REPEAT1 o (dresolve_tac ctxt @{thms analz_mono_contra})\n  THEN' mp_tac ctxt\n*}\n\nlemma knows_subset_knows_Cons: \"knows A evs \\<subseteq> knows A (e # evs)\"\nby (induct e, auto simp: knows_Cons)\n\nlemma initState_subset_knows: \"initState A \\<subseteq> knows A evs\"\napply (induct_tac evs, simp) \napply (blast intro: knows_subset_knows_Cons [THEN subsetD])\ndone\n\n\ntext{*For proving @{text new_keys_not_used}*}\nlemma keysFor_parts_insert:\n     \"[| K \\<in> keysFor (parts (insert X G));  X \\<in> synth (analz H) |] \n      ==> K \\<in> keysFor (parts (G \\<union> H)) | Key (invKey K) \\<in> parts H\" \nby (force \n    dest!: parts_insert_subset_Un [THEN keysFor_mono, THEN [2] rev_subsetD]\n           analz_subset_parts [THEN keysFor_mono, THEN [2] rev_subsetD]\n    intro: analz_subset_parts [THEN subsetD] parts_mono [THEN [2] rev_subsetD])\n\nmethod_setup analz_mono_contra = {*\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (analz_mono_contra_tac ctxt))) *}\n    \"for proving theorems of the form X \\<notin> analz (knows Spy evs) --> P\"\n\nsubsubsection{*Useful for case analysis on whether a hash is a spoof or not*}\n\nlemmas syan_impI = impI [where P = \"Y \\<notin> synth (analz (knows Spy evs))\"] for Y evs\n\nML\n{*\nval knows_Cons = @{thm knows_Cons};\nval used_Nil = @{thm used_Nil};\nval used_Cons = @{thm used_Cons};\n\nval Notes_imp_used = @{thm Notes_imp_used};\nval Says_imp_used = @{thm Says_imp_used};\nval Says_imp_knows_Spy = @{thm Says_imp_knows_Spy};\nval Notes_imp_knows_Spy = @{thm Notes_imp_knows_Spy};\nval knows_Spy_partsEs = @{thms knows_Spy_partsEs};\nval spies_partsEs = @{thms spies_partsEs};\nval Says_imp_spies = @{thm Says_imp_spies};\nval parts_insert_spies = @{thm parts_insert_spies};\nval Says_imp_knows = @{thm Says_imp_knows};\nval Notes_imp_knows = @{thm Notes_imp_knows};\nval Gets_imp_knows_agents = @{thm Gets_imp_knows_agents};\nval knows_imp_Says_Gets_Notes_initState = @{thm knows_imp_Says_Gets_Notes_initState};\nval knows_Spy_imp_Says_Notes_initState = @{thm knows_Spy_imp_Says_Notes_initState};\nval usedI = @{thm usedI};\nval initState_into_used = @{thm initState_into_used};\nval used_Says = @{thm used_Says};\nval used_Notes = @{thm used_Notes};\nval used_Gets = @{thm used_Gets};\nval used_nil_subset = @{thm used_nil_subset};\nval analz_mono_contra = @{thms analz_mono_contra};\nval knows_subset_knows_Cons = @{thm knows_subset_knows_Cons};\nval initState_subset_knows = @{thm initState_subset_knows};\nval keysFor_parts_insert = @{thm keysFor_parts_insert};\n\n\nval synth_analz_mono = @{thm synth_analz_mono};\n\nval knows_Spy_subset_knows_Spy_Says = @{thm knows_Spy_subset_knows_Spy_Says};\nval knows_Spy_subset_knows_Spy_Notes = @{thm knows_Spy_subset_knows_Spy_Notes};\nval knows_Spy_subset_knows_Spy_Gets = @{thm knows_Spy_subset_knows_Spy_Gets};\n\n\nfun synth_analz_mono_contra_tac ctxt = \n  resolve_tac ctxt @{thms syan_impI} THEN'\n  REPEAT1 o \n    (dresolve_tac ctxt\n     [@{thm knows_Spy_subset_knows_Spy_Says} RS @{thm synth_analz_mono} RS @{thm contra_subsetD},\n      @{thm knows_Spy_subset_knows_Spy_Notes} RS @{thm synth_analz_mono} RS @{thm contra_subsetD},\n      @{thm knows_Spy_subset_knows_Spy_Gets} RS @{thm synth_analz_mono} RS @{thm contra_subsetD}])\n  THEN'\n  mp_tac ctxt\n*}\n\nmethod_setup synth_analz_mono_contra = {*\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (synth_analz_mono_contra_tac ctxt))) *}\n    \"for proving theorems of the form X \\<notin> synth (analz (knows Spy evs)) --> P\"\n(*>*)\n\nsection{* Event Traces \\label{sec:events} *}\n\ntext {*\nThe system's behaviour is formalized as a set of traces of\n\\emph{events}.  The most important event, @{text \"Says A B X\"}, expresses\n$A\\to B : X$, which is the attempt by~$A$ to send~$B$ the message~$X$.\nA trace is simply a list, constructed in reverse\nusing~@{text \"#\"}.  Other event types include reception of messages (when\nwe want to make it explicit) and an agent's storing a fact.\n\nSometimes the protocol requires an agent to generate a new nonce. The\nprobability that a 20-byte random number has appeared before is effectively\nzero.  To formalize this important property, the set @{term \"used evs\"}\ndenotes the set of all items mentioned in the trace~@{text evs}.\nThe function @{text used} has a straightforward\nrecursive definition.  Here is the case for @{text Says} event:\n@{thm [display,indent=5] used_Says [no_vars]}\n\nThe function @{text knows} formalizes an agent's knowledge.  Mostly we only\ncare about the spy's knowledge, and @{term \"knows Spy evs\"} is the set of items\navailable to the spy in the trace~@{text evs}.  Already in the empty trace,\nthe spy starts with some secrets at his disposal, such as the private keys\nof compromised users.  After each @{text Says} event, the spy learns the\nmessage that was sent:\n@{thm [display,indent=5] knows_Spy_Says [no_vars]}\nCombinations of functions express other important\nsets of messages derived from~@{text evs}:\n\\begin{itemize}\n\\item @{term \"analz (knows Spy evs)\"} is everything that the spy could\nlearn by decryption\n\\item @{term \"synth (analz (knows Spy evs))\"} is everything that the spy\ncould generate\n\\end{itemize}\n*}\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/Doc/Tutorial/Protocol/Event.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6477982315512488, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3314891115827678}}
{"text": "theory flash107Bra  imports flash107Rev\n \n  begin\nlemma onInv107:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv107 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv107 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv107 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash107Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7310585903489891, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.33136096766910594}}
{"text": "(*  Title:      HOL/Auth/OtwayReesBella.thy\n    Author:     Giampaolo Bella, Catania University\n*)\n\nsection\\<open>Bella's version of the Otway-Rees protocol\\<close>\n\n\ntheory OtwayReesBella imports Public begin\n\ntext\\<open>Bella's modifications to a version of the Otway-Rees protocol taken from\nthe BAN paper only concern message 7. The updated protocol makes the goal of\nkey distribution of the session key available to A. Investigating the\nprinciple of Goal Availability undermines the BAN claim about the original\nprotocol, that \"this protocol does not make use of Kab as an encryption key,\nso neither principal can know whether the key is known to the other\". The\nupdated protocol makes no use of the session key to encrypt but informs A that\nB knows it.\\<close>\n\ninductive_set orb :: \"event list set\"\n where\n\n  Nil:  \"[]\\<in> orb\"\n\n| Fake: \"\\<lbrakk>evsa\\<in> orb;  X\\<in> synth (analz (knows Spy evsa))\\<rbrakk>\n         \\<Longrightarrow> Says Spy B X  # evsa \\<in> orb\"\n\n| Reception: \"\\<lbrakk>evsr\\<in> orb;  Says A B X \\<in> set evsr\\<rbrakk>\n              \\<Longrightarrow> Gets B X # evsr \\<in> orb\"\n\n| OR1:  \"\\<lbrakk>evs1\\<in> orb;  Nonce NA \\<notin> used evs1\\<rbrakk>\n         \\<Longrightarrow> Says A B \\<lbrace>Nonce M, Agent A, Agent B, \n                   Crypt (shrK A) \\<lbrace>Nonce NA, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \n               # evs1 \\<in> orb\"\n\n| OR2:  \"\\<lbrakk>evs2\\<in> orb;  Nonce NB \\<notin> used evs2;\n           Gets B \\<lbrace>Nonce M, Agent A, Agent B, X\\<rbrace> \\<in> set evs2\\<rbrakk>\n        \\<Longrightarrow> Says B Server \n                \\<lbrace>Nonce M, Agent A, Agent B, X, \n           Crypt (shrK B) \\<lbrace>Nonce NB, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace>\n               # evs2 \\<in> orb\"\n\n| OR3:  \"\\<lbrakk>evs3\\<in> orb;  Key KAB \\<notin> used evs3;\n          Gets Server \n             \\<lbrace>Nonce M, Agent A, Agent B, \n               Crypt (shrK A) \\<lbrace>Nonce NA, Nonce M, Agent A, Agent B\\<rbrace>, \n               Crypt (shrK B) \\<lbrace>Nonce NB, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace>\n          \\<in> set evs3\\<rbrakk>\n        \\<Longrightarrow> Says Server B \\<lbrace>Nonce M,\n                    Crypt (shrK B) \\<lbrace>Crypt (shrK A) \\<lbrace>Nonce NA, Key KAB\\<rbrace>,\n                                      Nonce NB, Key KAB\\<rbrace>\\<rbrace>\n               # evs3 \\<in> orb\"\n\n  (*B can only check that the message he is bouncing is a ciphertext*)\n  (*Sending M back is omitted*)   \n| OR4:  \"\\<lbrakk>evs4\\<in> orb; B \\<noteq> Server; \\<forall> p q. X \\<noteq> \\<lbrace>p, q\\<rbrace>; \n          Says B Server \\<lbrace>Nonce M, Agent A, Agent B, X', \n                Crypt (shrK B) \\<lbrace>Nonce NB, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace>\n            \\<in> set evs4;\n          Gets B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce NB, Key KAB\\<rbrace>\\<rbrace>\n            \\<in> set evs4\\<rbrakk>\n        \\<Longrightarrow> Says B A \\<lbrace>Nonce M, X\\<rbrace> # evs4 \\<in> orb\"\n\n\n| Oops: \"\\<lbrakk>evso\\<in> orb;  \n           Says Server B \\<lbrace>Nonce M,\n                    Crypt (shrK B) \\<lbrace>Crypt (shrK A) \\<lbrace>Nonce NA, Key KAB\\<rbrace>,\n                                      Nonce NB, Key KAB\\<rbrace>\\<rbrace> \n             \\<in> set evso\\<rbrakk>\n \\<Longrightarrow> Notes Spy \\<lbrace>Agent A, Agent B, Nonce NA, Nonce NB, Key KAB\\<rbrace> # evso \n     \\<in> orb\"\n\n\n\ndeclare knows_Spy_partsEs [elim]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\n\n\ntext\\<open>Fragile proof, with backtracking in the possibility call.\\<close>\nlemma possibility_thm: \"\\<lbrakk>A \\<noteq> Server; B \\<noteq> Server; Key K \\<notin> used[]\\<rbrakk>    \n      \\<Longrightarrow>   \\<exists> evs \\<in> orb.           \n     Says B A \\<lbrace>Nonce M, Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>\\<rbrace> \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] orb.Nil\n                    [THEN orb.OR1, THEN orb.Reception,\n                     THEN orb.OR2, THEN orb.Reception,\n                     THEN orb.OR3, THEN orb.Reception, THEN orb.OR4]) \napply (possibility, simp add: used_Cons)  \ndone\n\n\nlemma Gets_imp_Says :\n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> orb\\<rbrakk> \\<Longrightarrow> \\<exists>A. Says A B X \\<in> set evs\"\napply (erule rev_mp)\napply (erule orb.induct)\napply auto\ndone\n\nlemma Gets_imp_knows_Spy: \n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> orb\\<rbrakk>  \\<Longrightarrow> X \\<in> knows Spy evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\ndeclare Gets_imp_knows_Spy [THEN parts.Inj, dest]\n\nlemma Gets_imp_knows:\n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> orb\\<rbrakk>  \\<Longrightarrow> X \\<in> knows B evs\"\nby (metis Gets_imp_knows_Spy Gets_imp_knows_agents)\n\nlemma OR2_analz_knows_Spy: \n   \"\\<lbrakk>Gets B \\<lbrace>Nonce M, Agent A, Agent B, X\\<rbrace> \\<in> set evs; evs \\<in> orb\\<rbrakk>   \n    \\<Longrightarrow> X \\<in> analz (knows Spy evs)\"\nby (blast dest!: Gets_imp_knows_Spy [THEN analz.Inj])\n\nlemma OR4_parts_knows_Spy: \n   \"\\<lbrakk>Gets B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key Kab\\<rbrace>\\<rbrace>  \\<in> set evs; \n      evs \\<in> orb\\<rbrakk>   \\<Longrightarrow> X \\<in> parts (knows Spy evs)\"\nby blast\n\nlemma Oops_parts_knows_Spy: \n    \"Says Server B \\<lbrace>Nonce M, Crypt K' \\<lbrace>X, Nonce Nb, K\\<rbrace>\\<rbrace> \\<in> set evs  \n     \\<Longrightarrow> K \\<in> parts (knows Spy evs)\"\nby blast\n\nlemmas OR2_parts_knows_Spy =\n    OR2_analz_knows_Spy [THEN analz_into_parts]\n\nML\n\\<open>\nfun parts_explicit_tac ctxt i =\n    forward_tac ctxt [@{thm Oops_parts_knows_Spy}] (i+7) THEN\n    forward_tac ctxt [@{thm OR4_parts_knows_Spy}]  (i+6) THEN\n    forward_tac ctxt [@{thm OR2_parts_knows_Spy}]  (i+4)\n\\<close>\n \nmethod_setup parts_explicit = \\<open>\n    Scan.succeed (SIMPLE_METHOD' o parts_explicit_tac)\\<close>\n  \"to explicitly state that some message components belong to parts knows Spy\"\n\n\nlemma Spy_see_shrK [simp]: \n    \"evs \\<in> orb \\<Longrightarrow> (Key (shrK A) \\<in> parts (knows Spy evs)) = (A \\<in> bad)\"\nby (erule orb.induct, parts_explicit, simp_all, blast+)\n\nlemma Spy_analz_shrK [simp]: \n\"evs \\<in> orb \\<Longrightarrow> (Key (shrK A) \\<in> analz (knows Spy evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"\\<lbrakk>Key (shrK A) \\<in> parts (knows Spy evs);  evs \\<in> orb\\<rbrakk> \\<Longrightarrow> A \\<in> bad\"\nby (blast dest: Spy_see_shrK)\n\nlemma new_keys_not_used [simp]:\n   \"\\<lbrakk>Key K \\<notin> used evs; K \\<in> symKeys; evs \\<in> orb\\<rbrakk>  \\<Longrightarrow> K \\<notin> keysFor (parts (knows Spy evs))\"\napply (erule rev_mp)\napply (erule orb.induct, parts_explicit, simp_all)\napply (force dest!: keysFor_parts_insert)\napply (blast+)\ndone\n\n\n\nsubsection\\<open>Proofs involving analz\\<close>\n\ntext\\<open>Describes the form of K and NA when the Server sends this message.  Also\n  for Oops case.\\<close>\nlemma Says_Server_message_form: \n\"\\<lbrakk>Says Server B  \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key K\\<rbrace>\\<rbrace> \\<in> set evs;  \n     evs \\<in> orb\\<rbrakk>                                            \n \\<Longrightarrow> K \\<notin> range shrK \\<and> (\\<exists> A Na. X=(Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>))\"\nby (erule rev_mp, erule orb.induct, simp_all)\n\nlemma Says_Server_imp_Gets: \n \"\\<lbrakk>Says Server B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>,\n                                             Nonce Nb, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n    evs \\<in> orb\\<rbrakk>\n  \\<Longrightarrow>  Gets Server \\<lbrace>Nonce M, Agent A, Agent B, \n                   Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace>, \n               Crypt (shrK B) \\<lbrace>Nonce Nb, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace>\n         \\<in> set evs\"\nby (erule rev_mp, erule orb.induct, simp_all)\n\n\nlemma A_trusts_OR1: \n\"\\<lbrakk>Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace> \\<in> parts (knows Spy evs);  \n    A \\<notin> bad; evs \\<in> orb\\<rbrakk>                   \n \\<Longrightarrow> Says A B \\<lbrace>Nonce M, Agent A, Agent B, Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule orb.induct, parts_explicit, simp_all)\napply blast\ndone\n\n\nlemma B_trusts_OR2:\n \"\\<lbrakk>Crypt (shrK B) \\<lbrace>Nonce Nb, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>  \n      \\<in> parts (knows Spy evs);  B \\<notin> bad; evs \\<in> orb\\<rbrakk>                   \n  \\<Longrightarrow> (\\<exists> X. Says B Server \\<lbrace>Nonce M, Agent A, Agent B, X,  \n              Crypt (shrK B) \\<lbrace>Nonce Nb, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \n          \\<in> set evs)\"\napply (erule rev_mp, erule orb.induct, parts_explicit, simp_all)\napply (blast+)\ndone\n\n\nlemma B_trusts_OR3: \n\"\\<lbrakk>Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key K\\<rbrace> \\<in> parts (knows Spy evs);  \n   B \\<notin> bad; evs \\<in> orb\\<rbrakk>                   \n\\<Longrightarrow> \\<exists> M. Says Server B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key K\\<rbrace>\\<rbrace> \n         \\<in> set evs\"\napply (erule rev_mp, erule orb.induct, parts_explicit, simp_all)\napply (blast+)\ndone\n\nlemma Gets_Server_message_form: \n\"\\<lbrakk>Gets B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key K\\<rbrace>\\<rbrace> \\<in> set evs;  \n    evs \\<in> orb\\<rbrakk>                                              \n \\<Longrightarrow> (K \\<notin> range shrK \\<and> (\\<exists> A Na. X = (Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>)))    \n             | X \\<in> analz (knows Spy evs)\"\nby (metis B_trusts_OR3 Crypt_Spy_analz_bad Gets_imp_Says MPair_analz MPair_parts\n          Says_Server_message_form Says_imp_analz_Spy Says_imp_parts_knows_Spy)\n\nlemma unique_Na: \"\\<lbrakk>Says A B  \\<lbrace>Nonce M, Agent A, Agent B, Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs;   \n         Says A B' \\<lbrace>Nonce M', Agent A, Agent B', Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M', Agent A, Agent B'\\<rbrace>\\<rbrace> \\<in> set evs;  \n    A \\<notin> bad; evs \\<in> orb\\<rbrakk> \\<Longrightarrow> B=B' \\<and> M=M'\"\nby (erule rev_mp, erule rev_mp, erule orb.induct, simp_all, blast+)\n\nlemma unique_Nb: \"\\<lbrakk>Says B Server \\<lbrace>Nonce M, Agent A, Agent B, X, Crypt (shrK B) \\<lbrace>Nonce Nb, Nonce M, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs;   \n         Says B Server \\<lbrace>Nonce M', Agent A', Agent B, X', Crypt (shrK B) \\<lbrace>Nonce Nb,Nonce M', Nonce M', Agent A', Agent B\\<rbrace>\\<rbrace> \\<in> set evs;   \n    B \\<notin> bad; evs \\<in> orb\\<rbrakk> \\<Longrightarrow>   M=M' \\<and> A=A' \\<and> X=X'\"\nby (erule rev_mp, erule rev_mp, erule orb.induct, simp_all, blast+)\n\nlemma analz_image_freshCryptK_lemma:\n\"(Crypt K X \\<in> analz (Key`nE \\<union> H)) \\<longrightarrow> (Crypt K X \\<in> analz H) \\<Longrightarrow>  \n        (Crypt K X \\<in> analz (Key`nE \\<union> H)) = (Crypt K X \\<in> analz H)\"\nby (blast intro: analz_mono [THEN [2] rev_subsetD])\n\nML\n\\<open>\nstructure OtwayReesBella =\nstruct\n\nval analz_image_freshK_ss =\n  simpset_of\n   (\\<^context> delsimps [image_insert, image_Un]\n      delsimps [@{thm imp_disjL}]    (*reduces blow-up*)\n      addsimps @{thms analz_image_freshK_simps})\n\nend\n\\<close>\n\nmethod_setup analz_freshCryptK = \\<open>\n    Scan.succeed (fn ctxt =>\n     (SIMPLE_METHOD\n      (EVERY [REPEAT_FIRST (resolve_tac ctxt [allI, ballI, impI]),\n          REPEAT_FIRST (resolve_tac ctxt @{thms analz_image_freshCryptK_lemma}),\n          ALLGOALS (asm_simp_tac\n            (put_simpset OtwayReesBella.analz_image_freshK_ss ctxt))])))\\<close>\n  \"for proving useful rewrite rule\"\n\n\nmethod_setup disentangle = \\<open>\n    Scan.succeed\n     (fn ctxt => SIMPLE_METHOD\n      (REPEAT_FIRST (eresolve_tac ctxt [asm_rl, conjE, disjE] \n                   ORELSE' hyp_subst_tac ctxt)))\\<close>\n  \"for eliminating conjunctions, disjunctions and the like\"\n\n\n\nlemma analz_image_freshCryptK [rule_format]: \n\"evs \\<in> orb \\<Longrightarrow>                              \n     Key K \\<notin> analz (knows Spy evs) \\<longrightarrow>  \n       (\\<forall> KK. KK \\<subseteq> - (range shrK) \\<longrightarrow>                  \n             (Crypt K X \\<in> analz (Key`KK \\<union> (knows Spy evs))) =   \n             (Crypt K X \\<in> analz (knows Spy evs)))\"\napply (erule orb.induct)\napply (analz_mono_contra)\napply (frule_tac [7] Gets_Server_message_form)\napply (frule_tac [9] Says_Server_message_form)\napply disentangle\napply (drule_tac [5] Gets_imp_knows_Spy [THEN analz.Inj, THEN analz.Snd, THEN analz.Snd, THEN  analz.Snd])\nprefer 8 apply clarify\napply (analz_freshCryptK, spy_analz, fastforce)\ndone\n\n\n\nlemma analz_insert_freshCryptK: \n\"\\<lbrakk>evs \\<in> orb;  Key K \\<notin> analz (knows Spy evs);  \n         Seskey \\<notin> range shrK\\<rbrakk> \\<Longrightarrow>   \n         (Crypt K X \\<in> analz (insert (Key Seskey) (knows Spy evs))) =  \n         (Crypt K X \\<in> analz (knows Spy evs))\"\nby (simp only: analz_image_freshCryptK analz_image_freshK_simps)\n\n\nlemma analz_hard: \n\"\\<lbrakk>Says A B \\<lbrace>Nonce M, Agent A, Agent B,  \n             Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in>set evs; \n   Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace> \\<in> analz (knows Spy evs);  \n   A \\<notin> bad; B \\<notin> bad; evs \\<in> orb\\<rbrakk>                   \n \\<Longrightarrow>  Says B A \\<lbrace>Nonce M, Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule orb.induct)\napply (frule_tac [7] Gets_Server_message_form)\napply (frule_tac [9] Says_Server_message_form)\napply disentangle\ntxt\\<open>letting the simplifier solve OR2\\<close>\napply (drule_tac [5] Gets_imp_knows_Spy [THEN analz.Inj, THEN analz.Snd, THEN analz.Snd, THEN analz.Snd])\napply (simp_all (no_asm_simp) add: analz_insert_eq pushes split_ifs)\napply (spy_analz)\ntxt\\<open>OR1\\<close>\napply blast\ntxt\\<open>Oops\\<close>\nprefer 4 apply (blast dest: analz_insert_freshCryptK)\ntxt\\<open>OR4 - ii\\<close>\nprefer 3 apply blast\ntxt\\<open>OR3\\<close>\n(*adding Gets_imp_ and Says_imp_ for efficiency*)\napply (blast dest: \n       A_trusts_OR1 unique_Na Key_not_used analz_insert_freshCryptK)\ntxt\\<open>OR4 - i\\<close>\napply clarify\napply (simp add: pushes split_ifs)\napply (case_tac \"Aaa\\<in>bad\")\napply (blast dest: analz_insert_freshCryptK)\napply clarify\napply simp\napply (case_tac \"Ba\\<in>bad\")\napply (frule Gets_imp_knows_Spy [THEN analz.Inj, THEN analz.Snd, THEN analz.Decrypt, THEN analz.Fst] , assumption)\napply (simp (no_asm_simp))\napply clarify\napply (frule Gets_imp_knows_Spy \n             [THEN parts.Inj, THEN parts.Snd, THEN B_trusts_OR3],  \n       assumption, assumption, assumption, erule exE)\napply (frule Says_Server_imp_Gets \n            [THEN Gets_imp_knows_Spy, THEN parts.Inj, THEN parts.Snd, \n            THEN parts.Snd, THEN parts.Snd, THEN parts.Fst, THEN A_trusts_OR1],\n       assumption, assumption, assumption, assumption)\napply (blast dest: Says_Server_imp_Gets B_trusts_OR2 unique_Na unique_Nb)\ndone\n\n\nlemma Gets_Server_message_form': \n\"\\<lbrakk>Gets B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>X, Nonce Nb, Key K\\<rbrace>\\<rbrace>  \\<in> set evs;  \n   B \\<notin> bad; evs \\<in> orb\\<rbrakk>                              \n  \\<Longrightarrow> K \\<notin> range shrK \\<and> (\\<exists> A Na. X = (Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>))\"\nby (blast dest!: B_trusts_OR3 Says_Server_message_form)\n\n\nlemma OR4_imp_Gets: \n\"\\<lbrakk>Says B A \\<lbrace>Nonce M, Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>\\<rbrace> \\<in> set evs;   \n   B \\<notin> bad; evs \\<in> orb\\<rbrakk>  \n \\<Longrightarrow> (\\<exists> Nb. Gets B \\<lbrace>Nonce M, Crypt (shrK B) \\<lbrace>Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>,\n                                             Nonce Nb, Key K\\<rbrace>\\<rbrace> \\<in> set evs)\"\napply (erule rev_mp, erule orb.induct, parts_explicit, simp_all)\nprefer 3 apply (blast dest: Gets_Server_message_form')\napply blast+\ndone\n\n\nlemma A_keydist_to_B: \n\"\\<lbrakk>Says A B \\<lbrace>Nonce M, Agent A, Agent B,  \n            Crypt (shrK A) \\<lbrace>Nonce Na, Nonce M, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in>set evs; \n   Gets A \\<lbrace>Nonce M, Crypt (shrK A) \\<lbrace>Nonce Na, Key K\\<rbrace>\\<rbrace> \\<in> set evs;    \n   A \\<notin> bad; B \\<notin> bad; evs \\<in> orb\\<rbrakk>  \n  \\<Longrightarrow> Key K \\<in> analz (knows B evs)\"\napply (drule Gets_imp_knows_Spy [THEN analz.Inj, THEN analz.Snd], assumption)\napply (drule analz_hard, assumption, assumption, assumption, assumption)\napply (drule OR4_imp_Gets, assumption, assumption)\napply (fastforce dest!: Gets_imp_knows [THEN analz.Inj] analz.Decrypt)\ndone\n\n\ntext\\<open>Other properties as for the original protocol\\<close>\n\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/OtwayReesBella.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.33129662982949665}}
{"text": "theory Conti      (*Benzmüller, Fuenmayor & Lomfeld, 2020*)  \n  imports GeneralKnowledgeNew\nbegin (*** ASPCA v. Conti \"wild animal\" case **)\n\nconsts \\<alpha>::\"e\" (*appropriated animal (parrot in this case) *)\n\n(*case-specific 'world-vocabulary'*)\nconsts Care::\"c\\<Rightarrow>e\\<Rightarrow>\\<sigma>\"\nconsts Prop::\"c\\<Rightarrow>e\\<Rightarrow>\\<sigma>\"\nconsts Capture::\"c\\<Rightarrow>e\\<Rightarrow>\\<sigma>\"\n\n(*case-specific taxonomic (legal domain) knowledge*)\naxiomatization where \n CW1: \"\\<lfloor>Animal \\<alpha> \\<^bold>\\<and> Pet \\<alpha> \\<^bold>\\<rightarrow> Domestic \\<alpha>\\<rfloor>\" and\n CW2: \"\\<lfloor>(\\<^bold>\\<exists>c. Capture c \\<alpha> \\<^bold>\\<and> Domestic \\<alpha>) \\<^bold>\\<rightarrow> appDomAnimal\\<rfloor>\" and\n CW3: \"\\<lfloor>\\<^bold>\\<forall>c. Care c \\<alpha> \\<^bold>\\<rightarrow> Intent c\\<rfloor>\" and\n CW4: \"\\<lfloor>\\<^bold>\\<forall>c. Prop c \\<alpha> \\<^bold>\\<rightarrow> Own c\\<rfloor>\" and\n CW5: \"\\<lfloor>\\<^bold>\\<forall>c. Capture c \\<alpha> \\<^bold>\\<rightarrow> Poss c\\<rfloor>\"\n\nlemma True nitpick[satisfy,card i=4] oops (*satisfiable*)\n\n(****************** pro-ASPCA's argument ****************)  \nabbreviation \"ASPCA_facts \\<equiv> \\<lfloor>Parrot \\<alpha> \\<^bold>\\<and> Pet \\<alpha> \\<^bold>\\<and> Care p \\<alpha> \\<^bold>\\<and> \n                     Prop p \\<alpha> \\<^bold>\\<and> (\\<^bold>\\<not>Prop d \\<alpha>) \\<^bold>\\<and> Capture d \\<alpha>\\<rfloor>\"\n\nlemma \"ASPCA_facts\" nitpick[satisfy] oops (*TODO facts inconsistent - fix*)\n\n(* a decision for defendant (Conti) is compatible with premises*)\nlemma \"ASPCA_facts \\<and> \\<lfloor>For p \\<^bold>\\<prec> For d\\<rfloor>\"\n  nitpick[satisfy,card i=4] oops (*non-trivial model*)\n\n(* a decision for plaintiff (ASPCA) is compatible with premises*)\nlemma \"ASPCA_facts \\<and> \\<lfloor>For d \\<^bold>\\<prec> For p\\<rfloor>\"\n  nitpick[satisfy,card i=4] oops (* non-trivial model?*)\n\n(* a decision for plaintiff (ASPCA) is provable*)\nlemma assumes ASPCA_facts shows \"\\<lfloor>For d \\<^bold>\\<prec> For p\\<rfloor>\" \n  sledgehammer\n  oops\n(*  while a decision for the defendant is countersatisfiable*)\nlemma assumes ASPCA_facts shows \"\\<lfloor>For p \\<^bold>\\<prec> For d\\<rfloor>\"\n  nitpick oops (*counterexample found*)\n\n(****************** pro-Conti's argument ****************)\n(*TODO ...*)\n\nend\n\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/Preference-Logics/vanBenthemEtAl2009/OLD/Conti.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953797290152, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3312966297541238}}
{"text": "(*  Title:      HOL/Library/Mapping.thy\n    Author:     Florian Haftmann and Ondrej Kuncar\n*)\n\nsection \\<open>An abstract view on maps for code generation.\\<close>\n\ntheory Mapping\nimports MainRLT AList\nbegin\n\nsubsection \\<open>Parametricity transfer rules\\<close>\n\nlemma map_of_foldr: \"map_of xs = foldr (\\<lambda>(k, v) m. m(k \\<mapsto> v)) xs Map.empty\"  (* FIXME move *)\n  using map_add_map_of_foldr [of Map.empty] by auto\n\ncontext includes lifting_syntax\nbegin\n\nlemma empty_parametric: \"(A ===> rel_option B) Map.empty Map.empty\"\n  by transfer_prover\n\nlemma lookup_parametric: \"((A ===> B) ===> A ===> B) (\\<lambda>m k. m k) (\\<lambda>m k. m k)\"\n  by transfer_prover\n\nlemma update_parametric:\n  assumes [transfer_rule]: \"bi_unique A\"\n  shows \"(A ===> B ===> (A ===> rel_option B) ===> A ===> rel_option B)\n    (\\<lambda>k v m. m(k \\<mapsto> v)) (\\<lambda>k v m. m(k \\<mapsto> v))\"\n  by transfer_prover\n\nlemma delete_parametric:\n  assumes [transfer_rule]: \"bi_unique A\"\n  shows \"(A ===> (A ===> rel_option B) ===> A ===> rel_option B)\n    (\\<lambda>k m. m(k := None)) (\\<lambda>k m. m(k := None))\"\n  by transfer_prover\n\nlemma is_none_parametric [transfer_rule]:\n  \"(rel_option A ===> HOL.eq) Option.is_none Option.is_none\"\n  by (auto simp add: Option.is_none_def rel_fun_def rel_option_iff split: option.split)\n\nlemma dom_parametric:\n  assumes [transfer_rule]: \"bi_total A\"\n  shows \"((A ===> rel_option B) ===> rel_set A) dom dom\"\n  unfolding dom_def [abs_def] Option.is_none_def [symmetric] by transfer_prover\n\nlemma graph_parametric:\n  assumes \"bi_total A\"\n  shows \"((A ===> rel_option B) ===> rel_set (rel_prod A B)) Map.graph Map.graph\"\nproof\n  fix f g assume \"(A ===> rel_option B) f g\"\n  with assms[unfolded bi_total_def] show \"rel_set (rel_prod A B) (Map.graph f) (Map.graph g)\"\n    unfolding graph_def rel_set_def rel_fun_def\n    by auto (metis option_rel_Some1 option_rel_Some2)+\nqed\n\nlemma map_of_parametric [transfer_rule]:\n  assumes [transfer_rule]: \"bi_unique R1\"\n  shows \"(list_all2 (rel_prod R1 R2) ===> R1 ===> rel_option R2) map_of map_of\"\n  unfolding map_of_def by transfer_prover\n\nlemma map_entry_parametric [transfer_rule]:\n  assumes [transfer_rule]: \"bi_unique A\"\n  shows \"(A ===> (B ===> B) ===> (A ===> rel_option B) ===> A ===> rel_option B)\n    (\\<lambda>k f m. (case m k of None \\<Rightarrow> m\n      | Some v \\<Rightarrow> m (k \\<mapsto> (f v)))) (\\<lambda>k f m. (case m k of None \\<Rightarrow> m\n      | Some v \\<Rightarrow> m (k \\<mapsto> (f v))))\"\n  by transfer_prover\n\nlemma tabulate_parametric:\n  assumes [transfer_rule]: \"bi_unique A\"\n  shows \"(list_all2 A ===> (A ===> B) ===> A ===> rel_option B)\n    (\\<lambda>ks f. (map_of (map (\\<lambda>k. (k, f k)) ks))) (\\<lambda>ks f. (map_of (map (\\<lambda>k. (k, f k)) ks)))\"\n  by transfer_prover\n\nlemma bulkload_parametric:\n  \"(list_all2 A ===> HOL.eq ===> rel_option A)\n    (\\<lambda>xs k. if k < length xs then Some (xs ! k) else None)\n    (\\<lambda>xs k. if k < length xs then Some (xs ! k) else None)\"\nproof\n  fix xs ys\n  assume \"list_all2 A xs ys\"\n  then show\n    \"(HOL.eq ===> rel_option A)\n      (\\<lambda>k. if k < length xs then Some (xs ! k) else None)\n      (\\<lambda>k. if k < length ys then Some (ys ! k) else None)\"\n    apply induct\n     apply auto\n    unfolding rel_fun_def\n    apply clarsimp\n    apply (case_tac xa)\n     apply (auto dest: list_all2_lengthD list_all2_nthD)\n    done\nqed\n\nlemma map_parametric:\n  \"((A ===> B) ===> (C ===> D) ===> (B ===> rel_option C) ===> A ===> rel_option D)\n     (\\<lambda>f g m. (map_option g \\<circ> m \\<circ> f)) (\\<lambda>f g m. (map_option g \\<circ> m \\<circ> f))\"\n  by transfer_prover\n\nlemma combine_with_key_parametric:\n  \"((A ===> B ===> B ===> B) ===> (A ===> rel_option B) ===> (A ===> rel_option B) ===>\n    (A ===> rel_option B)) (\\<lambda>f m1 m2 x. combine_options (f x) (m1 x) (m2 x))\n    (\\<lambda>f m1 m2 x. combine_options (f x) (m1 x) (m2 x))\"\n  unfolding combine_options_def by transfer_prover\n\nlemma combine_parametric:\n  \"((B ===> B ===> B) ===> (A ===> rel_option B) ===> (A ===> rel_option B) ===>\n    (A ===> rel_option B)) (\\<lambda>f m1 m2 x. combine_options f (m1 x) (m2 x))\n    (\\<lambda>f m1 m2 x. combine_options f (m1 x) (m2 x))\"\n  unfolding combine_options_def by transfer_prover\n\nend\n\n\nsubsection \\<open>Type definition and primitive operations\\<close>\n\ntypedef ('a, 'b) mapping = \"UNIV :: ('a \\<rightharpoonup> 'b) set\"\n  morphisms rep Mapping ..\n\nsetup_lifting type_definition_mapping\n\nlift_definition empty :: \"('a, 'b) mapping\"\n  is Map.empty parametric empty_parametric .\n\nlift_definition lookup :: \"('a, 'b) mapping \\<Rightarrow> 'a \\<Rightarrow> 'b option\"\n  is \"\\<lambda>m k. m k\" parametric lookup_parametric .\n\ndefinition \"lookup_default d m k = (case Mapping.lookup m k of None \\<Rightarrow> d | Some v \\<Rightarrow> v)\"\n\nlift_definition update :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  is \"\\<lambda>k v m. m(k \\<mapsto> v)\" parametric update_parametric .\n\nlift_definition delete :: \"'a \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  is \"\\<lambda>k m. m(k := None)\" parametric delete_parametric .\n\nlift_definition filter :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  is \"\\<lambda>P m k. case m k of None \\<Rightarrow> None | Some v \\<Rightarrow> if P k v then Some v else None\" .\n\nlift_definition keys :: \"('a, 'b) mapping \\<Rightarrow> 'a set\"\n  is dom parametric dom_parametric .\n\nlift_definition entries :: \"('a, 'b) mapping \\<Rightarrow> ('a \\<times> 'b) set\"\n  is Map.graph parametric graph_parametric .\n\nlift_definition tabulate :: \"'a list \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> ('a, 'b) mapping\"\n  is \"\\<lambda>ks f. (map_of (List.map (\\<lambda>k. (k, f k)) ks))\" parametric tabulate_parametric .\n\nlift_definition bulkload :: \"'a list \\<Rightarrow> (nat, 'a) mapping\"\n  is \"\\<lambda>xs k. if k < length xs then Some (xs ! k) else None\" parametric bulkload_parametric .\n\nlift_definition map :: \"('c \\<Rightarrow> 'a) \\<Rightarrow> ('b \\<Rightarrow> 'd) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('c, 'd) mapping\"\n  is \"\\<lambda>f g m. (map_option g \\<circ> m \\<circ> f)\" parametric map_parametric .\n\nlift_definition map_values :: \"('c \\<Rightarrow> 'a \\<Rightarrow> 'b) \\<Rightarrow> ('c, 'a) mapping \\<Rightarrow> ('c, 'b) mapping\"\n  is \"\\<lambda>f m x. map_option (f x) (m x)\" .\n\nlift_definition combine_with_key ::\n  \"('a \\<Rightarrow> 'b \\<Rightarrow> 'b \\<Rightarrow> 'b) \\<Rightarrow> ('a,'b) mapping \\<Rightarrow> ('a,'b) mapping \\<Rightarrow> ('a,'b) mapping\"\n  is \"\\<lambda>f m1 m2 x. combine_options (f x) (m1 x) (m2 x)\" parametric combine_with_key_parametric .\n\nlift_definition combine ::\n  \"('b \\<Rightarrow> 'b \\<Rightarrow> 'b) \\<Rightarrow> ('a,'b) mapping \\<Rightarrow> ('a,'b) mapping \\<Rightarrow> ('a,'b) mapping\"\n  is \"\\<lambda>f m1 m2 x. combine_options f (m1 x) (m2 x)\" parametric combine_parametric .\n\ndefinition \"All_mapping m P \\<longleftrightarrow>\n  (\\<forall>x. case Mapping.lookup m x of None \\<Rightarrow> True | Some y \\<Rightarrow> P x y)\"\n\ndeclare [[code drop: map]]\n\n\nsubsection \\<open>Functorial structure\\<close>\n\nfunctor map: map\n  by (transfer, auto simp add: fun_eq_iff option.map_comp option.map_id)+\n\n\nsubsection \\<open>Derived operations\\<close>\n\ndefinition ordered_keys :: \"('a::linorder, 'b) mapping \\<Rightarrow> 'a list\"\n  where \"ordered_keys m = (if finite (keys m) then sorted_list_of_set (keys m) else [])\"\n\ndefinition ordered_entries :: \"('a::linorder, 'b) mapping \\<Rightarrow> ('a \\<times> 'b) list\"\n  where \"ordered_entries m = (if finite (entries m) then sorted_key_list_of_set fst (entries m)\n                                                    else [])\"\n\ndefinition fold :: \"('a::linorder \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'c) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> 'c \\<Rightarrow> 'c\"\n  where \"fold f m a = List.fold (case_prod f) (ordered_entries m) a\"\n\ndefinition is_empty :: \"('a, 'b) mapping \\<Rightarrow> bool\"\n  where \"is_empty m \\<longleftrightarrow> keys m = {}\"\n\ndefinition size :: \"('a, 'b) mapping \\<Rightarrow> nat\"\n  where \"size m = (if finite (keys m) then card (keys m) else 0)\"\n\ndefinition replace :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  where \"replace k v m = (if k \\<in> keys m then update k v m else m)\"\n\ndefinition default :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  where \"default k v m = (if k \\<in> keys m then m else update k v m)\"\n\ntext \\<open>Manual derivation of transfer rule is non-trivial\\<close>\n\nlift_definition map_entry :: \"'a \\<Rightarrow> ('b \\<Rightarrow> 'b) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\" is\n  \"\\<lambda>k f m.\n    (case m k of\n      None \\<Rightarrow> m\n    | Some v \\<Rightarrow> m (k \\<mapsto> (f v)))\" parametric map_entry_parametric .\n\nlemma map_entry_code [code]:\n  \"map_entry k f m =\n    (case lookup m k of\n      None \\<Rightarrow> m\n    | Some v \\<Rightarrow> update k (f v) m)\"\n  by transfer rule\n\ndefinition map_default :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('b \\<Rightarrow> 'b) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  where \"map_default k v f m = map_entry k f (default k v m)\"\n\ndefinition of_alist :: \"('k \\<times> 'v) list \\<Rightarrow> ('k, 'v) mapping\"\n  where \"of_alist xs = foldr (\\<lambda>(k, v) m. update k v m) xs empty\"\n\ninstantiation mapping :: (type, type) equal\nbegin\n\ndefinition \"HOL.equal m1 m2 \\<longleftrightarrow> (\\<forall>k. lookup m1 k = lookup m2 k)\"\n\ninstance\n  apply standard\n  unfolding equal_mapping_def\n  apply transfer\n  apply auto\n  done\n\nend\n\ncontext includes lifting_syntax\nbegin\n\n\n\nlemma of_alist_transfer [transfer_rule]:\n  assumes [transfer_rule]: \"bi_unique R1\"\n  shows \"(list_all2 (rel_prod R1 R2) ===> pcr_mapping R1 R2) map_of of_alist\"\n  unfolding of_alist_def [abs_def] map_of_foldr [abs_def] by transfer_prover\n\nend\n\n\nsubsection \\<open>Properties\\<close>\n\nlemma mapping_eqI: \"(\\<And>x. lookup m x = lookup m' x) \\<Longrightarrow> m = m'\"\n  by transfer (simp add: fun_eq_iff)\n\nlemma mapping_eqI':\n  assumes \"\\<And>x. x \\<in> Mapping.keys m \\<Longrightarrow> Mapping.lookup_default d m x = Mapping.lookup_default d m' x\"\n    and \"Mapping.keys m = Mapping.keys m'\"\n  shows \"m = m'\"\nproof (intro mapping_eqI)\n  show \"Mapping.lookup m x = Mapping.lookup m' x\" for x\n  proof (cases \"Mapping.lookup m x\")\n    case None\n    then have \"x \\<notin> Mapping.keys m\"\n      by transfer (simp add: dom_def)\n    then have \"x \\<notin> Mapping.keys m'\"\n      by (simp add: assms)\n    then have \"Mapping.lookup m' x = None\"\n      by transfer (simp add: dom_def)\n    with None show ?thesis\n      by simp\n  next\n    case (Some y)\n    then have A: \"x \\<in> Mapping.keys m\"\n      by transfer (simp add: dom_def)\n    then have \"x \\<in> Mapping.keys m'\"\n      by (simp add: assms)\n    then have \"\\<exists>y'. Mapping.lookup m' x = Some y'\"\n      by transfer (simp add: dom_def)\n    with Some assms(1)[OF A] show ?thesis\n      by (auto simp add: lookup_default_def)\n  qed\nqed\n\nlemma lookup_update[simp]: \"lookup (update k v m) k = Some v\"\n  by transfer simp\n\nlemma lookup_update_neq[simp]: \"k \\<noteq> k' \\<Longrightarrow> lookup (update k v m) k' = lookup m k'\"\n  by transfer simp\n\nlemma lookup_update': \"lookup (update k v m) k' = (if k = k' then Some v else lookup m k')\"\n  by transfer simp\n\nlemma lookup_empty[simp]: \"lookup empty k = None\"\n  by transfer simp\n\nlemma lookup_delete[simp]: \"lookup (delete k m) k = None\"\n  by transfer simp\n\nlemma lookup_delete_neq[simp]: \"k \\<noteq> k' \\<Longrightarrow> lookup (delete k m) k' = lookup m k'\"\n  by transfer simp\n\nlemma lookup_filter:\n  \"lookup (filter P m) k =\n    (case lookup m k of\n      None \\<Rightarrow> None\n    | Some v \\<Rightarrow> if P k v then Some v else None)\"\n  by transfer simp_all\n\nlemma lookup_map_values: \"lookup (map_values f m) k = map_option (f k) (lookup m k)\"\n  by transfer simp_all\n\nlemma lookup_default_empty: \"lookup_default d empty k = d\"\n  by (simp add: lookup_default_def lookup_empty)\n\nlemma lookup_default_update: \"lookup_default d (update k v m) k = v\"\n  by (simp add: lookup_default_def)\n\nlemma lookup_default_update_neq:\n  \"k \\<noteq> k' \\<Longrightarrow> lookup_default d (update k v m) k' = lookup_default d m k'\"\n  by (simp add: lookup_default_def)\n\nlemma lookup_default_update':\n  \"lookup_default d (update k v m) k' = (if k = k' then v else lookup_default d m k')\"\n  by (auto simp: lookup_default_update lookup_default_update_neq)\n\nlemma lookup_default_filter:\n  \"lookup_default d (filter P m) k =\n     (if P k (lookup_default d m k) then lookup_default d m k else d)\"\n  by (simp add: lookup_default_def lookup_filter split: option.splits)\n\nlemma lookup_default_map_values:\n  \"lookup_default (f k d) (map_values f m) k = f k (lookup_default d m k)\"\n  by (simp add: lookup_default_def lookup_map_values split: option.splits)\n\nlemma lookup_combine_with_key:\n  \"Mapping.lookup (combine_with_key f m1 m2) x =\n    combine_options (f x) (Mapping.lookup m1 x) (Mapping.lookup m2 x)\"\n  by transfer (auto split: option.splits)\n\nlemma combine_altdef: \"combine f m1 m2 = combine_with_key (\\<lambda>_. f) m1 m2\"\n  by transfer' (rule refl)\n\nlemma lookup_combine:\n  \"Mapping.lookup (combine f m1 m2) x =\n     combine_options f (Mapping.lookup m1 x) (Mapping.lookup m2 x)\"\n  by transfer (auto split: option.splits)\n\nlemma lookup_default_neutral_combine_with_key:\n  assumes \"\\<And>x. f k d x = x\" \"\\<And>x. f k x d = x\"\n  shows \"Mapping.lookup_default d (combine_with_key f m1 m2) k =\n    f k (Mapping.lookup_default d m1 k) (Mapping.lookup_default d m2 k)\"\n  by (auto simp: lookup_default_def lookup_combine_with_key assms split: option.splits)\n\nlemma lookup_default_neutral_combine:\n  assumes \"\\<And>x. f d x = x\" \"\\<And>x. f x d = x\"\n  shows \"Mapping.lookup_default d (combine f m1 m2) x =\n    f (Mapping.lookup_default d m1 x) (Mapping.lookup_default d m2 x)\"\n  by (auto simp: lookup_default_def lookup_combine assms split: option.splits)\n\nlemma lookup_map_entry: \"lookup (map_entry x f m) x = map_option f (lookup m x)\"\n  by transfer (auto split: option.splits)\n\nlemma lookup_map_entry_neq: \"x \\<noteq> y \\<Longrightarrow> lookup (map_entry x f m) y = lookup m y\"\n  by transfer (auto split: option.splits)\n\nlemma lookup_map_entry':\n  \"lookup (map_entry x f m) y =\n     (if x = y then map_option f (lookup m y) else lookup m y)\"\n  by transfer (auto split: option.splits)\n\nlemma lookup_default: \"lookup (default x d m) x = Some (lookup_default d m x)\"\n  unfolding lookup_default_def default_def\n  by transfer (auto split: option.splits)\n\nlemma lookup_default_neq: \"x \\<noteq> y \\<Longrightarrow> lookup (default x d m) y = lookup m y\"\n  unfolding lookup_default_def default_def\n  by transfer (auto split: option.splits)\n\nlemma lookup_default':\n  \"lookup (default x d m) y =\n    (if x = y then Some (lookup_default d m x) else lookup m y)\"\n  unfolding lookup_default_def default_def\n  by transfer (auto split: option.splits)\n\nlemma lookup_map_default: \"lookup (map_default x d f m) x = Some (f (lookup_default d m x))\"\n  unfolding lookup_default_def default_def\n  by (simp add: map_default_def lookup_map_entry lookup_default lookup_default_def)\n\nlemma lookup_map_default_neq: \"x \\<noteq> y \\<Longrightarrow> lookup (map_default x d f m) y = lookup m y\"\n  unfolding lookup_default_def default_def\n  by (simp add: map_default_def lookup_map_entry_neq lookup_default_neq)\n\nlemma lookup_map_default':\n  \"lookup (map_default x d f m) y =\n    (if x = y then Some (f (lookup_default d m x)) else lookup m y)\"\n  unfolding lookup_default_def default_def\n  by (simp add: map_default_def lookup_map_entry' lookup_default' lookup_default_def)\n\nlemma lookup_tabulate:\n  assumes \"distinct xs\"\n  shows \"Mapping.lookup (Mapping.tabulate xs f) x = (if x \\<in> set xs then Some (f x) else None)\"\n  using assms by transfer (auto simp: map_of_eq_None_iff o_def dest!: map_of_SomeD)\n\nlemma lookup_of_alist: \"lookup (of_alist xs) k = map_of xs k\"\n  by transfer simp_all\n\nlemma keys_is_none_rep [code_unfold]: \"k \\<in> keys m \\<longleftrightarrow> \\<not> (Option.is_none (lookup m k))\"\n  by transfer (auto simp add: Option.is_none_def)\n\nlemma update_update:\n  \"update k v (update k w m) = update k v m\"\n  \"k \\<noteq> l \\<Longrightarrow> update k v (update l w m) = update l w (update k v m)\"\n  by (transfer; simp add: fun_upd_twist)+\n\nlemma update_delete [simp]: \"update k v (delete k m) = update k v m\"\n  by transfer simp\n\nlemma delete_update:\n  \"delete k (update k v m) = delete k m\"\n  \"k \\<noteq> l \\<Longrightarrow> delete k (update l v m) = update l v (delete k m)\"\n  by (transfer; simp add: fun_upd_twist)+\n\nlemma delete_empty [simp]: \"delete k empty = empty\"\n  by transfer simp\n\nlemma Mapping_delete_if_notin_keys[simp]:\n  \"k \\<notin> keys m \\<Longrightarrow> delete k m = m\"\n  by transfer simp\n\nlemma replace_update:\n  \"k \\<notin> keys m \\<Longrightarrow> replace k v m = m\"\n  \"k \\<in> keys m \\<Longrightarrow> replace k v m = update k v m\"\n  by (transfer; auto simp add: replace_def fun_upd_twist)+\n\nlemma map_values_update: \"map_values f (update k v m) = update k (f k v) (map_values f m)\"\n  by transfer (simp_all add: fun_eq_iff)\n\nlemma size_mono: \"finite (keys m') \\<Longrightarrow> keys m \\<subseteq> keys m' \\<Longrightarrow> size m \\<le> size m'\"\n  unfolding size_def by (auto intro: card_mono)\n\nlemma size_empty [simp]: \"size empty = 0\"\n  unfolding size_def by transfer simp\n\nlemma size_update:\n  \"finite (keys m) \\<Longrightarrow> size (update k v m) =\n    (if k \\<in> keys m then size m else Suc (size m))\"\n  unfolding size_def by transfer (auto simp add: insert_dom)\n\nlemma size_delete: \"size (delete k m) = (if k \\<in> keys m then size m - 1 else size m)\"\n  unfolding size_def by transfer simp\n\nlemma size_tabulate [simp]: \"size (tabulate ks f) = length (remdups ks)\"\n  unfolding size_def by transfer (auto simp add: map_of_map_restrict card_set comp_def)\n\nlemma keys_filter: \"keys (filter P m) \\<subseteq> keys m\"\n  by transfer (auto split: option.splits)\n\nlemma size_filter: \"finite (keys m) \\<Longrightarrow> size (filter P m) \\<le> size m\"\n  by (intro size_mono keys_filter)\n\nlemma bulkload_tabulate: \"bulkload xs = tabulate [0..<length xs] (nth xs)\"\n  by transfer (auto simp add: map_of_map_restrict)\n\nlemma is_empty_empty [simp]: \"is_empty empty\"\n  unfolding is_empty_def by transfer simp\n\nlemma is_empty_update [simp]: \"\\<not> is_empty (update k v m)\"\n  unfolding is_empty_def by transfer simp\n\nlemma is_empty_delete: \"is_empty (delete k m) \\<longleftrightarrow> is_empty m \\<or> keys m = {k}\"\n  unfolding is_empty_def by transfer (auto simp del: dom_eq_empty_conv)\n\nlemma is_empty_replace [simp]: \"is_empty (replace k v m) \\<longleftrightarrow> is_empty m\"\n  unfolding is_empty_def replace_def by transfer auto\n\nlemma is_empty_default [simp]: \"\\<not> is_empty (default k v m)\"\n  unfolding is_empty_def default_def by transfer auto\n\nlemma is_empty_map_entry [simp]: \"is_empty (map_entry k f m) \\<longleftrightarrow> is_empty m\"\n  unfolding is_empty_def by transfer (auto split: option.split)\n\nlemma is_empty_map_values [simp]: \"is_empty (map_values f m) \\<longleftrightarrow> is_empty m\"\n  unfolding is_empty_def by transfer (auto simp: fun_eq_iff)\n\nlemma is_empty_map_default [simp]: \"\\<not> is_empty (map_default k v f m)\"\n  by (simp add: map_default_def)\n\nlemma keys_dom_lookup: \"keys m = dom (Mapping.lookup m)\"\n  by transfer rule\n\nlemma keys_empty [simp]: \"keys empty = {}\"\n  by transfer (fact dom_empty)\n\nlemma in_keysD: \"k \\<in> keys m \\<Longrightarrow> \\<exists>v. lookup m k = Some v\"\n  by transfer (fact domD)\n\nlemma keys_update [simp]: \"keys (update k v m) = insert k (keys m)\"\n  by transfer simp\n\nlemma keys_delete [simp]: \"keys (delete k m) = keys m - {k}\"\n  by transfer simp\n\nlemma keys_replace [simp]: \"keys (replace k v m) = keys m\"\n  unfolding replace_def by transfer (simp add: insert_absorb)\n\nlemma keys_default [simp]: \"keys (default k v m) = insert k (keys m)\"\n  unfolding default_def by transfer (simp add: insert_absorb)\n\nlemma keys_map_entry [simp]: \"keys (map_entry k f m) = keys m\"\n  by transfer (auto split: option.split)\n\nlemma keys_map_default [simp]: \"keys (map_default k v f m) = insert k (keys m)\"\n  by (simp add: map_default_def)\n\nlemma keys_map_values [simp]: \"keys (map_values f m) = keys m\"\n  by transfer (simp_all add: dom_def)\n\nlemma keys_combine_with_key [simp]:\n  \"Mapping.keys (combine_with_key f m1 m2) = Mapping.keys m1 \\<union> Mapping.keys m2\"\n  by transfer (auto simp: dom_def combine_options_def split: option.splits)\n\nlemma keys_combine [simp]: \"Mapping.keys (combine f m1 m2) = Mapping.keys m1 \\<union> Mapping.keys m2\"\n  by (simp add: combine_altdef)\n\nlemma keys_tabulate [simp]: \"keys (tabulate ks f) = set ks\"\n  by transfer (simp add: map_of_map_restrict o_def)\n\nlemma keys_of_alist [simp]: \"keys (of_alist xs) = set (List.map fst xs)\"\n  by transfer (simp_all add: dom_map_of_conv_image_fst)\n\nlemma keys_bulkload [simp]: \"keys (bulkload xs) = {0..<length xs}\"\n  by (simp add: bulkload_tabulate)\n\nlemma finite_keys_update[simp]:\n  \"finite (keys (update k v m)) = finite (keys m)\"\n  by transfer simp\n\nlemma set_ordered_keys[simp]:\n  \"finite (Mapping.keys m) \\<Longrightarrow> set (Mapping.ordered_keys m) = Mapping.keys m\"\n  unfolding ordered_keys_def by transfer auto\n\nlemma distinct_ordered_keys [simp]: \"distinct (ordered_keys m)\"\n  by (simp add: ordered_keys_def)\n\nlemma ordered_keys_infinite [simp]: \"\\<not> finite (keys m) \\<Longrightarrow> ordered_keys m = []\"\n  by (simp add: ordered_keys_def)\n\nlemma ordered_keys_empty [simp]: \"ordered_keys empty = []\"\n  by (simp add: ordered_keys_def)\n\nlemma sorted_ordered_keys[simp]: \"sorted (ordered_keys m)\"\n  unfolding ordered_keys_def by simp\n\nlemma ordered_keys_update [simp]:\n  \"k \\<in> keys m \\<Longrightarrow> ordered_keys (update k v m) = ordered_keys m\"\n  \"finite (keys m) \\<Longrightarrow> k \\<notin> keys m \\<Longrightarrow>\n    ordered_keys (update k v m) = insort k (ordered_keys m)\"\n  by (simp_all add: ordered_keys_def)\n     (auto simp only: sorted_list_of_set_insert_remove[symmetric] insert_absorb)\n\nlemma ordered_keys_delete [simp]: \"ordered_keys (delete k m) = remove1 k (ordered_keys m)\"\nproof (cases \"finite (keys m)\")\n  case False\n  then show ?thesis by simp\nnext\n  case fin: True\n  show ?thesis\n  proof (cases \"k \\<in> keys m\")\n    case False\n    with fin have \"k \\<notin> set (sorted_list_of_set (keys m))\"\n      by simp\n    with False show ?thesis\n      by (simp add: ordered_keys_def remove1_idem)\n  next\n    case True\n    with fin show ?thesis\n      by (simp add: ordered_keys_def sorted_list_of_set_remove)\n  qed\nqed\n\nlemma ordered_keys_replace [simp]: \"ordered_keys (replace k v m) = ordered_keys m\"\n  by (simp add: replace_def)\n\nlemma ordered_keys_default [simp]:\n  \"k \\<in> keys m \\<Longrightarrow> ordered_keys (default k v m) = ordered_keys m\"\n  \"finite (keys m) \\<Longrightarrow> k \\<notin> keys m \\<Longrightarrow> ordered_keys (default k v m) = insort k (ordered_keys m)\"\n  by (simp_all add: default_def)\n\nlemma ordered_keys_map_entry [simp]: \"ordered_keys (map_entry k f m) = ordered_keys m\"\n  by (simp add: ordered_keys_def)\n\nlemma ordered_keys_map_default [simp]:\n  \"k \\<in> keys m \\<Longrightarrow> ordered_keys (map_default k v f m) = ordered_keys m\"\n  \"finite (keys m) \\<Longrightarrow> k \\<notin> keys m \\<Longrightarrow> ordered_keys (map_default k v f m) = insort k (ordered_keys m)\"\n  by (simp_all add: map_default_def)\n\nlemma ordered_keys_tabulate [simp]: \"ordered_keys (tabulate ks f) = sort (remdups ks)\"\n  by (simp add: ordered_keys_def sorted_list_of_set_sort_remdups)\n\nlemma ordered_keys_bulkload [simp]: \"ordered_keys (bulkload ks) = [0..<length ks]\"\n  by (simp add: ordered_keys_def)\n\nlemma tabulate_fold: \"tabulate xs f = List.fold (\\<lambda>k m. update k (f k) m) xs empty\"\nproof transfer\n  fix f :: \"'a \\<Rightarrow> 'b\" and xs\n  have \"map_of (List.map (\\<lambda>k. (k, f k)) xs) = foldr (\\<lambda>k m. m(k \\<mapsto> f k)) xs Map.empty\"\n    by (simp add: foldr_map comp_def map_of_foldr)\n  also have \"foldr (\\<lambda>k m. m(k \\<mapsto> f k)) xs = List.fold (\\<lambda>k m. m(k \\<mapsto> f k)) xs\"\n    by (rule foldr_fold) (simp add: fun_eq_iff)\n  ultimately show \"map_of (List.map (\\<lambda>k. (k, f k)) xs) = List.fold (\\<lambda>k m. m(k \\<mapsto> f k)) xs Map.empty\"\n    by simp\nqed\n\nlemma All_mapping_mono:\n  \"(\\<And>k v. k \\<in> keys m \\<Longrightarrow> P k v \\<Longrightarrow> Q k v) \\<Longrightarrow> All_mapping m P \\<Longrightarrow> All_mapping m Q\"\n  unfolding All_mapping_def by transfer (auto simp: All_mapping_def dom_def split: option.splits)\n\nlemma All_mapping_empty [simp]: \"All_mapping Mapping.empty P\"\n  by (auto simp: All_mapping_def lookup_empty)\n\nlemma All_mapping_update_iff:\n  \"All_mapping (Mapping.update k v m) P \\<longleftrightarrow> P k v \\<and> All_mapping m (\\<lambda>k' v'. k = k' \\<or> P k' v')\"\n  unfolding All_mapping_def\nproof safe\n  assume \"\\<forall>x. case Mapping.lookup (Mapping.update k v m) x of None \\<Rightarrow> True | Some y \\<Rightarrow> P x y\"\n  then have *: \"case Mapping.lookup (Mapping.update k v m) x of None \\<Rightarrow> True | Some y \\<Rightarrow> P x y\" for x\n    by blast\n  from *[of k] show \"P k v\"\n    by (simp add: lookup_update)\n  show \"case Mapping.lookup m x of None \\<Rightarrow> True | Some v' \\<Rightarrow> k = x \\<or> P x v'\" for x\n    using *[of x] by (auto simp add: lookup_update' split: if_splits option.splits)\nnext\n  assume \"P k v\"\n  assume \"\\<forall>x. case Mapping.lookup m x of None \\<Rightarrow> True | Some v' \\<Rightarrow> k = x \\<or> P x v'\"\n  then have A: \"case Mapping.lookup m x of None \\<Rightarrow> True | Some v' \\<Rightarrow> k = x \\<or> P x v'\" for x\n    by blast\n  show \"case Mapping.lookup (Mapping.update k v m) x of None \\<Rightarrow> True | Some xa \\<Rightarrow> P x xa\" for x\n    using \\<open>P k v\\<close> A[of x] by (auto simp: lookup_update' split: option.splits)\nqed\n\nlemma All_mapping_update:\n  \"P k v \\<Longrightarrow> All_mapping m (\\<lambda>k' v'. k = k' \\<or> P k' v') \\<Longrightarrow> All_mapping (Mapping.update k v m) P\"\n  by (simp add: All_mapping_update_iff)\n\nlemma All_mapping_filter_iff: \"All_mapping (filter P m) Q \\<longleftrightarrow> All_mapping m (\\<lambda>k v. P k v \\<longrightarrow> Q k v)\"\n  by (auto simp: All_mapping_def lookup_filter split: option.splits)\n\nlemma All_mapping_filter: \"All_mapping m Q \\<Longrightarrow> All_mapping (filter P m) Q\"\n  by (auto simp: All_mapping_filter_iff intro: All_mapping_mono)\n\nlemma All_mapping_map_values: \"All_mapping (map_values f m) P \\<longleftrightarrow> All_mapping m (\\<lambda>k v. P k (f k v))\"\n  by (auto simp: All_mapping_def lookup_map_values split: option.splits)\n\nlemma All_mapping_tabulate: \"(\\<forall>x\\<in>set xs. P x (f x)) \\<Longrightarrow> All_mapping (Mapping.tabulate xs f) P\"\n  unfolding All_mapping_def\n  apply (intro allI)\n  apply transfer\n  apply (auto split: option.split dest!: map_of_SomeD)\n  done\n\nlemma All_mapping_alist:\n  \"(\\<And>k v. (k, v) \\<in> set xs \\<Longrightarrow> P k v) \\<Longrightarrow> All_mapping (Mapping.of_alist xs) P\"\n  by (auto simp: All_mapping_def lookup_of_alist dest!: map_of_SomeD split: option.splits)\n\nlemma combine_empty [simp]: \"combine f Mapping.empty y = y\" \"combine f y Mapping.empty = y\"\n  by (transfer; force)+\n\nlemma (in abel_semigroup) comm_monoid_set_combine: \"comm_monoid_set (combine f) Mapping.empty\"\n  by standard (transfer fixing: f, simp add: combine_options_ac[of f] ac_simps)+\n\nlocale combine_mapping_abel_semigroup = abel_semigroup\nbegin\n\nsublocale combine: comm_monoid_set \"combine f\" Mapping.empty\n  by (rule comm_monoid_set_combine)\n\nlemma fold_combine_code:\n  \"combine.F g (set xs) = foldr (\\<lambda>x. combine f (g x)) (remdups xs) Mapping.empty\"\nproof -\n  have \"combine.F g (set xs) = foldr (\\<lambda>x. combine f (g x)) xs Mapping.empty\"\n    if \"distinct xs\" for xs\n    using that by (induction xs) simp_all\n  from this[of \"remdups xs\"] show ?thesis by simp\nqed\n\nlemma keys_fold_combine: \"finite A \\<Longrightarrow> Mapping.keys (combine.F g A) = (\\<Union>x\\<in>A. Mapping.keys (g x))\"\n  by (induct A rule: finite_induct) simp_all\n\nend\n\nsubsubsection \\<open>@{term [source] entries}, @{term [source] ordered_entries},\n               and @{term [source] fold}\\<close>\n\ncontext linorder\nbegin\n\nsublocale folding_Map_graph: folding_insort_key \"(\\<le>)\" \"(<)\" \"Map.graph m\" fst for m\n  by unfold_locales (fact inj_on_fst_graph)\n\nend\n\nlemma sorted_fst_list_of_set_insort_Map_graph[simp]:\n  assumes \"finite (dom m)\" \"fst x \\<notin> dom m\"\n  shows \"sorted_key_list_of_set fst (insert x (Map.graph m))\n       = insort_key fst x (sorted_key_list_of_set fst (Map.graph m))\"\nproof(cases x)\n  case (Pair k v)\n  with \\<open>fst x \\<notin> dom m\\<close> have \"Map.graph m \\<subseteq> Map.graph (m(k \\<mapsto> v))\"\n    by(auto simp: graph_def)\n  moreover from Pair \\<open>fst x \\<notin> dom m\\<close> have \"(k, v) \\<notin> Map.graph m\"\n    using graph_domD by fastforce\n  ultimately show ?thesis\n    using Pair assms folding_Map_graph.sorted_key_list_of_set_insert[where ?m=\"m(k \\<mapsto> v)\"]\n    by auto\nqed\n\nlemma sorted_fst_list_of_set_insort_insert_Map_graph[simp]:\n  assumes \"finite (dom m)\" \"fst x \\<notin> dom m\"\n  shows \"sorted_key_list_of_set fst (insert x (Map.graph m))\n       = insort_insert_key fst x (sorted_key_list_of_set fst (Map.graph m))\"\nproof(cases x)\n  case (Pair k v)\n  with \\<open>fst x \\<notin> dom m\\<close> have \"Map.graph m \\<subseteq> Map.graph (m(k \\<mapsto> v))\"\n    by(auto simp: graph_def)    \n  with assms Pair show ?thesis\n    unfolding sorted_fst_list_of_set_insort_Map_graph[OF assms] insort_insert_key_def\n    using folding_Map_graph.set_sorted_key_list_of_set in_graphD by (fastforce split: if_splits)\nqed\n\nlemma linorder_finite_Map_induct[consumes 1, case_names empty update]:\n  fixes m :: \"'a::linorder \\<rightharpoonup> 'b\"\n  assumes \"finite (dom m)\"\n  assumes \"P Map.empty\"\n  assumes \"\\<And>k v m. \\<lbrakk> finite (dom m); k \\<notin> dom m; (\\<And>k'. k' \\<in> dom m \\<Longrightarrow> k' \\<le> k); P m \\<rbrakk>\n                    \\<Longrightarrow> P (m(k \\<mapsto> v))\"\n  shows \"P m\"\nproof -\n  let ?key_list = \"\\<lambda>m. sorted_list_of_set (dom m)\"\n  from assms(1,2) show ?thesis\n  proof(induction \"length (?key_list m)\" arbitrary: m)\n    case 0\n    then have \"sorted_list_of_set (dom m) = []\"\n      by auto\n    with \\<open>finite (dom m)\\<close> have \"m = Map.empty\"\n       by auto\n     with \\<open>P Map.empty\\<close> show ?case by simp\n  next\n    case (Suc n)\n    then obtain x xs where x_xs: \"sorted_list_of_set (dom m) = xs @ [x]\"\n      by (metis append_butlast_last_id length_greater_0_conv zero_less_Suc)\n    have \"sorted_list_of_set (dom (m(x := None))) = xs\"\n    proof -\n      have \"distinct (xs @ [x])\"\n        by (metis sorted_list_of_set.distinct_sorted_key_list_of_set x_xs)\n      then have \"remove1 x (xs @ [x]) = xs\"\n        by (simp add: remove1_append)\n      with \\<open>finite (dom m)\\<close> x_xs show ?thesis\n        by (simp add: sorted_list_of_set_remove)\n    qed\n    moreover have \"k \\<le> x\" if \"k \\<in> dom (m(x := None))\" for k\n    proof -\n      from x_xs have \"sorted (xs @ [x])\"\n        by (metis sorted_list_of_set.sorted_sorted_key_list_of_set)\n      moreover from \\<open>k \\<in> dom (m(x := None))\\<close> have \"k \\<in> set xs\"\n        using \\<open>finite (dom m)\\<close> \\<open>sorted_list_of_set (dom (m(x := None))) = xs\\<close>\n        by auto\n      ultimately show \"k \\<le> x\"\n        by (simp add: sorted_append)\n    qed     \n    moreover from \\<open>finite (dom m)\\<close> have \"finite (dom (m(x := None)))\" \"x \\<notin> dom (m(x := None))\"\n      by simp_all\n    moreover have \"P (m(x := None))\"\n      using Suc \\<open>sorted_list_of_set (dom (m(x := None))) = xs\\<close> x_xs by auto\n    ultimately show ?case\n      using assms(3)[where ?m=\"m(x := None)\"] by (metis fun_upd_triv fun_upd_upd not_Some_eq)\n  qed\nqed\n\nlemma delete_insort_fst[simp]: \"AList.delete k (insort_key fst (k, v) xs) = AList.delete k xs\"\n  by (induction xs) simp_all\n\nlemma insort_fst_delete: \"\\<lbrakk> fst x \\<noteq> k2; sorted (List.map fst xs) \\<rbrakk>\n  \\<Longrightarrow> insort_key fst x (AList.delete k2 xs) = AList.delete k2 (insort_key fst x xs)\"\n  by (induction xs) (fastforce simp add: insort_is_Cons order_trans)+\n\nlemma sorted_fst_list_of_set_Map_graph_fun_upd_None[simp]:\n  \"sorted_key_list_of_set fst (Map.graph (m(k := None)))\n   = AList.delete k (sorted_key_list_of_set fst (Map.graph m))\"\nproof(cases \"finite (Map.graph m)\")\n  assume \"finite (Map.graph m)\"\n  from this[unfolded finite_graph_iff_finite_dom] show ?thesis\n  proof(induction rule: finite_Map_induct)\n    let ?list_of=\"sorted_key_list_of_set fst\"\n    case (update k2 v2 m)\n    note [simp] = \\<open>k2 \\<notin> dom m\\<close> \\<open>finite (dom m)\\<close>\n\n    have right_eq: \"AList.delete k (?list_of (Map.graph (m(k2 \\<mapsto> v2))))\n      = AList.delete k (insort_key fst (k2, v2) (?list_of (Map.graph m)))\"\n      by simp\n\n    show ?case\n    proof(cases \"k = k2\")\n      case True\n      then have \"?list_of (Map.graph ((m(k2 \\<mapsto> v2))(k := None)))\n        = AList.delete k (insort_key fst (k2, v2) (?list_of (Map.graph m)))\"\n        using fst_graph_eq_dom update.IH by auto\n      then show ?thesis\n        using right_eq by metis\n    next\n      case False\n      then have \"AList.delete k (insort_key fst (k2, v2) (?list_of (Map.graph m)))\n        = insort_key fst (k2, v2) (?list_of (Map.graph (m(k := None))))\"\n        by (auto simp add: insort_fst_delete update.IH\n                      folding_Map_graph.sorted_sorted_key_list_of_set[OF subset_refl])\n      also have \"\\<dots> = ?list_of (insert (k2, v2) (Map.graph (m(k := None))))\"\n        by auto\n      also from False \\<open>k2 \\<notin> dom m\\<close> have \"\\<dots> = ?list_of (Map.graph ((m(k2 \\<mapsto> v2))(k := None)))\"\n        by (metis graph_map_upd domIff fun_upd_triv fun_upd_twist)\n      finally show ?thesis using right_eq by metis\n    qed\n  qed simp\nqed simp\n\nlemma entries_empty[simp]: \"entries empty = {}\"\n  by transfer (fact graph_empty)\n\nlemma entries_lookup: \"entries m = Map.graph (lookup m)\"\n  by transfer rule\n\nlemma in_entriesI: \"lookup m k = Some v \\<Longrightarrow> (k, v) \\<in> entries m\"\n  by transfer (fact in_graphI)\n\nlemma in_entriesD: \"(k, v) \\<in> entries m \\<Longrightarrow> lookup m k = Some v\"\n  by transfer (fact in_graphD)\n\nlemma fst_image_entries_eq_keys[simp]: \"fst ` Mapping.entries m = Mapping.keys m\"\n  by transfer (fact fst_graph_eq_dom)\n\nlemma finite_entries_iff_finite_keys[simp]:\n  \"finite (entries m) = finite (keys m)\"\n  by transfer (fact finite_graph_iff_finite_dom)\n\nlemma entries_update:\n  \"entries (update k v m) = insert (k, v) (entries (delete k m))\"\n  by transfer (fact graph_map_upd)\n\nlemma entries_delete:\n  \"entries (delete k m) = {e \\<in> entries m. fst e \\<noteq> k}\"\n  by transfer (fact graph_fun_upd_None)\n\nlemma entries_of_alist[simp]:\n  \"distinct (List.map fst xs) \\<Longrightarrow> entries (of_alist xs) = set xs\"\n  by transfer (fact graph_map_of_if_distinct_dom)\n\nlemma entries_keysD:\n  \"x \\<in> entries m \\<Longrightarrow> fst x \\<in> keys m\"\n  by transfer (fact graph_domD)\n\nlemma set_ordered_entries[simp]:\n  \"finite (keys m) \\<Longrightarrow> set (ordered_entries m) = entries m\"\n  unfolding ordered_entries_def\n  by transfer (auto simp: folding_Map_graph.set_sorted_key_list_of_set[OF subset_refl])\n\nlemma distinct_ordered_entries[simp]: \"distinct (List.map fst (ordered_entries m))\"\n  unfolding ordered_entries_def\n  by transfer (simp add: folding_Map_graph.distinct_sorted_key_list_of_set[OF subset_refl])\n\nlemma sorted_ordered_entries[simp]: \"sorted (List.map fst (ordered_entries m))\"\n  unfolding ordered_entries_def\n  by transfer (auto intro: folding_Map_graph.sorted_sorted_key_list_of_set)\n\nlemma ordered_entries_infinite[simp]:\n  \"\\<not> finite (Mapping.keys m) \\<Longrightarrow> ordered_entries m = []\"\n  by (simp add: ordered_entries_def)\n\nlemma ordered_entries_empty[simp]: \"ordered_entries empty = []\"\n  by (simp add: ordered_entries_def)\n\nlemma ordered_entries_update[simp]:\n  assumes \"finite (keys m)\"\n  shows \"ordered_entries (update k v m)\n   = insort_insert_key fst (k, v) (AList.delete k (ordered_entries m))\"\nproof -\n  let ?list_of=\"sorted_key_list_of_set fst\" and ?insort=\"insort_insert_key fst\"\n\n  have *: \"?list_of (insert (k, v) (Map.graph (m(k := None))))\n    = ?insort (k, v) (AList.delete k (?list_of (Map.graph m)))\" if \"finite (dom m)\" for m\n  proof -\n    from \\<open>finite (dom m)\\<close> have \"?list_of (insert (k, v) (Map.graph (m(k := None))))\n      = ?insort (k, v) (?list_of (Map.graph (m(k := None))))\"\n      by (intro sorted_fst_list_of_set_insort_insert_Map_graph) (simp_all add: subset_insertI) \n    then show ?thesis by simp\n  qed\n  from assms show ?thesis\n    unfolding ordered_entries_def\n    apply (transfer fixing: k v) using \"*\" by auto\nqed\n\nlemma ordered_entries_delete[simp]:\n  \"ordered_entries (delete k m) = AList.delete k (ordered_entries m)\"\n  unfolding ordered_entries_def by transfer auto\n\nlemma map_fst_ordered_entries[simp]:\n  \"List.map fst (ordered_entries m) = ordered_keys m\"\nproof(cases \"finite (Mapping.keys m)\")\n  case True\n  then have \"set (List.map fst (Mapping.ordered_entries m)) = set (Mapping.ordered_keys m)\"\n    unfolding ordered_entries_def ordered_keys_def\n    by (transfer) (simp add: folding_Map_graph.set_sorted_key_list_of_set[OF subset_refl] fst_graph_eq_dom)\n  with True show \"List.map fst (Mapping.ordered_entries m) = Mapping.ordered_keys m\"\n    by (metis distinct_ordered_entries ordered_keys_def sorted_list_of_set.idem_if_sorted_distinct          \n              sorted_list_of_set.set_sorted_key_list_of_set sorted_ordered_entries)\nnext\n  case False\n  then show ?thesis\n    unfolding ordered_entries_def ordered_keys_def by simp\nqed\n\nlemma fold_empty[simp]: \"fold f empty a = a\"\n  unfolding fold_def by simp\n\nlemma insort_key_is_snoc_if_sorted_and_distinct:\n  assumes \"sorted (List.map f xs)\" \"f y \\<notin> f ` set xs\" \"\\<forall>x \\<in> set xs. f x \\<le> f y\"\n  shows \"insort_key f y xs = xs @ [y]\"\n  using assms by (induction xs) (auto dest!: insort_is_Cons)\n\nlemma fold_update:\n  assumes \"finite (keys m)\"\n  assumes \"k \\<notin> keys m\" \"\\<And>k'. k' \\<in> keys m \\<Longrightarrow> k' \\<le> k\"\n  shows \"fold f (update k v m) a = f k v (fold f m a)\"\nproof -\n  from assms have k_notin_entries: \"k \\<notin> fst ` set (ordered_entries m)\"\n    using entries_keysD by fastforce\n  with assms have \"ordered_entries (update k v m)\n    = insort_insert_key fst (k, v) (ordered_entries m)\"\n    by simp\n  also from k_notin_entries have \"\\<dots> = ordered_entries m @ [(k, v)]\"\n  proof -\n    from assms have \"\\<forall>x \\<in> set (ordered_entries m). fst x \\<le> fst (k, v)\"\n      unfolding ordered_entries_def\n      by transfer (fastforce simp: folding_Map_graph.set_sorted_key_list_of_set[OF order_refl]\n                             dest: graph_domD)\n    from insort_key_is_snoc_if_sorted_and_distinct[OF _ _ this] k_notin_entries \\<open>finite (keys m)\\<close>\n    show ?thesis\n      using sorted_ordered_keys\n      unfolding insort_insert_key_def by auto\n  qed\n  finally show ?thesis unfolding fold_def by simp\nqed\n\nlemma linorder_finite_Mapping_induct[consumes 1, case_names empty update]:\n  fixes m :: \"('a::linorder, 'b) mapping\"\n  assumes \"finite (keys m)\"\n  assumes \"P empty\"\n  assumes \"\\<And>k v m.\n    \\<lbrakk> finite (keys m); k \\<notin> keys m; (\\<And>k'. k' \\<in> keys m \\<Longrightarrow> k' \\<le> k); P m \\<rbrakk>\n    \\<Longrightarrow> P (update k v m)\"\n  shows \"P m\"\n  using assms by transfer (simp add: linorder_finite_Map_induct)\n\n\nsubsection \\<open>Code generator setup\\<close>\n\nhide_const (open) empty is_empty rep lookup lookup_default filter update delete ordered_keys\n  keys size replace default map_entry map_default tabulate bulkload map map_values combine of_alist\n  entries ordered_entries fold\n\nend\n", "meta": {"author": "dtraytel", "repo": "HOLRLT", "sha": "e9029da59bb3af0c835604a65308498f9696a364", "save_path": "github-repos/isabelle/dtraytel-HOLRLT", "path": "github-repos/isabelle/dtraytel-HOLRLT/HOLRLT-e9029da59bb3af0c835604a65308498f9696a364/HOLRLT/Library/Mapping.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813031051514762, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.33125711574585126}}
{"text": "theory Option_Monad_Add\nimports \"HOL-Library.Monad_Syntax\"\nbegin\n  definition \"oassert \\<Phi> \\<equiv> if \\<Phi> then Some () else None\"\n\n  fun omap :: \"('a\\<rightharpoonup>'b) \\<Rightarrow> 'a list \\<rightharpoonup> 'b list\" where\n    \"omap f [] = Some []\" \n  | \"omap f (x#xs) = do { y \\<leftarrow> f x; ys \\<leftarrow> omap f xs; Some (y#ys) }\"  \n    \n  lemma omap_cong[fundef_cong]:\n    assumes \"\\<And>x. x\\<in>set l' \\<Longrightarrow> f x = f' x\"\n    assumes \"l=l'\"\n    shows \"omap f l = omap f' l'\"\n    unfolding assms(2) using assms(1) by (induction l') (auto)\n\n  lemma assert_eq_iff[simp]: \n    \"oassert \\<Phi> = None \\<longleftrightarrow> \\<not>\\<Phi>\"  \n    \"oassert \\<Phi> = Some u \\<longleftrightarrow> \\<Phi>\"  \n    unfolding oassert_def by auto\n\n  lemma omap_length[simp]: \"omap f l = Some l' \\<Longrightarrow> length l' = length l\" \n    apply (induction l arbitrary: l') \n    apply (auto split: Option.bind_splits)\n    done \n\n  lemma omap_append[simp]: \"omap f (xs@ys) = do {xs \\<leftarrow> omap f xs; ys \\<leftarrow> omap f ys; Some (xs@ys)}\"\n    by (induction xs) (auto)\n    \n        \n  lemma omap_alt: \"omap f l = Some l' \\<longleftrightarrow> (l' = map (the o f) l \\<and> (\\<forall>x\\<in>set l. f x \\<noteq> None))\"  \n    apply (induction l arbitrary: l')\n    apply (auto split: Option.bind_splits)\n    done\n    \n  lemma omap_alt_None: \"omap f l = None \\<longleftrightarrow> (\\<exists>x\\<in>set l. f x = None)\"\n    apply (induction l)\n    apply (auto split: Option.bind_splits)\n    done\n    \n  lemma omap_nth: \"\\<lbrakk>omap f l = Some l'; i<length l\\<rbrakk> \\<Longrightarrow> f (l!i) = Some (l'!i)\"\n    apply (induction l arbitrary: l' i)\n    apply (auto split: Option.bind_splits simp: nth_Cons split: nat.splits)\n    done\n\n  lemma omap_eq_Nil_conv[simp]: \"omap f xs = Some [] \\<longleftrightarrow> xs=[]\"\n    apply (cases xs) \n    apply (auto split: Option.bind_splits)\n    done\n\n  lemma omap_eq_Cons_conv[simp]: \"omap f xs = Some (y#ys') \\<longleftrightarrow> (\\<exists>x xs'. xs=x#xs' \\<and> f x = Some y \\<and> omap f xs' = Some ys')\"  \n    apply (cases xs) \n    apply (auto split: Option.bind_splits)\n    done\n        \n  lemma omap_eq_append_conv[simp]: \"omap f xs = Some (ys\\<^sub>1@ys\\<^sub>2) \\<longleftrightarrow> (\\<exists>xs\\<^sub>1 xs\\<^sub>2. xs=xs\\<^sub>1@xs\\<^sub>2 \\<and> omap f xs\\<^sub>1 = Some ys\\<^sub>1 \\<and> omap f xs\\<^sub>2 = Some ys\\<^sub>2)\"\n    apply (induction ys\\<^sub>1 arbitrary: xs)\n    apply (auto 0 3 split: Option.bind_splits)\n    apply (metis append_Cons)\n    done\n  \n  lemma omap_list_all2_conv: \"omap f xs = Some ys \\<longleftrightarrow> (list_all2 (\\<lambda>x y. f x = Some y)) xs ys\"  \n    apply (induction xs arbitrary: ys)\n    apply (auto split: Option.bind_splits simp: )\n    apply (simp add: list_all2_Cons1)\n    apply (simp add: list_all2_Cons1)\n    apply (simp add: list_all2_Cons1)\n    apply clarsimp\n    by (metis option.inject)\n    \n    \n    \n    \n  fun omap_option where\n    \"omap_option f None = Some None\"    \n  | \"omap_option f (Some x) = do { x \\<leftarrow> f x; Some (Some x) }\"\n  \n  lemma omap_option_conv:\n    \"omap_option f xx = None \\<longleftrightarrow> (\\<exists>x. xx=Some x \\<and> f x = None)\" \n    \"omap_option f xx = (Some (Some x')) \\<longleftrightarrow> (\\<exists>x. xx=Some x \\<and> f x = Some x')\"\n    \"omap_option f xx = (Some None) \\<longleftrightarrow> xx=None\"\n    by (cases xx;auto split: Option.bind_splits)+\n  \n  lemma omap_option_eq: \"omap_option f x = (case x of None \\<Rightarrow> Some None | Some x \\<Rightarrow> do { x \\<leftarrow> f x; Some (Some x) })\"  \n    by (auto split: option.split)\n      \n  fun omap_prod where\n    \"omap_prod f\\<^sub>1 f\\<^sub>2 (a,b) = do { a\\<leftarrow>f\\<^sub>1 a; b\\<leftarrow>f\\<^sub>2 b; Some (a,b) }\"\n    \n      \n  (* Extend map function for datatype to option monad.\n    TODO: Show reasonable lemmas, like parametricity, etc. \n    Hopefully only depending on BNF-property of datatype\n   *)\n  definition \"omap_dt setf mapf f obj \\<equiv> do {\n    oassert (\\<forall>x\\<in>setf obj. f x \\<noteq> None);\n    Some (mapf (the o f) obj)\n  }\"\n    \n    \n    \nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/AI_Planning_Languages_Semantics/Option_Monad_Add.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.3312571074789061}}
{"text": "(*  Title:       Safe OCL\n    Author:      Denis Nikiforov, March 2019\n    Maintainer:  Denis Nikiforov <denis.nikif at gmail.com>\n    License:     LGPL\n*)\nchapter \\<open>Typing\\<close>\ntheory OCL_Typing\n  imports OCL_Object_Model OCL_Type_Helpers \"HOL-Library.Transitive_Closure_Table\"\nbegin\n\ntext \\<open>\n  The following rules are more restrictive than rules given in\n  the OCL specification. This allows one to identify more errors\n  in expressions. However, these restrictions may be revised if necessary.\n  Perhaps some of them could be separated and should cause warnings\n  instead of errors.\\<close>\n\n(*** Operations Typing ******************************************************)\n\nsection \\<open>Operations Typing\\<close>\n\ntext \\<open>\n  A strict operation is an operation that is defined for invalid source and\n  arguments and returns an invalid value if any of its source or arguments\n  is invalid.\n\n  A non-strict operation is an operation that either is not defined for\n  invalid source and arguments or returns a valid value for invalid source\n  or arguments.\n\n  A null-safe operation is an operation that is defined for a nullable\n  source.\n\n  All metaclass and type operations are non-strict, because neither\n  source nor argument types can be invalid. For these operations we\n  define rules for errorable types explicitly.\n\n  Most of the other operations are strict by default. The typing rules\n  for errorable source and arguments are defined implicitly. The only\n  exclusion from this rule is the following non-strict operations:\\<close>\n\ninductive non_strict_op :: \"op \\<Rightarrow> bool\" where\n  \"non_strict_op OclIsUndefinedOp\"\n| \"non_strict_op OclIsInvalidOp\"\n| \"non_strict_op AndOp\"\n| \"non_strict_op OrOp\"\n| \"non_strict_op XorOp\"\n| \"non_strict_op ImpliesOp\"\n\nabbreviation \"strict_op op \\<equiv> \\<not> non_strict_op op\"\n\nsubsection \\<open>Metaclass Operations\\<close>\n\ntext \\<open>\n  All basic types in the theory are either nullable or non-nullable.\n  For example, instead of @{text Boolean} type we have two types:\n  @{text \"Boolean[1]\"} and @{text \"Boolean[?]\"}.\n  The @{text \"allInstances()\"} operation is extended accordingly:\\<close>\n\ntext \\<open>\n\\<^verbatim>\\<open>Boolean[1].allInstances() = Set{true, false}\nBoolean[?].allInstances() = Set{true, false, null}\\<close>\\<close>\n\ninductive mataop_type where\n  \"finite_type\\<^sub>N \\<tau> \\<Longrightarrow>\n   mataop_type (ErrorFree \\<tau>) AllInstancesOp (Set \\<tau>)[1]\"\n\nsubsection \\<open>Type Operations\\<close>\n\ntext \\<open>\n  At first we decided to allow casting only to subtypes.\n  However sometimes it is necessary to cast expressions to supertypes,\n  for example, to access overridden attributes of a supertype.\n  So we allow casting to subtypes and supertypes.\n  Casting to other types is meaningless and prohibited.\\<close>\n\ntext \\<open>\n  According to the Section 7.4.7 of the OCL specification\n  @{text \"oclAsType()\"} can be applied to collections as well as\n  to single values. I guess we can allow @{text \"oclIsTypeOf()\"}\n  and @{text \"oclIsKindOf()\"} for collections too.\\<close>\n\ntext \\<open>\n  Please take a note that the following expressions are prohibited,\n  because they always return true or false:\\<close>\n\ntext \\<open>\n\\<^verbatim>\\<open>1.oclIsKindOf(OclAny[?])\n1.oclIsKindOf(String[1])\\<close>\\<close>\n\ntext \\<open>\n  Please take a note that:\\<close>\n\ntext \\<open>\n\\<^verbatim>\\<open>Set{1,2,null,'abc'}->selectByKind(Integer[1]) = Set{1,2}\nSet{1,2,null,'abc'}->selectByKind(Integer[?]) = Set{1,2,null}\\<close>\\<close>\n\ntext \\<open>\n  The following expressions are prohibited, because they always\n  returns either the same or empty collections:\\<close>\n\ntext \\<open>\n\\<^verbatim>\\<open>Set{1,2,null,'abc'}->selectByKind(OclAny[?])\nSet{1,2,null,'abc'}->selectByKind(Collection(Boolean[1]))\\<close>\\<close>\n\ninductive typeop_type where\n  \"\\<tau> < \\<sigma> \\<Longrightarrow>\n   typeop_type DotCall OclAsTypeOp \\<tau> \\<sigma> \\<sigma>\"\n| \"\\<sigma> < \\<tau> \\<Longrightarrow>\n   typeop_type DotCall OclAsTypeOp \\<tau> \\<sigma> \\<sigma>\\<lbrakk>.!\\<rbrakk>\"\n\n| \"\\<sigma> < \\<tau>[1] \\<Longrightarrow>\n   typeop_type DotCall OclIsTypeOfOp \\<tau>[1] \\<sigma> Boolean[1]\"\n| \"\\<sigma> < \\<tau>[?] \\<Longrightarrow>\n   typeop_type DotCall OclIsTypeOfOp \\<tau>[?] \\<sigma> Boolean[1!]\"\n| \"\\<sigma> < \\<tau>[1!] \\<Longrightarrow>\n   typeop_type DotCall OclIsTypeOfOp \\<tau>[1!] \\<sigma> Boolean[1!]\"\n| \"\\<sigma> < \\<tau>[?!] \\<Longrightarrow>\n   typeop_type DotCall OclIsTypeOfOp \\<tau>[?!] \\<sigma> Boolean[1!]\"\n\n| \"\\<sigma> < \\<tau>[1] \\<Longrightarrow>\n   typeop_type DotCall OclIsKindOfOp \\<tau>[1] \\<sigma> Boolean[1]\"\n| \"\\<sigma> < \\<tau>[?] \\<Longrightarrow>\n   typeop_type DotCall OclIsKindOfOp \\<tau>[?] \\<sigma> Boolean[1!]\"\n| \"\\<sigma> < \\<tau>[1!] \\<Longrightarrow>\n   typeop_type DotCall OclIsKindOfOp \\<tau>[1!] \\<sigma> Boolean[1!]\"\n| \"\\<sigma> < \\<tau>[?!] \\<Longrightarrow>\n   typeop_type DotCall OclIsKindOfOp \\<tau>[?!] \\<sigma> Boolean[1!]\"\n\n| \"\\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<rho>)[1] \\<Longrightarrow> \\<sigma> < \\<rho> \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> Collection\\<^bsub>k\\<^esub>(\\<sigma>)[1] \\<Longrightarrow>\n   typeop_type ArrowCall SelectByKindOp \\<tau> \\<sigma> \\<upsilon>\"\n| \"\\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<rho>)[1!] \\<Longrightarrow> \\<sigma> < \\<rho> \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> Collection\\<^bsub>k\\<^esub>(\\<sigma>)[1!] \\<Longrightarrow>\n   typeop_type ArrowCall SelectByKindOp \\<tau> \\<sigma> \\<upsilon>\"\n\n| \"\\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<rho>)[1] \\<Longrightarrow> \\<sigma> < \\<rho> \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> Collection\\<^bsub>k\\<^esub>(\\<sigma>)[1] \\<Longrightarrow>\n   typeop_type ArrowCall SelectByTypeOp \\<tau> \\<sigma> \\<upsilon>\"\n| \"\\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<rho>)[1!] \\<Longrightarrow> \\<sigma> < \\<rho> \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> Collection\\<^bsub>k\\<^esub>(\\<sigma>)[1!] \\<Longrightarrow>\n   typeop_type ArrowCall SelectByTypeOp \\<tau> \\<sigma> \\<upsilon>\"\n\nsubsection \\<open>OclAny Operations\\<close>\n\ntext \\<open>\n  The OCL specification defines @{text \"toString()\"} operation\n  only for boolean and numeric types. However, I guess it is a good\n  idea to define it once for all types. The OCL specification does not\n  state that the operation can return @{text invalid} for a null\n  boolean value. Let us suppose that it returns a \"null\" string.\n  However, I guess that the operation should be strict and\n  return @{text invalid} for an invalid value.\\<close>\n\ninductive any_unop_type where\n  \"\\<tau> \\<hookrightarrow> NonIterable(\\<sigma>[1]) \\<Longrightarrow>\n   any_unop_type OclAsSetOp \\<tau> (Set \\<sigma>[\\<^bold>1])[1]\"\n| \"\\<tau> \\<hookrightarrow> NonIterable(\\<sigma>[?]) \\<Longrightarrow>\n   any_unop_type OclAsSetOp \\<tau> (Set \\<sigma>[\\<^bold>1])[1]\"\n\n| \"\\<tau> \\<hookrightarrow> ObjectType(\\<C>)[_] \\<Longrightarrow>\n   any_unop_type OclIsNewOp \\<tau> Boolean[1]\"\n\n| \"any_unop_type OclIsUndefinedOp \\<tau>[?] Boolean[1]\"\n| \"any_unop_type OclIsUndefinedOp \\<tau>[1!] Boolean[1]\"\n| \"any_unop_type OclIsUndefinedOp \\<tau>[?!] Boolean[1]\"\n\n| \"any_unop_type OclIsInvalidOp \\<tau>[1!] Boolean[1]\"\n| \"any_unop_type OclIsInvalidOp \\<tau>[?!] Boolean[1]\"\n\n| \"any_unop_type ToStringOp \\<tau> String[1]\"\n\ntext \\<open>\n  It makes sense to compare values only with compatible types.\\<close>\n\n(* We have to specify the predicate type explicitly to let\n   a generated code work *)\ninductive any_binop_type\n    :: \"any_binop \\<Rightarrow> ('a :: order) type\\<^sub>N\\<^sub>E \\<Rightarrow> 'a type\\<^sub>N\\<^sub>E \\<Rightarrow> 'a type\\<^sub>N\\<^sub>E \\<Rightarrow> bool\" where\n  \"\\<tau> \\<le> \\<sigma> \\<or> \\<sigma> < \\<tau> \\<Longrightarrow>\n   any_binop_type EqualOp \\<tau> \\<sigma> Boolean[1]\"\n| \"\\<tau> \\<le> \\<sigma> \\<or> \\<sigma> < \\<tau> \\<Longrightarrow>\n   any_binop_type NotEqualOp \\<tau> \\<sigma> Boolean[1]\"\n\nsubsection \\<open>Boolean Operations\\<close>\n\ntext \\<open>\n  Please take a note that:\\<close>\n\ntext \\<open>\n\\<^verbatim>\\<open>true or false : Boolean[1]\ntrue and null : Boolean[?]\nnull and null : OclVoid[?]\\<close>\\<close>\n\ninductive boolean_unop_type where\n  \"\\<tau> \\<le> Boolean[?!] \\<Longrightarrow>\n   boolean_unop_type NotOp \\<tau> \\<tau>\"\n\ninductive boolean_binop_type where\n  \"\\<tau> \\<squnion> \\<sigma> = \\<rho> \\<Longrightarrow> \\<rho> \\<le> Boolean[?!] \\<Longrightarrow>\n   boolean_binop_type AndOp \\<tau> \\<sigma> \\<rho>\"\n| \"\\<tau> \\<squnion> \\<sigma> = \\<rho> \\<Longrightarrow> \\<rho> \\<le> Boolean[?!] \\<Longrightarrow>\n   boolean_binop_type OrOp \\<tau> \\<sigma> \\<rho>\"\n| \"\\<tau> \\<squnion> \\<sigma> = \\<rho> \\<Longrightarrow> \\<rho> \\<le> Boolean[?!] \\<Longrightarrow>\n   boolean_binop_type XorOp \\<tau> \\<sigma> \\<rho>\"\n| \"\\<tau> \\<squnion> \\<sigma> = \\<rho> \\<Longrightarrow> \\<rho> \\<le> Boolean[?!] \\<Longrightarrow>\n   boolean_binop_type ImpliesOp \\<tau> \\<sigma> \\<rho>\"\n\nsubsection \\<open>Numeric Operations\\<close>\n\ntext \\<open>\n  The expression @{text \"1 + null\"} is not well-typed.\n  Nullable numeric values should be converted to non-nullable ones.\n  This is a significant difference from the OCL specification.\\<close>\n\ntext \\<open>\n  Please take a note that @{text \"floor()\"} and @{text \"round()\"}\n  operations are undefined for the @{text \"Integer\"} type.\n  The @{text \"Integer\"} type is not inherited from the @{text \"Real\"}\n  type, it is just a subtype.\\<close>\n\ntext \\<open>\n  The @{text \"oclAsType(Integer)\"} operation is not well-typed,\n  because the @{text \"UnlimitedNatural\"} type is not a subtype\n  of the @{text \"Integer\"} type. So the @{text \"toInteger()\"}\n  operation should be used instead.\\<close>\n\ninductive numeric_unop_type where\n  \"numeric_unop_type UMinusOp Real[1] Real[1]\"\n| \"numeric_unop_type UMinusOp Integer[1] Integer[1]\"\n\n| \"numeric_unop_type AbsOp Real[1] Real[1]\"\n| \"numeric_unop_type AbsOp Integer[1] Integer[1]\"\n\n| \"numeric_unop_type FloorOp Real[1] Integer[1]\"\n| \"numeric_unop_type RoundOp Real[1] Integer[1]\"\n\n| \"numeric_unop_type numeric_unop.ToIntegerOp UnlimitedNatural[1] Integer[1!]\"\n\ninductive numeric_binop_type where\n  \"\\<tau> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow> \\<sigma> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow>\n   numeric_binop_type PlusOp \\<tau> \\<sigma> (\\<tau> \\<squnion> \\<sigma>)\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type PlusOp \\<tau> \\<sigma> UnlimitedNatural[1!]\"\n\n| \"\\<tau> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow> \\<sigma> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow>\n   numeric_binop_type MinusOp \\<tau> \\<sigma> (\\<tau> \\<squnion> \\<sigma>)\"\n\n| \"\\<tau> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow> \\<sigma> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow>\n   numeric_binop_type MultOp \\<tau> \\<sigma> (\\<tau> \\<squnion> \\<sigma>)\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type MultOp \\<tau> \\<sigma> UnlimitedNatural[1!]\"\n\n| \"\\<tau> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow> \\<sigma> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow>\n   numeric_binop_type DivideOp \\<tau> \\<sigma> Real[1!]\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type DivideOp \\<tau> \\<sigma> Real[1!]\"\n\n| \"\\<tau> = Integer[1] \\<Longrightarrow> \\<sigma> = Integer[1] \\<Longrightarrow>\n   numeric_binop_type DivOp \\<tau> \\<sigma> Integer[1!]\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type DivOp \\<tau> \\<sigma> UnlimitedNatural[1!]\"\n\n| \"\\<tau> = Integer[1] \\<Longrightarrow> \\<sigma> = Integer[1] \\<Longrightarrow>\n   numeric_binop_type ModOp \\<tau> \\<sigma> Integer[1!]\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type ModOp \\<tau> \\<sigma> UnlimitedNatural[1!]\"\n\n| \"\\<tau> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow> \\<sigma> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow>\n   numeric_binop_type NumericMaxOp \\<tau> \\<sigma> (\\<tau> \\<squnion> \\<sigma>)\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type NumericMaxOp \\<tau> \\<sigma> UnlimitedNatural[1]\"\n\n| \"\\<tau> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow> \\<sigma> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow>\n   numeric_binop_type NumericMinOp \\<tau> \\<sigma> (\\<tau> \\<squnion> \\<sigma>)\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type NumericMinOp \\<tau> \\<sigma> UnlimitedNatural[1]\"\n\n| \"\\<tau> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow> \\<sigma> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow>\n   numeric_binop_type NumericLessOp \\<tau> \\<sigma> Boolean[1]\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type NumericLessOp \\<tau> \\<sigma> Boolean[1]\"\n\n| \"\\<tau> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow> \\<sigma> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow>\n   numeric_binop_type NumericLessEqOp \\<tau> \\<sigma> Boolean[1]\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type NumericLessEqOp \\<tau> \\<sigma> Boolean[1]\"\n\n| \"\\<tau> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow> \\<sigma> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow>\n   numeric_binop_type NumericGreaterOp \\<tau> \\<sigma> Boolean[1]\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type NumericGreaterOp \\<tau> \\<sigma> Boolean[1]\"\n\n| \"\\<tau> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow> \\<sigma> = Integer[1]\\<midarrow>Real[1] \\<Longrightarrow>\n   numeric_binop_type NumericGreaterEqOp \\<tau> \\<sigma> Boolean[1]\"\n| \"\\<tau> = UnlimitedNatural[1] \\<Longrightarrow> \\<sigma> = UnlimitedNatural[1] \\<Longrightarrow>\n   numeric_binop_type NumericGreaterEqOp \\<tau> \\<sigma> Boolean[1]\"\n\nsubsection \\<open>String Operations\\<close>\n\ninductive string_unop_type where\n  \"string_unop_type StringSizeOp String[1] Integer[1]\"\n| \"string_unop_type CharactersOp String[1] (Sequence String[\\<^bold>1])[1]\"\n| \"string_unop_type ToUpperCaseOp String[1] String[1]\"\n| \"string_unop_type ToLowerCaseOp String[1] String[1]\"\n| \"string_unop_type ToBooleanOp String[1] Boolean[1!]\"\n| \"string_unop_type ToRealOp String[1] Real[1!]\"\n| \"string_unop_type ToIntegerOp String[1] Integer[1!]\"\n\ninductive string_binop_type where\n  \"string_binop_type ConcatOp String[1] String[1] String[1]\"\n| \"string_binop_type EqualsIgnoreCaseOp String[1] String[1] Boolean[1]\"\n| \"string_binop_type StringLessOp String[1] String[1] Boolean[1]\"\n| \"string_binop_type StringLessEqOp String[1] String[1] Boolean[1]\"\n| \"string_binop_type StringGreaterOp String[1] String[1] Boolean[1]\"\n| \"string_binop_type StringGreaterEqOp String[1] String[1] Boolean[1]\"\n| \"string_binop_type StringIndexOfOp String[1] String[1] Integer[1]\"\n| \"string_binop_type StringAtOp String[1] Integer[1] String[1!]\"\n\ninductive string_ternop_type where\n  \"string_ternop_type SubstringOp String[1] Integer[1] Integer[1] String[1!]\"\n\nsubsection \\<open>Iterable Operations\\<close>\n\ntext \\<open>\n  Please take a note, that @{text \"flatten()\"} preserves a collection kind.\\<close>\n\nabbreviation \"max_op_defined \\<tau> \\<equiv>\n  (\\<tau> = Real[1] \\<or> \\<tau> = Integer[1] \\<or> \\<tau> = UnlimitedNatural[1] \\<or>\n   operation_defined \\<tau> STR ''max'' [\\<tau>])\"\n\nabbreviation \"min_op_defined \\<tau> \\<equiv>\n  (\\<tau> = Real[1] \\<or> \\<tau> = Integer[1] \\<or> \\<tau> = UnlimitedNatural[1] \\<or>\n   operation_defined \\<tau> STR ''min'' [\\<tau>])\"\n\nabbreviation \"sum_op_defined \\<tau> \\<equiv>\n  (\\<tau> = Real[1] \\<or> \\<tau> = Integer[1] \\<or> \\<tau> = UnlimitedNatural[1] \\<or>\n   operation_defined \\<tau> STR ''+'' [\\<tau>])\"\n\n\ninductive comparable_type\\<^sub>T where\n  \"comparable_type\\<^sub>T Real\"\n| \"comparable_type\\<^sub>T Integer\"\n| \"comparable_type\\<^sub>T UnlimitedNatural\"\n| \"comparable_type\\<^sub>T String\"\n\ninductive comparable_type\\<^sub>N where\n  \"comparable_type\\<^sub>T \\<tau> \\<Longrightarrow>\n   comparable_type\\<^sub>N (Required \\<tau>) False\"\n| \"comparable_type\\<^sub>T \\<tau> \\<Longrightarrow>\n   comparable_type\\<^sub>N (Optional \\<tau>) True\"\n\ninductive comparable_type where\n  \"comparable_type\\<^sub>N \\<tau> n \\<Longrightarrow>\n   comparable_type (ErrorFree \\<tau>) n\"\n| \"comparable_type\\<^sub>N \\<tau> n \\<Longrightarrow>\n   comparable_type (Errorable \\<tau>) n\"\n\n\ninductive iterable_unop_type where\n  \"\\<tau> \\<hookrightarrow> Iterable(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_unop_type SizeOp \\<tau> Integer[1]\"\n| \"\\<tau> \\<hookrightarrow> Iterable(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_unop_type IsEmptyOp \\<tau> Boolean[1]\"\n| \"\\<tau> \\<hookrightarrow> Iterable(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_unop_type NotEmptyOp \\<tau> Boolean[1]\"\n\n| \"\\<tau> \\<hookrightarrow> Collection(\\<sigma>)[1] \\<Longrightarrow> max_op_defined \\<sigma> \\<Longrightarrow>\n   iterable_unop_type MaxOp \\<tau> \\<sigma>\"\n| \"\\<tau> \\<hookrightarrow> Collection(\\<sigma>)[1] \\<Longrightarrow> min_op_defined \\<sigma> \\<Longrightarrow>\n   iterable_unop_type MinOp \\<tau> \\<sigma>\"\n| \"\\<tau> \\<hookrightarrow> Collection(\\<sigma>)[1] \\<Longrightarrow> sum_op_defined \\<sigma> \\<Longrightarrow>\n   iterable_unop_type SumOp \\<tau> \\<sigma>\"\n\n| \"\\<tau> \\<hookrightarrow> Collection(\\<sigma>)[1] \\<Longrightarrow>\n   \\<rho> \\<hookleftarrow> Set(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_unop_type AsSetOp \\<tau> \\<rho>\"\n| \"\\<tau> \\<hookrightarrow> Collection(\\<sigma>)[1] \\<Longrightarrow>\n   \\<rho> \\<hookleftarrow> OrderedSet(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_unop_type AsOrderedSetOp \\<tau> \\<rho>\"\n| \"\\<tau> \\<hookrightarrow> Collection(\\<sigma>)[1] \\<Longrightarrow>\n   \\<rho> \\<hookleftarrow> Bag(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_unop_type AsBagOp \\<tau> \\<rho>\"\n| \"\\<tau> \\<hookrightarrow> Collection(\\<sigma>)[1] \\<Longrightarrow>\n   \\<rho> \\<hookleftarrow> Sequence(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_unop_type AsSequenceOp \\<tau> \\<rho>\"\n\n| \"\\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<sigma>)[1] \\<Longrightarrow>\n   to_single_type \\<sigma> \\<rho> \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> Collection\\<^bsub>k\\<^esub>(\\<rho>)[1] \\<Longrightarrow>\n   iterable_unop_type FlattenOp \\<tau> \\<upsilon>\"\n\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<sigma>[1])[1] \\<Longrightarrow>\n   iterable_unop_type FirstOp \\<tau> \\<sigma>[1!]\"\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<sigma>[?])[1] \\<Longrightarrow>\n   iterable_unop_type FirstOp \\<tau> \\<sigma>[?!]\"\n\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<sigma>[1])[1] \\<Longrightarrow>\n   iterable_unop_type LastOp \\<tau> \\<sigma>[1!]\"\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<sigma>[?])[1] \\<Longrightarrow>\n   iterable_unop_type LastOp \\<tau> \\<sigma>[?!]\"\n\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_unop_type ReverseOp \\<tau> \\<tau>\"\n\n| \"\\<tau> \\<hookrightarrow> Map(\\<sigma>, \\<rho>)[1] \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> Set(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_unop_type KeysOp \\<tau> \\<upsilon>\"\n| \"\\<tau> \\<hookrightarrow> Map(\\<sigma>, \\<rho>)[1] \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> Bag(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_unop_type ValuesOp \\<tau> \\<upsilon>\"\n\ntext \\<open>\n  Please take a note that if both arguments are collections,\n  then an element type of the resulting collection is a super type\n  of element types of orginal collections. However for single-valued\n  operations (@{text \"append()\"}, @{text \"insertAt()\"}, ...)\n  this behavior looks undesirable. So we restrict such arguments\n  to have a subtype of the collection element type.\\<close>\n\ntext \\<open>\n  Please take a note that we allow the following expressions:\\<close>\n\ntext \\<open>\n\\<^verbatim>\\<open>let nullable_value : Integer[?] = null in\nSequence{1..3}->inculdes(nullable_value) and\nSequence{1..3}->inculdes(null) and\nSequence{1..3}->inculdesAll(Set{1,null})\\<close>\\<close>\n\ntext \\<open>\n  The OCL specification defines @{text \"including()\"} and\n  @{text \"excluding()\"} operations for the @{text Sequence} type\n  but does not define them for the @{text OrderedSet} type.\n  We define them for all collection types.\n\n  It is a good idea to prohibit including of values that\n  do not conform to a collection element type.\n  However we do not restrict it.\n\n  At first we defined the following typing rules for the\n  @{text \"excluding()\"} operation:\n\n{\\isacharbar}\\ {\\isachardoublequoteopen}element{\\isacharunderscore}type\\ {\\isasymtau}\\ {\\isasymrho}\\ {\\isasymLongrightarrow}\\ {\\isasymsigma}\\ {\\isasymle}\\ {\\isasymrho}\\ {\\isasymLongrightarrow}\\ {\\isasymsigma}\\ {\\isasymnoteq}\\ OclVoid{\\isacharbrackleft}{\\isacharquery}{\\isacharbrackright}\\ {\\isasymLongrightarrow}\\isanewline\n\\ \\ \\ collection{\\isacharunderscore}binop{\\isacharunderscore}type\\ ExcludingOp\\ {\\isasymtau}\\ {\\isasymsigma}\\ {\\isasymtau}{\\isachardoublequoteclose}\\isanewline\n{\\isacharbar}\\ {\\isachardoublequoteopen}element{\\isacharunderscore}type\\ {\\isasymtau}\\ {\\isasymrho}\\ {\\isasymLongrightarrow}\\ {\\isasymsigma}\\ {\\isasymle}\\ {\\isasymrho}\\ {\\isasymLongrightarrow}\\ {\\isasymsigma}\\ {\\isacharequal}\\ OclVoid{\\isacharbrackleft}{\\isacharquery}{\\isacharbrackright}\\ {\\isasymLongrightarrow}\\isanewline\n\\ \\ \\ update{\\isacharunderscore}element{\\isacharunderscore}type\\ {\\isasymtau}\\ {\\isacharparenleft}to{\\isacharunderscore}required{\\isacharunderscore}type\\ {\\isasymrho}{\\isacharparenright}\\ {\\isasymupsilon}\\ {\\isasymLongrightarrow}\\isanewline\n\\ \\ \\ collection{\\isacharunderscore}binop{\\isacharunderscore}type\\ ExcludingOp\\ {\\isasymtau}\\ {\\isasymsigma}\\ {\\isasymupsilon}{\\isachardoublequoteclose}\\isanewline\n\n  This operation could play a special role in a definition\n  of safe navigation operations:\\<close>\n\ntext \\<open>\n\\<^verbatim>\\<open>Sequence{1,2,null}->exculding(null) : Integer[1]\\<close>\\<close>\n\ntext \\<open>\n  However it is more natural to use a @{text \"selectByKind(T[1])\"}\n  operation instead.\\<close>\n\n(* TODO: Написать про разницу including и append *)\n\nnotation unwrap_errorable_type (\"\\<lfloor>_\\<rfloor>\\<^sub>E\")\n\ninductive iterable_binop_type where\n  \"\\<tau> \\<hookrightarrow> Collection(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<rho>[??] \\<Longrightarrow>\n   iterable_binop_type CountOp \\<tau> \\<sigma> Integer[1]\"\n\n| \"\\<tau> \\<hookrightarrow> Iterable(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<rho>[??] \\<Longrightarrow>\n   iterable_binop_type IncludesOp \\<tau> \\<sigma> Boolean[1]\"\n| \"\\<tau> \\<hookrightarrow> Iterable(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<rho>[??] \\<Longrightarrow>\n   iterable_binop_type ExcludesOp \\<tau> \\<sigma> Boolean[1]\"\n\n| \"\\<tau> \\<hookrightarrow> Map(\\<rho>, \\<upsilon>)[1] \\<Longrightarrow> \\<sigma> \\<le> \\<upsilon>[??] \\<Longrightarrow>\n   iterable_binop_type IncludesValueOp \\<tau> \\<sigma> Boolean[1]\"\n| \"\\<tau> \\<hookrightarrow> Map(\\<rho>, \\<upsilon>)[1] \\<Longrightarrow> \\<sigma> \\<le> \\<upsilon>[??] \\<Longrightarrow>\n   iterable_binop_type ExcludesValueOp \\<tau> \\<sigma> Boolean[1]\"\n\n| \"\\<tau> \\<hookrightarrow> Iterable(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> Collection(\\<upsilon>)[1] \\<Longrightarrow>\n   \\<upsilon> \\<le> \\<rho>[??] \\<Longrightarrow>\n   iterable_binop_type IncludesAllOp \\<tau> \\<sigma> Boolean[1]\"\n| \"\\<tau> \\<hookrightarrow> Iterable(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> Collection(\\<upsilon>)[1] \\<Longrightarrow>\n   \\<upsilon> \\<le> \\<rho>[??] \\<Longrightarrow>\n   iterable_binop_type ExcludesAllOp \\<tau> \\<sigma> Boolean[1]\"\n\n| \"\\<tau> \\<hookrightarrow> Map(\\<rho>, \\<upsilon>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> Map(\\<phi>, \\<psi>)[1] \\<Longrightarrow>\n   \\<phi> \\<le> \\<rho>[??] \\<Longrightarrow>\n   \\<psi> \\<le> \\<upsilon>[??] \\<Longrightarrow>\n   iterable_binop_type IncludesMapOp \\<tau> \\<sigma> Boolean[1]\"\n| \"\\<tau> \\<hookrightarrow> Map(\\<rho>, \\<upsilon>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> Map(\\<phi>, \\<psi>)[1] \\<Longrightarrow>\n   \\<phi> \\<le> \\<rho>[??] \\<Longrightarrow>\n   \\<psi> \\<le> \\<upsilon>[??] \\<Longrightarrow>\n   iterable_binop_type ExcludesMapOp \\<tau> \\<sigma> Boolean[1]\"\n\n| \"\\<tau> \\<hookrightarrow> Collection(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> Collection(\\<upsilon>)[1] \\<Longrightarrow>\n   iterable_binop_type ProductOp \\<tau> \\<sigma>\n      (Set (Tuple(STR ''first'' : \\<lfloor>\\<rho>\\<rfloor>\\<^sub>E, STR ''second'' : \\<lfloor>\\<upsilon>\\<rfloor>\\<^sub>E))[\\<^bold>1])[1]\"\n\n| \"iterable_binop_type UnionOp (Set \\<tau>)[1] (Set \\<sigma>)[1] (Set (\\<tau> \\<squnion> \\<sigma>))[1]\"\n| \"iterable_binop_type UnionOp (Set \\<tau>)[1] (Bag \\<sigma>)[1] (Bag (\\<tau> \\<squnion> \\<sigma>))[1]\"\n| \"iterable_binop_type UnionOp (Bag \\<tau>)[1] (Set \\<sigma>)[1] (Bag (\\<tau> \\<squnion> \\<sigma>))[1]\"\n| \"iterable_binop_type UnionOp (Bag \\<tau>)[1] (Bag \\<sigma>)[1] (Bag (\\<tau> \\<squnion> \\<sigma>))[1]\"\n\n| \"iterable_binop_type IntersectionOp (Set \\<tau>)[1] (Set \\<sigma>)[1] (Set (\\<tau> \\<squnion> \\<sigma>))[1]\"\n| \"iterable_binop_type IntersectionOp (Set \\<tau>)[1] (Bag \\<sigma>)[1] (Set (\\<tau> \\<squnion> \\<sigma>))[1]\"\n| \"iterable_binop_type IntersectionOp (Bag \\<tau>)[1] (Set \\<sigma>)[1] (Set (\\<tau> \\<squnion> \\<sigma>))[1]\"\n| \"iterable_binop_type IntersectionOp (Bag \\<tau>)[1] (Bag \\<sigma>)[1] (Bag (\\<tau> \\<squnion> \\<sigma>))[1]\"\n\n| \"\\<tau> \\<le> \\<sigma> \\<or> \\<sigma> \\<le> \\<tau> \\<Longrightarrow>\n   iterable_binop_type SetMinusOp (Set \\<tau>)[1] (Set \\<sigma>)[1] (Set \\<tau>)[1]\"\n| \"iterable_binop_type SymmetricDifferenceOp (Set \\<tau>)[1] (Set \\<sigma>)[1] (Set (\\<tau> \\<squnion> \\<sigma>))[1]\"\n\n| \"\\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<rho>)[1] \\<Longrightarrow>\n   \\<phi> \\<hookleftarrow> Collection\\<^bsub>k\\<^esub>(\\<rho> \\<squnion> \\<sigma>)[1] \\<Longrightarrow>\n   iterable_binop_type IncludingOp \\<tau> \\<sigma> \\<phi>\"\n| \"\\<tau> \\<hookrightarrow> Collection(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<rho> \\<Longrightarrow>\n   iterable_binop_type ExcludingOp \\<tau> \\<sigma> \\<tau>\"\n| \"\\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> Collection(\\<upsilon>)[1] \\<Longrightarrow>\n   \\<phi> \\<hookleftarrow> Collection\\<^bsub>k\\<^esub>(\\<rho> \\<squnion> \\<upsilon>)[1] \\<Longrightarrow>\n   iterable_binop_type IncludingAllOp \\<tau> \\<sigma> \\<phi>\"\n| \"\\<tau> \\<hookrightarrow> Collection(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> Collection(\\<upsilon>)[1] \\<Longrightarrow>\n   \\<upsilon> \\<le> \\<rho> \\<Longrightarrow>\n   iterable_binop_type ExcludingAllOp \\<tau> \\<sigma> \\<tau>\"\n\n| \"\\<tau> \\<hookrightarrow> Map(\\<rho>, \\<upsilon>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> Map(\\<rho>', \\<upsilon>')[1] \\<Longrightarrow>\n   \\<phi> \\<hookleftarrow> Map(\\<rho> \\<squnion> \\<rho>', \\<upsilon> \\<squnion> \\<upsilon>')[1] \\<Longrightarrow>\n   iterable_binop_type IncludingMapOp \\<tau> \\<sigma> \\<phi>\"\n| \"\\<tau> \\<hookrightarrow> Map(\\<rho>, \\<upsilon>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> Map(\\<rho>', \\<upsilon>')[1] \\<Longrightarrow>\n   \\<rho>' \\<le> \\<rho> \\<Longrightarrow>\n   \\<upsilon>' \\<le> \\<upsilon> \\<Longrightarrow>\n   iterable_binop_type ExcludingMapOp \\<tau> \\<sigma> \\<tau>\"\n\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<rho> \\<Longrightarrow>\n   iterable_binop_type AppendOp \\<tau> \\<sigma> \\<tau>\"\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<rho> \\<Longrightarrow>\n   iterable_binop_type PrependOp \\<tau> \\<sigma> \\<tau>\"\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> OrderedCollection(\\<upsilon>)[1] \\<Longrightarrow>\n   \\<upsilon> \\<le> \\<rho> \\<Longrightarrow>\n   iterable_binop_type AppendAllOp \\<tau> \\<sigma> \\<tau>\"\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<hookrightarrow> OrderedCollection(\\<upsilon>)[1] \\<Longrightarrow>\n   \\<upsilon> \\<le> \\<rho> \\<Longrightarrow>\n   iterable_binop_type PrependAllOp \\<tau> \\<sigma> \\<tau>\"\n\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<sigma>[1])[1] \\<Longrightarrow>\n   iterable_binop_type AtOp \\<tau> Integer[1] \\<sigma>[1!]\"\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<sigma>[?])[1] \\<Longrightarrow>\n   iterable_binop_type AtOp \\<tau> Integer[1] \\<sigma>[?!]\"\n\n| \"\\<tau> \\<hookrightarrow> Map(\\<rho>, \\<upsilon>[1])[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<rho>[??] \\<Longrightarrow>\n   iterable_binop_type AtOp \\<tau> \\<sigma> \\<upsilon>[1!]\"\n| \"\\<tau> \\<hookrightarrow> Map(\\<rho>, \\<upsilon>[?])[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<rho>[??] \\<Longrightarrow>\n   iterable_binop_type AtOp \\<tau> \\<sigma> \\<upsilon>[?!]\"\n\n| \"\\<tau> \\<hookrightarrow> OrderedCollection(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<rho> \\<Longrightarrow>\n   iterable_binop_type IndexOfOp \\<tau> \\<sigma> Integer[1]\"\n\ninductive iterable_ternop_type where\n  \"\\<tau>[1] \\<hookrightarrow> OrderedCollection(\\<rho>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<rho> \\<Longrightarrow>\n   iterable_ternop_type InsertAtOp \\<tau>[1] Integer[1] \\<sigma> \\<tau>[1!]\"\n\n| \"\\<tau>[1] \\<hookrightarrow> OrderedSet(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_ternop_type SubOrderedSetOp \\<tau>[1] Integer[1] Integer[1] \\<tau>[1!]\"\n| \"\\<tau>[1] \\<hookrightarrow> Sequence(\\<sigma>)[1] \\<Longrightarrow>\n   iterable_ternop_type SubSequenceOp \\<tau>[1] Integer[1] Integer[1] \\<tau>[1!]\"\n\n| \"\\<tau> \\<hookrightarrow> Map(\\<upsilon>, \\<phi>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<upsilon> \\<Longrightarrow>\n   \\<rho> \\<le> \\<phi> \\<Longrightarrow>\n   iterable_ternop_type IncludesPairOp \\<tau> \\<sigma> \\<rho> Boolean[1]\"\n| \"\\<tau> \\<hookrightarrow> Map(\\<upsilon>, \\<phi>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<upsilon> \\<Longrightarrow>\n   \\<rho> \\<le> \\<phi> \\<Longrightarrow>\n   iterable_ternop_type ExcludesPairOp \\<tau> \\<sigma> \\<rho> Boolean[1]\"\n\n| \"\\<tau> \\<hookrightarrow> Map(\\<upsilon>, \\<phi>)[1] \\<Longrightarrow>\n   \\<psi> \\<hookleftarrow> Map(\\<upsilon> \\<squnion> \\<sigma>, \\<phi> \\<squnion> \\<rho>)[1] \\<Longrightarrow>\n   iterable_ternop_type IncludingPairOp \\<tau> \\<sigma> \\<rho> \\<psi>\"\n| \"\\<tau> \\<hookrightarrow> Map(\\<upsilon>, \\<phi>)[1] \\<Longrightarrow>\n   \\<sigma> \\<le> \\<upsilon> \\<Longrightarrow>\n   \\<rho> \\<le> \\<phi> \\<Longrightarrow>\n   iterable_ternop_type ExcludingPairOp \\<tau> \\<sigma> \\<rho> \\<tau>\"\n\nsubsection \\<open>Iterations\\<close>\n\ninductive iteration_type where\n  \"n \\<le> (1 :: nat) \\<Longrightarrow>\n   \\<rho> \\<le> Boolean[?] \\<Longrightarrow>\n   iteration_type AnyIter n \\<tau> \\<sigma>[1] \\<rho> \\<sigma>[1!]\"\n| \"n \\<le> (1 :: nat) \\<Longrightarrow>\n   \\<rho> \\<le> Boolean[?] \\<Longrightarrow>\n   iteration_type AnyIter n \\<tau> \\<sigma>[?] \\<rho> \\<sigma>[?!]\"\n\n| \"n \\<le> 1 \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<sigma>)[1.] \\<Longrightarrow>\n   \\<rho> \\<hookrightarrow> Collection(\\<phi>)[1.] \\<Longrightarrow>\n   \\<phi> \\<le> \\<sigma> \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> UniqueCollection\\<^bsub>k\\<^esub>(\\<sigma>)[1] \\<Longrightarrow>\n   iteration_type ClosureIter n \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n\n| \"n \\<le> 1 \\<Longrightarrow>\n   to_single_type \\<rho> \\<rho>' \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<sigma>)[1.] \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> NonUniqueCollection\\<^bsub>k\\<^esub>(\\<rho>')[1] \\<Longrightarrow>\n   iteration_type CollectIter n \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n| \"n \\<le> 1 \\<Longrightarrow>\n   to_single_type \\<rho> \\<rho>' \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> Map(\\<sigma>, _)[1.] \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> Bag(\\<rho>')[1] \\<Longrightarrow>\n   iteration_type CollectIter n \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n\n| \"n \\<le> 1 \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> Map(\\<sigma>, \\<rho>)[1] \\<Longrightarrow>\n   iteration_type CollectByIter n \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n\n| \"n \\<le> 1 \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<sigma>)[1.] \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> NonUniqueCollection\\<^bsub>k\\<^esub>(\\<rho>)[1] \\<Longrightarrow>\n   iteration_type CollectNestedIter n \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n| \"n \\<le> 1 \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> Map(\\<upsilon>, _)[1.] \\<Longrightarrow>\n   \\<phi> \\<hookleftarrow> Map(\\<upsilon>, \\<rho>)[1] \\<Longrightarrow>\n   iteration_type CollectNestedIter n \\<tau> \\<sigma> \\<rho> \\<phi>\"\n\n| \"n \\<le> 2 \\<Longrightarrow>\n   \\<rho> \\<le> Boolean[?!] \\<Longrightarrow>\n   iteration_type ExistsIter n \\<tau> \\<sigma> \\<rho> \\<rho>\"\n| \"n \\<le> 2 \\<Longrightarrow>\n   \\<rho> \\<le> Boolean[?!] \\<Longrightarrow>\n   iteration_type ForAllIter n \\<tau> \\<sigma> \\<rho> \\<rho>\"\n\n| \"n \\<le> 1 \\<Longrightarrow>\n   \\<rho> \\<le> Boolean[?!] \\<Longrightarrow>\n   iteration_type OneIter n \\<tau> \\<sigma> \\<rho> Boolean[1]\"\n| \"n \\<le> 1 \\<Longrightarrow>\n   iteration_type IsUniqueIter n \\<tau> \\<sigma> \\<rho> Boolean[1]\"\n\n| \"n \\<le> 1 \\<Longrightarrow>\n   \\<rho> \\<le> Boolean[?!] \\<Longrightarrow>\n   iteration_type SelectIter n \\<tau> \\<sigma> \\<rho> \\<tau>\"\n| \"n \\<le> 1 \\<Longrightarrow>\n   \\<rho> \\<le> Boolean[?!] \\<Longrightarrow>\n   iteration_type RejectIter n \\<tau> \\<sigma> \\<rho> \\<tau>\"\n\n| \"n \\<le> 1 \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<sigma>)[1.] \\<Longrightarrow>\n   \\<upsilon> \\<hookleftarrow> OrderedCollection\\<^bsub>k\\<^esub>(\\<sigma>)[1] \\<Longrightarrow>\n   iteration_type SortedByIter n \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n\nsubsection \\<open>Coercions\\<close>\n\ninductive unop_type where\n  \"any_unop_type op \\<tau> \\<sigma> \\<Longrightarrow>\n   unop_type (Inl op) DotCall \\<tau> \\<sigma>\"\n| \"boolean_unop_type op \\<tau> \\<sigma> \\<Longrightarrow>\n   unop_type (Inr (Inl op)) DotCall \\<tau> \\<sigma>\"\n| \"numeric_unop_type op \\<tau> \\<sigma> \\<Longrightarrow>\n   unop_type (Inr (Inr (Inl op))) DotCall \\<tau> \\<sigma>\"\n| \"string_unop_type op \\<tau> \\<sigma> \\<Longrightarrow>\n   unop_type (Inr (Inr (Inr (Inl op)))) DotCall \\<tau> \\<sigma>\"\n| \"iterable_unop_type op \\<tau> \\<sigma> \\<Longrightarrow>\n   unop_type (Inr (Inr (Inr (Inr op)))) ArrowCall \\<tau> \\<sigma>\"\n\ninductive binop_type where\n  \"any_binop_type op \\<tau> \\<sigma> \\<rho> \\<Longrightarrow>\n   binop_type (Inl op) DotCall \\<tau> \\<sigma> \\<rho>\"\n| \"boolean_binop_type op \\<tau> \\<sigma> \\<rho> \\<Longrightarrow>\n   binop_type (Inr (Inl op)) DotCall \\<tau> \\<sigma> \\<rho>\"\n| \"numeric_binop_type op \\<tau> \\<sigma> \\<rho> \\<Longrightarrow>\n   binop_type (Inr (Inr (Inl op))) DotCall \\<tau> \\<sigma> \\<rho>\"\n| \"string_binop_type op \\<tau> \\<sigma> \\<rho> \\<Longrightarrow>\n   binop_type (Inr (Inr (Inr (Inl op)))) DotCall \\<tau> \\<sigma> \\<rho>\"\n| \"iterable_binop_type op \\<tau> \\<sigma> \\<rho> \\<Longrightarrow>\n   binop_type (Inr (Inr (Inr (Inr op)))) ArrowCall \\<tau> \\<sigma> \\<rho>\"\n\ninductive ternop_type where\n  \"string_ternop_type op \\<tau> \\<sigma> \\<rho> \\<upsilon> \\<Longrightarrow>\n   ternop_type (Inl op) DotCall \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n| \"iterable_ternop_type op \\<tau> \\<sigma> \\<rho> \\<upsilon> \\<Longrightarrow>\n   ternop_type (Inr op) ArrowCall \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n\ndefinition \"op_result_type_is_errorable op \\<pi> \\<equiv>\n  strict_op op \\<and> fBex \\<pi> errorable_type\"\n\ninductive op_type where\n  \"unop_type op k \\<tau>\\<lbrakk>.\\<rbrakk> \\<upsilon> \\<Longrightarrow>\n   op_result_type_is_errorable (Inl op) {|\\<tau>|} \\<Longrightarrow>\n   op_type (Inl op) k \\<tau> [] \\<upsilon>\\<lbrakk>.!\\<rbrakk>\"\n| \"unop_type op k \\<tau> \\<upsilon> \\<Longrightarrow>\n   \\<not> op_result_type_is_errorable (Inl op) {|\\<tau>|} \\<Longrightarrow>\n   op_type (Inl op) k \\<tau> [] \\<upsilon>\"\n\n| \"binop_type op k \\<tau>\\<lbrakk>.\\<rbrakk> \\<sigma>\\<lbrakk>.\\<rbrakk> \\<upsilon> \\<Longrightarrow>\n   op_result_type_is_errorable (Inr (Inl op)) {|\\<tau>, \\<sigma>|} \\<Longrightarrow>\n   op_type (Inr (Inl op)) k \\<tau> [\\<sigma>] \\<upsilon>\\<lbrakk>.!\\<rbrakk>\"\n| \"binop_type op k \\<tau> \\<sigma> \\<upsilon> \\<Longrightarrow>\n   \\<not> op_result_type_is_errorable (Inr (Inl op)) {|\\<tau>, \\<sigma>|} \\<Longrightarrow>\n   op_type (Inr (Inl op)) k \\<tau> [\\<sigma>] \\<upsilon>\"\n\n| \"ternop_type op k \\<tau>\\<lbrakk>.\\<rbrakk> \\<sigma>\\<lbrakk>.\\<rbrakk> \\<rho>\\<lbrakk>.\\<rbrakk> \\<upsilon> \\<Longrightarrow>\n   op_result_type_is_errorable (Inr (Inr (Inl op))) {|\\<tau>, \\<sigma>, \\<rho>|} \\<Longrightarrow>\n   op_type (Inr (Inr (Inl op))) k \\<tau> [\\<sigma>, \\<rho>] \\<upsilon>\\<lbrakk>.!\\<rbrakk>\"\n| \"ternop_type op k \\<tau> \\<sigma> \\<rho> \\<upsilon> \\<Longrightarrow>\n   \\<not> op_result_type_is_errorable (Inr (Inr (Inl op))) {|\\<tau>, \\<sigma>, \\<rho>|} \\<Longrightarrow>\n   op_type (Inr (Inr (Inl op))) k \\<tau> [\\<sigma>, \\<rho>] \\<upsilon>\"\n\n| \"operation \\<tau> op \\<pi> oper \\<Longrightarrow>\n   op_type (Inr (Inr (Inr op))) DotCall \\<tau> \\<pi> (oper_type oper)\"\n\n(*code_pred [show_modes] op_type .*)\n\n(*** Simplification Rules ***************************************************)\n\nsubsection \\<open>Simplification Rules\\<close>\n\ninductive_simps op_type_alt_simps:\n\"mataop_type \\<tau> op \\<sigma>\"\n\"typeop_type k op \\<tau> \\<sigma> \\<rho>\"\n\n\"op_type op k \\<tau> \\<pi> \\<sigma>\"\n\"unop_type op k \\<tau> \\<sigma>\"\n\"binop_type op k \\<tau> \\<sigma> \\<rho>\"\n\"ternop_type op k \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n\n\"any_unop_type op \\<tau> \\<sigma>\"\n\"boolean_unop_type op \\<tau> \\<sigma>\"\n\"numeric_unop_type op \\<tau> \\<sigma>\"\n\"string_unop_type op \\<tau> \\<sigma>\"\n\"iterable_unop_type op \\<tau> \\<sigma>\"\n\n\"any_binop_type op \\<tau> \\<sigma> \\<rho>\"\n\"boolean_binop_type op \\<tau> \\<sigma> \\<rho>\"\n\"numeric_binop_type op \\<tau> \\<sigma> \\<rho>\"\n\"string_binop_type op \\<tau> \\<sigma> \\<rho>\"\n\"iterable_binop_type op \\<tau> \\<sigma> \\<rho>\"\n\n\"string_ternop_type op \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n\"iterable_ternop_type op \\<tau> \\<sigma> \\<rho> \\<upsilon>\"\n\n(*** Determinism ************************************************************)\n\n(*code_pred [show_modes] op_type .*)\n\nsubsection \\<open>Determinism\\<close>\n\nlemma mataop_type_det:\n  \"mataop_type \\<tau> op \\<sigma> \\<Longrightarrow>\n   mataop_type \\<tau> op \\<rho> \\<Longrightarrow> \\<sigma> = \\<rho>\"\n  by (auto simp: mataop_type.simps)\n\nlemma typeop_type_det:\n  \"typeop_type op k \\<tau> \\<sigma> \\<rho>\\<^sub>1 \\<Longrightarrow>\n   typeop_type op k \\<tau> \\<sigma> \\<rho>\\<^sub>2 \\<Longrightarrow> \\<rho>\\<^sub>1 = \\<rho>\\<^sub>2\"\n  apply (erule typeop_type.cases; simp add: typeop_type.simps)\n  apply auto[1]\n  apply auto[1]\n  using collection_type_det collection_type'_det by blast+\n\nlemma any_unop_type_det:\n  \"any_unop_type op \\<tau> \\<sigma>\\<^sub>1 \\<Longrightarrow>\n   any_unop_type op \\<tau> \\<sigma>\\<^sub>2 \\<Longrightarrow> \\<sigma>\\<^sub>1 = \\<sigma>\\<^sub>2\"\n  by (erule any_unop_type.cases;\n      simp add: any_unop_type.simps any_type_template'.simps any_type.simps)\n\nlemma boolean_unop_type_det:\n  \"boolean_unop_type op \\<tau> \\<sigma>\\<^sub>1 \\<Longrightarrow>\n   boolean_unop_type op \\<tau> \\<sigma>\\<^sub>2 \\<Longrightarrow> \\<sigma>\\<^sub>1 = \\<sigma>\\<^sub>2\"\n  by (erule boolean_unop_type.cases; simp add: boolean_unop_type.simps)\n\nlemma numeric_unop_type_det:\n  \"numeric_unop_type op \\<tau> \\<sigma>\\<^sub>1 \\<Longrightarrow>\n   numeric_unop_type op \\<tau> \\<sigma>\\<^sub>2 \\<Longrightarrow> \\<sigma>\\<^sub>1 = \\<sigma>\\<^sub>2\"\n  by (erule numeric_unop_type.cases; auto simp add: numeric_unop_type.simps)\n\nlemma string_unop_type_det:\n  \"string_unop_type op \\<tau> \\<sigma>\\<^sub>1 \\<Longrightarrow>\n   string_unop_type op \\<tau> \\<sigma>\\<^sub>2 \\<Longrightarrow> \\<sigma>\\<^sub>1 = \\<sigma>\\<^sub>2\"\n  by (erule string_unop_type.cases; simp add: string_unop_type.simps)\n\nlemma iterable_unop_type_det:\n  \"iterable_unop_type op \\<tau> \\<sigma>\\<^sub>1 \\<Longrightarrow>\n   iterable_unop_type op \\<tau> \\<sigma>\\<^sub>2 \\<Longrightarrow> \\<sigma>\\<^sub>1 = \\<sigma>\\<^sub>2\"\n  apply (erule iterable_unop_type.cases; simp add: iterable_unop_type.simps)\n  using collection_type'_det any_collection_type_det apply blast+\n  using collection_type_det collection_type'_det to_single_type_det apply blast+\n  using any_ordered_collection_type_det apply blast+\n  using collection_type'_det map_type_det by blast+\n\nlemma unop_type_det:\n  \"unop_type op k \\<tau> \\<sigma>\\<^sub>1 \\<Longrightarrow>\n   unop_type op k \\<tau> \\<sigma>\\<^sub>2 \\<Longrightarrow> \\<sigma>\\<^sub>1 = \\<sigma>\\<^sub>2\"\n  by (erule unop_type.cases;\n      simp add: unop_type.simps any_unop_type_det\n                boolean_unop_type_det numeric_unop_type_det\n                string_unop_type_det iterable_unop_type_det)\n\nlemma any_binop_type_det:\n  \"any_binop_type op \\<tau> \\<sigma> \\<rho>\\<^sub>1 \\<Longrightarrow>\n   any_binop_type op \\<tau> \\<sigma> \\<rho>\\<^sub>2 \\<Longrightarrow> \\<rho>\\<^sub>1 = \\<rho>\\<^sub>2\"\n  by (erule any_binop_type.cases; auto simp add: any_binop_type.simps)\n\nlemma boolean_binop_type_det:\n  \"boolean_binop_type op \\<tau> \\<sigma> \\<rho>\\<^sub>1 \\<Longrightarrow>\n   boolean_binop_type op \\<tau> \\<sigma> \\<rho>\\<^sub>2 \\<Longrightarrow> \\<rho>\\<^sub>1 = \\<rho>\\<^sub>2\"\n  by (erule boolean_binop_type.cases; simp add: boolean_binop_type.simps)\n\n\n\nlemma string_binop_type_det:\n  \"string_binop_type op \\<tau> \\<sigma> \\<rho>\\<^sub>1 \\<Longrightarrow>\n   string_binop_type op \\<tau> \\<sigma> \\<rho>\\<^sub>2 \\<Longrightarrow> \\<rho>\\<^sub>1 = \\<rho>\\<^sub>2\"\n  by (erule string_binop_type.cases; simp add: string_binop_type.simps)\n\nlemma iterable_binop_type_det:\n  \"iterable_binop_type op \\<tau> \\<sigma> \\<rho>\\<^sub>1 \\<Longrightarrow>\n   iterable_binop_type op \\<tau> \\<sigma> \\<rho>\\<^sub>2 \\<Longrightarrow> \\<rho>\\<^sub>1 = \\<rho>\\<^sub>2\"\n  apply (erule iterable_binop_type.cases; simp add: iterable_binop_type.simps)\n  using any_collection_type_det apply blast\n  using collection_type'_det collection_type_det apply blast\n  apply (metis any_collection_type_det collection_type'_det collection_type_det)\n  apply (metis map_type'_det map_type_det)\n  using any_ordered_collection_type_and_map_type_distinct\n        any_ordered_collection_type_det apply blast\n  using any_ordered_collection_type_and_map_type_distinct any_ordered_collection_type_det apply blast\n  apply (metis any_ordered_collection_type_and_map_type_distinct errorable.inject(1) map_type_det)\n  using any_ordered_collection_type_and_map_type_distinct map_type_det by blast\n\nlemma binop_type_det:\n  \"binop_type op k \\<tau> \\<sigma> \\<rho>\\<^sub>1 \\<Longrightarrow>\n   binop_type op k \\<tau> \\<sigma> \\<rho>\\<^sub>2 \\<Longrightarrow> \\<rho>\\<^sub>1 = \\<rho>\\<^sub>2\"\n  by (erule binop_type.cases;\n      simp add: binop_type.simps any_binop_type_det\n                boolean_binop_type_det numeric_binop_type_det\n                string_binop_type_det iterable_binop_type_det)\n\nlemma string_ternop_type_det:\n  \"string_ternop_type op \\<tau> \\<sigma> \\<rho> \\<upsilon>\\<^sub>1 \\<Longrightarrow>\n   string_ternop_type op \\<tau> \\<sigma> \\<rho> \\<upsilon>\\<^sub>2 \\<Longrightarrow> \\<upsilon>\\<^sub>1 = \\<upsilon>\\<^sub>2\"\n  by (erule string_ternop_type.cases; simp add: string_ternop_type.simps)\n\nlemma iterable_ternop_type_det:\n  \"iterable_ternop_type op \\<tau> \\<sigma> \\<rho> \\<upsilon>\\<^sub>1 \\<Longrightarrow>\n   iterable_ternop_type op \\<tau> \\<sigma> \\<rho> \\<upsilon>\\<^sub>2 \\<Longrightarrow> \\<upsilon>\\<^sub>1 = \\<upsilon>\\<^sub>2\"\n  apply (erule iterable_ternop_type.cases; simp add: iterable_ternop_type.simps)\n  using map_type_det map_type'_det by blast\n\nlemma ternop_type_det:\n  \"ternop_type op k \\<tau> \\<sigma> \\<rho> \\<upsilon>\\<^sub>1 \\<Longrightarrow>\n   ternop_type op k \\<tau> \\<sigma> \\<rho> \\<upsilon>\\<^sub>2 \\<Longrightarrow> \\<upsilon>\\<^sub>1 = \\<upsilon>\\<^sub>2\"\n  by (erule ternop_type.cases;\n      simp add: ternop_type.simps string_ternop_type_det iterable_ternop_type_det)\n\nlemma op_type_det:\n  \"op_type op k \\<tau> \\<pi> \\<sigma> \\<Longrightarrow>\n   op_type op k \\<tau> \\<pi> \\<rho> \\<Longrightarrow> \\<sigma> = \\<rho>\"\n  apply (erule op_type.cases; simp add: op_type.simps)\n  using unop_type_det binop_type_det ternop_type_det apply blast+\n  using operation_det by blast\n\nlemma collection_type_template_det:\n  \"collection_type_template \\<tau> k\\<^sub>1 \\<sigma>\\<^sub>1 n\\<^sub>1 \\<Longrightarrow>\n   collection_type_template \\<tau> k\\<^sub>2 \\<sigma>\\<^sub>2 n\\<^sub>2 \\<Longrightarrow> k\\<^sub>1 = k\\<^sub>2 \\<and> \\<sigma>\\<^sub>1 = \\<sigma>\\<^sub>2 \\<and> n\\<^sub>1 = n\\<^sub>2\"\n  apply (simp add: collection_type_template.simps)\n  using collection_type_det by blast\n\nlemma any_collection_type_and_map_type_distinct':\n  \"collection_type_template \\<tau> k \\<sigma> n\\<^sub>1 \\<Longrightarrow> map_type_template \\<tau> \\<rho> \\<upsilon> n\\<^sub>2 \\<Longrightarrow> False\"\n  by (auto simp: collection_type_template.simps collection_type.simps\n      collection_type\\<^sub>N.simps collection_type\\<^sub>T.simps\n      map_type_template.simps\n      map_type.simps map_type\\<^sub>N.simps map_type\\<^sub>T.simps)\n\nlemma iteration_type_det:\n  \"iteration_type iter n \\<tau> \\<sigma> \\<rho> \\<upsilon> \\<Longrightarrow>\n   iteration_type iter n \\<tau> \\<sigma> \\<rho> \\<phi> \\<Longrightarrow> \\<upsilon> = \\<phi>\"\n  apply (erule iteration_type.cases; simp add: iteration_type.simps)\n  using collection_type_template_det unique_collection_type'_det apply blast\n  apply (metis any_collection_type_and_map_type_distinct' collection_type_template_det non_unique_collection_type'_det to_single_type_det)\n  using any_collection_type_and_map_type_distinct' collection_type'_det to_single_type_det apply blast\n  using map_type'_det apply blast\n  using any_collection_type_and_map_type_distinct' collection_type_template_det non_unique_collection_type'_det apply blast\n  using any_collection_type_and_map_type_distinct' map_type'_det map_type_template_det apply blast\n  using collection_type_template_det ordered_collection_type'_det by blast\n\n(*** Expressions Typing *****************************************************)\n\nsection \\<open>Expressions Typing\\<close>\n\ntext \\<open>\n  The following typing rules are preliminary. The final rules are given at\n  the end of the next chapter.\\<close>\n\ndefinition \"iterators its \\<tau> \\<equiv>\n  fmap_of_list (map (\\<lambda>it. (fst it, \\<tau>)) its)\"\n\ndefinition \"coiterators its \\<tau> \\<equiv>\n  fmap_of_list (map (\\<lambda>it. (the (snd it), \\<tau>)) (filter (\\<lambda>it. snd it \\<noteq> None) its))\"\n\ninductive typing :: \"('a :: ocl_object_model) type\\<^sub>N\\<^sub>E env \\<Rightarrow> 'a expr \\<Rightarrow> 'a type\\<^sub>N\\<^sub>E \\<Rightarrow> bool\"\n       (\"(1_/ \\<turnstile>\\<^sub>E/ (_ :/ _))\" [51,51,51] 50)\n      and collection_part_typing (\"(1_/ \\<turnstile>\\<^sub>C/ (_ :/ _))\" [51,51,51] 50)\n      and iterator_typing (\"(1_/ \\<turnstile>\\<^sub>I/ (_ :/ _))\" [51,51,51] 50)\n      and expr_list_typing (\"(1_/ \\<turnstile>\\<^sub>L/ (_ :/ _))\" [51,51,51] 50) where\n\n\\<comment> \\<open>Primitive Literals\\<close>\n\n NullLiteralT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E NullLiteral : OclVoid[?]\"\n|BooleanLiteralT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E BooleanLiteral c : Boolean[1]\"\n|RealLiteralT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E RealLiteral c : Real[1]\"\n|IntegerLiteralT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E IntegerLiteral c : Integer[1]\"\n|UnlimitedNaturalLiteralT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E UnlimitedNaturalLiteral c : UnlimitedNatural[1]\"\n|StringLiteralT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E StringLiteral c : String[1]\"\n|EnumLiteralT:\n  \"has_literal enm lit \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E EnumLiteral enm lit : (Enum enm)[1]\"\n\n\\<comment> \\<open>Tuple Literals\\<close>\n\n|TupleLiteralNilT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E TupleLiteral [] : (Tuple fmempty)[1]\"\n|TupleLiteralConsT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E tuple_literal_element_expr el : \\<tau> \\<Longrightarrow>\n   tuple_literal_element_type el = Some \\<sigma> \\<Longrightarrow>\n   \\<tau> \\<le> \\<sigma> \\<Longrightarrow>\n   \\<rho> \\<hookleftarrow> Tuple([tuple_literal_element_name el \\<mapsto>\\<^sub>f \\<sigma>])[1] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E TupleLiteral elems : \\<upsilon> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E TupleLiteral (el # elems) : \\<rho> \\<squnion> \\<upsilon>\"\n\n\\<comment> \\<open>Collection Literals\\<close>\n\n|CollectionLiteralNilT:\n  \"k \\<noteq> CollectionKind \\<Longrightarrow>\n   \\<sigma> \\<hookleftarrow> Collection\\<^bsub>k\\<^esub>(OclVoid[1])[1] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E CollectionLiteral k [] : \\<sigma>\"\n|CollectionLiteralConsT:\n  \"k \\<noteq> CollectionKind \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>C x : \\<tau> \\<Longrightarrow>\n   \\<sigma> \\<hookleftarrow> Collection\\<^bsub>k\\<^esub>(\\<tau>)[1] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E CollectionLiteral k xs : \\<rho> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E CollectionLiteral k (x # xs) : \\<sigma> \\<squnion> \\<rho>\"\n\n|CollectionPartItemT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E a : \\<tau> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>C CollectionItem a : \\<tau>\"\n|CollectionPartRangeT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E a : Integer[1] \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>E b : Integer[1] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>C CollectionRange a b : Integer[1]\"\n|LowerErrorableCollectionPartRangeT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E a : Integer[1!] \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>E b : Integer[1] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>C CollectionRange a b : Integer[1!]\"\n|UpperErrorableCollectionPartRangeT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E a : Integer[1] \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>E b : Integer[1!] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>C CollectionRange a b : Integer[1!]\"\n|ErrorableCollectionPartRangeT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E a : Integer[1!] \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>E b : Integer[1!] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>C CollectionRange a b : Integer[1!]\"\n\n\\<comment> \\<open>Map Literals\\<close>\n\n|MapNilT:\n  \"\\<tau> \\<hookleftarrow> Map(OclVoid[1], OclVoid[1])[1] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E MapLiteral [] : \\<tau>\"\n|MapConsT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E map_literal_element_key x : \\<tau> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E map_literal_element_value x : \\<sigma> \\<Longrightarrow>\n   \\<rho> \\<hookleftarrow> Map(\\<tau>, \\<sigma>)[1] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E MapLiteral xs : \\<upsilon> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E MapLiteral (x # xs) : \\<rho> \\<squnion> \\<upsilon>\"\n\n\\<comment> \\<open>Misc Expressions\\<close>\n\n|LetT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E init : \\<sigma> \\<Longrightarrow>\n   \\<sigma> \\<le> \\<tau> \\<Longrightarrow>\n   \\<Gamma>(v \\<mapsto>\\<^sub>f \\<tau>) \\<turnstile>\\<^sub>E body : \\<rho> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E Let v (Some \\<tau>) init body : \\<rho>\"\n|VarT:\n  \"fmlookup \\<Gamma> v = Some \\<tau> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E Var v : \\<tau>\"\n|IfT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E cnd : Boolean[1] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E thn : \\<sigma> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E els : \\<rho> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E If cnd thn els : \\<sigma> \\<squnion> \\<rho>\"\n|ErrorableIfT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E cnd : Boolean[1!] \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E thn : \\<sigma> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E els : \\<rho> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E If cnd thn els : (\\<sigma> \\<squnion> \\<rho>)\\<lbrakk>.!\\<rbrakk>\"\n\n\\<comment> \\<open>Call Expressions\\<close>\n\n|MetaOperationCallT:\n  \"mataop_type \\<tau> op \\<sigma> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E MetaOperationCall \\<tau> op : \\<sigma>\"\n\n|StaticOperationCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>L params : \\<pi> \\<Longrightarrow>\n   static_operation \\<tau> op \\<pi> oper \\<Longrightarrow>\n   \\<not> fBex (fset_of_list \\<pi>) errorable_type \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E StaticOperationCall \\<tau> op params : oper_type oper\"\n|ErrorableStaticOperationCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>L params : \\<pi> \\<Longrightarrow>\n   static_operation \\<tau> op \\<pi> oper \\<Longrightarrow>\n   fBex (fset_of_list \\<pi>) errorable_type \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E StaticOperationCall \\<tau> op params : (oper_type oper)\\<lbrakk>.!\\<rbrakk>\"\n\n|TypeOperationCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E a : \\<tau> \\<Longrightarrow>\n   typeop_type k op \\<tau> \\<sigma> \\<rho> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E TypeOperationCall a k op \\<sigma> : \\<rho>\"\n\n|OperationCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<tau> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>L params : \\<pi> \\<Longrightarrow>\n   op_type op k \\<tau> \\<pi> \\<sigma> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E OperationCall src k op params : \\<sigma>\"\n\n|AttributeCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<langle>\\<C>\\<rangle>\\<^sub>\\<T>[1] \\<Longrightarrow>\n   attribute \\<C> prop \\<D> \\<tau> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E AttributeCall src prop : \\<tau>\"\n|ErrorableAttributeCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<langle>\\<C>\\<rangle>\\<^sub>\\<T>[1!] \\<Longrightarrow>\n   attribute \\<C> prop \\<D> \\<tau> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E AttributeCall src prop : \\<tau>\\<lbrakk>.!\\<rbrakk>\"\n\n|AssociationEndCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<langle>\\<C>\\<rangle>\\<^sub>\\<T>[1] \\<Longrightarrow>\n   association_end \\<C> from role \\<D> end \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E AssociationEndCall src from role : assoc_end_type end\"\n|ErrorableAssociationEndCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<langle>\\<C>\\<rangle>\\<^sub>\\<T>[1!] \\<Longrightarrow>\n   association_end \\<C> from role \\<D> end \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E AssociationEndCall src from role : (assoc_end_type end)\\<lbrakk>.!\\<rbrakk>\"\n\n|AssociationClassCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<langle>\\<C>\\<rangle>\\<^sub>\\<T>[1] \\<Longrightarrow>\n   referred_by_association_class \\<C> from \\<A> \\<D> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E AssociationClassCall src from \\<A> : class_assoc_type \\<A>\"\n|ErrorableAssociationClassCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<langle>\\<C>\\<rangle>\\<^sub>\\<T>[1!] \\<Longrightarrow>\n   referred_by_association_class \\<C> from \\<A> \\<D> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E AssociationClassCall src from \\<A> : (class_assoc_type \\<A>)\\<lbrakk>.!\\<rbrakk>\"\n\n|AssociationClassEndCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<langle>\\<A>\\<rangle>\\<^sub>\\<T>[1] \\<Longrightarrow>\n   association_class_end \\<A> role end \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E AssociationClassEndCall src role : class_assoc_end_type end\"\n|ErrorableAssociationClassEndCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<langle>\\<A>\\<rangle>\\<^sub>\\<T>[1!] \\<Longrightarrow>\n   association_class_end \\<A> role end \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E AssociationClassEndCall src role : (class_assoc_end_type end)\\<lbrakk>.!\\<rbrakk>\"\n\n|TupleElementCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : (Tuple \\<pi>)[1] \\<Longrightarrow>\n   fmlookup \\<pi> elem = Some \\<tau> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E TupleElementCall src elem : ErrorFree \\<tau>\"\n|ErrorableTupleElementCallT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : (Tuple \\<pi>)[1!] \\<Longrightarrow>\n   fmlookup \\<pi> elem = Some \\<tau> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E TupleElementCall src elem : Errorable \\<tau>\"\n\n\\<comment> \\<open>Iterator Expressions\\<close>\n\n|CollectionLoopT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<tau> \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> Collection(\\<sigma>)[1.] \\<Longrightarrow>\n   \\<sigma> \\<le> its_ty \\<Longrightarrow>\n   list_all (\\<lambda>it. snd it = None) its \\<Longrightarrow>\n   \\<Gamma> ++\\<^sub>f iterators its its_ty \\<turnstile>\\<^sub>E body : \\<rho> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>I (src, its, (Some its_ty, None), body) : (\\<tau>, \\<sigma>, \\<rho>)\"\n|MapLoopT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E src : \\<tau> \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> Map(\\<sigma>, \\<upsilon>)[1.] \\<Longrightarrow>\n   \\<sigma> \\<le> its_key_ty \\<Longrightarrow>\n   \\<upsilon> \\<le> its_val_ty \\<Longrightarrow>\n   \\<Gamma> ++\\<^sub>f iterators its its_key_ty ++\\<^sub>f coiterators its its_val_ty \\<turnstile>\\<^sub>E body : \\<rho> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>I (src, its, (Some its_key_ty, Some its_val_ty), body) : (\\<tau>, \\<sigma>, \\<rho>)\"\n\n|IterateT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>I (src, its, its_ty, Let res (Some res_t) res_init body) : (\\<tau>, \\<sigma>, \\<rho>) \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> OclAny[.] \\<Longrightarrow>\n   \\<rho> \\<le> res_t \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E IterateCall src its its_ty res (Some res_t) res_init body : \\<rho>\"\n|ErrorableIterateT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>I (src, its, its_ty, Let res (Some res_t) res_init body) : (\\<tau>, \\<sigma>, \\<rho>) \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> OclAny[.!] \\<Longrightarrow>\n   \\<rho> \\<le> res_t \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E IterateCall src its its_ty res (Some res_t) res_init body : \\<rho>\\<lbrakk>.!\\<rbrakk>\"\n\n|IteratorT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>I (src, its, its_ty, body) : (\\<tau>, \\<sigma>, \\<rho>) \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> OclAny[.] \\<Longrightarrow> \\<rho> \\<hookrightarrow> OclAny[.] \\<Longrightarrow>\n   iteration_type iter (length its) \\<tau> \\<sigma> \\<rho> \\<upsilon> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E Call src ArrowCall (Iterator iter its its_ty body) : \\<upsilon>\"\n|ErrorableIteratorT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>I (src, its, its_ty, body) : (\\<tau>, \\<sigma>, \\<rho>) \\<Longrightarrow>\n   \\<tau> \\<hookrightarrow> OclAny[.!] \\<or> \\<rho> \\<hookrightarrow> OclAny[.!] \\<Longrightarrow>\n   iteration_type iter (length its) \\<tau> \\<sigma> \\<rho> \\<upsilon> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>E Call src ArrowCall (Iterator iter its its_ty body) : \\<upsilon>\\<lbrakk>.!\\<rbrakk>\"\n\n\\<comment> \\<open>Expression Lists\\<close>\n\n|ExprListNilT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>L [] : []\"\n|ExprListConsT:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E expr : \\<tau> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>L exprs : \\<pi> \\<Longrightarrow>\n   \\<Gamma> \\<turnstile>\\<^sub>L expr # exprs : \\<tau> # \\<pi>\"\n\n(*** Elimination Rules ******************************************************)\n\nsection \\<open>Elimination Rules\\<close>\n\ninductive_cases NullLiteralTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E NullLiteral : \\<tau>\"\ninductive_cases BooleanLiteralTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E BooleanLiteral c : \\<tau>\"\ninductive_cases RealLiteralTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E RealLiteral c : \\<tau>\"\ninductive_cases IntegerLiteralTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E IntegerLiteral c : \\<tau>\"\ninductive_cases UnlimitedNaturalLiteralTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E UnlimitedNaturalLiteral c : \\<tau>\"\ninductive_cases StringLiteralTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E StringLiteral c : \\<tau>\"\ninductive_cases EnumLiteralTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E EnumLiteral enm lit : \\<tau>\"\ninductive_cases TupleLiteralNilTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E TupleLiteral [] : \\<tau>\"\ninductive_cases TupleLiteralConsTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E TupleLiteral (x # xs) : \\<tau>\"\ninductive_cases CollectionLiteralNilTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E CollectionLiteral k [] : \\<tau>\"\ninductive_cases CollectionLiteralConsTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E CollectionLiteral k (x # xs) : \\<tau>\"\ninductive_cases MapLiteralNilTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E MapLiteral [] : \\<tau>\"\ninductive_cases MapLiteralConsTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E MapLiteral (x # xs) : \\<tau>\"\n\ninductive_cases CollectionItemTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>C CollectionItem a : \\<tau>\"\ninductive_cases CollectionRangeTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>C CollectionRange a b : \\<tau>\"\n\ninductive_cases LetTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E Let v \\<tau> init body : \\<sigma>\"\ninductive_cases VarTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E Var v : \\<tau>\"\ninductive_cases IfTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E If a b c : \\<tau>\"\n\ninductive_cases MetaOperationCallTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E MetaOperationCall \\<tau> op : \\<sigma>\"\ninductive_cases StaticOperationCallTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E StaticOperationCall \\<tau> op as : \\<sigma>\"\n\ninductive_cases TypeOperationCallTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E TypeOperationCall a k op \\<sigma> : \\<tau>\"\ninductive_cases AttributeCallTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E AttributeCall src prop : \\<tau>\"\ninductive_cases AssociationEndCallTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E AssociationEndCall src role from : \\<tau>\"\ninductive_cases AssociationClassCallTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E AssociationClassCall src a from : \\<tau>\"\ninductive_cases AssociationClassEndCallTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E AssociationClassEndCall src role : \\<tau>\"\ninductive_cases OperationCallTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E OperationCall src k op params : \\<tau>\"\ninductive_cases TupleElementCallTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E TupleElementCall src elem : \\<tau>\"\n\ninductive_cases LoopTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>I (src, its, body) : ys\"\ninductive_cases IterateTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E IterateCall src its its_ty res res_t res_init body : \\<tau>\"\ninductive_cases AnyIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E AnyIterationCall src its its_ty body : \\<tau>\"\ninductive_cases ClosureIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E ClosureIterationCall src its its_ty body : \\<tau>\"\ninductive_cases CollectIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E CollectIterationCall src its its_ty body : \\<tau>\"\ninductive_cases CollectByIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E CollectByIterationCall src its its_ty body : \\<tau>\"\ninductive_cases CollectNestedIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E CollectNestedIterationCall src its its_ty body : \\<tau>\"\ninductive_cases ExistsIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E ExistsIterationCall src its its_ty body : \\<tau>\"\ninductive_cases ForAllIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E ForAllIterationCall src its its_ty body : \\<tau>\"\ninductive_cases OneIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E OneIterationCall src its its_ty body : \\<tau>\"\ninductive_cases IsUniqueIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E IsUniqueIterationCall src its its_ty body : \\<tau>\"\ninductive_cases SelectIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E SelectIterationCall src its its_ty body : \\<tau>\"\ninductive_cases RejectIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E RejectIterationCall src its its_ty body : \\<tau>\"\ninductive_cases SortedByIterationTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E SortedByIterationCall src its its_ty body : \\<tau>\"\n\ninductive_cases ExprListNilTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>L [] : \\<pi>\"\ninductive_cases ExprListConsTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>L x # xs : \\<pi>\"\n\n(*** Simplification Rules ***************************************************)\n\nsection \\<open>Simplification Rules\\<close>\n\ninductive_simps typing_alt_simps: \n\"\\<Gamma> \\<turnstile>\\<^sub>E NullLiteral : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E BooleanLiteral c : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E RealLiteral c : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E UnlimitedNaturalLiteral c : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E IntegerLiteral c : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E StringLiteral c : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E EnumLiteral enm lit : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E TupleLiteral [] : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E TupleLiteral (x # xs) : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E CollectionLiteral k [] : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E CollectionLiteral k (x # xs) : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E MapLiteral [] : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E MapLiteral (x # xs) : \\<tau>\"\n\n\"\\<Gamma> \\<turnstile>\\<^sub>C CollectionItem a : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>C CollectionRange a b : \\<tau>\"\n\n\"\\<Gamma> \\<turnstile>\\<^sub>E Let v \\<tau> init body : \\<sigma>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E Var v : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E If a b c : \\<tau>\"\n\n\"\\<Gamma> \\<turnstile>\\<^sub>E MetaOperationCall \\<tau> op : \\<sigma>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E StaticOperationCall \\<tau> op as : \\<sigma>\"\n\n\"\\<Gamma> \\<turnstile>\\<^sub>E TypeOperationCall a k op \\<sigma> : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E AttributeCall src prop : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E AssociationEndCall src role from : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E AssociationClassCall src a from : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E AssociationClassEndCall src role : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E OperationCall src k op params : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E TupleElementCall src elem : \\<tau>\"\n\n\"\\<Gamma> \\<turnstile>\\<^sub>I (src, its, body) : ys\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E IterateCall src its its_ty res res_t res_init body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E AnyIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E ClosureIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E CollectIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E CollectByIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E CollectNestedIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E ExistsIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E ForAllIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E OneIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E IsUniqueIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E SelectIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E RejectIterationCall src its its_ty body : \\<tau>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>E SortedByIterationCall src its its_ty body : \\<tau>\"\n\n\"\\<Gamma> \\<turnstile>\\<^sub>L [] : \\<pi>\"\n\"\\<Gamma> \\<turnstile>\\<^sub>L x # xs : \\<pi>\"\n\nlemmas ocl_typing_simps =\n  non_strict_op.simps\n  op_type_alt_simps\n  op_result_type_is_errorable_def\n  iterators_def\n  coiterators_def\n  iteration_type.simps\n  typing_alt_simps\n\n(*** Misc Properties ********************************************************)\n\nsection \\<open>Misc Properties\\<close>\n\nlemma TupleLiteral_has_Tuple_type:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E TupleLiteral prts : \\<tau> \\<Longrightarrow> \\<exists>\\<pi>. required_tuple_type \\<tau> \\<pi>\"\nproof (induct prts arbitrary: \\<tau>)\n  case Nil show ?case\n    apply (insert Nil)\n    apply (erule TupleLiteralNilTE)\n    by (auto simp add: tuple_type.simps tuple_type\\<^sub>N.simps tuple_type\\<^sub>T.simps)\nnext\n  case (Cons a prts) show ?case\n    apply (insert Cons)\n    apply (erule TupleLiteralConsTE)\n    using tuple_type_sup tuple_type'_implies_ex_tuple_type by blast\nqed\n\nlemma collection_type_template_simps:\n  \"collection_type_template \\<tau> k \\<sigma> n =\n   (collection_type \\<tau> k \\<sigma> n False \\<or> collection_type \\<tau> k \\<sigma> n True)\"\n  by (metis (full_types) collection_type_template.cases collection_type_template.intros)\n\nlemma collection_type'_implies_ex_collection_type_template:\n  \" collection_type' \\<tau> k \\<sigma> n e \\<Longrightarrow> (\\<exists>\\<sigma>. collection_type_template \\<tau> k \\<sigma> n)\"\n  apply (simp add: collection_type'.simps collection_type_template.simps)\n  using collection_type.intros by blast\n\nlemma collection_type_sup':\n  \"collection_type \\<tau> k \\<rho> n e \\<Longrightarrow>\n   collection_type \\<sigma> k \\<upsilon> n e \\<Longrightarrow>\n   collection_type (\\<tau> \\<squnion> \\<sigma>) k (\\<rho> \\<squnion> \\<upsilon>) n e\"\n  by (auto simp add: collection_type.simps\n      collection_type\\<^sub>N.simps collection_type\\<^sub>T.simps)\n\nlemma CollectionLiteral_has_Collection_type:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E CollectionLiteral k prts : \\<tau> \\<Longrightarrow> \\<exists>\\<sigma>. \\<tau> \\<hookrightarrow> Collection\\<^bsub>k\\<^esub>(\\<sigma>)[1.]\"\nproof (induct prts arbitrary: \\<tau>)\n  case Nil show ?case\n    apply (insert Nil)\n    apply (erule CollectionLiteralNilTE)\n    by (simp add: collection_type'_implies_ex_collection_type_template)\nnext\n  case (Cons a prts) show ?case\n    apply (insert Cons)\n    apply (erule CollectionLiteralConsTE)\n    using collection_type_sup by blast\nqed\n\nlemma MapLiteral_has_Map_type:\n  \"\\<Gamma> \\<turnstile>\\<^sub>E MapLiteral prts : \\<tau> \\<Longrightarrow> \\<exists>\\<sigma> \\<rho>. \\<tau> \\<hookrightarrow> Map(\\<sigma>, \\<rho>)[1.]\"\nproof (induct prts arbitrary: \\<tau>)\n  case Nil show ?case\n    apply (insert Nil)\n    apply (erule MapLiteralNilTE)\n    by (cases \\<tau>; simp add: map_type'_implies_ex_map_type)\nnext\n  case (Cons a prts) show ?case\n    apply (insert Cons)\n    apply (erule MapLiteralConsTE)\n    using map_type'_sup map_type'_implies_ex_map_type by blast\nqed\n\n(*** Determinism ************************************************************)\n\nsection \\<open>Determinism\\<close>\n\ninductive_cases IteratorTE [elim]: \"\\<Gamma> \\<turnstile>\\<^sub>E Call src ArrowCall (Iterator iter its its_ty body) : \\<upsilon>\"\n\nlemma\n  typing_det:\n    \"\\<Gamma> \\<turnstile>\\<^sub>E expr : \\<tau> \\<Longrightarrow>\n     \\<Gamma> \\<turnstile>\\<^sub>E expr : \\<sigma> \\<Longrightarrow> \\<tau> = \\<sigma>\" and\n  collection_part_typing_det:\n    \"\\<Gamma> \\<turnstile>\\<^sub>C prt : \\<tau> \\<Longrightarrow>\n     \\<Gamma> \\<turnstile>\\<^sub>C prt : \\<sigma> \\<Longrightarrow> \\<tau> = \\<sigma>\" and\n  iterator_typing_det:\n    \"\\<Gamma> \\<turnstile>\\<^sub>I (src, its, body) : xs \\<Longrightarrow>\n     \\<Gamma> \\<turnstile>\\<^sub>I (src, its, body) : ys \\<Longrightarrow> xs = ys\" and\n  expr_list_typing_det:\n    \"\\<Gamma> \\<turnstile>\\<^sub>L exprs : \\<pi> \\<Longrightarrow>\n     \\<Gamma> \\<turnstile>\\<^sub>L exprs : \\<xi> \\<Longrightarrow> \\<pi> = \\<xi>\"\nproof (induct arbitrary: \\<sigma> and \\<sigma> and ys and \\<xi>\n       rule: typing_collection_part_typing_iterator_typing_expr_list_typing.inducts)\n  case (NullLiteralT \\<Gamma>) thus ?case by auto\nnext\n  case (BooleanLiteralT \\<Gamma> c) thus ?case by auto\nnext\n  case (RealLiteralT \\<Gamma> c) thus ?case by auto\nnext\n  case (IntegerLiteralT \\<Gamma> c) thus ?case by auto\nnext\n  case (UnlimitedNaturalLiteralT \\<Gamma> c) thus ?case by auto\nnext\n  case (StringLiteralT \\<Gamma> c) thus ?case by auto\nnext\n  case (EnumLiteralT enum lit \\<Gamma>) thus ?case by auto\nnext\n  case (TupleLiteralNilT \\<Gamma>) thus ?case by auto\nnext\n  case (TupleLiteralConsT \\<Gamma> el \\<tau> \\<sigma> \\<rho> elems \\<upsilon>)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E Literal (TupleLiteral (el # elems)) : \\<sigma> \\<Longrightarrow> \\<rho> \\<squnion> \\<upsilon> = \\<sigma>\"\n    using TupleLiteralConsT.hyps(3) TupleLiteralConsT.hyps(5)\n        TupleLiteralConsT.hyps(7) tuple_type_det(2) by fastforce\n  thus ?case by (simp add: TupleLiteralConsT.prems)\nnext\n  case (CollectionLiteralNilT k \\<sigma> \\<Gamma>) thus ?case\n    by (meson CollectionLiteralNilTE collection_type'_det)\nnext\n  case (CollectionLiteralConsT k \\<Gamma> x \\<tau> \\<sigma> xs \\<rho>) thus ?case\n    by (metis CollectionLiteralConsTE collection_type'_det)\nnext\n  case (CollectionPartItemT \\<Gamma> a \\<tau>) thus ?case by blast\nnext\n  case (CollectionPartRangeT \\<Gamma> a b) thus ?case by blast\nnext\n  case (LowerErrorableCollectionPartRangeT \\<Gamma> a b) thus ?case by blast\nnext\n  case (UpperErrorableCollectionPartRangeT \\<Gamma> a b) thus ?case by blast\nnext\n  case (ErrorableCollectionPartRangeT \\<Gamma> a b) thus ?case by blast\nnext\n  case (MapNilT \\<tau> \\<Gamma>) thus ?case\n    using map_type'_det by blast\nnext\n  case (MapConsT \\<Gamma> x \\<tau> \\<sigma> \\<rho> xs \\<upsilon>)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E Literal (MapLiteral (x # xs)) : \\<sigma> \\<Longrightarrow> \\<rho> \\<squnion> \\<upsilon> = \\<sigma>\"\n    using MapConsT.hyps map_type'_det by blast\n  thus ?case by (simp add: MapConsT.prems)\nnext\n  case (LetT \\<Gamma> init \\<sigma> \\<tau> v body \\<rho>) thus ?case by blast\nnext\n  case (VarT \\<Gamma> v \\<tau>) thus ?case by auto\nnext\n  case (IfT \\<Gamma> cnd thn \\<sigma> els \\<rho>) thus ?case by blast\nnext\n  case (ErrorableIfT \\<Gamma> cnd thn \\<sigma> els \\<rho>) thus ?case by blast\nnext\n  case (MetaOperationCallT \\<tau> op \\<sigma> \\<Gamma>) thus ?case\n    by (meson MetaOperationCallTE mataop_type_det)\nnext\n  case (StaticOperationCallT \\<Gamma> params \\<pi> \\<tau> op oper)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E StaticOperationCall \\<tau> op params : \\<sigma> \\<Longrightarrow>\n        oper_type oper = \\<sigma>\"\n    apply (erule StaticOperationCallTE)\n    using StaticOperationCallT.hyps static_operation_det by blast+\n  thus ?case by (simp add: StaticOperationCallT.prems)\nnext\n  case (ErrorableStaticOperationCallT \\<Gamma> params \\<pi> \\<tau> op oper)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E StaticOperationCall \\<tau> op params : \\<sigma> \\<Longrightarrow>\n        (oper_type oper)\\<lbrakk>.!\\<rbrakk> = \\<sigma>\"\n    apply (erule StaticOperationCallTE)\n    using ErrorableStaticOperationCallT.hyps static_operation_det by blast+\n  thus ?case by (simp add: ErrorableStaticOperationCallT.prems)\nnext\n  case (TypeOperationCallT \\<Gamma> a \\<tau> k op \\<sigma> \\<rho>) thus ?case\n    by (metis TypeOperationCallTE typeop_type_det)\nnext\n  case (OperationCallT \\<Gamma> src \\<tau> params \\<pi> op k \\<sigma>) thus ?case\n    by (metis OperationCallTE op_type_det)\nnext\n  case (AttributeCallT \\<Gamma> src \\<C> \"prop\" \\<D> \\<tau>)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E AttributeCall src prop : \\<sigma> \\<Longrightarrow> \\<tau> = \\<sigma>\"\n    apply (erule AttributeCallTE)\n    using AttributeCallT.hyps attribute_det by blast+\n  thus ?case by (simp add: AttributeCallT.prems)\nnext\n  case (ErrorableAttributeCallT \\<Gamma> src \\<C> \"prop\" \\<D> \\<tau>)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E AttributeCall src prop : \\<sigma> \\<Longrightarrow> \\<tau>\\<lbrakk>.!\\<rbrakk> = \\<sigma>\"\n    apply (erule AttributeCallTE)\n    using ErrorableAttributeCallT.hyps attribute_det by blast+\n  thus ?case by (simp add: ErrorableAttributeCallT.prems)\nnext\n  case (AssociationEndCallT \\<Gamma> src \\<C> \"from\" role \\<D> \"end\")\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E AssociationEndCall src from role : \\<sigma> \\<Longrightarrow>\n        assoc_end_type end = \\<sigma>\"\n    apply (erule AssociationEndCallTE)\n    using AssociationEndCallT.hyps association_end_det by blast+\n  thus ?case by (simp add: AssociationEndCallT.prems)\nnext\n  case (ErrorableAssociationEndCallT \\<Gamma> src \\<C> \"from\" role \\<D> \"end\")\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E AssociationEndCall src from role : \\<sigma> \\<Longrightarrow>\n        (assoc_end_type end)\\<lbrakk>.!\\<rbrakk> = \\<sigma>\"\n    apply (erule AssociationEndCallTE)\n    using ErrorableAssociationEndCallT.hyps association_end_det by blast+\n  thus ?case by (simp add: ErrorableAssociationEndCallT.prems)\nnext\n  case (AssociationClassCallT \\<Gamma> src \\<C> \"from\" \\<A> \\<D>)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E AssociationClassCall src from \\<A> : \\<sigma> \\<Longrightarrow>\n        class_assoc_type \\<A> = \\<sigma>\"\n    apply (erule AssociationClassCallTE)\n    using AssociationClassCallT.hyps by blast+\n  thus ?case by (simp add: AssociationClassCallT.prems)\nnext\n  case (ErrorableAssociationClassCallT \\<Gamma> src \\<C> \"from\" \\<A> \\<D>)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E AssociationClassCall src from \\<A> : \\<sigma> \\<Longrightarrow>\n        (class_assoc_type \\<A>)\\<lbrakk>.!\\<rbrakk> = \\<sigma>\"\n    apply (erule AssociationClassCallTE)\n    using ErrorableAssociationClassCallT.hyps by blast+\n  thus ?case by (simp add: ErrorableAssociationClassCallT.prems)\nnext\n  case (AssociationClassEndCallT \\<Gamma> src \\<A> role \"end\")\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E AssociationClassEndCall src role : \\<sigma> \\<Longrightarrow>\n        class_assoc_end_type end = \\<sigma>\"\n    apply (erule AssociationClassEndCallTE)\n    using AssociationClassEndCallT.hyps\n          association_class_end_det by blast+\n  thus ?case by (simp add: AssociationClassEndCallT.prems)\nnext\n  case (ErrorableAssociationClassEndCallT \\<Gamma> src \\<A> role \"end\")\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E AssociationClassEndCall src role : \\<sigma> \\<Longrightarrow>\n        (class_assoc_end_type end)\\<lbrakk>.!\\<rbrakk> = \\<sigma>\"\n    apply (erule AssociationClassEndCallTE)\n    using ErrorableAssociationClassEndCallT.hyps\n          association_class_end_det by blast+\n  thus ?case by (simp add: ErrorableAssociationClassEndCallT.prems)\nnext\n  case (TupleElementCallT \\<Gamma> src \\<pi> elem \\<tau>)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E TupleElementCall src elem : \\<sigma> \\<Longrightarrow> ErrorFree \\<tau> = \\<sigma>\"\n    apply (erule TupleElementCallTE)\n    using TupleElementCallT.hyps by force+\n  thus ?case by (simp add: TupleElementCallT.prems)\nnext\n  case (ErrorableTupleElementCallT \\<Gamma> src \\<pi> elem \\<tau>)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E TupleElementCall src elem : \\<sigma> \\<Longrightarrow> Errorable \\<tau> = \\<sigma>\"\n    apply (erule TupleElementCallTE)\n    using ErrorableTupleElementCallT.hyps by force+\n  thus ?case by (simp add: ErrorableTupleElementCallT.prems)\nnext\n  case (CollectionLoopT \\<Gamma> src \\<tau> \\<sigma> its_ty its body \\<rho>)\n  have \"\\<And>ys. \\<Gamma> \\<turnstile>\\<^sub>I (src, its, (Some its_ty, None), body) : ys \\<Longrightarrow>\n        (\\<tau>, \\<sigma>, \\<rho>) = ys\"\n    apply (erule LoopTE)\n    using CollectionLoopT.hyps(2) CollectionLoopT.hyps(3)\n          CollectionLoopT.hyps(7) any_collection_type_template_det apply blast\n    using CollectionLoopT.hyps(2) CollectionLoopT.hyps(3)\n          collection_type_det by blast\n  thus ?case by (simp add: CollectionLoopT.prems)\nnext\n  case (MapLoopT \\<Gamma> src \\<tau> \\<sigma> \\<upsilon> its_key_ty its_val_ty its body \\<rho>)\n  have \"\\<And>ys. \\<Gamma> \\<turnstile>\\<^sub>I (src, its, (Some its_key_ty, Some its_val_ty), body) : ys \\<Longrightarrow>\n        (\\<tau>, \\<sigma>, \\<rho>) = ys\"\n    apply (erule LoopTE, auto simp add: MapLoopT.hyps)\n    using MapLoopT.hyps(2) MapLoopT.hyps(3) map_type_template_det by blast\n  thus ?case by (simp add: MapLoopT.prems)\nnext\n  case (IterateT \\<Gamma> src its its_ty res res_t res_init body \\<tau> \\<sigma> \\<rho>)\n    thus ?case by blast\nnext\n  case (ErrorableIterateT \\<Gamma> src its its_ty res res_t res_init body \\<tau> \\<sigma> \\<rho>)\n    thus ?case by blast\nnext\n  case (IteratorT \\<Gamma> src its its_ty body \\<tau> \\<sigma> \\<rho> iter \\<upsilon>)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E src->(Iterator iter its its_ty body) : \\<sigma> \\<Longrightarrow> \\<upsilon> = \\<sigma>\"\n    apply (erule IteratorTE)\n    apply (metis IteratorT.hyps(2) IteratorT.hyps(5) Pair_inject iteration_type_det)\n    using IteratorT.hyps(2) IteratorT.hyps(3) IteratorT.hyps(4) by blast\n  thus ?case by (simp add: IteratorT.prems)\nnext\n  case (ErrorableIteratorT \\<Gamma> src its its_ty body \\<tau> \\<sigma> \\<rho> iter \\<upsilon>)\n  have \"\\<And>\\<sigma>. \\<Gamma> \\<turnstile>\\<^sub>E src->(Iterator iter its its_ty body) : \\<sigma> \\<Longrightarrow> \\<upsilon>\\<lbrakk>.!\\<rbrakk> = \\<sigma>\"\n    apply (erule IteratorTE)\n    using ErrorableIteratorT.hyps(2) ErrorableIteratorT.hyps(3) apply blast\n    using ErrorableIteratorT.hyps(2) ErrorableIteratorT.hyps(4) Pair_inject\n          iteration_type_det by fastforce\n  thus ?case by (simp add: ErrorableIteratorT.prems)\nnext\n  case (ExprListNilT \\<Gamma>) thus ?case by auto\nnext\n  case (ExprListConsT \\<Gamma> expr \\<tau> exprs \\<pi>) thus ?case by blast\nqed\n\n(*** Code Setup *************************************************************)\n\nsection \\<open>Code Setup\\<close>\n\ncode_pred non_strict_op .\n\ncode_pred (modes:\n    i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool,\n    i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) mataop_type .\ncode_pred (modes:\n    i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool,\n    i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) typeop_type .\n\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) any_unop_type .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) boolean_unop_type .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) numeric_unop_type .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) string_unop_type .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) iterable_unop_type .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) unop_type .\n\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) any_binop_type .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) boolean_binop_type .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) numeric_binop_type .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) string_binop_type .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) iterable_binop_type .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) binop_type .\n\ncode_pred (modes:\n    i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) string_ternop_type .\ncode_pred (modes:\n    i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) iterable_ternop_type .\ncode_pred (modes:\n    i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) ternop_type .\n\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) op_type .\n\ncode_pred (modes:\n    i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool,\n    i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) iteration_type .\n\ncode_pred (modes:\n    typing: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool and\n    iterator_typing: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool and\n    expr_list_typing: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool and\n    collection_part_typing: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool, i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) typing .\n\nend\n", "meta": {"author": "AresEkb", "repo": "Safe_OCL", "sha": "61efbf1207b7a0e892190fe36fb60daf6dcf45a5", "save_path": "github-repos/isabelle/AresEkb-Safe_OCL", "path": "github-repos/isabelle/AresEkb-Safe_OCL/Safe_OCL-61efbf1207b7a0e892190fe36fb60daf6dcf45a5/OCL_Typing.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3312570992119607}}
{"text": "section {*FUNCTION\\_\\_DPDA\\_DFA\\_CC\\_\\_fp\\_one\\_\\_DPDA\\_DFA\\_CONSTRUCT\\_CONTROLLER\\_FP\\_ONE*}\ntheory\n  FUNCTION__DPDA_DFA_CC__fp_one__DPDA_DFA_CONSTRUCT_CONTROLLER_FP_ONE\n\nimports\n  PRJ_14_02__ENTRY\n\nbegin\n\ndefinition FPiteratorMarked__SpecInput :: \"\n  'event DES \n  \\<Rightarrow> 'event DES\n  \\<Rightarrow> 'event DES \n  \\<Rightarrow> bool\"\n  where\n    \"FPiteratorMarked__SpecInput C S P \\<equiv>\n  IsDES C \n  \\<and> IsDES S \n  \\<and> IsDES P \n  \\<and> DES_nonblockingness C \n  \\<and> DES_specification_satisfied S C \n  \\<and> C \\<le> P\"\n\ndefinition FPiteratorMarked__SpecOutput_Alt :: \"\n  'event DES\n  \\<Rightarrow> 'event DES\n  \\<Rightarrow> 'event DES\n  \\<Rightarrow> 'event set\n  \\<Rightarrow> 'event DES\n  \\<Rightarrow> bool\n  \\<Rightarrow> bool\" \n  where\n    \"FPiteratorMarked__SpecOutput_Alt C S P \\<Sigma>UC C' unchanged \\<equiv>\n  IsDES C'\n  \\<and> DES_specification_satisfied S C'\n  \\<and> (C = C' \\<longleftrightarrow> unchanged)\n  \\<and> (if C = C' then DES_nonblockingness C' \\<and> DES_controllability \\<Sigma>UC P C' else True)\"\n\ndefinition FPiteratorMarked__SpecOutput :: \"\n  'event DES\n  \\<Rightarrow> 'event DES\n  \\<Rightarrow> 'event DES\n  \\<Rightarrow> 'event set\n  \\<Rightarrow> 'event DES\n  \\<Rightarrow> bool\n  \\<Rightarrow> bool\" \n  where\n    \"FPiteratorMarked__SpecOutput C S P \\<Sigma>UC C' unchanged \\<equiv>\n  IsDES C'\n  \\<and> DES_specification_satisfied S C'  \n  \\<and> (C = C' \\<longleftrightarrow> unchanged)\n  \\<and> (C = C' \\<longrightarrow> DES_nonblockingness C' \\<and> DES_controllability \\<Sigma>UC P C')\"    \n\ndefinition F_DPDA_DFA_CC__fp_one__SpecInput :: \"\n  ('state DT_symbol, 'event DT_symbol, 'stack DT_symbol) epda\n  \\<Rightarrow> ('state DT_symbol, 'event DT_symbol, 'stack DT_symbol) epda \n  \\<Rightarrow> ('state DT_symbol, 'event DT_symbol, nat) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_DFA_CC__fp_one__SpecInput C S P \\<equiv>\n  valid_dpda C\n  \\<and> valid_dpda S\n  \\<and> valid_dfa P\n  \\<and> FPiteratorMarked__SpecInput (epda_to_des C) (epda_to_des S) (epda_to_des P)\n  \\<and> \\<not> epdaH_livelock C\n  \\<and> epdaH.accessible C\"\n\ndefinition F_DPDA_DFA_CC__fp_one__SpecOutput :: \"\n  ('state DT_symbol, 'event DT_symbol, 'stack DT_symbol) epda\n  \\<Rightarrow> ('state DT_symbol, 'event DT_symbol, 'stack DT_symbol) epda \n  \\<Rightarrow> ('state DT_symbol, 'event DT_symbol, nat) epda \n  \\<Rightarrow> 'event DT_symbol set\n  \\<Rightarrow> ((('state DT_symbol, 'event DT_symbol, 'stack DT_symbol) epda option) \n      \\<times> bool)\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_DFA_CC__fp_one__SpecOutput C S P \\<Sigma>UC C' \\<equiv>\n  case C' of\n    (None, changed) \\<Rightarrow>\n      FPiteratorMarked \\<Sigma>UC (epda_to_des P) (epda_to_des C) = DES {} {}\n    | (Some C', changed) \\<Rightarrow>\n      FPiteratorMarked \\<Sigma>UC (epda_to_des P) (epda_to_des C) = epda_to_des C'\n      \\<and> FPiteratorMarked__SpecOutput \n          (epda_to_des C) \n          (epda_to_des S)\n          (epda_to_des P)\n          \\<Sigma>UC \n          (epda_to_des C')\n          (\\<not> changed)\n      \\<and> F_DPDA_DFA_CC__fp_one__SpecInput C' S P\n      \\<and> epda_to_des C' \\<le> epda_to_des C\n      \\<and> (\\<not> changed \\<longleftrightarrow> C = C')\n      \\<and> (\\<not> changed \\<longrightarrow> epda_operational_controllable C' P \\<Sigma>UC)\"\n\nlemma leq_le_trans_DES: \"\n  a \\<le> b \\<Longrightarrow> b < (c::('a)DES) \\<Longrightarrow>  a \\<le> c\"\n  apply(force)\n  done\n\ntheorem F_DPDA_DFA_CC__fp_one__SOUND: \"\n  F_DPDA_DFA_CC__fp_one__SpecInput C S P\n  \\<Longrightarrow> F_DPDA_DFA_CC__fp_one__SpecOutput C S P \\<Sigma>UC (F_DPDA_DFA_CC__fp_one C P \\<Sigma>UC)\"\n  apply(simp add: F_DPDA_DFA_CC__fp_one_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      S=\"C\"\n      and P=\"P\"\n      and \\<Sigma>UC=\"\\<Sigma>UC\"\n      in F_DPDA_EC__SOUND)\n    apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def)\n    apply(clarsimp)\n    apply(rule_tac\n      s=\"epdaH.unmarked_language C\"\n      and t=\"epdaS.unmarked_language C\"\n      in ssubst)\n     apply(rule epdaS_to_epdaH_unmarked_language)\n     apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n    apply(rule_tac\n      s=\"epdaH.unmarked_language P\"\n      and t=\"epdaS.unmarked_language P\"\n      in ssubst)\n     apply(rule epdaS_to_epdaH_unmarked_language)\n     apply (metis valid_dfa_def valid_dpda_to_valid_pda PDA_to_epda)\n    apply(rule_tac\n      s=\"epdaH.marked_language C\"\n      and t=\"epdaS.marked_language C\"\n      in ssubst)\n     apply(rule epdaS_to_epdaH_mlang)\n     apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n    apply(rule_tac\n      s=\"epdaH.marked_language P\"\n      and t=\"epdaS.marked_language P\"\n      in ssubst)\n     apply(rule epdaS_to_epdaH_mlang)\n     apply (metis valid_dfa_def valid_dpda_to_valid_pda PDA_to_epda)\n    apply(rule conjI)\n     apply(force)\n    apply(simp add: DES_nonblockingness_def nonblockingness_language_def)\n   apply(force)\n  apply(case_tac \"F_DPDA_EC C P \\<Sigma>UC\")\n  apply(rename_tac a b)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n   apply(rename_tac a b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac b)(*strict*)\n   apply(simp add: FPiteratorMarked__SpecOutput_def F_DPDA_DFA_CC__fp_one__SpecOutput_def F_DPDA_EC__SpecOutput_def F_DPDA_DFA_CC__fp_one__SpecInput_def FPiteratorMarked__SpecInput_def)\n   apply(clarsimp)\n   apply(simp add: FPiteratorMarked_def epda_to_des_def)\n   apply(simp add: ifcomp_def)\n   apply(rule conjI)\n    apply(rename_tac b)(*strict*)\n    apply(clarsimp)\n    apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def DES_nonblockingness_def nonblockingness_language_def)\n    apply(simp add: prefix_closure_def prefix_def)\n   apply(rename_tac b)(*strict*)\n   apply(clarsimp)\n   apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def DES_nonblockingness_def prefix_closure_def prefix_def Enforce_Nonblockingness_DES_def)\n  apply(rename_tac a b aa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b aa)(*strict*)\n  apply(rename_tac C')\n  apply(rename_tac b C')(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac b C')(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"C'\"\n      in F_DPDA_EB_OPT__SOUND)\n   apply(simp add: F_DPDA_EB_OPT__SpecInput_def F_DPDA_EC__SpecOutput_def)\n  apply(rename_tac b C')(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac b C')(*strict*)\n   prefer 2\n   apply(rule_tac\n      \\<Sigma>UC=\"\\<Sigma>UC\"\n      and P=\"epda_to_des P\"\n      in Characteristic_Fixed_Point_Iterator_Enforce_Marked_Controllable_Subset)\n   apply(simp add: F_DPDA_EC__SpecOutput_def FPiteratorMarked__SpecOutput_def F_DPDA_DFA_CC__fp_one__SpecInput_def FPiteratorMarked__SpecInput_def)\n  apply(rename_tac b C')(*strict*)\n  apply(case_tac b)\n   apply(rename_tac b C')(*strict*)\n   apply(clarsimp)\n   apply(simp only: F_DPDA_EC__SpecOutput_def FPiteratorMarked__SpecOutput_def F_DPDA_DFA_CC__fp_one__SpecInput_def FPiteratorMarked__SpecInput_def)\n   apply(clarsimp)\n   apply(rename_tac b)(*strict*)\n   apply(subgoal_tac \"(\\<forall>X. IsDES X \\<and> DES_nonblockingness X \\<longrightarrow> DES_controllability \\<Sigma>UC (epda_to_des P) X = (Enforce_Marked_Controllable_Subset \\<Sigma>UC (des_langUM (epda_to_des P)) X = X))\")\n    apply(rename_tac b)(*strict*)\n    prefer 2\n    apply(simp add: Characteristic_Fixed_Point_Iterator_def)\n   apply(rename_tac b)(*strict*)\n   apply(erule_tac\n      x=\"(epda_to_des C)\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: F_DPDA_DFA_CC__fp_one__SpecOutput_def)\n   apply(rename_tac b)(*strict*)\n   apply(simp add: epda_to_des_def F_DPDA_DFA_CC__fp_one__SpecOutput_def F_DPDA_EC__SpecOutput_def FPiteratorMarked__SpecOutput_def F_DPDA_DFA_CC__fp_one__SpecInput_def FPiteratorMarked__SpecInput_def)\n   apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def prefix_closure_def prefix_def)\n   apply(clarsimp)\n   apply(simp add: FPiteratorMarked_def)\n   apply(simp add: ifcomp_def)\n  apply(clarsimp)\n  apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def DES_nonblockingness_def) \n  apply(rename_tac b C')(*strict*)\n  apply(clarsimp)\n  apply(simp only: F_DPDA_DFA_CC__fp_one__SpecOutput_def F_DPDA_EC__SpecOutput_def F_DPDA_DFA_CC__fp_one__SpecInput_def FPiteratorMarked__SpecInput_def)\n  apply(clarsimp)\n  apply(simp add: F_DPDA_EB_OPT__SpecOutput_def)\n  apply(subgoal_tac \"epdaS.marked_language C' = epdaH.marked_language C'\")\n   apply(rename_tac b C')(*strict*)\n   prefer 2\n   apply(rule epdaS_to_epdaH_mlang)\n   apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n  apply(rename_tac b C')(*strict*)\n  apply(subgoal_tac \"epdaS.unmarked_language C' = epdaH.unmarked_language C'\")\n   apply(rename_tac b C')(*strict*)\n   prefer 2\n   apply(rule epdaS_to_epdaH_unmarked_language)\n   apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n  apply(rename_tac b C')(*strict*)\n  apply(case_tac \"F_DPDA_EB_OPT C'\")\n   apply(rename_tac b C')(*strict*)\n   apply(clarsimp)\n   apply(simp add: epda_to_des_def FPiteratorMarked__SpecOutput_def IsDES_def)\n   apply(clarsimp)\n   apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def prefix_closure_def prefix_def)\n   apply(simp add: FPiteratorMarked_def)\n   apply(simp add: ifcomp_def)\n   apply(rule conjI)\n    apply(rename_tac b C')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac b C')(*strict*)\n   apply(clarsimp)\n   apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def DES_nonblockingness_def prefix_closure_def prefix_def Enforce_Nonblockingness_DES_def)\n  apply(rename_tac b C' a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac C'')\n  apply(rename_tac b C' C'')(*strict*)\n  apply(subgoal_tac \"epdaS.marked_language C'' = epdaH.marked_language C''\")\n   apply(rename_tac b C' C'')(*strict*)\n   prefer 2\n   apply(rule epdaS_to_epdaH_mlang)\n   apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(subgoal_tac \"epdaS.unmarked_language C'' = epdaH.unmarked_language C''\")\n   apply(rename_tac b C' C'')(*strict*)\n   prefer 2\n   apply(rule epdaS_to_epdaH_unmarked_language)\n   apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(subgoal_tac \"epda_to_des C > epda_to_des C'\")\n   apply(rename_tac b C' C'')(*strict*)\n   prefer 2\n   apply(subgoal_tac \"epda_to_des C' \\<le> epda_to_des C\")\n    apply(rename_tac b C' C'')(*strict*)\n    apply(subgoal_tac \"epda_to_des C' \\<noteq> epda_to_des C\")\n     apply(rename_tac b C' C'')(*strict*)\n     apply(force)\n    apply(rename_tac b C' C'')(*strict*)\n    apply(force)\n   apply(rename_tac b C' C'')(*strict*)\n   apply(simp add: Enforce_Marked_Controllable_Subset_def)\n   apply(simp add: epda_to_des_def)\n   apply(clarsimp)\n   apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def nonblockingness_language_def DES_nonblockingness_def)\n   apply(rule conjI)\n    apply(rename_tac b C' C'')(*strict*)\n    apply(rule_tac\n      t=\"epdaH.unmarked_language C'\"\n      and s=\"{w \\<in> epdaH.unmarked_language C. controllable_sublanguage ((prefix_closure {w}) - {w}) (alphabet_to_language \\<Sigma>UC) (epdaH.unmarked_language P) (epdaH.unmarked_language C)}\"\n      in ssubst)\n     apply(rename_tac b C' C'')(*strict*)\n     apply(force)\n    apply(rename_tac b C' C'')(*strict*)\n    apply(force)\n   apply(rename_tac b C' C'')(*strict*)\n   apply(simp add: controllable_subset_def)\n   apply(rule_tac\n      t=\"epdaH.marked_language C''\"\n      and s=\"{w \\<in> epdaH.unmarked_language C. controllable_sublanguage (prefix_closure {w}) \\<langle>\\<Sigma>UC\\<rangle> (epdaH.unmarked_language P) (epdaH.unmarked_language C)} \\<inter> epdaH.marked_language C\"\n      in ssubst)\n    apply(rename_tac b C' C'')(*strict*)\n    apply(force)\n   apply(rename_tac b C' C'')(*strict*)\n   apply(force)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(subgoal_tac \"epda_to_des C' \\<ge> epda_to_des C''\")\n   apply(rename_tac b C' C'')(*strict*)\n   prefer 2\n   apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def)\n   apply(clarsimp)\n   apply(rename_tac b C' C'' x)(*strict*)\n   apply(simp add: IsDES_def)\n   apply(clarsimp)\n   apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def nonblockingness_language_def DES_nonblockingness_def)\n   apply(rule_tac\n      A=\"prefix_closure (epdaH.marked_language C'')\"\n      in set_mp)\n    apply(rename_tac b C' C'' x)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac b C' C'' x)(*strict*)\n   apply(rule_tac\n      t=\"prefix_closure (epdaH.marked_language C'')\"\n      and s=\"prefix_closure (epdaH.marked_language C')\"\n      in ssubst)\n    apply(rename_tac b C' C'' x)(*strict*)\n    apply(force)\n   apply(rename_tac b C' C'' x)(*strict*)\n   apply(simp (no_asm) add: prefix_closure_def prefix_def)\n   apply(clarsimp)\n   apply(rename_tac b C' C'' x xa c)(*strict*)\n   apply(rule_tac\n      v=\"c\"\n      in epdaH_unmarked_languageuage_prefix_closed)\n    apply(rename_tac b C' C'' x xa c)(*strict*)\n    apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n   apply(rename_tac b C' C'' x xa c)(*strict*)\n   apply(rule_tac\n      A=\"X\" for X\n      in set_mp)\n    apply(rename_tac b C' C'' x xa c)(*strict*)\n    apply(rule epdaH.lang_inclusion)\n    apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n   apply(rename_tac b C' C'' x xa c)(*strict*)\n   apply(force)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(rule_tac t=\"FPiteratorMarked__SpecOutput (epda_to_des C) (epda_to_des S) (epda_to_des P) \\<Sigma>UC\n        (epda_to_des C'') False\" and s=\"FPiteratorMarked__SpecOutput_Alt (epda_to_des C) (epda_to_des S) (epda_to_des P) \\<Sigma>UC\n        (epda_to_des C'') False\" in ssubst)\n   apply(simp add: FPiteratorMarked__SpecOutput_def FPiteratorMarked__SpecOutput_Alt_def)\n  apply(simp add: FPiteratorMarked__SpecOutput_Alt_def)\n  apply(rule context_conjI)\n   apply(rename_tac b C' C'')(*strict*)\n   apply(force)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"FPiteratorMarked \\<Sigma>UC (epda_to_des P) (epda_to_des C) = epda_to_des C'' \\<and> IsDES (epda_to_des C'') \\<and> DES_specification_satisfied (epda_to_des S) (epda_to_des C'') \\<and> DES_nonblockingness (epda_to_des C'') \\<and> epda_to_des C'' \\<le> epda_to_des P \\<and> epdaH.accessible C''\")\n   apply(rename_tac b C' C'')(*strict*)\n   apply(simp add: DES_specification_satisfied_def)\n   apply(clarsimp) \n   apply(rule context_conjI)\n    apply(simp add: prefix_closure_def prefix_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def  Enforce_Nonblockingness_DES_def)\n   apply(rule conjI)\n    apply(simp add: prefix_closure_def prefix_def lesseqDES_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def  Enforce_Nonblockingness_DES_def)\n   apply(force)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac b C' C'')(*strict*)\n   apply(simp add: FPiteratorMarked_def ifcomp_def)\n   apply(rule conjI)\n    apply(rename_tac b C' C'')(*strict*)\n    apply(simp add: FPiteratorMarked__SpecOutput_Alt_def IsDES_def FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def)\n    apply(clarsimp)\n   apply(rename_tac b C' C'')(*strict*)\n   apply(clarsimp)\n   apply(simp add: nonblockingness_language_def)\n   apply(simp add: prefix_closure_def prefix_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def  Enforce_Nonblockingness_DES_def)\n   apply(clarsimp)\n   apply(rename_tac b C' C'' x c)(*strict*)\n   apply(rule_tac\n      v=\"c\"\n      in epdaH_prefixes_of_marked_words_are_unmarked_words)\n    apply(rename_tac b C' C'' x c)(*strict*)\n    apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n   apply(rename_tac b C' C'' x c)(*strict*)\n   apply(force)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac b C' C'')(*strict*)\n   apply(rule epda_to_des_enforces_IsDES)\n   apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac b C' C'')(*strict*)\n   apply(simp add: DES_specification_satisfied_def epda_to_des_def)\n   apply(simp add: less_eq_DES_ext_def lesseqDES_def less_DES_ext_def lessDES_def FPiteratorMarked__SpecOutput_Alt_def IsDES_def FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def nonblockingness_language_def)\n   apply(clarsimp)\n   apply(force)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac b C' C'')(*strict*)\n   apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def)\n   apply(simp add: less_eq_DES_ext_def lesseqDES_def less_DES_ext_def lessDES_def FPiteratorMarked__SpecOutput_Alt_def IsDES_def FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def nonblockingness_language_def)\n   apply(clarsimp)\n   apply(simp add: FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_eq_DES_ext_def lesseqDES_def nonblockingness_language_def DES_nonblockingness_def)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac b C' C'')(*strict*)\n   apply(simp add: IsDES_def FPiteratorMarked__SpecInput_def F_DPDA_DFA_CC__fp_one__SpecInput_def F_DPDA_EC__SpecInput_def DES_specification_satisfied_def epda_to_des_def des_langUM_def des_langM_def less_DES_ext_def lessDES_def less_eq_DES_ext_def lesseqDES_def nonblockingness_language_def DES_nonblockingness_def)\n   apply(clarsimp)\n   apply(force)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(rule epdaS_to_epdaH_accessible)\n   apply(rename_tac b C' C'')(*strict*)\n   apply (metis valid_dpda_to_valid_pda PDA_to_epda)\n  apply(rename_tac b C' C'')(*strict*)\n  apply(force)\n  done\n\nend\n\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_14_02/FUNCTION__DPDA_DFA_CC__fp_one__DPDA_DFA_CONSTRUCT_CONTROLLER_FP_ONE.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056167854461, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.33119665152406835}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory ExampleSystemPolicyFlows\nimports\n  Noninterference\n  \"../access-control/ExampleSystem\"\nbegin\n\nsubsection {* Example 1 -- similar to Sys1 in ../access-control/ExampleSystem.thy *}\n\nsubsubsection {* Definitions *}\n\ndatatype Sys3Labels = UT3 | T3 | EP3 | IRQ3\n\ndefinition Sys3AuthGraph_aux :: \"Sys3Labels subject_label auth_graph\"\nwhere\n  \"Sys3AuthGraph_aux \\<equiv>\n   { (OrdinaryLabel (UT3), auth.SyncSend, OrdinaryLabel (EP3)),\n     (OrdinaryLabel (UT3), auth.Reset, OrdinaryLabel (EP3)),\n     (OrdinaryLabel (T3), auth.Receive, OrdinaryLabel (EP3)),\n     (OrdinaryLabel (T3), auth.Reset, OrdinaryLabel (EP3)) }\"\n\ndefinition Sys3AuthGraph :: \"Sys3Labels subject_label auth_graph\"\nwhere\n  \"Sys3AuthGraph \\<equiv> complete_AuthGraph Sys3AuthGraph_aux {OrdinaryLabel (T3), \n                                                         OrdinaryLabel (UT3)}\"\n\ndefinition Sys3PolicyFlows :: \"(Sys3Labels partition \\<times> Sys3Labels partition) set\"\nwhere\n  \"Sys3PolicyFlows \\<equiv>\n   { (Partition UT3, Partition UT3),\n     (Partition UT3, Partition EP3),\n     (Partition UT3, Partition T3),\n     (Partition T3, Partition T3),\n     (Partition T3, Partition UT3),\n     (Partition T3, Partition EP3),\n     (Partition EP3, Partition UT3),\n     (Partition EP3, Partition EP3),\n     (Partition EP3, Partition T3),\n     (Partition IRQ3, Partition IRQ3),\n     (PSched, Partition EP3),\n     (PSched, Partition UT3),\n     (PSched, Partition T3),\n     (PSched, Partition IRQ3),\n     (PSched, PSched) }\"\n\nsubsubsection {* Generalisations *}\n\ndefinition Sys3Reads where\n  \"Sys3Reads \\<equiv> { (OrdinaryLabel (UT3)), (OrdinaryLabel (EP3)), (OrdinaryLabel (T3)) }\"\n\ndefinition Sys3Affects where\n  \"Sys3Affects \\<equiv> { (OrdinaryLabel (UT3)), (OrdinaryLabel (EP3)), (OrdinaryLabel (T3)) }\"\n\nlemma Sys3Reads_correct_fw : \"\\<lbrakk>x \\<in> subjectReads Sys3AuthGraph (OrdinaryLabel (l)); l \\<in> {T3, UT3, EP3}\\<rbrakk> \\<Longrightarrow> x \\<in> Sys3Reads\"\n  apply (induct x rule:subjectReads.induct)\n         apply (auto simp:Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def Sys3Reads_def)\n  done\n\nlemma Sys3Affects_correct_fw : \"\\<lbrakk>x \\<in> subjectAffects Sys3AuthGraph (OrdinaryLabel (l)); l \\<in> {T3, UT3}\\<rbrakk> \\<Longrightarrow> x \\<in> Sys3Affects\"\n  apply (induct x rule:subjectAffects.induct)\n        apply (auto simp:Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def Sys3Affects_def)\n  done\n\nsubsubsection {* UT3 *}\n\nlemma Sys3UT3Reads_correct_bw : \"x \\<in> Sys3Reads \\<Longrightarrow> x \\<in> subjectReads Sys3AuthGraph (OrdinaryLabel (UT3))\"\n  apply (simp add: Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def Sys3Reads_def)\n  apply (erule disjE)\n   (* UT3 reads UT3 *)\n   apply (simp add: reads_lrefl)\n  (* UT3 reads EP3 *)\n  apply (erule disjE)\n   apply (rule_tac auth = SyncSend in reads_ep)\n    apply (simp)\n    apply (simp add:insertI1)\n  (* UT3 reads T3 *)\n  apply (rule_tac auth = SyncSend and ep = \"OrdinaryLabel (EP3)\" and a = \"OrdinaryLabel (UT3)\" in read_sync_ep_read_receivers)\n     apply (simp)\n     apply (simp)\n    apply (rule_tac auth = SyncSend in reads_ep)\n    apply (simp)\n    apply (rule insertI1)\n    apply (simp add: insertI1)\n  done\n\nlemma Sys3UT3Affects_correct_bw : \"x \\<in> Sys3Affects \\<Longrightarrow> x \\<in> subjectAffects Sys3AuthGraph (OrdinaryLabel (UT3))\"\n  apply (simp add:Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def Sys3Affects_def)\n  apply (erule disjE)\n   (* UT3 affects UT3 *)\n   apply (simp add:affects_lrefl)\n  (* UT3 affects EP3 *)\n  apply (erule disjE)\n   apply (rule_tac auth=SyncSend in affects_ep)\n    apply simp\n   apply (simp add:insertI1)\n  (* UT3 affects T3 *)\n  apply (rule_tac auth=SyncSend and l' = \"OrdinaryLabel (T3)\" and ep=\"OrdinaryLabel (EP3)\" in affects_send)\n     apply (simp_all add:insertI1)\n  done\n\nsubsubsection {* T3 *}\n\nlemma Sys3T3Reads_correct_bw : \"x \\<in> Sys3Reads \\<Longrightarrow> x \\<in> subjectReads Sys3AuthGraph (OrdinaryLabel (T3))\"\n  apply (simp add: Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def Sys3Reads_def)\n  apply (erule disjE)\n   (* T3 reads UT3 *)\n   apply (rule_tac auth = Receive and ep = \"OrdinaryLabel (EP3)\" and a = \"OrdinaryLabel (T3)\" in read_sync_ep_read_senders)\n      apply (simp)\n     apply (simp)\n    apply (rule_tac auth = Receive in reads_ep)\n     apply (simp)\n     apply (simp add:insertI1)\n   apply (simp add: insertI1)\n   (* T3 reads EP3 *)\n  apply (erule disjE)\n  apply (rule_tac auth = Receive in reads_ep)\n    apply (simp)\n    apply (simp add:insertI1)\n   (* T3 reads T3 *)\n  apply (simp add: reads_lrefl)\n  done\n\nlemma Sys3T3Affects_correct_bw : \"x \\<in> Sys3Affects \\<Longrightarrow> x \\<in> subjectAffects Sys3AuthGraph (OrdinaryLabel (T3))\"\n  apply (simp add:Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def Sys3Affects_def)\n  apply (erule disjE)\n   (* T3 affects UT3 *)\n   apply simp\n   apply (rule_tac l = \"OrdinaryLabel (T3)\" and l' = \"OrdinaryLabel (UT3)\" and ep=\"OrdinaryLabel (EP3)\" in affects_recv)\n    apply (simp_all add:insertI1)\n  (* T3 affects EP3 *)\n  apply (erule disjE)\n   apply (rule_tac auth=Receive in affects_ep)\n    apply simp\n   apply (simp add:insertI1)\n  (* T3 affects T3 *)\n  apply (simp add:affects_lrefl)\n  done\n\nsubsubsection {* EP3 *}\n\ndefinition Sys3EP3Affects :: \"(Sys3Labels subject_label) set\"\nwhere\n  \"Sys3EP3Affects \\<equiv> { OrdinaryLabel (EP3) }\"\n\nlemma Sys3EP3Reads_correct_bw : \"x \\<in> Sys3Reads \\<Longrightarrow> x \\<in> subjectReads Sys3AuthGraph (OrdinaryLabel (EP3))\"\n  apply (simp add: Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def Sys3Reads_def)\n  apply (erule disjE)\n   (* EP3 reads UT3 *)\n   apply simp\n   apply (rule_tac a = \"OrdinaryLabel (T3)\" and auth=Receive and ep = \"OrdinaryLabel (EP3)\" and b = \"OrdinaryLabel (UT3)\" in read_sync_ep_read_senders)\n      apply (simp)\n     apply (simp add:insertI1)\n    apply (simp add:reads_lrefl)\n   apply simp\n  (* EP3 reads EP3 *)\n  apply (erule disjE)\n   apply (simp add: reads_lrefl)\n  (* EP3 reads T3 *)\n  apply (rule_tac a = \"OrdinaryLabel (UT3)\" and auth = SyncSend and ep = \"OrdinaryLabel (EP3)\" and a = \"OrdinaryLabel (T3)\" in read_sync_ep_read_receivers)\n     apply (simp_all add:reads_lrefl)\n  done\n\nlemma Sys3EP3Affects_correct_fw : \"x \\<in> subjectAffects Sys3AuthGraph (OrdinaryLabel (EP3)) \\<Longrightarrow> x \\<in> Sys3EP3Affects\"\n  apply (induct x rule:subjectAffects.induct)\n        apply (auto simp:Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def Sys3EP3Affects_def)\n  done\n\nlemma Sys3EP3Affects_correct_bw : \"x \\<in> Sys3EP3Affects \\<Longrightarrow> x \\<in> subjectAffects Sys3AuthGraph (OrdinaryLabel (EP3))\"\n  by (simp add:Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def Sys3EP3Affects_def affects_lrefl)\n\nlemma Sys3EP3Affects_correct : \"subjectAffects Sys3AuthGraph (OrdinaryLabel (EP3)) = Sys3EP3Affects\"\n  apply (rule subset_antisym)\n   apply (simp_all add:subsetI Sys3EP3Affects_correct_fw Sys3EP3Affects_correct_bw)\n  done\n\nsubsubsection {* Generalisations pt2 *}\n\nlemma Sys3Reads_correct : \"l \\<in> {T3, UT3, EP3} \\<Longrightarrow> subjectReads Sys3AuthGraph (OrdinaryLabel (l)) = Sys3Reads\"\n  by (auto simp:subsetI Sys3Reads_correct_fw Sys3UT3Reads_correct_bw Sys3T3Reads_correct_bw Sys3EP3Reads_correct_bw)\n\nlemma Sys3Affects_correct : \"l \\<in> {T3, UT3} \\<Longrightarrow> subjectAffects Sys3AuthGraph (OrdinaryLabel (l)) = Sys3Affects\"\n  by (auto simp:subsetI Sys3Affects_correct_fw Sys3UT3Affects_correct_bw Sys3T3Affects_correct_bw)\n\nsubsubsection {* IRQ3 *}\n\nlemma IRQ3Reads : \" d \\<in> subjectReads Sys3AuthGraph (OrdinaryLabel (IRQ3)) \\<Longrightarrow> d = OrdinaryLabel (IRQ3)\"\n  apply (simp add: Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def)\n  apply (induct d rule: subjectReads.induct, auto)\n  done\n\nlemma IRQ3Affects : \"d \\<in> subjectAffects Sys3AuthGraph (OrdinaryLabel (IRQ3)) \\<Longrightarrow> d = OrdinaryLabel (IRQ3)\"\n  apply (simp add: Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def)\n  apply (induct d rule: subjectAffects.induct, auto)\n  done\n\nlemma IRQ3ReadsAndAffects :\n  \"\\<lbrakk> d \\<in> subjectAffects Sys3AuthGraph (OrdinaryLabel (l))\n   ; d \\<in> subjectReads Sys3AuthGraph (OrdinaryLabel (IRQ3))\n   \\<rbrakk> \\<Longrightarrow> l = IRQ3\"\n  apply (drule IRQ3Reads)\n  apply (simp add: Sys3AuthGraph_def Sys3AuthGraph_aux_def complete_AuthGraph_def)\n  apply (erule subjectAffects.cases, auto)\n  done\n\nsubsubsection {* Policy flows *}\n  \nlemma Sys3_policyFlows_correct_fw : \"(a,b) \\<in> policyFlows Sys3AuthGraph \\<Longrightarrow> (a,b) \\<in> Sys3PolicyFlows\"\n  apply (induct a b rule:policyFlows.induct)\n   apply (simp add:partsSubjectAffects_def label_can_affect_partition_def)\n   (* Partition l *)\n   apply (erule imageE)\n   apply simp\n   apply (case_tac \"x \\<in> {T3, UT3, EP3}\")\n    (* x in {T3, UT3, EP3} *)\n    apply (simp add:Sys3Reads_correct Sys3Reads_def)\n    apply (case_tac \"l \\<in> {T3, UT3}\")\n     (* l in {T3, UT3} *)\n     apply (simp add:Sys3Affects_correct Sys3Affects_def Sys3PolicyFlows_def)\n     apply (erule exE)\n     apply ((erule disjE)+, simp, simp, simp)+\n    (* l not in {T3, UT3} *)\n    apply (simp)\n    apply (case_tac l)\n    apply (simp, simp, simp)\n       apply (auto simp:Sys3PolicyFlows_def)[1]\n     apply (simp add:Sys3PolicyFlows_def)\n    apply (erule exE)\n    apply (erule conjE, drule IRQ3Affects)\n    apply (blast)\n    (* x not in {T3, UT3, EP3} *)\n    apply (case_tac x)\n    apply (simp, simp, simp, simp)\n   apply (erule exE)\n   apply (erule conjE)\n      apply (frule IRQ3ReadsAndAffects, assumption)\n   apply (simp add: Sys3PolicyFlows_def)\n   (* PSched *)\n   apply (case_tac d, simp add: Sys3PolicyFlows_def)\n  apply (rename_tac a)\n  apply (case_tac a)\n  apply (auto simp: Sys3PolicyFlows_def)\n  done\n\nlemma Sys3_policyFlows_correct_bw : \"(a,b) \\<in> Sys3PolicyFlows \\<Longrightarrow> (a,b) \\<in> policyFlows Sys3AuthGraph\"\n  apply (simp add:Sys3PolicyFlows_def)\n  (* All UT3/T3 cases *)\n  apply (erule disjE, simp, rule policy_affects, simp add: partsSubjectAffects_def label_can_affect_partition_def, rule imageI, simp add: Sys3Affects_correct Sys3Reads_correct Sys3Affects_def Sys3Reads_def, blast)+\n  (* All EP3 cases *)\n  apply (erule disjE,simp, rule policy_affects, simp add: partsSubjectAffects_def label_can_affect_partition_def, rule imageI, simp add: Sys3EP3Affects_correct Sys3Reads_correct Sys3Reads_def Sys3EP3Affects_def)+\n   (* IRQ3 case *)\n   apply (rule_tac x = \"OrdinaryLabel (IRQ3)\" in exI)\n   apply (rule conjI)\n   apply (rule affects_lrefl)\n  apply (rule reads_lrefl)\n  (* All PSched cases *)\n  apply (erule disjE, simp add: PSched_flows_to_all)+\n  apply (simp add: PSched_flows_to_all)\n  done\n\nlemma Sys3_policyFlows_correct : \"policyFlows Sys3AuthGraph = Sys3PolicyFlows\"\n  by (auto simp:Sys3_policyFlows_correct_fw Sys3_policyFlows_correct_bw)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/proof/infoflow/ExampleSystemPolicyFlows.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.689305616785446, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3311966515240683}}
{"text": "section {* Timed Designs *}\n\ntheory utp_time_designs\n  imports utp_time_rel \nbegin\n      \nnamed_theorems td_simps and tdes\n  \ntext {* We define timed designs via an embedding into reactive designs, where the pericondition\n  is simply false: an instantaneous reactive design. The healthiness condition is therefore\n  simply @{term ISRD}.  This allows us to reuse much of the infrastructure. *}\n  \ntype_synonym 's tdes = \"('s, real pos) rdes\"\n  \ndefinition time_design :: \"'s tdes \\<Rightarrow> 's tdes \\<Rightarrow> 's tdes\" (infixl \"\\<turnstile>\\<^sub>t\" 60) where\n[upred_defs]: \"time_design P Q = \\<^bold>R\\<^sub>s(P \\<turnstile> false \\<diamondop> Q)\"\n\nabbreviation time_skip :: \"'s tdes\" (\"II\\<^sub>t\") where\n\"II\\<^sub>t \\<equiv> II\\<^sub>R\"\n\ndefinition time_wait :: \"(real pos, 's) uexpr \\<Rightarrow> 's tdes\" (\"wait\\<^sub>t\") where\n[upred_defs, td_simps]: \"wait\\<^sub>t(n) = true\\<^sub>r \\<turnstile>\\<^sub>t wait\\<^sub>r(n)\"\n\nabbreviation time_pre :: \"'s tdes \\<Rightarrow> 's tdes\" (\"pre\\<^sub>t\") where\n\"pre\\<^sub>t(P) \\<equiv> pre\\<^sub>R(P)\"\n\nabbreviation time_post :: \"'s tdes \\<Rightarrow> 's tdes\" (\"post\\<^sub>t\") where\n\"post\\<^sub>t(P) \\<equiv> post\\<^sub>R(P)\"\n\nlemma pre_time_design [tdes]:\n  assumes \"P is RC\" \"Q is RR\"\n  shows \"pre\\<^sub>t(P \\<turnstile>\\<^sub>t Q) = P\"\n  by (simp add: time_design_def rdes assms closure)\n\nlemma post_time_design [tdes]:\n  assumes \"P is RC\" \"Q is RR\"\n  shows \"post\\<^sub>t(P \\<turnstile>\\<^sub>t Q) = (P \\<Rightarrow>\\<^sub>r Q)\"\n  by (simp add: time_design_def rdes assms closure)\n  \ndefinition TD :: \"'s tdes \\<Rightarrow> 's tdes\" where\n[upred_defs]: \"TD = ISRD\"\n    \nlemma TD_implies_ISRD [closure]: \"P is TD \\<Longrightarrow> P is ISRD\"\n  by (simp add: TD_def)\n\nlemma TD_elim: \"\\<lbrakk> P is TD; Q(pre\\<^sub>t(P) \\<turnstile>\\<^sub>t post\\<^sub>t(P)) \\<rbrakk> \\<Longrightarrow> Q(P)\"\n  by (simp add: TD_def time_design_def ISRD_elim)\n    \nthm RHS_tri_normal_design_composition'\n    \nlemma skip_time_design [td_simps]:\n  \"II\\<^sub>t = true\\<^sub>r \\<turnstile>\\<^sub>t II\\<^sub>r\"\n  by (simp add: rdes_def time_design_def) \n  \nlemma seq_time_design [td_simps]: \n  assumes \"P\\<^sub>1 is RC\" \"P\\<^sub>2 is RR\" \"Q\\<^sub>1 is RC\" \"Q\\<^sub>2 is RR\"\n  shows \"(P\\<^sub>1 \\<turnstile>\\<^sub>t P\\<^sub>2) ;; (Q\\<^sub>1 \\<turnstile>\\<^sub>t Q\\<^sub>2) = (P\\<^sub>1 \\<and> P\\<^sub>2 wp\\<^sub>R Q\\<^sub>1) \\<turnstile>\\<^sub>t P\\<^sub>2 ;; Q\\<^sub>2\"\n  by (simp add: time_design_def RHS_tri_normal_design_composition' assms closure unrest)\n\nlemma time_design_eq_intro: \"\\<lbrakk> P\\<^sub>1 = Q\\<^sub>1; (P\\<^sub>1 \\<Rightarrow>\\<^sub>r P\\<^sub>2) = (Q\\<^sub>1 \\<Rightarrow>\\<^sub>r Q\\<^sub>2) \\<rbrakk> \\<Longrightarrow> (P\\<^sub>1 \\<turnstile>\\<^sub>t P\\<^sub>2) = (Q\\<^sub>1 \\<turnstile>\\<^sub>t Q\\<^sub>2)\"\n  by (rel_auto, blast+)\n    \nlemma time_design_refine_intro:\n  assumes \"`P\\<^sub>1 \\<Rightarrow> Q\\<^sub>1`\" \"`P\\<^sub>1 \\<and> Q\\<^sub>2 \\<Rightarrow> P\\<^sub>2`\"\n  shows \"(P\\<^sub>1 \\<turnstile>\\<^sub>t P\\<^sub>2) \\<sqsubseteq> (Q\\<^sub>1 \\<turnstile>\\<^sub>t Q\\<^sub>2)\"\n  by (simp add: time_design_def srdes_tri_refine_intro assms)\n    \nmethod td_expand uses cls = (insert cls, (erule TD_elim)+)\n  \nmethod td_simp uses cls =\n  ((td_expand cls: cls)?, (simp add: cls td_simps closure rpred alpha usubst unrest wp prod.case_eq_if))\n\nmethod td_refine uses cls =\n  (td_simp cls: cls; rule_tac time_design_refine_intro; (insert cls; rel_simp; auto?))\n  \nmethod td_eq uses cls =\n  (td_simp cls: cls; rule_tac time_design_eq_intro; (insert cls; rel_simp; auto?))\n  \nlemma time_skip_left_unit [simp]:\n  assumes \"P is TD\"\n  shows \"II\\<^sub>t ;; P = P\"\n  by (td_simp cls: assms)\n\nlemma time_skip_right_unit [simp]:\n  assumes \"P is TD\"\n  shows \"P ;; II\\<^sub>t = P\"\n  by (td_simp cls: assms)\n\nlemma time_wait_0 [simp]: \"wait\\<^sub>t(0) = II\\<^sub>t\"\n  by (td_simp, simp add: wait_zero)\n    \nlemma time_wait_seq [simp]: \"wait\\<^sub>t(m) ;; wait\\<^sub>t(n) = wait\\<^sub>t(m + n)\"\n  by (td_simp, simp add: wait_plus)\n\ndefinition time_spec :: \"('a \\<Longrightarrow> 's) \\<Rightarrow> 's upred \\<Rightarrow> real pos \\<Rightarrow> 's upred \\<Rightarrow> real pos set \\<Rightarrow> 's tdes\" where\n[upred_defs]: \"time_spec x p t\\<^sub>0 r T = ([p]\\<^sub>S\\<^sub>< \\<and> R1(&tt <\\<^sub>u \\<guillemotleft>t\\<^sub>0\\<guillemotright>) \\<triangleleft> \\<guillemotleft>t\\<^sub>0 = 0\\<guillemotright> \\<triangleright>\\<^sub>R true\\<^sub>r) \\<turnstile>\\<^sub>t ([x:[\\<lceil>r\\<rceil>\\<^sub>>]]\\<^sub>S \\<and> R1(&tt \\<in>\\<^sub>u \\<guillemotleft>T\\<guillemotright>))\"\n    \nsyntax\n  \"_time_spec\" :: \"salpha \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_:[_, _ \\<turnstile> _, _]\\<^sub>t\" [200,0,0,0,0] 200)\n  \ntranslations\n  \"_time_spec x p t\\<^sub>0 r T\" == \"CONST time_spec x p t\\<^sub>0 r T\"\n\nlemma srd_cond_true [simp]: \"P \\<triangleleft> true \\<triangleright>\\<^sub>R Q = P\"\n  by (rel_auto)\n    \nlemma srd_cond_false [simp]: \"P \\<triangleleft> false \\<triangleright>\\<^sub>R Q = Q\"\n  by (rel_auto)\n  \nlemma tt_strict_prefix_RR [closure]: \"R1(&tt <\\<^sub>u \\<guillemotleft>v\\<guillemotright>) is RC\"\n  by (rel_auto, meson le_less_trans minus_cancel_le)\n    \nlemma tt_elem_RR [closure]: \"R1(&tt \\<in>\\<^sub>u \\<guillemotleft>T\\<guillemotright>) is RR\"\n  by (rel_auto)\n\nlemma time_spec_TD_closed: \"x:[p,t\\<^sub>0 \\<turnstile> r,T]\\<^sub>t is TD\"\n  apply (simp add: TD_def time_spec_def time_design_def)\n  apply (case_tac \"t\\<^sub>0 = 0\")\n  apply (simp_all add: true_alt_def[THEN sym] false_alt_def[THEN sym] closure unrest rdes)\ndone\n\ndefinition hoare_time :: \"'s upred \\<Rightarrow> real pos \\<Rightarrow> 's tdes \\<Rightarrow> 's upred \\<Rightarrow> real pos set \\<Rightarrow> bool\" where\n[td_simps]: \"hoare_time p t\\<^sub>0 Q r T = (\\<Sigma>:[p,t\\<^sub>0 \\<turnstile> r,T]\\<^sub>t \\<sqsubseteq> Q)\"\n\nsyntax\n  \"_time_var\" :: \"logic\"\n  \"_hoare_time\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"\\<lbrace>_\\<rbrace>/ _/ \\<lbrace>_\\<rbrace>\\<^sub>t\")\n  \nparse_translation {*\nlet\n  fun time_var_tr [] = Syntax.free \"ti\"\n    | time_var_tr _  = raise Match;\nin\n[(@{syntax_const \"_time_var\"}, K time_var_tr)]\nend\n*}\n  \ntranslations\n  \"_hoare_time p Q r\" => \"CONST hoare_time p Q (\\<lambda> _time_var. r)\"    \n    \nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/utp_time_designs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011397337391, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3311780900536605}}
{"text": "theory Labeled_Graphs\n  imports TA_Library.Graphs \\<^cancel>\\<open>\"Transition_Systems_and_Automata.Sequence_LTL\"\\<close>\nbegin\n\nlocale Graph_Defs =\n  fixes E :: \"'a \\<Rightarrow> 'l \\<Rightarrow> 'a \\<Rightarrow> bool\"\nbegin\n\nabbreviation \"E\\<^sub>u \\<equiv> \\<lambda>a b. \\<exists> l. E a l b\"\n\nsublocale UL: Graphs.Graph_Defs E\\<^sub>u .\n\nend\n\nlocale Simulation_Defs =\n  fixes A :: \"'a \\<Rightarrow> 'l \\<Rightarrow> 'a \\<Rightarrow> bool\" and B :: \"'b \\<Rightarrow> 'l \\<Rightarrow> 'b \\<Rightarrow> bool\"\n    and sim :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (infixr \"\\<sim>\" 60)\nbegin\n\nsublocale A: Graph_Defs A .\n\nsublocale B: Graph_Defs B .\n\nsublocale UL: Graphs.Simulation_Defs A.E\\<^sub>u B.E\\<^sub>u sim .\n\nend\n\nlocale Simulation = Simulation_Defs +\n  assumes A_B_step: \"\\<And> l a b a'. A a l b \\<Longrightarrow> a \\<sim> a' \\<Longrightarrow> (\\<exists> b'. B a' l b' \\<and> b \\<sim> b')\"\nbegin\n\n\\<^cancel>\\<open>lemma simulation_reaches:\n  \"\\<exists> b'. B\\<^sup>*\\<^sup>* b l b' \\<and> a' \\<sim> b'\" if \"A\\<^sup>*\\<^sup>* a l a'\" \"a \\<sim> b\"\n  using that by (induction rule: rtranclp_induct) (auto intro: rtranclp.intros(2) dest: A_B_step)\n\nlemma simulation_reaches1:\n  \"\\<exists> b'. B\\<^sup>+\\<^sup>+ b b' \\<and> a' \\<sim> b'\" if \"A\\<^sup>+\\<^sup>+ a a'\" \"a \\<sim> b\"\n  using that by (induction rule: tranclp_induct) (auto 4 3 intro: tranclp.intros(2) dest: A_B_step)\n\nlemma simulation_steps:\n  \"\\<exists> bs. B.steps (b # bs) \\<and> list_all2 (\\<lambda> a b. a \\<sim> b) as bs\" if \"A.steps (a # as)\" \"a \\<sim> b\"\n  using that\n  apply (induction \"a # as\" arbitrary: a b as)\n   apply force\n  apply (frule A_B_step, auto)\n  done\n\nlemma simulation_run:\n  \"\\<exists> ys. B.run (y ## ys) \\<and> stream_all2 (\\<sim>) xs ys\" if \"A.run (x ## xs)\" \"x \\<sim> y\"\nproof -\n  let ?ys = \"sscan (\\<lambda> a' b. SOME b'. B b b' \\<and> a' \\<sim> b') xs y\"\n  have \"B.run (y ## ?ys)\"\n    using that by (coinduction arbitrary: x y xs) (force dest!: someI_ex A_B_step elim: A.run.cases)\n  moreover have \"stream_all2 (\\<sim>) xs ?ys\"\n    using that by (coinduction arbitrary: x y xs) (force dest!: someI_ex A_B_step elim: A.run.cases)\n  ultimately show ?thesis by blast\nqed\\<close>\n\nsublocale UL: Graphs.Simulation A.E\\<^sub>u B.E\\<^sub>u sim\n  by standard (blast dest: A_B_step)\n\nend (* Simulation *)\n\nlocale Graph_Invariant = Graph_Defs +\n  fixes P :: \"'a \\<Rightarrow> bool\"\n  assumes invariant: \"P a \\<Longrightarrow> E a l b \\<Longrightarrow> P b\"\nbegin\n\nsublocale UL: Graphs.Graph_Invariant E\\<^sub>u\n  by standard (blast dest: invariant)\n\n\\<^cancel>\\<open>lemma invariant_steps:\n  \"list_all P as\" if \"steps (a # as)\" \"P a\"\n  using that by (induction \"a # as\" arbitrary: as a) (auto intro: invariant)\n\nlemma invariant_reaches:\n  \"P b\" if \"a \\<rightarrow>* b\" \"P a\"\n  using that by (induction; blast intro: invariant)\n\nlemma invariant_run:\n  assumes run: \"run (x ## xs)\" and P: \"P x\"\n  shows \"pred_stream P (x ## xs)\"\n  using run P by (coinduction arbitrary: x xs) (auto 4 3 elim: invariant run.cases)\n\ntext \\<open>Every graph invariant induces a subgraph.\\<close>\nsublocale Subgraph_Node_Defs where E = E and V = P .\n\nlemma subgraph':\n  assumes \"x \\<rightarrow> y\" \"P x\"\n  shows \"E' x y\"\n  using assms by (intro subgraph') (auto intro: invariant)\n\nlemma invariant_steps_iff:\n  \"G'.steps (v # vs) \\<longleftrightarrow> steps (v # vs)\" if \"P v\"\n  apply (rule iffI)\n  subgoal\n    using G'.steps_alt_induct steps_appendI by blast\n  subgoal premises prems\n    using prems \\<open>P v\\<close> by (induction \"v # vs\" arbitrary: v vs) (auto intro: subgraph' invariant)\n  done\n\nlemma invariant_reaches_iff:\n  \"G'.reaches u v \\<longleftrightarrow> reaches u v\" if \"P u\"\n  using that by (simp add: reaches_steps_iff2 G'.reaches_steps_iff2 invariant_steps_iff)\n\nlemma invariant_reaches1_iff:\n  \"G'.reaches1 u v \\<longleftrightarrow> reaches1 u v\" if \"P u\"\n  using that by (simp add: reaches1_steps_iff G'.reaches1_steps_iff invariant_steps_iff)\\<close>\n\nend (* Graph Invariant *)\n\nlocale Graph_Invariants = Graph_Defs +\n  fixes P Q :: \"'a \\<Rightarrow> bool\"\n  assumes invariant: \"P a \\<Longrightarrow> E a l b \\<Longrightarrow> Q b\" and Q_P: \"Q a \\<Longrightarrow> P a\"\nbegin\n\nsublocale Pre: Graph_Invariant E P\n  by standard (blast intro: invariant Q_P)\n\nsublocale Post: Graph_Invariant E Q\n  by standard (blast intro: invariant Q_P)\n\n\\<^cancel>\\<open>\nlemma invariant_steps:\n  \"list_all Q as\" if \"steps (a # as)\" \"P a\"\n  using that by (induction \"a # as\" arbitrary: as a) (auto intro: invariant Q_P)\n\nlemma invariant_run:\n  assumes run: \"run (x ## xs)\" and P: \"P x\"\n  shows \"pred_stream Q xs\"\n  using run P by (coinduction arbitrary: x xs) (auto 4 4 elim: invariant run.cases intro: Q_P)\n\nlemma invariant_reaches1:\n  \"Q b\" if \"a \\<rightarrow>\\<^sup>+ b\" \"P a\"\n  using that by (induction; blast intro: invariant Q_P)\\<close>\n\nend (* Graph Invariants *)\n\nlocale Simulation_Invariant = Simulation_Defs A B sim\n  for A :: \"'a \\<Rightarrow> 'l \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  and B :: \"'b \\<Rightarrow> 'l \\<Rightarrow> 'b \\<Rightarrow> bool\"\n  and sim :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (infixr \"\\<sim>\" 60) +\n  fixes PA :: \"'a \\<Rightarrow> bool\" and PB :: \"'b \\<Rightarrow> bool\"\n  assumes A_B_step:\n    \"\\<And> l a b a'. A a l b \\<Longrightarrow> PA a \\<Longrightarrow> PB a' \\<Longrightarrow> a \\<sim> a' \\<Longrightarrow> (\\<exists>b'. B a' l b' \\<and> b \\<sim> b')\"\n  assumes A_invariant[intro]: \"\\<And> l a b. PA a \\<Longrightarrow> A a l b \\<Longrightarrow> PA b\"\n  assumes B_invariant[intro]: \"\\<And> l a b. PB a \\<Longrightarrow> B a l b \\<Longrightarrow> PB b\"\nbegin\n\ndefinition \"equiv' \\<equiv> \\<lambda> a b. a \\<sim> b \\<and> PA a \\<and> PB b\"\n\nsublocale Simulation A B equiv' by standard (auto dest: A_B_step simp: equiv'_def)\n\nsublocale PA_invariant: Graph_Invariant A PA by standard blast\n\nsublocale PB_invariant: Graph_Invariant B PB by standard blast\n\n\\<^cancel>\\<open>lemma simulation_reaches:\n  \"\\<exists> b'. B\\<^sup>*\\<^sup>* b b' \\<and> a' \\<sim> b' \\<and> PA a' \\<and> PB b'\" if \"A\\<^sup>*\\<^sup>* a a'\" \"a \\<sim> b\" \"PA a\" \"PB b\"\n  using simulation_reaches[of a a' b] that unfolding equiv'_def by simp\n\nlemma simulation_steps:\n  \"\\<exists> bs. B.steps (b # bs) \\<and> list_all2 (\\<lambda> a b. a \\<sim> b \\<and> PA a \\<and> PB b) as bs\"\n  if \"A.steps (a # as)\" \"a \\<sim> b\" \"PA a\" \"PB b\"\n  using simulation_steps[of a as b] that unfolding equiv'_def by simp\n\nlemma simulation_steps':\n  \"\\<exists> bs. B.steps (b # bs) \\<and> list_all2 (\\<lambda> a b. a \\<sim> b) as bs \\<and> list_all PA as \\<and> list_all PB bs\"\n  if \"A.steps (a # as)\" \"a \\<sim> b\" \"PA a\" \"PB b\"\n  using simulation_steps[OF that]\n  by (force dest: list_all2_set1 list_all2_set2 simp: list_all_iff elim: list_all2_mono)\n\ncontext\n  fixes f\n  assumes eq: \"a \\<sim> b \\<Longrightarrow> b = f a\"\nbegin\n\nlemma simulation_steps'_map:\n  \"\\<exists> bs.\n    B.steps (b # bs) \\<and> bs = map f as\n    \\<and> list_all2 (\\<lambda> a b. a \\<sim> b) as bs\n    \\<and> list_all PA as \\<and> list_all PB bs\"\n  if \"A.steps (a # as)\" \"a \\<sim> b\" \"PA a\" \"PB b\"\nproof -\n  from simulation_steps'[OF that] obtain bs where guessed:\n    \"B.steps (b # bs)\"\n    \"list_all2 (\\<sim>) as bs\"\n    \"list_all PA as\"\n    \"list_all PB bs\"\n    by safe\n  from this(2) have \"bs = map f as\"\n    by (induction; simp add: eq)\n  with guessed show ?thesis\n    by auto\nqed\\<close>\n\n\\<^cancel>\\<open>end (* Context for Equality Relation *)\\<close>\n\nend (* Simulation Invariant *)\n\nlocale Simulation_Invariants = Simulation_Defs A B sim\n  for A :: \"'a \\<Rightarrow> 'l \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  and B :: \"'b \\<Rightarrow> 'l \\<Rightarrow> 'b \\<Rightarrow> bool\"\n  and sim :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (infixr \"\\<sim>\" 60) +\n  fixes PA QA :: \"'a \\<Rightarrow> bool\" and PB QB :: \"'b \\<Rightarrow> bool\"\n  assumes A_B_step:\n    \"\\<And> a b l a'. A a l b \\<Longrightarrow> PA a \\<Longrightarrow> PB a' \\<Longrightarrow> a \\<sim> a' \\<Longrightarrow> (\\<exists> b'. B a' l b' \\<and> b \\<sim> b')\"\n  assumes A_invariant[intro]: \"\\<And> a b. PA a \\<Longrightarrow> A a l b \\<Longrightarrow> QA b\"\n  assumes B_invariant[intro]: \"\\<And> a b. PB a \\<Longrightarrow> B a l b \\<Longrightarrow> QB b\"\n  assumes PA_QA[intro]: \"\\<And> a. QA a \\<Longrightarrow> PA a\" and PB_QB[intro]: \"\\<And> a. QB a \\<Longrightarrow> PB a\"\nbegin\nprint_locale Simulation_Invariant\nsublocale Pre: Simulation_Invariant A B \"(\\<sim>)\" PA PB\n  by standard (auto intro: A_B_step)\n\nsublocale Post: Simulation_Invariant A B \"(\\<sim>)\" QA QB\n  by standard (auto intro: A_B_step)\n\nsublocale A_invs: Graph_Invariants A PA QA\n  by standard auto\n\nsublocale B_invs: Graph_Invariants B PB QB\n  by standard auto\n\n\\<^cancel>\\<open>lemma simulation_reaches1:\n  \"\\<exists> b2. B.reaches1 b1 b2 \\<and> a2 \\<sim> b2 \\<and> QB b2\" if \"A.reaches1 a1 a2\" \"a1 \\<sim> b1\" \"PA a1\" \"PB b1\"\n  using that\n  by - (drule Pre.simulation_reaches1, auto intro: B_invs.invariant_reaches1 simp: Pre.equiv'_def)\n\nlemma reaches1_unique:\n  assumes unique: \"\\<And> b2. a \\<sim> b2 \\<Longrightarrow> QB b2 \\<Longrightarrow> b2 = b\"\n    and that: \"A.reaches1 a a\" \"a \\<sim> b\" \"PA a\" \"PB b\"\n  shows \"B.reaches1 b b\"\n  using that by (auto dest: unique simulation_reaches1)\\<close>\n\nend (* Simualation Invariants *)\n\nlocale Bisimulation = Simulation_Defs +\n  assumes A_B_step: \"\\<And> l a b a'. A a l b \\<Longrightarrow> a \\<sim> a' \\<Longrightarrow> (\\<exists> b'. B a' l b' \\<and> b \\<sim> b')\"\n  assumes B_A_step: \"\\<And> l a a' b'. B a' l b' \\<Longrightarrow> a \\<sim> a' \\<Longrightarrow> (\\<exists> b. A a l b \\<and> b \\<sim> b')\"\nbegin\n\nsublocale A_B: Simulation A B \"(\\<sim>)\" by standard (rule A_B_step)\n\nsublocale B_A: Simulation B A \"\\<lambda> x y. y \\<sim> x\" by standard (rule B_A_step)\n\n\\<^cancel>\\<open>lemma A_B_reaches:\n  \"\\<exists> b'. B\\<^sup>*\\<^sup>* b b' \\<and> a' \\<sim> b'\" if \"A\\<^sup>*\\<^sup>* a a'\" \"a \\<sim> b\"\n  using A_B.simulation_reaches[OF that] .\n\nlemma B_A_reaches:\n  \"\\<exists> b'. A\\<^sup>*\\<^sup>* b b' \\<and> b' \\<sim> a'\" if \"B\\<^sup>*\\<^sup>* a a'\" \"b \\<sim> a\"\n  using B_A.simulation_reaches[OF that] .\\<close>\n\nend (* Bisim *)\n\nlocale Bisimulation_Invariant = Simulation_Defs A B sim\n  for A :: \"'a \\<Rightarrow> 'l \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  and B :: \"'b \\<Rightarrow> 'l \\<Rightarrow> 'b \\<Rightarrow> bool\"\n  and sim :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (infixr \"\\<sim>\" 60) +\n  fixes PA :: \"'a \\<Rightarrow> bool\" and PB :: \"'b \\<Rightarrow> bool\"\n  assumes A_B_step: \"\\<And> l a b a'. A a l b \\<Longrightarrow> a \\<sim> a' \\<Longrightarrow> PA a \\<Longrightarrow> PB a' \\<Longrightarrow> (\\<exists> b'. B a' l b' \\<and> b \\<sim> b')\"\n  assumes B_A_step: \"\\<And> l a a' b'. B a' l b' \\<Longrightarrow> a \\<sim> a' \\<Longrightarrow> PA a \\<Longrightarrow> PB a' \\<Longrightarrow> (\\<exists> b. A a l b \\<and> b \\<sim> b')\"\n  assumes A_invariant[intro]: \"\\<And> l a b. PA a \\<Longrightarrow> A a l b \\<Longrightarrow> PA b\"\n  assumes B_invariant[intro]: \"\\<And> l a b. PB a \\<Longrightarrow> B a l b \\<Longrightarrow> PB b\"\nbegin\n\nsublocale PA_invariant: Graph_Invariant A PA by standard blast\n\nsublocale PB_invariant: Graph_Invariant B PB by standard blast\n\n\\<^cancel>\\<open>lemmas B_steps_invariant[intro] = PB_invariant.invariant_reaches\\<close>\n\ndefinition \"equiv' \\<equiv> \\<lambda> a b. a \\<sim> b \\<and> PA a \\<and> PB b\"\n\nsublocale bisim: Bisimulation A B equiv'\n  by standard (clarsimp simp add: equiv'_def, frule A_B_step B_A_step, assumption; auto)+\n\nsublocale A_B: Simulation_Invariant A B \"(\\<sim>)\" PA PB\n  by (standard; blast intro: A_B_step B_A_step)\n\nsublocale B_A: Simulation_Invariant B A \"\\<lambda> x y. y \\<sim> x\" PB PA\n  by (standard; blast intro: A_B_step B_A_step)\n\n\\<^cancel>\\<open>context\n  fixes f\n  assumes eq: \"a \\<sim> b \\<longleftrightarrow> b = f a\"\n    and inj: \"\\<forall> a b. PB (f a) \\<and> PA b \\<and> f a = f b \\<longrightarrow> a = b\"\nbegin\n\nlemma list_all2_inj_map_eq:\n  \"as = bs\" if \"list_all2 (\\<lambda>a b. a = f b) (map f as) bs\" \"list_all PB (map f as)\" \"list_all PA bs\"\n  using that inj\n  by (induction \"map f as\" bs arbitrary: as rule: list_all2_induct) (auto simp: inj_on_def)\n\nlemma steps_map_equiv:\n  \"A.steps (a # as) \\<longleftrightarrow> B.steps (b # map f as)\" if \"a \\<sim> b\" \"PA a\" \"PB b\"\n  using A_B.simulation_steps'_map[of f a as b] B_A.simulation_steps'[of b \"map f as\" a] that eq\n  by (auto dest: list_all2_inj_map_eq)\n\nlemma steps_map:\n  \"\\<exists> as. bs = map f as\" if \"B.steps (f a # bs)\" \"PA a\" \"PB (f a)\"\nproof -\n  have \"a \\<sim> f a\" unfolding eq ..\n  from B_A.simulation_steps'[OF that(1) this \\<open>PB _\\<close> \\<open>PA _\\<close>] obtain as where\n    \"A.steps (a # as)\"\n    \"list_all2 (\\<lambda>a b. b \\<sim> a) bs as\"\n    \"list_all PB bs\"\n    \"list_all PA as\"\n    by safe\n  from this(2) show ?thesis\n    unfolding eq by (inst_existentials as, induction rule: list_all2_induct, auto)\nqed\n\nlemma reaches_equiv:\n  \"A.reaches a a' \\<longleftrightarrow> B.reaches (f a) (f a')\" if \"PA a\" \"PB (f a)\"\n  apply safe\n   apply (drule A_B.simulation_reaches[of a a' \"f a\"]; simp add: eq that)\n  apply (drule B_A.simulation_reaches)\n     defer\n     apply (rule that | clarsimp simp: eq | metis inj)+\n  done\n\nend (* Context for Equality Relation *)\\<close>\n\nlemma equiv'_D:\n  \"a \\<sim> b\" if \"A_B.equiv' a b\"\n  using that unfolding A_B.equiv'_def by auto\n\nlemma equiv'_rotate_1:\n  \"B_A.equiv' b a\" if \"A_B.equiv' a b\"\n  using that by (auto simp: B_A.equiv'_def A_B.equiv'_def)\n\nlemma equiv'_rotate_2:\n  \"A_B.equiv' a b\" if \"B_A.equiv' b a\"\n  using that by (auto simp: B_A.equiv'_def A_B.equiv'_def)\n\nlemma stream_all2_equiv'_D:\n  \"stream_all2 (\\<sim>) xs ys\" if \"stream_all2 A_B.equiv' xs ys\"\n  using stream_all2_weaken[OF that equiv'_D] by fast\n\nlemma stream_all2_equiv'_D2:\n  \"stream_all2 B_A.equiv' ys xs \\<Longrightarrow> stream_all2 ((\\<sim>)\\<inverse>\\<inverse>) ys xs\"\n  by (coinduction arbitrary: xs ys) (auto simp: B_A.equiv'_def)\n\nlemma stream_all2_rotate_1:\n  \"stream_all2 B_A.equiv' ys xs \\<Longrightarrow> stream_all2 A_B.equiv' xs ys\"\n  by (coinduction arbitrary: xs ys) (auto simp: B_A.equiv'_def A_B.equiv'_def)\n\nlemma stream_all2_rotate_2:\n  \"stream_all2 A_B.equiv' xs ys \\<Longrightarrow> stream_all2 B_A.equiv' ys xs\"\n  by (coinduction arbitrary: xs ys) (auto simp: B_A.equiv'_def A_B.equiv'_def)\n\nend (* Bisim Invariant *)\n\nlemma Bisimulation_Invariant_composition:\n  assumes\n    \"Bisimulation_Invariant A B sim1 PA PB\"\n    \"Bisimulation_Invariant B C sim2 PB PC\"\n  shows\n    \"Bisimulation_Invariant A C (\\<lambda> a c. \\<exists> b. PB b \\<and> sim1 a b \\<and> sim2 b c) PA PC\"\nproof -\n  interpret A: Bisimulation_Invariant A B sim1 PA PB\n    by (rule assms(1))\n  interpret B: Bisimulation_Invariant B C sim2 PB PC\n    by (rule assms(2))\n  show ?thesis\n    by (standard; (blast dest: A.A_B_step B.A_B_step | blast dest: A.B_A_step B.B_A_step))\nqed\n\nlemma Bisimulation_Invariant_filter:\n  assumes\n    \"Bisimulation_Invariant A B sim PA PB\"\n    \"\\<And> l a b. sim a b \\<Longrightarrow> PA a \\<Longrightarrow> PB b \\<Longrightarrow> FA a \\<longleftrightarrow> FB b\"\n    \"\\<And> l a b. A a l b \\<and> FA b \\<longleftrightarrow> A' a l b\"\n    \"\\<And> l a b. B a l b \\<and> FB b \\<longleftrightarrow> B' a l b\"\n  shows\n    \"Bisimulation_Invariant A' B' sim PA PB\"\nproof -\n  interpret Bisimulation_Invariant A B sim PA PB\n    by (rule assms(1))\n  have unfold:\n    \"A' = (\\<lambda> a l b. A a l b \\<and> FA b)\" \"B' = (\\<lambda> a l b. B a l b \\<and> FB b)\"\n    using assms(3,4) by auto\n  show ?thesis\n    unfolding unfold\n    apply standard\n    using assms(2) apply (blast dest: A_B_step)\n    using assms(2) apply (blast dest: B_A_step)\n    by blast+\nqed\n\n\nlemma Bisimulation_Invariant_strengthen_post:\n  assumes\n    \"Bisimulation_Invariant A B sim PA PB\"\n    \"\\<And> l a b. PA' a \\<Longrightarrow> PA b \\<Longrightarrow> A a l b \\<Longrightarrow> PA' b\"\n    \"\\<And> a. PA' a \\<Longrightarrow> PA a\"\n  shows \"Bisimulation_Invariant A B sim PA' PB\"\nproof -\n  interpret Bisimulation_Invariant A B sim PA PB\n    by (rule assms)\n  show ?thesis\n    by (standard; blast intro: A_B_step B_A_step assms)\nqed\n\nlemma Bisimulation_Invariant_strengthen_post':\n  assumes\n    \"Bisimulation_Invariant A B sim PA PB\"\n    \"\\<And> l a b. PB' a \\<Longrightarrow> PB b \\<Longrightarrow> B a l b \\<Longrightarrow> PB' b\"\n    \"\\<And> a. PB' a \\<Longrightarrow> PB a\"\n  shows \"Bisimulation_Invariant A B sim PA PB'\"\nproof -\n  interpret Bisimulation_Invariant A B sim PA PB\n    by (rule assms)\n  show ?thesis\n    by (standard; blast intro: A_B_step B_A_step assms)\nqed\n\nlemma Simulation_Invariant_strengthen_post:\n  assumes\n    \"Simulation_Invariant A B sim PA PB\"\n    \"\\<And> l a b. PA a \\<Longrightarrow> PA b \\<Longrightarrow> A a l b \\<Longrightarrow> PA' b\"\n    \"\\<And> a. PA' a \\<Longrightarrow> PA a\"\n  shows \"Simulation_Invariant A B sim PA' PB\"\nproof -\n  interpret Simulation_Invariant A B sim PA PB\n    by (rule assms)\n  show ?thesis\n    by (standard; blast intro: A_B_step assms)\nqed\n\nlemma Simulation_Invariant_strengthen_post':\n  assumes\n    \"Simulation_Invariant A B sim PA PB\"\n    \"\\<And> l a b. PB a \\<Longrightarrow> PB b \\<Longrightarrow> B a l b \\<Longrightarrow> PB' b\"\n    \"\\<And> a. PB' a \\<Longrightarrow> PB a\"\n  shows \"Simulation_Invariant A B sim PA PB'\"\nproof -\n  interpret Simulation_Invariant A B sim PA PB\n    by (rule assms)\n  show ?thesis\n    by (standard; blast intro: A_B_step assms)\nqed\n\nlemma Simulation_Invariants_strengthen_post:\n  assumes\n    \"Simulation_Invariants A B sim PA QA PB QB\"\n    \"\\<And> l a b. PA a \\<Longrightarrow> QA b \\<Longrightarrow> A a l b \\<Longrightarrow> QA' b\"\n    \"\\<And> a. QA' a \\<Longrightarrow> QA a\"\n  shows \"Simulation_Invariants A B sim PA QA' PB QB\"\nproof -\n  interpret Simulation_Invariants A B sim PA QA PB QB\n    by (rule assms)\n  show ?thesis\n    by (standard; blast intro: A_B_step assms)\nqed\n\n\n\nlemma Bisimulation_Invariant_sim_replace:\n  assumes \"Bisimulation_Invariant A B sim PA PB\"\n      and \"\\<And> a b. PA a \\<Longrightarrow> PB b \\<Longrightarrow> sim a b \\<longleftrightarrow> sim' a b\"\n    shows \"Bisimulation_Invariant A B sim' PA PB\"\nproof -\n  interpret Bisimulation_Invariant A B sim PA PB\n    by (rule assms(1))\n  from assms(2) show ?thesis\n    apply unfold_locales\n    using assms(2) apply (blast dest: A_B_step)\n    using assms(2) apply (blast dest: B_A_step)\n    by blast+\nqed\n\nlemma (in Bisimulation) Bisimulation_Bisimulation_Invariant:\n  shows \"Bisimulation_Invariant A B sim (\\<lambda>_. True) (\\<lambda>_. True)\"\n  by standard (auto intro: A_B_step B_A_step)\n\nlemma Simulation_Invariant_composition:\n  assumes\n    \"Simulation_Invariant A B sim1 PA PB\"\n    \"Simulation_Invariant B C sim2 PB PC\"\n  shows\n    \"Simulation_Invariant A C (\\<lambda> a c. \\<exists> b. PB b \\<and> sim1 a b \\<and> sim2 b c) PA PC\"\nproof -\n  interpret A: Simulation_Invariant A B sim1 PA PB\n    by (rule assms(1))\n  interpret B: Simulation_Invariant B C sim2 PB PC\n    by (rule assms(2))\n  show ?thesis\n    by (standard; (blast dest: A.A_B_step B.A_B_step))\nqed\n\nlemma (in Simulation) Simulation_Invariant:\n  \"Simulation_Invariant A B sim (\\<lambda>_. True) (\\<lambda>_. True)\"\n  by unfold_locales (rule A_B_step)\n\nlemma Simulation_Invariant_sim_replace:\n  assumes \"Simulation_Invariant A B sim PA PB\"\n      and \"\\<And> a b. PA a \\<Longrightarrow> PB b \\<Longrightarrow> sim a b \\<longleftrightarrow> sim' a b\"\n    shows \"Simulation_Invariant A B sim' PA PB\"\nproof -\n  interpret Simulation_Invariant A B sim PA PB\n    by (rule assms(1))\n  from assms(2) show ?thesis\n    by (unfold_locales; blast dest: A_B_step)\nqed\n\nend", "meta": {"author": "wimmers", "repo": "munta-games", "sha": "12da82b74f595c33278aeac82b58cbfbfd2fd6a3", "save_path": "github-repos/isabelle/wimmers-munta-games", "path": "github-repos/isabelle/wimmers-munta-games/munta-games-12da82b74f595c33278aeac82b58cbfbfd2fd6a3/Labeled_Graphs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011397337391, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3311780900536605}}
{"text": "header {* \\isaheader{Dynamic Weak Control Dependence} *}\n\ntheory DynWeakControlDependence imports Postdomination begin\n\ncontext StrongPostdomination begin\n\ndefinition\n  dyn_weak_control_dependence :: \"'node \\<Rightarrow> 'node \\<Rightarrow> 'edge list \\<Rightarrow> bool\" \n  (\"_ weakly controls _ via _\" [51,0,0])\nwhere dyn_weak_control_dependence_def:\"n weakly controls n' via as \\<equiv> \n    (\\<exists>a a' as'. (as = a#as') \\<and> (n' \\<notin> set(sourcenodes as)) \\<and> (n -as\\<rightarrow>* n') \\<and>\n                   (n' strongly-postdominates (targetnode a)) \\<and>\n                   (valid_edge a') \\<and> (sourcenode a' = n) \\<and> \n                   (\\<not> n' strongly-postdominates (targetnode a')))\"\n\n\nlemma Exit_not_dyn_weak_control_dependent:\n  assumes control:\"n weakly controls (_Exit_) via as\" shows \"False\"\nproof -\n  from control obtain as a as' where path:\"n -as\\<rightarrow>* (_Exit_)\" and as:\"as = a#as'\"\n    and pd:\"(_Exit_) postdominates (targetnode a)\"\n    by(auto simp:dyn_weak_control_dependence_def strong_postdominate_def)\n  from path as have \"n -[]@a#as'\\<rightarrow>* (_Exit_)\" by simp\n  hence \"valid_edge a\" by(fastforce dest:path_split)\n  with pd show False by -(rule Exit_no_postdominator,auto)\nqed\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/Basic/DynWeakControlDependence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7122321720225278, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.33111785595595467}}
{"text": "theory ProcStrongNorm\nimports Main\nbegin\n\ntext {*\nBased on HOL/Proofs/Lambda/StrongNorm, \na formalization by Stefan Berghofer. \n*}\n\ndeclare [[syntax_ambiguity_warning = false]]\n\nsubsection {* Lambda-terms in de Bruijn notation and substitution *}\n\n(*\ndatatype program_rep =\n  Assign variable_untyped expression_untyped\n| Sample variable_untyped expression_distr\n| Seq program_rep program_rep\n| Skip\n| IfTE expression_untyped program_rep program_rep\n| While expression_untyped program_rep\n| CallProc variable_untyped procedure_rep \"expression_untyped list\"\nand procedure_rep =\n  Proc program_rep \"variable_untyped list\" expression_untyped\n| ProcRef nat (* deBruijn index *)\n| ProcAbs procedure_rep\n| ProcAppl procedure_rep procedure_rep\n*)\n\ntypedecl tmp\n\ndatatype program_rep =\n  Skip\n| CallProc tmp procedure_rep tmp\nand procedure_rep =\n    Proc program_rep tmp tmp\n  | ProcRef nat\n  | ProcAppl procedure_rep procedure_rep (infixl \"\\<degree>\" 200)\n  | ProcAbs procedure_rep\n\ntype_synonym dB = procedure_rep\nabbreviation \"Var == ProcRef\"\nabbreviation \"App == ProcAppl\"\nabbreviation \"Abs == ProcAbs\"\n\nprimrec\n  lift' :: \"[program_rep, nat] => program_rep\" and\n  lift :: \"[dB, nat] => dB\"\nwhere\n    \"lift (Var i) k = (if i < k then Var i else Var (i + 1))\"\n  | \"lift (s \\<degree> t) k = lift s k \\<degree> lift t k\"\n  | \"lift (Abs s) k = Abs (lift s (k + 1))\"\n  | \"lift (Proc body a r) k = Proc (lift' body k) a r\"\n  | \"lift' Skip k = Skip\"\n  | \"lift' (CallProc x p y) k = CallProc x (lift p k) y\"\n\nprimrec\n  subst' :: \"[program_rep, dB, nat] => program_rep\"  (\"_[_'/''_]\" [300, 0, 0] 300) and\n  subst :: \"[dB, dB, nat] => dB\"  (\"_[_'/_]\" [300, 0, 0] 300)\nwhere (* FIXME base names *)\n    subst_Var: \"(Var i)[s/k] =\n      (if k < i then Var (i - 1) else if i = k then s else Var i)\"\n  | subst_App: \"(t \\<degree> u)[s/k] = t[s/k] \\<degree> u[s/k]\"\n  | subst_Abs: \"(Abs t)[s/k] = Abs (t[lift s 0 / k+1])\"\n  | subst_Proc: \"(Proc body x y)[s/k] = Proc (body[s/'k]) x y\"\n  | subst_Skip: \"Skip[s/'k] = Skip\"\n  | subst_CallProc: \"(CallProc x p y)[s/'k] = CallProc x (p[s/k]) y\"\n\ndeclare subst_Var [simp del]\n\ntext {* Optimized versions of @{term subst} and @{term lift}. *}\n\nprimrec\n  liftn' :: \"[nat, program_rep, nat] => program_rep\" and\n  liftn :: \"[nat, dB, nat] => dB\"\nwhere\n    \"liftn n (Var i) k = (if i < k then Var i else Var (i + n))\"\n  | \"liftn n (s \\<degree> t) k = liftn n s k \\<degree> liftn n t k\"\n  | \"liftn n (Abs s) k = Abs (liftn n s (k + 1))\"\n  | \"liftn n (Proc body x y) k = Proc (liftn' n body k) x y\"\n  | \"liftn' n Skip k = Skip\"\n  | \"liftn' n (CallProc x p y) k = CallProc x (liftn n p k) y\"\n\n\nprimrec\n  substn' :: \"[program_rep, dB, nat] => program_rep\" and\n  substn :: \"[dB, dB, nat] => dB\"\nwhere\n    \"substn (Var i) s k =\n      (if k < i then Var (i - 1) else if i = k then liftn k s 0 else Var i)\"\n  | \"substn (t \\<degree> u) s k = substn t s k \\<degree> substn u s k\"\n  | \"substn (Abs t) s k = Abs (substn t s (k + 1))\"\n  | \"substn (Proc p x y) s k = Proc (substn' p s k) x y\"\n  | \"substn' Skip s k = Skip\"\n  | \"substn' (CallProc x p y) s k = CallProc x (substn p s k) y\"\n\n\nsubsection {* Beta-reduction *}\n\ninductive \n  beta' :: \"[program_rep, program_rep] => bool\"  (infixl \"\\<longrightarrow>\\<^sub>\\<beta>\" 50) and\n  beta :: \"[dB, dB] => bool\"  (infixl \"\\<rightarrow>\\<^sub>\\<beta>\" 50)\n  where\n    beta [simp, intro!]: \"Abs s \\<degree> t \\<rightarrow>\\<^sub>\\<beta> s[t/0]\"\n  | appL [simp, intro!]: \"s \\<rightarrow>\\<^sub>\\<beta> t ==> s \\<degree> u \\<rightarrow>\\<^sub>\\<beta> t \\<degree> u\"\n  | appR [simp, intro!]: \"s \\<rightarrow>\\<^sub>\\<beta> t ==> u \\<degree> s \\<rightarrow>\\<^sub>\\<beta> u \\<degree> t\"\n  | abs [simp, intro!]: \"s \\<rightarrow>\\<^sub>\\<beta> t ==> Abs s \\<rightarrow>\\<^sub>\\<beta> Abs t\"\n  | [simp, intro!]: \"s \\<longrightarrow>\\<^sub>\\<beta> t ==> Proc s x y \\<rightarrow>\\<^sub>\\<beta> Proc t x y\"\n  | [simp, intro!]: \"s \\<rightarrow>\\<^sub>\\<beta> t \\<Longrightarrow> CallProc x s y \\<longrightarrow>\\<^sub>\\<beta> CallProc x t y\"\nabbreviation\n  beta_reds  :: \"[dB, dB] => bool\"  (infixl \"->>\" 50) where\n  \"s ->> t == beta^** s t\"\nabbreviation\n  beta_reds' :: \"[program_rep, program_rep] => bool\"  (infixl \"-->>\" 50) where\n  \"s -->> t == beta'^** s t\"\n\nnotation (latex)\n  beta_reds  (infixl \"\\<rightarrow>\\<^sub>\\<beta>\\<^sup>*\" 50) and\n  beta_reds'  (infixl \"\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*\" 50)\n\ninductive_cases beta_cases [elim!]:\n  \"Var i \\<rightarrow>\\<^sub>\\<beta> t\"\n  \"Abs r \\<rightarrow>\\<^sub>\\<beta> s\"\n  \"s \\<degree> t \\<rightarrow>\\<^sub>\\<beta> u\"\n  \"Proc p x y \\<rightarrow>\\<^sub>\\<beta> u\"\n  \"Skip \\<longrightarrow>\\<^sub>\\<beta> u\"\n\ndeclare if_not_P [simp] not_less_eq [simp]\n  \\<comment> \\<open>don't add @{text \"r_into_rtrancl[intro!]\"}\\<close>\n\n\nsubsection {* Congruence rules *}\n\nlemma rtrancl_beta_Abs [intro!]:\n    \"s \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s' ==> Abs s \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* Abs s'\"\n  by (induct set: rtranclp) (blast intro: rtranclp.rtrancl_into_rtrancl)+\n\nlemma rtrancl_beta_Proc [intro!]:\n    \"s \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* s' ==> Proc s x y \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* Proc s' x y\"\n  by (induct set: rtranclp) (blast intro: rtranclp.rtrancl_into_rtrancl)+\n\nlemma rtrancl_beta_CallProc [intro!]:\n    \"s \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s' ==> CallProc x s y \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* CallProc x s' y\"\n  by (induct set: rtranclp) (blast intro: rtranclp.rtrancl_into_rtrancl)+\n\nlemma rtrancl_beta_AppL:\n    \"s \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s' ==> s \\<degree> t \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s' \\<degree> t\"\n  by (induct set: rtranclp) (blast intro: rtranclp.rtrancl_into_rtrancl)+\n\nlemma rtrancl_beta_AppR:\n    \"t \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* t' ==> s \\<degree> t \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s \\<degree> t'\"\n  by (induct set: rtranclp) (blast intro: rtranclp.rtrancl_into_rtrancl)+\n\nlemma rtrancl_beta_App [intro]:\n    \"[| s \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s'; t \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* t' |] ==> s \\<degree> t \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s' \\<degree> t'\"\n  by (blast intro!: rtrancl_beta_AppL rtrancl_beta_AppR intro: rtranclp_trans)\n\n\nsubsection {* Substitution-lemmas *}\n\nlemma subst_eq [simp]: \"(Var k)[u/k] = u\"\n  by (simp add: subst_Var)\n\nlemma subst_gt [simp]: \"i < j ==> (Var j)[u/i] = Var (j - 1)\"\n  by (simp add: subst_Var)\n\nlemma subst_lt [simp]: \"j < i ==> (Var j)[u/i] = Var j\"\n  by (simp add: subst_Var)\n\nlemma lift_lift:\n  shows \"i < k + 1 \\<Longrightarrow> lift' (lift' p i) (Suc k) = lift' (lift' p k) i\"\n  and  \"i < k + 1 \\<Longrightarrow> lift (lift t i) (Suc k) = lift (lift t k) i\" \n  by (induct p and t arbitrary: i k and i k) auto\n\nlemma lift_subst [simp]:\n  shows \"j < i + 1 \\<Longrightarrow> lift' (p[s/'j]) i = (lift' p (i + 1)) [lift s i /' j]\"\n  and \"j < i + 1 \\<Longrightarrow> lift (t[s/j]) i = (lift t (i + 1)) [lift s i / j]\"\n  by (induct p and t arbitrary: i j s and i j s)\n    (simp_all add: diff_Suc subst_Var lift_lift split: nat.split)\n\nlemma lift_subst_lt:\n  shows \"i < j + 1 \\<Longrightarrow> lift' (p[s/'j]) i = (lift' p i) [lift s i /' j + 1]\"\n  and \"i < j + 1 \\<Longrightarrow> lift (t[s/j]) i = (lift t i) [lift s i / j + 1]\"\n  by (induct p and t arbitrary: i j s and i j s) (simp_all add: subst_Var lift_lift)\n\nlemma subst_lift [simp]:\n  shows \"(lift' p k)[s/'k] = p\"\n   and  \"(lift t k)[s/k] = t\"\n  by (induct p and t arbitrary: k s and k s) simp_all\n\nlemma subst_subst:\n  shows \"i < j + 1 \\<Longrightarrow> p[lift v i /' Suc j][u[v/j]/'i] = p[u/'i][v/'j]\"\n  and   \"i < j + 1 \\<Longrightarrow> t[lift v i / Suc j][u[v/j]/i] = t[u/i][v/j]\"\n  by (induct p and t arbitrary: i j u v and i j u v)\n    (simp_all add: diff_Suc subst_Var lift_lift [symmetric] lift_subst_lt\n      split: nat.split)\n\n\nsubsection {* Equivalence proof for optimized substitution *}\n\nlemma liftn_0 [simp]: shows \"liftn' 0 p k = p\" and \"liftn 0 t k = t\"\n  by (induct p and t arbitrary: k and k) (simp_all add: subst_Var)\n\nlemma liftn_lift [simp]: \n  shows \"liftn' (Suc n) p k = lift' (liftn' n p k) k\"\n  and   \"liftn (Suc n) t k = lift (liftn n t k) k\"\n  by (induct p and t arbitrary: k and k) (simp_all add: subst_Var)\n\nlemma substn_subst_n [simp]:\n  shows \"substn' p s n = p[liftn n s 0 /' n]\"\n  and   \"substn t s n = t[liftn n s 0 / n]\"\n  by (induct p and t arbitrary: n and n) (simp_all add: subst_Var)\n\ntheorem substn_subst_0: \n  shows \"substn' p s 0 = p[s/'0]\"\n  and   \"substn t s 0 = t[s/0]\"\n  by simp_all\n\n\nsubsection {* Preservation theorems *}\n\ntext {* Not used in Church-Rosser proof, but in Strong\n  Normalization. \\medskip *}\n\ntheorem subst_preserves_beta [simp]:\n  shows \"pr \\<longrightarrow>\\<^sub>\\<beta> ps ==> pr[t/'i] \\<longrightarrow>\\<^sub>\\<beta> ps[t/'i]\"\n  and   \"r \\<rightarrow>\\<^sub>\\<beta> s ==> r[t/i] \\<rightarrow>\\<^sub>\\<beta> s[t/i]\"\n  by (induct arbitrary: t i and t i rule:beta'_beta.inducts) (simp_all add: subst_subst [symmetric])\n\ntheorem subst_preserves_beta': \"r \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s ==> r[t/i] \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s[t/i]\"\n  apply (induct set: rtranclp)\n   apply (rule rtranclp.rtrancl_refl)\n  apply (erule rtranclp.rtrancl_into_rtrancl)\n  apply (erule subst_preserves_beta)\n  done\n\ntheorem lift_preserves_beta [simp]:\n  shows \"pr \\<longrightarrow>\\<^sub>\\<beta> ps ==> lift' pr i \\<longrightarrow>\\<^sub>\\<beta> lift' ps i\"\n  and   \"r \\<rightarrow>\\<^sub>\\<beta> s ==> lift r i \\<rightarrow>\\<^sub>\\<beta> lift s i\"\n  by (induct arbitrary: i and i rule:beta'_beta.inducts) auto\n\ntheorem lift_preserves_beta': \"r \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s ==> lift r i \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* lift s i\"\n  apply (induct set: rtranclp)\n   apply (rule rtranclp.rtrancl_refl)\n  apply (erule rtranclp.rtrancl_into_rtrancl)\n  apply (erule lift_preserves_beta)\n  done\n\ntheorem subst_preserves_beta2 [simp]: \n  shows \"r \\<rightarrow>\\<^sub>\\<beta> s ==> p[r/'i] \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* p[s/'i]\"\n    and \"r \\<rightarrow>\\<^sub>\\<beta> s ==> t[r/i] \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* t[s/i]\"\n  apply (induct p and t arbitrary: r s i and r s i)\n  apply simp\n  apply (simp add: rtrancl_beta_CallProc)\n  apply (simp add: rtrancl_beta_Proc)\n  apply (simp add: subst_Var r_into_rtranclp)\n  apply (simp add: rtrancl_beta_App)\n  by (simp add: rtrancl_beta_Abs)\n  \n\ntheorem subst_preserves_beta2': \"r \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s ==> t[r/i] \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* t[s/i]\"\n  apply (induct set: rtranclp)\n   apply (rule rtranclp.rtrancl_refl)\n  apply (erule rtranclp_trans)\n  apply (erule subst_preserves_beta2)\n  done\n\nabbreviation\n  list_application :: \"dB => dB list => dB\"  (infixl \"\\<degree>\\<degree>\" 150) where\n  \"t \\<degree>\\<degree> ts == foldl (\\<degree>) t ts\"\n\nlemma apps_eq_tail_conv [iff]: \"(r \\<degree>\\<degree> ts = s \\<degree>\\<degree> ts) = (r = s)\"\n  by (induct ts rule: rev_induct) auto\n\nlemma Var_eq_apps_conv [iff]: \"(Var m = s \\<degree>\\<degree> ss) = (Var m = s \\<and> ss = [])\"\n  by (induct ss arbitrary: s) auto\n\nlemma Proc_eq_apps_conv [iff]: \"(Proc p x y = s \\<degree>\\<degree> ss) = (Proc p x y = s \\<and> ss = [])\"\n  by (induct ss arbitrary: s) auto\n\nlemma Var_apps_eq_Var_apps_conv [iff]:\n    \"(Var m \\<degree>\\<degree> rs = Var n \\<degree>\\<degree> ss) = (m = n \\<and> rs = ss)\"\n  apply (induct rs arbitrary: ss rule: rev_induct)\n   apply simp\n   apply blast\n  apply (induct_tac ss rule: rev_induct)\n   apply auto\n  done\n\nlemma Proc_apps_eq_Proc_apps_conv [iff]:\n    \"(Proc p x y \\<degree>\\<degree> rs = Proc p' x' y' \\<degree>\\<degree> ss) = (p=p' \\<and> x=x' \\<and> y=y' \\<and> rs = ss)\"\n  apply (induct rs arbitrary: ss rule: rev_induct)\n   apply simp\n   apply blast\n  apply (induct_tac ss rule: rev_induct)\n   apply auto\n  done\n\nlemma App_eq_foldl_conv:\n  \"(r \\<degree> s = t \\<degree>\\<degree> ts) =\n    (if ts = [] then r \\<degree> s = t\n    else (\\<exists>ss. ts = ss @ [s] \\<and> r = t \\<degree>\\<degree> ss))\"\n  apply (rule_tac xs = ts in rev_exhaust)\n   apply auto\n  done\n\nlemma Abs_eq_apps_conv [iff]:\n    \"(Abs r = s \\<degree>\\<degree> ss) = (Abs r = s \\<and> ss = [])\"\n  by (induct ss rule: rev_induct) auto\n\nlemma apps_eq_Abs_conv [iff]: \"(s \\<degree>\\<degree> ss = Abs r) = (s = Abs r \\<and> ss = [])\"\n  by (induct ss rule: rev_induct) auto\n\nlemma Abs_apps_eq_Abs_apps_conv [iff]:\n    \"(Abs r \\<degree>\\<degree> rs = Abs s \\<degree>\\<degree> ss) = (r = s \\<and> rs = ss)\"\n  apply (induct rs arbitrary: ss rule: rev_induct)\n   apply simp\n   apply blast\n  apply (induct_tac ss rule: rev_induct)\n   apply auto\n  done\n\nlemma Abs_App_neq_Var_apps [iff]:\n    \"Abs s \\<degree> t \\<noteq> Var n \\<degree>\\<degree> ss\"\n  by (induct ss arbitrary: s t rule: rev_induct) auto\n\nlemma Abs_App_neq_Proc_apps [iff]:\n    \"Abs s \\<degree> t \\<noteq> Proc p x y \\<degree>\\<degree> ss\"\n  by (induct ss arbitrary: s t rule: rev_induct) auto\n\nlemma Var_apps_neq_Abs_apps [iff]:\n    \"Var n \\<degree>\\<degree> ts \\<noteq> Abs r \\<degree>\\<degree> ss\"\n  apply (induct ss arbitrary: ts rule: rev_induct)\n   apply simp\n  apply (induct_tac ts rule: rev_induct)\n   apply auto\n  done\n\nlemma Proc_apps_neq_Abs_apps [iff]:\n    \"Proc p x y \\<degree>\\<degree> ts \\<noteq> Abs r \\<degree>\\<degree> ss\"\n  apply (induct ss arbitrary: ts rule: rev_induct)\n   apply simp\n  apply (induct_tac ts rule: rev_induct)\n   apply auto\n  done\n\nlemma Var_apps_neq_Proc_apps [iff]:\n    \"Var n \\<degree>\\<degree> ts \\<noteq> Proc p x y \\<degree>\\<degree> ss\"\n  apply (induct ss arbitrary: ts rule: rev_induct)\n  apply (induct_tac ts rule: rev_induct, simp_all)\n  by (induct_tac ts rule: rev_induct, simp_all)\n\n\nlemma ex_head_tail:\n  \"\\<exists>ts h. t = h \\<degree>\\<degree> ts \\<and> ((\\<exists>n. h = Var n) \\<or> (\\<exists>u. h = Abs u) \\<or> (\\<exists>p x y. h=Proc p x y))\"\n  apply (induct t)\n    apply simp\n    apply simp\n    apply (rule_tac x = \"[]\" in exI)\n    apply simp apply simp\n    apply (metis foldl_Cons foldl_Nil foldl_append)\n   by simp \n\nlemma size_apps [simp]:\n  \"size (r \\<degree>\\<degree> rs) = size r + foldl (+) 0 (map size rs) + length rs\"\n  by (induct rs rule: rev_induct) auto\n\nlemma lem0: \"[| (0::nat) < k; m <= n |] ==> m < n + k\"\n  by simp\n\nlemma lift_map [simp]:\n    \"lift (t \\<degree>\\<degree> ts) i = lift t i \\<degree>\\<degree> map (\\<lambda>t. lift t i) ts\"\n  by (induct ts arbitrary: t) simp_all\n\nlemma subst_map [simp]:\n    \"subst (t \\<degree>\\<degree> ts) u i = subst t u i \\<degree>\\<degree> map (\\<lambda>t. subst t u i) ts\"\n  by (induct ts arbitrary: t) simp_all\n\nlemma app_last: \"(t \\<degree>\\<degree> ts) \\<degree> u = t \\<degree>\\<degree> (ts @ [u])\"\n  by simp\n\n\ntext {* \\medskip A customized induction schema for @{text \"\\<degree>\\<degree>\"}. *}\n\n(*\nlemma lem:\n  assumes \"!!n ts. \\<forall>t \\<in> set ts. P t ==> P (Var n \\<degree>\\<degree> ts)\"\n    and \"!!u ts. [| P u; \\<forall>t \\<in> set ts. P t |] ==> P (Abs u \\<degree>\\<degree> ts)\"\n  shows \"size t = n \\<Longrightarrow> P t\"\n  apply (induct n arbitrary: t rule: nat_less_induct)\n  apply (cut_tac t = t in ex_head_tail)\n  apply clarify\n  apply (erule disjE)\n   apply clarify\n   apply (rule assms)\n   apply clarify\n   apply (erule allE, erule impE)\n    prefer 2\n    apply (erule allE, erule mp, rule refl)\n   apply simp\n   apply (simp only: foldl_conv_fold add.commute fold_plus_listsum_rev)\n   apply (fastforce simp add: listsum_map_remove1)\n  apply clarify\n  apply (rule assms)\n   apply (erule allE, erule impE)\n    prefer 2\n    apply (erule allE, erule mp, rule refl)\n   apply simp\n  apply clarify\n  apply (erule allE, erule impE)\n   prefer 2\n   apply (erule allE, erule mp, rule refl)\n  apply simp\n  apply (rule le_imp_less_Suc)\n  apply (rule trans_le_add1)\n  apply (rule trans_le_add2)\n  apply (simp only: foldl_conv_fold add.commute fold_plus_listsum_rev)\n  apply (simp add: member_le_listsum_nat)\n  done\n\ntheorem Apps_dB_induct:\n  assumes \"!!n ts. \\<forall>t \\<in> set ts. P t ==> P (Var n \\<degree>\\<degree> ts)\"\n    and \"!!u ts. [| P u; \\<forall>t \\<in> set ts. P t |] ==> P (Abs u \\<degree>\\<degree> ts)\"\n  shows \"P t\"\n  apply (rule_tac t = t in lem)\n    prefer 3\n    apply (rule refl)\n    using assms apply iprover+\n  done\n*)\n\n\nsubsection {* Environments *}\n\ndefinition\n  shift :: \"(nat \\<Rightarrow> 'a) \\<Rightarrow> nat \\<Rightarrow> 'a \\<Rightarrow> nat \\<Rightarrow> 'a\"  (\"_<_:_>\" [90, 0, 0] 91) where\n  \"e<i:a> = (\\<lambda>j. if j < i then e j else if j = i then a else e (j - 1))\"\n\nnotation (xsymbols)\n  shift  (\"_\\<langle>_:_\\<rangle>\" [90, 0, 0] 91)\n\nnotation (HTML output)\n  shift  (\"_\\<langle>_:_\\<rangle>\" [90, 0, 0] 91)\n\n\n\nlemma shift_gt [simp]: \"j < i \\<Longrightarrow> (e\\<langle>i:T\\<rangle>) j = e j\"\n  by (simp add: shift_def)\n\nlemma shift_lt [simp]: \"i < j \\<Longrightarrow> (e\\<langle>i:T\\<rangle>) j = e (j - 1)\"\n  by (simp add: shift_def)\n\nlemma shift_commute [simp]: \"e\\<langle>i:U\\<rangle>\\<langle>0:T\\<rangle> = e\\<langle>0:T\\<rangle>\\<langle>Suc i:U\\<rangle>\"\n  by (rule ext) (simp_all add: shift_def split: nat.split)\n\n\nsubsection {* Types and typing rules *}\n\ndatatype type =\n    Atom nat\n  | Fun type type    (infixr \"\\<Rightarrow>\" 200)\n\ninductive typing :: \"(nat \\<Rightarrow> type) \\<Rightarrow> dB \\<Rightarrow> type \\<Rightarrow> bool\"  (\"_ \\<turnstile> _ : _\" [50, 50, 50] 50)\n  where\n    Var [intro!]: \"env x = T \\<Longrightarrow> env \\<turnstile> Var x : T\"\n  | Abs [intro!]: \"env\\<langle>0:T\\<rangle> \\<turnstile> t : U \\<Longrightarrow> env \\<turnstile> Abs t : (T \\<Rightarrow> U)\"\n  | App [intro!]: \"env \\<turnstile> s : T \\<Rightarrow> U \\<Longrightarrow> env \\<turnstile> t : T \\<Longrightarrow> env \\<turnstile> (s \\<degree> t) : U\"\n\ninductive_cases typing_elims [elim!]:\n  \"e \\<turnstile> Var i : T\"\n  \"e \\<turnstile> t \\<degree> u : T\"\n  \"e \\<turnstile> Abs t : T\"\n\nprimrec\n  typings :: \"(nat \\<Rightarrow> type) \\<Rightarrow> dB list \\<Rightarrow> type list \\<Rightarrow> bool\"\nwhere\n    \"typings e [] Ts = (Ts = [])\"\n  | \"typings e (t # ts) Ts =\n      (case Ts of\n        [] \\<Rightarrow> False\n      | T # Ts \\<Rightarrow> e \\<turnstile> t : T \\<and> typings e ts Ts)\"\n\nabbreviation\n  typings_rel :: \"(nat \\<Rightarrow> type) \\<Rightarrow> dB list \\<Rightarrow> type list \\<Rightarrow> bool\"\n    (\"_ ||- _ : _\" [50, 50, 50] 50) where\n  \"env ||- ts : Ts == typings env ts Ts\"\n\nnotation (latex)\n  typings_rel  (\"_ \\<tturnstile> _ : _\" [50, 50, 50] 50)\n\nabbreviation\n  funs :: \"type list \\<Rightarrow> type \\<Rightarrow> type\"  (infixr \"=>>\" 200) where\n  \"Ts =>> T == foldr Fun Ts T\"\n\nnotation (latex)\n  funs  (infixr \"\\<Rrightarrow>\" 200)\n\n\nsubsection {* Some examples *}\n\nschematic_lemma \"e \\<turnstile> Abs (Abs (Abs (Var 1 \\<degree> (Var 2 \\<degree> Var 1 \\<degree> Var 0)))) : ?T\"\n  by force\n\nschematic_lemma \"e \\<turnstile> Abs (Abs (Abs (Var 2 \\<degree> Var 0 \\<degree> (Var 1 \\<degree> Var 0)))) : ?T\"\n  by force\n\n\nsubsection {* Lists of types *}\n\nlemma lists_typings:\n    \"e \\<tturnstile> ts : Ts \\<Longrightarrow> listsp (\\<lambda>t. \\<exists>T. e \\<turnstile> t : T) ts\"\n  apply (induct ts arbitrary: Ts)\n   apply (case_tac Ts)\n     apply simp\n     apply (rule listsp.Nil)\n    apply simp\n  apply (case_tac Ts)\n   apply simp\n  apply simp\n  apply (rule listsp.Cons)\n   apply blast\n  apply blast\n  done\n\nlemma types_snoc: \"e \\<tturnstile> ts : Ts \\<Longrightarrow> e \\<turnstile> t : T \\<Longrightarrow> e \\<tturnstile> ts @ [t] : Ts @ [T]\"\n  apply (induct ts arbitrary: Ts)\n  apply simp\n  apply (case_tac Ts)\n  apply simp+\n  done\n\nlemma types_snoc_eq: \"e \\<tturnstile> ts @ [t] : Ts @ [T] =\n  (e \\<tturnstile> ts : Ts \\<and> e \\<turnstile> t : T)\"\n  apply (induct ts arbitrary: Ts)\n  apply (case_tac Ts)\n  apply simp+\n  apply (case_tac Ts)\n  apply (case_tac \"ts @ [t]\")\n  apply simp+\n  done\n\nlemma rev_exhaust2 [extraction_expand]:\n  obtains (Nil) \"xs = []\"  |  (snoc) ys y where \"xs = ys @ [y]\"\n  \\<comment> \\<open>Cannot use @{text rev_exhaust} from the @{text List}\n    theory, since it is not constructive\\<close>\n  apply (subgoal_tac \"\\<forall>ys. xs = rev ys \\<longrightarrow> thesis\")\n  apply (erule_tac x=\"rev xs\" in allE)\n  apply simp\n  apply (rule allI)\n  apply (rule impI)\n  apply (case_tac ys)\n  apply simp\n  apply simp\n  done\n\nlemma types_snocE: \"e \\<tturnstile> ts @ [t] : Ts \\<Longrightarrow>\n  (\\<And>Us U. Ts = Us @ [U] \\<Longrightarrow> e \\<tturnstile> ts : Us \\<Longrightarrow> e \\<turnstile> t : U \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (cases Ts rule: rev_exhaust2)\n  apply simp\n  apply (case_tac \"ts @ [t]\")\n  apply (simp add: types_snoc_eq)+\n  done\n\n\nsubsection {* n-ary function types *}\n\nlemma list_app_typeD:\n    \"e \\<turnstile> t \\<degree>\\<degree> ts : T \\<Longrightarrow> \\<exists>Ts. e \\<turnstile> t : Ts \\<Rrightarrow> T \\<and> e \\<tturnstile> ts : Ts\"\n  apply (induct ts arbitrary: t T)\n   apply simp\n  apply (rename_tac a b t T)\n  apply atomize\n  apply simp\n  apply (erule_tac x = \"t \\<degree> a\" in allE)\n  apply (erule_tac x = T in allE)\n  apply (erule impE)\n   apply assumption\n  apply (elim exE conjE)\n  apply (ind_cases \"e \\<turnstile> t \\<degree> u : T\" for t u T)\n  apply (rule_tac x = \"Ta # Ts\" in exI)\n  apply simp\n  done\n\nlemma list_app_typeE:\n  \"e \\<turnstile> t \\<degree>\\<degree> ts : T \\<Longrightarrow> (\\<And>Ts. e \\<turnstile> t : Ts \\<Rrightarrow> T \\<Longrightarrow> e \\<tturnstile> ts : Ts \\<Longrightarrow> C) \\<Longrightarrow> C\"\n  by (insert list_app_typeD) fast\n\nlemma list_app_typeI:\n    \"e \\<turnstile> t : Ts \\<Rrightarrow> T \\<Longrightarrow> e \\<tturnstile> ts : Ts \\<Longrightarrow> e \\<turnstile> t \\<degree>\\<degree> ts : T\"\n  apply (induct ts arbitrary: t T Ts)\n   apply simp\n  apply (rename_tac a b t T Ts)\n  apply atomize\n  apply (case_tac Ts)\n   apply simp\n  apply simp\n  apply (erule_tac x = \"t \\<degree> a\" in allE)\n  apply (erule_tac x = T in allE)\n  apply (rename_tac list)\n  apply (erule_tac x = list in allE)\n  apply (erule impE)\n   apply (erule conjE)\n   apply (erule typing.App)\n   apply assumption\n  apply blast\n  done\n\ntext {*\nFor the specific case where the head of the term is a variable,\nthe following theorems allow to infer the types of the arguments\nwithout analyzing the typing derivation. This is crucial\nfor program extraction.\n*}\n\ntheorem var_app_type_eq:\n  \"e \\<turnstile> Var i \\<degree>\\<degree> ts : T \\<Longrightarrow> e \\<turnstile> Var i \\<degree>\\<degree> ts : U \\<Longrightarrow> T = U\"\n  apply (induct ts arbitrary: T U rule: rev_induct)\n  apply simp\n  apply (ind_cases \"e \\<turnstile> Var i : T\" for T)\n  apply (ind_cases \"e \\<turnstile> Var i : T\" for T)\n  apply simp\n  apply simp\n  apply (ind_cases \"e \\<turnstile> t \\<degree> u : T\" for t u T)\n  apply (ind_cases \"e \\<turnstile> t \\<degree> u : T\" for t u T)\n  apply atomize\n  apply (erule_tac x=\"Ta \\<Rightarrow> T\" in allE)\n  apply (erule_tac x=\"Tb \\<Rightarrow> U\" in allE)\n  apply (erule impE)\n  apply assumption\n  apply (erule impE)\n  apply assumption\n  apply simp\n  done\n\nlemma var_app_types: \"e \\<turnstile> Var i \\<degree>\\<degree> ts \\<degree>\\<degree> us : T \\<Longrightarrow> e \\<tturnstile> ts : Ts \\<Longrightarrow>\n  e \\<turnstile> Var i \\<degree>\\<degree> ts : U \\<Longrightarrow> \\<exists>Us. U = Us \\<Rrightarrow> T \\<and> e \\<tturnstile> us : Us\"\n  apply (induct us arbitrary: ts Ts U)\n  apply simp\n  apply (erule var_app_type_eq)\n  apply assumption\n  apply simp\n  apply (rename_tac a b ts Ts U)\n  apply atomize\n  apply (case_tac U)\n  apply (rule FalseE)\n  apply simp\n  apply (erule list_app_typeE)\n  apply (ind_cases \"e \\<turnstile> t \\<degree> u : T\" for t u T)\n  apply (drule_tac T=\"Atom nat\" and U=\"Ta \\<Rightarrow> Tsa \\<Rrightarrow> T\" in var_app_type_eq)\n  apply assumption\n  apply simp\n  apply (erule_tac x=\"ts @ [a]\" in allE)\n  apply (erule_tac x=\"Ts @ [type1]\" in allE)\n  apply (erule_tac x=\"type2\" in allE)\n  apply simp\n  apply (erule impE)\n  apply (rule types_snoc)\n  apply assumption\n  apply (erule list_app_typeE)\n  apply (ind_cases \"e \\<turnstile> t \\<degree> u : T\" for t u T)\n  apply (drule_tac T=\"type1 \\<Rightarrow> type2\" and U=\"Ta \\<Rightarrow> Tsa \\<Rrightarrow> T\" in var_app_type_eq)\n  apply assumption\n  apply simp\n  apply (erule impE)\n  apply (rule typing.App)\n  apply assumption\n  apply (erule list_app_typeE)\n  apply (ind_cases \"e \\<turnstile> t \\<degree> u : T\" for t u T)\n  apply (frule_tac T=\"type1 \\<Rightarrow> type2\" and U=\"Ta \\<Rightarrow> Tsa \\<Rrightarrow> T\" in var_app_type_eq)\n  apply assumption\n  apply simp\n  apply (erule exE)\n  apply (rule_tac x=\"type1 # Us\" in exI)\n  apply simp\n  apply (erule list_app_typeE)\n  apply (ind_cases \"e \\<turnstile> t \\<degree> u : T\" for t u T)\n  apply (frule_tac T=\"type1 \\<Rightarrow> Us \\<Rrightarrow> T\" and U=\"Ta \\<Rightarrow> Tsa \\<Rrightarrow> T\" in var_app_type_eq)\n  apply assumption\n  apply simp\n  done\n\nlemma var_app_typesE: \"e \\<turnstile> Var i \\<degree>\\<degree> ts : T \\<Longrightarrow>\n  (\\<And>Ts. e \\<turnstile> Var i : Ts \\<Rrightarrow> T \\<Longrightarrow> e \\<tturnstile> ts : Ts \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (drule var_app_types [of _ _ \"[]\", simplified])\n  apply (iprover intro: typing.Var)+\n  done\n\nlemma abs_typeE: \"e \\<turnstile> Abs t : T \\<Longrightarrow> (\\<And>U V. e\\<langle>0:U\\<rangle> \\<turnstile> t : V \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (cases T)\n  apply (rule FalseE)\n  apply (erule typing.cases)\n  apply simp_all\n  apply atomize\n  apply (erule_tac x=\"type1\" in allE)\n  apply (erule_tac x=\"type2\" in allE)\n  apply (erule mp)\n  apply (erule typing.cases)\n  apply simp_all\n  done\n\n\nsubsection {* Lifting preserves well-typedness *}\n\nlemma lift_type [intro!]: \"e \\<turnstile> t : T \\<Longrightarrow> e\\<langle>i:U\\<rangle> \\<turnstile> lift t i : T\"\n  by (induct arbitrary: i U set: typing) auto\n\nlemma lift_types:\n  \"e \\<tturnstile> ts : Ts \\<Longrightarrow> e\\<langle>i:U\\<rangle> \\<tturnstile> (map (\\<lambda>t. lift t i) ts) : Ts\"\n  apply (induct ts arbitrary: Ts)\n   apply simp\n  apply (case_tac Ts)\n   apply auto\n  done\n\n\nsubsection {* Substitution lemmas *}\n\nlemma subst_lemma:\n    \"e \\<turnstile> t : T \\<Longrightarrow> e' \\<turnstile> u : U \\<Longrightarrow> e = e'\\<langle>i:U\\<rangle> \\<Longrightarrow> e' \\<turnstile> t[u/i] : T\"\n  apply (induct arbitrary: e' i U u set: typing)\n    apply (rule_tac x = x and y = i in linorder_cases)\n      apply auto\n  apply blast\n  done\n\nlemma substs_lemma:\n  \"e \\<turnstile> u : T \\<Longrightarrow> e\\<langle>i:T\\<rangle> \\<tturnstile> ts : Ts \\<Longrightarrow>\n     e \\<tturnstile> (map (\\<lambda>t. t[u/i]) ts) : Ts\"\n  apply (induct ts arbitrary: Ts)\n   apply (case_tac Ts)\n    apply simp\n   apply simp\n  apply atomize\n  apply (case_tac Ts)\n   apply simp\n  apply simp\n  apply (erule conjE)\n  apply (erule (1) subst_lemma)\n  apply (rule refl)\n  done\n\n\nsubsection {* Subject reduction *}\n\nlemma subject_reduction: \"e \\<turnstile> t : T \\<Longrightarrow> t \\<rightarrow>\\<^sub>\\<beta> t' \\<Longrightarrow> e \\<turnstile> t' : T\"\n  apply (induct arbitrary: t' set: typing)\n    apply blast\n   apply blast\n  apply atomize\n  apply (ind_cases \"s \\<degree> t \\<rightarrow>\\<^sub>\\<beta> t'\" for s t t')\n    apply hypsubst\n    apply (ind_cases \"env \\<turnstile> Abs t : T \\<Rightarrow> U\" for env t T U)\n    apply (rule subst_lemma)\n      apply assumption\n     apply assumption\n    apply (rule ext)\n    apply (case_tac x)\n     apply auto\n  done\n\ntheorem subject_reduction': \"t \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* t' \\<Longrightarrow> e \\<turnstile> t : T \\<Longrightarrow> e \\<turnstile> t' : T\"\n  by (induct set: rtranclp) (iprover intro: subject_reduction)+\n\n\nsubsection {* Alternative induction rule for types *}\n\nlemma type_induct [induct type]:\n  assumes\n  \"(\\<And>T. (\\<And>T1 T2. T = T1 \\<Rightarrow> T2 \\<Longrightarrow> P T1) \\<Longrightarrow>\n    (\\<And>T1 T2. T = T1 \\<Rightarrow> T2 \\<Longrightarrow> P T2) \\<Longrightarrow> P T)\"\n  shows \"P T\"\nproof (induct T)\n  case Atom\n  show ?case by (rule assms) simp_all\nnext\n  case Fun\n  show ?case by (rule assms) (insert Fun, simp_all)\nqed\n\n\ntext {*\n  Lifting an order to lists of elements, relating exactly one\n  element.\n*}\n\ndefinition\n  step1 :: \"('a => 'a => bool) => 'a list => 'a list => bool\" where\n  \"step1 r =\n    (\\<lambda>ys xs. \\<exists>us z z' vs. xs = us @ z # vs \\<and> r z' z \\<and> ys =\n      us @ z' # vs)\"\n\n\nlemma step1_converse [simp]: \"step1 (r^--1) = (step1 r)^--1\"\n  apply (unfold step1_def)\n  apply (blast intro!: order_antisym)\n  done\n\nlemma in_step1_converse [iff]: \"(step1 (r^--1) x y) = ((step1 r)^--1 x y)\"\n  apply auto\n  done\n\nlemma not_Nil_step1 [iff]: \"\\<not> step1 r [] xs\"\n  apply (unfold step1_def)\n  apply blast\n  done\n\nlemma not_step1_Nil [iff]: \"\\<not> step1 r xs []\"\n  apply (unfold step1_def)\n  apply blast\n  done\n\nlemma Cons_step1_Cons [iff]:\n    \"(step1 r (y # ys) (x # xs)) =\n      (r y x \\<and> xs = ys \\<or> x = y \\<and> step1 r ys xs)\"\n  apply (unfold step1_def)\n  apply (rule iffI)\n   apply (erule exE)\n   apply (rename_tac ts)\n   apply (case_tac ts)\n    apply fastforce\n   apply force\n  apply (erule disjE)\n   apply blast\n  apply (blast intro: Cons_eq_appendI)\n  done\n\nlemma append_step1I:\n  \"step1 r ys xs \\<and> vs = us \\<or> ys = xs \\<and> step1 r vs us\n    ==> step1 r (ys @ vs) (xs @ us)\"\n  apply (unfold step1_def)\n  apply auto\n   apply blast\n  apply (blast intro: append_eq_appendI)\n  done\n\nlemma Cons_step1E [elim!]:\n  assumes \"step1 r ys (x # xs)\"\n    and \"!!y. ys = y # xs \\<Longrightarrow> r y x \\<Longrightarrow> R\"\n    and \"!!zs. ys = x # zs \\<Longrightarrow> step1 r zs xs \\<Longrightarrow> R\"\n  shows R\n  using assms\n  apply (cases ys)\n   apply (simp add: step1_def)\n  apply blast\n  done\n\nlemma Snoc_step1_SnocD:\n  \"step1 r (ys @ [y]) (xs @ [x])\n    ==> (step1 r ys xs \\<and> y = x \\<or> ys = xs \\<and> r y x)\"\n  apply (unfold step1_def)\n  apply (clarify del: disjCI)\n  apply (rename_tac vs)\n  apply (rule_tac xs = vs in rev_exhaust)\n   apply force\n  apply simp\n  apply blast\n  done\n\nlemma Cons_acc_step1I [intro!]:\n    \"Wellfounded.accp r x ==> Wellfounded.accp (step1 r) xs \\<Longrightarrow> Wellfounded.accp (step1 r) (x # xs)\"\n  apply (induct arbitrary: xs set: Wellfounded.accp)\n  apply (erule thin_rl)\n  apply (erule accp_induct)\n  apply (rule accp.accI)\n  apply blast\n  done\n\nlemma lists_accD: \"listsp (Wellfounded.accp r) xs ==> Wellfounded.accp (step1 r) xs\"\n  apply (induct set: listsp)\n   apply (rule accp.accI)\n   apply simp\n  apply (rule accp.accI)\n  apply (fast dest: accp_downward)\n  done\n\nlemma ex_step1I:\n  \"[| x \\<in> set xs; r y x |]\n    ==> \\<exists>ys. step1 r ys xs \\<and> y \\<in> set ys\"\n  apply (unfold step1_def)\n  apply (drule in_set_conv_decomp [THEN iffD1])\n  apply force\n  done\n\nlemma lists_accI: \"Wellfounded.accp (step1 r) xs ==> listsp (Wellfounded.accp r) xs\"\n  apply (induct set: Wellfounded.accp)\n  apply clarify\n  apply (rule accp.accI)\n  apply (drule_tac r=r in ex_step1I, assumption)\n  apply blast\n  done\n\ntext {*\n  Lifting beta-reduction to lists of terms, reducing exactly one element.\n*}\n\nabbreviation\n  list_beta :: \"dB list => dB list => bool\"  (infixl \"=>\" 50) where\n  \"rs => ss == step1 beta rs ss\"\n\nlemma head_Var_reduction:\n  \"Var n \\<degree>\\<degree> rs \\<rightarrow>\\<^sub>\\<beta> v \\<Longrightarrow> \\<exists>ss. rs => ss \\<and> v = Var n \\<degree>\\<degree> ss\"\n  apply (induct u == \"Var n \\<degree>\\<degree> rs\" v arbitrary: rs set: beta)\n     apply simp\n    apply (rule_tac xs = rs in rev_exhaust)\n     apply simp\n    apply (atomize, force intro: append_step1I)\n   apply (rule_tac xs = rs in rev_exhaust)\n    apply simp\n    apply (auto 0 3 intro: disjI2 [THEN append_step1I])\n  done\n\n(*\nlemma head_Proc_reduction:\n  \"Proc p x y \\<degree>\\<degree> rs \\<rightarrow>\\<^sub>\\<beta> v \\<Longrightarrow> (\\<exists>ss p'. rs => ss \\<and> v = Proc p x y \\<degree>\\<degree> ss)\"\n  apply (induct u == \"Proc p x y \\<degree>\\<degree> rs\" v arbitrary: rs taking: \"\\<lambda>_ _. True\" set: beta)\n    apply simp\n    apply (rule_tac xs = rs in rev_exhaust)\n     apply simp\n    apply (atomize, force intro: append_step1I)x\n   apply (rule_tac xs = rs in rev_exhaust)\n    apply simp\n    apply (auto 0 3 intro: disjI2 [THEN append_step1I])[1]\n    apply (auto 0 3 intro: disjI2 [THEN append_step1I])[1]\n    apply auto[1]\n    apply (auto 0 3 intro: disjI2 [THEN append_step1I])[1]\n  done\n*)\n\nlemma apps_betasE [elim!]:\n  assumes major: \"r \\<degree>\\<degree> rs \\<rightarrow>\\<^sub>\\<beta> s\"\n    and cases: \"!!r'. [| r \\<rightarrow>\\<^sub>\\<beta> r'; s = r' \\<degree>\\<degree> rs |] ==> R\"\n      \"!!rs'. [| rs => rs'; s = r \\<degree>\\<degree> rs' |] ==> R\"\n      \"!!t u us. [| r = Abs t; rs = u # us; s = t[u/0] \\<degree>\\<degree> us |] ==> R\"\n  shows R\nproof -\n  from major have\n   \"(\\<exists>r'. r \\<rightarrow>\\<^sub>\\<beta> r' \\<and> s = r' \\<degree>\\<degree> rs) \\<or>\n    (\\<exists>rs'. rs => rs' \\<and> s = r \\<degree>\\<degree> rs') \\<or>\n    (\\<exists>t u us. r = Abs t \\<and> rs = u # us \\<and> s = t[u/0] \\<degree>\\<degree> us)\"\n    apply (induct u == \"r \\<degree>\\<degree> rs\" s arbitrary: r rs set: beta)\n       apply (case_tac r)\n         apply simp\n         apply simp\n        apply (simp add: App_eq_foldl_conv)\n        apply (split split_if_asm)\n         apply simp\n         apply blast\n        apply simp\n       apply (simp add: App_eq_foldl_conv)\n       apply (split split_if_asm)\n        apply simp\n       apply simp\n      apply (drule App_eq_foldl_conv [THEN iffD1])\n      apply (split split_if_asm)\n       apply simp\n       apply blast\n      apply (force intro!: disjI1 [THEN append_step1I])\n     apply (drule App_eq_foldl_conv [THEN iffD1])\n     apply (split split_if_asm)\n      apply simp\n      apply blast\n     by (clarify, auto 0 3 del: exI intro!: exI intro: append_step1I)\n    \n  with cases show ?thesis by blast\nqed\n\nlemma apps_preserves_beta [simp]:\n    \"r \\<rightarrow>\\<^sub>\\<beta> s ==> r \\<degree>\\<degree> ss \\<rightarrow>\\<^sub>\\<beta> s \\<degree>\\<degree> ss\"\n  by (induct ss rule: rev_induct) auto\n\nlemma apps_preserves_beta2 [simp]:\n    \"r ->> s ==> r \\<degree>\\<degree> ss ->> s \\<degree>\\<degree> ss\"\n  apply (induct set: rtranclp)\n   apply blast\n  apply (blast intro: apps_preserves_beta rtranclp.rtrancl_into_rtrancl)\n  done\n\nlemma apps_preserves_betas [simp]:\n    \"rs => ss \\<Longrightarrow> r \\<degree>\\<degree> rs \\<rightarrow>\\<^sub>\\<beta> r \\<degree>\\<degree> ss\"\n  apply (induct rs arbitrary: ss rule: rev_induct)\n   apply simp\n  apply simp\n  apply (rule_tac xs = ss in rev_exhaust)\n   apply simp\n  apply simp\n  apply (drule Snoc_step1_SnocD)\n  apply blast\n  done\n\nsubsection {* Terminating lambda terms *}\n\ninductive IT' :: \"program_rep => bool\" and IT :: \"dB => bool\"\n  where\n    Var [intro]: \"listsp IT rs ==> IT (Var n \\<degree>\\<degree> rs)\"\n  | Lambda [intro]: \"IT r ==> IT (Abs r)\"\n  | Beta [intro]: \"IT ((r[s/0]) \\<degree>\\<degree> ss) ==> IT s ==> IT ((Abs r \\<degree> s) \\<degree>\\<degree> ss)\"\n  | [intro]: \"listsp IT rs ==> IT' body \\<Longrightarrow> IT (Proc body args ret \\<degree>\\<degree> rs)\"\n  | [intro]: \"IT' Skip\"\n\nlemma AppAbs_iff: \"IT ((Abs r \\<degree> s) \\<degree>\\<degree> ss) = (IT ((r[s/0]) \\<degree>\\<degree> ss) \\<and> IT s)\"\n  apply (rule iffI)\n  apply (cases \"((Abs r \\<degree> s) \\<degree>\\<degree> ss)\" rule:IT.cases, auto)\n  apply (metis Var_apps_neq_Abs_apps foldl_Cons)\n  apply (metis Var_apps_neq_Abs_apps foldl_Cons)\n  apply (metis (mono_tags) Abs_apps_eq_Abs_apps_conv foldl_Cons list.inject)\n  apply (metis (full_types) Abs_apps_eq_Abs_apps_conv append_Cons foldl_Cons last.simps last_appendR not_Cons_self2 rotate1.simps(2))\n  apply (metis foldl_Cons Proc_apps_neq_Abs_apps)\nby (metis (poly_guards_query) Proc_apps_neq_Abs_apps foldl_Cons)\n  \n\nlemma Var_iff: \"IT (Var n \\<degree>\\<degree> rs) = listsp IT rs\"\n  apply (rule iffI)\n  apply (cases \"Var n \\<degree>\\<degree> rs\" rule:IT.cases, auto)\n  by (metis Var_apps_neq_Abs_apps foldl_Cons)\n  \nsubsection {* Every term in @{text \"IT\"} terminates *}\n\nlemma double_induction_lemma [rule_format]:\n  \"termip beta s ==> \\<forall>t. termip beta t -->\n    (\\<forall>r ss. t = r[s/0] \\<degree>\\<degree> ss --> termip beta (Abs r \\<degree> s \\<degree>\\<degree> ss))\"\n  apply (erule accp_induct)\n  apply (rule allI)\n  apply (rule impI)\n  apply (erule thin_rl)\n  apply (erule accp_induct)\n  apply clarify\n  apply (rule accp.accI)\n  apply (safe elim!: apps_betasE)\n    apply (blast intro: subst_preserves_beta apps_preserves_beta)\n   apply (blast intro: apps_preserves_beta2 subst_preserves_beta2 rtranclp_converseI\n     dest: accp_downwards)  (* FIXME: acc_downwards can be replaced by acc(R ^* ) = acc(r) *)\n  apply (blast dest: apps_preserves_betas)\n  done\n\nthm accI\n\nlemma tmp: \"listsp (termip (\\<rightarrow>\\<^sub>\\<beta>)) rs \\<Longrightarrow>\n       termip (\\<longrightarrow>\\<^sub>\\<beta>) body \\<Longrightarrow> termip (\\<rightarrow>\\<^sub>\\<beta>) (Proc body args ret \\<degree>\\<degree> rs)\"\n  apply (induction rs rule:rev_induct, simp_all)\n  apply (erule accp_induct[where r=\"(\\<longrightarrow>\\<^sub>\\<beta>\\<inverse>\\<inverse>)\"])\n  apply (rule accp.intros, metis beta_cases(4) conversep_iff)\n  apply (rule accp.intros)\n  unfolding conversep_iff\n  apply (cases rule:beta.cases)\n  using Abs_App_neq_Proc_apps xxx\nusing Abs_App_neq_Proc_apps[where ss=\"x#xs\", symmetric]\n  apply (rule beta_cases)\n  apply (rule accp_downward)\n  defer apply simp\napply clarify\n  apply (erule beta_cases)\n  apply (metisx beta'.simps)\napply (metis (full_types) beta_cases(5) program_rep.exhaust)\napply (metis (poly_guards_query) beta'.simps beta_cases(4))\n  apply (metis (mono_tags, hide_lams) beta'.simps beta_cases(4))\n    \n  apply (drule lists_accD) \n  apply (rule accp_downward)\n  defer\n  \n\n  apply (drule rev_predicate1D [OF _ listsp_mono [where B=\"termip beta\"]])\n    apply (fast intro!: predicate1I)\n    apply (drule lists_accD) \n    apply (erule accp_induct)\n    apply (rule accp.accI)\n    apply simp\n    apply (drule head_Proc_reduction)\n    apply (erule exE, erule conjE, clarify)\n    \nthm IT'_IT.inducts\noops\n  \nlemma IT_implies_termi: \"IT t ==> termip beta t\"\n  apply (induct taking: \"termip beta'\" set: IT)\n\n    apply (drule rev_predicate1D [OF _ listsp_mono [where B=\"termip beta\"]])\n    apply (fast intro!: predicate1I)\n    apply (drule lists_accD)\n    apply (erule accp_induct)\n    apply (rule accp.accI)\n    apply (blast dest: head_Var_reduction)\n   apply (erule accp_induct)\n   apply (rule accp.accI)\n   apply blast\n  apply (blast intro: double_induction_lemma)\n\n  apply (drule rev_predicate1D [OF _ listsp_mono [where B=\"termip beta\"]])\n    apply (fast intro!: predicate1I)\n    apply (drule lists_accD) \n    apply (erule accp_induct)\n    apply (rule accp.accI)\n    using head_Proc_reduction\n    apply (blaxst dest: head_Proc_reduction)\n\nterm \"\n\\<And>rs n x y.\n       Wellfounded.accp (step1 (\\<rightarrow>\\<^sub>\\<beta>\\<inverse>\\<inverse>)) x \\<Longrightarrow>\n       \\<forall>y. step1 (\\<rightarrow>\\<^sub>\\<beta>\\<inverse>\\<inverse>) y x \\<longrightarrow> termip (\\<rightarrow>\\<^sub>\\<beta>) (Var n \\<degree>\\<degree> y) \\<Longrightarrow>\n       (\\<rightarrow>\\<^sub>\\<beta>\\<inverse>\\<inverse>) y (Var n \\<degree>\\<degree> x) \\<Longrightarrow> termip (\\<rightarrow>\\<^sub>\\<beta>) y\n\"\n  done\n\n\n\nsubsection {* Every terminating term is in @{text \"IT\"} *}\n\ndeclare Var_apps_neq_Abs_apps [symmetric, simp]\n\nlemma [simp, THEN not_sym, simp]: \"Var n \\<degree>\\<degree> ss \\<noteq> Abs r \\<degree> s \\<degree>\\<degree> ts\"\n  by (simp add: foldl_Cons [symmetric] del: foldl_Cons)\n\n\n\ninductive_cases [elim!]:\n  \"IT (Var n \\<degree>\\<degree> ss)\"\n  \"IT (Abs t)\"\n  \"IT (Abs r \\<degree> s \\<degree>\\<degree> ts)\"\n  \"IT (Proc body args ret)\"\n\ntheorem Apps_dB_induct_tmp:\n  assumes \"!!n ts. \\<forall>t \\<in> set ts. P t ==> P (Var n \\<degree>\\<degree> ts)\"\n    and \"!!u ts. [| P u; \\<forall>t \\<in> set ts. P t |] ==> P (Abs u \\<degree>\\<degree> ts)\"\n    and \"\\<And>body args ret ts. \\<lbrakk> P' body; \\<forall>t \\<in> set ts. P t \\<rbrakk> \\<Longrightarrow> P (Proc body args ret \\<degree>\\<degree> ts)\"\n    and \"P' Skip\"\n  shows \"P' p\" and \"P t\"\nsorry\n\n(* XXX *)\ntheorem termi_implies_IT: \"termip beta r ==> IT r\"\n  apply (erule accp_induct)\n  apply (rename_tac r)\n  apply (erule thin_rl)\n  apply (erule rev_mp)\n  apply simp\n  apply (rule_tac t = r and P' = \"\\<lambda>p. (\\<forall>y. p \\<longrightarrow>\\<^sub>\\<beta> y \\<longrightarrow> IT' y) \\<longrightarrow> IT' p\" in Apps_dB_induct_tmp(2))\n   apply clarify (*4*)\n   apply (rule IT'_IT.intros) \n   apply clarify\n   apply (drule bspec, assumption)\n   apply (erule mp)\n   apply clarify\n   apply (drule_tac r=beta in conversepI)\n   apply (drule_tac r=\"beta^--1\" in ex_step1I, assumption)\n   apply clarify\n   apply (rename_tac us)\n   apply (erule_tac x = \"Var n \\<degree>\\<degree> us\" in allE)\n   apply (drule mp, rule apps_preserves_betas, simp, unfold Var_iff)\n   apply force(*3*)\n   apply (rename_tac u ts)\n   apply (case_tac ts)(*4*)\n    apply simp\n    apply blast(*3*)\n   apply (rename_tac s ss)\n   apply simp\n   apply clarify\n   apply (rule IT'_IT.intros)(*4*)\n    apply (blast intro: apps_preserves_beta)(*3*)\n   apply (erule mp)\n   apply clarify\n   apply (rename_tac t)\n   apply (erule_tac x = \"Abs u \\<degree> t \\<degree>\\<degree> ss\" in allE)\n   apply (drule_tac Q=\"IT (App (Abs u) t \\<degree>\\<degree> ss)\" in mp)(*4*)\n   apply force(*3*) \n   apply (unfold AppAbs_iff)\n   apply force   \n   \ndone\n\nby simp\nend \n\nsubsection {* Properties of @{text IT} *}\n\nlemma lift_IT [intro!]: \"IT t \\<Longrightarrow> IT (lift t i)\"\n  apply (induct arbitrary: i set: IT)\n    apply (simp (no_asm))\n    apply (rule conjI)\n     apply\n      (rule impI,\n       rule IT.Var,\n       erule listsp.induct,\n       simp (no_asm),\n       simp (no_asm),\n       rule listsp.Cons,\n       blast,\n       assumption)+\n     apply auto\n   done\n\nlemma lifts_IT: \"listsp IT ts \\<Longrightarrow> listsp IT (map (\\<lambda>t. lift t 0) ts)\"\n  by (induct ts) auto\n\nlemma subst_Var_IT: \"IT r \\<Longrightarrow> IT (r[Var i/j])\"\n  apply (induct arbitrary: i j set: IT)\n    txt {* Case @{term Var}: *}\n    apply (simp (no_asm) add: subst_Var)\n    apply\n    ((rule conjI impI)+,\n      rule IT.Var,\n      erule listsp.induct,\n      simp (no_asm),\n      simp (no_asm),\n      rule listsp.Cons,\n      fast,\n      assumption)+\n   txt {* Case @{term Lambda}: *}\n   apply atomize\n   apply simp\n   apply (rule IT.Lambda)\n   apply fastx\n  txt {* Case @{term Beta}: *}\n  apply atomize\n  apply (simp (no_asm_use) add: subst_subst [symmetric])\n  apply (rule IT.Beta)\n   apply auto\n  done\n\nlemma Var_IT: \"IT (Var n)\"\n  apply (subgoal_tac \"IT (Var n \\<degree>\\<degree> [])\")\n   apply simp\n  apply (rule IT.Var)\n  apply (rule listsp.Nil)\n  done\n\nlemma app_Var_IT: \"IT t \\<Longrightarrow> IT (t \\<degree> Var i)\"\n  apply (induct set: IT)\n    apply (subst app_last)\n    apply (rule IT.Var)\n    apply simp\n    apply (rule listsp.Cons)\n     apply (rule Var_IT)\n    apply (rule listsp.Nil)\n   apply (rule IT.Beta [where ?ss = \"[]\", unfolded foldl_Nil [THEN eq_reflection]])\n    apply (erule subst_Var_IT)\n   apply (rule Var_IT)\n  apply (subst app_last)\n  apply (rule IT.Beta)\n   apply (subst app_last [symmetric])\n   apply assumption\n  apply assumption\n  done\n\n\nsubsection {* Well-typed substitution preserves termination *}\n\nlemma subst_type_IT:\n  \"\\<And>t e T u i. IT t \\<Longrightarrow> e\\<langle>i:U\\<rangle> \\<turnstile> t : T \\<Longrightarrow>\n    IT u \\<Longrightarrow> e \\<turnstile> u : U \\<Longrightarrow> IT (t[u/i])\"\n  (is \"PROP ?P U\" is \"\\<And>t e T u i. _ \\<Longrightarrow> PROP ?Q t e T u i U\")\nproof (induct U)\n  fix T t\n  assume MI1: \"\\<And>T1 T2. T = T1 \\<Rightarrow> T2 \\<Longrightarrow> PROP ?P T1\"\n  assume MI2: \"\\<And>T1 T2. T = T1 \\<Rightarrow> T2 \\<Longrightarrow> PROP ?P T2\"\n  assume \"IT t\"\n  thus \"\\<And>e T' u i. PROP ?Q t e T' u i T\"\n  proof induct\n    fix e T' u i\n    assume uIT: \"IT u\"\n    assume uT: \"e \\<turnstile> u : T\"\n    {\n      case (Var rs n e1 T'1 u1 i1)\n      assume nT: \"e\\<langle>i:T\\<rangle> \\<turnstile> Var n \\<degree>\\<degree> rs : T'\"\n      let ?ty = \"\\<lambda>t. \\<exists>T'. e\\<langle>i:T\\<rangle> \\<turnstile> t : T'\"\n      let ?R = \"\\<lambda>t. \\<forall>e T' u i.\n        e\\<langle>i:T\\<rangle> \\<turnstile> t : T' \\<longrightarrow> IT u \\<longrightarrow> e \\<turnstile> u : T \\<longrightarrow> IT (t[u/i])\"\n      show \"IT ((Var n \\<degree>\\<degree> rs)[u/i])\"\n      proof (cases \"n = i\")\n        case True\n        show ?thesis\n        proof (cases rs)\n          case Nil\n          with uIT True show ?thesis by simp\n        next\n          case (Cons a as)\n          with nT have \"e\\<langle>i:T\\<rangle> \\<turnstile> Var n \\<degree> a \\<degree>\\<degree> as : T'\" by simp\n          then obtain Ts\n              where headT: \"e\\<langle>i:T\\<rangle> \\<turnstile> Var n \\<degree> a : Ts \\<Rrightarrow> T'\"\n              and argsT: \"e\\<langle>i:T\\<rangle> \\<tturnstile> as : Ts\"\n            by (rule list_app_typeE)\n          from headT obtain T''\n              where varT: \"e\\<langle>i:T\\<rangle> \\<turnstile> Var n : T'' \\<Rightarrow> Ts \\<Rrightarrow> T'\"\n              and argT: \"e\\<langle>i:T\\<rangle> \\<turnstile> a : T''\"\n            by cases simp_all\n          from varT True have T: \"T = T'' \\<Rightarrow> Ts \\<Rrightarrow> T'\"\n            by cases auto\n          with uT have uT': \"e \\<turnstile> u : T'' \\<Rightarrow> Ts \\<Rrightarrow> T'\" by simp\n          from T have \"IT ((Var 0 \\<degree>\\<degree> map (\\<lambda>t. lift t 0)\n            (map (\\<lambda>t. t[u/i]) as))[(u \\<degree> a[u/i])/0])\"\n          proof (rule MI2)\n            from T have \"IT ((lift u 0 \\<degree> Var 0)[a[u/i]/0])\"\n            proof (rule MI1)\n              have \"IT (lift u 0)\" by (rule lift_IT [OF uIT])\n              thus \"IT (lift u 0 \\<degree> Var 0)\" by (rule app_Var_IT)\n              show \"e\\<langle>0:T''\\<rangle> \\<turnstile> lift u 0 \\<degree> Var 0 : Ts \\<Rrightarrow> T'\"\n              proof (rule typing.App)\n                show \"e\\<langle>0:T''\\<rangle> \\<turnstile> lift u 0 : T'' \\<Rightarrow> Ts \\<Rrightarrow> T'\"\n                  by (rule lift_type) (rule uT')\n                show \"e\\<langle>0:T''\\<rangle> \\<turnstile> Var 0 : T''\"\n                  by (rule typing.Var) simp\n              qed\n              from Var have \"?R a\" by cases (simp_all add: Cons)\n              with argT uIT uT show \"IT (a[u/i])\" by simp\n              from argT uT show \"e \\<turnstile> a[u/i] : T''\"\n                by (rule subst_lemma) simp\n            qed\n            thus \"IT (u \\<degree> a[u/i])\" by simp\n            from Var have \"listsp ?R as\"\n              by cases (simp_all add: Cons)\n            moreover from argsT have \"listsp ?ty as\"\n              by (rule lists_typings)\n            ultimately have \"listsp (\\<lambda>t. ?R t \\<and> ?ty t) as\"\n              by simp\n            hence \"listsp IT (map (\\<lambda>t. lift t 0) (map (\\<lambda>t. t[u/i]) as))\"\n              (is \"listsp IT (?ls as)\")\n            proof induct\n              case Nil\n              show ?case by fastforce\n            next\n              case (Cons b bs)\n              hence I: \"?R b\" by simp\n              from Cons obtain U where \"e\\<langle>i:T\\<rangle> \\<turnstile> b : U\" by fast\n              with uT uIT I have \"IT (b[u/i])\" by simp\n              hence \"IT (lift (b[u/i]) 0)\" by (rule lift_IT)\n              hence \"listsp IT (lift (b[u/i]) 0 # ?ls bs)\"\n                by (rule listsp.Cons) (rule Cons)\n              thus ?case by simp\n            qed\n            thus \"IT (Var 0 \\<degree>\\<degree> ?ls as)\" by (rule IT.Var)\n            have \"e\\<langle>0:Ts \\<Rrightarrow> T'\\<rangle> \\<turnstile> Var 0 : Ts \\<Rrightarrow> T'\"\n              by (rule typing.Var) simp\n            moreover from uT argsT have \"e \\<tturnstile> map (\\<lambda>t. t[u/i]) as : Ts\"\n              by (rule substs_lemma)\n            hence \"e\\<langle>0:Ts \\<Rrightarrow> T'\\<rangle> \\<tturnstile> ?ls as : Ts\"\n              by (rule lift_types)\n            ultimately show \"e\\<langle>0:Ts \\<Rrightarrow> T'\\<rangle> \\<turnstile> Var 0 \\<degree>\\<degree> ?ls as : T'\"\n              by (rule list_app_typeI)\n            from argT uT have \"e \\<turnstile> a[u/i] : T''\"\n              by (rule subst_lemma) (rule refl)\n            with uT' show \"e \\<turnstile> u \\<degree> a[u/i] : Ts \\<Rrightarrow> T'\"\n              by (rule typing.App)\n          qed\n          with Cons True show ?thesis\n            by (simp add: comp_def)\n        qed\n      next\n        case False\n        from Var have \"listsp ?R rs\" by simp\n        moreover from nT obtain Ts where \"e\\<langle>i:T\\<rangle> \\<tturnstile> rs : Ts\"\n          by (rule list_app_typeE)\n        hence \"listsp ?ty rs\" by (rule lists_typings)\n        ultimately have \"listsp (\\<lambda>t. ?R t \\<and> ?ty t) rs\"\n          by simp\n        hence \"listsp IT (map (\\<lambda>x. x[u/i]) rs)\"\n        proof induct\n          case Nil\n          show ?case by fastforce\n        next\n          case (Cons a as)\n          hence I: \"?R a\" by simp\n          from Cons obtain U where \"e\\<langle>i:T\\<rangle> \\<turnstile> a : U\" by fast\n          with uT uIT I have \"IT (a[u/i])\" by simp\n          hence \"listsp IT (a[u/i] # map (\\<lambda>t. t[u/i]) as)\"\n            by (rule listsp.Cons) (rule Cons)\n          thus ?case by simp\n        qed\n        with False show ?thesis by (auto simp add: subst_Var)\n      qed\n    next\n      case (Lambda r e1 T'1 u1 i1)\n      assume \"e\\<langle>i:T\\<rangle> \\<turnstile> Abs r : T'\"\n        and \"\\<And>e T' u i. PROP ?Q r e T' u i T\"\n      with uIT uT show \"IT (Abs r[u/i])\"\n        by fastforce\n    next\n      case (Beta r a as e1 T'1 u1 i1)\n      assume T: \"e\\<langle>i:T\\<rangle> \\<turnstile> Abs r \\<degree> a \\<degree>\\<degree> as : T'\"\n      assume SI1: \"\\<And>e T' u i. PROP ?Q (r[a/0] \\<degree>\\<degree> as) e T' u i T\"\n      assume SI2: \"\\<And>e T' u i. PROP ?Q a e T' u i T\"\n      have \"IT (Abs (r[lift u 0/Suc i]) \\<degree> a[u/i] \\<degree>\\<degree> map (\\<lambda>t. t[u/i]) as)\"\n      proof (rule IT.Beta)\n        have \"Abs r \\<degree> a \\<degree>\\<degree> as \\<rightarrow>\\<^sub>\\<beta> r[a/0] \\<degree>\\<degree> as\"\n          by (rule apps_preserves_beta) (rule beta.beta)\n        with T have \"e\\<langle>i:T\\<rangle> \\<turnstile> r[a/0] \\<degree>\\<degree> as : T'\"\n          by (rule subject_reduction)\n        hence \"IT ((r[a/0] \\<degree>\\<degree> as)[u/i])\"\n          using uIT uT by (rule SI1)\n        thus \"IT (r[lift u 0/Suc i][a[u/i]/0] \\<degree>\\<degree> map (\\<lambda>t. t[u/i]) as)\"\n          by (simp del: subst_map add: subst_subst subst_map [symmetric])\n        from T obtain U where \"e\\<langle>i:T\\<rangle> \\<turnstile> Abs r \\<degree> a : U\"\n          by (rule list_app_typeE) fast\n        then obtain T'' where \"e\\<langle>i:T\\<rangle> \\<turnstile> a : T''\" by cases simp_all\n        thus \"IT (a[u/i])\" using uIT uT by (rule SI2)\n      qed\n      thus \"IT ((Abs r \\<degree> a \\<degree>\\<degree> as)[u/i])\" by simp\n    }\n  qed\nqed\n\n\nsubsection {* Well-typed terms are strongly normalizing *}\n\nlemma type_implies_IT:\n  assumes \"e \\<turnstile> t : T\"\n  shows \"IT t\"\n  using assms\nproof induct\n  case Var\n  show ?case by (rule Var_IT)\nnext\n  case Abs\n  show ?case by (rule IT.Lambda) (rule Abs)\nnext\n  case (App e s T U t)\n  have \"IT ((Var 0 \\<degree> lift t 0)[s/0])\"\n  proof (rule subst_type_IT)\n    have \"IT (lift t 0)\" using `IT t` by (rule lift_IT)\n    hence \"listsp IT [lift t 0]\" by (rule listsp.Cons) (rule listsp.Nil)\n    hence \"IT (Var 0 \\<degree>\\<degree> [lift t 0])\" by (rule IT.Var)\n    also have \"Var 0 \\<degree>\\<degree> [lift t 0] = Var 0 \\<degree> lift t 0\" by simp\n    finally show \"IT \\<dots>\" .\n    have \"e\\<langle>0:T \\<Rightarrow> U\\<rangle> \\<turnstile> Var 0 : T \\<Rightarrow> U\"\n      by (rule typing.Var) simp\n    moreover have \"e\\<langle>0:T \\<Rightarrow> U\\<rangle> \\<turnstile> lift t 0 : T\"\n      by (rule lift_type) (rule App.hyps)\n    ultimately show \"e\\<langle>0:T \\<Rightarrow> U\\<rangle> \\<turnstile> Var 0 \\<degree> lift t 0 : U\"\n      by (rule typing.App)\n    show \"IT s\" by fact\n    show \"e \\<turnstile> s : T \\<Rightarrow> U\" by fact\n  qed\n  thus ?case by simp\nqed\n\ntheorem type_implies_termi: \"e \\<turnstile> t : T \\<Longrightarrow> termip beta t\"\nproof -\n  assume \"e \\<turnstile> t : T\"\n  hence \"IT t\" by (rule type_implies_IT)\n  thus ?thesis by (rule IT_implies_termi)\nqed\n\n", "meta": {"author": "dominique-unruh", "repo": "IsaCrypt", "sha": "1abc2041871af7b758adcc914b83f0d9135ec129", "save_path": "github-repos/isabelle/dominique-unruh-IsaCrypt", "path": "github-repos/isabelle/dominique-unruh-IsaCrypt/IsaCrypt-1abc2041871af7b758adcc914b83f0d9135ec129/old/ProcStrongNorm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5350984434543458, "lm_q2_score": 0.6187804267137442, "lm_q1q2_score": 0.3311084431745404}}
{"text": "(*  Title:      HOL/HOLCF/Domain.thy\n    Author:     Brian Huffman\n*)\n\nsection {* Domain package *}\n\ntheory Domain\nimports Representable Domain_Aux\nkeywords\n  \"domaindef\" :: thy_decl and \"lazy\" \"unsafe\" and\n  \"domain_isomorphism\" \"domain\" :: thy_decl\nbegin\n\ndefault_sort \"domain\"\n\nsubsection {* Representations of types *}\n\nlemma emb_prj: \"emb\\<cdot>((prj\\<cdot>x)::'a) = cast\\<cdot>DEFL('a)\\<cdot>x\"\nby (simp add: cast_DEFL)\n\nlemma emb_prj_emb:\n  fixes x :: \"'a\"\n  assumes \"DEFL('a) \\<sqsubseteq> DEFL('b)\"\n  shows \"emb\\<cdot>(prj\\<cdot>(emb\\<cdot>x) :: 'b) = emb\\<cdot>x\"\nunfolding emb_prj\napply (rule cast.belowD)\napply (rule monofun_cfun_arg [OF assms])\napply (simp add: cast_DEFL)\ndone\n\nlemma prj_emb_prj:\n  assumes \"DEFL('a) \\<sqsubseteq> DEFL('b)\"\n  shows \"prj\\<cdot>(emb\\<cdot>(prj\\<cdot>x :: 'b)) = (prj\\<cdot>x :: 'a)\"\n apply (rule emb_eq_iff [THEN iffD1])\n apply (simp only: emb_prj)\n apply (rule deflation_below_comp1)\n   apply (rule deflation_cast)\n  apply (rule deflation_cast)\n apply (rule monofun_cfun_arg [OF assms])\ndone\n\ntext {* Isomorphism lemmas used internally by the domain package: *}\n\nlemma domain_abs_iso:\n  fixes abs and rep\n  assumes DEFL: \"DEFL('b) = DEFL('a)\"\n  assumes abs_def: \"(abs :: 'a \\<rightarrow> 'b) \\<equiv> prj oo emb\"\n  assumes rep_def: \"(rep :: 'b \\<rightarrow> 'a) \\<equiv> prj oo emb\"\n  shows \"rep\\<cdot>(abs\\<cdot>x) = x\"\nunfolding abs_def rep_def\nby (simp add: emb_prj_emb DEFL)\n\nlemma domain_rep_iso:\n  fixes abs and rep\n  assumes DEFL: \"DEFL('b) = DEFL('a)\"\n  assumes abs_def: \"(abs :: 'a \\<rightarrow> 'b) \\<equiv> prj oo emb\"\n  assumes rep_def: \"(rep :: 'b \\<rightarrow> 'a) \\<equiv> prj oo emb\"\n  shows \"abs\\<cdot>(rep\\<cdot>x) = x\"\nunfolding abs_def rep_def\nby (simp add: emb_prj_emb DEFL)\n\nsubsection {* Deflations as sets *}\n\ndefinition defl_set :: \"'a::bifinite defl \\<Rightarrow> 'a set\"\nwhere \"defl_set A = {x. cast\\<cdot>A\\<cdot>x = x}\"\n\nlemma adm_defl_set: \"adm (\\<lambda>x. x \\<in> defl_set A)\"\nunfolding defl_set_def by simp\n\nlemma defl_set_bottom: \"\\<bottom> \\<in> defl_set A\"\nunfolding defl_set_def by simp\n\nlemma defl_set_cast [simp]: \"cast\\<cdot>A\\<cdot>x \\<in> defl_set A\"\nunfolding defl_set_def by simp\n\nlemma defl_set_subset_iff: \"defl_set A \\<subseteq> defl_set B \\<longleftrightarrow> A \\<sqsubseteq> B\"\napply (simp add: defl_set_def subset_eq cast_below_cast [symmetric])\napply (auto simp add: cast.belowI cast.belowD)\ndone\n\nsubsection {* Proving a subtype is representable *}\n\ntext {* Temporarily relax type constraints. *}\n\nsetup {*\n  fold Sign.add_const_constraint\n  [ (@{const_name defl}, SOME @{typ \"'a::pcpo itself \\<Rightarrow> udom defl\"})\n  , (@{const_name emb}, SOME @{typ \"'a::pcpo \\<rightarrow> udom\"})\n  , (@{const_name prj}, SOME @{typ \"udom \\<rightarrow> 'a::pcpo\"})\n  , (@{const_name liftdefl}, SOME @{typ \"'a::pcpo itself \\<Rightarrow> udom u defl\"})\n  , (@{const_name liftemb}, SOME @{typ \"'a::pcpo u \\<rightarrow> udom u\"})\n  , (@{const_name liftprj}, SOME @{typ \"udom u \\<rightarrow> 'a::pcpo u\"}) ]\n*}\n\nlemma typedef_domain_class:\n  fixes Rep :: \"'a::pcpo \\<Rightarrow> udom\"\n  fixes Abs :: \"udom \\<Rightarrow> 'a::pcpo\"\n  fixes t :: \"udom defl\"\n  assumes type: \"type_definition Rep Abs (defl_set t)\"\n  assumes below: \"op \\<sqsubseteq> \\<equiv> \\<lambda>x y. Rep x \\<sqsubseteq> Rep y\"\n  assumes emb: \"emb \\<equiv> (\\<Lambda> x. Rep x)\"\n  assumes prj: \"prj \\<equiv> (\\<Lambda> x. Abs (cast\\<cdot>t\\<cdot>x))\"\n  assumes defl: \"defl \\<equiv> (\\<lambda> a::'a itself. t)\"\n  assumes liftemb: \"(liftemb :: 'a u \\<rightarrow> udom u) \\<equiv> u_map\\<cdot>emb\"\n  assumes liftprj: \"(liftprj :: udom u \\<rightarrow> 'a u) \\<equiv> u_map\\<cdot>prj\"\n  assumes liftdefl: \"(liftdefl :: 'a itself \\<Rightarrow> _) \\<equiv> (\\<lambda>t. liftdefl_of\\<cdot>DEFL('a))\"\n  shows \"OFCLASS('a, domain_class)\"\nproof\n  have emb_beta: \"\\<And>x. emb\\<cdot>x = Rep x\"\n    unfolding emb\n    apply (rule beta_cfun)\n    apply (rule typedef_cont_Rep [OF type below adm_defl_set cont_id])\n    done\n  have prj_beta: \"\\<And>y. prj\\<cdot>y = Abs (cast\\<cdot>t\\<cdot>y)\"\n    unfolding prj\n    apply (rule beta_cfun)\n    apply (rule typedef_cont_Abs [OF type below adm_defl_set])\n    apply simp_all\n    done\n  have prj_emb: \"\\<And>x::'a. prj\\<cdot>(emb\\<cdot>x) = x\"\n    using type_definition.Rep [OF type]\n    unfolding prj_beta emb_beta defl_set_def\n    by (simp add: type_definition.Rep_inverse [OF type])\n  have emb_prj: \"\\<And>y. emb\\<cdot>(prj\\<cdot>y :: 'a) = cast\\<cdot>t\\<cdot>y\"\n    unfolding prj_beta emb_beta\n    by (simp add: type_definition.Abs_inverse [OF type])\n  show \"ep_pair (emb :: 'a \\<rightarrow> udom) prj\"\n    apply default\n    apply (simp add: prj_emb)\n    apply (simp add: emb_prj cast.below)\n    done\n  show \"cast\\<cdot>DEFL('a) = emb oo (prj :: udom \\<rightarrow> 'a)\"\n    by (rule cfun_eqI, simp add: defl emb_prj)\nqed (simp_all only: liftemb liftprj liftdefl)\n\nlemma typedef_DEFL:\n  assumes \"defl \\<equiv> (\\<lambda>a::'a::pcpo itself. t)\"\n  shows \"DEFL('a::pcpo) = t\"\nunfolding assms ..\n\ntext {* Restore original typing constraints. *}\n\nsetup {*\n  fold Sign.add_const_constraint\n  [ (@{const_name defl}, SOME @{typ \"'a::domain itself \\<Rightarrow> udom defl\"})\n  , (@{const_name emb}, SOME @{typ \"'a::domain \\<rightarrow> udom\"})\n  , (@{const_name prj}, SOME @{typ \"udom \\<rightarrow> 'a::domain\"})\n  , (@{const_name liftdefl}, SOME @{typ \"'a::predomain itself \\<Rightarrow> udom u defl\"})\n  , (@{const_name liftemb}, SOME @{typ \"'a::predomain u \\<rightarrow> udom u\"})\n  , (@{const_name liftprj}, SOME @{typ \"udom u \\<rightarrow> 'a::predomain u\"}) ]\n*}\n\nML_file \"Tools/domaindef.ML\"\n\nsubsection {* Isomorphic deflations *}\n\ndefinition isodefl :: \"('a \\<rightarrow> 'a) \\<Rightarrow> udom defl \\<Rightarrow> bool\"\n  where \"isodefl d t \\<longleftrightarrow> cast\\<cdot>t = emb oo d oo prj\"\n\ndefinition isodefl' :: \"('a::predomain \\<rightarrow> 'a) \\<Rightarrow> udom u defl \\<Rightarrow> bool\"\n  where \"isodefl' d t \\<longleftrightarrow> cast\\<cdot>t = liftemb oo u_map\\<cdot>d oo liftprj\"\n\nlemma isodeflI: \"(\\<And>x. cast\\<cdot>t\\<cdot>x = emb\\<cdot>(d\\<cdot>(prj\\<cdot>x))) \\<Longrightarrow> isodefl d t\"\nunfolding isodefl_def by (simp add: cfun_eqI)\n\nlemma cast_isodefl: \"isodefl d t \\<Longrightarrow> cast\\<cdot>t = (\\<Lambda> x. emb\\<cdot>(d\\<cdot>(prj\\<cdot>x)))\"\nunfolding isodefl_def by (simp add: cfun_eqI)\n\nlemma isodefl_strict: \"isodefl d t \\<Longrightarrow> d\\<cdot>\\<bottom> = \\<bottom>\"\nunfolding isodefl_def\nby (drule cfun_fun_cong [where x=\"\\<bottom>\"], simp)\n\nlemma isodefl_imp_deflation:\n  fixes d :: \"'a \\<rightarrow> 'a\"\n  assumes \"isodefl d t\" shows \"deflation d\"\nproof\n  note assms [unfolded isodefl_def, simp]\n  fix x :: 'a\n  show \"d\\<cdot>(d\\<cdot>x) = d\\<cdot>x\"\n    using cast.idem [of t \"emb\\<cdot>x\"] by simp\n  show \"d\\<cdot>x \\<sqsubseteq> x\"\n    using cast.below [of t \"emb\\<cdot>x\"] by simp\nqed\n\nlemma isodefl_ID_DEFL: \"isodefl (ID :: 'a \\<rightarrow> 'a) DEFL('a)\"\nunfolding isodefl_def by (simp add: cast_DEFL)\n\nlemma isodefl_LIFTDEFL:\n  \"isodefl' (ID :: 'a \\<rightarrow> 'a) LIFTDEFL('a::predomain)\"\nunfolding isodefl'_def by (simp add: cast_liftdefl u_map_ID)\n\nlemma isodefl_DEFL_imp_ID: \"isodefl (d :: 'a \\<rightarrow> 'a) DEFL('a) \\<Longrightarrow> d = ID\"\nunfolding isodefl_def\napply (simp add: cast_DEFL)\napply (simp add: cfun_eq_iff)\napply (rule allI)\napply (drule_tac x=\"emb\\<cdot>x\" in spec)\napply simp\ndone\n\nlemma isodefl_bottom: \"isodefl \\<bottom> \\<bottom>\"\nunfolding isodefl_def by (simp add: cfun_eq_iff)\n\nlemma adm_isodefl:\n  \"cont f \\<Longrightarrow> cont g \\<Longrightarrow> adm (\\<lambda>x. isodefl (f x) (g x))\"\nunfolding isodefl_def by simp\n\nlemma isodefl_lub:\n  assumes \"chain d\" and \"chain t\"\n  assumes \"\\<And>i. isodefl (d i) (t i)\"\n  shows \"isodefl (\\<Squnion>i. d i) (\\<Squnion>i. t i)\"\nusing assms unfolding isodefl_def\nby (simp add: contlub_cfun_arg contlub_cfun_fun)\n\nlemma isodefl_fix:\n  assumes \"\\<And>d t. isodefl d t \\<Longrightarrow> isodefl (f\\<cdot>d) (g\\<cdot>t)\"\n  shows \"isodefl (fix\\<cdot>f) (fix\\<cdot>g)\"\nunfolding fix_def2\napply (rule isodefl_lub, simp, simp)\napply (induct_tac i)\napply (simp add: isodefl_bottom)\napply (simp add: assms)\ndone\n\nlemma isodefl_abs_rep:\n  fixes abs and rep and d\n  assumes DEFL: \"DEFL('b) = DEFL('a)\"\n  assumes abs_def: \"(abs :: 'a \\<rightarrow> 'b) \\<equiv> prj oo emb\"\n  assumes rep_def: \"(rep :: 'b \\<rightarrow> 'a) \\<equiv> prj oo emb\"\n  shows \"isodefl d t \\<Longrightarrow> isodefl (abs oo d oo rep) t\"\nunfolding isodefl_def\nby (simp add: cfun_eq_iff assms prj_emb_prj emb_prj_emb)\n\nlemma isodefl'_liftdefl_of: \"isodefl d t \\<Longrightarrow> isodefl' d (liftdefl_of\\<cdot>t)\"\nunfolding isodefl_def isodefl'_def\nby (simp add: cast_liftdefl_of u_map_oo liftemb_eq liftprj_eq)\n\nlemma isodefl_sfun:\n  \"isodefl d1 t1 \\<Longrightarrow> isodefl d2 t2 \\<Longrightarrow>\n    isodefl (sfun_map\\<cdot>d1\\<cdot>d2) (sfun_defl\\<cdot>t1\\<cdot>t2)\"\napply (rule isodeflI)\napply (simp add: cast_sfun_defl cast_isodefl)\napply (simp add: emb_sfun_def prj_sfun_def)\napply (simp add: sfun_map_map isodefl_strict)\ndone\n\nlemma isodefl_ssum:\n  \"isodefl d1 t1 \\<Longrightarrow> isodefl d2 t2 \\<Longrightarrow>\n    isodefl (ssum_map\\<cdot>d1\\<cdot>d2) (ssum_defl\\<cdot>t1\\<cdot>t2)\"\napply (rule isodeflI)\napply (simp add: cast_ssum_defl cast_isodefl)\napply (simp add: emb_ssum_def prj_ssum_def)\napply (simp add: ssum_map_map isodefl_strict)\ndone\n\nlemma isodefl_sprod:\n  \"isodefl d1 t1 \\<Longrightarrow> isodefl d2 t2 \\<Longrightarrow>\n    isodefl (sprod_map\\<cdot>d1\\<cdot>d2) (sprod_defl\\<cdot>t1\\<cdot>t2)\"\napply (rule isodeflI)\napply (simp add: cast_sprod_defl cast_isodefl)\napply (simp add: emb_sprod_def prj_sprod_def)\napply (simp add: sprod_map_map isodefl_strict)\ndone\n\nlemma isodefl_prod:\n  \"isodefl d1 t1 \\<Longrightarrow> isodefl d2 t2 \\<Longrightarrow>\n    isodefl (prod_map\\<cdot>d1\\<cdot>d2) (prod_defl\\<cdot>t1\\<cdot>t2)\"\napply (rule isodeflI)\napply (simp add: cast_prod_defl cast_isodefl)\napply (simp add: emb_prod_def prj_prod_def)\napply (simp add: prod_map_map cfcomp1)\ndone\n\nlemma isodefl_u:\n  \"isodefl d t \\<Longrightarrow> isodefl (u_map\\<cdot>d) (u_defl\\<cdot>t)\"\napply (rule isodeflI)\napply (simp add: cast_u_defl cast_isodefl)\napply (simp add: emb_u_def prj_u_def liftemb_eq liftprj_eq u_map_map)\ndone\n\nlemma isodefl_u_liftdefl:\n  \"isodefl' d t \\<Longrightarrow> isodefl (u_map\\<cdot>d) (u_liftdefl\\<cdot>t)\"\napply (rule isodeflI)\napply (simp add: cast_u_liftdefl isodefl'_def)\napply (simp add: emb_u_def prj_u_def liftemb_eq liftprj_eq)\ndone\n\nlemma encode_prod_u_map:\n  \"encode_prod_u\\<cdot>(u_map\\<cdot>(prod_map\\<cdot>f\\<cdot>g)\\<cdot>(decode_prod_u\\<cdot>x))\n    = sprod_map\\<cdot>(u_map\\<cdot>f)\\<cdot>(u_map\\<cdot>g)\\<cdot>x\"\nunfolding encode_prod_u_def decode_prod_u_def\napply (case_tac x, simp, rename_tac a b)\napply (case_tac a, simp, case_tac b, simp, simp)\ndone\n\nlemma isodefl_prod_u:\n  assumes \"isodefl' d1 t1\" and \"isodefl' d2 t2\"\n  shows \"isodefl' (prod_map\\<cdot>d1\\<cdot>d2) (prod_liftdefl\\<cdot>t1\\<cdot>t2)\"\nusing assms unfolding isodefl'_def\nunfolding liftemb_prod_def liftprj_prod_def\nby (simp add: cast_prod_liftdefl cfcomp1 encode_prod_u_map sprod_map_map)\n\nlemma encode_cfun_map:\n  \"encode_cfun\\<cdot>(cfun_map\\<cdot>f\\<cdot>g\\<cdot>(decode_cfun\\<cdot>x))\n    = sfun_map\\<cdot>(u_map\\<cdot>f)\\<cdot>g\\<cdot>x\"\nunfolding encode_cfun_def decode_cfun_def\napply (simp add: sfun_eq_iff cfun_map_def sfun_map_def)\napply (rule cfun_eqI, rename_tac y, case_tac y, simp_all)\ndone\n\nlemma isodefl_cfun:\n  assumes \"isodefl (u_map\\<cdot>d1) t1\" and \"isodefl d2 t2\"\n  shows \"isodefl (cfun_map\\<cdot>d1\\<cdot>d2) (sfun_defl\\<cdot>t1\\<cdot>t2)\"\nusing isodefl_sfun [OF assms] unfolding isodefl_def\nby (simp add: emb_cfun_def prj_cfun_def cfcomp1 encode_cfun_map)\n\nsubsection {* Setting up the domain package *}\n\nnamed_theorems domain_defl_simps \"theorems like DEFL('a t) = t_defl$DEFL('a)\"\n  and domain_isodefl \"theorems like isodefl d t ==> isodefl (foo_map$d) (foo_defl$t)\"\n\nML_file \"Tools/Domain/domain_isomorphism.ML\"\nML_file \"Tools/Domain/domain_axioms.ML\"\nML_file \"Tools/Domain/domain.ML\"\n\nlemmas [domain_defl_simps] =\n  DEFL_cfun DEFL_sfun DEFL_ssum DEFL_sprod DEFL_prod DEFL_u\n  liftdefl_eq LIFTDEFL_prod u_liftdefl_liftdefl_of\n\nlemmas [domain_map_ID] =\n  cfun_map_ID sfun_map_ID ssum_map_ID sprod_map_ID prod_map_ID u_map_ID\n\nlemmas [domain_isodefl] =\n  isodefl_u isodefl_sfun isodefl_ssum isodefl_sprod\n  isodefl_cfun isodefl_prod isodefl_prod_u isodefl'_liftdefl_of\n  isodefl_u_liftdefl\n\nlemmas [domain_deflation] =\n  deflation_cfun_map deflation_sfun_map deflation_ssum_map\n  deflation_sprod_map deflation_prod_map deflation_u_map\n\nsetup {*\n  fold Domain_Take_Proofs.add_rec_type\n    [(@{type_name cfun}, [true, true]),\n     (@{type_name \"sfun\"}, [true, true]),\n     (@{type_name ssum}, [true, true]),\n     (@{type_name sprod}, [true, true]),\n     (@{type_name prod}, [true, true]),\n     (@{type_name \"u\"}, [true])]\n*}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/Domain.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804337438502, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.33110843776122734}}
{"text": "(*  Title:      HOL/Statespace/StateFun.thy\n    Author:     Norbert Schirmer, TU Muenchen\n*)\n\nsection \\<open>State Space Representation as Function \\label{sec:StateFun}\\<close>\n\ntheory StateFun imports DistinctTreeProver \nbegin\n\n\ntext \\<open>The state space is represented as a function from names to\nvalues. We neither fix the type of names nor the type of values. We\ndefine lookup and update functions and provide simprocs that simplify\nexpressions containing these, similar to HOL-records.\n\nThe lookup and update function get constructor/destructor functions as\nparameters. These are used to embed various HOL-types into the\nabstract value type. Conceptually the abstract value type is a sum of\nall types that we attempt to store in the state space.\n\nThe update is actually generalized to a map function. The map supplies\nbetter compositionality, especially if you think of nested state\nspaces.\\<close> \n\ndefinition K_statefun :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'a\" where \"K_statefun c x \\<equiv> c\"\n\nlemma K_statefun_apply [simp]: \"K_statefun c x = c\"\n  by (simp add: K_statefun_def)\n\nlemma K_statefun_comp [simp]: \"(K_statefun c \\<circ> f) = K_statefun c\"\n  by (rule ext) (simp add: comp_def)\n\nlemma K_statefun_cong [cong]: \"K_statefun c x = K_statefun c x\"\n  by (rule refl)\n\ndefinition lookup :: \"('v \\<Rightarrow> 'a) \\<Rightarrow> 'n \\<Rightarrow> ('n \\<Rightarrow> 'v) \\<Rightarrow> 'a\"\n  where \"lookup destr n s = destr (s n)\"\n\ndefinition update ::\n  \"('v \\<Rightarrow> 'a1) \\<Rightarrow> ('a2 \\<Rightarrow> 'v) \\<Rightarrow> 'n \\<Rightarrow> ('a1 \\<Rightarrow> 'a2) \\<Rightarrow> ('n \\<Rightarrow> 'v) \\<Rightarrow> ('n \\<Rightarrow> 'v)\"\n  where \"update destr constr n f s = s(n := constr (f (destr (s n))))\"\n\nlemma lookup_update_same:\n  \"(\\<And>v. destr (constr v) = v) \\<Longrightarrow> lookup destr n (update destr constr n f s) = \n         f (destr (s n))\"  \n  by (simp add: lookup_def update_def)\n\nlemma lookup_update_id_same:\n  \"lookup destr n (update destr' id n (K_statefun (lookup id n s')) s) =                  \n     lookup destr n s'\"  \n  by (simp add: lookup_def update_def)\n\nlemma lookup_update_other:\n  \"n\\<noteq>m \\<Longrightarrow> lookup destr n (update destr' constr m f s) = lookup destr n s\"  \n  by (simp add: lookup_def update_def)\n\n\nlemma id_id_cancel: \"id (id x) = x\" \n  by (simp add: id_def)\n  \nlemma destr_contstr_comp_id: \"(\\<And>v. destr (constr v) = v) \\<Longrightarrow> destr \\<circ> constr = id\"\n  by (rule ext) simp\n\n\n\nlemma block_conj_cong: \"(P \\<and> Q) = (P \\<and> Q)\"\n  by simp\n\nlemma conj1_False: \"P \\<equiv> False \\<Longrightarrow> (P \\<and> Q) \\<equiv> False\"\n  by simp\n\nlemma conj2_False: \"Q \\<equiv> False \\<Longrightarrow> (P \\<and> Q) \\<equiv> False\"\n  by simp\n\nlemma conj_True: \"P \\<equiv> True \\<Longrightarrow> Q \\<equiv> True \\<Longrightarrow> (P \\<and> Q) \\<equiv> True\"\n  by simp\n\nlemma conj_cong: \"P \\<equiv> P' \\<Longrightarrow> Q \\<equiv> Q' \\<Longrightarrow> (P \\<and> Q) \\<equiv> (P' \\<and> Q')\"\n  by simp\n\n\nlemma update_apply: \"(update destr constr n f s x) = \n     (if x=n then constr (f (destr (s n))) else s x)\"\n  by (simp add: update_def)\n\nlemma ex_id: \"\\<exists>x. id x = y\"\n  by (simp add: id_def)\n\nlemma swap_ex_eq: \n  \"\\<exists>s. f s = x \\<equiv> True \\<Longrightarrow>\n   \\<exists>s. x = f s \\<equiv> True\"\n  apply (rule eq_reflection)\n  apply auto\n  done\n\nlemmas meta_ext = eq_reflection [OF ext]\n\n(* This lemma only works if the store is welltyped:\n    \"\\<exists>x.  s ''n'' = (c x)\" \n   or in general when c (d x) = x,\n     (for example: c=id and d=id)\n *)\nlemma \"update d c n (K_statespace (lookup d n s)) s = s\"\n  apply (simp add: update_def lookup_def)\n  apply (rule ext)\n  apply simp\n  oops\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Statespace/StateFun.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3311084377612273}}
{"text": "subsection \\<open>Congruence Method\\<close>\n\ntext \\<open>The following is a method for proving equalities of large terms by checking the equivalence\nof subterms. It is possible to precisely control which operators to split by.\\<close>\n\ntheory Extra_Congruence_Method\n  imports Main \"HOL-Eisbach.Eisbach\"\nbegin\n\ndatatype cong_tag_type = CongTag\n\ndefinition cong_tag_1 :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> cong_tag_type\" \n  where \"cong_tag_1 x = CongTag\"\ndefinition cong_tag_2 :: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'c) \\<Rightarrow> cong_tag_type\"\n  where \"cong_tag_2 x = CongTag\"\ndefinition cong_tag_3 :: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'd) \\<Rightarrow> cong_tag_type\" \n  where \"cong_tag_3 x = CongTag\"\n\nlemma arg_cong3:\n  assumes \"x1 = x2\" \"y1 = y2\" \"z1 = z2\"\n  shows \"f x1 y1 z1 = f x2 y2 z2\"\n  using assms by auto\n\nmethod intro_cong for A :: \"cong_tag_type list\" uses more = \n  (match (A) in \n      \"cong_tag_1 f#h\" (multi) for f :: \"'a \\<Rightarrow> 'b\" and h \n        \\<Rightarrow> \\<open>intro_cong h more:more arg_cong[where f=\"f\"]\\<close>\n    \\<bar> \"cong_tag_2 f#h\" (multi) for f :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'c\" and h \n        \\<Rightarrow> \\<open>intro_cong h more:more arg_cong2[where f=\"f\"]\\<close>\n    \\<bar> \"cong_tag_3 f#h\" (multi) for f :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'd\" and h \n        \\<Rightarrow> \\<open>intro_cong h more:more arg_cong3[where f=\"f\"]\\<close>\n    \\<bar> _ \\<Rightarrow> \\<open>intro more refl\\<close>)\n\nbundle intro_cong_syntax\nbegin\n  notation cong_tag_1 (\"\\<sigma>\\<^sub>1\")\n  notation cong_tag_2 (\"\\<sigma>\\<^sub>2\")\n  notation cong_tag_3 (\"\\<sigma>\\<^sub>3\")\nend\n\nbundle no_intro_cong_syntax\nbegin\n  no_notation cong_tag_1 (\"\\<sigma>\\<^sub>1\")\n  no_notation cong_tag_2 (\"\\<sigma>\\<^sub>2\")\n  no_notation cong_tag_3 (\"\\<sigma>\\<^sub>3\")\nend\n\nlemma restr_Collect_cong:\n  assumes \"\\<And>x. x \\<in> A \\<Longrightarrow> P x = Q x\"\n  shows \"{x \\<in> A. P x} = {x \\<in> A. Q x}\"\n  using assms by auto\n\nend\n\n\n", "meta": {"author": "ekarayel", "repo": "distributed-distinct-elements-formalization", "sha": "0fe0146cfb86bcfa79957e46d243426e6c5cea4e", "save_path": "github-repos/isabelle/ekarayel-distributed-distinct-elements-formalization", "path": "github-repos/isabelle/ekarayel-distributed-distinct-elements-formalization/distributed-distinct-elements-formalization-0fe0146cfb86bcfa79957e46d243426e6c5cea4e/Expander_Graphs/Extra_Congruence_Method.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5350984137988772, "lm_q2_score": 0.6187804337438501, "lm_q1q2_score": 0.33110842858611544}}
{"text": "section {* Designs *}\n\ntheory utp_designs\nimports\n  \"../utp/utp\"\nbegin\n\ntext {* In UTP, in order to explicitly record the termination of a program,\na subset of alphabetized relations is introduced. These relations are called\ndesigns and their alphabet should contain the special boolean observational variable ok.\nIt is used to record the start and termination of a program. *}\n\nsubsection {* Definitions *}\n\nnamed_theorems ndes and ndes_simp\n  \ntext {* In the following, the definitions of designs alphabets, designs and\nhealthiness (well-formedness) conditions are given. The healthiness conditions of\ndesigns are defined by $H1$, $H2$, $H3$ and $H4$.*}\n\nalphabet des_vars =\n  ok :: bool\n\ntext {*\n  The two locale interpretations below are a technicality to improve automatic\n  proof support via the predicate and relational tactics. This is to enable the\n  (re-)interpretation of state spaces to remove any occurrences of lens types\n  after the proof tactics @{method pred_simp} and @{method rel_simp}, or any\n  of their derivatives have been applied. Eventually, it would be desirable to\n  automate both interpretations as part of a custom outer command for defining\n  alphabets.\n*}\n\ninterpretation des_vars: lens_interp \"\\<lambda>r. (ok\\<^sub>v r, more r)\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\ninterpretation des_vars_rel:\n  lens_interp \"\\<lambda>(r, r'). (ok\\<^sub>v r, ok\\<^sub>v r', more r, more r')\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\nlemma ok_ord [usubst]:\n  \"$ok \\<prec>\\<^sub>v $ok\\<acute>\"\n  by (simp add: var_name_ord_def)\n\ntype_synonym '\\<alpha> des  = \"'\\<alpha> des_vars_scheme\"\ntype_synonym ('\\<alpha>, '\\<beta>) rel_des = \"('\\<alpha> des, '\\<beta> des) rel\"\ntype_synonym '\\<alpha> hrel_des = \"('\\<alpha> des) hrel\"\n\ntranslations\n  (type) \"'\\<alpha> des\" <= (type) \"'\\<alpha> des_vars_scheme\"\n  (type) \"'\\<alpha> des\" <= (type) \"'\\<alpha> des_vars_ext\"\n  (type) \"('\\<alpha>, '\\<beta>) rel_des\" <= (type) \"('\\<alpha> des, '\\<beta> des) rel\"\n  (type) \"'\\<alpha> hrel_des\" <= (type) \"'\\<alpha> des hrel\"\n  \nnotation des_vars_child_lens (\"\\<Sigma>\\<^sub>D\")\n\nlemma ok_des_bij_lens: \"bij_lens (ok +\\<^sub>L \\<Sigma>\\<^sub>D)\"\n  by (unfold_locales, simp_all add: ok_def des_vars_child_lens_def lens_plus_def prod.case_eq_if)\n\ntext {* Define the lens functor for designs *}\n  \ndefinition lmap_des_vars :: \"('\\<alpha> \\<Longrightarrow> '\\<beta>) \\<Rightarrow> ('\\<alpha> des_vars_scheme \\<Longrightarrow> '\\<beta> des_vars_scheme)\" (\"lmap\\<^sub>D\")\nwhere [lens_defs]: \"lmap_des_vars = lmap[des_vars]\"\n\nlemma lmap_des_vars: \"vwb_lens f \\<Longrightarrow> vwb_lens (lmap_des_vars f)\"\n  by (unfold_locales, auto simp add: lens_defs des_vars.defs)\n\nlemma lmap_id: \"lmap\\<^sub>D 1\\<^sub>L = 1\\<^sub>L\"\n  by (simp add: lens_defs des_vars.defs fun_eq_iff)\n\nlemma lmap_comp: \"lmap\\<^sub>D (f ;\\<^sub>L g) = lmap\\<^sub>D f ;\\<^sub>L lmap\\<^sub>D g\"\n  by (simp add: lens_defs des_vars.defs fun_eq_iff)\n\ntext {* The following notations define liftings from non-design predicates into design\n  predicates using alphabet extensions. *}\n\nabbreviation lift_desr (\"\\<lceil>_\\<rceil>\\<^sub>D\")\nwhere \"\\<lceil>P\\<rceil>\\<^sub>D \\<equiv> P \\<oplus>\\<^sub>p (\\<Sigma>\\<^sub>D \\<times>\\<^sub>L \\<Sigma>\\<^sub>D)\"\n\nabbreviation lift_pre_desr (\"\\<lceil>_\\<rceil>\\<^sub>D\\<^sub><\")\nwhere \"\\<lceil>p\\<rceil>\\<^sub>D\\<^sub>< \\<equiv> \\<lceil>\\<lceil>p\\<rceil>\\<^sub><\\<rceil>\\<^sub>D\"\n\nabbreviation lift_post_desr (\"\\<lceil>_\\<rceil>\\<^sub>D\\<^sub>>\")\nwhere \"\\<lceil>p\\<rceil>\\<^sub>D\\<^sub>> \\<equiv> \\<lceil>\\<lceil>p\\<rceil>\\<^sub>>\\<rceil>\\<^sub>D\"\n\nabbreviation drop_desr (\"\\<lfloor>_\\<rfloor>\\<^sub>D\")\nwhere \"\\<lfloor>P\\<rfloor>\\<^sub>D \\<equiv> P \\<restriction>\\<^sub>p (\\<Sigma>\\<^sub>D \\<times>\\<^sub>L \\<Sigma>\\<^sub>D)\"\n\nabbreviation dcond :: \"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> '\\<alpha> upred \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" \n  (\"(3_ \\<triangleleft> _ \\<triangleright>\\<^sub>D/ _)\" [52,0,53] 52)\nwhere \"P \\<triangleleft> b \\<triangleright>\\<^sub>D Q \\<equiv> P \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>D\\<^sub>< \\<triangleright> Q\"\n  \ndefinition design::\"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (infixl \"\\<turnstile>\" 60)\nwhere \"P \\<turnstile> Q = ($ok \\<and> P \\<Rightarrow> $ok\\<acute> \\<and> Q)\"\n\ntext {* An rdesign is a design that uses the Isabelle type system to prevent reference to ok in the\n        assumption and commitment. *}\n\ndefinition rdesign::\"('\\<alpha>, '\\<beta>) rel \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (infixl \"\\<turnstile>\\<^sub>r\" 60)\nwhere \"(P \\<turnstile>\\<^sub>r Q) = \\<lceil>P\\<rceil>\\<^sub>D \\<turnstile> \\<lceil>Q\\<rceil>\\<^sub>D\"\n  \ntext {* An ndesign is a normal design, i.e. where the assumption is a condition *}\n\ndefinition ndesign::\"'\\<alpha> cond \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (infixl \"\\<turnstile>\\<^sub>n\" 60)\nwhere \"(p \\<turnstile>\\<^sub>n Q) = (\\<lceil>p\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q)\"\n\ndefinition skip_d :: \"'\\<alpha> hrel_des\" (\"II\\<^sub>D\")\nwhere \"II\\<^sub>D \\<equiv> (true \\<turnstile>\\<^sub>r II)\"\n\ndefinition assigns_d :: \"'\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\" (\"\\<langle>_\\<rangle>\\<^sub>D\")\nwhere \"assigns_d \\<sigma> = (true \\<turnstile>\\<^sub>r assigns_r \\<sigma>)\"\n\nsyntax\n  \"_assignmentd\" :: \"svids \\<Rightarrow> uexprs \\<Rightarrow> logic\"  (infixr \":=\\<^sub>D\" 72)\n\ntranslations\n  \"_assignmentd xs vs\" => \"CONST assigns_d (_mk_usubst (CONST id) xs vs)\"\n  \"x :=\\<^sub>D v\" <= \"CONST assigns_d (CONST subst_upd (CONST id) (CONST svar x) v)\"\n  \"x :=\\<^sub>D v\" <= \"CONST assigns_d (CONST subst_upd (CONST id) x v)\"\n  \"x,y :=\\<^sub>D u,v\" <= \"CONST assigns_d (CONST subst_upd (CONST subst_upd (CONST id) (CONST svar x) u) (CONST svar y) v)\"\n\ndefinition J :: \"'\\<alpha> hrel_des\"\nwhere \"J = (($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\"\n\ndefinition \"H1 (P)  \\<equiv>  $ok \\<Rightarrow> P\"\n\ndefinition \"H2 (P)  \\<equiv>  P ;; J\"\n\ndefinition \"H3 (P)  \\<equiv>  P ;; II\\<^sub>D\"\n\ndefinition \"H4 (P)  \\<equiv> ((P;;true) \\<Rightarrow> P)\"\n\nsyntax\n  \"_ok_f\"  :: \"logic \\<Rightarrow> logic\" (\"_\\<^sup>f\" [1000] 1000)\n  \"_ok_t\"  :: \"logic \\<Rightarrow> logic\" (\"_\\<^sup>t\" [1000] 1000)\n  \"_top_d\" :: \"logic\" (\"\\<top>\\<^sub>D\")\n  \"_bot_d\" :: \"logic\" (\"\\<bottom>\\<^sub>D\")\n\ntranslations\n  \"P\\<^sup>f\" \\<rightleftharpoons> \"CONST usubst (CONST subst_upd CONST id (CONST ovar CONST ok) false) P\"\n  \"P\\<^sup>t\" \\<rightleftharpoons> \"CONST usubst (CONST subst_upd CONST id (CONST ovar CONST ok) true) P\"\n  \"\\<top>\\<^sub>D\" => \"CONST not_upred (CONST utp_expr.var (CONST ivar CONST ok))\"\n  \"\\<bottom>\\<^sub>D\" => \"true\"\n\ndefinition pre_design :: \"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel\" (\"pre\\<^sub>D\") where\n\"pre\\<^sub>D(P) = \\<lfloor>\\<not> P\\<lbrakk>true,false/$ok,$ok\\<acute>\\<rbrakk>\\<rfloor>\\<^sub>D\"\n\ndefinition post_design :: \"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel\" (\"post\\<^sub>D\") where\n\"post\\<^sub>D(P) = \\<lfloor>P\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>\\<rfloor>\\<^sub>D\"\n\ndefinition wp_design :: \"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> '\\<beta> cond \\<Rightarrow> '\\<alpha> cond\" (infix \"wp\\<^sub>D\" 60) where\n\"Q wp\\<^sub>D r = (\\<lfloor>pre\\<^sub>D(Q) ;; true :: ('\\<alpha>, '\\<beta>) rel\\<rfloor>\\<^sub>< \\<and> (post\\<^sub>D(Q) wp r))\"\n\ndeclare design_def [upred_defs]\ndeclare rdesign_def [upred_defs]\ndeclare ndesign_def [upred_defs]\ndeclare skip_d_def [upred_defs]\ndeclare J_def [upred_defs]\ndeclare pre_design_def [upred_defs]\ndeclare post_design_def [upred_defs]\ndeclare wp_design_def [upred_defs]\ndeclare assigns_d_def [upred_defs]\n\ndeclare H1_def [upred_defs]\ndeclare H2_def [upred_defs]\ndeclare H3_def [upred_defs]\ndeclare H4_def [upred_defs]\n\nlemma drop_desr_inv [simp]: \"\\<lfloor>\\<lceil>P\\<rceil>\\<^sub>D\\<rfloor>\\<^sub>D = P\"\n  by (simp add: arestr_aext prod_mwb_lens)\n\nlemma lift_desr_inv:\n  fixes P :: \"('\\<alpha>, '\\<beta>) rel_des\"\n  assumes \"$ok \\<sharp> P\" \"$ok\\<acute> \\<sharp> P\"\n  shows \"\\<lceil>\\<lfloor>P\\<rfloor>\\<^sub>D\\<rceil>\\<^sub>D = P\"\nproof -\n  have \"bij_lens (\\<Sigma>\\<^sub>D \\<times>\\<^sub>L \\<Sigma>\\<^sub>D +\\<^sub>L (in_var ok +\\<^sub>L out_var ok) :: (_, '\\<alpha> des_vars_scheme \\<times> '\\<beta> des_vars_scheme) lens)\"\n    (is \"bij_lens (?P)\")\n  proof -\n    have \"?P \\<approx>\\<^sub>L (ok +\\<^sub>L \\<Sigma>\\<^sub>D) \\<times>\\<^sub>L (ok +\\<^sub>L \\<Sigma>\\<^sub>D)\" (is \"?P \\<approx>\\<^sub>L ?Q\")\n      apply (simp add: in_var_def out_var_def prod_as_plus)\n      apply (simp add: prod_as_plus[THEN sym])\n      apply (meson lens_equiv_sym lens_equiv_trans lens_indep_prod lens_plus_comm lens_plus_prod_exchange des_vars_indeps(1))\n    done\n    moreover have \"bij_lens ?Q\"\n      by (simp add: ok_des_bij_lens prod_bij_lens)\n    ultimately show ?thesis\n      by (metis bij_lens_equiv lens_equiv_sym)\n  qed\n\n  with assms show ?thesis\n    apply (rule_tac aext_arestr[of _ \"in_var ok +\\<^sub>L out_var ok\"])\n    apply (simp add: prod_mwb_lens)\n    apply (simp)\n    apply (metis alpha_in_var lens_indep_prod lens_indep_sym des_vars_indeps(1) out_var_def prod_as_plus)\n    using unrest_var_comp apply blast\n  done\nqed\n\nsubsection {* Design laws *}\n\nlemma unrest_out_des_lift [unrest]: \"out\\<alpha> \\<sharp> p \\<Longrightarrow> out\\<alpha> \\<sharp> \\<lceil>p\\<rceil>\\<^sub>D\"\n  by (pred_simp)\n\nlemma lift_dist_seq [simp]:\n  \"\\<lceil>P ;; Q\\<rceil>\\<^sub>D = (\\<lceil>P\\<rceil>\\<^sub>D ;; \\<lceil>Q\\<rceil>\\<^sub>D)\"\n  by (rel_auto)\n\nlemma lift_des_skip_dr_unit_unrest: \"$ok\\<acute> \\<sharp> P \\<Longrightarrow> (P ;; \\<lceil>II\\<rceil>\\<^sub>D) = P\"\n  by (rel_auto)\n\nlemma true_is_design:\n  \"(false \\<turnstile> true) = true\"\n  by (rel_auto)\n\nlemma true_is_rdesign:\n  \"(false \\<turnstile>\\<^sub>r true) = true\"\n  by (rel_auto)\n    \nlemma abort_ndes_def:\n  \"true = (false \\<turnstile>\\<^sub>n true)\"\n  by (rel_auto)\n\nlemma design_false_pre:\n  \"(false \\<turnstile> P) = true\"\n  by (rel_auto)\n\nlemma rdesign_false_pre:\n  \"(false \\<turnstile>\\<^sub>r P) = true\"\n  by (rel_auto)\n\nlemma ndesign_false_pre:\n  \"(false \\<turnstile>\\<^sub>n P) = true\"\n  by (rel_auto)\n\nlemma ndesign_miracle:\n  \"(true \\<turnstile>\\<^sub>n false) = \\<top>\\<^sub>D\"\n  by (rel_auto)\n    \nlemma state_subst_design [usubst]:\n  \"\\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> (P \\<turnstile>\\<^sub>r Q) = (\\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> P) \\<turnstile>\\<^sub>r (\\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> Q)\"\n  by (rel_auto)\n    \ntheorem design_refinement:\n  assumes\n    \"$ok \\<sharp> P1\" \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\" \"$ok\\<acute> \\<sharp> P2\"\n    \"$ok \\<sharp> Q1\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\" \"$ok\\<acute> \\<sharp> Q2\"\n  shows \"(P1 \\<turnstile> Q1 \\<sqsubseteq> P2 \\<turnstile> Q2) \\<longleftrightarrow> (`P1 \\<Rightarrow> P2` \\<and> `P1 \\<and> Q2 \\<Rightarrow> Q1`)\"\nproof -\n  have \"(P1 \\<turnstile> Q1) \\<sqsubseteq> (P2 \\<turnstile> Q2) \\<longleftrightarrow> `($ok \\<and> P2 \\<Rightarrow> $ok\\<acute> \\<and> Q2) \\<Rightarrow> ($ok \\<and> P1 \\<Rightarrow> $ok\\<acute> \\<and> Q1)`\"\n    by (pred_auto)\n  also with assms have \"... = `(P2 \\<Rightarrow> $ok\\<acute> \\<and> Q2) \\<Rightarrow> (P1 \\<Rightarrow> $ok\\<acute> \\<and> Q1)`\"\n    by (subst subst_bool_split[of \"in_var ok\"], simp_all, subst_tac)\n  also with assms have \"... = `(\\<not> P2 \\<Rightarrow> \\<not> P1) \\<and> ((P2 \\<Rightarrow> Q2) \\<Rightarrow> P1 \\<Rightarrow> Q1)`\"\n    by (subst subst_bool_split[of \"out_var ok\"], simp_all, subst_tac)\n  also have \"... \\<longleftrightarrow> `(P1 \\<Rightarrow> P2)` \\<and> `P1 \\<and> Q2 \\<Rightarrow> Q1`\"\n    by (pred_auto)\n  finally show ?thesis .\nqed\n\ntheorem rdesign_refinement:\n  \"(P1 \\<turnstile>\\<^sub>r Q1 \\<sqsubseteq> P2 \\<turnstile>\\<^sub>r Q2) \\<longleftrightarrow> (`P1 \\<Rightarrow> P2` \\<and> `P1 \\<and> Q2 \\<Rightarrow> Q1`)\"\n  by (rel_auto)\n\nlemma design_refine_intro:\n  assumes \"`P1 \\<Rightarrow> P2`\" \"`P1 \\<and> Q2 \\<Rightarrow> Q1`\"\n  shows \"P1 \\<turnstile> Q1 \\<sqsubseteq> P2 \\<turnstile> Q2\"\n  using assms unfolding upred_defs\n  by (pred_auto)\n\nlemma design_refine_intro':\n  assumes \"P\\<^sub>2 \\<sqsubseteq> P\\<^sub>1\" \"Q\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)\"\n  shows \"P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<sqsubseteq> P\\<^sub>2 \\<turnstile> Q\\<^sub>2\"\n  using assms design_refine_intro[of P\\<^sub>1 P\\<^sub>2 Q\\<^sub>2 Q\\<^sub>1] by (simp add: refBy_order)\n\nlemma rdesign_refine_intro:\n  assumes \"`P1 \\<Rightarrow> P2`\" \"`P1 \\<and> Q2 \\<Rightarrow> Q1`\"\n  shows \"P1 \\<turnstile>\\<^sub>r Q1 \\<sqsubseteq> P2 \\<turnstile>\\<^sub>r Q2\"\n  using assms unfolding upred_defs\n  by (pred_auto)\n\nlemma rdesign_refine_intro':\n  assumes \"P2 \\<sqsubseteq> P1\" \"Q1 \\<sqsubseteq> (P1 \\<and> Q2)\"\n  shows \"P1 \\<turnstile>\\<^sub>r Q1 \\<sqsubseteq> P2 \\<turnstile>\\<^sub>r Q2\"\n  using assms unfolding upred_defs\n  by (pred_auto)\n\nlemma ndesign_refine_intro:\n  assumes \"`p1 \\<Rightarrow> p2`\" \"`\\<lceil>p1\\<rceil>\\<^sub>< \\<and> Q2 \\<Rightarrow> Q1`\"\n  shows \"p1 \\<turnstile>\\<^sub>n Q1 \\<sqsubseteq> p2 \\<turnstile>\\<^sub>n Q2\"\n  using assms unfolding upred_defs\n  by (pred_auto)\n\nlemma design_subst [usubst]:\n  \"\\<lbrakk> $ok \\<sharp> \\<sigma>; $ok\\<acute> \\<sharp> \\<sigma> \\<rbrakk> \\<Longrightarrow> \\<sigma> \\<dagger> (P \\<turnstile> Q) = (\\<sigma> \\<dagger> P) \\<turnstile> (\\<sigma> \\<dagger> Q)\"\n  by (simp add: design_def usubst)\n\ntheorem design_ok_false [usubst]: \"(P \\<turnstile> Q)\\<lbrakk>false/$ok\\<rbrakk> = true\"\n  by (simp add: design_def usubst)\n\ntheorem design_npre:\n  \"(P \\<turnstile> Q)\\<^sup>f = (\\<not> $ok \\<or> \\<not> P\\<^sup>f)\"\n  by (rel_auto)\n\ntheorem design_pre:\n  \"\\<not> (P \\<turnstile> Q)\\<^sup>f = ($ok \\<and> P\\<^sup>f)\"\n  by (simp add: design_def, subst_tac)\n     (metis (no_types, hide_lams) not_conj_deMorgans true_not_false(2) utp_pred_laws.compl_top_eq\n            utp_pred_laws.sup.idem utp_pred_laws.sup_compl_top)\n\ntheorem design_post:\n  \"(P \\<turnstile> Q)\\<^sup>t = (($ok \\<and> P\\<^sup>t) \\<Rightarrow> Q\\<^sup>t)\"\n  by (rel_auto)\n\ntheorem rdesign_pre [simp]: \"pre\\<^sub>D(P \\<turnstile>\\<^sub>r Q) = P\"\n  by (pred_auto)\n\ntheorem rdesign_post [simp]: \"post\\<^sub>D(P \\<turnstile>\\<^sub>r Q) = (P \\<Rightarrow> Q)\"\n  by (pred_auto)\n\ntheorem ndesign_pre [simp]: \"pre\\<^sub>D(p \\<turnstile>\\<^sub>n Q) = \\<lceil>p\\<rceil>\\<^sub><\"\n  by (pred_auto)\n\ntheorem ndesign_post [simp]: \"post\\<^sub>D(p \\<turnstile>\\<^sub>n Q) = (\\<lceil>p\\<rceil>\\<^sub>< \\<Rightarrow> Q)\"\n  by (pred_auto)\n\ntheorem design_true_left_zero: \"(true ;; (P \\<turnstile> Q)) = true\"\nproof -\n  have \"(true ;; (P \\<turnstile> Q)) = (\\<^bold>\\<exists> ok\\<^sub>0 \\<bullet> true\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<acute>\\<rbrakk> ;; (P \\<turnstile> Q)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<rbrakk>)\"\n    by (subst seqr_middle[of ok], simp_all)\n  also have \"... = ((true\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; (P \\<turnstile> Q)\\<lbrakk>false/$ok\\<rbrakk>) \\<or> (true\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (P \\<turnstile> Q)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: disj_comm false_alt_def true_alt_def)\n  also have \"... = ((true\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; true\\<^sub>h) \\<or> (true ;; ((P \\<turnstile> Q)\\<lbrakk>true/$ok\\<rbrakk>)))\"\n    by (subst_tac, rel_auto)\n  also have \"... = true\"\n    by (subst_tac, simp add: precond_right_unit unrest)\n  finally show ?thesis .\nqed\n\ntheorem design_top_left_zero: \"(\\<top>\\<^sub>D ;; (P \\<turnstile> Q)) = \\<top>\\<^sub>D\"\n  by (rel_auto)\n    \ntheorem des_top_ndes_def [ndes_simp]: \n  \"\\<top>\\<^sub>D = true \\<turnstile>\\<^sub>n false\"\n  by (rel_auto)\n\ntheorem design_choice:\n  \"(P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<sqinter> (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2) = ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<or> Q\\<^sub>2))\"\n  by (rel_auto)\n\ntheorem rdesign_choice:\n  \"(P\\<^sub>1 \\<turnstile>\\<^sub>r P\\<^sub>2) \\<sqinter> (Q\\<^sub>1 \\<turnstile>\\<^sub>r Q\\<^sub>2) = ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile>\\<^sub>r (P\\<^sub>2 \\<or> Q\\<^sub>2))\"\n  by (rel_auto)\n\ntheorem ndesign_choice [ndes_simp]:\n  \"(p\\<^sub>1 \\<turnstile>\\<^sub>n P\\<^sub>2) \\<sqinter> (q\\<^sub>1 \\<turnstile>\\<^sub>n Q\\<^sub>2) = ((p\\<^sub>1 \\<and> q\\<^sub>1) \\<turnstile>\\<^sub>n (P\\<^sub>2 \\<or> Q\\<^sub>2))\"\n  by (rel_auto)\n\ntheorem design_inf:\n  \"(P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<squnion> (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2) = ((P\\<^sub>1 \\<or> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>1 \\<Rightarrow> P\\<^sub>2) \\<and> (Q\\<^sub>1 \\<Rightarrow> Q\\<^sub>2)))\"\n  by (rel_auto)\n\ntheorem rdesign_inf:\n  \"(P\\<^sub>1 \\<turnstile>\\<^sub>r P\\<^sub>2) \\<squnion> (Q\\<^sub>1 \\<turnstile>\\<^sub>r Q\\<^sub>2) = ((P\\<^sub>1 \\<or> Q\\<^sub>1) \\<turnstile>\\<^sub>r ((P\\<^sub>1 \\<Rightarrow> P\\<^sub>2) \\<and> (Q\\<^sub>1 \\<Rightarrow> Q\\<^sub>2)))\"\n  by (rel_auto)\n\ntheorem ndesign_inf [ndes_simp]:\n  \"(p\\<^sub>1 \\<turnstile>\\<^sub>n P\\<^sub>2) \\<squnion> (q\\<^sub>1 \\<turnstile>\\<^sub>n Q\\<^sub>2) = ((p\\<^sub>1 \\<or> q\\<^sub>1) \\<turnstile>\\<^sub>n ((\\<lceil>p\\<^sub>1\\<rceil>\\<^sub>< \\<Rightarrow> P\\<^sub>2) \\<and> (\\<lceil>q\\<^sub>1\\<rceil>\\<^sub>< \\<Rightarrow> Q\\<^sub>2)))\"\n  by (rel_auto)\n    \ntheorem design_condr:\n  \"((P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<triangleleft> b \\<triangleright> (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2)) = ((P\\<^sub>1 \\<triangleleft> b \\<triangleright> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<triangleleft> b \\<triangleright> Q\\<^sub>2))\"\n  by (rel_auto)\n\ntheorem ndesign_dcond [ndes_simp]:\n  \"((p\\<^sub>1 \\<turnstile>\\<^sub>n P\\<^sub>2) \\<triangleleft> b \\<triangleright>\\<^sub>D (q\\<^sub>1 \\<turnstile>\\<^sub>n Q\\<^sub>2)) = ((p\\<^sub>1 \\<triangleleft> b \\<triangleright> q\\<^sub>1) \\<turnstile>\\<^sub>n (P\\<^sub>2 \\<triangleleft> b \\<triangleright>\\<^sub>r Q\\<^sub>2))\"\n  by (rel_auto)\n    \nlemma design_top:\n  \"(P \\<turnstile> Q) \\<sqsubseteq> \\<top>\\<^sub>D\"\n  by (rel_auto)\n\nlemma design_bottom:\n  \"\\<bottom>\\<^sub>D \\<sqsubseteq> (P \\<turnstile> Q)\"\n  by simp\n\nlemma design_UINF_mem:\n  assumes \"A \\<noteq> {}\"\n  shows \"(\\<Sqinter> i \\<in> A \\<bullet> P(i) \\<turnstile> Q(i)) = (\\<Squnion> i \\<in> A \\<bullet> P(i)) \\<turnstile> (\\<Sqinter> i \\<in> A \\<bullet> Q(i))\"\n  using assms by (rel_auto)\n\nlemma ndesign_UINF_mem [ndes_simp]:\n  assumes \"A \\<noteq> {}\"\n  shows \"(\\<Sqinter> i \\<in> A \\<bullet> p(i) \\<turnstile>\\<^sub>n Q(i)) = (\\<Squnion> i \\<in> A \\<bullet> p(i)) \\<turnstile>\\<^sub>n (\\<Sqinter> i \\<in> A \\<bullet> Q(i))\"\n  using assms by (rel_auto)\n\nlemma ndesign_UINF_ind [ndes_simp]:\n  assumes \"A \\<noteq> {}\"\n  shows \"(\\<Sqinter> i \\<bullet> p(i) \\<turnstile>\\<^sub>n Q(i)) = (\\<Squnion> i \\<bullet> p(i)) \\<turnstile>\\<^sub>n (\\<Sqinter> i \\<bullet> Q(i))\"\n  using assms by (rel_auto)\n    \nlemma design_USUP_mem:\n  \"(\\<Squnion> i \\<in> A \\<bullet> P(i) \\<turnstile> Q(i)) = (\\<Sqinter> i \\<in> A \\<bullet> P(i)) \\<turnstile> (\\<Squnion> i \\<in> A \\<bullet> P(i) \\<Rightarrow> Q(i))\"\n  by (rel_auto)\n\nlemma ndesign_USUP_mem [ndes_simp]:\n  \"(\\<Squnion> i \\<in> A \\<bullet> p(i) \\<turnstile>\\<^sub>n Q(i)) = (\\<Sqinter> i \\<in> A \\<bullet> p(i)) \\<turnstile>\\<^sub>n (\\<Squnion> i \\<in> A \\<bullet> \\<lceil>p(i)\\<rceil>\\<^sub>< \\<Rightarrow> Q(i))\"\n  by (rel_auto)\n\nlemma ndesign_USUP_ind [ndes_simp]:\n  \"(\\<Squnion> i \\<bullet> p(i) \\<turnstile>\\<^sub>n Q(i)) = (\\<Sqinter> i \\<bullet> p(i)) \\<turnstile>\\<^sub>n (\\<Squnion> i \\<bullet> \\<lceil>p(i)\\<rceil>\\<^sub>< \\<Rightarrow> Q(i))\"\n  by (rel_auto)\n    \ntheorem design_composition_subst:\n  assumes\n    \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\"\n  shows \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) =\n         (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (\\<not> P2))) \\<turnstile> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; Q2\\<lbrakk>true/$ok\\<rbrakk>))\"\nproof -\n  have \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = (\\<^bold>\\<exists> ok\\<^sub>0 \\<bullet> ((P1 \\<turnstile> Q1)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<acute>\\<rbrakk> ;; (P2 \\<turnstile> Q2)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<rbrakk>))\"\n    by (rule seqr_middle, simp)\n  also have \" ...\n        = (((P1 \\<turnstile> Q1)\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; (P2 \\<turnstile> Q2)\\<lbrakk>false/$ok\\<rbrakk>)\n            \\<or> ((P1 \\<turnstile> Q1)\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (P2 \\<turnstile> Q2)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: true_alt_def false_alt_def, pred_auto)\n  also from assms\n  have \"... = ((($ok \\<and> P1 \\<Rightarrow> Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk>) ;; (P2 \\<Rightarrow> $ok\\<acute> \\<and> Q2\\<lbrakk>true/$ok\\<rbrakk>)) \\<or> ((\\<not> ($ok \\<and> P1)) ;; true))\"\n    by (simp add: design_def usubst unrest, pred_auto)\n  also have \"... = ((\\<not>$ok ;; true\\<^sub>h) \\<or> ((\\<not>P1) ;; true) \\<or> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (\\<not>P2)) \\<or> ($ok\\<acute> \\<and> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; Q2\\<lbrakk>true/$ok\\<rbrakk>)))\"\n    by (rel_auto)\n  also have \"... = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (\\<not> P2))) \\<turnstile> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; Q2\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: precond_right_unit design_def unrest, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma design_export_ok:\n  \"P \\<turnstile> Q = (P \\<turnstile> ($ok \\<and> Q))\"\n  by (rel_auto)\n\nlemma design_export_ok':\n  \"P \\<turnstile> Q = (P \\<turnstile> ($ok\\<acute> \\<and> Q))\"\n  by (rel_auto)\n\nlemma design_export_pre: \"P \\<turnstile> (P \\<and> Q) = P \\<turnstile> Q\"\n  by (rel_auto)\n\nlemma design_export_spec: \"P \\<turnstile> (P \\<Rightarrow> Q) = P \\<turnstile> Q\"\n  by (rel_auto)\n\nlemma design_ok_pre_conj: \"($ok \\<and> P) \\<turnstile> Q = P \\<turnstile> Q\"\n  by (rel_auto)\n\ntheorem design_composition:\n  assumes\n    \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\"\n  shows \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile> (Q1 ;; Q2))\"\n  using assms by (simp add: design_composition_subst usubst)\n\nlemma runrest_ident_var:\n  assumes \"x \\<sharp>\\<sharp> P\"\n  shows \"($x \\<and> P) = (P \\<and> $x\\<acute>)\"\nproof -\n  have \"P = ($x\\<acute> =\\<^sub>u $x \\<and> P)\"\n    by (metis RID_def assms unrest_relation_def utp_pred_laws.inf.cobounded2 utp_pred_laws.inf_absorb2)\n  moreover have \"($x\\<acute> =\\<^sub>u $x \\<and> ($x \\<and> P)) = ($x\\<acute> =\\<^sub>u $x \\<and> (P \\<and> $x\\<acute>))\"\n    by (rel_auto)\n  ultimately show ?thesis\n    by (metis utp_pred_laws.inf.assoc utp_pred_laws.inf_left_commute)\nqed\n\ntheorem design_composition_runrest:\n  assumes\n    \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\" \"ok \\<sharp>\\<sharp> Q1\" \"ok \\<sharp>\\<sharp> Q2\"\n  shows \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1\\<^sup>t ;; (\\<not> P2))) \\<turnstile> (Q1 ;; Q2))\"\nproof -\n  have \"($ok \\<and> $ok\\<acute> \\<and> (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>)) = ($ok \\<and> $ok\\<acute> \\<and> (Q1 ;; Q2))\"\n  proof -\n    have \"($ok \\<and> $ok\\<acute> \\<and> (Q1 ;; Q2)) = (($ok \\<and> Q1) ;; (Q2 \\<and> $ok\\<acute>))\"\n      by (metis (no_types, lifting) conj_comm seqr_post_var_out seqr_pre_var_out)\n    also have \"... = ((Q1 \\<and> $ok\\<acute>) ;; ($ok \\<and> Q2))\"\n      by (simp add: assms(3) assms(4) runrest_ident_var)\n    also have \"... = (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>)\"\n      by (metis ok_vwb_lens seqr_pre_transfer seqr_right_one_point true_alt_def uovar_convr upred_eq_true utp_pred_laws.inf.left_idem unrest_ouvar vwb_lens_mwb)\n    finally show ?thesis\n      by (metis utp_pred_laws.inf.left_commute utp_pred_laws.inf_left_idem)\n  qed\n  moreover have \"(\\<not> (\\<not> P1 ;; true) \\<and> \\<not> (Q1\\<^sup>t ;; (\\<not> P2))) \\<turnstile> (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>) =\n                 (\\<not> (\\<not> P1 ;; true) \\<and> \\<not> (Q1\\<^sup>t ;; (\\<not> P2))) \\<turnstile> ($ok \\<and> $ok\\<acute> \\<and> (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (metis design_export_ok design_export_ok')\n  ultimately show ?thesis using assms\n    by (simp add: design_composition_subst usubst, metis design_export_ok design_export_ok')\nqed\n\ntheorem rdesign_composition:\n  \"((P1 \\<turnstile>\\<^sub>r Q1) ;; (P2 \\<turnstile>\\<^sub>r Q2)) = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile>\\<^sub>r (Q1 ;; Q2))\"\n  by (simp add: rdesign_def design_composition unrest alpha)\n\nlemma skip_d_alt_def: \"II\\<^sub>D = true \\<turnstile> II\"\n  by (rel_auto)\n\nlemma skip_d_ndes_def [ndes_simp]: \"II\\<^sub>D = true \\<turnstile>\\<^sub>n II\"\n  by (rel_auto)\n    \ntheorem design_skip_idem [simp]:\n  \"(II\\<^sub>D ;; II\\<^sub>D) = II\\<^sub>D\"\n  by (rel_auto)\n\ntheorem design_composition_cond:\n  assumes\n    \"out\\<alpha> \\<sharp> p1\" \"$ok \\<sharp> P2\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\"\n  shows \"((p1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = ((p1 \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile> (Q1 ;; Q2))\"\n  using assms\n  by (simp add: design_composition unrest precond_right_unit)\n\ntheorem rdesign_composition_cond:\n  assumes \"out\\<alpha> \\<sharp> p1\"\n  shows \"((p1 \\<turnstile>\\<^sub>r Q1) ;; (P2 \\<turnstile>\\<^sub>r Q2)) = ((p1 \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile>\\<^sub>r (Q1 ;; Q2))\"\n  using assms\n  by (simp add: rdesign_def design_composition_cond unrest alpha)\n\ntheorem design_composition_wp:\n  assumes\n    \"ok \\<sharp> p1\" \"ok \\<sharp> p2\"\n    \"$ok \\<sharp> Q1\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\" \"$ok\\<acute> \\<sharp> Q2\"\n  shows \"((\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile> Q1) ;; (\\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile> Q2)) = ((\\<lceil>p1 \\<and> Q1 wp p2\\<rceil>\\<^sub><) \\<turnstile> (Q1 ;; Q2))\"\n  using assms by (rel_blast)\n\ntheorem rdesign_composition_wp:\n  \"((\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q1) ;; (\\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q2)) = ((\\<lceil>p1 \\<and> Q1 wp p2\\<rceil>\\<^sub><) \\<turnstile>\\<^sub>r (Q1 ;; Q2))\"\n  by (rel_blast)\n\ntheorem ndesign_composition_wp [ndes_simp]:\n  \"((p1 \\<turnstile>\\<^sub>n Q1) ;; (p2 \\<turnstile>\\<^sub>n Q2)) = ((p1 \\<and> Q1 wp p2) \\<turnstile>\\<^sub>n (Q1 ;; Q2))\"\n  by (rel_blast)\n\nlemma wp_USUP_pre [wp]: \"P wp (\\<Squnion>i\\<in>{0..n} \\<bullet> Q(i)) = (\\<Squnion>i\\<in>{0..n} \\<bullet> P wp Q(i))\"\n  by (rel_auto)\n\nlemma USUP_where_false [simp]: \"(\\<Squnion> i | false \\<bullet> P(i)) = true\"\n  by (pred_auto)\n    \ntheorem ndesign_iteration_wp [ndes_simp]:\n  \"(p \\<turnstile>\\<^sub>n Q) ;; (p \\<turnstile>\\<^sub>n Q) \\<^bold>^ n = ((\\<And> i\\<in>{0..n} \\<bullet> (Q \\<^bold>^ i) wp p) \\<turnstile>\\<^sub>n Q \\<^bold>^ Suc n)\"\nproof (induct n)\n  case 0\n  then show ?case by (simp add: wp true_upred_def)\nnext\n  case (Suc n) note hyp = this\n  have \"(p \\<turnstile>\\<^sub>n Q) ;; (p \\<turnstile>\\<^sub>n Q) \\<^bold>^ Suc n = (p \\<turnstile>\\<^sub>n Q) ;; (p \\<turnstile>\\<^sub>n Q) ;; (p \\<turnstile>\\<^sub>n Q) \\<^bold>^ n\"\n    by (simp)\n  also have \"... = (p \\<turnstile>\\<^sub>n Q) ;; ((\\<Squnion> i \\<in> {0..n} \\<bullet> Q \\<^bold>^ i wp p) \\<turnstile>\\<^sub>n Q \\<^bold>^ Suc n)\"\n    by (simp add: hyp)\n  also have \"... = (p \\<and> Q wp (\\<Squnion> i \\<in> {0..n} \\<bullet> Q \\<^bold>^ i wp p)) \\<turnstile>\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n    by (simp add: ndesign_composition_wp seqr_assoc)\n  also have \"... = (p \\<and> (\\<Squnion> i \\<in> {0..n} \\<bullet> Q \\<^bold>^ Suc i wp p)) \\<turnstile>\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n    by (simp add: wp)\n  also have \"... = (p \\<and> (\\<Squnion> i \\<in> {0..n}. Q \\<^bold>^ Suc i wp p)) \\<turnstile>\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n    by (simp add: USUP_as_Inf_image)\n  also have \"... = (p \\<and> (\\<Squnion> i \\<in> {1..Suc n}. Q \\<^bold>^ i wp p)) \\<turnstile>\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n    by (metis (no_types, lifting) One_nat_def image_Suc_atLeastAtMost image_cong image_image)  \n  also have \"... = (Q \\<^bold>^ 0 wp p \\<and> (\\<Squnion> i \\<in> {1..Suc n}. Q \\<^bold>^ i wp p)) \\<turnstile>\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n    by (simp add: wp)\n  also have \"... = ((\\<Squnion> i \\<in> {0..Suc n}. Q \\<^bold>^ i wp p)) \\<turnstile>\\<^sub>n (Q ;; Q) ;; Q \\<^bold>^ n\"\n    by (simp add: Iic_Suc_eq_insert_0 atLeast0AtMost conj_upred_def image_Suc_atMost)      \n  also have \"... = (\\<Squnion> i \\<in> {0..Suc n} \\<bullet> Q \\<^bold>^ i wp p) \\<turnstile>\\<^sub>n Q \\<^bold>^ Suc (Suc n)\"\n    by (simp add: USUP_as_Inf_image upred_semiring.mult_assoc)\n  finally show ?case .\nqed\n    \ntheorem rdesign_wp [wp]:\n  \"(\\<lceil>p\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q) wp\\<^sub>D r = (p \\<and> Q wp r)\"\n  by (rel_auto)\n\ntheorem ndesign_wp [wp]:\n  \"(p \\<turnstile>\\<^sub>n Q) wp\\<^sub>D r = (p \\<and> Q wp r)\"\n  by (simp add: ndesign_def rdesign_wp)\n\ntheorem wpd_seq_r:\n  fixes Q1 Q2 :: \"'\\<alpha> hrel\"\n  shows \"((\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q1) ;; (\\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q2)) wp\\<^sub>D r = (\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q1) wp\\<^sub>D ((\\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q2) wp\\<^sub>D r)\"\n  apply (simp add: wp)\n  apply (subst rdesign_composition_wp)\n  apply (simp only: wp)\n  apply (rel_auto)\ndone\n\ntheorem wpnd_seq_r [wp]:\n  fixes Q1 Q2 :: \"'\\<alpha> hrel\"\n  shows \"((p1 \\<turnstile>\\<^sub>n Q1) ;; (p2 \\<turnstile>\\<^sub>n Q2)) wp\\<^sub>D r = (p1 \\<turnstile>\\<^sub>n Q1) wp\\<^sub>D ((p2 \\<turnstile>\\<^sub>n Q2) wp\\<^sub>D r)\"\n  by (simp add: ndesign_def wpd_seq_r)\n\nlemma design_subst_ok:\n  \"(P\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> Q\\<lbrakk>true/$ok\\<rbrakk>) = (P \\<turnstile> Q)\"\n  by (rel_auto)\n\nlemma design_subst_ok_ok':\n  \"(P\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> Q\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>) = (P \\<turnstile> Q)\"\nproof -\n  have \"(P \\<turnstile> Q) = (($ok \\<and> P) \\<turnstile> ($ok \\<and> $ok\\<acute> \\<and> Q))\"\n    by (pred_auto)\n  also have \"... = (($ok \\<and> P\\<lbrakk>true/$ok\\<rbrakk>) \\<turnstile> ($ok \\<and> ($ok\\<acute> \\<and> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (metis conj_eq_out_var_subst conj_pos_var_subst upred_eq_true utp_pred_laws.inf_commute ok_vwb_lens)\n  also have \"... = (($ok \\<and> P\\<lbrakk>true/$ok\\<rbrakk>) \\<turnstile> ($ok \\<and> $ok\\<acute> \\<and> Q\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>))\"\n    by (simp add: usubst)\n  also have \"... = (P\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> Q\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>)\"\n    by (pred_auto)\n  finally show ?thesis ..\nqed\n\nlemma design_subst_ok':\n  \"(P \\<turnstile> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>) = (P \\<turnstile> Q)\"\nproof -\n  have \"(P \\<turnstile> Q) = (P \\<turnstile> ($ok\\<acute> \\<and> Q))\"\n    by (pred_auto)\n  also have \"... = (P \\<turnstile> ($ok\\<acute> \\<and> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>))\"\n    by (metis conj_eq_out_var_subst upred_eq_true utp_pred_laws.inf_commute ok_vwb_lens)\n  also have \"... = (P \\<turnstile> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>)\"\n    by (pred_auto)\n  finally show ?thesis ..\nqed\n\ntheorem design_left_unit_hom:\n  fixes P Q :: \"'\\<alpha> hrel_des\"\n  shows \"(II\\<^sub>D ;; (P \\<turnstile>\\<^sub>r Q)) = (P \\<turnstile>\\<^sub>r Q)\"\nproof -\n  have \"(II\\<^sub>D ;; (P \\<turnstile>\\<^sub>r Q)) = ((true \\<turnstile>\\<^sub>r II) ;; (P \\<turnstile>\\<^sub>r Q))\"\n    by (simp add: skip_d_def)\n  also have \"... = (true \\<and> \\<not> (II ;; (\\<not> P))) \\<turnstile>\\<^sub>r (II ;; Q)\"\n  proof -\n    have \"out\\<alpha> \\<sharp> true\"\n      by unrest_tac\n    thus ?thesis\n      using rdesign_composition_cond by blast\n  qed\n  also have \"... = (\\<not> (\\<not> P)) \\<turnstile>\\<^sub>r Q\"\n    by simp\n  finally show ?thesis by simp\nqed\n\ntheorem design_left_unit [simp]:\n  \"II\\<^sub>D ;; (P \\<turnstile>\\<^sub>r Q) = (P \\<turnstile>\\<^sub>r Q)\"\n  by (rel_auto)\n\ntheorem design_right_semi_unit:\n  \"(P \\<turnstile>\\<^sub>r Q) ;; II\\<^sub>D = ((\\<not> (\\<not> P) ;; true) \\<turnstile>\\<^sub>r Q)\"\n  by (simp add: skip_d_def rdesign_composition)\n\ntheorem design_right_cond_unit [simp]:\n  assumes \"out\\<alpha> \\<sharp> p\"\n  shows \"(p \\<turnstile>\\<^sub>r Q) ;; II\\<^sub>D = (p \\<turnstile>\\<^sub>r Q)\"\n  using assms\n  by (simp add: skip_d_def rdesign_composition_cond)\n\nlemma lift_des_skip_dr_unit [simp]:\n  \"(\\<lceil>P\\<rceil>\\<^sub>D ;; \\<lceil>II\\<rceil>\\<^sub>D) = \\<lceil>P\\<rceil>\\<^sub>D\"\n  \"(\\<lceil>II\\<rceil>\\<^sub>D ;; \\<lceil>P\\<rceil>\\<^sub>D) = \\<lceil>P\\<rceil>\\<^sub>D\"\n  by (rel_auto)+\n\nlemma assigns_d_ndes_def [ndes_simp]:\n  \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D = (true \\<turnstile>\\<^sub>n \\<langle>\\<sigma>\\<rangle>\\<^sub>a)\"\n  by (rel_auto)\n    \nlemma assigns_d_id [simp]: \"\\<langle>id\\<rangle>\\<^sub>D = II\\<^sub>D\"\n  by (rel_auto)\n\nlemma assign_d_left_comp:\n  \"(\\<langle>f\\<rangle>\\<^sub>D ;; (P \\<turnstile>\\<^sub>r Q)) = (\\<lceil>f\\<rceil>\\<^sub>s \\<dagger> P \\<turnstile>\\<^sub>r \\<lceil>f\\<rceil>\\<^sub>s \\<dagger> Q)\"\n  by (simp add: assigns_d_def rdesign_composition assigns_r_comp subst_not)\n\nlemma assign_d_right_comp:\n  \"((P \\<turnstile>\\<^sub>r Q) ;; \\<langle>f\\<rangle>\\<^sub>D) = ((\\<not> ((\\<not> P) ;; true)) \\<turnstile>\\<^sub>r (Q ;; \\<langle>f\\<rangle>\\<^sub>a))\"\n  by (simp add: assigns_d_def rdesign_composition)\n\nlemma assigns_d_comp:\n  \"(\\<langle>f\\<rangle>\\<^sub>D ;; \\<langle>g\\<rangle>\\<^sub>D) = \\<langle>g \\<circ> f\\<rangle>\\<^sub>D\"\n  by (simp add: assigns_d_def rdesign_composition assigns_comp)\n\nsubsection {* Design preconditions *}\n\nlemma design_pre_choice [simp]:\n  \"pre\\<^sub>D(P \\<sqinter> Q) = (pre\\<^sub>D(P) \\<and> pre\\<^sub>D(Q))\"\n  by (rel_auto)\n\nlemma design_post_choice [simp]:\n  \"post\\<^sub>D(P \\<sqinter> Q) = (post\\<^sub>D(P) \\<or> post\\<^sub>D(Q))\"\n  by (rel_auto)\n\nlemma design_pre_condr [simp]:\n  \"pre\\<^sub>D(P \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>D \\<triangleright> Q) = (pre\\<^sub>D(P) \\<triangleleft> b \\<triangleright> pre\\<^sub>D(Q))\"\n  by (rel_auto)\n\nlemma design_post_condr [simp]:\n  \"post\\<^sub>D(P \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>D \\<triangleright> Q) = (post\\<^sub>D(P) \\<triangleleft> b \\<triangleright> post\\<^sub>D(Q))\"\n  by (rel_auto)\n\nsubsection {* H1: No observation is allowed before initiation *}\n\nlemma H1_idem:\n  \"H1 (H1 P) = H1(P)\"\n  by (pred_auto)\n\nlemma H1_monotone:\n  \"P \\<sqsubseteq> Q \\<Longrightarrow> H1(P) \\<sqsubseteq> H1(Q)\"\n  by (pred_auto)\n\nlemma H1_Continuous: \"Continuous H1\"\n  by (rel_auto)\n\nlemma H1_below_top:\n  \"H1(P) \\<sqsubseteq> \\<top>\\<^sub>D\"\n  by (pred_auto)\n\nlemma H1_design_skip:\n  \"H1(II) = II\\<^sub>D\"\n  by (rel_auto)\n\nlemma H1_cond: \"H1(P \\<triangleleft> b \\<triangleright> Q) = H1(P) \\<triangleleft> b \\<triangleright> H1(Q)\"\n  by (rel_auto)\n\nlemma H1_conj: \"H1(P \\<and> Q) = (H1(P) \\<and> H1(Q))\"\n  by (rel_auto)\n\nlemma H1_disj: \"H1(P \\<or> Q) = (H1(P) \\<or> H1(Q))\"\n  by (rel_auto)\n\nlemma design_export_H1: \"(P \\<turnstile> Q) = (P \\<turnstile> H1(Q))\"\n  by (rel_auto)\n\ntext {* The H1 algebraic laws are valid only when $\\alpha(R)$ is homogeneous. This should maybe be\n        generalised. *}\n\ntheorem H1_algebraic_intro:\n  assumes\n    \"(true\\<^sub>h ;; R) = true\\<^sub>h\"\n    \"(II\\<^sub>D ;; R) = R\"\n  shows \"R is H1\"\nproof -\n  have \"R = (II\\<^sub>D ;; R)\" by (simp add: assms(2))\n  also have \"... = (H1(II) ;; R)\"\n    by (simp add: H1_design_skip)\n  also have \"... = (($ok \\<Rightarrow> II) ;; R)\"\n    by (simp add: H1_def)\n  also have \"... = (((\\<not> $ok) ;; R) \\<or> R)\"\n    by (simp add: impl_alt_def seqr_or_distl)\n  also have \"... = ((((\\<not> $ok) ;; true\\<^sub>h) ;; R) \\<or> R)\"\n    by (simp add: precond_right_unit unrest)\n  also have \"... = (((\\<not> $ok) ;; true\\<^sub>h) \\<or> R)\"\n    by (metis assms(1) seqr_assoc)\n  also have \"... = ($ok \\<Rightarrow> R)\"\n    by (simp add: impl_alt_def precond_right_unit unrest)\n  finally show ?thesis by (metis H1_def Healthy_def')\nqed\n\nlemma nok_not_false:\n  \"(\\<not> $ok) \\<noteq> false\"\n  by (pred_auto)\n\ntheorem H1_left_zero:\n  assumes \"P is H1\"\n  shows \"(true ;; P) = true\"\nproof -\n  from assms have \"(true ;; P) = (true ;; ($ok \\<Rightarrow> P))\"\n    by (simp add: H1_def Healthy_def')\n  (* The next step ensures we get the right alphabet for true by copying it *)\n  also from assms have \"... = (true ;; (\\<not> $ok \\<or> P))\" (is \"_ = (?true ;; _)\")\n    by (simp add: impl_alt_def)\n  also from assms have \"... = ((?true ;; (\\<not> $ok)) \\<or> (?true ;; P))\"\n    using seqr_or_distr by blast\n  also from assms have \"... = (true \\<or> (true ;; P))\"\n    by (simp add: nok_not_false precond_left_zero unrest)\n  finally show ?thesis\n    by (simp add: upred_defs urel_defs)\nqed\n\ntheorem H1_left_unit:\n  fixes P :: \"'\\<alpha> hrel_des\"\n  assumes \"P is H1\"\n  shows \"(II\\<^sub>D ;; P) = P\"\nproof -\n  have \"(II\\<^sub>D ;; P) = (($ok \\<Rightarrow> II) ;; P)\"\n    by (metis H1_def H1_design_skip)\n  also have \"... = (((\\<not> $ok) ;; P) \\<or> P)\"\n    by (simp add: impl_alt_def seqr_or_distl)\n  also from assms have \"... = ((((\\<not> $ok) ;; true\\<^sub>h) ;; P) \\<or> P)\"\n    by (simp add: precond_right_unit unrest)\n  also have \"... = (((\\<not> $ok) ;; (true\\<^sub>h ;; P)) \\<or> P)\"\n    by (simp add: seqr_assoc)\n  also from assms have \"... = ($ok \\<Rightarrow> P)\"\n    by (simp add: H1_left_zero impl_alt_def precond_right_unit unrest)\n  finally show ?thesis using assms\n    by (simp add: H1_def Healthy_def')\nqed\n\ntheorem H1_algebraic:\n  \"P is H1 \\<longleftrightarrow> (true\\<^sub>h ;; P) = true\\<^sub>h \\<and> (II\\<^sub>D ;; P) = P\"\n  using H1_algebraic_intro H1_left_unit H1_left_zero by blast\n\ntheorem H1_nok_left_zero:\n  fixes P :: \"'\\<alpha> hrel_des\"\n  assumes \"P is H1\"\n  shows \"((\\<not> $ok) ;; P) = (\\<not> $ok)\"\nproof -\n  have \"((\\<not> $ok) ;; P) = (((\\<not> $ok) ;; true\\<^sub>h) ;; P)\"\n    by (simp add: precond_right_unit unrest)\n  also have \"... = ((\\<not> $ok) ;; true\\<^sub>h)\"\n    by (metis H1_left_zero assms seqr_assoc)\n  also have \"... = (\\<not> $ok)\"\n    by (simp add: precond_right_unit unrest)\n  finally show ?thesis .\nqed\n\nlemma H1_design:\n  \"H1(P \\<turnstile> Q) = (P \\<turnstile> Q)\"\n  by (rel_auto)\n\nlemma H1_rdesign:\n  \"H1(P \\<turnstile>\\<^sub>r Q) = (P \\<turnstile>\\<^sub>r Q)\"\n  by (rel_auto)\n\nlemma H1_choice_closed [closure]:\n  \"\\<lbrakk> P is H1; Q is H1 \\<rbrakk> \\<Longrightarrow> P \\<sqinter> Q is H1\"\n  by (simp add: H1_def Healthy_def' disj_upred_def impl_alt_def semilattice_sup_class.sup_left_commute)\n\nlemma H1_inf_closed [closure]:\n  \"\\<lbrakk> P is H1; Q is H1 \\<rbrakk> \\<Longrightarrow> P \\<squnion> Q is H1\"\n  by (rel_blast)\n\nlemma H1_UINF:\n  assumes \"A \\<noteq> {}\"\n  shows \"H1(\\<Sqinter> i \\<in> A \\<bullet> P(i)) = (\\<Sqinter> i \\<in> A \\<bullet> H1(P(i)))\"\n  using assms by (rel_auto)\n\nlemma H1_Sup:\n  assumes \"A \\<noteq> {}\" \"\\<forall> P \\<in> A. P is H1\"\n  shows \"(\\<Sqinter> A) is H1\"\nproof -\n  from assms(2) have \"H1 ` A = A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  with H1_UINF[of A id, OF assms(1)] show ?thesis\n    by (simp add: UINF_as_Sup_image Healthy_def, presburger)\nqed\n\nlemma H1_USUP:\n  shows \"H1(\\<Squnion> i \\<in> A \\<bullet> P(i)) = (\\<Squnion> i \\<in> A \\<bullet> H1(P(i)))\"\n  by (rel_auto)\n\nlemma H1_Inf [closure]:\n  assumes \"\\<forall> P \\<in> A. P is H1\"\n  shows \"(\\<Squnion> A) is H1\"\nproof -\n  from assms have \"H1 ` A = A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  with H1_USUP[of A id] show ?thesis\n    by (simp add: USUP_as_Inf_image Healthy_def, presburger)\nqed\n\nsubsection {* H2: A specification cannot require non-termination *}\n\nlemma J_split:\n  shows \"(P ;; J) = (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))\"\nproof -\n  have \"(P ;; J) = (P ;; (($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D))\"\n    by (simp add: H2_def J_def design_def)\n  also have \"... = (P ;; (($ok \\<Rightarrow> $ok \\<and> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D))\"\n    by (rel_auto)\n  also have \"... = ((P ;; (\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D)) \\<or> (P ;; ($ok \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<and> $ok\\<acute>))))\"\n    by (rel_auto)\n  also have \"... = (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))\"\n  proof -\n    have \"(P ;; (\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D)) = P\\<^sup>f\"\n    proof -\n      have \"(P ;; (\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D)) = ((P \\<and> \\<not> $ok\\<acute>) ;; \\<lceil>II\\<rceil>\\<^sub>D)\"\n        by (rel_auto)\n      also have \"... = (\\<exists> $ok\\<acute> \\<bullet> P \\<and> $ok\\<acute> =\\<^sub>u false)\"\n        by (rel_auto)\n      also have \"... = P\\<^sup>f\"\n        by (metis C1 one_point out_var_uvar unrest_as_exists ok_vwb_lens vwb_lens_mwb)\n     finally show ?thesis .\n    qed\n    moreover have \"(P ;; ($ok \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<and> $ok\\<acute>))) = (P\\<^sup>t \\<and> $ok\\<acute>)\"\n    proof -\n      have \"(P ;; ($ok \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<and> $ok\\<acute>))) = (P ;; ($ok \\<and> II))\"\n        by (rel_auto)\n      also have \"... = (P\\<^sup>t \\<and> $ok\\<acute>)\"\n        by (rel_auto)\n      finally show ?thesis .\n    qed\n    ultimately show ?thesis\n      by simp\n  qed\n  finally show ?thesis .\nqed\n\nlemma H2_split:\n  shows \"H2(P) = (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))\"\n  by (simp add: H2_def J_split)\n\ntheorem H2_equivalence:\n  \"P is H2 \\<longleftrightarrow> `P\\<^sup>f \\<Rightarrow> P\\<^sup>t`\"\nproof -\n  have \"`P \\<Leftrightarrow> (P ;; J)` \\<longleftrightarrow> `P \\<Leftrightarrow> (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))`\"\n    by (simp add: J_split)\n  also have \"... \\<longleftrightarrow> `(P \\<Leftrightarrow> P\\<^sup>f \\<or> P\\<^sup>t \\<and> $ok\\<acute>)\\<^sup>f \\<and> (P \\<Leftrightarrow> P\\<^sup>f \\<or> P\\<^sup>t \\<and> $ok\\<acute>)\\<^sup>t`\"\n    by (simp add: subst_bool_split)\n  also have \"... = `(P\\<^sup>f \\<Leftrightarrow> P\\<^sup>f) \\<and> (P\\<^sup>t \\<Leftrightarrow> P\\<^sup>f \\<or> P\\<^sup>t)`\"\n    by subst_tac\n  also have \"... = `P\\<^sup>t \\<Leftrightarrow> (P\\<^sup>f \\<or> P\\<^sup>t)`\"\n    by (pred_auto robust)\n  also have \"... = `(P\\<^sup>f \\<Rightarrow> P\\<^sup>t)`\"\n    by (pred_auto)\n  finally show ?thesis\n    by (metis H2_def Healthy_def' taut_iff_eq)\nqed\n\nlemma H2_equiv:\n  \"P is H2 \\<longleftrightarrow> P\\<^sup>t \\<sqsubseteq> P\\<^sup>f\"\n  using H2_equivalence refBy_order by blast\n\nlemma H2_design:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\"\n  shows \"H2(P \\<turnstile> Q) = P \\<turnstile> Q\"\n  using assms\n  by (simp add: H2_split design_def usubst unrest, pred_auto)\n\nlemma H2_rdesign:\n  \"H2(P \\<turnstile>\\<^sub>r Q) = P \\<turnstile>\\<^sub>r Q\"\n  by (simp add: H2_design unrest rdesign_def)\n\ntheorem J_idem:\n  \"(J ;; J) = J\"\n  by (rel_auto)\n\ntheorem H2_idem:\n  \"H2(H2(P)) = H2(P)\"\n  by (metis H2_def J_idem seqr_assoc)\n\ntheorem H2_Continuous: \"Continuous H2\"\n  by (rel_auto)\n\ntheorem H2_not_okay: \"H2 (\\<not> $ok) = (\\<not> $ok)\"\nproof -\n  have \"H2 (\\<not> $ok) = ((\\<not> $ok)\\<^sup>f \\<or> ((\\<not> $ok)\\<^sup>t \\<and> $ok\\<acute>))\"\n    by (simp add: H2_split)\n  also have \"... = (\\<not> $ok \\<or> (\\<not> $ok) \\<and> $ok\\<acute>)\"\n    by (subst_tac)\n  also have \"... = (\\<not> $ok)\"\n    by (pred_auto)\n  finally show ?thesis .\nqed\n\nlemma H2_true: \"H2(true) = true\"\n  by (rel_auto)\n\nlemma H2_choice_closed [closure]:\n  \"\\<lbrakk> P is H2; Q is H2 \\<rbrakk> \\<Longrightarrow> P \\<sqinter> Q is H2\"\n  by (metis H2_def Healthy_def' disj_upred_def seqr_or_distl)\n\nlemma H2_inf_closed [closure]:\n  assumes \"P is H2\" \"Q is H2\"\n  shows \"P \\<squnion> Q is H2\"\nproof -\n  have \"P \\<squnion> Q = (P\\<^sup>f \\<or> P\\<^sup>t \\<and> $ok\\<acute>) \\<squnion> (Q\\<^sup>f \\<or> Q\\<^sup>t \\<and> $ok\\<acute>)\"\n    by (metis H2_def Healthy_def J_split assms(1) assms(2))\n  moreover have \"H2(...) = ...\"\n    by (simp add: H2_split usubst, pred_auto)\n  ultimately show ?thesis\n    by (simp add: Healthy_def)\nqed\n\nlemma H2_USUP:\n  shows \"H2(\\<Sqinter> i \\<in> A \\<bullet> P(i)) = (\\<Sqinter> i \\<in> A \\<bullet> H2(P(i)))\"\n  by (rel_auto)\n\ntheorem H1_H2_commute:\n  \"H1 (H2 P) = H2 (H1 P)\"\nproof -\n  have \"H2 (H1 P) = (($ok \\<Rightarrow> P) ;; J)\"\n    by (simp add: H1_def H2_def)\n  also have \"... = ((\\<not> $ok \\<or> P) ;; J)\"\n    by (rel_auto)\n  also have \"... = (((\\<not> $ok) ;; J) \\<or> (P ;; J))\"\n    using seqr_or_distl by blast\n  also have \"... =  ((H2 (\\<not> $ok)) \\<or> H2(P))\"\n    by (simp add: H2_def)\n  also have \"... =  ((\\<not> $ok) \\<or> H2(P))\"\n    by (simp add: H2_not_okay)\n  also have \"... = H1(H2(P))\"\n    by (rel_auto)\n  finally show ?thesis by simp\nqed\n\nlemma ok_pre: \"($ok \\<and> \\<lceil>pre\\<^sub>D(P)\\<rceil>\\<^sub>D) = ($ok \\<and> (\\<not> P\\<^sup>f))\"\n  by (pred_auto robust)\n\nlemma ok_post: \"($ok \\<and> \\<lceil>post\\<^sub>D(P)\\<rceil>\\<^sub>D) = ($ok \\<and> (P\\<^sup>t))\"\n  by (pred_auto robust)\n\nabbreviation \"H1_H2 P \\<equiv> H1 (H2 P)\"\n\nnotation H1_H2 (\"\\<^bold>H\")\n\nlemma H1_H2_comp: \"\\<^bold>H = H1 \\<circ> H2\"\n  by (auto)\n\ntheorem H1_H2_eq_design:\n  \"\\<^bold>H(P) = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\nproof -\n  have \"\\<^bold>H(P) = ($ok \\<Rightarrow> H2(P))\"\n    by (simp add: H1_def)\n  also have \"... = ($ok \\<Rightarrow> (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>)))\"\n    by (metis H2_split)\n  also have \"... = ($ok \\<and> (\\<not> P\\<^sup>f) \\<Rightarrow> $ok\\<acute> \\<and> $ok \\<and> P\\<^sup>t)\"\n    by (rel_auto)\n  also have \"... = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\ntheorem H1_H2_is_design:\n  assumes \"P is H1\" \"P is H2\"\n  shows \"P = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\n  using assms by (metis H1_H2_eq_design Healthy_def)\n\ntheorem H1_H2_eq_rdesign:\n  \"\\<^bold>H(P) = pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\nproof -\n  have \"\\<^bold>H(P) = ($ok \\<Rightarrow> H2(P))\"\n    by (simp add: H1_def Healthy_def')\n  also have \"... = ($ok \\<Rightarrow> (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>)))\"\n    by (metis H2_split)\n  also have \"... = ($ok \\<and> (\\<not> P\\<^sup>f) \\<Rightarrow> $ok\\<acute> \\<and> P\\<^sup>t)\"\n    by (pred_auto)\n  also have \"... = ($ok \\<and> (\\<not> P\\<^sup>f) \\<Rightarrow> $ok\\<acute> \\<and> $ok \\<and> P\\<^sup>t)\"\n    by (pred_auto)\n  also have \"... = ($ok \\<and> \\<lceil>pre\\<^sub>D(P)\\<rceil>\\<^sub>D \\<Rightarrow> $ok\\<acute> \\<and> $ok \\<and> \\<lceil>post\\<^sub>D(P)\\<rceil>\\<^sub>D)\"\n    by (simp add: ok_post ok_pre)\n  also have \"... = ($ok \\<and> \\<lceil>pre\\<^sub>D(P)\\<rceil>\\<^sub>D \\<Rightarrow> $ok\\<acute> \\<and> \\<lceil>post\\<^sub>D(P)\\<rceil>\\<^sub>D)\"\n    by (pred_auto)\n  also have \"... =  pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\n    by (simp add: rdesign_def design_def)\n  finally show ?thesis .\nqed\n\ntheorem H1_H2_is_rdesign:\n  assumes \"P is H1\" \"P is H2\"\n  shows \"P = pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\n  by (metis H1_H2_eq_rdesign Healthy_def assms(1) assms(2))\n\nlemma H1_H2_refinement:\n  assumes \"P is \\<^bold>H\" \"Q is \\<^bold>H\"\n  shows \"P \\<sqsubseteq> Q \\<longleftrightarrow> (`pre\\<^sub>D(P) \\<Rightarrow> pre\\<^sub>D(Q)` \\<and> `pre\\<^sub>D(P) \\<and> post\\<^sub>D(Q) \\<Rightarrow> post\\<^sub>D(P)`)\"\n  by (metis H1_H2_eq_rdesign Healthy_if assms rdesign_refinement)\n\nlemma H1_H2_refines:\n  assumes \"P is \\<^bold>H\" \"Q is \\<^bold>H\" \"P \\<sqsubseteq> Q\"\n  shows \"pre\\<^sub>D(Q) \\<sqsubseteq> pre\\<^sub>D(P)\" \"post\\<^sub>D(P) \\<sqsubseteq> (pre\\<^sub>D(P) \\<and> post\\<^sub>D(Q))\"\n  using H1_H2_refinement assms refBy_order by auto\n\nlemma H1_H2_idempotent: \"\\<^bold>H (\\<^bold>H P) = \\<^bold>H P\"\n  by (simp add: H1_H2_commute H1_idem H2_idem)\n\nlemma H1_H2_Idempotent [closure]: \"Idempotent \\<^bold>H\"\n  by (simp add: Idempotent_def H1_H2_idempotent)\n\nlemma H1_H2_monotonic [closure]: \"Monotonic \\<^bold>H\"\n  by (simp add: H1_monotone H2_def mono_def seqr_mono)\n\nlemma H1_H2_Continuous [closure]: \"Continuous \\<^bold>H\"\n  by (simp add: Continuous_comp H1_Continuous H1_H2_comp H2_Continuous)\n\nlemma design_is_H1_H2 [closure]:\n  \"\\<lbrakk> $ok\\<acute> \\<sharp> P; $ok\\<acute> \\<sharp> Q \\<rbrakk> \\<Longrightarrow> (P \\<turnstile> Q) is \\<^bold>H\"\n  by (simp add: H1_design H2_design Healthy_def')\n\nlemma rdesign_is_H1_H2 [closure]:\n  \"(P \\<turnstile>\\<^sub>r Q) is \\<^bold>H\"\n  by (simp add: Healthy_def H1_rdesign H2_rdesign)\n\nlemma assigns_d_is_H1_H2 [closure]:\n  \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D is \\<^bold>H\"\n  by (simp add: assigns_d_def rdesign_is_H1_H2)\n\nlemma state_subst_H1_H2_closed [closure]: \n  \"P is \\<^bold>H \\<Longrightarrow> \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> P is \\<^bold>H\"\n  by (metis H1_H2_eq_rdesign Healthy_if rdesign_is_H1_H2 state_subst_design)\n    \nlemma seq_r_H1_H2_closed [closure]:\n  assumes \"P is \\<^bold>H\" \"Q is \\<^bold>H\"\n  shows \"(P ;; Q) is \\<^bold>H\"\nproof -\n  obtain P\\<^sub>1 P\\<^sub>2 where \"P = P\\<^sub>1 \\<turnstile>\\<^sub>r P\\<^sub>2\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def assms(1))\n  moreover obtain Q\\<^sub>1 Q\\<^sub>2 where \"Q = Q\\<^sub>1 \\<turnstile>\\<^sub>r Q\\<^sub>2\"\n   by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def assms(2))\n  moreover have \"((P\\<^sub>1 \\<turnstile>\\<^sub>r P\\<^sub>2) ;; (Q\\<^sub>1 \\<turnstile>\\<^sub>r Q\\<^sub>2)) is \\<^bold>H\"\n    by (simp add: rdesign_composition rdesign_is_H1_H2)\n  ultimately show ?thesis by simp\nqed\n\nlemma assigns_d_comp_ext:\n  fixes P :: \"'\\<alpha> hrel_des\"\n  assumes \"P is \\<^bold>H\"\n  shows \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; P) = \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> P\"\nproof -\n  have \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; P = \\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; (pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P))\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def' assms)\n  also have \"... = \\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> pre\\<^sub>D(P) \\<turnstile>\\<^sub>r \\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> post\\<^sub>D(P)\"\n    by (simp add: assign_d_left_comp)\n  also have \"... = \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> (pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P))\"\n    by (rel_auto)\n  also have \"... = \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> P\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def' assms)\n  finally show ?thesis .\nqed\n\nlemma UINF_H1_H2_closed [closure]:\n  assumes \"A \\<noteq> {}\" \"\\<forall> P \\<in> A. P is \\<^bold>H\"\n  shows \"(\\<Sqinter> A) is H1_H2\"\nproof -\n  from assms have A: \"A = H1_H2 ` A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  also have \"(\\<Sqinter> ...) = (\\<Sqinter> P \\<in> A \\<bullet> H1_H2(P))\"\n    by (simp add: UINF_as_Sup_collect)\n  also have \"... = (\\<Sqinter> P \\<in> A \\<bullet> (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t)\"\n    by (meson H1_H2_eq_design)\n  also have \"... = (\\<Squnion> P \\<in> A \\<bullet> \\<not> P\\<^sup>f) \\<turnstile> (\\<Sqinter> P \\<in> A \\<bullet> P\\<^sup>t)\"\n    by (simp add: design_UINF_mem assms)\n  also have \"... is H1_H2\"\n    by (simp add: design_is_H1_H2 unrest)\n  finally show ?thesis .\nqed\n\ndefinition design_sup :: \"('\\<alpha>, '\\<beta>) rel_des set \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (\"\\<Sqinter>\\<^sub>D_\" [900] 900) where\n\"\\<Sqinter>\\<^sub>D A = (if (A = {}) then \\<top>\\<^sub>D else \\<Sqinter> A)\"\n\nlemma design_inf_H1_H2_closed:\n  assumes \"\\<forall> P \\<in> A. P is \\<^bold>H\"\n  shows \"(\\<Sqinter>\\<^sub>D A) is \\<^bold>H\"\n  apply (auto simp add: design_sup_def)\n  apply (simp add: H1_def H2_not_okay Healthy_def impl_alt_def)\n  using UINF_H1_H2_closed assms apply blast\ndone\n\nlemma design_sup_empty [simp]: \"\\<Sqinter>\\<^sub>D {} = \\<top>\\<^sub>D\"\n  by (simp add: design_sup_def)\n\nlemma design_sup_non_empty [simp]: \"A \\<noteq> {} \\<Longrightarrow> \\<Sqinter>\\<^sub>D A = \\<Sqinter> A\"\n  by (simp add: design_sup_def)\n\nlemma USUP_mem_H1_H2_closed:\n  assumes \"\\<And> i. i \\<in> A \\<Longrightarrow> P i is \\<^bold>H\"\n  shows \"(\\<Squnion> i\\<in>A \\<bullet> P i) is \\<^bold>H\"\nproof -\n  from assms have \"(\\<Squnion> i\\<in>A \\<bullet> P i) = (\\<Squnion> i\\<in>A \\<bullet> \\<^bold>H(P i))\"\n    by (auto intro: USUP_cong simp add: Healthy_def)\n  also have \"... = (\\<Squnion> i\\<in>A \\<bullet> (\\<not> (P i)\\<^sup>f) \\<turnstile> (P i)\\<^sup>t)\"\n    by (meson H1_H2_eq_design)\n  also have \"... = (\\<Sqinter> i\\<in>A \\<bullet> \\<not> (P i)\\<^sup>f) \\<turnstile> (\\<Squnion> i\\<in>A \\<bullet> \\<not> (P i)\\<^sup>f \\<Rightarrow> (P i)\\<^sup>t)\"    \n    by (simp add: design_USUP_mem)  \n  also have \"... is \\<^bold>H\"\n    by (simp add: design_is_H1_H2 unrest)\n  finally show ?thesis .\nqed\n\nlemma USUP_ind_H1_H2_closed:\n  assumes \"\\<And> i. P i is \\<^bold>H\"\n  shows \"(\\<Squnion> i \\<bullet> P i) is \\<^bold>H\"\n  using assms USUP_mem_H1_H2_closed[of UNIV P] by simp\n  \nlemma Inf_H1_H2_closed:\n  assumes \"\\<forall> P \\<in> A. P is \\<^bold>H\"\n  shows \"(\\<Squnion> A) is \\<^bold>H\"\nproof -\n  from assms have A: \"A = \\<^bold>H ` A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  also have \"(\\<Squnion> ...) = (\\<Squnion> P \\<in> A \\<bullet> \\<^bold>H(P))\"\n    by (simp add: USUP_as_Inf_collect)\n  also have \"... = (\\<Squnion> P \\<in> A \\<bullet> (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t)\"\n    by (meson H1_H2_eq_design)\n  also have \"... = (\\<Sqinter> P \\<in> A \\<bullet> \\<not> P\\<^sup>f) \\<turnstile> (\\<Squnion> P \\<in> A \\<bullet> \\<not> P\\<^sup>f \\<Rightarrow> P\\<^sup>t)\"\n    by (simp add: design_USUP_mem)\n  also have \"... is \\<^bold>H\"\n    by (simp add: design_is_H1_H2 unrest)\n  finally show ?thesis .\nqed\n\nabbreviation design_inf :: \"('\\<alpha>, '\\<beta>) rel_des set \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (\"\\<Squnion>\\<^sub>D_\" [900] 900) where\n\"\\<Squnion>\\<^sub>D A \\<equiv> \\<Squnion> A\"\n\nlemma rdesign_ref_monos:\n  assumes \"P is \\<^bold>H\" \"Q is \\<^bold>H\" \"P \\<sqsubseteq> Q\"\n  shows \"pre\\<^sub>D(Q) \\<sqsubseteq> pre\\<^sub>D(P)\" \"post\\<^sub>D(P) \\<sqsubseteq> (pre\\<^sub>D(P) \\<and> post\\<^sub>D(Q))\"\nproof -\n  have r: \"P \\<sqsubseteq> Q \\<longleftrightarrow> (`pre\\<^sub>D(P) \\<Rightarrow> pre\\<^sub>D(Q)` \\<and> `pre\\<^sub>D(P) \\<and> post\\<^sub>D(Q) \\<Rightarrow> post\\<^sub>D(P)`)\"\n    by (metis H1_H2_eq_rdesign Healthy_if assms(1) assms(2) rdesign_refinement)\n  from r assms show \"pre\\<^sub>D(Q) \\<sqsubseteq> pre\\<^sub>D(P)\"\n    by (auto simp add: refBy_order)\n  from r assms show \"post\\<^sub>D(P) \\<sqsubseteq> (pre\\<^sub>D(P) \\<and> post\\<^sub>D(Q))\"\n    by (auto simp add: refBy_order)\nqed\n\nsubsection {* H3: The design assumption is a precondition *}\n\ntheorem H3_idem:\n  \"H3(H3(P)) = H3(P)\"\n  by (metis H3_def design_skip_idem seqr_assoc)\n\ntheorem H3_mono:\n  \"P \\<sqsubseteq> Q \\<Longrightarrow> H3(P) \\<sqsubseteq> H3(Q)\"\n  by (simp add: H3_def seqr_mono)\n\ntheorem H3_Monotonic:\n  \"Monotonic H3\"\n  by (simp add: H3_mono mono_def)\n\ntheorem H3_Continuous: \"Continuous H3\"\n  by (rel_auto)\n\ntheorem design_condition_is_H3:\n  assumes \"out\\<alpha> \\<sharp> p\"\n  shows \"(p \\<turnstile> Q) is H3\"\nproof -\n  have \"((p \\<turnstile> Q) ;; II\\<^sub>D) = (\\<not> ((\\<not> p) ;; true)) \\<turnstile> (Q\\<^sup>t ;; II\\<lbrakk>true/$ok\\<rbrakk>)\"\n    by (simp add: skip_d_alt_def design_composition_subst unrest assms)\n  also have \"... = p \\<turnstile> (Q\\<^sup>t ;; II\\<lbrakk>true/$ok\\<rbrakk>)\"\n    using assms precond_equiv seqr_true_lemma by force\n  also have \"... = p \\<turnstile> Q\"\n    by (rel_auto)\n  finally show ?thesis\n    by (simp add: H3_def Healthy_def')\nqed\n\ntheorem rdesign_H3_iff_pre:\n  \"P \\<turnstile>\\<^sub>r Q is H3 \\<longleftrightarrow> P = (P ;; true)\"\nproof -\n  have \"(P \\<turnstile>\\<^sub>r Q) ;; II\\<^sub>D = (P \\<turnstile>\\<^sub>r Q) ;; (true \\<turnstile>\\<^sub>r II)\"\n    by (simp add: skip_d_def)\n  also have \"... = (\\<not> ((\\<not> P) ;; true) \\<and> \\<not> (Q ;; (\\<not> true))) \\<turnstile>\\<^sub>r (Q ;; II)\"\n    by (simp add: rdesign_composition)\n  also have \"... = (\\<not> ((\\<not> P) ;; true) \\<and> \\<not> (Q ;; (\\<not> true))) \\<turnstile>\\<^sub>r Q\"\n    by simp\n  also have \"... = (\\<not> ((\\<not> P) ;; true)) \\<turnstile>\\<^sub>r Q\"\n    by (pred_auto)\n  finally have \"P \\<turnstile>\\<^sub>r Q is H3 \\<longleftrightarrow> P \\<turnstile>\\<^sub>r Q = (\\<not> ((\\<not> P) ;; true)) \\<turnstile>\\<^sub>r Q\"\n    by (metis H3_def Healthy_def')\n  also have \"... \\<longleftrightarrow> P = (\\<not> ((\\<not> P) ;; true))\"\n    by (metis rdesign_pre)\n      thm seqr_true_lemma\n  also have \"... \\<longleftrightarrow> P = (P ;; true)\"\n    by (simp add: seqr_true_lemma)\n  finally show ?thesis .\nqed\n\ntheorem design_H3_iff_pre:\n  assumes \"$ok \\<sharp> P\" \"$ok\\<acute> \\<sharp> P\" \"$ok \\<sharp> Q\" \"$ok\\<acute> \\<sharp> Q\"\n  shows \"P \\<turnstile> Q is H3 \\<longleftrightarrow> P = (P ;; true)\"\nproof -\n  have \"P \\<turnstile> Q = \\<lfloor>P\\<rfloor>\\<^sub>D \\<turnstile>\\<^sub>r \\<lfloor>Q\\<rfloor>\\<^sub>D\"\n    by (simp add: assms lift_desr_inv rdesign_def)\n  moreover hence \"\\<lfloor>P\\<rfloor>\\<^sub>D \\<turnstile>\\<^sub>r \\<lfloor>Q\\<rfloor>\\<^sub>D is H3 \\<longleftrightarrow> \\<lfloor>P\\<rfloor>\\<^sub>D = (\\<lfloor>P\\<rfloor>\\<^sub>D ;; true)\"\n    using rdesign_H3_iff_pre by blast\n  ultimately show ?thesis\n    by (metis assms(1,2) drop_desr_inv lift_desr_inv lift_dist_seq aext_true)\nqed\n\ntheorem H1_H3_commute:\n  \"H1 (H3 P) = H3 (H1 P)\"\n  by (rel_auto)\n\nlemma skip_d_absorb_J_1:\n  \"(II\\<^sub>D ;; J) = II\\<^sub>D\"\n  by (metis H2_def H2_rdesign skip_d_def)\n\nlemma skip_d_absorb_J_2:\n  \"(J ;; II\\<^sub>D) = II\\<^sub>D\"\nproof -\n  have \"(J ;; II\\<^sub>D) = (($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D) ;; (true \\<turnstile> II)\"\n    by (simp add: J_def skip_d_alt_def)\n  also have \"... = (\\<^bold>\\<exists> ok\\<^sub>0 \\<bullet> (($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<acute>\\<rbrakk> ;; (true \\<turnstile> II)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<rbrakk>)\"\n    by (subst seqr_middle[of ok], simp_all)\n  also have \"... = (((($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; (true \\<turnstile> II)\\<lbrakk>false/$ok\\<rbrakk>)\n                  \\<or> ((($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (true \\<turnstile> II)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: disj_comm false_alt_def true_alt_def)\n  also have \"... = ((\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D ;; true) \\<or> (\\<lceil>II\\<rceil>\\<^sub>D ;; $ok\\<acute> \\<and> \\<lceil>II\\<rceil>\\<^sub>D))\"\n    by (rel_auto)\n  also have \"... = II\\<^sub>D\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nlemma H2_H3_absorb:\n  \"H2 (H3 P) = H3 P\"\n  by (metis H2_def H3_def seqr_assoc skip_d_absorb_J_1)\n\nlemma H3_H2_absorb:\n  \"H3 (H2 P) = H3 P\"\n  by (metis H2_def H3_def seqr_assoc skip_d_absorb_J_2)\n\ntheorem H2_H3_commute:\n  \"H2 (H3 P) = H3 (H2 P)\"\n  by (simp add: H2_H3_absorb H3_H2_absorb)\n\ntheorem H3_design_pre:\n  assumes \"$ok \\<sharp> p\" \"out\\<alpha> \\<sharp> p\" \"$ok \\<sharp> Q\" \"$ok\\<acute> \\<sharp> Q\"\n  shows \"H3(p \\<turnstile> Q) = p \\<turnstile> Q\"\n  using assms\n  by (metis Healthy_def' design_H3_iff_pre precond_right_unit unrest_out\\<alpha>_var ok_vwb_lens vwb_lens_mwb)\n\ntheorem H3_rdesign_pre:\n  assumes \"out\\<alpha> \\<sharp> p\"\n  shows \"H3(p \\<turnstile>\\<^sub>r Q) = p \\<turnstile>\\<^sub>r Q\"\n  using assms\n  by (simp add: H3_def)\n\ntheorem H3_ndesign:\n  \"H3(p \\<turnstile>\\<^sub>n Q) = (p \\<turnstile>\\<^sub>n Q)\"\n  by (simp add: H3_def ndesign_def unrest_pre_out\\<alpha>)\n\ntheorem H1_H3_is_design:\n  assumes \"P is H1\" \"P is H3\"\n  shows \"P = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\n  by (metis H1_H2_eq_design H2_H3_absorb Healthy_def' assms(1) assms(2))\n\ntheorem H1_H3_is_rdesign:\n  assumes \"P is H1\" \"P is H3\"\n  shows \"P = pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\n  by (metis H1_H2_is_rdesign H2_H3_absorb Healthy_def' assms)\n\ntheorem H1_H3_is_normal_design:\n  assumes \"P is H1\" \"P is H3\"\n  shows \"P = \\<lfloor>pre\\<^sub>D(P)\\<rfloor>\\<^sub>< \\<turnstile>\\<^sub>n post\\<^sub>D(P)\"\n  by (metis H1_H3_is_rdesign assms drop_pre_inv ndesign_def precond_equiv rdesign_H3_iff_pre)\n\nabbreviation \"H1_H3 p \\<equiv> H1 (H3 p)\"\n\nnotation H1_H3 (\"\\<^bold>N\")\n\nlemma H1_H3_comp: \"H1_H3 = H1 \\<circ> H3\"\n  by (auto)\n\nlemma H1_H3_idempotent: \"\\<^bold>N (\\<^bold>N P) = \\<^bold>N P\"\n  by (simp add: H1_H3_commute H1_idem H3_idem)\n\nlemma H1_H3_Idempotent: \"Idempotent \\<^bold>N\"\n  by (simp add: Idempotent_def H1_H3_idempotent)\n\nlemma H1_H3_monotonic: \"Monotonic \\<^bold>N\"\n  by (simp add: H1_monotone H3_mono mono_def)\n\nlemma H1_H3_Continuous: \"Continuous \\<^bold>N\"\n  by (simp add: Continuous_comp H1_Continuous H1_H3_comp H3_Continuous)\n\nlemma H1_H3_intro:\n  assumes \"P is \\<^bold>H\" \"out\\<alpha> \\<sharp> pre\\<^sub>D(P)\"\n  shows \"P is \\<^bold>N\"\n  by (metis H1_H2_eq_rdesign H1_rdesign H3_rdesign_pre Healthy_def' assms)\n    \nlemma H1_H3_impl_H2 [closure]: \"P is H1_H3 \\<Longrightarrow> P is H1_H2\"\n  by (metis H1_H2_commute H1_idem H2_H3_absorb Healthy_def')\n\nlemma H1_H3_eq_design_d_comp: \"H1 (H3 P) = ((\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t) ;; II\\<^sub>D\"\n  by (metis H1_H2_eq_design H1_H3_commute H3_H2_absorb H3_def)\n\nlemma H1_H3_eq_design: \"H1 (H3 P) = (\\<not> (P\\<^sup>f ;; true)) \\<turnstile> P\\<^sup>t\"\n  apply (simp add: H1_H3_eq_design_d_comp skip_d_alt_def)\n  apply (subst design_composition_subst)\n  apply (simp_all add: usubst unrest)\n  apply (rel_auto)\ndone\n\nlemma H3_unrest_out_alpha_nok [unrest]:\n  assumes \"P is H1_H3\"\n  shows \"out\\<alpha> \\<sharp> P\\<^sup>f\"\nproof -\n  have \"P = (\\<not> (P\\<^sup>f ;; true)) \\<turnstile> P\\<^sup>t\"\n    by (metis H1_H3_eq_design Healthy_def assms)\n  also have \"out\\<alpha> \\<sharp> (...\\<^sup>f)\"\n    by (simp add: design_def usubst unrest, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma H3_unrest_out_alpha [unrest]: \"P is H1_H3 \\<Longrightarrow> out\\<alpha> \\<sharp> pre\\<^sub>D(P)\"\n  by (metis H1_H3_commute H1_H3_is_rdesign H1_idem Healthy_def' precond_equiv rdesign_H3_iff_pre)\n\nlemma ndesign_H1_H3 [closure]: \"p \\<turnstile>\\<^sub>n Q is \\<^bold>N\"\n  by (simp add: H1_rdesign H3_def Healthy_def' ndesign_def unrest_pre_out\\<alpha>)\n\nlemma ndesign_form: \"P is \\<^bold>N \\<Longrightarrow> (\\<lfloor>pre\\<^sub>D(P)\\<rfloor>\\<^sub>< \\<turnstile>\\<^sub>n post\\<^sub>D(P)) = P\"\n  by (metis H1_H2_eq_rdesign H1_H3_impl_H2 H3_unrest_out_alpha Healthy_def drop_pre_inv ndesign_def)\n\nlemma des_bot_H1_H3 [closure]: \"\\<bottom>\\<^sub>D is \\<^bold>N\"\n  by (metis H1_design H3_def Healthy_def' design_false_pre design_true_left_zero skip_d_alt_def)\n\nlemma assigns_d_H1_H3 [closure]: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D is \\<^bold>N\"\n  by (metis H1_rdesign H3_ndesign Healthy_def' aext_true assigns_d_def ndesign_def)\n\nlemma des_top_is_H1_H3 [closure]: \"\\<top>\\<^sub>D is \\<^bold>N\"\n  by (metis ndesign_H1_H3 ndesign_miracle) \n    \nlemma skip_d_is_H1_H3 [closure]: \"II\\<^sub>D is \\<^bold>N\"\n  by (metis assigns_d_H1_H3 assigns_d_id)\n    \nlemma seq_r_H1_H3_closed [closure]:\n  assumes \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n  shows \"(P ;; Q) is \\<^bold>N\"\n  by (metis (no_types) H1_H2_eq_design H1_H3_eq_design_d_comp H1_H3_impl_H2 Healthy_def assms(1) assms(2) seq_r_H1_H2_closed seqr_assoc)\n\nlemma ndes_seqr_miracle:\n  assumes \"P is \\<^bold>N\"\n  shows \"P ;; \\<top>\\<^sub>D = \\<lfloor>pre\\<^sub>D P\\<rfloor>\\<^sub>< \\<turnstile>\\<^sub>n false\"\nproof -\n  have \"P ;; \\<top>\\<^sub>D = (\\<lfloor>pre\\<^sub>D(P)\\<rfloor>\\<^sub>< \\<turnstile>\\<^sub>n post\\<^sub>D(P)) ;; (true \\<turnstile>\\<^sub>n false)\"\n    by (simp add: assms ndesign_form ndesign_miracle)\n  also have \"... = \\<lfloor>pre\\<^sub>D P\\<rfloor>\\<^sub>< \\<turnstile>\\<^sub>n false\"\n    using [[simp_trace]]\n    by (simp add: ndesign_composition_wp wp alpha )\n  finally show ?thesis .\nqed\n \nlemma ndes_seqr_abort: \n  assumes \"P is \\<^bold>N\"\n  shows \"P ;; \\<bottom>\\<^sub>D = (\\<lfloor>pre\\<^sub>D P\\<rfloor>\\<^sub>< \\<and> post\\<^sub>D P wp false) \\<turnstile>\\<^sub>n false\"\nproof -\n  have \"P ;; \\<bottom>\\<^sub>D = (\\<lfloor>pre\\<^sub>D(P)\\<rfloor>\\<^sub>< \\<turnstile>\\<^sub>n post\\<^sub>D(P)) ;; (false \\<turnstile>\\<^sub>n false)\"\n    by (simp add: assms ndesign_false_pre ndesign_form)\n  also have \"... = (\\<lfloor>pre\\<^sub>D P\\<rfloor>\\<^sub>< \\<and> post\\<^sub>D P wp false) \\<turnstile>\\<^sub>n false\"\n    by (simp add: ndesign_composition_wp alpha)\n  finally show ?thesis .\nqed\n    \nlemma wp_assigns_d [wp]: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D wp\\<^sub>D r = \\<sigma> \\<dagger> r\"\n  by (rel_auto)\n\ntheorem wpd_seq_r_H1_H3 [wp]:\n  fixes P Q :: \"'\\<alpha> hrel_des\"\n  assumes \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n  shows \"(P ;; Q) wp\\<^sub>D r = P wp\\<^sub>D (Q wp\\<^sub>D r)\"\n  by (metis H1_H3_commute H1_H3_is_normal_design H1_idem Healthy_def' assms(1) assms(2) wpnd_seq_r)\n\nlemma preD_USUP_mem: \"pre\\<^sub>D (\\<Squnion> i\\<in>A \\<bullet> P i) = (\\<Sqinter> i\\<in>A \\<bullet> pre\\<^sub>D(P i))\"\n  by (rel_auto)\n  \nlemma preD_USUP_ind: \"pre\\<^sub>D (\\<Squnion> i \\<bullet> P i) = (\\<Sqinter> i \\<bullet> pre\\<^sub>D(P i))\"\n  by (rel_auto)\n\nlemma USUP_ind_H1_H3_closed [closure]:\n  \"\\<lbrakk> \\<And> i. P i is \\<^bold>N \\<rbrakk> \\<Longrightarrow> (\\<Squnion> i \\<bullet> P i) is \\<^bold>N\"\n  by (rule H1_H3_intro, simp_all add: H1_H3_impl_H2 USUP_ind_H1_H2_closed preD_USUP_ind unrest)\n    \nlemma state_subst_H1_H3_closed [closure]: \n  \"P is \\<^bold>N \\<Longrightarrow> \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> P is \\<^bold>N\"\n  by (metis H1_H2_eq_rdesign H1_H3_impl_H2 Healthy_if assign_d_left_comp assigns_d_H1_H3 seq_r_H1_H3_closed state_subst_design)\n    \ntext {* If two normal designs have the same weakest precondition for any given postcondition, then\n  the two designs are equivalent. *}\n\ntheorem wpd_eq_intro: \"\\<lbrakk> \\<And> r. (p\\<^sub>1 \\<turnstile>\\<^sub>n Q\\<^sub>1) wp\\<^sub>D r = (p\\<^sub>2 \\<turnstile>\\<^sub>n Q\\<^sub>2) wp\\<^sub>D r \\<rbrakk> \\<Longrightarrow> (p\\<^sub>1 \\<turnstile>\\<^sub>n Q\\<^sub>1) = (p\\<^sub>2 \\<turnstile>\\<^sub>n Q\\<^sub>2)\"\napply (rel_simp robust; metis curry_conv)\ndone\n\ntheorem wpd_H3_eq_intro: \"\\<lbrakk> P is H1_H3; Q is H1_H3; \\<And> r. P wp\\<^sub>D r = Q wp\\<^sub>D r \\<rbrakk> \\<Longrightarrow> P = Q\"\n  by (metis H1_H3_commute H1_H3_is_normal_design H3_idem Healthy_def' wpd_eq_intro)\n\nsubsection {* H4: Feasibility *}\n\ntheorem H4_idem:\n  \"H4(H4(P)) = H4(P)\"\n  by (pred_auto)\n\nlemma is_H4_alt_def:\n  \"P is H4 \\<longleftrightarrow> (P ;; true) = true\"\n  by (rel_auto)\n\nlemma H4_assigns_d: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D is H4\"\nproof -\n  have \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; (false \\<turnstile>\\<^sub>r true\\<^sub>h)) = (false \\<turnstile>\\<^sub>r true)\"\n    by (simp add: assigns_d_def rdesign_composition assigns_r_feasible)\n  moreover have \"... = true\"\n    by (rel_auto)\n  ultimately show ?thesis\n    using is_H4_alt_def by auto\nqed\n\nsubsection {* UTP theories *}\n\ntypedecl DES\ntypedecl NDES\n\nabbreviation \"DES \\<equiv> UTHY(DES, '\\<alpha> des)\"\nabbreviation \"NDES \\<equiv> UTHY(NDES, '\\<alpha> des)\"\n\noverloading\n  des_hcond == \"utp_hcond :: (DES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\"\n  des_unit == \"utp_unit :: (DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" (unchecked)\n\n  ndes_hcond == \"utp_hcond :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\"\n  ndes_unit == \"utp_unit :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" (unchecked)\n\nbegin\n  definition des_hcond :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\" where\n  [upred_defs]: \"des_hcond t = H1_H2\"\n\n  definition des_unit :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"des_unit t = II\\<^sub>D\"\n\n  definition ndes_hcond :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\" where\n  [upred_defs]: \"ndes_hcond t = H1_H3\"\n\n  definition ndes_unit :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"ndes_unit t = II\\<^sub>D\"\n\nend\n\ninterpretation des_utp_theory: utp_theory DES\n  by (simp add: H1_H2_commute H1_idem H2_idem des_hcond_def utp_theory_def)\n\ninterpretation ndes_utp_theory: utp_theory NDES\n  by (simp add: H1_H3_commute H1_idem H3_idem ndes_hcond_def utp_theory.intro)\n\ninterpretation des_left_unital: utp_theory_left_unital DES\n  apply (unfold_locales)\n  apply (simp_all add: des_hcond_def des_unit_def)\n  using seq_r_H1_H2_closed apply blast\n  apply (simp add: rdesign_is_H1_H2 skip_d_def)\n  apply (metis H1_idem H1_left_unit Healthy_def')\ndone\n\ninterpretation ndes_unital: utp_theory_unital NDES\n  apply (unfold_locales, simp_all add: ndes_hcond_def ndes_unit_def)\n  using seq_r_H1_H3_closed apply blast\n  apply (metis H1_rdesign H3_def Healthy_def' design_skip_idem skip_d_def)\n  apply (metis H1_idem H1_left_unit Healthy_def')\n  apply (metis H1_H3_commute H3_def H3_idem Healthy_def')\ndone\n\ninterpretation design_theory_continuous: utp_theory_continuous DES\n  rewrites \"\\<And> P. P \\<in> carrier (uthy_order DES) \\<longleftrightarrow> P is \\<^bold>H\"\n  and \"carrier (uthy_order DES) \\<rightarrow> carrier (uthy_order DES) \\<equiv> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n  and \"\\<lbrakk>\\<H>\\<^bsub>DES\\<^esub>\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<H>\\<^bsub>DES\\<^esub>\\<rbrakk>\\<^sub>H \\<equiv> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n  and \"le (uthy_order DES) = op \\<sqsubseteq>\"\n  and \"eq (uthy_order DES) = op =\"\n  by (unfold_locales, simp_all add: des_hcond_def H1_H2_Continuous utp_order_def)\n\ninterpretation normal_design_theory_continuous: utp_theory_continuous NDES\n  rewrites \"\\<And> P. P \\<in> carrier (uthy_order NDES) \\<longleftrightarrow> P is \\<^bold>N\"\n  and \"carrier (uthy_order NDES) \\<rightarrow> carrier (uthy_order NDES) \\<equiv> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H\"\n  and \"le (uthy_order NDES) = op \\<sqsubseteq>\"\n  and \"A \\<subseteq> carrier (uthy_order NDES) \\<longleftrightarrow> A \\<subseteq> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H\"  \n  and \"eq (uthy_order NDES) = op =\"  \n  by (unfold_locales, simp_all add: ndes_hcond_def H1_H3_Continuous utp_order_def)\n\nthm design_theory_continuous.healthy_top\n\nlemma design_lat_top: \"\\<^bold>\\<top>\\<^bsub>DES\\<^esub> = \\<^bold>H(false)\"\n  by (simp add: design_theory_continuous.healthy_top, simp add: des_hcond_def)\n\nlemma design_lat_bottom: \"\\<^bold>\\<bottom>\\<^bsub>DES\\<^esub> = \\<^bold>H(true)\"\n  by (simp add: design_theory_continuous.healthy_bottom, simp add: des_hcond_def)\n\nlemma ndesign_lat_top: \"\\<^bold>\\<top>\\<^bsub>NDES\\<^esub> = \\<^bold>N(false)\"\n  by (metis ndes_hcond_def normal_design_theory_continuous.healthy_top)\n\nlemma ndesign_lat_bottom: \"\\<^bold>\\<bottom>\\<^bsub>NDES\\<^esub> = \\<^bold>N(true)\"\n  by (metis ndes_hcond_def normal_design_theory_continuous.healthy_bottom)\n    \nabbreviation design_lfp :: \"('\\<alpha> hrel_des \\<Rightarrow> '\\<alpha> hrel_des) \\<Rightarrow> '\\<alpha> hrel_des\" (\"\\<mu>\\<^sub>D\") where\n\"\\<mu>\\<^sub>D F \\<equiv> \\<^bold>\\<mu>\\<^bsub>DES\\<^esub> F\"\n\nabbreviation design_gfp :: \"('\\<alpha> hrel_des \\<Rightarrow> '\\<alpha> hrel_des) \\<Rightarrow> '\\<alpha> hrel_des\" (\"\\<nu>\\<^sub>D\") where\n\"\\<nu>\\<^sub>D F \\<equiv> \\<^bold>\\<nu>\\<^bsub>DES\\<^esub> F\"\n\nsyntax\n  \"_dmu\" :: \"pttrn \\<Rightarrow> logic \\<Rightarrow> logic\" (\"\\<mu>\\<^sub>D _ \\<bullet> _\" [0, 10] 10)\n  \"_dnu\" :: \"pttrn \\<Rightarrow> logic \\<Rightarrow> logic\" (\"\\<nu>\\<^sub>D _ \\<bullet> _\" [0, 10] 10)\n\ntranslations\n  \"\\<mu>\\<^sub>D X \\<bullet> P\" == \"\\<^bold>\\<mu>\\<^bsub>CONST DES\\<^esub> (\\<lambda> X. P)\"\n  \"\\<nu>\\<^sub>D X \\<bullet> P\" == \"\\<^bold>\\<nu>\\<^bsub>CONST DES\\<^esub> (\\<lambda> X. P)\"\n\nthm design_theory_continuous.GFP_unfold\nthm design_theory_continuous.LFP_unfold\n\ntext {* We also set up local variables for designs. *}\n\noverloading\n  des_pvar == \"pvar :: (DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\"\n  des_assigns == \"pvar_assigns :: (DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\"\n  ndes_pvar == \"pvar :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\"\n  ndes_assigns == \"pvar_assigns :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\"\nbegin\n  definition des_pvar :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\" where\n  [upred_defs]: \"des_pvar T = \\<Sigma>\\<^sub>D\"\n  definition des_assigns :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"des_assigns T \\<sigma> = \\<langle>\\<sigma>\\<rangle>\\<^sub>D\"\n  definition ndes_pvar :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\" where\n  [upred_defs]: \"ndes_pvar T = \\<Sigma>\\<^sub>D\"\n  definition ndes_assigns :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"ndes_assigns T \\<sigma> = \\<langle>\\<sigma>\\<rangle>\\<^sub>D\"\n\nend\n\ninterpretation des_prog_var: utp_prog_var \"UTHY(DES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>DES\\<^esub> = \\<^bold>H\"\n  apply (unfold_locales, simp_all add: des_pvar_def des_assigns_def des_hcond_def)\n  apply (simp add: assigns_d_def rdesign_is_H1_H2)\n  apply (simp add: assigns_d_comp_ext assigns_d_is_H1_H2)\n  apply (rel_auto)\ndone\n\ninterpretation ndes_prog_var: utp_prog_var \"UTHY(NDES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>NDES\\<^esub> = \\<^bold>N\"\n  apply (unfold_locales, simp_all add: ndes_pvar_def ndes_assigns_def ndes_hcond_def)\n  apply (simp add: assigns_d_H1_H3)\n  apply (rel_auto)\ndone\n\ninterpretation des_local_var: utp_local_var \"UTHY(DES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>DES\\<^esub> = \\<^bold>H\"\n  by (unfold_locales, simp_all add: des_unit_def des_assigns_def des_hcond_def)\n\ninterpretation ndes_local_var: utp_local_var \"UTHY(NDES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>NDES\\<^esub> = \\<^bold>N\"\n  by (unfold_locales, simp_all add: ndes_unit_def ndes_assigns_def ndes_hcond_def)\n\ntext {* Weakest precondition laws for design variable scopes *}\n\nlemma wpd_var_begin [wp]:\n  fixes x :: \"'a list \\<Longrightarrow> '\\<alpha>\" and r :: \"'\\<alpha> upred\"\n  shows \"(var_begin NDES x) wp\\<^sub>D r = r\\<lbrakk>\\<langle>\\<guillemotleft>undefined\\<guillemotright>\\<rangle> ^\\<^sub>u &x/x\\<rbrakk>\"\n  by (simp add: var_begin_def ndes_assigns_def wp usubst)\n\nlemma wpd_var_end [wp]:\n  fixes x :: \"'a list \\<Longrightarrow> '\\<alpha>\" and r :: \"'\\<alpha> upred\"\n  shows \"(var_end NDES x) wp\\<^sub>D r = r\\<lbrakk>tail\\<^sub>u(&x)/x\\<rbrakk>\"\n  by (simp add: var_end_def ndes_assigns_def wp usubst)\n\ntext {* Example Galois connection between designs and relations. Based on Jim's example in COMPASS\n        deliverable D23.5. *}\n\ndefinition [upred_defs]: \"Des(R) = \\<^bold>H(\\<lceil>R\\<rceil>\\<^sub>D \\<and> $ok\\<acute>)\"\ndefinition [upred_defs]: \"Rel(D) = \\<lfloor>D\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>\\<rfloor>\\<^sub>D\"\n\nlemma Des_design: \"Des(R) = true \\<turnstile>\\<^sub>r R\"\n  by (rel_auto)\n\nlemma Rel_design: \"Rel(P \\<turnstile>\\<^sub>r Q) = (P \\<Rightarrow> Q)\"\n  by (rel_auto)\n\ninterpretation Des_Rel_coretract:\n  coretract \"DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\"\n  rewrites\n    \"\\<And> x. x \\<in> carrier \\<X>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = (x is \\<^bold>H)\" and\n    \"\\<And> x. x \\<in> carrier \\<Y>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = True\" and\n    \"\\<pi>\\<^sub>*\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = Des\" and\n    \"\\<pi>\\<^sup>*\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = Rel\" and\n    \"le \\<X>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = op \\<sqsubseteq>\" and\n    \"le \\<Y>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = op \\<sqsubseteq>\"\nproof (unfold_locales, simp_all add: rel_hcond_def des_hcond_def)\n  show \"\\<And>x. x is id\"\n    by (simp add: Healthy_def)\nnext\n  show \"Rel \\<in> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>id\\<rbrakk>\\<^sub>H\"\n    by (auto simp add: Rel_def rel_hcond_def Healthy_def)\nnext\n  show \"Des \\<in> \\<lbrakk>id\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n    by (auto simp add: Des_def des_hcond_def Healthy_def H1_H2_commute H1_idem H2_idem)\nnext\n  fix R :: \"'a hrel\"\n  show \"R \\<sqsubseteq> Rel (Des R)\"\n    by (simp add: Des_design Rel_design)\nnext\n  fix R :: \"'a hrel\" and D :: \"'a hrel_des\"\n  assume a: \"D is \\<^bold>H\"\n  then obtain D\\<^sub>1 D\\<^sub>2 where D: \"D = D\\<^sub>1 \\<turnstile>\\<^sub>r D\\<^sub>2\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H1_idem Healthy_def')\n  show \"(Rel D \\<sqsubseteq> R) = (D \\<sqsubseteq> Des R)\"\n  proof -\n    have \"(D \\<sqsubseteq> Des R) = (D\\<^sub>1 \\<turnstile>\\<^sub>r D\\<^sub>2 \\<sqsubseteq> true \\<turnstile>\\<^sub>r R)\"\n      by (simp add: D Des_design)\n    also have \"... = `D\\<^sub>1 \\<and> R \\<Rightarrow> D\\<^sub>2`\"\n      by (simp add: rdesign_refinement)\n    also have \"... = ((D\\<^sub>1 \\<Rightarrow> D\\<^sub>2) \\<sqsubseteq> R)\"\n      by (rel_auto)\n    also have \"... = (Rel D \\<sqsubseteq> R)\"\n      by (simp add: D Rel_design)\n    finally show ?thesis ..\n  qed\nqed\n\ntext {* From this interpretation we gain many Galois theorems. Some require simplification to\n        remove superfluous assumptions. *}\n\nthm Des_Rel_coretract.deflation[simplified]\nthm Des_Rel_coretract.inflation\nthm Des_Rel_coretract.upper_comp[simplified]\nthm Des_Rel_coretract.lower_comp\n\ntext {* Specialise @{thm [source] mu_refine_intro} to designs. *}\n\nlemma design_mu_refine_intro:\n  assumes \"$ok\\<acute> \\<sharp> C\" \"$ok\\<acute> \\<sharp> S\" \"(C \\<turnstile> S) \\<sqsubseteq> F(C \\<turnstile> S)\" \"`C \\<Rightarrow> (\\<mu>\\<^sub>D F \\<Leftrightarrow> \\<nu>\\<^sub>D F)`\"\n  shows \"(C \\<turnstile> S) \\<sqsubseteq> \\<mu>\\<^sub>D F\"\nproof -\n  from assms have \"(C \\<turnstile> S) \\<sqsubseteq> \\<nu>\\<^sub>D F\"\n    thm design_theory_continuous.weak.GFP_upperbound\n    by (simp add: design_is_H1_H2 design_theory_continuous.weak.GFP_upperbound)\n  with assms show ?thesis\n    by (rel_auto, metis (no_types, lifting))\nqed\n\nlemma rdesign_mu_refine_intro:\n  assumes \"(C \\<turnstile>\\<^sub>r S) \\<sqsubseteq> F(C \\<turnstile>\\<^sub>r S)\" \"`\\<lceil>C\\<rceil>\\<^sub>D \\<Rightarrow> (\\<mu>\\<^sub>D F \\<Leftrightarrow> \\<nu>\\<^sub>D F)`\"\n  shows \"(C \\<turnstile>\\<^sub>r S) \\<sqsubseteq> \\<mu>\\<^sub>D F\"\n  using assms by (simp add: rdesign_def design_mu_refine_intro unrest)\n\nlemma H1_H2_mu_refine_intro:\n  assumes \"P is \\<^bold>H\" \"P \\<sqsubseteq> F(P)\" \"`\\<lceil>pre\\<^sub>D(P)\\<rceil>\\<^sub>D \\<Rightarrow> (\\<mu>\\<^sub>D F \\<Leftrightarrow> \\<nu>\\<^sub>D F)`\"\n  shows \"P \\<sqsubseteq> \\<mu>\\<^sub>D F\"\n  by (metis H1_H2_eq_rdesign Healthy_if assms rdesign_mu_refine_intro)\n\ntext {* A theorem we'd like to have, but that doesn't seem true ... *}\n\nlemma conditional_refine:\n  assumes \"mono F\" \"(P \\<Rightarrow> F(Q)) \\<sqsubseteq> Q\"\n  shows \"(P \\<Rightarrow> \\<mu> F) \\<sqsubseteq> Q\"\n  oops\n\nlocale design_fp =\n  fixes F :: \"'\\<alpha> hrel_des \\<Rightarrow> '\\<alpha> hrel_des\"\n  assumes mono_F: \"mono F\"\n  and type_F: \"F \\<in> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\nbegin\n\n  definition \"P(Y) \\<equiv> \\<nu> X \\<bullet> pre\\<^sub>D(F(X \\<turnstile>\\<^sub>r Y))\"\n  definition \"Q \\<equiv> \\<mu> Y \\<bullet> (P(Y) \\<Rightarrow> post\\<^sub>D(F(P(Y) \\<turnstile>\\<^sub>r Y)))\"\n\n  lemma mono_design_iter: \"mono (\\<lambda>X. pre\\<^sub>D (F X) \\<turnstile>\\<^sub>r post\\<^sub>D (F X))\"\n    apply (rule monoI)\n    apply (rule rdesign_refine_intro')\n    apply (metis design_pre_choice mono_F mono_def semilattice_sup_class.le_iff_sup utp_pred_laws.inf.absorb_iff2)\n    apply (metis (no_types, lifting) design_post_choice mono_F semilattice_inf_class.inf.absorb2 semilattice_inf_class.inf.orderE semilattice_sup_class.mono_sup semilattice_sup_class.sup.orderE semilattice_sup_class.sup_ge1 utp_pred_laws.le_infI2 utp_pred_laws.sup.order_iff)\n  done\n\n  lemma mu_design_iter:\n    \"(\\<mu> X \\<bullet> pre\\<^sub>D(F(X)) \\<turnstile>\\<^sub>r post\\<^sub>D(F(X))) = F(\\<mu> X \\<bullet> pre\\<^sub>D(F(X)) \\<turnstile>\\<^sub>r post\\<^sub>D(F(X)))\"\n      by (metis (no_types, lifting) H1_H2_eq_rdesign H1_H2_idempotent Healthy_def Healthy_if\n                PiE gfp_fixpoint mem_Collect_eq mono_design_iter type_F)\n\n  lemma mu_design_form:\n    \"\\<mu>\\<^sub>D F = (\\<mu> X \\<bullet> pre\\<^sub>D(F(X)) \\<turnstile>\\<^sub>r post\\<^sub>D(F(X)))\"\n  proof -\n    have 1: \"F (\\<mu> X \\<bullet> pre\\<^sub>D (F X) \\<turnstile>\\<^sub>r post\\<^sub>D (F X)) is \\<^bold>H\"\n      by (metis (no_types, lifting) H1_H2_eq_rdesign Healthy_def' gfp_unfold mono_design_iter mu_design_iter)\n    have 2:\"Mono\\<^bsub>uthy_order DES\\<^esub> F\"\n      by (simp add: mono_F mono_Monotone_utp_order)\n    hence 3:\"\\<mu>\\<^sub>D F = F (\\<mu>\\<^sub>D F)\"\n      by (simp add: design_theory_continuous.LFP_unfold[THEN sym] type_F)\n    hence \"pre\\<^sub>D (F (F (\\<mu>\\<^sub>D F))) \\<turnstile>\\<^sub>r post\\<^sub>D (F (F (\\<mu>\\<^sub>D F))) = \\<mu>\\<^sub>D F\"\n      by (metis H1_H2_eq_rdesign Healthy_def design_theory_continuous.weak.LFP_closed)\n    hence \"(\\<mu> X \\<bullet> pre\\<^sub>D (F X) \\<turnstile>\\<^sub>r post\\<^sub>D (F X)) \\<sqsubseteq> F (\\<mu>\\<^sub>D F)\"\n      by (simp add: 2 design_theory_continuous.weak.LFP_lemma3 gfp_upperbound type_F)\n    thus ?thesis\n      using 1 3 design_theory_continuous.weak.LFP_lowerbound eq_iff mu_design_iter by auto\n  qed\n\n  lemma mu_postcondition: \"post\\<^sub>D(\\<mu>\\<^sub>D F) = Q\"\n  proof (rule antisym)\n    show \"Q \\<sqsubseteq> post\\<^sub>D (\\<mu>\\<^sub>D F)\"\n      apply (simp add: Q_def)\n      apply (rule gfp_upperbound)\n    oops\n\n  lemma mu_postcondition:\n    \"post\\<^sub>D(F(\\<mu> X \\<bullet> pre\\<^sub>D(F(X)) \\<turnstile>\\<^sub>r post\\<^sub>D(F(X)))) = Q\"\n  proof (simp add: Q_def, rule antisym)\n    show \"(\\<mu> Y \\<bullet> P Y \\<Rightarrow> post\\<^sub>D (F (P Y \\<turnstile>\\<^sub>r Y))) \\<sqsubseteq> post\\<^sub>D (F (\\<mu> X \\<bullet> pre\\<^sub>D (F X) \\<turnstile>\\<^sub>r post\\<^sub>D (F X)))\"\n    proof (rule gfp_upperbound)\n  oops\n\n  lemma mu_precondition:\n    \"pre\\<^sub>D(F(\\<mu> X \\<bullet> pre\\<^sub>D(F(X)) \\<turnstile>\\<^sub>r post\\<^sub>D(F(X)))) = P(Q)\"\n  proof (simp add: P_def, rule antisym)\n    show \"(\\<nu> X \\<bullet> pre\\<^sub>D (F (X \\<turnstile>\\<^sub>r Q))) \\<sqsubseteq> pre\\<^sub>D (F (\\<mu> X \\<bullet> pre\\<^sub>D (F X) \\<turnstile>\\<^sub>r post\\<^sub>D (F X)))\"\n    proof (rule lfp_greatest)\n      fix Y\n      assume a:\"Y \\<sqsubseteq> pre\\<^sub>D (F (Y \\<turnstile>\\<^sub>r Q))\"\n      have \"pre\\<^sub>D (F (Y \\<turnstile>\\<^sub>r Q)) \\<sqsubseteq> pre\\<^sub>D (F (\\<mu> X \\<bullet> pre\\<^sub>D (F X) \\<turnstile>\\<^sub>r post\\<^sub>D (F X)))\"\n      proof (rule rdesign_ref_monos)\n        show \"F (\\<mu> X \\<bullet> pre\\<^sub>D (F X) \\<turnstile>\\<^sub>r post\\<^sub>D (F X)) \\<sqsubseteq> F (Y \\<turnstile>\\<^sub>r Q)\"\n        proof (rule monoD[OF mono_F])\n          show \"(\\<mu> X \\<bullet> pre\\<^sub>D (F X) \\<turnstile>\\<^sub>r post\\<^sub>D (F X)) \\<sqsubseteq> Y \\<turnstile>\\<^sub>r Q\"\n          proof (rule gfp_upperbound, rule rdesign_refine_intro')\n            show \"Y \\<sqsubseteq> pre\\<^sub>D (F (Y \\<turnstile>\\<^sub>r Q))\"\n              using a by blast\n            have \"post\\<^sub>D (F (Y \\<turnstile>\\<^sub>r Q)) \\<sqsubseteq> Q\"\n              apply (simp add: Q_def)\n              apply (rule gfp_least)\n            oops\n\n  lemma mono_pre_F: \"X \\<sqsubseteq> Y \\<Longrightarrow> pre\\<^sub>D(F (X \\<turnstile>\\<^sub>r Z)) \\<sqsubseteq> pre\\<^sub>D(F (Y \\<turnstile>\\<^sub>r Z))\"\n    apply (rule rdesign_ref_monos(1))\n    using rdesign_is_H1_H2 type_F apply fastforce\n    using rdesign_is_H1_H2 type_F apply fastforce\n    apply (rule monoD[OF mono_F])\n    apply (rel_simp)\n  done\n\n  lemma P_is_pre: \"P(X) = pre\\<^sub>D((F (P X \\<turnstile>\\<^sub>r X)))\"\n    apply (simp add: P_def)\n    apply (subst lfp_unfold)\n    apply (simp_all add: monoI mono_pre_F)\n  done\n\n  lemma antitone_post_F: \"X \\<sqsubseteq> Y \\<Longrightarrow> pre\\<^sub>D(F (Z \\<turnstile>\\<^sub>r Y)) \\<sqsubseteq> pre\\<^sub>D(F (Z \\<turnstile>\\<^sub>r X))\"\n    apply (rule rdesign_ref_monos(1))\n    using rdesign_is_H1_H2 type_F apply fastforce\n    using rdesign_is_H1_H2 type_F apply fastforce\n    apply (rule monoD[OF mono_F])\n    apply (rel_simp)\n  done\n\n lemma P_antitone:\n    \"X \\<sqsubseteq> Y \\<Longrightarrow> P(Y) \\<sqsubseteq> P(X)\"\n    apply (simp add: P_def)\n    apply (rule lfp_mono)\n    apply (simp add: antitone_post_F)\n  done\n\n  lemma mono_post_F: \"Y \\<sqsubseteq> X \\<Longrightarrow> post\\<^sub>D(F(P(Y) \\<turnstile>\\<^sub>r Y)) \\<sqsubseteq> (P(Y) \\<and> post\\<^sub>D(F(P(X) \\<turnstile>\\<^sub>r X)))\"\n    apply (subst P_is_pre)\n    apply (rule rdesign_ref_monos(2))\n    using rdesign_is_H1_H2 type_F apply fastforce\n    using rdesign_is_H1_H2 type_F apply fastforce\n    apply (rule monoD[OF mono_F])\n    apply (rule rdesign_refine_intro)\n    using P_antitone refBy_order apply auto[1]\n    apply (rel_auto)\n  done\n\n  lemma P_Q_design_fixed_point:\n    \"F(P(Q) \\<turnstile>\\<^sub>r Q) = (P(Q) \\<turnstile>\\<^sub>r Q)\"\n  proof -\n    have \"F(P(Q) \\<turnstile>\\<^sub>r Q) = pre\\<^sub>D(F(P(Q) \\<turnstile>\\<^sub>r Q)) \\<turnstile>\\<^sub>r post\\<^sub>D(F(P(Q) \\<turnstile>\\<^sub>r Q))\"\n    proof -\n      have \"P Q \\<turnstile>\\<^sub>r Q is \\<^bold>H\"\n        using rdesign_is_H1_H2 by blast\n      then show ?thesis\n        by (metis (no_types) H1_H2_eq_rdesign Healthy_if Pi_iff mem_Collect_eq type_F)\n    qed\n    also have \"... = P(Q) \\<turnstile>\\<^sub>r post\\<^sub>D(F(P(Q) \\<turnstile>\\<^sub>r Q))\"\n    proof -\n      have \"mono (\\<lambda>X. pre\\<^sub>D(F (X \\<turnstile>\\<^sub>r Q)))\"\n        by (simp add: monoI mono_pre_F)\n      hence \"pre\\<^sub>D(F(P(Q) \\<turnstile>\\<^sub>r Q)) = P(Q)\"\n        using P_is_pre by auto\n      thus ?thesis by simp\n    qed\n    also have \"... = P(Q) \\<turnstile>\\<^sub>r (P(Q) \\<Rightarrow> post\\<^sub>D(F(P(Q) \\<turnstile>\\<^sub>r Q)))\"\n      by (rel_auto)\n    also have \"... = P(Q) \\<turnstile>\\<^sub>r Q\"\n    proof -\n      have \"mono (\\<lambda>Y. P Y \\<Rightarrow> post\\<^sub>D(F (P Y \\<turnstile>\\<^sub>r Y)))\"\n        by (simp add: P_antitone impl_refine_intro monoI mono_post_F)\n      hence \"(P(Q) \\<Rightarrow> post\\<^sub>D(F(P(Q) \\<turnstile>\\<^sub>r Q))) = Q\"\n        using Q_def gfp_fixpoint by auto\n      thus ?thesis\n        by simp\n    qed\n    finally show ?thesis .\n  qed\n\nend\n\nsubsection {* Normal Designs Proof Tactics *}\n  \nnamed_theorems ND_elim\n  \nlemma ndes_elim [ND_elim]: \"\\<lbrakk> P is \\<^bold>N; Q(\\<lfloor>pre\\<^sub>D(P)\\<rfloor>\\<^sub>< \\<turnstile>\\<^sub>n post\\<^sub>D(P)) \\<rbrakk> \\<Longrightarrow> Q(P)\"\n  by (simp add: ndesign_form)\n    \nmethod ndes_expand uses cls = (insert cls, (erule ND_elim)+)\n  \nmethod ndes_simp uses cls =\n  ((ndes_expand cls: cls)?, (simp add: ndes_simp cls closure alpha usubst unrest wp prod.case_eq_if))\n\nmethod ndes_refine uses cls =\n  (ndes_simp cls: cls; rule_tac ndesign_refine_intro; (insert cls; rel_simp; auto?))\n\nmethod ndes_eq uses cls =\n  (rule_tac antisym; ndes_refine)\n  \nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP/theories/utp_designs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3310596390570629}}
{"text": "section \\<open> TripleSet by RBTs \\<close>\ntheory RBT_TripleSetImpl\nimports \"../../TripleSetGA\" \nbegin\n\nsubsection \\<open>Triple Set\\<close>\n\ninterpretation rs_ts_defs: tsbm_defs rm_ops rm_ops rs_ops \n  by intro_locales\n\ndefinition \"rs_ts_\\<alpha> \\<equiv> rs_ts_defs.tsbm_\\<alpha>\"\ndefinition \"rs_ts_invar \\<equiv> rs_ts_defs.tsbm_invar\"\ndefinition \"rs_ts_empty \\<equiv> rs_ts_defs.tsbm_empty\"\ndefinition \"rs_ts_memb \\<equiv> rs_ts_defs.tsbm_memb\"\ndefinition \"rs_ts_add \\<equiv> rs_ts_defs.tsbm_add\"\ndefinition \"rs_ts_add_Al \\<equiv> rs_ts_defs.tsbm_add_Al\"\ndefinition \"rs_ts_add_Bl \\<equiv> rs_ts_defs.tsbm_add_Bl\"\ndefinition \"rs_ts_add_Cl \\<equiv> rs_ts_defs.tsbm_add_Cl\"\ndefinition \"rs_ts_add_Cs \\<equiv> rs_ts_defs.tsbm_add_Cs\"\ndefinition \"rs_ts_set_Cs \\<equiv> rs_ts_defs.tsbm_set_Cs\"\ndefinition \"rs_ts_delete \\<equiv> rs_ts_defs.tsbm_delete\"\ndefinition \"rs_ts_filter_it \\<equiv> rs_ts_defs.tsbm_filter_it rm_iteratei rm_iteratei rs_iteratei\"\ndefinition \"rs_ts_it \\<equiv> rs_ts_defs.tsbm_it rm_iteratei rm_iteratei rs_iteratei\"\ndefinition \"rs_ts_A_it \\<equiv> rs_ts_defs.tsbm_A_it rm_iteratei\"\ndefinition \"rs_ts_B_it \\<equiv> rs_ts_defs.tsbm_B_it rm_iteratei\"\ndefinition \"rs_ts_C_it \\<equiv> rs_ts_defs.tsbm_C_it rs_iteratei\"\ndefinition \"rs_ts_AB_it \\<equiv> rs_ts_defs.tsbm_AB_it rm_iteratei rm_iteratei\"\ndefinition \"rs_ts_AC_it \\<equiv> rs_ts_defs.tsbm_AC_it rm_iteratei rs_iteratei\"\ndefinition \"rs_ts_BC_it \\<equiv> rs_ts_defs.tsbm_BC_it rm_iteratei rs_iteratei\"\n\ndefinition \"rs_ts_from_list \\<equiv>  tsga_from_list rs_ts_empty rs_ts_add\"\ndefinition \"rs_ts_to_list \\<equiv> tsga_to_list rs_ts_it\"\ndefinition \"rs_ts_image_filter \\<equiv> tsga_image_filter rs_ts_empty rs_ts_add rs_ts_filter_it\"\ndefinition \"rs_ts_filter \\<equiv> tsga_filter rs_ts_empty rs_ts_add rs_ts_filter_it\"\ndefinition \"rs_ts_image \\<equiv> tsga_image rs_ts_image_filter\"\n\nlemmas rs_ts_defs = \n  rs_ts_\\<alpha>_def\n  rs_ts_invar_def\n  rs_ts_empty_def\n  rs_ts_memb_def\n  rs_ts_add_def\n  rs_ts_add_Al_def\n  rs_ts_add_Bl_def\n  rs_ts_add_Cl_def\n  rs_ts_add_Cs_def\n  rs_ts_set_Cs_def\n  rs_ts_delete_def\n  rs_ts_filter_it_def\n  rs_ts_it_def\n  rs_ts_A_it_def\n  rs_ts_B_it_def\n  rs_ts_C_it_def\n  rs_ts_AB_it_def\n  rs_ts_AC_it_def\n  rs_ts_BC_it_def\n  rs_ts_from_list_def\n  rs_ts_to_list_def\n  rs_ts_image_filter_def[unfolded rs_ts_filter_it_def]\n  rs_ts_filter_def[unfolded rs_ts_filter_it_def]\n  rs_ts_image_def[unfolded rs_ts_image_filter_def rs_ts_filter_it_def]\n\nlemmas rs_ts_defs_raw = \n  rs_ts_defs.tsbm_empty_def[abs_def]\n  rs_ts_defs.tsbm_memb_def[abs_def]\n  rs_ts_defs.tsbm_add_def[abs_def]\n  rs_ts_defs.tsbm_add_Al_def[abs_def]\n  rs_ts_defs.tsbm_add_Bl_def[abs_def]\n  rs_ts_defs.tsbm_add_Cl_def[abs_def]\n  rs_ts_defs.tsbm_add_Cs_def[abs_def]\n  rs_ts_defs.tsbm_set_Cs_def[abs_def]\n  rs_ts_defs.tsbm_delete_def[abs_def]\n  rs_ts_defs.tsbm_filter_it_alt_def\n  rs_ts_defs.tsbm_it_alt_def\n  rs_ts_defs.tsbm_A_it_alt_def\n  rs_ts_defs.tsbm_B_it_alt_def\n  rs_ts_defs.tsbm_C_it_alt_def\n  rs_ts_defs.tsbm_AB_it_alt_def\n  rs_ts_defs.tsbm_AC_it_alt_def\n  rs_ts_defs.tsbm_BC_it_alt_def\n  tsga_from_list_alt_def\n  tsga_to_list_alt_def\n  tsga_image_filter_def[abs_def]\n  tsga_image_def[abs_def]\n  tsga_filter_def[abs_def]\n\nlemmas [code] = rs_ts_defs[unfolded rs_ts_defs_raw, simplified]\n\n(*lemmas [code] = rs_ts_defs[unfolded rs_ts_defs_raw rm_ops_unfold rs_ops_unfold, simplified]*)\n\nlemmas rs_ts_empty_impl = rs_ts_defs.tsbm_empty_correct[folded rs_ts_defs]\ninterpretation rs_ts: triple_set_empty rs_ts_\\<alpha> rs_ts_invar rs_ts_empty \n  using rs_ts_empty_impl .\nlemmas rs_ts_memb_impl = rs_ts_defs.tsbm_memb_correct[folded rs_ts_defs]\ninterpretation rs_ts: triple_set_memb rs_ts_\\<alpha> rs_ts_invar rs_ts_memb\n  using rs_ts_memb_impl .\nlemmas rs_ts_add_impl = rs_ts_defs.tsbm_add_correct[folded rs_ts_defs]\ninterpretation rs_ts: triple_set_add rs_ts_\\<alpha> rs_ts_invar rs_ts_add\n  using rs_ts_add_impl .\nlemmas rs_ts_add_Al_impl = rs_ts_defs.tsbm_add_Al_correct[folded rs_ts_defs]\ninterpretation rs_ts: triple_set_add_Al rs_ts_\\<alpha> rs_ts_invar rs_ts_add_Al\n  using rs_ts_add_Al_impl .\nlemmas rs_ts_add_Bl_impl = rs_ts_defs.tsbm_add_Bl_correct[folded rs_ts_defs]\ninterpretation rs_ts: triple_set_add_Bl rs_ts_\\<alpha> rs_ts_invar rs_ts_add_Bl\n  using rs_ts_add_Bl_impl .\nlemmas rs_ts_add_Cl_impl = rs_ts_defs.tsbm_add_Cl_correct[folded rs_ts_defs]\ninterpretation rs_ts: triple_set_add_Cl rs_ts_\\<alpha> rs_ts_invar rs_ts_add_Cl\n  using rs_ts_add_Cl_impl .\nlemmas rs_ts_add_Cs_impl = rs_ts_defs.tsbm_add_Cs_correct[folded rs_ts_defs]\ninterpretation rs_ts: triple_set_add_Cs rs_\\<alpha> rs_invar rs_ts_\\<alpha> rs_ts_invar rs_ts_add_Cs\n  using rs_ts_add_Cs_impl .\nlemmas rs_ts_set_Cs_impl = rs_ts_defs.tsbm_set_Cs_correct[folded rs_ts_defs]\ninterpretation rs_ts: triple_set_set_Cs rs_\\<alpha> rs_invar rs_ts_\\<alpha> rs_ts_invar rs_ts_set_Cs\n  using rs_ts_set_Cs_impl .\nlemmas rs_ts_delete_impl = rs_ts_defs.tsbm_delete_correct[folded rs_ts_defs]\ninterpretation rs_ts: triple_set_delete rs_ts_\\<alpha> rs_ts_invar rs_ts_delete\n  using rs_ts_delete_impl .\n\nlemmas rs_ts_filter_it_impl = rs_ts_defs.tsbm_filter_it_correct[\n  OF rm.v1_iteratei_impl rm.v1_iteratei_impl rs.v1_iteratei_impl,\n  folded rs_ts_defs]\ninterpretation rs_ts: triple_set_filter_it rs_ts_\\<alpha> rs_ts_invar rs_ts_filter_it \n  using rs_ts_filter_it_impl .\nlemmas rs_ts_it_impl = rs_ts_defs.tsbm_it_correct[\n  OF rm.v1_iteratei_impl rm.v1_iteratei_impl rs.v1_iteratei_impl,\n  folded rs_ts_defs]\ninterpretation rs_ts: triple_set_iterator rs_ts_\\<alpha> rs_ts_invar rs_ts_it \n  using rs_ts_it_impl .\nlemmas rs_ts_A_it_impl = rs_ts_defs.tsbm_A_it_correct[\n  OF rm.v1_iteratei_impl,\n  folded rs_ts_defs]\ninterpretation rs_ts: triple_set_A_it rs_ts_\\<alpha> rs_ts_invar rs_ts_A_it \n  using rs_ts_A_it_impl .\nlemmas rs_ts_B_it_impl = rs_ts_defs.tsbm_B_it_correct[\n  OF rm.v1_iteratei_impl,\n  folded rs_ts_defs]\ninterpretation rs_ts: triple_set_B_it rs_ts_\\<alpha> rs_ts_invar rs_ts_B_it \n  using rs_ts_B_it_impl .\nlemmas rs_ts_C_it_impl = rs_ts_defs.tsbm_C_it_correct[\n  OF rs.v1_iteratei_impl,\n  folded rs_ts_defs]\ninterpretation rs_ts: triple_set_C_it rs_ts_\\<alpha> rs_ts_invar rs_ts_C_it \n  using rs_ts_C_it_impl .\nlemmas rs_ts_AB_it_impl = rs_ts_defs.tsbm_AB_it_correct[\n  OF rm.v1_iteratei_impl rm.v1_iteratei_impl,\n  folded rs_ts_defs]\ninterpretation rs_ts: triple_set_AB_it rs_ts_\\<alpha> rs_ts_invar rs_ts_AB_it \n  using rs_ts_AB_it_impl .\nlemmas rs_ts_AC_it_impl = rs_ts_defs.tsbm_AC_it_correct[\n  OF rm.v1_iteratei_impl rs.v1_iteratei_impl,\n  folded rs_ts_defs]\ninterpretation rs_ts: triple_set_AC_it rs_ts_\\<alpha> rs_ts_invar rs_ts_AC_it \n  using rs_ts_AC_it_impl .\nlemmas rs_ts_BC_it_impl = rs_ts_defs.tsbm_BC_it_correct[\n  OF rm.v1_iteratei_impl rs.v1_iteratei_impl,\n  folded rs_ts_defs]\ninterpretation rs_ts: triple_set_BC_it rs_ts_\\<alpha> rs_ts_invar rs_ts_BC_it \n  using rs_ts_BC_it_impl .\n\nlemmas rs_ts_from_list_impl = \n  tsga_from_list_correct [OF rs_ts_empty_impl rs_ts_add_impl, folded rs_ts_defs]\ninterpretation rs_ts: triple_set_from_list rs_ts_\\<alpha> rs_ts_invar rs_ts_from_list \n  using rs_ts_from_list_impl .\nlemmas rs_ts_to_list_impl = tsga_to_list_correct [OF rs_ts_it_impl, folded rs_ts_defs]\ninterpretation rs_ts: triple_set_to_list rs_ts_\\<alpha> rs_ts_invar rs_ts_to_list \n  using rs_ts_to_list_impl .\nlemmas rs_ts_image_filter_impl = \n  tsga_image_filter_correct [OF rs_ts_empty_impl rs_ts_add_impl rs_ts_filter_it_impl, \n        folded rs_ts_defs rs_ts_image_filter_def]\ninterpretation rs_ts: triple_set_image_filter rs_ts_\\<alpha> rs_ts_invar rs_ts_\\<alpha> rs_ts_invar rs_ts_image_filter \n  using rs_ts_image_filter_impl .\nlemmas rs_ts_image_impl = tsga_image_correct [OF rs_ts_image_filter_impl, folded rs_ts_defs rs_ts_image_def]\ninterpretation rs_ts: triple_set_image rs_ts_\\<alpha> rs_ts_invar rs_ts_\\<alpha> rs_ts_invar rs_ts_image \n  using rs_ts_image_impl .\nlemmas rs_ts_filter_impl = tsga_filter_correct [OF rs_ts_empty_impl rs_ts_add_impl rs_ts_filter_it_impl, folded rs_ts_defs rs_ts_filter_def]\ninterpretation rs_ts: triple_set_filter rs_ts_\\<alpha> rs_ts_invar rs_ts_filter\n  using rs_ts_filter_impl .\n\n\nsubsection \\<open> Record \\<close>\n\n  definition rs_ts_ops where\n    \"rs_ts_ops = \\<lparr>\n    triple_set_op_\\<alpha> = rs_ts_\\<alpha>,\n    triple_set_op_invar = rs_ts_invar,\n    triple_set_op_empty = rs_ts_empty,\n    triple_set_op_memb = rs_ts_memb,\n    triple_set_op_add = rs_ts_add,\n    triple_set_op_add_Al = rs_ts_add_Al,\n    triple_set_op_add_Bl = rs_ts_add_Bl,\n    triple_set_op_add_Cl = rs_ts_add_Cl,\n    triple_set_op_delete = rs_ts_delete,\n    triple_set_op_to_list = rs_ts_to_list,\n    triple_set_op_from_list = rs_ts_from_list,\n    triple_set_op_image_filter = rs_ts_image_filter,\n    triple_set_op_filter = rs_ts_filter,\n    triple_set_op_image = rs_ts_image \\<rparr>\"\n\n  lemma rs_ts_ops_unfold :\n    shows \n      \"triple_set_op_\\<alpha> rs_ts_ops = rs_ts_\\<alpha>\"\n      \"triple_set_op_invar rs_ts_ops = rs_ts_invar\"\n      \"triple_set_op_empty rs_ts_ops = rs_ts_empty\"\n      \"triple_set_op_memb rs_ts_ops = rs_ts_memb\"\n      \"triple_set_op_add rs_ts_ops = rs_ts_add\"\n      \"triple_set_op_add_Al rs_ts_ops = rs_ts_add_Al\"\n      \"triple_set_op_add_Bl rs_ts_ops = rs_ts_add_Bl\"\n      \"triple_set_op_add_Cl rs_ts_ops = rs_ts_add_Cl\"\n      \"triple_set_op_delete rs_ts_ops = rs_ts_delete\"\n      \"triple_set_op_to_list rs_ts_ops = rs_ts_to_list\"\n      \"triple_set_op_from_list rs_ts_ops = rs_ts_from_list\"\n      \"triple_set_op_image_filter rs_ts_ops = rs_ts_image_filter\"\n      \"triple_set_op_filter rs_ts_ops = rs_ts_filter\"\n      \"triple_set_op_image rs_ts_ops = rs_ts_image\"\n     unfolding rs_ts_ops_def by simp_all\n\n  lemma rs_ts_ops_impl :\n    shows \"StdTripleSet rs_ts_ops\"\n   unfolding StdTripleSet_def rs_ts_ops_def\n     apply (simp)\n     apply (intro conjI rs_ts_it_impl rs_ts_empty_impl\n                rs_ts_add_impl rs_ts_delete_impl\n                rs_ts_add_Al_impl rs_ts_add_Bl_impl rs_ts_add_Cl_impl\n                rs_ts_to_list_impl rs_ts_from_list_impl rs_ts_filter_impl\n                rs_ts_image_filter_impl rs_ts_image_impl rs_ts_memb_impl \n                tsga_it_implies_finite[of _ _ rs_ts_it])                \n   done\n\n   interpretation rs_tsr: StdTripleSet rs_ts_ops by (rule rs_ts_ops_impl)\n\nend\n", "meta": {"author": "VTrelat", "repo": "Hopcroft_verif", "sha": "ede77c3a2105fd6722cf96896a297db294edf269", "save_path": "github-repos/isabelle/VTrelat-Hopcroft_verif", "path": "github-repos/isabelle/VTrelat-Hopcroft_verif/Hopcroft_verif-ede77c3a2105fd6722cf96896a297db294edf269/Isabelle/Automata_Malik_Tuerk/implementation/instantiations/RBT/RBT_TripleSetImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.33105963094473895}}
{"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      Compose.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Experiments on State Composition\"\n\n\ntheory Compose imports \"../HoareTotalProps\" begin\n\ntext {*\nWe develop some theory to support state-space modular development of programs.\nThese experiments aim at the representation of state-spaces with records.\nIf we use @{text \"statespaces\"} instead we get this kind of compositionality for free.\n*}\n\n\nsubsection {* Changing the State-Space *}\n\n(* Lift a command on statespace 'b to work on statespace 'a *)\n \ndefinition lift\\<^sub>f:: \"('S \\<Rightarrow> 's) \\<Rightarrow> ('S \\<Rightarrow> 's \\<Rightarrow> 'S) \\<Rightarrow> ('s \\<Rightarrow> 's) \\<Rightarrow> ('S \\<Rightarrow> 'S)\"\n  where \"lift\\<^sub>f prj inject f = (\\<lambda>S. inject S (f (prj S)))\"\n\ndefinition lift\\<^sub>s:: \"('S \\<Rightarrow> 's) \\<Rightarrow> 's set \\<Rightarrow> 'S set\"\n  where \"lift\\<^sub>s prj A = {S. prj S \\<in> A}\"\n\ndefinition lift\\<^sub>r:: \"('S \\<Rightarrow> 's) \\<Rightarrow> ('S \\<Rightarrow> 's \\<Rightarrow> 'S) \\<Rightarrow> ('s \\<times> 's) set \n                       \\<Rightarrow> ('S \\<times> 'S) set\"\nwhere\n\"lift\\<^sub>r prj inject R = {(S,T). (prj S,prj T) \\<in> R \\<and> T=inject S (prj T)}\"\n\n\nprimrec lift\\<^sub>c:: \"('S \\<Rightarrow> 's) \\<Rightarrow> ('S \\<Rightarrow> 's \\<Rightarrow> 'S) \\<Rightarrow> ('s,'p,'f) com \\<Rightarrow> ('S,'p,'f) com\"\nwhere\n\"lift\\<^sub>c prj inject Skip = Skip\" |\n\"lift\\<^sub>c prj inject (Basic f) = Basic (lift\\<^sub>f prj inject f)\" |\n\"lift\\<^sub>c prj inject (Spec r) = Spec (lift\\<^sub>r prj inject r)\" |\n\"lift\\<^sub>c prj inject (Seq c\\<^sub>1 c\\<^sub>2)  = \n  (Seq (lift\\<^sub>c prj inject c\\<^sub>1) (lift\\<^sub>c prj inject c\\<^sub>2))\" |\n\"lift\\<^sub>c prj inject (Cond b c\\<^sub>1 c\\<^sub>2) = \n  Cond (lift\\<^sub>s prj b) (lift\\<^sub>c prj inject c\\<^sub>1) (lift\\<^sub>c prj inject c\\<^sub>2)\" |\n\"lift\\<^sub>c prj inject (While b c) = \n  While (lift\\<^sub>s prj b) (lift\\<^sub>c prj inject c)\" |\n\"lift\\<^sub>c prj inject (Call p) = Call p\" |\n\"lift\\<^sub>c prj inject (DynCom c) = DynCom (\\<lambda>s. lift\\<^sub>c prj inject (c (prj s)))\" |\n\"lift\\<^sub>c prj inject (Guard f g c) = Guard f (lift\\<^sub>s prj g) (lift\\<^sub>c prj inject c)\" |\n\"lift\\<^sub>c prj inject Throw = Throw\" |\n\"lift\\<^sub>c prj inject (Catch c\\<^sub>1 c\\<^sub>2) = \n  Catch (lift\\<^sub>c prj inject c\\<^sub>1) (lift\\<^sub>c prj inject c\\<^sub>2)\"\n\n\n\nlemma lift\\<^sub>c_Skip: \"(lift\\<^sub>c prj inject c = Skip) = (c = Skip)\"\n  by (cases c) auto \n\nlemma lift\\<^sub>c_Basic: \n  \"(lift\\<^sub>c prj inject c = Basic lf) = (\\<exists>f. c = Basic f \\<and> lf = lift\\<^sub>f prj inject f)\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Spec:\n  \"(lift\\<^sub>c prj inject c = Spec lr) = (\\<exists>r. c = Spec r \\<and> lr = lift\\<^sub>r prj inject r)\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Seq: \n  \"(lift\\<^sub>c prj inject c = Seq lc\\<^sub>1 lc\\<^sub>2) = \n     (\\<exists> c\\<^sub>1 c\\<^sub>2. c = Seq c\\<^sub>1 c\\<^sub>2 \\<and>\n               lc\\<^sub>1 = lift\\<^sub>c prj inject c\\<^sub>1 \\<and> lc\\<^sub>2 = lift\\<^sub>c prj inject c\\<^sub>2 )\"\n    by (cases c) auto\n\nlemma lift\\<^sub>c_Cond:\n  \"(lift\\<^sub>c prj inject c = Cond lb lc\\<^sub>1 lc\\<^sub>2) = \n     (\\<exists>b c\\<^sub>1 c\\<^sub>2. c = Cond b c\\<^sub>1 c\\<^sub>2 \\<and> lb = lift\\<^sub>s prj b \\<and>\n                lc\\<^sub>1 = lift\\<^sub>c prj inject c\\<^sub>1 \\<and> lc\\<^sub>2 = lift\\<^sub>c prj inject c\\<^sub>2 )\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_While:\n  \"(lift\\<^sub>c prj inject c = While lb lc') = \n     (\\<exists>b c'. c = While b c' \\<and> lb = lift\\<^sub>s prj b \\<and> \n               lc' = lift\\<^sub>c prj inject c')\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Call: \n  \"(lift\\<^sub>c prj inject c = Call p) = (c = Call p)\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_DynCom:\n  \"(lift\\<^sub>c prj inject c = DynCom lc) = \n     (\\<exists>C. c=DynCom C \\<and> lc = (\\<lambda>s. lift\\<^sub>c prj inject (C (prj s))))\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Guard: \n  \"(lift\\<^sub>c prj inject c = Guard f lg lc') =\n     (\\<exists>g c'. c = Guard f g c' \\<and> lg = lift\\<^sub>s prj g \\<and> \n             lc' = lift\\<^sub>c prj inject c')\"\n   by (cases c) auto\n\nlemma lift\\<^sub>c_Throw: \n  \"(lift\\<^sub>c prj inject c = Throw) = (c = Throw)\"\n  by (cases c) auto\n\nlemma lift\\<^sub>c_Catch: \n  \"(lift\\<^sub>c prj inject c = Catch lc\\<^sub>1 lc\\<^sub>2) = \n     (\\<exists> c\\<^sub>1 c\\<^sub>2. c = Catch c\\<^sub>1 c\\<^sub>2 \\<and>\n               lc\\<^sub>1 = lift\\<^sub>c prj inject c\\<^sub>1 \\<and> lc\\<^sub>2 = lift\\<^sub>c prj inject c\\<^sub>2 )\"\n    by (cases c) auto\n\n\n\ndefinition xstate_map:: \"('S \\<Rightarrow> 's) \\<Rightarrow> ('S,'f) xstate \\<Rightarrow> ('s,'f) xstate\"\nwhere\n\"xstate_map g x = (case x of\n                      Normal s \\<Rightarrow> Normal (g s)\n                    | Abrupt s \\<Rightarrow> Abrupt (g s)\n                    | Fault f \\<Rightarrow> Fault f\n                    | Stuck \\<Rightarrow> Stuck)\"\n\nlemma xstate_map_simps [simp]:\n\"xstate_map g (Normal s) = Normal (g s)\"\n\"xstate_map g (Abrupt s) = Abrupt (g s)\"\n\"xstate_map g (Fault f) = (Fault f)\"\n\"xstate_map g Stuck = Stuck\"\n  by (auto simp add: xstate_map_def)\n\nlemma xstate_map_Normal_conv: \n  \"xstate_map g S = Normal s = (\\<exists>s'. S=Normal s' \\<and> s = g s')\"\n  by (cases S) auto\n\nlemma xstate_map_Abrupt_conv: \n  \"xstate_map g S = Abrupt s = (\\<exists>s'. S=Abrupt s' \\<and> s = g s')\"\n  by (cases S) auto\n\nlemma xstate_map_Fault_conv: \n  \"xstate_map g S = Fault f = (S=Fault f)\"\n  by (cases S) auto\n\nlemma xstate_map_Stuck_conv: \n  \"xstate_map g S = Stuck = (S=Stuck)\"\n  by (cases S) auto\n\nlemmas xstate_map_convs = xstate_map_Normal_conv xstate_map_Abrupt_conv\n xstate_map_Fault_conv xstate_map_Stuck_conv\n\ndefinition state:: \"('s,'f) xstate \\<Rightarrow> 's\"\nwhere\n\"state x = (case x of\n               Normal s \\<Rightarrow> s\n             | Abrupt s \\<Rightarrow> s\n             | Fault g \\<Rightarrow> undefined\n             | Stuck \\<Rightarrow> undefined)\"\n\nlemma state_simps [simp]:\n\"state (Normal s) = s\"\n\"state (Abrupt s) = s\"\n  by (auto simp add: state_def )\n\n\nlocale lift_state_space = \n  fixes project::\"'S \\<Rightarrow> 's\"\n  fixes \"inject\"::\"'S \\<Rightarrow> 's \\<Rightarrow> 'S\"\n  fixes \"project\\<^sub>x\"::\"('S,'f) xstate \\<Rightarrow> ('s,'f) xstate\"\n  fixes \"lift\\<^sub>e\"::\"('s,'p,'f) body \\<Rightarrow> ('S,'p,'f) body\"\n  fixes lift\\<^sub>c:: \"('s,'p,'f) com \\<Rightarrow> ('S,'p,'f) com\"\n  fixes lift\\<^sub>f:: \"('s \\<Rightarrow> 's) \\<Rightarrow> ('S \\<Rightarrow> 'S)\"\n  fixes lift\\<^sub>s:: \"'s set \\<Rightarrow> 'S set\"\n  fixes lift\\<^sub>r:: \"('s \\<times> 's) set \\<Rightarrow> ('S \\<times> 'S) set\"\n  assumes proj_inj_commute: \"\\<And>S s.  project (inject S s) = s\"\n  defines \"lift\\<^sub>c \\<equiv> Compose.lift\\<^sub>c project inject\"\n  defines \"project\\<^sub>x \\<equiv> xstate_map project\"\n  defines \"lift\\<^sub>e \\<equiv> (\\<lambda>\\<Gamma> p. map_option lift\\<^sub>c (\\<Gamma> p))\"\n  defines \"lift\\<^sub>f \\<equiv> Compose.lift\\<^sub>f project inject\"\n  defines \"lift\\<^sub>s \\<equiv> Compose.lift\\<^sub>s project\"\n  defines \"lift\\<^sub>r \\<equiv> Compose.lift\\<^sub>r project inject\"\n\n\nlemma (in lift_state_space) lift\\<^sub>f_simp:\n \"lift\\<^sub>f f \\<equiv> \\<lambda>S. inject S (f (project S))\" \n  by (simp add: lift\\<^sub>f_def Compose.lift\\<^sub>f_def)\n\nlemma (in lift_state_space) lift\\<^sub>s_simp:\n  \"lift\\<^sub>s A \\<equiv> {S. project S \\<in> A}\"\n  by  (simp add: lift\\<^sub>s_def Compose.lift\\<^sub>s_def)\n\nlemma (in lift_state_space) lift\\<^sub>r_simp:\n\"lift\\<^sub>r R \\<equiv> {(S,T). (project S,project T) \\<in> R \\<and> T=inject S (project T)}\"\n  by  (simp add: lift\\<^sub>r_def Compose.lift\\<^sub>r_def)\n\n(* Causes loop when instantiating locale\nlemmas (in lift_state_space) lift\\<^sub>f_simp  = Compose.lift\\<^sub>f_def \n [of project \"inject\", folded lift\\<^sub>f_def]\nlemmas (in lift_state_space) lift\\<^sub>s_simp  = Compose.lift\\<^sub>s_def \n [of project, folded lift\\<^sub>s_def]\nlemmas (in lift_state_space) lift\\<^sub>r_simp  = Compose.lift\\<^sub>r_def \n [of project \"inject\", folded lift\\<^sub>r_def]\n*)\nlemma (in lift_state_space) lift\\<^sub>c_Skip_simp [simp]:\n \"lift\\<^sub>c Skip = Skip\"\n  by (simp add: lift\\<^sub>c_def)\nlemma (in lift_state_space) lift\\<^sub>c_Basic_simp [simp]:\n\"lift\\<^sub>c (Basic f) = Basic (lift\\<^sub>f f)\"\n  by (simp add: lift\\<^sub>c_def lift\\<^sub>f_def)\nlemma (in lift_state_space) lift\\<^sub>c_Spec_simp [simp]:\n\"lift\\<^sub>c (Spec r) = Spec (lift\\<^sub>r r)\"\n  by (simp add: lift\\<^sub>c_def lift\\<^sub>r_def)\nlemma (in lift_state_space) lift\\<^sub>c_Seq_simp [simp]:\n\"lift\\<^sub>c (Seq c\\<^sub>1 c\\<^sub>2)  = \n  (Seq (lift\\<^sub>c c\\<^sub>1) (lift\\<^sub>c c\\<^sub>2))\"\n  by (simp add: lift\\<^sub>c_def)\nlemma (in lift_state_space) lift\\<^sub>c_Cond_simp [simp]:\n\"lift\\<^sub>c (Cond b c\\<^sub>1 c\\<^sub>2) = \n  Cond (lift\\<^sub>s b) (lift\\<^sub>c c\\<^sub>1) (lift\\<^sub>c c\\<^sub>2)\"\n  by (simp add: lift\\<^sub>c_def lift\\<^sub>s_def)\nlemma (in lift_state_space) lift\\<^sub>c_While_simp [simp]:\n\"lift\\<^sub>c (While b c) = \n  While (lift\\<^sub>s b) (lift\\<^sub>c c)\"\n  by (simp add: lift\\<^sub>c_def lift\\<^sub>s_def)\nlemma (in lift_state_space) lift\\<^sub>c_Call_simp [simp]:\n\"lift\\<^sub>c (Call p) = Call p\"\n  by (simp add: lift\\<^sub>c_def)\nlemma (in lift_state_space) lift\\<^sub>c_DynCom_simp [simp]:\n\"lift\\<^sub>c (DynCom c) = DynCom (\\<lambda>s. lift\\<^sub>c (c (project s)))\"\n  by (simp add: lift\\<^sub>c_def)\nlemma (in lift_state_space) lift\\<^sub>c_Guard_simp [simp]:\n\"lift\\<^sub>c (Guard f g c) = Guard f (lift\\<^sub>s g) (lift\\<^sub>c c)\"\n  by (simp add: lift\\<^sub>c_def lift\\<^sub>s_def)\nlemma (in lift_state_space) lift\\<^sub>c_Throw_simp [simp]:\n\"lift\\<^sub>c Throw = Throw\"\n  by (simp add: lift\\<^sub>c_def)\nlemma (in lift_state_space) lift\\<^sub>c_Catch_simp [simp]:\n\"lift\\<^sub>c (Catch c\\<^sub>1 c\\<^sub>2) = \n  Catch (lift\\<^sub>c c\\<^sub>1) (lift\\<^sub>c c\\<^sub>2)\"\n  by (simp add: lift\\<^sub>c_def)\n\nlemma (in lift_state_space) project\\<^sub>x_def': \n\"project\\<^sub>x s \\<equiv> (case s of\n                 Normal s \\<Rightarrow> Normal (project s)\n                | Abrupt s \\<Rightarrow> Abrupt (project s)\n                | Fault f \\<Rightarrow> Fault f\n                | Stuck \\<Rightarrow> Stuck)\"\n  by (simp add: xstate_map_def project\\<^sub>x_def)\n\nlemma (in lift_state_space) lift\\<^sub>e_def': \n  \"lift\\<^sub>e \\<Gamma> p \\<equiv> (case \\<Gamma> p of Some bdy \\<Rightarrow> Some (lift\\<^sub>c bdy) | None \\<Rightarrow> None)\"  \n  by (simp add: lift\\<^sub>e_def map_option_case)\n\n\n\n\ntext {*\nThe problem is that @{term \"(lift\\<^sub>c project inject \\<circ> \\<Gamma>)\"} is quite\na strong premise. The problem is that @{term \"\\<Gamma>\"} is a function here.\nA map would be better. We only have to lift those procedures in the domain\nof @{term \"\\<Gamma>\"}:\n@{text \"\\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' p = Some lift\\<^sub>c project inject bdy\"}.\nWe then can com up with theorems that allow us to extend the domains\nof @{term \\<Gamma>} and preserve validity.\n*}\n\n\nlemma (in lift_state_space) \n\"{(S,T). \\<exists>t. (project S,t) \\<in> r \\<and> T=inject S t}\n \\<subseteq> {(S,T). (project S,project T) \\<in> r \\<and> T=inject S (project T)}\"\n  apply clarsimp\n  apply (rename_tac S t)\n  apply (simp add: proj_inj_commute)\n  done\n\nlemma (in lift_state_space) \n\"{(S,T). (project S,project T) \\<in> r \\<and> T=inject S (project T)} \n \\<subseteq> {(S,T). \\<exists>t. (project S,t) \\<in> r \\<and> T=inject S t}\"\n  apply clarsimp\n  apply (rename_tac S T)\n  apply (rule_tac x=\"project T\" in exI)\n  apply simp\n  done\n\n\nlemma (in lift_state_space) lift_exec: \nassumes exec_lc: \"(lift\\<^sub>e \\<Gamma>)\\<turnstile>\\<langle>lc,s\\<rangle> \\<Rightarrow> t\"\nshows \"\\<And>c. \\<lbrakk> lift\\<^sub>c c = lc\\<rbrakk> \\<Longrightarrow> \n              \\<Gamma>\\<turnstile>\\<langle>c,project\\<^sub>x s\\<rangle> \\<Rightarrow>  project\\<^sub>x t\"\nusing exec_lc\nproof (induct)\n  case Skip thus ?case\n    by (auto simp add: project\\<^sub>x_def lift\\<^sub>c_Skip lift\\<^sub>c_def intro: exec.Skip)\nnext\n  case Guard thus ?case\n    by (auto simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def lift\\<^sub>c_Guard lift\\<^sub>c_def\n      intro: exec.Guard)\nnext\n  case GuardFault thus ?case\n    by (auto simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def lift\\<^sub>c_Guard lift\\<^sub>c_def\n      intro: exec.GuardFault)\nnext\n  case FaultProp thus ?case\n    by (fastforce simp add: project\\<^sub>x_def)\nnext\n  case Basic\n  thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Basic lift\\<^sub>f_def Compose.lift\\<^sub>f_def \n      lift\\<^sub>c_def\n        proj_inj_commute\n        intro: exec.Basic)\nnext\n  case Spec\n  thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Spec lift\\<^sub>f_def Compose.lift\\<^sub>f_def  \n        lift\\<^sub>r_def Compose.lift\\<^sub>r_def lift\\<^sub>c_def\n        proj_inj_commute\n        intro: exec.Spec)\nnext\n  case (SpecStuck s r)\n  thus ?case\n    apply (simp add: project\\<^sub>x_def)\n    apply (clarsimp simp add: lift\\<^sub>c_Spec lift\\<^sub>c_def)\n    apply (unfold lift\\<^sub>r_def Compose.lift\\<^sub>r_def)\n    apply (rule exec.SpecStuck)\n    apply (rule allI)\n    apply (erule_tac x=\"inject s t\" in allE)\n    apply clarsimp\n    apply (simp add: proj_inj_commute)\n    done\nnext\n  case Seq \n  thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Seq lift\\<^sub>c_def intro: exec.intros)\nnext\n  case CondTrue\n  thus ?case\n     by (auto simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def lift\\<^sub>c_Cond lift\\<^sub>c_def\n         intro: exec.CondTrue)\nnext\n  case CondFalse\n  thus ?case\n     by (auto simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def lift\\<^sub>c_Cond lift\\<^sub>c_def\n         intro: exec.CondFalse)\nnext\n  case WhileTrue\n  thus ?case\n     by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def \n         lift\\<^sub>c_While lift\\<^sub>c_def\n         intro: exec.WhileTrue)\nnext\n  case WhileFalse\n  thus ?case\n     by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def \n         lift\\<^sub>c_While lift\\<^sub>c_def\n         intro: exec.WhileFalse)\nnext\n  case Call \n  thus ?case\n    by (fastforce simp add: \n               project\\<^sub>x_def lift\\<^sub>c_Call lift\\<^sub>f_def Compose.lift\\<^sub>f_def lift\\<^sub>c_def\n               lift\\<^sub>e_def\n          intro: exec.Call)\nnext\n  case CallUndefined\n  thus ?case\n    by (fastforce simp add: \n               project\\<^sub>x_def lift\\<^sub>c_Call lift\\<^sub>f_def Compose.lift\\<^sub>f_def lift\\<^sub>c_def\n               lift\\<^sub>e_def\n          intro: exec.CallUndefined)\nnext\n  case StuckProp thus ?case\n    by (fastforce simp add: project\\<^sub>x_def)\nnext\n  case DynCom\n  thus ?case\n    by (fastforce simp add: \n               project\\<^sub>x_def lift\\<^sub>c_DynCom lift\\<^sub>f_def Compose.lift\\<^sub>f_def lift\\<^sub>c_def\n          intro: exec.DynCom)\nnext\n  case Throw thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Throw lift\\<^sub>c_def intro: exec.Throw)\nnext\n  case AbruptProp thus ?case\n    by (fastforce simp add: project\\<^sub>x_def)\nnext\n  case CatchMatch \n  thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Catch lift\\<^sub>c_def intro: exec.CatchMatch)\nnext\n  case (CatchMiss c\\<^sub>1 s t c\\<^sub>2 c) \n  thus ?case\n    by (cases t)\n       (fastforce simp add: project\\<^sub>x_def lift\\<^sub>c_Catch lift\\<^sub>c_def intro: exec.CatchMiss)+\nqed\n\nlemma (in lift_state_space) lift_exec': \nassumes exec_lc: \"(lift\\<^sub>e \\<Gamma>)\\<turnstile>\\<langle>lift\\<^sub>c c,s\\<rangle> \\<Rightarrow> t\"\nshows \"\\<Gamma>\\<turnstile>\\<langle>c,project\\<^sub>x s\\<rangle> \\<Rightarrow> project\\<^sub>x t\"\n  using lift_exec [OF exec_lc]\n  by simp\n\n\n\nlemma (in lift_state_space) lift_valid: \n  assumes valid: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \n   \"(lift\\<^sub>e \\<Gamma>)\\<Turnstile>\\<^bsub>/F\\<^esub> (lift\\<^sub>s P) (lift\\<^sub>c c) (lift\\<^sub>s Q),(lift\\<^sub>s A)\"\nproof (rule validI)\n  fix s t\n  assume lexec:\n    \"(lift\\<^sub>e \\<Gamma>)\\<turnstile>\\<langle>lift\\<^sub>c c,Normal s\\<rangle> \\<Rightarrow> t\"\n  assume lP: \"s \\<in> lift\\<^sub>s P\"\n  assume noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` lift\\<^sub>s Q \\<union> Abrupt ` lift\\<^sub>s A\"\n  proof -\n    from lexec\n    have \"\\<Gamma>\\<turnstile> \\<langle>c,project\\<^sub>x (Normal s)\\<rangle> \\<Rightarrow> (project\\<^sub>x t)\"\n      by (rule lift_exec) (simp_all)\n    moreover\n    from lP have \"project s \\<in> P\"\n      by (simp add: lift\\<^sub>s_def Compose.lift\\<^sub>s_def project\\<^sub>x_def)\n    ultimately \n    have \"project\\<^sub>x t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      using valid noFault\n      apply (clarsimp simp add: valid_def project\\<^sub>x_def)\n      apply (cases t)\n      apply auto\n      done\n    thus ?thesis\n      apply (simp add: lift\\<^sub>s_def Compose.lift\\<^sub>s_def)\n      apply (cases t)\n      apply (auto simp add: project\\<^sub>x_def)\n      done\n  qed\nqed\n\nlemma (in lift_state_space) lift_hoarep: \n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \n   \"(lift\\<^sub>e \\<Gamma>),{}\\<turnstile>\\<^bsub>/F\\<^esub> (lift\\<^sub>s P) (lift\\<^sub>c c) (lift\\<^sub>s Q),(lift\\<^sub>s A)\"\napply (rule hoare_complete)\napply (insert hoare_sound [OF deriv])\napply (rule lift_valid)\napply (simp add: cvalid_def)\ndone\n\nlemma (in lift_state_space) lift_hoarep': \n  \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) c (Q Z),(A Z) \\<Longrightarrow>\n    \\<forall>Z. (lift\\<^sub>e \\<Gamma>),{}\\<turnstile>\\<^bsub>/F\\<^esub> (lift\\<^sub>s (P Z)) (lift\\<^sub>c c) \n                                  (lift\\<^sub>s (Q Z)),(lift\\<^sub>s (A Z))\"\napply (iprover intro: lift_hoarep)\ndone\n\n\n\nlemma (in lift_state_space) lift_termination:\nassumes termi: \"\\<Gamma>\\<turnstile>c\\<down>s\"\nshows \"\\<And>S. project\\<^sub>x S = s \\<Longrightarrow> \n  lift\\<^sub>e \\<Gamma> \\<turnstile>(lift\\<^sub>c c)\\<down>S\"\n  using termi\nproof (induct)\n  case Skip thus ?case\n    by (clarsimp simp add: terminates.Skip project\\<^sub>x_def xstate_map_convs)\nnext\n  case Basic thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs intro: terminates.intros) \nnext\n  case Spec thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs intro: terminates.intros) \nnext\n  case Guard thus ?case\n    by (auto simp add: project\\<^sub>x_def xstate_map_convs intro: terminates.intros) \nnext\n  case GuardFault thus ?case\n    by (auto simp add: project\\<^sub>x_def xstate_map_convs lift\\<^sub>s_def Compose.lift\\<^sub>s_def\n           intro: terminates.intros) \nnext\n  case Fault thus ?case by (clarsimp simp add: project\\<^sub>x_def xstate_map_convs)\nnext\n  case (Seq c1 s c2)\n  have \"project\\<^sub>x S = Normal s\" by fact\n  then obtain s' where S: \"S=Normal s'\" and s: \"s = project s'\"\n    by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n  from Seq have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c1 \\<down> S\"\n    by simp\n  moreover\n  {\n    fix w\n    assume exec_lc1: \"lift\\<^sub>e \\<Gamma>\\<turnstile>\\<langle>lift\\<^sub>c c1,Normal s'\\<rangle> \\<Rightarrow> w\"\n    have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c2 \\<down> w\"\n    proof (cases w)\n      case (Normal w')\n      with lift_exec [where c=c1, OF exec_lc1] s\n      have \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow> Normal (project w')\"\n        by (simp add: project\\<^sub>x_def)\n      from Seq.hyps (3) [rule_format, OF this] Normal\n      show \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c2 \\<down> w\"\n        by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n    qed (auto)\n  }\n  ultimately show ?case\n    using S s\n    by (auto intro: terminates.intros)\nnext\n  case CondTrue thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def xstate_map_convs \n      intro: terminates.intros) \nnext\n  case CondFalse thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def xstate_map_convs \n      intro: terminates.intros) \nnext\n  case (WhileTrue s b c)\n  have \"project\\<^sub>x S = Normal s\" by fact\n  then obtain s' where S: \"S=Normal s'\" and s: \"s = project s'\"\n    by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n  from WhileTrue have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c \\<down> S\"\n    by simp\n  moreover\n  {\n    fix w\n    assume exec_lc: \"lift\\<^sub>e \\<Gamma>\\<turnstile>\\<langle>lift\\<^sub>c c,Normal s'\\<rangle> \\<Rightarrow> w\"\n    have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c (While b c) \\<down> w\"\n    proof (cases w)\n      case (Normal w')\n      with lift_exec [where c=c, OF exec_lc] s\n      have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal (project w')\"\n        by (simp add: project\\<^sub>x_def)\n      from WhileTrue.hyps (4) [rule_format, OF this] Normal\n      show \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c (While b c) \\<down> w\"\n        by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n    qed (auto)\n  }\n  ultimately show ?case\n    using S s\n    by (auto intro: terminates.intros)      \nnext\n  case WhileFalse thus ?case\n    by (fastforce simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def xstate_map_convs \n      intro: terminates.intros) \nnext\n  case Call thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs lift\\<^sub>e_def\n      intro: terminates.intros) \nnext\n  case CallUndefined thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs lift\\<^sub>e_def\n      intro: terminates.intros) \nnext\n  case Stuck thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs)\nnext\n  case DynCom thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs \n      intro: terminates.intros)\nnext\n  case Throw thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs \n      intro: terminates.intros)\nnext\n  case Abrupt thus ?case\n    by (fastforce simp add: project\\<^sub>x_def xstate_map_convs \n      intro: terminates.intros)\nnext\n  case (Catch c1 s c2) \n  have \"project\\<^sub>x S = Normal s\" by fact\n  then obtain s' where S: \"S=Normal s'\" and s: \"s = project s'\"\n    by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n  from Catch have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c1 \\<down> S\"\n    by simp\n  moreover\n  {\n    fix w\n    assume exec_lc1: \"lift\\<^sub>e \\<Gamma>\\<turnstile>\\<langle>lift\\<^sub>c c1,Normal s'\\<rangle> \\<Rightarrow> Abrupt w\"\n    have \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c2 \\<down> Normal w\"\n    proof -\n      from lift_exec [where c=c1, OF exec_lc1] s\n      have \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow> Abrupt (project w)\"\n        by (simp add: project\\<^sub>x_def)\n      from Catch.hyps (3) [rule_format, OF this] \n      show \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c2 \\<down> Normal w\"\n        by (auto simp add: project\\<^sub>x_def xstate_map_convs)\n    qed\n  }\n  ultimately show ?case\n    using S s\n    by (auto intro: terminates.intros)\nqed\n\nlemma (in lift_state_space) lift_termination':\nassumes termi: \"\\<Gamma>\\<turnstile>c\\<down>project\\<^sub>x S\"\nshows \"lift\\<^sub>e \\<Gamma> \\<turnstile>(lift\\<^sub>c c)\\<down>S\"\n  using lift_termination [OF termi]\n  by iprover\n\n\nlemma (in lift_state_space) lift_validt: \n  assumes valid: \"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"(lift\\<^sub>e \\<Gamma>)\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (lift\\<^sub>s P) (lift\\<^sub>c c) (lift\\<^sub>s Q),(lift\\<^sub>s A)\"\nproof -\n  from valid\n  have \"(lift\\<^sub>e \\<Gamma>)\\<Turnstile>\\<^bsub>/F\\<^esub> (lift\\<^sub>s P) (lift\\<^sub>c c) (lift\\<^sub>s Q),(lift\\<^sub>s A)\"\n    by (auto intro: lift_valid simp add: validt_def)\n  moreover\n  {\n    fix S\n    assume \"S \\<in> lift\\<^sub>s P\"\n    hence \"project S \\<in> P\"\n      by (simp add: lift\\<^sub>s_def Compose.lift\\<^sub>s_def)\n    with valid have \"\\<Gamma>\\<turnstile>c \\<down> project\\<^sub>x (Normal S)\"\n      by (simp add: validt_def project\\<^sub>x_def)\n    hence \"lift\\<^sub>e \\<Gamma>\\<turnstile>lift\\<^sub>c c \\<down> Normal S\"\n      by (rule lift_termination')\n  }\n  ultimately show ?thesis\n    by (simp add: validt_def)\nqed\n\nlemma (in lift_state_space) lift_hoaret: \n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \n   \"(lift\\<^sub>e \\<Gamma>),{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (lift\\<^sub>s P) (lift\\<^sub>c c) (lift\\<^sub>s Q),(lift\\<^sub>s A)\"\napply (rule hoaret_complete)\napply (insert hoaret_sound [OF deriv])\napply (rule lift_validt)\napply (simp add: cvalidt_def)\ndone\n    \n  \nlocale lift_state_space_ext = lift_state_space +\n  assumes inj_proj_commute: \"\\<And>S. inject S (project S) = S\"\n  assumes inject_last: \"\\<And>S s t. inject (inject S s) t = inject S t\"\n\n\n(* \\<exists>x. state t = inject (state s) x *)\nlemma (in lift_state_space_ext) lift_exec_inject_same: \nassumes exec_lc: \"(lift\\<^sub>e \\<Gamma>)\\<turnstile>\\<langle>lc,s\\<rangle> \\<Rightarrow> t\"\nshows \"\\<And>c. \\<lbrakk>lift\\<^sub>c c = lc; t \\<notin> (Fault ` UNIV) \\<union> {Stuck}\\<rbrakk> \\<Longrightarrow> \n              state t = inject (state s) (project (state t))\"\nusing exec_lc\nproof (induct)\n  case Skip thus ?case\n    by (clarsimp simp add: inj_proj_commute)\nnext\n  case Guard thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_Guard lift\\<^sub>c_def)\nnext\n  case GuardFault thus ?case\n    by simp\nnext\n  case FaultProp thus ?case by simp\nnext\n  case Basic thus ?case\n    by (clarsimp simp add: lift\\<^sub>f_def Compose.lift\\<^sub>f_def \n        proj_inj_commute lift\\<^sub>c_Basic lift\\<^sub>c_def)\nnext\n  case (Spec r) thus ?case\n    by (clarsimp simp add: Compose.lift\\<^sub>r_def lift\\<^sub>c_Spec lift\\<^sub>c_def)\nnext\n  case SpecStuck\n  thus ?case by simp\nnext\n  case (Seq lc1 s s' lc2 t c) \n  have t: \"t \\<notin> Fault ` UNIV \\<union> {Stuck}\" by fact\n  have \"lift\\<^sub>c c = Seq lc1 lc2\" by fact\n  then obtain c1 c2 where\n    c: \"c = Seq c1 c2\" and\n    lc1: \"lc1 = lift\\<^sub>c c1\" and\n    lc2: \"lc2 = lift\\<^sub>c c2\"\n    by (auto simp add: lift\\<^sub>c_Seq lift\\<^sub>c_def)\n  show ?case\n  proof (cases s')\n    case (Normal s'')\n    from Seq.hyps (2) [OF lc1 [symmetric]] this\n    have \"s'' = inject s (project s'')\"\n      by auto\n    moreover from Seq.hyps (4) [OF lc2 [symmetric]] Normal t \n    have \"state t = inject s'' (project (state t))\"\n      by auto\n    ultimately have \"state t = inject (inject s (project s'')) (project (state t))\"\n      by simp\n    then show ?thesis\n      by (simp add: inject_last)\n  next\n    case (Abrupt s'')\n    from Seq.hyps (2) [OF lc1 [symmetric]] this\n    have \"s'' = inject s (project s'')\"\n      by auto\n    moreover from Seq.hyps (4) [OF lc2 [symmetric]] Abrupt t \n    have \"state t = inject s'' (project (state t))\"\n      by auto\n    ultimately have \"state t = inject (inject s (project s'')) (project (state t))\"\n      by simp\n    then show ?thesis\n      by (simp add: inject_last)\n  next\n    case (Fault f)\n    with Seq\n    have \"t = Fault f\"\n      by (auto dest: Fault_end)\n    with t have False by simp\n    thus ?thesis ..\n  next\n    case Stuck\n    with Seq\n    have \"t = Stuck\"\n      by (auto dest: Stuck_end)\n    with t have False by simp\n    thus ?thesis ..\n  qed\nnext\n  case CondTrue thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_Cond lift\\<^sub>c_def)\nnext\n  case CondFalse thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_Cond lift\\<^sub>c_def)\nnext\n  case (WhileTrue s lb lc' s' t c)\n  have t: \"t \\<notin> Fault ` UNIV \\<union> {Stuck}\" by fact\n  have lw: \"lift\\<^sub>c c = While lb lc'\" by fact\n  then obtain b c' where \n    c: \"c = While b c'\" and\n    lb: \"lb = lift\\<^sub>s b\" and\n    lc: \"lc' = lift\\<^sub>c c'\"\n    by (auto simp add: lift\\<^sub>c_While lift\\<^sub>s_def lift\\<^sub>c_def)\n  show ?case\n  proof (cases s')\n    case (Normal s'')\n    from WhileTrue.hyps (3) [OF lc [symmetric]] this\n    have \"s'' = inject s (project s'')\"\n      by auto\n    moreover from WhileTrue.hyps (5) [OF lw] Normal t \n    have \"state t = inject s'' (project (state t))\"\n      by auto\n    ultimately have \"state t = inject (inject s (project s'')) (project (state t))\"\n      by simp\n    then show ?thesis\n      by (simp add: inject_last)\n  next\n    case (Abrupt s'')\n    from WhileTrue.hyps (3) [OF lc [symmetric]] this\n    have \"s'' = inject s (project s'')\"\n      by auto\n    moreover from WhileTrue.hyps (5) [OF lw] Abrupt t \n    have \"state t = inject s'' (project (state t))\"\n      by auto\n    ultimately have \"state t = inject (inject s (project s'')) (project (state t))\"\n      by simp\n    then show ?thesis\n      by (simp add: inject_last)\n  next\n    case (Fault f)\n    with WhileTrue\n    have \"t = Fault f\"\n      by (auto dest: Fault_end)\n    with t have False by simp\n    thus ?thesis ..\n  next\n    case Stuck\n    with WhileTrue\n    have \"t = Stuck\"\n      by (auto dest: Stuck_end)\n    with t have False by simp\n    thus ?thesis ..\n  qed\nnext\n  case WhileFalse thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_While inj_proj_commute)\nnext\n  case Call thus ?case\n    by (clarsimp simp add: inject_last lift\\<^sub>c_Call lift\\<^sub>e_def lift\\<^sub>c_def)\nnext\n  case CallUndefined thus ?case by simp\nnext\n  case StuckProp thus ?case by simp\nnext\n  case DynCom\n  thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_DynCom lift\\<^sub>c_def)\nnext\n  case Throw thus ?case\n    by (simp add: inj_proj_commute)\nnext\n  case AbruptProp thus ?case by (simp add: inj_proj_commute)\nnext\n  case (CatchMatch lc1 s s' lc2 t c) \n  have t: \"t \\<notin> Fault ` UNIV \\<union> {Stuck}\" by fact\n  have \"lift\\<^sub>c c = Catch lc1 lc2\" by fact\n  then obtain c1 c2 where\n    c: \"c = Catch c1 c2\" and\n    lc1: \"lc1 = lift\\<^sub>c c1\" and\n    lc2: \"lc2 = lift\\<^sub>c c2\"\n    by (auto simp add: lift\\<^sub>c_Catch lift\\<^sub>c_def)\n  from CatchMatch.hyps (2) [OF lc1 [symmetric]] this\n  have \"s' = inject s (project s')\"\n    by auto\n  moreover\n  from CatchMatch.hyps (4) [OF lc2 [symmetric]] t\n  have \"state t = inject s' (project (state t))\"\n    by auto\n  ultimately have \"state t = inject (inject s (project s')) (project (state t))\"\n    by simp\n  then show ?case\n    by (simp add: inject_last)\nnext\n  case CatchMiss\n  thus ?case\n    by (clarsimp simp add: lift\\<^sub>c_Catch lift\\<^sub>c_def)\nqed\n\nlemma (in lift_state_space_ext) valid_inject_project:\n assumes noFaultStuck: \n  \"\\<Gamma>\\<turnstile>\\<langle>c,Normal (project \\<sigma>)\\<rangle> \\<Rightarrow>\\<notin>(Fault ` UNIV \\<union> {Stuck})\"\n shows \"lift\\<^sub>e \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} lift\\<^sub>c c \n                {t. t=inject \\<sigma> (project t)}, {t. t=inject \\<sigma> (project t)}\"\nproof (rule validI)\n  fix s t\n  assume exec: \"lift\\<^sub>e \\<Gamma>\\<turnstile>\\<langle>lift\\<^sub>c c,Normal s\\<rangle> \\<Rightarrow> t\"\n  assume P: \"s \\<in> {\\<sigma>}\"\n  assume noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` {t. t = inject \\<sigma> (project t)} \\<union> \n        Abrupt ` {t. t = inject \\<sigma> (project t)}\"\n  proof -\n    from lift_exec [OF exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c,project\\<^sub>x (Normal s)\\<rangle> \\<Rightarrow> project\\<^sub>x t\"\n      by simp\n    with noFaultStuck P have t: \"t \\<notin> Fault ` UNIV \\<union> {Stuck}\"\n      by (auto simp add: final_notin_def project\\<^sub>x_def)\n    from lift_exec_inject_same [OF exec refl this] P\n    have \"state t = inject \\<sigma> (project (state t))\"\n      by simp\n    with t show ?thesis\n      by (cases t) auto\n  qed\nqed\n\nlemma (in lift_state_space_ext) lift_exec_inject_same': \nassumes exec_lc: \"(lift\\<^sub>e \\<Gamma>)\\<turnstile>\\<langle>lift\\<^sub>c c,S\\<rangle> \\<Rightarrow> T\"\nshows \"\\<And>c. \\<lbrakk>T \\<notin> (Fault ` UNIV) \\<union> {Stuck}\\<rbrakk> \\<Longrightarrow> \n              state T = inject (state S) (project (state T))\"\n  using lift_exec_inject_same [OF exec_lc]\n  by simp\n\nlemma (in lift_state_space_ext) valid_lift_modifies:\n  assumes valid: \"\\<forall>s. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {s} c (Modif s),(ModifAbr s)\"\n  shows \"(lift\\<^sub>e \\<Gamma>)\\<Turnstile>\\<^bsub>/F\\<^esub> {S} (lift\\<^sub>c c) \n           {T. T \\<in> lift\\<^sub>s (Modif (project S)) \\<and> T=inject S (project T)},\n           {T. T \\<in> lift\\<^sub>s (ModifAbr (project S)) \\<and> T=inject S (project T)}\"\nproof (rule validI)\n  fix s t\n  assume exec: \"lift\\<^sub>e \\<Gamma>\\<turnstile>\\<langle>lift\\<^sub>c c,Normal s\\<rangle> \\<Rightarrow> t\"\n  assume P: \"s \\<in> {S}\"\n  assume noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal `\n                 {t \\<in> lift\\<^sub>s (Modif (project S)).\n                  t = inject S (project t)} \\<union>\n                 Abrupt `\n                 {t \\<in> lift\\<^sub>s (ModifAbr (project S)).\n                  t = inject S (project t)}\"\n  proof -\n    from lift_exec [OF exec]\n    have \"\\<Gamma>\\<turnstile> \\<langle>c,project\\<^sub>x (Normal s)\\<rangle> \\<Rightarrow> project\\<^sub>x t\"\n      by auto\n    moreover\n    from noFault have \"project\\<^sub>x t \\<notin> Fault ` F\"\n      by (cases \"t\") (auto simp add: project\\<^sub>x_def)\n    ultimately   \n    have \"project\\<^sub>x t \\<in> \n            Normal ` (Modif (project s)) \\<union> Abrupt ` (ModifAbr (project s))\"\n      using valid [rule_format, of \"(project s)\"]\n      by (auto simp add: valid_def project\\<^sub>x_def)\n    hence \"t \\<in> Normal ` lift\\<^sub>s (Modif (project s)) \\<union> \n               Abrupt ` lift\\<^sub>s (ModifAbr (project s))\"\n      by (cases t) (auto simp add: project\\<^sub>x_def lift\\<^sub>s_def Compose.lift\\<^sub>s_def)\n    moreover\n    from this\n    have \"t \\<notin> Fault ` UNIV \\<union> {Stuck}\"\n      by (cases t) auto\n    from lift_exec_inject_same [OF exec _ this]\n    have \"state t = inject (state (Normal s)) (project (state t))\"\n      by simp\n    ultimately show ?thesis\n      using P by auto\n  qed\nqed\n\nlemma (in lift_state_space_ext) hoare_lift_modifies:\n  assumes deriv: \"\\<forall>\\<sigma>. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} c (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<forall>\\<sigma>. (lift\\<^sub>e \\<Gamma>),{}\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} (lift\\<^sub>c c) \n           {T. T \\<in> lift\\<^sub>s (Modif (project \\<sigma>)) \\<and> T=inject \\<sigma> (project T)},\n           {T. T \\<in> lift\\<^sub>s (ModifAbr (project \\<sigma>)) \\<and> T=inject \\<sigma> (project T)}\"\napply (rule allI)\napply (rule hoare_complete)\napply (rule valid_lift_modifies)\napply (rule allI)\napply (insert hoare_sound [OF deriv [rule_format]])\napply (simp add: cvalid_def)\ndone\n\nlemma (in lift_state_space_ext) hoare_lift_modifies':\n  assumes deriv: \"\\<forall>\\<sigma>. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} c (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<forall>\\<sigma>. (lift\\<^sub>e \\<Gamma>),{}\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} (lift\\<^sub>c c) \n           {T. T \\<in> lift\\<^sub>s (Modif (project \\<sigma>)) \\<and> \n                   (\\<exists>T'. T=inject \\<sigma> T')},\n           {T. T \\<in> lift\\<^sub>s (ModifAbr (project \\<sigma>)) \\<and> \n                   (\\<exists>T'. T=inject \\<sigma> T')}\"\napply (rule allI)\napply (rule HoarePartialDef.conseq [OF hoare_lift_modifies [OF deriv]])\napply blast\ndone\n\nsubsection {* Renaming Procedures *}\n\nprimrec rename:: \"('p \\<Rightarrow> 'q) \\<Rightarrow> ('s,'p,'f) com \\<Rightarrow> ('s,'q,'f) com\"\nwhere\n\"rename N Skip = Skip\" |\n\"rename N (Basic f) = Basic f\" |\n\"rename N (Spec r) = Spec r\" |\n\"rename N (Seq c\\<^sub>1 c\\<^sub>2)  = (Seq (rename N c\\<^sub>1) (rename N c\\<^sub>2))\" |\n\"rename N (Cond b c\\<^sub>1 c\\<^sub>2) = Cond b (rename N c\\<^sub>1) (rename N c\\<^sub>2)\" |\n\"rename N (While b c) = While b (rename N c)\" |\n\"rename N (Call p) = Call (N p)\" |\n\"rename N (DynCom c) = DynCom (\\<lambda>s. rename N (c s))\" |\n\"rename N (Guard f g c) = Guard f g (rename N c)\" |\n\"rename N Throw = Throw\" |\n\"rename N (Catch c\\<^sub>1 c\\<^sub>2) = Catch (rename N c\\<^sub>1) (rename N c\\<^sub>2)\"\n\nlemma rename_Skip: \"rename h c = Skip = (c=Skip)\"\n  by (cases c) auto\n\nlemma rename_Basic: \n  \"(rename h c = Basic f) = (c=Basic f)\"\n  by (cases c) auto\n\nlemma rename_Spec:\n  \"(rename h c = Spec r) = (c=Spec r)\"\n  by (cases c) auto\n\nlemma rename_Seq: \n  \"(rename h c = Seq rc\\<^sub>1 rc\\<^sub>2) = \n     (\\<exists> c\\<^sub>1 c\\<^sub>2. c = Seq c\\<^sub>1 c\\<^sub>2 \\<and>\n               rc\\<^sub>1 = rename h c\\<^sub>1 \\<and> rc\\<^sub>2 = rename h c\\<^sub>2 )\"\n    by (cases c) auto\n\nlemma rename_Cond:\n  \"(rename h c = Cond b rc\\<^sub>1 rc\\<^sub>2) = \n     (\\<exists>c\\<^sub>1 c\\<^sub>2. c = Cond b c\\<^sub>1 c\\<^sub>2  \\<and> rc\\<^sub>1 = rename h c\\<^sub>1 \\<and> rc\\<^sub>2 = rename h c\\<^sub>2 )\"\n  by (cases c) auto\n\nlemma rename_While:\n  \"(rename h c = While b rc') = (\\<exists>c'. c = While b c' \\<and> rc' = rename h c')\"\n  by (cases c) auto\n\nlemma rename_Call: \n  \"(rename h c = Call q) = (\\<exists>p. c = Call p \\<and> q=h p)\"\n  by (cases c) auto\n\n\n\nlemma rename_Guard: \n  \"(rename h c = Guard f g rc') =\n     (\\<exists>c'. c = Guard f g c' \\<and> rc' = rename h c')\"\n   by (cases c) auto\n\nlemma rename_Throw: \n  \"(rename h c = Throw) = (c = Throw)\"\n  by (cases c) auto\n\nlemma rename_Catch: \n  \"(rename h c = Catch rc\\<^sub>1 rc\\<^sub>2) = \n     (\\<exists>c\\<^sub>1 c\\<^sub>2. c = Catch c\\<^sub>1 c\\<^sub>2 \\<and> rc\\<^sub>1 = rename h c\\<^sub>1 \\<and> rc\\<^sub>2 = rename h c\\<^sub>2 )\"\n    by (cases c) auto\n\nlemma exec_rename_to_exec:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (h p) = Some (rename h bdy)\"\n  assumes exec: \"\\<Gamma>'\\<turnstile>\\<langle>rc,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<And>c. rename h c = rc\\<Longrightarrow>  \\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and> (t'=Stuck \\<or> t'=t)\"\nusing exec\nproof (induct)\n  case Skip thus ?case by (fastforce intro: exec.intros simp add: rename_Skip)\nnext\n  case Guard thus ?case by (fastforce intro: exec.intros simp add: rename_Guard)\nnext\n  case GuardFault thus ?case by (fastforce intro: exec.intros simp add: rename_Guard)\nnext\n  case FaultProp thus ?case by (fastforce intro: exec.intros)\nnext\n  case Basic thus ?case by (fastforce intro: exec.intros simp add: rename_Basic)\nnext\n  case Spec thus ?case by (fastforce intro: exec.intros simp add: rename_Spec)\nnext\n  case SpecStuck thus ?case by (fastforce intro: exec.intros simp add: rename_Spec)\nnext\n  case Seq thus ?case by (fastforce intro: exec.intros simp add: rename_Seq)\nnext\n  case CondTrue thus ?case by (fastforce intro: exec.intros simp add: rename_Cond)\nnext\n  case CondFalse thus ?case by (fastforce intro: exec.intros simp add: rename_Cond)\nnext\n  case WhileTrue thus ?case by (fastforce intro: exec.intros simp add: rename_While)\nnext\n  case WhileFalse thus ?case by (fastforce intro: exec.intros simp add: rename_While)\nnext\n  case (Call p rbdy s t)\n  have rbdy: \"\\<Gamma>' p = Some rbdy\" by fact\n  have \"rename h c = Call p\" by fact\n  then obtain q where c: \"c=Call q\" and p: \"p=h q\"\n    by (auto simp add: rename_Call)\n  show ?case\n  proof (cases \"\\<Gamma> q\")\n    case None\n    with c show ?thesis by (auto intro: exec.CallUndefined)\n  next\n    case (Some bdy)\n    from \\<Gamma> [rule_format, OF this] p rbdy\n    have \"rename h bdy = rbdy\" by simp\n    with Call.hyps c Some\n    show ?thesis\n      by (fastforce intro: exec.intros)\n  qed\nnext\n  case (CallUndefined p s)\n  have undef: \"\\<Gamma>' p = None\" by fact\n  have \"rename h c = Call p\" by fact\n  then obtain q where c: \"c=Call q\" and p: \"p=h q\"\n    by (auto simp add: rename_Call)\n  from undef p \\<Gamma> have \"\\<Gamma> q = None\"\n    by (cases \"\\<Gamma> q\") auto\n  with p c show ?case\n    by (auto intro: exec.intros)\nnext\n  case StuckProp thus ?case by (fastforce intro: exec.intros)\nnext\n  case DynCom thus ?case by (fastforce intro: exec.intros simp add: rename_DynCom)\nnext\n  case Throw thus ?case by (fastforce intro: exec.intros simp add: rename_Throw)\nnext\n  case AbruptProp thus ?case by (fastforce intro: exec.intros)\nnext\n  case CatchMatch thus ?case by (fastforce intro: exec.intros simp add: rename_Catch)\nnext\n  case CatchMiss thus ?case by (fastforce intro: exec.intros simp add: rename_Catch)\nqed\n\n\n\nlemma exec_rename_to_exec':\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes exec: \"\\<Gamma>'\\<turnstile>\\<langle>rename N c,s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<exists>t'. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t' \\<and> (t'=Stuck \\<or> t'=t)\"\n  using exec_rename_to_exec [OF \\<Gamma> exec]\n  by  auto\n\n\n    \nlemma valid_to_valid_rename:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes valid: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>'\\<Turnstile>\\<^bsub>/F\\<^esub> P (rename N c) Q,A\"\nproof (rule validI)\n  fix s t\n  assume execr: \"\\<Gamma>'\\<turnstile> \\<langle>rename N c,Normal s\\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from exec_rename_to_exec [OF \\<Gamma> execr] \n    obtain t' where\n      exec: \"\\<Gamma>\\<turnstile> \\<langle>c,Normal s\\<rangle> \\<Rightarrow> t'\"  and t': \"(t' = Stuck \\<or> t' = t)\"\n      by auto\n    with valid noFault P show ?thesis\n      by (auto simp add: valid_def)\n  qed\nqed\n\nlemma hoare_to_hoare_rename:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>',{}\\<turnstile>\\<^bsub>/F\\<^esub> P (rename N c) Q,A\"\napply (rule hoare_complete)\napply (insert hoare_sound [OF deriv])\napply (rule valid_to_valid_rename)\napply  (rule \\<Gamma>)\napply (simp add: cvalid_def)\ndone\n\nlemma hoare_to_hoare_rename':\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes deriv: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) c (Q Z),(A Z)\"\n  shows \"\\<forall>Z. \\<Gamma>',{}\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) (rename N c) (Q Z),(A Z)\"\napply rule\napply (rule hoare_to_hoare_rename [OF \\<Gamma>])\napply (rule deriv[rule_format])\ndone\n\nlemma terminates_to_terminates_rename:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes termi: \"\\<Gamma>\\<turnstile> c \\<down> s\"\n  assumes noStuck: \"\\<Gamma>\\<turnstile> \\<langle>c,s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\" \n  shows \"\\<Gamma>'\\<turnstile> rename N c \\<down> s\"\nusing termi noStuck\nproof (induct)\n  case Skip thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Basic thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Spec thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Guard thus ?case by (fastforce intro: terminates.intros \n    simp add: final_notin_def exec.intros)\nnext\n  case GuardFault thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Fault thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Seq\n  thus ?case\n    by (force intro!: terminates.intros exec.intros dest: exec_rename_to_exec [OF \\<Gamma>]\n         simp add: final_notin_def)\nnext\n  case CondTrue thus ?case by (fastforce intro: terminates.intros \n    simp add: final_notin_def exec.intros)\nnext\n  case CondFalse thus ?case by (fastforce intro: terminates.intros \n    simp add: final_notin_def exec.intros)\nnext\n  case (WhileTrue s b c)\n  have s_in_b: \"s \\<in> b\" by fact\n  have noStuck: \"\\<Gamma>\\<turnstile> \\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\" by fact\n  with s_in_b have \"\\<Gamma>\\<turnstile> \\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n    by (auto simp add: final_notin_def intro: exec.intros)\n  with WhileTrue.hyps have \"\\<Gamma>'\\<turnstile>rename N c \\<down> Normal s\"\n    by simp\n  moreover\n  {\n    fix t\n    assume exec_rc: \"\\<Gamma>'\\<turnstile> \\<langle>rename N c,Normal s\\<rangle> \\<Rightarrow> t\"\n    have \"\\<Gamma>'\\<turnstile> While b (rename N c) \\<down> t\"\n    proof -\n      from exec_rename_to_exec [OF \\<Gamma> exec_rc] obtain t'\n        where exec_c: \"\\<Gamma>\\<turnstile> \\<langle>c,Normal s\\<rangle> \\<Rightarrow> t'\" and t': \"(t' = Stuck \\<or> t' = t)\"\n        by auto\n      with s_in_b noStuck obtain \"t'=t\" and \"\\<Gamma>\\<turnstile> \\<langle>While b c,t\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n        by (auto simp add: final_notin_def intro: exec.intros)\n      with exec_c WhileTrue.hyps\n      show ?thesis\n        by auto\n    qed\n  }\n  ultimately show ?case\n    using s_in_b\n    by (auto intro: terminates.intros)\nnext\n  case WhileFalse thus ?case by (fastforce intro: terminates.intros)\nnext\n  case (Call p bdy s)\n  have \"\\<Gamma> p = Some bdy\" by fact\n  from \\<Gamma> [rule_format, OF this]\n  have bdy': \"\\<Gamma>' (N p) = Some (rename N bdy)\".\n  from Call have \"\\<Gamma>'\\<turnstile>rename N bdy \\<down> Normal s\"\n    by (auto simp add: final_notin_def intro: exec.intros)\n  with bdy' have \"\\<Gamma>'\\<turnstile>Call (N p) \\<down> Normal s\"\n    by (auto intro: terminates.intros)\n  thus ?case by simp\nnext\n  case (CallUndefined p s)\n  have \"\\<Gamma> p = None\" \"\\<Gamma>\\<turnstile> \\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\" by fact+\n  hence False by (auto simp add: final_notin_def intro: exec.intros)\n  thus ?case ..\nnext\n  case Stuck thus ?case by (fastforce intro: terminates.intros)\nnext\n  case DynCom thus ?case by (fastforce intro: terminates.intros \n    simp add: final_notin_def exec.intros)\nnext\n  case Throw thus ?case by (fastforce intro: terminates.intros)\nnext\n  case Abrupt thus ?case by (fastforce intro: terminates.intros)\nnext\n  case (Catch c1 s c2)\n  have noStuck: \"\\<Gamma>\\<turnstile> \\<langle>Catch c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\" by fact\n  hence \"\\<Gamma>\\<turnstile> \\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n    by (fastforce simp add: final_notin_def intro: exec.intros)\n  with Catch.hyps have \"\\<Gamma>'\\<turnstile>rename N c1 \\<down> Normal s\"\n    by auto\n  moreover\n  {\n    fix t\n    assume exec_rc1:\"\\<Gamma>'\\<turnstile> \\<langle>rename N c1,Normal s\\<rangle> \\<Rightarrow> Abrupt t\"\n    have \"\\<Gamma>'\\<turnstile>rename N c2 \\<down> Normal t\"\n    proof -\n      from exec_rename_to_exec [OF \\<Gamma> exec_rc1] obtain t'\n        where exec_c: \"\\<Gamma>\\<turnstile> \\<langle>c1,Normal s\\<rangle> \\<Rightarrow> t'\" and \"(t' = Stuck \\<or> t' = Abrupt t)\"\n        by auto\n      with noStuck have t': \"t'=Abrupt t\" \n        by (fastforce simp add: final_notin_def intro: exec.intros)\n      with exec_c noStuck have \"\\<Gamma>\\<turnstile> \\<langle>c2,Normal t\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n        by (auto simp add: final_notin_def intro: exec.intros)\n      with exec_c t' Catch.hyps\n      show ?thesis\n        by auto\n    qed\n  }\n  ultimately show ?case\n    by (auto intro: terminates.intros)\nqed\n\nlemma validt_to_validt_rename:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes valid: \"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>'\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (rename N c) Q,A\"\nproof -\n  from valid\n  have \"\\<Gamma>'\\<Turnstile>\\<^bsub>/F\\<^esub> P (rename N c) Q,A\"\n    by (auto intro: valid_to_valid_rename [OF \\<Gamma>] simp add: validt_def)\n  moreover\n  {\n    fix s\n    assume \"s \\<in> P\"\n    with valid obtain \"\\<Gamma>\\<turnstile>c \\<down> (Normal s)\" \"\\<Gamma>\\<turnstile> \\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>{Stuck}\"\n      by (auto simp add: validt_def valid_def final_notin_def)\n    from terminates_to_terminates_rename [OF \\<Gamma> this]\n    have \"\\<Gamma>'\\<turnstile>rename N c \\<down> Normal s\"\n      .\n  }\n  ultimately show ?thesis\n    by (simp add: validt_def)\nqed\n\nlemma hoaret_to_hoaret_rename:\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>',{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (rename N c) Q,A\"\napply (rule hoaret_complete)\napply (insert hoaret_sound [OF deriv])\napply (rule validt_to_validt_rename)\napply  (rule \\<Gamma>)\napply (simp add: cvalidt_def)\ndone\n\nlemma hoaret_to_hoaret_rename':\n  assumes \\<Gamma>: \"\\<forall>p bdy. \\<Gamma> p = Some bdy \\<longrightarrow> \\<Gamma>' (N p) = Some (rename N bdy)\"\n  assumes deriv: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) c (Q Z),(A Z)\"\n  shows \"\\<forall>Z. \\<Gamma>',{}\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P Z) (rename N c) (Q Z),(A Z)\"\napply rule\napply (rule hoaret_to_hoaret_rename [OF \\<Gamma>])\napply (rule deriv[rule_format])\ndone\n\nlemma lift\\<^sub>c_whileAnno [simp]: \"lift\\<^sub>c prj inject (whileAnno b I V c) =\n    whileAnno (lift\\<^sub>s prj b) \n              (lift\\<^sub>s prj I) (lift\\<^sub>r prj inject V) (lift\\<^sub>c prj inject c)\"\n  by (simp add: whileAnno_def)\n\nlemma lift\\<^sub>c_block [simp]: \"lift\\<^sub>c prj inject (block init bdy return c) = \n  block (lift\\<^sub>f prj inject init) (lift\\<^sub>c prj inject bdy) \n        (\\<lambda>s. (lift\\<^sub>f prj inject (return (prj s))))\n        (\\<lambda>s t. lift\\<^sub>c prj inject (c (prj s) (prj t)))\"\n  by (simp add: block_def)\n\n(*\nlemma lift\\<^sub>c_block [simp]: \"lift\\<^sub>c prj inject (block init bdy return c) = \n  block (lift\\<^sub>f prj inject init) (lift\\<^sub>c prj inject bdy) \n        (\\<lambda>s t. inject s (return (prj s) (prj t)))\n        (\\<lambda>s t. lift\\<^sub>c prj inject (c (prj s) (prj t)))\"\n  apply (simp add: block_def)\n  apply (simp add: lift\\<^sub>f_def)\n*)\nlemma lift\\<^sub>c_call [simp]: \"lift\\<^sub>c prj inject (call init p return c) = \n  call (lift\\<^sub>f prj inject init) p \n        (\\<lambda>s. (lift\\<^sub>f prj inject (return (prj s))))\n        (\\<lambda>s t. lift\\<^sub>c prj inject (c (prj s) (prj t)))\"\n  by (simp add: call_def lift\\<^sub>c_block)\n\nlemma rename_whileAnno [simp]: \"rename h (whileAnno b I V c) =\n   whileAnno b I V (rename h c)\"\n  by (simp add: whileAnno_def)\n\nlemma rename_block [simp]: \"rename h (block init bdy return c) =\n  block init (rename h bdy) return (\\<lambda>s t. rename h (c s t))\"\n  by (simp add: block_def)\n\nlemma rename_call [simp]: \"rename h (call init p return c) =\n  call init (h p) return (\\<lambda>s t. rename h (c s t))\"\n  by (simp add: call_def)\n\n\nend\n\n\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/ex/Compose.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5888891163376236, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3310596228324149}}
{"text": "section {*FUNCTION\\_\\_EPDAAIA\\_\\_EPDA\\_APPROXIMATE\\_INITIAL\\_ACCESSIBLE*}\ntheory\n  FUNCTION__EPDAAIA__EPDA_APPROXIMATE_INITIAL_ACCESSIBLE\n\nimports\n  PRJ_12_04_02__ENTRY\n\nbegin\n\ndefinition F_EPDA_AIA__fp_invariant_01 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('state, 'stack list) DT_tuple2 set\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_AIA__fp_invariant_01 G k N \\<equiv>\n  F_EPDA_AIA__fp_start G k \\<in> N\"\n\ndefinition F_EPDA_AIA__codom :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('state, 'stack list) DT_tuple2 set\"\n  where\n    \"F_EPDA_AIA__codom G k \\<equiv>\n  {cons_tuple2 q (take k s) | q s. q \\<in> epda_states G \\<and> set s \\<subseteq> epda_gamma G}\n  \\<union> {F_EPDA_AIA__fp_start G k}\"\n\ndefinition F_EPDA_AIA__fp_invariant_02 :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('state, 'stack list) DT_tuple2 set\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_AIA__fp_invariant_02 G k N \\<equiv>\n  N \\<subseteq> F_EPDA_AIA__codom G k\"\n\ndefinition F_EPDA_AIA__fp_invariants :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('state, 'stack list) DT_tuple2 set\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_AIA__fp_invariants G k N \\<equiv>\n  F_EPDA_AIA__fp_invariant_01 G k N\n  \\<and> F_EPDA_AIA__fp_invariant_02 G k N\"\n\ndefinition F_EPDA_AIA__fp_all_have_parent_element :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('state, 'stack list) DT_tuple2 set\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_AIA__fp_all_have_parent_element G k E \\<equiv>\n  \\<forall>q2 s2.\n  cons_tuple2 q2 s2 \\<in> E - {F_EPDA_AIA__fp_start G k}\n  \\<longrightarrow> (\\<exists>q1 x w1 w2 s1.\n      cons_tuple2 q1 s1 \\<in> E\n      \\<and> \\<lparr>edge_src = q1,\n        edge_event = x,\n        edge_pop = w1,\n        edge_push = w2,\n        edge_trg = q2\\<rparr> \\<in> epda_delta G\n      \\<and> s2 = take k (w2 @ (drop (length w1) s1)))\"\n\ndefinition F_EPDA_AIA__fp_valid_input :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('state, 'stack list) DT_tuple2 set\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_AIA__fp_valid_input G k E \\<equiv>\n  valid_epda G\n  \\<and> F_EPDA_AIA__fp_start G k \\<in> E\n  \\<and> E \\<subseteq> F_EPDA_AIA__codom G k\n  \\<and> F_EPDA_AIA__fp_all_have_parent_element G k E\"\n\nlemma F_EPDA_AIA__fp_valid_input_implies_F_EPDA_AIA__fp_invariants: \"\n  F_EPDA_AIA__fp_valid_input G k N\n  \\<Longrightarrow> F_EPDA_AIA__fp_invariants G k N\"\n  apply(simp add: F_EPDA_AIA__fp_invariants_def)\n  apply(simp add: F_EPDA_AIA__fp_valid_input_def F_EPDA_AIA__fp_invariant_01_def F_EPDA_AIA__fp_invariant_02_def F_EPDA_AIA__fp_start_def)\n  done\n\nlemma F_EPDA_AIA__fp_one_preserves_F_EPDA_AIA__fp_valid_input: \"\n  F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> F_EPDA_AIA__fp_valid_input G k (F_EPDA_AIA__fp_one G k E)\"\n  apply(simp add: F_EPDA_AIA__fp_valid_input_def F_EPDA_AIA__fp_one_def valid_epda_def F_EPDA_AIA__fp_one_def F_EPDA_AIA__fp_start_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac q1 s1 q2 xa w1 w2)(*strict*)\n   apply(thin_tac \"w1 \\<sqsubseteq> s1 \\<or> s1 \\<sqsubseteq> w1\")\n   apply(subgoal_tac \"cons_tuple2 q1 s1 \\<in> F_EPDA_AIA__codom G k\")\n    apply(rename_tac q1 s1 q2 xa w1 w2)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac q1 s1 q2 xa w1 w2)(*strict*)\n   apply(thin_tac \" E \\<subseteq> F_EPDA_AIA__codom G k\")\n   apply(thin_tac \"cons_tuple2 q1 s1\n       \\<in> E\")\n   apply(simp add: F_EPDA_AIA__codom_def)\n   apply(erule_tac x=\"\\<lparr>edge_src = q1, edge_event = xa, edge_pop = w1, edge_push = w2,\n          edge_trg = q2\\<rparr>\" in ballE)\n    apply(rename_tac q1 s1 q2 xa w1 w2)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac q1 s1 q2 xa w1 w2)(*strict*)\n   apply(rule disjI2)\n   apply(erule disjE)\n    apply(rename_tac q1 s1 q2 xa w1 w2)(*strict*)\n    apply(simp add: valid_epda_step_label_def may_terminated_by_def F_EPDA_AIA__fp_start_def)\n    apply(simp add: append_language_def kleene_star_def)\n    apply(clarsimp)\n    apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n    apply(rule_tac x=\"take k w2 @\n             take (k - length w2) (drop (length w1) (take k [epda_box G]))\" in exI)\n    apply(clarsimp)\n    apply(subgoal_tac \"X\" for X)\n     apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n     prefer 2\n     apply(rule_tac a=\"(length w2)\" and b=\"k\" in min_alt)\n    apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n    apply(erule_tac P=\"min (length w2) k = length w2 \\<and> length w2 \\<le> k\" in disjE)\n     apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n     apply(rule conjI)\n      apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n     apply(rule conjI)\n      apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n      apply(rule set_take_subset2)\n      apply(force)\n     apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n     apply(rule set_take_subset2)\n     apply(case_tac k)\n      apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac q2 xa w1 w2 a aa nat)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac q2 xa w1 w2 a aa nat x)(*strict*)\n     apply(case_tac w1)\n      apply(rename_tac q2 xa w1 w2 a aa nat x)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac q2 xa w1 w2 a aa nat x ab list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n     apply(rule set_take_subset2)\n     apply(force)\n    apply(rename_tac q2 xa w1 w2 a aa)(*strict*)\n    apply(force)\n   apply(rename_tac q1 s1 q2 xa w1 w2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n   apply(rule_tac x=\"take k w2 @\n             take (k - length w2) (drop (length w1) (take k s))\" in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n    apply(case_tac \"min (length w2) k = length w2\")\n     apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n    apply(subgoal_tac \"min (length w2) k = k\")\n     apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n    apply(simp add: valid_epda_step_label_def)\n   apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n    apply(rule set_take_subset2)\n    apply(simp add: valid_epda_step_label_def may_terminated_by_def append_language_def kleene_star_def)\n    apply(force)\n   apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n   apply(rule set_take_subset2)\n   apply(rule_tac subset_trans)\n    apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n    apply(rule set_drop_subset)\n   apply(rename_tac q1 q2 xa w1 w2 s)(*strict*)\n   apply(rule set_take_subset2)\n   apply(force)\n  apply(simp add: F_EPDA_AIA__fp_all_have_parent_element_def)\n  apply(clarsimp)\n  apply(rename_tac q2 s2)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac q2 s2)(*strict*)\n   apply(erule_tac x=\"q2\" in allE)\n   apply(erule_tac x=\"s2\" in allE)\n   apply(erule impE)\n    apply(rename_tac q2 s2)(*strict*)\n    apply(force)\n   apply(rename_tac q2 s2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac q2 q1 x w1 w2 s1)(*strict*)\n   apply(rule_tac x=\"q1\" in exI)\n   apply(rule_tac x=\"x\" in exI)\n   apply(rule_tac x=\"w1\" in exI)\n   apply(rule_tac x=\"w2\" in exI)\n   apply(rule_tac x=\"s1\" in exI)\n   apply(clarsimp)\n  apply(rename_tac q2 s2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac q2 q1 s1 x w1 w2)(*strict*)\n  apply(rule_tac x=\"q1\" in exI)\n  apply(rule_tac x=\"x\" in exI)\n  apply(rule_tac x=\"w1\" in exI)\n  apply(rule_tac x=\"w2\" in exI)\n  apply(rule_tac x=\"s1\" in exI)\n  apply(clarsimp)\n  done\n\nlemma F_EPDA_AIA__fp_one_mono: \"\n  E \\<subseteq> F_EPDA_AIA__fp_one G k E\"\n  apply(simp add: F_EPDA_AIA__fp_one_def)\n  done\n\nlemma finite_F_EPDA_AIA__codom: \"\n  valid_epda G\n  \\<Longrightarrow> finite (F_EPDA_AIA__codom G k)\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac h=\"\\<lambda>(q,s). cons_tuple2 q s\" and F=\"(epda_states G \\<times> {take k w| w. set w \\<subseteq> epda_gamma G})\" in finite_imageI)\n   apply(rule finite_cartesian_product)\n    apply(simp add: F_EPDA_AIA__fp_valid_input_def valid_epda_def)\n   apply(rule wordsUpToLengthFinite2)\n   apply(simp add: F_EPDA_AIA__fp_valid_input_def valid_epda_def)\n  apply(rule_tac\n      s=\"((\\<lambda>(q, s). cons_tuple2 q s) `\n      (epda_states G \\<times> {take k w |w. set w \\<subseteq> epda_gamma G}))\"\n      and t=\"F_EPDA_AIA__codom G k\"\n      in ssubst)\n   prefer 2\n   apply(force)\n  apply(simp add: F_EPDA_AIA__codom_def)\n  apply(rule antisym)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rule inMap)\n    apply(rule_tac x=\"(epda_initial G,take k [epda_box G])\" in bexI)\n     apply(clarsimp)\n     apply(simp add: F_EPDA_AIA__fp_start_def)\n    apply(clarsimp)\n    apply(simp add: valid_epda_def)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_EPDA_AIA__fp_one_increases_cardinality: \"\n  F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> F_EPDA_AIA__fp_one G k E \\<noteq> E\n  \\<Longrightarrow> card (F_EPDA_AIA__codom G k - F_EPDA_AIA__fp_one G k E) < card (F_EPDA_AIA__codom G k - E)\"\n  apply(rule Finite_Set.psubset_card_mono)\n   prefer 2\n   apply(rule rev_subset)\n    prefer 3\n    apply(rule_tac\n      B = \"F_EPDA_AIA__codom G k\"\n      in Finite_Set.finite_subset)\n     apply(force)\n    prefer 2\n    apply(subgoal_tac \"E\\<subseteq> F_EPDA_AIA__fp_one G k E\")\n     apply(blast)\n    apply(rule F_EPDA_AIA__fp_one_mono)\n   prefer 2\n   apply(subgoal_tac \"F_EPDA_AIA__fp_valid_input G k (F_EPDA_AIA__fp_one G k E)\")\n    prefer 2\n    apply(rule F_EPDA_AIA__fp_one_preserves_F_EPDA_AIA__fp_valid_input)\n    apply(blast)\n   apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n  apply(rule finite_F_EPDA_AIA__codom)\n  apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n  done\n\nlemma F_EPDA_AIA__fp_valid_input_implies_termination: \"\n  F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> F_EPDA_AIA__fp_dom (G, k, E)\"\n  apply(rule_tac\n      TERM_ARGS_TEST = \"\\<lambda>(G,k,E). F_EPDA_AIA__fp_valid_input G k E\"\n      and RECURSIVE_COND = \"\\<lambda>(G,k,E). F_EPDA_AIA__fp_one G k E\\<noteq>E\"\n      and MODIFY_ARGS_FOR_REC_CALL = \"\\<lambda>(G,k,E). (G,k,F_EPDA_AIA__fp_one G k E)\"\n      and MEASURE = \"\\<lambda>(G,k,E). card (F_EPDA_AIA__codom G k - E)\"\n      in partial_termination_wf)\n      apply(auto)\n       apply(rename_tac a aa b x)(*strict*)\n       apply(thin_tac \"F_EPDA_AIA__fp_valid_input G k E\")\n       apply(rename_tac G k E x)\n       apply(rename_tac G k E x)(*strict*)\n       apply(thin_tac \"x \\<in> F_EPDA_AIA__fp_one G k E\")\n       apply(subgoal_tac \"F_EPDA_AIA__fp_valid_input G k (F_EPDA_AIA__fp_one G k E)\")\n        apply(rename_tac G k E x)(*strict*)\n        apply(blast)\n       apply(rename_tac G k E x)(*strict*)\n       apply(thin_tac \"\\<not> F_EPDA_AIA__fp_valid_input G k (F_EPDA_AIA__fp_one G k E)\")\n       apply(rule F_EPDA_AIA__fp_one_preserves_F_EPDA_AIA__fp_valid_input)\n       apply(blast)\n      apply(rename_tac a aa b x)(*strict*)\n      apply(thin_tac \"F_EPDA_AIA__fp_valid_input G k E\")\n      apply(rename_tac G k E x)\n      apply(rename_tac G k E x)(*strict*)\n      apply(thin_tac \"x \\<in> E\")\n      apply(subgoal_tac \"F_EPDA_AIA__fp_valid_input G k (F_EPDA_AIA__fp_one G k E)\")\n       apply(rename_tac G k E x)(*strict*)\n       apply(blast)\n      apply(rename_tac G k E x)(*strict*)\n      apply(thin_tac \"\\<not> F_EPDA_AIA__fp_valid_input G k (F_EPDA_AIA__fp_one G k E)\")\n      apply(rule F_EPDA_AIA__fp_one_preserves_F_EPDA_AIA__fp_valid_input)\n      apply(blast)\n     apply(rename_tac a aa b x)(*strict*)\n     apply(thin_tac \"F_EPDA_AIA__fp_valid_input G k E\")\n     apply(rename_tac G k E x)\n     apply(rename_tac G k E x)(*strict*)\n     apply(case_tac \"F_EPDA_AIA__fp_one G k E = E\")\n      apply(rename_tac G k E x)(*strict*)\n      apply(force)\n     apply(rename_tac G k E x)(*strict*)\n     apply(thin_tac \"x \\<in> F_EPDA_AIA__fp_one G k E\")\n     apply(subgoal_tac \"card (F_EPDA_AIA__codom G k - F_EPDA_AIA__fp_one G k E) < card (F_EPDA_AIA__codom G k - E)\")\n      apply(rename_tac G k E x)(*strict*)\n      apply(blast)\n     apply(rename_tac G k E x)(*strict*)\n     apply(thin_tac \"\\<not> card (F_EPDA_AIA__codom G k - F_EPDA_AIA__fp_one G k E) < card (F_EPDA_AIA__codom G k - E)\")\n     apply(rule F_EPDA_AIA__fp_one_increases_cardinality)\n      apply(rename_tac G k E x)(*strict*)\n      apply(blast)\n     apply(rename_tac G k E x)(*strict*)\n     apply(force)\n    apply(rename_tac a aa b x)(*strict*)\n    apply(thin_tac \"F_EPDA_AIA__fp_valid_input G k E\")\n    apply(rename_tac G k E x)\n    apply(rename_tac G k E x)(*strict*)\n    apply(subgoal_tac \"E \\<subseteq> F_EPDA_AIA__fp_one G k E\")\n     apply(rename_tac G k E x)(*strict*)\n     prefer 2\n     apply(rule F_EPDA_AIA__fp_one_mono)\n    apply(rename_tac G k E x)(*strict*)\n    apply(blast)\n   apply(rename_tac a aa b)(*strict*)\n   apply(rule F_EPDA_AIA__fp.domintros)\n    apply(rename_tac a aa b x)(*strict*)\n    apply(force,force)\n  apply(rename_tac a aa b)(*strict*)\n  apply(rule F_EPDA_AIA__fp.domintros)\n   apply(rename_tac a aa b x)(*strict*)\n   apply(force,force)\n  done\n\nlemma F_EPDA_AIA__fp_F_EPDA_AIA__fp_one_idempotent_inner: \"\n  F_EPDA_AIA__fp_valid_input G k N\n  \\<Longrightarrow> F_EPDA_AIA__fp G k N = F_EPDA_AIA__fp G k (F_EPDA_AIA__fp_one G k N)\"\n  apply(rule_tac\n      t = \"F_EPDA_AIA__fp G k N\"\n      and s = \"(if F_EPDA_AIA__fp_one G k N = N then N else F_EPDA_AIA__fp G k (F_EPDA_AIA__fp_one G k N))\"\n      in ssubst)\n   apply(rule F_EPDA_AIA__fp.psimps)\n   apply(rule F_EPDA_AIA__fp_valid_input_implies_termination)\n   apply(blast)\n  apply(clarsimp)\n  apply(rule_tac\n      t = \"F_EPDA_AIA__fp G k N\"\n      and s = \"(if F_EPDA_AIA__fp_one G k N = N then N else F_EPDA_AIA__fp G k (F_EPDA_AIA__fp_one G k N))\"\n      in ssubst)\n   apply(rule F_EPDA_AIA__fp.psimps)\n   apply(rule F_EPDA_AIA__fp_valid_input_implies_termination)\n   apply(blast)\n  apply(clarsimp)\n  done\n\nlemma F_EPDA_AIA__fp_Meta_Lift_Without_Argument_With_Argument: \"\n  F_EPDA_AIA__fp_valid_input G k N\n  \\<Longrightarrow> (\\<And>G k N. F_EPDA_AIA__fp_valid_input G k (F_EPDA_AIA__fp_one G k N) \\<Longrightarrow> F_EPDA_AIA__fp_valid_input G k N \\<Longrightarrow> F_EPDA_AIA__fp_invariants G k N \\<Longrightarrow> P G k (F_EPDA_AIA__fp_one G k N) (F_EPDA_AIA__fp G k N) \\<Longrightarrow> P G k N (F_EPDA_AIA__fp G k N))\n  \\<Longrightarrow> (\\<And>G k N. F_EPDA_AIA__fp_one G k N = N \\<Longrightarrow> F_EPDA_AIA__fp_valid_input G k N \\<Longrightarrow> P G k N (F_EPDA_AIA__fp G k N))\n  \\<Longrightarrow> P G k N (F_EPDA_AIA__fp G k N)\"\n  apply(subgoal_tac \"(\\<lambda>G k N. F_EPDA_AIA__fp_invariants G k N \\<longrightarrow> (P G k N (F_EPDA_AIA__fp G k N))) G k N\")\n   apply(erule impE)\n    prefer 2\n    apply(blast)\n   apply(rule F_EPDA_AIA__fp_valid_input_implies_F_EPDA_AIA__fp_invariants)\n   apply(blast)\n  apply(subgoal_tac \"(\\<lambda>(G,k,N). F_EPDA_AIA__fp_invariants G k N \\<longrightarrow> (P G k N (F_EPDA_AIA__fp G k N))) (G,k,N)\")\n   apply(blast)\n  apply(rule_tac\n      TERM_ARGS_TEST = \"\\<lambda>(G,k,N). F_EPDA_AIA__fp_valid_input G k N\"\n      and RECURSIVE_COND = \"\\<lambda>(G,k,N). F_EPDA_AIA__fp_one G k N\\<noteq>N\"\n      and MODIFY_ARGS_FOR_REC_CALL = \"\\<lambda>(G,k,N). (G,k,F_EPDA_AIA__fp_one G k N)\"\n      and MEASURE = \"\\<lambda>(G,k,S). card (((F_EPDA_AIA__codom G k))-S)\"\n      and TERM_FUN = \"(\\<lambda>(G,k,N). F_EPDA_AIA__fp_invariants G k N \\<longrightarrow> (P G k N (F_EPDA_AIA__fp G k N)))\"\n      and y = \"(G,k,N)\"\n      in partial_termination_wf)\n      apply(rule allI)\n      apply(rename_tac x)(*strict*)\n      apply(clarify)\n      apply(rename_tac a aa b)(*strict*)\n      apply(thin_tac \"F_EPDA_AIA__fp_valid_input G k N\")\n      apply(rename_tac G k N)\n      apply(rename_tac G k N)(*strict*)\n      apply(rule F_EPDA_AIA__fp_one_preserves_F_EPDA_AIA__fp_valid_input)\n      apply(blast)\n     apply(thin_tac \"F_EPDA_AIA__fp_valid_input G k N\")\n     apply(clarsimp)\n     apply(rename_tac a aa b)(*strict*)\n     apply(rename_tac G k N)\n     apply(rename_tac G k N)(*strict*)\n     apply(rule F_EPDA_AIA__fp_one_increases_cardinality)\n      apply(rename_tac G k N)(*strict*)\n      apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n     apply(rename_tac G k N)(*strict*)\n     apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n    apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n   prefer 2\n   apply(clarsimp)\n  apply(clarsimp)\n  apply(rename_tac a aa b)(*strict*)\n  apply(thin_tac \"F_EPDA_AIA__fp_valid_input G k N\")\n  apply(rename_tac G k N)\n  apply(rename_tac G k N)(*strict*)\n  apply(erule impE)\n   apply(rename_tac G k N)(*strict*)\n   apply(rule F_EPDA_AIA__fp_valid_input_implies_F_EPDA_AIA__fp_invariants)\n   apply(rename_tac G k N)(*strict*)\n   apply(blast)\n  apply(rename_tac G k N)(*strict*)\n  apply(subgoal_tac \"P G k (F_EPDA_AIA__fp_one G k N) (F_EPDA_AIA__fp G k N)\")\n   apply(rename_tac G k N)(*strict*)\n   apply(thin_tac \"P G k (F_EPDA_AIA__fp_one G k N) (F_EPDA_AIA__fp G k (F_EPDA_AIA__fp_one G k N))\")\n   prefer 2\n   apply(rule_tac\n      t=\"F_EPDA_AIA__fp G k N\"\n      and s=\"F_EPDA_AIA__fp G k (F_EPDA_AIA__fp_one G k N)\"\n      in ssubst)\n    apply(rename_tac G k N)(*strict*)\n    apply(rule F_EPDA_AIA__fp_F_EPDA_AIA__fp_one_idempotent_inner)\n    apply(force)\n   apply(rename_tac G k N)(*strict*)\n   apply(force)\n  apply(rename_tac G k N)(*strict*)\n  apply(force)\n  done\n\nlemma F_EPDA_AIA__fp_mono: \"\n  F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> E \\<subseteq> F_EPDA_AIA__fp G k E\"\n  apply(rule F_EPDA_AIA__fp_Meta_Lift_Without_Argument_With_Argument)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(rule_tac B=\"F_EPDA_AIA__fp_one Ga ka N\" in subset_trans)\n    apply(rename_tac Ga ka N)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(simp add: F_EPDA_AIA__fp_one_def)\n  apply(rename_tac Ga ka N)(*strict*)\n  apply(rule_tac ?x.0=\"Ga\" and ?xa.0=\"ka\" and ?xb.0=\"N\" in F_EPDA_AIA__fp.pelims)\n    apply(rename_tac Ga ka N)(*strict*)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(rule F_EPDA_AIA__fp_valid_input_implies_termination)\n   apply(force)\n  apply(rename_tac Ga ka N Gaa kaa Ea)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_EPDA_AIA__fp_start_in_F_EPDA_AIA__codom: \"\n  valid_epda G\n  \\<Longrightarrow> F_EPDA_AIA__fp_start G k \\<in> F_EPDA_AIA__codom G k\"\n  apply(simp add: F_EPDA_AIA__fp_start_def F_EPDA_AIA__codom_def)\n  done\n\nlemma F_EPDA_AIA__fp_valid_input_with_F_EPDA_AIA__fp_start: \"\n  valid_epda G\n  \\<Longrightarrow> F_EPDA_AIA__fp_valid_input G k {F_EPDA_AIA__fp_start G k}\"\n  apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n  apply(rule conjI)\n   apply(rule F_EPDA_AIA__fp_start_in_F_EPDA_AIA__codom)\n   apply(force)\n  apply(simp add: F_EPDA_AIA__fp_all_have_parent_element_def)\n  done\n\ndefinition F_EPDA_AIA__fp_computed_stack_approximation :: \"\n  (('state, 'event, 'stack) epda_step_label, ('state, 'event, 'stack) epdaH_conf) derivation\n  \\<Rightarrow> nat\n  \\<Rightarrow> nat\n  \\<Rightarrow> nat\"\n  where\n    \"F_EPDA_AIA__fp_computed_stack_approximation d i k \\<equiv>\n  foldl\n    (\\<lambda>n e. min k (n - length (edge_pop e) + length (edge_push e)))\n    (min k (Suc 0))\n    (map (\\<lambda>i. the (get_label (d i))) (nat_seq (Suc 0) i))\"\n\ndefinition F_EPDA_AIA__fp_one_step_contained :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('state, 'stack list) DT_tuple2 set\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_AIA__fp_one_step_contained G k E \\<equiv>\n  \\<forall>d i e1 c1 e2 c2.\n  epdaH.derivation_initial G d\n  \\<longrightarrow> d i = Some (pair e1 c1)\n  \\<longrightarrow> d (Suc i) = Some (pair (Some e2) c2)\n  \\<longrightarrow> (\\<exists>w1 w2.\n          cons_tuple2 (epdaH_conf_state c1) (take k w1) \\<in> E\n          \\<and> cons_tuple2 (epdaH_conf_state c2) (take k w2) \\<in> E\n          \\<and> cons_tuple2 (epdaH_conf_state c2) (take k w2) \\<in> F_EPDA_AIA__fp_one G k {cons_tuple2 (epdaH_conf_state c1) (take k w1)}\n          \\<and> w1 = take (F_EPDA_AIA__fp_computed_stack_approximation d i k) (epdaH_conf_stack c1)\n          \\<and> w2 = take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k) (epdaH_conf_stack c2))\"\n\nlemma F_EPDA_AIA__fp_Meta_Lift_Without_Argument: \"\n  F_EPDA_AIA__fp_valid_input G k N\n  \\<Longrightarrow> (\\<And>G k N. F_EPDA_AIA__fp_valid_input G k (F_EPDA_AIA__fp_one G k N) \\<Longrightarrow> F_EPDA_AIA__fp_valid_input G k N \\<Longrightarrow> F_EPDA_AIA__fp_invariants G k N \\<Longrightarrow> P G k (F_EPDA_AIA__fp G k (F_EPDA_AIA__fp_one G k N)) \\<Longrightarrow> P G k (F_EPDA_AIA__fp G k N))\n  \\<Longrightarrow> (\\<And>G k N. F_EPDA_AIA__fp_one G k N = N \\<Longrightarrow> F_EPDA_AIA__fp_valid_input G k N \\<Longrightarrow> F_EPDA_AIA__fp_invariants G k N \\<Longrightarrow> P G k (F_EPDA_AIA__fp G k N))\n  \\<Longrightarrow> P G k (F_EPDA_AIA__fp G k N)\"\n  apply(subgoal_tac \"(\\<lambda>G k N. F_EPDA_AIA__fp_invariants G k N \\<longrightarrow> (P G k (F_EPDA_AIA__fp G k N))) G k N\")\n   apply(erule impE)\n    prefer 2\n    apply(blast)\n   apply(rule F_EPDA_AIA__fp_valid_input_implies_F_EPDA_AIA__fp_invariants)\n   apply(blast)\n  apply(subgoal_tac \"(\\<lambda>(G,k,N). F_EPDA_AIA__fp_invariants G k N \\<longrightarrow> (P G k (F_EPDA_AIA__fp G k N))) (G,k,N)\")\n   apply(blast)\n  apply(rule_tac\n      TERM_ARGS_TEST = \"\\<lambda>(G,k,N). F_EPDA_AIA__fp_valid_input G k N\"\n      and RECURSIVE_COND = \"\\<lambda>(G,k,N). F_EPDA_AIA__fp_one G k N\\<noteq>N\"\n      and MODIFY_ARGS_FOR_REC_CALL = \"\\<lambda>(G,k,N). (G,k,F_EPDA_AIA__fp_one G k N)\"\n      and MEASURE = \"\\<lambda>(G,k,S). card (((F_EPDA_AIA__codom G k))-S)\"\n      and TERM_FUN = \"(\\<lambda>(G,k,N). F_EPDA_AIA__fp_invariants G k N \\<longrightarrow> (P G k (F_EPDA_AIA__fp G k N)))\"\n      and y = \"(G,k,N)\"\n      in partial_termination_wf)\n      apply(rule allI)\n      apply(rename_tac x)(*strict*)\n      apply(clarify)\n      apply(rename_tac a aa b)(*strict*)\n      apply(thin_tac \"F_EPDA_AIA__fp_valid_input G k N\")\n      apply(rename_tac G k N)\n      apply(rename_tac G k N)(*strict*)\n      apply(rule F_EPDA_AIA__fp_one_preserves_F_EPDA_AIA__fp_valid_input)\n      apply(blast)\n     apply(thin_tac \"F_EPDA_AIA__fp_valid_input G k N\")\n     apply(clarsimp)\n     apply(rename_tac a aa b)(*strict*)\n     apply(rename_tac G k N)\n     apply(rename_tac G k N)(*strict*)\n     apply(rule F_EPDA_AIA__fp_one_increases_cardinality)\n      apply(rename_tac G k N)(*strict*)\n      apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n     apply(rename_tac G k N)(*strict*)\n     apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n    apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n   prefer 2\n   apply(clarsimp)\n  apply(clarsimp)\n  apply(rename_tac a aa b)(*strict*)\n  apply(erule impE)\n   apply(rename_tac a aa b)(*strict*)\n   apply(rule F_EPDA_AIA__fp_valid_input_implies_F_EPDA_AIA__fp_invariants)\n   apply(rename_tac a aa b)(*strict*)\n   apply(blast)\n  apply(rename_tac a aa b)(*strict*)\n  apply(blast)\n  done\n\nlemma F_EPDA_AIA__fp_one_intro2: \"\n  cons_tuple2 q1 s1 \\<in> E\n  \\<Longrightarrow> \\<lparr>edge_src = q1, edge_event = x, edge_pop = w1, edge_push = w2, edge_trg = q2\\<rparr> \\<in> epda_delta G\n  \\<Longrightarrow> s2 = take k (w2 @ (drop (length w1) s1))\n  \\<Longrightarrow> prefix s1 w1 \\<or> prefix w1 s1\n  \\<Longrightarrow> cons_tuple2 q2 s2 \\<in> F_EPDA_AIA__fp_one G k E\"\n  apply(simp add: F_EPDA_AIA__fp_one_def)\n  apply(force)\n  done\n\nlemma F_EPDA_AIA__fp_one_intro3: \"\n  cons_tuple2 q1 s1 \\<in> E\n  \\<Longrightarrow> F_EPDA_AIA__fp_one G k E = E\n  \\<Longrightarrow> \\<lparr>edge_src = q1, edge_event = x, edge_pop = w1, edge_push = w2, edge_trg = q2\\<rparr> \\<in> epda_delta G\n  \\<Longrightarrow> s2 = take k (w2 @ (drop (length w1) s1))\n  \\<Longrightarrow> prefix s1 w1 \\<or> prefix w1 s1\n  \\<Longrightarrow> cons_tuple2 q2 s2 \\<in> E \\<and> cons_tuple2 q2 s2 \\<in> F_EPDA_AIA__fp_one G k {cons_tuple2 q1 s1}\"\n  apply(rule conjI)\n   apply(rule_tac t=\"E\" and s=\"F_EPDA_AIA__fp_one G k E\" in ssubst)\n    apply(force)\n   apply(rule F_EPDA_AIA__fp_one_intro2)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule F_EPDA_AIA__fp_one_intro2)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_EPDA_AIA__fp_computed_stack_approximation_smaller_than_k: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d i = Some (pair (Some e) c)\n  \\<Longrightarrow> F_EPDA_AIA__fp_computed_stack_approximation d i k \\<le> k\"\n  apply(simp add: F_EPDA_AIA__fp_computed_stack_approximation_def)\n  apply(case_tac i)\n   apply(clarsimp)\n   apply(subgoal_tac \"nat_seq (Suc 0) 0 = []\")\n    apply(clarsimp)\n   apply (metis derivation_configuration.inject epdaH.derivation_initial_has_configuration_at_position_0 option.distinct(1) option.sel)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i)\n  apply(rename_tac i)(*strict*)\n  apply(subgoal_tac \"nat_seq (Suc 0) (Suc i) = nat_seq (Suc 0) (i) @[Suc i]\")\n   apply(rename_tac i)(*strict*)\n   prefer 2\n   apply (metis append_Cons append_assoc natUptTo_n_Sucn nat_seq_drop_last_prime self_append_conv2)\n  apply(rename_tac i)(*strict*)\n  apply(force)\n  done\n\nlemma F_EPDA_AIA__fp_computed_stack_approximation_unfold: \"\n  d (Suc i) = Some (pair (Some e) c)\n  \\<Longrightarrow> edge_pop e = po\n  \\<Longrightarrow> edge_push e = pu\n  \\<Longrightarrow> F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k = min k (F_EPDA_AIA__fp_computed_stack_approximation d i k - length po + length pu)\"\n  apply(simp add: F_EPDA_AIA__fp_computed_stack_approximation_def)\n  apply(rule_tac t=\"nat_seq (Suc 0) (Suc i)\" and s=\"nat_seq (Suc 0) i @ [Suc i]\" in ssubst)\n   apply (metis append_Cons append_assoc natUptTo_n_Sucn nat_seq_drop_last_prime self_append_conv2)\n  apply(rule_tac t=\"foldl\n     (\\<lambda>n e. min k (n - length (edge_pop e) + length (edge_push e)))\n     (min k (Suc 0))\n     (map (\\<lambda>i. the (get_label (d i)))\n       (nat_seq (Suc 0) i @ [Suc i]))\" and s=\"(\\<lambda>n e. min k (n - length (edge_pop e) + length (edge_push e))) (foldl\n     (\\<lambda>n e. min k (n - length (edge_pop e) + length (edge_push e)))\n     (min k (Suc 0))\n     (map (\\<lambda>i. the (get_label (d i)))\n       (nat_seq (Suc 0) i))) e\" in ssubst)\n   apply(clarsimp)\n   apply(simp add: get_label_def)\n  apply(clarsimp)\n  done\n\nlemma F_EPDA_AIA__fp_some_tuple_reachable_hlp2: \"\n  F_EPDA_AIA__fp_one G k E = E\n  \\<Longrightarrow> F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> F_EPDA_AIA__fp_invariants G k E\n  \\<Longrightarrow> F_EPDA_AIA__fp G k E = E\n  \\<Longrightarrow> F_EPDA_AIA__fp_dom (G, k, E)\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d i = Some (pair e1 c1)\n  \\<Longrightarrow> d (Suc i) = Some (pair (Some e2) c2)\n  \\<Longrightarrow> \\<exists>w1 w2. cons_tuple2 (epdaH_conf_state c1) (take k w1) \\<in> E \\<and> cons_tuple2 (epdaH_conf_state c2) (take k w2) \\<in> E \\<and> cons_tuple2 (epdaH_conf_state c2) (take k w2) \\<in> F_EPDA_AIA__fp_one G k {cons_tuple2 (epdaH_conf_state c1) (take k w1) } \\<and> w1 = take (F_EPDA_AIA__fp_computed_stack_approximation d i k) (epdaH_conf_stack c1) \\<and> w2 = take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k) (epdaH_conf_stack c2)\"\n  apply(induct i arbitrary: e1 c1 e2 c2)\n   apply(rename_tac e1 c1 e2 c2)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac e1 c1 e2 c2)(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"d\" and\n      n=\"0\" and\n      m=\"Suc 0\"\n      in epdaH.step_detail_before_some_position)\n      apply(rename_tac e1 c1 e2 c2)(*strict*)\n      apply(rule epdaH.derivation_initial_is_derivation)\n      apply(force)\n     apply(rename_tac e1 c1 e2 c2)(*strict*)\n     apply(force)\n    apply(rename_tac e1 c1 e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac e1 c1 e2 c2)(*strict*)\n   apply(clarsimp)\n   apply(simp add: epdaH_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac e1 c1 e2 c2 w)(*strict*)\n   apply(case_tac c1)\n   apply(rename_tac e1 c1 e2 c2 w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n   apply(case_tac c2)\n   apply(rename_tac e1 c1 e2 c2 w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa)(*strict*)\n   apply(case_tac e2)\n   apply(rename_tac e1 c1 e2 c2 w epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n   apply(rename_tac q1 h1 s1 q2 h2 s2 qs r po pu qt)\n   apply(rename_tac e1 c1 e2 c2 w q1 h1 s1 q2 h2 s2 qs r po pu qt)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e1 w h1 qs r po pu qt)(*strict*)\n   apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def F_EPDA_AIA__fp_invariants_def F_EPDA_AIA__fp_invariant_01_def F_EPDA_AIA__fp_start_def)\n   apply(clarsimp)\n   apply(rename_tac w r po pu qt)(*strict*)\n   apply(simp add: F_EPDA_AIA__fp_computed_stack_approximation_def)\n   apply(subgoal_tac \"nat_seq (Suc 0) 0 = []\")\n    apply(rename_tac w r po pu qt)(*strict*)\n    prefer 2\n    apply (metis append_Cons append_assoc natUptTo_n_Sucn nat_seq_drop_last_prime self_append_conv2)\n   apply(rename_tac w r po pu qt)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc 0) = [Suc 0]\")\n    apply(rename_tac w r po pu qt)(*strict*)\n    prefer 2\n    apply (metis append_Cons append_assoc natUptTo_n_Sucn nat_seq_drop_last_prime self_append_conv2)\n   apply(rename_tac w r po pu qt)(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_label_def)\n   apply(case_tac k)\n    apply(rename_tac w r po pu qt)(*strict*)\n    apply(clarsimp)\n    apply(rule F_EPDA_AIA__fp_one_intro3)\n        apply(rename_tac w r po pu qt)(*strict*)\n        apply(force)\n       apply(rename_tac w r po pu qt)(*strict*)\n       apply(force)\n      apply(rename_tac w r po pu qt)(*strict*)\n      apply(force)\n     apply(rename_tac w r po pu qt)(*strict*)\n     apply(force)\n    apply(rename_tac w r po pu qt)(*strict*)\n    apply(simp add: prefix_def)\n   apply(rename_tac w r po pu qt nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac k)\n   apply(rename_tac w r po pu qt k)(*strict*)\n   apply(case_tac po)\n    apply(rename_tac w r po pu qt k)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac r pu qt k)(*strict*)\n    apply(rule F_EPDA_AIA__fp_one_intro3)\n        apply(rename_tac r pu qt k)(*strict*)\n        apply(force)\n       apply(rename_tac r pu qt k)(*strict*)\n       apply(force)\n      apply(rename_tac r pu qt k)(*strict*)\n      apply(force)\n     apply(rename_tac r pu qt k)(*strict*)\n     prefer 2\n     apply(simp add: prefix_def)\n    apply(rename_tac r pu qt k)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"X\" for X)\n     apply(rename_tac r pu qt k)(*strict*)\n     prefer 2\n     apply(rule_tac b=\"(length pu)\" and a=\"k\" in min_alt)\n    apply(rename_tac r pu qt k)(*strict*)\n    apply(erule disjE)\n     apply(rename_tac r pu qt k)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac r pu qt k)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac w r po pu qt k a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac r pu qt k)(*strict*)\n   apply(rule F_EPDA_AIA__fp_one_intro3)\n       apply(rename_tac r pu qt k)(*strict*)\n       apply(force)\n      apply(rename_tac r pu qt k)(*strict*)\n      apply(force)\n     apply(rename_tac r pu qt k)(*strict*)\n     apply(force)\n    apply(rename_tac r pu qt k)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def)\n   apply(rename_tac r pu qt k)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac r pu qt k)(*strict*)\n    prefer 2\n    apply(rule_tac b=\"(length pu)\" and a=\"Suc k\" in min_alt)\n   apply(rename_tac r pu qt k)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac r pu qt k)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac r pu qt k)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i e1 c1 e2 c2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i e1 c1 e2 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\" and\n      n=\"i\" and\n      m=\"Suc i\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac i e1 c1 e2 c2)(*strict*)\n     apply(rule epdaH.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac i e1 c1 e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac i e1 c1 e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i e1 c1 e2 c2)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i e1 c1 e2 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\" and\n      n=\"Suc i\" and\n      m=\"Suc (Suc i)\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac i e1 c1 e2 c2)(*strict*)\n     apply(rule epdaH.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac i e1 c1 e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac i e1 c1 e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i e1 c1 e2 c2)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac i e1 c1 e2 c2 e1a e1b e2a e2b c1a c1b c2a c2b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a)(*strict*)\n  apply(erule_tac x=\"e1a\" in meta_allE)\n  apply(clarsimp)\n  apply(erule_tac x=\"c1a\" in meta_allE)\n  apply(clarsimp)\n  apply(erule_tac x=\"e2a\" in meta_allE)\n  apply(clarsimp)\n  apply(erule_tac x=\"c1\" in meta_allE)\n  apply(clarsimp)\n  apply(simp add: epdaH_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa)(*strict*)\n  apply(case_tac c1a)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n  apply(rename_tac q1 h1 s1)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa q1 h1 s1)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa q1 h1 s1 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n  apply(rename_tac q2 h2 s2)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa q1 h1 s1 q2 h2 s2)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa q1 h1 s1 q2 h2 s2 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n  apply(rename_tac q3 h3 s3)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa q1 h1 s1 q2 h2 s2 q3 h3 s3)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa q1 h1 s1 q2 h2 s2 q3 h3 s3 edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n  apply(rename_tac qs1 r1 po1 pu1 qt1)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa q1 h1 s1 q2 h2 s2 q3 h3 s3 qs1 r1 po1 pu1 qt1)(*strict*)\n  apply(case_tac e2a)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa q1 h1 s1 q2 h2 s2 q3 h3 s3 qs1 r1 po1 pu1 qt1 edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n  apply(rename_tac qs2 r2 po2 pu2 qt2)\n  apply(rename_tac i c1 e2 c2 e1a e2a c1a w wa q1 h1 s1 q2 h2 s2 q3 h3 s3 qs1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(rule F_EPDA_AIA__fp_one_intro3)\n      apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n    apply(force)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(case_tac \"min k (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k) - length po1\")\n    apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n    apply(rule disjI1)\n    apply(clarsimp)\n    apply(simp add: prefix_def)\n    apply(rule_tac x=\"drop (min k (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k)) po1\" in exI)\n    apply(rule append_take_drop_id)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2 nat)(*strict*)\n   apply(rule disjI2)\n   apply(clarsimp)\n   apply(simp add: prefix_def)\n   apply(rule_tac x=\"take (Suc nat) w\" in exI)\n   apply(clarsimp)\n   apply(rule sym)\n   apply(rule take_all)\n   apply(force)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(subgoal_tac \"F_EPDA_AIA__fp_computed_stack_approximation d (Suc (Suc i)) k \\<le> k\")\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(rule F_EPDA_AIA__fp_computed_stack_approximation_smaller_than_k)\n     apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n     apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n     apply(force)\n    apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n    apply(force)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   apply(force)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(subgoal_tac \"F_EPDA_AIA__fp_computed_stack_approximation d (Suc (i)) k \\<le> k\")\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(rule F_EPDA_AIA__fp_computed_stack_approximation_smaller_than_k)\n     apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n     apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n     apply(force)\n    apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n    apply(force)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   apply(force)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"min k (F_EPDA_AIA__fp_computed_stack_approximation d (Suc (Suc i)) k) = (F_EPDA_AIA__fp_computed_stack_approximation d (Suc (Suc i)) k)\")\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(subgoal_tac \"min k (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k) = (F_EPDA_AIA__fp_computed_stack_approximation d (Suc (i)) k)\")\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac t=\"F_EPDA_AIA__fp_computed_stack_approximation d (Suc (Suc i)) k\" and s=\"\n  min k (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k - length po1 + length pu1)\" in ssubst)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   apply(rule F_EPDA_AIA__fp_computed_stack_approximation_unfold)\n     apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n     apply(force)\n    apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n    apply(force)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   apply(force)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(rule_tac a=\"length pu1\" and b=\"k\" in min_alt)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(clarsimp)\n   apply(rule_tac t=\"(min k\n          (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k - length po1 + length pu1))\" and s=\"k\" in ssubst)\n    apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n    apply(force)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(rule_tac a=\"length po1\" and b=\"F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k\" in min_alt)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(clarsimp)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(rule_tac b=\"(F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k + length pu1 - length po1)\" and a=\"k\" in min_alt)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n    prefer 2\n    apply(rule_tac a=\"k - length pu1\" and  b=\"(F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k - length po1)\" in min_alt)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac t=\"F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k - length po1\" and s=\"k-length pu1\" in ssubst)\n    apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n    apply(rule antisym)\n     apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n     apply(force)\n    apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n    apply(rule to_mutual_sub1)\n    apply(force)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   apply(force)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(rule_tac a=\"k - length pu1\" and  b=\"(F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k - length po1)\" in min_alt)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(clarsimp)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k - length po1 \\<le> k - length pu1\")\n   apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n   prefer 2\n   apply(rule to_mutual_sub2)\n   apply(force)\n  apply(rename_tac i e1a w wa h1 r1 po1 pu1 qt1 qs2 r2 po2 pu2 qt2)(*strict*)\n  apply(force)\n  done\n\nlemma F_EPDA_AIA__fp_some_tuple_reachable_hlp1: \"\n  F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> \\<forall>d i e1 c1 e2 c2. epdaH.derivation_initial G d \\<longrightarrow> d i = Some (pair e1 c1) \\<longrightarrow> d (Suc i) = Some (pair (Some e2) c2) \\<longrightarrow> (\\<exists>w1 w2. cons_tuple2 (epdaH_conf_state c1) (take k w1) \\<in> (F_EPDA_AIA__fp G k E) \\<and> cons_tuple2 (epdaH_conf_state c2) (take k w2) \\<in> (F_EPDA_AIA__fp G k E) \\<and> cons_tuple2 (epdaH_conf_state c2) (take k w2) \\<in> F_EPDA_AIA__fp_one G k {cons_tuple2 (epdaH_conf_state c1) (take k w1) } \\<and> w1 = take (F_EPDA_AIA__fp_computed_stack_approximation d i k) (epdaH_conf_stack c1) \\<and> w2 = take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k) (epdaH_conf_stack c2))\"\n  apply(rule_tac P=\"\\<lambda>Ga ka N. \\<forall>d i e1 c1 e2 c2.\n          epdaH.derivation_initial Ga\n           d \\<longrightarrow>\n          d i = Some (pair e1 c1) \\<longrightarrow>\n          d (Suc i) = Some (pair (Some e2) c2) \\<longrightarrow>\n          (\\<exists>w1 w2.\n              cons_tuple2 (epdaH_conf_state c1) (take ka w1) \\<in> N \\<and>\n              cons_tuple2 (epdaH_conf_state c2) (take ka w2) \\<in> N \\<and>\n              cons_tuple2 (epdaH_conf_state c2) (take ka w2)\n              \\<in> F_EPDA_AIA__fp_one Ga ka\n                  {cons_tuple2 (epdaH_conf_state c1) (take ka w1)} \\<and>\n              w1 = take (F_EPDA_AIA__fp_computed_stack_approximation d i ka) (epdaH_conf_stack c1) \\<and>\n              w2 = take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) ka) (epdaH_conf_stack c2))\" in F_EPDA_AIA__fp_Meta_Lift_Without_Argument)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(rule_tac t=\"(F_EPDA_AIA__fp Ga ka N)\"  and s=\"(F_EPDA_AIA__fp Ga ka (F_EPDA_AIA__fp_one Ga ka N))\" in ssubst)\n    apply(rename_tac Ga ka N)(*strict*)\n    apply(rule F_EPDA_AIA__fp_F_EPDA_AIA__fp_one_idempotent_inner)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(force)\n  apply(rename_tac Ga ka N)(*strict*)\n  apply(rule_tac ?x.0=\"Ga\" and ?xa.0=\"ka\" and ?xb.0=\"N\" in F_EPDA_AIA__fp.pelims)\n    apply(rename_tac Ga ka N)(*strict*)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(rule F_EPDA_AIA__fp_valid_input_implies_termination)\n   apply(force)\n  apply(rename_tac Ga ka N Gaa kaa Ea)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac Ga ka Ea d i e1 c1 e2 c2)(*strict*)\n  apply(thin_tac \"X\" for X)\n  apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n   prefer 2\n   apply(rule_tac i=\"i\" in F_EPDA_AIA__fp_some_tuple_reachable_hlp2)\n          apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n          apply(force)\n         apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n         apply(force)\n        apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n        apply(force)\n       apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n       apply(force)\n      apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n      apply(force)\n     apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n     apply(force)\n    apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac Ga ka E d i e1 c1 e2 c2)(*strict*)\n  apply(force)\n  done\n\ntheorem F_EPDA_AIA__fp_some_tuple_reachable: \"\n  F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d i = Some (pair e1 c1)\n  \\<Longrightarrow> d (Suc i) = Some (pair (Some e2) c2)\n  \\<Longrightarrow> \\<exists>w1 w2. cons_tuple2 (epdaH_conf_state c1) (take k w1) \\<in> (F_EPDA_AIA__fp G k E) \\<and> cons_tuple2 (epdaH_conf_state c2) (take k w2) \\<in> (F_EPDA_AIA__fp G k E) \\<and> cons_tuple2 (epdaH_conf_state c2) (take k w2) \\<in> F_EPDA_AIA__fp_one G k {cons_tuple2 (epdaH_conf_state c1) (take k w1) } \\<and> w1 = take (F_EPDA_AIA__fp_computed_stack_approximation d i k) (epdaH_conf_stack c1) \\<and> w2 = take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k) (epdaH_conf_stack c2)\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule F_EPDA_AIA__fp_some_tuple_reachable_hlp1)\n   apply(force)\n  apply(force)\n  done\n\ntheorem F_EPDA_AIA__fp_enforces_F_EPDA_AIA__fp_one_step_contained: \"\n  F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> F_EPDA_AIA__fp_one_step_contained G k (F_EPDA_AIA__fp G k E)\"\n  apply(simp only: F_EPDA_AIA__fp_one_step_contained_def)\n  apply(rule allI)+\n  apply(rename_tac d i e1 c1 e2 c2)(*strict*)\n  apply(rule impI)+\n  apply(rule_tac F_EPDA_AIA__fp_some_tuple_reachable)\n     apply(rename_tac d i e1 c1 e2 c2)(*strict*)\n     apply(force)\n    apply(rename_tac d i e1 c1 e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac d i e1 c1 e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac d i e1 c1 e2 c2)(*strict*)\n  apply(force)\n  done\n\ntheorem F_EPDA_AIA__fp_identifies_only_useless_states: \"\n  valid_epda G\n  \\<Longrightarrow> Q = {q | q s. cons_tuple2 q s \\<in> F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k}}\n  \\<Longrightarrow> q \\<in> epda_states G - Q\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> epdaH_conf_state c = q\n  \\<Longrightarrow> False\"\n  apply(clarsimp)\n  apply(case_tac i)\n   apply(clarsimp)\n   apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n   apply(clarsimp)\n   apply(case_tac c)\n   apply(rename_tac epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac x=\"take k [epda_box G]\" in allE)\n   apply(fold F_EPDA_AIA__fp_start_def)\n   apply(subgoal_tac \"F_EPDA_AIA__fp_start G k \\<in> F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k}\")\n    apply(force)\n   apply(rule_tac A=\"{F_EPDA_AIA__fp_start G k}\" in set_mp)\n    prefer 2\n    apply(force)\n   apply(rule F_EPDA_AIA__fp_mono)\n   apply(rule F_EPDA_AIA__fp_valid_input_with_F_EPDA_AIA__fp_start)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\" and\n      n=\"nat\" and\n      m=\"Suc nat\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac nat)(*strict*)\n     apply(rule epdaH.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(force)\n   apply(rename_tac nat)(*strict*)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1)(*strict*)\n  apply(subgoal_tac \"F_EPDA_AIA__fp_one_step_contained G k (F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k})\")\n   apply(rename_tac nat e1 e2 c1)(*strict*)\n   prefer 2\n   apply(rule F_EPDA_AIA__fp_enforces_F_EPDA_AIA__fp_one_step_contained)\n   apply(rule F_EPDA_AIA__fp_valid_input_with_F_EPDA_AIA__fp_start)\n   apply(force)\n  apply(rename_tac nat e1 e2 c1)(*strict*)\n  apply(simp add: F_EPDA_AIA__fp_one_step_contained_def)\n  apply(erule_tac x=\"d\" in allE)\n  apply(clarsimp)\n  apply(erule_tac x=\"nat\" in allE)\n  apply(force)\n  done\n\nlemma F_EPDA_AIA_preserves_epdaH_accessible_states: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH_accessible_states G \\<subseteq> {q | q s. cons_tuple2 q s \\<in> F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k}}\"\n  apply(simp add: epdaH_accessible_states_def)\n  apply(clarsimp)\n  apply(rename_tac d n e c)(*strict*)\n  apply(case_tac \" \\<exists>s. cons_tuple2 (epdaH_conf_state c) s\n           \\<in> F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k}\")\n   apply(rename_tac d n e c)(*strict*)\n   apply(force)\n  apply(rename_tac d n e c)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac k=\"k\" in F_EPDA_AIA__fp_identifies_only_useless_states)\n       apply(rename_tac d n e c)(*strict*)\n       apply(force)\n      apply(rename_tac d n e c)(*strict*)\n      apply(force)\n     apply(rename_tac d n e c)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac d n e c)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac d n e c)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac d n e c)(*strict*)\n  apply(clarsimp)\n  apply(thin_tac \"\\<forall>s. cons_tuple2 (epdaH_conf_state c) s\n           \\<notin> F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k}\")\n  apply(subgoal_tac \"c \\<in> epdaH_configurations G\")\n   apply(rename_tac d n e c)(*strict*)\n   apply(simp add: epdaH_configurations_def)\n   apply(force)\n  apply(rename_tac d n e c)(*strict*)\n  apply (metis epdaH.derivation_initial_configurations)\n  done\n\ntheorem F_EPDA_AIA__fp_identifies_only_useless_edges: \"\n  valid_epda G\n  \\<Longrightarrow> D = {e | q s e. cons_tuple2 q s \\<in> F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k} \\<and> edge_src e = q \\<and> (prefix (edge_pop e) s \\<or> prefix s (edge_pop e)) }\n  \\<Longrightarrow> e \\<in> epda_delta G - D\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d i = Some (pair (Some e) c)\n  \\<Longrightarrow> False\"\n  apply(clarsimp)\n  apply(case_tac i)\n   apply(clarsimp)\n   apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\" and\n      n=\"nat\" and\n      m=\"Suc nat\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac nat)(*strict*)\n     apply(rule epdaH.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(force)\n   apply(rename_tac nat)(*strict*)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 c1)(*strict*)\n  apply(subgoal_tac \"F_EPDA_AIA__fp_one_step_contained G k (F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k})\")\n   apply(rename_tac nat e1 c1)(*strict*)\n   prefer 2\n   apply(rule F_EPDA_AIA__fp_enforces_F_EPDA_AIA__fp_one_step_contained)\n   apply(rule F_EPDA_AIA__fp_valid_input_with_F_EPDA_AIA__fp_start)\n   apply(force)\n  apply(rename_tac nat e1 c1)(*strict*)\n  apply(case_tac nat)\n   apply(rename_tac nat e1 c1)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e1 c1)(*strict*)\n   apply(simp add: F_EPDA_AIA__fp_one_step_contained_def)\n   apply(erule_tac x=\"d\" in allE)\n   apply(clarsimp)\n   apply(erule_tac x=\"0\" in allE)\n   apply(clarsimp)\n   apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def epdaH_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac c1 w)(*strict*)\n   apply(case_tac e)\n   apply(rename_tac c1 w edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n   apply(rename_tac q r po pu q')\n   apply(rename_tac c1 w q r po pu q')(*strict*)\n   apply(case_tac c)\n   apply(rename_tac c1 w q r po pu q' epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n   apply(rename_tac q1 h1 s1)\n   apply(rename_tac c1 w q r po pu q' q1 h1 s1)(*strict*)\n   apply(case_tac c1)\n   apply(rename_tac c1 w q r po pu q' q1 h1 s1 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n   apply(rename_tac q2 h2 s2)\n   apply(rename_tac c1 w q r po pu q' q1 h1 s1 q2 h2 s2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac w r po pu q')(*strict*)\n   apply(erule_tac x=\"take k [epda_box G]\" in allE)\n   apply(erule impE)\n    apply(rename_tac w r po pu q')(*strict*)\n    apply(fold F_EPDA_AIA__fp_start_def)\n    apply(rule_tac A=\"{F_EPDA_AIA__fp_start G k}\" in set_mp)\n     apply(rename_tac w r po pu q')(*strict*)\n     apply(rule F_EPDA_AIA__fp_mono)\n     apply(rule F_EPDA_AIA__fp_valid_input_with_F_EPDA_AIA__fp_start)\n     apply(force)\n    apply(rename_tac w r po pu q')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac w r po pu q')(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(case_tac po)\n    apply(rename_tac w r po pu q')(*strict*)\n    apply(force)\n   apply(rename_tac w r po pu q' a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac r pu q')(*strict*)\n   apply(case_tac k)\n    apply(rename_tac r pu q')(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac nat e1 c1 nata)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac e1 c1 nata)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac e1 c1 nata)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\" and\n      n=\"nata\" and\n      m=\"Suc nata\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac e1 c1 nata)(*strict*)\n     apply(rule epdaH.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac e1 c1 nata)(*strict*)\n    apply(force)\n   apply(rename_tac e1 c1 nata)(*strict*)\n   apply(force)\n  apply(rename_tac e1 c1 nata)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c1 nata e1a e2 c1a)(*strict*)\n  apply(simp add: F_EPDA_AIA__fp_one_step_contained_def)\n  apply(erule_tac x=\"d\" in allE)\n  apply(clarsimp)\n  apply(erule_tac x=\"nata\" in allE)\n  apply(clarsimp)\n  apply(simp add: epdaH_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac c1 nata e1a e2 c1a w wa)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac c1 nata e1a e2 c1a w wa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n  apply(rename_tac q2 r2 po2 pu2 q2')\n  apply(rename_tac c1 nata e1a e2 c1a w wa q2 r2 po2 pu2 q2')(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac c1 nata e1a e2 c1a w wa q2 r2 po2 pu2 q2' edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n  apply(rename_tac q1 r1 po1 pu1 q1')\n  apply(rename_tac c1 nata e1a e2 c1a w wa q2 r2 po2 pu2 q2' q1 r1 po1 pu1 q1')(*strict*)\n  apply(case_tac c)\n  apply(rename_tac c1 nata e1a e2 c1a w wa q2 r2 po2 pu2 q2' q1 r1 po1 pu1 q1' epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n  apply(rename_tac p1 h1 s1)\n  apply(rename_tac c1 nata e1a e2 c1a w wa q2 r2 po2 pu2 q2' q1 r1 po1 pu1 q1' p1 h1 s1)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac c1 nata e1a e2 c1a w wa q2 r2 po2 pu2 q2' q1 r1 po1 pu1 q1' p1 h1 s1 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n  apply(rename_tac p2 h2 s2)\n  apply(rename_tac c1 nata e1a e2 c1a w wa q2 r2 po2 pu2 q2' q1 r1 po1 pu1 q1' p1 h1 s1 p2 h2 s2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nata e1a c1a w wa r2 po2 pu2 q2' r1 po1 pu1 q1')(*strict*)\n  apply(case_tac c1a)\n  apply(rename_tac nata e1a c1a w wa r2 po2 pu2 q2' r1 po1 pu1 q1' epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n  apply(rename_tac p3 h3 s3)\n  apply(rename_tac nata e1a c1a w wa r2 po2 pu2 q2' r1 po1 pu1 q1' p3 h3 s3)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nata e1a w wa r2 po2 pu2 q2' r1 po1 pu1 q1' p3 h3)(*strict*)\n  apply(erule_tac x=\"X\" for X in allE)\n  apply(erule impE)\n   apply(rename_tac nata e1a w wa r2 po2 pu2 q2' r1 po1 pu1 q1' p3 h3)(*strict*)\n   apply(force)\n  apply(rename_tac nata e1a w wa r2 po2 pu2 q2' r1 po1 pu1 q1' p3 h3)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac nata e1a w wa r2 po2 pu2 q2' r1 po1 pu1 q1' p3 h3)(*strict*)\n   prefer 2\n   apply(rule_tac a=\"(min k (F_EPDA_AIA__fp_computed_stack_approximation d (Suc nata) k))\" and b=\"length po2\" in min_alt)\n  apply(rename_tac nata e1a w wa r2 po2 pu2 q2' r1 po1 pu1 q1' p3 h3)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac nata e1a w wa r2 po2 pu2 q2' r1 po1 pu1 q1' p3 h3)(*strict*)\n   apply(clarsimp)\n   apply(simp add: prefix_def)\n   apply(erule_tac x=\"drop (min k (F_EPDA_AIA__fp_computed_stack_approximation d (Suc nata) k)) po2\" in allE)+\n   apply(force)\n  apply(rename_tac nata e1a w wa r2 po2 pu2 q2' r1 po1 pu1 q1' p3 h3)(*strict*)\n  apply(clarsimp)\n  apply(simp add: prefix_def)\n  done\n\nlemma F_EPDA_AIA_preserves_epdaH_accessible_edges: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH_accessible_edges G \\<subseteq> {e | q s e. e \\<in> epda_delta G \\<and> cons_tuple2 q s \\<in> F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k} \\<and> edge_src e = q \\<and> (prefix (edge_pop e) s \\<or> prefix s (edge_pop e))}\"\n  apply(simp add: epdaH_accessible_edges_def)\n  apply(clarsimp)\n  apply(rename_tac x d n c)(*strict*)\n  apply(case_tac \" \\<exists>s. cons_tuple2 (edge_src x) s\n           \\<in> F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k} \\<and>\n           (edge_pop x \\<sqsubseteq> s \\<or> s \\<sqsubseteq> edge_pop x)\")\n   apply(rename_tac x d n c)(*strict*)\n   apply(force)\n  apply(rename_tac x d n c)(*strict*)\n  apply(subgoal_tac \"False\")\n   apply(rename_tac x d n c)(*strict*)\n   apply(force)\n  apply(rename_tac x d n c)(*strict*)\n  apply(rule_tac k=\"k\" in F_EPDA_AIA__fp_identifies_only_useless_edges)\n      apply(rename_tac x d n c)(*strict*)\n      apply(force)\n     apply(rename_tac x d n c)(*strict*)\n     apply(force)\n    apply(rename_tac x d n c)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x d n c)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x d n c)(*strict*)\n  apply(clarsimp)\n  done\n\ndefinition F_EPDA_AIA__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> nat\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_AIA__SpecInput G k \\<equiv>\n  valid_epda G\"\n\ndefinition F_EPDA_AIA__SpecOutput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('state, 'stack list) DT_tuple2 set\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_AIA__SpecOutput G k E \\<equiv>\n  epdaH_accessible_edges G \\<subseteq>\n    {e | q s e.\n      e \\<in> epda_delta G\n      \\<and> cons_tuple2 q s \\<in> E\n      \\<and> edge_src e = q\n      \\<and> (prefix (edge_pop e) s \\<or> prefix s (edge_pop e))}\n  \\<and> epdaH_accessible_states G \\<subseteq> {q | q s. cons_tuple2 q s \\<in> E}\"\n\ntheorem F_EPDA_AIA__SOUND: \"\n  F_EPDA_AIA__SpecInput G k\n  \\<Longrightarrow> F_EPDA_AIA__SpecOutput G k (F_EPDA_AIA G k)\"\n  apply(simp add: F_EPDA_AIA__SpecOutput_def F_EPDA_AIA__SpecInput_def)\n  apply(rule conjI)\n   apply(simp only: F_EPDA_AIA_def)\n   apply(rule_tac B=\"X\" for X in subset_trans)\n    apply(rule F_EPDA_AIA_preserves_epdaH_accessible_edges)\n    apply(force)\n   apply(force)\n  apply(simp only: F_EPDA_AIA_def)\n  apply(rule_tac B=\"X\" for X in subset_trans)\n   apply(rule F_EPDA_AIA_preserves_epdaH_accessible_states)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_EPDA_AIA__fp_computed_stack_approximation_initial: \"\n  F_EPDA_AIA__fp_computed_stack_approximation d 0 k = min k (Suc 0)\"\n  apply(simp add: F_EPDA_AIA__fp_computed_stack_approximation_def)\n  apply(subgoal_tac \"nat_seq (Suc 0) 0 = []\")\n   apply(clarsimp)\n  apply (metis append_Cons append_assoc natUptTo_n_Sucn nat_seq_drop_last_prime self_append_conv2)\n  done\ndeclare F_EPDA_AIA__fp_computed_stack_approximation_initial [simp add]\n\nlemma F_EPDA_AIA__fp_F_EPDA_AIA__fp_one_idempotent_outer: \"\n  F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> F_EPDA_AIA__fp G k E = F_EPDA_AIA__fp_one G k (F_EPDA_AIA__fp G k E)\"\n  apply(rule_tac G=\"G\" and k=\"k\" and N=\"E\" in F_EPDA_AIA__fp_Meta_Lift_Without_Argument)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply (metis F_EPDA_AIA__fp_F_EPDA_AIA__fp_one_idempotent_inner)\n  apply(rename_tac Ga ka N)(*strict*)\n  apply (metis F_EPDA_AIA__fp.psimps F_EPDA_AIA__fp_valid_input_implies_termination)\n  done\n\nlemma F_EPDA_AIA__fp_F_EPDA_AIA__fp_one_idempotent_outer_explicit: \"\n  valid_epda G\n  \\<Longrightarrow> F_EPDA_AIA__fp_one G k (F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k}) = F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k}\"\n  apply(rule sym)\n  apply(rule F_EPDA_AIA__fp_F_EPDA_AIA__fp_one_idempotent_outer)\n  apply(rule F_EPDA_AIA__fp_valid_input_with_F_EPDA_AIA__fp_start)\n  apply(force)\n  done\n\nlemma F_EPDA_AIA__fp_strong_dependency: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d i = Some (pair e1 c1)\n  \\<Longrightarrow> d (i+j) = Some (pair e2 c2)\n  \\<Longrightarrow> k > 0\n  \\<Longrightarrow> \\<exists>w.\n      length w = Suc j\n      \\<and> set w \\<subseteq> F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k}\n      \\<and> (\\<forall>ik<length w.\n          \\<forall>e c.\n          d (i+ik) = Some (pair e c)\n          \\<longrightarrow> w!ik\n            = cons_tuple2\n                (epdaH_conf_state c)\n                (take (F_EPDA_AIA__fp_computed_stack_approximation d (i+ik) k) (epdaH_conf_stack c)))\n      \\<and> (\\<forall>ik.\n          Suc ik<length w\n          \\<longrightarrow> w ! Suc ik\n            \\<in> F_EPDA_AIA__fp_one G k {w ! ik})\"\n  apply(induct j arbitrary: e2 c2)\n   apply(rename_tac e2 c2)(*strict*)\n   apply(clarsimp)\n   apply(case_tac i)\n    apply(clarsimp)\n    apply(rule_tac x=\"[F_EPDA_AIA__fp_start G k]\" in exI)\n    apply(rule conjI)\n     apply(force)\n    apply(rule conjI)\n     apply(simp (no_asm))\n     apply(rule_tac A=\"{F_EPDA_AIA__fp_start G k}\" in set_mp)\n      prefer 2\n      apply(force)\n     apply(rule F_EPDA_AIA__fp_mono)\n     apply(rule F_EPDA_AIA__fp_valid_input_with_F_EPDA_AIA__fp_start)\n     apply(force)\n    apply(rule conjI)\n     apply(clarsimp)\n     apply(simp add: epdaH.derivation_initial_def epdaH_initial_configurations_def F_EPDA_AIA__fp_start_def)\n    apply(clarsimp)\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(subgoal_tac \"F_EPDA_AIA__fp_one_step_contained G k (F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k})\")\n    apply(rename_tac i)(*strict*)\n    prefer 2\n    apply(rule F_EPDA_AIA__fp_enforces_F_EPDA_AIA__fp_one_step_contained)\n    apply(rule F_EPDA_AIA__fp_valid_input_with_F_EPDA_AIA__fp_start)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(simp add: F_EPDA_AIA__fp_one_step_contained_def)\n   apply(erule_tac x=\"d\" in allE)\n   apply(clarsimp)\n   apply(erule_tac x=\"i\" in allE)\n   apply(clarsimp)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac i)(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"d\" and\n      n=\"i\" and\n      m=\"Suc i\"\n      in epdaH.step_detail_before_some_position)\n      apply(rename_tac i)(*strict*)\n      apply(rule epdaH.derivation_initial_is_derivation)\n      apply(force)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i e1 e2 c1a)(*strict*)\n   apply(rule_tac x=\"[cons_tuple2 (epdaH_conf_state c1) X]\" for X in exI)\n   apply(rule conjI)\n    apply(rename_tac i e1 e2 c1a)(*strict*)\n    apply(force)\n   apply(rename_tac i e1 e2 c1a)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac i e1 e2 c1a)(*strict*)\n    apply(force)\n   apply(rename_tac i e1 e2 c1a)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac i e1 e2 c1a)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac t=\"min k (F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k)\" and s = \"F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k\" in ssubst)\n     apply(rename_tac i e1 e2 c1a)(*strict*)\n     apply (metis F_EPDA_AIA__fp_computed_stack_approximation_smaller_than_k min_absorb2)\n    apply(rename_tac i e1 e2 c1a)(*strict*)\n    apply(force)\n   apply(rename_tac i e1 e2 c1a)(*strict*)\n   apply(force)\n  apply(rename_tac j e2 c2)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac j e2 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\" and\n      n=\"i+j\" and\n      m=\"i+Suc j\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac j e2 c2)(*strict*)\n     apply(rule epdaH.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac j e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac j e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac j e2 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j c2 e1a e2a c1a)(*strict*)\n  apply(erule_tac x=\"e1a\" in meta_allE)\n  apply(erule_tac x=\"c1a\" in meta_allE)\n  apply(erule_tac meta_impE)\n   apply(rename_tac j c2 e1a e2a c1a)(*strict*)\n   apply(force)\n  apply(rename_tac j c2 e1a e2a c1a)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac j c2 e1a e2a c1a w)(*strict*)\n  apply(erule conjE)+\n  apply(rule_tac xs=\"w\" in rev_cases)\n   apply(rename_tac j c2 e1a e2a c1a w)(*strict*)\n   apply(force)\n  apply(rename_tac j c2 e1a e2a c1a w ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n  apply(subgoal_tac \"cons_tuple2 (epdaH_conf_state c2)\n                      (take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc (i + length ys)) k)\n                        (epdaH_conf_stack c2)) \\<in> F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k} \\<and> cons_tuple2 (epdaH_conf_state c2)\n                      (take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc (i + length ys)) k)\n                        (epdaH_conf_stack c2)) \\<in> F_EPDA_AIA__fp_one G k {y}\")\n   apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n   apply(rule_tac x=\"ys@[y,cons_tuple2 (epdaH_conf_state c2)\n                      (take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc (i + length ys)) k)\n                        (epdaH_conf_stack c2))]\" in exI)\n   apply(rule conjI)\n    apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n    apply(force)\n   apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac c2 e1a e2a c1a ys y ik e c)(*strict*)\n    apply(case_tac \"ik = (Suc (length ys))\")\n     apply(rename_tac c2 e1a e2a c1a ys y ik e c)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac e1a e2a c1a ys y c)(*strict*)\n     apply (metis (no_types, hide_lams) append_Cons append_Nil append_assoc length_Suc nth_append_length)\n    apply(rename_tac c2 e1a e2a c1a ys y ik e c)(*strict*)\n    apply(erule_tac x=\"ik\" in allE)+\n    apply(clarsimp)\n    apply(case_tac \"ik = ((length ys))\")\n     apply(rename_tac c2 e1a e2a c1a ys y ik e c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac c2 e1a e2a c1a ys y ik e c)(*strict*)\n    apply(clarsimp)\n    apply (metis less_Suc_eq nth_append)\n   apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c2 e1a e2a c1a ys y ik)(*strict*)\n   apply(case_tac \"ik=length ys\")\n    apply(rename_tac c2 e1a e2a c1a ys y ik)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n    apply(rule_tac t=\"(ys @\n        [y, cons_tuple2 (epdaH_conf_state c2)\n             (take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc (i + length ys)) k)\n               (epdaH_conf_stack c2))]) !\n       Suc (length ys)\" and s=\"cons_tuple2 (epdaH_conf_state c2)\n             (take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc (i + length ys)) k)\n               (epdaH_conf_stack c2))\" in ssubst)\n     apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n     apply (metis append_Cons append_Nil append_assoc length_Suc nth_append_length)\n    apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n    apply(case_tac e2a)\n    apply(rename_tac c2 e1a e2a c1a ys y edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n    apply(rename_tac q r po pu q')\n    apply(rename_tac c2 e1a e2a c1a ys y q r po pu q')(*strict*)\n    apply(thin_tac \"\\<forall>ik<length ys.\n          (ys @ [y]) ! Suc ik\n          \\<in> F_EPDA_AIA__fp_one G k {(ys @ [y]) ! ik}\")\n    apply(erule_tac x=\"length ys\" in allE)\n    apply(clarsimp)\n   apply(rename_tac c2 e1a e2a c1a ys y ik)(*strict*)\n   apply(thin_tac \"\\<forall>ik<Suc (length ys).\n          \\<forall>e c. d (i + ik) = Some (pair e c) \\<longrightarrow>\n                (ys @ [y]) ! ik =\n                cons_tuple2 (epdaH_conf_state c)\n                 (take (F_EPDA_AIA__fp_computed_stack_approximation d (i + ik) k)\n                   (epdaH_conf_stack c))\")\n   apply(erule_tac x=\"ik\" in allE)\n   apply(clarsimp)\n   apply(rule_tac t=\"(ys @\n        [y, cons_tuple2 (epdaH_conf_state c2)\n             (take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc (i + length ys)) k)\n               (epdaH_conf_stack c2))]) !\n       Suc ik\" and s=\" (ys @ [y]) ! Suc ik\" in ssubst)\n    apply(rename_tac c2 e1a e2a c1a ys y ik)(*strict*)\n    apply (metis (mono_tags, hide_lams) Suc_less_eq less_Suc_eq monoid_add_class.add.right_neutral nth_Cons_0 nth_append nth_append_length_plus)\n   apply(rename_tac c2 e1a e2a c1a ys y ik)(*strict*)\n   apply(rule_tac t=\"(ys @\n             [y, cons_tuple2 (epdaH_conf_state c2)\n                  (take (F_EPDA_AIA__fp_computed_stack_approximation d (Suc (i + length ys)) k)\n                    (epdaH_conf_stack c2))]) !\n            ik\" and s=\" (ys @ [y]) ! ik\" in ssubst)\n    apply(rename_tac c2 e1a e2a c1a ys y ik)(*strict*)\n    apply (metis Suc_less_eq less_Suc_eq nth_append nth_append_length)\n   apply(rename_tac c2 e1a e2a c1a ys y ik)(*strict*)\n   apply(force)\n  apply(rename_tac c2 e1a e2a c1a ys y)(*strict*)\n  apply(thin_tac \"\\<forall>ik<length ys.\n          (ys @ [y]) ! Suc ik\n          \\<in> F_EPDA_AIA__fp_one G k {(ys @ [y]) ! ik}\")\n  apply(erule_tac x=\"length ys\" in allE)\n  apply(clarsimp)\n  apply(rename_tac c2 e1a e2a c1a ys)(*strict*)\n  apply(case_tac e2a)\n  apply(rename_tac c2 e1a e2a c1a ys edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n  apply(rename_tac q r po pu q')\n  apply(rename_tac c2 e1a e2a c1a ys q r po pu q')(*strict*)\n  apply(case_tac c1a)\n  apply(rename_tac c2 e1a e2a c1a ys q r po pu q' epdaH_conf_statea epdaH_conf_history epdaH_conf_stacka)(*strict*)\n  apply(rename_tac q1 h1 s1)\n  apply(rename_tac c2 e1a e2a c1a ys q r po pu q' q1 h1 s1)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac c2 e1a e2a c1a ys q r po pu q' q1 h1 s1 epdaH_conf_statea epdaH_conf_history epdaH_conf_stacka)(*strict*)\n  apply(rename_tac q2 h2 s2)\n  apply(rename_tac c2 e1a e2a c1a ys q r po pu q' q1 h1 s1 q2 h2 s2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac e1a ys q r po pu q' q1 h1 s1 q2 h2 s2)(*strict*)\n  apply(rule F_EPDA_AIA__fp_one_intro3)\n      apply(rename_tac e1a ys q r po pu q' q1 h1 s1 q2 h2 s2)(*strict*)\n      apply(force)\n     apply(rename_tac e1a ys q r po pu q' q1 h1 s1 q2 h2 s2)(*strict*)\n     apply(rule F_EPDA_AIA__fp_F_EPDA_AIA__fp_one_idempotent_outer_explicit)\n     apply(force)\n    apply(rename_tac e1a ys q r po pu q' q1 h1 s1 q2 h2 s2)(*strict*)\n    apply(simp add: epdaH_step_relation_def)\n    apply(force)\n   apply(rename_tac e1a ys q r po pu q' q1 h1 s1 q2 h2 s2)(*strict*)\n   prefer 2\n   apply(simp add: epdaH_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   apply(case_tac \"(F_EPDA_AIA__fp_computed_stack_approximation d (i + length ys) k - length po)\")\n    apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n    apply(thin_tac \"\\<not> po \\<sqsubseteq>\n          take (F_EPDA_AIA__fp_computed_stack_approximation d (i + length ys) k) po @\n          take (F_EPDA_AIA__fp_computed_stack_approximation d (i + length ys) k - length po) w\")\n    apply(simp add: prefix_def)\n    apply(rule_tac x=\"drop (F_EPDA_AIA__fp_computed_stack_approximation d (i + length ys) k) po\" in exI)\n    apply(rule append_take_drop_id)\n   apply(rename_tac e1a ys q r po pu q' h1 w nat)(*strict*)\n   apply(subgoal_tac \"po \\<sqsubseteq>\n          take (F_EPDA_AIA__fp_computed_stack_approximation d (i + length ys) k) po @\n          take (F_EPDA_AIA__fp_computed_stack_approximation d (i + length ys) k - length po) w\")\n    apply(rename_tac e1a ys q r po pu q' h1 w nat)(*strict*)\n    apply(force)\n   apply(rename_tac e1a ys q r po pu q' h1 w nat)(*strict*)\n   apply(thin_tac \"\\<not> po \\<sqsubseteq>\n          take (F_EPDA_AIA__fp_computed_stack_approximation d (i + length ys) k) po @\n          take (F_EPDA_AIA__fp_computed_stack_approximation d (i + length ys) k - length po) w\")\n   apply(clarsimp)\n   apply(simp add: prefix_def)\n  apply(rename_tac e1a ys q r po pu q' q1 h1 s1 q2 h2 s2)(*strict*)\n  apply(simp add: epdaH_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(rule_tac t=\"F_EPDA_AIA__fp_computed_stack_approximation d (Suc (i + length ys)) k\" and s=\"\n  min k (F_EPDA_AIA__fp_computed_stack_approximation d ((i + length ys)) k - length po + length pu)\" in ssubst)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   apply(rule F_EPDA_AIA__fp_computed_stack_approximation_unfold)\n     apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n     apply(force)\n    apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n    apply(force)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   apply(force)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   prefer 2\n   apply(rule_tac a=\"length pu\" and b=\"k\" in min_alt)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   prefer 2\n   apply(clarsimp)\n   apply(rule_tac t=\"(min k\n          (F_EPDA_AIA__fp_computed_stack_approximation d (i+length ys) k - length po + length pu))\" and s=\"k\" in ssubst)\n    apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n    apply(force)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   prefer 2\n   apply(rule_tac a=\"length po\" and b=\"F_EPDA_AIA__fp_computed_stack_approximation d (i+length ys) k\" in min_alt)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   prefer 2\n   apply(clarsimp)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   prefer 2\n   apply(rule_tac b=\"(F_EPDA_AIA__fp_computed_stack_approximation d (i+length ys) k + length pu - length po)\" and a=\"k\" in min_alt)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n    prefer 2\n    apply(rule_tac a=\"k - length pu\" and  b=\"(F_EPDA_AIA__fp_computed_stack_approximation d (i+length ys) k - length po)\" in min_alt)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac t=\"F_EPDA_AIA__fp_computed_stack_approximation d (i+length ys) k - length po\" and s=\"k-length pu\" in ssubst)\n    apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n    apply(rule antisym)\n     apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n     apply(force)\n    apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n    apply(rule to_mutual_sub1)\n    apply(force)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   apply(force)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   prefer 2\n   apply(rule_tac a=\"k - length pu\" and  b=\"(F_EPDA_AIA__fp_computed_stack_approximation d (i+length ys) k - length po)\" in min_alt)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   prefer 2\n   apply(clarsimp)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"F_EPDA_AIA__fp_computed_stack_approximation d (i+length ys) k - length po \\<le> k - length pu\")\n   apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n   prefer 2\n   apply(rule to_mutual_sub2)\n   apply(force)\n  apply(rename_tac e1a ys q r po pu q' h1 w)(*strict*)\n  apply(force)\n  done\n\nlemma F_EPDA_AIA__fp_one_intro1: \"\n  x \\<in> E\n  \\<Longrightarrow> x \\<in> F_EPDA_AIA__fp_one G k E\"\n  apply(simp add: F_EPDA_AIA__fp_one_def)\n  done\n\nlemma F_EPDA_AIA__fp_some_tuple_reachable_hlp3: \"\n  take (min (k - length pu1) (k - (length pu2 + length ca))) cc = take (k - length pu1) (drop (length pu2 + length ca - (min (length pu2) k + min (length ca) (k - length pu2))) (take (k - (length pu2 + length ca)) cc))\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac a=\"(k - length pu1)\" and b=\"(k - (length pu2 + length ca))\" in min_alt)\n  apply(erule disjE)\n   apply(clarsimp)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac a=\"length pu2\" and b=\"k\" in min_alt)\n   apply(erule disjE)\n    apply(clarsimp)\n    apply(subgoal_tac \"X\" for X)\n     prefer 2\n     apply(rule_tac a=\"length ca\" and b=\"k-length pu2\" in min_alt)\n    apply(erule disjE)\n     apply(clarsimp)\n    apply(clarsimp)\n   apply(clarsimp)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac a=\"length ca\" and b=\"k-length pu2\" in min_alt)\n  apply(erule disjE)\n   apply(clarsimp)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac a=\"length pu2\" and b=\"k\" in min_alt)\n   apply(erule disjE)\n    apply(clarsimp)\n   apply(clarsimp)\n  apply(clarsimp)\n  done\n\nlemma F_EPDA_AIA__fp_one_in_F_EPDA_AIA__fp: \"\n  F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> F_EPDA_AIA__fp_one G k E \\<subseteq> F_EPDA_AIA__fp G k E\"\n  apply(rule_tac F_EPDA_AIA__fp_Meta_Lift_Without_Argument_With_Argument)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(rule_tac B=\"F_EPDA_AIA__fp_one Ga ka (F_EPDA_AIA__fp_one Ga ka N)\" in subset_trans)\n    apply(rename_tac Ga ka N)(*strict*)\n    apply(rule F_EPDA_AIA__fp_one_mono)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(force)\n  apply(rename_tac Ga ka N)(*strict*)\n  apply(rule_tac ?xb.0=\"N\" in F_EPDA_AIA__fp.pelims)\n    apply(rename_tac Ga ka N)(*strict*)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(rule_tac G=\"Ga\" and k=\"ka\" in F_EPDA_AIA__fp_valid_input_implies_termination)\n   apply(force)\n  apply(rename_tac Ga ka N Gaa kaa Ea)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_EPDA_AIA__fp_computed_stack_approximation_not_zero_after_push: \"\n  valid_epda G\n  \\<Longrightarrow> epdaH.derivation_initial G d\n  \\<Longrightarrow> d (Suc i) = Some (pair (Some e) c)\n  \\<Longrightarrow> edge_event e = None\n  \\<Longrightarrow> edge_push e = [A, X]\n  \\<Longrightarrow> edge_pop e = [X]\n  \\<Longrightarrow> k > 0\n  \\<Longrightarrow> F_EPDA_AIA__fp_computed_stack_approximation d (Suc i) k > 0\"\n  apply(simp add: F_EPDA_AIA__fp_computed_stack_approximation_def)\n  apply(subgoal_tac \"nat_seq (Suc 0) (Suc i) = nat_seq (Suc 0) i @[Suc i]\")\n   prefer 2\n   apply (metis diff_Suc_Suc minus_nat.diff_0 nat_seq_last zero_less_Suc)\n  apply(clarsimp)\n  apply(simp add: get_label_def)\n  done\n\ntheorem F_EPDA_AIA__fp_preserves_F_EPDA_AIA__fp_valid_input: \"\n  F_EPDA_AIA__fp_valid_input G k E\n  \\<Longrightarrow> F_EPDA_AIA__fp_valid_input G k (F_EPDA_AIA__fp G k E)\"\n  apply(rule F_EPDA_AIA__fp_Meta_Lift_Without_Argument)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(rule_tac t=\"(F_EPDA_AIA__fp Ga ka N)\"  and s=\"(F_EPDA_AIA__fp Ga ka (F_EPDA_AIA__fp_one Ga ka N))\" in ssubst)\n    apply(rename_tac Ga ka N)(*strict*)\n    apply(rule F_EPDA_AIA__fp_F_EPDA_AIA__fp_one_idempotent_inner)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(force)\n  apply(rename_tac Ga ka N)(*strict*)\n  apply(rule_tac ?x.0=\"Ga\" and ?xa.0=\"ka\" and ?xb.0=\"N\" in F_EPDA_AIA__fp.pelims)\n    apply(rename_tac Ga ka N)(*strict*)\n    apply(force)\n   apply(rename_tac Ga ka N)(*strict*)\n   apply(rule F_EPDA_AIA__fp_valid_input_implies_termination)\n   apply(force)\n  apply(rename_tac Ga ka N Gaa kaa Ea)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_EPDA_AIA__fp_enforces_F_EPDA_AIA__fp_all_have_parent_element: \"\n  valid_epda G\n  \\<Longrightarrow> F_EPDA_AIA__fp_all_have_parent_element G k (F_EPDA_AIA__fp G k {F_EPDA_AIA__fp_start G k})\"\n  apply(rule F_EPDA_AIA__fp_Meta_Lift_Without_Argument)\n    apply (metis F_EPDA_AIA__fp_valid_input_with_F_EPDA_AIA__fp_start)\n   apply(rename_tac Ga k N)(*strict*)\n   apply (metis F_EPDA_AIA__fp_F_EPDA_AIA__fp_one_idempotent_inner)\n  apply(rename_tac Ga k N)(*strict*)\n  apply(rule_tac ?x.0=\"Ga\" and ?xa.0=\"k\" and ?xb.0=\"N\" in F_EPDA_AIA__fp.pelims)\n    apply(rename_tac Ga k N)(*strict*)\n    apply(force)\n   apply(rename_tac Ga k N)(*strict*)\n   apply(rule F_EPDA_AIA__fp_valid_input_implies_termination)\n   apply(force)\n  apply(rename_tac Ga k N Gaa ka E)(*strict*)\n  apply(simp add: F_EPDA_AIA__fp_valid_input_def)\n  done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_04_02/FUNCTION__EPDAAIA__EPDA_APPROXIMATE_INITIAL_ACCESSIBLE.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.66192288918838, "lm_q2_score": 0.5, "lm_q1q2_score": 0.33096144459419}}
{"text": "theory flash17Bra  imports flash17Rev\n \n  begin\nlemma onInv17:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv17  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv17  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv17 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash17Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228625116081, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3309614312558041}}
{"text": "theory flash10Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_FAck ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_InvVsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Inv  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_InvAck_1VsInv10:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_InvAck_1_HomeVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_InvAck_2VsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                     have allCases:\"formEval   (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) )  s  \\<or>formEval  ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume c1:\"formEval  (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) )  s\"\nhave \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1  c1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n    }\n\n    moreover\n                       {assume c1:\"formEval ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately have \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                     have allCases:\"formEval   (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) )  s  \\<or>formEval  ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume c1:\"formEval  (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) )  s\"\nhave \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1  c1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n    }\n\n    moreover\n                       {assume c1:\"formEval ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately have \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_GetXVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak1VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak2VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak3VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX1VsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX4VsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX7VsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv10:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv10:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_GetVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak1VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak2VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak3VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put1VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put2VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put3VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_PutVsInv10:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) )  ( Const UNI_Put ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv10:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Local_PutXAcksDone ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) )  ( Const UNI_PutX ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma NI_NakVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Nak  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Nak_ClearVsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Nak_Clear ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Nak_HomeVsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Nak_Home ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Remote_GetX_NakVsInv10:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Remote_GetX_Nak_HomeVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Remote_GetX_PutXVsInv10:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Remote_Get_Nak2VsInv10:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Remote_Get_Put1VsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv10:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutVsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Remote_Put  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                     have allCases:\"formEval  ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true ))  s  \\<or>formEval   (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true )) )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true ))  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n\n    moreover\n                       {assume c1:\"formEval  (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true )) )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately have \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutXVsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''Dir_local'') )  ( Const true ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_PutX ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_ReplaceVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_ReplaceHomeVsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_ReplaceHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_ReplaceHomeShrVldVsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_ReplaceHomeShrVld ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_ReplaceShrVldVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_ShWbVsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_ShWb N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_WbVsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (NI_Wb ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_GetX1VsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Local_GetX_GetX1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_GetX2VsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Local_GetX_GetX2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX1VsInv10:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma PI_Local_GetX_PutX2VsInv10:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Para ''CacheState'' Home) )  ( Const CACHE_S ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma PI_Local_GetX_PutX3VsInv10:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Local_GetX_PutX3 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma PI_Local_GetX_PutX4VsInv10:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Local_GetX_PutX4 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Para ''CacheState'' Home) )  ( Const CACHE_S ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma PI_Local_Get_GetVsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Local_Get_Get ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_Get_PutVsInv10:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Local_Get_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma PI_Local_PutXVsInv10:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Local_PutX ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n     have allCases:\"formEval  ( eqn ( IVar ( Global ''Dir_Pending'') )  ( Const true ))  s  \\<or>formEval   (neg ( eqn ( IVar ( Global ''Dir_Pending'') )  ( Const true )) )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume b1:\"formEval ( eqn ( IVar ( Global ''Dir_Pending'') )  ( Const true ))  s\"\nhave \"?P2 s\"\n\n   \n  apply(cut_tac  a1  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n    }\n\n    moreover\n                       {assume b1:\"formEval  (neg ( eqn ( IVar ( Global ''Dir_Pending'') )  ( Const true )) )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Local_ReplaceVsInv10:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Local_Replace ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma PI_Remote_GetVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Remote_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma PI_Remote_GetXVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Remote_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma PI_Remote_PutXVsInv10:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_ReplaceVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (PI_Remote_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma StoreVsInv10:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (Store  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma StoreHomeVsInv10:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv10  iInv1 ) (StoreHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash10Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370308082623217, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3309510876326517}}
{"text": "chapter \\<open>MTL\\<close>\n\ntheory MTL\n  imports Interval Trace \"HOL-Library.Simps_Case_Conv\"\n    \"Containers.Containers\"\n    \"Well_Quasi_Orders.Well_Quasi_Orders\"\nbegin\ndeclare [[names_short]]\nsection \\<open>Formulas and Satisfiability\\<close>\n\ndatatype 'a mtl = TT | FF | Atom 'a | Neg \"'a mtl\" | Disj \"'a mtl\" \"'a mtl\" \n  | Conj \"'a mtl\" \"'a mtl\" | Impl \"'a mtl\" \"'a mtl\" | Iff \"'a mtl\" \"'a mtl\"\n  | Next \\<I> \"'a mtl\" | Prev \\<I> \"'a mtl\" | Once \\<I> \"'a mtl\" | Historically \\<I> \"'a mtl\"\n  | Eventually \\<I> \"'a mtl\" | Always \\<I> \"'a mtl\"\n  | Since \"'a mtl\" \\<I> \"'a mtl\" | Until \"'a mtl\" \\<I> \"'a mtl\"\n\nfun sat :: \"'a trace \\<Rightarrow> nat \\<Rightarrow> 'a mtl \\<Rightarrow> bool\" where\n  \"sat \\<sigma> i TT = True\"\n| \"sat \\<sigma> i FF = False\"\n| \"sat \\<sigma> i (Atom a) = (a \\<in> \\<Gamma> \\<sigma> i)\"\n| \"sat \\<sigma> i (Neg \\<phi>) = (\\<not> sat \\<sigma> i \\<phi>)\"\n| \"sat \\<sigma> i (Disj \\<phi> \\<psi>) = (sat \\<sigma> i \\<phi> \\<or> sat \\<sigma> i \\<psi>)\"\n| \"sat \\<sigma> i (Conj \\<phi> \\<psi>) = (sat \\<sigma> i \\<phi> \\<and> sat \\<sigma> i \\<psi>)\"\n| \"sat \\<sigma> i (Impl \\<phi> \\<psi>) = (sat \\<sigma> i \\<phi> \\<longrightarrow> sat \\<sigma> i \\<psi>)\"\n| \"sat \\<sigma> i (Iff \\<phi> \\<psi>) = (sat \\<sigma> i \\<phi> \\<longleftrightarrow> sat \\<sigma> i \\<psi>)\"\n| \"sat \\<sigma> i (Next I \\<phi>) = (mem (\\<tau> \\<sigma> (i + 1) - \\<tau> \\<sigma> i) I \\<and> sat \\<sigma> (i + 1) \\<phi>)\"\n| \"sat \\<sigma> i (Prev I \\<phi>) = (case i of 0 \\<Rightarrow> False | Suc j \\<Rightarrow> mem (\\<tau> \\<sigma> i - \\<tau> \\<sigma> j) I \\<and> sat \\<sigma> j \\<phi>)\"\n| \"sat \\<sigma> i (Once I \\<phi>) = (\\<exists>j\\<le>i. mem (\\<tau> \\<sigma> i - \\<tau> \\<sigma> j) I \\<and> sat \\<sigma> j \\<phi>)\"\n| \"sat \\<sigma> i (Historically I \\<phi>) = (\\<forall>j\\<le>i. mem (\\<tau> \\<sigma> i - \\<tau> \\<sigma> j) I \\<longrightarrow> sat \\<sigma> j \\<phi>)\"\n| \"sat \\<sigma> i (Eventually I \\<phi>) = (\\<exists>j\\<ge>i. mem (\\<tau> \\<sigma> j - \\<tau> \\<sigma> i) I \\<and> sat \\<sigma> j \\<phi>)\"\n| \"sat \\<sigma> i (Always I \\<phi>) = (\\<forall>j\\<ge>i. mem (\\<tau> \\<sigma> j - \\<tau> \\<sigma> i) I \\<longrightarrow> sat \\<sigma> j \\<phi>)\"\n| \"sat \\<sigma> i (Since \\<phi> I \\<psi>) = (\\<exists>j\\<le>i. mem (\\<tau> \\<sigma> i - \\<tau> \\<sigma> j) I \\<and> sat \\<sigma> j \\<psi> \\<and> (\\<forall>k \\<in> {j <.. i}. sat \\<sigma> k \\<phi>))\"\n| \"sat \\<sigma> i (Until \\<phi> I \\<psi>) = (\\<exists>j\\<ge>i. mem (\\<tau> \\<sigma> j - \\<tau> \\<sigma> i) I \\<and> sat \\<sigma> j \\<psi> \\<and> (\\<forall>k \\<in> {i ..< j}. sat \\<sigma> k \\<phi>))\"\n\nabbreviation \"delta rho i j \\<equiv> (\\<tau> rho i) - (\\<tau> rho j)\"\n\nlemma sat_Until_rec: \"sat \\<sigma> i (Until \\<phi> I \\<psi>) \\<longleftrightarrow>\n  mem 0 I \\<and> sat \\<sigma> i \\<psi> \\<or>\n  (\\<Delta> \\<sigma> (i + 1) \\<le> right I \\<and> sat \\<sigma> i \\<phi> \\<and> sat \\<sigma> (i + 1) (Until \\<phi> (subtract (\\<Delta> \\<sigma> (i + 1)) I) \\<psi>))\"\n  (is \"?L \\<longleftrightarrow> ?R\")\nproof (rule iffI; (elim disjE conjE)?)\n  assume ?L\n  then obtain j where j: \"i \\<le> j\" \"mem (\\<tau> \\<sigma> j - \\<tau> \\<sigma> i) I\" \"sat \\<sigma> j \\<psi>\" \"\\<forall>k \\<in> {i ..< j}. sat \\<sigma> k \\<phi>\"\n    by auto\n  then show ?R\n  proof (cases \"i = j\")\n    case False\n    with j(1,2) have \"\\<Delta> \\<sigma> (i + 1) \\<le> right I\"\n      by (auto elim: order_trans[rotated] simp: diff_le_mono)\n    moreover from False j(1,4) have \"sat \\<sigma> i \\<phi>\" by auto\n    moreover from False j have \"sat \\<sigma> (i + 1) (Until \\<phi> (subtract (\\<Delta> \\<sigma> (i + 1)) I) \\<psi>)\"\n      by (cases \"right I\") (auto simp: le_diff_conv le_diff_conv2 intro!: exI[of _ j])\n    ultimately show ?thesis by blast\n  qed simp\nnext\n  assume \\<Delta>: \"\\<Delta> \\<sigma> (i + 1) \\<le> right I\" and now: \"sat \\<sigma> i \\<phi>\" and\n   \"next\": \"sat \\<sigma> (i + 1) (Until \\<phi> (subtract (\\<Delta> \\<sigma> (i + 1)) I) \\<psi>)\"\n  from \"next\" obtain j where j: \"i + 1 \\<le> j\" \"mem (\\<tau> \\<sigma> j - \\<tau> \\<sigma> (i + 1)) ((subtract (\\<Delta> \\<sigma> (i + 1)) I))\"\n      \"sat \\<sigma> j \\<psi>\" \"\\<forall>k \\<in> {i + 1 ..< j}. sat \\<sigma> k \\<phi>\"\n    by auto\n  from \\<Delta> j(1,2) have \"mem (\\<tau> \\<sigma> j - \\<tau> \\<sigma> i) I\"\n    by (cases \"right I\") (auto simp: le_diff_conv2)\n  with now j(1,3,4) show ?L by (auto simp: le_eq_less_or_eq[of i] intro!: exI[of _ j])\nqed auto\n\nlemma sat_Since_rec: \"sat \\<sigma> i (Since \\<phi> I \\<psi>) \\<longleftrightarrow>\n  mem 0 I \\<and> sat \\<sigma> i \\<psi> \\<or>\n  (i > 0 \\<and> \\<Delta> \\<sigma> i \\<le> right I \\<and> sat \\<sigma> i \\<phi> \\<and> sat \\<sigma> (i - 1) (Since \\<phi> (subtract (\\<Delta> \\<sigma> i) I) \\<psi>))\"\n  (is \"?L \\<longleftrightarrow> ?R\")\nproof (rule iffI; (elim disjE conjE)?)\n  assume ?L\n  then obtain j where j: \"j \\<le> i\" \"mem (\\<tau> \\<sigma> i - \\<tau> \\<sigma> j) I\" \"sat \\<sigma> j \\<psi>\" \"\\<forall>k \\<in> {j <.. i}. sat \\<sigma> k \\<phi>\"\n    by auto\n  then show ?R\n  proof (cases \"i = j\")\n    case False\n    with j(1) obtain k where [simp]: \"i = k + 1\"\n      by (cases i) auto\n    with j(1,2) False have \"\\<Delta> \\<sigma> i \\<le> right I\"\n      by (auto elim: order_trans[rotated] simp: diff_le_mono2 le_Suc_eq)\n    moreover from False j(1,4) have \"sat \\<sigma> i \\<phi>\" by auto\n    moreover from False j have \"sat \\<sigma> (i - 1) (Since \\<phi> (subtract (\\<Delta> \\<sigma> i) I) \\<psi>)\"\n      by (cases \"right I\") (auto simp: le_diff_conv le_diff_conv2 intro!: exI[of _ j])\n    ultimately show ?thesis by auto\n  qed simp\nnext\n  assume i: \"0 < i\" and \\<Delta>: \"\\<Delta> \\<sigma> i \\<le> right I\" and now: \"sat \\<sigma> i \\<phi>\" and\n   \"prev\": \"sat \\<sigma> (i - 1) (Since \\<phi> (subtract (\\<Delta> \\<sigma> i) I) \\<psi>)\"\n  from \"prev\" obtain j where j: \"j \\<le> i - 1\" \"mem (\\<tau> \\<sigma> (i - 1) - \\<tau> \\<sigma> j) ((subtract (\\<Delta> \\<sigma> i) I))\"\n      \"sat \\<sigma> j \\<psi>\" \"\\<forall>k \\<in> {j <.. i - 1}. sat \\<sigma> k \\<phi>\"\n    by auto\n  from \\<Delta> i j(1,2) have \"mem (\\<tau> \\<sigma> i - \\<tau> \\<sigma> j) I\"\n    by (cases \"right I\") (auto simp: le_diff_conv2)\n  with now i j(1,3,4) show ?L by (auto simp: le_Suc_eq gr0_conv_Suc intro!: exI[of _ j])\nqed auto\n\nlemma sat_Once_Since: \"sat \\<sigma> i (Once I \\<phi>) = sat \\<sigma> i (Since TT I \\<phi>)\"\n  by auto\n\nlemma sat_Once_rec: \"sat \\<sigma> i (Once I \\<phi>) \\<longleftrightarrow>\n  mem 0 I \\<and> sat \\<sigma> i \\<phi> \\<or> \n  (i > 0 \\<and> \\<Delta> \\<sigma> i \\<le> right I \\<and> sat \\<sigma> (i - 1) (Once (subtract (\\<Delta> \\<sigma> i) I) \\<phi>))\"\n  unfolding sat_Once_Since\n  by (subst sat_Since_rec) auto\n\nlemma sat_Historically_Once: \"sat \\<sigma> i (Historically I \\<phi>) = sat \\<sigma> i (Neg (Once I (Neg \\<phi>)))\"\n  by auto\n\nlemma sat_Historically_rec: \"sat \\<sigma> i (Historically I \\<phi>) \\<longleftrightarrow>\n  (mem 0 I \\<longrightarrow> sat \\<sigma> i \\<phi>) \\<and> \n  (i > 0 \\<longrightarrow> \\<Delta> \\<sigma> i \\<le> right I \\<longrightarrow> sat \\<sigma> (i - 1) (Historically (subtract (\\<Delta> \\<sigma> i) I) \\<phi>))\"\n  unfolding sat_Historically_Once sat.simps(4)\n  by (subst sat_Once_rec) auto\n\nlemma sat_Eventually_Until: \"sat \\<sigma> i (Eventually I \\<phi>) = sat \\<sigma> i (Until TT I \\<phi>)\"\n  by auto\n\nlemma sat_Eventually_rec: \"sat \\<sigma> i (Eventually I \\<phi>) \\<longleftrightarrow>\n  mem 0 I \\<and> sat \\<sigma> i \\<phi> \\<or> \n  (\\<Delta> \\<sigma> (i + 1) \\<le> right I \\<and> sat \\<sigma> (i + 1) (Eventually (subtract (\\<Delta> \\<sigma> (i + 1)) I) \\<phi>))\"\n  unfolding sat_Eventually_Until\n  by (subst sat_Until_rec) auto\n\nlemma sat_Always_Eventually: \"sat \\<sigma> i (Always I \\<phi>) = sat \\<sigma> i (Neg (Eventually I (Neg \\<phi>)))\"\n  by auto\n\nlemma sat_Always_rec: \"sat \\<sigma> i (Always I \\<phi>) \\<longleftrightarrow>\n  (mem 0 I \\<longrightarrow> sat \\<sigma> i \\<phi>) \\<and> \n  (\\<Delta> \\<sigma> (i + 1) \\<le> right I \\<longrightarrow> sat \\<sigma> (i + 1) (Always (subtract (\\<Delta> \\<sigma> (i + 1)) I) \\<phi>))\"\n  unfolding sat_Always_Eventually sat.simps(4)\n  by (subst sat_Eventually_rec) auto\n\ndefinition ETP:: \"'a trace \\<Rightarrow> nat \\<Rightarrow> nat\"\n  where\n    \"ETP rho t = (LEAST i. \\<tau> rho i \\<ge> t)\"\n\nlemma ETP_zero[simp]: \"ETP rho 0 = 0\"\n  by (auto simp add: ETP_def)\n\ndefinition LTP:: \"'a trace \\<Rightarrow> nat \\<Rightarrow> nat\"\n  where\n    \"LTP rho t = Max {i. (\\<tau> rho i) \\<le> t}\"\n\n(*ETP and LTP lemmas for arbitrary event streams*)\nlemma i_etp_to_tau: \"i \\<ge> ETP rho n \\<longleftrightarrow> \\<tau> rho i \\<ge> n\"\nproof\n  assume P: \"i \\<ge> ETP rho n\"\n  define j where j_def: \"j \\<equiv> ETP rho n\"\n  then have i_j: \"\\<tau> rho i \\<ge> \\<tau> rho j\" using P by auto\n  from j_def have \"\\<tau> rho j \\<ge> n\"\n    unfolding ETP_def using LeastI_ex ex_le_\\<tau> by force\n  then show \"\\<tau> rho i \\<ge> n\" using i_j by auto\nnext\n  assume Q: \"\\<tau> rho i \\<ge> n\"\n  then show \"ETP rho n \\<le> i\" unfolding ETP_def\n    by (auto simp add: Least_le)\nqed\n\nlemma i_ltp_to_tau:\n  assumes n_asm: \"n \\<ge> \\<tau> rho 0\"\n  shows \"(i \\<le> LTP rho n \\<longleftrightarrow> \\<tau> rho i \\<le> n)\"\nproof\n  define A and j where A_def: \"A \\<equiv> {i. \\<tau> rho i \\<le> n}\"  and j_def: \"j \\<equiv> LTP rho n\"\n  assume P: \"i \\<le> LTP rho n\"\n  from n_asm A_def have A_ne: \"A \\<noteq> {}\" by auto\n  from j_def have i_j: \"\\<tau> rho i \\<le> \\<tau> rho j\" using P by auto\n  from A_ne j_def have \"\\<tau> rho j \\<le> n\"\n    unfolding LTP_def using Max_in[of A] A_def\n    by (metis \\<tau>_mono finite_nat_set_iff_bounded_le le_trans mem_Collect_eq nat_le_linear)\n  then show \"\\<tau> rho i \\<le> n\" using i_j by auto\nnext\n  define A and j where A_def: \"A \\<equiv> {i. \\<tau> rho i \\<le> n}\"  and j_def: \"j \\<equiv> LTP rho n\"\n  assume Q: \"\\<tau> rho i \\<le> n\"\n  then have \"i \\<in> A\" using A_def by auto\n  then show \"i \\<le> LTP rho n\" unfolding LTP_def using Max_ge[of A] A_def\n    by (metis finite_Collect_le_nat i_etp_to_tau infinite_nat_iff_unbounded_le mem_Collect_eq)\nqed\n\nlemma etp_to_delta: \"i \\<ge> ETP rho (\\<tau> rho l + n) \\<Longrightarrow> delta rho i l \\<ge> n\"\nproof -\n  assume P: \"i \\<ge> ETP rho (\\<tau> rho l + n)\"\n  then have \"\\<tau> rho i \\<ge> \\<tau> rho l + n\" by (auto simp add: i_etp_to_tau)\n  then show ?thesis by auto\nqed\n\nlemma etp_ge: \"ETP rho (\\<tau> rho l + n + 1) > l\"\nproof -\n  define j where j_def: \"j \\<equiv> \\<tau> rho l + n + 1\"\n  then have etp_j: \"\\<tau> rho (ETP rho j) \\<ge> j\" unfolding ETP_def\n    using LeastI_ex ex_le_\\<tau> by force\n  then have \"\\<tau> rho (ETP rho j) > \\<tau> rho l\" using j_def by auto\n  then show ?thesis using j_def less_\\<tau>D by blast\nqed\n\nlemma i_le_ltpi: \"i \\<le> LTP rho (\\<tau> rho i)\"\n  using \\<tau>_mono i_ltp_to_tau[of rho \"\\<tau> rho i\" i]\n  by auto\n\nlemma i_le_ltpi_add: \"i \\<le> LTP rho (\\<tau> rho i + n)\"\n  using i_le_ltpi\n  by (simp add: add_increasing2 i_ltp_to_tau)\n\nlemma i_le_ltpi_minus: \"\\<tau> rho 0 + n \\<le> \\<tau> rho i \\<Longrightarrow> i > 0 \\<Longrightarrow> n > 0 \\<Longrightarrow>\n  LTP rho (\\<tau> rho i - n) < i\"\n  unfolding LTP_def\n  apply (subst Max_less_iff)\n    apply (auto simp: finite_nat_set_iff_bounded_le)\n  subgoal apply (rule exI[of _ i]; auto)\n    apply (erule contrapos_pp) back back back\n    apply (auto simp: not_le not_less dest!: \\<tau>_mono[of i _ rho] less_imp_le[of i])\n    done\n  subgoal apply (rule exI[of _ 0]; auto) done\n  subgoal for a\n    apply (erule contrapos_pp)\n    apply (auto simp: not_le not_less dest!: \\<tau>_mono[of i a rho])\n    done\n  done\n\nlemma i_ge_etpi: \"ETP rho (\\<tau> rho i) \\<le> i\"\n  using \\<tau>_mono i_etp_to_tau[of rho \"\\<tau> rho i\" i]\n  by auto\n\nlemma enat_trans[simp]: \"enat i \\<le> enat j \\<and> enat j \\<le> enat k \\<Longrightarrow> enat i \\<le> enat k\"\n  by auto\n\n(*sat lemmas*)\nlemma not_sat_SinceD:\n  assumes unsat: \"\\<not> sat rho i (Since phi I psi)\" and\n    witness: \"\\<exists>j \\<le> i. mem (\\<tau> rho i - \\<tau> rho j) I \\<and> sat rho j psi\"\n  shows \"\\<exists>j \\<le> i. ETP rho (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> \\<tau> rho i - n) \\<le> j \\<and> \\<not> sat rho j phi\n  \\<and> (\\<forall>k \\<in> {j .. (min i (LTP rho (\\<tau> rho i - left I)))}. \\<not> sat rho k psi)\"\nproof -\n  define A and j where A_def: \"A \\<equiv> {j. j \\<le> i \\<and> mem (\\<tau> rho i - \\<tau> rho j) I \\<and> sat rho j psi}\"\n    and j_def: \"j \\<equiv> Max A\"\n  from witness have j: \"j \\<le> i\" \"sat rho j psi\" \"mem (\\<tau> rho i - \\<tau> rho j) I\"\n    using Max_in[of A] unfolding j_def[symmetric] unfolding A_def\n    by auto\n  moreover\n  from j(3) have \"ETP rho (case right I of enat n \\<Rightarrow> \\<tau> rho i - n | \\<infinity> \\<Rightarrow> 0) \\<le> j\"\n    unfolding ETP_def by (intro Least_le) (auto split: enat.splits)\n  moreover\n  { fix j\n    assume \"\\<tau> rho j \\<le> \\<tau> rho i\"\n    moreover obtain k where \"\\<tau> rho i < \\<tau> rho k\" \"i < k\"\n      by (meson ex_le_\\<tau> gt_ex less_le_trans)\n    ultimately have \"j \\<le> ETP rho (Suc (\\<tau> rho i))\"\n      unfolding ETP_def\n      apply -\n      apply (rule LeastI2[of _ k])\n       apply (auto simp: Suc_le_eq)\n      by (meson \\<tau>_mono leD less_le_trans linear)\n  } note * = this\n  { fix k\n    assume k: \"k \\<in> {j <.. (min i (LTP rho (\\<tau> rho i - left I)))}\"\n    with j(3) have \"mem (\\<tau> rho i - \\<tau> rho k) I\"\n      unfolding LTP_def\n      apply (auto simp: le_diff_conv2 add.commute)\n       apply (subst (asm) Max_ge_iff)\n         apply auto\n        prefer 2\n      using \\<tau>_mono le_trans nat_add_left_cancel_le apply blast\n       apply (rule finite_subset[of _ \"{0 .. ETP rho (\\<tau> rho i + 1)}\"])\n        apply (auto simp: * Suc_le_eq) [2]\n      apply (cases \"right I\")\n       apply (auto simp: le_diff_conv)\n      by (meson \\<tau>_mono add_mono_thms_linordered_semiring(2) le_trans less_imp_le)\n\n    with Max_ge[of A k] k have \"\\<not> sat rho k psi\"\n      unfolding j_def[symmetric] unfolding A_def\n      by auto\n  }\n  ultimately show ?thesis using unsat\n    by (auto dest!: spec[of _ j])\nqed\n\nlemma min_not_in: \"finite A \\<Longrightarrow> A \\<noteq> {} \\<Longrightarrow> x < Min A \\<Longrightarrow> x \\<notin> A\"\n  by auto\n\nlemma not_sat_UntilD:\n  assumes unsat: \"\\<not> (sat rho i (Until phi I psi))\"\n    and witness: \"\\<exists>j \\<ge> i. mem (delta rho j i) I \\<and> sat rho j psi\"\n  shows \"\\<exists>j \\<ge> i. (case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> j \\<le> LTP rho (\\<tau> rho i + n))\n  \\<and> \\<not> (sat rho j phi) \\<and> (\\<forall>k \\<in> {(max i (ETP rho (\\<tau> rho i + left I))) .. j}.\n   \\<not> sat rho k psi)\"\nproof -\n  from \\<tau>_mono have i0: \"\\<tau> rho 0 \\<le> \\<tau> rho i\" by auto\n  from witness obtain jmax where jmax: \"jmax \\<ge> i\" \"sat rho jmax psi\"\n    \"mem (delta rho jmax i) I\" by blast\n  define A and j where A_def: \"A \\<equiv> {j. j \\<ge> i \\<and> j \\<le> jmax\n  \\<and> mem (delta rho j i) I \\<and> sat rho j psi}\" and j_def: \"j \\<equiv> Min A\"\n  have j: \"j \\<ge> i\" \"sat rho j psi\" \"mem (delta rho j i) I\"\n    using A_def j_def jmax Min_in[of A]\n    unfolding j_def[symmetric] unfolding A_def\n    by fastforce+\n  moreover have \"case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> j \\<le> LTP rho (\\<tau> rho i + n)\"\n    using i_ltp_to_tau[of rho j]\n    apply (auto split: enat.splits)\n    by (smt (verit, ccfv_SIG) \\<tau>_mono add_diff_cancel_left' enat_ord_simps(1) i0 i_ltp_to_tau j(1) j(3) le_add1 le_add_diff_inverse2 le_diff_conv2 le_trans)\n  moreover\n  {fix k\n    assume k_def: \"k \\<in> {(max i (ETP rho (\\<tau> rho i + left I))) ..< j}\"\n    then have ki: \"\\<tau> rho k \\<ge> \\<tau> rho i + left I\" using i_etp_to_tau by auto\n    with k_def have kj: \"k < j\" by auto\n    then have \"\\<tau> rho k \\<le> \\<tau> rho j\" by auto\n    then have \"delta rho k i \\<le> delta rho j i\" by auto\n    with this j(3) have \"enat (delta rho k i) \\<le> right I\"\n      by (meson enat_ord_simps(1) order_subst2)\n    with this ki j(3) have mem_k: \"mem (delta rho k i) I\"\n      unfolding ETP_def by (auto simp: Least_le)\n\n    with j_def have \"j \\<le> jmax\" using Min_in[of A]\n      using jmax A_def\n      by (metis (mono_tags, lifting) Collect_empty_eq\n          finite_nat_set_iff_bounded_le mem_Collect_eq order_refl)\n    with this k_def have kjm: \"k \\<le> jmax\" by auto\n\n    with this mem_k ki Min_le[of A k] min_not_in[of A k] k_def have \"k \\<notin> A\"\n      unfolding j_def[symmetric] unfolding A_def unfolding ETP_def\n      using finite_nat_set_iff_bounded_le kj by blast\n    with this mem_k k_def kjm have \"\\<not> sat rho k psi\"\n      by (simp add: A_def)}\n  ultimately show ?thesis using unsat\n    by (auto split: enat.splits dest!: spec[of _ j])\nqed\n\ncontext fixes rho:: \"'a trace\"\nbegin\n\n(* Abbreviations for readability *)\nabbreviation \"l i I \\<equiv> min i (LTP rho ((\\<tau> rho i) - left I))\"\nabbreviation \"lu i I \\<equiv> max i (ETP rho ((\\<tau> rho i) + left I))\"\n\ninductive bounded_future where\n  TTBF: \"bounded_future TT\"\n| FFBF: \"bounded_future FF\"\n| AtomBF: \"bounded_future (Atom n)\"\n| DisjBF: \"bounded_future phi \\<Longrightarrow> bounded_future psi\n\\<Longrightarrow> bounded_future (Disj phi psi)\"\n| ConjBF: \"bounded_future phi \\<Longrightarrow> bounded_future psi\n\\<Longrightarrow> bounded_future (Conj phi psi)\"\n| ImplBF: \"bounded_future phi \\<Longrightarrow> bounded_future psi\n\\<Longrightarrow> bounded_future (Impl phi psi)\"\n| IffBF: \"bounded_future phi \\<Longrightarrow> bounded_future psi\n\\<Longrightarrow> bounded_future (Iff phi psi)\"\n| NegBF:  \"bounded_future phi \\<Longrightarrow> bounded_future (Neg phi)\"\n| NextBF: \"bounded_future phi \\<Longrightarrow> bounded_future (Next I phi)\"\n| PrevBF: \"bounded_future phi \\<Longrightarrow> bounded_future (Prev I phi)\"\n| OnceBF: \"bounded_future phi \\<Longrightarrow> bounded_future (Once I phi)\"\n| HistoricallyBF: \"bounded_future phi \\<Longrightarrow> bounded_future (Historically I phi)\"\n| EventuallyBF: \"right I \\<noteq> \\<infinity> \\<Longrightarrow> bounded_future phi \\<Longrightarrow> bounded_future (Eventually I phi)\"\n| AlwaysBF: \"right I \\<noteq> \\<infinity> \\<Longrightarrow> bounded_future phi \\<Longrightarrow> bounded_future (Always I phi)\"\n| SinceBF: \"bounded_future phi \\<Longrightarrow> bounded_future psi\n\\<Longrightarrow> bounded_future (Since phi I psi)\"\n| UntilBF: \"right I \\<noteq> \\<infinity> \\<Longrightarrow> bounded_future phi \\<Longrightarrow> bounded_future psi\n\\<Longrightarrow> bounded_future (Until phi I psi)\"\n\nlemma bounded_future_simps[simp]:\n  shows\n    \"bounded_future TT \\<longleftrightarrow> True\" \"bounded_future FF \\<longleftrightarrow> True\"\n    \"bounded_future (Atom n) \\<longleftrightarrow> True\"\n    \"bounded_future (Disj phi psi) \\<longleftrightarrow> bounded_future phi \\<and> bounded_future psi\"\n    \"bounded_future (Conj phi psi) \\<longleftrightarrow> bounded_future phi \\<and> bounded_future psi\"\n    \"bounded_future (Impl phi psi) \\<longleftrightarrow> bounded_future phi \\<and> bounded_future psi\"\n    \"bounded_future (Iff phi psi) \\<longleftrightarrow> bounded_future phi \\<and> bounded_future psi\"\n    \"bounded_future (Neg phi) \\<longleftrightarrow> bounded_future phi\"\n    \"bounded_future (Next I phi) \\<longleftrightarrow> bounded_future phi\"\n    \"bounded_future (Prev I phi) \\<longleftrightarrow> bounded_future phi\"\n    \"bounded_future (Once I phi) \\<longleftrightarrow> bounded_future phi\"\n    \"bounded_future (Historically I phi) \\<longleftrightarrow> bounded_future phi\"\n    \"bounded_future (Eventually I phi) \\<longleftrightarrow> bounded_future phi \\<and> right I \\<noteq> \\<infinity>\"\n    \"bounded_future (Always I phi) \\<longleftrightarrow> bounded_future phi \\<and> right I \\<noteq> \\<infinity>\"\n    \"bounded_future (Since phi I psi) \\<longleftrightarrow> bounded_future phi \\<and> bounded_future psi\"\n    \"bounded_future (Until phi I psi) \\<longleftrightarrow> bounded_future phi \\<and> bounded_future psi \\<and> right I \\<noteq> \\<infinity>\"\n  by (auto intro: bounded_future.intros elim: bounded_future.cases)\n\ninductive SAT and VIO where\n  STT: \"SAT i TT\"\n| VFF: \"VIO i FF\"\n| SP: \"n \\<in> \\<Gamma> rho i  \\<Longrightarrow> SAT i (Atom n)\"\n| VP: \"n \\<notin> \\<Gamma> rho i  \\<Longrightarrow> VIO i (Atom n)\"\n| SDisjL: \"SAT i phi \\<Longrightarrow> SAT i (Disj phi psi)\"\n| SDisjR: \"SAT i psi \\<Longrightarrow> SAT i (Disj phi psi)\"\n| VDisj: \"VIO i phi \\<Longrightarrow> VIO i psi \\<Longrightarrow> VIO i (Disj phi psi)\"\n| SConj: \"SAT i phi \\<Longrightarrow> SAT i psi \\<Longrightarrow> SAT i (Conj phi psi)\"\n| VConjL: \"VIO i phi \\<Longrightarrow> VIO i (Conj phi psi)\"\n| VConjR: \"VIO i psi \\<Longrightarrow> VIO i (Conj phi psi)\"\n| SNeg: \"VIO i phi \\<Longrightarrow> SAT i (Neg phi)\"\n| VNeg: \"SAT i phi \\<Longrightarrow> VIO i (Neg phi)\"\n| SImplL: \"VIO i phi \\<Longrightarrow> SAT i (Impl phi psi)\"\n| SImplR: \"SAT i psi \\<Longrightarrow> SAT i (Impl phi psi)\"\n| VImpl: \"SAT i phi \\<Longrightarrow> VIO i psi \\<Longrightarrow> VIO i (Impl phi psi)\"\n| SIff_ss: \"SAT i phi \\<Longrightarrow> SAT i psi \\<Longrightarrow> SAT i (Iff phi psi)\"\n| SIff_vv: \"VIO i phi \\<Longrightarrow> VIO i psi \\<Longrightarrow> SAT i (Iff phi psi)\"\n| VIff_sv: \"SAT i phi \\<Longrightarrow> VIO i psi \\<Longrightarrow> VIO i (Iff phi psi)\"\n| VIff_vs: \"VIO i phi \\<Longrightarrow> SAT i psi \\<Longrightarrow> VIO i (Iff phi psi)\"\n| SNext: \"mem (\\<Delta> rho (i+1)) I \\<Longrightarrow> SAT (i+1) phi \\<Longrightarrow> SAT i (Next I phi)\"\n| VNext: \"VIO (i+1) phi \\<Longrightarrow> VIO i (Next I phi)\"\n| VNext_le: \"(\\<Delta> rho (i+1)) < (left I) \\<Longrightarrow> VIO i (Next I phi)\"\n| VNext_ge: \"enat (\\<Delta> rho (i+1)) > (right I) \\<Longrightarrow> VIO i (Next I phi)\"\n| SPrev: \"i > 0 \\<Longrightarrow> mem (\\<Delta> rho i) I \\<Longrightarrow> SAT (i-1) phi \\<Longrightarrow> SAT i (Prev I phi)\"\n| VPrev: \"i > 0 \\<Longrightarrow> VIO (i-1) phi \\<Longrightarrow> VIO i (Prev I phi)\"\n| VPrev_zero: \"i = 0 \\<Longrightarrow> VIO i (Prev I phi)\"\n| VPrev_le: \"i > 0 \\<Longrightarrow> (\\<Delta> rho i) < (left I) \\<Longrightarrow> VIO i (Prev I phi)\"\n| VPrev_ge: \"i > 0 \\<Longrightarrow> enat (\\<Delta> rho i) > (right I) \\<Longrightarrow> VIO i (Prev I phi)\"\n| SOnce: \"j \\<le> i \\<Longrightarrow> mem (delta rho i j) I  \\<Longrightarrow> SAT j phi \\<Longrightarrow> SAT i (Once I phi)\"\n| VOnce_le: \"\\<tau> rho i < \\<tau> rho 0 + left I \\<Longrightarrow> VIO i (Once I phi)\"\n| VOnce: \"j = (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho ((\\<tau> rho i) - n)) \\<Longrightarrow>\n (\\<tau> rho i) \\<ge> (\\<tau> rho 0) + left I \\<Longrightarrow>\n(\\<And>k. k \\<in> {j .. l i I} \\<Longrightarrow> VIO k phi) \\<Longrightarrow> VIO i (Once I phi)\"\n| SHistorically: \"j = (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho ((\\<tau> rho i) - n)) \\<Longrightarrow>\n (\\<tau> rho i) \\<ge> (\\<tau> rho 0) + left I \\<Longrightarrow>\n(\\<And>k. k \\<in> {j .. l i I} \\<Longrightarrow> SAT k phi) \\<Longrightarrow> SAT i (Historically I phi)\"\n| SHistorically_le: \"\\<tau> rho i < \\<tau> rho 0 + left I \\<Longrightarrow> SAT i (Historically I phi)\"\n| VHistorically: \"j \\<le> i \\<Longrightarrow> mem (delta rho i j) I  \\<Longrightarrow> VIO j phi \\<Longrightarrow> VIO i (Historically I phi)\"\n| SEventually: \"j \\<ge> i \\<Longrightarrow> mem (delta rho j i) I  \\<Longrightarrow> SAT j phi \\<Longrightarrow> SAT i (Eventually I phi)\"\n| VEventually: \"(\\<And>k. k \\<in> (case right I of \\<infinity> \\<Rightarrow> {lu i I ..} | enat n \\<Rightarrow> {lu i I .. LTP rho ((\\<tau> rho i) + n)}) \\<Longrightarrow> VIO k phi)\n\\<Longrightarrow> VIO i (Eventually I phi)\"\n| SAlways: \"(\\<And>k. k \\<in> (case right I of \\<infinity> \\<Rightarrow> {lu i I ..} | enat n \\<Rightarrow> {lu i I .. LTP rho ((\\<tau> rho i) + n)}) \\<Longrightarrow> SAT k phi)\n\\<Longrightarrow> SAT i (Always I phi)\"\n| VAlways: \"j \\<ge> i \\<Longrightarrow> mem (delta rho j i) I  \\<Longrightarrow> VIO j phi \\<Longrightarrow> VIO i (Always I phi)\"\n| SSince: \"j \\<le> i \\<Longrightarrow> mem (delta rho i j) I  \\<Longrightarrow> SAT j psi \\<Longrightarrow> (\\<And>k. k \\<in> {j <.. i}\n\\<Longrightarrow> SAT k phi) \\<Longrightarrow> SAT i (Since phi I psi)\"\n| VSince_le: \"\\<tau> rho i < \\<tau> rho 0 + left I \\<Longrightarrow> VIO i (Since phi I psi)\"\n| VSince: \"(case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> ETP rho ((\\<tau> rho i) - n) \\<le> j)\n\\<Longrightarrow> j \\<le> i \\<Longrightarrow> (\\<tau> rho 0) + left I \\<le> (\\<tau> rho i) \\<Longrightarrow> VIO j phi\n\\<Longrightarrow> (\\<And>k. k \\<in> {j .. l i I} \\<Longrightarrow> VIO k psi) \\<Longrightarrow> VIO i (Since phi I psi)\"\n| VSince_never: \"j = (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho ((\\<tau> rho i) - n)) \\<Longrightarrow>\n (\\<tau> rho i) \\<ge> (\\<tau> rho 0) + left I \\<Longrightarrow>\n(\\<And>k. k \\<in> {j .. l i I} \\<Longrightarrow> VIO k psi) \\<Longrightarrow> VIO i (Since phi I psi)\"\n| SUntil: \"j \\<ge> i \\<Longrightarrow> mem (delta rho j i) I  \\<Longrightarrow> SAT j psi \\<Longrightarrow> (\\<And>k. k \\<in> {i ..< j} \\<Longrightarrow> SAT k phi)\n\\<Longrightarrow> SAT i (Until phi I psi)\"\n| VUntil: \"(case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> j \\<le> LTP rho ((\\<tau> rho i) + n)) \\<Longrightarrow> j \\<ge> i\n\\<Longrightarrow> VIO j phi \\<Longrightarrow> (\\<And>k. k \\<in> {lu i I .. j} \\<Longrightarrow> VIO k psi) \\<Longrightarrow> VIO i (Until phi I psi)\"\n| VUntil_never: \"(\\<And>k. k \\<in> (case right I of \\<infinity> \\<Rightarrow> {lu i I ..} | enat n \\<Rightarrow> {lu i I .. LTP rho ((\\<tau> rho i) + n)}) \\<Longrightarrow> VIO k psi)\n\\<Longrightarrow> VIO i (Until phi I psi)\"\n\nlemma completeness: \"\n(sat rho i phi \\<longrightarrow> SAT i phi) \\<and> (\\<not> sat rho i phi \\<longrightarrow> VIO i phi)\"\nproof (induct phi arbitrary: i)\n  case (Prev I phi)\n  show ?case using  local.Prev\n    by (auto intro: SAT_VIO.SPrev SAT_VIO.VPrev SAT_VIO.VPrev_le SAT_VIO.VPrev_ge SAT_VIO.VPrev_zero split: nat.splits)\nnext\n  case (Once I phi)\n  {assume \"sat rho i (Once I phi)\"\n    then have \"SAT i (Once I phi)\"\n      using SAT_VIO.SOnce local.Once\n      by auto}\n  moreover\n  {assume i_l: \"\\<tau> rho i < \\<tau> rho 0 + left I\"\n    then have \"VIO i (Once I phi)\"\n      using SAT_VIO.VOnce_le local.Once\n      by auto}\n  moreover\n  {assume unsat: \"\\<not> sat rho i (Once I phi)\"\n      and i_ge: \"\\<tau> rho 0 + left I \\<le> \\<tau> rho i\"\n    then have \"VIO i (Once I phi)\"\n      using local.Once\n      by (auto intro!: SAT_VIO.VOnce simp: i_ltp_to_tau i_etp_to_tau\n          split: enat.splits)}\n  ultimately show ?case\n    by force\nnext\n  case (Historically I phi)\n  from \\<tau>_mono have i0: \"\\<tau> rho 0 \\<le> \\<tau> rho i\" by auto\n  {assume sat: \"sat rho i (Historically I phi)\"\n      and i_ge: \"\\<tau> rho i \\<ge> \\<tau> rho 0 + left I\"\n    then have \"SAT i (Historically I phi)\"\n      using local.Historically le_diff_conv\n      by (auto intro!: SAT_VIO.SHistorically simp: i_ltp_to_tau i_etp_to_tau\n          split: enat.splits)}\n  moreover\n  {assume \"\\<not> sat rho i (Historically I phi)\"\n    then have \"VIO i (Historically I phi)\"\n      using SAT_VIO.VHistorically local.Historically\n      by auto}\n  moreover\n  {assume i_l: \"\\<tau> rho i < \\<tau> rho 0 + left I\"\n    then have \"SAT i (Historically I phi)\"\n      using SAT_VIO.SHistorically_le local.Historically\n      by auto}\n  ultimately show ?case\n    by force\nnext\n  case (Eventually I phi)\n  from \\<tau>_mono have i0: \"\\<tau> rho 0 \\<le> \\<tau> rho i\" by auto\n  {assume \"sat rho i (Eventually I phi)\"\n    then have \"SAT i (Eventually I phi)\"\n      using SAT_VIO.SEventually local.Eventually\n      by auto}\n  moreover\n  {assume unsat: \"\\<not> sat rho i (Eventually I phi)\"\n    then have \"VIO i (Eventually I phi)\"\n      using local.Eventually\n      by (auto intro!: SAT_VIO.VEventually simp: add_increasing2 i0 i_ltp_to_tau i_etp_to_tau\n          split: enat.splits)}\n  ultimately show ?case by auto\nnext\n  case (Always I phi)\n    from \\<tau>_mono have i0: \"\\<tau> rho 0 \\<le> \\<tau> rho i\" by auto\n  {assume \"\\<not> sat rho i (Always I phi)\"\n    then have \"VIO i (Always I phi)\"\n      using SAT_VIO.VAlways local.Always\n      by auto}\n  moreover\n  {assume sat: \"sat rho i (Always I phi)\"\n    then have \"SAT i (Always I phi)\"\n      using local.Always\n      by (auto intro!: SAT_VIO.SAlways simp: add_increasing2 i0 i_ltp_to_tau i_etp_to_tau le_diff_conv split: enat.splits)}\n  ultimately show ?case by auto\nnext\n  case (Since phi I psi)\n  {assume \"sat rho i (Since phi I psi)\"\n    then have \"SAT i (Since phi I psi)\"\n      using SAT_VIO.SSince local.Since\n      by auto}\n  moreover\n  {assume i_l: \"\\<tau> rho i < \\<tau> rho 0 + left I\"\n    then have \"VIO i (Since phi I psi)\"\n      using SAT_VIO.VSince_le local.Since\n      by auto}\n  moreover\n  {assume unsat: \"\\<not> sat rho i (Since phi I psi)\"\n      and nw: \"\\<forall>j\\<le>i. \\<not> mem (delta rho i j) I \\<or> \\<not> sat rho j psi\"\n      and i_ge: \"\\<tau> rho 0 + left I \\<le> \\<tau> rho i\"\n    then have \"VIO i (Since phi I psi)\"\n      using local.Since\n      by (auto intro!: SAT_VIO.VSince_never simp: i_ltp_to_tau i_etp_to_tau\n          split: enat.splits)}\n  moreover\n  {assume unsat: \"\\<not> sat rho i (Since phi I psi)\"\n      and jw: \"\\<exists>j\\<le>i. mem (delta rho i j) I \\<and> sat rho j psi\"\n      and i_ge: \"\\<tau> rho 0 + left I \\<le> \\<tau> rho i\"\n    from unsat jw not_sat_SinceD[of rho i phi I psi]\n    obtain j where j: \"j \\<le> i\"\n      \"case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n) \\<le> j\"\n      \"\\<not> sat rho j phi\" \"(\\<forall>k \\<in> {j .. (min i (LTP rho (\\<tau> rho i - left I)))}.\n      \\<not> sat rho k psi)\" by (auto split: enat.splits)\n    then have \"VIO i (Since phi I psi)\"\n      using i_ge unsat jw SAT_VIO.VSince local.Since\n      by auto}\n  ultimately show ?case\n    by (force simp del: sat.simps)\nnext\n  case (Until phi I psi)\n  from \\<tau>_mono have i0: \"\\<tau> rho 0 \\<le> \\<tau> rho i\" by auto\n  {assume \"sat rho i (Until phi I psi)\"\n    then have \"SAT i (Until phi I psi)\"\n      using SAT_VIO.SUntil local.Until\n      by auto}\n  moreover\n  {assume unsat: \"\\<not> sat rho i (Until phi I psi)\"\n      and witness: \"\\<exists>j \\<ge> i. mem (delta rho j i) I \\<and> sat rho j psi\"\n    from this local.Until not_sat_UntilD[of rho i phi I psi] obtain j\n      where j: \"j \\<ge> i\" \"(case right I of \\<infinity> \\<Rightarrow> True | enat n\n      \\<Rightarrow> j \\<le> LTP rho (\\<tau> rho i + n))\" \"\\<not> (sat rho j phi)\"\n        \"(\\<forall>k \\<in> {(max i (ETP rho (\\<tau> rho i + left I))) .. j}. \\<not> sat rho k psi)\"\n      by auto\n    then have \"VIO i (Until phi I psi)\"\n      using unsat witness SAT_VIO.VUntil local.Until\n      by auto}\n  moreover\n  {assume unsat: \"\\<not> sat rho i (Until phi I psi)\"\n      and no_witness: \"\\<forall>j \\<ge> i. \\<not> mem (delta rho j i) I \\<or> \\<not> sat rho j psi\"\n    then have \"VIO i (Until phi I psi)\"\n      using local.Until\n      by (auto intro!: SAT_VIO.VUntil_never simp: add_increasing2 i0 i_ltp_to_tau i_etp_to_tau\n          split: enat.splits)\n  }\n  ultimately show ?case by auto\nqed(auto intro: SAT_VIO.intros)\n\n\n\nend\n\ndatatype 'a sproof = STT nat | SAtm 'a nat | SNeg \"'a vproof\" | SDisjL \"'a sproof\" | SDisjR \"'a sproof\"\n  | SConj \"'a sproof\" \"'a sproof\" | SImplR \"'a sproof\" | SImplL \"'a vproof\"\n  | SIff_ss \"'a sproof\" \"'a sproof\" | SIff_vv \"'a vproof\" \"'a vproof\" | SOnce nat \"'a sproof\"\n  | SEventually nat \"'a sproof\" | SHistorically nat nat \"'a sproof list\" | SHistorically_le nat\n  | SAlways nat nat \"'a sproof list\"\n  | SSince \"'a sproof\" \"'a sproof list\" | SUntil \"'a sproof list\" \"'a sproof\" | SNext \"'a sproof\"\n  | SPrev \"'a sproof\"\n    and 'a vproof = VFF nat | VAtm 'a nat | VNeg \"'a sproof\" | VDisj \"'a vproof\" \"'a vproof\"\n  | VConjL \"'a vproof\" | VConjR \"'a vproof\" | VImpl \"'a sproof\" \"'a vproof\"\n  | VIff_sv \"'a sproof\" \"'a vproof\" | VIff_vs \"'a vproof\" \"'a sproof\" \n  | VOnce_le nat | VOnce nat nat \"'a vproof list\" | VEventually nat nat \"'a vproof list\"\n  | VHistorically nat \"'a vproof\" | VAlways nat \"'a vproof\"\n  | VSince nat \"'a vproof\" \"'a vproof list\" | VUntil nat \"'a vproof list\" \"'a vproof\"\n  | VSince_never nat nat \"'a vproof list\" | VUntil_never nat nat \"'a vproof list\" | VSince_le nat\n  | VNext \"'a vproof\" | VNext_ge nat | VNext_le nat | VPrev \"'a vproof\" | VPrev_ge nat | VPrev_le nat\n  | VPrev_zero\n\n\ncontext fixes compa :: \"'a \\<Rightarrow> 'b \\<Rightarrow> order\" begin\nfun comparator_list' :: \"'a list \\<Rightarrow> 'b list \\<Rightarrow> order\" where\n  \"comparator_list' [] [] = Eq\"\n| \"comparator_list' [] (y # ys) = Lt\"\n| \"comparator_list' (x # xs) [] = Gt\"\n| \"comparator_list' (x # xs) (y # ys) = (case compa x y of Eq \\<Rightarrow> comparator_list' xs ys | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\"\nend\n\ninstantiation sproof and vproof :: (ccompare) ccompare begin\n\nprimrec comparator_sproof :: \"('a \\<Rightarrow> 'b \\<Rightarrow> order) \\<Rightarrow> 'a sproof \\<Rightarrow> 'b sproof \\<Rightarrow> order\"\n  and comparator_vproof :: \"('a \\<Rightarrow> 'b \\<Rightarrow> order) \\<Rightarrow> 'a vproof \\<Rightarrow> 'b vproof \\<Rightarrow> order\" where\n  \"comparator_sproof compa (STT i) rhs =\n    (case rhs of\n      STT j \\<Rightarrow> comparator_of i j\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SAtm p i) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm q j \\<Rightarrow> (case compa p q of Eq \\<Rightarrow> comparator_of i j | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SNeg vp) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg vp' \\<Rightarrow> comparator_vproof compa vp vp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SDisjL sp) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL sp' \\<Rightarrow> comparator_sproof compa sp sp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SDisjR sp) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR sp' \\<Rightarrow> comparator_sproof compa sp sp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SConj sp1 sp2) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj sp1' sp2' \\<Rightarrow> (case comparator_sproof compa sp1 sp1' of Eq \\<Rightarrow> comparator_sproof compa sp2 sp2' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SImplR sp) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR sp' \\<Rightarrow> comparator_sproof compa sp sp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SImplL vp) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL vp' \\<Rightarrow> comparator_vproof compa vp vp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SIff_ss sp1 sp2) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss sp1' sp2' \\<Rightarrow> (case comparator_sproof compa sp1 sp1' of Eq \\<Rightarrow> comparator_sproof compa sp2 sp2' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SIff_vv vp1 vp2) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss _ _ \\<Rightarrow> Gt\n    | SIff_vv vp1' vp2' \\<Rightarrow> (case comparator_vproof compa vp1 vp1' of Eq \\<Rightarrow> comparator_vproof compa vp2 vp2' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SOnce i sp) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss _ _ \\<Rightarrow> Gt\n    | SIff_vv _ _ \\<Rightarrow> Gt\n    | SOnce i' sp' \\<Rightarrow> (case comparator_of i i' of Eq \\<Rightarrow> comparator_sproof compa sp sp' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SEventually i sp) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss _ _ \\<Rightarrow> Gt\n    | SIff_vv _ _ \\<Rightarrow> Gt\n    | SOnce _ _ \\<Rightarrow> Gt\n    | SEventually i' sp' \\<Rightarrow> (case comparator_of i i' of Eq \\<Rightarrow> comparator_sproof compa sp sp' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SHistorically i t sps) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss _ _ \\<Rightarrow> Gt\n    | SIff_vv _ _ \\<Rightarrow> Gt\n    | SOnce _ _ \\<Rightarrow> Gt\n    | SEventually _ _ \\<Rightarrow> Gt\n    | SHistorically i' t' sps' \\<Rightarrow> (case comparator_of i i' of \n                                   Eq \\<Rightarrow> (case comparator_of t t' of Eq \\<Rightarrow> comparator_list' (\\<lambda>f x. f x) (map (comparator_sproof compa) sps) sps' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n                                 | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SHistorically_le i) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss _ _ \\<Rightarrow> Gt\n    | SIff_vv _ _ \\<Rightarrow> Gt\n    | SOnce _ _ \\<Rightarrow> Gt\n    | SEventually _ _ \\<Rightarrow> Gt\n    | SHistorically _ _ _ \\<Rightarrow> Gt\n    | SHistorically_le i' \\<Rightarrow> comparator_of i i'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SAlways i t sps) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss _ _ \\<Rightarrow> Gt\n    | SIff_vv _ _ \\<Rightarrow> Gt\n    | SOnce _ _ \\<Rightarrow> Gt\n    | SEventually _ _ \\<Rightarrow> Gt\n    | SHistorically _ _ _ \\<Rightarrow> Gt\n    | SHistorically_le _ \\<Rightarrow> Gt\n    | SAlways i' t' sps' \\<Rightarrow> (case comparator_of i i' of \n                                        Eq \\<Rightarrow> (case comparator_of t t' of Eq \\<Rightarrow> comparator_list' (\\<lambda>f x. f x) (map (comparator_sproof compa) sps) sps' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n                                      | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SSince sp2 sp1s) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss _ _ \\<Rightarrow> Gt\n    | SIff_vv _ _ \\<Rightarrow> Gt\n    | SOnce _ _ \\<Rightarrow> Gt\n    | SEventually _ _ \\<Rightarrow> Gt\n    | SHistorically _ _ _ \\<Rightarrow> Gt\n    | SHistorically_le _ \\<Rightarrow> Gt\n    | SAlways _ _ _ \\<Rightarrow> Gt\n    | SSince sp2' sp1s' \\<Rightarrow> (case comparator_sproof compa sp2 sp2' of \n                             Eq \\<Rightarrow> comparator_list' (\\<lambda>f x. f x) (map (comparator_sproof compa) sp1s) sp1s'\n                           | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SUntil sp1s sp2) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss _ _ \\<Rightarrow> Gt\n    | SIff_vv _ _ \\<Rightarrow> Gt\n    | SOnce _ _ \\<Rightarrow> Gt\n    | SEventually _ _ \\<Rightarrow> Gt\n    | SHistorically _ _ _ \\<Rightarrow> Gt\n    | SHistorically_le _ \\<Rightarrow> Gt\n    | SAlways _ _ _ \\<Rightarrow> Gt\n    | SSince _ _ \\<Rightarrow> Gt\n    | SUntil sp1s' sp2' \\<Rightarrow> (case comparator_sproof compa sp2 sp2' of \n                             Eq \\<Rightarrow> comparator_list' (\\<lambda>f x. f x) (map (comparator_sproof compa) sp1s) sp1s'\n                           | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SPrev sp) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss _ _ \\<Rightarrow> Gt\n    | SIff_vv _ _ \\<Rightarrow> Gt\n    | SOnce _ _ \\<Rightarrow> Gt\n    | SEventually _ _ \\<Rightarrow> Gt\n    | SHistorically _ _ _ \\<Rightarrow> Gt\n    | SHistorically_le _ \\<Rightarrow> Gt\n    | SAlways _ _ _ \\<Rightarrow> Gt\n    | SSince _ _ \\<Rightarrow> Gt\n    | SUntil _ _  \\<Rightarrow> Gt\n    | SPrev sp' \\<Rightarrow> comparator_sproof compa sp sp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_sproof compa (SNext sp) rhs =\n    (case rhs of\n      STT _ \\<Rightarrow> Gt\n    | SAtm _ _ \\<Rightarrow> Gt\n    | SNeg _ \\<Rightarrow> Gt\n    | SDisjL _ \\<Rightarrow> Gt\n    | SDisjR _ \\<Rightarrow> Gt\n    | SConj _ _ \\<Rightarrow> Gt\n    | SImplR _ \\<Rightarrow> Gt\n    | SImplL _ \\<Rightarrow> Gt\n    | SIff_ss _ _ \\<Rightarrow> Gt\n    | SIff_vv _ _ \\<Rightarrow> Gt\n    | SOnce _ _ \\<Rightarrow> Gt\n    | SEventually _ _ \\<Rightarrow> Gt\n    | SHistorically _ _ _ \\<Rightarrow> Gt\n    | SHistorically_le _ \\<Rightarrow> Gt\n    | SAlways _ _ _ \\<Rightarrow> Gt\n    | SSince _ _ \\<Rightarrow> Gt\n    | SUntil _ _  \\<Rightarrow> Gt\n    | SPrev _ \\<Rightarrow> Gt\n    | SNext sp' \\<Rightarrow> comparator_sproof compa sp sp')\"\n| \"comparator_vproof compa (VFF i) rhs =\n    (case rhs of\n      VFF j \\<Rightarrow> comparator_of i j\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VAtm p i) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm q j \\<Rightarrow> (case compa p q of Eq \\<Rightarrow> comparator_of i j | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VNeg sp) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg sp' \\<Rightarrow> comparator_sproof compa sp sp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VDisj vp1 vp2) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj vp1' vp2' \\<Rightarrow> (case comparator_vproof compa vp1 vp1' of Eq \\<Rightarrow> comparator_vproof compa vp2 vp2' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VConjL vp) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL vp' \\<Rightarrow> comparator_vproof compa vp vp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VConjR vp) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR vp' \\<Rightarrow> comparator_vproof compa vp vp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VImpl sp1 vp2) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl sp1' vp2' \\<Rightarrow> (case comparator_sproof compa sp1 sp1' of Eq \\<Rightarrow> comparator_vproof compa vp2 vp2' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VIff_sv sp1 vp2) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv sp1' vp2' \\<Rightarrow> (case comparator_sproof compa sp1 sp1' of Eq \\<Rightarrow> comparator_vproof compa vp2 vp2' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VIff_vs vp1 sp2) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs vp1' sp2' \\<Rightarrow> (case comparator_vproof compa vp1 vp1' of Eq \\<Rightarrow> comparator_sproof compa sp2 sp2' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VOnce_le i) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le i' \\<Rightarrow> comparator_of i i'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VOnce i t vps) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce i' t' vps' \\<Rightarrow> (case comparator_of i i' of \n                                   Eq \\<Rightarrow> (case comparator_of t t' of Eq \\<Rightarrow> comparator_list' (\\<lambda>f x. f x) (map (comparator_vproof compa) vps) vps' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n                                 | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VEventually i t vps) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually i' t' vps' \\<Rightarrow> (case comparator_of i i' of \n                                        Eq \\<Rightarrow> (case comparator_of t t' of Eq \\<Rightarrow> comparator_list' (\\<lambda>f x. f x) (map (comparator_vproof compa) vps) vps' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n                                      | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VHistorically i vp) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically i' vp' \\<Rightarrow> (case comparator_of i i' of Eq \\<Rightarrow> comparator_vproof compa vp vp' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VAlways i vp) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways i' vp' \\<Rightarrow> (case comparator_of i i' of Eq \\<Rightarrow> comparator_vproof compa vp vp' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VSince i vp1 vp2s) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince i' vp1' vp2s' \\<Rightarrow> (case comparator_of i i' of \n                                Eq \\<Rightarrow> (case comparator_vproof compa vp1 vp1' of\n                                        Eq \\<Rightarrow> comparator_list' (\\<lambda>f x. f x) (map (comparator_vproof compa) vp2s) vp2s'\n                                      | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n                              | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VUntil i vp2s vp1) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil i' vp2s' vp1' \\<Rightarrow> (case comparator_of i i' of \n                                Eq \\<Rightarrow> (case comparator_vproof compa vp1 vp1' of\n                                        Eq \\<Rightarrow> comparator_list' (\\<lambda>f x. f x) (map (comparator_vproof compa) vp2s) vp2s'\n                                      | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n                              | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VSince_never i t vp2s) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil _ _ _ \\<Rightarrow> Gt\n    | VSince_never i' t' vp2s' \\<Rightarrow> (case comparator_of i i' of \n                                   Eq \\<Rightarrow> (case comparator_of t t' of Eq \\<Rightarrow> comparator_list' (\\<lambda>f x. f x) (map (comparator_vproof compa) vp2s) vp2s' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n                                  | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VUntil_never i t vp2s) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil _ _ _ \\<Rightarrow> Gt\n    | VSince_never _ _ _ \\<Rightarrow> Gt\n    | VUntil_never i' t' vp2s' \\<Rightarrow> (case comparator_of i i' of \n                                   Eq \\<Rightarrow> (case comparator_of t t' of Eq \\<Rightarrow> comparator_list' (\\<lambda>f x. f x) (map (comparator_vproof compa) vp2s) vp2s' | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n                                 | Lt \\<Rightarrow> Lt | Gt \\<Rightarrow> Gt)\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VSince_le i) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil _ _ _ \\<Rightarrow> Gt\n    | VSince_never _ _ _ \\<Rightarrow> Gt\n    | VUntil_never _ _ _  \\<Rightarrow> Gt\n    | VSince_le i' \\<Rightarrow> comparator_of i i'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VNext vp) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil _ _ _ \\<Rightarrow> Gt\n    | VSince_never _ _ _ \\<Rightarrow> Gt\n    | VUntil_never _ _ _  \\<Rightarrow> Gt\n    | VSince_le _ \\<Rightarrow> Gt\n    | VNext vp' \\<Rightarrow> comparator_vproof compa vp vp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VNext_ge i) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil _ _ _ \\<Rightarrow> Gt\n    | VSince_never _ _ _ \\<Rightarrow> Gt\n    | VUntil_never _ _ _  \\<Rightarrow> Gt\n    | VSince_le _ \\<Rightarrow> Gt\n    | VNext _ \\<Rightarrow> Gt\n    | VNext_ge i' \\<Rightarrow> comparator_of i i'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VNext_le i) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil _ _ _ \\<Rightarrow> Gt\n    | VSince_never _ _ _ \\<Rightarrow> Gt\n    | VUntil_never _ _ _  \\<Rightarrow> Gt\n    | VSince_le _ \\<Rightarrow> Gt\n    | VNext _ \\<Rightarrow> Gt\n    | VNext_ge _ \\<Rightarrow> Gt\n    | VNext_le i' \\<Rightarrow> comparator_of i i'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VPrev vp) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil _ _ _ \\<Rightarrow> Gt\n    | VSince_never _ _ _ \\<Rightarrow> Gt\n    | VUntil_never _ _ _  \\<Rightarrow> Gt\n    | VSince_le _ \\<Rightarrow> Gt\n    | VNext _ \\<Rightarrow> Gt\n    | VNext_ge _ \\<Rightarrow> Gt\n    | VNext_le _ \\<Rightarrow> Gt\n    | VPrev vp' \\<Rightarrow> comparator_vproof compa vp vp'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VPrev_ge i) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil _ _ _ \\<Rightarrow> Gt\n    | VSince_never _ _ _ \\<Rightarrow> Gt\n    | VUntil_never _ _ _  \\<Rightarrow> Gt\n    | VSince_le _ \\<Rightarrow> Gt\n    | VNext _ \\<Rightarrow> Gt\n    | VNext_ge _ \\<Rightarrow> Gt\n    | VNext_le _ \\<Rightarrow> Gt\n    | VPrev _ \\<Rightarrow> Gt\n    | VPrev_ge i' \\<Rightarrow> comparator_of i i'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa (VPrev_le i) rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil _ _ _ \\<Rightarrow> Gt\n    | VSince_never _ _ _ \\<Rightarrow> Gt\n    | VUntil_never _ _ _  \\<Rightarrow> Gt\n    | VSince_le _ \\<Rightarrow> Gt\n    | VNext _ \\<Rightarrow> Gt\n    | VNext_ge _ \\<Rightarrow> Gt\n    | VNext_le _ \\<Rightarrow> Gt\n    | VPrev _ \\<Rightarrow> Gt\n    | VPrev_ge _ \\<Rightarrow> Gt\n    | VPrev_le i' \\<Rightarrow> comparator_of i i'\n    | _ \\<Rightarrow> Lt)\"\n| \"comparator_vproof compa VPrev_zero rhs =\n    (case rhs of\n      VFF _ \\<Rightarrow> Gt\n    | VAtm _ _ \\<Rightarrow> Gt\n    | VNeg _ \\<Rightarrow> Gt\n    | VDisj _ _ \\<Rightarrow> Gt\n    | VConjL _ \\<Rightarrow> Gt\n    | VConjR _ \\<Rightarrow> Gt\n    | VImpl _ _ \\<Rightarrow> Gt\n    | VIff_sv _ _ \\<Rightarrow> Gt\n    | VIff_vs _ _ \\<Rightarrow> Gt\n    | VOnce_le _ \\<Rightarrow> Gt\n    | VOnce _ _ _ \\<Rightarrow> Gt\n    | VEventually _ _ _ \\<Rightarrow> Gt\n    | VHistorically _ _ \\<Rightarrow> Gt\n    | VAlways _ _ \\<Rightarrow> Gt\n    | VSince _ _ _ \\<Rightarrow> Gt\n    | VUntil _ _ _ \\<Rightarrow> Gt\n    | VSince_never _ _ _ \\<Rightarrow> Gt\n    | VUntil_never _ _ _  \\<Rightarrow> Gt\n    | VSince_le _ \\<Rightarrow> Gt\n    | VNext _ \\<Rightarrow> Gt\n    | VNext_ge _ \\<Rightarrow> Gt\n    | VNext_le _ \\<Rightarrow> Gt\n    | VPrev _ \\<Rightarrow> Gt\n    | VPrev_ge _ \\<Rightarrow> Gt\n    | VPrev_le _ \\<Rightarrow> Gt\n    | VPrev_zero \\<Rightarrow> Eq)\"\n\ndefinition \"ccompare_sproof = (case ID ccompare of None \\<Rightarrow> None | Some comp_'a \\<Rightarrow> Some (comparator_sproof comp_'a))\"\ndefinition \"ccompare_vproof = (case ID ccompare of None \\<Rightarrow> None | Some comp_'a \\<Rightarrow> Some (comparator_vproof comp_'a))\"\n\nlemma comparator_list'_map[simp]: \"comparator_list' (\\<lambda>f x. f x) (map f xs) ys = comparator_list f xs ys\"\n  by (induct xs ys rule: comparator_list'.induct[where compa = f]) (auto split: order.splits)\n\nlemma eq_Eq_comparator_proof:\n  assumes \"ID ccompare = Some compa\"\n  shows \"comparator_sproof compa sp sp' = Eq \\<longleftrightarrow> sp = sp'\"\n    \"comparator_vproof compa vp vp' = Eq \\<longleftrightarrow> vp = vp'\"\n   apply (induct sp and vp arbitrary: sp' and vp')\n                      apply (simp_all add:  comparator_list_pointwise(1)[unfolded peq_comp_def, rule_format] comparator_of_def\n      comparator.eq_Eq_conv[OF ID_ccompare'[OF assms]]\n      comparator.Lt_lt_conv[OF ID_ccompare'[OF assms]]\n      comparator.Gt_lt_conv[OF ID_ccompare'[OF assms]]\n      split: sproof.splits vproof.splits order.splits if_splits)\n              apply auto[1]\n               apply (metis Comparator.comparator.Gt_lt_conv Comparator.comparator.Lt_lt_conv Comparator.order.simps(6) ID_ccompare' assms)\n              apply (metis Comparator.comparator.Gt_lt_conv Comparator.comparator.Lt_lt_conv Comparator.order.simps(6) ID_ccompare' assms)\n             apply (metis order.simps(2,4))+\n        apply (metis Comparator.comparator.Gt_lt_conv Comparator.comparator.Lt_lt_conv Comparator.order.simps(6) ID_code assms ccompare)\n       apply (metis Comparator.order.distinct(1) Comparator.order.distinct(3))\n      apply (metis order.simps(2,4))+\n  done\n\nlemma trans_order_equal[simp]:\n  \"trans_order Eq b b\"\n  \"trans_order b Eq b\"\n  by (intro trans_orderI, auto)+\n\ndeclare trans_order_different[simp]\n\nlemma invert_order_comparator_proof:\n  assumes \"ID ccompare = Some compa\"\n  shows \"invert_order (comparator_sproof compa sp sp') = comparator_sproof compa sp' sp\"\n    \"invert_order (comparator_vproof compa vp vp') = comparator_vproof compa vp' vp\"\n   apply (induct sp and vp arbitrary: sp' and vp')\n                      apply (simp_all add: comparator_of_def comparator_list_pointwise(2)[unfolded psym_comp_def, rule_format] split: sproof.splits vproof.splits order.splits)\n              apply (metis comparator.eq_Eq_conv comparator.nGt_le_conv comparator.nLt_le_conv order.simps(6) ID_ccompare' assms)\n             apply (metis invert_order.simps order.simps(6))\n            apply (metis invert_order.simps order.simps(6))\n           apply (metis invert_order.simps order.simps(6))\n          apply (metis invert_order.simps order.simps(6))\n         apply (metis invert_order.simps order.simps(6))\n        apply (metis comparator.eq_Eq_conv comparator.nGt_le_conv comparator.nLt_le_conv order.simps(6) ID_ccompare' assms)\n       apply (metis invert_order.simps order.simps(6))\n      apply (metis invert_order.simps order.simps(6))\n     apply (metis invert_order.simps order.simps(6))\n    apply (metis invert_order.simps order.simps(6))\n   apply (metis invert_order.simps order.simps(6))\n  apply (metis invert_order.simps order.simps(6))\n  done\n\nlemma trans_comparator_proof:\n  assumes \"ID ccompare = Some compa\"\n  shows \"trans_order (comparator_sproof compa sp sp') (comparator_sproof compa sp' sp'') (comparator_sproof compa sp sp'')\"\n    \"trans_order (comparator_vproof compa vp vp') (comparator_vproof compa vp' vp'') (comparator_vproof compa vp vp'')\"\nproof (induct sp and vp arbitrary: sp' sp'' and vp' vp'')\n  case (STT x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (SAtm x1 x2)\n  then show ?case\n    apply (simp add: comparator_of_def comparator.comp_same[OF ID_ccompare'[OF assms]]\n        comparator.eq_Eq_conv[OF ID_ccompare'[OF assms]] split: sproof.splits vproof.splits order.splits if_splits)\n    by safe\n      (metis Comparator.invert_order.simps(1) Comparator.order.simps(6) ID_code assms ccompare comparator_def)+\nnext\n  case (SNeg x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (SDisjL x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (SDisjR x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (SConj x1 x2)\n  then show ?case\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.distinct(3) order.simps(2) trans_order_def)\n    done\nnext\n  case (SImplR x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (SImplL x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (SIff_ss x1 x2)\n  then show ?case\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.distinct(3) order.simps(2) trans_order_def)\n    done\nnext\n  case (SIff_vv x1 x2)\n  then show ?case\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.distinct(3) order.simps(2) trans_order_def)\n    done\nnext\n  case (SOnce x1 x2)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (SEventually x1 x2)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (SHistorically_le x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (SHistorically x1 x2 x3)\n  then show ?case\n    using comparator_list_pointwise(3)[unfolded ptrans_comp_def, of _ \"comparator_sproof compa\"]\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\ncase (SAlways x1 x2 x3)\n  then show ?case\n    using comparator_list_pointwise(3)[unfolded ptrans_comp_def, of _ \"comparator_sproof compa\"]\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (SSince x1 x2)\n  then show ?case\n    using comparator_list_pointwise(3)[unfolded ptrans_comp_def, of _ \"comparator_sproof compa\"]\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.simps(2) order.simps(4) trans_order_def)\n    done\nnext\n  case (SUntil x1 x2)\n  then show ?case\n    using comparator_list_pointwise(3)[unfolded ptrans_comp_def, of _ \"comparator_sproof compa\"]\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.simps(2) order.simps(4) trans_order_def)\n    done\nnext\n  case (SNext x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits order.splits if_splits)\nnext\n  case (SPrev x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits order.splits if_splits)\nnext\n  case (VFF x)\n  then show ?case\n    by (simp add: comparator_of_def split: vproof.splits order.splits if_splits)\nnext\n  case (VAtm x1 x2)\n  then show ?case\n    apply (simp add: comparator_of_def comparator.comp_same[OF ID_ccompare'[OF assms]]\n        comparator.eq_Eq_conv[OF ID_ccompare'[OF assms]] split: sproof.splits vproof.splits order.splits if_splits)\n    by safe\n      (metis Comparator.invert_order.simps(1) Comparator.order.simps(6) ID_code assms ccompare comparator_def)+\nnext\n  case (VNeg x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (VDisj x1 x2)\n  then show ?case\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.simps(2) order.simps(4) trans_order_def)\n    done\nnext\n  case (VConjL x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (VConjR x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (VImpl x1 x2)\n  then show ?case\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.simps(2) order.simps(4) trans_order_def)\n    done\nnext\n  case (VIff_sv x1 x2)\n  then show ?case\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.simps(2) order.simps(4) trans_order_def)\n    done\nnext\n  case (VIff_vs x1 x2)\n  then show ?case\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.simps(2) order.simps(4) trans_order_def)\n    done\nnext\n  case (VOnce_le x)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (VOnce x1 x2 x3)\n  then show ?case\n    using comparator_list_pointwise(3)[unfolded ptrans_comp_def, of _ \"comparator_vproof compa\"]\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (VEventually x1 x2 x3)\n  then show ?case\n    using comparator_list_pointwise(3)[unfolded ptrans_comp_def, of _ \"comparator_vproof compa\"]\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (VHistorically x1 x2)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (VAlways x1 x2)\n  then show ?case\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (VSince x1 x2 x3)\n  then show ?case\n    using comparator_list_pointwise(3)[unfolded ptrans_comp_def, of _ \"comparator_vproof compa\"]\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.simps(2) order.simps(4) trans_order_def)\n    done\nnext\n  case (VUntil x1 x2 x3)\n  then show ?case\n    using comparator_list_pointwise(3)[unfolded ptrans_comp_def, of _ \"comparator_vproof compa\"]\n    apply (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\n    apply (smt (verit, del_insts) order.simps(2) order.simps(4) trans_order_def)\n    done\nnext\n  case (VSince_never x1 x2 x3)\n  then show ?case\n    using comparator_list_pointwise(3)[unfolded ptrans_comp_def, of _ \"comparator_vproof compa\"]\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (VUntil_never x1 x2 x3)\n  then show ?case\n    using comparator_list_pointwise(3)[unfolded ptrans_comp_def, of _ \"comparator_vproof compa\"]\n    by (simp add: comparator_of_def split: sproof.splits vproof.splits order.splits if_splits)\nnext\n  case (VSince_le x)\n  then show ?case\n    by (simp add: comparator_of_def split: vproof.splits order.splits if_splits)\nnext\n  case (VNext x)\n  then show ?case\n    by (simp add: comparator_of_def split: vproof.splits order.splits if_splits)\nnext\n  case (VNext_ge x)\n  then show ?case\n    by (simp add: comparator_of_def split: vproof.splits order.splits if_splits)\nnext\n  case (VNext_le x)\n  then show ?case\n    by (simp add: comparator_of_def split: vproof.splits order.splits if_splits)\nnext\n  case (VPrev x)\n  then show ?case \n    by (simp add: comparator_of_def split: vproof.splits order.splits if_splits)\nnext\n  case (VPrev_ge x)\n  then show ?case \n    by (simp add: comparator_of_def split: vproof.splits order.splits if_splits)\nnext\n  case (VPrev_le x)\n  then show ?case\n    by (simp add: comparator_of_def split: vproof.splits order.splits if_splits)\nnext\n  case VPrev_zero\n  then show ?case\n    by (simp add: comparator_of_def split: vproof.splits order.splits if_splits)\nqed\n\ninstance\n   apply standard\n   apply (force simp add: ccompare_sproof_def ccompare_vproof_def comparator_def\n      eq_Eq_comparator_proof invert_order_comparator_proof intro: trans_comparator_proof[THEN trans_orderD(2)] split: option.splits)+\n  done\n\nend\n\nderive (eq) ceq sproof\nderive (rbt) set_impl sproof\nderive (eq) ceq vproof\nderive (rbt) set_impl vproof\n\nlemma neq_Nil_conv_snoc: \"(xs \\<noteq> []) = (\\<exists>y ys. xs = ys @ [y])\"\n  by (induct xs) auto\n\nlemma size_last_estimation[termination_simp]: \"xs \\<noteq> [] \\<Longrightarrow> size (last xs) < size_list size xs\"\n  by (induct xs) auto\n\n(*Updated definitions for temporal operators; added constraint violations*)\nfun s_at and v_at where\n  \"s_at (STT n) = n\"\n| \"s_at (SAtm _ n) = n\"\n| \"s_at (SNeg vphi) = v_at vphi\"\n| \"s_at (SDisjL sphi) = s_at sphi\"\n| \"s_at (SDisjR spsi) = s_at spsi\"\n| \"s_at (SConj sphi spsi) = s_at sphi\"\n| \"s_at (SImplL vphi) = v_at vphi\"\n| \"s_at (SImplR spsi) = s_at spsi\"\n| \"s_at (SIff_ss sphi spsi) = s_at sphi\"\n| \"s_at (SIff_vv vphi vpsi) = v_at vphi\"\n| \"s_at (SNext sphi) = s_at sphi - 1\"\n| \"s_at (SPrev sphi) = s_at sphi + 1\"\n| \"s_at (SOnce n sphi) = n\"\n| \"s_at (SEventually n sphi) = n\"\n| \"s_at (SHistorically n li sphis) = n\"\n| \"s_at (SHistorically_le n) = n\"\n| \"s_at (SAlways n hi sphis) = n\"\n| \"s_at (SSince spsi sphis) = (case sphis of [] \\<Rightarrow> s_at spsi | _ \\<Rightarrow> s_at (last sphis))\"\n| \"s_at (SUntil sphis spsi) = (case sphis of [] \\<Rightarrow> s_at spsi | x # _ \\<Rightarrow> s_at x)\"\n| \"v_at (VFF n) = n\"\n| \"v_at (VAtm _ n) = n\"\n| \"v_at (VNeg sphi) = s_at sphi\"\n| \"v_at (VDisj vphi vpsi) = v_at vphi\"\n| \"v_at (VConjL vphi) = v_at vphi\"\n| \"v_at (VConjR vpsi) = v_at vpsi\"\n| \"v_at (VImpl sphi vpsi) = s_at sphi\"\n| \"v_at (VIff_sv sphi vpsi) = s_at sphi\"\n| \"v_at (VIff_vs vphi spsi) = v_at vphi\"\n| \"v_at (VNext vphi) = v_at vphi - 1\"\n| \"v_at (VNext_ge n) = n\"\n| \"v_at (VNext_le n) = n\"\n| \"v_at (VPrev vphi) = v_at vphi + 1\"\n| \"v_at (VPrev_ge n) = n\"\n| \"v_at (VPrev_le n) = n\"\n| \"v_at (VPrev_zero) = 0\"\n| \"v_at (VOnce_le n) = n\"\n| \"v_at (VOnce n li vphi) = n\"\n| \"v_at (VEventually n li vphi) = n\"\n| \"v_at (VHistorically n vphi) = n\"\n| \"v_at (VAlways n vphi) = n\"\n| \"v_at (VSince n vpsi vphis) = n\"\n| \"v_at (VSince_le n) = n\"\n| \"v_at (VUntil n vphis vpsi) = n\"\n| \"v_at (VSince_never n li vpsis) = n\"\n| \"v_at (VUntil_never n hi vpsis) = n\"\ncontext fixes rho :: \"'a trace\"\nbegin\n\nfun s_check and v_check where\n  \"s_check f p = (case (f, p) of\n    (TT, STT i) \\<Rightarrow> True\n  | (Atom a, SAtm b i) \\<Rightarrow> (a = b \\<and> a \\<in> (\\<Gamma> rho i))\n  | (Neg phi, SNeg sphi) \\<Rightarrow> v_check phi sphi\n  | (Disj phi psi, SDisjL sphi) \\<Rightarrow> s_check phi sphi\n  | (Disj phi psi, SDisjR spsi) \\<Rightarrow> s_check psi spsi\n  | (Conj phi psi, SConj sphi spsi) \\<Rightarrow> s_check phi sphi \\<and> s_check psi spsi \\<and> s_at sphi = s_at spsi\n  | (Impl phi psi, SImplL vphi) \\<Rightarrow> v_check phi vphi\n  | (Impl phi psi, SImplR spsi) \\<Rightarrow> s_check psi spsi\n  | (Iff phi psi, SIff_ss sphi spsi) \\<Rightarrow> s_check phi sphi \\<and> s_check psi spsi \\<and> s_at sphi = s_at spsi\n  | (Iff phi psi, SIff_vv vphi vpsi) \\<Rightarrow> v_check phi vphi \\<and> v_check psi vpsi \\<and> v_at vphi = v_at vpsi\n  | (Once I phi, SOnce i sphi) \\<Rightarrow> \n    (let j = s_at sphi\n    in j \\<le> i \\<and> mem (\\<tau> rho i - \\<tau> rho j) I \\<and> s_check phi sphi)\n  | (Eventually I phi, SEventually i sphi) \\<Rightarrow> \n    (let j = s_at sphi\n    in j \\<ge> i \\<and> mem (\\<tau> rho j - \\<tau> rho i) I \\<and> s_check phi sphi)\n  | (Historically I phi, SHistorically_le i) \\<Rightarrow> \n    \\<tau> rho i < \\<tau> rho 0 + left I\n  | (Historically I phi, SHistorically i li sphis) \\<Rightarrow>\n    (li = (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n))\n    \\<and> \\<tau> rho 0 + left I \\<le> \\<tau> rho i\n    \\<and> map s_at sphis = [li ..< Suc (l rho i I)]\n    \\<and> (\\<forall>sphi \\<in> set sphis. s_check phi sphi))\n  | (Always I phi, SAlways i hi sphis) \\<Rightarrow>\n    (hi = (case right I of enat n \\<Rightarrow> LTP rho (\\<tau> rho i + n)) \\<and> right I \\<noteq> \\<infinity>\n    \\<and> map s_at sphis = [(lu rho i I) ..< Suc hi]\n    \\<and> (\\<forall>sphi \\<in> set sphis. s_check phi sphi))\n  | (Since phi I psi, SSince spsi sphis) \\<Rightarrow>\n    (let i = s_at (SSince spsi sphis); j = s_at spsi\n    in j \\<le> i \\<and> mem (\\<tau> rho i - \\<tau> rho j) I \\<and> map s_at sphis = [Suc j ..< Suc i] \\<and> s_check psi spsi\n    \\<and> (\\<forall>sphi \\<in> set sphis. s_check phi sphi))\n  | (Until phi I psi, SUntil sphis spsi) \\<Rightarrow>\n    (let i = s_at (SUntil sphis spsi); j = s_at spsi\n    in j \\<ge> i \\<and> mem (\\<tau> rho j - \\<tau> rho i) I \\<and> map s_at sphis = [i ..< j] \\<and> s_check psi spsi\n    \\<and> (\\<forall>sphi \\<in> set sphis. s_check phi sphi))\n  | (Next I phi, SNext sphi) \\<Rightarrow>\n    (let j = s_at sphi; i = s_at (SNext sphi)\n    in j = Suc i \\<and> mem (\\<Delta> rho j) I \\<and> s_check phi sphi)\n  | (Prev I phi, SPrev sphi) \\<Rightarrow>\n    (let j = s_at sphi; i = s_at (SPrev sphi)\n    in i = Suc j \\<and> mem (\\<Delta> rho i) I \\<and> s_check phi sphi)\n  | (_, _) \\<Rightarrow> False)\"\n| \"v_check f p = (case (f, p) of\n    (FF, VFF i) \\<Rightarrow> True\n  | (Atom a, VAtm b i) \\<Rightarrow> (a = b \\<and> a \\<notin> (\\<Gamma> rho i))\n  | (Neg phi, VNeg sphi) \\<Rightarrow> s_check phi sphi\n  | (Disj phi psi, VDisj vphi vpsi) \\<Rightarrow> v_check phi vphi \\<and> v_check psi vpsi \\<and> v_at vphi = v_at vpsi\n  | (Conj phi psi, VConjL vphi) \\<Rightarrow> v_check phi vphi\n  | (Conj phi psi, VConjR vpsi) \\<Rightarrow> v_check psi vpsi\n  | (Impl phi psi, VImpl sphi vpsi) \\<Rightarrow> s_check phi sphi \\<and> v_check psi vpsi \\<and> s_at sphi = v_at vpsi\n  | (Iff phi psi, VIff_sv sphi vpsi) \\<Rightarrow> s_check phi sphi \\<and> v_check psi vpsi \\<and> s_at sphi = v_at vpsi\n  | (Iff phi psi, VIff_vs vphi spsi) \\<Rightarrow> v_check phi vphi \\<and> s_check psi spsi \\<and> v_at vphi = s_at spsi\n  | (Once I phi, VOnce_le i) \\<Rightarrow> \n    \\<tau> rho i < \\<tau> rho 0 + left I\n  | (Once I phi, VOnce i li vphis) \\<Rightarrow>\n    (li = (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n))\n    \\<and> \\<tau> rho 0 + left I \\<le> \\<tau> rho i\n    \\<and> map v_at vphis = [li ..< Suc (l rho i I)]\n    \\<and> (\\<forall>vphi \\<in> set vphis. v_check phi vphi))\n  | (Eventually I phi, VEventually i hi vphis) \\<Rightarrow>\n    (hi = (case right I of enat n \\<Rightarrow> LTP rho (\\<tau> rho i + n)) \\<and> right I \\<noteq> \\<infinity>\n    \\<and> map v_at vphis = [(lu rho i I) ..< Suc hi]\n    \\<and> (\\<forall>vphi \\<in> set vphis. v_check phi vphi))\n  | (Historically I phi, VHistorically i vphi) \\<Rightarrow> \n    (let j = v_at vphi\n    in j \\<le> i \\<and> mem (\\<tau> rho i - \\<tau> rho j) I \\<and> v_check phi vphi)\n  | (Always I phi, VAlways i vphi) \\<Rightarrow> \n    (let j = v_at vphi\n    in j \\<ge> i \\<and> mem (\\<tau> rho j - \\<tau> rho i) I \\<and> v_check phi vphi)\n  | (Since phi I psi, VSince_le i) \\<Rightarrow>\n    \\<tau> rho i < \\<tau> rho 0 + left I\n  | (Since phi I psi, VSince i vphi vpsis) \\<Rightarrow>\n    (let j = v_at vphi\n    in (case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n) \\<le> j) \\<and> j \\<le> i\n    \\<and> \\<tau> rho 0 + left I \\<le> \\<tau> rho i\n    \\<and> map v_at vpsis = [j ..< Suc (l rho i I)] \\<and> v_check phi vphi\n    \\<and> (\\<forall>vpsi \\<in> set vpsis. v_check psi vpsi))\n  | (Until phi I psi, VUntil i vpsis vphi) \\<Rightarrow>\n    (let j = v_at vphi\n    in (case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> j \\<le> LTP rho (\\<tau> rho i + n)) \\<and> i \\<le> j\n    \\<and> map v_at vpsis = [(lu rho i I) ..< Suc j] \\<and> v_check phi vphi\n    \\<and> (\\<forall>vpsi \\<in> set vpsis. v_check psi vpsi))\n  | (Since phi I psi, VSince_never i li vpsis) \\<Rightarrow>\n    (li = (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n))\n    \\<and> \\<tau> rho 0 + left I \\<le> \\<tau> rho i\n    \\<and> map v_at vpsis = [li ..< Suc (l rho i I)]\n    \\<and> (\\<forall>vpsi \\<in> set vpsis. v_check psi vpsi))\n  | (Until phi I psi, VUntil_never i hi vpsis) \\<Rightarrow>\n    (hi = (case right I of enat n \\<Rightarrow> LTP rho (\\<tau> rho i + n)) \\<and> right I \\<noteq> \\<infinity>\n    \\<and> map v_at vpsis = [(lu rho i I) ..< Suc hi]\n    \\<and> (\\<forall>vpsi \\<in> set vpsis. v_check psi vpsi))\n  | (Next I phi, VNext vphi) \\<Rightarrow>\n    (let j = v_at vphi; i = v_at (VNext vphi)\n    in j = Suc i \\<and> v_check phi vphi)\n  | (Next I phi, VNext_ge i) \\<Rightarrow>\n    enat (\\<Delta> rho (Suc i)) > right I\n  | (Next I phi, VNext_le i) \\<Rightarrow>\n    \\<Delta> rho (Suc i) < left I\n  | (Prev I phi, VPrev vphi) \\<Rightarrow>\n    (let j = v_at vphi; i = v_at (VPrev vphi)\n    in i = Suc j \\<and> v_check phi vphi)\n  | (Prev I phi, VPrev_ge i) \\<Rightarrow>\n    i > 0 \\<and> enat (\\<Delta> rho i) > right I\n  | (Prev I phi, VPrev_le i) \\<Rightarrow>\n    i > 0 \\<and> \\<Delta> rho i < left I\n  | (Prev I phi, VPrev_zero) \\<Rightarrow>\n    v_at (VPrev_zero :: 'a vproof) = 0\n  | (_, _) \\<Rightarrow> False)\"\n\ndeclare s_check.simps[simp del] v_check.simps[simp del]\nsimps_of_case s_check_simps[simp, code]: s_check.simps[unfolded prod.case] (splits: mtl.split sproof.split)\nsimps_of_case v_check_simps[simp, code]: v_check.simps[unfolded prod.case] (splits: mtl.split vproof.split)\n\nthm s_check_simps\n\nlemma Cons_eq_upt_conv: \"x # xs = [m ..< n] \\<longleftrightarrow> m < n \\<and> x = m \\<and> xs = [Suc m ..< n]\"\n  by (induct n arbitrary: xs) (force simp: Cons_eq_append_conv)+\n\nlemma map_setE[elim_format]: \"map f xs = ys \\<Longrightarrow> y \\<in> set ys \\<Longrightarrow> \\<exists>x\\<in>set xs. f x = y\"\n  by (induct xs arbitrary: ys) auto\n\nlemma check_sound:\n  \"s_check phi sphi \\<Longrightarrow> SAT rho (s_at sphi) phi\"\n  \"v_check phi vphi \\<Longrightarrow> VIO rho (v_at vphi) phi\"\nproof (induction sphi and vphi arbitrary: phi and phi)\n  case STT\n  then show ?case by (cases phi) (auto intro: SAT_VIO.STT)\nnext\n  case SAtm\n  then show ?case by (cases phi) (auto intro: SAT_VIO.SP)\nnext\n  case SNeg\n  then show ?case by (cases phi) (auto intro: SAT_VIO.SNeg)\nnext\n  case SConj\n  then show ?case by (cases phi) (auto intro: SAT_VIO.SConj)\nnext\n  case SDisjL\n  then show ?case by (cases phi) (auto intro: SAT_VIO.SDisjL)\nnext\n  case SDisjR\n  then show ?case by (cases phi) (auto intro: SAT_VIO.SDisjR)\nnext\n  case SImplR\n  then show ?case by (cases phi) (auto intro: SAT_VIO.SImplR)\nnext\n  case SImplL\n  then show ?case by (cases phi) (auto intro: SAT_VIO.SImplL)\nnext\n  case SIff_ss\n  then show ?case by (cases phi) (auto intro: SAT_VIO.SIff_ss)\nnext\n  case SIff_vv\n  then show ?case by (cases phi) (auto intro: SAT_VIO.SIff_vv)\nnext\n  case (SSince spsi sphis)\n  then show ?case\n  proof (cases phi)\n    case (Since phi I psi)\n    show ?thesis\n      using SSince\n      unfolding Since\n      apply (intro SAT_VIO.SSince[of \"s_at spsi\"])\n         apply (auto simp: Let_def le_Suc_eq Cons_eq_append_conv Cons_eq_upt_conv\n          split: if_splits list.splits)\n      subgoal for k z zs\n        apply (cases \"k \\<le> s_at z\")\n         apply (fastforce simp: le_Suc_eq elim!: map_setE[of _ _ _ k])+\n        done\n      done\n  qed auto\nnext\n  case (SOnce i sphi)\n  then show ?case\n  proof (cases phi)\n    case (Once I phi)\n    show ?thesis\n      using SOnce\n      unfolding Once\n      apply (intro SAT_VIO.SOnce[of \"s_at sphi\"])\n        apply (auto simp: Let_def)\n      done\n  qed auto\nnext\n  case (SEventually i sphi)\n  then show ?case\n  proof (cases phi)\n    case (Eventually I phi)\n    show ?thesis\n      using SEventually\n      unfolding Eventually\n      apply (intro SAT_VIO.SEventually[of _ \"s_at sphi\"])\n        apply (auto simp: Let_def)\n      done\n  qed auto\nnext\n  case SHistorically_le\n  then show ?case by (cases phi) (auto intro: SAT_VIO.SHistorically_le)\nnext\n  case (SHistorically i li sphis)\n  then show ?case\n  proof (cases phi)\n    case (Historically I phi)\n    {fix k\n      define j where j_def: \"j \\<equiv> case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n)\"\n      assume k_def: \"k \\<ge> j \\<and> k \\<le> i \\<and> k \\<le> LTP rho (\\<tau> rho i - left I)\"\n      from SHistorically Historically j_def have map: \"set (map s_at sphis) = set [j ..< Suc (l rho i I)]\"\n        by (auto simp: Let_def)\n      then have kset: \"k \\<in> set ([j ..< Suc (l rho i I)])\" using j_def k_def by auto\n      then obtain x where x: \"x \\<in> set sphis\"  \"s_at x = k\" using k_def map\n        apply auto\n         apply (metis imageE insertI1)\n        by (metis List.List.list.set_map imageE kset map)\n      then have \"SAT rho k phi\" using SHistorically unfolding Historically\n        by (auto simp: Let_def)\n    } note * = this\n    show ?thesis\n      using SHistorically\n      unfolding Historically\n      apply (auto simp: Let_def intro!: SAT_VIO.SHistorically)\n      using SHistorically.IH *  by (auto split: if_splits)\n  qed (auto intro: SAT_VIO.intros)\nnext\n  case (SAlways i hi sphis)\n  then show ?case\n  proof (cases phi)\n    case (Always I phi)\n    obtain n where n_def: \"right I = enat n\"\n      using SAlways\n      by (auto simp: Always split: enat.splits)\n    {fix k  \n      define j where j_def: \"j \\<equiv> LTP rho (\\<tau> rho i + n)\"\n      assume k_def: \"k \\<le> j \\<and> k \\<ge> i \\<and> k \\<ge> ETP rho (\\<tau> rho i + left I)\"\n      from SAlways Always j_def have map: \"set (map s_at sphis) = set [(lu rho i I) ..< Suc j]\"\n        by (auto simp: Let_def n_def)\n      then have kset: \"k \\<in> set ([(lu rho i I) ..< Suc j])\" using k_def j_def by auto\n      then obtain x where x: \"x \\<in> set sphis\" \"s_at x = k\" using k_def map\n        apply auto\n         apply (metis imageE insertI1)\n        by (metis set_map imageE kset map)\n      then have \"SAT rho k phi\" using SAlways unfolding Always\n        by (auto simp: Let_def n_def)\n    } note * = this\n    then show ?thesis\n      using SAlways\n      unfolding Always\n      by (auto simp: Let_def n_def intro: SAT_VIO.SAlways split: if_splits enat.splits)\n  qed(auto intro: SAT_VIO.intros)\nnext\n  case (SUntil sphis spsi)\n  then show ?case\n  proof (cases phi)\n    case (Until phi I psi)\n    show ?thesis\n      using SUntil\n      unfolding Until\n      apply (intro SAT_VIO.SUntil[of _ \"s_at spsi\"])\n         apply (auto simp: Let_def le_Suc_eq Cons_eq_append_conv Cons_eq_upt_conv\n          split: if_splits list.splits)\n      subgoal for k z zs\n        apply (cases \"k \\<le> s_at z\")\n         apply (fastforce simp: le_Suc_eq elim!: map_setE[of _ _ _ k])+\n        done\n      done\n  qed auto\nnext\n  case (SNext sphi)\n  then show ?case by (cases phi) (auto simp add: Let_def SAT_VIO.SNext)\nnext\n  case (SPrev sphi)\n  then show ?case by (cases phi) (auto simp add: Let_def SAT_VIO.SPrev)\nnext\n  case VFF\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VFF)\nnext\n  case VAtm\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VP SAT_VIO.VPrev_zero)\nnext\n  case VNeg\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VNeg SAT_VIO.VPrev_zero)\nnext\n  case VDisj\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VDisj SAT_VIO.VPrev_zero)\nnext\n  case VConjL\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VConjL)\nnext\n  case VConjR\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VConjR)\nnext\n  case VImpl\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VImpl)\nnext\n  case VIff_sv\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VIff_sv)\nnext\n  case VIff_vs\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VIff_vs)\nnext\n  case VOnce_le\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VOnce_le)\nnext\n  case (VOnce i li vphis)\n  then show ?case\n  proof (cases phi)\n    case (Once I phi)\n    {fix k\n      define j where j_def: \"j \\<equiv> case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n)\"\n      assume k_def: \"k \\<ge> j \\<and> k \\<le> i \\<and> k \\<le> LTP rho (\\<tau> rho i - left I)\"\n      from VOnce Once j_def have map: \"set (map v_at vphis) = set [j ..< Suc (l rho i I)]\"\n        by (auto simp: Let_def)\n      then have kset: \"k \\<in> set ([j ..< Suc (l rho i I)])\" using j_def k_def by auto\n      then obtain x where x: \"x \\<in> set vphis\"  \"v_at x = k\" using k_def map\n        apply auto\n         apply (metis imageE insertI1)\n        by (metis List.List.list.set_map imageE kset map)\n      then have \"VIO rho k phi\" using VOnce unfolding Once\n        by (auto simp: Let_def)\n    } note * = this\n    show ?thesis\n      using VOnce\n      unfolding Once\n      apply (auto simp: Let_def intro!: SAT_VIO.VOnce)\n      using VOnce.IH *  by (auto split: if_splits)\n  qed (auto intro: SAT_VIO.intros)\nnext\n  case (VEventually i hi vphis)\n  then show ?case\n  proof (cases phi)\n    case (Eventually I phi)\n    obtain n where n_def: \"right I = enat n\"\n      using VEventually\n      by (auto simp: Eventually split: enat.splits)\n    {fix k  \n      define j where j_def: \"j \\<equiv> LTP rho (\\<tau> rho i + n)\"\n      assume k_def: \"k \\<le> j \\<and> k \\<ge> i \\<and> k \\<ge> ETP rho (\\<tau> rho i + left I)\"\n      from VEventually Eventually j_def have map: \"set (map v_at vphis) = set [(lu rho i I) ..< Suc j]\"\n        by (auto simp: Let_def n_def)\n      then have kset: \"k \\<in> set ([(lu rho i I) ..< Suc j])\" using k_def j_def by auto\n      then obtain x where x: \"x \\<in> set vphis\" \"v_at x = k\" using k_def map\n        apply auto\n         apply (metis imageE insertI1)\n        by (metis set_map imageE kset map)\n      then have \"VIO rho k phi\" using VEventually unfolding Eventually\n        by (auto simp: Let_def n_def)\n    } note * = this\n    then show ?thesis\n      using VEventually\n      unfolding Eventually\n      by (auto simp: Let_def n_def intro: SAT_VIO.VEventually split: if_splits enat.splits)\n  qed(auto intro: SAT_VIO.intros)\nnext\n  case (VHistorically i vphi)\n  then show ?case\n  proof (cases phi)\n    case (Historically I phi)\n    show ?thesis\n      using VHistorically\n      unfolding Historically\n      apply (intro SAT_VIO.VHistorically[of \"v_at vphi\"])\n        apply (auto simp: Let_def)\n      done\n  qed auto\nnext\n  case (VAlways i vphi)\n  then show ?case\n  proof (cases phi)\n    case (Always I phi)\n    show ?thesis\n      using VAlways\n      unfolding Always\n      apply (intro SAT_VIO.VAlways[of _ \"v_at vphi\"])\n        apply (auto simp: Let_def)\n      done\n  qed auto\nnext\n  case VNext\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VNext)\nnext\n  case VNext_ge\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VNext_ge)\nnext\n  case VNext_le\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VNext_le)\nnext\n  case VPrev\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VPrev)\nnext\n  case VPrev_ge\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VPrev_ge)\nnext\n  case VPrev_le\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VPrev_le)\nnext\n  case VPrev_zero\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VPrev_zero)\nnext\n  case VSince_le\n  then show ?case by (cases phi) (auto intro: SAT_VIO.VSince_le)\nnext\n  case (VSince i vphi vpsi)\n  then show ?case\n  proof (cases phi)\n    case (Since phi I psi)\n    {fix k\n      assume k_def: \"k \\<ge> v_at vphi \\<and> k \\<le> i \\<and> k \\<le> LTP rho (\\<tau> rho i - left I)\"\n      from VSince Since have map: \"set (map v_at vpsi) = set ([(v_at vphi) ..< Suc (l rho i I)])\"\n        by (auto simp: Let_def)\n      then have kset: \"k \\<in> set ([(v_at vphi) ..< Suc (l rho i I)])\" using k_def by auto\n      then obtain x where x: \"x \\<in> set vpsi\" \"v_at x = k\" using k_def map kset\n        apply auto\n         apply (metis imageE insertI1)\n        by (metis List.List.list.set_map imageE kset map)\n      then have \"VIO rho k psi\" using VSince unfolding Since\n        by (auto simp: Let_def)\n    } note * = this\n    show ?thesis\n      using VSince\n      unfolding Since\n      apply (auto simp: Let_def split: enat.splits if_splits\n          intro!: SAT_VIO.VSince[of _ i \"v_at vphi\"])\n      using VSince.IH * by (auto split: if_splits)\n  qed (auto intro: SAT_VIO.intros)\nnext\n  case (VUntil i vpsis vphi)\n  then show ?case\n  proof (cases phi)\n    case (Until phi I psi)\n    {fix k\n      assume k_def: \"k \\<le> v_at vphi \\<and> k \\<ge> i \\<and> k \\<ge> ETP rho (\\<tau> rho i + left I)\"\n      from VUntil Until have map: \"set (map v_at vpsis) = set [(lu rho i I) ..< Suc (v_at vphi)]\"\n        by (auto simp: Let_def)\n      then have kset: \"k \\<in> set ([(lu rho i I) ..< Suc (v_at vphi)])\" using k_def by auto\n      then obtain x where x: \"x \\<in> set vpsis\" \"v_at x = k\" using k_def map kset\n        apply auto\n         apply (metis imageE insertI1)\n        by (metis List.List.list.set_map imageE kset map)\n      then have \"VIO rho k psi\" using VUntil unfolding Until\n        by (auto simp: Let_def)\n    } note * = this\n    then show ?thesis\n      using VUntil\n      unfolding Until\n      by (auto simp: Let_def split: enat.splits if_splits\n          intro!: SAT_VIO.VUntil)\n  qed(auto intro: SAT_VIO.intros)\nnext\n  case (VSince_never i li vpsis)\n  then show ?case\n  proof (cases phi)\n    case (Since phi I psi)\n    {fix k\n      define j where j_def: \"j \\<equiv> case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n)\"\n      assume k_def: \"k \\<ge> j \\<and> k \\<le> i \\<and> k \\<le> LTP rho (\\<tau> rho i - left I)\"\n      from VSince_never Since j_def have map: \"set (map v_at vpsis) = set [j ..< Suc (l rho i I)]\"\n        by (auto simp: Let_def)\n      then have kset: \"k \\<in> set ([j ..< Suc (l rho i I)])\" using j_def k_def by auto\n      then obtain x where x: \"x \\<in> set vpsis\"  \"v_at x = k\" using k_def map\n        apply auto\n         apply (metis imageE insertI1)\n        by (metis List.List.list.set_map imageE kset map)\n      then have \"VIO rho k psi\" using VSince_never unfolding Since\n        by (auto simp: Let_def)\n    } note * = this\n    show ?thesis\n      using VSince_never\n      unfolding Since\n      apply (auto simp: Let_def intro!: SAT_VIO.VSince_never)\n      using VSince_never.IH *  by (auto split: if_splits)\n  qed (auto intro: SAT_VIO.intros)\nnext\n  case (VUntil_never i hi vpsis)\n  then show ?case\n  proof (cases phi)\n    case (Until phi I psi)\n    obtain n where n_def: \"right I = enat n\"\n      using VUntil_never\n      by (auto simp: Until split: enat.splits)\n    {fix k  \n      define j where j_def: \"j \\<equiv> LTP rho (\\<tau> rho i + n)\"\n      assume k_def: \"k \\<le> j \\<and> k \\<ge> i \\<and> k \\<ge> ETP rho (\\<tau> rho i + left I)\"\n      from VUntil_never Until j_def have map: \"set (map v_at vpsis) = set [(lu rho i I) ..< Suc j]\"\n        by (auto simp: Let_def n_def)\n      then have kset: \"k \\<in> set ([(lu rho i I) ..< Suc j])\" using k_def j_def by auto\n      then obtain x where x: \"x \\<in> set vpsis\" \"v_at x = k\" using k_def map\n        apply auto\n         apply (metis imageE insertI1)\n        by (metis List.List.list.set_map imageE kset map)\n      then have \"VIO rho k psi\" using VUntil_never unfolding Until\n        by (auto simp: Let_def n_def)\n    } note * = this\n    then show ?thesis\n      using VUntil_never\n      unfolding Until\n      by (auto simp: Let_def n_def intro: SAT_VIO.VUntil_never split: if_splits enat.splits)\n  qed(auto intro: SAT_VIO.intros)\nqed\n\nlemma SAT_or_VIO: \"SAT rho i \\<phi> \\<or> VIO rho i \\<phi>\"\n  using completeness by blast\n\nlemma set_map_list: \"Suc j \\<le> i \\<and> (\\<forall>k \\<in> {Suc j ..< Suc i}. \\<exists>sphi. s_at sphi = k \\<and> s_check phi sphi)\n\\<Longrightarrow> \\<exists>sphis. map (s_at) sphis = [Suc j ..< Suc i] \\<and> (\\<forall>sphi' \\<in> set sphis. s_check phi sphi')\"\nproof(induction i)\n  case 0\n  then obtain sphi where sphi: \"s_at sphi = i \\<and> s_check phi sphi\"\n    using \"local.0\"  by auto\n  define sphis where sphis: \"sphis = [sphi]\"\n  then have \"map s_at sphis = [i] \\<and> (\\<forall>sphi \\<in> set sphis. s_check phi sphi)\"\n    using sphi by auto\n  then show ?case\n    by auto\nnext\n  case (Suc x)\n  then obtain sphis where sphis: \"map (s_at) sphis = [Suc j ..< Suc x] \\<and> (\\<forall>sphi' \\<in> set sphis. s_check phi sphi')\"\n    apply auto\n    by (meson List.list.distinct(1) List.list.set_cases List.list.simps(8))\n  from local.Suc.prems obtain sphi where sphi: \"s_at sphi = Suc x \\<and> s_check phi sphi\"\n    by fastforce\n  then have \"map s_at (sphis @ [sphi]) = [Suc j ..< Suc (Suc x)] \\<and> (\\<forall>sphi' \\<in> set (sphis @ [sphi]). s_check phi sphi')\"\n    using sphis local.Suc by auto\n  then show ?case by blast\nqed\n\nlemma check_complete:\n  \"bounded_future phi \\<Longrightarrow> (SAT rho i phi \\<longrightarrow> (\\<exists>sphi. s_at sphi = i \\<and> s_check phi sphi))\n  \\<and> (VIO rho i phi \\<longrightarrow> (\\<exists>vphi. v_at vphi = i \\<and> v_check phi vphi))\"\nproof (induction phi arbitrary: i rule: bounded_future.induct)\n  case TTBF\n  then show ?case\n    by (auto elim: VIO.cases intro: exI[of _ \"STT i\"])\nnext\n  case FFBF\n  then show ?case\n    by (auto elim: SAT.cases intro: exI[of _ \"VFF i\"])\nnext\n  case (AtomBF n)\n  {assume \"SAT rho i (Atom n)\"\n    then have \"s_at (SAtm n i) = i \\<and> s_check (Atom n) (SAtm n i)\" by cases auto\n  }\n  moreover\n  {assume \"VIO rho i (Atom n)\"\n    then have \"v_at (VAtm n i) = i \\<and> v_check (Atom n) (VAtm n i)\" by cases auto\n  }\n  ultimately show ?case by blast\nnext\n  case (DisjBF phi psi)\n  {assume \"SAT rho i (Disj phi psi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Disj phi psi) sphi\"\n    proof (cases)\n      case (SDisjL)\n      then obtain sphi where sphi: \"s_at sphi = i \\<and> s_check phi sphi\" using DisjBF by auto\n      then have \"s_at (SDisjL sphi) = i \\<and> s_check (Disj phi psi) (SDisjL sphi)\"\n        by auto\n      then show ?thesis by blast\n    next\n      case (SDisjR)\n      then obtain spsi where spsi: \"s_at spsi = i \\<and> s_check psi spsi\" using DisjBF by auto\n      then have \"s_at (SDisjR spsi) = i \\<and> s_check (Disj phi psi) (SDisjR spsi)\"\n        by auto\n      then show ?thesis by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Disj phi psi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Disj phi psi) vphi\"\n    proof (cases)\n      case (VDisj)\n      then obtain vphi and vpsi where sphi: \"v_at vphi = i \\<and> v_check phi vphi\"\n        and vpsi: \"v_at vpsi = i \\<and> v_check psi vpsi\" using DisjBF by blast\n      then have \"v_at (VDisj vphi vpsi) = i \\<and> v_check (Disj phi psi) (VDisj vphi vpsi)\"\n        by auto\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (ConjBF phi psi)\n  {assume \"SAT rho i (Conj phi psi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Conj phi psi) sphi\"\n    proof (cases)\n      case (SConj)\n      then obtain sphi and spsi where sphi: \"s_at sphi = i \\<and> s_check phi sphi\"\n        and spsi: \"s_at spsi = i \\<and> s_check psi spsi\" using ConjBF by blast\n      then have \"s_at (SConj sphi spsi) = i \\<and> s_check (Conj phi psi) (SConj sphi spsi)\"\n        by auto\n      then show ?thesis by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Conj phi psi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Conj phi psi) vphi\"\n    proof (cases)\n      case (VConjL)\n      then obtain vphi where vphi: \"v_at vphi = i \\<and> v_check phi vphi\" using ConjBF by auto\n      then have \"v_at (VConjL vphi) = i \\<and> v_check (Conj phi psi) (VConjL vphi)\"\n        by auto\n      then show ?thesis by blast\n    next\n      case (VConjR)\n      then obtain vpsi where vpsi: \"v_at vpsi = i \\<and> v_check psi vpsi\" using ConjBF by auto\n      then have \"v_at (VConjR vpsi) = i \\<and> v_check (Conj phi psi) (VConjR vpsi)\"\n        by auto\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (NegBF phi)\n  {assume \"SAT rho i (Neg phi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Neg phi) sphi\"\n    proof (cases)\n      case (SNeg)\n      then obtain vphi where vphi: \"v_at vphi = i \\<and> v_check phi vphi\" using NegBF by auto\n      then have \"s_at (SNeg vphi) = i \\<and> s_check (Neg phi) (SNeg vphi)\"\n        by auto\n      then show ?thesis by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Neg phi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Neg phi) vphi\"\n    proof (cases)\n      case (VNeg)\n      then obtain sphi where sphi: \"s_at sphi = i \\<and> s_check phi sphi\" using NegBF by auto\n      then have \"v_at (VNeg sphi) = i \\<and> v_check (Neg phi) (VNeg sphi)\"\n        by auto\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (ImplBF phi psi)\n  {assume \"SAT rho i (Impl phi psi)\"\n    then have \"\\<exists>sp. s_at sp = i \\<and> s_check (Impl phi psi) sp\"\n    proof (cases)\n      case (SImplL)\n      then obtain vphi where vphi: \"v_at vphi = i \\<and> v_check phi vphi\"\n        using ImplBF by blast\n      then have \"s_at (SImplL vphi) = i \\<and> s_check (Impl phi psi) (SImplL vphi)\"\n        by auto\n      then show ?thesis by blast\n    next\n      case (SImplR)\n      then obtain spsi where spsi: \"s_at spsi = i \\<and> s_check psi spsi\"\n        using ImplBF by blast\n      then have \"s_at (SImplR spsi) = i \\<and> s_check (Impl phi psi) (SImplR spsi)\"\n        by auto\n      then show ?thesis by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Impl phi psi)\"\n    then have \"\\<exists>vp. v_at vp = i \\<and> v_check (Impl phi psi) vp\"\n    proof (cases)\n      case (VImpl)\n      then obtain sphi and vpsi where sphi: \"s_at sphi = i \\<and> s_check phi sphi\" \n        and vpsi: \"v_at vpsi = i \\<and> v_check psi vpsi\"\n        using ImplBF by blast\n      then have \"v_at (VImpl sphi vpsi) = i \\<and> v_check (Impl phi psi) (VImpl sphi vpsi)\"\n        by auto\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (IffBF phi psi)\n  {assume \"SAT rho i (Iff phi psi)\"\n    then have \"\\<exists>sp. s_at sp = i \\<and> s_check (Iff phi psi) sp\"\n    proof (cases)\n      case (SIff_ss)\n      then obtain sphi and spsi where sphi: \"s_at sphi = i \\<and> s_check phi sphi\" \n        and spsi: \"s_at spsi = i \\<and> s_check psi spsi\"\n        using IffBF by blast\n      then have \"s_at (SIff_ss sphi spsi) = i \\<and> s_check (Iff phi psi) (SIff_ss sphi spsi)\"\n        by auto\n      then show ?thesis by blast\n    next\n      case (SIff_vv)\n      then obtain vphi and vpsi where sphi: \"v_at vphi = i \\<and> v_check phi vphi\" \n        and vpsi: \"v_at vpsi = i \\<and> v_check psi vpsi\"\n        using IffBF by blast\n      then have \"s_at (SIff_vv vphi vpsi) = i \\<and> s_check (Iff phi psi) (SIff_vv vphi vpsi)\"\n        by auto\n      then show ?thesis by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Iff phi psi)\"\n    then have \"\\<exists>vp. v_at vp = i \\<and> v_check (Iff phi psi) vp\"\n    proof (cases)\n      case (VIff_sv)\n      then obtain sphi and vpsi where sphi: \"s_at sphi = i \\<and> s_check phi sphi\"\n        and vpsi: \"v_at vpsi = i \\<and> v_check psi vpsi\"\n        using IffBF by blast\n      then have \"v_at (VIff_sv sphi vpsi) = i \\<and> v_check (Iff phi psi) (VIff_sv sphi vpsi)\"\n        by auto\n      then show ?thesis by blast\n    next\n      case (VIff_vs)\n      then obtain vphi and spsi where sphi: \"v_at vphi = i \\<and> v_check phi vphi\"\n        and spsi: \"s_at spsi = i \\<and> s_check psi spsi\"\n        using IffBF by blast\n      then have \"v_at (VIff_vs vphi spsi) = i \\<and> v_check (Iff phi psi) (VIff_vs vphi spsi)\"\n        by auto\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (NextBF phi I)\n  {assume \"SAT rho i (Next I phi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Next I phi) sphi\"\n    proof (cases)\n      case (SNext)\n      then obtain sphi where sphi: \"s_at sphi = (Suc i) \\<and> s_check phi sphi\" using NextBF by auto\n      then have \"s_at (SNext sphi) = i \\<and> s_check (Next I phi) (SNext sphi)\"\n        using SNext sphi by auto\n      then show ?thesis by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Next I phi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Next I phi) vphi\"\n    proof (cases)\n      case (VNext)\n      then obtain vphi where vphi: \"v_at vphi = (Suc i) \\<and> v_check phi vphi\" using NextBF by auto\n      then have \"v_at (VNext vphi) = i \\<and> v_check (Next I phi) (VNext vphi)\"\n        using VNext vphi by auto\n      then show ?thesis by blast\n    next\n      case (VNext_le)\n      then have \"v_at (VNext_le i) = i \\<and> v_check (Next I phi) (VNext_le i)\" by auto\n      then show ?thesis by blast\n    next\n      case (VNext_ge)\n      then have \"v_at (VNext_ge i) = i \\<and> v_check (Next I phi) (VNext_ge i)\" by auto\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (PrevBF phi I)\n  {assume \"SAT rho i (Prev I phi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Prev I phi) sphi\"\n    proof (cases)\n      case (SPrev)\n      then obtain sphi where sphi: \"s_at sphi = i - 1 \\<and> s_check phi sphi\" using PrevBF by auto\n      then have \"s_at (SPrev sphi) = i \\<and> s_check (Prev I phi) (SPrev sphi)\"\n        using SPrev sphi by auto\n      then show ?thesis by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Prev I phi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Prev I phi) vphi\"\n    proof (cases)\n      case (VPrev)\n      then obtain vphi where vphi: \"v_at vphi = i - 1 \\<and> v_check phi vphi\" using PrevBF by auto\n      then have \"v_at (VPrev vphi) = i \\<and> v_check (Prev I phi) (VPrev vphi)\"\n        using VPrev vphi by auto\n      then show ?thesis by blast\n    next\n      case (VPrev_zero)\n      then have \"v_at (VPrev_zero) = i \\<and> v_check (Prev I phi) (VPrev_zero)\" by auto\n      then show ?thesis by blast\n    next\n      case (VPrev_le)\n      then have \"v_at (VPrev_le i) = i \\<and> v_check (Prev I phi) (VPrev_le i)\" by auto\n      then show ?thesis by blast\n    next\n      case (VPrev_ge)\n      then have \"v_at (VPrev_ge i) = i \\<and> v_check (Prev I phi) (VPrev_ge i)\" by auto\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (OnceBF phi I)\n  {assume \"SAT rho i (Once I phi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Once I phi) sphi\"\n    proof (cases)\n      case (SOnce j)\n      then obtain sphi where sphi: \"s_at sphi = j \\<and> s_check phi sphi\" using OnceBF by blast\n      {assume \"Suc j > i\"\n        then have \"s_at (SOnce i sphi) = i \\<and> s_check (Once I phi) (SOnce i sphi)\"\n          using sphi SOnce by auto\n        then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Once I phi) sphi\" by blast\n      }\n      moreover\n      {assume j_i: \"Suc j \\<le> i\"\n        have \"s_at (SOnce i sphi) = i \\<and> s_check (Once I phi) (SOnce i sphi)\"\n          using sphi j_i SOnce\n          by (auto)\n      }\n      ultimately show ?thesis\n        using not_less by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Once I phi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Once I phi) vphi\"\n    proof (cases)\n      case (VOnce_le)\n      then have \"v_at (VOnce_le i) = i \\<and> v_check (Once I phi) (VOnce_le i)\"\n        by auto\n      then show ?thesis by blast\n    next\n      case (VOnce j)\n      from OnceBF VOnce obtain f where f_def: \"\\<forall>k \\<in> {j .. l rho i I}. v_at (f k) = k \\<and> v_check phi (f k)\"\n        by atomize_elim (auto intro: bchoice)\n      then obtain vphis where vphis: \"map (v_at) vphis = [j ..< Suc (l rho i I)]\n          \\<and> (\\<forall>vphi \\<in> set vphis. v_check phi vphi)\"\n        by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ \"map f ([j ..< Suc (l rho i I)])\"])\n      then have \"v_at (VOnce i j vphis) = i \\<and> v_check (Once I phi) (VOnce i j vphis)\"\n        using VOnce by auto\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (HistoricallyBF phi I)\n  {assume \"VIO rho i (Historically I phi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Historically I phi) vphi\"\n    proof (cases)\n      case (VHistorically j)\n      then obtain vphi where vphi: \"v_at vphi = j \\<and> v_check phi vphi\" \n        using HistoricallyBF by blast\n      {assume \"Suc j > i\"\n        then have \"v_at (VHistorically i vphi) = i \\<and> v_check (Historically I phi) (VHistorically i vphi)\"\n          using vphi VHistorically by auto\n        then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Historically I phi) vphi\" by blast\n      }\n      moreover\n      {assume j_i: \"Suc j \\<le> i\"\n        have \"v_at (VHistorically i vphi) = i \\<and> v_check (Historically I phi) (VHistorically i vphi)\"\n          using vphi j_i VHistorically\n          by (auto)\n      }\n      ultimately show ?thesis\n        using not_less by blast\n    qed\n  }\n  moreover\n  {assume \"SAT rho i (Historically I phi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Historically I phi) sphi\"\n    proof (cases)\n      case (SHistorically_le)\n      then have \"s_at (SHistorically_le i) = i \\<and> s_check (Historically I phi) (SHistorically_le i)\"\n        by auto\n      then show ?thesis by blast\n    next\n      case (SHistorically j)\n      from HistoricallyBF SHistorically obtain f where f_def: \"\\<forall>k \\<in> {j .. l rho i I}. s_at (f k) = k \\<and> s_check phi (f k)\"\n        by atomize_elim (auto intro: bchoice)\n      then obtain sphis where sphis: \"map (s_at) sphis = [j ..< Suc (l rho i I)]\n          \\<and> (\\<forall>sphi \\<in> set sphis. s_check phi sphi)\"\n        by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ \"map f ([j ..< Suc (l rho i I)])\"])\n      then have \"s_at (SHistorically i j sphis) = i \\<and> s_check (Historically I phi) (SHistorically i j sphis)\"\n        using SHistorically by auto\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (EventuallyBF I phi)\n  {assume \"SAT rho i (Eventually I phi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Eventually I phi) sphi\"\n    proof (cases)\n      case (SEventually j)\n      then obtain sphi where sphi: \"s_at sphi = j \\<and> s_check phi sphi\" using EventuallyBF by blast\n      {assume \"Suc i > j\"\n        then have \"s_at (SEventually i sphi) = i \\<and> s_check (Eventually I phi) (SEventually i sphi)\"\n          using sphi SEventually by auto\n        then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Eventually I phi) sphi\" by blast\n      }\n      moreover\n      {assume i_j: \"Suc i \\<le> j\"\n        have \"s_at (SEventually i sphi) = i \\<and> s_check (Eventually I phi) (SEventually i sphi)\"\n          using sphi i_j SEventually\n          by (auto)\n      }\n      ultimately show ?thesis using not_less by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Eventually I phi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Eventually I phi) vphi\"\n    proof (cases)\n      case (VEventually)\n      obtain n where n_def: \"right I = enat n\"\n        using EventuallyBF\n        by (cases \"right I\") auto\n      define j where \"j = LTP rho (\\<tau> rho i + n)\"\n      obtain f where f_def: \"\\<forall>k \\<in> {lu rho i I .. j}. v_at (f k) = k \\<and> v_check phi (f k)\"\n        using EventuallyBF VEventually by atomize_elim (auto simp: n_def j_def intro: bchoice)\n      then obtain vphis where vphis: \"map (v_at) vphis = [lu rho i I ..< Suc j]\n        \\<and> (\\<forall>vphi \\<in> set vphis. v_check phi vphi)\"\n        by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ \"map f ([lu rho i I ..< Suc j])\"])\n      then have \"v_at (VEventually i j vphis) = i \\<and> v_check (Eventually I phi) (VEventually i j vphis)\"\n        using EventuallyBF VEventually by (auto simp: n_def j_def)\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (AlwaysBF I phi)\n  {assume \"VIO rho i (Always I phi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Always I phi) vphi\"\n    proof (cases)\n      case (VAlways j)\n      then obtain vphi where vphi: \"v_at vphi = j \\<and> v_check phi vphi\" using AlwaysBF by blast\n      {assume \"Suc i > j\"\n        then have \"v_at (VAlways i vphi) = i \\<and> v_check (Always I phi) (VAlways i vphi)\"\n          using vphi VAlways by auto\n        then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Always I phi) vphi\" by blast\n      }\n      moreover\n      {assume i_j: \"Suc i \\<le> j\"\n        have \"v_at (VAlways i vphi) = i \\<and> v_check (Always I phi) (VAlways i vphi)\"\n          using vphi i_j VAlways\n          by (auto)\n      }\n      ultimately show ?thesis using not_less by blast\n    qed\n  }\n  moreover\n  {assume \"SAT rho i (Always I phi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Always I phi) sphi\"\n    proof (cases)\n      case (SAlways)\n      obtain n where n_def: \"right I = enat n\"\n        using AlwaysBF\n        by (cases \"right I\") auto\n      define j where \"j = LTP rho (\\<tau> rho i + n)\"\n      obtain f where f_def: \"\\<forall>k \\<in> {lu rho i I .. j}. s_at (f k) = k \\<and> s_check phi (f k)\"\n        using AlwaysBF SAlways by atomize_elim (auto simp: n_def j_def intro: bchoice)\n      then obtain sphis where sphis: \"map (s_at) sphis = [lu rho i I ..< Suc j]\n        \\<and> (\\<forall>sphi \\<in> set sphis. s_check phi sphi)\"\n        by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ \"map f ([lu rho i I ..< Suc j])\"])\n      then have \"s_at (SAlways i j sphis) = i \\<and> s_check (Always I phi) (SAlways i j sphis)\"\n        using AlwaysBF SAlways by (auto simp: n_def j_def)\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (SinceBF phi psi I)\n  {assume \"SAT rho i (Since phi I psi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Since phi I psi) sphi\"\n    proof (cases)\n      case (SSince j)\n      then obtain spsi where spsi: \"s_at spsi = j \\<and> s_check psi spsi\" using SinceBF by blast\n      {assume \"Suc j > i\"\n        then have \"s_at (SSince spsi []) = i \\<and> s_check (Since phi I psi) (SSince spsi [])\"\n          using spsi SSince by auto\n        then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Since phi I psi) sphi\" by blast\n      }\n      moreover\n      {assume j_i: \"Suc j \\<le> i\"\n        from SinceBF SSince obtain f where f_def: \"\\<forall>k \\<in> {Suc j..<Suc i}. s_at (f k) = k \\<and> s_check phi (f k)\"\n          by atomize_elim (auto intro: bchoice)\n        then obtain sphis where sphis: \"map (s_at) sphis = [Suc j ..< Suc i]\n        \\<and> (\\<forall>sphi \\<in> set sphis. s_check phi sphi)\"\n          by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ \"map f [Suc j..< Suc i]\"])\n        then have \"sphis \\<noteq> []\" using j_i by auto\n        then have \"s_at (SSince spsi sphis) = i \\<and> s_check (Since phi I psi) (SSince spsi sphis)\"\n          using spsi j_i sphis SSince\n          apply (auto)\n           apply (metis List.list.exhaust List.list.simps(5) last_map last_snoc)\n          by (metis (full_types) List.list.exhaust List.list.simps(5) last_map last_snoc)\n        then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Since phi I psi) sphi\" by blast\n      }\n      ultimately show ?thesis\n        using not_less by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Since phi I psi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Since phi I psi) vphi\"\n    proof (cases)\n      case (VSince_le)\n      then have \"v_at (VSince_le i) = i \\<and> v_check (Since phi I psi) (VSince_le i)\"\n        by auto\n      then show ?thesis by blast\n    next\n      case (VSince j)\n      then obtain vphi where vphi: \"v_at vphi = j \\<and> v_check phi vphi\" using SinceBF VSince by auto\n      from SinceBF VSince obtain f where f_def: \"\\<forall>k \\<in> {j .. l rho i I}. v_at (f k) = k \\<and> v_check psi (f k)\"\n        by atomize_elim (auto intro: bchoice)\n      then obtain vpsis where vpsis: \"map (v_at) vpsis = [j ..< Suc (l rho i I)]\n        \\<and> (\\<forall>vpsi \\<in> set vpsis. v_check psi vpsi)\"\n        by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ \"map f ([j ..< Suc (l rho i I)])\"])\n      then have \"v_at (VSince i vphi vpsis) = i \\<and> v_check (Since phi I psi) (VSince i vphi vpsis)\"\n        using vphi VSince by auto\n      then show ?thesis by blast\n    next\n      case (VSince_never j)\n      from SinceBF VSince_never obtain f where f_def: \"\\<forall>k \\<in> {j .. l rho i I}. v_at (f k) = k \\<and> v_check psi (f k)\"\n        by atomize_elim (auto intro: bchoice)\n      then obtain vpsis where vpsis: \"map (v_at) vpsis = [j ..< Suc (l rho i I)]\n        \\<and> (\\<forall>vpsi \\<in> set vpsis. v_check psi vpsi)\"\n        by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ \"map f ([j ..< Suc (l rho i I)])\"])\n      then have \"v_at (VSince_never i j vpsis) = i \\<and> v_check (Since phi I psi) (VSince_never i j vpsis)\"\n        using VSince_never by auto\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nnext\n  case (UntilBF I phi psi)\n  {assume \"SAT rho i (Until phi I psi)\"\n    then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Until phi I psi) sphi\"\n    proof (cases)\n      case (SUntil j)\n      then obtain spsi where spsi: \"s_at spsi = j \\<and> s_check psi spsi\" using UntilBF SUntil by blast\n      {assume \"i \\<ge> j\"\n        then have \"s_at (SUntil [] spsi) = i \\<and> s_check (Until phi I psi) (SUntil [] spsi)\"\n          using spsi SUntil by auto\n        then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Until phi I psi) sphi\" by blast\n      }\n      moreover\n      { assume i_j: \"i < j\"\n        from UntilBF SUntil obtain f where f_def: \"\\<forall>k \\<in> {i ..< j}. s_at (f k) = k \\<and> s_check phi (f k)\"\n          by atomize_elim (auto intro: bchoice)\n        then obtain sphis where sphis: \"map (s_at) sphis = [i ..< j]\n          \\<and> (\\<forall>sphi \\<in> set sphis. s_check phi sphi)\"\n          by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ \"map f ([i ..< j])\"])\n        then have non_empt:\"sphis \\<noteq> []\" using i_j apply auto\n          by (metis gr_implies_not0 leD upt_eq_Nil_conv)\n        then have \"s_at (SUntil sphis spsi) = i \\<and> s_check (Until phi I psi) (SUntil sphis spsi)\"\n          using spsi SUntil sphis apply (auto split: list.splits)\n          using Cons_eq_upt_conv apply blast\n          by (simp add: Cons_eq_upt_conv)\n        then have \"\\<exists>sphi. s_at sphi = i \\<and> s_check (Until phi I psi) sphi\" by blast\n      }\n      ultimately show ?thesis using not_less by blast\n    qed\n  }\n  moreover\n  {assume \"VIO rho i (Until phi I psi)\"\n    then have \"\\<exists>vphi. v_at vphi = i \\<and> v_check (Until phi I psi) vphi\"\n    proof (cases)\n      case (VUntil j)\n      then obtain vphi where vphi: \"v_at vphi = j \\<and> v_check phi vphi\" using UntilBF by auto\n      from UntilBF VUntil obtain f where f_def: \"\\<forall>k \\<in> {lu rho i I .. j}. v_at (f k) = k \\<and> v_check psi (f k)\"\n        by atomize_elim (auto intro: bchoice)\n      then obtain vpsis where vpsis: \"map (v_at) vpsis = [lu rho i I ..< Suc j]\n        \\<and> (\\<forall>vpsi \\<in> set vpsis. v_check psi vpsi)\"\n        by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ \"map f ([lu rho i I ..< Suc j])\"])\n      then have \"v_at (VUntil i vpsis vphi) = i \\<and> v_check (Until phi I psi) (VUntil i vpsis vphi)\"\n        using vphi UntilBF VUntil by auto\n      then show ?thesis by blast\n    next\n      case (VUntil_never)\n      obtain n where n_def: \"right I = enat n\"\n        using UntilBF\n        by (cases \"right I\") auto\n      define j where \"j = LTP rho (\\<tau> rho i + n)\"\n      obtain f where f_def: \"\\<forall>k \\<in> {lu rho i I .. j}. v_at (f k) = k \\<and> v_check psi (f k)\"\n        using UntilBF VUntil_never by atomize_elim (auto simp: n_def j_def intro: bchoice)\n      then obtain vpsis where vpsis: \"map (v_at) vpsis = [lu rho i I ..< Suc j]\n        \\<and> (\\<forall>vpsi \\<in> set vpsis. v_check psi vpsi)\"\n        by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ \"map f ([lu rho i I ..< Suc j])\"])\n      then have \"v_at (VUntil_never i j vpsis) = i \\<and> v_check (Until phi I psi) (VUntil_never i j vpsis)\"\n        using UntilBF VUntil_never by (auto simp: n_def j_def)\n      then show ?thesis by blast\n    qed\n  }\n  ultimately show ?case by blast\nqed\n\nend\n\nsection \\<open>Algorithm\\<close>\n\ncontext\n  fixes rho :: \"'a trace\" and phi :: \"'a mtl\"\nbegin\n\ndefinition \"p_check = (\\<lambda>phi p. case_sum (s_check rho phi) (v_check rho phi) p)\"\n\nend\n\ndefinition \"p_at = (\\<lambda>p. case_sum s_at v_at p)\"\n\n(* Optimal proof-finding algorithm *)\n\n(* ++ operator from paper *)\ndefinition proofApp :: \"('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof)\" (infixl \"\\<oplus>\" 65) where\n  \"p \\<oplus> r = (case (p, r) of\n   (Inl (SHistorically i li p1), Inl r) \\<Rightarrow> Inl (SHistorically (Suc i) li (p1 @ [r]))\n | (Inl (SAlways i hi p1), Inl r) \\<Rightarrow> Inl (SAlways (i-1) hi (r # p1))\n | (Inl (SSince p1 p2), Inl r) \\<Rightarrow> Inl (SSince p1 (p2 @ [r]))\n | (Inl (SUntil p1 p2), Inl r) \\<Rightarrow> Inl (SUntil (r # p1) p2)\n | (Inr (VSince i p1 p2), Inr r) \\<Rightarrow> Inr (VSince (Suc i) p1 (p2 @ [r]))\n | (Inr (VOnce i li p1), Inr r) \\<Rightarrow> Inr (VOnce (Suc i) li (p1 @ [r]))\n | (Inr (VEventually i hi p1), Inr r) \\<Rightarrow> Inr (VEventually (i-1) hi (r # p1))\n | (Inr (VSince_never i li p1), Inr r) \\<Rightarrow> Inr (VSince_never (Suc i) li (p1 @ [r]))\n | (Inr (VUntil i p1 p2), Inr r) \\<Rightarrow> Inr (VUntil (i-1) (r # p1) p2)\n | (Inr (VUntil_never i hi p1), Inr r) \\<Rightarrow> Inr (VUntil_never (i-1) hi (r # p1)))\"\n\ndefinition proofIncr :: \"('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof)\" where\n  \"proofIncr p = (case p of\n   Inl (SOnce i p1) \\<Rightarrow> Inl (SOnce (Suc i) p1)\n | Inl (SEventually i p1) \\<Rightarrow> Inl (SEventually (i-1) p1)\n | Inl (SHistorically i li p1) \\<Rightarrow> Inl (SHistorically (Suc i) li p1)\n | Inl (SAlways i hi p1) \\<Rightarrow> Inl (SAlways (i-1) hi (p1))\n | Inr (VSince i p1 p2) \\<Rightarrow> Inr (VSince (Suc i) p1 p2)\n | Inr (VOnce i li p1) \\<Rightarrow> Inr (VOnce (Suc i) li p1)\n | Inr (VEventually i hi p1) \\<Rightarrow> Inr (VEventually (i-1) hi (p1))\n | Inr (VHistorically i p1) \\<Rightarrow> Inr (VHistorically (Suc i) p1)\n | Inr (VAlways i p1) \\<Rightarrow> Inr (VAlways (i-1) p1)\n | Inr (VSince_never i li p1) \\<Rightarrow> Inr (VSince_never (Suc i) li p1)\n | Inr (VUntil i p1 p2) \\<Rightarrow> Inr (VUntil (i-1) p1 p2)\n | Inr (VUntil_never i hi p1) \\<Rightarrow> Inr (VUntil_never (i-1) hi (p1)))\"\n\ndatatype 'a onetwo = One 'a | Two 'a 'a\n\nterm set_onetwo\nthm onetwo.set\n\n(* Minimum w.r.t. a wqo *)\nfun min_onetwo where\n  \"min_onetwo r (One x) = x\"\n| \"min_onetwo r (Two x y) = (if r x y then x else y)\"\n\nlemma min_onetwo_in: \"min_onetwo r ot \\<in> set_onetwo ot\"\n  by (cases ot) auto\n\nlemma min_onetwo_le: \"reflp r \\<Longrightarrow> total_on r (set_onetwo ot) \\<Longrightarrow> p \\<in> set_onetwo ot \\<Longrightarrow> r (min_onetwo r ot) p\"\n  by (cases ot) (auto simp add: reflp_def total_on_def)\n\ndefinition min_list_wrt where\n  \"min_list_wrt r xs = hd [x \\<leftarrow> xs. \\<forall>y \\<in> set xs. r x y]\"\n\nlemma refl_total_transp_imp_ex_min:\n  \"xs \\<noteq> [] \\<Longrightarrow> reflp r \\<Longrightarrow> total_on r (set xs) \\<Longrightarrow> transp r \\<Longrightarrow> \\<exists>x \\<in> set xs. \\<forall>y \\<in> set xs. r x y\"\nproof(induction xs)\n  case (Cons y' ys)\n  then show ?case\n  proof (cases ys)\n    case Nil\n    then show ?thesis\n      using reflpD[OF Cons(3)] Cons(2)\n      by simp\n  next\n    case cons_ys: (Cons a list)\n    then have ys_nnil: \"ys \\<noteq> []\"\n      by auto\n    from Cons(4) have total_ys: \"total_on r (set ys)\"\n      by (simp add: total_on_def)\n    from Cons(1)[OF ys_nnil Cons(3) total_ys Cons(5)]\n    obtain x where x_def: \"x \\<in> set ys\" \"\\<forall>y \\<in> set ys. r x y\"\n      by auto\n    then have \"r x y' \\<or> r y' x\"\n      using Cons(2,4)\n      by (auto simp: total_on_def)\n    moreover\n    {\n      assume r_xy: \"r x y'\"\n      then have \"\\<exists>x \\<in> set (y' # ys). \\<forall>y \\<in> set (y' # ys). r x y\"\n        using x_def\n        by auto\n    }\n    moreover\n    {\n      assume r_yx: \"r y' x\"\n      then have \"\\<forall>x \\<in> set (y' # ys). r y' x\"\n        using x_def Cons(3,4) transpD[OF Cons(5), of y' x]\n        by (auto simp: total_on_def reflp_def)\n      then have \"\\<exists>y \\<in> set (y' # ys). \\<forall>x \\<in> set (y' # ys). r y x\"\n        by auto\n    }\n    ultimately show ?thesis\n      by auto\n  qed\nqed simp\n\nlemma min_list_wrt_in:\n  assumes nnil: \"xs \\<noteq> []\" and total: \"total_on r (set xs)\"\n    and refl: \"reflp r\" and transp: \"transp r\"\n  shows \"min_list_wrt r xs \\<in> set xs\"\nproof -\n  have \"filter (\\<lambda>x. \\<forall>y \\<in> set xs. r x y) xs \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl total transp]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set xs. r x y)\" xs]\n    by simp\n  then show ?thesis\n    using assms min_list_wrt_def[of r xs]\n      filter_is_subset[of \"(\\<lambda>x. \\<forall>y \\<in> set xs. r x y)\" xs] list.set_sel(1)\n    by force\nqed\n\nlemma min_list_wrt_le:\n  assumes total: \"total_on r (set xs)\" and refl: \"reflp r\" and transp: \"transp r\"\n    and p_in: \"p \\<in> set xs\"\n  shows \"r (min_list_wrt r xs) p\"\nproof -\n  from p_in have nnil: \"xs \\<noteq> []\"\n    by auto\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set xs. r x y) xs \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl total transp]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set xs. r x y)\" xs]\n    by simp\n  then show ?thesis\n    using assms list.set_sel(1)[of \"filter (\\<lambda>x. \\<forall>y \\<in> set xs. r x y) xs\"]\n    by (auto simp: min_list_wrt_def)\nqed\n\n(* Helper functions for Cand *)\ndefinition doDisj :: \"('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow>\n('a sproof + 'a vproof) list\" where\n  \"doDisj p1 p2 = (case (p1, p2) of\n  (Inl p1, Inl p2) \\<Rightarrow> [Inl (SDisjL p1), Inl (SDisjR p2)]\n| (Inl p1, Inr p2) \\<Rightarrow> [Inl (SDisjL p1)]\n| (Inr p1, Inl p2) \\<Rightarrow> [Inl (SDisjR p2)]\n| (Inr p1, Inr p2) \\<Rightarrow> [Inr (VDisj p1 p2)])\"\n\ndefinition doConj :: \"('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow>\n('a sproof + 'a vproof) list\" where\n  \"doConj p1 p2 = (case (p1, p2) of\n  (Inl p1, Inl p2) \\<Rightarrow> [Inl (SConj p1 p2)]\n| (Inl p1, Inr p2) \\<Rightarrow> [Inr (VConjR p2)]\n| (Inr p1, Inl p2) \\<Rightarrow> [Inr (VConjL p1)]\n| (Inr p1, Inr p2) \\<Rightarrow> [Inr (VConjL p1), Inr (VConjR p2)])\"\n\ndefinition doImpl :: \"('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow>\n('a sproof + 'a vproof) list\" where\n  \"doImpl p1 p2 = (case (p1, p2) of\n  (Inl p1, Inl p2) \\<Rightarrow> [Inl (SImplR p2)]\n| (Inl p1, Inr p2) \\<Rightarrow> [Inr (VImpl p1 p2)]\n| (Inr p1, Inl p2) \\<Rightarrow> [Inl (SImplL p1), Inl (SImplR p2)]\n| (Inr p1, Inr p2) \\<Rightarrow> [Inl (SImplL p1)])\"\n\ndefinition doIff :: \"('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow>\n('a sproof + 'a vproof) list\" where\n  \"doIff p1 p2 = (case (p1, p2) of\n  (Inl p1, Inl p2) \\<Rightarrow> [Inl (SIff_ss p1 p2)]\n| (Inl p1, Inr p2) \\<Rightarrow> [Inr (VIff_sv p1 p2)]\n| (Inr p1, Inl p2) \\<Rightarrow> [Inr (VIff_vs p1 p2)]\n| (Inr p1, Inr p2) \\<Rightarrow> [Inl (SIff_vv p1 p2)])\"\n\ndefinition doPrev :: \"nat \\<Rightarrow> \\<I> \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doPrev i I tau p = (case (p, tau < left I) of\n  (Inl p, True) \\<Rightarrow> [Inr (VPrev_le i)]\n| (Inl p, False) \\<Rightarrow> (if mem tau I then [Inl (SPrev p)] else [Inr (VPrev_ge i)])\n| (Inr p, True) \\<Rightarrow> [Inr (VPrev p), Inr (VPrev_le i)]\n| (Inr p, False) \\<Rightarrow> (if mem tau I then [Inr (VPrev p)] else [Inr (VPrev p), Inr (VPrev_ge i)]))\"\n\ndefinition doNext :: \"nat \\<Rightarrow> \\<I> \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doNext i I tau p = (case (p, tau < left I) of\n  (Inl p, True) \\<Rightarrow> [Inr (VNext_le i)]\n| (Inl p, False) \\<Rightarrow> (if mem tau I then [Inl (SNext p)] else [Inr (VNext_ge i)])\n| (Inr p, True) \\<Rightarrow> [Inr (VNext p), Inr (VNext_le i)]\n| (Inr p, False) \\<Rightarrow> (if mem tau I then [Inr (VNext p)] else [Inr (VNext p), Inr (VNext_ge i)]))\"\n\ndefinition doOnceBase :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doOnceBase i a p = (case (p, a = 0) of\n  (Inl p, True) \\<Rightarrow> [Inl (SOnce i p)]\n| (Inr p, True) \\<Rightarrow> [Inr (VOnce i i [p])]\n| (_, False) \\<Rightarrow> [Inr (VOnce i i [])])\"\n\ndefinition doOnce :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doOnce i a p p' = (case (p, a = 0, p') of\n  (Inr p, True, Inl (SOnce j p'')) \\<Rightarrow> [Inl (SOnce i p'')]\n| (Inr p, True, Inr p') \\<Rightarrow> [(Inr p') \\<oplus> (Inr p)]\n| (Inr p, False, Inl (SOnce j p'')) \\<Rightarrow> [Inl (SOnce i p'')]\n| (Inr p, False, Inr (VOnce j li q)) \\<Rightarrow> [Inr (VOnce i li q)]\n| (Inl p, True, Inr (VOnce j li q)) \\<Rightarrow> [Inl (SOnce i p)]\n| (Inl p, True, Inl (SOnce j p'')) \\<Rightarrow> [Inl (SOnce i p''), Inl (SOnce i p)]\n| (Inl p, False, Inl (SOnce j p'')) \\<Rightarrow> [Inl (SOnce i p'')]\n| (Inl p, False, Inr (VOnce j li q)) \\<Rightarrow> [Inr (VOnce i li q)])\"\n\ndefinition doEventuallyBase :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doEventuallyBase i a p = (case (p, a = 0) of\n  (Inl p, True) \\<Rightarrow> [Inl (SEventually i p)]\n| (Inr p, True) \\<Rightarrow> [Inr (VEventually i i [p])]\n| (_, False) \\<Rightarrow> [Inr (VEventually i i [])])\"\n\ndefinition doEventually :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doEventually i a p p' = (case (p, a = 0, p') of\n  (Inr p, True, Inl (SEventually j p'')) \\<Rightarrow> [Inl (SEventually i p'')]\n| (Inr p, True, Inr p') \\<Rightarrow> [(Inr p') \\<oplus> (Inr p)]\n| (Inr p, False, Inl (SEventually j p'')) \\<Rightarrow> [Inl (SEventually i p'')]\n| (Inr p, False, Inr (VEventually j hi q)) \\<Rightarrow> [Inr (VEventually i hi q)]\n| (Inl p, True, Inr (VEventually j hi q)) \\<Rightarrow> [Inl (SEventually i p)]\n| (Inl p, True, Inl (SEventually j p'')) \\<Rightarrow> [Inl (SEventually i p''), Inl (SEventually i p)]\n| (Inl p, False, Inl (SEventually j p'')) \\<Rightarrow> [Inl (SEventually i p'')]\n| (Inl p, False, Inr (VEventually j hi q)) \\<Rightarrow> [Inr (VEventually i hi q)])\"\n\ndefinition doHistoricallyBase :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doHistoricallyBase i a p = (case (p, a = 0) of\n  (Inl p, True) \\<Rightarrow> [Inl (SHistorically i i [p])]\n| (Inr p, True) \\<Rightarrow> [Inr (VHistorically i p)]\n| (_, False) \\<Rightarrow> [Inl (SHistorically i i [])])\"\n\ndefinition doHistorically :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doHistorically i a p p' = (case (p, a = 0, p') of\n  (Inr p, True, Inl (SHistorically j li q)) \\<Rightarrow> [Inr (VHistorically i p)]\n| (Inr p, True, Inr (VHistorically j p'')) \\<Rightarrow> [Inr (VHistorically i p), Inr (VHistorically i p'')]\n| (Inr p, False, Inl (SHistorically j li q)) \\<Rightarrow> [Inl (SHistorically i li q)]\n| (Inr p, False, Inr (VHistorically j p'')) \\<Rightarrow> [Inr (VHistorically i p'')]\n| (Inl p, True, Inr (VHistorically j p'')) \\<Rightarrow> [Inr (VHistorically i p'')]\n| (Inl p, True, Inl p') \\<Rightarrow> [(Inl p') \\<oplus> (Inl p)]\n| (Inl p, False, Inl (SHistorically j li q)) \\<Rightarrow> [Inl (SHistorically i li q)]\n| (Inl p, False, Inr (VHistorically j p'')) \\<Rightarrow> [Inr (VHistorically i p'')])\"\n\ndefinition doAlwaysBase :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doAlwaysBase i a p = (case (p, a = 0) of\n  (Inl p, True) \\<Rightarrow> [Inl (SAlways i i [p])]\n| (Inr p, True) \\<Rightarrow> [Inr (VAlways i p)]\n| (_, False) \\<Rightarrow> [Inl (SAlways i i [])])\"\n\ndefinition doAlways :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doAlways i a p p' = (case (p, a = 0, p') of\n  (Inr p, True, Inl (SAlways j li q)) \\<Rightarrow> [Inr (VAlways i p)]\n| (Inr p, True, Inr (VAlways j p'')) \\<Rightarrow> [Inr (VAlways i p), Inr (VAlways i p'')]\n| (Inr p, False, Inl (SAlways j li q)) \\<Rightarrow> [Inl (SAlways i li q)]\n| (Inr p, False, Inr (VAlways j p'')) \\<Rightarrow> [Inr (VAlways i p'')]\n| (Inl p, True, Inr (VAlways j p'')) \\<Rightarrow> [Inr (VAlways i p'')]\n| (Inl p, True, Inl p') \\<Rightarrow> [(Inl p') \\<oplus> (Inl p)]\n| (Inl p, False, Inl (SAlways j li q)) \\<Rightarrow> [Inl (SAlways i li q)]\n| (Inl p, False, Inr (VAlways j p'')) \\<Rightarrow> [Inr (VAlways i p'')])\"\n\ndefinition doSinceBase :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doSinceBase i a p1 p2 = (case (p1, p2, a = 0) of\n  (_, Inl p2, True) \\<Rightarrow> [Inl (SSince p2 [])]\n| (Inl p1, _, False) \\<Rightarrow> [Inr (VSince_never i i [])]\n| (Inl p1, Inr p2, True) \\<Rightarrow> [Inr (VSince_never i i [p2])]\n| (Inr p1, _, False) \\<Rightarrow> [Inr (VSince i p1 []), Inr (VSince_never i i [])]\n| (Inr p1, Inr p2, True) \\<Rightarrow> [Inr (VSince i p1 [p2]), Inr (VSince_never i i [p2])])\"\n\ndefinition doSince :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doSince i a p1 p2 p' = (case (p1, p2, a = 0, p') of\n  (Inr p1, Inr p2, True, Inl p') \\<Rightarrow> [Inr (VSince i p1 [p2])]\n| (Inr p1, _, False, Inl p') \\<Rightarrow> [Inr (VSince i p1 [])]\n| (Inr p1, Inl p2, True, Inl p') \\<Rightarrow> [Inl (SSince p2 [])]\n| (Inl p1, Inr p2, True, Inl p') \\<Rightarrow> [(Inl p') \\<oplus> (Inl p1)]\n| (Inl p1, _, False, Inl p') \\<Rightarrow> [(Inl p') \\<oplus> (Inl p1)]\n| (Inl p1, Inl p2, True, Inl p') \\<Rightarrow> [(Inl p') \\<oplus> (Inl p1), Inl (SSince p2 [])]\n| (Inr p1, Inr p2, True, Inr (VSince_never j li q)) \\<Rightarrow> [Inr (VSince i p1 [p2]), p' \\<oplus> (Inr p2)]\n| (Inr p1, _, False, Inr (VSince_never j li q)) \\<Rightarrow> [Inr (VSince i p1 []), Inr (VSince_never i li q)]\n| (_, Inl p2, True, Inr (VSince_never j li q)) \\<Rightarrow> [Inl (SSince p2 [])]\n| (Inl p1, Inr p2, True, Inr (VSince_never j li q)) \\<Rightarrow> [p' \\<oplus> (Inr p2)]\n| (Inl p1, _, False, Inr (VSince_never j li q)) \\<Rightarrow> [Inr (VSince_never i li q)]\n| (Inr p1, Inr p2, True, Inr (VSince j q1 q2)) \\<Rightarrow> [Inr (VSince i p1 [p2]), p' \\<oplus> (Inr p2)]\n| (Inr p1, _, False, Inr (VSince j q1 q2)) \\<Rightarrow> [Inr (VSince i p1 []), Inr (VSince i q1 q2)]\n| (_, Inl p2, True, Inr (VSince j q1 q2)) \\<Rightarrow> [Inl (SSince p2 [])]\n| (Inl p1, Inr p2, True, Inr (VSince j q1 q2)) \\<Rightarrow> [p' \\<oplus> (Inr p2)]\n| (Inl p1, _, False, Inr (VSince j q1 q2)) \\<Rightarrow> [Inr (VSince i q1 q2)])\"\n\ndefinition doUntilBase :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doUntilBase i a p1 p2 = (case (p1, p2, a = 0) of\n  (_, Inl p2, True) \\<Rightarrow> [Inl (SUntil [] p2)]\n| (Inl p1, _, False) \\<Rightarrow> [Inr (VUntil_never i i [])]\n| (Inl p1, Inr p2, True) \\<Rightarrow> [Inr (VUntil_never i i [p2])]\n| (Inr p1, _, False) \\<Rightarrow> [Inr (VUntil i [] p1), Inr (VUntil_never i i [])]\n| (Inr p1, Inr p2, True) \\<Rightarrow> [Inr (VUntil i [p2] p1), Inr (VUntil_never i i [p2])])\"\n\ndefinition doUntil :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof)\n\\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof) list\" where\n  \"doUntil i a p1 p2 p' = (case (p1, p2, a = 0, p') of\n  (Inr p1, Inr p2, True, Inl (SUntil q1 q2)) \\<Rightarrow> [Inr (VUntil i [p2] p1)]\n| (Inr p1, _, False, Inl (SUntil q1 q2)) \\<Rightarrow> [Inr (VUntil i [] p1)]\n| (Inr p1, Inl p2, True, Inl (SUntil q1 q2)) \\<Rightarrow> [Inl (SUntil [] p2)]\n| (Inl p1, Inr p2, True, Inl (SUntil q1 q2)) \\<Rightarrow> [p' \\<oplus> (Inl p1)]\n| (Inl p1, _, False, Inl (SUntil q1 q2)) \\<Rightarrow> [p' \\<oplus> (Inl p1)]\n| (Inl p1, Inl p2, True, Inl (SUntil q1 q2)) \\<Rightarrow> [p' \\<oplus> (Inl p1), Inl (SUntil [] p2)]\n| (Inr p1, Inr p2, True, Inr (VUntil_never j hi q)) \\<Rightarrow> [Inr (VUntil i [p2] p1), p' \\<oplus> (Inr p2)]\n| (Inr p1, _, False, Inr (VUntil_never j hi q)) \\<Rightarrow> [Inr (VUntil i [] p1), Inr (VUntil_never i hi q)]\n| (_, Inl p2, True, Inr (VUntil_never j hi q)) \\<Rightarrow> [Inl (SUntil [] p2)]\n| (Inl p1, Inr p2, True, Inr (VUntil_never j hi q)) \\<Rightarrow> [p' \\<oplus> (Inr p2)]\n| (Inl p1, _, False, Inr (VUntil_never j hi q)) \\<Rightarrow> [Inr (VUntil_never i hi q)]\n| (Inr p1, Inr p2, True, Inr (VUntil j q1 q2)) \\<Rightarrow> [Inr (VUntil i [p2] p1), p' \\<oplus> (Inr p2)]\n| (Inr p1, _, False, Inr (VUntil j q1 q2)) \\<Rightarrow> [Inr (VUntil i [] p1), Inr (VUntil i q1 q2)]\n| (_, Inl p2, True, Inr (VUntil j q1 q2)) \\<Rightarrow> [Inl (SUntil [] p2)]\n| (Inl p1, Inr p2, True, Inr (VUntil j q1 q2)) \\<Rightarrow> [p' \\<oplus> (Inr p2)]\n| (Inl p1, _, False, Inr (VUntil j q1 q2)) \\<Rightarrow> [Inr (VUntil i q1 q2)])\"\n\nlocale alg = fixes rho :: \"'a trace\" and\n  wqo :: \"('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> bool\"\n  (*and f :: \"('a sproof rsproof + 'a vproof rvproof) \\<Rightarrow> nat\"*)\nbegin\n\n(* O and C from paper *)\nfunction (sequential) Cand :: \"nat \\<Rightarrow> 'a mtl \\<Rightarrow> ('a sproof + 'a vproof) list\"\n  and Opt :: \"nat \\<Rightarrow> 'a mtl \\<Rightarrow> ('a sproof + 'a vproof)\" where\n  \"Cand i TT = [Inl (STT i)]\"\n| \"Cand i FF = [Inr (VFF i)]\"\n| \"Cand i (Atom n) = (case n \\<in> \\<Gamma> rho i of\n  True \\<Rightarrow> [Inl (SAtm n i)] | False \\<Rightarrow> [Inr (VAtm n i)])\"\n| \"Cand i (Disj phi psi) = doDisj (Opt i phi) (Opt i psi)\"\n| \"Cand i (Conj phi psi) = doConj (Opt i phi) (Opt i psi)\"\n| \"Cand i (Impl phi psi) = doImpl (Opt i phi) (Opt i psi)\"\n| \"Cand i (Iff phi psi) = doIff (Opt i phi) (Opt i psi)\"\n| \"Cand i (Neg phi) = (let p = Opt i phi\n  in (if isl p then [Inr (VNeg (projl p))] else [Inl (SNeg (projr p))]))\"\n| \"Cand i (Prev I phi) = (if i = 0 then [Inr VPrev_zero]\n  else doPrev i I (\\<Delta> rho i) (Opt (i-1) phi))\"\n| \"Cand i (Next I phi) = doNext i I (\\<Delta> rho (i+1)) (Opt (i+1) phi)\"\n| \"Cand i (Since phi I psi) = (if \\<tau> rho i < \\<tau> rho 0 + left I then [Inr (VSince_le i)]\n  else (let p1 = Opt i phi;\n  p2 = Opt i psi\n  in (if i = 0 then doSinceBase 0 0 p1 p2\n  else if right I \\<ge> enat (\\<Delta> rho i)\n  then doSince i (left I) p1 p2 (Opt (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi))\n  else doSinceBase i (left I) p1 p2)))\"\n| \"Cand i (Until phi I psi) = (let p1 = Opt i phi;\n  p2 = Opt i psi\n  in (if right I = \\<infinity> then undefined else if right I \\<ge> enat (\\<Delta> rho (i+1)) then\n  doUntil i (left I) p1 p2 (Opt (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi))\n  else doUntilBase i (left I) p1 p2))\"\n| \"Cand i (Once I phi) = (if \\<tau> rho i < \\<tau> rho 0 + left I then [Inr (VOnce_le i)]\n  else (let p = Opt i phi in \n  (if i = 0 then doOnceBase 0 0 p\n    else if right I \\<ge> enat (\\<Delta> rho i)\n    then doOnce i (left I) p (Opt (i-1) (Once (subtract (\\<Delta> rho i) I) phi))\n    else doOnceBase i (left I) p)))\"\n| \"Cand i (Historically I phi) = (if \\<tau> rho i < \\<tau> rho 0 + left I then [Inl (SHistorically_le i)]\n  else (let p = Opt i phi in \n  (if i = 0 then doHistoricallyBase 0 0 p\n    else if right I \\<ge> enat (\\<Delta> rho i)\n    then doHistorically i (left I) p (Opt (i-1) (Historically (subtract (\\<Delta> rho i) I) phi))\n    else doHistoricallyBase i (left I) p)))\"\n| \"Cand i (Eventually I phi) = (let p1 = Opt i phi\n  in (if right I = \\<infinity> then undefined else if right I \\<ge> enat (\\<Delta> rho (i+1)) then\n  doEventually i (left I) p1 (Opt (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi))\n  else doEventuallyBase i (left I) p1))\"\n| \"Cand i (Always I phi) = (let p1 = Opt i phi\n  in (if right I = \\<infinity> then undefined else if right I \\<ge> enat (\\<Delta> rho (i+1)) then\n  doAlways i (left I) p1 (Opt (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi))\n  else doAlwaysBase i (left I) p1))\"\n| \"Opt i phi = min_list_wrt wqo (Cand i phi)\"\n  by pat_completeness auto\n\nfun dist where\n  \"dist i (Since _ _ _) = i\"\n| \"dist i (Once _ _) = i\"\n| \"dist i (Historically _ _) = i\"\n| \"dist i (Eventually I _) = LTP rho (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> (\\<tau> rho i + n)) - i\"\n| \"dist i (Always I _) = LTP rho (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> (\\<tau> rho i + n)) - i\"\n| \"dist i (Until _ I _) = LTP rho (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> (\\<tau> rho i + n)) - i\"\n| \"dist _ _ = undefined\"\n\ntermination Cand\n  apply (relation \"measures\n    [\\<lambda>args. case args of Inl (_, \\<phi>) \\<Rightarrow> size \\<phi> | Inr (_, \\<phi>) \\<Rightarrow> size \\<phi>,\n     \\<lambda>args. case args of Inl (i, \\<phi>) \\<Rightarrow> dist i \\<phi> | Inr (i, \\<phi>) \\<Rightarrow> dist i \\<phi>,\n     \\<lambda>args. case args of Inl _ \\<Rightarrow> 0 | Inr _ \\<Rightarrow> 1]\")\n                      apply (auto simp: add.commute termination_simp)\n  subgoal for i _ I _ x\n  proof (induction i)\n    case 0\n    then show ?case\n      by (simp add: Suc_le_lessD i_ltp_to_tau)\n  next\n    case (Suc j)\n    then have ge0: \"\\<tau> rho (Suc j) + x \\<ge> \\<tau> rho 0\"\n      by (auto simp add: add_increasing add.commute)\n    then have \"\\<tau> rho (Suc (Suc j)) \\<le> \\<tau> rho (Suc j) + x\" using local.Suc by auto\n    then have \"Suc (Suc j) \\<le> LTP rho (\\<tau> rho (Suc j) + x)\"\n      using i_ltp_to_tau ge0 local.Suc by auto\n    then show ?case by (simp add: add.commute)\n  qed\n  subgoal for i I _ x\n  proof (induction i)\n    case 0\n    then show ?case\n      by (simp add: Suc_le_lessD i_ltp_to_tau)\n  next\n    case (Suc j)\n    then have ge0: \"\\<tau> rho (Suc j) + x \\<ge> \\<tau> rho 0\"\n      by (auto simp add: add_increasing add.commute)\n    then have \"\\<tau> rho (Suc (Suc j)) \\<le> \\<tau> rho (Suc j) + x\" using local.Suc by auto\n    then have \"Suc (Suc j) \\<le> LTP rho (\\<tau> rho (Suc j) + x)\"\n      using i_ltp_to_tau ge0 local.Suc by auto\n    then show ?case by (simp add: add.commute)\n  qed\n  subgoal for i I _ x\n  proof (induction i)\n    case 0\n    then show ?case\n      by (simp add: Suc_le_lessD i_ltp_to_tau)\n  next\n    case (Suc j)\n    then have ge0: \"\\<tau> rho (Suc j) + x \\<ge> \\<tau> rho 0\"\n      by (auto simp add: add_increasing add.commute)\n    then have \"\\<tau> rho (Suc (Suc j)) \\<le> \\<tau> rho (Suc j) + x\" using local.Suc by auto\n    then have \"Suc (Suc j) \\<le> LTP rho (\\<tau> rho (Suc j) + x)\"\n      using i_ltp_to_tau ge0 local.Suc by auto\n    then show ?case by (simp add: add.commute)\n  qed\n  done\nend\n\ndefinition \"valid rho i phi p = (case p of\n    Inl p \\<Rightarrow> s_check rho phi p \\<and> s_at p = i\n  | Inr p \\<Rightarrow> v_check rho phi p \\<and> v_at p = i)\"\n\ninductive checkApp :: \"('a sproof + 'a vproof) \\<Rightarrow> ('a sproof + 'a vproof) \\<Rightarrow> bool\" where\n  \"checkApp (Inl (SSince p1 p2)) (Inl r)\"\n| \"checkApp (Inl (SUntil p1 p2)) (Inl r)\"\n| \"p1 \\<noteq> [] \\<Longrightarrow> checkApp (Inl (SHistorically i li p1)) (Inl r)\"\n| \"p1 \\<noteq> [] \\<Longrightarrow> checkApp (Inl (SAlways i hi p1)) (Inl r)\"\n| \"p2 \\<noteq> [] \\<Longrightarrow> checkApp (Inr (VSince i p1 p2)) (Inr r)\"\n| \"p1 \\<noteq> [] \\<Longrightarrow> checkApp (Inr (VSince_never i li p1)) (Inr r)\"\n| \"p1 \\<noteq> [] \\<Longrightarrow> checkApp (Inr (VOnce i li p1)) (Inr r)\"\n| \"p1 \\<noteq> [] \\<Longrightarrow> checkApp (Inr (VEventually i hi p1)) (Inr r)\"\n| \"p1 \\<noteq> [] \\<Longrightarrow> checkApp (Inr (VUntil i p1 p2)) (Inr r)\"\n| \"p1 \\<noteq> [] \\<Longrightarrow> checkApp (Inr (VUntil_never i hi p1)) (Inr r)\"\n\ninductive checkIncr :: \"('a sproof + 'a vproof) \\<Rightarrow> bool\" where\n  \"s_at p \\<le> i \\<Longrightarrow> checkIncr (Inl (SOnce i p))\"\n| \"i \\<le> s_at p \\<Longrightarrow> checkIncr (Inl (SEventually i p))\"\n| \"(\\<And>p. p \\<in> set p1 \\<Longrightarrow> s_at p \\<le> i) \\<Longrightarrow> checkIncr (Inl (SHistorically i li p1))\"\n| \"(\\<And>p. p \\<in> set p1 \\<Longrightarrow> i \\<le> s_at p) \\<Longrightarrow> checkIncr (Inl (SAlways i hi p1))\"\n| \"(\\<And>p. p \\<in> set p1 \\<Longrightarrow> v_at p \\<le> i) \\<Longrightarrow> checkIncr (Inr (VOnce i li p1))\"\n| \"(\\<And>p. p \\<in> set p1 \\<Longrightarrow> i \\<le> v_at p) \\<Longrightarrow> checkIncr (Inr (VEventually i hi p1))\"\n| \"v_at p \\<le> i \\<Longrightarrow> checkIncr (Inr (VHistorically i p))\"\n| \"i \\<le> v_at p \\<Longrightarrow> checkIncr (Inr (VAlways i p))\"\n| \"v_at p1 \\<le> i \\<Longrightarrow> (\\<And>p. p \\<in> set p2 \\<Longrightarrow> v_at p \\<le> i) \\<Longrightarrow> checkIncr (Inr (VSince i p1 p2))\"\n| \"(\\<And>p. p \\<in> set p1 \\<Longrightarrow> v_at p \\<le> i) \\<Longrightarrow> checkIncr (Inr (VSince_never i li p1))\"\n| \"(\\<And>p. p \\<in> set p1 \\<Longrightarrow> i \\<le> v_at p) \\<Longrightarrow> i \\<le> v_at p2 \\<Longrightarrow> checkIncr (Inr (VUntil i p1 p2))\"\n| \"(\\<And>p. p \\<in> set p1 \\<Longrightarrow> i \\<le> v_at p) \\<Longrightarrow> checkIncr (Inr (VUntil_never i hi p1))\"\n\nlocale cmonotone = fixes wqo :: \"'a sproof + 'a vproof \\<Rightarrow> 'a sproof + 'a vproof \\<Rightarrow> bool\"\n  assumes\n    SNeg: \"\\<And>p p'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inl (SNeg p)) (Inl (SNeg p'))\"\n    and VNeg: \"\\<And>p p'. wqo (Inl p) (Inl p') \\<Longrightarrow> wqo (Inr (VNeg p)) (Inr (VNeg p'))\"\n    and SDisjL: \"\\<And>p p'. wqo (Inl p) (Inl p') \\<Longrightarrow> wqo (Inl (SDisjL p)) (Inl (SDisjL p'))\"\n    and SDisjR: \"\\<And>p p'. wqo (Inl p) (Inl p') \\<Longrightarrow> wqo (Inl (SDisjR p)) (Inl (SDisjR p'))\"\n    and VDisj: \"\\<And>p1 p1' p2 p2'. wqo (Inr p1) (Inr p1') \\<Longrightarrow> wqo (Inr p2) (Inr p2' ) \\<Longrightarrow>\n  wqo (Inr (VDisj p1 p2)) (Inr (VDisj p1' p2'))\"\n    and SConj: \"\\<And>p1 p1' p2 p2'. wqo (Inl p1) (Inl p1') \\<Longrightarrow> wqo (Inl p2) (Inl p2' ) \\<Longrightarrow>\n  wqo (Inl (SConj p1 p2)) (Inl (SConj p1' p2'))\"\n    and VConjL: \"\\<And>p p'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inr (VConjL p)) (Inr (VConjL p'))\"\n    and VConjR: \"\\<And>p p'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inr (VConjR p)) (Inr (VConjR p'))\"\n    and SImplR: \"\\<And>p p'. wqo (Inl p) (Inl p') \\<Longrightarrow> wqo (Inl (SImplR p)) (Inl (SImplR p'))\"\n    and SImplL: \"\\<And>p p'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inl (SImplL p)) (Inl (SImplL p'))\"\n    and VImpl: \"\\<And>p1 p1' p2 p2'. wqo (Inl p1) (Inl p1') \\<Longrightarrow> wqo (Inr p2) (Inr p2' ) \\<Longrightarrow>\n  wqo (Inr (VImpl p1 p2)) (Inr (VImpl p1' p2'))\"\n    and SIff_ss: \"\\<And>p1 p1' p2 p2'. wqo (Inl p1) (Inl p1') \\<Longrightarrow> wqo (Inl p2) (Inl p2' ) \\<Longrightarrow>\n  wqo (Inl (SIff_ss p1 p2)) (Inl (SIff_ss p1' p2'))\"\n    and SIff_vv: \"\\<And>p1 p1' p2 p2'. wqo (Inr p1) (Inr p1') \\<Longrightarrow> wqo (Inr p2) (Inr p2' ) \\<Longrightarrow>\n  wqo (Inl (SIff_vv p1 p2)) (Inl (SIff_vv p1' p2'))\"\n    and VIff_sv: \"\\<And>p1 p1' p2 p2'. wqo (Inl p1) (Inl p1') \\<Longrightarrow> wqo (Inr p2) (Inr p2' ) \\<Longrightarrow>\n  wqo (Inr (VIff_sv p1 p2)) (Inr (VIff_sv p1' p2'))\"\n    and VIff_vs: \"\\<And>p1 p1' p2 p2'. wqo (Inr p1) (Inr p1') \\<Longrightarrow> wqo (Inl p2) (Inl p2' ) \\<Longrightarrow>\n  wqo (Inr (VIff_vs p1 p2)) (Inr (VIff_vs p1' p2'))\"\n    and SOnce: \"\\<And>i p p'. wqo (Inl p) (Inl p') \\<Longrightarrow> wqo (Inl (SOnce i p)) (Inl (SOnce i p'))\"\n    and VOnce: \"\\<And>i li q q'. wqo (Inr q) (Inr q') \\<Longrightarrow>\n  wqo (Inr (VOnce i li [q])) (Inr (VOnce i li [q']))\"\n    and SHistorically: \"\\<And>i li q q'. wqo (Inl q) (Inl q') \\<Longrightarrow>\n  wqo (Inl (SHistorically i li [q])) (Inl (SHistorically i li [q']))\"\n    and VHistorically: \"\\<And>i p p'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inr (VHistorically i p)) (Inr (VHistorically i p'))\"\n    and SEventually: \"\\<And>i p p'. wqo (Inl p) (Inl p') \\<Longrightarrow> wqo (Inl (SEventually i p)) (Inl (SEventually i p'))\"\n    and VEventually: \"\\<And>i hi q q'. wqo (Inr q) (Inr q') \\<Longrightarrow>\n  wqo (Inr (VEventually i hi [q])) (Inr (VEventually i hi [q']))\"\n    and SAlways: \"\\<And>i hi q q'. wqo (Inl q) (Inl q') \\<Longrightarrow>\n  wqo (Inl (SAlways i hi [q])) (Inl (SAlways i hi [q']))\"\n    and VAlways: \"\\<And>i p p'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inr (VAlways i p)) (Inr (VAlways i p'))\"\n    and SSince: \"\\<And>p p'. wqo (Inl p) (Inl p') \\<Longrightarrow> wqo (Inl (SSince p [])) (Inl (SSince p' []))\"\n    and VSince_Nil: \"\\<And>i p p'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inr (VSince i p [])) (Inr (VSince i p' []))\"\n    and VSince: \"\\<And>i p p' q q'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inr q) (Inr q') \\<Longrightarrow>\n  wqo (Inr (VSince i p [q])) (Inr (VSince i p' [q']))\"\n    and VSince_never: \"\\<And>i li q q'. wqo (Inr q) (Inr q') \\<Longrightarrow>\n  wqo (Inr (VSince_never i li [q])) (Inr (VSince_never i li [q']))\"\n    and SUntil_Nil: \"\\<And>p p'. wqo (Inl p) (Inl p') \\<Longrightarrow>\n  wqo (Inl (SUntil [] p)) (Inl (SUntil [] p'))\"\n    and SUntil: \"\\<And>p p' q q'. wqo (Inl p) (Inl p') \\<Longrightarrow> wqo (Inl q) (Inl q') \\<Longrightarrow>\n  wqo (Inl (SUntil [q] p)) (Inl (SUntil [q'] p'))\"\n    and VUntil_Nil: \"\\<And>i p p'. wqo (Inr p) (Inr p') \\<Longrightarrow>\n  wqo (Inr (VUntil i [] p)) (Inr (VUntil i [] p'))\"\n    and VUntil: \"\\<And>i p p' q q'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inr q) (Inr q') \\<Longrightarrow>\n  wqo (Inr (VUntil i [q] p)) (Inr (VUntil i [q'] p'))\"\n    and VUntil_never: \"\\<And>i hi q q'. wqo (Inr q) (Inr q') \\<Longrightarrow>\n  wqo (Inr (VUntil_never i hi [q])) (Inr (VUntil_never i hi [q']))\"\n    and SNext: \"\\<And>p p'. wqo (Inl p) (Inl p') \\<Longrightarrow> wqo (Inl (SNext p)) (Inl (SNext p'))\"\n    and VNext: \"\\<And>p p'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inr (VNext p)) (Inr (VNext p'))\"\n    and SPrev: \"\\<And>p p'. wqo (Inl p) (Inl p') \\<Longrightarrow> wqo (Inl (SPrev p)) (Inl (SPrev p'))\"\n    and VPrev: \"\\<And>p p'. wqo (Inr p) (Inr p') \\<Longrightarrow> wqo (Inr (VPrev p)) (Inr (VPrev p'))\"\n    and proofApp_mono: \"\\<And>i phi p p' r r'. checkApp p r \\<Longrightarrow> checkApp p' r' \\<Longrightarrow> wqo p p' \\<Longrightarrow> wqo r r' \\<Longrightarrow>\n  valid rho i phi (p \\<oplus> r) \\<Longrightarrow> valid rho i phi (p' \\<oplus> r') \\<Longrightarrow> wqo (p \\<oplus> r) (p' \\<oplus> r')\"\n    and proofIncr_mono: \"\\<And>i phi p p'. checkIncr p \\<Longrightarrow> checkIncr p' \\<Longrightarrow> wqo p p' \\<Longrightarrow>\n  valid rho i phi p \\<Longrightarrow> valid rho i phi p' \\<Longrightarrow> wqo (proofIncr p) (proofIncr p')\"\n\nsubsection \\<open>Algorithm lemmas\\<close>\n\nlocale trans_wqo = cmonotone wqo + alg rho wqo \n  for wqo rho+\n  assumes refl_wqo: \"reflp wqo\"\n    and trans_wqo: \"transp wqo\"\n    and pw_total: \"\\<And>i \\<phi>. total_on wqo {p. valid rho i \\<phi> p}\"\nbegin\n\nlemma valid_OnceE: \"valid rho i (Once I phi) p \\<Longrightarrow>\n  (\\<And>i sphi. p = Inl (SOnce i sphi) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i li vphis. p = Inr (VOnce i li vphis) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i. p = Inr (VOnce_le i) \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (cases p)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  done\n\nlemma valid_EventuallyE: \"valid rho i (Eventually I phi) p \\<Longrightarrow>\n  (\\<And>i sphi. p = Inl (SEventually i sphi) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i hi vphis. p = Inr (VEventually i hi vphis) \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (cases p)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  done\n\nlemma valid_HistoricallyE: \"valid rho i (Historically I phi) p \\<Longrightarrow>\n  (\\<And>i vphi. p = Inr (VHistorically i vphi) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i li sphis. p = Inl (SHistorically i li sphis) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i. p = Inl (SHistorically_le i) \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (cases p)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  done\n\nlemma valid_AlwaysE: \"valid rho i (Always I phi) p \\<Longrightarrow>\n  (\\<And>i vphi. p = Inr (VAlways i vphi) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i hi sphis. p = Inl (SAlways i hi sphis) \\<Longrightarrow> P) \n  \\<Longrightarrow> P\"\n  apply (cases p)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  done\n\nlemma valid_SinceE: \"valid rho i (Since phi I psi) p \\<Longrightarrow>\n  (\\<And>spsi sphis. p = Inl (SSince spsi sphis) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i vphi vpsis. p = Inr (VSince i vphi vpsis) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i li vpsis. p = Inr (VSince_never i li vpsis) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i. p = Inr (VSince_le i) \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (cases p)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  done\n\nlemma valid_UntilE: \"\n  valid rho i (Until phi I psi) p \\<Longrightarrow>\n  (\\<And>spsi sphis. p = Inl (SUntil spsi sphis) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i vphi vpsis. p = Inr (VUntil i vphi vpsis) \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i hi vpsis. p = Inr (VUntil_never i hi vpsis) \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  apply (cases p)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  subgoal for x\n    by (cases x) (auto simp: valid_def)\n  done\n\nsimps_of_case proofApp_simps[simp]: proofApp_def\n\nlemma not_wqo:\n  \"valid rho i phi p1 \\<Longrightarrow> valid rho i phi p2 \\<Longrightarrow> \\<not> wqo p1 p2 \\<Longrightarrow> wqo p2 p1\"\n  using pw_total trans_wqo refl_wqo\n  by (metis mem_Collect_eq reflpD total_on_def)\n\ndefinition \"optimal i phi p = (valid rho i phi p \\<and> (\\<forall>q. valid rho i phi q \\<longrightarrow> wqo p q))\"\n\nlemma check_consistent:\n  assumes bf: \"bounded_future phi\"\n  shows \"s_check rho phi p \\<Longrightarrow> s_at p = v_at q \\<Longrightarrow> \\<not> v_check rho phi q\"\n  by (auto simp only: s_at.simps list.case dest!: check_sound\n      soundness[THEN conjunct1, THEN mp]\n      soundness[THEN conjunct2, THEN mp])\n\nlemma val_SAT_imp_l:\n  assumes bf: \"bounded_future phi\" and\n    val: \" valid rho i phi p\" and sat: \"SAT rho i phi\"\n  shows \"\\<exists>a. p = Inl a\"\n  using check_consistent[OF bf] check_complete[OF bf] assms unfolding valid_def\n  apply (cases p) apply auto\n  by blast\n\nlemma val_VIO_imp_r:\n  assumes bf: \"bounded_future phi\" and\n    val: \"valid rho i phi p\" and vio: \"VIO rho i phi\"\n  shows \"\\<exists>a. p = Inr a\"\n  using check_consistent[OF bf] check_complete[OF bf] assms unfolding valid_def\n  apply (cases p) apply auto\n  by fastforce\n\nlemma ETP_lt_delta: \"n < delta rho i (i - 1) \\<Longrightarrow> i = ETP rho (\\<tau> rho i - n)\" for n\n  apply (cases i)\n   apply auto\n  by (smt (verit, ccfv_threshold) add_diff_cancel_left' diff_is_0_eq' i_etp_to_tau leD le_add_diff_inverse2 le_diff_iff' le_trans less_or_eq_imp_le nat_le_linear not_less_eq not_less_eq_eq)\n\nlemma r_less_Delta_imp_less:\n  assumes \"(i > 0 \\<and> right I < enat (\\<Delta> rho i))\"\n  shows \"(\\<forall>j < i. \\<not> mem (delta rho i j) I)\"\nproof -\n  from \\<tau>_mono have j_le: \"\\<forall>j < i. \\<tau> rho j \\<le> \\<tau> rho (i-1)\" by auto\n  then show ?thesis using assms\n    apply (cases \"right I\") apply auto\n    by (smt One_nat_def Suc_leI diff_le_mono2 j_le le_trans not_less_eq_eq)\nqed\n\nlemma pastBase_constrs:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n  \\<and> right I < enat (\\<Delta> rho i)\" and\n    n_def: \"right I = enat n\" and j_def: \"j \\<le> (i-1)\"\n  shows \"j < ETP rho (\\<tau> rho i - n)\"\nproof -\n  from \\<tau>_mono j_def have tjs: \"\\<tau> rho j \\<le> \\<tau> rho (i-1)\" by auto\n  from i_props have \"n < \\<tau> rho i - \\<tau> rho (i-1)\" using n_def by auto\n  then have \"n < \\<tau> rho i - \\<tau> rho j\" using tjs \\<tau>_mono\n    by (metis add_less_le_mono diff_add diff_le_self less_diff_conv)\n  then have \"\\<tau> rho j < \\<tau> rho i - n\" by auto\n  then show ?thesis using less_\\<tau>D i_etp_to_tau leD leI\n    by blast\nqed\n\nlemma futureBase_constrs:\n  assumes n_def: \"right I = enat n\" and j_def: \"j \\<ge> (i+1)\"\n    and i_props: \"right I < enat (\\<Delta> rho (i+1))\"\n  shows \"LTP rho (\\<tau> rho i + n) < j\"\nproof -\n  from assms have tjs: \"\\<tau> rho (i+1) \\<le> \\<tau> rho j\" by auto\n  from i_props have \"n < \\<tau> rho (i+1) - \\<tau> rho i\" using n_def by auto\n  then have \"\\<tau> rho i + n < \\<tau> rho (i+1)\" by auto\n  then have \"\\<tau> rho i + n < \\<tau> rho j\" using j_def tjs less_le_trans\n    by blast\n  then show ?thesis using less_\\<tau>D i_ltp_to_tau leD leI\n    by (metis add_lessD1 add_less_same_cancel1 not_add_less1)\nqed\n\nlemma LTP_lt_delta: \"n < delta rho (Suc i) i \\<Longrightarrow> i = LTP rho (\\<tau> rho i + n)\"\n  using i_le_ltpi_add[of i rho n] i_ltp_to_tau[where ?i=\"Suc i\" and ?rho=rho and ?n=\"\\<tau> rho i + n\"]\n  using less_diff_conv trans_le_add1 by force\n\nlemma diff_cancel_middle:\n  fixes a b c :: nat\n  shows \"b + a \\<ge> c \\<Longrightarrow> a - (b + a - c) = c - b\"\n  by simp\n\nlemma map_set_in_imp_set_in:\n  \"\\<forall>p \\<in> set qs. v_check rho phi p\n  \\<Longrightarrow> \\<forall>j \\<in> set (map v_at qs). \\<exists>p \\<in> set qs. v_at p = j \\<and> v_check rho phi p\"\n  and\n  \"\\<forall>p \\<in> set ps. s_check rho phi p\n  \\<Longrightarrow> \\<forall>j \\<in> set (map s_at ps). \\<exists>p \\<in> set ps. s_at p = j \\<and> s_check rho phi p\"\n  by auto\n\nlemma mem_imp_ge_etp:\n  assumes mem: \"mem (delta rho (i-1) j) (subtract (\\<Delta> rho i) I)\"\n    and j_le_i: \"j \\<le> i-1\" and\n    i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I \\<and> right I \\<ge> enat (\\<Delta> rho i)\"\n  shows \"ETP rho (case right I of enat n \\<Rightarrow> \\<tau> rho i - n | _ \\<Rightarrow> 0) \\<le> j\"\nproof (cases \"right I\")\n  case (enat n)\n  from mem have \"delta rho (i-1) j \\<le> n + \\<tau> rho (i-1) - \\<tau> rho i\"\n    using i_props enat by auto\n  then have \"delta rho (i-1) j + \\<tau> rho i \\<le> n + \\<tau> rho (i-1)\"\n    apply auto\n    by (metis One_nat_def enat_ord_simps(1) i_props le_diff_conv le_diff_conv2 enat)\n  then show ?thesis by (auto simp add: i_etp_to_tau enat split: enat.splits)\nqed (auto simp add: i_etp_to_tau)\n\nlemma mem_imp_le_ltp:\n  assumes mem: \"mem (delta rho (i-1) j) (subtract (\\<Delta> rho i) I)\"\n    and j_le_i: \"j \\<le> i-1\" and\n    i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I \\<and> right I \\<ge> enat (\\<Delta> rho i)\"\n  shows \"j \\<le> LTP rho (\\<tau> rho i - left I)\"\nproof -\n  from mem have \"left I + \\<tau> rho (i-1) - \\<tau> rho i \\<le> delta rho (i-1) j\" by auto\n  then have \"left I + \\<tau> rho (i-1) - \\<tau> rho i + \\<tau> rho j \\<le> \\<tau> rho (i-1)\"\n    using j_le_i add_le_mono1[of \"left I + \\<tau> rho (i-1) - \\<tau> rho i\" \"delta rho (i-1) j\" \"\\<tau> rho j\"]\n    by auto\n  then have \"\\<tau> rho j \\<le> \\<tau> rho i - left I\" by auto\n  then show ?thesis using i_props by (auto simp add: i_ltp_to_tau)\nqed\n\nlemma i_props_imp_not_le:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n   \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and\n    p'_def: \"optimal (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n  shows \"p' \\<noteq> Inr (VSince_le (i-1))\"\nproof (rule ccontr)\n  assume p'_le: \"\\<not> p' \\<noteq> Inr (VSince_le (i-1))\"\n  then have \"\\<tau> rho (i-1) < \\<tau> rho 0 + (left I - \\<Delta> rho i)\" using p'_def\n    unfolding optimal_def valid_def by auto\n  then have \"\\<tau> rho (i-1) - \\<tau> rho 0 < left I - \\<Delta> rho i\" using i_props\n    by (simp add: less_diff_conv2)\n  then have i_le: \"\\<tau> rho i < \\<tau> rho 0 + left I\" by linarith\n  then show False using i_props by auto\nqed\n\nlemma i_props_imp_not_le_once:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n   \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and\n    p'_def: \"optimal (i-1) (Once (subtract (\\<Delta> rho i) I) phi) p'\"\n  shows \"p' \\<noteq> Inr (VOnce_le (i-1))\"\nproof (rule ccontr)\n  assume p'_le: \"\\<not> p' \\<noteq> Inr (VOnce_le (i-1))\"\n  then have \"\\<tau> rho (i-1) < \\<tau> rho 0 + (left I - \\<Delta> rho i)\" using p'_def\n    unfolding optimal_def valid_def by auto\n  then have \"\\<tau> rho (i-1) - \\<tau> rho 0 < left I - \\<Delta> rho i\" using i_props\n    by (simp add: less_diff_conv2)\n  then have i_le: \"\\<tau> rho i < \\<tau> rho 0 + left I\" by linarith\n  then show False using i_props by auto\nqed\n\nlemma i_props_imp_not_le_historically:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n   \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and\n    p'_def: \"optimal (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) p'\"\n  shows \"p' \\<noteq> Inl (SHistorically_le (i-1))\"\nproof (rule ccontr)\n  assume p'_le: \"\\<not> p' \\<noteq> Inl (SHistorically_le (i-1))\"\n  then have \"\\<tau> rho (i-1) < \\<tau> rho 0 + (left I - \\<Delta> rho i)\" using p'_def\n    unfolding optimal_def valid_def by auto\n  then have \"\\<tau> rho (i-1) - \\<tau> rho 0 < left I - \\<Delta> rho i\" using i_props\n    by (simp add: less_diff_conv2)\n  then have i_le: \"\\<tau> rho i < \\<tau> rho 0 + left I\" by linarith\n  then show False using i_props by auto\nqed\n\nlemma case_snoc: \"(case xs @ [x] of [] \\<Rightarrow> a | x # xs \\<Rightarrow> b) = b\"\n  by (cases xs; auto)\n\nlemma sval_to_sval':\n  assumes val: \"valid rho i (Since phi I psi) (Inl (SSince spsi (ys @ [y])))\" and\n    i_props: \"0 < i \\<and> \\<tau> rho 0 + left I \\<le> \\<tau> rho i \\<and> enat (\\<Delta> rho i) \\<le> right I\"\n  shows \"valid rho (i - 1) (Since phi (subtract (\\<Delta> rho i) I) psi)\n     (Inl (SSince spsi ys))\"\nproof -\n  from val have spsi_i: \"s_at spsi \\<le> s_at y\" unfolding valid_def\n    by (auto simp: Let_def case_snoc)\n  from val have y_i: \"s_at y = i\" unfolding valid_def\n    by (auto simp: Let_def case_snoc)\n  then have map_ys: \"map s_at ys = [Suc (s_at spsi) ..< i]\" using val\n    unfolding valid_def by (auto simp: Let_def case_snoc split: if_splits)\n  from val have \"left I - (\\<Delta> rho i) \\<le> \\<tau> rho (i-1) - \\<tau> rho (s_at spsi)\"\n    unfolding valid_def\n    apply (auto simp: Let_def case_snoc split: if_splits)\n    subgoal premises prems\n    proof -\n      from y_i prems(2) spsi_i have \"left I + \\<tau> rho (s_at spsi) \\<le> \\<tau> rho i\"\n        by (auto simp add: le_diff_conv2)\n      then show ?thesis using y_i by auto\n    qed\n    done\n  moreover have \"\\<And>n. right I = enat n \\<Longrightarrow> \\<tau> rho (i-1) - \\<tau> rho (s_at spsi) \\<le> n - (\\<Delta> rho i)\"\n    using val unfolding valid_def\n    by (auto simp: Let_def case_snoc split: if_splits)\n  ultimately have mem': \"mem (delta rho (i-1) (s_at spsi)) (subtract (\\<Delta> rho i) I)\"\n    by (cases \"right I\") auto\n  then show ?thesis\n  proof (cases ys rule: rev_cases)\n    case Nil\n    then show ?thesis using assms y_i zero_enat_def unfolding valid_def\n      by (auto simp add: Let_def le_diff_conv2 split: if_splits)\n  next\n    case (snoc as a)\n    then have \"s_at a = i - 1\" using map_ys\n      apply auto\n      by (metis Nil_is_append_conv Suc_pred append1_eq_conv not_Cons_self2 not_gr_zero upt_Suc upt_eq_Nil_conv)\n    then show ?thesis using mem' snoc assms y_i map_ys unfolding valid_def\n      apply (auto simp: Let_def case_snoc)\n      by (metis Suc_pred upt_Suc_append)\n  qed\nqed\n\nlemma etpi_imp_etp_suci:\n  assumes rI: \"n \\<ge> \\<Delta> rho i\"\n    and etpj: \"i > 0 \\<and> ETP rho (\\<tau> rho i - n) \\<le> j\"\n  shows \"ETP rho (\\<tau> rho (i-1) - (n - (\\<Delta> rho i))) \\<le> j\"\nproof -\n  have \"\\<tau> rho (i-1) - (n - (\\<Delta> rho i)) = \\<tau> rho i - n\"\n    using assms diff_diff_right[of \"\\<tau> rho (i-1)\" \"\\<tau> rho i\" n] by auto\n  then show ?thesis using etpj by (auto simp add: i_etp_to_tau)\nqed\n\nlemma val_ge_zero:\n  assumes pr: \"p = Inr p'\" and form_p': \"p' = VSince (i-1) p1 p2\"\n    and val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p\"\n  shows \"\\<tau> rho 0 \\<le> \\<tau> rho (i-1) - (left I - (\\<Delta> rho i))\"\n  using assms unfolding valid_def by (auto simp: Let_def)\n\nlemma val_ge_zero_never:\n  assumes pr: \"p = Inr p'\" and form_p': \"p' = VSince_never (i-1) li p1\"\n    and val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p\"\n  shows \"\\<tau> rho 0 \\<le> \\<tau> rho (i-1) - (left I - (\\<Delta> rho i))\"\n  using assms unfolding valid_def\n  by (auto simp: Let_def split: enat.splits)\n\nlemma val_ge_zero_never_once:\n  assumes pr: \"p = Inr p'\" and form_p': \"p' = VOnce (i-1) li p1\"\n    and val: \"valid rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi) p\"\n  shows \"\\<tau> rho 0 \\<le> \\<tau> rho (i-1) - (left I - (\\<Delta> rho i))\"\n  using assms unfolding valid_def\n  by (auto simp: Let_def split: enat.splits)\n\nlemma val_ge_zero_never_historically:\n  assumes pl: \"p = Inl p'\" and form_p': \"p' = SHistorically (i-1) li p1\"\n    and val: \"valid rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) p\"\n  shows \"\\<tau> rho 0 \\<le> \\<tau> rho (i-1) - (left I - (\\<Delta> rho i))\"\n  using assms unfolding valid_def\n  by (auto simp: Let_def split: enat.splits)\n\nlemma i_to_predi_props:\n  assumes \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I \\<and> right I \\<ge> enat (\\<Delta> rho i)\"\n  shows \"\\<tau> rho 0 + (left I + \\<tau> rho (i - Suc 0) - \\<tau> rho i) \\<le> \\<tau> rho (i - Suc 0)\"\nproof -\n  from assms have \"(left I + \\<tau> rho (i-1) - \\<tau> rho i) \\<le> \\<tau> rho (i-1) - \\<tau> rho 0\"\n    by auto\n  then show ?thesis using le_diff_conv2 by auto\nqed\n\nlemma predi_eq_ltp:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n   \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and \"\\<tau> rho (i-1) \\<le> \\<tau> rho (i-1) - (left I + \\<tau> rho (i-1) - \\<tau> rho i)\"\n    and i_g_ltp: \"i > LTP rho (\\<tau> rho i - left I)\"\n  shows \"(i-1) = LTP rho (\\<tau> rho i - left I)\"\nproof -\n  from assms have \"\\<tau> rho (i-1) \\<le> \\<tau> rho i - left I\" by auto\n  then show ?thesis using i_g_ltp i_props apply (auto simp add: i_ltp_to_tau)\n    by (metis Suc_pred add_le_imp_le_diff i_ltp_to_tau i_props le_less_Suc_eq)\nqed\n\nlemma predi_val_props:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n   \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and j_le: \"\\<tau> rho j \\<le> \\<tau> rho i - left I\"\n    and j_le_predi: \"j \\<le> i-1\"\n  shows \"\\<tau> rho j \\<le> \\<tau> rho (i-1) - (left I + \\<tau> rho (i-1) - \\<tau> rho i)\"\nproof -\n  from assms have \"\\<tau> rho j - \\<tau> rho (i-1) \\<le> \\<tau> rho i - left I - \\<tau> rho (i-1) \"\n    by auto\n  then have \"\\<tau> rho j + left I + \\<tau> rho (i-1) - \\<tau> rho i \\<le> \\<tau> rho (i-1)\"\n    apply auto\n    by (metis (no_types, lifting) add.commute le_diff_conv2 add_leD2 add_le_cancel_left i_props j_le le_diff_conv)\n  then have \"(left I + \\<tau> rho (i-1) - \\<tau> rho i) \\<le> \\<tau> rho (i-1) - \\<tau> rho j\"\n    by auto\n  then have \"\\<tau> rho j + (left I + \\<tau> rho (i-1) - \\<tau> rho i) \\<le> \\<tau> rho (i-1)\" using j_le_predi\n    by (auto simp add: le_diff_conv2)\n  then show ?thesis using assms by auto\nqed\n\nlemma sval_to_sval'_u:\n  assumes val: \"valid rho i (Until phi I psi) (Inl (SUntil (y # ys) spsi))\" and\n    i_props: \"enat (\\<Delta> rho (i+1)) \\<le> right I\"\n    and rI: \"right I = enat n\"\n  shows \"valid rho (i + 1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi)\n     (Inl (SUntil ys spsi))\"\nproof -\n  from val have spsi_i: \"s_at spsi \\<ge> s_at y\" unfolding valid_def\n    by (auto simp: Let_def)\n  from val have y_i: \"s_at y = i\" unfolding valid_def\n    by (auto simp: Let_def)\n  then have map_ys: \"map s_at ys = [Suc i ..< s_at spsi]\" using val\n    unfolding valid_def by (auto simp: Let_def Cons_eq_upt_conv split: if_splits)\n  from val have \"left I - (\\<Delta> rho (i+1)) \\<le> \\<tau> rho (s_at spsi) - \\<tau> rho (i+1)\"\n    unfolding valid_def\n    apply (auto simp: Let_def split: if_splits)\n    subgoal premises prems\n    proof -\n      from y_i prems(1-2) spsi_i have \"left I + \\<tau> rho i \\<le> \\<tau> rho (s_at spsi)\"\n        by (auto simp add: le_diff_conv2)\n      then show ?thesis using y_i by auto\n    qed\n    done\n  moreover have \"\\<tau> rho (s_at spsi) - \\<tau> rho (i+1) \\<le> n - (\\<Delta> rho (i+1))\"\n    using val rI unfolding valid_def\n    by (auto simp: Let_def split: if_splits)\n  ultimately have mem': \"mem (delta rho (s_at spsi) (i+1)) (subtract (\\<Delta> rho (i+1)) I)\"\n    using rI by auto\n  then show ?thesis\n  proof (cases ys)\n    case Nil\n    then show ?thesis using assms y_i map_ys unfolding valid_def\n      apply (auto simp add: Let_def le_diff_conv2 split: if_splits)\n      prefer 2\n      apply (metis le_Suc_eq neq_Nil_conv upt_eq_Nil_conv)\n      by (metis le_Suc_eq not_Cons_self2 upt_eq_Nil_conv)\n  next\n    case (Cons a as)\n    then have \"s_at a = i + 1\" using map_ys\n      by (auto simp add: Cons_eq_upt_conv)\n    then show ?thesis using mem' Cons assms y_i map_ys unfolding valid_def\n      apply (auto simp: Let_def)\n      by (meson Cons_eq_upt_conv nat_less_le)\n  qed\nqed\n\nlemma mem_imp_le_ltp_u:\n  assumes mem: \"mem (delta rho j (Suc i)) (subtract (\\<Delta> rho (Suc i)) I)\" and\n    j_ge: \"j \\<ge> Suc i\" and rI: \"right I = enat n\" and i_props: \"\\<Delta> rho (Suc i) \\<le> n\"\n  shows \"j \\<le> LTP rho (\\<tau> rho i + n)\"\n  using assms apply (auto simp add: add.commute i_le_ltpi_add)\n  by (metis add.commute i_le_ltpi_add le_add_diff_inverse le_diff_conv)\n\nlemma mem_imp_ge_etp_u:\n  assumes mem: \"mem (delta rho j (Suc i)) (subtract (\\<Delta> rho (Suc i)) I)\" and\n    j_ge: \"j \\<ge> Suc i\" and rI: \"right I = enat n\" and i_props: \"\\<Delta> rho (Suc i) \\<le> n\"\n  shows \"j \\<ge> ETP rho (\\<tau> rho i + left I)\"\nproof -\n  from assms have \"left I \\<le> \\<tau> rho j - \\<tau> rho i\" using le_diff_conv by auto\n  then show ?thesis using j_ge le_diff_conv2 by (auto simp add: i_etp_to_tau)\nqed\n\nlemma i_to_suci_le:\n  assumes \"left I + \\<tau> rho i \\<le> \\<tau> rho j\" and \"\\<tau> rho (Suc i) \\<le> \\<tau> rho j\"\n  shows \"\\<tau> rho (Suc i) + (left I + \\<tau> rho i - \\<tau> rho (Suc i)) \\<le> \\<tau> rho j\"\n  using le_diff_conv2 assms by auto\n\nlemma r_less_imp_nphi:\n  assumes \"right I < enat (\\<Delta> rho (i+1))\"\n  shows \"\\<forall>j > i. \\<not> mem (delta rho j i) I\"\nproof -\n  from \\<tau>_mono have j_to_tau: \"\\<forall>j \\<ge> i. \\<tau> rho i \\<le> \\<tau> rho j\" by auto\n  then show ?thesis using assms\n    apply (cases \"right I\") apply auto\n    by (smt add.commute add_diff_cancel_right' diff_le_self j_to_tau le_less_trans less_\\<tau>D less_diff_iff less_imp_le_nat not_less_eq plus_1_eq_Suc)\nqed\n\nsection \\<open>Soundness and Optimality (algorithm)\\<close>\n\nsubsection \\<open>Operator: Disj\\<close>\n\nlemma disj_sound:\n  assumes p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\"\n    and p_def: \"p \\<in> set (doDisj p1 p2)\"\n  shows \"valid rho i (Disj phi psi) p\"\nproof (cases p1)\n  case (Inl a)\n  then have p1s: \"p1 = Inl a\" by auto\n  then show ?thesis\n  proof (cases p2)\n    case (Inl a2)\n    then have sp: \"p = Inl (SDisjL a) \\<or> p = Inl (SDisjR a2)\"\n      using p_def p1s local.Inl unfolding doDisj_def valid_def by auto\n    then show ?thesis using Inl p_def p1_def p2_def p1s\n      unfolding optimal_def valid_def\n      by auto\n  next\n    case (Inr b2)\n    then have \"p = Inl (SDisjL a)\"\n      using p_def local.Inl unfolding doDisj_def by simp\n    then show ?thesis using p_def p1_def p2_def p1s Inr\n      unfolding optimal_def valid_def by auto\n  qed\nnext\n  case (Inr b)\n  then have p1v: \"p1 = Inr b\" by auto\n  then show ?thesis\n  proof (cases p2)\n    case (Inl a2)\n    then have \"p = Inl (SDisjR a2)\" using p_def Inr unfolding doDisj_def\n      by auto\n    then show ?thesis using p2_def Inl p1_def p_def\n      unfolding optimal_def valid_def by auto\n  next\n    case (Inr b2)\n    then have \"p = Inr (VDisj b b2)\" using p_def p1v unfolding doDisj_def\n      by auto\n    then show ?thesis using p_def p1_def p2_def local.Inr p1v\n      unfolding optimal_def valid_def by auto\n  qed\nqed\n\nlemma disj_optimal:\n  assumes bf: \"bounded_future (Disj phi psi)\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\"\n  shows \"optimal i (Disj phi psi) (min_list_wrt wqo (doDisj p1 p2))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  have bf_psi: \"bounded_future psi\"\n    using bf by auto\n  from p1_def p2_def have nnil: \"doDisj p1 p2 \\<noteq> []\"\n    using doDisj_def[of p1 p2]\n    by (cases p1; cases p2; auto)\n  assume nopt: \"\\<not> optimal i (Disj phi psi) (min_list_wrt wqo (doDisj p1 p2))\"\n  from disj_sound[OF p1_def p2_def min_list_wrt_in[of \"doDisj p1 p2\" wqo]]\n    refl_wqo trans_wqo pw_total nnil\n  have vmin: \"valid rho i (Disj phi psi) (min_list_wrt wqo (doDisj p1 p2))\"\n    apply auto\n    by (metis disj_sound not_wqo p1_def p2_def total_onI)\n  from this nopt obtain q where q_val: \"valid rho i (Disj phi psi) q\" and\n    q_le: \"\\<not> wqo (min_list_wrt wqo (doDisj p1 p2)) q\"\n    unfolding optimal_def by auto\n  then have \"wqo (min_list_wrt wqo (doDisj p1 p2)) q\"\n  proof(cases q)\n    case (Inl a)\n    {fix p\n      assume al: \"a = SDisjL p\"\n      then have p_val: \"valid rho i phi (Inl p)\" using q_val Inl unfolding valid_def by auto\n      obtain p1' where p1'_def: \"p1 = Inl p1'\"\n        using p_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo p1 (Inl p)\" using p_val p1_def unfolding optimal_def by auto\n      then have \"wqo (Inl (SDisjL (projl p1))) q\"\n        using al Inl SDisjL p1'_def by auto\n      moreover have \"Inl (SDisjL (projl p1)) \\<in> set (doDisj p1 p2)\"\n        using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n        by (auto simp add: doDisj_def optimal_def valid_def split: sum.splits)\n      ultimately have \"wqo (min_list_wrt wqo (doDisj p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo]\n          disj_sound[OF p1_def p2_def] pw_total[of i \"Disj phi psi\"] trans_wqo\n        by (metis not_wqo total_on_def transpE)\n    } note * = this\n    {fix p\n      assume ar: \"a = SDisjR p\"\n      then have p_val: \"valid rho i psi (Inl p)\" using q_val Inl unfolding valid_def by auto\n      obtain p2' where p2'_def: \"p2 = Inl p2'\"\n        using p_val p2_def check_consistent[OF bf_psi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo p2 (Inl p)\" using p_val p2_def unfolding optimal_def by auto\n      then have \"wqo (Inl (SDisjR (projl p2))) q\"\n        using ar Inl SDisjR p2'_def by auto\n      moreover have \"Inl (SDisjR (projl p2)) \\<in> set (doDisj p1 p2)\"\n        using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n        by (auto simp add: doDisj_def optimal_def valid_def split: sum.splits)\n      ultimately have \"wqo (min_list_wrt wqo (doDisj p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo]\n          disj_sound[OF p1_def p2_def] pw_total[of i \"Disj phi psi\"] trans_wqo\n        by (metis not_wqo total_on_def transpE)\n    } note ** = this\n    then show ?thesis using * ** q_val Inl unfolding valid_def doDisj_def\n      by (cases a) auto\n  next\n    case (Inr b)\n    then obtain p and p' where formq: \"b = VDisj p p'\" using q_val\n      unfolding valid_def by (cases b) auto\n    then have p_val: \"valid rho i phi (Inr p) \\<and> valid rho i psi (Inr p')\" using q_val Inr\n      unfolding valid_def by auto\n    then have sub: \"wqo p1 (Inr p) \\<and> wqo p2 (Inr p')\" using p1_def p2_def formq\n      unfolding optimal_def by auto\n    obtain p1' where p1'_def: \"p1 = Inr p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    obtain p2' where p2'_def: \"p2 = Inr p2'\"\n      using p_val p2_def check_consistent[OF bf_psi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inr (VDisj (projr p1) (projr p2))) (Inr b)\"\n      using formq VDisj p1'_def p2'_def sub by auto\n    moreover have \"Inr (VDisj (projr p1) (projr p2)) \\<in> set (doDisj p1 p2)\"\n      using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n      by (auto simp add: doDisj_def optimal_def valid_def split: sum.splits)\n    ultimately show ?thesis\n      using min_list_wrt_le[OF _ refl_wqo] disj_sound[OF p1_def p2_def]\n        pw_total[of i \"Disj phi psi\"] trans_wqo Inr\n      apply (auto simp add: total_on_def)\n      by (metis transpD)\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Conj\\<close>\n\nlemma conj_sound:\n  assumes p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\"\n    and p_def: \"p \\<in> set (doConj p1 p2)\"\n  shows \"valid rho i (Conj phi psi) p\"\nproof (cases p1)\n  case (Inr a)\n  then have p1s: \"p1 = Inr a\" by auto\n  then show ?thesis\n  proof (cases p2)\n    case (Inr a2)\n    then have vp: \"p = Inr (VConjL a) \\<or> p = Inr (VConjR a2)\"\n      using p_def p1s local.Inr unfolding doConj_def valid_def by auto\n    then show ?thesis using Inr p_def p1_def p2_def p1s\n      unfolding optimal_def valid_def\n      by auto\n  next\n    case (Inl b2)\n    then have \"p = Inr (VConjL a)\"\n      using p_def p1s local.Inl unfolding doConj_def by simp\n    then show ?thesis using p_def p1_def p2_def p1s Inr\n      unfolding optimal_def valid_def by auto\n  qed\nnext\n  case (Inl b)\n  then have p1v: \"p1 = Inl b\" by auto\n  then show ?thesis\n  proof (cases p2)\n    case (Inr a2)\n    then have \"p = Inr (VConjR a2)\" using p_def Inl unfolding doConj_def\n      by auto\n    then show ?thesis using p2_def Inr p1_def p_def\n      unfolding optimal_def valid_def by auto\n  next\n    case (Inl b2)\n    then have \"p = Inl (SConj b b2)\" using p_def p1v unfolding doConj_def\n      by auto\n    then show ?thesis using p_def p1_def p2_def local.Inl p1v\n      unfolding optimal_def valid_def by auto\n  qed\nqed\n\nlemma conj_optimal:\n  assumes bf: \"bounded_future (Conj phi psi)\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\"\n  shows \"optimal i (Conj phi psi) (min_list_wrt wqo (doConj p1 p2))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  have bf_psi: \"bounded_future psi\"\n    using bf by auto\n  from p1_def p2_def have nnil: \"doConj p1 p2 \\<noteq> []\"\n    using doConj_def[of p1 p2]\n    by (cases p1; cases p2; auto)\n  assume nopt: \"\\<not> optimal i (Conj phi psi) (min_list_wrt wqo (doConj p1 p2))\"\n  from conj_sound[OF p1_def p2_def min_list_wrt_in[of \"doConj p1 p2\" wqo]]\n    refl_wqo trans_wqo pw_total nnil\n  have vmin: \"valid rho i (Conj phi psi) (min_list_wrt wqo (doConj p1 p2))\"\n    apply auto\n    by (metis conj_sound not_wqo p1_def p2_def total_onI)\n  from this nopt obtain q where q_val: \"valid rho i (Conj phi psi) q\" and\n    q_le: \"\\<not> wqo (min_list_wrt wqo (doConj p1 p2)) q\"\n    unfolding optimal_def by auto\n  then have \"wqo (min_list_wrt wqo (doConj p1 p2)) q\"\n  proof(cases q)\n    case (Inr a)\n    {fix p\n      assume al: \"a = VConjL p\"\n      then have p_val: \"valid rho i phi (Inr p)\" using q_val Inr unfolding valid_def by auto\n      obtain p1' where p1'_def: \"p1 = Inr p1'\"\n        using p_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo p1 (Inr p)\" using p_val p1_def unfolding optimal_def by auto\n      then have \"wqo (Inr (VConjL (projr p1))) q\"\n        using al Inr VConjL p1'_def by auto\n      moreover have \"Inr (VConjL (projr p1)) \\<in> set (doConj p1 p2)\"\n        using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n        by (auto simp add: doConj_def optimal_def valid_def split: sum.splits)\n      ultimately have \"wqo (min_list_wrt wqo (doConj p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo]\n          conj_sound[OF p1_def p2_def] pw_total[of i \"Conj phi psi\"] trans_wqo\n        by (metis not_wqo total_on_def transpE)\n    } note * = this\n    {fix p\n      assume ar: \"a = VConjR p\"\n      then have p_val: \"valid rho i psi (Inr p)\" using q_val Inr unfolding valid_def by auto\n      obtain p2' where p2'_def: \"p2 = Inr p2'\"\n        using p_val p2_def check_consistent[OF bf_psi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo p2 (Inr p)\" using p_val p2_def unfolding optimal_def by auto\n      then have \"wqo (Inr (VConjR (projr p2))) q\"\n        using ar Inr VConjR p2'_def by auto\n      moreover have \"Inr (VConjR (projr p2)) \\<in> set (doConj p1 p2)\"\n        using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n        by (auto simp add: doConj_def optimal_def valid_def split: sum.splits)\n      ultimately have \"wqo (min_list_wrt wqo (doConj p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo]\n          conj_sound[OF p1_def p2_def] pw_total[of i \"Conj phi psi\"] trans_wqo\n        by (metis not_wqo total_on_def transpE)\n    } note ** = this\n    then show ?thesis using * ** q_val Inr unfolding valid_def doConj_def\n      by (cases a) auto\n  next\n    case (Inl b)\n    then obtain p and p' where formq: \"b = SConj p p'\" using q_val\n      unfolding valid_def by (cases b) auto\n    then have p_val: \"valid rho i phi (Inl p) \\<and> valid rho i psi (Inl p')\" using q_val Inl\n      unfolding valid_def by auto\n    then have sub: \"wqo p1 (Inl p) \\<and> wqo p2 (Inl p')\" using p1_def p2_def formq\n      unfolding optimal_def by auto\n    obtain p1' where p1'_def: \"p1 = Inl p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    obtain p2' where p2'_def: \"p2 = Inl p2'\"\n      using p_val p2_def check_consistent[OF bf_psi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inl (SConj (projl p1) (projl p2))) (Inl b)\"\n      using formq SConj p1'_def p2'_def sub by auto\n    moreover have \"Inl (SConj (projl p1) (projl p2)) \\<in> set (doConj p1 p2)\"\n      using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n      by (auto simp add: doConj_def optimal_def valid_def split: sum.splits)\n    ultimately show ?thesis\n      using min_list_wrt_le[OF _ refl_wqo] conj_sound[OF p1_def p2_def]\n        pw_total[of i \"Conj phi psi\"] trans_wqo Inl\n      apply (auto simp add: total_on_def)\n      by (metis transpD)\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Impl\\<close>\n\nlemma impl_sound:\n  assumes p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\"\n    and p_def: \"p \\<in> set (doImpl p1 p2)\"\n  shows \"valid rho i (Impl phi psi) p\"\nproof (cases p1)\n  case (Inr va)\n  then have vp1: \"p1 = Inr va\" \n    by simp\n  then show ?thesis\n  proof (cases p2)\n    case (Inr vb)\n    then have sp: \"p = Inl (SImplL va)\"\n      using p_def vp1 Inr unfolding doImpl_def valid_def \n      by simp\n    then show ?thesis using Inr p_def p1_def p2_def vp1\n      unfolding optimal_def valid_def\n      by simp\n  next\n    case (Inl sb)\n    then have sp: \"p = Inl (SImplL va) \\<or> p = Inl (SImplR sb)\"\n      using p_def vp1 Inl unfolding doImpl_def valid_def\n      by simp\n    then show ?thesis using Inl p_def p1_def p2_def vp1\n      unfolding optimal_def valid_def \n      by auto\n  qed\nnext\n  case (Inl sa)\n  then have sp1: \"p1 = Inl sa\" \n    by simp\n  then show ?thesis\n  proof (cases p2)\n    case (Inr vb)\n    then have vp: \"p = Inr (VImpl sa vb)\" \n      using p_def Inl unfolding doImpl_def \n      by simp\n    then show ?thesis using Inr p_def p1_def p2_def sp1\n      unfolding optimal_def valid_def \n      by simp\n  next\n    case (Inl sb)\n    then have sp: \"p = Inl (SImplR sb)\"\n      using p_def Inl sp1 unfolding doImpl_def\n      by simp\n    then show ?thesis using Inl p_def p1_def p2_def sp1\n      unfolding optimal_def valid_def \n      by simp\n  qed\nqed\n\nlemma impl_optimal:\n  assumes bf: \"bounded_future (Impl phi psi)\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\"\n  shows \"optimal i (Impl phi psi) (min_list_wrt wqo (doImpl p1 p2))\"\nproof(rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  have bf_psi: \"bounded_future psi\"\n    using bf by auto\n  from p1_def p2_def have nnil: \"doImpl p1 p2 \\<noteq> []\"\n    using doImpl_def[of p1 p2]\n    by (cases p1; cases p2; auto)\n  assume nopt: \"\\<not> optimal i (Impl phi psi) (min_list_wrt wqo (doImpl p1 p2))\"\n  from impl_sound[OF p1_def p2_def min_list_wrt_in[of \"doImpl p1 p2\" wqo]]\n    refl_wqo trans_wqo pw_total nnil\n  have vmin: \"valid rho i (Impl phi psi) (min_list_wrt wqo (doImpl p1 p2))\"\n    apply auto\n    by (metis impl_sound not_wqo p1_def p2_def total_onI)\n  from this nopt \n  obtain q where q_val: \"valid rho i (Impl phi psi) q\" and\n    q_le: \"\\<not> wqo (min_list_wrt wqo (doImpl p1 p2)) q\"\n    unfolding optimal_def \n    by auto\n  then have \"wqo (min_list_wrt wqo (doImpl p1 p2)) q\"\n  proof(cases q)\n    case (Inr a)\n    then obtain p and p' where formq: \"a = VImpl p p'\" using q_val\n      unfolding valid_def by (cases a) auto\n    then have p_val: \"valid rho i phi (Inl p) \\<and> valid rho i psi (Inr p')\" using q_val Inr\n      unfolding valid_def by auto\n    then have sub: \"wqo p1 (Inl p) \\<and> wqo p2 (Inr p')\" using p1_def p2_def formq\n      unfolding optimal_def by auto\n    obtain p1' where p1'_def: \"p1 = Inl p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    obtain p2' where p2'_def: \"p2 = Inr p2'\"\n      using p_val p2_def check_consistent[OF bf_psi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inr (VImpl (projl p1) (projr p2))) (Inr a)\"\n      using formq VImpl p1'_def p2'_def sub by auto\n    moreover have \"Inr (VImpl (projl p1) (projr p2)) \\<in> set (doImpl p1 p2)\"\n      using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n      by (auto simp add: doImpl_def optimal_def valid_def split: sum.splits)\n    ultimately show ?thesis\n      using min_list_wrt_le[OF _ refl_wqo] impl_sound[OF p1_def p2_def]\n        pw_total[of i \"Impl phi psi\"] trans_wqo Inr\n      apply (auto simp add: total_on_def)\n      by (metis transpD)\n  next\n    case (Inl b)\n    {fix p\n      assume al: \"b = SImplL p\"\n      then have p_val: \"valid rho i phi (Inr p)\" using q_val Inl unfolding valid_def \n        by auto\n      obtain p1' where p1'_def: \"p1 = Inr p1'\"\n        using p_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo p1 (Inr p)\" using p_val p1_def unfolding optimal_def by auto\n      then have \"wqo (Inl (SImplL (projr p1))) q\"\n        using al Inl SImplL p1'_def by auto\n      moreover have \"Inl (SImplL (projr p1)) \\<in> set (doImpl p1 p2)\"\n        using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n        by (auto simp add: doImpl_def optimal_def valid_def split: sum.splits)\n      ultimately have \"wqo (min_list_wrt wqo (doImpl p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo]\n          impl_sound[OF p1_def p2_def] pw_total[of i \"Impl phi psi\"] trans_wqo\n        by (metis not_wqo total_on_def transpE)\n    } note * = this\n    {fix p\n      assume ar: \"b = SImplR p\"\n      then have p_val: \"valid rho i psi (Inl p)\" using q_val Inl unfolding valid_def by auto\n      obtain p2' where p2'_def: \"p2 = Inl p2'\"\n        using p_val p2_def check_consistent[OF bf_psi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo p2 (Inl p)\" using p_val p2_def unfolding optimal_def by auto\n      then have \"wqo (Inl (SImplR (projl p2))) q\"\n        using ar Inl SImplR p2'_def by auto\n      moreover have \"Inl (SImplR (projl p2)) \\<in> set (doImpl p1 p2)\"\n        using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n        by (auto simp add: doImpl_def optimal_def valid_def split: sum.splits)\n      ultimately have \"wqo (min_list_wrt wqo (doImpl p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo]\n          impl_sound[OF p1_def p2_def] pw_total[of i \"Impl phi psi\"] trans_wqo\n        by (metis not_wqo total_on_def transpE)\n    } note ** = this\n    then show ?thesis using * ** q_val Inl unfolding valid_def doImpl_def\n      by (cases b) auto\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Iff\\<close>\n\nlemma iff_sound:\n  assumes p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\"\n    and p_def: \"p \\<in> set (doIff p1 p2)\"\n  shows \"valid rho i (Iff phi psi) p\"\nproof (cases p1)\n  case (Inr va)\n  then have vp1: \"p1 = Inr va\" \n    by simp\n  then show ?thesis\n  proof (cases p2)\n    case (Inr vb)\n    then have sp: \"p = Inl (SIff_vv va vb)\"\n      using p_def vp1 unfolding doIff_def valid_def \n      by simp\n    then show ?thesis using Inr p_def p1_def p2_def vp1\n      unfolding optimal_def valid_def\n      by simp\n  next\n    case (Inl sb)\n    then have vp: \"p = Inr (VIff_vs va sb)\"\n      using p_def vp1 Inl unfolding doIff_def valid_def\n      by simp\n    then show ?thesis using Inl p_def p1_def p2_def vp1\n      unfolding optimal_def valid_def \n      by simp\n  qed\nnext\n  case (Inl sa)\n  then have sp1: \"p1 = Inl sa\" \n    by simp\n  then show ?thesis\n  proof (cases p2)\n    case (Inr vb)\n    then have vp: \"p = Inr (VIff_sv sa vb)\" \n      using p_def Inl unfolding doIff_def \n      by simp\n    then show ?thesis using Inr p_def p1_def p2_def sp1\n      unfolding optimal_def valid_def \n      by simp\n  next\n    case (Inl sb)\n    then have sp: \"p = Inl (SIff_ss sa sb)\"\n      using p_def Inl sp1 unfolding doIff_def\n      by simp\n    then show ?thesis using Inl p_def p1_def p2_def sp1\n      unfolding optimal_def valid_def \n      by simp\n  qed\nqed\n\nlemma iff_optimal:\n  assumes bf: \"bounded_future (Iff phi psi)\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\"\n  shows \"optimal i (Iff phi psi) (min_list_wrt wqo (doIff p1 p2))\"\nproof(rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  have bf_psi: \"bounded_future psi\"\n    using bf by auto\n  from p1_def p2_def have nnil: \"doIff p1 p2 \\<noteq> []\"\n    using doIff_def[of p1 p2]\n    by (cases p1; cases p2; auto)\n  assume nopt: \"\\<not> optimal i (Iff phi psi) (min_list_wrt wqo (doIff p1 p2))\"\n  from iff_sound[OF p1_def p2_def min_list_wrt_in[of \"doIff p1 p2\" wqo]]\n    refl_wqo trans_wqo pw_total nnil\n  have vmin: \"valid rho i (Iff phi psi) (min_list_wrt wqo (doIff p1 p2))\"\n    apply auto\n    by (metis iff_sound not_wqo p1_def p2_def total_onI)\n  from this nopt\n  obtain q where q_val: \"valid rho i (Iff phi psi) q\" and\n    q_le: \"\\<not> wqo (min_list_wrt wqo (doIff p1 p2)) q\"\n    unfolding optimal_def \n    by auto\n  then have \"wqo (min_list_wrt wqo (doIff p1 p2)) q\"\n  proof(cases q)\n    case (Inr a)\n    {fix p p'\n      assume formq: \"a = VIff_sv p p'\"\n      then have p_val: \"valid rho i phi (Inl p) \\<and> valid rho i psi (Inr p')\" using q_val Inr\n        unfolding valid_def by auto\n      then have sub: \"wqo p1 (Inl p) \\<and> wqo p2 (Inr p')\" using p1_def p2_def formq\n        unfolding optimal_def by auto\n      obtain p1' where p1'_def: \"p1 = Inl p1'\"\n        using p_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      obtain p2' where p2'_def: \"p2 = Inr p2'\"\n        using p_val p2_def check_consistent[OF bf_psi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo (Inr (VIff_sv (projl p1) (projr p2))) (Inr a)\"\n        using formq VIff_sv p1'_def p2'_def sub by auto\n      moreover have \"Inr (VIff_sv (projl p1) (projr p2)) \\<in> set (doIff p1 p2)\"\n        using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n        by (auto simp add: doIff_def optimal_def valid_def split: sum.splits)\n      ultimately have \"wqo (min_list_wrt wqo (doIff p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo] iff_sound[OF p1_def p2_def]\n          pw_total[of i \"Iff phi psi\"] trans_wqo Inr\n        by (metis not_wqo total_on_def transpE)\n    } note * = this\n    {fix p p'\n      assume formq: \"a = VIff_vs p p'\"\n      then have p_val: \"valid rho i phi (Inr p) \\<and> valid rho i psi (Inl p')\" using q_val Inr\n        unfolding valid_def by auto\n      then have sub: \"wqo p1 (Inr p) \\<and> wqo p2 (Inl p')\" using p1_def p2_def formq\n        unfolding optimal_def by auto\n      obtain p1' where p1'_def: \"p1 = Inr p1'\"\n        using p_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      obtain p2' where p2'_def: \"p2 = Inl p2'\"\n        using p_val p2_def check_consistent[OF bf_psi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo (Inr (VIff_vs (projr p1) (projl p2))) (Inr a)\"\n        using formq VIff_vs p1'_def p2'_def sub by auto\n      moreover have \"Inr (VIff_vs (projr p1) (projl p2)) \\<in> set (doIff p1 p2)\"\n        using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n        by (auto simp add: doIff_def optimal_def valid_def split: sum.splits)\n      ultimately have \"wqo (min_list_wrt wqo (doIff p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo] iff_sound[OF p1_def p2_def]\n          pw_total[of i \"Iff phi psi\"] trans_wqo Inr\n        by (metis not_wqo total_on_def transpE)\n    } note ** = this\n    then show ?thesis using * ** q_val Inr unfolding valid_def doIff_def\n      by (cases a) auto\n  next\n    case (Inl b)\n    {fix p p'\n      assume formq: \"b = SIff_ss p p'\"\n      then have p_val: \"valid rho i phi (Inl p) \\<and> valid rho i psi (Inl p')\" using q_val Inl\n        unfolding valid_def by auto\n      then have sub: \"wqo p1 (Inl p) \\<and> wqo p2 (Inl p')\" using p1_def p2_def formq\n        unfolding optimal_def by auto\n      obtain p1' where p1'_def: \"p1 = Inl p1'\"\n        using p_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      obtain p2' where p2'_def: \"p2 = Inl p2'\"\n        using p_val p2_def check_consistent[OF bf_psi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo (Inl (SIff_ss (projl p1) (projl p2))) (Inl b)\"\n        using formq SIff_ss p1'_def p2'_def sub by auto\n      moreover have \"Inl (SIff_ss (projl p1) (projl p2)) \\<in> set (doIff p1 p2)\"\n        using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n        by (auto simp add: doIff_def optimal_def valid_def split: sum.splits)\n      ultimately have \"wqo (min_list_wrt wqo (doIff p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo] iff_sound[OF p1_def p2_def]\n          pw_total[of i \"Iff phi psi\"] trans_wqo Inl\n        by (metis not_wqo total_on_def transpE)\n    } note * = this\n    {fix p p'\n      assume formq: \"b = SIff_vv p p'\"\n      then have p_val: \"valid rho i phi (Inr p) \\<and> valid rho i psi (Inr p')\" using q_val Inl\n        unfolding valid_def by auto\n      then have sub: \"wqo p1 (Inr p) \\<and> wqo p2 (Inr p')\" using p1_def p2_def formq\n        unfolding optimal_def by auto\n      obtain p1' where p1'_def: \"p1 = Inr p1'\"\n        using p_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      obtain p2' where p2'_def: \"p2 = Inr p2'\"\n        using p_val p2_def check_consistent[OF bf_psi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo (Inl (SIff_vv (projr p1) (projr p2))) (Inl b)\"\n        using formq SIff_vv p1'_def p2'_def sub by auto\n      moreover have \"Inl(SIff_vv (projr p1) (projr p2)) \\<in> set (doIff p1 p2)\"\n        using p1_def p2_def bf check_consistent[of phi] check_consistent[of psi] p_val\n        by (auto simp add: doIff_def optimal_def valid_def split: sum.splits)\n      ultimately have \"wqo (min_list_wrt wqo (doIff p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo] iff_sound[OF p1_def p2_def]\n          pw_total[of i \"Iff phi psi\"] trans_wqo Inl\n        by (metis not_wqo total_on_def transpE)\n    } note ** = this\n    then show ?thesis using * ** q_val Inl unfolding valid_def doIff_def\n      by (cases b) auto\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Once\\<close>\n\nlemma valid_checkApp_VOnce: \"valid rho j (Once I phi) (Inr (VOnce j li vphis')) \\<Longrightarrow>\n  left I = 0 \\<or> (case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> ETP rho (\\<tau> rho j - n) \\<le> LTP rho (\\<tau> rho j - left I)) \\<Longrightarrow>\n  checkApp (Inr (VOnce j li vphis')) (Inr p1')\"\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits intro!: checkApp.intros)\n  apply (meson diff_le_self i_etp_to_tau)\n  apply (meson diff_le_self i_etp_to_tau i_le_ltpi leD le_less_trans not_le_imp_less)\n  by (meson diff_le_self i_etp_to_tau)\n\nlemma valid_checkIncr_SOnce: \"valid rho j phi (Inl (SOnce j sphi)) \\<Longrightarrow>\n  checkIncr (Inl (SOnce j sphi))\"\n  apply (cases phi)\n  by (auto simp: valid_def Let_def split: if_splits enat.splits dest!: arg_cong[where ?x=\"map _ _\" and ?f=set] intro!: checkIncr.intros)\n\nlemma valid_checkIncr_VOnce: \"valid rho j phi (Inr (VOnce j li vphis')) \\<Longrightarrow>\n  checkIncr (Inr (VOnce j li vphis'))\"\n  apply (cases phi)\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits dest!: arg_cong[where ?x=\"map _ _\" and ?f=set] intro!: checkIncr.intros)\n  apply (drule imageI[where ?A=\"set vphis'\" and ?f=v_at])\n  apply auto[1]\n  apply (drule imageI[where ?A=\"set vphis'\" and ?f=v_at])\n  apply auto[1]\n  done\n\nlemma valid_shift_VOnce:\n  assumes i_props: \"i > 0\" \"right I \\<ge> enat (\\<Delta> rho i)\"\n    and valid: \"valid rho i (Once I phi) (Inr (VOnce i li ys))\"\n  shows \"valid rho (i - 1) (Once (subtract (delta rho i (i - 1)) I) phi) (Inr (VOnce (i - 1) li (if left I = 0 then butlast ys else ys)))\"\nproof (cases \"left I = 0\")\n  case True\n  obtain z zs where ys_def: \"ys = zs @ [z]\"\n    using valid True\n    apply (cases ys rule: rev_cases)\n    apply (auto simp: valid_def Let_def split: if_splits enat.splits)\n    apply (meson diff_le_self i_etp_to_tau)\n    by (meson \\<tau>_mono diff_le_self i_etp_to_tau i_ltp_to_tau i_props(1) less_or_eq_imp_le)\n  show ?thesis\n    using assms etpi_imp_etp_suci i_props True\n    unfolding optimal_def valid_def\n    apply (auto simp add: Let_def i_ltp_to_tau ys_def split: if_splits)\n    using i_le_ltpi by (auto simp: min_def split: enat.splits)\nnext\n  case False\n  have b: \"\\<tau> rho i \\<ge> \\<tau> rho 0 + left I\"\n    using valid\n    by (auto simp: valid_def Let_def)\n  have rw: \"\\<tau> rho (i - Suc 0) - (left I + \\<tau> rho (i - Suc 0) - \\<tau> rho i) =\n    (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    by auto\n  have e: \"right I = enat n \\<Longrightarrow> right (subtract (delta rho i (i - 1)) I) = enat n' \\<Longrightarrow>\n    ETP rho (\\<tau> rho i - n) = ETP rho (\\<tau> rho (i - 1) - n')\" for n n'\n    apply (auto)\n    by (metis One_nat_def diff_cancel_middle enat_ord_simps(1) i_props(2) le_diff_conv)\n  have l: \"l rho i I = min (i - Suc 0) (LTP rho (\\<tau> rho i - left I))\"\n    using False b\n    apply (auto simp: min_def)\n    by (meson i_le_ltpi_minus i_props leD)\n  have t: \"\\<tau> rho (i - 1) - left (subtract (delta rho i (i - 1)) I) =\n  (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    using i_props\n    by auto\n  have F1: \"\\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho 0 + left (subtract (delta rho i (i - 1)) I)\"\n    using i_props b\n    apply (auto)\n    using i_props i_to_predi_props by blast\n  have F3: \"\\<not> \\<tau> rho i \\<le> left I + \\<tau> rho (i - Suc 0) \\<Longrightarrow>\n    LTP rho (\\<tau> rho i - left I) = LTP rho (\\<tau> rho (i - 1))\"\n    using False i_props LTP_lt_delta b\n    apply (auto)\n    by (smt (z3) One_nat_def Suc_pred diff_is_0_eq i_le_ltpi_minus le_add_diff_inverse2 nat_le_linear neq0_conv predi_eq_ltp rw trans_le_add2)\n  show ?thesis\n    using False F1 valid e\n    by (auto simp: valid_def Let_def rw t l F3) (auto split: enat.splits)\nqed\n\nlemma valid_shift_SOnce:\n  assumes i_props: \"i > 0\" \"right I \\<ge> enat (\\<Delta> rho i)\"\n    and valid: \"valid rho i (Once I phi) (Inl (SOnce i p))\"\n    and s_at_p: \"s_at p \\<le> i - (Suc 0)\"\n  shows \"valid rho (i - 1) (Once (subtract (delta rho i (i - 1)) I) phi) (Inl (SOnce (i - 1) p))\"\nproof (cases \"left I = 0\")\n  case True\n  obtain z where p_def: \"p = z\"\n    using valid True\n    by blast\n  then show ?thesis\n    using assms etpi_imp_etp_suci i_props True i_le_ltpi\n    unfolding optimal_def valid_def\n    apply (auto simp add: Let_def i_ltp_to_tau p_def split: if_splits enat.splits)\n    subgoal premises prems\n    proof (cases \"right I\")\n      case (enat nat)\n      then show ?thesis\n        using i_le_ltpi prems enat_ord_simps(1) idiff_enat_enat by force\n    next\n      case infinity\n      then show ?thesis \n        using i_le_ltpi prems enat_ord_simps(1) idiff_enat_enat by force\n    qed\n    done\nnext\n  case False\n  have b: \"\\<tau> rho i \\<ge> \\<tau> rho 0 + left I\"\n    using valid False\n    apply (auto simp: valid_def Let_def)\n    by (smt (verit, best) diff_cancel_middle diff_diff_right diff_is_0_eq diff_le_self le_add_diff_inverse2 le_trans less_\\<tau>D linorder_not_le)\n  have rw: \"\\<tau> rho (i - Suc 0) - (left I + \\<tau> rho (i - Suc 0) - \\<tau> rho i) =\n    (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    by auto\n  have e: \"right I = enat n \\<Longrightarrow> right (subtract (delta rho i (i - 1)) I) = enat n' \\<Longrightarrow>\n    ETP rho (\\<tau> rho i - n) = ETP rho (\\<tau> rho (i - 1) - n')\" for n n'\n    apply (auto)\n    by (metis One_nat_def diff_cancel_middle enat_ord_simps(1) i_props(2) le_diff_conv)\n  have l: \"l rho i I = min (i - Suc 0) (LTP rho (\\<tau> rho i - left I))\"\n    using False b\n    apply (auto simp: min_def)\n    by (meson i_le_ltpi_minus i_props leD)\n  have t: \"\\<tau> rho (i - 1) - left (subtract (delta rho i (i - 1)) I) =\n  (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    using i_props\n    by auto\n  have F1: \"\\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho 0 + left (subtract (delta rho i (i - 1)) I)\"\n    using i_props b\n    apply (auto)\n    using i_props i_to_predi_props by blast\n  have F3: \"\\<not> \\<tau> rho i \\<le> left I + \\<tau> rho (i - Suc 0) \\<Longrightarrow>\n    LTP rho (\\<tau> rho i - left I) = LTP rho (\\<tau> rho (i - 1))\"\n    using False i_props LTP_lt_delta b\n    apply (auto)\n    by (smt (z3) One_nat_def Suc_pred diff_is_0_eq i_le_ltpi_minus le_add_diff_inverse2 nat_le_linear neq0_conv predi_eq_ltp rw trans_le_add2)\n  show ?thesis\n    using False F1 valid e s_at_p\n    apply (auto simp: valid_def Let_def rw t l F3)\n    subgoal premises prems\n    proof (cases \"right I\")\n      case (enat nat)\n      then show ?thesis\n        using prems\n        by (auto simp add: sat_Once_rec le_diff_conv)\n    next\n      case infinity\n      then show ?thesis\n        using prems\n        by (auto simp add: sat_Once_rec le_diff_conv)\n    qed\n    done\nqed\n\nlemma onceBase0_sound:\n  assumes p1_def: \"optimal i phi p1\" and\n    i_props: \"i = 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\" and\n    p_def: \"p \\<in> set (doOnceBase 0 0 p1)\"\n  shows \"valid rho i (Once I phi) p\"\n  using assms unfolding optimal_def valid_def\n  apply (auto simp: i_etp_to_tau doOnceBase_def zero_enat_def[symmetric] split: sum.splits enat.splits)\n  apply (meson Orderings.order_class.order.not_eq_order_implies_strict diff_le_self i_etp_to_tau less_nat_zero_code)\n  done\n\nlemma onceBase0_optimal:\n  assumes bf: \"bounded_future (Once I phi)\" and\n    p1_def: \"optimal i phi p1\" and\n    i_props: \"i = 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\"\n  shows\n    \"optimal i (Once I phi) (min_list_wrt wqo (doOnceBase 0 0 p1))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  from doOnceBase_def[of 0 0 p1]\n  have nnil: \"doOnceBase 0 0 p1 \\<noteq> []\"\n    by (cases p1; auto)\n  assume nopt: \"\\<not> optimal i (Once I phi) (min_list_wrt wqo (doOnceBase 0 0 p1))\"\n  from onceBase0_sound[OF p1_def i_props min_list_wrt_in[of _ wqo]]\n    refl_wqo pw_total trans_wqo nnil\n  have vmin: \"valid rho i (Once I phi) (min_list_wrt wqo (doOnceBase 0 0 p1))\"\n    apply auto\n    by (metis i_props not_wqo p1_def onceBase0_sound total_onI)\n  then obtain q where q_val: \"valid rho i (Once I phi) q\" and\n    q_le: \"\\<not> wqo (min_list_wrt wqo (doOnceBase 0 0 p1)) q\" using nopt\n    unfolding optimal_def by auto\n  then have \"wqo (min_list_wrt wqo (doOnceBase 0 0 p1)) q\"\n  proof (cases q)\n    case (Inl a)\n    then obtain sphiq where sq: \"a = SOnce i sphiq\"\n      using q_val unfolding valid_def\n      by (cases a) auto\n    then have p_val: \"valid rho i phi (Inl sphiq)\" using Inl q_val i_props\n      unfolding valid_def\n      by (auto simp: Let_def)\n    then have p_le: \"wqo p1 (Inl sphiq)\" using p1_def unfolding optimal_def\n      by auto\n    obtain p1' where p1'_def: \"p1 = Inl p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inl (SOnce i p1')) q\"\n      using SOnce[OF p_le[unfolded p1'_def]] sq Inl\n      by (fastforce simp add: p1'_def map_idI)\n    moreover have \"Inl (SOnce i (projl p1)) \\<in> set (doOnceBase 0 0 p1)\"\n      using i_props p1_def bf check_consistent[of phi] p_val\n      unfolding doOnceBase_def optimal_def valid_def\n      by (auto split: sum.splits)\n    ultimately show ?thesis using min_list_wrt_le[OF _ refl_wqo]\n        onceBase0_sound[OF p1_def i_props] pw_total[of i \"Once I phi\"]\n        trans_wqo Inl\n      apply (auto simp add: total_on_def p1'_def)\n      by (metis transpD)\n  next\n    case (Inr b)\n    {fix vphi li\n      assume vb: \"b = VOnce i li [vphi]\"\n      then have b_val: \"valid rho i phi (Inr vphi)\" using Inr q_val i_props\n        unfolding valid_def by (auto simp: Let_def split: if_splits)\n      then have lcomp: \"wqo p1 (Inr vphi)\"\n        using p1_def unfolding optimal_def\n        by auto\n      have li_def: \"li = (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n))\"\n        using q_val\n        by (auto simp: Inr vb valid_def)\n      obtain p1' where p1'_def: \"p1 = Inr p1'\"\n        using b_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have etp_0: \"ETP rho (\\<tau> rho 0 - n) = 0\" for n\n        by (meson Nat.bot_nat_0.extremum_uniqueI diff_le_self i_etp_to_tau)\n      have \"wqo (Inr (VOnce i li [p1'])) q\"\n        using vb Inr VOnce lcomp\n        by (auto simp add: p1'_def)\n      moreover have \"Inr (VOnce i li [p1']) \\<in> set (doOnceBase 0 0 p1)\"\n        using i_props p1_def bf check_consistent b_val\n        unfolding doOnceBase_def optimal_def valid_def\n        by (auto split: sum.splits enat.splits simp: p1'_def li_def etp_0)\n      ultimately have \"wqo (min_list_wrt wqo (doOnceBase 0 0 p1)) q\"\n        using min_list_wrt_le[OF _ refl_wqo]\n          onceBase0_sound[OF p1_def i_props] pw_total[of i \"Once I phi\"]\n          trans_wqo Inr\n        apply (auto simp add: total_on_def)\n        by (metis transpD)\n    }\n    then show ?thesis using Inr q_val assms unfolding valid_def\n      apply (cases b)\n                          apply (auto simp: Let_def split: if_splits enat.splits)\n       apply (metis order.asym diff_le_self i_etp_to_tau i_props le_0_eq)\n      apply (metis diff_le_self i_etp_to_tau i_le_ltpi le_zero_eq)\n      done\n  qed\n  then show False using q_le by auto\nqed\n\nlemma onceBaseNZ_sound:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n  \\<and> right I < enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\"\n    and p_def: \"p \\<in> set (doOnceBase i (left I) p1)\"\n  shows \"valid rho i (Once I phi) p\"\nproof (cases \"left I\")\n  {fix i::nat\n    assume i_ge: \"i > 0\"\n    then have \"\\<tau> rho i \\<le> \\<tau> rho i \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0\" by auto\n    then have \"i \\<le> LTP rho (\\<tau> rho i)\" using i_ge\n      by (auto simp add: i_ltp_to_tau)\n    then have \"i \\<le> min i (LTP rho (\\<tau> rho i))\" by auto\n  } note ** = this\n  case 0\n  then show ?thesis\n  proof (cases p1)\n    case (Inl a)\n    then have p1s: \"p1 = Inl a\" by auto\n    then have \"p = Inl (SOnce i a)\" using p_def p1s \"local.0\"\n      unfolding doOnceBase_def by simp\n    then show ?thesis using p1_def \"local.0\" Inl zero_enat_def\n      unfolding optimal_def valid_def by auto\n  next\n    case (Inr b)\n    then have p1v: \"p1 = Inr b\" by auto\n    then have \"p = Inr (VOnce i i [b])\" using p_def p1v \"local.0\"\n      unfolding doOnceBase_def by simp\n    then show ?thesis using p_def p1_def i_props Inr p1v \"local.0\"\n        pastBase_constrs[OF i_props] ** ETP_lt_delta enat_iless\n      unfolding optimal_def valid_def\n      by (auto simp: Let_def i_etp_to_tau split: enat.splits sum.splits)\n  qed\nnext\n  case (Suc n)\n  then show ?thesis\n  proof (cases p1)\n    case (Inl a)\n    then have \"p = Inr (VOnce i i [])\" using p_def Suc p1_def\n      unfolding doOnceBase_def by auto\n    then show ?thesis using Inl p_def p1_def Suc i_props pastBase_constrs[OF i_props] ETP_lt_delta enat_iless\n      unfolding valid_def\n      by (auto simp: Let_def split: enat.splits)\n        (metis add_Suc_right i_le_ltpi_minus leD not_less_eq_eq zero_less_Suc)\n  next\n    case (Inr b)\n    then have \"p = Inr (VOnce i i [])\"\n      using p_def p1_def Suc unfolding doOnceBase_def by auto\n    then show ?thesis using Inr p1_def i_props Suc pastBase_constrs[OF i_props] ETP_lt_delta enat_iless\n      unfolding optimal_def valid_def\n      by (auto simp: Let_def split: enat.splits)\n        (metis i_le_ltpi_minus i_props leD zero_less_Suc)+\n  qed\nqed\n\nlemma onceBaseNZ_optimal:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n  \\<and> right I < enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\"\n    and bf: \"bounded_future (Once I phi)\"\n  shows \"optimal i (Once I phi) (min_list_wrt wqo (doOnceBase i (left I) p1))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  from doOnceBase_def[of i \"left I\" p1]\n  have nnil: \"doOnceBase i (left I) p1 \\<noteq> []\"\n    by (cases p1; cases \"left I\"; auto)\n  from pw_total[of i \"Once I phi\"] have total_set: \"total_on wqo (set (doOnceBase i (left I) p1))\"\n    using onceBaseNZ_sound[OF i_props p1_def]\n    by (metis not_wqo total_onI)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doOnceBase i (left I) p1). wqo x y) (doOnceBase i (left I) p1) \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doOnceBase i (left I) p1). wqo x y)\" \"(doOnceBase i (left I) p1)\"]\n    by simp\n  assume nopt: \"\\<not> optimal i (Once I phi) (min_list_wrt wqo (doOnceBase i (left I) p1))\"\n  define minp where minp: \"minp \\<equiv> (min_list_wrt wqo (doOnceBase i (left I) p1))\"\n  {\n    assume l_ge: \"left I > 0\"\n    then have \"right I > 0\" using left_right[of I] zero_enat_def\n      apply auto\n      using enat_0_iff(2) by auto\n    then have \"\\<not> mem (delta rho i i) I\" using l_ge by auto\n    then have \"\\<forall>j \\<le> i. \\<not> mem (delta rho i j) I\"\n      using i_props r_less_Delta_imp_less l_ge le_neq_implies_less\n      by blast\n    then have \"\\<not> sat rho i (Once I phi)\" by auto\n    then have \"VIO rho i (Once I phi)\" using completeness\n      by blast\n  } note * = this\n  from onceBaseNZ_sound[OF i_props p1_def min_list_wrt_in[of _ wqo]]\n    minp trans_wqo refl_wqo pw_total nnil\n  have vmin: \"valid rho i (Once I phi) minp\"\n    apply auto\n    by (metis i_props not_wqo p1_def onceBaseNZ_sound total_onI)\n  then obtain q where q_val: \"valid rho i (Once I phi) q\" and\n    q_le: \"\\<not> wqo minp q\" using nopt minp unfolding optimal_def\n    by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inl a)\n    then obtain sphiq where sq: \"a = SOnce i sphiq\"\n      using q_val unfolding valid_def\n      by (cases a) auto\n    then have p_val: \"valid rho i phi (Inl sphiq)\" using Inl q_val i_props\n      unfolding valid_def\n      apply (auto simp: Let_def split: list.splits)\n      by (metis One_nat_def le_neq_implies_less r_less_Delta_imp_less)\n    then have p1_le: \"wqo p1 (Inl sphiq)\" using p1_def unfolding optimal_def\n      by simp\n    from q_val have sats: \"SAT rho i (Once I phi)\" using check_sound Inl\n      unfolding valid_def by auto\n    obtain p1' where p1'_def: \"p1 = Inl p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inl (SOnce i (projl p1))) q\"\n      using SOnce[OF p1_le[unfolded p1'_def]] sq Inl\n      by (fastforce simp add: p1'_def map_idI)\n    moreover have \"Inl (SOnce i (projl p1)) \\<in> set (doOnceBase i (left I) p1)\"\n      using i_props p1_def bf check_consistent p_val * sats\n      unfolding doOnceBase_def optimal_def valid_def\n      apply (cases \"left I\"; auto split: sum.splits nat.splits)\n      by (metis bf check_complete)+\n    ultimately show ?thesis\n      using min_list_wrt_le[OF _ refl_wqo]\n        onceBaseNZ_sound[OF i_props p1_def] pw_total[of i \" Once I phi\"]\n        trans_wqo Inl minp\n      apply (auto simp add: total_on_def)\n      by (metis transpD)\n  next\n    case (Inr b)\n    {fix n j\n      assume j_def: \"right I = enat n \\<and> j \\<le> LTP rho (\\<tau> rho i)\n       \\<and> ETP rho (\\<tau> rho i - n) \\<le> j \\<and> j \\<le> i\"\n      then have jin: \"\\<tau> rho j \\<ge> \\<tau> rho i - n\" using i_etp_to_tau by auto\n      from \\<tau>_mono have j_lei: \"\\<forall>j < i. \\<tau> rho j \\<le> \\<tau> rho (i-1)\" by auto\n      from this i_props j_def have \"\\<forall>j < i. \\<tau> rho j \\<le> \\<tau> rho i - n\"\n        apply auto\n        by (metis One_nat_def j_lei add_diff_inverse_nat add_le_imp_le_diff add_le_mono less_imp_le_nat less_nat_zero_code nat_diff_split_asm)\n      then have \"j = i\" using j_def jin apply auto\n        by (metis add.commute order.not_eq_order_implies_strict diff_diff_left enat_ord_simps(2) i_props j_lei less_le_not_le zero_less_diff)\n    } note ** = this\n    then show ?thesis\n    proof (cases \"left I\")\n      case 0\n      {fix vphi\n        assume bv: \"b = VOnce i i [vphi]\"\n        then have b_val: \"valid rho i phi (Inr vphi)\"\n          using q_val Inr min.absorb_iff1 i_props \"0\" i_le_ltpi\n          unfolding valid_def\n          by (auto simp: Let_def split: if_splits enat.splits)\n        then have p1_wqo: \"wqo p1 (Inr vphi)\"\n          using b_val p1_def unfolding optimal_def\n          by auto\n        obtain p1' where p1'_def: \"p1 = Inr p1'\"\n          using b_val p1_def check_consistent[OF bf_phi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        have \"wqo (Inr (VOnce i i [p1'])) q\"\n          using bv Inr VOnce p1_wqo\n          by (auto simp add: p1'_def)\n        moreover have \"Inr (VOnce i i [p1']) \\<in> set (doOnceBase i (left I) p1)\"\n          using i_props bf check_consistent b_val \"0\"\n          unfolding doOnceBase_def optimal_def valid_def\n          by (auto split: sum.splits nat.splits simp: p1'_def)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            onceBaseNZ_sound[OF i_props p1_def] pw_total[of i \"Once I phi\"]\n            trans_wqo bv Inr minp\n          apply (auto simp add: total_on_def)\n          by (metis transpD)\n      }\n      moreover\n      have \"\\<exists>vphi. b = VOnce i i [vphi]\"\n        using q_val \"0\" Inr assms(1) ** \n        unfolding valid_def doOnceBase_def\n      proof (cases b)\n        case (VOnce i j vphis)\n        then show ?thesis\n          using VOnce q_val \"0\" Inr assms(1) ** \n          unfolding valid_def doOnceBase_def\n          by (cases vphis; cases \"tl vphis\")\n            (auto simp: Let_def min_def i_etp_to_tau i_le_ltpi dest: ETP_lt_delta[simplified] split: if_splits enat.splits)\n      next\n        case (VOnce_le i)\n        then show ?thesis\n          using q_val \"0\" Inr assms(1) ** \n          unfolding valid_def doOnceBase_def\n          by (auto simp: Let_def leD split: if_splits enat.splits)\n      qed (auto simp: Let_def split: if_splits enat.splits)\n      ultimately show ?thesis by blast\n    next\n      case (Suc nat)\n      from q_val Inr have \"VIO rho i (Once I phi)\"\n        using check_sound(2)[of rho \"Once I phi\" b]\n        unfolding valid_def by auto\n      {fix li vphis\n        assume bv: \"b = VOnce i li vphis\"\n        have vphis_Nil: \"vphis = []\"\n          using q_val i_props\n          by (auto simp: Inr bv valid_def Let_def split: if_splits enat.splits)\n            (smt (z3) \"**\" Lattices.linorder_class.min.cobounded1 Suc i_le_ltpi i_le_ltpi_minus leD le_trans min_def zero_less_Suc)\n        have li_def: \"li = i\"\n          using q_val\n          apply (auto simp: Inr bv vphis_Nil valid_def split: enat.splits if_splits)\n          using diff_le_self i_etp_to_tau apply blast\n          using ETP_lt_delta enat_ord_simps(2) i_props by presburger\n        have \"wqo (Inr (VOnce i i [])) q\"\n          using q_val bv Inr not_wqo\n          by (fastforce simp add: map_idI vphis_Nil li_def)\n        moreover have \"Inr (VOnce i i []) \\<in> set (doOnceBase i (left I) p1)\"\n          using i_props p1_def bf check_consistent Suc\n          unfolding doOnceBase_def optimal_def valid_def\n          by (auto split: sum.splits nat.splits)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            onceBaseNZ_sound[OF i_props p1_def] pw_total[of i \"Once I phi\"]\n            trans_wqo bv Inr minp\n          apply (simp add: total_on_def)\n          by (metis transpD)\n      }\n      then show ?thesis\n        using minp Suc Inr q_val assms\n        unfolding doOnceBase_def valid_def optimal_def\n        by (cases b) (auto)\n    qed\n  qed\n  then show False using q_le by auto\nqed\n\n\n(* lemma *: \"valid rho (i - Suc 0)\n    (Once (subtract (delta rho i (i - Suc 0)) I) phi)\n    (Inr (VOnce ia li p1)) \\<Longrightarrow>\n  left I = 0 \\<Longrightarrow>\n  valid rho i phi (Inr r) \\<Longrightarrow>\n  valid rho i (Once I phi)\n    (Inr (VOnce (Suc ia) li (p1 @ [r])))\"\n  unfolding valid_def\n  apply (auto simp only: sum.case prod.case mtl.case vproof.case\n    v_at.simps v_check_simps split: enat.splits)\n                    apply (simp_all split: if_splits)\n           apply hypsubst_thin\n           apply simp\n\nlemma \n  \"checkApp p' p \\<Longrightarrow> valid rho (i - 1) (Once (subtract (delta rho i (i - 1)) I) phi) p' \\<Longrightarrow>\n  valid rho i phi p \\<Longrightarrow> left I = 0 \\<Longrightarrow> valid rho i (Once I phi) (p' \\<oplus> p)\"\nproof (induct p' p rule: checkApp.induct)\n  case (5 p1 i li r)\n  then show ?case\n    by (auto  dest!: \nqed (simp_all add: valid_def) *)\n\nlemma once_sound:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n  \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\" and\n    p'_def: \"optimal (i-1) (Once (subtract (\\<Delta> rho i) I) phi) p'\"\n    and p_def: \"p \\<in> set (doOnce i (left I) p1 p')\"\n  shows \"valid rho i (Once I phi) p\"\nproof (cases p')\n  case (Inl a)\n  then have p'l: \"p' = Inl a\" by auto\n  then have satp': \"sat rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi)\"\n    using soundness p'_def check_sound(1)[of rho \"Once (subtract (\\<Delta> rho i) I) phi\" a]\n    unfolding optimal_def valid_def by fastforce\n  then obtain q where a_def: \"a = SOnce (i-1) q\" using Inl p'_def\n    unfolding optimal_def valid_def p'l\n    apply(cases a)\n    by auto\n  then have a_val: \"s_check rho (Once (subtract (\\<Delta> rho i) I) phi) a\"\n    using Inl p'_def unfolding optimal_def valid_def by (auto simp: Let_def)\n  then have mem: \"mem (delta rho (i-1) (s_at q)) (subtract (\\<Delta> rho i) I)\"\n    using a_def Inl p'_def s_check.simps unfolding optimal_def valid_def\n    by (auto simp: Let_def)                                                 \n  then have \"left I - \\<Delta> rho i \\<le> delta rho (i-1) (s_at q)\" by auto\n  then have tmp: \"left I \\<le> \\<tau> rho i - \\<tau> rho (i-1) + (\\<tau> rho (i-1) - \\<tau> rho (s_at q))\"\n    by auto\n  from a_val have qi: \"(s_at q) \\<le> (i-1)\" using a_def p'l p'_def\n    unfolding optimal_def valid_def\n    by (auto simp: Let_def)\n  then have liq: \"left I \\<le> delta rho i (s_at q)\" using diff_add_assoc tmp\n    by auto\n  show ?thesis\n  proof (cases \"right I\")\n    case n_def: (enat n)\n    from mem n_def have \"enat (delta rho (i-1) (s_at q)) \\<le> enat n - enat (\\<Delta> rho i)\"\n      by auto\n    then have \"delta rho (i-1) (s_at q) + \\<Delta> rho i \\<le> n\"\n      apply auto\n      by (metis One_nat_def enat_ord_simps(1) i_props le_diff_conv le_diff_conv2 n_def)\n    then have riq: \"enat (delta rho i (s_at q)) \\<le> right I\" using n_def by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then have sps: \"p = Inl (SOnce i q) \\<or> p = Inl (SOnce i (projl p1))\"\n          using a_def p'l True p_def  unfolding doOnce_def optimal_def by auto\n        then show ?thesis\n          using Inl True assms n_def a_val a_def qi riq \n          unfolding optimal_def valid_def\n          by auto\n      next\n        case (Inr b2)\n        then have p1r: \"p1 = Inr b2\" by simp\n        then have sp: \"p = Inl (SOnce i q)\"\n          using p1r p_def True p'l a_def unfolding doOnce_def by auto\n        then show ?thesis\n          using Inr Inl True assms n_def a_def unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by simp\n        then have sp: \"p = Inl (SOnce i q)\"\n          using p1l p_def False p'l a_def unfolding doOnce_def by auto\n        then show ?thesis\n          using Inl False assms n_def a_def qi liq riq a_val unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      next\n        case (Inr b2)\n        then have p1r: \"p1 = Inr b2\" by simp\n        then have sp: \"p = Inl (SOnce i q)\"\n          using p1r p_def False p'l a_def unfolding doOnce_def by auto\n        then show ?thesis\n          using Inr False assms n_def a_def qi liq riq a_val unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n    qed\n  next\n    case infinity\n    then have riq: \"enat (delta rho i (s_at q)) \\<le> right I\" by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then have sps: \"p = Inl (SOnce i q) \\<or> p = Inl (SOnce i (projl p1))\"\n          using a_def p'l p1l True p_def unfolding doOnce_def by auto\n        then show ?thesis\n          using a_def True p'_def p1_def p'l p1l i_props zero_enat_def qi riq\n          unfolding optimal_def valid_def\n          by auto\n      next\n        case (Inr b2)\n        then have p1r: \"p1 = Inr b2\" by simp\n        then have sp: \"p = Inl (SOnce i q)\"\n          using p1r p_def True p'l a_def unfolding doOnce_def by auto\n        then show ?thesis\n          using Inr True assms zero_enat_def i_props a_def qi riq a_val\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by simp\n        then have sp: \"p = Inl (SOnce i q)\"\n          using p1l p_def False p'l a_def unfolding doOnce_def by auto\n        then show ?thesis\n          using Inl False assms zero_enat_def a_def qi liq riq a_val \n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      next\n        case (Inr b2)\n        then have p1r: \"p1 = Inr b2\" by simp\n        then have sp: \"p = Inl (SOnce i q)\"\n          using p1r p_def False p'l a_def unfolding doOnce_def by auto\n        then show ?thesis\n          using Inr False assms zero_enat_def a_def qi liq riq a_val\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n    qed\n  qed\nnext\n  case (Inr b)\n  then have p'r: \"p' = Inr b\" by auto\n  then show ?thesis\n  proof (cases b)\n    case VFF\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VAtm x11 x12)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNeg x2)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VDisj x31 x32)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VConjL x31)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VConjR x31)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VImpl x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VIff_sv x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VIff_vs x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VOnce_le x8)\n    then have c: \"\\<tau> rho (i-1) < \\<tau> rho 0 + (left I - \\<Delta> rho i)\" using p'r p'_def\n      unfolding optimal_def valid_def by auto\n    then have \"\\<tau> rho (i-1) - \\<tau> rho 0 < left I - \\<Delta> rho i\" using i_props\n      by (simp add: less_diff_conv2)\n    then have \"\\<tau> rho i - \\<tau> rho 0 < left I\" by linarith\n    then show ?thesis using i_props by auto\n  next\n    case (VOnce j li qs)\n    have li_def: \"li = (case right I - enat (delta rho i (i - Suc 0)) of enat n \\<Rightarrow>\n      ETP rho (\\<tau> rho (i - Suc 0) - n) | \\<infinity> \\<Rightarrow> 0)\"\n      using p'_def\n      by (auto simp: Inr VOnce optimal_def valid_def)\n    have li: \"li = (case right I of enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0)\"\n      using i_props\n      by (auto simp: li_def split: enat.splits)\n    have j_def: \"j = i-1\" using p'r p'_def VOnce unfolding optimal_def valid_def\n      by auto\n    then show ?thesis \n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases \"right I\")\n        case n_def: (enat n)\n        then show ?thesis\n        proof (cases p1)\n          case (Inl a1)\n          then have \"p = Inl (SOnce i (projl p1))\"\n            using p'r VOnce True p_def unfolding doOnce_def\n            by auto\n          then show ?thesis using p1_def i_props Inl True zero_enat_def\n            unfolding optimal_def valid_def by auto\n        next\n          case (Inr b1)\n          then have p1r: \"p1 = Inr b1\" by auto\n          {\n            from i_props n_def have r: \"n \\<ge> \\<Delta> rho i\" by auto\n            then have \"ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) \\<le> i-1\"\n              using p'_def VOnce p'r n_def unfolding optimal_def valid_def\n              by (auto simp add: i_etp_to_tau le_diff_conv Let_def split: if_splits)\n            then have \"ETP rho (\\<tau> rho i - n) \\<le> i-1\"\n              using r diff_diff_right[of \"\\<Delta> rho i\" n \"\\<tau> rho (i-1)\"] by auto\n          } note * = this\n          {\n            from i_props have b1_ge: \"v_at b1 > 0\" using p1r p1_def\n              unfolding optimal_def valid_def by auto\n            then have nl_def: \"ETP rho (\\<tau> rho i - n) \\<le> v_at b1 - 1\" using * VOnce p'r p'_def p1_def p1r\n              unfolding optimal_def valid_def by (auto simp: Let_def)\n            define l where l_def: \"l \\<equiv> [ETP rho (\\<tau> rho i - n) ..< min (v_at b1-1) (LTP rho (\\<tau> rho (v_at b1-1)))]\"\n            then have \"l = [ETP rho (\\<tau> rho i - n) ..< v_at b1 -1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (v_at b1-1) (LTP rho (\\<tau> rho (v_at b1 -1)))] = l @ [v_at b1 -1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (v_at b1-1) (LTP rho (\\<tau> rho (v_at b1 -1)))] = [ETP rho (\\<tau> rho i - n) ..< min (v_at b1) (LTP rho (\\<tau> rho (v_at b1)))]\"\n              using nl_def l_def b1_ge\n              apply (auto simp add: i_le_ltpi min_def)\n              by (metis Suc_pred upt_Suc_append)\n          } note ** = this\n          then have \"p = p' \\<oplus> p1\" using p1r p'r VOnce True p_def\n            unfolding doOnce_def by auto\n          then have \"p = Inr (VOnce i li (qs @ [projr p1]))\"\n            using VOnce p'r p1_def p1r i_props\n            unfolding proofApp_def j_def\n            by auto\n          then show ?thesis\n            using * ** n_def p'_def p1_def p1r p'r VOnce\n              True i_props i_le_ltpi\n            unfolding optimal_def valid_def\n            using [[linarith_split_limit=20]]\n            apply (auto 0 0 simp: Let_def split: if_splits)\n            using min.orderE apply blast\n                 apply (metis One_nat_def Suc_diff_1 le_SucI)\n                apply (metis Suc_pred le_trans nat_le_linear not_less_eq_eq)\n            using le_trans by blast+\n        qed\n      next\n        case infinity\n        then show ?thesis\n        proof (cases p1)\n          case (Inl a1)\n          then have \"p = Inl (SOnce i (projl p1))\"\n            using p'r VOnce True p_def unfolding doOnce_def\n            by auto\n          then show ?thesis using p1_def i_props Inl True zero_enat_def\n            unfolding optimal_def valid_def by auto\n        next\n          case (Inr b1)\n          then have p1r: \"p1 = Inr b1\" by auto\n          {\n            from i_props have b1_ge: \"v_at b1 > 0\" using p1r p1_def\n              unfolding optimal_def valid_def by auto\n            then have nl_def: \"ETP rho 0 \\<le> v_at b1 - 1\" using VOnce p'r p'_def p1_def p1r\n              unfolding optimal_def valid_def by (auto simp: Let_def i_etp_to_tau)\n            define l where l_def: \"l \\<equiv> [ETP rho 0 ..< min (v_at b1 -1) (LTP rho (\\<tau> rho (v_at b1 -1)))]\"\n            then have \"l = [ETP rho 0 ..< v_at b1 -1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (v_at b1 -1) (LTP rho (\\<tau> rho (v_at b1 -1)))] = l @ [v_at b1 -1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (v_at b1 -1) (LTP rho (\\<tau> rho (v_at b1 -1)))] = [ETP rho 0 ..< min (v_at b1) (LTP rho (\\<tau> rho (v_at b1)))]\"\n              using nl_def l_def b1_ge\n              apply (auto simp add: i_le_ltpi min_def)\n              by (metis Suc_pred diff_0_eq_0 diff_is_0_eq upt_Suc)\n          } note ** = this\n          then have \"p = p' \\<oplus> p1\" using p1r p'r VOnce True p_def\n            unfolding doOnce_def by auto\n          then have \"p = Inr (VOnce i li (qs @ [projr p1]))\"\n            using VOnce p'r p1_def p1r i_props\n            unfolding optimal_def valid_def proofApp_def j_def\n            by auto\n          then show ?thesis\n            using infinity p'_def p1_def p1r p'r VOnce\n              True i_props i_le_ltpi **\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def i_etp_to_tau i_le_ltpi split: if_splits)\n        qed\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        { fix n assume n_def: \"right I = enat n\"\n          case (Inl a1)\n          then have formp: \"p = Inr (VOnce i li qs)\"\n            using False p_def p'r VOnce\n            unfolding doOnce_def by (simp add: Inl) \n          from p'_def have v_at_qs: \"map v_at qs = [ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n            using n_def unfolding optimal_def valid_def VOnce p'r\n            by (auto simp: Let_def)\n          have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n            using False i_props\n            apply (auto simp: min_def)\n               apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              apply (rule antisym)\n              subgoal apply (subst i_ltp_to_tau)\n                 apply  (auto simp: gr0_conv_Suc not_le)\n                by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n              subgoal\n                by (auto simp: gr0_conv_Suc)\n              done\n            subgoal\n              by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n            done\n          from p'_def have vq: \"\\<forall>q \\<in> set qs. v_check rho phi q\"\n            unfolding optimal_def valid_def VOnce p'r\n            by (auto simp: Let_def)\n          from n_def i_props have \"ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) = ETP rho (\\<tau> rho i - n)\"\n            by auto\n          then have \"map v_at qs = [ETP rho (\\<tau> rho i - n) ..< Suc (l rho i I)]\"\n            using v_at_qs[unfolded l_subtract] by auto\n          then have ?thesis using False i_props VOnce p'r formp vq n_def \n            unfolding valid_def\n            by (auto simp: Let_def li)\n        }\n        moreover\n        { assume infinity: \"right I = \\<infinity>\"\n          case (Inl a1)\n          then have formp: \"p = Inr (VOnce i li qs)\"\n            using False p_def p'r VOnce\n            unfolding doOnce_def by auto\n          from p'_def have v_at_qs: \"map v_at qs = [ETP rho 0 ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n            using infinity unfolding optimal_def valid_def VOnce p'r\n            by (auto simp: Let_def)\n          have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n            using False i_props\n            apply (auto simp: min_def)\n               apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              apply (rule antisym)\n              subgoal apply (subst i_ltp_to_tau)\n                 apply  (auto simp: gr0_conv_Suc not_le)\n                by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n              subgoal\n                by (auto simp: gr0_conv_Suc)\n              done\n            subgoal\n              by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n            done\n          from p'_def have vq: \"\\<forall>q \\<in> set qs. v_check rho phi q\"\n            unfolding optimal_def valid_def VOnce p'r\n            by (auto simp: Let_def)\n          then have \"map v_at qs = [ETP rho 0 ..< Suc (l rho i I)]\"\n            using v_at_qs[unfolded l_subtract] by auto\n          then have ?thesis using False i_props VOnce p'r formp vq infinity\n            unfolding valid_def\n            by (auto simp: Let_def li)\n        }\n        moreover case Inl\n        ultimately show ?thesis \n          by (cases \"right I\"; auto)\n      next\n        { fix n \n          assume n_def: \"right I = enat n\"\n          case (Inr b1)\n          then have \"p = Inr (VOnce i li qs)\"\n            using p'r VOnce False p_def unfolding doOnce_def\n            by (simp add: Inr)\n          moreover\n          {\n            assume formp: \"p = Inr (VOnce i li qs)\"\n            from p'_def have v_at_qs: \"map v_at qs = [ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n              using n_def unfolding optimal_def valid_def VOnce p'r\n              by (auto simp: Let_def)\n            have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n              using False i_props\n              apply (auto simp: min_def)\n                 apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                apply (rule antisym)\n                subgoal apply (subst i_ltp_to_tau)\n                   apply  (auto simp: gr0_conv_Suc not_le)\n                  by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n                subgoal\n                  by (auto simp: gr0_conv_Suc)\n                done\n              subgoal\n                by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n              done\n            from p'_def have vq: \"\\<forall>q \\<in> set qs. v_check rho phi q\"\n              unfolding optimal_def valid_def VOnce p'r\n              by (auto simp: Let_def)\n            from n_def i_props have \"ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) = ETP rho (\\<tau> rho i - n)\"\n              by auto\n            then have \"map v_at qs = [ETP rho (\\<tau> rho i - n) ..< Suc (l rho i I)]\"\n              using v_at_qs[unfolded l_subtract] by auto\n            then have \"valid rho i (Once I phi) p\"\n              using False i_props VOnce p'r formp vq n_def\n              unfolding valid_def\n              by (auto simp: Let_def li)\n          }\n          ultimately have ?thesis by auto\n        }\n        moreover\n        { assume infinity: \"right I = infinity\"\n          case (Inr b1)\n          then have \"p = Inr (VOnce i li qs)\"\n            using p'r VOnce False p_def unfolding doOnce_def\n            by (simp add: Inr)\n          moreover\n          {\n            assume formp: \"p = Inr (VOnce i li qs)\"\n            from p'_def have v_at_qs: \"map v_at qs = [ETP rho 0 ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n              using infinity unfolding optimal_def valid_def VOnce p'r\n              by (auto simp: Let_def)\n            have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n              using False i_props\n              apply (auto simp: min_def)\n                 apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                apply (rule antisym)\n                subgoal apply (subst i_ltp_to_tau)\n                   apply  (auto simp: gr0_conv_Suc not_le)\n                  by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n                subgoal\n                  by (auto simp: gr0_conv_Suc)\n                done\n              subgoal\n                by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n              done\n            from p'_def have vq: \"\\<forall>q \\<in> set qs. v_check rho phi q\"\n              unfolding optimal_def valid_def VOnce p'r\n              by (auto simp: Let_def)\n            then have \"map v_at qs = [ETP rho 0 ..< Suc (l rho i I)]\"\n              using v_at_qs[unfolded l_subtract] by auto\n            then have \"valid rho i (Once I phi) p\"\n              using False i_props p'r formp vq infinity\n              unfolding valid_def\n              by (auto simp: Let_def li)\n          }\n          ultimately have ?thesis by auto\n        }\n        moreover case Inr\n        ultimately show ?thesis by (cases \"right I\"; auto)\n      qed\n    qed\n  next\n    case (VUntil x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VUntil_never x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VEventually x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VHistorically x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VAlways x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VSince_le x8)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNext x9)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNext_ge x10)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNext_le x11a)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VPrev x12a)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VPrev_ge x13)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VPrev_le x14)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case VPrev_zero\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VSince x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VSince_never x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  qed\nqed\n\nlemma once_optimal:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n   \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\" and\n    p'_def: \"optimal (i-1) (Once (subtract (\\<Delta> rho i) I) phi) p'\"\n    and bf: \"bounded_future (Once I phi)\"\n    and bf': \"bounded_future (Once (subtract (\\<Delta> rho i) I) phi)\"\n  shows \"optimal i (Once I phi) (min_list_wrt wqo (doOnce i (left I) p1 p'))\"\nproof (rule ccontr)\n  define minp where minp: \"minp \\<equiv> min_list_wrt wqo (doOnce i (left I) p1 p')\"\n  from bf have bfphi: \"bounded_future phi\" by simp\n  from pw_total[of i \"Once I phi\"] have total_set: \"total_on wqo (set (doOnce i (left I) p1 p'))\"\n    using once_sound[OF i_props p1_def p'_def]\n    by (metis not_wqo total_onI)\n  define li where \"li = (case right I - enat (delta rho i (i - Suc 0)) of enat n \\<Rightarrow>\n      ETP rho (\\<tau> rho (i - Suc 0) - n) | \\<infinity> \\<Rightarrow> 0)\"\n  have li: \"li = (case right I of enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0)\"\n    using i_props\n    by (auto simp: li_def split: enat.splits)\n  from p'_def have p'_form: \"(\\<exists>p. p' = Inl (SOnce (i-1) p)) \\<or>\n    (\\<exists>p. p' = Inr (VOnce (i-1) li p))\"\n  proof(cases \"SAT rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi)\")\n    case True\n    then obtain a' where a'_def: \"p' = Inl a'\"\n      using val_SAT_imp_l[OF bf'] p'_def\n      unfolding optimal_def\n      by force\n    then show ?thesis\n      using p'_def i_props_imp_not_le_once[OF i_props p'_def]\n      unfolding optimal_def valid_def\n      by (cases a') (auto simp: li_def)\n  next\n    case False\n    then have VIO: \"VIO rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi)\"\n      using SAT_or_VIO\n      by auto\n    then obtain b' where b'_def: \"p' = Inr b'\"\n      using val_VIO_imp_r[OF bf'] p'_def\n      unfolding optimal_def\n      by force\n    then show ?thesis\n      using p'_def i_props_imp_not_le_once[OF i_props p'_def]\n      unfolding optimal_def valid_def\n      by (cases b') (auto simp: li_def)\n  qed\n  from doOnce_def[of i \"left I\" p1 p'] p'_form\n  have nnil: \"doOnce i (left I) p1 p' \\<noteq> []\"\n    by (cases p1; cases \"left I\"; cases p'; auto)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doOnce i (left I) p1 p'). wqo x y) (doOnce i (left I) p1 p') \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doOnce i (left I) p1 p'). wqo x y)\" \"(doOnce i (left I) p1 p')\"]\n    by simp\n  assume nopt: \"\\<not> optimal i (Once I phi) minp\"\n  from once_sound[OF i_props p1_def p'_def min_list_wrt_in]\n    total_set trans_wqo refl_wqo nnil minp\n  have vmin: \"valid rho i (Once I phi) minp\"\n    by auto\n  then obtain q where q_val: \"valid rho i (Once I phi) q\" and\n    q_le: \"\\<not> wqo minp q\" using minp nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inl a)\n    then have q_s: \"q = Inl a\" by auto\n    then have SATs: \"SAT rho i (Once I phi)\" using q_val check_sound(1)\n      unfolding valid_def by auto\n    then have sats: \"sat rho i (Once I phi)\" using soundness\n      by blast\n    from Inl obtain sphi where a_def: \"a = SOnce i sphi\"\n      using q_val unfolding valid_def by (cases a) auto\n    then have valphi: \"valid rho (s_at sphi) phi (Inl sphi)\" using q_val Inl\n      unfolding valid_def by (auto simp: Let_def)\n    from q_val Inl a_def\n    have sphi_bounds: \"s_at sphi \\<ge> ETP rho (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> \\<tau> rho i - n) \n      \\<and> s_at sphi \\<le> i\"\n      unfolding valid_def\n      by (auto simp: Let_def i_etp_to_tau split: list.splits if_splits enat.splits)\n    from valphi val_SAT_imp_l[OF bf] SATs have check_sphi: \"s_check rho phi sphi\"\n      unfolding valid_def by auto\n    then show ?thesis\n    proof (cases p')\n      case (Inl a')\n      then have p'l: \"p' = Inl a'\" by simp\n      then obtain sphi' where a'_def: \"a' = SOnce (i-1) sphi'\"\n        using p'_def unfolding optimal_def valid_def\n        by (cases a') auto\n      then have sphi'_bounds: \"ETP rho (case right I of enat n \\<Rightarrow> (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0) \\<le> s_at sphi'\n      \\<and> s_at sphi' < i \\<and> s_at sphi' \\<le> LTP rho (\\<tau> rho i - left I)\"\n        using a'_def Inl p'_def i_props mem_imp_le_ltp[of i I \"s_at sphi'\"]\n        unfolding optimal_def valid_def\n        by (auto simp: Let_def diff_commute i_etp_to_tau le_diff_conv split: enat.splits)\n      from a'_def Inl have \"s_check rho phi sphi'\" using p'_def\n        unfolding optimal_def valid_def by (auto simp: Let_def)\n      from SATs vmin have minl: \"\\<exists>a. minp = Inl a\" using minp val_SAT_imp_l[OF bf]\n        by auto\n      from p'_def have p'_val: \"valid rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi) p'\"\n        unfolding optimal_def by auto\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = min_list_wrt wqo [Inl (SOnce i sphi'), Inl (SOnce i a1)]\"\n            using p1l p'l True a'_def minp filter_nnil\n            unfolding doOnce_def \n            by (cases p1) auto\n          show ?thesis\n          proof (cases \"s_at sphi = i\")\n            case sphi_i: True\n            have \"wqo (Inl (SOnce i a1)) q\"\n              using SOnce a_def optimal_def p1_def p1l sphi_i valphi q_s\n              unfolding optimal_def valid_def by auto\n            then show ?thesis\n              using q_s a_def pw_total[of i \"Once I phi\"]\n                once_sound[OF i_props p1_def p'_def] p'l a'_def p1l True\n              unfolding form doOnce_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          next\n            case False\n            have incr: \"checkIncr (Inl (SOnce (i-1) sphi'))\" \"checkIncr (Inl (SOnce (i-1) sphi))\"\n              using p'l a'_def False sphi'_bounds sphi_bounds\n              by (auto intro!: checkIncr.intros)\n            have valid: \"valid rho (i - 1) (Once (subtract (\\<Delta> rho i) I) phi) (Inl (SOnce (i-1) sphi))\"\n              using False valid_shift_SOnce a_def i_props q_s q_val sphi_bounds by fastforce\n            have wqo: \"wqo (Inl (SOnce (i-1) sphi')) (Inl (SOnce (i-1) sphi))\"\n              using valphi p'_def p'l a'_def a_def valid\n              unfolding optimal_def valid_def\n              by (simp add: Let_def split: sum.split)\n            from proofIncr_mono[OF incr wqo p'_val[unfolded p'l a'_def] valid] have \"wqo (Inl (SOnce i sphi')) q\"\n              unfolding q_s a_def using i_props\n              by (auto simp add: Let_def proofIncr_def)\n            then show ?thesis\n              using q_s a_def pw_total[of i \"Once I phi\"]\n                once_sound[OF i_props p1_def p'_def] p'l a'_def p1l True\n              unfolding form doOnce_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          qed\n        next\n          case False\n          have form: \"minp = min_list_wrt wqo [Inl (SOnce i sphi')]\"\n            using p1l p'l False a'_def minp filter_nnil\n            unfolding doOnce_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have sphi_le_i: \"s_at sphi < i\"\n            using False a_def q_s q_val soundness check_sound(1) le_eq_less_or_eq \n            unfolding valid_def \n            by (auto simp add: Let_def  split: sum.splits)\n          then have incr: \"checkIncr (Inl (SOnce (i-1) sphi'))\" \"checkIncr (Inl (SOnce (i-1) sphi))\"\n            using p'l a'_def False sphi'_bounds sphi_bounds\n            by (auto intro!: checkIncr.intros)\n          have valid: \"valid rho (i - 1) (Once (subtract (\\<Delta> rho i) I) phi) (Inl (SOnce (i-1) sphi))\"\n            using False valid_shift_SOnce a_def i_props q_s q_val sphi_bounds sphi_le_i by fastforce\n          have wqo: \"wqo (Inl (SOnce (i-1) sphi')) (Inl (SOnce (i-1) sphi))\"\n            using valphi p'_def p'l a'_def a_def valid\n            unfolding optimal_def valid_def\n            by (simp add: Let_def split: sum.split)\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'l a'_def] valid] have \"wqo (Inl (SOnce i sphi')) q\"\n            unfolding q_s a_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_s a_def pw_total[of i \"Once I phi\"]\n                once_sound[OF i_props p1_def p'_def] p'l a'_def p1l False\n            unfolding form doOnce_def\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        qed\n      next\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          have form: \"minp = min_list_wrt wqo [Inl (SOnce i sphi')]\"\n            using p1r p'l True a'_def minp filter_nnil\n            unfolding doOnce_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have sphi_le_i: \"s_at sphi < i\"\n            using True a_def q_s q_val soundness check_sound(1) \n              le_eq_less_or_eq p1r p1_def\n            unfolding optimal_def valid_def \n            apply (simp add: Let_def split: sum.split)\n            using bfphi check_consistent by force\n          then have incr: \"checkIncr (Inl (SOnce (i-1) sphi'))\" \"checkIncr (Inl (SOnce (i-1) sphi))\"\n            using p'l a'_def True sphi'_bounds sphi_bounds\n            by (auto intro!: checkIncr.intros)\n          have valid: \"valid rho (i - 1) (Once (subtract (\\<Delta> rho i) I) phi) (Inl (SOnce (i-1) sphi))\"\n            using True valid_shift_SOnce a_def i_props q_s q_val sphi_bounds sphi_le_i by fastforce\n          have wqo: \"wqo (Inl (SOnce (i-1) sphi')) (Inl (SOnce (i-1) sphi))\"\n            using valphi p'_def p'l a'_def a_def valid\n            unfolding optimal_def valid_def\n            by (simp add: Let_def split: sum.split)\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'l a'_def] valid] have \"wqo (Inl (SOnce i sphi')) q\"\n            unfolding q_s a_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_s a_def pw_total[of i \"Once I phi\"]\n                once_sound[OF i_props p1_def p'_def] p'l a'_def p1r True\n            unfolding form doOnce_def\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        next\n          case False\n          have form: \"minp = min_list_wrt wqo [Inl (SOnce i sphi')]\"\n            using p1r p'l False a'_def minp filter_nnil\n            unfolding doOnce_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have sphi_le_i: \"s_at sphi < i\"\n            using False a_def q_s q_val soundness check_sound(1) \n              le_eq_less_or_eq p1r p1_def\n            unfolding optimal_def valid_def \n            apply (simp add: Let_def split: sum.split)\n            using bfphi check_consistent by force\n          then have incr: \"checkIncr (Inl (SOnce (i-1) sphi'))\" \"checkIncr (Inl (SOnce (i-1) sphi))\"\n            using p'l a'_def False sphi'_bounds sphi_bounds\n            by (auto intro!: checkIncr.intros)\n          have valid: \"valid rho (i - 1) (Once (subtract (\\<Delta> rho i) I) phi) (Inl (SOnce (i-1) sphi))\"\n            using False valid_shift_SOnce a_def i_props q_s q_val sphi_bounds sphi_le_i by fastforce\n          have wqo: \"wqo (Inl (SOnce (i-1) sphi')) (Inl (SOnce (i-1) sphi))\"\n            using valphi p'_def p'l a'_def a_def valid\n            unfolding optimal_def valid_def\n            by (simp add: Let_def split: sum.split)\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'l a'_def] valid] have \"wqo (Inl (SOnce i sphi')) q\"\n            unfolding q_s a_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_s a_def pw_total[of i \"Once I phi\"]\n                once_sound[OF i_props p1_def p'_def] p'l a'_def p1r False\n            unfolding form doOnce_def\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        qed\n      qed\n    next\n      case (Inr b')\n      then have p'r: \"p' = Inr b'\" by simp\n      then obtain vphis' where b'_def: \"b' = VOnce (i-1) li vphis'\"\n        using p'_def doOnce_def p'_form by auto\n      from p'_def have p'_val: \"valid rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi) p'\"\n        unfolding optimal_def by auto\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = min_list_wrt wqo [Inl (SOnce i a1)]\"\n            using p1l p'r True b'_def minp filter_nnil\n            unfolding doOnce_def \n            by (cases p1) (auto)\n          show ?thesis\n          proof (cases \"s_at sphi = i\")\n            case sphi_i: True\n            have \"wqo (Inl (SOnce i a1)) q\"\n              using SOnce a_def optimal_def p1_def p1l sphi_i valphi q_s\n              unfolding optimal_def valid_def by auto\n            then show ?thesis\n              using q_s a_def pw_total[of i \"Once I phi\"]\n                once_sound[OF i_props p1_def p'_def] p1l True\n              unfolding form doOnce_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          next\n            case False\n            have sphi_le_i: \"s_at sphi < i\"\n              using False a_def q_s q_val p1l sphi_bounds unfolding valid_def \n              by (auto simp add: Let_def)\n            have wqo_p1: \"wqo (Inl a1) (Inl sphi)\" \n              using p1_def Inl True valphi p'_def p'r q_s q_val\n              unfolding optimal_def apply simp\n              by (metis (no_types, lifting) trans_wqo.valid_shift_SOnce One_nat_def Suc_diff_1 sum.distinct(1) a_def bf' completeness i_props le_Suc_eq sphi_bounds trans_wqo_axioms val_SAT_imp_l val_VIO_imp_r)\n            have \"wqo (Inl (SOnce i a1)) q\"\n              using q_s a_def SOnce[OF wqo_p1] by auto\n            then show ?thesis\n              using q_s a_def pw_total[of i \"Once I phi\"]\n                once_sound[OF i_props p1_def p'_def] p1l True\n              unfolding form doOnce_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          qed\n        next\n          case False\n          then have form: \"minp = Inr (VOnce i li vphis')\"\n            using b'_def Inl minp Inr filter_nnil unfolding doOnce_def\n            by (cases p1) (auto simp: min_list_wrt_def split: enat.splits)\n          then show ?thesis\n            using q_s a_def valphi p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split)\n            using SATs val_SAT_imp_l[OF bf] vmin by auto\n        qed\n      next\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by simp\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = (p' \\<oplus> p1)\"\n            thm val_VIO_imp_r[OF bf vmin]\n            using p'r b'_def Inl minp Inr filter_nnil val_VIO_imp_r[OF bf vmin]\n            unfolding doOnce_def \n            by (cases p1) (auto simp add: min_list_wrt_def split: sum.split)\n          have form_algo: \"doOnce i (left I) p1 p' = [(p' \\<oplus> p1)]\"\n            using p1r p'r True b'_def unfolding doOnce_def by auto\n          have check_p: \"checkApp p' p1\"\n            using valid_checkApp_VOnce[of i I phi li vphis']\n              p'r p1r b'_def True p1_def p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split if_splits)\n             apply (metis (no_types, lifting) checkApp.intros(7) Nil_is_append_conv map_is_Nil_conv not_Cons_self2)\n            using b'_def diff_0_eq_0 p'_val subtract_simps(1) valid_checkApp_VOnce by presburger\n          have p_val: \"valid rho i (Once I phi) (p' \\<oplus> p1)\"\n            using p'r b'_def p1r vmin form once_sound[OF i_props p1_def p'_def]\n            by auto\n          then have p_optimal: \"optimal i (Once I phi) (p' \\<oplus> p1)\"\n            using p'r b'_def p1r vmin form check_p \n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: if_split sum.split)\n            using SATs val_SAT_imp_l[OF bf vmin] vmin by blast\n          then show ?thesis using form check_p p_val p'r b'_def p1r vmin q_s nopt p_optimal\n            unfolding optimal_def valid_def\n            by blast            \n        next\n          case False\n          then have form: \"minp = Inr (VOnce i li vphis')\"\n            using p'r b'_def Inl minp Inr filter_nnil unfolding doOnce_def\n            by (cases p1) (auto simp: min_list_wrt_def split: enat.splits)\n          then show ?thesis\n            using q_s a_def valphi p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split)\n            using SATs val_SAT_imp_l[OF bf] vmin by auto\n        qed\n      qed\n    qed\n  next\n    case (Inr b)\n    then have qr: \"q = Inr b\" by simp\n    then have VIO: \"VIO rho i (Once I phi)\"\n      using q_val check_sound(2)[of rho \"Once I phi\" b]\n      unfolding valid_def by simp\n    then have formb: \"\\<exists>ps. b = VOnce i li ps\"\n      using Inr q_val i_props unfolding valid_def by (cases b) (auto simp: li)\n    moreover\n    {fix li' ps\n      assume bv: \"b = VOnce i li' ps\"\n      have li'_def: \"li' = li\"\n        using q_val\n        by (auto simp: Inr bv valid_def li)\n      have \"wqo minp q\"\n        using bv\n      proof (cases p')\n        case (Inl a')\n        then obtain p1' where a's: \"a' = SOnce (i-1) p1'\"\n          using p'_def\n          unfolding optimal_def valid_def\n          by (cases a') auto\n        from bv qr have mapt: \"map v_at ps = [ETP rho (case right I of enat n \\<Rightarrow> (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0) ..< Suc (l rho i I)]\"\n          using q_val unfolding valid_def by (auto simp: Let_def split: enat.splits)\n        then have ps_check: \"\\<forall>p \\<in> set ps. v_check rho phi p\"\n          using bv qr q_val unfolding valid_def\n          by (auto simp: Let_def)\n        then have jc: \"\\<forall>j \\<in> set (map v_at ps). \\<exists>p. v_at p = j \\<and> v_check rho phi p\"\n          using map_set_in_imp_set_in[OF ps_check] by auto\n        then have sp1'_bounds: \"ETP rho (case right I of enat n \\<Rightarrow> (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0) \\<le> s_at p1'\n        \\<and> s_at p1' < i \\<and> s_at p1' \\<le> LTP rho (\\<tau> rho i - left I)\"\n          using a's Inl p'_def i_props mem_imp_le_ltp[of i I \"s_at p1'\"]\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def diff_commute i_etp_to_tau le_diff_conv split: enat.splits)\n        from sp1'_bounds have p1'_in: \"s_at p1' \\<in> set (map v_at ps)\" using mapt\n          by (auto split: if_splits)\n        from a's Inl have \"s_check rho phi p1'\" using p'_def\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        then have False using jc p1'_in check_consistent[OF bfphi] by auto\n        then show ?thesis by simp\n      next\n        case (Inr b')\n        then have p'b': \"p' = Inr b'\" by simp\n        then have b'v: \"(\\<exists>ps. b' = VOnce (i-1) li ps)\"\n          using Inr p'_def i_props i_props_imp_not_le_once[OF i_props p'_def]\n          unfolding optimal_def valid_def by (cases b') (auto simp: Let_def li_def)\n        moreover\n        {fix li'' vphis'\n          assume b'v: \"b' = VOnce (i-1) li'' vphis'\"\n          have li''_def: \"li'' = li\"\n            using p'_def\n            by (auto simp: Inr b'v optimal_def valid_def li_def)\n          have \"wqo minp q\"\n            using b'v\n          proof (cases p1)\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inl (SOnce i (projl p1))\"\n                using Inl p'b' b'v minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doOnce_def \n                by (cases p1) (auto simp: min_list_wrt_def)\n              then obtain p1' where p1l: \"p1 = Inl p1'\"\n                using True b'v Inl minp Inr val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doOnce_def\n                by (cases p1; auto simp: min_list_wrt_def split: if_splits)\n              then show ?thesis\n                using form qr bv Inl p1_def q_val unfolding optimal_def valid_def\n                by (metis Inr_Inl_False VIO bf val_VIO_imp_r vmin)\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inr (VOnce i li vphis')\"\n                using b'v Inl minp Inr filter_nnil unfolding doOnce_def\n                by (cases p1) (auto simp: min_list_wrt_def li''_def split: enat.splits)\n              then show ?thesis using qr bv q_val i_props\n                unfolding optimal_def valid_def\n                apply (auto simp add: Let_def False i_ltp_to_tau i_etp_to_tau split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi) (Inr (VOnce (i-1) li' ps))\"\n                    using valid_shift_VOnce[of i I phi li' ps] i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VOnce (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VOnce)\n                  moreover have \"checkIncr (Inr (VOnce (i-1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VOnce)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VOnce (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                qed\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi) (Inr (VOnce (i-1) li ps))\"\n                    using prems val_ge_zero_never_once[OF p'b' b'v p'_val] diff_cancel_middle[of \"\\<tau> rho i\" \"left I\" \"\\<tau> rho (i-1)\"]\n                    unfolding valid_def\n                    by (auto simp add: le_diff_conv Let_def i_ltp_to_tau i_etp_to_tau li'_def li''_def split: enat.splits)\n                  then have \"wqo p' (Inr (VOnce (i-1) li ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VOnce)\n                  moreover have \"checkIncr (Inr (VOnce (i - 1) li ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VOnce)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VOnce (i-1) li ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v  \n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                qed\n                using p1_def False Inl q_val i_props vmin\n                apply (auto simp: Let_def optimal_def valid_def i_ltp_to_tau i_etp_to_tau i_le_ltpi split: if_splits)\n                using not_wqo vmin apply blast\n                done\n            qed\n          next\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p1\" using Inr b'v p'b' minp\n                  val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doOnce_def \n                by (cases p1) (auto simp: min_list_wrt_def)\n              then obtain p1' where p1r: \"p1 = Inr p1'\"\n                using True b'v Inr minp Inr val_VIO_imp_r[OF bf vmin VIO]\n                  filter_nnil\n                unfolding doOnce_def\n                by (cases p1; auto simp: min_list_wrt_def split: if_splits)\n              then show ?thesis\n                using form_min qr bv Inr p1_def q_val unfolding optimal_def valid_def\n                apply (cases ps rule: rev_cases)\n                 apply (auto simp add: Let_def True i_ltp_to_tau i_etp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems for ys y\n                proof -\n                  from vmin form_min p1r have p_val: \"valid rho i (Once I phi) (p' \\<oplus> (Inr p1'))\"\n                    by auto\n                  have check_p: \"checkApp p' (Inr p1')\"\n                    using p'_def True\n                    unfolding p1r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VOnce)\n                  from prems have y_val: \"valid rho i phi (Inr y)\"\n                    using q_val True i_le_ltpi i_props unfolding valid_def\n                    by (auto simp: Let_def min_def split: if_splits)\n                  have val_q': \"valid rho (i - 1) (Once (subtract (delta rho i (i - 1)) I) phi) (Inr (VOnce (i - 1) li' ys))\"\n                    using valid_shift_VOnce[of i I phi li' ps] i_props q_val True prems(8)\n                    by (auto simp: qr bv)\n                  then have q_val2: \"valid rho i (Once I phi) ((Inr (VOnce (i-1) li' ys)) \\<oplus> (Inr y))\"\n                    using q_val prems i_props by (auto simp: li'_def)\n                  have check_q: \"checkApp (Inr (VOnce (i-1) li' ys)) (Inr y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_VOnce)\n                  from p'_def have wqo_p': \"wqo p' (Inr (VOnce (i - 1) li' ys))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p1: \"wqo p1 (Inr y)\" using i_props p1_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    unfolding prems using p'b' b'v p1_def q_val prems p1r unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' wqo_p1[unfolded p1r] p_val q_val2]\n                    apply (auto simp: li''_def li)\n                    by (metis One_nat_def Suc_diff_1 bv i_props q_le qr)\n                qed\n                done\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inr (VOnce i li vphis')\"\n                using b'v minp Inr filter_nnil p'b' unfolding doOnce_def\n                by (cases p1) (auto simp: min_list_wrt_def li''_def split: enat.splits)\n              then show ?thesis using qr bv q_val i_props\n                unfolding optimal_def valid_def\n                apply (auto simp add: Let_def False i_ltp_to_tau i_etp_to_tau split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi) (Inr (VOnce (i-1) li' ps))\"\n                    using valid_shift_VOnce[of i I phi li' ps] i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VOnce (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VOnce)\n                  moreover have \"checkIncr (Inr (VOnce (i-1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VOnce)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VOnce (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                qed\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Once (subtract (\\<Delta> rho i) I) phi) (Inr (VOnce (i-1) li ps))\"\n                    using prems val_ge_zero_never_once[OF p'b' b'v p'_val] diff_cancel_middle[of \"\\<tau> rho i\" \"left I\" \"\\<tau> rho (i-1)\"]\n                    unfolding valid_def\n                    by (auto simp add: le_diff_conv Let_def i_ltp_to_tau i_etp_to_tau li'_def li''_def split: enat.splits)\n                  then have \"wqo p' (Inr (VOnce (i-1) li ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VOnce)\n                  moreover have \"checkIncr (Inr (VOnce (i - 1) li ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VOnce)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VOnce (i-1) li ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v  \n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                qed\n                using p1_def False q_val i_props vmin\n                apply (auto simp: Let_def optimal_def valid_def i_ltp_to_tau i_etp_to_tau i_le_ltpi split: if_splits)\n                using not_wqo vmin apply blast\n                done\n            qed\n          qed\n        }\n        then show ?thesis using b'v by blast\n      qed\n    }\n    then show ?thesis using formb by blast\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Historically\\<close>\n\nlemma valid_checkApp_SHistorically: \"valid rho j (Historically I phi) (Inl (SHistorically j li sphis')) \\<Longrightarrow>\n  left I = 0 \\<or> (case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> ETP rho (\\<tau> rho j - n) \\<le> LTP rho (\\<tau> rho j - left I)) \\<Longrightarrow>\n  checkApp (Inl (SHistorically j li sphis')) (Inl p1')\"\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits intro!: checkApp.intros)\n  apply (meson diff_le_self i_etp_to_tau)\n  apply (meson diff_le_self i_etp_to_tau i_le_ltpi leD le_less_trans not_le_imp_less)\n  by (meson diff_le_self i_etp_to_tau)\n\nlemma valid_checkIncr_VHistorically: \"valid rho j phi (Inr (VHistorically j vphi)) \\<Longrightarrow>\n  checkIncr (Inr (VHistorically j vphi))\"\n  apply (cases phi)\n  by (auto simp: valid_def Let_def split: if_splits enat.splits dest!: arg_cong[where ?x=\"map _ _\" and ?f=set] intro!: checkIncr.intros)\n\nlemma valid_checkIncr_SHistorically: \"valid rho j phi (Inl (SHistorically j li sphis')) \\<Longrightarrow>\n  checkIncr (Inl (SHistorically j li sphis'))\"\n  apply (cases phi)\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits dest!: arg_cong[where ?x=\"map _ _\" and ?f=set] intro!: checkIncr.intros)\n  apply (drule imageI[where ?A=\"set sphis'\" and ?f=s_at])\n  apply auto[1]\n  apply (drule imageI[where ?A=\"set sphis'\" and ?f=s_at])\n  apply auto[1]\n  done\n\nlemma valid_shift_SHistorically:\n  assumes i_props: \"i > 0\" \"right I \\<ge> enat (\\<Delta> rho i)\"\n    and valid: \"valid rho i (Historically I phi) (Inl (SHistorically i li ys))\"\n  shows \"valid rho (i - 1) (Historically (subtract (delta rho i (i - 1)) I) phi) (Inl (SHistorically (i - 1) li (if left I = 0 then butlast ys else ys)))\"\nproof (cases \"left I = 0\")\n  case True\n  obtain z zs where ys_def: \"ys = zs @ [z]\"\n    using valid True\n    apply (cases ys rule: rev_cases)\n    apply (auto simp: valid_def Let_def split: if_splits enat.splits)\n    apply (meson diff_le_self i_etp_to_tau)\n    by (meson \\<tau>_mono diff_le_self i_etp_to_tau i_ltp_to_tau i_props(1) less_or_eq_imp_le)\n  show ?thesis\n    using assms etpi_imp_etp_suci i_props True\n    unfolding optimal_def valid_def\n    apply (auto simp add: Let_def i_ltp_to_tau ys_def split: if_splits)\n    using i_le_ltpi by (auto simp: min_def split: enat.splits)\nnext\n  case False\n  have b: \"\\<tau> rho i \\<ge> \\<tau> rho 0 + left I\"\n    using valid\n    by (auto simp: valid_def Let_def)\n  have rw: \"\\<tau> rho (i - Suc 0) - (left I + \\<tau> rho (i - Suc 0) - \\<tau> rho i) =\n    (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    by auto\n  have e: \"right I = enat n \\<Longrightarrow> right (subtract (delta rho i (i - 1)) I) = enat n' \\<Longrightarrow>\n    ETP rho (\\<tau> rho i - n) = ETP rho (\\<tau> rho (i - 1) - n')\" for n n'\n    apply (auto)\n    by (metis One_nat_def diff_cancel_middle enat_ord_simps(1) i_props(2) le_diff_conv)\n  have l: \"l rho i I = min (i - Suc 0) (LTP rho (\\<tau> rho i - left I))\"\n    using False b\n    apply (auto simp: min_def)\n    by (meson i_le_ltpi_minus i_props leD)\n  have t: \"\\<tau> rho (i - 1) - left (subtract (delta rho i (i - 1)) I) =\n  (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    using i_props\n    by auto\n  have F1: \"\\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho 0 + left (subtract (delta rho i (i - 1)) I)\"\n    using i_props b\n    apply (auto)\n    using i_props i_to_predi_props by blast\n  have F3: \"\\<not> \\<tau> rho i \\<le> left I + \\<tau> rho (i - Suc 0) \\<Longrightarrow>\n    LTP rho (\\<tau> rho i - left I) = LTP rho (\\<tau> rho (i - 1))\"\n    using False i_props LTP_lt_delta b\n    apply (auto)\n    by (smt (z3) One_nat_def Suc_pred diff_is_0_eq i_le_ltpi_minus le_add_diff_inverse2 nat_le_linear neq0_conv predi_eq_ltp rw trans_le_add2)\n  show ?thesis\n    using False F1 valid e\n    by (auto simp: valid_def Let_def rw t l F3 split: enat.splits)\nqed\n\nlemma valid_shift_VHistorically:\n  assumes i_props: \"i > 0\" \"right I \\<ge> enat (\\<Delta> rho i)\"\n    and valid: \"valid rho i (Historically I phi) (Inr (VHistorically i p))\"\n    and s_at_p: \"v_at p \\<le> i - (Suc 0)\"\n  shows \"valid rho (i - 1) (Historically (subtract (delta rho i (i - 1)) I) phi) (Inr (VHistorically (i - 1) p))\"\nproof (cases \"left I = 0\")\n  case True\n  obtain z where p_def: \"p = z\"\n    using valid True\n    by blast\n  then show ?thesis\n    using assms etpi_imp_etp_suci i_props True i_le_ltpi\n    unfolding optimal_def valid_def\n    apply (auto simp add: Let_def i_ltp_to_tau p_def split: if_splits enat.splits)\n    subgoal premises prems\n    proof (cases \"right I\")\n      case (enat nat)\n      then show ?thesis\n        using i_le_ltpi prems enat_ord_simps(1) idiff_enat_enat by force\n    next\n      case infinity\n      then show ?thesis \n        using i_le_ltpi prems enat_ord_simps(1) idiff_enat_enat by force\n    qed\n    done\nnext\n  case False\n  have b: \"\\<tau> rho i \\<ge> \\<tau> rho 0 + left I\"\n    using valid False\n    apply (auto simp: valid_def Let_def)\n    by (smt (verit, best) diff_cancel_middle diff_diff_right diff_is_0_eq diff_le_self le_add_diff_inverse2 le_trans less_\\<tau>D linorder_not_le)\n  have rw: \"\\<tau> rho (i - Suc 0) - (left I + \\<tau> rho (i - Suc 0) - \\<tau> rho i) =\n    (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    by auto\n  have e: \"right I = enat n \\<Longrightarrow> right (subtract (delta rho i (i - 1)) I) = enat n' \\<Longrightarrow>\n    ETP rho (\\<tau> rho i - n) = ETP rho (\\<tau> rho (i - 1) - n')\" for n n'\n    apply (auto)\n    by (metis One_nat_def diff_cancel_middle enat_ord_simps(1) i_props(2) le_diff_conv)\n  have l: \"l rho i I = min (i - Suc 0) (LTP rho (\\<tau> rho i - left I))\"\n    using False b\n    apply (auto simp: min_def)\n    by (meson i_le_ltpi_minus i_props leD)\n  have t: \"\\<tau> rho (i - 1) - left (subtract (delta rho i (i - 1)) I) =\n  (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    using i_props\n    by auto\n  have F1: \"\\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho 0 + left (subtract (delta rho i (i - 1)) I)\"\n    using i_props b\n    apply (auto)\n    using i_props i_to_predi_props by blast\n  have F3: \"\\<not> \\<tau> rho i \\<le> left I + \\<tau> rho (i - Suc 0) \\<Longrightarrow>\n    LTP rho (\\<tau> rho i - left I) = LTP rho (\\<tau> rho (i - 1))\"\n    using False i_props LTP_lt_delta b\n    apply (auto)\n    by (smt (z3) One_nat_def Suc_pred diff_is_0_eq i_le_ltpi_minus le_add_diff_inverse2 nat_le_linear neq0_conv predi_eq_ltp rw trans_le_add2)\n  show ?thesis\n    using False F1 valid e s_at_p\n    apply (auto simp: valid_def Let_def rw t l F3)\n    subgoal premises prems\n    proof (cases \"right I\")\n      case (enat nat)\n      then show ?thesis\n        using prems\n        by (auto simp add: sat_Once_rec le_diff_conv)\n    next\n      case infinity\n      then show ?thesis\n        using prems\n        by (auto simp add: sat_Once_rec le_diff_conv)\n    qed\n    done\nqed\n\nlemma historicallyBase0_sound:\n  assumes p1_def: \"optimal i phi p1\" and\n    i_props: \"i = 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\" and\n    p_def: \"p \\<in> set (doHistoricallyBase 0 0 p1)\"\n  shows \"valid rho i (Historically I phi) p\"\n  using assms unfolding optimal_def valid_def doHistoricallyBase_def\n  apply (simp add: i_etp_to_tau zero_enat_def[symmetric] split: sum.splits enat.splits)\n  apply (meson order_class.order.not_eq_order_implies_strict diff_le_self i_etp_to_tau less_nat_zero_code)\n  done\n\nlemma historicallyBase0_optimal:\n  assumes bf: \"bounded_future (Historically I phi)\" and\n    p1_def: \"optimal i phi p1\" and\n    i_props: \"i = 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\"\n  shows\n    \"optimal i (Historically I phi) (min_list_wrt wqo (doHistoricallyBase 0 0 p1))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  from doHistoricallyBase_def[of 0 0 p1]\n  have nnil: \"doHistoricallyBase 0 0 p1 \\<noteq> []\"\n    by (cases p1; auto)\n  assume nopt: \"\\<not> optimal i (Historically I phi) (min_list_wrt wqo (doHistoricallyBase 0 0 p1))\"\n  from historicallyBase0_sound[OF p1_def i_props min_list_wrt_in[of _ wqo]]\n    refl_wqo pw_total trans_wqo nnil\n  have vmin: \"valid rho i (Historically I phi) (min_list_wrt wqo (doHistoricallyBase 0 0 p1))\"\n    apply simp\n    by (metis i_props not_wqo p1_def historicallyBase0_sound total_onI)\n  then obtain q where q_val: \"valid rho i (Historically I phi) q\" and\n    q_le: \"\\<not> wqo (min_list_wrt wqo (doHistoricallyBase 0 0 p1)) q\" using nopt\n    unfolding optimal_def by auto\n  then have \"wqo (min_list_wrt wqo (doHistoricallyBase 0 0 p1)) q\"\n  proof (cases q)\n    case (Inr b)\n    then obtain vphiq where sq: \"b = VHistorically i vphiq\"\n      using q_val unfolding valid_def\n      by (cases b) auto\n    then have p_val: \"valid rho i phi (Inr vphiq)\" using Inr q_val i_props\n      unfolding valid_def\n      by (auto simp: Let_def)\n    then have p_le: \"wqo p1 (Inr vphiq)\" using p1_def unfolding optimal_def\n      by auto\n    obtain p1' where p1'_def: \"p1 = Inr p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inr (VHistorically i p1')) q\"\n      using VHistorically[OF p_le[unfolded p1'_def]] sq Inr\n      by (fastforce simp add: p1'_def map_idI)\n    moreover have \"Inr (VHistorically i (projr p1)) \\<in> set (doHistoricallyBase 0 0 p1)\"\n      using i_props p1_def bf check_consistent[of phi] p_val\n      unfolding doHistoricallyBase_def optimal_def valid_def\n      by (auto split: sum.splits)\n    ultimately show ?thesis using min_list_wrt_le[OF _ refl_wqo]\n        historicallyBase0_sound[OF p1_def i_props] pw_total[of i \"Historically I phi\"]\n        trans_wqo Inr\n      apply (auto simp add: total_on_def p1'_def)\n      by (metis transpD)\n  next\n    case (Inl a)\n    {fix sphi li\n      assume sa: \"a = SHistorically i li [sphi]\"\n      then have a_val: \"valid rho i phi (Inl sphi)\" using Inl q_val i_props\n        unfolding valid_def by (auto simp: Let_def split: if_splits)\n      then have lcomp: \"wqo p1 (Inl sphi)\"\n        using p1_def unfolding optimal_def by simp\n      have li_def: \"li = (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n))\"\n        using q_val\n        by (auto simp: Inl sa valid_def)\n      obtain p1' where p1'_def: \"p1 = Inl p1'\"\n        using a_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have etp_0: \"ETP rho (\\<tau> rho 0 - n) = 0\" for n\n        by (meson Nat.bot_nat_0.extremum_uniqueI diff_le_self i_etp_to_tau)\n      have \"wqo (Inl (SHistorically i li [p1'])) q\"\n        using sa Inl SHistorically lcomp\n        by (auto simp add: p1'_def)\n      moreover have \"Inl (SHistorically i li [p1']) \\<in> set (doHistoricallyBase 0 0 p1)\"\n        using i_props p1_def bf check_consistent a_val\n        unfolding doHistoricallyBase_def optimal_def valid_def\n        by (auto split: sum.splits enat.splits simp: p1'_def li_def etp_0)\n      ultimately have \"wqo (min_list_wrt wqo (doHistoricallyBase 0 0 p1)) q\"\n        using min_list_wrt_le[OF _ refl_wqo]\n          historicallyBase0_sound[OF p1_def i_props] pw_total[of i \"Historically I phi\"]\n          trans_wqo Inl\n        apply (auto simp add: total_on_def)\n        by (metis transpD)\n    }\n    then show ?thesis using Inl q_val assms unfolding valid_def\n      apply (cases a)\n                       apply (auto simp: Let_def split: if_splits enat.splits)\n       apply (metis order.asym diff_le_self i_etp_to_tau i_props le_0_eq)\n      apply (metis diff_le_self i_etp_to_tau i_le_ltpi le_zero_eq)\n      done\n  qed\n  then show False using q_le by auto\nqed\n\nlemma historicallyBaseNZ_sound:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n  \\<and> right I < enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\"\n    and p_def: \"p \\<in> set (doHistoricallyBase i (left I) p1)\"\n  shows \"valid rho i (Historically I phi) p\"\nproof (cases \"left I\")\n  {fix i::nat\n    assume i_ge: \"i > 0\"\n    then have \"\\<tau> rho i \\<le> \\<tau> rho i \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0\" by auto\n    then have \"i \\<le> LTP rho (\\<tau> rho i)\" using i_ge\n      by (auto simp add: i_ltp_to_tau)\n    then have \"i \\<le> min i (LTP rho (\\<tau> rho i))\" by auto\n  } note ** = this\n  case 0\n  then show ?thesis\n  proof (cases p1)\n    case (Inr b)\n    then have p1r: \"p1 = Inr b\" by auto\n    then have \"p = Inr (VHistorically i b)\" using p_def p1r \"local.0\"\n      unfolding doHistoricallyBase_def by simp\n    then show ?thesis using p1_def \"local.0\" Inr zero_enat_def\n      unfolding optimal_def valid_def by auto\n  next\n    case (Inl a)\n    then have p1s: \"p1 = Inl a\" by auto\n    then have \"p = Inl (SHistorically i i [a])\" using p_def p1s \"local.0\"\n      unfolding doHistoricallyBase_def by simp\n    then show ?thesis using p_def p1_def i_props Inl p1s \"local.0\"\n        pastBase_constrs[OF i_props] ** ETP_lt_delta enat_iless\n      unfolding optimal_def valid_def\n      by (auto simp: Let_def i_etp_to_tau split: enat.splits sum.splits)\n  qed\nnext\n  case (Suc n)\n  then show ?thesis\n  proof (cases p1)\n    case (Inl a)\n    then have \"p = Inl (SHistorically i i [])\" using p_def Suc p1_def\n      unfolding doHistoricallyBase_def by auto\n    then show ?thesis using Inl p_def p1_def Suc i_props pastBase_constrs[OF i_props] ETP_lt_delta enat_iless\n      unfolding valid_def\n      by (auto simp: Let_def split: enat.splits)\n        (metis add_Suc_right i_le_ltpi_minus leD not_less_eq_eq zero_less_Suc)\n  next\n    case (Inr b)\n    then have \"p = Inl (SHistorically i i [])\" using p_def Suc p1_def\n      unfolding doHistoricallyBase_def by auto\n    then show ?thesis using Inr p_def p1_def Suc i_props pastBase_constrs[OF i_props] ETP_lt_delta enat_iless\n      unfolding valid_def\n      by (auto simp: Let_def split: enat.splits)\n        (metis add_Suc_right i_le_ltpi_minus leD not_less_eq_eq zero_less_Suc)\n  qed\nqed\n\nlemma historicallyBaseNZ_optimal:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n  \\<and> right I < enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\"\n    and bf: \"bounded_future (Historically I phi)\"\n  shows \"optimal i (Historically I phi) (min_list_wrt wqo (doHistoricallyBase i (left I) p1))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  from doHistoricallyBase_def[of i \"left I\" p1]\n  have nnil: \"doHistoricallyBase i (left I) p1 \\<noteq> []\"\n    by (cases p1; cases \"left I\"; auto)\n  from pw_total[of i \"Once I phi\"] have total_set: \"total_on wqo (set (doHistoricallyBase i (left I) p1))\"\n    using historicallyBaseNZ_sound[OF i_props p1_def]\n    by (metis not_wqo total_onI)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doHistoricallyBase i (left I) p1). wqo x y) (doHistoricallyBase i (left I) p1) \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doHistoricallyBase i (left I) p1). wqo x y)\" \"(doHistoricallyBase i (left I) p1)\"]\n    by simp\n  assume nopt: \"\\<not> optimal i (Historically I phi) (min_list_wrt wqo (doHistoricallyBase i (left I) p1))\"\n  define minp where minp: \"minp \\<equiv> (min_list_wrt wqo (doHistoricallyBase i (left I) p1))\"\n  {\n    assume l_ge: \"left I > 0\"\n    then have \"right I > 0\" using left_right[of I] zero_enat_def\n      apply auto\n      using enat_0_iff(2) by auto\n    then have \"\\<not> mem (delta rho i i) I\" using l_ge by auto\n    then have \"\\<forall>j \\<le> i. \\<not> mem (delta rho i j) I\"\n      using i_props r_less_Delta_imp_less l_ge le_neq_implies_less\n      by blast\n    then have \"sat rho i (Historically I phi)\" by auto\n    then have \"SAT rho i (Historically I phi)\" using completeness\n      by blast\n  } note * = this\n  from historicallyBaseNZ_sound[OF i_props p1_def min_list_wrt_in[of _ wqo]]\n    minp trans_wqo refl_wqo pw_total nnil\n  have vmin: \"valid rho i (Historically I phi) minp\"\n    apply auto\n    by (metis i_props not_wqo p1_def historicallyBaseNZ_sound total_onI)\n  then obtain q where q_val: \"valid rho i (Historically I phi) q\" and\n    q_le: \"\\<not> wqo minp q\" using nopt minp unfolding optimal_def\n    by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inr b)\n    then obtain vphiq where vq: \"b = VHistorically i vphiq\"\n      using q_val unfolding valid_def\n      by (cases b) auto\n    then have p_val: \"valid rho i phi (Inr vphiq)\" using Inr q_val i_props\n      unfolding valid_def\n      apply (auto simp: Let_def split: list.splits)\n      by (metis One_nat_def le_neq_implies_less r_less_Delta_imp_less)\n    then have p1_le: \"wqo p1 (Inr vphiq)\" using p1_def unfolding optimal_def\n      by simp\n    from q_val have vio: \"VIO rho i (Historically I phi)\" \n      using check_sound Inr SAT_or_VIO bf q_val val_SAT_imp_l\n      unfolding valid_def by blast\n    obtain p1' where p1'_def: \"p1 = Inr p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inr (VHistorically i (projr p1))) q\"\n      using VHistorically[OF p1_le[unfolded p1'_def]] vq Inr\n      by (fastforce simp add: p1'_def map_idI)\n    moreover have \"Inr (VHistorically i (projr p1)) \\<in> set (doHistoricallyBase i (left I) p1)\"\n      using i_props p1_def bf check_consistent p_val * vio\n      unfolding doHistoricallyBase_def optimal_def valid_def\n      apply (cases \"left I\"; auto split: sum.splits nat.splits)\n      by (metis bf check_complete)\n    ultimately show ?thesis\n      using min_list_wrt_le[OF _ refl_wqo]\n        historicallyBaseNZ_sound[OF i_props p1_def] pw_total[of i \"Historically I phi\"]\n        trans_wqo Inr minp\n      apply (auto simp add: total_on_def)\n      by (metis transpD)\n  next\n    case (Inl a)\n    {fix n j\n      assume j_def: \"right I = enat n \\<and> j \\<le> LTP rho (\\<tau> rho i)\n       \\<and> ETP rho (\\<tau> rho i - n) \\<le> j \\<and> j \\<le> i\"\n      then have jin: \"\\<tau> rho j \\<ge> \\<tau> rho i - n\" using i_etp_to_tau by auto\n      from \\<tau>_mono have j_lei: \"\\<forall>j < i. \\<tau> rho j \\<le> \\<tau> rho (i-1)\" by auto\n      from this i_props j_def have \"\\<forall>j < i. \\<tau> rho j \\<le> \\<tau> rho i - n\"\n        apply auto\n        by (metis One_nat_def j_lei add_diff_inverse_nat add_le_imp_le_diff add_le_mono less_imp_le_nat less_nat_zero_code nat_diff_split_asm)\n      then have \"j = i\" using j_def jin apply auto\n        by (metis add.commute order.not_eq_order_implies_strict diff_diff_left enat_ord_simps(2) i_props j_lei less_le_not_le zero_less_diff)\n    } note ** = this\n    then show ?thesis\n    proof (cases \"left I\")\n      case 0\n      {fix sphi\n        assume as: \"a = SHistorically i i [sphi]\"\n        then have a_val: \"valid rho i phi (Inl sphi)\"\n          using q_val Inl min.absorb_iff1 i_props \"0\" i_le_ltpi\n          unfolding valid_def\n          by (auto simp: Let_def split: if_splits enat.splits)\n        then have p1_wqo: \"wqo p1 (Inl sphi)\"\n          using a_val p1_def unfolding optimal_def\n          by simp\n        obtain p1' where p1'_def: \"p1 = Inl p1'\"\n          using a_val p1_def check_consistent[OF bf_phi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        have \"wqo (Inl (SHistorically i i [p1'])) q\"\n          using as Inl SHistorically p1_wqo\n          by (auto simp add: p1'_def)\n        moreover have \"Inl (SHistorically i i [p1']) \\<in> set (doHistoricallyBase i (left I) p1)\"\n          using i_props bf check_consistent a_val \"0\"\n          unfolding doHistoricallyBase_def optimal_def valid_def\n          by (auto split: sum.splits nat.splits simp: p1'_def)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            historicallyBaseNZ_sound[OF i_props p1_def] pw_total[of i \"Historically I phi\"]\n            trans_wqo as Inl minp\n          apply (auto simp add: total_on_def)\n          by (metis transpD)\n      }\n      moreover\n      have \"\\<exists>sphi. a = SHistorically i i [sphi]\"\n        using q_val \"0\" Inl assms(1) ** \n        unfolding valid_def\n      proof (cases a)\n        case (SHistorically i j vphis)\n        then show ?thesis\n          using SHistorically q_val \"0\" Inl assms(1) ** \n          unfolding valid_def\n          by (cases vphis; cases \"tl vphis\")\n            (auto simp: Let_def min_def i_etp_to_tau i_le_ltpi dest: ETP_lt_delta[simplified] split: if_splits enat.splits)\n      next\n        case (SHistorically_le i)\n        then show ?thesis\n          using q_val \"0\" Inl assms(1) ** \n          unfolding valid_def doOnceBase_def\n          by (auto simp: Let_def leD split: if_splits enat.splits)\n      qed (auto simp: Let_def split: if_splits enat.splits)\n      ultimately show ?thesis by blast\n    next\n      case (Suc nat)\n      from q_val Inl have \"SAT rho i (Historically I phi)\"\n        using check_sound(1)[of rho \"Historically I phi\" a]\n        unfolding valid_def by auto\n      {fix li sphis\n        assume as: \"a = SHistorically i li sphis\"\n        have sphis_Nil: \"sphis = []\"\n          using q_val i_props\n          unfolding valid_def\n          by (simp add: Inl as Let_def split: if_splits enat.splits)\n            (smt (z3) \"**\" linorder_class.min.cobounded1 Suc i_le_ltpi i_le_ltpi_minus leD le_trans min_def zero_less_Suc)\n        have li_def: \"li = i\"\n          using q_val ETP_lt_delta i_props\n          unfolding valid_def\n          by (simp add: Inl as split: enat.splits)\n        have \"wqo (Inl (SHistorically i i [])) q\"\n          using q_val as Inl not_wqo\n          by (fastforce simp add: map_idI sphis_Nil li_def)\n        moreover have \"Inl (SHistorically i i []) \\<in> set (doHistoricallyBase i (left I) p1)\"\n          using i_props p1_def bf check_consistent Suc\n          unfolding doHistoricallyBase_def optimal_def valid_def\n          by (auto split: sum.splits nat.splits)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            historicallyBaseNZ_sound[OF i_props p1_def] pw_total[of i \"Historically I phi\"]\n            trans_wqo as Inl minp\n          apply (simp add: total_on_def)\n          by (metis transpD)\n      }\n      then show ?thesis\n        using minp Suc Inl q_val assms\n        unfolding doHistoricallyBase_def valid_def optimal_def\n        by (cases a) (auto)\n    qed\n  qed\n  then show False using q_le by auto\nqed\n\nlemma historically_sound:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n  \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\" and\n    p'_def: \"optimal (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) p'\"\n    and p_def: \"p \\<in> set (doHistorically i (left I) p1 p')\"\n  shows \"valid rho i (Historically I phi) p\"\nproof (cases p')\n  case (Inr b)\n  then have p'r: \"p' = Inr b\" by auto\n  then have nsatp': \"\\<not> sat rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi)\"\n    using soundness p'_def check_sound(2)[of rho \"Historically (subtract (\\<Delta> rho i) I) phi\" b]\n    unfolding optimal_def valid_def by fastforce\n  then obtain q where b_def: \"b = VHistorically (i-1) q\" using Inr p'_def\n    unfolding optimal_def valid_def p'r\n    apply(cases b)\n    by auto\n  then have b_val: \"v_check rho (Historically (subtract (\\<Delta> rho i) I) phi) b\"\n    using Inr p'_def unfolding optimal_def valid_def by (auto simp: Let_def)\n  then have mem: \"mem (delta rho (i-1) (v_at q)) (subtract (\\<Delta> rho i) I)\"\n    using b_def Inr p'_def s_check.simps unfolding optimal_def valid_def\n    by (auto simp: Let_def)                                                 \n  then have \"left I - \\<Delta> rho i \\<le> delta rho (i-1) (v_at q)\" by auto\n  then have tmp: \"left I \\<le> \\<tau> rho i - \\<tau> rho (i-1) + (\\<tau> rho (i-1) - \\<tau> rho (v_at q))\"\n    by auto\n  from b_val have qi: \"(v_at q) \\<le> (i-1)\" using b_def p'r p'_def\n    unfolding optimal_def valid_def\n    by (auto simp: Let_def)\n  then have liq: \"left I \\<le> delta rho i (v_at q)\" using diff_add_assoc tmp\n    by auto\n  show ?thesis\n  proof (cases \"right I\")\n    case n_def: (enat n)\n    from mem n_def have \"enat (delta rho (i-1) (v_at q)) \\<le> enat n - enat (\\<Delta> rho i)\"\n      by auto\n    then have \"delta rho (i-1) (v_at q) + \\<Delta> rho i \\<le> n\"\n      apply auto\n      by (metis One_nat_def enat_ord_simps(1) i_props le_diff_conv le_diff_conv2 n_def)\n    then have riq: \"enat (delta rho i (v_at q)) \\<le> right I\" using n_def by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases p1)\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by auto\n        then have vps: \"p = Inr (VHistorically i (projr p1)) \\<or> p = Inr (VHistorically i q)\"\n          using b_def p'r True p_def unfolding doHistorically_def optimal_def by auto\n        then show ?thesis\n          using Inr True assms n_def b_val b_def qi riq \n          unfolding optimal_def valid_def\n          by auto\n      next\n        case (Inl a1)\n        then have p1r: \"p1 = Inl a1\" by simp\n        then have vp: \"p = Inr (VHistorically i q)\"\n          using p1r p_def True p'r b_def unfolding doHistorically_def by auto\n        then show ?thesis\n          using Inr Inl True assms n_def b_def unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by simp\n        then have vp: \"p = Inr (VHistorically i q)\"\n          using p1r p_def False p'r b_def unfolding doHistorically_def by auto\n        then show ?thesis\n          using Inr b_def qi liq riq b_val \n          unfolding optimal_def valid_def\n          by (simp add: Let_def)\n      next\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by simp\n        then have vp: \"p = Inr (VHistorically i q)\"\n          using p1l p_def False p'r b_def unfolding doHistorically_def by auto\n        then show ?thesis\n          using Inr b_def qi liq riq b_val\n          unfolding optimal_def valid_def\n          by (simp add: Let_def)\n      qed\n    qed\n  next\n    case infinity\n    then have riq: \"enat (delta rho i (v_at q)) \\<le> right I\" by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases p1)\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by auto\n        then have vps: \"p = Inr (VHistorically i q) \\<or> p = Inr (VHistorically i (projr p1))\"\n          using b_def p'r p1r True p_def unfolding doHistorically_def by auto\n        then show ?thesis\n          using b_def True p'_def p1_def p'r p1r i_props zero_enat_def qi riq\n          unfolding optimal_def valid_def\n          by auto\n      next\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by simp\n        then have vp: \"p = Inr (VHistorically i q)\"\n          using p1l p_def True p'r b_def unfolding doHistorically_def by auto\n        then show ?thesis\n          using Inr True zero_enat_def i_props b_def qi riq b_val\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by simp\n        then have vp: \"p = Inr (VHistorically i q)\"\n          using p1r p_def False p'r b_def unfolding doHistorically_def by auto\n        then show ?thesis\n          using Inr False zero_enat_def b_def qi liq riq b_val \n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      next\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by simp\n        then have vp: \"p = Inr (VHistorically i q)\"\n          using p1l p_def False p'r b_def unfolding doHistorically_def by auto\n        then show ?thesis\n          using Inr False zero_enat_def b_def qi liq riq b_val \n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n    qed\n  qed\nnext\n  case (Inl b)\n  then have p'l: \"p' = Inl b\" by auto\n  then show ?thesis\n  proof (cases b)\n    case (STT x1)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SAtm x21 x22)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SNeg x3)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SDisjL x4)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SDisjR x5)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SConj x61 x62)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SImplR x7)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SImplL x8)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SIff_ss x91 x92)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SIff_vv x101 x102)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SOnce x111 x112)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SEventually x121 x122)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SHistorically j li qs)\n    have li_def: \"li = (case right I - enat (delta rho i (i - Suc 0)) of enat n \\<Rightarrow>\n      ETP rho (\\<tau> rho (i - Suc 0) - n) | \\<infinity> \\<Rightarrow> 0)\"\n      using p'_def p'l SHistorically\n      unfolding valid_def optimal_def\n      by auto\n    have li: \"li = (case right I of enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0)\"\n      using i_props\n      by (auto simp: li_def split: enat.splits)\n    have j_def: \"j = i-1\" using p'l p'_def SHistorically unfolding optimal_def valid_def by auto\n    then show ?thesis \n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases \"right I\")\n        case n_def: (enat n)\n        then show ?thesis\n        proof (cases p1)\n          case (Inr b1)\n          then have \"p = Inr (VHistorically i (projr p1))\"\n            using p'l SHistorically True p_def unfolding doHistorically_def\n            by auto\n          then show ?thesis using p1_def i_props True zero_enat_def Inr\n            unfolding optimal_def valid_def by auto\n        next\n          case (Inl a1)\n          then have p1l: \"p1 = Inl a1\" by auto\n          {\n            from i_props n_def have r: \"n \\<ge> \\<Delta> rho i\" by auto\n            then have \"ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) \\<le> i-1\"\n              using p'_def SHistorically p'l n_def unfolding optimal_def valid_def\n              by (auto simp add: i_etp_to_tau le_diff_conv Let_def split: if_splits)\n            then have \"ETP rho (\\<tau> rho i - n) \\<le> i-1\"\n              using r diff_diff_right[of \"\\<Delta> rho i\" n \"\\<tau> rho (i-1)\"] by auto\n          } note * = this\n          {\n            from i_props have a1_ge: \"s_at a1 > 0\" using p1l p1_def\n              unfolding optimal_def valid_def by auto\n            then have nl_def: \"ETP rho (\\<tau> rho i - n) \\<le> s_at a1 - 1\" using * SHistorically p'l p'_def p1_def p1l\n              unfolding optimal_def valid_def by (auto simp: Let_def)\n            define l where l_def: \"l \\<equiv> [ETP rho (\\<tau> rho i - n) ..< min (s_at a1-1) (LTP rho (\\<tau> rho (s_at a1-1)))]\"\n            then have \"l = [ETP rho (\\<tau> rho i - n) ..< s_at a1 -1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (s_at a1-1) (LTP rho (\\<tau> rho (s_at a1 - 1)))] = l @ [s_at a1 - 1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (s_at a1-1) (LTP rho (\\<tau> rho (s_at a1 - 1)))] = [ETP rho (\\<tau> rho i - n) ..< min (s_at a1) (LTP rho (\\<tau> rho (s_at a1)))]\"\n              using nl_def l_def a1_ge\n              apply (auto simp add: i_le_ltpi min_def)\n              by (metis Suc_pred upt_Suc_append)\n          } note ** = this\n          then have \"p = p' \\<oplus> p1\" using p1l p'l SHistorically True p_def\n            unfolding doHistorically_def by auto\n          then have \"p = Inl (SHistorically i li (qs @ [projl p1]))\"\n            using SHistorically p'l p1_def p1l i_props\n            unfolding proofApp_def j_def\n            by auto\n          then show ?thesis\n            using * ** n_def p'_def p1_def p1l p'l SHistorically\n              True i_props i_le_ltpi\n            unfolding optimal_def valid_def\n            using [[linarith_split_limit=20]]\n            apply (auto 0 0 simp: Let_def split: if_splits)\n            using min.orderE apply blast\n                 apply (metis One_nat_def Suc_diff_1 le_SucI)\n                apply (metis Suc_pred le_trans nat_le_linear not_less_eq_eq)\n            using le_trans by blast+\n        qed\n      next\n        case infinity\n        then show ?thesis\n        proof (cases p1)\n          case (Inr b1)\n          then have \"p = Inr (VHistorically i (projr p1))\"\n            using p'l SHistorically True p_def unfolding doHistorically_def\n            by auto\n          then show ?thesis using p1_def i_props Inr True zero_enat_def\n            unfolding optimal_def valid_def by auto\n        next\n          case (Inl a1)\n          then have p1r: \"p1 = Inl a1\" by auto\n          {\n            from i_props have b1_ge: \"s_at a1 > 0\" using p1r p1_def\n              unfolding optimal_def valid_def by auto\n            then have nl_def: \"ETP rho 0 \\<le> s_at a1 - 1\" using SHistorically p'l p'_def p1_def p1r\n              unfolding optimal_def valid_def by (auto simp: Let_def i_etp_to_tau)\n            define l where l_def: \"l \\<equiv> [ETP rho 0 ..< min (s_at a1 - 1) (LTP rho (\\<tau> rho (s_at a1 - 1)))]\"\n            then have \"l = [ETP rho 0 ..< s_at a1 - 1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (s_at a1 - 1) (LTP rho (\\<tau> rho (s_at a1 - 1)))] = l @ [s_at a1 - 1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (s_at a1 - 1) (LTP rho (\\<tau> rho (s_at a1 - 1)))] = [ETP rho 0 ..< min (s_at a1) (LTP rho (\\<tau> rho (s_at a1)))]\"\n              using nl_def l_def b1_ge\n              apply (auto simp add: i_le_ltpi min_def)\n              by (metis Suc_pred diff_0_eq_0 diff_is_0_eq upt_Suc)\n          } note ** = this\n          then have \"p = p' \\<oplus> p1\" using p1r p'l SHistorically True p_def\n            unfolding doHistorically_def by auto\n          then have \"p = Inl (SHistorically i li (qs @ [projl p1]))\"\n            using SHistorically p'l p1_def p1r i_props\n            unfolding optimal_def valid_def proofApp_def j_def\n            by auto\n          then show ?thesis\n            using infinity p'_def p1_def p1r p'l SHistorically\n              True i_props i_le_ltpi **\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def i_etp_to_tau i_le_ltpi split: if_splits)\n        qed\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        { fix n assume n_def: \"right I = enat n\"\n          case (Inr b1)\n          then have formp: \"p = Inl (SHistorically i li qs)\"\n            using False p_def p'l SHistorically\n            unfolding doHistorically_def by (simp add: Inl) \n          from p'_def have s_at_qs: \"map s_at qs = [ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n            using n_def unfolding optimal_def valid_def SHistorically p'l\n            by (auto simp: Let_def)\n          have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n            using False i_props\n            apply (auto simp: min_def)\n               apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              apply (rule antisym)\n              subgoal apply (subst i_ltp_to_tau)\n                 apply  (auto simp: gr0_conv_Suc not_le)\n                by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n              subgoal\n                by (auto simp: gr0_conv_Suc)\n              done\n            subgoal\n              by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n            done\n          from p'_def have sq: \"\\<forall>q \\<in> set qs. s_check rho phi q\"\n            unfolding optimal_def valid_def SHistorically p'l\n            by (auto simp: Let_def)\n          from n_def i_props have \"ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) = ETP rho (\\<tau> rho i - n)\"\n            by auto\n          then have \"map s_at qs = [ETP rho (\\<tau> rho i - n) ..< Suc (l rho i I)]\"\n            using s_at_qs[unfolded l_subtract] by auto\n          then have ?thesis using False i_props VOnce p'l formp sq n_def \n            unfolding valid_def\n            by (auto simp: Let_def li)\n        }\n        moreover\n        { assume infinity: \"right I = \\<infinity>\"\n          case (Inr b1)\n          then have formp: \"p = Inl (SHistorically i li qs)\"\n            using False p_def p'l SHistorically\n            unfolding doHistorically_def by auto\n          from p'_def have s_at_qs: \"map s_at qs = [ETP rho 0 ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n            using infinity unfolding optimal_def valid_def SHistorically p'l\n            by (auto simp: Let_def)\n          have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n            using False i_props\n            apply (auto simp: min_def)\n               apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              apply (rule antisym)\n              subgoal apply (subst i_ltp_to_tau)\n                 apply  (auto simp: gr0_conv_Suc not_le)\n                by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n              subgoal\n                by (auto simp: gr0_conv_Suc)\n              done\n            subgoal\n              by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n            done\n          from p'_def have sq: \"\\<forall>q \\<in> set qs. s_check rho phi q\"\n            unfolding optimal_def valid_def SHistorically p'l\n            by (auto simp: Let_def)\n          then have \"map s_at qs = [ETP rho 0 ..< Suc (l rho i I)]\"\n            using s_at_qs[unfolded l_subtract] by auto\n          then have ?thesis using False i_props SHistorically p'l formp sq infinity\n            unfolding valid_def\n            by (auto simp: Let_def li)\n        }\n        moreover case Inr\n        ultimately show ?thesis \n          by (cases \"right I\"; auto)\n      next\n        { fix n \n          assume n_def: \"right I = enat n\"\n          case (Inl a1)\n          then have \"p = Inl (SHistorically i li qs)\"\n            using p'l SHistorically False p_def unfolding doHistorically_def\n            by (simp add: Inl)\n          moreover\n          {\n            assume formp: \"p = Inl (SHistorically i li qs)\"\n            from p'_def have s_at_qs: \"map s_at qs = [ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n              using n_def unfolding optimal_def valid_def SHistorically p'l\n              by (auto simp: Let_def)\n            have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n              using False i_props\n              apply (auto simp: min_def)\n                 apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                apply (rule antisym)\n                subgoal apply (subst i_ltp_to_tau)\n                   apply  (auto simp: gr0_conv_Suc not_le)\n                  by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n                subgoal\n                  by (auto simp: gr0_conv_Suc)\n                done\n              subgoal\n                by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n              done\n            from p'_def have sq: \"\\<forall>q \\<in> set qs. s_check rho phi q\"\n              using p'l unfolding optimal_def valid_def SHistorically \n              by (auto simp: Let_def)\n            from n_def i_props have \"ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) = ETP rho (\\<tau> rho i - n)\"\n              by auto\n            then have \"map s_at qs = [ETP rho (\\<tau> rho i - n) ..< Suc (l rho i I)]\"\n              using s_at_qs[unfolded l_subtract] by auto\n            then have \"valid rho i (Historically I phi) p\"\n              using False i_props VOnce p'l formp sq n_def\n              unfolding valid_def\n              by (auto simp: Let_def li)\n          }\n          ultimately have ?thesis by auto\n        }\n        moreover\n        { assume infinity: \"right I = infinity\"\n          case (Inl a1)\n          then have \"p = Inl (SHistorically i li qs)\"\n            using p'l SHistorically False p_def unfolding doHistorically_def\n            by (simp)\n          moreover\n          {\n            assume formp: \"p = Inl (SHistorically i li qs)\"\n            from p'_def have s_at_qs: \"map s_at qs = [ETP rho 0 ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n              using infinity unfolding optimal_def valid_def SHistorically p'l\n              by (auto simp: Let_def)\n            have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n              using False i_props\n              apply (auto simp: min_def)\n                 apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                apply (rule antisym)\n                subgoal apply (subst i_ltp_to_tau)\n                   apply  (auto simp: gr0_conv_Suc not_le)\n                  by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n                subgoal\n                  by (auto simp: gr0_conv_Suc)\n                done\n              subgoal\n                by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n              done\n            from p'_def have sq: \"\\<forall>q \\<in> set qs. s_check rho phi q\"\n              unfolding optimal_def valid_def SHistorically p'l\n              by (auto simp: Let_def)\n            then have \"map s_at qs = [ETP rho 0 ..< Suc (l rho i I)]\"\n              using s_at_qs[unfolded l_subtract] by auto\n            then have \"valid rho i (Historically I phi) p\"\n              using False i_props p'l formp sq infinity\n              unfolding valid_def\n              by (auto simp: Let_def li)\n          }\n          ultimately have ?thesis by auto\n        }\n        moreover case Inl\n        ultimately show ?thesis \n          by (cases \"right I\"; auto)\n      qed\n    qed\n  next\n    case (SHistorically_le x14)\n    then have c: \"\\<tau> rho (i-1) < \\<tau> rho 0 + (left I - \\<Delta> rho i)\" using p'l p'_def\n      unfolding optimal_def valid_def by auto\n    then have \"\\<tau> rho (i-1) - \\<tau> rho 0 < left I - \\<Delta> rho i\" using i_props\n      by (simp add: less_diff_conv2)\n    then have \"\\<tau> rho i - \\<tau> rho 0 < left I\" by linarith\n    then show ?thesis using i_props by auto\n  next\n    case (SAlways x151 x152 x153)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SSince x151 x152)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SUntil x161 x162)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SNext x17)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  next\n    case (SPrev x18)\n    then show ?thesis using p'l p'_def unfolding optimal_def valid_def by simp\n  qed\nqed\n\nlemma historically_optimal:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n   \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\" and\n    p'_def: \"optimal (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) p'\"\n    and bf: \"bounded_future (Historically I phi)\"\n    and bf': \"bounded_future (Historically (subtract (\\<Delta> rho i) I) phi)\"\n  shows \"optimal i (Historically I phi) (min_list_wrt wqo (doHistorically i (left I) p1 p'))\"\nproof (rule ccontr)\n  define minp where minp: \"minp \\<equiv> min_list_wrt wqo (doHistorically i (left I) p1 p')\"\n  from bf have bfphi: \"bounded_future phi\" by simp\n  from pw_total[of i \"Historically I phi\"] have total_set: \"total_on wqo (set (doHistorically i (left I) p1 p'))\"\n    using historically_sound[OF i_props p1_def p'_def]\n    by (metis not_wqo total_onI)\n  define li where \"li = (case right I - enat (delta rho i (i - Suc 0)) of enat n \\<Rightarrow>\n      ETP rho (\\<tau> rho (i - Suc 0) - n) | \\<infinity> \\<Rightarrow> 0)\"\n  have li: \"li = (case right I of enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0)\"\n    using i_props\n    by (auto simp: li_def split: enat.splits)\n  from p'_def have p'_form: \"(\\<exists>p. p' = Inr (VHistorically (i-1) p)) \\<or>\n    (\\<exists>p. p' = Inl (SHistorically (i-1) li p))\"\n  proof(cases \"VIO rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi)\")\n    case True\n    then obtain b' where b'_def: \"p' = Inr b'\"\n      using val_VIO_imp_r[OF bf'] p'_def\n      unfolding optimal_def\n      by force\n    then show ?thesis\n      using p'_def i_props_imp_not_le_historically[OF i_props p'_def]\n      unfolding optimal_def valid_def\n      by (cases b') (auto simp: li_def)\n  next\n    case False\n    then have VIO: \"SAT rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi)\"\n      using SAT_or_VIO\n      by auto\n    then obtain a' where a'_def: \"p' = Inl a'\"\n      using val_SAT_imp_l[OF bf'] p'_def\n      unfolding optimal_def\n      by force\n    then show ?thesis\n      using p'_def i_props_imp_not_le_historically[OF i_props p'_def]\n      unfolding optimal_def valid_def\n      by (cases a') (auto simp: li_def)\n  qed\n  from doHistorically_def[of i \"left I\" p1 p'] p'_form\n  have nnil: \"doHistorically i (left I) p1 p' \\<noteq> []\"\n    by (cases p1; cases \"left I\"; cases p'; auto)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doHistorically i (left I) p1 p'). wqo x y) (doHistorically i (left I) p1 p') \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doHistorically i (left I) p1 p'). wqo x y)\" \"(doHistorically i (left I) p1 p')\"]\n    by simp\n  assume nopt: \"\\<not> optimal i (Historically I phi) minp\"\n  from historically_sound[OF i_props p1_def p'_def min_list_wrt_in]\n    total_set trans_wqo refl_wqo nnil minp\n  have vmin: \"valid rho i (Historically I phi) minp\"\n    by auto\n  then obtain q where q_val: \"valid rho i (Historically I phi) q\" and\n    q_le: \"\\<not> wqo minp q\" using minp nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inr b)\n    then have q_v: \"q = Inr b\" by auto\n    then have VIOv: \"VIO rho i (Historically I phi)\" \n      using q_val unfolding valid_def \n      apply (simp add: Let_def split: if_splits sum.splits)\n      using SAT_or_VIO bf q_val val_SAT_imp_l by blast\n    then have viov: \"\\<not> sat rho i (Historically I phi)\" using soundness\n      by blast\n    from Inr obtain vphi where b_def: \"b = VHistorically i vphi\"\n      using q_val unfolding valid_def by (cases b) auto\n    then have valphi: \"valid rho (v_at vphi) phi (Inr vphi)\" using q_val Inr\n      unfolding valid_def by (auto simp: Let_def)\n    from q_val Inr b_def\n    have vphi_bounds: \"v_at vphi \\<ge> ETP rho (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> \\<tau> rho i - n) \n      \\<and> v_at vphi \\<le> i\"\n      unfolding valid_def\n      by (auto simp: Let_def i_etp_to_tau split: list.splits if_splits enat.splits)\n    from valphi val_VIO_imp_r[OF bf] VIOv have check_vphi: \"v_check rho phi vphi\"\n      unfolding valid_def by auto\n    then show ?thesis\n    proof (cases p')\n      case (Inr b')\n      then have p'r: \"p' = Inr b'\" by simp\n      then obtain vphi' where b'_def: \"b' = VHistorically (i-1) vphi'\"\n        using p'_def unfolding optimal_def valid_def\n        by (cases b') auto\n      then have vphi'_bounds: \"ETP rho (case right I of enat n \\<Rightarrow> (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0) \\<le> v_at vphi'\n      \\<and> v_at vphi' < i \\<and> v_at vphi' \\<le> LTP rho (\\<tau> rho i - left I)\"\n        using b'_def Inr p'_def i_props mem_imp_le_ltp[of i I \"v_at vphi'\"]\n        unfolding optimal_def valid_def\n        by (auto simp: Let_def diff_commute i_etp_to_tau le_diff_conv split: enat.splits)\n      from b'_def Inr have \"v_check rho phi vphi'\" using p'_def\n        unfolding optimal_def valid_def by (auto simp: Let_def)\n      from VIOv vmin have minl: \"\\<exists>a. minp = Inr a\" using minp val_VIO_imp_r[OF bf]\n        by auto\n      from p'_def have p'_val: \"valid rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) p'\"\n        unfolding optimal_def by auto\n      then show ?thesis\n      proof (cases p1)\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = min_list_wrt wqo [Inr (VHistorically i b1), Inr (VHistorically i vphi')]\"\n            using p1r p'r True b'_def minp filter_nnil\n            unfolding doHistorically_def \n            by (cases p1) auto\n          show ?thesis\n          proof (cases \"v_at vphi = i\")\n            case vphi_i: True\n            have \"wqo (Inr (VHistorically i b1)) q\"\n              using VHistorically b_def optimal_def p1_def p1r vphi_i valphi q_v\n              unfolding optimal_def valid_def by auto\n            then show ?thesis\n              using q_v b_def pw_total[of i \"Historically I phi\"]\n                historically_sound[OF i_props p1_def p'_def] p'r b'_def p1r True\n              unfolding form doHistorically_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          next\n            case False\n            have incr: \"checkIncr (Inr (VHistorically (i-1) vphi'))\" \"checkIncr (Inr (VHistorically (i-1) vphi))\"\n              using p'r b'_def False vphi'_bounds vphi_bounds\n              by (auto intro!: checkIncr.intros)\n            have valid: \"valid rho (i - 1) (Historically (subtract (\\<Delta> rho i) I) phi) (Inr (VHistorically (i-1) vphi))\"\n              using False valid_shift_VHistorically b_def i_props q_v q_val vphi_bounds by fastforce\n            have wqo: \"wqo (Inr (VHistorically (i-1) vphi')) (Inr (VHistorically (i-1) vphi))\"\n              using valphi p'_def p'r b'_def b_def valid\n              unfolding optimal_def valid_def\n              by simp\n            from proofIncr_mono[OF incr wqo p'_val[unfolded p'r b'_def] valid] have \"wqo (Inr (VHistorically i vphi')) q\"\n              unfolding q_v b_def using i_props\n              by (auto simp add: Let_def proofIncr_def)\n            then show ?thesis\n              using q_v b_def pw_total[of i \"Historically I phi\"]\n                historically_sound[OF i_props p1_def p'_def] p'r b'_def p1r True\n              unfolding form doHistorically_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          qed\n        next\n          case False\n          have form: \"minp = min_list_wrt wqo [Inr (VHistorically i vphi')]\"\n            using p1r p'r False b'_def minp filter_nnil\n            unfolding doHistorically_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have vphi_le_i: \"v_at vphi < i\"\n            using False b_def q_v q_val soundness le_eq_less_or_eq \n            unfolding valid_def \n            by (auto simp add: Let_def)\n          then have incr: \"checkIncr (Inr (VHistorically (i-1) vphi'))\" \"checkIncr (Inr (VHistorically (i-1) vphi))\"\n            using p'r b'_def False vphi'_bounds vphi_bounds\n            by (auto intro!: checkIncr.intros)\n          have valid: \"valid rho (i - 1) (Historically (subtract (\\<Delta> rho i) I) phi) (Inr (VHistorically (i-1) vphi))\"\n            using False valid_shift_VHistorically b_def i_props q_v q_val vphi_bounds vphi_le_i by fastforce\n          have wqo: \"wqo (Inr (VHistorically (i-1) vphi')) (Inr (VHistorically (i-1) vphi))\"\n            using valphi p'_def p'r b'_def b_def valid\n            unfolding optimal_def valid_def\n            by simp\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'r b'_def] valid] have \"wqo (Inr (VHistorically i vphi')) q\"\n            unfolding q_v b_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_v b_def pw_total[of i \"Historically I phi\"]\n                historically_sound[OF i_props p1_def p'_def] p'r b'_def p1r False\n            unfolding form doHistorically_def\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        qed\n      next\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          have form: \"minp = min_list_wrt wqo [Inr (VHistorically i vphi')]\"\n            using p1l p'r True b'_def minp filter_nnil\n            unfolding doHistorically_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have vphi_le_i: \"v_at vphi < i\"\n            using True b_def q_v q_val soundness check_sound(1) \n              le_eq_less_or_eq p1l p1_def\n            unfolding optimal_def valid_def \n            apply (simp add: Let_def split: sum.split)\n            using bfphi check_consistent by force\n          then have incr: \"checkIncr (Inr (VHistorically (i-1) vphi'))\" \"checkIncr (Inr (VHistorically (i-1) vphi))\"\n            using p'r b'_def True vphi'_bounds vphi_bounds\n            by (auto intro!: checkIncr.intros)\n          have valid: \"valid rho (i - 1) (Historically (subtract (\\<Delta> rho i) I) phi) (Inr (VHistorically (i-1) vphi))\"\n            using True valid_shift_VHistorically b_def i_props q_v q_val vphi_bounds vphi_le_i by fastforce\n          have wqo: \"wqo (Inr (VHistorically (i-1) vphi')) (Inr (VHistorically (i-1) vphi))\"\n            using valphi p'_def p'r b'_def b_def valid\n            unfolding optimal_def valid_def\n            by (simp add: Let_def split: sum.split)\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'r b'_def] valid] have \"wqo (Inr (VHistorically i vphi')) q\"\n            unfolding q_v b_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_v b_def pw_total[of i \"Historically I phi\"]\n                historically_sound[OF i_props p1_def p'_def] p'r b'_def p1l True\n            unfolding form \n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        next\n          case False\n          have form: \"minp = min_list_wrt wqo [Inr (VHistorically i vphi')]\"\n            using p1l p'r False b'_def minp filter_nnil\n            unfolding doHistorically_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have vphi_le_i: \"v_at vphi < i\"\n            using False b_def q_v q_val soundness le_eq_less_or_eq \n            unfolding valid_def \n            by (auto simp add: Let_def)\n          then have incr: \"checkIncr (Inr (VHistorically (i-1) vphi'))\" \"checkIncr (Inr (VHistorically (i-1) vphi))\"\n            using p'r b'_def False vphi'_bounds vphi_bounds\n            by (auto intro!: checkIncr.intros)\n          have valid: \"valid rho (i - 1) (Historically (subtract (\\<Delta> rho i) I) phi) (Inr (VHistorically (i-1) vphi))\"\n            using False valid_shift_VHistorically b_def i_props q_v q_val vphi_bounds vphi_le_i by fastforce\n          have wqo: \"wqo (Inr (VHistorically (i-1) vphi')) (Inr (VHistorically (i-1) vphi))\"\n            using valphi p'_def p'r b'_def b_def valid\n            unfolding optimal_def valid_def\n            by simp\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'r b'_def] valid] have \"wqo (Inr (VHistorically i vphi')) q\"\n            unfolding q_v b_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_v b_def pw_total[of i \"Historically I phi\"]\n                historically_sound[OF i_props p1_def p'_def] p'r b'_def p1l False\n            unfolding form\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        qed\n      qed\n    next\n      case (Inl a')\n      then have p'l: \"p' = Inl a'\" by simp\n      then obtain sphis' where a'_def: \"a' = SHistorically (i-1) li sphis'\"\n        using p'_def p'_form by auto\n      from p'_def have p'_val: \"valid rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) p'\"\n        unfolding optimal_def by auto\n      then show ?thesis\n      proof (cases p1)\n        case (Inr b1)\n        then have p1l: \"p1 = Inr b1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = min_list_wrt wqo [Inr (VHistorically i b1)]\"\n            using p1l p'l True a'_def minp filter_nnil\n            unfolding doHistorically_def \n            by (cases p1) (auto)\n          show ?thesis\n          proof (cases \"v_at vphi = i\")\n            case vphi_i: True\n            have \"wqo (Inr (VHistorically i b1)) q\"\n              using VHistorically b_def optimal_def p1_def p1l vphi_i valphi q_v\n              unfolding optimal_def valid_def by auto\n            then show ?thesis\n              using q_v b_def pw_total[of i \"Historically I phi\"]\n                historically_sound[OF i_props p1_def p'_def] p1l True\n              unfolding form\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          next\n            case False\n            have vphi_le_i: \"v_at vphi < i\"\n              using False b_def q_v q_val p1l vphi_bounds unfolding valid_def \n              by (auto simp add: Let_def)\n            have wqo_p1: \"wqo (Inr b1) (Inr vphi)\" \n              using p1_def p'l True valphi p'_def q_v q_val b_def\n              unfolding optimal_def apply (simp add: p1l)\n              by (metis Inl_Inr_False valid_shift_VHistorically One_nat_def Suc_pred bf' completeness i_props leD not_less_eq_eq val_SAT_imp_l val_VIO_imp_r vphi_le_i)\n            have \"wqo (Inr (VHistorically i b1)) q\"\n              using q_v b_def VHistorically[OF wqo_p1] by auto\n            then show ?thesis\n              using q_v b_def pw_total[of i \"Historically I phi\"]\n                historically_sound[OF i_props p1_def p'_def] p1l True\n              unfolding form\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          qed\n        next\n          case False\n          then have form: \"minp = Inl (SHistorically i li sphis')\"\n            using a'_def Inl minp Inr filter_nnil unfolding doHistorically_def\n            by (cases p1) (auto simp: min_list_wrt_def split: enat.splits)\n          then show ?thesis\n            using q_v b_def valphi p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split)\n            using VIOv val_VIO_imp_r[OF bf] vmin by auto\n        qed\n      next\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by simp\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = (p' \\<oplus> p1)\"\n            thm val_VIO_imp_r[OF bf vmin]\n            using p'l a'_def Inl minp Inr filter_nnil val_VIO_imp_r[OF bf vmin]\n            unfolding doHistorically_def \n            by (cases p1) (auto simp add: min_list_wrt_def split: sum.split)\n          have form_algo: \"doHistorically i (left I) p1 p' = [(p' \\<oplus> p1)]\"\n            using p1l p'l True a'_def unfolding doHistorically_def by auto\n          have check_p: \"checkApp p' p1\"\n            using valid_checkApp_SHistorically[of i I phi li sphis']\n              p'l p1l a'_def True p1_def p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split if_splits)\n             apply (metis (no_types, lifting) checkApp.intros(3) Nil_is_append_conv map_is_Nil_conv not_Cons_self2)\n            using a'_def diff_0_eq_0 p'_val subtract_simps(1) valid_checkApp_SHistorically by presburger\n          have p_val: \"valid rho i (Historically I phi) (p' \\<oplus> p1)\"\n            using p'l a'_def p1l vmin form historically_sound[OF i_props p1_def p'_def]\n            by auto\n          then have p_optimal: \"optimal i (Historically I phi) (p' \\<oplus> p1)\"\n            using p'l a'_def p1l vmin form check_p \n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: if_split sum.split)\n            using VIOv val_VIO_imp_r[OF bf vmin] vmin by blast\n          then show ?thesis using form check_p p_val p'l a'_def p1l vmin q_v nopt p_optimal\n            unfolding optimal_def valid_def\n            by blast            \n        next\n          case False\n          then have form: \"minp = Inl (SHistorically i li sphis')\"\n            using p'l a'_def Inl minp Inr filter_nnil unfolding doHistorically_def\n            by (cases p1) (auto simp: min_list_wrt_def split: enat.splits)\n          then show ?thesis\n            using q_v b_def valphi p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split)\n            using VIOv val_VIO_imp_r[OF bf] vmin by auto\n        qed\n      qed\n    qed\n  next\n    case (Inl a)\n    then have qs: \"q = Inl a\" by simp\n    then have SATs: \"SAT rho i (Historically I phi)\"\n      using q_val check_sound(1)[of rho \"Historically I phi\" a]\n      unfolding valid_def by simp\n    then have formb: \"\\<exists>ps. a = SHistorically i li ps\"\n      using Inl q_val i_props unfolding valid_def by (cases a) (auto simp: li)\n    moreover\n    {fix li' ps\n      assume as: \"a = SHistorically i li' ps\"\n      have li'_def: \"li' = li\"\n        using q_val\n        by (auto simp: Inl as valid_def li)\n      have \"wqo minp q\"\n        using as\n      proof (cases p')\n        case (Inr b')\n        then obtain p1' where b'v: \"b' = VHistorically (i-1) p1'\"\n          using p'_def\n          unfolding optimal_def valid_def\n          by (cases b') auto\n        from as qs have mapt: \"map s_at ps = [ETP rho (case right I of enat n \\<Rightarrow> (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0) ..< Suc (l rho i I)]\"\n          using q_val unfolding valid_def by (auto simp: Let_def split: enat.splits)\n        then have ps_check: \"\\<forall>p \\<in> set ps. s_check rho phi p\"\n          using as qs q_val unfolding valid_def\n          by (auto simp: Let_def)\n        thm map_set_in_imp_set_in[]\n        then have jc: \"\\<forall>j \\<in> set (map s_at ps). \\<exists>p. s_at p = j \\<and> s_check rho phi p\"\n          using map_set_in_imp_set_in by auto\n        then have vp1'_bounds: \"ETP rho (case right I of enat n \\<Rightarrow> (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0) \\<le> v_at p1'\n        \\<and> v_at p1' < i \\<and> v_at p1' \\<le> LTP rho (\\<tau> rho i - left I)\"\n          using b'v Inr p'_def i_props mem_imp_le_ltp[of i I \"v_at p1'\"]\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def diff_commute i_etp_to_tau le_diff_conv split: enat.splits)\n        from vp1'_bounds have p1'_in: \"v_at p1' \\<in> set (map s_at ps)\" using mapt\n          by (auto split: if_splits)\n        from b'v Inr have \"v_check rho phi p1'\" using p'_def\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        then have False using jc p1'_in check_consistent[OF bfphi] by auto\n        then show ?thesis by simp\n      next\n        case (Inl a')\n        then have p'l: \"p' = Inl a'\" by simp\n        then have a's: \"(\\<exists>ps. a' = SHistorically (i-1) li ps)\"\n          using Inl p'_def i_props i_props_imp_not_le_historically[OF i_props p'_def]\n          unfolding optimal_def valid_def by (cases a') (auto simp: Let_def li_def)\n        moreover\n        {fix li'' sphis'\n          assume a's: \"a' = SHistorically (i-1) li'' sphis'\"\n          have li''_def: \"li'' = li\"\n            using p'_def\n            by (auto simp: Inl a's optimal_def valid_def li_def)\n          have \"wqo minp q\"\n            using a's\n          proof (cases p1)\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inr (VHistorically i (projr p1))\"\n                using Inr p'l a's minp val_SAT_imp_l[OF bf vmin SATs] filter_nnil\n                unfolding doHistorically_def\n                by (cases p1) (auto simp: min_list_wrt_def)\n              then obtain p1' where p1l: \"p1 = Inl p1'\"\n                using True a's Inl minp Inr val_SAT_imp_l[OF bf vmin SATs] filter_nnil\n                unfolding doHistorically_def\n                by (cases p1; auto simp: min_list_wrt_def split: if_splits)\n              then show ?thesis\n                using form qs as Inl p1_def q_val unfolding optimal_def valid_def\n                by (metis Inr_Inl_False SATs bf val_SAT_imp_l vmin)\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inl (SHistorically i li sphis')\"\n                using a's Inl minp Inr filter_nnil unfolding doHistorically_def\n                by (cases p1) (auto simp: min_list_wrt_def li''_def split: enat.splits)\n              then show ?thesis using qs as q_val i_props\n                unfolding optimal_def valid_def\n                apply (auto simp add: Let_def False i_ltp_to_tau i_etp_to_tau split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) (Inl (SHistorically (i-1) li' ps))\"\n                    using valid_shift_SHistorically[of i I phi li' ps] i_props q_val False\n                    by (auto simp: qs as)\n                  then have \"wqo p' (Inl (SHistorically (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'l a's\n                    by (auto simp: optimal_def intro!: valid_checkIncr_SHistorically)\n                  moreover have \"checkIncr (Inl (SHistorically (i-1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_SHistorically)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inl (SHistorically (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'l a's\n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                qed\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) (Inl (SHistorically (i-1) li ps))\"\n                    using prems val_ge_zero_never_historically[OF p'l a's p'_val] diff_cancel_middle[of \"\\<tau> rho i\" \"left I\" \"\\<tau> rho (i-1)\"]\n                    unfolding valid_def\n                    by (auto simp add: le_diff_conv Let_def i_ltp_to_tau i_etp_to_tau li'_def li''_def split: enat.splits)\n                  then have \"wqo p' (Inl (SHistorically (i-1) li ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'l a's\n                    by (auto simp: optimal_def intro!: valid_checkIncr_SHistorically)\n                  moreover have \"checkIncr (Inl (SHistorically (i - 1) li ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_SHistorically)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inl (SHistorically (i-1) li ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'l a's\n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                qed\n                using p1_def False Inl q_val i_props vmin\n                apply (auto simp: Let_def optimal_def valid_def i_ltp_to_tau i_etp_to_tau i_le_ltpi split: if_splits)\n                using not_wqo vmin apply blast\n                done\n            qed\n          next\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p1\" using Inl a's p'l minp\n                  val_SAT_imp_l[OF bf vmin SATs] filter_nnil\n                unfolding doHistorically_def \n                by (cases p1) (auto simp: min_list_wrt_def)\n              then obtain p1' where p1l: \"p1 = Inl p1'\"\n                using True a's Inl minp val_SAT_imp_l[OF bf vmin SATs]\n                  filter_nnil\n                unfolding doHistorically_def\n                by (cases p1; auto simp: min_list_wrt_def split: if_splits)\n              then show ?thesis\n                using form_min qs as Inl p1_def q_val unfolding optimal_def valid_def\n                apply (cases ps rule: rev_cases)\n                 apply (auto simp add: Let_def True i_ltp_to_tau i_etp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems for ys y\n                proof -\n                  from vmin form_min p1l have p_val: \"valid rho i (Historically I phi) (p' \\<oplus> (Inl p1'))\"\n                    by auto\n                  have check_p: \"checkApp p' (Inl p1')\"\n                    using p'_def True\n                    unfolding p1l a's p'l\n                    by (auto simp: optimal_def intro!: valid_checkApp_SHistorically)\n                  from prems have y_val: \"valid rho i phi (Inl y)\"\n                    using q_val True i_le_ltpi i_props unfolding valid_def\n                    by (auto simp: Let_def min_def split: if_splits)\n                  have val_q': \"valid rho (i - 1) (Historically (subtract (delta rho i (i - 1)) I) phi) (Inl (SHistorically (i - 1) li' ys))\"\n                    using valid_shift_SHistorically[of i I phi li' ps] i_props q_val True prems(8)\n                    by (auto simp: qs as)\n                  then have q_val2: \"valid rho i (Historically I phi) ((Inl (SHistorically (i-1) li' ys)) \\<oplus> (Inl y))\"\n                    using q_val prems i_props by (auto simp: li'_def)\n                  have check_q: \"checkApp (Inl (SHistorically (i-1) li' ys)) (Inl y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_SHistorically)\n                  from p'_def have wqo_p': \"wqo p' (Inl (SHistorically (i - 1) li' ys))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p1: \"wqo p1 (Inl y)\" using i_props p1_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    unfolding prems using p'l a's p1_def q_val prems p1l unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' wqo_p1[unfolded p1l] p_val q_val2]\n                    apply (auto simp: li''_def li)\n                    by (metis One_nat_def Suc_diff_1 as i_props q_le qs)\n                qed\n                done\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inl (SHistorically i li sphis')\"\n                using a's Inl minp filter_nnil p'l unfolding doHistorically_def\n                by (cases p1) (auto simp: min_list_wrt_def li''_def split: enat.splits)\n              then show ?thesis using qs as q_val i_props\n                unfolding optimal_def valid_def\n                apply (auto simp add: Let_def False i_ltp_to_tau i_etp_to_tau split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) (Inl (SHistorically (i-1) li' ps))\"\n                    using valid_shift_SHistorically[of i I phi li' ps] i_props q_val False\n                    by (auto simp: qs as)\n                  then have \"wqo p' (Inl (SHistorically (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'l a's\n                    by (auto simp: optimal_def intro!: valid_checkIncr_SHistorically)\n                  moreover have \"checkIncr (Inl (SHistorically (i-1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_SHistorically)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inl (SHistorically (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'l a's\n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                qed\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Historically (subtract (\\<Delta> rho i) I) phi) (Inl (SHistorically (i-1) li ps))\"\n                    using prems val_ge_zero_never_historically[OF p'l a's p'_val] diff_cancel_middle[of \"\\<tau> rho i\" \"left I\" \"\\<tau> rho (i-1)\"]\n                    unfolding valid_def\n                    by (auto simp add: le_diff_conv Let_def i_ltp_to_tau i_etp_to_tau li'_def li''_def split: enat.splits)\n                  then have \"wqo p' (Inl (SHistorically (i-1) li ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'l a's\n                    by (auto simp: optimal_def intro!: valid_checkIncr_SHistorically)\n                  moreover have \"checkIncr (Inl (SHistorically (i - 1) li ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_SHistorically)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inl (SHistorically (i-1) li ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'l a's\n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                qed\n                using p1_def False Inl q_val i_props vmin\n                apply (auto simp: Let_def optimal_def valid_def i_ltp_to_tau i_etp_to_tau i_le_ltpi split: if_splits)\n                using not_wqo vmin apply blast\n                done\n            qed\n          qed\n        }\n        then show ?thesis using a's by blast\n      qed\n    }\n    then show ?thesis using formb by blast\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Since\\<close>\n\nlemma valid_checkApp_VSince: \"valid rho j (Since phi I psi) (Inr (VSince j vphi' vpsis')) \\<Longrightarrow>\n  left I = 0 \\<or> v_at vphi' \\<le> LTP rho (\\<tau> rho j - left I) \\<Longrightarrow> checkApp (Inr (VSince j vphi' vpsis')) (Inr p2')\"\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits intro!: checkApp.intros)\n  using i_le_ltpi le_trans\n  apply blast+\n  done\n\nlemma valid_checkApp_VSince_never: \"valid rho j (Since phi I psi) (Inr (VSince_never j li vpsis')) \\<Longrightarrow>\n  left I = 0 \\<or> (case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> ETP rho (\\<tau> rho j - n) \\<le> LTP rho (\\<tau> rho j - left I)) \\<Longrightarrow>\n  checkApp (Inr (VSince_never j li vpsis')) (Inr p2')\"\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits intro!: checkApp.intros)\n  apply (meson diff_le_self i_etp_to_tau)\n  apply (meson diff_le_self i_etp_to_tau i_le_ltpi leD le_less_trans not_le_imp_less)\n  by (meson diff_le_self i_etp_to_tau)\n\nlemma valid_checkIncr_VSince: \"valid rho j phi (Inr (VSince j vphi' vpsis')) \\<Longrightarrow>\n  checkIncr (Inr (VSince j vphi' vpsis'))\"\n  apply (cases phi)\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits dest!: arg_cong[where ?x=\"map _ _\" and ?f=set] intro!: checkIncr.intros)\n  apply (drule imageI[where ?A=\"set vpsis'\" and ?f=v_at])\n  apply auto[1]\n  apply (drule imageI[where ?A=\"set vpsis'\" and ?f=v_at])\n  apply auto[1]\n  done\n\nlemma valid_checkIncr_VSince_never: \"valid rho j phi (Inr (VSince_never j li vpsis')) \\<Longrightarrow>\n  checkIncr (Inr (VSince_never j li vpsis'))\"\n  apply (cases phi)\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits dest!: arg_cong[where ?x=\"map _ _\" and ?f=set] intro!: checkIncr.intros)\n  apply (drule imageI[where ?A=\"set vpsis'\" and ?f=v_at])\n  apply auto[1]\n  apply (drule imageI[where ?A=\"set vpsis'\" and ?f=v_at])\n  apply auto[1]\n  done\n\nlemma valid_shift_VSince:\n  assumes i_props: \"i > 0\" \"right I \\<ge> enat (\\<Delta> rho i)\"\n    and valid: \"valid rho i (Since phi I psi) (Inr (VSince i p ys))\"\n    and v_at_p: \"v_at p \\<le> i - Suc 0\"\n  shows \"valid rho (i - 1) (Since phi (subtract (delta rho i (i - 1)) I) psi) (Inr (VSince (i - 1) p (if left I = 0 then butlast ys else ys)))\"\nproof (cases \"left I = 0\")\n  case True\n  obtain z zs where ys_def: \"ys = zs @ [z]\"\n    using valid True\n    apply (cases ys rule: rev_cases)\n    apply (auto simp: valid_def Let_def split: if_splits enat.splits)\n    apply (meson i_le_ltpi le_trans)+\n    done\n  show ?thesis\n    using assms etpi_imp_etp_suci i_props True\n    unfolding optimal_def valid_def\n    apply (auto simp add: Let_def i_ltp_to_tau ys_def split: if_splits)\n    using i_le_ltpi by (auto simp: min_def split: enat.splits)\nnext\n  case False\n  have b: \"\\<tau> rho i \\<ge> \\<tau> rho 0 + left I\"\n    using valid\n    by (auto simp: valid_def Let_def)\n  have rw: \"\\<tau> rho (i - Suc 0) - (left I + \\<tau> rho (i - Suc 0) - \\<tau> rho i) =\n    (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    by auto\n  have e: \"right I = enat n \\<Longrightarrow> right (subtract (delta rho i (i - 1)) I) = enat n' \\<Longrightarrow>\n    ETP rho (\\<tau> rho i - n) = ETP rho (\\<tau> rho (i - 1) - n')\" for n n'\n    apply (auto)\n    by (metis One_nat_def diff_cancel_middle enat_ord_simps(1) i_props(2) le_diff_conv)\n  have l: \"l rho i I = min (i - Suc 0) (LTP rho (\\<tau> rho i - left I))\"\n    using False b\n    apply (auto simp: min_def)\n    by (meson i_le_ltpi_minus i_props leD)\n  have t: \"\\<tau> rho (i - 1) - left (subtract (delta rho i (i - 1)) I) =\n  (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    using i_props\n    by auto\n  have F1: \"\\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho 0 + left (subtract (delta rho i (i - 1)) I)\"\n    using i_props b\n    apply (auto)\n    using i_props i_to_predi_props by blast\n  have F2: \"v_at p \\<le> min (i - Suc 0) (LTP rho (\\<tau> rho i - left I))\" if \"ys \\<noteq> []\"\n    using valid v_at_p that\n    by (auto simp: valid_def Let_def split: if_splits enat.splits)\n  have F3: \"\\<not> \\<tau> rho i \\<le> left I + \\<tau> rho (i - Suc 0) \\<Longrightarrow>\n    LTP rho (\\<tau> rho i - left I) = LTP rho (\\<tau> rho (i - 1))\"\n    using False i_props LTP_lt_delta b\n    apply (auto)\n    by (smt (z3) One_nat_def Suc_pred diff_is_0_eq i_le_ltpi_minus le_add_diff_inverse2 nat_le_linear neq0_conv predi_eq_ltp rw trans_le_add2)\n  show ?thesis\n    using False F1 F2 valid e v_at_p\n    apply (cases ys rule: rev_cases)\n    by (auto simp: valid_def Let_def rw t l F3) (auto split: enat.splits)\nqed\n\nlemma valid_shift_VSince_never:\n  assumes i_props: \"i > 0\" \"right I \\<ge> enat (\\<Delta> rho i)\"\n    and valid: \"valid rho i (Since phi I psi) (Inr (VSince_never i li ys))\"\n  shows \"valid rho (i - 1) (Since phi (subtract (delta rho i (i - 1)) I) psi) (Inr (VSince_never (i - 1) li (if left I = 0 then butlast ys else ys)))\"\nproof (cases \"left I = 0\")\n  case True\n  obtain z zs where ys_def: \"ys = zs @ [z]\"\n    using valid True\n    apply (cases ys rule: rev_cases)\n    apply (auto simp: valid_def Let_def split: if_splits enat.splits)\n    apply (meson diff_le_self i_etp_to_tau)\n    by (meson \\<tau>_mono diff_le_self i_etp_to_tau i_ltp_to_tau i_props(1) less_or_eq_imp_le)\n  show ?thesis\n    using assms etpi_imp_etp_suci i_props True\n    unfolding optimal_def valid_def\n    apply (auto simp add: Let_def i_ltp_to_tau ys_def split: if_splits)\n    using i_le_ltpi by (auto simp: min_def split: enat.splits)\nnext\n  case False\n  have b: \"\\<tau> rho i \\<ge> \\<tau> rho 0 + left I\"\n    using valid\n    by (auto simp: valid_def Let_def)\n  have rw: \"\\<tau> rho (i - Suc 0) - (left I + \\<tau> rho (i - Suc 0) - \\<tau> rho i) =\n    (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    by auto\n  have e: \"right I = enat n \\<Longrightarrow> right (subtract (delta rho i (i - 1)) I) = enat n' \\<Longrightarrow>\n    ETP rho (\\<tau> rho i - n) = ETP rho (\\<tau> rho (i - 1) - n')\" for n n'\n    apply (auto)\n    by (metis One_nat_def diff_cancel_middle enat_ord_simps(1) i_props(2) le_diff_conv)\n  have l: \"l rho i I = min (i - Suc 0) (LTP rho (\\<tau> rho i - left I))\"\n    using False b\n    apply (auto simp: min_def)\n    by (meson i_le_ltpi_minus i_props leD)\n  have t: \"\\<tau> rho (i - 1) - left (subtract (delta rho i (i - 1)) I) =\n  (if left I + \\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho i then \\<tau> rho i - left I else \\<tau> rho (i - Suc 0))\"\n    using i_props\n    by auto\n  have F1: \"\\<tau> rho (i - Suc 0) \\<ge> \\<tau> rho 0 + left (subtract (delta rho i (i - 1)) I)\"\n    using i_props b\n    apply (auto)\n    using i_props i_to_predi_props by blast\n  have F3: \"\\<not> \\<tau> rho i \\<le> left I + \\<tau> rho (i - Suc 0) \\<Longrightarrow>\n    LTP rho (\\<tau> rho i - left I) = LTP rho (\\<tau> rho (i - 1))\"\n    using False i_props LTP_lt_delta b\n    apply (auto)\n    by (smt (z3) One_nat_def Suc_pred diff_is_0_eq i_le_ltpi_minus le_add_diff_inverse2 nat_le_linear neq0_conv predi_eq_ltp rw trans_le_add2)\n  show ?thesis\n    using False F1 valid e\n    by (auto simp: valid_def Let_def rw t l F3) (auto split: enat.splits)\nqed\n\nlemma sinceBase0_sound:\n  assumes p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\" and\n    i_props: \"i = 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\" and\n    p_def: \"p \\<in> set (doSinceBase 0 0 p1 p2)\"\n  shows \"valid rho i (Since phi I psi) p\"\n  using assms unfolding optimal_def valid_def\n  apply (auto simp: i_etp_to_tau doSinceBase_def zero_enat_def[symmetric] split: sum.splits enat.splits)\n   apply (meson Orderings.order_class.order.not_eq_order_implies_strict diff_le_self i_etp_to_tau less_nat_zero_code)\n   apply (metis add_cancel_right_left add_diff_cancel_left' diff_is_0_eq diff_less i_etp_to_tau le_0_eq le_iff_add nat_le_linear nat_less_le)\n  apply (meson Nat.bot_nat_0.extremum_uniqueI diff_le_self i_etp_to_tau)\n  done\n\nlemma sinceBase0_optimal:\n  assumes bf: \"bounded_future (Since phi I psi)\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\" and\n    i_props: \"i = 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\"\n  shows\n    \"optimal i (Since phi I psi) (min_list_wrt wqo (doSinceBase 0 0 p1 p2))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  have bf_psi: \"bounded_future psi\"\n    using bf by auto\n  from doSinceBase_def[of 0 0 p1 p2]\n  have nnil: \"doSinceBase 0 0 p1 p2 \\<noteq> []\"\n    by (cases p1; cases p2; auto)\n  assume nopt: \"\\<not> optimal i (Since phi I psi) (min_list_wrt wqo (doSinceBase 0 0 p1 p2))\"\n  from sinceBase0_sound[OF p1_def p2_def i_props min_list_wrt_in[of _ wqo]]\n    refl_wqo pw_total trans_wqo nnil\n  have vmin: \"valid rho i (Since phi I psi) (min_list_wrt wqo (doSinceBase 0 0 p1 p2))\"\n    apply auto\n    by (metis i_props not_wqo p1_def p2_def sinceBase0_sound total_onI)\n  then obtain q  where q_val: \"valid rho i (Since phi I psi) q\" and\n    q_le: \"\\<not> wqo (min_list_wrt wqo (doSinceBase 0 0 p1 p2)) q\" using nopt\n    unfolding optimal_def by auto\n  then have \"wqo (min_list_wrt wqo (doSinceBase 0 0 p1 p2)) q\"\n  proof (cases q)\n    case (Inl a)\n    then obtain spsiq sphisq where sq: \"a = SSince spsiq sphisq\"\n      using q_val unfolding valid_def\n      by (cases a) auto\n    then have p_val: \"valid rho i psi (Inl spsiq)\" using Inl q_val i_props\n      unfolding valid_def\n      by (auto simp: Let_def)\n    then have p2_le: \"wqo p2 (Inl spsiq)\" using p2_def unfolding optimal_def\n      by auto\n    obtain p2' where p2'_def: \"p2 = Inl p2'\"\n      using p_val p2_def check_consistent[OF bf_psi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have sphisq_Nil: \"sphisq = []\"\n      using q_val i_props\n      by (auto simp: Inl sq valid_def Let_def split: list.splits if_splits)\n    have \"wqo (Inl (SSince p2' [])) q\"\n      using SSince[OF p2_le[unfolded p2'_def]] sq Inl\n      by (fastforce simp add: p2'_def map_idI sphisq_Nil)\n    moreover have \"Inl (SSince (projl p2) []) \\<in> set (doSinceBase 0 0 p1 p2)\"\n      using i_props p1_def p2_def bf check_consistent[of psi] p_val\n      unfolding doSinceBase_def optimal_def valid_def\n      by (auto split: sum.splits)\n    ultimately show ?thesis using min_list_wrt_le[OF _ refl_wqo]\n        sinceBase0_sound[OF p1_def p2_def i_props] pw_total[of i \"Since phi I psi\"]\n        trans_wqo Inl\n      apply (auto simp add: total_on_def p2'_def)\n      by (metis transpD)\n  next\n    case (Inr b)\n    {fix vphi vpsi\n      assume vs: \"b = VSince i vphi [vpsi]\"\n      then have b_val: \"valid rho i phi (Inr vphi)\n      \\<and> valid rho i psi (Inr vpsi)\"\n        using q_val Inr i_props unfolding valid_def\n        by (auto simp: Let_def)\n      then have p1_le: \"wqo p1 (Inr vphi)\"\n        using p1_def\n        unfolding optimal_def by auto\n      obtain p1' where p1'_def: \"p1 = Inr p1'\"\n        using b_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      obtain p2' where p2'_def: \"p2 = Inr p2'\"\n        using b_val p2_def check_consistent[OF bf_psi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have lcomp: \"wqo (Inr p2') (Inr vpsi)\" using b_val p2_def\n        unfolding optimal_def\n        by (auto simp: p2'_def)\n      have \"wqo (Inr (VSince i p1' [p2'])) q\"\n        using VSince[OF p1_le[unfolded p1'_def] lcomp] Inr vs\n        by (auto simp add: p1'_def p2'_def)\n      moreover have \"Inr (VSince i p1' [p2']) \\<in> set (doSinceBase 0 0 p1 p2)\"\n        using i_props p1_def p2_def bf check_consistent b_val\n        unfolding doSinceBase_def optimal_def valid_def\n        by (auto split: sum.splits simp: p1'_def p2'_def)\n      ultimately have \"wqo (min_list_wrt wqo (doSinceBase 0 0 p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo]\n          sinceBase0_sound[OF p1_def p2_def i_props] pw_total[of i \"Since phi I psi\"]\n          trans_wqo Inr\n        apply (auto simp add: total_on_def)\n        by (metis transpD)\n    } note * = this\n    {fix vpsi li\n      assume vb: \"b = VSince_never i li [vpsi]\"\n      then have b_val: \"valid rho i psi (Inr vpsi)\" using Inr q_val i_props\n        unfolding valid_def by (auto simp: Let_def split: if_splits)\n      then have lcomp: \"wqo p2 (Inr vpsi)\"\n        using p2_def unfolding optimal_def\n        by auto\n      have li_def: \"li = (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n))\"\n        using q_val\n        by (auto simp: Inr vb valid_def)\n      obtain p2' where p2'_def: \"p2 = Inr p2'\"\n        using b_val p2_def check_consistent[OF bf_psi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have etp_0: \"ETP rho (\\<tau> rho 0 - n) = 0\" for n\n        by (meson Nat.bot_nat_0.extremum_uniqueI diff_le_self i_etp_to_tau)\n      have \"wqo (Inr (VSince_never i li [p2'])) q\"\n        using vb Inr VSince_never lcomp\n        by (auto simp add: p2'_def)\n      moreover have \"Inr (VSince_never i li [p2']) \\<in> set (doSinceBase 0 0 p1 p2)\"\n        using i_props p1_def p2_def bf check_consistent b_val\n        unfolding doSinceBase_def optimal_def valid_def\n        by (auto split: sum.splits enat.splits simp: p2'_def li_def etp_0)\n      ultimately have \"wqo (min_list_wrt wqo (doSinceBase 0 0 p1 p2)) q\"\n        using min_list_wrt_le[OF _ refl_wqo]\n          sinceBase0_sound[OF p1_def p2_def i_props] pw_total[of i \"Since phi I psi\"]\n          trans_wqo Inr\n        apply (auto simp add: total_on_def)\n        by (metis transpD)\n    }\n    then show ?thesis using * Inr q_val assms unfolding valid_def doSinceBase_def\n      apply (cases b)\n                          apply (auto simp: Let_def split: if_splits enat.splits)\n       apply (metis order.asym diff_le_self i_etp_to_tau i_props le_0_eq)\n      apply (metis diff_le_self i_etp_to_tau i_le_ltpi le_zero_eq)\n      done\n  qed\n  then show False using q_le by auto\nqed\n\nlemma sinceBaseNZ_sound:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n  \\<and> right I < enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\"and p2_def: \"optimal i psi p2\"\n    and p_def: \"p \\<in> set (doSinceBase i (left I) p1 p2)\"\n  shows \"valid rho i (Since phi I psi) p\"\nproof (cases \"left I\")\n  {fix i::nat\n    assume i_ge: \"i > 0\"\n    then have \"\\<tau> rho i \\<le> \\<tau> rho i \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0\" by auto\n    then have \"i \\<le> LTP rho (\\<tau> rho i)\" using i_ge\n      by (auto simp add: i_ltp_to_tau)\n    then have \"i \\<le> min i (LTP rho (\\<tau> rho i))\" by auto\n  }note ** = this\n  case 0\n  then show ?thesis\n  proof (cases p1)\n    case (Inl a)\n    then have p1s: \"p1 = Inl a\" by auto\n    then show ?thesis\n    proof (cases p2)\n      case (Inl a1)\n      then have \"p = Inl (SSince a1 [])\" using p_def p1s \"local.0\"\n        unfolding doSinceBase_def by auto\n      then show ?thesis using p2_def \"local.0\" Inl zero_enat_def\n        unfolding optimal_def valid_def by auto\n    next\n      case (Inr b1)\n      from Inr have \"p = Inr (VSince_never i i [b1])\" using p_def p1s \"local.0\"\n        unfolding doSinceBase_def by auto\n      then show ?thesis\n        using p2_def \"local.0\" Inr i_props i_etp_to_tau\n          pastBase_constrs[OF i_props] ** ETP_lt_delta enat_iless\n        unfolding optimal_def valid_def\n        by (auto split: sum.splits enat.splits)\n    qed\n  next\n    case (Inr b)\n    then have p1v: \"p1 = Inr b\" by auto\n    then show ?thesis\n    proof (cases p2)\n      case (Inl a1)\n      then have \"p = Inl (SSince a1 [])\" using p_def \"local.0\" p1v\n        unfolding doSinceBase_def by auto\n      then show ?thesis using p_def p2_def \"local.0\" zero_enat_def Inl\n        unfolding optimal_def valid_def by auto\n    next\n      case (Inr b1)\n      then have \"p = Inr (VSince i b [b1]) \\<or> p = Inr (VSince_never i i [b1])\"\n        using p_def \"local.0\" p1v unfolding doSinceBase_def by auto\n      then show ?thesis using p_def p1_def p2_def i_props Inr p1v \"local.0\"\n          pastBase_constrs[OF i_props] ** ETP_lt_delta enat_iless\n        unfolding optimal_def valid_def\n        by (auto simp: Let_def i_etp_to_tau split: enat.splits sum.splits)\n    qed\n  qed\nnext\n  case (Suc n)\n  then show ?thesis\n  proof (cases p1)\n    case (Inl a)\n    then have \"p = Inr (VSince_never i i [])\" using p_def Suc p1_def\n      unfolding doSinceBase_def\n      by (cases p2; auto)\n    then show ?thesis using Inl p_def p1_def Suc i_props pastBase_constrs[OF i_props] ETP_lt_delta enat_iless\n      unfolding valid_def\n      by (auto simp: Let_def split: enat.splits)\n        (metis add_Suc_right i_le_ltpi_minus leD not_less_eq_eq zero_less_Suc)\n  next\n    case (Inr b)\n    then have \"p = Inr (VSince i b []) \\<or> p = Inr (VSince_never i i [])\"\n      using p_def p1_def Suc unfolding doSinceBase_def\n      by (cases p2; auto)\n    then show ?thesis using Inr p1_def i_props Suc pastBase_constrs[OF i_props] ETP_lt_delta enat_iless\n      unfolding optimal_def valid_def\n      by (auto simp: Let_def split: enat.splits)\n        (metis i_le_ltpi_minus i_props leD zero_less_Suc)+\n  qed\nqed\n\nlemma sinceBaseNZ_optimal:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n  \\<and> right I < enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\"\n    and bf: \"bounded_future (Since phi I psi)\"\n  shows \"optimal i (Since phi I psi) (min_list_wrt wqo (doSinceBase i (left I) p1 p2))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  have bf_psi: \"bounded_future psi\"\n    using bf by auto\n  from doSinceBase_def[of i \"left I\" p1 p2]\n  have nnil: \"doSinceBase i (left I) p1 p2 \\<noteq> []\"\n    by (cases p1; cases p2; cases \"left I\"; auto)\n  from pw_total[of i \"Since phi I psi\"] have total_set: \"total_on wqo (set (doSinceBase i (left I) p1 p2))\"\n    using sinceBaseNZ_sound[OF i_props p1_def p2_def]\n    by (metis not_wqo total_onI)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doSinceBase i (left I) p1 p2). wqo x y) (doSinceBase i (left I) p1 p2) \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doSinceBase i (left I) p1 p2). wqo x y)\" \"(doSinceBase i (left I) p1 p2)\"]\n    by simp\n  assume nopt: \"\\<not> optimal i (Since phi I psi) (min_list_wrt wqo (doSinceBase i (left I) p1 p2))\"\n  define minp where minp: \"minp \\<equiv> (min_list_wrt wqo (doSinceBase i (left I) p1 p2))\"\n  {\n    assume l_ge: \"left I > 0\"\n    then have \"right I > 0\" using left_right[of I] zero_enat_def\n      apply auto\n      using enat_0_iff(2) by auto\n    then have \"\\<not> mem (delta rho i i) I\" using l_ge by auto\n    then have \"\\<forall>j \\<le> i. \\<not> mem (delta rho i j) I\"\n      using i_props r_less_Delta_imp_less l_ge le_neq_implies_less\n      by blast\n    then have \"\\<not> sat rho i (Since phi I psi)\" by auto\n    then have \"VIO rho i (Since phi I psi)\" using completeness\n      by blast\n  } note * = this\n  from sinceBaseNZ_sound[OF i_props p1_def p2_def min_list_wrt_in[of _ wqo]]\n    minp trans_wqo refl_wqo pw_total nnil\n  have vmin: \"valid rho i (Since phi I psi) minp\"\n    apply auto\n    by (metis i_props not_wqo p1_def p2_def sinceBaseNZ_sound total_onI)\n  then obtain q where q_val: \"valid rho i (Since phi I psi) q\" and\n    q_le: \"\\<not> wqo minp q\" using nopt minp unfolding optimal_def\n    by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inl a)\n    then obtain spsiq sphisq where sq: \"a = SSince spsiq sphisq\"\n      using q_val unfolding valid_def\n      by (cases a) auto\n    then have p_val: \"valid rho i psi (Inl spsiq)\" using Inl q_val i_props\n      unfolding valid_def\n      apply (auto simp: Let_def split: list.splits)\n       apply (metis One_nat_def le_neq_implies_less r_less_Delta_imp_less)\n      by (metis One_nat_def le_neq_implies_less r_less_Delta_imp_less)\n    then have p2_le: \"wqo p2 (Inl spsiq)\" using p2_def unfolding optimal_def\n      by auto\n    from q_val have sats: \"SAT rho i (Since phi I psi)\" using check_sound Inl\n      unfolding valid_def by auto\n    have sphisq_Nil: \"sphisq = []\"\n      using q_val Suc_le_lessD i_props r_less_Delta_imp_less\n      by (auto simp: Inl sq valid_def Let_def split: list.splits if_splits)\n    obtain p2' where p2'_def: \"p2 = Inl p2'\"\n      using p_val p2_def check_consistent[OF bf_psi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inl (SSince (projl p2) [])) q\"\n      using SSince[OF p2_le[unfolded p2'_def]] sq Inl\n      by (fastforce simp add: p2'_def map_idI sphisq_Nil)\n    moreover have \"Inl (SSince (projl p2) []) \\<in> set (doSinceBase i (left I) p1 p2)\"\n      using i_props p1_def p2_def bf check_consistent p_val * sats\n      unfolding doSinceBase_def optimal_def valid_def\n      apply (cases \"left I\"; auto split: sum.splits nat.splits)\n      by (metis bf check_complete)+\n    ultimately show ?thesis\n      using min_list_wrt_le[OF _ refl_wqo]\n        sinceBaseNZ_sound[OF i_props p1_def p2_def] pw_total[of i \"Since phi I psi\"]\n        trans_wqo Inl minp\n      apply (auto simp add: total_on_def)\n      by (metis transpD)\n  next\n    case (Inr b)\n    {fix n j\n      assume j_def: \"right I = enat n \\<and> j \\<le> LTP rho (\\<tau> rho i)\n       \\<and> ETP rho (\\<tau> rho i - n) \\<le> j \\<and> j \\<le> i\"\n      then have jin: \"\\<tau> rho j \\<ge> \\<tau> rho i - n\" using i_etp_to_tau by auto\n      from \\<tau>_mono have j_lei: \"\\<forall>j < i. \\<tau> rho j \\<le> \\<tau> rho (i-1)\" by auto\n      from this i_props j_def have \"\\<forall>j < i. \\<tau> rho j \\<le> \\<tau> rho i - n\"\n        apply auto\n        by (metis One_nat_def j_lei add_diff_inverse_nat add_le_imp_le_diff add_le_mono less_imp_le_nat less_nat_zero_code nat_diff_split_asm)\n      then have \"j = i\" using j_def jin apply auto\n        by (metis add.commute order.not_eq_order_implies_strict diff_diff_left enat_ord_simps(2) i_props j_lei less_le_not_le zero_less_diff)\n    } note ** = this\n    then show ?thesis\n    proof (cases \"left I\")\n      case 0\n      {fix vphi vpsi\n        assume bv: \"b = VSince i vphi [vpsi]\"\n        then have b_val: \"valid rho i phi (Inr vphi)\n            \\<and> valid rho i psi (Inr vpsi)\" using q_val Inr i_props i_etp_to_tau\n          \"local.0\" ** i_le_ltpi\n          unfolding valid_def\n          by (auto simp: Let_def split: enat.splits if_splits)\n        then have p1_wqo: \"wqo p1 (Inr vphi)\" using p1_def\n          unfolding optimal_def by auto\n        have p2_wqo: \"wqo p2 (Inr vpsi)\"\n          using b_val p2_def unfolding optimal_def\n          by auto\n        obtain p1' where p1'_def: \"p1 = Inr p1'\"\n          using b_val p1_def check_consistent[OF bf_phi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        obtain p2' where p2'_def: \"p2 = Inr p2'\"\n          using b_val p2_def check_consistent[OF bf_psi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        have \"wqo (Inr (VSince i p1' [p2'])) q\"\n          using bv Inr VSince[OF p1_wqo[unfolded p1'_def]] p2_wqo\n          by (auto simp add: p1'_def p2'_def)\n        moreover have \"Inr (VSince i (p1') [p2']) \\<in> set (doSinceBase i (left I) p1 p2)\"\n          using i_props p1_def p2_def bf check_consistent b_val \"0\"\n          unfolding doSinceBase_def optimal_def valid_def\n          by (auto split: sum.splits nat.splits simp: p1'_def p2'_def)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            sinceBaseNZ_sound[OF i_props p1_def p2_def] pw_total[of i \"Since phi I psi\"]\n            trans_wqo bv Inr minp\n          apply (auto simp add: total_on_def)\n          by (metis transpD)\n      }\n      moreover\n      {fix vpsi\n        assume bv: \"b = VSince_never i i [vpsi]\"\n        then have b_val: \"valid rho i psi (Inr vpsi)\"\n          using q_val Inr min.absorb_iff1 i_props \"0\" i_le_ltpi\n          unfolding valid_def\n          by (auto simp: Let_def split: if_splits enat.splits)\n        then have p2_wqo: \"wqo p2 (Inr vpsi)\"\n          using b_val p2_def unfolding optimal_def\n          by auto\n        obtain p2' where p2'_def: \"p2 = Inr p2'\"\n          using b_val p2_def check_consistent[OF bf_psi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        have \"wqo (Inr (VSince_never i i [p2'])) q\"\n          using bv Inr VSince_never p2_wqo\n          by (auto simp add: p2'_def)\n        moreover have \"Inr (VSince_never i i [p2']) \\<in> set (doSinceBase i (left I) p1 p2)\"\n          using i_props p2_def bf check_consistent b_val \"0\"\n          unfolding doSinceBase_def optimal_def valid_def\n          by (auto split: sum.splits nat.splits simp: p2'_def)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            sinceBaseNZ_sound[OF i_props p1_def p2_def] pw_total[of i \"Since phi I psi\"]\n            trans_wqo bv Inr minp\n          apply (auto simp add: total_on_def)\n          by (metis transpD)\n      }\n      ultimately show ?thesis using q_val \"0\" Inr minp assms **\n        unfolding valid_def doSinceBase_def\n        apply (cases b)\n                            apply (auto simp: Let_def split: if_splits enat.splits)\n             apply (metis (no_types, lifting) list.map_disc_iff append_eq_append_conv2 map_eq_Cons_conv min_less_iff_conj nat_less_le self_append_conv upt_rec)\n            apply (meson i_le_ltpi le_trans)\n           apply (metis (no_types, lifting) list.map_disc_iff append_eq_append_conv2 eq_imp_le map_eq_Cons_conv min_less_iff_conj nat_less_le self_append_conv upt_rec)\n          apply (meson diff_le_self i_etp_to_tau)\n         apply (metis diff_diff_cancel diff_is_0_eq i_etp_to_tau i_le_ltpi le_trans nat_le_linear)\n        using i_props by auto\n    next\n      case (Suc nat)\n      from q_val Inr have \"VIO rho i (Since phi I psi)\"\n        using check_sound(2)[of rho \"Since phi I psi\" b]\n        unfolding valid_def by auto\n          (*\n      have minp_def: \"minp = Inr (VSince i (projr p1) []) \\<or> minp = Inr (VSince_never i i [])\"\n        using minp vmin Suc nnil doSinceBase_def[of i \"left I\" p1 p2]\n          trans_wqo pw_total filter_nnil\n        unfolding valid_def\n        by (cases p1; cases p2; auto simp: min_list_wrt_def refl_wqo reflpD)\n*)\n      {fix vphi vpsis\n        assume bv: \"b = VSince i vphi vpsis\"\n        then have b_val: \"valid rho i phi (Inr vphi)\"\n          using q_val Inr i_props Suc ** i_le_ltpi\n          unfolding valid_def\n          apply (auto simp: Let_def split: enat.splits if_splits)\n          using le_trans apply blast\n          using le_trans by blast\n        then have p1_wqo: \"wqo p1 (Inr vphi)\" using p1_def\n          unfolding optimal_def by auto\n        have vpsis_Nil: \"vpsis = []\"\n          using q_val\n          apply (auto simp: Inr bv valid_def Let_def split: if_splits enat.splits)\n           apply (metis \"**\" Suc i_le_ltpi i_le_ltpi_minus i_props leD le_trans zero_less_Suc)\n          by (metis enat_ord_simps(3) i_props leD)\n        obtain p1' where p1'_def: \"p1 = Inr p1'\"\n          using b_val p1_def check_consistent[OF bf_phi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        have \"wqo (Inr (VSince i (projr p1) [])) q\"\n          using bv Inr VSince_Nil[OF p1_wqo[unfolded p1'_def]]\n          by (fastforce simp add: p1'_def map_idI vpsis_Nil)\n        moreover have \"Inr (VSince i (projr p1) []) \\<in> set (doSinceBase i (left I) p1 p2)\"\n          using i_props p1_def p2_def bf check_consistent b_val Suc\n          unfolding doSinceBase_def optimal_def valid_def\n          by (auto split: sum.splits nat.splits)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            sinceBaseNZ_sound[OF i_props p1_def p2_def] pw_total[of i \"Since phi I psi\"]\n            trans_wqo bv Inr minp\n          apply (auto simp add: total_on_def)\n          by (metis transpD)\n      }\n      moreover\n      {fix li vpsis\n        assume bv: \"b = VSince_never i li vpsis\"\n        have vpsis_Nil: \"vpsis = []\"\n          using q_val i_props\n          by (auto simp: Inr bv valid_def Let_def split: if_splits enat.splits)\n            (smt (z3) \"**\" Lattices.linorder_class.min.cobounded1 Suc i_le_ltpi i_le_ltpi_minus leD le_trans min_def zero_less_Suc)\n        have li_def: \"li = i\"\n          using q_val\n          apply (auto simp: Inr bv vpsis_Nil valid_def split: enat.splits if_splits)\n          using diff_le_self i_etp_to_tau apply blast\n          using ETP_lt_delta enat_ord_simps(2) i_props by presburger\n        have \"wqo (Inr (VSince_never i i [])) q\"\n          using q_val bv Inr not_wqo\n          by (fastforce simp add: map_idI vpsis_Nil li_def)\n        moreover have \"Inr (VSince_never i i []) \\<in> set (doSinceBase i (left I) p1 p2)\"\n          using i_props p2_def bf check_consistent Suc\n          unfolding doSinceBase_def optimal_def valid_def\n          by (auto split: sum.splits nat.splits)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            sinceBaseNZ_sound[OF i_props p1_def p2_def] pw_total[of i \"Since phi I psi\"]\n            trans_wqo bv Inr minp\n          apply (auto simp add: total_on_def)\n          by (metis transpD)\n      }\n      ultimately show ?thesis\n        using minp Suc Inr q_val assms\n        unfolding doSinceBase_def valid_def optimal_def\n        by (cases b) (auto)\n    qed\n  qed\n  then show False using q_le by auto\nqed\n\nlemma since_sound:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n  \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\" and\n    p'_def: \"optimal (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n    and p_def: \"p \\<in> set (doSince i (left I) p1 p2 p')\"\n    and bf: \"bounded_future (Since phi I psi)\"\n    and bf': \"bounded_future (Since phi (subtract (\\<Delta> rho i) I) psi)\"\n  shows \"valid rho i (Since phi I psi) p\"\nproof (cases p')\n  case (Inl a)\n  then have p'l: \"p' = Inl a\" by auto\n  then have satp': \"sat rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi)\"\n    using soundness p'_def check_sound(1)[of rho \"Since phi (subtract (\\<Delta> rho i) I) psi\" a]\n    unfolding optimal_def valid_def by fastforce\n  then obtain q qs where a_def: \"a = SSince q qs\" using Inl p'_def\n    unfolding optimal_def valid_def by (cases a) auto\n  then have a_val: \"s_check rho (Since phi (subtract (\\<Delta> rho i) I) psi) a\"\n    using Inl p'_def unfolding optimal_def valid_def by (auto simp: Let_def)\n  then have mem: \"mem (delta rho (i-1) (s_at q)) (subtract (\\<Delta> rho i) I)\"\n    using a_def Inl p'_def s_check.simps unfolding optimal_def valid_def\n    by (auto simp: Let_def)\n  then have \"left I - \\<Delta> rho i \\<le> delta rho (i-1) (s_at q)\" by auto\n  then have tmp: \"left I \\<le> \\<tau> rho i - \\<tau> rho (i-1) + (\\<tau> rho (i-1) - \\<tau> rho (s_at q))\"\n    by auto\n  from a_val have qi: \"(s_at q) \\<le> (i-1)\" using a_def p'l p'_def\n    unfolding optimal_def valid_def\n    by (auto simp: Let_def)\n  then have liq: \"left I \\<le> delta rho i (s_at q)\" using diff_add_assoc tmp\n    by auto\n  show ?thesis\n  proof (cases \"right I\")\n    case n_def: (enat n)\n    from mem n_def have \"enat (delta rho (i-1) (s_at q)) \\<le> enat n - enat (\\<Delta> rho i)\"\n      by auto\n    then have \"delta rho (i-1) (s_at q) + \\<Delta> rho i \\<le> n\"\n      apply auto\n      by (metis One_nat_def enat_ord_simps(1) i_props le_diff_conv le_diff_conv2 n_def)\n    then have riq: \"enat (delta rho i (s_at q)) \\<le> right I\" using n_def by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then show ?thesis\n        proof (cases p2)\n          case (Inl a2)\n          then have por: \"p = p' \\<oplus> p1 \\<or> p = Inl (SSince (projl p2) [])\"\n            using a_def p'l p1l True p_def unfolding doSince_def by auto\n          moreover\n          {\n            assume pplus: \"p = p' \\<oplus> p1\"\n            then have \"p = Inl (SSince q (qs @ [projl p1]))\" using a_def p'l p1l\n                p'_def p1_def unfolding proofApp_def by auto\n            then have \"valid rho i (Since phi I psi) p\"\n              using a_def True p'_def p1_def p'l p1l i_props liq riq\n              unfolding optimal_def valid_def\n              apply (auto simp: Let_def split: list.splits)\n              by (metis Suc_pred i_props upt_Suc_append)\n          }\n          ultimately show ?thesis\n            using Inl p1l True assms n_def unfolding optimal_def valid_def\n            by auto\n        next\n          case (Inr b2)\n          then have pplus: \"p = p' \\<oplus> p1\" using p1l p_def True p'l\n            unfolding doSince_def by auto\n          then have \"p = Inl (SSince q (qs @ [projl p1]))\" using a_def p'l p1l\n              p'_def p1_def unfolding proofApp_def by auto\n          then show ?thesis\n            using a_def True p'_def p1_def p'l p1l i_props liq riq n_def\n            unfolding optimal_def valid_def\n            apply (auto simp: Let_def split: list.splits)\n            by (metis Suc_pred i_props upt_Suc_append)\n        qed\n      next\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by auto\n        then show ?thesis\n        proof (cases p2)\n          case (Inl a2)\n          then have \"p = Inl (SSince (projl p2) [])\" using p_def Inr True p'l\n            unfolding doSince_def by auto\n          then show ?thesis using p2_def True Inl Inr p'l i_props zero_enat_def\n            unfolding optimal_def valid_def by auto\n        next\n          case (Inr b2)\n          then have \"p = Inr (VSince i (projr p1) [projr p2])\" using p1r True p'l p_def\n            unfolding doSince_def by auto\n          then show ?thesis using i_props p1_def p2_def True p1r Inr bf n_def\n            unfolding optimal_def valid_def\n            apply (auto split: enat.splits)\n            using diff_le_self i_etp_to_tau apply blast\n            using i_le_ltpi by blast\n        qed\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have pplus: \"p = p' \\<oplus> p1\" using p_def False p'l\n          unfolding doSince_def by (cases p2) auto\n        then have pl: \"p = Inl (SSince q (qs @ [projl p1]))\" using a_def p'l Inl\n          unfolding proofApp_def by auto thm s_check.simps\n        from p'_def p'l a_def Inl i_props liq riq have p'_props:\n          \"map s_at qs = [Suc (s_at q) ..< i] \\<and> (\\<forall>q' \\<in> set qs. s_check rho phi q')\"\n          unfolding optimal_def valid_def\n          apply (auto simp: Let_def split: list.splits if_splits)\n           apply (metis One_nat_def Suc_diff_1 Suc_leI diff_Suc_less le_add_diff_inverse2 upt_eq_Cons_conv upt_eq_Nil_conv)\n          by (metis One_nat_def Suc_diff_1 upt_Suc_append)\n        then have map_eq: \"map s_at (qs @ [projl p1]) = [Suc (s_at q) ..< Suc i]\n            \\<and> (\\<forall>q' \\<in> set (qs @ [projl p1]). s_check rho phi q')\"\n          using Inl p1_def i_props qi\n          by (auto simp: optimal_def valid_def)\n        from pl p1_def Inl have at_p1: \"s_at (last (qs @ [projl p1])) = s_at a1\"\n          by (auto simp: optimal_def valid_def)\n        from a_def p'_def p'l have \"s_check rho psi q \\<and> mem (delta rho i (s_at q)) I\"\n          using liq riq\n          by (auto simp: Let_def optimal_def valid_def)\n        then show ?thesis\n          using False pl Inl p1_def i_props liq riq map_eq at_p1\n          unfolding optimal_def valid_def\n          apply (auto simp: Let_def n_def at_p1 split: if_splits list.splits)\n          by (metis last_ConsR last_snoc)+\n      next\n        case (Inr b1)\n        then have \"p = Inr (VSince i (projr p1) [])\" using Inr False p'l p_def\n          unfolding doSince_def by (cases p2) auto\n        then show ?thesis using p1_def i_props Inr False bf\n          unfolding optimal_def valid_def\n          by (auto simp add: i_etp_to_tau Let_def False i_ltp_to_tau le_diff_conv2\n              split: enat.splits)\n      qed\n    qed\n  next\n    case infinity\n    then have riq: \"enat (delta rho i (s_at q)) \\<le> right I\" by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then show ?thesis\n        proof (cases p2)\n          case (Inl a2)\n          then have por: \"p = p' \\<oplus> p1 \\<or> p = Inl (SSince (projl p2) [])\"\n            using a_def p'l p1l True p_def unfolding doSince_def by auto\n          moreover\n          {\n            assume pplus: \"p = p' \\<oplus> p1\"\n            then have \"p = Inl (SSince q (qs @ [projl p1]))\" using a_def p'l p1l\n                p'_def p1_def unfolding proofApp_def by auto\n            then have \"valid rho i (Since phi I psi) p\"\n              using a_def True p'_def p1_def p'l p1l i_props liq riq\n              unfolding optimal_def valid_def\n              apply (auto simp: Let_def split: list.splits)\n              by (metis Suc_pred i_props upt_Suc_append)\n          }\n          ultimately show ?thesis\n            using Inl p1l True assms infinity unfolding optimal_def valid_def\n            by auto\n        next\n          case (Inr b2)\n          then have pplus: \"p = p' \\<oplus> p1\" using p1l p_def True p'l\n            unfolding doSince_def by auto\n          then have \"p = Inl (SSince q (qs @ [projl p1]))\" using a_def p'l p1l\n              p'_def p1_def unfolding proofApp_def by auto\n          then show ?thesis\n            using a_def True p'_def p1_def p'l p1l i_props liq riq infinity\n            unfolding optimal_def valid_def\n            apply (auto simp: Let_def split: list.splits)\n            by (metis Suc_pred i_props upt_Suc_append)\n        qed\n      next\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by auto\n        then show ?thesis\n        proof (cases p2)\n          case (Inl a2)\n          then have \"p = Inl (SSince (projl p2) [])\" using p_def Inr True p'l\n            unfolding doSince_def by auto\n          then show ?thesis using p2_def True Inl Inr p'l i_props zero_enat_def\n            unfolding optimal_def valid_def by auto\n        next\n          case (Inr b2)\n          then have \"p = Inr (VSince i (projr p1) [projr p2])\" using p1r True p'l p_def\n            unfolding doSince_def by auto\n          then show ?thesis using i_props p1_def p2_def True p1r Inr bf infinity\n            unfolding optimal_def valid_def\n            apply (auto split: enat.splits)\n            using i_le_ltpi by blast\n        qed\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have pplus: \"p = p' \\<oplus> p1\" using p_def False p'l\n          unfolding doSince_def by (cases p2) auto\n        then have pl: \"p = Inl (SSince q (qs @ [projl p1]))\" using a_def p'l Inl\n          unfolding proofApp_def by auto\n        then show ?thesis\n          using False p1_def p'_def Inl i_props liq riq a_def p'l infinity\n          unfolding optimal_def valid_def\n          apply (auto simp: Let_def split: list.splits if_splits)\n           apply (simp_all add: Cons_eq_upt_conv)\n          apply (metis One_nat_def Suc_diff_1 i_props upt_Suc_append)\n          done\n      next\n        case (Inr b1)\n        then have \"p = Inr (VSince i (projr p1) [])\" using Inr False p'l p_def\n          unfolding doSince_def by (cases p2) auto\n        then show ?thesis using p1_def i_props Inr False bf\n          unfolding optimal_def valid_def\n          by (auto simp add: i_etp_to_tau Let_def False i_ltp_to_tau le_diff_conv2\n              split: enat.splits)\n      qed\n    qed\n  qed\nnext\n  case (Inr b)\n  then have p'r: \"p' = Inr b\" by auto\n  then show ?thesis\n  proof (cases b)\n    case VFF\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VAtm x11 x12)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNeg x2)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VDisj x31 x32)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VConjL x31)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VConjR x31)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VImpl x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VIff_sv x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VIff_vs x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VOnce_le x8)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VOnce x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VEventually x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VAlways x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VUntil x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VUntil_never x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VHistorically x131 x132)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VSince_le x8)\n    then have c: \"\\<tau> rho (i-1) < \\<tau> rho 0 + (left I - \\<Delta> rho i)\" using p'r p'_def\n      unfolding optimal_def valid_def by auto\n    then have \"\\<tau> rho (i-1) - \\<tau> rho 0 < left I - \\<Delta> rho i\" using i_props\n      by (simp add: less_diff_conv2)\n    then have \"\\<tau> rho i - \\<tau> rho 0 < left I\" by linarith\n    then show ?thesis using i_props by auto\n  next\n    case (VNext x9)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNext_ge x10)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNext_le x11a)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VPrev x12a)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VPrev_ge x13)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VPrev_le x14)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case VPrev_zero\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VSince j q qs)\n    then have j_def: \"j = i-1\" using p'r p'_def unfolding optimal_def valid_def\n      by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases p2)\n        case (Inl a2)\n        then have \"p = Inl (SSince (projl p2) [])\" using p_def p'r VSince True\n          unfolding doSince_def by (cases p1) auto\n        then show ?thesis using Inl p2_def True i_props zero_enat_def\n          unfolding optimal_def valid_def by auto\n      next\n        case (Inr b2)\n        then have p2r: \"p2 = Inr b2\" by auto\n        {\n          from i_props have b2_ge: \"v_at b2 > 0\" using p2r p2_def\n            unfolding optimal_def valid_def by auto\n          then have nl_def: \"v_at q \\<le> v_at b2 -1\" using VSince p'r p'_def p2_def p2r\n            unfolding optimal_def valid_def by (auto simp: Let_def)\n          define l where l_def: \"l \\<equiv> [v_at q ..< min (v_at b2 -1) (LTP rho (\\<tau> rho (v_at b2 -1)))]\"\n          then have \"l = [v_at q ..< v_at b2 -1]\"\n            by (auto simp add: i_le_ltpi min_def)\n          then have \"l @ [min (v_at b2 -1) (LTP rho (\\<tau> rho (v_at b2 -1)))] = l @ [v_at b2 -1]\"\n            by (auto simp add: i_le_ltpi min_def)\n          then have \"l @ [min (v_at b2 -1) (LTP rho (\\<tau> rho (v_at b2 -1)))] = [v_at q ..< min (v_at b2 ) (LTP rho (\\<tau> rho (v_at b2)))]\"\n            using nl_def l_def b2_ge\n            apply (auto simp add: i_le_ltpi min_def)\n            by (metis Suc_pred upt_Suc_append)\n        } note * = this\n        then show ?thesis\n        proof (cases p1)\n          case (Inl a1)\n          from Inl have \"p = p' \\<oplus> p2\" using p2r VSince p'r p_def True\n            unfolding doSince_def by auto\n          then have \"p = Inr (VSince i q (qs @ [projr p2]))\" using VSince p'r\n              p2_def p2r i_props unfolding optimal_def valid_def proofApp_def j_def\n            by auto\n          then show ?thesis using p'_def p2_def i_props True Inl p2r VSince p'r bf'\n              j_def i_le_ltpi\n            unfolding optimal_def valid_def\n            apply (auto simp: Let_def)\n                   apply (auto split: if_splits enat.splits)\n            using * apply auto\n            using min.order_iff apply blast\n            using min.order_iff apply blast\n                   apply (meson diff_le_self le_trans)\n                  apply (meson diff_le_self le_trans)\n            using le_trans apply blast\n            using le_trans apply blast\n            using le_trans apply blast\n            using le_trans apply blast\n            using le_trans apply blast\n            using le_trans by blast\n        next\n          case (Inr b1)\n          then have \"p = Inr (VSince i (projr p1) [projr p2]) \\<or> p = p' \\<oplus> p2\"\n            using p2r p'r VSince True p_def unfolding doSince_def by auto\n          moreover\n          {\n            assume pplus: \"p = p' \\<oplus> p2\"\n            then have \"p = Inr (VSince i q (qs @ [projr p2]))\" using VSince p'r\n                p2_def p2r i_props unfolding optimal_def valid_def proofApp_def j_def\n              by auto\n            then have \"valid rho i (Since phi I psi) p\" using p'_def p2_def i_props True Inr p2r VSince p'r bf'\n                j_def i_le_ltpi\n              unfolding optimal_def valid_def\n              apply (auto simp: Let_def)\n                     apply (auto split: if_splits enat.splits)\n              using * apply auto\n              using Lattices.linorder_class.min.order_iff apply blast\n              using Lattices.linorder_class.min.order_iff apply blast\n                     apply (meson diff_le_self le_trans)\n                    apply (meson diff_le_self le_trans)\n              using le_trans apply blast\n              using le_trans apply blast\n              using le_trans apply blast\n              using le_trans apply blast\n              using le_trans apply blast\n              using le_trans by blast\n          }\n          moreover\n          {\n            assume p: \"p = Inr (VSince i (projr p1) [projr p2])\"\n            then have \"valid rho i (Since phi I psi) p\"\n              using p1_def p2_def Inr p2r bf True i_le_ltpi i_props\n              unfolding optimal_def valid_def\n              by (auto simp add: i_etp_to_tau split: enat.splits)\n          }\n          ultimately show ?thesis by auto\n        qed\n      qed\n    next\n      case False\n      {fix n\n        assume n_def: \"right I = enat n\"\n        from i_props n_def have r: \"n \\<ge> \\<Delta> rho i\" by auto\n        then have \"ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) \\<le> v_at q\"\n          using p'_def VSince p'r n_def unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        then have \"ETP rho (\\<tau> rho i - n) \\<le> v_at q\"\n          using r diff_diff_right[of \"\\<Delta> rho i\" n \"\\<tau> rho (i-1)\"] by auto\n      }note ** = this\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        from Inl have formp: \"p = Inr (VSince i q qs)\" using VSince p'r False p_def\n          unfolding doSince_def by (cases p2) auto\n        from p'_def have v_at_qs: \"map v_at qs = [v_at q ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n          unfolding optimal_def valid_def VSince p'r\n          by (auto simp: Let_def)\n        have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n          using False i_props\n          apply (auto simp: min_def)\n             apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n          subgoal\n            apply (rule antisym)\n            subgoal apply (subst i_ltp_to_tau)\n               apply  (auto simp: gr0_conv_Suc not_le)\n              by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n            subgoal\n              by (auto simp: gr0_conv_Suc)\n            done\n          subgoal\n            by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n          subgoal\n            by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n          done\n        from p'_def have vq: \"v_check rho phi q \\<and> (\\<forall>q \\<in> set qs. v_check rho psi q)\"\n          unfolding optimal_def valid_def VSince p'r\n          by (auto simp: Let_def)\n        from p'_def i_props have \"v_at q \\<le> i\" using VSince p'r\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        then show ?thesis using False i_props VSince p'r bf' formp ** vq\n            v_at_qs[unfolded l_subtract]\n          unfolding valid_def\n          by (auto simp: Let_def i_etp_to_tau split: enat.splits)\n      next\n        case (Inr b1)\n        then have \"p = Inr (VSince i (projr p1) []) \\<or> p = Inr (VSince i q qs)\"\n          using False p_def p'r VSince unfolding doSince_def\n          by (cases p2) auto\n        moreover\n        {\n          assume formp: \"p = Inr (VSince i (projr p1) [])\"\n          then have \"valid rho i (Since phi I psi) p\"\n            using False Inr p1_def i_props bf\n            unfolding optimal_def valid_def\n            apply auto\n             apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            using diff_le_self i_etp_to_tau\n            apply (auto split: enat.splits)\n            using diff_le_self by blast\n        }\n        moreover\n        {\n          assume formp: \"p = Inr (VSince i q qs)\"\n          from p'_def have v_at_qs: \"map v_at qs = [v_at q ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n            unfolding optimal_def valid_def VSince p'r\n            by (auto simp: Let_def)\n          have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n            using False i_props\n            apply (auto simp: min_def)\n               apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              apply (rule antisym)\n              subgoal apply (subst i_ltp_to_tau)\n                 apply  (auto simp: gr0_conv_Suc not_le)\n                by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n              subgoal\n                by (auto simp: gr0_conv_Suc)\n              done\n            subgoal\n              by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n            done\n          from p'_def have vq: \"v_check rho phi q \\<and> (\\<forall>q \\<in> set qs. v_check rho psi q)\"\n            unfolding optimal_def valid_def VSince p'r\n            by (auto simp: Let_def)\n          from p'_def i_props have \"v_at q \\<le> i\" using VSince p'r\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def)\n          then have \"valid rho i (Since phi I psi) p\" using False i_props VSince p'r\n              bf' formp ** vq v_at_qs[unfolded l_subtract]\n            unfolding valid_def\n            by (auto simp: Let_def i_etp_to_tau split: enat.splits)\n        }\n        ultimately show ?thesis by auto\n      qed\n    qed\n  next\n    case (VSince_never j li qs)\n    have li_def: \"li = (case right I - enat (delta rho i (i - Suc 0)) of enat n \\<Rightarrow>\n      ETP rho (\\<tau> rho (i - Suc 0) - n) | \\<infinity> \\<Rightarrow> 0)\"\n      using p'_def\n      by (auto simp: Inr VSince_never optimal_def valid_def)\n    have li: \"li = (case right I of enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0)\"\n      using i_props\n      by (auto simp: li_def split: enat.splits)\n    have j_def: \"j = i-1\" using p'r p'_def VSince_never unfolding optimal_def valid_def\n      by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases \"right I\")\n        case n_def: (enat n)\n        then show ?thesis\n        proof (cases p2)\n          case (Inl a2)\n          then have \"p = Inl (SSince (projl p2) [])\"\n            using p'r VSince_never True p_def unfolding doSince_def\n            by (cases p1) auto\n          then show ?thesis using p2_def i_props Inl True zero_enat_def\n            unfolding optimal_def valid_def by auto\n        next\n          case (Inr b2)\n          then have p2r: \"p2 = Inr b2\" by auto\n          {\n            from i_props n_def have r: \"n \\<ge> \\<Delta> rho i\" by auto\n            then have \"ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) \\<le> i-1\"\n              using p'_def VSince_never p'r n_def unfolding optimal_def valid_def\n              by (auto simp add: i_etp_to_tau le_diff_conv Let_def split: if_splits)\n            then have \"ETP rho (\\<tau> rho i - n) \\<le> i-1\"\n              using r diff_diff_right[of \"\\<Delta> rho i\" n \"\\<tau> rho (i-1)\"] by auto\n          }note * = this\n          {\n            from i_props have b2_ge: \"v_at b2 > 0\" using p2r p2_def\n              unfolding optimal_def valid_def by auto\n            then have nl_def: \"ETP rho (\\<tau> rho i - n) \\<le> v_at b2 - 1\" using * VSince_never p'r p'_def p2_def p2r\n              unfolding optimal_def valid_def by (auto simp: Let_def)\n            define l where l_def: \"l \\<equiv> [ETP rho (\\<tau> rho i - n) ..< min (v_at b2 -1) (LTP rho (\\<tau> rho (v_at b2 -1)))]\"\n            then have \"l = [ETP rho (\\<tau> rho i - n) ..< v_at b2 -1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (v_at b2 -1) (LTP rho (\\<tau> rho (v_at b2 -1)))] = l @ [v_at b2 -1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (v_at b2 -1) (LTP rho (\\<tau> rho (v_at b2 -1)))] = [ETP rho (\\<tau> rho i - n) ..< min (v_at b2 ) (LTP rho (\\<tau> rho (v_at b2)))]\"\n              using nl_def l_def b2_ge\n              apply (auto simp add: i_le_ltpi min_def)\n              by (metis Suc_pred upt_Suc_append)\n          }note ** = this\n          then show ?thesis\n          proof (cases p1)\n            case (Inl a1)\n            then have \"p = p' \\<oplus> p2\" using p2r p'r VSince_never True p_def\n              unfolding doSince_def by auto\n            then have \"p = Inr (VSince_never i li (qs @ [projr p2]))\"\n              using VSince_never p'r p2_def p2r i_props\n              unfolding optimal_def valid_def proofApp_def j_def\n              by auto\n            then show ?thesis using * ** n_def p'_def p2_def p2r p'r VSince_never\n                True i_props i_le_ltpi\n              unfolding optimal_def valid_def\n              using [[linarith_split_limit=20]]\n              apply (auto 0 0 simp: Let_def split: if_splits)\n              using min.orderE apply blast\n                   apply (metis One_nat_def Suc_diff_1 le_SucI)\n                  apply (metis Suc_pred le_trans nat_le_linear not_less_eq_eq)\n              using le_trans by blast+\n          next\n            case (Inr b1)\n            then have \"p = Inr (VSince i (projr p1) [projr p2]) \\<or> p = p' \\<oplus> p2\"\n              using p2r True p'r VSince_never p_def unfolding doSince_def\n              by auto\n            moreover\n            {\n              assume \"p = p' \\<oplus> p2\"\n              then have \"p = Inr (VSince_never i li (qs @ [projr p2]))\"\n                using VSince_never p'r p2_def p2r i_props\n                unfolding optimal_def valid_def proofApp_def j_def\n                by auto\n              then have \"valid rho i (Since phi I psi) p\" using * ** n_def p'_def p2_def p2r p'r VSince_never\n                  True i_props i_le_ltpi\n                unfolding optimal_def valid_def\n                using [[linarith_split_limit=20]]\n                apply (auto 0 0 simp: Let_def split: if_splits)\n                using min.orderE apply blast\n                     apply (metis One_nat_def Suc_diff_1 le_SucI)\n                    apply (metis Suc_pred le_trans nat_le_linear not_less_eq_eq)\n                using le_trans by blast+\n            }\n            moreover\n            {\n              assume \"p = Inr (VSince i (projr p1) [projr p2])\"\n              then have \"valid rho i (Since phi I psi) p\"\n                using Inr p2r p1_def p2_def True i_props n_def\n                unfolding optimal_def valid_def\n                apply (auto simp add: i_etp_to_tau)\n                using i_le_ltpi by blast\n            }\n            ultimately show ?thesis by auto\n          qed\n        qed\n      next\n        case infinity\n        then show ?thesis        proof (cases p2)\n          case (Inl a2)\n          then have \"p = Inl (SSince (projl p2) [])\"\n            using p'r VSince_never True p_def unfolding doSince_def\n            by (cases p1) auto\n          then show ?thesis using p2_def i_props Inl True zero_enat_def\n            unfolding optimal_def valid_def by auto\n        next\n          case (Inr b2)\n          then have p2r: \"p2 = Inr b2\" by auto\n          {\n            from i_props have b2_ge: \"v_at b2 > 0\" using p2r p2_def\n              unfolding optimal_def valid_def by auto\n            then have nl_def: \"ETP rho 0 \\<le> v_at b2 - 1\" using VSince_never p'r p'_def p2_def p2r\n              unfolding optimal_def valid_def by (auto simp: Let_def i_etp_to_tau)\n            define l where l_def: \"l \\<equiv> [ETP rho 0 ..< min (v_at b2 -1) (LTP rho (\\<tau> rho (v_at b2 -1)))]\"\n            then have \"l = [ETP rho 0 ..< v_at b2 -1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (v_at b2 -1) (LTP rho (\\<tau> rho (v_at b2 -1)))] = l @ [v_at b2 -1]\"\n              by (auto simp add: i_le_ltpi min_def)\n            then have \"l @ [min (v_at b2 -1) (LTP rho (\\<tau> rho (v_at b2 -1)))] = [ETP rho 0 ..< min (v_at b2 ) (LTP rho (\\<tau> rho (v_at b2)))]\"\n              using nl_def l_def b2_ge\n              apply (auto simp add: i_le_ltpi min_def)\n              by (metis Suc_pred diff_0_eq_0 diff_is_0_eq upt_Suc)\n          }note ** = this\n          then show ?thesis\n          proof (cases p1)\n            case (Inl a1)\n            then have \"p = p' \\<oplus> p2\" using p2r p'r VSince_never True p_def\n              unfolding doSince_def by auto\n            then have \"p = Inr (VSince_never i li (qs @ [projr p2]))\"\n              using VSince_never p'r p2_def p2r i_props\n              unfolding optimal_def valid_def proofApp_def j_def\n              by auto\n            then show ?thesis using infinity p'_def p2_def p2r p'r VSince_never\n                True i_props i_le_ltpi **\n              unfolding optimal_def valid_def\n              by (auto simp: Let_def i_etp_to_tau i_le_ltpi split: if_splits)\n          next\n            case (Inr b1)\n            then have \"p = Inr (VSince i (projr p1) [projr p2]) \\<or> p = p' \\<oplus> p2\"\n              using p2r True p'r VSince_never p_def unfolding doSince_def\n              by auto\n            moreover\n            {\n              assume \"p = p' \\<oplus> p2\"\n              then have \"p = Inr (VSince_never i li (qs @ [projr p2]))\"\n                using VSince_never p'r p2_def p2r i_props\n                unfolding optimal_def valid_def proofApp_def j_def\n                by auto\n              then have \"valid rho i (Since phi I psi) p\" using ** infinity p'_def p2_def p2r p'r VSince_never\n                  True i_props i_le_ltpi\n                unfolding optimal_def valid_def\n                by (auto simp: Let_def  i_etp_to_tau i_le_ltpi split: if_splits)\n            }\n            moreover\n            {\n              assume \"p = Inr (VSince i (projr p1) [projr p2])\"\n              then have \"valid rho i (Since phi I psi) p\"\n                using Inr p2r p1_def p2_def True i_props infinity\n                unfolding optimal_def valid_def\n                apply (auto simp add: i_etp_to_tau)\n                using i_le_ltpi by blast\n            }\n            ultimately show ?thesis by auto\n          qed\n        qed\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        { fix n assume n_def: \"right I = enat n\"\n          case (Inl a1)\n          then have formp: \"p = Inr (VSince_never i li qs)\"\n            using False p_def p'r VSince_never\n            unfolding doSince_def by (cases p2) auto\n          from p'_def have v_at_qs: \"map v_at qs = [ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n            using n_def unfolding optimal_def valid_def VSince_never p'r\n            by (auto simp: Let_def)\n          have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n            using False i_props\n            apply (auto simp: min_def)\n               apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              apply (rule antisym)\n              subgoal apply (subst i_ltp_to_tau)\n                 apply  (auto simp: gr0_conv_Suc not_le)\n                by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n              subgoal\n                by (auto simp: gr0_conv_Suc)\n              done\n            subgoal\n              by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n            done\n          from p'_def have vq: \"\\<forall>q \\<in> set qs. v_check rho psi q\"\n            unfolding optimal_def valid_def VSince_never p'r\n            by (auto simp: Let_def)\n          from n_def i_props have \"ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) = ETP rho (\\<tau> rho i - n)\"\n            by auto\n          then have \"map v_at qs = [ETP rho (\\<tau> rho i - n) ..< Suc (l rho i I)]\"\n            using v_at_qs[unfolded l_subtract] by auto\n          then have ?thesis using False i_props VSince_never p'r bf' bf formp vq\n              n_def unfolding valid_def\n            by (auto simp: Let_def li)\n        }\n        moreover\n        { assume infinity: \"right I = \\<infinity>\"\n          case (Inl a1)\n          then have formp: \"p = Inr (VSince_never i li qs)\"\n            using False p_def p'r VSince_never\n            unfolding doSince_def by (cases p2) auto\n          from p'_def have v_at_qs: \"map v_at qs = [ETP rho 0 ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n            using infinity unfolding optimal_def valid_def VSince_never p'r\n            by (auto simp: Let_def)\n          have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n            using False i_props\n            apply (auto simp: min_def)\n               apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              apply (rule antisym)\n              subgoal apply (subst i_ltp_to_tau)\n                 apply  (auto simp: gr0_conv_Suc not_le)\n                by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n              subgoal\n                by (auto simp: gr0_conv_Suc)\n              done\n            subgoal\n              by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n            subgoal\n              by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n            done\n          from p'_def have vq: \"\\<forall>q \\<in> set qs. v_check rho psi q\"\n            unfolding optimal_def valid_def VSince_never p'r\n            by (auto simp: Let_def)\n          then have \"map v_at qs = [ETP rho 0 ..< Suc (l rho i I)]\"\n            using v_at_qs[unfolded l_subtract] by auto\n          then have ?thesis using False i_props VSince_never p'r bf' bf formp vq\n              infinity unfolding valid_def\n            by (auto simp: Let_def li)\n        }\n        moreover case Inl\n        ultimately show ?thesis by (cases \"right I\"; blast)\n      next\n        { fix n assume n_def: \"right I = enat n\"\n          case (Inr b1)\n          then have \"p = Inr (VSince i (projr p1) []) \\<or> p = Inr (VSince_never i li qs)\"\n            using p'r VSince_never False p_def unfolding doSince_def\n            by (cases p2) auto\n          moreover\n          {\n            assume formp: \"p = Inr (VSince_never i li qs)\"\n            from p'_def have v_at_qs: \"map v_at qs = [ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n              using n_def unfolding optimal_def valid_def VSince_never p'r\n              by (auto simp: Let_def)\n            have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n              using False i_props\n              apply (auto simp: min_def)\n                 apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                apply (rule antisym)\n                subgoal apply (subst i_ltp_to_tau)\n                   apply  (auto simp: gr0_conv_Suc not_le)\n                  by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n                subgoal\n                  by (auto simp: gr0_conv_Suc)\n                done\n              subgoal\n                by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n              done\n            from p'_def have vq: \"\\<forall>q \\<in> set qs. v_check rho psi q\"\n              unfolding optimal_def valid_def VSince_never p'r\n              by (auto simp: Let_def)\n            from n_def i_props have \"ETP rho (\\<tau> rho (i-1) - (n - \\<Delta> rho i)) = ETP rho (\\<tau> rho i - n)\"\n              by auto\n            then have \"map v_at qs = [ETP rho (\\<tau> rho i - n) ..< Suc (l rho i I)]\"\n              using v_at_qs[unfolded l_subtract] by auto\n            then have \"valid rho i (Since phi I psi) p\"\n              using False i_props VSince_never p'r bf' bf formp vq n_def\n              unfolding valid_def\n              by (auto simp: Let_def li)\n          }\n          moreover\n          {\n            assume formp: \"p = Inr (VSince i (projr p1) [])\"\n            then have \"valid rho i (Since phi I psi) p\"\n              using p1_def i_props Inr n_def False\n              unfolding optimal_def valid_def\n              apply (auto simp add: i_etp_to_tau)\n              by (metis i_le_ltpi_minus le_antisym less_irrefl_nat less_or_eq_imp_le)\n          }\n          ultimately have ?thesis by auto\n        }\n        moreover\n        { assume infinity: \"right I = infinity\"\n          case (Inr b1)\n          then have \"p = Inr (VSince i (projr p1) []) \\<or> p = Inr (VSince_never i li qs)\"\n            using p'r VSince_never False p_def unfolding doSince_def\n            by (cases p2) auto\n          moreover\n          {\n            assume formp: \"p = Inr (VSince_never i li qs)\"\n            from p'_def have v_at_qs: \"map v_at qs = [ETP rho 0 ..< Suc (l rho (i - 1) (subtract (\\<Delta> rho i) I))]\"\n              using infinity unfolding optimal_def valid_def VSince_never p'r\n              by (auto simp: Let_def)\n            have l_subtract: \"l rho (i - 1) (subtract (\\<Delta> rho i) I) = l rho i I\"\n              using False i_props\n              apply (auto simp: min_def)\n                 apply (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                apply (rule antisym)\n                subgoal apply (subst i_ltp_to_tau)\n                   apply  (auto simp: gr0_conv_Suc not_le)\n                  by (smt order.trans add_Suc diff_cancel_middle diff_diff_left diff_is_0_eq i_ltp_to_tau i_props le_add2 le_diff_conv2 nat_le_linear)\n                subgoal\n                  by (auto simp: gr0_conv_Suc)\n                done\n              subgoal\n                by (smt False add_leD2 diff_diff_cancel diff_is_0_eq' i_ltp_to_tau le_diff_conv2)\n              subgoal\n                by (metis diff_cancel_middle diff_zero i_le_ltpi less_le neq0_conv zero_less_diff)\n              done\n            from p'_def have vq: \"\\<forall>q \\<in> set qs. v_check rho psi q\"\n              unfolding optimal_def valid_def VSince_never p'r\n              by (auto simp: Let_def)\n            then have \"map v_at qs = [ETP rho 0 ..< Suc (l rho i I)]\"\n              using v_at_qs[unfolded l_subtract] by auto\n            then have \"valid rho i (Since phi I psi) p\"\n              using False i_props VSince_never p'r bf' bf formp vq infinity\n              unfolding valid_def\n              by (auto simp: Let_def li)\n          }\n          moreover\n          {\n            assume formp: \"p = Inr (VSince i (projr p1) [])\"\n            then have \"valid rho i (Since phi I psi) p\"\n              using p1_def i_props Inr False infinity\n              unfolding optimal_def valid_def\n              apply (auto simp add: i_etp_to_tau)\n              by (metis i_le_ltpi_minus le_antisym less_irrefl_nat less_or_eq_imp_le)\n          }\n          ultimately have ?thesis by auto\n        }\n        thm calculation this\n        moreover case Inr\n        ultimately show ?thesis by (cases \"right I\"; blast)\n      qed\n    qed\n  qed\nqed\n\nlemma since_optimal:\n  assumes i_props: \"i > 0 \\<and> \\<tau> rho i \\<ge> \\<tau> rho 0 + left I\n   \\<and> right I \\<ge> enat (\\<Delta> rho i)\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\" and\n    p'_def: \"optimal (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n    and bf: \"bounded_future (Since phi I psi)\"\n    and bf': \"bounded_future (Since phi (subtract (\\<Delta> rho i) I) psi)\"\n  shows \"optimal i (Since phi I psi) (min_list_wrt wqo (doSince i (left I) p1 p2 p'))\"\nproof (rule ccontr)\n  define minp where minp: \"minp \\<equiv> min_list_wrt wqo (doSince i (left I) p1 p2 p')\"\n  from bf have bfpsi: \"bounded_future psi\" by auto\n  from bf have bfphi: \"bounded_future phi\" by auto\n      (*  from bf obtain n where n_def: \"right I = enat n\" by auto*)\n  from pw_total[of i \"Since phi I psi\"] have total_set: \"total_on wqo (set (doSince i (left I) p1 p2 p'))\"\n    using since_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n    by (metis not_wqo total_onI)\n  define li where \"li = (case right I - enat (delta rho i (i - Suc 0)) of enat n \\<Rightarrow>\n      ETP rho (\\<tau> rho (i - Suc 0) - n) | \\<infinity> \\<Rightarrow> 0)\"\n  have li: \"li = (case right I of enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0)\"\n    using i_props\n    by (auto simp: li_def split: enat.splits)\n  from p'_def have p'_form: \"(\\<exists>p p''. p' = Inl (SSince p p'')) \\<or> (\\<exists>p p''. p' = Inr (VSince (i-1) p p''))\n  \\<or> (\\<exists>p. p' = Inr (VSince_never (i-1) li p))\"\n  proof(cases \"SAT rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi)\")\n    case True\n    then show ?thesis\n      using val_SAT_imp_l[OF bf'] p'_def\n        valid_SinceE[of \"i-1\" phi \"subtract (\\<Delta> rho i) I\" psi p']\n      unfolding optimal_def\n      apply auto\n      by blast\n  next\n    case False\n    then have VIO: \"VIO rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi)\"\n      using SAT_or_VIO\n      by auto\n    then obtain b' where b'_def: \"p' = Inr b'\"\n      using val_VIO_imp_r[OF bf'] p'_def\n      unfolding optimal_def\n      by force\n    then show ?thesis\n      using p'_def i_props_imp_not_le[OF i_props p'_def]\n      unfolding optimal_def valid_def\n      by (cases b') (auto simp: li_def)\n  qed\n  from doSince_def[of i \"left I\" p1 p2 p'] p'_form\n  have nnil: \"doSince i (left I) p1 p2 p' \\<noteq> []\"\n    by (cases p1; cases p2; cases \"left I\"; cases p'; auto)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doSince i (left I) p1 p2 p'). wqo x y) (doSince i (left I) p1 p2 p') \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doSince i (left I) p1 p2 p'). wqo x y)\" \"(doSince i (left I) p1 p2 p')\"]\n    by simp\n  assume nopt: \"\\<not> optimal i (Since phi I psi) minp\"\n  from since_sound[OF i_props p1_def p2_def p'_def min_list_wrt_in bf bf']\n    total_set trans_wqo refl_wqo nnil minp\n  have vmin: \"valid rho i (Since phi I psi) minp\"\n    by auto\n  then obtain q where q_val: \"valid rho i (Since phi I psi) q\" and\n    q_le: \"\\<not> wqo minp q\" using minp nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inl a)\n    then have q_s: \"q = Inl a\" by auto\n    then have SATs: \"SAT rho i (Since phi I psi)\" using q_val check_sound(1)\n      unfolding valid_def by auto\n    then have sats: \"sat rho i (Since phi I psi)\" using soundness\n      by blast\n    from Inl obtain spsi sphis where a_def: \"a = SSince spsi sphis\"\n      using q_val unfolding valid_def by (cases a) auto\n    then have valpsi: \"valid rho (s_at spsi) psi (Inl spsi)\" using q_val Inl\n      unfolding valid_def by (auto simp: Let_def)\n    from q_val Inl a_def\n    have spsi_bounds: \"s_at spsi \\<ge> ETP rho (case right I of \\<infinity> \\<Rightarrow> 0 | enat n \\<Rightarrow> \\<tau> rho i - n) \\<and> s_at spsi \\<le> i\"\n      unfolding valid_def\n      by (auto simp: Let_def i_etp_to_tau split: list.splits if_splits enat.splits)\n    from valpsi val_SAT_imp_l[OF bf] SATs have check_spsi: \"s_check rho psi spsi\"\n      unfolding valid_def by auto\n    then show ?thesis\n    proof (cases p')\n      case (Inl a')\n      then have p'l: \"p' = Inl a'\" by auto\n      then obtain spsi' sphis' where a'_def: \"a' = SSince spsi' sphis'\"\n        using p'_def unfolding optimal_def valid_def\n        by (cases a') auto\n      from SATs vmin have minl: \"\\<exists>a. minp = Inl a\" using minp val_SAT_imp_l[OF bf]\n        by auto\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then show ?thesis\n          proof (cases p2)\n            case (Inl a2)\n            then have form: \"doSince i (left I) p1 p2 p' = [(p' \\<oplus> p1), Inl (SSince a2 [])]\"\n              using p1l p'l True a'_def unfolding doSince_def by auto\n            then show ?thesis\n            proof (cases sphis rule: rev_cases)\n              case Nil\n              then have \"wqo (Inl (SSince a2 [])) q\"\n                using Inl q_val p2_def SSince[of a2 spsi]\n                by (auto simp: optimal_def valid_def q_s a_def)\n              moreover have \"Inl (SSince a2 []) \\<in> set (doSince i (left I) p1 p2 p')\"\n                using form by auto\n              ultimately show ?thesis using minp min_list_wrt_le[OF _ refl_wqo]\n                  since_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                  pw_total[of i \"Since phi I psi\"] q_val\n                  trans_wqo q_s\n                apply (auto simp add: total_on_def)\n                by (metis transpD)\n            next\n              case (snoc ys y)\n              from p'l p1l a'_def have check_p: \"checkApp p' p1\"\n                by (auto intro: checkApp.intros)\n              from form since_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n              have p_val: \"valid rho i (Since phi I psi) (p' \\<oplus> p1)\"\n                by auto\n              from a_def snoc have y_val: \"valid rho i phi (Inl y)\"\n                using q_s q_val True i_props unfolding valid_def\n                by (auto simp: Let_def case_snoc split: if_splits)\n              with q_val have q'_val:\n                \"valid rho (i - 1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inl (SSince spsi ys))\"\n                using y_val snoc i_props sval_to_sval'[of i phi I psi spsi ys y]\n                unfolding q_s a_def\n                by (auto simp: Let_def valid_def case_snoc)\n              then have q_eq: \"q = (Inl (SSince spsi ys)) \\<oplus> (Inl y)\"\n                using q_s a_def snoc by auto\n              then have q_val2: \"valid rho i (Since phi I psi) ((Inl (SSince spsi ys)) \\<oplus> (Inl y))\"\n                using q_val by auto\n              then have check_q: \"checkApp (Inl (SSince spsi ys)) (Inl y)\"\n                using checkApp.intros(1) by auto\n              then have wqo_p': \"wqo p' (Inl (SSince spsi ys))\" using q'_val p'_def\n                unfolding optimal_def by auto\n              moreover have wqo_p1: \"wqo p1 (Inl y)\" using i_props p1_def y_val\n                unfolding optimal_def by auto\n              ultimately have \"wqo (p' \\<oplus> p1) q\"\n                using snoc q_s a_def\n                  proofApp_mono[OF check_p check_q wqo_p' wqo_p1 p_val q_val2]\n                by auto\n              moreover have \"(p' \\<oplus> p1) \\<in> set (doSince i (left I) p1 p2 p')\"\n                using form by auto\n              ultimately show ?thesis using minp min_list_wrt_le[OF _ refl_wqo] snoc\n                  since_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                  pw_total[of i \"Since phi I psi\"] p'l trans_wqo q_s p1l a'_def\n                unfolding proofApp_def\n                apply (auto simp add: total_on_def)\n                by (metis transpD)\n            qed\n          next\n            case (Inr b2)\n            then have form: \"minp = p' \\<oplus> p1\"\n              using Inr p1l p'l a'_def True minp filter_nnil\n              unfolding doSince_def\n              by (auto simp: min_list_wrt_def)\n            from p2_def Inr have psi_VIO: \"VIO rho i psi\"\n              using check_consistent[OF bfpsi]\n              unfolding optimal_def valid_def\n              by (auto simp add: check_sound(2))\n            then have spsi_less: \"s_at spsi < i\"\n              using a_def q_s q_val zero_enat_def unfolding valid_def\n              apply (auto simp: Let_def split: list.splits if_splits)\n              using bfpsi check_sound(1) soundness by blast\n            then have sphis_not_nil: \"sphis \\<noteq> []\" using a_def q_s q_val\n              unfolding valid_def by auto\n            then obtain y and ys where snoc_q: \"sphis = ys @ [y]\"\n              using a_def q_s q_val spsi_less unfolding valid_def\n              apply (auto simp: Let_def split: if_splits)\n              by (metis neq_Nil_conv_snoc sphis_not_nil)\n            from p'l p1l a'_def have check_p: \"checkApp p' p1\"\n              by (auto intro: checkApp.intros)\n            from form vmin have p_val: \"valid rho i (Since phi I psi) (p' \\<oplus> p1)\"\n              using minp by auto\n            from a_def snoc_q have y_val: \"valid rho i phi (Inl y)\"\n              using q_s q_val True i_props unfolding valid_def\n              by (auto simp: Let_def case_snoc split: if_splits)\n            with q_val have q'_val:\n              \"valid rho (i - 1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inl (SSince spsi ys))\"\n              using y_val snoc_q i_props sval_to_sval'[of i phi I psi spsi ys y]\n              unfolding q_s a_def\n              by (auto simp: Let_def valid_def case_snoc)\n            then have q_eq: \"q = (Inl (SSince spsi ys)) \\<oplus> (Inl y)\"\n              using q_s a_def snoc_q by auto\n            then have q_val2: \"valid rho i (Since phi I psi) ((Inl (SSince spsi ys)) \\<oplus> (Inl y))\"\n              using q_val by auto\n            then have check_q: \"checkApp (Inl (SSince spsi ys)) (Inl y)\"\n              using checkApp.intros(1) by auto\n            then have wqo_p': \"wqo p' (Inl (SSince spsi ys))\" using q'_val p'_def\n              unfolding optimal_def by auto\n            moreover have wqo_p1: \"wqo p1 (Inl y)\" using i_props p1_def y_val\n              unfolding optimal_def by auto\n            ultimately show ?thesis\n              using snoc_q q_s a_def form\n                proofApp_mono[OF check_p check_q wqo_p' wqo_p1 p_val q_val2]\n              by auto\n          qed\n        next\n          case False\n          then have form: \"minp = p' \\<oplus> p1\"\n            using p1l p'l a'_def minp filter_nnil\n            unfolding doSince_def\n            by (cases p2; auto simp: min_list_wrt_def)\n          from False have spsi_less: \"s_at spsi < i\" using q_val a_def q_s\n            unfolding valid_def\n            by (auto simp: Let_def split: if_splits)\n          then have sphis_not_nil: \"sphis \\<noteq> []\" using a_def q_s q_val\n            unfolding valid_def by auto\n          then obtain y and ys where snoc_q: \"sphis = ys @ [y]\"\n            using a_def q_s q_val spsi_less unfolding valid_def\n            apply (auto simp: Let_def split: if_splits)\n            by (metis neq_Nil_conv_snoc sphis_not_nil)\n          from p'l p1l a'_def have check_p: \"checkApp p' p1\"\n            by (auto intro: checkApp.intros)\n          from form vmin have p_val: \"valid rho i (Since phi I psi) (p' \\<oplus> p1)\"\n            using minp by auto\n          from a_def snoc_q have y_val: \"valid rho i phi (Inl y)\"\n            using q_s q_val i_props unfolding valid_def\n            by (auto simp: Let_def case_snoc split: if_splits)\n          with q_val have q'_val:\n            \"valid rho (i - 1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inl (SSince spsi ys))\"\n            using y_val snoc_q i_props sval_to_sval'[of i phi I psi spsi ys y]\n            unfolding q_s a_def\n            by (auto simp: Let_def valid_def case_snoc)\n          then have q_eq: \"q = (Inl (SSince spsi ys)) \\<oplus> (Inl y)\"\n            using q_s a_def snoc_q by auto\n          then have q_val2: \"valid rho i (Since phi I psi) ((Inl (SSince spsi ys)) \\<oplus> (Inl y))\"\n            using q_val by auto\n          then have check_q: \"checkApp (Inl (SSince spsi ys)) (Inl y)\"\n            using checkApp.intros(1) by auto\n          then have wqo_p': \"wqo p' (Inl (SSince spsi ys))\" using q'_val p'_def\n            unfolding optimal_def by auto\n          moreover have wqo_p1: \"wqo p1 (Inl y)\" using i_props p1_def y_val\n            unfolding optimal_def by auto\n          ultimately show ?thesis\n            using snoc_q q_s a_def form\n              proofApp_mono[OF check_p check_q wqo_p' wqo_p1 p_val q_val2]\n            by auto\n        qed\n      next\n        case (Inr b1)\n        then have phivio: \"VIO rho i phi\" using p1_def check_sound(2)\n          unfolding optimal_def valid_def\n          by auto\n        from Inr have form_min: \"minp = Inl (SSince (projl p2) [])\"\n          using p'l minp minl filter_nnil unfolding doSince_def\n          by (cases p2; cases \"left I = 0\"; auto simp: min_list_wrt_def)\n        then have sphis_nil: \"sphis = []\" using phivio q_val a_def i_props q_s\n          unfolding valid_def\n          apply (auto simp: Let_def split: if_splits list.splits)\n          using bfphi check_sound(1) soundness apply blast\n          using bfphi check_sound(1) last_in_set soundness by blast\n        then have sc: \"s_at spsi = i\" using a_def q_s q_val unfolding valid_def\n          by auto\n        then obtain a2 where a2_def: \"p2 = Inl a2\"\n          using bfpsi check_sound(1) check_spsi optimal_def p2_def val_SAT_imp_l\n          by blast\n        moreover have \"wqo p2 (Inl spsi)\" using valpsi sc p2_def\n          unfolding optimal_def by auto\n        ultimately show ?thesis using form_min q_s a_def sphis_nil a2_def\n            SSince[of a2 spsi] by auto\n      qed\n    next\n      case (Inr b)\n      then have formb: \"(\\<exists>q qs. b = VSince (i-1) q qs) \\<or> (\\<exists>qs. b = VSince_never (i-1) li qs)\"\n        using i_props_imp_not_le[OF i_props p'_def] p'_def i_props Inr\n        unfolding optimal_def valid_def\n        by (cases b) (auto simp: li_def)\n      then have viosp: \"\\<not> sat rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi)\"\n        using p'_def Inr check_sound(2)[of rho \"Since phi (subtract (\\<Delta> rho i) I) psi\" b]\n          soundness[of rho _ \"Since phi (subtract (delta rho i (i - 1)) I) psi\"]\n        unfolding optimal_def valid_def\n        by (auto simp: Let_def)\n      then have satc: \"mem 0 I \\<and> sat rho i psi\" using i_props sats sat_Since_rec\n        apply auto\n        apply (metis Nat.bot_nat_0.extremum_unique sat_Since_rec sats viosp)\n         apply (metis enat_0_iff(2) zero_le)\n        by (metis sat_Since_rec sats viosp)\n      from vmin SATs val_SAT_imp_l obtain ap where ap_def: \"minp = Inl ap\"\n        using minp unfolding valid_def apply auto\n        using bf by blast\n      then have aps: \"ap = SSince (projl p2) []\" using minp formb Inr satc\n          filter_nnil\n        unfolding doSince_def proofApp_def\n        by (cases p1; cases p2) (auto simp: min_list_wrt_def split: if_splits)\n      then obtain a2 where a2_def: \"p2 = Inl a2\"\n        using ap_def minp satc formb Inr filter_nnil\n        unfolding doSince_def proofApp_def\n        by (cases p1; cases p2) (auto simp: min_list_wrt_def split: if_splits)\n      then have min: \"min (i-1) (LTP rho (\\<tau> rho (i-1) - (left (subtract (\\<Delta> rho i) I)))) = i-1\"\n        using satc apply auto\n        by (metis min.orderE i_le_ltpi)\n      {fix qs\n        assume bv: \"b = VSince_never (i-1) li qs\"\n        then have tc: \"map v_at qs = [(case right I of enat n \\<Rightarrow> ETP rho (\\<tau> rho i - n) | _ \\<Rightarrow> 0) ..< i]\"\n          using min satc Inr p'_def i_props unfolding optimal_def valid_def\n          by (auto split: enat.splits)\n        then have qs_check: \"\\<forall>p \\<in> set qs. v_check rho psi p\"\n          using bv min satc Inr p'_def i_props\n          unfolding optimal_def valid_def by auto\n        then have jc: \"\\<forall>j \\<in> set (map v_at qs). \\<exists>p. v_at p = j \\<and> v_check rho psi p\"\n          using map_set_in_imp_set_in qs_check by auto\n        then have \"s_at spsi = i\"\n          using spsi_bounds check_spsi jc tc check_consistent[OF bfpsi]\n          apply (auto split: enat.splits)\n          apply force\n          by (metis Nat.add_0_right add_diff_inverse_nat atLeastLessThan_iff diff_is_0_eq le0)\n      }\n      moreover\n      {fix qa qs\n        assume bv: \"b = VSince (i-1) qa qs\"\n        then have tc: \"map v_at qs = [v_at qa ..< i]\"\n          using min Inr p'_def i_props\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        then have qs_check: \"\\<forall>p \\<in> set qs. v_check rho psi p\"\n          using bv min Inr p'_def i_props\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        then have jc: \"\\<forall>j \\<in> set (map v_at qs). \\<exists>p. v_at p = j \\<and> v_check rho psi p\"\n          using map_set_in_imp_set_in by auto\n        from bv Inr p'_def have qa_le_i: \"v_at qa \\<le> i\"\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        from bv Inr p'_def have qa_check: \"v_check rho phi qa\"\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        {\n          assume spsi_le: \"s_at spsi < v_at qa\"\n          from a_def Inl q_val\n          have tc_q: \"map s_at sphis = [Suc (s_at spsi) ..< Suc i]\"\n            unfolding valid_def by (auto simp: Let_def)\n          then have qa_in: \"v_at qa \\<in> set (map s_at sphis)\" using spsi_le qa_le_i\n            by (auto split: if_splits)\n          from a_def Inl q_val have phis_check: \"\\<forall>p \\<in> set sphis. s_check rho phi p\"\n            unfolding valid_def by (auto simp: Let_def)\n          then have \"\\<forall>j \\<in> set (map s_at sphis). \\<exists>p. s_at p = j \\<and> s_check rho phi p\"\n            using map_set_in_imp_set_in by auto\n          then have spsi_ge: \"s_at spsi \\<ge> v_at qa\" using qa_in qa_check spsi_le\n              check_consistent[OF bfphi]\n            by auto\n          then have False using spsi_le by auto\n        }\n        then have spsi_ge: \"s_at spsi \\<ge> v_at qa\" using not_le_imp_less by blast\n        from bf have bfpsi: \"bounded_future psi\" by auto\n        then have \"s_at spsi = i\" using tc jc check_spsi check_consistent[OF bfpsi]\n            spsi_bounds spsi_ge\n          by force\n      }\n      ultimately have \"wqo p2 (Inl spsi)\" and s_at_spsi: \"s_at spsi = i\" using formb p2_def valpsi\n        unfolding optimal_def by auto\n      moreover have \"sphis = []\"\n        using q_val s_at_spsi\n        by (auto simp: Inl a_def valid_def Let_def split: list.splits if_splits)\n      ultimately show ?thesis using a_def Inl ap_def aps a2_def SSince[of a2 spsi]\n        by (auto simp: map_idI)\n    qed\n  next\n    case (Inr b)\n    then have qr: \"q = Inr b\" by auto\n    then have VIO: \"VIO rho i (Since phi I psi)\"\n      using q_val check_sound(2)[of rho \"Since phi I psi\" b]\n      unfolding valid_def by auto\n    then have formb: \"(\\<exists>p ps. b = VSince i p ps) \\<or> (\\<exists>ps. b = VSince_never i li ps)\"\n      using Inr q_val i_props unfolding valid_def by (cases b) (auto simp: li)\n    moreover\n    {fix p ps\n      assume bv: \"b = VSince i p ps\"\n      from bv have vp: \"valid rho (v_at p) phi (Inr p)\" using q_val qr\n        unfolding valid_def by (auto simp: Let_def)\n      then have p_bounds: \"ETP rho (case right I of enat n \\<Rightarrow> (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0) \\<le> v_at p \\<and> v_at p \\<le> i\"\n        using bv qr q_val unfolding valid_def by (auto simp: Let_def split: enat.splits)\n      then have \"wqo minp q\"\n      proof (cases p')\n        case (Inl a')\n        then obtain p1' ps' where a's: \"a' = SSince p1' ps'\" using p'_def\n          unfolding optimal_def valid_def\n          by (cases a') auto\n        from a's Inl have ps'c: \"map s_at ps' = [Suc (s_at p1') ..< i]\"\n          using p'_def unfolding optimal_def valid_def\n          apply (auto simp: Let_def)\n          by (metis Suc_pred i_props upt_Suc_append)\n        from a's Inl have ps'_check: \"\\<forall>p \\<in> set ps'. s_check rho phi p\"\n          using p'_def unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        then have jc: \"\\<forall>j \\<in> set (map s_at ps'). \\<exists>p. s_at p = j \\<and> s_check rho phi p\"\n          using map_set_in_imp_set_in by auto\n        from a's Inl have sp1'_le_ltp: \"s_at p1' \\<le> LTP rho (\\<tau> rho i - left I)\"\n          using p'_def i_props mem_imp_le_ltp unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        from a's Inl have sp1'_bounds: \"ETP rho (case right I of enat n \\<Rightarrow> (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0) \\<le> s_at p1'\n        \\<and> s_at p1' < i\" using p'_def i_props mem_imp_ge_etp[of i I \"s_at p1'\"]\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        from a's Inl have sp1': \"s_check rho psi p1'\" using p'_def\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        from jc have \"v_at p \\<notin> set (map s_at ps')\" using vp bfphi check_consistent\n          unfolding valid_def by auto\n        then have \"v_at p \\<le> s_at p1' \\<or> v_at p = i\" using sp1'_bounds ps'c p_bounds\n          by (auto split: enat.splits)\n        moreover\n        {\n          assume p_le_p1': \"v_at p \\<le> s_at p1'\"\n          from bv qr q_val\n          have tc_q: \"map v_at ps = [v_at p ..< Suc (l rho i I)]\"\n            unfolding valid_def by (auto simp: Let_def)\n          then have qa_in: \"s_at p1' \\<in> set (map v_at ps)\"\n            using p_le_p1' sp1'_bounds sp1'_le_ltp\n            by (auto split: if_splits)\n          from bv qr q_val have phis_check: \"\\<forall>p \\<in> set ps. v_check rho psi p\"\n            unfolding valid_def by (auto simp: Let_def)\n          then have \"\\<forall>j \\<in> set (map v_at ps). \\<exists>p. v_at p = j \\<and> v_check rho psi p\"\n            using map_set_in_imp_set_in by auto\n          then have spsi_ge: \"v_at p > s_at p1'\" using qa_in sp1' p_le_p1'\n              check_consistent[OF bfpsi]\n            by auto\n          then have False using p_le_p1' by auto\n        }\n        ultimately have p_eq_i: \"v_at p = i\" by auto\n        from Inl have form_minp: \"minp = Inr (VSince i (projr p1) [projr p2])\n        \\<or> minp = Inr (VSince i (projr p1) [])\"\n          using vmin val_VIO_imp_r[OF bf vmin VIO] minp a's filter_nnil\n          unfolding doSince_def proofApp_def\n          by (cases p1; cases p2; cases \"left I = 0\") (auto simp: min_list_wrt_def split: if_splits)\n        moreover\n        {\n          assume pv: \"minp = Inr (VSince i (projr p1) [projr p2])\"\n          then have l0: \"left I = 0\" using minp Inl a's filter_nnil\n            unfolding doSince_def proofApp_def\n            by (cases p1; cases p2; cases \"left I = 0\") (auto simp: min_list_wrt_def split: if_splits)\n          then obtain pps where pps: \"ps = [pps] \\<and> valid rho i psi (Inr pps)\"\n            using p_eq_i p_bounds qr bv q_val unfolding valid_def\n            by (auto simp add: i_le_ltpi min_def split: if_splits)\n          from pv l0 obtain a1 where a1_def: \"p1 = Inr a1\"\n            using form_minp minp a's Inl filter_nnil\n            unfolding doSince_def proofApp_def\n            by (cases p1; cases p2; cases \"left I = 0\") (auto simp: min_list_wrt_def split: if_splits)\n          obtain a2 where a2_def: \"p2 = Inr a2\"\n            using pps p2_def check_consistent[OF bfpsi]\n            by (auto simp add: optimal_def valid_def split: sum.splits)\n          from vp p_eq_i p1_def have \"wqo p1 (Inr p)\" unfolding optimal_def\n            by auto\n          moreover have lcomp: \"wqo (Inr a2) (Inr pps)\" using p2_def pps\n            unfolding optimal_def by (auto simp: a2_def)\n          ultimately have \"wqo minp q\"\n            using a2_def bv qr pv a1_def VSince[of a1 p] pps\n            by auto\n        }\n        moreover\n        {\n          assume pv: \"minp = Inr (VSince i (projr p1) [])\"\n          then obtain a1 where a1_def: \"p1 = Inr a1\"\n            using vmin val_VIO_imp_r[OF bf vmin VIO] minp a's Inl filter_nnil\n            unfolding doSince_def proofApp_def\n            by (cases p1; cases p2; cases \"left I = 0\") (auto simp: min_list_wrt_def split: if_splits)\n          have wqo_p: \"wqo p1 (Inr p)\" using p1_def p_eq_i vp\n            unfolding optimal_def by auto\n          have \"wqo minp q\"\n          proof (cases \"left I\")\n            case 0\n            then show ?thesis\n              using vmin\n              by (auto simp: pv valid_def Let_def i_ltp_to_tau split: enat.splits if_splits)\n          next\n            case (Suc nat)\n            have ps_Nil: \"ps = []\"\n              using q_val p_eq_i\n              apply (auto simp: Inr bv Suc valid_def Let_def split: enat.splits if_splits)\n              apply (metis add_Suc_right i_le_ltpi_minus i_props leD zero_less_Suc)\n              by (metis add_Suc_right i_le_ltpi_minus i_props leD zero_less_Suc)\n            show ?thesis\n              using VSince_Nil[of a1 p] wqo_p pv bv qr a1_def\n              by (auto simp: map_idI ps_Nil)\n          qed\n        }\n        ultimately show ?thesis by auto\n      next\n        case (Inr b')\n        then have p'b': \"p' = Inr b'\" by auto\n        then have formb': \"(\\<exists>p ps. b' = VSince (i-1)  p ps)\n        \\<or> (\\<exists>ps. b' = VSince_never (i-1) li ps)\"\n          using Inr p'_def i_props i_props_imp_not_le[OF i_props p'_def]\n          unfolding optimal_def valid_def by (cases b') (auto simp: Let_def li_def)\n        moreover\n        {fix vphi' vpsis'\n          assume b'v: \"b' = VSince (i-1) vphi' vpsis'\"\n          then have \"wqo minp q\"\n          proof (cases p1)\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p2\" using b'v Inl minp Inr filter_nnil\n                  val_VIO_imp_r[OF bf vmin VIO]\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using True b'v Inl minp Inr val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def apply (cases p2; auto simp: min_list_wrt_def)\n                by (metis (mono_tags) Inl_Inr_False List.filter.simps(1) List.list.sel(1))\n              then show ?thesis\n                using form_min qr bv Inl p1_def q_val unfolding optimal_def valid_def\n                apply (cases ps rule: rev_cases)\n                apply (auto simp add: Let_def True i_ltp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems for ys y\n                proof -\n                  from vmin form_min p2r have p_val: \"valid rho i (Since phi I psi) (p' \\<oplus> (Inr p2'))\"\n                    by auto\n                  have check_p: \"checkApp p' (Inr p2')\"\n                    using p'_def True\n                    unfolding p2r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VSince)\n                  from prems have y_val: \"valid rho i psi (Inr y)\"\n                    using q_val True i_le_ltpi i_props unfolding valid_def\n                    by (auto simp: Let_def min_def split: if_splits)\n                  have \"v_at p \\<le> i - Suc 0\"\n                    using q_val p'_def p1_def\n                    apply (auto simp: qr bv Inl optimal_def valid_def Let_def)\n                    by (metis MTL.trans_wqo.check_consistent Suc_pred bfphi i_props le_antisym not_less_eq_eq trans_wqo_axioms)\n                  then have val_q': \"valid rho (i - 1) (Since phi (subtract (delta rho i (i - 1)) I) psi) (Inr (VSince (i - 1) p ys))\"\n                    using valid_shift_VSince[of i I phi psi p ps]\n                    using i_props True q_val\n                    by (auto simp: qr bv prems(8))\n                  then have q_val2: \"valid rho i (Since phi I psi) ((Inr (VSince (i-1) p ys)) \\<oplus> (Inr y))\"\n                    using q_val prems i_props by auto\n                  have check_q: \"checkApp (Inr (VSince (i-1) p ys)) (Inr y)\"\n                    using val_q' True\n                    unfolding p2r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VSince)\n                  from p'_def have wqo_p': \"wqo p' (Inr (VSince (i - 1) p ys))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p2: \"wqo p2 (Inr y)\" using i_props p2_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    unfolding prems using p'b' b'v p2_def q_val prems p2r unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' wqo_p2[unfolded p2r] p_val q_val2]\n                    apply auto\n                    by (metis One_nat_def Suc_diff_1 bv i_props prems(8) q_le qr)\n                qed\n                done\n            next\n              case False\n              then have form: \"minp = Inr (VSince i vphi' vpsis')\"\n                using b'v Inl minp Inr filter_nnil unfolding doSince_def\n                by (cases p2) (auto simp: min_list_wrt_def)\n              then show ?thesis using qr bv q_val Inl p1_def i_props\n                unfolding optimal_def valid_def\n                apply (cases ps rule: rev_cases)\n                apply (auto simp add: Let_def False i_ltp_to_tau split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from p1_def Inl have p_ni: \"\\<not> v_at p = s_at a1\"\n                    using check_consistent[OF bfphi] prems(13-15)\n                    unfolding optimal_def valid_def\n                    by auto\n                  then have p_le_predi: \"v_at p \\<le> s_at a1 - 1\"\n                    using p_bounds prems by auto\n                  then have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince (i-1) p ps))\"\n                    using valid_shift_VSince[of i I phi psi p ps]\n                    using i_props q_val False prems(12)\n                    by (auto simp: qr bv prems(8))\n                  then have \"wqo p' (Inr (VSince (i-1) p ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr (Inr (VSince (i - 1) vphi' vpsis'))\"\n                    using p'_val\n                    by (auto simp: p'b' b'v intro!: valid_checkIncr_VSince)\n                  moreover have \"checkIncr (Inr (VSince (s_at a1 - Suc 0) p []))\"\n                    using p_le_predi\n                    by (auto intro!: checkIncr.intros)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince (i-1) p ps)\"]\n                      valid_q_before i_props prems(3,13)\n                    unfolding p'b' b'v\n                    apply (auto simp add: proofIncr_def intro: checkIncr.intros split: enat.splits)\n                    using bv prems(4) qr apply blast+\n                    done\n                qed\n                subgoal premises prems for ys y\n                proof -\n                  {fix i j\n                  }\n                  from p1_def have a1_i: \"s_at a1 = i\" using Inl\n                    unfolding optimal_def valid_def by auto\n                  from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from p1_def have p_ni: \"\\<not> v_at p = s_at a1\"\n                    using check_consistent[OF bfphi] prems\n                    unfolding optimal_def valid_def\n                    by auto\n                  then have p_le_predi: \"v_at p \\<le> s_at a1 - 1\"\n                    using p_bounds prems thm i_le_ltpi_minus\n                    by (auto simp: Let_def)\n                  then have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince (i-1) p ps))\"\n                    using valid_shift_VSince[of i I phi psi p ps]\n                    using prems val_ge_zero[OF p'b' b'v p'_val] False i_props p_le_predi\n                    unfolding valid_def\n                    by (auto simp: Let_def)\n                  then have \"wqo p' (Inr (VSince (i-1) p ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince)\n                  moreover have \"checkIncr (Inr (VSince (i - 1) p ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince (i-1) p ps)\"]\n                      valid_q_before i_props prems(3) form qr\n                    unfolding p'b' b'v a1_i[symmetric]\n                    by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                qed\n                done\n            qed\n          next\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inr (VSince i b1 [projr p2]) \\<or> minp = (p' \\<oplus> p2)\"\n                using Inr p'b' b'v minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using p'b' b'v Inr True minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def\n                by (cases p2; auto simp: min_list_wrt_def split: if_splits)\n              then have res: \"doSince i (left I) p1 p2 p' = [Inr (VSince i b1 [projr p2]), (p' \\<oplus> p2)]\"\n                using True Inr p'b' b'v unfolding doSince_def by auto\n              from True q_val qr bv have ps_not_nil: \"ps \\<noteq> []\"\n                unfolding valid_def\n                apply (auto simp: Let_def split: if_splits)\n                using i_le_ltpi le_trans by blast\n              then obtain y and ys where snoc_q: \"ps = ys @ [y]\"\n                using qr bv\n                by (cases ps rule: rev_cases; auto)\n              then have y_val: \"valid rho i psi (Inr y)\"\n                using q_val qr bv True unfolding valid_def\n                by (auto simp: Let_def min_def i_le_ltpi split: if_splits)\n              then have wqo_p2: \"wqo (Inr p2') (Inr y)\" using p2r p2_def\n                unfolding optimal_def by auto\n              then show ?thesis\n              proof (cases ys)\n                case Nil\n                then have p_eq_i: \"v_at p = i\" using True bv qr q_val i_props\n                  unfolding valid_def\n                  apply (auto simp: Let_def min_def i_le_ltpi split: if_splits)\n                  by (metis List.list.simps(8) List.list.simps(9) append1_eq_conv le_antisym map_append neq0_conv snoc_q upt_eq_Nil_conv)\n                then have p_val: \"valid rho i phi (Inr p)\" using vp\n                  by auto\n                from wqo_p2 have lcomp: \"wqo (Inr p2') (Inr y)\"\n                  by auto\n                moreover have wqo_p1: \"wqo (Inr b1) (Inr p)\"\n                  using Inr p1_def p_val unfolding optimal_def by auto\n                ultimately have \"wqo (Inr (VSince i b1 [p2'])) q\"\n                  using qr bv snoc_q VSince[OF wqo_p1 lcomp] Nil p2r\n                  by auto\n                moreover have \"(Inr (VSince i b1 [p2'])) \\<in> set (doSince i (left I) p1 p2 p')\"\n                  using form minp Inr p2r Inr True b'v p'b'\n                  unfolding doSince_def by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF _ refl_wqo]\n                    since_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Since phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                  unfolding proofApp_def\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              next\n                case (Cons a as)\n                then have p_less_i: \"v_at p \\<le> i - 1\"\n                  using True bv qr q_val i_props snoc_q Cons_eq_upt_conv\n                  unfolding valid_def\n                  by (auto simp: Let_def min_def i_le_ltpi split: if_splits)\n                then have q'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince (i-1) p ys))\"\n                  using q_val snoc_q True qr bv etpi_imp_etp_suci i_props\n                  unfolding valid_def\n                  by (auto simp: Let_def min_def i_ltp_to_tau split: if_splits enat.splits)\n                then have wqo_p': \"wqo p' (Inr (VSince (i-1) p ys))\"\n                  using p'_def unfolding optimal_def by auto\n                have check_q: \"checkApp (Inr (VSince (i-1) p ys)) (Inr y)\"\n                  using q'_val True\n                  by (auto intro!: valid_checkApp_VSince)\n                have check_min: \"checkApp p' (Inr p2')\" using p2r p'b' b'v\n                  using p'_def True\n                  by (auto simp: optimal_def intro!: valid_checkApp_VSince)\n                from res have val_min: \"valid rho i (Since phi I psi) (p' \\<oplus> (Inr p2'))\"\n                  using b'v p'b' p2r\n                    since_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                  by auto\n                from q_val have q_val2: \"valid rho i (Since phi I psi) ((Inr (VSince (i-1) p ys)) \\<oplus> (Inr y))\"\n                  using qr bv snoc_q i_props unfolding proofApp_def by auto\n                then have \"wqo (p' \\<oplus> (Inr p2')) q\"\n                  using qr bv snoc_q p'b' b'v i_props\n                    proofApp_mono[OF check_min check_q wqo_p' wqo_p2 val_min q_val2]\n                  by auto\n                moreover have \"(p' \\<oplus> (Inr p2')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                  using form minp Inr p2r Inr True b'v p'b'\n                  unfolding doSince_def by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF _ refl_wqo]\n                    since_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Since phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                  unfolding proofApp_def\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              qed\n            next\n              case False\n              then have lI: \"left I \\<noteq> 0\" by auto\n              then have form: \"minp = Inr (VSince i b1 [])\n                \\<or> minp = Inr (VSince i vphi' vpsis')\" using Inr p'b' b'v minp\n                val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              from p1_def Inr have b1i: \"v_at b1 = i\"\n                unfolding optimal_def valid_def by auto\n              from False Inr p'b' b'v have\n                res: \"doSince i (left I) p1 p2 p' = [Inr (VSince i b1 []), Inr (VSince i vphi' vpsis')]\"\n                unfolding doSince_def by (cases p2; auto)\n              then show ?thesis\n              proof (cases \"v_at p = i\")\n                case True\n                then have ps_nil: \"ps = []\" using qr bv q_val False\n                  unfolding valid_def\n                  apply (auto simp: Let_def min_def split: if_splits)\n                  using i_le_ltpi_minus by force\n                from True vp have wqo_p1: \"wqo (Inr b1) (Inr p)\" using p1_def Inr\n                  unfolding optimal_def by auto\n                then have \"wqo (Inr (VSince i b1 [])) q\"\n                  using qr bv ps_nil VSince_Nil[OF wqo_p1] by auto\n                moreover have \"(Inr (VSince i b1 [])) \\<in> set (doSince i (left I) p1 p2 p')\"\n                  using Inr b'v p'b' res by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF _ refl_wqo]\n                    since_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Since phi I psi\"] p'b' trans_wqo Inr b'v\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              next\n                case False\n                then have p_le_predi: \"v_at p \\<le> i - 1\" using p_bounds\n                  apply (cases \"right I\")\n                  apply fastforce\n                  by linarith\n                from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                  unfolding optimal_def by auto\n                then show ?thesis using qr bv q_val Inr p1_def i_props\n                  unfolding optimal_def valid_def\n                  apply (cases ps rule: rev_cases)\n                  apply (auto simp add: Let_def False i_ltp_to_tau split: if_splits)[1]\n                  subgoal premises prems\n                  proof -\n                    from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                      unfolding optimal_def by auto\n                    then have p_le_predi: \"v_at p \\<le> i - 1\" using False p_bounds\n                      by auto\n                    then have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince (i-1) p ps))\"\n                      using prems val_ge_zero[OF p'b' b'v p'_val]\n                      unfolding valid_def\n                      apply (auto simp add: le_diff_conv Let_def i_ltp_to_tau split: enat.splits)\n                      using One_nat_def i_to_predi_props prems(11) apply presburger+\n                      done\n                    then have \"wqo p' (Inr (VSince (i-1) p ps))\" using p'_def\n                      unfolding optimal_def by auto\n                    moreover have \"checkIncr p'\"\n                      using p'_def\n                      unfolding p'b' b'v\n                      by (auto simp: optimal_def intro!: valid_checkIncr_VSince)\n                    moreover have \"checkIncr (Inr (VSince (i - 1) p ps))\"\n                      using valid_q_before\n                      by (auto intro!: valid_checkIncr_VSince)\n                    ultimately have wqo_p: \"wqo (Inr (VSince i vphi' vpsis')) q\"\n                      using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince (i-1) p ps)\"]\n                        valid_q_before i_props prems(3) qr bv\n                      unfolding p'b' b'v\n                      by (auto simp add: proofIncr_def)\n                    moreover have comp_in: \"(Inr (VSince i vphi' vpsis')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                      using Inr b'v p'b' res by auto\n                    ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo trans_wqo]\n                        since_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                        pw_total[of i \"Since phi I psi\"] p'b' trans_wqo b'v wqo_p prems res\n                        prems(13)\n                      apply (auto simp add: total_on_def)\n                      by (metis transpD)\n                  qed\n                  subgoal premises prems for ys y\n                  proof -\n                    from False have p_le_predi: \"v_at p \\<le> i - 1\"\n                      using p_bounds\n                      by auto\n                        (*\n                    with prems(2-4, 7-8) False i_props p_bounds have \"map v_at ps = [v_at p ..< Suc (l rho (i-1) (subtract (\\<Delta> rho i) I))]\"\n                    apply (auto simp: Let_def split: enat.splits)\n                         apply (simp add: min_def split: if_splits)\n                      apply (metis add_leD2 add_le_imp_le_diff diff_diff_cancel diff_is_0_eq i_ltp_to_tau lI)\n                         apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                        apply (simp add: min_def split: if_splits)\n                         apply (metis add_leD2 add_le_imp_le_diff diff_diff_cancel diff_is_0_eq i_ltp_to_tau lI)\n                        apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                       apply (metis Nat.minus_nat.diff_0 diff_cancel_middle diff_is_0_eq' i_le_ltpi le_trans nat_le_linear)\n                      apply (simp add: min_def split: if_splits)\n                       apply (metis add_leD2 add_le_imp_le_diff diff_diff_cancel diff_is_0_eq i_ltp_to_tau lI)\n                      apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                     apply (simp add: min_def split: if_splits)\n                      apply (metis add_leD2 add_le_imp_le_diff diff_diff_cancel diff_is_0_eq i_ltp_to_tau lI)\n                     apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                    by (metis Nat.minus_nat.diff_0 diff_cancel_middle diff_is_0_eq' i_le_ltpi le_trans nat_le_linear)\n*)\n                    have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince (i-1) p ps))\"\n                      using valid_shift_VSince[of i I phi psi p ps]\n                      using prems val_ge_zero[OF p'b' b'v p'_val] lI i_props p_le_predi\n                      unfolding valid_def\n                      by (auto simp: Let_def)\n                    then have \"wqo p' (Inr (VSince (i-1) p ps))\" using p'_def\n                      unfolding optimal_def by auto\n                    moreover have \"checkIncr p'\"\n                      using p'_def\n                      unfolding p'b' b'v\n                      by (auto simp: optimal_def intro!: valid_checkIncr_VSince)\n                    moreover have \"checkIncr (Inr (VSince (i - 1) p ps))\"\n                      using valid_q_before\n                      by (auto intro!: valid_checkIncr_VSince)\n                    ultimately have wqo_p: \"wqo (Inr (VSince i vphi' vpsis')) q\"\n                      using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince (i-1) p ps)\"]\n                        valid_q_before i_props qr bv\n                      unfolding p'b' b'v\n                      by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                    moreover have comp_in: \"(Inr (VSince i vphi' vpsis')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                      using Inr b'v p'b' res by auto\n                    ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo trans_wqo]\n                        since_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                        pw_total[of i \"Since phi I psi\"] p'b' trans_wqo b'v wqo_p prems res\n                      apply (auto simp add: total_on_def)\n                      by (metis transpD)\n                  qed\n                  done\n              qed\n            qed\n          qed\n        }\n        moreover\n        {fix li' vpsis'\n          assume b'v: \"b' = VSince_never (i-1) li' vpsis'\"\n          have li'_def: \"li' = li\"\n            using p'_def\n            by (auto simp: Inr b'v optimal_def valid_def li_def)\n          have \"wqo minp q\"\n            using b'v\n          proof (cases p1)\n            case (Inl a1)\n            from p1_def have a1_i: \"s_at a1 = i\" using Inl\n              unfolding optimal_def valid_def by auto\n            show ?thesis\n              using Inl\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p2\" using Inl b'v p'b' minp\n                  val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using True b'v Inl minp Inr val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def\n                apply (cases p2; auto simp: min_list_wrt_def split: if_splits)\n                by (metis Inl_Inr_False)\n              then show ?thesis\n                using form_min qr bv Inl p1_def q_val unfolding optimal_def valid_def\n                apply (cases ps rule: rev_cases)\n                apply (auto simp add: Let_def True i_ltp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems for ys y\n                proof -\n                  from vmin form_min p2r have p_val: \"valid rho i (Since phi I psi) (p' \\<oplus> (Inr p2'))\"\n                    by auto\n                  have check_p: \"checkApp p' (Inr p2')\"\n                    using p'_def True\n                    unfolding p2r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VSince_never)\n                  from prems have y_val: \"valid rho i psi (Inr y)\"\n                    using q_val True i_le_ltpi i_props unfolding valid_def\n                    by (auto simp: Let_def min_def split: if_splits)\n                  have \"v_at p \\<le> s_at a1 - Suc 0\"\n                    using p1_def q_val\n                    apply (auto simp: Inl optimal_def valid_def qr bv Let_def)\n                    by (metis MTL.trans_wqo.check_consistent Suc_pred bfphi i_props le_antisym not_less_eq_eq trans_wqo_axioms)\n                  then have val_q': \"valid rho (i - 1) (Since phi (subtract (delta rho i (i - 1)) I) psi) (Inr (VSince (i - 1) p ys))\"\n                    using valid_shift_VSince[of i I phi psi p ps]\n                    using qr bv Inl p1_def q_val etpi_imp_etp_suci i_props prems\n                    unfolding optimal_def valid_def\n                    by (auto simp add: Let_def True)\n                  then have q_val2: \"valid rho i (Since phi I psi) ((Inr (VSince (i-1) p ys)) \\<oplus> (Inr y))\"\n                    using q_val prems i_props by auto\n                  have check_q: \"checkApp (Inr (VSince (i-1) p ys)) (Inr y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_VSince)\n                  from p'_def have wqo_p': \"wqo p' (Inr (VSince (i - 1) p ys))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p2: \"wqo p2 (Inr y)\" using i_props p2_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    unfolding prems using p'b' b'v p2_def q_val prems p2r unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' wqo_p2[unfolded p2r] p_val q_val2]\n                    apply auto\n                    by (metis One_nat_def Suc_diff_1 bv i_props prems(8) q_le qr)\n                qed\n                done\n            next\n              case False\n              then have form: \"minp = Inr (VSince_never i li' vpsis')\"\n                using minp p'b' b'v Inl filter_nnil unfolding doSince_def\n                by (cases p2) (auto simp: min_list_wrt_def)\n              then show ?thesis using qr bv q_val Inl p1_def i_props\n                unfolding optimal_def valid_def\n                apply (cases ps rule: rev_cases)\n                apply (auto simp add: Let_def False i_ltp_to_tau split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from p1_def Inl have p_ni: \"\\<not> v_at p = s_at a1\"\n                    using check_consistent[OF bfphi] prems\n                    unfolding optimal_def valid_def\n                    by auto\n                  then have p_le_predi: \"v_at p \\<le> s_at a1 - 1\"\n                    using p_bounds prems\n                    by auto\n                  then have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince (i-1) p ps))\"\n                    using valid_shift_VSince[of i I phi psi p ps] i_props q_val False\n                    by (auto simp: qr bv a1_i)\n                  then have \"wqo p' (Inr (VSince (i-1) p ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince_never)\n                  moreover have \"checkIncr (Inr (VSince (i - 1) p ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince (i-1) p ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def intro: checkIncr.intros)\n                qed\n                subgoal premises prems for ys y\n                proof -\n                  thm Inl\n                  from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from p1_def have p_ni: \"\\<not> v_at p = s_at a1\"\n                    using check_consistent[OF bfphi] prems\n                    unfolding optimal_def valid_def\n                    by auto\n                  then have p_le_predi: \"v_at p \\<le> s_at a1 - 1\"\n                    using p_bounds prems\n                    by auto\n                      (*\n                   with a1_i prems(2-4, 8) False i_props p_bounds have \"map v_at ps = [v_at p ..< Suc (l rho (i-1) (subtract (\\<Delta> rho i) I))]\"\n                    apply (auto simp: Let_def split: enat.splits)\n                         apply (simp add: min_def split: if_splits)\n                          apply (metis a1_i diff_is_0_eq i_le_ltpi_minus i_props neq0_conv zero_less_diff)\n                         apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                        apply (simp add: min_def split: if_splits)\n                         apply (metis a1_i diff_is_0_eq i_le_ltpi_minus i_props neq0_conv zero_less_diff)\n                        apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                       apply (metis Nat.minus_nat.diff_0 diff_cancel_middle diff_is_0_eq' i_le_ltpi le_trans nat_le_linear)\n                      apply (simp add: min_def split: if_splits)\n                       apply (metis a1_i diff_is_0_eq i_le_ltpi_minus i_props neq0_conv zero_less_diff)\n                      apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                     apply (simp add: min_def split: if_splits)\n                      apply (metis a1_i diff_is_0_eq i_le_ltpi_minus i_props neq0_conv zero_less_diff)\n                     apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                    by (metis Nat.minus_nat.diff_0 diff_cancel_middle diff_is_0_eq' i_le_ltpi le_trans nat_le_linear)\n*)\n                  then have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince (i-1) p ps))\"\n                    using valid_shift_VSince[of i I phi psi p ps] False q_val i_props\n                    by (auto simp: qr bv a1_i)\n                  then have \"wqo p' (Inr (VSince (i-1) p ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince_never)\n                  moreover have \"checkIncr (Inr (VSince (i - 1) p ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince)\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince_never)\n                  moreover have \"checkIncr (Inr (VSince (i - 1) p ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince (i-1) p ps)\"]\n                      valid_q_before i_props prems form qr\n                    unfolding p'b' b'v a1_i[symmetric]\n                    by (auto simp add: proofIncr_def li'_def intro: checkIncr.intros)\n                qed\n                done\n            qed\n          next\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inr (VSince i b1 [projr p2]) \\<or> minp = p' \\<oplus> p2\"\n                using Inr p'b' b'v minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using p'b' b'v Inr True minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def\n                by (cases p2; auto simp: min_list_wrt_def split: if_splits)\n              then have res: \"doSince i (left I) p1 p2 p' = [Inr (VSince i b1 [projr p2]), (p' \\<oplus> p2)]\"\n                using True Inr p'b' b'v unfolding doSince_def by auto\n              from True q_val qr bv have ps_not_nil: \"ps \\<noteq> []\"\n                unfolding valid_def\n                apply (auto simp: Let_def split: if_splits)\n                using i_le_ltpi le_trans by blast\n              then obtain y and ys where snoc_q: \"ps = ys @ [y]\"\n                using qr bv\n                by (cases ps rule: rev_cases; auto)\n              then have y_val: \"valid rho i psi (Inr y)\"\n                using q_val qr bv True unfolding valid_def\n                by (auto simp: Let_def min_def i_le_ltpi split: if_splits)\n              then have wqo_p2: \"wqo (Inr p2') (Inr y)\" using p2r p2_def\n                unfolding optimal_def by auto\n              then show ?thesis\n              proof (cases ys)\n                case Nil\n                then have p_eq_i: \"v_at p = i\" using True bv qr q_val i_props\n                  unfolding valid_def\n                  apply (auto simp: Let_def min_def i_le_ltpi split: if_splits)\n                  by (metis List.list.simps(8) List.list.simps(9) append1_eq_conv le_antisym map_append neq0_conv snoc_q upt_eq_Nil_conv)\n                then have p_val: \"valid rho i phi (Inr p)\" using vp\n                  by auto\n                from wqo_p2 have lcomp: \"wqo (Inr p2') (Inr y)\"\n                  by auto\n                moreover have wqo_p1: \"wqo (Inr b1) (Inr p)\"\n                  using Inr p1_def p_val unfolding optimal_def by auto\n                ultimately have \"wqo (Inr (VSince i b1 [p2'])) q\"\n                  using qr bv snoc_q VSince[OF wqo_p1 lcomp] Nil p2r\n                  by auto\n                moreover have \"(Inr (VSince i b1 [p2'])) \\<in> set (doSince i (left I) p1 p2 p')\"\n                  using form minp Inr p2r Inr True b'v p'b'\n                  unfolding doSince_def by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                    since_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Since phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                  unfolding proofApp_def\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              next\n                case (Cons a as)\n                then have p_less_i: \"v_at p \\<le> i - 1\"\n                  using True bv qr q_val i_props snoc_q Cons_eq_upt_conv\n                  unfolding valid_def\n                  by (auto simp: Let_def min_def i_le_ltpi split: if_splits)\n                then have q'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince (i-1) p ys))\"\n                  using q_val snoc_q True qr bv etpi_imp_etp_suci i_props\n                  unfolding valid_def\n                  by (auto simp: Let_def min_def i_ltp_to_tau split: if_splits enat.splits)\n                then have wqo_p': \"wqo p' (Inr (VSince (i-1) p ys))\"\n                  using p'_def unfolding optimal_def by auto\n                have check_q: \"checkApp (Inr (VSince (i-1) p ys)) (Inr y)\"\n                  using q'_val True\n                  by (auto intro!: valid_checkApp_VSince)\n                have check_min: \"checkApp p' (Inr p2')\" using p2r p'b' b'v\n                  using p'_def True\n                  unfolding p2r b'v p'b'\n                  by (auto simp: optimal_def intro!: valid_checkApp_VSince_never)\n                from res have val_min: \"valid rho i (Since phi I psi) (p' \\<oplus> (Inr p2'))\"\n                  using b'v p'b' p2r\n                    since_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                  by auto\n                from q_val have q_val2: \"valid rho i (Since phi I psi) ((Inr (VSince (i-1) p ys)) \\<oplus> (Inr y))\"\n                  using qr bv snoc_q i_props unfolding proofApp_def by auto\n                then have \"wqo (p' \\<oplus> (Inr p2')) q\"\n                  using qr bv snoc_q p'b' b'v i_props\n                    proofApp_mono[OF check_min check_q wqo_p' wqo_p2 val_min q_val2]\n                  by auto\n                moreover have \"(p' \\<oplus> (Inr p2')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                  using form minp Inr p2r Inr True b'v p'b'\n                  unfolding doSince_def by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                    since_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Since phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                  unfolding proofApp_def\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              qed\n            next\n              case False\n              then have lI: \"left I \\<noteq> 0\" by auto\n              then have form: \"minp = Inr (VSince i b1 [])\n              \\<or> minp = Inr (VSince_never i li' vpsis')\" using Inr p'b' b'v minp filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              from p1_def Inr have b1i: \"v_at b1 = i\"\n                unfolding optimal_def valid_def by auto\n              from False Inr p'b' b'v have\n                res: \"doSince i (left I) p1 p2 p' = [Inr (VSince i b1 []), Inr (VSince_never i li' vpsis')]\"\n                unfolding doSince_def by (cases p2; auto)\n              then show ?thesis\n              proof (cases \"v_at p = i\")\n                case True\n                then have ps_nil: \"ps = []\" using qr bv q_val False\n                  unfolding valid_def\n                  apply (auto simp: Let_def min_def split: if_splits)\n                  using i_le_ltpi_minus by force\n                from True vp have wqo_p1: \"wqo (Inr b1) (Inr p)\" using p1_def Inr\n                  unfolding optimal_def by auto\n                then have \"wqo (Inr (VSince i b1 [])) q\"\n                  using qr bv ps_nil VSince_Nil[OF wqo_p1] by auto\n                moreover have \"(Inr (VSince i b1 [])) \\<in> set (doSince i (left I) p1 p2 p')\"\n                  using Inr b'v p'b' res by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                    since_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Since phi I psi\"] p'b' trans_wqo Inr b'v\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              next\n                case False\n                then have p_le_predi: \"v_at p \\<le> i - 1\" using p_bounds\n                  by auto\n                from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                  unfolding optimal_def by auto\n                then show ?thesis using qr bv q_val Inr p1_def i_props\n                  unfolding optimal_def valid_def\n                  apply (cases ps rule: rev_cases)\n                  apply (auto simp add: Let_def False i_ltp_to_tau split: if_splits)[1]\n                  subgoal premises prems\n                  proof -\n                    from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                      unfolding optimal_def by auto\n                    then have p_le_predi: \"v_at p \\<le> i - 1\" using False p_bounds\n                      by auto\n                    then have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince (i-1) p ps))\"\n                      using prems val_ge_zero_never[OF p'b' b'v p'_val]\n                      unfolding valid_def\n                      apply (auto simp add: le_diff_conv Let_def i_ltp_to_tau split: enat.splits)\n                      using i_props i_to_predi_props apply blast+\n                      done\n                    then have \"wqo p' (Inr (VSince (i-1) p ps))\" using p'_def\n                      unfolding optimal_def by auto\n                    moreover have \"checkIncr p'\"\n                      using p'_def\n                      unfolding p'b' b'v\n                      by (auto simp: optimal_def intro!: valid_checkIncr_VSince_never)\n                    moreover have \"checkIncr (Inr (VSince (i - 1) p ps))\"\n                      using valid_q_before\n                      by (auto intro!: valid_checkIncr_VSince)\n                    ultimately have wqo_p: \"wqo (Inr (VSince_never i li' vpsis')) q\"\n                      using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince (i-1) p ps)\"]\n                        valid_q_before i_props prems(3) qr bv\n                      unfolding p'b' b'v prems(13)\n                      by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                    moreover have comp_in: \"(Inr (VSince_never i li' vpsis')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                      using Inr b'v p'b' res by auto\n                    ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo trans_wqo]\n                        since_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                        pw_total[of i \"Since phi I psi\"] p'b' trans_wqo b'v wqo_p prems res\n                      apply (auto simp add: total_on_def li)\n                      by (metis transpD)\n                  qed\n                  subgoal premises prems for ys y\n                  proof -\n                    from False have p_le_predi: \"v_at p \\<le> i - 1\"\n                      using p_bounds by auto\n                        (*\n                    with prems(2-4, 8) False i_props p_bounds have \"map v_at ps = [v_at p ..< Suc (l rho (i-1) (subtract (\\<Delta> rho i) I))]\"\n                    apply (auto simp: Let_def split: enat.splits)\n                         apply (simp add: min_def split: if_splits)\n                      apply (metis add_leD2 add_le_imp_le_diff diff_diff_cancel diff_is_0_eq i_ltp_to_tau lI)\n                         apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                        apply (simp add: min_def split: if_splits)\n                         apply (metis add_leD2 add_le_imp_le_diff diff_diff_cancel diff_is_0_eq i_ltp_to_tau lI)\n                        apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                       apply (metis Nat.minus_nat.diff_0 diff_cancel_middle diff_is_0_eq' i_le_ltpi le_trans nat_le_linear)\n                      apply (simp add: min_def split: if_splits)\n                       apply (metis add_leD2 add_le_imp_le_diff diff_diff_cancel diff_is_0_eq i_ltp_to_tau lI)\n                      apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                     apply (simp add: min_def split: if_splits)\n                      apply (metis add_leD2 add_le_imp_le_diff diff_diff_cancel diff_is_0_eq i_ltp_to_tau lI)\n                     apply (smt add.commute Nat.add_0_right Nat.minus_nat.diff_0 One_nat_def diff_cancel_middle diff_is_0_eq' i_le_ltpi_minus i_ltp_to_tau i_props i_to_predi_props nat_le_linear neq0_conv predi_eq_ltp zero_less_diff)\n                    by (metis Nat.minus_nat.diff_0 diff_cancel_middle diff_is_0_eq' i_le_ltpi le_trans nat_le_linear)\n*)\n                    have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince (i-1) p ps))\"\n                      using valid_shift_VSince[of i I phi psi p ps] i_props lI q_val p_le_predi\n                      by (auto simp: qr bv)\n                    then have \"wqo p' (Inr (VSince (i-1) p ps))\" using p'_def\n                      unfolding optimal_def by auto\n                    moreover have \"checkIncr p'\"\n                      using p'_def\n                      unfolding p'b' b'v\n                      by (auto simp: optimal_def intro!: valid_checkIncr_VSince_never)\n                    moreover have \"checkIncr (Inr (VSince (i - 1) p ps))\"\n                      using valid_q_before\n                      by (auto intro!: valid_checkIncr_VSince)\n                    ultimately have wqo_p: \"wqo (Inr (VSince_never i li' vpsis')) q\"\n                      using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince (i-1) p ps)\"]\n                        valid_q_before i_props qr bv\n                      unfolding p'b' b'v\n                      by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                    moreover have comp_in: \"(Inr (VSince_never i li' vpsis')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                      using Inr b'v p'b' res by auto\n                    ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo trans_wqo]\n                        since_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                        pw_total[of i \"Since phi I psi\"] p'b' trans_wqo b'v wqo_p prems res\n                      apply (auto simp add: total_on_def)\n                      by (metis transpD)\n                  qed\n                  done\n              qed\n            qed\n          qed\n        }\n        ultimately show ?thesis by auto\n      qed\n    }\n    moreover\n    {fix li' ps\n      assume bv: \"b = VSince_never i li' ps\"\n      have li'_def: \"li' = li\"\n        using q_val\n        by (auto simp: Inr bv valid_def li)\n      have \"wqo minp q\"\n        using bv\n      proof (cases p')\n        case (Inl a')\n        then obtain p1' ps' where a's: \"a' = SSince p1' ps'\"\n          using p'_def\n          unfolding optimal_def valid_def\n          by (cases a') auto\n        from a's Inl have \"\\<And>n. right I = enat n \\<Longrightarrow> ETP rho (\\<tau> rho i - n) \\<le> s_at p1'\n        \\<and> s_at p1' < i\" using p'_def i_props mem_imp_ge_etp[of i I \"s_at p1'\"]\n          unfolding optimal_def valid_def\n          apply (auto simp: Let_def)\n          by (metis One_nat_def Suc_diff_1 le_imp_less_Suc)\n        then have sp1'_bounds: \"ETP rho (case right I of enat n \\<Rightarrow> (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0) \\<le> s_at p1'\n        \\<and> s_at p1' < i \\<and> s_at p1' \\<le> LTP rho (\\<tau> rho i - left I)\"\n          using a's Inl p'_def i_props mem_imp_le_ltp[of i I \"s_at p1'\"]\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def split: enat.splits)\n        from bv qr have mapt: \"map v_at ps = [ETP rho (case right I of enat n \\<Rightarrow> (\\<tau> rho i - n) | \\<infinity> \\<Rightarrow> 0) ..< Suc (l rho i I)]\"\n          using q_val unfolding valid_def by (auto simp: Let_def split: enat.splits)\n        then have ps_check: \"\\<forall>p \\<in> set ps. v_check rho psi p\"\n          using bv qr q_val unfolding valid_def\n          by (auto simp: Let_def)\n        then have jc: \"\\<forall>j \\<in> set (map v_at ps). \\<exists>p. v_at p = j \\<and> v_check rho psi p\"\n          using map_set_in_imp_set_in[OF ps_check] by auto\n        from sp1'_bounds have p1'_in: \"s_at p1' \\<in> set (map v_at ps)\" using mapt\n          by (auto split: if_splits)\n        from a's Inl have \"s_check rho psi p1'\" using p'_def\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        then have False using jc p1'_in check_consistent[OF bfpsi] by auto\n        then show ?thesis by auto\n      next\n        case (Inr b')\n        then have p'b': \"p' = Inr b'\" by auto\n        then have b'v: \"(\\<exists>p ps. b' = VSince (i-1) p ps)\n        \\<or> (\\<exists>ps. b' = VSince_never (i-1) li ps)\"\n          using Inr p'_def i_props i_props_imp_not_le[OF i_props p'_def]\n          unfolding optimal_def valid_def by (cases b') (auto simp: Let_def li_def)\n        moreover\n        {fix vphi' vpsis'\n          assume b'v: \"b' = VSince (i-1) vphi' vpsis'\"\n          then have \"wqo minp q\"\n          proof (cases p1)\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p2\" using b'v Inl minp Inr\n                  val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using True b'v Inl minp Inr val_VIO_imp_r[OF bf vmin VIO]\n                  filter_nnil\n                unfolding doSince_def\n                apply (cases p2; auto simp: min_list_wrt_def split: if_splits)\n                by (metis Inl_Inr_False)\n              then show ?thesis\n                using form_min qr bv Inl p1_def q_val unfolding optimal_def valid_def\n                apply (cases ps rule: rev_cases)\n                apply (auto simp add: Let_def True i_ltp_to_tau i_etp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems for ys y\n                proof -\n                  from vmin form_min p2r have p_val: \"valid rho i (Since phi I psi) (p' \\<oplus> (Inr p2'))\"\n                    by auto\n                  have check_p: \"checkApp p' (Inr p2')\"\n                    using p'_def True\n                    unfolding p2r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VSince)\n                  from prems have y_val: \"valid rho i psi (Inr y)\"\n                    using q_val True i_le_ltpi i_props unfolding valid_def\n                    by (auto simp: Let_def min_def split: if_splits)\n                  have val_q': \"valid rho (i - 1) (Since phi (subtract (delta rho i (i - 1)) I) psi) (Inr (VSince_never (i - 1) li' ys))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val True prems(8)\n                    by (auto simp: qr bv)\n                  then have q_val2: \"valid rho i (Since phi I psi) ((Inr (VSince_never (i-1) li ys)) \\<oplus> (Inr y))\"\n                    using q_val prems i_props by (auto simp: li)\n                  have check_q: \"checkApp (Inr (VSince_never (i-1) li' ys)) (Inr y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_VSince_never)\n                  from p'_def have wqo_p': \"wqo p' (Inr (VSince_never (i - 1) li' ys))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p2: \"wqo p2 (Inr y)\" using i_props p2_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    unfolding prems using p'b' b'v p2_def q_val prems p2r unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' wqo_p2[unfolded p2r] p_val q_val2[folded li'_def]]\n                    apply (auto simp: li'_def)\n                    by (metis One_nat_def Suc_diff_1 i_props q_le qr)\n                qed\n                done\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                unfolding optimal_def by auto\n              from False have form_min: \"minp = Inr (VSince i vphi' vpsis')\"\n                using b'v Inl minp Inr filter_nnil unfolding doSince_def\n                by (cases p2) (auto simp: min_list_wrt_def)\n              then show ?thesis using qr bv q_val i_props\n                unfolding optimal_def valid_def\n                apply (auto simp add: Let_def False i_etp_to_tau i_ltp_to_tau split: if_splits enat.splits)\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li' ps))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li' ps)\"]\n                      valid_q_before i_props prems(2-3,10)\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def li intro: checkIncr.intros split: enat.splits)\n                qed\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li' ps))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li intro: checkIncr.intros)\n                qed\n                using p1_def False Inl q_val i_props vmin apply (auto simp: Let_def optimal_def valid_def i_ltp_to_tau i_etp_to_tau i_le_ltpi split: if_splits)\n                apply (metis add_leD2 i_etp_to_tau i_ltp_to_tau le_diff_conv2 le_trans)\n                subgoal premises prems for n\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li' ps))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def li intro: checkIncr.intros)\n                qed\n                done\n            qed\n          next\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inr (VSince i b1 [projr p2]) \\<or> minp =  (p' \\<oplus> p2)\"\n                using Inr p'b' b'v minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using p'b' b'v Inr True minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def\n                by (cases p2; auto simp: min_list_wrt_def split: if_splits)\n              then have res: \"doSince i (left I) p1 p2 p' = [Inr (VSince i b1 [projr p2]), (p' \\<oplus> p2)]\"\n                using True Inr p'b' b'v unfolding doSince_def by auto\n              from True q_val qr bv have ps_not_nil: \"ps \\<noteq> []\"\n                unfolding valid_def\n                apply (auto simp: Let_def i_etp_to_tau split: if_splits enat.splits)\n                by (meson diff_le_self i_le_ltpi leD leI less_\\<tau>D less_le_trans)\n              then obtain y and ys where snoc_q: \"ps = ys @ [y]\"\n                using qr bv\n                by (cases ps rule: rev_cases; auto)\n              then have y_val: \"valid rho i psi (Inr y)\"\n                using q_val qr bv True unfolding valid_def\n                by (auto simp: Let_def min_def i_le_ltpi split: if_splits)\n              then have wqo_p2: \"wqo (Inr p2') (Inr y)\" using p2r p2_def\n                unfolding optimal_def by auto\n              then have q'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li ys))\"\n                using q_val snoc_q True qr bv etpi_imp_etp_suci i_props\n                unfolding valid_def\n                by (auto simp: Let_def min_def i_ltp_to_tau li_def split: if_splits enat.splits)\n              then have wqo_p': \"wqo p' (Inr (VSince_never (i-1) li ys))\"\n                using p'_def unfolding optimal_def by auto\n              have check_q: \"checkApp (Inr (VSince_never (i-1) li ys)) (Inr y)\"\n                using q'_val True\n                by (auto intro!: valid_checkApp_VSince_never)\n              have check_min: \"checkApp p' (Inr p2')\" using p2r p'b' b'v\n                using p'_def True\n                unfolding p2r b'v p'b'\n                by (auto simp: optimal_def intro!: valid_checkApp_VSince)\n              from res have val_min: \"valid rho i (Since phi I psi) (p' \\<oplus> (Inr p2'))\"\n                using b'v p'b' p2r\n                  since_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                by auto\n              from q_val have q_val2: \"valid rho i (Since phi I psi) ((Inr (VSince_never (i-1) li ys)) \\<oplus> (Inr y))\"\n                using qr bv snoc_q i_props unfolding proofApp_def by (auto simp: li'_def)\n              then have \"wqo (p' \\<oplus> (Inr p2')) q\"\n                using qr bv snoc_q p'b' b'v i_props\n                  proofApp_mono[OF check_min check_q wqo_p' wqo_p2 val_min q_val2]\n                by (auto simp: li'_def)\n              moreover have \"(p' \\<oplus> (Inr p2')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                using form minp Inr p2r Inr True b'v p'b'\n                unfolding doSince_def by auto\n              ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                  since_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                  pw_total[of i \"Since phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                unfolding proofApp_def\n                apply (auto simp add: total_on_def)\n                by (metis transpD)\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi)p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inr (VSince i b1 [])\n              \\<or> minp = Inr (VSince i vphi' vpsis')\" using Inr p'b' b'v minp\n                val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              then have res: \"doSince i (left I) p1 p2 p' = [Inr (VSince i b1 []), Inr (VSince i vphi' vpsis')]\"\n                using False Inr p'b' b'v unfolding doSince_def by (cases p2; auto)\n              then show ?thesis using qr bv q_val i_props\n                unfolding optimal_def valid_def\n                apply (auto simp add: Let_def False i_ltp_to_tau i_etp_to_tau split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li' ps))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately have \"wqo (Inr (VSince i vphi' vpsis')) q\"\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def intro: checkIncr.intros)\n                  moreover have comp_in: \"(Inr (VSince i vphi' vpsis')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                    using Inr b'v p'b' res by auto\n                  ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                      since_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                      pw_total[of i \"Since phi I psi\"] p'b' trans_wqo b'v prems res\n                    apply (auto simp add: total_on_def)\n                    by (metis transpD)\n                qed\n                using Inr \n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li ps))\"\n                    using prems val_ge_zero[OF p'b' b'v p'_val]\n                    unfolding valid_def\n                    by (auto simp add: le_diff_conv Let_def i_ltp_to_tau i_etp_to_tau split: enat.splits)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately have \"wqo (Inr (VSince i vphi' vpsis')) q\"\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def intro: checkIncr.intros)\n                  moreover have comp_in: \"(Inr (VSince i vphi' vpsis')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                    using Inr b'v p'b' res by auto\n                  ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                      since_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                      pw_total[of i \"Since phi I psi\"] p'b' trans_wqo b'v prems res\n                    apply (auto simp add: total_on_def)\n                    by (metis transpD)\n                qed\n                using p1_def False Inr q_val i_props vmin apply (auto simp: Let_def optimal_def valid_def i_ltp_to_tau i_etp_to_tau i_le_ltpi split: enat.splits)\n                subgoal premises prems for n\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li' ps))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately have \"wqo (Inr (VSince i vphi' vpsis')) q\"\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def intro: checkIncr.intros)\n                  moreover have comp_in: \"(Inr (VSince i vphi' vpsis')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                    using Inr b'v p'b' res by auto\n                  ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                      since_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                      pw_total[of i \"Since phi I psi\"] p'b' trans_wqo b'v prems res\n                    apply (auto simp add: total_on_def)\n                    by (metis transpD)\n                qed\n                done\n            qed\n          qed\n        }\n        moreover\n        {fix li'' vpsis'\n          assume b'v: \"b' = VSince_never (i-1) li'' vpsis'\"\n          have li''_def: \"li'' = li\"\n            using p'_def\n            by (auto simp: Inr b'v optimal_def valid_def li_def)\n          have \"wqo minp q\"\n            using b'v\n          proof (cases p1)\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p2\" using Inl b'v p'b' minp\n                  val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using True b'v Inl minp Inr val_VIO_imp_r[OF bf vmin VIO]\n                  filter_nnil\n                unfolding doSince_def\n                apply (cases p2; auto simp: min_list_wrt_def split: if_splits)\n                by (metis Inl_Inr_False)\n              then show ?thesis\n                using form_min qr bv Inl p1_def q_val unfolding optimal_def valid_def\n                apply (cases ps rule: rev_cases)\n                apply (auto simp add: Let_def True i_ltp_to_tau i_etp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems for ys y\n                proof -\n                  from vmin form_min p2r have p_val: \"valid rho i (Since phi I psi) (p' \\<oplus> (Inr p2'))\"\n                    by auto\n                  have check_p: \"checkApp p' (Inr p2')\"\n                    using p'_def True\n                    unfolding p2r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VSince_never)\n                  from prems have y_val: \"valid rho i psi (Inr y)\"\n                    using q_val True i_le_ltpi i_props unfolding valid_def\n                    by (auto simp: Let_def min_def split: if_splits)\n                  have val_q': \"valid rho (i - 1) (Since phi (subtract (delta rho i (i - 1)) I) psi) (Inr (VSince_never (i - 1) li' ys))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val True prems(8)\n                    by (auto simp: qr bv)\n                  then have q_val2: \"valid rho i (Since phi I psi) ((Inr (VSince_never (i-1) li' ys)) \\<oplus> (Inr y))\"\n                    using q_val prems i_props by (auto simp: li'_def)\n                  have check_q: \"checkApp (Inr (VSince_never (i-1) li' ys)) (Inr y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_VSince_never)\n                  from p'_def have wqo_p': \"wqo p' (Inr (VSince_never (i - 1) li' ys))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p2: \"wqo p2 (Inr y)\" using i_props p2_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    unfolding prems using p'b' b'v p2_def q_val prems p2r unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' wqo_p2[unfolded p2r] p_val q_val2]\n                    apply (auto simp: li''_def li)\n                    by (metis One_nat_def Suc_diff_1 bv i_props q_le qr)\n                qed\n                done\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inr (VSince_never i li vpsis')\"\n                using b'v Inl minp Inr filter_nnil unfolding doSince_def\n                by (cases p2) (auto simp: min_list_wrt_def li''_def split: enat.splits)\n              then show ?thesis using qr bv q_val i_props\n                unfolding optimal_def valid_def\n                apply (auto simp add: Let_def False i_ltp_to_tau i_etp_to_tau split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li' ps))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince_never)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                qed\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li ps))\"\n                    using prems val_ge_zero_never[OF p'b' b'v p'_val] diff_cancel_middle[of \"\\<tau> rho i\" \"left I\" \"\\<tau> rho (i-1)\"]\n                    unfolding valid_def\n                    by (auto simp add: le_diff_conv Let_def i_ltp_to_tau i_etp_to_tau li'_def li''_def split: enat.splits)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince_never)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                qed\n                using p1_def False Inl q_val i_props vmin\n                apply (auto simp: Let_def optimal_def valid_def i_ltp_to_tau i_etp_to_tau i_le_ltpi split: if_splits)\n                using not_wqo vmin apply blast\n                done\n            qed\n          next\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inr (VSince i b1 [projr p2]) \\<or> minp = (p' \\<oplus> p2)\"\n                using Inr p'b' b'v minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using p'b' b'v Inr True minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def\n                by (cases p2; auto simp: min_list_wrt_def split: if_splits)\n              then have res: \"doSince i (left I) p1 p2 p' = [Inr (VSince i b1 [projr p2]), (p' \\<oplus> p2)]\"\n                using True Inr p'b' b'v unfolding doSince_def by auto\n              from True q_val qr bv have ps_not_nil: \"ps \\<noteq> []\"\n                unfolding valid_def\n                apply (auto simp: Let_def i_etp_to_tau split: if_splits enat.splits)\n                by (meson \\<tau>_mono diff_le_self i_le_ltpi order_subst1)\n              then obtain y and ys where snoc_q: \"ps = ys @ [y]\"\n                using qr bv\n                by (cases ps rule: rev_cases; auto)\n              then have y_val: \"valid rho i psi (Inr y)\"\n                using q_val qr bv True unfolding valid_def\n                by (auto simp: Let_def min_def i_le_ltpi split: if_splits)\n              then have wqo_p2: \"wqo (Inr p2') (Inr y)\" using p2r p2_def\n                unfolding optimal_def by auto\n              then have q'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li ys))\"\n                using q_val snoc_q True qr bv etpi_imp_etp_suci i_props\n                unfolding valid_def\n                by (auto simp: Let_def min_def i_ltp_to_tau li'_def li''_def split: if_splits enat.splits)\n              then have wqo_p': \"wqo p' (Inr (VSince_never (i-1) li ys))\"\n                using p'_def unfolding optimal_def by auto\n              have check_q: \"checkApp (Inr (VSince_never (i-1) li ys)) (Inr y)\"\n                using q'_val True\n                by (auto intro!: valid_checkApp_VSince_never)\n              have check_min: \"checkApp p' (Inr p2')\" using p2r p'b' b'v\n                using p'_def True\n                unfolding p2r b'v p'b'\n                by (auto simp: optimal_def intro!: valid_checkApp_VSince_never)\n              from res have val_min: \"valid rho i (Since phi I psi) (p' \\<oplus> (Inr p2'))\"\n                using b'v p'b' p2r\n                  since_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                by auto\n              from q_val have q_val2: \"valid rho i (Since phi I psi) ((Inr (VSince_never (i-1) li ys)) \\<oplus> (Inr y))\"\n                using qr bv snoc_q i_props unfolding proofApp_def by (auto simp: li li'_def)\n              then have \"wqo (p' \\<oplus> (Inr p2')) q\"\n                using qr bv snoc_q p'b' b'v i_props\n                  proofApp_mono[OF check_min check_q wqo_p' wqo_p2 val_min q_val2]\n                by (auto simp: li'_def)\n              moreover have \"(p' \\<oplus> (Inr p2')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                using form minp Inr p2r Inr True b'v p'b'\n                unfolding doSince_def by auto\n              ultimately show ?thesis using minp min_list_wrt_le[OF _ refl_wqo]\n                  since_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                  pw_total[of i \"Since phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                unfolding proofApp_def\n                apply (auto simp add: total_on_def)\n                by (metis transpD)\n            next\n              case False\n              then have lI: \"left I \\<noteq> 0\" by auto\n              then have form: \"minp = Inr (VSince i b1 [])\n                \\<or> minp = Inr (VSince_never i li vpsis')\" using Inr p'b' b'v minp\n                val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doSince_def by (cases p2) (auto simp: min_list_wrt_def li''_def split: enat.splits)\n              from p1_def Inr have b1i: \"v_at b1 = i\"\n                unfolding optimal_def valid_def by auto\n              from p'_def have p'_val: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) p'\"\n                unfolding optimal_def by auto\n              from False Inr p'b' b'v have\n                res: \"doSince i (left I) p1 p2 p' = [Inr (VSince i b1 []), Inr (VSince_never i li vpsis')]\"\n                unfolding doSince_def by (cases p2; auto simp: li''_def)\n              then show ?thesis using qr bv q_val i_props\n                unfolding optimal_def valid_def\n                apply (auto simp add: Let_def False i_ltp_to_tau i_etp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li' ps))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val False prems(8)\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince_never)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately have \"wqo (Inr (VSince_never i li' vpsis')) q\"\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def simp: li'_def li''_def intro: checkIncr.intros)\n                  moreover have comp_in: \"(Inr (VSince_never i li' vpsis')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                    using Inr b'v p'b' res by (auto simp: li'_def)\n                  ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                      since_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                      pw_total[of i \"Since phi I psi\"] p'b' trans_wqo b'v prems res\n                    apply (auto simp add: total_on_def li'_def li''_def)\n                    by (metis transpD)\n                qed\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li' ps))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val False prems(8)\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince_never)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately have \"wqo (Inr (VSince_never i li' vpsis')) q\"\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li_def li''_def intro: checkIncr.intros)\n                  moreover have comp_in: \"(Inr (VSince_never i li' vpsis')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                    using Inr b'v p'b' res by (auto simp: li'_def)\n                  ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                      since_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                      pw_total[of i \"Since phi I psi\"] p'b' trans_wqo b'v prems res\n                    apply (auto simp add: total_on_def)\n                    by (metis transpD)\n                qed\n                using p1_def False Inr q_val i_props vmin apply (auto simp: Let_def optimal_def valid_def i_ltp_to_tau i_etp_to_tau i_le_ltpi split: enat.splits)\n                subgoal premises prems for n\n                proof -\n                  have valid_q_before: \"valid rho (i-1) (Since phi (subtract (\\<Delta> rho i) I) psi) (Inr (VSince_never (i-1) li' ps))\"\n                    using valid_shift_VSince_never[of i I phi psi li' ps] i_props q_val False prems(8)\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VSince_never (i-1) li' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VSince_never)\n                  moreover have \"checkIncr (Inr (VSince_never (i - 1) li' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VSince_never)\n                  ultimately have \"wqo (Inr (VSince_never i li' vpsis')) q\"\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VSince_never (i-1) li' ps)\"]\n                      valid_q_before i_props prems\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def li'_def li''_def intro: checkIncr.intros)\n                  moreover have comp_in: \"(Inr (VSince_never i li' vpsis')) \\<in> set (doSince i (left I) p1 p2 p')\"\n                    using Inr b'v p'b' res by (auto simp: li'_def)\n                  ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                      since_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                      pw_total[of i \"Since phi I psi\"] p'b' trans_wqo b'v prems res\n                    apply (auto simp add: total_on_def)\n                    by (metis transpD)\n                qed\n                done\n            qed\n          qed\n        }\n        ultimately show ?thesis by auto\n      qed\n    }\n    ultimately show ?thesis by auto\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Until\\<close>\n\nlemma valid_checkApp_VUntil: \"valid rho j (Until phi I psi) (Inr (VUntil j vpsis' vphi')) \\<Longrightarrow>\n  left I = 0 \\<or> ETP rho (\\<tau> rho j + left I) \\<le> v_at vphi' \\<Longrightarrow> checkApp (Inr (VUntil j vpsis' vphi')) (Inr p2')\"\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits intro!: checkApp.intros)\n  using i_ge_etpi order_trans apply blast+\n  done\n\nlemma valid_checkApp_VUntil_never: \"valid rho j (Until phi I psi) (Inr (VUntil_never j hi vpsis')) \\<Longrightarrow>\n  left I = 0 \\<or> (case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> ETP rho (\\<tau> rho j + left I) \\<le> LTP rho (\\<tau> rho j + n)) \\<Longrightarrow>\n  checkApp (Inr (VUntil_never j hi vpsis')) (Inr p2')\"\n  apply (intro checkApp.intros)\n  apply (simp add: valid_def Let_def i_etp_to_tau i_le_ltpi_add split: if_splits enat.splits)\n  by force\n\nlemma valid_checkIncr_VUntil: \"valid rho j phi (Inr (VUntil j vpsis' vphi')) \\<Longrightarrow>\n  checkIncr (Inr (VUntil j vpsis' vphi' ))\"\n  apply (cases phi)\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits dest!: arg_cong[where ?x=\"map _ _\" and ?f=set] intro!: checkIncr.intros)\n  apply (drule imageI[where ?A=\"set vpsis'\" and ?f=v_at])\n  apply auto[1]\n  apply (drule imageI[where ?A=\"set vpsis'\" and ?f=v_at])\n  apply auto[1]\n  done\n\nlemma valid_checkIncr_VUntil_never: \"valid rho j phi (Inr (VUntil_never j hi vpsis')) \\<Longrightarrow>\n  checkIncr (Inr (VUntil_never j hi vpsis'))\"\n  apply (cases phi)\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits dest!: arg_cong[where ?x=\"map _ _\" and ?f=set] intro!: checkIncr.intros)\n  apply (drule imageI[where ?A=\"set vpsis'\" and ?f=v_at])\n  apply auto[1]\n  done\n\nlemma untilBase_sound:\n  assumes i_props: \"right I < enat (\\<Delta> rho (i+1))\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\" and\n    p_def: \"p \\<in> set (doUntilBase i (left I) p1 p2)\"\n  shows \"valid rho i (Until phi I psi) p\"\nproof(cases \"left I = 0\")\n  case True\n  then show ?thesis\n  proof (cases p2)\n    case (Inl a)\n    then have \"p = Inl (SUntil [] (projl p2))\" using p_def True\n      unfolding doUntilBase_def\n      by (cases p1) auto\n    then show ?thesis using True i_props p2_def zero_enat_def Inl\n      unfolding optimal_def valid_def by auto\n  next\n    case (Inr b)\n    then have p2v: \"p2 = Inr b\" by auto\n    then show ?thesis\n    proof(cases p1)\n      case (Inl a)\n      then have \"p = Inr (VUntil_never i i [projr p2])\" using p_def True Inr\n        unfolding doUntilBase_def\n        by auto\n      then show ?thesis using True i_props p2_def Inr i_ge_etpi[of rho i]\n          LTP_lt_delta enat_iless\n        unfolding optimal_def valid_def\n        by (auto simp: Let_def split: enat.splits)\n    next\n      case (Inr b1)\n      then have \"p = Inr (VUntil i [projr p2] (projr p1))\n      \\<or> p = Inr (VUntil_never i i [projr p2])\" using p_def True p2v\n        unfolding doUntilBase_def\n        by auto\n      then show ?thesis using assms True Inr\n          p2v i_ge_etpi[of rho i] i_le_ltpi_add[of i rho] LTP_lt_delta enat_iless\n        unfolding optimal_def valid_def\n        by (auto simp: Let_def split: enat.splits)\n    qed\n  qed\nnext\n  case False\n  then show ?thesis\n  proof (cases p1)\n    case (Inl a)\n    then have \"p = Inr (VUntil_never i i [])\" using assms False\n      unfolding doUntilBase_def\n      by (cases p2) auto\n    then show ?thesis using Inl False assms futureBase_constrs LTP_lt_delta enat_iless\n      unfolding valid_def\n      by (auto simp: Let_def i_etp_to_tau split: enat.splits)\n  next\n    case (Inr b)\n    then have \"p = Inr (VUntil i [] (projr p1)) \\<or> p = Inr (VUntil_never i i [])\"\n      using False assms unfolding doUntilBase_def\n      by (cases p2) auto\n    then show ?thesis using Inr False assms i_ge_etpi[of rho i] LTP_lt_delta enat_iless\n      unfolding optimal_def valid_def\n      by (auto simp: Let_def i_etp_to_tau split: enat.splits)\n  qed\nqed\n\nlemma untilBase_optimal:\n  assumes bf: \"bounded_future (Until phi I psi)\" and\n    i_props: \"right I < enat (\\<Delta> rho (i+1))\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\"\n  shows \"optimal i (Until phi I psi) (min_list_wrt wqo (doUntilBase i (left I) p1 p2))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  have bf_psi: \"bounded_future psi\"\n    using bf by auto\n  from doUntilBase_def[of i \"left I\" p1 p2]\n  have nnil: \"doUntilBase i (left I) p1 p2 \\<noteq> []\"\n    by (cases p1; cases p2; cases \"left I\"; auto)\n  from pw_total[of i \"Until phi I psi\"] have total_set: \"total_on wqo (set (doUntilBase i (left I) p1 p2))\"\n    using untilBase_sound[OF i_props p1_def p2_def]\n    by (metis not_wqo total_onI)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doUntilBase i (left I) p1 p2). wqo x y) (doUntilBase i (left I) p1 p2) \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doUntilBase i (left I) p1 p2). wqo x y)\" \"(doUntilBase i (left I) p1 p2)\"]\n    by simp\n  {assume sat: \"SAT rho i (Until phi I psi)\"\n    then have satu: \"sat rho i (Until phi I psi)\" using soundness\n      by blast\n    then have \"sat rho i psi\" using i_props r_less_imp_nphi nat_less_le\n      by auto\n    then have \"left I = 0\" using satu sat_Until_rec[of rho i phi I psi] i_props\n      by auto\n  } note * = this\n  define minp where minp: \"minp \\<equiv> (min_list_wrt wqo (doUntilBase i (left I) p1 p2))\"\n  assume nopt: \"\\<not> optimal i (Until phi I psi) minp\"\n  from untilBase_sound[OF i_props p1_def p2_def min_list_wrt_in[of _ wqo]]\n    refl_wqo trans_wqo pw_total minp nnil\n  have vmin: \"valid rho i (Until phi I psi) minp\"\n    by (auto simp add: total_set)\n  then obtain q where q_val: \"valid rho i (Until phi I psi) q\" and\n    q_le: \"\\<not> wqo minp q\" using nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inl a)\n    then obtain spsi sphis where a_def: \"a = SUntil sphis spsi\" using q_val\n      unfolding valid_def by (cases a) auto\n    from q_val have satu: \"SAT rho i (Until phi I psi)\" using check_sound Inl\n      unfolding valid_def by auto\n    from a_def have p_val: \"valid rho i psi (Inl spsi)\" using q_val Inl i_props\n      using q_val Inl i_props r_less_imp_nphi \n      unfolding valid_def \n      by (auto simp: Let_def diff_add_inverse2 le_eq_less_or_eq)\n    then have p2_le: \"wqo p2 (Inl spsi)\" using p2_def unfolding optimal_def\n      by auto\n    have sphis_Nil: \"sphis = []\"\n      using q_val i_props\n      by (auto simp: Inl a_def valid_def Let_def split: list.splits)\n        (metis (no_types, lifting) Cons_eq_upt_conv Suc_eq_plus1 diff_add_inverse2 r_less_imp_nphi)\n    obtain p2' where p2'_def: \"p2 = Inl p2'\"\n      using p_val p2_def check_consistent[OF bf_psi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inl (SUntil [] (projl p2))) q\"\n      using Inl a_def SUntil_Nil[OF p2_le[unfolded p2'_def]]\n      by (fastforce simp add: p2'_def map_idI sphis_Nil)\n    moreover have \"Inl (SUntil [] (projl p2)) \\<in> set (doUntilBase i (left I) p1 p2)\"\n      using assms check_consistent[of psi] satu * p_val\n      unfolding doUntilBase_def optimal_def valid_def\n      by (auto split: sum.splits)\n    ultimately show ?thesis using min_list_wrt_le[OF _ refl_wqo]\n        untilBase_sound[OF i_props p1_def p2_def] pw_total[of i \"Until phi I psi\"]\n        trans_wqo Inl minp\n      apply (auto simp add: total_on_def)\n      by (metis transpD)\n  next\n    case (Inr b)\n    then show ?thesis\n    proof (cases \"left I\")\n      {fix n j\n        assume j_def: \"right I = enat n \\<and> ETP rho (\\<tau> rho i) \\<le> j\n       \\<and> j \\<le> LTP rho (\\<tau> rho i + n) \\<and> j \\<ge> i\"\n        from \\<tau>_mono have \"\\<tau> rho i + n \\<ge> \\<tau> rho 0\"  by (auto simp add: trans_le_add1)\n        then have jin: \"\\<tau> rho j \\<le> \\<tau> rho i + n\" using j_def i_ltp_to_tau by auto\n        from \\<tau>_mono have j_gei: \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho (i+1)\" by auto\n        from this i_props j_def have \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho i + n\"\n          apply auto\n          by (smt Suc_eq_plus1 diff_is_0_eq' j_gei le_add_diff_inverse le_trans less_imp_le_nat less_nat_zero_code nat_add_left_cancel_le nat_le_linear)\n        then have \"j = i\" using j_def jin apply auto\n          by (metis dual_order.strict_implies_not_eq add_diff_cancel_left' add_diff_cancel_right' i_props j_gei le_antisym le_neq_implies_less less_add_one)\n      } note ** = this\n      case 0\n      {fix vpsi vphi\n        assume bv: \"b = VUntil i [vpsi] vphi\"\n        then have p_val: \"valid rho i phi (Inr vphi) \\<and> valid rho i psi (Inr vpsi)\"\n          using bf q_val Inr \"0\" unfolding valid_def\n          apply (auto simp: Let_def split: if_splits enat.splits)\n          by (metis max.order_iff i_ge_etpi le0 le_antisym upt_eq_Nil_conv)\n        then have wqo_p1: \"wqo p1 (Inr vphi)\" using p1_def unfolding optimal_def\n          by auto\n        obtain p1' where p1'_def: \"p1 = Inr p1'\"\n          using p_val p1_def check_consistent[OF bf_phi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        obtain p2' where p2'_def: \"p2 = Inr p2'\"\n          using p_val p2_def check_consistent[OF bf_psi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        from p_val have wqo_p2: \"wqo p2 (Inr vpsi)\" using p2_def unfolding optimal_def\n          by auto\n        then have lcomp: \"wqo (Inr p2') (Inr vpsi)\"\n          by (auto simp: p2'_def)\n        have \"wqo (Inr (VUntil i [p2'] (p1'))) q\"\n          using wqo_p1 Inr bv VUntil[OF wqo_p1[unfolded p1'_def] lcomp]\n          by (auto simp add: p1'_def p2'_def)\n        moreover have \"Inr (VUntil i [projr p2] (projr p1)) \\<in> set (doUntilBase i (left I) p1 p2)\"\n          using assms check_consistent * p_val \"0\"\n          unfolding doUntilBase_def optimal_def valid_def\n          by (auto split: sum.splits)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            untilBase_sound[OF i_props p1_def p2_def] pw_total[of i \"Until phi I psi\"]\n            trans_wqo Inr minp\n          apply (auto simp add: total_on_def p1'_def p2'_def)\n          by (metis transpD)\n      }\n      moreover\n      {fix vpsi\n        assume bv: \"b = VUntil_never i i [vpsi]\"\n        then have p_val: \"valid rho i psi (Inr vpsi)\" using Inr q_val bf \"0\"\n          unfolding valid_def by (auto simp: Let_def split: enat.splits if_splits)\n        then have wqo_p2: \"wqo p2 (Inr vpsi)\" using p2_def unfolding optimal_def\n          by auto\n        then have lcomp: \"wqo p2 (Inr vpsi)\"\n          by auto\n        obtain p2' where p2'_def: \"p2 = Inr p2'\"\n          using p_val p2_def check_consistent[OF bf_psi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        have \"wqo (Inr (VUntil_never i i [p2'])) q\"\n          using bv Inr VUntil_never lcomp\n          by (auto simp add: p2'_def)\n        moreover have \"Inr (VUntil_never i i [p2']) \\<in> set (doUntilBase i (left I) p1 p2)\"\n          using assms check_consistent * p_val \"0\"\n          unfolding doUntilBase_def optimal_def valid_def\n          by (auto split: sum.splits simp: p2'_def)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            untilBase_sound[OF i_props p1_def p2_def] pw_total[of i \"Until phi I psi\"]\n            trans_wqo Inr minp\n          apply (simp add: total_on_def p2'_def)\n          by (metis transpD)\n      }\n      ultimately show ?thesis using minp Inr \"0\" q_val assms **\n        unfolding doUntilBase_def valid_def\n        apply (cases b)\n                            apply (auto simp: Let_def split: if_splits)\n            apply fastforce\n        using i_ge_etpi le_trans apply blast\n          apply fastforce\n         apply (simp add: i_le_ltpi_add)\n        using i_ge_etpi i_le_ltpi_add le_trans by blast\n    next\n      {fix n j\n        assume j_def: \"right I = enat n \\<and> ETP rho (\\<tau> rho i) \\<le> j\n       \\<and> j \\<le> LTP rho (\\<tau> rho i + n) \\<and> j \\<ge> i\"\n        from \\<tau>_mono have \"\\<tau> rho i + n \\<ge> \\<tau> rho 0\"  by (auto simp add: trans_le_add1)\n        then have jin: \"\\<tau> rho j \\<le> \\<tau> rho i + n\" using j_def i_ltp_to_tau by auto\n        from \\<tau>_mono have j_gei: \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho (i+1)\" by auto\n        from this i_props j_def have \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho i + n\"\n          apply auto\n          by (smt Suc_eq_plus1 diff_is_0_eq' j_gei le_add_diff_inverse le_trans less_imp_le_nat less_nat_zero_code nat_add_left_cancel_le nat_le_linear)\n        then have \"j = i\" using j_def jin apply auto\n          by (metis dual_order.strict_implies_not_eq add_diff_cancel_left' add_diff_cancel_right' i_props j_gei le_antisym le_neq_implies_less less_add_one)\n      } note ** = this\n      case (Suc nat)\n      moreover\n      {fix hi vpsis\n        assume bv: \"b = VUntil_never i hi vpsis\"\n        have vpsis_Nil: \"vpsis = []\"\n          using q_val\n          by (auto simp: Inr bv valid_def Let_def split: enat.splits if_splits)\n            (smt (z3) \"**\" Lattices.linorder_class.max.cobounded2 Suc Suc_n_not_le_n add_Suc_shift i_etp_to_tau le_add1 le_trans max_def)\n        have hi_def: \"hi = i\"\n          using q_val\n          using i_le_ltpi_add\n          apply (auto simp: Inr bv valid_def vpsis_Nil split: if_splits)\n           apply blast\n          by (metis Groups.ab_semigroup_add_class.add.commute LTP_lt_delta diff_add_inverse2 enat_ord_simps(2) i_props plus_1_eq_Suc)\n        have \"wqo (Inr (VUntil_never i hi [])) q\"\n          using not_wqo q_val\n          by (auto simp: Inr bv vpsis_Nil)\n        moreover have \"Inr (VUntil_never i i []) \\<in> set (doUntilBase i (left I) p1 p2)\"\n          using assms check_consistent Suc\n          unfolding doUntilBase_def optimal_def valid_def\n          by (auto split: sum.splits)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            untilBase_sound[OF i_props p1_def p2_def] pw_total[of i \"Until phi I psi\"]\n            trans_wqo Inr minp\n          apply (auto simp add: total_on_def hi_def)\n          by (metis transpD)\n      }\n      moreover\n      {fix vphi vpsis\n        assume bv: \"b = VUntil i vpsis vphi\"\n        then have p_val: \"valid rho i phi (Inr vphi)\"\n          using Inr q_val i_props Suc ** i_ge_etpi unfolding valid_def\n          apply (auto simp: Let_def split: enat.splits if_splits)\n          using le_trans apply blast\n          using le_trans by blast\n        then have p1_wqo: \"wqo p1 (Inr vphi)\" using p1_def unfolding optimal_def\n          by auto\n        have vpsis_Nil: \"vpsis = []\"\n          using q_val i_props\n          by (auto simp: Inr bv valid_def Let_def split: if_splits enat.splits)\n            (metis \"**\" Suc Zero_not_Suc add_diff_cancel_left' diff_is_0_eq' i_etp_to_tau i_ge_etpi le_trans)\n        obtain p1' where p1'_def: \"p1 = Inr p1'\"\n          using p_val p1_def check_consistent[OF bf_phi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        have \"wqo (Inr (VUntil i [] (projr p1))) q\"\n          using Inr bv VUntil_Nil[OF p1_wqo[unfolded p1'_def]]\n          by (fastforce simp add: p1'_def map_idI vpsis_Nil)\n        moreover have \"Inr (VUntil i [] (projr p1)) \\<in> set (doUntilBase i (left I) p1 p2)\"\n          using assms check_consistent Suc p_val\n          unfolding doUntilBase_def optimal_def valid_def\n          by (auto split: sum.splits)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            untilBase_sound[OF i_props p1_def p2_def] pw_total[of i \"Until phi I psi\"]\n            trans_wqo Inr minp\n          apply (auto simp add: total_on_def)\n          by (metis transpD)\n      }\n      ultimately show ?thesis using assms minp q_val Inr Suc\n        unfolding doUntilBase_def valid_def\n        by (cases b) auto\n    qed\n  qed\n  then show False using q_le by auto\nqed\n\nlemma until_sound:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\" and\n    p'_def: \"optimal (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n    and p_def: \"p \\<in> set (doUntil i (left I) p1 p2 p')\"\n    and bf: \"bounded_future (Until phi I psi)\"\n    and bf': \"bounded_future (Until phi (subtract (\\<Delta> rho (i+1)) I) psi)\"\n  shows \"valid rho i (Until phi I psi) p\"\nproof (cases p')\n  case (Inl a)\n  then have p'l: \"p' = Inl a\" by auto\n  then have satp': \"sat rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi)\"\n    using soundness[of _ _ \"Until phi (subtract (\\<Delta> rho (i+1)) I) psi\"] p'_def check_sound(1)[of rho \"Until phi (subtract (\\<Delta> rho (i+1)) I) psi\" a]\n    unfolding optimal_def valid_def by auto\n  then obtain q qs where a_def: \"a = SUntil qs q\" using Inl p'_def\n    unfolding optimal_def valid_def by (cases a) auto\n  then have a_val: \"s_check rho (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) a\"\n    using Inl p'_def unfolding optimal_def valid_def by (auto simp: Let_def)\n  then have mem: \"mem (delta rho (s_at q) (i+1)) (subtract (\\<Delta> rho (i+1)) I)\"\n    using a_def Inl p'_def s_check.simps unfolding optimal_def valid_def\n    by (auto simp: Let_def)\n  then have \"left I - \\<Delta> rho (i+1) \\<le> delta rho (s_at q) (i+1) \" by auto\n  then have tmp: \"left I \\<le> \\<tau> rho (i+1) - \\<tau> rho i + (\\<tau> rho (s_at q) - \\<tau> rho (i+1))\"\n    by auto\n  from a_val have qi: \"i + 1\\<le> s_at q\" using a_def p'l p'_def\n    unfolding optimal_def valid_def\n    by (auto simp: Let_def)\n  then have liq: \"left I \\<le> delta rho (s_at q) i\" using diff_add_assoc tmp\n    by auto\n  from bf obtain n where n_def: \"right I = enat n\" by auto\n  from mem n_def have \"enat (delta rho (s_at q) (i+1))  \\<le> enat n - enat (\\<Delta> rho (i+1))\"\n    by auto\n  then have \"delta rho (s_at q) (i+1) + \\<Delta> rho (i+1) \\<le> n\"\n    apply auto\n    by (metis Suc_eq_plus1 diff_add_inverse2 enat_ord_simps(1) i_props le_diff_conv le_diff_conv2 n_def)\n  then have riq: \"enat (delta rho (s_at q) i) \\<le> right I\" using n_def by auto\n  then show ?thesis\n  proof (cases \"left I = 0\")\n    case True\n    then show ?thesis\n    proof (cases p1)\n      case (Inl a1)\n      then have p1l: \"p1 = Inl a1\" by auto\n      then show ?thesis\n      proof (cases p2)\n        case (Inl a2)\n        then have por: \"p = p' \\<oplus> p1 \\<or> p = Inl (SUntil [] a2)\"\n          using a_def p'l p1l True p_def unfolding doUntil_def by auto\n        moreover\n        {\n          assume pplus: \"p = p' \\<oplus> p1\"\n          then have \"p = Inl (SUntil (a1 # qs) q)\" using a_def p'l p1l\n              p'_def p1_def unfolding proofApp_def by auto\n          then have \"valid rho i (Until phi I psi) p\"\n            using a_def True p'_def p1_def p'l p1l i_props liq riq\n            unfolding optimal_def valid_def\n            by (auto simp: upt_rec Let_def split: list.splits)\n        }\n        ultimately show ?thesis\n          using Inl p1l True assms unfolding optimal_def valid_def\n          by auto\n      next\n        case (Inr b2)\n        then have pplus: \"p = p' \\<oplus> p1\" using p1l p_def True p'l a_def\n          unfolding doUntil_def by auto\n        then have \"p = Inl (SUntil (a1 # qs) q)\" using a_def p'l p1l\n            p'_def p1_def unfolding proofApp_def by auto\n        then show ?thesis\n          using a_def True p'_def p1_def p'l p1l i_props liq riq\n          unfolding optimal_def valid_def\n          by (auto simp: upt_rec Let_def split: list.splits)\n      qed\n    next\n      case (Inr b1)\n      then have p1r: \"p1 = Inr b1\" by auto\n      then show ?thesis\n      proof (cases p2)\n        case (Inl a2)\n        then have \"p = Inl (SUntil [] a2)\" using p_def Inr True p'l a_def\n          unfolding doUntil_def by auto\n        then show ?thesis using p2_def True Inl Inr p'l i_props zero_enat_def\n          unfolding optimal_def valid_def by auto\n      next\n        case (Inr b2)\n        then have \"p = Inr (VUntil i [b2] b1)\" using p1r True p'l p_def a_def\n          unfolding doUntil_def by auto\n        then show ?thesis using i_props p1_def p2_def True p1r Inr bf\n          unfolding optimal_def valid_def\n          apply (auto simp: upt_rec split: enat.splits)\n          using i_le_ltpi_add apply blast\n          using i_ge_etpi less_Suc_eq_le by blast\n      qed\n    qed\n  next\n    case False\n    then show ?thesis\n    proof (cases p1)\n      case (Inl a1)\n      then have pplus: \"p = p' \\<oplus> p1\" using p_def False p'l a_def\n        unfolding doUntil_def by (cases p2) auto\n      then have pl: \"p = Inl (SUntil (a1 # qs) q)\" using a_def p'l Inl\n        unfolding proofApp_def by auto\n      then show ?thesis\n        using False p1_def p'_def Inl i_props liq riq a_def p'l\n        unfolding optimal_def valid_def\n        by (auto simp: Cons_eq_upt_conv Let_def split: list.splits if_splits)\n    next\n      case (Inr b1)\n      then have \"p = Inr (VUntil i [] b1)\" using Inr False p'l p_def a_def\n        unfolding doUntil_def by (cases p2) auto\n      then show ?thesis using p1_def i_props Inr False bf n_def i_le_ltpi_add\n        unfolding optimal_def valid_def\n        by (auto simp add: i_etp_to_tau Let_def False i_ltp_to_tau le_diff_conv2\n            split: enat.splits)\n    qed\n  qed\nnext\n  case (Inr b)\n  then have p'r: \"p' = Inr b\" by auto\n  from bf obtain n where n_def: \"right I = enat n\" by auto\n  then show ?thesis\n  proof (cases b)\n    case (VFF n)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VAtm x11 x12)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNeg x2)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VDisj x31 x32)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VConjL x31)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VConjR x32)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VImpl x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VIff_sv x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VIff_vs x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VOnce x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VOnce_le x8)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VEventually x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VHistorically x131 x132)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VAlways x131 x132)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VSince x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VSince_never x51 x52 x53)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VSince_le x8)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNext x9)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNext_ge x10)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VNext_le x11a)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VPrev x12a)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VPrev_ge x13)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VPrev_le x14)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case VPrev_zero\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VUntil j qs q)\n    then have j_def: \"j = i+1\" using p'r p'_def unfolding optimal_def valid_def\n      by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis\n      proof (cases p2)\n        case (Inl a2)\n        then have \"p = Inl (SUntil [] a2)\" using p_def p'r VUntil True\n          unfolding doUntil_def by (cases p1) auto\n        then show ?thesis using Inl p2_def True i_props zero_enat_def\n          unfolding optimal_def valid_def by auto\n      next\n        case (Inr b2)\n        then have p2r: \"p2 = Inr b2\" by auto\n        {\n          from i_ge_etpi have b2_ge: \"v_at b2 \\<ge> ETP rho (\\<tau> rho (v_at b2))\"\n            using p2r p2_def\n            unfolding optimal_def valid_def by auto\n          then have nl_def: \"v_at q \\<ge> v_at b2 + 1\" using VUntil p'r p'_def p2_def p2r\n            unfolding optimal_def valid_def by (auto simp: Let_def)\n          define l where l_def: \"l \\<equiv> [max (v_at b2+1) (ETP rho (\\<tau> rho (v_at b2+1))) ..< v_at q]\"\n          then have l2_def: \"l = [v_at b2+1..< v_at q ]\" using i_ge_etpi[of rho \"v_at b2 + 1\"]\n            by (auto simp add: max_def)\n          then have b2_cons: \"(max (v_at b2) (ETP rho (\\<tau> rho (v_at b2)))) # l = v_at b2 # l\"\n            by (auto simp add: antisym b2_ge max_def)\n          then have \"v_at b2 # l = [max (v_at b2) (ETP rho (\\<tau> rho (v_at b2))) ..< v_at q]\"\n            using nl_def l_def b2_ge\n            apply (auto simp add: antisym b2_cons upt_eq_Cons_conv i_ge_etpi max_def)\n            apply (metis antisym i_ge_etpi less_eq_Suc_le upt_conv_Cons)\n            apply (metis Suc_le_eq l2_def upt_eq_Cons_conv)\n            using b2_ge upt_conv_Cons by auto\n        } note * = this\n        then show ?thesis\n        proof (cases p1)\n          case (Inl a1)\n          from Inl have \"p = p' \\<oplus> p2\" using p2r VUntil p'r p_def True\n            unfolding doUntil_def by auto\n          then have \"p = Inr (VUntil i (b2 # qs) q)\" using VUntil p'r\n              p2_def p2r i_props unfolding optimal_def valid_def proofApp_def j_def\n            by auto\n          then show ?thesis using p'_def p2_def i_props True Inl p2r VUntil p'r bf'\n              j_def n_def *\n            unfolding optimal_def valid_def\n            apply (auto simp: add.commute Let_def i_ge_etpi)\n            done\n        next\n          case (Inr b1)\n          then have \"p = Inr (VUntil i [b2] b1) \\<or> p = p' \\<oplus> p2\"\n            using p2r p'r VUntil True p_def unfolding doUntil_def by auto\n          moreover\n          {\n            assume pplus: \"p = p' \\<oplus> p2\"\n            then have \"p = Inr (VUntil i (b2 # qs) q)\" using VUntil p'r\n                p2_def p2r i_props unfolding optimal_def valid_def proofApp_def j_def\n              by auto\n            then have \"valid rho i (Until phi I psi) p\" using p'_def p2_def i_props True Inr p2r VUntil p'r bf'\n                j_def n_def *\n              unfolding optimal_def valid_def\n              apply (auto simp: add.commute Let_def i_ge_etpi)\n              done\n          }\n          moreover\n          {\n            assume p: \"p = Inr (VUntil i [b2] b1)\"\n            then have \"valid rho i (Until phi I psi) p\"\n              using p1_def p2_def Inr p2r bf True i_ge_etpi i_props n_def\n              unfolding optimal_def valid_def\n              by (auto simp add: i_le_ltpi_add split: enat.splits)\n          }\n          ultimately show ?thesis by auto\n        qed\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        from Inl have formp: \"p = Inr (VUntil i qs q)\" using VUntil p'r False p_def\n          unfolding doUntil_def by (cases p2) auto\n        from p'_def have v_at_qs: \"map v_at qs = [lu rho (i + 1) (subtract (\\<Delta> rho (i+1)) I) ..< Suc (v_at q)]\"\n          unfolding optimal_def valid_def VUntil p'r\n          by (auto simp: Let_def)\n        have l_subtract: \"lu rho (i + 1) (subtract (\\<Delta> rho (i+1)) I) = lu rho i I\"\n          using False i_props\n          apply (auto simp: max_def)\n          subgoal\n            apply (rule antisym)\n            subgoal apply (subst i_etp_to_tau)\n              apply  (auto simp: gr0_conv_Suc not_le)\n              by (smt add.commute add_0_right diff_is_0_eq' etp_ge i_etp_to_tau le_add_diff_inverse nat_le_linear nat_less_le not_less_eq_eq plus_1_eq_Suc)\n            subgoal\n              apply (auto simp: gr0_conv_Suc)\n              by (metis add.commute diff_is_0_eq' i_etp_to_tau le_add_diff_inverse nat_le_linear)\n            done\n          subgoal\n            using etp_to_delta nat_le_linear by fastforce\n          subgoal\n            by (simp add: i_etp_to_tau not_less_eq_eq)\n          using etp_to_delta nat_le_linear by fastforce\n        from p'_def have vq: \"v_check rho phi q \\<and> (\\<forall>q \\<in> set qs. v_check rho psi q)\"\n          unfolding optimal_def valid_def VUntil p'r\n          by (auto simp: Let_def)\n        from p'_def i_props have \"i \\<le> v_at q\" using VUntil p'r\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        then show ?thesis using False i_props VUntil p'r bf' formp vq n_def\n            v_at_qs[unfolded l_subtract] p'_def\n          unfolding optimal_def valid_def\n          by (auto simp: add.commute Let_def)\n      next\n        case (Inr b1)\n        then have \"p = Inr (VUntil i [] b1) \\<or> p = Inr (VUntil i qs q)\"\n          using False p_def p'r VUntil unfolding doUntil_def\n          by (cases p2) auto\n        moreover\n        {\n          assume formp: \"p = Inr (VUntil i [] b1)\"\n          then have \"valid rho i (Until phi I psi) p\"\n            using False Inr p1_def i_props bf\n            unfolding optimal_def valid_def\n            apply (auto simp add: i_etp_to_tau)\n            using i_le_ltpi_add by blast\n        }\n        moreover\n        {\n          assume formp: \"p = Inr (VUntil i qs q)\"\n          from p'_def have v_at_qs: \"map v_at qs = [lu rho (i+1) (subtract (\\<Delta> rho (i+1)) I)..< Suc (v_at q)]\"\n            unfolding optimal_def valid_def VUntil p'r\n            by (auto simp: Let_def)\n          have l_subtract: \"lu rho (i + 1) (subtract (\\<Delta> rho (i+1)) I) = lu rho i I\"\n            using False i_props\n            apply (auto simp: max_def)\n            subgoal\n              apply (rule antisym)\n              subgoal apply (subst i_etp_to_tau)\n                apply  (auto simp: gr0_conv_Suc not_le)\n                by (smt add.commute add_0_right diff_is_0_eq' etp_ge i_etp_to_tau le_add_diff_inverse nat_le_linear nat_less_le not_less_eq_eq plus_1_eq_Suc)\n              subgoal\n                apply (auto simp: gr0_conv_Suc)\n                by (metis add.commute diff_is_0_eq' i_etp_to_tau le_add_diff_inverse nat_le_linear)\n              done\n            subgoal\n              using etp_to_delta nat_le_linear by fastforce\n            subgoal\n              by (simp add: i_etp_to_tau not_less_eq_eq)\n            using etp_to_delta nat_le_linear by fastforce\n          from p'_def have vq: \"v_check rho phi q \\<and> (\\<forall>q \\<in> set qs. v_check rho psi q)\"\n            unfolding optimal_def valid_def VUntil p'r\n            by (auto simp: Let_def)\n          from p'_def i_props have \"i \\<le> v_at q\" using VUntil p'r\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def)\n          then have \"valid rho i (Until phi I psi) p\" using False i_props VUntil p'r\n              bf' formp vq v_at_qs[unfolded l_subtract] p'_def n_def\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def add.commute)\n        }\n        ultimately show ?thesis by auto\n      qed\n    qed\n  next\n    case (VUntil_never j hi qs)\n    have hi_def: \"hi = LTP rho (n + \\<tau> rho i)\"\n      using p'_def\n      apply (auto simp: Inr VUntil_never optimal_def valid_def n_def)\n      by (smt (z3) Groups.ab_semigroup_add_class.add.commute diff_add_inverse2 enat_ord_simps(1) i_props le_add2 le_add_diff_inverse2 le_diff_conv2 le_trans n_def nat_le_linear plus_1_eq_Suc)\n    have j_def: \"j = i+1\" using p'r p'_def unfolding optimal_def valid_def VUntil_never\n      by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      from bf obtain n where n_def: \"right I = enat n\" by auto\n      then show ?thesis\n      proof (cases p2)\n        case (Inl a2)\n        then have \"p = Inl (SUntil [] a2)\"\n          using p'r VUntil_never True p_def unfolding doUntil_def\n          by (cases p1) auto\n        then show ?thesis using p2_def i_props Inl True zero_enat_def\n          unfolding optimal_def valid_def by auto\n      next\n        case (Inr b2)\n        then have p2r: \"p2 = Inr b2\" by auto\n        {\n          from i_ge_etpi have b2_ge: \"v_at b2 \\<ge> ETP rho (\\<tau> rho (v_at b2))\"\n            using p2r p2_def\n            unfolding optimal_def valid_def by auto\n          then have nl_def: \"LTP rho (\\<tau> rho i + n) \\<ge> v_at b2 + 1\"\n            using n_def VUntil_never p'r p'_def p2_def p2r\n            unfolding optimal_def valid_def apply (auto simp: Let_def)\n            by (metis diff_add_inverse diff_add_inverse2 enat_ord_simps(1) i_etp_to_tau i_le_ltpi_add i_props le_SucI le_add1 le_diff_iff le_imp_diff_is_add plus_1_eq_Suc)\n          define l where l_def: \"l \\<equiv> [max (v_at b2+1) (ETP rho (\\<tau> rho (v_at b2+1))) ..< LTP rho (\\<tau> rho i + n)]\"\n          then have l2_def: \"l = [v_at b2+1..< LTP rho (\\<tau> rho i + n)]\" using i_ge_etpi[of rho \"v_at b2 + 1\"]\n            by (auto simp add: max_def)\n          then have b2_cons: \"(max (v_at b2) (ETP rho (\\<tau> rho (v_at b2)))) # l = v_at b2 # l\"\n            by (auto simp add: antisym b2_ge max_def)\n          then have \"v_at b2 # l = [max (v_at b2) (ETP rho (\\<tau> rho (v_at b2))) ..< LTP rho (\\<tau> rho i + n)]\"\n            using nl_def l_def b2_ge\n            apply (auto simp add: antisym b2_cons upt_eq_Cons_conv i_ge_etpi max_def)\n            apply (metis antisym i_ge_etpi less_eq_Suc_le upt_conv_Cons)\n            apply (metis Suc_le_eq l2_def upt_eq_Cons_conv)\n            using b2_ge upt_conv_Cons by auto\n        } note * = this\n        then show ?thesis\n        proof (cases p1)\n          case (Inl a1)\n          then have \"p = p' \\<oplus> p2\" using p2r p'r VUntil_never True p_def\n            unfolding doUntil_def by auto\n          then have \"p = Inr (VUntil_never i hi (b2 # qs))\"\n            using VUntil_never p'r p2_def p2r i_props\n            unfolding optimal_def valid_def proofApp_def j_def\n            by auto\n          then show ?thesis using * n_def p'_def p2_def p2r p'r VUntil_never\n              True i_props i_ge_etpi i_le_ltpi_add\n            unfolding optimal_def valid_def\n            apply (auto simp: Let_def add.commute split: if_splits)\n            apply (smt Suc_leD i_ge_etpi le_trans)\n            apply (smt Cons_eq_upt_conv Suc_le_mono i_ge_etpi le_SucE le_trans upt_conv_Nil)\n            apply (smt Suc_le_mono i_ge_etpi le_SucE le_antisym le_trans)\n            using max.orderE apply blast\n            using le_trans by blast\n        next\n          case (Inr b1)\n          then have \"p = Inr (VUntil i [b2] b1) \\<or> p = p' \\<oplus> p2\"\n            using p2r True p'r VUntil_never p_def unfolding doUntil_def\n            by auto\n          moreover\n          {\n            assume \"p = p' \\<oplus> p2\"\n            then have \"p = Inr (VUntil_never i hi (b2 # qs))\"\n              using VUntil_never p'r p2_def p2r i_props\n              unfolding optimal_def valid_def proofApp_def j_def\n              by auto\n            then have \"valid rho i (Until phi I psi) p\" using * n_def p'_def p2_def p2r p'r VUntil_never\n                True i_props i_ge_etpi i_le_ltpi_add\n              unfolding optimal_def valid_def\n              apply (auto simp: Let_def add.commute split: if_splits)\n              apply (smt Suc_leD i_ge_etpi le_trans)\n              apply (smt Cons_eq_upt_conv Suc_le_mono i_ge_etpi le_SucE le_trans upt_conv_Nil)\n              apply (smt Suc_le_mono i_ge_etpi le_SucE le_antisym le_trans)\n              using max.orderE apply blast\n              using le_trans by blast\n          }\n          moreover\n          {\n            assume \"p = Inr (VUntil i [b2] b1)\"\n            then have \"valid rho i (Until phi I psi) p\"\n              using Inr p2r p1_def p2_def True i_props n_def\n              unfolding optimal_def valid_def\n              apply (auto simp add: i_etp_to_tau)\n              using i_le_ltpi_add by blast\n          }\n          ultimately show ?thesis by auto\n        qed\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have formp: \"p = Inr (VUntil_never i hi qs)\"\n          using False p_def p'r VUntil_never\n          unfolding doUntil_def by (cases p2) auto\n        from p'_def have v_at_qs: \"map v_at qs = [lu rho (i+1) (subtract (\\<Delta> rho (i+1)) I)..< Suc (LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1))))]\"\n          using VUntil_never p'r n_def unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        have l_subtract: \"lu rho (i + 1) (subtract (\\<Delta> rho (i+1)) I) = lu rho i I\"\n          using False i_props\n          apply (auto simp: max_def)\n          subgoal\n            apply (rule antisym)\n            subgoal apply (subst i_etp_to_tau)\n              apply  (auto simp: gr0_conv_Suc not_le)\n              by (smt add.commute add_0_right diff_is_0_eq' etp_ge i_etp_to_tau le_add_diff_inverse nat_le_linear nat_less_le not_less_eq_eq plus_1_eq_Suc)\n            subgoal\n              apply (auto simp: gr0_conv_Suc)\n              by (metis add.commute diff_is_0_eq' i_etp_to_tau le_add_diff_inverse nat_le_linear)\n            done\n          subgoal\n            using etp_to_delta nat_le_linear by fastforce\n          subgoal\n            by (simp add: i_etp_to_tau not_less_eq_eq)\n          using etp_to_delta nat_le_linear by fastforce\n        from p'_def have vq: \"(\\<forall>q \\<in> set qs. v_check rho psi q)\"\n          unfolding optimal_def valid_def VUntil_never p'r\n          by (auto simp: Let_def split: enat.splits)\n        from p'_def i_props have \"i \\<le> LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1)))\"\n          using VUntil_never p'r n_def i_le_ltpi_add[of i rho n]\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def add.commute)\n        then show ?thesis using False i_props VUntil p'r\n            bf' formp vq v_at_qs[unfolded l_subtract] p'_def n_def\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def add.commute hi_def)\n      next\n        case (Inr b1)\n        then have \"p = Inr (VUntil i [] b1) \\<or> p = Inr (VUntil_never i hi qs)\"\n          using p'r VUntil_never False p_def unfolding doUntil_def\n          by (cases p2) auto\n        moreover\n        {\n          assume formp: \"p = Inr (VUntil_never i hi qs)\"\n          from p'_def have v_at_qs: \"map v_at qs = [lu rho (i+1) (subtract (\\<Delta> rho (i+1)) I)..< Suc (LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1))))]\"\n            using VUntil_never p'r n_def unfolding optimal_def valid_def\n            by (auto simp: Let_def)\n          have l_subtract: \"lu rho (i + 1) (subtract (\\<Delta> rho (i+1)) I) = lu rho i I\"\n            using False i_props\n            apply (auto simp: max_def)\n            subgoal\n              apply (rule antisym)\n              subgoal apply (subst i_etp_to_tau)\n                apply  (auto simp: gr0_conv_Suc not_le)\n                by (smt add.commute add_0_right diff_is_0_eq' etp_ge i_etp_to_tau le_add_diff_inverse nat_le_linear nat_less_le not_less_eq_eq plus_1_eq_Suc)\n              subgoal\n                apply (auto simp: gr0_conv_Suc)\n                by (metis add.commute diff_is_0_eq' i_etp_to_tau le_add_diff_inverse nat_le_linear)\n              done\n            subgoal\n              using etp_to_delta nat_le_linear by fastforce\n            subgoal\n              by (simp add: i_etp_to_tau not_less_eq_eq)\n            using etp_to_delta nat_le_linear by fastforce\n          from p'_def have vq: \"(\\<forall>q \\<in> set qs. v_check rho psi q)\"\n            unfolding optimal_def valid_def VUntil_never p'r\n            by (auto simp: Let_def split: enat.splits)\n          from p'_def i_props have \"i \\<le> LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1)))\"\n            using VUntil_never p'r n_def i_le_ltpi_add[of i rho n]\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def add.commute)\n          then have \"valid rho i (Until phi I psi) p\"\n            using False i_props VUntil p'r bf' formp vq\n              v_at_qs[unfolded l_subtract] p'_def n_def\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def add.commute hi_def)\n        }\n        moreover\n        {\n          assume formp: \"p = Inr (VUntil i [] b1)\"\n          then have \"valid rho i (Until phi I psi) p\"\n            using p1_def i_props Inr n_def False i_le_ltpi_add[of \"v_at b1\" rho n]\n            unfolding optimal_def valid_def\n            by (auto simp add: i_etp_to_tau add.commute)\n        }\n        ultimately show ?thesis by auto\n      qed\n    qed\n  qed\nqed\n\nlemma valid_shift_VUntil:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\"\n    and valid: \"valid rho i (Until phi I psi) (Inr (VUntil i ys p))\"\n    and v_at_p: \"v_at p \\<ge> i + Suc 0\"\n    and rfin: \"right I \\<noteq> \\<infinity>\"\n  shows \"valid rho (i + 1) (Until phi (subtract (delta rho (i + 1) i) I) psi) (Inr (VUntil (i + 1) (if left I = 0 then tl ys else ys) p))\"\nproof -\n  obtain n where rI: \"right I = enat n\"\n    using rfin by (cases \"right I\") auto\n  show ?thesis\n  proof (cases \"left I = 0\")\n    case True\n    obtain z zs where ys_def: \"ys = z # zs\"\n      using valid True\n      apply (cases ys)\n      apply (auto simp: valid_def Let_def split: if_splits enat.splits)\n      apply (meson i_ge_etpi order_trans)+\n      done\n    show ?thesis\n      using i_props v_at_p valid\n      unfolding valid_def\n      apply (auto simp add: Let_def Cons_eq_append_conv Cons_eq_upt_conv add.commute True i_le_ltpi min_def i_ltp_to_tau rI ys_def i_etp_to_tau le_diff_conv split: if_splits)\n      done\n  next\n    case False\n    have rw: \"\\<tau> rho i - (left I + \\<tau> rho i - \\<tau> rho (Suc i)) =\n    (if left I + \\<tau> rho i \\<ge> \\<tau> rho (Suc i) then \\<tau> rho (Suc i) - left I else \\<tau> rho i)\"\n      by auto\n    have e: \"right I = enat n \\<Longrightarrow> right (subtract (delta rho (Suc i) i) I) = enat n' \\<Longrightarrow>\n    ETP rho (\\<tau> rho (Suc i) - n) = ETP rho (\\<tau> rho i - n')\" for n n'\n      by auto (metis Suc_eq_plus1 diff_add_inverse2 diff_cancel_middle enat_ord_simps(1) i_props le_diff_conv)\n    have t: \"\\<tau> rho (Suc i) + (left I + \\<tau> rho i - \\<tau> rho (Suc i)) =\n    (if left I + \\<tau> rho i \\<ge> \\<tau> rho (Suc i) then \\<tau> rho i + left I else \\<tau> rho (Suc i))\"\n      by auto\n    have etp: \"max (Suc i) (ETP rho (left I + \\<tau> rho i)) = max i (ETP rho (left I + \\<tau> rho i))\"\n      using False\n      by (auto simp: max_def)\n        (meson add_le_same_cancel2 i_etp_to_tau leD not_less_eq_eq)\n    have ee: \"\\<not> \\<tau> rho (Suc i) \\<le> left I + \\<tau> rho i \\<Longrightarrow> ETP rho (\\<tau> rho i + left I) = Suc i\"\n      by (metis Groups.ab_semigroup_add_class.add.commute Lattices.linorder_class.max.absorb1 etp i_etp_to_tau max_def n_not_Suc_n nat_le_linear)\n    show ?thesis\n      using False valid e v_at_p i_ge_etpi[of rho \"Suc i\"] ee etp i_props\n      apply (cases ys rule: rev_cases)\n      apply (auto simp: valid_def Let_def rw t rI add.commute split: if_splits)\n      done\n  qed\nqed\n\nlemma valid_shift_VUntil_never:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\"\n    and valid: \"valid rho i (Until phi I psi) (Inr (VUntil_never i hi ys))\"\n    and rfin: \"right I \\<noteq> \\<infinity>\"\n  shows \"valid rho (i + 1) (Until phi (subtract (delta rho (i + 1) i) I) psi) (Inr (VUntil_never (i + 1) hi (if left I = 0 then tl ys else ys)))\"\nproof -\n  obtain n where rI: \"right I = enat n\"\n    using rfin by (cases \"right I\") auto\n  show ?thesis\n  proof (cases \"left I = 0\")\n    case True\n    obtain z zs where ys_def: \"ys = z # zs\"\n      using valid True\n      apply (cases ys)\n      apply (auto simp: valid_def Let_def split: if_splits enat.splits)\n      apply (meson i_le_ltpi_add)\n      by (meson i_ge_etpi i_le_ltpi_add le_trans)\n    show ?thesis\n      using i_props valid\n      unfolding valid_def\n      apply (auto simp add: Let_def Cons_eq_append_conv Cons_eq_upt_conv add.commute True i_le_ltpi min_def i_ltp_to_tau rI ys_def i_etp_to_tau le_diff_conv split: if_splits)\n      done\n  next\n    case False\n    have rw: \"\\<tau> rho i - (left I + \\<tau> rho i - \\<tau> rho (Suc i)) =\n    (if left I + \\<tau> rho i \\<ge> \\<tau> rho (Suc i) then \\<tau> rho (Suc i) - left I else \\<tau> rho i)\"\n      by auto\n    have e: \"right I = enat n \\<Longrightarrow> right (subtract (delta rho (Suc i) i) I) = enat n' \\<Longrightarrow>\n    ETP rho (\\<tau> rho (Suc i) - n) = ETP rho (\\<tau> rho i - n')\" for n n'\n      by auto (metis Suc_eq_plus1 diff_add_inverse2 diff_cancel_middle enat_ord_simps(1) i_props le_diff_conv)\n    have t: \"\\<tau> rho (Suc i) + (left I + \\<tau> rho i - \\<tau> rho (Suc i)) =\n    (if left I + \\<tau> rho i \\<ge> \\<tau> rho (Suc i) then \\<tau> rho i + left I else \\<tau> rho (Suc i))\"\n      by auto\n    have etp: \"max (Suc i) (ETP rho (left I + \\<tau> rho i)) = max i (ETP rho (left I + \\<tau> rho i))\"\n      using False\n      by (auto simp: max_def)\n        (meson add_le_same_cancel2 i_etp_to_tau leD not_less_eq_eq)\n    have ee: \"\\<not> \\<tau> rho (Suc i) \\<le> left I + \\<tau> rho i \\<Longrightarrow> ETP rho (\\<tau> rho i + left I) = Suc i\"\n      by (metis Groups.ab_semigroup_add_class.add.commute Lattices.linorder_class.max.absorb1 etp i_etp_to_tau max_def n_not_Suc_n nat_le_linear)\n    show ?thesis\n      using False valid e i_ge_etpi[of rho \"Suc i\"] ee etp i_props\n      apply (cases ys rule: rev_cases)\n      apply (auto simp: valid_def Let_def rw t rI add.commute split: if_splits)\n      done\n  qed\nqed\n\nlemma until_optimal:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\" and\n    p1_def: \"optimal i phi p1\" and p2_def: \"optimal i psi p2\" and\n    p'_def: \"optimal (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n    and bf: \"bounded_future (Until phi I psi)\"\n    and bf': \"bounded_future (Until phi (subtract (\\<Delta> rho (i+1)) I) psi)\"\n  shows \"optimal i (Until phi I psi) (min_list_wrt wqo (doUntil i (left I) p1 p2 p'))\"\nproof (rule ccontr)\n  define minp where minp: \"minp \\<equiv> min_list_wrt wqo (doUntil i (left I) p1 p2 p')\"\n  from bf have bfpsi: \"bounded_future psi\" by auto\n  from bf have bfphi: \"bounded_future phi\" by auto\n  from bf obtain n where n_def: \"right I = enat n\" by auto\n  from pw_total[of i \"Until phi I psi\"]\n  have total_set: \"total_on wqo (set (doUntil i (left I) p1 p2 p'))\"\n    using until_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n    by (metis not_wqo total_onI)\n  term v_check\n  define hi where \"hi = (case right I - enat (delta rho (i + Suc 0) i) of enat n \\<Rightarrow> LTP rho (\\<tau> rho (Suc i) + n))\"\n  have rfin: \"right I \\<noteq> \\<infinity>\" \"right I - enat (delta rho (i + Suc 0) i) \\<noteq> \\<infinity>\"\n    using bf\n    by auto\n  have hi: \"hi = (case right I of enat n \\<Rightarrow> LTP rho (\\<tau> rho i + n) | \\<infinity> \\<Rightarrow> 0)\"\n    using i_props rfin\n    by (auto simp: hi_def add.commute split: enat.splits)\n  from p'_def have p'_form: \"(\\<exists>p p''. p' = Inl (SUntil p p'')) \\<or> (\\<exists>p p''. p' = Inr (VUntil (i+1) p p''))\n  \\<or> (\\<exists>p. p' = Inr (VUntil_never (i+1) hi p))\"\n  proof(cases \"SAT rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi)\")\n    case True\n    then show ?thesis\n      using val_SAT_imp_l[OF bf', of \"i+1\" p'] p'_def\n        valid_UntilE[of \"i+1\" phi \"subtract (\\<Delta> rho (i+1)) I\" psi p']\n      unfolding optimal_def\n      by auto+\n  next\n    case False\n    then have VIO: \"VIO rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi)\"\n      using SAT_or_VIO\n      by auto\n    then obtain b' where b'_def: \"p' = Inr b'\"\n      using val_VIO_imp_r[OF bf'] p'_def\n      unfolding optimal_def\n      by force\n    then show ?thesis\n      using p'_def\n      unfolding optimal_def valid_def\n      by (cases b') (auto simp: hi_def)\n  qed\n  from doUntil_def[of i \"left I\" p1 p2 p'] p'_form\n  have nnil: \"doUntil i (left I) p1 p2 p' \\<noteq> []\"\n    by (cases p1; cases p2; cases \"left I\"; cases p'; auto)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doUntil i (left I) p1 p2 p'). wqo x y) (doUntil i (left I) p1 p2 p') \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doUntil i (left I) p1 p2 p'). wqo x y)\" \"(doUntil i (left I) p1 p2 p')\"]\n    by simp\n  assume nopt: \"\\<not> optimal i (Until phi I psi) minp\"\n  from until_sound[OF i_props p1_def p2_def p'_def min_list_wrt_in bf bf']\n    total_set trans_wqo refl_wqo nnil minp\n  have vmin: \"valid rho i (Until phi I psi) minp\"\n    by auto\n  then obtain q where q_val: \"valid rho i (Until phi I psi) q\" and\n    q_le: \"\\<not> wqo minp q\" using minp nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inl a)\n    then have q_s: \"q = Inl a\" by auto\n    then have SATs: \"SAT rho i (Until phi I psi)\" using q_val check_sound(1)\n      unfolding valid_def by auto\n    then have sats: \"sat rho i (Until phi I psi)\" using soundness\n      by blast\n    from Inl obtain spsi sphis where a_def: \"a = SUntil sphis spsi\"\n      using q_val unfolding valid_def by (cases a) auto\n    then have valpsi: \"valid rho (s_at spsi) psi (Inl spsi)\" using q_val Inl\n      unfolding valid_def by (auto simp: Let_def)\n    from q_val Inl a_def n_def\n    have spsi_bounds: \"s_at spsi \\<le> LTP rho (\\<tau> rho i + n) \\<and> s_at spsi \\<ge> i\"\n      unfolding valid_def\n      apply (auto simp: Let_def i_le_ltpi_add split: list.splits if_splits)\n      by (metis add.commute i_le_ltpi_add le_Suc_ex le_diff_conv)\n    from valpsi val_SAT_imp_l[OF bf] SATs have check_spsi: \"s_check rho psi spsi\"\n      unfolding valid_def by auto\n    then show ?thesis\n    proof (cases p')\n      case (Inl a')\n      then have p'l: \"p' = Inl a'\" by auto\n      then obtain spsi' sphis' where a'_def: \"a' = SUntil spsi' sphis'\"\n        using p'_def unfolding optimal_def valid_def\n        by (cases a') auto\n      from SATs vmin have minl: \"\\<exists>a. minp = Inl a\" using minp val_SAT_imp_l[OF bf]\n        by auto\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then show ?thesis\n          proof (cases p2)\n            case (Inl a2)\n            then have form: \"doUntil i (left I) p1 p2 p' = [(p' \\<oplus> p1), Inl (SUntil [] a2)]\"\n              using p1l p'l True a'_def unfolding doUntil_def by auto\n            then show ?thesis\n            proof (cases sphis)\n              case Nil\n              then have \"wqo (Inl (SUntil [] a2)) q\"\n                using Inl q_val p2_def SUntil_Nil[of a2 spsi]\n                by (auto simp: optimal_def valid_def q_s a_def)\n              moreover have \"Inl (SUntil [] a2) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                using form by auto\n              ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                  until_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                  pw_total[of i \"Until phi I psi\"] q_val\n                  trans_wqo q_s\n                apply (auto simp add: total_on_def)\n                by (metis transpD)\n            next\n              case (Cons y ys)\n              from p'l p1l a'_def have check_p: \"checkApp p' p1\"\n                by (auto intro: checkApp.intros)\n              from form until_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n              have p_val: \"valid rho i (Until phi I psi) (p' \\<oplus> p1)\"\n                by auto\n              from a_def Cons have y_val: \"valid rho i phi (Inl y)\"\n                using q_s q_val True i_props unfolding valid_def\n                by (auto simp: Let_def split: if_splits)\n              with q_val have q'_val:\n                \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inl (SUntil ys spsi))\"\n                using Cons n_def i_props sval_to_sval'_u[of i phi I psi y ys spsi n]\n                unfolding q_s a_def\n                by (auto simp: Let_def valid_def)\n              then have q_eq: \"q = (Inl (SUntil ys spsi)) \\<oplus> (Inl y)\"\n                using q_s a_def Cons by auto\n              then have q_val2: \"valid rho i (Until phi I psi) ((Inl (SUntil ys spsi)) \\<oplus> (Inl y))\"\n                using q_val by auto\n              then have check_q: \"checkApp (Inl (SUntil ys spsi)) (Inl y)\"\n                using checkApp.intros(2) by auto\n              then have wqo_p': \"wqo p' (Inl (SUntil ys spsi))\" using q'_val p'_def\n                unfolding optimal_def by auto\n              moreover have wqo_p1: \"wqo p1 (Inl y)\" using i_props p1_def y_val\n                unfolding optimal_def by auto\n              ultimately have \"wqo (p' \\<oplus> p1) q\"\n                using Cons q_s a_def\n                  proofApp_mono[OF check_p check_q wqo_p' wqo_p1 p_val q_val2]\n                by auto\n              moreover have \"(p' \\<oplus> p1) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                using form by auto\n              ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                  until_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                  pw_total[of i \"Until phi I psi\"] p'l trans_wqo q_s p1l a'_def\n                unfolding proofApp_def\n                apply (auto simp add: total_on_def)\n                by (metis transpD)\n            qed\n          next\n            case (Inr b2)\n            then have form: \"minp = p' \\<oplus> p1\"\n              using Inr p1l p'l a'_def True minp filter_nnil\n              unfolding doUntil_def by (auto simp: min_list_wrt_def)\n            from p2_def Inr have psi_VIO: \"VIO rho i psi\"\n              using check_consistent[OF bfpsi]\n              unfolding optimal_def valid_def\n              by (auto simp add: check_sound(2))\n            then have spsi_greater: \"s_at spsi > i\"\n              using a_def q_s q_val zero_enat_def unfolding valid_def\n              apply (auto simp: Let_def split: list.splits if_splits)\n              using bfpsi val_VIO_imp_r valpsi nat_less_le by auto\n            then have sphis_not_nil: \"sphis \\<noteq> []\" using a_def q_s q_val\n              unfolding valid_def by auto\n            then obtain y and ys where cons_q: \"sphis = y # ys\"\n              using a_def q_s q_val spsi_greater unfolding valid_def\n              apply (auto simp: Let_def split: if_splits)\n              by (meson neq_Nil_conv)\n            from p'l p1l a'_def have check_p: \"checkApp p' p1\"\n              by (auto intro: checkApp.intros)\n            from form vmin have p_val: \"valid rho i (Until phi I psi) (p' \\<oplus> p1)\"\n              using minp by auto\n            from a_def cons_q have y_val: \"valid rho i phi (Inl y)\"\n              using q_s q_val True i_props unfolding valid_def\n              by (auto simp: Let_def case_snoc split: if_splits)\n            with q_val have q'_val:\n              \"valid rho (i + 1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inl (SUntil ys spsi))\"\n              using y_val cons_q n_def i_props sval_to_sval'_u[of i phi I psi y ys spsi n]\n              unfolding q_s a_def\n              by (auto simp: Let_def valid_def)\n            then have q_eq: \"q = (Inl (SUntil ys spsi)) \\<oplus> (Inl y)\"\n              using q_s a_def cons_q by auto\n            then have q_val2: \"valid rho i (Until phi I psi) ((Inl (SUntil ys spsi)) \\<oplus> (Inl y))\"\n              using q_val by auto\n            then have check_q: \"checkApp (Inl (SUntil ys spsi)) (Inl y)\"\n              using checkApp.intros(2) by auto\n            then have wqo_p': \"wqo p' (Inl (SUntil ys spsi))\" using q'_val p'_def\n              unfolding optimal_def by auto\n            moreover have wqo_p1: \"wqo p1 (Inl y)\" using i_props p1_def y_val\n              unfolding optimal_def by auto\n            ultimately show ?thesis\n              using cons_q q_s a_def form\n                proofApp_mono[OF check_p check_q wqo_p' wqo_p1 p_val q_val2]\n              by auto\n          qed\n        next\n          case False\n          then have form: \"minp = p' \\<oplus> p1\" using p1l p'l a'_def minp filter_nnil\n            unfolding doUntil_def by (cases p2; auto simp: min_list_wrt_def)\n          from False have spsi_less: \"s_at spsi > i\" using q_val a_def q_s\n            unfolding valid_def\n            apply (auto simp: Let_def split: if_splits)\n            using le_zero_eq by fastforce\n          then have sphis_not_nil: \"sphis \\<noteq> []\" using a_def q_s q_val\n            unfolding valid_def by auto\n          then obtain y and ys where cons_q: \"sphis = y # ys\"\n            using a_def q_s q_val spsi_less unfolding valid_def\n            apply (auto simp: Let_def split: if_splits)\n            by (meson neq_Nil_conv)\n          from p'l p1l a'_def have check_p: \"checkApp p' p1\"\n            by (auto intro: checkApp.intros)\n          from form vmin have p_val: \"valid rho i (Until phi I psi) (p' \\<oplus> p1)\"\n            using minp by auto\n          from a_def cons_q have y_val: \"valid rho i phi (Inl y)\"\n            using q_s q_val i_props unfolding valid_def\n            by (auto simp: Let_def split: if_splits)\n          with q_val have q'_val:\n            \"valid rho (i + 1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inl (SUntil ys spsi))\"\n            using y_val cons_q n_def i_props sval_to_sval'_u[of i phi I psi y ys spsi n]\n            unfolding q_s a_def\n            by (auto simp: Let_def valid_def)\n          then have q_eq: \"q = (Inl (SUntil ys spsi)) \\<oplus> (Inl y)\"\n            using q_s a_def cons_q by auto\n          then have q_val2: \"valid rho i (Until phi I psi) ((Inl (SUntil ys spsi)) \\<oplus> (Inl y))\"\n            using q_val by auto\n          then have check_q: \"checkApp (Inl (SUntil ys spsi)) (Inl y)\"\n            using checkApp.intros(2) by auto\n          then have wqo_p': \"wqo p' (Inl (SUntil ys spsi))\" using q'_val p'_def\n            unfolding optimal_def by auto\n          moreover have wqo_p1: \"wqo p1 (Inl y)\" using i_props p1_def y_val\n            unfolding optimal_def by auto\n          ultimately show ?thesis\n            using cons_q q_s a_def form\n              proofApp_mono[OF check_p check_q wqo_p' wqo_p1 p_val q_val2]\n            by auto\n        qed\n      next\n        case (Inr b1)\n        then have phivio: \"VIO rho i phi\" using p1_def check_sound(2)\n          unfolding optimal_def valid_def\n          by auto\n        from Inr have form_min: \"minp = Inl (SUntil [] (projl p2))\"\n          using p'l minp minl a'_def filter_nnil unfolding doUntil_def\n          by (cases p2; cases \"left I = 0\") (auto simp: min_list_wrt_def)\n        then have sphis_nil: \"sphis = []\" using phivio q_val a_def i_props q_s\n          unfolding valid_def\n          apply (auto simp: Let_def split: if_splits list.splits)\n          using bfphi check_sound(1) soundness by blast\n        then have sc: \"s_at spsi = i\" using a_def q_s q_val unfolding valid_def\n          by auto\n        then obtain a2 where a2_def: \"p2 = Inl a2\"\n          using bfpsi check_sound(1) check_spsi optimal_def p2_def val_SAT_imp_l\n          by blast\n        moreover have \"wqo p2 (Inl spsi)\" using valpsi sc p2_def\n          unfolding optimal_def by auto\n        ultimately show ?thesis using form_min q_s a_def sphis_nil a2_def\n            SUntil_Nil[of a2 spsi] by auto\n      qed\n    next\n      case (Inr b)\n      then have formb: \"(\\<exists>q qs. b = VUntil (i+1) qs q) \\<or> (\\<exists>qs. b = VUntil_never (i+1) hi qs)\"\n        using p'_def i_props Inr unfolding optimal_def valid_def\n        by (cases b) (auto simp: hi_def)\n      then have viosp: \"\\<not> sat rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi)\"\n        using p'_def Inr check_sound(2)[of rho \"Until phi (subtract (\\<Delta> rho (i+1)) I) psi\" b]\n          soundness[of _ _ \"Until phi (subtract (delta rho (i + 1) (i + 1 - 1)) I) psi\"]\n        unfolding optimal_def valid_def\n        by (auto simp: Let_def)\n      then have satc: \"mem 0 I \\<and> sat rho i psi\"\n        using i_props sats sat_Until_rec zero_enat_def\n        apply auto\n        apply (metis Suc_eq_plus1 add_implies_diff le_neq_implies_less less_nat_zero_code sat_Until_rec sats viosp)\n        by (meson sat_Until_rec sats viosp)\n      from vmin SATs val_SAT_imp_l obtain ap where ap_def: \"minp = Inl ap\"\n        using minp unfolding valid_def apply auto\n        using bf by blast\n      then have aps: \"ap = SUntil [] (projl p2)\"\n        using minp formb Inr satc filter_nnil\n        unfolding doUntil_def proofApp_def\n        by (cases p1; cases p2) (auto  simp: min_list_wrt_def split: if_splits)\n      then obtain a2 where a2_def: \"p2 = Inl a2\"\n        using ap_def minp satc formb Inr filter_nnil\n        unfolding doUntil_def proofApp_def\n        by (cases p1; cases p2) (auto  simp: min_list_wrt_def split: if_splits)\n      then have max: \"max (Suc i) (ETP rho (\\<tau> rho (i+1) + (left (subtract (\\<Delta> rho (i+1)) I)))) = Suc i\"\n        using satc apply auto\n        by (metis max.orderE i_ge_etpi)\n      {fix hi' qs\n        assume bv: \"b = VUntil_never (i+1) hi' qs\"\n        have hi'_def: \"hi' = hi\"\n          using p'_def\n          by (auto simp: Inr bv optimal_def valid_def hi_def)\n        have tc: \"map v_at qs = [Suc i ..< Suc (LTP rho (\\<tau> rho i + n))]\"\n          using max n_def satc Inr p'_def i_props unfolding optimal_def valid_def\n          by (auto simp: Let_def bv add.commute)\n        then have qs_check: \"\\<forall>p \\<in> set qs. v_check rho psi p\"\n          using bv n_def max satc Inr p'_def i_props\n          unfolding optimal_def valid_def by auto\n        then have jc: \"\\<forall>j \\<in> set (map v_at qs). \\<exists>p. v_at p = j \\<and> v_check rho psi p\"\n          using map_set_in_imp_set_in[of qs psi] qs_check by auto\n        then have \"s_at spsi \\<notin> set (map v_at qs)\" using spsi_bounds\n            check_consistent[OF bfpsi] check_spsi by auto\n        then have \"s_at spsi = i\"\n          using spsi_bounds tc\n          by auto\n      }\n      moreover\n      {fix qa qs\n        assume bv: \"b = VUntil (i+1) qs qa\"\n        then have tc: \"map v_at qs = [Suc i ..< Suc (v_at qa)]\"\n          using max n_def Inr p'_def i_props\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        then have qs_check: \"\\<forall>p \\<in> set qs. v_check rho psi p\"\n          using bv n_def max Inr p'_def i_props\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        then have jc: \"\\<forall>j \\<in> set (map v_at qs). \\<exists>p. v_at p = j \\<and> v_check rho psi p\"\n          using map_set_in_imp_set_in[of qs psi] by auto\n        then have spsi_not_in: \"s_at spsi \\<notin> set (map v_at qs)\" using spsi_bounds\n            check_consistent[OF bfpsi] check_spsi by auto\n        from bv Inr p'_def have qa_ge_i: \"v_at qa \\<ge> i\"\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        from bv Inr p'_def have qa_check: \"v_check rho phi qa\"\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        {\n          assume spsi_ge: \"s_at spsi > v_at qa\"\n          from a_def Inl q_val\n          have tc_q: \"map s_at sphis = [i ..< s_at spsi]\" unfolding valid_def\n            by (auto simp: Let_def)\n          then have qa_in: \"v_at qa \\<in> set (map s_at sphis)\" using spsi_ge qa_ge_i\n            by (auto split: if_splits)\n          from a_def Inl q_val have phis_check: \"\\<forall>p \\<in> set sphis. s_check rho phi p\"\n            unfolding valid_def by (auto simp: Let_def)\n          then have \"\\<forall>j \\<in> set (map s_at sphis). \\<exists>p. s_at p = j \\<and> s_check rho phi p\"\n            using map_set_in_imp_set_in by auto\n          then have spsi_le: \"s_at spsi \\<le> v_at qa\" using qa_in qa_check spsi_ge\n              check_consistent[OF bfphi]\n            by auto\n          then have False using spsi_ge by auto\n        }\n        then have spsi_le: \"s_at spsi \\<le> v_at qa\" using not_le_imp_less by blast\n        then have \"s_at spsi = i\" using spsi_bounds spsi_not_in tc\n          by auto\n      }\n      ultimately have wqo: \"wqo p2 (Inl spsi)\" and s_at_spsi: \"s_at spsi = i\" using formb p2_def valpsi\n        unfolding optimal_def by auto\n      have sphis_Nil: \"sphis = []\"\n        using q_val s_at_spsi\n        by (auto simp: Inl a_def valid_def Let_def split: list.splits)\n      show ?thesis using a_def Inl minp ap_def aps a2_def\n          SUntil_Nil[of a2 spsi] wqo\n        by (auto simp: map_idI sphis_Nil)\n    qed\n  next\n    case (Inr b)\n    then have qr: \"q = Inr b\" by auto\n    then have VIO: \"VIO rho i (Until phi I psi)\"\n      using q_val check_sound(2)[of rho \"Until phi I psi\" b]\n      unfolding valid_def by auto\n    then have formb: \"(\\<exists>p ps. b = VUntil i ps p) \\<or> (\\<exists>ps. b = VUntil_never i hi ps)\"\n      using Inr q_val i_props unfolding valid_def by (cases b) (auto simp: hi_def add.commute)\n    moreover\n    {fix p ps\n      assume bv: \"b = VUntil i ps p\"\n      from bv have vp: \"valid rho (v_at p) phi (Inr p)\" using q_val qr\n        unfolding valid_def by (auto simp: Let_def)\n      then have p_bounds: \"LTP rho (\\<tau> rho i + n) \\<ge> v_at p \\<and> v_at p \\<ge> i\"\n        using n_def bv qr q_val unfolding valid_def by (auto simp: Let_def)\n      then have \"wqo minp q\"\n      proof (cases p')\n        case (Inl a')\n        then obtain p1' ps' where a's: \"a' = SUntil ps' p1'\" using p'_def\n          unfolding optimal_def valid_def\n          by (cases a') auto\n        from a's Inl have ps'c: \"map s_at ps' = [Suc i ..< s_at p1']\"\n          using p'_def unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        from a's Inl have ps'_check: \"\\<forall>p \\<in> set ps'. s_check rho phi p\"\n          using p'_def unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        then have jc: \"\\<forall>j \\<in> set (map s_at ps'). \\<exists>p. s_at p = j \\<and> s_check rho phi p\"\n          using map_set_in_imp_set_in by auto\n        from a's Inl have sp1'_le_ltp: \"s_at p1' \\<ge> ETP rho (\\<tau> rho i + left I)\"\n          using p'_def n_def i_props mem_imp_ge_etp_u[of i I \"s_at p1'\" n]\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        from a's Inl have sp1'_bounds: \"LTP rho (\\<tau> rho i + n) \\<ge> s_at p1'\n        \\<and> s_at p1' > i\" using p'_def i_props n_def\n          mem_imp_le_ltp_u[of i I \"s_at p1'\" n] unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        from a's Inl have sp1': \"s_check rho psi p1'\" using p'_def\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        from jc have \"v_at p \\<notin> set (map s_at ps')\" using vp bfphi check_consistent\n          unfolding valid_def by auto\n        then have \"v_at p \\<ge> s_at p1' \\<or> v_at p = i\" using sp1'_bounds ps'c p_bounds\n          by auto\n        moreover\n        {\n          assume p_ge_p1': \"v_at p \\<ge> s_at p1'\"\n          from bv qr q_val n_def\n          have tc_q: \"map v_at ps = [lu rho i I ..< Suc (v_at p)]\"\n            unfolding valid_def by (auto simp: Let_def)\n          then have qa_in: \"s_at p1' \\<in> set (map v_at ps)\"\n            using p_ge_p1' sp1'_bounds sp1'_le_ltp\n            by (auto split: if_splits)\n          from bv qr q_val have phis_check: \"\\<forall>p \\<in> set ps. v_check rho psi p\"\n            unfolding valid_def by (auto simp: Let_def)\n          then have \"\\<forall>j \\<in> set (map v_at ps). \\<exists>p. v_at p = j \\<and> v_check rho psi p\"\n            using map_set_in_imp_set_in by auto\n          then have spsi_ge: \"v_at p < s_at p1'\" using qa_in sp1' p_ge_p1'\n              check_consistent[OF bfpsi]\n            by auto\n          then have False using p_ge_p1' by auto\n        }\n        ultimately have p_eq_i: \"v_at p = i\" by auto\n        from Inl have form_minp: \"minp = Inr (VUntil i [projr p2] (projr p1) )\n        \\<or> minp = Inr (VUntil i [] (projr p1))\"\n          using vmin val_VIO_imp_r[OF bf vmin VIO] minp n_def a's filter_nnil\n          unfolding doUntil_def proofApp_def\n          by (cases p1; cases p2; cases \"left I = 0\") (auto simp: min_list_wrt_def split: if_splits)\n        moreover\n        {\n          assume pv: \"minp = Inr (VUntil i [projr p2] (projr p1))\"\n          then have l0: \"left I = 0\" using minp Inl a's filter_nnil\n            unfolding doUntil_def proofApp_def\n            by (cases p1; cases p2; cases \"left I = 0\") (auto simp: min_list_wrt_def split: if_splits)\n          then obtain pps where pps: \"ps = [pps] \\<and> valid rho i psi (Inr pps)\"\n            using p_eq_i p_bounds qr bv q_val n_def unfolding valid_def\n            by (auto simp add: i_ge_etpi split: if_splits)\n          from pv l0 obtain a1 where a1_def: \"p1 = Inr a1\"\n            using form_minp minp a's Inl filter_nnil\n            unfolding doUntil_def proofApp_def\n            by (cases p1; cases p2; cases \"left I = 0\") (auto simp: min_list_wrt_def split: if_splits)\n          obtain a2 where a2_def: \"p2 = Inr a2\"\n            using pps p2_def check_consistent[OF bfpsi]\n            by (auto simp add: optimal_def valid_def split: sum.splits)\n          from vp p_eq_i p1_def have \"wqo p1 (Inr p)\" unfolding optimal_def\n            by auto\n          moreover have lcomp: \"wqo (Inr a2) (Inr pps)\" using p2_def pps\n            unfolding optimal_def by (auto simp: a2_def)\n          ultimately have \"wqo minp q\"\n            using a2_def bv qr pv a1_def VUntil[of a1 p] pps\n            by auto\n        }\n        moreover\n        {\n          assume pv: \"minp = Inr (VUntil i [] (projr p1))\"\n          then obtain a1 where a1_def: \"p1 = Inr a1\"\n            using vmin val_VIO_imp_r[OF bf vmin VIO] minp n_def a's Inl filter_nnil\n            unfolding doUntil_def proofApp_def\n            by (cases p1; cases p2; cases \"left I = 0\") (auto simp: min_list_wrt_def split: if_splits)\n          have wqo: \"wqo p1 (Inr p)\" using p1_def p_eq_i vp\n            unfolding optimal_def by auto\n          have \"left I = 0 \\<Longrightarrow> False\"\n            using vmin\n            by (auto simp: pv valid_def Let_def n_def i_etp_to_tau split: if_splits enat.splits)\n          then have ps_Nil: \"ps = []\"\n            using q_val\n            apply (cases \"left I\")\n            apply (auto simp: Inr bv valid_def Let_def n_def split: if_splits enat.splits)\n            apply (metis Suc_n_not_le_n i_etp_to_tau le_add1 le_trans p_eq_i)\n            done\n          have \"wqo minp q\"\n            using VUntil_Nil[of a1 p] pv bv qr a1_def wqo\n            by (auto simp: map_idI ps_Nil)\n        }\n        ultimately show ?thesis by auto\n      next\n        case (Inr b')\n        then have p'b': \"p' = Inr b'\" by auto\n        then have formb': \"(\\<exists>p ps. b' = VUntil (i+1) ps p)\n        \\<or> (\\<exists>ps. b' = VUntil_never (i+1) hi ps)\"\n          using Inr p'_def n_def i_props\n          unfolding optimal_def valid_def by (cases b') (auto simp: Let_def hi add.commute)\n        moreover\n        {fix vphi' vpsis'\n          assume b'v: \"b' = VUntil (i+1) vpsis' vphi'\"\n          then have \"wqo minp q\"\n          proof (cases p1)\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p2\" using b'v Inl minp Inr\n                  val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using True b'v Inl minp Inr val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def\n                apply (cases p2; auto simp: min_list_wrt_def split: if_splits)\n                by (metis Inl_Inr_False)\n              then show ?thesis\n                using form_min qr bv Inl p1_def q_val unfolding optimal_def valid_def\n                apply (cases ps)\n                apply (auto simp add: Let_def True i_etp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems for y ys\n                proof -\n                  from vmin form_min p2r have p_val: \"valid rho i (Until phi I psi) (p' \\<oplus> (Inr p2'))\"\n                    by auto\n                  have check_p: \"checkApp p' (Inr p2')\"\n                    using p'_def True\n                    unfolding p2r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VUntil)\n                  from prems have y_val: \"valid rho i psi (Inr y)\"\n                    using q_val True i_props n_def i_ge_etpi[of rho i] unfolding valid_def\n                    apply (auto simp: Let_def max_def Cons_eq_append_conv split: if_splits)\n                    using Cons_eq_upt_conv by blast\n                  have \"Suc i \\<le> v_at p\"\n                    using q_val p1_def check_consistent[OF bfphi]\n                    by (auto simp: Inl qr bv prems(8) optimal_def valid_def Let_def split: if_splits enat.splits)\n                      (meson le_antisym not_less_eq_eq)+\n                  then have val_q': \"valid rho (i + 1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ys p))\"\n                    using valid_shift_VUntil[of i I phi psi ps p] rfin(1) i_props q_val\n                    by (auto simp: qr bv True prems(8))\n                  then have q_val2: \"valid rho i (Until phi I psi) ((Inr (VUntil (i+1) ys p)) \\<oplus> (Inr y))\"\n                    using q_val prems i_props by auto\n                  have check_q: \"checkApp (Inr (VUntil (i+1) ys p)) (Inr y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_VUntil)\n                  from p'_def have wqo_p': \"wqo p' (Inr (VUntil (i + 1) ys p))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p2: \"wqo p2 (Inr y)\" using i_props p2_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    unfolding prems using p'b' b'v p2_def q_val prems p2r unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' wqo_p2[unfolded p2r] p_val q_val2]\n                    by auto\n                qed\n                done\n            next\n              case False\n              then have form: \"minp = Inr (VUntil i vpsis' vphi')\"\n                using b'v Inl minp Inr filter_nnil unfolding doUntil_def\n                by (cases p2) (auto simp: min_list_wrt_def)\n              then show ?thesis using qr bv q_val Inl p1_def i_props n_def\n                unfolding optimal_def valid_def\n                apply (cases ps)\n                apply (auto simp add: Let_def False i_etp_to_tau split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from p1_def Inl have p_ni: \"\\<not> v_at p = s_at a1\"\n                    using check_consistent[OF bfphi] prems(10-14)\n                    unfolding optimal_def valid_def\n                    by auto\n                  then have p_le_predi: \"v_at p \\<ge> s_at a1 + 1\"\n                    using p_bounds prems by auto\n                  then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ps p))\"\n                    using prems unfolding valid_def\n                    by (auto simp add: le_diff_conv Let_def i_etp_to_tau add.commute)\n                  then have \"wqo p' (Inr (VUntil (i+1) ps p))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil)\n                  moreover have \"checkIncr (Inr (VUntil (i + 1) ps p))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil (i+1) ps p)\"]\n                      valid_q_before i_props prems(4)\n                    unfolding p'b' b'v prems(11)[symmetric]\n                    by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                qed\n                subgoal premises prems for y ys\n                proof -\n                  from p1_def have a1_i: \"s_at a1 = i\" using Inl\n                    unfolding optimal_def valid_def by auto\n                  from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from p'_def p'b' b'v n_def have suc_le_etp: \"Suc i \\<le> ETP rho (\\<tau> rho i + left I)\"\n                    unfolding optimal_def valid_def\n                    apply (auto simp: Let_def split: if_splits)\n                    apply (meson False add_cancel_left_left etp_to_delta le_add2 le_antisym le_diff_conv2 le_refl not_less_eq_eq)\n                    by (metis False diff_add_inverse diff_is_0_eq' i_etp_to_tau not_less_eq_eq)\n                  from p1_def have p_ni: \"\\<not> v_at p = s_at a1\"\n                    using check_consistent[OF bfphi] prems\n                    unfolding optimal_def valid_def\n                    by auto\n                  then have p_le_predi: \"v_at p \\<ge> s_at a1 + 1\"\n                    using p_bounds prems by auto\n                  then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ps p))\"\n                    using valid_shift_VUntil[of i I phi psi ps p] rfin(1) i_props q_val False\n                    by (auto simp: qr bv prems(8) a1_i)\n                  then have \"wqo p' (Inr (VUntil (i+1) ps p))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil)\n                  moreover have \"checkIncr (Inr (VUntil (i + 1) ps p))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil (i+1) ps p)\"]\n                      valid_q_before i_props prems(3) form qr\n                    unfolding p'b' b'v a1_i[symmetric]\n                    by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                qed\n                done\n            qed\n          next\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inr (VUntil i [projr p2] b1) \\<or> minp = (p' \\<oplus> p2)\"\n                using Inr p'b' b'v minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using p'b' b'v Inr True minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def\n                by (cases p2; auto simp: min_list_wrt_def split: if_splits)\n              then have res: \"doUntil i (left I) p1 p2 p' = [Inr (VUntil i [projr p2] b1), (p' \\<oplus> p2)]\"\n                using True Inr p'b' b'v unfolding doUntil_def by auto\n              from True q_val qr bv have ps_not_nil: \"ps \\<noteq> []\"\n                using n_def unfolding valid_def\n                apply (auto simp: Let_def split: if_splits)\n                using i_ge_etpi le_trans by blast\n              then obtain y and ys where cons_q: \"ps = y # ys\"\n                using qr bv\n                by (cases ps; auto)\n              then have y_val: \"valid rho i psi (Inr y)\"\n                using q_val qr bv n_def True i_ge_etpi[of rho i] unfolding valid_def\n                apply (auto simp: Let_def max_def Cons_eq_append_conv split: if_splits)\n                by (metis upt_eq_Cons_conv)\n              then have wqo_p2: \"wqo (Inr p2') (Inr y)\" using p2r p2_def\n                unfolding optimal_def by auto\n              then show ?thesis\n              proof (cases ys)\n                case Nil\n                then have p_eq_i: \"v_at p = i\" using True bv qr q_val n_def\n                    i_props i_ge_etpi[of rho i]\n                  unfolding valid_def\n                  apply (auto simp: Let_def max_def split: if_splits)\n                  by (metis append.left_neutral list.simps(8) list.simps(9) add_cancel_right_right append1_eq_conv cons_q le_add2 le_antisym upt_eq_Nil_conv)\n                then have p_val: \"valid rho i phi (Inr p)\" using vp\n                  by auto\n                from wqo_p2 have lcomp: \"wqo (Inr p2') (Inr y)\"\n                  by auto\n                moreover have wqo_p1: \"wqo (Inr b1) (Inr p)\"\n                  using Inr p1_def p_val unfolding optimal_def by auto\n                ultimately have \"wqo (Inr (VUntil i [p2'] b1)) q\"\n                  using qr bv cons_q VUntil[OF wqo_p1 lcomp] Nil p2r\n                  by auto\n                moreover have \"(Inr (VUntil i [p2'] b1)) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                  using form minp Inr p2r Inr True b'v p'b'\n                  unfolding doUntil_def by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                    until_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                  unfolding proofApp_def\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              next\n                case (Cons a as)\n                then have p_ge_suci: \"v_at p \\<ge> i + 1\"\n                  using True bv qr q_val n_def i_props cons_q i_ge_etpi[of rho i]\n                  unfolding valid_def\n                  apply (auto simp: Let_def max_def split: if_splits)\n                  using not_less_eq_eq by fastforce\n                then have q'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ys p))\"\n                  using q_val cons_q True qr bv n_def i_props\n                  unfolding valid_def\n                  apply (auto simp: Let_def max_def i_etp_to_tau True add.commute Cons_eq_append_conv Cons_eq_upt_conv split: if_splits)\n                  using i_ge_etpi[of rho \"Suc i\"] i_ge_etpi[of rho i]\n                  by auto\n                then have wqo_p': \"wqo p' (Inr (VUntil (i+1) ys p))\"\n                  using p'_def unfolding optimal_def by auto\n                have check_q: \"checkApp (Inr (VUntil (i+1) ys p)) (Inr y)\"\n                  using q'_val True\n                  by (auto intro!: valid_checkApp_VUntil)\n                have check_min: \"checkApp p' (Inr p2')\" using p2r p'b' b'v\n                  using p'_def True\n                  unfolding p2r b'v p'b'\n                  by (auto simp: optimal_def intro!: valid_checkApp_VUntil)\n                from res have val_min: \"valid rho i (Until phi I psi) (p' \\<oplus> (Inr p2'))\"\n                  using b'v p'b' p2r\n                    until_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                  by auto\n                from q_val have q_val2: \"valid rho i (Until phi I psi) ((Inr (VUntil (i+1) ys p)) \\<oplus> (Inr y))\"\n                  using qr bv cons_q i_props unfolding proofApp_def by auto\n                then have \"wqo (p' \\<oplus> (Inr p2')) q\"\n                  using qr bv cons_q p'b' b'v i_props\n                    proofApp_mono[OF check_min check_q wqo_p' wqo_p2 val_min q_val2]\n                  by auto\n                moreover have \"(p' \\<oplus> (Inr p2')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                  using form minp Inr p2r Inr True b'v p'b'\n                  unfolding doUntil_def by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                    until_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                  unfolding proofApp_def\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              qed\n            next\n              case False\n              then have lI: \"left I \\<noteq> 0\" by auto\n              then have form: \"minp = Inr (VUntil i [] b1)\n                \\<or> minp = Inr (VUntil i vpsis' vphi')\" using Inr p'b' b'v minp\n                val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              from p1_def Inr have b1i: \"v_at b1 = i\"\n                unfolding optimal_def valid_def by auto\n              from False Inr p'b' b'v have\n                res: \"doUntil i (left I) p1 p2 p' = [Inr (VUntil i [] b1), Inr (VUntil i vpsis' vphi')]\"\n                unfolding doUntil_def by (cases p2; auto)\n              then show ?thesis\n              proof (cases \"v_at p = i\")\n                case True\n                then have ps_nil: \"ps = []\" using qr bv q_val n_def False\n                  unfolding valid_def\n                  apply (auto simp: Let_def max_def split: if_splits)\n                  apply (metis add_le_same_cancel1 i_etp_to_tau lI le0 le_antisym le_refl)\n                  by (meson add_le_same_cancel1 i_etp_to_tau lI le_0_eq nat_le_linear)\n                from True vp have wqo_p1: \"wqo (Inr b1) (Inr p)\" using p1_def Inr\n                  unfolding optimal_def by auto\n                then have \"wqo (Inr (VUntil i [] b1)) q\"\n                  using qr bv ps_nil VUntil_Nil[OF wqo_p1] by auto\n                moreover have \"(Inr (VUntil i [] b1)) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                  using Inr b'v p'b' res by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                    until_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              next\n                case False\n                then have p_le_predi: \"v_at p \\<ge> i + 1\" using p_bounds by auto\n                from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                  unfolding optimal_def by auto\n                then show ?thesis using qr bv q_val Inr p1_def i_props n_def\n                  unfolding optimal_def valid_def\n                  apply (cases ps)\n                  apply (auto simp add: Let_def False i_etp_to_tau split: if_splits)[1]\n                  subgoal premises prems\n                  proof -\n                    from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                      unfolding optimal_def by auto\n                    then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ps p))\"\n                      using prems unfolding valid_def\n                      apply (auto simp add: le_diff_conv Let_def i_etp_to_tau add.commute)\n                      using p_le_predi apply linarith\n                      using False by linarith\n                    then have \"wqo p' (Inr (VUntil (i+1) ps p))\" using p'_def\n                      unfolding optimal_def by auto\n                    moreover have \"checkIncr p'\"\n                      using p'_def\n                      unfolding p'b' b'v\n                      by (auto simp: optimal_def intro!: valid_checkIncr_VUntil)\n                    moreover have \"checkIncr (Inr (VUntil (i + 1) ps p))\"\n                      using valid_q_before\n                      by (auto intro!: valid_checkIncr_VUntil)\n                    ultimately have \"wqo (Inr (VUntil i vpsis' vphi')) q\"\n                      using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil (i+1) ps p)\"]\n                        valid_q_before i_props prems(4) qr bv\n                      unfolding p'b' b'v prems(11)[symmetric]\n                      by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                    moreover have comp_in: \"(Inr (VUntil i vpsis' vphi')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                      using Inr b'v p'b' res by auto\n                    ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                        until_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                        pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v\n                        res prems\n                      unfolding prems(11)[symmetric]\n                      apply (auto simp add: total_on_def)\n                      by (metis transpD)\n                  qed\n                  subgoal premises prems for y ys\n                  proof -\n                    from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                      unfolding optimal_def by auto\n                    from Inr p1_def have b1_i: \"v_at b1 = i\" unfolding optimal_def valid_def\n                      by auto\n                    from p'_def p'b' b'v n_def have suc_le_etp: \"Suc i \\<le> ETP rho (\\<tau> rho i + left I)\"\n                      unfolding optimal_def valid_def\n                      apply (auto simp: Let_def split: if_splits)\n                      apply (meson add_eq_self_zero i_etp_to_tau lI le_add1 le_antisym not_less_eq_eq)\n                      by (meson add_eq_self_zero i_etp_to_tau lI le_neq_implies_less not_add_less1 not_less_eq_eq)\n                    have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ps p))\"\n                      using p_le_predi valid_shift_VUntil[of i I phi psi ps p] rfin(1) i_props q_val False lI\n                      by (auto simp: qr bv prems(8))\n                    then have \"wqo p' (Inr (VUntil (i+1) ps p))\" using p'_def\n                      unfolding optimal_def by auto\n                    moreover have \"checkIncr p'\"\n                      using p'_def\n                      unfolding p'b' b'v\n                      by (auto simp: optimal_def intro!: valid_checkIncr_VUntil)\n                    moreover have \"checkIncr (Inr (VUntil (i + 1) ps p))\"\n                      using valid_q_before\n                      by (auto intro!: valid_checkIncr_VUntil)\n                    ultimately have \"wqo (Inr (VUntil i vpsis' vphi')) q\"\n                      using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil (i+1) ps p)\"]\n                        valid_q_before i_props prems(4) qr bv\n                      unfolding p'b' b'v b1_i[symmetric]\n                      by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                    moreover have comp_in: \"(Inr (VUntil i vpsis' vphi')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                      using Inr b'v p'b' res by auto\n                    ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                        until_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                        pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v\n                        res prems\n                      unfolding b1_i[symmetric]\n                      apply (auto simp add: total_on_def)\n                      by (metis transpD)\n                  qed\n                  done\n              qed\n            qed\n          qed\n        }\n        moreover\n        {fix hi' vpsis'\n          assume b'v: \"b' = VUntil_never (i+1) hi' vpsis'\"\n          have hi'_def: \"hi' = hi\"\n            using p'_def\n            by (auto simp: p'b' b'v optimal_def valid_def hi_def)\n          have \"wqo minp q\"\n            using b'v\n          proof (cases p1)\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p2\" using b'v Inl minp Inr\n                  val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using True b'v Inl minp Inr val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def\n                apply (cases p2; auto simp: min_list_wrt_def split: if_splits)\n                by (metis Inl_Inr_False)\n              then show ?thesis\n                using form_min qr bv Inl p1_def q_val unfolding optimal_def valid_def\n                apply (cases ps)\n                apply (auto simp add: Let_def True i_etp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems for y ys\n                proof -\n                  from vmin form_min p2r have p_val: \"valid rho i (Until phi I psi) (p' \\<oplus> (Inr p2'))\"\n                    by auto\n                  from p2r b'v p'b' have check_p: \"checkApp p' (Inr p2')\"\n                    using p'_def True\n                    unfolding p2r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VUntil_never)\n                  from prems have y_val: \"valid rho i psi (Inr y)\"\n                    using q_val True i_props n_def i_ge_etpi[of rho i] unfolding valid_def\n                    apply (auto simp: Let_def max_def Cons_eq_append_conv split: if_splits)\n                    using Cons_eq_upt_conv by blast\n                  have val_q': \"valid rho (i + 1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ys p))\"\n                    using qr bv Inl p1_def q_val i_props n_def check_consistent[OF bfphi]\n                      prems\n                    unfolding optimal_def valid_def\n                    apply (auto simp add: Let_def True i_etp_to_tau split: if_splits)\n                    using i_ge_etpi[of rho \"s_at a1\"] i_ge_etpi[of rho \"Suc (s_at a1)\"]\n                    by (auto simp: max_def add.commute Cons_eq_append_conv Cons_eq_upt_conv split: if_splits)\n                  then have q_val2: \"valid rho i (Until phi I psi) ((Inr (VUntil (i+1) ys p)) \\<oplus> (Inr y))\"\n                    using q_val prems i_props by auto\n                  have check_q: \"checkApp (Inr (VUntil (i+1) ys p)) (Inr y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_VUntil)\n                  from p'_def have wqo_p': \"wqo p' (Inr (VUntil (i + 1) ys p))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p2: \"wqo p2 (Inr y)\" using i_props p2_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    unfolding prems using p'b' b'v p2_def q_val prems p2r unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' wqo_p2[unfolded p2r] p_val q_val2]\n                    by auto\n                qed\n                done\n            next\n              case False\n              then have form: \"minp = Inr (VUntil_never i hi' vpsis')\"\n                using b'v Inl minp Inr filter_nnil unfolding doUntil_def\n                by (cases p2) (auto simp: min_list_wrt_def)\n              then show ?thesis using qr bv q_val Inl p1_def i_props n_def\n                unfolding optimal_def valid_def\n                apply (cases ps)\n                apply (auto simp add: Let_def False i_etp_to_tau split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from p1_def Inl have p_ni: \"\\<not> v_at p = s_at a1\"\n                    using check_consistent[OF bfphi] prems(10-14)\n                    unfolding optimal_def valid_def\n                    by auto\n                  then have p_le_predi: \"v_at p \\<ge> s_at a1 + 1\"\n                    using p_bounds prems by auto\n                  then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ps p))\"\n                    using prems unfolding valid_def\n                    by (auto simp add: le_diff_conv Let_def i_etp_to_tau add.commute)\n                  then have \"wqo p' (Inr (VUntil (i+1) ps p))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil_never)\n                  moreover have \"checkIncr (Inr (VUntil (i + 1) ps p))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil (i+1) ps p)\"]\n                      valid_q_before i_props prems(4)\n                    unfolding p'b' b'v prems(11)[symmetric]\n                    by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                qed\n                subgoal premises prems for y ys\n                proof -\n                  from p1_def have a1_i: \"s_at a1 = i\" using Inl\n                    unfolding optimal_def valid_def by auto\n                  from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from p'_def p'b' b'v n_def have suc_le_etp: \"Suc i \\<le> ETP rho (\\<tau> rho i + left I)\"\n                    unfolding optimal_def valid_def\n                    apply (auto simp: Let_def split: if_splits)\n                    apply (meson False add_cancel_left_left etp_to_delta le_add2 le_antisym le_diff_conv2 le_refl not_less_eq_eq)\n                    apply (metis False diff_add_inverse diff_is_0_eq' i_etp_to_tau not_less_eq_eq)\n                    by (metis False diff_add_inverse diff_is_0_eq' i_etp_to_tau not_less_eq_eq)\n                  from p1_def have p_ni: \"\\<not> v_at p = s_at a1\"\n                    using check_consistent[OF bfphi] prems\n                    unfolding optimal_def valid_def\n                    by auto\n                  then have p_le_predi: \"v_at p \\<ge> s_at a1 + 1\"\n                    using p_bounds prems by auto\n                  then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ps p))\"\n                    using prems False i_props p_ni suc_le_etp unfolding valid_def\n                    apply (auto simp add: le_diff_conv Let_def i_etp_to_tau i_ltp_to_tau add.commute)\n                    apply (simp add: max_def split: if_splits)\n                    apply (metis (no_types, lifting) Nat.add_0_right add_diff_inverse_nat diff_is_0_eq i_etp_to_tau less_irrefl_nat nat_le_linear zero_less_diff)\n                    using i_etp_to_tau i_ge_etpi i_to_suci_le le_trans by blast\n                  then have \"wqo p' (Inr (VUntil (i+1) ps p))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil_never)\n                  moreover have \"checkIncr (Inr (VUntil (i + 1) ps p))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil (i+1) ps p)\"]\n                      valid_q_before i_props prems(3) form qr\n                    unfolding p'b' b'v a1_i[symmetric]\n                    by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                qed\n                done\n            qed\n          next\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inr (VUntil i [projr p2] b1) \\<or> minp = (p' \\<oplus> p2)\"\n                using Inr p'b' b'v minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using p'b' b'v Inr True minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def\n                by (cases p2; auto simp: min_list_wrt_def split: if_splits)\n              then have res: \"doUntil i (left I) p1 p2 p' = [Inr (VUntil i [projr p2] b1), (p' \\<oplus> p2)]\"\n                using True Inr p'b' b'v unfolding doUntil_def by auto\n              from True q_val qr bv have ps_not_nil: \"ps \\<noteq> []\"\n                using n_def unfolding valid_def\n                apply (auto simp: Let_def split: if_splits)\n                using i_ge_etpi le_trans by blast\n              then obtain y and ys where cons_q: \"ps = y # ys\"\n                using qr bv\n                by (cases ps; auto)\n              then have y_val: \"valid rho i psi (Inr y)\"\n                using q_val qr bv n_def True i_ge_etpi[of rho i] unfolding valid_def\n                apply (auto simp: Let_def max_def Cons_eq_append_conv split: if_splits)\n                by (metis upt_eq_Cons_conv)\n              then have wqo_p2: \"wqo (Inr p2') (Inr y)\" using p2r p2_def\n                unfolding optimal_def by auto\n              then show ?thesis\n              proof (cases ys)\n                case Nil\n                then have p_eq_i: \"v_at p = i\" using True bv qr q_val n_def\n                    i_props i_ge_etpi[of rho i]\n                  unfolding valid_def\n                  apply (auto simp: Let_def max_def split: if_splits)\n                  by (metis append.left_neutral list.simps(8) list.simps(9) add_cancel_right_right append1_eq_conv cons_q le_add2 le_antisym upt_eq_Nil_conv)\n                then have p_val: \"valid rho i phi (Inr p)\" using vp\n                  by auto\n                from wqo_p2 have lcomp: \"wqo (Inr p2') (Inr y)\"\n                  by auto\n                moreover have wqo_p1: \"wqo (Inr b1) (Inr p)\"\n                  using Inr p1_def p_val unfolding optimal_def by auto\n                ultimately have \"wqo (Inr (VUntil i [p2'] b1)) q\"\n                  using qr bv cons_q VUntil[OF wqo_p1 lcomp] Nil p2r\n                  by auto\n                moreover have \"(Inr (VUntil i [p2'] b1)) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                  using form minp Inr p2r Inr True b'v p'b'\n                  unfolding doUntil_def by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                    until_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                  unfolding proofApp_def\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              next\n                case (Cons a as)\n                then have p_ge_suci: \"v_at p \\<ge> i + 1\"\n                  using True bv qr q_val n_def i_props cons_q i_ge_etpi[of rho i]\n                  unfolding valid_def\n                  apply (auto simp: Let_def max_def split: if_splits)\n                  using not_less_eq_eq by fastforce\n                then have q'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ys p))\"\n                  using q_val cons_q True qr bv n_def i_props\n                  unfolding valid_def\n                  apply (auto simp: Let_def max_def i_etp_to_tau True add.commute Cons_eq_append_conv Cons_eq_upt_conv split: if_splits)\n                  using i_ge_etpi[of rho \"Suc i\"] i_ge_etpi[of rho i]\n                  by auto\n                then have wqo_p': \"wqo p' (Inr (VUntil (i+1) ys p))\"\n                  using p'_def unfolding optimal_def by auto\n                have check_q: \"checkApp (Inr (VUntil (i+1) ys p)) (Inr y)\"\n                  using q'_val True\n                  by (auto intro!: valid_checkApp_VUntil)\n                have check_min: \"checkApp p' (Inr p2')\" using p2r p'b' b'v\n                  using p'_def True\n                  unfolding p2r b'v p'b'\n                  by (auto simp: optimal_def intro!: valid_checkApp_VUntil_never)\n                from res have val_min: \"valid rho i (Until phi I psi) (p' \\<oplus> (Inr p2'))\"\n                  using b'v p'b' p2r\n                    until_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                  by auto\n                from q_val have q_val2: \"valid rho i (Until phi I psi) ((Inr (VUntil (i+1) ys p)) \\<oplus> (Inr y))\"\n                  using qr bv cons_q i_props unfolding proofApp_def by auto\n                then have \"wqo (p' \\<oplus> (Inr p2')) q\"\n                  using qr bv cons_q p'b' b'v i_props\n                    proofApp_mono[OF check_min check_q wqo_p' wqo_p2 val_min q_val2]\n                  by auto\n                moreover have \"(p' \\<oplus> (Inr p2')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                  using form minp Inr p2r Inr True b'v p'b'\n                  unfolding doUntil_def by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                    until_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                  unfolding proofApp_def\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              qed\n            next\n              case False\n              then have lI: \"left I \\<noteq> 0\" by auto\n              then have form: \"minp = Inr (VUntil i [] b1)\n                \\<or> minp = Inr (VUntil_never i hi' vpsis')\" using Inr p'b' b'v minp\n                val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              from p1_def Inr have b1i: \"v_at b1 = i\"\n                unfolding optimal_def valid_def by auto\n              from False Inr p'b' b'v have\n                res: \"doUntil i (left I) p1 p2 p' = [Inr (VUntil i [] b1), Inr (VUntil_never i hi' vpsis')]\"\n                unfolding doUntil_def by (cases p2; auto)\n              then show ?thesis\n              proof (cases \"v_at p = i\")\n                case True\n                then have ps_nil: \"ps = []\" using qr bv q_val n_def False\n                  unfolding valid_def\n                  apply (auto simp: Let_def max_def split: if_splits)\n                  apply (metis add_le_same_cancel1 i_etp_to_tau lI le0 le_antisym le_refl)\n                  by (meson add_le_same_cancel1 i_etp_to_tau lI le_0_eq nat_le_linear)\n                from True vp have wqo_p1: \"wqo (Inr b1) (Inr p)\" using p1_def Inr\n                  unfolding optimal_def by auto\n                then have \"wqo (Inr (VUntil i [] b1)) q\"\n                  using qr bv ps_nil VUntil_Nil[OF wqo_p1] by auto\n                moreover have \"(Inr (VUntil i [] b1)) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                  using Inr b'v p'b' res by auto\n                ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                    until_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                    pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v\n                  apply (auto simp add: total_on_def)\n                  by (metis transpD)\n              next\n                case False\n                then have p_le_predi: \"v_at p \\<ge> i + 1\" using p_bounds by auto\n                from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                  unfolding optimal_def by auto\n                then show ?thesis using qr bv q_val Inr p1_def i_props n_def\n                  unfolding optimal_def valid_def\n                  apply (cases ps)\n                  apply (auto simp add: Let_def False i_etp_to_tau split: if_splits)[1]\n                  subgoal premises prems\n                  proof -\n                    from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                      unfolding optimal_def by auto\n                    then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ps p))\"\n                      using prems unfolding valid_def\n                      apply (auto simp add: le_diff_conv Let_def i_etp_to_tau add.commute)\n                      using p_le_predi apply linarith\n                      using False by linarith\n                    then have \"wqo p' (Inr (VUntil (i+1) ps p))\" using p'_def\n                      unfolding optimal_def by auto\n                    moreover have \"checkIncr p'\"\n                      using p'_def\n                      unfolding p'b' b'v\n                      by (auto simp: optimal_def intro!: valid_checkIncr_VUntil_never)\n                    moreover have \"checkIncr (Inr (VUntil (i + 1) ps p))\"\n                      using valid_q_before\n                      by (auto intro!: valid_checkIncr_VUntil)\n                    ultimately  have \"wqo (Inr (VUntil_never i hi' vpsis')) q\"\n                      using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil (i+1) ps p)\"]\n                        valid_q_before i_props prems(4) qr bv\n                      unfolding p'b' b'v prems(11)[symmetric]\n                      by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                    moreover have comp_in: \"(Inr (VUntil_never i hi' vpsis')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                      using Inr b'v p'b' res by auto\n                    ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                        until_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                        pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v\n                        res prems\n                      unfolding prems(11)[symmetric]\n                      apply (auto simp add: total_on_def)\n                      by (metis transpD)\n                  qed\n                  subgoal premises prems for y ys\n                  proof -\n                    from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                      unfolding optimal_def by auto\n                    from Inr p1_def have b1_i: \"v_at b1 = i\" unfolding optimal_def valid_def\n                      by auto\n                    from p'_def p'b' b'v n_def have suc_le_etp: \"Suc i \\<le> ETP rho (\\<tau> rho i + left I)\"\n                      unfolding optimal_def valid_def\n                      apply (auto simp: Let_def split: if_splits)\n                      apply (meson add_eq_self_zero i_etp_to_tau lI le_add1 le_antisym not_less_eq_eq)\n                      apply (meson add_eq_self_zero i_etp_to_tau lI le_neq_implies_less not_add_less1 not_less_eq_eq)\n                      by (metis diff_add_inverse diff_is_0_eq' i_etp_to_tau lI not_less_eq_eq)\n                    then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil (i+1) ps p))\"\n                      using prems False i_props unfolding valid_def\n                      apply (auto simp add: le_diff_conv Let_def i_etp_to_tau i_ltp_to_tau add.commute)\n                      apply (simp add: max_def split: if_splits)\n                      apply (metis (no_types, lifting) Nat.add_0_right add_diff_inverse_nat diff_is_0_eq i_etp_to_tau less_irrefl_nat nat_le_linear zero_less_diff)\n                      by (meson i_etp_to_tau i_ge_etpi i_to_suci_le le_trans)\n                    then have \"wqo p' (Inr (VUntil (i+1) ps p))\" using p'_def\n                      unfolding optimal_def by auto\n                    moreover have \"checkIncr p'\"\n                      using p'_def\n                      unfolding p'b' b'v\n                      by (auto simp: optimal_def intro!: valid_checkIncr_VUntil_never)\n                    moreover have \"checkIncr (Inr (VUntil (i + 1) ps p))\"\n                      using valid_q_before\n                      by (auto intro!: valid_checkIncr_VUntil)\n                    ultimately have \"wqo (Inr (VUntil_never i hi' vpsis')) q\"\n                      using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil (i+1) ps p)\"]\n                        valid_q_before i_props prems(4) qr bv\n                      unfolding p'b' b'v b1_i[symmetric]\n                      by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                    moreover have comp_in: \"(Inr (VUntil_never i hi' vpsis')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                      using Inr b'v p'b' res by auto\n                    ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                        until_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                        pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v\n                        res prems\n                      unfolding b1_i[symmetric]\n                      apply (auto simp add: total_on_def)\n                      by (metis transpD)\n                  qed\n                  done\n              qed\n            qed\n          qed\n        }\n        ultimately show ?thesis by auto\n      qed\n    }\n    moreover\n    {fix hi' ps\n      assume bv: \"b = VUntil_never i hi' ps\"\n      have hi'_def: \"hi' = hi\"\n        using q_val\n        by (auto simp: Inr bv valid_def hi)\n      have \"wqo minp q\"\n        using bv\n      proof (cases p')\n        case (Inl a')\n        then obtain p1' ps' where a's: \"a' = SUntil ps' p1'\"\n          using p'_def\n          unfolding optimal_def valid_def\n          by (cases a') auto\n        from a's Inl have \"LTP rho (\\<tau> rho i + n) \\<ge> s_at p1'\n        \\<and> s_at p1' > i\" using p'_def i_props mem_imp_le_ltp_u[of i I \"s_at p1'\" n]\n          n_def\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        then have sp1'_bounds: \"LTP rho (\\<tau> rho i + n) \\<ge> s_at p1'\n        \\<and> s_at p1' > i \\<and> s_at p1' \\<ge> ETP rho (\\<tau> rho i + left I)\"\n          using a's Inl p'_def i_props mem_imp_ge_etp_u[of i I \"s_at p1'\" n] n_def\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        from bv qr have mapt: \"map v_at ps = [lu rho i I  ..< Suc (LTP rho (\\<tau> rho i + n))]\"\n          using q_val n_def unfolding valid_def by (auto simp: Let_def)\n        then have ps_check: \"\\<forall>p \\<in> set ps. v_check rho psi p\"\n          using bv qr q_val n_def unfolding valid_def\n          by (auto simp: Let_def)\n        then have jc: \"\\<forall>j \\<in> set (map v_at ps). \\<exists>p. v_at p = j \\<and> v_check rho psi p\"\n          using map_set_in_imp_set_in[OF ps_check] by auto\n        from sp1'_bounds have p1'_in: \"s_at p1' \\<in> set (map v_at ps)\" using mapt\n          by auto\n        from a's Inl have \"s_check rho psi p1'\" using p'_def\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        then have False using jc p1'_in check_consistent[OF bfpsi] by auto\n        then show ?thesis by auto\n      next\n        case (Inr b')\n        then have p'b': \"p' = Inr b'\" by auto\n        then have b'v: \"(\\<exists>p ps. b' = VUntil (i+1) ps p)\n        \\<or> (\\<exists>ps. b' = VUntil_never (i+1) hi ps)\"\n          using Inr p'_def n_def i_props\n          unfolding optimal_def valid_def by (cases b') (auto simp: Let_def hi add.commute)\n        moreover\n        {fix vphi' vpsis'\n          assume b'v: \"b' = VUntil (i+1) vpsis' vphi'\"\n          then have \"wqo minp q\"\n          proof (cases p1)\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p2\" using b'v Inl minp Inr\n                  val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using True b'v Inl minp Inr val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def\n                apply (cases p2; auto simp: min_list_wrt_def split: if_splits)\n                by (metis Inl_Inr_False)\n              then show ?thesis\n                using form_min qr bv Inl p1_def q_val n_def\n                unfolding optimal_def valid_def\n                apply (cases ps)\n                apply (auto simp add: Let_def True i_le_ltpi_add i_etp_to_tau split: if_splits)\n                subgoal premises prems for y ys\n                proof -\n                  from vmin form_min p2r have p_val: \"valid rho i (Until phi I psi) (p' \\<oplus> (Inr p2'))\"\n                    by auto\n                  from p2r b'v p'b' have check_p: \"checkApp p' (Inr p2')\"\n                    using p'_def True\n                    unfolding p2r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VUntil)\n                  from prems have y_val: \"valid rho i psi (Inr y)\"\n                    using q_val True i_ge_etpi[of rho \"s_at a1\"] i_props unfolding valid_def\n                    apply (auto simp: Let_def split: if_splits)\n                    apply (auto simp add: max_def Cons_eq_append_conv split: if_splits)\n                    using Cons_eq_upt_conv by blast\n                  have val_q': \"valid rho (i + 1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ys))\"\n                    using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val\n                    by (auto simp: True prems(2) qr bv)\n                  then have q_val2: \"valid rho i (Until phi I psi) ((Inr (VUntil_never (i+1) hi' ys)) \\<oplus> (Inr y))\"\n                    using q_val prems i_props by auto\n                  have check_q: \"checkApp (Inr (VUntil_never (i+1) hi' ys)) (Inr y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_VUntil_never)\n                  from p'_def have wqo_p': \"wqo p' (Inr (VUntil_never (i + 1) hi' ys))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p2: \"wqo p2 (Inr y)\" using i_props p2_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    unfolding prems using p'b' b'v p2_def q_val prems p2r unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' wqo_p2[unfolded p2r] p_val q_val2]\n                    by auto\n                qed\n                done\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                unfolding optimal_def by auto\n              from False have form_min: \"minp = Inr (VUntil i vpsis' vphi')\"\n                using b'v Inl minp Inr filter_nnil unfolding doUntil_def\n                by (cases p2) (auto simp: min_list_wrt_def)\n              then show ?thesis using qr bv q_val i_props n_def\n                unfolding optimal_def valid_def\n                apply (cases ps)\n                apply (auto simp add: Let_def False i_le_ltpi_add split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ps))\"\n                    using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val False\n                    by (auto simp: prems(2) qr bv)\n                  then have \"wqo p' (Inr (VUntil_never (i+1) hi' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil)\n                  moreover have \"checkIncr (Inr (VUntil_never (i + 1) hi' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil_never)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil_never (i+1) hi' ps)\"]\n                      valid_q_before i_props prems(3)\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def hi'_def hi n_def intro: checkIncr.intros)\n                qed\n                subgoal premises prems for y ys\n                proof -\n                  from p1_def have a1_i: \"s_at a1 = i\" using Inl\n                    unfolding optimal_def valid_def by auto\n                  from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from p'_def p'b' b'v n_def have suc_le_etp: \"Suc i \\<le> ETP rho (\\<tau> rho i + left I)\"\n                    unfolding optimal_def valid_def\n                    apply (auto simp: Let_def split: if_splits)\n                    apply (meson False add_cancel_left_left etp_to_delta le_add2 le_antisym le_diff_conv2 le_refl not_less_eq_eq)\n                    by (metis False diff_add_inverse diff_is_0_eq' i_etp_to_tau not_less_eq_eq)\n                  then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ps))\"\n                    using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VUntil_never (i+1) hi' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil)\n                  moreover have \"checkIncr (Inr (VUntil_never (i + 1) hi' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil_never)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil_never (i+1) hi' ps)\"]\n                      valid_q_before i_props prems(3) form_min qr\n                    unfolding p'b' b'v a1_i[symmetric]\n                    by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                qed\n                done\n            qed\n          next\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inr (VUntil i [projr p2] b1) \\<or> minp = (p' \\<oplus> p2)\"\n                using Inr p'b' b'v minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using p'b' b'v Inr True minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def\n                by (cases p2; auto simp: min_list_wrt_def split: if_splits)\n              then have res: \"doUntil i (left I) p1 p2 p' = [Inr (VUntil i [projr p2] b1), (p' \\<oplus> p2)]\"\n                using True Inr p'b' b'v unfolding doUntil_def by auto\n              from True q_val qr bv have ps_not_nil: \"ps \\<noteq> []\"\n                using n_def i_le_ltpi_add unfolding valid_def\n                by (auto simp: Let_def i_etp_to_tau split: if_splits)\n              then obtain y and ys where cons_q: \"ps = y # ys\"\n                using qr bv\n                by (cases ps; auto)\n              then have y_val: \"valid rho i psi (Inr y)\"\n                using q_val qr bv n_def True i_ge_etpi[of rho i] unfolding valid_def\n                apply (auto simp: Let_def max_def Cons_eq_append_conv split: if_splits)\n                by (metis upt_eq_Cons_conv)\n              then have wqo_p2: \"wqo (Inr p2') (Inr y)\" using p2r p2_def\n                unfolding optimal_def by auto\n              then have q'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ys))\"\n                using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val\n                by (auto simp: True qr bv cons_q)\n              then have wqo_p': \"wqo p' (Inr (VUntil_never (i+1) hi' ys))\"\n                using p'_def unfolding optimal_def by auto\n              have check_q: \"checkApp (Inr (VUntil_never (i+1) hi' ys)) (Inr y)\"\n                using q'_val True\n                by (auto intro!: valid_checkApp_VUntil_never)\n              have check_min: \"checkApp p' (Inr p2')\" using p2r p'b' b'v\n                using p'_def True\n                unfolding p2r b'v p'b'\n                by (auto simp: optimal_def intro!: valid_checkApp_VUntil)\n              from res have val_min: \"valid rho i (Until phi I psi) (p' \\<oplus> (Inr p2'))\"\n                using b'v p'b' p2r\n                  until_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                by auto\n              from q_val have q_val2: \"valid rho i (Until phi I psi) ((Inr (VUntil_never (i+1) hi' ys)) \\<oplus> (Inr y))\"\n                using qr bv cons_q i_props unfolding proofApp_def by auto\n              then have \"wqo (p' \\<oplus> (Inr p2')) q\"\n                using qr bv cons_q p'b' b'v i_props\n                  proofApp_mono[OF check_min check_q wqo_p' wqo_p2 val_min q_val2]\n                by auto\n              moreover have \"(p' \\<oplus> (Inr p2')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                using form minp Inr p2r Inr True b'v p'b'\n                unfolding doUntil_def by auto\n              ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                  until_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                  pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                unfolding proofApp_def\n                apply (auto simp add: total_on_def)\n                by (metis transpD)\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inr (VUntil i [] b1)\n              \\<or> minp = Inr (VUntil i vpsis' vphi')\" using Inr p'b' b'v minp\n                val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              then have res: \"doUntil i (left I) p1 p2 p' = [Inr (VUntil i [] b1), Inr (VUntil i vpsis' vphi')]\"\n                using False Inr p'b' b'v unfolding doUntil_def by (cases p2; auto)\n              then show ?thesis using qr bv q_val Inr p1_def i_props n_def\n                unfolding optimal_def valid_def\n                apply (cases ps)\n                apply (auto simp add: Let_def False i_le_ltpi_add split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ps))\"\n                    using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val False\n                    by (auto simp: prems(2) qr bv)\n                  then have \"wqo p' (Inr (VUntil_never (i+1) hi' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil)\n                  moreover have \"checkIncr (Inr (VUntil_never (i + 1) hi' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil_never)\n                  ultimately have \"wqo (Inr (VUntil i vpsis' vphi')) q\"\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil_never (i+1) hi' ps)\"]\n                      valid_q_before i_props prems(4) qr bv\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                  moreover have comp_in: \"(Inr (VUntil i vpsis' vphi')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                    using Inr b'v p'b' res by auto\n                  ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                      until_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                      pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v\n                      res prems\n                    unfolding prems(11)[symmetric]\n                    apply (auto simp add: total_on_def)\n                    by (metis transpD)\n                qed\n                subgoal premises prems for y ys\n                proof -\n                  from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from Inr p1_def have b1_i: \"v_at b1 = i\" unfolding optimal_def valid_def\n                    by auto\n                  from p'_def p'b' b'v n_def have suc_le_etp: \"Suc i \\<le> ETP rho (\\<tau> rho i + left I)\"\n                    unfolding optimal_def valid_def\n                    apply (auto simp: Let_def split: if_splits)\n                    apply (meson add_eq_self_zero i_etp_to_tau False le_add1 le_antisym not_less_eq_eq)\n                    by (meson add_eq_self_zero i_etp_to_tau False le_neq_implies_less not_add_less1 not_less_eq_eq)\n                  then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ps))\"\n                    using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VUntil_never (i+1) hi' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil)\n                  moreover have \"checkIncr (Inr (VUntil_never (i + 1) hi' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil_never)\n                  ultimately have \"wqo (Inr (VUntil i vpsis' vphi')) q\"\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil_never (i+1) hi' ps)\"]\n                      valid_q_before i_props prems(4) qr bv\n                    unfolding p'b' b'v b1_i[symmetric]\n                    by (auto simp add: proofIncr_def intro: checkIncr.intros)\n                  moreover have comp_in: \"(Inr (VUntil i vpsis' vphi')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                    using Inr b'v p'b' res by auto\n                  ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                      until_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                      pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v\n                      res prems\n                    unfolding b1_i[symmetric]\n                    apply (auto simp add: total_on_def)\n                    by (metis transpD)\n                qed\n                done\n            qed\n          qed\n        }\n        moreover\n        {fix hi'' vpsis'\n          assume b'v: \"b' = VUntil_never (i+1) hi'' vpsis'\"\n          have hi''_def: \"hi'' = hi\"\n            using p'_def rfin\n            by (auto simp: Inr b'v optimal_def valid_def hi_def)\n          have \"wqo minp q\"\n            using b'v\n          proof (cases p1)\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p2\" using Inl b'v p'b' minp\n                  val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using True b'v Inl minp Inr val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def\n                apply (cases p2; auto simp: min_list_wrt_def split: if_splits)\n                by (metis Inl_Inr_False)\n              then show ?thesis\n                using form_min qr bv Inl p1_def q_val n_def unfolding optimal_def valid_def\n                apply (cases ps)\n                apply (auto simp add: Let_def True i_etp_to_tau i_le_ltpi_add split: if_splits enat.splits)[1]\n                subgoal premises prems for y ys\n                proof -\n                  from vmin form_min p2r have p_val: \"valid rho i (Until phi I psi) (p' \\<oplus> (Inr p2'))\"\n                    by auto\n                  from p2r b'v p'b' have check_p: \"checkApp p' (Inr p2')\"\n                    using p'_def True\n                    unfolding p2r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VUntil_never)\n                  from prems have y_val: \"valid rho i psi (Inr y)\"\n                    using q_val True i_ge_etpi[of rho \"s_at a1\"] i_props unfolding valid_def\n                    apply (auto simp: Let_def split: if_splits)\n                    apply (auto simp add: max_def Cons_eq_append_conv split: if_splits)\n                    using Cons_eq_upt_conv by blast\n                  have val_q': \"valid rho (i + 1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ys))\"\n                    using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val\n                    by (auto simp: True prems(9) qr bv)\n                  then have q_val2: \"valid rho i (Until phi I psi) ((Inr (VUntil_never (i+1) hi' ys)) \\<oplus> (Inr y))\"\n                    using q_val prems i_props by auto\n                  have check_q: \"checkApp (Inr (VUntil_never (i+1) hi' ys)) (Inr y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_VUntil_never)\n                  from p'_def have wqo_p': \"wqo p' (Inr (VUntil_never (i + 1) hi' ys))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p2: \"wqo p2 (Inr y)\" using i_props p2_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    unfolding prems using p'b' b'v p2_def q_val prems p2r unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' wqo_p2[unfolded p2r] p_val q_val2]\n                    by auto\n                qed\n                done\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                unfolding optimal_def by auto\n              from False have form_min: \"minp = Inr (VUntil_never i hi' vpsis')\"\n                using b'v Inl minp Inr filter_nnil unfolding doUntil_def\n                by (cases p2) (auto simp: min_list_wrt_def hi''_def hi'_def)\n              then show ?thesis using qr bv q_val i_props n_def\n                unfolding optimal_def valid_def\n                apply (cases ps)\n                apply (auto simp add: Let_def False i_le_ltpi_add split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ps))\"\n                    using prems\n                    unfolding valid_def\n                    by (auto simp add: add.commute le_diff_conv Let_def i_etp_to_tau split: if_splits)\n                  then have \"wqo p' (Inr (VUntil_never (i+1) hi' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil_never)\n                  moreover have \"checkIncr (Inr (VUntil_never (i + 1) hi' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil_never)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil_never (i+1) hi' ps)\"]\n                      valid_q_before i_props prems(3)\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def hi hi'_def hi''_def n_def intro: checkIncr.intros)\n                qed\n                subgoal premises prems for y ys\n                proof -\n                  from p1_def have a1_i: \"s_at a1 = i\" using Inl\n                    unfolding optimal_def valid_def by auto\n                  from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from p'_def p'b' b'v n_def have suc_le_etp: \"Suc i \\<le> ETP rho (\\<tau> rho i + left I)\"\n                    unfolding optimal_def valid_def\n                    apply (auto simp: Let_def split: if_splits)\n                    apply (meson False add_cancel_left_left etp_to_delta le_add2 le_antisym le_diff_conv2 le_refl not_less_eq_eq)\n                    using i_le_ltpi_add apply blast\n                    by (metis False diff_add_inverse diff_is_0_eq' i_etp_to_tau not_less_eq_eq)\n                  then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ps))\"\n                    using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val False\n                    by (auto simp: qr bv)\n                  then have \"wqo p' (Inr (VUntil_never (i+1) hi' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil_never)\n                  moreover have \"checkIncr (Inr (VUntil_never (i + 1) hi' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil_never)\n                  ultimately show ?thesis\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil_never (i+1) hi' ps)\"]\n                      valid_q_before i_props prems(3) form_min qr\n                    unfolding p'b' b'v a1_i[symmetric]\n                    by (auto simp add: proofIncr_def hi'_def hi''_def intro: checkIncr.intros)\n                qed\n                done\n            qed\n          next\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inr (VUntil i [projr p2] b1) \\<or> minp =  (p' \\<oplus> p2)\"\n                using Inr p'b' b'v minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def)\n              then obtain p2' where p2r: \"p2 = Inr p2'\"\n                using p'b' b'v Inr True minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def\n                by (cases p2; auto simp: min_list_wrt_def split: if_splits)\n              then have res: \"doUntil i (left I) p1 p2 p' = [Inr (VUntil i [projr p2] b1), (p' \\<oplus> p2)]\"\n                using True Inr p'b' b'v unfolding doUntil_def by auto\n              from True q_val qr bv have ps_not_nil: \"ps \\<noteq> []\"\n                using n_def i_le_ltpi_add unfolding valid_def\n                by (auto simp: Let_def i_etp_to_tau split: if_splits)\n              then obtain y and ys where cons_q: \"ps = y # ys\"\n                using qr bv\n                by (cases ps; auto)\n              then have y_val: \"valid rho i psi (Inr y)\"\n                using q_val qr bv n_def True i_ge_etpi[of rho i] unfolding valid_def\n                apply (auto simp: Let_def max_def Cons_eq_append_conv split: if_splits)\n                by (metis upt_eq_Cons_conv)\n              then have wqo_p2: \"wqo (Inr p2') (Inr y)\" using p2r p2_def\n                unfolding optimal_def by auto\n              then have q'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ys))\"\n                using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val\n                by (auto simp: True qr bv cons_q)\n              then have wqo_p': \"wqo p' (Inr (VUntil_never (i+1) hi' ys))\"\n                using p'_def unfolding optimal_def by auto\n              have check_q: \"checkApp (Inr (VUntil_never (i+1) hi' ys)) (Inr y)\"\n                using q'_val True\n                by (auto intro!: valid_checkApp_VUntil_never)\n              have check_min: \"checkApp p' (Inr p2')\" using p2r p'b' b'v\n                using p'_def True\n                unfolding p2r b'v p'b'\n                by (auto simp: optimal_def intro!: valid_checkApp_VUntil_never)\n              from res have val_min: \"valid rho i (Until phi I psi) (p' \\<oplus> (Inr p2'))\"\n                using b'v p'b' p2r\n                  until_sound[OF i_props p1_def p2_def p'_def _ bf bf']\n                by auto\n              from q_val have q_val2: \"valid rho i (Until phi I psi) ((Inr (VUntil_never (i+1) hi' ys)) \\<oplus> (Inr y))\"\n                using qr bv cons_q i_props unfolding proofApp_def by auto\n              then have \"wqo (p' \\<oplus> (Inr p2')) q\"\n                using qr bv cons_q p'b' b'v i_props\n                  proofApp_mono[OF check_min check_q wqo_p' wqo_p2 val_min q_val2]\n                by auto\n              moreover have \"(p' \\<oplus> (Inr p2')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                using form minp Inr p2r Inr True b'v p'b'\n                unfolding doUntil_def by auto\n              ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                  until_sound[OF i_props p1_def p2_def p'_def _ bf bf'] form\n                  pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v p2r\n                unfolding proofApp_def\n                apply (auto simp add: total_on_def)\n                by (metis transpD)\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inr (VUntil i [] b1)\n              \\<or> minp = Inr (VUntil_never i hi' vpsis')\" using Inr p'b' b'v minp\n                val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doUntil_def by (cases p2) (auto simp: min_list_wrt_def hi'_def hi''_def)\n              then have res: \"doUntil i (left I) p1 p2 p' = [Inr (VUntil i [] b1), Inr (VUntil_never i hi' vpsis')]\"\n                using False Inr p'b' b'v unfolding doUntil_def by (cases p2; auto simp: hi'_def hi''_def)\n              then show ?thesis using qr bv q_val Inr p1_def i_props n_def\n                unfolding optimal_def valid_def\n                apply (cases ps)\n                apply (auto simp add: Let_def False i_le_ltpi_add split: if_splits)[1]\n                subgoal premises prems\n                proof -\n                  from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ps))\"\n                    using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val False\n                    by (auto simp: prems(9) qr bv)\n                  then have \"wqo p' (Inr (VUntil_never (i+1) hi' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil_never)\n                  moreover have \"checkIncr (Inr (VUntil_never (i + 1) hi' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil_never)\n                  ultimately  have \"wqo (Inr (VUntil_never i hi' vpsis')) q\"\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil_never (i+1) hi' ps)\"]\n                      valid_q_before i_props prems(4) qr bv\n                    unfolding p'b' b'v\n                    by (auto simp add: proofIncr_def hi'_def hi''_def intro: checkIncr.intros)\n                  moreover have comp_in: \"(Inr (VUntil_never i hi' vpsis')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                    using Inr b'v p'b' res by auto\n                  ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                      until_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                      pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v\n                      res prems\n                    unfolding prems(11)[symmetric]\n                    apply (auto simp add: total_on_def)\n                    by (metis transpD)\n                qed\n                subgoal premises prems for y ys\n                proof -\n                  from p'_def have p'_val: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n                    unfolding optimal_def by auto\n                  from Inr p1_def have b1_i: \"v_at b1 = i\" unfolding optimal_def valid_def\n                    by auto\n                  from p'_def p'b' b'v n_def have suc_le_etp: \"Suc i \\<le> ETP rho (\\<tau> rho i + left I)\"\n                    unfolding optimal_def valid_def\n                    apply (auto simp: Let_def i_le_ltpi_add split: if_splits)\n                    apply (meson add_eq_self_zero i_etp_to_tau False le_add1 le_antisym not_less_eq_eq)\n                    by (meson add_eq_self_zero i_etp_to_tau False le_neq_implies_less not_add_less1 not_less_eq_eq)\n                  then have valid_q_before: \"valid rho (i+1) (Until phi (subtract (\\<Delta> rho (i+1)) I) psi) (Inr (VUntil_never (i+1) hi' ps))\"\n                    using valid_shift_VUntil_never[of i I phi psi hi' ps] rfin(1) i_props q_val False\n                    by (auto simp: prems(9) qr bv)\n                  then have \"wqo p' (Inr (VUntil_never (i+1) hi' ps))\" using p'_def\n                    unfolding optimal_def by auto\n                  moreover have \"checkIncr p'\"\n                    using p'_def\n                    unfolding p'b' b'v\n                    by (auto simp: optimal_def intro!: valid_checkIncr_VUntil_never)\n                  moreover have \"checkIncr (Inr (VUntil_never (i + 1) hi' ps))\"\n                    using valid_q_before\n                    by (auto intro!: valid_checkIncr_VUntil_never)\n                  ultimately have \"wqo (Inr (VUntil_never i hi' vpsis')) q\"\n                    using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VUntil_never (i+1) hi' ps)\"]\n                      valid_q_before i_props prems(4) qr bv\n                    unfolding p'b' b'v b1_i[symmetric]\n                    by (auto simp add: proofIncr_def hi hi'_def hi''_def intro: checkIncr.intros)\n                  moreover have comp_in: \"(Inr (VUntil_never i hi' vpsis')) \\<in> set (doUntil i (left I) p1 p2 p')\"\n                    using Inr b'v p'b' res by auto\n                  ultimately show ?thesis using minp min_list_wrt_le[OF total_set refl_wqo]\n                      until_sound[OF i_props p1_def p2_def p'_def comp_in bf bf'] form\n                      pw_total[of i \"Until phi I psi\"] p'b' trans_wqo Inr b'v\n                      res prems\n                    unfolding b1_i[symmetric]\n                    apply (auto simp add: total_on_def)\n                    by (metis transpD)\n                qed\n                done\n            qed\n          qed\n        }\n        ultimately show ?thesis by auto\n      qed\n    }\n    ultimately show ?thesis by auto\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Eventually\\<close>\n\nlemma valid_checkApp_VEventually: \"valid rho j (Eventually I phi) (Inr (VEventually j hi vphis')) \\<Longrightarrow>\n  left I = 0 \\<or> (case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> ETP rho (\\<tau> rho j + left I) \\<le> LTP rho (\\<tau> rho j + n)) \\<Longrightarrow>\n  checkApp (Inr (VEventually j hi vphis')) (Inr p1')\"\n  apply (intro checkApp.intros)\n  apply (simp add: valid_def Let_def i_etp_to_tau i_le_ltpi_add split: if_splits enat.splits)\n  by force\n\nlemma valid_checkIncr_VEventually: \"valid rho j phi (Inr (VEventually j hi vphis')) \\<Longrightarrow>\n  checkIncr (Inr (VEventually j hi vphis'))\"\n  apply (cases phi)\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits dest!: arg_cong[where ?x=\"map _ _\" and ?f=set] intro!: checkIncr.intros)\n  apply (drule imageI[where ?A=\"set vphis'\" and ?f=v_at])\n  apply auto\n  done\n\nlemma eventuallyBase_sound:\n  assumes i_props: \"right I < enat (\\<Delta> rho (i+1))\" and\n    p1_def: \"optimal i phi p1\" and\n    p_def: \"p \\<in> set (doEventuallyBase i (left I) p1)\"\n  shows \"valid rho i (Eventually I phi) p\"\nproof(cases \"left I = 0\")\n  case True\n  then show ?thesis\n  proof (cases p1)\n    case (Inl a)\n    then have \"p = Inl (SEventually i a)\" \n      using p_def True\n      unfolding doEventuallyBase_def by simp\n    then show ?thesis \n      using True i_props p1_def zero_enat_def Inl\n      unfolding optimal_def valid_def by auto\n  next\n    case (Inr b)\n    then have \"p = Inr (VEventually i i [b])\" \n      using p_def True\n      unfolding doEventuallyBase_def by simp\n    then show ?thesis \n      using True i_props p1_def Inr i_ge_etpi[of rho i]\n          LTP_lt_delta enat_iless\n      unfolding optimal_def valid_def\n      by (auto simp: Let_def split: enat.splits)\n  qed\nnext\n  case False\n  then show ?thesis\n  proof (cases p1)\n    case (Inl a)\n    then have \"p = Inr (VEventually i i [])\"\n      using p_def False\n      unfolding doEventuallyBase_def by simp\n    then show ?thesis \n      using False i_props p1_def Inl i_ge_etpi[of rho i]\n          LTP_lt_delta enat_iless \n      unfolding optimal_def valid_def\n      by (auto simp: Let_def i_etp_to_tau split: enat.splits)\n  next\n    case (Inr b)\n    then have \"p = Inr (VEventually i i [])\"\n      using p_def False\n      unfolding doEventuallyBase_def by simp\n    then show ?thesis \n      using False i_props p1_def Inr i_ge_etpi[of rho i]\n          LTP_lt_delta enat_iless \n      unfolding optimal_def valid_def\n      by (auto simp: Let_def i_etp_to_tau split: enat.splits)\n  qed\nqed\n\nlemma eventuallyBase_optimal:\n  assumes bf: \"bounded_future (Eventually I phi)\" and\n    i_props: \"right I < enat (\\<Delta> rho (i+1))\" and p1_def: \"optimal i phi p1\"\n  shows \"optimal i (Eventually I phi) (min_list_wrt wqo (doEventuallyBase i (left I) p1))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  from doEventuallyBase_def[of i \"left I\" p1]\n  have nnil: \"doEventuallyBase i (left I) p1 \\<noteq> []\"\n    by (cases p1; cases \"left I\"; auto)\n  from pw_total[of i \"Eventually I phi\"] have total_set: \"total_on wqo (set (doEventuallyBase i (left I) p1))\"\n    using eventuallyBase_sound[OF i_props p1_def]\n    by (metis not_wqo total_onI)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doEventuallyBase i (left I) p1). wqo x y) (doEventuallyBase i (left I) p1) \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doEventuallyBase i (left I) p1). wqo x y)\" \"(doEventuallyBase i (left I) p1)\"]\n    by simp\n  {assume sat: \"SAT rho i (Eventually I phi)\"\n    then have sate: \"sat rho i (Eventually I phi)\" using soundness\n      by blast\n    then have \"sat rho i phi\" using i_props r_less_imp_nphi nat_less_le\n      by auto\n    then have \"left I = 0\" using sate sat_Eventually_rec[of rho i I phi] i_props\n      by auto\n  } note * = this\n  define minp where minp: \"minp \\<equiv> (min_list_wrt wqo (doEventuallyBase i (left I) p1))\"\n  assume nopt: \"\\<not> optimal i (Eventually I phi) minp\"\n  from eventuallyBase_sound[OF i_props p1_def min_list_wrt_in[of _ wqo]]\n    refl_wqo trans_wqo pw_total minp nnil\n  have vmin: \"valid rho i (Eventually I phi) minp\"\n    by (auto simp add: total_set)\n  then obtain q where q_val: \"valid rho i (Eventually I phi) q\" and\n    q_le: \"\\<not> wqo minp q\" using nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inl a)\n    then obtain sphiq where sq: \"a = SEventually i sphiq\" using q_val\n      unfolding valid_def by (cases a) auto\n    from q_val have satu: \"SAT rho i (Eventually I phi)\" using check_sound Inl\n      unfolding valid_def by auto\n    from sq have p_val: \"valid rho i phi (Inl sphiq)\" \n      using q_val Inl i_props r_less_imp_nphi \n      unfolding valid_def \n      by (auto simp: Let_def diff_add_inverse2 le_eq_less_or_eq)\n    then have p1_le: \"wqo p1 (Inl sphiq)\" using p1_def unfolding optimal_def\n      by simp\n    obtain p1' where p1'_def: \"p1 = Inl p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inl (SEventually i (projl p1))) q\"\n      using SEventually[OF p1_le[unfolded p1'_def]] sq Inl\n      by (fastforce simp add: p1'_def map_idI)\n    moreover have \"Inl (SEventually i (projl p1)) \\<in> set (doEventuallyBase i (left I) p1)\"\n      using assms check_consistent[of phi] satu * p_val\n      unfolding doEventuallyBase_def optimal_def valid_def\n      by (auto split: sum.splits)\n    ultimately show ?thesis using min_list_wrt_le[OF _ refl_wqo]\n        eventuallyBase_sound[OF i_props p1_def] pw_total[of i \"Eventually I phi\"]\n        trans_wqo Inl minp\n      apply (simp add: total_on_def)\n      by (metis transpD)\n  next\n    case (Inr b)\n    then show ?thesis\n    proof (cases \"left I\")\n      {fix n j\n        assume j_def: \"right I = enat n \\<and> ETP rho (\\<tau> rho i) \\<le> j\n       \\<and> j \\<le> LTP rho (\\<tau> rho i + n) \\<and> j \\<ge> i\"\n        from \\<tau>_mono have \"\\<tau> rho i + n \\<ge> \\<tau> rho 0\"  by (auto simp add: trans_le_add1)\n        then have jin: \"\\<tau> rho j \\<le> \\<tau> rho i + n\" using j_def i_ltp_to_tau by auto\n        from \\<tau>_mono have j_gei: \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho (i+1)\" by auto\n        from this i_props j_def have \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho i + n\"\n          apply auto\n          by (smt Suc_eq_plus1 diff_is_0_eq' j_gei le_add_diff_inverse le_trans less_imp_le_nat less_nat_zero_code nat_add_left_cancel_le nat_le_linear)\n        then have \"j = i\" using j_def jin apply auto\n          by (metis dual_order.strict_implies_not_eq add_diff_cancel_left' add_diff_cancel_right' i_props j_gei le_antisym le_neq_implies_less less_add_one)\n      } note ** = this\n      case 0\n      {fix vphi\n        assume bv: \"b = VEventually i i [vphi]\"\n        then have b_val: \"valid rho i phi (Inr vphi)\"\n          using q_val Inr\n          unfolding valid_def\n          by (auto simp: Let_def split: if_splits enat.splits)\n        then have p1_wqo: \"wqo p1 (Inr vphi)\"\n          using b_val p1_def unfolding optimal_def\n          by auto\n        obtain p1' where p1'_def: \"p1 = Inr p1'\"\n          using b_val p1_def check_consistent[OF bf_phi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        have \"wqo (Inr (VEventually i i [p1'])) q\"\n          using bv Inr VEventually p1_wqo\n          by (auto simp add: p1'_def)\n        moreover have \"Inr (VEventually i i [p1']) \\<in> set (doEventuallyBase i (left I) p1)\"\n          using b_val \"0\"\n          unfolding doEventuallyBase_def\n          by (auto split: sum.splits simp: p1'_def)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            eventuallyBase_sound[OF i_props p1_def] pw_total[of i \"Eventually I phi\"]\n            trans_wqo bv Inr minp \n          apply (simp add: total_on_def)\n          by (metis transpD)\n      }\n      then show ?thesis using minp Inr \"0\" q_val ** i_props LTP_lt_delta i_ge_etpi\n        unfolding doEventuallyBase_def valid_def\n        apply (cases b)\n                            apply (auto simp add: i_le_ltpi_add Let_def split: if_splits)\n        by blast\n    next\n      case (Suc nat)\n      {fix n j\n        assume j_def: \"right I = enat n \\<and> ETP rho (\\<tau> rho i) \\<le> j\n       \\<and> j \\<le> LTP rho (\\<tau> rho i + n) \\<and> j \\<ge> i\"\n        from \\<tau>_mono have \"\\<tau> rho i + n \\<ge> \\<tau> rho 0\"  by (auto simp add: trans_le_add1)\n        then have jin: \"\\<tau> rho j \\<le> \\<tau> rho i + n\" using j_def i_ltp_to_tau by auto\n        from \\<tau>_mono have j_gei: \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho (i+1)\" by auto\n        from this i_props j_def have \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho i + n\"\n          apply auto\n          by (smt Suc_eq_plus1 diff_is_0_eq' j_gei le_add_diff_inverse le_trans less_imp_le_nat less_nat_zero_code nat_add_left_cancel_le nat_le_linear)\n        then have \"j = i\" using j_def jin apply auto\n          by (metis dual_order.strict_implies_not_eq add_diff_cancel_left' add_diff_cancel_right' i_props j_gei le_antisym le_neq_implies_less less_add_one)\n      } note ** = this\n      moreover\n      {fix li vphis\n        assume bv: \"b = VEventually i li vphis\"\n        have vphis_Nil: \"vphis = []\"\n          using q_val i_props Suc Inr bv i_le_ltpi LTP_lt_delta\n          unfolding valid_def\n          by (auto simp add: Let_def i_etp_to_tau split: if_splits)\n        have li_def: \"li = i\"\n          using q_val Inr bv LTP_lt_delta i_props\n          unfolding valid_def\n          by (auto simp: i_le_ltpi_add vphis_Nil split: if_splits)\n        have \"wqo (Inr (VEventually i i [])) q\"\n          using q_val bv Inr not_wqo\n          by (fastforce simp add: map_idI vphis_Nil li_def)\n        moreover have \"Inr (VEventually i i []) \\<in> set (doEventuallyBase i (left I) p1)\"\n          using i_props Suc\n          unfolding doEventuallyBase_def optimal_def valid_def\n          by (auto split: sum.splits)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            eventuallyBase_sound[OF i_props p1_def] pw_total[of i \"Eventually I phi\"]\n            trans_wqo bv Inr minp\n          apply (simp add: total_on_def)\n          by (metis transpD)\n      }\n      then show ?thesis\n        using Inr q_val\n        unfolding valid_def\n        by (cases b) (auto)\n    qed\n  qed\n  then show False using q_le by auto\nqed\n\nlemma eventually_sound:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\" and\n    p1_def: \"optimal i phi p1\" and\n    p'_def: \"optimal (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n    and p_def: \"p \\<in> set (doEventually i (left I) p1 p')\"\n    and bf: \"bounded_future (Eventually I phi)\"\n    and bf': \"bounded_future (Eventually (subtract (\\<Delta> rho (i+1)) I) phi)\"\n  shows \"valid rho i (Eventually I phi) p\"\nproof (cases p')\n  case (Inl a)\n  then have p'l: \"p' = Inl a\" by auto\n  then have satp': \"sat rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi)\"\n    using soundness[of _ _ \"Eventually (subtract (\\<Delta> rho (i+1)) I) phi\"] p'_def \n      check_sound(1)[of rho \"Eventually (subtract (\\<Delta> rho (i+1)) I) phi\" a]\n    unfolding optimal_def valid_def by auto\n  then obtain q where a_def: \"a = SEventually (i+1) q\" using Inl p'_def\n    unfolding optimal_def valid_def\n    by (cases a) (auto)\n  then have a_val: \"s_check rho (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) a\"\n    using Inl p'_def unfolding optimal_def valid_def by (auto simp: Let_def)\n  then have mem: \"mem (delta rho (s_at q) (i+1)) (subtract (\\<Delta> rho (i+1)) I)\"\n    using a_def Inl p'_def unfolding optimal_def valid_def\n    by (auto simp: Let_def)\n  then have \"left I - \\<Delta> rho (i+1) \\<le> delta rho (s_at q) (i+1) \" by auto\n  then have tmp: \"left I \\<le> \\<tau> rho (i+1) - \\<tau> rho i + (\\<tau> rho (s_at q) - \\<tau> rho (i+1))\"\n    by auto\n  from a_val have qi: \"i+1 \\<le> s_at q\" using a_def p'l p'_def\n    unfolding optimal_def valid_def\n    by (auto simp: Let_def)\n  then have liq: \"left I \\<le> delta rho (s_at q) i\" using diff_add_assoc tmp\n    by simp\n  from bf obtain n where n_def: \"right I = enat n\" by auto\n  from mem n_def have \"enat (delta rho (s_at q) (i+1)) \\<le> enat n - enat (\\<Delta> rho (i+1))\"\n    by simp\n  then have \"delta rho (s_at q) (i+1) + \\<Delta> rho (i+1) \\<le> n\"\n    using i_props n_def by simp\n  then have riq: \"enat (delta rho (s_at q) i) \\<le> right I\" using n_def by simp\n  then show ?thesis\n  proof (cases \"left I = 0\")\n    case True\n    then show ?thesis\n    proof (cases p1)\n      case (Inl a1)\n      then have p1l: \"p1 = Inl a1\" by simp\n      then have sps: \"p = Inl (SEventually i q) \\<or> p = Inl (SEventually i (projl p1))\"\n        using a_def p'l True p_def unfolding doEventually_def optimal_def by auto\n      then show ?thesis\n        using Inl True n_def a_val a_def qi riq p1_def\n        unfolding optimal_def valid_def\n        by auto\n    next\n      case (Inr b2)\n        then have p1r: \"p1 = Inr b2\" by simp\n        then have sp: \"p = Inl (SEventually i q)\"\n          using p1r p_def True p'l a_def unfolding doEventually_def by simp\n        then show ?thesis\n          using Inr Inl True n_def a_def p'_def i_props unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n  next\n    case False\n    then show ?thesis\n    proof (cases p1)\n      case (Inl a1)\n      then have p1l: \"p1 = Inl a1\" by simp\n      then have sp: \"p = Inl (SEventually i q)\"\n        using p1l p_def False p'l a_def unfolding doEventually_def by simp\n      then show ?thesis\n        using Inl False n_def a_def qi liq riq a_val unfolding optimal_def valid_def\n        by (auto simp: Let_def)\n    next\n      case (Inr b2)\n        then have p1r: \"p1 = Inr b2\" by simp\n        then have sp: \"p = Inl (SEventually i q)\"\n          using p1r p_def False p'l a_def unfolding doEventually_def by simp\n        then show ?thesis\n          using Inr False n_def a_def qi liq riq a_val unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n  qed\nnext\n  case (Inr b)\n  then have p'r: \"p' = Inr b\" by auto\n  from bf obtain n where n_def: \"right I = enat n\" by auto\n  then show ?thesis\n  proof (cases b)\n    case (VFF x1)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VAtm x21 x22)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VNeg x3)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VDisj x41 x42)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VConjL x5)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VConjR x6)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VImpl x71 x72)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VIff_sv x81 x82)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VIff_vs x91 x92)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VOnce_le x10)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VOnce x111 x112 x113)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VEventually j hi qs)\n    have hi_def: \"hi = LTP rho (n + \\<tau> rho i)\"\n      using p'_def VEventually i_props Inr n_def\n      unfolding optimal_def valid_def by auto\n    have j_def: \"j = i+1\" using p'r p'_def unfolding optimal_def valid_def VEventually\n      by simp\n    from bf obtain n where n_def: \"right I = enat n\" by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis \n      proof (cases p1)\n          case (Inl a1)\n          then have \"p = Inl (SEventually i (projl p1))\"\n            using p'r VEventually True p_def unfolding doEventually_def\n            by simp\n          then show ?thesis using p1_def i_props Inl True zero_enat_def\n            unfolding optimal_def valid_def by simp\n        next\n          case (Inr b1)\n          then have p1r: \"p1 = Inr b1\" by simp\n          {\n            from i_ge_etpi have b1_ge: \"v_at b1 \\<ge> ETP rho (\\<tau> rho (v_at b1))\"\n            using p1r p1_def\n            unfolding optimal_def valid_def by simp\n          then have nl_def: \"LTP rho (\\<tau> rho i + n) \\<ge> v_at b1 + 1\"\n            using n_def VEventually p'r p'_def p1_def p1r i_props\n            unfolding optimal_def valid_def apply (simp add: Let_def)\n            by (metis add.commute diff_add_assoc diff_add_inverse i_le_ltpi_add le_diff_conv)\n          define l where l_def: \"l \\<equiv> [max (v_at b1+1) (ETP rho (\\<tau> rho (v_at b1+1))) ..< LTP rho (\\<tau> rho i + n)]\"\n          then have l1_def: \"l = [v_at b1+1..< LTP rho (\\<tau> rho i + n)]\" using i_ge_etpi[of rho \"v_at b1 + 1\"]\n            by (simp add: max_def)\n          then have b1_cons: \"(max (v_at b1) (ETP rho (\\<tau> rho (v_at b1)))) # l = v_at b1 # l\"\n            by (simp add: antisym b1_ge max_def)\n          then have \"v_at b1 # l = [max (v_at b1) (ETP rho (\\<tau> rho (v_at b1))) ..< LTP rho (\\<tau> rho i + n)]\"\n            using nl_def l_def b1_ge\n            apply (simp add: antisym b1_cons i_ge_etpi)\n            by (metis less_eq_Suc_le upt_conv_Cons)\n        } note * = this\n        then have \"p = p' \\<oplus> p1\" using p1r p'r VEventually True p_def\n          unfolding doEventually_def by simp\n        then have \"p = Inr (VEventually i hi ((projr p1) # qs))\"\n          using VEventually p'r p1_def p1r i_props j_def\n          unfolding proofApp_def optimal_def valid_def\n          by simp\n        then show ?thesis using * n_def p'_def p1_def p1r p'r VEventually\n              True i_props\n          unfolding optimal_def valid_def\n          by (simp add: Let_def add.commute i_ge_etpi split: if_splits)\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have formp: \"p = Inr (VEventually i hi qs)\"\n            using False p_def p'r VEventually\n            unfolding doEventually_def by simp \n          from p'_def have v_at_qs: \"map v_at qs = [lu rho (i+1) (subtract (\\<Delta> rho (i+1)) I)..< Suc (LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1))))]\"\n            using VEventually p'r n_def unfolding optimal_def valid_def\n            by (auto simp: Let_def)\n          have l_subtract: \"lu rho (i + 1) (subtract (\\<Delta> rho (i+1)) I) = lu rho i I\"\n            using False i_props \n            apply (simp add: max_def i_etp_to_tau etpi_imp_etp_suci)\n            by (smt (verit) diff_add_inverse2 diff_is_0_eq' i_etp_to_tau le_add_diff_inverse le_less_Suc_eq less_le_not_le nle_le)\n        from p'_def have vq: \"(\\<forall>q \\<in> set qs. v_check rho phi q)\"\n          unfolding optimal_def valid_def VEventually p'r\n          by (auto simp: Let_def split: enat.splits)\n        from p'_def i_props have \"i \\<le> LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1)))\"\n          using VEventually p'r n_def i_le_ltpi_add[of i rho n]\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def add.commute)\n        then show ?thesis using False i_props VEventually p'r\n            bf' formp vq v_at_qs[unfolded l_subtract] p'_def n_def\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def add.commute)\n      next\n        case (Inr b1)\n        then have formp: \"p = Inr (VEventually i hi qs)\"\n          using p'r VEventually False p_def \n          unfolding doEventually_def by simp\n        from p'_def have v_at_qs: \"map v_at qs = [lu rho (i+1) (subtract (\\<Delta> rho (i+1)) I)..< Suc (LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1))))]\"\n          using VEventually p'r n_def unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        have l_subtract: \"lu rho (i + 1) (subtract (\\<Delta> rho (i+1)) I) = lu rho i I\"\n          using False i_props \n          apply (simp add: max_def i_etp_to_tau etpi_imp_etp_suci)\n          by (smt (verit) diff_add_inverse2 diff_is_0_eq' i_etp_to_tau le_add_diff_inverse le_less_Suc_eq less_le_not_le nle_le)\n        from p'_def have vq: \"(\\<forall>q \\<in> set qs. v_check rho phi q)\"\n          unfolding optimal_def valid_def VEventually p'r\n          by (auto simp: Let_def split: enat.splits)\n        from p'_def i_props have \"i \\<le> LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1)))\"\n          using VEventually p'r n_def i_le_ltpi_add[of i rho n]\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def add.commute)\n        then show ?thesis using False i_props VEventually p'r\n            bf' formp vq v_at_qs[unfolded l_subtract] p'_def n_def\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def add.commute)\n      qed\n    qed\n  next\n    case (VHistorically x131 x132)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VAlways x131 x132)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by auto\n  next\n    case (VSince x131 x132 x133)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VUntil x141 x142 x143)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VSince_never x151 x152 x153)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VUntil_never x161 x162 x163)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VSince_le x17)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VNext x18)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VNext_ge x19)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VNext_le x20)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VPrev x21a)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VPrev_ge x22a)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case (VPrev_le x23)\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  next\n    case VPrev_zero\n    then show ?thesis using p'r p'_def unfolding optimal_def valid_def by simp\n  qed\nqed\n\nlemma valid_shift_SEventually:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\"\n    and valid: \"valid rho i (Eventually I phi) (Inl (SEventually i p))\"\n    and s_at_p: \"s_at p \\<ge> i + (Suc 0)\"\n    and rfin: \"right I \\<noteq> \\<infinity>\"\n  shows \"valid rho (i + 1) (Eventually (subtract (delta rho (i + 1) i) I) phi) (Inl (SEventually (i + 1) p))\"\nproof -\n  obtain n where rI: \"right I = enat n\"\n    using rfin by (cases \"right I\") auto\n  show ?thesis\n  proof (cases \"left I = 0\")\n    obtain n where rI: \"right I = enat n\"\n      using rfin by (cases \"right I\") auto\n    case True\n    obtain z where p_def: \"p = z\"\n      using valid True \n      unfolding valid_def\n      apply (cases p)\n      by (auto simp add: Let_def i_etp_to_tau i_le_ltpi_add split: if_splits enat.splits)\n    show ?thesis\n      using i_props valid True s_at_p\n      unfolding valid_def\n      by (simp add: le_diff_conv rI split: if_splits enat.splits)\n  next\n    case False\n    show ?thesis\n      using False valid i_props s_at_p\n      unfolding valid_def\n      by (auto simp: Let_def rI)\n  qed\nqed\n\nlemma valid_shift_VEventually:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\"\n    and valid: \"valid rho i (Eventually I phi) (Inr (VEventually i hi ys))\"\n    and rfin: \"right I \\<noteq> \\<infinity>\"\n  shows \"valid rho (i + 1) (Eventually (subtract (delta rho (i + 1) i) I) phi) (Inr (VEventually (i + 1) hi (if left I = 0 then tl ys else ys)))\"\nproof -\n  obtain n where rI: \"right I = enat n\"\n    using rfin by (cases \"right I\") auto\n  show ?thesis\n  proof (cases \"left I = 0\")\n    obtain n where rI: \"right I = enat n\"\n      using rfin by (cases \"right I\") auto\n    case True\n    obtain z zs where ys_def: \"ys = zs @ [z]\"\n      using valid True \n      unfolding valid_def\n      apply (cases ys)\n       apply (simp add: Let_def i_etp_to_tau i_le_ltpi_add split: if_splits enat.splits)\n      by (meson neq_Nil_conv rev_exhaust)\n    show ?thesis\n      using i_props valid True\n      unfolding valid_def\n      apply (simp add: map_tl i_etp_to_tau i_ltp_to_tau i_le_ltpi_add split: if_splits enat.splits)\n      by (metis add.commute list.discI list.set_sel(2) append_is_Nil_conv ys_def)\n  next\n    case False\n    have rw: \"\\<tau> rho i - (left I + \\<tau> rho i - \\<tau> rho (Suc i)) =\n    (if left I + \\<tau> rho i \\<ge> \\<tau> rho (Suc i) then \\<tau> rho (Suc i) - left I else \\<tau> rho i)\"\n      by auto\n    have e: \"right I = enat n \\<Longrightarrow> right (subtract (delta rho (Suc i) i) I) = enat n' \\<Longrightarrow>\n    ETP rho (\\<tau> rho (Suc i) - n) = ETP rho (\\<tau> rho i - n')\" for n n'\n      by auto (metis Suc_eq_plus1 diff_add_inverse2 diff_cancel_middle enat_ord_simps(1) i_props le_diff_conv)\n    have t: \"\\<tau> rho (Suc i) + (left I + \\<tau> rho i - \\<tau> rho (Suc i)) =\n    (if left I + \\<tau> rho i \\<ge> \\<tau> rho (Suc i) then \\<tau> rho i + left I else \\<tau> rho (Suc i))\"\n      by auto\n    have etp: \"max (Suc i) (ETP rho (left I + \\<tau> rho i)) = max i (ETP rho (left I + \\<tau> rho i))\"\n      using False\n      by (auto simp: max_def)\n        (meson add_le_same_cancel2 i_etp_to_tau leD not_less_eq_eq)\n    have ee: \"\\<not> \\<tau> rho (Suc i) \\<le> left I + \\<tau> rho i \\<Longrightarrow> ETP rho (\\<tau> rho i + left I) = Suc i\"\n      by (metis Groups.ab_semigroup_add_class.add.commute Lattices.linorder_class.max.absorb1 etp i_etp_to_tau max_def n_not_Suc_n nat_le_linear)\n    show ?thesis\n      using False valid e i_ge_etpi[of rho \"Suc i\"] ee etp i_props\n      apply (cases ys rule: rev_cases)\n      by (auto simp: valid_def Let_def rw t rI add.commute split: if_splits)\n  qed\nqed\n\nlemma eventually_optimal:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\" \n    and p1_def: \"optimal i phi p1\"\n    and p'_def: \"optimal (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n    and bf: \"bounded_future (Eventually I phi)\"\n    and bf': \"bounded_future (Eventually (subtract (\\<Delta> rho (i+1)) I) phi)\"\n  shows \"optimal i (Eventually I phi) (min_list_wrt wqo (doEventually i (left I) p1 p'))\"\nproof (rule ccontr)\n  define minp where minp: \"minp \\<equiv> min_list_wrt wqo (doEventually i (left I) p1 p')\"\n  from bf have bfphi: \"bounded_future phi\" by auto\n  from bf obtain n where n_def: \"right I = enat n\" by auto\n  from pw_total[of i \"Eventually I phi\"]\n  have total_set: \"total_on wqo (set (doEventually i (left I) p1 p'))\"\n    using eventually_sound[OF i_props p1_def p'_def _ bf bf']\n    by (metis not_wqo total_onI)\n  define hi where \"hi = (case right I - enat (delta rho (i + Suc 0) i) of enat n \\<Rightarrow> LTP rho (\\<tau> rho (Suc i) + n))\"\n  have rfin: \"right I \\<noteq> \\<infinity>\" \"right I - enat (delta rho (i + Suc 0) i) \\<noteq> \\<infinity>\"\n    using bf by auto\n  have hi: \"hi = (case right I of enat n \\<Rightarrow> LTP rho (\\<tau> rho i + n) | \\<infinity> \\<Rightarrow> 0)\"\n    using i_props rfin\n    by (auto simp: hi_def add.commute split: enat.splits)\n  from p'_def have p'_form: \"(\\<exists>p. p' = Inl (SEventually (i+1) p)) \\<or>\n    (\\<exists>ps. p' = Inr (VEventually (i+1) hi ps))\"\n  proof(cases \"SAT rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi)\")\n    case True\n    then obtain a' where a'_def: \"p' = Inl a'\"\n      using val_SAT_imp_l[OF bf'] p'_def\n      unfolding optimal_def\n      by force\n    then show ?thesis\n      using val_SAT_imp_l[OF bf', of \"i+1\" p'] p'_def\n      unfolding optimal_def valid_def\n      by (cases a') (auto simp: hi_def)\n  next\n    case False\n    then have VIO: \"VIO rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi)\"\n      using SAT_or_VIO by auto\n    then obtain b' where b'_def: \"p' = Inr b'\"\n      using val_VIO_imp_r[OF bf'] p'_def\n      unfolding optimal_def\n      by force\n    then show ?thesis\n      using p'_def val_SAT_imp_l[OF bf', of \"i+1\" p']\n      unfolding optimal_def valid_def\n      by (cases b') (auto simp: hi_def)\n  qed\n  from doEventually_def[of i \"left I\" p1 p'] p'_form\n  have nnil: \"doEventually i (left I) p1 p' \\<noteq> []\"\n    by (cases p1; cases \"left I\"; cases p'; auto)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doEventually i (left I) p1 p'). wqo x y) (doEventually i (left I) p1 p') \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doEventually i (left I) p1 p'). wqo x y)\" \"(doEventually i (left I) p1 p')\"]\n    by simp\n  assume nopt: \"\\<not> optimal i (Eventually I phi) minp\"\n  from eventually_sound[OF i_props p1_def p'_def min_list_wrt_in]\n    total_set trans_wqo refl_wqo nnil minp i_props bf'\n  have vmin: \"valid rho i (Eventually I phi) minp\"\n    unfolding valid_def optimal_def\n    apply (simp add: Let_def split: if_splits sum.splits enat.splits)\n    by fastforce+\n  then obtain q where q_val: \"valid rho i (Eventually I phi) q\" and\n    q_le: \"\\<not> wqo minp q\" using minp nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inl a)\n    then have q_s: \"q = Inl a\" by auto\n    then have SATs: \"SAT rho i (Eventually I phi)\" using q_val check_sound(1)\n      unfolding valid_def by auto\n    then have sats: \"sat rho i (Eventually I phi)\" using soundness\n      by blast\n    from Inl obtain sphi where a_def: \"a = SEventually i sphi\"\n      using q_val unfolding valid_def by (cases a) auto\n    then have valphi: \"valid rho (s_at sphi) phi (Inl sphi)\" using q_val Inl\n      unfolding valid_def by (auto simp: Let_def)\n    from q_val Inl a_def n_def\n    have sphi_bounds: \"s_at sphi \\<le> LTP rho (\\<tau> rho i + n) \\<and> s_at sphi \\<ge> i\"\n      unfolding valid_def\n      apply (simp add: Let_def)\n      by (metis add.commute i_le_ltpi_add le_Suc_ex le_diff_conv)\n    from valphi val_SAT_imp_l[OF bf] SATs have check_sphi: \"s_check rho phi sphi\"\n      unfolding valid_def by auto\n    then show ?thesis\n    proof (cases p')\n      case (Inl a')\n      then have p'l: \"p' = Inl a'\" by simp\n      then obtain sphi' where a'_def: \"a' = SEventually (i+1) sphi'\"\n        using p'_def unfolding optimal_def valid_def\n        by (cases a') auto\n      from SATs vmin have minl: \"\\<exists>a. minp = Inl a\" using minp val_SAT_imp_l[OF bf]\n        by auto\n      from p'_def have p'_val: \"valid rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n        unfolding optimal_def by auto\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = min_list_wrt wqo [Inl (SEventually i sphi'), Inl (SEventually i a1)]\"\n            using p1l p'l True a'_def minp filter_nnil\n            unfolding doEventually_def \n            by (cases p1) auto\n          show ?thesis\n          proof (cases \"s_at sphi = i\")\n            case sphi_i: True\n            have \"wqo (Inl (SEventually i a1)) q\"\n              using SEventually a_def optimal_def p1_def p1l sphi_i valphi q_s\n              unfolding optimal_def valid_def by auto\n            then show ?thesis\n              using q_s a_def pw_total[of i \"Eventually I phi\"]\n                eventually_sound[OF i_props p1_def p'_def] p'l a'_def p1l True\n                bf bf'\n              unfolding form doEventually_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          next\n            case False\n            have incr: \"checkIncr (Inl (SEventually (i+1) sphi'))\" \"checkIncr (Inl (SEventually (i+1) sphi))\"\n              using p'l a'_def False sphi_bounds p'_def\n              unfolding optimal_def valid_def\n              by (auto simp: Let_def intro!: checkIncr.intros)\n            have valid: \"valid rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) (Inl (SEventually (i+1) sphi))\"\n              using False valid_shift_SEventually a_def i_props q_s q_val sphi_bounds n_def\n              by (auto simp: Let_def)\n            have wqo: \"wqo (Inl (SEventually (i+1) sphi')) (Inl (SEventually (i+1) sphi))\"\n              using valphi p'_def p'l a'_def a_def valid\n              unfolding optimal_def valid_def\n              by (simp add: Let_def split: sum.split)\n            from proofIncr_mono[OF incr wqo p'_val[unfolded p'l a'_def] valid] have \"wqo (Inl (SEventually i sphi')) q\"\n              unfolding q_s a_def using i_props\n              by (auto simp add: Let_def proofIncr_def)\n            then show ?thesis\n              using q_s a_def pw_total[of i \"Eventually I phi\"]\n                eventually_sound[OF i_props p1_def p'_def] p'l a'_def p1l True bfphi n_def\n              unfolding form doEventually_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          qed\n        next\n          case False\n          have form: \"minp = min_list_wrt wqo [Inl (SEventually i sphi')]\"\n            using p1l p'l False a'_def minp filter_nnil\n            unfolding doEventually_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have sphi_g_i: \"s_at sphi > i\"\n            using False a_def q_s q_val soundness check_sound(1) le_eq_less_or_eq \n            unfolding valid_def \n            by (auto simp add: Let_def  split: sum.splits)\n          have incr: \"checkIncr (Inl (SEventually (i+1) sphi'))\" \"checkIncr (Inl (SEventually (i+1) sphi))\"\n            using p'l a'_def False sphi_bounds p'_def Suc_le_eq sphi_g_i\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def intro!: checkIncr.intros split: sum.splits)\n          have valid: \"valid rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) (Inl (SEventually (i+1) sphi))\"\n            using False valid_shift_SEventually a_def i_props q_s q_val sphi_bounds sphi_g_i n_def by simp\n          have wqo: \"wqo (Inl (SEventually (i+1) sphi')) (Inl (SEventually (i+1) sphi))\"\n            using valphi p'_def p'l a'_def a_def valid\n            unfolding optimal_def valid_def\n            by (simp add: Let_def split: sum.split)\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'l a'_def] valid] have \"wqo (Inl (SEventually i sphi')) q\"\n            unfolding q_s a_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_s a_def pw_total[of i \"Eventually I phi\"]\n                eventually_sound[OF i_props p1_def p'_def] p'l a'_def p1l False\n            unfolding form doEventually_def\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        qed\n      next\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          have form: \"minp = min_list_wrt wqo [Inl (SEventually i sphi')]\"\n            using p1r p'l True a'_def minp filter_nnil\n            unfolding doEventually_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have sphi_g_i: \"s_at sphi > i\"\n            using True a_def q_s q_val p1r bfphi check_sound(1) p1_def val_SAT_imp_l check_consistent linorder_not_le\n            unfolding valid_def optimal_def\n            apply (simp add: Let_def split: sum.splits)\n            by fastforce\n          have incr: \"checkIncr (Inl (SEventually (i+1) sphi'))\" \"checkIncr (Inl (SEventually (i+1) sphi))\"\n            using p'l a'_def True sphi_bounds p'_def Suc_le_eq sphi_g_i\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def intro!: checkIncr.intros split: sum.splits)\n          have valid: \"valid rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) (Inl (SEventually (i+1) sphi))\"\n            using True valid_shift_SEventually a_def i_props q_s q_val sphi_bounds sphi_g_i n_def by simp\n          have wqo: \"wqo (Inl (SEventually (i+1) sphi')) (Inl (SEventually (i+1) sphi))\"\n            using valphi p'_def p'l a'_def a_def valid\n            unfolding optimal_def valid_def\n            by (simp add: Let_def split: sum.split)\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'l a'_def] valid] have \"wqo (Inl (SEventually i sphi')) q\"\n            unfolding q_s a_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_s a_def pw_total[of i \"Eventually I phi\"]\n                eventually_sound[OF i_props p1_def p'_def] p'l a'_def p1r True\n            unfolding form doEventually_def\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n          next\n            case False\n            have form: \"minp = min_list_wrt wqo [Inl (SEventually i sphi')]\"\n            using p1r p'l False a'_def minp filter_nnil\n            unfolding doEventually_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have sphi_g_i: \"s_at sphi > i\"\n            using False a_def q_s q_val soundness check_sound(1) le_eq_less_or_eq \n            unfolding valid_def \n            by (auto simp add: Let_def  split: sum.splits)\n          have incr: \"checkIncr (Inl (SEventually (i+1) sphi'))\" \"checkIncr (Inl (SEventually (i+1) sphi))\"\n            using p'l a'_def False sphi_bounds p'_def Suc_le_eq sphi_g_i\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def intro!: checkIncr.intros split: sum.splits)\n          have valid: \"valid rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) (Inl (SEventually (i+1) sphi))\"\n            using False valid_shift_SEventually a_def i_props q_s q_val sphi_bounds sphi_g_i n_def by simp\n          have wqo: \"wqo (Inl (SEventually (i+1) sphi')) (Inl (SEventually (i+1) sphi))\"\n            using valphi p'_def p'l a'_def a_def valid\n            unfolding optimal_def valid_def\n            by (simp add: Let_def split: sum.split)\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'l a'_def] valid] have \"wqo (Inl (SEventually i sphi')) q\"\n            unfolding q_s a_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_s a_def pw_total[of i \"Eventually I phi\"]\n                eventually_sound[OF i_props p1_def p'_def] p'l a'_def p1r False\n            unfolding form doEventually_def\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        qed\n      qed\n    next\n      case (Inr b')\n      then have p'r: \"p' = Inr b'\" by simp\n      then obtain vphis' where b'_def: \"b' = VEventually (i+1) hi vphis'\"\n        using p'_def doEventually_def p'_form by auto\n      from p'_def have p'_val: \"valid rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n        unfolding optimal_def by auto\n      then show ?thesis\n      proof (cases p1)\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = min_list_wrt wqo [Inl (SEventually i a1)]\"\n            using p1l p'r True b'_def minp filter_nnil\n            unfolding doEventually_def \n            by (cases p1) (auto)\n          show ?thesis\n          proof (cases \"s_at sphi = i\")\n            case sphi_i: True\n            have \"wqo (Inl (SEventually i a1)) q\"\n              using SEventually a_def optimal_def p1_def p1l sphi_i valphi q_s\n              unfolding optimal_def valid_def by auto\n            then show ?thesis\n              using q_s a_def pw_total[of i \"Eventually I phi\"]\n                eventually_sound[OF i_props p1_def p'_def] p1l True\n              unfolding form doOnce_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          next\n            case False\n            have sphi_g_i: \"s_at sphi > i\"\n              using False a_def q_s q_val p1l sphi_bounds \n              unfolding valid_def by simp\n            then have wqo_p1: \"wqo (Inl a1) (Inl sphi)\" \n              using p1_def Inl True valphi p'_def p'r q_s q_val \n              unfolding optimal_def apply simp\n              by (metis Inr_Inl_False trans_wqo.valid_shift_SEventually One_nat_def SAT_or_VIO Suc_eq_plus1 Suc_leI a_def bf' diff_Suc_1 i_props rfin(1) trans_wqo_axioms val_SAT_imp_l val_VIO_imp_r)\n            have \"wqo (Inl (SEventually i a1)) q\"\n              using q_s a_def SEventually[OF wqo_p1] by auto\n            then show ?thesis\n              using q_s a_def pw_total[of i \"Eventually I phi\"]\n                eventually_sound[OF i_props p1_def p'_def] p1l True\n              unfolding form doEventually_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          qed\n        next\n          case False\n          then have form: \"minp = Inr (VEventually i hi vphis')\"\n            using b'_def Inl minp Inr filter_nnil unfolding doEventually_def\n            by (cases p1) (auto simp: min_list_wrt_def split: enat.splits)\n          then show ?thesis\n            using q_s a_def valphi p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split)\n            using SATs val_SAT_imp_l[OF bf] vmin by auto\n        qed\n      next\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by simp\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = (p' \\<oplus> p1)\"\n            using p'r b'_def Inl minp Inr filter_nnil val_VIO_imp_r[OF bf vmin]\n            unfolding doEventually_def \n            by (cases p1) (auto simp add: min_list_wrt_def split: sum.split)\n          have form_algo: \"doEventually i (left I) p1 p' = [(p' \\<oplus> p1)]\"\n            using p1r p'r True b'_def unfolding doEventually_def by auto\n          have check_p: \"checkApp p' p1\"\n            using valid_checkApp_VEventually[of i I phi li vphis']\n              p'r p1r b'_def True p1_def p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split if_splits)\n             apply (metis (no_types, lifting) checkApp.intros(8) Nil_is_append_conv map_is_Nil_conv not_Cons_self2)\n            using b'_def diff_0_eq_0 p'_val subtract_simps(1) valid_checkApp_VEventually by presburger\n          have p_val: \"valid rho i (Eventually I phi) (p' \\<oplus> p1)\"\n            using p'r b'_def p1r vmin form eventually_sound[OF i_props p1_def p'_def]\n            by auto\n          then have p_optimal: \"optimal i (Eventually I phi) (p' \\<oplus> p1)\"\n            using p'r b'_def p1r vmin form check_p \n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: if_split sum.split)\n            using SATs val_SAT_imp_l[OF bf vmin] vmin by blast\n          then show ?thesis using form check_p p_val p'r b'_def p1r vmin q_s nopt p_optimal\n            unfolding optimal_def valid_def\n            by blast \n        next\n          case False\n          then have form: \"minp = Inr (VEventually i hi vphis')\"\n            using p'r b'_def Inl minp Inr filter_nnil unfolding doEventually_def\n            by (cases p1) (auto simp: min_list_wrt_def split: enat.splits)\n          then show ?thesis\n            using q_s a_def valphi p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split)\n            using SATs val_SAT_imp_l[OF bf] vmin by auto\n        qed\n      qed\n    qed\n  next\n    case (Inr b)\n    then have qr: \"q = Inr b\" by simp\n    then have VIO: \"VIO rho i (Eventually I phi)\"\n      using q_val check_sound(2)[of rho \"Eventually I phi\" b]\n      unfolding valid_def by simp\n    then have formb: \"\\<exists>ps. b = VEventually i hi ps\"\n      using Inr q_val i_props unfolding valid_def by (cases b) (auto simp: hi)\n    moreover\n    {fix hi' ps\n      assume bv: \"b = VEventually i hi' ps\"\n      have hi'_def: \"hi' = hi\"\n        using q_val\n        by (auto simp: Inr bv valid_def hi)\n      have \"wqo minp q\"\n        using bv\n      proof (cases p')\n        case (Inl a')\n        then obtain p1' where a's: \"a' = SEventually (i+1) p1'\"\n          using p'_def\n          unfolding optimal_def valid_def\n          by (cases a') auto\n        from bv qr have mapt: \"map v_at ps = [lu rho i I  ..< Suc (LTP rho (\\<tau> rho i + n))]\"\n          using n_def bv qr q_val unfolding valid_def by simp\n        then have ps_check: \"\\<forall>p \\<in> set ps. v_check rho phi p\"\n          using bv qr q_val unfolding valid_def\n          by (auto simp: Let_def)\n        then have jc: \"\\<forall>j \\<in> set (map v_at ps). \\<exists>p. v_at p = j \\<and> v_check rho phi p\"\n          using map_set_in_imp_set_in[OF ps_check] by auto\n        then have sp1'_bounds: \"lu rho i I \\<le> s_at p1' \\<and> s_at p1' \\<le> LTP rho (\\<tau> rho i + n)\"\n          using a's Inl p'_def i_props n_def\n          unfolding optimal_def valid_def\n          apply (simp add: Let_def add.commute i_etp_to_tau le_diff_conv i_le_ltpi_add split: sum.splits)\n          by (metis i_le_ltpi_add le_add_diff_inverse)\n        from sp1'_bounds have p1'_in: \"s_at p1' \\<in> set (map v_at ps)\" using mapt\n          by (auto split: if_splits)\n        from a's Inl have \"s_check rho phi p1'\" using p'_def\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        then have False using jc p1'_in check_consistent[OF bfphi] by auto\n        then show ?thesis by simp\n      next\n        case (Inr b')\n        then have p'b': \"p' = Inr b'\" by simp\n        then have b'v: \"(\\<exists>ps. b' = VEventually (i+1) hi ps)\"\n          using Inr p'_def \n          unfolding optimal_def valid_def \n          by (cases b') (auto simp: hi_def)\n        moreover\n        {fix hi'' vphis'\n          assume b'v: \"b' = VEventually (i+1) hi'' vphis'\"\n          have hi''_def: \"hi'' = hi\"\n            using p'_def\n            unfolding optimal_def valid_def\n            by (simp add: b'v Inr hi_def)\n          have \"wqo minp q\"\n            using b'v\n          proof (cases p1)\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inl (SEventually i (projl p1))\"\n                using Inl p'b' b'v minp val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doEventually_def \n                by (cases p1) (auto simp: min_list_wrt_def)\n              then obtain p1' where p1l: \"p1 = Inl p1'\"\n                using True b'v Inl minp Inr val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                by (cases p1; auto simp: min_list_wrt_def split: if_splits)\n              then show ?thesis\n                using form VIO bf val_VIO_imp_r vmin\n                unfolding optimal_def valid_def\n                by blast\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inr (VEventually i hi vphis')\"\n                using b'v Inl minp Inr filter_nnil unfolding doEventually_def\n                by (cases p1) (auto simp: min_list_wrt_def hi''_def)\n              have valid_q_after: \"valid rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) (Inr (VEventually (i+1) hi' ps))\"\n                using valid_shift_VEventually[of i I phi hi' ps] i_props q_val False n_def qr bv \n                unfolding valid_def optimal_def\n                apply (simp split: if_splits)\n                by force\n              then have \"wqo p' (Inr (VEventually (i+1) hi' ps))\" using p'_def\n                unfolding optimal_def by auto\n              moreover have \"checkIncr p'\"\n                using p'_def\n                unfolding p'b' b'v\n                by (auto simp: optimal_def intro!: valid_checkIncr_VEventually)\n              moreover have \"checkIncr (Inr (VEventually (i+1) hi' ps))\"\n                using valid_q_after\n                by (auto intro!: valid_checkIncr_VEventually)\n              ultimately show ?thesis\n                using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VEventually (i+1) hi' ps)\"]\n                      valid_q_after p'b'\n                unfolding valid_def optimal_def\n                by (auto simp add: proofIncr_def hi''_def b'v bv form qr)\n            qed\n          next\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              (* case True\n              then have form_min: \"minp = p' \\<oplus> p1\" using Inr b'v p'b' minp\n                  val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doEventually_def \n                by (cases p1) (auto simp: min_list_wrt_def)\n              then obtain p1' where p1r: \"p1 = Inr p1'\"\n                using True b'v Inr minp Inr val_VIO_imp_r[OF bf vmin VIO]\n                  filter_nnil\n                by (cases p1; auto simp: min_list_wrt_def split: if_splits)\n              from vmin form_min p1r have p_val: \"valid rho i (Eventually I phi) (p' \\<oplus> (Inr p1'))\"\n                by auto\n              then have check_p: \"checkApp p' (Inr p1')\"\n                using p'_def True\n                unfolding p1r b'v p'b'\n                by (auto simp: optimal_def intro!: valid_checkApp_VEventually)\n              then show ?thesis *)\n              case True\n              then have form_min: \"minp = p' \\<oplus> p1\" using Inr b'v p'b' minp\n                  val_VIO_imp_r[OF bf vmin VIO] filter_nnil\n                unfolding doEventually_def \n                by (cases p1) (auto simp: min_list_wrt_def)\n              then obtain p1' where p1r: \"p1 = Inr p1'\"\n                using True b'v Inr minp Inr val_VIO_imp_r[OF bf vmin VIO]\n                  filter_nnil\n                unfolding doEventually_def\n                by (cases p1; auto simp: min_list_wrt_def split: if_splits)\n              then show ?thesis\n                using form_min qr bv Inr p1_def q_val i_le_ltpi_add unfolding optimal_def valid_def\n                apply (cases ps)\n                 apply (auto simp add: Let_def True i_ltp_to_tau i_etp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems for y ys\n                proof -\n                  from vmin form_min p1r have p_val: \"valid rho i (Eventually I phi) (p' \\<oplus> (Inr p1'))\"\n                    by auto\n                  have check_p: \"checkApp p' (Inr p1')\"\n                    using p'_def True\n                    unfolding p1r b'v p'b'\n                    by (auto simp: optimal_def intro!: valid_checkApp_VEventually)\n                  from prems have y_val: \"valid rho i phi (Inr y)\"\n                    using q_val True i_props n_def i_ge_etpi[of rho i]\n                    unfolding valid_def\n                    apply (simp add: Cons_eq_append_conv split: if_splits)\n                    by (metis Cons_eq_upt_conv bot_nat_0.extremum le_antisym)\n                  have val_q': \"valid rho (i + 1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) (Inr (VEventually (i+1) hi' ys))\"\n                    using valid_shift_VEventually[of i I phi hi' ps] i_props q_val True prems(9) n_def\n                    by (auto simp: qr bv)\n                  then have q_val2: \"valid rho i (Eventually I phi) ((Inr (VEventually (i+1) hi' ys)) \\<oplus> (Inr y))\"\n                    using q_val prems i_props by auto\n                  have check_q: \"checkApp (Inr (VEventually (i+1) hi' ys)) (Inr y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_VEventually)\n                  from p'_def have wqo_p': \"wqo p' (Inr (VEventually (i+1) hi' ys))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p1: \"wqo p1 (Inr y)\" using i_props p1_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    using p'b' b'v q_val prems unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' _ p_val q_val2]\n                    by auto\n                qed\n                done\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inr (VEventually i hi vphis')\"\n                using b'v Inr minp Inr filter_nnil p'b' unfolding doEventually_def\n                by (cases p1) (auto simp: min_list_wrt_def hi''_def split: if_splits sum.splits)\n              have valid_q_after: \"valid rho (i+1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi) (Inr (VEventually (i+1) hi' ps))\"\n                using valid_shift_VEventually[of i I phi hi' ps] i_props q_val False n_def qr bv p'b'\n                unfolding valid_def optimal_def\n                apply (simp split: if_splits)\n                by force\n              then have \"wqo p' (Inr (VEventually (i+1) hi' ps))\" using p'_def\n                unfolding optimal_def by auto\n              moreover have \"checkIncr p'\"\n                using p'_def\n                unfolding p'b' b'v\n                by (auto simp: optimal_def intro!: valid_checkIncr_VEventually)\n              moreover have \"checkIncr (Inr (VEventually (i+1) hi' ps))\"\n                using valid_q_after\n                by (auto intro!: valid_checkIncr_VEventually)\n              ultimately show ?thesis\n                using proofIncr_mono[OF _ _ _ p'_val, of \"Inr (VEventually (i+1) hi' ps)\"]\n                      valid_q_after p'b'\n                unfolding valid_def optimal_def\n                by (auto simp add: proofIncr_def hi''_def b'v bv form qr)\n            qed\n          qed\n        }\n        then show ?thesis using b'v by blast\n      qed\n    }\n    then show ?thesis using formb by blast\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Always\\<close>\n\nlemma valid_checkApp_SAlways: \"valid rho j (Always I phi) (Inl (SAlways j hi sphis')) \\<Longrightarrow>\n  left I = 0 \\<or> (case right I of \\<infinity> \\<Rightarrow> True | enat n \\<Rightarrow> ETP rho (\\<tau> rho j + left I) \\<le> LTP rho (\\<tau> rho j + n)) \\<Longrightarrow>\n  checkApp (Inl (SAlways j hi sphis')) (Inl p1')\"\n  apply (intro checkApp.intros)\n  apply (simp add: valid_def Let_def i_etp_to_tau i_le_ltpi_add split: if_splits enat.splits)\n  by force\n\nlemma valid_checkIncr_SAlways: \"valid rho j phi (Inl (SAlways j hi sphis')) \\<Longrightarrow>\n  checkIncr (Inl (SAlways j hi sphis'))\"\n  apply (cases phi)\n  apply (auto simp: valid_def Let_def split: if_splits enat.splits dest!: arg_cong[where ?x=\"map _ _\" and ?f=set] intro!: checkIncr.intros)\n  apply (drule imageI[where ?A=\"set sphis'\" and ?f=s_at])\n  apply auto\n  done\n\nlemma alwaysBase_sound:\n  assumes i_props: \"right I < enat (\\<Delta> rho (i+1))\" and\n    p1_def: \"optimal i phi p1\" and\n    p_def: \"p \\<in> set (doAlwaysBase i (left I) p1)\"\n  shows \"valid rho i (Always I phi) p\"\nproof(cases \"left I = 0\")\n  case True\n  then show ?thesis\n  proof (cases p1)\n    case (Inr b)\n    then have \"p = Inr (VAlways i b)\" \n      using p_def True\n      unfolding doAlwaysBase_def by simp\n    then show ?thesis \n      using True i_props p1_def zero_enat_def Inr\n      unfolding optimal_def valid_def by auto\n  next\n    case (Inl a)\n    then have \"p = Inl (SAlways i i [a])\" \n      using p_def True\n      unfolding doAlwaysBase_def by simp\n    then show ?thesis \n      using True i_props p1_def Inl i_ge_etpi[of rho i]\n          LTP_lt_delta enat_iless\n      unfolding optimal_def valid_def\n      by (auto simp: Let_def split: enat.splits)\n  qed\nnext\n  case False\n  then show ?thesis\n  proof (cases p1)\n    case (Inr b)\n    then have \"p = Inl (SAlways i i [])\"\n      using p_def False\n      unfolding doAlwaysBase_def by simp\n    then show ?thesis \n      using False i_props p1_def Inr i_ge_etpi[of rho i]\n          LTP_lt_delta enat_iless \n      unfolding optimal_def valid_def\n      by (auto simp: Let_def i_etp_to_tau split: enat.splits)\n  next\n    case (Inl a)\n    then have \"p = Inl (SAlways i i [])\"\n      using p_def False\n      unfolding doAlwaysBase_def by simp\n    then show ?thesis \n      using False i_props p1_def Inl i_ge_etpi[of rho i]\n          LTP_lt_delta enat_iless \n      unfolding optimal_def valid_def\n      by (auto simp: Let_def i_etp_to_tau split: enat.splits)\n  qed\nqed\n\nlemma alwaysBase_optimal:\n  assumes bf: \"bounded_future (Always I phi)\" and\n    i_props: \"right I < enat (\\<Delta> rho (i+1))\" and p1_def: \"optimal i phi p1\"\n  shows \"optimal i (Always I phi) (min_list_wrt wqo (doAlwaysBase i (left I) p1))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  from doAlwaysBase_def[of i \"left I\" p1]\n  have nnil: \"doAlwaysBase i (left I) p1 \\<noteq> []\"\n    by (cases p1; cases \"left I\"; auto)\n  from pw_total[of i \"Always I phi\"] have total_set: \"total_on wqo (set (doAlwaysBase i (left I) p1))\"\n    using alwaysBase_sound[OF i_props p1_def]\n    by (metis not_wqo total_onI)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doAlwaysBase i (left I) p1). wqo x y) (doAlwaysBase i (left I) p1) \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doAlwaysBase i (left I) p1). wqo x y)\" \"(doAlwaysBase i (left I) p1)\"]\n    by simp\n  {assume vio: \"VIO rho i (Always I phi)\"\n    then have nsata: \"\\<not> sat rho i (Always I phi)\" using soundness\n      by blast\n    then have \"\\<not> sat rho i phi\" using i_props r_less_imp_nphi nat_less_le\n      by auto\n    then have \"left I = 0\" using nsata sat_Always_rec[of rho i I phi] i_props\n      by auto\n  } note * = this\n  define minp where minp: \"minp \\<equiv> (min_list_wrt wqo (doAlwaysBase i (left I) p1))\"\n  assume nopt: \"\\<not> optimal i (Always I phi) minp\"\n  from alwaysBase_sound[OF i_props p1_def min_list_wrt_in[of _ wqo]]\n    refl_wqo trans_wqo pw_total minp nnil\n  have vmin: \"valid rho i (Always I phi) minp\"\n    by (auto simp add: total_set)\n  then obtain q where q_val: \"valid rho i (Always I phi) q\" and\n    q_le: \"\\<not> wqo minp q\" using nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inr b)\n    then obtain vphiq where vq: \"b = VAlways i vphiq\" using q_val\n      unfolding valid_def by (cases b) auto\n    from q_val have vioa: \"VIO rho i (Always I phi)\" \n      using check_sound Inr vq SAT_VIO.VAlways\n      unfolding valid_def optimal_def \n      apply (simp add: Let_def split: sum.splits)\n      by blast\n    from vq have p_val: \"valid rho i phi (Inr vphiq)\" \n      using q_val Inr i_props r_less_imp_nphi \n      unfolding valid_def \n      by (auto simp: Let_def diff_add_inverse2 le_eq_less_or_eq)\n    then have p1_le: \"wqo p1 (Inr vphiq)\" using p1_def unfolding optimal_def\n      by simp\n    obtain p1' where p1'_def: \"p1 = Inr p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inr (VAlways i (projr p1))) q\"\n      using VAlways[OF p1_le[unfolded p1'_def]] vq Inr\n      by (fastforce simp add: p1'_def map_idI)\n    moreover have \"Inr (VAlways i (projr p1)) \\<in> set (doAlwaysBase i (left I) p1)\"\n      using assms check_consistent[of phi] vioa * p_val\n      unfolding doAlwaysBase_def optimal_def valid_def\n      by (auto split: sum.splits)\n    ultimately show ?thesis using min_list_wrt_le[OF _ refl_wqo]\n        alwaysBase_sound[OF i_props p1_def] pw_total[of i \"Always I phi\"]\n        trans_wqo Inr minp\n      apply (simp add: total_on_def)\n      by (metis transpD)\n  next\n    case (Inl a)\n    then show ?thesis\n    proof (cases \"left I\")\n      {fix n j\n        assume j_def: \"right I = enat n \\<and> ETP rho (\\<tau> rho i) \\<le> j\n       \\<and> j \\<le> LTP rho (\\<tau> rho i + n) \\<and> j \\<ge> i\"\n        from \\<tau>_mono have \"\\<tau> rho i + n \\<ge> \\<tau> rho 0\"  by (auto simp add: trans_le_add1)\n        then have jin: \"\\<tau> rho j \\<le> \\<tau> rho i + n\" using j_def i_ltp_to_tau by auto\n        from \\<tau>_mono have j_gei: \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho (i+1)\" by auto\n        from this i_props j_def have \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho i + n\"\n          apply auto\n          by (smt Suc_eq_plus1 diff_is_0_eq' j_gei le_add_diff_inverse le_trans less_imp_le_nat less_nat_zero_code nat_add_left_cancel_le nat_le_linear)\n        then have \"j = i\" using j_def jin apply auto\n          by (metis dual_order.strict_implies_not_eq add_diff_cancel_left' add_diff_cancel_right' i_props j_gei le_antisym le_neq_implies_less less_add_one)\n      } note ** = this\n      case 0\n      {fix sphi\n        assume as: \"a = SAlways i i [sphi]\"\n        then have a_val: \"valid rho i phi (Inl sphi)\"\n          using q_val Inl\n          unfolding valid_def\n          by (auto simp: Let_def split: if_splits enat.splits)\n        then have p1_wqo: \"wqo p1 (Inl sphi)\"\n          using a_val p1_def unfolding optimal_def\n          by auto\n        obtain p1' where p1'_def: \"p1 = Inl p1'\"\n          using a_val p1_def check_consistent[OF bf_phi]\n          by (auto simp add: optimal_def valid_def split: sum.splits)\n        have \"wqo (Inl (SAlways i i [p1'])) q\"\n          using as Inl SAlways p1_wqo\n          by (auto simp add: p1'_def)\n        moreover have \"Inl (SAlways i i [p1']) \\<in> set (doAlwaysBase i (left I) p1)\"\n          using a_val \"0\"\n          unfolding doAlwaysBase_def\n          by (auto split: sum.splits simp: p1'_def)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            alwaysBase_sound[OF i_props p1_def] pw_total[of i \"Always I phi\"]\n            trans_wqo as Inl minp \n          apply (simp add: total_on_def)\n          by (metis transpD)\n      }\n      then show ?thesis using minp Inl \"0\" q_val ** i_props LTP_lt_delta i_ge_etpi\n        unfolding valid_def\n        apply (cases a)\n                            apply (auto simp add: i_le_ltpi_add Let_def split: if_splits)\n        by blast\n    next\n      case (Suc nat)\n      {fix n j\n        assume j_def: \"right I = enat n \\<and> ETP rho (\\<tau> rho i) \\<le> j\n       \\<and> j \\<le> LTP rho (\\<tau> rho i + n) \\<and> j \\<ge> i\"\n        from \\<tau>_mono have \"\\<tau> rho i + n \\<ge> \\<tau> rho 0\"  by (auto simp add: trans_le_add1)\n        then have jin: \"\\<tau> rho j \\<le> \\<tau> rho i + n\" using j_def i_ltp_to_tau by auto\n        from \\<tau>_mono have j_gei: \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho (i+1)\" by auto\n        from this i_props j_def have \"\\<forall>j > i. \\<tau> rho j \\<ge> \\<tau> rho i + n\"\n          apply auto\n          by (smt Suc_eq_plus1 diff_is_0_eq' j_gei le_add_diff_inverse le_trans less_imp_le_nat less_nat_zero_code nat_add_left_cancel_le nat_le_linear)\n        then have \"j = i\" using j_def jin apply auto\n          by (metis dual_order.strict_implies_not_eq add_diff_cancel_left' add_diff_cancel_right' i_props j_gei le_antisym le_neq_implies_less less_add_one)\n      } note ** = this\n      moreover\n      {fix li sphis\n        assume as: \"a = SAlways i li sphis\"\n        have sphis_Nil: \"sphis = []\"\n          using q_val i_props Suc Inl as i_le_ltpi LTP_lt_delta\n          unfolding valid_def\n          by (auto simp add: Let_def i_etp_to_tau split: if_splits)\n        have li_def: \"li = i\"\n          using q_val Inl as LTP_lt_delta i_props\n          unfolding valid_def\n          by (auto simp: i_le_ltpi_add sphis_Nil split: if_splits)\n        have \"wqo (Inl (SAlways i i [])) q\"\n          using q_val as Inl not_wqo\n          by (fastforce simp add: map_idI sphis_Nil li_def)\n        moreover have \"Inl (SAlways i i []) \\<in> set (doAlwaysBase i (left I) p1)\"\n          using i_props Suc\n          unfolding doAlwaysBase_def optimal_def valid_def\n          by (auto split: sum.splits)\n        ultimately have \"wqo minp q\" using min_list_wrt_le[OF _ refl_wqo]\n            alwaysBase_sound[OF i_props p1_def] pw_total[of i \"Always I phi\"]\n            trans_wqo as Inl minp\n          apply (simp add: total_on_def)\n          by (metis transpD)\n      }\n      then show ?thesis\n        using Inl q_val\n        unfolding valid_def\n        by (cases a) (auto)\n    qed\n  qed\n  then show False using q_le by auto\nqed\n\nlemma always_sound:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\" and\n    p1_def: \"optimal i phi p1\" and\n    p'_def: \"optimal (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n    and p_def: \"p \\<in> set (doAlways i (left I) p1 p')\"\n    and bf: \"bounded_future (Always I phi)\"\n    and bf': \"bounded_future (Always (subtract (\\<Delta> rho (i+1)) I) phi)\"\n  shows \"valid rho i (Always I phi) p\"\nproof (cases p')\n  case (Inr b)\n  then have p'r: \"p' = Inr b\" by auto\n  then have viop': \"\\<not> sat rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi)\"\n    using soundness[of _ _ \"Always (subtract (\\<Delta> rho (i+1)) I) phi\"] p'_def \n      check_sound(2)[of rho \"Always (subtract (\\<Delta> rho (i+1)) I) phi\" b]\n    unfolding optimal_def valid_def by auto\n  then obtain q where b_def: \"b = VAlways (i+1) q\" using Inr p'_def\n    unfolding optimal_def valid_def\n    by (cases b) (auto)\n  then have b_val: \"v_check rho (Always (subtract (\\<Delta> rho (i+1)) I) phi) b\"\n    using Inr p'_def unfolding optimal_def valid_def by (auto simp: Let_def)\n  then have mem: \"mem (delta rho (v_at q) (i+1)) (subtract (\\<Delta> rho (i+1)) I)\"\n    using b_def Inr p'_def unfolding optimal_def valid_def\n    by (auto simp: Let_def)\n  then have \"left I - \\<Delta> rho (i+1) \\<le> delta rho (v_at q) (i+1) \" by auto\n  then have tmp: \"left I \\<le> \\<tau> rho (i+1) - \\<tau> rho i + (\\<tau> rho (v_at q) - \\<tau> rho (i+1))\"\n    by auto\n  from b_val have qi: \"i+1 \\<le> v_at q\" using b_def p'r p'_def\n    unfolding optimal_def valid_def\n    by (auto simp: Let_def)\n  then have liq: \"left I \\<le> delta rho (v_at q) i\" using diff_add_assoc tmp\n    by simp\n  from bf obtain n where n_def: \"right I = enat n\" by auto\n  from mem n_def have \"enat (delta rho (v_at q) (i+1)) \\<le> enat n - enat (\\<Delta> rho (i+1))\"\n    by simp\n  then have \"delta rho (v_at q) (i+1) + \\<Delta> rho (i+1) \\<le> n\"\n    using i_props n_def by simp\n  then have riq: \"enat (delta rho (v_at q) i) \\<le> right I\" using n_def by simp\n  then show ?thesis\n  proof (cases \"left I = 0\")\n    case True\n    then show ?thesis\n    proof (cases p1)\n      case (Inr b1)\n      then have p1l: \"p1 = Inr b1\" by simp\n      then have vps: \"p = Inr (VAlways i q) \\<or> p = Inr (VAlways i (projr p1))\"\n        using b_def p'r True p_def unfolding doAlways_def optimal_def by auto\n      then show ?thesis\n        using Inr True n_def b_val b_def qi riq p1_def\n        unfolding optimal_def valid_def\n        by auto\n    next\n      case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by simp\n        then have vp: \"p = Inr (VAlways i q)\"\n          using p1l p_def True p'r b_def unfolding doAlways_def by simp\n        then show ?thesis\n          using Inr Inl True n_def b_def p'_def i_props unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n  next\n    case False\n    then show ?thesis\n    proof (cases p1)\n      case (Inr b1)\n      then have p1r: \"p1 = Inr b1\" by simp\n      then have vp: \"p = Inr (VAlways i q)\"\n        using p1r p_def False p'r b_def unfolding doAlways_def by simp\n      then show ?thesis\n        using Inr False n_def b_def qi liq riq b_val unfolding optimal_def valid_def\n        by (auto simp: Let_def)\n    next\n      case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by simp\n        then have vp: \"p = Inr (VAlways i q)\"\n          using p1l p_def False p'r b_def unfolding doAlways_def by simp\n        then show ?thesis\n          using Inr False n_def b_def qi liq riq b_val unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n      qed\n  qed\nnext\n  case (Inl a)\n  then have p'l: \"p' = Inl a\" by auto\n  from bf obtain n where n_def: \"right I = enat n\" by auto\n  then show ?thesis\n  using p'l p'_def\n  proof (cases a)\n    case (SAlways j hi qs)\n    have hi_def: \"hi = LTP rho (n + \\<tau> rho i)\"\n      using p'_def SAlways i_props Inl n_def\n      unfolding optimal_def valid_def by auto\n    have j_def: \"j = i+1\" using p'l p'_def unfolding optimal_def valid_def SAlways\n      by simp\n    from bf obtain n where n_def: \"right I = enat n\" by auto\n    then show ?thesis\n    proof (cases \"left I = 0\")\n      case True\n      then show ?thesis \n      proof (cases p1)\n          case (Inr b1)\n          then have \"p = Inr (VAlways i (projr p1))\"\n            using p'l SAlways True p_def unfolding doAlways_def\n            by simp\n          then show ?thesis using p1_def i_props Inr True zero_enat_def\n            unfolding optimal_def valid_def by simp\n        next\n          case (Inl a1)\n          then have p1l: \"p1 = Inl a1\" by simp\n          {\n            from i_ge_etpi have a1_ge: \"s_at a1 \\<ge> ETP rho (\\<tau> rho (s_at a1))\"\n            using p1l p1_def\n            unfolding optimal_def valid_def by simp\n          then have nl_def: \"LTP rho (\\<tau> rho i + n) \\<ge> s_at a1 + 1\"\n            using n_def SAlways p'l p'_def p1_def p1l i_props\n            unfolding optimal_def valid_def apply (simp add: Let_def)\n            by (metis add.commute diff_add_assoc diff_add_inverse i_le_ltpi_add le_diff_conv)\n          define l where l_def: \"l \\<equiv> [max (s_at a1+1) (ETP rho (\\<tau> rho (s_at a1+1))) ..< LTP rho (\\<tau> rho i + n)]\"\n          then have l1_def: \"l = [s_at a1+1..< LTP rho (\\<tau> rho i + n)]\" using i_ge_etpi[of rho \"s_at a1 + 1\"]\n            by (simp add: max_def)\n          then have a1_cons: \"(max (s_at a1) (ETP rho (\\<tau> rho (s_at a1)))) # l = s_at a1 # l\"\n            by (simp add: antisym a1_ge max_def)\n          then have \"s_at a1 # l = [max (s_at a1) (ETP rho (\\<tau> rho (s_at a1))) ..< LTP rho (\\<tau> rho i + n)]\"\n            using nl_def l_def a1_ge\n            apply (simp add: antisym a1_cons i_ge_etpi)\n            by (metis less_eq_Suc_le upt_conv_Cons)\n        } note * = this\n        then have \"p = p' \\<oplus> p1\" using p1l p'l SAlways True p_def\n          unfolding doAlways_def by simp\n        then have \"p = Inl (SAlways i hi ((projl p1) # qs))\"\n          using SAlways p'l p1_def p1l i_props j_def\n          unfolding proofApp_def optimal_def valid_def\n          by simp\n        then show ?thesis using * n_def p'_def p1_def p1l p'l SAlways\n              True i_props\n          unfolding optimal_def valid_def\n          by (simp add: Let_def add.commute i_ge_etpi split: if_splits)\n      qed\n    next\n      case False\n      then show ?thesis\n      proof (cases p1)\n        case (Inr b1)\n        then have formp: \"p = Inl (SAlways i hi qs)\"\n          using False p_def p'l SAlways\n          unfolding doAlways_def by simp\n        from p'_def have s_at_qs: \"map s_at qs = [lu rho (i+1) (subtract (\\<Delta> rho (i+1)) I)..< Suc (LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1))))]\"\n          using SAlways p'l n_def unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        have l_subtract: \"lu rho (i + 1) (subtract (\\<Delta> rho (i+1)) I) = lu rho i I\"\n          using False i_props \n          apply (simp add: max_def i_etp_to_tau etpi_imp_etp_suci)\n          by (smt (verit) diff_add_inverse2 diff_is_0_eq' i_etp_to_tau le_add_diff_inverse le_less_Suc_eq less_le_not_le nle_le)\n        from p'_def have sq: \"(\\<forall>q \\<in> set qs. s_check rho phi q)\"\n          unfolding optimal_def valid_def SAlways p'l\n          by (auto simp: Let_def split: enat.splits)\n        from p'_def i_props have \"i \\<le> LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1)))\"\n          using SAlways p'l n_def i_le_ltpi_add[of i rho n]\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def add.commute)\n        then show ?thesis using False i_props SAlways p'l\n            bf' formp sq s_at_qs[unfolded l_subtract] p'_def n_def\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def add.commute)\n      next\n        case (Inl a1)\n        then have formp: \"p = Inl (SAlways i hi qs)\"\n          using False p_def p'l SAlways\n          unfolding doAlways_def by simp\n        from p'_def have s_at_qs: \"map s_at qs = [lu rho (i+1) (subtract (\\<Delta> rho (i+1)) I)..< Suc (LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1))))]\"\n          using SAlways p'l n_def unfolding optimal_def valid_def\n          by (auto simp: Let_def)\n        have l_subtract: \"lu rho (i + 1) (subtract (\\<Delta> rho (i+1)) I) = lu rho i I\"\n          using False i_props \n          apply (simp add: max_def i_etp_to_tau etpi_imp_etp_suci)\n          by (smt (verit) diff_add_inverse2 diff_is_0_eq' i_etp_to_tau le_add_diff_inverse le_less_Suc_eq less_le_not_le nle_le)\n        from p'_def have sq: \"(\\<forall>q \\<in> set qs. s_check rho phi q)\"\n          unfolding optimal_def valid_def SAlways p'l\n          by (auto simp: Let_def split: enat.splits)\n        from p'_def i_props have \"i \\<le> LTP rho (\\<tau> rho (i+1) + (n - \\<Delta> rho (i+1)))\"\n          using SAlways p'l n_def i_le_ltpi_add[of i rho n]\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def add.commute)\n        then show ?thesis using False i_props SAlways p'l\n            bf' formp sq s_at_qs[unfolded l_subtract] p'_def n_def\n          unfolding optimal_def valid_def\n          by (auto simp: Let_def add.commute)\n      qed\n    qed\n  qed (auto simp add: optimal_def valid_def)\nqed\n\nlemma valid_shift_SAlways:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\"\n    and valid: \"valid rho i (Always I phi) (Inl (SAlways i hi ys))\"\n    and rfin: \"right I \\<noteq> \\<infinity>\"\n  shows \"valid rho (i + 1) (Always (subtract (delta rho (i + 1) i) I) phi) (Inl (SAlways (i + 1) hi (if left I = 0 then tl ys else ys)))\"\nproof -\n  obtain n where rI: \"right I = enat n\"\n    using rfin by (cases \"right I\") auto\n  show ?thesis\n  proof (cases \"left I = 0\")\n    obtain n where rI: \"right I = enat n\"\n      using rfin by (cases \"right I\") auto\n    case True\n    obtain z zs where ys_def: \"ys = zs @ [z]\"\n      using valid True \n      unfolding valid_def\n      apply (cases ys)\n       apply (simp add: Let_def i_etp_to_tau i_le_ltpi_add split: if_splits enat.splits)\n      by (meson neq_Nil_conv rev_exhaust)\n    show ?thesis\n      using i_props valid True\n      unfolding valid_def\n      apply (simp add: map_tl i_etp_to_tau i_ltp_to_tau i_le_ltpi_add split: if_splits enat.splits)\n      by (metis add.commute list.discI list.set_sel(2) append_is_Nil_conv ys_def)\n  next\n    case False\n    have rw: \"\\<tau> rho i - (left I + \\<tau> rho i - \\<tau> rho (Suc i)) =\n    (if left I + \\<tau> rho i \\<ge> \\<tau> rho (Suc i) then \\<tau> rho (Suc i) - left I else \\<tau> rho i)\"\n      by auto\n    have e: \"right I = enat n \\<Longrightarrow> right (subtract (delta rho (Suc i) i) I) = enat n' \\<Longrightarrow>\n    ETP rho (\\<tau> rho (Suc i) - n) = ETP rho (\\<tau> rho i - n')\" for n n'\n      by auto (metis Suc_eq_plus1 diff_add_inverse2 diff_cancel_middle enat_ord_simps(1) i_props le_diff_conv)\n    have t: \"\\<tau> rho (Suc i) + (left I + \\<tau> rho i - \\<tau> rho (Suc i)) =\n    (if left I + \\<tau> rho i \\<ge> \\<tau> rho (Suc i) then \\<tau> rho i + left I else \\<tau> rho (Suc i))\"\n      by auto\n    have etp: \"max (Suc i) (ETP rho (left I + \\<tau> rho i)) = max i (ETP rho (left I + \\<tau> rho i))\"\n      using False\n      by (auto simp: max_def)\n        (meson add_le_same_cancel2 i_etp_to_tau leD not_less_eq_eq)\n    have ee: \"\\<not> \\<tau> rho (Suc i) \\<le> left I + \\<tau> rho i \\<Longrightarrow> ETP rho (\\<tau> rho i + left I) = Suc i\"\n      by (metis Groups.ab_semigroup_add_class.add.commute Lattices.linorder_class.max.absorb1 etp i_etp_to_tau max_def n_not_Suc_n nat_le_linear)\n    show ?thesis\n      using False valid e i_ge_etpi[of rho \"Suc i\"] ee etp i_props\n      apply (cases ys rule: rev_cases)\n      by (auto simp: valid_def Let_def rw t rI add.commute split: if_splits)\n  qed\nqed\n\nlemma valid_shift_VAlways:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\"\n    and valid: \"valid rho i (Always I phi) (Inr (VAlways i p))\"\n    and v_at_p: \"v_at p \\<ge> i + (Suc 0)\"\n    and rfin: \"right I \\<noteq> \\<infinity>\"\n  shows \"valid rho (i + 1) (Always (subtract (delta rho (i + 1) i) I) phi) (Inr (VAlways (i + 1) p))\"\nproof -\n  obtain n where rI: \"right I = enat n\"\n    using rfin by (cases \"right I\") auto\n  show ?thesis\n  proof (cases \"left I = 0\")\n    obtain n where rI: \"right I = enat n\"\n      using rfin by (cases \"right I\") auto\n    case True\n    obtain z where p_def: \"p = z\"\n      using valid True \n      unfolding valid_def\n      apply (cases p)\n      by (auto simp add: Let_def i_etp_to_tau i_le_ltpi_add split: if_splits enat.splits)\n    show ?thesis\n      using i_props valid True v_at_p\n      unfolding valid_def\n      by (simp add: le_diff_conv rI split: if_splits enat.splits)\n  next\n    case False\n    show ?thesis\n      using False valid i_props v_at_p\n      unfolding valid_def\n      by (auto simp: Let_def rI)\n  qed\nqed\n\nlemma always_optimal:\n  assumes i_props: \"right I \\<ge> enat (\\<Delta> rho (i+1))\" \n    and p1_def: \"optimal i phi p1\"\n    and p'_def: \"optimal (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n    and bf: \"bounded_future (Always I phi)\"\n    and bf': \"bounded_future (Always (subtract (\\<Delta> rho (i+1)) I) phi)\"\n  shows \"optimal i (Always I phi) (min_list_wrt wqo (doAlways i (left I) p1 p'))\"\nproof (rule ccontr)\n  define minp where minp: \"minp \\<equiv> min_list_wrt wqo (doAlways i (left I) p1 p')\"\n  from bf have bfphi: \"bounded_future phi\" by auto\n  from bf obtain n where n_def: \"right I = enat n\" by auto\n  from pw_total[of i \"Always I phi\"]\n  have total_set: \"total_on wqo (set (doAlways i (left I) p1 p'))\"\n    using always_sound[OF i_props p1_def p'_def _ bf bf']\n    by (metis not_wqo total_onI)\n  define hi where \"hi = (case right I - enat (delta rho (i + Suc 0) i) of enat n \\<Rightarrow> LTP rho (\\<tau> rho (Suc i) + n))\"\n  have rfin: \"right I \\<noteq> \\<infinity>\" \"right I - enat (delta rho (i + Suc 0) i) \\<noteq> \\<infinity>\"\n    using bf by auto\n  have hi: \"hi = (case right I of enat n \\<Rightarrow> LTP rho (\\<tau> rho i + n) | \\<infinity> \\<Rightarrow> 0)\"\n    using i_props rfin\n    by (auto simp: hi_def add.commute split: enat.splits)\n  from p'_def have p'_form: \"(\\<exists>p. p' = Inr (VAlways (i+1) p)) \\<or>\n    (\\<exists>ps. p' = Inl (SAlways (i+1) hi ps))\"\n  proof(cases \"VIO rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi)\")\n    case True\n    then obtain b' where b'_def: \"p' = Inr b'\"\n      using val_VIO_imp_r[OF bf'] p'_def\n      unfolding optimal_def\n      by force\n    then show ?thesis\n      using val_VIO_imp_r[OF bf', of \"i+1\" p'] p'_def\n      unfolding optimal_def valid_def\n      by (cases b') (auto simp: hi_def)\n  next\n    case False\n    then have SAT: \"SAT rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi)\"\n      using SAT_or_VIO by auto\n    then obtain a' where a'_def: \"p' = Inl a'\"\n      using val_SAT_imp_l[OF bf'] p'_def\n      unfolding optimal_def\n      by force\n    then show ?thesis\n      using val_VIO_imp_r[OF bf', of \"i+1\" p'] p'_def\n      unfolding optimal_def valid_def\n      by (cases a') (auto simp: hi_def)\n  qed\n  from doAlways_def[of i \"left I\" p1 p'] p'_form\n  have nnil: \"doAlways i (left I) p1 p' \\<noteq> []\"\n    by (cases p1; cases \"left I\"; cases p'; auto)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doAlways i (left I) p1 p'). wqo x y) (doAlways i (left I) p1 p') \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doAlways i (left I) p1 p'). wqo x y)\" \"(doAlways i (left I) p1 p')\"]\n    by simp\n  assume nopt: \"\\<not> optimal i (Always I phi) minp\"\n  from always_sound[OF i_props p1_def p'_def min_list_wrt_in]\n    total_set trans_wqo refl_wqo nnil minp i_props bf'\n  have vmin: \"valid rho i (Always I phi) minp\"\n    unfolding valid_def optimal_def\n    apply (simp add: Let_def split: if_splits sum.splits enat.splits)\n    by fastforce+\n  then obtain q where q_val: \"valid rho i (Always I phi) q\" and\n    q_le: \"\\<not> wqo minp q\" using minp nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof (cases q)\n    case (Inr b)\n    then have q_v: \"q = Inr b\" by auto\n    then have VIO: \"VIO rho i (Always I phi)\" using q_val check_sound(2)\n      unfolding valid_def apply simp\n      using v_check_simps(14) by blast\n    then have vio: \"\\<not> sat rho i (Always I phi)\" using soundness\n      by blast\n    from Inr obtain vphi where b_def: \"b = VAlways i vphi\"\n      using q_val unfolding valid_def by (cases b) auto\n    then have valphi: \"valid rho (v_at vphi) phi (Inr vphi)\" using q_val Inr\n      unfolding valid_def by (auto simp: Let_def)\n    from q_val Inr b_def n_def\n    have vphi_bounds: \"v_at vphi \\<le> LTP rho (\\<tau> rho i + n) \\<and> v_at vphi \\<ge> i\"\n      unfolding valid_def\n      apply (simp add: Let_def)\n      by (metis add.commute i_le_ltpi_add le_Suc_ex le_diff_conv)\n    from valphi val_VIO_imp_r[OF bf] VIO have check_vphi: \"v_check rho phi vphi\"\n      unfolding valid_def by auto\n    then show ?thesis\n    proof (cases p')\n      case (Inr b')\n      then have p'r: \"p' = Inr b'\" by simp\n      then obtain vphi' where b'_def: \"b' = VAlways (i+1) vphi'\"\n        using p'_def unfolding optimal_def valid_def\n        by (cases b') auto\n      from VIO vmin have minl: \"\\<exists>a. minp = Inr a\" using minp val_VIO_imp_r[OF bf]\n        by auto\n      from p'_def have p'_val: \"valid rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n        unfolding optimal_def by auto\n      then show ?thesis\n      proof (cases p1)\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = min_list_wrt wqo [Inr (VAlways i b1), Inr (VAlways i vphi')]\"\n            using p1r p'r True b'_def minp filter_nnil\n            unfolding doAlways_def \n            by (cases p1) auto\n          show ?thesis\n          proof (cases \"v_at vphi = i\")\n            case vphi_i: True\n            have \"wqo (Inr (VAlways i b1)) q\"\n              using VAlways b_def optimal_def p1_def p1r vphi_i valphi q_v\n              unfolding optimal_def valid_def by auto\n            then show ?thesis\n              using q_v b_def pw_total[of i \"Always I phi\"]\n                always_sound[OF i_props p1_def p'_def] p'r b'_def p1r True\n                bf bf'\n              unfolding form doAlways_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          next\n            case False\n            have incr: \"checkIncr (Inr (VAlways (i+1) vphi'))\" \"checkIncr (Inr (VAlways (i+1) vphi))\"\n              using p'r b'_def False vphi_bounds p'_def\n              unfolding optimal_def valid_def\n              by (auto simp: Let_def intro!: checkIncr.intros)\n            have valid: \"valid rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) (Inr (VAlways (i+1) vphi))\"\n              using False valid_shift_VAlways b_def i_props q_v q_val vphi_bounds n_def\n              by (auto simp: Let_def)\n            have wqo: \"wqo (Inr (VAlways (i+1) vphi')) (Inr (VAlways (i+1) vphi))\"\n              using valphi p'_def p'r b'_def b_def valid\n              unfolding optimal_def valid_def\n              by (simp add: Let_def split: sum.split)\n            from proofIncr_mono[OF incr wqo p'_val[unfolded p'r b'_def] valid] have \"wqo (Inr (VAlways i vphi')) q\"\n              unfolding q_v b_def using i_props\n              by (auto simp add: Let_def proofIncr_def)\n            then show ?thesis\n              using q_v b_def pw_total[of i \"Always I phi\"]\n                always_sound[OF i_props p1_def p'_def] p'r b'_def p1r True bfphi n_def\n              unfolding form doAlways_def\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          qed\n        next\n          case False\n          have form: \"minp = min_list_wrt wqo [Inr (VAlways i vphi')]\"\n            using p1r p'r False b'_def minp filter_nnil\n            unfolding doAlways_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have vphi_g_i: \"v_at vphi > i\"\n            using False b_def q_v q_val soundness le_eq_less_or_eq \n            unfolding valid_def \n            by (auto simp add: Let_def  split: sum.splits)\n          have incr: \"checkIncr (Inr (VAlways (i+1) vphi'))\" \"checkIncr (Inr (VAlways (i+1) vphi))\"\n            using p'r b'_def False vphi_bounds p'_def Suc_le_eq vphi_g_i\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def intro!: checkIncr.intros split: sum.splits)\n          have valid: \"valid rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) (Inr (VAlways (i+1) vphi))\"\n            using False valid_shift_VAlways b_def i_props q_v q_val vphi_bounds vphi_g_i n_def by simp\n          have wqo: \"wqo (Inr (VAlways (i+1) vphi')) (Inr (VAlways (i+1) vphi))\"\n            using valphi p'_def p'r b'_def b_def valid\n            unfolding optimal_def valid_def\n            by (simp add: Let_def split: sum.split)\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'r b'_def] valid] have \"wqo (Inr (VAlways i vphi')) q\"\n            unfolding q_v b_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_v b_def pw_total[of i \"Always I phi\"]\n                always_sound[OF i_props p1_def p'_def] p'r b'_def p1r False\n            unfolding form\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        qed\n      next\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          have form: \"minp = min_list_wrt wqo [Inr (VAlways i vphi')]\"\n            using p1l p'r True b'_def minp filter_nnil\n            unfolding doAlways_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have vphi_g_i: \"v_at vphi > i\"\n            using True b_def q_v q_val p1l bfphi check_sound(1) p1_def val_SAT_imp_l check_consistent linorder_not_le\n            unfolding valid_def optimal_def\n            apply (simp add: Let_def split: sum.splits)\n            by fastforce\n          have incr: \"checkIncr (Inr (VAlways (i+1) vphi'))\" \"checkIncr (Inr (VAlways (i+1) vphi))\"\n            using p'r b'_def True vphi_bounds p'_def Suc_le_eq vphi_g_i\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def intro!: checkIncr.intros split: sum.splits)\n          have valid: \"valid rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) (Inr (VAlways (i+1) vphi))\"\n            using True valid_shift_VAlways b_def i_props q_v q_val vphi_bounds vphi_g_i n_def by simp\n          have wqo: \"wqo (Inr (VAlways (i+1) vphi')) (Inr (VAlways (i+1) vphi))\"\n            using valphi p'_def p'r b'_def b_def valid\n            unfolding optimal_def valid_def\n            by (simp add: Let_def split: sum.split)\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'r b'_def] valid] have \"wqo (Inr (VAlways i vphi')) q\"\n            unfolding q_v b_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_v b_def pw_total[of i \"Always I phi\"]\n                always_sound[OF i_props p1_def p'_def] p'r b'_def p1l True\n            unfolding form\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        next\n           case False\n          have form: \"minp = min_list_wrt wqo [Inr (VAlways i vphi')]\"\n            using p1l p'r False b'_def minp filter_nnil\n            unfolding doAlways_def \n            by (cases p') (auto simp: min_list_wrt_def)\n          have vphi_g_i: \"v_at vphi > i\"\n            using False b_def q_v q_val soundness le_eq_less_or_eq \n            unfolding valid_def \n            by (auto simp add: Let_def  split: sum.splits)\n          have incr: \"checkIncr (Inr (VAlways (i+1) vphi'))\" \"checkIncr (Inr (VAlways (i+1) vphi))\"\n            using p'r b'_def False vphi_bounds p'_def Suc_le_eq vphi_g_i\n            unfolding optimal_def valid_def\n            by (auto simp: Let_def intro!: checkIncr.intros split: sum.splits)\n          have valid: \"valid rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) (Inr (VAlways (i+1) vphi))\"\n            using False valid_shift_VAlways b_def i_props q_v q_val vphi_bounds vphi_g_i n_def by simp\n          have wqo: \"wqo (Inr (VAlways (i+1) vphi')) (Inr (VAlways (i+1) vphi))\"\n            using valphi p'_def p'r b'_def b_def valid\n            unfolding optimal_def valid_def\n            by (simp add: Let_def split: sum.split)\n          from proofIncr_mono[OF incr wqo p'_val[unfolded p'r b'_def] valid] have \"wqo (Inr (VAlways i vphi')) q\"\n            unfolding q_v b_def using i_props\n            by (auto simp add: Let_def proofIncr_def)\n          then show ?thesis\n            using q_v b_def pw_total[of i \"Always I phi\"]\n                always_sound[OF i_props p1_def p'_def] p'r b'_def p1l False\n            unfolding form\n            apply (elim trans_wqo[THEN transpD,rotated])\n            apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n            by (auto simp add: total_on_def)\n        qed\n      qed\n    next\n      case (Inl a')\n      then have p'l: \"p' = Inl a'\" by simp\n      then obtain sphis' where a'_def: \"a' = SAlways (i+1) hi sphis'\"\n        using p'_def doAlways_def p'_form by auto\n      from p'_def have p'_val: \"valid rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n        unfolding optimal_def by auto\n      then show ?thesis\n      proof (cases p1)\n        case (Inr b1)\n        then have p1r: \"p1 = Inr b1\" by auto\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = min_list_wrt wqo [Inr (VAlways i b1)]\"\n            using p1r p'l True a'_def minp filter_nnil\n            unfolding doAlways_def \n            by (cases p1) (auto)\n          show ?thesis\n          proof (cases \"v_at vphi = i\")\n            case vphi_i: True\n            have \"wqo (Inr (VAlways i b1)) q\"\n              using VAlways b_def optimal_def p1_def p1r vphi_i valphi q_v\n              unfolding optimal_def valid_def by auto\n            then show ?thesis\n              using q_v b_def pw_total[of i \"Always I phi\"]\n                always_sound[OF i_props p1_def p'_def] p1r True\n              unfolding form\n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          next\n            case False\n            have vphi_g_i: \"v_at vphi > i\"\n              using False b_def q_v q_val p1r vphi_bounds \n              unfolding valid_def by simp\n            then have wqo_p1: \"wqo (Inr b1) (Inr vphi)\" \n              using p1_def Inl True valphi p'_def p'l q_v q_val \n              unfolding optimal_def apply simp\n              by (metis Inr_Inl_False trans_wqo.valid_shift_VAlways One_nat_def SAT_or_VIO Suc_eq_plus1 Suc_leI b_def bf' diff_Suc_1 i_props rfin(1) trans_wqo_axioms val_SAT_imp_l val_VIO_imp_r)\n            have \"wqo (Inr (VAlways i b1)) q\"\n              using q_v b_def VAlways[OF wqo_p1] by auto\n            then show ?thesis\n              using q_v b_def pw_total[of i \"Always I phi\"]\n                always_sound[OF i_props p1_def p'_def] p1r True\n              unfolding form \n              apply (elim trans_wqo[THEN transpD,rotated])\n              apply (intro min_list_wrt_le[OF _ refl_wqo trans_wqo])\n              by (auto simp add: total_on_def)\n          qed\n        next\n          case False\n          then have form: \"minp = Inl (SAlways i hi sphis')\"\n            using a'_def Inl minp Inr filter_nnil unfolding doAlways_def\n            by (cases p1) (auto simp: min_list_wrt_def split: enat.splits)\n          then show ?thesis\n            using q_v b_def valphi p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split)\n            using VIO val_VIO_imp_r[OF bf] vmin by auto\n        qed\n      next\n        case (Inl a1)\n        then have p1l: \"p1 = Inl a1\" by simp\n        then show ?thesis\n        proof (cases \"left I = 0\")\n          case True\n          then have form: \"minp = (p' \\<oplus> p1)\"\n            using p'l a'_def Inl minp Inr filter_nnil val_VIO_imp_r[OF bf vmin]\n            unfolding doAlways_def \n            by (cases p1) (auto simp add: min_list_wrt_def split: sum.split)\n          have form_algo: \"doAlways i (left I) p1 p' = [(p' \\<oplus> p1)]\"\n            using p1l p'l True a'_def unfolding doAlways_def by auto\n          have check_p: \"checkApp p' p1\"\n            using valid_checkApp_SAlways[of i I phi hi sphis']\n              p'l p1l a'_def True p1_def p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split if_splits)\n             apply (metis (no_types, lifting) checkApp.intros(4) Nil_is_append_conv map_is_Nil_conv not_Cons_self2)\n            using a'_def diff_0_eq_0 p'_val subtract_simps(1) valid_checkApp_SAlways by presburger\n          have p_val: \"valid rho i (Always I phi) (p' \\<oplus> p1)\"\n            using p'l a'_def p1l vmin form always_sound[OF i_props p1_def p'_def]\n            by auto\n          then have p_optimal: \"optimal i (Always I phi) (p' \\<oplus> p1)\"\n            using p'l a'_def p1l vmin form check_p \n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: if_split sum.split)\n            using VIO val_VIO_imp_r[OF bf vmin] vmin by blast\n          then show ?thesis using form check_p p_val p'l a'_def p1l vmin q_v nopt p_optimal\n            unfolding optimal_def valid_def\n            by blast \n        next\n          case False\n          then have form: \"minp = Inl (SAlways i hi sphis')\"\n            using p'l a'_def Inl minp Inr filter_nnil unfolding doAlways_def\n            by (cases p1) (auto simp: min_list_wrt_def split: enat.splits)\n          then show ?thesis\n            using q_v b_def valphi p'_def\n            unfolding optimal_def valid_def\n            apply (simp add: Let_def split: sum.split)\n            using VIO val_VIO_imp_r[OF bf] vmin by auto\n        qed\n      qed\n    qed\n  next\n    case (Inl a)\n    then have ql: \"q = Inl a\" by simp\n    then have SAT: \"SAT rho i (Always I phi)\"\n      using q_val check_sound(1)[of rho \"Always I phi\" a]\n      unfolding valid_def by simp\n    then have formb: \"\\<exists>ps. a = SAlways i hi ps\"\n      using Inl q_val i_props unfolding valid_def by (cases a) (auto simp: hi)\n    moreover\n    {fix hi' ps\n      assume bv: \"a = SAlways i hi' ps\"\n      have hi'_def: \"hi' = hi\"\n        using q_val\n        by (auto simp: Inl bv valid_def hi)\n      have \"wqo minp q\"\n        using bv\n      proof (cases p')\n        case (Inr b')\n        then obtain p1' where b'v: \"b' = VAlways (i+1) p1'\"\n          using p'_def\n          unfolding optimal_def valid_def\n          by (cases b') auto\n        from bv ql have mapt: \"map s_at ps = [lu rho i I  ..< Suc (LTP rho (\\<tau> rho i + n))]\"\n          using n_def bv ql q_val unfolding valid_def by simp\n        then have ps_check: \"\\<forall>p \\<in> set ps. s_check rho phi p\"\n          using bv ql q_val unfolding valid_def\n          by (auto simp: Let_def)\n        then have jc: \"\\<forall>j \\<in> set (map s_at ps). \\<exists>p. s_at p = j \\<and> s_check rho phi p\"\n          using map_set_in_imp_set_in by auto\n        then have vp1'_bounds: \"lu rho i I \\<le> v_at p1' \\<and> v_at p1' \\<le> LTP rho (\\<tau> rho i + n)\"\n          using b'v Inr p'_def i_props n_def\n          unfolding optimal_def valid_def\n          apply (simp add: Let_def add.commute i_etp_to_tau le_diff_conv i_le_ltpi_add split: sum.splits)\n          by (metis i_le_ltpi_add le_add_diff_inverse)\n        from vp1'_bounds have p1'_in: \"v_at p1' \\<in> set (map s_at ps)\" using mapt\n          by (auto split: if_splits)\n        from b'v Inr have \"v_check rho phi p1'\" using p'_def\n          unfolding optimal_def valid_def by (auto simp: Let_def)\n        then have False using jc p1'_in check_consistent[OF bfphi] by auto\n        then show ?thesis by simp\n      next\n        case (Inl a')\n        then have p'a': \"p' = Inl a'\" by simp\n        then have a's: \"(\\<exists>ps. a' = SAlways (i+1) hi ps)\"\n          using Inl p'_def \n          unfolding optimal_def valid_def \n          by (cases a') (auto simp: hi_def)\n        moreover\n        {fix hi'' sphis'\n          assume a's: \"a' = SAlways (i+1) hi'' sphis'\"\n          have hi''_def: \"hi'' = hi\"\n            using p'_def\n            unfolding optimal_def valid_def\n            by (simp add: a's Inl hi_def)\n          have \"wqo minp q\"\n            using a's\n          proof (cases p1)\n            case (Inr b1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form: \"minp = Inr (VAlways i (projr p1))\"\n                using Inr p'a' a's minp val_SAT_imp_l[OF bf vmin SAT] filter_nnil\n                unfolding doAlways_def \n                by (cases p1) (auto simp: min_list_wrt_def)\n              then obtain p1' where p1r: \"p1 = Inr p1'\"\n                using True a's Inl minp Inr val_SAT_imp_l[OF bf vmin SAT] filter_nnil\n                by (cases p1; auto simp: min_list_wrt_def split: if_splits)\n              then show ?thesis\n                using form SAT bf val_SAT_imp_l vmin\n                unfolding optimal_def valid_def\n                by blast\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inl (SAlways i hi sphis')\"\n                using a's Inl minp Inr filter_nnil unfolding doAlways_def\n                by (cases p1) (auto simp: min_list_wrt_def hi''_def)\n              have valid_q_after: \"valid rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) (Inl (SAlways (i+1) hi' ps))\"\n                using valid_shift_SAlways[of i I phi hi' ps] i_props q_val False n_def ql bv \n                unfolding valid_def optimal_def\n                apply (simp split: if_splits)\n                by force\n              then have \"wqo p' (Inl (SAlways (i+1) hi' ps))\" using p'_def\n                unfolding optimal_def by auto\n              moreover have \"checkIncr p'\"\n                using p'_def\n                unfolding p'a' a's\n                by (auto simp: optimal_def intro!: valid_checkIncr_SAlways)\n              moreover have \"checkIncr (Inl (SAlways (i+1) hi' ps))\"\n                using valid_q_after\n                by (auto intro!: valid_checkIncr_SAlways)\n              ultimately show ?thesis\n                using proofIncr_mono[OF _ _ _ p'_val, of \"Inl (SAlways (i+1) hi' ps)\"]\n                      valid_q_after p'a'\n                unfolding valid_def optimal_def\n                by (auto simp add: proofIncr_def hi''_def a's bv form ql)\n            qed\n          next\n            case (Inl a1)\n            then show ?thesis\n            proof (cases \"left I = 0\")\n              case True\n              then have form_min: \"minp = p' \\<oplus> p1\" using Inl a's p'a' minp\n                  val_SAT_imp_l[OF bf vmin SAT] filter_nnil\n                unfolding doAlways_def \n                by (cases p1) (auto simp: min_list_wrt_def)\n              then obtain p1' where p1l: \"p1 = Inl p1'\"\n                using True a's Inl minp val_SAT_imp_l[OF bf vmin SAT] filter_nnil\n                by (cases p1; auto simp: min_list_wrt_def split: if_splits)\n              then show ?thesis\n                using form_min ql bv Inl p1_def q_val i_le_ltpi_add unfolding optimal_def valid_def\n                apply (cases ps)\n                 apply (auto simp add: Let_def True i_ltp_to_tau i_etp_to_tau split: if_splits enat.splits)[1]\n                subgoal premises prems for y ys\n                proof -\n                  from vmin form_min p1l have p_val: \"valid rho i (Always I phi) (p' \\<oplus> (Inl p1'))\"\n                    by auto\n                  have check_p: \"checkApp p' (Inl p1')\"\n                    using p'_def True\n                    unfolding p1l a's p'a'\n                    by (auto simp: optimal_def intro!: valid_checkApp_SAlways)\n                  from prems have y_val: \"valid rho i phi (Inl y)\"\n                    using q_val True i_props n_def i_ge_etpi[of rho i]\n                    unfolding valid_def\n                    apply (simp add: Cons_eq_append_conv split: if_splits)\n                    by (metis Cons_eq_upt_conv bot_nat_0.extremum le_antisym)\n                  have val_q': \"valid rho (i + 1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) (Inl (SAlways (i+1) hi' ys))\"\n                    using valid_shift_SAlways[of i I phi hi' ps] i_props q_val True prems(9) n_def\n                    by (auto simp: ql bv)\n                  then have q_val2: \"valid rho i (Always I phi) ((Inl (SAlways (i+1) hi' ys)) \\<oplus> (Inl y))\"\n                    using q_val prems i_props by auto\n                  have check_q: \"checkApp (Inl (SAlways (i+1) hi' ys)) (Inl y)\"\n                    using val_q' True\n                    by (auto intro!: valid_checkApp_SAlways)\n                  from p'_def have wqo_p': \"wqo p' (Inl (SAlways (i+1) hi' ys))\"\n                    using val_q' unfolding optimal_def by simp\n                  moreover have wqo_p1: \"wqo p1 (Inl y)\" using i_props p1_def y_val\n                    unfolding optimal_def by auto\n                  ultimately show ?thesis\n                    using p'a' a's q_val prems unfolding valid_def optimal_def\n                    using proofApp_mono[OF check_p check_q wqo_p' _ p_val q_val2]\n                    by auto\n                qed\n                done\n            next\n              case False\n              from p'_def have p'_val: \"valid rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) p'\"\n                unfolding optimal_def by auto\n              from False have form: \"minp = Inl (SAlways i hi sphis')\"\n                using a's Inl minp filter_nnil p'a' unfolding doAlways_def\n                by (cases p1) (auto simp: min_list_wrt_def hi''_def)\n              have valid_q_after: \"valid rho (i+1) (Always (subtract (\\<Delta> rho (i+1)) I) phi) (Inl (SAlways (i+1) hi' ps))\"\n                using valid_shift_SAlways[of i I phi hi' ps] i_props q_val False n_def ql bv p'a'\n                unfolding valid_def optimal_def\n                apply (simp split: if_splits)\n                by force\n              then have \"wqo p' (Inl (SAlways (i+1) hi' ps))\" using p'_def\n                unfolding optimal_def by auto\n              moreover have \"checkIncr p'\"\n                using p'_def\n                unfolding p'a' a's\n                by (auto simp: optimal_def intro!: valid_checkIncr_SAlways)\n              moreover have \"checkIncr (Inl (SAlways (i+1) hi' ps))\"\n                using valid_q_after\n                by (auto intro!: valid_checkIncr_SAlways)\n              ultimately show ?thesis\n                using proofIncr_mono[OF _ _ _ p'_val, of \"Inl (SAlways (i+1) hi' ps)\"]\n                      valid_q_after p'a'\n                unfolding valid_def optimal_def\n                by (auto simp add: proofIncr_def hi''_def a's bv form ql)\n            qed\n          qed\n        }\n        then show ?thesis using a's by blast\n      qed\n    }\n    then show ?thesis using formb by blast\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Prev\\<close>\n\nlemma prev_sound:\n  assumes i_props: \"i > 0\" and\n    p1_def: \"optimal (i-1) phi p1\" and\n    p_def: \"p \\<in> set (doPrev i I (\\<Delta> rho i) p1)\"\n  shows \"valid rho i (Prev I phi) p\"\nproof (cases p1)\n  define \\<tau> where \\<tau>_def: \"\\<tau> \\<equiv> \\<Delta> rho i\"\n  case (Inl a)\n  {assume \\<tau>_ge: \"enat \\<tau> > right I\"\n    then have \"\\<tau> > left I\" using i_props left_right[of I] \\<tau>_def  apply auto\n      by (metis (no_types, lifting) One_nat_def diff_less enat_ord_simps(1) enat_trans less_enatE nat_less_le r_less_Delta_imp_less zero_less_one)\n    then have \"p = Inr (VPrev_ge i)\" using i_props \\<tau>_def Inl p_def \\<tau>_ge\n      unfolding doPrev_def\n      by (auto split: if_splits)\n    then have \"valid rho i (Prev I phi) p\" using \\<tau>_def \\<tau>_ge i_props unfolding valid_def\n      by auto\n  }\n  moreover\n  {assume \\<tau>_le: \"\\<tau> < left I\"\n    then have \"p = Inr (VPrev_le i)\" using i_props \\<tau>_def Inl p_def\n      unfolding doPrev_def by auto\n    then have \"valid rho i (Prev I phi) p\" using \\<tau>_def \\<tau>_le i_props unfolding valid_def\n      by auto\n  }\n  moreover\n  {assume \\<tau>_in: \"mem \\<tau> I\"\n    then have \"p = Inl (SPrev (projl p1))\" using Inl \\<tau>_def p_def unfolding doPrev_def\n      by auto\n    then have \"valid rho i (Prev I phi) p\" using p1_def Inl \\<tau>_def \\<tau>_in i_props\n      unfolding optimal_def valid_def by auto\n  }\n  ultimately show ?thesis using Inl assms \\<tau>_def\n    unfolding doPrev_def optimal_def valid_def\n    by (auto split: sum.splits if_splits)\nnext\n  define \\<tau> where \\<tau>_def: \"\\<tau> \\<equiv> \\<Delta> rho i\"\n  case (Inr b)\n  {assume \\<tau>_ge: \"enat \\<tau> > right I\"\n    then have \"\\<tau> > left I\" using i_props left_right[of I] \\<tau>_def  apply auto\n      by (metis (no_types, lifting) One_nat_def diff_less enat_ord_simps(1) enat_trans less_enatE nat_less_le r_less_Delta_imp_less zero_less_one)\n    then have \"p = Inr (VPrev_ge i) \\<or> p = Inr (VPrev (projr p1))\" using i_props \\<tau>_def Inr p_def \\<tau>_ge\n      unfolding doPrev_def\n      by (auto split: if_splits)\n    then have \"valid rho i (Prev I phi) p\" using p1_def \\<tau>_def \\<tau>_ge i_props Inr\n      unfolding valid_def optimal_def\n      by auto\n  }\n  moreover\n  {assume \\<tau>_le: \"\\<tau> < left I\"\n    then have \"p = Inr (VPrev_le i) \\<or> p = Inr (VPrev (projr p1))\"\n      using i_props \\<tau>_def Inr p_def\n      unfolding doPrev_def by auto\n    then have \"valid rho i (Prev I phi) p\" using p1_def \\<tau>_def \\<tau>_le i_props Inr\n      unfolding valid_def optimal_def\n      by auto\n  }\n  moreover\n  {assume \\<tau>_in: \"mem \\<tau> I\"\n    then have \"p = Inr (VPrev (projr p1))\" using Inr \\<tau>_def p_def unfolding doPrev_def\n      by auto\n    then have \"valid rho i (Prev I phi) p\" using p1_def Inr \\<tau>_def \\<tau>_in i_props\n      unfolding optimal_def valid_def by auto\n  }\n  ultimately show ?thesis using assms Inr \\<tau>_def\n    unfolding doPrev_def optimal_def valid_def\n    by (auto split: sum.splits if_splits)\nqed\n\nlemma prev_optimal:\n  assumes i_props: \"i > 0\" and\n    p1_def: \"optimal (i-1) phi p1\" and bf: \"bounded_future (Prev I phi)\"\n  shows \"optimal i (Prev I phi) (min_list_wrt wqo (doPrev i I (\\<Delta> rho i) p1))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  from doPrev_def[of i I \"\\<Delta> rho i\" p1]\n  have nnil: \"doPrev i I (\\<Delta> rho i) p1 \\<noteq> []\"\n    by (cases p1; cases \"left I\"; cases \"\\<Delta> rho i < left I\"; auto)\n  from pw_total[of i \"Prev I phi\"] have total_set: \"total_on wqo (set (doPrev i I (\\<Delta> rho i) p1))\"\n    using prev_sound[OF i_props p1_def]\n    by (metis not_wqo total_onI)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doPrev i I (\\<Delta> rho i) p1). wqo x y) (doPrev i I (\\<Delta> rho i) p1) \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doPrev i I (\\<Delta> rho i) p1). wqo x y)\" \"(doPrev i I (\\<Delta> rho i) p1)\"]\n    by simp\n  define minp where minp: \"minp \\<equiv> min_list_wrt wqo (doPrev i I (\\<Delta> rho i) p1)\"\n  assume nopt: \"\\<not> optimal i (Prev I phi) minp\"\n  from prev_sound[OF i_props p1_def min_list_wrt_in[OF nnil total_set refl_wqo trans_wqo]]\n    minp\n  have vmin: \"valid rho i (Prev I phi) minp\" \n    by auto\n  then obtain q where q_val: \"valid rho i (Prev I phi) q\" and\n    q_le: \"\\<not> wqo minp q\" using minp nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof(cases q)\n    case (Inl a)\n    then have SATp: \"SAT rho i (Prev I phi)\" using q_val check_sound(1)\n      unfolding valid_def\n      by auto\n    then have satp: \"sat rho i (Prev I phi)\" using soundness\n      by blast\n    then have sat_phi: \"sat rho (i-1) phi \\<and> mem (\\<Delta> rho i) I\"\n      using sat.simps(9)[of rho i I phi] i_props\n      by (auto split: nat.splits)\n    then have SAT_phi: \"SAT rho (i-1) phi\" using completeness[of rho _ phi] i_props bf\n      by auto\n    then have sp1: \"\\<exists>p1'. p1 = Inl p1'\" using p1_def unfolding optimal_def valid_def\n      apply (cases p1) apply auto\n      by (metis check_sound(2) soundness)\n    then have mins: \"minp = Inl (SPrev (projl p1))\"\n      using minp sat_phi refl_wqo SPrev optimal_def p1_def\n      unfolding doPrev_def\n      by (auto simp: min_list_wrt_def)\n    from Inl obtain sphi where a_def: \"a = SPrev sphi\"\n      using q_val unfolding valid_def\n      by (cases a) auto\n    then have p_val: \"valid rho (i-1) phi (Inl sphi)\" using Inl q_val i_props\n      unfolding valid_def\n      by (auto simp: Let_def)\n    then have p1_wqo: \"wqo p1 (Inl sphi)\" using p1_def unfolding optimal_def\n      by auto\n    obtain p1' where p1'_def: \"p1 = Inl p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inl (SPrev (projl p1))) q\"\n      using Inl a_def SPrev[OF p1_wqo[unfolded p1'_def]]\n      by (auto simp add: p1'_def)\n    then show ?thesis using mins minp by auto\n  next\n    case (Inr b)\n    then have \"VIO rho i (Prev I phi)\"\n      using q_val\n      unfolding valid_def\n      by (cases b) (auto simp add: MTL.SAT_VIO.intros check_sound(2))\n    then obtain b' where b'_def: \"minp = Inr b'\"\n      using val_VIO_imp_r[OF bf] vmin\n      unfolding valid_def\n      by auto\n    then have \"(\\<exists>a. b' = VPrev a) \\<or> b' = VPrev_le i\n    \\<or> b' = VPrev_ge i\"\n      using vmin i_props\n      unfolding valid_def\n      by (cases b') auto\n    moreover\n    {assume bv: \"b = VPrev_le i\"\n      then have d_le: \"\\<Delta> rho i < left I\" using q_val Inr unfolding valid_def\n        by auto\n      then have \"q \\<in> set (doPrev i I (\\<Delta> rho i) p1)\" using Inr bv\n        unfolding doPrev_def\n        by (cases p1) auto\n      then have \"wqo minp q\" using d_le Inr bv minp filter_nnil\n        unfolding doPrev_def\n        by (cases p1) (auto simp add: min_list_wrt_def refl_wqo reflpD)\n    }\n    moreover\n    {assume bv: \"b = VPrev_ge i\"\n      then have d_ge: \"enat (\\<Delta> rho i) > right I\" using q_val Inr unfolding valid_def\n        by auto\n      then have d_gel: \"\\<Delta> rho i > left I\" using left_right[of I] i_props apply auto\n        by (smt One_nat_def diff_less enat_ord_simps(1) enat_trans less_enatE nat_less_le r_less_Delta_imp_less zero_less_one)\n      then have \"q \\<in> set (doPrev i I (\\<Delta> rho i) p1)\" using Inr bv d_ge\n        unfolding doPrev_def\n        by (cases p1) auto\n      then have \"wqo minp q\" using d_ge Inr bv minp d_gel filter_nnil\n        unfolding doPrev_def\n        by (cases p1) (auto simp add: min_list_wrt_def refl_wqo reflpD)\n    }\n    moreover\n    {fix vphi\n      assume bv: \"b = VPrev vphi\"\n      then have p_val: \"valid rho (i-1) phi (Inr vphi)\" using Inr q_val\n        unfolding valid_def by auto\n      then have p1_wqo: \"wqo p1 (Inr vphi)\" using p1_def unfolding optimal_def\n        by auto\n      obtain p1' where p1'_def: \"p1 = Inr p1'\"\n        using p_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo (Inr (VPrev (projr p1))) q\"\n        using bv Inr VPrev[OF p1_wqo[unfolded p1'_def]] by (auto simp add: p1'_def)\n      moreover have \"Inr (VPrev (projr p1)) \\<in> set (doPrev i I (\\<Delta> rho i) p1)\"\n        using assms p_val check_consistent unfolding doPrev_def optimal_def valid_def\n        by (cases p1; cases \"\\<Delta> rho i < left I\") auto\n      ultimately have \"wqo minp q\" using minp bv min_list_wrt_le[OF _ refl_wqo]\n          prev_sound[OF i_props p1_def] pw_total[of i \"Prev I phi\"]\n          trans_wqo Inr\n        apply (auto simp add: total_on_def)\n        by (metis transpD)\n    }\n    ultimately show ?thesis using q_val Inr assms unfolding doPrev_def valid_def\n      by (cases b) auto\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Next\\<close>\n\nlemma next_sound:\n  assumes p1_def: \"optimal (i+1) phi p1\" and\n    p_def: \"p \\<in> set (doNext i I (\\<Delta> rho (i+1)) p1)\"\n  shows \"valid rho i (Next I phi) p\"\nproof (cases p1)\n  define \\<tau> where \\<tau>_def: \"\\<tau> \\<equiv> \\<Delta> rho (i+1)\"\n  case (Inl a)\n  {assume \\<tau>_le: \"\\<tau> < left I\"\n    then have \"p = Inr (VNext_le i)\" using \\<tau>_def p_def Inl unfolding doNext_def\n      by auto\n    then have \"valid rho i (Next I phi) p\" using \\<tau>_le \\<tau>_def\n      unfolding valid_def by auto\n  }\n  moreover\n  {assume \\<tau>_ge: \"enat \\<tau> > right I\"\n    then have n_\\<tau>_ler:\"\\<not> enat \\<tau> \\<le> right I\" by auto\n    from \\<tau>_ge have \\<tau>_gel: \"\\<tau> > left I\" using left_right\n      by (meson enat_ord_simps(2) less_le_trans not_le)\n    then have \"p = Inr (VNext_ge i)\" using n_\\<tau>_ler \\<tau>_ge \\<tau>_def p_def Inl\n      unfolding doNext_def by auto\n    then have \"valid rho i (Next I phi) p\" using n_\\<tau>_ler \\<tau>_ge \\<tau>_def p_def Inl \\<tau>_gel\n      unfolding valid_def doNext_def by auto\n  }\n  moreover\n  {assume \\<tau>_in: \"mem \\<tau> I\"\n    then have \"p = Inl (SNext (projl p1))\" using \\<tau>_def Inl p_def unfolding doNext_def\n      by auto\n    then have \"valid rho i (Next I phi) p\" using p1_def \\<tau>_def \\<tau>_in Inl p_def\n      unfolding doNext_def valid_def optimal_def\n      by (auto simp: Let_def)\n  }\n  ultimately show ?thesis using \\<tau>_def Inl assms\n    unfolding doNext_def optimal_def valid_def\n    by (auto split: sum.splits if_splits)\nnext\n  define \\<tau> where \\<tau>_def: \"\\<tau> \\<equiv> \\<Delta> rho (i+1)\"\n  case (Inr b)\n  {assume \\<tau>_le: \"\\<tau> < left I\"\n    then have \"p = Inr (VNext_le i) \\<or> p = Inr (VNext (projr p1))\"\n      using \\<tau>_def p_def Inr unfolding doNext_def\n      by auto\n    then have \"valid rho i (Next I phi) p\" using \\<tau>_le \\<tau>_def p1_def p_def\n      unfolding valid_def optimal_def doNext_def by (cases p1) auto\n  }\n  moreover\n  {assume \\<tau>_ge: \"enat \\<tau> > right I\"\n    then have n_\\<tau>_ler:\"\\<not> enat \\<tau> \\<le> right I\" by auto\n    from \\<tau>_ge have \\<tau>_gel: \"\\<tau> > left I\" using left_right\n      by (meson enat_ord_simps(2) less_le_trans not_le)\n    then have \"p = Inr (VNext_ge i) \\<or> p = Inr (VNext (projr p1))\"\n      using n_\\<tau>_ler \\<tau>_ge \\<tau>_def p_def Inr\n      unfolding doNext_def by auto\n    then have \"valid rho i (Next I phi) p\" using \\<tau>_ge \\<tau>_gel n_\\<tau>_ler \\<tau>_def p1_def p_def\n      unfolding valid_def optimal_def doNext_def by (cases p1) auto\n  }\n  moreover\n  {assume \\<tau>_in: \"mem \\<tau> I\"\n    then have \"p = Inr (VNext (projr p1))\" using \\<tau>_def Inr p_def unfolding doNext_def\n      by auto\n    then have \"valid rho i (Next I phi) p\" using p1_def \\<tau>_def \\<tau>_in Inr p_def\n      unfolding doNext_def valid_def optimal_def\n      by (auto simp: Let_def)\n  }\n  ultimately show ?thesis using \\<tau>_def Inr assms\n    unfolding doNext_def optimal_def valid_def\n    by (auto split: sum.splits if_splits)\nqed\n\nlemma next_optimal:\n  assumes p1_def: \"optimal (i+1) phi p1\" and\n    bf: \"bounded_future (Next I phi)\"\n  shows \"optimal i (Next I phi) (min_list_wrt wqo (doNext i I (\\<Delta> rho (i+1)) p1))\"\nproof (rule ccontr)\n  have bf_phi: \"bounded_future phi\"\n    using bf by auto\n  from doNext_def[of i I \"\\<Delta> rho (i+1)\" p1]\n  have nnil: \"doNext i I (\\<Delta> rho (i+1)) p1 \\<noteq> []\"\n    by (cases p1; cases \"left I\"; cases \"\\<Delta> rho (i+1) < left I\"; auto)\n  from pw_total[of i \"Next I phi\"] have total_set: \"total_on wqo (set (doNext i I (\\<Delta> rho (i+1)) p1))\"\n    using next_sound[OF p1_def]\n    by (metis not_wqo total_onI)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (doNext i I (\\<Delta> rho (i+1)) p1). wqo x y) (doNext i I (\\<Delta> rho (i+1)) p1) \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (doNext i I (\\<Delta> rho (i+1)) p1). wqo x y)\" \"(doNext i I (\\<Delta> rho (i+1)) p1)\"]\n    by simp\n  define minp where minp: \"minp \\<equiv> min_list_wrt wqo (doNext i I (\\<Delta> rho (i+1)) p1)\"\n  assume nopt: \"\\<not> optimal i (Next I phi) minp\"\n  from next_sound[OF p1_def min_list_wrt_in] total_set refl_wqo trans_wqo nnil minp\n  have vmin: \"valid rho i (Next I phi) minp\"\n    by auto\n  then obtain q where q_val: \"valid rho i (Next I phi) q\" and\n    q_le: \"\\<not> wqo minp q\" using minp nopt unfolding optimal_def by auto\n  then have \"wqo minp q\" using minp\n  proof(cases q)\n    case (Inl a)\n    then have SATn: \"SAT rho i (Next I phi)\" using q_val check_sound(1)\n      unfolding valid_def\n      by auto\n    then have satn: \"sat rho i (Next I phi)\" using soundness\n      by blast\n    then have sat_phi: \"sat rho (i+1) phi \\<and> mem (\\<Delta> rho (i+1)) I\"\n      using sat.simps(9)[of rho i I phi]\n      by (auto split: nat.splits)\n    then have SAT_phi: \"SAT rho (i+1) phi\" using completeness[of rho _ phi] bf\n      by auto\n    then have sp1: \"\\<exists>p1'. p1 = Inl p1'\" using p1_def unfolding optimal_def valid_def\n      apply (cases p1) apply auto\n      using bf check_sound(2) soundness by fastforce\n    then have mins: \"minp = Inl (SNext (projl p1))\"\n      using minp sat_phi filter_nnil\n      unfolding doNext_def\n      by (auto simp: min_list_wrt_def)\n    from Inl obtain sphi where a_def: \"a = SNext sphi\"\n      using q_val unfolding valid_def\n      by (cases a) auto\n    then have p_val: \"valid rho (i+1) phi (Inl sphi)\" using Inl q_val\n      unfolding valid_def\n      by (auto simp: Let_def)\n    then have p1_wqo: \"wqo p1 (Inl sphi)\" using p1_def unfolding optimal_def\n      by auto\n    obtain p1' where p1'_def: \"p1 = Inl p1'\"\n      using p_val p1_def check_consistent[OF bf_phi]\n      by (auto simp add: optimal_def valid_def split: sum.splits)\n    have \"wqo (Inl (SNext (projl p1))) q\"\n      using Inl a_def SNext[OF p1_wqo[unfolded p1'_def]] by (auto simp add: p1'_def)\n    then show ?thesis using mins minp by auto\n  next\n    case (Inr b)\n    then have \"VIO rho i (Next I phi)\"\n      using q_val\n      unfolding valid_def\n      by (cases b) (auto simp add: MTL.SAT_VIO.intros check_sound(2))\n    then obtain b' where b'_def: \"minp = Inr b'\"\n      using val_VIO_imp_r[OF bf] vmin\n      unfolding valid_def\n      by auto\n    then have \"(\\<exists>a. b' = VNext a) \\<or> b' = VNext_le i\n    \\<or> b' = VNext_ge i\"\n      using vmin\n      unfolding valid_def\n      by (cases b') auto\n    moreover\n    {assume bv: \"b = VNext_le i\"\n      then have d_le: \"\\<Delta> rho (i+1) < left I\" using q_val Inr unfolding valid_def\n        by auto\n      then have \"q \\<in> set (doNext i I (\\<Delta> rho (i+1)) p1)\" using Inr bv\n        unfolding doNext_def\n        by (cases p1) auto\n      then have \"wqo minp q\"\n        using d_le Inr bv minp filter_nnil\n        unfolding doNext_def\n        by (cases p1) (auto simp: refl_wqo reflpD min_list_wrt_def)\n    }\n    moreover\n    {assume bv: \"b = VNext_ge i\"\n      then have d_ge: \"enat (\\<Delta> rho (i+1)) > right I\" using q_val Inr unfolding valid_def\n        by auto\n      then have d_gel: \"\\<Delta> rho (i+1) > left I\" using left_right[of I]\n        apply auto\n        using enat_ord_simps(2) le_less_trans by blast\n      then have \"q \\<in> set (doNext i I (\\<Delta> rho (i+1)) p1)\" using Inr bv d_ge\n        unfolding doNext_def\n        by (cases p1) auto\n      then have \"wqo minp q\"\n        using d_ge Inr bv minp d_gel filter_nnil\n        unfolding doNext_def\n        by (cases p1) (auto simp add: refl_wqo reflpD min_list_wrt_def)\n    }\n    moreover\n    {fix vphi\n      assume bv: \"b = VNext vphi\"\n      then have p_val: \"valid rho (i+1) phi (Inr vphi)\" using Inr q_val\n        unfolding valid_def by auto\n      then have p1_wqo: \"wqo p1 (Inr vphi)\" using p1_def unfolding optimal_def\n        by auto\n      obtain p1' where p1'_def: \"p1 = Inr p1'\"\n        using p_val p1_def check_consistent[OF bf_phi]\n        by (auto simp add: optimal_def valid_def split: sum.splits)\n      have \"wqo (Inr (VNext (projr p1))) q\"\n        using bv Inr VNext[OF p1_wqo[unfolded p1'_def]] by (auto simp add: p1'_def)\n      moreover have \"Inr (VNext (projr p1)) \\<in> set (doNext i I (\\<Delta> rho (i+1)) p1)\"\n        using assms p_val check_consistent unfolding doNext_def optimal_def valid_def\n        by (cases p1; cases \"\\<Delta> rho (i+1) < left I\") auto\n      ultimately have \"wqo minp q\"\n        using minp bv min_list_wrt_le[OF _ refl_wqo]\n          next_sound[OF p1_def] pw_total[of i \"Next I phi\"]\n          trans_wqo Inr\n        apply (auto simp add: total_on_def)\n        by (metis transpD)\n    }\n    ultimately show ?thesis using q_val Inr assms unfolding valid_def\n      by (cases b) auto\n  qed\n  then show False using q_le by auto\nqed\n\nsubsection \\<open>Operator: Neg\\<close>\n\nlemma neg_sound:\n  assumes p'_opt: \"optimal i phi (Opt i phi)\" and\n    p_def: \"p \\<in> set (Cand i (Neg phi))\"\n  shows \"valid rho i (Neg phi) p\"\nproof -\n  define p1 where p1_def: \"p1 = Opt i phi\"\n  then show ?thesis\n  proof (cases p1)\n    case (Inl a)\n    then have \"SAT rho i phi\" using p1_def p'_opt check_sound(1)[of _ phi a]\n      unfolding optimal_def valid_def by auto\n    then show ?thesis using p1_def p'_opt Inl p_def\n      unfolding optimal_def valid_def\n      by (auto simp: sum.case_eq_if Let_def isl_def split: if_splits)\n  next\n    case (Inr b)\n    then have \"VIO rho i phi\" using p1_def p'_opt check_sound(2)[of rho phi b]\n      unfolding optimal_def valid_def by auto\n    then show ?thesis using p1_def p'_opt Inr p_def\n      unfolding optimal_def valid_def\n      by (auto simp: sum.case_eq_if Let_def isl_def split: if_splits)\n  qed\nqed\n\nlemma neg_optimal:\n  assumes p'_opt: \"optimal i phi (Opt i phi)\" and bf: \"bounded_future (Neg phi)\"\n  shows \"optimal i (Neg phi) (min_list_wrt wqo (Cand i (Neg phi)))\"\nproof (rule ccontr)\n  assume nopt: \"\\<not> optimal i (Neg phi) (min_list_wrt wqo (Cand i (Neg phi)))\"\n  define p1 where p1_def: \"p1 = Opt i phi\"\n  define minp where minp: \"minp = min_list_wrt wqo (Cand i (Neg phi))\"\n  from bf have bfphi: \"bounded_future phi\" by auto\n  have nnil: \"Cand i (Neg phi) \\<noteq> []\"\n    by (auto simp: Let_def)\n  from pw_total[of i \"Neg phi\"]\n  have total_set: \"total_on wqo (set (Cand i (Neg phi)))\"\n    using neg_sound[OF p'_opt]\n    by (metis not_wqo total_onI)\n  have filter_nnil: \"filter (\\<lambda>x. \\<forall>y \\<in> set (Cand i (Neg phi)). wqo x y) (Cand i (Neg phi)) \\<noteq> []\"\n    using refl_total_transp_imp_ex_min[OF nnil refl_wqo total_set trans_wqo]\n      filter_empty_conv[of \"(\\<lambda>x. \\<forall>y \\<in> set (Cand i (Neg phi)). wqo x y)\" \"(Cand i (Neg phi))\"]\n    by simp\n  from neg_sound[OF p'_opt min_list_wrt_in, of wqo] total_set refl_wqo trans_wqo\n    nnil minp\n  have vmin: \"valid rho i (Neg phi) minp\"\n    by auto\n  then obtain q where q_val: \"valid rho i (Neg phi) q\" and q_le: \"\\<not> wqo minp q\"\n    using minp nopt unfolding optimal_def by auto\n  then show False\n  proof (cases q)\n    case (Inl a)\n    then obtain a' where a'_val: \"valid rho i phi (Inr a')\" and a'_def: \"a = SNeg a'\"\n      using q_val unfolding valid_def by (cases a; auto)\n    from p'_opt p1_def have p1_val: \"valid rho i phi p1\" unfolding optimal_def\n      by auto\n    from a'_val have \"VIO rho i phi\" using check_sound(2)[of rho phi a']\n      unfolding valid_def by auto\n    then obtain p1' where p1'_def: \"p1 = Inr p1'\" using val_VIO_imp_r[OF bfphi p1_val]\n      by auto\n    then have \"wqo (Inr p1') (Inr a')\" using p'_opt p1_def a'_val\n      unfolding optimal_def by auto\n    then show ?thesis using q_le Inl minp p1_def SNeg p1'_def a'_def filter_nnil\n        min_list_wrt_in[OF nnil total_set refl_wqo trans_wqo]\n      by (auto simp: Let_def isl_def split: if_splits)\n  next\n    case (Inr b)\n    then obtain b' where a'_val: \"valid rho i phi (Inl b')\" and a'_def: \"b = VNeg b'\"\n      using q_val unfolding valid_def by (cases b; auto)\n    from p'_opt p1_def have p1_val: \"valid rho i phi p1\" unfolding optimal_def\n      by auto\n    from a'_val have \"SAT rho i phi\" using check_sound(1)[of rho phi b']\n      unfolding valid_def by auto\n    then obtain p1' where p1'_def: \"p1 = Inl p1'\" using val_SAT_imp_l[OF bfphi p1_val]\n      by auto\n    then have \"wqo (Inl p1') (Inl b')\" using p'_opt p1_def a'_val\n      unfolding optimal_def by auto\n    then show ?thesis using q_le Inr minp p'_opt vmin p1_def\n        VNeg p1'_def a'_def min_list_wrt_in[OF nnil total_set refl_wqo trans_wqo]\n      unfolding valid_def\n      apply (auto simp: Let_def isl_def split: if_splits)\n      by metis\n  qed\nqed\n\nsubsection \\<open>Algorithm optimality\\<close>\n\nlemma s_check_AtomE[elim]:\n  \"s_check rho (Atom x) p \\<Longrightarrow> (\\<And>i. p = SAtm x i \\<Longrightarrow> x \\<in> \\<Gamma> rho i \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (cases p) auto\n\nlemma s_check_PrevE[elim]:\n  \"s_check rho (Prev I \\<phi>) p \\<Longrightarrow>\n     (\\<And>q. s_at p > 0 \\<Longrightarrow> p = SPrev q \\<Longrightarrow> s_check rho \\<phi> q \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (cases p) (auto simp: Let_def)\n\nlemma s_check_SinceE[elim]:\n  \"s_check rho (Since phi I psi) p \\<Longrightarrow>\n     (\\<And>q qs. p = SSince q qs \\<Longrightarrow> s_check rho psi q \\<Longrightarrow> list_all (s_check rho phi) qs \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (cases p) (auto simp: Let_def list.pred_set)\n\nthm Cand_Opt.induct(1)\nthm Cand_Opt.induct(2)\n\ntheorem alg_optimal:\n  \"bounded_future phi \\<Longrightarrow> optimal i phi (Opt i phi)\"\nproof (induction i phi rule: Cand_Opt.induct(2)[where P = \"\\<lambda>i phi. bounded_future phi \\<longrightarrow>\n  (\\<forall>x \\<in> set (Cand i phi). valid rho i phi x) \\<and>\n  (\\<exists>x \\<in> set (Cand i phi). optimal i phi x)\",\n      case_names TT FF Atom Disj Conj Impl Iff Neg Prev Next Since Until Once Historically Eventually Always Opt])\n  case (TT i)\n  then show ?case unfolding optimal_def valid_def\n    by (auto simp: refl_wqo[unfolded reflp_def] s_check.simps\n        split: sum.splits sproof.splits vproof.splits)\nnext\n  case (FF i)\n  then show ?case unfolding optimal_def valid_def\n    by (auto simp: refl_wqo[unfolded reflp_def] s_check.simps v_check.simps\n        split: sum.splits sproof.splits vproof.splits)\nnext\n  case (Atom i x)\n  then show ?case unfolding optimal_def valid_def\n    by (cases \"x \\<in> \\<Gamma> rho i\"; auto simp: refl_wqo[unfolded reflp_def] v_check.simps\n        split: sum.splits vproof.splits)\nnext\n  note Opt.simps[simp del]\n  case (Neg i phi')\n  then show ?case using NegBF[of phi'] neg_sound[OF Neg] neg_optimal[OF Neg]\n    unfolding valid_def\n    by (auto simp: min_list_wrt_def Let_def VNeg optimal_def SNeg)\nnext\n  note Opt.simps[simp del]\n  case (Disj i phi' psi)\n  then have \"doDisj (Opt i phi') (Opt i psi) \\<noteq> []\"\n    unfolding doDisj_def\n    apply auto\n    by (metis (mono_tags, lifting) List.list.distinct(1) Sum_Type.sum.case_eq_if)\n  then show ?case\n    using Disj trans_wqo refl_wqo pw_total\n    apply (auto intro!: bexI[OF _ min_list_wrt_in] disj_optimal disj_sound)\n    using disj_sound not_wqo total_on_def\n    by fastforce\nnext\n  note Opt.simps[simp del]\n  case (Conj i phi' psi)\n  then have \"doConj (Opt i phi') (Opt i psi) \\<noteq> []\"\n    unfolding doConj_def\n    apply auto\n    by (metis (mono_tags, lifting) List.list.distinct(1) Sum_Type.sum.case_eq_if)\n  then show ?case\n    using Conj trans_wqo refl_wqo pw_total\n    apply (auto intro!: bexI[OF _ min_list_wrt_in] conj_optimal conj_sound)\n    using conj_sound not_wqo total_on_def\n    by fastforce\nnext\n  note Opt.simps[simp del]\n  case (Impl i phi' psi)\n  then have \"doImpl (Opt i phi') (Opt i psi) \\<noteq> []\"\n    unfolding doImpl_def\n    apply auto\n    by (metis (mono_tags, lifting) List.list.distinct(1) Sum_Type.sum.case_eq_if)\n  then show ?case\n    using Impl trans_wqo refl_wqo pw_total\n    apply (auto intro!: bexI[OF _ min_list_wrt_in] impl_optimal impl_sound)\n    using impl_sound not_wqo total_on_def\n    by fastforce\nnext\n  note Opt.simps[simp del]\n  case (Iff i phi' psi)\n  then have \"doIff (Opt i phi') (Opt i psi) \\<noteq> []\"\n    unfolding doIff_def\n    apply auto\n    by (metis (mono_tags, lifting) List.list.distinct(1) Sum_Type.sum.case_eq_if)\n  then show ?case\n    using Iff trans_wqo refl_wqo pw_total\n    apply (auto intro!: bexI[OF _ min_list_wrt_in] iff_optimal iff_sound)\n    using iff_sound not_wqo total_on_def\n    by fastforce\nnext\n  note Opt.simps[simp del]\n  case (Next i I phi')\n  then have \"doNext i I (\\<Delta> rho (i+1)) (Opt (Suc i) phi') \\<noteq> []\"\n    unfolding doNext_def\n    by (auto split: sum.splits bool.splits)\n  then show ?case\n    using trans_wqo refl_wqo pw_total[of i \"Next I phi'\"] Next next_sound\n    by (auto simp: total_on_def intro!: bexI[OF _ min_list_wrt_in] next_optimal[simplified])\nnext\n  note Opt.simps[simp del]\n  case (Prev i I phi')\n  then have \"doPrev i I (\\<Delta> rho i) (Opt (i - 1) phi') \\<noteq> []\"\n    unfolding doPrev_def\n    by (auto split: sum.splits bool.splits)\n  moreover have \"optimal 0 (Prev I phi') (Inr VPrev_zero)\"\n    using refl_wqo\n    by (auto simp: optimal_def valid_def reflp_def v_check.simps split: sum.splits vproof.splits)\n  ultimately show ?case thm Cand.simps\n    using trans_wqo refl_wqo pw_total[of i \"Prev I phi'\"] Prev prev_optimal[of i, OF _ Prev] prev_sound[of i, OF _ Prev]\n    apply (cases i)\n    apply (auto simp: doPrev_def valid_def split: sum.splits bool.splits)[1]\n    by (auto simp: total_on_def elim: bounded_future.cases intro!: bexI[OF _ min_list_wrt_in, of _ wqo])\nnext\n  note Opt.simps[simp del]\n  case (Since i phi' I psi)\n  show ?case using Since\n    apply auto\n    apply (auto simp: optimal_def valid_def refl_wqo[unfolded reflp_def]\n        split: sum.splits)[1]\n    subgoal\n      using check_consistent[of \"Since phi' I psi\"]\n      apply (auto simp: optimal_def valid_def refl_wqo[unfolded reflp_def] v_check.simps\n          split: sum.splits vproof.splits)[1]\n      by (metis VSince_le bounded_future_simps(15) check_complete check_consistent)\n    subgoal\n      by (auto simp: Let_def dest!: sinceBase0_sound[rotated -1] sinceBaseNZ_sound[rotated -1]\n          since_sound[rotated -3, of _ _ _ _ _ _ phi' psi] split: if_splits)\n    subgoal\n      apply (auto simp: Let_def split: if_splits)\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        define p2 where p2_def: \"p2 \\<equiv> Opt i psi\"\n        from prems have i_props: \"i = 0 \\<and>  \\<tau> rho 0 + left I \\<le> \\<tau> rho i\"\n          by simp\n        from pw_total[of 0 \"Since phi' I psi\"]\n        have total_set: \"total_on wqo (set (doSinceBase i (left I) p1 p2))\"\n          using sinceBase0_sound[OF _ _ i_props] i_props prems(1,2)\n            p1_def p2_def\n          by (fastforce simp: total_on_def)\n        from prems p1_def p2_def have \"doSinceBase i (left I) p1 p2 \\<noteq> []\"\n          unfolding doSinceBase_def\n          by (auto split: sum.splits bool.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Since p1_def p2_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule sinceBase0_optimal[simplified]; auto)\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        define p2 where p2_def: \"p2 \\<equiv> Opt i psi\"\n        define p' where p'_def: \"p' \\<equiv> Opt (i - 1) (Since phi' (subtract (delta rho i (i - 1)) I) psi)\"\n        from prems have i_props: \"0 < i \\<and>  \\<tau> rho 0 + left I \\<le> \\<tau> rho i\n        \\<and> enat (delta rho i (i - 1)) \\<le> right I\"\n          by simp\n        from prems p'_def\n        have opt: \"optimal (i - 1) (Since phi' (subtract (delta rho i (i - 1)) I) psi) p'\"\n          by simp\n        from prems(5-7) have bf: \"bounded_future (Since phi' I psi)\"\n          and bf': \"bounded_future (Since phi' (subtract (delta rho i (i - 1)) I) psi)\"\n          by (auto intro: SinceBF)\n        from pw_total[of i \"Since phi' I psi\"]\n        have total_set: \"total_on wqo (set (doSince i (left I) p1 p2 p'))\"\n          using since_sound[OF i_props prems(1) prems(2) opt _ bf bf']\n            p'_def p1_def p2_def\n          by (auto simp: total_on_def)\n        from opt have not_le: \"p' \\<noteq> Inr (VSince_le (i-1))\"\n          using i_props_imp_not_le[OF i_props opt] p'_def\n          by auto\n        then have nnil: \"doSince i (left I) p1 p2 p' \\<noteq> []\"\n          using opt p1_def p2_def p'_def\n          unfolding doSince_def optimal_def valid_def\n          apply (simp add: Let_def split: sum.splits bool.split)\n          by (auto simp: Let_def split: vproof.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Since p'_def p1_def p2_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule since_optimal[simplified]; auto)\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        thm prems\n        from prems(3, 6) left_right[of I]\n        have False \n          by auto\n        then show ?thesis\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        define p2 where p2_def: \"p2 \\<equiv> Opt i psi\"\n        from prems have i_props: \"0 < i \\<and>  \\<tau> rho 0 + left I \\<le> \\<tau> rho i\n        \\<and> right I < enat (delta rho i (i - 1))\"\n          by simp\n        from pw_total[of i \"Since phi' I psi\"]\n        have total_set: \"total_on wqo (set (doSinceBase i (left I) p1 p2))\"\n          using sinceBaseNZ_sound[OF i_props prems(1) prems(2)]\n            p1_def p2_def\n          by (auto simp: total_on_def)\n        from prems p1_def p2_def have \"doSinceBase i (left I) p1 p2 \\<noteq> []\"\n          unfolding doSinceBase_def\n          by (auto split: sum.splits bool.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Since p1_def p2_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule sinceBaseNZ_optimal[simplified]; auto)\n          by auto\n      qed\n      done\n    done\nnext\n  note Opt.simps[simp del]\n  case (Until i phi' I psi)\n  then show ?case using trans_wqo pw_total refl_wqo\n    apply auto\n    apply (auto simp: Let_def dest!: untilBase_sound[rotated -1]\n        until_sound[rotated -3, of _ _ _ _ _ _ phi' psi] split: if_splits)[1]\n    subgoal for x\n      apply (auto simp: Let_def split: if_splits)\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        define p2 where p2_def: \"p2 \\<equiv> Opt i psi\"\n        define p' where p'_def: \"p' \\<equiv> Opt (i + 1) (Until phi' (subtract (delta rho (i + 1) i) I) psi)\"\n        from prems(9,10) have i_props: \"enat (\\<Delta> rho (i+1)) \\<le> right I\"\n          by auto\n        from prems p'_def\n        have opt: \"optimal (i + 1) (Until phi' (subtract (\\<Delta> rho (i+1)) I) psi) p'\"\n          by simp\n        from prems(7-9) have bf: \"bounded_future (Until phi' I psi)\"\n          and bf': \"bounded_future (Until phi' (subtract (\\<Delta> rho (i+1)) I) psi)\"\n          by (auto intro: UntilBF)\n        from pw_total[of i \"Until phi' I psi\"]\n        have total_set: \"total_on wqo (set (doUntil i (left I) p1 p2 p'))\"\n          using until_sound[OF i_props prems(1) prems(2) opt _ bf bf']\n            p'_def p1_def p2_def\n          by (auto simp: total_on_def)\n        have nnil: \"doUntil i (left I) p1 p2 p' \\<noteq> []\"\n          using opt p1_def p2_def p'_def prems(9)\n          unfolding doUntil_def\n          apply (auto simp: optimal_def valid_def split: sum.splits bool.splits)\n          by (auto simp: Let_def split: sproof.splits vproof.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Until p'_def p1_def p2_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule until_optimal[simplified]; auto)\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        define p2 where p2_def: \"p2 \\<equiv> Opt i psi\"\n        from prems(8,9) have i_props: \"right I < enat (\\<Delta> rho (i+1))\"\n          by simp\n        from pw_total[of i \"Until phi' I psi\"]\n        have total_set: \"total_on wqo (set (doUntilBase i (left I) p1 p2))\"\n          using untilBase_sound[OF i_props prems(1) prems(2)]\n            p1_def p2_def\n          by (auto simp: total_on_def)\n        from prems p1_def p2_def have \"doUntilBase i (left I) p1 p2 \\<noteq> []\"\n          unfolding doUntilBase_def\n          by (auto split: sum.splits bool.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Until p1_def p2_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule untilBase_optimal[simplified]; auto)\n          by auto\n      qed\n      done\n    done\nnext\n  note Opt.simps[simp del]\n  case (Once i I phi')\n  show ?case using Once\n    apply auto\n    apply (auto simp: optimal_def valid_def refl_wqo[unfolded reflp_def]\n        split: sum.splits)[1]\n    subgoal\n      using check_consistent[of \"Once I phi'\"]\n      unfolding optimal_def valid_def\n      apply (auto simp: refl_wqo[unfolded reflp_def] Let_def split: sum.splits)\n       apply (metis OnceBF VOnce_le check_complete)\n      apply (case_tac x2; simp add: refl_wqo[unfolded reflp_def])\n      done\n    subgoal\n      apply (auto simp: Let_def dest!: onceBase0_sound[rotated -1] onceBaseNZ_sound[rotated -1]\n          once_sound[rotated -3, of _ phi' _ _ _] split: if_splits)\n      using local.Once.IH(1) by force+\n    subgoal\n      apply (auto simp: Let_def split: if_splits)\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        from prems have i_props: \"i = 0 \\<and>  \\<tau> rho 0 + left I \\<le> \\<tau> rho i\"\n          by simp\n        from pw_total[of 0 \"Once I phi'\"]\n        have total_set: \"total_on wqo (set (doOnceBase i (left I) p1))\"\n          using onceBase0_sound[OF _ i_props] i_props prems(1,2)\n            p1_def\n          by (fastforce simp: total_on_def)\n        from prems p1_def have \"doOnceBase i (left I) p1 \\<noteq> []\"\n          unfolding doOnceBase_def\n          by (auto split: sum.splits bool.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Once p1_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule onceBase0_optimal[simplified]; auto)\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        define p' where p'_def: \"p' \\<equiv> Opt (i - 1) (Once (subtract (delta rho i (i - 1)) I) phi')\"\n        from prems have i_props: \"0 < i \\<and>  \\<tau> rho 0 + left I \\<le> \\<tau> rho i\n        \\<and> enat (delta rho i (i - 1)) \\<le> right I\"\n          by simp\n        from prems p'_def\n        have opt: \"optimal (i - 1) (Once (subtract (delta rho i (i - 1)) I) phi') p'\"\n          by simp\n        from prems(4-6) have bf: \"bounded_future (Once I phi')\"\n          and bf': \"bounded_future (Once (subtract (delta rho i (i - 1)) I) phi')\"\n          by (auto intro: OnceBF)\n        from pw_total[of i \"Once I phi'\"]\n        have total_set: \"total_on wqo (set (doOnce i (left I) p1 p'))\"\n          using once_sound[OF i_props prems(1) opt _ ]\n            p'_def p1_def\n          by (auto simp: total_on_def)\n        from opt have not_le: \"p' \\<noteq> Inr (VOnce_le (i-1))\"\n          using i_props_imp_not_le_once[OF i_props opt] p'_def\n          by auto\n        then have nnil: \"doOnce i (left I) p1 p' \\<noteq> []\"\n          using opt p1_def p'_def\n          unfolding doOnce_def optimal_def valid_def\n          apply (simp add: Let_def split: if_splits sum.splits bool.splits)\n          by (auto simp: Let_def split: sproof.splits vproof.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Once p'_def p1_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule once_optimal[simplified]; auto)\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        thm prems\n        from prems(2, 4) left_right[of I]\n        have False \n          by auto\n        then show ?thesis\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        from prems have i_props: \"0 < i \\<and>  \\<tau> rho 0 + left I \\<le> \\<tau> rho i\n        \\<and> right I < enat (delta rho i (i - 1))\"\n          by simp\n        from pw_total[of i \"Once I phi'\"]\n        have total_set: \"total_on wqo (set (doOnceBase i (left I) p1))\"\n          using onceBaseNZ_sound[OF i_props prems(1)]\n            p1_def\n          by (auto simp: total_on_def)\n        from prems p1_def have \"doOnceBase i (left I) p1 \\<noteq> []\"\n          unfolding doOnceBase_def\n          by (auto split: sum.splits bool.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Once p1_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule onceBaseNZ_optimal[simplified]; auto)\n          by auto\n      qed\n      done\n    done\nnext\n  note Opt.simps[simp del]\n  case (Historically i I phi')\n  show ?case using Historically\n    apply auto\n    apply (auto simp: optimal_def valid_def refl_wqo[unfolded reflp_def] \n        split: sum.splits)[1]\n    subgoal\n      thm sproof.splits\n      using check_consistent[of \"Historically I phi'\"] \n      unfolding optimal_def valid_def\n      apply (auto simp: refl_wqo[unfolded reflp_def] Let_def split: sum.splits)\n      apply (case_tac x1; simp add: refl_wqo[unfolded reflp_def])\n      using MTL.s_at.simps(16) s_check_simps(205) by blast\n    subgoal\n      apply (auto simp: Let_def dest!: historicallyBase0_sound[rotated -1] historicallyBaseNZ_sound[rotated -1]\n          historically_sound[rotated -3, of _ phi' _ _ _] split: if_splits)\n      using local.Historically.IH(1) by force+\n    subgoal\n      apply (auto simp: Let_def split: if_splits)\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        from prems have i_props: \"i = 0 \\<and>  \\<tau> rho 0 + left I \\<le> \\<tau> rho i\"\n          by simp\n        from pw_total[of 0 \"Historically I phi'\"]\n        have total_set: \"total_on wqo (set (doHistoricallyBase i (left I) p1))\"\n          using historicallyBase0_sound[OF _ i_props] i_props prems(1,2)\n            p1_def\n          by (fastforce simp: total_on_def)\n        from prems p1_def have \"doHistoricallyBase i (left I) p1 \\<noteq> []\"\n          unfolding doHistoricallyBase_def\n          by (auto split: sum.splits bool.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Historically p1_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule historicallyBase0_optimal[simplified]; auto)\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        define p' where p'_def: \"p' \\<equiv> Opt (i - 1) (Historically (subtract (delta rho i (i - 1)) I) phi')\"\n        from prems have i_props: \"0 < i \\<and>  \\<tau> rho 0 + left I \\<le> \\<tau> rho i\n        \\<and> enat (delta rho i (i - 1)) \\<le> right I\"\n          by simp\n        from prems p'_def\n        have opt: \"optimal (i - 1) (Historically (subtract (delta rho i (i - 1)) I) phi') p'\"\n          by simp\n        from prems(4-6) have bf: \"bounded_future (Historically I phi')\"\n          and bf': \"bounded_future (Historically (subtract (delta rho i (i - 1)) I) phi')\"\n          by (auto intro: HistoricallyBF)\n        from pw_total[of i \"Historically I phi'\"]\n        have total_set: \"total_on wqo (set (doHistorically i (left I) p1 p'))\"\n          using historically_sound[OF i_props prems(1) opt _ ]\n            p'_def p1_def\n          by (auto simp: total_on_def)\n        from opt have not_le: \"p' \\<noteq> Inl (SHistorically_le (i-1))\"\n          using i_props_imp_not_le_historically[OF i_props opt] p'_def\n          by auto\n        then have nnil: \"doHistorically i (left I) p1 p' \\<noteq> []\"\n          using opt p1_def p'_def\n          unfolding doHistorically_def optimal_def valid_def\n          apply (simp add: Let_def split: if_splits sum.splits bool.splits)\n          by (auto simp: Let_def split: sproof.splits vproof.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Historically p'_def p1_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule historically_optimal[simplified]; auto)\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        thm prems\n        from prems(2, 4) left_right[of I]\n        have False \n          by auto\n        then show ?thesis\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        from prems have i_props: \"0 < i \\<and>  \\<tau> rho 0 + left I \\<le> \\<tau> rho i\n        \\<and> right I < enat (delta rho i (i - 1))\"\n          by simp\n        from pw_total[of i \"Historically I phi'\"]\n        have total_set: \"total_on wqo (set (doHistoricallyBase i (left I) p1))\"\n          using historicallyBaseNZ_sound[OF i_props prems(1)]\n            p1_def\n          by (auto simp: total_on_def)\n        from prems p1_def have \"doHistoricallyBase i (left I) p1 \\<noteq> []\"\n          unfolding doHistoricallyBase_def\n          by (auto split: sum.splits bool.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Historically p1_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule historicallyBaseNZ_optimal[simplified]; auto)\n          by auto\n      qed\n      done\n    done\nnext\n  note Opt.simps[simp del]\n  case (Eventually i I phi')\n  then show ?case using trans_wqo pw_total refl_wqo\n    apply auto\n    apply (auto simp: Let_def dest!: eventuallyBase_sound[rotated -1]\n        eventually_sound [rotated -3, of _ _ _ _ _ phi'] split: if_splits)[1]\n    subgoal for x\n      apply (auto simp: Let_def split: if_splits)\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        define p' where p'_def: \"p' \\<equiv> Opt (i + 1) (Eventually (subtract (delta rho (i + 1) i) I) phi')\"\n        from prems(7,8) have i_props: \"enat (\\<Delta> rho (i+1)) \\<le> right I\"\n          by auto\n        from prems p'_def\n        have opt: \"optimal (i + 1) (Eventually (subtract (\\<Delta> rho (i+1)) I) phi') p'\"\n          by simp\n        from prems(6-8) have bf: \"bounded_future (Eventually I phi')\"\n          and bf': \"bounded_future (Eventually (subtract (\\<Delta> rho (i+1)) I) phi')\"\n          by (auto intro: EventuallyBF)\n        from pw_total[of i \"Eventually I phi'\"]\n        have total_set: \"total_on wqo (set (doEventually i (left I) p1 p'))\"\n          using eventually_sound[OF i_props prems(1) opt _ bf bf']\n            p'_def p1_def\n          by (auto simp: total_on_def)\n        have nnil: \"doEventually i (left I) p1 p' \\<noteq> []\"\n          using opt p1_def p1_def p'_def prems(8)\n          unfolding doEventually_def optimal_def valid_def\n          apply (simp add: Let_def  split: sum.splits bool.splits)\n          by (auto simp: Let_def split: sproof.splits vproof.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Eventually p'_def p1_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule eventually_optimal[simplified]; auto)\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        from prems(6,7) have i_props: \"right I < enat (\\<Delta> rho (i+1))\"\n          by simp\n        from pw_total[of i \"Eventually I phi'\"]\n        have total_set: \"total_on wqo (set (doEventuallyBase i (left I) p1))\"\n          using eventuallyBase_sound[OF i_props prems(1)] p1_def\n          by (auto simp: total_on_def)\n        from prems p1_def have \"doEventuallyBase i (left I) p1 \\<noteq> []\"\n          unfolding doEventuallyBase_def\n          by (auto split: sum.splits bool.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Eventually p1_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule eventuallyBase_optimal[simplified]; auto)\n          by auto\n      qed\n      done\n    done\nnext\n  note Opt.simps[simp del]\n  case (Always i I phi')\n  then show ?case using trans_wqo pw_total refl_wqo\n    apply auto\n    apply (auto simp: Let_def dest!: alwaysBase_sound[rotated -1]\n        always_sound [rotated -3, of _ _ _ _ _ phi'] split: if_splits)[1]\n    subgoal for x\n      apply (auto simp: Let_def split: if_splits)\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        define p' where p'_def: \"p' \\<equiv> Opt (i + 1) (Always (subtract (delta rho (i + 1) i) I) phi')\"\n        from prems(7,8) have i_props: \"enat (\\<Delta> rho (i+1)) \\<le> right I\"\n          by auto\n        from prems p'_def\n        have opt: \"optimal (i + 1) (Always (subtract (\\<Delta> rho (i+1)) I) phi') p'\"\n          by simp\n        from prems(6-8) have bf: \"bounded_future (Always I phi')\"\n          and bf': \"bounded_future (Always (subtract (\\<Delta> rho (i+1)) I) phi')\"\n          by auto\n        from pw_total[of i \"Always I phi'\"]\n        have total_set: \"total_on wqo (set (doAlways i (left I) p1 p'))\"\n          using always_sound[OF i_props prems(1) opt _ bf bf']\n            p'_def p1_def\n          by (auto simp: total_on_def)\n        have nnil: \"doAlways i (left I) p1 p' \\<noteq> []\"\n          using opt p1_def p1_def p'_def prems(8)\n          unfolding doAlways_def optimal_def valid_def\n          apply (simp add: Let_def  split: sum.splits bool.splits)\n          by (auto simp: Let_def split: sproof.splits vproof.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Always p'_def p1_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule always_optimal[simplified]; auto)\n          by auto\n      qed\n      subgoal premises prems\n      proof -\n        define p1 where p1_def: \"p1 = Opt i phi'\"\n        from prems(6,7) have i_props: \"right I < enat (\\<Delta> rho (i+1))\"\n          by simp\n        from pw_total[of i \"Always I phi'\"]\n        have total_set: \"total_on wqo (set (doAlwaysBase i (left I) p1))\"\n          using alwaysBase_sound[OF i_props prems(1)] p1_def\n          by (auto simp: total_on_def)\n        from prems p1_def have \"doAlwaysBase i (left I) p1 \\<noteq> []\"\n          unfolding doAlwaysBase_def\n          by (auto split: sum.splits bool.splits)\n        then show ?thesis\n          using trans_wqo refl_wqo total_set prems Always p1_def\n          apply auto\n          apply (rule bexI[OF _ min_list_wrt_in])\n          apply (rule alwaysBase_optimal[simplified]; auto)\n          by auto\n      qed\n      done\n    done\nnext\n  case (Opt i phi')\n  then show ?case\n    using trans_wqo pw_total refl_wqo\n    unfolding optimal_def\n    apply (auto simp: total_on_def)\n    apply (metis empty_iff empty_set min_list_wrt_in total_onI)\n    apply (rule trans_wqo[unfolded transp_def, rule_format, rotated])\n    apply (drule spec, erule mp, assumption)\n    apply (rule min_list_wrt_le[of wqo])\n    apply (auto simp: total_on_def refl_wqo dest: not_wqo[rotated -1])\n    done\nqed\n\nend\n\nend\n", "meta": {"author": "runtime-monitoring", "repo": "explanator2", "sha": "d263f14d886847cc2116b2e799b5eb45d0daeb9f", "save_path": "github-repos/isabelle/runtime-monitoring-explanator2", "path": "github-repos/isabelle/runtime-monitoring-explanator2/explanator2-d263f14d886847cc2116b2e799b5eb45d0daeb9f/formalization/thys/MTL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.33095108047264077}}
{"text": "theory Executions\nimports IOA \"~~/src/HOL/Library/Sublist\"\nbegin\n\n(* Author: Giuliano Losa. This theory is an adaptation of the one by Olaf Mueller found in \n  Isabelle/HOLCF *)\n\ncontext IOA begin\n\ndeclare Let_def[simp]\n\ndefinition proj_exec  (\"_ \\<downharpoonright> _ _\") where\n  \"proj_exec e i sig \\<equiv> \n    (fst e i, map (\\<lambda> p . (fst p, snd p i)) (filter (\\<lambda> p . fst p \\<in> actions sig) (snd e)))\"\n\nsection \"Composition is monotonic with respect to the implementation relation\"\n\n(*  Should also hold with the stuttering version of projection, would even be simpler *)\nlemma last_state_proj:\n  fixes fam i e\n  assumes \"i \\<in> ids fam\" and \"is_exec_frag_of (par fam) e\"\n  shows \"(last_state e) i = last_state (e \\<downharpoonright> i (ioa.asig (memb fam i)))\"\nproof -\n  have \"is_exec_frag_of (par fam) e \n        \\<Longrightarrow> (last_state e) i = last_state (e \\<downharpoonright> i (ioa.asig (memb fam i)))\"\n  proof (induction \"snd e\" arbitrary: e) \n    case Nil show ?case \n      by (simp add:proj_exec_def)\n      (metis last_state.simps(1) Nil.hyps filter.simps(1) list.simps(8) prod.collapse) \n  next \n    case (Cons p ps e)\n    from \"Cons.prems\" have 1:\"is_exec_frag_of (par fam) (fst e, ps)\"\n      by (metis Cons.hyps(2) is_exec_frag_of.simps(1) is_exec_frag_of.simps(3) list.exhaust surjective_pairing)\n    from 1 and \"Cons.hyps\"\n      have 2:\"(last_state (fst e, ps)) i = last_state ((fst e, ps) \\<downharpoonright> i (ioa.asig (memb fam i)))\" \n        by simp\n    show ?case\n    proof (cases \"fst p \\<in> act (memb fam i)\")\n      case True\n      hence \"last_state (fst e, p#ps) i = last_state ((fst e, p#ps) \\<downharpoonright> i (ioa.asig (memb fam i)))\"\n        by (simp add:proj_exec_def)\n      with Cons.hyps(2) show ?thesis by simp\n    next\n      case False\n      from False have 3: \"((fst e, p#ps) \\<downharpoonright> i (ioa.asig (memb fam i))) \n                          = ((fst e, ps) \\<downharpoonright> i (ioa.asig (memb fam i)))\"\n          by (simp add:proj_exec_def)\n      from False and `i \\<in> ids fam` and Cons.prems and Cons.hyps(2) \n        have 4:\"last_state (fst e, p#ps) i = last_state (fst e, ps) i\" \n          by  (cases \"(par fam, fst e, snd e)\" rule:is_exec_frag_of.cases)\n              (auto simp add:is_trans_def par_def)\n      from 2 3 4 Cons.hyps(2) show ?thesis by simp\n    qed\n  qed\n  with assms(2) show ?thesis by simp\nqed\n\nlemma proj_execs:\n  fixes fam i e\n  assumes \"is_exec_frag_of (par fam) e\"\n  and \"i \\<in> ids fam\"\n  defines sig_def:\"sig \\<equiv> ioa.asig (memb fam i)\"\n  and A_i_def:\"A_i \\<equiv> memb fam i\"\n  shows \"is_exec_frag_of A_i (e \\<downharpoonright> i sig)\" (* Here we would have a problem with the stuttering version of projections *)\nproof -\n  have \"is_exec_frag_of (par fam) e \n        \\<Longrightarrow> is_exec_frag_of A_i (e \\<downharpoonright> i sig)\"\n  proof (induction \"snd e\" arbitrary:e)\n    case Nil\n    thus ?case by (simp add:proj_exec_def)\n  next\n    case (Cons p ps e)\n    let ?e = \"(fst e, p#ps)\"\n    let ?e' = \"(fst e, ps)\"\n    thm Cons.hyps\n    from Cons.prems and Cons.hyps(2) have prems:\"is_exec_frag_of (par fam) ?e\" by simp\n    from Cons.hyps have ih:\"is_exec_frag_of (par fam) ?e' \n                          \\<Longrightarrow> is_exec_frag_of A_i (?e' \\<downharpoonright> i sig)\" by simp\n    from prems have 0:\"is_exec_frag_of (par fam) ?e'\" by (metis is_exec_frag_of.simps(1,3) list.exhaust)\n    from 0 and ih have 1:\"is_exec_frag_of A_i (?e' \\<downharpoonright> i sig)\" by auto\n    have \"is_exec_frag_of A_i (?e \\<downharpoonright> i sig)\"\n    proof (cases \"fst p \\<in> act A_i\")\n      case False\n      hence \"(?e \\<downharpoonright> i sig) = (?e' \\<downharpoonright> i sig)\" by (simp add:proj_exec_def sig_def A_i_def)\n      with 1 show ?thesis by simp\n    next\n      case True\n      from True and prems and `i \\<in> ids fam` \n        have 2:\"(last_state ?e' i)\\<midarrow>(fst p)\\<midarrow>A_i\\<longrightarrow>(snd p i)\"\n          by  (cases \"(par fam, ?e')\" rule:is_exec_frag_of.cases)\n              (auto simp add:A_i_def is_trans_def par_def split: if_splits)\n      from True have 3:\"(?e \\<downharpoonright> i sig) = cons_exec  (?e' \\<downharpoonright> i sig) (fst p, snd p i)\" \n        by (simp add:proj_exec_def A_i_def sig_def cons_exec_def)\n      from `i \\<in> ids fam` and last_state_proj and 0 \n        have 4:\"last_state ?e' i = last_state (?e' \\<downharpoonright>i sig)\" by (metis sig_def)\n      from 1 2 3 4 and trans_from_last_state show ?thesis by fastforce\n    qed\n    thus ?case using Cons.hyps(2) by simp\n  qed\n  with assms(1) show ?thesis by simp\nqed\n\n(*  This one is trickier. In the HOLCF theory, projection on a component does not remove steps but\n    instead results in suttering sequences. Stuttering sequences can be pasted easily. *)\nlemma paste_execs:\n  fixes fam and es and t::\"'a trace\" \n  assumes \"\\<forall> i \\<in> ids fam . is_exec_of (memb fam i) (es i)\"\n    and \"\\<forall> i \\<in> ids fam . let sig_i = ioa.asig (memb fam i) in (t \\<bar> sig_i) = trace sig_i (es i)\"\n  obtains e where \"is_exec_of (par fam) e\" and \"trace (ioa.asig (par fam)) e = t\" \n    and \"\\<forall> i \\<in> ids fam . (e \\<downharpoonright> i (ioa.asig (memb fam i))) = es i\" oops\n\nend", "meta": {"author": "nano-o", "repo": "IO-Automata", "sha": "a5fda5dd1fbccec9a8e087773fc71be0202b37f2", "save_path": "github-repos/isabelle/nano-o-IO-Automata", "path": "github-repos/isabelle/nano-o-IO-Automata/IO-Automata-a5fda5dd1fbccec9a8e087773fc71be0202b37f2/Executions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3309510733126297}}
{"text": "theory METASINVAR_SystemBoundary\nimports SINVAR_BLPtrusted_impl\n        SINVAR_SubnetsInGW_impl\n        \"../TopoS_Composition_Theory_impl\"\nbegin\n\n\nsubsubsection {* Meta SecurityInvariant: System Boundaries *}\n\n\ndatatype system_components = SystemComponent\n                           | SystemBoundaryInput\n                           | SystemBoundaryOutput\n                           | SystemBoundaryInputOutput\n\n\nfun system_components_to_subnets :: \"system_components \\<Rightarrow> subnets\" where\n  \"system_components_to_subnets SystemComponent = Member\" |\n  \"system_components_to_subnets SystemBoundaryInput = InboundGateway\" |\n  \"system_components_to_subnets SystemBoundaryOutput = Member\" |\n  \"system_components_to_subnets SystemBoundaryInputOutput = InboundGateway\"\n\nfun system_components_to_blp :: \"system_components \\<Rightarrow> SINVAR_BLPtrusted.node_config\" where\n  \"system_components_to_blp SystemComponent = \\<lparr> security_level = 1, trusted = False \\<rparr>\" |\n  \"system_components_to_blp SystemBoundaryInput = \\<lparr> security_level = 1, trusted = False \\<rparr>\" |\n  \"system_components_to_blp SystemBoundaryOutput = \\<lparr> security_level = 0, trusted = True \\<rparr>\" |\n  \"system_components_to_blp SystemBoundaryInputOutput = \\<lparr> security_level = 0, trusted = True \\<rparr>\"\n\ndefinition new_meta_system_boundary :: \"('v::vertex \\<times> system_components) list \\<Rightarrow> string \\<Rightarrow> ('v SecurityInvariant) list\" where \n  \"new_meta_system_boundary C description = [\n      new_configured_list_SecurityInvariant SINVAR_LIB_SubnetsInGW \\<lparr> \n          node_properties = map_of (map (\\<lambda>(v,c). (v, system_components_to_subnets c)) C)\n          \\<rparr> (description @ '' (ACS)'')\n      ,\n      new_configured_list_SecurityInvariant SINVAR_LIB_BLPtrusted \\<lparr> \n          node_properties = map_of (map (\\<lambda>(v,c). (v, system_components_to_blp c)) C)\n          \\<rparr> (description @ '' (IFS)'')\n      ]\"\n\n\nlemma system_components_to_subnets:\n      \"SINVAR_SubnetsInGW.allowed_subnet_flow\n        SINVAR_SubnetsInGW.default_node_properties\n        (system_components_to_subnets c) \\<longleftrightarrow>\n       c = SystemBoundaryInput \\<or> c = SystemBoundaryInputOutput\"\nby(cases c)(simp_all add: SINVAR_SubnetsInGW.default_node_properties_def)\n\nlemma system_components_to_blp:\n      \"(\\<not> trusted SINVAR_BLPtrusted.default_node_properties \\<longrightarrow>\n       security_level (system_components_to_blp c) \\<le> security_level SINVAR_BLPtrusted.default_node_properties)\n       \\<longleftrightarrow>\n       c = SystemBoundaryOutput \\<or> c = SystemBoundaryInputOutput\"\nby(cases c)(simp_all add: SINVAR_BLPtrusted.default_node_properties_def)\n\n\nlemma \"all_security_requirements_fulfilled (new_meta_system_boundary C description) G \\<longleftrightarrow>\n       (\\<forall>(v\\<^sub>1, v\\<^sub>2) \\<in> set (edgesL G). case ((map_of C) v\\<^sub>1, (map_of C) v\\<^sub>2)\n          of \n          (*No restrictions outside of the component*)\n             (None, None) \\<Rightarrow> True\n\n          (*no restrictions inside the component*)\n          |  (Some c1, Some c2) \\<Rightarrow> True\n\n          (*System Boundaries Input*)\n          |  (None, Some SystemBoundaryInputOutput) \\<Rightarrow> True\n          |  (None, Some SystemBoundaryInput) \\<Rightarrow> True\n\n          (*System Boundaries Output*)\n          |  (Some SystemBoundaryOutput, None) \\<Rightarrow> True\n          |  (Some SystemBoundaryInputOutput, None) \\<Rightarrow> True\n\n          (*everything else is prohibited*)\n          |  _ \\<Rightarrow> False\n       )\"\napply(simp)\napply(simp add: new_meta_system_boundary_def)\napply(simp add: all_security_requirements_fulfilled_def)\napply(simp add: Let_def)\napply(simp add: SINVAR_LIB_SubnetsInGW_def SINVAR_LIB_BLPtrusted_def)\napply(simp add: SINVAR_SubnetsInGW_impl.NetModel_node_props_def SINVAR_BLPtrusted_impl.NetModel_node_props_def)\napply(rule iffI)\n apply(clarsimp)\n subgoal for a b\n apply(erule_tac x=\"(a,b)\" in ballE)+\n  apply(simp_all)\n apply(case_tac \"map_of C a\")\n  apply(case_tac \"map_of C b\")\n   apply(simp_all)\n  apply(simp add: map_of_map)\n  apply(simp split: system_components.split)\n  apply(simp add: system_components_to_subnets)\n  apply blast\n apply(case_tac \"map_of C b\")\n  apply(simp add: map_of_map)\n  apply(simp split: system_components.split)\n  apply(simp add: system_components_to_blp)\n  apply blast\n apply(simp add: map_of_map)\n apply(simp split: system_components.split; fail)\n done\napply(intro conjI)\n apply(simp add: map_of_map)\n apply(clarsimp)\n subgoal for a b\n apply(erule_tac x=\"(a,b)\" in ballE)+\n  apply(simp_all)\n apply(simp split: option.split_asm system_components.split_asm)\n    by(simp_all add: SINVAR_SubnetsInGW.default_node_properties_def)\napply(clarsimp)\nsubgoal for a b\napply(erule_tac x=\"(a,b)\" in ballE)+\n apply(simp_all)\napply(simp add: map_of_map)\napply(simp split: option.split_asm system_components.split_asm)\n  apply(simp add: SINVAR_BLPtrusted.default_node_properties_def; fail)\n apply(rename_tac x, case_tac x, simp_all)+\ndone\ndone\n\n\nvalue[code] \"let nodes = [1,2,3,4,8,9,10];\n           sinvars = new_meta_system_boundary\n              [(1::int, SystemBoundaryInput),\n               (2, SystemComponent),\n               (3, SystemBoundaryOutput),\n               (4, SystemBoundaryInputOutput)\n               ] ''foobar''\n       in generate_valid_topology sinvars \\<lparr>nodesL = nodes, edgesL = List.product nodes nodes \\<rparr>\"\n\n\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/Security_Invariants/METASINVAR_SystemBoundary.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723316860482762, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.33091367914212033}}
{"text": "(*  Title:      HOL/MicroJava/BV/LBVComplete.thy\n    Author:     Gerwin Klein\n    Copyright   2000 Technische Universitaet Muenchen\n*)\n\nheader {* \\isaheader{Completeness of the LBV} *}\n\ntheory LBVComplete\nimports LBVSpec Typing_Framework\nbegin\n\ndefinition is_target :: \"'s step_type \\<Rightarrow> 's list \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"is_target step \\<tau>s pc' \\<longleftrightarrow> (\\<exists>pc s'. pc' \\<noteq> pc+1 \\<and> pc < size \\<tau>s \\<and> (pc',s') \\<in> set (step pc (\\<tau>s!pc)))\"\n\ndefinition make_cert :: \"'s step_type \\<Rightarrow> 's list \\<Rightarrow> 's \\<Rightarrow> 's certificate\" where\n  \"make_cert step \\<tau>s B = map (\\<lambda>pc. if is_target step \\<tau>s pc then \\<tau>s!pc else B) [0..<size \\<tau>s] @ [B]\"\n\n\n\nlocale lbvc = lbv + \n  fixes \\<tau>s :: \"'a list\" \n  fixes c :: \"'a list\" \n  defines cert_def: \"c \\<equiv> make_cert step \\<tau>s \\<bottom>\"\n\n  assumes mono: \"mono r step (size \\<tau>s) A\"\n  assumes pres: \"pres_type step (size \\<tau>s) A\" \n  assumes \\<tau>s:  \"\\<forall>pc < size \\<tau>s. \\<tau>s!pc \\<in> A \\<and> \\<tau>s!pc \\<noteq> \\<top>\"\n  assumes bounded: \"bounded step (size \\<tau>s)\"\n\n  assumes B_neq_T: \"\\<bottom> \\<noteq> \\<top>\" \n\n\nlemma (in lbvc) cert: \"cert_ok c (size \\<tau>s) \\<top> \\<bottom> A\"\n(*<*)\nproof (unfold cert_ok_def, intro strip conjI)  \n  note [simp] = make_cert_def cert_def nth_append \n\n  show \"c!size \\<tau>s = \\<bottom>\" by simp\n\n  fix pc assume pc: \"pc < size \\<tau>s\" \n  from pc \\<tau>s B_A show \"c!pc \\<in> A\" by simp\n  from pc \\<tau>s B_neq_T show \"c!pc \\<noteq> \\<top>\" by simp\nqed\n(*>*)\n\nlemmas [simp del] = split_paired_Ex\n\nlemma (in lbvc) cert_target [intro?]:\n  \"\\<lbrakk> (pc',s') \\<in> set (step pc (\\<tau>s!pc));\n      pc' \\<noteq> pc+1; pc < size \\<tau>s; pc' < size \\<tau>s \\<rbrakk>\n  \\<Longrightarrow> c!pc' = \\<tau>s!pc'\"\n(*<*) by (auto simp add: cert_def make_cert_def nth_append is_target_def) (*>*)\n\nlemma (in lbvc) cert_approx [intro?]:\n  \"\\<lbrakk> pc < size \\<tau>s; c!pc \\<noteq> \\<bottom> \\<rbrakk> \\<Longrightarrow> c!pc = \\<tau>s!pc\"\n(*<*) by (auto simp add: cert_def make_cert_def nth_append) (*>*)\n\nlemma (in lbv) le_top [simp, intro]: \"x <=_r \\<top>\"\n(*<*) by (insert top) simp (*>*)\n  \nlemma (in lbv) merge_mono:\n  assumes less:  \"set ss\\<^sub>2 {\\<sqsubseteq>\\<^bsub>r\\<^esub>} set ss\\<^sub>1\"\n  assumes x:     \"x \\<in> A\"\n  assumes ss\\<^sub>1:   \"snd`set ss\\<^sub>1 \\<subseteq> A\"\n  assumes ss\\<^sub>2:   \"snd`set ss\\<^sub>2 \\<subseteq> A\"\n  shows \"merge c pc ss\\<^sub>2 x \\<sqsubseteq>\\<^sub>r merge c pc ss\\<^sub>1 x\" (is \"?s\\<^sub>2 \\<sqsubseteq>\\<^sub>r ?s\\<^sub>1\")\n(*<*)\nproof-\n  have \"?s\\<^sub>1 = \\<top> \\<Longrightarrow> ?thesis\" by simp\n  moreover {\n    assume merge: \"?s\\<^sub>1 \\<noteq> T\" \n    from x ss\\<^sub>1 have \"?s\\<^sub>1 =\n      (if \\<forall>(pc',s')\\<in>set ss\\<^sub>1. pc' \\<noteq> pc + 1 \\<longrightarrow> s' \\<sqsubseteq>\\<^sub>r c!pc'\n      then (map snd [(p', t') \\<leftarrow> ss\\<^sub>1 . p'=pc+1]) \\<Squnion>\\<^bsub>f\\<^esub> x\n      else \\<top>)\" by (rule merge_def)  \n    with merge obtain\n      app: \"\\<forall>(pc',s')\\<in>set ss\\<^sub>1. pc' \\<noteq> pc+1 \\<longrightarrow> s' \\<sqsubseteq>\\<^sub>r c!pc'\" \n           (is \"?app ss\\<^sub>1\") and\n      sum: \"(map snd [(p',t') \\<leftarrow> ss\\<^sub>1 . p' = pc+1] \\<Squnion>\\<^bsub>f\\<^esub> x) = ?s\\<^sub>1\" \n           (is \"?map ss\\<^sub>1 \\<Squnion>\\<^bsub>f\\<^esub> x = _\" is \"?sum ss\\<^sub>1 = _\")\n      by (simp split: split_if_asm)\n    from app less have \"?app ss\\<^sub>2\" by (blast dest: trans_r lesub_step_typeD)\n    moreover {\n      from ss\\<^sub>1 have map1: \"set (?map ss\\<^sub>1) \\<subseteq> A\" by auto\n      with x and semilat Semilat_axioms have \"?sum ss\\<^sub>1 \\<in> A\" by (auto intro!: plusplus_closed)\n      with sum have \"?s\\<^sub>1 \\<in> A\" by simp\n      moreover    \n      have mapD: \"\\<And>x ss. x \\<in> set (?map ss) \\<Longrightarrow> \\<exists>p. (p,x) \\<in> set ss \\<and> p=pc+1\" by auto\n      from x map1 have \"\\<forall>x \\<in> set (?map ss\\<^sub>1). x \\<sqsubseteq>\\<^sub>r ?sum ss\\<^sub>1\" by clarify (rule pp_ub1)\n      with sum have \"\\<forall>x \\<in> set (?map ss\\<^sub>1). x \\<sqsubseteq>\\<^sub>r ?s\\<^sub>1\" by simp\n      with less have \"\\<forall>x \\<in> set (?map ss\\<^sub>2). x \\<sqsubseteq>\\<^sub>r ?s\\<^sub>1\"\n        by (fastforce dest!: mapD lesub_step_typeD intro: trans_r)\n      moreover from map1 x have \"x \\<sqsubseteq>\\<^sub>r (?sum ss\\<^sub>1)\" by (rule pp_ub2)\n      with sum have \"x \\<sqsubseteq>\\<^sub>r ?s\\<^sub>1\" by simp\n      moreover from ss\\<^sub>2 have \"set (?map ss\\<^sub>2) \\<subseteq> A\" by auto\n      ultimately  have \"?sum ss\\<^sub>2 \\<sqsubseteq>\\<^sub>r ?s\\<^sub>1\" using x by - (rule pp_lub)\n    }\n    moreover from x ss\\<^sub>2 have \"?s\\<^sub>2 =\n      (if \\<forall>(pc', s')\\<in>set ss\\<^sub>2. pc' \\<noteq> pc + 1 \\<longrightarrow> s' \\<sqsubseteq>\\<^sub>r c!pc'\n      then map snd [(p', t') \\<leftarrow> ss\\<^sub>2 . p' = pc + 1] \\<Squnion>\\<^bsub>f\\<^esub> x\n      else \\<top>)\" by (rule merge_def)\n    ultimately have ?thesis by simp\n  }\n  ultimately show ?thesis by (cases \"?s\\<^sub>1 = \\<top>\") auto\nqed\n(*>*)\n\nlemma (in lbvc) wti_mono:\n  assumes less: \"s\\<^sub>2 \\<sqsubseteq>\\<^sub>r s\\<^sub>1\"\n  assumes pc: \"pc < size \\<tau>s\" and s\\<^sub>1: \"s\\<^sub>1 \\<in> A\" and s\\<^sub>2: \"s\\<^sub>2 \\<in> A\"\n  shows \"wti c pc s\\<^sub>2 \\<sqsubseteq>\\<^sub>r wti c pc s\\<^sub>1\" (is \"?s\\<^sub>2' \\<sqsubseteq>\\<^sub>r ?s\\<^sub>1'\")\n(*<*)\nproof -\n  from mono pc s\\<^sub>2 less have \"set (step pc s\\<^sub>2) {\\<sqsubseteq>\\<^bsub>r\\<^esub>} set (step pc s\\<^sub>1)\" by (rule monoD)\n  moreover from cert B_A pc have \"c!Suc pc \\<in> A\" by (rule cert_okD3)\n  moreover from pres s\\<^sub>1 pc have \"snd`set (step pc s\\<^sub>1) \\<subseteq> A\" by (rule pres_typeD2)\n  moreover from pres s\\<^sub>2 pc have \"snd`set (step pc s\\<^sub>2) \\<subseteq> A\" by (rule pres_typeD2)\n  ultimately show ?thesis by (simp add: wti merge_mono)\nqed \n(*>*)\n\nlemma (in lbvc) wtc_mono:\n  assumes less: \"s\\<^sub>2 \\<sqsubseteq>\\<^sub>r s\\<^sub>1\"\n  assumes pc: \"pc < size \\<tau>s\" and s\\<^sub>1: \"s\\<^sub>1 \\<in> A\" and s\\<^sub>2: \"s\\<^sub>2 \\<in> A\"\n  shows \"wtc c pc s\\<^sub>2 \\<sqsubseteq>\\<^sub>r wtc c pc s\\<^sub>1\" (is \"?s\\<^sub>2' \\<sqsubseteq>\\<^sub>r ?s\\<^sub>1'\")\n(*<*)\nproof (cases \"c!pc = \\<bottom>\")\n  case True \n  moreover from less pc s\\<^sub>1 s\\<^sub>2 have \"wti c pc s\\<^sub>2 \\<sqsubseteq>\\<^sub>r wti c pc s\\<^sub>1\" by (rule wti_mono)\n  ultimately show ?thesis by (simp add: wtc)\nnext\n  case False\n  have \"?s\\<^sub>1' = \\<top> \\<Longrightarrow> ?thesis\" by simp\n  moreover {\n    assume \"?s\\<^sub>1' \\<noteq> \\<top>\" \n    with False have c: \"s\\<^sub>1 \\<sqsubseteq>\\<^sub>r c!pc\" by (simp add: wtc split: split_if_asm)\n    with less have \"s\\<^sub>2 \\<sqsubseteq>\\<^sub>r c!pc\" ..\n    with False c have ?thesis by (simp add: wtc)\n  }\n  ultimately show ?thesis by (cases \"?s\\<^sub>1' = \\<top>\") auto\nqed\n(*>*)\n\nlemma (in lbv) top_le_conv [simp]: \"\\<top> \\<sqsubseteq>\\<^sub>r x = (x = \\<top>)\"\n(*<*) by (insert semilat) (simp add: top top_le_conv)  (*>*)\n\nlemma (in lbv) neq_top [simp, elim]: \"\\<lbrakk> x \\<sqsubseteq>\\<^sub>r y; y \\<noteq> \\<top> \\<rbrakk> \\<Longrightarrow> x \\<noteq> \\<top>\"\n(*<*) by (cases \"x = T\") auto (*>*)\n\nlemma (in lbvc) stable_wti:\n  assumes stable:  \"stable r step \\<tau>s pc\" and pc: \"pc < size \\<tau>s\"\n  shows \"wti c pc (\\<tau>s!pc) \\<noteq> \\<top>\"\n(*<*)\nproof -\n  let ?step = \"step pc (\\<tau>s!pc)\"\n  from stable \n  have less: \"\\<forall>(q,s')\\<in>set ?step. s' \\<sqsubseteq>\\<^sub>r \\<tau>s!q\" by (simp add: stable_def)\n  \n  from cert B_A pc have cert_suc: \"c!Suc pc \\<in> A\" by (rule cert_okD3)\n  moreover from \\<tau>s pc have \"\\<tau>s!pc \\<in> A\" by simp\n  with pres pc have stepA: \"snd`set ?step \\<subseteq> A\" by - (rule pres_typeD2)\n  ultimately\n  have \"merge c pc ?step (c!Suc pc) =\n    (if \\<forall>(pc',s')\\<in>set ?step. pc'\\<noteq>pc+1 \\<longrightarrow> s' \\<sqsubseteq>\\<^sub>r c!pc'\n    then map snd [(p',t') \\<leftarrow> ?step.p'=pc+1] \\<Squnion>\\<^bsub>f\\<^esub> c!Suc pc\n    else \\<top>)\" unfolding mrg_def by (rule lbv.merge_def [OF lbvc.axioms(1), OF lbvc_axioms])\n  moreover {\n    fix pc' s' assume s': \"(pc',s') \\<in> set ?step\" and suc_pc: \"pc' \\<noteq> pc+1\"\n    with less have \"s' \\<sqsubseteq>\\<^sub>r \\<tau>s!pc'\" by auto\n    also from bounded pc s' have \"pc' < size \\<tau>s\" by (rule boundedD)\n    with s' suc_pc pc have \"c!pc' = \\<tau>s!pc'\" ..\n    hence \"\\<tau>s!pc' = c!pc'\" ..\n    finally have \"s' \\<sqsubseteq>\\<^sub>r c!pc'\" .\n  } hence \"\\<forall>(pc',s')\\<in>set ?step. pc'\\<noteq>pc+1 \\<longrightarrow> s' \\<sqsubseteq>\\<^sub>r c!pc'\" by auto\n  moreover from pc have \"Suc pc = size \\<tau>s \\<or> Suc pc < size \\<tau>s\" by auto\n  hence \"map snd [(p',t') \\<leftarrow> ?step.p'=pc+1] \\<Squnion>\\<^bsub>f\\<^esub> c!Suc pc \\<noteq> \\<top>\" (is \"?map \\<Squnion>\\<^bsub>f\\<^esub> _ \\<noteq> _\")\n  proof (rule disjE)\n    assume pc': \"Suc pc = size \\<tau>s\"\n    with cert have \"c!Suc pc = \\<bottom>\" by (simp add: cert_okD2)\n    moreover \n    from pc' bounded pc \n    have \"\\<forall>(p',t')\\<in>set ?step. p'\\<noteq>pc+1\" by clarify (drule boundedD, auto)\n    hence \"[(p',t') \\<leftarrow> ?step. p'=pc+1] = []\" by (blast intro: filter_False)\n    hence \"?map = []\" by simp\n    ultimately show ?thesis by (simp add: B_neq_T)\n  next\n    assume pc': \"Suc pc < size \\<tau>s\"\n    from pc' \\<tau>s have \"\\<tau>s!Suc pc \\<in> A\" by simp\n    moreover note cert_suc\n    moreover from stepA have \"set ?map \\<subseteq> A\" by auto\n    moreover have \"\\<And>s. s \\<in> set ?map \\<Longrightarrow> \\<exists>t. (Suc pc, t) \\<in> set ?step\" by auto\n    with less have \"\\<forall>s' \\<in> set ?map. s' \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" by auto\n    moreover from pc' have \"c!Suc pc \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" \n      by (cases \"c!Suc pc = \\<bottom>\") (auto dest: cert_approx)\n    ultimately have \"?map \\<Squnion>\\<^bsub>f\\<^esub> c!Suc pc \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" by (rule pp_lub)\n    moreover from pc' \\<tau>s have \"\\<tau>s!Suc pc \\<noteq> \\<top>\" by simp\n    ultimately show ?thesis by auto\n  qed\n  ultimately have \"merge c pc ?step (c!Suc pc) \\<noteq> \\<top>\" by simp\n  thus ?thesis by (simp add: wti)  \nqed\n(*>*)\n\nlemma (in lbvc) wti_less:\n  assumes stable: \"stable r step \\<tau>s pc\" and suc_pc: \"Suc pc < size \\<tau>s\"\n  shows \"wti c pc (\\<tau>s!pc) \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" (is \"?wti \\<sqsubseteq>\\<^sub>r _\")\n(*<*)\nproof -\n  let ?step = \"step pc (\\<tau>s!pc)\"\n\n  from stable\n  have less: \"\\<forall>(q,s')\\<in>set ?step. s' \\<sqsubseteq>\\<^sub>r \\<tau>s!q\" by (simp add: stable_def)\n   \n  from suc_pc have pc: \"pc < size \\<tau>s\" by simp\n  with cert B_A have cert_suc: \"c!Suc pc \\<in> A\" by (rule cert_okD3)\n  moreover from \\<tau>s pc have \"\\<tau>s!pc \\<in> A\" by simp\n  with pres pc have stepA: \"snd`set ?step \\<subseteq> A\" by - (rule pres_typeD2)\n  moreover from stable pc have \"?wti \\<noteq> \\<top>\" by (rule stable_wti)\n  hence \"merge c pc ?step (c!Suc pc) \\<noteq> \\<top>\" by (simp add: wti)\n  ultimately\n  have \"merge c pc ?step (c!Suc pc) =\n    map snd [(p',t') \\<leftarrow> ?step.p'=pc+1] \\<Squnion>\\<^bsub>f\\<^esub> c!Suc pc\" by (rule merge_not_top_s) \n  hence \"?wti = \\<dots>\" (is \"_ = (?map \\<Squnion>\\<^bsub>f\\<^esub> _)\" is \"_ = ?sum\") by (simp add: wti)\n  also {\n    from suc_pc \\<tau>s have \"\\<tau>s!Suc pc \\<in> A\" by simp\n    moreover note cert_suc\n    moreover from stepA have \"set ?map \\<subseteq> A\" by auto\n    moreover have \"\\<And>s. s \\<in> set ?map \\<Longrightarrow> \\<exists>t. (Suc pc, t) \\<in> set ?step\" by auto\n    with less have \"\\<forall>s' \\<in> set ?map. s' \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" by auto\n    moreover from suc_pc have \"c!Suc pc \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\"\n      by (cases \"c!Suc pc = \\<bottom>\") (auto dest: cert_approx)\n    ultimately have \"?sum \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" by (rule pp_lub)\n  }\n  finally show ?thesis .\nqed\n(*>*)\n\nlemma (in lbvc) stable_wtc:\n  assumes stable: \"stable r step \\<tau>s pc\" and pc: \"pc < size \\<tau>s\"\n  shows \"wtc c pc (\\<tau>s!pc) \\<noteq> \\<top>\"\n(*<*)\nproof -\n  from stable pc have wti: \"wti c pc (\\<tau>s!pc) \\<noteq> \\<top>\" by (rule stable_wti)\n  show ?thesis\n  proof (cases \"c!pc = \\<bottom>\")\n    case True with wti show ?thesis by (simp add: wtc)\n  next\n    case False\n    with pc have \"c!pc = \\<tau>s!pc\" ..    \n    with False wti show ?thesis by (simp add: wtc)\n  qed\nqed\n(*>*)\n\nlemma (in lbvc) wtc_less:\n  assumes stable: \"stable r step \\<tau>s pc\" and suc_pc: \"Suc pc < size \\<tau>s\"\n  shows \"wtc c pc (\\<tau>s!pc) \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" (is \"?wtc \\<sqsubseteq>\\<^sub>r _\")\n(*<*)\nproof (cases \"c!pc = \\<bottom>\")\n  case True\n  moreover from stable suc_pc have \"wti c pc (\\<tau>s!pc) \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" by (rule wti_less)\n  ultimately show ?thesis by (simp add: wtc)\nnext\n  case False\n  from suc_pc have pc: \"pc < size \\<tau>s\" by simp\n  with stable have \"?wtc \\<noteq> \\<top>\" by (rule stable_wtc)\n  with False have \"?wtc = wti c pc (c!pc)\" \n    by (unfold wtc) (simp split: split_if_asm)\n  also from pc False have \"c!pc = \\<tau>s!pc\" .. \n  finally have \"?wtc = wti c pc (\\<tau>s!pc)\" .\n  also from stable suc_pc have \"wti c pc (\\<tau>s!pc) \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" by (rule wti_less)\n  finally show ?thesis .\nqed\n(*>*)\n\nlemma (in lbvc) wt_step_wtl_lemma:\n  assumes wt_step: \"wt_step r \\<top> step \\<tau>s\"\n  shows \"\\<And>pc s. pc+size ls = size \\<tau>s \\<Longrightarrow> s \\<sqsubseteq>\\<^sub>r \\<tau>s!pc \\<Longrightarrow> s \\<in> A \\<Longrightarrow> s\\<noteq>\\<top> \\<Longrightarrow>\n                wtl ls c pc s \\<noteq> \\<top>\"\n  (is \"\\<And>pc s. _ \\<Longrightarrow> _ \\<Longrightarrow> _ \\<Longrightarrow> _ \\<Longrightarrow> ?wtl ls pc s \\<noteq> _\")\n(*<*)\nproof (induct ls)\n  fix pc s assume \"s\\<noteq>\\<top>\" thus \"?wtl [] pc s \\<noteq> \\<top>\" by simp\nnext\n  fix pc s i ls\n  assume \"\\<And>pc s. pc+size ls=size \\<tau>s \\<Longrightarrow> s \\<sqsubseteq>\\<^sub>r \\<tau>s!pc \\<Longrightarrow> s \\<in> A \\<Longrightarrow> s\\<noteq>\\<top> \\<Longrightarrow> \n                  ?wtl ls pc s \\<noteq> \\<top>\"\n  moreover\n  assume pc_l: \"pc + size (i#ls) = size \\<tau>s\"\n  hence suc_pc_l: \"Suc pc + size ls = size \\<tau>s\" by simp\n  ultimately\n  have IH: \"\\<And>s. s \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc \\<Longrightarrow> s \\<in> A \\<Longrightarrow> s \\<noteq> \\<top> \\<Longrightarrow> ?wtl ls (Suc pc) s \\<noteq> \\<top>\" .\n\n  from pc_l obtain pc: \"pc < size \\<tau>s\" by simp\n  with wt_step have stable: \"stable r step \\<tau>s pc\" by (simp add: wt_step_def)\n  moreover note pc\n  ultimately have wt_\\<tau>s: \"wtc c pc (\\<tau>s!pc) \\<noteq> \\<top>\" by (rule stable_wtc)\n\n  assume s_\\<tau>s: \"s \\<sqsubseteq>\\<^sub>r \\<tau>s!pc\"\n  assume sA: \"s \\<in> A\"\n  from \\<tau>s pc have \\<tau>s_pc: \"\\<tau>s!pc \\<in> A\" by simp\n  from s_\\<tau>s pc \\<tau>s_pc sA have wt_s_\\<tau>s: \"wtc c pc s \\<sqsubseteq>\\<^sub>r wtc c pc (\\<tau>s!pc)\" by (rule wtc_mono)\n  with wt_\\<tau>s have wt_s: \"wtc c pc s \\<noteq> \\<top>\" by simp\n  moreover assume s: \"s \\<noteq> \\<top>\" \n  ultimately have \"ls = [] \\<Longrightarrow> ?wtl (i#ls) pc s \\<noteq> \\<top>\" by simp\n  moreover {\n    assume \"ls \\<noteq> []\" \n    with pc_l have suc_pc: \"Suc pc < size \\<tau>s\" by (auto simp add: neq_Nil_conv)\n    with stable have \"wtc c pc (\\<tau>s!pc) \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" by (rule wtc_less)\n    with wt_s_\\<tau>s have \"wtc c pc s \\<sqsubseteq>\\<^sub>r \\<tau>s!Suc pc\" by (rule trans_r)      \n    moreover from cert suc_pc have \"c!pc \\<in> A\" \"c!(pc+1) \\<in> A\" \n      by (auto simp add: cert_ok_def)\n    from pres this sA pc have \"wtc c pc s \\<in> A\" by (rule wtc_pres)\n    ultimately have \"?wtl ls (Suc pc) (wtc c pc s) \\<noteq> \\<top>\" using IH wt_s by blast\n    with s wt_s have \"?wtl (i#ls) pc s \\<noteq> \\<top>\" by simp \n  }\n  ultimately show \"?wtl (i#ls) pc s \\<noteq> \\<top>\" by (cases ls) blast+\nqed\n(*>*)\n\ntheorem (in lbvc) wtl_complete:\n  assumes wt: \"wt_step r \\<top> step \\<tau>s\"\n  assumes s: \"s \\<sqsubseteq>\\<^sub>r \\<tau>s!0\" \"s \\<in> A\" \"s \\<noteq> \\<top>\" and eq: \"size ins = size \\<tau>s\"\n  shows \"wtl ins c 0 s \\<noteq> \\<top>\"\n(*<*)\nproof -  \n  from eq have \"0+size ins = size \\<tau>s\" by simp\n  from wt this s show ?thesis by (rule wt_step_wtl_lemma)\nqed\n(*>*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/DFA/LBVComplete.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.33090176139532157}}
{"text": "(*\nAuthor:  Christian Sternagel <c.sternagel@gmail.com>\nAuthor:  René Thiemann <rene.thiemann@uibk.ac.at>\nLicense: LGPL\n*)\nsection \\<open>Abstract Matching\\<close>\n\ntheory Abstract_Matching\n  imports\n    Term_Pair_Multiset\n    \"Abstract-Rewriting.Abstract_Rewriting\"\nbegin\n\n(*FIXME: move(?)*)\nlemma singleton_eq_union_iff [iff]:\n  \"{#x#} = M + {#y#} \\<longleftrightarrow> M = {#} \\<and> x = y\"\n  by (metis multi_self_add_other_not_self single_eq_single single_is_union)\n\ntext \\<open>Turning functional maps into substitutions.\\<close>\ndefinition \"subst_of_map d \\<sigma> x =\n  (case \\<sigma> x of\n    None \\<Rightarrow> d x\n  | Some t \\<Rightarrow> t)\"\n\n\n\ndefinition matchers :: \"(('f, 'v) term \\<times> ('f, 'w) term) set \\<Rightarrow> ('f, 'v, 'w) gsubst set\"\n  where\n    \"matchers P = {\\<sigma>. \\<forall>e\\<in>P. fst e \\<cdot> \\<sigma> = snd e}\"\n\nlemma matchers_vars_term_eq:\n  assumes \"\\<sigma> \\<in> matchers P\" and \"\\<tau> \\<in> matchers P\"\n    and \"(s, t) \\<in> P\"\n  shows \"\\<forall>x\\<in>vars_term s. \\<sigma> x = \\<tau> x\"\n  using assms unfolding term_subst_eq_conv [symmetric] by (force simp: matchers_def)\n\nlemma matchers_empty [simp]:\n  \"matchers {} = UNIV\"\n  by (simp add: matchers_def)\n\nlemma matchers_insert [simp]:\n  \"matchers (insert e P) = {\\<sigma>. fst e \\<cdot> \\<sigma> = snd e} \\<inter> matchers P\"\n  by (auto simp: matchers_def)\n\nlemma matchers_Un [simp]:\n  \"matchers (P \\<union> P') = matchers P \\<inter> matchers P'\"\n  by (auto simp: matchers_def)\n\nlemma matchers_set_zip [simp]:\n  assumes \"length ss = length ts\"\n  shows \"matchers (set (zip ss ts)) = {\\<sigma>. map (\\<lambda>t. t \\<cdot> \\<sigma>) ss = ts}\"\n  using assms by (induct ss ts rule: list_induct2) auto\n\ndefinition \"matchers_map m = matchers ((\\<lambda>x. (Var x, the (m x))) ` Map.dom m)\"\n\nlemma matchers_map_empty [simp]:\n  \"matchers_map Map.empty = UNIV\"\n  by (simp add: matchers_map_def)\n\nlemma matchers_map_upd [simp]:\n  assumes \"\\<sigma> x = None \\<or> \\<sigma> x = Some t\"\n  shows \"matchers_map (\\<lambda>y. if y = x then Some t else \\<sigma> y) =\n    matchers_map \\<sigma> \\<inter> {\\<tau>. \\<tau> x = t}\" (is \"?L = ?R\")\nproof\n  show \"?L \\<supseteq> ?R\" by (auto simp: matchers_map_def matchers_def)\nnext\n  show \"?L \\<subseteq> ?R\"\n    by (rule subsetI)\n       (insert assms, auto simp: matchers_map_def matchers_def dom_def)\nqed\n\nlemma matchers_map_upd' [simp]:\n  assumes \"\\<sigma> x = None \\<or> \\<sigma> x = Some t\"\n  shows \"matchers_map (\\<sigma> (x \\<mapsto> t)) = matchers_map \\<sigma> \\<inter> {\\<tau>. \\<tau> x = t}\"\n  using matchers_map_upd [of \\<sigma> x t, OF assms]\n  by (simp add: matchers_map_def matchers_def dom_def)\n\ninductive MATCH1 where\n  Var [intro!, simp]: \"\\<sigma> x = None \\<or> \\<sigma> x = Some t \\<Longrightarrow>\n    MATCH1 (P + {#(Var x, t)#}, \\<sigma>) (P, \\<sigma> (x \\<mapsto> t))\" |\n  Fun [intro]: \"length ss = length ts \\<Longrightarrow>\n    MATCH1 (P + {#(Fun f ss, Fun f ts)#}, \\<sigma>) (P + mset (zip ss ts), \\<sigma>)\"\n  \nlemma MATCH1_matchers [simp]:\n  assumes \"MATCH1 x y\"\n  shows \"matchers_map (snd x) \\<inter> matchers (set_mset (fst x)) =\n    matchers_map (snd y) \\<inter> matchers (set_mset (fst y))\"\n  using assms by (induct) (simp_all add: ac_simps)\n\ndefinition \"matchrel = {(x, y). MATCH1 x y}\"\n\nlemma MATCH1_matchrel_conv:\n  \"MATCH1 x y \\<longleftrightarrow> (x, y) \\<in> matchrel\"\n  by (simp add: matchrel_def)\n\nlemma matchrel_rtrancl_matchers [simp]:\n  assumes \"(x, y) \\<in> matchrel\\<^sup>*\"\n  shows \"matchers_map (snd x) \\<inter> matchers (set_mset (fst x)) =\n    matchers_map (snd y) \\<inter> matchers (set_mset (fst y))\"\n  using assms by (induct) (simp_all add: matchrel_def)\n\nlemma subst_of_map_in_matchers_map [simp]:\n  \"subst_of_map d m \\<in> matchers_map m\"\n  by (auto simp: subst_of_map_def [abs_def] matchers_map_def matchers_def)\n\nlemma matchrel_sound:\n  assumes \"((P, Map.empty), ({#}, \\<sigma>)) \\<in> matchrel\\<^sup>*\"\n  shows \"subst_of_map d \\<sigma> \\<in> matchers (set_mset P)\"\n  using matchrel_rtrancl_matchers [OF assms] by simp\n\nlemma MATCH1_size_mset:\n  assumes \"MATCH1 x y\"\n  shows \"size_mset (fst x) > size_mset (fst y)\"\n  using assms by (cases) (auto simp: pair_size_def)+\n\ndefinition \"matchless = inv_image (measure size_mset) fst\"\n\nlemma wf_matchless:\n  \"wf matchless\"\n  by (auto simp: matchless_def)\n\nlemma MATCH1_matchless:\n  assumes \"MATCH1 x y\"\n  shows \"(y, x) \\<in> matchless\"\n  using MATCH1_size_mset [OF assms]\n  by (simp add: matchless_def)\n\nlemma converse_matchrel_subset_matchless:\n  \"matchrel\\<inverse> \\<subseteq> matchless\"\n  using MATCH1_matchless by (auto simp: matchrel_def)\n\nlemma wf_converse_matchrel:\n  \"wf (matchrel\\<inverse>)\"\n  by (rule wf_subset [OF wf_matchless converse_matchrel_subset_matchless])\n\nlemma MATCH1_singleton_Var [intro]:\n  \"\\<sigma> x = None \\<Longrightarrow> MATCH1 ({#(Var x, t)#}, \\<sigma>) ({#}, \\<sigma> (x \\<mapsto> t))\"\n  \"\\<sigma> x = Some t \\<Longrightarrow> MATCH1 ({#(Var x, t)#}, \\<sigma>) ({#}, \\<sigma> (x \\<mapsto> t))\"\n  using MATCH1.Var [of \\<sigma> x t \"{#}\"] by simp_all\n\nlemma MATCH1_singleton_Fun [intro]:\n  \"length ss = length ts \\<Longrightarrow> MATCH1 ({#(Fun f ss, Fun f ts)#}, \\<sigma>) (mset (zip ss ts), \\<sigma>)\"\n  using MATCH1.Fun [of ss ts \"{#}\" f \\<sigma>] by simp\n\nlemma not_MATCH1_singleton_Var [dest]:\n  \"\\<not> MATCH1 ({#(Var x, t)#}, \\<sigma>) ({#}, \\<sigma> (x \\<mapsto> t)) \\<Longrightarrow> \\<sigma> x \\<noteq> None \\<and> \\<sigma> x \\<noteq> Some t\"\n  by auto\n\nlemma not_matchrelD:\n  assumes \"\\<not> (\\<exists>y. (({#e#}, \\<sigma>), y) \\<in> matchrel)\"\n  shows \"(\\<exists>f ss x. e = (Fun f ss, Var x)) \\<or>\n    (\\<exists>x t. e = (Var x, t) \\<and> \\<sigma> x \\<noteq> None \\<and> \\<sigma> x \\<noteq> Some t) \\<or>\n    (\\<exists>f g ss ts. e = (Fun f ss, Fun g ts) \\<and> (f \\<noteq> g \\<or> length ss \\<noteq> length ts))\"\nproof (rule ccontr)\n  assume *: \"\\<not> ?thesis\"\n  show False\n  proof (cases e)\n    case (Pair s t)\n    with assms and * show ?thesis\n      by (cases s) (cases t, auto simp: matchrel_def)+\n  qed\nqed\n\nlemma ne_matchers_imp_matchrel:\n  assumes \"matchers_map \\<sigma> \\<inter> matchers {e} \\<noteq> {}\"\n  shows \"\\<exists>y. (({#e#}, \\<sigma>), y) \\<in> matchrel\"\nproof (rule ccontr)\n  assume \"\\<not> ?thesis\"\n  from not_matchrelD [OF this] and assms\n    show False by (auto simp: matchers_map_def matchers_def dom_def)\nqed\n\nlemma MATCH1_mono:\n  assumes \"MATCH1 (P, \\<sigma>) (P', \\<sigma>')\"\n  shows \"MATCH1 (P + M, \\<sigma>) (P' + M, \\<sigma>')\"\n  using assms apply (cases) apply (auto simp: ac_simps)\n  using Var apply force\n  using Var apply force\n  using Fun\n  by (metis (no_types, lifting) add.assoc add_mset_add_single)\n\nlemma matchrel_mono:\n  assumes \"(x, y) \\<in> matchrel\"\n  shows \"((fst x + M, snd x), (fst y + M, snd y)) \\<in> matchrel\"\n  using assms and MATCH1_mono [of \"fst x\"]\n  by (simp add: MATCH1_matchrel_conv)\n\nlemma matchrel_rtrancl_mono:\n  assumes \"(x, y) \\<in> matchrel\\<^sup>*\"\n  shows \"((fst x + M, snd x), (fst y + M, snd y)) \\<in> matchrel\\<^sup>*\"\n  using assms by (induct) (auto dest:  matchrel_mono [of _ _ M])\n\nlemma ne_matchers_imp_empty_or_matchrel:\n  assumes \"matchers_map \\<sigma> \\<inter> matchers (set_mset P) \\<noteq> {}\"\n  shows \"P = {#} \\<or> (\\<exists>y. ((P, \\<sigma>), y) \\<in> matchrel)\"\nproof (cases P)\n  case (add e P')\n  then have [simp]: \"P = P' + {#e#}\" by simp\n  from assms have \"matchers_map \\<sigma> \\<inter> matchers {e} \\<noteq> {}\" by auto\n  from ne_matchers_imp_matchrel [OF this]\n    obtain P'' \\<sigma>' where \"MATCH1 ({#e#}, \\<sigma>) (P'', \\<sigma>')\"\n    by (auto simp: matchrel_def)\n  from MATCH1_mono [OF this, of P'] have \"MATCH1 (P, \\<sigma>) (P' + P'', \\<sigma>')\" by (simp add: ac_simps)\n  then show ?thesis by (auto simp: matchrel_def)\nqed simp\n\nlemma matchrel_imp_converse_matchless [dest]:\n  \"(x, y) \\<in> matchrel \\<Longrightarrow> (y, x) \\<in> matchless\"\n  using MATCH1_matchless by (cases x, cases y) (auto simp: matchrel_def)\n\nlemma ne_matchers_imp_empty:\n  fixes P :: \"(('f, 'v) term \\<times> ('f, 'w) term) multiset\"\n  assumes \"matchers_map \\<sigma> \\<inter> matchers (set_mset P) \\<noteq> {}\"\n  shows \"\\<exists>\\<sigma>'. ((P, \\<sigma>), ({#}, \\<sigma>')) \\<in> matchrel\\<^sup>*\"\nusing assms\nproof (induct P arbitrary: \\<sigma> rule: wf_induct [OF wf_measure [of size_mset]])\n  fix P :: \"(('f, 'v) term \\<times> ('f, 'w) term) multiset\"\n    and \\<sigma>\n  presume IH: \"\\<And>P' \\<sigma>. \\<lbrakk>(P', P) \\<in> measure size_mset; matchers_map \\<sigma> \\<inter> matchers (set_mset P') \\<noteq> {}\\<rbrakk> \\<Longrightarrow>\n    \\<exists>\\<sigma>'. ((P', \\<sigma>), {#}, \\<sigma>') \\<in> matchrel\\<^sup>*\"\n    and *: \"matchers_map \\<sigma> \\<inter> matchers (set_mset P) \\<noteq> {}\"\n  show \"\\<exists>\\<sigma>'. ((P, \\<sigma>), {#}, \\<sigma>') \\<in> matchrel\\<^sup>*\"\n  proof (cases \"P = {#}\")\n    assume \"P \\<noteq> {#}\"\n    with ne_matchers_imp_empty_or_matchrel [OF *]\n      obtain P' \\<sigma>' where **: \"((P, \\<sigma>), (P', \\<sigma>')) \\<in> matchrel\" by (auto)\n    with * have \"(P', P) \\<in> measure size_mset\"\n      and \"matchers_map \\<sigma>' \\<inter> matchers (set_mset P') \\<noteq> {}\"\n      using MATCH1_matchers [of \"(P, \\<sigma>)\" \"(P', \\<sigma>')\"]\n      by (auto simp: matchrel_def dest: MATCH1_size_mset)\n    from IH [OF this] and **\n      show ?thesis by (auto intro: converse_rtrancl_into_rtrancl)\n  qed force\nqed simp\n\nlemma empty_not_reachable_imp_matchers_empty:\n  assumes \"\\<And>\\<sigma>'. ((P, \\<sigma>), ({#}, \\<sigma>')) \\<notin> matchrel\\<^sup>*\"\n  shows \"matchers_map \\<sigma> \\<inter> matchers (set_mset P) = {}\"\n  using ne_matchers_imp_empty [of \\<sigma> P] and assms by blast\n\nlemma irreducible_reachable_imp_matchers_empty:\n  assumes \"((P, \\<sigma>), y) \\<in> matchrel\\<^sup>!\" and \"fst y \\<noteq> {#}\"\n  shows \"matchers_map \\<sigma> \\<inter> matchers (set_mset P) = {}\"\nproof -\n  have \"((P, \\<sigma>), y) \\<in> matchrel\\<^sup>*\"\n    and \"\\<And>\\<tau>. (y, ({#}, \\<tau>)) \\<notin> matchrel\\<^sup>*\"\n    using assms by  auto (metis NF_not_suc fst_conv normalizability_E)\n  moreover with empty_not_reachable_imp_matchers_empty\n    have \"matchers_map (snd y) \\<inter> matchers (set_mset (fst y)) = {}\" by (cases y) auto\n  ultimately show ?thesis using matchrel_rtrancl_matchers [of \"(P, \\<sigma>)\"] by simp\nqed\n\nlemma matchers_map_not_empty [simp]:\n  \"matchers_map \\<sigma> \\<noteq> {}\"\n  \"{} \\<noteq> matchers_map \\<sigma>\"\n  by (auto simp: matchers_map_def matchers_def)\n\nlemma matchers_empty_imp_not_empty_NF:\n  assumes \"matchers (set_mset P) = {}\"\n  shows \"\\<exists>y. fst y \\<noteq> {#} \\<and> ((P, Map.empty), y) \\<in> matchrel\\<^sup>!\"\nproof (rule ccontr)\n  assume \"\\<not> ?thesis\"\n  then have *: \"\\<And>y. ((P, Map.empty), y) \\<in> matchrel\\<^sup>! \\<Longrightarrow> fst y = {#}\" by auto\n  have \"SN matchrel\" using wf_converse_matchrel by (auto simp: SN_iff_wf)\n  then obtain y where \"((P, Map.empty), y) \\<in> matchrel\\<^sup>!\"\n    by (metis SN_imp_WN UNIV_I WN_onE)\n  with * [OF this] obtain \\<tau> where \"((P, Map.empty), ({#}, \\<tau>)) \\<in> matchrel\\<^sup>*\" by (cases y) auto\n  from matchrel_rtrancl_matchers [OF this] and assms\n    show False by simp\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/First_Order_Terms/Abstract_Matching.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.33090176139532157}}
{"text": "(*  Title:      Containers/Map_To_Mapping.thy\n    Author:     Andreas Lochbihler, ETH Zurich *)\n\ntheory Map_To_Mapping imports\n  \"Mapping_Impl\"\nbegin\n\nsection {* Infrastructure for operation identification *}\n\ntext {*\n  To convert theorems from @{typ \"'a \\<Rightarrow> 'b option\"} to @{typ \"('a, 'b) mapping\"} using lifting / transfer,\n  we first introduce constants for the empty map and map lookup, then apply lifting / transfer,\n  and finally eliminate the non-converted constants again.\n*}\n\ntext {* Dynamic theorem list of rewrite rules that are applied before Transfer.transferred *}\nML {*\nstructure Containers_Pre = Named_Thms\n(\n  val name = @{binding containers_pre}\n  val description = \"Preprocessing rewrite rules in operation identification for Containers\"\n)\n*}\nsetup {* Containers_Pre.setup *}\n\ntext {* Dynamic theorem list of rewrite rules that are applied after Transfer.transferred *}\nML {*\nstructure Containers_Post = Named_Thms\n(\n  val name = @{binding containers_post}\n  val description = \"Postprocessing rewrite rules in operation identification for Containers\"\n)\n*}\nsetup {* Containers_Post.setup *}\n\ncontext begin interpretation lifting_syntax .\n\ndefinition map_empty :: \"'a \\<Rightarrow> 'b option\"\nwhere [code_unfold]: \"map_empty = Map.empty\"\n\ndeclare map_empty_def[containers_post, symmetric, containers_pre]\n\ndeclare Mapping.empty.transfer[transfer_rule del]\n\nlemma map_empty_transfer [transfer_rule]:\n  \"(pcr_mapping A B) map_empty Mapping.empty\"\nunfolding map_empty_def by(rule Mapping.empty.transfer)\n\n\ndefinition map_apply :: \"('a \\<Rightarrow> 'b option) \\<Rightarrow> 'a \\<Rightarrow> 'b option\"\nwhere [code_unfold]: \"map_apply = (\\<lambda>m. m)\"\n\nlemma eq_map_apply: \"m x \\<equiv> map_apply m x\"\nby(simp add: map_apply_def)\n\ndeclare eq_map_apply[symmetric, abs_def, containers_post]\n\ntext {* We cannot use @{thm [source] eq_map_apply} as a fold rule for operator identification,\n  because it would loop. We use a simproc instead. *}\nML {*\nval map_apply_simproc = \n  Simplifier.simproc_global_i @{theory} \"map_apply\" [@{term \"f x :: 'a option\"}]\n    (fn ctxt => fn redex => case redex of\n      Const (@{const_name map_apply}, _) $ _ $ _ => NONE\n    | f $ x => \n      let\n        val thy = Proof_Context.theory_of ctxt;\n        val cTr = \n          redex\n          |> fastype_of\n          |> dest_Type\n          |> snd |> hd\n          |> ctyp_of thy;\n        val cTx = ctyp_of thy (fastype_of x);\n        val cts = map (SOME o cterm_of thy) [f, x];\n      in\n        SOME (Drule.instantiate' [SOME cTr, SOME cTx] cts @{thm eq_map_apply})\n      end\n    | _ => NONE);\n*}\n\nlemma map_apply_parametric [transfer_rule]:\n  \"((A ===> B) ===> A ===> B) map_apply map_apply\"\nunfolding map_apply_def by(transfer_prover)\n\nlemma map_apply_transfer [transfer_rule]:\n  \"(pcr_mapping A B ===> A ===> rel_option B) map_apply Mapping.lookup\"\nby(auto simp add: pcr_mapping_def cr_mapping_def Mapping.lookup_def map_apply_def dest: rel_funD)\n\n\ndefinition map_update :: \"'a \\<Rightarrow> 'b option \\<Rightarrow> ('a \\<Rightarrow> 'b option) \\<Rightarrow> ('a \\<Rightarrow> 'b option)\"\nwhere \"map_update x y f = f(x := y)\"\n\nlemma map_update_parametric [transfer_rule]:\n  assumes [transfer_rule]: \"bi_unique A\"\n  shows \"(A ===> rel_option B ===> (A ===> rel_option B) ===> (A ===> rel_option B)) map_update map_update\"\nunfolding map_update_def[abs_def] by transfer_prover\n\ncontext begin\nlocal_setup {* Local_Theory.map_naming (Name_Space.mandatory_path \"Mapping\") *}\n\nlift_definition update' :: \"'a \\<Rightarrow> 'b option \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\nis map_update parametric map_update_parametric .\n\nlemma update'_code [simp, code, code_unfold]:\n  \"update' x None = Mapping.delete x\"\n  \"update' x (Some y) = Mapping.update x y\"\nby(transfer, simp add: map_update_def fun_eq_iff)+\n\nend\n\ndeclare map_update_def[abs_def, containers_post] map_update_def[symmetric, containers_pre]\n\n\ndefinition map_is_empty :: \"('a \\<Rightarrow> 'b option) \\<Rightarrow> bool\"\nwhere \"map_is_empty m \\<longleftrightarrow> m = Map.empty\"\n\nlemma map_is_empty_folds:\n  \"m = map_empty \\<longleftrightarrow> map_is_empty m\"\n  \"map_empty = m \\<longleftrightarrow> map_is_empty m\"\nby(auto simp add: map_is_empty_def map_empty_def)\n\ndeclare map_is_empty_folds[containers_pre]\n  map_is_empty_def[abs_def, containers_post]\n\nlemma map_is_empty_transfer [transfer_rule]:\n  assumes \"bi_total A\"\n  shows \"(pcr_mapping A B ===> op =) map_is_empty Mapping.is_empty\"\nunfolding map_is_empty_def[abs_def] Mapping.is_empty_def[abs_def] dom_eq_empty_conv[symmetric]\nby(rule rel_funI)+(auto simp del: dom_eq_empty_conv dest: rel_setD2 rel_setD1 Mapping.keys.transfer[THEN rel_funD, OF assms])\n\nend\n\nML {*\nsignature CONTAINERS = sig\n  val identify : Context.generic -> thm -> thm;\n  val identify_attribute : attribute;\nend\n\nstructure Containers: CONTAINERS =\nstruct\n\nfun identify ctxt thm =\n  let\n    val ctxt' = Context.proof_of ctxt\n    val ss = put_simpset HOL_basic_ss ctxt'\n    val ctxt1 = ss addsimps Containers_Pre.get ctxt' addsimprocs [map_apply_simproc]\n    val ctxt2 = ss addsimps Containers_Post.get ctxt'\n\n    (* Hack to recover Transfer.transferred function from attribute *)\n    fun transfer_transferred ctxt thm = Transfer.transferred_attribute [] (ctxt, thm) |> snd |> the\n  in\n    thm\n    |> full_simplify ctxt1\n    |> transfer_transferred ctxt\n    |> full_simplify ctxt2\n  end\n\nval identify_attribute = Thm.rule_attribute identify\n\nend\n*}\n\nattribute_setup \"containers_identify\" =\n  {* Scan.succeed Containers.identify_attribute *}\n  \"Transfer theorems for operator identification in Containers\"\n\nhide_const (open) map_apply map_empty map_is_empty map_update\nhide_fact (open) map_apply_def map_empty_def eq_map_apply\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Containers/Map_To_Mapping.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269796369904, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.3309017526840803}}
{"text": "(*  Title:      HOL/Auth/n_mutualEx_lemma_inv__4_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_inv__4_on_rules imports n_mutualEx_lemma_on_inv__4\nbegin\nsection{*All lemmas on causal relation between inv__4*}\nlemma lemma_inv__4_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0. p__Inv0\\<le>N\\<and>f=inv__4  p__Inv0)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_TryVsinv__4) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_CritVsinv__4) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_ExitVsinv__4) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_IdleVsinv__4) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualEx/n_mutualEx_lemma_inv__4_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.7057850278370112, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.3308654054631334}}
{"text": "(*  Title:      JinjaThreads/MM/HB_Completion.thy\n    Author:     Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Happens-before consistent completion of executions in the JMM} *}\n\ntheory HB_Completion imports\n  \"Non_Speculative\"\nbegin\n\ncoinductive ta_hb_consistent :: \"'m prog \\<Rightarrow> ('thread_id \\<times> ('addr, 'thread_id) obs_event action) list \\<Rightarrow> ('thread_id \\<times> ('addr, 'thread_id) obs_event action) llist \\<Rightarrow> bool\"\nfor P :: \"'m prog\"\nwhere\n  LNil: \"ta_hb_consistent P obs LNil\" \n| LCons:\n  \"\\<lbrakk> ta_hb_consistent P (obs @ [ob]) obs';\n     case ob of (t, NormalAction (ReadMem ad al v))\n        \\<Rightarrow> (\\<exists>w. w \\<in> write_actions (llist_of (obs @ [ob])) \\<and> (ad, al) \\<in> action_loc P (llist_of (obs @ [ob])) w \\<and>\n               value_written P (llist_of (obs @ [ob])) w (ad, al) = v \\<and>\n             P,llist_of (obs @ [ob]) \\<turnstile> w \\<le>hb length obs \\<and>\n             (\\<forall>w'\\<in>write_actions (llist_of (obs @ [ob])). (ad, al) \\<in> action_loc P (llist_of (obs @ [ob])) w' \\<longrightarrow> \n                (P,llist_of (obs @ [ob]) \\<turnstile> w \\<le>hb w' \\<and> P,llist_of (obs @ [ob]) \\<turnstile> w' \\<le>hb length obs \\<or> \n                   is_volatile P al \\<and> P,llist_of (obs @ [ob]) \\<turnstile> w \\<le>so w' \\<and> P,llist_of (obs @ [ob]) \\<turnstile> w' \\<le>so length obs) \\<longrightarrow> \n                w' = w))\n     | _ \\<Rightarrow> True \\<rbrakk> \n  \\<Longrightarrow> ta_hb_consistent P obs (LCons ob obs')\"\n\ninductive_simps ta_hb_consistent_LNil [simp]:\n  \"ta_hb_consistent P obs LNil\"\n\ninductive_simps ta_hb_consistent_LCons:\n  \"ta_hb_consistent P obs (LCons ob obs')\"\n\nlemma ta_hb_consistent_into_non_speculative:\n  \"ta_hb_consistent P obs0 obs\n  \\<Longrightarrow> non_speculative P (w_values P (\\<lambda>_. {}) (map snd obs0)) (lmap snd obs)\"\nproof(coinduction arbitrary: obs0 obs)\n  case (non_speculative obs0 obs)\n  let ?vs = \"w_values P (\\<lambda>_. {}) (map snd obs0)\"\n  let ?CH = \"\\<lambda>vs obs'. \\<exists>obs0 obs. vs = w_values P (\\<lambda>_. {}) (map snd obs0) \\<and> obs' = lmap snd obs \\<and> ta_hb_consistent P obs0 obs\"\n  from non_speculative show ?case\n  proof(cases)\n    case LNil hence ?LNil by simp\n    thus ?thesis ..\n  next\n    case (LCons tob obs'')\n    note obs = `obs = LCons tob obs''`\n    obtain t ob where tob: \"tob = (t, ob)\" by(cases tob)\n    from `ta_hb_consistent P (obs0 @ [tob]) obs''` tob obs\n    have \"?CH (w_value P ?vs ob) (lmap snd obs'')\" by(auto intro!: exI)\n    moreover {\n      fix ad al v\n      assume ob: \"ob = NormalAction (ReadMem ad al v)\"\n      with LCons tob obtain w where w: \"w \\<in> write_actions (llist_of (obs0 @ [tob]))\"\n        and adal: \"(ad, al) \\<in> action_loc P (llist_of (obs0 @ [tob])) w\"\n        and v: \"value_written P (llist_of (obs0 @ [tob])) w (ad, al) = v\" by auto\n      from w obtain \"is_write_action (action_obs (llist_of (obs0 @ [tob])) w)\" \n        and w_actions: \"w \\<in> actions (llist_of (obs0 @ [tob]))\" by cases\n      hence \"v \\<in> ?vs (ad, al)\"\n      proof(cases)\n        case (WriteMem ad' al' v')\n        hence \"NormalAction (WriteMem ad al v) \\<in> set (map snd obs0)\"\n          using adal ob tob v w_actions unfolding in_set_conv_nth\n          by(auto simp add: action_obs_def nth_append value_written.simps actions_def cong: conj_cong split: split_if_asm)\n        thus ?thesis by(rule w_values_WriteMemD)\n      next\n        case (NewHeapElem ad' hT)\n        hence \"NormalAction (NewHeapElem ad hT) \\<in> set (map snd obs0)\"\n          using adal ob tob v w_actions unfolding in_set_conv_nth\n          by(auto simp add: action_obs_def nth_append value_written.simps actions_def cong: conj_cong split: split_if_asm)\n        thus ?thesis using NewHeapElem adal unfolding v[symmetric]\n          by(fastforce simp add: value_written.simps intro!: w_values_new_actionD intro: rev_image_eqI)\n      qed }\n    hence \"case ob of NormalAction (ReadMem ad al v) \\<Rightarrow> v \\<in> ?vs (ad, al) | _ \\<Rightarrow> True\"\n      by(simp split: action.split obs_event.split)\n    ultimately have ?LCons using obs tob by simp\n    thus ?thesis ..\n  qed\nqed\n\nlemma ta_hb_consistent_lappendI:\n  assumes hb1: \"ta_hb_consistent P E E'\"\n  and hb2: \"ta_hb_consistent P (E @ list_of E') E''\"\n  and fin: \"lfinite E'\"\n  shows \"ta_hb_consistent P E (lappend E' E'')\"\nusing fin hb1 hb2\nproof(induction arbitrary: E)\n  case lfinite_LNil thus ?case by simp\nnext\n  case (lfinite_LConsI E' tob)\n  from `ta_hb_consistent P E (LCons tob E')`\n  have \"ta_hb_consistent P (E @ [tob]) E'\" by cases\n  moreover from `ta_hb_consistent P (E @ list_of (LCons tob E')) E''` `lfinite E'`\n  have \"ta_hb_consistent P ((E @ [tob]) @ list_of E') E''\" by simp\n  ultimately have \"ta_hb_consistent P (E @ [tob]) (lappend E' E'')\" by(rule lfinite_LConsI.IH)\n  thus ?case unfolding lappend_code apply(rule ta_hb_consistent.LCons)\n    using `ta_hb_consistent P E (LCons tob E')`\n    by cases (simp split: prod.split_asm action.split_asm obs_event.split_asm)\nqed\n\nlemma ta_hb_consistent_coinduct_append\n  [consumes 1, case_names ta_hb_consistent, case_conclusion ta_hb_consistent LNil lappend]:\n  assumes major: \"X E tobs\"\n  and step: \"\\<And>E tobs. X E tobs \n    \\<Longrightarrow> tobs = LNil \\<or>\n       (\\<exists>tobs' tobs''. tobs = lappend tobs' tobs'' \\<and> tobs' \\<noteq> LNil \\<and> ta_hb_consistent P E tobs' \\<and>\n                    (lfinite tobs' \\<longrightarrow> (X (E @ list_of tobs') tobs''\\<or> \n                                       ta_hb_consistent P (E @ list_of tobs') tobs'')))\"\n    (is \"\\<And>E tobs. _ \\<Longrightarrow> _ \\<or> ?step E tobs\")\n  shows \"ta_hb_consistent P E tobs\"\nproof -\n  from major\n  have \"\\<exists>tobs' tobs''. tobs = lappend (llist_of tobs') tobs'' \\<and> ta_hb_consistent P E (llist_of tobs') \\<and> \n                     X (E @ tobs') tobs''\"\n    by(auto intro: exI[where x=\"[]\"])\n  thus ?thesis\n  proof(coinduct)\n    case (ta_hb_consistent E tobs)\n    then obtain tobs' tobs'' \n      where tobs: \"tobs = lappend (llist_of tobs') tobs''\"\n      and hb_tobs': \"ta_hb_consistent P E (llist_of tobs')\"\n      and X: \"X (E @ tobs') tobs''\" by blast\n\n    show ?case\n    proof(cases tobs')\n      case Nil\n      with X have \"X E tobs''\" by simp\n      from step[OF this] show ?thesis\n      proof\n        assume \"tobs'' = LNil\" \n        with Nil tobs show ?thesis by simp\n      next\n        assume \"?step E tobs''\"\n        then obtain tobs''' tobs'''' \n          where tobs'': \"tobs'' = lappend tobs''' tobs''''\" and \"tobs''' \\<noteq> LNil\"\n          and sc_obs''': \"ta_hb_consistent P E tobs'''\" \n          and fin: \"lfinite tobs''' \\<Longrightarrow> X (E @ list_of tobs''') tobs'''' \\<or>\n                                      ta_hb_consistent P (E @ list_of tobs''') tobs''''\"\n          by blast\n        from `tobs''' \\<noteq> LNil` obtain t ob tobs''''' where tobs''': \"tobs''' = LCons (t, ob) tobs'''''\"\n          unfolding neq_LNil_conv by auto\n        with Nil tobs'' tobs have concl1: \"tobs = LCons (t, ob) (lappend tobs''''' tobs'''')\" by simp\n        \n        have ?LCons\n        proof(cases \"lfinite tobs'''\")\n          case False\n          hence \"lappend tobs''''' tobs'''' = tobs'''''\" using tobs''' by(simp add: lappend_inf)\n          hence \"ta_hb_consistent P (E @ [(t, ob)]) (lappend tobs''''' tobs'''')\" \n            using sc_obs''' tobs''' by(simp add: ta_hb_consistent_LCons)\n          with concl1 show ?LCons apply(simp)\n            using sc_obs'''[unfolded tobs'''] by cases simp\n        next\n          case True\n          with tobs''' obtain tobs'''''' where tobs''''': \"tobs''''' = llist_of tobs''''''\"\n            by simp(auto simp add: lfinite_eq_range_llist_of)\n          from fin[OF True] \n          have \"ta_hb_consistent P (E @ [(t, ob)]) (llist_of tobs'''''') \\<and> X (E @ (t, ob) # tobs'''''') tobs'''' \\<or> \n                ta_hb_consistent P (E @ [(t, ob)]) (lappend (llist_of tobs'''''') tobs'''')\"\n          proof\n            assume X: \"X (E @ list_of tobs''') tobs''''\"\n            hence \"X (E @ (t, ob) # tobs'''''') tobs''''\" using tobs''''' tobs''' by simp\n            moreover have \"ta_hb_consistent P (E @ [(t, ob)]) (llist_of tobs'''''')\"\n              using sc_obs''' tobs''' tobs''''' by(simp add: ta_hb_consistent_LCons)\n            ultimately show ?thesis by simp\n          next\n            assume \"ta_hb_consistent P (E @ list_of tobs''') tobs''''\"\n            with sc_obs''' tobs''''' tobs'''\n            have \"ta_hb_consistent P (E @ [(t, ob)]) (lappend (llist_of tobs'''''') tobs'''')\"\n              by(simp add: ta_hb_consistent_LCons ta_hb_consistent_lappendI)\n            thus ?thesis ..\n          qed\n          hence \"((\\<exists>tobs' tobs''. lappend (llist_of tobs'''''') tobs'''' = lappend (llist_of tobs') tobs'' \\<and>\n                                  ta_hb_consistent P (E @ [(t, ob)]) (llist_of tobs') \\<and> X (E @ (t, ob) # tobs') tobs'') \\<or>\n                 ta_hb_consistent P (E @ [(t, ob)]) (lappend (llist_of tobs'''''') tobs''''))\"\n            by auto\n          thus \"?LCons\" using concl1 tobs''''' apply(simp)\n            using sc_obs'''[unfolded tobs'''] by cases simp\n        qed\n        thus ?thesis ..\n      qed\n    next\n      case (Cons tob tobs''')\n      with X tobs hb_tobs' show ?thesis by(auto simp add: ta_hb_consistent_LCons)\n    qed\n  qed\nqed\n\nlemma ta_hb_consistent_coinduct_append_wf\n  [consumes 2, case_names ta_hb_consistent, case_conclusion ta_hb_consistent LNil lappend]:\n  assumes major: \"X E obs a\"\n  and wf: \"wf R\"\n  and step: \"\\<And>E obs a. X E obs a\n    \\<Longrightarrow> obs = LNil \\<or>\n       (\\<exists>obs' obs'' a'. obs = lappend obs' obs'' \\<and> ta_hb_consistent P E obs' \\<and> (obs' = LNil \\<longrightarrow> (a', a) \\<in> R) \\<and>\n                        (lfinite obs' \\<longrightarrow> X (E @ list_of obs') obs'' a' \\<or>\n                                          ta_hb_consistent P (E @ list_of obs') obs''))\"\n    (is \"\\<And>E obs a. _ \\<Longrightarrow> _ \\<or> ?step E obs a\")\n  shows \"ta_hb_consistent P E obs\"\nproof -\n  { fix E obs a\n    assume \"X E obs a\"\n    with wf\n    have \"obs = LNil \\<or> (\\<exists>obs' obs''. obs = lappend obs' obs'' \\<and> obs' \\<noteq> LNil \\<and> ta_hb_consistent P E obs' \\<and>\n          (lfinite obs' \\<longrightarrow> (\\<exists>a. X (E @ list_of obs') obs'' a) \\<or> \n                            ta_hb_consistent P (E @ list_of obs') obs''))\"\n      (is \"_ \\<or> ?step_concl E obs\")\n    proof(induction a arbitrary: E obs rule: wf_induct[consumes 1, case_names wf])\n      case (wf a)\n      note IH = wf.IH[rule_format]\n      from step[OF `X E obs a`]\n      show ?case\n      proof\n        assume \"obs = LNil\" thus ?thesis ..\n      next\n        assume \"?step E obs a\"\n        then obtain obs' obs'' a'\n          where obs: \"obs = lappend obs' obs''\"\n          and sc_obs': \"ta_hb_consistent P E obs'\"\n          and decr: \"obs' = LNil \\<Longrightarrow> (a', a) \\<in> R\"\n          and fin: \"lfinite obs' \\<Longrightarrow> \n                    X (E @ list_of obs') obs'' a' \\<or>\n                    ta_hb_consistent P (E @ list_of obs') obs''\"\n          by blast\n        show ?case\n        proof(cases \"obs' = LNil\")\n          case True\n          hence \"lfinite obs'\" by simp\n          from fin[OF this] show ?thesis\n          proof\n            assume X: \"X (E @ list_of obs') obs'' a'\"\n            from True have \"(a', a) \\<in> R\" by(rule decr)\n            from IH[OF this X] show ?thesis\n            proof\n              assume \"obs'' = LNil\"\n              with True obs have \"obs = LNil\" by simp\n              thus ?thesis ..\n            next\n              assume \"?step_concl (E @ list_of obs') obs''\"\n              hence \"?step_concl E obs\" using True obs by simp\n              thus ?thesis ..\n            qed\n          next\n            assume \"ta_hb_consistent P (E @ list_of obs') obs''\"\n            thus ?thesis using obs True\n              by cases (auto 4 3 cong: action.case_cong obs_event.case_cong intro: exI[where x=\"LCons x LNil\" for x] simp add: ta_hb_consistent_LCons)\n          qed\n        next\n          case False\n          with obs sc_obs' fin show ?thesis by auto\n        qed\n      qed\n    qed }\n  note step' = this\n\n  from major show ?thesis\n  proof(coinduction arbitrary: E obs a rule: ta_hb_consistent_coinduct_append)\n    case (ta_hb_consistent E obs)\n    thus ?case by simp(rule step')\n  qed\nqed\n\nlemma ta_hb_consistent_lappendD2:\n  assumes hb: \"ta_hb_consistent P E (lappend E' E'')\"\n  and fin: \"lfinite E'\"\n  shows \"ta_hb_consistent P (E @ list_of E') E''\"\nusing fin hb\nby(induct arbitrary: E)(fastforce simp add: ta_hb_consistent_LCons)+\n\nlemma ta_hb_consistent_Read_hb:\n  fixes E E' defines \"E'' \\<equiv> lappend (llist_of E') E\"\n  assumes hb: \"ta_hb_consistent P E' E\"\n  and tsa: \"thread_start_actions_ok E''\"\n  and E'': \"is_write_seen P (llist_of E') ws'\"\n  and new_actions_for_fun: \n  \"\\<And>w w' adal. \\<lbrakk> w \\<in> new_actions_for P E'' adal; \n                 w' \\<in> new_actions_for P E'' adal \\<rbrakk> \\<Longrightarrow> w = w'\"\n  shows \"\\<exists>ws. P \\<turnstile> (E'', ws) \\<surd> \\<and> (\\<forall>n. n \\<in> read_actions E'' \\<longrightarrow> length E' \\<le> n \\<longrightarrow> P,E'' \\<turnstile> ws n \\<le>hb n) \\<and> \n              (\\<forall>n. n < length E' \\<longrightarrow> ws n = ws' n)\"\nproof(intro exI conjI strip)\n  let ?P = \n    \"\\<lambda>n w. case lnth E'' n of\n        (t, NormalAction (ReadMem ad al v)) \\<Rightarrow> \n          (w \\<in> write_actions E'' \\<and> (ad, al) \\<in> action_loc P E'' w \\<and> value_written P E'' w (ad, al) = v \\<and>\n          P,E'' \\<turnstile> w \\<le>hb n \\<and> \n          (\\<forall>w'\\<in>write_actions E''. (ad, al) \\<in> action_loc P E'' w' \\<longrightarrow> \n              (P,E'' \\<turnstile> w \\<le>hb w' \\<and> P,E'' \\<turnstile> w' \\<le>hb n \\<or> \n               is_volatile P al \\<and> P,E'' \\<turnstile> w \\<le>so w' \\<and> P,E'' \\<turnstile> w' \\<le>so n) \\<longrightarrow> \n              w' = w))\"\n  let ?ws = \"\\<lambda>n. if n < length E' then ws' n else Eps (?P n)\"\n  \n  have \"\\<And>n. n < length E' \\<Longrightarrow> ?ws n = ws' n\" by simp\n  moreover\n  have \"P \\<turnstile> (E'', ?ws) \\<surd> \\<and> \n        (\\<forall>n ad al v. n \\<in> read_actions E'' \\<longrightarrow> length E' \\<le> n \\<longrightarrow> action_obs E'' n = NormalAction (ReadMem ad al v) \\<longrightarrow> P,E'' \\<turnstile> ?ws n \\<le>hb n)\"\n  proof(intro conjI wf_execI strip is_write_seenI)\n    fix a' ad al v\n    assume read: \"a' \\<in> read_actions E''\" \n      and aobs: \"action_obs E'' a' = NormalAction (ReadMem ad al v)\"\n    then obtain t where a': \"enat a' < llength E''\"\n      and lnth'': \"lnth E'' a' = (t, NormalAction (ReadMem ad al v))\"\n      by(cases)(cases \"lnth E'' a'\", clarsimp simp add: actions_def action_obs_def)\n\n    have \"?ws a' \\<in> write_actions E'' \\<and> \n      (ad, al) \\<in> action_loc P E'' (?ws a') \\<and> \n      value_written P E'' (?ws a') (ad, al) = v \\<and>\n      (length E' \\<le> a' \\<longrightarrow> P,E'' \\<turnstile> ?ws a' \\<le>hb a') \\<and>\n      \\<not> P,E'' \\<turnstile> a' \\<le>hb ?ws a' \\<and>\n      (is_volatile P al \\<longrightarrow> \\<not> P,E'' \\<turnstile> a' \\<le>so ?ws a') \\<and>\n      (\\<forall>a''. a'' \\<in> write_actions E'' \\<longrightarrow> (ad, al) \\<in> action_loc P E'' a'' \\<longrightarrow>\n             (P,E'' \\<turnstile> ?ws a' \\<le>hb a'' \\<and> P,E'' \\<turnstile> a'' \\<le>hb a' \\<or> is_volatile P al \\<and> P,E'' \\<turnstile> ?ws a' \\<le>so a'' \\<and> P,E'' \\<turnstile> a'' \\<le>so a')\n             \\<longrightarrow> a'' = ?ws a')\"\n    proof(cases \"a' < length E'\", safe del: notI disjE conjE)\n      assume a'_E': \"a' < length E'\"\n      with read aobs have a': \"a' \\<in> read_actions (llist_of E')\" \n        and aobs': \"action_obs (llist_of E') a' = NormalAction (ReadMem ad al v)\"\n        by(auto simp add: E''_def action_obs_def lnth_lappend1 actions_def elim: read_actions.cases intro: read_actions.intros)\n      have sim: \"ltake (enat (length E')) (llist_of E') [\\<approx>] ltake (enat (length E')) (lappend (llist_of E') E)\"\n        by(rule eq_into_sim_actions)(simp add: ltake_all ltake_lappend1)\n      from tsa have tsa': \"thread_start_actions_ok (llist_of E')\"\n        by(rule thread_start_actions_ok_prefix)(simp add: E''_def lprefix_lappend)\n\n      from is_write_seenD[OF E'' a' aobs'] a'_E'\n      show \"?ws a' \\<in> write_actions E''\"\n        and \"(ad, al) \\<in> action_loc P E'' (?ws a')\"\n        and \"value_written P E'' (?ws a') (ad, al) = v\"\n        and \"\\<not> P,E'' \\<turnstile> a' \\<le>hb ?ws a'\"\n        and \"is_volatile P al \\<Longrightarrow> \\<not> P,E'' \\<turnstile> a' \\<le>so ?ws a'\"\n        by(auto elim!: write_actions.cases intro!: write_actions.intros simp add: E''_def lnth_lappend1 actions_def action_obs_def value_written_def enat_less_enat_plusI dest: happens_before_change_prefix[OF _ tsa' sim[symmetric]] sync_order_change_prefix[OF _ sim[symmetric]])\n\n      { assume \"length E' \\<le> a'\"\n        thus \"P,E'' \\<turnstile> ?ws a' \\<le>hb a'\" using a'_E' by simp }\n\n      { fix w\n        assume w: \"w \\<in> write_actions E''\" \"(ad, al) \\<in> action_loc P E'' w\" \n          and hbso: \"P,E'' \\<turnstile> ?ws a' \\<le>hb w \\<and> P,E'' \\<turnstile> w \\<le>hb a' \\<or> is_volatile P al \\<and> P,E'' \\<turnstile> ?ws a' \\<le>so w \\<and> P,E'' \\<turnstile> w \\<le>so a'\"\n        show \"w = ?ws a'\"\n        proof(cases \"w < length E'\")\n          case True\n          with is_write_seenD[OF E'' a' aobs'] a'_E' w hbso show ?thesis\n            by(auto 4 3 elim!: write_actions.cases intro!: write_actions.intros simp add: E''_def lnth_lappend1 actions_def action_obs_def value_written_def enat_less_enat_plusI dest: happens_before_change_prefix[OF _ tsa[unfolded E''_def] sim] happens_before_change_prefix[OF _ tsa' sim[symmetric]] sync_order_change_prefix[OF _ sim, simplified] sync_order_change_prefix[OF _ sim[symmetric], simplified] bspec[where x=w])\n        next\n          case False\n          from hbso have \"E'' \\<turnstile> w \\<le>a a'\" by(auto intro: happens_before_into_action_order elim: sync_orderE)\n          moreover from w(1) read have \"w \\<noteq> a'\" by(auto dest: read_actions_not_write_actions)\n          ultimately have new_w: \"is_new_action (action_obs E'' w)\" using False aobs a'_E'\n            by(cases rule: action_orderE) auto\n          moreover from hbso a'_E' have \"E'' \\<turnstile> ws' a' \\<le>a w\"\n            by(auto intro: happens_before_into_action_order elim: sync_orderE)\n          hence new_a': \"is_new_action (action_obs E'' (?ws a'))\" using new_w a'_E'\n            by(cases rule: action_orderE) auto\n          ultimately have \"w \\<in> new_actions_for P E'' (ad, al)\" \"?ws a' \\<in> new_actions_for P E'' (ad, al)\"\n            using w is_write_seenD[OF E'' a' aobs'] a'_E'\n            by(auto simp add: new_actions_for_def actions_def action_obs_def lnth_lappend1 E''_def enat_less_enat_plusI elim!: write_actions.cases)\n          thus ?thesis by(rule new_actions_for_fun)\n        qed }\n    next\n      assume \"\\<not> a' < length E'\"\n      hence a'_E': \"length E' \\<le> a'\" by simp\n      def a \\<equiv> \"a' - length E'\"\n      with a' a'_E' have a: \"enat a < llength E\"\n        by(simp add: E''_def) (metis enat_add_mono le_add_diff_inverse plus_enat_simps(1))\n      \n      from a_def aobs lnth'' a'_E'\n      have aobs: \"action_obs E a = NormalAction (ReadMem ad al v)\"\n        and lnth: \"lnth E a = (t, NormalAction (ReadMem ad al v))\"\n        by(simp_all add: E''_def lnth_lappend2 action_obs_def)\n      \n      def E''' \\<equiv> \"lappend (llist_of E') (ltake (enat a) E)\"\n      let ?E'' = \"lappend E''' (LCons (t, NormalAction (ReadMem ad al v)) LNil)\"\n    \n      note hb also\n      have E_unfold1: \"E = lappend (ltake (enat a) E) (ldropn a E)\" by simp\n      also have E_unfold2: \"ldropn a E = LCons (t, NormalAction (ReadMem ad al v)) (ldropn (Suc a) E)\"\n        using a lnth by (metis ldropn_Suc_conv_ldropn)\n      finally\n      have \"ta_hb_consistent P (E' @ list_of (ltake (enat a) E))\n              (LCons (t, NormalAction (ReadMem ad al v)) (ldropn (Suc a) E))\"\n        by(rule ta_hb_consistent_lappendD2) simp\n      with a a'_E' a_def obtain w where w: \"w \\<in> write_actions ?E''\"\n        and adal_w: \"(ad, al) \\<in> action_loc P ?E'' w\"\n        and written: \"value_written P ?E'' w (ad, al) = v\"\n        and hb: \"P,?E'' \\<turnstile> w \\<le>hb a'\"\n        and in_between_so:\n        \"\\<And>w'. \\<lbrakk> w' \\<in> write_actions ?E''; (ad, al) \\<in> action_loc P ?E'' w'; \n                is_volatile P al; P,?E'' \\<turnstile> w \\<le>so w'; P,?E'' \\<turnstile> w' \\<le>so a' \\<rbrakk>\n        \\<Longrightarrow> w' = w\"        \n        and in_between_hb: \n        \"\\<And>w'. \\<lbrakk> w' \\<in> write_actions ?E''; (ad, al) \\<in> action_loc P ?E'' w'; \n                P,?E'' \\<turnstile> w \\<le>hb w'; P,?E'' \\<turnstile> w' \\<le>hb a' \\<rbrakk>\n        \\<Longrightarrow> w' = w\"\n        by(auto simp add: ta_hb_consistent_LCons length_list_of_conv_the_enat min_def lnth_ltake lappend_llist_of_llist_of[symmetric] E'''_def lappend_assoc simp del: lappend_llist_of_llist_of nth_list_of split: if_splits)\n\n      from a' a'_E' a\n      have eq: \"ltake (enat (Suc a')) ?E'' = ltake (enat (Suc a')) E''\" (is \"?lhs = ?rhs\")\n        unfolding E''_def E'''_def lappend_assoc\n        apply(subst (2) E_unfold1)\n        apply(subst E_unfold2)\n        apply(subst (1 2) ltake_lappend2)\n         apply(simp)\n        apply(rule arg_cong) back\n        apply(subst (1 2) ltake_lappend2)\n         apply(simp add: min_def)\n         apply (metis Suc_diff_le a_def le_Suc_eq order_le_less)\n        apply(rule arg_cong) back\n        apply(auto simp add: min_def a_def)\n        apply(auto simp add: eSuc_enat[symmetric] zero_enat_def[symmetric])\n        done\n      hence sim: \"?lhs [\\<approx>] ?rhs\" by(rule eq_into_sim_actions)\n      from tsa have tsa': \"thread_start_actions_ok ?E''\" unfolding E''_def E'''_def lappend_assoc\n        by(rule thread_start_actions_ok_prefix)(subst (2) E_unfold1, simp add: E_unfold2)\n\n      from w a a' a_def a'_E' have w_a': \"w < Suc a'\"\n        by cases(simp add: actions_def E'''_def min_def zero_enat_def eSuc_enat split: split_if_asm)\n\n      from w sim have \"w \\<in> write_actions E''\" by(rule write_actions_change_prefix)(simp add: w_a')\n      moreover\n      from adal_w action_loc_change_prefix[OF sim, of w P] w_a'\n      have \"(ad, al) \\<in> action_loc P E'' w\" by simp\n      moreover\n      from written value_written_change_prefix[OF eq, of w P] w_a'\n      have \"value_written P E'' w (ad, al) = v\" by simp\n      moreover\n      from hb tsa sim have \"P,E'' \\<turnstile> w \\<le>hb a'\" by(rule happens_before_change_prefix)(simp_all add: w_a')\n      moreover {\n        fix w'\n        assume w': \"w' \\<in> write_actions E''\"\n          and adal: \"(ad, al) \\<in> action_loc P E'' w'\"\n          and hbso: \"P,E'' \\<turnstile> w \\<le>hb w' \\<and> P,E'' \\<turnstile> w' \\<le>hb a' \\<or> is_volatile P al \\<and> P,E'' \\<turnstile> w \\<le>so w' \\<and> P,E'' \\<turnstile> w' \\<le>so a'\"\n          (is \"?hbso E''\")\n        from hbso have ao: \"E'' \\<turnstile> w \\<le>a w'\" \"E'' \\<turnstile> w' \\<le>a a'\"\n          by(auto dest: happens_before_into_action_order elim: sync_orderE)\n        have \"w' = w\"\n        proof(cases \"is_new_action (action_obs E'' w')\")\n          case True\n          hence \"w' \\<in> new_actions_for P E'' (ad, al)\" using w' adal by(simp add: new_actions_for_def)\n          moreover from ao True have \"is_new_action (action_obs E'' w)\" by(cases rule: action_orderE) simp_all\n          with `w \\<in> write_actions E''` `(ad, al) \\<in> action_loc P E'' w`\n          have \"w \\<in> new_actions_for P E'' (ad, al)\" by(simp add: new_actions_for_def)\n          ultimately show \"w' = w\" by(rule new_actions_for_fun)\n        next\n          case False\n          with ao have \"w' \\<le> a'\" by(auto elim: action_orderE)\n          hence w'_a: \"enat w' < enat (Suc a')\" by simp\n          with hbso w_a' have \"?hbso ?E''\"\n            by(auto 4 3 elim: happens_before_change_prefix[OF _ tsa' sim[symmetric]] sync_order_change_prefix[OF _ sim[symmetric]] del: disjCI intro: disjI1 disjI2)\n          moreover from w' `w' \\<le> a'` a' a lnth a'_E' have \"w' \\<in> write_actions ?E''\"\n            by(cases)(cases \"w' < a'\", auto intro!: write_actions.intros simp add: E'''_def actions_def action_obs_def lnth_lappend min_def zero_enat_def eSuc_enat lnth_ltake a_def E''_def not_le not_less)\n          moreover from adal `w' \\<le> a'` a a' lnth w' a'_E' have \"(ad, al) \\<in> action_loc P ?E'' w'\"\n            by(cases \"w' < a'\")(cases \"w' < length E'\", auto simp add: E'''_def action_obs_def lnth_lappend lappend_assoc[symmetric] min_def lnth_ltake less_trans[where y=\"enat a\"] a_def E''_def lnth_ltake elim: write_actions.cases)\n          ultimately show \"w' = w\" by(blast dest: in_between_so in_between_hb)\n        qed }\n      ultimately have \"?P a' w\" using a'_E' lnth unfolding E''_def a_def by(simp add: lnth_lappend)\n      hence P: \"?P a' (Eps (?P a'))\" by(rule someI[where P=\"?P a'\"])\n      \n      from P lnth'' a'_E'\n      show \"?ws a' \\<in> write_actions E''\" \n        and \"(ad, al) \\<in> action_loc P E'' (?ws a')\" \n        and \"value_written P E'' (?ws a') (ad, al) = v\" \n        and \"P,E'' \\<turnstile> ?ws a' \\<le>hb a'\" by simp_all\n\n      show \"\\<not> P,E'' \\<turnstile> a' \\<le>hb ?ws a'\"\n      proof\n        assume \"P,E'' \\<turnstile> a' \\<le>hb ?ws a'\"\n        with `P,E'' \\<turnstile> ?ws a' \\<le>hb a'` have \"a' = ?ws a'\"\n          by(blast dest: antisymPD[OF antisym_action_order] happens_before_into_action_order)\n        with read `?ws a' \\<in> write_actions E''` show False\n          by(auto dest: read_actions_not_write_actions)\n      qed\n\n      show \"\\<not> P,E'' \\<turnstile> a' \\<le>so ?ws a'\"\n      proof\n        assume \"P,E'' \\<turnstile> a' \\<le>so ?ws a'\"\n        hence \"E'' \\<turnstile> a' \\<le>a ?ws a'\" by(blast elim: sync_orderE)\n        with `P,E'' \\<turnstile> ?ws a' \\<le>hb a'` have \"a' = ?ws a'\"\n          by(blast dest: antisymPD[OF antisym_action_order] happens_before_into_action_order)\n        with read `?ws a' \\<in> write_actions E''` show False\n          by(auto dest: read_actions_not_write_actions)\n      qed\n      \n      fix a''\n      assume \"a'' \\<in> write_actions E''\" \"(ad, al) \\<in> action_loc P E'' a''\"\n        and \"P,E'' \\<turnstile> ?ws a' \\<le>hb a'' \\<and> P,E'' \\<turnstile> a'' \\<le>hb a' \\<or>\n             is_volatile P al \\<and> P,E'' \\<turnstile> ?ws a' \\<le>so a'' \\<and> P,E'' \\<turnstile> a'' \\<le>so a'\"\n      thus \"a'' = ?ws a'\" using lnth'' P a'_E' by -(erule disjE, clarsimp+)\n    qed\n    thus \"?ws a' \\<in> write_actions E''\"\n      and \"(ad, al) \\<in> action_loc P E'' (?ws a')\"\n      and \"value_written P E'' (?ws a') (ad, al) = v\"\n      and \"length E' \\<le> a' \\<Longrightarrow> P,E'' \\<turnstile> ?ws a' \\<le>hb a'\"\n      and \"\\<not> P,E'' \\<turnstile> a' \\<le>hb ?ws a'\"\n      and \"is_volatile P al \\<Longrightarrow> \\<not> P,E'' \\<turnstile> a' \\<le>so ?ws a'\"\n      and \"\\<And>a''. \\<lbrakk> a'' \\<in> write_actions E''; (ad, al) \\<in> action_loc P E'' a''; P,E'' \\<turnstile> ?ws a' \\<le>hb a''; P,E'' \\<turnstile> a'' \\<le>hb a' \\<rbrakk> \\<Longrightarrow> a'' = ?ws a'\"\n      and \"\\<And>a''. \\<lbrakk> a'' \\<in> write_actions E''; (ad, al) \\<in> action_loc P E'' a''; is_volatile P al; P,E'' \\<turnstile> ?ws a' \\<le>so a''; P,E'' \\<turnstile> a'' \\<le>so a' \\<rbrakk> \\<Longrightarrow> a'' = ?ws a'\"\n      by blast+\n  qed(assumption|rule tsa)+\n  thus \"P \\<turnstile> (E'', ?ws) \\<surd>\"\n    and \"\\<And>n. \\<lbrakk> n \\<in> read_actions E''; length E' \\<le> n \\<rbrakk> \\<Longrightarrow> P,E'' \\<turnstile> ?ws n \\<le>hb n\"\n    by(blast elim: read_actions.cases intro: read_actions.intros)+\n  \n  fix n\n  assume \"n < length E'\"\n  thus \"?ws n = ws' n\" by simp\nqed\n\nlemma ta_hb_consistent_not_ReadI:\n  \"(\\<And>t ad al v. (t, NormalAction (ReadMem ad al v)) \\<notin> lset E) \\<Longrightarrow> ta_hb_consistent P E' E\"\nproof(coinduction arbitrary: E' E)\n  case (ta_hb_consistent E' E)\n  thus ?case by(cases E)(auto split: action.split obs_event.split, blast)\nqed\n\ncontext jmm_multithreaded begin\n\ndefinition complete_hb :: \"('l,'thread_id,'x,'m,'w) state \\<Rightarrow> ('thread_id \\<times> ('addr, 'thread_id) obs_event action) list\n  \\<Rightarrow> ('thread_id \\<times> ('l, 'thread_id, 'x, 'm, 'w, ('addr, 'thread_id) obs_event action) thread_action) llist\"\nwhere\n  \"complete_hb s E = unfold_llist\n     (\\<lambda>(s, E). \\<forall>t ta s'. \\<not> s -t\\<triangleright>ta\\<rightarrow> s')\n     (\\<lambda>(s, E). fst (SOME ((t, ta), s'). s -t\\<triangleright>ta\\<rightarrow> s' \\<and> ta_hb_consistent P E (llist_of (map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>))))\n     (\\<lambda>(s, E). let ((t, ta), s') = SOME ((t, ta), s'). s -t\\<triangleright>ta\\<rightarrow> s' \\<and> ta_hb_consistent P E (llist_of (map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>))\n         in (s', E @ map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>))\n     (s, E)\"\n\ndefinition hb_completion ::\n  \"('l, 'thread_id, 'x, 'm, 'w) state \\<Rightarrow> ('thread_id \\<times> ('addr, 'thread_id) obs_event action) list \\<Rightarrow> bool\"\nwhere\n  \"hb_completion s E \\<longleftrightarrow>\n   (\\<forall>ttas s' t x ta x' m' i.\n       s -\\<triangleright>ttas\\<rightarrow>* s' \\<longrightarrow> \n       non_speculative P (w_values P (\\<lambda>_. {}) (map snd E)) (llist_of (concat (map (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas))) \\<longrightarrow>\n       thr s' t = \\<lfloor>(x, no_wait_locks)\\<rfloor> \\<longrightarrow> t \\<turnstile> (x, shr s') -ta\\<rightarrow> (x', m') \\<longrightarrow> actions_ok s' t ta \\<longrightarrow>\n       non_speculative P (w_values P (w_values P (\\<lambda>_. {}) (map snd E)) (concat (map (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas))) (llist_of (take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>)) \\<longrightarrow>\n       (\\<exists>ta' x'' m''. t \\<turnstile> (x, shr s') -ta'\\<rightarrow> (x'', m'') \\<and> actions_ok s' t ta' \\<and> \n                      take i \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub> = take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> \\<and>\n                      ta_hb_consistent P\n                        (E @ concat (map (\\<lambda>(t, ta). map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas) @ map (Pair t) (take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>))\n                        (llist_of (map (Pair t) (drop i \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub>))) \\<and>\n                      (i < length \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> \\<longrightarrow> i < length \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub>) \\<and>\n                      (if \\<exists>ad al v. \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v) then sim_action else op =) (\\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> ! i) (\\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub> ! i)))\"\n\nlemma hb_completionD:\n  \"\\<lbrakk> hb_completion s E; s -\\<triangleright>ttas\\<rightarrow>* s';\n     non_speculative P (w_values P (\\<lambda>_. {}) (map snd E)) (llist_of (concat (map (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas))); \n     thr s' t = \\<lfloor>(x, no_wait_locks)\\<rfloor>; t \\<turnstile> (x, shr s') -ta\\<rightarrow> (x', m'); actions_ok s' t ta;\n     non_speculative P (w_values P (w_values P (\\<lambda>_. {}) (map snd E)) (concat (map (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas))) (llist_of (take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>)) \\<rbrakk>\n  \\<Longrightarrow> \\<exists>ta' x'' m''. t \\<turnstile> (x, shr s') -ta'\\<rightarrow> (x'', m'') \\<and> actions_ok s' t ta' \\<and>\n                   take i \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub> = take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> \\<and>\n                   ta_hb_consistent P (E @ concat (map (\\<lambda>(t, ta). map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas) @ map (Pair t) (take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>))\n                                      (llist_of (map (Pair t) (drop i \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub>))) \\<and>\n                   (i < length \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> \\<longrightarrow> i < length \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub>) \\<and>\n                   (if \\<exists>ad al v. \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v) then sim_action else op =) (\\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> ! i) (\\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub> ! i)\"\nunfolding hb_completion_def by blast\n\nlemma hb_completionI [intro?]:\n  \"(\\<And>ttas s' t x ta x' m' i. \n     \\<lbrakk> s -\\<triangleright>ttas\\<rightarrow>* s'; non_speculative P (w_values P (\\<lambda>_. {}) (map snd E)) (llist_of (concat (map (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas)));\n       thr s' t = \\<lfloor>(x, no_wait_locks)\\<rfloor>; t \\<turnstile> (x, shr s') -ta\\<rightarrow> (x', m'); actions_ok s' t ta;\n       non_speculative P (w_values P (w_values P (\\<lambda>_. {}) (map snd E)) (concat (map (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas))) (llist_of (take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>)) \\<rbrakk>\n     \\<Longrightarrow> \\<exists>ta' x'' m''. t \\<turnstile> (x, shr s') -ta'\\<rightarrow> (x'', m'') \\<and> actions_ok s' t ta' \\<and> take i \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub> = take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> \\<and>\n                   ta_hb_consistent P (E @ concat (map (\\<lambda>(t, ta). map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas) @ map (Pair t) (take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>)) (llist_of (map (Pair t) (drop i \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub>))) \\<and>\n                   (i < length \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> \\<longrightarrow> i < length \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub>) \\<and>\n                   (if \\<exists>ad al v. \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v) then sim_action else op =) (\\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> ! i) (\\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub> ! i))\n  \\<Longrightarrow> hb_completion s E\"\nunfolding hb_completion_def by blast\n\nlemma hb_completion_shift:\n  assumes hb_c: \"hb_completion s E\"\n  and \\<tau>Red: \"s -\\<triangleright>ttas\\<rightarrow>* s'\"\n  and sc: \"non_speculative P (w_values P (\\<lambda>_. {}) (map snd E)) (llist_of (concat (map (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas)))\"\n      (is \"non_speculative _ ?vs _\")\n  shows \"hb_completion s' (E @ (concat (map (\\<lambda>(t, ta). map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas)))\"\n  (is \"hb_completion _ ?E\")\nproof(rule hb_completionI)\n  fix ttas' s'' t x ta x' m' i\n  assume \\<tau>Red': \"s' -\\<triangleright>ttas'\\<rightarrow>* s''\"\n    and sc': \"non_speculative P (w_values P (\\<lambda>_. {}) (map snd ?E)) (llist_of (concat (map (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas')))\"\n    and red: \"thr s'' t = \\<lfloor>(x, no_wait_locks)\\<rfloor>\" \"t \\<turnstile> \\<langle>x, shr s''\\<rangle> -ta\\<rightarrow> \\<langle>x', m'\\<rangle>\" \"actions_ok s'' t ta\" \n    and ns: \"non_speculative P (w_values P (w_values P (\\<lambda>_. {}) (map snd ?E)) (concat (map (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas'))) (llist_of (take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>))\"\n  from \\<tau>Red \\<tau>Red' have \"s -\\<triangleright>ttas @ ttas'\\<rightarrow>* s''\" unfolding RedT_def by(rule rtrancl3p_trans)\n  moreover from sc sc' have \"non_speculative P ?vs (llist_of (concat (map (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) (ttas @ ttas'))))\"\n    unfolding map_append concat_append lappend_llist_of_llist_of[symmetric] map_concat\n    by(simp add: non_speculative_lappend o_def split_def del: lappend_llist_of_llist_of)\n  ultimately\n  show \"\\<exists>ta' x'' m''. t \\<turnstile> \\<langle>x, shr s''\\<rangle> -ta'\\<rightarrow> \\<langle>x'', m''\\<rangle> \\<and> actions_ok s'' t ta' \\<and> take i \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub> = take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> \\<and>\n         ta_hb_consistent P (?E @ concat (map (\\<lambda>(t, ta). map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>) ttas') @ map (Pair t) (take i \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>))\n                            (llist_of (map (Pair t) (drop i \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub>))) \\<and>\n         (i < length \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> \\<longrightarrow> i < length \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub>) \\<and>\n         (if \\<exists>ad al v. \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> ! i = NormalAction (ReadMem ad al v) then sim_action else op =) (\\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> ! i) (\\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub> ! i)\"\n    using red ns unfolding append_assoc\n    apply(subst (2) append_assoc[symmetric])\n    unfolding concat_append[symmetric] map_append[symmetric] foldr_append[symmetric]\n    by(rule hb_completionD[OF hb_c])(simp_all add: map_concat o_def split_def)\nqed\n\nlemma hb_completion_shift1:\n  assumes hb_c: \"hb_completion s E\"\n  and Red: \"s -t\\<triangleright>ta\\<rightarrow> s'\"\n  and sc: \"non_speculative P (w_values P (\\<lambda>_. {}) (map snd E)) (llist_of \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>)\"\n  shows \"hb_completion s' (E @ map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>)\"\nusing hb_completion_shift[OF hb_c, of \"[(t, ta)]\" s'] Red sc\nby(simp add: RedT_def rtrancl3p_Cons rtrancl3p_Nil del: split_paired_Ex)\n\nlemma complete_hb_in_Runs:\n  assumes hb_c: \"hb_completion s E\"\n  and ta_hb_consistent_convert_RA: \"\\<And>t E ln. ta_hb_consistent P E (llist_of (map (Pair t) (convert_RA ln)))\"\n  shows \"mthr.Runs s (complete_hb s E)\"\nusing hb_c\nproof(coinduction arbitrary: s E)\n  case (Runs s E)\n  let ?P = \"\\<lambda>((t, ta), s'). s -t\\<triangleright>ta\\<rightarrow> s' \\<and> ta_hb_consistent P E (llist_of (map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>))\"\n  show ?case\n  proof(cases \"\\<exists>t ta s'. s -t\\<triangleright>ta\\<rightarrow> s'\")\n    case False\n    then have ?Stuck by(simp add: complete_hb_def)\n    thus ?thesis ..\n  next\n    case True\n    let ?t = \"fst (fst (Eps ?P))\" and ?ta = \"snd (fst (Eps ?P))\" and ?s' = \"snd (Eps ?P)\"\n    from True obtain t ta s' where red: \"s -t\\<triangleright>ta\\<rightarrow> s'\" by blast\n    hence \"\\<exists>x. ?P x\"\n    proof(cases)\n      case (redT_normal x x' m')\n      from hb_completionD[OF Runs _ _ `thr s t = \\<lfloor>(x, no_wait_locks)\\<rfloor>` `t \\<turnstile> \\<langle>x, shr s\\<rangle> -ta\\<rightarrow> \\<langle>x', m'\\<rangle>` `actions_ok s t ta`, of \"[]\" 0]\n      obtain ta' x'' m'' where \"t \\<turnstile> \\<langle>x, shr s\\<rangle> -ta'\\<rightarrow> \\<langle>x'', m''\\<rangle>\"\n        and \"actions_ok s t ta'\" \"ta_hb_consistent P E (llist_of (map (Pair t) \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub>))\" \n        by fastforce\n      moreover obtain ws' where \"redT_updWs t (wset s) \\<lbrace>ta'\\<rbrace>\\<^bsub>w\\<^esub> ws'\" by (metis redT_updWs_total)\n      ultimately show ?thesis using `thr s t = \\<lfloor>(x, no_wait_locks)\\<rfloor>`\n        by(cases ta')(auto intro!: exI redT.redT_normal)\n    next\n      case (redT_acquire x ln n)\n      thus ?thesis using ta_hb_consistent_convert_RA[of E t ln] \n        by(auto intro!: exI redT.redT_acquire)\n    qed\n    hence \"?P (Eps ?P)\" by(rule someI_ex)\n    hence red: \"s -?t\\<triangleright>?ta\\<rightarrow> ?s'\"\n      and hb: \"ta_hb_consistent P E (llist_of (map (Pair ?t) \\<lbrace>?ta\\<rbrace>\\<^bsub>o\\<^esub>))\"\n      by(simp_all add: split_beta)\n    moreover\n    from ta_hb_consistent_into_non_speculative[OF hb]\n    have \"non_speculative P (w_values P (\\<lambda>_. {}) (map snd E)) (llist_of \\<lbrace>?ta\\<rbrace>\\<^bsub>o\\<^esub>)\" by(simp add: o_def)\n    with Runs red have \"hb_completion ?s' (E @ map (Pair ?t) \\<lbrace>?ta\\<rbrace>\\<^bsub>o\\<^esub>)\" by(rule hb_completion_shift1)\n    ultimately have ?Step using True\n      unfolding complete_hb_def by(fastforce simp del: split_paired_Ex simp add: split_def)\n    thus ?thesis ..\n  qed\nqed\n\nlemma complete_hb_ta_hb_consistent:\n  assumes \"hb_completion s E\"\n  and ta_hb_consistent_convert_RA: \"\\<And>E t ln. ta_hb_consistent P E (llist_of (map (Pair t) (convert_RA ln)))\"\n  shows \"ta_hb_consistent P E (lconcat (lmap (\\<lambda>(t, ta). llist_of (map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>)) (complete_hb s E)))\"\n  (is \"ta_hb_consistent _ _ (?obs (complete_hb s E))\")\nproof -\n  def obs \\<equiv> \"?obs (complete_hb s E)\" and a \\<equiv> \"complete_hb s E\"\n  with `hb_completion s E` have \"\\<exists>s. hb_completion s E \\<and> obs = ?obs (complete_hb s E) \\<and> a = complete_hb s E\" by blast\n  moreover have \"wf (inv_image {(m, n). m < n} (llength \\<circ> ltakeWhile (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> = [])))\"\n    (is \"wf ?R\") by(rule wf_inv_image)(rule wellorder_class.wf)\n  ultimately show \"ta_hb_consistent P E obs\"\n  proof(coinduct E obs a rule: ta_hb_consistent_coinduct_append_wf)\n    case (ta_hb_consistent E obs a)\n    then obtain s where hb_c: \"hb_completion s E\"\n      and obs: \"obs = lconcat (lmap (\\<lambda>(t, ta). llist_of (map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>)) (complete_hb s E))\"\n      and a: \"a = complete_hb s E\"\n      by blast\n    let ?P = \"\\<lambda>((t, ta), s'). s -t\\<triangleright>ta\\<rightarrow> s' \\<and> ta_hb_consistent P E (llist_of (map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>))\"\n    show ?case\n    proof(cases \"\\<exists>t ta s'. s -t\\<triangleright>ta\\<rightarrow> s'\")\n      case False\n      with obs have ?LNil by(simp add: complete_hb_def)\n      thus ?thesis ..\n    next\n      case True\n      let ?t = \"fst (fst (Eps ?P))\" and ?ta = \"snd (fst (Eps ?P))\" and ?s' = \"snd (Eps ?P)\"\n      from True obtain t ta s' where red: \"s -t\\<triangleright>ta\\<rightarrow> s'\" by blast\n      hence \"\\<exists>x. ?P x\"\n      proof(cases)\n        case (redT_normal x x' m')\n        from hb_completionD[OF hb_c _ _ `thr s t = \\<lfloor>(x, no_wait_locks)\\<rfloor>` `t \\<turnstile> \\<langle>x, shr s\\<rangle> -ta\\<rightarrow> \\<langle>x', m'\\<rangle>` `actions_ok s t ta`, of \"[]\" 0]\n        obtain ta' x'' m'' where \"t \\<turnstile> \\<langle>x, shr s\\<rangle> -ta'\\<rightarrow> \\<langle>x'', m''\\<rangle>\"\n          and \"actions_ok s t ta'\" \"ta_hb_consistent P E (llist_of (map (Pair t) \\<lbrace>ta'\\<rbrace>\\<^bsub>o\\<^esub>))\"\n          by fastforce\n        moreover obtain ws' where \"redT_updWs t (wset s) \\<lbrace>ta'\\<rbrace>\\<^bsub>w\\<^esub> ws'\" by (metis redT_updWs_total)\n        ultimately show ?thesis using `thr s t = \\<lfloor>(x, no_wait_locks)\\<rfloor>`\n          by(cases ta')(auto intro!: exI redT.redT_normal)\n      next\n        case (redT_acquire x ln n)\n        thus ?thesis using ta_hb_consistent_convert_RA[of E t ln]\n          by(auto intro!: exI redT.redT_acquire)\n      qed\n      hence \"?P (Eps ?P)\" by(rule someI_ex)\n      hence red': \"s -?t\\<triangleright>?ta\\<rightarrow> ?s'\" \n        and hb: \"ta_hb_consistent P E (llist_of (map (Pair ?t) \\<lbrace>?ta\\<rbrace>\\<^bsub>o\\<^esub>))\"\n        by(simp_all add: split_beta)\n      moreover\n      from ta_hb_consistent_into_non_speculative[OF hb]\n      have \"non_speculative P (w_values P (\\<lambda>_. {}) (map snd E)) (llist_of \\<lbrace>?ta\\<rbrace>\\<^bsub>o\\<^esub>)\" by(simp add: o_def)\n      with hb_c red' have hb_c': \"hb_completion ?s' (E @ map (Pair ?t) \\<lbrace>?ta\\<rbrace>\\<^bsub>o\\<^esub>)\"\n        by(rule hb_completion_shift1)\n      show ?thesis\n      proof(cases \"lnull obs\")\n        case True thus ?thesis unfolding lnull_def by simp\n      next\n        case False\n        have eq: \"(\\<forall>t ta s'. \\<not> s -t\\<triangleright>ta\\<rightarrow> s') = False\" using True by auto\n        { assume \"\\<lbrace>?ta\\<rbrace>\\<^bsub>o\\<^esub> = []\"\n          moreover from obs False\n          have \"lfinite (ltakeWhile (\\<lambda>(t, ta). \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub> = []) (complete_hb s E))\"\n            unfolding lfinite_ltakeWhile by(fastforce simp add: split_def lconcat_eq_LNil)\n          ultimately have \"(complete_hb ?s' (E @ map (Pair ?t) \\<lbrace>?ta\\<rbrace>\\<^bsub>o\\<^esub>), a) \\<in> ?R\"\n            using red unfolding a complete_hb_def\n            apply(subst (2) unfold_llist.code)\n            apply(subst (asm) unfold_llist.code)\n            apply(auto simp add: split_beta simp del: split_paired_Ex split_paired_All split: split_if_asm)\n            apply(auto simp add: lfinite_eq_range_llist_of)\n            done }\n        hence ?lappend using red hb hb_c' unfolding obs complete_hb_def\n          apply(subst unfold_llist.code)\n          apply(simp add: split_beta eq del: split_paired_Ex split_paired_All split del: split_if)\n          apply(intro exI conjI impI refl disjI1|rule refl|assumption|simp_all add: llist_of_eq_LNil_conv)+\n          done\n        thus ?thesis ..\n      qed\n    qed\n  qed\nqed\n\nlemma hb_completion_Runs:\n  assumes \"hb_completion s E\"\n  and \"\\<And>E t ln. ta_hb_consistent P E (llist_of (map (Pair t) (convert_RA ln)))\"\n  shows \"\\<exists>ttas. mthr.Runs s ttas \\<and> ta_hb_consistent P E (lconcat (lmap (\\<lambda>(t, ta). llist_of (map (Pair t) \\<lbrace>ta\\<rbrace>\\<^bsub>o\\<^esub>)) ttas))\"\nusing complete_hb_in_Runs[OF assms] complete_hb_ta_hb_consistent[OF assms]\nby blast\n\nend\n\nend\n\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/MM/HB_Completion.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850278370111, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.3308654054631333}}
{"text": "theory flash94Bra  imports flash94Rev\n \n  begin\nlemma onInv94:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv94 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv94 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv94 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash94Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7490872131147275, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.3308516009213196}}
{"text": "theory TopoS_Composition_Theory_impl\nimports TopoS_Interface_impl TopoS_Composition_Theory\nbegin\n\nsection\\<open>Composition Theory -- List Implementation\\<close>\n\ntext\\<open>Several invariants may apply to one policy.\\<close>\n\n\n(*the packed network model record from the list implementation*)\nterm \"X::('v::vertex, 'a) TopoS_packed\"\n\n\nsubsection\\<open>Generating instantiated (configured) network security invariants\\<close>\n\n  \\<comment> \\<open>a configured network security invariant in list implementaion\\<close>\n  (*very minimal version, no eval, ...*)\n  record ('v) SecurityInvariant =\n    implc_type :: string\n    implc_description :: string\n    implc_sinvar ::\"('v) list_graph \\<Rightarrow> bool\"\n    implc_offending_flows ::\"('v) list_graph \\<Rightarrow> ('v \\<times> 'v) list list\"\n    implc_isIFS :: \"bool\"\n\n  text\\<open>Test if this definition is compliant with the formal definition on sets.\\<close>\n  definition SecurityInvariant_complies_formal_def :: \n    \"('v) SecurityInvariant \\<Rightarrow> 'v TopoS_Composition_Theory.SecurityInvariant_configured \\<Rightarrow> bool\" where\n    \"SecurityInvariant_complies_formal_def impl spec \\<equiv> \n      (\\<forall> G. wf_list_graph G \\<longrightarrow> implc_sinvar impl G = c_sinvar spec (list_graph_to_graph G)) \\<and>\n      (\\<forall> G. wf_list_graph G \\<longrightarrow> set`set (implc_offending_flows impl G) = c_offending_flows spec (list_graph_to_graph G)) \\<and>\n      (implc_isIFS impl = c_isIFS spec)\"\n    \n\n  fun new_configured_list_SecurityInvariant :: \n    \"('v::vertex, 'a) TopoS_packed \\<Rightarrow> ('v::vertex, 'a) TopoS_Params \\<Rightarrow> string \\<Rightarrow>\n        ('v SecurityInvariant)\" where \n      \"new_configured_list_SecurityInvariant m C description = \n        (let nP = nm_node_props m C in\n         \\<lparr> \n            implc_type = nm_name m,\n            implc_description = description,\n            implc_sinvar = (\\<lambda>G. (nm_sinvar m) G nP),\n            implc_offending_flows = (\\<lambda>G. (nm_offending_flows m) G nP),\n            implc_isIFS = nm_receiver_violation m\n          \\<rparr>)\"\n\n  text\\<open>the @{term TopoS_Composition_Theory.new_configured_SecurityInvariant} must give a\n         result if we have the SecurityInvariant modelLibrary\\<close>\n  lemma TopoS_modelLibrary_yields_new_configured_SecurityInvariant:\n    assumes NetModelLib: \"TopoS_modelLibrary m sinvar_spec\"\n    and     nPdef:       \"nP = nm_node_props m C\"\n    and formalSpec:      \"Spec = \\<lparr> \n                              c_sinvar = (\\<lambda>G. sinvar_spec G nP),\n                              c_offending_flows = (\\<lambda>G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec G nP),\n                              c_isIFS = nm_receiver_violation m\n                            \\<rparr>\"\n    shows \"new_configured_SecurityInvariant (sinvar_spec, nm_default m, nm_receiver_violation m, nP) = Some Spec\"\n    proof -\n      from NetModelLib have NetModel: \"SecurityInvariant sinvar_spec (nm_default m) (nm_receiver_violation m)\"\n        by(simp add: TopoS_modelLibrary_def TopoS_List_Impl_def)\n\n      have Spec: \"\\<lparr>c_sinvar = \\<lambda>G. sinvar_spec G nP,\n             c_offending_flows = \\<lambda>G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec G nP,\n             c_isIFS = nm_receiver_violation m\\<rparr> = Spec\"\n      by(simp add: formalSpec)\n      show ?thesis\n        unfolding new_configured_SecurityInvariant.simps\n        by(simp add: NetModel Spec)\n    qed\n    thm TopoS_modelLibrary_yields_new_configured_SecurityInvariant[simplified] (*todo fold in Spec*)\n\n\n  (* The new_* functions comply, i.e. we can instance network security models that are executable. *)\n  lemma new_configured_list_SecurityInvariant_complies:\n    assumes NetModelLib: \"TopoS_modelLibrary m sinvar_spec\"\n    and     nPdef:       \"nP = nm_node_props m C\"\n    and formalSpec:      \"Spec = new_configured_SecurityInvariant (sinvar_spec, nm_default m, nm_receiver_violation m, nP)\"\n    and implSpec:        \"Impl = new_configured_list_SecurityInvariant m C description\"\n    shows \"SecurityInvariant_complies_formal_def Impl (the Spec)\"\n    proof -\n      from TopoS_modelLibrary_yields_new_configured_SecurityInvariant[OF NetModelLib nPdef]\n      have SpecUnfolded: \"new_configured_SecurityInvariant (sinvar_spec, nm_default m, nm_receiver_violation m, nP) =\n        Some \\<lparr>c_sinvar = \\<lambda>G. sinvar_spec G nP,\n             c_offending_flows = \\<lambda>G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec G nP,\n             c_isIFS = nm_receiver_violation m\\<rparr>\" by simp\n      \n      from NetModelLib show ?thesis\n        apply(simp add: SpecUnfolded formalSpec implSpec Let_def)\n        apply(simp add: SecurityInvariant_complies_formal_def_def)\n        apply(simp add: TopoS_modelLibrary_def TopoS_List_Impl_def)\n        apply(simp add: nPdef)\n        done\n    qed\n\n\n  corollary new_configured_list_SecurityInvariant_complies':\n    \"\\<lbrakk> TopoS_modelLibrary m sinvar_spec \\<rbrakk> \\<Longrightarrow> \n    SecurityInvariant_complies_formal_def (new_configured_list_SecurityInvariant m C description)\n      (the (new_configured_SecurityInvariant (sinvar_spec, nm_default m, nm_receiver_violation m, nm_node_props m C)))\"\n    by(blast dest: new_configured_list_SecurityInvariant_complies)\n\n  \\<comment> \\<open>From\\<close>\n  thm new_configured_SecurityInvariant_sound\n  \\<comment> \\<open>we get that @{const new_configured_list_SecurityInvariant} has all the necessary properties (modulo @{const SecurityInvariant_complies_formal_def})\\<close>\n\nsubsection\\<open>About security invariants\\<close>\n\n   text\\<open>specification and implementation comply.\\<close>\n   type_synonym 'v security_models_spec_impl=\"('v SecurityInvariant \\<times> 'v TopoS_Composition_Theory.SecurityInvariant_configured) list\"\n   \n   definition get_spec :: \"'v security_models_spec_impl \\<Rightarrow> ('v TopoS_Composition_Theory.SecurityInvariant_configured) list\" where\n    \"get_spec M \\<equiv> [snd m. m \\<leftarrow> M]\"\n   definition get_impl :: \"'v security_models_spec_impl \\<Rightarrow> ('v SecurityInvariant) list\" where\n    \"get_impl M \\<equiv> [fst m. m \\<leftarrow> M]\"\n\nsubsection\\<open>Calculating offending flows\\<close>\n  fun implc_get_offending_flows :: \"('v) SecurityInvariant list \\<Rightarrow> 'v list_graph \\<Rightarrow> (('v \\<times> 'v) list list)\" where\n    \"implc_get_offending_flows [] G = []\"  |\n    \"implc_get_offending_flows (m#Ms) G = (implc_offending_flows m G)@(implc_get_offending_flows Ms G)\"  \n  \n\n  lemma implc_get_offending_flows_fold: \n    \"implc_get_offending_flows M G = fold (\\<lambda>m accu. accu@(implc_offending_flows m G)) M []\"\n    proof- \n    { fix accu\n      have \"accu@(implc_get_offending_flows M G) = fold (\\<lambda>m accu. accu@(implc_offending_flows m G)) M accu\"\n      apply(induction M arbitrary: accu)\n       apply(simp_all)\n      by(metis append_eq_appendI) }\n    from this[where accu2=\"[]\"] show ?thesis by simp\n  qed\n\n  lemma implc_get_offending_flows_Un: \"set`set (implc_get_offending_flows M G) = (\\<Union>m\\<in>set M. set`set (implc_offending_flows m G))\"\n    apply(induction M)\n     apply(simp_all)\n    by (metis image_Un)\n\n\n  lemma implc_get_offending_flows_map_concat: \"(implc_get_offending_flows M G) = concat [implc_offending_flows m G. m \\<leftarrow> M]\"\n    apply(induction M)\n     by(simp_all)\n\n  \n  theorem implc_get_offending_flows_complies:\n    assumes a1: \"\\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec\"\n    and     a2: \"wf_list_graph G\"\n    shows   \"set`set (implc_get_offending_flows (get_impl M) G) = (get_offending_flows (get_spec M) (list_graph_to_graph G))\"\n    proof -\n      from a1 have \"\\<forall> (m_impl, m_spec) \\<in> set M. set ` set (implc_offending_flows m_impl G) = c_offending_flows m_spec (list_graph_to_graph G)\"\n        apply(simp add: SecurityInvariant_complies_formal_def_def)\n        using a2 by blast\n      hence \"\\<forall> m \\<in> set M. set ` set (implc_offending_flows (fst m) G) = c_offending_flows (snd m) (list_graph_to_graph G)\" by fastforce\n      thus ?thesis\n        by(simp add: get_impl_def get_spec_def implc_get_offending_flows_Un get_offending_flows_def)\n   qed\n\n\n\nsubsection\\<open>Accessors\\<close>\n  definition get_IFS :: \"'v SecurityInvariant list \\<Rightarrow> 'v SecurityInvariant list\" where\n    \"get_IFS M \\<equiv> [m \\<leftarrow> M. implc_isIFS m]\"\n  definition get_ACS :: \"'v SecurityInvariant list \\<Rightarrow> 'v SecurityInvariant list\" where\n    \"get_ACS M \\<equiv> [m \\<leftarrow> M. \\<not> implc_isIFS m]\"\n\n  lemma get_IFS_get_ACS_complies:\n  assumes a: \"\\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec\"\n    shows \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M))).\n      SecurityInvariant_complies_formal_def m_impl m_spec\"\n    and \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_ACS (get_impl M)) (TopoS_Composition_Theory.get_ACS (get_spec M))).\n      SecurityInvariant_complies_formal_def m_impl m_spec\"\n    proof -\n      from a have \"\\<forall> (m_impl, m_spec) \\<in> set M. implc_isIFS m_impl = c_isIFS m_spec\"\n        apply(simp add: SecurityInvariant_complies_formal_def_def) by fastforce\n      hence set_zip_IFS: \"set (zip (filter implc_isIFS (get_impl M)) (filter c_isIFS (get_spec M))) \\<subseteq> set M\"\n        apply(simp add: get_impl_def get_spec_def)\n        apply(induction M)\n         apply(simp_all)\n        by force\n      from set_zip_IFS a show \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M))).\n          SecurityInvariant_complies_formal_def m_impl m_spec\"\n        apply(simp add: get_IFS_def get_ACS_def\n          TopoS_Composition_Theory.get_IFS_def TopoS_Composition_Theory.get_ACS_def) by blast\n      next\n      from a have \"\\<forall> (m_impl, m_spec) \\<in> set M. implc_isIFS m_impl = c_isIFS m_spec\"\n        apply(simp add: SecurityInvariant_complies_formal_def_def) by fastforce\n      hence set_zip_ACS: \"set (zip [m\\<leftarrow>get_impl M . \\<not> implc_isIFS m] [m\\<leftarrow>get_spec M . \\<not> c_isIFS m]) \\<subseteq> set M\"\n        apply(simp add: get_impl_def get_spec_def)\n        apply(induction M)\n         apply(simp_all)\n        by force\n      from this a show \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_ACS (get_impl M)) (TopoS_Composition_Theory.get_ACS (get_spec M))).\n        SecurityInvariant_complies_formal_def m_impl m_spec\"\n        apply(simp add: get_IFS_def get_ACS_def\n          TopoS_Composition_Theory.get_IFS_def TopoS_Composition_Theory.get_ACS_def) by fast\n     qed\n\n\n\n   lemma get_IFS_get_ACS_select_simps:\n    assumes a1: \"\\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec\"\n    shows \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M))). SecurityInvariant_complies_formal_def m_impl m_spec\" (is \"\\<forall> (m_impl, m_spec) \\<in> set ?zippedIFS. SecurityInvariant_complies_formal_def m_impl m_spec\")\n    and   \"(get_impl (zip (TopoS_Composition_Theory_impl.get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M)))) = TopoS_Composition_Theory_impl.get_IFS (get_impl M)\"\n    and   \"(get_spec (zip (TopoS_Composition_Theory_impl.get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M)))) = TopoS_Composition_Theory.get_IFS (get_spec M)\"\n    and   \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_ACS (get_impl M)) (TopoS_Composition_Theory.get_ACS (get_spec M))). SecurityInvariant_complies_formal_def m_impl m_spec\" (is \"\\<forall> (m_impl, m_spec) \\<in> set ?zippedACS. SecurityInvariant_complies_formal_def m_impl m_spec\")\n    and   \"(get_impl (zip (TopoS_Composition_Theory_impl.get_ACS (get_impl M)) (TopoS_Composition_Theory.get_ACS (get_spec M)))) = TopoS_Composition_Theory_impl.get_ACS (get_impl M)\"\n    and   \"(get_spec (zip (TopoS_Composition_Theory_impl.get_ACS (get_impl M)) (TopoS_Composition_Theory.get_ACS (get_spec M)))) = TopoS_Composition_Theory.get_ACS (get_spec M)\"\n    proof -\n        from get_IFS_get_ACS_complies(1)[OF a1]\n        show \"\\<forall> (m_impl, m_spec) \\<in> set (?zippedIFS). SecurityInvariant_complies_formal_def m_impl m_spec\" by simp\n      next\n        from a1 show \"(get_impl ?zippedIFS) = TopoS_Composition_Theory_impl.get_IFS (get_impl M)\"\n          apply(simp add: TopoS_Composition_Theory_impl.get_IFS_def get_spec_def get_impl_def TopoS_Composition_Theory.get_IFS_def)\n          apply(induction M)\n           apply(simp)\n          apply(simp)\n          apply(rule conjI)\n           apply(clarify)\n           using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          apply(clarify)\n          using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          done\n      next\n        from a1 show \"(get_spec ?zippedIFS) = TopoS_Composition_Theory.get_IFS (get_spec M)\"\n          apply(simp add: TopoS_Composition_Theory_impl.get_IFS_def get_spec_def get_impl_def TopoS_Composition_Theory.get_IFS_def)\n          apply(induction M)\n           apply(simp)\n          apply(simp)\n          apply(rule conjI)\n           apply(clarify)\n           using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          apply(clarify)\n          using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          done\n      next\n        from get_IFS_get_ACS_complies(2)[OF a1]\n        show \"\\<forall> (m_impl, m_spec) \\<in> set (?zippedACS). SecurityInvariant_complies_formal_def m_impl m_spec\" by simp\n      next\n        from a1 show \"(get_impl ?zippedACS) = TopoS_Composition_Theory_impl.get_ACS (get_impl M)\"\n          apply(simp add: TopoS_Composition_Theory_impl.get_ACS_def get_spec_def get_impl_def TopoS_Composition_Theory.get_ACS_def)\n          apply(induction M)\n           apply(simp)\n          apply(simp)\n          apply(rule conjI)\n           apply(clarify)\n           using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          apply(clarify)\n          using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          done\n      next\n        from a1 show \"(get_spec ?zippedACS) = TopoS_Composition_Theory.get_ACS (get_spec M)\"\n          apply(simp add: TopoS_Composition_Theory_impl.get_ACS_def get_spec_def get_impl_def TopoS_Composition_Theory.get_ACS_def)\n          apply(induction M)\n           apply(simp)\n          apply(simp)\n          apply(rule conjI)\n           apply(clarify)\n           using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          apply(clarify)\n          using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          done\n      qed \n \n   thm get_IFS_get_ACS_select_simps\n\nsubsection\\<open>All security requirements fulfilled\\<close>\n   definition all_security_requirements_fulfilled :: \"'v SecurityInvariant list \\<Rightarrow> 'v list_graph \\<Rightarrow> bool\" where\n      \"all_security_requirements_fulfilled M G \\<equiv> \\<forall>m \\<in> set M. (implc_sinvar m) G\"\n\n  lemma all_security_requirements_fulfilled_complies:\n    \"\\<lbrakk> \\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec; \n       wf_list_graph (G::('v::vertex) list_graph) \\<rbrakk> \\<Longrightarrow>\n    all_security_requirements_fulfilled (get_impl M) G \\<longleftrightarrow> TopoS_Composition_Theory.all_security_requirements_fulfilled (get_spec M) (list_graph_to_graph G)\"\n    apply(simp add: all_security_requirements_fulfilled_def TopoS_Composition_Theory.all_security_requirements_fulfilled_def)\n    apply(simp add: get_impl_def get_spec_def)\n    using SecurityInvariant_complies_formal_def_def by fastforce\n\nsubsection\\<open>generate valid topology\\<close>\n  value \"concat [[1::int,2,3], [4,6,5]]\"\n\n  fun generate_valid_topology :: \"'v SecurityInvariant list \\<Rightarrow> 'v list_graph \\<Rightarrow> ('v list_graph)\" where\n    \"generate_valid_topology M G = delete_edges G (concat (implc_get_offending_flows M G))\"\n\n\n  lemma generate_valid_topology_complies:\n    \"\\<lbrakk> \\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec;\n       wf_list_graph (G::('v list_graph)) \\<rbrakk> \\<Longrightarrow> \n       list_graph_to_graph (generate_valid_topology (get_impl M) G) = \n       TopoS_Composition_Theory.generate_valid_topology (get_spec M) (list_graph_to_graph G)\"\n    apply (subst generate_valid_topology_def_alt)\n    apply (drule(1) implc_get_offending_flows_complies)\n    apply (simp add: delete_edges_correct [symmetric])\n    done\n\n\n\nsubsection\\<open>generate valid topology\\<close>\n  text\\<open>tuned for invariants where we don't want to calculate all offending flows\\<close>\n\n  text\\<open>Theoretic foundations: The algorithm @{const generate_valid_topology_SOME} picks\n        ONE offending flow non-deterministically.\n        This is sound: @{thm generate_valid_topology_SOME_sound}.\n        However, this non-deterministic choice is hard to implement. \n        To pick one offending flow deterministically, we have implemented @{const minimalize_offending_overapprox}.\n        It gives back one offending flow:\n          @{thm SecurityInvariant_preliminaries.minimalize_offending_overapprox_gives_back_an_offending_flow}\n        The good thing about this function is, that it does not need to construct the complete\n        @{const SecurityInvariant_withOffendingFlows.set_offending_flows}. Therefore, \n        it can be used for security invariants which may have an exponential number of offending flows. \n        The corresponding algorithm that uses this function is @{const TopoS_Composition_Theory.generate_valid_topology_some}.\n        It is also sound: @{thm generate_valid_topology_some_sound}.\\<close>\n\n  fun generate_valid_topology_some :: \"'v SecurityInvariant list \\<Rightarrow> 'v list_graph \\<Rightarrow> ('v list_graph)\" where\n    \"generate_valid_topology_some [] G = G\" |\n    \"generate_valid_topology_some (m#Ms) G = (if implc_sinvar m G\n      then generate_valid_topology_some Ms G\n      else delete_edges (generate_valid_topology_some Ms G) (minimalize_offending_overapprox (implc_sinvar m) (edgesL G) [] G)\n      )\"\n\n  thm TopoS_Composition_Theory.generate_valid_topology_some_sound\n\n  lemma generate_valid_topology_some_complies:\n    \"\\<lbrakk> \\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec;\n       wf_list_graph (G::('v::vertex list_graph)) \\<rbrakk> \\<Longrightarrow> \n       list_graph_to_graph (generate_valid_topology_some (get_impl M) G) = \n       TopoS_Composition_Theory.generate_valid_topology_some (get_spec M) (edgesL G) (list_graph_to_graph G)\"\n    proof(induction M)\n    case Nil thus ?case by(simp add: get_spec_def get_impl_def)\n    next\n    case (Cons m M)\n      obtain m_impl m_spec where m: \"m = (m_impl, m_spec)\" by(cases m) blast\n      from m have m_impl: \"get_impl ((m_impl, m_spec) # M) = m_impl # (get_impl M)\" by (simp add: get_impl_def) \n      from m have m_spec: \"get_spec ((m_impl, m_spec) # M) = m_spec # (get_spec M)\" by (simp add: get_spec_def) \n      \n      from Cons.prems(1) m have complies_formal_def: \"SecurityInvariant_complies_formal_def m_impl m_spec\" by simp\n      with Cons.prems(2) have impl_spec: \"implc_sinvar m_impl G \\<longleftrightarrow> c_sinvar m_spec (list_graph_to_graph G)\"\n        by (simp add: SecurityInvariant_complies_formal_def_def)\n\n      from complies_formal_def\n      have \"\\<And>G nP. wf_list_graph G \\<Longrightarrow>\n        (\\<lambda>G nP. (c_sinvar m_spec) G) (list_graph_to_graph G) nP = (\\<lambda>G nP. (implc_sinvar m_impl) G) G nP\"\n        by (simp add: SecurityInvariant_complies_formal_def_def)\n\n      from minimalize_offending_overapprox_spec_impl[OF Cons.prems(2),\n          of \"(\\<lambda>G nP. (c_sinvar m_spec) G)\" \"(\\<lambda>G nP. (implc_sinvar m_impl) G)\", OF this]\n        (*TODO: because of funny type, horribly complex instantiation*)\n      have \"TopoS_Interface_impl.minimalize_offending_overapprox (implc_sinvar m_impl) fs keeps G =\n            TopoS_withOffendingFlows.minimalize_offending_overapprox (c_sinvar m_spec) fs keeps (list_graph_to_graph G)\"\n        for fs keeps by simp\n      from this[of \"(edgesL G)\"  \"[]\"] have minimalize_offending_overapprox_spec:\n         \"TopoS_Interface_impl.minimalize_offending_overapprox (implc_sinvar m_impl) (edgesL G) [] G =\n          TopoS_withOffendingFlows.minimalize_offending_overapprox (c_sinvar m_spec) (edgesL G) [] (list_graph_to_graph G)\" .\n      \n      from Cons show ?case\n        apply(simp)\n        apply(simp add: m m_impl m_spec)\n        apply(intro conjI impI)\n          apply (simp add: impl_spec; fail)\n         apply (simp add: impl_spec; fail)\n        apply(simp add: delete_edges_correct[symmetric])\n        apply(simp add: list_graph_to_graph_def FiniteGraph.delete_edges_simp2)\n        apply(simp add: minimalize_offending_overapprox_spec)\n        by (simp add: list_graph_to_graph_def)\n    qed\n\n(*\nsubsection{*generate valid topology*}\n  text{*tuned for invariants where we don't want to calculate all offending flows*}\n\n  fun generate_valid_topology_SOME :: \"'v SecurityInvariant list \\<Rightarrow> 'v list_graph \\<Rightarrow> ('v list_graph)\" where\n    \"generate_valid_topology_SOME [] G = G\" |\n    \"generate_valid_topology_SOME (m#Ms) G = (if implc_sinvar m G\n      then generate_valid_topology_SOME Ms G\n      else delete_edges (generate_valid_topology_SOME Ms G) (minimalize_offending_overapprox (implc_sinvar m) (edgesL G) [] G)\n      )\"\n\n  thm TopoS_Composition_Theory.generate_valid_topology_SOME_sound\n\n  (*TODO: show conformance to generate_valid_topology_some_sound*)\n  (*TODO: won't work because of the SOME!\n    I will probably have to show something like\n       all_security_requirements_fulfilled (get_impl M) (generate_valid_topology_SOME (get_impl M) G)\n    How can I do this without copy&pasting the proof of the spec?*)\n  lemma generate_valid_topology_SOME_complies:\n    \"\\<lbrakk> \\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec;\n       wf_list_graph (G::('v list_graph)) \\<rbrakk> \\<Longrightarrow> \n       list_graph_to_graph (generate_valid_topology_SOME (get_impl M) G) = \n       TopoS_Composition_Theory.generate_valid_topology_SOME (get_spec M) (list_graph_to_graph G)\"\n    proof(induction M)\n    case Nil thus ?case by(simp add: get_spec_def get_impl_def)\n    next\n    case (Cons m M)\n      obtain m_impl m_spec where m: \"m = (m_impl, m_spec)\" by(cases m) blast\n      from m have m_impl: \"get_impl ((m_impl, m_spec) # M) = m_impl # (get_impl M)\" by (simp add: get_impl_def) \n      from m have m_spec: \"get_spec ((m_impl, m_spec) # M) = m_spec # (get_spec M)\" by (simp add: get_spec_def) \n      \n      from Cons.prems(1) m have complies_formal_def:  \"SecurityInvariant_complies_formal_def m_impl m_spec\" by simp\n      with Cons.prems(2) have impl_spec: \"implc_sinvar m_impl G \\<longleftrightarrow>  c_sinvar m_spec (list_graph_to_graph G)\"\n        by (simp add: SecurityInvariant_complies_formal_def_def)\n      \n      (*from minimalize_offending_overapprox_gives_some_offending_flow\n      have \"set (minimalize_offending_overapprox (implc_sinvar m_impl) (edgesL G) [] G)\n        \\<in> SecurityInvariant_withOffendingFlows.set_offending_flows (c_sinvar_m_spec_bound_to_nP) (list_graph_to_graph G) nP\" sorry\n      *)\n\n      have my_todo: \"set (minimalize_offending_overapprox (implc_sinvar m_impl) (edgesL G) [] G)\n        \\<in> c_offending_flows m_spec (list_graph_to_graph G)\" sorry\n      \n      from my_todo[simplified list_graph_to_graph_def] have how_do_i_solve_this:\n      \"set (minimalize_offending_overapprox (implc_sinvar m_impl) (edgesL G) [] G) =\n       (SOME F. F \\<in> c_offending_flows m_spec \\<lparr>nodes = set (nodesL G), edges = set (edgesL G)\\<rparr>)\" sorry\n      \n      from Cons show ?case\n        apply(simp)\n        apply(simp add: m m_impl m_spec)\n        apply(intro conjI impI)\n          apply (simp add: impl_spec; fail)\n         apply (simp add: impl_spec; fail)\n        apply(simp add: delete_edges_correct[symmetric])\n        apply(simp add: list_graph_to_graph_def FiniteGraph.delete_edges_simp2)\n        using how_do_i_solve_this by simp\n    qed\n*)\n\n    \nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/TopoS_Composition_Theory_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3307657281333979}}
{"text": "theory Proof_4_500\n  imports Proofs4\nbegin\n\nabbreviation s where \" s s0 PdOut'value paid'value opened'value \\<equiv>\n(toEnv\n   (setPstate\n     (setVarBool (setVarBool (setVarBool s0 PdOut' PdOut'value) paid' paid'value) opened' opened'value)\n     Init'init' Controller'isOpened'))\"\n\ntheorem proof_4_500: \"VC500 inv4 env s0 PdOut_value paid_value opened_value\"\n  apply(simp only: VC500_def inv4_def R4_def extraInv_def)\n  apply(rule impI)\n  apply(rule conjI)\n   apply(rule conjI)\n    apply simp\n   apply(drule conjE)\n    prefer 2\n    apply assumption\n   apply(drule conjE)\n    prefer 2\n    apply assumption\n   apply((rule allI)+)\n  subgoal premises vc_prems for s1 s2\n    using vc_prems(2) apply -\n    apply(drule conjE)\n     prefer 2\n     apply assumption\n    subgoal premises invs0\n      apply(rule impI)\n      apply(rule disjE[of \"100 < toEnvNum s2 (s s0 PdOut_value paid_value opened_value)\" \n\"100 = toEnvNum s2 (s s0 PdOut_value paid_value opened_value)\"])\n      using le_imp_less_or_eq apply blast\n      apply(rule cut_rl[of \"\\<exists>s4. toEnvP s4 \\<and>\n         substate s2 s4 \\<and>\n         substate s4 s0 \\<and>\n         toEnvNum s2 s4 \\<le> 100 \\<and>\n         \\<not> getVarBool s4 Controller'minimalOpened' \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow> getVarBool s3 Controller'minimalOpened')\"])\n        apply(drule exE)\n         prefer 2\n         apply assumption\n      subgoal for s4\n        apply(rule exI[of _ s4])\n        by simp\n      subgoal premises req_prems\n        using invs0(1) req_prems apply -\n        apply(drule conjE)\n         prefer 2\n         apply assumption\n        apply(drule allE[of _ s1])\n        prefer 2\n         apply assumption\n        apply(drule allE[of _ s2])\n        prefer 2\n         apply assumption\n        by(simp split: if_splits)\n      apply(rule cut_rl[of \"\\<forall> s5. toEnvP s5 \\<and> substate s2 s5 \\<and> substate s5 (s s0 PdOut_value paid_value opened_value) \\<longrightarrow>\npred4 s1 s2 (s s0 PdOut_value paid_value opened_value) s5\"])\n       apply(drule allE[of _ s2])\n      prefer 2\n        apply assumption\n       apply(drule impE)\n      prefer 3\n      apply assumption\n      using substate_refl apply blast\n       apply(simp only: pred4_def)\n       apply(drule impE)\n      prefer 3\n      apply assumption\n      using substate_refl substate_trans substate_antisym apply blast\n       apply assumption\n      apply(rule allI)\n      subgoal premises prems for s5\n        apply(induction rule: state_ind)\n        using prems(1) apply simp\n         apply(simp only: pred4_def)\n         apply(rule impI)\n\n         apply(rule impE[OF minimalOpened_open[of s1 s2 s0 s0]])\n        using vc_prems(1) apply(simp split: if_splits)\n        using invs0(2) substate_refl\n         apply (smt (verit))\n        apply(drule exE)\n         prefer 2\n          apply assumption\n        subgoal for s3\n          apply((drule conjE[of _ _ ?thesis])+)\n                      defer\n                      apply assumption+\n          apply(drule allE[of _ s3])\n           prefer 2\n           apply assumption\n          apply(drule impE)\n            prefer 3\n            apply assumption\n          using substate_antisym[of s3 s0] substate_refl  apply auto[1]\n          by blast\n\n        subgoal for s5\n          apply(simp only: pred4_def)\n          apply(rule impI)\n          apply(cases \"getVarBool (predEnv s5) open' = False\")\n           apply(rule exI[of _ \"predEnv s5\"])\n           apply(rule conjI)\n        apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n            apply blast\n       apply(rule conjI)\n          using substate_refl apply simp\n       apply(rule conjI)\n      using predEnv_substate substate_trans apply blast\n       apply(rule conjI)\n      using toEnvNum3[of s2 \"predEnv s5\"\n \"(s s0 PdOut_value paid_value opened_value) \"] \n        apply force\n       apply(rule conjI)\n        apply blast\n      using substate_antisym apply blast\n      apply(drule impE)\n        prefer 3\n        apply assumption\n       apply(((rule conjI),blast)+)\n      using substate_imp_substatete_predEnv_or_eq apply blast\n      apply(drule exE)\n       prefer 2\n       apply assumption\n      subgoal for s4\n        apply(rule exI[of _ s4])\n       apply(rule conjI)\n         apply blast\n        apply(rule conjI)\n        using predEnv_substate substate_trans apply blast\n        apply(((rule conjI),blast)+)\n        using predEnv_substate_imp_substate_or_eq by blast\n      done\n    done\n  done\n  done\n\n\n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/turnstile/Proof_4_500.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6513548511303338, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3307657212597985}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005 (modified)    |\n            |              September 2005 (modified)    |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_continuous\nimports CSP_F_domain Domain_F_cpo CSP_T_mono\nbegin\n\n(*****************************************************************\n\n         1. continuous failuresfun\n         2. continuous failuresFun\n         3. continuous [[ ]]Ffun\n         4. continuous [[ ]]FFun\n\n *****************************************************************)\n\n(*=============================================================*\n |                     traces fstF                             |\n *=============================================================*)\n\nlemma continuous_traces_fstF:\n   \"continuous ((%M. traces P (fstF o M)))\"\napply (subgoal_tac \"(%M. traces P (fstF o M)) = (traces P) o (op o fstF)\")\napply (simp add: continuous_traces continuous_op_fstF compo_continuous)\napply (simp add: fun_eq_iff)\ndone\n\n(*--------------------------------*\n |        STOP,SKIP,DIV           |\n *--------------------------------*)\n\nlemma continuous_failures_STOP: \"continuous (failures (STOP))\"\nby (simp add: failures_iff continuous_Constant)\n\nlemma continuous_failures_SKIP: \"continuous (failures (SKIP))\"\nby (simp add: failures_iff continuous_Constant)\n\nlemma continuous_failures_DIV: \"continuous (failures (DIV))\"\nby (simp add: failures_iff continuous_Constant)\n\n(*--------------------------------*\n |          Act_prefix            |\n *--------------------------------*)\n\nlemma continuous_failures_Act_prefix:\n \"continuous (failures P) ==> continuous (failures (a -> P))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\napply (rule_tac x=\"x\" in exI, simp)\n\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n\n(* <= *)\napply (rule)\napply (simp add: in_failures)\napply (erule disjE, fast)\napply (elim conjE exE)\napply (simp)\n\n(* => *)\napply (rule)\napply (simp)\napply (erule bexE)\napply (simp add: in_failures)\napply (erule disjE, simp)\napply (elim conjE exE)\napply (rule disjI2)\napply (rule_tac x=\"sa\" in exI, simp)\napply (rule_tac x=\"xa\" in bexI)\napply (simp_all)\n\nby (simp add: directed_def)\n\n(*--------------------------------*\n |        Ext_pre_choice          |\n *--------------------------------*)\n\nlemma continuous_failures_Ext_pre_choice:\n \"ALL a. continuous (failures (Pf a))\n     ==> continuous (failures (? a:X -> (Pf a)))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\n\napply (subgoal_tac \"Xa ~= {}\")\napply (erule exchange_forall_orderE)\napply (drule_tac x=\"Xa\" in spec)\napply (simp add: isLUB_UnionF)\n\napply (rule_tac x=\"LUB Xa\" in exI)\napply (rule conjI)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE, fast)\n apply (elim conjE exE)\n apply (simp)\n apply (drule_tac x=\"a\" in spec)\n apply (elim conjE exE)\n apply (subgoal_tac \"LUB Xa = x\", simp)\n apply (simp add: isLUB_LUB)\n\n(* => *)\n apply (rule)\n apply (simp)\n apply (erule bexE)\n apply (simp add: in_failures)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (rule disjI2)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sa\" in exI, simp)\n\n apply (drule_tac x=\"a\" in spec)\n apply (elim conjE exE)\n apply (subgoal_tac \"LUB Xa = xa\", simp)\n apply (rule_tac x=\"x\" in bexI)\n apply (simp)\n apply (simp)\n apply (simp add: isLUB_LUB)\n\n apply (drule_tac x=\"a\" in spec)\n apply (elim conjE exE)\n apply (simp add: isLUB_LUB)\n\nby (simp add: directed_def)\n\n(*--------------------------------*\n |          Ext_choice            |\n *--------------------------------*)\n\nlemma continuous_failures_Ext_choice:\n \"[| continuous (failures P) ; continuous (failures Q) |]\n  ==> continuous (failures (P [+] Q))\"\napply (subgoal_tac \"mono (failures P) & mono (failures Q)\")\napply (subgoal_tac \"continuous (%M. traces P (fstF o M)) &\n                    continuous (%M. traces Q (fstF o M))\")\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (elim conjE)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\n\napply (subgoal_tac \"xa = x\")\napply (subgoal_tac \"xb = x\")\napply (subgoal_tac \"xc = x\")\napply (rule_tac x=\"x\" in exI, simp)\n\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (simp add: isLUB_UnionT)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE bexE disjE)\n\n (* 1 *)\n  apply (simp add: directed_def)\n  apply (drule_tac x=\"xd\" in spec)\n  apply (drule_tac x=\"xe\" in spec)\n  apply (simp, elim conjE exE)\n  apply (rule_tac x=\"z\" in bexI)\n  apply (rule disjI1)\n  apply (rule conjI)\n  apply (rule memF_subsetF, simp)\n  apply (simp add: mono_def)\n  apply (rotate_tac -4)\n  apply (rule memF_subsetF, simp)\n  apply (simp add: mono_def)\n\n (* 2-5 *)\n  apply (fast)+\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (fast)\n\napply (simp add: directed_def)\napply (rule LUB_unique, simp_all)+\n\napply (simp add: continuous_traces_fstF)\napply (simp add: continuous_mono)\ndone\n\n(*--------------------------------*\n |          Int_choice            |\n *--------------------------------*)\n\nlemma continuous_failures_Int_choice:\n \"[| continuous (failures P) ; continuous (failures Q) |]\n  ==> continuous (failures (P |~| Q))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\n\napply (subgoal_tac \"xa = x\")\napply (rule_tac x=\"x\" in exI, simp)\n\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n apply (rule, simp add: in_failures, fast)\n apply (rule, simp add: in_failures, fast)\napply (simp add: directed_def)\nby (rule LUB_unique, simp_all)\n\n(*--------------------------------*\n |        Rep_int_choice          |\n *--------------------------------*)\n\nlemma continuous_failures_Rep_int_choice:\n \"ALL c. continuous (failures (Pf c))\n  ==> continuous (failures (!! :C .. Pf))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\n\napply (subgoal_tac \"X ~= {}\")\napply (erule exchange_forall_orderE)\napply (drule_tac x=\"X\" in spec)\napply (simp add: isLUB_UnionF)\n\napply (rule_tac x=\"LUB X\" in exI)\napply (rule conjI)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE bexE)\n apply (drule_tac x=\"c\" in spec)\n apply (elim conjE exE)\n apply (subgoal_tac \"LUB X = x\", simp)\n apply (elim bexE)\n apply (rule_tac x=\"xa\" in bexI)\n apply (fast)\n apply (simp)\n apply (simp add: isLUB_LUB)\n\n(* => *)\n apply (rule)\n apply (simp)\n apply (erule bexE)\n apply (simp add: in_failures)\n apply (elim conjE bexE)\n apply (rule_tac x=\"c\" in bexI)\n\n apply (drule_tac x=\"c\" in spec)\n apply (elim conjE exE)\n apply (subgoal_tac \"LUB X = xa\", simp)\n apply (rule_tac x=\"x\" in bexI)\n apply (simp)\n apply (simp)\n apply (simp add: isLUB_LUB)\n apply (simp)\n\n apply (drule_tac x=\"c\" in spec)\n apply (elim conjE exE)\n apply (simp add: isLUB_LUB)\n\nby (simp add: directed_def)\n\n(*--------------------------------*\n |              IF                |\n *--------------------------------*)\n\nlemma continuous_failures_IF:\n \"[| continuous (failures P) ; continuous (failures Q) |]\n  ==> continuous (failures (IF b THEN P ELSE Q))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\napply (case_tac \"b\")\n apply (rule_tac x=\"x\" in exI, simp)\n apply (simp add: failures_iff)\n\n apply (rule_tac x=\"xa\" in exI, simp)\n apply (simp add: failures_iff)\ndone\n\n(*--------------------------------*\n |           Parallel             |\n *--------------------------------*)\n\nlemma continuous_failures_Parallel:\n \"[| continuous (failures P) ; continuous (failures Q) |]\n  ==> continuous (failures (P |[X]| Q))\"\napply (subgoal_tac \"mono (failures P) & mono (failures Q)\")\n\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"Xa\" in spec, simp)\napply (drule_tac x=\"Xa\" in spec, simp)\napply (elim conjE exE)\n\napply (subgoal_tac \"xa = x\")\napply (rule_tac x=\"x\" in exI, simp)\n\napply (subgoal_tac \"Xa ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim exE bexE conjE)\n\n apply (simp add: directed_def)\n apply (drule_tac x=\"xb\" in spec)\n apply (drule_tac x=\"xc\" in spec)\n apply (simp, elim conjE exE)\n apply (rule_tac x=\"z\" in bexI)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Z\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n apply (rule conjI)\n apply (rule memF_subsetF, simp)\n apply (simp add: mono_def)\n apply (rotate_tac -4)\n apply (rule memF_subsetF, simp)\n apply (simp add: mono_def)\n apply (simp)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (fast)\n\napply (simp add: directed_def)\napply (simp add: LUB_unique)\n\nby (simp add: continuous_mono)\n\n(*--------------------------------*\n |            Hiding              |\n *--------------------------------*)\n\nlemma continuous_failures_Hiding:\n \"continuous (failures P)\n  ==> continuous (failures (P -- X))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"Xa\" in spec, simp)\napply (elim conjE exE)\n\napply (rule_tac x=\"x\" in exI, simp)\napply (subgoal_tac \"Xa ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (fast)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (fast)\n\nby (simp add: directed_def)\n\n(*--------------------------------*\n |           Renaming             |\n *--------------------------------*)\n\nlemma continuous_failures_Renaming:\n \"continuous (failures P)\n  ==> continuous (failures (P [[r]]))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\n\napply (rule_tac x=\"x\" in exI, simp)\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n apply (rule, simp add: in_failures, fast)\n apply (rule, simp add: in_failures, fast)\nby (simp add: directed_def)\n\n(*--------------------------------*\n |           Seq_compo            |\n *--------------------------------*)\n\nlemma continuous_failures_Seq_compo:\n \"[| continuous (failures P) ; continuous (failures Q) |]\n  ==> continuous (failures (P ;; Q))\"\napply (subgoal_tac \"mono (traces P) & mono (failures Q)\")\napply (subgoal_tac \"continuous (%M. traces P (fstF o M))\")\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\n\napply (subgoal_tac \"xa = x\")\napply (subgoal_tac \"xb = x\")\napply (rule_tac x=\"x\" in exI, simp)\n\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (simp add: isLUB_UnionT)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim bexE exE conjE disjE)\n\n (* 1 *)\n  apply (fast)\n\n (* 2 *)\n  apply (simp add: directed_def)\n  apply (drule_tac x=\"xc\" in spec)\n  apply (drule_tac x=\"xd\" in spec)\n  apply (simp, elim conjE exE)\n  apply (rule_tac x=\"z\" in bexI)\n  apply (rule disjI2)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp)\n\n  apply (rule conjI)\n  apply (rule memT_subdomT, simp)\n  apply (simp add: mono_def)\n  apply (subgoal_tac \"fstF o xc <= fstF o z\")\n  apply (simp add: comp_def)\n\n  apply (simp add: comp_def)\n  apply (simp add: order_prod_def)\n  apply (simp add: mono_fstF[simplified mono_def])\n\n  apply (rotate_tac -4)\n  apply (rule memF_subsetF, simp)\n  apply (simp add: mono_def)\n  apply (simp)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (fast)\n\napply (simp add: directed_def)\napply (simp add: LUB_unique)+\napply (simp add: continuous_traces_fstF)\napply (simp add: continuous_mono)\napply (simp add: mono_traces)\ndone\n\n(*--------------------------------*\n |          Depth_rest            |\n *--------------------------------*)\n\nlemma continuous_failures_Depth_rest:\n \"continuous (failures P)\n  ==> continuous (failures (P |. n))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\n\napply (rule_tac x=\"x\" in exI, simp)\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n apply (rule, simp add: in_failures)\n apply (rule, simp add: in_failures)\nby (simp add: directed_def)\n\n(*--------------------------------*\n |            variable            |\n *--------------------------------*)\n\nlemma continuous_failures_variable_lm: \"continuous (sndF o (%M. M p))\"\napply (rule compo_continuous)\napply (simp add: continuous_prod_variable)\napply (simp add: sndF_def)\napply (rule compo_continuous)\napply (simp add: cont_Rep_domF)\napply (simp add: snd_continuous)\ndone\n\nlemma continuous_failures_variable: \n   \"continuous (failures ($p))\"\napply (simp add: failures_iff)\napply (simp add: continuous_failures_variable_lm[simplified comp_def])\ndone\n\n(** [[ ]]Ff **)\n\nlemma continuous_semFf_variable: \"continuous ([[$p]]Ff)\"\napply (simp add: semFf_Proc_name)\napply (simp add: continuous_prod_variable)\ndone\n\n(*--------------------------------*\n |             Proc               |\n *--------------------------------*)\n\nlemma continuous_failures: \"continuous (failures P)\"\napply (induct_tac P)\napply (simp add: continuous_failures_STOP)\napply (simp add: continuous_failures_SKIP)\napply (simp add: continuous_failures_DIV)\napply (simp add: continuous_failures_Act_prefix)\napply (simp add: continuous_failures_Ext_pre_choice)\napply (simp add: continuous_failures_Ext_choice)\napply (simp add: continuous_failures_Int_choice)\napply (simp add: continuous_failures_Rep_int_choice)\napply (simp add: continuous_failures_IF)\napply (simp add: continuous_failures_Parallel)\napply (simp add: continuous_failures_Hiding)\napply (simp add: continuous_failures_Renaming)\napply (simp add: continuous_failures_Seq_compo)\napply (simp add: continuous_failures_Depth_rest)\napply (simp add: continuous_failures_variable)\ndone\n\n(*=============================================================*\n |                          [[P]]Ff                            |\n *=============================================================*)\n\nlemma continuous_semFf: \n  \"continuous ([[Pf]]Ff)\"\napply (simp add: semFf_def)\napply (simp add: continuous_domF_decompo)\napply (simp add: continuous_traces_fstF)\napply (simp add: continuous_failures)\ndone\n\n(*=============================================================*\n |                         [[P]]Ffun                           |\n *=============================================================*)\n\nlemma continuous_semFfun: \n  \"continuous ([[PF]]Ffun)\"\napply (simp add: semFfun_def)\napply (simp add: prod_continuous)\napply (simp add: proj_fun_def comp_def)\napply (simp add: continuous_semFf)\ndone\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_continuous.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6513548511303338, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3307657212597985}}
{"text": "(*  Title:      HOL/Proofs/Lambda/ListBeta.thy\n    Author:     Tobias Nipkow\n    Copyright   1998 TU Muenchen\n*)\n\nsection \\<open>Lifting beta-reduction to lists\\<close>\n\ntheory ListBeta imports ListApplication ListOrder begin\n\ntext \\<open>\n  Lifting beta-reduction to lists of terms, reducing exactly one element.\n\\<close>\n\nabbreviation\n  list_beta :: \"dB list => dB list => bool\"  (infixl \"=>\" 50) where\n  \"rs => ss == step1 beta rs ss\"\n\nlemma head_Var_reduction:\n  \"Var n \\<degree>\\<degree> rs \\<rightarrow>\\<^sub>\\<beta> v \\<Longrightarrow> \\<exists>ss. rs => ss \\<and> v = Var n \\<degree>\\<degree> ss\"\n  apply (induct u == \"Var n \\<degree>\\<degree> rs\" v arbitrary: rs set: beta)\n     apply simp\n    apply (rule_tac xs = rs in rev_exhaust)\n     apply simp\n    apply (atomize, force intro: append_step1I)\n   apply (rule_tac xs = rs in rev_exhaust)\n    apply simp\n    apply (auto 0 3 intro: disjI2 [THEN append_step1I])\n  done\n\nlemma apps_betasE [elim!]:\n  assumes major: \"r \\<degree>\\<degree> rs \\<rightarrow>\\<^sub>\\<beta> s\"\n    and cases: \"!!r'. [| r \\<rightarrow>\\<^sub>\\<beta> r'; s = r' \\<degree>\\<degree> rs |] ==> R\"\n      \"!!rs'. [| rs => rs'; s = r \\<degree>\\<degree> rs' |] ==> R\"\n      \"!!t u us. [| r = Abs t; rs = u # us; s = t[u/0] \\<degree>\\<degree> us |] ==> R\"\n  shows R\nproof -\n  from major have\n   \"(\\<exists>r'. r \\<rightarrow>\\<^sub>\\<beta> r' \\<and> s = r' \\<degree>\\<degree> rs) \\<or>\n    (\\<exists>rs'. rs => rs' \\<and> s = r \\<degree>\\<degree> rs') \\<or>\n    (\\<exists>t u us. r = Abs t \\<and> rs = u # us \\<and> s = t[u/0] \\<degree>\\<degree> us)\"\n    apply (induct u == \"r \\<degree>\\<degree> rs\" s arbitrary: r rs set: beta)\n       apply (case_tac r)\n         apply simp\n        apply (simp add: App_eq_foldl_conv)\n        apply (split if_split_asm)\n         apply simp\n         apply blast\n        apply simp\n       apply (simp add: App_eq_foldl_conv)\n       apply (split if_split_asm)\n        apply simp\n       apply simp\n      apply (drule App_eq_foldl_conv [THEN iffD1])\n      apply (split if_split_asm)\n       apply simp\n       apply blast\n      apply (force intro!: disjI1 [THEN append_step1I])\n     apply (drule App_eq_foldl_conv [THEN iffD1])\n     apply (split if_split_asm)\n      apply simp\n      apply blast\n     apply (clarify, auto 0 3 intro!: exI intro: append_step1I)\n    done\n  with cases show ?thesis by blast\nqed\n\nlemma apps_preserves_beta [simp]:\n    \"r \\<rightarrow>\\<^sub>\\<beta> s ==> r \\<degree>\\<degree> ss \\<rightarrow>\\<^sub>\\<beta> s \\<degree>\\<degree> ss\"\n  by (induct ss rule: rev_induct) auto\n\nlemma apps_preserves_beta2 [simp]:\n    \"r \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s ==> r \\<degree>\\<degree> ss \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s \\<degree>\\<degree> ss\"\n  apply (induct set: rtranclp)\n   apply blast\n  apply (blast intro: apps_preserves_beta rtranclp.rtrancl_into_rtrancl)\n  done\n\nlemma apps_preserves_betas [simp]:\n    \"rs => ss \\<Longrightarrow> r \\<degree>\\<degree> rs \\<rightarrow>\\<^sub>\\<beta> r \\<degree>\\<degree> ss\"\n  apply (induct rs arbitrary: ss rule: rev_induct)\n   apply simp\n  apply simp\n  apply (rule_tac xs = ss in rev_exhaust)\n   apply simp\n  apply simp\n  apply (drule Snoc_step1_SnocD)\n  apply blast\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Proofs/Lambda/ListBeta.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5544704796847396, "lm_q2_score": 0.5964331462646254, "lm_q1q2_score": 0.3307045727092253}}
{"text": "(*  Title:      Code_Target_Word_Base.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nchapter \\<open>Common base for target language implementations of word types\\<close>\n\ntheory Code_Target_Word_Base\n  imports\n    \"HOL-Library.Word\"\n    \"../Word_Lib/Signed_Division_Word\"\n    \"../Word_Lib/More_Word\"\nbegin\n\nsubsection \\<open>More on conversions\\<close>\n\nlemma int_of_integer_unsigned_eq [simp]:\n  \\<open>int_of_integer (unsigned w) = uint w\\<close>\n  by transfer simp\n\nlemma int_of_integer_signed_eq [simp]:\n  \\<open>int_of_integer (signed w) = sint w\\<close>\n  by transfer simp\n\nabbreviation word_of_integer :: \\<open>integer \\<Rightarrow> 'a::len word\\<close>\n  where \\<open>word_of_integer k \\<equiv> word_of_int (int_of_integer k)\\<close>\n\n\nsubsection \\<open>Quickcheck conversion functions\\<close>\n\ncontext\n  includes state_combinator_syntax\nbegin\n\ndefinition qc_random_cnv ::\n  \"(natural \\<Rightarrow> 'a::term_of) \\<Rightarrow> natural \\<Rightarrow> Random.seed\n    \\<Rightarrow> ('a \\<times> (unit \\<Rightarrow> Code_Evaluation.term)) \\<times> Random.seed\"\n  where \"qc_random_cnv a_of_natural i = Random.range (i + 1) \\<circ>\\<rightarrow> (\\<lambda>k. Pair (\n       let n = a_of_natural k\n       in (n, \\<lambda>_. Code_Evaluation.term_of n)))\"\n\nend\n\ndefinition qc_exhaustive_cnv :: \"(natural \\<Rightarrow> 'a) \\<Rightarrow> ('a \\<Rightarrow> (bool \\<times> term list) option)\n  \\<Rightarrow> natural \\<Rightarrow> (bool \\<times> term list) option\"\nwhere\n  \"qc_exhaustive_cnv a_of_natural f d =\n   Quickcheck_Exhaustive.exhaustive (%x. f (a_of_natural x)) d\"\n\ndefinition qc_full_exhaustive_cnv ::\n  \"(natural \\<Rightarrow> ('a::term_of)) \\<Rightarrow> ('a \\<times> (unit \\<Rightarrow> term) \\<Rightarrow> (bool \\<times> term list) option)\n  \\<Rightarrow> natural \\<Rightarrow> (bool \\<times> term list) option\"\nwhere\n  \"qc_full_exhaustive_cnv a_of_natural f d = Quickcheck_Exhaustive.full_exhaustive\n  (%(x, xt). f (a_of_natural x, %_. Code_Evaluation.term_of (a_of_natural x))) d\"\n\ndeclare [[quickcheck_narrowing_ghc_options = \"-XTypeSynonymInstances\"]]\n\ndefinition qc_narrowing_drawn_from :: \"'a list \\<Rightarrow> integer \\<Rightarrow> _\"\nwhere\n  \"qc_narrowing_drawn_from xs =\n   foldr Quickcheck_Narrowing.sum (map Quickcheck_Narrowing.cons (butlast xs)) (Quickcheck_Narrowing.cons (last xs))\"\n\nlocale quickcheck_narrowing_samples =\n  fixes a_of_integer :: \"integer \\<Rightarrow> 'a \\<times> 'a :: {partial_term_of, term_of}\"\n  and zero :: \"'a\"\n  and tr :: \"typerep\"\nbegin\n\nfunction narrowing_samples :: \"integer \\<Rightarrow> 'a list\"\nwhere\n  \"narrowing_samples i =\n   (if i > 0 then let (a, a') = a_of_integer i in narrowing_samples (i - 1) @ [a, a'] else [zero])\"\nby pat_completeness auto\ntermination including integer.lifting\nproof(relation \"measure nat_of_integer\")\n  fix i :: integer\n  assume \"0 < i\"\n  thus \"(i - 1, i) \\<in> measure nat_of_integer\"\n    by simp(transfer, simp)\nqed simp\n\ndefinition partial_term_of_sample :: \"integer \\<Rightarrow> 'a\"\nwhere\n  \"partial_term_of_sample i =\n  (if i < 0 then undefined\n   else if i = 0 then zero\n   else if i mod 2 = 0 then snd (a_of_integer (i div 2))\n   else fst (a_of_integer (i div 2 + 1)))\"\n\nlemma partial_term_of_code:\n  \"partial_term_of (ty :: 'a itself) (Quickcheck_Narrowing.Narrowing_variable p t) \\<equiv>\n    Code_Evaluation.Free (STR ''_'') tr\"\n  \"partial_term_of (ty :: 'a itself) (Quickcheck_Narrowing.Narrowing_constructor i []) \\<equiv>\n   Code_Evaluation.term_of (partial_term_of_sample i)\"\nby (rule partial_term_of_anything)+\n\nend\n\nlemmas [code] =\n  quickcheck_narrowing_samples.narrowing_samples.simps\n  quickcheck_narrowing_samples.partial_term_of_sample_def\n\n\nsubsection \\<open>More on division\\<close>\n\nlemma div_half_nat:\n  fixes x y :: nat\n  assumes \"y \\<noteq> 0\"\n  shows \"(x div y, x mod y) = (let q = 2 * (x div 2 div y); r = x - q * y in if y \\<le> r then (q + 1, r - y) else (q, r))\"\nproof -\n  let ?q = \"2 * (x div 2 div y)\"\n  have q: \"?q = x div y - x div y mod 2\"\n    by(metis div_mult2_eq mult.commute minus_mod_eq_mult_div [symmetric])\n  let ?r = \"x - ?q * y\"\n  have r: \"?r = x mod y + x div y mod 2 * y\"\n    by(simp add: q diff_mult_distrib minus_mod_eq_div_mult [symmetric])(metis diff_diff_cancel mod_less_eq_dividend mod_mult2_eq add.commute mult.commute)\n\n  show ?thesis\n  proof(cases \"y \\<le> x - ?q * y\")\n    case True\n    with assms q have \"x div y mod 2 \\<noteq> 0\" unfolding r\n      by (metis Nat.add_0_right diff_0_eq_0 diff_Suc_1 le_div_geq mod2_gr_0 mod_div_trivial mult_0 neq0_conv numeral_1_eq_Suc_0 numerals(1)) \n    hence \"x div y = ?q + 1\" unfolding q\n      by simp\n    moreover hence \"x mod y = ?r - y\"\n      by simp(metis minus_div_mult_eq_mod [symmetric] diff_commute diff_diff_left mult_Suc)\n    ultimately show ?thesis using True by(simp add: Let_def)\n  next\n    case False\n    hence \"x div y mod 2 = 0\" unfolding r\n      by(simp add: not_le)(metis Nat.add_0_right assms div_less div_mult_self2 mod_div_trivial mult.commute)\n    hence \"x div y = ?q\" unfolding q by simp\n    moreover hence \"x mod y = ?r\" by (metis minus_div_mult_eq_mod [symmetric])\n    ultimately show ?thesis using False by(simp add: Let_def)\n  qed\nqed\n\nlemma div_half_word:\n  fixes x y :: \"'a :: len word\"\n  assumes \"y \\<noteq> 0\"\n  shows \"(x div y, x mod y) = (let q = push_bit 1 (drop_bit 1 x div y); r = x - q * y in if y \\<le> r then (q + 1, r - y) else (q, r))\"\nproof -\n  obtain n where n: \"x = of_nat n\" \"n < 2 ^ LENGTH('a)\"\n    by (rule that [of \\<open>unat x\\<close>]) simp_all\n  moreover obtain m where m: \"y = of_nat m\" \"m < 2 ^ LENGTH('a)\"\n    by (rule that [of \\<open>unat y\\<close>]) simp_all\n  ultimately have [simp]: \\<open>unat (of_nat n :: 'a word) = n\\<close> \\<open>unat (of_nat m :: 'a word) = m\\<close>\n    by (transfer, simp add: take_bit_of_nat take_bit_nat_eq_self_iff)+\n  let ?q = \"push_bit 1 (drop_bit 1 x div y)\"\n  let ?q' = \"2 * (n div 2 div m)\"\n  have \"n div 2 div m < 2 ^ LENGTH('a)\"\n    using n by (metis of_nat_inverse uno_simps(2) unsigned_less)\n  hence q: \"?q = of_nat ?q'\" using n m\n    by (auto simp add: drop_bit_eq_div word_arith_nat_div uno_simps take_bit_nat_eq_self unsigned_of_nat)\n  from assms have \"m \\<noteq> 0\" using m by -(rule notI, simp)\n\n  from n have \"2 * (n div 2 div m) < 2 ^ LENGTH('a)\"\n    by (metis mult.commute div_mult2_eq minus_mod_eq_mult_div [symmetric] less_imp_diff_less of_nat_inverse unsigned_less uno_simps(2))\n  moreover\n  have \"2 * (n div 2 div m) * m < 2 ^ LENGTH('a)\" using n unfolding div_mult2_eq[symmetric]\n    by(subst (2) mult.commute)(simp add: minus_mod_eq_div_mult [symmetric] diff_mult_distrib minus_mod_eq_mult_div [symmetric] div_mult2_eq)\n  moreover have \"2 * (n div 2 div m) * m \\<le> n\"\n    by (simp flip: div_mult2_eq ac_simps)\n  ultimately\n  have r: \"x - ?q * y = of_nat (n - ?q' * m)\"\n    and \"y \\<le> x - ?q * y \\<Longrightarrow> of_nat (n - ?q' * m) - y = of_nat (n - ?q' * m - m)\"\n    using n m unfolding q\n     apply (simp_all add: of_nat_diff)\n    apply (subst of_nat_diff)\n    apply (cases \\<open>LENGTH('a) \\<ge> 2\\<close>)\n     apply (simp_all add: word_le_nat_alt take_bit_nat_eq_self unat_sub_if' unat_word_ariths unsigned_of_nat)\n    done\n  then show ?thesis using n m div_half_nat [OF \\<open>m \\<noteq> 0\\<close>, of n] unfolding q\n    by (simp add: word_le_nat_alt word_div_def word_mod_def Let_def take_bit_nat_eq_self unsigned_of_nat\n      flip: zdiv_int zmod_int\n      split del: if_split split: if_split_asm)\nqed\n\ntext \\<open>Division on @{typ \"'a word\"} is unsigned, but Scala and OCaml only have signed division and modulus.\\<close>\n\n\n\nlemma [code]:\n  \"x smod y =\n   (let x' = sint x; y' = sint y;\n        negative = (x' < 0);\n        result = abs x' mod abs y'\n    in word_of_int (if negative then -result else result))\"\n  for x y :: \\<open>'a::len word\\<close>\nproof -\n  have *: \\<open>k mod l = k - k div l * l\\<close> for k l :: int\n    by (simp add: minus_div_mult_eq_mod)\n  show ?thesis\n    by (simp add: smod_word_def signed_modulo_int_def signed_divide_int_def * sgn_if Let_def)\nqed\n\ntext \\<open>\n  This algorithm implements unsigned division in terms of signed division.\n  Taken from Hacker's Delight.\n\\<close>\n\nlemma divmod_via_sdivmod:\n  fixes x y :: \"'a :: len word\"\n  assumes \"y \\<noteq> 0\"\n  shows\n  \"(x div y, x mod y) =\n  (if push_bit (LENGTH('a) - 1) 1 \\<le> y then if x < y then (0, x) else (1, x - y)\n   else let q = (push_bit 1 (drop_bit 1 x sdiv y));\n            r = x - q * y\n        in if r \\<ge> y then (q + 1, r - y) else (q, r))\"\nproof(cases \"push_bit (LENGTH('a) - 1) 1 \\<le> y\")\n  case True\n  note y = this\n  show ?thesis\n  proof(cases \"x < y\")\n    case True\n    then have \"x mod y = x\"\n      by transfer simp\n    then show ?thesis using True y\n      using bits_mod_div_trivial [of x y] by simp\n  next\n    case False\n    obtain n where n: \"y = of_nat n\" \"n < 2 ^ LENGTH('a)\"\n      by (rule that [of \\<open>unat y\\<close>]) simp_all\n    have \"unat x < 2 ^ LENGTH('a)\" by (rule unsigned_less)\n    also have \"\\<dots> = 2 * 2 ^ (LENGTH('a) - 1)\"\n      by(metis Suc_pred len_gt_0 power_Suc One_nat_def)\n    also have \"\\<dots> \\<le> 2 * n\" using y n\n      by transfer (simp add: take_bit_eq_mod)\n    finally have div: \"x div of_nat n = 1\" using False n\n      by (simp add: take_bit_nat_eq_self unsigned_of_nat word_div_eq_1_iff)\n    moreover have \"x mod y = x - x div y * y\"\n      by (simp add: minus_div_mult_eq_mod)\n    with div n have \"x mod y = x - y\" by simp\n    ultimately show ?thesis using False y n by simp\n  qed\nnext\n  case False\n  note y = this\n  obtain n where n: \"x = of_nat n\" \"n < 2 ^ LENGTH('a)\"\n    by (rule that [of \\<open>unat x\\<close>]) simp_all\n  hence \"int n div 2 + 2 ^ (LENGTH('a) - Suc 0) < 2 ^ LENGTH('a)\"\n    by (cases \\<open>LENGTH('a)\\<close>)\n      (auto dest: less_imp_of_nat_less [where ?'a = int])\n  with y n have \"sint (drop_bit 1 x) = uint (drop_bit 1 x)\"\n    by (cases \\<open>LENGTH('a)\\<close>)\n      (auto simp add: sint_uint drop_bit_eq_div take_bit_nat_eq_self uint_div_distrib\n        signed_take_bit_int_eq_self_iff unsigned_of_nat)\n  moreover have \"uint y + 2 ^ (LENGTH('a) - Suc 0) < 2 ^ LENGTH('a)\"\n    using y by (cases \\<open>LENGTH('a)\\<close>)\n      (simp_all add: not_le word_less_alt uint_power_lower)\n  then have \"sint y = uint y\"\n    apply (cases \\<open>LENGTH('a)\\<close>)\n     apply (auto simp add: sint_uint signed_take_bit_int_eq_self_iff)\n    using uint_ge_0 [of y]\n    by linarith \n  ultimately show ?thesis using y\n    apply (subst div_half_word [OF assms])\n    apply (simp add: sdiv_word_def signed_divide_int_def flip: uint_div)\n    done\nqed\n\n\nsubsection \\<open>More on misc operations\\<close>\n\ncontext\n  includes bit_operations_syntax\nbegin\n\nlemma word_of_int_code:\n  \"uint (word_of_int x :: 'a word) = x AND mask (LENGTH('a :: len))\"\n  by (simp add: unsigned_of_int take_bit_eq_mask)\n\nlemma word_and_mask_or_conv_and_mask:\n  \"bit n index \\<Longrightarrow> (n AND mask index) OR (push_bit index 1) = n AND mask (index + 1)\"\n  for n :: \\<open>'a::len word\\<close>\n  by (rule bit_eqI) (auto simp add: bit_simps)\n\nlemma uint_and_mask_or_full:\n  fixes n :: \"'a :: len word\"\n  assumes \"bit n (LENGTH('a) - 1)\"\n  and \"mask1 = mask (LENGTH('a) - 1)\"\n  and \"mask2 = push_bit (LENGTH('a) - 1) 1\"\n  shows \"uint (n AND mask1) OR mask2 = uint n\"\nproof -\n  have \"mask2 = uint (push_bit (LENGTH('a) - 1) 1 :: 'a word)\" using assms\n    by transfer (simp add: take_bit_push_bit)\n  hence \"uint (n AND mask1) OR mask2 = uint (n AND mask1 OR (push_bit (LENGTH('a) - 1) 1 :: 'a word))\"\n    by(simp add: uint_or)\n  also have \"\\<dots> = uint (n AND mask (LENGTH('a) - 1 + 1))\"\n    using assms by(simp only: word_and_mask_or_conv_and_mask)\n  also have \"\\<dots> = uint n\" by simp\n  finally show ?thesis .\nqed\n\nlemma word_of_int_via_signed:\n  fixes mask\n  assumes mask_def: \"mask = Bit_Operations.mask LENGTH('a)\"\n  and shift_def: \"shift = push_bit LENGTH('a) 1\"\n  and index_def: \"index = LENGTH('a) - 1\"\n  and overflow_def:\"overflow = push_bit (LENGTH('a) - 1) 1\"\n  and least_def: \"least = - overflow\"\n  shows\n  \"(word_of_int i :: 'a :: len word) =\n   (let i' = i AND mask\n    in if bit i' index then\n         if i' - shift < least \\<or> overflow \\<le> i' - shift then arbitrary1 i' else word_of_int (i' - shift)\n       else if i' < least \\<or> overflow \\<le> i' then arbitrary2 i' else word_of_int i')\"\nproof -\n  define i' where \"i' = i AND mask\"\n  have \"shift = mask + 1\" unfolding assms\n    by (simp add: mask_eq_exp_minus_1) \n  hence \"i' < shift\"\n    by (simp add: mask_def i'_def)\n  show ?thesis\n  proof(cases \"bit i' index\")\n    case True\n    then have unf: \"i' = overflow OR i'\"\n      apply (simp add: assms i'_def flip: take_bit_eq_mask)\n      apply (rule bit_eqI)\n      apply (auto simp add: bit_take_bit_iff bit_or_iff bit_exp_iff)\n      done\n    have \\<open>overflow \\<le> overflow OR i'\\<close>\n      by (simp add: i'_def mask_def or_greater_eq)\n    then have \"overflow \\<le> i'\"\n      by (subst unf)\n    hence \"i' - shift < least \\<longleftrightarrow> False\" unfolding assms\n      by(cases \"LENGTH('a)\")(simp_all add: not_less)\n    moreover\n    have \"overflow \\<le> i' - shift \\<longleftrightarrow> False\" using \\<open>i' < shift\\<close> unfolding assms\n      by(cases \"LENGTH('a)\")(auto simp add: not_le elim: less_le_trans)\n    moreover\n    have \"word_of_int (i' - shift) = (word_of_int i :: 'a word)\" using \\<open>i' < shift\\<close>\n      by (simp add: i'_def shift_def mask_def word_of_int_eq_iff flip: take_bit_eq_mask)\n    ultimately show ?thesis using True by(simp add: Let_def i'_def)\n  next\n    case False\n    have \"i' = i AND Bit_Operations.mask (LENGTH('a) - 1)\"\n      apply (rule bit_eqI)\n      apply (use False in \\<open>auto simp add: bit_simps assms i'_def\\<close>)\n      apply (auto simp add: less_le)\n      done\n    also have \"\\<dots> \\<le> Bit_Operations.mask (LENGTH('a) - 1)\"\n      using AND_upper2 mask_nonnegative_int by blast\n    also have \"\\<dots> < overflow\"\n      by (simp add: mask_int_def overflow_def)\n    also\n    have \"least \\<le> 0\" unfolding least_def overflow_def by simp\n    have \"0 \\<le> i'\" by (simp add: i'_def mask_def)\n    hence \"least \\<le> i'\" using \\<open>least \\<le> 0\\<close> by simp\n    moreover\n    have \"word_of_int i' = (word_of_int i :: 'a word)\"\n      by (simp add: i'_def mask_def of_int_and_eq of_int_mask_eq)\n    ultimately show ?thesis using False by(simp add: Let_def i'_def)\n  qed\nqed\n\nend\n\n\nsubsection \\<open>Code generator setup\\<close>\n\ntext \\<open>\n  The separate code target \\<open>SML_word\\<close> collects setups for the\n  code generator that PolyML does not provide.\n\\<close>\n\nsetup \\<open>Code_Target.add_derived_target (\"SML_word\", [(Code_ML.target_SML, I)])\\<close>\n\ncode_identifier code_module Code_Target_Word_Base \\<rightharpoonup>\n  (SML) Word and (Haskell) Word and (OCaml) Word and (Scala) Word\n\n\ntext \\<open>Misc\\<close>\n\nlemmas word_sdiv_def = sdiv_word_def\nlemmas word_smod_def = smod_word_def\n\nend\n", "meta": {"author": "VTrelat", "repo": "Hopcroft_verif", "sha": "ede77c3a2105fd6722cf96896a297db294edf269", "save_path": "github-repos/isabelle/VTrelat-Hopcroft_verif", "path": "github-repos/isabelle/VTrelat-Hopcroft_verif/Hopcroft_verif-ede77c3a2105fd6722cf96896a297db294edf269/Isabelle/Native_Word/Code_Target_Word_Base.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3307045718820767}}
{"text": "theory Common \nimports Main\nbegin\n\n(* FIXME when to use options and when to use rresult *)\n\nsection \"preliminaries\"\n\ndefinition rev_apply :: \"'a => ('a => 'b) => 'b\" (infixl \"|>\" 100) where\n  \"rev_apply x f = f x\"\n\n\n(* Quickcheck_Examples/Completeness.thy - should be in Main? simpler defn here*)\ndefinition is_Some :: \"'a option => bool\" where\n  \"is_Some x == x ~= None\"\n\nprimrec dest_Some (* :: \"'a option => 'a\" *) where \n  \"dest_Some (Some x) = x\"\n  | \"dest_Some None = undefined\"\n\n\ndefinition arb :: \"'a\" where\n  \"arb == undefined\"  \n\ndefinition impossible :: \"'a\" where\n  \"impossible == undefined\"  \n\ndatatype 'a rresult = Ok 'a | Error \n\ndefinition rresult_to_option :: \"'a rresult => 'a option\" where\n  \"rresult_to_option x = (case x of Ok x => Some x | Error => None)\"\n\n\n\n\n\nsection \"page, page_ref, store\"\n\n(* type vars: 'bs 'k 'r 'v *)\n\ndatatype 'bs page = Page 'bs (* bytes *)\n\ndatatype 'r page_ref = Page_ref 'r\n\ndefinition dest_page_ref :: \"'r page_ref => 'r\" where\n  \"dest_page_ref r0 == (case r0 of Page_ref r => r)\"\n\ndatatype ('bs,'r) store = Store \"('r page_ref ~=> 'bs page)\"  (* different to paper: we store actual bytes *)\n\ndefinition dest_store :: \"('bs,'r) store => ('r page_ref ~=> 'bs page)\" where\n  \"dest_store s0 == (case s0 of Store f => f)\"\n\ndefinition ref_to_page :: \"('bs,'r) store => 'r page_ref => 'bs page option\" where\n  \"ref_to_page s0 r0 == (s0|>dest_store) r0\"\n\n\nsection \"key and frame, (leaf_frame) key_to_v\"\n\n\ndatatype 'k key = Key 'k\n\ndefinition dest_key :: \"'k key => 'k\" where\n  \"dest_key k = (case k of Key k => k)\"\n\n\ndatatype 'v value_t = Value 'v\n\ndefinition dest_value :: \"'v value_t => 'v\" where\n  \"dest_value v == (case v of Value v => v)\"\n\n\nrecord ('r,'k) node_frame = \n  nf_n :: \"nat\"\n  nf_ks :: \"nat => 'k key\"\n  nf_rs :: \"nat => 'r page_ref\"\n\nrecord ('k,'v) leaf_frame = \n  lf_kvs :: \"('k key * 'v value_t) list\" (* slightly different to paper - we store ks in tree *) \n\ndatatype ('r,'k,'v) frame = Frm_I \"('r,'k) node_frame\" | Frm_L \"('k,'v) leaf_frame\"\n\ndefinition key_to_v :: \"('k,'v) leaf_frame => 'k key => 'v value_t option\" where\n  \"key_to_v lf k == (lf |> lf_kvs |> map_of) k\"\n\n\n\nsection \"page and frame, page_to_frame, ctxt_p2f\"\n\n(* interpretation of pages *)\ndatatype ('bs,'k,'r,'v) page_to_frame = P2f \"'bs page => ('r,'k,'v) frame\"  (* note that this forces that the page internally stores its type; this is not necessary, but is used by step_find *)\n\ndefinition dest_p2f :: \"('bs,'k,'r,'v) page_to_frame => 'bs page => ('r,'k,'v) frame\" where\n  \"dest_p2f x = (case x of P2f f => f)\"\n\n(**********)\n(* to convert a page_ref to a frame, lookup the page option and use the above *)\nrecord  ('bs,'k,'r,'v) ctxt_p2f_t =\n  ctxt_p2f :: \"('bs,'k,'r,'v) page_to_frame\"\n\n(* from this point, we don't duplicate 0/Suc defns, to minimize # of defns *)\ndefinition page_ref_to_frame :: \"('bs,'k,'r,'v) ctxt_p2f_t => ('bs,'r) store =>  'r page_ref => ('r,'k,'v) frame option\" where\n  \"page_ref_to_frame c0 s0 r0 == (\n    case ref_to_page s0 r0 of\n    None => (Error |> rresult_to_option)  (* invalid page access *)\n    | Some p => (Some( (c0|>ctxt_p2f|>dest_p2f) p))\n)\"\n\n\n\nsection \"tree\"\n\ndatatype ('k,'v) tree = Tr_nd \"(nat * (nat => 'k key) * (nat => ('k,'v) tree))\" | Tr_lf \"('k key * 'v value_t) list\"\n\ntype_synonym tree_height = nat\n\nlemma FIXME: \"P\" sorry\n\n\nfunction tree_to_leaves :: \"('k,'v) tree => ('k key *'v value_t) list list\" where\n  \"tree_to_leaves (Tr_lf(kvs)) = [kvs]\"\n  | \"tree_to_leaves (Tr_nd(n,ks,ts)) = (\n    [0..<n+1] |> (List.map ts) |> (List.map tree_to_leaves) |> List.concat)\"\nby pat_completeness auto\ntermination  (* tree_to_leavess_dom is not right here - the function package seems confused FIXME *)\n  apply(force intro:FIXME)\n  done\n\n\ndefinition tree_to_kvs :: \"('k,'v) tree => ('k key *'v value_t) list\" where\n  \"tree_to_kvs t0 == tree_to_leaves t0 |> List.concat\"\n\nlemma tree_to_kvs_simp: \"\n  (tree_to_kvs (Tr_lf(kvs)) = kvs)\n  & (tree_to_kvs (Tr_nd(n,ks,ts)) = ([0..<n+1] |> (List.map ts) |> (List.map tree_to_kvs) |> List.concat))\n\"\n  sorry\n\n\n\nsection \"page_ref_to_tree, page_ref_to_map, page_ref_key_to_v\"\n\n\ntype_synonym ('k,'r,'v) pr2f_t = \" ('r page_ref => ('k,'v) tree option)\"\n\ndefinition nf_to_subtrees' :: \"('bs,'k,'r,'v) ctxt_p2f_t =>  ('bs,'r) store => \n  ('r,'k) node_frame => (* given a node frame *)\n  ('k,'r,'v) pr2f_t => (* and a function taking page_refs and giving subtrees (the recursive call) *)\n  (nat => ('k,'v) tree) rresult\" (* produce the equivalent of the nf, but with trees not refs *)\nwhere\n  \"nf_to_subtrees' c0 s0 nf pr2t == (\n          let n = (nf|>nf_n) in\n          let rs = (nf|>nf_rs) :: (nat => 'r page_ref) in\n          let f0 = pr2t :: ('r page_ref => ('k,'v) tree option) in\n          let prop = (! (m::nat). m <= n --> m |> rs |> f0 |> is_Some) in (* we use \\<le> because the number of subtrees to create is n (number of keys) + 1 --since we start from index 0, it is just n*)\n          case prop of\n          True => (Ok(% (m::nat). m |> rs |> f0 |> dest_Some))\n          | False => (Error)  (* Frm_I was not wellformed - prop was false *)\n  )\"\n\n(* NB this has an explicit n argument, whereas wfness gives us that we can just use page_ref_to_frame *)\nfun page_ref_to_tree :: \"\n  ('bs,'k,'r,'v) ctxt_p2f_t =>  ('bs,'r) store => 'r page_ref => tree_height => \n  ('k,'v) tree option\" \nwhere\n  \"page_ref_to_tree c0 s0 r0 0 = (\n      case page_ref_to_frame c0 s0 r0 of \n      None => (Error |> rresult_to_option) \n      | Some frm => (\n        case frm of \n        Frm_L(lf) => (Some(Tr_lf (lf|>lf_kvs)))\n        | _ => (Error |> rresult_to_option )))\"  (* attempt to access missing page *)\n  | \"page_ref_to_tree c0 s0 r0 (Suc n') = (\n      case page_ref_to_frame c0 s0 r0 of\n      None => (Error |> rresult_to_option)  (* attempt to access missing page *)\n      | Some frm => (\n        case frm of \n        Frm_I(nf) => (\n          let ks = (nf|>nf_ks) in\n          let rs :: (nat => 'r page_ref) = nf|>nf_rs in\n          let pr2t ::  ('k,'r,'v) pr2f_t = (% r. page_ref_to_tree c0 s0 r n') in\n          let subtrees :: (nat => ('k,'v) tree) rresult = nf_to_subtrees' c0 s0 nf pr2t in\n          case subtrees of\n          Error => (Error |> rresult_to_option) \n          | Ok subtrees => (arb))\n        | Frm_L(_) => (Error |> rresult_to_option)))\"  (* found Frm_L but tree_height was not 0 *)\n\n(* notice that this ideally belongs in section \"page and frame\" *)\ndefinition page_ref_to_kvs ::  \"('bs,'k,'r,'v) ctxt_p2f_t =>  ('bs,'r) store => 'r page_ref => tree_height => ('k key*'v value_t) list option\" where\n  \"page_ref_to_kvs c0 s0 r0 n0 == (\n  (page_ref_to_tree c0 s0 r0 n0)\n  |> (% x. case x of\n    None => None\n    | Some t => Some(tree_to_kvs t)))\"\n\ndefinition kvs_to_map :: \"('k key*'v value_t) list => ('k key ~=> 'v value_t)\" where\n  \"kvs_to_map kvs == (map_of kvs)\"\n\ndefinition page_ref_to_map :: \"('bs,'k,'r,'v) ctxt_p2f_t =>  ('bs,'r) store => 'r page_ref => tree_height => ('k key ~=> 'v value_t) option\" where\n  \"page_ref_to_map c0 s0 r0 n0 == (page_ref_to_kvs c0 s0 r0 n0) |> (map_option kvs_to_map)\"\n\ndefinition page_ref_key_to_v :: \"('bs,'k,'r,'v) ctxt_p2f_t => ('bs,'r) store => 'r page_ref => tree_height =>'k key => 'v value_t option\" where\n  \"page_ref_key_to_v ctxt s0 r0 n0 k0 == (\n    let m0 = page_ref_to_map ctxt s0 r0 n0 in\n    Option.bind m0 (% m. m k0))\"\n\n\nsection \"(given node_frame) key_to_ref, ctxt_k2r_t\"\n\n\n\n\n(* NB we need some properties of these functions for correctness \n\nThis abstracts from the particular find implementation. Essentially, at a non-leaf node, we need to map\na key to a page ref, from which we can continue the find. The property this function should have is\nthat, given a key, if there is a value corresponding to the key (which is unique), then the \nreturned page ref identifies the relevant subtree.\n\n*)\n(* FIXME following should be key to index *)\ndatatype ('bs,'k,'r,'v) key_to_ref = Key_to_ref \"('r,'k) node_frame => 'k key => nat (* 'r page_ref *)\" \n(* datatype ('bs,'k,'r,'v) key_to_v = Key_to_v \"('k,'v) leaf_frame => 'k key => 'v option\"  (* may be no such v *) - there is only one impl! *)\n\ndefinition dest_key_to_ref :: \"('bs,'k,'r,'v) key_to_ref => ('r,'k) node_frame => 'k key => nat (* 'r page_ref *)\" where\n  \"dest_key_to_ref k2r == (case k2r of Key_to_ref f => f)\"\n\n(*\ndefinition dest_key_to_v :: \"('bs,'k,'r,'v) key_to_v => ('k,'v) leaf_frame => 'k key => 'v value_t option\" where\n  \"dest_key_to_v k2v == (case k2v of Key_to_v f => f)\"\n*)\n\n(**********)\nrecord  ('bs,'k,'r,'v) ctxt_k2r_t =  \"('bs,'k,'r,'v) ctxt_p2f_t\" +\n  key_to_ref2 :: \"('bs,'k,'r,'v) key_to_ref\"\n(*  key_to_v :: \"('bs,'k,'r,'v) key_to_v\" *)\n\ndefinition apply_key_to_ref :: \"('bs,'k,'r,'v) key_to_ref => ('r,'k) node_frame  => 'k key => 'r page_ref\" where\n  \"apply_key_to_ref k2r nf k0 == (\n    let n = (dest_key_to_ref k2r) nf k0 in\n    (nf|>nf_rs) n)\"\n\nend\n\n", "meta": {"author": "tomjridge", "repo": "ocaml_btree.old", "sha": "94b65118793ab1178f0a165e6021ba5e96eb5ac4", "save_path": "github-repos/isabelle/tomjridge-ocaml_btree.old", "path": "github-repos/isabelle/tomjridge-ocaml_btree.old/ocaml_btree.old-94b65118793ab1178f0a165e6021ba5e96eb5ac4/src/isabelle/tr/Common.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.33070456392715747}}
{"text": "(*<*)(*:maxLineLen=68:*)\ntheory dAutomaton_causal\n  imports dAutomaton spf.SPF\nbegin\n\ndefault_sort \"chan\"\n(*>*)\n\nsubsection \\<open>Deterministic Causal Automaton\\<close> text\\<open>\\label{cauaut}\\<close>\n\ntext\\<open>Since the causality properties are an important factor for the\nrealizability of a component we introduce two automaton types that\nwork similar to our general deterministic automaton, but always have\na causal semantic. From the general causality theorems we can see\ndirectly how to comply with their assumptions. First, we define the \noutput of a transition function as a @{type sbElem}. This leads\ndirectly the weakness of an automaton.\\<close>\n\nrecord ('state::type, 'in, 'out) dAutomaton_weak  =\n  dawTransition :: \"('state \\<Rightarrow> 'in\\<^sup>\\<surd> \\<Rightarrow> ('state \\<times> 'out\\<^sup>\\<surd>))\"\n  dawInitState :: \"'state\"\n\ntext\\<open>The semantic of a weak automaton will never be strong, because\nit has no initial output. But expanding it with an initial output in\nfrom of a @{type sbElem} will directly fulfill necessary assumptions\nfor its strong semantic. Hence, we define the extension of the weak\nautomaton type as the strong automaton type.\\<close>\n\nrecord ('state::type,'in,'out)dAutomaton_strong = \n      \"('state::type,'in,'out)dAutomaton_weak\" + dasInitOut::\"'out\\<^sup>\\<surd>\"\n\ntext\\<open>Records directly provide functions for arbitrary type \nextensions, we use them for the defined type extension from weak to\nstrong automatons.\\<close>\n\ndefinition daw2das::\n\"('state::type, 'in, 'out) dAutomaton_weak \n\\<Rightarrow> 'out\\<^sup>\\<surd> \\<Rightarrow> ('state::type, 'in, 'out) dAutomaton_strong\"where\n\"daw2das daw initout\\<equiv> dAutomaton_weak.extend daw \n                      (dAutomaton_strong.fields initout)\"\n\ntext\\<open>Furthermore, the next two functions convert our causal\nautomatons to equivalent general automatons\\ref{sub:detaut}.\\<close>\n\ndefinition daw2da::\"('state::type, 'in, 'out) dAutomaton_weak \n\\<Rightarrow> ('state::type, 'in, 'out) dAutomaton\" where\n\"daw2da \\<equiv> \\<lambda>aut. \n(| daTransition =(\\<lambda>s sbe. (fst(dawTransition aut s sbe),\n                           sbe2sb (snd(dawTransition aut s sbe)))),\n   daInitState  = dawInitState(aut), \n   daInitOut    = \\<bottom> |)\"\n\ntext\\<open>The only difference in those converters is the initial output.\nIt is the empty bundle for weak automatons.\\<close>\n\ndefinition das2da::\"('state::type, 'in, 'out) dAutomaton_strong \n\\<Rightarrow> ('state::type, 'in, 'out) dAutomaton\" where\n\"das2da \\<equiv> \\<lambda>aut. \n(| daTransition =(\\<lambda>s sbe. (fst(dawTransition aut s sbe),\n                           sbe2sb (snd(dawTransition aut s sbe)))),\n   daInitState  = dawInitState(aut), \n    daInitOut   = sbe2sb(dasInitOut aut) |)\"\n\ntext\\<open>The semantic mapping of our causal automatons use the \nconverters to apply our general state semantic mapping \n@{const daStateSem} to our converted automatons.\\<close>\n\ndefinition dawStateSem::\n\"('s::type,'I::{chan,finite},'O) dAutomaton_weak \n\\<Rightarrow> ('s \\<Rightarrow> ('I\\<^sup>\\<Omega> \\<rightarrow> 'O\\<^sup>\\<Omega>))\" where\n\"dawStateSem da \\<equiv> daStateSem (daw2da da)\"\n\ntext\\<open>Since our weak Automatons have no initial output, the complete\nsemantic mapping only maps the state semantic to the corresponding\n\\gls{spf} of the initial state. Alternatively we could also use\n@{const daSem}\\ref{subsub:sem} and our converter to accomplish the\nsame.\\<close>\n\ndefinition dawSem::\n\"('s::type, 'I::{chan,finite},'O) dAutomaton_weak \n\\<Rightarrow> ('I\\<^sup>\\<Omega> \\<rightarrow> 'O\\<^sup>\\<Omega>)\" where\n\"dawSem da \\<equiv> dawStateSem da (dawInitState da)\"\n\ntext\\<open>Our strong semantic does exactly this.\\<close>\n\ndefinition dasSem::\n\"('s::type, 'I::{chan,finite},'O) dAutomaton_strong \n\\<Rightarrow> ('I\\<^sup>\\<Omega> \\<rightarrow> 'O\\<^sup>\\<Omega>)\" where\n\"dasSem da \\<equiv> daSem(das2da da)\"\n(*<*)\nsubsubsection  \\<open>Rum96 Automaton Semantic\\<close>\n\nfunction Rum_tap::\"('s::type, 'in,'out) dAutomaton_weak \n\\<Rightarrow> ('s \\<Rightarrow> ('in,'out) spfw) set\" where\n\"Rum_tap aut = \n{h | h. \\<forall>m s. \\<exists>t out . snd(dawTransition aut s m) = out \\<and>\n                       (\\<exists>h2\\<in> (Rum_tap aut). \\<forall>i .\n          Rep_spfw(h s)\\<cdot>(m \\<bullet>\\<^sup>\\<surd> i) = out \\<bullet>\\<^sup>\\<surd> (Rep_spfw(h2 t))\\<cdot>i)}\"\n  by(simp)+\n\nfun Rum_ta::\"('s::type, 'in,'out) dAutomaton_weak \n\\<Rightarrow> (('in,'out) spfw) set\"where\n\"Rum_ta aut = {g | g. \\<exists>h\\<in>(Rum_tap aut). \\<exists> s (out::'out\\<^sup>\\<surd>). \\<forall>i.\n              (Rep_spfw g)\\<cdot>i = out\\<bullet>\\<^sup>\\<surd>((Rep_spfw(h s))\\<cdot>i)}\"\n\nfun Rum_ta_strong::\n\"('s::type, 'in::{chan,finite},'out) dAutomaton_strong \n\\<Rightarrow> (('in,'out) spfs) set\"where\n\"Rum_ta_strong aut = Abs_spfs`Rum_ta (dAutomaton_weak.truncate aut)\"\n\n(*>*)\nparagraph \\<open>Causal Sem lemmas \\\\\\<close>\n\ntext\\<open>The causal automaton types work very similar to our general\nautomatons. Firstly, the semantic iteration terminates, if the input\n\\gls{sb} has not bundle element.\\<close>\n\nlemma dawstatesem_unfolding:\n\"dawStateSem automat s = sb_split\\<cdot>(\\<lambda>sbe. \\<Lambda> sb .\n           let (nextState, output) = dawTransition automat s sbe in\n           output \\<bullet>\\<^sup>\\<surd> ((dawStateSem automat) nextState\\<cdot>sb))\"\n  apply(simp add: dawStateSem_def daw2da_def)\n  apply(subst dastatesem_unfolding)\n  by(simp add: sbECons_def prod.case_eq_if)\n\nlemma dawNextOut:\n  shows \"sbe2sb (snd ((dawTransition automat) s sbe)) = \n         daNextOut (daw2da automat) s sbe\"\n  by (simp add: daNextOut_def daw2da_def)\n\nlemma dawNextState:\n  shows \"fst (dawTransition automat s sbe) = \n         daNextState (daw2da automat) s sbe\"\n  by  (simp add: daNextState_def daw2da_def)\n\ntheorem dawstatesem_bottom:\n  assumes \"\\<not>sbHdElemWell (sb::'b::{finite,chan}\\<^sup>\\<Omega>)\"\n  and \"\\<not> chDomEmpty TYPE('b)\"\n  shows \"(dawStateSem automat s)\\<cdot>sb = \\<bottom>\"\n  by  (simp_all add: assms dawStateSem_def dastatesem_bottom)\n\nlemma dawstatesem_strict:\n  assumes \"\\<not> chDomEmpty TYPE('b::{finite, chan})\"\n  shows \"(dawStateSem automat s)\\<cdot>(\\<bottom>::'b\\<^sup>\\<Omega>) = \\<bottom>\"\n  by (simp add: assms dawStateSem_def dastatesem_strict)\n\nlemma dawstatesem_step:\n  assumes \"sbHdElemWell sb\"\n  shows \"(dawStateSem da s)\\<cdot>sb = \n  snd (dawTransition da s (sbHdElem sb)) \\<bullet>\\<^sup>\\<surd> \n  dawStateSem da (fst (dawTransition da s (sbHdElem sb)))\\<cdot>(sbRt\\<cdot>sb)\"\n  by (simp_all add: dawStateSem_def sbECons_def assms \n      daNextState_def[symmetric] dawNextState[symmetric] \n      daNextOut_def[symmetric] dawNextOut dastatesem_step)\n\nlemma dawstatesem_final:\n  assumes \"sbHdElemWell sb\"\n  shows \"dawStateSem automat s\\<cdot>sb = \n(let (nextState, output) = dawTransition automat s (sbHdElem sb) in\n                  output \\<bullet>\\<^sup>\\<surd> dawStateSem automat nextState\\<cdot>(sbRt\\<cdot>sb))\"\n  by (simp add: case_prod_unfold Let_def dawStateSem_def sbECons_def\n      dawNextOut dawNextState dastatesem_final assms)\n\n\ntext\\<open>Furthermore, process every input bundle element similar to the\ngeneral automatons, but produce exactly one bundle element as \noutput for every input element.\\<close>\n\ntheorem dawstatesem_final_h2:\n  shows \"(dawStateSem automat s)\\<cdot>(sbe \\<bullet>\\<^sup>\\<surd> sb) =\n          (let (nextState, output) = dawTransition automat s sbe in\n                         output \\<bullet>\\<^sup>\\<surd> dawStateSem automat nextState\\<cdot>sb)\"\n  apply (simp add: case_prod_unfold Let_def dawStateSem_def)\n  apply (subst (2) sbECons_def)\n  by (simp add: dawNextOut dawNextState dastatesem_final_h2)\n\ntext\\<open>Thus, the length of the output is equal to the length of the\ninput. This leads directly to the weakness of any weak automaton \nsemantic.\\<close>\n\nlemma dawsem_len:\n  fixes automat::\"('s::type,'I::{chan,finite},'O)dAutomaton_weak\"\n  assumes \"\\<not>chDomEmpty TYPE('O)\"  \n  shows \"sbLen (dawStateSem automat s\\<cdot>sb) = sbLen sb\"\nproof (cases \"chDomEmpty TYPE('I)\")\n  case True\n  have \"\\<And>s sbe. sbLen (sbe2sb (snd ((dawTransition automat) s sbe))) = 1\"\n    by (simp add: assms)\n  thus ?thesis\n    by (metis (mono_tags, lifting) True dastatesem_inempty_len\n        dawNextOut dawStateSem_def min.orderI min_def sblen_empty\n        sbtypeepmpty_sbbot)\nnext\n  case False\n  have \"\\<And>s sbe. sbLen (sbe2sb (snd ((dawTransition automat) s sbe))) = 1\"\n    by (simp add: assms)\n  hence nextout_len: \"\\<And>s sbe. sbLen (daNextOut (daw2da automat) s sbe) = 1\"\n    by (simp add: dawNextOut)\n  have \"sbLen sb < \\<infinity> \\<Longrightarrow> sbLen sb = sbLen (dawStateSem automat s\\<cdot>sb)\"\n  proof-\n    assume sb_len: \"sbLen sb < \\<infinity>\"\n    thus ?thesis\n    proof (induction sb arbitrary: s rule: sb_finind)\n      case 1\n      then show ?case\n        using sb_len by blast\n    next\n      case (2 sb)\n      then show ?case\n        by (metis False assms botsbleast dawstatesem_bottom lnzero_def sbleast2sblenempty)\n    next\n      case (3 sbe sb)\n      then show ?case\n        by (metis dawstatesem_step fold_inf inf_less_eq le_less_linear\n            lnat.con_rews lnzero_def sbecons_len sbleast2sblenempty sbrt_sbecons)\n    qed\n  qed\n  thus ?thesis\n    by (metis dastatesem_weak dawStateSem_def inf_less_eq\n        le_less_linear less_irrefl nextout_len weak_well_def)\nqed\n\nlemma dawstatesem_weak:\n  shows  \"weak_well (dawStateSem automat s)\"\n  apply (simp add: dawStateSem_def)\n  apply (rule dastatesem_weak)\n  apply (simp add: daw2da_def daNextOut_def)\n  by (cases \"chDomEmpty TYPE('b)\",auto)\n\ntheorem dawsem_weak[simp]:\n  fixes automat::\"('s::type,'I::{chan,finite},'O)dAutomaton_weak\"\n  shows  \"weak_well (dawSem automat)\"\n  apply (simp add: dawSem_def)\n  by (simp add: dawstatesem_weak eta_cfun)\n  \nlemma dassem_insert:\n\"dasSem automat\\<cdot>sb = dasInitOut automat \\<bullet>\\<^sup>\\<surd> \n                     dawStateSem (dAutomaton_weak.truncate automat)\n                     (dawInitState automat)\\<cdot>sb\"\n  by (simp add:  dasSem_def dawSem_def dAutomaton_weak.defs \n      dAutomaton_strong.defs sbECons_def  dasem_insert das2da_def \n      dawStateSem_def daw2da_def daStateSem_def)\n\nlemma dasinitout_well:\"(dasInitOut\n         (dAutomaton_weak.extend daw\n           (dAutomaton_strong.fields\n             sbe))) = sbe\"\n  by(simp add: dAutomaton_weak.defs dAutomaton_strong.defs)\n\nlemma das2daw_trunc_well:\"dAutomaton_weak.truncate\n                (dAutomaton_weak.extend da\n                  (dAutomaton_strong.fields sbe)) = da\" \n  by(simp add: dAutomaton_weak.defs dAutomaton_strong.defs)\n\nlemma dassem_bottom:\n  assumes \"\\<not> chDomEmpty TYPE('b::{finite,chan})\"\n  shows \"dasSem automat\\<cdot>(\\<bottom>::'b\\<^sup>\\<Omega>) = sbe2sb (dasInitOut automat)\"\n  by (simp add: dasSem_def dasem_bottom assms das2da_def)\n\ntext\\<open>Of course the strong automatons are then immediately strong,\nsince they have an additional initial output element.\\<close>\n\nlemma dassem_len:\n  fixes automat::\"('s::type,'I::{chan,finite},'O)dAutomaton_strong\"\n  assumes \"\\<not>chDomEmpty TYPE('O)\"  \n  shows  \"sbLen (dasSem automat\\<cdot>sb) = lnsuc\\<cdot>(sbLen sb)\"\n  by (simp add: assms dassem_insert dawsem_len sbecons_len)\n\ntheorem dassem_strong:\nshows \"strong_well (dasSem automat)\"\n  apply (simp add: strong_well_def dassem_insert SB.sbecons_len)\n  by (meson dawstatesem_weak weak_well_def)\n\nparagraph \\<open>Lifted semantic \\\\\\<close>\n\ntext\\<open>We can then provide lifted semantics for strong and weak\nautomatons. The lifted versions of @{const dawSem} and \n@{const dasSem} map to well formed causal \\glspl{spf}.\\<close>\n\nlift_definition semantic_weak::\n\"('state::type,'in::{chan,finite},'out) dAutomaton_weak \n\\<Rightarrow> ('in,'out)spfw\" is \"dawSem\"\n  by %visible simp\n\nlift_definition semantic_strong::\n\"('s::type, 'in::{chan,finite}, 'out) dAutomaton_strong \n\\<Rightarrow> ('in,'out)spfs\"is \"\\<lambda>auts. Abs_spfw(dasSem auts)\"\n  by %visible (simp add: Abs_spfw_inverse dassem_strong strong2weak)\n\nsubsubsection \\<open>Causal Automaton Locales\\<close>\n\ntext\\<open>The semantic mapping allows us to verify the behaviour of\ncomponents with \\glspl{spf}. Since these components are modeled as \nautomatons, we introduce two locals for constructing and\ntransforming automatons. These locals are used in the generation\nprocess, where a MontiArc model provides the information about the\nautomatons components. Hence, they provide us with a state type,\nmessage types, the transition function directly obtained from the\nmodel and an initial state. Since the MontiArc model has no\n\\glspl{sb}, @{type sbElem}s or the @{type M}, the transition \nfunction also does not use any of these things. Instead it uses \nexactly the types from its model. But the message types do not have \nto be in type @{type M} to construct an automaton in Isabelle,\nbecause our locals @{locale sbeGen} and @{locale sbGen} are also \ninterpreted with constructors provided by the generator and we can\nutilize them to define the automaton internally and independently.\\<close>\n\nlocale sscanlGen =\n  fixes daTransition::\"'state::countable \\<Rightarrow> 'a::countable \n                        \\<Rightarrow> ('state\\<times>'b::countable)\"\n  and   daInitialState::\"'state\"\n  and fin::\"'a::countable \\<Rightarrow> 'in::{chan,finite} \\<Rightarrow> M\"  \n  and fout::\"'b::countable \\<Rightarrow> 'out::{chan,finite} \\<Rightarrow> M\"\n  assumes sbegenfin:\"sbeGen fin\"\n      and sbegenfout:\"sbeGen fout\"\nbegin\n\ntext\\<open>Using the setter, getter and MontiArc transition function we\ndefine the corresponding transition function for our automaton by\napplying the provided getter to its input @{type sbElem}, running\nthe MontiArc transition function and then using the setter to \nconvert its output back to a @{type sbElem}. The state type is not\nconverted.\\<close> \n\ndefinition daTransitionH::\"'state \\<Rightarrow> 'in\\<^sup>\\<surd> \\<Rightarrow> ('state \\<times> 'out\\<^sup>\\<surd>)\" where\n\"daTransitionH state sbe = \n     (let (s,output) = daTransition state (sbeGen.getter fin sbe) in \n                       (s, sbeGen.setter fout output))\"\n\ntext\\<open>Then the deterministic automaton is defined with the initial\nstate and @{const daTransitionH}.\\<close>\n\ndefinition \"da = \\<lparr> dawTransition = daTransitionH,\n                 dawInitState =daInitialState \\<rparr>\"\n\ntext\\<open>Often components output behaviour depends on the input. These\ncomponents have a non-empty input and output domain and so does\ntheir semantic. We can then represent their components behaviour by\nreducing its semantic with the setter and getter to a \n@{const sscanlAsnd} mapping that uses the MontiArc transition\nfunction and works completely over streams. This is an important \npart of the verification process because it is often easier to proof\nproperties directly for the streams of a bundle and not for the\nbundle itself. If the input domain is empty, the components output \nis independent from the input.\\<close>\n\ntheorem daut2sscanl: \n  assumes \"\\<not>chDomEmpty TYPE('out)\"\n  and \"\\<not>chDomEmpty TYPE('in)\"\n  shows\"sbeGen.getterSB fout \\<cdot>\n  (dawStateSem da state\\<cdot>(sbeGen.setterSB fin\\<cdot>input)) =  \n   sscanlAsnd daTransition state\\<cdot>input\"\nusing assms\nproof(induction input arbitrary: state rule: ind)\n  case 1\n  then show ?case\n    by simp\nnext\n  case 2\n  then show ?case\n    by (simp add: assms sbeGen.gettersb_realboteps \n        sbeGen.settersb_strict sbegenfin sbegenfout \n        dawstatesem_strict)\nnext\n  case (3 a s)\n  then show ?case                                                                      \n    by (simp add: sbeGen.get_set dawstatesem_final_h2 sbegenfin \n        sbegenfout sbeGen.settersb_unfold prod.case_eq_if \n        sbeGen.gettersb_unfold da_def daTransitionH_def)\nqed\n\nlemma daut2sscanl2: \n  shows\"(dawStateSem da state\\<cdot>input) =  \n   sbeGen.setterSB fout\\<cdot>(sscanlAsnd daTransition state\\<cdot>(sbeGen.getterSB fin\\<cdot>input))\"\n  apply(induction input arbitrary: state)\n    apply simp_all\n  apply(cases \"chDomEmpty TYPE('in)\")\n    apply (simp add: sbegenfin sbegenfout sbeGen.gettersb_empty_inf)\n  defer\n    apply (simp add: sbegenfin sbegenfout sbeGen.gettersb_boteps)\n    apply (simp add: dawstatesem_bottom sbeGen.settersb_strict sbegenfout)\n    apply (simp add: sbegenfin sbegenfout sbeGen.gettersb_unfold dawstatesem_final_h2)(* TODO: anstatt \"case\" ein lemma mit \"fst\"/\"snd\" anlegen *)\n  apply (simp add: case_prod_beta daTransitionH_def da_def sbeGen.settersb_unfold sbegenfout) \n  oops\n\nlemma emptychan_eq[simp]:\n  \"chDomEmpty TYPE('out) \\<Longrightarrow> (sb1::'out\\<^sup>\\<Omega>) = sb2\"\n  by (metis (full_types)sbtypeepmpty_sbbot)\n\nlemma daut2sscanl:\n\"(dawStateSem da state\\<cdot>input) = sbeGen.setterSB fout\\<cdot>\n(sscanlAsnd daTransition state\\<cdot>(sbeGen.getterSB fin\\<cdot>input))\"\n  apply(cases \"chDomEmpty(TYPE('out))\",simp_all)\n  apply(insert daut2sscanl[of state \"sbeGen.getterSB fin\\<cdot>input\"])\n  oops\n\nfun %invisible stateSemList::\"'state \\<Rightarrow> 'a list \\<Rightarrow> 'b list\" where\n\"stateSemList _ [] = []\" |\n\"stateSemList state (l#ls) = snd(daTransition state l) # \n                      stateSemList (fst (daTransition state l)) ls\"\n\nlemma \"dawStateSem da state\\<cdot>(sbeGen.setterList fin input) = \n        sbeGen.setterList fout (stateSemList state input)\"\n  oops\n(* TODO: initiale ausgabe ... \"sscanlA\" kann nichts partielles \nausgben. dh alles oder nichts. Das kann man durch den typ abfangen!\n    * weak = \"chIstEmpty\" als assumption (oder besser, dafür eine \nklasse anlegen)\n    * strong = gleicher typ wie ausgabe\n*)\n\nend\n\ntext\\<open>Some automatons contains a self looping state that will never \nbe left again. If such an automaton reaches a self looping state on \nits run, its behaviour can be reduced to an easier transition\nfunction. For such cases we provide a sub local of \n@{locale sscanlGen} which provides an additional behaviour \ntranslation.\\<close>\n\nlocale smapGen =\n  fixes daTransition::\"'state::countable \\<Rightarrow> 'a::countable \\<Rightarrow> \n                      ('state\\<times>'b::countable)\"\n  and   daInitialState::\"'state\"\n  and fin::\"'a::countable \\<Rightarrow> 'in::{chan,finite} \\<Rightarrow> M\"  \n  and fout::\"'b::countable \\<Rightarrow> 'out::{chan,finite} \\<Rightarrow> M\"\n  and loopState::\"'state\"\n  assumes scscanlgenf:\"sscanlGen fin fout\"\n  and singlestate:\"\\<And>sbe. fst(daTransition loopState sbe)=loopState\"\nbegin\n\ntext\\<open>The looping state is used for defining a mapping \\<open> 'a \\<Rightarrow> 'b\\<close>\nfrom the MontiArc transition function.\\<close>\n\nabbreviation \"smapTransition \\<equiv> (\\<lambda>e. snd(daTransition loopState e))\" \n\ntext\\<open>Using this, we can reduce the semantic with setter and getter\nto a @{const smap} mapping over streams from the moment its looping \nstate is reached.\\<close>\n\ntheorem daut2smap:\n  assumes \"\\<not>chDomEmpty TYPE('out)\"\n  and \"\\<not>chDomEmpty TYPE('in)\"\n  shows\"sbeGen.getterSB fout\\<cdot>(dawStateSem \n        (sscanlGen.da daTransition daInitialState fin fout) \n        loopState\\<cdot>(sbeGen.setterSB fin \\<cdot>input)) = \n        smap smapTransition\\<cdot>input\"\n  apply(subst sscanlGen.daut2sscanl)\n  using scscanlgenf sscanlGen.sbegenfin assms  apply auto[2]\n  by (simp_all add: assms singlestate sscanl2smap)\n\ntext\\<open>In case of a previous reduction to the @{const sscanlAsnd}\nmapping an additional theorem is provided, that allows the further\nreduction to @{const smap} if a looping state is reached at any\npoint.\\<close>\n\ntheorem step2smap:\n  assumes \"\\<not>chDomEmpty TYPE('out)\"\n  and     \"\\<not>chDomEmpty TYPE('in)\"\n  shows   \"sscanlAsnd daTransition loopState\\<cdot>input = \n           smap smapTransition\\<cdot>input\"\n  using scscanlgenf sscanlGen.sbegenfin assms apply auto\n  by (simp_all add: assms singlestate sscanl2smap)\n\n\nend\n\ntext\\<open>A @{locale smapGen} interpretation should also automatically \nprovide all properties and definitions from the @{locale sscanlGen}\nlocale. This is done be instantiating @{locale smapGen} as a\nsub locale of @{locale sscanlGen}.\\<close>\n\nsublocale smapGen \\<subseteq> sscanlGen\n  by %visible (simp add: scscanlgenf)\n\n\n(*<*)\nend\n(*>*)", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/automatons/dAutomaton_causal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5544704649604274, "lm_q1q2_score": 0.33070456392715747}}
{"text": "(*  Title:    HOL/Prolog/Test.thy\n    Author:   David von Oheimb (based on a lecture on Lambda Prolog by Nadathur)\n*)\n\nsection \\<open>Basic examples\\<close>\n\ntheory Test\nimports HOHH\nbegin\n\ntypedecl nat\n\ntypedecl 'a list\n\nconsts\n  Nil   :: \"'a list\"                                  (\"[]\")\n  Cons  :: \"'a => 'a list => 'a list\"                 (infixr \"#\"  65)\n\nsyntax\n  (* list Enumeration *)\n  \"_list\"     :: \"args => 'a list\"                          (\"[(_)]\")\n\ntranslations\n  \"[x, xs]\"     == \"x#[xs]\"\n  \"[x]\"         == \"x#[]\"\n\ntypedecl person\n\naxiomatization\n  append  :: \"['a list, 'a list, 'a list]            => bool\" and\n  reverse :: \"['a list, 'a list]                     => bool\" and\n\n  mappred :: \"[('a => 'b => bool), 'a list, 'b list] => bool\" and\n  mapfun  :: \"[('a => 'b), 'a list, 'b list]         => bool\" and\n\n  bob     :: person and\n  sue     :: person and\n  ned     :: person and\n\n  nat23   :: nat          (\"23\") and\n  nat24   :: nat          (\"24\") and\n  nat25   :: nat          (\"25\") and\n\n  age     :: \"[person, nat]                          => bool\" and\n\n  eq      :: \"['a, 'a]                               => bool\" and\n\n  empty   :: \"['b]                                   => bool\" and\n  add     :: \"['a, 'b, 'b]                           => bool\" and\n  remove  :: \"['a, 'b, 'b]                           => bool\" and\n  bag_appl:: \"['a, 'a, 'a, 'a]                       => bool\"\nwhere\n        append:  \"\\<And>x xs ys zs. append  []    xs  xs    ..\n                  append (x#xs) ys (x#zs) :- append xs ys zs\" and\n        reverse: \"\\<And>L1 L2. reverse L1 L2 :- (\\<forall>rev_aux.\n                  (\\<forall>L.          rev_aux  []    L  L )..\n                  (\\<forall>X L1 L2 L3. rev_aux (X#L1) L2 L3 :- rev_aux L1 L2 (X#L3))\n                  => rev_aux L1 L2 [])\" and\n\n        mappred: \"\\<And>x xs y ys P. mappred P  []     []    ..\n                  mappred P (x#xs) (y#ys) :- P x y  &  mappred P xs ys\" and\n        mapfun:  \"\\<And>x xs ys f. mapfun f  []     []      ..\n                  mapfun f (x#xs) (f x#ys) :- mapfun f xs ys\" and\n\n        age:     \"age bob 24 ..\n                  age sue 23 ..\n                  age ned 23\" and\n\n        eq:      \"\\<And>x. eq x x\" and\n\n(* actual definitions of empty and add is hidden -> yields abstract data type *)\n\n        bag_appl: \"\\<And>A B X Y. bag_appl A B X Y:- (\\<exists>S1 S2 S3 S4 S5.\n                                empty    S1    &\n                                add A    S1 S2 &\n                                add B    S2 S3 &\n                                remove X S3 S4 &\n                                remove Y S4 S5 &\n                                empty    S5)\"\n\nlemmas prog_Test = append reverse mappred mapfun age eq bag_appl\n\nschematic_goal \"append ?x ?y [a,b,c,d]\"\n  apply (prolog prog_Test)\n  back\n  back\n  back\n  back\n  done\n\nschematic_goal \"append [a,b] y ?L\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"\\<forall>y. append [a,b] y (?L y)\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"reverse [] ?L\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"reverse [23] ?L\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"reverse [23,24,?x] ?L\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"reverse ?L [23,24,?x]\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"mappred age ?x [23,24]\"\n  apply (prolog prog_Test)\n  back\n  done\n\nschematic_goal \"mappred (\\<lambda>x y. \\<exists>z. age z y) ?x [23,24]\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"mappred ?P [bob,sue] [24,23]\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"mapfun f [bob,bob,sue] [?x,?y,?z]\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"mapfun (%x. h x 25) [bob,sue] ?L\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"mapfun ?F [24,25] [h bob 24,h bob 25]\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"mapfun ?F [24] [h 24 24]\"\n  apply (prolog prog_Test)\n  back\n  back\n  back\n  done\n\nlemma \"True\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"age ?x 24 & age ?y 23\"\n  apply (prolog prog_Test)\n  back\n  done\n\nschematic_goal \"age ?x 24 | age ?x 23\"\n  apply (prolog prog_Test)\n  back\n  back\n  done\n\nlemma \"\\<exists>x y. age x y\"\n  apply (prolog prog_Test)\n  done\n\nlemma \"\\<forall>x y. append [] x x\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"age sue 24 .. age bob 23 => age ?x ?y\"\n  apply (prolog prog_Test)\n  back\n  back\n  back\n  back\n  done\n\n(*set trace_DEPTH_FIRST;*)\nlemma \"age bob 25 :- age bob 24 => age bob 25\"\n  apply (prolog prog_Test)\n  done\n(*reset trace_DEPTH_FIRST;*)\n\nschematic_goal \"(\\<forall>x. age x 25 :- age x 23) => age ?x 25 & age ?y 25\"\n  apply (prolog prog_Test)\n  back\n  back\n  back\n  done\n\nlemma \"\\<forall>x. \\<exists>y. eq x y\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"\\<exists>P. P \\<and> eq P ?x\"\n  apply (prolog prog_Test)\n(*\n  back\n  back\n  back\n  back\n  back\n  back\n  back\n  back\n*)\n  done\n\nlemma \"\\<exists>P. eq P (True & True) \\<and> P\"\n  apply (prolog prog_Test)\n  done\n\nlemma \"\\<exists>P. eq P (\\<or>) \\<and> P k True\"\n  apply (prolog prog_Test)\n  done\n\nlemma \"\\<exists>P. eq P (Q => True) \\<and> P\"\n  apply (prolog prog_Test)\n  done\n\n(* P flexible: *)\nlemma \"(\\<forall>P k l. P k l :- eq P Q) => Q a b\"\n  apply (prolog prog_Test)\n  done\n(*\nloops:\nlemma \"(!P k l. P k l :- eq P (%x y. x | y)) => a | b\"\n*)\n\n(* implication and disjunction in atom: *)\nlemma \"\\<exists>Q. (\\<forall>p q. R(q :- p) => R(Q p q)) \\<and> Q (t | s) (s | t)\"\n  by fast\n\n(* disjunction in atom: *)\nlemma \"(\\<forall>P. g P :- (P => b \\<or> a)) => g(a \\<or> b)\"\n  apply (tactic \"step_tac (put_claset HOL_cs \\<^context>) 1\")\n  apply (tactic \"step_tac (put_claset HOL_cs \\<^context>) 1\")\n  apply (tactic \"step_tac (put_claset HOL_cs \\<^context>) 1\")\n   prefer 2\n   apply fast\n  apply fast\n  done\n\n(*\nhangs:\nlemma \"(!P. g P :- (P => b | a)) => g(a | b)\"\n  by fast\n*)\n\nschematic_goal \"\\<forall>Emp Stk.(\n                       empty    (Emp::'b) .. \n         (\\<forall>(X::nat) S. add    X (S::'b)         (Stk X S)) .. \n         (\\<forall>(X::nat) S. remove X ((Stk X S)::'b) S))\n => bag_appl 23 24 ?X ?Y\"\n  oops\n\nschematic_goal \"\\<forall>Qu. ( \n          (\\<forall>L.            empty    (Qu L L)) .. \n          (\\<forall>(X::nat) L K. add    X (Qu L (X#K)) (Qu L K)) ..\n          (\\<forall>(X::nat) L K. remove X (Qu (X#L) K) (Qu L K)))\n => bag_appl 23 24 ?X ?Y\"\n  oops\n\nlemma \"D \\<and> (\\<forall>y. E) :- (\\<forall>x. True \\<and> True) :- True => D\"\n  apply (prolog prog_Test)\n  done\n\nschematic_goal \"P x .. P y => P ?X\"\n  apply (prolog prog_Test)\n  back\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Prolog/Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5964331462646254, "lm_q1q2_score": 0.33070456392715736}}
{"text": "theory utp_lens_demo\n  imports \"../theories/utp_designs\"\nbegin\n\nalphabet person =\n  surname :: string\n  forename :: string\n  dateOfBirth :: \"nat * nat * nat\"\n\nalphabet myst =\n  x :: nat\n  y :: person\n  z :: \"int list\"\n\nlemma \"(\\<exists> x \\<bullet> &x >\\<^sub>u 1) = true\"\n  by (rel_auto)\n\nlemma \"(\\<forall> x \\<bullet> &x >\\<^sub>u 1) = true\"\n  apply (rel_simp)\n  nitpick\noops\n\nlemma \"x := 1 ;; x := (&x + 1) = x := 2\"\n  by (rel_auto)\n\nlemma \"x := 1 ;; x := (&x + 2) = x := 2\"\n  apply (rel_auto)\n  oops\n\nlemma \"x := (&x - 5) wp (&x >\\<^sub>u 10) = (&x >\\<^sub>u 15)\"\n  apply (simp add: wp)\n  apply (subst_tac)\n  apply (pred_auto)\ndone\n\nlemma \"(true \\<turnstile>\\<^sub>n x := 1) ;; ((&x >\\<^sub>u 1) \\<turnstile>\\<^sub>n y := &y) = \\<bottom>\\<^sub>D\"\n  apply (simp add: ndesign_composition_wp)\n  apply (simp add: wp)\n  apply (subst_tac)\n  apply (pred_auto)\ndone\n\nterm \"x +\\<^sub>L y\"\n\nlemma \"x \\<bowtie> y\"\n  by (simp)\n\nlemma \"x +\\<^sub>L y \\<bowtie> z\"\n  by (simp)\n\nterm \"surname ;\\<^sub>L y\"\n\nterm \"y:surname := \\<guillemotleft>''Foster''\\<guillemotright> ;; y:dateOfBirth := (02, 02, &x)\\<^sub>u\"\n\nlemma \"(surname ;\\<^sub>L y) \\<subseteq>\\<^sub>L y\"\n  by (simp)\n\nlemma \"x +\\<^sub>L y +\\<^sub>L z \\<approx>\\<^sub>L 1\\<^sub>L\"\n  oops\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/tutorial/utp_lens_demo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737473266735, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.33062512925535115}}
{"text": "theory RedsImprovesArityAnalysis\nimports ArityAnalysisFixProps Launchbury\nbegin\n\nfixrec inc_bot :: \"Arity\\<^sub>\\<bottom> \\<rightarrow> Arity\\<^sub>\\<bottom>\" (\"inc\\<^sub>\\<bottom>\")\n  where \"inc\\<^sub>\\<bottom>\\<cdot>(up\\<cdot>n)=up\\<cdot>(inc\\<cdot>n)\"\n\n\nlocale ArityAnalysisSafeAfix = ArityAnalysisSafe + \n  assumes Aexp_Let: \"Afix as\\<cdot>(Aexp e\\<cdot>n) f|` (- domA as) \\<sqsubseteq> Aexp (Let as e)\\<cdot>n\"\n\nbegin\nlemma fup_Aexp_Let: \"Afix as\\<cdot>(fup\\<cdot>(Aexp e)\\<cdot>n) f|` (- domA as) \\<sqsubseteq> fup\\<cdot>(Aexp (Let as e))\\<cdot>n\"\n  by (cases n) (simp_all add: Aexp_Let)\n\nlemma  reds_improves_arity':\n       \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : v \\<Longrightarrow>\n        edom ae \\<subseteq> set L \\<Longrightarrow> \n        Afix \\<Delta> \\<cdot> (fup\\<cdot>(Aexp v)\\<cdot>n \\<squnion> ae) f|` (- (domA \\<Delta> - domA \\<Gamma>)) \\<sqsubseteq> Afix \\<Gamma> \\<cdot> (fup\\<cdot>(Aexp e)\\<cdot>n \\<squnion> ae) f|` (- (domA \\<Delta> - domA \\<Gamma>))\"\nproof(induct arbitrary: ae n rule: reds.induct)\ncase Lambda\n  show ?case by simp\nnext\ncase (Variable \\<Gamma> x e L \\<Delta> z ae n)\n  have reorder: \"map_of ((x, e) # delete x \\<Gamma>) = map_of \\<Gamma>\" by (rule map_of_delete_insert[OF Variable.hyps(1)])\n\n  from `edom ae \\<subseteq> set L`\n  have prem: \"edom ae \\<subseteq> set (x#L)\" by auto\n\n  from `map_of \\<Gamma> x = Some e` have [simp]: \"x \\<in> domA \\<Gamma>\" by (metis domA_from_set map_of_is_SomeD)\n\n  have \"x \\<notin> domA \\<Delta>\" by (rule reds_avoids_live[OF Variable(2), where x = x]) simp_all\n  hence [simp]:\"delete x \\<Delta> = \\<Delta>\" by simp\n\n  note IH =  Variable(3)\n  let \"?S\" = \"(- (domA ((x, z) # \\<Delta>) - domA \\<Gamma>))\"\n\n  have \"Afix ((x, z) # \\<Delta>) \\<cdot> (fup\\<cdot>(Aexp z)\\<cdot>n \\<squnion> ae)  f|` ?S = (\\<mu> ae'. fup\\<cdot>(Aexp z)\\<cdot>(ae' x) \\<squnion> ABinds \\<Delta> \\<cdot> ae' \\<squnion> fup\\<cdot>(Aexp z)\\<cdot>n \\<squnion> ae) f|` ?S\"\n    unfolding Afix_eq by simp\n  also have \"\\<dots> \\<sqsubseteq> (\\<mu> ae'. ABinds \\<Delta> \\<cdot> ae' \\<squnion> (fup\\<cdot>(Aexp z)\\<cdot>(n \\<squnion> ae' x) \\<squnion> ae)) f|` ?S\"\n    by (auto intro!: env_restr_mono monofun_cfun_arg cfun_belowI join_mono[OF below_refl] join_mono[OF _ below_refl] cfun_join_below simp del: join_assoc)\n  also have \"\\<dots> = (\\<mu> ae'. Afix \\<Delta> \\<cdot> ae' \\<squnion> (fup\\<cdot>(Aexp z)\\<cdot>(n \\<squnion> ae' x) \\<squnion> ae))  f|` ?S\"\n    apply (rule arg_cong[where f = \"\\<lambda> x. x f|` ?S\"] )\n    apply (rule fix_eq_fix, simp_all)\n\n    apply (subst fix_eq) back back apply simp_all\n    apply (intro join_below)\n    apply (simp add: below_trans[OF _ join_above2]  below_trans[OF _ join_above1])\n    apply (simp add: below_trans[OF _ join_above2]  below_trans[OF _ join_above1] monofun_cfun_fun[OF Abinds_below_Afix])\n    apply (simp add: below_trans[OF _ join_above2]  below_trans[OF _ join_above1])\n\n    apply (intro join_below)\n    apply (subst fix_eq, simp)\n    apply (subst Afix_eq)\n    apply (rule fix_least_below, simp)\n    \n    apply (subst fix_eq) back apply simp\n    apply (simp add: below_trans[OF _ join_above2]  below_trans[OF _ join_above1])\n    apply (subst fix_eq) back apply simp\n    apply (simp add: below_trans[OF _ join_above2]  below_trans[OF _ join_above1])\n    done\n  also have \"\\<dots> = (\\<mu> ae'. Afix \\<Delta> \\<cdot> (fup\\<cdot>(Aexp z)\\<cdot>(n \\<squnion> ae' x) \\<squnion> ae)) f|` ?S\"\n    apply (rule arg_cong[where f = \"\\<lambda> x. x f|` ?S\"] )\n    apply (rule fix_eq_fix, simp_all)\n    \n    apply (subst fix_eq) back back apply simp_all\n    apply (intro join_below)\n    apply (simp add: below_trans[OF _ join_above2]  below_trans[OF _ join_above1]  below_trans[OF _ Afix_above_arg])\n    \n    apply (subst Afix_eq)\n    apply (rule fix_least_below, simp)\n    apply (rule join_below)\n    apply (subst fix_eq, simp)\n    \n    apply (simp add: below_trans[OF _ join_above2]  below_trans[OF _ join_above1] monofun_cfun_fun[OF Abinds_below_Afix])\n\n    apply (subst Afix_eq) back apply simp\n    apply (subst fix_eq, simp) back\n    apply (simp add: below_trans[OF _ join_above2]  below_trans[OF _ join_above1])\n\n    apply (subst fix_eq, simp) back \n    apply (rule below_trans[OF _ join_above2])\n    apply (rule below_trans[OF _ join_above1])\n    apply (rule monofun_cfun_arg)\n    apply (intro join_below)\n    apply (subst fix_eq, simp)\n    apply (subst fix_eq, simp) back\n    apply (rule below_trans[OF _ join_above2])\n    apply (rule below_trans[OF _ join_above2])\n    apply rule\n    done\n    \n  also have \"\\<dots> \\<sqsubseteq> (\\<mu> ae'. Afix (delete x \\<Gamma>) \\<cdot> (fup\\<cdot>(Aexp e)\\<cdot>(n \\<squnion> ae' x) \\<squnion> ae)) f|` ?S\"\n  proof (induction rule: parallel_fix_ind[where P =\"\\<lambda> x y. x f|` ?S \\<sqsubseteq> y f|` ?S\"])\n  case (goal3 aeL aeR)\n    have \"- (domA ((x, z) # \\<Delta>) - domA \\<Gamma>) \\<subseteq> - (domA \\<Delta> - domA (delete x \\<Gamma>))\"\n      using `x \\<notin> domA \\<Delta>` by auto\n    moreover\n    note IH[OF prem]\n    ultimately have \"(Afix \\<Delta>\\<cdot>(fup\\<cdot>(Aexp z)\\<cdot>(n \\<squnion> aeL x) \\<squnion> ae)) f|` ?S \\<sqsubseteq> (Afix (delete x \\<Gamma>)\\<cdot>(fup\\<cdot>(Aexp e)\\<cdot>(n \\<squnion> aeL x) \\<squnion> ae)) f|` ?S\"\n      by (rule env_restr_below_subset)\n    also from goal3 have \"aeL x \\<sqsubseteq>  aeR x\" by (rule env_restr_belowD) simp\n    finally have \"Afix \\<Delta>\\<cdot>(fup\\<cdot>(Aexp z)\\<cdot>(n \\<squnion> aeL x) \\<squnion> ae) f|` ?S \\<sqsubseteq> Afix (delete x \\<Gamma>)\\<cdot>(fup\\<cdot>(Aexp e)\\<cdot>(n \\<squnion> aeR x) \\<squnion> ae) f|` ?S\" by this simp_all\n    thus ?case by simp\n  qed simp_all\n  also have \"\\<dots> \\<sqsubseteq> (\\<mu> ae'. Afix ((x,e)#delete x \\<Gamma>) \\<cdot> (esing x \\<cdot> (n \\<squnion> ae' x) \\<squnion> ae))  f|` ?S\"\n    apply (rule env_restr_mono)\n    apply (rule monofun_cfun_arg)\n    apply (rule cfun_belowI, simp)\n    apply (rule Afix_e_to_heap[simplified])\n    done\n  also have \"\\<dots> = Afix ((x,e)#delete x \\<Gamma>) \\<cdot> (esing x\\<cdot>n \\<squnion> ae)  f|` ?S\" by (rule arg_cong[OF Afix_repeat_singleton])\n  also have \"\\<dots> \\<sqsubseteq> Afix ((x,e)#delete x \\<Gamma>) \\<cdot> (fup\\<cdot>(Aexp (Var x))\\<cdot>n \\<squnion> ae)  f|` ?S\" by (intro fup_Aexp_Var monofun_cfun env_restr_mono join_mono below_refl)\n  also have \"\\<dots> = Afix \\<Gamma> \\<cdot> (fup\\<cdot>(Aexp (Var x))\\<cdot>n \\<squnion> ae) f|` ?S\" by (rule arg_cong[OF Afix_reorder[OF reorder]])\n  finally show \"Afix ((x, z) # \\<Delta>)\\<cdot>(fup\\<cdot>(Aexp z)\\<cdot>n \\<squnion> ae) f|` ?S \\<sqsubseteq> Afix \\<Gamma>\\<cdot>(fup\\<cdot>(Aexp (Var x))\\<cdot>n \\<squnion> ae) f|` ?S\"\n    by this simp_all\nnext\ncase (Application y \\<Gamma> e x L \\<Delta> \\<Theta> z e' ae n)\n  note prem1 =  `edom ae \\<subseteq> set L`\n  hence prem2: \"edom ae \\<subseteq> set (x#L)\" by auto\n  hence prem3: \"edom (esing x\\<cdot>(up\\<cdot>0) \\<squnion> ae) \\<subseteq> set (x#L)\" by auto\n\n  have subset1: \" (- (domA \\<Theta> - domA \\<Gamma>)) \\<subseteq> (- (domA \\<Theta> - domA \\<Delta>))\"\n    and subset2: \"(- (domA \\<Theta> - domA \\<Gamma>)) \\<subseteq> (- (domA \\<Delta> - domA \\<Gamma>))\"\n    using reds_doesnt_forget[OF Application(2)]  reds_doesnt_forget[OF Application(4)] by auto\n  let \"?S\" = \" (- (domA \\<Theta> - domA \\<Gamma>))\"\n\n  show \"Afix \\<Theta>\\<cdot>(fup\\<cdot>(Aexp z)\\<cdot>n \\<squnion> ae) f|` ?S \\<sqsubseteq> Afix \\<Gamma>\\<cdot>(fup\\<cdot>(Aexp (App e x))\\<cdot>n \\<squnion> ae)  f|` ?S\"\n  proof(cases n)\n    case bottom\n    from env_restr_below_trans[OF env_restr_below_subset[OF subset1 Application(5)[OF prem1, where n = \"\\<bottom>\"], simplified]\n                                  env_restr_below_subset[OF subset2 Application(3)[OF prem2, where n = \"\\<bottom>\"], simplified]]\n    show ?thesis using bottom by simp\n  next\n    case (up n')\n    note IH1 = env_restr_below_subset[OF subset2 Application(3)[OF prem3, where n = \"inc\\<^sub>\\<bottom>\\<cdot>n\"], unfolded up inc_bot.simps fup2] \n    note IH2 = env_restr_below_subset[OF subset1 Application(5)[OF prem1, where n = n], unfolded up fup2]\n    have \"Afix \\<Theta>\\<cdot>(Aexp z\\<cdot>n' \\<squnion> ae)  f|` ?S  \\<sqsubseteq> Afix \\<Delta>\\<cdot>(Aexp e'[y::=x]\\<cdot>n' \\<squnion> ae)  f|` ?S\" by (rule IH2)\n    also have \"\\<dots> \\<sqsubseteq> Afix \\<Delta>\\<cdot>(env_delete y (Aexp e'\\<cdot>n') \\<squnion>  esing x \\<cdot> (up\\<cdot>0) \\<squnion> ae)  f|` ?S\"\n      by (intro monofun_cfun_arg monofun_cfun_fun env_restr_mono Aexp_subst join_mono below_refl)  \n    also have \"\\<dots> = Afix \\<Delta>\\<cdot>(env_delete y (Aexp e'\\<cdot>(pred\\<cdot>(inc\\<cdot>n'))) \\<squnion> (esing x \\<cdot> (up\\<cdot>0) \\<squnion> ae))  f|` ?S\" by simp\n    also have \"\\<dots> \\<sqsubseteq> Afix \\<Delta>\\<cdot>(Aexp (Lam [y]. e')\\<cdot>(inc\\<cdot>n') \\<squnion> (esing x \\<cdot> (up\\<cdot>0) \\<squnion> ae))  f|` ?S\"\n      by (intro monofun_cfun_arg monofun_cfun_fun env_restr_mono Aexp_Lam join_mono below_refl)  \n    also have \"\\<dots> \\<sqsubseteq> Afix \\<Gamma>\\<cdot>(Aexp e\\<cdot>(inc\\<cdot>n') \\<squnion> (esing x\\<cdot>(up\\<cdot>0) \\<squnion> ae)) f|` ?S\" by (rule IH1)\n    also have \"\\<dots> = Afix \\<Gamma>\\<cdot>(Aexp e\\<cdot>(inc\\<cdot>n') \\<squnion> esing x\\<cdot>(up\\<cdot>0) \\<squnion> ae)  f|` ?S\" by simp\n    also have \"\\<dots> \\<sqsubseteq> Afix \\<Gamma>\\<cdot>(Aexp (App e x)\\<cdot>n' \\<squnion> ae)  f|` ?S\" \n      by (intro monofun_cfun_arg monofun_cfun_fun env_restr_mono Aexp_App join_mono below_refl)  \n    finally\n    show ?thesis unfolding up by simp\n  qed\nnext\ncase (Let as \\<Gamma> L e \\<Delta> z ae n)\n  have *: \"atom ` domA as \\<sharp>* \\<Gamma>\" using Let(1) by (metis fresh_star_Pair)\n\n  let ?S = \"(- (domA \\<Delta> - domA \\<Gamma>))\"\n  have subset: \"?S \\<subseteq>  (- (domA \\<Delta> - domA (as @ \\<Gamma>)))\" by auto\n\n  note prem = `edom ae \\<subseteq> set L`\n  note IH = env_restr_below_subset[OF subset Let(3)[OF prem]]\n\n  from `atom \\` domA as \\<sharp>* (\\<Gamma>, L)`\n  have \"atom ` domA as \\<sharp>* set L\" by (auto simp add: fresh_star_Pair set_bn_to_atom_domA fresh_star_set)\n  hence \"domA as \\<inter> set L = {}\" by (metis Int_commute disjoint_iff_not_equal fresh_list_elem fresh_set fresh_star_def image_eqI not_self_fresh)\n  with prem\n  have **: \"ae ` domA as \\<subseteq> {\\<bottom>}\" by (auto simp add: edom_def)\n\n  have [simp]: \"ae f|` (-domA as) = ae\" apply (rule env_restr_useless) using prem `domA as \\<inter> set L = {}` by auto\n\n  from `atom \\` domA as \\<sharp>* \\<Gamma>` have \"domA as \\<inter> domA \\<Gamma> = {}\" by (metis fresh_distinct)\n  moreover from reds_doesnt_forget[OF Let(2)] have \"domA as \\<subseteq> domA \\<Delta>\" by auto\n  ultimately have ***: \"((- domA \\<Delta> \\<union> domA \\<Gamma>) \\<inter> - domA as) = (- domA \\<Delta> \\<union> domA \\<Gamma>)\" by auto\n\n  have \"Afix \\<Delta>\\<cdot>(fup\\<cdot>(Aexp z)\\<cdot>n \\<squnion> ae)  f|` ?S \\<sqsubseteq> Afix (as @ \\<Gamma>)\\<cdot>(fup\\<cdot>(Aexp e)\\<cdot>n \\<squnion> ae)  f|` ?S\" by (rule IH)\n  also have \"\\<dots> = Afix \\<Gamma>\\<cdot>(Afix as\\<cdot>(fup\\<cdot>(Aexp e)\\<cdot>n \\<squnion> ae))  f|` ?S\" by (rule arg_cong[OF Afix_append_fresh[OF *]])\n  also have \"\\<dots> = Afix \\<Gamma>\\<cdot>(Afix as\\<cdot>(fup\\<cdot>(Aexp e)\\<cdot>n) \\<squnion> ae)  f|` ?S\" by (rule arg_cong[OF Afix_join_fresh[OF **]])\n  also have \"\\<dots> = Afix \\<Gamma>\\<cdot>(Afix as\\<cdot>(fup\\<cdot>(Aexp e)\\<cdot>n) \\<squnion> ae) f|` (- (domA as)) f|` ?S\" by (simp add: ***)\n  also have \"\\<dots> = Afix \\<Gamma>\\<cdot>((Afix as\\<cdot>(fup\\<cdot>(Aexp e)\\<cdot>n) \\<squnion> ae) f|` (- (domA as))) f|` (- (domA as)) f|` ?S\" by (rule arg_cong[OF Afix_restr_fresh[OF *]])\n  also have \"\\<dots> = Afix \\<Gamma>\\<cdot>((Afix as\\<cdot>(fup\\<cdot>(Aexp e)\\<cdot>n) \\<squnion> ae) f|` (- (domA as))) f|` ?S\" by (simp add: ***)\n  also have \"\\<dots> = Afix \\<Gamma>\\<cdot>((Afix as\\<cdot>(fup\\<cdot>(Aexp e)\\<cdot>n)  f|` (- (domA as))) \\<squnion> ae) f|` ?S\" by (simp add: env_restr_join)\n  also have \"\\<dots> \\<sqsubseteq> Afix \\<Gamma>\\<cdot>(fup\\<cdot>(Aexp (Let as e))\\<cdot>n \\<squnion> ae) f|` ?S\" by (intro monofun_cfun_arg join_mono env_restr_mono below_refl fup_Aexp_Let)\n  finally\n  show \"Afix \\<Delta>\\<cdot>(fup\\<cdot>(Aexp z)\\<cdot>n \\<squnion> ae) f|` ?S \\<sqsubseteq> Afix \\<Gamma>\\<cdot>(fup\\<cdot>(Aexp (Let as e))\\<cdot>n \\<squnion> ae) f|` ?S\" by this simp_all\nqed\n\ncorollary  reds_improves_arity'':\n       \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : v \\<Longrightarrow>\n        edom ae \\<subseteq> set L \\<Longrightarrow> \n        Afix \\<Delta> \\<cdot> (Aexp v \\<cdot> n \\<squnion> ae) f|` (- (domA \\<Delta> - domA \\<Gamma>)) \\<sqsubseteq> Afix \\<Gamma> \\<cdot> (Aexp e \\<cdot> n \\<squnion> ae) f|` (- (domA \\<Delta> - domA \\<Gamma>))\"\nusing reds_improves_arity'[OF assms, where n = \"up\\<cdot>n\", simplified] by simp\n\ncorollary  reds_improves_arity:\n  assumes \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : v\"\n  shows \"Afix \\<Delta> \\<cdot> (fup\\<cdot>(Aexp v) \\<cdot> n) f|` (- (domA \\<Delta> - domA \\<Gamma>)) \\<sqsubseteq> Afix \\<Gamma> \\<cdot> (fup\\<cdot>(Aexp e) \\<cdot> n) f|` (- (domA \\<Delta> - domA \\<Gamma>))\"\n  using reds_improves_arity'[where ae = \\<bottom>, OF assms] by simp\nend\n\n\nend\n\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/RedsImprovesArityAnalysis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544210587585, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.33052601078826194}}
{"text": "chapter \\<open>Definition\\<close>\n\ntheory %invisible Definition\nimports Main\nbegin\n\ntext \\<open>\\label{chap:definition}\\<close>\n\ntext \\<open>In stepwise refinement~\\<^cite>\\<open>\"DijkstraConstructive\" and \"WirthRefinement\"\\<close>,\na program is derived from a specification\nvia a sequence of intermediate specifications.\\<close>\n\ntext \\<open>Pop-refinement (where `pop' stands for `predicates over programs')\nis an approach to stepwise refinement,\ncarried out inside an interactive theorem prover\n(e.g.\\ Isabelle/HOL, HOL4, Coq, PVS, ACL2)\nas follows:\n\\begin{enumerate}\n\\item\nFormalize the syntax and semantics\nof (the needed subset of) the target programming language (and libraries),\nas a deep embedding.\n\\item\nSpecify the requirements\nby defining a predicate over programs\nthat characterizes the possible implementations.\n\\item\nRefine the specification stepwise\nby defining monotonically decreasing predicates over programs\n(decreasing with respect to inclusion, i.e.\\ logical implication),\naccording to decisions that narrow down the possible implementations.\n\\item\nConclude the derivation\nwith a predicate that characterizes a unique program in explicit syntactic form,\nfrom which the program text is readily obtained.\n\\end{enumerate}\\<close>\n\n\nend %invisible\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Pop_Refinement/Definition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.33046813131717984}}
{"text": "(*  Title:      ZF/AC/WO6_WO1.thy\n    Author:     Krzysztof Grabczewski\n\nProofs needed to state that formulations WO1,...,WO6 are all equivalent.\nThe only hard one is WO6 ==> WO1.\n\nEvery proof (except WO6 ==> WO1 and WO1 ==> WO2) are described as \"clear\"\nby Rubin & Rubin (page 2). \nThey refer reader to a book by Gödel to see the proof WO1 ==> WO2.\nFortunately order types made this proof also very easy.\n*)\n\ntheory WO6_WO1\nimports Cardinal_aux\nbegin\n\n(* Auxiliary definitions used in proof *)\ndefinition\n  NN  :: \"i => i\"  where\n    \"NN(y) == {m \\<in> nat. \\<exists>a. \\<exists>f. Ord(a) & domain(f)=a  &  \n                        (\\<Union>b<a. f`b) = y & (\\<forall>b<a. f`b \\<lesssim> m)}\"\n  \ndefinition\n  uu  :: \"[i, i, i, i] => i\"  where\n    \"uu(f, beta, gamma, delta) == (f`beta * f`gamma) \\<inter> f`delta\"\n\n\n(** Definitions for case 1 **)\ndefinition\n  vv1 :: \"[i, i, i] => i\"  where\n     \"vv1(f,m,b) ==                                                \n           let g = \\<mu> g. (\\<exists>d. Ord(d) & (domain(uu(f,b,g,d)) \\<noteq> 0 & \n                                 domain(uu(f,b,g,d)) \\<lesssim> m));      \n               d = \\<mu> d. domain(uu(f,b,g,d)) \\<noteq> 0 &                  \n                            domain(uu(f,b,g,d)) \\<lesssim> m         \n           in  if f`b \\<noteq> 0 then domain(uu(f,b,g,d)) else 0\"\n\ndefinition\n  ww1 :: \"[i, i, i] => i\"  where\n     \"ww1(f,m,b) == f`b - vv1(f,m,b)\"\n\ndefinition\n  gg1 :: \"[i, i, i] => i\"  where\n     \"gg1(f,a,m) == \\<lambda>b \\<in> a++a. if b<a then vv1(f,m,b) else ww1(f,m,b--a)\"\n\n\n(** Definitions for case 2 **)\ndefinition\n  vv2 :: \"[i, i, i, i] => i\"  where\n     \"vv2(f,b,g,s) ==   \n           if f`g \\<noteq> 0 then {uu(f, b, g, \\<mu> d. uu(f,b,g,d) \\<noteq> 0)`s} else 0\"\n\ndefinition\n  ww2 :: \"[i, i, i, i] => i\"  where\n     \"ww2(f,b,g,s) == f`g - vv2(f,b,g,s)\"\n\ndefinition\n  gg2 :: \"[i, i, i, i] => i\"  where\n     \"gg2(f,a,b,s) ==\n              \\<lambda>g \\<in> a++a. if g<a then vv2(f,b,g,s) else ww2(f,b,g--a,s)\"\n\n\nlemma WO2_WO3: \"WO2 ==> WO3\"\nby (unfold WO2_def WO3_def, fast)\n\n(* ********************************************************************** *)\n\nlemma WO3_WO1: \"WO3 ==> WO1\"\napply (unfold eqpoll_def WO1_def WO3_def)\napply (intro allI)\napply (drule_tac x=A in spec) \napply (blast intro: bij_is_inj well_ord_rvimage \n                    well_ord_Memrel [THEN well_ord_subset])\ndone\n\n(* ********************************************************************** *)\n\nlemma WO1_WO2: \"WO1 ==> WO2\"\napply (unfold eqpoll_def WO1_def WO2_def)\napply (blast intro!: Ord_ordertype ordermap_bij)\ndone\n\n(* ********************************************************************** *)\n\nlemma lam_sets: \"f \\<in> A->B ==> (\\<lambda>x \\<in> A. {f`x}): A -> {{b}. b \\<in> B}\"\nby (fast intro!: lam_type apply_type)\n\nlemma surj_imp_eq': \"f \\<in> surj(A,B) ==> (\\<Union>a \\<in> A. {f`a}) = B\"\napply (unfold surj_def)\napply (fast elim!: apply_type)\ndone\n\nlemma surj_imp_eq: \"[| f \\<in> surj(A,B); Ord(A) |] ==> (\\<Union>a<A. {f`a}) = B\"\nby (fast dest!: surj_imp_eq' intro!: ltI elim!: ltE)\n\nlemma WO1_WO4: \"WO1 ==> WO4(1)\"\napply (unfold WO1_def WO4_def)\napply (rule allI)\napply (erule_tac x = A in allE)\napply (erule exE)\napply (intro exI conjI)\napply (erule Ord_ordertype)\napply (erule ordermap_bij [THEN bij_converse_bij, THEN bij_is_fun, THEN lam_sets, THEN domain_of_fun])\napply (simp_all add: singleton_eqpoll_1 eqpoll_imp_lepoll Ord_ordertype\n       ordermap_bij [THEN bij_converse_bij, THEN bij_is_surj, THEN surj_imp_eq]\n       ltD)\ndone\n\n(* ********************************************************************** *)\n\nlemma WO4_mono: \"[| m\\<le>n; WO4(m) |] ==> WO4(n)\"\napply (unfold WO4_def)\napply (blast dest!: spec intro: lepoll_trans [OF _ le_imp_lepoll])\ndone\n\n(* ********************************************************************** *)\n\nlemma WO4_WO5: \"[| m \\<in> nat; 1\\<le>m; WO4(m) |] ==> WO5\"\nby (unfold WO4_def WO5_def, blast)\n\n(* ********************************************************************** *)\n\nlemma WO5_WO6: \"WO5 ==> WO6\"\nby (unfold WO4_def WO5_def WO6_def, blast)\n\n\n(* ********************************************************************** \n    The proof of \"WO6 ==> WO1\".  Simplified by L C Paulson.\n\n    From the book \"Equivalents of the Axiom of Choice\" by Rubin & Rubin,\n    pages 2-5\n************************************************************************* *)\n\nlemma lt_oadd_odiff_disj:\n      \"[| k < i++j;  Ord(i);  Ord(j) |] \n       ==> k < i  |  (~ k<i & k = i ++ (k--i) & (k--i)<j)\"\napply (rule_tac i = k and j = i in Ord_linear2)\nprefer 4 \n   apply (drule odiff_lt_mono2, assumption)\n   apply (simp add: oadd_odiff_inverse odiff_oadd_inverse)\napply (auto elim!: lt_Ord)\ndone\n\n\n(* ********************************************************************** *)\n(* The most complicated part of the proof - lemma ii - p. 2-4             *)\n(* ********************************************************************** *)\n\n(* ********************************************************************** *)\n(* some properties of relation uu(beta, gamma, delta) - p. 2              *)\n(* ********************************************************************** *)\n\nlemma domain_uu_subset: \"domain(uu(f,b,g,d)) \\<subseteq> f`b\"\nby (unfold uu_def, blast)\n\nlemma quant_domain_uu_lepoll_m:\n     \"\\<forall>b<a. f`b \\<lesssim> m ==> \\<forall>b<a. \\<forall>g<a. \\<forall>d<a. domain(uu(f,b,g,d)) \\<lesssim> m\"\nby (blast intro: domain_uu_subset [THEN subset_imp_lepoll] lepoll_trans)\n\nlemma uu_subset1: \"uu(f,b,g,d) \\<subseteq> f`b * f`g\"\nby (unfold uu_def, blast)\n\nlemma uu_subset2: \"uu(f,b,g,d) \\<subseteq> f`d\"\nby (unfold uu_def, blast)\n\nlemma uu_lepoll_m: \"[| \\<forall>b<a. f`b \\<lesssim> m;  d<a |] ==> uu(f,b,g,d) \\<lesssim> m\"\nby (blast intro: uu_subset2 [THEN subset_imp_lepoll] lepoll_trans)\n\n(* ********************************************************************** *)\n(* Two cases for lemma ii                                                 *)\n(* ********************************************************************** *)\nlemma cases: \n     \"\\<forall>b<a. \\<forall>g<a. \\<forall>d<a. u(f,b,g,d) \\<lesssim> m   \n      ==> (\\<forall>b<a. f`b \\<noteq> 0 \\<longrightarrow>  \n                  (\\<exists>g<a. \\<exists>d<a. u(f,b,g,d) \\<noteq> 0 & u(f,b,g,d) \\<prec> m))  \n        | (\\<exists>b<a. f`b \\<noteq> 0 & (\\<forall>g<a. \\<forall>d<a. u(f,b,g,d) \\<noteq> 0 \\<longrightarrow>   \n                                        u(f,b,g,d) \\<approx> m))\"\napply (unfold lesspoll_def)\napply (blast del: equalityI)\ndone\n\n(* ********************************************************************** *)\n(* Lemmas used in both cases                                              *)\n(* ********************************************************************** *)\nlemma UN_oadd: \"Ord(a) ==> (\\<Union>b<a++a. C(b)) = (\\<Union>b<a. C(b) \\<union> C(a++b))\"\nby (blast intro: ltI lt_oadd1 oadd_lt_mono2 dest!: lt_oadd_disj)\n\n\n(* ********************************************************************** *)\n(* Case 1: lemmas                                                        *)\n(* ********************************************************************** *)\n\nlemma vv1_subset: \"vv1(f,m,b) \\<subseteq> f`b\"\nby (simp add: vv1_def Let_def domain_uu_subset)\n\n(* ********************************************************************** *)\n(* Case 1: Union of images is the whole \"y\"                              *)\n(* ********************************************************************** *)\nlemma UN_gg1_eq: \n  \"[| Ord(a);  m \\<in> nat |] ==> (\\<Union>b<a++a. gg1(f,a,m)`b) = (\\<Union>b<a. f`b)\"\nby (simp add: gg1_def UN_oadd lt_oadd1 oadd_le_self [THEN le_imp_not_lt] \n              lt_Ord odiff_oadd_inverse ltD vv1_subset [THEN Diff_partition]\n              ww1_def)\n\nlemma domain_gg1: \"domain(gg1(f,a,m)) = a++a\"\nby (simp add: lam_funtype [THEN domain_of_fun] gg1_def)\n\n(* ********************************************************************** *)\n(* every value of defined function is less than or equipollent to m       *)\n(* ********************************************************************** *)\nlemma nested_LeastI:\n     \"[| P(a, b);  Ord(a);  Ord(b);   \n         Least_a = (\\<mu> a. \\<exists>x. Ord(x) & P(a, x)) |]   \n      ==> P(Least_a, \\<mu> b. P(Least_a, b))\"\napply (erule ssubst)\napply (rule_tac Q = \"%z. P (z, \\<mu> b. P (z, b))\" in LeastI2)\napply (fast elim!: LeastI)+\ndone\n\nlemmas nested_Least_instance =\n       nested_LeastI [of \"%g d. domain(uu(f,b,g,d)) \\<noteq> 0 & \n                                domain(uu(f,b,g,d)) \\<lesssim> m\"] for f b m\n\nlemma gg1_lepoll_m: \n     \"[| Ord(a);  m \\<in> nat;   \n         \\<forall>b<a. f`b \\<noteq>0 \\<longrightarrow>                                        \n             (\\<exists>g<a. \\<exists>d<a. domain(uu(f,b,g,d)) \\<noteq> 0  &                \n                          domain(uu(f,b,g,d)) \\<lesssim> m);             \n         \\<forall>b<a. f`b \\<lesssim> succ(m);  b<a++a |] \n      ==> gg1(f,a,m)`b \\<lesssim> m\"\napply (simp add: gg1_def empty_lepollI)\napply (safe dest!: lt_oadd_odiff_disj)\n(*Case b<a   \\<in> show vv1(f,m,b) \\<lesssim> m *)\n apply (simp add: vv1_def Let_def empty_lepollI)\n apply (fast intro: nested_Least_instance [THEN conjunct2]\n             elim!: lt_Ord)\n(*Case a\\<le>b \\<in> show ww1(f,m,b--a) \\<lesssim> m *)\napply (simp add: ww1_def empty_lepollI)\napply (case_tac \"f` (b--a) = 0\", simp add: empty_lepollI)\napply (rule Diff_lepoll, blast)\napply (rule vv1_subset)\napply (drule ospec [THEN mp], assumption+)\napply (elim oexE conjE)\napply (simp add: vv1_def Let_def lt_Ord nested_Least_instance [THEN conjunct1])\ndone\n\n(* ********************************************************************** *)\n(* Case 2: lemmas                                                        *)\n(* ********************************************************************** *)\n\n(* ********************************************************************** *)\n(* Case 2: vv2_subset                                                    *)\n(* ********************************************************************** *)\n\nlemma ex_d_uu_not_empty:\n     \"[| b<a;  g<a;  f`b\\<noteq>0;  f`g\\<noteq>0;         \n         y*y \\<subseteq> y;  (\\<Union>b<a. f`b)=y |] \n      ==> \\<exists>d<a. uu(f,b,g,d) \\<noteq> 0\"\nby (unfold uu_def, blast) \n\nlemma uu_not_empty:\n     \"[| b<a; g<a; f`b\\<noteq>0; f`g\\<noteq>0;  y*y \\<subseteq> y; (\\<Union>b<a. f`b)=y |]   \n      ==> uu(f,b,g,\\<mu> d. (uu(f,b,g,d) \\<noteq> 0)) \\<noteq> 0\"\napply (drule ex_d_uu_not_empty, assumption+)\napply (fast elim!: LeastI lt_Ord)\ndone\n\nlemma not_empty_rel_imp_domain: \"[| r \\<subseteq> A*B; r\\<noteq>0 |] ==> domain(r)\\<noteq>0\"\nby blast\n\nlemma Least_uu_not_empty_lt_a:\n     \"[| b<a; g<a; f`b\\<noteq>0; f`g\\<noteq>0; y*y \\<subseteq> y; (\\<Union>b<a. f`b)=y |]   \n      ==> (\\<mu> d. uu(f,b,g,d) \\<noteq> 0) < a\"\napply (erule ex_d_uu_not_empty [THEN oexE], assumption+)\napply (blast intro: Least_le [THEN lt_trans1] lt_Ord)\ndone\n\nlemma subset_Diff_sing: \"[| B \\<subseteq> A; a\\<notin>B |] ==> B \\<subseteq> A-{a}\"\nby blast\n\n(*Could this be proved more directly?*)\nlemma supset_lepoll_imp_eq:\n     \"[| A \\<lesssim> m; m \\<lesssim> B; B \\<subseteq> A; m \\<in> nat |] ==> A=B\"\napply (erule natE)\napply (fast dest!: lepoll_0_is_0 intro!: equalityI)\napply (safe intro!: equalityI)\napply (rule ccontr)\napply (rule succ_lepoll_natE)\n apply (erule lepoll_trans)  \n apply (rule lepoll_trans)  \n  apply (erule subset_Diff_sing [THEN subset_imp_lepoll], assumption)\n apply (rule Diff_sing_lepoll, assumption+) \ndone\n\nlemma uu_Least_is_fun:\n     \"[| \\<forall>g<a. \\<forall>d<a. domain(uu(f, b, g, d))\\<noteq>0 \\<longrightarrow>                \n          domain(uu(f, b, g, d)) \\<approx> succ(m);                         \n          \\<forall>b<a. f`b \\<lesssim> succ(m);  y*y \\<subseteq> y;                        \n          (\\<Union>b<a. f`b)=y;  b<a;  g<a;  d<a;                             \n          f`b\\<noteq>0;  f`g\\<noteq>0;  m \\<in> nat;  s \\<in> f`b |] \n      ==> uu(f, b, g, \\<mu> d. uu(f,b,g,d)\\<noteq>0) \\<in> f`b -> f`g\"\napply (drule_tac x2=g in ospec [THEN ospec, THEN mp])\n   apply (rule_tac [3] not_empty_rel_imp_domain [OF uu_subset1 uu_not_empty])\n        apply (rule_tac [2] Least_uu_not_empty_lt_a, assumption+)\napply (rule rel_is_fun)\n    apply (erule eqpoll_sym [THEN eqpoll_imp_lepoll]) \n   apply (erule uu_lepoll_m) \n   apply (rule Least_uu_not_empty_lt_a, assumption+) \napply (rule uu_subset1)\napply (rule supset_lepoll_imp_eq [OF _ eqpoll_sym [THEN eqpoll_imp_lepoll]])\napply (fast intro!: domain_uu_subset)+\ndone\n\nlemma vv2_subset: \n     \"[| \\<forall>g<a. \\<forall>d<a. domain(uu(f, b, g, d))\\<noteq>0 \\<longrightarrow>             \n                       domain(uu(f, b, g, d)) \\<approx> succ(m);\n         \\<forall>b<a. f`b \\<lesssim> succ(m); y*y \\<subseteq> y;\n         (\\<Union>b<a. f`b)=y;  b<a;  g<a;  m \\<in> nat;  s \\<in> f`b |] \n      ==> vv2(f,b,g,s) \\<subseteq> f`g\"\napply (simp add: vv2_def)\napply (blast intro: uu_Least_is_fun [THEN apply_type])\ndone\n\n(* ********************************************************************** *)\n(* Case 2: Union of images is the whole \"y\"                              *)\n(* ********************************************************************** *)\nlemma UN_gg2_eq: \n     \"[| \\<forall>g<a. \\<forall>d<a. domain(uu(f,b,g,d)) \\<noteq> 0 \\<longrightarrow>              \n               domain(uu(f,b,g,d)) \\<approx> succ(m);                         \n         \\<forall>b<a. f`b \\<lesssim> succ(m); y*y \\<subseteq> y;                        \n         (\\<Union>b<a. f`b)=y;  Ord(a);  m \\<in> nat;  s \\<in> f`b;  b<a |] \n      ==> (\\<Union>g<a++a. gg2(f,a,b,s) ` g) = y\"\napply (unfold gg2_def)\napply (drule sym) \napply (simp add: ltD UN_oadd  oadd_le_self [THEN le_imp_not_lt] \n                 lt_Ord odiff_oadd_inverse ww2_def \n                 vv2_subset [THEN Diff_partition])\ndone\n\nlemma domain_gg2: \"domain(gg2(f,a,b,s)) = a++a\"\nby (simp add: lam_funtype [THEN domain_of_fun] gg2_def)\n\n\n(* ********************************************************************** *)\n(* every value of defined function is less than or equipollent to m       *)\n(* ********************************************************************** *)\n\nlemma vv2_lepoll: \"[| m \\<in> nat; m\\<noteq>0 |] ==> vv2(f,b,g,s) \\<lesssim> m\"\napply (unfold vv2_def)\napply (simp add: empty_lepollI)\napply (fast dest!: le_imp_subset [THEN subset_imp_lepoll, THEN lepoll_0_is_0] \n       intro!: singleton_eqpoll_1 [THEN eqpoll_imp_lepoll, THEN lepoll_trans]\n               not_lt_imp_le [THEN le_imp_subset, THEN subset_imp_lepoll]\n               nat_into_Ord nat_1I)\ndone\n\nlemma ww2_lepoll: \n    \"[| \\<forall>b<a. f`b \\<lesssim> succ(m);  g<a;  m \\<in> nat;  vv2(f,b,g,d) \\<subseteq> f`g |]  \n     ==> ww2(f,b,g,d) \\<lesssim> m\"\napply (unfold ww2_def)\napply (case_tac \"f`g = 0\")\napply (simp add: empty_lepollI)\napply (drule ospec, assumption)\napply (rule Diff_lepoll, assumption+)\napply (simp add: vv2_def not_emptyI)\ndone\n\nlemma gg2_lepoll_m: \n     \"[| \\<forall>g<a. \\<forall>d<a. domain(uu(f,b,g,d)) \\<noteq> 0 \\<longrightarrow>              \n                      domain(uu(f,b,g,d)) \\<approx> succ(m);                         \n         \\<forall>b<a. f`b \\<lesssim> succ(m);  y*y \\<subseteq> y;                     \n         (\\<Union>b<a. f`b)=y;  b<a;  s \\<in> f`b;  m \\<in> nat;  m\\<noteq> 0;  g<a++a |] \n      ==> gg2(f,a,b,s) ` g \\<lesssim> m\"\napply (simp add: gg2_def empty_lepollI)\napply (safe elim!: lt_Ord2 dest!: lt_oadd_odiff_disj)\n apply (simp add: vv2_lepoll)\napply (simp add: ww2_lepoll vv2_subset)\ndone\n\n(* ********************************************************************** *)\n(* lemma ii                                                               *)\n(* ********************************************************************** *)\nlemma lemma_ii: \"[| succ(m) \\<in> NN(y); y*y \\<subseteq> y; m \\<in> nat; m\\<noteq>0 |] ==> m \\<in> NN(y)\"\napply (unfold NN_def)\napply (elim CollectE exE conjE) \napply (rule quant_domain_uu_lepoll_m [THEN cases, THEN disjE], assumption)\n(* case 1 *)\napply (simp add: lesspoll_succ_iff)\napply (rule_tac x = \"a++a\" in exI)\napply (fast intro!: Ord_oadd domain_gg1 UN_gg1_eq gg1_lepoll_m)\n(* case 2 *)\napply (elim oexE conjE)\napply (rule_tac A = \"f`B\" for B in not_emptyE, assumption)\napply (rule CollectI)\napply (erule succ_natD)\napply (rule_tac x = \"a++a\" in exI)\napply (rule_tac x = \"gg2 (f,a,b,x) \" in exI)\napply (simp add: Ord_oadd domain_gg2 UN_gg2_eq gg2_lepoll_m)\ndone\n\n\n(* ********************************************************************** *)\n(* lemma iv - p. 4:                                                       *)\n(* For every set x there is a set y such that   x \\<union> (y * y) \\<subseteq> y         *)\n(* ********************************************************************** *)\n\n\n(* The leading \\<forall>-quantifier looks odd but makes the proofs shorter \n   (used only in the following two lemmas)                          *)\n\nlemma z_n_subset_z_succ_n:\n     \"\\<forall>n \\<in> nat. rec(n, x, %k r. r \\<union> r*r) \\<subseteq> rec(succ(n), x, %k r. r \\<union> r*r)\"\nby (fast intro: rec_succ [THEN ssubst])\n\nlemma le_subsets:\n     \"[| \\<forall>n \\<in> nat. f(n)<=f(succ(n)); n\\<le>m; n \\<in> nat; m \\<in> nat |]   \n      ==> f(n)<=f(m)\"\napply (erule_tac P = \"n\\<le>m\" in rev_mp)\napply (rule_tac P = \"%z. n\\<le>z \\<longrightarrow> f (n) \\<subseteq> f (z) \" in nat_induct) \napply (auto simp add: le_iff) \ndone\n\nlemma le_imp_rec_subset:\n     \"[| n\\<le>m; m \\<in> nat |] \n      ==> rec(n, x, %k r. r \\<union> r*r) \\<subseteq> rec(m, x, %k r. r \\<union> r*r)\"\napply (rule z_n_subset_z_succ_n [THEN le_subsets])\napply (blast intro: lt_nat_in_nat)+\ndone\n\nlemma lemma_iv: \"\\<exists>y. x \\<union> y*y \\<subseteq> y\"\napply (rule_tac x = \"\\<Union>n \\<in> nat. rec (n, x, %k r. r \\<union> r*r) \" in exI)\napply safe\napply (rule nat_0I [THEN UN_I], simp)\napply (rule_tac a = \"succ (n \\<union> na) \" in UN_I)\napply (erule Un_nat_type [THEN nat_succI], assumption)\napply (auto intro: le_imp_rec_subset [THEN subsetD] \n            intro!: Un_upper1_le Un_upper2_le Un_nat_type \n            elim!: nat_into_Ord)\ndone\n\n(* ********************************************************************** *)\n(* Rubin & Rubin wrote,                                                   *)\n(* \"It follows from (ii) and mathematical induction that if y*y \\<subseteq> y then *)\n(* y can be well-ordered\"                                                 *)\n\n(* In fact we have to prove                                               *)\n(*      * WO6 ==> NN(y) \\<noteq> 0                                              *)\n(*      * reverse induction which lets us infer that 1 \\<in> NN(y)            *)\n(*      * 1 \\<in> NN(y) ==> y can be well-ordered                             *)\n(* ********************************************************************** *)\n\n(* ********************************************************************** *)\n(*      WO6 ==> NN(y) \\<noteq> 0                                                *)\n(* ********************************************************************** *)\n\nlemma WO6_imp_NN_not_empty: \"WO6 ==> NN(y) \\<noteq> 0\"\nby (unfold WO6_def NN_def, clarify, blast)\n\n(* ********************************************************************** *)\n(*      1 \\<in> NN(y) ==> y can be well-ordered                               *)\n(* ********************************************************************** *)\n\nlemma lemma1:\n     \"[| (\\<Union>b<a. f`b)=y; x \\<in> y; \\<forall>b<a. f`b \\<lesssim> 1; Ord(a) |] ==> \\<exists>c<a. f`c = {x}\"\nby (fast elim!: lepoll_1_is_sing)\n\nlemma lemma2:\n     \"[| (\\<Union>b<a. f`b)=y; x \\<in> y; \\<forall>b<a. f`b \\<lesssim> 1; Ord(a) |]   \n      ==> f` (\\<mu> i. f`i = {x}) = {x}\"\napply (drule lemma1, assumption+)\napply (fast elim!: lt_Ord intro: LeastI)\ndone\n\nlemma NN_imp_ex_inj: \"1 \\<in> NN(y) ==> \\<exists>a f. Ord(a) & f \\<in> inj(y, a)\"\napply (unfold NN_def)\napply (elim CollectE exE conjE)\napply (rule_tac x = a in exI)\napply (rule_tac x = \"\\<lambda>x \\<in> y. \\<mu> i. f`i = {x}\" in exI)\napply (rule conjI, assumption)\napply (rule_tac d = \"%i. THE x. x \\<in> f`i\" in lam_injective)\napply (drule lemma1, assumption+)\napply (fast elim!: Least_le [THEN lt_trans1, THEN ltD] lt_Ord)\napply (rule lemma2 [THEN ssubst], assumption+, blast)\ndone\n\nlemma y_well_ord: \"[| y*y \\<subseteq> y; 1 \\<in> NN(y) |] ==> \\<exists>r. well_ord(y, r)\"\napply (drule NN_imp_ex_inj)\napply (fast elim!: well_ord_rvimage [OF _ well_ord_Memrel])\ndone\n\n(* ********************************************************************** *)\n(*      reverse induction which lets us infer that 1 \\<in> NN(y)              *)\n(* ********************************************************************** *)\n\nlemma rev_induct_lemma [rule_format]: \n     \"[| n \\<in> nat; !!m. [| m \\<in> nat; m\\<noteq>0; P(succ(m)) |] ==> P(m) |]   \n      ==> n\\<noteq>0 \\<longrightarrow> P(n) \\<longrightarrow> P(1)\"\nby (erule nat_induct, blast+)\n\nlemma rev_induct:\n     \"[| n \\<in> nat;  P(n);  n\\<noteq>0;   \n         !!m. [| m \\<in> nat; m\\<noteq>0; P(succ(m)) |] ==> P(m) |]   \n      ==> P(1)\"\nby (rule rev_induct_lemma, blast+)\n\nlemma NN_into_nat: \"n \\<in> NN(y) ==> n \\<in> nat\"\nby (simp add: NN_def)\n\nlemma lemma3: \"[| n \\<in> NN(y); y*y \\<subseteq> y; n\\<noteq>0 |] ==> 1 \\<in> NN(y)\"\napply (rule rev_induct [OF NN_into_nat], assumption+)\napply (rule lemma_ii, assumption+)\ndone\n\n(* ********************************************************************** *)\n(* Main theorem \"WO6 ==> WO1\"                                             *)\n(* ********************************************************************** *)\n\n(* another helpful lemma *)\nlemma NN_y_0: \"0 \\<in> NN(y) ==> y=0\"\napply (unfold NN_def) \napply (fast intro!: equalityI dest!: lepoll_0_is_0 elim: subst)\ndone\n\nlemma WO6_imp_WO1: \"WO6 ==> WO1\"\napply (unfold WO1_def)\napply (rule allI)\napply (case_tac \"A=0\")\napply (fast intro!: well_ord_Memrel nat_0I [THEN nat_into_Ord])\napply (rule_tac x = A in lemma_iv [elim_format])\napply (erule exE)\napply (drule WO6_imp_NN_not_empty)\napply (erule Un_subset_iff [THEN iffD1, THEN conjE])\napply (erule_tac A = \"NN (y) \" in not_emptyE)\napply (frule y_well_ord)\n apply (fast intro!: lemma3 dest!: NN_y_0 elim!: not_emptyE)\napply (fast elim: well_ord_subset)\ndone\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/ZF/AC/WO6_WO1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.33046813131717984}}
{"text": "\\<^marker>\\<open>creator \"Kevin Kappelmann\"\\<close>\nsubsubsection \\<open>Transport for Partial Quotient Types\\<close>\ntheory Transport_Partial_Quotient_Types\n  imports\n    HOL.Lifting\n    Transport.Transport\nbegin\n\nparagraph \\<open>Summary\\<close>\ntext \\<open>Every partial quotient type @{term Quotient}, as used by the Lifting\npackage, is transportable.\\<close>\n\ncontext transport\nbegin\n\ninterpretation t : transport L \"(=)\" l r .\n\nlemma Quotient_T_eq_Galois:\n  assumes \"Quotient (\\<le>\\<^bsub>L\\<^esub>) l r T\"\n  shows \"T = t.Galois\"\nproof (intro ext iffI)\n  fix x y assume \"T x y\"\n  with assms have \"x \\<le>\\<^bsub>L\\<^esub> x\" \"l x = y\" using Quotient_cr_rel by auto\n  with assms have \"r (l x) \\<le>\\<^bsub>L\\<^esub> x\" \"r (l x) \\<le>\\<^bsub>L\\<^esub> r y\"\n    using Quotient_rep_abs Quotient_rep_reflp by auto\n  with assms have \"x \\<le>\\<^bsub>L\\<^esub> r y\" using Quotient_part_equivp\n    by (blast elim: part_equivpE dest: transpD sympD)\n  then show \"t.Galois x y\" by blast\nnext\n  fix x y assume \"t.Galois x y\"\n  with assms show \"T x y\" using Quotient_cr_rel Quotient_refl1 Quotient_symp\n    by (fastforce intro: Quotient_rel_abs2[symmetric] dest: sympD)\nqed\n\nlemma Quotient_if_preorder_equivalence:\n  assumes \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (=)) l r\"\n  shows \"Quotient (\\<le>\\<^bsub>L\\<^esub>) l r t.Galois\"\nproof (rule QuotientI)\n  from assms show \"l (r y) = y\" for y by fast\n  from assms show \"r y \\<le>\\<^bsub>L\\<^esub> r y\" for y by blast\n  show \"x \\<le>\\<^bsub>L\\<^esub> x' \\<longleftrightarrow> x \\<le>\\<^bsub>L\\<^esub> x \\<and> x' \\<le>\\<^bsub>L\\<^esub> x' \\<and> l x = l x'\"\n    (is \"?lhs \\<longleftrightarrow> ?rhs\") for x x'\n  proof (rule iffI)\n    assume ?rhs\n    with assms have \"\\<eta> x \\<le>\\<^bsub>L\\<^esub> \\<eta> x'\" by fastforce\n    moreover from \\<open>?rhs\\<close> assms have \"x \\<le>\\<^bsub>L\\<^esub> \\<eta> x\" \"\\<eta> x' \\<le>\\<^bsub>L\\<^esub> x'\"\n      by (blast elim: t.preorder_equivalence_order_equivalenceE)+\n    moreover from assms have \"transitive (\\<le>\\<^bsub>L\\<^esub>)\" by blast\n    ultimately show \"x \\<le>\\<^bsub>L\\<^esub> x'\" by blast\n  next\n    assume ?lhs\n    with assms show ?rhs by blast\n  qed\n  from assms show \"t.Galois = (\\<lambda>x y. x \\<le>\\<^bsub>L\\<^esub> x \\<and> l x = y)\"\n    by (intro ext iffI)\n    (blast elim!: t.GaloisE,\n    auto intro!: t.Galois_left_if_left_rel_if_inflationary_on_in_fieldI\n      elim!: t.preorder_equivalence_order_equivalenceE)\nqed\n\nlemma partial_equivalence_rel_equivalence_if_Quotient:\n  assumes \"Quotient (\\<le>\\<^bsub>L\\<^esub>) l r T\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^bsub>PER\\<^esub> (=)) l r\"\nproof (rule t.partial_equivalence_rel_equivalence_if_order_equivalenceI)\n  from Quotient_part_equivp[OF assms] show \"partial_equivalence_rel (\\<le>\\<^bsub>L\\<^esub>)\"\n    by (blast elim: part_equivpE dest: transpD sympD)\n  have \"x \\<equiv>\\<^bsub>L\\<^esub> r (l x)\" if \"in_field (\\<le>\\<^bsub>L\\<^esub>) x\" for x\n  proof -\n    from assms \\<open>in_field (\\<le>\\<^bsub>L\\<^esub>) x\\<close> have \"x \\<le>\\<^bsub>L\\<^esub> x\"\n      using Quotient_refl1 Quotient_refl2 by fastforce\n    with assms Quotient_rep_abs Quotient_symp show ?thesis\n      by (fastforce dest: sympD)\n  qed\n  with assms show \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (=)) l r\"\n    using Quotient_abs_rep Quotient_rel_abs Quotient_rep_reflp\n      Quotient_abs_rep[symmetric]\n    by (intro t.order_equivalenceI dep_mono_wrt_relI rel_equivalence_onI\n      inflationary_onI deflationary_onI)\n    auto\nqed auto\n\ncorollary Quotient_iff_partial_equivalence_rel_equivalence:\n  \"Quotient (\\<le>\\<^bsub>L\\<^esub>) l r t.Galois \\<longleftrightarrow> ((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^bsub>PER\\<^esub> (=)) l r\"\n  using Quotient_if_preorder_equivalence partial_equivalence_rel_equivalence_if_Quotient\n  by blast\n\ncorollary Quotient_T_eq_flip_Galois:\n  assumes \"Quotient (\\<le>\\<^bsub>L\\<^esub>) l r T\"\n  shows \"T = t.flip_Galois\\<inverse>\"\n  using assms\n  by (subst t.inv_flip_Galois_eq_Galois_if_symmetric_if_in_codom_eq_in_dom_if_galois_prop)\n  (blast dest: partial_equivalence_rel_equivalence_if_Quotient\n  intro: in_codom_eq_in_dom_if_reflexive_on_in_field Quotient_T_eq_Galois)+\n\nend\n\n\nend", "meta": {"author": "kappelmann", "repo": "transport-isabelle", "sha": "b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff", "save_path": "github-repos/isabelle/kappelmann-transport-isabelle", "path": "github-repos/isabelle/kappelmann-transport-isabelle/transport-isabelle-b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff/Transport/Examples/Transport_Partial_Quotient_Types.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352403, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.3304681313171798}}
{"text": "theory Normalized_Zone_Semantics_Certification\n  imports TA_Impl.Normalized_Zone_Semantics_Impl_Semantic_Refinement\nbegin\n\nno_notation TA_Start_Defs.step_impl' (\"\\<langle>_, _\\<rangle> \\<leadsto>\\<^bsub>_\\<^esub> \\<langle>_, _\\<rangle>\" [61,61,61] 61)\n\ncontext TA_Start_Defs\nbegin\n\ndefinition\n  \"E_precise_op l r g l' M \\<equiv>\n    let\n      M' = FW' (abstr_upd (inv_of A l) (up_canonical_upd M n)) n;\n      M'' = FW' (abstr_upd (inv_of A l') (reset'_upd (FW' (abstr_upd g M') n) n r 0)) n\n    in M''\"\n\ndefinition\n  \"E_precise_op' l r g l' M \\<equiv>\n    let\n      M1 = abstr_repair (inv_of A l) (up_canonical_upd M n);\n      M2 = filter_diag (\\<lambda> M. abstr_repair g M) M1;\n      M3 = filter_diag (\\<lambda> M. abstr_repair (inv_of A l') (reset'_upd M n r 0)) M2\n    in M3\"\n\nlemma E_precise_op'_alt_def:\n  \"E_precise_op' l r g l' M \\<equiv>\n    let\n      M' = abstr_repair (inv_of A l) (up_canonical_upd M n);\n      f1 = \\<lambda> M. abstr_repair g M;\n      f2 = \\<lambda> M. abstr_repair (inv_of A l') (reset'_upd M n r 0)\n    in filter_diag (filter_diag f2 o f1) M'\"\n  unfolding E_precise_op'_def filter_diag_def\n  by (rule HOL.eq_reflection) (auto simp: Let_def check_diag_marker)\n\nno_notation step_impl' (\"\\<langle>_, _\\<rangle> \\<leadsto>\\<^bsub>_\\<^esub> \\<langle>_, _\\<rangle>\" [61,61,61] 61)\n\nabbreviation step_impl_precise (\"\\<langle>_, _\\<rangle> \\<leadsto>\\<^bsub>_\\<^esub> \\<langle>_, _\\<rangle>\" [61,61,61] 61)\nwhere\n  \"\\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>a\\<^esub> \\<langle>l'', Z''\\<rangle> \\<equiv> \\<exists> l' Z'.\n    A \\<turnstile>\\<^sub>I \\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>n,\\<tau>\\<^esub> \\<langle>l', Z'\\<rangle> \\<and> A \\<turnstile>\\<^sub>I \\<langle>l', Z'\\<rangle> \\<leadsto>\\<^bsub>n,\\<upharpoonleft>a\\<^esub> \\<langle>l'', Z''\\<rangle>\"\n\n(* sublocale Graph_Defs \"\\<lambda> (l, u) (l', u'). conv_A A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>\" . *)\n\ndefinition \"E_precise \\<equiv> (\\<lambda>(l, Z) (l'', Z''). \\<exists>a. \\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>a\\<^esub> \\<langle>l'', Z''\\<rangle>)\"\n\nend\n\n\n\nlocale E_Precise_Bisim = E_From_Op +\n  assumes op_bisim:\n    \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l' \\<Longrightarrow> wf_dbm M \\<Longrightarrow> f l r g l' M \\<simeq> E_precise_op l r g l' M\"\n    and op_wf:\n    \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l' \\<Longrightarrow> wf_dbm M \\<Longrightarrow> wf_dbm (f l r g l' M)\"\nbegin\n\nlemma E_precise_E_op:\n  \"E_precise = (\\<lambda>(l, M) (l', M'''). \\<exists>g a r. A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l' \\<and> M''' = E_precise_op l r g l' M)\"\n  unfolding E_precise_op_def E_precise_def by (intro ext) (auto elim!: step_impl.cases)\n\nlemma E_E_from_op_step:\n  \"\\<exists>c. E_from_op a c \\<and> b \\<sim> c\" if \"E_precise a b\" \"wf_state a\"\n  using that unfolding E_precise_E_op E_from_op_def wf_state_def state_equiv_def\n  by (blast intro: op_bisim dbm_equiv_sym)\n\nlemma E_from_op_E_step:\n  \"\\<exists>c. E_precise a c \\<and> b \\<sim> c\" if \"E_from_op a b\" \"wf_state a\"\n  using that unfolding E_precise_E_op E_from_op_def wf_state_def state_equiv_def\n  by (blast intro: op_bisim)\n\nlemma E_from_op_wf_state:\n  \"wf_state b\" if \"wf_state a\" \"E_from_op a b\"\n  using that unfolding E_E_op E_from_op_def wf_state_def state_equiv_def by (blast intro: op_wf)\n\nlemma E_precise_wf_dbm[intro]:\n  \"wf_dbm D'\" if \"E_precise (l, D) (l', D')\" \"wf_dbm D\"\n  using that unfolding wf_state_def E_def E_precise_def by (auto intro: step_impl_wf_dbm)\n\nlemma E_precise_wf_state:\n  \"wf_state a \\<Longrightarrow> E_precise a b \\<Longrightarrow> wf_state b\"\n  unfolding wf_state_def by auto\n\n(* lemma E_E_from_op_steps_empty:\n  \"(\\<exists>l' M'. E_precise\\<^sup>*\\<^sup>* a\\<^sub>0 (l', M') \\<and> [curry (conv_M M')]\\<^bsub>v,n\\<^esub> = {}) \\<longleftrightarrow>\n   (\\<exists>l' M'. E_from_op\\<^sup>*\\<^sup>* a\\<^sub>0 (l', M') \\<and> [curry (conv_M M')]\\<^bsub>v,n\\<^esub> = {})\"\n  by (rule E_E\\<^sub>1_steps_empty[OF E_E_from_op_step E_from_op_E_step E_from_op_wf_state]) *)\n\ntheorem E_from_op_reachability_check:\n  \"(\\<exists> l' D'. E_precise\\<^sup>*\\<^sup>* a\\<^sub>0 (l', D') \\<and> F_rel (l', D'))\n  \\<longleftrightarrow> (\\<exists> l' D'. E_from_op\\<^sup>*\\<^sup>* a\\<^sub>0 (l', D') \\<and> F_rel (l', D'))\"\n  oops\n(*   apply (rule E_E\\<^sub>1_steps_equiv[OF E_E_from_op_step E_from_op_E_step E_from_op_wf_state])\n  by\n    (auto\n      simp: F_rel_def state_equiv_def wf_state_def dbm_equiv_def\n      dest!:\n        check_diag_empty_spec[OF check_diag_conv_M]\n        canonical_check_diag_empty_iff[OF wf_dbm_altD(1)]\n    ) *)\n\nlemma E_from_op_mono:\n  assumes \"E_from_op (l,D) (l',D')\"\n    and   \"wf_dbm D\" \"wf_dbm M\"\n    and \"[curry (conv_M D)]\\<^bsub>v,n\\<^esub> \\<subseteq> [curry (conv_M M)]\\<^bsub>v,n\\<^esub>\"\n  shows \"\\<exists> M'. E_from_op (l,M) (l',M') \\<and> [curry (conv_M D')]\\<^bsub>v,n\\<^esub> \\<subseteq> [curry (conv_M M')]\\<^bsub>v,n\\<^esub>\"\n  (* using assms by - (rule E\\<^sub>1_mono[OF E_E_from_op_step E_from_op_E_step E_from_op_wf_state]; blast) *)\n  oops\n\nlemma E_from_op_mono':\n  assumes \"E_from_op (l,D) (l',D')\"\n    and   \"wf_dbm D\" \"wf_dbm M\"\n    and \"dbm_subset n D M\"\n  shows \"\\<exists> M'. E_from_op (l,M) (l',M') \\<and> dbm_subset n D' M'\"\n  (* using assms by - (rule E\\<^sub>1_mono'[OF E_E_from_op_step E_from_op_E_step E_from_op_wf_state]; blast) *)\n  oops\n\n  thm E_E_from_op_step E_from_op_E_step E_from_op_wf_state\n\nlemma E_equiv:\n  \"\\<exists> b'. E_precise b b' \\<and> a' \\<sim> b'\" if \"E_precise a a'\" \"a \\<sim> b\" \"wf_state a\" \"wf_state b\"\n  using that\n  unfolding wf_state_def E_precise_def\n  apply safe\n  apply (frule step_impl_equiv, assumption, assumption, rule state_equiv_D, assumption)\n  by (safe, drule step_impl_equiv, auto intro: step_impl_wf_dbm simp: state_equiv_def)\n\nlemma E_from_op_bisim:\n  \"Bisimulation_Invariant E_precise E_from_op (\\<sim>) wf_state wf_state\"\n  apply standard\n  subgoal\n    by (drule E_equiv, assumption+) (auto dest!: E_E_from_op_step)\n  subgoal\n    by (drule (1) E_from_op_E_step, safe, drule E_equiv) (auto 4 4 intro: state_equiv_sym)\n   apply (rule E_precise_wf_state; assumption)\n  apply (rule E_from_op_wf_state; assumption)\n  done\n\nlemma E_from_op_bisim_empty:\n  \"Bisimulation_Invariant\n    (\\<lambda>(l, M) (l', M'). E_precise (l, M) (l', M') \\<and> \\<not> check_diag n M')\n    (\\<lambda>(l, M) (l', M'). E_from_op (l, M) (l', M') \\<and> \\<not> check_diag n M')\n    (\\<sim>) wf_state wf_state\"\n  using E_from_op_bisim\n  apply (rule Bisimulation_Invariant_filter[\n        where FA = \"\\<lambda>(l, M). \\<not> check_diag n M\" and FB = \"\\<lambda>(l, M). \\<not> check_diag n M\"\n        ])\n  subgoal\n    unfolding wf_state_def state_equiv_def\n    apply clarsimp\n    apply (subst canonical_check_diag_empty_iff[symmetric], erule wf_dbm_altD(1))\n    apply (subst canonical_check_diag_empty_iff[symmetric], erule wf_dbm_altD(1))\n    apply (simp add: dbm_equiv_def)\n    done\n   apply (auto; fail)+\n  done\n\nend (* End of context for bisimilarity *)\n\ndefinition step_z_dbm' ::\n  \"('a, 'c, 't, 's) ta \\<Rightarrow> 's \\<Rightarrow> 't :: {linordered_cancel_ab_monoid_add,uminus} DBM\n    \\<Rightarrow> ('c \\<Rightarrow> nat) \\<Rightarrow> nat \\<Rightarrow> 'a \\<Rightarrow> 's \\<Rightarrow> 't DBM \\<Rightarrow> bool\"\n(\"_ \\<turnstile>'' \\<langle>_, _\\<rangle> \\<leadsto>\\<^bsub>_,_,_\\<^esub> \\<langle>_, _\\<rangle>\" [61,61,61,61] 61) where\n  \"A \\<turnstile>' \\<langle>l,D\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l'',D''\\<rangle> \\<equiv>\n  \\<exists>l' D'. A \\<turnstile> \\<langle>l, D\\<rangle> \\<leadsto>\\<^bsub>v,n,\\<tau>\\<^esub> \\<langle>l', D'\\<rangle> \\<and> A \\<turnstile> \\<langle>l', D'\\<rangle> \\<leadsto>\\<^bsub>v,n,\\<upharpoonleft>a\\<^esub> \\<langle>l'', D''\\<rangle>\"\n\ncontext TA_Start\nbegin\n\nlemma E_precise_op'_bisim:\n  \"E_precise_op' l r g l' M \\<simeq> E_precise_op l r g l' M\" if \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l'\" \"wf_dbm M\"\nproof -\n  note intros =\n    dbm_equiv_refl dbm_equiv_trans[OF filter_diag_equiv, rotated]\n    wf_dbm_abstr_repair_equiv_FW[rotated] reset'_upd_equiv\n  have \"\\<forall>c\\<in>constraint_clk ` set (inv_of A l). 0 < c \\<and> c \\<le> n\"\n    using clock_range collect_clks_inv_clk_set[of A l] unfolding collect_clks_def by blast\n  moreover have\n    \"\\<forall>c\\<in>constraint_clk ` set (inv_of A l'). 0 < c \\<and> c \\<le> n\"\n    \"\\<forall>c\\<in>constraint_clk ` set (inv_of A l'). 0 < c\"\n    using clock_range collect_clks_inv_clk_set[of A l'] unfolding collect_clks_def by blast+\n  moreover have \"\\<forall>c\\<in>constraint_clk ` set g. 0 < c \\<and> c \\<le> n\" \"\\<forall>c\\<in>constraint_clk ` set g. 0 < c\"\n    using clock_range collect_clocks_clk_set[OF that(1)] unfolding collect_clks_def by blast+\n  moreover have \"\\<forall>i\\<in>set r. 0 < i \\<and> i \\<le> n\" \"\\<forall>i\\<in>set r. 0 < i\"\n    using clock_range reset_clk_set[OF that(1)] unfolding collect_clks_def by blast+\n  moreover note side_conds = calculation that(2)\n  note wf_intros =\n    wf_dbm_abstr_repair wf_dbm_reset'_upd wf_dbm_up_canonical_upd filter_diag_wf_dbm\n    wf_dbm_FW'_abstr_upd\n  note check_diag_intros =\n    reset'_upd_check_diag_preservation abstr_repair_check_diag_preservation\n  show ?thesis unfolding E_precise_op'_def E_precise_op_def\n    by simp (intro intros check_diag_intros side_conds wf_intros order.refl)\nqed\n\nlemma step_z_'_step_z_dbm'_equiv:\n  \"Bisimulation_Invariant\n     (\\<lambda> (l, D) (l', D'). \\<exists> a. step_z' (conv_A A) l D l' D')\n     (\\<lambda> (l, D) (l', D'). \\<exists> a. step_z_dbm' (conv_A A) l D v n a l' D')\n     (\\<lambda>(l, Z) (l', M). l = l' \\<and> [M]\\<^bsub>v,n\\<^esub> = Z)\n     (\\<lambda>(l, Z). True)\n     (\\<lambda>(l, y). True)\"\nproof (standard, goal_cases)\n  case prems: (1 a b a')\n  obtain l Z l' Z' l1 M where unfolds[simp]: \"a = (l, Z)\" \"b = (l', Z')\" \"a' = (l1, M)\"\n    by force+\n  from prems have [simp]: \"l1 = l\"\n    by auto\n  from prems have \"conv_A A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto> \\<langle>l', Z'\\<rangle>\" \"[M]\\<^bsub>v,n\\<^esub> = Z\"\n    by auto\n  from this(1) guess Z1 a\n    unfolding step_z'_def by safe\n  note Z1 = this\n  from step_z_dbm_DBM[OF Z1(1)[folded \\<open>_ = Z\\<close>]] guess M1 .\n  note M1 = this\n  from step_z_dbm_DBM[OF Z1(2)[unfolded \\<open>Z1 = _\\<close>]] guess Z2 .\n  with M1 Z1 show ?case\n    unfolding step_z_dbm'_def by auto\nnext\n  case prems: (2 a a' b')\n  obtain l M l' M' l1 Z where unfolds[simp]: \"a' = (l, M)\" \"b' = (l', M')\" \"a = (l1, Z)\"\n    by force+\n  from prems have [simp]: \"l1 = l\"\n    by auto\n  from prems obtain a1 where \"conv_A A \\<turnstile>' \\<langle>l, M\\<rangle> \\<leadsto>\\<^bsub>v,n,a1\\<^esub> \\<langle>l', M'\\<rangle>\" \"[M]\\<^bsub>v,n\\<^esub> = Z\"\n    by auto\n  from this(1) guess l1' Z1\n    unfolding step_z_dbm'_def by safe\n  note Z1 = this\n  then have [simp]: \"l1' = l\"\n    by (intro step_z_dbm_delay_loc)\n  from Z1 \\<open>_ = Z\\<close> show ?case\n    unfolding step_z'_def by (auto dest: step_z_dbm_sound)\nnext\n  case (3 a b)\n  then show ?case\n    by auto\nnext\n  case (4 a b)\n  then show ?case\n    by auto\nqed\n\nlemma step_z_dbm'_step_impl_precise_equiv:\n  \"Bisimulation_Invariant\n     (\\<lambda> (l, D) (l', D'). \\<exists> a. step_z_dbm' (conv_A A) l D v n a l' D')\n     (\\<lambda>(l, D) (l', D'). \\<exists>a. \\<langle>l, D\\<rangle> \\<leadsto>\\<^bsub>a\\<^esub> \\<langle>l', D'\\<rangle>)\n     (\\<lambda>(l, M) (l', D). l = l' \\<and> [curry (conv_M D)]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>)\n     (\\<lambda>(l, y). valid_dbm y)\n     wf_state\"\nproof (standard, goal_cases)\n  case prems: (1 a b a')\n  obtain l M l' M' l1 D where unfolds[simp]: \"a = (l, M)\" \"b = (l', M')\" \"a' = (l1, D)\"\n    by force+\n  from prems have [simp]: \"l1 = l\"\n    by auto\n  from prems obtain a1 where\n    \"step_z_dbm' (conv_A A) l M v n a1 l' M'\"\n    by auto\n  then obtain l2 M1 where steps:\n    \"conv_A A \\<turnstile> \\<langle>l,  M\\<rangle>  \\<leadsto>\\<^bsub>v,n,\\<tau>\\<^esub>   \\<langle>l2, M1\\<rangle>\"\n    \"conv_A A \\<turnstile> \\<langle>l2, M1\\<rangle> \\<leadsto>\\<^bsub>v,n,\\<upharpoonleft>a1\\<^esub> \\<langle>l', M'\\<rangle>\"\n    unfolding step_z_dbm'_def by auto\n  from step_z_dbm_equiv'[OF steps(1), of \"curry (conv_M D)\"] prems(2-) obtain M2 where\n    \"conv_A A \\<turnstile> \\<langle>l, curry (conv_M D)\\<rangle> \\<leadsto>\\<^bsub>v,n,\\<tau>\\<^esub> \\<langle>l2, M2\\<rangle>\" \"wf_dbm D\" \"[M1]\\<^bsub>v,n\\<^esub> = [M2]\\<^bsub>v,n\\<^esub>\"\n    by (auto simp: wf_state_def)\n  with step_impl_complete''_improved[OF this(1)] obtain D2 where D2:\n    \"A \\<turnstile>\\<^sub>I \\<langle>l, D\\<rangle> \\<leadsto>\\<^bsub>n,\\<tau>\\<^esub> \\<langle>l2, D2\\<rangle>\" \"[curry (conv_M D2)]\\<^bsub>v,n\\<^esub> = [M1]\\<^bsub>v,n\\<^esub>\"\n    by auto\n  from step_impl_wf_dbm[OF D2(1) \\<open>wf_dbm D\\<close>] have \"wf_dbm D2\" .\n  from step_z_dbm_equiv'[OF steps(2) sym[OF D2(2)]] obtain D3 where D3:\n    \"conv_A A \\<turnstile> \\<langle>l2, curry (conv_M D2)\\<rangle> \\<leadsto>\\<^bsub>v,n,\\<upharpoonleft>a1\\<^esub> \\<langle>l', D3\\<rangle>\" \"[M']\\<^bsub>v,n\\<^esub> = [D3]\\<^bsub>v,n\\<^esub>\"\n    by (elim conjE exE)\n  from step_impl_complete''_improved[OF D3(1) \\<open>wf_dbm D2\\<close>] obtain D4 where D4:\n    \"A \\<turnstile>\\<^sub>I \\<langle>l2, D2\\<rangle> \\<leadsto>\\<^bsub>n,\\<upharpoonleft>a1\\<^esub> \\<langle>l', D4\\<rangle>\" \"[curry (conv_M D4)]\\<^bsub>v,n\\<^esub> = [D3]\\<^bsub>v,n\\<^esub>\"\n    by auto\n  with D2(1) have \"\\<langle>l, D\\<rangle> \\<leadsto>\\<^bsub>a1\\<^esub> \\<langle>l', D4\\<rangle>\"\n    by auto\n  with D4(2) D3 show ?case\n    by force\nnext\n  case prems: (2 a a' b')\n  obtain l M l' D' l1 D where unfolds[simp]: \"a = (l, M)\" \"b' = (l', D')\" \"a' = (l1, D)\"\n    by force+\n  from prems have [simp]: \"l1 = l\"\n    by auto\n  from prems obtain a1 where \"\\<langle>l, D\\<rangle> \\<leadsto>\\<^bsub>a1\\<^esub> \\<langle>l', D'\\<rangle>\"\n    by auto\n  then obtain D1 where steps:\n    \"A \\<turnstile>\\<^sub>I \\<langle>l, D\\<rangle> \\<leadsto>\\<^bsub>n,\\<tau>\\<^esub> \\<langle>l, D1\\<rangle>\" \"A \\<turnstile>\\<^sub>I \\<langle>l, D1\\<rangle> \\<leadsto>\\<^bsub>n,\\<upharpoonleft>a1\\<^esub> \\<langle>l', D'\\<rangle>\"\n    by (auto dest: step_impl_delay_loc_eq)\n  from prems have \"wf_dbm D\"\n    by (auto simp: wf_state_def)\n  with steps have \"wf_dbm D1\"\n    by (blast intro: step_impl_wf_dbm)\n  from step_impl_sound'[OF steps(1)] \\<open>wf_dbm D\\<close> obtain M2 where M2:\n    \"conv_A A \\<turnstile> \\<langle>l, curry (conv_M D)\\<rangle> \\<leadsto>\\<^bsub>v,n,\\<tau>\\<^esub> \\<langle>l, M2\\<rangle>\"\n    \"[curry (conv_M D1)]\\<^bsub>v,n\\<^esub> = [M2]\\<^bsub>v,n\\<^esub>\"\n    using wf_dbm_D by auto\n  from step_impl_sound'[OF steps(2)] \\<open>wf_dbm D1\\<close> obtain M3 where M3:\n    \"step_z_dbm (conv_A A) l (curry (conv_M D1)) v n (\\<upharpoonleft>a1) l' M3\"\n    \"[curry (conv_M D')]\\<^bsub>v,n\\<^esub> = [M3]\\<^bsub>v,n\\<^esub>\"\n    using wf_dbm_D by auto\n  from step_z_dbm_equiv'[OF M2(1), of M] prems(2) obtain M2' where M2':\n    \"conv_A A \\<turnstile> \\<langle>l, M\\<rangle> \\<leadsto>\\<^bsub>v,n,\\<tau>\\<^esub> \\<langle>l, M2'\\<rangle>\" \"[M2]\\<^bsub>v,n\\<^esub> = [M2']\\<^bsub>v,n\\<^esub>\"\n    by auto\n  from step_z_dbm_equiv'[OF M3(1), of M2'] M2(2) M2'(2) obtain M3' where\n    \"conv_A A \\<turnstile> \\<langle>l, M2'\\<rangle> \\<leadsto>\\<^bsub>v,n,\\<upharpoonleft>a1\\<^esub> \\<langle>l', M3'\\<rangle>\" \"[M3]\\<^bsub>v,n\\<^esub> = [M3']\\<^bsub>v,n\\<^esub>\"\n    by auto\n  with M2'(1) M3(2) show ?case\n    unfolding step_z_dbm'_def by auto\nnext\n  case (3 a b)\n  then show ?case\n    unfolding step_z_dbm'_def using step_z_norm_valid_dbm'_spec step_z_valid_dbm' by auto\nnext\n  case (4 a b)\n  then show ?case\n    by (clarsimp simp: norm_step_wf_dbm step_impl_wf_dbm wf_state_def)\nqed\n\nlemma E_precise_op'_wf:\n  assumes \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l'\" \"wf_dbm M\"\n    shows \"wf_dbm (E_precise_op' l r g l' M)\"\nproof -\n  have \"\\<forall>c\\<in>constraint_clk ` set (inv_of A l). 0 < c \\<and> c \\<le> n\"\n    using clock_range collect_clks_inv_clk_set[of A l] unfolding collect_clks_def by blast\n  moreover have \"\\<forall>c\\<in>constraint_clk ` set (inv_of A l'). 0 < c \\<and> c \\<le> n\"\n    using clock_range collect_clks_inv_clk_set[of A l'] unfolding collect_clks_def by blast\n  moreover have \"\\<forall>c\\<in>constraint_clk ` set g. 0 < c \\<and> c \\<le> n\"\n    using clock_range collect_clocks_clk_set[OF assms(1)] unfolding collect_clks_def by blast\n  moreover have \"\\<forall>i\\<in>set r. 0 < i \\<and> i \\<le> n\"\n    using clock_range reset_clk_set[OF assms(1)] unfolding collect_clks_def by blast\n  moreover note side_conds = calculation assms(2)\n  note wf_intros =\n    wf_dbm_abstr_repair wf_dbm_reset'_upd wf_dbm_up_canonical_upd filter_diag_wf_dbm\n  show ?thesis\n    unfolding E_precise_op'_def by simp (intro wf_intros side_conds order.refl)\nqed\n\nsublocale E_precise_op': E_Precise_Bisim _ _ _ _ E_precise_op'\n  by standard (rule E_precise_op'_bisim E_precise_op'_wf; assumption)+\n\nlemma step_z_dbm'_final_bisim:\n  \"Bisimulation_Invariant\n     (\\<lambda> (l, D) (l', D'). \\<exists> a. step_z_dbm' (conv_A A) l D v n a l' D')\n     E_precise_op'.E_from_op\n     (\\<lambda> (l, M) (l', D'). l' = l \\<and> [curry (conv_M D')]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>)\n     (\\<lambda>(l, y). valid_dbm y) wf_state\"\n  by (rule Bisimulation_Invariant_sim_replace,\n      rule Bisimulation_Invariant_composition[\n        OF step_z_dbm'_step_impl_precise_equiv[folded E_precise_def] E_precise_op'.E_from_op_bisim\n      ]) (auto simp add: state_equiv_def dbm_equiv_def)\n\nend (* TA Start *)\n\ncontext E_Precise_Bisim\nbegin\n\ntheorem step_z_dbm'_mono:\n  assumes \"conv_A A \\<turnstile>' \\<langle>l, M\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', M'\\<rangle>\" and \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> [D]\\<^bsub>v,n\\<^esub>\"\n  shows \"\\<exists>D'. conv_A A \\<turnstile>' \\<langle>l, D\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', D'\\<rangle> \\<and> [M']\\<^bsub>v,n\\<^esub> \\<subseteq> [D']\\<^bsub>v,n\\<^esub>\"\n  using assms unfolding step_z_dbm'_def\n  apply clarsimp\n  apply (drule step_z_dbm_mono, assumption)\n  apply safe\n  apply (drule step_z_dbm_mono, assumption)\n  apply auto\n  done\n\ninterpretation\n  Bisimulation_Invariant\n  \"(\\<lambda> (l, D) (l', D'). \\<exists> a. step_z_dbm' (conv_A A) l D v n a l' D')\"\n  E_from_op\n  \"\\<lambda> (l, M) (l', D'). l' = l \\<and> [curry (conv_M D')]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>\"\n  \"\\<lambda>(l, y). valid_dbm y\"\n  wf_state\n  by (rule Bisimulation_Invariant_sim_replace,\n      rule Bisimulation_Invariant_composition[\n        OF step_z_dbm'_step_impl_precise_equiv[folded E_precise_def] E_from_op_bisim\n      ]) (auto simp add: state_equiv_def dbm_equiv_def)\n\nlemmas step_z_dbm'_E_from_op_bisim = Bisimulation_Invariant_axioms\n\ndefinition\n  \"E_from_op_empty \\<equiv> \\<lambda>(l, D) (l', D'). E_from_op (l, D) (l', D') \\<and> \\<not> check_diag n D'\"\n\ninterpretation bisim_empty:\n  Bisimulation_Invariant\n  \"\\<lambda>(l, M) (l', M'). \\<exists> a. step_z_dbm' (conv_A A) l M v n a l' M' \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n  \"\\<lambda>(l, D) (l', D'). E_from_op (l, D) (l', D') \\<and> \\<not> check_diag n D'\"\n  \"\\<lambda>(l, M) (l', D'). l' = l \\<and> [curry (conv_M D')]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>\"\n  \"\\<lambda>(l, y). valid_dbm y\"\n  wf_state\n  using step_z_dbm'_E_from_op_bisim apply (rule Bisimulation_Invariant_filter[\n        where FA = \"\\<lambda>(l', M'). [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\" and FB = \"\\<lambda>(l', D'). \\<not> check_diag n D'\"\n        ])\n  using canonical_check_diag_empty_iff canonical_empty_check_diag' by (auto simp: wf_state_def)\n\nlemmas step_z_dbm'_E_from_op_bisim_empty =\n  bisim_empty.Bisimulation_Invariant_axioms[folded E_from_op_empty_def]\n\nlemma E_from_op_mono:\n  assumes \"E_from_op (l,D) (l',D')\"\n    and   \"wf_dbm D\" \"wf_dbm M\"\n    and \"[curry (conv_M D)]\\<^bsub>v,n\\<^esub> \\<subseteq> [curry (conv_M M)]\\<^bsub>v,n\\<^esub>\"\n  shows \"\\<exists> M'. E_from_op (l,M) (l',M') \\<and> [curry (conv_M D')]\\<^bsub>v,n\\<^esub> \\<subseteq> [curry (conv_M M')]\\<^bsub>v,n\\<^esub>\"\nproof -\n  from B_A_step[OF assms(1), of \"(l, curry (conv_M D))\"] assms(2) obtain a D1 where D1:\n    \"conv_A A \\<turnstile>' \\<langle>l, curry (conv_M D)\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', D1\\<rangle>\" \"[D1]\\<^bsub>v,n\\<^esub> = [curry (conv_M D')]\\<^bsub>v,n\\<^esub>\"\n    unfolding wf_state_def by (force dest: wf_dbm_D)\n  from step_z_dbm'_mono[OF this(1) assms(4)] guess M1\n    by safe\n  note M1 = this\n  with A_B_step[of \"(l, curry (conv_M M))\" \"(l', M1)\" \"(l, M)\"] assms(3) obtain M2 where\n    \"E_from_op (l, M) (l', M2)\" \"[curry (conv_M M2)]\\<^bsub>v,n\\<^esub> = [M1]\\<^bsub>v,n\\<^esub>\"\n    unfolding wf_state_def by (force dest: wf_dbm_D)\n  with assms(3) M1(2) D1(2) show ?thesis\n    by auto\nqed\n\n(* XXX Duplication (E_mono') *)\nlemma E_from_op_mono':\n  assumes \"E_from_op (l,D) (l',D')\"\n    and   \"wf_dbm D\" \"wf_dbm M\"\n    and \"dbm_subset n D M\"\n  shows \"\\<exists> M'. E_from_op (l,M) (l',M') \\<and> dbm_subset n D' M'\"\n  using assms\n  apply -\n  apply (frule E_from_op_mono[where M = M], assumption+)\n   apply (subst dbm_subset_correct'', assumption+)\n   apply (rule dbm_subset_conv, assumption)\n  apply safe\n  apply (subst (asm) dbm_subset_correct'')\n  subgoal\n    using B_invariant[unfolded wf_state_def] by auto\n  subgoal\n    using B_invariant[unfolded wf_state_def] by auto\n  apply (blast intro: dbm_subset_conv_rev)\n  done\n\nlemma E_from_op_empty_mono':\n  assumes \"E_from_op_empty (l,D) (l',D')\"\n    and   \"wf_dbm D\" \"wf_dbm M\"\n    and \"dbm_subset n D M\"\n  shows \"\\<exists> M'. E_from_op_empty (l,M) (l',M') \\<and> dbm_subset n D' M'\"\n  using assms unfolding E_from_op_empty_def using check_diag_subset E_from_op_mono' by blast\n\nend (* E Precise Bisim *)\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Certification/Normalized_Zone_Semantics_Certification.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883449573377, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3304681234419158}}
{"text": "(*\n  File:     Pratt_Certificate_Code.thy\n  Author:   Manuel Eberl, TU München\n\n  Efficient checking of Pratt certificates using the code generator.\n  Evaluation on some big examples.\n*)\ntheory Pratt_Certificate_Code\nimports\n  Pratt_Certificate\n  \"HOL-Library.Code_Target_Numeral\"\nbegin\n\nsubsection \\<open>Code generation for Pratt certificates\\<close>\n\ntext \\<open>\n  The following one-time setup is required to set up code generation for the certificate\n  checking. Other theories importing this theories do not have to do this again.\n\\<close>\n\nsetup \\<open>\n  Context.theory_map (Pratt.setup_valid_cert_code_conv\n    (@{computation_check\n        terms: Trueprop valid_pratt_tree \"0::nat\" \"1::nat\" \"2::nat\" \"3::nat\" \"4::nat\"\n        datatypes: \"pratt_tree list\" \"nat \\<times> nat \\<times> pratt_tree list\" nat}))\n\\<close>\n\ntext \\<open>\n  We can now evaluate the efficiency of the procedure on some examples.\n\\<close>\n\nlemma \"prime (131059 :: nat)\"\n  by (pratt (code))\n\nlemma \"prime (100000007 :: nat)\"\n  by (pratt (code))\n\nlemma \"prime (8504276003 :: nat)\"\n  by (pratt (code))\n\nlemma \"prime (52759926861157 :: nat)\"\n  by (pratt (code))\n\nlemma \"prime (39070009756439177203 :: nat)\"\n  by (pratt (code)\n        \\<open>{39070009756439177203, 2, \n           {2, {3, 2, {2}}, {197, 2, {2, {7, 3, {2, {3, 2, {2}}}}}}, \n            {11018051256751037, 2, {2, {19, 2, {2, {3, 2, {2}}}}, \n              {1249, 7, {2, {3, 2, {2}}, {13, 2, {2, {3, 2, {2}}}}}}, \n              {116072344789, 2, {2, {3, 2, {2}}, \n                {3067, 2, {2, {3, 2, {2}}, {7, 3, {2, {3, 2, {2}}}}, \n                  {73, 5, {2, {3, 2, {2}}}}}}, \n                {3153797, 2, {2, {788449, 11, \n                   {2, {3, 2, {2}}, {43, 3, \n                     {2, {3, 2, {2}}, {7, 3, {2, {3, 2, {2}}}}}}, \n                    {191, 19, {2, {5, 2, {2}}, {19, 2, {2, {3, 2, {2}}}}}}}}}}}}}}}}\\<close>)\n\nlemma \"prime (933491553728809239092563013853810654040043466297416456476877 :: nat)\"\n  by (pratt (code)\n        \\<open>{933491553728809239092563013853810654040043466297416456476877, \n             2, {2, {38463351105299604725411, 6, \n               {2, {5, 2, {2}}, {13, 2, {2, {3, 2, {2}}}}, \n                {295871931579227728657, 5, \n                 {2, {3, 2, {2}}, {26041, 13, \n                   {2, {3, 2, {2}}, {5, 2, {2}}, {7, 3, {2, {3, 2, {2}}}}, \n                    {31, 3, {2, {3, 2, {2}}, {5, 2, {2}}}}}}, \n                  {29009, 3, {2, {7, 3, {2, {3, 2, {2}}}}, \n                    {37, 2, {2, {3, 2, {2}}}}}}, \n                  {39133, 5, {2, {3, 2, {2}}, \n                    {1087, 3, {2, {3, 2, {2}}, \n                      {181, 2, {2, {3, 2, {2}}, {5, 2, {2}}}}}}}}, \n                  {208511, 7, {2, {5, 2, {2}}, {29, 2, {2, {7, 3, {2, {3, 2, {2}}}}}}, \n                    {719, 11, {2, {359, 7, \n                       {2, {179, 2, {2, {89, 3, {2, {11, 2, {2, {5, 2, {2}}}}}}}}}}}}}}\n                   }}}}, {6067409149902371339956289140415169329, 3, \n               {2, {11, 2, {2, {5, 2, {2}}}}, \n                {103, 5, {2, {3, 2, {2}}, {17, 3, {2}}}}, \n                {7955023343, 7, {2, {7, 3, {2, {3, 2, {2}}}}, \n                  {79, 3, {2, {3, 2, {2}}, {13, 2, {2, {3, 2, {2}}}}}}, \n                  {1451, 2, {2, {5, 2, {2}}, {29, 2, {2, {7, 3, {2, {3, 2, {2}}}}}}}}, \n                  {4957, 2, {2, {3, 2, {2}}, {7, 3, {2, {3, 2, {2}}}}, \n                    {59, 2, {2, {29, 2, {2, {7, 3, {2, {3, 2, {2}}}}}}}}}}}}, \n                {8108847767, 5, {2, {4054423883, 2, \n                   {2, {2027211941, 2, {2, {5, 2, {2}}, {13, 2, {2, {3, 2, {2}}}}, \n                      {29, 2, {2, {7, 3, {2, {3, 2, {2}}}}}}, \n                      {268861, 6, {2, {3, 2, {2}}, {5, 2, {2}}, \n                        {4481, 3, {2, {5, 2, {2}}, {7, 3, {2, {3, 2, {2}}}}}}}}}}}}}}, \n                {5188630976471, 13, {2, {5, 2, {2}}, \n                  {518863097647, 5, {2, {3, 2, {2}}, \n                    {67, 2, {2, {3, 2, {2}}, {11, 2, {2, {5, 2, {2}}}}}}, \n                    {17881, 7, {2, {3, 2, {2}}, {5, 2, {2}}, \n                      {149, 2, {2, {37, 2, {2, {3, 2, {2}}}}}}}}, \n                    {24061, 10, {2, {3, 2, {2}}, {5, 2, {2}}, \n                      {401, 3, {2, {5, 2, {2}}}}}}}}}}}}}}\n\\<close>)\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pratt_Certificate/Pratt_Certificate_Code.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.33016563169757446}}
{"text": "section\\<open>Modelling the Adversary\\<close>\n\ntheory Adversary imports Message begin\n\nsubsection\\<open>Analysis\\<close>\n\ninductive_set\n  analz :: \"msg set \\<Rightarrow> msg set\"\n  for H :: \"msg set\"\n  where\n    Inj [intro,simp] : \"X \\<in> H \\<Longrightarrow> X \\<in> analz H\"\n  | Fst:     \"\\<lbrace>X,Y\\<rbrace> \\<in> analz H \\<Longrightarrow> X \\<in> analz H\"\n  | Snd:     \"\\<lbrace>X,Y\\<rbrace> \\<in> analz H \\<Longrightarrow> Y \\<in> analz H\"\n  | Decrypt [dest]: \n             \"\\<lbrakk>Crypt K X \\<in> analz H; Key(invKey K) \\<in> analz H\\<rbrakk>\n              \\<Longrightarrow> X \\<in> analz H\"\n\nlemma analz_mono: \"G\\<subseteq>H \\<Longrightarrow> analz(G) \\<subseteq> analz(H)\"\napply auto\napply (erule analz.induct) \napply (auto dest: analz.Fst analz.Snd) \ndone\n\nlemma MPair_analz [elim!]: \"\\<lbrakk> \\<lbrace>X,Y\\<rbrace> \\<in> analz H; \\<lbrakk>X \\<in> analz H; Y \\<in> analz H \\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\nby (blast dest: analz.Fst analz.Snd)\n\nlemma analz_increasing: \"H \\<subseteq> analz(H)\"\nby blast\n\nlemma analz_subset_parts: \"analz H \\<subseteq> parts H\"\napply (rule subsetI)\napply (erule analz.induct, blast+)\ndone\n\nlemmas analz_into_parts = analz_subset_parts [THEN subsetD]\n\nlemmas not_parts_not_analz = analz_subset_parts [THEN contra_subsetD]\n\nlemma parts_analz [simp]: \"parts (analz H) = parts H\"\napply (rule equalityI)\napply (rule analz_subset_parts [THEN parts_mono, THEN subset_trans], simp)\napply (blast intro: analz_increasing [THEN parts_mono, THEN subsetD])\ndone\n\nlemma analz_parts [simp]: \"analz (parts H) = parts H\"\napply auto\napply (erule analz.induct, auto)\ndone\n\nlemmas analz_insertI = subset_insertI [THEN analz_mono, THEN [2] rev_subsetD]\n\nlemma analz_empty [simp]: \"analz{} = {}\"\napply safe\napply (erule analz.induct, blast+)\ndone\n\nlemma analz_Un: \"analz(G) \\<union> analz(H) \\<subseteq> analz(G \\<union> H)\"\nby (intro Un_least analz_mono Un_upper1 Un_upper2)\n\nlemma analz_insert: \"insert X (analz H) \\<subseteq> analz(insert X H)\"\nby (blast intro: analz_mono [THEN [2] rev_subsetD])\n\nlemmas analz_insert_eq_I = equalityI [OF subsetI analz_insert]\n\nlemma analz_insert_Agent [simp]:\n     \"analz (insert (Agent agt) H) = insert (Agent agt) (analz H)\"\napply (rule analz_insert_eq_I) \napply (erule analz.induct, auto) \ndone\n\nlemma analz_insert_Nonce [simp]:\n     \"analz (insert (Nonce N) H) = insert (Nonce N) (analz H)\"\napply (rule analz_insert_eq_I) \napply (erule analz.induct, auto) \ndone\n\nlemma analz_insert_Key [simp]: \n    \"K \\<notin> keysFor (analz H) \\<Longrightarrow>   \n          analz (insert (Key K) H) = insert (Key K) (analz H)\"\napply (unfold keysFor_def)\napply (rule analz_insert_eq_I) \napply (erule analz.induct, auto) \ndone\n\nlemma analz_insert_MPair [simp]:\n     \"analz (insert \\<lbrace>X,Y\\<rbrace> H) =  \n          insert \\<lbrace>X,Y\\<rbrace> (analz (insert X (insert Y H)))\"\napply (rule equalityI)\napply (rule subsetI)\napply (erule analz.induct, auto)\napply (erule analz.induct)\napply (blast intro: analz.Fst analz.Snd)+\ndone\n\nlemma analz_insert_Crypt:\n     \"Key (invKey K) \\<notin> analz H \n      \\<Longrightarrow> analz (insert (Crypt K X) H) = insert (Crypt K X) (analz H)\"\napply (rule analz_insert_eq_I) \napply (erule analz.induct, auto) \ndone\n\nlemma lemma1: \"Key (invKey K) \\<in> analz H \\<Longrightarrow>   \n               analz (insert (Crypt K X) H) \\<subseteq>  \n               insert (Crypt K X) (analz (insert X H))\"\napply (rule subsetI)\napply (erule_tac x = x in analz.induct, auto)\ndone\n\nlemma lemma2: \"Key (invKey K) \\<in> analz H \\<Longrightarrow>   \n               insert (Crypt K X) (analz (insert X H)) \\<subseteq>  \n               analz (insert (Crypt K X) H)\"\napply auto\napply (erule_tac x = x in analz.induct, auto)\napply (blast intro: analz_insertI analz.Decrypt)\ndone\n\nlemma analz_insert_Decrypt:\n     \"Key (invKey K) \\<in> analz H \\<Longrightarrow>   \n               analz (insert (Crypt K X) H) =  \n               insert (Crypt K X) (analz (insert X H))\"\nby (intro equalityI lemma1 lemma2)\n\nlemma analz_Crypt_if [simp]:\n     \"analz (insert (Crypt K X) H) =                 \n          (if (Key (invKey K) \\<in> analz H)                 \n           then insert (Crypt K X) (analz (insert X H))  \n           else insert (Crypt K X) (analz H))\"\nby (simp add: analz_insert_Crypt analz_insert_Decrypt)\n\nlemma analz_insert_Crypt_subset:\n     \"analz (insert (Crypt K X) H) \\<subseteq>   \n           insert (Crypt K X) (analz (insert X H))\"\napply (rule subsetI)\napply (erule analz.induct, auto)\ndone\n\nlemma analz_image_Key [simp]: \"analz (Key`N) = Key`N\"\napply auto\napply (erule analz.induct, auto)\ndone\n\nlemma analz_analzD [dest!]: \"X\\<in> analz (analz H) \\<Longrightarrow> X\\<in> analz H\"\nby (erule analz.induct, blast+)\n\nlemma analz_idem [simp]: \"analz (analz H) = analz H\"\nby blast\n\nlemma analz_subset_iff [simp]: \"(analz G \\<subseteq> analz H) = (G \\<subseteq> analz H)\"\napply (rule iffI)\napply (iprover intro: subset_trans analz_increasing)  \napply (frule analz_mono, simp) \ndone\n\nlemma analz_trans: \"\\<lbrakk>X\\<in> analz G;  G \\<subseteq> analz H \\<rbrakk> \\<Longrightarrow> X\\<in> analz H\"\nby (drule analz_mono, blast)\n\nlemma analz_cut: \"\\<lbrakk>Y\\<in> analz (insert X H);  X\\<in> analz H \\<rbrakk> \\<Longrightarrow> Y\\<in> analz H\"\nby (erule analz_trans, blast)\n\nlemma analz_insert_eq: \"X\\<in> analz H \\<Longrightarrow> analz (insert X H) = analz H\"\nby (blast intro: analz_cut analz_insertI)\n\nlemma analz_subset_cong:\n     \"\\<lbrakk> analz G \\<subseteq> analz G'; analz H \\<subseteq> analz H'\\<rbrakk>\n      \\<Longrightarrow> analz (G \\<union> H) \\<subseteq> analz (G' \\<union> H')\"\napply simp\napply (iprover intro: conjI subset_trans analz_mono Un_upper1 Un_upper2) \ndone\n\nlemma analz_cong:\n     \"\\<lbrakk>analz G = analz G'; analz H = analz H'\\<rbrakk> \n      \\<Longrightarrow> analz (G \\<union> H) = analz (G' \\<union> H')\"\nby (intro equalityI analz_subset_cong, simp_all) \n\nlemma analz_insert_cong:\n     \"analz H = analz H' \\<Longrightarrow> analz(insert X H) = analz(insert X H')\"\nby (force simp only: insert_def intro!: analz_cong)\n\nlemma analz_trivial:\n     \"[| \\<forall>X Y. \\<lbrace>X,Y\\<rbrace> \\<notin> H;  \\<forall>X K. Crypt K X \\<notin> H |] ==> analz H = H\"\napply safe\napply (erule analz.induct, blast+)\ndone\n\nlemma analz_UN_analz_lemma:\n     \"X\\<in> analz (\\<Union>i\\<in>A. analz (H i)) \\<Longrightarrow> X\\<in> analz (\\<Union>i\\<in>A. H i)\"\napply (erule analz.induct)\napply (blast intro: analz_mono [THEN [2] rev_subsetD])+\ndone\n\nlemma analz_UN_analz [simp]: \"analz (\\<Union>i\\<in>A. analz (H i)) = analz (\\<Union>i\\<in>A. H i)\"\nby (blast intro: analz_UN_analz_lemma analz_mono [THEN [2] rev_subsetD])\n\nlemma gen_analz_insert_eq [rule_format]:\n     \"X \\<in> analz H \\<Longrightarrow> \\<forall>G. H \\<subseteq> G \\<longrightarrow> analz (insert X G) = analz G\"\nby (blast intro: analz_cut analz_insertI analz_mono [THEN [2] rev_subsetD])\n\nlemma analz_analz_Un [simp]: \"analz (analz G \\<union> H) = analz (G \\<union> H)\"\napply (intro equalityI analz_subset_cong)+\napply simp_all\ndone\n\nsubsubsection\\<open>Combinations of parts and analz\\<close>\n\nlemma analz_conj_parts [simp]:\n     \"(X \\<in> analz H & X \\<in> parts H) = (X \\<in> analz H)\"\nby (blast intro: analz_subset_parts [THEN subsetD])\n\nlemma analz_disj_parts [simp]:\n     \"(X \\<in> analz H | X \\<in> parts H) = (X \\<in> parts H)\"\nby (blast intro: analz_subset_parts [THEN subsetD])\n\nsubsection\\<open>Synthesis\\<close>\n\ninductive_set\n  synth :: \"msg set \\<Rightarrow> msg set\"\n  for H :: \"msg set\"\n  where\n    Inj    [intro]: \"X \\<in> H \\<Longrightarrow> X \\<in> synth H\"\n  | Agent  [intro]: \"Agent agt \\<in> synth H\"\n  | MPair  [intro]:\n              \"\\<lbrakk>X \\<in> synth H;  Y \\<in> synth H\\<rbrakk> \\<Longrightarrow> \\<lbrace>X,Y\\<rbrace> \\<in> synth H\"\n  | Crypt  [intro]:\n              \"\\<lbrakk>X \\<in> synth H;  Key K \\<in> H\\<rbrakk> \\<Longrightarrow> Crypt K X \\<in> synth H\"\nlemma synth_mono: \"G\\<subseteq>H \\<Longrightarrow> synth(G) \\<subseteq> synth(H)\"\n  by (auto, erule synth.induct, auto)  \n\ninductive_cases Key_synth   [elim!]: \"Key K \\<in> synth H\"\ninductive_cases MPair_synth [elim!]: \"\\<lbrace>X,Y\\<rbrace> \\<in> synth H\"\ninductive_cases Crypt_synth [elim!]: \"Crypt K X \\<in> synth H\"\ninductive_cases Nonce_synth [elim!]: \"Nonce n \\<in> synth H\"\n\nlemma synth_increasing: \"H \\<subseteq> synth(H)\"\nby blast\n\nlemma synth_Un: \"synth(G) \\<union> synth(H) \\<subseteq> synth(G \\<union> H)\"\nby (intro Un_least synth_mono Un_upper1 Un_upper2)\n\nlemma synth_insert: \"insert X (synth H) \\<subseteq> synth(insert X H)\"\nby (blast intro: synth_mono [THEN [2] rev_subsetD])\n\nlemma synth_synthD [dest!]: \"X\\<in> synth (synth H) \\<Longrightarrow> X\\<in> synth H\"\nby (erule synth.induct, blast+)\n\nlemma synth_idem: \"synth (synth H) = synth H\"\nby blast\n\nlemma synth_subset_iff [simp]: \"(synth G \\<subseteq> synth H) = (G \\<subseteq> synth H)\"\napply (rule iffI)\napply (iprover intro: subset_trans synth_increasing)  \napply (frule synth_mono, simp add: synth_idem) \ndone\n\nlemma synth_trans: \"\\<lbrakk>X\\<in> synth G;  G \\<subseteq> synth H\\<rbrakk> \\<Longrightarrow> X\\<in> synth H\"\nby (drule synth_mono, blast)\n\nlemma synth_cut: \"\\<lbrakk> Y\\<in> synth (insert X H);  X\\<in> synth H \\<rbrakk> \\<Longrightarrow> Y\\<in> synth H\"\nby (erule synth_trans, blast)\n\nlemma Nonce_synth_eq [simp]: \"(Nonce N \\<in> synth H) = (Nonce N \\<in> H)\"\nby blast\n\n\n\nlemma Crypt_synth_eq [simp]:\n     \"Key K \\<notin> H \\<Longrightarrow> (Crypt K X \\<in> synth H) = (Crypt K X \\<in> H)\"\nby blast\n\nlemma keysFor_synth [simp]: \n    \"keysFor (synth H) = keysFor H \\<union> invKey`{K. Key K \\<in> H}\"\nby (unfold keysFor_def, blast)\n\nsubsubsection\\<open>Combinations of parts and synth\\<close>\n\nlemma parts_synth [simp]: \"parts (synth H) = parts H \\<union> synth H\"\napply (rule equalityI)\napply (rule subsetI)\napply (erule parts.induct)\napply (blast intro: synth_increasing [THEN parts_mono, THEN subsetD] \n                    parts.Fst parts.Snd parts.Body)+\ndone\n\nlemma keysFor_parts_insert:\n     \"[| K \\<in> keysFor (parts (insert X G));  X \\<in> synth (analz H) |] \n      ==> K \\<in> keysFor (parts (G \\<union> H)) | Key (invKey K) \\<in> parts H\" \nby (force \n    dest!: parts_insert_subset_Un [THEN keysFor_mono, THEN [2] rev_subsetD]\n           analz_subset_parts [THEN keysFor_mono, THEN [2] rev_subsetD]\n    intro: analz_subset_parts [THEN subsetD] parts_mono [THEN [2] rev_subsetD])\n\nsubsubsection\\<open>Combinations of analz and synth\\<close>\n\nlemma analz_synth_Un [simp]: \"analz (synth G \\<union> H) = analz (G \\<union> H) \\<union> synth G\"\napply (rule equalityI)\napply (rule subsetI)\napply (erule analz.induct)\nprefer 5 apply (blast intro: analz_mono [THEN [2] rev_subsetD])\napply (blast intro: analz.Fst analz.Snd analz.Decrypt)+\ndone\n\nlemma analz_synth [simp]: \"analz (synth H) = analz H \\<union> synth H\"\napply (cut_tac H = \"{}\" in analz_synth_Un)\napply (simp (no_asm_use))\ndone\n\nlemma Fake_analz_insert:\n     \"X \\<in> synth (analz G) \\<Longrightarrow>  \n      analz (insert X H) \\<subseteq> synth (analz G) \\<union> analz (G \\<union> H)\"\napply (rule subsetI)\napply (subgoal_tac \"x \\<in> analz (synth (analz G) \\<union> H) \")\nprefer 2 apply (blast intro: analz_mono [THEN [2] rev_subsetD] analz_mono [THEN synth_mono, THEN [2] rev_subsetD])\napply (simp (no_asm_use))\napply blast\ndone\n\nlemma MPair_synth_analz [iff]:\n     \"(\\<lbrace>X,Y\\<rbrace> \\<in> synth (analz H)) =  \n      (X \\<in> synth (analz H) & Y \\<in> synth (analz H))\"\nby blast\n\nlemma synth_analz_mono: \"G\\<subseteq>H \\<Longrightarrow> synth (analz(G)) \\<subseteq> synth (analz(H))\"\nby (iprover intro: synth_mono analz_mono) \n\nlemma Fake_analz_eq [simp]:\n     \"X \\<in> synth(analz H) \\<Longrightarrow> synth (analz (insert X H)) = synth (analz H)\"\napply (drule Fake_analz_insert[of _ _ \"H\"])\napply (simp add: synth_increasing[THEN Un_absorb2])\napply (drule synth_mono)\napply (simp add: synth_idem)\napply (rule equalityI)\napply (simp add: )\napply (rule synth_analz_mono, blast)   \ndone\n\nlemma synth_analz_insert_eq [rule_format]:\n     \"X \\<in> synth (analz H) \n      \\<Longrightarrow> \\<forall>G. H \\<subseteq> G \\<longrightarrow> (Key K \\<in> analz (insert X G)) = (Key K \\<in> analz G)\"\napply (erule synth.induct) \napply (simp_all add: gen_analz_insert_eq subset_trans [OF _ subset_insertI]) \ndone\n\nlemma synth_analz_idem [simp]: \"synth (analz (synth (analz X)))=synth (analz X)\"\n  by (simp add: sup_absorb2 synth_idem synth_increasing)\n\nsubsubsection\\<open>Combinations of parts, analz, and synth\\<close>\n\nlemma Fake_parts_insert: \"X \\<in> synth (analz H) \\<Longrightarrow> parts (insert X H) \\<subseteq> synth (analz H) \\<union> parts H\"\napply (drule parts_insert_subset_Un)\napply (simp (no_asm_use))\napply blast\ndone\n\nlemma Fake_parts_insert_in_Un:\n     \"\\<lbrakk>Z \\<in> parts (insert X H);  X \\<in> synth (analz H)\\<rbrakk>\n      \\<Longrightarrow> Z \\<in>  synth (analz H) \\<union> parts H\"\nby (blast dest: Fake_parts_insert  [THEN subsetD])\n\nlemma Crypt_synth_analz:\n     \"\\<lbrakk> Key K \\<in> analz H;  Key (invKey K) \\<in> analz H \\<rbrakk>\n       \\<Longrightarrow> (Crypt K X \\<in> synth (analz H)) = (X \\<in> synth (analz H))\"\nby blast\n\nlemma Fake_parts_sing:\n     \"X \\<in> synth (analz H) \\<Longrightarrow> parts{X} \\<subseteq> synth (analz H) \\<union> parts H\"\napply (rule subset_trans) \n apply (erule_tac [2] Fake_parts_insert)\napply (rule parts_mono, blast)\n  done\n\nlemmas Fake_parts_sing_imp_Un = Fake_parts_sing [THEN [2] rev_subsetD]\n\ndeclare parts.Body [rule del]\n\nend", "meta": {"author": "ScottRWood", "repo": "Security-CA", "sha": "3b21dc043670ece81e7b9a70d9dda9049ca50622", "save_path": "github-repos/isabelle/ScottRWood-Security-CA", "path": "github-repos/isabelle/ScottRWood-Security-CA/Security-CA-3b21dc043670ece81e7b9a70d9dda9049ca50622/Adversary.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410572017153, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.33010607884242454}}
{"text": "(*  Title:      Native_Cast.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nchapter {* Conversions between unsigned words and between char *}\n\ntheory Native_Cast imports\n  \"~~/src/HOL/Library/Code_Char\"\n  Uint8\n  Uint16\n  Uint32\nbegin\n\ntext {* Auxiliary stuff *}\n\ncontext begin interpretation lifting_syntax .\n\nlemma char_of_integer_transfer [transfer_rule]:\n  \"(pcr_integer ===> op =) (\\<lambda>n. char_of_nat (nat n)) char_of_integer\"\nby(simp add: integer.pcr_cr_eq cr_integer_def rel_fun_def char_of_integer_def nat_of_integer_def)\n\nlemma integer_of_char_transfer [transfer_rule]:\n  \"(op = ===> pcr_integer) (\\<lambda>n. int (nat_of_char n)) integer_of_char\"\nby(simp add: integer.pcr_cr_eq cr_integer_def rel_fun_def integer_of_char_def)\n\nend\n\nlemma integer_of_char_char_of_integer [simp]:\n  \"0 \\<le> x \\<Longrightarrow> integer_of_char (char_of_integer x) = x mod 256\"\nunfolding integer_of_char_def char_of_integer_def o_apply nat_of_char_of_nat\nincluding integer.lifting by transfer(auto dest: nat_mod_distrib[of _ 256, symmetric])\n\nlemma char_of_integer_integer_of_char [simp]:\n  \"char_of_integer (integer_of_char x) = x\"\nby(simp add: integer_of_char_def char_of_integer_def)\n\nlemma int_lt_numeral [simp]: \"int x < numeral n \\<longleftrightarrow> x < numeral n\"\nby (metis nat_numeral zless_nat_eq_int_zless)\n\nlemma int_of_integer_ge_0: \"0 \\<le> int_of_integer x \\<longleftrightarrow> 0 \\<le> x\"\nincluding integer.lifting by transfer simp\n\nlemma integer_of_char_ge_0 [simp]: \"0 \\<le> integer_of_char x\"\nincluding integer.lifting by transfer simp\n\n\nsection {* Conversions between @{typ uint8} and @{typ char} *}\n\ndefinition uint8_of_char :: \"char \\<Rightarrow> uint8\"\nwhere \"uint8_of_char = Uint8 \\<circ> integer_of_char\"\n\ndefinition char_of_uint8 :: \"uint8 \\<Rightarrow> char\"\nwhere \"char_of_uint8 = char_of_integer \\<circ> integer_of_int \\<circ> uint \\<circ> Rep_uint8'\"\n\nlemma uint8_of_char_char_of_uint8 [simp]:\n  \"uint8_of_char (char_of_uint8 x) = x\"\napply(simp add: uint8_of_char_def char_of_uint8_def)\nincluding integer.lifting apply transfer\napply(simp add: mod_pos_pos_trivial uint_bounded[where ?'a=8, simplified])\ndone\n\nlemma char_of_uint8_uint8_of_char [simp]:\n  \"char_of_uint8 (uint8_of_char x) = x\"\nproof -\n  have \"char_of_uint8 (uint8_of_char x) = \n    char_of_integer (of_int (int_of_integer (integer_of_char x) mod 256))\"\n    by(simp add: uint8_of_char_def char_of_uint8_def Uint8.rep_eq uint_word_of_int)\n  also { have \"int_of_integer (integer_of_char x) < 256\"\n      including integer.lifting by transfer(simp add: nat_of_char_less_256) }\n  hence \"\\<dots> = x\"\n    by(simp add: semiring_numeral_div_class.mod_less int_of_integer_ge_0)\n  finally show ?thesis .\nqed\n\ncode_printing code_module Native_Casts \\<rightharpoonup> (Haskell)\n{*import qualified Data.Char;\n\nord :: Char -> Int;\nord = Data.Char.ord;\n\nchr :: Int -> Char;\nchr = Data.Char.chr;\n*}\ncode_reserved Haskell Native_Casts\n\ncode_printing constant uint8_of_char \\<rightharpoonup>\n  (SML) \"Word8.fromInt (Char.ord _)\" and\n  (Haskell) \"(Prelude.fromIntegral (Native'_Casts.ord _) :: Uint8.Word8)\" and\n  (Scala) \"_.toByte\"\n| constant char_of_uint8 \\<rightharpoonup>\n  (SML) \"Char.chr (Word8.toInt _)\" and\n  (Haskell) \"Native'_Casts.chr (Prelude.fromIntegral _)\" and\n  (Scala) \"((_).toInt & 0xFF).toChar\"\n\nsection {* Conversion between native words *}\n\nlift_definition uint8_of_uint32 :: \"uint32 \\<Rightarrow> uint8\" is ucast .\nlift_definition uint8_of_uint16 :: \"uint16 \\<Rightarrow> uint8\" is ucast .\n\nlift_definition uint16_of_uint8 :: \"uint8 \\<Rightarrow> uint16\" is ucast .\nlift_definition uint16_of_uint32 :: \"uint32 \\<Rightarrow> uint16\" is ucast .\n\nlift_definition uint32_of_uint8 :: \"uint8 \\<Rightarrow> uint32\" is ucast .\nlift_definition uint32_of_uint16 :: \"uint16 \\<Rightarrow> uint32\" is ucast .\n\ncode_printing\n  constant uint8_of_uint16 \\<rightharpoonup>\n  (SML_word) \"Word8.fromLarge (Word16.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint8.Word8)\" and\n  (Scala) \"_.toByte\"\n| constant uint8_of_uint32 \\<rightharpoonup>\n  (SML) \"Word8.fromLarge (Word32.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint8.Word8)\" and\n  (Scala) \"_.toByte\"\n| constant uint16_of_uint8 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLarge (Word8.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint16.Word16)\" and\n  (Scala) \"((_).toInt & 0xFF).toChar\"\n| constant uint16_of_uint32 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLarge (Word32.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint16.Word16)\" and\n  (Scala) \"_.toChar\"\n| constant uint32_of_uint8 \\<rightharpoonup>\n  (SML) \"Word32.fromLarge (Word8.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint32.Word32)\" and\n  (Scala) \"((_).toInt & 0xFF)\"\n| constant uint32_of_uint16 \\<rightharpoonup>\n  (SML_word) \"Word32.fromLarge (Word16.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint32.Word32)\" and\n  (Scala) \"(_).toInt\"\n\ntext {* \n  Use @{const Abs_uint8'} etc. instead of @{const Rep_uint8} in code equations\n  for conversion functions to avoid exceptions during code generation when the\n  target language provides only some of the uint types.\n*}\n\nlemma uint8_of_uint16_code [code]:\n  \"uint8_of_uint16 x = Abs_uint8' (ucast (Rep_uint16' x))\"\nby transfer simp\n\nlemma uint8_of_uint32_code [code]:\n  \"uint8_of_uint32 x = Abs_uint8' (ucast (Rep_uint32' x))\"\nby transfer simp\n\nlemma uint16_of_uint8_code [code]:\n  \"uint16_of_uint8 x = Abs_uint16' (ucast (Rep_uint8' x))\"\nby transfer simp\n\nlemma uint16_of_uint32_code [code]:\n  \"uint16_of_uint32 x = Abs_uint16' (ucast (Rep_uint32' x))\"\nby transfer simp\n\nlemma uint32_of_uint8_code [code]:\n  \"uint32_of_uint8 x = Abs_uint32' (ucast (Rep_uint8' x))\"\nby transfer simp\n\nlemma uint32_of_uint16_code [code]:\n  \"uint32_of_uint16 x = Abs_uint32' (ucast (Rep_uint16' x))\"\nby transfer simp\n\nend", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Native_Word/Native_Cast.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3301060722590912}}
{"text": "(*  Title:      JinjaDCI/BV/LBVJVM.thy\n\n    Author:     Tobias Nipkow, Gerwin Klein, Susannah Mansky\n    Copyright   2000 TUM, 2020 UIUC\n\n    Based on the Jinja theory BV/LBVJVM.thy by Tobias Nipkow and Gerwin Klein\n*)\n\nsection \\<open> LBV for the JVM \\label{sec:JVM} \\<close>\n\ntheory LBVJVM\nimports Jinja.Abstract_BV TF_JVM\nbegin\n\ntype_synonym prog_cert = \"cname \\<Rightarrow> mname \\<Rightarrow> ty\\<^sub>i' err list\"\n\ndefinition check_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> bool\"\nwhere\n  \"check_cert P mxs mxl n cert \\<equiv> check_types P mxs mxl cert \\<and> size cert = n+1 \\<and>\n                                 (\\<forall>i<n. cert!i \\<noteq> Err) \\<and> cert!n = OK None\"\n\ndefinition lbvjvm :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> \n             ty\\<^sub>i' err list \\<Rightarrow> instr list \\<Rightarrow> ty\\<^sub>i' err \\<Rightarrow> ty\\<^sub>i' err\"\nwhere\n  \"lbvjvm P mxs maxr T\\<^sub>r et cert bs \\<equiv>\n  wtl_inst_list bs cert (JVM_SemiType.sup P mxs maxr) (JVM_SemiType.le P mxs maxr) Err (OK None) (exec P mxs T\\<^sub>r et bs) 0\"\n\ndefinition wt_lbv :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> staticb \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n             ex_table \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> instr list \\<Rightarrow> bool\"\nwhere\n  \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 et cert ins \\<equiv> (b = Static \\<or> b = NonStatic) \\<and>\n   check_cert P mxs ((case b of Static \\<Rightarrow> 0 | NonStatic \\<Rightarrow> 1)+size Ts+mxl\\<^sub>0) (size ins) cert \\<and>\n   0 < size ins \\<and> \n   (let start  = Some ([],(case b of Static \\<Rightarrow> [] | NonStatic \\<Rightarrow> [OK (Class C)])\n                            @((map OK Ts))@(replicate mxl\\<^sub>0 Err));\n        result = lbvjvm P mxs ((case b of Static \\<Rightarrow> 0 | NonStatic \\<Rightarrow> 1)+size Ts+mxl\\<^sub>0) T\\<^sub>r et cert ins (OK start)\n    in result \\<noteq> Err)\"\n\ndefinition wt_jvm_prog_lbv :: \"jvm_prog \\<Rightarrow> prog_cert \\<Rightarrow> bool\"\nwhere\n  \"wt_jvm_prog_lbv P cert \\<equiv>\n  wf_prog (\\<lambda>P C (mn,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)). wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 et (cert C mn) ins) P\"\n\ndefinition mk_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> instr list \n              \\<Rightarrow> ty\\<^sub>m \\<Rightarrow> ty\\<^sub>i' err list\"\nwhere\n  \"mk_cert P mxs T\\<^sub>r et bs phi \\<equiv> make_cert (exec P mxs T\\<^sub>r et bs) (map OK phi) (OK None)\"\n\ndefinition prg_cert :: \"jvm_prog \\<Rightarrow> ty\\<^sub>P \\<Rightarrow> prog_cert\"\nwhere\n  \"prg_cert P phi C mn \\<equiv> let (C,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)) = method P C mn\n                         in  mk_cert P mxs T\\<^sub>r et ins (phi C mn)\"\n   \nlemma check_certD [intro?]:\n  \"check_cert P mxs mxl n cert \\<Longrightarrow> cert_ok cert n Err (OK None) (states P mxs mxl)\"\n  by (unfold cert_ok_def check_cert_def check_types_def) auto\n\n\nlemma (in start_context) wt_lbv_wt_step:\n  assumes lbv: \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"\n  shows \"\\<exists>\\<tau>s \\<in> nlists (size is) A. wt_step r Err step \\<tau>s \\<and> OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\"\n(*<*)\nproof -\n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover note bounded_step\n  moreover from lbv have \"cert_ok cert (size is) Err (OK None) A\"\n    by (unfold wt_lbv_def) (auto dest: check_certD)\n  moreover note exec_pres_type\n  moreover\n  from lbv \n  have \"wtl_inst_list is cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (cases b; simp add: wt_lbv_def lbvjvm_def step_def_exec [symmetric])\n  moreover note first_in_A\n  moreover from lbv have \"0 < size is\" by (simp add: wt_lbv_def)\n  ultimately show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])\nqed\n(*>*)\n\n\nlemma (in start_context) wt_lbv_wt_method:\n  assumes lbv: \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"  \n  shows \"\\<exists>\\<tau>s. wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n(*<*)\nproof -\n  from lbv have l: \"is \\<noteq> []\" and  \n             stab: \"b = Static \\<or> b = NonStatic\" by (auto simp add: wt_lbv_def)\n  moreover\n  from wf lbv C Ts obtain \\<tau>s where \n    list:  \"\\<tau>s \\<in> nlists (size is) A\" and\n    step:  \"wt_step r Err step \\<tau>s\" and    \n    start: \"OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\" \n    by (blast dest: wt_lbv_wt_step)\n  from list have [simp]: \"size \\<tau>s = size is\" by simp\n  have \"size (map ok_val \\<tau>s) = size is\" by simp  \n  moreover from l have 0: \"0 < size \\<tau>s\" by simp\n  with step obtain \\<tau>s0 where \"\\<tau>s!0 = OK \\<tau>s0\"\n    by (unfold wt_step_def) blast\n  with start 0 have \"wt_start P C b Ts mxl\\<^sub>0 (map ok_val \\<tau>s)\"\n    by (cases b; simp add: wt_start_def JVM_le_Err_conv lesub_def Err.le_def)    \n  moreover {\n    from list have \"check_types P mxs mxl \\<tau>s\" by (simp add: check_types_def)\n    also from step  have \"\\<forall>x \\<in> set \\<tau>s. x \\<noteq> Err\" \n      by (auto simp add: all_set_conv_all_nth wt_step_def)    \n    hence [symmetric]: \"map OK (map ok_val \\<tau>s) = \\<tau>s\"\n      by (auto intro!: map_idI)\n    finally have \"check_types P mxs mxl (map OK (map ok_val \\<tau>s))\" .\n  }\n  moreover {  \n    note bounded_step\n    moreover from list have \"set \\<tau>s \\<subseteq> A\" by simp\n    moreover from step have \"wt_err_step (sup_state_opt P) step \\<tau>s\"\n      by (simp add: wt_err_step_def JVM_le_Err_conv)\n    ultimately have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\<tau>s)\"\n      by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def states_def)\n  }    \n  ultimately have \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\<tau>s)\"\n    by (simp add: wt_method_def2 check_types_def del: map_map)\n  thus ?thesis ..\nqed\n(*>*)\n\n  \nlemma (in start_context) wt_method_wt_lbv:\n  assumes wt: \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\" \n  defines [simp]: \"cert \\<equiv> mk_cert P mxs T\\<^sub>r xt is \\<tau>s\"\n  \n  shows \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\" \n(*<*)\nproof -\n  let ?\\<tau>s  = \"map OK \\<tau>s\"\n  let ?cert = \"make_cert step ?\\<tau>s (OK None)\"\n\n  from wt obtain \n    0:        \"0 < size is\" and\n    size:     \"size is = size ?\\<tau>s\" and\n    ck_types: \"check_types P mxs mxl ?\\<tau>s\" and\n    wt_start: \"wt_start P C b Ts mxl\\<^sub>0 \\<tau>s\" and\n    app_eff:  \"wt_app_eff (sup_state_opt P) app eff \\<tau>s\"\n    by (force simp add: wt_method_def2 check_types_def) \n  \n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover from wf have \"mono r step (size is) A\" by (rule step_mono)\n  hence \"mono r step (size ?\\<tau>s) A\" by (simp add: size)\n  moreover from exec_pres_type \n  have \"pres_type step (size ?\\<tau>s) A\" by (simp add: size) \n  moreover\n  from ck_types have \\<tau>s_in_A: \"set ?\\<tau>s \\<subseteq> A\" by (simp add: check_types_def)\n  hence \"\\<forall>pc. pc < size ?\\<tau>s \\<longrightarrow> ?\\<tau>s!pc \\<in> A \\<and> ?\\<tau>s!pc \\<noteq> Err\" by auto\n  moreover from bounded_step \n  have \"bounded step (size ?\\<tau>s)\" by (simp add: size)\n  moreover have \"OK None \\<noteq> Err\" by simp\n  moreover from bounded_step size \\<tau>s_in_A app_eff\n  have \"wt_err_step (sup_state_opt P) step ?\\<tau>s\"\n    by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def states_def)    \n  hence \"wt_step r Err step ?\\<tau>s\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  moreover\n  from 0 size have \"0 < size \\<tau>s\" by auto\n  hence \"?\\<tau>s!0 = OK (\\<tau>s!0)\" by simp\n  with wt_start have \"OK first \\<sqsubseteq>\\<^sub>r ?\\<tau>s!0\"\n    by (cases b; clarsimp simp add: wt_start_def lesub_def Err.le_def JVM_le_Err_conv)\n  moreover note first_in_A\n  moreover have \"OK first \\<noteq> Err\" by simp\n  moreover note size \n  ultimately\n  have \"wtl_inst_list is ?cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])\n  moreover from 0 size have \"\\<tau>s \\<noteq> []\" by auto\n  moreover from ck_types have \"check_types P mxs mxl ?cert\"\n    by (fastforce simp: make_cert_def check_types_def JVM_states_unfold\n                  dest!: nth_mem)\n  moreover note 0 size\n  ultimately show ?thesis using staticb\n    by (simp add: wt_lbv_def lbvjvm_def mk_cert_def step_def_exec [symmetric]\n                  check_cert_def make_cert_def nth_append)\nqed  \n(*>*)\n\n\n\ntheorem jvm_lbv_correct:\n  \"wt_jvm_prog_lbv P Cert \\<Longrightarrow> wf_jvm_prog P\"\n(*<*)\nproof -  \n  let ?\\<Phi> = \"\\<lambda>C mn. let (C,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)) = method P C mn in \n              SOME \\<tau>s. wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n  \n  let ?A = \"\\<lambda>P C (mn,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)). wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 et (Cert C mn) ins\"\n  let ?B = \"\\<lambda>P C (M,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). \n                wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (?\\<Phi> C M)\"\n\n  assume wt: \"wt_jvm_prog_lbv P Cert\"\n  then have \"wf_prog ?A P\" by(simp add: wt_jvm_prog_lbv_def)\n  moreover {\n    fix wf_md C M b Ts Ca T m bd\n    \n    assume ass1: \"wf_prog wf_md P\" and sees: \"P \\<turnstile> Ca sees M, b :  Ts\\<rightarrow>T = m in Ca\" and\n           ass2: \"set Ts \\<subseteq> types P\" and ass3: \"bd = (M, b, Ts, T, m)\" and\n           ass4: \"?A P Ca bd\"\n    from ass3 ass4 have stab: \"b = Static \\<or> b = NonStatic\" by (simp add:wt_lbv_def)        \n    from ass1 sees ass2 ass3 ass4 have \"?B P Ca bd\" using sees_method_is_class[OF sees] \n      by (auto  dest!: start_context.wt_lbv_wt_method [OF start_context_intro_auxi[OF stab]]\n               intro: someI)  \n  }\n  ultimately have \"wf_prog ?B P\" by(rule wf_prog_lift)\n  hence \"wf_jvm_prog\\<^bsub>?\\<Phi>\\<^esub> P\" by (simp add: wf_jvm_prog_phi_def)\n  thus ?thesis by (unfold wf_jvm_prog_def) blast\nqed\n(*>*)\n\ntheorem jvm_lbv_complete:\n  assumes wt: \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\" \n  shows \"wt_jvm_prog_lbv P (prg_cert P \\<Phi>)\"\n(*<*)\nproof -\n  let ?cert = \"prg_cert P \\<Phi>\"\n  let ?A = \"\\<lambda>P C (M,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). \n                wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (\\<Phi> C M)\"\n  let ?B = \"\\<lambda>P C (mn,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)).\n                wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 et (?cert C mn) ins\"\n\n  from wt have \"wf_prog ?A P\" by(clarsimp simp: wf_jvm_prog_def wf_jvm_prog_phi_def)\n  moreover {\n    fix wf_md C M b Ts Ca T m bd\n    assume ass1: \"wf_prog wf_md P\" and sees: \"P \\<turnstile> Ca sees M, b :  Ts\\<rightarrow>T = m in Ca\" and\n           ass2: \"set Ts \\<subseteq> types P\" and ass3: \"bd = (M, b, Ts, T, m)\" and\n           ass4: \"?A P Ca bd\"\n    from ass3 ass4 have stab: \"b = Static \\<or> b = NonStatic\" by (simp add:wt_method_def)\n    from ass1 sees ass2 ass3 ass4 have \"?B P Ca bd\" using sees_method_is_class[OF sees]  \n      by (auto simp add: prg_cert_def \n               intro!: start_context.wt_method_wt_lbv start_context_intro_auxi[OF stab])\n  }\n  ultimately have \"wf_prog ?B P\" by(rule wf_prog_lift)\n  thus \"wt_jvm_prog_lbv P (prg_cert P \\<Phi>)\" by (simp add: wt_jvm_prog_lbv_def)\nqed\n(*>*)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/BV/LBVJVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3301060722590912}}
{"text": "theory PhiSem_CF_Routine_Basic\n  imports PhiSem_CF_Basic\nbegin\n\nsection \\<open>Routine\\<close>\n\ntext \\<open>Procedure in \\<open>\\<phi>\\<close>-system is a program segment, which does not correspond to a function\n  in the target language necessarily. To model them, we formalize a specific semantic statement\n  and we call them \\<^emph>\\<open>routine\\<close> to distinguish with \\<^emph>\\<open>procedure\\<close>.\\<close>\n\ndefinition op_routine_basic :: \\<open>TY list \\<Rightarrow> TY list \\<Rightarrow> ('a::FIX_ARITY_VALs, 'b::FIX_ARITY_VALs) proc' \\<Rightarrow> ('a,'b) proc'\\<close>\n  where \\<open>op_routine_basic argtys rettys F = (\\<lambda>args.\n      \\<phi>M_assert (args \\<in> Well_Typed_Vals argtys)\n   \\<ggreater> F args\n  \\<bind> (\\<lambda>rets. \\<phi>M_assert (rets \\<in> Well_Typed_Vals rettys)\n           \\<ggreater> Return rets))\\<close>\n\nlemma \"__routine_basic__\":\n  \\<open> \\<phi>_Have_Types X TY_ARGs\n\\<Longrightarrow> \\<phi>_Have_Types Y TY_RETs\n\\<Longrightarrow> \\<r>Success\n\\<Longrightarrow> (\\<And>(vs:: 'a::FIX_ARITY_VALs \\<phi>arg <named> 'names).\n          \\<p>\\<r>\\<o>\\<c> F (case_named id vs) \\<lbrace> X (case_named id vs) \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E)\n\\<Longrightarrow> \\<p>\\<r>\\<o>\\<c> op_routine_basic TY_ARGs TY_RETs F vs \\<lbrace> X vs \\<longmapsto> Y \\<rbrace> \\<t>\\<h>\\<r>\\<o>\\<w>\\<s> E\\<close>\n  unfolding op_routine_basic_def \\<phi>_Have_Types_def named_All named.case id_apply\n  by (rule \\<phi>SEQ, rule \\<phi>SEQ, rule \\<phi>M_assert, blast, assumption, rule \\<phi>SEQ,\n      rule \\<phi>M_assert, blast, rule \\<phi>M_Success')\n\nML_file \\<open>library/cf_routine.ML\\<close>\n\nattribute_setup routine_basic =\n  \\<open>Scan.succeed (Phi_Modifier.wrap_to_attribute\n                    (PhiSem_Control_Flow.routine_mod I (K I) @{thm \"__routine_basic__\"}))\\<close>\n\n\n\nend", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_Semantics/PhiSem_CF_Routine_Basic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6654105454764747, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3301060656757578}}
{"text": "(*******************************************************************************\n\n  Project: Development of Security Protocols by Refinement\n\n  Module:  Auth_simple/m3_enc.thy (Isabelle/HOL 2016-1)\n  ID:      $Id: m3_enc.thy 133852 2017-03-20 15:59:33Z csprenge $\n  Author:  Christoph Sprenger, ETH Zurich <sprenger@inf.ethz.ch>\n  \n  One-Way authentication protocols\n  Refinement 3: protocol using public-key encryption and Dolev-Yao intruder\n\n  Copyright (c) 2009-2016 Christoph Sprenger \n  Licence: LGPL\n\n*******************************************************************************)\n\nsection \\<open>Refinement 3b: Encryption-based Dolev-Yao Protocol (Variant A)\\<close>\n\ntheory m3_enc imports m2_confid_chan \"../Refinement/Message\"\nbegin\n\ntext \\<open>This refines the channel protocol using public-key encryption and\nadds a full-fledged Dolev-Yao adversary.  In this variant, the adversary is \nrealized using Paulson's message derivation closure operators (as opposed to\na collection of one-step message construction and decomposition events a la \nStrand spaces).\\<close>\n\ntext \\<open>Proof tool configuration. Avoid annoying automatic unfolding of\n\\<open>dom\\<close> (again).\\<close>\n\ndeclare domIff [simp, iff del]\n\n\ntext \\<open>A general lemma about \\<open>parts\\<close> (move?!).\\<close>\n\nlemmas parts_insertD = parts_insert [THEN equalityD1, THEN subsetD]\n\n\n(******************************************************************************)\nsubsection \\<open>State and observations\\<close>\n(******************************************************************************)\n\ntext \\<open>We extend the state of @{term m1} with two confidential channels\nbetween each pair of agents, one channel for each protocol message.\\<close>\n\nrecord m3_state = m1_state +\n  IK :: \"msg set\"                                 \\<comment> \\<open>intruder knowledge\\<close>\n\n\ntext \\<open>Observations: local agent states.\\<close>\n\ntype_synonym \n  m3_obs = m1_obs\n\ndefinition \n  m3_obs :: \"m3_state \\<Rightarrow> m3_obs\" where\n  \"m3_obs s \\<equiv> \\<lparr> \n     runs = runs s\n  \\<rparr>\"\n\n\n(******************************************************************************)\nsubsection \\<open>Events\\<close>\n(******************************************************************************)\n\ndefinition\n  m3_step1 :: \"[rid_t, agent, agent, nonce] \\<Rightarrow> (m3_state \\<times> m3_state) set\"\nwhere\n  \"m3_step1 Ra A B Na \\<equiv> {(s, s1).\n\n     \\<comment> \\<open>guards:\\<close>\n     Ra \\<notin> dom (runs s) \\<and>\n     Na = Ra$0 \\<and>\n\n     \\<comment> \\<open>actions:\\<close>\n     s1 = s\\<lparr>\n       runs := (runs s)(Ra \\<mapsto> (Init, [A, B], [])), \n       IK := insert (Crypt (pubK B) \\<lbrace>Nonce Na, Agent A\\<rbrace>)  (IK s)\n     \\<rparr>\n  }\"\n\ndefinition\n  m3_step2 :: \n    \"[rid_t, agent, agent, nonce, nonce] \\<Rightarrow> (m3_state \\<times> m3_state) set\"\nwhere\n  \"m3_step2 Rb A B Na Nb \\<equiv> {(s, s1).\n\n     \\<comment> \\<open>guards\\<close>\n     Rb \\<notin> dom (runs s) \\<and>\n     Nb = Rb$0 \\<and>\n\n     Crypt (pubK B) \\<lbrace>Nonce Na, Agent A\\<rbrace> \\<in> IK s \\<and>      \\<comment> \\<open>receive msg 1\\<close>\n\n     \\<comment> \\<open>actions\\<close>\n     s1 = s\\<lparr> \n       runs := (runs s)(Rb \\<mapsto> (Resp, [A, B], [aNon Na])), \n       IK := insert (Crypt (pubK A) \\<lbrace>Nonce Na, Nonce Nb, Agent B\\<rbrace>) (IK s) \n     \\<rparr>  \n  }\"\n\ndefinition\n  m3_step3 :: \"[rid_t, agent, agent, nonce, nonce] \\<Rightarrow> (m3_state \\<times> m3_state) set\"\nwhere\n  \"m3_step3 Ra A B Na Nb \\<equiv> {(s, s1).\n\n     \\<comment> \\<open>guards\\<close>\n     runs s Ra = Some (Init, [A, B], []) \\<and>\n     Na = Ra$0 \\<and>\n\n     Crypt (pubK A) \\<lbrace>Nonce Na, Nonce Nb, Agent B\\<rbrace> \\<in> IK s \\<and>   \\<comment> \\<open>recv msg2\\<close>\n\n     \\<comment> \\<open>actions\\<close>\n     s1 = s\\<lparr> \n       runs := (runs s)(Ra \\<mapsto> (Init, [A, B], [aNon Nb]))\n     \\<rparr>  \n  }\"\n\n\ntext \\<open>Standard Dolev-Yao intruder.\\<close>\n\ndefinition \n  m3_DY_fake :: \"(m3_state \\<times> m3_state) set\"\nwhere\n  \"m3_DY_fake \\<equiv> {(s, s1).\n\n     \\<comment> \\<open>actions:\\<close>\n     s1 = s\\<lparr> IK := synth (analz (IK s)) \\<rparr>  \n  }\"\n\n\ntext \\<open>Transition system.\\<close>\n\ndefinition \n  m3_init :: \"m3_state set\" \nwhere\n  \"m3_init \\<equiv> { \\<lparr> \n     runs = Map.empty, \n     IK = (Key`priK`bad) \\<union> (Key`range pubK) \\<union> (Key`shrK`bad) \n  \\<rparr> }\"\n\ndefinition \n  m3_trans :: \"(m3_state \\<times> m3_state) set\" where\n  \"m3_trans \\<equiv> (\\<Union> A B Ra Rb Na Nb.\n     m3_step1 Ra A B Na    \\<union>\n     m3_step2 Rb A B Na Nb \\<union>\n     m3_step3 Ra A B Na Nb \\<union>\n     m3_DY_fake \\<union>\n     Id\n  )\"\n\ndefinition\n  m3 :: \"(m3_state, m3_obs) spec\" where\n  \"m3 \\<equiv> \\<lparr>\n    init = m3_init,\n    trans = m3_trans, \n    obs = m3_obs\n  \\<rparr>\"\n\nlemmas m3_defs = \n  m3_def m3_init_def m3_trans_def m3_obs_def\n  m3_step1_def m3_step2_def m3_step3_def \n  m3_DY_fake_def \n\n\n(******************************************************************************)\nsubsection \\<open>Invariants\\<close>\n(******************************************************************************)\n\ntext \\<open>Automatic tool tuning. Tame too-agressive pair decomposition, which is\ndeclared as a safe elim rule ([elim!]).\\<close>\n\nlemmas MPair_parts [rule del, elim]\nlemmas MPair_analz [rule del, elim]\n\ntext \\<open>Specialize injectiveness of @{term \"parts\"} and @{term \"analz\"} to \nenable aggressive application.\\<close>\n\nlemmas parts_Inj_IK = parts.Inj [where H=\"IK s\" for s]\nlemmas analz_Inj_IK = analz.Inj [where H=\"IK s\" for s]\n\ndeclare analz_into_parts [dest]\n\n\nsubsubsection \\<open>inv1: Key secrecy\\<close>\n(******************************************************************************)\n \ntext \\<open>Decryption keys are secret, that is, the intruder only knows private \nkeys of corrupted agents.\\<close>\n\ndefinition\n  m3_inv1_keys :: \"m3_state set\" where\n  \"m3_inv1_keys \\<equiv> {s. \\<forall> A. \n     Key (priK A) \\<in> parts (IK s) \\<longrightarrow> A \\<in> bad\n  }\"\n\nlemmas m3_inv1_keysI = m3_inv1_keys_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv1_keysE [elim] = \n  m3_inv1_keys_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv1_keysD [dest] = \n  m3_inv1_keys_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\nlemma PO_m3_inv1_keys_init [iff]:\n  \"init m3 \\<subseteq> m3_inv1_keys\"\nby (auto simp add: PO_hoare_def m3_defs intro!: m3_inv1_keysI) \n\nlemma PO_m3_inv1_keys_trans [iff]:\n  \"{m3_inv1_keys} trans m3 {> m3_inv1_keys}\"\nby (auto simp add: PO_hoare_def m3_defs intro!: m3_inv1_keysI) \n   (auto)\n\nlemma PO_m3_inv1_keys [iff]: \"reach m3 \\<subseteq> m3_inv1_keys\"\nby (rule inv_rule_basic, auto)\n\n\n(******************************************************************************)\nsubsection \\<open>Simulation relation\\<close>\n(******************************************************************************)\n\ntext \\<open>Simulation relation is canonical. It states that the protocol messages\nappearing in the intruder knowledge refine those occurring on the abstract\nconfidential channels. Moreover, if the concrete intruder knows a nonce then so \ndoes the abstract one (as defined by \\<open>ink\\<close>).\\<close>\n\n\ntext \\<open>Abstraction function on sets of messages.\\<close>\n\ninductive_set \n  abs_msg :: \"msg set \\<Rightarrow> chmsg set\"\n  for H :: \"msg set\"\nwhere \n  am_msg1: \n    \"Crypt (pubK B) \\<lbrace>Nonce Na, Agent A\\<rbrace> \\<in> H\n  \\<Longrightarrow> Confid A B (Msg [aNon Na]) \\<in> abs_msg H\"\n\n| am_msg2:\n    \"Crypt (pubK A) \\<lbrace>Nonce Na, Nonce Nb, Agent B\\<rbrace> \\<in> H \n  \\<Longrightarrow> Confid B A (Msg [aNon Na, aNon Nb]) \\<in> abs_msg H\"\n\ndeclare abs_msg.intros [intro!]\ndeclare abs_msg.cases [elim!]\n\n\ntext \\<open>The simulation relation is canonical. It states that the protocol \nmessages in the intruder knowledge refine the abstract messages appearing on\nthe confidential channels.\\<close>\n\ndefinition\n  R23_msgs :: \"(m2_state \\<times> m3_state) set\" where\n  \"R23_msgs \\<equiv> {(s, t). abs_msg (parts (IK t)) \\<subseteq> chan s}\"   \\<comment> \\<open>with \\<open>parts\\<close>!\\<close>\n\ndefinition \n  R23_non :: \"(m2_state \\<times> m3_state) set\" where\n  \"R23_non \\<equiv> {(s, t). \\<forall>N. Nonce N \\<in> analz (IK t) \\<longrightarrow> aNon N \\<in> extr ik0 (chan s)}\"\n\ndefinition \n  R23_pres :: \"(m2_state \\<times> m3_state) set\" where\n  \"R23_pres \\<equiv> {(s, t). runs s = runs t}\"\n\ndefinition \n  R23 :: \"(m2_state \\<times> m3_state) set\" where\n  \"R23 \\<equiv> R23_msgs \\<inter> R23_non \\<inter> R23_pres\"\n\nlemmas R23_defs =\n  R23_def R23_msgs_def R23_non_def R23_pres_def\n\nlemmas R23_msgsI = \n  R23_msgs_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_msgsE [elim] = \n  R23_msgs_def [THEN rel_def_to_elim, simplified, rule_format]\nlemmas R23_msgsE' [elim] = \n  R23_msgs_def [THEN rel_def_to_dest, simplified, rule_format, THEN subsetD]\n\nlemmas R23_nonI = \n  R23_non_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_nonE [elim] = \n  R23_non_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_presI = \n  R23_pres_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_presE [elim] = \n  R23_pres_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_intros = R23_msgsI R23_nonI R23_presI\n\n\ntext \\<open>Mediator function.\\<close>\n\nabbreviation\n  med32 :: \"m3_obs \\<Rightarrow> m2_obs\" where\n  \"med32 \\<equiv> id\"\n\n\n(******************************************************************************)\nsubsection \\<open>Misc lemmas\\<close>\n(******************************************************************************)\n\ntext \\<open>General facts about @{term \"abs_msg\"}\\<close>\n\nlemma abs_msg_empty: \"abs_msg {} = {}\"\nby (auto)\n\nlemma abs_msg_Un [simp]: \n  \"abs_msg (G \\<union> H) = abs_msg G \\<union> abs_msg H\"\nby (auto)\n\nlemma abs_msg_mono [elim]: \n  \"\\<lbrakk> m \\<in> abs_msg G; G \\<subseteq> H \\<rbrakk> \\<Longrightarrow> m \\<in> abs_msg H\"\nby (auto)\n\nlemma abs_msg_insert_mono [intro]: \n  \"\\<lbrakk> m \\<in> abs_msg H \\<rbrakk> \\<Longrightarrow> m \\<in> abs_msg (insert m' H)\"\nby (auto)\n\n\ntext \\<open>Abstraction of concretely fakeable message yields abstractly fakeable \nmessages. This is the key lemma for the refinement of the intruder.\\<close>\n\nlemma abs_msg_DY_subset_fake:\n  \"\\<lbrakk> (s, t) \\<in> R23_msgs; (s, t) \\<in> R23_non; t \\<in> m3_inv1_keys \\<rbrakk>\n  \\<Longrightarrow> abs_msg (synth (analz (IK t))) \\<subseteq> fake ik0 (dom (runs s)) (chan s)\"\napply (auto)\n  apply (rule fake_Inj, fastforce)\n  apply (rule fake_intros, auto)\n  apply (rule fake_Inj, fastforce)  \n  apply (rule fake_intros, auto)\ndone\n\nlemma abs_msg_parts_subset_fake:\n  \"\\<lbrakk> (s, t) \\<in> R23_msgs \\<rbrakk>\n  \\<Longrightarrow> abs_msg (parts (IK t)) \\<subseteq> fake ik0 (-dom (runs s)) (chan s)\"\nby (rule_tac B=\"chan s\" in subset_trans) (auto)\n\ndeclare abs_msg_DY_subset_fake [simp, intro!]\ndeclare abs_msg_parts_subset_fake [simp, intro!]\n\n\n(******************************************************************************)\nsubsection \\<open>Refinement proof\\<close>\n(******************************************************************************)\n\ntext \\<open>Proofs obligations.\\<close>\n\nlemma PO_m3_step1_refines_m2_step1:\n  \"{R23 \\<inter> UNIV \\<times> m3_inv1_keys} \n     (m2_step1 Ra A B Na), (m3_step1 Ra A B Na) \n   {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m2_defs m3_defs intro!: R23_intros)\n   (auto)\n\nlemma PO_m3_step2_refines_m2_step2:\n  \"{R23 \\<inter> UNIV \\<times> m3_inv1_keys} \n     (m2_step2 Rb A B Na Nb), (m3_step2 Rb A B Na Nb) \n   {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m2_defs m3_defs intro!: R23_intros)\n   (auto)\n\nlemma PO_m3_step3_refines_m2_step3:\n  \"{R23} \n     (m2_step3 Ra A B Na Nb), (m3_step3 Ra A B Na Nb) \n   {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m2_defs m3_defs intro!: R23_intros)\n\n\ntext \\<open>Dolev-Yao fake event refines abstract fake event.\\<close>\n\nlemma PO_m3_DY_fake_refines_m2_fake:\n  \"{R23 \\<inter> UNIV \\<times> m3_inv1_keys} \n     (m2_fake), (m3_DY_fake) \n   {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m2_defs m3_defs) \n   (rule R23_intros, auto)+\n\n\ntext \\<open>All together now...\\<close>\n\nlemmas PO_m3_trans_refines_m2_trans = \n  PO_m3_step1_refines_m2_step1 PO_m3_step2_refines_m2_step2 \n  PO_m3_step3_refines_m2_step3 PO_m3_DY_fake_refines_m2_fake \n\nlemma PO_m3_refines_init_m2 [iff]:\n  \"init m3 \\<subseteq> R23``(init m2)\"\nby (auto simp add: R23_defs m2_defs m3_defs)\n\nlemma PO_m3_refines_trans_m2 [iff]:\n  \"{R23 \\<inter> UNIV \\<times> m3_inv1_keys} \n     (trans m2), (trans m3) \n   {> R23}\"\napply (auto simp add: m3_def m3_trans_def m2_def m2_trans_def)\napply (blast intro!: PO_m3_trans_refines_m2_trans)+\ndone\n\nlemma PO_R23_obs_consistent [iff]: \n  \"obs_consistent R23 med32 m2 m3\"\nby (auto simp add: obs_consistent_def R23_def m2_defs m3_defs)\n\nlemma PO_m3_refines_m2 [iff]:\n  \"refines \n     (R23 \\<inter> UNIV \\<times> m3_inv1_keys)\n     med32 m2 m3\"\nby (rule Refinement_using_invariants) (auto)\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Auth_simple/m3_enc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6548947290421276, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.33000549501129833}}
{"text": "(*  Title:      HOL/SPARK/SPARK.thy\n    Author:     Stefan Berghofer\n    Copyright:  secunet Security Networks AG\n\nDeclaration of proof functions for SPARK/Ada verification environment.\n*)\n\ntheory SPARK\nimports SPARK_Setup\nbegin\n\ntext {* Bitwise logical operators *}\n\nspark_proof_functions\n  bit__and (integer, integer) : integer = \"op AND\"\n  bit__or (integer, integer) : integer = \"op OR\"\n  bit__xor (integer, integer) : integer = \"op XOR\"\n\nlemmas [simp] =\n  OR_upper [of _ 8, simplified zle_diff1_eq [symmetric], simplified]\n  OR_upper [of _ 8, simplified]\n  OR_upper [of _ 16, simplified zle_diff1_eq [symmetric], simplified]\n  OR_upper [of _ 16, simplified]\n  OR_upper [of _ 32, simplified zle_diff1_eq [symmetric], simplified]\n  OR_upper [of _ 32, simplified]\n  OR_upper [of _ 64, simplified zle_diff1_eq [symmetric], simplified]\n  OR_upper [of _ 64, simplified]\n\nlemmas [simp] =\n  XOR_upper [of _ 8, simplified zle_diff1_eq [symmetric], simplified]\n  XOR_upper [of _ 8, simplified]\n  XOR_upper [of _ 16, simplified zle_diff1_eq [symmetric], simplified]\n  XOR_upper [of _ 16, simplified]\n  XOR_upper [of _ 32, simplified zle_diff1_eq [symmetric], simplified]\n  XOR_upper [of _ 32, simplified]\n  XOR_upper [of _ 64, simplified zle_diff1_eq [symmetric], simplified]\n  XOR_upper [of _ 64, simplified]\n\nlemma bit_not_spark_eq:\n  \"NOT (word_of_int x :: ('a::len0) word) =\n  word_of_int (2 ^ len_of TYPE('a) - 1 - x)\"\nproof -\n  have \"word_of_int x + NOT (word_of_int x) =\n    word_of_int x + (word_of_int (2 ^ len_of TYPE('a) - 1 - x)::'a word)\"\n    by (simp only: bwsimps bin_add_not Min_def)\n      (simp add: word_of_int_hom_syms word_of_int_2p_len)\n  then show ?thesis by (rule add_left_imp_eq)\nqed\n\nlemmas [simp] =\n  bit_not_spark_eq [where 'a=8, simplified]\n  bit_not_spark_eq [where 'a=16, simplified]\n  bit_not_spark_eq [where 'a=32, simplified]\n  bit_not_spark_eq [where 'a=64, simplified]\n\n\ntext {* Minimum and maximum *}\n\nspark_proof_functions\n  integer__min = \"min :: int \\<Rightarrow> int \\<Rightarrow> int\"\n  integer__max = \"max :: int \\<Rightarrow> int \\<Rightarrow> int\"\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/SPARK/SPARK.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3300054950112983}}
{"text": "(*  Title:      Construct_SSA_code.thy\n    Author:     Denis Lohner, Sebastian Ullrich\n*)\n\nsubsection {* Code Equations for SSA Construction *}\n\ntheory Construct_SSA_code imports\n  SSA_CFG_code\n  Construct_SSA\n  Mapping_Exts\n  \"~~/src/HOL/Library/Product_Lexorder\"\nbegin\n\ndefinition[code]: \"lookup_multimap m k \\<equiv> (case_option {} id (Mapping.lookup m k))\"\n\nlocale CFG_Construct_linorder = CFG_Construct_wf \\<alpha>n predecessors Entry \"defs\" \"uses\"\nfor\n  \\<alpha>n :: \"'node::linorder list\" and\n  predecessors :: \"'node \\<Rightarrow> 'node list\" and\n  Entry::\"'node\" and\n  \"defs\" :: \"'node \\<Rightarrow> ('var::linorder) set\" and\n  \"uses\" :: \"'node \\<Rightarrow> 'var set\"\nbegin\n  type_synonym ('n, 'v) sparse_phis = \"('n \\<times> 'v, ('n, 'v) ssaVal list) mapping\"\n\n  function readVariableRecursive :: \"'var \\<Rightarrow> 'node \\<Rightarrow> ('node, 'var) sparse_phis \\<Rightarrow> (('node, 'var) ssaVal \\<times> ('node, 'var) sparse_phis)\"\n       and readArgs :: \"'var \\<Rightarrow> 'node \\<Rightarrow> ('node, 'var) sparse_phis \\<Rightarrow> 'node list \\<Rightarrow> ('node, 'var) sparse_phis \\<times> ('node, 'var) ssaVal list\"\n  where[code]: \"readVariableRecursive v n phis = (if v \\<in> defs n then ((v,n), phis)\n    else case predecessors n of\n      []  \\<Rightarrow> ((v,n), Mapping.update (n,v) [] phis)\n    | [m] \\<Rightarrow> readVariableRecursive v m phis\n    | ms  \\<Rightarrow> (case Mapping.lookup phis (n,v) of\n        Some _ \\<Rightarrow> ((v,n),phis)\n      | None \\<Rightarrow>\n        let phis = Mapping.update (n,v) [] phis in\n        let (phis,args) = readArgs v n phis ms in\n        ((v,n), Mapping.update (n,v) args phis)\n  ))\"\n  | \"readArgs v n phis [] = (phis,[])\"\n  | \"readArgs v n phis (m#ms) = (\n      let (phis,args) = readArgs v n phis ms in\n      let (v,phis) = readVariableRecursive v m phis in\n      (phis,v#args))\"\n  by pat_completeness auto\n\n  lemma length_filter_less2:\n    assumes \"x \\<in> set xs\" \"\\<not>P x\" \"Q x\" \"\\<And>x. P x \\<Longrightarrow> Q x\"\n    shows \"length (filter P xs) < length (filter Q xs)\"\n  proof-\n    have \"\\<And>x. (Q x \\<and> P x) = P x\"\n      using assms(4) by auto\n    hence \"filter P xs = filter P (filter Q xs)\"\n      by auto\n    also have \"length (...) < length (filter Q xs)\"\n      using assms(1-3) by - (rule length_filter_less, auto)\n    finally show ?thesis .\n  qed\n\n  lemma length_filter_le2:\n    assumes \"\\<And>x. P x \\<Longrightarrow> Q x\"\n    shows \"length (filter P xs) \\<le> length (filter Q xs)\"\n  proof-\n    have \"\\<And>x. (Q x \\<and> P x) = P x\"\n      using assms by auto\n    hence \"filter P xs = filter P (filter Q xs)\"\n      by auto\n    also have \"length (...) \\<le> length (filter Q xs)\"\n      by - (rule length_filter_le)\n    finally show ?thesis .\n  qed\n\n  abbreviation \"phis_measure v phis \\<equiv> length [n \\<leftarrow> \\<alpha>n. Mapping.lookup phis (n,v) = None]\"\n\n  lemma phis_measure_update_le: \"phis_measure v (Mapping.update k a p) \\<le> phis_measure v p\"\n  apply (rule length_filter_le2)\n  apply (case_tac \"k = (x, v)\")\n   apply (auto simp: lookup_update lookup_update_neq)\n  done\n\n  lemma phis_measure_update_le': \"phis_measure v p \\<le> phis_measure v (Mapping.update k [] phis) \\<Longrightarrow>\n       phis_measure v (Mapping.update k a p) \\<le> phis_measure v phis\"\n  apply (rule le_trans, rule phis_measure_update_le)\n  apply (rule le_trans, assumption, rule phis_measure_update_le)\n  done\n\n  lemma readArgs_phis_le:\n    \"readVariableRecursive_readArgs_dom (Inl (v, n, phis)) \\<Longrightarrow> (val,p) = readVariableRecursive v n phis \\<Longrightarrow> phis_measure v p \\<le> phis_measure v phis\"\n    \"readVariableRecursive_readArgs_dom (Inr (v, n, phis, ms)) \\<Longrightarrow> (p,u) = readArgs v n phis ms \\<Longrightarrow> phis_measure v p \\<le> phis_measure v phis\"\n  proof (induction arbitrary: val p and p u rule: readVariableRecursive_readArgs.pinduct)\n    case (1 v n phis)\n    show ?case\n    using \"1.IH\"(1) \"1.prems\"\n    apply (subst(asm) \"readVariableRecursive.psimps\"[OF \"1.IH\"(1)])\n    apply (auto simp: Let_def intro: phis_measure_update_le elim: \"1.IH\"(2) split: split_if_asm list.splits option.splits prod.splits)\n    apply (subgoal_tac \"phis_measure v x1 \\<le> phis_measure v (Mapping.update (n,v) [] phis)\")\n     defer\n     apply (rule \"1.IH\"(3))\n     apply (auto simp: phis_measure_update_le')\n    done\n  next\n    case (3 v n m ms phis)\n    from \"3.IH\"(1) \"3.prems\" show ?case\n    apply (auto simp: readArgs.psimps split: prod.splits)\n    apply (rule le_trans)\n     apply (rule \"3.IH\"(3))\n     apply auto\n    apply (rule \"3.IH\"(2))\n    apply auto\n    done\n  qed (auto simp: readArgs.psimps split: prod.splits)\n\n  termination\n  apply (relation \"measures [\n    \\<lambda>args. let (v,phis) = case args of Inl((v,n,phis)) \\<Rightarrow> (v,phis) | Inr((v,n,phis,ms)) \\<Rightarrow> (v,phis) in\n      phis_measure v phis,\n    \\<lambda>args. case args of Inl(_) \\<Rightarrow> 0 | Inr((v,n,phis,ms)) \\<Rightarrow> length ms,\n    \\<lambda>args. let n = case args of Inl((v,n,phis)) \\<Rightarrow> n | Inr((v,n,ms,phis)) \\<Rightarrow> n in\n      shortestPath n\n    ]\")\n  apply (auto intro: shortestPath_single_predecessor)[2]\n  apply clarsimp\n  apply (rule_tac x=n in length_filter_less2)\n     apply (rule successor_in_\\<alpha>n; auto)\n    apply (auto simp: lookup_update)[2]\n  apply (case_tac \"x=n\"; auto simp: lookup_update_neq)\n  apply (auto dest: readArgs_phis_le)\n  done\n\n  declare readVariableRecursive.simps[simp del] readArgs.simps[simp del]\n\n  lemma fst_readVariableRecursive:\n    assumes \"n \\<in> set \\<alpha>n\"\n    shows \"fst (readVariableRecursive v n phis) = lookupDef n v\"\n  using assms\n  apply (induction rule: lookupDef_induct[where v=v])\n    apply (simp add: readVariableRecursive.simps)\n   apply (simp add: readVariableRecursive.simps; auto simp: split_def Let_def split: list.split option.split)\n  apply (auto simp add: readVariableRecursive.simps)\n  done\n\n  definition \"phis'_aux v ns (phis:: ('node,'var) sparse_phis) \\<equiv> Mapping.Mapping (\\<lambda>(m,v\\<^sub>2).\n    (if v\\<^sub>2=v \\<and> m \\<in> \\<Union>(phiDefNodes_aux v [n \\<leftarrow> \\<alpha>n. (n,v) \\<notin> Mapping.keys phis] ` ns) \\<and> v \\<in> vars then Some (map (\\<lambda>m. lookupDef m v) (predecessors m)) else (Mapping.lookup phis (m,v\\<^sub>2))))\"\n\n  lemma phis'_aux_keys_super: \"Mapping.keys (phis'_aux v ns phis) \\<supseteq> Mapping.keys phis\"\n    by (auto simp: keys_dom_lookup phis'_aux_def)\n\n  lemma phiDefNodes_aux_in_unvisited:\n    shows \"phiDefNodes_aux v un n \\<subseteq> set un\"\n  using assms proof (induction un arbitrary: n rule:removeAll_induct)\n    case (1 un)\n    show ?case\n    unfolding phiDefNodes_aux.simps\n    apply (auto elim!: fold_union_elem)\n     apply (rename_tac m n')\n     apply (drule_tac x5=n and n5=n' in 1)\n     apply auto[1]\n    apply (rename_tac m n')\n    apply (drule_tac x5=n and n5=n' in 1)\n    apply auto\n    done\n  qed\n\n  lemma phiDefNodes_aux_unvisited_monotonic:\n    assumes \"set un \\<subseteq> set un'\"\n    shows \"phiDefNodes_aux v un n \\<subseteq> phiDefNodes_aux v un' n\"\n  using assms proof (induction un arbitrary: un' n rule:removeAll_induct)\n    case (1 un)\n    {\n      fix m A\n      assume \"n \\<in> set un\"\n      hence a: \"\\<And>m. phiDefNodes_aux v (removeAll n un) m \\<subseteq> phiDefNodes_aux v (removeAll n un') m\"\n      apply (rule 1)\n      using 1(2)\n      by auto\n\n      assume \"m \\<in> fold op \\<union> (map (phiDefNodes_aux v (removeAll n un)) (predecessors n)) A\"\n      hence \"m \\<in> fold op \\<union> (map (phiDefNodes_aux v (removeAll n un')) (predecessors n)) A\"\n      apply (rule fold_union_elem)\n      apply (rule fold_union_elemI')\n      apply (auto simp: image_def dest: a[THEN subsetD])\n      done\n    }\n    with 1(2) show ?case\n    apply (subst(1 2) phiDefNodes_aux.simps)\n    by auto\n  qed\n\n  lemma phiDefNodes_aux_single_pred:\n    assumes \"predecessors n = [m]\"\n    shows \"phiDefNodes_aux v (removeAll n un) m = phiDefNodes_aux v un m\"\n  proof-\n    {\n      fix n' ns\n      assume asm: \"n'\\<comment>ns\\<rightarrow>m\" \"distinct ns\" \"length (predecessors n') \\<noteq> 1\" \"n \\<in> set ns\"\n      then obtain ns\\<^sub>1 ns\\<^sub>2 where split: \"n'\\<comment>ns\\<^sub>1\\<rightarrow>n\" \"n\\<comment>ns\\<^sub>2\\<rightarrow>m\" \"ns = butlast ns\\<^sub>1 @ ns\\<^sub>2\"\n        by - (rule path2_split_ex)\n      with `distinct ns` have \"m \\<notin> set (butlast ns\\<^sub>1)\"\n        by (auto dest: path2_last_in_ns)\n      from split(1,2) have False\n      apply-\n      apply (frule path2_unsnoc)\n        apply (erule path2_nontrivial)\n        using assms asm(3) `m \\<notin> set (butlast ns\\<^sub>1)`\n        apply (auto dest: path2_not_Nil)\n      done\n    }\n    with assms show ?thesis\n    apply-\n    apply rule\n     apply (rule phiDefNodes_aux_unvisited_monotonic; auto)\n    apply (rule subsetI)\n    apply (rename_tac n')\n    apply (erule phiDefNodes_auxE)\n     apply (rule predecessor_is_node[where n'=n]; auto)\n    apply (rule phiDefNodes_auxI; auto)\n    done\n  qed\n\n  lemma phis'_aux_finite:\n    assumes \"finite (Mapping.keys phis)\"\n    shows \"finite (Mapping.keys (phis'_aux v ns phis))\"\n  proof-\n    have a: \"\\<And>n. phiDefNodes_aux v [n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> dom (Mapping.lookup phis)] n \\<subseteq> (set \\<alpha>n)\"\n      by (rule subset_trans, rule phiDefNodes_aux_in_unvisited, auto)\n    have \"Mapping.keys (phis'_aux v ns phis) \\<subseteq> set \\<alpha>n \\<times> vars \\<union> Mapping.keys phis\"\n      by (auto simp: phis'_aux_def keys_dom_lookup split: split_if_asm dest: subsetD[OF a])\n    thus ?thesis by (rule finite_subset, auto intro: assms)\n  qed\n\n  lemma phiDefNodes_aux_redirect:\n    assumes asm: \"n\\<comment>ns\\<rightarrow>m\"  \"\\<forall>n \\<in> set ns. v \\<notin> defs n\" \"length (predecessors n) \\<noteq> 1\" \"unvisitedPath un ns\"\n    assumes n': \"n' \\<in> set ns\" \"n' \\<in> phiDefNodes_aux v un m'\" \"m' \\<in> set \\<alpha>n\"\n    shows \"n \\<in> phiDefNodes_aux v un m'\"\n  proof-\n    from asm(1) n'(1) obtain ns\\<^sub>1 where ns\\<^sub>1: \"n\\<comment>ns\\<^sub>1\\<rightarrow>n'\" \"set ns\\<^sub>1 \\<subseteq> set ns\"\n      by (rule path2_split_ex, simp)\n\n    from n'(2-3) obtain ns' where ns': \"n'\\<comment>ns'\\<rightarrow>m'\" \"\\<forall>n \\<in> set ns'. v \\<notin> defs n\" \"length (predecessors n') \\<noteq> 1\"\n      \"unvisitedPath un ns'\"\n      by (rule phiDefNodes_auxE)\n\n    from ns\\<^sub>1(1) ns'(1) obtain ms where ms: \"n\\<comment>ms\\<rightarrow>m'\" \"distinct ms\" \"set ms \\<subseteq> set ns\\<^sub>1 \\<union> set (tl ns')\"\n      by - (drule path2_app, auto elim: simple_path2)\n\n    show ?thesis\n    using ms(1)\n    apply (rule phiDefNodes_auxI)\n      using ms asm(4) ns\\<^sub>1(2) ns'(4)\n      apply clarsimp\n      apply (rename_tac x)\n      apply (case_tac \"x \\<in> set ns\\<^sub>1\")\n       apply (drule_tac A=\"set ns\" and c=x in subsetD; auto)\n      apply (drule_tac A=\"set ns'\" and c=x in subsetD; auto)\n     using asm(2-3) ns\\<^sub>1(2) ns'(2) ms(3)\n     apply (auto dest!: bspec)\n    done\n  qed\n\n  lemma snd_readVariableRecursive:\n    assumes \"v \\<in> vars\" \"n \\<in> set \\<alpha>n\" \"finite (Mapping.keys phis)\"\n    \"\\<And>n. (n,v) \\<in> Mapping.keys phis \\<Longrightarrow> length (predecessors n) \\<noteq> 1\" \"Mapping.lookup phis (Entry,v) \\<in> {None, Some []}\"\n    shows\n      \"phis'_aux v {n} phis = snd (readVariableRecursive v n phis)\"\n      \"set ms \\<subseteq> set \\<alpha>n \\<Longrightarrow> (phis'_aux v (set ms) phis, map (\\<lambda>m. lookupDef m v) ms) = readArgs v n phis ms\"\n  using assms proof (induction v n phis and v n phis ms rule: readVariableRecursive_readArgs.induct)\n    case (1 v n phis)\n    note \"1.prems\"(1-3)[simp]\n    note phis_wf = \"1.prems\"(4)[rule_format]\n\n    from \"1.prems\"(5) have a: \"(Entry,v) \\<in> Mapping.keys phis \\<Longrightarrow> Mapping.lookup phis (Entry, v) = Some []\"\n    by (auto simp: keys_dom_lookup)\n\n    have IH1: \"\\<And>m. v \\<notin> defs n \\<Longrightarrow> predecessors n = [m] \\<Longrightarrow> phis'_aux v {m} phis = snd (readVariableRecursive v m phis)\"\n    apply (rule \"1.IH\"[rule_format])\n          apply auto[4]\n      apply (rule_tac n'=n in predecessor_is_node; auto)\n     using \"1.prems\"(5)\n     apply (auto dest: phis_wf)\n    done\n\n    {\n      fix m\\<^sub>1 m\\<^sub>2 :: 'node\n      fix ms' :: \"'node list\"\n      let ?ms = \"m\\<^sub>1#m\\<^sub>2#ms'\"\n      let ?phis' = \"Mapping.update (n,v) [] phis\"\n      assume asm: \"v \\<notin> defs n\" \"predecessors n = ?ms\" \"Mapping.lookup phis (n, v) = None\"\n      moreover have \"set ?ms \\<subseteq> set \\<alpha>n\"\n        by (rule subsetI, rule predecessor_is_node[of _ n]; auto simp: asm(2))\n      ultimately have \"readArgs v n ?phis' ?ms = (phis'_aux v (set ?ms) ?phis', map (\\<lambda>m. lookupDef m v) ?ms)\"\n      using \"1.prems\"(5)\n      by - (rule \"1.IH\"(2)[symmetric, rule_format]; auto dest: phis_wf simp: lookup_update_cases)\n    }\n    note IH2 = this\n\n    note foldr_Cons[simp del] fold_Cons[simp del] list.map(2)[simp del] set_simps(2)[simp del]\n\n    have c: \"\\<And>f x. \\<Union>(f ` {x}) = f x\" by auto\n\n    show ?case\n    unfolding phis'_aux_def c\n    apply (subst readVariableRecursive.simps)\n    apply (subst phiDefNodes_aux.simps[abs_def])\n    apply (cases \"predecessors n\")\n     apply (auto simp: a Mapping_eq_lookup lookup_update_cases split: list.split intro!: ext)[1]\n    apply (rename_tac m\\<^sub>1 ms)\n    apply (case_tac ms)\n     apply (subst Mapping_eq_lookup)\n     apply (intro ext)\n     apply (auto simp: fold_Cons list.map(2))[1]\n        apply (auto dest: phis_wf)[1]\n       apply (subst IH1[symmetric], assumption, assumption)\n       apply (auto simp: phis'_aux_def)[1]\n       apply (drule rev_subsetD, rule phiDefNodes_aux_unvisited_monotonic[where un'=\"[n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> Mapping.keys phis]\"]; auto)\n      apply (subst IH1[symmetric], assumption, assumption)\n      apply (auto simp: phis'_aux_def)[1]\n     apply (subst IH1[symmetric], assumption, assumption)\n     apply (auto simp: phis'_aux_def phiDefNodes_aux_single_pred)[1]\n    apply (auto simp: Mapping_eq_lookup lookup_update_cases intro!: ext)\n       apply (auto simp: keys_dom_lookup)[1]\n      apply (auto split: option.split prod.split)[1]\n       apply (subst(asm) IH2, assumption, assumption, assumption)\n       apply (erule fold_union_elem)\n       apply (auto simp: lookup_update_cases phis'_aux_def[abs_def])[1]\n         apply (drule rev_subsetD, rule phiDefNodes_aux_unvisited_monotonic[where un'=\"[n'\\<leftarrow>\\<alpha>n . n' \\<noteq> n \\<and> (n', v) \\<notin> Mapping.keys phis]\"]; auto)\n        apply (drule rev_subsetD, rule phiDefNodes_aux_unvisited_monotonic[where un'=\"[n'\\<leftarrow>\\<alpha>n . n' \\<noteq> n \\<and> (n', v) \\<notin> Mapping.keys phis]\"]; auto)\n       apply (rename_tac m)\n       apply (erule_tac x=m in ballE)\n        apply (drule rev_subsetD, rule phiDefNodes_aux_unvisited_monotonic[where un'=\"[n'\\<leftarrow>\\<alpha>n . n' \\<noteq> n \\<and> (n', v) \\<notin> Mapping.keys phis]\"]; auto)\n       apply auto[1]\n      apply (subst(asm) IH2, assumption, assumption)\n       apply (auto simp: keys_dom_lookup)[2]\n     apply (auto split: option.split prod.split)[1]\n     apply (subst(asm) IH2, assumption, assumption, assumption)\n     apply (auto simp: lookup_update_neq phis'_aux_def)[1]\n    apply (auto split: option.splits prod.splits)[1]\n    apply (subst(asm) IH2, assumption, assumption, assumption)\n    apply (auto simp: lookup_update_cases phis'_aux_def removeAll_filter_not_eq image_def split: split_if_asm)[1]\n       apply (cut_tac fold_union_elemI)\n         apply auto[3]\n      apply (cut_tac fold_union_elemI)\n        apply auto[1]\n       apply assumption\n      apply (subgoal_tac \"[x\\<leftarrow>\\<alpha>n . x \\<noteq> n \\<and> (x, v) \\<notin> Mapping.keys phis] = [x\\<leftarrow>\\<alpha>n . (x, v) \\<notin> Mapping.keys phis \\<and> n \\<noteq> x]\")\n       apply auto[1]\n      apply (rule arg_cong2[where f=filter])\n       apply auto[2]\n     apply (cut_tac fold_union_elemI)\n       apply auto[1]\n      apply assumption\n     apply (subgoal_tac \"[x\\<leftarrow>\\<alpha>n . x \\<noteq> n \\<and> (x, v) \\<notin> Mapping.keys phis] = [x\\<leftarrow>\\<alpha>n . (x, v) \\<notin> Mapping.keys phis \\<and> n \\<noteq> x]\")\n      apply auto[1]\n     apply (rule arg_cong2[where f=filter])\n      apply auto[2]\n    apply (cut_tac fold_union_elemI)\n      apply auto[1]\n     apply assumption\n    apply (subgoal_tac \"[x\\<leftarrow>\\<alpha>n . x \\<noteq> n \\<and> (x, v) \\<notin> Mapping.keys phis] = [x\\<leftarrow>\\<alpha>n . (x, v) \\<notin> Mapping.keys phis \\<and> n \\<noteq> x]\")\n     apply auto[1]\n    apply (rule arg_cong2[where f=filter])\n     apply auto[2]\n    done\n  next\n    case (3 v n phis m ms)\n    note \"3.prems\"(2-4)[simp]\n    from \"3.prems\"(1) have[simp]: \"m \\<in> set \\<alpha>n\" by auto\n\n    from 3 have IH1: \"readArgs v n phis ms = (phis'_aux v (set ms) phis, map (\\<lambda>m. lookupDef m v) ms)\"\n    by auto\n\n    have IH2: \"phis'_aux v {m} (phis'_aux v (set ms) phis) = snd (readVariableRecursive v m (phis'_aux v (set ms) phis))\"\n    apply (rule \"3.IH\"(2))\n          apply (auto simp: IH1 intro: phis'_aux_finite)[5]\n     apply (simp add: phis'_aux_def keys_dom_lookup dom_def split: split_if_asm)\n     apply safe\n      apply (erule phiDefNodes_auxE)\n       using \"3.prems\"(1,5)\n       apply (auto simp: keys_dom_lookup)[3]\n    using \"3.prems\"(6)\n    apply (auto simp: phis'_aux_def split: split_if_asm)\n    done\n\n    have a: \"phiDefNodes_aux v [n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> Mapping.keys (phis'_aux v (set ms) phis)] m \\<subseteq> phiDefNodes_aux v [n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> Mapping.keys phis] m\"\n    apply (rule phiDefNodes_aux_unvisited_monotonic)\n    by (auto dest: phis'_aux_keys_super[THEN subsetD])\n\n    {\n      fix n\n      assume m:  \"n \\<in> phiDefNodes_aux v [n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> Mapping.keys phis] m\" and\n             ms: \"\\<forall>x\\<in>set ms. n \\<notin> phiDefNodes_aux v [n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> Mapping.keys phis] x\"\n\n      have \"n \\<in> phiDefNodes_aux v [n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> Mapping.keys (phis'_aux v (set ms) phis)] m\"\n      using m\n      apply-\n      apply (erule phiDefNodes_auxE, simp)\n      apply (rule phiDefNodes_auxI)\n         apply (auto simp: phis'_aux_def keys_dom_lookup split: split_if_asm)[3]\n        apply (drule phiDefNodes_aux_redirect)\n              using \"3.prems\"(1)\n              apply auto[6]\n        apply (rule ms[THEN ballE]; auto simp: keys_dom_lookup)\n       apply auto\n      done\n    }\n    note b = this\n\n    show ?case\n    unfolding readArgs.simps phis'_aux_def\n    unfolding IH1\n    apply (simp add: split_def Let_def IH2[symmetric])\n    apply (subst phis'_aux_def)\n    apply (subst(2) phis'_aux_def)\n    apply (auto simp: Mapping_eq_lookup fst_readVariableRecursive split: prod.splits intro!: ext dest!: a[THEN subsetD] b)\n    done\n  qed (auto simp: readArgs.simps phis'_aux_def)\n\n  definition \"aux_1 n = (\\<lambda>v (uses,phis).\n    let (use,phis') = readVariableRecursive v n phis in\n    (Mapping.update n (insert use (lookup_multimap uses n)) uses, phis')\n  )\"\n\n  definition \"aux_2 n = foldr (aux_1 n) (sorted_list_of_set (uses n))\"\n\n  abbreviation \"init_state \\<equiv> (Mapping.empty, Mapping.empty)\"\n  abbreviation \"from_sparse \\<equiv> \\<lambda>(n,v). (n,(v,n))\"\n  definition \"uses'_phis' = (\n    let (u,p) = foldr (aux_2) \\<alpha>n init_state in\n    (u, map_keys from_sparse p)\n  )\"\n\n  lemma from_sparse_inj: \"inj from_sparse\"\n    by (rule injI, auto)\n\n  declare uses'_phis'_def[unfolded aux_2_def[abs_def] aux_1_def, code]\n\n  lift_definition phis'_code :: \" ('node, ('node, 'var) ssaVal) phis_code\" is phis' .\n\n  lemma foldr_prod: \"foldr (\\<lambda>x y. (f1 x (fst y), f2 x (snd y))) xs y = (foldr f1 xs (fst y), foldr f2 xs (snd y))\"\n  by (induction xs, auto)\n\n  lemma foldr_aux_1:\n    assumes \"set us \\<subseteq> uses n\" \"Mapping.lookup u n = None\" \"foldr (aux_1 n) us (u,p) = (u',p')\" (is \"foldr ?f _ _ = _\")\n    assumes \"finite (Mapping.keys p)\" \"\\<And>n v. (n,v) \\<in> Mapping.keys p \\<Longrightarrow> length (predecessors n) \\<noteq> 1\" \"\\<And>v. Mapping.lookup p (Entry,v) \\<in> {None, Some []}\"\n    shows \"lookupDef n ` set us = lookup_multimap u' n\" \"\\<And>m. m \\<noteq> n \\<Longrightarrow> Mapping.lookup u' m = Mapping.lookup u m\"\n      \"\\<And>m v. (if m \\<in> phiDefNodes_aux v [n \\<leftarrow> \\<alpha>n. (n,v) \\<notin> Mapping.keys p] n \\<and> v \\<in> set us then\n        Some (map (\\<lambda>m. lookupDef m v) (predecessors m)) else\n        (Mapping.lookup p (m,v))) = Mapping.lookup p' (m,v)\"\n  using assms proof (induction us arbitrary: u' p')\n    case (Cons v us)\n    let ?u = \"fst (foldr ?f us (u,p))\"\n    let ?p = \"snd (foldr ?f us (u,p))\"\n    {\n      case 1\n      have \"n \\<in> set \\<alpha>n\" using 1(1) uses_in_\\<alpha>n by auto\n      hence \"lookupDef n v = fst (readVariableRecursive v n ?p)\"\n        by (rule fst_readVariableRecursive[symmetric])\n      moreover have \"lookupDef n ` set us = lookup_multimap ?u n\"\n        using 1 by - (rule Cons(1)[of ?u ?p], auto)\n      ultimately show ?case\n        using 1(3) by (auto simp: aux_1_def split_def Let_def lookup_multimap_def lookup_update split: option.splits)\n    next\n      case 2\n      have \"Mapping.lookup ?u m = Mapping.lookup u m\"\n        using 2 by - (rule Cons(2)[of _ ?u ?p], auto)\n      thus ?case\n        using 2 by (auto simp: aux_1_def split_def Let_def lookup_multimap_def lookup_update_neq split: option.splits)\n    next\n      case (3 m v' u' p')\n      from 3(1) have[simp]: \"\\<And>v. v \\<in> set us \\<Longrightarrow> v \\<in> vars\"\n        by auto\n\n      from 3 have IH: \"\\<And>m v'. (if m \\<in> phiDefNodes_aux v' [n \\<leftarrow> \\<alpha>n. (n,v') \\<notin> Mapping.keys p] n \\<and> v' \\<in> set us then\n        Some (map (\\<lambda>m. lookupDef m v') (predecessors m)) else\n        (Mapping.lookup p (m,v'))) = Mapping.lookup ?p (m,v')\"\n        by - (rule Cons(3)[of ?u ?p], auto)\n\n      have rVV: \"phis'_aux v {n} ?p = snd (readVariableRecursive v n ?p)\"\n      apply (rule snd_readVariableRecursive(1))\n         using 3\n         apply (auto simp: uses_in_\\<alpha>n)[2]\n        apply (rule finite_subset[where B=\"set \\<alpha>n \\<times> vars \\<union> Mapping.keys p\"])\n         apply (auto simp: keys_dom_lookup IH[symmetric] split: split_if_asm dest!: phiDefNodes_aux_in_unvisited[THEN subsetD])[1]\n        apply (simp add: 3(4))[1]\n       using 3(5-6)\n       apply (auto simp: keys_dom_lookup dom_def IH[symmetric] split: split_if_asm dest!: phiDefNode_aux_is_join_node)\n      done\n\n      have a: \"m \\<in> phiDefNodes_aux v [n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> Mapping.keys ?p] n \\<Longrightarrow> m \\<in> phiDefNodes_aux v [n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> Mapping.keys p] n\"\n      apply (erule rev_subsetD)\n      apply (rule phiDefNodes_aux_unvisited_monotonic)\n      by (auto simp: IH[symmetric] keys_dom_lookup split: split_if_asm)\n\n      have b: \"v \\<notin> set us \\<Longrightarrow> [n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> Mapping.keys ?p] = [n\\<leftarrow>\\<alpha>n . (n, v) \\<notin> Mapping.keys p]\"\n      by (rule arg_cong2[where f=filter], auto simp: keys_dom_lookup IH[symmetric])\n\n      from 3 show ?case\n      unfolding aux_1_def\n      unfolding foldr.foldr_Cons\n      unfolding aux_1_def[symmetric]\n      by (auto simp: Let_def split_def IH[symmetric] rVV[symmetric] phis'_aux_def b dest: a uses_in_vars split: split_if_asm)\n    }\n  qed (auto simp: lookup_multimap_def)\n\n  lemma foldr_aux_2:\n    assumes \"set ns \\<subseteq> set \\<alpha>n\" \"distinct ns\" \"foldr (aux_2) ns init_state = (u',p')\"\n    shows \"\\<And>n. n \\<in> set ns \\<Longrightarrow> uses' n = lookup_multimap u' n\" \"\\<And>n. n \\<notin> set ns \\<Longrightarrow> Mapping.lookup u' n = None\"\n      \"\\<And>m v. (if \\<exists>n \\<in> set ns. m \\<in> phiDefNodes_aux v \\<alpha>n n \\<and> v \\<in> uses n then\n        Some (map (\\<lambda>m. lookupDef m v) (predecessors m)) else\n        None) = Mapping.lookup p' (m,v)\"\n  using assms proof (induction ns arbitrary: u' p')\n    case (Cons n ns)\n    let ?u = \"fst (foldr (aux_2) ns init_state)\"\n    let ?p = \"snd (foldr (aux_2) ns init_state)\"\n\n    fix m u' p'\n    assume asm: \"set (n#ns) \\<subseteq> set \\<alpha>n\" \"distinct (n#ns)\" \"foldr (aux_2) (n#ns) init_state = (u', p')\"\n    hence IH:\n      \"\\<And>n. n \\<in> set ns \\<Longrightarrow> uses' n = lookup_multimap ?u n\"\n      \"\\<And>n. n \\<notin> set ns \\<Longrightarrow> Mapping.lookup ?u n = None\"\n      \"\\<And>m v. (if \\<exists>n \\<in> set ns. m \\<in> phiDefNodes_aux v \\<alpha>n n \\<and> v \\<in> uses n then\n        Some (map (\\<lambda>m. lookupDef m v) (predecessors m)) else\n        None) = Mapping.lookup ?p (m,v)\"\n    apply -\n      apply (rule Cons.IH(1)[where p'5=\"?p\"]; auto; fail)\n     apply (rule Cons.IH(2)[where p'5=\"?p\"]; auto; fail)\n    by (rule Cons.IH(3)[where u'5=\"?u\"], auto)\n\n    with this[of n] asm(2) have a': \"Mapping.lookup ?u n = None\" by simp\n    moreover have \"finite (Mapping.keys ?p)\"\n      by (rule finite_subset[where B=\"set \\<alpha>n \\<times> vars\"]) (auto simp: keys_dom_lookup IH[symmetric] split: split_if_asm dest!: phiDefNodes_aux_in_unvisited[THEN subsetD])\n    moreover have \"\\<And>n v. (n,v) \\<in> Mapping.keys ?p \\<Longrightarrow> length (predecessors n) \\<noteq> 1\"\n      by (auto simp: keys_dom_lookup dom_def IH[symmetric] split: split_if_asm dest!: phiDefNode_aux_is_join_node)\n    moreover have \"\\<And>v. Mapping.lookup ?p (Entry,v) \\<in> {None, Some []}\"\n      by (auto simp: IH[symmetric])\n    ultimately have aux_2: \"lookupDef n ` uses n = lookup_multimap u' n\" \"\\<And>m. m \\<noteq> n \\<Longrightarrow> Mapping.lookup u' m = Mapping.lookup ?u m\"\n      \"\\<And>m v. (if m \\<in> phiDefNodes_aux v [n \\<leftarrow> \\<alpha>n. (n,v) \\<notin> Mapping.keys ?p] n \\<and> v \\<in> uses n then\n        Some (map (\\<lambda>m. lookupDef m v) (predecessors m)) else\n        (Mapping.lookup ?p (m,v))) = Mapping.lookup p' (m,v)\"\n    apply-\n      apply (rule foldr_aux_1(1)[of \"sorted_list_of_set (uses n)\" n ?u ?p u' p', simplified]; simp add: aux_2_def[symmetric] asm(3)[simplified]; fail)\n     apply (rule foldr_aux_1(2)[of \"sorted_list_of_set (uses n)\" n ?u ?p u' p', simplified]; simp add: aux_2_def[symmetric] asm(3)[simplified]; fail)\n    apply (rule foldr_aux_1(3)[of \"sorted_list_of_set (uses n)\" n ?u ?p u' p', simplified]; simp add: aux_2_def[symmetric] asm(3)[simplified]; fail)\n    done\n\n    {\n      assume 1: \"m \\<in> set (n#ns)\"\n      show \"uses' m = lookup_multimap u' m\"\n      apply (cases \"m = n\")\n       apply (simp add: uses'_def aux_2)\n      using 1 asm(2)\n      apply (auto simp: IH(1) lookup_multimap_def aux_2(2))\n      done\n    next\n      assume 2: \"m \\<notin> set (n#ns)\"\n      thus \"Mapping.lookup u' m = None\"\n        by (simp add: aux_2(2) IH(2))\n    next\n      fix v\n      show \"(if \\<exists>n \\<in> set (n#ns). m \\<in> phiDefNodes_aux v \\<alpha>n n \\<and> v \\<in> uses n then\n        Some (map (\\<lambda>m. lookupDef m v) (predecessors m)) else\n        None) = Mapping.lookup p' (m,v)\"\n      apply (auto simp: aux_2(3)[symmetric] IH(3)[symmetric] keys_dom_lookup dom_def)\n       apply (erule phiDefNodes_auxE)\n        apply (erule uses_in_\\<alpha>n)\n       apply (rule phiDefNodes_auxI)\n          apply auto[4]\n       apply (drule phiDefNodes_aux_redirect; auto simp: uses_in_\\<alpha>n; fail)\n      apply (drule rev_subsetD)\n       apply (rule phiDefNodes_aux_unvisited_monotonic)\n       apply auto\n      done\n    }\n  qed (auto simp: lookup_empty)\n\n  lemma fst_uses'_phis': \"uses' = lookup_multimap (fst (uses'_phis'))\"\n  apply (rule ext)\n  apply (simp add: uses'_phis'_def Let_def split_def)\n  apply (case_tac \"x \\<in> set \\<alpha>n\")\n   apply (rule foldr_aux_2(1)[OF _ _ surjective_pairing]; auto simp: lookup_empty intro: \\<alpha>n_distinct; fail)\n  unfolding lookup_multimap_def\n  apply (subst foldr_aux_2(2)[OF _ _ surjective_pairing]; auto simp: lookup_empty uses_in_\\<alpha>n uses'_def intro: \\<alpha>n_distinct)\n  done\n\n  lemma fst_uses'_phis'_in_\\<alpha>n: \"Mapping.keys (fst (uses'_phis')) \\<subseteq> set \\<alpha>n\"\n  apply (rule subsetI)\n  apply (rule ccontr)\n  apply (simp add: uses'_phis'_def Let_def split_def keys_dom_lookup dom_def)\n  apply (subst(asm) foldr_aux_2(2)[OF _ _ surjective_pairing]; auto intro: \\<alpha>n_distinct)\n  done\n\n  lemma snd_uses'_phis': \"phis'_code = snd (uses'_phis')\"\n  proof-\n    have a: \"\\<And>n v. (THE k. (\\<lambda>p. (fst p, snd p, fst p)) -` {(n, v, n)} = {k}) = (n,v)\"\n      by (rule the1_equality) (auto simp: vimage_def)\n    show ?thesis\n    apply (subst Mapping_eq_lookup)\n    apply transfer\n    apply (simp add: phis'_def uses'_phis'_def Let_def split_def)\n    apply (auto simp: lookup_map_keys a intro!: ext)\n       apply (auto simp: vimage_def)[1]\n      apply (subst(asm) foldr_aux_2(3)[OF _ _ surjective_pairing, symmetric])\n        apply (auto simp: phiDefNodes_def vimage_def elim!: fold_union_elem intro!: \\<alpha>n_distinct split: split_if_asm)[3]\n     apply (subst(asm) foldr_aux_2(3)[OF _ _ surjective_pairing, symmetric])\n       apply (auto simp: phiDefNodes_def vimage_def elim!: fold_union_elem intro!: \\<alpha>n_distinct split: split_if_asm)[2]\n     apply (auto simp: phiDefNodes_def intro: fold_union_elemI' split: split_if_asm)[1]\n    apply (subst(asm) foldr_aux_2(3)[OF _ _ surjective_pairing, symmetric])\n      apply (auto simp: phiDefNodes_def vimage_def elim!: fold_union_elem intro!: \\<alpha>n_distinct fold_union_elemI split: split_if_asm)\n    done\n  qed\nend\n\nend\n", "meta": {"author": "lohner", "repo": "FormalSSA", "sha": "34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e", "save_path": "github-repos/isabelle/lohner-FormalSSA", "path": "github-repos/isabelle/lohner-FormalSSA/FormalSSA-34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e/Construct_SSA_code.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3300054950112983}}
{"text": "section {* Small-step semantics of CBV lambda calculus *}\n\ntheory SmallStepLam\n  imports Lambda\nbegin\n  \ntext{*\n  The following substitution function is not capture avoiding, so it has a precondition\n  that $v$ is closed. With hindsight, we should have used DeBruijn indices instead\n  because we also use substitution in the optimizing compiler.\n*}\nfun subst :: \"name \\<Rightarrow> exp \\<Rightarrow> exp \\<Rightarrow> exp\" where\n  \"subst x v (EVar y) = (if x = y then v else EVar y)\" |\n  \"subst x v (ENat n) = ENat n\" |\n  \"subst x v (ELam y e) = (if x = y then ELam y e else ELam y (subst x v e))\" |\n  \"subst x v (EApp e1 e2) = EApp (subst x v e1) (subst x v e2)\" |\n  \"subst x v (EPrim f e1 e2) = EPrim f (subst x v e1) (subst x v e2)\" |\n  \"subst x v (EIf e1 e2 e3) = EIf (subst x v e1) (subst x v e2) (subst x v e3)\" |\n  \"subst x v (ECons e1 e2) = ECons (subst x v e1) (subst x v e2)\" |\n  \"subst x v (ECar e) = ECar (subst x v e)\" |\n  \"subst x v (ECdr e) = ECdr (subst x v e)\"\n\ninductive isval :: \"exp \\<Rightarrow> bool\" where\n  valnat[intro!]: \"isval (ENat n)\" |\n  vallam[intro!]: \"isval (ELam x e)\" |\n  valpair[intro!]: \"\\<lbrakk> isval v1; isval v2 \\<rbrakk> \\<Longrightarrow> isval (ECons v1 v2)\"\n\ninductive_cases\n  isval_var_inv[elim!]: \"isval (EVar x)\" and\n  isval_app_inv[elim!]: \"isval (EApp e1 e2)\" and\n  isval_prim_inv[elim!]: \"isval (EPrim f e1 e2)\" and\n  isval_if_inv[elim!]: \"isval (EIf e1 e2 e3)\" and\n  isval_cons_inv[elim!]: \"isval (ECons e1 e2)\" and\n  isval_car_inv[elim!]: \"isval (ECar e)\" and\n  isval_cdr_inv[elim!]: \"isval (ECdr e)\"\n\ndefinition is_val :: \"exp \\<Rightarrow> bool\" where\n  \"is_val v \\<equiv> isval v \\<and> FV v = {}\"\ndeclare is_val_def[simp]\n\ninductive reduce :: \"exp \\<Rightarrow> exp \\<Rightarrow> bool\" (infix \"\\<longrightarrow>\" 55) where\n  beta[intro!]: \"\\<lbrakk> is_val v \\<rbrakk> \\<Longrightarrow> EApp (ELam x e) v \\<longrightarrow> (subst x v e)\" |\n  app_left[intro!]: \"\\<lbrakk> e1 \\<longrightarrow> e1' \\<rbrakk> \\<Longrightarrow> EApp e1 e2 \\<longrightarrow> EApp e1' e2\" |\n  app_right[intro!]: \"\\<lbrakk> e2 \\<longrightarrow> e2' \\<rbrakk> \\<Longrightarrow> EApp e1 e2 \\<longrightarrow> EApp e1 e2'\" |\n  delta[intro!]: \"EPrim f (ENat n1) (ENat n2) \\<longrightarrow> ENat (f n1 n2)\" |\n  prim_left[intro!]: \"\\<lbrakk> e1 \\<longrightarrow> e1' \\<rbrakk> \\<Longrightarrow> EPrim f e1 e2 \\<longrightarrow> EPrim f e1' e2\" |\n  prim_right[intro!]: \"\\<lbrakk> e2 \\<longrightarrow> e2' \\<rbrakk> \\<Longrightarrow> EPrim f e1 e2 \\<longrightarrow> EPrim f e1 e2'\" |\n  cons_left[intro!]: \"\\<lbrakk> \\<not> isval e1 \\<and> e1 \\<longrightarrow> e1' \\<rbrakk> \\<Longrightarrow> ECons e1 e2 \\<longrightarrow> ECons e1' e2\" |\n  cons_right[intro!]: \"\\<lbrakk> \\<not> isval e2 \\<and> e2 \\<longrightarrow> e2' \\<rbrakk> \\<Longrightarrow> ECons e1 e2 \\<longrightarrow> ECons e1 e2'\" |\n  car[intro!]: \"\\<lbrakk> e \\<longrightarrow> e' \\<rbrakk> \\<Longrightarrow> ECar e \\<longrightarrow> ECar e'\" |\n  cdr[intro!]: \"\\<lbrakk> e \\<longrightarrow> e' \\<rbrakk> \\<Longrightarrow> ECdr e \\<longrightarrow> ECdr e'\" |\n  car_v[intro!]: \"\\<lbrakk> is_val v1 \\<and> is_val v2 \\<rbrakk> \\<Longrightarrow> ECar (ECons v1 v2) \\<longrightarrow> v1\" |\n  cdr_v[intro!]: \"\\<lbrakk> is_val v1 \\<and> is_val v2 \\<rbrakk> \\<Longrightarrow> ECdr (ECons v1 v2) \\<longrightarrow> v2\" |\n  if_zero[intro!]: \"EIf (ENat 0) thn els \\<longrightarrow> els\" |\n  if_nz[intro!]: \"n \\<noteq> 0 \\<Longrightarrow> EIf (ENat n) thn els \\<longrightarrow> thn\" |\n  if_cond[intro!]: \"\\<lbrakk> cond \\<longrightarrow> cond' \\<rbrakk> \\<Longrightarrow> \n    EIf cond thn els \\<longrightarrow> EIf cond' thn els\" \n\ninductive_cases\n  red_var_inv[elim!]: \"EVar x \\<longrightarrow> e\" and\n  red_int_inv[elim!]: \"ENat n \\<longrightarrow> e\" and\n  red_lam_inv[elim!]: \"ELam x e \\<longrightarrow> e'\" and\n  red_app_inv[elim!]: \"EApp e1 e2 \\<longrightarrow> e'\" and\n  red_cons_inv[elim!]:\"ECons e1 e2 \\<longrightarrow> e'\" and\n  red_car_inv[elim!]: \"ECar e \\<longrightarrow> e'\" and\n  red_cdr_inv[elim!]: \"ECdr e \\<longrightarrow> e'\"\n\ninductive multi_step :: \"exp \\<Rightarrow> exp \\<Rightarrow> bool\" (infix \"\\<longrightarrow>*\" 55) where\n  ms_nil[intro!]: \"e \\<longrightarrow>* e\" |\n  ms_cons[intro!]: \"\\<lbrakk> e1 \\<longrightarrow> e2; e2 \\<longrightarrow>* e3 \\<rbrakk> \\<Longrightarrow> e1 \\<longrightarrow>* e3\"\n\ndefinition diverge :: \"exp \\<Rightarrow> bool\" where\n  \"diverge e \\<equiv> (\\<forall> e'. e \\<longrightarrow>* e' \\<longrightarrow> (\\<exists> e''. e' \\<longrightarrow> e''))\"\n  \ndefinition stuck :: \"exp \\<Rightarrow> bool\" where\n  \"stuck e \\<equiv> \\<not> (\\<exists> e'. e \\<longrightarrow> e')\" \ndeclare stuck_def[simp]\n\ndefinition goes_wrong :: \"exp \\<Rightarrow> bool\" where\n  \"goes_wrong e \\<equiv> \\<exists> e'. e \\<longrightarrow>* e' \\<and> stuck e' \\<and> \\<not> isval e'\"\ndeclare goes_wrong_def[simp]\n\ndatatype obs = ONat nat | OFun | OPair | OBad\n\nfun observe :: \"exp \\<Rightarrow> obs \\<Rightarrow> bool\" where\n  \"observe (ENat n) (ONat n') = (n = n')\" |\n  \"observe (ELam x e) OFun = True\" |\n  \"observe (ECons e1 e2) OPair = True\" |\n  \"observe e ob = False\" \n\ndefinition run :: \"exp \\<Rightarrow> obs \\<Rightarrow> bool\" (infix \"\\<Down>\" 52) where\n  \"run e ob \\<equiv> ((\\<exists> v. e \\<longrightarrow>* v \\<and> observe v ob)\n              \\<or> ((diverge e \\<or> goes_wrong e) \\<and> ob = OBad))\"\n\nlemma cons_vals: \"isval (ECons e1 e2) \\<Longrightarrow> isval e1 \\<and> isval e2\"\n  by blast\n\nlemma val_stuck: fixes e::exp assumes val_e: \"isval e\" shows \"stuck e\"\nproof (rule classical)\n  assume \"\\<not> stuck e\"\n  from this obtain e' where red: \"e \\<longrightarrow> e'\" by auto \n  from val_e red have \"False\" by (case_tac e) auto\n  from this show ?thesis ..\nqed\n\nlemma subst_fv_aux: assumes fvv: \"FV v = {}\" shows \"FV (subst x v e) \\<subseteq> FV e - {x}\"\n  using fvv\nproof (induction e arbitrary: x v rule: exp.induct)\n  case (EVar x)\n  then show ?case by auto\nnext\n  case (ENat x)\n  then show ?case by auto\nnext\n  case (ELam y e)\n  then show ?case by (cases \"x = y\") auto\nnext\n  case (ECar x)\n  then show ?case by auto\nnext\n  case (ECdr x)\n  then show ?case by auto\nqed (simp,blast)+\n\nlemma subst_fv:  assumes fv_e: \"FV e \\<subseteq> {x}\" and fv_v: \"FV v = {}\" \n  shows \"FV (subst x v e) = {}\"\n  using fv_e fv_v subst_fv_aux by blast\n    \nlemma red_pres_fv:  fixes e::exp assumes red: \"e \\<longrightarrow> e'\" and fv: \"FV e = {}\" shows \"FV e' = {}\"\n  using red fv\nproof (induction rule: reduce.induct)\n  case (beta v x e)\n  then show ?case using subst_fv by auto\nqed fastforce+\n    \nlemma reduction_pres_fv: fixes e::exp assumes r: \"e \\<longrightarrow>* e'\" and fv: \"FV e = {}\" shows \"FV e' = {}\"\n  using r fv\nproof (induction)\n  case (ms_nil e)\n  then show ?case by blast\nnext\n  case (ms_cons e1 e2 e3)\n  then show ?case using red_pres_fv by auto\nqed\n\nend", "meta": {"author": "cderici", "repo": "denotational-semantics-LC-with-pairs", "sha": "23081a67ee7d9035b62052d9206cd5e97d3e141f", "save_path": "github-repos/isabelle/cderici-denotational-semantics-LC-with-pairs", "path": "github-repos/isabelle/cderici-denotational-semantics-LC-with-pairs/denotational-semantics-LC-with-pairs-23081a67ee7d9035b62052d9206cd5e97d3e141f/Decl_Sem_Fun_PL-with-pairs/SmallStepLam.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.6548947223065755, "lm_q1q2_score": 0.33000549161721204}}
{"text": "(*\n * Copyright 2023, Proofcraft Pty Ltd\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Example_Valid_State\nimports\n  \"ArchNoninterference\"\n  \"Lib.Distinct_Cmd\"\nbegin\n\nsection \\<open>Example\\<close>\n\n(* This example is a classic 'one way information flow'\n   example, where information is allowed to flow from Low to High,\n   but not the reverse. We consider a typical scenario where\n   shared memory and an notification for notifications are used to\n   implement a ring-buffer. We consider the NTFN to be in the domain of High,\n   and the shared memory to be in the domain of Low. *)\n\n(* basic machine-level declarations that need to happen outside the locale *)\n\nconsts s0_context :: user_context\n\n(* define the irqs to come regularly every 10 *)\n\naxiomatization where\n  irq_oracle_def: \"ARM.irq_oracle \\<equiv> \\<lambda>pos. if pos mod 10 = 0 then 10 else 0\"\n\ncontext begin interpretation Arch . (*FIXME: arch_split*)\n\nsubsection \\<open>We show that the authority graph does not let\n              information flow from High to Low\\<close>\n\ndatatype auth_graph_label = High | Low | IRQ0\n\nabbreviation partition_label where\n  \"partition_label x \\<equiv> OrdinaryLabel x\"\n\ndefinition Sys1AuthGraph :: \"(auth_graph_label subject_label) auth_graph\" where\n  \"Sys1AuthGraph \\<equiv>\n   { (partition_label High,Read,partition_label Low),\n     (partition_label Low,Notify,partition_label High),\n     (partition_label Low,Reset,partition_label High),\n     (SilcLabel,Notify,partition_label High),\n     (SilcLabel,Reset,partition_label High)\n   } \\<union> {(x, a, y). x = y}\"\n\nlemma subjectReads_Low: \"subjectReads Sys1AuthGraph (partition_label Low) = {partition_label Low}\"\n  apply(rule equalityI)\n   apply(rule subsetI)\n   apply(erule subjectReads.induct, (fastforce simp: Sys1AuthGraph_def)+)\n  done\n\nlemma Low_in_subjectReads_High:\n  \"partition_label Low \\<in> subjectReads Sys1AuthGraph (partition_label High)\"\n  apply (simp add: Sys1AuthGraph_def reads_read)\n  done\n\nlemma subjectReads_High: \"subjectReads Sys1AuthGraph (partition_label High) = {partition_label High,partition_label Low}\"\n  apply(rule equalityI)\n   apply(rule subsetI)\n   apply(erule subjectReads.induct, (fastforce simp: Sys1AuthGraph_def)+)\n  apply(auto intro: Low_in_subjectReads_High)\n  done\n\nlemma subjectReads_IRQ0: \"subjectReads Sys1AuthGraph (partition_label IRQ0) = {partition_label IRQ0}\"\n  apply(rule equalityI)\n   apply(rule subsetI)\n   apply(erule subjectReads.induct, (fastforce simp: Sys1AuthGraph_def)+)\n  done\n\nlemma High_in_subjectAffects_Low:\n  \"partition_label High \\<in> subjectAffects Sys1AuthGraph (partition_label Low)\"\n  apply(rule affects_ep)\n   apply (simp add: Sys1AuthGraph_def)\n   apply (rule disjI1, simp+)\n   done\n\nlemma subjectAffects_Low: \"subjectAffects Sys1AuthGraph (partition_label Low) = {partition_label Low, partition_label High}\"\n  apply(rule equalityI)\n   apply(rule subsetI)\n   apply(erule subjectAffects.induct, (fastforce simp: Sys1AuthGraph_def)+)\n  apply(auto intro: affects_lrefl High_in_subjectAffects_Low)\n  done\n\nlemma subjectAffects_High: \"subjectAffects Sys1AuthGraph (partition_label High) = {partition_label High}\"\n  apply(rule equalityI)\n   apply(rule subsetI)\n   apply(erule subjectAffects.induct, (fastforce simp: Sys1AuthGraph_def)+)\n  apply(auto intro: affects_lrefl)\n  done\n\nlemma subjectAffects_IRQ0: \"subjectAffects Sys1AuthGraph (partition_label IRQ0) = {partition_label IRQ0}\"\n  apply(rule equalityI)\n   apply(rule subsetI)\n   apply(erule subjectAffects.induct, (fastforce simp: Sys1AuthGraph_def)+)\n  apply(auto intro: affects_lrefl)\n  done\n\n\n\nlemmas subjectReads = subjectReads_High subjectReads_Low subjectReads_IRQ0\n\n\n\nlemma partsSubjectAffects_Low: \"partsSubjectAffects Sys1AuthGraph Low = {Partition Low, Partition High}\"\n  apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_Low | case_tac xa, rename_tac xa)+\n  done\n\nlemma partsSubjectAffects_High: \"partsSubjectAffects Sys1AuthGraph High = {Partition High}\"\n  apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_High | rename_tac xa, case_tac xa)+\n  done\n\nlemma partsSubjectAffects_IRQ0: \"partsSubjectAffects Sys1AuthGraph IRQ0 = {Partition IRQ0}\"\n  apply(auto simp: partsSubjectAffects_def image_def label_can_affect_partition_def subjectReads subjectAffects_IRQ0 | rename_tac xa, case_tac xa)+\n  done\n\nlemmas partsSubjectAffects =\n   partsSubjectAffects_High partsSubjectAffects_Low partsSubjectAffects_IRQ0\n\n\ndefinition example_policy where\n  \"example_policy \\<equiv> {(PSched, d)|d. True} \\<union>\n                    {(d,e). d = e} \\<union>\n                    {(Partition Low, Partition High)}\"\n\nlemma \"policyFlows Sys1AuthGraph = example_policy\"\n  apply(rule equalityI)\n   apply(rule subsetI)\n   apply(clarsimp simp: example_policy_def)\n   apply(erule policyFlows.cases)\n    apply(case_tac l, auto simp: partsSubjectAffects)[1]\n   apply assumption\n  apply(rule subsetI)\n  apply(clarsimp simp: example_policy_def)\n  apply(elim disjE)\n    apply(fastforce simp: partsSubjectAffects intro: policy_affects)\n   apply(fastforce intro: policy_scheduler)\n  apply(fastforce intro: policyFlows_refl refl_onD)\n  done\n\nsubsection \\<open>We show there exists a valid initial state associated to the\n              above authority graph\\<close>\n\ntext \\<open>\n\nThis example (modified from ../access-control/ExampleSystem) is a system Sys1 made\nof 2 main components Low and High, connected through an notification NTFN.\nBoth Low and High contains:\n\n  . one TCB\n  . one vspace made up of one page directory\n  . each pd contains a single page table, with access to a shared page in memory\n     Low can read/write to this page, High can only read\n  . one cspace made up of one cnode\n  . each cspace contains 4 caps:\n         one to the tcb\n         one to the cnode itself\n         one to the vspace\n         one to the ntfn\n\nLow can send to the ntfn while High can receive from it.\n\nAttempt to ASCII art:\n\n\n          --------    ----                    ----   --------\n          |       |   |  |                    |  |   |      |\n          V       |   |  V    S         R     |  V   |      V\nLow_tcb(3079)-->Low_cnode(6)--->ntfn(9)<---High_cnode(7)<--High_tcb(3080)\n  |              |                               |          |\n  V              |                               |          V\nLow_pd(3063)<-----                               -------> High_pd(3065)\n  |                                                         |\n  V               R/W                           R           V\nLow_pt(3072)---------------->shared_page<-----------------High_pt(3077)\n\n\n(the references are derived from the dump of the SAC system)\n\n\nThe aim is to be able to prove\n\n  valid_initial_state s0_internal Sys1PAS timer_irq utf\n\nwhere Sys1PAS is the label graph defining the AC policy for Sys1 using\nthe authority graph defined above and s0 is the state of Sys1 described above.\n\n\\<close>\n\nsubsubsection \\<open>Defining the State\\<close>\n\n\ndefinition \"ntfn_ptr \\<equiv> kernel_base + 0x10\"\n\ndefinition \"Low_tcb_ptr \\<equiv> kernel_base + 0x200\"\ndefinition \"High_tcb_ptr = kernel_base + 0x400\"\ndefinition \"idle_tcb_ptr = kernel_base + 0x1000\"\n\ndefinition \"Low_pt_ptr = kernel_base + 0x800\"\ndefinition \"High_pt_ptr = kernel_base + 0xC00\"\n\n\n(* init_globals_frame \\<equiv> {kernel_base + 0x5000,... kernel_base + 0x5FFF} *)\n\ndefinition \"shared_page_ptr_virt = kernel_base + 0x6000\"\ndefinition \"shared_page_ptr_phys = addrFromPPtr shared_page_ptr_virt\"\n\ndefinition \"Low_pd_ptr = kernel_base + 0x20000\"\ndefinition \"High_pd_ptr = kernel_base + 0x24000\"\n\ndefinition \"Low_cnode_ptr = kernel_base + 0x10000\"\ndefinition \"High_cnode_ptr = kernel_base + 0x14000\"\ndefinition \"Silc_cnode_ptr = kernel_base + 0x18000\"\ndefinition \"irq_cnode_ptr = kernel_base + 0x1C000\"\n\n(* init_global_pd \\<equiv> {kernel_base + 0x60000,... kernel_base + 0x603555} *)\n\ndefinition \"timer_irq \\<equiv> 10\" (* not sure exactly how this fits in *)\n\ndefinition \"Low_mcp \\<equiv> 5 :: word8\"\ndefinition \"Low_prio \\<equiv> 5 :: word8\"\ndefinition \"High_mcp \\<equiv> 5 :: word8\"\ndefinition \"High_prio \\<equiv> 5 :: word8\"\ndefinition \"Low_time_slice \\<equiv> 0 :: nat\"\ndefinition \"High_time_slice \\<equiv> 5 :: nat\"\ndefinition \"Low_domain \\<equiv> 0 :: word8\"\ndefinition \"High_domain \\<equiv> 1 :: word8\"\n\nlemmas s0_ptr_defs =\n  Low_cnode_ptr_def High_cnode_ptr_def Silc_cnode_ptr_def ntfn_ptr_def irq_cnode_ptr_def\n  Low_pd_ptr_def High_pd_ptr_def Low_pt_ptr_def High_pt_ptr_def Low_tcb_ptr_def\n  High_tcb_ptr_def idle_tcb_ptr_def timer_irq_def Low_prio_def High_prio_def Low_time_slice_def\n  Low_domain_def High_domain_def init_irq_node_ptr_def init_globals_frame_def init_global_pd_def\n  kernel_base_def shared_page_ptr_virt_def\n\n(* Distinctness proof of kernel pointers. *)\n\ndistinct ptrs_distinct [simp]:\n  Low_tcb_ptr High_tcb_ptr idle_tcb_ptr\n  Low_pt_ptr High_pt_ptr\n  shared_page_ptr_virt ntfn_ptr\n  Low_pd_ptr High_pd_ptr\n  Low_cnode_ptr High_cnode_ptr Silc_cnode_ptr irq_cnode_ptr\n  init_globals_frame init_global_pd\n  by (auto simp: s0_ptr_defs)\n\n\ntext \\<open>We need to define the asids of each pd and pt to ensure that\nthe object is included in the right ASID-label\\<close>\n\ntext \\<open>Low's ASID\\<close>\n\ndefinition\n  Low_asid :: machine_word\nwhere\n  \"Low_asid \\<equiv> 1<<asid_low_bits\"\n\ntext \\<open>High's ASID\\<close>\n\ndefinition\n  High_asid :: machine_word\nwhere\n  \"High_asid \\<equiv> 2<<asid_low_bits\"\n\nlemma \"asid_high_bits_of High_asid \\<noteq> asid_high_bits_of Low_asid\"\nby (simp add: Low_asid_def asid_high_bits_of_def High_asid_def asid_low_bits_def)\n\n\ntext \\<open>converting a nat to a bool list of size 10 - for the cnodes\\<close>\n\ndefinition\n  nat_to_bl :: \"nat \\<Rightarrow> nat \\<Rightarrow> bool list option\"\nwhere\n  \"nat_to_bl bits n \\<equiv>\n    if n \\<ge> 2^bits then\n      None\n    else\n      Some $ bin_to_bl bits (of_nat n)\"\n\nlemma nat_to_bl_id [simp]: \"nat_to_bl (size (x :: (('a::len) word))) (unat x) = Some (to_bl x)\"\n  by (clarsimp simp: nat_to_bl_def to_bl_def le_def word_size)\n\ndefinition\n  the_nat_to_bl :: \"nat \\<Rightarrow> nat \\<Rightarrow> bool list\"\nwhere\n  \"the_nat_to_bl sz n \\<equiv>\n      the (nat_to_bl sz (n mod 2^sz))\"\n\nabbreviation (input)\n  the_nat_to_bl_10  :: \"nat \\<Rightarrow> bool list\"\nwhere\n  \"the_nat_to_bl_10 n \\<equiv> the_nat_to_bl 10 n\"\n\nlemma len_the_nat_to_bl [simp]:\n    \"length (the_nat_to_bl x y) = x\"\n  apply (clarsimp simp: the_nat_to_bl_def nat_to_bl_def)\n  apply safe\n   apply (metis le_def mod_less_divisor nat_zero_less_power_iff zero_less_numeral)\n  apply (clarsimp simp: len_bin_to_bl_aux not_le)\n  done\n\nlemma tcb_cnode_index_nat_to_bl [simp]:\n  \"the_nat_to_bl_10 n \\<noteq> tcb_cnode_index n\"\n  by (clarsimp simp: tcb_cnode_index_def intro!: length_neq)\n\nlemma mod_less_self [simp]:\n    \"a \\<le> b mod a \\<longleftrightarrow> ((a :: nat) = 0)\"\n  by (metis mod_less_divisor nat_neq_iff not_less not_less0)\n\nlemma split_div_mod:\n    \"a = (b::nat) \\<longleftrightarrow> (a div k = b div k \\<and> a mod k = b mod k)\"\n  by (metis mult_div_mod_eq)\n\nlemma nat_to_bl_eq:\n  assumes \"a < 2 ^ n \\<or> b < 2 ^ n\"\n  shows \"nat_to_bl n a = nat_to_bl n b \\<longleftrightarrow> a = b\"\n  using assms\n  apply -\n  apply (erule disjE_R)\n   apply (clarsimp simp: nat_to_bl_def)\n  apply (case_tac \"a \\<ge> 2 ^ n\")\n   apply (clarsimp simp: nat_to_bl_def)\n  apply (clarsimp simp: not_le)\n  apply (induct n arbitrary: a b)\n   apply (clarsimp simp: nat_to_bl_def)\n  apply atomize\n  apply (clarsimp simp: nat_to_bl_def)\n  apply (erule_tac x=\"a div 2\" in allE)\n  apply (erule_tac x=\"b div 2\" in allE)\n  apply (erule impE)\n   apply (metis power_commutes td_gal_lt zero_less_numeral)\n  apply (clarsimp simp: bin_last_def zdiv_int)\n  apply (rule iffI [rotated], clarsimp)\n  apply (subst (asm) (1 2 3 4) bin_to_bl_aux_alt)\n  apply (clarsimp simp: mod_eq_dvd_iff)\n  apply (subst split_div_mod [where k=2])\n  apply clarsimp\n  apply presburger\n  done\n\nlemma nat_to_bl_mod_n_eq [simp]:\n    \"nat_to_bl n a = nat_to_bl n b \\<longleftrightarrow> ((a = b \\<and> a < 2 ^ n) \\<or> (a \\<ge> 2 ^ n \\<and> b \\<ge> 2 ^ n))\"\n  apply (rule iffI)\n  apply (clarsimp simp: not_le)\n  apply (subst (asm) nat_to_bl_eq, simp)\n  apply clarsimp\n  apply (erule disjE)\n   apply clarsimp\n  apply (clarsimp simp: nat_to_bl_def)\n  done\n\nlemma the_the_eq:\n    \"\\<lbrakk> x \\<noteq> None; y \\<noteq> None \\<rbrakk> \\<Longrightarrow> (the x = the y) = (x = y)\"\n  by auto\n\nlemma the_nat_to_bl_eq [simp]:\n    \"(the_nat_to_bl n a = the_nat_to_bl m b) \\<longleftrightarrow> (n = m \\<and> (a mod 2 ^ n = b mod 2 ^ n))\"\n  apply (case_tac \"n = m\")\n   apply (clarsimp simp: the_nat_to_bl_def)\n   apply (subst the_the_eq)\n     apply (clarsimp simp: nat_to_bl_def)\n    apply (clarsimp simp: nat_to_bl_def)\n   apply simp\n  apply simp\n  apply (metis len_the_nat_to_bl)\n  done\n\nlemma empty_cnode_eq_Some [simp]:\n    \"(empty_cnode n x = Some y) = (length x = n \\<and> y = NullCap)\"\n  by (clarsimp simp: empty_cnode_def, metis)\n\nlemma empty_cnode_eq_None [simp]:\n    \"(empty_cnode n x = None) = (length x \\<noteq> n)\"\n  by (clarsimp simp: empty_cnode_def)\n\ntext \\<open>Low's CSpace\\<close>\n\ndefinition\n  Low_caps :: cnode_contents\nwhere\n  \"Low_caps \\<equiv>\n   (empty_cnode 10)\n      ( (the_nat_to_bl_10 1)\n            \\<mapsto> ThreadCap Low_tcb_ptr,\n        (the_nat_to_bl_10 2)\n            \\<mapsto> CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2),\n        (the_nat_to_bl_10 3)\n            \\<mapsto> ArchObjectCap (PageDirectoryCap Low_pd_ptr\n                                             (Some Low_asid)),\n        (the_nat_to_bl_10 318)\n            \\<mapsto> NotificationCap ntfn_ptr 0 {AllowSend} )\"\n\ndefinition\n  Low_cnode :: kernel_object\nwhere\n  \"Low_cnode \\<equiv> CNode 10 Low_caps\"\n\nlemma ran_empty_cnode [simp]:\n    \"ran (empty_cnode C) = {NullCap}\"\n  by (auto simp: empty_cnode_def ran_def Ex_list_of_length intro: set_eqI)\n\nlemma empty_cnode_app [simp]:\n    \"length x = n \\<Longrightarrow> empty_cnode n x = Some NullCap\"\n  by (auto simp: empty_cnode_def)\n\nlemma in_ran_If [simp]:\n      \"(x \\<in> ran (\\<lambda>n. if P n then A n else B n))\n            \\<longleftrightarrow>  (\\<exists>n. P n \\<and> A n = Some x) \\<or> (\\<exists>n. \\<not> P n \\<and> B n = Some x)\"\n by (auto simp: ran_def)\n\n\nlemma Low_caps_ran:\n  \"ran Low_caps = {ThreadCap Low_tcb_ptr,\n                   CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2),\n                   ArchObjectCap (PageDirectoryCap Low_pd_ptr\n                                              (Some Low_asid)),\n                   NotificationCap ntfn_ptr 0 {AllowSend},\n                   NullCap}\"\n  apply (rule equalityI)\n   apply (clarsimp simp: Low_caps_def fun_upd_def empty_cnode_def split: if_split_asm)\n  apply (clarsimp simp: Low_caps_def fun_upd_def empty_cnode_def split: if_split_asm\n                  cong: conj_cong)\n  apply (rule exI [where x=\"the_nat_to_bl_10 0\"])\n  apply simp\n  done\n\ntext \\<open>High's Cspace\\<close>\n\ndefinition\n  High_caps :: cnode_contents\nwhere\n  \"High_caps \\<equiv>\n   (empty_cnode 10)\n      ( (the_nat_to_bl_10 1)\n            \\<mapsto> ThreadCap High_tcb_ptr,\n        (the_nat_to_bl_10 2)\n            \\<mapsto> CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2),\n        (the_nat_to_bl_10 3)\n           \\<mapsto> ArchObjectCap (PageDirectoryCap High_pd_ptr\n                                            (Some High_asid)),\n        (the_nat_to_bl_10 318)\n           \\<mapsto> NotificationCap ntfn_ptr 0 {AllowRecv}) \"\n\ndefinition\n  High_cnode :: kernel_object\nwhere\n  \"High_cnode \\<equiv> CNode 10 High_caps\"\n\nlemma High_caps_ran:\n  \"ran High_caps = {ThreadCap High_tcb_ptr,\n                    CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2),\n                    ArchObjectCap (PageDirectoryCap High_pd_ptr\n                                               (Some High_asid)),\n                    NotificationCap ntfn_ptr 0 {AllowRecv},\n                    NullCap}\"\n  apply (rule equalityI)\n   apply (clarsimp simp: High_caps_def ran_def empty_cnode_def split: if_split_asm)\n  apply (clarsimp simp: High_caps_def ran_def empty_cnode_def split: if_split_asm\n                  cong: conj_cong)\n  apply (rule exI [where x=\"the_nat_to_bl_10 0\"])\n  apply simp\n  done\n\ntext \\<open>We need a copy of boundary crossing caps owned by SilcLabel.\n        The only such cap is Low's cap to the notification\\<close>\n\ndefinition\n  Silc_caps :: cnode_contents\nwhere\n  \"Silc_caps \\<equiv>\n   (empty_cnode 10)\n      ( (the_nat_to_bl_10 2)\n            \\<mapsto> CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl_10 2),\n        (the_nat_to_bl_10 318)\n            \\<mapsto> NotificationCap ntfn_ptr 0 {AllowSend} )\"\n\n\ndefinition\n  Silc_cnode :: kernel_object\nwhere\n  \"Silc_cnode \\<equiv> CNode 10 Silc_caps\"\n\nlemma Silc_caps_ran:\n  \"ran Silc_caps = {CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl_10 2),\n                    NotificationCap ntfn_ptr 0 {AllowSend},\n                    NullCap}\"\n  apply (rule equalityI)\n   apply (clarsimp simp: Silc_caps_def ran_def empty_cnode_def)\n  apply (clarsimp simp: ran_def Silc_caps_def empty_cnode_def cong: conj_cong)\n  apply (rule_tac x=\"the_nat_to_bl_10 0\" in exI)\n  apply simp\n  done\n\ntext \\<open>notification between Low and High\\<close>\n\ndefinition\n  ntfn :: kernel_object\nwhere\n  \"ntfn \\<equiv> Notification \\<lparr>ntfn_obj = WaitingNtfn [High_tcb_ptr], ntfn_bound_tcb=None\\<rparr>\"\n\n\ntext \\<open>Low's VSpace (PageDirectory)\\<close>\n\ndefinition\n  Low_pt' :: \"word8 \\<Rightarrow> pte \"\nwhere\n  \"Low_pt' \\<equiv> (\\<lambda>_. InvalidPTE)\n            (0 := SmallPagePTE shared_page_ptr_phys {} vm_read_write)\"\n\ndefinition\n  Low_pt :: kernel_object\nwhere\n  \"Low_pt \\<equiv> ArchObj (PageTable Low_pt')\"\n\n\ndefinition\n  Low_pd' :: \"12 word \\<Rightarrow> pde \"\nwhere\n  \"Low_pd' \\<equiv>\n    global_pd\n     (0 := PageTablePDE\n              (addrFromPPtr Low_pt_ptr)\n              {}\n              undefined )\"\n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n  Low_pd :: kernel_object\nwhere\n  \"Low_pd \\<equiv> ArchObj (PageDirectory Low_pd')\"\n\n\ntext \\<open>High's VSpace (PageDirectory)\\<close>\n\n\ndefinition\n  High_pt' :: \"word8 \\<Rightarrow> pte \"\nwhere\n  \"High_pt' \\<equiv>\n    (\\<lambda>_. InvalidPTE)\n     (0 := SmallPagePTE shared_page_ptr_phys {} vm_read_only)\"\n\n\ndefinition\n  High_pt :: kernel_object\nwhere\n  \"High_pt \\<equiv> ArchObj (PageTable High_pt')\"\n\n\ndefinition\n  High_pd' :: \"12 word \\<Rightarrow> pde \"\nwhere\n  \"High_pd' \\<equiv>\n    global_pd\n     (0 := PageTablePDE\n             (addrFromPPtr High_pt_ptr)\n             {}\n             undefined )\"\n\n(* used addrFromPPtr because proof gives me ptrFromAddr.. TODO: check\nif it's right *)\n\ndefinition\n  High_pd :: kernel_object\nwhere\n  \"High_pd \\<equiv> ArchObj (PageDirectory High_pd')\"\n\n\ntext \\<open>Low's tcb\\<close>\n\ndefinition\n  Low_tcb :: kernel_object\nwhere\n  \"Low_tcb \\<equiv>\n   TCB \\<lparr>\n     tcb_ctable        = CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2),\n     tcb_vtable        = ArchObjectCap\n                           (PageDirectoryCap Low_pd_ptr (Some Low_asid)),\n     tcb_reply         = ReplyCap Low_tcb_ptr True {AllowGrant, AllowWrite}, \\<comment> \\<open>master reply cap\\<close>\n     tcb_caller        = NullCap,\n     tcb_ipcframe      = NullCap,\n     tcb_state         = Running,\n     tcb_fault_handler = replicate word_bits False,\n     tcb_ipc_buffer    = 0,\n     tcb_fault         = None,\n     tcb_bound_notification     = None,\n     tcb_mcpriority    = Low_mcp,\n     tcb_arch = \\<lparr>tcb_context = undefined\\<rparr>\\<rparr>\"\n\ndefinition\n  Low_etcb :: etcb\nwhere\n  \"Low_etcb \\<equiv> \\<lparr>tcb_priority   = Low_prio,\n               tcb_time_slice = Low_time_slice,\n               tcb_domain     = Low_domain\\<rparr>\"\n\n\ntext \\<open>High's tcb\\<close>\n\ndefinition\n  High_tcb :: kernel_object\nwhere\n  \"High_tcb \\<equiv>\n   TCB \\<lparr>\n     tcb_ctable        = CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2) ,\n     tcb_vtable        = ArchObjectCap\n                           (PageDirectoryCap High_pd_ptr (Some High_asid)),\n     tcb_reply         = ReplyCap High_tcb_ptr True {AllowGrant,AllowWrite}, \\<comment> \\<open>master reply cap to itself\\<close>\n     tcb_caller        = NullCap,\n     tcb_ipcframe      = NullCap,\n     tcb_state         = BlockedOnNotification ntfn_ptr,\n     tcb_fault_handler = replicate word_bits False,\n     tcb_ipc_buffer    = 0,\n     tcb_fault         = None,\n     tcb_bound_notification     = None,\n     tcb_mcpriority    = High_mcp,\n     tcb_arch = \\<lparr>tcb_context = undefined\\<rparr>\\<rparr>\"\n\ndefinition\n  High_etcb :: etcb\nwhere\n  \"High_etcb \\<equiv> \\<lparr>tcb_priority   = High_prio,\n                tcb_time_slice = High_time_slice,\n                tcb_domain     = High_domain\\<rparr>\"\n\n\ntext \\<open>idle's tcb\\<close>\n\ndefinition\n  idle_tcb :: kernel_object\nwhere\n  \"idle_tcb \\<equiv>\n   TCB \\<lparr>\n     tcb_ctable        = NullCap,\n     tcb_vtable        = NullCap,\n     tcb_reply         = NullCap,\n     tcb_caller        = NullCap,\n     tcb_ipcframe      = NullCap,\n     tcb_state         = IdleThreadState,\n     tcb_fault_handler = replicate word_bits False,\n     tcb_ipc_buffer    = 0,\n     tcb_fault         = None,\n     tcb_bound_notification     = None,\n     tcb_mcpriority    = default_priority,\n     tcb_arch = \\<lparr>tcb_context = empty_context\\<rparr>\\<rparr>\"\n\n\ndefinition\n \"irq_cnode \\<equiv> CNode 0 (Map.empty([] \\<mapsto> cap.NullCap))\"\n\ndefinition\n  kh0 :: kheap\nwhere\n  \"kh0 \\<equiv> (\\<lambda>x. if \\<exists>irq::10 word. init_irq_node_ptr + (ucast irq << cte_level_bits) = x\n          then Some (CNode 0 (empty_cnode 0)) else None)\n         (Low_cnode_ptr  \\<mapsto> Low_cnode,\n          High_cnode_ptr \\<mapsto> High_cnode,\n          Silc_cnode_ptr \\<mapsto> Silc_cnode,\n          ntfn_ptr        \\<mapsto> ntfn,\n          irq_cnode_ptr  \\<mapsto> irq_cnode,\n          Low_pd_ptr     \\<mapsto> Low_pd,\n          High_pd_ptr    \\<mapsto> High_pd,\n          Low_pt_ptr     \\<mapsto> Low_pt,\n          High_pt_ptr    \\<mapsto> High_pt,\n          Low_tcb_ptr    \\<mapsto> Low_tcb,\n          High_tcb_ptr   \\<mapsto> High_tcb,\n          idle_tcb_ptr   \\<mapsto> idle_tcb,\n          init_globals_frame \\<mapsto> ArchObj (DataPage False ARMSmallPage),\n          init_global_pd \\<mapsto> ArchObj (PageDirectory global_pd))\"\n\nlemma irq_node_offs_min:\n  \"init_irq_node_ptr \\<le> init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits)\"\n  apply (rule_tac sz=28 in machine_word_plus_mono_right_split)\n   apply (simp add: unat_word_ariths mask_def shiftl_t2n s0_ptr_defs cte_level_bits_def)\n   apply (cut_tac x=irq and 'a=32 in ucast_less)\n    apply simp\n   apply (simp add: word_less_nat_alt)\n  apply (simp add: word_bits_def)\n  done\n\nlemma irq_node_offs_max:\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) < init_irq_node_ptr + 0x4000\"\n  apply (simp add: s0_ptr_defs cte_level_bits_def shiftl_t2n)\n  apply (cut_tac x=irq and 'a=32 in ucast_less)\n   apply simp\n  apply (simp add: word_less_nat_alt unat_word_ariths)\n  done\n\ndefinition irq_node_offs_range where\n  \"irq_node_offs_range \\<equiv> {x. init_irq_node_ptr \\<le> x \\<and> x < init_irq_node_ptr + 0x4000}\n                         \\<inter> {x. is_aligned x cte_level_bits}\"\n\n\n\nlemma irq_node_offs_in_range:\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits)\n     \\<in> irq_node_offs_range\"\n  apply (clarsimp simp: irq_node_offs_min irq_node_offs_max irq_node_offs_range_def)\n  apply (rule is_aligned_add[OF _ is_aligned_shift])\n  apply (simp add: is_aligned_def s0_ptr_defs cte_level_bits_def)\n  done\n\nlemma irq_node_offs_range_correct:\n  \"x \\<in> irq_node_offs_range\n    \\<Longrightarrow> \\<exists>irq. x = init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits)\"\n  apply (clarsimp simp: irq_node_offs_min irq_node_offs_max irq_node_offs_range_def\n                        s0_ptr_defs cte_level_bits_def)\n  apply (rule_tac x=\"ucast ((x - 0xE0008000) >> 4)\" in exI)\n  apply (clarsimp simp: ucast_ucast_mask)\n  apply (subst aligned_shiftr_mask_shiftl)\n   apply (rule aligned_sub_aligned)\n     apply assumption\n    apply (simp add: is_aligned_def)\n   apply simp\n  apply simp\n  apply (rule_tac n=14 in mask_eqI)\n   apply (subst mask_add_aligned)\n    apply (simp add: is_aligned_def)\n   apply (simp add: mask_twice)\n   apply (simp add: diff_conv_add_uminus del: add_uminus_conv_diff)\n   apply (subst add.commute[symmetric])\n   apply (subst mask_add_aligned)\n    apply (simp add: is_aligned_def)\n   apply simp\n  apply (simp add: diff_conv_add_uminus del: add_uminus_conv_diff)\n  apply (subst add_mask_lower_bits)\n    apply (simp add: is_aligned_def)\n   apply clarsimp\n  apply (cut_tac x=x and y=\"0xE000BFFF\" and n=14 in neg_mask_mono_le)\n   apply (force dest: word_less_sub_1)\n  apply (drule_tac n=14 in aligned_le_sharp)\n   apply (simp add: is_aligned_def)\n  apply (simp add: mask_def)\n  done\n\nlemma irq_node_offs_range_distinct[simp]:\n  \"Low_cnode_ptr \\<notin> irq_node_offs_range\"\n  \"High_cnode_ptr \\<notin> irq_node_offs_range\"\n  \"Silc_cnode_ptr \\<notin> irq_node_offs_range\"\n  \"ntfn_ptr \\<notin> irq_node_offs_range\"\n  \"irq_cnode_ptr \\<notin> irq_node_offs_range\"\n  \"Low_pd_ptr \\<notin> irq_node_offs_range\"\n  \"High_pd_ptr \\<notin> irq_node_offs_range\"\n  \"Low_pt_ptr \\<notin> irq_node_offs_range\"\n  \"High_pt_ptr \\<notin> irq_node_offs_range\"\n  \"Low_tcb_ptr \\<notin> irq_node_offs_range\"\n  \"High_tcb_ptr \\<notin> irq_node_offs_range\"\n  \"idle_tcb_ptr \\<notin> irq_node_offs_range\"\n  \"init_globals_frame \\<notin> irq_node_offs_range\"\n  \"init_global_pd \\<notin> irq_node_offs_range\"\n  by(simp add:irq_node_offs_range_def s0_ptr_defs)+\n\nlemma irq_node_offs_distinct[simp]:\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> Low_cnode_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> High_cnode_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> Silc_cnode_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> ntfn_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> irq_cnode_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> Low_pd_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> High_pd_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> Low_pt_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> High_pt_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> Low_tcb_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> High_tcb_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> idle_tcb_ptr\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> init_globals_frame\"\n  \"init_irq_node_ptr + (ucast (irq:: 10 word) << cte_level_bits) \\<noteq> init_global_pd\"\n  by (simp add:not_inD[symmetric, OF _ irq_node_offs_in_range])+\n\nlemma kh0_dom:\n  \"dom kh0 = {init_globals_frame, init_global_pd, idle_tcb_ptr, High_tcb_ptr, Low_tcb_ptr,\n              High_pt_ptr, Low_pt_ptr, High_pd_ptr, Low_pd_ptr, irq_cnode_ptr, ntfn_ptr,\n              Silc_cnode_ptr, High_cnode_ptr, Low_cnode_ptr} \\<union>\n             irq_node_offs_range\"\n  apply (rule equalityI)\n   apply (simp add: kh0_def dom_def)\n   apply (clarsimp simp: irq_node_offs_in_range)\n  apply (clarsimp simp: dom_def)\n  apply (rule conjI, clarsimp simp: kh0_def)+\n  apply (force simp: kh0_def cte_level_bits_def dest: irq_node_offs_range_correct)\n  done\n\nlemmas kh0_SomeD' = set_mp[OF equalityD1[OF kh0_dom[simplified dom_def]], OF CollectI, simplified, OF exI]\n\nlemma kh0_SomeD:\n  \"kh0 x = Some y \\<Longrightarrow>\n        x = init_globals_frame \\<and> y = ArchObj (DataPage False ARMSmallPage) \\<or>\n        x = init_global_pd \\<and> y = ArchObj (PageDirectory global_pd) \\<or>\n        x = idle_tcb_ptr \\<and> y = idle_tcb \\<or>\n        x = High_tcb_ptr \\<and> y = High_tcb \\<or>\n        x = Low_tcb_ptr \\<and> y = Low_tcb \\<or>\n        x = High_pt_ptr \\<and> y = High_pt \\<or>\n        x = Low_pt_ptr \\<and> y = Low_pt \\<or>\n        x = High_pd_ptr \\<and> y = High_pd \\<or>\n        x = Low_pd_ptr \\<and> y = Low_pd \\<or>\n        x = irq_cnode_ptr \\<and> y = irq_cnode \\<or>\n        x = ntfn_ptr \\<and> y = ntfn \\<or>\n        x = Silc_cnode_ptr \\<and> y = Silc_cnode \\<or>\n        x = High_cnode_ptr \\<and> y = High_cnode \\<or>\n        x = Low_cnode_ptr \\<and> y = Low_cnode \\<or>\n        x \\<in> irq_node_offs_range \\<and> y = CNode 0 (empty_cnode 0)\"\n  apply (frule kh0_SomeD')\n  apply (erule disjE, simp add: kh0_def\n        | force simp: kh0_def split: if_split_asm)+\n  done\n\nlemmas kh0_obj_def =\n  Low_cnode_def High_cnode_def Silc_cnode_def ntfn_def irq_cnode_def Low_pd_def\n  High_pd_def Low_pt_def High_pt_def Low_tcb_def High_tcb_def idle_tcb_def\n\ndefinition exst0 :: \"det_ext\" where\n  \"exst0 \\<equiv> \\<lparr>work_units_completed_internal = undefined,\n             scheduler_action_internal = resume_cur_thread,\n             ekheap_internal = [Low_tcb_ptr  \\<mapsto> Low_etcb,\n                                High_tcb_ptr \\<mapsto> High_etcb,\n                                idle_tcb_ptr \\<mapsto> default_etcb],\n             domain_list_internal = [(0, 10), (1, 10)],\n             domain_index_internal = 0,\n             cur_domain_internal = 0,\n             domain_time_internal = 5,\n             ready_queues_internal = (const (const [])),\n             cdt_list_internal = const []\\<rparr>\"\n\nlemmas ekh0_obj_def =\n  Low_etcb_def High_etcb_def default_etcb_def\n\ndefinition machine_state0 :: \"machine_state\" where\n  \"machine_state0 \\<equiv> \\<lparr>irq_masks = (\\<lambda>irq. if irq = timer_irq then False else True),\n                     irq_state = 0,\n                     underlying_memory = const 0,\n                     device_state = Map.empty,\n                     exclusive_state = undefined,\n                     machine_state_rest = undefined\\<rparr>\"\n\ndefinition arch_state0 :: \"arch_state\" where\n  \"arch_state0 \\<equiv> \\<lparr>arm_asid_table = Map.empty,\n                  arm_hwasid_table = Map.empty, arm_next_asid = 0, arm_asid_map = Map.empty,\n                  arm_global_pd = init_global_pd, arm_global_pts = [],\n                  arm_kernel_vspace =\n       \\<lambda>ref. if ref \\<in> {kernel_base..kernel_base + mask 20} then ArmVSpaceKernelWindow\n               else ArmVSpaceInvalidRegion\\<rparr>\"\n\ndefinition\n  s0_internal :: \"det_ext state\"\nwhere\n  \"s0_internal \\<equiv>  \\<lparr>\n    kheap = kh0,\n    cdt = Map.empty,\n    is_original_cap =  (\\<lambda>_. False) ((Low_tcb_ptr, tcb_cnode_index 2) := True,\n                                    (High_tcb_ptr, tcb_cnode_index 2) := True),\n    cur_thread = Low_tcb_ptr,\n    idle_thread = idle_tcb_ptr,\n    machine_state = machine_state0,\n    interrupt_irq_node = (\\<lambda>irq. init_irq_node_ptr + (ucast irq << cte_level_bits)),\n    interrupt_states = (\\<lambda>_. irq_state.IRQInactive) (timer_irq := irq_state.IRQTimer),\n    arch_state = arch_state0,\n     exst = exst0\n   \\<rparr>\"\n\n\nsubsubsection \\<open>Defining the policy graph\\<close>\n\n(* FIXME: should incorporate SharedPage above *)\n\n(* There is an NTFN in the High label, a SharedPage in the Low label *)\n\ndefinition\n  Sys1AgentMap :: \"(auth_graph_label subject_label) agent_map\"\nwhere\n  \"Sys1AgentMap \\<equiv>\n   (\\<lambda>p. if p \\<in> ptr_range shared_page_ptr_virt pageBits\n          then partition_label Low else partition_label IRQ0)\n            \\<comment> \\<open>set the range of the shared_page to Low, default everything else to IRQ0\\<close>\n     (Low_cnode_ptr := partition_label Low,\n      High_cnode_ptr := partition_label High,\n      ntfn_ptr := partition_label High,\n      irq_cnode_ptr := partition_label IRQ0,\n      Silc_cnode_ptr := SilcLabel,\n      Low_pd_ptr := partition_label Low,\n      High_pd_ptr := partition_label High,\n      Low_pt_ptr := partition_label Low,\n      High_pt_ptr := partition_label High,\n      Low_tcb_ptr := partition_label Low,\n      High_tcb_ptr := partition_label High,\n      idle_tcb_ptr := partition_label Low)\"\n\nlemma Sys1AgentMap_simps:\n  \"Sys1AgentMap Low_cnode_ptr = partition_label Low\"\n      \"Sys1AgentMap High_cnode_ptr = partition_label High\"\n      \"Sys1AgentMap ntfn_ptr = partition_label High\"\n      \"Sys1AgentMap irq_cnode_ptr = partition_label IRQ0\"\n      \"Sys1AgentMap Silc_cnode_ptr = SilcLabel\"\n      \"Sys1AgentMap Low_pd_ptr = partition_label Low\"\n      \"Sys1AgentMap High_pd_ptr = partition_label High\"\n      \"Sys1AgentMap Low_pt_ptr = partition_label Low\"\n      \"Sys1AgentMap High_pt_ptr = partition_label High\"\n      \"Sys1AgentMap Low_tcb_ptr = partition_label Low\"\n      \"Sys1AgentMap High_tcb_ptr = partition_label High\"\n      \"Sys1AgentMap idle_tcb_ptr = partition_label Low\"\n      \"\\<And>p. p \\<in> ptr_range shared_page_ptr_virt pageBits\n          \\<Longrightarrow> Sys1AgentMap p = partition_label Low\"\n  unfolding Sys1AgentMap_def\n  apply simp_all\n  by (auto simp: s0_ptr_defs ptr_range_def pageBits_def)\n\ndefinition\n  Sys1ASIDMap :: \"(auth_graph_label subject_label) agent_asid_map\"\nwhere\n  \"Sys1ASIDMap \\<equiv>\n    (\\<lambda>x. if (asid_high_bits_of x = asid_high_bits_of Low_asid)\n          then partition_label Low\n         else if (asid_high_bits_of x = asid_high_bits_of High_asid)\n          then partition_label High else undefined)\"\n\n(* We include 2 domains, Low is associated to domain 0, High to domain 1, we default the rest of the possible domains to High *)\n\ndefinition Sys1PAS :: \"(auth_graph_label subject_label) PAS\" where\n  \"Sys1PAS \\<equiv> \\<lparr>\n    pasObjectAbs = Sys1AgentMap,\n    pasASIDAbs = Sys1ASIDMap,\n    pasIRQAbs = (\\<lambda>_. partition_label IRQ0),\n    pasPolicy = Sys1AuthGraph,\n    pasSubject = partition_label Low,\n    pasMayActivate = True,\n    pasMayEditReadyQueues = True, pasMaySendIrqs = False,\n    pasDomainAbs = ((\\<lambda>_. {partition_label High})(0 := {partition_label Low}))\n   \\<rparr>\"\n\nsubsubsection \\<open>Proof of pas_refined for Sys1\\<close>\n\nlemma High_caps_well_formed: \"well_formed_cnode_n 10 High_caps\"\n  by (auto simp: High_caps_def well_formed_cnode_n_def  split: if_split_asm)\n\nlemma Low_caps_well_formed: \"well_formed_cnode_n 10 Low_caps\"\n  by (auto simp: Low_caps_def well_formed_cnode_n_def  split: if_split_asm)\n\nlemma Silc_caps_well_formed: \"well_formed_cnode_n 10 Silc_caps\"\n  by (auto simp: Silc_caps_def well_formed_cnode_n_def  split: if_split_asm)\n\nlemma s0_caps_of_state :\n  \"caps_of_state s0_internal p = Some cap \\<Longrightarrow>\n     cap = NullCap \\<or>\n     (p,cap) \\<in>\n       { ((Low_cnode_ptr::obj_ref,(the_nat_to_bl_10 1)),  ThreadCap Low_tcb_ptr),\n         ((Low_cnode_ptr::obj_ref,(the_nat_to_bl_10 2)),  CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2)),\n         ((Low_cnode_ptr::obj_ref,(the_nat_to_bl_10 3)),  ArchObjectCap (PageDirectoryCap Low_pd_ptr (Some Low_asid))),\n         ((Low_cnode_ptr::obj_ref,(the_nat_to_bl_10 318)),NotificationCap ntfn_ptr 0 {AllowSend}),\n         ((High_cnode_ptr::obj_ref,(the_nat_to_bl_10 1)),  ThreadCap High_tcb_ptr),\n         ((High_cnode_ptr::obj_ref,(the_nat_to_bl_10 2)),  CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2)),\n         ((High_cnode_ptr::obj_ref,(the_nat_to_bl_10 3)),  ArchObjectCap (PageDirectoryCap High_pd_ptr (Some High_asid))),\n         ((High_cnode_ptr::obj_ref,(the_nat_to_bl_10 318)),NotificationCap  ntfn_ptr 0 {AllowRecv}) ,\n         ((Silc_cnode_ptr::obj_ref,(the_nat_to_bl_10 2)),CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl_10 2)),\n         ((Silc_cnode_ptr::obj_ref,(the_nat_to_bl_10 318)),NotificationCap ntfn_ptr 0 {AllowSend}),\n         ((Low_tcb_ptr::obj_ref, (tcb_cnode_index 0)), CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2)),\n         ((Low_tcb_ptr::obj_ref, (tcb_cnode_index 1)), ArchObjectCap (PageDirectoryCap Low_pd_ptr (Some Low_asid))),\n         ((Low_tcb_ptr::obj_ref, (tcb_cnode_index 2)), ReplyCap Low_tcb_ptr True {AllowGrant, AllowWrite}),\n         ((Low_tcb_ptr::obj_ref, (tcb_cnode_index 3)), NullCap),\n         ((Low_tcb_ptr::obj_ref, (tcb_cnode_index 4)), NullCap),\n         ((High_tcb_ptr::obj_ref, (tcb_cnode_index 0)), CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2)),\n         ((High_tcb_ptr::obj_ref, (tcb_cnode_index 1)), ArchObjectCap (PageDirectoryCap High_pd_ptr (Some High_asid))),\n         ((High_tcb_ptr::obj_ref, (tcb_cnode_index 2)), ReplyCap High_tcb_ptr True {AllowGrant, AllowWrite}),\n         ((High_tcb_ptr::obj_ref, (tcb_cnode_index 3)), NullCap),\n         ((High_tcb_ptr::obj_ref, (tcb_cnode_index 4)), NullCap)} \"\n  supply if_cong[cong]\n  apply (insert High_caps_well_formed)\n  apply (insert Low_caps_well_formed)\n  apply (insert Silc_caps_well_formed)\n  apply (simp add: caps_of_state_cte_wp_at cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def)\n  apply (case_tac p, clarsimp)\n  apply (clarsimp split: if_splits)\n       apply (clarsimp simp: cte_wp_at_cases tcb_cap_cases_def\n                       split: if_split_asm)+\n    apply (clarsimp simp: Silc_caps_def split: if_splits)\n   apply (clarsimp simp: High_caps_def split: if_splits)\n  apply (clarsimp simp: Low_caps_def cte_wp_at_cases split: if_splits)\n  done\n\nlemma tcb_states_of_state_s0:\n  \"tcb_states_of_state s0_internal = [High_tcb_ptr \\<mapsto> thread_state.BlockedOnNotification ntfn_ptr,  Low_tcb_ptr \\<mapsto> thread_state.Running, idle_tcb_ptr \\<mapsto> thread_state.IdleThreadState ]\"\n  unfolding s0_internal_def tcb_states_of_state_def\n  apply (rule ext)\n  apply (simp add: get_tcb_def)\n  apply (simp add: kh0_def kh0_obj_def)\n  done\n\nlemma thread_bounds_of_state_s0:\n  \"thread_bound_ntfns s0_internal = Map.empty\"\n  unfolding s0_internal_def thread_bound_ntfns_def\n  apply (rule ext)\n  apply (simp add: get_tcb_def)\n  apply (simp add: kh0_def kh0_obj_def)\n  done\n\nlemma Sys1_wellformed':\n  \"policy_wellformed (pasPolicy Sys1PAS) False irqs x\"\n  apply (clarsimp simp: Sys1PAS_def policy_wellformed_def Sys1AuthGraph_def)\n  done\n\ncorollary Sys1_wellformed:\n  \"x \\<in> range (pasObjectAbs Sys1PAS) \\<union> \\<Union>(range (pasDomainAbs Sys1PAS)) - {SilcLabel} \\<Longrightarrow>\n   policy_wellformed (pasPolicy Sys1PAS) False irqs x\"\n  by (rule Sys1_wellformed')\n\nlemma Sys1_pas_wellformed:\n  \"pas_wellformed Sys1PAS\"\n  apply (clarsimp simp: Sys1PAS_def policy_wellformed_def Sys1AuthGraph_def)\n  done\n\nlemma domains_of_state_s0[simp]:\n  \"domains_of_state s0_internal = {(High_tcb_ptr, High_domain), (Low_tcb_ptr, Low_domain), (idle_tcb_ptr, default_domain)}\"\n  apply(rule equalityI)\n   apply(rule subsetI)\n   apply clarsimp\n   apply (erule domains_of_state_aux.cases)\n   apply (clarsimp simp: s0_internal_def exst0_def ekh0_obj_def split: if_split_asm)\n  apply clarsimp\n  apply (force simp: s0_internal_def exst0_def ekh0_obj_def intro: domains_of_state_aux.domtcbs)+\n  done\n\nlemma Sys1_pas_refined:\n  \"pas_refined Sys1PAS s0_internal\"\n  apply (clarsimp simp: pas_refined_def)\n  apply (intro conjI)\n       apply (simp add: Sys1_pas_wellformed)\n      apply (clarsimp simp: irq_map_wellformed_aux_def s0_internal_def Sys1PAS_def)\n      apply (clarsimp simp: Sys1AgentMap_def)\n      apply (clarsimp simp: s0_ptr_defs ptr_range_def pageBits_def cte_level_bits_def)\n      apply word_bitwise\n     apply (clarsimp simp: tcb_domain_map_wellformed_aux_def\n                           Sys1PAS_def Sys1AgentMap_def\n                           default_domain_def minBound_word\n                           High_domain_def Low_domain_def cte_level_bits_def)\n    apply (clarsimp simp: auth_graph_map_def\n                          Sys1PAS_def\n                          state_objs_to_policy_def\n                          state_bits_to_policy_def)\n    apply (erule state_bits_to_policyp.cases, simp_all, clarsimp)\n        apply (drule s0_caps_of_state, clarsimp)\n        apply (simp add: Sys1AuthGraph_def)\n        apply (elim disjE conjE, auto simp: Sys1AgentMap_simps cap_auth_conferred_def cap_rights_to_auth_def)[1]\n       apply (drule s0_caps_of_state, clarsimp)\n       apply (elim disjE, simp_all)[1]\n      apply (clarsimp simp: state_refs_of_def thread_st_auth_def tcb_states_of_state_s0\n             Sys1AuthGraph_def Sys1AgentMap_simps split: if_splits)\n      apply (clarsimp simp: state_refs_of_def thread_st_auth_def thread_bounds_of_state_s0)\n     apply (simp add: s0_internal_def) (* this is OK because cdt is empty..*)\n     apply (simp add: s0_internal_def) (* this is OK because cdt is empty..*)\n    apply (clarsimp simp: state_vrefs_def\n                           vs_refs_no_global_pts_def\n                           s0_internal_def kh0_def  Sys1AgentMap_simps\n                           kh0_obj_def comp_def Low_pt'_def High_pt'_def\n                           pte_ref_def pde_ref2_def Low_pd'_def High_pd'_def\n                           Sys1AuthGraph_def ptr_range_def vspace_cap_rights_to_auth_def\n                           vm_read_only_def vm_read_write_def\n\n                     dest!: graph_ofD\n                     split: if_splits)\n     apply (rule Sys1AgentMap_simps(13))\n     apply (simp add: ptr_range_def pageBits_def shared_page_ptr_phys_def)\n    apply (erule notE)\n    apply (rule Sys1AgentMap_simps(13)[symmetric])\n    apply (simp add: ptr_range_def pageBits_def shared_page_ptr_phys_def)\n\n   apply (rule subsetI, clarsimp)\n   apply (erule state_asids_to_policy_aux.cases)\n     apply clarsimp\n     apply (drule s0_caps_of_state, clarsimp)\n     apply (simp add: Sys1AuthGraph_def Sys1PAS_def Sys1ASIDMap_def)\n     apply (elim disjE conjE, simp_all add: Sys1AgentMap_simps cap_auth_conferred_def\n                                            cap_rights_to_auth_def Low_asid_def High_asid_def\n       asid_low_bits_def asid_high_bits_of_def )[1]\n    apply (clarsimp simp: state_vrefs_def\n                           vs_refs_no_global_pts_def\n                           s0_internal_def kh0_def  Sys1AgentMap_simps\n                           kh0_obj_def comp_def Low_pt'_def High_pt'_def\n                           pte_ref_def pde_ref2_def Low_pd'_def High_pd'_def\n                           Sys1AuthGraph_def ptr_range_def\n                     dest!: graph_ofD\n                     split: if_splits)\n   apply (clarsimp simp: s0_internal_def arch_state0_def)\n  apply (rule subsetI, clarsimp)\n  apply (erule state_irqs_to_policy_aux.cases)\n   apply (simp add: Sys1AuthGraph_def Sys1PAS_def Sys1ASIDMap_def)\n   apply (drule s0_caps_of_state)\n   apply (simp add: Sys1AuthGraph_def Sys1PAS_def Sys1ASIDMap_def)\n   apply (elim disjE conjE, simp_all add: Sys1AgentMap_simps cap_auth_conferred_def cap_rights_to_auth_def Low_asid_def High_asid_def\n     asid_low_bits_def asid_high_bits_of_def )[1]\n   done\n\nlemma Sys1_pas_cur_domain:\n  \"pas_cur_domain Sys1PAS s0_internal\"\n  by (simp add: s0_internal_def exst0_def Sys1PAS_def)\n\nlemma Sys1_current_subject_idemp:\n  \"Sys1PAS\\<lparr>pasSubject := the_elem (pasDomainAbs Sys1PAS (cur_domain s0_internal))\\<rparr> = Sys1PAS\"\n  apply (simp add: Sys1PAS_def s0_internal_def exst0_def)\n  done\n\nlemma pasMaySendIrqs_Sys1PAS[simp]:\n  \"pasMaySendIrqs Sys1PAS = False\"\n  by(auto simp: Sys1PAS_def)\n\nlemma Sys1_pas_domains_distinct:\n  \"pas_domains_distinct Sys1PAS\"\n  apply (clarsimp simp: Sys1PAS_def pas_domains_distinct_def)\n  done\n\nlemma Sys1_pas_wellformed_noninterference:\n  \"pas_wellformed_noninterference Sys1PAS\"\n  apply (simp add: pas_wellformed_noninterference_def)\n  apply (intro conjI ballI allI)\n    apply (blast intro: Sys1_wellformed)\n   apply (clarsimp simp: Sys1PAS_def policy_wellformed_def Sys1AuthGraph_def)\n  apply (rule Sys1_pas_domains_distinct)\n  done\n\nlemma silc_inv_s0:\n  \"silc_inv Sys1PAS s0_internal s0_internal\"\n  apply (clarsimp simp: silc_inv_def)\n  apply (rule conjI, simp add: Sys1PAS_def)\n  apply (rule conjI)\n   apply (clarsimp simp: Sys1PAS_def Sys1AgentMap_def\n                         s0_internal_def kh0_def obj_at_def kh0_obj_def\n                         is_cap_table_def Silc_caps_well_formed split: if_split_asm)\n  apply (rule conjI)\n   apply (clarsimp simp: Sys1PAS_def Sys1AuthGraph_def)\n  apply (rule conjI)\n   apply clarsimp\n   apply (rule_tac x=Silc_cnode_ptr in exI)\n   apply (rule conjI)\n    apply (rule_tac x=\"the_nat_to_bl_10 318\" in exI)\n    apply (clarsimp simp: slots_holding_overlapping_caps_def2)\n    apply (case_tac \"cap = NullCap\")\n     apply clarsimp\n     apply (simp add: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def)\n     apply (case_tac a, clarsimp)\n     apply (clarsimp split: if_splits)\n            apply ((clarsimp simp: intra_label_cap_def cte_wp_at_cases tcb_cap_cases_def\n                                   cap_points_to_label_def split: if_split_asm)+)[8]\n    apply (clarsimp simp: intra_label_cap_def cap_points_to_label_def)\n    apply (drule cte_wp_at_caps_of_state' s0_caps_of_state)+\n    apply ((erule disjE |\n          clarsimp simp: Sys1PAS_def Sys1AgentMap_simps\n              the_nat_to_bl_def nat_to_bl_def ctes_wp_at_def cte_wp_at_cases\n              s0_internal_def kh0_def kh0_obj_def Silc_caps_well_formed obj_refs_def\n         | simp add: Silc_caps_def)+)[1]\n   apply (simp add: Sys1PAS_def Sys1AgentMap_simps)\n  apply (intro conjI)\n  apply (clarsimp simp: all_children_def s0_internal_def silc_dom_equiv_def equiv_for_refl)\n  apply (clarsimp simp: all_children_def s0_internal_def silc_dom_equiv_def equiv_for_refl)\n  apply (clarsimp simp: Invariants_AI.cte_wp_at_caps_of_state )\n  by (auto simp:is_transferable.simps dest:s0_caps_of_state)\n\n\nlemma only_timer_irq_s0:\n  \"only_timer_irq timer_irq s0_internal\"\n  apply (clarsimp simp: only_timer_irq_def s0_internal_def irq_is_recurring_def is_irq_at_def\n                        irq_at_def Let_def irq_oracle_def machine_state0_def timer_irq_def)\n  apply presburger\n  done\n\nlemma domain_sep_inv_s0:\n  \"domain_sep_inv False s0_internal s0_internal\"\n  apply (clarsimp simp: domain_sep_inv_def)\n  apply (force dest: cte_wp_at_caps_of_state' s0_caps_of_state\n        | rule conjI allI | clarsimp simp: s0_internal_def)+\n  done\n\nlemma only_timer_irq_inv_s0:\n  \"only_timer_irq_inv timer_irq s0_internal s0_internal\"\n  by (simp add: only_timer_irq_inv_def only_timer_irq_s0 domain_sep_inv_s0)\n\nlemma Sys1_guarded_pas_domain:\n  \"guarded_pas_domain Sys1PAS s0_internal\"\n  by (clarsimp simp: guarded_pas_domain_def Sys1PAS_def s0_internal_def\n                     exst0_def Sys1AgentMap_simps)\n\nlemma s0_valid_domain_list:\n  \"valid_domain_list s0_internal\"\n  by (clarsimp simp: valid_domain_list_2_def s0_internal_def exst0_def)\n\n\ndefinition\n  \"s0 \\<equiv> ((if ct_idle s0_internal then idle_context s0_internal else s0_context,s0_internal),KernelExit)\"\n\n\n\nsubsubsection \\<open>einvs\\<close>\n\n\nlemma well_formed_cnode_n_s0_caps[simp]:\n  \"well_formed_cnode_n 10 High_caps\"\n  \"well_formed_cnode_n 10 Low_caps\"\n  \"well_formed_cnode_n 10 Silc_caps\"\n  \"\\<not> well_formed_cnode_n 10 [[] \\<mapsto> NullCap]\"\n  apply ((force simp: High_caps_def Low_caps_def Silc_caps_def well_formed_cnode_n_def\n                  the_nat_to_bl_def nat_to_bl_def dom_empty_cnode)+)[3]\n  apply (clarsimp simp: well_formed_cnode_n_def)\n  apply (drule eqset_imp_iff[where x=\"[]\"])\n  apply simp\n  done\n\nlemma valid_caps_s0[simp]:\n  \"s0_internal \\<turnstile> ThreadCap Low_tcb_ptr\"\n  \"s0_internal \\<turnstile> ThreadCap High_tcb_ptr\"\n  \"s0_internal \\<turnstile> CNodeCap Low_cnode_ptr 10 (the_nat_to_bl_10 2)\"\n  \"s0_internal \\<turnstile> CNodeCap High_cnode_ptr 10 (the_nat_to_bl_10 2)\"\n  \"s0_internal \\<turnstile> CNodeCap Silc_cnode_ptr 10 (the_nat_to_bl_10 2)\"\n  \"s0_internal \\<turnstile> ArchObjectCap (PageDirectoryCap Low_pd_ptr (Some Low_asid))\"\n  \"s0_internal \\<turnstile> ArchObjectCap (PageDirectoryCap High_pd_ptr (Some High_asid))\"\n  \"s0_internal \\<turnstile> NotificationCap ntfn_ptr 0 {AllowWrite}\"\n  \"s0_internal \\<turnstile> NotificationCap ntfn_ptr 0 {AllowRead}\"\n  \"s0_internal \\<turnstile> ReplyCap Low_tcb_ptr True {AllowGrant,AllowWrite}\"\n  \"s0_internal \\<turnstile> ReplyCap High_tcb_ptr True {AllowGrant,AllowWrite}\"\n  by (simp_all add: valid_cap_def s0_internal_def s0_ptr_defs cap_aligned_def is_aligned_def\n                       word_bits_def cte_level_bits_def the_nat_to_bl_def\n                       nat_to_bl_def Low_asid_def High_asid_def asid_low_bits_def asid_bits_def\n                       obj_at_def kh0_def kh0_obj_def is_tcb_def is_cap_table_def a_type_def\n                       is_ntfn_def)\n\nlemma valid_obj_s0[simp]:\n  \"valid_obj Low_cnode_ptr  Low_cnode s0_internal\"\n  \"valid_obj High_cnode_ptr High_cnode s0_internal\"\n  \"valid_obj Silc_cnode_ptr Silc_cnode s0_internal\"\n  \"valid_obj ntfn_ptr        ntfn s0_internal\"\n  \"valid_obj irq_cnode_ptr  irq_cnode s0_internal\"\n  \"valid_obj Low_pd_ptr     Low_pd s0_internal\"\n  \"valid_obj High_pd_ptr    High_pd s0_internal\"\n  \"valid_obj Low_pt_ptr     Low_pt s0_internal\"\n  \"valid_obj High_pt_ptr    High_pt s0_internal\"\n  \"valid_obj Low_tcb_ptr    Low_tcb s0_internal\"\n  \"valid_obj High_tcb_ptr   High_tcb s0_internal\"\n  \"valid_obj idle_tcb_ptr   idle_tcb s0_internal\"\n  \"valid_obj init_global_pd (ArchObj (PageDirectory ((\\<lambda>_. InvalidPDE)\n            (ucast (kernel_base >> 20) := SectionPDE (addrFromPPtr kernel_base) {} 0 {}))))\n                                     s0_internal\"\n  \"valid_obj init_globals_frame (ArchObj (DataPage False ARMSmallPage)) s0_internal\"\n               apply (simp_all add: valid_obj_def kh0_obj_def)\n              apply (simp add: valid_cs_def Low_caps_ran High_caps_ran Silc_caps_ran\n                               valid_cs_size_def word_bits_def cte_level_bits_def)+\n           apply (simp add: valid_ntfn_def obj_at_def s0_internal_def kh0_def\n                            High_tcb_def is_tcb_def)\n          apply (simp add: valid_cs_def valid_cs_size_def word_bits_def cte_level_bits_def)\n          apply (simp add: well_formed_cnode_n_def)\n         apply (fastforce simp: Low_pd'_def High_pd'_def Low_pt'_def High_pt'_def\n                                Low_pt_ptr_def High_pt_ptr_def\n                                shared_page_ptr_phys_def shared_page_ptr_virt_def\n                                valid_vm_rights_def vm_kernel_only_def\n                                kernel_base_def pageBits_def pt_bits_def vmsz_aligned_def\n                                is_aligned_def[THEN iffD2]\n                                is_aligned_addrFromPPtr_n)+\n     apply (clarsimp simp: valid_tcb_def tcb_cap_cases_def is_master_reply_cap_def\n                           valid_ipc_buffer_cap_def valid_tcb_state_def valid_arch_tcb_def\n           | simp add: obj_at_def s0_internal_def kh0_def kh0_obj_def is_ntfn_def\n                       is_valid_vtable_root_def)+\n  apply (simp add: valid_vm_rights_def vm_kernel_only_def\n                   kernel_base_def pageBits_def vmsz_aligned_def\n                   is_aligned_def[THEN iffD2]\n                   is_aligned_addrFromPPtr_n)\n  done\n\nlemma valid_objs_s0:\n  \"valid_objs s0_internal\"\n  apply (clarsimp simp: valid_objs_def)\n  apply (subst(asm) s0_internal_def kh0_def)+\n  apply (simp split: if_split_asm)\n    apply force+\n  apply (clarsimp simp: valid_obj_def valid_cs_def empty_cnode_def valid_cs_size_def ran_def\n                        cte_level_bits_def word_bits_def well_formed_cnode_n_def dom_def)\n  done\n\nlemma pspace_aligned_s0:\n  \"pspace_aligned s0_internal\"\n  apply (clarsimp simp: pspace_aligned_def s0_internal_def)\n  apply (drule kh0_SomeD)\n  apply (erule disjE\n         | (subst is_aligned_def,\n           fastforce simp: s0_ptr_defs cte_level_bits_def kh0_def kh0_obj_def))+\n  apply (clarsimp simp: cte_level_bits_def)\n  apply (drule irq_node_offs_range_correct)\n  apply (clarsimp simp: s0_ptr_defs cte_level_bits_def)\n  apply (rule is_aligned_add[OF _ is_aligned_shift])\n  apply (simp add: is_aligned_def s0_ptr_defs cte_level_bits_def)\n  done\n\nlemma pspace_distinct_s0:\n  \"pspace_distinct s0_internal\"\n  apply (clarsimp simp: pspace_distinct_def s0_internal_def)\n  apply (drule kh0_SomeD)+\n  apply (case_tac \"x \\<in> irq_node_offs_range \\<and> y \\<in> irq_node_offs_range\")\n   apply clarsimp\n   apply (drule irq_node_offs_range_correct)+\n   apply clarsimp\n   apply (clarsimp simp: s0_ptr_defs cte_level_bits_def)\n   apply (case_tac \"(ucast irq << 4) < (ucast irqa << 4)\")\n    apply (frule udvd_decr'[where K=\"0x10::32 word\" and ua=0, simplified])\n       apply (simp add: shiftl_t2n uint_word_ariths)\n       apply (subst mod_mult_mult1[where c=\"2^4\" and b=\"2^28\", simplified])\n       apply simp\n      apply (simp add: shiftl_t2n uint_word_ariths)\n      apply (subst mod_mult_mult1[where c=\"2^4\" and b=\"2^28\", simplified])\n      apply simp\n     apply (simp add: shiftl_def uint_shiftl word_size bintrunc_shiftl)\n     apply (simp add: shiftl_int_def take_bit_eq_mod push_bit_eq_mult)\n    apply (frule_tac y=\"ucast irq << 4\" in word_plus_mono_right[where x=\"0xE000800F\"])\n     apply (simp add: shiftl_t2n)\n     apply (case_tac \"(1::32 word) \\<le> ucast irqa\")\n      apply (drule_tac i=1 and k=\"0x10\" in word_mult_le_mono1)\n        apply simp\n       apply (cut_tac x=irqa and 'a=32 in ucast_less)\n        apply simp\n       apply (simp add: word_less_nat_alt)\n      apply (simp add: mult.commute)\n      apply (drule_tac y=\"0x10\" and x=\"0xE0007FFF\" in word_plus_mono_right)\n       apply (rule_tac sz=28 in machine_word_plus_mono_right_split)\n        apply (simp add: unat_word_ariths mask_def)\n        apply (cut_tac x=irqa and 'a=32 in ucast_less)\n         apply simp\n        apply (simp add: word_less_nat_alt)\n       apply (simp add: word_bits_def)\n      apply simp\n     apply (simp add: lt1_neq0)\n    apply (drule(1) order_trans_rules(23))\n    apply clarsimp\n    apply (drule_tac a=\"0xE0008000 + (ucast irqa << 4)\" and b=\"ucast irqa << 4\"\n                 and c=\"0xE0007FFF + (ucast irqa << 4)\" and d=\"ucast irqa << 4\" in word_sub_mono)\n       apply simp\n      apply simp\n      apply (rule_tac sz=28 in machine_word_plus_mono_right_split)\n       apply (simp add: unat_word_ariths mask_def shiftl_t2n)\n       apply (cut_tac x=irqa and 'a=32 in ucast_less)\n        apply simp\n       apply (simp add: word_less_nat_alt)\n      apply (simp add: word_bits_def)\n     apply simp\n     apply (rule_tac sz=28 in machine_word_plus_mono_right_split)\n      apply (simp add: unat_word_ariths mask_def shiftl_t2n)\n      apply (cut_tac x=irqa and 'a=32 in ucast_less)\n       apply simp\n      apply (simp add: word_less_nat_alt)\n     apply (simp add: word_bits_def)\n    apply simp\n   apply (case_tac \"(ucast irq << 4) > (ucast irqa << 4)\")\n    apply (frule udvd_decr'[where K=\"0x10::32 word\" and ua=0, simplified])\n       apply (simp add: shiftl_t2n uint_word_ariths)\n       apply (subst mod_mult_mult1[where c=\"2^4\" and b=\"2^28\", simplified])\n       apply simp\n      apply (simp add: shiftl_t2n uint_word_ariths)\n      apply (subst mod_mult_mult1[where c=\"2^4\" and b=\"2^28\", simplified])\n      apply simp\n     apply (simp add: shiftl_def uint_shiftl word_size bintrunc_shiftl)\n     apply (simp add: shiftl_int_def take_bit_eq_mod push_bit_eq_mult)\n    apply (frule_tac y=\"ucast irqa << 4\" in word_plus_mono_right[where x=\"0xE000800F\"])\n     apply (simp add: shiftl_t2n)\n     apply (case_tac \"(1::32 word) \\<le> ucast irq\")\n      apply (drule_tac i=1 and k=\"0x10\" in word_mult_le_mono1)\n        apply simp\n       apply (cut_tac x=irq and 'a=32 in ucast_less)\n        apply simp\n       apply (simp add: word_less_nat_alt)\n      apply (simp add: mult.commute)\n      apply (drule_tac y=\"0x10\" and x=\"0xE0007FFF\" in word_plus_mono_right)\n       apply (rule_tac sz=28 in machine_word_plus_mono_right_split)\n        apply (simp add: unat_word_ariths mask_def)\n        apply (cut_tac x=irq and 'a=32 in ucast_less)\n         apply simp\n        apply (simp add: word_less_nat_alt)\n       apply (simp add: word_bits_def)\n      apply simp\n     apply (simp add: lt1_neq0)\n    apply (drule(1) order_trans_rules(23))\n    apply clarsimp\n    apply (drule_tac a=\"0xE0008000 + (ucast irq << 4)\" and b=\"ucast irq << 4\"\n                 and c=\"0xE0007FFF + (ucast irq << 4)\" and d=\"ucast irq << 4\" in word_sub_mono)\n       apply simp\n      apply simp\n      apply (rule_tac sz=28 in machine_word_plus_mono_right_split)\n       apply (simp add: unat_word_ariths mask_def shiftl_t2n)\n       apply (cut_tac x=irq and 'a=32 in ucast_less)\n        apply simp\n       apply (simp add: word_less_nat_alt)\n      apply (simp add: word_bits_def)\n     apply simp\n     apply (rule_tac sz=28 in machine_word_plus_mono_right_split)\n      apply (simp add: unat_word_ariths mask_def shiftl_t2n)\n      apply (cut_tac x=irq and 'a=32 in ucast_less)\n       apply simp\n      apply (simp add: word_less_nat_alt)\n     apply (simp add: word_bits_def)\n    apply simp\n   apply simp\n  by ((simp | erule disjE | clarsimp simp: kh0_obj_def cte_level_bits_def s0_ptr_defs\n        | clarsimp simp: irq_node_offs_range_def s0_ptr_defs,\n          drule_tac x=\"0xF\" in word_plus_strict_mono_right, simp, simp add: add.commute,\n          drule(1) notE[rotated, OF less_trans, OF _ _ leD, rotated 2] |\n          drule(1) notE[rotated, OF le_less_trans, OF _ _ leD, rotated 2], simp, assumption)+)\n\nlemma valid_pspace_s0[simp]:\n  \"valid_pspace s0_internal\"\n  apply (simp add: valid_pspace_def pspace_distinct_s0 pspace_aligned_s0 valid_objs_s0)\n  apply (rule conjI)\n   apply (clarsimp simp: if_live_then_nonz_cap_def)\n   apply (subst(asm) s0_internal_def)\n   apply (clarsimp simp: live_def hyp_live_def obj_at_def kh0_def kh0_obj_def s0_ptr_defs split: if_split_asm)\n     apply (clarsimp simp: ex_nonz_cap_to_def)\n     apply (rule_tac x=\"High_cnode_ptr\" in exI)\n     apply (rule_tac x=\"the_nat_to_bl_10 1\" in exI)\n     apply (force simp: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def s0_ptr_defs tcb_cap_cases_def High_caps_def the_nat_to_bl_def nat_to_bl_def well_formed_cnode_n_def dom_empty_cnode)\n    apply (clarsimp simp: ex_nonz_cap_to_def)\n    apply (rule_tac x=\"Low_cnode_ptr\" in exI)\n    apply (rule_tac x=\"the_nat_to_bl_10 1\" in exI)\n    apply (force simp: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def s0_ptr_defs tcb_cap_cases_def Low_caps_def the_nat_to_bl_def nat_to_bl_def well_formed_cnode_n_def dom_empty_cnode)\n   apply (clarsimp simp: ex_nonz_cap_to_def)\n   apply (rule_tac x=\"High_cnode_ptr\" in exI)\n   apply (rule_tac x=\"the_nat_to_bl_10 318\" in exI)\n   apply (force simp: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def s0_ptr_defs tcb_cap_cases_def High_caps_def the_nat_to_bl_def nat_to_bl_def well_formed_cnode_n_def dom_empty_cnode)\n  apply (rule conjI)\n   apply (simp add: Invariants_AI.cte_wp_at_caps_of_state zombies_final_def)\n   apply (force dest: s0_caps_of_state simp: is_zombie_def)\n  apply (rule conjI)\n   apply (clarsimp simp: sym_refs_def state_refs_of_def state_hyp_refs_of_def s0_internal_def)\n   apply (subst(asm) kh0_def)\n   apply (clarsimp split: if_split_asm)\n   apply (simp add: refs_of_def kh0_def s0_ptr_defs kh0_obj_def)+\n  apply (clarsimp simp: sym_refs_def state_hyp_refs_of_def s0_internal_def)\n  apply (subst(asm) kh0_def)\n  apply (clarsimp split: if_split_asm)\n             by (simp add: refs_of_def kh0_def s0_ptr_defs kh0_obj_def)+\n\nlemma descendants_s0[simp]:\n  \"descendants_of (a, b) (cdt s0_internal) = {}\"\n  apply (rule set_eqI)\n  apply clarsimp\n  apply (drule descendants_of_NoneD[rotated])\n   apply (simp add: s0_internal_def)+\n   done\n\nlemma valid_mdb_s0[simp]:\n  \"valid_mdb s0_internal\"\n  apply (simp add: valid_mdb_def reply_mdb_def)\n  apply (intro conjI)\n           apply (clarsimp simp: mdb_cte_at_def s0_internal_def)\n          apply (force dest: s0_caps_of_state simp: untyped_mdb_def)\n         apply (clarsimp simp: descendants_inc_def)\n        apply (clarsimp simp: no_mloop_def s0_internal_def cdt_parent_defs)\n       apply (clarsimp simp: untyped_inc_def)\n       apply (drule s0_caps_of_state)+\n       apply ((simp | erule disjE)+)[1]\n      apply (force dest: s0_caps_of_state simp: ut_revocable_def)\n     apply (force dest: s0_caps_of_state simp: irq_revocable_def)\n    apply (clarsimp simp: reply_master_revocable_def)\n    apply (drule s0_caps_of_state)\n    apply ((simp add: is_master_reply_cap_def s0_internal_def s0_ptr_defs | erule disjE)+)[1]\n   apply (force dest: s0_caps_of_state simp: reply_caps_mdb_def)\n  apply (clarsimp simp: reply_masters_mdb_def)\n  apply (simp add: s0_internal_def)\n  done\n\nlemma valid_ioc_s0[simp]:\n  \"valid_ioc s0_internal\"\n  by (clarsimp simp: cte_wp_at_cases tcb_cap_cases_def valid_ioc_def\n                        s0_internal_def kh0_def kh0_obj_def split: if_split_asm)+\n\nlemma valid_idle_s0[simp]:\n  \"valid_idle s0_internal\"\n  apply (clarsimp simp: valid_idle_def st_tcb_at_tcb_states_of_state_eq\n                        thread_bounds_of_state_s0\n                        identity_eq[symmetric] tcb_states_of_state_s0\n                        valid_arch_idle_def)\n  by (simp add: s0_ptr_defs s0_internal_def idle_thread_ptr_def pred_tcb_at_def obj_at_def kh0_def idle_tcb_def)\n\nlemma only_idle_s0[simp]:\n  \"only_idle s0_internal\"\n  apply (clarsimp simp: only_idle_def st_tcb_at_tcb_states_of_state_eq\n                        identity_eq[symmetric] tcb_states_of_state_s0)\n  apply (simp add: s0_ptr_defs s0_internal_def)\n  done\n\nlemma if_unsafe_then_cap_s0[simp]:\n  \"if_unsafe_then_cap s0_internal\"\n  apply (clarsimp simp: if_unsafe_then_cap_def ex_cte_cap_wp_to_def)\n  apply (drule s0_caps_of_state)\n  apply (case_tac \"a=Low_cnode_ptr\")\n   apply (rule_tac x=Low_tcb_ptr in exI, rule_tac x=\"tcb_cnode_index 0\" in exI)\n   apply ((clarsimp simp: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def\n                          tcb_cap_cases_def the_nat_to_bl_def nat_to_bl_def\n                          Low_caps_def | erule disjE)+)[1]\n  apply (case_tac \"a=High_cnode_ptr\")\n   apply (rule_tac x=High_tcb_ptr in exI, rule_tac x=\"tcb_cnode_index 0\" in exI)\n   apply ((clarsimp simp: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def\n                          tcb_cap_cases_def the_nat_to_bl_def nat_to_bl_def\n                          High_caps_def | erule disjE)+)[1]\n  apply (case_tac \"a=Low_tcb_ptr\")\n   apply (rule_tac x=Low_cnode_ptr in exI, rule_tac x=\"the_nat_to_bl_10 1\" in exI)\n   apply ((clarsimp simp: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def\n                          tcb_cap_cases_def the_nat_to_bl_def nat_to_bl_def\n                          Low_caps_def well_formed_cnode_n_def dom_empty_cnode\n         | erule disjE | force)+)[1]\n  apply (case_tac \"a=High_tcb_ptr\")\n   apply (rule_tac x=High_cnode_ptr in exI, rule_tac x=\"the_nat_to_bl_10 1\" in exI)\n   apply ((clarsimp simp: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def\n                          tcb_cap_cases_def the_nat_to_bl_def nat_to_bl_def\n                          High_caps_def well_formed_cnode_n_def dom_empty_cnode\n         | erule disjE | force)+)[1]\n  apply (rule_tac x=Silc_cnode_ptr in exI, rule_tac x=\"the_nat_to_bl_10 2\" in exI)\n  apply ((clarsimp simp: cte_wp_at_cases s0_internal_def kh0_def kh0_obj_def\n                         tcb_cap_cases_def the_nat_to_bl_def nat_to_bl_def\n                         Silc_caps_def well_formed_cnode_n_def dom_empty_cnode\n        | erule disjE | force)+)[1]\n  done\n\nlemma valid_reply_caps_s0[simp]:\n  \"valid_reply_caps s0_internal\"\n  apply (clarsimp simp: valid_reply_caps_def)\n  apply (rule conjI)\n   apply (force  dest: s0_caps_of_state\n                 simp: Invariants_AI.cte_wp_at_caps_of_state has_reply_cap_def is_reply_cap_to_def)\n  apply (clarsimp simp: unique_reply_caps_def)\n  apply (drule s0_caps_of_state)+\n  apply (erule disjE | simp add: is_reply_cap_def)+\n  done\n\nlemma valid_reply_masters_s0[simp]:\n  \"valid_reply_masters s0_internal\"\n  apply (clarsimp simp: valid_reply_masters_def)\n  apply (force dest: s0_caps_of_state\n               simp: Invariants_AI.cte_wp_at_caps_of_state  is_master_reply_cap_to_def)\n  done\n\nlemma valid_global_refs_s0[simp]:\n  \"valid_global_refs s0_internal\"\n  apply (clarsimp simp: valid_global_refs_def valid_refs_def)\n  apply (simp add: Invariants_AI.cte_wp_at_caps_of_state)\n  apply clarsimp\n  apply (drule s0_caps_of_state)\n  apply (clarsimp simp: global_refs_def s0_internal_def arch_state0_def)\n  apply (erule disjE | simp add: cap_range_def\n                     | clarsimp simp: irq_node_offs_distinct[symmetric]\n                     | simp only: s0_ptr_defs, force)+\n  done\n\nlemma valid_arch_state_s0[simp]:\n  \"valid_arch_state s0_internal\"\n  apply (clarsimp simp: valid_arch_state_def s0_internal_def arch_state0_def)\n  apply (intro conjI)\n      apply (clarsimp simp: obj_at_def kh0_def)\n     apply (simp add: valid_asid_table_def)\n    apply (clarsimp simp: obj_at_def kh0_def a_type_def)\n   apply (simp add: valid_global_pts_def)\n  apply (simp add: is_inv_def)\n  done\n\nlemma valid_irq_node_s0[simp]:\n  \"valid_irq_node s0_internal\"\n  apply (clarsimp simp: valid_irq_node_def)\n  apply (rule conjI)\n   apply (simp add: s0_internal_def)\n   apply (rule injI)\n   apply simp\n   apply (rule ccontr)\n   apply (rule_tac bnd=\"0x400\" and 'a=32 in shift_distinct_helper[rotated 3])\n        apply assumption\n       apply (simp add: cte_level_bits_def)\n      apply (simp add: cte_level_bits_def)\n     apply (rule ucast_less[where 'b=10, simplified])\n     apply simp\n    apply (rule ucast_less[where 'b=10, simplified])\n    apply simp\n   apply (rule notI)\n   apply (drule ucast_up_inj)\n    apply simp\n   apply simp\n  apply (clarsimp simp: obj_at_def s0_internal_def)\n  apply (force simp: kh0_def is_cap_table_def well_formed_cnode_n_def dom_empty_cnode)\n  done\n\nlemma valid_irq_handlers_s0[simp]:\n  \"valid_irq_handlers s0_internal\"\n  apply (clarsimp simp: valid_irq_handlers_def ran_def)\n  apply (force dest: s0_caps_of_state)\n  done\n\nlemma valid_irq_state_s0[simp]:\n  \"valid_irq_states s0_internal\"\n  apply (clarsimp simp: valid_irq_states_def valid_irq_masks_def s0_internal_def machine_state0_def)\n  done\n\nlemma valid_machine_state_s0[simp]:\n  \"valid_machine_state s0_internal\"\n  apply (clarsimp simp: valid_machine_state_def s0_internal_def machine_state0_def in_user_frame_def obj_at_def const_def)\n  done\n\nlemma valid_arch_objs_s0[simp]:\n  \"valid_vspace_objs s0_internal\"\n  apply (clarsimp simp: valid_vspace_objs_def obj_at_def s0_internal_def)\n  apply (drule kh0_SomeD)\n  apply (erule disjE | clarsimp simp: addrFromPPtr_def\n         | erule vs_lookupE, force simp: arch_state0_def vs_asid_refs_def)+\n  done\n\n\nlemma valid_arch_caps_s0[simp]:\n  \"valid_arch_caps s0_internal\"\n  apply (clarsimp simp: valid_arch_caps_def)\n  apply (intro conjI)\n     apply (clarsimp simp: valid_vs_lookup_def vs_lookup_pages_def vs_asid_refs_def\n                           s0_internal_def arch_state0_def)\n    apply (clarsimp simp: valid_table_caps_def is_pd_cap_def is_pt_cap_def)\n    apply (drule s0_caps_of_state)\n    apply (erule disjE | simp)+\n   apply (clarsimp simp: unique_table_caps_def is_pd_cap_def is_pt_cap_def)\n   apply (drule s0_caps_of_state)+\n   apply (erule disjE | simp)+\n  apply (clarsimp simp: unique_table_refs_def table_cap_ref_def)\n  apply (drule s0_caps_of_state)+\n  by auto\n\nlemma valid_global_objs_s0[simp]:\n  \"valid_global_objs s0_internal\"\n  apply (clarsimp simp: valid_global_objs_def s0_internal_def arch_state0_def)\n  apply (force simp: valid_vso_at_def obj_at_def kh0_def kh0_obj_def\n                     is_aligned_addrFromPPtr kernel_base_aligned_pageBits\n                     kernel_mapping_slots_def empty_table_def pde_ref_def valid_pde_mappings_def)\n  done\n\nlemma valid_kernel_mappings_s0[simp]:\n  \"valid_kernel_mappings s0_internal\"\n  apply (clarsimp simp: valid_kernel_mappings_def s0_internal_def ran_def\n                 valid_kernel_mappings_if_pd_def split: kernel_object.splits\n                                                        arch_kernel_obj.splits)\n  apply (drule kh0_SomeD)\n  apply (clarsimp simp: arch_state0_def kernel_mapping_slots_def)\n  apply (erule disjE | simp add: pde_ref_def s0_ptr_defs kh0_obj_def High_pd'_def Low_pd'_def\n                          split: if_split_asm pde.splits)+\n  done\n\nlemma equal_kernel_mappings_s0[simp]:\n  \"equal_kernel_mappings s0_internal\"\n  apply (clarsimp simp: equal_kernel_mappings_def obj_at_def s0_internal_def)\n  apply (drule kh0_SomeD)+\n  apply (force simp: kh0_obj_def High_pd'_def Low_pd'_def s0_ptr_defs kernel_mapping_slots_def)\n  done\n\nlemma valid_asid_map_s0[simp]:\n  \"valid_asid_map s0_internal\"\n  apply (clarsimp simp: valid_asid_map_def s0_internal_def arch_state0_def)\n  done\n\nlemma valid_global_pd_mappings_s0[simp]:\n  \"valid_global_vspace_mappings s0_internal\"\n  apply (clarsimp simp: valid_global_vspace_mappings_def s0_internal_def arch_state0_def\n                        obj_at_def kh0_def kh0_obj_def s0_ptr_defs valid_pd_kernel_mappings_def\n                        valid_pde_kernel_mappings_def pde_mapping_bits_def mask_def)\n  apply (rule conjI)\n   apply force\n  apply clarsimp\n  apply (subgoal_tac \"xa - 0xFFFFF \\<le> ucast x << 20\")\n   apply (case_tac \"ucast x << 20 > (0xE0000000::32 word)\")\n    apply (subgoal_tac \"(0xE0100000::32 word) \\<le> ucast x << 20\")\n     apply ((drule(1) order_trans_rules(23))+, force)\n    apply (simp add: shiftl_t2n)\n    apply (cut_tac p=\"0xE0000000::32 word\" and n=20 and m=20 and q=\"0x100000 * ucast x\" in word_plus_power_2_offset_le)\n         apply (simp add: is_aligned_def)\n        apply (simp add: is_aligned_def unat_word_ariths)\n        apply (subst mod_mult_mult1[where c=\"2^20\" and b=\"2^12\", simplified])\n        apply simp\n       apply simp\n      apply simp\n     apply simp\n    apply simp\n   apply (case_tac \"ucast x << 20 < (0xE0000000::32 word)\")\n    apply (subgoal_tac \"(0xE0000000::32 word) - 0x100000 \\<ge> ucast x << 20\")\n     apply (subgoal_tac \"0xFFFFF + (ucast x << 20) \\<le> 0xDFFFFFFF\")\n      apply (drule_tac y=\"0xFFFFF + (ucast x << 20)\" and z=\"0xDFFFFFFF::32 word\" in order_trans_rules(23))\n       apply simp\n      apply ((drule(1) order_trans_rules(23))+, force)\n     apply (simp add: add.commute)\n     apply (simp add: word_plus_mono_left[where x=\"0xFFFFF\" and z=\"0xDFF00000\", simplified])\n    apply (simp add: shiftl_t2n)\n    apply (rule udvd_decr'[where K=\"0x100000\" and q=\"0xE0000000\" and ua=0, simplified])\n       apply simp\n      apply (simp add: uint_word_ariths)\n      apply (subst mod_mult_mult1[where c=\"2^20\" and b=\"2^12\", simplified])\n      apply simp\n     apply simp\n    apply simp\n   apply (erule notE)\n   apply (cut_tac x=\"ucast x::32 word\" and n=20 in shiftl_shiftr_id)\n     apply simp\n    apply (simp add: ucast_less[where 'b=12, simplified])\n   apply simp\n   apply (rule ucast_up_inj[where 'b=32])\n    apply simp\n   apply simp\n  apply (drule_tac c=\"0xFFFFF + (ucast x << 20)\" and d=\"0xFFFFF\" and b=\"0xFFFFF\" in word_sub_mono)\n     apply simp\n    apply (rule word_sub_le)\n    apply (rule order_trans_rules(23)[rotated], assumption)\n    apply simp\n   apply (simp add: add.commute)\n   apply (rule no_plus_overflow_neg)\n   apply simp\n   apply (drule_tac x=\"ucast x << 20\" in order_trans_rules(23), assumption)\n   apply (simp add: le_less_trans)\n  apply simp\n  done\n\nlemma pspace_in_kernel_window_s0[simp]:\n  \"pspace_in_kernel_window s0_internal\"\n  apply (clarsimp simp: pspace_in_kernel_window_def s0_internal_def)\n  apply (drule kh0_SomeD)\n  apply (erule disjE | simp add: arch_state0_def kh0_obj_def s0_ptr_defs mask_def\n                                 irq_node_offs_range_def cte_level_bits_def | rule conjI\n                     | rule order_trans_rules(23)[rotated] order_trans_rules(23), force, force)+\n   apply (force intro: order_trans_rules(23)[rotated])\n  apply clarsimp\n  apply (drule_tac x=y in le_less_trans)\n   apply (rule neq_le_trans[rotated])\n    apply (rule word_plus_mono_right)\n     apply (rule less_imp_le)\n     apply simp+\n  apply (force intro: less_imp_le less_le_trans)\n  done\n\nlemma cap_refs_in_kernel_window_s0[simp]:\n  \"cap_refs_in_kernel_window s0_internal\"\n  apply (clarsimp simp: cap_refs_in_kernel_window_def valid_refs_def cap_range_def\n                        Invariants_AI.cte_wp_at_caps_of_state)\n  apply (drule s0_caps_of_state)\n  apply (erule disjE | simp add: arch_state0_def s0_internal_def s0_ptr_defs mask_def)+\n  done\n\nlemma cur_tcb_s0[simp]:\n  \"cur_tcb s0_internal\"\n  by (simp add: cur_tcb_def s0_ptr_defs s0_internal_def kh0_def kh0_obj_def obj_at_def is_tcb_def)\n\nlemma valid_list_s0[simp]:\n  \"valid_list s0_internal\"\n  apply (simp add: valid_list_2_def s0_internal_def exst0_def const_def)\n  done\n\nlemma valid_sched_s0[simp]:\n  \"valid_sched s0_internal\"\n  apply (simp add: valid_sched_def s0_internal_def exst0_def)\n  apply (intro conjI)\n        apply (clarsimp simp: valid_etcbs_def s0_ptr_defs kh0_def kh0_obj_def is_etcb_at'_def\n                              st_tcb_at_kh_def obj_at_kh_def obj_at_def)\n       apply (clarsimp simp: const_def)\n      apply (clarsimp simp: const_def)\n     apply (clarsimp simp: valid_sched_action_def is_activatable_def st_tcb_at_kh_def\n                           obj_at_kh_def obj_at_def kh0_def kh0_obj_def s0_ptr_defs)\n    apply (clarsimp simp: ct_in_cur_domain_def in_cur_domain_def etcb_at'_def ekh0_obj_def\n                          s0_ptr_defs)\n   apply (clarsimp simp: const_def valid_blocked_def st_tcb_at_kh_def obj_at_kh_def obj_at_def\n                         kh0_def kh0_obj_def split: if_split_asm)\n  apply (clarsimp simp: valid_idle_etcb_def etcb_at'_def ekh0_obj_def s0_ptr_defs idle_thread_ptr_def)\n  done\n\nlemma respects_device_trivial:\n  \"pspace_respects_device_region s0_internal\"\n  \"cap_refs_respects_device_region s0_internal\"\n  apply (clarsimp simp: s0_internal_def pspace_respects_device_region_def machine_state0_def device_mem_def\n                        in_device_frame_def kh0_obj_def obj_at_kh_def obj_at_def kh0_def\n                 split: if_splits)[1]\n   apply fastforce\n  apply (clarsimp simp: cap_refs_respects_device_region_def Invariants_AI.cte_wp_at_caps_of_state\n                        cap_range_respects_device_region_def machine_state0_def)\n  apply (intro conjI impI)\n   apply (drule s0_caps_of_state)\n   apply fastforce\n  apply (clarsimp simp: s0_internal_def machine_state0_def)\n  done\n\nlemma einvs_s0:\n  \"einvs s0_internal\"\n  apply (simp add: valid_state_def invs_def respects_device_trivial)\n  done\n\nlemma obj_valid_pdpt_kh0:\n  \"x \\<in> ran kh0 \\<Longrightarrow> obj_valid_pdpt x\"\n  by (auto simp: kh0_def valid_entries_def obj_valid_pdpt_def idle_tcb_def High_tcb_def Low_tcb_def\n                 High_pt_def High_pt'_def entries_align_def Low_pt_def High_pd_def Low_pt'_def High_pd'_def\n                 Low_pd_def irq_cnode_def ntfn_def Silc_cnode_def High_cnode_def Low_cnode_def Low_pd'_def)\n\nsubsubsection \\<open>Haskell state\\<close>\n\ntext \\<open>One invariant we need on s0 is that there exists\n        an associated Haskell state satisfying the invariants.\n        This does not yet exist.\\<close>\n\nlemma Sys1_valid_initial_state_noenabled:\n  assumes extras_s0: \"step_restrict s0\"\n  assumes utf_det: \"\\<forall>pl pr pxn tc ms s. det_inv InUserMode tc s \\<and> einvs s \\<and> context_matches_state pl pr pxn ms s \\<and> ct_running s\n                   \\<longrightarrow> (\\<exists>x. utf (cur_thread s) pl pr pxn (tc, ms) = {x})\"\n  assumes utf_non_empty: \"\\<forall>t pl pr pxn tc ms. utf t pl pr pxn (tc, ms) \\<noteq> {}\"\n  assumes utf_non_interrupt: \"\\<forall>t pl pr pxn tc ms e f g. (e,f,g) \\<in> utf t pl pr pxn (tc, ms) \\<longrightarrow> e \\<noteq> Some Interrupt\"\n  assumes det_inv_invariant: \"invariant_over_ADT_if det_inv utf\"\n  assumes det_inv_s0: \"det_inv KernelExit (cur_context s0_internal) s0_internal\"\n  shows \"valid_initial_state_noenabled det_inv utf s0_internal Sys1PAS timer_irq s0_context\"\n  apply (unfold_locales, simp_all only: pasMaySendIrqs_Sys1PAS)\n                     apply (insert det_inv_invariant)[9]\n                     apply (erule(2) invariant_over_ADT_if.det_inv_abs_state)\n                    apply ((erule invariant_over_ADT_if.det_inv_abs_state\n                                  invariant_over_ADT_if.check_active_irq_if_Idle_det_inv\n                                  invariant_over_ADT_if.check_active_irq_if_User_det_inv\n                                  invariant_over_ADT_if.do_user_op_if_det_inv\n                                  invariant_over_ADT_if.handle_preemption_if_det_inv\n                                  invariant_over_ADT_if.kernel_entry_if_Interrupt_det_inv\n                                  invariant_over_ADT_if.kernel_entry_if_det_inv\n                                  invariant_over_ADT_if.kernel_exit_if_det_inv\n                                  invariant_over_ADT_if.schedule_if_det_inv)+)[8]\n            apply (rule Sys1_pas_cur_domain)\n           apply (rule Sys1_pas_wellformed_noninterference)\n          apply (simp only: einvs_s0)\n          apply (simp add: Sys1_current_subject_idemp)\n          apply (simp add: only_timer_irq_inv_s0 silc_inv_s0 Sys1_pas_cur_domain\n                           domain_sep_inv_s0 Sys1_pas_refined Sys1_guarded_pas_domain\n                           idle_equiv_refl)\n          apply (clarsimp simp: obj_valid_pdpt_kh0 valid_domain_list_2_def s0_internal_def exst0_def)\n         apply (simp add: det_inv_s0)\n        apply (simp add: s0_internal_def exst0_def)\n       apply (simp add: ct_in_state_def st_tcb_at_tcb_states_of_state_eq\n                        identity_eq[symmetric] tcb_states_of_state_s0)\n       apply (simp add: s0_ptr_defs s0_internal_def)\n      apply (simp add: s0_internal_def exst0_def)\n     apply (rule utf_det)\n    apply (rule utf_non_empty)\n   apply (rule utf_non_interrupt)\n  apply (simp add: extras_s0[simplified s0_def])\n  done\n\ntext \\<open>the extra assumptions in valid_initial_state of being enabled,\n        and a serial system, follow from ADT_IF_Refine\\<close>\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/infoflow/ARM/Example_Valid_State.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6548947155710234, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3300054882231258}}
{"text": "theory flash49Bra  imports flash49Rev\n \n  begin\nlemma onInv49:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv49  iInv1  iInv2  iInv3 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX1VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_GetXVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ShWbVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX7VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak2VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX5VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_WbVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_GetVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceShrVldVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_2VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak2VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_ReplaceVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_HomeVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put2VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX11VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX6VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put2VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1_HomeVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak1VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak1VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak2VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak3VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX2VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put1VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutXVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis StoreVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_FAckVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX3VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutXVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put1VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis StoreHomeVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_NakVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_PutXVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX4VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_NakVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak1VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_ClearVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_PutXVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak3VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX9VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetXVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv49  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put3VsInv49 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash49Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190475, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.3299646338063156}}
{"text": "theory Imp_Ctl_Hoare\n  imports Imp_Ctl \"../../Hoare/Hoare\"  \"../../Hoare/Hoare_Indexed\"\n  \"../../Hoare/Hoare_Indexed_Sound\"\nbegin\n\n(* Implementation of Hoare rules for WHILE and IF.\n * Provides an interesting example of using the step-count-indexed version of Hoare\n * logic to prove a theorem not easily provable without that abstraction\n * (this was what motivated the development of that abstraction).\n *)\n\n(* This if rule looks a bit different from the traditional one;\n * this is mostly because evaluation of the condition (cond) may have\n * side effects. \n *\n * Note that we mostly use HxIf in practice (since it works better with our other rules\n * that use the indexed abstraction\n *)\n(*\nlemma HIf :\n  assumes H0 : \"gs = pcomps fs\"\n  assumes HF : \"f = imp_sem_l_gen lfts\"\n  assumes Hpres : \"sups_pres (set fs) (\\<lambda> _ . ok_S)\"\n  assumes Hnemp : \"g \\<in> set fs\"\n  assumes Hdom : \"(f \\<downharpoonleft> (set fs) {Sif'})\"\n  assumes Hsyn : \"lfts Sif' = Sif\"\n  assumes P1_valid : \"\\<And> st.  P1 st \\<Longrightarrow> get_cond st \\<noteq> None\"\n  assumes P2_valid : \"\\<And> st . P2 st \\<Longrightarrow> get_cond st \\<noteq> None\"\n\n  assumes Hcond : \"|gs| {- P1 -} [cond] {- P2 -}\"\n  assumes Htrue : \"|gs| {- (\\<lambda> st . P2 st \\<and> get_cond st = Some True) -} [body]\n                        {- P3 -}\"\n  assumes Hfalse : \"|gs| {- (\\<lambda> st . P2 st \\<and> get_cond st = Some False) -} [] {-P3-}\"\n  shows \"|gs| {- P1 -} [G Sif' [cond, body]] {- P3 -}\"\nproof\n  fix c'\n  assume Guard : \"|gs| {P3} c'\"\n\n  have Gtrue : \"|gs| {(\\<lambda>st. P2 st \\<and> get_cond st = Some True)} ([body] @ c')\"\n    using HTE[OF Htrue Guard] by auto\n\n  have Gfalse : \"|gs| {(\\<lambda>st. P2 st \\<and> get_cond st = Some False)} ([] @ c')\"\n    using HTE[OF Hfalse Guard] by auto\n\n  show \"|gs| {P1} ([G Sif' [cond, body]] @ c')\"\n  proof\n    fix m :: \"('a, 'b) state\"\n\n    assume Ok : \"m \\<in> ok_S\"\n    assume M : \"P1 (payload m)\"\n    assume CM : \"cont m = Inl ([G Sif' [cond, body]] @ c')\"\n\n    show \"(safe gs m)\"\n    proof(cases \"(sem_step gs m)\")\n      case (Inr bad)\n\n      then have False using CM H0\n        by(auto simp add: sem_step_def)\n\n      then show ?thesis by auto\n    next\n      case (Inl m')\n\n      have F_eq : \"sem_step f m = Inl m'\"\n        using sym[OF dominant_pcomps[OF Hpres Hnemp Hdom _ Ok]] CM Inl H0\n        by(simp add: sem_step_def)\n\n      have CM' : \"cont m' = Inl ([cond] @ ([ G Sif' [body]] @ c'))\" \n        using CM Hsyn F_eq unfolding HF\n        by(cases m; auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n           schem_lift_defs lift_map_s_def\n          merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def\n          split: md_prio.splits md_triv.splits option.splits)\n\n      have M'_valid : \"\\<And> p . fst (payload m) \\<noteq> mdp p None\" using P1_valid[OF M]\n        by(auto simp add: get_cond_def split:prod.splits)\n\n      have Sm' : \"payload m = payload m'\"\n        using CM Hsyn F_eq M'_valid  unfolding HF\n        apply(cases m; auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n           schem_lift_defs lift_map_s_def\n          merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n          split: md_prio.splits md_triv.splits option.splits)\n\n      hence P1sm' : \"P1 (payload m')\" using M unfolding Sm' by auto\n\n      (* step to the end of cond. *)\n\n      have Sub : \"|gs| {P2} ([G Sif' [body]] @ c')\"\n      proof\n        fix mp2 :: \"('a, 'b) state\"\n\n        assume MP2 : \"P2 (payload mp2)\"\n\n        assume Cont2 : \"cont mp2 = Inl ([G Sif' [body]] @ c')\"\n\n        show \"safe gs mp2\"\n        proof(cases \"get_cond (payload mp2)\")\n          case None\n\n          then have False using P2_valid[OF MP2]\n            by(auto simp add: get_cond_def split: prod.splits md_prio.splits md_triv.splits option.splits)\n          then show ?thesis by auto\n\n        next\n          case Some' : (Some cnd)\n          then show ?thesis \n          proof(cases \"sem_step gs mp2\")\n            case (Inr bad)\n\n            then have False using Cont2 H0\n              by(auto simp add: sem_step_def)\n\n            then show ?thesis by auto\n\n          next\n            case (Inl mp2')\n\n            have F_eq' : \"sem_step f mp2 = Inl mp2'\"\n              using sym[OF dominant_pcomps[OF Hpres Hnemp Hdom]] Cont2 Inl H0\n              by(simp add: sem_step_def)\n\n            have Mp2'_p2 : \"P2 (payload mp2')\"\n              using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] Some' unfolding HF\n              by(cases mp2; \n                  auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                  schem_lift_defs \n                  merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                  get_cond_def\n                  split: md_prio.splits md_triv.splits option.splits)\n\n            show ?thesis\n            proof(cases cnd)\n              case True\n        \n              have Mp2'_cond : \"get_cond (payload mp2') = Some True\" \n                using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] True Some' unfolding HF\n                by(cases mp2; \n                    auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                    schem_lift_defs \n                    merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                    get_cond_def\n                    split: md_prio.splits md_triv.splits option.splits)\n\n              have Mp2'_p2_true :  \"P2 (payload mp2') \\<and> get_cond (payload mp2') = Some True\"\n                using Mp2'_p2 Mp2'_cond\n                by auto\n\n              have Mp2'_cont : \"cont mp2' = Inl ([body] @ c')\"\n                using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] True Some' unfolding HF\n                by(cases mp2; cases mp2'; \n                    auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                    schem_lift_defs \n                    merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                    get_cond_def\n                    split: md_prio.splits md_triv.splits option.splits)\n\n              have Mp2'_safe : \"safe gs mp2'\"\n                using guardedD[OF Gtrue Mp2'_p2_true Mp2'_cont] by auto\n\n              show ?thesis\n              proof\n                fix mz\n                assume Exec : \"sem_exec_p gs mp2 mz\"\n\n                show \"imm_safe gs mz\" using Exec unfolding sem_exec_p_def\n                proof(cases rule: rtranclp.cases)\n                  case rtrancl_refl\n\n                  then have \"(\\<exists>m'. sem_step gs mz = Inl m')\"\n                    using Inl unfolding imm_safe_def sem_step_p_eq\n                    by(cases mp2'; auto)\n\n                  then show ?thesis unfolding imm_safe_def sem_step_p_eq by auto\n                next\n                  case (rtrancl_into_rtrancl b)\n\n                  have Step : \"sem_step_p gs mp2 mp2'\" using Inl\n                    unfolding sem_step_p_eq\n                    by auto\n        \n                  have Exec_final : \"sem_exec_p gs mp2' mz\"\n                    using rtranclp_bisect1\n                      [OF sem_step_determ rtrancl_into_rtrancl(1)\n                          Step rtrancl_into_rtrancl(2)]\n                    unfolding sem_exec_p_def\n                    by auto\n        \n                  show ?thesis using safeD[OF Mp2'_safe Exec_final] by auto \n                qed\n              qed\n\n            next\n              case False\n\n              have Mp2'_cond : \"get_cond (payload mp2') = Some False\" \n                using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] False Some' unfolding HF\n                by(cases mp2; \n                    auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                    schem_lift_defs \n                    merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                    get_cond_def\n                    split: md_prio.splits md_triv.splits option.splits)\n\n              have Mp2'_p2_false :  \"P2 (payload mp2') \\<and> get_cond (payload mp2') = Some False\"\n                using Mp2'_p2 Mp2'_cond\n                by auto\n\n              have Mp2'_cont : \"cont mp2' = Inl ([] @ c')\"\n                using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] False Some' unfolding HF\n                by(cases mp2; \n                    auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                    schem_lift_defs \n                    merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                    get_cond_def\n                    split: md_prio.splits md_triv.splits option.splits if_splits)\n\n              have Mp2'_safe : \"safe gs mp2'\"\n                using guardedD[OF Gfalse Mp2'_p2_false Mp2'_cont] by auto\n\n              show ?thesis\n              proof\n                fix mz\n                assume Exec : \"sem_exec_p gs mp2 mz\"\n\n                show \"imm_safe gs mz\" using Exec unfolding sem_exec_p_def\n                proof(cases rule: rtranclp.cases)\n                  case rtrancl_refl\n\n                  then have \"(\\<exists>m'. sem_step gs mz = Inl m')\"\n                    using Inl unfolding imm_safe_def sem_step_p_eq\n                    by(cases mp2'; auto)\n\n                  then show ?thesis unfolding imm_safe_def sem_step_p_eq by auto\n                next\n                  case (rtrancl_into_rtrancl b)\n\n                  have Step : \"sem_step_p gs mp2 mp2'\" using Inl\n                    unfolding sem_step_p_eq\n                    by auto\n        \n                  have Exec_final : \"sem_exec_p gs mp2' mz\"\n                    using rtranclp_bisect1\n                      [OF sem_step_determ rtrancl_into_rtrancl(1)\n                          Step rtrancl_into_rtrancl(2)]\n                    unfolding sem_exec_p_def\n                    by auto\n        \n                  show ?thesis using safeD[OF Mp2'_safe Exec_final] by auto \n                qed\n              qed\n            qed\n          qed\n        qed\n      qed\n\n      have Guard' : \"|gs| {P1} ([cond] @ ([G Sif' [body]] @ c'))\"\n        using HTE[OF Hcond Sub] by auto\n\n      have Safe' : \"safe gs m'\" using guardedD[OF Guard' P1sm' CM'] by auto\n\n      show \"safe gs m\"\n      proof\n        fix mz\n\n        assume Z: \"sem_exec_p gs m mz\"\n\n        then show \"imm_safe gs mz\" unfolding sem_exec_p_def\n        proof(cases rule: rtranclp.cases)\n          case rtrancl_refl\n\n          then have \"(\\<exists>m'. sem_step gs mz = Inl m')\"\n            using Inl unfolding imm_safe_def sem_step_p_eq\n            by(cases m'; auto)\n\n          then show ?thesis using Inl unfolding imm_safe_def sem_step_p_eq\n            by(auto)\n        next\n          case (rtrancl_into_rtrancl b)\n\n          have Step : \"sem_step_p gs m m'\" using Inl\n            unfolding sem_step_p_eq\n            by auto\n\n          have Exec_final : \"sem_exec_p gs m' mz\"\n            using rtranclp_bisect1\n              [OF sem_step_determ rtrancl_into_rtrancl(1)\n                  Step rtrancl_into_rtrancl(2)]\n            unfolding sem_exec_p_def\n            by auto\n\n          show ?thesis using safeD[OF Safe' Exec_final] by auto\n        qed\n      qed\n    qed\n  qed\nqed\n*)\n(*\nfun payload_incr :: \"('x md_prio * 'y) \\<Rightarrow> ('x md_prio * 'y)\" where\n*)\nlemma HxIf :\n  assumes H0 : \"gs = pcomps fs\"\n  assumes HF : \"f = lift_map_t_s lfts \n    (imp_sem_lifting_gen :: (_, _, (_, (_ :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state) lifting)\n tg imp_ctl_sem\"\n  assumes Tg : \"tg (Sif') = True\"\n  assumes Hpres : \"sups_pres (set fs) (\\<lambda> _ . ok_S)\"\n  assumes Hnemp : \"g \\<in> set fs\"\n  assumes Hdom : \"(f \\<downharpoonleft> (set fs) {Sif'})\"\n  assumes Hsyn : \"lfts Sif' = Sif\"\n  assumes P1_valid : \"\\<And> st.  P1 st \\<Longrightarrow> get_cond st \\<noteq> None\"\n  assumes P2_valid : \"\\<And> st . P2 st \\<Longrightarrow> get_cond st \\<noteq> None\"\n  assumes P1_oblivious : \"\\<And> p p' x rest . P1 (mdp p x, rest) \\<Longrightarrow> P1 (mdp p' x, rest)\"\n  assumes P2_oblivious : \"\\<And> p p' x rest . P2 (mdp p x, rest) \\<Longrightarrow> P2 (mdp p' x, rest)\"\n\n\n  assumes Hcond : \"|gs| {~ P1 ~} [cond] {~ P2 ~}\"\n  assumes Htrue : \"|gs| {~ (\\<lambda> st . P2 st \\<and> get_cond st = Some True) ~} [body]\n                        {~ P3 ~}\"\n  assumes Hfalse : \"|gs| {~ (\\<lambda> st . P2 st \\<and> get_cond st = Some False) ~} [] {~P3~}\"\n  shows \"|gs| {~ P1 ~} [G Sif' [cond, body]] {~ P3 ~}\"\nproof(rule HT'I)\n  fix npre\n\n  obtain ncond where Ncond : \"|#gs#| {#-P1, (ncond + npre)-#} [cond] {#-P2, npre-#}\"\n    using HT'D[OF Hcond] by blast\n\n  have Ntrue : \n    \"|#gs#| {#- (\\<lambda> st . P2 st \\<and> get_cond st = Some True), npre -#} [body] {#- P3, npre -#}\"\n    using HT'D0[OF Htrue, of npre] by blast\n\n  have Nfalse : \n    \"|#gs#| {#- (\\<lambda> st . P2 st \\<and> get_cond st = Some False ), npre -#} [] {#- P3, npre -#}\"\n    using HT'D0[OF Hfalse] by blast\n(*\n  have Ntrue' : \n    \"|#gs#| {#- (\\<lambda> st . P2 st \\<and> get_cond st = Some True), ncond -#} [body] {#- P3, npost -#}\"\n    using Hoare_Indexed.HConseq\n      [OF Ntrue\n      ,of \"\\<lambda> st . P2 st \\<and> get_cond st = Some True\" ncond P3 npost]\n    using Npost by auto\n\n  have Nfalse' : \n    \"|#gs#| {#- (\\<lambda> st . P2 st \\<and> get_cond st = Some False), ncond -#} [] {#- P3, npost -#}\"\n    using Hoare_Indexed.HConseq\n      [OF Nfalse\n      ,of \"\\<lambda> st . P2 st \\<and> get_cond st = Some False\" ncond P3 npost]\n    using Npost by auto\n\n  have Ncond' : \"|#gs#| {#-P1, npre-#} [cond] {#-P2, ncond-#}\"\n    using Hoare_Indexed.HConseq\n      [OF Ncond\n      , of P1 npre P2 ncond]\n    using Npost by auto\n*)\n\n  have Conc' : \"|#gs#| {#-P1, npre-#} [G Sif' [cond, body]] {#-P3, npre-#}\"\n  proof\n    fix c'\n    assume Guard : \"|#gs#| {#P3, npre#} c'\"\n(*\n    have Gtrue : \"|#gs#| {# (\\<lambda>st. P2 st \\<and> get_cond st = Some True), npre #} ([body] @ c')\"\n      using HTiE[OF Ntrue' Guard]\n      by auto\n\n    have Gfalse : \"|#gs#| {#(\\<lambda>st. P2 st \\<and> get_cond st = Some False), npre#} ([] @ c')\"\n      using HTiE[OF Nfalse' Guard] by auto\n*)\n    show \"|#gs#| {#P1, npre#} ([G Sif' [cond, body]] @ c')\"\n    proof\n      fix m :: \"('a, 'b) state\"\n\n      assume Ok : \"m \\<in> ok_S\"\n      assume M : \"P1 (payload m)\"\n      assume CM : \"cont m = Inl ([G Sif' [cond, body]] @ c')\"\n  \n      show \"safe_for gs m npre\"\n      proof(cases \"(sem_step gs m)\")\n        case (Inr bad)\n  \n        then have False using CM H0\n          by(auto simp add: sem_step_def)\n  \n        then show ?thesis by auto\n      next\n        case (Inl m')\n  \n        have F_eq : \"sem_step f m = Inl m'\"\n          using sym[OF dominant_pcomps[OF Hpres Hnemp Hdom _ Ok]] CM Inl H0\n          by(simp add: sem_step_def)\n  \n        have CM' : \"cont m' = Inl ([cond] @ ([ G Sif' [body]] @ c'))\" \n          using CM Hsyn F_eq Tg unfolding HF\n          by(cases m; auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n             schem_lift_defs lift_map_s_def lift_map_t_s_def\n            merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def\n            split: md_prio.splits md_triv.splits option.splits)\n\n        have M'_valid : \"\\<And> p . fst (payload m) \\<noteq> mdp p None\" using P1_valid[OF M]\n          by(auto simp add: get_cond_def split:prod.splits)\n        (* ok, so this is kind of annoying... we need to adjust for the fact that\n         * priority has incremented *)\n        have Sm' : \"payload m' = (case payload m of (mdp pm vm, w) \\<Rightarrow> (mdp (1 + pm) vm, w))\"\n        (*have Sm' : \"payload m = payload m'\"*)\n          using CM CM' Hsyn F_eq M'_valid  Tg unfolding HF\n          by(cases m; cases m'; auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n             schem_lift_defs lift_map_s_def lift_map_t_s_def\n            merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n            split: md_prio.splits md_triv.splits option.splits list.split_asm if_splits)\n  \n        hence P1sm' : \"P1 (payload m')\" \n          using P1_oblivious\n          using M unfolding Sm' \n          by(cases m; auto split: md_prio.splits)\n  \n        (* step to the end of cond. *)\n  \n        have Sub : \"|#gs#| {#P2, npre#} ([G Sif' [body]] @ c')\"\n        proof\n          fix mp2 :: \"('a, 'b) state\"\n\n          assume Ok2 : \"mp2 \\<in> ok_S\"\n          assume MP2 : \"P2 (payload mp2)\"\n  \n          assume Cont2 : \"cont mp2 = Inl ([G Sif' [body]] @ c')\"\n  \n          show \"safe_for gs mp2 npre\"\n          proof(cases \"get_cond (payload mp2)\")\n            case None\n  \n            then have False using P2_valid[OF MP2]\n              by(auto simp add: get_cond_def split: prod.splits md_prio.splits md_triv.splits option.splits)\n            then show ?thesis by auto\n  \n          next\n            case Some' : (Some cnd)\n            then show ?thesis \n            proof(cases \"sem_step gs mp2\")\n              case (Inr bad)\n  \n              then have False using Cont2 H0\n                by(auto simp add: sem_step_def)\n  \n              then show ?thesis by auto\n  \n            next\n              case (Inl mp2')\n  \n              have F_eq' : \"sem_step f mp2 = Inl mp2'\"\n                using sym[OF dominant_pcomps[OF Hpres Hnemp Hdom _ Ok2]] Cont2 Inl H0\n                by(simp add: sem_step_def)\n\n              have Smp2' : \"payload mp2' = (case payload mp2 of (mdp pm vm, w) \\<Rightarrow> (mdp (1 + pm) vm, w))\"\n                using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] Some' Tg unfolding HF\n                by(cases mp2; \n                    auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                    schem_lift_defs \n                    merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                    get_cond_def lift_map_s_def lift_map_t_s_def\n                    split: md_prio.splits md_triv.splits option.splits)\n\n              hence Mp2'_p2 : \"P2 (payload mp2')\" \n                using P2_oblivious\n                using MP2 unfolding Smp2' \n                by(cases mp2; auto split: md_prio.splits)\n\n              have Mp2'_ok : \"mp2' \\<in> ok_S\"\n                using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] Some' Ok2 Tg unfolding HF\n                by(cases mp2; \n                    auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                    schem_lift_defs \n                    merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                    get_cond_def lift_map_s_def lift_map_t_s_def\n                    prod_ok_S option_ok_S triv_ok_S prio_ok_S\n                    split: md_prio.splits md_triv.splits option.splits)\n\n(*\n              have Mp2'_p2 : \"P2 (payload mp2')\"\n                using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] Some' unfolding HF\n                apply(cases mp2; \n                    auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                    schem_lift_defs \n                    merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                    get_cond_def lift_map_s_def\n                    split: md_prio.splits md_triv.splits option.splits)\n*)\n  \n              show ?thesis\n              proof(cases cnd)\n                case True\n          \n                have Mp2'_cond : \"get_cond (payload mp2') = Some True\" \n                  using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] True Some' Smp2' unfolding HF\n                  by(cases mp2; \n                      auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                      schem_lift_defs \n                      merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                      get_cond_def\n                      split: md_prio.splits md_triv.splits option.splits)\n  \n                have Mp2'_p2_true :  \"P2 (payload mp2') \\<and> get_cond (payload mp2') = Some True\"\n                  using Mp2'_p2 Mp2'_cond\n                  by auto\n  \n                have Mp2'_cont : \"cont mp2' = Inl ([body] @ c')\"\n                  using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] True Some' Tg unfolding HF\n                  by(cases mp2; cases mp2'; \n                      auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                      schem_lift_defs \n                      merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                      get_cond_def lift_map_s_def lift_map_t_s_def\n                      split: md_prio.splits md_triv.splits option.splits)\n\n                have Gtrue : \"|#gs#| {# (\\<lambda>st. P2 st \\<and> get_cond st = Some True), npre #} ([body] @ c')\"\n                  using HTiE[OF Ntrue Guard]\n                  by auto\n\n                have Mp2'_safe : \"safe_for gs mp2' npre\"\n                  using guardediD[OF Gtrue Mp2'_ok Mp2'_p2_true Mp2'_cont] by auto\n\n                have Exec1 : \"sem_exec_c_p gs mp2 1 mp2'\"\n                  using Excp_1[of gs mp2 mp2'] Inl unfolding sem_step_p_eq\n                  by auto\n\n                show ?thesis\n                  using safe_for_weaken[OF safe_for_extend[OF Mp2'_safe Exec1], of npre] by auto\n  \n              next\n                case False\n  \n                have Mp2'_cond : \"get_cond (payload mp2') = Some False\" \n                  using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] False Some' Tg unfolding HF\n                  by(cases mp2; \n                      auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                      schem_lift_defs \n                      merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                      get_cond_def lift_map_s_def lift_map_t_s_def\n                      split: md_prio.splits md_triv.splits option.splits)\n  \n                have Mp2'_p2_false :  \"P2 (payload mp2') \\<and> get_cond (payload mp2') = Some False\"\n                  using Mp2'_p2 Mp2'_cond\n                  by auto\n  \n                have Mp2'_cont : \"cont mp2' = Inl ([] @ c')\"\n                  using Cont2 Hsyn H0 MP2 F_eq' P2_valid[OF MP2] False Some' Tg unfolding HF\n                  by(cases mp2; \n                      auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                      schem_lift_defs lift_map_t_s_def\n                      merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                      get_cond_def lift_map_s_def\n                      split: md_prio.splits md_triv.splits option.splits if_splits)\n\n                have Gfalse : \"|#gs#| {#(\\<lambda>st. P2 st \\<and> get_cond st = Some False), npre#} ([] @ c')\"\n                  using HTiE[OF Nfalse Guard] by auto\n\n                have Mp2'_safe : \"safe_for gs mp2' npre\"\n                  using guardediD[OF Gfalse Mp2'_ok Mp2'_p2_false Mp2'_cont] by auto\n\n                have Exec1 : \"sem_exec_c_p gs mp2 1 mp2'\"\n                  using Excp_1[of gs mp2 mp2'] Inl unfolding sem_step_p_eq\n                  by auto\n\n                show ?thesis\n                  using safe_for_weaken[OF safe_for_extend[OF Mp2'_safe Exec1], of npre] by auto\n              qed\n            qed\n          qed\n        qed\n\n        have Guard' : \"|#gs#| {#P1, (ncond + npre)#} ([cond] @ [G Sif' [body]] @ c')\"\n          using HTiE[OF Ncond Sub]\n          by auto\n\n        have M'_ok : \"m' \\<in> ok_S\"\n          using CM CM' Hsyn F_eq M'_valid Ok Tg unfolding HF\n          by(cases m; cases m'; auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n             schem_lift_defs lift_map_s_def lift_map_t_s_def\n            prod_ok_S option_ok_S triv_ok_S prio_ok_S\n\n            merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n            split: md_prio.splits md_triv.splits option.splits list.split_asm if_splits)\n  \n\n        have Safe' : \"safe_for gs m' (ncond + npre)\" \n          using guardediD[OF Guard' M'_ok P1sm' CM'] by auto\n\n        have Exec1 : \"sem_exec_c_p gs m 1 m'\"\n          using Excp_1[of gs m m'] Inl unfolding sem_step_p_eq\n          by auto\n  \n        show \"safe_for gs m npre\"\n          using safe_for_weaken[OF safe_for_extend[OF Safe' Exec1], of npre] by auto\n      qed\n    qed\n  qed\n\n  hence \"|#gs#| {#-P1, (0 + npre) -#} [G Sif' [cond, body]] {#-P3, npre-#}\"\n    by simp\n\n  then show \"\\<exists>npre'. |#gs#| {#-P1, (npre' + npre)-#} [G Sif' [cond, body]] {#-P3, npre-#}\"\n    by blast\nqed\n(*\nlift_map_t_s imp_trans imp_sem_lifting_spec imp_toggle imp_ctl_sem\n*)\nlemma HxWhileC' :\n  assumes H0 : \"gs = pcomps fs\"\n  assumes HF : \"f = lift_map_t_s lfts \n    (imp_sem_lifting_gen :: (_, _, (_, (_ :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state) lifting)\n tg imp_ctl_sem\"  assumes Tg : \"tg (SwhileC') = True\"\n  assumes Hpres : \"sups_pres (set fs) (\\<lambda> _ . ok_S)\"\n  assumes Hnemp : \"g \\<in> set fs\"\n  assumes Hdom : \"(f \\<downharpoonleft> (set fs) {SwhileC'})\"\n  assumes Hsyn : \"lfts SwhileC' = SwhileC\"\n  assumes PX_valid : \"\\<And> st.  PX st \\<Longrightarrow> get_cond st \\<noteq> None\"\n  assumes PX_oblivious : \"\\<And> p p' x rest . PX (mdp p x, rest) \\<Longrightarrow> PX (mdp p' x, rest)\"\n(*  assumes Htrue : \"\\<And> nb2 . \\<exists> nb1' . |#gs#| {#- PX, (nb1' + nb2) -#} [body] {#- PX, nb2 -#}\" *)\n  assumes Htrue : \"\\<And> nb2 . \\<exists> nb1' . |#gs#| {#- (\\<lambda> st. PX st \\<and> get_cond st = Some True), (nb1' + nb2) -#} [body] {#- PX, nb2 -#}\" \n  assumes NLs : \"nl1 \\<le> nl2\"\n  shows \"|#gs#| {#- PX, nl1  -#} [G SwhileC' [body]] {#- (\\<lambda> st . PX st \\<and> get_cond st = Some False), nl2 -#}\"\nproof\n  fix c'\n\n  assume Guard : \"|#gs#| {#(\\<lambda>st. PX st \\<and> get_cond st = Some False), nl2#} c'\"\n\n  show \"|#gs#| {#PX, nl1#} ([G SwhileC' [body]] @ c')\" \n    using Guard NLs\n  proof(induction nl2 arbitrary: nl1 c')\n    case 0\n    show ?case\n    proof\n      fix m :: \"('a, 'b) state\"\n      assume Hm : \" PX (payload m)\"\n\n      have Nl1_0 : \"nl1 = 0\" using 0 by auto\n\n      assume Hcontm : \"cont m = Inl ([G SwhileC' [body]] @ c')\" \n\n\n      have Conc' : \"sem_exec_c_p gs m 0 m \\<and> cont m = Inl ((G SwhileC' [body]) # c')\"\n        using Hcontm Excp_0[of gs m] by auto\n\n      show \"safe_for gs m nl1\" \n        using Conc'\n        unfolding Nl1_0 safe_for_def\n        by blast\n    qed\n  next\n    case (Suc nl2')\n    show ?case \n    proof\n      fix m :: \"('a, 'b) state\"\n\n      assume Ok : \"m \\<in> ok_S\"\n      assume Hm : \"PX (payload m)\" \n\n      assume Hcontm : \"cont m = Inl ([G SwhileC' [body]] @ c')\" \n      show  \"safe_for gs m nl1\" \n\n      proof(cases \"(sem_step gs m)\")\n        case (Inr bad)\n  \n        then have False using Hcontm H0\n          by(auto simp add: sem_step_def)\n  \n        then show ?thesis by auto\n      next\n        case (Inl m')\n\n        have F_eq : \"sem_step f m = Inl m'\"\n          using sym[OF dominant_pcomps[OF Hpres Hnemp Hdom _ Ok]] Hcontm Inl H0\n          by(simp add: sem_step_def)\n  \n        have M_P1 : \"PX (payload m)\" using Hm Hcontm by auto\n  \n        have M'_valid : \"\\<And> p . fst (payload m) \\<noteq> mdp p None\" using PX_valid[OF M_P1]\n          by(auto simp add: get_cond_def split:prod.splits)\n  \n        have Sm' : \"payload m' = (case payload m of (mdp pm vm, w) \\<Rightarrow> (mdp (1 + pm) vm, w))\"\n          using Hcontm Hsyn F_eq M'_valid Tg unfolding HF\n          by(cases m; auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n             schem_lift_defs lift_map_s_def lift_map_t_s_def\n            merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n            split: md_prio.splits md_triv.splits option.splits)\n  \n        have M' : \"PX (payload m')\" using Sm' M_P1 PX_oblivious \n          by (cases \"payload m\"; auto split: md_prio.splits)\n\n        show \"safe_for gs m nl1\"\n        proof(cases \"get_cond (payload m)\")\n          case None\n  \n          then have False using PX_valid[OF M_P1]\n            by(auto simp add: get_cond_def split: prod.splits md_prio.splits md_triv.splits option.splits)\n          then show ?thesis by auto\n  \n        next\n          case Some' : (Some cnd)\n\n          have Helper : \"|#gs#| {#(\\<lambda> st . PX st \\<and> get_cond st = Some False), nl2'#} c'\"\n          proof\n            fix ml :: \"('a, 'b) state\"\n            assume Ok_ml : \"ml \\<in> ok_S\"\n            assume Hpay : \"PX (payload ml) \\<and> get_cond (payload ml) = Some False\"\n\n            assume Hcont : \"cont ml = Inl c'\"\n\n            have Conc' : \"safe_for gs ml (Suc nl2')\"\n              using guardediD[OF Suc.prems(1) Ok_ml Hpay Hcont]\n              by auto\n\n            show \"safe_for gs ml nl2'\"\n              using safe_for_weaken[OF Conc', of nl2'] by auto\n          qed\n\n          show ?thesis\n          proof(cases cnd)\n            case True\n\n            have M'_cont : \"cont m' = Inl ([body, G SwhileC' [body]] @ c')\"\n                using Hsyn H0 M' F_eq True Some' Hcontm Tg unfolding HF\n                by(cases m; auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                  schem_lift_defs \n                  merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                  get_cond_def lift_map_s_def lift_map_t_s_def\n                  split: md_prio.splits md_triv.splits option.splits)\n\n            have G1 : \"|#gs#| {#PX, nl2'#} ([G SwhileC' [body]] @ c')\"\n              using Suc.IH[OF Helper] by auto\n\n            hence G1' :  \"|#gs#| {#PX, (Suc nl2' - 1)#} ([G SwhileC' [body]] @ c')\"\n              using Suc.IH[OF Helper] by auto\n\n            obtain nb where NB : \"|#gs#| {#-(\\<lambda> st . PX st \\<and>\n                      get_cond st =\n                      Some\n                       True), (nb + nl2')-#} [body] {#-PX, nl2'-#}\"\n              using Htrue[of nl2'] by auto\n\n            have Ggood : \"|#gs#| {#(\\<lambda> st . PX st \\<and>\n                   get_cond st =\n                   Some\n                    True), (nb + nl2')#} ([body] @ [G SwhileC' [body]] @ c')\" \n              using HTiE[OF NB G1] by auto\n\n            have Sm'' : \"payload m' = (case payload m of (mdp pm vm, w) \\<Rightarrow> (mdp (1 + pm) vm, w))\"\n              using M' True Some' Sm' PX_oblivious\n              by(cases m; cases m';  auto split: md_prio.splits prod.splits)\n\n            have M'' : \"PX (payload m') \\<and> get_cond (payload m') = Some True\"\n              using M' True Some' Sm' PX_oblivious\n              by(cases m; cases m';  auto simp add: get_cond_def split: md_prio.splits prod.splits option.splits)\n\n            have M''_ok : \"m' \\<in> ok_S\"\n              using Ok\n                using Hsyn H0 M' F_eq True Some' Hcontm Tg unfolding HF\n                by(cases m; auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                  schem_lift_defs \n                  merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                  get_cond_def lift_map_s_def lift_map_t_s_def\n                    prod_ok_S option_ok_S triv_ok_S prio_ok_S\n                  split: md_prio.splits md_triv.splits option.splits)\n\n\n            have Almost :  \"safe_for gs m' (nb + nl2')\" using guardediD[OF Ggood] M'\n              using guardediD[OF Ggood M''_ok M''] M'_cont\n              by auto\n\n            have Step : \"sem_step_p gs m m'\" using Inl\n              unfolding sem_step_p_eq\n              by auto\n      \n            have Step' : \"sem_exec_c_p gs m 1 m'\"\n              using sem_exec_c_p.intros(2)[OF Step sem_exec_c_p.intros(1)] by auto\n\n            have Conc' : \"safe_for gs m (1 + nb + nl2')\"\n              using safe_for_extend[OF Almost Step'] by auto\n\n            have Leq : \"nl1 \\<le> 1 + nb + nl2'\" using Suc.prems by auto\n\n            show \"safe_for gs m nl1\"\n              using safe_for_weaken[OF Conc' Leq] by auto\n          next\n\n            case False\n\n            have M'_cont : \"cont m' = Inl (c')\"\n                using Hsyn H0 M' F_eq False Some' Hcontm Tg unfolding HF\n                by(cases m; auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                  schem_lift_defs \n                  merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                  get_cond_def lift_map_s_def lift_map_t_s_def\n                  split: md_prio.splits md_triv.splits option.splits if_splits)\n\n            have Sm'' : \"payload m' = (case payload m of (mdp pm vm, w) \\<Rightarrow> (mdp (1 + pm) vm, w))\"\n              using M' False Some' Sm' PX_oblivious\n              by(cases m; cases m';  auto split: md_prio.splits prod.splits)\n\n            have M'_full' : \"PX (payload m') \\<and> get_cond (payload m') = Some False\"\n              using M' False Some' Sm'' PX_oblivious unfolding Suc.prems(1) Sm'\n              by(cases m; cases m';  auto simp add: get_cond_def split: md_prio.splits prod.splits option.splits)\n\n            have M''_ok : \"m' \\<in> ok_S\"\n              using Ok\n                using Hsyn H0 M' F_eq False Some' Hcontm Tg unfolding HF\n                by(cases m; auto simp add: cont_def sem_step_def imp_sem_l_gen_def imp_ctl_sem_def imp_sem_lifting_gen_def\n                  schem_lift_defs \n                  merge_l_def fst_l_def snd_l_def prio_l_def triv_l_def option_l_def LNew_def\n                  get_cond_def lift_map_s_def lift_map_t_s_def\n                    prod_ok_S option_ok_S triv_ok_S prio_ok_S\n                  split: md_prio.splits md_triv.splits option.splits)\n\n\n            have Almost : \"safe_for gs m' (Suc nl2')\"\n              using guardediD[OF Suc.prems(1) M''_ok M'_full' M'_cont] by auto\n\n            have Step : \"sem_step_p gs m m'\" using Inl\n              unfolding sem_step_p_eq\n              by auto\n\n            have Step' : \"sem_exec_c_p gs m 1 m'\"\n              using sem_exec_c_p.intros(2)[OF Step sem_exec_c_p.intros(1)] by auto\n\n            have Conc' : \"safe_for gs m (1 + Suc (nl2'))\"\n              using safe_for_extend[OF Almost Step'] by auto\n\n            have Leq : \"nl1 \\<le> 1 + Suc nl2'\" using Suc.prems by auto\n\n            show \"safe_for gs m nl1\"\n              using safe_for_weaken[OF Conc' Leq] by auto\n          qed\n        qed\n      qed\n    qed\n  qed\nqed\n\n(*\n  assumes H0 : \"gs = pcomps fs\"\n  assumes HF : \"f = imp_sem_l_gen lfts\"\n  assumes Hpres : \"sups_pres (set fs) (\\<lambda> _ . ok_S)\"\n  assumes Hnemp : \"g \\<in> set fs\"\n  assumes Hdom : \"(f \\<downharpoonleft> (set fs) {SwhileC'})\"\n  assumes Hsyn : \"lfts SwhileC' = SwhileC\"\n  assumes PX_valid : \"\\<And> st.  PX st \\<Longrightarrow> get_cond st \\<noteq> None\"\n  assumes PX_oblivious : \"\\<And> p p' x rest . PX (mdp p x, rest) \\<Longrightarrow> PX (mdp p' x, rest)\"\n(*  assumes Htrue : \"\\<And> nb2 . \\<exists> nb1' . |#gs#| {#- PX, (nb1' + nb2) -#} [body] {#- PX, nb2 -#}\" *)\n  assumes Htrue : \"\\<And> nb2 . \\<exists> nb1' . |#gs#| {#- (\\<lambda> st. PX st \\<and> get_cond st = Some True), (nb1' + nb2) -#} [body] {#- PX, nb2 -#}\" \n*)\nlemma HxWhileC :\n  assumes H0 : \"gs = pcomps fs\"\n  assumes HF : \"f = lift_map_t_s lfts \n    (imp_sem_lifting_gen :: (_, _, (_, (_ :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state) lifting)\n tg imp_ctl_sem\"  assumes Tg : \"tg (SwhileC') = True\"\n  assumes Hpres : \"sups_pres (set fs) (\\<lambda> _ . ok_S)\"\n  assumes Hnemp : \"g \\<in> set fs\"\n  assumes Hdom : \"(f \\<downharpoonleft> (set fs) {SwhileC'})\"\n  assumes Hsyn : \"lfts SwhileC' = SwhileC\"\n  assumes PX_valid : \"\\<And> st.  PX st \\<Longrightarrow> get_cond st \\<noteq> None\"\n  assumes PX_oblivious : \"\\<And> p p' x rest . PX (mdp p x, rest) \\<Longrightarrow> PX (mdp p' x, rest)\"\n  assumes Htrue : \"|gs| {~ (\\<lambda> st . (PX st \\<and> get_cond st = Some True))~} [body] {~ PX~}\"\n  shows \"|gs| {~PX~} [G SwhileC' [body]] {~ (\\<lambda> st . PX st \\<and> get_cond st = Some False)~}\"\nproof(rule HT'I)\n  fix npost\n\n  have Htrue' : \"(\\<And>nb2. \\<exists>nb1'. |#gs#| {#-(\\<lambda> st . PX st \\<and> get_cond st = Some True), (nb1' + nb2)-#} [body] {#-PX, nb2-#})\"\n    using HT'D[OF Htrue] by auto\n\n  have Conc' : \"|#gs#| {#-PX, (0 + npost)-#} [G SwhileC' [body]] {#-(\\<lambda>st. PX st \\<and> get_cond st = Some False), npost-#}\"\n    unfolding add_0\n    using HxWhileC'[OF H0 HF Tg Hpres Hnemp Hdom Hsyn _ _ Htrue', of npost npost] PX_valid PX_oblivious\n    by blast\n\n  then show \"\\<exists>npre. |#gs#| {#-PX, (npre + npost)-#} [G SwhileC' [body]] {#-(\\<lambda>st. PX st \\<and> get_cond st = Some False), npost-#}\"\n    by blast\nqed\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Language_Components/Imp_Ctl/Imp_Ctl_Hoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3298780234384952}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* Author: Thomas Sewell *)\n\nsection \"Enumeration Instances for Words\"\n\ntheory Word_Enum\nimports Enumeration Word_Lib\nbegin\n\ninstantiation word :: (len) enum\nbegin\n\ndefinition\n  \"(enum_class.enum :: ('a :: len) word list) \\<equiv> map of_nat [0 ..< 2 ^ LENGTH('a)]\"\n\ndefinition\n  \"enum_class.enum_all (P :: ('a :: len) word \\<Rightarrow> bool) \\<longleftrightarrow> Ball UNIV P\"\n\ndefinition\n  \"enum_class.enum_ex (P :: ('a :: len) word \\<Rightarrow> bool) \\<longleftrightarrow> Bex UNIV P\"\n\ninstance\n  apply (intro_classes)\n     apply (force simp: enum_word_def)\n    apply (simp add: distinct_map enum_word_def)\n    apply (rule subset_inj_on, rule word_unat.Abs_inj_on)\n    apply (clarsimp simp add: unats_def)\n   apply (simp add: enum_all_word_def)\n  apply (simp add: enum_ex_word_def)\n  done\n\nend\n\nlemma fromEnum_unat[simp]: \"fromEnum (x :: 'a::len word) = unat x\"\nproof -\n  have \"enum ! the_index enum x = x\" by (auto intro: nth_the_index)\n  moreover\n  have \"the_index enum x < length (enum::'a::len word list)\" by (auto intro: the_index_bounded)\n  moreover\n  { fix y assume \"of_nat y = x\"\n    moreover assume \"y < 2 ^ LENGTH('a)\"\n    ultimately have \"y = unat x\" using of_nat_inverse by fastforce\n  }\n  ultimately\n  show ?thesis by (simp add: fromEnum_def enum_word_def)\nqed\n\nlemma length_word_enum: \"length (enum :: 'a :: len word list) = 2 ^ LENGTH('a)\"\n  by (simp add: enum_word_def)\n\nlemma toEnum_of_nat[simp]: \"n < 2 ^ LENGTH('a) \\<Longrightarrow> (toEnum n :: 'a :: len word) = of_nat n\"\n  by (simp add: toEnum_def length_word_enum enum_word_def)\n\ndeclare of_nat_diff [simp]\n\ninstantiation word :: (len) enumeration_both\nbegin\n\ndefinition\n  enum_alt_word_def: \"enum_alt \\<equiv> alt_from_ord (enum :: ('a :: len) word list)\"\n\ninstance\n  by (intro_classes, simp add: enum_alt_word_def)\n\nend\n\ndefinition\n  upto_enum_step :: \"('a :: len) word \\<Rightarrow> 'a word \\<Rightarrow> 'a word \\<Rightarrow> 'a word list\" (\"[_ , _ .e. _]\")\nwhere\n  \"upto_enum_step a b c \\<equiv>\n      if c < a then [] else map (\\<lambda>x. a + x * (b - a)) [0 .e. (c - a) div (b - a)]\"\n  (* in the wraparound case, bad things happen. *)\n\nlemma maxBound_word:\n  \"(maxBound::'a::len word) = -1\"\n  by (simp add: maxBound_def enum_word_def last_map)\n\nlemma minBound_word:\n  \"(minBound::'a::len word) = 0\"\n  by (simp add: minBound_def enum_word_def upt_conv_Cons)\n\nlemma maxBound_max_word:\n  \"(maxBound::'a::len word) = max_word\"\n  by (simp add: maxBound_word max_word_minus [symmetric])\n\n\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/Word_Lib/Word_Enum.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.32987802343849515}}
{"text": "(*  Title:      HOL/HOLCF/Fixrec.thy\n    Author:     Amber Telfer and Brian Huffman\n*)\n\nsection \"Package for defining recursive functions in HOLCF\"\n\ntheory Fixrec\nimports Cprod Sprod Ssum Up One Tr Fix\nkeywords \"fixrec\" :: thy_defn\nbegin\n\nsubsection \\<open>Pattern-match monad\\<close>\n\ndefault_sort cpo\n\npcpodef 'a match = \"UNIV::(one ++ 'a u) set\"\nby simp_all\n\ndefinition\n  fail :: \"'a match\" where\n  \"fail = Abs_match (sinl\\<cdot>ONE)\"\n\ndefinition\n  succeed :: \"'a \\<rightarrow> 'a match\" where\n  \"succeed = (\\<Lambda> x. Abs_match (sinr\\<cdot>(up\\<cdot>x)))\"\n\nlemma matchE [case_names bottom fail succeed, cases type: match]:\n  \"\\<lbrakk>p = \\<bottom> \\<Longrightarrow> Q; p = fail \\<Longrightarrow> Q; \\<And>x. p = succeed\\<cdot>x \\<Longrightarrow> Q\\<rbrakk> \\<Longrightarrow> Q\"\nunfolding fail_def succeed_def\napply (cases p, rename_tac r)\napply (rule_tac p=r in ssumE, simp add: Abs_match_strict)\napply (rule_tac p=x in oneE, simp, simp)\napply (rule_tac p=y in upE, simp, simp add: cont_Abs_match)\ndone\n\nlemma succeed_defined [simp]: \"succeed\\<cdot>x \\<noteq> \\<bottom>\"\nby (simp add: succeed_def cont_Abs_match Abs_match_bottom_iff)\n\nlemma fail_defined [simp]: \"fail \\<noteq> \\<bottom>\"\nby (simp add: fail_def Abs_match_bottom_iff)\n\nlemma succeed_eq [simp]: \"(succeed\\<cdot>x = succeed\\<cdot>y) = (x = y)\"\nby (simp add: succeed_def cont_Abs_match Abs_match_inject)\n\nlemma succeed_neq_fail [simp]:\n  \"succeed\\<cdot>x \\<noteq> fail\" \"fail \\<noteq> succeed\\<cdot>x\"\nby (simp_all add: succeed_def fail_def cont_Abs_match Abs_match_inject)\n\nsubsubsection \\<open>Run operator\\<close>\n\ndefinition\n  run :: \"'a match \\<rightarrow> 'a::pcpo\" where\n  \"run = (\\<Lambda> m. sscase\\<cdot>\\<bottom>\\<cdot>(fup\\<cdot>ID)\\<cdot>(Rep_match m))\"\n\ntext \\<open>rewrite rules for run\\<close>\n\nlemma run_strict [simp]: \"run\\<cdot>\\<bottom> = \\<bottom>\"\nunfolding run_def\nby (simp add: cont_Rep_match Rep_match_strict)\n\nlemma run_fail [simp]: \"run\\<cdot>fail = \\<bottom>\"\nunfolding run_def fail_def\nby (simp add: cont_Rep_match Abs_match_inverse)\n\nlemma run_succeed [simp]: \"run\\<cdot>(succeed\\<cdot>x) = x\"\nunfolding run_def succeed_def\nby (simp add: cont_Rep_match cont_Abs_match Abs_match_inverse)\n\nsubsubsection \\<open>Monad plus operator\\<close>\n\ndefinition\n  mplus :: \"'a match \\<rightarrow> 'a match \\<rightarrow> 'a match\" where\n  \"mplus = (\\<Lambda> m1 m2. sscase\\<cdot>(\\<Lambda> _. m2)\\<cdot>(\\<Lambda> _. m1)\\<cdot>(Rep_match m1))\"\n\nabbreviation\n  mplus_syn :: \"['a match, 'a match] \\<Rightarrow> 'a match\"  (infixr \"+++\" 65)  where\n  \"m1 +++ m2 == mplus\\<cdot>m1\\<cdot>m2\"\n\ntext \\<open>rewrite rules for mplus\\<close>\n\nlemma mplus_strict [simp]: \"\\<bottom> +++ m = \\<bottom>\"\nunfolding mplus_def\nby (simp add: cont_Rep_match Rep_match_strict)\n\nlemma mplus_fail [simp]: \"fail +++ m = m\"\nunfolding mplus_def fail_def\nby (simp add: cont_Rep_match Abs_match_inverse)\n\nlemma mplus_succeed [simp]: \"succeed\\<cdot>x +++ m = succeed\\<cdot>x\"\nunfolding mplus_def succeed_def\nby (simp add: cont_Rep_match cont_Abs_match Abs_match_inverse)\n\nlemma mplus_fail2 [simp]: \"m +++ fail = m\"\nby (cases m, simp_all)\n\nlemma mplus_assoc: \"(x +++ y) +++ z = x +++ (y +++ z)\"\nby (cases x, simp_all)\n\nsubsection \\<open>Match functions for built-in types\\<close>\n\ndefault_sort pcpo\n\ndefinition\n  match_bottom :: \"'a \\<rightarrow> 'c match \\<rightarrow> 'c match\"\nwhere\n  \"match_bottom = (\\<Lambda> x k. seq\\<cdot>x\\<cdot>fail)\"\n\ndefinition\n  match_Pair :: \"'a::cpo \\<times> 'b::cpo \\<rightarrow> ('a \\<rightarrow> 'b \\<rightarrow> 'c match) \\<rightarrow> 'c match\"\nwhere\n  \"match_Pair = (\\<Lambda> x k. csplit\\<cdot>k\\<cdot>x)\"\n\ndefinition\n  match_spair :: \"'a \\<otimes> 'b \\<rightarrow> ('a \\<rightarrow> 'b \\<rightarrow> 'c match) \\<rightarrow> 'c match\"\nwhere\n  \"match_spair = (\\<Lambda> x k. ssplit\\<cdot>k\\<cdot>x)\"\n\ndefinition\n  match_sinl :: \"'a \\<oplus> 'b \\<rightarrow> ('a \\<rightarrow> 'c match) \\<rightarrow> 'c match\"\nwhere\n  \"match_sinl = (\\<Lambda> x k. sscase\\<cdot>k\\<cdot>(\\<Lambda> b. fail)\\<cdot>x)\"\n\ndefinition\n  match_sinr :: \"'a \\<oplus> 'b \\<rightarrow> ('b \\<rightarrow> 'c match) \\<rightarrow> 'c match\"\nwhere\n  \"match_sinr = (\\<Lambda> x k. sscase\\<cdot>(\\<Lambda> a. fail)\\<cdot>k\\<cdot>x)\"\n\ndefinition\n  match_up :: \"'a::cpo u \\<rightarrow> ('a \\<rightarrow> 'c match) \\<rightarrow> 'c match\"\nwhere\n  \"match_up = (\\<Lambda> x k. fup\\<cdot>k\\<cdot>x)\"\n\ndefinition\n  match_ONE :: \"one \\<rightarrow> 'c match \\<rightarrow> 'c match\"\nwhere\n  \"match_ONE = (\\<Lambda> ONE k. k)\"\n\ndefinition\n  match_TT :: \"tr \\<rightarrow> 'c match \\<rightarrow> 'c match\"\nwhere\n  \"match_TT = (\\<Lambda> x k. If x then k else fail)\"\n\ndefinition\n  match_FF :: \"tr \\<rightarrow> 'c match \\<rightarrow> 'c match\"\nwhere\n  \"match_FF = (\\<Lambda> x k. If x then fail else k)\"\n\nlemma match_bottom_simps [simp]:\n  \"match_bottom\\<cdot>x\\<cdot>k = (if x = \\<bottom> then \\<bottom> else fail)\"\nby (simp add: match_bottom_def)\n\nlemma match_Pair_simps [simp]:\n  \"match_Pair\\<cdot>(x, y)\\<cdot>k = k\\<cdot>x\\<cdot>y\"\nby (simp_all add: match_Pair_def)\n\nlemma match_spair_simps [simp]:\n  \"\\<lbrakk>x \\<noteq> \\<bottom>; y \\<noteq> \\<bottom>\\<rbrakk> \\<Longrightarrow> match_spair\\<cdot>(:x, y:)\\<cdot>k = k\\<cdot>x\\<cdot>y\"\n  \"match_spair\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_spair_def)\n\nlemma match_sinl_simps [simp]:\n  \"x \\<noteq> \\<bottom> \\<Longrightarrow> match_sinl\\<cdot>(sinl\\<cdot>x)\\<cdot>k = k\\<cdot>x\"\n  \"y \\<noteq> \\<bottom> \\<Longrightarrow> match_sinl\\<cdot>(sinr\\<cdot>y)\\<cdot>k = fail\"\n  \"match_sinl\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_sinl_def)\n\nlemma match_sinr_simps [simp]:\n  \"x \\<noteq> \\<bottom> \\<Longrightarrow> match_sinr\\<cdot>(sinl\\<cdot>x)\\<cdot>k = fail\"\n  \"y \\<noteq> \\<bottom> \\<Longrightarrow> match_sinr\\<cdot>(sinr\\<cdot>y)\\<cdot>k = k\\<cdot>y\"\n  \"match_sinr\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_sinr_def)\n\nlemma match_up_simps [simp]:\n  \"match_up\\<cdot>(up\\<cdot>x)\\<cdot>k = k\\<cdot>x\"\n  \"match_up\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_up_def)\n\nlemma match_ONE_simps [simp]:\n  \"match_ONE\\<cdot>ONE\\<cdot>k = k\"\n  \"match_ONE\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_ONE_def)\n\nlemma match_TT_simps [simp]:\n  \"match_TT\\<cdot>TT\\<cdot>k = k\"\n  \"match_TT\\<cdot>FF\\<cdot>k = fail\"\n  \"match_TT\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_TT_def)\n\nlemma match_FF_simps [simp]:\n  \"match_FF\\<cdot>FF\\<cdot>k = k\"\n  \"match_FF\\<cdot>TT\\<cdot>k = fail\"\n  \"match_FF\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\nby (simp_all add: match_FF_def)\n\nsubsection \\<open>Mutual recursion\\<close>\n\ntext \\<open>\n  The following rules are used to prove unfolding theorems from\n  fixed-point definitions of mutually recursive functions.\n\\<close>\n\nlemma Pair_equalI: \"\\<lbrakk>x \\<equiv> fst p; y \\<equiv> snd p\\<rbrakk> \\<Longrightarrow> (x, y) \\<equiv> p\"\nby simp\n\nlemma Pair_eqD1: \"(x, y) = (x', y') \\<Longrightarrow> x = x'\"\nby simp\n\nlemma Pair_eqD2: \"(x, y) = (x', y') \\<Longrightarrow> y = y'\"\nby simp\n\nlemma def_cont_fix_eq:\n  \"\\<lbrakk>f \\<equiv> fix\\<cdot>(Abs_cfun F); cont F\\<rbrakk> \\<Longrightarrow> f = F f\"\nby (simp, subst fix_eq, simp)\n\nlemma def_cont_fix_ind:\n  \"\\<lbrakk>f \\<equiv> fix\\<cdot>(Abs_cfun F); cont F; adm P; P \\<bottom>; \\<And>x. P x \\<Longrightarrow> P (F x)\\<rbrakk> \\<Longrightarrow> P f\"\nby (simp add: fix_ind)\n\ntext \\<open>lemma for proving rewrite rules\\<close>\n\nlemma ssubst_lhs: \"\\<lbrakk>t = s; P s = Q\\<rbrakk> \\<Longrightarrow> P t = Q\"\nby simp\n\n\nsubsection \\<open>Initializing the fixrec package\\<close>\n\nML_file \\<open>Tools/holcf_library.ML\\<close>\nML_file \\<open>Tools/fixrec.ML\\<close>\n\nmethod_setup fixrec_simp = \\<open>\n  Scan.succeed (SIMPLE_METHOD' o Fixrec.fixrec_simp_tac)\n\\<close> \"pattern prover for fixrec constants\"\n\nsetup \\<open>\n  Fixrec.add_matchers\n    [ (\\<^const_name>\\<open>up\\<close>, \\<^const_name>\\<open>match_up\\<close>),\n      (\\<^const_name>\\<open>sinl\\<close>, \\<^const_name>\\<open>match_sinl\\<close>),\n      (\\<^const_name>\\<open>sinr\\<close>, \\<^const_name>\\<open>match_sinr\\<close>),\n      (\\<^const_name>\\<open>spair\\<close>, \\<^const_name>\\<open>match_spair\\<close>),\n      (\\<^const_name>\\<open>Pair\\<close>, \\<^const_name>\\<open>match_Pair\\<close>),\n      (\\<^const_name>\\<open>ONE\\<close>, \\<^const_name>\\<open>match_ONE\\<close>),\n      (\\<^const_name>\\<open>TT\\<close>, \\<^const_name>\\<open>match_TT\\<close>),\n      (\\<^const_name>\\<open>FF\\<close>, \\<^const_name>\\<open>match_FF\\<close>),\n      (\\<^const_name>\\<open>bottom\\<close>, \\<^const_name>\\<open>match_bottom\\<close>) ]\n\\<close>\n\nhide_const (open) succeed fail run\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/Fixrec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.32987802343849515}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoarePartialProps.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Properties of Partial Correctness Hoare Logic *}\n\ntheory HoarePartialProps imports HoarePartialDef begin\n\nsubsection {* Soundness *}\n\nlemma hoare_cnvalid: \n assumes hoare: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\<And>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nusing hoare\nproof (induct)\n  case (Skip \\<Theta> F P A)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Skip P,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> P\"\n    thus \"t \\<in> Normal ` P \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext\n  case (Basic \\<Theta> F f P A)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> {s. f s \\<in> P} (Basic f) P,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> {s. f s \\<in> P}\"\n    thus \"t \\<in> Normal ` P \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext \n  case (Spec \\<Theta> F r Q A)\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {s. (\\<forall>t. (s, t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s, t) \\<in> r)} Spec r Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> {s. (\\<forall>t. (s, t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s, t) \\<in> r)}\"\n    from exec P\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext\n  case (Seq \\<Theta> F P c1 R A c2 Q)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c1 R,A\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> R c2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    assume P: \"s \\<in> P\"\n    from exec P obtain r where\n      exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> r\" and exec_c2:  \"\\<Gamma>\\<turnstile>\\<langle>c2,r\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    with t_notin_F have \"r \\<notin> Fault ` F\"\n      by (auto dest: execn_Fault_end)\n    with valid_c1 ctxt exec_c1 P\n    have r: \"r\\<in>Normal ` R \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n    show \"t\\<in>Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases r)\n      case (Normal r')\n      with exec_c2 r\n      show \"t\\<in>Normal ` Q \\<union> Abrupt ` A\"\n        apply -\n        apply (rule cnvalidD [OF valid_c2 ctxt _ _ t_notin_F])\n        apply auto\n        done\n    next\n      case (Abrupt r')\n      with exec_c2 have \"t=Abrupt r'\"\n        by (auto elim: execn_elim_cases)\n      with Abrupt r show ?thesis\n        by auto\n    next\n      case Fault with r show ?thesis by blast\n    next\n      case Stuck with r show ?thesis by blast\n    qed\n  qed\nnext\n  case (Cond \\<Theta> F P b c1 Q A c2)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> b) c1 Q,A\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> - b) c2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Cond b c1 c2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases \"s\\<in>b\")\n      case True\n      with exec have \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by cases auto\n      with P True \n      show ?thesis\n        by - (rule cnvalidD [OF valid_c1 ctxt _ _ t_notin_F],auto)\n    next\n      case False\n      with exec P have \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by cases auto\n      with P False \n      show ?thesis\n        by - (rule cnvalidD [OF valid_c2 ctxt _ _ t_notin_F],auto)\n    qed\n  qed\nnext\n  case (While \\<Theta> F P b c A n)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P While b c (P \\<inter> - b),A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    show \"t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt ` A\"\n    proof (cases \"s \\<in> b\")\n      case True\n      {\n        fix d::\"('b,'a,'c) com\" fix s t \n        assume exec: \"\\<Gamma>\\<turnstile>\\<langle>d,s\\<rangle> =n\\<Rightarrow> t\"\n        assume d: \"d=While b c\"\n        assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n        from exec d ctxt\n        have \"\\<lbrakk>s \\<in> Normal ` P; t \\<notin> Fault ` F\\<rbrakk>\n               \\<Longrightarrow> t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt`A\"\n        proof (induct)\n          case (WhileTrue s b' c' n r t)\n          have t_notin_F: \"t \\<notin> Fault ` F\" by fact\n          have eqs: \"While b' c' = While b c\" by fact\n          note valid_c\n          moreover have ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n          moreover from WhileTrue\n          obtain \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> r\" and\n            \"\\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> t\" and\n            \"Normal s \\<in> Normal `(P \\<inter> b)\" by auto\n          moreover with t_notin_F have \"r \\<notin> Fault ` F\"\n            by (auto dest: execn_Fault_end)\n          ultimately\n          have r: \"r \\<in> Normal ` P \\<union> Abrupt ` A\"\n            by - (rule cnvalidD,auto)\n          from this _ ctxt\n          show \"t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt ` A \"\n          proof (cases r)\n            case (Normal r')\n            with r ctxt eqs t_notin_F\n            show ?thesis\n              by - (rule WhileTrue.hyps,auto)\n          next\n            case (Abrupt r')\n            have \"\\<Gamma>\\<turnstile>\\<langle>While b' c',r\\<rangle> =n\\<Rightarrow> t\" by fact\n            with Abrupt have \"t=r\"\n              by (auto dest: execn_Abrupt_end) \n            with r Abrupt show ?thesis\n              by blast\n          next\n            case Fault with r show ?thesis by blast\n          next\n            case Stuck with r show ?thesis by blast\n          qed   \n        qed auto\n      }\n      with exec ctxt P t_notin_F\n      show ?thesis\n        by auto\n    next\n      case False\n      with exec P have \"t=Normal s\"\n        by cases auto\n      with P False\n      show ?thesis\n        by auto\n    qed\n  qed\nnext\n  case (Guard \\<Theta> F g P c Q A f)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) Guard f g c  Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    assume P:\"s \\<in> (g \\<inter> P)\"\n    from exec P have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    from valid_c ctxt this P t_notin_F\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n  qed\nnext\n  case (Guarantee f F \\<Theta> g P c Q A)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\" by fact\n  have f_F: \"f \\<in> F\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Guard f g c  Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    assume P:\"s \\<in> P\"\n    from exec f_F t_notin_F have g: \"s \\<in> g\"\n      by cases auto\n    with P have P': \"s \\<in> g \\<inter> P\"\n      by blast\n    from exec P g have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    from valid_c ctxt this P' t_notin_F\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n  qed\nnext\n  case (CallRec P p Q A Specs \\<Theta> F)\n  have p: \"(P,p,Q,A) \\<in> Specs\" by fact\n  have valid_body:\n    \"\\<forall>(P,p,Q,A) \\<in> Specs. p \\<in> dom \\<Gamma> \\<and> (\\<forall>n. \\<Gamma>,\\<Theta> \\<union> Specs \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A)\"\n    using CallRec.hyps by blast\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P Call p Q,A\"\n  proof -\n    {\n      fix n\n      have \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\n        \\<Longrightarrow> \\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n      proof (induct n)\n        case 0\n        show \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>0:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (fastforce elim!: execn_elim_cases simp add: nvalid_def)\n      next\n        case (Suc m)\n        have hyp: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\n              \\<Longrightarrow> \\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n        have \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n        hence ctxt_m: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (fastforce simp add: nvalid_def intro: execn_Suc)\n        hence valid_Proc:\n          \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (rule hyp)\n        let ?\\<Theta>'= \"\\<Theta> \\<union> Specs\"\n        from valid_Proc ctxt_m\n        have \"\\<forall>(P, p, Q, A)\\<in>?\\<Theta>'. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by fastforce\n        with valid_body\n        have valid_body_m: \n          \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<forall>n. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A\"\n          by (fastforce simp add: cnvalid_def)\n        show \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n        proof (clarify)\n          fix P p Q A assume p: \"(P,p,Q,A) \\<in> Specs\"\n          show \"\\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          proof (rule nvalidI)\n            fix s t\n            assume exec_call: \n              \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> =Suc m\\<Rightarrow> t\"\n            assume Pre: \"s \\<in> P\"\n            assume t_notin_F: \"t \\<notin> Fault ` F\"\n            from exec_call\n            show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n            proof (cases)\n              fix bdy m' \n              assume m: \"Suc m = Suc m'\"\n              assume bdy: \"\\<Gamma> p = Some bdy\"\n              assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =m'\\<Rightarrow> t\"\n              from Pre valid_body_m exec_body bdy m p t_notin_F\n              show ?thesis\n                by (fastforce simp add: nvalid_def)\n            next\n              assume \"\\<Gamma> p = None\"\n              with valid_body p have False by auto\n              thus ?thesis ..\n            qed\n          qed\n        qed\n      qed\n    }\n    with p show ?thesis\n      by (fastforce simp add: cnvalid_def)\n  qed\nnext\n  case (DynCom P \\<Theta> F c Q A)\n  hence valid_c: \"\\<forall>s\\<in>P. (\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (c s) Q,A)\" by auto\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P DynCom c Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    assume P: \"s \\<in> P\"\n    assume t_notin_Fault: \"t \\<notin> Fault ` F\"\n    from exec show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases)\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c s,Normal s\\<rangle> =n\\<Rightarrow> t\"      \n      from cnvalidD [OF valid_c [rule_format, OF P] ctxt this P t_notin_Fault]\n      show ?thesis .\n    qed\n  qed\nnext\n  case (Throw \\<Theta> F A Q)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> A Throw Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> A\"\n    then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by cases simp\n  qed\nnext\n  case (Catch \\<Theta> F P c\\<^sub>1 Q R c\\<^sub>2 A)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    assume P: \"s \\<in> P\"\n    assume t_notin_Fault: \"t \\<notin> Fault ` F\"\n    from exec show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases)\n      fix s'\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\" \n      assume exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      from cnvalidD [OF valid_c1 ctxt exec_c1 P ] \n      have \"Abrupt s' \\<in> Abrupt ` R\"\n        by auto\n      with cnvalidD [OF valid_c2 ctxt _ _ t_notin_Fault] exec_c2\n      show ?thesis\n        by fastforce\n    next\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      assume notAbr: \"\\<not> isAbr t\"\n      from cnvalidD [OF valid_c1 ctxt exec_c1 P t_notin_Fault] \n      have \"t \\<in> Normal ` Q \\<union> Abrupt ` R\" .\n      with notAbr\n      show ?thesis\n        by auto\n    qed\n  qed\nnext\n  case (Conseq P \\<Theta> F c Q A)\n  hence adapt: \"\\<forall>s \\<in> P. (\\<exists>P' Q' A'. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'  \\<and>\n                          s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A)\"\n    by blast\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof -\n      from P adapt obtain P' Q' A' Z  where\n        spec: \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'\" and\n        P': \"s \\<in> P'\"  and  strengthen: \"Q' \\<subseteq> Q \\<and> A' \\<subseteq> A\"\n        by auto\n      from spec [rule_format] ctxt exec P' t_notin_F  \n      have \"t \\<in> Normal ` Q' \\<union> Abrupt ` A'\"\n        by (rule cnvalidD)\n      with strengthen show ?thesis\n        by blast\n    qed\n  qed\nnext\n  case (Asm P p Q A \\<Theta> F)\n  have asm: \"(P, p, Q, A) \\<in> \\<Theta>\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    from asm ctxt have \"\\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Call p Q,A\" by auto\n    moreover\n    assume \"s \\<in> P\" \"t \\<notin> Fault ` F\"\n    ultimately\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      using exec\n      by (auto simp add: nvalid_def)\n  qed\nnext\n  case ExFalso thus ?case by iprover\nqed\n\n\n\nsubsection {* Completeness *}\n\nlemma MGT_valid:\n\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n   {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t}, {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof (rule validI) \n  fix s t\n  assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t\" \n         \"s \\<in> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))}\"\n         \"t \\<notin> Fault ` F\"\n  thus \"t \\<in> Normal ` {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t} \\<union> \n            Abrupt ` {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (cases t) (auto simp add: final_notin_def)\nqed\n\ntext {* The consequence rule where the existential @{term Z} is instantiated\nto @{term s}. Usefull in proof of @{text \"MGT_lemma\"}.*}\nlemma ConseqMGT: \n  assumes modif: \"\\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\n  assumes impl: \"\\<And>s. s \\<in> P \\<Longrightarrow> s \\<in> P' s \\<and> (\\<forall>t. t \\<in> Q' s \\<longrightarrow> t \\<in> Q) \\<and> \n                                            (\\<forall>t. t \\<in> A' s \\<longrightarrow> t \\<in> A)\"\n  shows \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl \nby -  (rule conseq [OF modif],blast)\n\n\nlemma Seq_NoFaultStuckD1: \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nproof (rule final_notinI)\n  fix t\n  assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t\"\n  show \"t \\<notin> {Stuck} \\<union> Fault `  F\"\n  proof \n    assume \"t \\<in> {Stuck} \\<union> Fault `  F\"\n    moreover\n    {\n      assume \"t = Stuck\"\n      with exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Stuck\"\n        by (auto intro: exec_Seq')\n      with noabort have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    moreover \n    {\n      assume \"t \\<in> Fault ` F\"\n      then obtain f where \n      t: \"t=Fault f\" and f: \"f \\<in> F\"\n        by auto\n      from t exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Fault f\"\n        by (auto intro: exec_Seq')\n      with noabort f have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    ultimately show False by auto\n  qed\nqed\n\nlemma Seq_NoFaultStuckD2: \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<forall>t. \\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> t\\<notin> ({Stuck} \\<union> Fault `  F) \\<longrightarrow> \n             \\<Gamma>\\<turnstile>\\<langle>c2,t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nusing noabort\nby (auto simp add: final_notin_def intro: exec_Seq')\n\n\nlemma MGT_implies_complete:\n  assumes MGT: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  assumes valid: \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  using MGT\n  apply (rule ConseqMGT) \n  apply (insert valid)\n  apply (auto simp add: valid_def intro!: final_notinI)\n  done\n\ntext {* Equipped only with the classic consequence rule @{thm \"conseqPrePost\"}\n        we can only derive this syntactically more involved version\n        of completeness. But semantically it is equivalent to the \"real\" one\n        (see below) *}\nlemma MGT_implies_complete':\n  assumes MGT: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                       {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  assumes valid: \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  using MGT [rule_format, of Z]\n  apply (rule conseqPrePost)\n  apply (insert valid)\n  apply   (fastforce simp add: valid_def final_notin_def)\n  apply  (fastforce simp add: valid_def)\n  apply (fastforce simp add: valid_def)\n  done\n\ntext {* Semantic equivalence of both kind of formulations *}\nlemma valid_involved_to_valid:\n  assumes valid: \n    \"\\<forall>Z. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  shows \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  using valid\n  apply (simp add: valid_def)\n  apply clarsimp\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"Normal x\" in allE)\n  apply (erule_tac x=t in allE)\n  apply fastforce\n  done\n\ntext {* The sophisticated consequence rule allow us to do this \n        semantical transformation on the hoare-level, too. \n        The magic is, that it allow us to\n        choose the instance of @{term Z} under the assumption of an state @{term \"s \\<in> P\"} *}\nlemma\n  assumes deriv: \n    \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule ConseqMGT [OF deriv])\n  apply auto\n  done\n\nlemma valid_to_valid_involved:\n  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow>\n   \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\nby (simp add: valid_def Collect_conv_if)\n\nlemma\n  assumes deriv: \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  apply (rule conseqPrePost [OF deriv])\n  apply auto\n  done\n\nlemma conseq_extract_state_indep_prop: \n  assumes state_indep_prop:\"\\<forall>s \\<in> P. R\" \n  assumes to_show: \"R \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule Conseq)\n  apply (clarify)\n  apply (rule_tac x=\"P\" in exI)\n  apply (rule_tac x=\"Q\" in exI)\n  apply (rule_tac x=\"A\" in exI)\n  using state_indep_prop to_show\n  by blast\n\n\nlemma MGT_lemma:\n  assumes MGT_Calls: \n    \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> \n       {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n        (Call p)\n       {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n       {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  shows \"\\<And>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c \n             {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof (induct c)\n  case Skip\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Skip\n           {t. \\<Gamma>\\<turnstile>\\<langle>Skip,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>Skip,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Skip [THEN conseqPre])\n       (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\nnext\n  case (Basic f)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Basic f\n           {t. \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal Z\\<rangle> \\<Rightarrow> Normal t}, \n           {t. \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Basic [THEN conseqPre])\n       (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\nnext\n  case (Spec r)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Spec r\n           {t. \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal Z\\<rangle> \\<Rightarrow> Normal t}, \n           {t. \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    apply (rule hoarep.Spec [THEN conseqPre])\n    apply (clarsimp simp add: final_notin_def)\n    apply (case_tac \"\\<exists>t. (Z,t) \\<in> r\")\n    apply (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\n    done\nnext\n  case (Seq c1 c2) \n  have hyp_c1: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Seq.hyps by iprover\n  have hyp_c2: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c2 \n                          {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                          {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Seq.hyps by iprover\n  from hyp_c1 \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n              {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t \\<and> \n                  \\<Gamma>\\<turnstile>\\<langle>c2,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT)\n       (auto dest: Seq_NoFaultStuckD1 [simplified] Seq_NoFaultStuckD2 [simplified]\n             intro: exec.Seq)\n  thus \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   Seq c1 c2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule hoarep.Seq )\n    show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t \\<and> \n                      \\<Gamma>\\<turnstile>\\<langle>c2,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   c2\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    proof (rule ConseqMGT [OF hyp_c2],safe)\n      fix r t\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal r\" \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal r\\<rangle> \\<Rightarrow> Normal t\"\n      then show \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        by (iprover intro: exec.intros)\n    next\n      fix r t\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal r\" \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal r\\<rangle> \\<Rightarrow> Abrupt t\"\n      then show \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n        by (iprover intro: exec.intros)\n    qed\n  qed\nnext\n  case (Cond b c1 c2) \n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n                 {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Cond.hyps by iprover  \n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\\<inter>b)\n                   c1 \n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    by (rule ConseqMGT)\n       (fastforce intro: exec.CondTrue simp add: final_notin_def)\n  moreover\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c2 \n                    {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Cond.hyps by iprover  \n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>({s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\\<inter>-b)\n                  c2 \n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    by (rule ConseqMGT)\n       (fastforce intro: exec.CondFalse simp add: final_notin_def)\n  ultimately\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                 Cond b c1 c2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Cond)       \nnext\n  case (While b c)\n  let ?unroll = \"({(s,t). s\\<in>b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t})\\<^sup>*\"\n  let ?P' = \"\\<lambda>Z. {t. (Z,t)\\<in>?unroll \\<and> \n                    (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                         \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                             (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}\"\n  let ?A' = \"\\<lambda>Z. {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                While b c\n              {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule ConseqMGT [where ?P'=\"?P'\" \n                         and ?Q'=\"\\<lambda>Z. ?P' Z \\<inter> - b\" and ?A'=\"?A'\"])\n    show \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?P' Z) (While b c) (?P' Z \\<inter> - b),(?A' Z)\"\n    proof (rule allI, rule hoarep.While)\n      fix Z\n      from While \n      have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\n                        {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                        {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" by iprover\n      then show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?P' Z  \\<inter> b) c (?P' Z),(?A' Z)\"\n      proof (rule ConseqMGT)\n        fix s\n        assume  \"s\\<in> {t. (Z, t) \\<in> ?unroll \\<and> \n                      (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                           \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                               (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                    \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}\n                   \\<inter> b\"\n        then obtain \n          Z_s_unroll: \"(Z,s) \\<in> ?unroll\" and\n          noabort:\"\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                        \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                            (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u)\" and\n          s_in_b: \"s\\<in>b\" \n          by blast\n        show \"s \\<in> {t. t = s \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \\<and>\n        (\\<forall>t. t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t} \\<longrightarrow>\n             t \\<in> {t. (Z, t) \\<in> ?unroll \\<and> \n                  (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow>  e\\<in>b \n                       \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                           (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}) \\<and> \n         (\\<forall>t. t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Abrupt t} \\<longrightarrow>\n             t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t})\"\n          (is \"?C1 \\<and> ?C2 \\<and> ?C3\")\n        proof (intro conjI)\n          from Z_s_unroll noabort s_in_b show ?C1 by blast\n        next\n          {\n            fix t \n            assume s_t: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t\"\n            moreover\n            from Z_s_unroll s_t s_in_b \n            have \"(Z, t) \\<in> ?unroll\"\n              by (blast intro: rtrancl_into_rtrancl)\n            moreover note noabort\n            ultimately \n            have \"(Z, t) \\<in> ?unroll \\<and> \n                  (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                        \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                            (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))\"\n              by iprover\n          }\n          then show ?C2 by blast\n        next\n          {\n            fix t\n            assume s_t:  \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Abrupt t\" \n            from Z_s_unroll noabort s_t s_in_b \n            have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n              by blast\n          } thus ?C3 by simp\n        qed\n      qed\n    qed\n  next\n    fix s\n    assume P: \"s \\<in> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n    hence WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n      by auto\n    show \"s \\<in> ?P' s \\<and> \n    (\\<forall>t. t\\<in>(?P' s \\<inter> - b)\\<longrightarrow>\n         t\\<in>{t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t})\\<and>\n    (\\<forall>t. t\\<in>?A' s \\<longrightarrow> t\\<in>?A' Z)\"\n    proof (intro conjI)\n      {\n        fix e\n        assume \"(Z,e) \\<in> ?unroll\" \"e \\<in> b\"\n        from this WhileNoFault\n        have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n               (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                    \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u)\" (is \"?Prop Z e\")\n        proof (induct rule: converse_rtrancl_induct [consumes 1])\n          assume e_in_b: \"e \\<in> b\"\n          assume WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n          with e_in_b WhileNoFault\n          have cNoFault: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n            by (auto simp add: final_notin_def intro: exec.intros)\n          moreover\n          {\n            fix u assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n            with e_in_b have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n              by (blast intro: exec.intros)\n          }\n          ultimately\n          show \"?Prop e e\"\n            by iprover\n        next\n          fix Z r\n          assume e_in_b: \"e\\<in>b\" \n          assume WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n          assume hyp: \"\\<lbrakk>e\\<in>b;\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\\<rbrakk>\n                       \\<Longrightarrow> ?Prop r e\"\n          assume Z_r:\n            \"(Z, r) \\<in> {(Z, r). Z \\<in> b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r}\"\n          with WhileNoFault\n          have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n            by (auto simp add: final_notin_def intro: exec.intros)\n          from hyp [OF e_in_b this] obtain\n            cNoFault: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\" and\n            Abrupt_r: \"\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u \\<longrightarrow> \n                            \\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Abrupt u\"\n            by simp\n          \n           {\n            fix u assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n            with Abrupt_r have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Abrupt u\" by simp\n            moreover from  Z_r obtain\n              \"Z \\<in> b\"  \"\\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r\"\n              by simp\n            ultimately have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u\"\n              by (blast intro: exec.intros)\n          }\n          with cNoFault show \"?Prop Z e\"\n            by iprover\n        qed\n      }\n      with P show \"s \\<in> ?P' s\"\n        by blast\n    next\n      {\n        fix t\n        assume \"termination\": \"t \\<notin> b\"\n        assume \"(Z, t) \\<in> ?unroll\"\n        hence \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        proof (induct rule: converse_rtrancl_induct [consumes 1])\n          from \"termination\" \n          show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal t\\<rangle> \\<Rightarrow> Normal t\"\n            by (blast intro: exec.WhileFalse)\n        next\n          fix Z r\n          assume first_body: \n                 \"(Z, r) \\<in> {(s, t). s \\<in> b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t}\"\n          assume \"(r, t) \\<in> ?unroll\"\n          assume rest_loop: \"\\<Gamma>\\<turnstile>\\<langle>While b c, Normal r\\<rangle> \\<Rightarrow> Normal t\"\n          show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n          proof -\n            from first_body obtain\n              \"Z \\<in> b\" \"\\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r\"\n              by fast\n            moreover\n            from rest_loop have\n              \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Normal t\"\n              by fast\n            ultimately show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n              by (rule exec.WhileTrue)\n          qed\n        qed\n      }\n      with P\n      show \"(\\<forall>t. t\\<in>(?P' s \\<inter> - b)\n            \\<longrightarrow>t\\<in>{t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t})\"\n        by blast\n    next\n      from P show \"\\<forall>t. t\\<in>?A' s \\<longrightarrow> t\\<in>?A' Z\" by simp\n    qed\n  qed\nnext\n  case (Call p)\n  let ?P = \"{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n  from noStuck_Call have \"\\<forall>s \\<in> ?P. p \\<in> dom \\<Gamma>\"\n    by (fastforce simp add: final_notin_def )\n  then show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ?P (Call p)\n               {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule conseq_extract_state_indep_prop)\n    assume p_definied: \"p \\<in> dom \\<Gamma>\"\n    with MGT_Calls show\n      \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \n                 \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n                  (Call p)\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Call  p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      by (auto)\n  qed\nnext\n  case (DynCom c)\n  have hyp: \n    \"\\<And>s'. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c s',Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c s'\n      {t. \\<Gamma>\\<turnstile>\\<langle>c s',Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>c s',Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using DynCom by simp\n  have hyp':\n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c Z\n        {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT [OF hyp])\n       (fastforce simp add: final_notin_def intro: exec.intros)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n               DynCom c\n             {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n             {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    apply (rule hoarep.DynCom)\n    apply (clarsimp)\n    apply (rule hyp' [simplified])\n    done\nnext  \n  case (Guard f g c)\n  have hyp_c: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Guard by iprover\n  show ?case\n  proof (cases \"f \\<in> F\")\n    case True \n    from hyp_c\n    have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>(g \\<inter> {s. s = Z \\<and> \n                    \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (- F))}) \n             c\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      apply (rule ConseqMGT)\n      apply (insert True)\n      apply (auto simp add: final_notin_def intro: exec.intros)\n      done\n    from True this\n    show ?thesis      \n      by (rule conseqPre [OF Guarantee]) auto\n  next\n    case False\n    from hyp_c\n    have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> \n           (g \\<inter> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}) \n           c\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      apply (rule ConseqMGT)\n      apply clarify\n      apply (frule Guard_noFaultStuckD [OF _ False])\n      apply (auto simp add: final_notin_def intro: exec.intros)\n      done\n    then show ?thesis\n      apply (rule conseqPre [OF hoarep.Guard])\n      apply clarify\n      apply (frule Guard_noFaultStuckD [OF _ False])\n      apply auto\n      done\n  qed\nnext\n  case Throw\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Throw\n              {t. \\<Gamma>\\<turnstile>\\<langle>Throw,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Throw,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule conseqPre [OF hoarep.Throw]) (blast intro: exec.intros)\nnext\n  case (Catch c\\<^sub>1 c\\<^sub>2)\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>1\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Catch.hyps by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>1\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t \\<and> \n                   \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n    by (rule ConseqMGT)\n       (fastforce intro: exec.intros simp add: final_notin_def)\n  moreover\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>2\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Catch.hyps by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow>Abrupt s \\<and> \n                   \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n               c\\<^sub>2\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT)\n       (fastforce intro: exec.intros  simp add: final_notin_def)\n  ultimately\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   Catch c\\<^sub>1 c\\<^sub>2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Catch)\nqed\n\nlemma MGT_Calls: \n \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \n     \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n            (Call p)\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof - \n  {\n    fix p Z \n    assume defined: \"p \\<in> dom \\<Gamma>\"\n    have \n      \"\\<Gamma>,(\\<Union>p\\<in>dom \\<Gamma>. \\<Union>Z. \n          {({s. s=Z \\<and> \n             \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))},\n             p,\n             {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n             {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t})})\n       \\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n          (the (\\<Gamma> p))\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      (is \"\\<Gamma>,?\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (?Pre p Z) (the (\\<Gamma> p)) (?Post p Z),(?Abr p Z)\")\n    proof -\n      have MGT_Calls:\n       \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \\<Gamma>,?\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> \n        {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n         (Call p)\n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n        by (intro ballI allI, rule HoarePartialDef.Asm,auto)\n      have \"\\<forall>Z. \\<Gamma>,?\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p) ,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault`(-F))} \n                        (the (\\<Gamma> p))\n                        {t. \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                        {t. \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n        by (iprover intro: MGT_lemma [OF MGT_Calls])\n      thus \"\\<Gamma>,?\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?Pre p Z) (the (\\<Gamma> p)) (?Post p Z),(?Abr p Z)\"\n        apply (rule ConseqMGT)\n        apply (clarify,safe)\n      proof -\n        assume \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n        with defined show \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\" \n          by (fastforce simp add: final_notin_def \n                intro: exec.intros)\n      next\n        fix t\n        assume \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        with defined \n        show \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>Normal t\"\n          by  (auto intro: exec.Call)\n      next\n        fix t\n        assume \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n        with defined \n        show \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>Abrupt t\"\n          by  (auto intro: exec.Call)\n      qed\n    qed\n  }\n  then show ?thesis\n    apply -\n    apply (intro ballI allI)\n    apply (rule CallRec' [where Procs=\"dom \\<Gamma>\"  and \n      P=\"\\<lambda>p Z. {s. s=Z \\<and> \n                  \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"and\n      Q=\"\\<lambda>p Z. \n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t}\" and\n      A=\"\\<lambda>p Z. \n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"] )\n    apply simp+\n    done\nqed\n\ntheorem hoare_complete: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow> \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (iprover intro: MGT_implies_complete MGT_lemma [OF MGT_Calls])\n\nlemma hoare_complete': \n  assumes cvalid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (cases \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\")\n  case True\n  hence \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n    by (rule hoare_complete)\n  thus \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P c Q,A\"\n    by (rule hoare_augment_context) simp\nnext\n  case False\n  with cvalid\n  show ?thesis\n    by (rule ExFalso)\nqed\n  \n\nlemma hoare_strip_\\<Gamma>: \n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nproof (rule hoare_complete)\n  from hoare_sound [OF deriv] have \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n    by (simp add: cvalid_def)\n  from this F'\n  show \"strip F' \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n    by (rule valid_to_valid_strip)\nqed\n\n\nsubsection {* And Now: Some Useful Rules *}\n \nsubsubsection {* Consequence *}\n\n\nlemma LiberalConseq_sound:\nfixes F::\"'f set\" \nassumes cons: \"\\<forall>s \\<in> P. \\<forall>(t::('s,'f) xstate). \\<exists>P' Q' A'. (\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A') \\<and>\n                ((s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from P cons obtain P' Q' A' where\n      spec: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'\" and\n      adapt: \"(s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      apply -\n      apply (drule (1) bspec)\n      apply (erule_tac x=t in allE)\n      apply (elim exE conjE)\n      apply iprover\n      done\n    from exec spec ctxt t_notin_F\n    have \"s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A'\"\n      by (simp add: cnvalid_def nvalid_def)\n    with adapt show ?thesis\n      by simp\n  qed\nqed\n\nlemma LiberalConseq:\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<forall>(t::('s,'f) xstate). \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                ((s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule hoare_complete')\napply (rule allI)\napply (rule LiberalConseq_sound)\nusing cons\napply (clarify)\napply (drule (1) bspec)\napply (erule_tac x=t in allE)\napply clarify\napply (rule_tac x=P' in exI)\napply (rule_tac x=Q' in exI)\napply (rule_tac x=A' in exI)\napply (rule conjI)\napply (blast intro: hoare_cnvalid)\napply assumption\ndone\n\nlemma \"\\<forall>s \\<in> P. \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A \n           \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule LiberalConseq)\n  apply (rule ballI)\n  apply (drule (1) bspec)\n  apply clarify\n  apply (rule_tac x=P' in exI)\n  apply (rule_tac x=Q' in exI)\n  apply (rule_tac x=A' in exI)\n  apply auto\n  done\n\nlemma\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                (\\<forall>(t::('s,'f) xstate). (s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\n  apply (rule Conseq)\n  apply (rule ballI)\n  apply (insert cons)\n  apply (drule (1) bspec)\n  apply clarify\n  apply (rule_tac x=P' in exI)\n  apply (rule_tac x=Q' in exI)\n  apply (rule_tac x=A' in exI)\n  apply (rule conjI)\n  apply  assumption\n  (* no way to get s \\<in> P' *)\n  oops\n\nlemma LiberalConseq':\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                (\\<forall>(t::('s,'f) xstate). (s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule LiberalConseq)\napply (rule ballI)\napply (rule allI)\napply (insert cons)\napply (drule (1) bspec)\napply clarify\napply (rule_tac x=P' in exI)\napply (rule_tac x=Q' in exI)\napply (rule_tac x=A' in exI)\napply iprover\ndone\n\nlemma LiberalConseq'':\nfixes F:: \"'f set\"\nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s (t::('s,'f) xstate). \n                 (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in> Normal ` Q' Z \\<union> Abrupt ` A' Z)\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule LiberalConseq)\napply (rule ballI)\napply (rule allI)\napply (insert cons)\napply (erule_tac x=s in allE)\napply (erule_tac x=t in allE)\napply (case_tac \"t \\<in> Normal ` Q \\<union> Abrupt ` A\")\napply (insert spec)\napply  iprover\napply auto\ndone\n\nprimrec procs:: \"('s,'p,'f) com \\<Rightarrow> 'p set\"\nwhere\n\"procs Skip = {}\" |\n\"procs (Basic f) = {}\" |\n\"procs (Seq c\\<^sub>1 c\\<^sub>2)  = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\" |\n\"procs (Cond b c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\" |\n\"procs (While b c) = procs c\" |\n\"procs (Call p) = {p}\" |\n\"procs (DynCom c) = (\\<Union>s. procs (c s))\" |\n\"procs (Guard f g c) = procs c\" |\n\"procs Throw = {}\" |\n\"procs (Catch c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\"\n\nprimrec noSpec:: \"('s,'p,'f) com \\<Rightarrow> bool\"\nwhere\n\"noSpec Skip = True\" |\n\"noSpec (Basic f) = True\" |\n\"noSpec (Spec r) = False\" |\n\"noSpec (Seq c\\<^sub>1 c\\<^sub>2)  = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\" |\n\"noSpec (Cond b c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\" |\n\"noSpec (While b c) = noSpec c\" |\n\"noSpec (Call p) = True\" |\n\"noSpec (DynCom c) = (\\<forall>s. noSpec (c s))\" |\n\"noSpec (Guard f g c) = noSpec c\" |\n\"noSpec Throw = True\" |\n\"noSpec (Catch c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\"\n\nlemma exec_noSpec_no_Stuck:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes noSpec_c: \"noSpec c\"\n assumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\n assumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\n assumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\n assumes s_no_Stuck: \"s\\<noteq>Stuck\"\n shows \"t\\<noteq>Stuck\"\n  using exec noSpec_c procs_subset s_no_Stuck\n  proof (induct) \n    case (Call p bdy s t) with noSpec_\\<Gamma> procs_subset_\\<Gamma> show ?case \n      apply -\n      apply (drule bspec [where x=p])\n      apply  fastforce\n      apply (drule bspec [where x=p])\n      apply (auto)\n      done\n  qed fastforce+\n\nlemma execn_noSpec_no_Stuck:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes noSpec_c: \"noSpec c\"\n assumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\n assumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\n assumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\n assumes s_no_Stuck: \"s\\<noteq>Stuck\"\n shows \"t\\<noteq>Stuck\"\n  using exec noSpec_c procs_subset s_no_Stuck\n  proof (induct)\n     case (Call p bdy n s t) with noSpec_\\<Gamma> procs_subset_\\<Gamma> show ?case \n      apply -\n      apply (drule bspec [where x=p])\n      apply  fastforce\n      apply (drule bspec [where x=p])\n      apply (auto)\n      done\n  qed fastforce+\n\n\n\nlemma LiberalConseq_noguards_nothrows_sound:\nassumes spec: \"\\<forall>Z. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s t. (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in>  Q' Z )\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Q )\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from execn_noguards_no_Fault [OF exec noguards_c noguards_\\<Gamma>]\n     execn_nothrows_no_Abrupt [OF exec nothrows_c nothrows_\\<Gamma> ]\n     execn_noSpec_no_Stuck [OF exec  \n              noSpec_c  noSpec_\\<Gamma> procs_subset \n      procs_subset_\\<Gamma>]                            \n    obtain t' where t: \"t=Normal t'\"\n      by (cases t) auto\n    with exec spec ctxt\n    have \"(\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t' \\<in>  Q' Z)\"\n      by (unfold  cnvalid_def nvalid_def) blast\n    with cons P t show ?thesis\n      by simp\n  qed\nqed\n\n\nlemma LiberalConseq_noguards_nothrows:\nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s t. (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in>  Q' Z )\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Q )\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule hoare_complete')\napply (rule allI)\napply (rule LiberalConseq_noguards_nothrows_sound \n             [OF _ cons noguards_c noguards_\\<Gamma> nothrows_c nothrows_\\<Gamma> \n                 noSpec_c noSpec_\\<Gamma> \n                 procs_subset procs_subset_\\<Gamma>])\napply (insert spec)\napply (intro allI)\napply (erule_tac x=Z in allE)\nby (rule hoare_cnvalid)\n\nlemma \nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=fst Z \\<and> P s (snd Z)} c {t. Q (fst Z) (snd Z) t},{}\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=\\<sigma>} c {t. \\<forall>l. P \\<sigma> l \\<longrightarrow> Q \\<sigma> l t},{}\"\napply (rule allI)\napply (rule LiberalConseq_noguards_nothrows\n              [OF spec _ noguards_c noguards_\\<Gamma> nothrows_c nothrows_\\<Gamma>\n                  noSpec_c noSpec_\\<Gamma> \n                  procs_subset procs_subset_\\<Gamma>])\napply auto\ndone\n\nsubsubsection {* Modify Return *}\n\nlemma ProcModifyReturn_sound:\n  assumes valid_call: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n  assumes valid_modif: \n    \"\\<forall>\\<sigma>. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \n  assumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\n  assumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\n  shows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  then have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from exec\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.Call)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = \n      Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\"  .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\" \n      \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> p = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    then have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\n\nlemma ProcModifyReturn:\n  assumes spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n  assumes result_conform:\n      \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes return_conform:\n      \"\\<forall>s t. t \\<in> ModifAbr (init s) \n             \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes modifies_spec:  \n  \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule ProcModifyReturn_sound \n          [where Modif=Modif and ModifAbr=ModifAbr, \n            OF _ _ result_conform return_conform] )\nusing spec\napply (blast intro: hoare_cnvalid)\nusing modifies_spec\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma ProcModifyReturnSameFaults_sound:\n  assumes valid_call: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n  assumes valid_modif: \n    \"\\<forall>\\<sigma>. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \n  assumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\n  assumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\n  shows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from exec\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy \n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = \n      Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also \n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n \\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\"  and\n      t: \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    from cnvalidD [OF valid_call [rule_format] ctxt this P] t t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> p = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    then have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\n\nlemma ProcModifyReturnSameFaults:\n  assumes spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n  assumes result_conform:\n      \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes return_conform:\n  \"\\<forall>s t. t \\<in> ModifAbr (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes modifies_spec:  \n  \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule ProcModifyReturnSameFaults_sound \n          [where Modif=Modif and ModifAbr=ModifAbr, \n         OF _ _ result_conform return_conform])\nusing spec\napply (blast intro: hoare_cnvalid)\nusing modifies_spec\napply (blast intro: hoare_cnvalid)\ndone\n\nsubsubsection {* DynCall *}\n  \nlemma dynProcModifyReturn_sound:\nassumes valid_call: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  then have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  assume P: \"s \\<in> P\"\n  with valid_modif \n  have valid_modif': \"\\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n    by blast\n  from exec\n  have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by (cases rule: execn_dynCall_Normal_elim)\n  then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n\\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\" \n      \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> (p s) = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    hence \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma dynProcModifyReturn:\nassumes dyn_call: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nassumes modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>.  \n       \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule dynProcModifyReturn_sound [where Modif=Modif and ModifAbr=ModifAbr,\n          OF hoare_cnvalid [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_cnvalid [OF modif [rule_format]])\napply assumption\ndone\n\nlemma dynProcModifyReturnSameFaults_sound:\nassumes valid_call: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \\<longrightarrow> return' s t = return s t\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  assume P: \"s \\<in> P\"\n  with valid_modif \n  have valid_modif': \"\\<forall>\\<sigma>. \\<forall>n. \n    \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n    by blast\n  from exec\n  have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by (cases rule: execn_dynCall_Normal_elim)\n  then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n \\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.Call)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n \\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\"  and\n      t: \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this P] t t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> (p s) = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    hence \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma dynProcModifyReturnSameFaults:\nassumes dyn_call: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nassumes modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule dynProcModifyReturnSameFaults_sound \n        [where Modif=Modif and ModifAbr=ModifAbr,\n           OF hoare_cnvalid [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_cnvalid [OF modif [rule_format]])\napply assumption\ndone\n\n\nsubsubsection {* Conjunction of Postcondition *}\n\nlemma PostConjI_sound:\nassumes valid_Q: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\" \nassumes valid_R: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c R,B\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from valid_Q [rule_format] ctxt exec P t_notin_F have \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (rule cnvalidD)\n  moreover\n  from valid_R [rule_format] ctxt exec P t_notin_F have \"t \\<in> Normal ` R \\<union> Abrupt ` B\"\n    by (rule cnvalidD)\n  ultimately show \"t \\<in> Normal ` (Q \\<inter> R) \\<union> Abrupt ` (A \\<inter> B)\"\n    by blast\nqed\n\nlemma PostConjI: \n  assumes deriv_Q: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  assumes deriv_R: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c R,B\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule PostConjI_sound)\nusing deriv_Q\napply (blast intro: hoare_cnvalid)\nusing deriv_R\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma Merge_PostConj_sound: \n  assumes validF: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validG: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/G\\<^esub> P' c R,X\"\n  assumes F_G: \"F \\<subseteq> G\"\n  assumes P_P': \"P \\<subseteq> P'\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> X)\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  with F_G have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/G\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  with P_P' have P': \"s \\<in> P'\"\n    by auto\n  assume t_noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` (Q \\<inter> R) \\<union> Abrupt ` (A \\<inter> X)\"\n  proof -\n    from cnvalidD [OF validF [rule_format] ctxt exec P t_noFault]\n    have \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\n    moreover from this have \"t \\<notin> Fault ` G\"\n      by auto\n    from cnvalidD [OF validG [rule_format] ctxt' exec P' this]\n    have \"t \\<in> Normal ` R \\<union> Abrupt ` X\" .\n    ultimately show ?thesis by auto\n  qed\nqed\n\nlemma Merge_PostConj: \n  assumes validF: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validG: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/G\\<^esub> P' c R,X\"\n  assumes F_G: \"F \\<subseteq> G\"\n  assumes P_P': \"P \\<subseteq> P'\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> X)\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule Merge_PostConj_sound [OF _ _ F_G P_P'])\nusing validF apply (blast intro:hoare_cnvalid)\nusing validG apply (blast intro:hoare_cnvalid)\ndone\n\nsubsubsection {* Weaken Context *}\n\n\nlemma WeakenContext_sound:\n  assumes valid_c: \"\\<forall>n. \\<Gamma>,\\<Theta>'\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes valid_ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>'. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  with valid_ctxt\n  have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>'. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    by (simp add: cnvalid_def)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from valid_c [rule_format] ctxt' exec P t_notin_F\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (rule cnvalidD)\nqed\n\nlemma WeakenContext: \n  assumes deriv_c: \"\\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  assumes deriv_ctxt: \"\\<forall>(P,p,Q,A)\\<in>\\<Theta>'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule WeakenContext_sound)\nusing deriv_c\napply (blast intro: hoare_cnvalid)\nusing deriv_ctxt\napply (blast intro: hoare_cnvalid)\ndone\n\nsubsubsection {* Guards and Guarantees *}\n\nlemma SplitGuards_sound:\nassumes valid_c1: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\nassumes valid_c2: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\nassumes c: \"(c\\<^sub>1 \\<inter>\\<^sub>g c\\<^sub>2) = Some c\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case Normal\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    case Abrupt\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    case (Fault f)\n    with exec inter_guards_execn_Fault [OF c]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    then show ?thesis\n    proof (cases rule: disjE [consumes 1])\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      from Fault cnvalidD [OF valid_c1 [rule_format] ctxt this P] t_notin_F\n      show ?thesis\n        by blast\n    next\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      from Fault cnvalidD [OF valid_c2 [rule_format] ctxt this P] t_notin_F\n      show ?thesis\n        by blast\n    qed\n  next\n    case Stuck\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma SplitGuards: \n  assumes c: \"(c\\<^sub>1 \\<inter>\\<^sub>g c\\<^sub>2) = Some c\" \n  assumes deriv_c1: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\" \n  assumes deriv_c2: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule SplitGuards_sound [OF _ _ c])\nusing deriv_c1\napply (blast intro: hoare_cnvalid)\nusing deriv_c2\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma CombineStrip_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes valid_strip: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  hence ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case (Normal t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Normal \n    show ?thesis\n      by auto\n  next\n    case (Abrupt t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Abrupt \n    show ?thesis\n      by auto\n  next\n    case (Fault f)\n    show ?thesis\n    proof (cases \"f \\<in> F\")\n      case True\n      hence \"f \\<notin> -F\" by simp\n      with exec Fault\n      have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards (-F) c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" \n        by (auto intro: execn_to_execn_strip_guards_Fault)\n      from cnvalidD [OF valid_strip [rule_format] ctxt this P] Fault\n      have False\n        by auto\n      thus ?thesis ..\n    next\n      case False\n      with cnvalidD [OF valid [rule_format] ctxt' exec P] Fault\n      show ?thesis\n        by auto\n    qed\n  next\n    case Stuck\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Stuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma CombineStrip: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes deriv_strip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule CombineStrip_sound)\napply  (iprover intro: hoare_cnvalid [OF deriv])\napply (iprover intro: hoare_cnvalid [OF deriv_strip])\ndone\n\nlemma GuardsFlip_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validFlip: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  hence ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  from ctxt have ctxtFlip: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/-F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case (Normal t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Normal \n    show ?thesis\n      by auto\n  next\n    case (Abrupt t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Abrupt \n    show ?thesis\n      by auto\n  next\n    case (Fault f)\n    show ?thesis\n    proof (cases \"f \\<in> F\")\n      case True\n      hence \"f \\<notin> -F\" by simp\n      with cnvalidD [OF validFlip [rule_format] ctxtFlip exec P] Fault\n      have False\n        by auto\n      thus ?thesis ..\n    next\n      case False\n      with cnvalidD [OF valid [rule_format] ctxt' exec P] Fault\n      show ?thesis\n        by auto\n    qed\n  next\n    case Stuck\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Stuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma GuardsFlip: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes derivFlip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule GuardsFlip_sound)\napply  (iprover intro: hoare_cnvalid [OF deriv])\napply (iprover intro: hoare_cnvalid [OF derivFlip])\ndone\n\nlemma MarkGuardsI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_mark_guards_to_execn [OF exec] obtain t' where\n    exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n    t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n    by blast\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from cnvalidD [OF valid [rule_format] ctxt exec_c P]\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by blast\n    with t'_noFault\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma MarkGuardsI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"  \napply (rule hoare_complete')\napply (rule allI)\napply (rule MarkGuardsI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MarkGuardsD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"isFault t\")\n    case True\n    with execn_to_execn_mark_guards_Fault [OF exec ]\n    obtain f' where \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> Fault f'\"\n      by (fastforce elim: isFaultE)\n    from cnvalidD [OF valid [rule_format] ctxt this P]\n    have False\n      by auto\n    thus ?thesis ..\n  next\n    case False\n    from execn_to_execn_mark_guards [OF exec False]\n    obtain f' where \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    from cnvalidD [OF valid [rule_format] ctxt this P]\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma MarkGuardsD: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MarkGuardsD_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MergeGuardsI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  from execn_merge_guards_to_execn [OF exec_merge] \n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" .\n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec P t_notin_F]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma MergeGuardsI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MergeGuardsI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MergeGuardsD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_to_execn_merge_guards [OF exec] \n  have exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\".\n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_merge P t_notin_F]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\n\n\n\nlemma SubsetGuards_sound: \n  assumes c_c': \"c \\<subseteq>\\<^sub>g c'\"\n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c' Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_to_execn_subseteq_guards [OF c_c' exec] obtain t' where\n    exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n    t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n    by blast\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_c' P] t'_noFault t_noFault\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by auto\nqed\n\nlemma SubsetGuards: \n  assumes c_c': \"c \\<subseteq>\\<^sub>g c'\"\n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c' Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule SubsetGuards_sound [OF c_c'])\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma NormalizeD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  hence exec_norm: \"\\<Gamma>\\<turnstile>\\<langle>normalize c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    by (rule execn_to_execn_normalize)\n  assume P: \"s \\<in> P\" \n  assume noFault: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_norm P noFault]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma NormalizeD: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule NormalizeD_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma NormalizeI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume \"\\<Gamma>\\<turnstile>\\<langle>normalize c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  hence exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    by (rule execn_normalize_to_execn)\n  assume P: \"s \\<in> P\" \n  assume noFault: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec P noFault]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma NormalizeI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule NormalizeI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\n\nsubsubsection {* Restricting the Procedure Environment *}\n\nlemma nvalid_restrict_to_nvalid:\nassumes valid_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from execn_to_execn_restrict [OF exec]\n    obtain t' where\n      exec_res: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n      t_Fault: \"\\<forall>f. t = Fault f \\<longrightarrow> t' \\<in> {Fault f, Stuck}\" and\n      t'_notStuck: \"t'\\<noteq>Stuck \\<longrightarrow> t'=t\"\n      by blast\n    from t_Fault t_notin_F t'_notStuck have \"t' \\<notin> Fault ` F\"\n      by (cases t') auto\n    with valid_c exec_res P \n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: nvalid_def)\n    with t'_notStuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma valid_restrict_to_valid:\nassumes valid_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from exec_to_exec_restrict [OF exec]\n    obtain t' where\n      exec_res: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t'\" and\n      t_Fault: \"\\<forall>f. t = Fault f \\<longrightarrow> t' \\<in> {Fault f, Stuck}\" and\n      t'_notStuck: \"t'\\<noteq>Stuck \\<longrightarrow> t'=t\"\n      by blast\n    from t_Fault t_notin_F t'_notStuck have \"t' \\<notin> Fault ` F\"\n      by (cases t') auto\n    with valid_c exec_res P\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: valid_def)\n    with t'_notStuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma augment_procs:\nassumes deriv_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule hoare_complete)\n  apply (rule valid_restrict_to_valid)\n  apply (insert hoare_sound [OF deriv_c])\n  by (simp add: cvalid_def)\n\nlemma augment_Faults:\nassumes deriv_c: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes F: \"F \\<subseteq> F'\"\nshows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F'\\<^esub> P c Q,A\"\n  apply (rule hoare_complete)\n  apply (rule valid_augment_Faults [OF _ F])\n  apply (insert hoare_sound [OF deriv_c])\n  by (simp add: cvalid_def)\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Simpl/HoarePartialProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.32987802343849515}}
{"text": "(*  Title:       Permute\n    Authors:     Jasmin Blanchette, Andrei Popescu, Dmitriy Traytel\n    Maintainer:  Dmitriy Traytel <traytel at inf.ethz.ch>\n*)\n\nsection \\<open>Changing the Order of Live Variables\\<close>\n\n(*<*)\ntheory Permute\n  imports \"HOL-Library.BNF_Axiomatization\"\nbegin\n(*>*)\n\nunbundle cardinal_syntax\n\ndeclare [[bnf_internals]]\nbnf_axiomatization (dead 'p, Fset1: 'a1, Fset2: 'a2, Fset3: 'a3) F for map: Fmap rel: Frel\ntype_synonym ('p, 'a1, 'a2, 'a3) F' = \"('p, 'a3, 'a1, 'a2) F\"\n\nabbreviation Fin :: \"'a1 set \\<Rightarrow> 'a2 set \\<Rightarrow> 'a3 set \\<Rightarrow> (('p, 'a1, 'a2, 'a3) F) set\" where\n  \"Fin A1 A2 A3 \\<equiv> {x. Fset1 x \\<subseteq> A1 \\<and> Fset2 x \\<subseteq> A2 \\<and> Fset3 x \\<subseteq> A3}\"\n\nabbreviation F'map :: \"('a1 \\<Rightarrow> 'b1) \\<Rightarrow> ('a2 \\<Rightarrow> 'b2) \\<Rightarrow> ('a3 \\<Rightarrow> 'b3) \\<Rightarrow> ('p, 'a1, 'a2, 'a3) F' \\<Rightarrow> ('p, 'b1, 'b2, 'b3) F'\" where\n  \"F'map f g h \\<equiv> Fmap h f g\"\n\nabbreviation F'set1 :: \"('p, 'a1, 'a2, 'a3) F' \\<Rightarrow> 'a1 set\" where\n  \"F'set1 \\<equiv> Fset2\"\n\nabbreviation F'set2 :: \"('p, 'a1, 'a2, 'a3) F' \\<Rightarrow> 'a2 set\" where\n  \"F'set2 \\<equiv> Fset3\"\n\nabbreviation F'set3 :: \"('p, 'a1, 'a2, 'a3) F' \\<Rightarrow> 'a3 set\" where\n  \"F'set3 \\<equiv> Fset1\"\n\nabbreviation F'bd where\n  \"F'bd \\<equiv> bd_F\"\n\ntheorem F'map_id: \"F'map id id id = id\"\n  by (rule F.map_id0)\n\ntheorem F'map_comp: \"F'map (f1 o g1) (f2 o g2) (f3 o g3) = F'map f1 f2 f3 o F'map g1 g2 g3\"\n  by (rule F.map_comp0)\n\ntheorem F'map_cong: \"\\<lbrakk>\\<And>z. z \\<in> F'set1 x \\<Longrightarrow> f1 z = g1 z; \\<And>z. z \\<in> F'set2 x \\<Longrightarrow> f2 z = g2 z; \\<And>z. z \\<in> F'set3 x \\<Longrightarrow> f3 z = g3 z\\<rbrakk>\n  \\<Longrightarrow> F'map f1 f2 f3 x = F'map g1 g2 g3 x\"\n  apply (rule F.map_cong0)\n    apply assumption+\n  done\n\ntheorem F'set1_natural: \"F'set1 o F'map f1 f2 f3 = image f1 o F'set1\"\n  by (rule F.set_map0(2))\n\ntheorem F'set2_natural: \"F'set2 o F'map f1 f2 f3 = image f2 o F'set2\"\n  by (rule F.set_map0(3))\n\ntheorem F'set3_natural: \"F'set3 o F'map f1 f2 f3 = image f3 o F'set3\"\n  by (rule F.set_map0(1))\n\ntheorem F'bd_card_order: \"card_order F'bd\"\n  by (rule F.bd_card_order)\n\ntheorem F'bd_cinfinite: \"cinfinite F'bd\"\n  by (rule F.bd_cinfinite)\n\ntheorem F'set1_bd: \"|F'set1 (x :: ('c, 'a, 'b, 'd) F)| \\<le>o (F'bd :: 'c bd_type_F rel)\"\n  by (rule F.set_bd(2))\n\n\n\ntheorem F'set3_bd: \"|F'set3 (x :: ('c, 'a, 'b, 'd) F)| \\<le>o (F'bd :: 'c bd_type_F rel)\"\n  by (rule F.set_bd(1))\n\nabbreviation F'in :: \"'a1 set \\<Rightarrow> 'a2 set \\<Rightarrow> 'a3 set \\<Rightarrow> (('p, 'a1, 'a2, 'a3) F') set\" where\n  \"F'in A1 A2 A3 \\<equiv> {x. F'set1 x \\<subseteq> A1 \\<and> F'set2 x \\<subseteq> A2 \\<and> F'set3 x \\<subseteq> A3}\"\n\nlemma F'in_alt: \"F'in A1 A2 A3 = Fin A3 A1 A2\"\n  apply (rule Collect_cong)\n  by (tactic \\<open>BNF_Tactics.mk_rotate_eq_tac @{context}\n  (BNF_Util.rtac @{context} @{thm refl}) @{thm trans} @{thm conj_assoc} @{thm conj_commute} @{thm conj_cong}\n  [1, 2, 3] [3, 1, 2] 1\\<close>)\n\ndefinition F'rel where\n  \"F'rel R1 R2 R3 = (BNF_Def.Grp (F'in (Collect (case_prod R1)) (Collect (case_prod R2)) (Collect (case_prod R3))) (F'map fst fst fst))^--1 OO\n                 (BNF_Def.Grp (F'in (Collect (case_prod R1)) (Collect (case_prod R2)) (Collect (case_prod R3))) (F'map snd snd snd))\"\n\n\nlemmas F'rel_unfold = trans[OF F'rel_def trans[OF OO_Grp_cong[OF F'in_alt] sym[OF F.rel_compp_Grp]]]\n\nbnf F': \"('p, 'a1, 'a2, 'a3) F'\"\n  map: F'map\n  sets: F'set1 F'set2 F'set3\n  bd: \"F'bd :: 'p bd_type_F rel\"\n  rel: F'rel\n              apply -\n              apply (rule F'map_id)\n             apply (rule F'map_comp)\n            apply (erule F'map_cong) apply assumption+\n           apply (rule F'set1_natural)\n          apply (rule F'set2_natural)\n         apply (rule F'set3_natural)\n        apply (rule F'bd_card_order)\n       apply (rule F'bd_cinfinite)\n      apply (rule F'set1_bd)\n     apply (rule F'set2_bd)\n    apply (rule F'set3_bd)\n   apply (unfold F'rel_unfold F.rel_compp[symmetric] eq_OO) [1] apply (rule order_refl)\n  apply (rule F'rel_def[unfolded OO_Grp_alt mem_Collect_eq])\n  done\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BNF_Operations/Permute.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631556226292, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.32987801572426545}}
{"text": "subsection \\<open>MulNode Phase\\<close>\n\ntheory MulPhase\n  imports\n    Common\n    Proofs.StampEvalThms\nbegin\n\nfun mul_size :: \"IRExpr \\<Rightarrow> nat\" where\n  \"mul_size (UnaryExpr op e) = (mul_size e) + 2\" |\n  \"mul_size (BinaryExpr BinMul x y) = ((mul_size x) + (mul_size y) + 2) * 2\" |\n  \"mul_size (BinaryExpr op x y) = (mul_size x) + (mul_size y) + 2\" |\n  \"mul_size (ConditionalExpr cond t f) = (mul_size cond) + (mul_size t) + (mul_size f) + 2\" |\n  \"mul_size (ConstantExpr c) = 1\" |\n  \"mul_size (ParameterExpr ind s) = 2\" |\n  \"mul_size (LeafExpr nid s) = 2\" |\n  \"mul_size (ConstantVar c) = 2\" |\n  \"mul_size (VariableExpr x s) = 2\"\n\nphase MulNode\n  terminating mul_size\nbegin\n\n(* Word level proofs *)\nlemma bin_eliminate_redundant_negative:\n  \"uminus (x :: 'a::len word) * uminus (y :: 'a::len word) = x * y\"\n  by simp\n\nlemma bin_multiply_identity:\n \"(x :: 'a::len word) * 1 = x\"\n  by simp\n\nlemma bin_multiply_eliminate:\n \"(x :: 'a::len word) * 0 = 0\"\n  by simp\n\nlemma bin_multiply_negative:\n \"(x :: 'a::len word) * uminus 1 = uminus x\"\n  by simp\n\nlemma bin_multiply_power_2:\n \"(x:: 'a::len word) * (2^j) = x << j\"\n  by simp\n\n(* Helper *)\nlemma take_bit64[simp]: \n  fixes w :: \"int64\"\n  shows \"take_bit 64 w = w\"\nproof -\n  have \"Nat.size w = 64\"\n    by (simp add: size64)\n  then show ?thesis\n    by (metis lt2p_lem mask_eq_iff take_bit_eq_mask verit_comp_simplify1(2) wsst_TYs(3))\nqed\n\n\n(* TODO: merge this with val_eliminate_redundant_negative *)\nlemma mergeTakeBit:\n  fixes a :: \"nat\"\n  fixes b c :: \"64 word\"\n  shows \"take_bit a (take_bit a (b) * take_bit a (c)) = \n         take_bit a (b * c)\" \n by (smt (verit, ccfv_SIG) take_bit_mult take_bit_of_int unsigned_take_bit_eq word_mult_def)\n\n\n(* Value level proofs *)\nlemma val_eliminate_redundant_negative:\n  assumes \"val[-x * -y] \\<noteq> UndefVal\"\n  shows \"val[-x * -y] = val[x * y]\"\n  using assms apply (cases x; cases y; auto)\n  using mergeTakeBit by auto\n\nlemma val_multiply_neutral:\n  assumes \"x = new_int b v\"\n  shows \"val[x * (IntVal b 1)] = val[x]\"\n  using assms by force\n\nlemma val_multiply_zero:\n  assumes \"x = new_int b v\"\n  shows \"val[x * (IntVal b 0)] = IntVal b 0\"\n  using assms by simp\n\nlemma val_multiply_negative:\n  assumes \"x = new_int b v\"\n  shows \"val[x * intval_negate (IntVal b 1)] = intval_negate x\" \n  by (smt (verit) Value.disc(1) Value.inject(1) add.inverse_neutral intval_negate.simps(1) \n      is_IntVal_def mask_0 mask_eq_take_bit_minus_one new_int.elims of_bool_eq(2) take_bit_dist_neg \n      take_bit_of_1 val_eliminate_redundant_negative val_multiply_neutral val_multiply_zero \n      verit_minus_simplify(4) zero_neq_one assms)\n\n(* x * 2^i = x << i*)\nlemma val_MulPower2:\n  fixes i :: \"64 word\"\n  assumes \"y = IntVal 64 (2 ^ unat(i))\"\n  and     \"0 < i\"\n  and     \"i < 64\"\n  and     \"val[x * y] \\<noteq> UndefVal\"\n  shows   \"val[x * y] = val[x << IntVal 64 i]\"\n  using assms apply (cases x; cases y; auto)\n    subgoal premises p for x2\n    proof -\n      have 63: \"(63 :: int64) = mask 6\"\n        by eval\n      then have \"(2::int) ^ 6 = 64\"\n        by eval\n      then have \"uint i < (2::int) ^ 6\"\n        by (metis linorder_not_less lt2p_lem of_int_numeral p(4) size64 word_2p_lem word_of_int_2p \n            wsst_TYs(3))\n      then have \"and i (mask 6) = i\"\n        using mask_eq_iff by blast\n      then show \"x2 << unat i = x2 << unat (and i (63::64 word))\"\n        unfolding 63\n        by force\n    qed\n    by presburger\n\n(*  x * ((2 ^ j) + 1) = (x << j) + x  *)\nlemma val_MulPower2Add1:\n  fixes i :: \"64 word\"\n  assumes \"y = IntVal 64 ((2 ^ unat(i)) + 1)\"\n  and     \"0 < i\"\n  and     \"i < 64\"\n  and     \"val_to_bool(val[IntVal 64 0 < x])\"\n  and     \"val_to_bool(val[IntVal 64 0 < y])\"\n  shows   \"val[x * y] = val[(x << IntVal 64 i) + x]\"\n  using assms apply (cases x; cases y; auto)\n    subgoal premises p for x2\n  proof -\n    have 63: \"(63 :: int64) = mask 6\"\n      by eval\n    then have \"(2::int) ^ 6 = 64\"\n      by eval\n    then have \"and i (mask 6) = i\"\n      using mask_eq_iff by (simp add: less_mask_eq p(6))\n    then have \"x2 * ((2::64 word) ^ unat i + (1::64 word)) = (x2 * ((2::64 word) ^ unat i)) + x2\"\n      by (simp add: distrib_left)\n    then show \"x2 * ((2::64 word) ^ unat i + (1::64 word)) = x2 << unat (and i (63::64 word)) + x2\"\n      by (simp add: \"63\" \\<open>and (i::64 word) (mask (6::nat)) = i\\<close>)\n    qed \n    using val_to_bool.simps(2) by presburger\n\n\n(*  x * ((2 ^ j) - 1) = (x << j) - x  *)\nlemma val_MulPower2Sub1:\n  fixes i :: \"64 word\"\n  assumes \"y = IntVal 64 ((2 ^ unat(i)) - 1)\"\n  and     \"0 < i\"\n  and     \"i < 64\"\n  and     \"val_to_bool(val[IntVal 64 0 < x])\"\n  and     \"val_to_bool(val[IntVal 64 0 < y])\"\n  shows   \"val[x * y] = val[(x << IntVal 64 i) - x]\"\n  using assms apply (cases x; cases y; auto)\n    subgoal premises p for x2\n  proof -\n    have 63: \"(63 :: int64) = mask 6\"\n      by eval\n    then have \"(2::int) ^ 6 = 64\"\n      by eval\n    then have \"and i (mask 6) = i\"\n      using mask_eq_iff by (simp add: less_mask_eq p(6))\n    then have \"x2 * ((2::64 word) ^ unat i - (1::64 word)) = (x2 * ((2::64 word) ^ unat i)) - x2\"\n      by (simp add: right_diff_distrib')\n    then show \"x2 * ((2::64 word) ^ unat i - (1::64 word)) = x2 << unat (and i (63::64 word)) - x2\"\n      by (simp add: \"63\" \\<open>and (i::64 word) (mask (6::nat)) = i\\<close>)\n    qed \n    using val_to_bool.simps(2) by presburger\n\n(* Value level helpers *)\nlemma val_distribute_multiplication:\n  assumes \"x = new_int 64 xx \\<and> q = new_int 64 qq \\<and> a = new_int 64 aa\"\n  shows \"val[x * (q + a)] = val[(x * q) + (x * a)]\"\n  apply (cases x; cases q; cases a; auto) using distrib_left assms by auto\n\n(*  x * ((2 ^ j) + (2 ^ k)) = (x << j) + (x << k)  *)\nlemma val_MulPower2AddPower2:\n  fixes i j :: \"64 word\"\n  assumes \"y = IntVal 64 ((2 ^ unat(i)) + (2 ^ unat(j)))\"\n  and     \"0 < i\"\n  and     \"0 < j\"\n  and     \"i < 64\"\n  and     \"j < 64\"\n  and     \"x = new_int 64 xx\"\n  shows   \"val[x * y] = val[(x << IntVal 64 i) + (x << IntVal 64 j)]\"\n  using assms\n  proof -\n    have 63: \"(63 :: int64) = mask 6\"\n      by eval\n    then have \"(2::int) ^ 6 = 64\"\n      by eval\n    then have n: \"IntVal 64 ((2 ^ unat(i)) + (2 ^ unat(j))) = \n           val[(IntVal 64 (2 ^ unat(i))) + (IntVal 64 (2 ^ unat(j)))]\"\n       (* x * (2^i + 2^j)*)\n      using assms by (cases i; cases j; auto) \n   then have 1: \"val[x * ((IntVal 64 (2 ^ unat(i))) + (IntVal 64 (2 ^ unat(j))))] = \n           val[(x * IntVal 64 (2 ^ unat(i))) + (x * IntVal 64 (2 ^ unat(j)))]\"\n      (* (x * 2^i) + (x * 2^j)*)\n     using assms val_distribute_multiplication val_MulPower2 by simp \n   then have 2: \"val[(x * IntVal 64 (2 ^ unat(i)))] = val[x << IntVal 64 i]\"\n     by (smt (verit) Value.distinct(1) intval_mul.simps(1) new_int.simps new_int_bin.simps assms \n         val_MulPower2)\n   then show \"?thesis\" \n     by (smt (verit, del_insts) \"1\" Value.distinct(1) assms(1) assms(3) assms(5) assms(6) \n         intval_mul.simps(1) n new_int.simps new_int_bin.elims val_MulPower2)\n   qed\n\nthm_oracles val_MulPower2AddPower2\n\n(* Exp-level proofs *)\nlemma exp_multiply_zero_64:\n \"exp[x * (const (IntVal 64 0))] \\<ge> ConstantExpr (IntVal 64 0)\"\n  using val_multiply_zero apply auto \n  by (smt (verit) Value.inject(1) constantAsStamp.simps(1) int_signed_value_bounds intval_mul.elims \n        mult_zero_right new_int.simps new_int_bin.simps nle_le numeral_eq_Suc take_bit_of_0 \n        unfold_const valid_stamp.simps(1) valid_value.simps(1) zero_less_Suc wf_value_def)\n\nlemma exp_multiply_neutral:\n \"exp[x * (const (IntVal b 1))] \\<ge> x\"\n  using val_multiply_neutral apply auto\n  by (smt (verit) Value.inject(1) eval_unused_bits_zero intval_mul.elims mult.right_neutral \n      new_int.elims new_int_bin.elims)\n\nthm_oracles exp_multiply_neutral\n\nlemma exp_MulPower2:\n  fixes i :: \"64 word\"\n  assumes \"y = ConstantExpr (IntVal 64 (2 ^ unat(i)))\"\n  and     \"0 < i\"\n  and     \"i < 64\"\n  and     \"exp[x > (const IntVal b 0)]\"\n  and     \"exp[y > (const IntVal b 0)]\"\n  shows \"exp[x * y] \\<ge> exp[x << ConstantExpr (IntVal 64 i)]\"\n   using assms apply simp\n  by (metis ConstantExprE equiv_exprs_def unfold_binary)\n\nlemma exp_MulPower2Add1:\n  fixes i :: \"64 word\"\n  assumes \"y = ConstantExpr (IntVal 64 ((2 ^ unat(i)) + 1))\"\n  and     \"0 < i\"\n  and     \"i < 64\"\n  and     \"exp[x > (const IntVal b 0)]\"\n  and     \"exp[y > (const IntVal b 0)]\"\nshows   \"exp[x * y] \\<ge> exp[(x << ConstantExpr (IntVal 64 i)) + x]\"\n   using assms apply simp  \n  by (metis (no_types, lifting) ConstantExprE equiv_exprs_def unfold_binary)\n\nlemma exp_MulPower2Sub1:\n  fixes i :: \"64 word\"\n  assumes \"y = ConstantExpr (IntVal 64 ((2 ^ unat(i)) - 1))\"\n  and     \"0 < i\"\n  and     \"i < 64\"\n  and     \"exp[x > (const IntVal b 0)]\"\n  and     \"exp[y > (const IntVal b 0)]\"\nshows   \"exp[x * y] \\<ge> exp[(x << ConstantExpr (IntVal 64 i)) - x]\"\n   using assms apply simp  \n  by (metis (no_types, lifting) ConstantExprE equiv_exprs_def unfold_binary)\n\nlemma exp_MulPower2AddPower2:\n  fixes i j :: \"64 word\"\n  assumes \"y = ConstantExpr (IntVal 64 ((2 ^ unat(i)) + (2 ^ unat(j))))\"\n  and     \"0 < i\"\n  and     \"0 < j\"\n  and     \"i < 64\"\n  and     \"j < 64\"\n  and     \"exp[x > (const IntVal b 0)]\"\n  and     \"exp[y > (const IntVal b 0)]\"\nshows   \"exp[x * y] \\<ge> exp[(x << ConstantExpr (IntVal 64 i)) + (x << ConstantExpr (IntVal 64 j))]\"\n   using assms apply simp  \n  by (metis (no_types, lifting) ConstantExprE equiv_exprs_def unfold_binary)\n\n(* Exp level helpers *)\n\n(* Subgoal is false *)\nlemma greaterConstant:\n  fixes a b :: \"64 word\"\n  assumes \"a > b\"\n  and     \"y = ConstantExpr (IntVal 64 a)\"\n  and     \"x = ConstantExpr (IntVal 64 b)\"\n  shows \"exp[y > x]\"\n  apply auto\n  sorry\n\nlemma exp_distribute_multiplication:\n  shows \"exp[(x * q) + (x * a)] \\<ge> exp[x * (q + a)]\"\n  sorry\n\ntext \\<open>Optimisations\\<close>\n\noptimization EliminateRedundantNegative: \"-x * -y \\<longmapsto> x * y\"\n  using mul_size.simps apply auto\n  by (metis BinaryExpr val_eliminate_redundant_negative bin_eval.simps(2))\n\noptimization MulNeutral: \"x * ConstantExpr (IntVal b 1) \\<longmapsto> x\"\n  using exp_multiply_neutral by blast\n\noptimization MulEliminator: \"x * ConstantExpr (IntVal b 0) \\<longmapsto> const (IntVal b 0)\"\n   apply auto \n  by (smt (verit) Value.inject(1) constantAsStamp.simps(1) int_signed_value_bounds intval_mul.elims \n      mult_zero_right new_int.simps new_int_bin.simps take_bit_of_0 unfold_const \n      valid_stamp.simps(1) valid_value.simps(1) val_multiply_zero)\n\noptimization MulNegate: \"x * -(const (IntVal b 1)) \\<longmapsto> -x\"\n  apply auto \n  by (smt (verit) Value.distinct(1) Value.sel(1) add.inverse_inverse intval_mul.elims \n      intval_negate.simps(1) mask_eq_take_bit_minus_one new_int.simps new_int_bin.simps \n      take_bit_dist_neg unary_eval.simps(2) unfold_unary val_multiply_negative\n      val_eliminate_redundant_negative val_multiply_negative wf_value_def)\n\nfun isNonZero :: \"Stamp \\<Rightarrow> bool\" where\n  \"isNonZero (IntegerStamp b lo hi) = (lo > 0)\" |\n  \"isNonZero _ = False\"\n\nlemma isNonZero_defn:\n  assumes \"isNonZero (stamp_expr x)\"\n  assumes \"wf_stamp x\"\n  shows \"([m, p] \\<turnstile> x \\<mapsto> v) \\<longrightarrow> (\\<exists>vv b. (v = IntVal b vv \\<and> val_to_bool val[(IntVal b 0) < v]))\"\n  apply (rule impI) subgoal premises eval\nproof -\n  obtain b lo hi where xstamp: \"stamp_expr x = IntegerStamp b lo hi\"\n    by (meson isNonZero.elims(2) assms)\n  then obtain vv where vdef: \"v = IntVal b vv\"\n    by (metis assms(2) eval valid_int wf_stamp_def)\n  have \"lo > 0\"\n    using assms(1) xstamp by force\n  then have signed_above: \"int_signed_value b vv > 0\"\n    using assms unfolding wf_stamp_def\n    using eval vdef xstamp by fastforce\n  have \"take_bit b vv = vv\"\n    using eval eval_unused_bits_zero vdef by auto\n  then have \"vv > 0\"\n    by (metis bit_take_bit_iff int_signed_value.simps not_less_zero signed_eq_0_iff \n        signed_take_bit_eq_if_positive take_bit_0 take_bit_of_0 verit_comp_simplify1(1) word_gt_0 \n        signed_above)\n  then show ?thesis\n    using vdef signed_above\n    by simp\nqed\n  done\n\noptimization MulPower2: \"x * y \\<longmapsto> x << const (IntVal 64 i) \n                              when (i > 0 \\<and> \n                                    64 > i \\<and>\n                                    y = exp[const (IntVal 64 (2 ^ unat(i)))])\"\n   defer\n   apply simp apply (rule impI; (rule allI)+; rule impI)\n  subgoal premises eval for m p v\nproof -\n  obtain xv where xv: \"[m, p] \\<turnstile> x \\<mapsto> xv\"\n    using eval(2) by blast\n  then obtain xvv where xvv: \"xv = IntVal 64 xvv\"\n    by (smt (verit) ConstantExprE bin_eval.simps(2) evalDet intval_bits.simps intval_mul.elims \n          new_int_bin.simps unfold_binary eval)\n  obtain yv where yv: \"[m, p] \\<turnstile> y \\<mapsto> yv\"\n    using eval(1) eval(2) by blast\n  then have lhs: \"[m, p] \\<turnstile> exp[x * y] \\<mapsto> val[xv * yv]\"\n    by (metis bin_eval.simps(2) eval(1) eval(2) evalDet unfold_binary xv)\n  have \"[m, p] \\<turnstile> exp[const (IntVal 64 i)] \\<mapsto> val[(IntVal 64 i)]\"\n    by (smt (verit, ccfv_SIG) ConstantExpr constantAsStamp.simps(1) eval_bits_1_64 take_bit64 \n        validStampIntConst wf_value_def valid_value.simps(1) xv xvv)\n  then have rhs: \"[m, p] \\<turnstile> exp[x << const (IntVal 64 i)] \\<mapsto> val[xv << (IntVal 64 i)]\"\n    using xv xvv using evaltree.BinaryExpr\n    by (metis Value.simps(5) bin_eval.simps(8) intval_left_shift.simps(1) new_int.simps)\n  have \"val[xv * yv] = val[xv << (IntVal 64 i)]\"\n    by (metis ConstantExprE eval(1) evaltree_not_undef lhs yv val_MulPower2)\n  then show ?thesis\n    by (metis eval(1) eval(2) evalDet lhs rhs)\nqed\n  done\n\n\noptimization MulPower2Add1: \"x * y \\<longmapsto> (x << const (IntVal 64 i)) + x \n                              when (i > 0 \\<and>  \n                                    64 > i \\<and>\n                                    y = ConstantExpr (IntVal 64 ((2 ^ unat(i)) + 1)) )\"\n   defer\n   apply simp apply (rule impI; (rule allI)+; rule impI)\n  subgoal premises p for m p v\n  proof -\n    obtain xv where xv: \"[m, p] \\<turnstile> x \\<mapsto> xv\"\n      using p by fast\n    then obtain xvv where xvv: \"xv = IntVal 64 xvv\"\n      by (smt (verit) p ConstantExprE bin_eval.simps(2) evalDet intval_bits.simps intval_mul.elims \n          new_int_bin.simps unfold_binary)\n    obtain yv where yv: \"[m, p] \\<turnstile> y \\<mapsto> yv\"\n      using p  by blast\n    have ygezero: \"y > ConstantExpr (IntVal 64 0)\"\n      using greaterConstant p wf_value_def by fastforce \n    then have 1: \"0 < i \\<and>\n                  i < 64 \\<and> \n                  y = ConstantExpr (IntVal 64 ((2 ^ unat(i)) + 1))\"\n      using p by blast\n    then have lhs: \"[m, p] \\<turnstile> exp[x * y] \\<mapsto> val[xv * yv]\"\n      by (metis bin_eval.simps(2) evalDet p(1) p(2) xv yv unfold_binary)\n    then have \"[m, p] \\<turnstile> exp[const (IntVal 64 i)] \\<mapsto> val[(IntVal 64 i)]\"\n      by (metis wf_value_def verit_comp_simplify1(2) zero_less_numeral ConstantExpr \n          constantAsStamp.simps(1) take_bit64 validStampIntConst valid_value.simps(1))\n    then have rhs2: \"[m, p] \\<turnstile> exp[x << const (IntVal 64 i)] \\<mapsto> val[xv << (IntVal 64 i)]\"\n      by (metis Value.simps(5) bin_eval.simps(8) intval_left_shift.simps(1) new_int.simps xv xvv \n          evaltree.BinaryExpr)\n    then have rhs: \"[m, p] \\<turnstile> exp[(x << const (IntVal 64 i)) + x] \\<mapsto> val[(xv << (IntVal 64 i)) + xv]\" \n       by (metis (no_types, lifting) intval_add.simps(1) rhs2 bin_eval.simps(1) Value.simps(5) \n           evaltree.BinaryExpr intval_left_shift.simps(1) new_int.simps xv xvv)\n     then have simple: \"val[xv * (IntVal 64 (2 ^ unat(i)))] = val[xv << (IntVal 64 i)]\"\n       using val_MulPower2  sorry\n     then have \"val[xv * yv] = val[(xv << (IntVal 64 i)) + xv]\"\n        sorry\n     then show ?thesis\n       by (metis \"1\" evalDet lhs p(2) rhs)\n  qed\n  done\n\n(* Need to prove exp_MulPower2Sub1 *)\noptimization MulPower2Sub1: \"x * y \\<longmapsto> (x << const (IntVal 64 i)) - x \n                              when (i > 0 \\<and>  \n                                    64 > i \\<and>\n                                    y = ConstantExpr (IntVal 64 ((2 ^ unat(i)) - 1)) )\"\n   defer\n   apply simp apply (rule impI; (rule allI)+; rule impI)\n  subgoal premises p for m p v\n  proof -\n    obtain xv where xv: \"[m,p] \\<turnstile> x \\<mapsto> xv\"\n      using p by fast\n    then obtain xvv where xvv: \"xv = IntVal 64 xvv\"\n      by (smt (verit) p ConstantExprE bin_eval.simps(2) evalDet intval_bits.simps intval_mul.elims \n          new_int_bin.simps unfold_binary)\n    obtain yv where yv: \"[m,p] \\<turnstile> y \\<mapsto> yv\"\n      using p  by blast\n    have ygezero: \"y > ConstantExpr (IntVal 64 0)\"\n      by (smt (verit, del_insts) eq_iff_diff_eq_0 mask_0 mask_eq_exp_minus_1 power_inject_exp \n          uint_2p unat_eq_zero word_gt_0 zero_neq_one greaterConstant p) \n    then have 1: \"0 < i \\<and>\n                  i < 64 \\<and> \n                  y = ConstantExpr (IntVal 64 ((2 ^ unat(i)) - 1))\"\n      using p by blast\n    then have lhs: \"[m, p] \\<turnstile> exp[x * y] \\<mapsto> val[xv * yv]\"\n      by (metis bin_eval.simps(2) evalDet p(1) p(2) xv yv unfold_binary)\n    then have \"[m, p] \\<turnstile> exp[const (IntVal 64 i)] \\<mapsto> val[(IntVal 64 i)]\"\n      by (metis wf_value_def verit_comp_simplify1(2) zero_less_numeral ConstantExpr \n          constantAsStamp.simps(1) take_bit64 validStampIntConst valid_value.simps(1))\n    then have rhs2: \"[m, p] \\<turnstile> exp[x << const (IntVal 64 i)] \\<mapsto> val[xv << (IntVal 64 i)]\"\n      by (metis Value.simps(5) bin_eval.simps(8) intval_left_shift.simps(1) new_int.simps xv xvv \n          evaltree.BinaryExpr)\n    then have rhs: \"[m, p] \\<turnstile> exp[(x << const (IntVal 64 i)) - x] \\<mapsto> val[(xv << (IntVal 64 i)) - xv]\" \n      by (smt (verit, ccfv_threshold) bin_eval.simps(3) new_int_bin.simps intval_sub.simps(1) \n          rhs2 bin_eval.simps(1) Value.simps(5) evaltree.BinaryExpr intval_left_shift.simps(1) \n          new_int.simps xv xvv )\n    then have \"val[xv * yv] = val[(xv << (IntVal 64 i)) - xv]\"\n       using \"1\" exp_MulPower2Sub1 ygezero sorry \n     then show ?thesis\n      by (metis evalDet lhs p(1) p(2) rhs)\n  qed\ndone\n\n\nend (* End of MulPhase *)\n\nend (* End of file *)\n", "meta": {"author": "uqcyber", "repo": "veriopt-releases", "sha": "4ffab3c91bbd699772889dbf263bb6d2582256d7", "save_path": "github-repos/isabelle/uqcyber-veriopt-releases", "path": "github-repos/isabelle/uqcyber-veriopt-releases/veriopt-releases-4ffab3c91bbd699772889dbf263bb6d2582256d7/Optimizations/Canonicalizations/MulPhase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3298780157242654}}
{"text": "(*  Title:      HOL/Auth/n_mutualExSimp_lemma_inv__2_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExSimp Protocol Case Study*} \n\ntheory n_mutualExSimp_lemma_inv__2_on_rules imports n_mutualExSimp_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__2  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_CritVsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_ExitVsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_IdleVsinv__2) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExSimp/n_mutualExSimp_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7154240079185319, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.3298224719733103}}
{"text": "(*  File:       Elect_Module_Ref.thy\n    Copyright   2023  Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\<open>creator \"Valentin, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\ntheory Elect_Module_Ref\n  imports \"Verified_Voting_Rule_Construction.Elect_Module\"\n    \"Component_Types/Electoral_Module_Ref\"\n\nbegin\n\nsection \\<open>Refined Elect Module\\<close>\n\ntext \\<open>This is more or less an experimental artifacts. We use the elector instead\\<close>\n\n \\<comment> \\<open>The elect module should not return just the reference to all alternatives\n  but a deep copy.\\<close>\n\ndefinition aux_set_copy :: \"'a set \\<Rightarrow> 'a set nres\" where\n  \"aux_set_copy A \\<equiv>  FOREACH A \n     (\\<lambda> x cp. RETURN (insert x cp)) {}\"\n\nlemma aux_set_copy_correct:\n  shows \"(aux_set_copy, (RETURN o op_set_copy)) \n    \\<in> [\\<lambda> s. finite s]\\<^sub>f \\<langle>Id\\<rangle>set_rel \\<rightarrow> \\<langle>\\<langle>Id\\<rangle>set_rel\\<rangle>nres_rel\"  \n  unfolding aux_set_copy_def comp_apply\n  apply (intro frefI nres_relI, clarsimp)\nproof (rename_tac A)\n  fix A :: \"'a set\"\n  assume fina: \"finite A\"\n  show \"FOREACH A (\\<lambda>x cp. RETURN (insert x cp)) {} \\<le> RETURN A\"\n    apply (refine_vcg FOREACH_rule[where I = \"\\<lambda> it x. \n      x = A -it\"])\n    by (auto simp add: fina)\nqed\n\nsubsection \\<open>Defintion\\<close>\n\nfun elect_module_ref :: \"'a Electoral_Module_Ref\" where\n  \"elect_module_ref A p = do {\n   B \\<leftarrow> aux_set_copy A;\n   RETURN (B,{},{})\n}\"\n\nlemma elect_module_ref_correct:\n  shows \"(uncurry elect_module_ref, uncurry (RETURN oo elect_module))\n      \\<in> [\\<lambda> (A, pl). finite A]\\<^sub>f (\\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r profile_rel)\n  \\<rightarrow> \\<langle>\\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>Id\\<rangle>set_rel\\<rangle>nres_rel\"\n  unfolding elect_module_ref.simps elect_module.simps aux_set_copy_def\n  apply (intro frefI fun_relI nres_relI) unfolding comp_apply\n  apply clarsimp \nproof (rename_tac A pl pr)\n  fix A:: \"'a set\"\n  fix pl pr \n assume fina: \"finite A\"\n  from fina show \"FOREACH A (\\<lambda>x cp. RETURN (insert x cp)) {} \\<bind> (\\<lambda>B. RETURN (B, {}, {})) \\<le> RETURN (A, {}, {})\"\n    apply (refine_vcg)\n    apply (auto)\n    using aux_set_copy_correct[THEN frefD, THEN nres_relD] aux_set_copy_def\n    by (smt (verit, ccfv_threshold) RES_sng_eq_RETURN op_set_copy_def pair_in_Id_conv push_in_let_conv(2) refine_IdD set_rel_id_simp)\n    \nqed\n\n\nsepref_definition hs_copy_sep is \"aux_set_copy\" :: \n  \" (hs.assn id_assn)\\<^sup>k\n \\<rightarrow>\\<^sub>a (hs.assn id_assn)\"\n  unfolding aux_set_copy_def hs.fold_custom_empty\n  by sepref\n\nlemma hs_copy_hnr_aux: \"(hs_copy_sep,RETURN o op_set_copy) \n  \\<in> [\\<lambda> s. finite s]\\<^sub>a (hs.assn id_assn)\\<^sup>k \\<rightarrow> hs.assn id_assn\"\n  using hs_copy_sep.refine[FCOMP aux_set_copy_correct] by auto\n  \n\nsepref_definition elect_module_sep is \n  \"uncurry elect_module_ref\" :: \n\"(alts_set_impl_assn id_assn)\\<^sup>k *\\<^sub>a (profile_impl_assn id_assn)\\<^sup>k\n    \\<rightarrow>\\<^sub>a (result_impl_assn id_assn)\"\n  unfolding elect_module_ref.simps aux_set_copy_def hs.fold_custom_empty \n  by sepref\n\nlemma elect_module_sep_correct:\n  shows \"(uncurry elect_module_sep, uncurry (RETURN \\<circ>\\<circ> elect_module)) \\<in>  [\\<lambda>(a, b).\n           finite\n            a]\\<^sub>a (alts_set_impl_assn id_assn)\\<^sup>k *\\<^sub>a\n                 (list_assn\n                   (hr_comp (ballot_impl_assn id_assn)\n                     ballot_rel))\\<^sup>k \\<rightarrow> result_impl_assn id_assn\"\n  using\n elect_module_sep.refine[FCOMP elect_module_ref_correct]  set_rel_id hr_comp_Id2 by simp\n                                                                                      \n\ndeclare elect_module_sep_correct[sepref_fr_rules]\n\nend", "meta": {"author": "SpringVaS", "repo": "RefinementOfVotingRules", "sha": "a01e44b062fb43e172dff81cffbf941856c977d8", "save_path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules", "path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules/RefinementOfVotingRules-a01e44b062fb43e172dff81cffbf941856c977d8/theories/Compositional_Structures/Basic_Modules/Elect_Module_Ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442251201477016, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3296606911471149}}
{"text": "(*\n * Copyright 2023, Proofcraft Pty Ltd\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Empty_Fail\n  imports\n    NonDetMonad\n    WPSimp\nbegin\n\nsection \\<open>Monads that are wellformed w.r.t. failure\\<close>\n\ntext \\<open>\n  Usually, well-formed monads constructed from the primitives in NonDetMonad will have the following\n  property: if they return an empty set of results, they will have the failure flag set.\\<close>\ndefinition empty_fail :: \"('s,'a) nondet_monad \\<Rightarrow> bool\" where\n  \"empty_fail m \\<equiv> \\<forall>s. fst (m s) = {} \\<longrightarrow> snd (m s)\"\n\ntext \\<open>Useful in forcing otherwise unknown executions to have the @{const empty_fail} property.\\<close>\ndefinition mk_ef :: \"'a set \\<times> bool \\<Rightarrow> 'a set \\<times> bool\" where\n  \"mk_ef S \\<equiv> (fst S, fst S = {} \\<or> snd S)\"\n\n\nsubsection \\<open>WPC setup\\<close>\n\nlemma wpc_helper_empty_fail_final:\n  \"empty_fail f \\<Longrightarrow> wpc_helper (P, P') (Q, Q') (empty_fail f)\"\n  by (clarsimp simp: wpc_helper_def)\n\nwpc_setup \"\\<lambda>m. empty_fail m\" wpc_helper_empty_fail_final\n\n\nsubsection \\<open>@{const empty_fail} intro/dest rules\\<close>\n\nlemma empty_failI:\n  \"(\\<And>s. fst (m s) = {} \\<Longrightarrow> snd (m s)) \\<Longrightarrow> empty_fail m\"\n  by (simp add: empty_fail_def)\n\nlemma empty_failD:\n  \"\\<lbrakk> empty_fail m; fst (m s) = {} \\<rbrakk> \\<Longrightarrow> snd (m s)\"\n  by (simp add: empty_fail_def)\n\nlemma empty_fail_not_snd:\n  \"\\<lbrakk> \\<not> snd (m s); empty_fail m \\<rbrakk> \\<Longrightarrow> \\<exists>v. v \\<in> fst (m s)\"\n  by (fastforce simp: empty_fail_def)\n\nlemmas empty_failD2 = empty_fail_not_snd[rotated]\n\nlemma empty_failD3:\n  \"\\<lbrakk> empty_fail f; \\<not> snd (f s) \\<rbrakk> \\<Longrightarrow> fst (f s) \\<noteq> {}\"\n  by (drule(1) empty_failD2, clarsimp)\n\nlemma empty_fail_bindD1:\n  \"empty_fail (a >>= b) \\<Longrightarrow> empty_fail a\"\n  unfolding empty_fail_def bind_def\n  by (fastforce simp: split_def image_image)\n\n\nsubsection \\<open>Wellformed monads\\<close>\n\n(*\n  Collect generic empty_fail lemmas here:\n   - naming convention is emtpy_fail_NAME.\n   - add lemmas with assumptions to [empty_fail_cond] set\n   - add lemmas without assumption to [empty_fail_term] set\n*)\n\nnamed_theorems empty_fail_term\nnamed_theorems empty_fail_cond\n\nlemma empty_fail_K_bind[empty_fail_cond]:\n  \"empty_fail f \\<Longrightarrow> empty_fail (K_bind f x)\"\n  by simp\n\nlemma empty_fail_fun_app[empty_fail_cond]:\n  \"empty_fail (f x) \\<Longrightarrow> empty_fail (f $ x)\"\n  by simp\n\n(* empty_fail as such does not need context, but empty_fail_select_f does, so we need to build\n   up context in other rules *)\nlemma empty_fail_If[empty_fail_cond]:\n  \"\\<lbrakk> P \\<Longrightarrow> empty_fail f; \\<not>P \\<Longrightarrow> empty_fail g \\<rbrakk> \\<Longrightarrow> empty_fail (if P then f else g)\"\n  by (simp split: if_split)\n\nlemma empty_fail_If_applied[empty_fail_cond]:\n  \"\\<lbrakk> P \\<Longrightarrow> empty_fail (f x); \\<not>P \\<Longrightarrow> empty_fail (g x) \\<rbrakk> \\<Longrightarrow> empty_fail ((if P then f else g) x)\"\n  by simp\n\nlemma empty_fail_put[empty_fail_term]:\n  \"empty_fail (put f)\"\n  by (simp add: put_def empty_fail_def)\n\nlemma empty_fail_modify[empty_fail_term]:\n  \"empty_fail (modify f)\"\n  by (simp add: empty_fail_def simpler_modify_def)\n\nlemma empty_fail_gets[empty_fail_term]:\n  \"empty_fail (gets f)\"\n  by (simp add: empty_fail_def simpler_gets_def)\n\nlemma empty_fail_select[empty_fail_cond]:\n  \"S \\<noteq> {} \\<Longrightarrow> empty_fail (select S)\"\n  by (simp add: empty_fail_def select_def)\n\nlemma empty_fail_select_f[empty_fail_cond]:\n  assumes ef: \"fst S = {} \\<Longrightarrow> snd S\"\n  shows \"empty_fail (select_f S)\"\n  by (fastforce simp add: empty_fail_def select_f_def intro: ef)\n\nlemma empty_fail_bind[empty_fail_cond]:\n  \"\\<lbrakk> empty_fail a; \\<And>x. empty_fail (b x) \\<rbrakk> \\<Longrightarrow> empty_fail (a >>= b)\"\n  by (fastforce simp: bind_def empty_fail_def split_def)\n\nlemma empty_fail_return[empty_fail_term]:\n  \"empty_fail (return x)\"\n  by (simp add: empty_fail_def return_def)\n\nlemma empty_fail_returnOk[empty_fail_term]:\n  \"empty_fail (returnOk v)\"\n  by (fastforce simp: returnOk_def empty_fail_term)\n\nlemma empty_fail_throwError[empty_fail_term]:\n  \"empty_fail (throwError v)\"\n  by (fastforce simp: throwError_def empty_fail_term)\n\nlemma empty_fail_lift[empty_fail_cond]:\n  \"\\<lbrakk> \\<And>x. empty_fail (f x) \\<rbrakk> \\<Longrightarrow> empty_fail (lift f x)\"\n  unfolding lift_def\n  by (auto simp: empty_fail_term split: sum.split)\n\nlemma empty_fail_liftE[empty_fail_cond]:\n  \"empty_fail f \\<Longrightarrow> empty_fail (liftE f)\"\n  by (simp add: liftE_def empty_fail_cond empty_fail_term)\n\nlemma empty_fail_bindE[empty_fail_cond]:\n  \"\\<lbrakk> empty_fail f; \\<And>rv. empty_fail (g rv) \\<rbrakk> \\<Longrightarrow> empty_fail (f >>=E g)\"\n  by (simp add: bindE_def empty_fail_cond)\n\nlemma empty_fail_mapM[empty_fail_cond]:\n  assumes m: \"\\<And>x. x \\<in> set xs \\<Longrightarrow> empty_fail (m x)\"\n  shows \"empty_fail (mapM m xs)\"\nusing m\nproof (induct xs)\n  case Nil\n  thus ?case by (simp add: mapM_def sequence_def empty_fail_term)\nnext\n  case Cons\n  have P: \"\\<And>m x xs. mapM m (x # xs) = (do y \\<leftarrow> m x; ys \\<leftarrow> (mapM m xs); return (y # ys) od)\"\n    by (simp add: mapM_def sequence_def Let_def)\n  from Cons\n  show ?case by (simp add: P m empty_fail_cond empty_fail_term)\nqed\n\nlemma empty_fail_fail[empty_fail_term]:\n  \"empty_fail fail\"\n  by (simp add: fail_def empty_fail_def)\n\nlemma empty_fail_assert[empty_fail_term]:\n  \"empty_fail (assert P)\"\n  unfolding assert_def by (simp add: empty_fail_term)\n\nlemma empty_fail_assert_opt[empty_fail_term]:\n  \"empty_fail (assert_opt x)\"\n  by (simp add: assert_opt_def empty_fail_term split: option.splits)\n\nlemma empty_fail_mk_ef[empty_fail_term]:\n  \"empty_fail (mk_ef o m)\"\n  by (simp add: empty_fail_def mk_ef_def)\n\nlemma empty_fail_gets_the[empty_fail_term]:\n  \"empty_fail (gets_the f)\"\n  unfolding gets_the_def\n  by (simp add: empty_fail_cond empty_fail_term)\n\nlemma empty_fail_gets_map[empty_fail_term]:\n  \"empty_fail (gets_map f p)\"\n  unfolding gets_map_def\n  by (simp add: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_whenEs[empty_fail_cond]:\n  \"(P \\<Longrightarrow> empty_fail f) \\<Longrightarrow> empty_fail (whenE P f)\"\n  \"(\\<not>P \\<Longrightarrow> empty_fail f) \\<Longrightarrow> empty_fail (unlessE P f)\"\n  by (auto simp add: whenE_def unlessE_def empty_fail_term)\n\nlemma empty_fail_assertE[empty_fail_term]:\n  \"empty_fail (assertE P)\"\n  by (simp add: assertE_def empty_fail_term)\n\nlemma empty_fail_get[empty_fail_term]:\n  \"empty_fail get\"\n  by (simp add: empty_fail_def get_def)\n\nlemma empty_fail_catch[empty_fail_cond]:\n  \"\\<lbrakk> empty_fail f; \\<And>x. empty_fail (g x) \\<rbrakk> \\<Longrightarrow> empty_fail (catch f g)\"\n  by (simp add: catch_def empty_fail_cond empty_fail_term split: sum.split)\n\nlemma empty_fail_guard[empty_fail_term]:\n  \"empty_fail (state_assert G)\"\n  by (clarsimp simp: state_assert_def empty_fail_cond empty_fail_term)\n\nlemma empty_fail_spec[empty_fail_term]:\n  \"empty_fail (state_select F)\"\n  by (clarsimp simp: state_select_def empty_fail_def)\n\nlemma empty_fail_when[empty_fail_cond]:\n  \"(P \\<Longrightarrow> empty_fail x) \\<Longrightarrow> empty_fail (when P x)\"\n  unfolding when_def\n  by (simp add: empty_fail_term)\n\nlemma empty_fail_unless[empty_fail_cond]:\n  \"(\\<not>P \\<Longrightarrow> empty_fail f) \\<Longrightarrow> empty_fail (unless P f)\"\n  unfolding unless_def\n  by (simp add: empty_fail_cond)\n\nlemma empty_fail_liftM[empty_fail_cond]:\n  \"empty_fail m \\<Longrightarrow> empty_fail (liftM f m)\"\n  unfolding liftM_def\n  by (fastforce simp: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_liftME[empty_fail_cond]:\n  \"empty_fail m \\<Longrightarrow> empty_fail (liftME f m)\"\n  unfolding liftME_def\n  by (simp add: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_handleE[empty_fail_cond]:\n  \"\\<lbrakk> empty_fail L; \\<And>r. empty_fail (R r) \\<rbrakk> \\<Longrightarrow> empty_fail (L <handle> R)\"\n  by (clarsimp simp: handleE_def handleE'_def empty_fail_term empty_fail_cond split: sum.splits)\n\nlemma empty_fail_handle'[empty_fail_cond]:\n  \"\\<lbrakk>empty_fail f; \\<And>e. empty_fail (handler e)\\<rbrakk> \\<Longrightarrow> empty_fail (f <handle2> handler)\"\n  unfolding handleE'_def\n  by (fastforce simp: empty_fail_term empty_fail_cond split: sum.splits)\n\nlemma empty_fail_sequence[empty_fail_cond]:\n  \"(\\<And>m. m \\<in> set ms \\<Longrightarrow> empty_fail m) \\<Longrightarrow> empty_fail (sequence ms)\"\n  unfolding sequence_def\n  by (induct ms; simp add: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_sequence_x[empty_fail_cond]:\n  \"(\\<And>m. m \\<in> set ms \\<Longrightarrow> empty_fail m) \\<Longrightarrow> empty_fail (sequence_x ms)\"\n  unfolding sequence_x_def\n  by (induct ms; simp add: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_sequenceE[empty_fail_cond]:\n  \"(\\<And>m. m \\<in> set ms \\<Longrightarrow> empty_fail m) \\<Longrightarrow> empty_fail (sequenceE ms)\"\n  unfolding sequenceE_def\n  by (induct ms; simp add: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_sequenceE_x[empty_fail_cond]:\n  \"(\\<And>m. m \\<in> set ms \\<Longrightarrow> empty_fail m) \\<Longrightarrow> empty_fail (sequenceE_x ms)\"\n  unfolding sequenceE_x_def\n  by (induct ms; simp add: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_mapM_x[empty_fail_cond]:\n  \"(\\<And>m. m \\<in> f ` set ms \\<Longrightarrow> empty_fail m) \\<Longrightarrow> empty_fail (mapM_x f ms)\"\n  unfolding mapM_x_def\n  by (fastforce intro: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_mapME[empty_fail_cond]:\n  \"(\\<And>m. m \\<in> f ` set xs \\<Longrightarrow> empty_fail m) \\<Longrightarrow> empty_fail (mapME f xs)\"\n  unfolding mapME_def\n  by (fastforce intro: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_mapME_x[empty_fail_cond]:\n  \"(\\<And>m'. m' \\<in> f ` set xs \\<Longrightarrow> empty_fail m') \\<Longrightarrow> empty_fail (mapME_x f xs)\"\n  unfolding mapME_x_def\n  by (fastforce intro: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_filterM[empty_fail_cond]:\n  \"(\\<And>m. m \\<in> set ms \\<Longrightarrow> empty_fail (P m)) \\<Longrightarrow> empty_fail (filterM P ms)\"\n  by (induct ms; simp add: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_zipWithM_x[empty_fail_cond]:\n  \"(\\<And>x y. empty_fail (f x y)) \\<Longrightarrow> empty_fail (zipWithM_x f xs ys)\"\n  unfolding zipWithM_x_def zipWith_def\n  by (fastforce intro: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_zipWithM[empty_fail_cond]:\n  \"(\\<And>x y. empty_fail (f x y)) \\<Longrightarrow> empty_fail (zipWithM f xs ys)\"\n  unfolding zipWithM_def zipWith_def\n  by (fastforce intro: empty_fail_term empty_fail_cond)\n\nlemma empty_fail_maybeM[empty_fail_cond]:\n  \"\\<forall>x. empty_fail (f x) \\<Longrightarrow> empty_fail (maybeM f t)\"\n  unfolding maybeM_def\n  by (fastforce intro: empty_fail_term split: option.splits)\n\nlemma empty_fail_ifM[empty_fail_cond]:\n  \"\\<lbrakk> empty_fail P; empty_fail a; empty_fail b \\<rbrakk> \\<Longrightarrow> empty_fail (ifM P a b)\"\n  by (simp add: ifM_def empty_fail_cond)\n\nlemma empty_fail_ifME[empty_fail_cond]:\n  \"\\<lbrakk> empty_fail P; empty_fail a; empty_fail b \\<rbrakk> \\<Longrightarrow> empty_fail (ifME P a b)\"\n  by (simp add: ifME_def empty_fail_cond)\n\nlemma empty_fail_whenM[empty_fail_cond]:\n  \"\\<lbrakk> empty_fail P; empty_fail f \\<rbrakk> \\<Longrightarrow> empty_fail (whenM P f)\"\n  by (simp add: whenM_def empty_fail_term empty_fail_cond)\n\nlemma empty_fail_andM[empty_fail_cond]:\n  \"\\<lbrakk> empty_fail A; empty_fail B \\<rbrakk> \\<Longrightarrow> empty_fail (andM A B)\"\n  by (simp add: andM_def empty_fail_term empty_fail_cond)\n\nlemma empty_fail_orM[empty_fail_cond]:\n  \"\\<lbrakk> empty_fail A; empty_fail B \\<rbrakk> \\<Longrightarrow> empty_fail (orM A B)\"\n  by (simp add: orM_def empty_fail_term empty_fail_cond)\n\nlemma empty_fail_notM[empty_fail_cond]:\n  \"empty_fail A \\<Longrightarrow> empty_fail (notM A)\"\n  by (simp add: notM_def empty_fail_term empty_fail_cond)\n\n(* not everything [simp] by default, because side conditions can slow down simp a lot *)\nlemmas empty_fail[wp, intro!] = empty_fail_term empty_fail_cond\nlemmas [simp] = empty_fail_term\n\n\nsubsection \\<open>Equations and legacy names\\<close>\n\nlemma empty_fail_select_eq[simp]:\n  \"empty_fail (select V) = (V \\<noteq> {})\"\n  by (clarsimp simp: select_def empty_fail_def)\n\nlemma empty_fail_liftM_eq[simp]:\n  \"empty_fail (liftM f m) = empty_fail m\"\n  unfolding liftM_def\n  by (fastforce dest: empty_fail_bindD1)\n\nlemma empty_fail_liftE_eq[simp]:\n  \"empty_fail (liftE f) = empty_fail f\"\n  by (fastforce simp: liftE_def empty_fail_def bind_def)\n\nlemma liftME_empty_fail_eq[simp]:\n  \"empty_fail (liftME f m) = empty_fail m\"\n  unfolding liftME_def\n  by (fastforce dest: empty_fail_bindD1 simp: bindE_def)\n\n(* legacy name binding *)\nlemmas empty_fail_error_bits = empty_fail_returnOk empty_fail_throwError empty_fail_liftE_eq\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Monads/Empty_Fail.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.6442251133170357, "lm_q1q2_score": 0.32966068765174966}}
{"text": "(*  Title:      HOL/Auth/Guard/GuardK.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2002  University of Cambridge\n\nVery similar to Guard except:\n- Guard is replaced by GuardK, guard by guardK, Nonce by Key\n- some scripts are slightly modified (+ keyset_in, kparts_parts)\n- the hypothesis Key n ~:G (keyset G) is added\n*)\n\nsection\\<open>protocol-independent confidentiality theorem on keys\\<close>\n\ntheory GuardK\nimports Analz Extensions\nbegin\n\n(******************************************************************************\nmessages where all the occurrences of Key n are\nin a sub-message of the form Crypt (invKey K) X with K:Ks\n******************************************************************************)\n\ninductive_set\n  guardK :: \"nat => key set => msg set\"\n  for n :: nat and Ks :: \"key set\"\nwhere\n  No_Key [intro]: \"Key n \\<notin> parts {X} \\<Longrightarrow> X \\<in> guardK n Ks\"\n| Guard_Key [intro]: \"invKey K \\<in> Ks \\<Longrightarrow> Crypt K X \\<in> guardK n Ks\"\n| Crypt [intro]: \"X \\<in> guardK n Ks \\<Longrightarrow> Crypt K X \\<in> guardK n Ks\"\n| Pair [intro]: \"\\<lbrakk>X \\<in> guardK n Ks; Y \\<in> guardK n Ks\\<rbrakk> \\<Longrightarrow> \\<lbrace>X,Y\\<rbrace> \\<in> guardK n Ks\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>guardK\\<close>\\<close>\n\nlemma Nonce_is_guardK [iff]: \"Nonce p \\<in> guardK n Ks\"\nby auto\n\nlemma Agent_is_guardK [iff]: \"Agent A \\<in> guardK n Ks\"\nby auto\n\nlemma Number_is_guardK [iff]: \"Number r \\<in> guardK n Ks\"\nby auto\n\nlemma Key_notin_guardK: \"X \\<in> guardK n Ks \\<Longrightarrow> X \\<noteq> Key n\"\nby (erule guardK.induct, auto)\n\nlemma Key_notin_guardK_iff [iff]: \"Key n \\<notin> guardK n Ks\"\nby (auto dest: Key_notin_guardK)\n\nlemma guardK_has_Crypt [rule_format]: \"X \\<in> guardK n Ks \\<Longrightarrow> Key n \\<in> parts {X}\n\\<longrightarrow> (\\<exists>K Y. Crypt K Y \\<in> kparts {X} \\<and> Key n \\<in> parts {Y})\"\nby (erule guardK.induct, auto)\n\nlemma Key_notin_kparts_msg: \"X \\<in> guardK n Ks \\<Longrightarrow> Key n \\<notin> kparts {X}\"\nby (erule guardK.induct, auto dest: kparts_parts)\n\nlemma Key_in_kparts_imp_no_guardK: \"Key n \\<in> kparts H\n\\<Longrightarrow> \\<exists>X. X \\<in> H \\<and> X \\<notin> guardK n Ks\"\napply (drule in_kparts, clarify)\napply (rule_tac x=X in exI, clarify)\nby (auto dest: Key_notin_kparts_msg)\n\nlemma guardK_kparts [rule_format]: \"X \\<in> guardK n Ks \\<Longrightarrow>\nY \\<in> kparts {X} \\<longrightarrow> Y \\<in> guardK n Ks\"\nby (erule guardK.induct, auto dest: kparts_parts parts_sub)\n\nlemma guardK_Crypt: \"\\<lbrakk>Crypt K Y \\<in> guardK n Ks; K \\<notin> invKey`Ks\\<rbrakk> \\<Longrightarrow> Y \\<in> guardK n Ks\"\n  by (ind_cases \"Crypt K Y \\<in> guardK n Ks\") (auto intro!: image_eqI)\n\nlemma guardK_MPair [iff]: \"(\\<lbrace>X,Y\\<rbrace> \\<in> guardK n Ks)\n= (X \\<in> guardK n Ks \\<and> Y \\<in> guardK n Ks)\"\nby (auto, (ind_cases \"\\<lbrace>X,Y\\<rbrace> \\<in> guardK n Ks\", auto)+)\n\nlemma guardK_not_guardK [rule_format]: \"X \\<in>guardK n Ks \\<Longrightarrow>\nCrypt K Y \\<in> kparts {X} \\<longrightarrow> Key n \\<in> kparts {Y} \\<longrightarrow> Y \\<notin> guardK n Ks\"\nby (erule guardK.induct, auto dest: guardK_kparts)\n\nlemma guardK_extand: \"\\<lbrakk>X \\<in> guardK n Ks; Ks \\<subseteq> Ks';\n\\<lbrakk>K \\<in> Ks'; K \\<notin> Ks\\<rbrakk> \\<Longrightarrow> Key K \\<notin> parts {X}\\<rbrakk> \\<Longrightarrow> X \\<in> guardK n Ks'\"\nby (erule guardK.induct, auto)\n\nsubsection\\<open>guarded sets\\<close>\n\ndefinition GuardK :: \"nat \\<Rightarrow> key set \\<Rightarrow> msg set \\<Rightarrow> bool\" where\n\"GuardK n Ks H \\<equiv> \\<forall>X. X \\<in> H \\<longrightarrow> X \\<in> guardK n Ks\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>GuardK\\<close>\\<close>\n\nlemma GuardK_empty [iff]: \"GuardK n Ks {}\"\nby (simp add: GuardK_def)\n\nlemma Key_notin_kparts [simplified]: \"GuardK n Ks H \\<Longrightarrow> Key n \\<notin> kparts H\"\nby (auto simp: GuardK_def dest: in_kparts Key_notin_kparts_msg)\n\nlemma GuardK_must_decrypt: \"\\<lbrakk>GuardK n Ks H; Key n \\<in> analz H\\<rbrakk> \\<Longrightarrow>\n\\<exists>K Y. Crypt K Y \\<in> kparts H \\<and> Key (invKey K) \\<in> kparts H\"\napply (drule_tac P=\"\\<lambda>G. Key n \\<in> G\" in analz_pparts_kparts_substD, simp)\nby (drule must_decrypt, auto dest: Key_notin_kparts)\n\nlemma GuardK_kparts [intro]: \"GuardK n Ks H \\<Longrightarrow> GuardK n Ks (kparts H)\"\nby (auto simp: GuardK_def dest: in_kparts guardK_kparts)\n\nlemma GuardK_mono: \"\\<lbrakk>GuardK n Ks H; G \\<subseteq> H\\<rbrakk> \\<Longrightarrow> GuardK n Ks G\"\nby (auto simp: GuardK_def)\n\nlemma GuardK_insert [iff]: \"GuardK n Ks (insert X H)\n= (GuardK n Ks H \\<and> X \\<in> guardK n Ks)\"\nby (auto simp: GuardK_def)\n\nlemma GuardK_Un [iff]: \"GuardK n Ks (G Un H) = (GuardK n Ks G & GuardK n Ks H)\"\nby (auto simp: GuardK_def)\n\nlemma GuardK_synth [intro]: \"GuardK n Ks G \\<Longrightarrow> GuardK n Ks (synth G)\"\nby (auto simp: GuardK_def, erule synth.induct, auto)\n\nlemma GuardK_analz [intro]: \"\\<lbrakk>GuardK n Ks G; \\<forall>K. K \\<in> Ks \\<longrightarrow> Key K \\<notin> analz G\\<rbrakk>\n\\<Longrightarrow> GuardK n Ks (analz G)\"\napply (auto simp: GuardK_def)\napply (erule analz.induct, auto)\nby (ind_cases \"Crypt K Xa \\<in> guardK n Ks\" for K Xa, auto)\n\nlemma in_GuardK [dest]: \"\\<lbrakk>X \\<in> G; GuardK n Ks G\\<rbrakk> \\<Longrightarrow> X \\<in> guardK n Ks\"\nby (auto simp: GuardK_def)\n\nlemma in_synth_GuardK: \"\\<lbrakk>X \\<in> synth G; GuardK n Ks G\\<rbrakk> \\<Longrightarrow> X \\<in> guardK n Ks\"\nby (drule GuardK_synth, auto)\n\nlemma in_analz_GuardK: \"\\<lbrakk>X \\<in> analz G; GuardK n Ks G;\n\\<forall>K. K \\<in> Ks \\<longrightarrow> Key K \\<notin> analz G\\<rbrakk> \\<Longrightarrow> X \\<in> guardK n Ks\"\nby (drule GuardK_analz, auto)\n\nlemma GuardK_keyset [simp]: \"\\<lbrakk>keyset G; Key n \\<notin> G\\<rbrakk> \\<Longrightarrow> GuardK n Ks G\"\nby (simp only: GuardK_def, clarify, drule keyset_in, auto)\n\nlemma GuardK_Un_keyset: \"\\<lbrakk>GuardK n Ks G; keyset H; Key n \\<notin> H\\<rbrakk>\n\\<Longrightarrow> GuardK n Ks (G Un H)\"\nby auto\n\nlemma in_GuardK_kparts: \"\\<lbrakk>X \\<in> G; GuardK n Ks G; Y \\<in> kparts {X}\\<rbrakk> \\<Longrightarrow> Y \\<in> guardK n Ks\"\nby blast\n\nlemma in_GuardK_kparts_neq: \"\\<lbrakk>X \\<in> G; GuardK n Ks G; Key n' \\<in> kparts {X}\\<rbrakk>\n\\<Longrightarrow> n \\<noteq> n'\"\nby (blast dest: in_GuardK_kparts)\n\nlemma in_GuardK_kparts_Crypt: \"\\<lbrakk>X \\<in> G; GuardK n Ks G; is_MPair X;\nCrypt K Y \\<in> kparts {X}; Key n \\<in> kparts {Y}\\<rbrakk> \\<Longrightarrow> invKey K \\<in> Ks\"\napply (drule in_GuardK, simp)\napply (frule guardK_not_guardK, simp+)\napply (drule guardK_kparts, simp)\nby (ind_cases \"Crypt K Y \\<in> guardK n Ks\", auto)\n\nlemma GuardK_extand: \"\\<lbrakk>GuardK n Ks G; Ks \\<subseteq> Ks';\n\\<lbrakk>K \\<in> Ks'; K \\<notin> Ks\\<rbrakk> \\<Longrightarrow> Key K \\<notin> parts G\\<rbrakk> \\<Longrightarrow> GuardK n Ks' G\"\nby (auto simp: GuardK_def dest: guardK_extand parts_sub)\n\nsubsection\\<open>set obtained by decrypting a message\\<close>\n\nabbreviation (input)\n  decrypt :: \"msg set \\<Rightarrow> key \\<Rightarrow> msg \\<Rightarrow> msg set\" where\n  \"decrypt H K Y \\<equiv> insert Y (H - {Crypt K Y})\"\n\nlemma analz_decrypt: \"\\<lbrakk>Crypt K Y \\<in> H; Key (invKey K) \\<in> H; Key n \\<in> analz H\\<rbrakk>\n\\<Longrightarrow> Key n \\<in> analz (decrypt H K Y)\"\napply (drule_tac P=\"\\<lambda>H. Key n \\<in> analz H\" in ssubst [OF insert_Diff])\napply assumption \napply (simp only: analz_Crypt_if, simp)\ndone\n\nlemma parts_decrypt: \"\\<lbrakk>Crypt K Y \\<in> H; X \\<in> parts (decrypt H K Y)\\<rbrakk> \\<Longrightarrow> X \\<in> parts H\"\nby (erule parts.induct, auto intro: parts.Fst parts.Snd parts.Body)\n\nsubsection\\<open>number of Crypt's in a message\\<close>\n\nfun crypt_nb :: \"msg => nat\" where\n\"crypt_nb (Crypt K X) = Suc (crypt_nb X)\" |\n\"crypt_nb \\<lbrace>X,Y\\<rbrace> = crypt_nb X + crypt_nb Y\" |\n\"crypt_nb X = 0\" (* otherwise *)\n\nsubsection\\<open>basic facts about \\<^term>\\<open>crypt_nb\\<close>\\<close>\n\nlemma non_empty_crypt_msg: \"Crypt K Y \\<in> parts {X} \\<Longrightarrow> crypt_nb X \\<noteq> 0\"\nby (induct X, simp_all, safe, simp_all)\n\nsubsection\\<open>number of Crypt's in a message list\\<close>\n\nprimrec cnb :: \"msg list => nat\" where\n\"cnb [] = 0\" |\n\"cnb (X#l) = crypt_nb X + cnb l\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>cnb\\<close>\\<close>\n\nlemma cnb_app [simp]: \"cnb (l @ l') = cnb l + cnb l'\"\nby (induct l, auto)\n\nlemma mem_cnb_minus: \"x \\<in> set l \\<Longrightarrow> cnb l = crypt_nb x + (cnb l - crypt_nb x)\"\nby (induct l, auto)\n\nlemmas mem_cnb_minus_substI = mem_cnb_minus [THEN ssubst]\n\nlemma cnb_minus [simp]: \"x \\<in> set l \\<Longrightarrow> cnb (remove l x) = cnb l - crypt_nb x\"\napply (induct l, auto)\nby (erule_tac l=l and x=x in mem_cnb_minus_substI, simp)\n\nlemma parts_cnb: \"Z \\<in> parts (set l) \\<Longrightarrow>\ncnb l = (cnb l - crypt_nb Z) + crypt_nb Z\"\nby (erule parts.induct, auto simp: in_set_conv_decomp)\n\nlemma non_empty_crypt: \"Crypt K Y \\<in> parts (set l) \\<Longrightarrow> cnb l \\<noteq> 0\"\nby (induct l, auto dest: non_empty_crypt_msg parts_insert_substD)\n\nsubsection\\<open>list of kparts\\<close>\n\nlemma kparts_msg_set: \"\\<exists>l. kparts {X} = set l \\<and> cnb l = crypt_nb X\"\napply (induct X, simp_all)\napply (rename_tac agent, rule_tac x=\"[Agent agent]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Number nat]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Nonce nat]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Key nat]\" in exI, simp)\napply (rule_tac x=\"[Hash X]\" in exI, simp)\napply (clarify, rule_tac x=\"l@la\" in exI, simp)\nby (clarify, rename_tac nat X y, rule_tac x=\"[Crypt nat X]\" in exI, simp)\n\nlemma kparts_set: \"\\<exists>l'. kparts (set l) = set l' & cnb l' = cnb l\"\napply (induct l)\napply (rule_tac x=\"[]\" in exI, simp, clarsimp)\napply (rename_tac a b l')\napply (subgoal_tac \"\\<exists>l''.  kparts {a} = set l'' & cnb l'' = crypt_nb a\", clarify)\napply (rule_tac x=\"l''@l'\" in exI, simp)\napply (rule kparts_insert_substI, simp)\nby (rule kparts_msg_set)\n\nsubsection\\<open>list corresponding to \"decrypt\"\\<close>\n\ndefinition decrypt' :: \"msg list => key => msg => msg list\" where\n\"decrypt' l K Y == Y # remove l (Crypt K Y)\"\n\ndeclare decrypt'_def [simp]\n\nsubsection\\<open>basic facts about \\<^term>\\<open>decrypt'\\<close>\\<close>\n\nlemma decrypt_minus: \"decrypt (set l) K Y <= set (decrypt' l K Y)\"\nby (induct l, auto)\n\ntext\\<open>if the analysis of a finite guarded set gives n then it must also give\none of the keys of Ks\\<close>\n\nlemma GuardK_invKey_by_list [rule_format]: \"\\<forall>l. cnb l = p\n\\<longrightarrow> GuardK n Ks (set l) \\<longrightarrow> Key n \\<in> analz (set l)\n\\<longrightarrow> (\\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz (set l))\"\napply (induct p)\n(* case p=0 *)\napply (clarify, drule GuardK_must_decrypt, simp, clarify)\napply (drule kparts_parts, drule non_empty_crypt, simp)\n(* case p>0 *)\napply (clarify, frule GuardK_must_decrypt, simp, clarify)\napply (drule_tac P=\"\\<lambda>G. Key n \\<in> G\" in analz_pparts_kparts_substD, simp)\napply (frule analz_decrypt, simp_all)\napply (subgoal_tac \"\\<exists>l'. kparts (set l) = set l' \\<and> cnb l' = cnb l\", clarsimp)\napply (drule_tac G=\"insert Y (set l' - {Crypt K Y})\"\nand H=\"set (decrypt' l' K Y)\" in analz_sub, rule decrypt_minus)\napply (rule_tac analz_pparts_kparts_substI, simp)\napply (case_tac \"K \\<in> invKey`Ks\")\n(* K:invKey`Ks *)\napply (clarsimp, blast)\n(* K ~:invKey`Ks *)\napply (subgoal_tac \"GuardK n Ks (set (decrypt' l' K Y))\")\napply (drule_tac x=\"decrypt' l' K Y\" in spec, simp)\napply (subgoal_tac \"Crypt K Y \\<in> parts (set l)\")\napply (drule parts_cnb, rotate_tac -1, simp)\napply (clarify, drule_tac X=\"Key Ka\" and H=\"insert Y (set l')\" in analz_sub)\napply (rule insert_mono, rule set_remove)\napply (simp add: analz_insertD, blast)\n(* Crypt K Y:parts (set l) *)\napply (blast dest: kparts_parts)\n(* GuardK n Ks (set (decrypt' l' K Y)) *)\napply (rule_tac H=\"insert Y (set l')\" in GuardK_mono)\napply (subgoal_tac \"GuardK n Ks (set l')\", simp)\napply (rule_tac K=K in guardK_Crypt, simp add: GuardK_def, simp)\napply (drule_tac t=\"set l'\" in sym, simp)\napply (rule GuardK_kparts, simp, simp)\napply (rule_tac B=\"set l'\" in subset_trans, rule set_remove, blast)\nby (rule kparts_set)\n\nlemma GuardK_invKey_finite: \"\\<lbrakk>Key n \\<in> analz G; GuardK n Ks G; finite G\\<rbrakk>\n\\<Longrightarrow> \\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz G\"\napply (drule finite_list, clarify)\nby (rule GuardK_invKey_by_list, auto)\n\nlemma GuardK_invKey: \"\\<lbrakk>Key n \\<in> analz G; GuardK n Ks G\\<rbrakk>\n\\<Longrightarrow> \\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz G\"\nby (auto dest: analz_needs_only_finite GuardK_invKey_finite)\n\ntext\\<open>if the analyse of a finite guarded set and a (possibly infinite) set of\nkeys gives n then it must also gives Ks\\<close>\n\nlemma GuardK_invKey_keyset: \"\\<lbrakk>Key n \\<in> analz (G \\<union> H); GuardK n Ks G; finite G;\nkeyset H; Key n \\<notin> H\\<rbrakk> \\<Longrightarrow> \\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz (G \\<union> H)\"\napply (frule_tac P=\"\\<lambda>G. Key n \\<in> G\" and G=G in analz_keyset_substD, simp_all)\napply (drule_tac G=\"G Un (H Int keysfor G)\" in GuardK_invKey_finite)\napply (auto simp: GuardK_def intro: analz_sub)\nby (drule keyset_in, auto)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/Guard/GuardK.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.32966068415638444}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Strong_Early_Bisim_Pres\n  imports Strong_Early_Bisim Strong_Early_Sim_Pres\nbegin\n\n(************* Preservation rules *************)\n\nlemma tauPres:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"\\<tau>.(P) \\<sim> \\<tau>.(Q)\"\nproof -\n  let ?X = \"{(\\<tau>.(P), \\<tau>.(Q)) | P Q. P \\<sim> Q}\"\n  from \\<open>P \\<sim> Q\\<close> have \"(\\<tau>.(P), \\<tau>.(Q)) \\<in> ?X\" by auto\n  thus ?thesis\n    by(coinduct rule: bisimCoinduct) (auto intro: tauPres dest: bisimE)\nqed\n\nlemma inputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   x :: name\n\n  assumes PSimQ: \"\\<forall>y. P[x::=y] \\<sim> Q[x::=y]\"\n  \n  shows \"a<x>.P \\<sim> a<x>.Q\"\nproof -\n  let ?X = \"{(a<x>.P, a<x>.Q) | a x P Q. \\<forall>y. P[x::=y] \\<sim> Q[x::=y]}\"\n  {\n    fix axP axQ p\n    assume \"(axP, axQ) \\<in> ?X\"\n    then obtain a x P Q where A: \"\\<forall>y. P[x::=y] \\<sim> Q[x::=y]\" and B: \"axP = a<x>.P\" and C: \"axQ = a<x>.Q\"\n      by auto\n    have \"\\<And>y. ((p::name prm) \\<bullet> P)[(p \\<bullet> x)::=y] \\<sim> (p \\<bullet> Q)[(p \\<bullet> x)::=y]\"\n    proof -\n      fix y\n      from A have \"P[x::=(rev p \\<bullet> y)] \\<sim> Q[x::=(rev p \\<bullet> y)]\"\n        by blast\n      hence \"(p \\<bullet> (P[x::=(rev p \\<bullet> y)])) \\<sim> p \\<bullet> (Q[x::=(rev p \\<bullet> y)])\"\n        by(rule bisimClosed)\n      thus \"(p \\<bullet> P)[(p \\<bullet> x)::=y] \\<sim> (p \\<bullet> Q)[(p \\<bullet> x)::=y]\"\n        by(simp add: eqvts pt_pi_rev[OF pt_name_inst, OF at_name_inst])\n    qed\n    hence \"((p::name prm) \\<bullet> axP, p \\<bullet> axQ) \\<in> ?X\" using B C\n      by auto\n  }\n  hence \"eqvt ?X\" by(simp add: eqvt_def)\n  from PSimQ have \"(a<x>.P, a<x>.Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cSim P Q)\n    thus ?case using \\<open>eqvt ?X\\<close>\n      by(force intro: inputPres)\n  next\n    case(cSym P Q)\n    thus ?case\n      by(blast dest: bisimE)\n  qed\nqed\n\nlemma outputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"a{b}.P \\<sim> a{b}.Q\"\nproof -\n  let ?X = \"{(a{b}.P, a{b}.Q) | a b P Q. P \\<sim> Q}\"\n  from \\<open>P \\<sim> Q\\<close> have \"(a{b}.P, a{b}.Q) \\<in> ?X\" by auto\n  thus ?thesis\n    by(coinduct rule: bisimCoinduct) (blast intro: outputPres dest: bisimE)+\nqed\n\n\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"[a\\<frown>b]P \\<sim> [a\\<frown>b]Q\"\nproof -\n  let ?X = \"{x. \\<exists>P Q a b. P \\<sim> Q \\<and> x = ([a\\<frown>b]P, [a\\<frown>b]Q)}\"\n  from assms have \"([a\\<frown>b]P, [a\\<frown>b]Q) \\<in> ?X\" by blast\n  thus ?thesis\n    by(coinduct rule: bisimCoinduct) (blast intro: matchPres dest: bisimE)+\nqed\n\nlemma mismatchPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"[a\\<noteq>b]P \\<sim> [a\\<noteq>b]Q\"\nproof -\n  let ?X = \"{x. \\<exists>P Q a b. P \\<sim> Q \\<and> x = ([a\\<noteq>b]P, [a\\<noteq>b]Q)}\"\n  from assms have \"([a\\<noteq>b]P, [a\\<noteq>b]Q) \\<in> ?X\" by blast\n  thus ?thesis\n    by(coinduct rule: bisimCoinduct) (blast intro: mismatchPres dest: bisimE)+\nqed\n\nlemma sumPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n  \n  assumes \"P \\<sim> Q\"\n\n  shows \"P \\<oplus> R \\<sim> Q \\<oplus> R\"\nproof -\n  let ?X = \"{(P \\<oplus> R, Q \\<oplus> R) | P Q R. P \\<sim> Q}\"\n  from assms have \"(P \\<oplus> R, Q \\<oplus> R) \\<in> ?X\" by blast\n  thus ?thesis\n    by(coinduct rule: bisimCoinduct) (auto dest: bisimE intro: reflexive sumPres)\nqed\n\n\n\n  shows \"<\\<nu>x>P \\<sim> <\\<nu>x>Q\"\nproof -\n  let ?X = \"{x. \\<exists>P Q. P \\<sim> Q \\<and> (\\<exists>a. x = (<\\<nu>a>P, <\\<nu>a>Q))}\"\n  from assms have \"(<\\<nu>x>P, <\\<nu>x>Q) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cSim xP xQ)\n    moreover {\n      fix P Q a\n      assume \"P \\<sim> Q\"\n      hence \"P \\<leadsto>[bisim] Q\" by(rule bisimE)\n      moreover have \"\\<And>P Q a. P \\<sim> Q \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> ?X \\<union> bisim\" by blast\n      moreover have \"bisim \\<subseteq> ?X \\<union> bisim\" by blast\n      moreover have \"eqvt bisim\" by(rule eqvt)\n      moreover have \"eqvt (?X \\<union> bisim)\" using eqvts\n        by(auto simp add: eqvt_def) blast\n      ultimately have \"<\\<nu>a>P \\<leadsto>[(?X \\<union> bisim)] <\\<nu>a>Q\"\n        by(rule Strong_Early_Sim_Pres.resPres)\n    }\n    ultimately show ?case by auto\n  next\n    case(cSym xP xQ)\n    thus ?case by(auto dest: bisimE)\n  qed\nqed\n\nlemma parPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n  and   T :: pi\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"P \\<parallel> R \\<sim> Q \\<parallel> R\"\nproof -\n  let ?X = \"{(resChain lst (P \\<parallel> R), resChain lst (Q \\<parallel> R)) | lst P Q R. P \\<sim> Q}\"\n  have BC: \"\\<And>P Q. P \\<parallel> Q = resChain [] (P \\<parallel> Q)\" by auto\n  from assms have \"(P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\" by(blast intro: BC)\n  thus ?thesis\n  proof(coinduct rule: bisimWeakCoinduct)\n    case(cSim PR QR)\n    moreover {\n      fix lst P Q R\n      assume \"P \\<sim> Q\"\n      have \"eqvt ?X\" using eqvts by(auto simp add: eqvt_def) blast\n      moreover have Res: \"\\<And>P Q x. (P, Q) \\<in> ?X \\<Longrightarrow> (<\\<nu>x>P, <\\<nu>x>Q) \\<in> ?X\"\n        by(auto, rule_tac x=\"x#lst\" in exI) auto\n      moreover {\n        from \\<open>P \\<sim> Q\\<close> have \"P \\<leadsto>[bisim] Q\" by(rule bisimE)\n        moreover note \\<open>P \\<sim> Q\\<close>\n        moreover have \"\\<And>P Q R. P \\<sim> Q \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\"\n          by(blast intro: BC)\n        ultimately have \"P \\<parallel> R \\<leadsto>[?X] Q \\<parallel> R\" using Res\n          by(rule parPres)\n      }\n\n      ultimately have \"resChain lst (P \\<parallel> R) \\<leadsto>[?X] resChain lst (Q \\<parallel> R)\"\n        by(rule resChainI)\n    }\n    ultimately show ?case by auto\n  next\n    case(cSym P Q)\n    thus ?case by(auto dest: bisimE)\n  qed\nqed\n\nlemma bangRelBisimE: \n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n\n  assumes A:   \"(P, Q) \\<in> bangRel Rel\"\n  and     Sym: \"\\<And>P Q. (P, Q) \\<in> Rel \\<Longrightarrow> (Q, P) \\<in> Rel\"\n\n  shows \"(Q, P) \\<in> bangRel Rel\"\nproof -\n  from A show ?thesis\n  proof(induct)\n    fix P Q\n    assume \"(P, Q) \\<in> Rel\"\n    hence \"(Q, P) \\<in> Rel\" by(rule Sym)\n    thus \"(!Q, !P) \\<in> bangRel Rel\" by(rule BRBang)\n  next\n    fix P Q R T\n    assume RRelT: \"(R, T) \\<in> Rel\"\n    assume IH: \"(Q, P) \\<in> bangRel Rel\"\n    from RRelT have \"(T, R) \\<in> Rel\" by(rule Sym)\n    thus \"(T \\<parallel> Q, R \\<parallel> P) \\<in> bangRel Rel\" using IH by(rule BRPar)\n  next\n    fix P Q a\n    assume \"(Q, P) \\<in> bangRel Rel\"\n    thus \"(<\\<nu>a>Q, <\\<nu>a>P) \\<in> bangRel Rel\" by(rule BRRes)\n  qed\nqed\n\n\n\n  assumes PBiSimQ: \"P \\<sim> Q\"\n\n  shows \"!P \\<sim> !Q\"\nproof -\n  let ?X = \"bangRel bisim\"\n    from PBiSimQ have \"(!P, !Q) \\<in> ?X\" by(rule BRBang)\n    thus ?thesis\n    proof(coinduct rule: bisimWeakCoinduct)\n      case(cSim bP bQ)\n      {\n        fix P Q\n        assume \"(P, Q) \\<in> ?X\"\n        hence \"P \\<leadsto>[?X] Q\"\n        proof(induct)\n          fix P Q\n          assume \"P \\<sim> Q\"\n          thus \"!P \\<leadsto>[?X] !Q\" using bisimE(1) eqvt\n            by(rule Strong_Early_Sim_Pres.bangPres)\n        next\n          fix P Q R T\n          assume RBiSimT: \"R \\<sim> T\"\n          assume PBangRelQ: \"(P, Q) \\<in> ?X\"\n          assume PSimQ: \"P \\<leadsto>[?X] Q\"\n          from RBiSimT  have \"R \\<leadsto>[bisim] T\" by(blast dest: bisimE)\n          thus \"R \\<parallel> P \\<leadsto>[?X] T \\<parallel> Q\" using PSimQ RBiSimT PBangRelQ BRPar BRRes eqvt eqvtBangRel\n            by(blast intro: Strong_Early_Sim_Pres.parCompose)\n        next\n          fix P Q a\n          assume \"P \\<leadsto>[?X] Q\"\n          moreover from eqvtBangRel eqvt have \"eqvt ?X\" by blast \n          ultimately show \"<\\<nu>a>P \\<leadsto>[?X] <\\<nu>a>Q\" using BRRes by(blast intro: Strong_Early_Sim_Pres.resPres)\n        qed\n      }\n      with \\<open>(bP, bQ) \\<in> ?X\\<close> show ?case by blast\n    next\n      case(cSym bP bQ)\n      thus ?case by(metis bangRelSymetric bisimE)\n  qed\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Strong_Early_Bisim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.629774621301746, "lm_q1q2_score": 0.32963685203300125}}
{"text": "theory GabrielaLimonta\nimports \"~~/src/HOL/IMP/Big_Step\" \"~~/src/HOL/IMP/Vars\"\nbegin\n\n(** Score: 1/5\n  5.1 Ran into trouble fast, due to wrong data-flow equations\n  5.2 Missing\n*)\n\nfun gen :: \"com \\<Rightarrow> (vname * aexp) set\"\nand \"kill\" :: \"com \\<Rightarrow> (vname * aexp) set\" where\n\"gen SKIP = {}\" |\n\"gen (x ::= a) = (if x \\<notin> vars a then {(x, a)} else {})\" |\n\"gen (c1 ;; c2) = (gen c1 - kill c2) \\<union> gen c2\" |\n\"gen (IF b THEN c1 ELSE c2) = (gen c1 - kill c2) \\<inter> gen c2\" | (* ? Why the \"- kill c2\", in a completely symmetric thing like an if ? *)\n\"gen (WHILE b DO c) = gen c\" | (* It may happen that the while-loop is not executed at all! *)\n\"kill SKIP = {}\" |\n\"kill (x ::= a) = {(y,e). y = x \\<and> e \\<noteq> a} \\<union> {(y,e). x \\<in> vars e}\" |\n\"kill (c1 ;; c2) = kill c1 \\<union> kill c2\" |\n\"kill (IF b THEN c1 ELSE c2) = kill c1 \\<union> kill c2\" |\n\"kill (WHILE b DO c) = kill c\"\n\n\ndefinition AD :: \"(vname * aexp) set \\<Rightarrow> com \\<Rightarrow> (vname * aexp) set\" where\n\"AD A c = gen c \\<union> (A - kill c)\"\n\nlemma \"{(''x'', (N 5)), (''y'', (N 8))} = AD {(''x'', (N 4)), (''y'', (N 8))} (''x'' ::= (N 5))\"\nby (auto simp: AD_def)\n\ntheorem \"\\<lbrakk> (c,s) \\<Rightarrow> s'; \\<forall> (x, a) \\<in> A. s x = aval a s \\<rbrakk>\n  \\<Longrightarrow> \\<forall> (x, a) \\<in> AD A c. s' x = aval a s'\"\nproof (induction arbitrary: A rule: big_step_induct)\nprint_cases\ncase (Skip s)\n  thus ?case using AD_def by auto\nnext\ncase (Assign x' a' s)\n  thus ?case using AD_def by (auto split: if_splits)\nnext\ncase (Seq c1 s1 s2 c2 s3) \n  thus ?case using AD_def sorry\nnext\ncase (IfTrue b s c1 t)\n  thus ?case using AD_def by auto\nnext\ncase (IfFalse b s c2 t)\n  thus ?case using AD_def by auto\nnext\ncase (WhileFalse b s)\n  thus ?case using AD_def and big_step.intros sorry\nnext\ncase (WhileTrue b s1 c s2 s3)\n  thus ?case using AD_def and big_step.intros sorry\nqed \n\nend\n", "meta": {"author": "glimonta", "repo": "Semantics", "sha": "68d3cacdb2101c7e7c67fd3065266bb37db5f760", "save_path": "github-repos/isabelle/glimonta-Semantics", "path": "github-repos/isabelle/glimonta-Semantics/Semantics-68d3cacdb2101c7e7c67fd3065266bb37db5f760/Exercise9/GabrielaLimontaFeedback.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3296368447588545}}
{"text": "(*  Title:      JinjaThreads/Compiler/Exception_Tables.thy\n    Author:     Andreas Lochbihler\n*)\n\nsection \\<open>Various Operations for Exception Tables\\<close>\n\ntheory Exception_Tables imports\n  Compiler2\n  \"../Common/ExternalCallWF\"\n  \"../JVM/JVMExceptions\"\nbegin\n\ndefinition pcs :: \"ex_table \\<Rightarrow> nat set\"\nwhere \"pcs xt  \\<equiv>  \\<Union>(f,t,C,h,d) \\<in> set xt. {f ..< t}\"\n\nlemma pcs_subset:\n  fixes e :: \"'addr expr1\" and es :: \"'addr expr1 list\"\n  shows \"pcs(compxE2 e pc d) \\<subseteq> {pc..<pc+size(compE2 e)}\"\n  and \"pcs(compxEs2 es pc d) \\<subseteq> {pc..<pc+size(compEs2 es)}\" \napply(induct e pc d and es pc d rule: compxE2_compxEs2_induct)\napply (simp_all add:pcs_def)\napply (fastforce)+\ndone\n\nlemma pcs_Nil [simp]: \"pcs [] = {}\"\nby(simp add:pcs_def)\n\nlemma pcs_Cons [simp]: \"pcs (x#xt) = {fst x ..< fst(snd x)} \\<union> pcs xt\"\nby(auto simp add: pcs_def)\n\nlemma pcs_append [simp]: \"pcs(xt\\<^sub>1 @ xt\\<^sub>2) = pcs xt\\<^sub>1 \\<union> pcs xt\\<^sub>2\"\nby(simp add:pcs_def)\n\n\n\nlemma [simp]: \"pc < pc0 \\<or> pc0+size(compEs2 es) \\<le> pc \\<Longrightarrow> pc \\<notin> pcs(compxEs2 es pc0 d)\"\nusing pcs_subset by fastforce\n\nlemma [simp]: \"pc1 + size(compE2 e1) \\<le> pc2 \\<Longrightarrow> pcs(compxE2 e1 pc1 d1) \\<inter> pcs(compxE2 e2 pc2 d2) = {}\"\nusing pcs_subset by fastforce\n\nlemma [simp]: \"pc\\<^sub>1 + size(compE2 e) \\<le> pc\\<^sub>2 \\<Longrightarrow> pcs(compxE2 e pc\\<^sub>1 d\\<^sub>1) \\<inter> pcs(compxEs2 es pc\\<^sub>2 d\\<^sub>2) = {}\"\nusing pcs_subset by fastforce\n\nlemma match_ex_table_append_not_pcs [simp]:\n \"pc \\<notin> pcs xt0 \\<Longrightarrow> match_ex_table P C pc (xt0 @ xt1) = match_ex_table P C pc xt1\"\nby (induct xt0) (auto simp: matches_ex_entry_def)\n\nlemma outside_pcs_not_matches_entry [simp]:\n  \"\\<lbrakk> x \\<in> set xt; pc \\<notin> pcs xt \\<rbrakk> \\<Longrightarrow> \\<not> matches_ex_entry P D pc x\"\nby(auto simp:matches_ex_entry_def pcs_def)\n\nlemma outside_pcs_compxE2_not_matches_entry [simp]:\n  assumes xe: \"xe \\<in> set(compxE2 e pc d)\"\n  and outside: \"pc' < pc \\<or> pc+size(compE2 e) \\<le> pc'\"\n  shows \"\\<not> matches_ex_entry P C pc' xe\"\nproof\n  assume \"matches_ex_entry P C pc' xe\"\n  with xe have \"pc' \\<in> pcs(compxE2 e pc d)\"\n    by(force simp add:matches_ex_entry_def pcs_def)\n  with outside show False by simp\nqed\n\nlemma outside_pcs_compxEs2_not_matches_entry [simp]:\n  assumes xe: \"xe \\<in> set(compxEs2 es pc d)\" \n  and outside: \"pc' < pc \\<or> pc+size(compEs2 es) \\<le> pc'\"\n  shows \"\\<not> matches_ex_entry P C pc' xe\"\nproof\n  assume \"matches_ex_entry P C pc' xe\"\n  with xe have \"pc' \\<in> pcs(compxEs2 es pc d)\"\n    by(force simp add:matches_ex_entry_def pcs_def)\n  with outside show False by simp\nqed\n\nlemma match_ex_table_app[simp]:\n  \"\\<forall>xte \\<in> set xt\\<^sub>1. \\<not> matches_ex_entry P D pc xte \\<Longrightarrow>\n  match_ex_table P D pc (xt\\<^sub>1 @ xt) = match_ex_table P D pc xt\"\nby(induct xt\\<^sub>1) simp_all\n\nlemma match_ex_table_eq_NoneI [simp]:\n  \"\\<forall>x \\<in> set xtab. \\<not> matches_ex_entry P C pc x \\<Longrightarrow>\n  match_ex_table P C pc xtab = None\"\nusing match_ex_table_app[where ?xt = \"[]\"] by fastforce\n\n\n\nlemma match_ex_entry:\n  fixes start shows\n  \"matches_ex_entry P C pc (start, end, catch_type, handler) =\n  (start \\<le> pc \\<and> pc < end \\<and> (case catch_type of None \\<Rightarrow> True | \\<lfloor>C'\\<rfloor> \\<Rightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* C'))\"\nby(simp add:matches_ex_entry_def)\n\nlemma pcs_compxE2D [dest]:\n  \"pc \\<in> pcs (compxE2 e pc' d) \\<Longrightarrow> pc' \\<le> pc \\<and> pc < pc' + length (compE2 e)\"\nusing pcs_subset by(fastforce)\n\nlemma pcs_compxEs2D [dest]:\n  \"pc \\<in> pcs (compxEs2 es pc' d) \\<Longrightarrow> pc' \\<le> pc \\<and> pc < pc' + length (compEs2 es)\"\nusing pcs_subset by(fastforce)\n\ndefinition shift :: \"nat \\<Rightarrow> ex_table \\<Rightarrow> ex_table\"\nwhere\n  \"shift n xt \\<equiv> map (\\<lambda>(from,to,C,handler,depth). (n+from,n+to,C,n+handler,depth)) xt\"\n\nlemma shift_0 [simp]: \"shift 0 xt = xt\"\nby(induct xt)(auto simp:shift_def)\n\nlemma shift_Nil [simp]: \"shift n [] = []\"\nby(simp add:shift_def)\n\nlemma shift_Cons_tuple [simp]:\n  \"shift n ((from, to, C, handler, depth) # xt) = (from + n, to + n, C, handler + n, depth) # shift n xt\"\nby(simp add: shift_def)\n\nlemma shift_append [simp]: \"shift n (xt\\<^sub>1 @ xt\\<^sub>2) = shift n xt\\<^sub>1 @ shift n xt\\<^sub>2\"\nby(simp add:shift_def)\n\nlemma shift_shift [simp]: \"shift m (shift n xt) = shift (m+n) xt\"\nby(simp add: shift_def split_def)\n\nlemma fixes e :: \"'addr expr1\" and es :: \"'addr expr1 list\"\n  shows shift_compxE2: \"shift pc (compxE2 e pc' d) = compxE2 e (pc' + pc) d\"\n  and  shift_compxEs2: \"shift pc (compxEs2 es pc' d) = compxEs2 es (pc' + pc) d\"\nby(induct e and es arbitrary: pc pc' d and pc pc' d rule: compE2.induct compEs2.induct)\n  (auto simp:shift_def ac_simps)\n\nlemma compxE2_size_convs [simp]: \"n \\<noteq> 0 \\<Longrightarrow> compxE2 e n d = shift n (compxE2 e 0 d)\"\n and compxEs2_size_convs: \"n \\<noteq> 0 \\<Longrightarrow> compxEs2 es n d = shift n (compxEs2 es 0 d)\" \nby(simp_all add:shift_compxE2 shift_compxEs2)\n\nlemma pcs_shift_conv [simp]: \"pcs (shift n xt) = (+) n ` pcs xt\"\napply(auto simp add: shift_def pcs_def)\napply(rule_tac x=\"x-n\" in image_eqI)\napply(auto)\napply(rule bexI)\n prefer 2\n apply(assumption)\napply(auto)\ndone\n\nlemma image_plus_const_conv [simp]:\n  fixes m :: nat\n  shows \"m \\<in> (+) n ` A \\<longleftrightarrow> m \\<ge> n \\<and> m - n \\<in> A\"\nby(force)\n\nlemma match_ex_table_shift_eq_None_conv [simp]:\n  \"match_ex_table P C pc (shift n xt) = None \\<longleftrightarrow> pc < n \\<or> match_ex_table P C (pc - n) xt = None\"\nby(induct xt)(auto simp add: match_ex_entry split: if_split_asm)\n\nlemma match_ex_table_shift_pc_None:\n  \"pc \\<ge> n \\<Longrightarrow> match_ex_table P C pc (shift n xt) = None \\<longleftrightarrow> match_ex_table P C (pc - n) xt = None\"\nby(simp add: match_ex_table_shift_eq_None_conv)\n\nlemma match_ex_table_shift_eq_Some_conv [simp]:\n  \"match_ex_table P C pc (shift n xt) = \\<lfloor>(pc', d)\\<rfloor> \\<longleftrightarrow>\n   pc \\<ge> n \\<and> pc' \\<ge> n \\<and> match_ex_table P C (pc - n) xt = \\<lfloor>(pc' - n, d)\\<rfloor>\"\nby(induct xt)(auto simp add: match_ex_entry split: if_split_asm)\n\nlemma match_ex_table_shift:\n \"match_ex_table P C pc xt = \\<lfloor>(pc', d)\\<rfloor> \\<Longrightarrow> match_ex_table P C (n + pc) (shift n xt) = \\<lfloor>(n + pc', d)\\<rfloor>\"\nby(simp add: match_ex_table_shift_eq_Some_conv)\n\nlemma match_ex_table_shift_pcD:\n  \"match_ex_table P C pc (shift n xt) = \\<lfloor>(pc', d)\\<rfloor> \\<Longrightarrow> pc \\<ge> n \\<and> pc' \\<ge> n \\<and> match_ex_table P C (pc - n) xt = \\<lfloor>(pc' - n, d)\\<rfloor>\"\nby(simp add: match_ex_table_shift_eq_Some_conv)\n\nlemma match_ex_table_pcsD: \"match_ex_table P C pc xt = \\<lfloor>(pc', D)\\<rfloor> \\<Longrightarrow> pc \\<in> pcs xt\"\nby(induct xt)(auto split: if_split_asm simp add: match_ex_entry)\n\n\ndefinition stack_xlift :: \"nat \\<Rightarrow> ex_table \\<Rightarrow> ex_table\"\nwhere \"stack_xlift n xt \\<equiv> map (\\<lambda>(from,to,C,handler,depth). (from, to, C, handler, n + depth)) xt\"\n\nlemma stack_xlift_0 [simp]: \"stack_xlift 0 xt = xt\"\nby(induct xt, auto simp add: stack_xlift_def)\n\nlemma stack_xlift_Nil [simp]: \"stack_xlift n [] = []\"\nby(simp add: stack_xlift_def)\n\nlemma stack_xlift_Cons_tuple [simp]:\n  \"stack_xlift n ((from, to, C, handler, depth) # xt) = (from, to, C, handler, depth + n) # stack_xlift n xt\"\nby(simp add: stack_xlift_def)\n\nlemma stack_xlift_append [simp]: \"stack_xlift n (xt @ xt') = stack_xlift n xt @ stack_xlift n xt'\"\nby(simp add: stack_xlift_def)\n\nlemma stack_xlift_stack_xlift [simp]: \"stack_xlift n (stack_xlift m xt) = stack_xlift (n + m) xt\"\nby(simp add: stack_xlift_def split_def)\n\nlemma fixes e :: \"'addr expr1\" and es :: \"'addr expr1 list\"\n  shows stack_xlift_compxE2: \"stack_xlift n (compxE2 e pc d) = compxE2 e pc (n + d)\"\n  and stack_xlift_compxEs2: \"stack_xlift n (compxEs2 es pc d) = compxEs2 es pc (n + d)\"\nby(induct e and es arbitrary: d pc and d pc rule: compE2.induct compEs2.induct)\n  (auto simp add: shift_compxE2 simp del: compxE2_size_convs)\n\nlemma compxE2_stack_xlift_convs [simp]: \"d > 0 \\<Longrightarrow> compxE2 e pc d = stack_xlift d (compxE2 e pc 0)\"\n  and compxEs2_stack_xlift_convs [simp]: \"d > 0 \\<Longrightarrow> compxEs2 es pc d = stack_xlift d (compxEs2 es pc 0)\"\nby(simp_all add: stack_xlift_compxE2 stack_xlift_compxEs2)\n\nlemma stack_xlift_shift [simp]: \"stack_xlift d (shift n xt) = shift n (stack_xlift d xt)\"\nby(induct xt)(auto)\n\nlemma pcs_stack_xlift_conv [simp]: \"pcs (stack_xlift n xt) = pcs xt\"\nby(auto simp add: pcs_def stack_xlift_def)\n\nlemma match_ex_table_stack_xlift_eq_None_conv [simp]:\n  \"match_ex_table P C pc (stack_xlift d xt) = None \\<longleftrightarrow> match_ex_table P C pc xt = None\"\nby(induct xt)(auto simp add: match_ex_entry)\n\nlemma match_ex_table_stack_xlift_eq_Some_conv [simp]:\n  \"match_ex_table P C pc (stack_xlift n xt) = \\<lfloor>(pc', d)\\<rfloor> \\<longleftrightarrow> d \\<ge> n \\<and> match_ex_table P C pc xt = \\<lfloor>(pc', d - n)\\<rfloor>\"\nby(induct xt)(auto simp add: match_ex_entry)\n\nlemma match_ex_table_stack_xliftD:\n  \"match_ex_table P C pc (stack_xlift n xt) = \\<lfloor>(pc', d)\\<rfloor> \\<Longrightarrow> d \\<ge> n \\<and> match_ex_table P C pc xt = \\<lfloor>(pc', d - n)\\<rfloor>\"\nby(simp)\n\nlemma match_ex_table_stack_xlift:\n  \"match_ex_table P C pc xt = \\<lfloor>(pc', d)\\<rfloor> \\<Longrightarrow> match_ex_table P C pc (stack_xlift n xt) = \\<lfloor>(pc', n + d)\\<rfloor>\"\nby simp\n\nlemma pcs_stack_xlift: \"pcs (stack_xlift n xt) = pcs xt\"\nby(auto simp add: stack_xlift_def pcs_def)\n\nlemma match_ex_table_None_append [simp]:\n  \"match_ex_table P C pc xt = None\n  \\<Longrightarrow> match_ex_table P C pc (xt @ xt') = match_ex_table P C pc xt'\"\nby(induct xt, auto)\n\nlemma match_ex_table_Some_append [simp]: \n  \"match_ex_table P C pc xt = \\<lfloor>(pc', d)\\<rfloor> \\<Longrightarrow> match_ex_table P C pc (xt @ xt') = \\<lfloor>(pc', d)\\<rfloor>\"\nby(induct xt)(auto)\n\nlemma match_ex_table_append:\n  \"match_ex_table P C pc (xt @ xt') = (case match_ex_table P C pc xt of None \\<Rightarrow> match_ex_table P C pc xt' \n                                                                  | Some pcd \\<Rightarrow> Some pcd)\"\nby(auto)\n\nlemma match_ex_table_pc_length_compE2:\n  \"match_ex_table P a pc (compxE2 e pc' d) = \\<lfloor>pcd\\<rfloor> \\<Longrightarrow> pc' \\<le> pc \\<and> pc < length (compE2 e) + pc'\"\n  \n  and match_ex_table_pc_length_compEs2:\n  \"match_ex_table P a pc (compxEs2 es pc' d) = \\<lfloor>pcd\\<rfloor> \\<Longrightarrow> pc' \\<le> pc \\<and> pc < length (compEs2 es) + pc'\"\nusing pcs_subset by(cases pcd, fastforce dest!: match_ex_table_pcsD)+\n\nlemma match_ex_table_compxE2_shift_conv:\n  \"f > 0 \\<Longrightarrow> match_ex_table P C pc (compxE2 e f d) = \\<lfloor>(pc', d')\\<rfloor> \\<longleftrightarrow> pc \\<ge> f \\<and> pc' \\<ge> f \\<and> match_ex_table P C (pc - f) (compxE2 e 0 d) = \\<lfloor>(pc' - f, d')\\<rfloor>\"\nby simp\n\nlemma match_ex_table_compxEs2_shift_conv:\n  \"f > 0 \\<Longrightarrow> match_ex_table P C pc (compxEs2 es f d) = \\<lfloor>(pc', d')\\<rfloor> \\<longleftrightarrow> pc \\<ge> f \\<and> pc' \\<ge> f \\<and> match_ex_table P C (pc - f) (compxEs2 es 0 d) = \\<lfloor>(pc' - f, d')\\<rfloor>\"\nby(simp add: compxEs2_size_convs)\n\nlemma match_ex_table_compxE2_stack_conv:\n  \"d > 0 \\<Longrightarrow> match_ex_table P C pc (compxE2 e 0 d) = \\<lfloor>(pc', d')\\<rfloor> \\<longleftrightarrow> d' \\<ge> d \\<and> match_ex_table P C pc (compxE2 e 0 0) = \\<lfloor>(pc', d' - d)\\<rfloor>\"\nby simp\n\nlemma match_ex_table_compxEs2_stack_conv:\n  \"d > 0 \\<Longrightarrow> match_ex_table P C pc (compxEs2 es 0 d) = \\<lfloor>(pc', d')\\<rfloor> \\<longleftrightarrow> d' \\<ge> d \\<and> match_ex_table P C pc (compxEs2 es 0 0) = \\<lfloor>(pc', d' - d)\\<rfloor>\"\nby(simp add: compxEs2_stack_xlift_convs)\n\nlemma fixes e :: \"'addr expr1\" and es :: \"'addr expr1 list\"\n  shows match_ex_table_compxE2_not_same: \"match_ex_table P C pc (compxE2 e n d) = \\<lfloor>(pc', d')\\<rfloor> \\<Longrightarrow> pc \\<noteq> pc'\"\n  and match_ex_table_compxEs2_not_same:\"match_ex_table P C pc (compxEs2 es n d) = \\<lfloor>(pc', d')\\<rfloor> \\<Longrightarrow> pc \\<noteq> pc'\"\napply(induct e n d and es n d rule: compxE2_compxEs2_induct)\napply(auto simp add: match_ex_table_append match_ex_entry simp del: compxE2_size_convs compxEs2_size_convs compxE2_stack_xlift_convs compxEs2_stack_xlift_convs split: if_split_asm)\ndone\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Compiler/Exception_Tables.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3296368447588545}}
{"text": "(*  Title:      HOL/Auth/OtwayRees_AN.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n*)\n\nsection\\<open>The Otway-Rees Protocol as Modified by Abadi and Needham\\<close>\n\ntheory OtwayRees_AN imports Public begin\n\ntext\\<open>\nThis simplified version has minimal encryption and explicit messages.\n\nNote that the formalization does not even assume that nonces are fresh.\nThis is because the protocol does not rely on uniqueness of nonces for\nsecurity, only for freshness, and the proof script does not prove freshness\nproperties.\n\nFrom page 11 of\n  Abadi and Needham (1996).  \n  Prudent Engineering Practice for Cryptographic Protocols.\n  IEEE Trans. SE 22 (1)\n\\<close>\n\ninductive_set otway :: \"event list set\"\n  where\n   Nil: \\<comment> \\<open>The empty trace\\<close>\n        \"[] \\<in> otway\"\n\n | Fake: \\<comment> \\<open>The Spy may say anything he can say.  The sender field is correct,\n            but agents don't use that information.\\<close>\n         \"\\<lbrakk>evsf \\<in> otway;  X \\<in> synth (analz (knows Spy evsf))\\<rbrakk>\n          \\<Longrightarrow> Says Spy B X  # evsf \\<in> otway\"\n\n        \n | Reception: \\<comment> \\<open>A message that has been sent can be received by the\n                  intended recipient.\\<close>\n              \"\\<lbrakk>evsr \\<in> otway;  Says A B X \\<in>set evsr\\<rbrakk>\n               \\<Longrightarrow> Gets B X # evsr \\<in> otway\"\n\n | OR1:  \\<comment> \\<open>Alice initiates a protocol run\\<close>\n         \"evs1 \\<in> otway\n          \\<Longrightarrow> Says A B \\<lbrace>Agent A, Agent B, Nonce NA\\<rbrace> # evs1 \\<in> otway\"\n\n | OR2:  \\<comment> \\<open>Bob's response to Alice's message.\\<close>\n         \"\\<lbrakk>evs2 \\<in> otway;\n             Gets B \\<lbrace>Agent A, Agent B, Nonce NA\\<rbrace> \\<in>set evs2\\<rbrakk>\n          \\<Longrightarrow> Says B Server \\<lbrace>Agent A, Agent B, Nonce NA, Nonce NB\\<rbrace>\n                 # evs2 \\<in> otway\"\n\n | OR3:  \\<comment> \\<open>The Server receives Bob's message.  Then he sends a new\n           session key to Bob with a packet for forwarding to Alice.\\<close>\n         \"\\<lbrakk>evs3 \\<in> otway;  Key KAB \\<notin> used evs3;\n             Gets Server \\<lbrace>Agent A, Agent B, Nonce NA, Nonce NB\\<rbrace>\n               \\<in>set evs3\\<rbrakk>\n          \\<Longrightarrow> Says Server B\n               \\<lbrace>Crypt (shrK A) \\<lbrace>Nonce NA, Agent A, Agent B, Key KAB\\<rbrace>,\n                 Crypt (shrK B) \\<lbrace>Nonce NB, Agent A, Agent B, Key KAB\\<rbrace>\\<rbrace>\n              # evs3 \\<in> otway\"\n\n | OR4:  \\<comment> \\<open>Bob receives the Server's (?) message and compares the Nonces with\n             those in the message he previously sent the Server.\n             Need \\<^term>\\<open>B \\<noteq> Server\\<close> because we allow messages to self.\\<close>\n         \"\\<lbrakk>evs4 \\<in> otway;  B \\<noteq> Server;\n             Says B Server \\<lbrace>Agent A, Agent B, Nonce NA, Nonce NB\\<rbrace> \\<in>set evs4;\n             Gets B \\<lbrace>X, Crypt(shrK B)\\<lbrace>Nonce NB,Agent A,Agent B,Key K\\<rbrace>\\<rbrace>\n               \\<in>set evs4\\<rbrakk>\n          \\<Longrightarrow> Says B A X # evs4 \\<in> otway\"\n\n | Oops: \\<comment> \\<open>This message models possible leaks of session keys.  The nonces\n             identify the protocol run.\\<close>\n         \"\\<lbrakk>evso \\<in> otway;\n             Says Server B\n                      \\<lbrace>Crypt (shrK A) \\<lbrace>Nonce NA, Agent A, Agent B, Key K\\<rbrace>,\n                        Crypt (shrK B) \\<lbrace>Nonce NB, Agent A, Agent B, Key K\\<rbrace>\\<rbrace>\n               \\<in>set evso\\<rbrakk>\n          \\<Longrightarrow> Notes Spy \\<lbrace>Nonce NA, Nonce NB, Key K\\<rbrace> # evso \\<in> otway\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body  [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\n\n\ntext\\<open>A \"possibility property\": there are traces that reach the end\\<close>\nlemma \"\\<lbrakk>B \\<noteq> Server; Key K \\<notin> used []\\<rbrakk>\n      \\<Longrightarrow> \\<exists>evs \\<in> otway.\n           Says B A (Crypt (shrK A) \\<lbrace>Nonce NA, Agent A, Agent B, Key K\\<rbrace>)\n             \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] otway.Nil\n                    [THEN otway.OR1, THEN otway.Reception,\n                     THEN otway.OR2, THEN otway.Reception,\n                     THEN otway.OR3, THEN otway.Reception, THEN otway.OR4])\napply (possibility, simp add: used_Cons) \ndone\n\nlemma Gets_imp_Says [dest!]:\n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> otway\\<rbrakk> \\<Longrightarrow> \\<exists>A. Says A B X \\<in> set evs\"\nby (erule rev_mp, erule otway.induct, auto)\n\n\n\ntext\\<open>For reasoning about the encrypted portion of messages\\<close>\n\nlemma OR4_analz_knows_Spy:\n     \"\\<lbrakk>Gets B \\<lbrace>X, Crypt(shrK B) X'\\<rbrace> \\<in> set evs;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> X \\<in> analz (knows Spy evs)\"\nby blast\n\n\ntext\\<open>Theorems of the form \\<^term>\\<open>X \\<notin> parts (spies evs)\\<close> imply that\nNOBODY sends messages containing X!\\<close>\n\ntext\\<open>Spy never sees a good agent's shared key!\\<close>\nlemma Spy_see_shrK [simp]:\n     \"evs \\<in> otway \\<Longrightarrow> (Key (shrK A) \\<in> parts (knows Spy evs)) = (A \\<in> bad)\"\nby (erule otway.induct, simp_all, blast+)\n\nlemma Spy_analz_shrK [simp]:\n     \"evs \\<in> otway \\<Longrightarrow> (Key (shrK A) \\<in> analz (knows Spy evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"\\<lbrakk>Key (shrK A) \\<in> parts (knows Spy evs);  evs \\<in> otway\\<rbrakk> \\<Longrightarrow> A \\<in> bad\"\nby (blast dest: Spy_see_shrK)\n\n\nsubsection\\<open>Proofs involving analz\\<close>\n\ntext\\<open>Describes the form of K and NA when the Server sends this message.\\<close>\nlemma Says_Server_message_form:\n     \"\\<lbrakk>Says Server B\n            \\<lbrace>Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, Key K\\<rbrace>,\n              Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, Key K\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> K \\<notin> range shrK \\<and> (\\<exists>i. NA = Nonce i) \\<and> (\\<exists>j. NB = Nonce j)\"\napply (erule rev_mp)\napply (erule otway.induct, auto)\ndone\n\n\n\n(****\n The following is to prove theorems of the form\n\n  Key K \\<in> analz (insert (Key KAB) (knows Spy evs)) \\<Longrightarrow>\n  Key K \\<in> analz (knows Spy evs)\n\n A more general formula must be proved inductively.\n****)\n\n\ntext\\<open>Session keys are not used to encrypt other session keys\\<close>\n\ntext\\<open>The equality makes the induction hypothesis easier to apply\\<close>\nlemma analz_image_freshK [rule_format]:\n \"evs \\<in> otway \\<Longrightarrow>\n   \\<forall>K KK. KK \\<subseteq> -(range shrK) \\<longrightarrow>\n          (Key K \\<in> analz (Key`KK \\<union> (knows Spy evs))) =\n          (K \\<in> KK | Key K \\<in> analz (knows Spy evs))\"\napply (erule otway.induct) \napply (frule_tac [8] Says_Server_message_form)\napply (drule_tac [7] OR4_analz_knows_Spy, analz_freshK, spy_analz, auto) \ndone\n\nlemma analz_insert_freshK:\n  \"\\<lbrakk>evs \\<in> otway;  KAB \\<notin> range shrK\\<rbrakk> \\<Longrightarrow>\n      (Key K \\<in> analz (insert (Key KAB) (knows Spy evs))) =\n      (K = KAB | Key K \\<in> analz (knows Spy evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\n\ntext\\<open>The Key K uniquely identifies the Server's message.\\<close>\nlemma unique_session_keys:\n     \"\\<lbrakk>Says Server B\n          \\<lbrace>Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, K\\<rbrace>,\n            Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, K\\<rbrace>\\<rbrace>\n         \\<in> set evs;\n        Says Server B'\n          \\<lbrace>Crypt (shrK A') \\<lbrace>NA', Agent A', Agent B', K\\<rbrace>,\n            Crypt (shrK B') \\<lbrace>NB', Agent A', Agent B', K\\<rbrace>\\<rbrace>\n         \\<in> set evs;\n        evs \\<in> otway\\<rbrakk>\n     \\<Longrightarrow> A=A' \\<and> B=B' \\<and> NA=NA' \\<and> NB=NB'\"\napply (erule rev_mp, erule rev_mp, erule otway.induct, simp_all)\napply blast+  \\<comment> \\<open>OR3 and OR4\\<close>\ndone\n\n\nsubsection\\<open>Authenticity properties relating to NA\\<close>\n\ntext\\<open>If the encrypted message appears then it originated with the Server!\\<close>\nlemma NA_Crypt_imp_Server_msg [rule_format]:\n    \"\\<lbrakk>A \\<notin> bad;  A \\<noteq> B;  evs \\<in> otway\\<rbrakk>\n     \\<Longrightarrow> Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, Key K\\<rbrace> \\<in> parts (knows Spy evs)\n       \\<longrightarrow> (\\<exists>NB. Says Server B\n                    \\<lbrace>Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, Key K\\<rbrace>,\n                      Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, Key K\\<rbrace>\\<rbrace>\n                    \\<in> set evs)\"\napply (erule otway.induct, force)\napply (simp_all add: ex_disj_distrib)\napply blast+  \\<comment> \\<open>Fake, OR3\\<close>\ndone\n\n\ntext\\<open>Corollary: if A receives B's OR4 message then it originated with the\n      Server. Freshness may be inferred from nonce NA.\\<close>\nlemma A_trusts_OR4:\n     \"\\<lbrakk>Says B' A (Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, Key K\\<rbrace>) \\<in> set evs;\n         A \\<notin> bad;  A \\<noteq> B;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> \\<exists>NB. Says Server B\n                  \\<lbrace>Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, Key K\\<rbrace>,\n                    Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, Key K\\<rbrace>\\<rbrace>\n                 \\<in> set evs\"\nby (blast intro!: NA_Crypt_imp_Server_msg)\n\n\ntext\\<open>Crucial secrecy property: Spy does not see the keys sent in msg OR3\n    Does not in itself guarantee security: an attack could violate\n    the premises, e.g. by having \\<^term>\\<open>A=Spy\\<close>\\<close>\nlemma secrecy_lemma:\n     \"\\<lbrakk>A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> Says Server B\n           \\<lbrace>Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, Key K\\<rbrace>,\n             Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, Key K\\<rbrace>\\<rbrace>\n          \\<in> set evs \\<longrightarrow>\n          Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs \\<longrightarrow>\n          Key K \\<notin> analz (knows Spy evs)\"\napply (erule otway.induct, force)\napply (frule_tac [7] Says_Server_message_form)\napply (drule_tac [6] OR4_analz_knows_Spy)\napply (simp_all add: analz_insert_eq analz_insert_freshK pushes)\napply spy_analz  \\<comment> \\<open>Fake\\<close>\napply (blast dest: unique_session_keys)+  \\<comment> \\<open>OR3, OR4, Oops\\<close>\ndone\n\n\nlemma Spy_not_see_encrypted_key:\n     \"\\<lbrakk>Says Server B\n            \\<lbrace>Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, Key K\\<rbrace>,\n              Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, Key K\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\n  by (metis secrecy_lemma)\n\n\ntext\\<open>A's guarantee.  The Oops premise quantifies over NB because A cannot know\n  what it is.\\<close>\nlemma A_gets_good_key:\n     \"\\<lbrakk>Says B' A (Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, Key K\\<rbrace>) \\<in> set evs;\n         \\<forall>NB. Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  A \\<noteq> B;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\n  by (metis A_trusts_OR4 secrecy_lemma)\n\n\n\nsubsection\\<open>Authenticity properties relating to NB\\<close>\n\ntext\\<open>If the encrypted message appears then it originated with the Server!\\<close>\nlemma NB_Crypt_imp_Server_msg [rule_format]:\n \"\\<lbrakk>B \\<notin> bad;  A \\<noteq> B;  evs \\<in> otway\\<rbrakk>\n  \\<Longrightarrow> Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, Key K\\<rbrace> \\<in> parts (knows Spy evs)\n      \\<longrightarrow> (\\<exists>NA. Says Server B\n                   \\<lbrace>Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, Key K\\<rbrace>,\n                     Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, Key K\\<rbrace>\\<rbrace>\n                   \\<in> set evs)\"\napply (erule otway.induct, force, simp_all add: ex_disj_distrib)\napply blast+  \\<comment> \\<open>Fake, OR3\\<close>\ndone\n\n\n\ntext\\<open>Guarantee for B: if it gets a well-formed certificate then the Server\n  has sent the correct message in round 3.\\<close>\nlemma B_trusts_OR3:\n     \"\\<lbrakk>Says S B \\<lbrace>X, Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, Key K\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         B \\<notin> bad;  A \\<noteq> B;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> \\<exists>NA. Says Server B\n                   \\<lbrace>Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B, Key K\\<rbrace>,\n                     Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, Key K\\<rbrace>\\<rbrace>\n                   \\<in> set evs\"\nby (blast intro!: NB_Crypt_imp_Server_msg)\n\n\ntext\\<open>The obvious combination of \\<open>B_trusts_OR3\\<close> with \n      \\<open>Spy_not_see_encrypted_key\\<close>\\<close>\nlemma B_gets_good_key:\n     \"\\<lbrakk>Gets B \\<lbrace>X, Crypt (shrK B) \\<lbrace>NB, Agent A, Agent B, Key K\\<rbrace>\\<rbrace>\n          \\<in> set evs;\n         \\<forall>NA. Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  A \\<noteq> B;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest: B_trusts_OR3 Spy_not_see_encrypted_key)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/OtwayRees_AN.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3296368447588545}}
{"text": "section \\<open>Writer monad transformer\\<close>\n\ntheory Writer_Transformer\nimports Writer_Monad\nbegin\n\nsubsection \\<open>Type definition\\<close>\n\ntext \\<open>Below is the standard Haskell definition of a writer monad\ntransformer:\\<close>\n\ntext_raw \\<open>\n\\begin{verbatim}\nnewtype WriterT w m a = WriterT { runWriterT :: m (a, w) }\n\\end{verbatim}\n\\<close>\n\ntext \\<open>In this development, since a lazy pair type is not pre-defined\nin HOLCF, we will use an equivalent formulation in terms of our\nprevious \\texttt{Writer} type:\\<close>\n\ntext_raw \\<open>\n\\begin{verbatim}\ndata Writer w a = Writer w a\nnewtype WriterT w m a = WriterT { runWriterT :: m (Writer w a) }\n\\end{verbatim}\n\\<close>\n\ntext \\<open>We can translate this definition directly into HOLCF using\n\\<open>tycondef\\<close>. \\medskip\\<close>\n\ntycondef 'a\\<cdot>('m::\"functor\",'w) writerT =\n  WriterT (runWriterT :: \"('a\\<cdot>'w writer)\\<cdot>'m\")\n\nlemma coerce_writerT_abs [simp]:\n  \"coerce\\<cdot>(writerT_abs\\<cdot>x) = writerT_abs\\<cdot>(coerce\\<cdot>x)\"\napply (simp add: writerT_abs_def coerce_def)\napply (simp add: emb_prj_emb prj_emb_prj DEFL_eq_writerT)\ndone\n\nlemma coerce_WriterT [simp]: \"coerce\\<cdot>(WriterT\\<cdot>k) = WriterT\\<cdot>(coerce\\<cdot>k)\"\nunfolding WriterT_def by simp\n\nlemma writerT_cases [case_names WriterT]:\n  obtains k where \"y = WriterT\\<cdot>k\"\nproof\n  show \"y = WriterT\\<cdot>(runWriterT\\<cdot>y)\"\n    by (cases y, simp_all)\nqed\n\nlemma WriterT_runWriterT [simp]: \"WriterT\\<cdot>(runWriterT\\<cdot>m) = m\"\nby (cases m rule: writerT_cases, simp)\n\nlemma writerT_induct [case_names WriterT]:\n  fixes P :: \"'a\\<cdot>('f::functor,'e) writerT \\<Rightarrow> bool\"\n  assumes \"\\<And>k. P (WriterT\\<cdot>k)\"\n  shows \"P y\"\nby (cases y rule: writerT_cases, simp add: assms)\n\nlemma writerT_eq_iff:\n  \"a = b \\<longleftrightarrow> runWriterT\\<cdot>a = runWriterT\\<cdot>b\"\napply (cases a rule: writerT_cases)\napply (cases b rule: writerT_cases)\napply simp\ndone\n\nlemma writerT_below_iff:\n  \"a \\<sqsubseteq> b \\<longleftrightarrow> runWriterT\\<cdot>a \\<sqsubseteq> runWriterT\\<cdot>b\"\napply (cases a rule: writerT_cases)\napply (cases b rule: writerT_cases)\napply simp\ndone\n\nlemma writerT_eqI:\n  \"runWriterT\\<cdot>a = runWriterT\\<cdot>b \\<Longrightarrow> a = b\"\nby (simp add: writerT_eq_iff)\n\nlemma writerT_belowI:\n  \"runWriterT\\<cdot>a \\<sqsubseteq> runWriterT\\<cdot>b \\<Longrightarrow> a \\<sqsubseteq> b\"\nby (simp add: writerT_below_iff)\n\nlemma runWriterT_coerce [simp]:\n  \"runWriterT\\<cdot>(coerce\\<cdot>k) = coerce\\<cdot>(runWriterT\\<cdot>k)\"\nby (induct k rule: writerT_induct, simp)\n\nsubsection \\<open>Functor class instance\\<close>\n\nlemma fmap_writer_def: \"fmap = writer_map\\<cdot>ID\"\napply (rule cfun_eqI, rename_tac f)\napply (rule cfun_eqI, rename_tac x)\napply (case_tac x rule: writer.exhaust, simp_all)\napply (simp add: writer_map_def fix_const)\napply (simp add: writer_map_def fix_const Writer_def)\ndone\n\nlemma fmapU_WriterT [simp]:\n  \"fmapU\\<cdot>f\\<cdot>(WriterT\\<cdot>m) = WriterT\\<cdot>(fmap\\<cdot>(fmap\\<cdot>f)\\<cdot>m)\"\nunfolding fmapU_writerT_def writerT_map_def fmap_writer_def fix_const\n  WriterT_def by simp\n\nlemma runWriterT_fmapU [simp]:\n  \"runWriterT\\<cdot>(fmapU\\<cdot>f\\<cdot>m) = fmap\\<cdot>(fmap\\<cdot>f)\\<cdot>(runWriterT\\<cdot>m)\"\nby (induct m rule: writerT_induct) simp\n\ninstance writerT :: (\"functor\", \"domain\") \"functor\"\nproof\n  fix f g :: \"udom \\<rightarrow> udom\" and xs :: \"udom\\<cdot>('a,'b) writerT\"\n  show \"fmapU\\<cdot>f\\<cdot>(fmapU\\<cdot>g\\<cdot>xs) = fmapU\\<cdot>(\\<Lambda> x. f\\<cdot>(g\\<cdot>x))\\<cdot>xs\"\n    apply (induct xs rule: writerT_induct)\n    apply (simp add: fmap_fmap eta_cfun)\n    done\nqed\n\nsubsection \\<open>Monad operations\\<close>\n\ntext \\<open>The writer monad transformer does not yield a monad in the\nusual sense: We cannot prove a \\<open>monad\\<close> class instance, because\ntype \\<open>'a\\<cdot>('m,'w) writerT\\<close> contains values that break the monad\nlaws. However, it turns out that such values are inaccessible: The\nmonad laws are satisfied by all values constructible from the abstract\noperations.\\<close>\n\ntext \\<open>To explore the properties of the writer monad transformer\noperations, we define them all as non-overloaded functions. \\medskip\n\\<close>\n\ndefinition unitWT :: \"'a \\<rightarrow> 'a\\<cdot>('m::monad,'w::monoid) writerT\"\n  where \"unitWT = (\\<Lambda> x. WriterT\\<cdot>(return\\<cdot>(Writer\\<cdot>mempty\\<cdot>x)))\"\n\ndefinition bindWT :: \"'a\\<cdot>('m::monad,'w::monoid) writerT \\<rightarrow> ('a \\<rightarrow> 'b\\<cdot>('m,'w) writerT) \\<rightarrow> 'b\\<cdot>('m,'w) writerT\"\n  where \"bindWT = (\\<Lambda> m k. WriterT\\<cdot>(bind\\<cdot>(runWriterT\\<cdot>m)\\<cdot>\n    (\\<Lambda>(Writer\\<cdot>w\\<cdot>x). bind\\<cdot>(runWriterT\\<cdot>(k\\<cdot>x))\\<cdot>(\\<Lambda>(Writer\\<cdot>w'\\<cdot>y).\n      return\\<cdot>(Writer\\<cdot>(mappend\\<cdot>w\\<cdot>w')\\<cdot>y)))))\"\n\ndefinition liftWT :: \"'a\\<cdot>'m \\<rightarrow> 'a\\<cdot>('m::monad,'w::monoid) writerT\"\n  where \"liftWT = (\\<Lambda> m. WriterT\\<cdot>(fmap\\<cdot>(Writer\\<cdot>mempty)\\<cdot>m))\"\n\ndefinition tellWT :: \"'a \\<rightarrow> 'w \\<rightarrow> 'a\\<cdot>('m::monad,'w::monoid) writerT\"\n  where \"tellWT = (\\<Lambda> x w. WriterT\\<cdot>(return\\<cdot>(Writer\\<cdot>w\\<cdot>x)))\"\n\ndefinition fmapWT :: \"('a \\<rightarrow> 'b) \\<rightarrow> 'a\\<cdot>('m::monad,'w::monoid) writerT \\<rightarrow> 'b\\<cdot>('m,'w) writerT\"\n  where \"fmapWT = (\\<Lambda> f m. bindWT\\<cdot>m\\<cdot>(\\<Lambda> x. unitWT\\<cdot>(f\\<cdot>x)))\"\n\nlemma runWriterT_fmap [simp]:\n  \"runWriterT\\<cdot>(fmap\\<cdot>f\\<cdot>m) = fmap\\<cdot>(fmap\\<cdot>f)\\<cdot>(runWriterT\\<cdot>m)\"\nby (subst fmap_def, simp add: coerce_simp eta_cfun)\n\nlemma runWriterT_unitWT [simp]:\n  \"runWriterT\\<cdot>(unitWT\\<cdot>x) = return\\<cdot>(Writer\\<cdot>mempty\\<cdot>x)\"\nunfolding unitWT_def by simp\n\n\n\nlemma runWriterT_liftWT [simp]:\n  \"runWriterT\\<cdot>(liftWT\\<cdot>m) = fmap\\<cdot>(Writer\\<cdot>mempty)\\<cdot>m\"\nunfolding liftWT_def by simp\n\nlemma runWriterT_tellWT [simp]:\n  \"runWriterT\\<cdot>(tellWT\\<cdot>x\\<cdot>w) = return\\<cdot>(Writer\\<cdot>w\\<cdot>x)\"\nunfolding tellWT_def by simp\n\nlemma runWriterT_fmapWT [simp]:\n  \"runWriterT\\<cdot>(fmapWT\\<cdot>f\\<cdot>m) =\n    runWriterT\\<cdot>m \\<bind> (\\<Lambda> (Writer\\<cdot>w\\<cdot>x). return\\<cdot>(Writer\\<cdot>w\\<cdot>(f\\<cdot>x)))\"\nby (simp add: fmapWT_def bindWT_def mempty_right)\n\nsubsection \\<open>Laws\\<close>\n\ntext \\<open>The \\<open>liftWT\\<close> function maps \\<open>return\\<close> and\n\\<open>bind\\<close> on the inner monad to \\<open>unitWT\\<close> and \\<open>bindWT\\<close>, as expected. \\medskip\\<close>\n\nlemma liftWT_return:\n  \"liftWT\\<cdot>(return\\<cdot>x) = unitWT\\<cdot>x\"\nby (rule writerT_eqI, simp add: fmap_return)\n\nlemma liftWT_bind:\n  \"liftWT\\<cdot>(bind\\<cdot>m\\<cdot>k) = bindWT\\<cdot>(liftWT\\<cdot>m)\\<cdot>(liftWT oo k)\"\nby (rule writerT_eqI)\n   (simp add: monad_fmap bind_bind mempty_left)\n\ntext \\<open>The composition rule holds unconditionally for fmap. The fmap\nfunction also interacts as expected with unit and bind. \\medskip\\<close>\n\nlemma fmapWT_fmapWT:\n  \"fmapWT\\<cdot>f\\<cdot>(fmapWT\\<cdot>g\\<cdot>m) = fmapWT\\<cdot>(\\<Lambda> x. f\\<cdot>(g\\<cdot>x))\\<cdot>m\"\napply (simp add: writerT_eq_iff bind_bind)\napply (rule cfun_arg_cong, rule cfun_eqI, simp)\napply (case_tac x, simp add: bind_strict, simp add: mempty_right)\ndone\n\nlemma fmapWT_unitWT:\n  \"fmapWT\\<cdot>f\\<cdot>(unitWT\\<cdot>x) = unitWT\\<cdot>(f\\<cdot>x)\"\nby (simp add: writerT_eq_iff mempty_right)\n\nlemma fmapWT_bindWT:\n  \"fmapWT\\<cdot>f\\<cdot>(bindWT\\<cdot>m\\<cdot>k) = bindWT\\<cdot>m\\<cdot>(\\<Lambda> x. fmapWT\\<cdot>f\\<cdot>(k\\<cdot>x))\"\napply (simp add: writerT_eq_iff bind_bind)\napply (rule cfun_arg_cong, rule cfun_eqI, rename_tac x, simp)\napply (case_tac x, simp add: bind_strict, simp add: bind_bind)\napply (rule cfun_arg_cong, rule cfun_eqI, rename_tac y, simp)\napply (case_tac y, simp add: bind_strict, simp add: mempty_right)\ndone\n\nlemma bindWT_fmapWT:\n  \"bindWT\\<cdot>(fmapWT\\<cdot>f\\<cdot>m)\\<cdot>k = bindWT\\<cdot>m\\<cdot>(\\<Lambda> x. k\\<cdot>(f\\<cdot>x))\"\napply (simp add: writerT_eq_iff bind_bind)\napply (rule cfun_arg_cong, rule cfun_eqI, rename_tac x, simp)\napply (case_tac x, simp add: bind_strict, simp add: mempty_right)\ndone\n\ntext \\<open>The left unit monad law is not satisfied in general. \\medskip\\<close>\n\nlemma bindWT_unitWT_counterexample:\n  fixes k :: \"'a \\<rightarrow> 'b\\<cdot>('m::monad,'w::monoid) writerT\"\n  assumes 1: \"k\\<cdot>x = WriterT\\<cdot>(return\\<cdot>\\<bottom>)\"\n  assumes 2: \"return\\<cdot>\\<bottom> \\<noteq> (\\<bottom> :: ('b\\<cdot>'w writer)\\<cdot>'m::monad)\"\n  shows \"bindWT\\<cdot>(unitWT\\<cdot>x)\\<cdot>k \\<noteq> k\\<cdot>x\"\nby (simp add: writerT_eq_iff mempty_left assms)\n\ntext \\<open>However, left unit is satisfied for inner monads with a strict\n\\<open>return\\<close> function.\\<close>\n\nlemma bindWT_unitWT_restricted:\n  fixes k :: \"'a \\<rightarrow> 'b\\<cdot>('m::monad,'w::monoid) writerT\"\n  assumes \"return\\<cdot>\\<bottom> = (\\<bottom> :: ('b\\<cdot>'w writer)\\<cdot>'m)\"\n  shows \"bindWT\\<cdot>(unitWT\\<cdot>x)\\<cdot>k = k\\<cdot>x\"\nunfolding writerT_eq_iff\napply (simp add: mempty_left)\napply (rule trans [OF _ monad_right_unit])\napply (rule cfun_arg_cong)\napply (rule cfun_eqI)\napply (case_tac x, simp_all add: assms)\ndone\n\ntext \\<open>The associativity of \\<open>bindWT\\<close> holds\nunconditionally. \\medskip\\<close>\n\nlemma bindWT_bindWT:\n  \"bindWT\\<cdot>(bindWT\\<cdot>m\\<cdot>h)\\<cdot>k = bindWT\\<cdot>m\\<cdot>(\\<Lambda> x. bindWT\\<cdot>(h\\<cdot>x)\\<cdot>k)\"\napply (rule writerT_eqI)\napply simp\napply (simp add: bind_bind)\napply (rule cfun_arg_cong)\napply (rule cfun_eqI, simp)\napply (case_tac x)\napply (simp add: bind_strict)\napply (simp add: bind_bind)\napply (rule cfun_arg_cong)\napply (rule cfun_eqI, simp, rename_tac y)\napply (case_tac y)\napply (simp add: bind_strict)\napply (simp add: bind_bind)\napply (rule cfun_arg_cong)\napply (rule cfun_eqI, simp, rename_tac z)\napply (case_tac z)\napply (simp add: bind_strict)\napply (simp add: mappend_assoc)\ndone\n\ntext \\<open>The right unit monad law is not satisfied in general. \\medskip\\<close>\n\nlemma bindWT_unitWT_right_counterexample:\n  fixes m :: \"'a\\<cdot>('m::monad,'w::monoid) writerT\"\n  assumes \"m = WriterT\\<cdot>(return\\<cdot>\\<bottom>)\"\n  assumes \"return\\<cdot>\\<bottom> \\<noteq> (\\<bottom> :: ('a\\<cdot>'w writer)\\<cdot>'m)\"\n  shows \"bindWT\\<cdot>m\\<cdot>unitWT \\<noteq> m\"\nby (simp add: writerT_eq_iff assms)\n\ntext \\<open>Right unit is satisfied for inner monads with a strict \\<open>return\\<close> function. \\medskip\\<close>\n\nlemma bindWT_unitWT_right_restricted:\n  fixes m :: \"'a\\<cdot>('m::monad,'w::monoid) writerT\"\n  assumes \"return\\<cdot>\\<bottom> = (\\<bottom> :: ('a\\<cdot>'w writer)\\<cdot>'m)\"\n  shows \"bindWT\\<cdot>m\\<cdot>unitWT = m\"\nunfolding writerT_eq_iff\napply simp\napply (rule trans [OF _ monad_right_unit])\napply (rule cfun_arg_cong)\napply (rule cfun_eqI)\napply (case_tac x, simp_all add: assms mempty_right)\ndone\n\nsubsection \\<open>Writer monad transformer invariant\\<close>\n\ntext \\<open>We inductively define a predicate that includes all values\nthat can be constructed from the standard \\<open>writerT\\<close> operations.\n\\medskip\\<close>\n\ninductive invar :: \"'a\\<cdot>('m::monad, 'w::monoid) writerT \\<Rightarrow> bool\"\n  where invar_bottom: \"invar \\<bottom>\"\n  | invar_lub: \"\\<And>Y. \\<lbrakk>chain Y; \\<And>i. invar (Y i)\\<rbrakk> \\<Longrightarrow> invar (\\<Squnion>i. Y i)\"\n  | invar_unitWT: \"\\<And>x. invar (unitWT\\<cdot>x)\"\n  | invar_bindWT: \"\\<And>m k. \\<lbrakk>invar m; \\<And>x. invar (k\\<cdot>x)\\<rbrakk> \\<Longrightarrow> invar (bindWT\\<cdot>m\\<cdot>k)\"\n  | invar_tellWT: \"\\<And>x w. invar (tellWT\\<cdot>x\\<cdot>w)\"\n  | invar_liftWT: \"\\<And>m. invar (liftWT\\<cdot>m)\"\n\ntext \\<open>Right unit is satisfied for arguments built from standard\nfunctions. \\medskip\\<close>\n\nlemma bindWT_unitWT_right_invar:\n  fixes m :: \"'a\\<cdot>('m::monad,'w::monoid) writerT\"\n  assumes \"invar m\"\n  shows \"bindWT\\<cdot>m\\<cdot>unitWT = m\"\nusing assms proof (induct set: invar)\n  case invar_bottom thus ?case\n    by (rule writerT_eqI, simp add: bind_strict)\nnext\n  case invar_lub thus ?case\n    by - (rule admD, simp, assumption, assumption)\nnext\n  case invar_unitWT thus ?case\n    by (rule writerT_eqI, simp add: bind_bind mempty_left)\nnext\n  case invar_bindWT thus ?case\n    apply (simp add: writerT_eq_iff bind_bind)\n    apply (rule cfun_arg_cong, rule cfun_eqI, simp)\n    apply (case_tac x, simp add: bind_strict, simp add: bind_bind)\n    apply (rule cfun_arg_cong, rule cfun_eqI, simp, rename_tac y)\n    apply (case_tac y, simp add: bind_strict, simp add: mempty_right)\n    done\nnext\n  case invar_tellWT thus ?case\n    by (simp add: writerT_eq_iff mempty_right)\nnext\n  case invar_liftWT thus ?case\n    by (rule writerT_eqI, simp add: monad_fmap bind_bind mempty_right)\nqed\n\ntext \\<open>Left unit is also satisfied for arguments built from standard\nfunctions. \\medskip\\<close>\n\nlemma writerT_left_unit_invar_lemma:\n  assumes \"invar m\"\n  shows \"runWriterT\\<cdot>m \\<bind> (\\<Lambda> (Writer\\<cdot>w\\<cdot>x). return\\<cdot>(Writer\\<cdot>w\\<cdot>x)) = runWriterT\\<cdot>m\"\nusing assms proof (induct m set: invar)\n  case invar_bottom thus ?case\n    by (simp add: bind_strict)\nnext\n  case invar_lub thus ?case\n    by - (rule admD, simp, assumption, assumption)\nnext\n  case invar_unitWT thus ?case\n    by simp\nnext\n  case invar_bindWT thus ?case\n    apply (simp add: bind_bind)\n    apply (rule cfun_arg_cong)\n    apply (rule cfun_eqI, simp, rename_tac n)\n    apply (case_tac n, simp add: bind_strict)\n    apply (simp add: bind_bind)\n    apply (rule cfun_arg_cong)\n    apply (rule cfun_eqI, simp, rename_tac p)\n    apply (case_tac p, simp add: bind_strict)\n    apply simp\n    done\nnext\n  case invar_tellWT thus ?case\n    by simp\nnext\n  case invar_liftWT thus ?case\n    by (simp add: monad_fmap bind_bind)\nqed\n\nlemma bindWT_unitWT_invar:\n  assumes \"invar (k\\<cdot>x)\"\n  shows \"bindWT\\<cdot>(unitWT\\<cdot>x)\\<cdot>k = k\\<cdot>x\"\napply (simp add: writerT_eq_iff mempty_left)\napply (rule writerT_left_unit_invar_lemma [OF assms])\ndone\n\nsubsection \\<open>Invariant expressed as a deflation\\<close>\n\ndefinition invar' :: \"'a\\<cdot>('m::monad, 'w::monoid) writerT \\<Rightarrow> bool\"\n  where \"invar' m \\<longleftrightarrow> fmapWT\\<cdot>ID\\<cdot>m = m\"\n\ntext \\<open>All standard operations preserve the invariant.\\<close>\n\nlemma invar'_bottom: \"invar' \\<bottom>\"\n  unfolding invar'_def by (simp add: writerT_eq_iff bind_strict)\n\nlemma adm_invar': \"adm invar'\"\n  unfolding invar'_def [abs_def] by simp\n\nlemma invar'_unitWT: \"invar' (unitWT\\<cdot>x)\"\n  unfolding invar'_def by (simp add: writerT_eq_iff)\n\nlemma invar'_bindWT: \"\\<lbrakk>invar' m; \\<And>x. invar' (k\\<cdot>x)\\<rbrakk> \\<Longrightarrow> invar' (bindWT\\<cdot>m\\<cdot>k)\"\n  unfolding invar'_def\n  apply (erule subst)\n  apply (simp add: writerT_eq_iff)\n  apply (simp add: bind_bind)\n  apply (rule cfun_arg_cong)\n  apply (rule cfun_eqI, case_tac x)\n  apply (simp add: bind_strict)\n  apply simp\n  apply (simp add: bind_bind)\n  apply (rule cfun_arg_cong)\n  apply (rule cfun_eqI, rename_tac x, case_tac x)\n  apply (simp add: bind_strict)\n  apply simp\n  done\n\nlemma invar'_tellWT: \"invar' (tellWT\\<cdot>x\\<cdot>w)\"\n  unfolding invar'_def by (simp add: writerT_eq_iff)\n\nlemma invar'_liftWT: \"invar' (liftWT\\<cdot>m)\"\n  unfolding invar'_def by (simp add: writerT_eq_iff monad_fmap bind_bind)\n\ntext \\<open>Left unit is satisfied for arguments built from fmap.\\<close>\n\nlemma bindWT_unitWT_fmapWT:\n  \"bindWT\\<cdot>(unitWT\\<cdot>x)\\<cdot>(\\<Lambda> x. fmapWT\\<cdot>f\\<cdot>(k\\<cdot>x))\n    = fmapWT\\<cdot>f\\<cdot>(k\\<cdot>x)\"\napply (simp add: fmapWT_def writerT_eq_iff bind_bind)\napply (rule cfun_arg_cong, rule cfun_eqI, simp)\napply (case_tac x, simp_all add: bind_strict mempty_left)\ndone\n\ntext \\<open>Right unit is satisfied for arguments built from fmap.\\<close>\n\nlemma bindWT_fmapWT_unitWT:\n  shows \"bindWT\\<cdot>(fmapWT\\<cdot>f\\<cdot>m)\\<cdot>unitWT = fmapWT\\<cdot>f\\<cdot>m\"\napply (simp add: bindWT_fmapWT)\napply (simp add: fmapWT_def)\ndone\n\ntext \\<open>All monad laws are preserved by values satisfying the invariant.\\<close>\n\nlemma invar'_right_unit: \"invar' m \\<Longrightarrow> bindWT\\<cdot>m\\<cdot>unitWT = m\"\nunfolding invar'_def by (erule subst, rule bindWT_fmapWT_unitWT)\n\nlemma invar'_monad_fmap:\n  \"invar' m \\<Longrightarrow> fmapWT\\<cdot>f\\<cdot>m = bindWT\\<cdot>m\\<cdot>(\\<Lambda> x. unitWT\\<cdot>(f\\<cdot>x))\"\n  unfolding invar'_def\n  by (erule subst, simp add: writerT_eq_iff mempty_right)\n\nlemma invar'_bind_assoc:\n  \"\\<lbrakk>invar' m; \\<And>x. invar' (f\\<cdot>x); \\<And>y. invar' (g\\<cdot>y)\\<rbrakk>\n    \\<Longrightarrow> bindWT\\<cdot>(bindWT\\<cdot>m\\<cdot>f)\\<cdot>g = bindWT\\<cdot>m\\<cdot>(\\<Lambda> x. bindWT\\<cdot>(f\\<cdot>x)\\<cdot>g)\"\n  by (rule bindWT_bindWT)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Tycon/Writer_Transformer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.6297746074044134, "lm_q1q2_score": 0.3296368447588545}}
{"text": "theory Iterator\nimports \n  It_to_It \n  SetIteratorOperations \n  SetIteratorGA \n  Proper_Iterator\n  Gen_Iterator\n  Idx_Iterator\nbegin\n\n  text {* Folding over a list created by a proper iterator can be replaced\n    by a single iteration *}\n  lemma proper_it_to_list_opt[refine_transfer_post_subst]:\n    assumes PR: \"proper_it' it it'\"\n    shows \"foldli o it_to_list it \\<equiv> it'\"\n  proof (rule eq_reflection, intro ext)\n    fix s c f \\<sigma>\n    \n    obtain l where \"it s = foldli l\" and \"it' s = foldli l\"\n      by (rule proper_itE[OF PR[THEN proper_it'D[where s=s]]])\n    thus \"(foldli o it_to_list it) s c f \\<sigma> = it' s c f \\<sigma>\"\n      by (simp add: comp_def it_to_list_def)\n  qed\n\n  lemma iterator_cnv_to_comp[refine_transfer_post_simp]:\n    \"foldli (it_to_list it x) = (foldli o it_to_list it) x\"\n    by auto\n\n  declare idx_iteratei_eq_foldli[autoref_rules]\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/iterator/Iterator.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494550081926, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3295840873500187}}
{"text": "theory flash97Bra  imports flash97Rev\n \n  begin\nlemma onInv97:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv97 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv97 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv97 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash97Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7461389930307512, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.329549451695469}}
{"text": "(* Title:     Xml\n   Author:    Christian Sternagel\n   Author:    René Thiemann\n*)\n\nheader \\<open>XML Transformers for Extracting Data from XML Nodes\\<close>\n\ntheory Xmlt\nimports\n  Xml\n  \"../Certification_Monads/Strict_Sum\"\n  \"~~/src/HOL/Rat\"\nbegin\n\ntype_synonym\n  tag = string\n\ntext \\<open>The type of transformers on xml nodes.\\<close>\ntype_synonym\n  'a xmlt = \"xml \\<Rightarrow> string +\\<^sub>\\<bottom> 'a\"\n\ndefinition map :: \"(xml \\<Rightarrow> ('e +\\<^sub>\\<bottom> 'a)) \\<Rightarrow> xml list \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'a list\"\nwhere\n  [code_unfold]: \"map = map_sum_bot\"\n\nlemma map_mono [partial_function_mono]:\n  fixes C :: \"xml \\<Rightarrow> ('b \\<Rightarrow> ('e +\\<^sub>\\<bottom> 'c)) \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'd\"\n  assumes C: \"\\<And>y. y \\<in> set B \\<Longrightarrow> mono_sum_bot (C y)\"\n  shows \"mono_sum_bot (\\<lambda>f. map (\\<lambda>y. C y f) B)\" \n  unfolding map_def by (auto intro: partial_function_mono C)\n\nhide_const (open) map\n\nfun \"text\" :: \"tag \\<Rightarrow> string xmlt\"\nwhere\n  \"text tag (XML n atts [XML_text t]) = \n    (if n = tag \\<and> atts = [] then return t\n    else error (concat\n      [''could not extract text for '', tag,'' from '', ''\\<newline>'', show (XML n atts [XML_text t])]))\"\n| \"text tag xml = error (concat [''could not extract text for '', tag,'' from '', ''\\<newline>'', show xml])\"\nhide_const (open) \"text\"\n\ndefinition bool_of_string :: \"string \\<Rightarrow> string +\\<^sub>\\<bottom> bool\"\nwhere\n  \"bool_of_string s =\n    (if s = ''true'' then return True\n    else if s = ''false'' then return False\n    else error (''cannot convert '' @ s @ '' into Boolean''))\"\n\nfun bool :: \"tag \\<Rightarrow> bool xmlt\"\nwhere\n  \"bool tag node = Xmlt.text tag node \\<guillemotright>= bool_of_string\"\nhide_const (open) bool\n\ndefinition fail :: \"tag \\<Rightarrow> 'a xmlt\"\nwhere\n  \"fail tag xml =\n    error (concat\n      [''could not transform the following xml element (expected '', tag, '')'', ''\\<newline>'', show xml])\"\nhide_const (open) fail\n\ndefinition guard :: \"(xml \\<Rightarrow> bool) \\<Rightarrow> 'a xmlt \\<Rightarrow> 'a xmlt \\<Rightarrow> 'a xmlt\"\nwhere\n  \"guard p p1 p2 x = (if p x then p1 x else p2 x)\"\nhide_const (open) guard\n\nlemma guard_mono [partial_function_mono]:\n  assumes p1: \"\\<And>y. mono_sum_bot (p1 y)\"\n    and p2: \"\\<And>y. mono_sum_bot (p2 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.guard p (\\<lambda>y. p1 y g) (\\<lambda>y. p2 y g) x)\" \n  by (cases x) (auto intro!: partial_function_mono p1 p2 simp: Xmlt.guard_def)\n\nfun leaf :: \"tag \\<Rightarrow> 'a \\<Rightarrow> 'a xmlt\"\nwhere\n  \"leaf tag x (XML name atts cs) = \n    (if name = tag \\<and> atts = [] \\<and> cs = [] then return x \n    else Xmlt.fail tag (XML name atts cs))\" |\n  \"leaf tag x xml = Xmlt.fail tag xml\"\nhide_const (open) leaf\n\nfun list1element :: \"'a list \\<Rightarrow> 'a option\"\nwhere\n  \"list1element [x] = Some x\" |\n  \"list1element _ = None\"\n\nfun singleton :: \"tag \\<Rightarrow> 'a xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'b xmlt\"\nwhere\n  \"singleton tag p1 f xml =\n    (case xml of\n      XML name atts cs \\<Rightarrow>\n      (if name = tag \\<and> atts = [] then\n        (case list1element cs of \n          Some (cs1) \\<Rightarrow> p1 cs1 \\<guillemotright>= return \\<circ> f\n        | None \\<Rightarrow> Xmlt.fail tag xml)\n      else Xmlt.fail tag xml)\n    | _ \\<Rightarrow> Xmlt.fail tag xml)\"\nhide_const (open) singleton\n\nlemma singleton_mono [partial_function_mono]:\n  assumes p: \"\\<And>y. mono_sum_bot (p1 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.singleton t (\\<lambda>y. p1 y g) f x)\" \n    by (cases x, cases \"list1element (Xml.children x)\") (auto intro!: partial_function_mono p)\n\nfun list2elements :: \"'a list \\<Rightarrow> ('a \\<times> 'a) option\"\nwhere\n  \"list2elements [x, y] = Some (x, y)\" |\n  \"list2elements _ = None\"\n\nfun pair :: \"tag \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> 'c) \\<Rightarrow> 'c xmlt\"\nwhere\n  \"pair tag p1 p2 f xml =\n    (case xml of\n      XML name atts cs \\<Rightarrow>\n      (if name = tag \\<and> atts = [] then\n        (case list2elements cs of \n          Some (cs1, cs2) \\<Rightarrow>\n          do {\n            a \\<leftarrow> p1 cs1;\n            b \\<leftarrow> p2 cs2;\n            return (f a b)\n          }\n        | None \\<Rightarrow> Xmlt.fail tag xml)\n      else Xmlt.fail tag xml)\n    | _ \\<Rightarrow> Xmlt.fail tag xml)\"\nhide_const (open) pair\n\nlemma pair_mono [partial_function_mono]:\n  assumes \"\\<And>y. mono_sum_bot (p1 y)\"\n    and \"\\<And>y. mono_sum_bot (p2 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.pair t (\\<lambda>y. p1 y g) (\\<lambda> y. p2 y g) f x)\"\n  using assms\n  by (cases x, cases \"list2elements (Xml.children x)\") (auto intro!: partial_function_mono)\n\nfun list3elements :: \"'a list \\<Rightarrow> ('a \\<times> 'a \\<times> 'a) option\"\nwhere\n  \"list3elements [x, y, z] = Some (x, y, z)\" |\n  \"list3elements _ = None\"\n\nfun triple :: \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> 'c xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'd) \\<Rightarrow> 'd xmlt\"\nwhere\n  \"triple tag p1 p2 p3 f xml = (case xml of XML name atts cs \\<Rightarrow>\n    (if name = tag \\<and> atts = [] then\n      (case list3elements cs of \n        Some (cs1, cs2, cs3) \\<Rightarrow>\n        do {\n          a \\<leftarrow> p1 cs1;\n          b \\<leftarrow> p2 cs2;\n          c \\<leftarrow> p3 cs3;\n          return (f a b c)\n        }\n      | None \\<Rightarrow> Xmlt.fail tag xml)\n    else Xmlt.fail tag xml)\n  | _ \\<Rightarrow> Xmlt.fail tag xml)\"\n\nlemma triple_mono [partial_function_mono]:\n  assumes \"\\<And>y. mono_sum_bot (p1 y)\"\n    and \"\\<And>y. mono_sum_bot (p2 y)\"\n    and \"\\<And>y. mono_sum_bot (p3 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.triple t (\\<lambda>y. p1 y g) (\\<lambda> y. p2 y g) (\\<lambda> y. p3 y g) f x)\"\n  using assms\n  by (cases x, cases \"list3elements (Xml.children x)\", auto intro!: partial_function_mono)\n\nfun list4elements :: \"'a list \\<Rightarrow> ('a \\<times> 'a \\<times> 'a \\<times> 'a) option\"\nwhere\n  \"list4elements [x, y, z, u] = Some (x, y, z, u)\" |\n  \"list4elements _ = None\"\n\nfun\n  tuple4 ::\n    \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> 'c xmlt \\<Rightarrow> 'd xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'd \\<Rightarrow> 'e) \\<Rightarrow> 'e xmlt\"\nwhere\n  \"tuple4 tag p1 p2 p3 p4 f xml =\n    (case xml of\n      XML name atts cs \\<Rightarrow>\n        (if name = tag \\<and> atts = [] then\n          (case list4elements cs of \n            Some (cs1, cs2, cs3, cs4) \\<Rightarrow>\n            do {\n              a \\<leftarrow> p1 cs1;\n              b \\<leftarrow> p2 cs2;\n              c \\<leftarrow> p3 cs3;\n              d \\<leftarrow> p4 cs4;\n              return (f a b c d)\n            }\n          | None \\<Rightarrow> Xmlt.fail tag xml)\n        else Xmlt.fail tag xml)\n   | _ \\<Rightarrow> Xmlt.fail tag xml)\"\n\nlemma tuple4_mono [partial_function_mono]:\n  assumes \"\\<And>y. mono_sum_bot (p1 y)\"\n    and \"\\<And>y. mono_sum_bot (p2 y)\"\n    and \"\\<And>y. mono_sum_bot (p3 y)\"\n    and\"\\<And>y. mono_sum_bot (p4 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.tuple4 t (\\<lambda>y. p1 y g) (\\<lambda> y. p2 y g) (\\<lambda> y. p3 y g) (\\<lambda> y. p4 y g) f x)\"\n  using assms\n  by (cases x, cases \"list4elements (Xml.children x)\") (auto intro!: partial_function_mono)\n\nfun list5elements :: \"'a list \\<Rightarrow> ('a \\<times> 'a \\<times> 'a \\<times> 'a \\<times> 'a) option\"\nwhere\n  \"list5elements [x, y, z, u, v] = Some (x, y, z, u, v)\" |\n  \"list5elements _ = None\"\n\nfun\n  tuple5 ::\n    \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> 'c xmlt \\<Rightarrow> 'd xmlt \\<Rightarrow> 'e xmlt \\<Rightarrow>\n      ('a \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'd \\<Rightarrow> 'e \\<Rightarrow> 'f) \\<Rightarrow> 'f xmlt\"\nwhere\n  \"tuple5 tag p1 p2 p3 p4 p5 f xml =\n    (case xml of\n      XML name atts cs \\<Rightarrow>\n        (if name = tag \\<and> atts = [] then\n          (case list5elements cs of \n            Some (cs1,cs2,cs3,cs4,cs5) \\<Rightarrow>\n            do {\n              a \\<leftarrow> p1 cs1;\n              b \\<leftarrow> p2 cs2;\n              c \\<leftarrow> p3 cs3;\n              d \\<leftarrow> p4 cs4;\n              e \\<leftarrow> p5 cs5;\n              return (f a b c d e)\n            }\n          | None \\<Rightarrow> Xmlt.fail tag xml)\n        else Xmlt.fail tag xml)\n    | _ \\<Rightarrow> Xmlt.fail tag xml)\"\n\nlemma tuple5_mono [partial_function_mono]:\n  assumes \"\\<And>y. mono_sum_bot (p1 y)\"\n    and \"\\<And>y. mono_sum_bot (p2 y)\"\n    and \"\\<And>y. mono_sum_bot (p3 y)\"\n    and \"\\<And>y. mono_sum_bot (p4 y)\"\n    and \"\\<And>y. mono_sum_bot (p5 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.tuple5 t (\\<lambda>y. p1 y g) (\\<lambda> y. p2 y g) (\\<lambda> y. p3 y g) (\\<lambda> y. p4 y g) (\\<lambda> y. p5 y g) f x)\"\n  using assms\n  by (cases x, cases \"list5elements (Xml.children x)\") (auto intro!: partial_function_mono)\n\nfun list6elements :: \"'a list \\<Rightarrow> ('a \\<times> 'a \\<times> 'a \\<times> 'a \\<times> 'a \\<times> 'a) option\"\nwhere\n  \"list6elements [x, y, z, u, v, w] = Some (x, y, z, u, v, w)\" |\n  \"list6elements _ = None\"\n\nfun\n  tuple6 ::\n    \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> 'c xmlt \\<Rightarrow> 'd xmlt \\<Rightarrow> 'e xmlt \\<Rightarrow> 'f xmlt \\<Rightarrow>\n      ('a \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'd \\<Rightarrow> 'e \\<Rightarrow> 'f \\<Rightarrow> 'g) \\<Rightarrow> 'g xmlt\"\nwhere\n  \"tuple6 tag p1 p2 p3 p4 p5 p6 f xml =\n    (case xml of\n      XML name atts cs  \\<Rightarrow>\n        (if name = tag \\<and> atts = [] then\n          (case list6elements cs of \n            Some (cs1,cs2,cs3,cs4,cs5,cs6) \\<Rightarrow>\n            do {\n              a \\<leftarrow> p1 cs1;\n              b \\<leftarrow> p2 cs2;\n              c \\<leftarrow> p3 cs3;\n              d \\<leftarrow> p4 cs4;\n              e \\<leftarrow> p5 cs5;\n              ff \\<leftarrow> p6 cs6;\n              return (f a b c d e ff)\n            }\n          | None \\<Rightarrow> Xmlt.fail tag xml)\n        else Xmlt.fail tag xml)\n    | _ \\<Rightarrow> Xmlt.fail tag xml)\"\n\nlemma tuple6_mono [partial_function_mono]:\n  assumes \"\\<And>y. mono_sum_bot (p1 y)\"\n    and \"\\<And>y. mono_sum_bot (p2 y)\"\n    and \"\\<And>y. mono_sum_bot (p3 y)\"\n    and \"\\<And>y. mono_sum_bot (p4 y)\"\n    and \"\\<And>y. mono_sum_bot (p5 y)\"\n    and \"\\<And>y. mono_sum_bot (p6 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.tuple6 t (\\<lambda>y. p1 y g) (\\<lambda> y. p2 y g) (\\<lambda> y. p3 y g) (\\<lambda> y. p4 y g) (\\<lambda> y. p5 y g) (\\<lambda> y. p6 y g) f x)\"\n  using assms\n  by (cases x, cases \"list6elements (Xml.children x)\") (auto intro!: partial_function_mono)\n\nfun optional :: \"tag \\<Rightarrow> 'a xmlt \\<Rightarrow> ('a option \\<Rightarrow> 'b) \\<Rightarrow> 'b xmlt\"\nwhere\n  \"optional tag p1 f (XML name atts cs) =\n    (let l = length cs in\n    (if name = tag \\<and> atts = [] \\<and> l \\<ge> 0 \\<and> l \\<le> 1 then do {\n      if l = 1 then do {\n        x1 \\<leftarrow> p1 (cs ! 0);\n        return (f (Some x1))\n      } else return (f None)\n    } else Xmlt.fail tag (XML name atts cs)))\" |\n  \"optional tag p1 f xml = Xmlt.fail tag xml\"\n\nlemma optional_mono [partial_function_mono]:\n  assumes \"\\<And>y. mono_sum_bot (p1 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.optional t (\\<lambda>y. p1 y g) f x)\" \n  using assms by (cases x) (auto intro!: partial_function_mono)\n\nfun xml1to2elements :: \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b option \\<Rightarrow> 'c) \\<Rightarrow> 'c xmlt\"\nwhere\n  \"xml1to2elements tag p1 p2 f (XML name atts cs) = (\n     let l = length cs in\n     (if name = tag \\<and> atts = [] \\<and> l \\<ge> 1 \\<and> l \\<le> 2\n       then do {\n         x1 \\<leftarrow> p1 (cs ! 0);\n         (if l = 2\n           then do {\n             x2 \\<leftarrow> p2 (cs ! 1);\n             return (f x1 (Some x2))\n           } else return (f x1 None))\n       } else Xmlt.fail tag (XML name atts cs)))\" |\n  \"xml1to2elements tag p1 p2 f xml = Xmlt.fail tag xml\"\n\nlemma xml1to2elements_mono[partial_function_mono]:\n  assumes p1: \"\\<And>y. mono_sum_bot (p1 y)\"\n              \"\\<And>y. mono_sum_bot (p2 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. xml1to2elements t (\\<lambda>y. p1 y g) (\\<lambda>y. p2 y g) f x)\" \n  by (cases x, auto intro!: partial_function_mono p1)\n\ntext \\<open>\n  Apply the first transformer to the first child-node, then check the second child-node,\n  which is must be a Boolean. If the Boolean is true, then apply the second transformer\n  to the last child-node.\n\\<close>\nfun xml2nd_choice :: \"tag \\<Rightarrow> 'a xmlt \\<Rightarrow> tag \\<Rightarrow> 'b xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b option \\<Rightarrow> 'c) \\<Rightarrow> 'c xmlt\"\nwhere\n  \"xml2nd_choice tag p1 cn p2 f (XML name atts cs) = (\n    let l = length cs in\n    (if name = tag \\<and> atts = [] \\<and> l \\<ge> 2 then do {\n      x1 \\<leftarrow> p1 (cs ! 0);\n      b \\<leftarrow> Xmlt.bool cn (cs ! 1);\n      (if b then do {\n        x2 \\<leftarrow> p2 (cs ! (l - 1));\n        return (f x1 (Some x2))\n      } else return (f x1 None))\n    } else Xmlt.fail tag (XML name atts cs)))\" |\n  \"xml2nd_choice tag p1 cn p2 f xml = Xmlt.fail tag xml\"\n\nlemma xml2nd_choice_mono [partial_function_mono]:\n  assumes p1: \"\\<And>y. mono_sum_bot (p1 y)\"\n              \"\\<And>y. mono_sum_bot (p2 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. xml2nd_choice t (\\<lambda>y. p1 y g) h (\\<lambda>y. p2 y g) f x)\" \n  by (cases x, auto intro!: partial_function_mono p1)\n\nfun\n  xml2to3elements ::\n    \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> 'c xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> 'c option \\<Rightarrow> 'd) \\<Rightarrow> 'd xmlt\"\nwhere\n  \"xml2to3elements tag p1 p2 p3 f (XML name atts cs) = (\n     let l = length cs in\n     (if name = tag \\<and> atts = [] \\<and> l \\<ge> 2 \\<and> l \\<le> 3 then do {\n       x1 \\<leftarrow> p1 (cs ! 0);\n       x2 \\<leftarrow> p2 (cs ! 1);\n       (if l = 3 then do {\n         x3 \\<leftarrow> p3 (cs ! 2);\n         return (f x1 x2 (Some x3))\n       } else return (f x1 x2 None))\n     } else Xmlt.fail tag (XML name atts cs)))\" |\n  \"xml2to3elements tag p1 p2 p3 f xml = Xmlt.fail tag xml\"\n\nlemma xml2to3elements_mono [partial_function_mono]:\n  assumes p1: \"\\<And>y. mono_sum_bot (p1 y)\"\n              \"\\<And>y. mono_sum_bot (p2 y)\"\n              \"\\<And>y. mono_sum_bot (p3 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. xml2to3elements t (\\<lambda>y. p1 y g) (\\<lambda>y. p2 y g) (\\<lambda>y. p3 y g) f x)\" \n  by (cases x, auto intro!: partial_function_mono p1)\n\nfun\n  xml3to4elements ::\n    \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> 'c xmlt \\<Rightarrow> 'd xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> 'c option \\<Rightarrow> 'd \\<Rightarrow> 'e) \\<Rightarrow>\n      'e xmlt\"\nwhere\n  \"xml3to4elements tag p1 p2 p3 p4 f (XML name atts cs) = (\n     let l = length cs in\n     (if name = tag \\<and> atts = [] \\<and> l \\<ge> 3 \\<and> l \\<le> 4 then do {\n       x1 \\<leftarrow> p1 (cs ! 0);\n       x2 \\<leftarrow> p2 (cs ! 1);\n       (if l = 4 then do {\n         x3 \\<leftarrow> p3 (cs ! 2);\n         x4 \\<leftarrow> p4 (cs ! 3);\n         return (f x1 x2 (Some x3) x4)\n       } else do {\n         x4 \\<leftarrow> p4 (cs ! 2);\n         return (f x1 x2 None x4)\n       } )\n     } else Xmlt.fail tag (XML name atts cs)))\" |\n  \"xml3to4elements tag p1 p2 p3 p4 f xml = Xmlt.fail tag xml\"\n\nlemma xml3to4elements_mono [partial_function_mono]:\n  assumes p1: \"\\<And>y. mono_sum_bot (p1 y)\"\n              \"\\<And>y. mono_sum_bot (p2 y)\"\n              \"\\<And>y. mono_sum_bot (p3 y)\"\n              \"\\<And>y. mono_sum_bot (p4 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. xml3to4elements t (\\<lambda>y. p1 y g) (\\<lambda>y. p2 y g) (\\<lambda>y. p3 y g) (\\<lambda>y. p4 y g) f x)\" \n  by (cases x, auto intro!: partial_function_mono p1)\n\nfun many :: \"tag \\<Rightarrow> 'a xmlt \\<Rightarrow> ('a list \\<Rightarrow> 'b) \\<Rightarrow> 'b xmlt\"\nwhere\n  \"many tag p f (XML name atts cs) =\n    (if name = tag \\<and> atts = [] then (Xmlt.map p cs \\<guillemotright>= (return \\<circ> f))\n    else Xmlt.fail tag (XML name atts cs))\" |\n  \"many tag p f xml = Xmlt.fail tag xml\"\nhide_const (open) many\n\nlemma many_mono [partial_function_mono]:\n  fixes p1 :: \"xml \\<Rightarrow> ('b \\<Rightarrow> (string +\\<^sub>\\<bottom> 'c)) \\<Rightarrow> string +\\<^sub>\\<bottom> 'd\"\n  assumes \"\\<And>y. y \\<in> set (Xml.children x) \\<Longrightarrow> mono_sum_bot (p1 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.many t (\\<lambda>y. p1 y g) f x)\" \n  using assms by (cases x) (auto intro!: partial_function_mono)\n\nfun many1_gen :: \"tag \\<Rightarrow> 'a xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b xmlt) \\<Rightarrow> ('a \\<Rightarrow> 'b list \\<Rightarrow> 'c) \\<Rightarrow> 'c xmlt\"\nwhere\n  \"many1_gen tag p1 p2 f (XML name atts cs) =\n    (if name = tag \\<and> atts = [] \\<and> cs \\<noteq> [] then\n      (case cs of h # t \\<Rightarrow> do {\n        x \\<leftarrow> p1 h;\n        xs \\<leftarrow> Xmlt.map (p2 x) t;\n        return (f x xs)\n      })\n    else Xmlt.fail tag (XML name atts cs))\" |\n  \"many1_gen tag p1 p2 f xml = Xmlt.fail tag xml\"\n\n(* TODO \nlemma Xmlt.many1_gen_mono[partial_function_mono]:\n  fixes p1 :: \"xml \\<Rightarrow> ('b \\<Rightarrow> 'c sum_bot) \\<Rightarrow> 'd sum_bot\"\n  assumes p1: \"\\<And>y. mono_sum_bot (p1 y)\"\n              \"\\<And>y. mono_sum_bot (p2 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.many1_gen t (\\<lambda>y. p1 y g) (\\<lambda>y. p2 y g) f x)\" \n  by (cases x, auto intro!: partial_function_mono p1)\n*)\n\ndefinition many1 :: \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b list \\<Rightarrow> 'c) \\<Rightarrow> 'c xmlt\"\nwhere\n  \"many1 tag p1 p2 = Xmlt.many1_gen tag p1 (\\<lambda>_. p2)\"\nhide_const (open) many1\n\nlemma many1_mono [partial_function_mono]:\n  fixes p1 :: \"xml \\<Rightarrow> ('b \\<Rightarrow> (string +\\<^sub>\\<bottom> 'c)) \\<Rightarrow> string +\\<^sub>\\<bottom> 'd\"\n  assumes \"\\<And>y. mono_sum_bot (p1 y)\"\n    and \"\\<And>y. y \\<in> set (tl (Xml.children x)) \\<Longrightarrow> mono_sum_bot (p2 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.many1 t (\\<lambda>y. p1 y g) (\\<lambda>y. p2 y g) f x)\" \n  unfolding Xmlt.many1_def using assms\n  by (cases x, cases \"Xml.children x\") (auto intro!: partial_function_mono)\n\nfun length_ge_2 :: \"'a list \\<Rightarrow> bool\"\nwhere \n  \"length_ge_2 (_ # _ # _) = True\" |\n  \"length_ge_2 _ = False\"\n\nfun many2 :: \"tag \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> 'c xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> 'c list \\<Rightarrow> 'd) \\<Rightarrow> 'd xmlt\"\nwhere\n  \"many2 tag p1 p2 p3 f (XML name atts cs) =\n    (if name = tag \\<and> atts = [] \\<and> length_ge_2 cs then\n      (case cs of cs0 # cs1 # t \\<Rightarrow> do {\n        x \\<leftarrow> p1 cs0;\n        y \\<leftarrow> p2 cs1;\n        xs \\<leftarrow> Xmlt.map p3 t;\n        return (f x y xs)\n      })\n    else Xmlt.fail tag (XML name atts cs))\" |\n  \"many2 tag p1 p2 p3 f xml = Xmlt.fail tag xml\"\n\nlemma many2_mono [partial_function_mono]:\n  fixes p1 :: \"xml \\<Rightarrow> ('b \\<Rightarrow> (string +\\<^sub>\\<bottom> 'c)) \\<Rightarrow> string +\\<^sub>\\<bottom> 'd\"\n  assumes \"\\<And>y. mono_sum_bot (p1 y)\"\n    and \"\\<And>y. mono_sum_bot (p2 y)\"\n    and \"\\<And>y. mono_sum_bot (p3 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.many2 t (\\<lambda>y. p1 y g) (\\<lambda>y. p2 y g) (\\<lambda>y. p3 y g) f x)\"\n  using assms\n  by (cases x, cases \"Xml.children x\", (auto intro!: partial_function_mono)[1], cases \"tl (Xml.children x)\", auto intro!: partial_function_mono)\n\nfun\n  xml1or2many_elements ::\n    \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> 'c xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b option \\<Rightarrow> 'c list \\<Rightarrow> 'd) \\<Rightarrow> 'd xmlt\"\nwhere\n  \"xml1or2many_elements tag p1 p2 p3 f (XML name atts cs) =\n    (if name = tag \\<and> atts = [] \\<and> cs \\<noteq> [] then\n      (case cs of\n        cs0 # tt \\<Rightarrow>\n        do { \n          x \\<leftarrow> p1 cs0;\n          (case tt of\n            cs1 # t \\<Rightarrow>\n            do {\n              try do {\n                y \\<leftarrow> p2 cs1;\n                xs \\<leftarrow> Xmlt.map p3 t;\n                return (f x (Some y) xs)\n              } catch (\\<lambda> _. do {\n                xs \\<leftarrow> Xmlt.map p3 tt;\n                return (f x None xs)\n              })\n            }\n          | [] \\<Rightarrow> return (f x None []))}) \n     else Xmlt.fail tag (XML name atts cs))\" |\n  \"xml1or2many_elements tag p1 p2 p3 f  xml = Xmlt.fail tag xml\"\n\nfun\n  xml1many2elements_gen ::\n    \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b xmlt) \\<Rightarrow> 'c xmlt \\<Rightarrow> 'd xmlt \\<Rightarrow>\n      ('a \\<Rightarrow> 'b list \\<Rightarrow> 'c \\<Rightarrow> 'd \\<Rightarrow> 'e) \\<Rightarrow> 'e xmlt\"\nwhere\n  \"xml1many2elements_gen tag p1 p2 p3 p4 f (XML name atts cs) = (\n     let ds = List.rev cs; l = length cs in\n     (if name = tag \\<and> atts = [] \\<and> l \\<ge> 3 then do {\n       x \\<leftarrow> p1 (cs ! 0);\n       xs \\<leftarrow> Xmlt.map (p2 x) (tl (take (l - 2) cs));\n       y \\<leftarrow> p3 (ds ! 1);\n       z \\<leftarrow> p4 (ds ! 0);\n       return (f x xs y z)\n     } else Xmlt.fail tag (XML name atts cs)))\" |\n  \"xml1many2elements_gen tag p1 p2 p3 p4 f xml = Xmlt.fail tag xml\"\n\nlemma xml1many2elements_gen_mono [partial_function_mono]:\n  fixes p1 :: \"xml \\<Rightarrow> ('b \\<Rightarrow> (string +\\<^sub>\\<bottom> 'c)) \\<Rightarrow> string +\\<^sub>\\<bottom> 'd\"\n  assumes p1: \"\\<And>y. mono_sum_bot (p1 y)\"\n              \"\\<And>y. mono_sum_bot (p3 y)\"\n              \"\\<And>y. mono_sum_bot (p4 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. xml1many2elements_gen t (\\<lambda>y. p1 y g) p2 (\\<lambda>y. p3 y g) (\\<lambda>y. p4 y g) f x)\" \n  by (cases x, auto intro!: partial_function_mono p1)\n\nfun\n  xml1many2elements ::\n    \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> 'c xmlt \\<Rightarrow> 'd xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b list \\<Rightarrow> 'c \\<Rightarrow> 'd \\<Rightarrow> 'e) \\<Rightarrow>\n      'e xmlt\"\nwhere\n  \"xml1many2elements tag p1 p2 = xml1many2elements_gen tag p1 (\\<lambda>_. p2)\"\n\nfun\n  xml_many2elements ::\n    \"string \\<Rightarrow> 'a xmlt \\<Rightarrow> 'b xmlt \\<Rightarrow> 'c xmlt \\<Rightarrow> ('a list \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'd) \\<Rightarrow> 'd xmlt\"\nwhere\n  \"xml_many2elements tag p1 p2 p3 f (XML name atts cs) = (\n     let ds = List.rev cs in\n     (if name = tag \\<and> atts = [] \\<and> length_ge_2 cs then do {\n       xs \\<leftarrow> Xmlt.map p1 (List.rev (tl (tl ds)));\n       y \\<leftarrow> p2 (ds ! 1);\n       z \\<leftarrow> p3 (ds ! 0);\n       return (f xs y z)\n     } else Xmlt.fail tag (XML name atts cs)))\" |\n  \"xml_many2elements tag p1 p2 p3 f xml = Xmlt.fail tag xml\"\n\ndefinition options :: \"(string \\<times> 'a xmlt) list \\<Rightarrow> 'a xmlt\"\nwhere\n  \"options ps x =\n    (case map_of ps (Xml.tag x) of \n      None \\<Rightarrow> error (concat\n        [''expected one of: '', concat (map (\\<lambda>p. fst p @ '' '') ps), ''\\<newline>'', ''but found'', ''\\<newline>'', show x])\n    | Some p \\<Rightarrow> p x)\"\nhide_const (open) options\n\nlemma options_mono_gen [partial_function_mono]:\n  assumes p: \"\\<And> k p. (k, p) \\<in> set ps \\<Longrightarrow> mono_sum_bot (p x)\"\n  shows \"mono_sum_bot (\\<lambda> g. Xmlt.options (map (\\<lambda> (k, p). (k, (\\<lambda> y. p y g))) ps) x)\"\nproof -\n  {\n    fix g\n    have \"(map (\\<lambda>p. fst p @ '' '') (map (\\<lambda>(k, p). (k, \\<lambda>y. p y g)) ps)) = \n      map (\\<lambda>p. fst p @ '' '') ps\"\n      by (induct ps) (auto)\n  } note id = this\n  {\n    fix z\n    have \"mono_sum_bot\n      (\\<lambda>g. case map_of (map (\\<lambda>(k, p). (k, \\<lambda>y. p y g)) ps) (Xml.tag x) of\n        None \\<Rightarrow> z\n      | Some p \\<Rightarrow> p x)\"\n      using p\n    proof (induct ps)\n      case Nil\n      show ?case by (auto intro: partial_function_mono)\n    next\n      case (Cons kp ps)\n      obtain k p where kp: \"kp = (k,p)\" by force\n      note Cons = Cons[unfolded kp]\n      from Cons(2) have monop: \"mono_sum_bot (p x)\" and mono: \"\\<And> k p. (k,p) \\<in> set ps \\<Longrightarrow> mono_sum_bot (p x)\" by auto\n      show ?case \n      proof (cases \"Xml.tag x = k\")\n        case True\n        thus ?thesis unfolding kp using monop by auto\n      next\n        case False\n        thus ?thesis using Cons(1) mono unfolding kp by auto\n      qed\n    qed\n  } note main = this\n  show ?thesis unfolding Xmlt.options_def \n    unfolding id\n    by (rule main)\nqed\n\n(* instantiate this lemma to have the monotonicity lemmas for lists of variable lengths which\n   are then applicable, e.g., for lists of length 3 it would be\n\nmono_sum_bot (p1 x) \\<Longrightarrow> mono_sum_bot (p2 x) \\<Longrightarrow> mono_sum_bot (p3 x) \n\\<Longrightarrow> mono_sum_bot (\\<lambda>g. Xmlt.options [(k1, \\<lambda>y. p1 y g), (k2, \\<lambda>y. p2 y g), (k3, \\<lambda>y. p3 y g)] x)\n\n*)\nlocal_setup \\<open>fn lthy => \n  let\n    val N = 30 (* we require monotonicity lemmas for xml-options for lists up to length N *) \n    val thy = Proof_Context.theory_of lthy\n    val options = @{term \"Xmlt.options :: (string \\<times> (xml \\<Rightarrow> (string +\\<^sub>\\<bottom> 'd))) list \\<Rightarrow> xml \\<Rightarrow> string +\\<^sub>\\<bottom> 'd\"}\n    val mono_sum_bot = @{term \"mono_sum_bot :: (('a \\<Rightarrow> ('b +\\<^sub>\\<bottom> 'c)) \\<Rightarrow> string +\\<^sub>\\<bottom> 'd) \\<Rightarrow> bool\"}\n    val ktyp = @{typ string}\n    val x = @{term \"x :: xml\"}\n    val y = @{term \"y :: xml\"}\n    val g = @{term \"g :: 'a \\<Rightarrow> 'b +\\<^sub>\\<bottom> 'c\"}\n    val ptyp = @{typ \"xml \\<Rightarrow> ('a \\<Rightarrow> ('b +\\<^sub>\\<bottom> 'c)) \\<Rightarrow> string +\\<^sub>\\<bottom> 'd\"}\n    fun k i = Free (\"k\" ^ string_of_int i,ktyp)\n    fun p i = Free (\"p\" ^ string_of_int i,ptyp)\n    fun prem i = HOLogic.mk_Trueprop (mono_sum_bot $ (p i $ x))\n    fun prems n = 1 upto n |> map prem\n    fun pair i = HOLogic.mk_prod (k i, lambda y (p i $ y $ g))\n    fun pair2 i = HOLogic.mk_prod (k i, p i)\n    fun list n = 1 upto n |> map pair |> HOLogic.mk_list @{typ \"(string \\<times> (xml \\<Rightarrow> string +\\<^sub>\\<bottom> 'd))\"}\n    fun list2 n = 1 upto n |> map pair2 |> HOLogic.mk_list (HOLogic.mk_prodT (ktyp,ptyp))\n    fun concl n = HOLogic.mk_Trueprop (mono_sum_bot $ lambda g (options $ (list n) $ x))\n    fun xs n = x :: (1 upto n |> map (fn i => [p i, k i]) |> List.concat)\n       |> map (fst o dest_Free)\n    fun tac n pc =\n      let\n        val {prems = prems, context = ctxt} = pc\n        val mono_thm = Drule.instantiate' \n            (map (SOME o ctyp_of thy) [@{typ 'a},@{typ 'b},@{typ 'c},@{typ 'd}]) \n            (map (SOME o cterm_of thy) [list2 n,x]) @{thm Xmlt.options_mono_gen}\n      in \n        Method.insert_tac (mono_thm :: prems) 1 THEN force_tac ctxt 1\n      end\n    fun thm n = Goal.prove lthy (xs n) (prems n) (concl n) (tac n)\n    val thms = map thm (0 upto N)\n  in Local_Theory.note ((@{binding \"options_mono_thms\"}, []), thms) lthy |> snd end\n\\<close>\n\ndeclare Xmlt.options_mono_thms [partial_function_mono]\n\nfun choice :: \"string \\<Rightarrow> 'a xmlt list \\<Rightarrow> 'a xmlt\"\nwhere\n  \"choice e [] x = error (concat [''error in parsing choice for '', e, ''\\<newline>'', show x])\" |\n  \"choice e (p # ps) x = (try p x catch (\\<lambda>_. choice e ps x))\"\nhide_const (open) choice\n\nlemma choice_mono_2 [partial_function_mono]:\n  assumes p: \"mono_sum_bot (p1 x)\"\n             \"mono_sum_bot (p2 x)\"\n  shows \"mono_sum_bot (\\<lambda> g. Xmlt.choice e [(\\<lambda> y. p1 y g), (\\<lambda> y. p2 y g)] x)\"\n  using p by (auto intro!: partial_function_mono) \n\nlemma choice_mono_3 [partial_function_mono]:\n  assumes p: \"mono_sum_bot (p1 x)\"\n             \"mono_sum_bot (p2 x)\"\n             \"mono_sum_bot (p3 x)\"\n  shows \"mono_sum_bot (\\<lambda> g. Xmlt.choice e [(\\<lambda> y. p1 y g), (\\<lambda> y. p2 y g), (\\<lambda> y. p3 y g)] x)\"\n  using p by (auto intro!: partial_function_mono) \n\nfun change :: \"'a xmlt \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'b xmlt\"\nwhere\n  \"change p f x = p x \\<guillemotright>= return \\<circ> f\"\nhide_const (open) change\n\nlemma change_mono [partial_function_mono]:\n  assumes p: \"\\<And>y. mono_sum_bot (p1 y)\"\n  shows \"mono_sum_bot (\\<lambda>g. Xmlt.change (\\<lambda>y. p1 y g) f x)\" \n  by (cases x, insert p, auto intro!: partial_function_mono)\n\nfun int_of_digit :: \"char \\<Rightarrow> string +\\<^sub>\\<bottom> int\"\nwhere\n  \"int_of_digit x =\n    (if x = CHR ''0'' then return 0\n    else if x = CHR ''1'' then return 1\n    else if x = CHR ''2'' then return 2\n    else if x = CHR ''3'' then return 3\n    else if x = CHR ''4'' then return 4\n    else if x = CHR ''5'' then return 5\n    else if x = CHR ''6'' then return 6\n    else if x = CHR ''7'' then return 7\n    else if x = CHR ''8'' then return 8\n    else if x = CHR ''9'' then return 9\n    else error (x # '' is not a digit''))\"\n\nfun int_of_string_aux :: \"int \\<Rightarrow> string \\<Rightarrow> string +\\<^sub>\\<bottom> int\"\nwhere\n  \"int_of_string_aux n [] = return n\" |\n  \"int_of_string_aux n (d # s) = (int_of_digit d \\<guillemotright>= (\\<lambda>m. int_of_string_aux (10 * n + m) s))\"\n\ndefinition int_of_string :: \"string \\<Rightarrow> string +\\<^sub>\\<bottom> int\"\nwhere\n  \"int_of_string s =\n    (if s = [] then error ''cannot convert empty string into number'' \n    else if take 1 s = ''-'' then int_of_string_aux 0 (tl s) \\<guillemotright>= (\\<lambda> i. return (0 - i))\n    else int_of_string_aux 0 s)\"\n\nhide_const int_of_string_aux\n\nfun int :: \"tag \\<Rightarrow> int xmlt\"\nwhere\n  \"int tag x = (Xmlt.text tag x \\<guillemotright>= int_of_string)\"\nhide_const (open) int\n\nfun nat :: \"tag \\<Rightarrow> nat xmlt\"\nwhere\n  \"nat tag x = do {\n    txt \\<leftarrow> Xmlt.text tag x;\n    i \\<leftarrow> int_of_string txt;\n    return (Int.nat i)\n  }\"\nhide_const (open) nat\n\ndefinition rat :: \"rat xmlt\"\nwhere\n  \"rat = Xmlt.options [\n    (''integer'', Xmlt.change (Xmlt.int ''integer'') of_int),\n    (''rational'',\n      Xmlt.pair ''rational'' (Xmlt.int ''numerator'') (Xmlt.int ''denominator'')\n        (\\<lambda> x y. of_int x / of_int y))]\"\nhide_const (open) rat\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/XML/Xmlt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.32952462503647323}}
{"text": "(* uses Isabelle2019 and autocorres version 1.6 *)\ntheory ShortestPathCVerification\n  imports \n  \"HOL-Library.Option_ord\"\n  \"Library/Autocorres_Misc\"\n  \"ShortestPath/ShortestPath\"\nbegin\n\n(* Parse the input file. *)\ninstall_C_file \"shortest_path_checker.c\"\n\nautocorres \"shortest_path_checker.c\"\n\ncontext shortest_path_checker begin\n\n(*Implementation Graph Types*)\n\ntype_synonym IVertex = \"32 word\"\ntype_synonym IEdge_Id = \"32 word\"\ntype_synonym IEdge = \"IVertex \\<times> IVertex\"\ntype_synonym IPEdge = \"IVertex \\<Rightarrow> IEdge_Id\" \ntype_synonym IEInt = \"IVertex \\<Rightarrow> (32 word \\<times> 32 word)\"\ntype_synonym ICost = \"IEdge_Id \\<Rightarrow> 32 word\"\ntype_synonym IGraph = \"32 word \\<times> 32 word \\<times> (IEdge_Id \\<Rightarrow> IEdge)\"\n\nabbreviation ivertex_cnt :: \n  \"IGraph \\<Rightarrow> 32 word\"\nwhere \n  \"ivertex_cnt G \\<equiv> fst G\"\n\nabbreviation iedge_cnt :: \n\"IGraph \\<Rightarrow> 32 word\"\nwhere \n  \"iedge_cnt G \\<equiv> fst (snd G)\"\n\nabbreviation iedges :: \n  \"IGraph \\<Rightarrow> IEdge_Id \\<Rightarrow> IEdge\"\nwhere \n  \"iedges G \\<equiv> snd (snd G)\"\n\nabbreviation val :: \n  \"IEInt \\<Rightarrow> IVertex \\<Rightarrow> 32 word\"\nwhere \n  \"val f v \\<equiv> fst (f v)\"\n\nfun bool :: \n  \"32 word \\<Rightarrow> bool\" \nwhere \n  \"bool b = (if b=0 then False else True)\"\n\nabbreviation is_inf :: \n  \"IEInt \\<Rightarrow> IVertex \\<Rightarrow> 32 word\"\nwhere \n  \"is_inf f v \\<equiv>  (snd (f v))\"\n\n(* Make List - makes a list containing the result of a function *)\n\nfun mk_list' :: \n  \"nat \\<Rightarrow> (32 word \\<Rightarrow> 'b) \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list' n f = map f  (map of_nat [0..<n])\"\n\nfun mk_list'_temp :: \n  \"nat \\<Rightarrow> (32 word \\<Rightarrow> 'b) \\<Rightarrow> nat \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list'_temp 0 _ _ = []\" |\n  \"mk_list'_temp (Suc x) f i = (f (of_nat i)) # mk_list'_temp x f (Suc i)\"\n\n(* Make graph lists *)\nfun mk_iedge_list :: \n  \"IGraph \\<Rightarrow> IEdge list\"\nwhere \n  \"mk_iedge_list G = mk_list' (unat (iedge_cnt G)) (iedges G)\"\n\nfun mk_inum_list :: \n  \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> (32 word \\<times> 32 word) list\"\nwhere \n  \"mk_inum_list G num = mk_list' (unat (ivertex_cnt G)) num\"\n  \nfun mk_ipedge_list :: \n  \"IGraph \\<Rightarrow> IPEdge \\<Rightarrow> 32 word list\"\nwhere\n  \"mk_ipedge_list G pedge = mk_list' (unat (ivertex_cnt G)) pedge\"\n\nfun mk_idist_list :: \n  \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> (32 word \\<times> 32 word) list\"\nwhere\n  \"mk_idist_list G dis = mk_list' (unat (ivertex_cnt G)) dis\"\n\nfun mk_icost_list :: \n  \"IGraph \\<Rightarrow> ICost \\<Rightarrow> 32 word list\"\nwhere\n  \"mk_icost_list G cost = mk_list' (unat (iedge_cnt G)) cost\"\n\n(* Equate to Implementation *)\n\nlemma sint_ucast: \n  \"sint (ucast (x ::word32) :: sword32) = sint x\"\n  by (clarsimp simp: sint_uint uint_up_ucast is_up)\n\nlemma long_ucast:\n  \"unat (ucast (x ::word32) :: word64) = unat x\"\n  by (simp add: is_up uint_up_ucast unat_def)\n\n\nfun to_edge :: \n  \"IEdge \\<Rightarrow> Edge_C\"\nwhere\n  \"to_edge (u,v) = Edge_C u v\"\n\nlemma s_C_pte[simp]:\n  \"first_C (to_edge e) = fst e\"\n  by (cases e) auto\n\nlemma t_C_pte[simp]:\n  \"second_C (to_edge e) = snd e\"\n  by (cases e) auto\n\nfun cast_long :: \n  \"32 word \\<Rightarrow> 64 word\"\nwhere \n  \"cast_long x = ucast x\"\n\nfun to_eint :: \n  \"(32 word \\<times> 32 word) \\<Rightarrow> EInt_C\"\nwhere\n  \"to_eint p = EInt_C (fst p) (snd p)\"\n\nlemma val_C_pte[simp]:\n  \"val_C (to_eint p) = fst p\"\n  by (case_tac \"p\") auto\n\nlemma isInf_C_pte[simp]:\n  \"isInf_C (to_eint p) = snd p\"\n  by (cases p) auto\n\ndefinition is_graph\nwhere\n  \"is_graph h iG p \\<equiv>\n    is_valid_Graph_C h p \\<and> \n    ivertex_cnt iG = num_vertices_C (heap_Graph_C h p) \\<and> \n    iedge_cnt iG = num_edges_C (heap_Graph_C h p) \\<and>\n    arrlist (heap_Edge_C h) (is_valid_Edge_C h)\n      (map to_edge (mk_iedge_list iG)) (arcs_C (heap_Graph_C h p))\"\n\ndefinition is_numm\nwhere\n  \"is_numm h iG iN p \\<equiv> \n        arrlist (\\<lambda>p. heap_EInt_C h p) (\\<lambda>p. is_valid_EInt_C h p) \n        (map to_eint (mk_inum_list iG iN)) p\"\n\ndefinition is_pedge\nwhere\n  \"is_pedge h iG iP  (p:: 32 signed word ptr) \\<equiv> arrlist (\\<lambda>p. heap_w32 h (ptr_coerce p))\n        (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) (mk_ipedge_list iG iP) p\"\n\ndefinition is_dist\nwhere\n  \"is_dist h iG iD p \\<equiv> \n        arrlist (\\<lambda>p. heap_EInt_C h p) (\\<lambda>p. is_valid_EInt_C h p) \n        (map to_eint (mk_idist_list iG iD)) p\"\n\n\ndefinition is_cost\nwhere\n  \"is_cost h iG iC p \\<equiv> arrlist (heap_w32 h) (is_valid_w32 h) (mk_icost_list iG iC) p\"\n\n(* Lemmas for unat and of_nat *)\nlemma eq_of_nat_conv:\n  assumes \"unat w1 = n\"\n  shows \"w2 = of_nat n \\<longleftrightarrow> w2 = w1\"\n  using assms by auto\n\n(* More Lemmas for unat and of_nat *)\nlemma less_unat_plus1: \n  assumes \"a < unat (b + 1)\"\n  shows \"a < unat b \\<or> a = unat b\"\n  apply (subgoal_tac  \"b + 1 \\<noteq> 0 \")\n  using assms unat_minus_one add_diff_cancel \n  by fastforce+\n\nlemma unat_minus_plus1_less:\n  fixes a b\n  assumes \"a < b\"\n  shows \"unat (b - (a + 1)) < unat (b - a)\"\n  by (metis (no_types) ab_semigroup_add_class.add_ac(1) right_minus_eq measure_unat\n      add_diff_cancel2 assms is_num_normalize(1) zadd_diff_inverse linorder_neq_iff)\n\n(* Abstract Graph *)\n\ndefinition no_loops :: \n  \"('a, 'b) pre_digraph \\<Rightarrow> bool\" \nwhere\n  \"no_loops G \\<equiv> \\<forall>e \\<in> arcs G. tail G e \\<noteq> head G e\"\n\ndefinition abs_IGraph :: \n  \"IGraph \\<Rightarrow> (32 word, 32 word) pre_digraph\" \nwhere\n  \"abs_IGraph G \\<equiv> \\<lparr> verts = {0..<ivertex_cnt G}, arcs = {0..<iedge_cnt G},\n    tail = fst o iedges G, head = snd o iedges G \\<rparr>\"\n\nlemma verts_absI[simp]: \"verts (abs_IGraph G) = {0..<ivertex_cnt G}\"\n  and edges_absI[simp]: \"arcs (abs_IGraph G) = {0..<iedge_cnt G}\"\n  and start_absI[simp]: \"tail (abs_IGraph G) e = fst (iedges G e)\"\n  and target_absI[simp]: \"head (abs_IGraph G) e = snd (iedges G e)\"\n  by (auto simp: abs_IGraph_def)\n\ndefinition abs_ICost :: \n  \"(IEdge_Id \\<Rightarrow> 32 word) \\<Rightarrow> IEdge_Id \\<Rightarrow> real\"\nwhere\n  \"abs_ICost c e \\<equiv> real (unat (c e))\"\n\ndefinition abs_IDist :: \n  \"(32 word \\<Rightarrow> (32 word \\<times> 32 word)) \\<Rightarrow> 32 word \\<Rightarrow> ereal\"\nwhere\n  \"abs_IDist d v \\<equiv> if snd (d v) \\<noteq> 0 then PInfty else \n         real (unat (fst (d v)))\"\n\ndefinition abs_INum :: \n  \"(32 word \\<Rightarrow> (32 word \\<times> 32 word)) \\<Rightarrow> 32 word \\<Rightarrow> enat\"\nwhere\n  \"abs_INum n v \\<equiv> if snd (n v) \\<noteq> 0 then \\<infinity> else unat (fst (n v))\"\n\ndefinition abs_IPedge :: \n  \"(32 word \\<Rightarrow> 32 word) \\<Rightarrow> 32 word \\<Rightarrow> 32 word option\" \nwhere\n  \"abs_IPedge p v \\<equiv> if msb (p v) then None else Some (p v)\"\n\nlemma None_abs_pedgeI[simp]: \n  \"(abs_IPedge p v = None) = msb (p v)\"\n  using abs_IPedge_def by auto\n\nlemma Some_abs_pedgeI[simp]: \n  \"(\\<exists>e. abs_IPedge p v = Some e) =  (~ (msb (p v)))\"\n  using None_not_eq None_abs_pedgeI \n  by (metis abs_IPedge_def)\n    \n(*Helper Lemmas*)\n\nlemma wellformed_iGraph:\n  assumes \"wf_digraph (abs_IGraph G)\"\n  shows \"\\<And>e. e < iedge_cnt G \\<Longrightarrow> \n        fst (iedges G e) < ivertex_cnt G \\<and> \n        snd (iedges G e) < ivertex_cnt G\" \n  using assms unfolding wf_digraph_def by simp\n\nlemma unat_image_upto:\n  fixes n :: \"32 word\"\n  shows \"unat ` {0..<n} = {unat 0..<unat n}\" (is \"?A = ?B\")\nproof\n  show \"?B \\<subseteq> ?A\"  \n  proof \n    fix i assume a: \"i \\<in> ?B\"\n    then obtain i':: \"32 word\" where ii: \"i=  unat i'\"\n      by (metis atLeastLessThan_iff le_unat_uoi less_or_eq_imp_le)\n    then have \"i' \\<in> {0..<n}\" \n      using a word_less_nat_alt by auto\n    thus  \"i \\<in> ?A\" using ii by fast\n  qed\nnext\n  show \"?A \\<subseteq> ?B\"\n  proof\n     fix i assume a: \"i \\<in> ?A\"\n    then obtain i':: \"32 word\" where ii: \"i=  unat i'\" by blast\n    then have \"i' \\<in> {0..<n}\" using a by force\n    thus  \"i \\<in> ?B\"   \n      by (metis Un_iff atLeast0LessThan ii ivl_disj_un(8) \n          lessThan_iff unat_0 unat_mono word_zero_le)\n  qed\nqed\n\n\n\nlemma unat_simp: \n  \"\\<And>x y:: 32 word. unat (x + y) \\<ge> unat x \\<longleftrightarrow> \n      unat (x + y) = unat x + unat y\"\n  using unat_plus_simple word_le_nat_alt by blast\n\nlemma unat_simp_2:\n  \"\\<And>x y :: 32 word. unat (x + y) = unat x + unat y \\<longrightarrow> unat x + unat y \\<ge> unat x\"\n  by simp\n\nlemma unat_leq_plus:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"unat x \\<le> unat y + unat z\" \n  by (simp add: assms word_unat_less_le)\n\nlemma unat_leq_plus_64:\n  fixes x y z :: \"64 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"unat x \\<le> unat y + unat z\" \n  by (simp add: assms word_unat_less_le)\n\nlemma real_unat_leq_plus:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"real (unat x) \\<le> real (unat y) + real (unat z)\" \n  using assms unat_leq_plus by fastforce\n\nlemma real_unat_leq_plus_64:\n  fixes x y z :: \"64 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"real (unat x) \\<le> real (unat y) + real (unat z)\" \n  using assms unat_leq_plus_64 by fastforce\n\nlemma real_nat:\n  fixes x y z :: \"nat\"\n  assumes a1: \"real x \\<le> real y + real z\"\n  shows \"x \\<le> y + z\"\n  using assms by linarith\n\nlemma unat_leq_trian_plus:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"unat x \\<le> unat y + unat z\"\n  assumes a2: \"unat y + unat z \\<ge> unat y\"\n  assumes a3: \"unat (y + z) \\<ge> unat y\"\n  shows \"x \\<le> y + z\"\n  using a1 a3 unat_simp word_le_nat_alt by fastforce\n\nlemma unat_leq_plus_unats:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"unat x \\<le> unat (y + z)\"\n  shows \"x \\<le> y + z\"\nproof -\n  have f1: \"unat x \\<le> unat y + unat z\"\n    using a1 by (meson not_le unat_leq_plus word_less_nat_alt)\n  then show ?thesis\n    by (simp add: assms word_le_nat_alt)\nqed\n\nlemma unat_plus_leq_unats:\n  fixes y z :: \"32 word\"\n  assumes a1: \"unat y + unat z \\<le> unat (max_word :: 32 word)\"\n  shows \"unat y + unat z \\<le> unat (y + z)\"\n  using a1 \n  by unat_arith\n\nlemma trian_imp_valid:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"real (unat y) + real (unat z) \\<le> real (unat (max_word :: 32 word)) \\<and> real(unat x) \\<le> real (unat y) + real (unat z)\"\n  shows \"unat y + unat z \\<le> unat (max_word::32 word)\"\n  using a1 by linarith\n\nlemma c: \"UCAST(32 \\<rightarrow> 64) (x::word32) = cast_long x\"\n  by simp\n\nlemma cast_long_max: \"unat (cast_long (x::32 word)) \\<le> unat (max_word::word32)\"\n  using word_le_nat_alt long_ucast by auto\n\nlemma cast_long_max_extend: \"unat (cast_long (x::32 word)) \\<le> unat (max_word::word64)\"\n  using word_le_nat_alt by blast\n\nlemma trian_64_reverse:\n  fixes x y z :: \"word32\"\n  assumes a1: \"UCAST(32 \\<rightarrow> 64) x \\<le> UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z\"\n  shows \"unat x \\<le> unat y + unat z\"\n  by (metis (no_types, hide_lams) assms is_up len_of_word_comparisons(2) unat_leq_plus_64 \n            uint_up_ucast unat_def)\n\nlemma unat_plus_less_two_power_length:\n  assumes len: \"len_of TYPE('a::len) < len_of TYPE('b::len)\"\n  shows \"unat (C:: 'a word) + unat (D:: 'a word) < (2::nat) ^ LENGTH('b)\"\nproof -\n  have bounded: \"uint C < 2 ^ LENGTH('a)\" \"uint D < (2 :: int) ^ LENGTH('a)\"\n    by (insert uint_bounded)\nhave unat_bounded: \"unat C < 2 ^ LENGTH('a)\" \"unat D < (2 :: nat) ^ LENGTH('a)\"\n  by simp+\n  have suc_leq: \"Suc (len_of (TYPE('a)::'a itself)) \\<le> len_of (TYPE('b)::'b itself)\"\n    using len Suc_leI by blast\n  then have two_power_suc_leq: \"(2::nat) ^ (len_of (TYPE('a)::'a itself) + 1) \\<le> \n        2 ^ len_of (TYPE('b)::'b itself)\"\n    by (metis (no_types) One_nat_def add.right_neutral add_Suc_right \n             power_increasing_iff rel_simps(49) rel_simps(9))\n  have \"(2::nat) ^ (LENGTH ('a) + 1) = (2 ^ LENGTH ('a)) + (2 ^ LENGTH ('a))\" \n    by auto\n  then have \"unat (C:: 'a word) + unat (D:: 'a word) < (2::nat) ^ (LENGTH ('a) + 1)\"\n    using unat_bounded by linarith  \n  thus ?thesis using two_power_suc_leq \n    by linarith\nqed\n\nlemma abstract_val_ucast_add_strict_upcast:\n    \"\\<lbrakk> len_of TYPE('a::len) < len_of TYPE('b::len);\n       abstract_val P C' unat C; abstract_val P D' unat D \\<rbrakk>\n            \\<Longrightarrow>  abstract_val P (C' + D') unat \n                    ((ucast (C :: 'a word) :: 'b word) +\n                      ucast (D :: 'a word) :: 'b word)\"\n  apply (clarsimp simp: is_up unat_ucast_upcast ucast_def )\n  apply (clarsimp simp:  word_of_int_def unat_word_ariths(1))\n  apply (frule unat_plus_less_two_power_length[where C=C and D=D]) \n  by (metis (mono_tags, hide_lams) unat_of_nat_eq \n        add.right_neutral zero_less_power\n        unat_plus_less_two_power_length uint_inverse \n        uint_mod_same uint_nat unat_of_nat zero_less_numeral) \nlemmas word_add_strict_up_cast_no_overflow_32_64 = \n      abstract_val_ucast_add_strict_upcast\n        [unfolded abstract_val_def,\n          OF word_abs_base(18) impI, where P=True, simplified]\nlemma word_add_cast_up_no_overflow: \n  \"unat y + unat z = unat (UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\"\n  using word_add_strict_up_cast_no_overflow_32_64 by blast\n  \nlemma add_ucast_no_overflow_64: (* add_ucast_no_overflow *)\n  fixes x y z :: \"word32\"\n  assumes a1: \"unat x \\<le> unat y + unat z\"\n  shows \"(UCAST(32 \\<rightarrow> 64) x) \\<le> (UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\"\n  apply (insert a1) \n  apply (subgoal_tac \"unat (UCAST(32 \\<rightarrow> 64) x) \\<le> \n                      unat (UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\")\n   using word_le_nat_alt apply blast\n  apply (subst word_add_cast_up_no_overflow[symmetric])\n  using long_ucast by auto\n\nlemma add_ucast_no_overflow_unat:\n  fixes x y z :: \"word32\"\n  shows \"(UCAST(32 \\<rightarrow> 64) x = UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z) = \n         (unat x = unat y + unat z)\"\nproof -\n  have \"(UCAST(32 \\<rightarrow> 64) x = UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z) \\<longrightarrow> \n         unat x = unat y + unat z\"\n    by (metis (mono_tags, hide_lams) is_up le_add_same_cancel1 \n              len_of_word_comparisons(2) add_ucast_no_overflow_64 uint_up_ucast unat_def \n              unat_plus_simple zero_le)\n  moreover \n  have \"unat x = unat y + unat z \\<longrightarrow> \n        (UCAST(32 \\<rightarrow> 64) x = UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\"\n    by (metis (mono_tags, hide_lams) is_up len_of_word_comparisons(2) \n              uint_up_ucast unat_def word_arith_nat_add word_unat.Rep_inverse)\n  ultimately show ?thesis by blast\nqed\n  \n\nlemma path_length:\n  assumes \"vpath p (abs_IGraph iG)\"\n  shows \"vwalk_length p < unat (ivertex_cnt iG)\" \nproof -\n  have pne: \"p \\<noteq> []\" and dp: \"distinct p\" using assms by fast+\n  have \"unat (ivertex_cnt iG) = card (unat ` {0..<(fst iG)})\"  \n    using unat_image_upto by simp\n  then have \"unat (ivertex_cnt iG) = card ((verts (abs_IGraph iG)))\"  \n     by (simp add: inj_on_def card_image)\n  hence \"length p  \\<le> unat (ivertex_cnt iG)\" \n      by (metis finite_code card_mono vwalk_def\n          distinct_card[OF dp] vpath_def assms)\n  hence \"length p - 1 < unat (ivertex_cnt iG)\" \n    by (metis pne Nat.diff_le_self le_neq_implies_less \n        less_imp_diff_less minus_eq one_neq_zero length_0_conv)\n  thus \"vwalk_length p < unat (fst iG)\"\n    using  assms \n    unfolding vpath_def vwalk_def by simp\nqed\n\nlemma ptr_coerce_ptr_add_uint[simp]:\n  \"ptr_coerce (p +\\<^sub>p uint x) =  p +\\<^sub>p  (uint x)\"\n  by auto\n\nlemma heap_ptr_coerce:\n  \"\\<lbrakk>arrlist (\\<lambda>p. h (ptr_coerce p)) (\\<lambda>p. v (ptr_coerce p)) \n  (map (iL \\<circ> of_nat) [0..<unat n]) l; i < n; 0 \\<le> i\\<rbrakk> \\<Longrightarrow>\n    iL i = h (ptr_coerce (l +\\<^sub>p int (unat i)))\" \n  apply (subgoal_tac \n  \"h (ptr_coerce (l +\\<^sub>p int (unat i))) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (drule arrlist_nth_value[where i=\"int (unat i)\"], (simp add:unat_mono)+)\n  done\n\nlemma arrlist_heap:\n  \"\\<lbrakk>arrlist h v (map (iL \\<circ> of_nat) [0..<unat n]) l; \n  i < n\\<rbrakk> \\<Longrightarrow>\n    iL i = h (l +\\<^sub>p int (unat i))\" \n  apply (subgoal_tac \n  \"h (l +\\<^sub>p int (unat i)) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (simp add: arrlist_nth_value unat_mono)\n  done\n\nlemma two_comp_arrlist_heap:\n  \"\\<lbrakk> arrlist h v (map (f \\<circ> (iL \\<circ> of_nat)) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> f (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_heap \n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n\nlemma two_comp_to_eint_arrlist_heap:\n  \"\\<lbrakk> arrlist h v (map (to_eint \\<circ> (iL \\<circ> of_nat)) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> to_eint (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_heap \n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n\nlemma two_comp_to_edge_arrlist_heap:\n  \"\\<lbrakk> arrlist h v (map (to_edge \\<circ> (iL \\<circ> of_nat)) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> to_edge (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_heap \n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n \nlemma head_heap:\n  \"\\<lbrakk>arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  snd ((iedges iG) e) = second_C (h (ep +\\<^sub>p (uint e)))\" \n  using two_comp_arrlist_heap to_edge.simps t_C_pte by (metis uint_nat)\n\nlemma tail_heap:\n  \"\\<lbrakk>arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  fst ((iedges iG) e) =  first_C (h (ep +\\<^sub>p  (uint e)))\" \n  using two_comp_arrlist_heap to_edge.simps s_C_pte uint_nat by metis\n\nlemma val_heap:\n  \"\\<lbrakk>arrlist h v (map (to_eint \\<circ> (f \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  val f e = val_C (h (ep +\\<^sub>p (uint e)))\" \n  using two_comp_arrlist_heap to_eint.simps val_C_pte by (metis uint_nat)\n\nlemma is_inf_heap:\n  \"\\<lbrakk>arrlist h v (map (to_eint \\<circ> (f \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  is_inf f e =  isInf_C (h (ep +\\<^sub>p (uint e)))\" \n  using two_comp_arrlist_heap to_eint.simps isInf_C_pte by (metis uint_nat)\n\ndefinition is_wellformed_inv :: \"IGraph \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"is_wellformed_inv G i \\<equiv> \\<forall>k < i. ivertex_cnt G > fst (iedges G k)\n                                 \\<and> ivertex_cnt G > snd (iedges G k)\"\n\ndeclare arrlist_nth [simp]\ndeclare if_split_asm [split]\n\nlemma is_wellformed_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g) \\<rbrace>\n   is_wellformed' g\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> is_wellformed_inv iG (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: is_wellformed'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> is_wellformed_inv iG ee \\<and> \n                   ee \\<le> iedge_cnt iG \\<and> \n                   is_graph s iG g\"])\n  apply (simp add: skipE_def)\n  apply wp\n  unfolding is_graph_def is_wellformed_inv_def\n     apply (subst if_bool_eq_conj)+\n     apply (simp, safe) \n              apply (rule_tac x = \"ee\" in exI)\n              apply (subgoal_tac \"num_vertices_C (heap_Graph_C s g) \\<le> fst (snd (snd iG) ee)\", force)\n              apply (subgoal_tac \"first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint ee)) = fst (snd (snd iG) ee)\", simp)\n              apply (subst tail_heap[where iG=iG], simp, blast+)\n             apply(rule_tac x = \"ee\" in exI)\n             apply (subgoal_tac \"num_vertices_C (heap_Graph_C s g) \\<le> snd (snd (snd iG) ee)\", force)\n             apply (subgoal_tac \"second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint ee)) = snd (snd (snd iG) ee)\", simp)\n             apply (subst head_heap[where iG=iG], simp, blast+)\n            apply (metis two_comp_arrlist_heap s_C_pte le_cases le_step uint_nat word_le_less_eq)\n           apply (metis head_heap le_step not_less) \n          apply (metis le_step word_not_le)\n         apply simp\n        apply (metis (mono_tags, hide_lams) diff_diff_add \n                diff_self_eq_0 eq_iff_diff_eq_0 measure_unat not_less0 \n                word_less_nat_alt zero_less_diff)\n       apply (simp add: uint_nat unat_mono)+\n   apply wp \n  apply simp\n  done\n\ndefinition trian_inv :: \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> ICost \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"trian_inv G d c m \\<equiv> \n    \\<forall>i < m. is_inf d (fst (iedges G i)) = 0 \\<longrightarrow> \n     (is_inf d (snd (iedges G i)) = 0 \\<and> \n     cast_long (val d (snd (iedges G i))) \\<le> cast_long (val d (fst (iedges G i))) + cast_long (c i))\"\n\nlemma trian_inv_step:\n  assumes i_less_max: \"i < (max_word::32 word)\"\n  shows \"trian_inv G d c (i + 1) \\<longleftrightarrow> trian_inv G d c i \\<and>\n  (is_inf d (fst (iedges G i)) = 0 \\<longrightarrow> is_inf d (snd (iedges G i)) = 0 \\<and>\n  cast_long (val d (snd (iedges G i))) \\<le> cast_long (val d (fst (iedges G i))) + cast_long (c i))\"\n  unfolding trian_inv_def\n  by (metis (no_types) i_less_max less_irrefl less_x_plus_1)\n\nlemma trian_inv_le:\n  assumes leq: \"j \\<le> i\" \n  assumes trian_i: \"trian_inv G d c i\"\n  shows \"trian_inv G d c j\"\n  using assms \n  by (induct j) (auto simp add: trian_inv_def)\n\nlemma cost_abs_C_equiv:\n  fixes ee :: \"32 word\" and s :: lifted_globals\n  assumes a1: \"arrlist (heap_w32 s) (is_valid_w32 s) (map (iC \\<circ> of_nat) [0..<unat (num_edges_C (heap_Graph_C s g))]) c\"\n  assumes a2: \"fst (snd iG) = num_edges_C (heap_Graph_C s g)\"\n  assumes a3: \"ee < num_edges_C (heap_Graph_C s g)\"\n  shows \"iC ee = heap_w32 s (c +\\<^sub>p int (unat (ee)))\"\nproof -\n  show ?thesis\n    using a1 a3 arrlist_heap by blast\nqed\n\nlemma enat_abs_C_equiv:\n  fixes ee :: \"32 word\" and s :: lifted_globals\n  assumes a1: \"ee < num_edges_C (heap_Graph_C s g)\"\n  assumes a2: \"arrlist (heap_EInt_C s) (is_valid_EInt_C s) (map (to_eint \\<circ> (iL \\<circ> of_nat)) [0..<unat (num_vertices_C (heap_Graph_C s g))]) l\"\n  assumes a3: \"fst iG = num_vertices_C (heap_Graph_C s g)\"\n  assumes a4: \"fst (snd iG) = num_edges_C (heap_Graph_C s g)\"\n  assumes a5: \"arrlist (heap_Edge_C s) (is_valid_Edge_C s) (map (to_edge \\<circ> (snd (snd iG) \\<circ> of_nat)) [0..<unat (num_edges_C (heap_Graph_C s g))]) (arcs_C (heap_Graph_C s g))\"\n  assumes a6: \"\\<forall>ee < num_edges_C (heap_Graph_C s g). fst (snd (snd iG) ee) < num_vertices_C (heap_Graph_C s g)\"\n  shows \"fst (iL (fst (snd (snd iG) ee))) = val_C (heap_EInt_C s (l +\\<^sub>p int (unat (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p int (unat ee)))))))\"\nproof -\n  show ?thesis using a6 a5 a4 a3 a2 a1 s_C_pte two_comp_to_edge_arrlist_heap two_comp_to_eint_arrlist_heap val_C_pte by metis\nqed\n\ndeclare if_bool_eq_conj [[simp add]]\n\nlemma trian_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c)\\<rbrace>\n   trian' g d c\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> trian_inv iG iD iC (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: trian'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> trian_inv iG iD iC ee \\<and> \n                   ee \\<le> iedge_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and> \n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_cost s iG iC c\"])\n  apply (simp add: skipE_def)\n  apply wp\n     apply (subst if_bool_eq_conj)+\n     apply simp\n     apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI)\n        apply fast\n       apply (unfold trian_inv_def is_dist_def is_cost_def is_graph_def)[1]\n       apply clarsimp\n       apply (rule_tac x=ee in exI)\n       apply safe[1]\n        apply (metis is_inf_heap s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n       apply (subgoal_tac \"snd (iD (snd (snd (snd iG) ee))) = isInf_C (heap_EInt_C s (d +\\<^sub>p uint (second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint ee)))))\")\n        apply argo\n       apply (subst is_inf_heap, fastforce)\n        apply (subst head_heap, fastforce, fastforce)\n        apply (metis head_heap wellformed_iGraph)\n       apply (subst head_heap, fastforce, fastforce)\n       apply fast\n      apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI)\n         apply fast\n        apply (unfold trian_inv_def is_dist_def is_cost_def is_graph_def)[1]\n        apply clarsimp\n        apply (rule_tac x=ee in exI)\n        apply safe[1]\n         apply (subst is_inf_heap, fastforce)\n          apply (metis wellformed_iGraph)\n         apply (subst tail_heap, fastforce, fastforce)\n         apply blast\n        apply (subgoal_tac \"UCAST(32 \\<rightarrow> 64) (fst (iD (snd (snd (snd iG) ee)))) = \n                           UCAST(32 \\<rightarrow> 64) \n                             (val_C (heap_EInt_C s \n                                (d +\\<^sub>p uint (second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p \n                              uint ee))))))\")\n         apply (subgoal_tac \"UCAST(32 \\<rightarrow> 64) (fst (iD (fst (snd (snd iG) ee)))) + \n                            UCAST(32 \\<rightarrow> 64) (iC ee) = \n                            UCAST(32 \\<rightarrow> 64) \n                              (val_C (heap_EInt_C s \n                                (d +\\<^sub>p uint (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p \n                              uint ee)))))) + UCAST(32 \\<rightarrow> 64) (heap_w32 s (c +\\<^sub>p uint ee))\")\n          apply fastforce\n         apply (subst tail_heap, fastforce, fastforce)\n         apply (subst val_heap, fastforce)\n          apply (metis s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n         apply (simp add: cost_abs_C_equiv uint_nat)\n        apply (subst head_heap, fastforce, fastforce)\n        apply (subst val_heap, fastforce)\n         apply (metis t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n        apply blast\n       apply (rule conjI, rule impI, rule conjI)\n         apply fastforce\n        apply (rule conjI)\n         apply (subgoal_tac \" ee + 1 \\<le> fst (snd iG)\")\n          apply (subgoal_tac \"ee < (max_word::32 word)\") \n           apply (drule trian_inv_step[where d=iD and G=iG and c=iC])\n           apply clarsimp\n           apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1] \n           apply clarsimp\n           apply (subst tail_heap, fastforce, fastforce)\n           apply (subst head_heap, fastforce, fastforce)\n           apply (simp add: cost_abs_C_equiv)\n           apply (subst is_inf_heap, fastforce)\n            apply (metis t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n           apply (subst val_heap, fastforce)\n            apply (metis wellformed_iGraph)\n           apply (subst head_heap, fastforce, fastforce)\n           apply (subst val_heap, fastforce) \n            apply (metis s_C_pte two_comp_to_edge_arrlist_heap uint_nat wellformed_iGraph)\n           apply (rule conjI, blast, simp add: uint_nat)\n          apply (simp add:less_le not_le, meson less_le max_word_max not_le)\n         apply (simp add: inc_le is_graph_def, blast intro: inc_le)\n        apply (metis (mono_tags) inc_le is_graph_def unat_minus_plus1_less)\n       apply (rule conjI)\n        apply (unfold wf_digraph_def trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n        apply (clarsimp simp: if_bool_eq_conj)+\n        apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n       apply (rule conjI)\n        apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n        apply (clarsimp simp: if_bool_eq_conj)+\n        apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n       apply (rule conjI)\n        apply (unfold wf_digraph_def trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n        apply (clarsimp simp: if_bool_eq_conj)+\n        apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n       apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n       apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n      apply (unfold wf_digraph_def trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+) \n     apply (rule conjI, rule impI, rule conjI)\n       apply fastforce\n      apply (rule conjI)\n       apply (subgoal_tac \" ee + 1 \\<le> fst (snd iG)\")\n        apply (subgoal_tac \"ee < (max_word::32 word)\") \n         apply (drule trian_inv_step[where d=iD and G=iG and c=iC])\n         apply clarsimp\n         apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1] \n         apply clarsimp\n         apply (subst tail_heap, fastforce, fastforce)\n         apply (subst head_heap, fastforce, fastforce)\n         apply (simp add: cost_abs_C_equiv)\n         apply (subst is_inf_heap, fastforce)\n          apply (metis t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n         apply (subst val_heap, fastforce)\n          apply (metis wellformed_iGraph)\n         apply (subst head_heap, fastforce, fastforce)\n         apply (subst val_heap, fastforce) \n          apply (metis s_C_pte two_comp_to_edge_arrlist_heap uint_nat wellformed_iGraph)\n         apply (rule conjI)\n          apply (metis uint_nat s_C_pte two_comp_to_edge_arrlist_heap \n      is_inf_heap wellformed_iGraph)\n         apply (metis (no_types, hide_lams)  isInf_C_pte tail_heap \n      two_comp_to_eint_arrlist_heap wellformed_iGraph uint_nat)\n        apply (metis less_le max_word_max not_le)\n       apply (fastforce intro: inc_le simp: is_graph_def)\n      apply (metis (mono_tags) inc_le is_graph_def unat_minus_plus1_less)\n     apply (rule conjI) \n      apply (unfold wf_digraph_def trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n     apply (rule conjI)\n      apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+) \n     apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n    apply (simp add: is_graph_def)\n   apply wp\n  apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n  apply force\n  done\n\ndefinition just_inv :: \n  \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> ICost \\<Rightarrow> IVertex \\<Rightarrow> IEInt \\<Rightarrow> IPEdge \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"just_inv G d c s n p k \\<equiv>\n    \\<forall>v < k. v \\<noteq> s \\<and> is_inf n v = 0 \\<longrightarrow> \n      sint (p v) \\<ge> 0 \\<and>\n      (\\<exists> e. e = p v \\<and> e < iedge_cnt G \\<and>\n        v = snd (iedges G e) \\<and>\n        (is_inf d v = 0 \\<longleftrightarrow> is_inf d (fst (iedges G e)) = 0) \\<and>\n        (is_inf d v = 0 \\<longrightarrow> \n         cast_long (val d v) = cast_long (val d (fst (iedges G e))) + cast_long (c e)) \\<and>\n        is_inf n (fst (iedges G e)) = 0 \\<and>\n        cast_long (val n v) = cast_long (val n (fst (iedges G e))) + 1)\"\n\nlemma just_inv_step:\n  assumes v_less_max: \"v < (max_word::32 word)\"\n  shows \"just_inv G d c s n p (v + 1) \\<longleftrightarrow> just_inv G d c s n p v\n    \\<and> (v \\<noteq> s \\<and> is_inf n v = 0 \\<longrightarrow> \n      sint (p v) \\<ge> 0 \\<and>\n      (\\<exists> e. e = p v \\<and> e < iedge_cnt G \\<and> \n        v = snd (iedges G e) \\<and>\n        (is_inf d v = 0 \\<longleftrightarrow> is_inf d (fst (iedges G e)) = 0) \\<and>\n        (is_inf d v = 0 \\<longrightarrow>\n         cast_long (val d v) = cast_long (val d (fst (iedges G e))) + cast_long (c e)) \\<and>\n        is_inf n (fst (iedges G e)) = 0 \\<and>\n        cast_long (val n v) = cast_long (val n (fst (iedges G e))) + 1))\"\n  unfolding just_inv_def using v_less_max \n  by (force simp: less_x_plus_1)\n  \nlemma just_inv_le:\n  assumes leq: \"j \\<le> i\" \n  assumes just_i: \"just_inv G d c s n p i\"\n  shows \"just_inv G d c s n p j\"\n  using assms \n  by (induct j) (auto simp add: just_inv_def)\n\nlemma pedge_abs_C_equiv:\n  fixes vv :: \"32 word\" and s :: lifted_globals\n  assumes a1: \"arrlist (\\<lambda>p. heap_w32 s (ptr_coerce p)) (\\<lambda>p. is_valid_w32 s (ptr_coerce p)) (map (iP \\<circ> of_nat) [0..<unat (num_vertices_C (heap_Graph_C s g))]) p\"\n  assumes a2: \"fst iG = num_vertices_C (heap_Graph_C s g)\"\n  assumes a3: \"vv < num_vertices_C (heap_Graph_C s g)\"\n  shows \"iP vv = heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat vv)))\"\nproof -\n  have \"\\<forall>w. heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat w))) = iP w \\<or> \\<not> w < fst iG\"\n    using a2 a1 heap_ptr_coerce unat_0 by fastforce\n  show ?thesis\n    using a1 a3 arrlist_heap by blast\nqed\n\nlemma  word32_minus_comm: \"(x:: 32 word) - y - z = x - z - y\" by simp\n\nlemma just_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   just' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> just_inv iG iD iC sc iN iP (ivertex_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: just'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(vv, s). unat (ivertex_cnt iG - vv)\" and\n        I=\"\\<lambda>vv s. P s \\<and> just_inv iG iD iC sc iN iP vv \\<and>\n                   vv \\<le> ivertex_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and>\n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_cost s iG iC c \\<and>\n                   is_numm s iG iN n \\<and>\n                   is_pedge s iG iP p\"])\n  apply (simp add: skipE_def)\n  apply wp\n    apply (subst if_bool_eq_conj)+\n    apply simp\n    apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI)\n       apply (unfold just_inv_def is_graph_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n       apply (clarsimp, rule_tac x=vv in exI, simp add: uint_nat)\n       apply (metis isInf_C_pte sint_ucast two_comp_to_eint_arrlist_heap not_le heap_ptr_coerce word_zero_le)\n      apply (rule impI, rule conjI)                   \n       apply (unfold just_inv_def is_graph_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n       apply (clarsimp, rule_tac x=vv in exI, simp add: uint_nat)\n       apply (metis isInf_C_pte two_comp_to_eint_arrlist_heap not_le heap_ptr_coerce word_zero_le)\n      apply (rule conjI, rule impI, rule conjI)\n        apply (unfold just_inv_def is_graph_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n        apply (clarsimp, rule_tac x=vv in exI, simp add: uint_nat)\n        apply (metis (no_types) isInf_C_pte two_comp_to_eint_arrlist_heap \n                heap_ptr_coerce word_zero_le two_comp_to_edge_arrlist_heap t_C_pte)\n       apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI)\n          apply (unfold just_inv_def is_graph_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n          apply meson\n         apply (unfold just_inv_def is_graph_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n         apply (clarsimp, rule_tac x=vv in exI, simp add: uint_nat)\n         apply (subgoal_tac \"heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat vv))) = iP vv\") \n          apply (metis (no_types, hide_lams) is_inf_heap tail_heap uint_nat)\n         apply (metis heap_ptr_coerce word_zero_le)\n        apply (rule conjI, rule impI, rule conjI)\n          apply (unfold just_inv_def is_graph_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n          apply (clarsimp, rule_tac x=vv in exI, simp add: uint_nat)\n          apply (subgoal_tac \"heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat vv))) = iP vv\") \n           apply (subgoal_tac \"snd (iN vv) = 0\")\n            apply (subgoal_tac \"\\<And>w. w < fst iG \\<Longrightarrow> heap_EInt_C s (d +\\<^sub>p int (unat w)) = to_eint (iD w)\")\n             apply (metis (no_types, hide_lams) cost_abs_C_equiv isInf_C_pte tail_heap val_C_pte uint_nat)\n            apply (metis two_comp_to_eint_arrlist_heap) \n           apply (metis isInf_C_pte two_comp_to_eint_arrlist_heap)\n          apply (metis (no_types) heap_ptr_coerce word_zero_le)\n         apply (rule conjI, rule impI, rule conjI)\n           apply (unfold just_inv_def is_graph_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n           apply (clarsimp, rule_tac x=vv in exI, simp add: uint_nat)\n           apply (rule conjI)\n            apply (metis isInf_C_pte two_comp_to_eint_arrlist_heap)\n           apply (rule impI)+\n           apply (simp add: pedge_abs_C_equiv)\n           apply (simp add: enat_abs_C_equiv)\n           apply (simp add: cost_abs_C_equiv) \n           apply (subgoal_tac \"isInf_C \n                                 (heap_EInt_C s (n +\\<^sub>p int (unat (fst (snd (snd iG) \n                                 (heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat vv))))))))) \\<noteq> 0\")\n            apply (metis isInf_C_pte two_comp_to_eint_arrlist_heap)\n           apply (metis tail_heap uint_nat)\n          apply (rule conjI, rule impI, rule conjI)\n            apply (unfold just_inv_def is_graph_def is_dist_def is_cost_def \n                          is_numm_def is_pedge_def wf_digraph_def)[1]\n            apply (clarsimp, rule_tac x=vv in exI, simp add: uint_nat)\n            apply (rule conjI)\n             apply (subst is_inf_heap, blast, blast)\n             apply (simp add: pedge_abs_C_equiv)\n             apply (simp add: uint_nat)\n            apply (rule impI)+\n            apply (simp add: pedge_abs_C_equiv enat_abs_C_equiv cost_abs_C_equiv)\n            apply (subst val_heap, blast, blast, simp add: uint_nat)\n            apply (metis two_comp_to_eint_arrlist_heap val_C_pte)\n           apply (rule conjI, rule impI, rule conjI) \n             apply blast \n            apply clarsimp\n            apply (unfold is_graph_def)[1]\n            apply (rule conjI)\n             apply (subst just_inv_step)\n              apply (metis max_word_max not_le word_le_less_eq)\n             apply clarsimp\n             apply (unfold is_graph_def is_dist_def is_cost_def \n                           is_numm_def is_pedge_def wf_digraph_def)[1]\n             apply clarsimp\n             apply (frule_tac e=\"iP vv\" in head_heap;\n                    simp add: pedge_abs_C_equiv sint_ucast \n                              enat_abs_C_equiv uint_nat cost_abs_C_equiv)\n             apply (frule_tac e=\"iP vv\" in tail_heap;\n                    simp add: pedge_abs_C_equiv)\n             apply (rule conjI, simp) \n             apply (rule conjI) \n              apply (metis (no_types, hide_lams) not_le isInf_C_pte \n                     two_comp_to_eint_arrlist_heap uint_nat)\n             apply (rule conjI, clarsimp) \n              apply (subst val_heap, fastforce, fast)\n              apply (subst val_heap, fastforce, metis not_le) \n              apply (simp add: uint_nat)\n             apply (rule conjI) \n              apply (metis (no_types, hide_lams) not_le isInf_C_pte \n                     two_comp_to_eint_arrlist_heap uint_nat)\n             apply (subst val_heap, fastforce, fast)\n             apply (subst val_heap, fastforce, metis not_le) \n             apply (simp add: uint_nat)\n            apply (metis le_step not_le unat_minus_plus1_less)\n           apply (rule conjI)\n            apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n            apply (clarsimp simp: if_bool_eq_conj)+\n            apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+) \n           apply (rule conjI)\n            apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n            apply (clarsimp simp: if_bool_eq_conj)+\n            apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n           apply (rule conjI)\n            apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n            apply (clarsimp simp: if_bool_eq_conj)+\n            apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n           apply (simp add: is_graph_def word_less_nat_alt not_le, blast+)\n          apply (rule conjI)\n           apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n          apply (rule conjI)\n           apply (unfold is_pedge_def is_graph_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n          apply (simp add: is_graph_def word_less_nat_alt not_le, blast+)\n         apply (rule conjI)\n          apply (unfold is_dist_def is_pedge_def is_graph_def)[1]\n          apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n          apply (metis (no_types, hide_lams) not_le wellformed_iGraph word_less_nat_alt)\n         apply (rule conjI)\n          apply (unfold is_cost_def is_pedge_def is_graph_def)[1]\n          apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n         apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n         apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule conjI; rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n        apply clarsimp\n        apply (subgoal_tac \" vv + 1 \\<le> fst iG\")\n         apply (subgoal_tac \"vv < (max_word::32 word)\")\n          apply (rule conjI, rule impI)\n           apply (rule conjI, rule impI, clarsimp)\n            apply (drule_tac j=\"vv + 1\" in just_inv_le, assumption)\n            apply (clarsimp simp: is_graph_def) \n            apply (simp add: just_inv_step)\n            apply (subgoal_tac \"snd (iN vv) = 0\")\n             apply clarsimp\n             apply (subgoal_tac \"snd (iN (fst (snd (snd iG) (iP vv)))) \\<noteq> 0\")\n              apply simp\n             apply (subst is_inf_heap, force simp: is_numm_def, metis wellformed_iGraph) \n             apply (subst tail_heap, fastforce, fastforce)\n             apply (unfold is_pedge_def enat_abs_C_equiv)[] \n             apply (subst pedge_abs_C_equiv[where iP=iP], fastforce+)\n             apply (simp add: uint_nat)\n            apply (subst is_inf_heap, force simp: is_numm_def, fast+)\n           prefer 3 apply (metis max_word_max not_le word_le_less_eq) \n          prefer 3 apply (clarsimp simp: is_graph_def, metis not_le plus_one_helper)\n         apply (rule conjI; clarsimp)\n          apply (rule conjI, clarsimp)  \n           apply (drule_tac j=\"vv + 1\" in just_inv_le, assumption)\n           apply (clarsimp simp: is_graph_def)\n           apply (simp add: just_inv_step)\n           apply (subgoal_tac \"snd (iN vv) = 0\")\n            apply (clarsimp simp: \n                      add_ucast_no_overflow_unat[where z=1, simplified ucast_1 unat_1])\n            apply (unfold is_numm_def)[] \n            apply clarsimp\n            apply (simp add: val_heap)\n            apply (subst notE[where P = \" fst x = val_C y \" for x y], assumption)\n             apply (subst val_heap, fast, metis wellformed_iGraph)\n             apply (subst tail_heap, fastforce, fastforce)\n             apply (unfold is_pedge_def enat_abs_C_equiv)[] \n             apply (subst pedge_abs_C_equiv[where iP=iP], fastforce+)\n             apply (simp add: uint_nat)\n            apply simp\n           apply (subst is_inf_heap, force simp: is_numm_def, fast+)\n          apply (rule conjI, clarsimp) \n           apply (rule conjI) \n            apply (subst just_inv_step, assumption)  \n            apply clarsimp\n            apply (unfold is_graph_def is_dist_def is_cost_def \n                          is_numm_def is_pedge_def wf_digraph_def)[1]\n            apply clarsimp\n            apply (frule_tac e=\"iP vv\" in head_heap;\n                   simp add: pedge_abs_C_equiv sint_ucast \n                             enat_abs_C_equiv uint_nat cost_abs_C_equiv)\n            apply (frule_tac e=\"iP vv\" in tail_heap;\n                   simp add: pedge_abs_C_equiv)\n            apply (rule conjI, simp) \n            apply (rule conjI) \n             apply (metis (no_types, hide_lams) not_le isInf_C_pte \n                           two_comp_to_eint_arrlist_heap uint_nat)\n            apply (rule conjI, clarsimp) \n             apply (subst val_heap, fastforce, fast)\n             apply (subst val_heap, fastforce, metis not_le) \n             apply (simp add: uint_nat)\n             apply (metis (no_types, hide_lams) isInf_C_pte two_comp_to_eint_arrlist_heap)\n            apply (subst val_heap, fastforce, fast)\n            apply (subst val_heap, fastforce, metis not_le) \n            apply (simp add: uint_nat)  \n            apply (metis (no_types, hide_lams) not_le isInf_C_pte two_comp_to_eint_arrlist_heap)\n           apply (rule conjI) \n            apply (metis not_le unat_minus_plus1_less word_add_no_overflow word_le_less_eq)\n           apply (simp add: is_graph_def)\n          apply (rule conjI) \n           apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n          apply (rule conjI)\n           apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n          apply (rule conjI)\n           apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono is_graph_def)+)\n         apply (rule conjI)\n          apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n          apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n         apply (rule conjI)\n          apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n          apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule arrlist_nth, (simp add: uint_nat unat_mono is_dist_def)+)+\n        apply (rule conjI)\n         apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n         apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n        apply (rule conjI)\n         apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n         apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n        apply (rule conjI)\n         apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n         apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule arrlist_nth, (simp add: uint_nat unat_mono is_graph_def)+) \n       apply (rule conjI)\n        apply (unfold is_graph_def just_inv_def is_dist_def is_cost_def is_numm_def is_pedge_def wf_digraph_def)[1]\n        apply (clarsimp simp: if_bool_eq_conj)+\n        apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n       apply blast\n      apply (force simp add: is_graph_def)\n     apply (rule conjI, rule impI, rule conjI)\n       apply meson\n      apply (rule conjI)\n       apply (subgoal_tac \" vv + 1 \\<le> fst iG\")\n        apply (subgoal_tac \"vv < (max_word::32 word)\") \n         apply (drule just_inv_step[where d=iD and G=iG and c=iC and p=iP and n=iN and s=sc])\n         apply (unfold just_inv_def is_graph_def is_cost_def is_dist_def is_numm_def is_pedge_def)[1]\n         apply clarsimp\n         apply (metis is_inf_heap)\n        apply (simp add:less_le not_le, meson less_le max_word_max not_le)\n       apply (simp add: inc_le is_graph_def)\n       apply (unfold just_inv_def is_graph_def is_cost_def is_dist_def is_numm_def is_pedge_def)[1]\n       apply (blast intro: inc_le)\n      apply (metis (no_types, hide_lams) inc_le is_graph_def unat_minus_plus1_less)\n     apply (rule conjI)\n      apply (unfold is_numm_def is_pedge_def is_graph_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n     apply clarsimp\n     apply (unfold is_pedge_def is_graph_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n     apply safe[1]\n        apply (subgoal_tac \" sc + 1 \\<le> fst iG\")\n         apply (subgoal_tac \"sc < (max_word::32 word)\") \n          apply (drule just_inv_step[where d=iD and G=iG and c=iC and p=iP and n=iN and s=sc])\n          apply (unfold just_inv_def is_graph_def is_cost_def is_dist_def is_numm_def is_pedge_def)[1]\n          apply clarsimp\n         apply (simp add:less_le not_le, meson less_le max_word_max not_le)\n        apply (simp add: inc_le is_graph_def) \n       apply (simp add: inc_le is_graph_def) \n      apply (simp add: unat_minus_plus1_less is_graph_def)\n     apply (unfold is_graph_def)[1]\n     apply blast\n    apply (unfold is_graph_def is_pedge_def)[1]\n    apply (clarsimp simp: if_bool_eq_conj)+\n    apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n    apply (metis is_graph_def word_le_less_eq)\n   apply (unfold just_inv_def is_graph_def)[1] \n   apply wp \n  apply simp\n  apply (metis (no_types, hide_lams) map_map is_graph_def mk_iedge_list.simps mk_list'.simps)\n  done\n   \ndefinition no_path_inv :: \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> IEInt \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"no_path_inv G d n k \\<equiv>  \\<forall>v < k. (is_inf d v \\<noteq> 0 \\<longleftrightarrow> is_inf n v \\<noteq> 0)\"\n\nlemma no_path_inv_step:\n  assumes v_less_max: \"v < max_word\"\n  shows \"no_path_inv G d n (v + 1) \\<longleftrightarrow> no_path_inv G d n v\n    \\<and> (is_inf d v \\<noteq> 0 \\<longleftrightarrow> is_inf n v \\<noteq> 0)\"\n  unfolding no_path_inv_def\n  using v_less_max  \n  by (force simp: less_x_plus_1) \n\nlemma no_path_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n)\\<rbrace>\n   no_path' g d n\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> no_path_inv iG iD iN (ivertex_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: no_path'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(vv, s). unat (ivertex_cnt iG - vv)\" and\n        I=\"\\<lambda>vv s. P s \\<and> no_path_inv iG iD iN vv \\<and> \n                   vv \\<le> ivertex_cnt iG \\<and> \n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_numm s iG iN n\"])\n  apply (simp add: skipE_def)\n  apply wp\n  unfolding is_graph_def is_dist_def is_numm_def no_path_inv_def\n     apply (subst if_bool_eq_conj)+\n     apply (simp, safe) \n                      apply (metis (no_types, hide_lams) is_inf_heap)\n                      apply (metis (no_types, hide_lams) is_inf_heap)\n                      apply (metis (no_types, hide_lams) le_step is_inf_heap)\n                     apply (metis (no_types, hide_lams) le_step is_inf_heap)\n                    apply (metis le_step not_less)\n                   apply simp+\n                apply (metis (no_types, hide_lams) diff_diff_add eq_iff_diff_eq_0 measure_unat word_not_le)\n               apply (metis (no_types, hide_lams) le_step is_inf_heap)\n              apply (metis (no_types, hide_lams) le_step is_inf_heap)\n             apply (simp add: inc_le word_less_nat_alt)\n            apply simp+\n         apply (metis (no_types, hide_lams) diff_diff_add eq_iff_diff_eq_0 measure_unat word_not_le)\n        apply (rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+, simp add: uint_nat word_less_def)\n       apply (rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+, simp add: uint_nat word_less_def)\n      apply simp+\n   apply wp \n  apply simp\n  done\n\nlemma wf_inv_is_fin_digraph:\n   \"is_wellformed_inv G (iedge_cnt G) \\<longleftrightarrow> fin_digraph (abs_IGraph G)\"\n    unfolding is_wellformed_inv_def fin_digraph_def fin_digraph_axioms_def\n      wf_digraph_def no_loops_def \n    by auto\n\nlemma trian_inv_eq_math:\n  \"trian_inv G d c (fst (snd G)) \\<longleftrightarrow> \n   (\\<forall>e. e \\<in> arcs (abs_IGraph G) \\<longrightarrow> \n    abs_IDist d (head (abs_IGraph G) e) \\<le> \n    abs_IDist d (tail (abs_IGraph G) e) + ereal (abs_ICost c e))\"\n  apply safe\n   apply (simp add: abs_IDist_def abs_ICost_def)\n   apply clarsimp \n   apply (metis real_unat_leq_plus_64 long_ucast cast_long.simps trian_inv_def)\n  apply (fastforce intro: add_ucast_no_overflow_64 \n           simp add: trian_inv_def abs_IDist_def abs_ICost_def)\n  done\n\nlemma just_inv_eq_math: \n  \"just_inv G d c s n p (ivertex_cnt G) \\<longleftrightarrow> \n    (\\<forall>v<fst G. v \\<noteq> s \\<longrightarrow>\n    (\\<exists>i. abs_INum n v = enat i) \\<longrightarrow>\n    (\\<exists> e. (abs_IPedge p v) = Some e \\<and>\n     e < (fst (snd G)) \\<and>\n     v = snd (snd (snd G) e) \\<and>\n     abs_IDist d v =\n     abs_IDist d (fst (snd (snd G) e)) +\n     ereal (abs_ICost c e) \\<and>\n     abs_INum n v = \n     abs_INum n (fst (snd (snd G) e)) + enat (Suc 0)))\"\n  apply (simp add: just_inv_def)\n  apply (rule iffI; clarsimp; erule_tac x=v in allE)\n   apply (rule_tac x= \"p v\" in exI, clarsimp simp: abs_IPedge_def)\n   apply (case_tac \"snd (n v) = 0\"; clarsimp simp: not_le word_msb_sint abs_INum_def) \n   apply (rule conjI)\n    apply (simp add: add_ucast_no_overflow_unat abs_IDist_def abs_ICost_def abs_IPedge_def)\n   apply (metis (mono_tags, hide_lams) add.right_neutral add_Suc_right \n          le_add_same_cancel1 long_ucast add_ucast_no_overflow_64 unat_eq_1(2) \n          unat_plus_simple zero_le)\n  apply (clarsimp simp add: abs_IPedge_def)\n  apply (subgoal_tac \"\\<exists>i. abs_INum n v = enat i\"; simp add: abs_INum_def) \n  apply (case_tac \"msb (p v)\"; \n         clarsimp simp: not_le word_msb_sint \n         abs_INum_def abs_IDist_def abs_ICost_def)  \n  apply (case_tac \"snd (n (fst (snd (snd G) (p v)))) = 0\"; clarsimp) \n  apply (case_tac \"snd (d v) = 0\"; \n         case_tac \"snd (d (fst (snd (snd G) (p v)))) = 0\"; \n         clarsimp simp: add_ucast_no_overflow_unat)\n  apply (metis add.commute of_nat_Suc ucast_nat_def) \n  apply (subgoal_tac \"UCAST(32 \\<rightarrow> 64) (fst (n (fst (snd (snd G) (p v))))) + (1::64 word) = \n                      UCAST(32 \\<rightarrow> 64) (fst (n v))\")\n  apply (simp add: add_ucast_no_overflow_unat)\n  apply (subgoal_tac \"\\<forall>w wa. (w::64 word) + wa = of_nat (nat (uint w) + nat (uint wa))\")\n   apply (metis Suc_eq_plus1 long_ucast unat_1 unat_def word_unat.Rep_inverse)\n  apply simp\n  done\n\nlemma src_dist_nonneg_valid: \n  \"abs_IDist d s \\<le> 0 \\<longleftrightarrow> (is_inf d s = 0 \\<and> val d s = 0)\"\n  unfolding abs_IDist_def\n  by (simp add: unat_eq_zero)\n\nlemma src_dist_zero_valid: \n  \"abs_IDist d s = 0 \\<longleftrightarrow> (is_inf d s = 0 \\<and> val d s = 0)\"\n  unfolding abs_IDist_def\n  by (simp add: unat_eq_zero)\n\nlemma no_path_inv_eq_math:\n  \"no_path_inv G d n (ivertex_cnt G) \\<longleftrightarrow>\n   (\\<forall>v. v \\<in> verts (abs_IGraph G) \\<longrightarrow> (abs_IDist d v \\<noteq> PInfty \\<longleftrightarrow> abs_INum n v \\<noteq> PInfty))\"\n  unfolding no_path_inv_def abs_IDist_def abs_INum_def by fastforce+\n\nlemma nonneg_cost_edge_valid:\n  \"(\\<forall>e. e \\<in> arcs (abs_IGraph G) \\<longrightarrow> 0 \\<le> abs_ICost c e)\"\n  unfolding abs_ICost_def by force\n\nlemma basic_just_sp_eq_invariants_imp:\n\"\\<And>G d c s n p. \n    (is_wellformed_inv G (iedge_cnt G) \\<and> \n    s < ivertex_cnt G \\<and>\n    is_inf d s = 0 \\<and>\n    val d s = 0 \\<and>\n    trian_inv G d c (iedge_cnt G) \\<and> \n    just_inv G d c s n p (ivertex_cnt G))\n    =\n    basic_just_sp_pred \n    (abs_IGraph G) (abs_IDist d) \n    (abs_ICost c) s (abs_INum n) (abs_IPedge p) \n    \"\nproof -\n  fix G d c s n p \n  let ?aG = \"abs_IGraph G\"\n  let ?ad = \"abs_IDist d\"\n  let ?ac = \"abs_ICost c\"\n  let ?an = \"abs_INum n\"  \n  let ?ap = \"abs_IPedge p\"\n   show \"?thesis G d c s n p\"\n   unfolding \n    basic_just_sp_pred_def \n    basic_just_sp_pred_axioms_def \n    basic_sp_def basic_sp_axioms_def\n   by (auto simp: wf_inv_is_fin_digraph[where ?G=G]\n     src_dist_nonneg_valid[where ?d=d and ?s=s] \n     trian_inv_eq_math[where ?G=G and ?d=d and ?c=c]\n     just_inv_eq_math[where ?G=G and ?d=d and ?c=c and ?s=s and ?n=n and ?p=p])\nqed\n\nlemma shortest_path_pos_cost_pred_eq_invariants':\n\"\\<And>G d c s n p.\n    (is_wellformed_inv G (iedge_cnt G) \\<and> \n    s < ivertex_cnt G \\<and>\n    is_inf d s = 0 \\<and>\n    val d s = 0 \\<and>\n    trian_inv G d c (iedge_cnt G) \\<and> \n    just_inv G d c s n p (ivertex_cnt G) \\<and>\n    no_path_inv G d n (ivertex_cnt G) \\<and>\n    (\\<forall>e < ivertex_cnt G. 0 \\<le> c e))\n    =\n    shortest_path_pos_cost_pred (abs_IGraph G) (abs_IDist d) (abs_ICost c) s (abs_INum n) (abs_IPedge p)\"\nproof -\n  fix G d c s n p \n  let ?aG = \"abs_IGraph G\"\n  let ?ad = \"abs_IDist d\"\n  let ?ac = \"abs_ICost c\"\n  let ?an = \"abs_INum n\"  \n  let ?ap = \"abs_IPedge p\"\n  show \"?thesis G d c s n p\"\n  unfolding \n    basic_just_sp_pred_def \n    basic_just_sp_pred_axioms_def \n    basic_sp_def basic_sp_axioms_def\n    shortest_path_pos_cost_pred_def\n    shortest_path_pos_cost_pred_axioms_def\n  by (auto simp:  wf_inv_is_fin_digraph [where ?G=G]\n        src_dist_nonneg_valid[where ?d=d and ?s=s] \n        trian_inv_eq_math[where ?G=G and ?d=d and ?c=c]\n        just_inv_eq_math[where ?G=G and ?d=d and ?c=c and ?s=s and ?n=n and ?p=p]\n        no_path_inv_eq_math[where ?G=G and ?d=d and ?n=n]\n        nonneg_cost_edge_valid[where ?G=G and ?c=c] src_dist_zero_valid)\nqed\n\ndefinition basic_just_sp_inv :: \n  \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> ICost \\<Rightarrow> IVertex \\<Rightarrow> IEInt \\<Rightarrow> IPEdge \\<Rightarrow> bool\" where\n  \"basic_just_sp_inv G d c s n p \\<equiv>\n       (is_wellformed_inv G (iedge_cnt G) \\<and>\n        s < ivertex_cnt G \\<and>\n        val d s = 0 \\<and>\n        is_inf d s = 0 \\<and>\n        trian_inv G d c (iedge_cnt G) \\<and> \n        just_inv G d c s n p (ivertex_cnt G))\"\n\nlemma check_basic_just_sp_spc_intermediate:\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and> \n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   check_basic_just_sp' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n        basic_just_sp_inv iG iD iC sc iN iP)\\<rbrace>!\"\n  apply (clarsimp simp: check_basic_just_sp'_def basic_just_sp_inv_def)\n  apply wp\n  apply (rule_tac P1=\" P and \n    (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          is_wellformed_inv iG (iedge_cnt iG) \\<and>\n          sc < ivertex_cnt iG \\<and> \n          val iD sc = 0 \\<and>\n          is_inf iD sc = 0 \\<and>\n          trian_inv iG iD iC (iedge_cnt iG))\" \n     in validNF_post_imp[OF _ just_spc']) \n     apply fastforce\n    apply (rule_tac P1=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          is_wellformed_inv iG (iedge_cnt iG) \\<and>\n          sc < ivertex_cnt iG \\<and> \n          val iD sc = 0 \\<and>\n          is_inf iD sc = 0)\"\n     in validNF_post_imp[OF _ trian_spc']) \n     using fin_digraph_def fin_digraph_axioms_def\n         apply (fastforce simp: wf_inv_is_fin_digraph)\n        defer\n        defer\n  apply (rule_tac P' = \" P and\n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p) \" and \n   P1 = \" P and (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p) \" and \n   Q' = \"\\<lambda>ret' s. if ret' = 0 then ((\\<lambda>_. P) And (\\<lambda>rr s. (rr \\<noteq> 0) = (is_wellformed_inv iG (fst (snd iG)) \\<and> sc < ivertex_cnt iG \\<and> fst (iD sc) = 0 \\<and> snd (iD sc) = 0 \\<and> trian_inv iG iD iC (fst (snd iG)) \\<and> just_inv iG iD iC sc iN iP (fst iG)))) 0 s\n               else (\\<lambda> r s. P s \\<and> \n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          is_wellformed_inv iG (iedge_cnt iG)) ret' s \"\n     in validNF_pre_post_imp[OF is_wellformed_spc'])\n         apply fastforce\n        apply fastforce\n       apply blast\n\napply (rule_tac P=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          is_wellformed_inv iG (iedge_cnt iG) \\<and>\n          sc < ivertex_cnt iG)\"\n         in validNF_post_imp[OF _ _])\n       apply blast\n      apply wp\n      apply simp_all\n      apply (erule conjE)+\n      apply safe[1]\n             apply (subgoal_tac \"fst (iD sc) = val_C (heap_EInt_C s (d +\\<^sub>p uint sc))\")\n              apply fastforce\n             apply (unfold is_dist_def is_graph_def is_wellformed_inv_def)[1]\n             apply (subst val_heap, force) prefer 2\n              apply blast\n             apply clarsimp\n            apply (unfold is_dist_def is_graph_def is_wellformed_inv_def)[1]\n            apply (erule conjE)+\n            apply (clarsimp simp: if_bool_eq_conj)+\n            apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n           apply (subgoal_tac \"snd (iD sc) = isInf_C (heap_EInt_C s (d +\\<^sub>p unat sc))\")\n            apply fastforce\n           apply (unfold is_dist_def is_graph_def is_wellformed_inv_def)[1]\n       (*apply (subst is_inf_heap, force, force)*)\n           apply (subst is_inf_heap, force) \n            apply argo\n           apply (simp add: int_unat)\n          apply (unfold is_dist_def is_graph_def is_wellformed_inv_def)[1]\n          apply (erule conjE)+\n          apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n         apply (subgoal_tac \"fst (iD sc) = val_C (heap_EInt_C s (d +\\<^sub>p unat sc))\")\n     using word_neq_0_conv apply auto[1]\n         apply (unfold is_dist_def is_graph_def is_wellformed_inv_def)[1]\n         apply (subst val_heap, force) prefer 2\n          apply (simp add: int_unat)\n         apply clarsimp\n        apply (subgoal_tac \"snd (iD sc) = isInf_C (heap_EInt_C s (d +\\<^sub>p uint sc))\")\n     using word_neq_0_conv apply auto[1]\n        apply (unfold is_dist_def is_graph_def is_wellformed_inv_def)[1] \n        apply (erule conjE)+\n        apply simp\n        apply (simp add: shortest_path_checker.is_inf_heap)\n     using fin_digraph_def shortest_path_checker.wf_inv_is_fin_digraph apply blast\n      apply (unfold is_dist_def is_graph_def is_wellformed_inv_def)[1]\n      apply (erule conjE)+\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n     apply wp\n     apply clarsimp\n     apply safe\n       apply (subgoal_tac \"num_vertices_C (heap_Graph_C s g) = fst iG\")\n        apply force\n       apply (simp_all add: is_graph_def)\n     done\n\ndefinition basic_sp_inv :: \n  \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> ICost \\<Rightarrow> IVertex \\<Rightarrow> IEInt \\<Rightarrow> IPEdge \\<Rightarrow> bool\" where\n  \"basic_sp_inv G d c s n p \\<equiv>\n       (basic_just_sp_inv G d c s n p \\<and>\n        val d s = 0 \\<and>\n        no_path_inv G d n (ivertex_cnt G)\\<and>\n        (\\<forall>e < ivertex_cnt G. 0 \\<le> c e))\"\n\nlemma shortest_path_pos_cost_pred_eq_invariants:\n\"\\<And>G d c s n p.\n    basic_sp_inv G d c s n p\n    =\n    shortest_path_pos_cost_pred (abs_IGraph G) (abs_IDist d) (abs_ICost c) s (abs_INum n) (abs_IPedge p)\"\n  unfolding basic_sp_inv_def basic_just_sp_inv_def shortest_path_pos_cost_pred_eq_invariants'[symmetric]\n  by force\n\nlemma shortest_path_pos_cost_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   check_sp' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow>\n       basic_sp_inv iG iD iC sc iN iP)\\<rbrace>!\"\n  apply (clarsimp simp: check_sp'_def basic_sp_inv_def)\n  apply wp\n      apply (rule_tac P1=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          basic_just_sp_inv iG iD iC sc iN iP \\<and>\n          sc < ivertex_cnt iG \\<and>\n          val iD sc = 0)\" \n      in validNF_post_imp[OF _ no_path_spc'])\n      apply fastforce\n     apply (rule_tac P= \"P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          basic_just_sp_inv iG iD iC sc iN iP)\" \n      in validNF_post_imp)\n      apply fastforce\n     apply wp\n     apply safe\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply safe\n       apply (subgoal_tac \"fst (iD sc) = val_C (heap_EInt_C s (d +\\<^sub>p uint sc))\")\n        apply argo\n       apply (unfold is_dist_def)[1]\n       apply (subst val_heap, simp+)\n        apply (simp add: basic_just_sp_inv_def)\n       apply (subgoal_tac \"fst (iD sc) = val_C (heap_EInt_C s (d +\\<^sub>p uint sc))\")\n        apply argo\n       apply (unfold is_dist_def is_graph_def)[1]\n       apply (subst val_heap, simp+)\n        apply (simp add: basic_just_sp_inv_def)\n       apply (simp add: is_graph_def)\n      apply (simp add: is_graph_def is_dist_def basic_just_sp_inv_def)\n     apply (subgoal_tac \"fst (iD sc) = val_C (heap_EInt_C s (d +\\<^sub>p uint sc))\")\n      apply argo\n     apply (unfold is_dist_def)[1] \n     apply (simp add: basic_just_sp_inv_def)\n    apply (unfold is_dist_def is_graph_def basic_just_sp_inv_def)[1]\n    apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+) \n   apply (rule_tac P1= \"P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\" \n      in validNF_post_imp[OF _ check_basic_just_sp_spc_intermediate])\n   apply blast\n  apply force\n  done\n\n\nlemma shortest_path_pos_cost_imp_correct:\n\"\\<And>G d c s n p . \n  shortest_path_pos_cost_pred (abs_IGraph G) d c s n p \\<longrightarrow>\n   (\\<forall>v \\<in> verts (abs_IGraph G).\n   d v = wf_digraph.\\<mu> (abs_IGraph G) c s v)\"\n  using shortest_path_pos_cost_pred.correct_shortest_path_pred by fast\n\ntheorem shortest_path_pos_cost_ax_char:\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   check_sp' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow>\n           shortest_path_pos_cost_pred \n                (abs_IGraph iG) (abs_IDist iD) (abs_ICost iC) sc \n                (abs_INum iN) (abs_IPedge iP))\\<rbrace>!\"\n  using validNF_post_imp[OF _ shortest_path_pos_cost_spc'] \n        shortest_path_pos_cost_pred_eq_invariants \n  by simp\n\ncorollary shortest_path_checker_is_correct:\n \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   check_sp' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longrightarrow> \n  (\\<forall>v \\<in> verts (abs_IGraph iG).\n   (abs_IDist iD) v = wf_digraph.\\<mu> (abs_IGraph iG) (abs_ICost iC) sc v))\\<rbrace>!\"\n  using validNF_post_imp[OF _ shortest_path_pos_cost_ax_char] \n        shortest_path_pos_cost_imp_correct \n  by simp\n\nend\n\nend", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-isa19/ShortestPathCVerification.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.538983220687684, "lm_q1q2_score": 0.3295246250364732}}
{"text": "theory TotalCorrectness\nimports \n  \"LinearAssembly/AssemblyToMachine\" \n  \"Assembly/Linearization\" \n  \"BranchingAssembly/Debranching\" \n  \"FlatStack/StackToAssembly\"\n  \"Stack/Flattening\"\nbegin\n\ndefinition state_convert :: \"stack_program \\<Rightarrow> stack_state \\<Rightarrow> machine_state set\" where\n  \"state_convert \\<Pi> \\<Sigma>\\<^sub>S = { \\<Sigma>\\<^sub>M | \\<Sigma>\\<^sub>B \\<Sigma>\\<^sub>M. \n    \\<Sigma>\\<^sub>B \\<in> StackToAssembly.state_convert (Flattening.state_convert \\<Sigma>\\<^sub>S) \\<and> \n      \\<Sigma>\\<^sub>M \\<in> AssemblyToMachine.state_convert\n        (linearize (debranch (StackToAssembly.program_convert (flatten \\<Pi>)))) \n          (Linearization.state_convert \n            (Debranching.state_convert (dom (StackToAssembly.program_convert (flatten \\<Pi>))) \\<Sigma>\\<^sub>B)) }\"\n\ndefinition program_convert :: \"stack_program \\<Rightarrow> machine_program\" where\n  \"program_convert = \n    AssemblyToMachine.program_convert o linearize o \n      debranch o StackToAssembly.program_convert o flatten\"\n\ntheorem output_equivalence: \"\\<Sigma>\\<^sub>M \\<in> state_convert \\<Pi> \\<Sigma>\\<^sub>S \\<Longrightarrow> machine_output \\<Sigma>\\<^sub>M = stack_output \\<Sigma>\\<^sub>S\"\n  proof -\n    let ?\\<Pi>\\<^sub>B = \"StackToAssembly.program_convert (flatten \\<Pi>)\"\n    let ?\\<Pi>\\<^sub>A = \"linearize (debranch ?\\<Pi>\\<^sub>B)\"\n    assume \"\\<Sigma>\\<^sub>M \\<in> state_convert \\<Pi> \\<Sigma>\\<^sub>S\"\n    with state_convert_def obtain \\<Sigma>\\<^sub>B where B: \"\n      \\<Sigma>\\<^sub>B \\<in> StackToAssembly.state_convert (Flattening.state_convert \\<Sigma>\\<^sub>S) \\<and> \n        \\<Sigma>\\<^sub>M \\<in> AssemblyToMachine.state_convert ?\\<Pi>\\<^sub>A (Linearization.state_convert \n          (Debranching.state_convert (dom ?\\<Pi>\\<^sub>B) \\<Sigma>\\<^sub>B))\" by blast\n    thus ?thesis by auto\n  qed\n\ntheorem total_correctness: \"finite (dom \\<Pi>) \\<Longrightarrow> valid_state \\<Pi> \\<Sigma>\\<^sub>S \\<Longrightarrow> \n  iterate_ind (eval_stack \\<Pi>) \\<Sigma>\\<^sub>S \\<Sigma>\\<^sub>S' \\<Longrightarrow> \\<Sigma>\\<^sub>M \\<in> state_convert \\<Pi> \\<Sigma>\\<^sub>S \\<Longrightarrow> \n    \\<exists>\\<Sigma>\\<^sub>M'. \\<Sigma>\\<^sub>M' \\<in> state_convert \\<Pi> \\<Sigma>\\<^sub>S' \\<and> iterate (eval_machine (program_convert \\<Pi>)) \\<Sigma>\\<^sub>M \\<Sigma>\\<^sub>M'\"\n  proof -\n    assume D: \"finite (dom \\<Pi>)\"\n    hence DA: \"finite (dom (StackToAssembly.program_convert (flatten \\<Pi>)))\" by simp\n    hence DF: \"finite (dom (debranch (StackToAssembly.program_convert (flatten \\<Pi>))))\" by simp\n    hence DL: \"domain_distinct (linearize (debranch (StackToAssembly.program_convert (flatten \\<Pi>))))\" \n      by simp\n    assume ES: \"iterate_ind (eval_stack \\<Pi>) \\<Sigma>\\<^sub>S \\<Sigma>\\<^sub>S'\"\n    let ?\\<Pi>\\<^sub>B = \"StackToAssembly.program_convert (flatten \\<Pi>)\"\n    let ?\\<Pi>\\<^sub>A = \"debranch ?\\<Pi>\\<^sub>B\"\n    let ?\\<Pi>\\<^sub>M = \"AssemblyToMachine.program_convert (linearize ?\\<Pi>\\<^sub>A)\"\n    assume \"\\<Sigma>\\<^sub>M \\<in> state_convert \\<Pi> \\<Sigma>\\<^sub>S\"\n    with state_convert_def obtain \\<Sigma>\\<^sub>B where B: \n      \"\\<Sigma>\\<^sub>B \\<in> StackToAssembly.state_convert (Flattening.state_convert \\<Sigma>\\<^sub>S) \\<and> \n        \\<Sigma>\\<^sub>M \\<in> AssemblyToMachine.state_convert (linearize ?\\<Pi>\\<^sub>A) \n          (Linearization.state_convert (Debranching.state_convert (dom ?\\<Pi>\\<^sub>B) \\<Sigma>\\<^sub>B))\" \n      by blast\n    assume \"valid_state \\<Pi> \\<Sigma>\\<^sub>S\"\n    with ES B stack_to_assembly_correct flattening_correct obtain \\<Sigma>\\<^sub>B' where SB': \n      \"\\<Sigma>\\<^sub>B' \\<in> StackToAssembly.state_convert (Flattening.state_convert \\<Sigma>\\<^sub>S') \\<and> \n        iterate (eval_b_assembly ?\\<Pi>\\<^sub>B) \\<Sigma>\\<^sub>B \\<Sigma>\\<^sub>B'\" by blast\n    with ES DA B debranching_correct have SA': \"iterate (eval_assembly ?\\<Pi>\\<^sub>A)\n      (Debranching.state_convert (dom ?\\<Pi>\\<^sub>B) \\<Sigma>\\<^sub>B) (Debranching.state_convert (dom ?\\<Pi>\\<^sub>B) \\<Sigma>\\<^sub>B')\" by blast\n    with DF linearization_correct have SL': \"iterate (eval_l_assembly (linearize ?\\<Pi>\\<^sub>A)) \n      (Linearization.state_convert (Debranching.state_convert (dom ?\\<Pi>\\<^sub>B) \\<Sigma>\\<^sub>B)) \n        (Linearization.state_convert (Debranching.state_convert (dom ?\\<Pi>\\<^sub>B) \\<Sigma>\\<^sub>B'))\" by blast\n    with SA' B DL assembly_to_machine_correct obtain \\<Sigma>\\<^sub>M' where SM': \n      \"\\<Sigma>\\<^sub>M' \\<in> AssemblyToMachine.state_convert (linearize ?\\<Pi>\\<^sub>A) \n        (Linearization.state_convert (Debranching.state_convert (dom ?\\<Pi>\\<^sub>B) \\<Sigma>\\<^sub>B')) \\<and> \n          iterate (eval_machine ?\\<Pi>\\<^sub>M) \\<Sigma>\\<^sub>M \\<Sigma>\\<^sub>M'\" by blast\n    with SA' SB' have \"\\<Sigma>\\<^sub>M' \\<in> { \\<Sigma>\\<^sub>M' | \\<Sigma>\\<^sub>B' \\<Sigma>\\<^sub>M'. \n      \\<Sigma>\\<^sub>B' \\<in> StackToAssembly.state_convert (Flattening.state_convert \\<Sigma>\\<^sub>S') \\<and> \n        \\<Sigma>\\<^sub>M' \\<in> AssemblyToMachine.state_convert (linearize ?\\<Pi>\\<^sub>A) \n          (Linearization.state_convert (Debranching.state_convert (dom ?\\<Pi>\\<^sub>B) \\<Sigma>\\<^sub>B')) }\" \n      by blast\n    with SM' have \"\\<Sigma>\\<^sub>M' \\<in> state_convert \\<Pi> \\<Sigma>\\<^sub>S' \\<and> iterate (eval_machine (program_convert \\<Pi>)) \\<Sigma>\\<^sub>M \\<Sigma>\\<^sub>M'\"\n      by (simp add: state_convert_def program_convert_def)\n    thus ?thesis by fastforce\n  qed\n\nend", "meta": {"author": "xtreme-james-cooper", "repo": "Elements", "sha": "695d842d865d1524a9e638f778b0bad97485b969", "save_path": "github-repos/isabelle/xtreme-james-cooper-Elements", "path": "github-repos/isabelle/xtreme-james-cooper-Elements/Elements-695d842d865d1524a9e638f778b0bad97485b969/TotalCorrectness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300573952054, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.3293395058300693}}
{"text": "(*  Title:      HOL/Auth/n_mesi_lemma_inv__1_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mesi Protocol Case Study*} \n\ntheory n_mesi_lemma_inv__1_on_rules imports n_mesi_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__1  p__Inv0 p__Inv2)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t1  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_t2 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_t3 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_t4 N i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t1  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t1Vsinv__1) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t2 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t2Vsinv__1) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t3 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t3Vsinv__1) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t4 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t4Vsinv__1) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mesi/n_mesi_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7520125737597972, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.3292487764213913}}
{"text": "(*File: OBJ.thy*)\n(*Authors: Lennart Beringer and Martin Hofmann, LMU Munich 2008*)\ntheory OBJ imports Main begin\n\nsection{*Base-line non-interference with objects*}\n\ntext{*\\label{sec:Objects} We now extend the encoding for base-line\nnon-interference to a language with objects.  The development follows\nthe structure of Sections \\ref{sec:IMP} to\n\\ref{sec:BaseLineNI}. Syntax and operational semantics are defined in\nSection \\ref{sec:ObjLanguage}, the axiomatic semantics in Section\n\\ref{sec:ObjLogic}. The generalised definition of non-interference is\ngiven in \\ref{sec:ObjNI}, the derived proof rules in Section\n\\ref{sec:ObjDerivedRules}, and a type system in the style of Volpano\net al.~in Section \\ref{sec:ObjTypeSystem}. Finally, Section\n\\ref{sec:contextObj} concludes with results on contextual closure.*}\n\nsubsection {*Syntax and operational semantics*}\ntext{*\\label{sec:ObjLanguage}*}\n\ntext{*First, some operations for association lists*}\n\nprimrec lookup :: \"('a \\<times> 'b) list \\<Rightarrow> 'a \\<Rightarrow> 'b option\"\nwhere\n\"lookup [] l = None\" |\n\"lookup (h # t) l = (if (fst h)=l then Some (snd h) else lookup t l)\" \n\ndefinition Dom::\"('a \\<times> 'b) list \\<Rightarrow> 'a set\"\nwhere \"Dom L = {l . \\<exists> a . lookup L l = Some a}\"\n\n(*<*)\nlemma lookupNoneAppend[rule_format]: \n\"\\<forall> l L2. (lookup L1 l = None \\<longrightarrow> lookup L2 l = None \\<longrightarrow> lookup (L1 @ L2) l = None)\"\nby (induct L1, simp+)\n\nlemma DomAppendUnion[rule_format]: \"\\<forall> ab. Dom (a @ ab) = Dom a \\<union> Dom ab\"\napply (induct a)\napply (simp add: Dom_def)\napply (simp add: Dom_def)\napply clarsimp apply fast\ndone\n\nlemma DomAppend: \"Dom L \\<subseteq> Dom((a, b) # L)\"\nby (simp add: Dom_def, auto)\n\nlemma lookupSomeAppend1[rule_format]:\n\"\\<forall> L2 l c . lookup L1 l = Some c \\<longrightarrow> lookup (L1 @ L2) l = Some c\"\nby (induct L1, simp, simp)\n\nlemma DomUnion[rule_format]:\"Dom ((a,b) # L) = {a} \\<union> Dom L\"\nby (simp add: Dom_def DomAppendUnion, fast)\n\nlemma lookupSomeAppend2[rule_format]:\n\"\\<forall> l c L2 . lookup L2 l = Some c \\<longrightarrow> Dom L1 \\<inter> Dom L2 = {} \\<longrightarrow> lookup (L1 @ L2) l = Some c\"\napply (induct L1)\napply (simp add: Dom_def)\napply clarsimp\n  apply rule\n    apply clarsimp apply (subgoal_tac \"l:Dom L2\") apply (simp add: DomUnion) \n   apply (simp add: Dom_def) \napply clarsimp\n  apply (erule_tac x=l in allE)\n  apply (erule_tac x=c in allE)\n  apply (erule_tac x=L2 in allE)\n  apply simp apply (erule impE) apply (simp add: DomUnion) \n  apply simp\ndone\n(*>*)\n\ntext{*Abstract types of variables, class names, field names, and\nlocations.*}\n\ntypedecl Var\ntypedecl Class\ntypedecl Field\ntypedecl Location\n\ntext{*References are either null or a location. Values are either\nintegers or references.*}\n\ndatatype Ref = Nullref | Loc Location\n\ndatatype Val = RVal Ref | IVal int \n\ntext{*The heap is a finite map from locations to objects. Objects have\na dynamic class and a field map.*}\n\ntype_synonym Object = \"Class \\<times> ((Field \\<times> Val) list)\"\ntype_synonym Heap = \"(Location \\<times> Object) list\"\n\ntext{*Stores contain values for all variables, and states are pairs of\nstores and heaps.*}\n\ntype_synonym Store = \"Var \\<Rightarrow> Val\"\n\ndefinition update :: \"Store \\<Rightarrow> Var \\<Rightarrow> Val \\<Rightarrow> Store\"\nwhere \"update s x v = (\\<lambda> y . if x=y then v else s y)\"\n\ntype_synonym State = \"Store \\<times> Heap\"\n\ntext{*Arithmetic and boolean expressions are as before.*}\n\ndatatype Expr = \n    varE Var \n  | valE Val\n  | opE \"Val \\<Rightarrow> Val \\<Rightarrow> Val\" Expr Expr\n\ndatatype BExpr = compB \"Val \\<Rightarrow> Val \\<Rightarrow> bool\" Expr Expr\n\ntext{*The same applies to their semantics.*}\n\nprimrec evalE::\"Expr \\<Rightarrow> Store \\<Rightarrow> Val\"\nwhere\n\"evalE (varE x) s = s x\" |\n\"evalE (valE v) s = v\" |\n\"evalE (opE f e1 e2) s = f (evalE e1 s) (evalE e2 s)\"\n\nprimrec evalB::\"BExpr \\<Rightarrow> Store \\<Rightarrow> bool\"\nwhere\n\"evalB (compB f e1 e2) s = f (evalE e1 s) (evalE e2 s)\"\n\ntext{*The category of commands is extended by instructions for\nallocating a fresh object, obtaining a value from a field and assigning\na value to a field.*}\n\ndatatype OBJ =\n    Skip \n  | Assign Var Expr\n  | New Var Class\n  | Get Var Var Field\n  | Put Var Field Expr\n  | Comp OBJ OBJ\n  | While BExpr OBJ\n  | Iff BExpr OBJ OBJ\n  | Call\n\ntext{*The body of the procedure is identified by the same constant as\nbefore.*}\n\nconsts body :: OBJ\n\ntext{*The operational semantics is again a standard big-step\nrelation.*}\n\ninductive_set Semn :: \"(State \\<times> OBJ \\<times> nat \\<times> State) set\"\nwhere\nSemSkip: \"s=t \\<Longrightarrow> (s,Skip,1, t):Semn\"\n\n| SemAssign:\n  \"\\<lbrakk> t = (update (fst s) x (evalE e (fst s)), snd s)\\<rbrakk> \n  \\<Longrightarrow> (s, Assign x e, 1, t):Semn\"\n\n| SemNew:\n  \"\\<lbrakk>l \\<notin> Dom (snd s); \n       t = (update (fst s) x (RVal (Loc l)), (l,(C,[])) # (snd s))\\<rbrakk> \n  \\<Longrightarrow> (s, New x C, 1, t):Semn\"\n\n| SemGet:\n  \"\\<lbrakk>(fst s) y = RVal(Loc l); lookup (snd s) l = Some(C,Flds); \n       lookup Flds F = Some v; t = (update (fst s) x v, snd s)\\<rbrakk> \n  \\<Longrightarrow> (s, Get x y F, 1, t):Semn\"\n\n| SemPut:\n  \"\\<lbrakk>(fst s) x = RVal(Loc l); lookup (snd s) l = Some(C,Flds); \n       t = (fst s, (l,(C,(F,evalE e (fst s)) # Flds)) # (snd s))\\<rbrakk> \n  \\<Longrightarrow> (s, Put x F e, 1, t):Semn\"\n\n| SemComp:\n  \"\\<lbrakk> (s, c, n, r):Semn; (r,d, m, t):Semn; k=(max n m)+1\\<rbrakk>\n  \\<Longrightarrow> (s, Comp c d, k, t):Semn\"\n\n| SemWhileT:\n  \"\\<lbrakk>evalB b (fst s); (s,c, n, r):Semn; (r, While b c, m, t):Semn; k=((max n m)+1)\\<rbrakk>\n  \\<Longrightarrow> (s, While b c, k, t):Semn\"\n\n| SemWhileF:\n  \"\\<lbrakk>\\<not> (evalB b (fst s)); t=s\\<rbrakk> \\<Longrightarrow> (s, While b c, 1, t):Semn\"\n\n| SemTrue:\n  \"\\<lbrakk>evalB b (fst s); (s,c1, n, t):Semn\\<rbrakk> \n  \\<Longrightarrow> (s, Iff b c1 c2, n+1, t):Semn\"\n\n| SemFalse:\n  \"\\<lbrakk>\\<not> (evalB b (fst s)); (s,c2, n, t):Semn\\<rbrakk>\n  \\<Longrightarrow> (s, Iff b c1 c2, n+1, t):Semn\"\n\n| SemCall: \"\\<lbrakk> (s,body,n, t):Semn\\<rbrakk> \\<Longrightarrow> (s,Call,n+1, t):Semn\"\n\nabbreviation\n  SemN  :: \"[State, OBJ, nat, State] \\<Rightarrow> bool\"   (\" _ , _ \\<rightarrow>\\<^sub>_  _ \")\nwhere\n\"s,c \\<rightarrow>\\<^sub>n t == (s,c,n,t) : Semn\"\n\ntext{*Often, the height index does not matter, so we define a notion\nhiding it.*}\n\ndefinition\nSem :: \"[State, OBJ, State] \\<Rightarrow> bool\" (\"_ , _ \\<Down> _ \" 1000)\nwhere \"s,c \\<Down> t = (\\<exists> n. s,c \\<rightarrow>\\<^sub>n t)\"\n\ninductive_cases Sem_eval_cases: \n \"s,Skip \\<rightarrow>\\<^sub>n t\"\n \"s,(Assign x e) \\<rightarrow>\\<^sub>n t\"\n \"s,(New x C) \\<rightarrow>\\<^sub>n t\"\n \"s,(Get x y F) \\<rightarrow>\\<^sub>n t\"\n \"s,(Put x F e) \\<rightarrow>\\<^sub>n t\"\n \"s,(Comp c1 c2) \\<rightarrow>\\<^sub>n t\"\n \"s,(While b c) \\<rightarrow>\\<^sub>n t\"\n \"s,(Iff b c1 c2) \\<rightarrow>\\<^sub>n t\"\n \"s, Call \\<rightarrow>\\<^sub>n t\"\n\n(*<*)\nlemma Sem_no_zero_height_derivsAux: \"\\<forall> s t. ((s, c \\<rightarrow>\\<^sub>0 t) \\<longrightarrow> False)\"\nby (induct_tac c, auto elim: Sem_eval_cases)\n(*>*)\nlemma Sem_no_zero_height_derivs: \"(s, c \\<rightarrow>\\<^sub>0 t) \\<Longrightarrow> False\"\n(*<*)by (insert Sem_no_zero_height_derivsAux, fastforce)(*>*)\n\ntext{* Determinism does not hold as allocation is nondeterministic.*}\n\ntext{*End of theory OBJ*}\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/SIFPL/OBJ.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.3292149283724471}}
{"text": "theory flash27Bra  imports flash27Rev\n \n  begin\nlemma onInv27:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv27  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv27  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv27 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash27Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.32921492837244704}}
{"text": "theory flash48Bra  imports flash48Rev\n \n  begin\nlemma onInv48:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv48  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv48  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv48 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash48Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.32921492837244704}}
{"text": "(*  Title:      statecharts/HA/HAKripke.thy\n\n    Author:     Steffen Helke, Software Engineering Group\n    Copyright   2010 Technische Universitaet Berlin\n*)\n\n\nsection \\<open>Kripke Structures as Hierarchical Automata\\<close>\ntheory HAKripke\nimports HASem Kripke\nbegin\n\ntype_synonym ('s,'e,'d)hakripke = \"(('s,'e,'d)status,('s,'e,'d)atomar)kripke\"\ntype_synonym ('s,'e,'d)hactl    = \"(('s,'e,'d)status,('s,'e,'d)atomar)ctl\"\n\ndefinition\n  LabelFunSem :: \"('s,'e,'d)hierauto\n              => (('s,'e,'d)status \\<rightharpoonup> ((('s,'e,'d) atomar) set))\" where\n  \"LabelFunSem a = (\\<lambda> ST.\n         (if (HA ST = a) then\n              (let\n                  In_preds = (\\<lambda> s. (IN s)) ` (Conf ST);\n                  En_preds = (\\<lambda> e. (EN e)) ` (Events ST);\n                  Val_preds = { x . (\\<exists> P. (x = (VAL P)) \\<and> P (Value ST)) }\n               in\n                  Some (In_preds \\<union> En_preds \\<union> Val_preds \\<union> {atomar.TRUE}))\n            else\n               None))\"\n\ndefinition\n  HA2Kripke :: \"('s,'e,'d)hierauto => ('s,'e,'d)hakripke\" where\n  \"HA2Kripke a =\n         Abs_kripke ({ST. HA ST = a},\n                     {InitStatus a},\n                     StepRelSem a,\n                     LabelFunSem a)\"\n\ndefinition\n   eval_ctl_HA :: \"[('s,'e,'d)hierauto, ('s,'e,'d)hactl]\n                   => bool\"  (\"_ |=H= _\" [92,91]90) where\n\n   \"eval_ctl_HA a f = ((HA2Kripke a), (InitStatus a) |=c= f)\"\n\nlemma Kripke_HA [simp]:\n  \"Kripke {ST. HA ST = a} {InitStatus a} (StepRelSem a) (LabelFunSem a)\"\napply (unfold Kripke_def)\napply auto\napply (unfold StepRelSem_def)\napply auto\napply (unfold LabelFunSem_def Let_def If_def dom_def)\napply auto\nprefer 2\napply (rename_tac ST S)\napply (case_tac \"HA ST = a\")\napply auto\napply (rename_tac ST)\napply (case_tac \"HPT ST = {}\")\napply auto\napply (rename_tac TSS)\napply (erule_tac x=\"StepStatus ST TSS (@ u. u : ResolveRacing TSS)\" in allE)\napply (erule_tac x=TSS in ballE)\napply auto\ndone\n\nlemma LabelFun_LabelFunSem [simp]: \n  \"(LabelFun (HA2Kripke a)) = (LabelFunSem a)\"\napply (unfold HA2Kripke_def LabelFun_def)\napply auto\napply (subst Abs_kripke_inverse)\napply auto\napply (unfold kripke_def)\napply auto\ndone\n\nlemma InitStatuses_InitStatus [simp]:\n   \"(InitStatuses (HA2Kripke a)) = {(InitStatus a)}\"\napply (unfold HA2Kripke_def InitStatuses_def)\napply simp\napply (subst Abs_kripke_inverse)\napply (unfold kripke_def)\napply auto\ndone\n\nlemma Statuses_StatusesOfHA [simp]:\n   \"(Statuses (HA2Kripke a)) = {ST. HA ST = a}\"\napply (unfold HA2Kripke_def Statuses_def)\napply simp\napply (subst Abs_kripke_inverse)\napply (unfold kripke_def)\napply auto\ndone\n\nlemma StepRel_StepRelSem [simp]:\n  \"(StepRel (HA2Kripke a)) = (StepRelSem a)\"\napply (unfold HA2Kripke_def StepRel_def)\napply simp\napply (subst Abs_kripke_inverse)\napply (unfold kripke_def)\napply auto\ndone\n\nlemma TRUE_LabelFunSem [simp]:\n   \"atomar.TRUE \\<in> the (LabelFunSem (HA ST) ST)\"\napply (unfold LabelFunSem_def Let_def)\napply auto\ndone\n\nlemma FALSE_LabelFunSem [simp]:\n   \"atomar.FALSE \\<notin> the (LabelFunSem (HA ST) ST)\"\napply (unfold LabelFunSem_def Let_def)\napply auto\ndone\n\nlemma Conf_LabelFunSem [simp]:\n   \"((IN S) \\<in> the (LabelFunSem (HA ST) ST)) = (S \\<in> (Conf ST))\"\napply (unfold LabelFunSem_def Let_def)\napply auto\ndone\n\nlemma Events_LabelFunSem [simp]:\n  \"((EN S) \\<in> the (LabelFunSem (HA ST) ST)) = (S \\<in> (Events ST))\"\napply (unfold LabelFunSem_def Let_def)\napply auto\ndone\n\nlemma Value_LabelFunSem [simp]:\n  \"((VAL P) \\<in> the (LabelFunSem (HA ST) ST)) = (P (Value ST))\"\napply (unfold LabelFunSem_def Let_def)\napply auto\ndone\n\nlemma AtomTRUE_EvalCTLHA [simp]:\n  \"a |=H= (Atom (atomar.TRUE))\"\napply (unfold eval_ctl_HA_def)\napply auto\napply (subst HA_InitStatus [THEN sym])\napply (rule TRUE_LabelFunSem)\ndone\n\nlemma AtomFalse_EvalCTLHA [simp]:\n  \"\\<not> a |=H= (Atom (atomar.FALSE))\"\napply (unfold eval_ctl_HA_def)\napply auto\napply (subst (asm) HA_InitStatus [THEN sym])\napply (simp only: FALSE_LabelFunSem)\ndone\n\nlemma Events_InitStatus_EvalCTLHA [simp]:\n  \"(a |=H= (Atom (EN S))) = (S \\<in> (Events (InitStatus a)))\"\napply (unfold eval_ctl_HA_def)\napply simp\napply (subst HA_InitStatus [THEN sym])\napply (rule Events_LabelFunSem)\ndone\n\nlemma Conf_InitStatus_EvalCTLHA [simp]:\n  \"(a |=H= (Atom (IN S))) = (S \\<in> (Conf (InitStatus a)))\"\napply (unfold eval_ctl_HA_def)\napply simp\napply (subst HA_InitStatus [THEN sym])\napply (subst Conf_LabelFunSem)\napply simp\ndone\n\nlemma HAInitValue_EvalCTLHA [simp]:\n  \"(a |=H= (Atom (VAL P))) = (P (HAInitValue a))\"\napply (unfold eval_ctl_HA_def)\napply simp\napply (subst HA_InitStatus [THEN sym])\napply (subst Value_LabelFunSem)\napply auto\ndone\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Statecharts/HAKripke.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.32921492837244704}}
{"text": "section \\<open>Priority Search Trees on top of RBTs\\<close>\n\ntheory PST_RBT\nimports\n  \"HOL-Data_Structures.Cmp\"\n  \"HOL-Data_Structures.Isin2\"\n  \"HOL-Data_Structures.Lookup2\"\n  PST_General\n  \"../../../../SeLFiE\"\nbegin\n  \ntext \\<open>\nWe obtain a priority search map based on red-black trees via the \ngeneral priority search tree augmentation.\n\nThis theory has been derived from the standard Isabelle implementation of red \nblack trees in @{session \"HOL-Data_Structures\"}.\n\\<close>\n\nsubsection \\<open>Definitions\\<close>\n\nsubsubsection \\<open>The Code\\<close>\n\ndatatype tcolor = Red | Black\n\ntype_synonym ('k,'p) rbth = \"(('k\\<times>'p) \\<times> (tcolor \\<times> ('k \\<times> 'p))) tree\"\n\nabbreviation R where \"R mkp l a r \\<equiv> Node l (a, Red,mkp) r\"\nabbreviation B where \"B mkp l a r \\<equiv> Node l (a, Black,mkp) r\"\n\nabbreviation \"mkR \\<equiv> mkNode Red\"\nabbreviation \"mkB \\<equiv> mkNode Black\"\n\nfun baliL :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k\\<times>'p \\<Rightarrow> ('k,'p) rbth \\<Rightarrow> ('k,'p) rbth\" \n  where\n  \"baliL (R _ (R _ t1 a1 t2) a2 t3) a3 t4 = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\"\n| \"baliL (R _ t1 a1 (R _ t2 a2 t3)) a3 t4 = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\"\n| \"baliL t1 a t2 = mkB t1 a t2\"\n\nfun baliR :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k\\<times>'p \\<Rightarrow> ('k,'p) rbth \\<Rightarrow> ('k,'p) rbth\" \n  where\n\"baliR t1 a1 (R _ (R _ t2 a2 t3) a3 t4) = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\" |\n\"baliR t1 a1 (R _ t2 a2 (R _ t3 a3 t4)) = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\" |\n\"baliR t1 a t2 = mkB t1 a t2\"\n\nfun paint :: \"tcolor \\<Rightarrow> ('k,'p::linorder) rbth \\<Rightarrow> ('k,'p::linorder) rbth\" where\n\"paint c Leaf = Leaf\" |\n\"paint c (Node l (a, (_,mkp)) r) = Node l (a, (c,mkp)) r\"\n\nfun baldL :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k \\<times> 'p \\<Rightarrow> ('k,'p::linorder) rbth \n    \\<Rightarrow> ('k,'p::linorder) rbth\" \nwhere\n\"baldL (R _ t1 x t2) y t3 = mkR (mkB t1 x t2) y t3\" |\n\"baldL bl x (B _ t1 y t2) = baliR bl x (mkR t1 y t2)\" |\n\"baldL bl x (R _ (B _ t1 y t2) z t3) \n  = mkR (mkB bl x t1) y (baliR t2 z (paint Red t3))\" |\n\"baldL t1 x t2 = mkR t1 x t2\"\n\nfun baldR :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k \\<times> 'p \\<Rightarrow> ('k,'p::linorder) rbth \n    \\<Rightarrow> ('k,'p::linorder) rbth\" \nwhere\n\"baldR t1 x (R _ t2 y t3) = mkR t1 x (mkB t2 y t3)\" |\n\"baldR (B _ t1 x t2) y t3 = baliL (mkR t1 x t2) y t3\" |\n\"baldR (R _ t1 x (B _ t2 y t3)) z t4 \n  = mkR (baliL (paint Red t1) x t2) y (mkB t3 z t4)\" |\n\"baldR t1 x t2 = mkR t1 x t2\"\n\nfun combine :: \"('k,'p::linorder) rbth \\<Rightarrow> ('k,'p::linorder) rbth \n    \\<Rightarrow> ('k,'p::linorder) rbth\" \nwhere\n\"combine Leaf t = t\" |\n\"combine t Leaf = t\" |\n\"combine (R _ t1 a t2) (R _ t3 c t4) =\n  (case combine t2 t3 of\n     R _ u2 b u3 \\<Rightarrow> (mkR (mkR t1 a u2) b (mkR u3 c t4)) |\n     t23 \\<Rightarrow> mkR t1 a (mkR t23 c t4))\" |\n\"combine (B _ t1 a t2) (B _ t3 c t4) =\n  (case combine t2 t3 of\n     R _ t2' b t3' \\<Rightarrow> mkR (mkB t1 a t2') b (mkB t3' c t4) |\n     t23 \\<Rightarrow> baldL t1 a (mkB t23 c t4))\" |\n\"combine t1 (R _ t2 a t3) = mkR (combine t1 t2) a t3\" |\n\"combine (R _ t1 a t2) t3 = mkR t1 a (combine t2 t3)\"\n\nfun color :: \"('k,'p) rbth \\<Rightarrow> tcolor\" where\n\"color Leaf = Black\" |\n\"color (Node _ (_, (c,_)) _) = c\"\n\n\nfun upd :: \"'a::linorder \\<Rightarrow> 'b::linorder \\<Rightarrow> ('a,'b) rbth \\<Rightarrow> ('a,'b) rbth\" where\n\"upd x y Leaf = mkR Leaf (x,y) Leaf\" |\n\"upd x y (B _ l (a,b) r) = (case cmp x a of\n  LT \\<Rightarrow> baliL (upd x y l) (a,b) r |\n  GT \\<Rightarrow> baliR l (a,b) (upd x y r) |\n  EQ \\<Rightarrow> mkB l (x,y) r)\" |\n\"upd x y (R _ l (a,b) r) = (case cmp x a of\n  LT \\<Rightarrow> mkR (upd x y l) (a,b) r |\n  GT \\<Rightarrow> mkR l (a,b) (upd x y r) |\n  EQ \\<Rightarrow> mkR l (x,y) r)\"\n\ndefinition update :: \"'a::linorder \\<Rightarrow> 'b::linorder \\<Rightarrow> ('a,'b) rbth \\<Rightarrow> ('a,'b) rbth\" \nwhere\n\"update x y t = paint Black (upd x y t)\"\n\n\nfun del :: \"'a::linorder \\<Rightarrow> ('a,'b::linorder)rbth \\<Rightarrow> ('a,'b)rbth\" where\n\"del x Leaf = Leaf\" |\n\"del x (Node l ((a,b), (c,_)) r) = (case cmp x a of\n     LT \\<Rightarrow> if l \\<noteq> Leaf \\<and> color l = Black\n           then baldL (del x l) (a,b) r else mkR (del x l) (a,b) r |\n     GT \\<Rightarrow> if r \\<noteq> Leaf\\<and> color r = Black\n           then baldR l (a,b) (del x r) else mkR l (a,b) (del x r) |\n  EQ \\<Rightarrow> combine l r)\"\n\ndefinition delete :: \"'a::linorder \\<Rightarrow> ('a,'b::linorder) rbth \\<Rightarrow> ('a,'b) rbth\" where\n\"delete x t = paint Black (del x t)\"\n\n\nsubsubsection \\<open>Invariants\\<close>\n\nfun bheight :: \"('k,'p) rbth \\<Rightarrow> nat\" where\n\"bheight Leaf = 0\" |\n\"bheight (Node l (x, (c,_)) r) = (if c = Black then bheight l + 1 else bheight l)\"\n\nfun invc :: \"('k,'p) rbth \\<Rightarrow> bool\" where\n\"invc Leaf = True\" |\n\"invc (Node l (a, (c,_)) r) =\n  (invc l \\<and> invc r \\<and> (c = Red \\<longrightarrow> color l = Black \\<and> color r = Black))\"\n\nfun invc2 :: \"('k,'p) rbth \\<Rightarrow> bool\" \\<comment> \\<open>Weaker version\\<close> where\n\"invc2 Leaf = True\" |\n\"invc2 (Node l (a, _) r) = (invc l \\<and> invc r)\"\n\nfun invh :: \"('k,'p) rbth \\<Rightarrow> bool\" where\n\"invh Leaf = True\" |\n\"invh (Node l (x, _) r) = (invh l \\<and> invh r \\<and> bheight l = bheight r)\"\n\ndefinition rbt :: \"('k,'p::linorder) rbth \\<Rightarrow> bool\" where\n\"rbt t = (invc t \\<and> invh t \\<and> invpst t \\<and> color t = Black)\"\n\n\nsubsection \\<open>Functional Correctness\\<close>\n\nlemma inorder_paint[simp]: \"inorder(paint c t) = inorder t\"\nby(cases t) (auto)\n\nlemma inorder_mkNode[simp]:\n  \"inorder (mkNode c l a r) = inorder l @ a # inorder r\"\nby (auto simp: mkNode_def)\n\n\nlemma inorder_baliL[simp]:\n  \"inorder(baliL l a r) = inorder l @ a # inorder r\"\nby(cases \"(l,a,r)\" rule: baliL.cases) (auto)\n\nlemma inorder_baliR[simp]:\n  \"inorder(baliR l a r) = inorder l @ a # inorder r\"\nby(cases \"(l,a,r)\" rule: baliR.cases) (auto)\n\n\nlemma inorder_baldL[simp]:\n  \"inorder(baldL l a r) = inorder l @ a # inorder r\"\nby (cases \"(l,a,r)\" rule: baldL.cases) auto\n\nlemma inorder_baldR[simp]:\n  \"inorder(baldR l a r) = inorder l @ a # inorder r\"\nby(cases \"(l,a,r)\" rule: baldR.cases) auto\n\nlemma inorder_combine[simp]:\n  \"inorder(combine l r) = inorder l @ inorder r\"\n  all_induction_heuristic [on[\"l\",\"r\"], arb[\"ys\"],rule[]] semantic_induct\nby (induction l r rule: combine.induct) (auto split: tree.split tcolor.split)\n\nlemma inorder_upd:\n  \"sorted1(inorder t) \\<Longrightarrow> inorder(upd x y t) = upd_list x y (inorder t)\"\n  (*  88.764s elapsed time, 510.256s cpu time, 7.921s GC time*)\n  (*\\<rightarrow> 2.222s elapsed time, 14.496s cpu time, 0.979s GC time*)\n  all_induction_heuristic [on[\"x\",\"y\",\"t\"], arb[],rule[\"upd.induct\"]]\n  all_induction_heuristic [on[\"x\",\"y\",\"Tree2.inorder t\"], arb[],rule[\"upd_list.induct\"]]\n  semantic_induct\n  by(induction x y t rule: upd.induct)\n  (auto simp: upd_list_simps)\n\nlemma inorder_update:\n  \"sorted1(inorder t) \\<Longrightarrow> inorder(update x y t) = upd_list x y (inorder t)\"\nby(simp add: update_def inorder_upd)\n\nlemma inorder_del:\n \"sorted1(inorder t) \\<Longrightarrow>  inorder(del x t) = del_list x (inorder t)\"\n(*    50.495s elapsed time, 290.232s cpu time, 4.377s GC time\n * \\<rightarrow> 1.455s elapsed time, 10.788s cpu time, 0.096s GC time*)\n  semantic_induct\nby(induction x t rule: del.induct)\n  (auto simp: del_list_simps)\n\nlemma inorder_delete:\n  \"sorted1(inorder t) \\<Longrightarrow> inorder(delete x t) = del_list x (inorder t)\"\nby(simp add: delete_def inorder_del)\n\n\nsubsection \\<open>Invariant Preservation\\<close>\n\nlemma color_paint_Black: \"color (paint Black t) = Black\"\nby (cases t) auto\n\ntheorem rbt_Leaf: \"rbt Leaf\"\nby (simp add: rbt_def)\n\nlemma invc2I: \"invc t \\<Longrightarrow> invc2 t\"\nby (cases t rule: invc.cases) simp+\n\nlemma paint_invc2: \"invc2 t \\<Longrightarrow> invc2 (paint c t)\"\nby (cases t) auto\n\nlemma invc_paint_Black: \"invc2 t \\<Longrightarrow> invc (paint Black t)\"\nby (cases t) auto\n\nlemma invh_paint: \"invh t \\<Longrightarrow> invh (paint c t)\"\nby (cases t) auto\n\nlemma invc_mkRB[simp]:\n  \"invc (mkR l a r) \\<longleftrightarrow> invc l \\<and> invc r \\<and> color l = Black \\<and> color r = Black\"\n  \"invc (mkB l a r) \\<longleftrightarrow> invc l \\<and> invc r\"\nby (simp_all add: mkNode_def)\n\nlemma color_mkNode[simp]: \"color (mkNode c l a r) = c\"\nby (simp_all add: mkNode_def)\n\n\nsubsubsection \\<open>Update\\<close>\n\nlemma invc_baliL:\n  \"\\<lbrakk>invc2 l; invc r\\<rbrakk> \\<Longrightarrow> invc (baliL l a r)\"\n  semantic_induct\nby (induct l a r rule: baliL.induct) auto\n\nlemma invc_baliR:\n  \"\\<lbrakk>invc l; invc2 r\\<rbrakk> \\<Longrightarrow> invc (baliR l a r)\"\n  semantic_induct\nby (induct l a r rule: baliR.induct) auto\n\nlemma bheight_mkRB[simp]:\n  \"bheight (mkR l a r) = bheight l\"\n  \"bheight (mkB l a r) = Suc (bheight l)\"\n  by (simp_all add: mkNode_def)\n\nlemma bheight_baliL:\n  \"bheight l = bheight r \\<Longrightarrow> bheight (baliL l a r) = Suc (bheight l)\"\nsemantic_induct\nby (induct l a r rule: baliL.induct) auto\n\nlemma bheight_baliR:\n  \"bheight l = bheight r \\<Longrightarrow> bheight (baliR l a r) = Suc (bheight l)\"\nsemantic_induct\nby (induct l a r rule: baliR.induct) auto\n\nlemma invh_mkNode[simp]:\n  \"invh (mkNode c l a r) \\<longleftrightarrow> invh l \\<and> invh r \\<and> bheight l = bheight r\"\nby (simp add: mkNode_def)\n\nlemma invh_baliL:\n  \"\\<lbrakk> invh l; invh r; bheight l = bheight r \\<rbrakk> \\<Longrightarrow> invh (baliL l a r)\"\nsemantic_induct\nby (induct l a r rule: baliL.induct) auto\n\nlemma invh_baliR:\n  \"\\<lbrakk> invh l; invh r; bheight l = bheight r \\<rbrakk> \\<Longrightarrow> invh (baliR l a r)\"\nby (induct l a r rule: baliR.induct) auto\n\n\nlemma invc_upd: assumes \"invc t\"\n  shows \"color t = Black \\<Longrightarrow> invc (upd x y t)\" \"invc2 (upd x y t)\"\nusing assms \nby (induct x y t rule: upd.induct) \n   (auto simp: invc_baliL invc_baliR invc2I mkNode_def)\n\nlemma invh_upd: assumes \"invh t\"\n  shows \"invh (upd x y t)\" \"bheight (upd x y t) = bheight t\"\nusing assms \nby(induct x y t rule: upd.induct)\n  (auto simp: invh_baliL invh_baliR bheight_baliL bheight_baliR)\n\n\nlemma invpst_paint[simp]: \"invpst (paint c t) = invpst t\"\nby (cases \"(c,t)\" rule: paint.cases) auto\n\nlemma invpst_baliR: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baliR l a r)\"\nby (cases \"(l,a,r)\" rule: baliR.cases) auto\n\nlemma invpst_baliL: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baliL l a r)\"\nby (cases \"(l,a,r)\" rule: baliL.cases) auto\n\nlemma invpst_upd: \"invpst t \\<Longrightarrow> invpst (upd x y t)\"\nby (induct x y t rule: upd.induct) (auto simp: invpst_baliR invpst_baliL)\n\n\ntheorem rbt_update: \"rbt t \\<Longrightarrow> rbt (update x y t)\"\nby (simp add: invc_upd(2) invh_upd(1) color_paint_Black invc_paint_Black \n  invh_paint rbt_def update_def invpst_upd)\n\n\nsubsubsection \\<open>Delete\\<close>\n\nlemma bheight_paint_Red:\n  \"color t = Black \\<Longrightarrow> bheight (paint Red t) = bheight t - 1\"\nby (cases t) auto\n\nlemma invh_baldL_invc:\n  \"\\<lbrakk> invh l;  invh r;  bheight l + 1 = bheight r;  invc r \\<rbrakk>\n   \\<Longrightarrow> invh (baldL l a r) \\<and> bheight (baldL l a r) = bheight l + 1\"\nby (induct l a r rule: baldL.induct)\n   (auto simp: invh_baliR invh_paint bheight_baliR bheight_paint_Red)\n\nlemma invh_baldL_Black:\n  \"\\<lbrakk> invh l;  invh r;  bheight l + 1 = bheight r;  color r = Black \\<rbrakk>\n   \\<Longrightarrow> invh (baldL l a r) \\<and> bheight (baldL l a r) = bheight r\"\nby (induct l a r rule: baldL.induct) (auto simp add: invh_baliR bheight_baliR)\n\nlemma invc_baldL: \"\\<lbrakk>invc2 l; invc r; color r = Black\\<rbrakk> \\<Longrightarrow> invc (baldL l a r)\"\nby (induct l a r rule: baldL.induct) (auto simp: invc_baliR invc2I mkNode_def)\n\nlemma invc2_baldL: \"\\<lbrakk> invc2 l; invc r \\<rbrakk> \\<Longrightarrow> invc2 (baldL l a r)\"\nby (induct l a r rule: baldL.induct) \n   (auto simp: invc_baliR paint_invc2 invc2I mkNode_def)\n\nlemma invh_baldR_invc:\n  \"\\<lbrakk> invh l;  invh r;  bheight l = bheight r + 1;  invc l \\<rbrakk>\n  \\<Longrightarrow> invh (baldR l a r) \\<and> bheight (baldR l a r) = bheight l\"\nby(induct l a r rule: baldR.induct)\n  (auto simp: invh_baliL bheight_baliL invh_paint bheight_paint_Red)\n\nlemma invc_baldR: \"\\<lbrakk>invc a; invc2 b; color a = Black\\<rbrakk> \\<Longrightarrow> invc (baldR a x b)\"\nby (induct a x b rule: baldR.induct) (simp_all add: invc_baliL mkNode_def)\n\nlemma invc2_baldR: \"\\<lbrakk> invc l; invc2 r \\<rbrakk> \\<Longrightarrow>invc2 (baldR l x r)\"\nby (induct l x r rule: baldR.induct) \n   (auto simp: invc_baliL paint_invc2 invc2I mkNode_def)\n\nlemma invh_combine:\n  \"\\<lbrakk> invh l; invh r; bheight l = bheight r \\<rbrakk>\n  \\<Longrightarrow> invh (combine l r) \\<and> bheight (combine l r) = bheight l\"\nby (induct l r rule: combine.induct)\n   (auto simp: invh_baldL_Black split: tree.splits tcolor.splits)\n\nlemma invc_combine:\n  assumes \"invc l\" \"invc r\"\n  shows \"color l = Black \\<Longrightarrow> color r = Black \\<Longrightarrow> invc (combine l r)\"\n         \"invc2 (combine l r)\"\nusing assms \nby (induct l r rule: combine.induct)\n   (auto simp: invc_baldL invc2I mkNode_def split: tree.splits tcolor.splits)\n\nlemma neq_LeafD: \"t \\<noteq> Leaf \\<Longrightarrow> \\<exists>l x c r. t = Node l (x,c) r\"\nby(cases t) auto\n\nlemma del_invc_invh: \"invh t \\<Longrightarrow> invc t \\<Longrightarrow> invh (del x t) \\<and>\n   (color t = Red \\<and> bheight (del x t) = bheight t \\<and> invc (del x t) \\<or>\n    color t = Black \\<and> bheight (del x t) = bheight t - 1 \\<and> invc2 (del x t))\"semantic_induct\nproof (induct x t rule: del.induct)\ncase (2 x _ y _ c)\n  have \"x = y \\<or> x < y \\<or> x > y\" by auto\n  thus ?case proof (elim disjE)\n    assume \"x = y\"\n    with 2 show ?thesis\n    by (cases c) (simp_all add: invh_combine invc_combine)\n  next\n    assume \"x < y\"\n    with 2 show ?thesis\n      by(cases c)\n        (auto \n          simp: invh_baldL_invc invc_baldL invc2_baldL mkNode_def \n          dest: neq_LeafD)\n  next\n    assume \"y < x\"\n    with 2 show ?thesis\n      by(cases c)\n        (auto \n          simp: invh_baldR_invc invc_baldR invc2_baldR mkNode_def \n          dest: neq_LeafD)\n  qed\nqed auto\n\nlemma invpst_baldR: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baldR l a r)\"\nby (cases \"(l,a,r)\" rule: baldR.cases) (auto simp: invpst_baliL)\n\nlemma invpst_baldL: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baldL l a r)\"\nby (cases \"(l,a,r)\" rule: baldL.cases) (auto simp: invpst_baliR)\n\nlemma invpst_combine: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (combine l r)\" semantic_induct\nby(induction l r rule: combine.induct)\n  (auto split: tree.splits tcolor.splits simp: invpst_baldR invpst_baldL)\n\nlemma invpst_del: \"invpst t \\<Longrightarrow> invpst (del x t)\"semantic_induct\nby(induct x t rule: del.induct)\n  (auto simp: invpst_baldR invpst_baldL invpst_combine)\n\ntheorem rbt_delete: \"rbt t \\<Longrightarrow> rbt (delete k t)\"\napply (clarsimp simp: delete_def rbt_def)\napply (frule (1) del_invc_invh[where x=k])\napply (auto simp: invc_paint_Black invh_paint color_paint_Black invpst_del)\ndone\n\nlemma rbt_getmin_ismin: \n  \"rbt t \\<Longrightarrow> t\\<noteq>Leaf \\<Longrightarrow> is_min2 (pst_getmin t) (set_tree t)\"\nunfolding rbt_def by (simp add: pst_getmin_ismin)\n\ndefinition \"rbt_is_empty t \\<equiv> t = Leaf\"\n\nlemma rbt_is_empty: \"rbt_is_empty t \\<longleftrightarrow> inorder t = []\"\nby (cases t) (auto simp: rbt_is_empty_def)\n\ndefinition empty where \"empty = Leaf\"\n\n\nsubsection \\<open>Overall Correctness\\<close>\n\ninterpretation PM: PrioMap_by_Ordered\nwhere empty = empty and lookup = lookup and update = update and delete = delete\nand inorder = inorder and inv = \"rbt\" and is_empty = rbt_is_empty \nand getmin = pst_getmin\napply standard\napply (auto simp: lookup_map_of inorder_update inorder_delete rbt_update \n                  rbt_delete rbt_Leaf rbt_is_empty empty_def \n            dest: rbt_getmin_ismin)\ndone\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Priority_Search_Trees/PST_RBT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.32921492837244704}}
{"text": "theory flash23Bra  imports flash23Rev\n \n  begin\nlemma onInv23:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv23  iInv1  iInv2  iInv3 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX1VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_GetXVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ShWbVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX7VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak2VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX5VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_WbVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_GetVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceShrVldVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_2VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak2VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_ReplaceVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_HomeVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put2VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX11VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX6VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put2VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1_HomeVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak1VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak1VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak2VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak3VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX2VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put1VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutXVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis StoreVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_FAckVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX3VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutXVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put1VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis StoreHomeVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_NakVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_PutXVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX4VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_NakVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak1VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_ClearVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_PutXVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak3VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX9VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetXVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv23  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put3VsInv23 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash23Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710085, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.329214928372447}}
{"text": "section {*I\\_kparser\\_HFS\\_HF*}\ntheory\n  I_kparser_HFS_HF\n\nimports\n  I_kparser_HF\n  I_kparser_HFS\n\nbegin\n\nlemma rule_drop_in_parser_events_no_bottom: \"\n  valid_parser G\n  \\<Longrightarrow> set w \\<subseteq> parser_events G - {parser_bottom G}\n  \\<Longrightarrow> (\\<exists>x. x @ [parser_bottom G] = kPrefix k (w @ [parser_bottom G])) \\<longrightarrow> (\\<exists>x. x @ [parser_bottom G] = rule_rpush e)\n  \\<Longrightarrow> xa @ rule_rpush e = kPrefix k (w @ [parser_bottom G])\n  \\<Longrightarrow> set xa \\<subseteq> parser_events G \\<and> parser_bottom G \\<notin> set xa\"\n  apply(rule conjI)\n   apply(rule_tac\n      B=\"set (xa@rule_rpush e)\"\n      in subset_trans)\n    apply(rule set_append1)\n   apply(rule_tac\n      t=\"xa@rule_rpush e\"\n      and s=\"kPrefix k (w @ [parser_bottom G])\"\n      in ssubst)\n    apply(force)\n   apply(thin_tac \"xa @ rule_rpush e = kPrefix k (w @ [parser_bottom G])\")\n   apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(simp add: kPrefix_def)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac x)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      A=\"set(take k w)\"\n      in set_mp)\n     apply(rename_tac x)(*strict*)\n     apply(rule_tac\n      B=\"set w\"\n      in subset_trans)\n      apply(rename_tac x)(*strict*)\n      apply(rule set_take_subset)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x nat xa)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac x nat xa)(*strict*)\n    apply(force)\n   apply(rename_tac x nat xa)(*strict*)\n   apply(simp add: valid_parser_def)\n  apply(simp add: kPrefix_def)\n  apply(case_tac \"k-length w\")\n   apply(clarsimp)\n   apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n    apply(force)\n   apply(rule_tac\n      A=\"set(take k w)\"\n      in set_mp)\n    apply(rule set_take_subset)\n   apply(rule_tac\n      t=\"take k w\"\n      and s=\"xa @ rule_rpush e\"\n      in ssubst)\n    apply(force)\n   apply(thin_tac \"xa @ rule_rpush e = take k w\")\n   apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat x)(*strict*)\n  apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n   apply(rename_tac nat x)(*strict*)\n   apply(force)\n  apply(rename_tac nat x)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac nat x rule_lpop rule_rpop rule_lpush rule_rpusha more)(*strict*)\n  apply(clarsimp)\n  done\n\ndefinition parserHFvHFS_Lin2BraConf :: \"\n  ('stack, 'event) parserHFS_conf\n  \\<Rightarrow> ('stack, 'event) parserHF_conf\"\n  where\n    \"parserHFvHFS_Lin2BraConf c \\<equiv>\n  \\<lparr>parserHF_conf_fixed = parserHFS_conf_fixed c,\n  parserHF_conf_history = parserHFS_conf_history c,\n  parserHF_conf_stack = parserHFS_conf_stack c\\<rparr>\"\n\ndefinition parserHFvHFS_Bra2LinConf :: \"\n  ('stack, 'event) parserHF_conf\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> ('stack, 'event) parserHFS_conf\"\n  where\n    \"parserHFvHFS_Bra2LinConf c w \\<equiv>\n  \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n  parserHFS_conf_history = parserHF_conf_history c,\n  parserHFS_conf_stack = parserHF_conf_stack c,\n  parserHFS_conf_scheduler = w\\<rparr>\"\n\ndefinition parserHFvHFS_Bra2LinStep :: \"\n  ('stack, 'event) parserHF_conf\n  \\<Rightarrow> ('stack, 'event) parser_step_label\n  \\<Rightarrow> ('stack, 'event) parserHF_conf\n  \\<Rightarrow> 'event list\"\n  where\n    \"parserHFvHFS_Bra2LinStep c1 e c2 \\<equiv>\n  the (right_quotient_word (rule_rpop e) (rule_rpush e))\"\n\nlemma parserHFvHFS_inst_AX_Lin2BraConf_preserves_initiality: \"\n  \\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cl. cl \\<in> parserHFS_initial_configurations G \\<longrightarrow> parserHFvHFS_Lin2BraConf cl \\<in> parserHF_initial_configurations G)\"\n  apply(simp add: parserHFvHFS_Lin2BraConf_def parserHF_initial_configurations_def parserHFS_initial_configurations_def parserHF_configurations_def parserHFS_configurations_def)\n  apply(clarsimp)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinStep_closed: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>c1B. c1B \\<in> parserHF_configurations G \\<longrightarrow> (\\<forall>e c2B. parserHF_step_relation G c1B e c2B \\<longrightarrow> parserHFvHFS_Bra2LinStep c1B e c2B \\<in> parser_scheduler_fragments G)))\"\n  apply(clarsimp)\n  apply(rename_tac G c1B e c2B)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinStep_def)\n  apply(subgoal_tac \"valid_parser_step_label G e\")\n   apply(rename_tac G c1B e c2B)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(rename_tac G c1B e c2B)(*strict*)\n  apply(simp add: valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac G c1B e c2B k w xa)(*strict*)\n  apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xa\"\n      in ssubst)\n   apply(rename_tac G c1B e c2B k w xa)(*strict*)\n   apply(rule right_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G c1B e c2B k w xa)(*strict*)\n  apply(clarsimp)\n  apply(simp add: parser_scheduler_fragments_def)\n  apply(rule conjI)\n   apply(rename_tac G c1B e c2B k w xa)(*strict*)\n   apply(rule_tac\n      B=\"set (xa @ rule_rpush e)\"\n      in subset_trans)\n    apply(rename_tac G c1B e c2B k w xa)(*strict*)\n    apply(rule set_append1)\n   apply(rename_tac G c1B e c2B k w xa)(*strict*)\n   apply(rule_tac\n      t=\"xa@(rule_rpush e)\"\n      and s=\"kPrefix k (w@[parser_bottom G])\"\n      in ssubst)\n    apply(rename_tac G c1B e c2B k w xa)(*strict*)\n    apply(force)\n   apply(rename_tac G c1B e c2B k w xa)(*strict*)\n   apply(thin_tac \"xa @ rule_rpush e = kPrefix k (w @ [parser_bottom G])\")\n   apply(clarsimp)\n   apply(rename_tac G c1B e c2B k w x)(*strict*)\n   apply(simp add: kPrefix_def)\n   apply(erule disjE)\n    apply(rename_tac G c1B e c2B k w x)(*strict*)\n    apply(rule_tac\n      A=\"set w\"\n      in set_mp)\n     apply(rename_tac G c1B e c2B k w x)(*strict*)\n     apply(force)\n    apply(rename_tac G c1B e c2B k w x)(*strict*)\n    apply(rule_tac\n      A=\"set (take k w)\"\n      in set_mp)\n     apply(rename_tac G c1B e c2B k w x)(*strict*)\n     apply(rule set_take_subset)\n    apply(rename_tac G c1B e c2B k w x)(*strict*)\n    apply(force)\n   apply(rename_tac G c1B e c2B k w x)(*strict*)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac G c1B e c2B k w x)(*strict*)\n    apply(force)\n   apply(rename_tac G c1B e c2B k w x nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G c1B e c2B k w nat xa)(*strict*)\n   apply(simp add: valid_parser_def)\n  apply(rename_tac G c1B e c2B k w xa)(*strict*)\n  apply(simp add: kPrefix_def)\n  apply(case_tac \"k-length w\")\n   apply(rename_tac G c1B e c2B k w xa)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n    apply(rename_tac G c1B e c2B k w xa)(*strict*)\n    apply(force)\n   apply(rename_tac G c1B e c2B k w xa)(*strict*)\n   apply(rule_tac\n      A=\"set (take k w)\"\n      in set_mp)\n    apply(rename_tac G c1B e c2B k w xa)(*strict*)\n    apply(rule set_take_subset)\n   apply(rename_tac G c1B e c2B k w xa)(*strict*)\n   apply(rule_tac\n      t=\"take k w\"\n      and s=\"xa@(rule_rpush e)\"\n      in ssubst)\n    apply(rename_tac G c1B e c2B k w xa)(*strict*)\n    apply(force)\n   apply(rename_tac G c1B e c2B k w xa)(*strict*)\n   apply(thin_tac \"xa @ rule_rpush e = take k w\")\n   apply(force)\n  apply(rename_tac G c1B e c2B k w xa nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G c1B e c2B k w xa nat x)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac G c1B e c2B k w xa nat x rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G c1B c2B k xa nat x rule_lpop rule_lpush)(*strict*)\n  apply(force)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinFin_closed : \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cB. (parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> parserHF_conf_fixed cB \\<in> parser_schedulers G) \\<and> (\\<not> parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> parserHF_conf_fixed cB @ [parser_bottom G] \\<in> parser_schedulers G)))\"\n  apply(clarsimp)\n  apply(rename_tac G cB)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G cB)(*strict*)\n   apply(simp add: suffix_def parserHF_configurations_def parser_schedulers_def)\n   apply(clarsimp)\n  apply(rename_tac G cB)(*strict*)\n  apply(simp add: suffix_def parserHF_configurations_def parser_schedulers_def)\n  apply(clarsimp)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinConf_schedl_get : \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cB sL. parserHFvHFS_Bra2LinConf cB sL \\<in> parserHFS_configurations G \\<longrightarrow> sL \\<in> parser_schedulers G \\<longrightarrow> parserHFS_get_scheduler (parserHFvHFS_Bra2LinConf cB sL) = sL))\"\n  apply(clarsimp)\n  apply(rename_tac G cB sL)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFS_get_scheduler_def parserHFS_configurations_def)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinFin_creates_proper_extension : \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cB. (parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> parserHFvHFS_Bra2LinConf cB (parserHF_conf_fixed cB) \\<in> parserHFS_configurations G) \\<and> (\\<not> parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> parserHFvHFS_Bra2LinConf cB (parserHF_conf_fixed cB @ [parser_bottom G]) \\<in> parserHFS_configurations G)))\"\n  apply(clarsimp)\n  apply(rename_tac G cB)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G cB)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHF_configurations_def parserHFvHFS_Bra2LinConf_def parserHFS_configurations_def suffix_def prefix_def)\n   apply(clarsimp)\n  apply(rename_tac G cB)(*strict*)\n  apply(simp add: parserHF_configurations_def parserHFvHFS_Bra2LinConf_def parserHFS_configurations_def suffix_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G f l c)(*strict*)\n  apply(simp add: valid_parser_def)\n  done\n\nlemma parserHFvHFS_inst_AX_Lin2BraConf_preserves_configurations : \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cl. cl \\<in> parserHFS_configurations G \\<longrightarrow> parserHFvHFS_Lin2BraConf cl \\<in> parserHF_configurations G))\"\n  apply(clarsimp)\n  apply(rename_tac G cl)(*strict*)\n  apply(simp add: parserHFvHFS_Lin2BraConf_def parserHF_configurations_def parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G f h l w)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G f h l w c)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac G f h l w c)(*strict*)\n   apply (metis rotate_simps set_append1 set_rotate1 set_take_head2 subset_trans)\n  apply(rename_tac G f h l w c)(*strict*)\n  apply (metis List.butlast_append butlast_snoc self_append_conv set_append_contra1)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinConf_preserves_initiality: \"\n  \\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>sL. sL \\<in> parser_schedulers G \\<longrightarrow> (\\<forall>cB. cB \\<in> parserHF_initial_configurations G \\<longrightarrow> parserHFvHFS_Bra2LinConf cB sL \\<in> parserHFS_initial_configurations G))\"\n  apply(clarsimp)\n  apply(rename_tac G sL cB)(*strict*)\n  apply(simp add: parserHFS_initial_configurations_def)\n  apply(simp add: parserHF_initial_configurations_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac G sL cB)(*strict*)\n   apply(simp add: parserHFvHFS_Bra2LinConf_def)\n  apply(rename_tac G sL cB)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G sL cB)(*strict*)\n   apply(simp add: parserHFvHFS_Bra2LinConf_def)\n  apply(rename_tac G sL cB)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G sL cB)(*strict*)\n   apply(simp add: parserHFvHFS_Bra2LinConf_def)\n  apply(rename_tac G sL cB)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFS_configurations_def parserHF_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G sL)(*strict*)\n  apply(simp add: parser_schedulers_def)\n  apply(clarsimp)\n  apply(rename_tac G v)(*strict*)\n  apply(simp add: valid_parser_def)\n  apply(simp add: prefix_def)\n  done\n\nlemma parserHFvHFS_inst_AX_lin_step_relation_from_Bra2LinStep : \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>c1B. c1B \\<in> parserHF_configurations G \\<longrightarrow> (\\<forall>e c2B. parserHF_step_relation G c1B e c2B \\<longrightarrow> (\\<forall>sL. parserHFvHFS_Bra2LinConf c2B sL \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_step_relation G (parserHFvHFS_Bra2LinConf c1B (parserHFvHFS_Bra2LinStep c1B e c2B @ sL)) e (parserHFvHFS_Bra2LinConf c2B sL)))))\"\n  apply(clarsimp)\n  apply(rename_tac G c1B e c2B sL)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e\")\n   apply(rename_tac G c1B e c2B sL)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(rename_tac G c1B e c2B sL)(*strict*)\n  apply(simp add: valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n  apply(subgoal_tac \"c2B \\<in> parserHF_configurations G\")\n   apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n   prefer 2\n   apply(rule parserHF.AX_step_relation_preserves_belongsC)\n     apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n     apply(force)\n    apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n    apply(force)\n   apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n   apply(force)\n  apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinStep_def parserHF_configurations_def parserHFvHFS_Bra2LinConf_def parserHFS_configurations_def suffix_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n  apply(simp add: parserHFS_step_relation_def parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n  apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xa\"\n      in ssubst)\n   apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n   apply(rule right_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n  apply(clarsimp)\n  apply(simp add: kPrefix_def)\n  apply(case_tac \"k-length w\")\n   apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"take k w\"\n      and s=\"xa @ rule_rpush e\"\n      in ssubst)\n    apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n    apply(force)\n   apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n   apply(rule_tac\n      t=\"wa @ [parser_bottom G]\"\n      and s=\"rule_rpush e @ drop (min (length w) k) f @ c\"\n      in ssubst)\n    apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n    apply(force)\n   apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n   apply(rule_tac\n      x=\"drop (min (length w) k) f @ c\"\n      in exI)\n   apply(simp (no_asm))\n  apply(rename_tac G e k w xa f c ca wa cb x nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n  apply(rule_tac\n      x=\"[]\"\n      in exI)\n  apply(clarsimp)\n  apply(subgoal_tac \"wa=xb\")\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G e k w xa f ca cb x nat xb)(*strict*)\n   apply(rule triv_double_append)\n    apply(rename_tac G e k w xa f ca cb x nat xb)(*strict*)\n    apply(force)\n   apply(rename_tac G e k w xa f ca cb x nat xb)(*strict*)\n   apply(force)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n  apply(rule_tac\n      v=\"[parser_bottom G]\"\n      in append_injr)\n  apply(rule_tac\n      t=\"xb@[parser_bottom G]\"\n      and s=\"rule_rpush e\"\n      in ssubst)\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n   apply(force)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n  apply(rule_tac\n      t=\"wa @ [parser_bottom G]\"\n      and s=\"rule_rpush e @ drop (Suc (min (length w) k)) f @ c\"\n      in ssubst)\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n   apply(force)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n  apply(subgoal_tac \"drop (Suc (min (length w) k)) f @ c = []\")\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n   apply(force)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n  apply(clarsimp)\n  apply(rule propSym)\n  apply(rule context_conjI)\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n   apply(case_tac c)\n    apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n    apply(rename_tac G e k w xa f c ca wa cb x nat xb a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb a list)(*strict*)\n   apply(thin_tac \"c = a # list\")\n   apply(clarsimp)\n   apply(rename_tac G e k w xa f ca cb x nat xb w')(*strict*)\n   apply(case_tac e)\n   apply(rename_tac G e k w xa f ca cb x nat xb w' rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G e k w xa f ca wa cb x nat xb)(*strict*)\n  apply(subgoal_tac \"min (length w) k = length w\")\n   apply(rename_tac G e k w xa f ca wa cb x nat xb)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G e k w xa f ca wa cb x nat xb)(*strict*)\n  apply(clarsimp)\n  apply(thin_tac \"min (length w) k = length w\")\n  apply(subgoal_tac \"Suc nat+length w = k\")\n   apply(rename_tac G e k w xa f ca wa cb x nat xb)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G e k w xa f ca wa cb x nat xb)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G e w xa f ca wa cb x xb)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac G e w xa f ca wa cb x xb)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac G e w xa f ca wa cb x xb c)(*strict*)\n   apply(rule length_shorter_append)\n   apply(force)\n  apply(rename_tac G e w xa f ca wa cb x xb)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G e w xa ca wa cb x xb c wb)(*strict*)\n  apply(case_tac c)\n   apply(rename_tac G e w xa ca wa cb x xb c wb)(*strict*)\n   apply(force)\n  apply(rename_tac G e w xa ca wa cb x xb c wb a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n   apply(rename_tac G e w xa ca wa cb x xb c wb a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G e w xa ca wa cb x xb c wb a list)(*strict*)\n  apply(thin_tac \"c = a # list\")\n  apply(clarsimp)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinConf_only_modifies_lin_unfixed_scheduler: \"\n  \\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cL sL. parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL) sL \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_set_unfixed_scheduler cL (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL) sL)) = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL) sL)\"\n  apply(clarsimp)\n  apply(rename_tac G cL sL)(*strict*)\n  apply(simp add: parserHFS_set_unfixed_scheduler_def parserHFvHFS_Bra2LinConf_def parserHFvHFS_Lin2BraConf_def parserHFS_get_unfixed_scheduler_def prefix_def parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G cL c w)(*strict*)\n  apply(rule_tac\n      t=\"left_quotient_word (parserHFS_conf_fixed cL) (w @ [parser_bottom G])\"\n      and s=\"Some c\"\n      in ssubst)\n   apply(rename_tac G cL c w)(*strict*)\n   apply(rule left_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cL c w)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinConf_schedl_get2: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cB. cB \\<in> parserHF_configurations G \\<longrightarrow> (\\<forall>s1L s2L. parserHFvHFS_Bra2LinConf cB s1L = parserHFvHFS_Bra2LinConf cB s2L \\<longrightarrow> s1L = s2L)))\"\n  apply(clarsimp)\n  apply(rename_tac G cB s1L s2L)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinConf_inj: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cB. cB \\<in> parserHF_configurations G \\<longrightarrow> (\\<forall>s1L. s1L \\<in> parser_schedulers G \\<longrightarrow> s1L = parserHFS_get_scheduler (parserHFvHFS_Bra2LinConf cB s1L))))\"\n  apply(clarsimp)\n  apply(rename_tac G cB s1L)(*strict*)\n  apply(simp add: parserHFS_get_scheduler_def parserHFvHFS_Bra2LinConf_def)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinConf_on_empty_bra_sched_closed: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cB. cB \\<in> parserHF_configurations G \\<longrightarrow> parserHF_conf_fixed cB = [] \\<longrightarrow> parserHFvHFS_Bra2LinConf cB [parser_bottom G] \\<in> parserHFS_configurations G))\"\n  apply(clarsimp)\n  apply(rename_tac G cB)(*strict*)\n  apply(simp add: parserHF_configurations_def parserHFvHFS_Bra2LinConf_def parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G h l)(*strict*)\n  apply(simp add: prefix_def valid_parser_def)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinFin_on_empty_fixed_scheduler: \"\n  (\\<forall>G. [] \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> \\<not> valid_parser G)\"\n  apply(simp add: suffix_def)\n  done\n\nlemma parserHFvHFS_inst_AX_Bra2LinStep_translates_backwards_Bra2LinConf_closed : \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>c1B. c1B \\<in> parserHF_configurations G \\<longrightarrow> (\\<forall>e c2B. parserHF_step_relation G c1B e c2B \\<longrightarrow> (\\<forall>sL. parserHFvHFS_Bra2LinConf c2B sL \\<in> parserHFS_configurations G \\<longrightarrow> parserHFvHFS_Bra2LinConf c1B (parserHFvHFS_Bra2LinStep c1B e c2B @ sL) \\<in> parserHFS_configurations G))))\"\n  apply(clarsimp)\n  apply(rename_tac G c1B e c2B sL)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e\")\n   apply(rename_tac G c1B e c2B sL)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(rename_tac G c1B e c2B sL)(*strict*)\n  apply(simp add: valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n  apply(subgoal_tac \"c2B \\<in> parserHF_configurations G\")\n   apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n   prefer 2\n   apply(rule parserHF.AX_step_relation_preserves_belongsC)\n     apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n     apply(force)\n    apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n    apply(force)\n   apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n   apply(force)\n  apply(rename_tac G c1B e c2B sL k w xa)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinStep_def parserHF_configurations_def parserHFvHFS_Bra2LinConf_def parserHFS_configurations_def suffix_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n  apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xa\"\n      in ssubst)\n   apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n   apply(rule right_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n  apply(clarsimp)\n  apply(rule propSym)\n  apply(rule conjI)\n   apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n   apply(rule rule_drop_in_parser_events_no_bottom)\n      apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n      apply(force)\n     apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n    apply(force)\n   apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n   apply(force)\n  apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n  apply(rule_tac\n      s=\"fa @ c\"\n      and t=\"wa @ [parser_bottom G]\"\n      in ssubst)\n   apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n   apply(force)\n  apply(rename_tac G e k w xa f fa l la c ca wa cb)(*strict*)\n  apply(simp add: parserHF_step_relation_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n  apply(thin_tac \"set (rule_lpop e) \\<subseteq> parser_nonterms G\")\n  apply(thin_tac \"set (rule_lpush e) \\<subseteq> parser_nonterms G\")\n  apply(thin_tac \"rule_lpop e \\<noteq> []\")\n  apply(thin_tac \"rule_lpush e \\<noteq> []\")\n  apply(simp add: kPrefix_def)\n  apply(case_tac \"k-length w\")\n   apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n   apply(clarsimp)\n   apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take k w) \\<longrightarrow> (\\<exists>x. x @ [parser_bottom G] = rule_rpush e)\")\n   apply(subgoal_tac \"min (length w) k=k\")\n    apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n   apply(clarsimp)\n   apply(thin_tac \"min (length w) k=k\")\n   apply(thin_tac \"parser_bottom G \\<in> set (rule_rpush e) \\<longrightarrow> (\\<exists>w. rule_rpush e @ drop k f = w @ [parser_bottom G] \\<and> parser_bottom G \\<notin> set w)\")\n   apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n   apply(thin_tac \"set (drop k f) \\<subseteq> parser_events G\")\n   apply(erule disjE)\n    apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G e k w xa c ca wa cb x cc)(*strict*)\n    apply(rule_tac\n      t=\"take k w\"\n      and s=\"xa@rule_rpush e\"\n      in ssubst)\n     apply(rename_tac G e k w xa c ca wa cb x cc)(*strict*)\n     apply(force)\n    apply(rename_tac G e k w xa c ca wa cb x cc)(*strict*)\n    apply(rule_tac\n      t=\"wa@[parser_bottom G]\"\n      and s=\"rule_rpush e @ cc @ c\"\n      in ssubst)\n     apply(rename_tac G e k w xa c ca wa cb x cc)(*strict*)\n     apply(force)\n    apply(rename_tac G e k w xa c ca wa cb x cc)(*strict*)\n    apply(rule_tac\n      x=\"c\"\n      in exI)\n    apply(simp (no_asm))\n   apply(rename_tac G e k w xa f c ca wa cb x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G e k w xa f c ca wa cb x cc)(*strict*)\n   apply(case_tac \"parser_bottom G \\<in> set f\")\n    apply(rename_tac G e k w xa f c ca wa cb x cc)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G e k w xa c ca wa cb x cc wb)(*strict*)\n    apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n     apply(rename_tac G e k w xa c ca wa cb x cc wb)(*strict*)\n     apply(subgoal_tac \"False\")\n      apply(rename_tac G e k w xa c ca wa cb x cc wb)(*strict*)\n      apply(force)\n     apply(rename_tac G e k w xa c ca wa cb x cc wb)(*strict*)\n     apply(rule_tac\n      x=\"parser_bottom G\"\n      and A=\"parser_events G\"\n      and w=\"w\"\n      in nset_diff)\n      apply(rename_tac G e k w xa c ca wa cb x cc wb)(*strict*)\n      apply(force)\n     apply(rename_tac G e k w xa c ca wa cb x cc wb)(*strict*)\n     apply(force)\n    apply(rename_tac G e k w xa c ca wa cb x cc wb)(*strict*)\n    apply(rule take_reflects_mem)\n    apply(force)\n   apply(rename_tac G e k w xa f c ca wa cb x cc)(*strict*)\n   apply(clarsimp)\n   apply(thin_tac \"parser_bottom G \\<in> set (drop k f) \\<longrightarrow> (\\<exists>w. rule_rpush e @ drop k f = w @ [parser_bottom G] \\<and> parser_bottom G \\<notin> set w)\")\n   apply(rename_tac G e k w xa f c ca wa cb x cc)(*strict*)\n   apply(case_tac c)\n    apply(rename_tac G e k w xa f c ca wa cb x cc)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G e k w xa f ca wa cb x cc)(*strict*)\n    apply(case_tac \"drop k f\")\n     apply(rename_tac G e k w xa f ca wa cb x cc)(*strict*)\n     apply(clarsimp)\n     apply(force)\n    apply(rename_tac G e k w xa f ca wa cb x cc a list)(*strict*)\n    apply(subgoal_tac \"\\<exists>w' x'. drop k f = w' @ [x']\")\n     apply(rename_tac G e k w xa f ca wa cb x cc a list)(*strict*)\n     prefer 2\n     apply(rule NonEmptyListHasTailElem)\n     apply(force)\n    apply(rename_tac G e k w xa f ca wa cb x cc a list)(*strict*)\n    apply(thin_tac \"drop k f = a # list\")\n    apply(clarsimp)\n    apply(rename_tac G e k w xa f ca cb x cc w')(*strict*)\n    apply(subgoal_tac \"parser_bottom G \\<in> set f\")\n     apply(rename_tac G e k w xa f ca cb x cc w')(*strict*)\n     apply(force)\n    apply(rename_tac G e k w xa f ca cb x cc w')(*strict*)\n    apply(rule drop_reflects_mem)\n    apply(rule sym)\n    apply(force)\n   apply(rename_tac G e k w xa f c ca wa cb x cc a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n    apply(rename_tac G e k w xa f c ca wa cb x cc a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac G e k w xa f c ca wa cb x cc a list)(*strict*)\n   apply(thin_tac \"c = a # list\")\n   apply(clarsimp)\n   apply(rename_tac G e k w xa f ca cb x cc w')(*strict*)\n   apply(subgoal_tac \"prefix f xa \\<or> prefix xa f\")\n    apply(rename_tac G e k w xa f ca cb x cc w')(*strict*)\n    prefer 2\n    apply(rule_tac\n      b=\"cc\"\n      and d=\"rule_rpush e\"\n      in mutual_prefix_prefix)\n    apply(force)\n   apply(rename_tac G e k w xa f ca cb x cc w')(*strict*)\n   apply(erule disjE)\n    apply(rename_tac G e k w xa f ca cb x cc w')(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n   apply(rename_tac G e k w xa f ca cb x cc w')(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac G e k w xa ca cb x cc w' c)(*strict*)\n   apply(rule_tac\n      x=\"cc @ drop k xa @ drop (k - length xa) c @ w' @ [parser_bottom G]\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      w=\"xa\"\n      in append_linj)\n   apply(rule_tac\n      t=\"xa @ rule_rpush e\"\n      and s=\"take k w\"\n      in ssubst)\n    apply(rename_tac G e k w xa ca cb x cc w' c)(*strict*)\n    apply(force)\n   apply(rename_tac G e k w xa ca cb x cc w' c)(*strict*)\n   apply(force)\n  apply(rename_tac G e k w xa f c ca wa cb x nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n  apply(subgoal_tac \"min (length w) k = length w\")\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n  apply(clarsimp)\n  apply(thin_tac \"min (length w) k = length w\")\n  apply(subgoal_tac \"xa@xb=w\")\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n   prefer 2\n   apply(rule_tac\n      v=\"[parser_bottom G]\"\n      in append_injr)\n   apply(rule_tac\n      t=\"w@[parser_bottom G]\"\n      and s=\"xa @ rule_rpush e\"\n      in ssubst)\n    apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n    apply(force)\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n   apply(rule_tac\n      t=\"rule_rpush e\"\n      and s=\"xb@[parser_bottom G]\"\n      in ssubst)\n    apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n    apply(force)\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n   apply(force)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n  apply(clarify)\n  apply(subgoal_tac \"k=Suc nat+length (xa@xb)\")\n   apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n   prefer 2\n   apply(arith)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb)(*strict*)\n  apply(clarify)\n  apply(thin_tac \"Suc nat + length (xa @ xb) - length (xa @ xb) = Suc nat\")\n  apply(case_tac e)\n  apply(rename_tac G e k w xa f c ca wa cb x nat xb rule_lpop rule_rpopa rule_lpush rule_rpusha)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G xa f c ca wa cb x xb rule_lpop rule_lpush w)(*strict*)\n  apply(rename_tac po pu w)\n  apply(rename_tac G xa f c ca wa cb x xb po pu w)(*strict*)\n  apply(case_tac \"drop (Suc (length xa + length xb)) f\")\n   apply(rename_tac G xa f c ca wa cb x xb po pu w)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G xa f c ca wa cb x po pu w)(*strict*)\n   apply(subgoal_tac \"w=wa\")\n    apply(rename_tac G xa f c ca wa cb x po pu w)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G xa f c ca wa cb x po pu w)(*strict*)\n   apply(case_tac c)\n    apply(rename_tac G xa f c ca wa cb x po pu w)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G xa f c ca wa cb x po pu w a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n    apply(rename_tac G xa f c ca wa cb x po pu w a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac G xa f c ca wa cb x po pu w a list)(*strict*)\n   apply(thin_tac \"c = a # list\")\n   apply(clarsimp)\n  apply(rename_tac G xa f c ca wa cb x xb po pu w a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. drop (Suc (length xa + length xb)) f = w' @ [x']\")\n   apply(rename_tac G xa f c ca wa cb x xb po pu w a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G xa f c ca wa cb x xb po pu w a list)(*strict*)\n  apply(thin_tac \"drop (Suc (length xa + length xb)) f = a # list\")\n  apply(clarsimp)\n  done\n\nlemma parserHFvHFS_inst_AX_equal_by_fixed_unfixed_and_nonscheduler_part: \"\n  \\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cB. (parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> (\\<forall>cL. cL \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_set_unfixed_scheduler (parserHFvHFS_Bra2LinConf cB (parserHF_conf_fixed cB)) (parserHFS_get_unfixed_scheduler cL) = cL \\<longrightarrow> cB = parserHFvHFS_Lin2BraConf cL)) \\<and> (\\<not> parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> (\\<forall>cL. cL \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_set_unfixed_scheduler (parserHFvHFS_Bra2LinConf cB (parserHF_conf_fixed cB @ [parser_bottom G])) (parserHFS_get_unfixed_scheduler cL) = cL \\<longrightarrow> cB = parserHFvHFS_Lin2BraConf cL)))\"\n  apply(clarsimp)\n  apply(rename_tac G cB)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G cB)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G cB cL)(*strict*)\n   apply(simp add: parserHFvHFS_Lin2BraConf_def parserHFvHFS_Bra2LinConf_def parserHFS_set_unfixed_scheduler_def)\n   apply(case_tac cB)\n   apply(rename_tac G cB cL parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n   apply(case_tac cL)\n   apply(rename_tac G cB cL parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_scheduler)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G cB)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G cB cL)(*strict*)\n  apply(simp add: parserHFvHFS_Lin2BraConf_def parserHFvHFS_Bra2LinConf_def parserHFS_set_unfixed_scheduler_def)\n  apply(case_tac cB)\n  apply(rename_tac G cB cL parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(case_tac cL)\n  apply(rename_tac G cB cL parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_scheduler)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinConf_preserves_history: \"\n  \\<forall>G cB sL. valid_parser G \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> sL \\<in> parser_schedulers G \\<longrightarrow> parserHFvHFS_Bra2LinConf cB sL \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_conf_history (parserHFvHFS_Bra2LinConf cB sL) = parserHF_conf_history cB\"\n  apply(clarsimp)\n  apply(rename_tac G cB sL)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def)\n  done\n\nlemma parserHFvHFS_inst_AX_Lin2BraConf_preserves_steps: \"\n  \\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>c1l. c1l \\<in> parserHFS_configurations G \\<longrightarrow> (\\<forall>e c2l. parserHFS_step_relation G c1l e c2l \\<longrightarrow> parserHF_step_relation G (parserHFvHFS_Lin2BraConf c1l) e (parserHFvHFS_Lin2BraConf c2l)))\"\n  apply(clarsimp)\n  apply(rename_tac G c1l e c2l)(*strict*)\n  apply(simp add: parserHFS_step_relation_def parserHF_step_relation_def parserHFvHFS_Lin2BraConf_def)\n  apply(clarsimp)\n  apply(rename_tac G c1l e c2l x xa y)(*strict*)\n  apply(simp add: parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G e c2l x xa y f h w)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G e c2l x xa y f h w c)(*strict*)\n  apply(subgoal_tac \"prefix f (rule_rpop e) \\<or> prefix (rule_rpop e) f\")\n   apply(rename_tac G e c2l x xa y f h w c)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac G e c2l x xa y f h w c)(*strict*)\n    apply(simp add: prefix_def)\n   apply(rename_tac G e c2l x xa y f h w c)(*strict*)\n   apply(simp add: prefix_def)\n  apply(rename_tac G e c2l x xa y f h w c)(*strict*)\n  apply(rule mutual_prefix_prefix)\n  apply(force)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Lin2BraConf_preserves_history: \"\n  \\<forall>G cL. valid_parser G \\<longrightarrow> cL \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_conf_history cL = parserHF_conf_history (parserHFvHFS_Lin2BraConf cL)\"\n  apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(simp add: parserHFvHFS_Lin2BraConf_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_ATS_Branching_Versus_Linear1_axioms: \"\n  ATS_Branching_Versus_Linear1_axioms valid_parser\n     parserHFS_configurations parserHFS_initial_configurations\n     parserHFS_step_relation parser_scheduler_fragments parser_schedulers\n     parserHFS_get_scheduler (@) parserHFS_get_unfixed_scheduler\n     parserHFS_set_unfixed_scheduler parserHFS_conf_history\n     parserHF_configurations parserHF_initial_configurations\n     parserHF_step_relation parserHF_conf_fixed parserHF_conf_history\n     parserHFvHFS_Lin2BraConf parserHFvHFS_Bra2LinConf\n     parserHFvHFS_Bra2LinStep\n     (\\<lambda>G w. if w \\<sqsupseteq> [parser_bottom G] then w else w @ [parser_bottom G])\"\n  apply(simp add: ATS_Branching_Versus_Linear1_axioms_def)\n  apply(simp add: parserHFvHFS_inst_AX_Bra2LinConf_preserves_initiality parserHFvHFS_inst_AX_Bra2LinStep_closed parserHFvHFS_inst_AX_Bra2LinFin_closed parserHFvHFS_inst_AX_Bra2LinConf_schedl_get parserHFvHFS_inst_AX_Bra2LinConf_schedl_get2 parserHFvHFS_inst_AX_Bra2LinFin_creates_proper_extension parserHFvHFS_inst_AX_Bra2LinStep_translates_backwards_Bra2LinConf_closed parserHFvHFS_inst_AX_lin_step_relation_from_Bra2LinStep parserHFvHFS_inst_AX_Bra2LinConf_only_modifies_lin_unfixed_scheduler parserHFvHFS_inst_AX_Bra2LinConf_inj parserHFvHFS_inst_AX_Bra2LinConf_on_empty_bra_sched_closed parserHFvHFS_inst_AX_Bra2LinFin_on_empty_fixed_scheduler parserHFvHFS_inst_AX_equal_by_fixed_unfixed_and_nonscheduler_part parserHF_vs_parserHFS_inst_AX_Bra2LinConf_preserves_history)\n  apply(simp add:  parserHFvHFS_inst_AX_Lin2BraConf_preserves_configurations parserHFvHFS_inst_AX_Lin2BraConf_preserves_initiality\n      )\n  apply(rule conjI)\n   apply(rule parserHFvHFS_inst_AX_Lin2BraConf_preserves_steps)\n  apply(simp add: parserHF_vs_parserHFS_inst_AX_Lin2BraConf_preserves_history)\n  done\n\ninterpretation \"parserHF_vs_parserHFS\" : ATS_Branching_Versus_Linear1\n  (* TSstructure *)\n  \"valid_parser\"\n  (* lin_configurations *)\n  \"parserHFS_configurations\"\n  (* lin_initial_configurations *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels *)\n  \"parser_step_labels\"\n  (* lin_step_relation *)\n  \"parserHFS_step_relation\"\n  (* effects *)\n  \"parser_markers\"\n  (* lin_marking_condition *)\n  \"parserHFS_marking_condition\"\n  (* lin_marked_effect *)\n  \"parserHFS_marked_effect\"\n  (* lin_unmarked_effect *)\n  \"parserHFS_unmarked_effect\"\n  (* lin_fixed_schedulers *)\n  \"parser_fixed_schedulers\"\n  (* lin_empty_fixed_scheduler *)\n  \"parser_empty_fixed_scheduler\"\n  (* lin_fixed_scheduler_extendable *)\n  \"parser_fixed_scheduler_extendable\"\n  (* lin_scheduler_fragments *)\n  \"parser_scheduler_fragments\"\n  (* lin_empty_scheduler_fragment *)\n  \"parser_empty_scheduler_fragment\"\n  (* lin_join_scheduler_fragments *)\n  \"append\"\n  (* lin_unfixed_schedulers *)\n  \"parser_unfixed_schedulers\"\n  (* lin_empty_unfixed_scheduler *)\n  \"parser_empty_unfixed_scheduler\"\n  (* lin_unfixed_scheduler_right_quotient_word *)\n  \"right_quotient_word\"\n  (* lin_extend_unfixed_scheduler *)\n  \"append\"\n  (* lin_unfixed_scheduler_extendable *)\n  \"parser_unfixed_scheduler_extendable\"\n  (* lin_schedulers *)\n  \"parser_schedulers\"\n  (* lin_initial_schedulers *)\n  \"parser_schedulers\"\n  (* lin_empty_scheduler *)\n  \"parser_empty_scheduler\"\n  (* lin_get_scheduler *)\n  \"parserHFS_get_scheduler\"\n  (* lin_join_fixed_scheduler_unfixed_scheduler *)\n  \"append\"\n  (* lin_extend_scheduler *)\n  \"append\"\n  (* lin_get_unfixed_scheduler *)\n  \"parserHFS_get_unfixed_scheduler\"\n  (* lin_set_unfixed_scheduler *)\n  \"parserHFS_set_unfixed_scheduler\"\n  (* lin_get_fixed_scheduler *)\n  \"parserHFS_conf_fixed\"\n  (* histories *)\n  \"parser_markers\"\n  (* history_fragments *)\n  \"parser_markers\"\n  (* empty_history *)\n  \"parser_empty_history\"\n  (* empty_history_fragment *)\n  \"parser_empty_history_fragment\"\n  (* lin_set_history *)\n  \"parserHFS_set_history\"\n  (* extend_history *)\n  \"append\"\n  (* join_history_fragments *)\n  \"append\"\n  (* lin_get_history *)\n  \"parserHFS_conf_history\"\n  (* bra_configurations *)\n  \"parserHF_configurations\"\n  (* bra_initial_configurations *)\n  \"parserHF_initial_configurations\"\n  (* bra_step_relation *)\n  \"parserHF_step_relation\"\n  (* bra_marking_condition *)\n  \"parserHF_marking_condition\"\n  (* bra_marked_effect *)\n  \"parserHF_marked_effect\"\n  (* bra_unmarked_effect *)\n  \"parserHF_unmarked_effect\"\n  (* bra_fixed_schedulers *)\n  \"parser_fixed_schedulers\"\n  (* bra_empty_fixed_scheduler *)\n  \"parser_empty_fixed_scheduler\"\n  (* bra_fixed_scheduler_extendable *)\n  \"parser_fixed_scheduler_extendable\"\n  (* bra_get_fixed_scheduler *)\n  \"parserHF_conf_fixed\"\n  (* bra_set_history *)\n  \"parserHF_set_history\"\n  (* bra_get_history *)\n  \"parserHF_conf_history\"\n  (* Lin2BraConf *)\n  \"parserHFvHFS_Lin2BraConf\"\n  (* Bra2LinConf *)\n  \"parserHFvHFS_Bra2LinConf\"\n  (* Bra2LinStep *)\n  \"parserHFvHFS_Bra2LinStep\"\n  (* Bra2LinFin *)\n  \"\\<lambda>G w. if (suffix w [parser_bottom G]) then w else w@[parser_bottom G]\"\n  apply(simp add: LOCALE_DEFS parserHF_interpretations parserHFS_interpretations0)\n\n  apply(simp add: parserHF_vs_parserHFS_inst_ATS_Branching_Versus_Linear1_axioms)\n  done\n\nlemma parserHF_steps_are_empty1: \"\n  valid_parser G\n  \\<Longrightarrow> parserHF.derivation G d\n  \\<Longrightarrow> parserHF.belongs G d\n  \\<Longrightarrow> \\<forall>j e' c'. i < j \\<and> d j = Some (pair e' c') \\<longrightarrow> parserHF_conf_history c = parserHF_conf_history c'\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> parserHF_conf_fixed c = [] \\<or> parserHF_conf_fixed c = [parser_bottom G]\n  \\<Longrightarrow> i\\<le>n\n  \\<Longrightarrow> d n = Some (pair e' c')\n  \\<Longrightarrow> parserHF_conf_fixed c' = [] \\<or> parserHF_conf_fixed c' = [parser_bottom G]\"\n  apply(induct \"n-i\" arbitrary: n i e c e' c')\n   apply(rename_tac n i e c e' c')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x n i e c e' c')(*strict*)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"n\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"Suc i\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n   apply(rename_tac x n i e c e' c')(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n\"\n      in parserHF.pre_some_position_is_some_position_prime)\n      apply(rename_tac x n i e c e' c')(*strict*)\n      apply(force)\n     apply(rename_tac x n i e c e' c')(*strict*)\n     apply(force)\n    apply(rename_tac x n i e c e' c')(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e' c')(*strict*)\n   apply(force)\n  apply(rename_tac x n i e c e' c')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n  apply(erule_tac\n      x=\"Some ea\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"ca\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"e'\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"c'\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule meta_impE)\n   apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n   apply(force)\n  apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n   apply(subgoal_tac \"parserHF_conf_history ca = parserHF_conf_history c\")\n    apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x n i e c e' c' ea ca j e'a c'a)(*strict*)\n    apply(erule_tac\n      x=\"j\"\n      in allE)\n    apply(force)\n   apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n   apply(force)\n  apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n   defer\n   apply(force)\n  apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> d (Suc i) = Some (pair (Some e2) c2) \\<and> parserHF_step_relation G c1 e2 c2\")\n   apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc i\"\n      in parserHF.step_detail_before_some_position)\n     apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n   apply(force)\n  apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"valid_parser_step_label G ea\")\n   apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(rename_tac x n i e c e' c' ea ca)(*strict*)\n  apply(erule_tac\n      x=\"Suc i\"\n      in allE)\n  apply(clarsimp)\n  apply(simp add: valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e' c' ea ca k w xb)(*strict*)\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n  apply(erule_tac\n      P=\"parserHF_conf_fixed c = []\"\n      in disjE)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n   apply(clarsimp)\n   apply(simp add: kPrefix_def)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n     apply(clarsimp)\n     apply(case_tac w)\n      apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa a list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n    apply(rule butlast_if_match_direct2_prime)\n    apply(rule_tac\n      B=\"set w\"\n      in nset_mp)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n     apply(rule set_take_subset)\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa nat xc)(*strict*)\n   apply(subgoal_tac \"w=[]\")\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa nat xc)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x n i e c e' c' ea ca xb xa xc)(*strict*)\n    apply (metis drop_append Suc_length append_Nil2 drop_Nil drop_Suc_Cons drop_length_append eq_Nil_appendI le_SucE length_shorter_append2)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa nat xc)(*strict*)\n   apply (metis butlast_if_match_direct)\n  apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n  apply(clarsimp)\n  apply(erule disjE)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n   apply(simp add: kPrefix_def prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n    apply(clarsimp)\n    apply(case_tac cb)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa xc)(*strict*)\n     apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n      apply(rename_tac x n i e c e' c' ea ca k w xb xa xc)(*strict*)\n      apply(force)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa xc)(*strict*)\n     apply(rule_tac\n      A=\"set (take k w)\"\n      in set_mp)\n      apply(rename_tac x n i e c e' c' ea ca k w xb xa xc)(*strict*)\n      apply(rule set_take_subset)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa xc)(*strict*)\n     apply(force)\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa cb a list)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa a list)(*strict*)\n    apply(case_tac list)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa a list)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n     apply(subgoal_tac \"min (length w) k = 0\")\n      apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n     apply(clarsimp)\n     apply(case_tac w)\n      apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa a list)(*strict*)\n     apply(subgoal_tac \"k=0\")\n      apply(rename_tac x n i e c e' c' ea ca k w xb xa a list)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac x n i e c e' c' ea ca k w xb xa a list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa a list aa lista)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa cb nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa cb nat xc)(*strict*)\n   apply(case_tac cb)\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa cb nat xc)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x n i e c e' c' ea ca xb xa xc)(*strict*)\n    apply (metis valid_parser_rules_rhs_gets_shorter length_shorter_append2 self_append_conv2)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa cb nat xc a list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x n i e c e' c' ea ca k w xb xa)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n  apply(simp add: kPrefix_def)\n  apply(case_tac \"k-length w\")\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n   apply(rule_tac\n      A=\"set (take k w)\"\n      in set_mp)\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n    apply(rule set_take_subset)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n   apply(rule_tac\n      t=\"take k w\"\n      and s=\"parser_bottom G # cb\"\n      in ssubst)\n    apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa cb)(*strict*)\n   apply(simp (no_asm))\n  apply(rename_tac x n i e c e' c' ea ca k w xb xa cb nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e' c' ea ca k w xb xa cb nat xc)(*strict*)\n  apply(case_tac cb)\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa cb nat xc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x n i e c e' c' ea ca xb xa xc)(*strict*)\n   apply (metis valid_parser_rules_rhs_gets_shorter diff_0_eq_0 diff_Suc_Suc diff_is_0_eq le_antisym length_0_conv length_append_singleton self_append_conv2)\n  apply(rename_tac x n i e c e' c' ea ca k w xb xa cb nat xc a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. cb = w' @ [x']\")\n   apply(rename_tac x n i e c e' c' ea ca k w xb xa cb nat xc a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac x n i e c e' c' ea ca k w xb xa cb nat xc a list)(*strict*)\n  apply(thin_tac \"cb=a#list\")\n  apply(clarsimp)\n  done\n\nlemma parserHF_steps_are_empty2: \"\n  valid_parser G\n  \\<Longrightarrow> parserHF.derivation G d\n  \\<Longrightarrow> parserHF.belongs G d\n  \\<Longrightarrow> \\<forall>j e' c'. i < j \\<and> d j = Some (pair e' c') \\<longrightarrow> parserHF_conf_history c = parserHF_conf_history c'\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> parserHF_conf_fixed c = [] \\<or> parserHF_conf_fixed c = [parser_bottom G]\n  \\<Longrightarrow> i\\<le>n\n  \\<Longrightarrow> d n = Some (pair e1 c1)\n  \\<Longrightarrow> d (Suc n) = Some (pair (Some e2) c2)\n  \\<Longrightarrow> d (Suc n + m) = Some (pair e' c')\n  \\<Longrightarrow> parserHF_step_relation G c1 e2 c2\n  \\<Longrightarrow> the (right_quotient_word (rule_rpop e2) (rule_rpush e2)) = []\"\n  apply(induct \"n-i\" arbitrary: n i e c e1 c1 e2 c2)\n   apply(rename_tac n i e c e1 c1 e2 c2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i e1 c1 e2 c2)(*strict*)\n   apply(subgoal_tac \"e2 \\<in> parser_step_labels G \\<and> c2 \\<in> parserHF_configurations G\")\n    apply(rename_tac i e1 c1 e2 c2)(*strict*)\n    prefer 2\n    apply(rule parserHF.AX_step_relation_preserves_belongs)\n      apply(rename_tac i e1 c1 e2 c2)(*strict*)\n      apply(force)\n     apply(rename_tac i e1 c1 e2 c2)(*strict*)\n     apply(force)\n    apply(rename_tac i e1 c1 e2 c2)(*strict*)\n    apply(rule parserHF.belongs_configurations)\n     apply(rename_tac i e1 c1 e2 c2)(*strict*)\n     apply(force)\n    apply(rename_tac i e1 c1 e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac i e1 c1 e2 c2)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"valid_parser_step_label G e2\")\n    apply(rename_tac i e1 c1 e2 c2)(*strict*)\n    prefer 2\n    apply(simp add: valid_parser_def parserHF_step_relation_def)\n   apply(rename_tac i e1 c1 e2 c2)(*strict*)\n   apply(simp add: valid_parser_step_label_def)\n   apply(clarsimp)\n   apply(rename_tac i e1 c1 e2 c2 k w xa)(*strict*)\n   apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e2)\"\n      and s=\"Some xa\"\n      in ssubst)\n    apply(rename_tac i e1 c1 e2 c2 k w xa)(*strict*)\n    apply(rule right_quotient_word_Some_by_append)\n    apply(force)\n   apply(rename_tac i e1 c1 e2 c2 k w xa)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHF_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n   apply(erule_tac\n      P=\"parserHF_conf_fixed c1 = []\"\n      in disjE)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"Suc i\"\n      in allE)\n    apply(clarsimp)\n    apply(simp add: kPrefix_def)\n    apply(case_tac \"k-length w\")\n     apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"take k w=[]\")\n      apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n     apply(rule_tac\n      t=\"take k w\"\n      and s=\"butlast_if_match (take k w) (parser_bottom G)\"\n      in subst)\n      apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n      apply(rule butlast_if_match_direct2_prime)\n      apply(rule_tac\n      B=\"set w\"\n      in nset_mp)\n       apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n       apply(rule set_take_subset)\n      apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n      apply(force)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n     apply(force)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb)(*strict*)\n    apply(subgoal_tac \"w=[]\")\n     apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac i e1 c1 e2 c2 xa x xb)(*strict*)\n     apply (metis drop_append Suc_length append_Nil2 drop_Nil drop_Suc_Cons drop_length_append eq_Nil_appendI le_SucE length_shorter_append2)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb)(*strict*)\n    apply (metis butlast_if_match_direct)\n   apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"Suc i\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: kPrefix_def)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n    apply(clarsimp)\n    apply(erule disjE)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n     apply(simp add: prefix_def)\n     apply(clarsimp)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x c)(*strict*)\n     apply(case_tac c)\n      apply(rename_tac i e1 c1 e2 c2 k w xa x c)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac i e1 c1 e2 c2 k w xa x xb)(*strict*)\n      apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n       apply(rename_tac i e1 c1 e2 c2 k w xa x xb)(*strict*)\n       apply(force)\n      apply(rename_tac i e1 c1 e2 c2 k w xa x xb)(*strict*)\n      apply(rule_tac\n      A=\"set (take k w)\"\n      in set_mp)\n       apply(rename_tac i e1 c1 e2 c2 k w xa x xb)(*strict*)\n       apply(rule set_take_subset)\n      apply(rename_tac i e1 c1 e2 c2 k w xa x xb)(*strict*)\n      apply(force)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x c a list)(*strict*)\n     apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n      apply(rename_tac i e1 c1 e2 c2 k w xa x c a list)(*strict*)\n      prefer 2\n      apply(rule NonEmptyListHasTailElem)\n      apply(force)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x c a list)(*strict*)\n     apply(thin_tac \"c=a#list\")\n     apply(clarsimp)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n     apply(subgoal_tac \"min (length w) k = 0\")\n      apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n      apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n      prefer 2\n      apply(rule butlast_if_match_direct2_prime)\n      apply(rule_tac\n      B=\"set w\"\n      in nset_mp)\n       apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n       apply(rule set_take_subset)\n      apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n      apply(force)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n     apply(clarsimp)\n     apply(erule disjE)\n      apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x c)(*strict*)\n    apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n     apply(rename_tac i e1 c1 e2 c2 k w xa x c)(*strict*)\n     apply(force)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x c)(*strict*)\n    apply(rule_tac\n      A=\"set (take k w)\"\n      in set_mp)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x c)(*strict*)\n     apply(rule set_take_subset)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x c)(*strict*)\n    apply(rule_tac\n      t=\"take k w\"\n      and s=\"parser_bottom G # c\"\n      in ssubst)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x c)(*strict*)\n     apply(force)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x c)(*strict*)\n    apply(simp (no_asm))\n   apply(rename_tac i e1 c1 e2 c2 k w xa x nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb c)(*strict*)\n    apply(case_tac c)\n     apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb c)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac i e1 c1 e2 c2 xa x xb)(*strict*)\n     apply (metis Suc_le_mono add_Suc_shift append_is_Nil_conv drop_length_append le_Suc_eq le_refl list.size(3) list.size(4) add.commute plus_nat.add_0 takePrecise take_0 take_all take_max_no_append)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb c a list)(*strict*)\n    apply(force)\n   apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb c)(*strict*)\n   apply(case_tac c)\n    apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac i e1 c1 e2 c2 xa x xb)(*strict*)\n    apply (metis add_Suc_right append_self_conv2 drop_length_append le_0_eq length_shorter_append2 list.size(3) list.size(4) add.commute not_less_eq_eq plus_nat.add_0)\n   apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb c a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n    apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb c a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac i e1 c1 e2 c2 k w xa x nat xb c a list)(*strict*)\n   apply(thin_tac \"c=a#list\")\n   apply(clarsimp)\n  apply(rename_tac x n i e c e1 c1 e2 c2)(*strict*)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"n\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"Suc i\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n   apply(rename_tac x n i e c e1 c1 e2 c2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n   apply(erule_tac\n      x=\"Some ea\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"ca\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"e1\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"c1\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"e2\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"c2\"\n      in meta_allE)\n   apply(clarsimp)\n   apply(erule meta_impE)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n   apply(erule meta_impE)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n    apply(subgoal_tac \"parserHF_conf_history ca = parserHF_conf_history c\")\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n     prefer 2\n     apply(erule_tac\n      x=\"Suc i\"\n      in allE)\n     apply(clarsimp)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca j e'a c'a)(*strict*)\n    apply(erule_tac\n      x=\"j\"\n      in allE)\n    apply(force)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n   apply(erule meta_impE)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n    defer\n    apply(erule meta_impE)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e1 c1 e2 c2)(*strict*)\n   apply(rule_tac\n      m=\"Suc n\"\n      in parserHF.pre_some_position_is_some_position_prime)\n      apply(rename_tac x n i e c e1 c1 e2 c2)(*strict*)\n      apply(force)\n     apply(rename_tac x n i e c e1 c1 e2 c2)(*strict*)\n     apply(force)\n    apply(rename_tac x n i e c e1 c1 e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e1 c1 e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> d (Suc i) = Some (pair (Some e2) c2) \\<and> parserHF_step_relation G c1 e2 c2\")\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc i\"\n      in parserHF.step_detail_before_some_position)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n   apply(force)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"valid_parser_step_label G ea\")\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca)(*strict*)\n  apply(erule_tac\n      x=\"Suc i\"\n      in allE)\n  apply(clarsimp)\n  apply(simp add: valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb)(*strict*)\n  apply(thin_tac \"parserHF_step_relation G c1 e2 c2\")\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n  apply(erule_tac\n      P=\"parserHF_conf_fixed c = []\"\n      in disjE)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n   apply(clarsimp)\n   apply(simp add: kPrefix_def)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n     apply(clarsimp)\n     apply(case_tac w)\n      apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa a list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n    apply(rule butlast_if_match_direct2_prime)\n    apply(rule_tac\n      B=\"set w\"\n      in nset_mp)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n     apply(rule set_take_subset)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa nat xc)(*strict*)\n   apply(subgoal_tac \"w=[]\")\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa nat xc)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca xb xa xc)(*strict*)\n    apply (metis drop_append Suc_length append_Nil2 drop_Nil drop_Suc_Cons drop_length_append eq_Nil_appendI le_SucE length_shorter_append2)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa nat xc)(*strict*)\n   apply (metis butlast_if_match_direct)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n  apply(clarsimp)\n  apply(erule disjE)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n   apply(simp add: kPrefix_def prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n    apply(clarsimp)\n    apply(case_tac cb)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa xc)(*strict*)\n     apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n      apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa xc)(*strict*)\n      apply(force)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa xc)(*strict*)\n     apply(rule_tac\n      A=\"set (take k w)\"\n      in set_mp)\n      apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa xc)(*strict*)\n      apply(rule set_take_subset)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa xc)(*strict*)\n     apply(force)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb a list)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa a list)(*strict*)\n    apply(case_tac list)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa a list)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n     apply(subgoal_tac \"min (length w) k = 0\")\n      apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n     apply(clarsimp)\n     apply(case_tac w)\n      apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa a list)(*strict*)\n     apply(subgoal_tac \"k=0\")\n      apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa a list)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa a list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa a list aa lista)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb nat xc)(*strict*)\n   apply(case_tac cb)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb nat xc)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca xb xa xc)(*strict*)\n    apply (metis valid_parser_rules_rhs_gets_shorter diff_0_eq_0 diff_Suc_Suc diff_is_0_eq le_antisym length_0_conv length_append_singleton self_append_conv2)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb nat xc a list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n  apply(simp add: kPrefix_def)\n  apply(case_tac \"k-length w\")\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n   apply(rule_tac\n      A=\"set (take k w)\"\n      in set_mp)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n    apply(rule set_take_subset)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n   apply(rule_tac\n      t=\"take k w\"\n      and s=\"parser_bottom G # cb\"\n      in ssubst)\n    apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n    apply(force)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb)(*strict*)\n   apply(simp (no_asm))\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb nat xc)(*strict*)\n  apply(case_tac cb)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb nat xc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca xb xa xc)(*strict*)\n   apply (metis valid_parser_rules_rhs_gets_shorter diff_0_eq_0 diff_Suc_Suc diff_is_0_eq le_antisym length_0_conv length_append_singleton self_append_conv2)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb nat xc a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. cb = w' @ [x']\")\n   apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb nat xc a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac x n i e c e1 c1 e2 c2 ea ca k w xb xa cb nat xc a list)(*strict*)\n  apply(thin_tac \"cb=a#list\")\n  apply(clarsimp)\n  done\n\nlemma parserHFS_rhs_and_history_invariant_if_input_consumed: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.derivation_initial G d\n  \\<Longrightarrow> maximum_of_domain d x\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> i \\<le> j\n  \\<Longrightarrow> parserHFS_conf_scheduler c = [parser_bottom G]\n  \\<Longrightarrow> d j = Some (pair e' c')\n  \\<Longrightarrow>\n  parserHFS_conf_scheduler c = parserHFS_conf_scheduler c'\n  \\<and> parserHFS_conf_history c = parserHFS_conf_history c'\"\n  apply(induct \"j-i\" arbitrary: j i e c e' c')\n   apply(rename_tac j i e c e' c')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac xa j i e c e' c')(*strict*)\n  apply(erule_tac\n      x=\"j\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"Suc i\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> d (Suc i) = Some (pair (Some e2) c2) \\<and> parserHFS_step_relation G c1 e2 c2\")\n   apply(rename_tac xa j i e c e' c')(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"j\"\n      in parserHFS.step_detail_before_some_position)\n     apply(rename_tac xa j i e c e' c')(*strict*)\n     apply(simp add: parserHFS.derivation_initial_def)\n    apply(rename_tac xa j i e c e' c')(*strict*)\n    apply(force)\n   apply(rename_tac xa j i e c e' c')(*strict*)\n   apply(force)\n  apply(rename_tac xa j i e c e' c')(*strict*)\n  apply(clarify)\n  apply(rename_tac xa j i e c e' c' e1 e2 c1 c2)(*strict*)\n  apply(erule_tac\n      x=\"Some e2\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"c2\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"e'\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"c'\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n  apply(subgoal_tac \"c2 \\<in> parserHFS_configurations G\")\n   apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n   prefer 2\n   apply(rule parserHFS.belongs_configurations)\n    apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n    apply(rule parserHFS.derivation_initial_belongs)\n     apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n     apply(force)\n    apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n  apply(subgoal_tac \"parserHFS_conf_scheduler c2 = [parser_bottom G]\")\n   apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"valid_parser_step_label G e2\")\n    apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n    prefer 2\n    apply(simp add: parserHFS_step_relation_def valid_parser_def)\n   apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n   apply(subgoal_tac \"\\<exists>w. parserHFS_conf_scheduler c2 = w@[parser_bottom G]\")\n    apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n    prefer 2\n    apply(simp add: parserHFS_configurations_def)\n    apply(clarsimp)\n   apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac xa j i e c e' c' e2 c2 w)(*strict*)\n   apply(subgoal_tac \"\\<exists>x. rule_rpop e2 = x@(rule_rpush e2)\")\n    apply(rename_tac xa j i e c e' c' e2 c2 w)(*strict*)\n    prefer 2\n    apply(simp add: valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac xa j i e c e' c' e2 c2 w k wa xb)(*strict*)\n    apply(rule_tac\n      x=\"xb\"\n      in exI)\n    apply(force)\n   apply(rename_tac xa j i e c e' c' e2 c2 w)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac xa j i e c e' c' e2 c2 w xb)(*strict*)\n   apply(simp add: parserHFS_step_relation_def)\n   apply(clarify)\n   apply(rename_tac xa j i e c e' c' e2 c2 w xb xba xc)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"parserHFS_conf_history c = parserHFS_conf_history c2\")\n   apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n  apply(thin_tac \"parserHFS_conf_history c2 = parserHFS_conf_history c'\")\n  apply(subgoal_tac \"[parser_bottom G] = parserHFS_conf_scheduler c\")\n   apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac xa j i e c e' c' e2 c2)(*strict*)\n  apply(thin_tac \"[parser_bottom G] = parserHFS_conf_scheduler c'\")\n  apply(thin_tac \"parserHFS_conf_scheduler c = parserHFS_conf_scheduler c'\")\n  apply(thin_tac \"i \\<le> j\")\n  apply(thin_tac \"d j = Some (pair e' c')\")\n  apply(clarsimp)\n  apply(rename_tac xa j i e c c' e2 c2)(*strict*)\n  apply(simp add: parserHFS_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac xa j i e c c' e2 c2 xb xba y)(*strict*)\n  apply(rule_tac\n      t=\"butlast_if_match (rule_rpop e2) (parser_bottom G)\"\n      and s=\"[]\"\n      in ssubst)\n   apply(rename_tac xa j i e c c' e2 c2 xb xba y)(*strict*)\n   defer\n   apply(force)\n  apply(rename_tac xa j i e c c' e2 c2 xb xba y)(*strict*)\n  apply(case_tac \"rule_rpop e2\")\n   apply(rename_tac xa j i e c c' e2 c2 xb xba y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac xa j i e c c' e2 c2 xb)(*strict*)\n   apply (metis append_Nil butlast_if_match_prefix mutual_prefix_implies_equality prefix_def)\n  apply(rename_tac xa j i e c c' e2 c2 xb xba y a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa j i e c c' e2 c2 xb y)(*strict*)\n  apply(rule butlast_if_match_direct)\n  apply(force)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Lin2BraDer_preserves_marking_condition: \"\n  \\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>dl. parserHFS.derivation_initial G dl \\<longrightarrow> parserHFS_marking_condition G dl \\<longrightarrow> Ex (maximum_of_domain dl) \\<longrightarrow> parserHF_marking_condition G (ATS_Branching_Versus_Linear1.Lin2BraDer parserHFvHFS_Lin2BraConf dl))\"\n  apply(clarsimp)\n  apply(rename_tac G dl x)(*strict*)\n  apply(simp add: parserHF_vs_parserHFS.Lin2BraDer_def parserHF_marking_condition_def)\n  apply(simp add: parserHFS_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac G dl x i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(simp add: derivation_map_def)\n  apply(rule conjI)\n   apply(rename_tac G dl x i e c)(*strict*)\n   prefer 2\n   apply(clarsimp)\n   apply(rename_tac G dl x i e c j e' c')(*strict*)\n   apply(simp add: parserHFS_marking_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac G dl x i e c j e' c' f w)(*strict*)\n   apply(case_tac \"dl j\")\n    apply(rename_tac G dl x i e c j e' c' f w)(*strict*)\n    apply(force)\n   apply(rename_tac G dl x i e c j e' c' f w a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac G dl x i e c j e' c' f w a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G dl x i e c j e' f w b)(*strict*)\n   apply(simp add: parserHFvHFS_Lin2BraConf_def)\n   apply(subgoal_tac \"parserHFS_conf_scheduler c = parserHFS_conf_scheduler b \\<and> parserHFS_conf_history c = parserHFS_conf_history b\")\n    apply(rename_tac G dl x i e c j e' f w b)(*strict*)\n    apply(force)\n   apply(rename_tac G dl x i e c j e' f w b)(*strict*)\n   apply(rule_tac\n      i=\"i\"\n      and j=\"j\"\n      in parserHFS_rhs_and_history_invariant_if_input_consumed)\n         apply(rename_tac G dl x i e c j e' f w b)(*strict*)\n         apply(force)\n        apply(rename_tac G dl x i e c j e' f w b)(*strict*)\n        apply(force)\n       apply(rename_tac G dl x i e c j e' f w b)(*strict*)\n       apply(force)\n      apply(rename_tac G dl x i e c j e' f w b)(*strict*)\n      apply(force)\n     apply(rename_tac G dl x i e c j e' f w b)(*strict*)\n     apply(force)\n    apply(rename_tac G dl x i e c j e' f w b)(*strict*)\n    apply(force)\n   apply(rename_tac G dl x i e c j e' f w b)(*strict*)\n   apply(force)\n  apply(rename_tac G dl x i e c)(*strict*)\n  apply(subgoal_tac \"parserHFvHFS_Lin2BraConf c \\<in> parserHF_configurations G\")\n   apply(rename_tac G dl x i e c)(*strict*)\n   apply(simp add: parserHFvHFS_Lin2BraConf_def parserHF_marking_configurations_def parserHFS_marking_configurations_def)\n   apply(simp add: parserHF_configurations_def parserHFS_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac G dl x i e f w fa h)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac G dl x i e f w fa h c)(*strict*)\n   apply(case_tac c)\n    apply(rename_tac G dl x i e f w fa h c)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G dl x i e f w fa h c a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G dl x i e f w fa h a list)(*strict*)\n   apply(case_tac fa)\n    apply(rename_tac G dl x i e f w fa h a list)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G dl x i e f w fa h a list aa lista)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G dl x i e c)(*strict*)\n  apply(rule parserHF_vs_parserHFS.AX_Lin2BraConf_preserves_configurations)\n   apply(rename_tac G dl x i e c)(*strict*)\n   apply(force)\n  apply(rename_tac G dl x i e c)(*strict*)\n  apply(rule parserHFS.belongs_configurations)\n   apply(rename_tac G dl x i e c)(*strict*)\n   apply(rule parserHFS.derivation_initial_belongs)\n    apply(rename_tac G dl x i e c)(*strict*)\n    apply(force)\n   apply(rename_tac G dl x i e c)(*strict*)\n   apply(force)\n  apply(rename_tac G dl x i e c)(*strict*)\n  apply(force)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_set_constructed_sched_vs_set_constructed_schedUF: \"\n  \\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cB1. cB1 \\<in> parserHFS_configurations G \\<longrightarrow> (\\<forall>e cB2. (parserHF_conf_fixed cB2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> parserHF_step_relation G (parserHFvHFS_Lin2BraConf cB1) e cB2 \\<longrightarrow> (\\<forall>s. s \\<in> parser_schedulers G \\<longrightarrow> parserHFvHFS_Bra2LinConf cB2 s \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_set_unfixed_scheduler (parserHFvHFS_Bra2LinConf cB2 (parserHF_conf_fixed cB2)) (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf cB2 s)) = parserHFvHFS_Bra2LinConf cB2 s \\<longrightarrow> parserHFS_set_unfixed_scheduler cB1 (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cB1) (parserHFvHFS_Bra2LinStep (parserHFvHFS_Lin2BraConf cB1) e cB2 @ s))) = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cB1) (parserHFvHFS_Bra2LinStep (parserHFvHFS_Lin2BraConf cB1) e cB2 @ s))) \\<and> (\\<not> parserHF_conf_fixed cB2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> parserHF_step_relation G (parserHFvHFS_Lin2BraConf cB1) e cB2 \\<longrightarrow> (\\<forall>s. s \\<in> parser_schedulers G \\<longrightarrow> parserHFvHFS_Bra2LinConf cB2 s \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_set_unfixed_scheduler (parserHFvHFS_Bra2LinConf cB2 (parserHF_conf_fixed cB2 @ [parser_bottom G])) (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf cB2 s)) = parserHFvHFS_Bra2LinConf cB2 s \\<longrightarrow> parserHFS_set_unfixed_scheduler cB1 (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cB1) (parserHFvHFS_Bra2LinStep (parserHFvHFS_Lin2BraConf cB1) e cB2 @ s))) = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cB1) (parserHFvHFS_Bra2LinStep (parserHFvHFS_Lin2BraConf cB1) e cB2 @ s)))))\"\n  apply(clarsimp)\n  apply(rename_tac G cB1 e cB2)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G cB1 e cB2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G cB1 e cB2 s)(*strict*)\n   apply(simp add: parserHFS_set_unfixed_scheduler_def parserHFS_get_unfixed_scheduler_def parserHFvHFS_Bra2LinConf_def parserHFvHFS_Lin2BraConf_def)\n   apply(case_tac cB1)\n   apply(rename_tac G cB1 e cB2 s parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_scheduler)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G e cB2 s parserHFS_conf_fixed parserHFS_conf_history parserHFS_conf_stack parserHFS_conf_scheduler)(*strict*)\n   apply(rename_tac f h l r)\n   apply(rename_tac G e cB2 s f h l r)(*strict*)\n   apply(subgoal_tac \"s=parserHF_conf_fixed cB2\")\n    apply(rename_tac G e cB2 s f h l r)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G e cB2 f h l r)(*strict*)\n    apply(subgoal_tac \"valid_parser_step_label G e\")\n     apply(rename_tac G e cB2 f h l r)(*strict*)\n     prefer 2\n     apply(simp add: parserHF_step_relation_def valid_parser_def)\n    apply(rename_tac G e cB2 f h l r)(*strict*)\n    apply(simp add: parserHF_step_relation_def valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac G e cB2 f h r k w xa xb)(*strict*)\n    apply(thin_tac \"the (left_quotient_word (rule_rpush e @ drop (length (kPrefix k (w @ [parser_bottom G]))) f) (rule_rpush e @ drop (length (kPrefix k (w @ [parser_bottom G]))) f)) = []\")\n    apply(rename_tac G e cB2 f h r k w xa xb)(*strict*)\n    apply(simp add: parserHFvHFS_Bra2LinStep_def)\n    apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xb\"\n      in ssubst)\n     apply(rename_tac G e cB2 f h r k w xa xb)(*strict*)\n     apply(rule right_quotient_word_Some_by_append)\n     apply(force)\n    apply(rename_tac G e cB2 f h r k w xa xb)(*strict*)\n    apply(clarsimp)\n    apply(erule disjE)\n     apply(rename_tac G e cB2 f h r k w xa xb)(*strict*)\n     apply(simp add: prefix_def)\n     apply(clarsimp)\n     apply(rename_tac G e cB2 h r k w xa xb c)(*strict*)\n     apply(rule_tac\n      t=\"left_quotient_word (kPrefix k (w @ [parser_bottom G]) @ c) (xb @ rule_rpush e @ c)\"\n      and s=\"Some []\"\n      in ssubst)\n      apply(rename_tac G e cB2 h r k w xa xb c)(*strict*)\n      apply(rule left_quotient_word_Some_by_append)\n      apply(force)\n     apply(rename_tac G e cB2 h r k w xa xb c)(*strict*)\n     apply(force)\n    apply(rename_tac G e cB2 f h r k w xa xb)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n    apply(rule_tac\n      t=\"left_quotient_word f (xb @ rule_rpush e @ drop (length (kPrefix k (w @ [parser_bottom G]))) f)\"\n      and s=\"Some c\"\n      in ssubst)\n     apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n     apply(rule left_quotient_word_Some_by_append)\n     apply(rule_tac\n      t=\"f @ c\"\n      and s=\"kPrefix k (w @ [parser_bottom G])\"\n      in ssubst)\n      apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n      apply(force)\n     apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n     apply(rule_tac\n      t=\"kPrefix k (w @ [parser_bottom G])\"\n      and s=\"xb @ rule_rpush e\"\n      in ssubst)\n      apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n      apply(force)\n     apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n     apply(rule_tac\n      t=\"drop (length (xb @ rule_rpush e)) f\"\n      and s=\"[]\"\n      in ssubst)\n      apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n      apply(rule_tac\n      t=\"xb @ rule_rpush e\"\n      and s=\"kPrefix k (w @ [parser_bottom G])\"\n      in ssubst)\n       apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n       apply(force)\n      apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n      apply(rule_tac\n      t=\"kPrefix k (w @ [parser_bottom G])\"\n      and s=\"f@c\"\n      in ssubst)\n       apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n       apply(force)\n      apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n      apply(simp (no_asm))\n     apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n     apply(force)\n    apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      t=\"drop (length (kPrefix k (w @ [parser_bottom G]))) f\"\n      and s=\"[]\"\n      in ssubst)\n     apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n    apply(rule_tac\n      t=\"kPrefix k (w @ [parser_bottom G])\"\n      and s=\"f@c\"\n      in ssubst)\n     apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n     apply(force)\n    apply(rename_tac G e cB2 f h r k w xa xb c)(*strict*)\n    apply(simp (no_asm))\n   apply(rename_tac G e cB2 s f h l r)(*strict*)\n   apply(simp add: parserHFS_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac G e cB2 f h l w wa)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac G e cB2 f h l w wa c ca)(*strict*)\n   apply(case_tac ca)\n    apply(rename_tac G e cB2 f h l w wa c ca)(*strict*)\n    apply(force)\n   apply(rename_tac G e cB2 f h l w wa c ca a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. ca = w' @ [x']\")\n    apply(rename_tac G e cB2 f h l w wa c ca a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac G e cB2 f h l w wa c ca a list)(*strict*)\n   apply(thin_tac \"ca=a#list\")\n   apply(clarsimp)\n   apply(rename_tac G e cB2 f h l w c w')(*strict*)\n   apply(simp add: suffix_def)\n   apply(clarsimp)\n  apply(rename_tac G cB1 e cB2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G cB1 e cB2 s)(*strict*)\n  apply(simp add: parserHFS_set_unfixed_scheduler_def parserHFvHFS_Bra2LinConf_def parserHFS_get_unfixed_scheduler_def)\n  apply(subgoal_tac \"prefix (parserHF_conf_fixed cB2) s\")\n   apply(rename_tac G cB1 e cB2 s)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac G cB1 e cB2 c)(*strict*)\n   apply(simp add: parserHFS_set_unfixed_scheduler_def parserHFS_get_unfixed_scheduler_def parserHFvHFS_Bra2LinConf_def parserHFvHFS_Lin2BraConf_def)\n   apply(case_tac cB1)\n   apply(rename_tac G cB1 e cB2 c parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_scheduler)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G e cB2 c parserHFS_conf_fixed parserHFS_conf_history parserHFS_conf_stack parserHFS_conf_scheduler)(*strict*)\n   apply(rename_tac f h l r)\n   apply(rename_tac G e cB2 c f h l r)(*strict*)\n   apply(subgoal_tac \"valid_parser_step_label G e\")\n    apply(rename_tac G e cB2 c f h l r)(*strict*)\n    prefer 2\n    apply(simp add: parserHF_step_relation_def valid_parser_def)\n   apply(rename_tac G e cB2 c f h l r)(*strict*)\n   apply(simp add: parserHF_step_relation_def valid_parser_step_label_def)\n   apply(clarsimp)\n   apply(rename_tac G e cB2 c f h r k w xa xb)(*strict*)\n   apply(thin_tac \"the (left_quotient_word (rule_rpush e @ drop (length (kPrefix k (w @ [parser_bottom G]))) f) (rule_rpush e @ drop (length (kPrefix k (w @ [parser_bottom G]))) f @ c)) = c\")\n   apply(rename_tac G e cB2 c f h r k w xa xb)(*strict*)\n   apply(simp add: parserHFvHFS_Bra2LinStep_def)\n   apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xb\"\n      in ssubst)\n    apply(rename_tac G e cB2 c f h r k w xa xb)(*strict*)\n    apply(rule right_quotient_word_Some_by_append)\n    apply(force)\n   apply(rename_tac G e cB2 c f h r k w xa xb)(*strict*)\n   apply(clarsimp)\n   apply(erule disjE)\n    apply(rename_tac G e cB2 c f h r k w xa xb)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac G e cB2 c h r k w xa xb ca)(*strict*)\n    apply(rule_tac\n      t=\"left_quotient_word (kPrefix k (w @ [parser_bottom G]) @ ca) (xb @ rule_rpush e @ ca @ c)\"\n      and s=\"Some c\"\n      in ssubst)\n     apply(rename_tac G e cB2 c h r k w xa xb ca)(*strict*)\n     apply(rule left_quotient_word_Some_by_append)\n     apply(force)\n    apply(rename_tac G e cB2 c h r k w xa xb ca)(*strict*)\n    apply(force)\n   apply(rename_tac G e cB2 c f h r k w xa xb)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac G e cB2 c f h r k w xa xb ca)(*strict*)\n   apply(subgoal_tac \"drop (length (kPrefix k (w @ [parser_bottom G]))) f = []\")\n    apply(rename_tac G e cB2 c f h r k w xa xb ca)(*strict*)\n    prefer 2\n    apply(clarsimp)\n    apply (metis drop_length_append)\n   apply(rename_tac G e cB2 c f h r k w xa xb ca)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"xb @ rule_rpush e @ c\"\n      and s=\"kPrefix k (w @ [parser_bottom G]) @ c\"\n      in ssubst)\n    apply(rename_tac G e cB2 c f h r k w xa xb ca)(*strict*)\n    apply(force)\n   apply(rename_tac G e cB2 c f h r k w xa xb ca)(*strict*)\n   apply(rule_tac\n      t=\"kPrefix k (w @ [parser_bottom G])\"\n      and s=\"f@ca\"\n      in ssubst)\n    apply(rename_tac G e cB2 c f h r k w xa xb ca)(*strict*)\n    apply(force)\n   apply(rename_tac G e cB2 c f h r k w xa xb ca)(*strict*)\n   apply(rule_tac\n      t=\"left_quotient_word f ((f @ ca) @ c)\"\n      and s=\"Some (ca@c)\"\n      in ssubst)\n    apply(rename_tac G e cB2 c f h r k w xa xb ca)(*strict*)\n    apply(rule left_quotient_word_Some_by_append)\n    apply(force)\n   apply(rename_tac G e cB2 c f h r k w xa xb ca)(*strict*)\n   apply(force)\n  apply(rename_tac G cB1 e cB2 s)(*strict*)\n  apply(simp add: parserHFS_configurations_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_set_constructed_sched_vs_set_constructed_schedUF_Fin: \"\n  \\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cB1. (parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cB1) \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> cB1 \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_set_unfixed_scheduler cB1 (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cB1) (parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cB1)))) = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cB1) (parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cB1))) \\<and> (\\<not> parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cB1) \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> cB1 \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_set_unfixed_scheduler cB1 (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cB1) (parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cB1) @ [parser_bottom G]))) = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cB1) (parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cB1) @ [parser_bottom G])))\"\n  apply(clarsimp)\n  apply(rename_tac G cB1)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G cB1)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHFS_set_unfixed_scheduler_def parserHFS_get_unfixed_scheduler_def parserHFvHFS_Bra2LinConf_def parserHFvHFS_Lin2BraConf_def)\n   apply(case_tac cB1)\n   apply(rename_tac G cB1 parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_scheduler)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_history parserHFS_conf_stack parserHFS_conf_scheduler)(*strict*)\n   apply(simp add: left_quotient_word_def)\n  apply(rename_tac G cB1)(*strict*)\n  apply(clarsimp)\n  apply(simp add: parserHFS_set_unfixed_scheduler_def parserHFS_get_unfixed_scheduler_def parserHFvHFS_Bra2LinConf_def parserHFvHFS_Lin2BraConf_def)\n  apply(case_tac cB1)\n  apply(rename_tac G cB1 parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_scheduler)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_history parserHFS_conf_stack parserHFS_conf_scheduler)(*strict*)\n  apply(simp add: left_quotient_word_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Lin2BraConf_Bra2LinConf_idemp: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>cB. cB \\<in> parserHF_configurations G \\<longrightarrow> (\\<forall>s. s \\<in> parser_schedulers G \\<longrightarrow> parserHFvHFS_Bra2LinConf cB s \\<in> parserHFS_configurations G \\<longrightarrow> cB = parserHFvHFS_Lin2BraConf (parserHFvHFS_Bra2LinConf cB s))))\"\n  apply(clarsimp)\n  apply(rename_tac G cB s)(*strict*)\n  apply(simp add: parserHFvHFS_Lin2BraConf_def parserHFvHFS_Bra2LinConf_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_set_constructed_sched_vs_set_constructed_schedUF_prime_prime: \"\n  \\<forall>G c1L c3L cB e c2L sE3 sE2 sE1. valid_parser G \\<longrightarrow> c1L \\<in> parserHFS_configurations G \\<longrightarrow> c3L \\<in> parserHFS_configurations G \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> parserHFS_step_relation G c1L e c2L \\<longrightarrow> parserHFS_set_unfixed_scheduler c2L (sE3 @ parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf c3L) (sE2 @ (if parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed cB else parserHF_conf_fixed cB @ [parser_bottom G])))) = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf c2L) ((sE1 @ sE2) @ (if parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed cB else parserHF_conf_fixed cB @ [parser_bottom G])) \\<longrightarrow> parserHFS_set_unfixed_scheduler c1L ((the (right_quotient_word (parserHFS_get_unfixed_scheduler c1L) (parserHFS_get_unfixed_scheduler c2L)) @ sE3) @ parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf c3L) (sE2 @ (if parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G]\nthen parserHF_conf_fixed cB else parserHF_conf_fixed cB @ [parser_bottom G])))) = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf c1L) ((parserHFvHFS_Bra2LinStep (parserHFvHFS_Lin2BraConf c1L) e (parserHFvHFS_Lin2BraConf c2L) @ sE1 @ sE2) @ (if parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed cB else parserHF_conf_fixed cB @ [parser_bottom G]))\"\n  apply(clarsimp)\n  apply(rename_tac G c1L c3L cB)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G c1L c3L cB)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n   apply(subgoal_tac \"c2L \\<in> parserHFS_configurations G\")\n    apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n    apply(simp add: parserHFvHFS_Bra2LinStep_def parserHFvHFS_Bra2LinConf_def parserHFS_set_unfixed_scheduler_def parserHFvHFS_Lin2BraConf_def)\n    apply(subgoal_tac \"parserHFS_get_unfixed_scheduler c1L \\<sqsupseteq> parserHFS_get_unfixed_scheduler c2L\")\n     apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n     prefer 2\n     apply(rule parserHFS_unfixed_is_reduced_by_single_step)\n         apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n         apply(force)\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n        apply(force)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n       apply(simp add: parserHFS_step_relation_def valid_parser_def)\n       apply(force)\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n      apply(rule parserHFS.AX_step_relation_preserves_belongsC)\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n        apply(force)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n       apply(force)\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n      apply(force)\n     apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n    apply(simp add: suffix_def)\n    apply(subgoal_tac \"prefix (parserHFS_conf_fixed c2L) (parserHFS_conf_scheduler c2L)\")\n     apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n     apply(subgoal_tac \"prefix (parserHFS_conf_fixed c1L) (parserHFS_conf_scheduler c1L)\")\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n      apply(subgoal_tac \"prefix (parserHFS_conf_fixed c3L) (parserHFS_conf_scheduler c3L)\")\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca)(*strict*)\n       apply(rule_tac\n      t=\"right_quotient_word (parserHFS_get_unfixed_scheduler c1L) (parserHFS_get_unfixed_scheduler c2L)\"\n      and s=\"Some ca\"\n      in ssubst)\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca)(*strict*)\n        apply(rule right_quotient_word_Some_by_append)\n        apply(force)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca)(*strict*)\n       apply(rule_tac\n      t=\"right_quotient_word (ca @ parserHFS_get_unfixed_scheduler c2L) (parserHFS_get_unfixed_scheduler c2L)\"\n      and s=\"Some ca\"\n      in ssubst)\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca)(*strict*)\n        apply(rule right_quotient_word_Some_by_append)\n        apply(force)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca)(*strict*)\n       apply(clarsimp)\n       apply(subgoal_tac \"valid_parser_step_label G e\")\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca)(*strict*)\n        apply(simp add: parserHFS_get_unfixed_scheduler_def)\n        apply(simp add: prefix_def)\n        apply(clarsimp)\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb cc \"cd\")(*strict*)\n        apply(subgoal_tac \"left_quotient_word (parserHFS_conf_fixed c1L) (parserHFS_conf_scheduler c1L) = Some cc\")\n         apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb cc \"cd\")(*strict*)\n         apply(clarsimp)\n         apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb \"cd\")(*strict*)\n         apply(subgoal_tac \"left_quotient_word (parserHFS_conf_fixed c2L) (parserHFS_conf_scheduler c2L) = Some cb\")\n          apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb \"cd\")(*strict*)\n          apply(clarsimp)\n          apply(case_tac c1L)\n          apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb \"cd\" parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_schedulera)(*strict*)\n          apply(case_tac c2L)\n          apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb \"cd\" parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_schedulera parserHFS_conf_fixedaa parserHFS_conf_historyaa parserHFS_conf_stackaa parserHFS_conf_scheduleraa)(*strict*)\n          apply(clarsimp)\n          apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cb \"cd\" parserHFS_conf_fixeda parserHFS_conf_history parserHFS_conf_stack parserHFS_conf_fixedaa parserHFS_conf_historya parserHFS_conf_stacka)(*strict*)\n          apply(rename_tac f1 h1 l1 f2 h2 l2)\n          apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cb \"cd\" f1 h1 l1 f2 h2 l2)(*strict*)\n          apply(rule_tac\n      t=\"sE1 @ sE2 @ c @ [parser_bottom G]\"\n      and s=\"f2 @ sE3 @ the (left_quotient_word (parserHFS_conf_fixed c3L) (sE2 @ c @ [parser_bottom G]))\"\n      in ssubst)\n           apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cb \"cd\" f1 h1 l1 f2 h2 l2)(*strict*)\n           apply(force)\n          apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cb \"cd\" f1 h1 l1 f2 h2 l2)(*strict*)\n          apply(simp (no_asm))\n          apply(thin_tac \"f2 @ sE3 @ the (left_quotient_word (parserHFS_conf_fixed c3L) (sE2 @ c @ [parser_bottom G])) = sE1 @ sE2 @ c @ [parser_bottom G]\")\n          apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cb \"cd\" f1 h1 l1 f2 h2 l2)(*strict*)\n          apply(simp add: parserHFS_step_relation_def)\n          apply(rename_tac G c3L cB e c ca cb \"cd\" f1 h1 l1 f2 h2 l2)(*strict*)\n          apply(clarsimp)\n          apply(rename_tac G c3L cB e c ca cb \"cd\" f1 h1 x y)(*strict*)\n          apply(simp add: valid_parser_step_label_def)\n          apply(clarsimp)\n          apply(rename_tac G c3L cB e c ca cb \"cd\" f1 h1 x y k w xb)(*strict*)\n          apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xb\"\n      in ssubst)\n           apply(rename_tac G c3L cB e c ca cb \"cd\" f1 h1 x y k w xb)(*strict*)\n           apply(rule right_quotient_word_Some_by_append)\n           apply(force)\n          apply(rename_tac G c3L cB e c ca cb \"cd\" f1 h1 x y k w xb)(*strict*)\n          apply(force)\n         apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb \"cd\")(*strict*)\n         apply(rule left_quotient_word_Some_by_append)\n         apply(force)\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb cc \"cd\")(*strict*)\n        apply(rule left_quotient_word_Some_by_append)\n        apply(force)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca)(*strict*)\n       apply(simp add: valid_parser_def parserHFS_step_relation_def)\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n      apply(simp add: parserHFS_configurations_def)\n      apply(force)\n     apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n     apply(simp add: parserHFS_configurations_def)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n    apply(simp add: parserHFS_configurations_def)\n    apply(force)\n   apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n   apply(rule parserHFS.AX_step_relation_preserves_belongsC)\n     apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n    apply(force)\n   apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n   apply(force)\n  apply(rename_tac G c1L c3L cB)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n  apply(subgoal_tac \"c2L \\<in> parserHFS_configurations G\")\n   apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n   apply(simp add: parserHFvHFS_Bra2LinStep_def parserHFvHFS_Bra2LinConf_def parserHFS_set_unfixed_scheduler_def parserHFvHFS_Lin2BraConf_def)\n   apply(subgoal_tac \"parserHFS_get_unfixed_scheduler c1L \\<sqsupseteq> parserHFS_get_unfixed_scheduler c2L\")\n    apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n    prefer 2\n    apply(rule parserHFS_unfixed_is_reduced_by_single_step)\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n        apply(force)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n       apply(force)\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n      apply(simp add: parserHFS_step_relation_def valid_parser_def)\n      apply(force)\n     apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n     apply(rule parserHFS.AX_step_relation_preserves_belongsC)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n       apply(force)\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n      apply(force)\n     apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n    apply(force)\n   apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n   apply(simp add: suffix_def)\n   apply(subgoal_tac \"prefix (parserHFS_conf_fixed c2L) (parserHFS_conf_scheduler c2L)\")\n    apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n    apply(subgoal_tac \"prefix (parserHFS_conf_fixed c1L) (parserHFS_conf_scheduler c1L)\")\n     apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n     apply(subgoal_tac \"prefix (parserHFS_conf_fixed c3L) (parserHFS_conf_scheduler c3L)\")\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c)(*strict*)\n      apply(rule_tac\n      t=\"right_quotient_word (parserHFS_get_unfixed_scheduler c1L) (parserHFS_get_unfixed_scheduler c2L)\"\n      and s=\"Some c\"\n      in ssubst)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c)(*strict*)\n       apply(rule right_quotient_word_Some_by_append)\n       apply(force)\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c)(*strict*)\n      apply(rule_tac\n      t=\"right_quotient_word (c @ parserHFS_get_unfixed_scheduler c2L) (parserHFS_get_unfixed_scheduler c2L)\"\n      and s=\"Some c\"\n      in ssubst)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c)(*strict*)\n       apply(rule right_quotient_word_Some_by_append)\n       apply(force)\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c)(*strict*)\n      apply(clarsimp)\n      apply(subgoal_tac \"valid_parser_step_label G e\")\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c)(*strict*)\n       apply(simp add: parserHFS_get_unfixed_scheduler_def)\n       apply(simp add: prefix_def)\n       apply(clarsimp)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb cc)(*strict*)\n       apply(subgoal_tac \"left_quotient_word (parserHFS_conf_fixed c1L) (parserHFS_conf_scheduler c1L) = Some cb\")\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb cc)(*strict*)\n        apply(clarsimp)\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cc)(*strict*)\n        apply(subgoal_tac \"left_quotient_word (parserHFS_conf_fixed c2L) (parserHFS_conf_scheduler c2L) = Some ca\")\n         apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cc)(*strict*)\n         apply(clarsimp)\n         apply(case_tac c1L)\n         apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cc parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_schedulera)(*strict*)\n         apply(case_tac c2L)\n         apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cc parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_schedulera parserHFS_conf_fixedaa parserHFS_conf_historyaa parserHFS_conf_stackaa parserHFS_conf_scheduleraa)(*strict*)\n         apply(clarsimp)\n         apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cc parserHFS_conf_fixeda parserHFS_conf_history parserHFS_conf_stack parserHFS_conf_fixedaa parserHFS_conf_historya parserHFS_conf_stacka)(*strict*)\n         apply(rename_tac f1 h1 l1 f2 h2 l2)\n         apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cc f1 h1 l1 f2 h2 l2)(*strict*)\n         apply(thin_tac \"left_quotient_word f1 (f1 @ c @ ca) = Some (c @ ca)\")\n         apply(thin_tac \"left_quotient_word f2 (f2 @ ca) = Some ca\")\n         apply(simp add: parserHFS_step_relation_def)\n         apply(clarsimp)\n         apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cc f1 h1 x y)(*strict*)\n         apply(simp add: valid_parser_step_label_def)\n         apply(clarsimp)\n         apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cc f1 h1 x y k w xb)(*strict*)\n         apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xb\"\n      in ssubst)\n          apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cc f1 h1 x y k w xb)(*strict*)\n          apply(rule right_quotient_word_Some_by_append)\n          apply(force)\n         apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cc f1 h1 x y k w xb)(*strict*)\n         apply(clarsimp)\n         apply(rule_tac\n      t=\"f1 @ c @ sE3 @ the (left_quotient_word (parserHFS_conf_fixed c3L) (sE2 @ parserHF_conf_fixed cB @ [parser_bottom G]))\"\n      and s=\"kPrefix k (w @ [parser_bottom G]) @ drop (length (kPrefix k (w @ [parser_bottom G]))) f1@ sE3 @ the (left_quotient_word (parserHFS_conf_fixed c3L) (sE2 @ parserHF_conf_fixed cB @ [parser_bottom G]))\"\n      in ssubst)\n          apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cc f1 h1 x y k w xb)(*strict*)\n          apply(force)\n         apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cc f1 h1 x y k w xb)(*strict*)\n         apply(rule_tac\n      P=\"\\<lambda>X. X @ drop (length (kPrefix k (w @ [parser_bottom G]))) f1 @ sE3 @ the (left_quotient_word (parserHFS_conf_fixed c3L) (sE2 @ parserHF_conf_fixed cB @ [parser_bottom G])) = xb @ sE1 @ sE2 @ parserHF_conf_fixed cB @ [parser_bottom G]\"\n      and t=\"kPrefix k (w @ [parser_bottom G])\"\n      and s=\"xb @ rule_rpush e\"\n      in ssubst)\n          apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cc f1 h1 x y k w xb)(*strict*)\n          apply(force)\n         apply(rename_tac G c3L cB e sE3 sE2 sE1 c ca cc f1 h1 x y k w xb)(*strict*)\n         apply(simp (no_asm))\n        apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cc)(*strict*)\n        apply(rule left_quotient_word_Some_by_append)\n        apply(force)\n       apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c ca cb cc)(*strict*)\n       apply(rule left_quotient_word_Some_by_append)\n       apply(force)\n      apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1 c)(*strict*)\n      apply(simp add: valid_parser_def parserHFS_step_relation_def)\n     apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n     apply(simp add: parserHFS_configurations_def)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n    apply(simp add: parserHFS_configurations_def)\n    apply(force)\n   apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n   apply(simp add: parserHFS_configurations_def)\n   apply(force)\n  apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n  apply(rule parserHFS.AX_step_relation_preserves_belongsC)\n    apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n    apply(force)\n   apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n   apply(force)\n  apply(rename_tac G c1L c3L cB e c2L sE3 sE2 sE1)(*strict*)\n  apply(force)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinConf_triv_with_get_scheduler: \"\n   \\<forall>G cL. valid_parser G \\<longrightarrow>\n           cL \\<in> parserHFS_configurations G \\<longrightarrow>\n           parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL) (parserHFS_get_scheduler cL) =\n           cL\"\n  apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFS_get_scheduler_def parserHFvHFS_Lin2BraConf_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_lin_unfixed_scheduler_right_quotient_drop_proper1: \"\n  \\<forall>G cL cB sE. valid_parser G \\<longrightarrow> cL \\<in> parserHFS_configurations G \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> sE \\<in> parser_scheduler_fragments G \\<longrightarrow> \\<not> \\<not> parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> the (right_quotient_word (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf cB (sE @ (if parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) else parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) @ [parser_bottom G])))) (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL) (if parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) else parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) @ [parser_bottom G])))) = the (right_quotient_word (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf cB (sE @ (if parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) else parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) @ [parser_bottom G])))) [])\"\n  apply(clarsimp)\n  apply(rename_tac G cL cB sE)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFS_get_unfixed_scheduler_def parserHFvHFS_Lin2BraConf_def)\n  apply(rule_tac\n      t=\"left_quotient_word (parserHFS_conf_fixed cL) (parserHFS_conf_fixed cL)\"\n      and s=\"Some []\"\n      in ssubst)\n   apply(rename_tac G cL cB sE)(*strict*)\n   apply(rule left_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cL cB sE)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_lin_unfixed_scheduler_right_quotient_drop_proper: \"\n  (\\<forall>G cL cB sE. valid_parser G \\<longrightarrow> cL \\<in> parserHFS_configurations G \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> sE \\<in> parser_scheduler_fragments G \\<longrightarrow> parserHFvHFS_Bra2LinConf cB (sE @ (if parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) else parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) @ [parser_bottom G])) \\<in> parserHFS_configurations G \\<longrightarrow> (\\<not> \\<not> parserHF_conf_fixed cB \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> \\<not> \\<not> parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq> [parser_bottom G]) \\<longrightarrow> parserHFS_set_unfixed_scheduler (parserHFvHFS_Bra2LinConf cB (sE @ (if parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) else parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) @ [parser_bottom G]))) (the (right_quotient_word (parserHFS_get_unfixed_scheduler\n(parserHFvHFS_Bra2LinConf cB (sE @ (if parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) else parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) @ [parser_bottom G])))) (parserHFS_get_unfixed_scheduler (parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL) (if parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) else parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) @ [parser_bottom G])))) @ parserHFS_get_unfixed_scheduler cL) = parserHFvHFS_Bra2LinConf cB (sE @ parserHFS_get_scheduler cL))\"\n  apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G cL)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G cL cB sE)(*strict*)\n   apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFS_get_unfixed_scheduler_def parserHFvHFS_Lin2BraConf_def parserHFS_set_unfixed_scheduler_def)\n   apply(rule_tac\n      t=\"left_quotient_word (parserHFS_conf_fixed cL) (parserHFS_conf_fixed cL)\"\n      and s=\"Some []\"\n      in ssubst)\n    apply(rename_tac G cL cB sE)(*strict*)\n    apply(rule left_quotient_word_Some_by_append)\n    apply(force)\n   apply(rename_tac G cL cB sE)(*strict*)\n   apply(clarsimp)\n   apply(simp add: right_quotient_word_def)\n   apply(simp add: parserHFS_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac G cB sE f h l w wa)(*strict*)\n   apply(simp add: prefix_def suffix_def parserHFS_get_scheduler_def)\n   apply(clarsimp)\n   apply(rename_tac G cB sE l wa c ca cb cc \"cd\")(*strict*)\n   apply(subgoal_tac \"cc=[]\")\n    apply(rename_tac G cB sE l wa c ca cb cc \"cd\")(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G cB sE l wa ca cb \"cd\")(*strict*)\n    apply(rule_tac\n      t=\"left_quotient_word (wa @ [parser_bottom G]) (wa @ [parser_bottom G])\"\n      and s=\"Some []\"\n      in ssubst)\n     apply(rename_tac G cB sE l wa ca cb \"cd\")(*strict*)\n     apply(rule left_quotient_word_Some_by_append)\n     apply(force)\n    apply(rename_tac G cB sE l wa ca cb \"cd\")(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      t=\"left_quotient_word (parserHF_conf_fixed cB) (sE @ wa @ [parser_bottom G])\"\n      and s=\"Some ca\"\n      in ssubst)\n     apply(rename_tac G cB sE l wa ca cb \"cd\")(*strict*)\n     apply(rule left_quotient_word_Some_by_append)\n     apply(force)\n    apply(rename_tac G cB sE l wa ca cb \"cd\")(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G cB sE l wa c ca cb cc \"cd\")(*strict*)\n   apply(case_tac cc)\n    apply(rename_tac G cB sE l wa c ca cb cc \"cd\")(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G cB sE l wa c ca cb cc \"cd\" a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. cc = w' @ [x']\")\n    apply(rename_tac G cB sE l wa c ca cb cc \"cd\" a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac G cB sE l wa c ca cb cc \"cd\" a list)(*strict*)\n   apply(thin_tac \"cc=a#list\")\n   apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G cL cB sE)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFS_get_unfixed_scheduler_def parserHFvHFS_Lin2BraConf_def parserHFS_set_unfixed_scheduler_def parserHFS_get_scheduler_def)\n  apply(rule_tac\n      t=\"left_quotient_word (parserHFS_conf_fixed cL) (parserHFS_conf_fixed cL @ [parser_bottom G])\"\n      and s=\"Some [parser_bottom G]\"\n      in ssubst)\n   apply(rename_tac G cL cB sE)(*strict*)\n   apply(rule left_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cL cB sE)(*strict*)\n  apply(clarsimp)\n  apply(simp add: parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G cB sE f h l w)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G cB sE f h l w c ca)(*strict*)\n  apply(rule_tac\n      t=\"left_quotient_word f (w @ [parser_bottom G])\"\n      and s=\"Some ca\"\n      in ssubst)\n   apply(rename_tac G cB sE f h l w c ca)(*strict*)\n   apply(rule left_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cB sE f h l w c ca)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"left_quotient_word (parserHF_conf_fixed cB) (sE @ f @ [parser_bottom G])\"\n      and s=\"Some c\"\n      in ssubst)\n   apply(rename_tac G cB sE f h l w c ca)(*strict*)\n   apply(rule left_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cB sE f h l w c ca)(*strict*)\n  apply(clarsimp)\n  apply(simp add: suffix_def)\n  apply(clarsimp)\n  apply(rename_tac G cB sE f l w c ca cb cc)(*strict*)\n  apply(case_tac ca)\n   apply(rename_tac G cB sE f l w c ca cb cc)(*strict*)\n   apply(force)\n  apply(rename_tac G cB sE f l w c ca cb cc a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. ca = w' @ [x']\")\n   apply(rename_tac G cB sE f l w c ca cb cc a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G cB sE f l w c ca cb cc a list)(*strict*)\n  apply(thin_tac \"ca=a#list\")\n  apply(clarsimp)\n  apply(rename_tac G cB sE f l c cb cc w')(*strict*)\n  apply(case_tac c)\n   apply(rename_tac G cB sE f l c cb cc w')(*strict*)\n   apply(force)\n  apply(rename_tac G cB sE f l c cb cc w' a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n   apply(rename_tac G cB sE f l c cb cc w' a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G cB sE f l c cb cc w' a list)(*strict*)\n  apply(thin_tac \"c=a#list\")\n  apply(clarsimp)\n  apply(rename_tac G cB sE f l cb cc w' w'a)(*strict*)\n  apply(rule_tac\n      t=\"right_quotient_word (w'a @ [parser_bottom G]) [parser_bottom G]\"\n      and s=\"Some w'a\"\n      in ssubst)\n   apply(rename_tac G cB sE f l cb cc w' w'a)(*strict*)\n   apply(rule right_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cB sE f l cb cc w' w'a)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Lin2BraConf_ignores_set_unfixed_scheduler: \"\n  \\<forall>G cB s sUF. valid_parser G \\<longrightarrow> cB \\<in> parserHF_configurations G \\<longrightarrow> s \\<in> parser_schedulers G \\<longrightarrow> cB = parserHFvHFS_Lin2BraConf (parserHFS_set_unfixed_scheduler (parserHFvHFS_Bra2LinConf cB s) sUF)\"\n  apply(clarsimp)\n  apply(rename_tac G cB s sUF)(*strict*)\n  apply(simp add: parserHFvHFS_Lin2BraConf_def parserHFvHFS_Bra2LinConf_def parserHFS_set_unfixed_scheduler_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Lin2BraConf_preserves_fixed_scheduler_extendable: \"\n  \\<forall>G cL.\n       valid_parser G \\<longrightarrow>\n       cL \\<in> parserHFS_configurations G \\<longrightarrow>\n       parser_fixed_scheduler_extendable G\n        (parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL)) =\n       parser_fixed_scheduler_extendable G (parserHFS_conf_fixed cL)\"\n  apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(simp add: parserHFvHFS_Lin2BraConf_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinDer_preserves_marking_condition: \"\n  \\<forall>G. valid_parser G \\<longrightarrow>\n        (\\<forall>db. parserHF.derivation_initial G db \\<longrightarrow>\n              parserHF_marking_condition G db \\<longrightarrow>\n              (\\<forall>n. maximum_of_domain db n \\<longrightarrow>\n                   parserHFS_marking_condition G\n                    (parserHF_vs_parserHFS.Bra2LinDer\n                      G db n)))\"\n  apply(clarsimp)\n  apply(rename_tac G db n)(*strict*)\n  apply(rename_tac G dl n)\n  apply(rename_tac G dl n)(*strict*)\n  apply(simp add: parserHFS_marking_condition_def parserHF_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac G dl n i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(rule_tac\n      x=\"e\"\n      in exI)\n  apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n  apply(subgoal_tac \"i\\<le>n\")\n   apply(rename_tac G dl n i e c)(*strict*)\n   prefer 2\n   apply(rule parserHF.allPreMaxDomSome_prime)\n     apply(rename_tac G dl n i e c)(*strict*)\n     apply(simp add: parserHF.derivation_initial_def)\n     apply(force)\n    apply(rename_tac G dl n i e c)(*strict*)\n    apply(force)\n   apply(rename_tac G dl n i e c)(*strict*)\n   apply(force)\n  apply(rename_tac G dl n i e c)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e c. dl n = Some (pair e c)\")\n   apply(rename_tac G dl n i e c)(*strict*)\n   prefer 2\n   apply(rule parserHF.some_position_has_details_before_max_dom)\n     apply(rename_tac G dl n i e c)(*strict*)\n     apply(simp add: parserHF.derivation_initial_def)\n     apply(force)\n    apply(rename_tac G dl n i e c)(*strict*)\n    apply(force)\n   apply(rename_tac G dl n i e c)(*strict*)\n   apply(force)\n  apply(rename_tac G dl n i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G dl n i e c ea ca)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G dl n i e c ea ca)(*strict*)\n   apply(simp add: parserHF_marking_configurations_def suffix_def parserHFS_marking_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n   apply(subgoal_tac \"cb=[]\")\n    apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n    apply(subgoal_tac \"parserHFvHFS_Bra2LinConf c (parserHF_vs_parserHFS.Bra2LinDer' G dl n i @ [parser_bottom G]) \\<in> parserHFS_configurations G\")\n     apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n     apply(clarsimp)\n     apply(simp add: parserHF_vs_parserHFS.Bra2LinDer'_def)\n     apply(rule conjI)\n      apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n      apply(simp add: parserHFvHFS_Bra2LinConf_def)\n     apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n     apply(case_tac n)\n      apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac G dl e c f w)(*strict*)\n      apply(simp add: parserHFvHFS_Bra2LinConf_def)\n     apply(rename_tac G dl n i e c ea ca f w nat)(*strict*)\n     apply(simp add: parserHFvHFS_Bra2LinConf_def)\n     apply(rule foldl_emptyX)\n     apply(rename_tac G dl n i e c ea ca f w nat ia)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n     apply(subgoal_tac \"length (nat_seq i nat) = nat + 1 - i\")\n      apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n      prefer 2\n      apply(rule nat_seq_length_prime)\n     apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n     apply(rule_tac\n      t=\"nat_seq i nat ! ia\"\n      and s=\"i+ia\"\n      in ssubst)\n      apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n      apply(rule nat_seq_nth_compute)\n       apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n       apply(force)\n      apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n      apply(force)\n     apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. dl (i+ia) = Some (pair e1 c1) \\<and> dl (Suc(i+ia)) = Some (pair (Some e2) c2) \\<and> parserHF_step_relation G c1 e2 c2\")\n      apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n      prefer 2\n      apply(rule_tac\n      m=\"Suc nat\"\n      in parserHF.step_detail_before_some_position)\n        apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n        apply(simp add: parserHF.derivation_initial_def)\n       apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n       apply(force)\n      apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n      apply(force)\n     apply(rename_tac G dl i e c ea ca f w nat ia)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n     apply(simp add: parserHFvHFS_Bra2LinStep_def)\n     apply(rule_tac\n      d=\"dl\"\n      and i=\"i\"\n      and n=\"i+ia\"\n      and m=\"nat - i - ia\"\n      in parserHF_steps_are_empty2)\n               apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n               apply(force)\n              apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n              apply(simp add: parserHF.derivation_initial_def)\n             apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n             apply(rule parserHF.derivation_initial_belongs)\n              apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n              apply(force)\n             apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n             apply(force)\n            apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n            apply(force)\n           apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n           apply(force)\n          apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n          apply(force)\n         apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n         apply(force)\n        apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n        apply(force)\n       apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n       prefer 2\n       apply(force)\n      apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n      apply(force)\n     apply(rename_tac G dl i e c ea ca f w nat ia e1 e2 c1 c2)(*strict*)\n     apply(force)\n    apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n    apply(rule_tac n=\"n\" and m=\"i\" in parserHF_vs_parserHFS.Bra2LinDer_preserves_configurations_prime)\n          apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n          apply(force)\n         apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n         apply(simp add: parserHF.derivation_initial_def)\n         apply(force)\n        apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n        apply(rule parserHF.derivation_initial_belongs)\n         apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n         apply(force)\n        apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n        apply(force)\n       apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n       apply(force)\n      apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n      apply(force)\n     apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n     apply(force)\n    apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: suffix_def)\n   apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n   apply(subgoal_tac \"parserHF_conf_fixed ca = [] \\<or> parserHF_conf_fixed ca = [parser_bottom G]\")\n    apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n    apply(force)\n   apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n   apply(rule_tac\n      d=\"dl\"\n      and i=\"i\"\n      and n=\"n\"\n      in parserHF_steps_are_empty1)\n          apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n          apply(force)\n         apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n         apply(simp add: parserHF.derivation_initial_def)\n        apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n        apply(rule parserHF.derivation_initial_belongs)\n         apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n         apply(force)\n        apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n        apply(force)\n       apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n       apply(force)\n      apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n      apply(force)\n     apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n     apply(force)\n    apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n    apply(force)\n   apply(rename_tac G dl n i e c ea ca f w cb)(*strict*)\n   apply(force)\n  apply(rename_tac G dl n i e c ea ca)(*strict*)\n  apply(simp add: suffix_def)\n  apply(clarsimp)\n  apply(simp add: parserHF_marking_configurations_def suffix_def parserHFS_marking_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n  apply(subgoal_tac \"parserHFvHFS_Bra2LinConf c (parserHF_vs_parserHFS.Bra2LinDer' G dl n i @ parserHF_conf_fixed ca @ [parser_bottom G]) \\<in> parserHFS_configurations G\")\n   apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n   prefer 2\n   apply(rule_tac n=\"n\" and m=\"i\" in parserHF_vs_parserHFS.Bra2LinDer_preserves_configurations_prime)\n         apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n         apply(force)\n        apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n        apply(simp add: parserHF.derivation_initial_def)\n        apply(force)\n       apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n       apply(rule parserHF.derivation_initial_belongs)\n        apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n        apply(force)\n       apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n       apply(force)\n      apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n      apply(force)\n     apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n     apply(force)\n    apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n    apply(force)\n   apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: suffix_def)\n  apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n   apply(simp add: parserHFvHFS_Bra2LinConf_def)\n  apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def)\n  apply(simp add: parserHF_vs_parserHFS.Bra2LinDer'_def)\n  apply(simp add: parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"parserHF_conf_fixed ca = []\")\n   apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"parserHF_conf_fixed ca = [] \\<or> parserHF_conf_fixed ca = [parser_bottom G]\")\n    apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n    prefer 2\n    apply(rule_tac\n      c=\"c\"\n      and d=\"dl\"\n      and i=\"i\"\n      and n=\"n\"\n      in parserHF_steps_are_empty1)\n           apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n           apply(force)\n          apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n          apply(simp add: parserHF.derivation_initial_def)\n         apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n         apply(rule parserHF.derivation_initial_belongs)\n          apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n          apply(force)\n         apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n         apply(force)\n        apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n        apply(force)\n       apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n       apply(force)\n      apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n      apply(force)\n     apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n     apply(force)\n    apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n    apply(force)\n   apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n   apply(erule_tac\n      P=\"parserHF_conf_fixed ca = []\"\n      in disjE)\n    apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G dl n i e c ea ca f w)(*strict*)\n  apply(clarsimp)\n  apply(rule foldl_emptyX)\n  apply(rename_tac G dl n i e c ea ca f w ia)(*strict*)\n  apply(clarsimp)\n  apply(case_tac n)\n   apply(rename_tac G dl n i e c ea ca f w ia)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G dl n i e c ea ca f w ia nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n  apply(subgoal_tac \"length (nat_seq i nat) = nat + 1 - i\")\n   apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n  apply(rule_tac\n      t=\"nat_seq i nat ! ia\"\n      and s=\"i+ia\"\n      in ssubst)\n   apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n    apply(force)\n   apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n   apply(force)\n  apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. dl (i+ia) = Some (pair e1 c1) \\<and> dl (Suc(i+ia)) = Some (pair (Some e2) c2) \\<and> parserHF_step_relation G c1 e2 c2\")\n   apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in parserHF.step_detail_before_some_position)\n     apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n     apply(simp add: parserHF.derivation_initial_def)\n    apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n    apply(force)\n   apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n   apply(force)\n  apply(rename_tac G dl i e c ea ca f w ia nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n  apply(rule_tac\n      t=\"nat_seq i nat ! ia\"\n      and s=\"i+ia\"\n      in ssubst)\n   apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n    apply(force)\n   apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(simp add: parserHFvHFS_Bra2LinStep_def)\n  apply(rule_tac\n      d=\"dl\"\n      and i=\"i\"\n      and n=\"i+ia\"\n      and m=\"nat - i - ia\"\n      in parserHF_steps_are_empty2)\n            apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n            apply(force)\n           apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n           apply(simp add: parserHF.derivation_initial_def)\n          apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n          apply(rule parserHF.derivation_initial_belongs)\n           apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n           apply(force)\n          apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n          apply(force)\n         apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n         apply(force)\n        apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n        apply(force)\n       apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n       apply(force)\n      apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n      apply(force)\n     apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n     apply(force)\n    apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac G dl i e c ea ca f w ia nat e1 e2 c1 c2)(*strict*)\n  apply(force)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_lin_unfixed_scheduler_right_quotient_drop_proper2: \"\n\\<forall>G cL cB sE sL cL2.\n       valid_parser G \\<longrightarrow>\n       cL \\<in> parserHFS_configurations G \\<longrightarrow>\n       cB \\<in> parserHF_configurations G \\<longrightarrow>\n       sE \\<in> parser_scheduler_fragments G \\<longrightarrow>\n       parserHFvHFS_Bra2LinConf cB (sE @ sL) \\<in> parserHFS_configurations G \\<longrightarrow>\n       (\\<not> parser_fixed_scheduler_extendable G (parserHF_conf_fixed cB) \\<longrightarrow>\n        \\<not> parser_fixed_scheduler_extendable G\n            (parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL))) \\<longrightarrow>\n       sL =\n       (if parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq>\n           [parser_bottom G]\n        then parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL)\n        else parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) @\n             [parser_bottom G]) \\<longrightarrow>\n       cL2 = parserHFvHFS_Bra2LinConf cB (sE @ sL) \\<longrightarrow>\n       parserHFS_set_unfixed_scheduler cL2\n        (the (right_quotient_word (parserHFS_get_unfixed_scheduler cL2)\n               (parserHFS_get_unfixed_scheduler\n                 (parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL)\n                   sL))) @\n         parserHFS_get_unfixed_scheduler cL) =\n       parserHFvHFS_Bra2LinConf cB (sE @ parserHFS_get_scheduler cL)\"\n  apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G cL)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G cL cB sE)(*strict*)\n   apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFS_get_unfixed_scheduler_def parserHFvHFS_Lin2BraConf_def parserHFS_set_unfixed_scheduler_def)\n   apply(rule_tac\n      t=\"left_quotient_word (parserHFS_conf_fixed cL) (parserHFS_conf_fixed cL)\"\n      and s=\"Some []\"\n      in ssubst)\n    apply(rename_tac G cL cB sE)(*strict*)\n    apply(rule left_quotient_word_Some_by_append)\n    apply(force)\n   apply(rename_tac G cL cB sE)(*strict*)\n   apply(clarsimp)\n   apply(simp add: right_quotient_word_def)\n   apply(simp add: parserHFS_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac G cB sE f h l w wa)(*strict*)\n   apply(simp add: prefix_def suffix_def parserHFS_get_scheduler_def)\n   apply(clarsimp)\n   apply(rename_tac G cB sE l wa c ca cb cc \"cd\")(*strict*)\n   apply(subgoal_tac \"cc=[]\")\n    apply(rename_tac G cB sE l wa c ca cb cc \"cd\")(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G cB sE l wa ca cb \"cd\")(*strict*)\n    apply(rule_tac\n      t=\"left_quotient_word (wa @ [parser_bottom G]) (wa @ [parser_bottom G])\"\n      and s=\"Some []\"\n      in ssubst)\n     apply(rename_tac G cB sE l wa ca cb \"cd\")(*strict*)\n     apply(rule left_quotient_word_Some_by_append)\n     apply(force)\n    apply(rename_tac G cB sE l wa ca cb \"cd\")(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      t=\"left_quotient_word (parserHF_conf_fixed cB) (sE @ wa @ [parser_bottom G])\"\n      and s=\"Some ca\"\n      in ssubst)\n     apply(rename_tac G cB sE l wa ca cb \"cd\")(*strict*)\n     apply(rule left_quotient_word_Some_by_append)\n     apply(force)\n    apply(rename_tac G cB sE l wa ca cb \"cd\")(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G cB sE l wa c ca cb cc \"cd\")(*strict*)\n   apply(case_tac cc)\n    apply(rename_tac G cB sE l wa c ca cb cc \"cd\")(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G cB sE l wa c ca cb cc \"cd\" a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. cc = w' @ [x']\")\n    apply(rename_tac G cB sE l wa c ca cb cc \"cd\" a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac G cB sE l wa c ca cb cc \"cd\" a list)(*strict*)\n   apply(thin_tac \"cc=a#list\")\n   apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G cL cB sE)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFS_get_unfixed_scheduler_def parserHFvHFS_Lin2BraConf_def parserHFS_set_unfixed_scheduler_def parserHFS_get_scheduler_def)\n  apply(rule_tac\n      t=\"left_quotient_word (parserHFS_conf_fixed cL) (parserHFS_conf_fixed cL @ [parser_bottom G])\"\n      and s=\"Some [parser_bottom G]\"\n      in ssubst)\n   apply(rename_tac G cL cB sE)(*strict*)\n   apply(rule left_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cL cB sE)(*strict*)\n  apply(clarsimp)\n  apply(simp add: parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G cB sE f h l w)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G cB sE f h l w c ca)(*strict*)\n  apply(rule_tac\n      t=\"left_quotient_word f (w @ [parser_bottom G])\"\n      and s=\"Some ca\"\n      in ssubst)\n   apply(rename_tac G cB sE f h l w c ca)(*strict*)\n   apply(rule left_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cB sE f h l w c ca)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"left_quotient_word (parserHF_conf_fixed cB) (sE @ f @ [parser_bottom G])\"\n      and s=\"Some c\"\n      in ssubst)\n   apply(rename_tac G cB sE f h l w c ca)(*strict*)\n   apply(rule left_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cB sE f h l w c ca)(*strict*)\n  apply(clarsimp)\n  apply(simp add: suffix_def)\n  apply(clarsimp)\n  apply(rename_tac G cB sE f l w c ca cb cc)(*strict*)\n  apply(case_tac ca)\n   apply(rename_tac G cB sE f l w c ca cb cc)(*strict*)\n   apply(force)\n  apply(rename_tac G cB sE f l w c ca cb cc a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. ca = w' @ [x']\")\n   apply(rename_tac G cB sE f l w c ca cb cc a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G cB sE f l w c ca cb cc a list)(*strict*)\n  apply(thin_tac \"ca=a#list\")\n  apply(clarsimp)\n  apply(rename_tac G cB sE f l c cb cc w')(*strict*)\n  apply(case_tac c)\n   apply(rename_tac G cB sE f l c cb cc w')(*strict*)\n   apply(force)\n  apply(rename_tac G cB sE f l c cb cc w' a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n   apply(rename_tac G cB sE f l c cb cc w' a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G cB sE f l c cb cc w' a list)(*strict*)\n  apply(thin_tac \"c=a#list\")\n  apply(clarsimp)\n  apply(rename_tac G cB sE f l cb cc w' w'a)(*strict*)\n  apply(rule_tac\n      t=\"right_quotient_word (w'a @ [parser_bottom G]) [parser_bottom G]\"\n      and s=\"Some w'a\"\n      in ssubst)\n   apply(rename_tac G cB sE f l cb cc w' w'a)(*strict*)\n   apply(rule right_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cB sE f l cb cc w' w'a)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinStep_Bra2LinFin_compatible: \"\n  \\<forall>G cB1 e cB2.\n       valid_parser G \\<longrightarrow>\n       parserHF_step_relation G cB1 e cB2 \\<longrightarrow>\n       cB1 \\<in> parserHF_configurations G \\<longrightarrow>\n       \\<not> parser_fixed_scheduler_extendable G (parserHF_conf_fixed cB1) \\<longrightarrow>\n       parserHFvHFS_Bra2LinStep cB1 e cB2 @\n       (if parserHF_conf_fixed cB2 \\<sqsupseteq> [parser_bottom G]\n        then parserHF_conf_fixed cB2\n        else parserHF_conf_fixed cB2 @ [parser_bottom G]) =\n       (if parserHF_conf_fixed cB1 \\<sqsupseteq> [parser_bottom G]\n        then parserHF_conf_fixed cB1\n        else parserHF_conf_fixed cB1 @ [parser_bottom G])\"\n  apply(rule allI)+\n  apply(rename_tac G cB1 e cB2)(*strict*)\n  apply(rule impI)+\n  apply(subgoal_tac \"valid_parser_step_label G e\")\n   apply(rename_tac G cB1 e cB2)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(rename_tac G cB1 e cB2)(*strict*)\n  apply(subgoal_tac \"cB2 \\<in> parserHF_configurations G\")\n   apply(rename_tac G cB1 e cB2)(*strict*)\n   prefer 2\n   apply (metis parserHF.AX_step_relation_preserves_belongs)\n  apply(rename_tac G cB1 e cB2)(*strict*)\n  apply(subgoal_tac \"parserHF_conf_fixed cB2 \\<sqsupseteq> [parser_bottom G]\")\n   apply(rename_tac G cB1 e cB2)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHF_step_relation_def parserHF_configurations_def valid_parser_step_label_def parserHFvHFS_Bra2LinStep_def)\n   apply(clarsimp)\n   apply(rename_tac G e f h k w xa xb)(*strict*)\n   apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xb\"\n      in ssubst)\n    apply(rename_tac G e f h k w xa xb)(*strict*)\n    apply(rule right_quotient_word_Some_by_append)\n    apply(force)\n   apply(rename_tac G e f h k w xa xb)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"prefix (xb @ rule_rpush e) f\")\n    apply(rename_tac G e f h k w xa xb)(*strict*)\n    apply(simp add: prefix_def)\n    apply(force)\n   apply(rename_tac G e f h k w xa xb)(*strict*)\n   apply(simp add: prefix_def suffix_def)\n   apply(clarsimp)\n   apply(rename_tac G e k w xa xb c ca cb cc \"cd\")(*strict*)\n   apply(simp add: kPrefix_def)\n   apply(case_tac \"k - length w\")\n    apply(rename_tac G e k w xa xb c ca cb cc \"cd\")(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n     apply(rename_tac G e k w xa xb c ca cb cc \"cd\")(*strict*)\n     apply (metis not_in_diff)\n    apply(rename_tac G e k w xa xb c ca cb cc \"cd\")(*strict*)\n    apply (metis kPrefix_def take_reflects_mem)\n   apply(rename_tac G e k w xa xb c ca cb cc \"cd\" nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G e k w xa xb c ca cb cc \"cd\" nat x)(*strict*)\n   apply(rule_tac\n      x=\"[]\"\n      in exI)\n   apply(clarsimp)\n   apply(case_tac \"cd\")\n    apply(rename_tac G e k w xa xb c ca cb cc \"cd\" nat x)(*strict*)\n    apply(force)\n   apply(rename_tac G e k w xa xb c ca cb cc \"cd\" nat x a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. cd = w' @ [x']\")\n    apply(rename_tac G e k w xa xb c ca cb cc \"cd\" nat x a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac G e k w xa xb c ca cb cc \"cd\" nat x a list)(*strict*)\n   apply(thin_tac \"cd = a # list\")\n   apply(clarsimp)\n  apply(rename_tac G cB1 e cB2)(*strict*)\n  apply(subgoal_tac \"\\<not> parser_fixed_scheduler_extendable G (parserHF_conf_fixed cB2)\")\n   apply(rename_tac G cB1 e cB2)(*strict*)\n   prefer 2\n   apply (metis insert_Nil parserHF.AX_fixed_scheduler_extendable_translates_backwards)\n  apply(rename_tac G cB1 e cB2)(*strict*)\n  apply(simp add: parser_fixed_scheduler_extendable_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinConf_Lin2BraConf_on_unextendable_scheduler_fragments: \"\n  \\<forall>G cL. valid_parser G \\<longrightarrow> cL \\<in> parserHFS_configurations G \\<longrightarrow> \\<not> parserHFS_get_unfixed_scheduler cL \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> cL = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL) (if parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) else parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) @ [parser_bottom G])\"\n  apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G cL)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHFvHFS_Lin2BraConf_def parserHFvHFS_Bra2LinConf_def)\n   apply(case_tac cL)\n   apply(rename_tac G cL parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_scheduler)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_history parserHFS_conf_stack parserHFS_conf_scheduler)(*strict*)\n   apply(simp add: parserHFS_get_unfixed_scheduler_def)\n   apply(simp add: parserHFS_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_history parserHFS_conf_stack w)(*strict*)\n   apply(simp add: suffix_def)\n   apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_stack w c ca)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_stack w c ca cb)(*strict*)\n   apply(case_tac cb)\n    apply(rename_tac G parserHFS_conf_stack w c ca cb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_stack w c ca cb a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. cb = w' @ [x']\")\n    apply(rename_tac G parserHFS_conf_stack w c ca cb a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac G parserHFS_conf_stack w c ca cb a list)(*strict*)\n   apply(thin_tac \"cb = a # list\")\n   apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(clarsimp)\n  apply(simp add: parserHFvHFS_Lin2BraConf_def parserHFvHFS_Bra2LinConf_def parserHFS_get_unfixed_scheduler_def)\n  apply(case_tac cL)\n  apply(rename_tac G cL parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_schedulera)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_history parserHFS_conf_stack parserHFS_conf_scheduler)(*strict*)\n  apply(simp add: parserHFS_configurations_def suffix_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack c ca w)(*strict*)\n  apply(case_tac c)\n   apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack c ca w)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack c ca w a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n   apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack c ca w a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack c ca w a list)(*strict*)\n  apply(thin_tac \"c = a # list\")\n  apply(clarsimp)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack ca w')(*strict*)\n  apply(simp add: left_quotient_word_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_translate_proper_idemp_doulbe_transfer_on_head: \"\n  \\<forall>G s cB2 cL1 e. valid_parser G \\<longrightarrow> s \\<in> parser_schedulers G \\<longrightarrow> parserHFvHFS_Bra2LinConf cB2 s \\<in> parserHFS_configurations G \\<longrightarrow> cL1 \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_step_relation G cL1 e (parserHFvHFS_Bra2LinConf cB2 s) \\<longrightarrow> cL1 = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL1) (parserHFvHFS_Bra2LinStep (parserHFvHFS_Lin2BraConf cL1) e cB2 @ s)\"\n  apply(clarsimp)\n  apply(rename_tac G s cB2 cL1 e)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e\")\n   apply(rename_tac G s cB2 cL1 e)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def parserHFS_step_relation_def)\n  apply(rename_tac G s cB2 cL1 e)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFvHFS_Bra2LinStep_def parserHFvHFS_Lin2BraConf_def parserHFS_configurations_def parserHFS_step_relation_def valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac G cB2 e f h k w xa xb y xc wb)(*strict*)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac G cB2 e f k w xa xb y xc wb c ca cb cc)(*strict*)\n  apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xc\"\n      in ssubst)\n   apply(rename_tac G cB2 e f k w xa xb y xc wb c ca cb cc)(*strict*)\n   apply(rule right_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cB2 e f k w xa xb y xc wb c ca cb cc)(*strict*)\n  apply(clarsimp)\n  apply (metis concat_asso)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinConf_Lin2BraConf_idemp_on_get_scheduler: \"\n  \\<forall>G cL. valid_parser G \\<longrightarrow> cL \\<in> parserHFS_configurations G \\<longrightarrow> cL = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL) (parserHFS_get_scheduler cL)\"\n  apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFvHFS_Lin2BraConf_def parserHFS_get_scheduler_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinConf_Lin2BraConf_idemp_on_get_scheduler_prime: \"\n  (\\<forall>G cL sL. valid_parser G \\<longrightarrow> cL \\<in> parserHFS_configurations G \\<longrightarrow> sL \\<in> parser_schedulers G \\<longrightarrow> cL = parserHFvHFS_Bra2LinConf (parserHFvHFS_Lin2BraConf cL) sL \\<longrightarrow> sL = parserHFS_get_scheduler cL)\"\n  apply(clarsimp)\n  apply(rename_tac G cL sL)(*strict*)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def parserHFvHFS_Lin2BraConf_def parserHFS_get_scheduler_def)\n  apply(case_tac cL)\n  apply(rename_tac G cL sL parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_schedulera)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_proper_removal_of_scheduler_parts: \"\n  \\<forall>G cL1 e cL2. valid_parser G \\<longrightarrow> cL1 \\<in> parserHFS_configurations G \\<longrightarrow> parserHFS_step_relation G cL1 e cL2 \\<longrightarrow> parserHFvHFS_Bra2LinStep (parserHFvHFS_Lin2BraConf cL1) e (parserHFvHFS_Lin2BraConf cL2) @ parserHFS_get_scheduler cL2 = parserHFS_get_scheduler cL1\"\n  apply(clarsimp)\n  apply(rename_tac G cL1 e cL2)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e\")\n   apply(rename_tac G cL1 e cL2)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def parserHFS_step_relation_def)\n  apply(rename_tac G cL1 e cL2)(*strict*)\n  apply(simp add: valid_parser_step_label_def parserHFvHFS_Bra2LinConf_def parserHFvHFS_Lin2BraConf_def parserHFS_get_scheduler_def parserHFvHFS_Bra2LinStep_def parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac G cL1 e cL2 k w xa)(*strict*)\n  apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xa\"\n      in ssubst)\n   apply(rename_tac G cL1 e cL2 k w xa)(*strict*)\n   apply(rule right_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G cL1 e cL2 k w xa)(*strict*)\n  apply(clarsimp)\n  apply(simp add: parserHFS_step_relation_def)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinFin_takes_entire_fixed_scheduler: \"\n\\<forall>G cL.\n       valid_parser G \\<longrightarrow>\n       cL \\<in> parserHFS_configurations G \\<longrightarrow>\n       \\<not> parser_unfixed_scheduler_extendable G\n           (parserHFS_get_unfixed_scheduler cL) \\<longrightarrow>\n       (if parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) \\<sqsupseteq>\n           [parser_bottom G]\n        then parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL)\n        else parserHF_conf_fixed (parserHFvHFS_Lin2BraConf cL) @\n             [parser_bottom G]) =\n       parserHFS_get_scheduler cL\"\n  apply(clarsimp)\n  apply(rename_tac G cL)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G cL)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHFvHFS_Lin2BraConf_def parserHFvHFS_Bra2LinConf_def)\n   apply(case_tac cL)\n   apply(rename_tac G cL parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_scheduler)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_history parserHFS_conf_stack parserHFS_conf_scheduler)(*strict*)\n   apply(simp add: parserHFS_get_unfixed_scheduler_def)\n   apply(simp add: parserHFS_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_history parserHFS_conf_stack w)(*strict*)\n   apply(simp add: suffix_def)\n   apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_stack w c ca)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_stack w c ca cb)(*strict*)\n   apply(rule_tac\n      xs=\"cb\"\n      in rev_cases)\n    apply(rename_tac G parserHFS_conf_stack w c ca cb)(*strict*)\n    prefer 2\n    apply(rename_tac G parserHFS_conf_stack w c ca cb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_stack w c ca cb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G parserHFS_conf_stack w ca)(*strict*)\n   apply(simp add: parserHFS_get_scheduler_def)\n  apply(rename_tac G cL)(*strict*)\n  apply(clarsimp)\n  apply(simp add: parserHFvHFS_Lin2BraConf_def parserHFvHFS_Bra2LinConf_def parserHFS_get_unfixed_scheduler_def)\n  apply(case_tac cL)\n  apply(rename_tac G cL parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_schedulera)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_history parserHFS_conf_stack parserHFS_conf_scheduler)(*strict*)\n  apply(simp add: parserHFS_configurations_def suffix_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack c ca w)(*strict*)\n  apply(case_tac c)\n   apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack c ca w)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack c ca w a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n   apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack c ca w a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack c ca w a list)(*strict*)\n  apply(thin_tac \"c = a # list\")\n  apply(clarsimp)\n  apply(rename_tac G parserHFS_conf_fixed parserHFS_conf_stack ca w')(*strict*)\n  apply(simp add: left_quotient_word_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_combine_consumed_and_remaining_scheduler: \"\n \\<forall>G s cL1 e cB2.\n       valid_parser G \\<longrightarrow>\n       s \\<in> parser_schedulers G \\<longrightarrow>\n       cL1 \\<in> parserHFS_configurations G \\<longrightarrow>\n       parserHFS_step_relation G cL1 e (parserHFvHFS_Bra2LinConf cB2 s) \\<longrightarrow>\n       parserHFvHFS_Bra2LinStep (parserHFvHFS_Lin2BraConf cL1) e cB2 @ s =\n       parserHFS_get_scheduler cL1\"\n  apply(clarsimp)\n  apply(rename_tac G s cL1 e cL2)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e\")\n   apply(rename_tac G s cL1 e cL2)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def parserHFS_step_relation_def)\n  apply(rename_tac G s cL1 e cL2)(*strict*)\n  apply(simp add: valid_parser_step_label_def parserHFvHFS_Bra2LinConf_def parserHFvHFS_Lin2BraConf_def parserHFS_get_scheduler_def parserHFvHFS_Bra2LinStep_def parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac G s cL1 e cL2 k w xa)(*strict*)\n  apply(rule_tac\n      t=\"right_quotient_word (kPrefix k (w @ [parser_bottom G])) (rule_rpush e)\"\n      and s=\"Some xa\"\n      in ssubst)\n   apply(rename_tac G cL1 e cL2 k w xa)(*strict*)\n   apply(rule right_quotient_word_Some_by_append)\n   apply(force)\n  apply(rename_tac G s cL1 e cL2 k w xa)(*strict*)\n  apply(clarsimp)\n  apply(simp add: parserHFS_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac G cL1 e cL2 k w xa x xb y)(*strict*)\n  apply(rule_tac\n      xs=\"xb\"\n      in rev_cases)\n   apply(rename_tac G cL1 e cL2 k w xa x xb y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G cL1 e cL2 k w xa x xb y ys ya)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_bra2lin_preserves_unmarked_effect: \"\n  \\<forall>G db x n.\n       valid_parser G \\<longrightarrow>\n       ATS.derivation_initial parserHF_initial_configurations\n        parserHF_step_relation G db \\<longrightarrow>\n       x \\<in> parserHF_unmarked_effect G db \\<longrightarrow>\n       maximum_of_domain db n \\<longrightarrow>\n       x \\<in> parserHFS_unmarked_effect G\n             (parserHF_vs_parserHFS.Bra2LinDer\n               G db n)\"\n  apply(clarsimp)\n  apply(rename_tac G db x n)(*strict*)\n  apply(simp add: parserHF_unmarked_effect_def parserHFS_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G db n i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(subgoal_tac \"i\\<le>n\")\n   apply(rename_tac G db n i e c)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. db n = Some (pair e c)\")\n    apply(rename_tac G db n i e c)(*strict*)\n    apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G db n i\")\n     apply(rename_tac G db n i e c)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac G db n i e c ea ca)(*strict*)\n     apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(rename_tac G db n i e c a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G db n i e c a ea ca)(*strict*)\n    apply(case_tac a)\n    apply(rename_tac G db n i e c a ea ca option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G db n i e c ea ca option b)(*strict*)\n    apply(subgoal_tac \"parserHFS_conf_history (the (get_configuration (parserHF_vs_parserHFS.Bra2LinDer SSG SSd SSn SSi))) = parserHF_conf_history c\" for SSG SSd SSn SSi)\n     apply(rename_tac G db n i e c ea ca option b)(*strict*)\n     prefer 2\n     apply(rule_tac\n      n=\"n\"\n      and d=\"db\"\n      in parserHF_vs_parserHFS.AX_Bra2LinConf_preserves_history_lift)\n          apply(rename_tac G db n i e c ea ca option b)(*strict*)\n          apply(force)\n         apply(rename_tac G db n i e c ea ca option b)(*strict*)\n         apply(simp add: parserHF.derivation_initial_def)\n        apply(rename_tac G db n i e c ea ca option b)(*strict*)\n        apply(rule parserHF.derivation_initial_belongs)\n         apply(rename_tac G db n i e c ea ca option b)(*strict*)\n         apply(force)\n        apply(rename_tac G db n i e c ea ca option b)(*strict*)\n        apply(force)\n       apply(rename_tac G db n i e c ea ca option b)(*strict*)\n       apply(force)\n      apply(rename_tac G db n i e c ea ca option b)(*strict*)\n      apply(force)\n     apply(rename_tac G db n i e c ea ca option b)(*strict*)\n     apply(force)\n    apply(rename_tac G db n i e c ea ca option b)(*strict*)\n    apply(clarsimp)\n    apply(simp add: get_configuration_def)\n   apply(rename_tac G db n i e c)(*strict*)\n   apply(rule parserHF.some_position_has_details_before_max_dom)\n     apply(rename_tac G db n i e c)(*strict*)\n     apply(simp add: parserHF.derivation_initial_def)\n     apply(force)\n    apply(rename_tac G db n i e c)(*strict*)\n    apply(force)\n   apply(rename_tac G db n i e c)(*strict*)\n   apply(force)\n  apply(rename_tac G db n i e c)(*strict*)\n  apply (metis not_None_eq parserHF.allPreMaxDomSome_prime parserHF.derivation_initial_is_derivation)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_lin2bra_preserves_unmarked_effect: \"\n  \\<forall>G dl x n. valid_parser G \\<longrightarrow> parserHFS.derivation_initial G dl \\<longrightarrow> x \\<in> parserHFS_unmarked_effect G dl \\<longrightarrow> maximum_of_domain dl n \\<longrightarrow> x \\<in> parserHF_unmarked_effect G (ATS_Branching_Versus_Linear1.Lin2BraDer parserHFvHFS_Lin2BraConf dl)\"\n  apply(clarsimp)\n  apply(rename_tac G dl x xa)(*strict*)\n  apply(simp add: parserHF_unmarked_effect_def parserHFS_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G dl xa i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(case_tac \"ATS_Branching_Versus_Linear1.Lin2BraDer parserHFvHFS_Lin2BraConf dl i\")\n   apply(rename_tac G dl xa i e c)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHF_vs_parserHFS.Lin2BraDer_def derivation_map_def)\n  apply(rename_tac G dl xa i e c a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac G dl xa i e c a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G dl xa i e c option b)(*strict*)\n  apply(subgoal_tac \"parserHFS_conf_history c = parserHF_conf_history (parserHFvHFS_Lin2BraConf c)\")\n   apply(rename_tac G dl xa i e c option b)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"dl\"\n      in parserHF_vs_parserHFS.AX_Lin2BraConf_preserves_history_lift)\n      apply(rename_tac G dl xa i e c option b)(*strict*)\n      apply(force)\n     apply(rename_tac G dl xa i e c option b)(*strict*)\n     apply(simp add: parserHFS.derivation_initial_def)\n    apply(rename_tac G dl xa i e c option b)(*strict*)\n    apply(rule parserHFS.derivation_initial_belongs)\n     apply(rename_tac G dl xa i e c option b)(*strict*)\n     apply(force)\n    apply(rename_tac G dl xa i e c option b)(*strict*)\n    apply(force)\n   apply(rename_tac G dl xa i e c option b)(*strict*)\n   apply(force)\n  apply(rename_tac G dl xa i e c option b)(*strict*)\n  apply(clarsimp)\n  apply(simp add: parserHF_vs_parserHFS.Lin2BraDer_def derivation_map_def)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_lin2bra_preserves_marked_effect: \"\n  \\<forall>G dl x n. valid_parser G \\<longrightarrow> parserHFS.derivation_initial G dl \\<longrightarrow> parserHFS_marking_condition G dl \\<longrightarrow> x \\<in> parserHFS_marked_effect G dl \\<longrightarrow> maximum_of_domain dl n \\<longrightarrow> x \\<in> parserHF_marked_effect G (ATS_Branching_Versus_Linear1.Lin2BraDer parserHFvHFS_Lin2BraConf dl)\"\n  apply(clarsimp)\n  apply(rename_tac G dl x xa)(*strict*)\n  apply(simp add: parserHFS_marked_effect_def parserHF_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G dl xa i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(subgoal_tac \"i\\<le>xa\")\n   apply(rename_tac G dl xa i e c)(*strict*)\n   apply(case_tac \"ATS_Branching_Versus_Linear1.Lin2BraDer parserHFvHFS_Lin2BraConf dl i\")\n    apply(rename_tac G dl xa i e c)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Lin2BraDer_def derivation_map_def)\n   apply(rename_tac G dl xa i e c a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac G dl xa i e c a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G dl xa i e c option b)(*strict*)\n   apply(subgoal_tac \"parserHFS_conf_history c = parserHF_conf_history (parserHFvHFS_Lin2BraConf c)\")\n    apply(rename_tac G dl xa i e c option b)(*strict*)\n    prefer 2\n    apply(rule parserHF_vs_parserHFS.AX_Lin2BraConf_preserves_history_lift)\n       apply(rename_tac G dl xa i e c option b)(*strict*)\n       apply(force)\n      apply(rename_tac G dl xa i e c option b)(*strict*)\n      apply(rule parserHFS.derivation_initial_is_derivation)\n      apply(force)\n     apply(rename_tac G dl xa i e c option b)(*strict*)\n     apply (metis parserHFS.derivation_initial_belongs)\n    apply(rename_tac G dl xa i e c option b)(*strict*)\n    apply(force)\n   apply(rename_tac G dl xa i e c option b)(*strict*)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac G dl xa i e c option b)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Lin2BraDer_def derivation_map_def)\n   apply(rename_tac G dl xa i e c option b)(*strict*)\n   apply(simp add: parserHF_marking_configurations_def parserHFS_marking_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac G dl xa i e c option b f w)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac G dl xa i e c option b f w)(*strict*)\n    apply(rule_tac\n      x=\"f\"\n      in bexI)\n     apply(rename_tac G dl xa i e c option b f w)(*strict*)\n     apply(rule_tac\n      x=\"w\"\n      in exI)\n     apply(simp add: parserHF_vs_parserHFS.Lin2BraDer_def derivation_map_def)\n     apply(simp add: parserHFvHFS_Lin2BraConf_def)\n     apply(clarsimp)\n     apply(rename_tac G dl xa i c option b f w)(*strict*)\n     apply(case_tac b)\n     apply(rename_tac G dl xa i c option b f w parserHF_conf_fixed parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac G dl xa i e c option b f w)(*strict*)\n    apply(force)\n   apply(rename_tac G dl xa i e c option b f w)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac G dl xa i e c option b f w)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Lin2BraDer_def derivation_map_def)\n    apply(clarsimp)\n    apply(rename_tac G dl xa i c option f w)(*strict*)\n    apply(simp add: parserHFvHFS_Lin2BraConf_def)\n    apply(simp add: parserHFS_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac G dl xa i option f w fa h)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac G dl xa i option f w fa h c)(*strict*)\n    apply(case_tac c)\n     apply(rename_tac G dl xa i option f w fa h c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac G dl xa i option f w fa h c a list)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G dl xa i option f w fa h a list)(*strict*)\n    apply(subgoal_tac \"fa=[]\")\n     apply(rename_tac G dl xa i option f w fa h a list)(*strict*)\n     apply(subgoal_tac \"list=[]\")\n      apply(rename_tac G dl xa i option f w fa h a list)(*strict*)\n      apply(force)\n     apply(rename_tac G dl xa i option f w fa h a list)(*strict*)\n     apply(force)\n    apply(rename_tac G dl xa i option f w fa h a list)(*strict*)\n    apply (metis Cons_eq_appendI eq_Nil_appendI insert_Nil length_1_context_empty)\n   apply(rename_tac G dl xa i e c option b f w)(*strict*)\n   prefer 2\n   apply(rename_tac G dl xa i e c)(*strict*)\n   apply (metis not_Some_eq parserHFS.allPreMaxDomSome_prime parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G dl xa i e c option b f w)(*strict*)\n  apply(simp add: parserHF_vs_parserHFS.Lin2BraDer_def derivation_map_def)\n  apply(clarsimp)\n  apply(rename_tac G dl xa i c option f w)(*strict*)\n  apply(simp add: parserHFvHFS_Lin2BraConf_def)\n  apply(simp add: parserHF_configurations_def parserHFS_configurations_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac G dl xa i option f w fa h ca)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G dl xa i option f w fa h ca)(*strict*)\n   apply (metis set_append1 set_subset_in2 subset_trans)\n  apply(rename_tac G dl xa i option f w fa h ca)(*strict*)\n  apply(clarsimp)\n  apply(case_tac ca)\n   apply(rename_tac G dl xa i option f w fa h ca)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G dl xa i option f w fa h ca a list)(*strict*)\n  apply(subgoal_tac \"fa=[]\")\n   apply(rename_tac G dl xa i option f w fa h ca a list)(*strict*)\n   apply(subgoal_tac \"list=[]\")\n    apply(rename_tac G dl xa i option f w fa h ca a list)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G dl xa i option f w fa h ca a list)(*strict*)\n   apply(force)\n  apply(rename_tac G dl xa i option f w fa h ca a list)(*strict*)\n  apply (metis List.butlast_append Nil_is_append_conv butlast.simps(2) list.simps(2))\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_bra2lin_preserves_marked_effect: \"\n  \\<forall>G db x n. valid_parser G \\<longrightarrow> parserHF.derivation_initial G db \\<longrightarrow> parserHF_marking_condition G db \\<longrightarrow> x \\<in> parserHF_marked_effect G db \\<longrightarrow> maximum_of_domain db n \\<longrightarrow> (\\<exists>i\\<le>n. parserHF_marking_condition G (derivation_take db i) \\<and> x \\<in> parserHFS_marked_effect G (parserHF_vs_parserHFS.Bra2LinDer G (derivation_take db i) i))\"\n  apply(clarsimp)\n  apply(rename_tac G db x n)(*strict*)\n  apply(simp add: parserHFS_marked_effect_def parserHF_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G db n i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac G db n i e c)(*strict*)\n   apply (metis not_Some_eq parserHF.allPreMaxDomSome_prime parserHF.derivation_initial_is_derivation)\n  apply(rename_tac G db n i e c)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac G db n i e c)(*strict*)\n   apply(simp add: parserHF_marking_condition_def)\n   apply(clarsimp)\n   apply(rename_tac G db n i e c ia ea ca)(*strict*)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac G db n i e c ia ea ca)(*strict*)\n    apply(simp add: derivation_take_def)\n   apply(rename_tac G db n i e c ia ea ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G db n i e c ia ea ca j e' c')(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac G db n i e c)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(simp add: parserHF_marking_configurations_def)\n  apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_take db i) i i\")\n   apply(rename_tac G db n i e c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G db n i e c f w)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def derivation_take_def)\n  apply(rename_tac G db n i e c a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G db n i e c a f w)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac G db n i e c a f w option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G db n i e c f w option b)(*strict*)\n  apply(subgoal_tac \"parserHFS_conf_history (the (get_configuration (parserHF_vs_parserHFS.Bra2LinDer SSG SSd SSn SSi))) = parserHF_conf_history c\" for SSG SSd SSn SSi)\n   apply(rename_tac G db n i e c f w option b)(*strict*)\n   prefer 2\n   apply(rule_tac\n      i=\"i\"\n      and n=\"i\"\n      and d=\"derivation_take db i\"\n      in parserHF_vs_parserHFS.AX_Bra2LinConf_preserves_history_lift)\n        apply(rename_tac G db n i e c f w option b)(*strict*)\n        apply(force)\n       apply(rename_tac G db n i e c f w option b)(*strict*)\n       apply(rule parserHF.derivation_take_preserves_derivation)\n       apply(rule parserHF.derivation_initial_is_derivation)\n       apply(force)\n      apply(rename_tac G db n i e c f w option b)(*strict*)\n      apply(rule parserHF.derivation_initial_belongs)\n       apply(rename_tac G db n i e c f w option b)(*strict*)\n       apply(force)\n      apply(rename_tac G db n i e c f w option b)(*strict*)\n      apply(rule parserHF.derivation_take_preserves_derivation_initial)\n      apply(force)\n     apply(rename_tac G db n i e c f w option b)(*strict*)\n     apply(simp add: derivation_take_def)\n    apply(rename_tac G db n i e c f w option b)(*strict*)\n    apply(simp add: derivation_take_def)\n   apply(rename_tac G db n i e c f w option b)(*strict*)\n   apply(force)\n  apply(rename_tac G db n i e c f w option b)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G db n i e c f w option b)(*strict*)\n   apply(simp add: get_configuration_def ATS_Branching_Versus_Linear1.Bra2LinDer_def)\n  apply(rename_tac G db n i e c f w option b)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(simp add: parserHFS_marking_configurations_def)\n  apply(rule conjI)\n   apply(rename_tac G db n i e c f w option b)(*strict*)\n   apply(rule_tac\n      x=\"f\"\n      in bexI)\n    apply(rename_tac G db n i e c f w option b)(*strict*)\n    apply(rule_tac\n      x=\"w\"\n      in exI)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def derivation_take_def parserHFvHFS_Bra2LinConf_def)\n    apply(case_tac b)\n    apply(rename_tac G db n i e c f w option b parserHFS_conf_fixed parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_scheduler)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G db n i e c f w option b)(*strict*)\n   apply(force)\n  apply(rename_tac G db n i e c f w option b)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G db n i e c f w option b)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def derivation_take_def parserHFvHFS_Bra2LinConf_def parserHF_vs_parserHFS.Bra2LinDer'_def)\n   apply(case_tac b)\n   apply(rename_tac G db n i e c f w option b parserHFS_conf_fixed parserHFS_conf_historya parserHFS_conf_stack parserHFS_conf_schedulera)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G db n i c f w option)(*strict*)\n   apply(subgoal_tac \"case_nat [] (nat_seq i) i=[]\")\n    apply(rename_tac G db n i c f w option)(*strict*)\n    apply(clarsimp)\n    apply(erule disjE)\n     apply(rename_tac G db n i c f w option)(*strict*)\n     apply(clarsimp)\n     apply(simp add: suffix_def)\n    apply(rename_tac G db n i c f w option)(*strict*)\n    apply(clarsimp)\n    apply(simp add: suffix_def)\n   apply(rename_tac G db n i c f w option)(*strict*)\n   apply(case_tac i)\n    apply(rename_tac G db n i c f w option)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G db n i c f w option nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G db n c f w option nat)(*strict*)\n   apply (metis lessI nat_seqEmpty)\n  apply(rename_tac G db n i e c f w option b)(*strict*)\n  apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def derivation_take_def parserHFvHFS_Bra2LinConf_def parserHF_vs_parserHFS.Bra2LinDer'_def)\n  apply(case_tac b)\n  apply(rename_tac G db n i e c f w option b parserHFS_conf_fixed parserHFS_conf_historya parserHFS_conf_stack parserHFS_conf_scheduler)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G db n i c f w option)(*strict*)\n  apply(subgoal_tac \"case_nat [] (nat_seq i) i=[]\")\n   apply(rename_tac G db n i c f w option)(*strict*)\n   prefer 2\n   apply(case_tac i)\n    apply(rename_tac G db n i c f w option)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G db n i c f w option nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G db n c f w option nat)(*strict*)\n   apply (metis lessI nat_seqEmpty)\n  apply(rename_tac G db n i c f w option)(*strict*)\n  apply(clarsimp)\n  apply(erule disjE)\n   apply(rename_tac G db n i c f w option)(*strict*)\n   apply(clarsimp)\n   apply(simp add: suffix_def)\n   apply(simp add: parserHFS_configurations_def parserHF_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac G db n i f w option h)(*strict*)\n   apply(simp add: prefix_def)\n   apply(simp add: valid_parser_def)\n  apply(rename_tac G db n i c f w option)(*strict*)\n  apply(clarsimp)\n  apply(simp add: suffix_def)\n  apply(simp add: parserHFS_configurations_def parserHF_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac G db n i f w option h)(*strict*)\n  apply(simp add: prefix_def)\n  done\n\nlemma three_cases_strict_prefix: \"\n  prefix a x\n  \\<Longrightarrow> prefix b x\n  \\<Longrightarrow> a=b \\<or> strict_prefix a b \\<or> strict_prefix b a\"\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac c ca)(*strict*)\n  apply(subgoal_tac \"prefix a b \\<or> prefix b a\")\n   apply(rename_tac c ca)(*strict*)\n   prefer 2\n   apply(rule mutual_prefix_prefix)\n   apply(rule sym)\n   apply(force)\n  apply(rename_tac c ca)(*strict*)\n  apply(erule disjE)\n   apply(simp add: prefix_def strict_prefix_def)\n   apply(force)\n  apply(simp add: prefix_def strict_prefix_def)\n  apply(force)\n  done\n\nlemma set_butlast_if_match_subset: \"\n  set w \\<subseteq> A\n  \\<Longrightarrow> set(butlast_if_match w X) \\<subseteq> A\"\n  apply(rule_tac\n      xs=\"w\"\n      in rev_cases)\n   apply(simp add: butlast_if_match_def)\n  apply(rename_tac ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ys y x)(*strict*)\n  apply(simp add: butlast_if_match_def)\n  apply(case_tac \"y=X\")\n   apply(rename_tac ys y x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ys x uu_ uua_)(*strict*)\n   apply(force)\n  apply(rename_tac ys y x)(*strict*)\n  apply(force)\n  done\n\nlemma parserHFS_post_history_prefix_of_pre_history_and_remaining_rhs: \"\n         valid_parser G \\<Longrightarrow>\n       parserHFS_step_relation G cL e1 cL1 \\<Longrightarrow>\n       valid_parser_step_label G e1 \\<Longrightarrow>\n       cL \\<in> parserHFS_configurations G \\<Longrightarrow>\n       parserHFS_conf_history cL1 \\<sqsubseteq>\n       parserHFS_conf_history cL @\n       drop (length (parserHFS_conf_fixed cL)) (parserHFS_conf_scheduler cL)\"\n  apply(simp add: parserHFS_step_relation_def parserHFvHFS_Lin2BraConf_def Let_def)\n  apply(clarsimp)\n  apply(rename_tac x xa y)(*strict*)\n  apply(case_tac cL)\n  apply(rename_tac x xa y parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_schedulera)(*strict*)\n  apply(case_tac cL1)\n  apply(rename_tac x xa y parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_schedulera parserHFS_conf_fixedaa parserHFS_conf_historyaa parserHFS_conf_stackaa parserHFS_conf_scheduleraa)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac x xa y parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stacka parserHFS_conf_schedulera parserHFS_conf_fixedaa parserHFS_conf_historyaa parserHFS_conf_stackaa parserHFS_conf_scheduleraa rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa y parserHFS_conf_fixed parserHFS_conf_history rule_lpop rule_rpop rule_lpush rule_rpush)(*strict*)\n  apply(simp add: prefix_def)\n  apply(rule_tac xs=\"rule_rpop\" in rev_cases)\n   apply(rename_tac x xa y parserHFS_conf_fixed parserHFS_conf_history rule_lpop rule_rpop rule_lpush rule_rpush)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa y parserHFS_conf_fixed parserHFS_conf_history rule_lpop rule_lpush rule_rpush)(*strict*)\n   apply(simp add: butlast_if_match_def)\n  apply(rename_tac x xa y parserHFS_conf_fixed parserHFS_conf_history rule_lpop rule_rpop rule_lpush rule_rpush ys ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa y parserHFS_conf_fixed parserHFS_conf_history rule_lpop rule_lpush rule_rpush ys ya)(*strict*)\n  apply(simp add: parserHFS_configurations_def valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac x xa y parserHFS_conf_fixed parserHFS_conf_history rule_lpop rule_lpush rule_rpush ys ya k w xc wa)(*strict*)\n  apply(thin_tac \"parserHFS_conf_history \\<sqsupseteq>\n       butlast_if_match parserHFS_conf_fixed (parser_bottom G)\")\n  apply(thin_tac \"\\<lparr>rule_lpop = rule_lpop, rule_rpop = kPrefix k (w @ [parser_bottom G]),\n          rule_lpush = rule_lpush, rule_rpush = rule_rpush\\<rparr>\n       \\<in> parser_rules G\")\n  apply(rename_tac f h XXXXXXXXXXX YYYYYYYY rpu ys ya k w xc wa)\n  apply(rename_tac x xa y f h XXXXXXXXXXX YYYYYYYY rpu ys ya k w xc wa)(*strict*)\n  apply(thin_tac \"set XXXXXXXXXXX \\<subseteq> parser_nonterms G\" for XXXXXXXXXXX)\n  apply(thin_tac \"set XXXXXXXXXXX \\<subseteq> parser_nonterms G\" for XXXXXXXXXXX)\n  apply(thin_tac \"set XXXXXXXXXXX \\<subseteq> parser_nonterms G\" for XXXXXXXXXXX)\n  apply(thin_tac \"XXXXXXXXXXX \\<noteq> []\" for XXXXXXXXXXX)\n  apply(thin_tac \"XXXXXXXXXXX \\<noteq> []\" for XXXXXXXXXXX)\n  apply(clarsimp)\n  apply(rename_tac xa y f h rpu ys ya k w xc wa)(*strict*)\n  apply(simp add: prefix_def kPrefix_def)\n  apply(clarsimp)\n  apply(rename_tac xa y f h rpu ys ya k w xc wa c)(*strict*)\n  apply(case_tac \"k-length w\")\n   apply(rename_tac xa y f h rpu ys ya k w xc wa c)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"min (length w) k=k\")\n    apply(rename_tac xa y f h rpu ys ya k w xc wa c)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac xa y f h rpu ys ya k w xc wa c)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n    apply(rename_tac xa y f h rpu ys ya k w xc wa c)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_reduces in_set_conv_decomp in_set_takeD nset_diff)\n   apply(rename_tac xa y f h rpu ys ya k w xc wa c)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac xs=\"xa\" in rev_cases)\n    apply(rename_tac xa y f h rpu ys ya k w xc wa c)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac xa y f h rpu ys ya k w xc wa c ysa yb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h rpu ys ya k w xc c ysa)(*strict*)\n   apply(rule_tac xs=\"c\" in rev_cases)\n    apply(rename_tac f h rpu ys ya k w xc c ysa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac h rpu ys ya k w xc ysa)(*strict*)\n    apply (metis ConsApp List.length_take add_Suc_right append_assoc drop_length_append length_append list.size(4) monoid_add_class.add.right_neutral)\n   apply(rename_tac f h rpu ys ya k w xc c ysa ysb y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h rpu ys ya k w xc ysa ysb)(*strict*)\n   apply(rule_tac t=\"take k w\" and s=\"ys @ [ya]\" in ssubst)\n    apply(rename_tac f h rpu ys ya k w xc ysa ysb)(*strict*)\n    apply(force)\n   apply(rename_tac f h rpu ys ya k w xc ysa ysb)(*strict*)\n   apply(simp (no_asm))\n  apply(rename_tac xa y f h rpu ys ya k w xc wa c nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa y f h k xc wa c nat x)(*strict*)\n  apply(subgoal_tac \"butlast_if_match ((xc @ x) @ [parser_bottom G])\n              (parser_bottom G) = xc@x\")\n   apply(rename_tac xa y f h k xc wa c nat x)(*strict*)\n   prefer 2\n   apply (metis append_assoc butlast_if_match_direct)\n  apply(rename_tac xa y f h k xc wa c nat x)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma elem_in_append_set: \"\n  w@ A # v = r @ s\n  \\<Longrightarrow> A \\<notin> set r\n  \\<Longrightarrow> A \\<notin> set s\n  \\<Longrightarrow> Q\"\n  apply (metis in_set_conv_decomp not_set_append)\n  done\n\nlemma parser_bottom_take_end: \"\n  ysa @ [A] = take ka wa\n  \\<Longrightarrow> set wa \\<subseteq> X - {A}\n  \\<Longrightarrow> Q\"\n  apply(subgoal_tac \"A \\<in> set wa\")\n   apply(force)\n  apply(rule_tac A=\"set (take ka wa)\" in set_mp)\n   apply(rule set_take_subset2)\n   apply(force)\n  apply(rule_tac A=\"set (ysa @ [A])\" in set_mp)\n   apply(force)\n  apply(simp (no_asm))\n  done\n\nlemma parserHFS_step_precise_history: \"\n       parserHFS_step_relation G cL e1 cL1 \\<Longrightarrow>\n       parserHFS_conf_history cL1 =\n       parserHFS_conf_history cL @\n       drop (length (parserHFS_conf_fixed cL))\n        (butlast_if_match (rule_rpop e1) (parser_bottom G))\"\n  apply(simp add: parserHFS_step_relation_def parserHFvHFS_Lin2BraConf_def Let_def)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Lin2BraConf_enforces_compatible_history_fragment_SB_hlp: \"\n  prefix w1 w2 \\<and> P1\n  \\<or> prefix w2 w1 \\<and> P2\n  \\<or> w1=w2\n  \\<Longrightarrow> w2 \\<in> parser_markers G\n  \\<Longrightarrow> w1 \\<in> parser_markers G\n  \\<Longrightarrow> ATS_History.history_fragment_prefixes parser_markers (@) G w1 \\<subseteq> ATS_History.history_fragment_prefixes parser_markers (@) G w2 \\<and> P1 \\<or> ATS_History.history_fragment_prefixes parser_markers (@) G w2 \\<subseteq> ATS_History.history_fragment_prefixes parser_markers (@) G w1 \\<and> P2 \\<or> ATS_History.history_fragment_prefixes parser_markers (@) G w1 = ATS_History.history_fragment_prefixes parser_markers (@) G w2\"\n  apply(erule disjE)\n   apply(rule disjI1)\n   apply(rule conjI)\n    prefer 2\n    apply(clarsimp)\n   apply(rule_tac t=\"ATS_History.history_fragment_prefixes parser_markers (@) G w1\" and s=\"prefix_closure {w1}\" in ssubst)\n    apply(simp add: parserHFS.history_fragment_prefixes_def)\n    apply(rule antisym)\n     apply(clarsimp)\n     apply(rename_tac x hf'')(*strict*)\n     apply(simp add: prefix_closure_def prefix_def)\n    apply(simp add: prefix_closure_def prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x c ca)(*strict*)\n    apply(simp add: parser_markers_def)\n   apply(rule_tac t=\"ATS_History.history_fragment_prefixes parser_markers (@) G w2\" and s=\"prefix_closure {w2}\" in ssubst)\n    apply(simp add: parserHFS.history_fragment_prefixes_def)\n    apply(rule antisym)\n     apply(clarsimp)\n     apply(rename_tac x hf'')(*strict*)\n     apply(simp add: prefix_closure_def prefix_def)\n    apply(simp add: prefix_closure_def prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x c ca)(*strict*)\n    apply(simp add: parser_markers_def)\n   apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(simp add: prefix_closure_def prefix_def)\n   apply(force)\n  apply(erule disjE)\n   apply(rule disjI2)\n   apply(rule disjI1)\n   apply(rule conjI)\n    prefer 2\n    apply(clarsimp)\n   apply(rule_tac t=\"ATS_History.history_fragment_prefixes parser_markers (@) G w1\" and s=\"prefix_closure {w1}\" in ssubst)\n    apply(simp add: parserHFS.history_fragment_prefixes_def)\n    apply(rule antisym)\n     apply(clarsimp)\n     apply(rename_tac x hf'')(*strict*)\n     apply(simp add: prefix_closure_def prefix_def)\n    apply(simp add: prefix_closure_def prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x c ca)(*strict*)\n    apply(simp add: parser_markers_def)\n   apply(rule_tac t=\"ATS_History.history_fragment_prefixes parser_markers (@) G w2\" and s=\"prefix_closure {w2}\" in ssubst)\n    apply(simp add: parserHFS.history_fragment_prefixes_def)\n    apply(rule antisym)\n     apply(clarsimp)\n     apply(rename_tac x hf'')(*strict*)\n     apply(simp add: prefix_closure_def prefix_def)\n    apply(simp add: prefix_closure_def prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x c ca)(*strict*)\n    apply(simp add: parser_markers_def)\n   apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(simp add: prefix_closure_def prefix_def)\n   apply(force)\n  apply(rule disjI2)\n  apply(rule disjI2)\n  apply(rule_tac t=\"ATS_History.history_fragment_prefixes parser_markers (@) G w1\" and s=\"prefix_closure {w1}\" in ssubst)\n   apply(simp add: parserHFS.history_fragment_prefixes_def)\n   apply(rule antisym)\n    apply(clarsimp)\n    apply(rename_tac x hf'')(*strict*)\n    apply(simp add: prefix_closure_def prefix_def)\n   apply(simp add: prefix_closure_def prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x c)(*strict*)\n   apply(simp add: parser_markers_def)\n  apply(rule_tac t=\"ATS_History.history_fragment_prefixes parser_markers (@) G w2\" and s=\"prefix_closure {w2}\" in ssubst)\n   apply(simp add: parserHFS.history_fragment_prefixes_def)\n   apply(rule antisym)\n    apply(clarsimp)\n    apply(rename_tac x hf'')(*strict*)\n    apply(simp add: prefix_closure_def prefix_def)\n   apply(simp add: prefix_closure_def prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x c)(*strict*)\n   apply(simp add: parser_markers_def)\n  apply(clarsimp)\n  done\n\nlemma prefix_alt_apply: \"\n  w1@w2=v1@v2\n  \\<Longrightarrow> (prefix w1 v1 \\<Longrightarrow> P)\n  \\<Longrightarrow> (prefix v1 w1 \\<Longrightarrow> P)\n  \\<Longrightarrow> P\"\n  apply (metis mutual_strict_prefix_prefix strict_prefix_to_prefix)\n  done\n\nlemma tail_empty: \"\n  k\\<le>length c\n  \\<Longrightarrow> c@x = take k w\n  \\<Longrightarrow> x = []\"\n  apply (metis List.length_take append_eq_conv_conj append_self_conv take_all_length take_take)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Lin2BraConf_enforces_compatible_history_fragment_SB_hlp2: \"\n  x = cc @ drop (length cc) x @ c\n  \\<Longrightarrow> c \\<noteq> []\n  \\<Longrightarrow> False\"\n  apply(subgoal_tac \"length (cc @ drop (length cc) x @ c) = length x + length c\")\n   apply(force)\n  apply(subgoal_tac \"length (cc @ drop (length cc) x @ c) = length (cc @ drop (length cc) x)+length c\")\n   prefer 2\n   apply(simp (no_asm))\n  apply(subgoal_tac \"length (cc @ drop (length cc) x) = length x\")\n   prefer 2\n   apply(force)\n  apply(simp (no_asm_use))\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Lin2BraConf_enforces_compatible_history_fragment_SB_hlp3: \"\n       valid_parser G \\<Longrightarrow>\n       parserHFS_step_relation G cL e1 cL1 \\<Longrightarrow>\n       parserHFS_step_relation G cL e2 cL2 \\<Longrightarrow>\n       valid_parser_step_label G e1 \\<Longrightarrow>\n       valid_parser_step_label G e2 \\<Longrightarrow>\n       cL \\<in> parserHFS_configurations G \\<Longrightarrow>\n       drop (length (parserHFS_conf_fixed cL))\n        (butlast_if_match (rule_rpop e1) (parser_bottom G))\n       \\<in> parser_markers G \\<and>\n       drop (length (parserHFS_conf_fixed cL))\n        (butlast_if_match (rule_rpop e2) (parser_bottom G))\n       \\<in> parser_markers G \\<Longrightarrow>\n       parserHFS_conf_history cL1 \\<sqsubset> parserHFS_conf_history cL2 \\<Longrightarrow>\n       ATS_determHIST_SB.compatible_history_fragment_SB parser_markers (@)\n        (@) parserHF_conf_history parser_fixed_scheduler_extendable\n        parserHF_conf_fixed G (parserHFvHFS_Lin2BraConf cL)\n        (parserHFvHFS_Lin2BraConf cL1) (parserHFvHFS_Lin2BraConf cL2)\"\n  apply(simp add: parserHF.compatible_history_fragment_SB_def)\n  apply(rule_tac x=\"drop (length (parserHFS_conf_fixed cL))\n         (butlast_if_match (rule_rpop e1) (parser_bottom G))\" in exI)\n  apply(rule conjI)\n   apply(clarsimp)\n  apply(rule_tac x=\"drop (length (parserHFS_conf_fixed cL))\n         (butlast_if_match (rule_rpop e2) (parser_bottom G))\" in exI)\n  apply(rule conjI)\n   apply(clarsimp)\n  apply(simp add: Let_def)\n  apply(rule context_conjI)\n   apply(simp add: parserHFvHFS_Lin2BraConf_def)\n   apply(rule parserHFS_step_precise_history)\n   apply(force)\n  apply(rule context_conjI)\n   apply(simp add: parserHFvHFS_Lin2BraConf_def)\n   apply(rule parserHFS_step_precise_history)\n   apply(force)\n  apply(rule parserHF_vs_parserHFS_inst_AX_Lin2BraConf_enforces_compatible_history_fragment_SB_hlp)\n    prefer 2\n    apply(force)\n   prefer 2\n   apply(force)\n  apply(rule disjI1)\n  apply(rule conjI)\n   apply(simp add: strict_prefix_def prefix_def)\n   apply(thin_tac \"drop (length (parserHFS_conf_fixed cL))\n        (butlast_if_match (rule_rpop e1) (parser_bottom G))\n       \\<in> parser_markers G \\<and>\n       drop (length (parserHFS_conf_fixed cL))\n        (butlast_if_match (rule_rpop e2) (parser_bottom G))\n       \\<in> parser_markers G\")\n   apply(clarsimp)\n   apply(rename_tac c)(*strict*)\n   apply(simp add: parserHFS_configurations_def valid_parser_step_label_def parserHFS_step_relation_def parserHFvHFS_Lin2BraConf_def)\n   apply(clarsimp)\n   apply(rename_tac c f h k w ka wa xb xc xd xe y ya xf xg wb)(*strict*)\n   apply(rule_tac x=\"c\" in exI)\n   apply(force)\n  apply(thin_tac \"drop (length (parserHFS_conf_fixed cL))\n        (butlast_if_match (rule_rpop e1) (parser_bottom G))\n       \\<in> parser_markers G \\<and>\n       drop (length (parserHFS_conf_fixed cL))\n        (butlast_if_match (rule_rpop e2) (parser_bottom G))\n       \\<in> parser_markers G\")\n  apply(simp add: parserHFS_configurations_def valid_parser_step_label_def parserHFS_step_relation_def parserHFvHFS_Lin2BraConf_def)\n  apply(clarsimp)\n  apply(rename_tac f h k w ka wa xb xc xd xe y ya xf xg wb)(*strict*)\n  apply(thin_tac \"e1 \\<in> parser_rules G\" for e1)\n  apply(thin_tac \"e1 \\<in> parser_rules G\" for e1)\n  apply(thin_tac \"set xd \\<subseteq> parser_nonterms G\" for xd)\n  apply(thin_tac \"set xd \\<subseteq> parser_nonterms G\" for xd)\n  apply(thin_tac \"set xd \\<subseteq> parser_nonterms G\" for xd)\n  apply(thin_tac \"set xd \\<subseteq> parser_nonterms G\" for xd)\n  apply(thin_tac \"set xd \\<subseteq> parser_nonterms G\" for xd)\n  apply(thin_tac \"rule_lpop e1 \\<noteq> []\")\n  apply(thin_tac \"rule_lpop e2 \\<noteq> []\")\n  apply(thin_tac \"rule_lpush e1 \\<noteq> []\")\n  apply(thin_tac \"rule_lpush e2 \\<noteq> []\")\n  apply(thin_tac \"parserHFS_conf_stack cL1 = xb @ rule_lpush e1\")\n  apply(thin_tac \"parserHFS_conf_stack cL2 = xd @ rule_lpush e2\")\n  apply(thin_tac \"xb @ rule_lpop e1 = xd @ rule_lpop e2\")\n  apply(case_tac cL1)\n  apply(rename_tac f h k w ka wa xb xc xd xe y ya xf xg wb parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stack parserHFS_conf_schedulera)(*strict*)\n  apply(rename_tac f1 h1 l1 r1)\n  apply(rename_tac f h k w ka wa xb xc xd xe y ya xf xg wb f1 h1 l1 r1)(*strict*)\n  apply(case_tac cL2)\n  apply(rename_tac f h k w ka wa xb xc xd xe y ya xf xg wb f1 h1 l1 r1 parserHFS_conf_fixeda parserHFS_conf_historya parserHFS_conf_stack parserHFS_conf_schedulera)(*strict*)\n  apply(rename_tac f2 h2 cons_l2 r2)\n  apply(rename_tac f h k w ka wa xb xc xd xe y ya xf xg wb f1 h1 l1 r1 f2 h2 cons_l2 r2)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac f h k w ka wa xb xc xd xe y ya xf xg wb f1 h1 l1 r1 f2 h2 cons_l2 r2 rule_lpop rule_rpopa rule_lpush rule_rpusha)(*strict*)\n  apply(rename_tac lpo1 rpo1 lpu1 rpu1)\n  apply(rename_tac f h k w ka wa xb xc xd xe y ya xf xg wb f1 h1 l1 r1 f2 h2 cons_l2 r2 lpo1 rpo1 lpu1 rpu1)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac f h k w ka wa xb xc xd xe y ya xf xg wb f1 h1 l1 r1 f2 h2 cons_l2 r2 lpo1 rpo1 lpu1 rpu1 rule_lpop rule_rpopa rule_lpush rule_rpusha)(*strict*)\n  apply(rename_tac lpo2 rpo2 lpu2 rpu2)\n  apply(rename_tac f h k w ka wa xb xc xd xe y ya xf xg wb f1 h1 l1 r1 f2 h2 cons_l2 r2 lpo1 rpo1 lpu1 rpu1 lpo2 rpo2 lpu2 rpu2)(*strict*)\n  apply(clarsimp)\n  apply(simp add: strict_prefix_def prefix_def kPrefix_def)\n  apply(clarsimp)\n  apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca)(*strict*)\n  apply(case_tac \"k-length w\")\n   apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"min (length w) k=k\")\n    apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n    apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_reduces parser_bottom_take_end)\n   apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac xs=\"drop k f\" in rev_cases)\n    apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca)(*strict*)\n    apply(clarsimp)\n    apply(simp add: suffix_def)\n    apply(clarsimp)\n    apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu2 c ca cb cc)(*strict*)\n    apply(rule_tac w=\"xf @ cc\" and v=\"[]\" and r=\"take k w\" and s=\"[]\" and A=\"parser_bottom G\" in elem_in_append_set)\n      apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu2 c ca cb cc)(*strict*)\n      apply(force)\n     apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu2 c ca cb cc)(*strict*)\n     apply (metis in_set_takeD nset_diff)\n    apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu2 c ca cb cc)(*strict*)\n    apply(force)\n   apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca ys yb)(*strict*)\n   apply(clarsimp)\n   apply(simp add: suffix_def)\n   apply(clarsimp)\n   apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca ys cb)(*strict*)\n   apply(case_tac \"ka-length wa\")\n    apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca ys cb)(*strict*)\n    apply(subgoal_tac \"min (length wa) ka = ka\")\n     apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca ys cb)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca ys cb)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac xs=\"xe\" in rev_cases)\n     apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca ys cb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac f k w ka wa xc y ya xf xg wb rpu1 c ca ys cb)(*strict*)\n     apply(rule_tac w=\"xg @ ya\" and v=\"[]\" and r=\"take ka wa\" and s=\"[]\" and A=\"parser_bottom G\" in elem_in_append_set)\n       apply(rename_tac f k w ka wa xc y ya xf xg wb rpu1 c ca ys cb)(*strict*)\n       apply(force)\n      apply(rename_tac f k w ka wa xc y ya xf xg wb rpu1 c ca ys cb)(*strict*)\n      apply (metis in_set_takeD nset_diff)\n     apply(rename_tac f k w ka wa xc y ya xf xg wb rpu1 c ca ys cb)(*strict*)\n     apply(force)\n    apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca ys cb ysa yb)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac f k w ka wa xc y xf xg rpu1 rpu2 c ca ys cb ysa)(*strict*)\n    apply(rule_tac xs=\"xc\" in rev_cases)\n     apply(rename_tac f k w ka wa xc y xf xg rpu1 rpu2 c ca ys cb ysa)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac f k w ka wa y xf xg rpu2 c ca ys cb ysa)(*strict*)\n     apply(rule_tac w=\"take ka wa @ ysa\" and v=\"[]\" and r=\"take k w\" and s=\"[]\" and A=\"parser_bottom G\" in elem_in_append_set)\n       apply(rename_tac f k w ka wa y xf xg rpu2 c ca ys cb ysa)(*strict*)\n       apply(force)\n      apply(rename_tac f k w ka wa y xf xg rpu2 c ca ys cb ysa)(*strict*)\n      apply (metis in_set_takeD nset_diff)\n     apply(rename_tac f k w ka wa y xf xg rpu2 c ca ys cb ysa)(*strict*)\n     apply(force)\n    apply(rename_tac f k w ka wa xc y xf xg rpu1 rpu2 c ca ys cb ysa ysb ya)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac f k w ka wa xf xg rpu1 rpu2 c ca ys cb ysa ysb)(*strict*)\n    apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take k w) \\<longrightarrow>\n       (\\<exists>x. x @ [parser_bottom G] = rpu1)\")\n    apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take ka wa) \\<longrightarrow>\n       (\\<exists>x. x @ [parser_bottom G] = rpu2)\")\n    apply(subgoal_tac \"butlast_if_match (take ka wa) (parser_bottom G) = take ka wa\")\n     apply(rename_tac f k w ka wa xf xg rpu1 rpu2 c ca ys cb ysa ysb)(*strict*)\n     prefer 2\n     apply (metis butlast_if_match_reduces parser_bottom_take_end)\n    apply(rename_tac f k w ka wa xf xg rpu1 rpu2 c ca ys cb ysa ysb)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac xs=\"f\" in rev_cases)\n     apply(rename_tac f k w ka wa xf xg rpu1 rpu2 c ca ys cb ysa ysb)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac f k w ka wa xf xg rpu1 rpu2 c ca ys cb ysa ysb ysc y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac k w ka wa xf xg rpu1 rpu2 c ca ys cb ysa ysb ysc y)(*strict*)\n    apply(case_tac \"k - length ysc\")\n     apply(rename_tac k w ka wa xf xg rpu1 rpu2 c ca ys cb ysa ysb ysc y)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac k w ka wa xf xg rpu1 rpu2 ca cb ysa ysb ysc)(*strict*)\n     apply(rule_tac xs=\"ca\" in rev_cases)\n      apply(rename_tac k w ka wa xf xg rpu1 rpu2 ca cb ysa ysb ysc)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac k w ka wa xf xg rpu1 rpu2 ca cb ysa ysb ysc ys y)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac k w ka wa xf xg rpu1 rpu2 cb ysa ysb ysc ys)(*strict*)\n     apply(rule_tac w=\"ysc\" and v=\"ys\" and r=\"take ka wa\" and s=\"ysa\" and A=\"parser_bottom G\" in elem_in_append_set)\n       apply(rename_tac k w ka wa xf xg rpu1 rpu2 cb ysa ysb ysc ys)(*strict*)\n       apply(force)\n      apply(rename_tac k w ka wa xf xg rpu1 rpu2 cb ysa ysb ysc ys)(*strict*)\n      apply (metis in_set_takeD nset_diff)\n     apply(rename_tac k w ka wa xf xg rpu1 rpu2 cb ysa ysb ysc ys)(*strict*)\n     apply(force)\n    apply(rename_tac k w ka wa xf xg rpu1 rpu2 c ca ys cb ysa ysb ysc y nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac f k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca ys cb nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f k w ka xc xe y ya xf xg wb rpu1 c ca ys cb nat x)(*strict*)\n   apply(subgoal_tac \"ka = Suc nat+(length xg + length x)\")\n    apply(rename_tac f k w ka xc xe y ya xf xg wb rpu1 c ca ys cb nat x)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac f k w ka xc xe y ya xf xg wb rpu1 c ca ys cb nat x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f k w xc xe y ya xf xg wb rpu1 c ca ys cb x)(*strict*)\n   apply(rule_tac xs=\"xc\" in rev_cases)\n    apply(rename_tac f k w xc xe y ya xf xg wb rpu1 c ca ys cb x)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac f k w xe y ya xf xg wb c ca ys cb x)(*strict*)\n    apply(rule_tac w=\"xg @ x\" and v=\"xe\" and r=\"take k w\" and s=\"[]\" and A=\"parser_bottom G\" in elem_in_append_set)\n      apply(rename_tac f k w xe y ya xf xg wb c ca ys cb x)(*strict*)\n      apply(force)\n     apply(rename_tac f k w xe y ya xf xg wb c ca ys cb x)(*strict*)\n     apply (metis in_set_takeD nset_diff)\n    apply(rename_tac f k w xe y ya xf xg wb c ca ys cb x)(*strict*)\n    apply(force)\n   apply(rename_tac f k w xc xe y ya xf xg wb rpu1 c ca ys cb x ysa yb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f k w xe ya xf xg wb rpu1 c ca ys cb x ysa)(*strict*)\n   apply(rule_tac xs=\"xe\" in rev_cases)\n    apply(rename_tac f k w xe ya xf xg wb rpu1 c ca ys cb x ysa)(*strict*)\n    prefer 2\n    apply(rename_tac f k w xe ya xf xg wb rpu1 c ca ys cb x ysa ysb y)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac f k w xe ya xf xg wb rpu1 c ca ys cb x ysa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f k w xf xg rpu1 c ca ys cb x ysa)(*strict*)\n   apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take k w) \\<longrightarrow>\n       (\\<exists>x. x @ [parser_bottom G] = rpu1)\")\n   apply(rule_tac xs=\"f\" in rev_cases)\n    apply(rename_tac f k w xf xg rpu1 c ca ys cb x ysa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac f k w xf xg rpu1 c ca ys cb x ysa ysb y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac k w xf xg rpu1 c ca ys cb x ysa ysb y)(*strict*)\n   apply(subgoal_tac \"butlast_if_match ((xg @ x) @ [parser_bottom G])\n          (parser_bottom G) = xg@x\")\n    apply(rename_tac k w xf xg rpu1 c ca ys cb x ysa ysb y)(*strict*)\n    prefer 2\n    apply (metis append_assoc butlast_if_match_direct)\n   apply(rename_tac k w xf xg rpu1 c ca ys cb x ysa ysb y)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"k - length ysb\")\n    apply(rename_tac k w xf xg rpu1 c ca ys cb x ysa ysb y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac k w xf xg rpu1 ca cb x ysa ysb)(*strict*)\n    apply(rule_tac xs=\"ca\" in rev_cases)\n     apply(rename_tac k w xf xg rpu1 ca cb x ysa ysb)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac k w xf xg rpu1 ca cb x ysa ysb ys y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac k w xf xg rpu1 cb x ysa ysb ys)(*strict*)\n    apply(rule_tac w=\"ysb\" and v=\"ys\" and r=\"xg\" and s=\"x\" and A=\"parser_bottom G\" in elem_in_append_set)\n      apply(rename_tac k w xf xg rpu1 cb x ysa ysb ys)(*strict*)\n      apply(force)\n     apply(rename_tac k w xf xg rpu1 cb x ysa ysb ys)(*strict*)\n     apply (metis in_set_takeD nset_diff)\n    apply(rename_tac k w xf xg rpu1 cb x ysa ysb ys)(*strict*)\n    apply(force)\n   apply(rename_tac k w xf xg rpu1 c ca ys cb x ysa ysb y nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca nat)(*strict*)\n  apply(subgoal_tac \"k = Suc nat+length w\")\n   apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca nat)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac f h k w ka wa xc xe y ya xf xg wb rpu1 rpu2 c ca nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f h ka wa xc xe y ya xf xg wb rpu2 c ca nat x)(*strict*)\n  apply(case_tac \"ka - length wa\")\n   apply(rename_tac f h ka wa xc xe y ya xf xg wb rpu2 c ca nat x)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"min (length wa) ka=ka\")\n    apply(rename_tac f h ka wa xc xe y ya xf xg wb rpu2 c ca nat x)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac f h ka wa xc xe y ya xf xg wb rpu2 c ca nat x)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (take ka wa) (parser_bottom G) = take ka wa\")\n    apply(rename_tac f h ka wa xc xe y ya xf xg wb rpu2 c ca nat x)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_reduces in_set_conv_decomp in_set_takeD nset_diff)\n   apply(rename_tac f h ka wa xc xe y ya xf xg wb rpu2 c ca nat x)(*strict*)\n   apply(rule_tac xs=\"xe\" in rev_cases)\n    apply(rename_tac f h ka wa xc xe y ya xf xg wb rpu2 c ca nat x)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac f h ka wa xc y ya xf xg wb c ca nat x)(*strict*)\n    apply(rule_tac w=\"xf @ x\" and v=\"xc\" and r=\"take ka wa\" and s=\"[]\" and A=\"parser_bottom G\" in elem_in_append_set)\n      apply(rename_tac f h ka wa xc y ya xf xg wb c ca nat x)(*strict*)\n      apply(force)\n     apply(rename_tac f h ka wa xc y ya xf xg wb c ca nat x)(*strict*)\n     apply (metis in_set_takeD nset_diff)\n    apply(rename_tac f h ka wa xc y ya xf xg wb c ca nat x)(*strict*)\n    apply(force)\n   apply(rename_tac f h ka wa xc xe y ya xf xg wb rpu2 c ca nat x ys yb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h ka wa xc y xf xg rpu2 c ca nat x ys)(*strict*)\n   apply(rule_tac ?w1.0=\"f\" and ?w2.0=\"ca\" and ?v1.0=\"take ka wa\" and ?v2.0=\"ys @ [parser_bottom G]\" in prefix_alt_apply)\n     apply(rename_tac f h ka wa xc y xf xg rpu2 c ca nat x ys)(*strict*)\n     apply(force)\n    apply(rename_tac f h ka wa xc y xf xg rpu2 c ca nat x ys)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n   apply(rename_tac f h ka wa xc y xf xg rpu2 c ca nat x ys)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac f h ka wa xc y xf xg rpu2 c ca nat x ys cb)(*strict*)\n   apply(subgoal_tac \"ca = cb@ys @ [parser_bottom G]\")\n    apply(rename_tac f h ka wa xc y xf xg rpu2 c ca nat x ys cb)(*strict*)\n    prefer 2\n    apply (metis Nil_is_append_conv append_eq_append_conv_if append_eq_conv_conj)\n   apply(rename_tac f h ka wa xc y xf xg rpu2 c ca nat x ys cb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h ka wa xc y xf xg rpu2 c nat x ys cb)(*strict*)\n   apply(subgoal_tac \"butlast_if_match ((xf @ x) @ [parser_bottom G]) (parser_bottom G) = xf@x\")\n    apply(rename_tac f h ka wa xc y xf xg rpu2 c nat x ys cb)(*strict*)\n    prefer 2\n    apply (metis append_assoc butlast_if_match_direct)\n   apply(rename_tac f h ka wa xc y xf xg rpu2 c nat x ys cb)(*strict*)\n   apply(clarsimp)\n   apply(thin_tac \"butlast_if_match (xf @ x @ [parser_bottom G]) (parser_bottom G) =\n       xf @ x\")\n   apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take ka wa) \\<longrightarrow>\n       (\\<exists>x. x @ [parser_bottom G] = rpu2)\")\n   apply(rule_tac xs=\"xc\" in rev_cases)\n    apply(rename_tac f h ka wa xc y xf xg rpu2 c nat x ys cb)(*strict*)\n    prefer 2\n    apply(rename_tac f h ka wa xc y xf xg rpu2 c nat x ys cb ysa ya)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb ysa)(*strict*)\n    apply(rule_tac ?w.0=\"xf @ x\" and v=\"ysa\" and A=\"parser_bottom G\" in elem_in_append_set)\n      apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb ysa)(*strict*)\n      apply(force)\n     apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb ysa)(*strict*)\n     apply(force)\n    apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb ysa)(*strict*)\n    apply(force)\n   apply(rename_tac f h ka wa xc y xf xg rpu2 c nat x ys cb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb)(*strict*)\n   apply(rule_tac xs=\"drop\n         (Suc (min (length xf + length x)\n                (Suc (nat + (length xf + length x)))))\n         f\" in rev_cases)\n    apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb)(*strict*)\n    prefer 2\n    apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb ysa y)(*strict*)\n    apply(clarsimp)\n    apply(simp add: suffix_def)\n    apply(clarsimp)\n    apply(rename_tac f ka wa xf xg rpu2 c nat x ys cb ysa ca)(*strict*)\n    apply(rule_tac xs=\"f\" in rev_cases)\n     apply(rename_tac f ka wa xf xg rpu2 c nat x ys cb ysa ca)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac f ka wa xf xg rpu2 c nat x ys cb ysa ca ysb y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac ka wa xf xg rpu2 c nat x ys cb ysa ca ysb y)(*strict*)\n    apply(case_tac \"(Suc (min (length xf + length x)\n               (Suc (nat + (length xf + length x)))) -\n         length ysb)\")\n     apply(rename_tac ka wa xf xg rpu2 c nat x ys cb ysa ca ysb y)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac ka wa xf xg rpu2 nat x ys cb ca ysb)(*strict*)\n     apply (metis in_set_conv_decomp)\n    apply(rename_tac ka wa xf xg rpu2 c nat x ys cb ysa ca ysb y nata)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"min (length xf + length x)\n                (Suc (nat + (length xf + length x))) = (length xf + length x)\")\n    apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac ?w1.0=\"xf\" and ?w2.0=\"x\" and ?v1.0=\"f\" and ?v2.0=\"cb@ys\" in prefix_alt_apply)\n     apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb)(*strict*)\n     apply(force)\n    apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac f h ka wa xg rpu2 c nat x ys cb ca)(*strict*)\n    apply (metis append_assoc append_eq_conv_conj drop_length_append tail_empty)\n   apply(rename_tac f h ka wa xf xg rpu2 c nat x ys cb)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac h ka wa xf xg rpu2 c nat x ys cb ca)(*strict*)\n   apply(subgoal_tac \"x=ca @ cb@ys\")\n    apply(rename_tac h ka wa xf xg rpu2 c nat x ys cb ca)(*strict*)\n    prefer 2\n    apply (metis (erased, hide_lams) append_assoc append_eq_conv_conj)\n   apply(rename_tac h ka wa xf xg rpu2 c nat x ys cb ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac h ka wa xf xg rpu2 c nat ys cb ca)(*strict*)\n   apply(thin_tac \"min (length xf + (length ca + (length cb + length ys)))\n        (Suc (nat + (length xf + (length ca + (length cb + length ys))))) =\n       length xf + (length ca + (length cb + length ys))\")\n   apply(thin_tac \"(ca @ cb @ ys @ [parser_bottom G]) \\<sqsupseteq> [parser_bottom G]\")\n   apply(thin_tac \"set (take ka wa) \\<subseteq> parser_events G\")\n   apply(thin_tac \"parser_bottom G \\<notin> set (take ka wa)\")\n   apply(thin_tac \"h \\<sqsupseteq> butlast_if_match (xf @ ca) (parser_bottom G)\")\n   apply(thin_tac \"set h \\<subseteq> parser_events G\")\n   apply(subgoal_tac \"drop (length xf + length ca) (take ka wa) = cb\")\n    apply(rename_tac h ka wa xf xg rpu2 c nat ys cb ca)(*strict*)\n    prefer 2\n    apply(rule_tac t=\"take ka wa\" and s=\"xf @ ca @ cb\" in subst)\n     apply(rename_tac h ka wa xf xg rpu2 c nat ys cb ca)(*strict*)\n     apply(force)\n    apply(rename_tac h ka wa xf xg rpu2 c nat ys cb ca)(*strict*)\n    apply(simp (no_asm))\n   apply(rename_tac h ka wa xf xg rpu2 c nat ys cb ca)(*strict*)\n   apply(force)\n  apply(rename_tac f h ka wa xc xe y ya xf xg wb rpu2 c ca nat x nata)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f h ka xc xe y ya xf xg wb c ca nat x nata xa)(*strict*)\n  apply(subgoal_tac \"ka  = Suc nata+(length xg + length xa)\")\n   apply(rename_tac f h ka xc xe y ya xf xg wb c ca nat x nata xa)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac f h ka xc xe y ya xf xg wb c ca nat x nata xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f h xc xe y ya xf xg wb c ca nat x xa)(*strict*)\n  apply(subgoal_tac \"butlast_if_match ((xf @ x) @ [parser_bottom G]) (parser_bottom G) = xf @ x\")\n   apply(rename_tac f h xc xe y ya xf xg wb c ca nat x xa)(*strict*)\n   prefer 2\n   apply (metis butlast_if_match_direct)\n  apply(rename_tac f h xc xe y ya xf xg wb c ca nat x xa)(*strict*)\n  apply(subgoal_tac \"butlast_if_match ((xg @ xa) @ [parser_bottom G]) (parser_bottom G) = xg @ xa\")\n   apply(rename_tac f h xc xe y ya xf xg wb c ca nat x xa)(*strict*)\n   prefer 2\n   apply (metis butlast_if_match_direct)\n  apply(rename_tac f h xc xe y ya xf xg wb c ca nat x xa)(*strict*)\n  apply(clarsimp)\n  apply(thin_tac \"butlast_if_match (xf @ x @ [parser_bottom G]) (parser_bottom G) =\n       xf @ x\")\n  apply(thin_tac \"butlast_if_match (xg @ xa @ [parser_bottom G]) (parser_bottom G) =\n       xg @ xa\")\n  apply(rule_tac xs=\"xe\" in rev_cases)\n   apply(rename_tac f h xc xe y ya xf xg wb c ca nat x xa)(*strict*)\n   prefer 2\n   apply(rename_tac f h xc xe y ya xf xg wb c ca nat x xa ys yb)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac f h xc xe y ya xf xg wb c ca nat x xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f h xc y xf xg c ca nat x xa)(*strict*)\n  apply(rule_tac xs=\"xc\" in rev_cases)\n   apply(rename_tac f h xc y xf xg c ca nat x xa)(*strict*)\n   prefer 2\n   apply(rename_tac f h xc y xf xg c ca nat x xa ys ya)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h xf xg c ca nat x xa ys)(*strict*)\n   apply(rule_tac w=\"xf@x\" and A=\"parser_bottom G\" and v=\"ys\" and r=\"xg\" and s=\"xa\" in elem_in_append_set)\n     apply(rename_tac f h xf xg c ca nat x xa ys)(*strict*)\n     apply(force)\n    apply(rename_tac f h xf xg c ca nat x xa ys)(*strict*)\n    apply(force)\n   apply(rename_tac f h xf xg c ca nat x xa ys)(*strict*)\n   apply(force)\n  apply(rename_tac f h xc y xf xg c ca nat x xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f h xf xg c ca nat x xa)(*strict*)\n  apply(thin_tac \"h \\<sqsupseteq> butlast_if_match f (parser_bottom G)\")\n  apply(thin_tac \"set h \\<subseteq> parser_events G\")\n  apply(rule_tac xs=\"drop\n         (Suc (min (length xf + length x)\n                (Suc (nat + (length xf + length x)))))\n         f\" in rev_cases)\n   apply(rename_tac f h xf xg c ca nat x xa)(*strict*)\n   prefer 2\n   apply(rename_tac f h xf xg c ca nat x xa ys y)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"y=parser_bottom G\")\n    apply(rename_tac f h xf xg c ca nat x xa ys y)(*strict*)\n    prefer 2\n    apply(simp add: suffix_def)\n   apply(rename_tac f h xf xg c ca nat x xa ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h xf xg c ca nat x xa ys)(*strict*)\n   apply(rule_tac xs=\"f\" in rev_cases)\n    apply(rename_tac f h xf xg c ca nat x xa ys)(*strict*)\n    apply(force)\n   apply(rename_tac f h xf xg c ca nat x xa ys ysa y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac h xf xg c ca nat x xa ys ysa y)(*strict*)\n   apply(case_tac \"Suc (min (length xf + length x)\n               (Suc (nat + (length xf + length x)))) -\n         length ysa\")\n    apply(rename_tac h xf xg c ca nat x xa ys ysa y)(*strict*)\n    prefer 2\n    apply(rename_tac h xf xg c ca nat x xa ys ysa y nata)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac h xf xg c ca nat x xa ys ysa y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac h xf xg ca nat x xa ysa)(*strict*)\n   apply(rule_tac xs=\"ca\" in rev_cases)\n    apply(rename_tac h xf xg ca nat x xa ysa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac h xf xg ca nat x xa ysa ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac h xf xg nat x xa ysa ys)(*strict*)\n   apply(rule_tac w=\"ysa\" and A=\"parser_bottom G\" and v=\"ys\" and r=\"xg\" and s=\"xa\" in elem_in_append_set)\n     apply(rename_tac h xf xg nat x xa ysa ys)(*strict*)\n     apply(force)\n    apply(rename_tac h xf xg nat x xa ysa ys)(*strict*)\n    apply(force)\n   apply(rename_tac h xf xg nat x xa ysa ys)(*strict*)\n   apply(force)\n  apply(rename_tac f h xf xg c ca nat x xa)(*strict*)\n  apply(clarsimp)\n  apply(thin_tac \"(x @ [parser_bottom G]) \\<sqsupseteq> [parser_bottom G]\")\n  apply(thin_tac \"parser_bottom G \\<notin> set h\")\n  apply(subgoal_tac \"min (length xf + length x)\n                (Suc (nat + (length xf + length x))) = length xf + length x\")\n   apply(rename_tac f h xf xg c ca nat x xa)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac f h xf xg c ca nat x xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f xf xg c ca nat x xa)(*strict*)\n  apply(thin_tac \"min (length xf + length x)\n                (Suc (nat + (length xf + length x))) = length xf + length x\")\n  apply(thin_tac \"length f \\<le> Suc (length xf + length x)\")\n  apply(rule_tac ?w1.0=\"f\" and ?w2.0=\"ca\" and ?v1.0=\"xg\" and ?v2.0=\"xa @ [parser_bottom G]\" in prefix_alt_apply)\n    apply(rename_tac f xf xg c ca nat x xa)(*strict*)\n    apply(force)\n   apply(rename_tac f xf xg c ca nat x xa)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(rename_tac f xf xg c ca x xa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac xf xg c ca x xa cb)(*strict*)\n   apply(rule_tac ?w1.0=\"cb\" and ?w2.0=\"ca\" and ?v1.0=\"xa\" and ?v2.0=\"[parser_bottom G]\" in prefix_alt_apply)\n     apply(rename_tac xf xg c ca x xa cb)(*strict*)\n     apply(force)\n    apply(rename_tac xf xg c ca x xa cb)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n   apply(rename_tac xf xg c ca x xa cb)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac xf xg c x cb)(*strict*)\n   apply(rule_tac ?w1.0=\"xf\" and ?w2.0=\"x\" and ?v1.0=\"xg\" and ?v2.0=\"cb @\n       drop (length xg + length cb) xf @\n       drop (length xg + length cb - length xf) x @ c\" in prefix_alt_apply)\n     apply(rename_tac xf xg c x cb)(*strict*)\n     apply(force)\n    apply(rename_tac xf xg c x cb)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac xg c x cb ca)(*strict*)\n    apply(rule_tac ?w1.0=\"ca\" and ?w2.0=\"x\" and ?v1.0=\"cb\" and ?v2.0=\"drop (length cb) ca @ drop (length cb - length ca) x @ c\" in prefix_alt_apply)\n      apply(rename_tac xg c x cb ca)(*strict*)\n      apply(force)\n     apply(rename_tac xg c x cb ca)(*strict*)\n     prefer 2\n     apply(simp add: prefix_def)\n     apply(clarsimp)\n    apply(rename_tac xg c x cb ca)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac xg c x ca cc)(*strict*)\n    apply(rule parserHF_vs_parserHFS_inst_AX_Lin2BraConf_enforces_compatible_history_fragment_SB_hlp2)\n     apply(rename_tac xg c x ca cc)(*strict*)\n     apply(force)\n    apply(rename_tac xg c x ca cc)(*strict*)\n    apply(force)\n   apply(rename_tac xf xg c x cb)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac xf c x cb ca)(*strict*)\n   apply(rule_tac x=\"x\" and cc=\"ca @ cb\" and c=\"c\" in parserHF_vs_parserHFS_inst_AX_Lin2BraConf_enforces_compatible_history_fragment_SB_hlp2)\n    apply(rename_tac xf c x cb ca)(*strict*)\n    apply(force)\n   apply(rename_tac xf c x cb ca)(*strict*)\n   apply(force)\n  apply(rename_tac f xf xg c ca nat x xa)(*strict*)\n  apply(simp add: prefix_def)\n  apply(rename_tac f xf xg c ca x xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f xf c x xa cb)(*strict*)\n  apply(rule_tac ?w1.0=\"xf\" and ?w2.0=\"x\" and ?v1.0=\"f\" and ?v2.0=\"cb @ xa\" in prefix_alt_apply)\n    apply(rename_tac f xf c x xa cb)(*strict*)\n    apply(force)\n   apply(rename_tac f xf c x xa cb)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac f c x xa cb ca)(*strict*)\n   apply(rule_tac ?w1.0=\"ca\" and ?w2.0=\"x\" and ?v1.0=\"cb\" and ?v2.0=\"xa\" in prefix_alt_apply)\n     apply(rename_tac f c x xa cb ca)(*strict*)\n     apply(force)\n    apply(rename_tac f c x xa cb ca)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n   apply(rename_tac f c x xa cb ca)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n  apply(rename_tac f xf c x xa cb)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  done\n\nlemma compatible_history_fragment_SB_sym: \"\n       parserHF.compatible_history_fragment_SB G (parserHFvHFS_Lin2BraConf cL)\n        (parserHFvHFS_Lin2BraConf cL1) (parserHFvHFS_Lin2BraConf cL2) =\n       parserHF.compatible_history_fragment_SB G (parserHFvHFS_Lin2BraConf cL)\n        (parserHFvHFS_Lin2BraConf cL2) (parserHFvHFS_Lin2BraConf cL1)\"\n  apply(simp add: parserHF.compatible_history_fragment_SB_def)\n  apply(simp add: Let_def)\n  apply(rule antisym)\n   apply(clarsimp)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Lin2BraConf_enforces_compatible_history_fragment_SB: \"\n (\\<forall>G. valid_parser G \\<longrightarrow>\n         (\\<forall>cL. cL \\<in> ATS.get_accessible_configurations\n                      parserHFS_initial_configurations\n                      parserHFS_step_relation G \\<longrightarrow>\n               (\\<forall>e1 cL1.\n                   parserHFS_step_relation G cL e1 cL1 \\<longrightarrow>\n                   (\\<forall>e2 cL2.\n                       parserHFS_step_relation G cL e2 cL2 \\<longrightarrow>\n                       ATS_determHIST_SB.compatible_history_fragment_SB\n                        parser_markers (@) (@) parserHF_conf_history\n                        parser_fixed_scheduler_extendable\n                        parserHF_conf_fixed G (parserHFvHFS_Lin2BraConf cL)\n                        (parserHFvHFS_Lin2BraConf cL1)\n                        (parserHFvHFS_Lin2BraConf cL2)))))\"\n  apply(clarsimp)\n  apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   prefer 2\n   apply(simp add: parserHFS_step_relation_def valid_parser_def)\n  apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e2\")\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   prefer 2\n   apply(simp add: parserHFS_step_relation_def valid_parser_def)\n  apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n  apply(subgoal_tac \"cL \\<in> parserHFS_configurations G\")\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   prefer 2\n   apply (metis parserHFS.get_accessible_configurations_are_configurations2)\n  apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n  apply(thin_tac \"cL \\<in> ATS.get_accessible_configurations\n              parserHFS_initial_configurations parserHFS_step_relation G\")\n  apply(subgoal_tac \"parserHFS_conf_history cL1 = parserHFS_conf_history cL2 \\<or> (strict_prefix (parserHFS_conf_history cL1) (parserHFS_conf_history cL2)) \\<or> (strict_prefix (parserHFS_conf_history cL2) (parserHFS_conf_history cL1))\")\n   prefer 2\n   apply(rule_tac x=\"parserHFS_conf_history cL @ drop (length (parserHFS_conf_fixed cL)) (parserHFS_conf_scheduler cL)\" in three_cases_strict_prefix)\n    apply(rule parserHFS_post_history_prefix_of_pre_history_and_remaining_rhs)\n       apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n       apply(force)\n      apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n      apply(force)\n     apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n     apply(force)\n    apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n    apply(force)\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   apply(rule parserHFS_post_history_prefix_of_pre_history_and_remaining_rhs)\n      apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n      apply(force)\n     apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n     apply(force)\n    apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n    apply(force)\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   apply(force)\n  apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n  apply(subgoal_tac \"\n       drop (length (parserHFS_conf_fixed cL))\n        (butlast_if_match (rule_rpop e1) (parser_bottom G))\n       \\<in> parser_markers G \\<and>\n       drop (length (parserHFS_conf_fixed cL))\n        (butlast_if_match (rule_rpop e2) (parser_bottom G))\n       \\<in> parser_markers G\")\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   prefer 2\n   apply(simp add: parserHFS_step_relation_def parserHFvHFS_Lin2BraConf_def Let_def)\n   apply(clarsimp)\n   apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n    apply(simp add: parser_markers_def)\n    apply(rule_tac B=\"set (\n             (butlast_if_match (rule_rpop e1) (parser_bottom G)))\" in subset_trans)\n     apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n     apply(rule set_drop_subset)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n    apply(rule_tac B=\"set (\n             ((rule_rpop e1) ))\" in subset_trans)\n     apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n     apply(rule set_butlast_if_match_subset)\n     apply(force)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n    apply(simp add: valid_parser_def)\n    apply(clarsimp)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd)(*strict*)\n    apply(erule_tac x=\"e1\" in ballE)\n     apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd)(*strict*)\n    apply(simp add: valid_parser_step_label_def kPrefix_def)\n    apply(clarsimp)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n    apply(simp add: kPrefix_def)\n    apply(erule_tac P=\"xd \\<in> set (take k w)\" in disjE)\n     apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n     apply(rule_tac A=\"set w\" in set_mp)\n      apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n      apply(blast)\n     apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n     apply(rule_tac A=\"set (take k w)\" in set_mp)\n      apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n      apply(rule set_take_subset2)\n      apply(force)\n     apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n     apply(force)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n    apply(case_tac \"k-length w\")\n     apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n   apply(simp add: parser_markers_def)\n   apply(rule_tac B=\"set (\n             (butlast_if_match (rule_rpop e2) (parser_bottom G)))\" in subset_trans)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n    apply(rule set_drop_subset)\n   apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n   apply(rule_tac B=\"set (\n             ((rule_rpop e2) ))\" in subset_trans)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n    apply(rule set_butlast_if_match_subset)\n    apply(force)\n   apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya)(*strict*)\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd)(*strict*)\n   apply(erule_tac x=\"e2\" in ballE)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd)(*strict*)\n   apply(simp add: valid_parser_step_label_def kPrefix_def)\n   apply(clarsimp)\n   apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n   apply(simp add: kPrefix_def)\n   apply(erule_tac P=\"xd \\<in> set (take k w)\" in disjE)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n    apply(rule_tac A=\"set w\" in set_mp)\n     apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n     apply(blast)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n    apply(rule_tac A=\"set (take k w)\" in set_mp)\n     apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n     apply(rule set_take_subset2)\n     apply(force)\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n    apply(force)\n   apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G cL e1 cL1 e2 cL2 x xa xb xc y ya xd k w xf nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n  apply(erule_tac P=\"parserHFS_conf_history cL1 = parserHFS_conf_history cL2\" in disjE)\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   apply(simp add: parserHF.compatible_history_fragment_SB_def)\n   apply(simp add: parserHFS_step_relation_def parserHFvHFS_Lin2BraConf_def Let_def)\n   apply(clarsimp)\n  apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n  apply(erule_tac P=\"parserHFS_conf_history cL1 \\<sqsubset> parserHFS_conf_history cL2\" in disjE)\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   apply(rule parserHF_vs_parserHFS_inst_AX_Lin2BraConf_enforces_compatible_history_fragment_SB_hlp3)\n          apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n          apply(force)\n         apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n         apply(force)\n        apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n        apply(force)\n       apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n       apply(force)\n      apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n      apply(force)\n     apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n     apply(force)\n    apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n    apply(force)\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   apply(force)\n  apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n  apply(rule_tac t=\"ATS_determHIST_SB.compatible_history_fragment_SB parser_markers (@)\n        (@) parserHF_conf_history parser_fixed_scheduler_extendable\n        parserHF_conf_fixed G (parserHFvHFS_Lin2BraConf cL)\n        (parserHFvHFS_Lin2BraConf cL1) (parserHFvHFS_Lin2BraConf cL2)\" and s=\"ATS_determHIST_SB.compatible_history_fragment_SB parser_markers (@)\n        (@) parserHF_conf_history parser_fixed_scheduler_extendable\n        parserHF_conf_fixed G (parserHFvHFS_Lin2BraConf cL)\n        (parserHFvHFS_Lin2BraConf cL2) (parserHFvHFS_Lin2BraConf cL1)\" in ssubst)\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   prefer 2\n   apply(rule_tac ?cL2.0=\"cL1\" in parserHF_vs_parserHFS_inst_AX_Lin2BraConf_enforces_compatible_history_fragment_SB_hlp3)\n          apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n          apply(force)\n         apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n         apply(force)\n        apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n        apply(force)\n       apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n       apply(force)\n      apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n      apply(force)\n     apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n     apply(force)\n    apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n    apply(force)\n   apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n   apply(force)\n  apply(rename_tac G cL e1 cL1 e2 cL2)(*strict*)\n  apply(rule compatible_history_fragment_SB_sym)\n  done\n\ncorollary example_translation_0: \"\n  valid_parser G\n  \\<Longrightarrow> \\<lparr>parserHF_conf_fixed=f, parserHF_conf_history=h, parserHF_conf_stack = l\\<rparr> \\<in> parserHF_configurations G\n  \\<Longrightarrow> \\<exists>r. \\<lparr>parserHFS_conf_fixed=f, parserHFS_conf_history=h, parserHFS_conf_stack = l, parserHFS_conf_scheduler=r\\<rparr> \\<in> parserHFS_configurations G\"\n  apply(simp add: parserHF_configurations_def parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(case_tac \"parser_bottom G \\<in> set f\")\n   apply(clarsimp)\n   apply(rename_tac w)(*strict*)\n   apply(rule_tac\n      x=\"(w @ [parser_bottom G])\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"(f @ [parser_bottom G])\"\n      in exI)\n  apply(clarsimp)\n  apply(simp add: prefix_def)\n  apply(simp add: valid_parser_def)\n  done\n\ncorollary example_translation_1: \"\n  valid_parser G\n  \\<Longrightarrow> \\<lparr>parserHFS_conf_fixed=f, parserHFS_conf_history=h, parserHFS_conf_stack = l, parserHFS_conf_scheduler=r\\<rparr> \\<in> parserHFS_configurations G\n  \\<Longrightarrow> \\<lparr>parserHF_conf_fixed=f, parserHF_conf_history=h, parserHF_conf_stack = l\\<rparr> \\<in> parserHF_configurations G\"\n  apply(simp add: parserHF_configurations_def parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac w)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac w c)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac w c)(*strict*)\n   apply(rule_tac\n      B=\"set(f@c)\"\n      in subset_trans)\n    apply(rename_tac w c)(*strict*)\n    apply(rule set_append1)\n   apply(rename_tac w c)(*strict*)\n   apply(force)\n  apply(rename_tac w c)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"c\")\n   apply(rename_tac w c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac w c a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n   apply(rename_tac w c a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac w c a list)(*strict*)\n  apply(thin_tac \"c = a # list\")\n  apply(clarsimp)\n  done\n\ncorollary example_translation_2: \"\n  \\<lparr>rule_lpop = [p], rule_rpop = [a, b], rule_lpush = [q], rule_rpush = [b]\\<rparr> \\<in> parser_rules G\n  \\<Longrightarrow> b \\<noteq> parser_bottom G\n  \\<Longrightarrow> a \\<noteq> parser_bottom G\n  \\<Longrightarrow> parserHF_step_relation G \\<lparr>parserHF_conf_fixed=[a], parserHF_conf_history=[a], parserHF_conf_stack = [p]\\<rparr> \\<lparr>rule_lpop=[p], rule_rpop=[a, b], rule_lpush=[q], rule_rpush=[b]\\<rparr> \\<lparr>parserHF_conf_fixed=[b], parserHF_conf_history=[a, b], parserHF_conf_stack = [q]\\<rparr> \"\n  apply(simp only: parserHF_step_relation_def)\n  apply(rule conjI)\n   apply(force)\n  apply(rule conjI)\n   apply(force)\n  apply(rule conjI)\n   defer\n   apply(rule conjI)\n    apply(force)\n   apply(clarsimp)\n   apply(simp add: prefix_closure_def prefix_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"butlast_if_match [a, b] (parser_bottom G) = [a, b]\")\n   apply(clarsimp)\n  apply(rule butlast_if_match_direct2_prime)\n  apply(clarsimp)\n  done\n\nlemma parserHF_rpop_prefix_closureeeds_fixed_append_history_mod: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w\n  \\<Longrightarrow> prefix (butlast_if_match (rule_rpop e1) (parser_bottom G))\n  (butlast_if_match (parserHF_conf_fixed c) (parser_bottom G) @ w @ v)\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x ca)(*strict*)\n   apply(case_tac \"suffix (parserHF_conf_fixed c) [parser_bottom G]\")\n    apply(rename_tac x ca)(*strict*)\n    apply(simp add: suffix_def)\n    apply(clarsimp)\n    apply(rename_tac x ca caa)(*strict*)\n    apply(subgoal_tac \"butlast_if_match (caa @ [parser_bottom G]) (parser_bottom G) = caa\")\n     apply(rename_tac x ca caa)(*strict*)\n     prefer 2\n     apply (metis butlast_if_match_direct)\n    apply(rename_tac x ca caa)(*strict*)\n    apply(clarsimp)\n    apply(thin_tac \"butlast_if_match (caa @ [parser_bottom G]) (parser_bottom G) = caa\")\n    apply(case_tac ca)\n     apply(rename_tac x ca caa)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x ca)(*strict*)\n     apply(subgoal_tac \"butlast_if_match (ca @ [parser_bottom G]) (parser_bottom G)=ca\")\n      apply(rename_tac x ca)(*strict*)\n      prefer 2\n      apply (metis butlast_if_match_direct)\n     apply(rename_tac x ca)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x ca caa a list)(*strict*)\n    apply(subgoal_tac \"\\<exists>w' x'. ca = w' @ [x']\")\n     apply(rename_tac x ca caa a list)(*strict*)\n     prefer 2\n     apply(rule NonEmptyListHasTailElem)\n     apply(force)\n    apply(rename_tac x ca caa a list)(*strict*)\n    apply(thin_tac \"ca = a # list\")\n    apply(clarsimp)\n    apply(rename_tac x w')(*strict*)\n    apply(subgoal_tac \"butlast_if_match (rule_rpop e1) (parser_bottom G)=rule_rpop e1\")\n     apply(rename_tac x w')(*strict*)\n     apply(force)\n    apply(rename_tac x w')(*strict*)\n    apply(simp add: parserHF_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac x w' h)(*strict*)\n    apply(subgoal_tac \"butlast_if_match (rule_rpop e1 @ w' @ [parser_bottom G]) (parser_bottom G) = rule_rpop e1 @ w'\")\n     apply(rename_tac x w' h)(*strict*)\n     prefer 2\n     apply (metis butlast_if_match_direct butlast_if_match_pull_out_prime)\n    apply(rename_tac x w' h)(*strict*)\n    apply(clarsimp)\n    apply(simp add: suffix_def)\n    apply(clarsimp)\n    apply(rename_tac x w' c)(*strict*)\n    apply (metis butlast_if_match_direct2_prime)\n   apply(rename_tac x ca)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (parserHF_conf_fixed c) (parser_bottom G) = parserHF_conf_fixed c\")\n    apply(rename_tac x ca)(*strict*)\n    apply(subgoal_tac \"butlast_if_match (rule_rpop e1) (parser_bottom G) = rule_rpop e1\")\n     apply(rename_tac x ca)(*strict*)\n     apply(clarsimp)\n     apply(rule_tac\n      x=\"ca@drop (length (parserHF_conf_fixed c)) (rule_rpop e1) @ v\"\n      in exI)\n     apply(force)\n    apply(rename_tac x ca)(*strict*)\n    apply(simp add: parserHF_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac x c h)(*strict*)\n    apply(simp add: suffix_def)\n    apply(clarsimp)\n    apply(rename_tac x c ca)(*strict*)\n    apply (metis butlast_if_match_direct2_prime)\n   apply(rename_tac x ca)(*strict*)\n   apply (metis butlast_if_match_reduces suffix_def)\n  apply(rename_tac x)(*strict*)\n  apply(case_tac \"suffix (rule_rpop e1) [parser_bottom G]\")\n   apply(rename_tac x)(*strict*)\n   apply(simp add: suffix_def prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x ca caa)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (caa @ [parser_bottom G]) (parser_bottom G) = caa\")\n    apply(rename_tac x ca caa)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_direct)\n   apply(rename_tac x ca caa)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"ca\")\n    apply(rename_tac x ca caa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x ca caa a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. ca = w' @ [x']\")\n    apply(rename_tac x ca caa a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac x ca caa a list)(*strict*)\n   apply(thin_tac \"ca = a # list\")\n   apply(clarsimp)\n   apply(rename_tac x w')(*strict*)\n   apply(subgoal_tac \"butlast_if_match (parserHF_conf_fixed c) (parser_bottom G)=parserHF_conf_fixed c\")\n    apply(rename_tac x w')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x w')(*strict*)\n   apply(simp add: parserHF_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac x w' f h)(*strict*)\n   apply(simp add: suffix_def)\n   apply(clarsimp)\n   apply(rename_tac x w' f c)(*strict*)\n   apply(subgoal_tac \"valid_parser_step_label G e1\")\n    apply(rename_tac x w' f c)(*strict*)\n    apply(simp add: valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac x w' f c k w xb xc)(*strict*)\n    apply(case_tac \"parser_bottom G \\<in> set f\")\n     apply(rename_tac x w' f c k w xb xc)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x w' c k w xb xc wa)(*strict*)\n     apply (metis append_Cons butlast_only_tail_contra butlast_snoc butlast_snoc_2 head_in_set in_set_butlast_appendI triv_compl)\n    apply(rename_tac x w' f c k w xb xc)(*strict*)\n    apply(clarsimp)\n    apply (metis butlast_if_match_direct2_prime)\n   apply(rename_tac x w' f c)(*strict*)\n   apply(simp add: valid_parser_def)\n  apply(rename_tac x)(*strict*)\n  apply(subgoal_tac \"butlast_if_match (rule_rpop e1) (parser_bottom G) = rule_rpop e1\")\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply (metis butlast_if_match_reduces suffix_def)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac x ca)(*strict*)\n  apply(subgoal_tac \"butlast_if_match (parserHF_conf_fixed c) (parser_bottom G) = parserHF_conf_fixed c\")\n   apply(rename_tac x ca)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\" drop (length (parserHF_conf_fixed c)) (rule_rpop e1)\"\n      and s=\"ca\"\n      in ssubst)\n    apply(rename_tac x ca)(*strict*)\n    apply (metis dropPrecise)\n   apply(rename_tac x ca)(*strict*)\n   apply(rule_tac\n      t=\"rule_rpop e1\"\n      and s=\"parserHF_conf_fixed c @ ca\"\n      in ssubst)\n    apply(rename_tac x ca)(*strict*)\n    apply(force)\n   apply(rename_tac x ca)(*strict*)\n   apply(rule_tac\n      x=\"v\"\n      in exI)\n   apply(force)\n  apply(rename_tac x ca)(*strict*)\n  apply(rule butlast_if_match_direct2_prime)\n  apply(rule_tac\n      B=\"set (rule_rpop e1)\"\n      in nset_mp)\n   apply(rename_tac x ca)(*strict*)\n   apply (metis set_app_subset)\n  apply(rename_tac x ca)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   apply(rename_tac x ca)(*strict*)\n   apply(simp add: valid_parser_step_label_def)\n   apply(clarsimp)\n   apply(rename_tac x ca k w xb)(*strict*)\n   apply(simp add: kPrefix_def)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac x ca k w xb)(*strict*)\n    apply(clarsimp)\n    apply (metis in_set_takeD not_in_diff)\n   apply(rename_tac x ca k w xb nat)(*strict*)\n   apply(force)\n  apply(rename_tac x ca)(*strict*)\n  apply(simp add: valid_parser_def)\n  done\n\nlemma parserHF_history_extensions_longer_implies_rpop_longer: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w @ v\n  \\<Longrightarrow> w@v\\<noteq>[]\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c @ w\n  \\<Longrightarrow> length (butlast_if_match (rule_rpop e2) (parser_bottom G)) \\<le> length (butlast_if_match (rule_rpop e1) (parser_bottom G))\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(simp add: parserHF_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac x xa f h)(*strict*)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac x xa f c)(*strict*)\n  apply(case_tac \"length (butlast_if_match (rule_rpop e1) (parser_bottom G)) \\<ge> length f\")\n   apply(rename_tac x xa f c)(*strict*)\n   apply(rule drop_length_leq)\n    apply(rename_tac x xa f c)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x xa f c)(*strict*)\n   apply(force)\n  apply(rename_tac x xa f c)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHFS_minimal_step_prefix_closureondition: \"\n  valid_parser G\n  \\<Longrightarrow> e \\<in> parser_rules G\n  \\<Longrightarrow> c \\<in> parserHFS_configurations G\n  \\<Longrightarrow> suffix (parserHFS_conf_stack c) (rule_lpop e)\n  \\<Longrightarrow> prefix (rule_rpop e) (parserHFS_conf_scheduler c)\n  \\<Longrightarrow> \\<exists>c'. parserHFS_step_relation G c e c'\"\n  apply(simp add: parserHFS_step_relation_def)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac ca caa)(*strict*)\n  apply(rule_tac\n      x=\"\\<lparr>parserHFS_conf_fixed=rule_rpush e @ drop (length (rule_rpop e)) (parserHFS_conf_fixed c), parserHFS_conf_history=parserHFS_conf_history c @ drop (length (parserHFS_conf_fixed c)) (butlast_if_match (rule_rpop e) (parser_bottom G)), parserHFS_conf_stack =SSl, parserHFS_conf_scheduler=SSr\\<rparr>\" for SSr SSl\n      in exI)\n  apply(rename_tac ca caa)(*strict*)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac ca caa)(*strict*)\n   apply(force)\n  apply(rename_tac ca caa)(*strict*)\n  apply(rule_tac\n      x=\"caa\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac ca caa)(*strict*)\n   apply(force)\n  apply(rename_tac ca caa)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac ca caa)(*strict*)\n   apply(force)\n  apply(rename_tac ca caa)(*strict*)\n  apply(simp add: parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac c ca f h w)(*strict*)\n  apply(simp add: suffix_def)\n  apply(clarsimp)\n  apply(rename_tac c ca f w cb)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e\")\n   apply(rename_tac c ca f w cb)(*strict*)\n   apply(simp add: valid_parser_step_label_def)\n   apply(clarsimp)\n   apply(rename_tac c ca f w cb k wa xa)(*strict*)\n   apply (metis last_append append_Nil2 butlast_pull_out2 last_snoc)\n  apply(rename_tac c ca f w cb)(*strict*)\n  apply(simp add: valid_parser_def)\n  done\n\nlemma step_which_turns_fixed_unextendable_exceeds_fixed: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> prefix (parserHF_conf_fixed c) (rule_rpop e1)\"\n  apply(simp add: parserHF_step_relation_def parserHF_configurations_def prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac c x ca cb cc)(*strict*)\n  apply(case_tac cc)\n   apply(rename_tac c x ca cb cc)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c x ca cb cc a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. cc = w' @ [x']\")\n   apply(rename_tac c x ca cb cc a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac c x ca cb cc a list)(*strict*)\n  apply(thin_tac \"cc = a # list\")\n  apply(clarsimp)\n  done\n\nlemma step_which_modifies_history_exceeds_fixed: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> w2 \\<noteq> []\n  \\<Longrightarrow> prefix (parserHF_conf_fixed c) (rule_rpop e1)\"\n  apply(simp add: parserHF_step_relation_def parserHF_configurations_def prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac x c ca cb)(*strict*)\n  apply(case_tac cb)\n   apply(rename_tac x c ca cb)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x c ca cb a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. cb = w' @ [x']\")\n   apply(rename_tac x c ca cb a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac x c ca cb a list)(*strict*)\n  apply(thin_tac \"cb = a # list\")\n  apply(clarsimp)\n  apply(rename_tac x c ca w' x')(*strict*)\n  apply (metis append_length_inc butlast_if_match_direct2_prime le_Suc_eq length_append)\n  done\n\nlemma step_which_almost_modifies_history_exceeds_fixed: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> rule_rpop e1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> length (parserHF_conf_fixed c) \\<le> length (butlast_if_match (rule_rpop e1) (parser_bottom G))\"\n  apply(simp add: parserHF_step_relation_def parserHF_configurations_def prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac f c x ca cb)(*strict*)\n  apply(subgoal_tac \"butlast_if_match (c @ [parser_bottom G]) (parser_bottom G)=c\")\n   apply(rename_tac f c x ca cb)(*strict*)\n   apply(clarsimp)\n   apply(erule disjE)\n    apply(rename_tac f c x ca cb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac f c x ca cb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f c x ca cb cc)(*strict*)\n   apply (metis List.butlast_append butlast_if_match_direct2_prime butlast_snoc drop_length_append self_append_conv)\n  apply(rename_tac f c x ca cb)(*strict*)\n  apply (metis butlast_if_match_direct insert_Nil)\n  done\n\nlemma step_which_turns_fixed_unextendable_has_bottom_as_suffix: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> suffix (rule_rpop e1) [parser_bottom G]\"\n  apply(subgoal_tac \"prefix (parserHF_conf_fixed c) (rule_rpop e1)\")\n   prefer 2\n   apply(rule step_which_turns_fixed_unextendable_exceeds_fixed)\n         apply(force)\n        apply(force)\n       prefer 2\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(simp add: parserHF_step_relation_def parserHF_configurations_def prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac f c ca x cb cc)(*strict*)\n  apply(subgoal_tac \"\\<exists>x. rule_rpop e1 = x @ (rule_rpush e1)\")\n   apply(rename_tac f c ca x cb cc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f c ca x cb cc xa)(*strict*)\n   apply(subgoal_tac \"drop (length xa + length (rule_rpush e1)) f=[]\")\n    apply(rename_tac f c ca x cb cc xa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac f c ca x cb cc xa)(*strict*)\n   apply (metis drop_all drop_length_append length_append)\n  apply(rename_tac f c ca x cb cc)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   apply(rename_tac f c ca x cb cc)(*strict*)\n   apply(simp add: valid_parser_step_label_def)\n   apply(clarsimp)\n   apply(rename_tac f c ca x cb cc k w xb)(*strict*)\n   apply(rule_tac\n      x=\"xb\"\n      in exI)\n   apply(force)\n  apply(rename_tac f c ca x cb cc)(*strict*)\n  apply(simp add: valid_parser_def)\n  done\n\nlemma step_which_not_turns_fixed_unextendable_has_not_bottom_as_suffix: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> suffix (rule_rpop e1) [parser_bottom G]\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac x ca)(*strict*)\n  apply(simp add: parserHF_configurations_def)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac x c f ca cb)(*strict*)\n  apply(subgoal_tac \"butlast_if_match f (parser_bottom G) = f\")\n   apply(rename_tac x c f ca cb)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"butlast_if_match (rule_rpush e1 @ drop (Suc (length c)) f) (parser_bottom G)= rule_rpush e1 @ drop (Suc (length c)) f\")\n    apply(rename_tac x c f ca cb)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"butlast_if_match (c @ [parser_bottom G]) (parser_bottom G)=c\")\n     apply(rename_tac x c f ca cb)(*strict*)\n     apply(clarsimp)\n     apply(erule disjE)\n      apply(rename_tac x c f ca cb)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac x c f ca cb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x c f ca cb cc)(*strict*)\n     apply(case_tac cc)\n      apply(rename_tac x c f ca cb cc)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac x c f ca cb cc a list)(*strict*)\n     apply(subgoal_tac \"\\<exists>w' x'. cc = w' @ [x']\")\n      apply(rename_tac x c f ca cb cc a list)(*strict*)\n      prefer 2\n      apply(rule NonEmptyListHasTailElem)\n      apply(force)\n     apply(rename_tac x c f ca cb cc a list)(*strict*)\n     apply(thin_tac \"cc = a # list\")\n     apply(clarsimp)\n     apply(rename_tac x f ca cb w')(*strict*)\n     apply(subgoal_tac \"valid_parser_step_label G e1\")\n      apply(rename_tac x f ca cb w')(*strict*)\n      apply(simp add: valid_parser_step_label_def)\n      apply(clarsimp)\n      apply(rename_tac x f ca cb w' k w xb xc)(*strict*)\n      apply(erule_tac\n      x=\"xc\"\n      and P=\"\\<lambda>xc. rule_rpush e1 \\<noteq> xc @ [parser_bottom G]\"\n      in allE)\n      apply(force)\n     apply(rename_tac x f ca cb w')(*strict*)\n     apply(simp add: valid_parser_def)\n    apply(rename_tac x c f ca cb)(*strict*)\n    apply (metis butlast_if_match_direct insert_Nil)\n   apply(rename_tac x c f ca cb)(*strict*)\n   apply (metis butlast_if_match_direct2_prime butlast_if_match_pull_out_prime)\n  apply(rename_tac x c f ca cb)(*strict*)\n  apply (metis butlast_if_match_direct2_prime)\n  done\n\nlemma parserHF_prefix_closureise_history_modification: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_fixed c \\<sqsubseteq> rule_rpop e1\n  \\<Longrightarrow> rule_rpop e1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> w2 = butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e1)) (parser_bottom G)\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(simp add: suffix_def)\n  apply(clarsimp)\n  apply(rename_tac x ca)(*strict*)\n  apply(subgoal_tac \"butlast_if_match (ca @ [parser_bottom G]) (parser_bottom G)=ca\")\n   apply(rename_tac x ca)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"length (parserHF_conf_fixed c) - length ca\")\n    apply(rename_tac x ca)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"butlast_if_match (drop (length (parserHF_conf_fixed c)) ca @ [parser_bottom G]) (parser_bottom G) = drop (length (parserHF_conf_fixed c)) ca\")\n     apply(rename_tac x ca)(*strict*)\n     prefer 2\n     apply (metis butlast_if_match_direct rotate_simps)\n    apply(rename_tac x ca)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x ca nat)(*strict*)\n   apply(clarsimp)\n   apply(simp add: butlast_if_match_def)\n  apply(rename_tac x ca)(*strict*)\n  apply (metis butlast_if_match_direct)\n  done\n\nlemma parserHF_prefix_closureise_history_modification_prime: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_fixed c \\<sqsubseteq> rule_rpop e1\n  \\<Longrightarrow> \\<not> rule_rpop e1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> w2 = butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e1)) (parser_bottom G)\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(simp add: suffix_def)\n  apply(subgoal_tac \"butlast_if_match (rule_rpop e1) (parser_bottom G)=rule_rpop e1\")\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply (metis butlast_if_match_reduces rotate_simps)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply (metis butlast_if_match_reduces concat_asso drop_prefix_closureise prefix_def)\n  done\n\nlemma parserHF_equal_history_extension_and_turning_nonextendable_implies_eq_rpop: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> c2 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> rule_rpop e1 = rule_rpop e2\"\n  apply(subgoal_tac \"prefix (parserHF_conf_fixed c) (rule_rpop e1)\")\n   prefer 2\n   apply(rule step_which_turns_fixed_unextendable_exceeds_fixed)\n         apply(force)\n        apply(force)\n       prefer 2\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"prefix (parserHF_conf_fixed c) (rule_rpop e2)\")\n   prefer 2\n   apply(rule step_which_turns_fixed_unextendable_exceeds_fixed)\n         apply(force)\n        apply(force)\n       prefer 2\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"suffix (rule_rpop e1) [parser_bottom G]\")\n   prefer 2\n   apply(rule step_which_turns_fixed_unextendable_has_bottom_as_suffix)\n         apply(force)\n        apply(force)\n       prefer 2\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"suffix (rule_rpop e2) [parser_bottom G]\")\n   prefer 2\n   apply(rule step_which_turns_fixed_unextendable_has_bottom_as_suffix)\n         apply(force)\n        apply(force)\n       prefer 2\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"w2 = butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e1)) (parser_bottom G)\")\n   apply(subgoal_tac \"w2 = butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e2)) (parser_bottom G)\")\n    apply(clarsimp)\n    apply(subgoal_tac \"(drop (length (parserHF_conf_fixed c)) (rule_rpop e2)) = (drop (length (parserHF_conf_fixed c)) (rule_rpop e1)) \")\n     apply(clarsimp)\n     apply(rule equal_prefix_removal)\n       prefer 2\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(rule_tac\n      X=\"parser_bottom G\"\n      in equal_suffix_removal1)\n      apply(simp add: prefix_def suffix_def)\n      apply(clarsimp)\n      apply(rename_tac ca caa cb cc \"cd\" ce)(*strict*)\n      apply(case_tac \"length (parserHF_conf_fixed c) - length ce\")\n       apply(rename_tac ca caa cb cc \"cd\" ce)(*strict*)\n       apply(clarsimp)\n      apply(rename_tac ca caa cb cc \"cd\" ce nat)(*strict*)\n      apply(clarsimp)\n      apply(simp add: parserHF_step_relation_def)\n      apply(clarsimp)\n      apply(rename_tac ca caa cb cc \"cd\" ce nat x xa)(*strict*)\n      apply(simp add: prefix_def suffix_def)\n      apply (metis Suc_length append_Nil2 dropPrecise drop_0 drop_all drop_eq_Nil le0 length_drop not_less_eq_eq)\n     apply(simp add: prefix_def suffix_def)\n     apply(clarsimp)\n     apply(rename_tac ca caa cb cc \"cd\" ce)(*strict*)\n     apply(case_tac \"length (parserHF_conf_fixed c) - length cd\")\n      apply(rename_tac ca caa cb cc \"cd\" ce)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac ca caa cb cc \"cd\" ce nat)(*strict*)\n     apply(clarsimp)\n     apply(simp add: parserHF_step_relation_def)\n     apply(clarsimp)\n     apply(rename_tac ca caa cb cc \"cd\" ce nat x xa)(*strict*)\n     apply(simp add: prefix_def suffix_def)\n     apply (metis Suc_length append_Nil2 dropPrecise drop_0 drop_all drop_eq_Nil le0 length_drop not_less_eq_eq)\n    apply(force)\n   apply(rule parserHF_prefix_closureise_history_modification)\n          apply(force)\n         apply(force)\n        prefer 2\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule parserHF_prefix_closureise_history_modification)\n         apply(force)\n        apply(force)\n       prefer 2\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma parserHF_equal_history_extension_and_turning_nonextendable_implies_eq_rpop_prime: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> c2 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> w2 \\<noteq> []\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> rule_rpop e1 = rule_rpop e2\"\n  apply(subgoal_tac \"prefix (parserHF_conf_fixed c) (rule_rpop e1)\")\n   prefer 2\n   apply(rule step_which_modifies_history_exceeds_fixed)\n        apply(force)\n       apply(force)\n      prefer 2\n      apply(force)\n     apply(force)+\n  apply(subgoal_tac \"prefix (parserHF_conf_fixed c) (rule_rpop e2)\")\n   prefer 2\n   apply(rule step_which_modifies_history_exceeds_fixed)\n        apply(force)\n       apply(force)\n      prefer 2\n      apply(force)\n     apply(force)+\n  apply(subgoal_tac \"\\<not> suffix (rule_rpop e1) [parser_bottom G]\")\n   prefer 2\n   apply(rule step_which_not_turns_fixed_unextendable_has_not_bottom_as_suffix)\n        apply(force)\n       apply(force)\n      prefer 2\n      apply(force)\n     apply(force)+\n  apply(subgoal_tac \"\\<not> suffix (rule_rpop e2) [parser_bottom G]\")\n   prefer 2\n   apply(rule step_which_not_turns_fixed_unextendable_has_not_bottom_as_suffix)\n        apply(force)\n       apply(force)\n      prefer 2\n      apply(force)\n     apply(force)+\n  apply(subgoal_tac \"w2 = butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e1)) (parser_bottom G)\")\n   apply(subgoal_tac \"w2 = butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e2)) (parser_bottom G)\")\n    apply(clarsimp)\n    apply(subgoal_tac \"(drop (length (parserHF_conf_fixed c)) (rule_rpop e2)) = (drop (length (parserHF_conf_fixed c)) (rule_rpop e1)) \")\n     apply(clarsimp)\n     apply(rule_tac\n      v=\"parserHF_conf_fixed c\"\n      in equal_prefix_removal)\n       prefer 2\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(rule_tac\n      t=\"drop (length (parserHF_conf_fixed c)) (rule_rpop e2)\"\n      and s=\"butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e2)) (parser_bottom G)\"\n      in ssubst)\n     apply (metis butlast_if_match_reduces drop_prefix_closureise parser_inst_AX_extend_unfixed_scheduler_preserves_unfixed_scheduler_extendable prefix_def suffix_def)\n    apply(rule_tac\n      t=\"drop (length (parserHF_conf_fixed c)) (rule_rpop e1)\"\n      and s=\"butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e1)) (parser_bottom G)\"\n      in ssubst)\n     apply (metis butlast_if_match_reduces drop_prefix_closureise parser_inst_AX_extend_unfixed_scheduler_preserves_unfixed_scheduler_extendable prefix_def suffix_def)\n    apply(force)\n   apply(rule parserHF_prefix_closureise_history_modification_prime)\n          apply(force)\n         apply(force)\n        prefer 2\n        apply(force)\n       apply(force)+\n  apply(rule parserHF_prefix_closureise_history_modification_prime)\n         apply(force)\n        apply(force)\n       prefer 2\n       apply(force)\n      apply(force)+\n  done\n\nlemma parserHF_extendable_and_not_dollar_bottom_then_extendable: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> rule_rpop e1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\"\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   apply(simp add: parserHF_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac x)(*strict*)\n    apply(simp add: prefix_def suffix_def valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac x ca caa k w xb)(*strict*)\n    apply(case_tac \"drop (length (rule_rpop e1)) (parserHF_conf_fixed c)\")\n     apply(rename_tac x ca caa k w xb)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"caa=[]\")\n      apply(rename_tac x ca caa k w xb)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac x ca k w xb)(*strict*)\n      apply(erule_tac\n      x=\"xb@ca\"\n      in allE)\n      apply(force)\n     apply(rename_tac x ca caa k w xb)(*strict*)\n     apply (metis mutual_prefix_implies_equality2 prefix_def self_append_conv)\n    apply(rename_tac x ca caa k w xb a list)(*strict*)\n    apply(subgoal_tac \"\\<exists>w' x'. drop (length (rule_rpop e1)) (parserHF_conf_fixed c) = w' @ [x']\")\n     apply(rename_tac x ca caa k w xb a list)(*strict*)\n     prefer 2\n     apply(rule NonEmptyListHasTailElem)\n     apply(force)\n    apply(rename_tac x ca caa k w xb a list)(*strict*)\n    apply(thin_tac \"drop (length (rule_rpop e1)) (parserHF_conf_fixed c) = a # list\")\n    apply(clarsimp)\n    apply(rename_tac x ca k w xb w')(*strict*)\n    apply (metis append_Cons append_Nil2 concat_asso drop_append2 eq_Nil_appendI last_snoc)\n   apply(rename_tac x)(*strict*)\n   apply(simp add: prefix_def suffix_def)\n   apply(clarsimp)\n   apply(rename_tac x ca caa)(*strict*)\n   apply(case_tac \"drop (length (rule_rpop e1)) (parserHF_conf_fixed c)\")\n    apply(rename_tac x ca caa)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"caa=[]\")\n     apply(rename_tac x ca caa)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x ca)(*strict*)\n     apply(simp add: prefix_def suffix_def valid_parser_step_label_def)\n     apply(clarsimp)\n     apply(rename_tac x ca k w xb)(*strict*)\n     apply(erule_tac\n      x=\"xb@ca\"\n      in allE)\n     apply(force)\n    apply(rename_tac x ca caa)(*strict*)\n    apply (metis valid_parser_step_label_not_parser_bottom_random_insertion rotate_simps)\n   apply(rename_tac x ca caa a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. drop (length (rule_rpop e1)) (parserHF_conf_fixed c) = w' @ [x']\")\n    apply(rename_tac x ca caa a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac x ca caa a list)(*strict*)\n   apply(thin_tac \"drop (length (rule_rpop e1)) (parserHF_conf_fixed c) = a # list\")\n   apply(clarsimp)\n   apply(rename_tac x ca w')(*strict*)\n   apply (metis list.simps(3) prefix_append prefix_drop_none rotate1_is_Nil_conv rotate_simps)\n  apply(simp add: valid_parser_def parserHF_step_relation_def)\n  done\n\nlemma parserHF_extendable_and_not_dollar_bottom_then_extendable_rev: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> rule_rpop e1 \\<sqsupseteq> [parser_bottom G]\"\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   apply(simp add: parserHF_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac x)(*strict*)\n    apply(simp add: prefix_def suffix_def valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac x ca caa k w xb xa)(*strict*)\n    apply(case_tac \"drop (length (rule_rpop e1)) (parserHF_conf_fixed c)\")\n     apply(rename_tac x ca caa k w xb xa)(*strict*)\n     apply(clarsimp)\n     apply(erule_tac\n      x=\"xa\"\n      and P=\"\\<lambda>xa. rule_rpush e1 \\<noteq> xa @ [parser_bottom G]\"\n      in allE)\n     apply(force)\n    apply(rename_tac x ca caa k w xb xa a list)(*strict*)\n    apply(subgoal_tac \"\\<exists>w' x'. drop (length (rule_rpop e1)) (parserHF_conf_fixed c) = w' @ [x']\")\n     apply(rename_tac x ca caa k w xb xa a list)(*strict*)\n     prefer 2\n     apply(rule NonEmptyListHasTailElem)\n     apply(force)\n    apply(rename_tac x ca caa k w xb xa a list)(*strict*)\n    apply(thin_tac \"drop (length (rule_rpop e1)) (parserHF_conf_fixed c) = a # list\")\n    apply(clarsimp)\n    apply(rename_tac x ca caa k w xb xa w' x')(*strict*)\n    apply(subgoal_tac \"caa=[]\")\n     apply(rename_tac x ca caa k w xb xa w' x')(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x ca k w xb xa w' x')(*strict*)\n     apply(erule_tac\n      x=\"ca\"\n      in allE)\n     apply(force)\n    apply(rename_tac x ca caa k w xb xa w' x')(*strict*)\n    apply(simp add: parserHF_configurations_def)\n    apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(simp add: prefix_def suffix_def)\n   apply(clarsimp)\n   apply(rename_tac x ca caa)(*strict*)\n   apply(case_tac \"drop (length (rule_rpop e1)) (parserHF_conf_fixed c)\")\n    apply(rename_tac x ca caa)(*strict*)\n    apply(clarsimp)\n    apply(simp add: prefix_def suffix_def valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac x ca caa k w xb xc)(*strict*)\n    apply(erule_tac\n      x=\"xc\"\n      and P=\"\\<lambda>xc. rule_rpush e1 \\<noteq> xc @ [parser_bottom G]\"\n      in allE)\n    apply(force)\n   apply(rename_tac x ca caa a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. drop (length (rule_rpop e1)) (parserHF_conf_fixed c) = w' @ [x']\")\n    apply(rename_tac x ca caa a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac x ca caa a list)(*strict*)\n   apply(thin_tac \"drop (length (rule_rpop e1)) (parserHF_conf_fixed c) = a # list\")\n   apply(clarsimp)\n   apply(rename_tac x ca caa w' x')(*strict*)\n   apply (metis Suc_neq_Zero drop_eq_Nil drop_length_append length_Suc list.size(3))\n  apply(simp add: valid_parser_def parserHF_step_relation_def)\n  done\n\nlemma parserHF_history_modification_exists: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c @ w\n  \\<Longrightarrow> \\<not> rule_rpop e2 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> length (rule_rpop e2) \\<le> length (parserHF_conf_fixed c)\n  \\<Longrightarrow> w \\<noteq> []\"\n  apply(subgoal_tac \"valid_parser_step_label G e2\")\n   apply(simp add: parserHF_step_relation_def valid_parser_step_label_def)\n   apply(clarsimp)\n   apply(rename_tac k w xa xb)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac k w xa xb)(*strict*)\n    apply(simp add: prefix_def suffix_def)\n    apply(clarsimp)\n    apply(rename_tac k w xa xb ca)(*strict*)\n    apply(simp add: kPrefix_def)\n    apply(case_tac \"k-length w\")\n     apply(rename_tac k w xa xb ca)(*strict*)\n     apply(clarsimp)\n     apply (metis List.length_take append_length_inc kPrefix_def)\n    apply(rename_tac k w xa xb ca nat)(*strict*)\n    apply(force)\n   apply(rename_tac k w xa xb)(*strict*)\n   apply(simp add: prefix_def suffix_def)\n   apply(clarsimp)\n   apply(rename_tac k w xa xb ca)(*strict*)\n   apply(simp add: kPrefix_def)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac k w xa xb ca)(*strict*)\n    apply(clarsimp)\n    apply (metis List.length_take butlast_if_match_direct2_prime in_set_takeD kPrefix_def not_in_diff take_all_length)\n   apply(rename_tac k w xa xb ca nat)(*strict*)\n   apply(force)\n  apply(simp add: parserHF_step_relation_def valid_parser_def)\n  done\n\nlemma parserHF_step_preserved_under_context_switch_with_minimal_requirements: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> c' \\<in> parserHFS_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> c2 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHFS_step_relation G c' e1 c1'\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c @ w\n  \\<Longrightarrow> parserHFvHFS_Lin2BraConf c' = c\n  \\<Longrightarrow> \\<exists>c2'. parserHFS_step_relation G c' e2 c2'\"\n  apply(rule parserHFS_minimal_step_prefix_closureondition)\n      apply(force)\n     apply(simp add: parserHF_step_relation_def)\n    apply(force)\n   apply(simp add: parserHF_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: parserHFS_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa xb xc y)(*strict*)\n   apply(simp add: suffix_def prefix_def parserHFvHFS_Lin2BraConf_def)\n   apply(clarsimp)\n   apply(rename_tac x xa xc y)(*strict*)\n   apply(metis)\n  apply(subgoal_tac \"\\<exists>x. rule_rpop e1 = x @ (rule_rpush e1)\")\n   prefer 2\n   apply(subgoal_tac \"valid_parser_step_label G e1\")\n    apply(simp add: valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac k wa xa)(*strict*)\n    apply(metis)\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(subgoal_tac \"\\<exists>x. rule_rpop e2 = x @ (rule_rpush e2)\")\n   prefer 2\n   apply(subgoal_tac \"valid_parser_step_label G e2\")\n    apply(simp add: valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac x k wa xb)(*strict*)\n    apply(metis)\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(case_tac \"parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\")\n   apply(subgoal_tac \"rule_rpop e1 = rule_rpop e2\")\n    prefer 2\n    apply(rule parserHF_equal_history_extension_and_turning_nonextendable_implies_eq_rpop)\n              apply(force)\n             prefer 4\n             apply(force)\n            prefer 4\n            apply(force)\n           apply (metis)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(simp add: parserHFS_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa xb xc y)(*strict*)\n   apply(simp add: prefix_def)\n  apply(subgoal_tac \"length (butlast_if_match (rule_rpop e2) (parser_bottom G)) \\<le> length (butlast_if_match (rule_rpop e1) (parser_bottom G)) \\<or> length (butlast_if_match (rule_rpop e1) (parser_bottom G)) \\<le> length (butlast_if_match (rule_rpop e2) (parser_bottom G))\")\n   prefer 2\n   apply(force)\n  apply(subgoal_tac \"\\<not> rule_rpop e2 \\<sqsupseteq> [parser_bottom G]\")\n   apply(erule disjE)\n    apply(subgoal_tac \"prefix (butlast_if_match (rule_rpop e2)(parser_bottom G)) (butlast_if_match (rule_rpop e1)(parser_bottom G))\")\n     prefer 2\n     apply(rule_tac\n      w=\"butlast_if_match (parserHF_conf_fixed c)(parser_bottom G) @ w@[parser_bottom G]\"\n      in prefix_common_max)\n       apply(rule_tac\n      w=\"w\"\n      and v=\"[parser_bottom G]\"\n      in parserHF_rpop_prefix_closureeeds_fixed_append_history_mod)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(rule_tac\n      w=\"w\"\n      and v=\"[parser_bottom G]\"\n      in parserHF_rpop_prefix_closureeeds_fixed_append_history_mod)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(rule_tac\n      y=\"butlast_if_match (rule_rpop e1) (parser_bottom G)\"\n      in prefix_transitive)\n     apply(rule_tac\n      t=\"rule_rpop e2\"\n      and s=\"butlast_if_match (rule_rpop e2) (parser_bottom G)\"\n      in ssubst)\n      apply (metis butlast_if_match_reduces suffix_def)\n     apply(force)\n    apply(rule_tac\n      y=\"rule_rpop e1\"\n      in prefix_transitive)\n     apply (metis butlast_if_match_prefix)\n    apply (metis parserHFS_get_scheduler_def parserHFS_step_relation_def prefix_def)\n   apply(subgoal_tac \"prefix (butlast_if_match (rule_rpop e1) (parser_bottom G)) (butlast_if_match (rule_rpop e2) (parser_bottom G))\")\n    prefer 2\n    apply(rule_tac\n      w=\"butlast_if_match (parserHF_conf_fixed c)(parser_bottom G) @ w@[parser_bottom G]\"\n      in prefix_common_max)\n      apply(rule_tac\n      w=\"w\"\n      and v=\"[parser_bottom G]\"\n      in parserHF_rpop_prefix_closureeeds_fixed_append_history_mod)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(rule_tac\n      w=\"w\"\n      and v=\"[parser_bottom G]\"\n      in parserHF_rpop_prefix_closureeeds_fixed_append_history_mod)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(case_tac \"\\<not> rule_rpop e1 \\<sqsupseteq> [parser_bottom G]\")\n    apply(case_tac \"length (rule_rpop e2) \\<le> length (parserHF_conf_fixed c)\")\n     apply(rule_tac\n      y=\"parserHF_conf_fixed c\"\n      in prefix_transitive)\n      apply(simp add: parserHF_step_relation_def)\n      apply(erule conjE)+\n      apply(erule_tac\n      P=\"rule_rpop e2 \\<sqsubseteq> parserHF_conf_fixed c\"\n      in disjE)\n       apply(force)\n      apply(simp add: prefix_def)\n      apply (metis append_Nil2 dropPrecise drop_eq_Nil)\n     apply(rule_tac\n      t=\"parserHF_conf_fixed c\"\n      and s=\"parserHFS_conf_fixed c'\"\n      in ssubst)\n      apply(simp add: parserHFvHFS_Lin2BraConf_def)\n      apply(clarsimp)\n     apply(simp add: parserHFS_configurations_def)\n     apply(clarsimp)\n    apply(subgoal_tac \"w\\<noteq>[]\")\n     apply(subgoal_tac \"rule_rpop e1 = rule_rpop e2\")\n      prefer 2\n      apply(rule parserHF_equal_history_extension_and_turning_nonextendable_implies_eq_rpop_prime)\n                 apply(force)\n                prefer 4\n                apply(force)\n               prefer 4\n               apply(force)\n              apply (metis)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(rule parserHF_extendable_and_not_dollar_bottom_then_extendable)\n          apply(force)\n         prefer 2\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(clarsimp)\n     apply(rename_tac x xa)(*strict*)\n     apply(simp add: parserHF_step_relation_def)\n     apply(clarsimp)\n     apply(rename_tac x xa xb xc)(*strict*)\n     apply(simp add: prefix_def)\n     apply (metis concat_asso parserHFS_step_relation_def)\n    apply(rule_tac\n      ?e2.0=\"e2\"\n      in parserHF_history_modification_exists)\n         apply(force)\n        prefer 2\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   prefer 2\n   apply(rule parserHF_extendable_and_not_dollar_bottom_then_extendable_rev)\n       apply(force)\n      prefer 2\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"\\<exists>x. rule_rpop e1 = x @ [parser_bottom G]\")\n   prefer 2\n   apply(simp add: suffix_def)\n  apply(erule exE)+\n  apply(rename_tac x xa xb)(*strict*)\n  apply(subgoal_tac \"prefix xb (rule_rpop e2)\")\n   apply(rename_tac x xa xb)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"butlast_if_match (rule_rpop e2) (parser_bottom G) = rule_rpop e2\")\n    apply(rename_tac x xa xb)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_reduces suffix_def)\n   apply(rename_tac x xa xb)(*strict*)\n   apply(clarsimp)\n   apply(simp add: prefix_def suffix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa c ca)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (ca @ [parser_bottom G]) (parser_bottom G)=ca\")\n    apply(rename_tac x xa c ca)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_direct)\n   apply(rename_tac x xa c ca)(*strict*)\n   apply(clarsimp)\n   apply(thin_tac \"butlast_if_match (ca @ [parser_bottom G]) (parser_bottom G) = ca\")\n   apply(force)\n  apply(rename_tac x xa xb)(*strict*)\n  apply(subgoal_tac \"\\<exists>x. xb @ x = rule_rpop e2\")\n   apply(rename_tac x xa xb)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n  apply(rename_tac x xa xb)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac x xa xb xc)(*strict*)\n  apply(case_tac xc)\n   apply(rename_tac x xa xb xc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: prefix_def suffix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa c)(*strict*)\n   apply(simp add: parserHF_step_relation_def parserHFvHFS_Lin2BraConf_def parserHF_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac x xa c xb xc)(*strict*)\n   apply (metis Cons_eq_appendI append_assoc append_self_conv2 parserHFS_step_relation_def)\n  apply(rename_tac x xa xb xc a list)(*strict*)\n  apply(subgoal_tac \"xc\\<noteq>[]\")\n   apply(rename_tac x xa xb xc a list)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x xa xb xc a list)(*strict*)\n  apply(thin_tac \"xc=a#list\")\n  apply(subgoal_tac \"False\")\n   apply(rename_tac x xa xb xc a list)(*strict*)\n   apply(force)\n  apply(rename_tac x xa xb xc a list)(*strict*)\n  apply(subgoal_tac \"length (parserHF_conf_fixed c) \\<le> length xb\")\n   apply(rename_tac x xa xb xc a list)(*strict*)\n   apply(subgoal_tac \"xb=rule_rpop e2\")\n    apply(rename_tac x xa xb xc a list)(*strict*)\n    apply(force)\n   apply(rename_tac x xa xb xc a list)(*strict*)\n   apply(rule_tac\n      t=\"xb\"\n      and s=\"parserHF_conf_fixed c @ drop (length (parserHF_conf_fixed c)) xb\"\n      in ssubst)\n    apply(rename_tac x xa xb xc a list)(*strict*)\n    defer\n    apply(rule_tac\n      t=\"drop (length (parserHF_conf_fixed c)) xb\"\n      and s=\"butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e1)) (parser_bottom G)\"\n      in subst)\n     apply(rename_tac x xa xb xc a list)(*strict*)\n     apply(rule butlast_if_match_direct)\n     apply (metis drop_distrib_append)\n    apply(rename_tac x xa xb xc a list)(*strict*)\n    apply(rule_tac\n      t=\"butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e1)) (parser_bottom G)\"\n      and s=\"w\"\n      in subst)\n     apply(rename_tac x xa xb xc a list)(*strict*)\n     apply(rule parserHF_prefix_closureise_history_modification)\n            apply(rename_tac x xa xb xc a list)(*strict*)\n            apply(force)\n           apply(rename_tac x xa xb xc a list)(*strict*)\n           apply(force)\n          apply(rename_tac x xa xb xc a list)(*strict*)\n          prefer 2\n          apply(force)\n         apply(rename_tac x xa xb xc a list)(*strict*)\n         apply(force)+\n      apply(rename_tac x xa xb xc a list)(*strict*)\n      apply(simp add: parserHF_step_relation_def parserHF_configurations_def parserHFvHFS_Lin2BraConf_def)\n      apply(rename_tac x xa xb xc)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac x xa xb xc xd xe)(*strict*)\n      apply(simp add: prefix_def suffix_def)\n      apply(clarsimp)\n      apply(rename_tac x xa xc xd xe c ca cb cc \"cd\" ce cf)(*strict*)\n      apply (metis ConsApp concat_asso set_bi_append set_subset_in)\n     apply(rename_tac x xa xb xc a list)(*strict*)\n     apply(force)\n    apply(rename_tac x xa xb xc a list)(*strict*)\n    apply(rule_tac\n      t=\"rule_rpop e2\"\n      and s=\"parserHF_conf_fixed c @ drop (length (parserHF_conf_fixed c)) (rule_rpop e2)\"\n      in ssubst)\n     apply(rename_tac x xa xb xc a list)(*strict*)\n     defer\n     apply(rule_tac\n      t=\"drop (length (parserHF_conf_fixed c)) (rule_rpop e2)\"\n      and s=\"butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e2)) (parser_bottom G)\"\n      in subst)\n      apply(rename_tac x xa xb xc a list)(*strict*)\n      apply(rule_tac\n      t=\"butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e2)) (parser_bottom G)\"\n      and s=\"(drop (length (parserHF_conf_fixed c)) (butlast_if_match (rule_rpop e2) (parser_bottom G)))\"\n      in ssubst)\n       apply(rename_tac x xa xb xc a list)(*strict*)\n       apply (metis butlast_if_match_pull_out drop_distrib_append)\n      apply(rename_tac x xa xb xc a list)(*strict*)\n      apply (metis butlast_if_match_reduces suffix_def)\n     apply(rename_tac x xa xb xc a list)(*strict*)\n     apply(rule_tac\n      t=\"butlast_if_match (drop (length (parserHF_conf_fixed c)) (rule_rpop e2)) (parser_bottom G)\"\n      and s=\"w\"\n      in subst)\n      apply(rename_tac x xa xb xc a list)(*strict*)\n      defer\n      apply(force)\n     apply(rename_tac x xa xb xc a list)(*strict*)\n     apply(rule_tac\n      t=\"xb\"\n      and s=\"butlast_if_match (rule_rpop e1) (parser_bottom G)\"\n      in ssubst)\n      apply(rename_tac x xa xb xc a list)(*strict*)\n      apply (metis butlast_if_match_direct)\n     apply(rename_tac x xa xb xc a list)(*strict*)\n     apply(rule step_which_almost_modifies_history_exceeds_fixed)\n          apply(rename_tac x xa xb xc a list)(*strict*)\n          apply(force)\n         apply(rename_tac x xa xb xc a list)(*strict*)\n         apply(force)\n        apply(rename_tac x xa xb xc a list)(*strict*)\n        prefer 2\n        apply(force)\n       apply(rename_tac x xa xb xc a list)(*strict*)\n       apply(force)\n      apply(rename_tac x xa xb xc a list)(*strict*)\n      apply(force)\n     apply(rename_tac x xa xb xc a list)(*strict*)\n     apply(force)\n    apply(rename_tac x xa xb xc a list)(*strict*)\n    apply (metis dropPrecise parserHF_step_relation_def prefix_transitive prefix_common_max prefix_def)\n   apply(rename_tac x xa xb xc a list)(*strict*)\n   apply (metis dropPrecise parserHF_step_relation_def prefix_transitive prefix_common_max prefix_def)\n  apply(rename_tac x xa xb xc a list)(*strict*)\n  apply(rule parserHF_prefix_closureise_history_modification_prime)\n         apply(rename_tac x xa xb xc a list)(*strict*)\n         apply(force)\n        apply(rename_tac x xa xb xc a list)(*strict*)\n        apply(force)\n       apply(rename_tac x xa xb xc a list)(*strict*)\n       prefer 2\n       apply(force)\n      apply(rename_tac x xa xb xc a list)(*strict*)\n      apply(force)+\n   apply(rename_tac x xa xb xc a list)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x xa xb xc a list)(*strict*)\n  apply (metis (no_types, hide_lams) parserHF_step_relation_def mutual_prefix_implies_equality2 prefix_transitive prefix_def)\n  done\n\nlemma parserHFS2HF_FEdetermHist_hlp1: \"\n  valid_parser G\n  \\<Longrightarrow> \\<forall>c\\<in> parserHFS.get_accessible_configurations G. \\<forall>c1 c2 e1 e2. parserHFS_step_relation G c e1 c1 \\<and> parserHFS_step_relation G c e2 c2 \\<longrightarrow> e1 = e2\n  \\<Longrightarrow> parserHF.derivation_initial G d\n  \\<Longrightarrow> get_configuration (d n) = Some c\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> e1 = e2\"\n  apply(simp add: get_configuration_def)\n  apply(case_tac \"d n\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option)(*strict*)\n  apply(subgoal_tac \"c \\<in> parserHF_configurations G\")\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      in parserHF.belongs_configurations)\n    apply(rename_tac option)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac option)(*strict*)\n   apply (metis parserHF.derivation_initial_belongs)\n  apply(rename_tac option)(*strict*)\n  apply(subgoal_tac \"c1 \\<in> parserHF_configurations G\")\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply (metis parserHF.AX_step_relation_preserves_belongsC)\n  apply(rename_tac option)(*strict*)\n  apply(subgoal_tac \"c2 \\<in> parserHF_configurations G\")\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply (metis parserHF.AX_step_relation_preserves_belongsC)\n  apply(rename_tac option)(*strict*)\n  apply(subgoal_tac \"parserHFS.derivation_initial G (parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n))\")\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply(simp add: parserHFS.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac option)(*strict*)\n    apply(rule parserHF_vs_parserHFS.Bra2LinDer_preserves_derivation)\n       apply(rename_tac option)(*strict*)\n       apply(force)\n      apply(rename_tac option)(*strict*)\n      apply(rule parserHF.derivation_append_preserves_derivation)\n        apply(rename_tac option)(*strict*)\n        apply (metis parserHF.derivation_initial_is_derivation)\n       apply(rename_tac option)(*strict*)\n       apply(rule parserHF.der2_is_derivation)\n       apply(force)\n      apply(rename_tac option)(*strict*)\n      apply(clarsimp)\n      apply(simp add: der2_def)\n     apply(rename_tac option)(*strict*)\n     apply(rule parserHF.derivation_append_preserves_belongs)\n       apply(rename_tac option)(*strict*)\n       apply(force)\n      apply(rename_tac option)(*strict*)\n      apply (metis parserHF.derivation_initial_belongs)\n     apply(rename_tac option)(*strict*)\n     apply(rule parserHF.derivation_append_preserves_derivation)\n       apply(rename_tac option)(*strict*)\n       apply (metis parserHF.derivation_initial_is_derivation)\n      apply(rename_tac option)(*strict*)\n      apply(rule parserHF.der2_is_derivation)\n      apply(force)\n     apply(rename_tac option)(*strict*)\n     apply(clarsimp)\n     apply(simp add: der2_def)\n    apply(rename_tac option)(*strict*)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option)(*strict*)\n   apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n    apply(rename_tac option)(*strict*)\n    prefer 2\n    apply (metis parserHF.derivation_initial_is_derivation parserHF.some_position_has_details_at_0)\n   apply(rename_tac option)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option ca)(*strict*)\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) 0\")\n    apply(rename_tac option ca)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option ca a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac option ca a optiona b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option ca optiona b)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n   apply(rule_tac\n      t=\"b\"\n      and s=\"parserHFvHFS_Bra2LinConf ca (parserHF_vs_parserHFS.Bra2LinDer' G (\\<lambda>x. if x \\<le> n then d x else if x - n = 0 then Some (pair None c) else if x - n = Suc 0 then Some (pair (Some e1) c1) else None) (Suc n) 0 @ (if parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed c1 else parserHF_conf_fixed c1 @ [parser_bottom G]))\"\n      in ssubst)\n    apply(rename_tac option ca optiona b)(*strict*)\n    apply(force)\n   apply(rename_tac option ca optiona b)(*strict*)\n   apply(rule parserHF_vs_parserHFS.AX_Bra2LinConf_preserves_initiality)\n     apply(rename_tac option ca optiona b)(*strict*)\n     apply(force)\n    apply(rename_tac option ca optiona b)(*strict*)\n    apply(subgoal_tac \" parserHF_vs_parserHFS.Bra2LinDer' SSG (derivation_append d (der2 c e1 c1) n) (Suc n) 0 \\<in> parser_scheduler_fragments SSG\" for SSG)\n     apply(rename_tac option ca optiona b)(*strict*)\n     prefer 2\n     apply(rule parserHF_vs_parserHFS.Bra2LinDer_prime_closed)\n         apply(rename_tac option ca optiona b)(*strict*)\n         apply(force)\n        apply(rename_tac option ca optiona b)(*strict*)\n        apply(rule parserHF.derivation_append_preserves_derivation)\n          apply(rename_tac option ca optiona b)(*strict*)\n          apply (metis parserHF.derivation_initial_is_derivation)\n         apply(rename_tac option ca optiona b)(*strict*)\n         apply(rule parserHF.der2_is_derivation)\n         apply(force)\n        apply(rename_tac option ca optiona b)(*strict*)\n        apply(clarsimp)\n        apply(rename_tac option ca)(*strict*)\n        apply(simp add: der2_def)\n       apply(rename_tac option ca optiona b)(*strict*)\n       apply (rule parserHF.derivation_initial_belongs)\n        apply(rename_tac option ca optiona b)(*strict*)\n        apply(force)\n       apply(rename_tac option ca optiona b)(*strict*)\n       apply(rule parserHF.derivation_append_preserves_derivation_initial)\n         apply(rename_tac option ca optiona b)(*strict*)\n         apply(force)\n        apply(rename_tac option ca optiona b)(*strict*)\n        apply(force)\n       apply(rename_tac option ca optiona b)(*strict*)\n       apply(rule parserHF.derivation_append_preserves_derivation)\n         apply(rename_tac option ca optiona b)(*strict*)\n         apply (metis parserHF.derivation_initial_is_derivation)\n        apply(rename_tac option ca optiona b)(*strict*)\n        apply(rule parserHF.der2_is_derivation)\n        apply(force)\n       apply(rename_tac option ca optiona b)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac option ca)(*strict*)\n       apply(simp add: der2_def)\n      apply(rename_tac option ca optiona b)(*strict*)\n      apply(simp add: derivation_append_def der2_def)\n     apply(rename_tac option ca optiona b)(*strict*)\n     apply(force)\n    apply(rename_tac option ca optiona b)(*strict*)\n    apply(simp add: parser_scheduler_fragments_def parser_schedulers_def)\n    apply(clarsimp)\n    apply(rename_tac option ca)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac option ca)(*strict*)\n     apply(clarsimp)\n     apply(simp add: suffix_def)\n     apply(clarsimp)\n     apply(rename_tac option ca caa)(*strict*)\n     apply(simp add: derivation_append_def der2_def)\n     apply(simp add: parserHF_configurations_def)\n     apply(clarsimp)\n    apply(rename_tac option ca)(*strict*)\n    apply(clarsimp)\n    apply(simp add: derivation_append_def der2_def)\n    apply(simp add: parserHF_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac option c f fb h l la lb w)(*strict*)\n    apply(simp add: suffix_def)\n   apply(rename_tac option ca optiona b)(*strict*)\n   apply(simp add: parserHF.derivation_initial_def)\n  apply(rename_tac option)(*strict*)\n  apply(erule_tac\n      x=\"the(get_configuration(parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n))\"\n      in ballE)\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply(simp add: parserHFS.get_accessible_configurations_def)\n   apply(subgoal_tac \"False\")\n    apply(rename_tac option)(*strict*)\n    apply(force)\n   apply(rename_tac option)(*strict*)\n   apply(erule_tac\n      x=\"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n)\"\n      in allE)\n   apply(rename_tac option)(*strict*)\n   apply(erule_tac\n      P=\"parserHFS.derivation_initial G (parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n))\"\n      in impE)\n    apply(rename_tac option)(*strict*)\n    apply(force)\n   apply(rename_tac option)(*strict*)\n   apply(erule_tac\n      x=\"n\"\n      in allE)\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n    apply(rename_tac option)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option a)(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(case_tac a)\n   apply(rename_tac option a optiona b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac option)(*strict*)\n  apply(erule_tac\n      x=\"the(get_configuration(parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) (Suc n)))\"\n      in allE)\n  apply(erule_tac\n      x=\"THE c2. parserHFS_step_relation G (the(get_configuration(parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n))) e2 c2\"\n      in allE)\n  apply(rename_tac option)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in allE)\n  apply(erule_tac\n      x=\"e2\"\n      in allE)\n  apply(erule_tac\n      Q=\"e1 = e2\"\n      in impE)\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac option)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac option)(*strict*)\n   apply(rule_tac\n      d=\"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n)\"\n      and n=\"n\"\n      and ?e1.0=\"option\"\n      in parserHFS.position_change_due_to_step_relation)\n     apply(rename_tac option)(*strict*)\n     apply(rule parserHFS.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac option)(*strict*)\n    apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n     apply(rename_tac option)(*strict*)\n     apply(clarsimp)\n     apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n     apply(simp add: derivation_append_def der2_def)\n    apply(rename_tac option a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac option a optiona b)(*strict*)\n    apply(simp add: get_configuration_def)\n    apply(clarsimp)\n    apply(rename_tac option optiona b)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option)(*strict*)\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) (Suc n)\")\n    apply(rename_tac option)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac option a optiona b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac option optiona b)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac option)(*strict*)\n  apply(rule HOL.theI')\n  apply(rule parserHFS_unique_step)\n   apply(rename_tac option)(*strict*)\n   apply(force)\n  apply(rename_tac option)(*strict*)\n  apply(rule parserHF_step_preserved_under_context_switch_with_minimal_requirements)\n              apply(rename_tac option)(*strict*)\n              apply(force)\n             apply(rename_tac option)(*strict*)\n             prefer 3\n             apply(force)\n            apply(rename_tac option)(*strict*)\n            apply(force)\n           apply(rename_tac option)(*strict*)\n           prefer 6\n           apply(force)\n          apply(rename_tac option)(*strict*)\n          prefer 4\n          apply(force)\n         apply(rename_tac option)(*strict*)\n         prefer 4\n         apply(force)\n        apply(rename_tac option)(*strict*)\n        apply(force)\n       apply(rename_tac option)(*strict*)\n       prefer 2\n       apply(force)\n      apply(rename_tac option)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac option)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac option)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n    apply(rename_tac option)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac option a optiona b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option optiona b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(simp add: parserHFvHFS_Lin2BraConf_def)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n   apply(clarsimp)\n   apply(rename_tac optiona)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac optiona)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer'_def)\n    apply(subgoal_tac \"nat_seq n n=[n]\")\n     apply(rename_tac optiona)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"nat_seq (Suc n) n=[]\")\n      apply(rename_tac optiona)(*strict*)\n      apply(clarsimp)\n      apply(simp add: parserHFvHFS_Bra2LinStep_def)\n      apply(simp add: parserHFvHFS_Bra2LinConf_def)\n     apply(rename_tac optiona)(*strict*)\n     apply (metis lessI nat_seqEmpty)\n    apply(rename_tac optiona)(*strict*)\n    apply (metis natUptTo_n_n)\n   apply(rename_tac optiona)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer'_def)\n   apply(subgoal_tac \"nat_seq n n=[n]\")\n    apply(rename_tac optiona)(*strict*)\n    apply(subgoal_tac \"nat_seq (Suc n) n=[]\")\n     apply(rename_tac optiona)(*strict*)\n     apply(clarsimp)\n     apply(simp add: parserHFvHFS_Bra2LinStep_def)\n     apply(simp add: parserHFvHFS_Bra2LinConf_def)\n    apply(rename_tac optiona)(*strict*)\n    apply (metis lessI nat_seqEmpty)\n   apply(rename_tac optiona)(*strict*)\n   apply (metis natUptTo_n_n)\n  apply(rename_tac option)(*strict*)\n  apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n   apply(rename_tac option)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac option a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac option a optiona b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option optiona b)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(rule parserHFS.belongs_configurations)\n   apply(rename_tac option optiona b)(*strict*)\n   apply(rule parserHFS.derivation_initial_belongs)\n    apply(rename_tac option optiona b)(*strict*)\n    apply(force)\n   apply(rename_tac option optiona b)(*strict*)\n   apply(force)\n  apply(rename_tac option optiona b)(*strict*)\n  apply(force)\n  done\n\nlemma not_extendable_implies_pop_prefix_closureeeds_fixed: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> rule_rpop e2 \\<sqsubseteq> parserHF_conf_fixed c\"\n  apply(simp add: parserHF_configurations_def parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac f h x)(*strict*)\n  apply(simp add: suffix_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x c ca cb)(*strict*)\n  apply(subgoal_tac \"\\<exists>x. rule_rpop e2= x @ (rule_rpush e2)\")\n   apply(rename_tac x c ca cb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x c ca cb xa)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (c @ [parser_bottom G]) (parser_bottom G)=c\")\n    apply(rename_tac x c ca cb xa)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"cb=[]\")\n     apply(rename_tac x c ca cb xa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x c ca cb xa)(*strict*)\n    apply(subgoal_tac \"valid_parser_step_label G e2\")\n     apply(rename_tac x c ca cb xa)(*strict*)\n     apply(simp add: valid_parser_step_label_def)\n     apply(clarsimp)\n     apply(rename_tac x c ca cb xa k w)(*strict*)\n     apply(simp add: kPrefix_def)\n     apply(case_tac \"k-length w\")\n      apply(rename_tac x c ca cb xa k w)(*strict*)\n      apply(clarsimp)\n      apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n       apply(rename_tac x c ca cb xa k w)(*strict*)\n       apply(force)\n      apply(rename_tac x c ca cb xa k w)(*strict*)\n      apply (metis kPrefix_def take_reflects_mem)\n     apply(rename_tac x c ca cb xa k w nat)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x c ca cb xa k w nat xb)(*strict*)\n     apply(case_tac cb)\n      apply(rename_tac x c ca cb xa k w nat xb)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac x c ca cb xa k w nat xb a list)(*strict*)\n     apply(subgoal_tac \"\\<exists>w' x'. cb = w' @ [x']\")\n      apply(rename_tac x c ca cb xa k w nat xb a list)(*strict*)\n      prefer 2\n      apply(rule NonEmptyListHasTailElem)\n      apply(force)\n     apply(rename_tac x c ca cb xa k w nat xb a list)(*strict*)\n     apply(thin_tac \"cb = a # list\")\n     apply(clarsimp)\n    apply(rename_tac x c ca cb xa)(*strict*)\n    apply(simp add: valid_parser_def)\n   apply(rename_tac x c ca cb xa)(*strict*)\n   apply (metis butlast_if_match_direct)\n  apply(rename_tac x c ca cb)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e2\")\n   apply(rename_tac x c ca cb)(*strict*)\n   apply(simp add: valid_parser_step_label_def)\n   apply(clarsimp)\n   apply(rename_tac x c ca cb k w xb)(*strict*)\n   apply(rule_tac\n      x=\"xb\"\n      in exI)\n   apply(force)\n  apply(rename_tac x c ca cb)(*strict*)\n  apply(simp add: valid_parser_def)\n  done\n\nlemma parserHF_step_preserved_under_context_switch_with_minimal_requirements2: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> c' \\<in> parserHFS_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> c2 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHFS_step_relation G c' e1 c1'\n  \\<Longrightarrow> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c\n  \\<Longrightarrow> parserHFvHFS_Lin2BraConf c' = c\n  \\<Longrightarrow> \\<exists>c2'. parserHFS_step_relation G c' e2 c2'\"\n  apply(rule parserHFS_minimal_step_prefix_closureondition)\n      apply(force)\n     apply(simp add: parserHF_step_relation_def)\n    apply(force)\n   apply(simp add: parserHF_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: parserHFS_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa xb xc y)(*strict*)\n   apply(simp add: suffix_def prefix_def parserHFvHFS_Lin2BraConf_def)\n   apply(clarsimp)\n   apply(rename_tac x xa xc y c)(*strict*)\n   apply(metis)\n  apply(subgoal_tac \"\\<exists>x. rule_rpop e1 = x @ (rule_rpush e1)\")\n   prefer 2\n   apply(subgoal_tac \"valid_parser_step_label G e1\")\n    apply(simp add: valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac k w xa)(*strict*)\n    apply(metis)\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(subgoal_tac \"\\<exists>x. rule_rpop e2 = x @ (rule_rpush e2)\")\n   prefer 2\n   apply(subgoal_tac \"valid_parser_step_label G e2\")\n    apply(simp add: valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac x k w xb)(*strict*)\n    apply(metis)\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(rule_tac\n      y=\"parserHFS_conf_fixed c'\"\n      in prefix_transitive)\n   apply(rule_tac\n      t=\"parserHFS_conf_fixed c'\"\n      and s=\"parserHF_conf_fixed c\"\n      in ssubst)\n    apply(simp add: parserHF_step_relation_def parserHFvHFS_Lin2BraConf_def parserHF_configurations_def)\n    apply(clarsimp)\n   apply(rule not_extendable_implies_pop_prefix_closureeeds_fixed)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(simp add: parserHFS_configurations_def parserHFvHFS_Lin2BraConf_def)\n  apply(clarsimp)\n  done\n\nlemma parserHFS2HF_FEdetermHist_hlp2: \"\n  valid_parser G\n  \\<Longrightarrow> \\<forall>c\\<in> parserHFS.get_accessible_configurations G. \\<forall>c1 c2 e1 e2. parserHFS_step_relation G c e1 c1 \\<and> parserHFS_step_relation G c e2 c2 \\<longrightarrow> e1 = e2\n  \\<Longrightarrow> parserHF.derivation_initial G d\n  \\<Longrightarrow> get_configuration (d n) = Some c\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c\n  \\<Longrightarrow> e1 = e2\"\n  apply(simp add: get_configuration_def)\n  apply(case_tac \"d n\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option)(*strict*)\n  apply(subgoal_tac \"c \\<in> parserHF_configurations G\")\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      in parserHF.belongs_configurations)\n    apply(rename_tac option)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac option)(*strict*)\n   apply (metis parserHF.derivation_initial_belongs)\n  apply(rename_tac option)(*strict*)\n  apply(subgoal_tac \"c1 \\<in> parserHF_configurations G\")\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply (metis parserHF.AX_step_relation_preserves_belongsC)\n  apply(rename_tac option)(*strict*)\n  apply(subgoal_tac \"c2 \\<in> parserHF_configurations G\")\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply (metis parserHF.AX_step_relation_preserves_belongsC)\n  apply(rename_tac option)(*strict*)\n  apply(subgoal_tac \"parserHFS.derivation_initial G (parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n))\")\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply(simp add: parserHFS.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac option)(*strict*)\n    apply(rule parserHF_vs_parserHFS.Bra2LinDer_preserves_derivation)\n       apply(rename_tac option)(*strict*)\n       apply(force)\n      apply(rename_tac option)(*strict*)\n      apply(rule parserHF.derivation_append_preserves_derivation)\n        apply(rename_tac option)(*strict*)\n        apply (metis parserHF.derivation_initial_is_derivation)\n       apply(rename_tac option)(*strict*)\n       apply(rule parserHF.der2_is_derivation)\n       apply(force)\n      apply(rename_tac option)(*strict*)\n      apply(clarsimp)\n      apply(simp add: der2_def)\n     apply(rename_tac option)(*strict*)\n     apply(rule parserHF.derivation_append_preserves_belongs)\n       apply(rename_tac option)(*strict*)\n       apply(force)\n      apply(rename_tac option)(*strict*)\n      apply (metis parserHF.derivation_initial_belongs)\n     apply(rename_tac option)(*strict*)\n     apply(rule parserHF.derivation_append_preserves_derivation)\n       apply(rename_tac option)(*strict*)\n       apply (metis parserHF.derivation_initial_is_derivation)\n      apply(rename_tac option)(*strict*)\n      apply(rule parserHF.der2_is_derivation)\n      apply(force)\n     apply(rename_tac option)(*strict*)\n     apply(clarsimp)\n     apply(simp add: der2_def)\n    apply(rename_tac option)(*strict*)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option)(*strict*)\n   apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n    apply(rename_tac option)(*strict*)\n    prefer 2\n    apply (metis parserHF.derivation_initial_is_derivation parserHF.some_position_has_details_at_0)\n   apply(rename_tac option)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option ca)(*strict*)\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) 0\")\n    apply(rename_tac option ca)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option ca a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac option ca a optiona b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option ca optiona b)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n   apply(rule_tac\n      t=\"b\"\n      and s=\"parserHFvHFS_Bra2LinConf ca (parserHF_vs_parserHFS.Bra2LinDer' G (\\<lambda>x. if x \\<le> n then d x else if x - n = 0 then Some (pair None c) else if x - n = Suc 0 then Some (pair (Some e1) c1) else None) (Suc n) 0 @ (if parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed c1 else parserHF_conf_fixed c1 @ [parser_bottom G]))\"\n      in ssubst)\n    apply(rename_tac option ca optiona b)(*strict*)\n    apply(force)\n   apply(rename_tac option ca optiona b)(*strict*)\n   apply(rule parserHF_vs_parserHFS.AX_Bra2LinConf_preserves_initiality)\n     apply(rename_tac option ca optiona b)(*strict*)\n     apply(force)\n    apply(rename_tac option ca optiona b)(*strict*)\n    apply(subgoal_tac \" parserHF_vs_parserHFS.Bra2LinDer' SSG (derivation_append d (der2 c e1 c1) n) (Suc n) 0 \\<in> parser_scheduler_fragments SSG\" for SSG)\n     apply(rename_tac option ca optiona b)(*strict*)\n     prefer 2\n     apply(rule parserHF_vs_parserHFS.Bra2LinDer_prime_closed)\n         apply(rename_tac option ca optiona b)(*strict*)\n         apply(force)\n        apply(rename_tac option ca optiona b)(*strict*)\n        apply(rule parserHF.derivation_append_preserves_derivation)\n          apply(rename_tac option ca optiona b)(*strict*)\n          apply (metis parserHF.derivation_initial_is_derivation)\n         apply(rename_tac option ca optiona b)(*strict*)\n         apply(rule parserHF.der2_is_derivation)\n         apply(force)\n        apply(rename_tac option ca optiona b)(*strict*)\n        apply(clarsimp)\n        apply(rename_tac option ca)(*strict*)\n        apply(simp add: der2_def)\n       apply(rename_tac option ca optiona b)(*strict*)\n       apply (rule parserHF.derivation_initial_belongs)\n        apply(rename_tac option ca optiona b)(*strict*)\n        apply(force)\n       apply(rename_tac option ca optiona b)(*strict*)\n       apply(rule parserHF.derivation_append_preserves_derivation_initial)\n         apply(rename_tac option ca optiona b)(*strict*)\n         apply(force)\n        apply(rename_tac option ca optiona b)(*strict*)\n        apply(force)\n       apply(rename_tac option ca optiona b)(*strict*)\n       apply(rule parserHF.derivation_append_preserves_derivation)\n         apply(rename_tac option ca optiona b)(*strict*)\n         apply (metis parserHF.derivation_initial_is_derivation)\n        apply(rename_tac option ca optiona b)(*strict*)\n        apply(rule parserHF.der2_is_derivation)\n        apply(force)\n       apply(rename_tac option ca optiona b)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac option ca)(*strict*)\n       apply(simp add: der2_def)\n      apply(rename_tac option ca optiona b)(*strict*)\n      apply(simp add: derivation_append_def der2_def)\n     apply(rename_tac option ca optiona b)(*strict*)\n     apply(force)\n    apply(rename_tac option ca optiona b)(*strict*)\n    apply(simp add: parser_scheduler_fragments_def parser_schedulers_def)\n    apply(clarsimp)\n    apply(rename_tac option ca)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac option ca)(*strict*)\n     apply(clarsimp)\n     apply(simp add: suffix_def)\n     apply(clarsimp)\n     apply(rename_tac option ca caa cb)(*strict*)\n     apply(simp add: derivation_append_def der2_def)\n     apply(simp add: parserHF_configurations_def)\n     apply(clarsimp)\n    apply(rename_tac option ca)(*strict*)\n    apply(clarsimp)\n    apply(simp add: derivation_append_def der2_def)\n    apply(simp add: parserHF_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac option c f fb h l la lb w)(*strict*)\n    apply(simp add: suffix_def)\n   apply(rename_tac option ca optiona b)(*strict*)\n   apply(simp add: parserHF.derivation_initial_def)\n  apply(rename_tac option)(*strict*)\n  apply(erule_tac\n      x=\"the(get_configuration(parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n))\"\n      in ballE)\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply(simp add: parserHFS.get_accessible_configurations_def)\n   apply(subgoal_tac \"False\")\n    apply(rename_tac option)(*strict*)\n    apply(force)\n   apply(rename_tac option)(*strict*)\n   apply(erule_tac\n      x=\"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n)\"\n      in allE)\n   apply(rename_tac option)(*strict*)\n   apply(erule impE)\n    apply(rename_tac option)(*strict*)\n    apply(force)\n   apply(rename_tac option)(*strict*)\n   apply(erule_tac\n      x=\"n\"\n      in allE)\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n    apply(rename_tac option)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option a)(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(case_tac a)\n   apply(rename_tac option a optiona b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac option)(*strict*)\n  apply(erule_tac\n      x=\"the(get_configuration(parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) (Suc n)))\"\n      in allE)\n  apply(erule_tac\n      x=\"THE c2. parserHFS_step_relation G (the(get_configuration(parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n))) e2 c2\"\n      in allE)\n  apply(rename_tac option)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in allE)\n  apply(erule_tac\n      x=\"e2\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac option)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac option)(*strict*)\n   apply(rule_tac\n      d=\"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n)\"\n      and n=\"n\"\n      and ?e1.0=\"option\"\n      in parserHFS.position_change_due_to_step_relation)\n     apply(rename_tac option)(*strict*)\n     apply(rule parserHFS.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac option)(*strict*)\n    apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n     apply(rename_tac option)(*strict*)\n     apply(clarsimp)\n     apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n     apply(simp add: derivation_append_def der2_def)\n    apply(rename_tac option a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac option a optiona b)(*strict*)\n    apply(simp add: get_configuration_def)\n    apply(clarsimp)\n    apply(rename_tac option optiona b)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option)(*strict*)\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) (Suc n)\")\n    apply(rename_tac option)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac option a optiona b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac option optiona b)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac option)(*strict*)\n  apply(rule HOL.theI')\n  apply(rule parserHFS_unique_step)\n   apply(rename_tac option)(*strict*)\n   apply(force)\n  apply(rename_tac option)(*strict*)\n  apply(rule parserHF_step_preserved_under_context_switch_with_minimal_requirements2)\n             apply(rename_tac option)(*strict*)\n             apply(force)\n            apply(rename_tac option)(*strict*)\n            prefer 3\n            apply(force)\n           apply(rename_tac option)(*strict*)\n           apply(force)\n          apply(rename_tac option)(*strict*)\n          apply(force)\n         apply(rename_tac option)(*strict*)\n         prefer 2\n         apply(force)\n        apply(rename_tac option)(*strict*)\n        prefer 2\n        apply(force)\n       apply(rename_tac option)(*strict*)\n       prefer 2\n       apply(force)\n      apply(rename_tac option)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac option)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac option)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac option)(*strict*)\n   prefer 2\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n    apply(rename_tac option)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac option a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac option a optiona b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac option optiona b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(simp add: parserHFvHFS_Lin2BraConf_def)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n   apply(clarsimp)\n   apply(rename_tac optiona)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac optiona)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer'_def)\n    apply(subgoal_tac \"nat_seq n n=[n]\")\n     apply(rename_tac optiona)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"nat_seq (Suc n) n=[]\")\n      apply(rename_tac optiona)(*strict*)\n      apply(clarsimp)\n      apply(simp add: parserHFvHFS_Bra2LinStep_def)\n      apply(simp add: parserHFvHFS_Bra2LinConf_def)\n     apply(rename_tac optiona)(*strict*)\n     apply (metis lessI nat_seqEmpty)\n    apply(rename_tac optiona)(*strict*)\n    apply (metis natUptTo_n_n)\n   apply(rename_tac optiona)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer'_def)\n   apply(subgoal_tac \"nat_seq n n=[n]\")\n    apply(rename_tac optiona)(*strict*)\n    apply(subgoal_tac \"nat_seq (Suc n) n=[]\")\n     apply(rename_tac optiona)(*strict*)\n     apply(clarsimp)\n     apply(simp add: parserHFvHFS_Bra2LinStep_def)\n     apply(simp add: parserHFvHFS_Bra2LinConf_def)\n    apply(rename_tac optiona)(*strict*)\n    apply (metis lessI nat_seqEmpty)\n   apply(rename_tac optiona)(*strict*)\n   apply (metis natUptTo_n_n)\n  apply(rename_tac option)(*strict*)\n  apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n   apply(rename_tac option)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac option a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac option a optiona b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option optiona b)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(rule parserHFS.belongs_configurations)\n   apply(rename_tac option optiona b)(*strict*)\n   apply(rule parserHFS.derivation_initial_belongs)\n    apply(rename_tac option optiona b)(*strict*)\n    apply(force)\n   apply(rename_tac option optiona b)(*strict*)\n   apply(force)\n  apply(rename_tac option optiona b)(*strict*)\n  apply(force)\n  done\n\nlemma no_history_extension_if_already_unextendable: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> w2 = []\"\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   apply(simp add: parserHF_step_relation_def prefix_def suffix_def)\n   apply(clarsimp)\n   apply(rename_tac ca x)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac ca x)(*strict*)\n    prefer 2\n    apply(clarsimp)\n    apply(rename_tac ca x caa)(*strict*)\n    apply(simp add: valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac ca x caa k w xb)(*strict*)\n    apply(subgoal_tac \"caa=[]\")\n     apply(rename_tac ca x caa k w xb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac ca x k w xb)(*strict*)\n     apply (metis Suc_length butlast_if_match_length_le)\n    apply(rename_tac ca x caa k w xb)(*strict*)\n    apply(simp add: kPrefix_def)\n    apply(case_tac \"k-length w\")\n     apply(rename_tac ca x caa k w xb)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n      apply(rename_tac ca x caa k w xb)(*strict*)\n      apply(force)\n     apply(rename_tac ca x caa k w xb)(*strict*)\n     apply (metis kPrefix_def take_reflects_mem)\n    apply(rename_tac ca x caa k w xb nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac ca x caa k w xb nat xa)(*strict*)\n    apply(case_tac caa)\n     apply(rename_tac ca x caa k w xb nat xa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac ca x caa k w xb nat xa a list)(*strict*)\n    apply(subgoal_tac \"\\<exists>w' x'. caa = w' @ [x']\")\n     apply(rename_tac ca x caa k w xb nat xa a list)(*strict*)\n     prefer 2\n     apply(rule NonEmptyListHasTailElem)\n     apply(force)\n    apply(rename_tac ca x caa k w xb nat xa a list)(*strict*)\n    apply(thin_tac \"caa = a # list\")\n    apply(clarsimp)\n   apply(rename_tac ca x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ca x caa)(*strict*)\n   apply (metis append_length_inc drop_entire_butlast_if_match drop_eq_Nil length_Suc)\n  apply(simp add: valid_parser_def parserHF_step_relation_def)\n  done\n\nlemma parserHF_history_in_parser_events_no_bottom: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> set (parserHF_conf_history c) \\<subseteq> parser_events G - {parser_bottom G}\"\n  apply(simp add: parserHF_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac x f h l)(*strict*)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac x f l c)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x f l c)(*strict*)\n   apply(force)\n  apply(rename_tac x f l c)(*strict*)\n  apply(force)\n  done\n\nlemma parserHF_fixed_in_parser_events: \"\n  valid_parser G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> set (parserHF_conf_fixed c1) \\<subseteq> parser_events G\"\n  apply(simp add: parserHF_configurations_def prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac x f l c)(*strict*)\n  apply (metis subsetD)\n  done\n\nlemma parserHF_not_bottom_end_then_no_bottom: \"\n  valid_parser G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parser_bottom G \\<notin> set (parserHF_conf_fixed c1)\"\n  apply(simp add: parserHF_configurations_def prefix_def suffix_def)\n  apply(clarsimp)\n  done\n\nlemma parserHF_step_not_turning_nonextendable_has_pop_prefix_closureeeding_fixed_appended_with_history_extension: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> c2 \\<in> parserHF_configurations G\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c @ w1\n  \\<Longrightarrow> \\<exists>x. rule_rpop e2 = x @ rule_rpush e2\n  \\<Longrightarrow> rule_rpop e2 \\<sqsubseteq> (parserHF_conf_fixed c @ w1)\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa ca)(*strict*)\n   apply(rule_tac\n      t=\"drop (length (parserHF_conf_fixed c)) (butlast_if_match (x @ rule_rpush e2) (parser_bottom G))\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac x xa ca)(*strict*)\n    apply (metis append_assoc drop_entire_butlast_if_match drop_length_append)\n   apply(rename_tac x xa ca)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHF_configurations_def)\n   apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(subgoal_tac \"drop (length x + length (rule_rpush e2)) (parserHF_conf_fixed c)=[]\")\n   apply(rename_tac x xa ca)(*strict*)\n   prefer 2\n   apply (metis length_append prefix_append prefix_drop_none)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"drop (length (parserHF_conf_fixed c)) (butlast_if_match (x @ rule_rpush e2) (parser_bottom G))=butlast_if_match ca (parser_bottom G)\")\n   apply(rename_tac x xa ca)(*strict*)\n   prefer 2\n   apply (metis drop_butlast_if_match_distrib)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"butlast_if_match ca (parser_bottom G) = ca\")\n   apply(rename_tac x xa ca)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(case_tac ca)\n   apply(rename_tac x xa ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: butlast_if_match_def)\n  apply(rename_tac x xa ca a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. ca = w' @ [x']\")\n   apply(rename_tac x xa ca a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac x xa ca a list)(*strict*)\n  apply(thin_tac \"ca = a # list\")\n  apply(clarsimp)\n  apply(rename_tac x xa w' x')(*strict*)\n  apply(simp add: suffix_def)\n  apply(case_tac \"x'=parser_bottom G\")\n   apply(rename_tac x xa w' x')(*strict*)\n   prefer 2\n   apply (metis butlast_if_match_direct2 rotate_simps)\n  apply(rename_tac x xa w' x')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa w')(*strict*)\n  apply(subgoal_tac \"False\")\n   apply(rename_tac x xa w')(*strict*)\n   apply(force)\n  apply(rename_tac x xa w')(*strict*)\n  apply(thin_tac \"length (parserHF_conf_fixed c) \\<le> length x + length (rule_rpush e2)\")\n  apply(subgoal_tac \"butlast_if_match (w' @ [parser_bottom G]) (parser_bottom G)=w'\")\n   apply(rename_tac x xa w')(*strict*)\n   prefer 2\n   apply (metis butlast_if_match_direct insert_Nil)\n  apply(rename_tac x xa w')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(thin_tac \"butlast_if_match (drop (length (parserHF_conf_fixed c)) (butlast_if_match (x @ rule_rpush e2) (parser_bottom G)) @ [parser_bottom G]) (parser_bottom G) = drop (length (parserHF_conf_fixed c)) (butlast_if_match (x @ rule_rpush e2) (parser_bottom G))\")\n  apply(rename_tac x xa)(*strict*)\n  apply(case_tac \"rule_rpush e2\")\n   apply(rename_tac x xa)(*strict*)\n   prefer 2\n   apply(rename_tac x xa a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. rule_rpush e2 = w' @ [x']\")\n    apply(rename_tac x xa a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac x xa a list)(*strict*)\n   apply(thin_tac \"rule_rpush e2 = a # list\")\n   apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e2\")\n   apply(rename_tac xa)(*strict*)\n   apply(simp add: valid_parser_step_label_def)\n   apply(clarsimp)\n   apply(rename_tac xa k w)(*strict*)\n   apply(erule_tac\n      x=\"parserHF_conf_fixed c @ drop (length (parserHF_conf_fixed c)) (butlast_if_match (kPrefix k (w @ [parser_bottom G])) (parser_bottom G))\"\n      in allE)\n   apply(rename_tac xa k w)(*strict*)\n   apply(force)\n  apply(rename_tac xa)(*strict*)\n  apply(simp add: valid_parser_def)\n  done\n\nlemma parserHF_step_fixed_with_modification_prefix_closureeeds_pop: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w1 @ w2\n  \\<Longrightarrow> w2 \\<noteq> []\n  \\<Longrightarrow> \\<exists>x. rule_rpop e1 = x @ rule_rpush e1\n  \\<Longrightarrow> (parserHF_conf_fixed c @ w1) \\<sqsubseteq> rule_rpop e1\"\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   prefer 2\n   apply(simp add: parserHF_step_relation_def)\n   apply(simp add: valid_parser_def)\n  apply(rule_tac\n      y=\"parserHF_conf_fixed c @ w1 @ w2\"\n      in prefix_transitive)\n   apply(simp add: prefix_def)\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa ca)(*strict*)\n   apply(subgoal_tac \"drop (length (parserHF_conf_fixed c)) (butlast_if_match (x @ rule_rpush e1) (parser_bottom G)) = []\")\n    apply(rename_tac x xa ca)(*strict*)\n    prefer 2\n    apply (metis concat_asso drop_entire_butlast_if_match drop_length_append)\n   apply(rename_tac x xa ca)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(subgoal_tac \"drop (length (parserHF_conf_fixed c)) (butlast_if_match (x @ rule_rpush e1) (parser_bottom G)) = butlast_if_match ca (parser_bottom G)\")\n   apply(rename_tac x xa ca)(*strict*)\n   prefer 2\n   apply (metis drop_butlast_if_match_distrib)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(clarsimp)\n  apply(thin_tac \"drop (length (parserHF_conf_fixed c)) (butlast_if_match (x @ rule_rpush e1) (parser_bottom G)) = butlast_if_match ca (parser_bottom G)\")\n  apply(rename_tac x xa ca)(*strict*)\n  apply(case_tac \"suffix ca [parser_bottom G]\")\n   apply(rename_tac x xa ca)(*strict*)\n   apply(rule_tac\n      x=\"[parser_bottom G]\"\n      in exI)\n   apply(simp add: suffix_def)\n   apply(clarsimp)\n   apply (metis butlast_if_match_direct rotate_simps)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(simp add: suffix_def)\n  apply (metis append_Nil2 append_assoc butlast_if_match_reduces)\n  done\n\nlemma parserHF_step_preserved_under_context_switch_with_minimal_requirements3: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> c' \\<in> parserHFS_configurations G\n  \\<Longrightarrow> c1 \\<in> parserHF_configurations G\n  \\<Longrightarrow> c2 \\<in> parserHF_configurations G\n  \\<Longrightarrow> parserHFS_step_relation G c' e1 c1'\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w1 @ w2\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c @ w1\n  \\<Longrightarrow> w2 \\<noteq> []\n  \\<Longrightarrow> parserHFvHFS_Lin2BraConf c' = c\n  \\<Longrightarrow> \\<exists>c2'. parserHFS_step_relation G c' e2 c2'\"\n  apply(rule parserHFS_minimal_step_prefix_closureondition)\n      apply(force)\n     apply(simp add: parserHF_step_relation_def)\n    apply(force)\n   apply(simp add: parserHF_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: parserHFS_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa xb xc y)(*strict*)\n   apply(simp add: suffix_def prefix_def parserHFvHFS_Lin2BraConf_def)\n   apply(clarsimp)\n   apply(rename_tac x xa xc y)(*strict*)\n   apply(metis)\n  apply(subgoal_tac \"\\<exists>x. rule_rpop e1 = x @ (rule_rpush e1)\")\n   prefer 2\n   apply(subgoal_tac \"valid_parser_step_label G e1\")\n    apply(simp add: valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac k w xa)(*strict*)\n    apply(metis)\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(subgoal_tac \"\\<exists>x. rule_rpop e2 = x @ (rule_rpush e2)\")\n   prefer 2\n   apply(subgoal_tac \"valid_parser_step_label G e2\")\n    apply(simp add: valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac x k w xb)(*strict*)\n    apply(metis)\n   apply(simp add: valid_parser_def parserHF_step_relation_def)\n  apply(rule_tac\n      y=\"rule_rpop e1\"\n      in prefix_transitive)\n   defer\n   apply(simp add: parserHFS_step_relation_def parserHFS_configurations_def parserHFvHFS_Lin2BraConf_def prefix_def)\n   apply(clarsimp)\n  apply(rule_tac\n      t=\"parserHFS_conf_fixed c'\"\n      and s=\"parserHF_conf_fixed c\"\n      in ssubst)\n   apply(simp add: parserHF_step_relation_def parserHFvHFS_Lin2BraConf_def parserHF_configurations_def)\n   apply(clarsimp)\n  apply(rule_tac\n      y=\"parserHF_conf_fixed c @ w1\"\n      in prefix_transitive)\n   apply(rule parserHF_step_not_turning_nonextendable_has_pop_prefix_closureeeding_fixed_appended_with_history_extension)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)+\n  apply(rule parserHF_step_fixed_with_modification_prefix_closureeeds_pop)\n        apply(force)+\n  done\n\nlemma parserHFS2HF_FEdetermHist_hlp3: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.is_forward_edge_deterministic_accessible G\n  \\<Longrightarrow> parserHF.derivation_initial G d\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_step_relation G c e2 c2\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ w1\n  \\<Longrightarrow> parserHF_conf_history c2 = parserHF_conf_history c @ w2\n  \\<Longrightarrow> w2 \\<noteq> w1\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> c \\<in> parserHF_configurations G\n  \\<Longrightarrow> ATS_History.history_fragment_prefixes parser_markers (@) G w2 \\<subseteq> ATS_History.history_fragment_prefixes parser_markers (@) G w1\n  \\<Longrightarrow> \\<not> parserHF_get_fixed_scheduler_DB G (derivation_append d (der2 c e2 c2) n) (Suc n) \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> e1 = e2\"\n  apply(subgoal_tac \"c1 \\<in> parserHF_configurations G\")\n   prefer 2\n   apply (metis parserHF.AX_step_relation_preserves_belongsC)\n  apply(subgoal_tac \"c2 \\<in> parserHF_configurations G\")\n   prefer 2\n   apply (metis parserHF.AX_step_relation_preserves_belongsC)\n  apply(subgoal_tac \"prefix w2 w1\")\n   prefer 2\n   apply(subgoal_tac \"ATS_History.history_fragment_prefixes parser_markers (@) G w2 \\<subseteq> ATS_History.history_fragment_prefixes parser_markers (@) G w1 = prefix w2 w1\")\n    apply(force)\n   apply(rule order_antisym) prefer 2\n    apply(simp add: parserHFS.history_fragment_prefixes_def)\n   apply(clarsimp)\n   apply(simp add: prefix_def)\n   apply(subgoal_tac \"w2 \\<in> {hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w1}\")\n    apply(force)\n   apply(rule_tac\n      A=\"{hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w2}\"\n      in set_mp)\n    apply(simp add: parserHFS.history_fragment_prefixes_def)\n   apply(clarsimp)\n   apply(simp add: parser_markers_def)\n   apply(rule_tac\n      B=\"set (parserHF_conf_history c2)\"\n      in subset_trans)\n    apply(force)\n   apply(rule_tac\n      B=\"parser_events G - {parser_bottom G}\"\n      in subset_trans)\n    apply(rule parserHF_history_in_parser_events_no_bottom)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(thin_tac \"ATS_History.history_fragment_prefixes parser_markers (@) G w2 \\<subseteq> ATS_History.history_fragment_prefixes parser_markers (@) G w1\")\n  apply(subgoal_tac \"\\<exists>x. w2@x=w1 \\<and> x\\<noteq>[]\")\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n  apply(thin_tac \"prefix w2 w1\")\n  apply(thin_tac \"w2\\<noteq>w1\")\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(rename_tac w1)\n  apply(rename_tac w1)(*strict*)\n  apply(subgoal_tac \"\\<not> suffix (parserHF_conf_fixed c2) [parser_bottom G]\")\n   apply(rename_tac w1)(*strict*)\n   prefer 2\n   apply(simp add: parserHF_get_fixed_scheduler_DB_def derivation_append_def der2_def get_configuration_def)\n  apply(rename_tac w1)(*strict*)\n  apply(thin_tac \"\\<not> parserHF_get_fixed_scheduler_DB G (derivation_append d (der2 c e2 c2) n) (Suc n) \\<sqsupseteq> [parser_bottom G]\")\n  apply(rename_tac w1)(*strict*)\n  apply(simp add: parserHFS.is_forward_edge_deterministic_accessible_def)\n  apply(subgoal_tac \"parserHFS.derivation_initial G (parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n))\")\n   apply(rename_tac w1)(*strict*)\n   prefer 2\n   apply(simp add: parserHFS.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac w1)(*strict*)\n    apply(rule parserHF_vs_parserHFS.Bra2LinDer_preserves_derivation)\n       apply(rename_tac w1)(*strict*)\n       apply(force)\n      apply(rename_tac w1)(*strict*)\n      apply(rule parserHF.derivation_append_preserves_derivation)\n        apply(rename_tac w1)(*strict*)\n        apply (metis parserHF.derivation_initial_is_derivation)\n       apply(rename_tac w1)(*strict*)\n       apply(rule parserHF.der2_is_derivation)\n       apply(force)\n      apply(rename_tac w1)(*strict*)\n      apply(clarsimp)\n      apply(simp add: der2_def)\n     apply(rename_tac w1)(*strict*)\n     apply(rule parserHF.derivation_append_preserves_belongs)\n       apply(rename_tac w1)(*strict*)\n       apply(force)\n      apply(rename_tac w1)(*strict*)\n      apply (metis parserHF.derivation_initial_belongs)\n     apply(rename_tac w1)(*strict*)\n     apply(rule parserHF.derivation_append_preserves_derivation)\n       apply(rename_tac w1)(*strict*)\n       apply (metis parserHF.derivation_initial_is_derivation)\n      apply(rename_tac w1)(*strict*)\n      apply(rule parserHF.der2_is_derivation)\n      apply(force)\n     apply(rename_tac w1)(*strict*)\n     apply(clarsimp)\n     apply(simp add: der2_def)\n    apply(rename_tac w1)(*strict*)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac w1)(*strict*)\n   apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n    apply(rename_tac w1)(*strict*)\n    prefer 2\n    apply (metis parserHF.derivation_initial_is_derivation parserHF.some_position_has_details_at_0)\n   apply(rename_tac w1)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac w1 ca)(*strict*)\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) 0\")\n    apply(rename_tac w1 ca)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac w1 ca a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac w1 ca a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac w1 ca option b)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n   apply(rule_tac\n      t=\"b\"\n      and s=\"parserHFvHFS_Bra2LinConf ca (parserHF_vs_parserHFS.Bra2LinDer' G (\\<lambda>x. if x \\<le> n then d x else if x - n = 0 then Some (pair None c) else if x - n = Suc 0 then Some (pair (Some e1) c1) else None) (Suc n) 0 @ (if parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] then parserHF_conf_fixed c1 else parserHF_conf_fixed c1 @ [parser_bottom G]))\"\n      in ssubst)\n    apply(rename_tac w1 ca option b)(*strict*)\n    apply(force)\n   apply(rename_tac w1 ca option b)(*strict*)\n   apply(rule parserHF_vs_parserHFS.AX_Bra2LinConf_preserves_initiality)\n     apply(rename_tac w1 ca option b)(*strict*)\n     apply(force)\n    apply(rename_tac w1 ca option b)(*strict*)\n    apply(subgoal_tac \" parserHF_vs_parserHFS.Bra2LinDer' SSG (derivation_append d (der2 c e1 c1) n) (Suc n) 0 \\<in> parser_scheduler_fragments SSG\" for SSG)\n     apply(rename_tac w1 ca option b)(*strict*)\n     prefer 2\n     apply(rule parserHF_vs_parserHFS.Bra2LinDer_prime_closed)\n         apply(rename_tac w1 ca option b)(*strict*)\n         apply(force)\n        apply(rename_tac w1 ca option b)(*strict*)\n        apply(rule parserHF.derivation_append_preserves_derivation)\n          apply(rename_tac w1 ca option b)(*strict*)\n          apply (metis parserHF.derivation_initial_is_derivation)\n         apply(rename_tac w1 ca option b)(*strict*)\n         apply(rule parserHF.der2_is_derivation)\n         apply(force)\n        apply(rename_tac w1 ca option b)(*strict*)\n        apply(clarsimp)\n        apply(rename_tac w1 ca)(*strict*)\n        apply(simp add: der2_def)\n       apply(rename_tac w1 ca option b)(*strict*)\n       apply (rule parserHF.derivation_initial_belongs)\n        apply(rename_tac w1 ca option b)(*strict*)\n        apply(force)\n       apply(rename_tac w1 ca option b)(*strict*)\n       apply(rule parserHF.derivation_append_preserves_derivation_initial)\n         apply(rename_tac w1 ca option b)(*strict*)\n         apply(force)\n        apply(rename_tac w1 ca option b)(*strict*)\n        apply(force)\n       apply(rename_tac w1 ca option b)(*strict*)\n       apply(rule parserHF.derivation_append_preserves_derivation)\n         apply(rename_tac w1 ca option b)(*strict*)\n         apply (metis parserHF.derivation_initial_is_derivation)\n        apply(rename_tac w1 ca option b)(*strict*)\n        apply(rule parserHF.der2_is_derivation)\n        apply(force)\n       apply(rename_tac w1 ca option b)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac w1 ca)(*strict*)\n       apply(simp add: der2_def)\n      apply(rename_tac w1 ca option b)(*strict*)\n      apply(simp add: derivation_append_def der2_def)\n     apply(rename_tac w1 ca option b)(*strict*)\n     apply(force)\n    apply(rename_tac w1 ca option b)(*strict*)\n    apply(simp add: parser_scheduler_fragments_def parser_schedulers_def)\n    apply(clarsimp)\n    apply(rename_tac w1 ca)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac w1 ca)(*strict*)\n     apply(clarsimp)\n     apply(simp add: suffix_def)\n     apply(clarsimp)\n     apply(rename_tac w1 ca caa)(*strict*)\n     apply(simp add: derivation_append_def der2_def)\n     apply(simp add: parserHF_configurations_def)\n     apply(clarsimp)\n    apply(rename_tac w1 ca)(*strict*)\n    apply(clarsimp)\n    apply(simp add: derivation_append_def der2_def)\n    apply(simp add: parserHF_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac w1 c f fb h l la lb w)(*strict*)\n    apply(simp add: suffix_def)\n   apply(rename_tac w1 ca option b)(*strict*)\n   apply(simp add: parserHF.derivation_initial_def)\n  apply(rename_tac w1)(*strict*)\n  apply(erule_tac\n      x=\"the(get_configuration(parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n))\"\n      in ballE)\n   apply(rename_tac w1)(*strict*)\n   prefer 2\n   apply(simp add: parserHFS.get_accessible_configurations_def)\n   apply(subgoal_tac \"False\")\n    apply(rename_tac w1)(*strict*)\n    apply(force)\n   apply(rename_tac w1)(*strict*)\n   apply(erule_tac\n      x=\"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n)\"\n      in allE)\n   apply(rename_tac w1)(*strict*)\n   apply(erule impE)\n    apply(rename_tac w1)(*strict*)\n    apply(force)\n   apply(rename_tac w1)(*strict*)\n   apply(erule_tac\n      x=\"n\"\n      in allE)\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n    apply(rename_tac w1)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac w1 a)(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(case_tac a)\n   apply(rename_tac w1 a option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac w1)(*strict*)\n  apply(erule_tac\n      x=\"the(get_configuration(parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) (Suc n)))\"\n      in allE)\n  apply(erule_tac\n      x=\"THE c2. parserHFS_step_relation G (the(get_configuration(parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n))) e2 c2\"\n      in allE)\n  apply(rename_tac w1)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in allE)\n  apply(erule_tac\n      x=\"e2\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac w1)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac w1)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac w1)(*strict*)\n   apply(rule_tac\n      d=\"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n)\"\n      and n=\"n\"\n      and ?e1.0=\"e\"\n      in parserHFS.position_change_due_to_step_relation)\n     apply(rename_tac w1)(*strict*)\n     apply(rule parserHFS.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac w1)(*strict*)\n    apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n     apply(rename_tac w1)(*strict*)\n     apply(clarsimp)\n     apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n     apply(simp add: derivation_append_def der2_def)\n    apply(rename_tac w1 a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac w1 a option b)(*strict*)\n    apply(simp add: get_configuration_def)\n    apply(clarsimp)\n    apply(rename_tac w1 option b)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac w1)(*strict*)\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) (Suc n)\")\n    apply(rename_tac w1)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac w1 a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac w1 a option b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac w1 option b)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac w1)(*strict*)\n  apply(rule HOL.theI')\n  apply(rule parserHFS_unique_step)\n   apply(rename_tac w1)(*strict*)\n   apply(force)\n  apply(rename_tac w1)(*strict*)\n  apply(rule parserHF_step_preserved_under_context_switch_with_minimal_requirements3)\n              apply(rename_tac w1)(*strict*)\n              apply(force)\n             apply(rename_tac w1)(*strict*)\n             prefer 3\n             apply(force)\n            apply(rename_tac w1)(*strict*)\n            apply(force)\n           apply(rename_tac w1)(*strict*)\n           apply(force)\n          apply(rename_tac w1)(*strict*)\n          prefer 2\n          apply(force)\n         apply(rename_tac w1)(*strict*)\n         prefer 2\n         apply(force)\n        apply(rename_tac w1)(*strict*)\n        prefer 2\n        apply(force)\n       apply(rename_tac w1)(*strict*)\n       prefer 2\n       apply(force)\n      apply(rename_tac w1)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac w1)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac w1)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac w1)(*strict*)\n   prefer 2\n   apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n    apply(rename_tac w1)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac w1 a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac w1 a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac w1 option b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(simp add: parserHFvHFS_Lin2BraConf_def)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n   apply(clarsimp)\n   apply(rename_tac w1)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac w1)(*strict*)\n    apply(clarsimp)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer'_def)\n    apply(subgoal_tac \"nat_seq n n=[n]\")\n     apply(rename_tac w1)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"nat_seq (Suc n) n=[]\")\n      apply(rename_tac w1)(*strict*)\n      apply(clarsimp)\n      apply(simp add: parserHFvHFS_Bra2LinStep_def)\n      apply(simp add: parserHFvHFS_Bra2LinConf_def)\n     apply(rename_tac w1)(*strict*)\n     apply (metis lessI nat_seqEmpty)\n    apply(rename_tac w1)(*strict*)\n    apply (metis natUptTo_n_n)\n   apply(rename_tac w1)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer'_def)\n   apply(subgoal_tac \"nat_seq n n=[n]\")\n    apply(rename_tac w1)(*strict*)\n    apply(subgoal_tac \"nat_seq (Suc n) n=[]\")\n     apply(rename_tac w1)(*strict*)\n     apply(clarsimp)\n     apply(simp add: parserHFvHFS_Bra2LinStep_def)\n     apply(simp add: parserHFvHFS_Bra2LinConf_def)\n    apply(rename_tac w1)(*strict*)\n    apply (metis lessI nat_seqEmpty)\n   apply(rename_tac w1)(*strict*)\n   apply (metis natUptTo_n_n)\n  apply(rename_tac w1)(*strict*)\n  apply(case_tac \"parserHF_vs_parserHFS.Bra2LinDer G (derivation_append d (der2 c e1 c1) n) (Suc n) n\")\n   apply(rename_tac w1)(*strict*)\n   apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac w1 a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac w1 a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac w1 option b)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(rule parserHFS.belongs_configurations)\n   apply(rename_tac w1 option b)(*strict*)\n   apply(rule parserHFS.derivation_initial_belongs)\n    apply(rename_tac w1 option b)(*strict*)\n    apply(force)\n   apply(rename_tac w1 option b)(*strict*)\n   apply(force)\n  apply(rename_tac w1 option b)(*strict*)\n  apply(force)\n  done\n\nlemma parserHFS_step_relation_slim_step_intro2: \"\n  valid_parser G\n  \\<Longrightarrow> c1 \\<in> parserHFS_configurations G\n  \\<Longrightarrow> e \\<in> parser_step_labels G\n  \\<Longrightarrow> suffix (parserHFS_conf_stack c1) (rule_lpop e)\n  \\<Longrightarrow> prefix (rule_rpop e) (parserHFS_conf_scheduler c1)\n  \\<Longrightarrow> \\<exists>c2. parserHFS_step_relation G c1 e c2\"\n  apply(simp add: parserHFS_step_relation_def)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac c ca)(*strict*)\n  apply(simp add: parser_step_labels_def)\n  apply(rule_tac x=\"\\<lparr>parserHFS_conf_fixed = rule_rpush e @\n           drop (length (rule_rpop e)) (parserHFS_conf_fixed c1),\n    parserHFS_conf_history = parserHFS_conf_history c1 @\n           drop (length (parserHFS_conf_fixed c1))\n            (butlast_if_match (rule_rpop e) (parser_bottom G)),\n    parserHFS_conf_stack = c @ rule_lpush e,\n    parserHFS_conf_scheduler = SSr\\<rparr> \" for SSr in exI)\n  apply(clarsimp)\n  apply(rule_tac x=\"ca\" in exI)\n  apply(rule conjI)\n   apply(rename_tac c ca)(*strict*)\n   apply(force)\n  apply(rename_tac c ca)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac c ca)(*strict*)\n   apply(force)\n  apply(rename_tac c ca)(*strict*)\n  apply(simp add: parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac c ca f h w)(*strict*)\n  apply(simp add: valid_parser_def)\n  apply(clarsimp)\n  apply(erule_tac x=\"e\" in ballE)\n   apply(rename_tac c ca f h w)(*strict*)\n   prefer 2\n   apply(simp add: parser_step_labels_def)\n  apply(rename_tac c ca f h w)(*strict*)\n  apply(simp add: valid_parser_step_label_def)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac c ca f w cb cc k wa xa)(*strict*)\n  apply(rule_tac xs=\"ca\" in rev_cases)\n   apply(rename_tac c ca f w cb cc k wa xa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c f w cb cc k wa xa x)(*strict*)\n   apply(rule_tac xs=\"rule_rpush e\" in rev_cases)\n    apply(rename_tac c f w cb cc k wa xa x)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac c f w cb cc k wa xa x ys y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c ca f w cb cc k wa xa ys y)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHF_extension_empty: \"\n  valid_parser G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> rule_rpop e1 = x @ rule_rpush e1\n  \\<Longrightarrow> prefix (rule_rpop e1) (parserHF_conf_fixed c)\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ hf2\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> hf2=[]\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac xa)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac xa parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac xa parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka parserHF_conf_fixedaa parserHF_conf_historyaa parserHF_conf_stackaa)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac xa parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka parserHF_conf_fixedaa parserHF_conf_historyaa parserHF_conf_stackaa rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac parserHF_conf_fixed rule_lpop rule_lpush rule_rpush)(*strict*)\n  apply(rename_tac f lp lpu rpu)\n  apply(rename_tac f lp lpu rpu)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac lp lpu rpu c)(*strict*)\n  apply(rule_tac xs=\"c\" in rev_cases)\n   apply(rename_tac lp lpu rpu c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac lp lpu rpu)(*strict*)\n   apply(rule_tac xs=\"rpu\" in rev_cases)\n    apply(rename_tac lp lpu rpu)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac lp lpu)(*strict*)\n    apply(rule_tac xs=\"x\" in rev_cases)\n     apply(rename_tac lp lpu)(*strict*)\n     apply(clarsimp)\n     apply(simp add: butlast_if_match_def)\n    apply(rename_tac lp lpu ys y)(*strict*)\n    apply(clarsimp)\n    apply(simp add: suffix_def)\n    apply(subgoal_tac \"butlast_if_match (ys @ [y]) (parser_bottom G) = ys@[y]\")\n     apply(rename_tac lp lpu ys y)(*strict*)\n     prefer 2\n     apply (metis butlast_if_match_direct2)\n    apply(rename_tac lp lpu ys y)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac lp lpu rpu ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac lp lpu ys y)(*strict*)\n   apply(subgoal_tac \"butlast_if_match ((x@ys) @ [y]) (parser_bottom G) = (x@ys)@[y]\")\n    apply(rename_tac lp lpu ys y)(*strict*)\n    prefer 2\n    apply(rule butlast_if_match_direct2)\n     apply(rename_tac lp lpu ys y)(*strict*)\n     apply(force)\n    apply(rename_tac lp lpu ys y)(*strict*)\n    apply(simp add: suffix_def)\n   apply(rename_tac lp lpu ys y)(*strict*)\n   apply(force)\n  apply(rename_tac lp lpu rpu c ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac lp lpu rpu ys y)(*strict*)\n  apply(subgoal_tac \"length (butlast_if_match (x @ rpu) (parser_bottom G)) \\<le> SSX\" for SSX)\n   apply(rename_tac lp lpu rpu ys y)(*strict*)\n   prefer 2\n   apply(rule butlast_if_match_length_le)\n  apply(rename_tac lp lpu rpu ys y)(*strict*)\n  apply(force)\n  done\n\nlemma parserHF_extension_fixed_and_pop: \"\n  parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> prefix (parserHF_conf_fixed c) (rule_rpop e1) \\<or> prefix (rule_rpop e1) (parserHF_conf_fixed c)\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  done\n\nlemma parserHF_extension_notempty: \"\n  valid_parser G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> rule_rpop e1 = x @ rule_rpush e1\n  \\<Longrightarrow> parserHF_conf_fixed c @ w = rule_rpop e1\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ hf2\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> w=hf2\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac xa)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac xa parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac xa parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka parserHF_conf_fixedaa parserHF_conf_historyaa parserHF_conf_stackaa)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac xa parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka parserHF_conf_fixedaa parserHF_conf_historyaa parserHF_conf_stackaa rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac parserHF_conf_fixed rule_lpop rule_lpush rule_rpush)(*strict*)\n  apply(rename_tac f lp lpu rpu)\n  apply(rename_tac f lp lpu rpu)(*strict*)\n  apply(case_tac \"f \\<sqsubseteq> x @ rpu\")\n   apply(rename_tac f lp lpu rpu)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n  apply(rename_tac f lp lpu rpu)(*strict*)\n  apply(clarsimp)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu rpu c)(*strict*)\n  apply(subgoal_tac \"w=c\")\n   apply(rename_tac f lp lpu rpu c)(*strict*)\n   prefer 2\n   apply (metis drop_prefix_closureise)\n  apply(rename_tac f lp lpu rpu c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu rpu)(*strict*)\n  apply(subgoal_tac \"drop (length x + length rpu) f = []\")\n   apply(rename_tac f lp lpu rpu)(*strict*)\n   prefer 2\n   apply(rule_tac t=\"length x+length rpu\" and s=\"length (f@w)\" in ssubst)\n    apply(rename_tac f lp lpu rpu)(*strict*)\n    apply(force)\n   apply(rename_tac f lp lpu rpu)(*strict*)\n   apply(simp (no_asm))\n  apply(rename_tac f lp lpu rpu)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac xs=\"rpu\" in rev_cases)\n   apply(rename_tac f lp lpu rpu)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f lp lpu)(*strict*)\n   apply(rule_tac xs=\"w\" in rev_cases)\n    apply(rename_tac f lp lpu)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac xs=\"f\" in rev_cases)\n     apply(rename_tac f lp lpu)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac lp lpu)(*strict*)\n     apply(simp add: butlast_if_match_def)\n    apply(rename_tac f lp lpu ys y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac lp lpu ys y)(*strict*)\n    apply(simp add: suffix_def)\n    apply(rule_tac t=\"butlast_if_match (ys @ [y]) (parser_bottom G)\" and s=\"ys @ [y]\" in ssubst)\n     apply(rename_tac lp lpu ys y)(*strict*)\n     apply (metis butlast_if_match_direct2)\n    apply(rename_tac lp lpu ys y)(*strict*)\n    apply(force)\n   apply(rename_tac f lp lpu ys y)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"y=parser_bottom G\")\n    apply(rename_tac f lp lpu ys y)(*strict*)\n    prefer 2\n    apply(rule_tac t=\"butlast_if_match ((f@ys) @ [y]) (parser_bottom G)\" and s=\"(f@ys) @ [y]\" in ssubst)\n     apply(rename_tac f lp lpu ys y)(*strict*)\n     apply (rule butlast_if_match_direct2)\n      apply(rename_tac f lp lpu ys y)(*strict*)\n      apply(force)\n     apply(rename_tac f lp lpu ys y)(*strict*)\n     apply(force)\n    apply(rename_tac f lp lpu ys y)(*strict*)\n    apply(simp add: valid_parser_def)\n    apply(clarsimp)\n    apply(erule_tac x=\"\\<lparr>rule_lpop = lp, rule_rpop = f @ ys @ [y], rule_lpush = lpu,\n          rule_rpush = []\\<rparr>\" in ballE)\n     apply(rename_tac f lp lpu ys y)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac f lp lpu ys y)(*strict*)\n    apply(simp add: valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac f lp lpu ys y k w)(*strict*)\n    apply(simp add: kPrefix_def)\n    apply(case_tac \"k-length w\")\n     apply(rename_tac f lp lpu ys y k w)(*strict*)\n     apply(clarsimp)\n     apply(rule_tac t=\"butlast_if_match (take k w) (parser_bottom G)\" and s=\"take k w\" in ssubst)\n      apply(rename_tac f lp lpu ys y k w)(*strict*)\n      apply (rule_tac v=\"f@ys\" and y=\"y\" in butlast_if_match_direct2)\n       apply(rename_tac f lp lpu ys y k w)(*strict*)\n       apply(force)\n      apply(rename_tac f lp lpu ys y k w)(*strict*)\n      apply(force)\n     apply(rename_tac f lp lpu ys y k w)(*strict*)\n     apply(rule_tac t=\"take k w\" and s=\"f @ ys @ [y]\" in ssubst)\n      apply(rename_tac f lp lpu ys y k w)(*strict*)\n      apply(force)\n     apply(rename_tac f lp lpu ys y k w)(*strict*)\n     apply(simp (no_asm))\n    apply(rename_tac f lp lpu ys y k w nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac f lp lpu ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f lp lpu ys)(*strict*)\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac x=\"\\<lparr>rule_lpop = lp, rule_rpop = f @ ys @ [parser_bottom G],\n          rule_lpush = lpu, rule_rpush = []\\<rparr>\" in ballE)\n    apply(rename_tac f lp lpu ys)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac f lp lpu ys)(*strict*)\n   apply(simp add: valid_parser_step_label_def)\n  apply(rename_tac f lp lpu rpu ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu ys y)(*strict*)\n  apply(simp add: suffix_def)\n  apply(rule_tac t=\"butlast_if_match (x @ ys @ [y]) (parser_bottom G)\" in ssubst)\n   apply(rename_tac f lp lpu ys y)(*strict*)\n   apply (rule_tac v=\"x @ ys\" and y=\"y\" in butlast_if_match_direct2)\n    apply(rename_tac f lp lpu ys y)(*strict*)\n    apply(force)\n   apply(rename_tac f lp lpu ys y)(*strict*)\n   apply(force)\n  apply(rename_tac f lp lpu ys y)(*strict*)\n  apply(rule_tac t=\"x@ys@[y]\" and s=\"f @ w\" in ssubst)\n   apply(rename_tac f lp lpu ys y)(*strict*)\n   apply(force)\n  apply(rename_tac f lp lpu ys y)(*strict*)\n  apply(simp (no_asm))\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step1_hlp1: \"\n  valid_parser G \\<Longrightarrow>\n    ATS.derivation_initial parserHF_initial_configurations\n     parserHF_step_relation G d \\<Longrightarrow>\n    parserHF_step_relation G c e1 c1 \\<Longrightarrow>\n    parserHF_step_relation G c e2 c2 \\<Longrightarrow>\n    d i = Some (pair e1a c) \\<Longrightarrow>\n    parserHF_conf_history c1 = parserHF_conf_history c @ hf2 \\<Longrightarrow>\n    parserHF_conf_history c2 = parserHF_conf_history c @ hf2 @ hf1 \\<Longrightarrow>\n    hf1 \\<noteq> [] \\<Longrightarrow>\n    hf1 \\<in> parser_markers G \\<Longrightarrow>\n    hf2 \\<in> parser_markers G \\<Longrightarrow>\n    \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow>\n    \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n       parserHFS_conf_history = parserHF_conf_history c,\n       parserHFS_conf_stack = parserHF_conf_stack c,\n       parserHFS_conf_scheduler = wi @ parserHF_conf_fixed c2 @ [parser_bottom G]\\<rparr>\n    \\<in> parserHFS_configurations G \\<Longrightarrow>\n    parserHFS_step_relation G\n     \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n        parserHFS_conf_history = parserHF_conf_history c,\n        parserHFS_conf_stack = parserHF_conf_stack c,\n        parserHFS_conf_scheduler = wi @ parserHF_conf_fixed c2 @ [parser_bottom G]\\<rparr>\n     e2 \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c2,\n           parserHFS_conf_history = parserHF_conf_history c @ hf2 @ hf1,\n           parserHFS_conf_stack = parserHF_conf_stack c2,\n           parserHFS_conf_scheduler =\n             wix @ parserHF_conf_fixed c2 @ [parser_bottom G]\\<rparr> \\<Longrightarrow>\n    \\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow>\n    Ex (parserHFS_step_relation G\n         \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n            parserHFS_conf_history = parserHF_conf_history c,\n            parserHFS_conf_stack = parserHF_conf_stack c,\n            parserHFS_conf_scheduler =\n              wi @ parserHF_conf_fixed c2 @ [parser_bottom G]\\<rparr>\n         e1)\"\n  apply(subgoal_tac \"parserHF_conf_fixed c \\<sqsubseteq>\n    wi @ parserHF_conf_fixed c2 @ [parser_bottom G]\")\n   prefer 2\n   apply(simp add: parserHFS_configurations_def)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac ca)(*strict*)\n  apply(rule_tac parserHFS_step_relation_slim_step_intro2)\n      apply(rename_tac ca)(*strict*)\n      apply(force)\n     apply(rename_tac ca)(*strict*)\n     apply(force)\n    apply(rename_tac ca)(*strict*)\n    apply(simp add: parserHF_step_relation_def parser_step_labels_def)\n   apply(rename_tac ca)(*strict*)\n   apply(clarsimp)\n   apply(simp add: parserHF_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac ca x xa)(*strict*)\n   apply(simp add: prefix_def suffix_def)\n  apply(rename_tac ca)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac ca)(*strict*)\n   prefer 2\n   apply(rule parserHF.AX_fixed_scheduler_extendable_translates_backwards)\n      apply(rename_tac ca)(*strict*)\n      apply(force)\n     apply(rename_tac ca)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac ca)(*strict*)\n    apply(rule_tac d=\"d\" in parserHF.belongs_configurations)\n     apply(rename_tac ca)(*strict*)\n     apply(rule parserHF.derivation_initial_belongs)\n      apply(rename_tac ca)(*strict*)\n      apply(force)\n     apply(rename_tac ca)(*strict*)\n     apply(force)\n    apply(rename_tac ca)(*strict*)\n    apply(force)\n   apply(rename_tac ca)(*strict*)\n   apply(force)\n  apply(rename_tac ca)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"valid_parser_step_label G e2\")\n   apply(rename_tac ca)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac x=\"e2\" in ballE)\n    apply(rename_tac ca)(*strict*)\n    prefer 2\n    apply(simp add: parserHF_step_relation_def)\n   apply(rename_tac ca)(*strict*)\n   apply(force)\n  apply(rename_tac ca)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   apply(rename_tac ca)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac x=\"e1\" in ballE)\n    apply(rename_tac ca)(*strict*)\n    prefer 2\n    apply(simp add: parserHF_step_relation_def)\n   apply(rename_tac ca)(*strict*)\n   apply(force)\n  apply(rename_tac ca)(*strict*)\n  apply(subgoal_tac \"(\\<exists>x. x @ rule_rpush e1 = rule_rpop e1)\")\n   apply(rename_tac ca)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_step_label_def)\n  apply(rename_tac ca)(*strict*)\n  apply(subgoal_tac \"(\\<exists>x. x @ rule_rpush e2 = rule_rpop e2)\")\n   apply(rename_tac ca)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_step_label_def)\n  apply(rename_tac ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ca x xa)(*strict*)\n  apply(case_tac \"prefix (rule_rpop e2) (parserHF_conf_fixed c)\")\n   apply(rename_tac ca x xa)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac ca x xa)(*strict*)\n    prefer 2\n    apply(rule_tac ?e1.0=\"e2\" and x=\"xa\" in parserHF_extension_empty)\n         apply(rename_tac ca x xa)(*strict*)\n         apply(force)\n        apply(rename_tac ca x xa)(*strict*)\n        apply(force)\n       apply(rename_tac ca x xa)(*strict*)\n       apply(force)\n      apply(rename_tac ca x xa)(*strict*)\n      apply(force)\n     apply(rename_tac ca x xa)(*strict*)\n     apply(force)\n    apply(rename_tac ca x xa)(*strict*)\n    apply(force)\n   apply(rename_tac ca x xa)(*strict*)\n   apply(force)\n  apply(rename_tac ca x xa)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac ca x xa)(*strict*)\n   prefer 2\n   apply(rule_tac ?e1.0=\"e2\" in parserHF_extension_fixed_and_pop)\n   apply(force)\n  apply(rename_tac ca x xa)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac ca x xa)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac ca x xa)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac ca x xa caa)(*strict*)\n  apply(rule_tac xs=\"caa\" in rev_cases)\n   apply(rename_tac ca x xa caa)(*strict*)\n   apply(force)\n  apply(rename_tac ca x xa caa ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ca x xa ys y)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac ca x xa ys y)(*strict*)\n   prefer 2\n   apply(rule_tac ?e1.0=\"e1\" in parserHF_extension_fixed_and_pop)\n   apply(force)\n  apply(rename_tac ca x xa ys y)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac ca x xa ys y)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac ca x xa ys y caa)(*strict*)\n   apply(rule_tac t=\"wi @ parserHF_conf_fixed c2 @ [parser_bottom G]\" and s=\"parserHF_conf_fixed c @ ca\" in ssubst)\n    apply(rename_tac ca x xa ys y caa)(*strict*)\n    apply(force)\n   apply(rename_tac ca x xa ys y caa)(*strict*)\n   apply(rule_tac t=\"parserHF_conf_fixed c\" and s=\"rule_rpop e1 @ caa\" in ssubst)\n    apply(rename_tac ca x xa ys y caa)(*strict*)\n    apply(force)\n   apply(rename_tac ca x xa ys y caa)(*strict*)\n   apply(rule_tac x=\"caa@ca\" in exI)\n   apply(simp (no_asm))\n  apply(rename_tac ca x xa ys y)(*strict*)\n  apply(simp add: prefix_def)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac ca x xa ys y)(*strict*)\n   prefer 2\n   apply(rule_tac x=\"xa\" and ?e1.0=\"e2\" in parserHF_extension_notempty)\n         apply(rename_tac ca x xa ys y)(*strict*)\n         apply(force)\n        apply(rename_tac ca x xa ys y)(*strict*)\n        apply(force)\n       apply(rename_tac ca x xa ys y)(*strict*)\n       apply(force)\n      apply(rename_tac ca x xa ys y)(*strict*)\n      apply(force)\n     apply(rename_tac ca x xa ys y)(*strict*)\n     apply(force)\n    apply(rename_tac ca x xa ys y)(*strict*)\n    apply(force)\n   apply(rename_tac ca x xa ys y)(*strict*)\n   apply(force)\n  apply(rename_tac ca x xa ys y)(*strict*)\n  apply(rule_tac xs=\"hf1\" in rev_cases)\n   apply(rename_tac ca x xa ys y)(*strict*)\n   apply(force)\n  apply(rename_tac ca x xa ys y ysa ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ca x xa ysa ya caa)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac ca x xa ysa ya caa)(*strict*)\n   prefer 2\n   apply(rule_tac ?e1.0=\"e1\" and x=\"x\" in parserHF_extension_notempty)\n         apply(rename_tac ca x xa ysa ya caa)(*strict*)\n         apply(force)\n        apply(rename_tac ca x xa ysa ya caa)(*strict*)\n        apply(force)\n       apply(rename_tac ca x xa ysa ya caa)(*strict*)\n       apply(force)\n      apply(rename_tac ca x xa ysa ya caa)(*strict*)\n      apply(force)\n     apply(rename_tac ca x xa ysa ya caa)(*strict*)\n     apply(force)\n    apply(rename_tac ca x xa ysa ya caa)(*strict*)\n    apply(force)\n   apply(rename_tac ca x xa ysa ya caa)(*strict*)\n   apply(force)\n  apply(rename_tac ca x xa ysa ya caa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ca x xa ysa ya)(*strict*)\n  apply(thin_tac \"\\<forall>ca. rule_rpop e2 @ ca \\<noteq> parserHF_conf_fixed c\")\n  apply(rule_tac xs=\"ca\" in rev_cases)\n   apply(rename_tac ca x xa ysa ya)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa ysa ya)(*strict*)\n   apply(simp add: suffix_def)\n  apply(rename_tac ca x xa ysa ya ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa ysa ya ys)(*strict*)\n  apply(subgoal_tac \"parserHF_conf_fixed c2 = rule_rpush e2\")\n   apply(rename_tac x xa ysa ya ys)(*strict*)\n   prefer 2\n   apply(simp add: parserHF_step_relation_def)\n   apply(rule_tac t=\"rule_rpop e2\" and s=\"parserHF_conf_fixed c @\n       drop (length (parserHF_conf_fixed c))\n        (butlast_if_match (rule_rpop e2) (parser_bottom G))\" in ssubst)\n    apply(rename_tac x xa ysa ya ys)(*strict*)\n    apply(force)\n   apply(rename_tac x xa ysa ya ys)(*strict*)\n   apply(simp (no_asm))\n  apply(rename_tac x xa ysa ya ys)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac t=\"rule_rpop e1\" and s=\"parserHF_conf_fixed c @ hf2\" in ssubst)\n   apply(rename_tac x xa ysa ya ys)(*strict*)\n   apply(force)\n  apply(rename_tac x xa ysa ya ys)(*strict*)\n  apply(subgoal_tac \"\\<exists>ca. (parserHF_conf_fixed c @ hf2) @ ca =\n            wi @ rule_rpush e2\")\n   apply(rename_tac x xa ysa ya ys)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac x xa ysa ya ys ca)(*strict*)\n   apply(rule_tac x=\"ca@[parser_bottom G]\" in exI)\n   apply(force)\n  apply(rename_tac x xa ysa ya ys)(*strict*)\n  apply(subgoal_tac \"prefix (parserHF_conf_fixed c) wi \\<or> SSX\" for SSX)\n   apply(rename_tac x xa ysa ya ys)(*strict*)\n   prefer 2\n   apply(rule_tac mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac x xa ysa ya ys)(*strict*)\n  apply(subgoal_tac \"prefix (parserHF_conf_fixed c) xa  \\<or> SSX\" for SSX)\n   apply(rename_tac x xa ysa ya ys)(*strict*)\n   prefer 2\n   apply(rule_tac b=\"hf2 @ ysa @ [ya]\" and d=\"rule_rpush e2\" in mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac x xa ysa ya ys)(*strict*)\n  apply(erule disjE)+\n    apply(rename_tac x xa ysa ya ys)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x ysa ya ca caa)(*strict*)\n    apply(simp add: parserHFS_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac x ysa ya ca caa xa xb)(*strict*)\n    apply(rule_tac xs=\"xb\" in rev_cases)\n     apply(rename_tac x ysa ya ca caa xa xb)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x ysa ya ca caa xa xb ys y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x ysa ya ca caa xa ys)(*strict*)\n    apply(subgoal_tac \"butlast_if_match (rule_rpop e2) (parser_bottom G) = rule_rpop e2\")\n     apply(rename_tac x ysa ya ca caa xa ys)(*strict*)\n     prefer 2\n     apply (metis Nil_is_append_conv butlast_if_match_pull_out drop_butlast_if_match_distrib not_Cons_self2)\n    apply(rename_tac x ysa ya ca caa xa ys)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"drop (length (parserHF_conf_fixed c)) (rule_rpop e2) = caa @ rule_rpush e2\")\n     apply(rename_tac x ysa ya ca caa xa ys)(*strict*)\n     prefer 2\n     apply (metis same_append_eq)\n    apply(rename_tac x ysa ya ca caa xa ys)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"prefix hf2 caa \\<or> SSX\" for SSX)\n     apply(rename_tac x ysa ya ca caa xa ys)(*strict*)\n     prefer 2\n     apply(rule_tac mutual_prefix_prefix)\n     apply(force)\n    apply(rename_tac x ysa ya ca caa xa ys)(*strict*)\n    apply(erule disjE)\n     apply(rename_tac x ysa ya ca caa xa ys)(*strict*)\n     apply(simp add: prefix_def)\n     apply(clarsimp)\n     apply(rename_tac x ysa ya ca xa ys cb)(*strict*)\n     apply(rule_tac t=\"rule_rpop e2\" and s=\"parserHF_conf_fixed c @ hf2 @ cb @ rule_rpush e2\" in ssubst)\n      apply(rename_tac x ysa ya ca xa ys cb)(*strict*)\n      apply(force)\n     apply(rename_tac x ysa ya ca xa ys cb)(*strict*)\n     apply(rule_tac t=\"rule_rpop e1\" and s=\"parserHF_conf_fixed c @ hf2\" in ssubst)\n      apply(rename_tac x ysa ya ca xa ys cb)(*strict*)\n      apply(force)\n     apply(rename_tac x ysa ya ca xa ys cb)(*strict*)\n     apply(rule_tac x=\"cb @ rule_rpush e2 @ ys\" in exI)\n     apply(simp (no_asm))\n    apply(rename_tac x ysa ya ca caa xa ys)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x ysa ya ca caa xa ys cb)(*strict*)\n    apply(rule_tac t=\"rule_rpop e2\" and s=\"parserHF_conf_fixed c @ caa @ rule_rpush e2\" in ssubst)\n     apply(rename_tac x ysa ya ca caa xa ys cb)(*strict*)\n     apply(force)\n    apply(rename_tac x ysa ya ca caa xa ys cb)(*strict*)\n    apply(rule_tac t=\"rule_rpush e2\" and s=\"cb @ ysa @ [ya]\" in ssubst)\n     apply(rename_tac x ysa ya ca caa xa ys cb)(*strict*)\n     apply(force)\n    apply(rename_tac x ysa ya ca caa xa ys cb)(*strict*)\n    apply(rule_tac t=\"rule_rpop e1\" and s=\"parserHF_conf_fixed c @ caa @ cb \" in ssubst)\n     apply(rename_tac x ysa ya ca caa xa ys cb)(*strict*)\n     apply(force)\n    apply(rename_tac x ysa ya ca caa xa ys cb)(*strict*)\n    apply(rule_tac x=\"ysa @ [ya] @ ys\" in exI)\n    apply(simp (no_asm))\n   apply(rename_tac x xa ysa ya ys)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa ysa ya ca caa)(*strict*)\n   apply(simp add: parserHFS_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa ysa ya ca caa xb xc)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (rule_rpop e2) (parser_bottom G) = rule_rpop e2\")\n    apply(rename_tac x xa ysa ya ca caa xb xc)(*strict*)\n    prefer 2\n    apply (metis Nil_is_append_conv butlast_if_match_pull_out drop_butlast_if_match_distrib not_Cons_self2)\n   apply(rename_tac x xa ysa ya ca caa xb xc)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac xs=\"xc\" in rev_cases)\n    apply(rename_tac x xa ysa ya ca caa xb xc)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x xa ysa ya ca caa xb xc ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa ysa ya ca caa xb ys)(*strict*)\n   apply(subgoal_tac \"prefix (parserHF_conf_fixed c) (rule_rpop e2) \\<or> SSX\" for SSX)\n    apply(rename_tac x xa ysa ya ca caa xb ys)(*strict*)\n    prefer 2\n    apply(rule_tac mutual_prefix_prefix)\n    apply(force)\n   apply(rename_tac x xa ysa ya ca caa xb ys)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac x xa ysa ya ca caa xb ys)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x xa ysa ya ca caa xb ys cb)(*strict*)\n    apply (metis Nil_is_append_conv drop_eq_Nil drop_length_append snoc_eq_iff_butlast)\n   apply(rename_tac x xa ysa ya ca caa xb ys)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa ysa ya ca caa xb ys cb)(*strict*)\n   apply(subgoal_tac \"ca @ rule_rpush e2 = cb @ ys\")\n    apply(rename_tac x xa ysa ya ca caa xb ys cb)(*strict*)\n    prefer 2\n    apply (metis drop_append append_assoc)\n   apply(rename_tac x xa ysa ya ca caa xb ys cb)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"prefix ca cb \\<or> SSX\" for SSX)\n    apply(rename_tac x xa ysa ya ca caa xb ys cb)(*strict*)\n    prefer 2\n    apply(rule_tac mutual_prefix_prefix)\n    apply(force)\n   apply(rename_tac x xa ysa ya ca caa xb ys cb)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac x xa ysa ya ca caa xb ys cb)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x xa ysa ya ca xb cb cc)(*strict*)\n    apply(subgoal_tac \"drop (length (parserHF_conf_fixed c)) (rule_rpop e2) = cb\")\n     apply(rename_tac x xa ysa ya ca xb cb cc)(*strict*)\n     prefer 2\n     apply (metis same_append_eq)\n    apply(rename_tac x xa ysa ya ca xb cb cc)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xa ysa ya ca xb cc)(*strict*)\n    apply(rule_tac t=\"rule_rpop e2\" and s=\"parserHF_conf_fixed c @ hf2 @ ysa @ [ya]\" in ssubst)\n     apply(rename_tac x xa ysa ya ca xb cc)(*strict*)\n     apply(force)\n    apply(rename_tac x xa ysa ya ca xb cc)(*strict*)\n    apply(rule_tac t=\"rule_rpop e1\" and s=\"parserHF_conf_fixed c @ hf2\" in ssubst)\n     apply(rename_tac x xa ysa ya ca xb cc)(*strict*)\n     apply(force)\n    apply(rename_tac x xa ysa ya ca xb cc)(*strict*)\n    apply(rule_tac x=\"ysa @ [ya] @ cc @ rule_rpush e2\" in exI)\n    apply(simp (no_asm))\n   apply(rename_tac x xa ysa ya ca caa xb ys cb)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa ysa ya ca caa xb ys cc)(*strict*)\n   apply(subgoal_tac \"drop (length (parserHF_conf_fixed c)) (rule_rpop e2) = ca@cc\")\n    apply(rename_tac x xa ysa ya ca caa xb ys cc)(*strict*)\n    prefer 2\n    apply (metis same_append_eq)\n   apply(rename_tac x xa ysa ya ca caa xb ys cc)(*strict*)\n   apply(clarsimp)\n   apply(thin_tac \"drop (length (parserHF_conf_fixed c)) (rule_rpop e2) = ca @ cc\")\n   apply(thin_tac \"butlast_if_match (rule_rpop e2) (parser_bottom G) = rule_rpop e2\")\n   apply (metis append_eq_append_conv2)\n  apply(rename_tac x xa ysa ya ys)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x xa ysa ya ys ca)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x xa ysa ya ys ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x ysa ya ys ca caa)(*strict*)\n   apply(simp add: parserHFS_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x ysa ya ys ca caa xa xb)(*strict*)\n   apply(rule_tac xs=\"xb\" in rev_cases)\n    apply(rename_tac x ysa ya ys ca caa xa xb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x ysa ya ys ca caa xa xb ysb y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x ysa ya ys ca caa xa ysb)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (rule_rpop e2) (parser_bottom G) = rule_rpop e2\")\n    apply(rename_tac x ysa ya ys ca caa xa ysb)(*strict*)\n    prefer 2\n    apply (metis Nil_is_append_conv butlast_if_match_pull_out drop_butlast_if_match_distrib not_Cons_self2)\n   apply(rename_tac x ysa ya ys ca caa xa ysb)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"drop (length (parserHF_conf_fixed c)) (rule_rpop e2) = caa @ rule_rpush e2\")\n    apply(rename_tac x ysa ya ys ca caa xa ysb)(*strict*)\n    prefer 2\n    apply (metis same_append_eq)\n   apply(rename_tac x ysa ya ys ca caa xa ysb)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"prefix hf2 caa \\<or> SSX\" for SSX)\n    apply(rename_tac x ysa ya ys ca caa xa ysb)(*strict*)\n    prefer 2\n    apply(rule_tac mutual_prefix_prefix)\n    apply(force)\n   apply(rename_tac x ysa ya ys ca caa xa ysb)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac x ysa ya ys ca caa xa ysb)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x ysa ya ys ca xa ysb cb)(*strict*)\n    apply(rule_tac t=\"rule_rpop e2\" and s=\"parserHF_conf_fixed c @ hf2 @ cb @ rule_rpush e2\" in ssubst)\n     apply(rename_tac x ysa ya ys ca xa ysb cb)(*strict*)\n     apply(force)\n    apply(rename_tac x ysa ya ys ca xa ysb cb)(*strict*)\n    apply(rule_tac t=\"rule_rpop e1\" and s=\"parserHF_conf_fixed c @ hf2\" in ssubst)\n     apply(rename_tac x ysa ya ys ca xa ysb cb)(*strict*)\n     apply(force)\n    apply(rename_tac x ysa ya ys ca xa ysb cb)(*strict*)\n    apply(rule_tac x=\"cb @ rule_rpush e2 @ ysb\" in exI)\n    apply(simp (no_asm))\n   apply(rename_tac x ysa ya ys ca caa xa ysb)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x ysa ya ys ca caa xa ysb cb)(*strict*)\n   apply(rule_tac t=\"rule_rpop e2\" and s=\"parserHF_conf_fixed c @ caa @ rule_rpush e2\" in ssubst)\n    apply(rename_tac x ysa ya ys ca caa xa ysb cb)(*strict*)\n    apply(force)\n   apply(rename_tac x ysa ya ys ca caa xa ysb cb)(*strict*)\n   apply(rule_tac t=\"rule_rpush e2\" and s=\"cb @ ysa @ [ya]\" in ssubst)\n    apply(rename_tac x ysa ya ys ca caa xa ysb cb)(*strict*)\n    apply(force)\n   apply(rename_tac x ysa ya ys ca caa xa ysb cb)(*strict*)\n   apply(rule_tac t=\"rule_rpop e1\" and s=\"parserHF_conf_fixed c @ caa @ cb \" in ssubst)\n    apply(rename_tac x ysa ya ys ca caa xa ysb cb)(*strict*)\n    apply(force)\n   apply(rename_tac x ysa ya ys ca caa xa ysb cb)(*strict*)\n   apply(rule_tac x=\"ysa @ [ya] @ ysb\" in exI)\n   apply(simp (no_asm))\n  apply(rename_tac x xa ysa ya ys ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa ysa ya ys ca caa)(*strict*)\n  apply(simp add: parserHFS_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x xa ysa ya ys ca caa xb xc)(*strict*)\n  apply(subgoal_tac \"butlast_if_match (rule_rpop e2) (parser_bottom G) = rule_rpop e2\")\n   apply(rename_tac x xa ysa ya ys ca caa xb xc)(*strict*)\n   prefer 2\n   apply (metis Nil_is_append_conv butlast_if_match_pull_out drop_butlast_if_match_distrib not_Cons_self2)\n  apply(rename_tac x xa ysa ya ys ca caa xb xc)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac xs=\"xc\" in rev_cases)\n   apply(rename_tac x xa ysa ya ys ca caa xb xc)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x xa ysa ya ys ca caa xb xc ysb y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa ysa ya ys ca caa xb ysb)(*strict*)\n  apply(subgoal_tac \"prefix (parserHF_conf_fixed c) (rule_rpop e2) \\<or> SSX\" for SSX)\n   apply(rename_tac x xa ysa ya ys ca caa xb ysb)(*strict*)\n   prefer 2\n   apply(rule_tac mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac x xa ysa ya ys ca caa xb ysb)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x xa ysa ya ys ca caa xb ysb)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa ysa ya ys ca caa xb ysb cb)(*strict*)\n   apply (metis Nil_is_append_conv drop_eq_Nil drop_length_append snoc_eq_iff_butlast)\n  apply(rename_tac x xa ysa ya ys ca caa xb ysb)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x xa ysa ya ys ca caa xb ysb cb)(*strict*)\n  apply(subgoal_tac \"prefix wi xa \\<or> SSX\" for SSX)\n   apply(rename_tac x xa ysa ya ys ca caa xb ysb cb)(*strict*)\n   prefer 2\n   apply(rule_tac b=\"ca\" and d=\"caa\" in mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac x xa ysa ya ys ca caa xb ysb cb)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x xa ysa ya ys ca caa xb ysb cb)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa ysa ya ys ca caa xb ysb cb cc)(*strict*)\n   apply(subgoal_tac \"caa=cc@ca\")\n    apply(rename_tac x xa ysa ya ys ca caa xb ysb cb cc)(*strict*)\n    prefer 2\n    apply (metis same_append_eq)\n   apply(rename_tac x xa ysa ya ys ca caa xb ysb cb cc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa ysa ya ys ca xb ysb cb cc)(*strict*)\n   apply(subgoal_tac \"drop (length (parserHF_conf_fixed c)) (rule_rpop e2) = cb\")\n    apply(rename_tac x xa ysa ya ys ca xb ysb cb cc)(*strict*)\n    prefer 2\n    apply (metis same_append_eq)\n   apply(rename_tac x xa ysa ya ys ca xb ysb cb cc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa ysa ya ys ca xb ysb cc)(*strict*)\n   apply(rule_tac t=\"rule_rpop e2\" and s=\"parserHF_conf_fixed c @ hf2 @ ysa @ [ya]\" in ssubst)\n    apply(rename_tac x xa ysa ya ys ca xb ysb cc)(*strict*)\n    apply(force)\n   apply(rename_tac x xa ysa ya ys ca xb ysb cc)(*strict*)\n   apply(rule_tac t=\"rule_rpop e1\" and s=\"parserHF_conf_fixed c @ hf2\" in ssubst)\n    apply(rename_tac x xa ysa ya ys ca xb ysb cc)(*strict*)\n    apply(force)\n   apply(rename_tac x xa ysa ya ys ca xb ysb cc)(*strict*)\n   apply(rule_tac x=\"ysa @ [ya] @ ysb\" in exI)\n   apply(simp (no_asm))\n  apply(rename_tac x xa ysa ya ys ca caa xb ysb cb)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x ysa ya ys ca caa xb ysb cb cc)(*strict*)\n  apply(subgoal_tac \"ca=cc@caa\")\n   apply(rename_tac x ysa ya ys ca caa xb ysb cb cc)(*strict*)\n   prefer 2\n   apply (metis same_append_eq)\n  apply(rename_tac x ysa ya ys ca caa xb ysb cb cc)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x ysa ya ys ca xb ysb cb cc)(*strict*)\n  apply(subgoal_tac \"drop (length (parserHF_conf_fixed c)) (rule_rpop e2) = cb\")\n   apply(rename_tac x ysa ya ys ca xb ysb cb cc)(*strict*)\n   prefer 2\n   apply (metis same_append_eq)\n  apply(rename_tac x ysa ya ys ca xb ysb cb cc)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x ysa ya ys ca xb ysb cc)(*strict*)\n  apply(rule_tac t=\"rule_rpop e2\" and s=\"parserHF_conf_fixed c @ hf2 @ ysa @ [ya]\" in ssubst)\n   apply(rename_tac x ysa ya ys ca xb ysb cc)(*strict*)\n   apply(force)\n  apply(rename_tac x ysa ya ys ca xb ysb cc)(*strict*)\n  apply(rule_tac t=\"rule_rpop e1\" and s=\"parserHF_conf_fixed c @ hf2\" in ssubst)\n   apply(rename_tac x ysa ya ys ca xb ysb cc)(*strict*)\n   apply(force)\n  apply(rename_tac x ysa ya ys ca xb ysb cc)(*strict*)\n  apply(rule_tac x=\"ysa @ [ya] @ ysb\" in exI)\n  apply(simp (no_asm))\n  done\n\nlemma parserHF_extension_notempty_fixed_scheduler: \"\n  valid_parser G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> rule_rpop e1 = x @ rule_rpush e1\n  \\<Longrightarrow> parserHF_conf_fixed c @ w = rule_rpop e1\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c @ hf2\n  \\<Longrightarrow> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<not> parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\n  \\<Longrightarrow> \\<exists>v. w=v@[parser_bottom G] \\<and> v=hf2\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac xa)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac xa parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac xa parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka parserHF_conf_fixedaa parserHF_conf_historyaa parserHF_conf_stackaa)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac xa parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka parserHF_conf_fixedaa parserHF_conf_historyaa parserHF_conf_stackaa rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac parserHF_conf_fixed rule_lpop rule_lpush rule_rpush)(*strict*)\n  apply(rename_tac f lp lpu rpu)\n  apply(rename_tac f lp lpu rpu)(*strict*)\n  apply(case_tac \"f \\<sqsubseteq> x @ rpu\")\n   apply(rename_tac f lp lpu rpu)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n  apply(rename_tac f lp lpu rpu)(*strict*)\n  apply(clarsimp)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu rpu c)(*strict*)\n  apply(subgoal_tac \"w=c\")\n   apply(rename_tac f lp lpu rpu c)(*strict*)\n   prefer 2\n   apply (metis drop_prefix_closureise)\n  apply(rename_tac f lp lpu rpu c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu rpu)(*strict*)\n  apply(subgoal_tac \"drop (length x + length rpu) f = []\")\n   apply(rename_tac f lp lpu rpu)(*strict*)\n   prefer 2\n   apply(rule_tac t=\"length x+length rpu\" and s=\"length (f@w)\" in ssubst)\n    apply(rename_tac f lp lpu rpu)(*strict*)\n    apply(force)\n   apply(rename_tac f lp lpu rpu)(*strict*)\n   apply(simp (no_asm))\n  apply(rename_tac f lp lpu rpu)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac xs=\"rpu\" in rev_cases)\n   apply(rename_tac f lp lpu rpu)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f lp lpu)(*strict*)\n   apply(simp add: suffix_def)\n  apply(rename_tac f lp lpu rpu ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu ys y)(*strict*)\n  apply(simp add: suffix_def)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu ys)(*strict*)\n  apply(rule_tac xs=\"w\" in rev_cases)\n   apply(rename_tac f lp lpu ys)(*strict*)\n   apply(force)\n  apply(rename_tac f lp lpu ys ysa y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu ys ysa)(*strict*)\n  apply(rule_tac t=\"butlast_if_match (x @ ys @ [parser_bottom G]) (parser_bottom G)\" and s=\"x@ys\" in ssubst)\n   apply(rename_tac f lp lpu ys ysa)(*strict*)\n   apply(rule_tac t=\"x @ ys @ [parser_bottom G]\" and s=\"(x @ ys) @ [parser_bottom G]\" in ssubst)\n    apply(rename_tac f lp lpu ys ysa)(*strict*)\n    apply(force)\n   apply(rename_tac f lp lpu ys ysa)(*strict*)\n   apply (rule_tac butlast_if_match_direct)\n   apply(force)\n  apply(rename_tac f lp lpu ys ysa)(*strict*)\n  apply(rule_tac t=\"x@ys\" and s=\"f @ ysa\" in ssubst)\n   apply(rename_tac f lp lpu ys ysa)(*strict*)\n   apply(force)\n  apply(rename_tac f lp lpu ys ysa)(*strict*)\n  apply(simp (no_asm))\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step1_hlp2: \"\nvalid_parser G \\<Longrightarrow>\n    ATS.derivation_initial parserHF_initial_configurations\n     parserHF_step_relation G d \\<Longrightarrow>\n    parserHF_step_relation G c e1 c1 \\<Longrightarrow>\n    parserHF_step_relation G c e2 c2 \\<Longrightarrow>\n    d i = Some (pair e1a c) \\<Longrightarrow>\n    parserHF_conf_history c1 = parserHF_conf_history c @ hf2 \\<Longrightarrow>\n    parserHF_conf_history c2 = parserHF_conf_history c @ hf2 @ hf1 \\<Longrightarrow>\n    hf1 \\<noteq> [] \\<Longrightarrow>\n    hf1 \\<in> parser_markers G \\<Longrightarrow>\n    hf2 \\<in> parser_markers G \\<Longrightarrow>\n    \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow>\n    \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n       parserHFS_conf_history = parserHF_conf_history c,\n       parserHFS_conf_stack = parserHF_conf_stack c,\n       parserHFS_conf_scheduler = wi @ parserHF_conf_fixed c2\\<rparr>\n    \\<in> parserHFS_configurations G \\<Longrightarrow>\n    parserHFS_step_relation G\n     \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n        parserHFS_conf_history = parserHF_conf_history c,\n        parserHFS_conf_stack = parserHF_conf_stack c,\n        parserHFS_conf_scheduler = wi @ parserHF_conf_fixed c2\\<rparr>\n     e2 \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c2,\n           parserHFS_conf_history = parserHF_conf_history c @ hf2 @ hf1,\n           parserHFS_conf_stack = parserHF_conf_stack c2,\n           parserHFS_conf_scheduler = wix @ parserHF_conf_fixed c2\\<rparr> \\<Longrightarrow>\n    parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow>\n    Ex (parserHFS_step_relation G\n         \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n            parserHFS_conf_history = parserHF_conf_history c,\n            parserHFS_conf_stack = parserHF_conf_stack c,\n            parserHFS_conf_scheduler = wi @ parserHF_conf_fixed c2\\<rparr>\n         e1)\"\n  apply(rule_tac parserHFS_step_relation_slim_step_intro2)\n      apply(force)\n     apply(force)\n    apply(simp add: parserHF_step_relation_def parser_step_labels_def)\n   apply(clarsimp)\n   apply(simp add: parserHF_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule parserHF.AX_fixed_scheduler_extendable_translates_backwards)\n      apply(force)\n     prefer 2\n     apply(force)\n    apply(rule_tac d=\"d\" in parserHF.belongs_configurations)\n     apply(rule parserHF.derivation_initial_belongs)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"valid_parser_step_label G e2\")\n   prefer 2\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac x=\"e2\" in ballE)\n    prefer 2\n    apply(simp add: parserHF_step_relation_def)\n   apply(force)\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   prefer 2\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac x=\"e1\" in ballE)\n    prefer 2\n    apply(simp add: parserHF_step_relation_def)\n   apply(force)\n  apply(subgoal_tac \"(\\<exists>x. x @ rule_rpush e1 = rule_rpop e1)\")\n   prefer 2\n   apply(simp add: valid_parser_step_label_def)\n  apply(subgoal_tac \"(\\<exists>x. x @ rule_rpush e2 = rule_rpop e2)\")\n   prefer 2\n   apply(simp add: valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(case_tac \"prefix (rule_rpop e2) (parserHF_conf_fixed c)\")\n   apply(rename_tac x xa)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac x xa)(*strict*)\n    prefer 2\n    apply(rule_tac ?e1.0=\"e2\" and x=\"xa\" in parserHF_extension_empty)\n         apply(rename_tac x xa)(*strict*)\n         apply(force)\n        apply(rename_tac x xa)(*strict*)\n        apply(force)\n       apply(rename_tac x xa)(*strict*)\n       apply(force)\n      apply(rename_tac x xa)(*strict*)\n      apply(force)\n     apply(rename_tac x xa)(*strict*)\n     apply(force)\n    apply(rename_tac x xa)(*strict*)\n    apply(force)\n   apply(rename_tac x xa)(*strict*)\n   apply(force)\n  apply(rename_tac x xa)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac x xa)(*strict*)\n   prefer 2\n   apply(rule_tac ?e1.0=\"e2\" in parserHF_extension_fixed_and_pop)\n   apply(force)\n  apply(rename_tac x xa)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x xa)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x xa)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac x xa ca)(*strict*)\n   prefer 2\n   apply(rule_tac ?e1.0=\"e2\" and x=\"xa\" in parserHF_extension_notempty_fixed_scheduler)\n         apply(rename_tac x xa ca)(*strict*)\n         apply(force)\n        apply(rename_tac x xa ca)(*strict*)\n        apply(force)\n       apply(rename_tac x xa ca)(*strict*)\n       apply(force)\n      apply(rename_tac x xa ca)(*strict*)\n      apply(force)\n     apply(rename_tac x xa ca)(*strict*)\n     apply(force)\n    apply(rename_tac x xa ca)(*strict*)\n    apply(force)\n   apply(rename_tac x xa ca)(*strict*)\n   apply(force)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(simp add: parserHFS_step_relation_def parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x xa xb xc xd y)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac x xa xb xc xd y parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(rename_tac f h l)\n  apply(rename_tac x xa xb xc xd y f h l)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac x xa xb xc xd y f h l parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(rename_tac f1 h1 l1)\n  apply(rename_tac x xa xb xc xd y f h l f1 h1 l1)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac x xa xb xc xd y f h l f1 h1 l1 parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(rename_tac f2 h2 l2)\n  apply(rename_tac x xa xb xc xd y f h l f1 h1 l1 f2 h2 l2)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac x xa xb xc xd y f h l f1 h1 l1 f2 h2 cons_l2 rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(rename_tac lpo1 rpo1 lpu1 rpu1)\n  apply(rename_tac x xa xb xc xd y f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac x xa xb xc xd y f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1 rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(rename_tac lpo2 rpo2 lpu2 rpu2)\n  apply(rename_tac x xa xb xc xd y f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1 lpo2 rpo2 lpu2 rpu2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa xb xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n  apply(rule_tac xs=\"xb\" in rev_cases)\n   apply(rename_tac x xa xb xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n   prefer 2\n   apply(rename_tac x xa xb xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys ya)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys)(*strict*)\n   apply(simp add: valid_parser_step_label_def)\n   apply(clarsimp)\n   apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys k w ka wa)(*strict*)\n   apply(simp add: kPrefix_def)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys k w ka wa)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n     apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys k w ka wa)(*strict*)\n     apply(blast)\n    apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys k w ka wa)(*strict*)\n    apply(rule_tac A=\"set(take k w)\" in set_mp)\n     apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys k w ka wa)(*strict*)\n     apply(rule set_take_subset2)\n     apply(force)\n    apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys k w ka wa)(*strict*)\n    apply(rule_tac t=\"take k w\" and s=\"f @\n       drop (length f)\n        (butlast_if_match\n          (take ka wa @ take (ka - length wa) [parser_bottom G])\n          (parser_bottom G)) @\n       hf1 @ [parser_bottom G]\" in ssubst)\n     apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys k w ka wa)(*strict*)\n     apply(force)\n    apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys k w ka wa)(*strict*)\n    apply(simp (no_asm))\n   apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ys k w ka wa nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa xc xd f h lpo1 lpu1 rpu1 lpo2 lpu2 ys k ka wa nat xb)(*strict*)\n   apply(simp add: parserHFS_configurations_def)\n  apply(rename_tac x xa xb xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2)(*strict*)\n  apply(rule_tac xs=\"drop (Suc (length xa + length y)) f\" in rev_cases)\n   apply(rename_tac x xa xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2)(*strict*)\n   apply(subgoal_tac \"butlast_if_match ((wi @ y) @ [parser_bottom G])\n          (parser_bottom G) = wi @ y\")\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2)(*strict*)\n    prefer 2\n    apply (metis append_assoc butlast_if_match_direct)\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2)(*strict*)\n   apply(clarsimp)\n   apply(thin_tac \"butlast_if_match (wi @ y @ [parser_bottom G]) (parser_bottom G) =\n       wi @ y\")\n   apply(case_tac \"wi @ y @ [parser_bottom G] = f\")\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2)(*strict*)\n    apply(force)\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2)(*strict*)\n   apply(erule_tac P=\"wi @ y @ [parser_bottom G] \\<sqsubseteq> f\" in disjE)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2)(*strict*)\n    apply(simp add: prefix_def)\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2)(*strict*)\n   apply(simp add: prefix_def valid_parser_step_label_def parserHFS_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k w ka wa c)(*strict*)\n   apply(simp add: kPrefix_def)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k w ka wa c)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"parser_bottom G \\<in> set w\")\n     apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k w ka wa c)(*strict*)\n     apply(blast)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k w ka wa c)(*strict*)\n    apply(rule_tac A=\"set(take k w)\" in set_mp)\n     apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k w ka wa c)(*strict*)\n     apply(rule set_take_subset2)\n     apply(force)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k w ka wa c)(*strict*)\n    apply(rule_tac t=\"take k w\" and s=\"wi @ y @ [parser_bottom G]\" in ssubst)\n     apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k w ka wa c)(*strict*)\n     apply(force)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k w ka wa c)(*strict*)\n    apply(simp (no_asm))\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k w ka wa c nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k ka wa nat)(*strict*)\n   apply(subgoal_tac \"k\n        =\n       Suc nat+(length f +\n        (length wi - length f + (length y - (length f - length wi))))\")\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k ka wa nat)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 k ka wa nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa)(*strict*)\n   apply(subgoal_tac \"prefix f wi \\<or> SSX\" for SSX)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa)(*strict*)\n    prefer 2\n    apply(rule_tac d=\"y\" in mutual_prefix_prefix)\n    apply(force)\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa)(*strict*)\n   apply(erule_tac P=\"prefix f wi\" in disjE)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c)(*strict*)\n    apply(erule disjE)\n     apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n    apply(case_tac \"ka - length wa\")\n     apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"butlast_if_match (take ka wa) (parser_bottom G) = take ka wa\")\n      apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n      prefer 2\n      apply (metis butlast_if_match_reduces parser_bottom_take_end)\n     apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     apply(subgoal_tac \"prefix f x \\<or> SSX\" for SSX)\n      apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n      prefer 2\n      apply(rule_tac b=\"ca\" and d=\"rpu1\" in mutual_prefix_prefix)\n      apply(force)\n     apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     apply(erule_tac P=\"prefix f x\" in disjE)\n      apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n      apply(simp add: prefix_def valid_parser_step_label_def parserHFS_configurations_def)\n      apply(clarsimp)\n      apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n      apply(subgoal_tac \"ca=cb @ rpu1\")\n       apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n       prefer 2\n       apply (metis same_append_eq)\n      apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n      apply(subgoal_tac \"drop (length f) (take ka wa) = cb @ rpu1\")\n       apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n       prefer 2\n       apply (metis drop_append)\n      apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n      apply(clarsimp)\n      apply(subgoal_tac \"prefix c cb \\<or> SSX\" for SSX)\n       apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n       prefer 2\n       apply(rule_tac d=\"rpu1 @ hf1\" and b=\"y\" in mutual_prefix_prefix)\n       apply(force)\n      apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n      apply(erule_tac P=\"prefix c cb\" in disjE)\n       apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n       apply(simp add: prefix_def valid_parser_step_label_def parserHFS_configurations_def)\n       apply(clarsimp)\n      apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n      apply(simp add: prefix_def valid_parser_step_label_def parserHFS_configurations_def)\n      apply(clarsimp)\n      apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa cb ca)(*strict*)\n      apply(subgoal_tac \"prefix rpu1 ca \\<or> SSX\" for SSX)\n       apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa cb ca)(*strict*)\n       prefer 2\n       apply(rule_tac b=\"hf1\" and d=\"y\" in mutual_prefix_prefix)\n       apply(force)\n      apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa cb ca)(*strict*)\n      apply(erule_tac P=\"prefix rpu1 ca\" in disjE)\n       apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa cb ca)(*strict*)\n       apply(simp add: prefix_def valid_parser_step_label_def parserHFS_configurations_def)\n       apply(clarsimp)\n      apply(rename_tac xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa cb ca)(*strict*)\n      apply(simp add: prefix_def valid_parser_step_label_def parserHFS_configurations_def)\n      apply(clarsimp)\n     apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     apply(simp add: prefix_def valid_parser_step_label_def parserHFS_configurations_def)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n     apply(subgoal_tac \"rpu1 = cb @ ca\")\n      apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n      prefer 2\n      apply (metis same_append_eq)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n     apply(subgoal_tac \"drop (length x + length cb) (take ka wa) = ca\")\n      apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n      prefer 2\n      apply (metis append_assoc append_eq_conv_conj length_append)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n     apply(subgoal_tac \"prefix (drop (length x + length cb) (take ka wa)) c \\<or> SSX\" for SSX)\n      apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n      prefer 2\n      apply(rule_tac mutual_prefix_prefix)\n      apply(force)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n     apply(erule_tac P=\"prefix (drop (length x + length cb) (take ka wa)) c\" in disjE)\n      apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n      apply(simp add: prefix_def valid_parser_step_label_def)\n      apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n     apply(simp add: prefix_def valid_parser_step_label_def parserHFS_configurations_def)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c cb ca)(*strict*)\n     apply(subgoal_tac \"y=ca@hf1\")\n      apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c cb ca)(*strict*)\n      prefer 2\n      apply (metis append_assoc same_append_eq)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c cb ca)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xc xd h lpo1 lpu1 lpo2 lpu2 ka wa c cb ca)(*strict*)\n     apply(rule_tac x=\"hf1 @ [parser_bottom G]\" in exI)\n     apply(force)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 lpo2 lpu2 ka c ca nat xa)(*strict*)\n    apply(subgoal_tac \"ka = Suc nat + (length x + length xa)\")\n     apply(rename_tac x xc xd y f h lpo1 lpu1 lpo2 lpu2 ka c ca nat xa)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 lpo2 lpu2 ka c ca nat xa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n    apply(subgoal_tac \"butlast_if_match ((x @ xa) @ [parser_bottom G]) (parser_bottom G) = x@xa\")\n     apply(rename_tac x xc xd y f h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n     prefer 2\n     apply (metis append_assoc butlast_if_match_direct)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"prefix f x \\<or> SSX\" for SSX)\n     apply(rename_tac x xc xd y f h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n     prefer 2\n     apply(rule_tac mutual_prefix_prefix)\n     apply(force)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n    apply(erule_tac P=\"prefix f x\" in disjE)\n     apply(rename_tac x xc xd y f h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n     apply(simp add: prefix_def valid_parser_step_label_def)\n     apply(clarsimp)\n     apply(rename_tac xc xd y f h lpo1 lpu1 lpo2 lpu2 c xa cb)(*strict*)\n     apply(subgoal_tac \"prefix cb c \\<or> SSX\" for SSX)\n      apply(rename_tac xc xd y f h lpo1 lpu1 lpo2 lpu2 c xa cb)(*strict*)\n      prefer 2\n      apply(rule_tac mutual_prefix_prefix)\n      apply(force)\n     apply(rename_tac xc xd y f h lpo1 lpu1 lpo2 lpu2 c xa cb)(*strict*)\n     apply(simp add: prefix_def valid_parser_step_label_def suffix_def)\n    apply(rename_tac x xc xd y f h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n    apply(subgoal_tac \"prefix cb xa \\<or> SSX\" for SSX)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n     prefer 2\n     apply(rule_tac mutual_prefix_prefix)\n     apply(force)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n    apply(erule_tac P=\"prefix cb xa\" in disjE)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n     apply(simp add: prefix_def valid_parser_step_label_def)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c cb cc)(*strict*)\n     apply(simp add: suffix_def)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n    apply(simp add: prefix_def valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cc)(*strict*)\n    apply(rule_tac xs=\"ca\" in rev_cases)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cc)(*strict*)\n     prefer 2\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cc ys ya)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c xa)(*strict*)\n     apply(simp add: suffix_def)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cc)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n    apply(rule_tac x=\"ca@drop (length c) y @ [parser_bottom G]\" in exI)\n    apply(rule_tac t=\"wi @ c @ drop (length c) y @ [parser_bottom G]\" and s=\"(wi @ c) @ drop (length c) y @ [parser_bottom G]\" in ssubst)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     apply(force)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n    apply(rule_tac t=\"wi@c\" and s=\"x @ rpu1 @ ca\" in ssubst)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     apply(force)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n    apply(simp (no_asm))\n   apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n   apply(case_tac \"ka - length wa\")\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"butlast_if_match (take ka wa) (parser_bottom G) = take ka wa\")\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     prefer 2\n     apply (metis butlast_if_match_reduces parser_bottom_take_end)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"prefix (wi@c) x \\<or> SSX\" for SSX)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     prefer 2\n     apply(rule_tac b=\"ca\" and d=\"rpu1\" in mutual_prefix_prefix)\n     apply(force)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n    apply(erule_tac P=\"prefix (wi@c) x\" in disjE)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     apply(simp add: prefix_def valid_parser_step_label_def parserHFS_configurations_def)\n     apply(clarsimp)\n     apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n     apply(subgoal_tac \"ca=cb @ rpu1\")\n      apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n      prefer 2\n      apply (metis same_append_eq)\n     apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n     apply(subgoal_tac \"drop (length wi + length c) (take ka wa) = cb @ rpu1\")\n      apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n      prefer 2\n      apply(rule_tac t=\"take ka wa\" and s=\"wi @ c @ cb @ rpu1\" in ssubst)\n       apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n       apply(force)\n      apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n      apply(simp (no_asm))\n     apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n     apply(clarsimp)\n     apply(rule_tac x=\"hf1 @[parser_bottom G]\" in exI)\n     apply(force)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n    apply(subgoal_tac \"drop (length wi + length c) (take ka wa) = ca\")\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n     prefer 2\n     apply(rule_tac t=\"take ka wa\" and s=\"wi @ c @ ca\" in ssubst)\n      apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n      apply(force)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n     apply(simp (no_asm))\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca cb)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n    apply(subgoal_tac \"prefix x wi \\<or> SSX\" for SSX)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n     prefer 2\n     apply(rule_tac mutual_prefix_prefix)\n     apply(force)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n    apply(erule_tac P=\"prefix x wi\" in disjE)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n     apply(simp add: prefix_def valid_parser_step_label_def)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     apply(subgoal_tac \"rpu1=ca @ c @ drop (length x + length ca + length c) (take ka wa)\")\n      apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n      prefer 2\n      apply (metis same_append_eq)\n     apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa c ca)(*strict*)\n     apply(rule_tac x=\"hf1@[parser_bottom G]\" in exI)\n     apply(force)\n    apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c cb)(*strict*)\n    apply(simp add: prefix_def valid_parser_step_label_def parserHFS_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa cb ca)(*strict*)\n    apply(subgoal_tac \"rpu1=cb @ drop (length wi + (length ca + length  cb)) (take ka wa)\")\n     apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa cb ca)(*strict*)\n     prefer 2\n     apply (metis same_append_eq)\n    apply(rename_tac xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa cb ca)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 ka wa cb ca)(*strict*)\n    apply(rule_tac x=\"hf1@[parser_bottom G]\" in exI)\n    apply(force)\n   apply(rename_tac x xc xd y h lpo1 lpu1 rpu1 lpo2 lpu2 ka wa c ca nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka c ca nat xa)(*strict*)\n   apply(subgoal_tac \"ka = Suc nat+(length x + length xa)\")\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka c ca nat xa)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 ka c ca nat xa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n   apply(subgoal_tac \"butlast_if_match ((x @ xa) @ [parser_bottom G]) (parser_bottom G) = (x @ xa)\")\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n    prefer 2\n    apply (metis append_assoc butlast_if_match_direct)\n   apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac x=\"[]\" in exI)\n   apply(clarsimp)\n   apply(subgoal_tac \"prefix wi x \\<or> SSX\" for SSX)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n    prefer 2\n    apply(rule_tac mutual_prefix_prefix)\n    apply(force)\n   apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n   apply(erule_tac P=\"prefix wi x\" in disjE)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n    apply(subgoal_tac \"prefix cb xa \\<or> SSX\" for SSX)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n     prefer 2\n     apply(rule_tac mutual_prefix_prefix)\n     apply(force)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n    apply(erule_tac P=\"prefix cb xa\" in disjE)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n     prefer 2\n     apply(simp add: prefix_def valid_parser_step_label_def)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cc)(*strict*)\n     apply(rule_tac xs=\"ca\" in rev_cases)\n      apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cc)(*strict*)\n      prefer 2\n      apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cc ys ya)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 xa)(*strict*)\n      apply(simp add: suffix_def)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cc)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c xa cc)(*strict*)\n     apply(rule_tac xs=\"c\" in rev_cases)\n      apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c xa cc)(*strict*)\n      prefer 2\n      apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c xa cc ys ya)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c xa cc)(*strict*)\n     apply(simp add: suffix_def)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca cb cc)(*strict*)\n    apply(rule_tac xs=\"ca\" in rev_cases)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca cb cc)(*strict*)\n     prefer 2\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca cb cc ys ya)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c cb ys)(*strict*)\n     apply(simp add: suffix_def)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca cb cc)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n   apply(simp add: prefix_def)\n   apply(subgoal_tac \"prefix wi x \\<or> SSX\" for SSX)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n    prefer 2\n    apply(rule_tac b=\"c @ ca\" in mutual_prefix_prefix)\n    apply(force)\n   apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n   apply(erule_tac P=\"prefix wi x\" in disjE)\n    apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n    apply(rule_tac xs=\"ca\" in rev_cases)\n     apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa ys ya)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 c ys)(*strict*)\n    apply(simp add: suffix_def)\n   apply(rename_tac x xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n   apply(simp add: prefix_def)\n   apply(subgoal_tac \"prefix c cb \\<or> SSX\" for SSX)\n    apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n    prefer 2\n    apply(rule_tac mutual_prefix_prefix)\n    apply(force)\n   apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n   apply(erule_tac P=\"prefix c cb\" in disjE)\n    apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n    prefer 2\n    apply(simp add: prefix_def valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 ca xa cb cc)(*strict*)\n    apply(rule_tac xs=\"ca\" in rev_cases)\n     apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 ca xa cb cc)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 ca xa cb cc ys ya)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 cb cc ys)(*strict*)\n    apply(simp add: suffix_def)\n   apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 c ca xa cb)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac xc xd y h lpo1 lpu1 lpo2 lpu2 c xa cc)(*strict*)\n   apply(simp add: suffix_def)\n  apply(rename_tac x xa xc xd y f h lpo1 lpu1 rpu1 lpo2 lpu2 ys ya)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step1_hlp: \"\n              valid_parser G \\<Longrightarrow>\n       ATS.derivation_initial parserHF_initial_configurations\n        parserHF_step_relation G d \\<Longrightarrow>\n       parserHF_step_relation G c e1 c1 \\<Longrightarrow>\n       parserHF_step_relation G c e2 c2 \\<Longrightarrow>\n       d i = Some (pair e1a c) \\<Longrightarrow>\n       parserHF_conf_history c1 = parserHF_conf_history c @ hf2 \\<Longrightarrow>\n       parserHF_conf_history c2 = parserHF_conf_history c @ hf2 @ hf1 \\<Longrightarrow>\n       hf1\\<noteq>[] \\<Longrightarrow>\n       hf1 \\<in> parser_markers G \\<Longrightarrow>\n       hf2 \\<in> parser_markers G \\<Longrightarrow>\n       \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow>\n       \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n          parserHFS_conf_history = parserHF_conf_history c,\n          parserHFS_conf_stack = parserHF_conf_stack c,\n          parserHFS_conf_scheduler =\n            wi @\n            (if parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\n             then parserHF_conf_fixed c2\n             else parserHF_conf_fixed c2 @ [parser_bottom G])\\<rparr>\n       \\<in> parserHFS_configurations G \\<Longrightarrow>\n       parserHFS_step_relation G\n        \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n           parserHFS_conf_history = parserHF_conf_history c,\n           parserHFS_conf_stack = parserHF_conf_stack c,\n           parserHFS_conf_scheduler =\n             wi @\n             (if parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\n              then parserHF_conf_fixed c2\n              else parserHF_conf_fixed c2 @ [parser_bottom G])\\<rparr>\n        e2\n        \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c2,\n           parserHFS_conf_history = parserHF_conf_history c @ hf2 @ hf1,\n           parserHFS_conf_stack = parserHF_conf_stack c2,\n           parserHFS_conf_scheduler =\n             wix @\n             (if parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\n              then parserHF_conf_fixed c2\n              else parserHF_conf_fixed c2 @ [parser_bottom G])\\<rparr> \\<Longrightarrow>\n       (parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow>\n        Ex (parserHFS_step_relation G\n             \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n                parserHFS_conf_history = parserHF_conf_history c,\n                parserHFS_conf_stack = parserHF_conf_stack c,\n                parserHFS_conf_scheduler =\n                  wi @\n                  parserHF_conf_fixed c2\\<rparr>\n             e1)) \\<and>\n       (\\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow>\n        Ex (parserHFS_step_relation G\n             \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n                parserHFS_conf_history = parserHF_conf_history c,\n                parserHFS_conf_stack = parserHF_conf_stack c,\n                parserHFS_conf_scheduler =\n                  wi @\n                  parserHF_conf_fixed c2 @ [parser_bottom G]\\<rparr>\n             e1))\"\n  apply(rule conjI)\n   apply(clarsimp)\n   prefer 2\n   apply(clarsimp)\n   apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step1_hlp1)\n                apply(force)\n               apply(force)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step1_hlp2)\n               apply(force)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step1: \"\n   (\\<forall>G. valid_parser G \\<longrightarrow>\n         (\\<forall>d. ATS.derivation_initial parserHF_initial_configurations\n               parserHF_step_relation G d \\<longrightarrow>\n              (\\<forall>c e1 c1.\n                  parserHF_step_relation G c e1 c1 \\<longrightarrow>\n                  (\\<forall>e2 c2.\n                      parserHF_step_relation G c e2 c2 \\<longrightarrow>\n                      (\\<forall>i. (\\<exists>ei. d i = Some (pair ei c)) \\<longrightarrow>\n                           (\\<forall>hf2. parserHF_conf_history c1 =\n                                  parserHF_conf_history c @ hf2 \\<longrightarrow>\n                                  (\\<forall>hf1.\nparserHF_conf_history c2 = parserHF_conf_history c @ hf2 @ hf1 \\<longrightarrow>\nhf1 \\<noteq> [] \\<longrightarrow>\nATS.derivation_initial parserHFS_initial_configurations\n parserHFS_step_relation G\n (ATS_Branching_Versus_Linear1.Bra2LinDer parser_empty_scheduler_fragment\n   (@) (@) parserHF_conf_fixed parserHFvHFS_Bra2LinConf\n   parserHFvHFS_Bra2LinStep\n   (\\<lambda>G w. if w \\<sqsupseteq> [parser_bottom G] then w else w @ [parser_bottom G]) G\n   (derivation_append d (der2 c e2 c2) i) (Suc i)) \\<longrightarrow>\nhf1 \\<in> parser_markers G \\<longrightarrow>\nhf2 \\<in> parser_markers G \\<longrightarrow>\n\\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow>\nEx (parserHFS_step_relation G\n     (the (get_configuration\n            (ATS_Branching_Versus_Linear1.Bra2LinDer\n              parser_empty_scheduler_fragment (@) (@) parserHF_conf_fixed\n              parserHFvHFS_Bra2LinConf parserHFvHFS_Bra2LinStep\n              (\\<lambda>G w. if w \\<sqsupseteq> [parser_bottom G] then w\n                     else w @ [parser_bottom G])\n              G (derivation_append d (der2 c e2 c2) i) (Suc i) i)))\n     e1))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. SSd SSn = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> parserHFS_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"parserHF_vs_parserHFS.Bra2LinDer\n          G (derivation_append d (der2 c e2 c2) i) (Suc i)\"\n      and n=\"i\" and\n      m=\"Suc i\"\n      in parserHFS.step_detail_before_some_position)\n     apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1)(*strict*)\n     apply(simp add: parserHFS.derivation_initial_def)\n    apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def derivation_append_def der2_def get_configuration_def parserHFvHFS_Bra2LinConf_def parserHF_vs_parserHFS.Bra2LinDer'_def parserHFvHFS_Bra2LinStep_def parser_empty_scheduler_fragment_def)\n   apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1)(*strict*)\n   apply(force)\n  apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1 e1a e2a c1a c2a)(*strict*)\n  apply(subgoal_tac \"c1a \\<in> parserHFS_configurations G\")\n   apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1 e1a e2a c1a c2a)(*strict*)\n   prefer 2\n   apply(rule_tac e=\"e1a\" and i=\"i\" in parserHFS.belongs_configurations)\n    apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1 e1a e2a c1a c2a)(*strict*)\n    apply(rule parserHFS.derivation_initial_belongs)\n     apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1 e1a e2a c1a c2a)(*strict*)\n     apply(force)\n    apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1 e1a e2a c1a c2a)(*strict*)\n    apply(force)\n   apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1 e1a e2a c1a c2a)(*strict*)\n   apply(force)\n  apply(rename_tac G d c e1 c1 e2 c2 i ei hf2 hf1 e1a e2a c1a c2a)(*strict*)\n  apply(thin_tac \"parserHFS.derivation_initial G\n        (parserHF_vs_parserHFS.Bra2LinDer\n          G (derivation_append d (der2 c e2 c2) i) (Suc i))\")\n  apply(simp only: parserHF_vs_parserHFS.Bra2LinDer_def get_configuration_def derivation_append_def der2_def)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def)\n  apply(clarsimp)\n  apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n  apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step1_hlp)\n              apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n              apply(force)\n             apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n             apply(force)\n            apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n            apply(force)\n           apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n           apply(force)\n          apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n          apply(force)\n         apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n         apply(force)\n        apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n        apply(force)\n       apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n       apply(force)\n      apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n      apply(force)\n     apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n     apply(force)\n    apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n    apply(force)\n   apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n   apply(force)\n  apply(rename_tac G d c e1 c1 c2 i hf2 hf1 e1a e2a)(*strict*)\n  apply(force)\n  done\n\nlemma butlast_if_match_length_min: \"\n  length x \\<le> length (butlast_if_match (x @ [y]) (parser_bottom G))\"\n  apply (metis butlast_if_match_pull_out drop_length_append list.distinct(1))\n  done\n\nlemma parserHF_extension_empty_prefix_of_fixed_scheduler_with_bottom: \"\n  valid_parser G\n  \\<Longrightarrow> parserHF_step_relation G c e1 c1\n  \\<Longrightarrow> parserHF_conf_history c1 = parserHF_conf_history c\n  \\<Longrightarrow> prefix (rule_rpop e1) (parserHF_conf_fixed c @ [parser_bottom G])\"\n  apply(simp add: parserHF_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac x parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac x parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka parserHF_conf_fixedaa parserHF_conf_historyaa parserHF_conf_stackaa)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac x parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka parserHF_conf_fixedaa parserHF_conf_historyaa parserHF_conf_stackaa rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac parserHF_conf_fixed rule_lpop rule_rpop rule_lpush rule_rpush)(*strict*)\n  apply(rename_tac f lp rp lpu rpu)\n  apply(rename_tac f lp rp lpu rpu)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac f lp rp lpu rpu)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n  apply(rename_tac f lp rp lpu rpu)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu rpu c)(*strict*)\n  apply(rule_tac xs=\"c\" in rev_cases)\n   apply(rename_tac f lp lpu rpu c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac f lp lpu rpu c ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu rpu ys y)(*strict*)\n  apply(case_tac \"y=parser_bottom G\")\n   apply(rename_tac f lp lpu rpu ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f lp lpu rpu ys)(*strict*)\n   apply(rule_tac x=\"[]\" in exI)\n   apply(clarsimp)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac f lp lpu rpu ys)(*strict*)\n    prefer 2\n    apply(rule_tac x=\"f@ys\" and y=\"parser_bottom G\" and G=\"G\" in  butlast_if_match_length_min)\n   apply(rename_tac f lp lpu rpu ys)(*strict*)\n   apply(clarsimp)\n   apply (metis butlast_if_match_direct drop_butlast_if_match_distrib drop_eq_Nil)\n  apply(rename_tac f lp lpu rpu ys y)(*strict*)\n  apply(subgoal_tac \"butlast_if_match ((f @ ys) @ [y]) (parser_bottom G) = f@ys\")\n   apply(rename_tac f lp lpu rpu ys y)(*strict*)\n   prefer 2\n   apply (metis NotemptyString butlast_if_match_direct2 drop_butlast_if_match_distrib drop_eq_Nil)\n  apply(rename_tac f lp lpu rpu ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f lp lpu rpu y)(*strict*)\n  apply(subgoal_tac \"butlast_if_match (f @ [y]) (parser_bottom G) = f@[y]\")\n   apply(rename_tac f lp lpu rpu y)(*strict*)\n   apply(force)\n  apply(rename_tac f lp lpu rpu y)(*strict*)\n  apply (metis butlast_if_match_reduces snoc_eq_iff_butlast)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step2_hlp1: \"\n   valid_parser G \\<Longrightarrow>\n    ATS.derivation_initial parserHF_initial_configurations\n     parserHF_step_relation G d \\<Longrightarrow>\n    parserHF_step_relation G c e1 c1 \\<Longrightarrow>\n    parserHF_step_relation G c e2 c2 \\<Longrightarrow>\n \\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow>\n       \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow>\n    d i = Some (pair e1a c) \\<Longrightarrow>\n    parserHF_conf_history c1 = parserHF_conf_history c @ hf2 \\<Longrightarrow>\n    parserHF_conf_history c2 = parserHF_conf_history c @ hf2 \\<Longrightarrow>\n    hf2 \\<in> parser_markers G \\<Longrightarrow>\n    \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n       parserHFS_conf_history = parserHF_conf_history c,\n       parserHFS_conf_stack = parserHF_conf_stack c,\n       parserHFS_conf_scheduler = wi @ parserHF_conf_fixed c2 @ [parser_bottom G]\\<rparr>\n    \\<in> parserHFS_configurations G \\<Longrightarrow>\n    parserHFS_step_relation G\n     \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n        parserHFS_conf_history = parserHF_conf_history c,\n        parserHFS_conf_stack = parserHF_conf_stack c,\n        parserHFS_conf_scheduler = wi @ parserHF_conf_fixed c2 @ [parser_bottom G]\\<rparr>\n     e2 \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c2,\n           parserHFS_conf_history = parserHF_conf_history c @ hf2,\n           parserHFS_conf_stack = parserHF_conf_stack c2,\n           parserHFS_conf_scheduler =\n             wiX @ parserHF_conf_fixed c2 @ [parser_bottom G]\\<rparr> \\<Longrightarrow>\n    \\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow>\n    Ex (parserHFS_step_relation G\n         \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n            parserHFS_conf_history = parserHF_conf_history c,\n            parserHFS_conf_stack = parserHF_conf_stack c,\n            parserHFS_conf_scheduler =\n              wi @ parserHF_conf_fixed c2 @ [parser_bottom G]\\<rparr>\n         e1)\"\n  apply(rule_tac parserHFS_step_relation_slim_step_intro2)\n      apply(force)\n     apply(force)\n    apply(simp add: parserHF_step_relation_def parser_step_labels_def)\n   apply(clarsimp)\n   apply(simp add: parserHF_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac e=\"e2\" in parserHF.AX_fixed_scheduler_extendable_translates_backwards)\n      apply(force)\n     prefer 2\n     apply(force)\n    apply(rule_tac d=\"d\" in parserHF.belongs_configurations)\n     apply(rule parserHF.derivation_initial_belongs)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"valid_parser_step_label G e2\")\n   prefer 2\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac x=\"e2\" in ballE)\n    prefer 2\n    apply(simp add: parserHF_step_relation_def)\n   apply(force)\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   prefer 2\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac x=\"e1\" in ballE)\n    prefer 2\n    apply(simp add: parserHF_step_relation_def)\n   apply(force)\n  apply(subgoal_tac \"(\\<exists>x. x @ rule_rpush e1 = rule_rpop e1)\")\n   prefer 2\n   apply(simp add: valid_parser_step_label_def)\n  apply(subgoal_tac \"(\\<exists>x. x @ rule_rpush e2 = rule_rpop e2)\")\n   prefer 2\n   apply(simp add: valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(case_tac \"prefix (rule_rpop e2) (parserHF_conf_fixed c)\")\n   apply(rename_tac x xa)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac x xa)(*strict*)\n    prefer 2\n    apply(rule_tac ?e1.0=\"e2\" and x=\"xa\" in parserHF_extension_empty)\n         apply(rename_tac x xa)(*strict*)\n         apply(force)\n        apply(rename_tac x xa)(*strict*)\n        apply(force)\n       apply(rename_tac x xa)(*strict*)\n       apply(force)\n      apply(rename_tac x xa)(*strict*)\n      apply(force)\n     apply(rename_tac x xa)(*strict*)\n     apply(force)\n    apply(rename_tac x xa)(*strict*)\n    apply(force)\n   apply(rename_tac x xa)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac x xa)(*strict*)\n    prefer 2\n    apply(rule_tac ?e1.0=\"e1\" in parserHF_extension_empty_prefix_of_fixed_scheduler_with_bottom)\n      apply(rename_tac x xa)(*strict*)\n      apply(force)\n     apply(rename_tac x xa)(*strict*)\n     apply(force)\n    apply(rename_tac x xa)(*strict*)\n    apply(force)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa ca caa)(*strict*)\n   apply(rule_tac xs=\"caa\" in rev_cases)\n    apply(rename_tac x xa ca caa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xa ca)(*strict*)\n    apply(rule_tac x=\"[]\" in exI)\n    apply(clarsimp)\n    apply(simp add: parserHF_step_relation_def parserHFS_step_relation_def prefix_def parserHFS_configurations_def valid_parser_step_label_def)\n    apply(clarsimp)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi)(*strict*)\n    apply(case_tac c)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n    apply(rename_tac f h l)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi f h l)(*strict*)\n    apply(case_tac c1)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi f h l parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n    apply(rename_tac f1 h1 l1)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi f h l f1 h1 l1)(*strict*)\n    apply(case_tac c2)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi f h l f1 h1 l1 parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n    apply(rename_tac f2 h2 l2)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi f h l f1 h1 l1 f2 h2 l2)(*strict*)\n    apply(case_tac e1)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi f h l f1 h1 l1 f2 h2 cons_l2 rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n    apply(rename_tac lpo1 rpo1 lpu1 rpu1)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1)(*strict*)\n    apply(case_tac e2)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1 rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n    apply(rename_tac lpo2 rpo2 lpu2 rpu2)\n    apply(rename_tac x xa ca xb k w ka wa xe xf caa xg xh xi f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1 lpo2 rpo2 lpu2 rpu2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xa c k w ka wa xe xf ca xg xh xi h lpo1 lpu1 lpo2 lpu2 rpu2)(*strict*)\n    apply(simp add: suffix_def)\n   apply(rename_tac x xa ca caa ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa ca ys)(*strict*)\n   apply(simp add: parserHF_step_relation_def parserHFS_step_relation_def prefix_def parserHFS_configurations_def valid_parser_step_label_def)\n   apply(clarsimp)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh)(*strict*)\n   apply(case_tac c)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n   apply(rename_tac f h l)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh f h l)(*strict*)\n   apply(case_tac c1)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh f h l parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n   apply(rename_tac f1 h1 l1)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh f h l f1 h1 l1)(*strict*)\n   apply(case_tac c2)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh f h l f1 h1 l1 parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n   apply(rename_tac f2 h2 l2)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh f h l f1 h1 l1 f2 h2 l2)(*strict*)\n   apply(case_tac e1)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh f h l f1 h1 l1 f2 h2 cons_l2 rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n   apply(rename_tac lpo1 rpo1 lpu1 rpu1)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1)(*strict*)\n   apply(case_tac e2)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1 rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n   apply(rename_tac lpo2 rpo2 lpu2 rpu2)\n   apply(rename_tac x xa ca ys xb k w ka wa xe xf caa xg xh f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1 lpo2 rpo2 lpu2 rpu2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n   apply(simp add: kPrefix_def)\n   apply(case_tac \"k-length w\")\n    apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n    prefer 2\n    apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n   apply(subgoal_tac \"min (length w) k = k\")\n    apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"ka-length wa\")\n    apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n    prefer 2\n    apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xa c ys k w ka xe xf ca xg h lpo1 lpu1 lpo2 lpu2 rpu2 nat xb)(*strict*)\n    apply(subgoal_tac \"ka = Suc nat+(length x + length xb)\")\n     apply(rename_tac x xa c ys k w ka xe xf ca xg h lpo1 lpu1 lpo2 lpu2 rpu2 nat xb)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac x xa c ys k w ka xe xf ca xg h lpo1 lpu1 lpo2 lpu2 rpu2 nat xb)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xa c ys k w xe xf ca xg h lpo1 lpu1 lpo2 lpu2 rpu2 nat xb)(*strict*)\n    apply(rule_tac xs=\"ca\" in rev_cases)\n     apply(rename_tac x xa c ys k w xe xf ca xg h lpo1 lpu1 lpo2 lpu2 rpu2 nat xb)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x xa c ys k w xe xf ca xg h lpo1 lpu1 lpo2 lpu2 rpu2 nat xb ysa y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xa c ys k w xe xf xg h lpo1 lpu1 lpo2 lpu2 rpu2 nat xb ysa)(*strict*)\n    apply(rule_tac w=\"x @ xb\" and v=\"ys\" and r=\"take k w\" and s=\"c\" and A=\"parser_bottom G\" in elem_in_append_set)\n      apply(rename_tac x xa c ys k w xe xf xg h lpo1 lpu1 lpo2 lpu2 rpu2 nat xb ysa)(*strict*)\n      apply(force)\n     apply(rename_tac x xa c ys k w xe xf xg h lpo1 lpu1 lpo2 lpu2 rpu2 nat xb ysa)(*strict*)\n     apply (metis in_set_takeD nset_diff)\n    apply(rename_tac x xa c ys k w xe xf xg h lpo1 lpu1 lpo2 lpu2 rpu2 nat xb ysa)(*strict*)\n    apply(force)\n   apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac xs=\"ca\" in rev_cases)\n    apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x xa c ys k w ka wa xe xf ca xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ysa y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa c ys k w ka wa xe xf xg xh h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2 ysa)(*strict*)\n   apply(thin_tac \"valid_parser G\")\n   apply(thin_tac \"parserHF.derivation_initial G d\")\n   apply(thin_tac \"d i = Some (pair e1a \\<lparr>parserHF_conf_fixed = take k w @ c, parserHF_conf_history = h, parserHF_conf_stack = xe @ lpo1\\<rparr>)\")\n   apply(thin_tac \"[] \\<in> parser_markers G\")\n   apply(thin_tac \"\\<lparr>rule_lpop = lpo1, rule_rpop = take ka wa, rule_lpush = lpu1, rule_rpush = rpu1\\<rparr> \\<in> parser_rules G\")\n   apply(thin_tac \"\\<lparr>rule_lpop = lpo2, rule_rpop = take k w, rule_lpush = lpu2, rule_rpush = rpu2\\<rparr> \\<in> parser_rules G\")\n   apply(thin_tac \"set lpo2 \\<subseteq> parser_nonterms G\")\n   apply(thin_tac \"length (butlast_if_match (take k w) (parser_bottom G)) \\<le> k + length c\")\n   apply(thin_tac \"h \\<sqsupseteq> butlast_if_match (take k w @ c) (parser_bottom G)\")\n   apply(thin_tac \"set lpu2 \\<subseteq> parser_nonterms G\")\n   apply(thin_tac \"set lpo1 \\<subseteq> parser_nonterms G\")\n   apply(thin_tac \"lpo2 \\<noteq> []\")\n   apply(thin_tac \"set lpu1 \\<subseteq> parser_nonterms G\")\n   apply(thin_tac \"lpu2 \\<noteq> []\")\n   apply(thin_tac \"lpo1 \\<noteq> []\")\n   apply(thin_tac \"lpu1 \\<noteq> []\")\n   apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take ka wa) \\<longrightarrow> (\\<exists>x. x @ [parser_bottom G] = rpu1)\")\n   apply(thin_tac \"set h \\<subseteq> parser_events G\")\n   apply(thin_tac \"parser_bottom G \\<notin> set h\")\n   apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take k w) \\<longrightarrow> (\\<exists>x. x @ [parser_bottom G] = rpu2)\")\n   apply (metis append_assoc)\n  apply(rename_tac x xa)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac x xa)(*strict*)\n   prefer 2\n   apply(rule_tac ?e1.0=\"e2\" in parserHF_extension_fixed_and_pop)\n   apply(force)\n  apply(rename_tac x xa)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x xa)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x xa)(*strict*)\n  apply(case_tac \"rule_rpop e2 = parserHF_conf_fixed c\")\n   apply(rename_tac x xa)(*strict*)\n   apply(force)\n  apply(rename_tac x xa)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac x xa ca)(*strict*)\n   prefer 2\n   apply(rule_tac ?e1.0=\"e2\" and x=\"xa\" in parserHF_extension_notempty)\n         apply(rename_tac x xa ca)(*strict*)\n         apply(force)\n        apply(rename_tac x xa ca)(*strict*)\n        apply(force)\n       apply(rename_tac x xa ca)(*strict*)\n       apply(force)\n      apply(rename_tac x xa ca)(*strict*)\n      apply(force)\n     apply(rename_tac x xa ca)(*strict*)\n     apply(force)\n    apply(rename_tac x xa ca)(*strict*)\n    apply(force)\n   apply(rename_tac x xa ca)(*strict*)\n   apply(force)\n  apply(rename_tac x xa ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(simp add: parserHFS_step_relation_def parserHF_step_relation_def parserHFS_configurations_def valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(rename_tac f h l)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh f h l)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh f h l parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(rename_tac f1 h1 l1)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh f h l f1 h1 l1)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh f h l f1 h1 l1 parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(rename_tac f2 h2 l2)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh f h l f1 h1 l1 f2 h2 l2)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh f h l f1 h1 l1 f2 h2 cons_l2 rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(rename_tac lpo1 rpo1 lpu1 rpu1)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1 rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(rename_tac lpo2 rpo2 lpu2 rpu2)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1 lpo2 rpo2 lpu2 rpu2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa xb k w ka wa xe xf xg xh f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n  apply(thin_tac \"valid_parser G\")\n  apply(thin_tac \"parserHF.derivation_initial G d\")\n  apply(thin_tac \"set lpo2 \\<subseteq> parser_nonterms G\")\n  apply(thin_tac \"set lpu2 \\<subseteq> parser_nonterms G\")\n  apply(thin_tac \"set lpo1 \\<subseteq> parser_nonterms G\")\n  apply(thin_tac \"lpo2 \\<noteq> []\")\n  apply(thin_tac \"set lpu1 \\<subseteq> parser_nonterms G\")\n  apply(thin_tac \"lpu2 \\<noteq> []\")\n  apply(thin_tac \"lpo1 \\<noteq> []\")\n  apply(thin_tac \"lpu1 \\<noteq> []\")\n  apply(thin_tac \"set h \\<subseteq> parser_events G\")\n  apply(thin_tac \"parser_bottom G \\<notin> set h\")\n  apply(thin_tac \"d i =\n       Some (pair e1a\n              \\<lparr>parserHF_conf_fixed = f, parserHF_conf_history = h,\n                 parserHF_conf_stack = xe @ lpo1\\<rparr>)\")\n  apply(thin_tac \"\\<lparr>rule_lpop = lpo1, rule_rpop = kPrefix ka (wa @ [parser_bottom G]),\n          rule_lpush = lpu1, rule_rpush = rpu1\\<rparr>\n       \\<in> parser_rules G\")\n  apply(thin_tac \"\\<lparr>rule_lpop = lpo2, rule_rpop = kPrefix k (w @ [parser_bottom G]),\n          rule_lpush = lpu2, rule_rpush = rpu2\\<rparr>\n       \\<in> parser_rules G\")\n  apply(thin_tac \"h \\<sqsupseteq> butlast_if_match f (parser_bottom G)\")\n  apply(thin_tac \"xf @ lpo2 = xe @ lpo1\")\n  apply(simp add: kPrefix_def)\n  apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2)(*strict*)\n  apply(case_tac \"k-length w\")\n   apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2)(*strict*)\n   prefer 2\n   apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2 nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2)(*strict*)\n  apply(subgoal_tac \"min (length w) k = k\")\n   apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"ka-length wa\")\n   apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2)(*strict*)\n   prefer 2\n   apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2 nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa xb k w ka xe xg f rpu2 nat xc)(*strict*)\n   apply(subgoal_tac \"ka = Suc nat+(length x + length xc)\")\n    apply(rename_tac x xa xb k w ka xe xg f rpu2 nat xc)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x xa xb k w ka xe xg f rpu2 nat xc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa xb k w xe xg f rpu2 nat xc)(*strict*)\n   apply(rule_tac xs=\"xb\" in rev_cases)\n    apply(rename_tac x xa xb k w xe xg f rpu2 nat xc)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x xa xb k w xe xg f rpu2 nat xc ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa k w xe xg f rpu2 nat xc ys)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa k w xe xg f rpu2 nat xc ys c ca)(*strict*)\n   apply(rule_tac xs=\"c\" in rev_cases)\n    apply(rename_tac x xa k w xe xg f rpu2 nat xc ys c ca)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x xa k w xe xg f rpu2 nat xc ys c ca ysa y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa k w xe xg f rpu2 nat xc ys ca ysa)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n    apply(rename_tac x xa k w xe xg f rpu2 nat xc ys ca ysa)(*strict*)\n    prefer 2\n    apply (metis append_Nil2 butlast_if_match_pull_out drop_butlast_if_match_distrib)\n   apply(rename_tac x xa k w xe xg f rpu2 nat xc ys ca ysa)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"ysa=ca@ys\")\n    apply(rename_tac x xa k w xe xg f rpu2 nat xc ys ca ysa)(*strict*)\n    prefer 2\n    apply (metis append_assoc same_append_eq)\n   apply(rename_tac x xa k w xe xg f rpu2 nat xc ys ca ysa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa k w xe xg f rpu2 nat xc ys ca)(*strict*)\n   apply(subgoal_tac \"ca=drop (length f) (take k w)\")\n    apply(rename_tac x xa k w xe xg f rpu2 nat xc ys ca)(*strict*)\n    prefer 2\n    apply (metis append_eq_conv_conj)\n   apply(rename_tac x xa k w xe xg f rpu2 nat xc ys ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa k w xe xg f rpu2 nat xc ys)(*strict*)\n   apply(subgoal_tac \"xa=xg\")\n    apply(rename_tac x xa k w xe xg f rpu2 nat xc ys)(*strict*)\n    prefer 2\n    apply (metis append_same_eq)\n   apply(rename_tac x xa k w xe xg f rpu2 nat xc ys)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x k w xe xg f rpu2 nat xc ys)(*strict*)\n   apply(rule_tac x=\"[]\" in exI)\n   apply(clarsimp)\n   apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take k w) \\<longrightarrow>\n       (\\<exists>x. x @ [parser_bottom G] = rpu2)\")\n   apply(subgoal_tac \"butlast_if_match ((x @ xc) @ [parser_bottom G]) (parser_bottom G) = x@xc\")\n    apply(rename_tac x k w xe xg f rpu2 nat xc ys)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_direct)\n   apply(rename_tac x k w xe xg f rpu2 nat xc ys)(*strict*)\n   apply(clarsimp)\n   apply(thin_tac \"butlast_if_match (x @ xc @ [parser_bottom G]) (parser_bottom G) =\n       x @ xc\")\n   apply(thin_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n   apply(erule disjE)\n    apply(rename_tac x k w xe xg f rpu2 nat xc ys)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x k w xe xg f rpu2 nat xc ys)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x k w xe xg f rpu2 nat xc ys c)(*strict*)\n   apply(rule_tac xs=\"c\" in rev_cases)\n    apply(rename_tac x k w xe xg f rpu2 nat xc ys c)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x k w xe xg f rpu2 nat xc ys c ysa y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x k w xe xg f rpu2 nat xc ys ysa)(*strict*)\n   apply(rule_tac ?w1.0=\"f\" and ?v1.0=\"x\" in prefix_alt_apply)\n     apply(rename_tac x k w xe xg f rpu2 nat xc ys ysa)(*strict*)\n     apply(force)\n    apply(rename_tac x k w xe xg f rpu2 nat xc ys ysa)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac k w xe xg f rpu2 xc ys ysa c)(*strict*)\n    apply(simp add: suffix_def)\n   apply(rename_tac x k w xe xg f rpu2 nat xc ys ysa)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac x k w xe xg rpu2 ys c)(*strict*)\n   apply(simp add: suffix_def)\n  apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2 c ca)(*strict*)\n  apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take ka wa) \\<longrightarrow> (\\<exists>x. x @ [parser_bottom G] = rpu1)\")\n  apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take k w) \\<longrightarrow> (\\<exists>x. x @ [parser_bottom G] = rpu2)\")\n  apply(rule_tac xs=\"xb\" in rev_cases)\n   apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2 c ca)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x xa xb k w ka wa xe xg xh f rpu1 rpu2 c ca ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 c ca ys)(*strict*)\n  apply(subgoal_tac \"c=ca@ys @ [parser_bottom G]\")\n   apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 c ca ys)(*strict*)\n   prefer 2\n   apply (metis append_assoc same_append_eq)\n  apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 c ca ys)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n  apply(subgoal_tac \"butlast_if_match (take ka wa) (parser_bottom G) = take ka wa\")\n   apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n   prefer 2\n   apply (metis butlast_if_match_reduces in_set_conv_decomp in_set_takeD nset_diff)\n  apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n  apply(subgoal_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n   apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n   prefer 2\n   apply (metis append_Nil2 butlast_if_match_pull_out drop_butlast_if_match_distrib)\n  apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"xa=xg\")\n   apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n   prefer 2\n   apply (metis append_same_eq)\n  apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n  apply(subgoal_tac \"x=xh\")\n   apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n   prefer 2\n   apply (metis append_same_eq)\n  apply(rename_tac x xa k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n  apply(thin_tac \"butlast_if_match (take ka wa) (parser_bottom G) = take ka wa\")\n  apply(thin_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n  apply(erule disjE)\n   apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ca ys)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ca ys c)(*strict*)\n  apply(subgoal_tac \"ca=drop (length f) (take k w)\")\n   apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ca ys c)(*strict*)\n   prefer 2\n   apply (metis append_eq_conv_conj)\n  apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ca ys c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ys c)(*strict*)\n  apply(subgoal_tac \"c=drop(length f)(take ka wa)\")\n   apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ys c)(*strict*)\n   prefer 2\n   apply (metis append_eq_conv_conj)\n  apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ys c)(*strict*)\n  apply(rule_tac t=\"take ka wa\" and s=\"f@drop (length f) (take ka wa)\" in ssubst)\n   apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ys c)(*strict*)\n   apply(rule sym)\n   apply(blast)\n  apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ys c)(*strict*)\n  apply(rule_tac t=\"take k w\" and s=\"f @ drop (length f) (take k w)\" in subst)\n   apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ys c)(*strict*)\n   apply(blast)\n  apply(rename_tac k w ka wa xe xg xh f rpu1 rpu2 ys c)(*strict*)\n  apply(rule_tac x=\"ys @ [parser_bottom G]\" in exI)\n  apply(force)\n  done\n\nlemma append_context_empty: \"\n  w@v@x = v\n  \\<Longrightarrow> w@x=[]\"\n  apply(case_tac w)\n   apply(clarsimp)\n  apply(rename_tac a list)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step2_hlp2: \"\n valid_parser G \\<Longrightarrow>\n    ATS.derivation_initial parserHF_initial_configurations\n     parserHF_step_relation G d \\<Longrightarrow>\n    parserHF_step_relation G c e1 c1 \\<Longrightarrow>\n    parserHF_step_relation G c e2 c2 \\<Longrightarrow>\n \\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow>\n       \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow>\n    d i = Some (pair e1a c) \\<Longrightarrow>\n    parserHF_conf_history c1 = parserHF_conf_history c @ hf2 \\<Longrightarrow>\n    parserHF_conf_history c2 = parserHF_conf_history c @ hf2 \\<Longrightarrow>\n    hf2 \\<in> parser_markers G \\<Longrightarrow>\n    \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n       parserHFS_conf_history = parserHF_conf_history c,\n       parserHFS_conf_stack = parserHF_conf_stack c,\n       parserHFS_conf_scheduler = wi @ parserHF_conf_fixed c2\\<rparr>\n    \\<in> parserHFS_configurations G \\<Longrightarrow>\n    parserHFS_step_relation G\n     \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n        parserHFS_conf_history = parserHF_conf_history c,\n        parserHFS_conf_stack = parserHF_conf_stack c,\n        parserHFS_conf_scheduler = wi @ parserHF_conf_fixed c2\\<rparr>\n     e2 \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c2,\n           parserHFS_conf_history = parserHF_conf_history c @ hf2,\n           parserHFS_conf_stack = parserHF_conf_stack c2,\n           parserHFS_conf_scheduler = wiX @ parserHF_conf_fixed c2\\<rparr> \\<Longrightarrow>\n    parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow>\n    Ex (parserHFS_step_relation G\n         \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n            parserHFS_conf_history = parserHF_conf_history c,\n            parserHFS_conf_stack = parserHF_conf_stack c,\n            parserHFS_conf_scheduler = wi @ parserHF_conf_fixed c2\\<rparr>\n         e1)\"\n  apply(thin_tac \"\\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow>\n    \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] \")\n  apply(rule_tac parserHFS_step_relation_slim_step_intro2)\n      apply(force)\n     apply(force)\n    apply(simp add: parserHF_step_relation_def parser_step_labels_def)\n   apply(clarsimp)\n   apply(simp add: parserHF_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac x xa)(*strict*)\n   apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"valid_parser_step_label G e2\")\n   prefer 2\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac x=\"e2\" in ballE)\n    prefer 2\n    apply(simp add: parserHF_step_relation_def)\n   apply(force)\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   prefer 2\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac x=\"e1\" in ballE)\n    prefer 2\n    apply(simp add: parserHF_step_relation_def)\n   apply(force)\n  apply(subgoal_tac \"(\\<exists>x. x @ rule_rpush e1 = rule_rpop e1)\")\n   prefer 2\n   apply(simp add: valid_parser_step_label_def)\n  apply(subgoal_tac \"(\\<exists>x. x @ rule_rpush e2 = rule_rpop e2)\")\n   prefer 2\n   apply(simp add: valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac x xa)(*strict*)\n  apply(simp add: parserHF_step_relation_def parserHFS_step_relation_def prefix_def parserHFS_configurations_def valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(rename_tac f h l)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb f h l)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb f h l parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(rename_tac f1 h1 l1)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb f h l f1 h1 l1)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb f h l f1 h1 l1 parserHF_conf_fixeda parserHF_conf_historya parserHF_conf_stacka)(*strict*)\n  apply(rename_tac f2 h2 l2)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb f h l f1 h1 l1 f2 h2 l2)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb f h l f1 h1 l1 f2 h2 cons_l2 rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(rename_tac lpo1 rpo1 lpu1 rpu1)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1 rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(rename_tac lpo2 rpo2 lpu2 rpu2)\n  apply(rename_tac x xa xb k w ka wa xe xf ca y xg xh wb f h l f1 h1 l1 f2 h2 cons_l2 lpo1 rpo1 lpu1 rpu1 lpo2 rpo2 lpu2 rpu2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa xb k w ka wa xe xf c y xg xh wb f h lpo1 lpu1 rpu1 lpo2 lpu2 rpu2)(*strict*)\n  apply(thin_tac \"valid_parser G\")\n  apply(thin_tac \"parserHF.derivation_initial G d\")\n  apply(thin_tac \"set lpo2 \\<subseteq> parser_nonterms G\")\n  apply(thin_tac \"set lpu2 \\<subseteq> parser_nonterms G\")\n  apply(thin_tac \"set lpo1 \\<subseteq> parser_nonterms G\")\n  apply(thin_tac \"lpo2 \\<noteq> []\")\n  apply(thin_tac \"set lpu1 \\<subseteq> parser_nonterms G\")\n  apply(thin_tac \"lpu2 \\<noteq> []\")\n  apply(thin_tac \"lpo1 \\<noteq> []\")\n  apply(thin_tac \"lpu1 \\<noteq> []\")\n  apply(thin_tac \"set h \\<subseteq> parser_events G\")\n  apply(thin_tac \"parser_bottom G \\<notin> set h\")\n  apply(thin_tac \"d i =\n       Some\n        (pair e1a\n          \\<lparr>parserHF_conf_fixed = f, parserHF_conf_history = h,\n             parserHF_conf_stack = xe @ lpo1\\<rparr>)\")\n  apply(thin_tac \"\\<lparr>rule_lpop = lpo1, rule_rpop = kPrefix ka (wa @ [parser_bottom G]),\n          rule_lpush = lpu1, rule_rpush = rpu1\\<rparr>\n       \\<in> parser_rules G\")\n  apply(thin_tac \"\\<lparr>rule_lpop = lpo2, rule_rpop = kPrefix k (w @ [parser_bottom G]),\n          rule_lpush = lpu2, rule_rpush = rpu2\\<rparr>\n       \\<in> parser_rules G\")\n  apply(thin_tac \"drop (length f)\n        (butlast_if_match (kPrefix k (w @ [parser_bottom G]))\n          (parser_bottom G))\n       \\<in> parser_markers G\")\n  apply(simp add: kPrefix_def)\n  apply(rename_tac x xa xb k w ka wa xe xf c y xg xh wb f h lpo1 rpu1 lpo2 rpu2)(*strict*)\n  apply(case_tac \"k-length w\")\n   apply(rename_tac x xa xb k w ka wa xe xf c y xg xh wb f h lpo1 rpu1 lpo2 rpu2)(*strict*)\n   prefer 2\n   apply(rename_tac x xa xb k w ka wa xe xf c y xg xh wb f h lpo1 rpu1 lpo2 rpu2 nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa xb k ka wa xe xf c y xh f h lpo1 rpu1 lpo2 nat xc)(*strict*)\n   apply(subgoal_tac \"k = Suc nat + (length xa + length xc)\")\n    apply(rename_tac x xa xb k ka wa xe xf c y xh f h lpo1 rpu1 lpo2 nat xc)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x xa xb k ka wa xe xf c y xh f h lpo1 rpu1 lpo2 nat xc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa xb ka wa xe xf c y xh f h lpo1 rpu1 lpo2 nat xc)(*strict*)\n   apply(subgoal_tac \"min (length xa + length xc)\n                (Suc (nat + (length xa + length xc))) = (length xa + length xc)\")\n    apply(rename_tac x xa xb ka wa xe xf c y xh f h lpo1 rpu1 lpo2 nat xc)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x xa xb ka wa xe xf c y xh f h lpo1 rpu1 lpo2 nat xc)(*strict*)\n   apply(clarsimp)\n   apply(simp add: suffix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa xb ka wa xe xf c xh f lpo1 rpu1 lpo2 nat xc ca)(*strict*)\n   apply(rule_tac xs=\"xb\" in rev_cases)\n    apply(rename_tac x xa xb ka wa xe xf c xh f lpo1 rpu1 lpo2 nat xc ca)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xa ka wa xe xf c xh f lpo1 rpu1 lpo2 nat ca)(*strict*)\n    apply(rule_tac xs=\"c\" in rev_cases)\n     apply(rename_tac x xa ka wa xe xf c xh f lpo1 rpu1 lpo2 nat ca)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xa ka wa xe xf xh lpo1 rpu1 lpo2 nat ca cb)(*strict*)\n     apply(rule_tac xs=\"cb\" in rev_cases)\n      apply(rename_tac x xa ka wa xe xf xh lpo1 rpu1 lpo2 nat ca cb)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac x xa ka wa xe xf xh lpo1 rpu1 lpo2 nat ca cb ys y)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xa ka wa xe xf xh lpo1 rpu1 lpo2 nat ca ys y)(*strict*)\n     apply(case_tac \"ka - length wa\")\n      apply(rename_tac x xa ka wa xe xf xh lpo1 rpu1 lpo2 nat ca ys y)(*strict*)\n      apply(clarsimp)\n      apply(rule_tac w=\"xa @ ca\" and v=\"ys @ [y]\" and A=\"parser_bottom G\" in elem_in_append_set)\n        apply(rename_tac x xa ka wa xe xf xh lpo1 rpu1 lpo2 nat ca ys y)(*strict*)\n        apply(force)\n       apply(rename_tac x xa ka wa xe xf xh lpo1 rpu1 lpo2 nat ca ys y)(*strict*)\n       apply(force)\n      apply(rename_tac x xa ka wa xe xf xh lpo1 rpu1 lpo2 nat ca ys y)(*strict*)\n      apply (metis in_set_takeD nset_diff)\n     apply(rename_tac x xa ka wa xe xf xh lpo1 rpu1 lpo2 nat ca ys y nata)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x xa ka wa xe xf c xh f lpo1 rpu1 lpo2 nat ca ys y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xa ka wa xe xf xh f lpo1 rpu1 lpo2 nat ca ys)(*strict*)\n    apply(thin_tac \"set (drop (Suc (length xa + (length wiX + length ca))) f)\n       \\<subseteq> parser_events G\")\n    apply(thin_tac \"min (length xa + (length wiX + length ca))\n        (Suc (nat + (length xa + (length wiX + length ca)))) =\n       length xa + (length wiX + length ca)\")\n    apply(subgoal_tac \"X\" for X)\n     apply(rename_tac x xa ka wa xe xf xh f lpo1 rpu1 lpo2 nat ca ys)(*strict*)\n     prefer 2\n     apply(rule_tac v=\"ca @\n       [parser_bottom G]\" and w=\"wiX\" in append_context_empty)\n     apply(force)\n    apply(rename_tac x xa ka wa xe xf xh f lpo1 rpu1 lpo2 nat ca ys)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n    apply(subgoal_tac \"x=xh\")\n     apply(rename_tac x xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n     prefer 2\n     apply (metis append_same_eq)\n    apply(rename_tac x xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n    apply(thin_tac \"length f \\<le> Suc (length xa + length ca)\")\n    apply(subgoal_tac \"butlast_if_match ((xa @ ca) @ [parser_bottom G])\n          (parser_bottom G) = xa@ca\" )\n     apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n     prefer 2\n     apply (metis butlast_if_match_direct)\n    apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n    apply(clarsimp)\n    apply(thin_tac \"butlast_if_match (xa @ ca @ [parser_bottom G]) (parser_bottom G) =\n       xa @ ca\")\n    apply(case_tac \"ka - length wa\")\n     apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n     apply(subgoal_tac \"min (length wa) ka = ka\")\n      apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"butlast_if_match (take ka wa) (parser_bottom G) =take ka wa\")\n      apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n      prefer 2\n      apply (metis butlast_if_match_reduces parser_bottom_take_end)\n     apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n     apply(clarsimp)\n     apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take ka wa) \\<longrightarrow>\n       (\\<exists>x. x @ [parser_bottom G] = rpu1)\")\n     apply(thin_tac \"xf @ lpo2 = xe @ lpo1\")\n     apply(erule disjE)\n      apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac xa ka wa xe xh rpu1 ca ys c)(*strict*)\n      apply(erule disjE)\n       apply(rename_tac xa ka wa xe xh rpu1 ca ys c)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac xa ka wa xe xh rpu1 ca ys c cb)(*strict*)\n       apply (metis append_eq_append_conv2)\n      apply(rename_tac xa ka wa xe xh rpu1 ca ys c)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac xa ka wa xe xh rpu1 ca ys c cb)(*strict*)\n      apply (metis append_eq_append_conv2)\n     apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac xa ka wa xe xh f rpu1 ca ys c)(*strict*)\n     apply(erule disjE)\n      apply(rename_tac xa ka wa xe xh f rpu1 ca ys c)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac xa ka wa xe xh f rpu1 ca ys c)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac xa ka wa xe xh f rpu1 ca ys c cb)(*strict*)\n     apply(subgoal_tac \"cb=ys@[parser_bottom G]\")\n      apply(rename_tac xa ka wa xe xh f rpu1 ca ys c cb)(*strict*)\n      prefer 2\n      apply (metis drop_append append_assoc)\n     apply(rename_tac xa ka wa xe xh f rpu1 ca ys c cb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac xa ka wa xe xh f rpu1 ca ys c)(*strict*)\n     apply(rule_tac ?w1.0=\"f\" and ?v1.0=\"xa\" in prefix_alt_apply)\n       apply(rename_tac xa ka wa xe xh f rpu1 ca ys c)(*strict*)\n       apply(force)\n      apply(rename_tac xa ka wa xe xh f rpu1 ca ys c)(*strict*)\n      apply(simp add: prefix_def)\n      apply(clarsimp)\n      apply(rename_tac ka wa xe xh f rpu1 ca c cb)(*strict*)\n      apply(subgoal_tac \"c=cb @ ca\")\n       apply(rename_tac ka wa xe xh f rpu1 ca c cb)(*strict*)\n       prefer 2\n       apply (metis append_eq_conv_conj)\n      apply(rename_tac ka wa xe xh f rpu1 ca c cb)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac ka wa xe xh f rpu1 ca cb)(*strict*)\n      apply(rule_tac x=\" [parser_bottom G]\" in exI)\n      apply(force)\n     apply(rename_tac xa ka wa xe xh f rpu1 ca ys c)(*strict*)\n     apply(simp add: prefix_def)\n     apply(clarsimp)\n     apply(rename_tac xa ka wa xe xh rpu1 c cb)(*strict*)\n     apply(thin_tac \"set (drop (length xa + length cb) (take ka wa))\n       \\<subseteq> parser_events G - {parser_bottom G}\")\n     apply(thin_tac \"butlast_if_match (take ka wa) (parser_bottom G) = take ka wa\")\n     apply(thin_tac \"set (drop (length xa + length cb) (take ka wa)) \\<subseteq> parser_events G\")\n     apply(thin_tac \"set cb \\<subseteq> parser_events G\")\n     apply(subgoal_tac \"c=drop (length xa + length cb) (take ka wa)\")\n      apply(rename_tac xa ka wa xe xh rpu1 c cb)(*strict*)\n      prefer 2\n      apply (metis append_assoc append_eq_conv_conj length_append)\n     apply(rename_tac xa ka wa xe xh rpu1 c cb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac xa ka wa xe xh rpu1 cb)(*strict*)\n     apply(rule_tac x=\" [parser_bottom G]\" in exI)\n     apply(force)\n    apply(rename_tac xa ka wa xe xf xh f lpo1 rpu1 lpo2 ca ys nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xa ka xe xf xh f lpo1 lpo2 ca ys nat x)(*strict*)\n    apply(subgoal_tac \"ka = Suc nat+(length xh + length x)\")\n     apply(rename_tac xa ka xe xf xh f lpo1 lpo2 ca ys nat x)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac xa ka xe xf xh f lpo1 lpo2 ca ys nat x)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xa xe xf xh f lpo1 lpo2 ca ys x)(*strict*)\n    apply(rule_tac x=\"[]\" in exI)\n    apply(clarsimp)\n    apply(subgoal_tac \"butlast_if_match ((xh @ x) @ [parser_bottom G]) (parser_bottom G) = xh@x\")\n     apply(rename_tac xa xe xf xh f lpo1 lpo2 ca ys x)(*strict*)\n     prefer 2\n     apply (metis butlast_if_match_direct)\n    apply(rename_tac xa xe xf xh f lpo1 lpo2 ca ys x)(*strict*)\n    apply(clarsimp)\n    apply(thin_tac \"butlast_if_match (xh @ x @ [parser_bottom G]) (parser_bottom G) =\n       xh @ x\")\n    apply(thin_tac \"xf @ lpo2 = xe @ lpo1\")\n    apply(subgoal_tac \"ys=drop (length f) xa @ drop (length f - length xa) ca\")\n     apply(rename_tac xa xe xf xh f lpo1 lpo2 ca ys x)(*strict*)\n     prefer 2\n     apply (metis List.drop_append drop_append)\n    apply(rename_tac xa xe xf xh f lpo1 lpo2 ca ys x)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xa xe xh f ca x)(*strict*)\n    apply(erule_tac P=\"(\\<exists>c. xa @ ca @ parser_bottom G # c = f)\" in disjE)\n     apply(rename_tac xa xe xh f ca x)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac xa xe xh f ca x)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xa xe xh f ca x c)(*strict*)\n    apply(subgoal_tac \"c=drop (length f) xa @ drop (length f - length xa) ca@[parser_bottom G]\")\n     apply(rename_tac xa xe xh f ca x c)(*strict*)\n     prefer 2\n     apply(rule_tac w=\"f\" in append_linj)\n     apply(rule_tac t=\"f @ c\" and s=\"xa @ ca @ [parser_bottom G]\" in ssubst)\n      apply(rename_tac xa xe xh f ca x c)(*strict*)\n      apply(blast)\n     apply(rename_tac xa xe xh f ca x c)(*strict*)\n     apply(force)\n    apply(rename_tac xa xe xh f ca x c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xa xe xh f ca x)(*strict*)\n    apply(erule disjE)\n     apply(rename_tac xa xe xh f ca x)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac xa xe xh ca x c)(*strict*)\n     apply (metis append_assoc in_set_conv_decomp not_set_append)\n    apply(rename_tac xa xe xh f ca x)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac xa xe xh f ca x c)(*strict*)\n    apply (metis set_butlast_if_match_subset ConsApp List.drop_append append_Cons append_Nil2 append_assoc append_eq_conv_conj butlast_if_match_direct butlast_if_match_pull_out drop_butlast_if_match_distrib empty_subsetI in_set_conv_decomp  not_set_append  prefix_def set_empty set_eq_subset)\n   apply(rename_tac x xa xb ka wa xe xf c xh f lpo1 rpu1 lpo2 nat xc ca ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa ka wa xe xf c xh f lpo1 rpu1 lpo2 nat xc ca ys)(*strict*)\n   apply(rule_tac w=\"xc\" and v=\"ys\" and r=\"wiX\" and s=\"ca\" and A=\"parser_bottom G\" in elem_in_append_set)\n     apply(rename_tac x xa ka wa xe xf c xh f lpo1 rpu1 lpo2 nat xc ca ys)(*strict*)\n     apply(force)\n    apply(rename_tac x xa ka wa xe xf c xh f lpo1 rpu1 lpo2 nat xc ca ys)(*strict*)\n    apply (metis in_set_takeD nset_diff)\n   apply(rename_tac x xa ka wa xe xf c xh f lpo1 rpu1 lpo2 nat xc ca ys)(*strict*)\n   apply(force)\n  apply(rename_tac x xa xb k w ka wa xe xf c y xg xh wb f h lpo1 rpu1 lpo2 rpu2)(*strict*)\n  apply(clarsimp)\n  apply(thin_tac \"(\\<exists>x. x @ [parser_bottom G] = take k w) \\<longrightarrow>\n       (\\<exists>x. x @ [parser_bottom G] = rpu2)\")\n  apply(subgoal_tac \"min (length w) k = k\")\n   apply(rename_tac x xa xb k w ka wa xe xf c y xg xh wb f h lpo1 rpu1 lpo2 rpu2)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x xa xb k w ka wa xe xf c y xg xh wb f h lpo1 rpu1 lpo2 rpu2)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac xs=\"drop k f\" in rev_cases)\n   apply(rename_tac x xa xb k w ka wa xe xf c y xg xh wb f h lpo1 rpu1 lpo2 rpu2)(*strict*)\n   apply(clarsimp)\n   apply(simp add: suffix_def)\n   apply(clarsimp)\n   apply(rename_tac x xa xb k w ka wa xe xf c xg xh f lpo1 rpu1 lpo2 ca)(*strict*)\n   apply (metis set_take_subset insert_subset nset_diff set_append2 set_simps(2) subset_trans)\n  apply(rename_tac x xa xb k w ka wa xe xf c y xg xh wb f h lpo1 rpu1 lpo2 rpu2 ys ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xa xb k w ka wa xe xf c xg xh f h lpo1 rpu1 lpo2 rpu2 ys)(*strict*)\n  apply(thin_tac \"(rpu2 @ ys @ [parser_bottom G]) \\<sqsupseteq> [parser_bottom G]\")\n  apply(subgoal_tac \"xa=xg\")\n   apply(rename_tac x xa xb k w ka wa xe xf c xg xh f h lpo1 rpu1 lpo2 rpu2 ys)(*strict*)\n   prefer 2\n   apply (metis append_same_eq)\n  apply(rename_tac x xa xb k w ka wa xe xf c xg xh f h lpo1 rpu1 lpo2 rpu2 ys)(*strict*)\n  apply(thin_tac \"xf @ lpo2 = xe @ lpo1\")\n  apply(clarsimp)\n  apply(rename_tac x xb k w ka wa xe c xg xh f h rpu1 rpu2 ys)(*strict*)\n  apply(rule_tac xs=\"xb\" in rev_cases)\n   apply(rename_tac x xb k w ka wa xe c xg xh f h rpu1 rpu2 ys)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x xb k w ka wa xe c xg xh f h rpu1 rpu2 ys ysa y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x k w ka wa xe c xg xh f h rpu1 rpu2 ys ysa)(*strict*)\n  apply(rule_tac xs=\"f\" in rev_cases)\n   apply(rename_tac x k w ka wa xe c xg xh f h rpu1 rpu2 ys ysa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x k w ka wa xe c xg xh f h rpu1 rpu2 ys ysa ysb y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x k w ka wa xe c xg xh h rpu1 rpu2 ys ysa ysb y)(*strict*)\n  apply(case_tac \"k - length ysb\")\n   apply(rename_tac x k w ka wa xe c xg xh h rpu1 rpu2 ys ysa ysb y)(*strict*)\n   prefer 2\n   apply(rename_tac x k w ka wa xe c xg xh h rpu1 rpu2 ys ysa ysb y nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x k w ka wa xe c xg xh h rpu1 rpu2 ys ysa ysb y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x k w ka wa xe c xg xh h rpu1 rpu2 ysa ysb)(*strict*)\n  apply(rule_tac xs=\"c\" in rev_cases)\n   apply(rename_tac x k w ka wa xe c xg xh h rpu1 rpu2 ysa ysb)(*strict*)\n   prefer 2\n   apply(rename_tac x k w ka wa xe c xg xh h rpu1 rpu2 ysa ysb ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x k w ka wa xe xg xh h rpu1 rpu2 ysa ysb ys)(*strict*)\n   apply(rule_tac w=\"ysb\" and v=\"ys\" and r=\"wi @ rpu2\" and s=\"drop k ysb\" and A=\"parser_bottom G\" in elem_in_append_set)\n     apply(rename_tac x k w ka wa xe xg xh h rpu1 rpu2 ysa ysb ys)(*strict*)\n     apply(force)\n    apply(rename_tac x k w ka wa xe xg xh h rpu1 rpu2 ysa ysb ys)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x k w ka wa xe xg xh h rpu1 rpu2 ysa ysb ys)(*strict*)\n   apply (metis in_set_takeD nset_diff)\n  apply(rename_tac x k w ka wa xe c xg xh h rpu1 rpu2 ysa ysb)(*strict*)\n  apply(subgoal_tac \"ysb @ parser_bottom G #[] =\n       wi @ rpu2 @ drop k ysb @ [parser_bottom G]\")\n   apply(rename_tac x k w ka wa xe c xg xh h rpu1 rpu2 ysa ysb)(*strict*)\n   prefer 2\n   apply(blast)\n  apply(rename_tac x k w ka wa xe c xg xh h rpu1 rpu2 ysa ysb)(*strict*)\n  apply(thin_tac \"ysb @ parser_bottom G # c =\n       wi @ rpu2 @ drop k ysb @ [parser_bottom G]\")\n  apply(clarsimp)\n  apply(rename_tac x k w ka wa xe xh h rpu1 rpu2 ysa ca)(*strict*)\n  apply(thin_tac \" h \\<sqsupseteq>\n       butlast_if_match (wi @ rpu2 @ ysa @ [parser_bottom G])\n        (parser_bottom G)\")\n  apply(thin_tac \"drop (Suc (k + length ysa))\n        (butlast_if_match\n          (take ka wa @ take (ka - length wa) [parser_bottom G])\n          (parser_bottom G)) =\n       drop (Suc (k + length ysa))\n        (butlast_if_match (wi @ rpu2) (parser_bottom G))\")\n  apply(rule_tac xs=\"ca\" in rev_cases)\n   apply(rename_tac x k w ka wa xe xh h rpu1 rpu2 ysa ca)(*strict*)\n   prefer 2\n   apply(rename_tac x k w ka wa xe xh h rpu1 rpu2 ysa ca ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa ys y)(*strict*)\n   apply(case_tac \"ka - length wa\")\n    apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa ys y)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac w=\"wi @ rpu2 @ ysa\" and v=\"ys@[y]\" and r=\"take ka wa\" and s=\"[]\" and A=\"parser_bottom G\" in elem_in_append_set)\n      apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa ys y)(*strict*)\n      apply(force)\n     apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa ys y)(*strict*)\n     apply (metis in_set_takeD nset_diff)\n    apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa ys y)(*strict*)\n    apply(force)\n   apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa ys y nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x k w ka wa xe xh h rpu1 rpu2 ysa ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa)(*strict*)\n  apply(case_tac \"ka - length wa\")\n   apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac w=\"wi @ rpu2 @ ysa\" and v=\"[]\" and r=\"take ka wa\" and s=\"[]\" and A=\"parser_bottom G\" in elem_in_append_set)\n     apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa)(*strict*)\n     apply(force)\n    apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa)(*strict*)\n    apply (metis in_set_takeD nset_diff)\n   apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa)(*strict*)\n   apply(force)\n  apply(rename_tac x k w ka wa xe xh rpu1 rpu2 ysa nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x k w ka xe xh rpu2 ysa nat xa)(*strict*)\n  apply(subgoal_tac \"ka  = Suc nat+(length wi + (length rpu2 + length ysa))\")\n   apply(rename_tac x k w ka xe xh rpu2 ysa nat xa)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x k w ka xe xh rpu2 ysa nat xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x k w xe xh rpu2 ysa xa)(*strict*)\n  apply(subgoal_tac \"x=xh\")\n   apply(rename_tac x k w xe xh rpu2 ysa xa)(*strict*)\n   prefer 2\n   apply (metis append_same_eq)\n  apply(rename_tac x k w xe xh rpu2 ysa xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k w xe xh rpu2 ysa xa)(*strict*)\n  apply(rule_tac x=\"[]\" in exI)\n  apply(clarsimp)\n  apply (metis List.length_take add_diff_cancel_left' append_Nil append_take_drop_id diff_is_0_eq' drop_eq_Nil drop_length_append length_append order_refl take_0)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step2_hlp: \"\n              valid_parser G \\<Longrightarrow>\n       ATS.derivation_initial parserHF_initial_configurations\n        parserHF_step_relation G d \\<Longrightarrow>\n       parserHF_step_relation G c e1 c1 \\<Longrightarrow>\n       parserHF_step_relation G c e2a c2 \\<Longrightarrow>\n       d i = Some (pair e1a c) \\<Longrightarrow>\n       parserHF_conf_history c1 = parserHF_conf_history c @ hf2 \\<Longrightarrow>\n       parserHF_conf_history c2 = parserHF_conf_history c @ hf2 \\<Longrightarrow>\n       hf2 \\<in> parser_markers G \\<Longrightarrow>\n       \\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow>\n       \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow>\n       \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n          parserHFS_conf_history = parserHF_conf_history c,\n          parserHFS_conf_stack = parserHF_conf_stack c,\n          parserHFS_conf_scheduler =\n            wi @\n            (if parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\n             then parserHF_conf_fixed c2\n             else parserHF_conf_fixed c2 @ [parser_bottom G])\\<rparr>\n       \\<in> parserHFS_configurations G \\<Longrightarrow>\n       parserHFS_step_relation G\n        \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n           parserHFS_conf_history = parserHF_conf_history c,\n           parserHFS_conf_stack = parserHF_conf_stack c,\n           parserHFS_conf_scheduler =\n             wi @\n             (if parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\n              then parserHF_conf_fixed c2\n              else parserHF_conf_fixed c2 @ [parser_bottom G])\\<rparr>\n        e2a\n        \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c2,\n           parserHFS_conf_history = parserHF_conf_history c @ hf2,\n           parserHFS_conf_stack = parserHF_conf_stack c2,\n           parserHFS_conf_scheduler =\n             wix @\n             (if parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G]\n              then parserHF_conf_fixed c2\n              else parserHF_conf_fixed c2 @ [parser_bottom G])\\<rparr> \\<Longrightarrow>\n       (parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow>\n        Ex (parserHFS_step_relation G\n             \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n                parserHFS_conf_history = parserHF_conf_history c,\n                parserHFS_conf_stack = parserHF_conf_stack c,\n                parserHFS_conf_scheduler =\n                  wi @\n                  parserHF_conf_fixed c2\\<rparr>\n             e1)) \\<and>\n       (\\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow>\n        Ex (parserHFS_step_relation G\n             \\<lparr>parserHFS_conf_fixed = parserHF_conf_fixed c,\n                parserHFS_conf_history = parserHF_conf_history c,\n                parserHFS_conf_stack = parserHF_conf_stack c,\n                parserHFS_conf_scheduler =\n                  wi @\n                  parserHF_conf_fixed c2 @ [parser_bottom G]\\<rparr>\n             e1))\"\n  apply(rule conjI)\n   apply(clarsimp)\n   prefer 2\n   apply(clarsimp)\n   apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step2_hlp1)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step2_hlp2)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma parserHF_history_prefix_makes_equal: \"\n  valid_parser G\n  \\<Longrightarrow> hf1 \\<in> parser_markers G\n  \\<Longrightarrow> hf2 \\<in> parser_markers G\n  \\<Longrightarrow> ATS_History.history_fragment_prefixes parser_markers (@) G hf1 = ATS_History.history_fragment_prefixes parser_markers (@) G hf2\n  \\<Longrightarrow> hf1 = hf2\"\n  apply(subgoal_tac \"prefix hf1 hf2\")\n   prefer 2\n   apply(rule parserHF_history_prefix_makes_prefix)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"prefix hf2 hf1\")\n   prefer 2\n   apply(rule parserHF_history_prefix_makes_prefix)\n    apply(force)\n   apply(force)\n  apply (metis mutual_prefix_implies_equality)\n  done\n\nlemma parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step2: \"\n    (\\<forall>G. valid_parser G \\<longrightarrow>\n         (\\<forall>d. ATS.derivation_initial parserHF_initial_configurations\n               parserHF_step_relation G d \\<longrightarrow>\n              (\\<forall>c e1 c1.\n                  parserHF_step_relation G c e1 c1 \\<longrightarrow>\n                  (\\<forall>e2 c2.\n                      parserHF_step_relation G c e2 c2 \\<longrightarrow>\n                      (\\<forall>i. (\\<exists>ei. d i = Some (pair ei c)) \\<longrightarrow>\n                           (\\<forall>hf1. parserHF_conf_history c1 =\n                                  parserHF_conf_history c @ hf1 \\<longrightarrow>\n                                  (\\<forall>hf2.\nparserHF_conf_history c2 = parserHF_conf_history c @ hf2 \\<longrightarrow>\nATS_History.history_fragment_prefixes parser_markers (@) G hf1 =\nATS_History.history_fragment_prefixes parser_markers (@) G hf2 \\<longrightarrow>\nATS.derivation_initial parserHFS_initial_configurations\n parserHFS_step_relation G\n (ATS_Branching_Versus_Linear1.Bra2LinDer parser_empty_scheduler_fragment\n   (@) (@) parserHF_conf_fixed parserHFvHFS_Bra2LinConf\n   parserHFvHFS_Bra2LinStep\n   (\\<lambda>G w. if w \\<sqsupseteq> [parser_bottom G] then w else w @ [parser_bottom G]) G\n   (derivation_append d (der2 c e2 c2) i) (Suc i)) \\<longrightarrow>\nhf1 \\<in> parser_markers G \\<longrightarrow>\nhf2 \\<in> parser_markers G \\<longrightarrow>\n(\\<not> parserHF_conf_fixed c2 \\<sqsupseteq> [parser_bottom G] \\<longrightarrow>\n \\<not> parserHF_conf_fixed c1 \\<sqsupseteq> [parser_bottom G]) \\<longrightarrow>\nEx (parserHFS_step_relation G\n     (the (get_configuration\n            (ATS_Branching_Versus_Linear1.Bra2LinDer\n              parser_empty_scheduler_fragment (@) (@) parserHF_conf_fixed\n              parserHFvHFS_Bra2LinConf parserHFvHFS_Bra2LinStep\n              (\\<lambda>G w. if w \\<sqsupseteq> [parser_bottom G] then w\n                     else w @ [parser_bottom G])\n              G (derivation_append d (der2 c e2 c2) i) (Suc i) i)))\n     e1))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. SSd SSn = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> parserHFS_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"parserHF_vs_parserHFS.Bra2LinDer\n          G (derivation_append d (der2 c e2 c2) i) (Suc i)\"\n      and n=\"i\" and\n      m=\"Suc i\"\n      in parserHFS.step_detail_before_some_position)\n     apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2)(*strict*)\n     apply(simp add: parserHFS.derivation_initial_def)\n    apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2)(*strict*)\n    apply(simp add: parserHF_vs_parserHFS.Bra2LinDer_def derivation_append_def der2_def get_configuration_def parserHFvHFS_Bra2LinConf_def parserHF_vs_parserHFS.Bra2LinDer'_def parserHFvHFS_Bra2LinStep_def parser_empty_scheduler_fragment_def)\n   apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2)(*strict*)\n   apply(force)\n  apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2 e1a e2a c1a c2a)(*strict*)\n  apply(subgoal_tac \"c1a \\<in> parserHFS_configurations G\")\n   apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2 e1a e2a c1a c2a)(*strict*)\n   prefer 2\n   apply(rule_tac e=\"e1a\" and i=\"i\" in parserHFS.belongs_configurations)\n    apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2 e1a e2a c1a c2a)(*strict*)\n    apply(rule parserHFS.derivation_initial_belongs)\n     apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2 e1a e2a c1a c2a)(*strict*)\n     apply(force)\n    apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2 e1a e2a c1a c2a)(*strict*)\n    apply(force)\n   apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2 e1a e2a c1a c2a)(*strict*)\n   apply(force)\n  apply(rename_tac G d c e1 c1 e2 c2 i ei hf1 hf2 e1a e2a c1a c2a)(*strict*)\n  apply(thin_tac \"parserHFS.derivation_initial G\n        (parserHF_vs_parserHFS.Bra2LinDer\n          G (derivation_append d (der2 c e2 c2) i) (Suc i))\")\n  apply(simp only: parserHF_vs_parserHFS.Bra2LinDer_def get_configuration_def derivation_append_def der2_def)\n  apply(simp add: parserHFvHFS_Bra2LinConf_def)\n  apply(clarsimp)\n  apply(rename_tac G d c e1 c1 c2 i hf1 hf2 e1a e2a)(*strict*)\n  apply(subgoal_tac \"hf1=hf2\")\n   apply(rename_tac G d c e1 c1 c2 i hf1 hf2 e1a e2a)(*strict*)\n   prefer 2\n   apply(rule parserHF_history_prefix_makes_equal)\n      apply(rename_tac G d c e1 c1 c2 i hf1 hf2 e1a e2a)(*strict*)\n      apply(force)\n     apply(rename_tac G d c e1 c1 c2 i hf1 hf2 e1a e2a)(*strict*)\n     apply(force)\n    apply(rename_tac G d c e1 c1 c2 i hf1 hf2 e1a e2a)(*strict*)\n    apply(force)\n   apply(rename_tac G d c e1 c1 c2 i hf1 hf2 e1a e2a)(*strict*)\n   apply(force)\n  apply(rename_tac G d c e1 c1 c2 i hf1 hf2 e1a e2a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G d c e1 c1 c2 i hf2 e1a e2a)(*strict*)\n  apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step2_hlp)\n            apply(rename_tac G d c e1 c1 c2 i hf2 e1a e2a)(*strict*)\n            apply(force)+\n  done\n\nlemma parserHF_vs_parserHFS_inst_ATS_Branching_Versus_Linear2_axioms: \"\n  ATS_Branching_Versus_Linear2_axioms valid_parser\n     parserHFS_configurations parserHFS_initial_configurations\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect\n     parser_fixed_scheduler_extendable parser_scheduler_fragments\n     parser_empty_scheduler_fragment (@) right_quotient_word (@)\n     parser_unfixed_scheduler_extendable parser_schedulers\n     parser_empty_scheduler parserHFS_get_scheduler (@)\n     parserHFS_get_unfixed_scheduler parserHFS_set_unfixed_scheduler\n     parserHFS_conf_fixed parser_markers parser_empty_history_fragment (@)\n     (@) parserHF_configurations parserHF_initial_configurations\n     parserHF_step_relation parserHF_marking_condition\n     parserHF_marked_effect parserHF_unmarked_effect\n     parser_empty_fixed_scheduler parser_fixed_scheduler_extendable\n     parserHF_conf_fixed parserHF_conf_history parserHFvHFS_Lin2BraConf\n     parserHFvHFS_Bra2LinConf parserHFvHFS_Bra2LinStep\n     (\\<lambda>G w. if w \\<sqsupseteq> [parser_bottom G] then w else w @ [parser_bottom G]) \"\n  apply(simp only: ATS_Branching_Versus_Linear2_axioms_def)\n  apply(rule conjI)+\n      apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinConf_triv_with_get_scheduler)\n     apply(simp)\n     apply(rule parserHF_vs_parserHFS_inst_AX_Lin2BraDer_preserves_marking_condition)\n    apply(rule conjI)+\n     apply(simp)\n     apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinDer_preserves_marking_condition)\n    apply(rule conjI)+\n     apply(simp)\n     apply(rule parserHFvHFS_inst_AX_Bra2LinConf_on_empty_bra_sched_closed)\n    apply(simp add: suffix_def)\n   apply(rule conjI)+\n     apply(simp)\n     apply(rule parserHF_vs_parserHFS_inst_AX_Lin2BraConf_Bra2LinConf_idemp)\n    apply(subgoal_tac \"X\" for X)\n     prefer 2\n     apply(rule parserHF_vs_parserHFS_inst_AX_set_constructed_sched_vs_set_constructed_schedUF_prime_prime)\n    apply(rule allI)+\n    apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n    apply(rule impI)+\n    apply(erule_tac x=\"G\" in allE)\n    apply(erule_tac x=\"c1L\" in allE)\n    apply(erule_tac x=\"c3L\" in allE)\n    apply(erule_tac x=\"cB\" in allE)\n    apply(erule_tac x=\"e\" in allE)\n    apply(erule_tac x=\"c2L\" in allE)\n    apply(erule_tac x=\"sE3\" in allE)\n    apply(erule_tac x=\"sE2\" in allE)\n    apply(erule_tac x=\"sE1\" in allE)\n    apply(erule impE)\n     apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n    apply(erule impE)\n     apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n    apply(erule impE)\n     apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n    apply(erule impE)\n     apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n    apply(erule impE)\n     apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n    apply(erule impE)\n     apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n     apply(force)\n    apply(rename_tac G c1L c3L cB e c2L sL sLUF sE2 sE3 sE1)(*strict*)\n    apply(force)\n   apply(rule conjI)+\n    apply(rule parserHF_vs_parserHFS_inst_AX_lin_unfixed_scheduler_right_quotient_drop_proper2)\n   apply(rule conjI)+\n    apply(rule parserHF_vs_parserHFS_inst_AX_Lin2BraConf_ignores_set_unfixed_scheduler)\n   apply(rule parserHF_vs_parserHFS_inst_AX_Lin2BraConf_preserves_fixed_scheduler_extendable)\n  apply(rule conjI)+\n     apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinStep_Bra2LinFin_compatible)\n    apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinFin_takes_entire_fixed_scheduler)\n   apply(rule conjI)+\n    apply(rule parserHF_vs_parserHFS_inst_AX_combine_consumed_and_remaining_scheduler)\n   apply(rule conjI)+\n    apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinConf_Lin2BraConf_idemp_on_get_scheduler)\n   apply(rule parserHF_vs_parserHFS_inst_AX_bra2lin_preserves_unmarked_effect)\n  apply(rule conjI)+\n    apply(rule parserHF_vs_parserHFS_inst_AX_lin2bra_preserves_unmarked_effect)\n   apply(rule conjI)+\n    apply(rule parserHF_vs_parserHFS_inst_AX_bra2lin_preserves_marked_effect)\n   apply(rule parserHF_vs_parserHFS_inst_AX_lin2bra_preserves_marked_effect)\n  apply(rule conjI)+\n   apply(simp)\n   apply(rule parserHF_vs_parserHFS_inst_AX_Lin2BraConf_enforces_compatible_history_fragment_SB)\n  apply(rule conjI)+\n   apply(simp)\n   apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step1)\n  apply(simp)\n  apply(rule parserHF_vs_parserHFS_inst_AX_Bra2LinDer_allows_slim_step2)\n  done\n\ninterpretation \"parserHF_vs_parserHFS\" : ATS_Branching_Versus_Linear2\n  (* TSstructure *)\n  \"valid_parser\"\n  (* lin_configurations *)\n  \"parserHFS_configurations\"\n  (* lin_initial_configurations *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels *)\n  \"parser_step_labels\"\n  (* lin_step_relation *)\n  \"parserHFS_step_relation\"\n  (* effects *)\n  \"parser_markers\"\n  (* lin_marking_condition *)\n  \"parserHFS_marking_condition\"\n  (* lin_marked_effect *)\n  \"parserHFS_marked_effect\"\n  (* lin_unmarked_effect *)\n  \"parserHFS_unmarked_effect\"\n  (* lin_fixed_schedulers *)\n  \"parser_fixed_schedulers\"\n  (* lin_empty_fixed_scheduler *)\n  \"parser_empty_fixed_scheduler\"\n  (* lin_fixed_scheduler_extendable *)\n  \"parser_fixed_scheduler_extendable\"\n  (* lin_scheduler_fragments *)\n  \"parser_scheduler_fragments\"\n  (* lin_empty_scheduler_fragment *)\n  \"parser_empty_scheduler_fragment\"\n  (* lin_join_scheduler_fragments *)\n  \"append\"\n  (* lin_unfixed_schedulers *)\n  \"parser_unfixed_schedulers\"\n  (* lin_empty_unfixed_scheduler *)\n  \"parser_empty_unfixed_scheduler\"\n  (* lin_unfixed_scheduler_right_quotient_word *)\n  \"right_quotient_word\"\n  (* lin_extend_unfixed_scheduler *)\n  \"append\"\n  (* lin_unfixed_scheduler_extendable *)\n  \"parser_unfixed_scheduler_extendable\"\n  (* lin_schedulers *)\n  \"parser_schedulers\"\n  (* lin_initial_schedulers *)\n  \"parser_schedulers\"\n  (* lin_empty_scheduler *)\n  \"parser_empty_scheduler\"\n  (* lin_get_scheduler *)\n  \"parserHFS_get_scheduler\"\n  (* lin_join_fixed_scheduler_unfixed_scheduler *)\n  \"append\"\n  (* lin_extend_scheduler *)\n  \"append\"\n  (* lin_get_unfixed_scheduler *)\n  \"parserHFS_get_unfixed_scheduler\"\n  (* lin_set_unfixed_scheduler *)\n  \"parserHFS_set_unfixed_scheduler\"\n  (* lin_get_fixed_scheduler *)\n  \"parserHFS_conf_fixed\"\n  (* histories *)\n  \"parser_markers\"\n  (* history_fragments *)\n  \"parser_markers\"\n  (* empty_history *)\n  \"parser_empty_history\"\n  (* empty_history_fragment *)\n  \"parser_empty_history_fragment\"\n  (* lin_set_history *)\n  \"parserHFS_set_history\"\n  (* extend_history *)\n  \"append\"\n  (* join_history_fragments *)\n  \"append\"\n  (* lin_get_history *)\n  \"parserHFS_conf_history\"\n  (* bra_configurations *)\n  \"parserHF_configurations\"\n  (* bra_initial_configurations *)\n  \"parserHF_initial_configurations\"\n  (* bra_step_relation *)\n  \"parserHF_step_relation\"\n  (* bra_marking_condition *)\n  \"parserHF_marking_condition\"\n  (* bra_marked_effect *)\n  \"parserHF_marked_effect\"\n  (* bra_unmarked_effect *)\n  \"parserHF_unmarked_effect\"\n  (* bra_fixed_schedulers *)\n  \"parser_fixed_schedulers\"\n  (* bra_empty_fixed_scheduler *)\n  \"parser_empty_fixed_scheduler\"\n  (* bra_fixed_scheduler_extendable *)\n  \"parser_fixed_scheduler_extendable\"\n  (* bra_get_fixed_scheduler *)\n  \"parserHF_conf_fixed\"\n  (* bra_set_history *)\n  \"parserHF_set_history\"\n  (* bra_get_history *)\n  \"parserHF_conf_history\"\n  (* Lin2BraConf *)\n  \"parserHFvHFS_Lin2BraConf\"\n  (* Bra2LinConf *)\n  \"parserHFvHFS_Bra2LinConf\"\n  (* Bra2LinStep *)\n  \"parserHFvHFS_Bra2LinStep\"\n  (* Bra2LinFin *)\n  \"\\<lambda>G w. if (suffix w [parser_bottom G]) then w else w@[parser_bottom G]\"\n  apply(simp add: LOCALE_DEFS parserHF_interpretations parserHFS_interpretations0)\n  apply(simp add: parserHF_vs_parserHFS_inst_ATS_Branching_Versus_Linear1_axioms parserHF_vs_parserHFS_inst_ATS_Branching_Versus_Linear2_axioms)\n  done\n\ntheorem parserHFS2HF_DEdetermR_FEdetermHist_DB: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.is_forward_edge_deterministic_accessible G\n  \\<Longrightarrow> parserHF.is_forward_edge_deterministicHist_DB_long G\"\n  apply(simp add: parserHF.is_forward_edge_deterministicHist_DB_long_def)\n  apply(clarsimp)\n  apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n  apply(case_tac \"w1=w2\")\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n   apply(simp add: parserHFS.is_forward_edge_deterministic_accessible_def)\n   apply(case_tac \"parserHF_conf_fixed c \\<sqsupseteq> [parser_bottom G]\")\n    apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n    apply(subgoal_tac \"w2=[]\")\n     apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n     prefer 2\n     apply(rule_tac\n      c=\"c\"\n      in no_history_extension_if_already_unextendable)\n         apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n         apply(force)\n        apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n        apply(simp add: get_configuration_def)\n        apply(case_tac \"d n\")\n         apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n         apply(force)\n        apply(rename_tac c d n c1 c2 e1 e2 w2 a)(*strict*)\n        apply(clarsimp)\n        apply(case_tac a)\n        apply(rename_tac c d n c1 c2 e1 e2 w2 a option b)(*strict*)\n        apply(clarsimp)\n        apply(rename_tac c d n c1 c2 e1 e2 w2 option)(*strict*)\n        apply(subgoal_tac \"c \\<in> parserHF_configurations G\")\n         apply(rename_tac c d n c1 c2 e1 e2 w2 option)(*strict*)\n         prefer 2\n         apply(rule_tac\n      d=\"d\"\n      in parserHF.belongs_configurations)\n          apply(rename_tac c d n c1 c2 e1 e2 w2 option)(*strict*)\n          prefer 2\n          apply(force)\n         apply(rename_tac c d n c1 c2 e1 e2 w2 option)(*strict*)\n         apply (metis parserHF.derivation_initial_belongs)\n        apply(rename_tac c d n c1 c2 e1 e2 w2 option)(*strict*)\n        apply(clarsimp)\n       apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n       apply(force)\n      apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n      apply(force)\n     apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n     apply(force)\n    apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac c d n c1 c2 e1 e2)(*strict*)\n    apply(rule parserHFS2HF_FEdetermHist_hlp2)\n            apply(rename_tac c d n c1 c2 e1 e2)(*strict*)\n            apply(force)\n           apply(rename_tac c d n c1 c2 e1 e2)(*strict*)\n           apply(force)\n          apply(rename_tac c d n c1 c2 e1 e2)(*strict*)\n          apply(force)\n         apply(rename_tac c d n c1 c2 e1 e2)(*strict*)\n         apply(force)\n        apply(rename_tac c d n c1 c2 e1 e2)(*strict*)\n        apply(force)\n       apply(rename_tac c d n c1 c2 e1 e2)(*strict*)\n       apply(force)\n      apply(rename_tac c d n c1 c2 e1 e2)(*strict*)\n      apply(force)\n     apply(rename_tac c d n c1 c2 e1 e2)(*strict*)\n     apply(force)\n    apply(rename_tac c d n c1 c2 e1 e2)(*strict*)\n    apply(force)\n   apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n   apply(subgoal_tac \"(suffix (parserHF_conf_fixed c1) [parser_bottom G] \\<longrightarrow> (suffix (parserHF_conf_fixed c2) [parser_bottom G])) \\<or> ((suffix (parserHF_conf_fixed c2) [parser_bottom G]) \\<longrightarrow> (suffix (parserHF_conf_fixed c1) [parser_bottom G]))\")\n    apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n    prefer 2\n    apply(rule parserHFS2HF_FEdetermHist_hlp1)\n             apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n             apply(force)\n            apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n            apply(force)\n           apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n           apply(force)\n          apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n          apply(force)\n         apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n         apply(force)\n        apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n        apply(force)\n       apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n       apply(force)\n      apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n      apply(force)\n     apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n     apply(force)\n    apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n    apply(force)\n   apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n   apply(rule sym)\n   apply(rule parserHFS2HF_FEdetermHist_hlp1)\n            apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n            apply(force)\n           apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n           apply(force)\n          apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n          apply(force)\n         apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n         apply(force)\n        apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n        apply(force)\n       apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n       apply(force)\n      apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n      apply(force)\n     apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n     apply(force)\n    apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n    apply(force)\n   apply(rename_tac c d n c1 c2 e1 e2 w2)(*strict*)\n   apply(force)\n  apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(case_tac \"d n\")\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac c d n c1 c2 e1 e2 w1 w2 a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac c d n c1 c2 e1 e2 w1 w2 a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n  apply(subgoal_tac \"c \\<in> parserHF_configurations G\")\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      in parserHF.belongs_configurations)\n    apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n   apply (metis parserHF.derivation_initial_belongs)\n  apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n  apply(case_tac \"ATS_History.history_fragment_prefixes parser_markers (@) G w1 \\<subseteq> ATS_History.history_fragment_prefixes parser_markers (@) G w2 \\<and> \\<not> parserHF_get_fixed_scheduler_DB G (derivation_append d (der2 c e1 c1) n) (Suc n) \\<sqsupseteq> [parser_bottom G]\")\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n   apply(clarsimp)\n   apply(rule sym)\n   apply(rule parserHFS2HF_FEdetermHist_hlp3)\n              apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n              apply(force)\n             apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n             apply(force)\n            apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n            apply(force)\n           apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n           apply(force)\n          apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n          apply(force)\n         apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n         apply(force)\n        apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n        apply(force)\n       apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n       apply(force)\n      apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n      apply(force)\n     apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n     apply(force)\n    apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n    apply(force)\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n   apply(force)\n  apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n   apply(force)\n  apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n   prefer 2\n   apply(simp add: parserHF.history_fragment_prefixes_def)\n   apply(subgoal_tac \"w1=w2\")\n    apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n    apply(force)\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n   apply(subgoal_tac \"w1 \\<in> parser_markers G\")\n    apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n    apply(subgoal_tac \"w2 \\<in> parser_markers G\")\n     apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n     apply(subgoal_tac \"[] \\<in> parser_markers G\")\n      apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n      apply(rule mutual_prefix_implies_equality)\n       apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n       apply(subgoal_tac \"w1 \\<in> {hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w2}\")\n        apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n        apply(thin_tac \"{hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w2} = {hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w1}\")\n        apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n        apply(simp add: prefix_def)\n        apply(clarsimp)\n       apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n       apply(rule_tac\n      t=\"{hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w2}\"\n      and s=\"{hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w1}\"\n      in ssubst)\n        apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n        apply(force)\n       apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n       apply(force)\n      apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n      apply(subgoal_tac \"w2 \\<in> {hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w1}\")\n       apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n       apply(thin_tac \"{hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w2} = {hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w1}\")\n       apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n       apply(simp add: prefix_def)\n       apply(clarsimp)\n      apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n      apply(rule_tac\n      s=\"{hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w2}\"\n      and t=\"{hf' \\<in> parser_markers G. \\<exists>hf''\\<in> parser_markers G. hf' @ hf'' = w1}\"\n      in ssubst)\n       apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n       apply(force)\n      apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n      apply(force)\n     apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n     apply(simp add: parser_markers_def)\n    apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n    apply(simp add: parser_markers_def)\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n   apply(simp add: parser_markers_def)\n  apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n  apply(rule parserHFS2HF_FEdetermHist_hlp3)\n             apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n             apply(force)\n            apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n            apply(force)\n           apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n           apply(force)\n          apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n          apply(force)\n         apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n         apply(force)\n        apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n        apply(force)\n       apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n       apply(force)\n      apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n      apply(force)\n     apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n     apply(force)\n    apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n    apply(force)\n   apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n   apply(force)\n  apply(rename_tac c d n c1 c2 e1 e2 w1 w2 option)(*strict*)\n  apply(force)\n  done\n\ncorollary parserHFS2HF_FEdetermHist: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.is_forward_edge_deterministicHist_DB_long G\n  \\<Longrightarrow> parserHF.is_forward_edge_deterministicHist_DB_long G\"\n  apply (metis parserHFS.AX_is_forward_edge_deterministic_correspond_DB_SB parserHFS.AX_is_forward_edge_deterministic_correspond_SB parserHFS2HF_DEdetermR_FEdetermHist_DB)\n  done\n\ntheorem parserHF_vs_parserHFS_Nonblockingness_and_lang_transfer: \"\n  valid_parser G\n  \\<Longrightarrow> (parserHFS.Nonblockingness_linear_DB G \\<longleftrightarrow> parserHF.Nonblockingness_branching G) \\<and> parserHFS.unmarked_language G = parserHF.unmarked_language G \\<and> parserHFS.marked_language G = parserHF.marked_language G\"\n  apply(rule conjI)\n   apply(rule order_antisym)\n    apply(clarsimp)\n    apply(rule parserHF_vs_parserHFS.bflin_to_bfbra)\n     apply(force)+\n    apply(metis parserHFS.Nonblockingness_linear_vs_Nonblockingness_linear_DB)\n   apply(clarsimp)\n   apply(metis parserHF_vs_parserHFS.bfbra_to_bflin parserHFS.Nonblockingness_linear_vs_Nonblockingness_linear_DB)\n  apply(rule conjI)\n   apply(rule order_antisym)\n    apply(rule_tac\n      t=\"parserHFS.unmarked_language G\"\n      and s=\"parserHFS.finite_unmarked_language G\"\n      in ssubst)\n     apply (metis parserHFS.AX_unmarked_language_finite)\n    apply (metis parserHF_vs_parserHFS.ATS_Branching_Versus_Linear2_unmarked_language_translation2)\n   apply(rule_tac\n      t=\"parserHF.unmarked_language G\"\n      and s=\"parserHF.finite_unmarked_language G\"\n      in ssubst)\n    apply (metis parserHF.AX_unmarked_language_finite)\n   apply (metis parserHF_vs_parserHFS.ATS_Branching_Versus_Linear2_unmarked_language_translation1)\n  apply(rule order_antisym)\n   apply(rule_tac\n      t=\"parserHFS.marked_language G\"\n      and s=\"parserHFS.finite_marked_language G\"\n      in ssubst)\n    apply (metis parserHFS.AX_marked_language_finite)\n   apply (metis parserHF_vs_parserHFS.ATS_Branching_Versus_Linear2_marked_language_translation2)\n  apply(rule_tac\n      t=\"parserHF.marked_language G\"\n      and s=\"parserHF.finite_marked_language G\"\n      in ssubst)\n   apply (metis parserHF.AX_marked_language_finite)\n  apply (metis parserHF_vs_parserHFS.ATS_Branching_Versus_Linear2_marked_language_translation1)\n  done\n\nlemma parserHFS_inst_hlp_BF_LinSBRest_DetR_LaOp: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.is_forward_deterministic_accessible G\n  \\<Longrightarrow> nonblockingness_language (parserHFS.unmarked_language G) (parserHFS.marked_language G)\n  \\<Longrightarrow> parserHFS.Nonblockingness_linear_restricted G\"\n  apply(rule parserHF_vs_parserHFS.bfbra_to_bflin_rest)\n   apply(force)\n  apply(rule parserHF.AX_BF_BraSBRest_DetHDB_LaOp)\n    apply(force)\n   apply(rule_tac\n      t=\"parserHF.is_forward_deterministicHist_SB G\"\n      and s=\"parserHF.is_forward_deterministicHist_DB G\"\n      in ssubst)\n    apply(rule parserHF.is_forward_deterministic_correspond_DB_SB)\n    apply(force)\n   apply(simp only: parserHF.is_forward_deterministicHist_DB_def)\n   apply(rule conjI)\n    apply(rule parserHF_is_forward_target_deterministicHist_DB_long)\n    apply(force)\n   apply(rule parserHFS2HF_FEdetermHist)\n    apply(force)\n   apply(rule parserHFS.is_forward_edge_deterministic_accessible_implies_is_forward_edge_deterministicHist_DB_long)\n    apply(force)\n   apply(simp add: parserHFS.is_forward_deterministic_accessible_def)\n  apply(rule_tac\n      t=\"parserHF.unmarked_language G\"\n      and s=\"parserHFS.unmarked_language G\"\n      in ssubst)\n   apply(metis parserHF_vs_parserHFS_Nonblockingness_and_lang_transfer)\n  apply(rule_tac\n      t=\"parserHF.marked_language G\"\n      and s=\"parserHFS.marked_language G\"\n      in ssubst)\n   apply(metis parserHF_vs_parserHFS_Nonblockingness_and_lang_transfer)\n  apply(force)\n  done\n\nlemma parserHFS_inst_hlp_BF_LinDBRest_DetR_LaOp: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.is_forward_deterministic_accessible G\n  \\<Longrightarrow> nonblockingness_language (parserHFS.unmarked_language G) (parserHFS.marked_language G)\n  \\<Longrightarrow> parserHFS.Nonblockingness_linear_restricted_DB G\"\n  apply(rule_tac\n      t=\"parserHFS.Nonblockingness_linear_restricted_DB G\"\n      and s=\"parserHFS.Nonblockingness_linear_restricted G\"\n      in ssubst)\n   apply (metis parserHFS.Nonblockingness_linear_restricted_SB_vs_Nonblockingness_linear_restricted_DB)\n  apply (metis parserHFS_inst_hlp_BF_LinSBRest_DetR_LaOp)\n  done\n\nlemma parserHFS_inst_BF_LinDBRest_DetR_LaOp_axioms: \"\n  BF_LinDBRest_DetR_LaOp_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect\n     parser_unfixed_schedulers right_quotient_word (@)\n     parser_unfixed_scheduler_extendable parserHFS_get_scheduler (@)\n     parserHFS_set_unfixed_scheduler_DB parserHFS_get_unfixed_scheduler_DB\n     parserHFS_get_fixed_scheduler_DB\"\n  apply(simp add: BF_LinDBRest_DetR_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(metis parserHFS_inst_hlp_BF_LinDBRest_DetR_LaOp)\n  done\n\nlemma parserHFS_inst_BF_LinDBRest_DetHDB_LaOp_axioms: \"\n  BF_LinDBRest_DetHDB_LaOp_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect parser_markers (@)\n     (@) parserHFS_conf_history parser_fixed_scheduler_extendable\n     parserHFS_get_fixed_scheduler_DB parser_unfixed_schedulers\n     right_quotient_word (@) parser_unfixed_scheduler_extendable\n     parserHFS_get_scheduler (@) parserHFS_set_unfixed_scheduler_DB\n     parserHFS_get_unfixed_scheduler_DB\"\n  apply(simp add: BF_LinDBRest_DetHDB_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(subgoal_tac \"BF_LinDBRest_DetR_LaOp_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect\n     parser_unfixed_schedulers right_quotient_word (@)\n     parser_unfixed_scheduler_extendable parserHFS_get_scheduler (@)\n     parserHFS_set_unfixed_scheduler_DB parserHFS_get_unfixed_scheduler_DB\n     parserHFS_get_fixed_scheduler_DB\")\n   apply(rename_tac M)(*strict*)\n   prefer 2\n   apply(rule parserHFS_inst_BF_LinDBRest_DetR_LaOp_axioms)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: BF_LinDBRest_DetR_LaOp_axioms_def)\n  apply(erule_tac\n      x=\"M\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(erule impE)\n   apply(rename_tac M)(*strict*)\n   prefer 2\n   apply(erule impE)\n    apply(rename_tac M)(*strict*)\n    apply(force)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(thin_tac \"nonblockingness_language (parserHFS.unmarked_language M) (parserHFS.marked_language M)\")\n  apply(rename_tac M)(*strict*)\n  apply(simp add: parserHFS.is_forward_deterministic_accessible_def)\n  apply(rule conjI)\n   apply(rename_tac M)(*strict*)\n   apply (metis parserHFS_is_forward_target_deterministic_accessible)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: parserHFS.is_forward_deterministicHist_DB_def)\n  apply(clarsimp)\n  apply(thin_tac \"ATS_determHIST_DB.is_forward_target_deterministicHist_DB_long parserHFS_initial_configurations parserHFS_step_relation parser_markers (@) (@) parserHFS_conf_history parser_fixed_scheduler_extendable parserHFS_get_fixed_scheduler_DB M\")\n  apply(rename_tac M)(*strict*)\n  apply (metis parserHFS.AX_is_forward_edge_deterministic_correspond_DB_SB parserHFS_inst_AX_is_forward_edge_deterministic_correspond_SB)\n  done\n\nlemma parserHFS_inst_BF_LinDBRest_DetHSB_LaOp_axioms: \"\n  BF_LinDBRest_DetHSB_LaOp_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect parser_markers (@)\n     (@) parserHFS_conf_history parser_fixed_scheduler_extendable\n     parserHFS_conf_fixed parser_unfixed_schedulers right_quotient_word (@)\n     parser_unfixed_scheduler_extendable parserHFS_get_scheduler (@)\n     parserHFS_set_unfixed_scheduler_DB parserHFS_get_unfixed_scheduler_DB\n     parserHFS_get_fixed_scheduler_DB\"\n  apply(simp add: BF_LinDBRest_DetHSB_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(subgoal_tac \"BF_LinDBRest_DetR_LaOp_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect\n     parser_unfixed_schedulers right_quotient_word (@)\n     parser_unfixed_scheduler_extendable parserHFS_get_scheduler (@)\n     parserHFS_set_unfixed_scheduler_DB parserHFS_get_unfixed_scheduler_DB\n     parserHFS_get_fixed_scheduler_DB \")\n   apply(rename_tac M)(*strict*)\n   prefer 2\n   apply(rule parserHFS_inst_BF_LinDBRest_DetR_LaOp_axioms)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: BF_LinDBRest_DetR_LaOp_axioms_def)\n  apply(erule_tac\n      x=\"M\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(erule impE)\n   apply(rename_tac M)(*strict*)\n   prefer 2\n   apply(erule impE)\n    apply(rename_tac M)(*strict*)\n    apply(force)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(thin_tac \"nonblockingness_language (parserHFS.unmarked_language M) (parserHFS.marked_language M)\")\n  apply(rename_tac M)(*strict*)\n  apply(simp add: parserHFS.is_forward_deterministic_accessible_def)\n  apply(rule conjI)\n   apply(rename_tac M)(*strict*)\n   apply (metis parserHFS_is_forward_target_deterministic_accessible)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: parserHFS.is_forward_deterministicHist_SB_def)\n  apply(clarsimp)\n  apply (metis parserHFS_inst_AX_is_forward_edge_deterministic_correspond_SB)\n  done\n\nlemma parserHFS_inst_BF_LinSBRest_DetR_LaOp_axioms: \"\n  BF_LinSBRest_DetR_LaOp_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect right_quotient_word\n     (@) parser_unfixed_scheduler_extendable\n     parserHFS_set_unfixed_scheduler parserHFS_get_unfixed_scheduler\"\n  apply(simp add: BF_LinSBRest_DetR_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply (metis parserHFS_inst_hlp_BF_LinSBRest_DetR_LaOp)\n  done\n\nlemma parserHFS_inst_BF_LinSBRest_DetHDB_LaOp_axioms: \"\n  BF_LinSBRest_DetHDB_LaOp_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect parser_markers (@)\n     (@) parserHFS_conf_history parser_fixed_scheduler_extendable\n     parserHFS_get_fixed_scheduler_DB right_quotient_word (@)\n     parser_unfixed_scheduler_extendable parserHFS_set_unfixed_scheduler\n     parserHFS_get_unfixed_scheduler\"\n  apply(simp add: BF_LinSBRest_DetHDB_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(subgoal_tac \"BF_LinSBRest_DetR_LaOp_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect right_quotient_word\n     (@) parser_unfixed_scheduler_extendable\n     parserHFS_set_unfixed_scheduler parserHFS_get_unfixed_scheduler\")\n   apply(rename_tac M)(*strict*)\n   prefer 2\n   apply(rule parserHFS_inst_BF_LinSBRest_DetR_LaOp_axioms)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: BF_LinSBRest_DetR_LaOp_axioms_def)\n  apply(erule_tac\n      x=\"M\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(erule impE)\n   apply(rename_tac M)(*strict*)\n   prefer 2\n   apply(erule impE)\n    apply(rename_tac M)(*strict*)\n    apply(force)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(thin_tac \"nonblockingness_language (parserHFS.unmarked_language M) (parserHFS.marked_language M)\")\n  apply(rename_tac M)(*strict*)\n  apply(simp add: parserHFS.is_forward_deterministic_accessible_def)\n  apply(rule conjI)\n   apply(rename_tac M)(*strict*)\n   apply (metis parserHFS_is_forward_target_deterministic_accessible)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: parserHFS.is_forward_deterministicHist_DB_def)\n  apply(clarsimp)\n  apply (metis parserHFS.AX_is_forward_edge_deterministic_correspond_DB_SB parserHFS_inst_AX_is_forward_edge_deterministic_correspond_SB)\n  done\n\nlemma parserHFS_inst_BF_LinSBRest_DetHSB_LaOp_axioms: \"\n  BF_LinSBRest_DetHSB_LaOp_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect parser_markers (@)\n     (@) parserHFS_conf_history parser_fixed_scheduler_extendable\n     parserHFS_conf_fixed right_quotient_word (@)\n     parser_unfixed_scheduler_extendable parserHFS_set_unfixed_scheduler\n     parserHFS_get_unfixed_scheduler\"\n  apply(simp add: BF_LinSBRest_DetHSB_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(subgoal_tac \"BF_LinSBRest_DetHDB_LaOp_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect parser_markers (@)\n     (@) parserHFS_conf_history parser_fixed_scheduler_extendable\n     parserHFS_get_fixed_scheduler_DB right_quotient_word (@)\n     parser_unfixed_scheduler_extendable parserHFS_set_unfixed_scheduler\n     parserHFS_get_unfixed_scheduler\")\n   apply(rename_tac M)(*strict*)\n   prefer 2\n   apply(rule parserHFS_inst_BF_LinSBRest_DetHDB_LaOp_axioms)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: BF_LinSBRest_DetHDB_LaOp_axioms_def)\n  apply(erule_tac\n      x=\"M\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(erule impE)\n   apply(rename_tac M)(*strict*)\n   prefer 2\n   apply(erule impE)\n    apply(rename_tac M)(*strict*)\n    apply(force)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(thin_tac \"nonblockingness_language (parserHFS.unmarked_language M) (parserHFS.marked_language M)\")\n  apply(rename_tac M)(*strict*)\n  apply (metis parserHFS.is_forward_deterministic_correspond_DB_SB)\n  done\n\nlemma parserHFS_inst_BF_LinSB_OpLa_axioms: \"\n  BF_LinSB_OpLa_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect right_quotient_word\n     (@) parser_unfixed_scheduler_extendable\n     parserHFS_set_unfixed_scheduler parserHFS_get_unfixed_scheduler\"\n  apply(simp add: BF_LinSB_OpLa_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(rule_tac\n      s=\"parserHF.unmarked_language M\"\n      and t=\"parserHFS.unmarked_language M\"\n      in ssubst)\n   apply(rename_tac M)(*strict*)\n   apply(metis parserHF_vs_parserHFS_Nonblockingness_and_lang_transfer)\n  apply(rename_tac M)(*strict*)\n  apply(rule_tac\n      s=\"parserHF.marked_language M\"\n      and t=\"parserHFS.marked_language M\"\n      in ssubst)\n   apply(rename_tac M)(*strict*)\n   apply(metis parserHF_vs_parserHFS_Nonblockingness_and_lang_transfer)\n  apply(rename_tac M)(*strict*)\n  apply(rule parserHF.AX_BF_Bra_OpLa)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply (metis parserHF_vs_parserHFS.bflin_to_bfbra)\n  done\n\nlemma parserHFS_inst_BF_LinDB_OpLa_axioms: \"\n  BF_LinDB_OpLa_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect\n     parser_unfixed_schedulers right_quotient_word (@)\n     parser_unfixed_scheduler_extendable parserHFS_get_scheduler (@)\n     parserHFS_set_unfixed_scheduler_DB parserHFS_get_unfixed_scheduler_DB\n     parserHFS_get_fixed_scheduler_DB\"\n  apply(simp add: BF_LinDB_OpLa_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(subgoal_tac \"BF_LinSB_OpLa_axioms valid_parser parserHFS_configurations\n     parserHFS_initial_configurations parser_step_labels\n     parserHFS_step_relation parserHFS_marking_condition\n     parserHFS_marked_effect parserHFS_unmarked_effect right_quotient_word\n     (@) parser_unfixed_scheduler_extendable\n     parserHFS_set_unfixed_scheduler parserHFS_get_unfixed_scheduler\")\n   apply(rename_tac M)(*strict*)\n   prefer 2\n   apply(rule parserHFS_inst_BF_LinSB_OpLa_axioms)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: BF_LinSB_OpLa_axioms_def)\n  apply(erule_tac\n      x=\"M\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M)(*strict*)\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply(erule impE)\n   apply(rename_tac M)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac M)(*strict*)\n  apply (metis parserHFS.Nonblockingness_linear_vs_Nonblockingness_linear_DB)\n  done\n\ninterpretation \"parserHFS\" : loc_autHFS_10\n  (* TSstructure *)\n  \"valid_parser\"\n  (* configurations *)\n  \"parserHFS_configurations\"\n  (* initial_configurations *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels *)\n  \"parser_step_labels\"\n  (* step_relation *)\n  \"parserHFS_step_relation\"\n  (* effects *)\n  \"parser_markers\"\n  (* marking_condition *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect *)\n  \"parserHFS_unmarked_effect\"\n  (* destinations *)\n  \"parser_destinations\"\n  (* get_destinations *)\n  \"parserHFS_get_destinations\"\n  (* histories *)\n  \"parser_markers\"\n  (* history_fragments *)\n  \"parser_markers\"\n  (* empty_history *)\n  \"parser_empty_history\"\n  (* empty_history_fragment *)\n  \"parser_empty_history_fragment\"\n  (* set_history *)\n  \"parserHFS_set_history\"\n  (* extend_history *)\n  \"append\"\n  (* join_history_fragments *)\n  \"append\"\n  (* get_history *)\n  \"parserHFS_conf_history\"\n  (* decreasing *)\n  \"True\"\n  (* string_state *)\n  \"parserHFS_string_state\"\n  (* fixed_schedulers *)\n  \"parser_fixed_schedulers\"\n  (* empty_fixed_scheduler *)\n  \"parser_empty_fixed_scheduler\"\n  (* fixed_scheduler_extendable *)\n  \"parser_fixed_scheduler_extendable\"\n  (* scheduler_fragments *)\n  \"parser_scheduler_fragments\"\n  (* empty_scheduler_fragment *)\n  \"parser_empty_scheduler_fragment\"\n  (* join_scheduler_fragments *)\n  \"append\"\n  (* unfixed_schedulers *)\n  \"parser_unfixed_schedulers\"\n  (* empty_unfixed_scheduler *)\n  \"parser_empty_unfixed_scheduler\"\n  (* unfixed_scheduler_right_quotient_word *)\n  \"right_quotient_word\"\n  (* extend_unfixed_scheduler *)\n  \"append\"\n  (* unfixed_scheduler_extendable *)\n  \"parser_unfixed_scheduler_extendable\"\n  (* schedulers *)\n  \"parser_schedulers\"\n  (* initial_schedulers *)\n  \"parser_schedulers\"\n  (* empty_scheduler *)\n  \"parser_empty_scheduler\"\n  (* get_scheduler *)\n  \"parserHFS_get_scheduler\"\n  (* join_fixed_scheduler_unfixed_scheduler *)\n  \"append\"\n  (* extend_scheduler *)\n  \"append\"\n  (* set_unfixed_scheduler *)\n  \"parserHFS_set_unfixed_scheduler\"\n  (* get_unfixed_scheduler *)\n  \"parserHFS_get_unfixed_scheduler\"\n  (* get_fixed_scheduler *)\n  \"parserHFS_conf_fixed\"\n  (* set_unfixed_scheduler_DB *)\n  \"parserHFS_set_unfixed_scheduler_DB\"\n  (* get_unfixed_scheduler_DB *)\n  \"parserHFS_get_unfixed_scheduler_DB\"\n  (* get_fixed_scheduler_DB *)\n  \"parserHFS_get_fixed_scheduler_DB\"\n  apply(simp add: LOCALE_DEFS parserHF_interpretations parserHFS_interpretations0)\n  apply(simp add: parserHFS_inst_BF_LinDBRest_DetR_LaOp_axioms parserHFS_inst_BF_LinDBRest_DetHDB_LaOp_axioms parserHFS_inst_BF_LinDBRest_DetHSB_LaOp_axioms parserHFS_inst_BF_LinSBRest_DetR_LaOp_axioms parserHFS_inst_BF_LinSBRest_DetHDB_LaOp_axioms parserHFS_inst_BF_LinSBRest_DetHSB_LaOp_axioms parserHFS_inst_BF_LinSB_OpLa_axioms parserHFS_inst_BF_LinDB_OpLa_axioms parserHFS_inst_ATS_HistoryCE_DB_axioms )\n  done\n\nlemma set_drop_subset2: \"\n  set w \\<subseteq> A\n  \\<Longrightarrow> set(drop n w) \\<subseteq> A\"\n  apply(induct w arbitrary: n)\n   apply(rename_tac n)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac a w n)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a w n x)(*strict*)\n  apply(case_tac n)\n   apply(rename_tac a w n x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac a w x)(*strict*)\n   apply(force)\n  apply(rename_tac a w n x nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a w x nat)(*strict*)\n  apply(force)\n  done\n\nlemma prefix_common: \"\n  prefix a c\n  \\<Longrightarrow> prefix b c\n  \\<Longrightarrow> prefix a b \\<or> prefix b a\"\n  apply (metis mutual_prefix_prefix prefix_def)\n  done\n\nlemma prefix_closure_subset_to_prefix: \"\n  (prefix_closure {w} \\<subseteq> prefix_closure {v})\n  = (prefix w v)\"\n  apply (metis insert_subset prefixExists prefix_closure_idempotent prefix_closure_single_prefix prefix_closure_subset prefix_closure_subset2 prefix_def)\n  done\n\nlemma parserHF_parserHFS_preserve_determ_hlp1: \"\n       parserHFS_step_relation G ci e1 c1 \\<Longrightarrow>\n       parserHFS_conf_history c1 = parserHFS_conf_history ci @ w1 \\<Longrightarrow>\n       ci \\<in> parserHFS_configurations G \\<Longrightarrow>\n       c1 \\<in> parserHFS_configurations G \\<Longrightarrow>\n       valid_parser_step_label G e1 \\<Longrightarrow>\n       w1 \\<sqsubseteq> drop (length (parserHFS_conf_fixed ci)) (parserHFS_conf_scheduler ci)\"\n  apply(simp add: parserHFS_step_relation_def Let_def parserHFS_configurations_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac f h x xa c ca y w)(*strict*)\n  apply(rule_tac\n      xs=\"xa\"\n      in rev_cases)\n   apply(rename_tac f h x xa c ca y w)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h x c y w)(*strict*)\n   apply(rule_tac\n      xs=\"c\"\n      in rev_cases)\n    apply(rename_tac f h x c y w)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac h x y w)(*strict*)\n    apply(rule butlast_if_match_length_le)\n   apply(rename_tac f h x c y w ys ya)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h x y w ys ya)(*strict*)\n   apply(subgoal_tac \"f @ ys = w\")\n    apply(rename_tac f h x y w ys ya)(*strict*)\n    prefer 2\n    apply (metis append1_eq_conv append_assoc)\n   apply(rename_tac f h x y w ys ya)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h x y ys ya)(*strict*)\n   apply(subgoal_tac \"ya=parser_bottom G\")\n    apply(rename_tac f h x y ys ya)(*strict*)\n    prefer 2\n    apply (metis empty_iff insert_iff list.set(1) same_append_eq set_simps(2))\n   apply(rename_tac f h x y ys ya)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h x y ys)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (rule_rpop e1) (parser_bottom G) = f@ys\")\n    apply(rename_tac f h x y ys)(*strict*)\n    prefer 2\n    apply (metis (erased, hide_lams) append_assoc butlast_if_match_direct)\n   apply(rename_tac f h x y ys)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"butlast_if_match (y @ [parser_bottom G]) (parser_bottom G) = y\")\n    apply(rename_tac f h x y ys)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_direct)\n   apply(rename_tac f h x y ys)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"butlast_if_match f (parser_bottom G) = f\")\n    apply(rename_tac f h x y ys)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_direct2_prime)\n   apply(rename_tac f h x y ys)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"drop (length f) (rule_rpop e1)\"\n      and s=\"ys @ [parser_bottom G]\"\n      in ssubst)\n    apply(rename_tac f h x y ys)(*strict*)\n    apply(rule_tac\n      t=\"rule_rpop e1\"\n      and s=\"f@ys @ [parser_bottom G]\"\n      in ssubst)\n     apply(rename_tac f h x y ys)(*strict*)\n     apply(force)\n    apply(rename_tac f h x y ys)(*strict*)\n    apply(simp (no_asm))\n   apply(rename_tac f h x y ys)(*strict*)\n   apply(force)\n  apply(rename_tac f h x xa c ca y w ys ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f h x c ca ys)(*strict*)\n  apply(rule_tac\n      xs=\"c\"\n      in rev_cases)\n   apply(rename_tac f h x c ca ys)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac h x ys)(*strict*)\n   apply(rule_tac\n      j=\"length (rule_rpop e1)\"\n      in le_trans)\n    apply(rename_tac h x ys)(*strict*)\n    apply(rule butlast_if_match_length_le)\n   apply(rename_tac h x ys)(*strict*)\n   apply(force)\n  apply(rename_tac f h x c ca ys ysa y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f h x ca ys ysa)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac f h x ca ys ysa rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f h x ca ys ysa rule_lpop rule_rpop rule_lpush rule_rpush)(*strict*)\n  apply(rename_tac lpop rpop lpush rpush)\n  apply(rename_tac f h x ca ys ysa lpop rpop lpush rpush)(*strict*)\n  apply(subgoal_tac \"prefix f rpop \\<or> prefix rpop f\")\n   apply(rename_tac f h x ca ys ysa lpop rpop lpush rpush)(*strict*)\n   prefer 2\n   apply(rule mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac f h x ca ys ysa lpop rpop lpush rpush)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac f h x ca ys ysa lpop rpop lpush rpush)(*strict*)\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac h x ysa lpop rpop lpush rpush c)(*strict*)\n   apply(rule_tac\n      t=\"drop (length rpop + length c) (butlast_if_match rpop (parser_bottom G))\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac h x ysa lpop rpop lpush rpush c)(*strict*)\n    apply (metis butlast_if_match_direct2_prime length_append prefix_def prefix_drop_none)\n   apply(rename_tac h x ysa lpop rpop lpush rpush c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac f h x ca ys ysa lpop rpop lpush rpush)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac f h x ys lpop lpush rpush c)(*strict*)\n  apply(rule_tac\n      xs=\"c\"\n      in rev_cases)\n   apply(rename_tac f h x ys lpop lpush rpush c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h x ys lpop lpush rpush)(*strict*)\n   apply(rule_tac\n      t=\"drop (length f) (butlast_if_match f (parser_bottom G))\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac f h x ys lpop lpush rpush)(*strict*)\n    apply (metis butlast_if_match_direct2_prime drop_eq_Nil order_refl)\n   apply(rename_tac f h x ys lpop lpush rpush)(*strict*)\n   apply(force)\n  apply(rename_tac f h x ys lpop lpush rpush c ysa y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f h x ys lpop lpush rpush ysa y)(*strict*)\n  apply(case_tac \"y=parser_bottom G\")\n   apply(rename_tac f h x ys lpop lpush rpush ysa y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac f h x ys lpop lpush rpush ysa y)(*strict*)\n  apply(rule_tac\n      t=\"butlast_if_match (f @ ysa @ [y]) (parser_bottom G)\"\n      and s=\"f@ysa@[y]\"\n      in ssubst)\n   apply(rename_tac f h x ys lpop lpush rpush ysa y)(*strict*)\n   apply (metis append_assoc butlast_if_match_direct2)\n  apply(rename_tac f h x ys lpop lpush rpush ysa y)(*strict*)\n  apply(force)\n  done\n\nlemma parserHF_parserHFS_preserve_determ_hlp2: \"\n  valid_parser G \\<Longrightarrow>\n       parserHFS_step_relation G ci e1 c1 \\<Longrightarrow>\n       parserHFS_step_relation G ci e2 c2 \\<Longrightarrow>\n       ATS.derivation_initial parserHFS_initial_configurations\n        parserHFS_step_relation G d \\<Longrightarrow>\n       d i = Some (pair e ci) \\<Longrightarrow>\n       set w1 \\<subseteq> parser_events G - {parser_bottom G} \\<Longrightarrow>\n       set w2 \\<subseteq> parser_events G - {parser_bottom G} \\<Longrightarrow>\n       parserHFS_conf_history c1 = parserHFS_conf_history ci @ w1 \\<Longrightarrow>\n       parserHFS_conf_history c2 = parserHFS_conf_history ci @ w2 \\<Longrightarrow>\n       ci \\<in> parserHFS_configurations G \\<Longrightarrow>\n       c1 \\<in> parserHFS_configurations G \\<Longrightarrow>\n       c2 \\<in> parserHFS_configurations G \\<Longrightarrow>\n       valid_parser_step_label G e1 \\<Longrightarrow>\n       valid_parser_step_label G e2 \\<Longrightarrow>\n       w1 \\<sqsubseteq>\n       drop (length (parserHFS_conf_fixed ci)) (parserHFS_conf_scheduler ci) \\<Longrightarrow>\n       w2 \\<sqsubseteq>\n       drop (length (parserHFS_conf_fixed ci)) (parserHFS_conf_scheduler ci) \\<Longrightarrow>\n       w1 \\<noteq> w2 \\<Longrightarrow>\n       w1 \\<sqsubseteq> w2 \\<Longrightarrow> parserHFS_conf_fixed c1 \\<sqsupseteq> [parser_bottom G] \\<Longrightarrow> False\"\n  apply(subgoal_tac \"w2\\<noteq>[]\")\n   prefer 2\n   apply(simp add: prefix_def)\n   apply(force)\n  apply(case_tac \"parserHFS_conf_fixed ci \\<sqsupseteq> [parser_bottom G]\")\n   apply(thin_tac \"parserHFS_step_relation G ci e1 c1\")\n   apply(thin_tac \"c1 \\<in> parserHFS_configurations G\")\n   apply(thin_tac \"c2 \\<in> parserHFS_configurations G\")\n   apply(thin_tac \"parserHFS_conf_history c1 = parserHFS_conf_history ci @ w1\")\n   apply(thin_tac \"w1 \\<sqsubseteq> drop (length (parserHFS_conf_fixed ci)) (parserHFS_conf_scheduler ci)\")\n   apply(thin_tac \"w1 \\<noteq> w2\")\n   apply(thin_tac \"w1 \\<sqsubseteq> w2\")\n   apply(simp add: parserHFS_step_relation_def parserHFS_configurations_def prefix_def suffix_def)\n   apply(clarsimp)\n   apply(rename_tac c ca cb x xa cc \"cd\" y w)(*strict*)\n   apply(rule_tac\n      xs=\"cc\"\n      in rev_cases)\n    apply(rename_tac c ca cb x xa cc \"cd\" y w)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac c ca cb x xa cc \"cd\" y w ys ya)(*strict*)\n   apply(clarsimp)\n  apply(subgoal_tac \"rule_rpop e1 = parserHFS_conf_scheduler ci\")\n   prefer 2\n   apply(thin_tac \"parserHFS_step_relation G ci e2 c2\")\n   apply(simp add: parserHFS_step_relation_def prefix_def suffix_def)\n   apply(clarsimp)\n   apply(rename_tac c ca cb cc x xa y)(*strict*)\n   apply(rule_tac\n      xs=\"xa\"\n      in rev_cases)\n    apply(rename_tac c ca cb cc x xa y)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac c ca cb cc x xa y ys ya)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c ca cb cc x ys)(*strict*)\n   apply(thin_tac \"c2 \\<in> parserHFS_configurations G\")\n   apply(simp add: parserHFS_configurations_def prefix_def)\n   apply(clarsimp)\n   apply(rename_tac c ca cb cc x ys f h \"cd\" ce)(*strict*)\n   apply(rule_tac\n      xs=\"f\"\n      in rev_cases)\n    apply(rename_tac c ca cb cc x ys f h \"cd\" ce)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac c ca cb cc x ys f h \"cd\" ce ysa y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c ca cb cc x ys h \"cd\" ce ysa y)(*strict*)\n   apply(rule_tac\n      xs=\"cd\"\n      in rev_cases)\n    apply(rename_tac c ca cb cc x ys h \"cd\" ce ysa y)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac c ca cb cc x ys h \"cd\" ce ysa y ysb ya)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c ca cb cc x ys h ce ysa y ysb)(*strict*)\n   apply(simp add: suffix_def)\n   apply(clarsimp)\n   apply(rename_tac c ca cb cc x ys ce ysa y ysb \"cd\" cf)(*strict*)\n   apply(rule_tac\n      xs=\"ce\"\n      in rev_cases)\n    apply(rename_tac c ca cb cc x ys ce ysa y ysb \"cd\" cf)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac c ca cb x ys ysa y ysb \"cd\" cf)(*strict*)\n    apply (metis List.drop_append append_assoc append_take_drop_id butlast_if_match_direct2 in_set_conv_decomp)\n   apply(rename_tac c ca cb cc x ys ce ysa y ysb \"cd\" cf ysc ya)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c ca cb cc x ys ysa y ysb \"cd\" cf ysc)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (cc @ [parser_bottom G]) (parser_bottom G) = cc\")\n    apply(rename_tac c ca cb cc x ys ysa y ysb \"cd\" cf ysc)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_direct)\n   apply(rename_tac c ca cb cc x ys ysa y ysb \"cd\" cf ysc)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (ysa @ [y]) (parser_bottom G) = ysa@[y]\")\n    apply(rename_tac c ca cb cc x ys ysa y ysb \"cd\" cf ysc)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_direct2)\n   apply(rename_tac c ca cb cc x ys ysa y ysb \"cd\" cf ysc)(*strict*)\n   apply(clarsimp)\n   apply(case_tac e1)\n   apply(rename_tac c ca cb cc x ys ysa y ysb \"cd\" cf ysc rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c ca cb cc x ys ysa y ysb \"cd\" cf ysc rule_lpop rule_rpop rule_lpush rule_rpush)(*strict*)\n   apply(rename_tac lp rp lpu rpu)\n   apply(rename_tac c ca cb cc x ys ysa y ysb \"cd\" cf ysc lp rp lpu rpu)(*strict*)\n   apply(case_tac \"length rp - length ysa\")\n    apply(rename_tac c ca cb cc x ys ysa y ysb \"cd\" cf ysc lp rp lpu rpu)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac c ca cb cc x ys ysa y ysb \"cd\" cf ysc lp rp lpu rpu nat)(*strict*)\n   apply(clarsimp)\n  apply(subgoal_tac \"prefix (parserHFS_conf_fixed ci) (parserHFS_conf_scheduler ci)\")\n   prefer 2\n   apply(simp add: parserHFS_configurations_def)\n   apply(force)\n  apply(subgoal_tac \"prefix (parserHFS_conf_fixed c1) (parserHFS_conf_scheduler c1)\")\n   prefer 2\n   apply(simp add: parserHFS_configurations_def)\n   apply(force)\n  apply(subgoal_tac \"prefix (parserHFS_conf_fixed c2) (parserHFS_conf_scheduler c2)\")\n   prefer 2\n   apply(simp add: parserHFS_configurations_def)\n   apply(force)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac c ca cb cc \"cd\" ce cf)(*strict*)\n  apply(rule_tac\n      xs=\"ce\"\n      in rev_cases)\n   apply(rename_tac c ca cb cc \"cd\" ce cf)(*strict*)\n   prefer 2\n   apply(rename_tac c ca cb cc \"cd\" ce cf ys y)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c ca cb cc \"cd\" cf ys y)(*strict*)\n   apply(simp add: parserHFS_configurations_def)\n   apply(clarsimp)\n  apply(rename_tac c ca cb cc \"cd\" ce cf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c ca cb cc \"cd\" cf)(*strict*)\n  apply(subgoal_tac \"rule_rpop e1 = parserHFS_conf_fixed ci@w1@[parser_bottom G]\")\n   apply(rename_tac c ca cb cc \"cd\" cf)(*strict*)\n   prefer 2\n   apply(thin_tac \"parserHFS_step_relation G ci e2 c2\")\n   apply(simp add: parserHFS_step_relation_def prefix_def suffix_def)\n   apply(clarsimp)\n   apply(rename_tac c ca cb cc \"cd\" cf x y)(*strict*)\n   apply(thin_tac \"c2 \\<in> parserHFS_configurations G\")\n   apply(simp add: parserHFS_configurations_def prefix_def)\n   apply(clarsimp)\n   apply(rename_tac c ca cb \"cd\" cf x f h ce w wa)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (w @ [parser_bottom G]) (parser_bottom G) = w\")\n    apply(rename_tac c ca cb \"cd\" cf x f h ce w wa)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_direct)\n   apply(rename_tac c ca cb \"cd\" cf x f h ce w wa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ca cb \"cd\" cf x f h ce w wa)(*strict*)\n   apply(rule_tac\n      xs=\"ce\"\n      in rev_cases)\n    apply(rename_tac ca cb \"cd\" cf x f h ce w wa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac ca cb \"cd\" cf x f h ce w wa ys y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c ca cb cc \"cd\" cf)(*strict*)\n  apply(subgoal_tac \"prefix (rule_rpop e2) (parserHFS_conf_scheduler ci)\")\n   apply(rename_tac c ca cb cc \"cd\" cf)(*strict*)\n   prefer 2\n   apply(simp add: parserHFS_step_relation_def prefix_def)\n   apply(clarsimp)\n  apply(rename_tac c ca cb cc \"cd\" cf)(*strict*)\n  apply (metis ConsApp append_Cons drop_prefix_closureise length_1_context_both_empty_right list.distinct(1) list.exhaust nset_diff set_subset_in subset_refl)\n  done\n\ntheorem parserHF_parserHFS_preserve_determ: \"\n  valid_parser G\n  \\<Longrightarrow> parserHF.is_forward_edge_deterministicHist_SB G\n  \\<Longrightarrow> parserHFS.is_forward_edge_deterministic_accessible G\"\n  apply(simp add: parserHF.is_forward_edge_deterministicHist_SB_def parserHFS.is_forward_edge_deterministic_accessible_def)\n  apply(clarsimp)\n  apply(rename_tac c c1 c2 e1 e2)(*strict*)\n  apply(simp add: parserHFS.get_accessible_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac c c1 c2 e1 e2 d i)(*strict*)\n  apply(case_tac \"d i\")\n   apply(rename_tac c c1 c2 e1 e2 d i)(*strict*)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac c c1 c2 e1 e2 d i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac c c1 c2 e1 e2 d i a option conf)(*strict*)\n  apply(rename_tac e ci)\n  apply(rename_tac c c1 c2 e1 e2 d i a e ci)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n  apply(erule_tac\n      x=\"parserHFvHFS_Lin2BraConf c\"\n      in ballE)\n   apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n   prefer 2\n   apply(simp add: parserHF.get_accessible_configurations_def)\n   apply(erule_tac\n      x=\"parserHF_vs_parserHFS.Lin2BraDer d\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n    apply (metis parserHF_vs_parserHFS.Lin2BraConf_preserves_initiality_lift)\n   apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n   apply(simp add: get_configuration_def parserHF_vs_parserHFS.Lin2BraDer_def derivation_map_def)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(subgoal_tac \"c=ci\")\n   apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n   prefer 2\n   apply(simp add: get_configuration_def)\n  apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n  apply(erule_tac\n      x=\"parserHFvHFS_Lin2BraConf c1\"\n      in allE)\n  apply(erule_tac\n      x=\"parserHFvHFS_Lin2BraConf c2\"\n      in allE)\n  apply(erule_tac\n      x=\"e1\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n   apply (metis parserHFS.derivation_initial_configurations parserHFvHFS_inst_AX_Lin2BraConf_preserves_steps)\n  apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n  apply(erule_tac\n      x=\"e2\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n   apply (metis parserHFS.derivation_initial_configurations parserHFvHFS_inst_AX_Lin2BraConf_preserves_steps)\n  apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n  apply(erule impE)\n   apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac c c1 c2 e1 e2 d i e ci)(*strict*)\n  apply(clarify)\n  apply(clarsimp)\n  apply(rename_tac c c1 c2 e1 e2 d i e)(*strict*)\n  apply(rename_tac ci c1 c2 e1 e2 d i e)\n  apply(rename_tac ci c1 c2 e1 e2 d i e)(*strict*)\n  apply(subgoal_tac \" \\<exists>w1. set w1 \\<subseteq> parser_events G - {parser_bottom G} \\<and> (\\<exists>w2. set w2 \\<subseteq> parser_events G - {parser_bottom G} \\<and> parserHF_conf_history (parserHFvHFS_Lin2BraConf c1) = parserHF_conf_history (parserHFvHFS_Lin2BraConf ci) @ w1 \\<and> parserHF_conf_history (parserHFvHFS_Lin2BraConf c2) = parserHF_conf_history (parserHFvHFS_Lin2BraConf ci) @ w2)\")\n   apply(rename_tac ci c1 c2 e1 e2 d i e)(*strict*)\n   prefer 2\n   apply(simp add: parserHFvHFS_Lin2BraConf_def parserHFS_step_relation_def Let_def parser_markers_def)\n   apply(clarsimp)\n   apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya)(*strict*)\n    apply(rule set_drop_subset2)\n    apply(subgoal_tac \"valid_parser_step_label G e1\")\n     apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya)(*strict*)\n     prefer 2\n     apply(simp add: valid_parser_def)\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya)(*strict*)\n    apply(simp add: valid_parser_step_label_def kPrefix_def)\n    apply(clarsimp)\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n    apply(simp add: valid_parser_step_label_def kPrefix_def)\n    apply(case_tac \"k - length w\")\n     apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n      apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n      prefer 2\n      apply (metis append_take_drop_id butlast_if_match_reduces in_set_conv_decomp nset_diff set_app_subset subsetD)\n     apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n     apply(clarsimp)\n     apply(rule conjI)\n      apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n      apply (metis Diff_iff in_set_takeD subsetD)\n     apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n     apply (metis in_set_takeD nset_diff)\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf nat xe)(*strict*)\n    apply(subgoal_tac \"butlast_if_match (w @ [parser_bottom G]) (parser_bottom G) = w\")\n     apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf nat xe)(*strict*)\n     prefer 2\n     apply (metis butlast_if_match_direct)\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf nat xe)(*strict*)\n    apply(clarsimp)\n    apply (metis DiffE subsetD triv_compl)\n   apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya)(*strict*)\n   apply(rule set_drop_subset2)\n   apply(subgoal_tac \"valid_parser_step_label G e2\")\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya)(*strict*)\n    prefer 2\n    apply(simp add: valid_parser_def)\n   apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya)(*strict*)\n   apply(simp add: valid_parser_step_label_def kPrefix_def)\n   apply(clarsimp)\n   apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n   apply(simp add: valid_parser_step_label_def kPrefix_def)\n   apply(case_tac \"k - length w\")\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"butlast_if_match (take k w) (parser_bottom G) = take k w\")\n     apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n     prefer 2\n     apply (metis append_take_drop_id butlast_if_match_reduces in_set_conv_decomp nset_diff set_app_subset subsetD)\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n    apply(clarsimp)\n    apply(rule conjI)\n     apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n     apply (metis Diff_iff in_set_takeD subsetD)\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf)(*strict*)\n    apply (metis in_set_takeD nset_diff)\n   apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf nat xe)(*strict*)\n   apply(subgoal_tac \"butlast_if_match (w @ [parser_bottom G]) (parser_bottom G) = w\")\n    apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf nat xe)(*strict*)\n    prefer 2\n    apply (metis butlast_if_match_direct)\n   apply(rename_tac ci c1 c2 e1 e2 d i e x xa xb xc y ya xd k w xf nat xe)(*strict*)\n   apply(clarsimp)\n   apply (metis DiffE subsetD triv_compl)\n  apply(rename_tac ci c1 c2 e1 e2 d i e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(simp add: parserHFvHFS_Lin2BraConf_def)\n  apply(subgoal_tac \"ci \\<in> parserHFS_configurations G\")\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   prefer 2\n   apply(rule parserHFS.belongs_configurations)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(rule parserHFS.derivation_initial_belongs)\n     apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n     apply(force)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(force)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(subgoal_tac \"c1 \\<in> parserHFS_configurations G\")\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   prefer 2\n   apply(rule parserHFS.AX_step_relation_preserves_belongsC)\n     apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n     apply(force)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(force)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(subgoal_tac \"c2 \\<in> parserHFS_configurations G\")\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   prefer 2\n   apply(rule parserHFS.AX_step_relation_preserves_belongsC)\n     apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n     apply(force)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(force)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e1\")\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def)\n   apply(simp add: parserHFS_step_relation_def)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(subgoal_tac \"valid_parser_step_label G e2\")\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   prefer 2\n   apply(simp add: valid_parser_def)\n   apply(simp add: parserHFS_step_relation_def)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(subgoal_tac \"(prefix w1 w2 \\<or> prefix w2 w1) \\<and> (prefix w1 (drop (length (parserHFS_conf_fixed ci)) (parserHFS_conf_scheduler ci))) \\<and> (prefix w2 (drop (length (parserHFS_conf_fixed ci)) (parserHFS_conf_scheduler ci)))\")\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"(prefix w1 (drop (length (parserHFS_conf_fixed ci)) (parserHFS_conf_scheduler ci)))\")\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    prefer 2\n    apply(rule parserHF_parserHFS_preserve_determ_hlp1)\n        apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n        apply(force)\n       apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n       apply(force)\n      apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n      apply(force)\n     apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n     apply(force)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(force)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(subgoal_tac \"(prefix w2 (drop (length (parserHFS_conf_fixed ci)) (parserHFS_conf_scheduler ci)))\")\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    prefer 2\n    apply(rule_tac\n      ?c1.0=\"c2\"\n      in parserHF_parserHFS_preserve_determ_hlp1)\n        apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n        apply(force)\n       apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n       apply(force)\n      apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n      apply(force)\n     apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n     apply(force)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(force)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(rule_tac\n      c=\"drop (length (parserHFS_conf_fixed ci)) (parserHFS_conf_scheduler ci)\"\n      in prefix_common)\n     apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n     apply(force)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(force)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(unfold parserHF.compatible_history_fragment_SB_def)\n  apply(rule_tac\n      x=\"w1\"\n      in exI)\n  apply(rule_tac\n      x=\"w2\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(simp add: parser_markers_def)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(simp add: parser_markers_def)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(clarsimp)\n  apply(simp add: Let_def)\n  apply(rule_tac\n      t=\"ATS_History.history_fragment_prefixes parser_markers (@) G w1\"\n      and s=\"prefix_closure {w1}\"\n      in ssubst)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(simp add: parserHFS.history_fragment_prefixes_def)\n   apply(rule antisym)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(simp add: parser_markers_def prefix_closure_def prefix_def)\n    apply(clarsimp)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2 x)(*strict*)\n   apply(simp add: parser_markers_def prefix_closure_def prefix_def)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(rule_tac\n      t=\"ATS_History.history_fragment_prefixes parser_markers (@) G w2\"\n      and s=\"prefix_closure {w2}\"\n      in ssubst)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(simp add: parserHFS.history_fragment_prefixes_def)\n   apply(rule antisym)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(simp add: parser_markers_def prefix_closure_def prefix_def)\n    apply(clarsimp)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2 x)(*strict*)\n   apply(simp add: parser_markers_def prefix_closure_def prefix_def)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(rule_tac\n      t=\"ATS_History.history_fragment_prefixes parser_markers (@) G X\"\n      and s=\"prefix_closure {X}\" for X\n      in ssubst)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(simp add: parserHFS.history_fragment_prefixes_def)\n   apply(rule antisym)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(simp add: parser_markers_def prefix_closure_def prefix_def)\n    apply(clarsimp)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2 x c ca hf'')(*strict*)\n    apply(force)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(simp add: parser_markers_def prefix_closure_def prefix_def)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(rule_tac\n      t=\"prefix_closure {SSX} \\<subseteq> prefix_closure {SSY}\"\n      and s=\"prefix SSX SSY\" for SSX SSY\n      in ssubst)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(rule prefix_closure_subset_to_prefix)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(rule_tac\n      t=\"prefix_closure {SSX} \\<subseteq> prefix_closure {SSY}\"\n      and s=\"prefix SSX SSY\" for SSX SSY\n      in ssubst)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(rule prefix_closure_subset_to_prefix)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(rule_tac\n      t=\"prefix_closure {SSX} = prefix_closure {SSY}\"\n      and s=\"SSX=SSY\" for SSX SSY\n      in ssubst)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply (metis prefix_closure_single_eq)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(case_tac \"w1=w2\")\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(rule disjI1)\n   apply(clarsimp)\n   apply(rule_tac\n      ?c1.0=\"c1\"\n      and ?c2.0=\"c2\"\n      and ?w1.0=\"w1\"\n      and ?w2.0=\"w2\"\n      in parserHF_parserHFS_preserve_determ_hlp2)\n                     apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                     apply(force)\n                    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                    apply(force)\n                   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                   apply(force)\n                  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                  apply(force)\n                 apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                 apply(force)\n                apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                apply(force)\n               apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n               apply(force)\n              apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n              apply(force)\n             apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n             apply(force)\n            apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n            apply(force)\n           apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n           apply(force)\n          apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n          apply(force)\n         apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n         apply(force)\n        apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n        apply(force)\n       apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n       apply(force)\n      apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n      apply(force)\n     apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n     apply(force)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(force)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(rule disjI2)\n  apply(clarsimp)\n  apply(rule_tac\n      ?c1.0=\"c2\"\n      and ?c2.0=\"c1\"\n      and ?w1.0=\"w2\"\n      and ?w2.0=\"w1\"\n      in parserHF_parserHFS_preserve_determ_hlp2)\n                    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                    apply(force)\n                   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                   apply(force)\n                  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                  apply(force)\n                 apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                 apply(force)\n                apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n                apply(force)\n               apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n               apply(force)\n              apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n              apply(force)\n             apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n             apply(force)\n            apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n            apply(force)\n           apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n           apply(force)\n          apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n          apply(force)\n         apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n         apply(force)\n        apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n        apply(force)\n       apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n       apply(force)\n      apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n      apply(force)\n     apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n     apply(force)\n    apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n    apply(force)\n   apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac ci c1 c2 e1 e2 d i e w1 w2)(*strict*)\n  apply(force)\n  done\n\nlemma parserHFS_step_relation_slim_step_intro: \"\n  valid_parser G\n  \\<Longrightarrow> c1 \\<in> parserHFS_configurations G\n  \\<Longrightarrow> e \\<in> parser_step_labels G\n  \\<Longrightarrow> suffix (parserHFS_conf_stack c1) (rule_lpop e)\n  \\<Longrightarrow> \\<exists>w. ((rule_rpop e @ w @[parser_bottom G] = parserHFS_conf_scheduler c1) \\<or> (rule_rpop e =  parserHFS_conf_scheduler c1))\n  \\<Longrightarrow> \\<exists>c2. parserHFS_step_relation G c1 e c2\"\n  apply(erule exE)+\n  apply(rename_tac w)(*strict*)\n  apply(simp add: parserHFS_step_relation_def)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac w c)(*strict*)\n  apply(simp add: parser_step_labels_def)\n  apply(erule disjE)\n   apply(rename_tac w c)(*strict*)\n   apply(rule_tac x=\"\\<lparr>parserHFS_conf_fixed = rule_rpush e @\n           drop (length (rule_rpop e)) (parserHFS_conf_fixed c1),\n    parserHFS_conf_history = parserHFS_conf_history c1 @\n           drop (length (parserHFS_conf_fixed c1))\n            (butlast_if_match (rule_rpop e) (parser_bottom G)),\n    parserHFS_conf_stack = c @ rule_lpush e,\n    parserHFS_conf_scheduler = SSr\\<rparr> \" for SSr in exI)\n   apply(clarsimp)\n   apply(rule_tac x=\"w @ [parser_bottom G]\" in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac w c)(*strict*)\n    apply(force)\n   apply(rename_tac w c)(*strict*)\n   apply(simp add: parserHFS_configurations_def)\n  apply(rename_tac w c)(*strict*)\n  apply(rule_tac x=\"\\<lparr>parserHFS_conf_fixed = rule_rpush e @\n           drop (length (rule_rpop e)) (parserHFS_conf_fixed c1),\n    parserHFS_conf_history = parserHFS_conf_history c1 @\n           drop (length (parserHFS_conf_fixed c1))\n            (butlast_if_match (rule_rpop e) (parser_bottom G)),\n    parserHFS_conf_stack = c @ rule_lpush e,\n    parserHFS_conf_scheduler = SSr\\<rparr> \" for SSr in exI)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac w c)(*strict*)\n   apply(force)\n  apply(rename_tac w c)(*strict*)\n  apply(simp add: parserHFS_configurations_def)\n  apply(rename_tac c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c f h w)(*strict*)\n  apply(simp add: valid_parser_def)\n  apply(clarsimp)\n  apply(erule_tac x=\"e\" in ballE)\n   apply(rename_tac c f h w)(*strict*)\n   prefer 2\n   apply(simp add: parser_step_labels_def)\n  apply(rename_tac c f h w)(*strict*)\n  apply(simp add: valid_parser_step_label_def)\n  apply(simp add: prefix_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac c f w ca cb k wa xa xb)(*strict*)\n  apply(rule_tac xs=\"w\" in rev_cases)\n   apply(rename_tac c f w ca cb k wa xa xb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c f ca cb k wa xa xb)(*strict*)\n   apply(rule_tac xs=\"rule_rpush e\" in rev_cases)\n    apply(rename_tac c f ca cb k wa xa xb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac c f ca cb k wa xa xb ys y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c f w ca cb k wa xa xb ys y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c f ca cb k wa xa xb ys y)(*strict*)\n  apply(rule_tac x=\"xb\" in exI)\n  apply(force)\n  done\n\nlemmas parserHFS_interpretations1 =\n  parserHFS_inst_BF_LinDBRest_DetR_LaOp_axioms\n  parserHFS_inst_BF_LinDBRest_DetHDB_LaOp_axioms\n  parserHFS_inst_BF_LinDBRest_DetHSB_LaOp_axioms\n  parserHFS_inst_BF_LinSBRest_DetR_LaOp_axioms\n  parserHFS_inst_BF_LinSBRest_DetHDB_LaOp_axioms\n  parserHFS_inst_BF_LinSBRest_DetHSB_LaOp_axioms\n  parserHFS_inst_BF_LinSB_OpLa_axioms\n  parserHFS_inst_BF_LinDB_OpLa_axioms\n\nend\n\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_08/I_kparser_HFS_HF.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3292087502808415}}
{"text": "(*  Title:      HOL/SPARK/SPARK.thy\n    Author:     Stefan Berghofer\n    Copyright:  secunet Security Networks AG\n\nDeclaration of proof functions for SPARK/Ada verification environment.\n*)\n\ntheory SPARK\nimports SPARK_Setup\nbegin\n\ntext \\<open>Bitwise logical operators\\<close>\n\nspark_proof_functions\n  bit__and (integer, integer) : integer = \"op AND\"\n  bit__or (integer, integer) : integer = \"op OR\"\n  bit__xor (integer, integer) : integer = \"op XOR\"\n\nlemmas [simp] =\n  OR_upper [of _ 8, simplified zle_diff1_eq [symmetric], simplified]\n  OR_upper [of _ 8, simplified]\n  OR_upper [of _ 16, simplified zle_diff1_eq [symmetric], simplified]\n  OR_upper [of _ 16, simplified]\n  OR_upper [of _ 32, simplified zle_diff1_eq [symmetric], simplified]\n  OR_upper [of _ 32, simplified]\n  OR_upper [of _ 64, simplified zle_diff1_eq [symmetric], simplified]\n  OR_upper [of _ 64, simplified]\n\nlemmas [simp] =\n  XOR_upper [of _ 8, simplified zle_diff1_eq [symmetric], simplified]\n  XOR_upper [of _ 8, simplified]\n  XOR_upper [of _ 16, simplified zle_diff1_eq [symmetric], simplified]\n  XOR_upper [of _ 16, simplified]\n  XOR_upper [of _ 32, simplified zle_diff1_eq [symmetric], simplified]\n  XOR_upper [of _ 32, simplified]\n  XOR_upper [of _ 64, simplified zle_diff1_eq [symmetric], simplified]\n  XOR_upper [of _ 64, simplified]\n\nlemma bit_not_spark_eq:\n  \"NOT (word_of_int x :: ('a::len0) word) =\n  word_of_int (2 ^ len_of TYPE('a) - 1 - x)\"\nproof -\n  have \"word_of_int x + NOT (word_of_int x) =\n    word_of_int x + (word_of_int (2 ^ len_of TYPE('a) - 1 - x)::'a word)\"\n    by (simp only: bwsimps bin_add_not Min_def)\n      (simp add: word_of_int_hom_syms word_of_int_2p_len)\n  then show ?thesis by (rule add_left_imp_eq)\nqed\n\nlemmas [simp] =\n  bit_not_spark_eq [where 'a=8, simplified]\n  bit_not_spark_eq [where 'a=16, simplified]\n  bit_not_spark_eq [where 'a=32, simplified]\n  bit_not_spark_eq [where 'a=64, simplified]\n\n\ntext \\<open>Minimum and maximum\\<close>\n\nspark_proof_functions\n  integer__min = \"min :: int \\<Rightarrow> int \\<Rightarrow> int\"\n  integer__max = \"max :: int \\<Rightarrow> int \\<Rightarrow> int\"\n\nend\n\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/SPARK/SPARK.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3292087502808415}}
{"text": "section \"Execution Invariants (Part 3)\"\ntheory execution_invariants_unused\n  imports repliss_sem execution_invariants consistency commutativity  invariant_simps\nbegin\n\n\ntext \"These are execution invariants not needed for the soundness proof, but which still\n might be useful for verifying some applications.\"\n\n\n\n\nlemma causallyConsistent_downwards_closure:\nassumes wf: \"state_wellFormed S\"\nshows \"causallyConsistent (happensBefore S) (cs \\<down> happensBefore S)\"\napply (auto simp add: causallyConsistent_def downwardsClosure_def)\n  by (meson local.wf transD wellFormed_state_causality(2))\n\n\n\nlemma consistentSnapshot_txns:\nassumes wf: \"state_wellFormed S\"\n  and comitted: \"txns \\<subseteq> committedTransactions S\"\nshows \"consistentSnapshot S (callsInTransaction S txns \\<down> happensBefore S)\"\nunfolding consistentSnapshotH_def proof (intro conjI)\n \n  show \"callsInTransaction S txns \\<down> happensBefore S \\<subseteq> dom (calls S)\"\n    apply (auto simp add: callsInTransactionH_def downwardsClosure_def)\n    using local.wf wellFormed_callOrigin_dom2 apply fastforce\n    by (simp add: domD happensBefore_in_calls_left local.wf)\n    \n  show \"causallyConsistent (happensBefore S) (callsInTransaction S txns \\<down> happensBefore S)\"\n    apply (auto simp add: callsInTransactionH_def downwardsClosure_def causallyConsistent_def)\n    by (meson happensBefore_transitive local.wf transD)\n    \n  show \"transactionConsistent (callOrigin S) (txStatus S) (callsInTransaction S txns \\<down> happensBefore S)\"\n  proof (induct rule: show_transactionConsistent)\n    case (only_committed c tx)\n    then show ?case \n      apply (auto simp add: callsInTransactionH_def downwardsClosure_def)\n      using comitted apply blast\n      using comitted local.wf wellFormed_state_transaction_consistent(4) by fastforce\n  next\n    case (all_from_same c1 c2)\n    then show ?case \n      apply (auto simp add: callsInTransactionH_def downwardsClosure_def)\n      by (metis local.wf wellFormed_state_transaction_consistent(3))\n  qed\nqed    \n\n\n\n\n\nlemma wellFormed_visibleCallsSubsetCalls:\n  assumes a1: \"state_wellFormed A\"\n    and a2: \"visibleCalls A s \\<triangleq> vis\"\n  shows \"vis \\<subseteq> dom (calls A)\"\n  using a1 a2 wellFormed_visibleCallsSubsetCalls_h(2) by blast\n\n\n\nlemma wf_current_tx_not_before_others: \n  assumes wf: \"state_wellFormed S\"\n    and \"visibleCalls S i \\<triangleq> Vis\"\n    and \"currentTx S i \\<triangleq> tx\"\n    and \"callOrigin S x \\<triangleq> tx\"\n    and \"callOrigin S y \\<noteq> Some tx\"\n  shows \"(x,y) \\<notin> happensBefore S\"\nproof -\n  obtain tt :: \"(callId \\<Rightarrow> txId option) \\<Rightarrow> callId \\<Rightarrow> txId\" where\n    \"\\<forall>x0 x1. (\\<exists>v2. x0 x1 \\<triangleq> v2) = x0 x1 \\<triangleq> tt x0 x1\"\n    by moura\n  then have \"\\<forall>c f. c \\<notin> dom f \\<or> f c \\<triangleq> tt f c\"\n    by blast\n  then have \"(x, y) \\<notin> happensBefore S \\<or> y \\<notin> dom (callOrigin S)\"\n    by (metis (no_types) assms(3) assms(4) assms(5) local.wf option.inject txStatus.distinct(1) wellFormed_currentTx_unique_h(2) wellFormed_state_transaction_consistent(4))\n  then show ?thesis\n    by (meson domIff local.wf wellFormed_callOrigin_dom3 wellFormed_happensBefore_calls_r)\nqed\n\n\n\nlemma downwardsClosure_subset2:\n  \"x \\<in> S \\<down> R \\<Longrightarrow> x \\<in> S \\<union> fst ` R\"\n  by (meson downwardsClosure_subset subsetCE)\n\n\ntext \\<open>\n There can be no action on a invocId after a fail or return:\n (except for invariant checks)\n\\<close>\nlemma nothing_after_fail_or_return:\n  assumes steps: \"initialState program ~~ tr \\<leadsto>* S\"\n    and fail_or_return: \"tr!i = (s, ACrash) \\<or> tr!i = (s, AReturn res)\"\n    and i_in_range: \"i < length tr\"\n  shows \"\\<nexists>j. j>i \\<and> j<length tr \\<and> get_invoc(tr!j) = s \\<and> \\<not>is_AInvcheck (get_action (tr!j))\" \n  using steps fail_or_return i_in_range proof (induct rule: steps_induct)\n  case initial\n  then show ?case by auto\nnext\n  case (step S' tr a S'')\n  show \"\\<not> (\\<exists>j>i. j < length (tr @ [a]) \\<and> get_invoc ((tr @ [a]) ! j) = s \\<and> \\<not> is_AInvcheck (get_action ((tr @ [a]) ! j)))\"\n  proof (rule ccontr, auto)\n    fix j\n    assume a1: \"j < Suc (length tr)\"\n      and a2: \"i < j\"\n      and a3: \"s = get_invoc ((tr @ [a]) ! j)\"\n      and a4: \"\\<not> is_AInvcheck (get_action ((tr @ [a]) ! j))\"\n\n    have j_def: \"j = length tr\"\n    proof (rule ccontr)\n      assume \"j \\<noteq> length tr\"\n      then have \"j < length tr\" using a1 by simp\n      then have \"s \\<noteq> get_invoc ((tr @ [a]) ! j)\"\n        by (metis a2 a4 length_append_singleton less_Suc_eq nth_append order.asym step.IH step.prems(1) step.prems(2))\n      with a3 show False by simp\n    qed\n\n    obtain a_op where a_def: \"a = (s, a_op)\" using j_def a3\n      by (metis nth_append_length prod.collapse) \n\n\n\n    from \\<open>(tr @ [a]) ! i = (s, ACrash) \\<or> (tr @ [a]) ! i = (s, AReturn res)\\<close>\n    have no_ls: \"localState S' s = None\" \n      and op: \"invocOp S' s \\<noteq> None\"  \n       apply (metis a2 everything_starts_with_an_invocation j_def nth_append step.steps)\n      by (metis a2 everything_starts_with_an_invocation j_def nth_append step.prems(1) step.steps)\n\n    have fst_a: \"get_invoc a = s\" using a_def by simp  \n\n    from \\<open>S' ~~ a \\<leadsto> S''\\<close> a_def\n    have \"S' ~~ (s, a_op) \\<leadsto> S''\" by simp  \n\n    then show False\n      apply (rule step.cases)\n              apply (auto simp add: no_ls a3 op j_def)\n              apply (auto simp add: fst_a no_ls op)\n      using a4 a_def is_AInvcheck_def j_def by auto \n  qed\nqed\n\n\n\ntext \\<open>\n We have visible calls iff we have some local state.\n\\<close>\nlemma visibleCalls_iff_localState:\n  assumes steps: \"initialState program ~~ tr \\<leadsto>* S\"\n  shows \"localState S s = None \\<longleftrightarrow> visibleCalls S s = None\" \n  using steps\nproof (induct rule: steps_induct)\n  case initial\n  then show ?case\n    by (simp add: initialState_def)\nnext\n  case (step S' tr a S'')\n  from \\<open>S' ~~ a \\<leadsto> S''\\<close>\n  show ?case \n    apply (rule step.cases)\n    using step.IH  by (auto simp add: step)\nqed\n\nlemma i_callOriginI_notI1:\n  assumes \"state_wellFormed S_pre\" \n    and \"invocOp S_pre i = None\" \n  shows \"i_callOriginI S_pre c \\<noteq> Some i\"\n  by (simp add: assms(1) assms(2) i_callOriginI_h_def option.case_eq_if wf_no_invocation_no_origin)\n\nlemma i_callOriginI_notI2:\n  assumes \"state_wellFormed S_pre\" \n    and \"i_callOriginI S_pre c = Some i\" \n  shows \"invocOp S_pre i \\<noteq> None\"\n  using assms(1) assms(2) i_callOriginI_notI1 by blast\n\ntext \\<open>\nUpdating the invocId happens-before in the first transaction of an invocId.\n\n\\<close>\nlemma invocation_happensBeforeH_update:\n  assumes  Orig'_def: \"\\<And>c. Orig' c = (case Orig c of Some i \\<Rightarrow> Some i | None \\<Rightarrow> if c\\<in>set cs then Some i else None)\"\n    and cs_no_orig: \"\\<And>c. c \\<in> set cs \\<Longrightarrow> Orig c = None\"\n    and cs_notin_vis: \"\\<And>c. c \\<in> set cs \\<Longrightarrow> c \\<notin> vis\"\n    and cs_notin_hb1: \"\\<And>c x. c \\<in> set cs \\<Longrightarrow> (x,c) \\<notin> Hb\"\n    and cs_notin_hb2: \"\\<And>c x. c \\<in> set cs \\<Longrightarrow> (c,x) \\<notin> Hb\"\n    and invoc_fresh: \"\\<And>c. Orig c \\<noteq> Some i\"\n    and cs_nonempty: \"cs \\<noteq> []\"\n  shows\n    \"invocation_happensBeforeH Orig' (updateHb Hb vis cs)\n   = invocation_happensBeforeH Orig Hb \\<union> {i'. (\\<forall>c. Orig c \\<triangleq> i' \\<longrightarrow> c \\<in> vis) \\<and> (\\<exists>c. Orig c \\<triangleq> i') }  \\<times>  {i} \"\n  using invoc_fresh  apply (auto simp add: invocation_happensBeforeH_def  in_img_simp updateHb_cases)\n                apply (auto simp add: Orig'_def cs_notin_hb1  cs_notin_hb2 cs_notin_vis cs_no_orig  split: option.splits if_splits)\n  using cs_no_orig in_sequence_in2 apply fastforce\n  using cs_no_orig in_sequence_in1 apply fastforce\n        apply (metis cs_no_orig in_sequence_in2 option.simps(3))\n       apply (metis cs_no_orig in_sequence_in2 option.distinct(1))\n  using cs_no_orig in_sequence_in2 apply fastforce\n     apply (metis cs_no_orig option.distinct(1) option.sel)\n    apply (metis cs_no_orig option.distinct(1) option.sel)\n  using cs_notin_vis option.simps(3) apply fastforce\n  using cs_nonempty last_in_set by blast\n\n\n\nlemma state_wellFormed_txStatus_callOrigin:     \n  assumes \"state_wellFormed S\"\nand \"callOrigin S c \\<triangleq> tx\"\nshows \"txStatus S tx \\<noteq> None\"\n  using assms proof (induct rule: wellFormed_induct)\n  case initial\n  then show ?case by (simp add: initialState_def)\nnext\n  case (step S a S')\n  thus ?case \n    by (auto simp add: step.simps inTransaction_localState split: if_splits dest:  wellFormed_currentTx_unique_h(2) )\nqed\n\nlemma state_wellFormed_txStatus_txOrigin:     \n  assumes \"state_wellFormed S\"\nand \"txOrigin S tx \\<triangleq> i\"\nshows \"txStatus S tx \\<noteq> None\"\n  using assms proof (induct rule: wellFormed_induct)\n  case initial\n  then show ?case by (simp add: initialState_def)\nnext\n  case (step S a S')\n  thus ?case \n    by (auto simp add: step.simps inTransaction_localState split: if_splits dest:  wellFormed_currentTx_unique_h(2) )\nqed\n\nlemma state_wellFormed_current_transaction_origin:     \n  assumes \"state_wellFormed S\"\nand \"currentTx S i \\<triangleq> tx\"\nshows \"txOrigin S tx \\<triangleq> i\"\n  using assms proof (induct rule: wellFormed_induct)\n  case initial\n  then show ?case by (simp add: initialState_def)\nnext\n  case (step S a S')\n  thus ?case \n    by (auto simp add: step.simps  split: if_splits dest: state_wellFormed_txStatus_txOrigin)\n\nqed\n\n\nlemma state_wellFormed_ls_visibleCalls_callOrigin:     \n  assumes \"state_wellFormed S\"\nand \"callOrigin S c \\<triangleq> tx\"\nand \"txOrigin S tx \\<triangleq> i\"\nand \"visibleCalls S i \\<triangleq> vis\"\n  shows \"c \\<in> vis\"\n  using assms proof (induct  arbitrary: vis rule: wellFormed_induct)\n  case initial\n  then show ?case by (simp add: initialState_def)\nnext\n  case (step S a S' vis')\n  thus ?case \n    by (auto simp add: step.simps inTransaction_localState chooseSnapshot_def state_wellFormed_current_transaction_origin  split: if_splits \n          dest: wf_no_txStatus_origin_for_nothing  wf_no_invocation_no_origin )\n\nqed\n\n\n\ntext_raw \\<open>\\DefineSnippet{state_wellFormed_same_invocation_sequential}{\\<close>\nlemma state_wellFormed_same_invocation_sequential:     \n  assumes \"state_wellFormed S\"\n    and \"callOrigin S c1 \\<triangleq> tx1\" \n    and \"txOrigin S tx1 \\<triangleq> i\"\n    and \"callOrigin S c2 \\<triangleq> tx2\"\n    and \"txOrigin S tx2 \\<triangleq> i\"\n    and \"c1 \\<noteq> c2\"\nshows \"(c1,c2)\\<in>happensBefore S \\<or> (c2,c1)\\<in>happensBefore S\"\ntext_raw \\<open>}%EndSnippet\\<close>\n using assms proof (induct  arbitrary:  rule: wellFormed_induct)\n  case initial\n  then show ?case by (simp add: initialState_def)\nnext\n  case (step t a s)\n  then show ?case \n    using state_wellFormed_txStatus_callOrigin[OF \\<open>state_wellFormed t\\<close>]\n          wf_no_txStatus_origin_for_nothing[OF \\<open>state_wellFormed t\\<close>]\n          state_wellFormed_current_transaction_origin[OF \\<open>state_wellFormed t\\<close>]\n          state_wellFormed_ls_visibleCalls_callOrigin[OF \\<open>state_wellFormed t\\<close>]\n    by  (auto simp add: step.simps split: if_splits)\nqed\n\ntext_raw \\<open>\\DefineSnippet{state_wellFormed_vis_subset_calls}{\\<close>\nlemma state_wellFormed_vis_subset_calls:     \n  assumes \"state_wellFormed S\"\n    and \"visibleCalls S i \\<triangleq> vis\"\n    and \"c \\<in> vis\"\nshows \"c \\<in> dom (calls S)\"\ntext_raw \\<open>}%EndSnippet\\<close>\n  by (meson assms subset_h1 wellFormed_visibleCallsSubsetCalls_h(2))\n\ntext_raw \\<open>\\DefineSnippet{state_wellFormed_hb_antisym}{\\<close>\nlemma state_wellFormed_hb_antisym:     \n  assumes \"state_wellFormed S\"\n  assumes \"(x,y) \\<in> happensBefore S\"\n  shows \"(y,x) \\<notin> happensBefore S\"\n  text_raw \\<open>}%EndSnippet\\<close>\n  by (meson assms happensBefore_irrefl happensBefore_transitive irrefl_def transE)\n\ntext_raw \\<open>\\DefineSnippet{state_wellFormed_hb_antisym2}{\\<close>\nlemma state_wellFormed_hb_antisym2:     \n  assumes \"state_wellFormed S\"\n  shows \"antisym (happensBefore S)\"\n  text_raw \\<open>}%EndSnippet\\<close>\nusing antisym_def assms state_wellFormed_hb_antisym by auto\n\n\ntext_raw \\<open>\\DefineSnippet{state_wellFormed_transactionOrigin_callOrigin}{\\<close>\nlemma state_wellFormed_transactionOrigin_callOrigin:     \n  assumes \"state_wellFormed S\"\n    and \"txOrigin S tx = None\"\n  shows \"callOrigin S c \\<noteq> Some tx\"\ntext_raw \\<open>}%EndSnippet\\<close>\n  using assms state_wellFormed_txStatus_callOrigin wf_txOrigin_and_status by blast\n\n\n\ntext_raw \\<open>\\DefineSnippet{wf_transaction_consistent_l}{\\<close>\nlemma wf_transaction_consistent_l:     \n  assumes \"state_wellFormed S\"\n    and \"callOrigin S y1 = callOrigin S y2\"\n    and \"callOrigin S x \\<noteq> callOrigin S y1\"\n    and \"(y1, x)\\<in>happensBefore S\"\n  shows \"(y2, x)\\<in>happensBefore S\"\ntext_raw \\<open>}%EndSnippet\\<close>\n  by (metis assms wellFormed_state_transaction_consistent(3))\n\ntext_raw \\<open>\\DefineSnippet{wf_transaction_consistent_r}{\\<close>\nlemma wf_transaction_consistent_r:     \n  assumes \"state_wellFormed S\"\n    and \"callOrigin S y1 = callOrigin S y2\"\n    and \"callOrigin S x \\<noteq> callOrigin S y1\"\n    and \"(x, y1)\\<in>happensBefore S\"\n  shows \"(x, y2)\\<in>happensBefore S\"\ntext_raw \\<open>}%EndSnippet\\<close>\n by (metis assms wellFormed_state_transaction_consistent(3))\n\n\nlemma growth_callOrigin:\n  assumes \"state_monotonicGrowth i S S'\"\n    and \"callOrigin S c \\<triangleq> tx\"\n  shows \"callOrigin S' c \\<triangleq> tx\"\n  using assms(1) assms(2) state_monotonicGrowth_callOrigin by blast\n\n\n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/execution_invariants_unused.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3291325525050998}}
{"text": "(*\n * Copyright 2019, Data61\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(DATA61_BSD)\n *)\n\ntheory Guess_ExI\nimports\n  Eisbach_Methods\n  Apply_Debug\nbegin\n\n(*\nThis file contains the experimental methods guess_exI and guess_spec. Each, as the name suggests,\nattempts to guess an instantiation for their respective rules. It does so by looking\nfor a matching premise for the quantifying binder, checking that\nthis could be the only match for safety.\n*)\n\nmethod abs_used for P = (match (P) in \"\\<lambda>s. ?P\" \\<Rightarrow> \\<open>fail\\<close> \\<bar> _ \\<Rightarrow> \\<open>-\\<close>)\n\nmethod in_conj for P Q = (\n      match (Q) in \"P\" \\<Rightarrow> \\<open>-\\<close>\n    | match (Q) in \"\\<lambda>y. A y \\<and> B y\"  for A B  \\<Rightarrow>\n            \\<open> match (A) in \"(Q' :: 'b)\" for Q' \\<Rightarrow> \\<open>match (B) in \"(Q'' :: 'b)\"  for Q'' \\<Rightarrow>\n             \\<open> in_conj P Q' | in_conj P Q''\\<close>\\<close>\\<close>\n    )\n\nmethod guess_exI =\n    (require_determ \\<open>(match conclusion in \"\\<exists>x. Q x\" for Q \\<Rightarrow>\n                            \\<open>match premises in \"P y\" for P y \\<Rightarrow>\n                             \\<open>abs_used P, in_conj P Q, rule exI[where x=y]\\<close>\\<close>)\\<close>)\n\nlemma fun_uncurry:\n  \"(P \\<longrightarrow> Q \\<longrightarrow> R) \\<longleftrightarrow> (P \\<and> Q) \\<longrightarrow> R\"\n  by auto\n\nmethod guess_spec_inner for P uses I =\n    ((match I in \"\\<forall>x. C x \\<longrightarrow> _ x\" for C \\<Rightarrow> \\<open>in_conj P C\\<close> ))\n\nmethod guess_spec =\n    (require_determ \\<open>(match premises in I:\"\\<forall>x. _ x \\<longrightarrow> _ x\" \\<Rightarrow>\n                            \\<open>match premises in \"P y\" for P y \\<Rightarrow>\n                            \\<open>abs_used P, guess_spec_inner P I:I[simplified fun_uncurry],\n                                         insert I, drule spec[where x=y]\\<close>\\<close>)\\<close>)\n\ntext \\<open>Tests and examples\\<close>\nexperiment begin\n\n lemma\n    assumes Q: \"Q x\"\n    shows  \"P x \\<Longrightarrow> \\<forall>x. Q x \\<longrightarrow> P x \\<longrightarrow> R  \\<Longrightarrow> R\"\n    by (guess_spec, blast intro: Q)\n\n  (* Conflicting premises are checked *)\n  lemma\n    assumes Q: \"Q x\"\n    shows \"\\<lbrakk> P x; P y \\<rbrakk> \\<Longrightarrow>  \\<forall>x. Q x \\<longrightarrow> P x \\<longrightarrow> R \\<Longrightarrow> R\"\n    apply (fails \\<open>guess_spec\\<close>)\n    by (blast intro: Q)\n\n  (* Conflicts between different conjuncts are checked *)\n  lemma\n    assumes Q: \"Q x\"\n    shows \"\\<lbrakk> P x; Q y \\<rbrakk> \\<Longrightarrow> \\<forall>x. Q x \\<longrightarrow> P x \\<longrightarrow> R \\<Longrightarrow> R\"\n    apply (fails \\<open>guess_spec\\<close>)\n    by (blast intro: Q)\nend\n\ntext \\<open>Tests and examples\\<close>\nexperiment begin\n  lemma \"P x \\<Longrightarrow> \\<exists>x. P x\"\n    by guess_exI\n\n  lemma\n    assumes Q: \"Q x\"\n    shows \"P x \\<Longrightarrow> \\<exists>x. Q x \\<and> P x\"\n    apply guess_exI\n    by (blast intro: Q)\n\n  (* Conflicting premises are checked *)\n  lemma\n    assumes Q: \"Q x\"\n    shows \"\\<lbrakk> P x; P y \\<rbrakk> \\<Longrightarrow> \\<exists>x. Q x \\<and> P x\"\n    apply (fails \\<open>guess_exI\\<close>)\n    by (blast intro: Q)\n\n  (* Conflicts between different conjuncts are checked *)\n  lemma\n    assumes Q: \"Q x\"\n    shows \"\\<lbrakk> P x; Q y \\<rbrakk> \\<Longrightarrow> \\<exists>x. Q x \\<and> P x\"\n    apply (fails \\<open>guess_exI\\<close>)\n    by (blast intro: Q)\nend\n\nend", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/Guess_ExI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.3291325449539595}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory ExpandAll (* FIXME: bitrotted *)\nimports \"~~/src/HOL/Main\"\nbegin\n\nlemma expand_forall:\n  \"\\<lbrakk> \\<And>x. f (g x) = h x; (\\<forall>x. f x) = P; surj g \\<rbrakk> \\<Longrightarrow> (\\<forall>x. h x) = P\"\n  apply (simp add: surj_def)\n  apply metis\n  done\n\nlemma expand_exists:\n  \"\\<lbrakk> \\<And>x. f (g x) = h x; (\\<exists>x. f x) = P; surj g \\<rbrakk> \\<Longrightarrow> (\\<exists>x. h x) = P\"\n  apply (simp add: surj_def)\n  apply metis\n  done\n\nlemma expand_one_split:\n  \"\\<lbrakk> \\<And>a. (\\<forall>b. P a b) = Q a \\<rbrakk> \\<Longrightarrow> (\\<forall>v. (\\<lambda>(a, b). P a b) v) = (\\<forall>a. Q a)\"\n  \"\\<lbrakk> \\<And>a. (\\<exists>b. P a b) = Q a \\<rbrakk> \\<Longrightarrow> (\\<exists>v. (\\<lambda>(a, b). P a b) v) = (\\<exists>a. Q a)\"\n  by simp+\n\nML {*\n(* given patterns, e.g. fst, snd, replace\n  \\<forall>x. P (fst x) (snd x) with \\<forall>x y. P x y\n\n  more useful for things that aren't actually tuples,\n  e.g. replace \\<forall>xs. P (xs ! 0) (xs ! 2) with \\<forall>x y. P x y\n\n  pats here is a function for finding such pats\n\n  ditto \\<exists>x. P (fst x) (snd x)\n*)\n\nfun lambda_tuple [x] body =\n      lambda x body\n  | lambda_tuple (x::xs) body =\n      HOLogic.mk_split (lambda x (lambda_tuple xs body))\n  | lambda_tuple [] body =\n      raise TERM (\"lambda_tuple: empty\", [body])\n\nfun expand_forall_pats ctxt pats tac t = let\n    val (T, bdy, thm) = case t of\n        (Const (@{const_name All}, T) $ bdy) => (T, bdy, @{thm expand_forall})\n      | (Const (@{const_name Ex}, T) $ bdy) => (T, bdy, @{thm expand_exists})\n      | _ => raise TERM (\"expand_forall_pats: not All or Ex\", [t])\n\n    val thy = Proof_Context.theory_of ctxt\n\n    val x = Variable.variant_frees ctxt [bdy]\n        [(\"x\", domain_type (domain_type T))]\n      |> the_single |> Free\n\n    val bdy_x = betapply (bdy, x)\n    val pat_xs = pats x bdy_x |> sort_distinct Term_Ord.fast_term_ord\n\n    val ys = map (fn pat_x => (\"y\", fastype_of pat_x)) pat_xs\n     |> Variable.variant_frees ctxt [bdy_x] |> map Free\n\n    val f = Pattern.rewrite_term thy (pat_xs ~~ ys) [] bdy_x\n      |> tap (fn f => exists_subterm (curry (op =) x) f\n      andalso raise TERM (\"expand_forall_pats: not all converted\",\n          [x] @ pat_xs @ ys))\n      |> lambda_tuple ys\n\n    val g = lambda x (HOLogic.mk_tuple pat_xs)\n\n    val numsplits = length pat_xs - 1\n\n  in cterm_instantiate\n    [(@{cpat \"?f\\<Colon>?'b \\<Rightarrow> bool\"}, Thm.cterm_of ctxt f),\n        (@{cpat \"?g\\<Colon>?'a \\<Rightarrow> ?'b\"}, Thm.cterm_of ctxt g),\n        (@{cpat \"?h\\<Colon>?'a \\<Rightarrow> bool\"}, Thm.cterm_of ctxt bdy)]\n    thm\n    |> EVERY (\n        replicate numsplits (rtac @{thm trans[OF split_conv]} 1)\n      @ [rtac @{thm refl} 1]\n      @ replicate numsplits (resolve_tac ctxt @{thms expand_one_split} 1)\n      @ [rtac @{thm refl} 1, tac pat_xs])\n    |> Seq.hd\n  end\n\nfun mk_expand_forall_simproc s T pats tac thy\n  = let\n    val opT = (T --> HOLogic.boolT) --> HOLogic.boolT\n    val P = Free (\"P\", T --> HOLogic.boolT)\n  in Simplifier.simproc_global_i thy s\n      [Const (@{const_name All}, opT) $ P, Const (@{const_name Ex}, opT) $ P]\n      (fn ctxt  => (try (expand_forall_pats ctxt pats (tac ctxt) #> mk_meta_eq)))\n  end\n*}\n\nML {*\nfun get_nths xs (t as (Const (@{const_name nth}, _) $ ys $ _))\n    = if xs aconv ys then [t] else []\n  | get_nths xs (t as (Const (@{const_name hd}, _) $ ys))\n    = if xs aconv ys then [t] else []\n  | get_nths xs (f $ x) = get_nths xs f @ get_nths xs x\n  | get_nths xs (Abs (_, _, t)) = get_nths xs t\n  | get_nths _ _ = []\n*}\n\nlemma surj_via_mapI:\n  \"surj (\\<lambda>g. f (map g [0 ..< n])) \\<Longrightarrow> surj (\\<lambda>xs. f xs)\"\n  by (auto simp add: surj_def)\n\nlemma surj_tup_apply_eq:\n  \"surj (\\<lambda>f. (f x, g f)) = (\\<forall>v. surj (\\<lambda>f. g (f (x := v))))\"\n  apply (simp add: surj_def)\n  apply (rule arg_cong[where f=All, OF ext])+\n  apply safe\n   apply (metis fun_upd_triv)\n  apply (rule_tac x=\"f (x := y)\" for f y in exI, fastforce)\n  done\n\nlemma surj_apply:\n  \"surj (\\<lambda>f. f x)\"\n  by auto\n\nlemma hd_map:\n  \"xs \\<noteq> [] \\<Longrightarrow> hd (map f xs) = f (hd xs)\"\n  by (clarsimp simp: neq_Nil_conv)\n\n\nML {*\nfun inst_surj_via_mapI ctxt nths = let\n    fun get_nth (f $ (@{term Suc} $ n))\n      = get_nth (f $ n) + 1\n      | get_nth (Const (@{const_name nth}, _) $ _ $ n)\n      = HOLogic.dest_number n |> snd\n      | get_nth (Const (@{const_name hd}, _) $ _) = 0\n      | get_nth t = raise TERM (\"get_nth\", [t])\n    val max_n = map get_nth nths |> foldr1 (uncurry Integer.max)\n    val n = HOLogic.mk_number @{typ nat} (max_n + 1)\n      |> Thm.cterm_of ctxt\n    val t = cterm_instantiate [(@{cpat \"?n\\<Colon>nat\"}, n)] @{thm surj_via_mapI}\n    val ss = put_simpset (simpset_of @{context}) ctxt addsimps @{thms surj_tup_apply_eq surj_apply hd_map}\n            (* FIXME: should build up right simpset instead of taking the current one *)\n  in rtac t 1 THEN simp_tac ss 1 end\n*}\n\nML {*\nval t = expand_forall_pats @{context} get_nths\n  (inst_surj_via_mapI @{context})\n  @{term \"\\<forall>xs. xs ! 1 + xs ! 3 + xs ! 42 + hd xs < (12 :: nat)\"}\n*}\n\nML {*\nval expand_forall_nths_simproc\n  = mk_expand_forall_simproc \"expand_forall_nths\" @{typ \"'a list\"}\n    get_nths inst_surj_via_mapI @{theory}\n*}\n\nlemma test:\n  \"(\\<forall>xs. xs ! Suc 0 = 1 \\<and> xs ! 2 = 3 \\<longrightarrow> P (xs ! Suc 0 + xs ! 2)) = P (1 + 3)\n      \\<and> (\\<exists>xs. xs ! 3 = xs ! 4)\"\n  apply (tactic {* simp_tac (put_simpset HOL_basic_ss @{context} addsimprocs [expand_forall_nths_simproc]) 1 *})\n  apply simp\n  done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/lib/ExpandAll.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.32913254495395944}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Peter Lammich <peter dot lammich at uni-muenster.de>\n    Maintainer:  Peter Lammich <peter dot lammich at uni-muenster.de>\n*)\n(*\n  Changes since submission on 2009-11-26:\n\n  2009-12-10: OrderedSet, implemented iterators, min, max, to_sorted_list\n\n*)\n\nsection \\<open>\\isaheader{Set Implementation by Red-Black-Tree}\\<close>\ntheory RBTSetImpl\nimports \n  \"../spec/SetSpec\"\n  RBTMapImpl\n  \"../gen_algo/SetByMap\"\n  \"../gen_algo/SetGA\"\nbegin\ntext_raw \\<open>\\label{thy:RBTSetImpl}\\<close>\n(*@impl Set\n  @type ('a::linorder) rs\n  @abbrv rs,r\n  Sets over linearly ordered elements implemented by red-black trees.\n*)\n\nsubsection \"Definitions\"\ntype_synonym\n  'a rs = \"('a::linorder,unit) rm\"\n\nsetup Locale_Code.open_block\ninterpretation rs_sbm: OSetByOMap rm_basic_ops by unfold_locales\nsetup Locale_Code.close_block\n\ndefinition rs_ops :: \"('x::linorder,'x rs) oset_ops\"\n  where [icf_rec_def]: \"rs_ops \\<equiv> rs_sbm.obasic.dflt_oops\"\n\nsetup Locale_Code.open_block     \ninterpretation rs: StdOSetDefs rs_ops .\ninterpretation rs: StdOSet rs_ops\n  unfolding rs_ops_def\n  by (rule rs_sbm.obasic.dflt_oops_impl)\n\ninterpretation rs: StdSet_no_invar rs_ops\n  by unfold_locales (simp add: icf_rec_unf SetByMapDefs.invar_def)\nsetup Locale_Code.close_block\n\nsetup \\<open>ICF_Tools.revert_abbrevs \"rs\"\\<close>\n\nlemmas rbt_it_to_it_map_code_unfold[code_unfold] = \n  it_to_it_map_fold'[OF pi_rm]\n  it_to_it_map_fold'[OF pi_rm_rev]\n\nlemma pi_rs[proper_it]:\n  \"proper_it' rs.iteratei rs.iteratei\"\n  \"proper_it' rs.iterateoi rs.iterateoi\"\n  \"proper_it' rs.rev_iterateoi rs.rev_iterateoi\"\n  unfolding rs.iteratei_def[abs_def] rs.iterateoi_def[abs_def] \n    rs.rev_iterateoi_def[abs_def]\n  by (rule proper_it'I icf_proper_iteratorI)+\n\ninterpretation\n  pi_rs: proper_it_loc rs.iteratei rs.iteratei +\n  pi_rs_o: proper_it_loc rs.iterateoi rs.iterateoi +\n  pi_rs_ro: proper_it_loc rs.rev_iterateoi rs.rev_iterateoi\n  by unfold_locales (rule pi_rs)+\n\ndefinition \"rs_image_filter \\<equiv> undefined\"\ndefinition \"rs_image \\<equiv> undefined\"\n\nlemma rs_ops_unfold[code_unfold]:\n    \"set_op_\\<alpha> rs_ops = rs.\\<alpha>\"\n    \"set_op_invar rs_ops = rs.invar\"\n    \"set_op_empty rs_ops = rs.empty\"\n    \"set_op_sng rs_ops = rs.sng\"\n    \"set_op_memb rs_ops = rs.memb\"\n    \"set_op_ins rs_ops = rs.ins\"\n    \"set_op_ins_dj rs_ops = rs.ins_dj\"\n    \"set_op_delete rs_ops = rs.delete\"\n    \"set_op_isEmpty rs_ops = rs.isEmpty\"\n    \"set_op_isSng rs_ops = rs.isSng\"\n    \"set_op_ball rs_ops = rs.ball\"\n    \"set_op_bex rs_ops = rs.bex\"\n    \"set_op_size rs_ops = rs.size\"\n    \"set_op_size_abort rs_ops = rs.size_abort\"\n    \"set_op_union rs_ops = rs.union\"\n    \"set_op_union_dj rs_ops = rs.union_dj\"\n    \"set_op_diff rs_ops = rs.diff\"\n    \"set_op_filter rs_ops = rs.filter\"\n    \"set_op_inter rs_ops = rs.inter\"\n    \"set_op_subset rs_ops = rs.subset\"\n    \"set_op_equal rs_ops = rs.equal\"\n    \"set_op_disjoint rs_ops = rs.disjoint\"\n    \"set_op_disjoint_witness rs_ops = rs.disjoint_witness\"\n    \"set_op_sel rs_ops = rs.sel\"\n    \"set_op_to_list rs_ops = rs.to_list\"\n    \"set_op_from_list rs_ops = rs.from_list\"\n    \"set_op_min rs_ops = rs.min\"\n    \"set_op_max rs_ops = rs.max\"\n    by (auto simp add: rs_ops_def)\n\ndefinition test_codegen where \"test_codegen \\<equiv> (\n  rs.empty,\n  rs.memb,\n  rs.ins,\n  rs.delete,\n  rs.list_it,\n  rs.sng,\n  rs.isEmpty,\n  rs.isSng,\n  rs.ball,\n  rs.bex,\n  rs.size,\n  rs.size_abort,\n  rs.union,\n  rs.union_dj,\n  rs.diff,\n  rs.filter,\n  rs.inter,\n  rs.subset,\n  rs.equal,\n  rs.disjoint,\n  rs.disjoint_witness,\n  rs.sel,\n  rs.to_list,\n  rs.from_list,\n\n  rs.ordered_list_it,\n  rs.rev_list_it,\n  rs.min, \n  rs.max, \n  rs.to_sorted_list,\n  rs.to_rev_list\n)\"\n\nexport_code test_codegen checking SML\n\nend\n", "meta": {"author": "VTrelat", "repo": "Hopcroft_verif", "sha": "ede77c3a2105fd6722cf96896a297db294edf269", "save_path": "github-repos/isabelle/VTrelat-Hopcroft_verif", "path": "github-repos/isabelle/VTrelat-Hopcroft_verif/Hopcroft_verif-ede77c3a2105fd6722cf96896a297db294edf269/Isabelle/Collections/ICF/impl/RBTSetImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878414043816, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.32913253740281906}}
{"text": "(*  Title:       Integration of IsaFoR Terms and the Knuth-Bendix Order\n    Author:      Dmitriy Traytel <traytel at inf.ethz.ch>, 2014\n    Author:      Anders Schlichtkrull <andschl at dtu.dk>, 2017\n    Maintainer:  Anders Schlichtkrull <andschl at dtu.dk>\n*)\n\nsection \\<open>Integration of \\textsf{IsaFoR} Terms and the Knuth--Bendix Order\\<close>\n\ntext \\<open>\nThis theory implements the abstract interface for atoms and substitutions using\nthe \\textsf{IsaFoR} library.\n\\<close>\n\ntheory IsaFoR_Term\n  imports\n    Deriving.Derive\n    Ordered_Resolution_Prover.Abstract_Substitution\n    First_Order_Terms.Unification\n    First_Order_Terms.Subsumption\n    \"HOL-Cardinals.Wellorder_Extension\"\n    Open_Induction.Restricted_Predicates\n    Knuth_Bendix_Order.KBO\nbegin\n\nhide_const (open) mgu\n\nabbreviation subst_apply_literal ::\n  \"('f, 'v) term literal \\<Rightarrow> ('f, 'v, 'w) gsubst \\<Rightarrow> ('f, 'w) term literal\" (infixl \"\\<cdot>lit\" 60) where\n  \"L \\<cdot>lit \\<sigma> \\<equiv> map_literal (\\<lambda>A. A \\<cdot> \\<sigma>) L\"\n\ndefinition subst_apply_clause ::\n  \"('f, 'v) term clause \\<Rightarrow> ('f, 'v, 'w) gsubst \\<Rightarrow> ('f, 'w) term clause\" (infixl \"\\<cdot>cls\" 60) where\n  \"C \\<cdot>cls \\<sigma> = image_mset (\\<lambda>L. L \\<cdot>lit \\<sigma>) C\"\n\nabbreviation vars_lit :: \"('f, 'v) term literal \\<Rightarrow> 'v set\" where\n  \"vars_lit L \\<equiv> vars_term (atm_of L)\"\n\ndefinition vars_clause :: \"('f, 'v) term clause \\<Rightarrow> 'v set\" where\n  \"vars_clause C = Union (set_mset (image_mset vars_lit C))\"\n\ndefinition vars_clause_list :: \"('f, 'v) term clause list \\<Rightarrow> 'v set\" where\n  \"vars_clause_list Cs = Union (vars_clause ` set Cs) \"\n\ndefinition vars_partitioned :: \"('f,'v) term clause list \\<Rightarrow> bool\" where\n  \"vars_partitioned Cs \\<longleftrightarrow>\n   (\\<forall>i < length Cs. \\<forall>j < length Cs. i \\<noteq> j \\<longrightarrow> (vars_clause (Cs ! i) \\<inter> vars_clause (Cs ! j)) = {})\"\n\nlemma vars_clause_mono: \"S \\<subseteq># C \\<Longrightarrow> vars_clause S \\<subseteq> vars_clause C\"\n  unfolding vars_clause_def by auto\n\ninterpretation substitution_ops \"(\\<cdot>)\" Var \"(\\<circ>\\<^sub>s)\" .\n\nlemma is_ground_atm_is_ground_on_var:\n  assumes \"is_ground_atm (A \\<cdot> \\<sigma>)\" and \"v \\<in> vars_term A\"\n  shows \"is_ground_atm (\\<sigma> v)\"\nusing assms proof (induction A)\n  case (Var x)\n  then show ?case by auto\nnext\n  case (Fun f ts)\n  then show ?case unfolding is_ground_atm_def\n    by auto\nqed\n\nlemma is_ground_lit_is_ground_on_var:\n  assumes ground_lit: \"is_ground_lit (subst_lit L \\<sigma>)\" and v_in_L: \"v \\<in> vars_lit L\"\n  shows \"is_ground_atm (\\<sigma> v)\"\nproof -\n  let ?A = \"atm_of L\"\n  from v_in_L have A_p: \"v \\<in> vars_term ?A\"\n    by auto\n  then have \"is_ground_atm (?A \\<cdot> \\<sigma>)\"\n    using ground_lit unfolding is_ground_lit_def by auto\n  then show ?thesis\n    using A_p is_ground_atm_is_ground_on_var by metis\nqed\n\nlemma is_ground_cls_is_ground_on_var:\n  assumes\n    ground_clause: \"is_ground_cls (subst_cls C \\<sigma>)\" and\n    v_in_C: \"v \\<in> vars_clause C\"\n  shows \"is_ground_atm (\\<sigma> v)\"\nproof -\n  from v_in_C obtain L where L_p: \"L \\<in># C\" \"v \\<in> vars_lit L\"\n    unfolding vars_clause_def by auto\n  then have \"is_ground_lit (subst_lit L \\<sigma>)\"\n    using ground_clause unfolding is_ground_cls_def subst_cls_def by auto\n  then show ?thesis\n    using L_p is_ground_lit_is_ground_on_var by metis\nqed\n\nlemma is_ground_cls_list_is_ground_on_var:\n  assumes ground_list: \"is_ground_cls_list (subst_cls_list Cs \\<sigma>)\"\n    and v_in_Cs: \"v \\<in> vars_clause_list Cs\"\n  shows \"is_ground_atm (\\<sigma> v)\"\nproof -\n  from v_in_Cs obtain C where C_p: \"C \\<in> set Cs\" \"v \\<in> vars_clause C\"\n    unfolding vars_clause_list_def by auto\n  then have \"is_ground_cls (subst_cls C \\<sigma>)\"\n    using ground_list unfolding is_ground_cls_list_def subst_cls_list_def by auto\n  then show ?thesis\n    using C_p is_ground_cls_is_ground_on_var by metis\nqed\n\nlemma same_on_vars_lit:\n  assumes \"\\<forall>v \\<in> vars_lit L. \\<sigma> v = \\<tau> v\"\n  shows \"subst_lit L \\<sigma> = subst_lit L \\<tau>\"\n  using assms\nproof (induction L)\n  case (Pos x)\n  then have \"\\<forall>v \\<in> vars_term x. \\<sigma> v = \\<tau> v \\<Longrightarrow> subst_atm_abbrev x \\<sigma> = subst_atm_abbrev x \\<tau>\"\n    using term_subst_eq by metis+\n  then show ?case\n    unfolding subst_lit_def using Pos by auto\nnext\n  case (Neg x)\n  then have \"\\<forall>v \\<in> vars_term x. \\<sigma> v = \\<tau> v \\<Longrightarrow> subst_atm_abbrev x \\<sigma> = subst_atm_abbrev x \\<tau>\"\n    using term_subst_eq by metis+\n  then show ?case\n    unfolding subst_lit_def using Neg by auto\nqed\n\nlemma in_list_of_mset_in_S:\n  assumes \"i < length (list_of_mset S)\"\n  shows \"list_of_mset S ! i \\<in># S\"\nproof -\n  from assms have \"list_of_mset S ! i \\<in> set (list_of_mset S)\"\n    by auto\n  then have \"list_of_mset S ! i \\<in># mset (list_of_mset S)\"\n    by (meson in_multiset_in_set)\n  then show ?thesis\n    by auto\nqed\n\nlemma same_on_vars_clause:\n  assumes \"\\<forall>v \\<in> vars_clause S. \\<sigma> v = \\<tau> v\"\n  shows \"subst_cls S \\<sigma> = subst_cls S \\<tau>\"\n  by (smt assms image_eqI image_mset_cong2 mem_simps(9) same_on_vars_lit set_image_mset\n      subst_cls_def vars_clause_def)\n\ninterpretation substitution \"(\\<cdot>)\" \"Var :: _ \\<Rightarrow> ('f, nat) term\" \"(\\<circ>\\<^sub>s)\"\nproof unfold_locales\n  show \"\\<And>A. A \\<cdot> Var = A\"\n    by auto\nnext\n  show \"\\<And>A \\<tau> \\<sigma>. A \\<cdot> \\<tau> \\<circ>\\<^sub>s \\<sigma> = A \\<cdot> \\<tau> \\<cdot> \\<sigma>\"\n    by auto\nnext\n  show \"\\<And>\\<sigma> \\<tau>. (\\<And>A. A \\<cdot> \\<sigma> = A \\<cdot> \\<tau>) \\<Longrightarrow> \\<sigma> = \\<tau>\"\n    by (simp add: subst_term_eqI)\nnext\n  fix C :: \"('f, nat) term clause\"\n  fix \\<sigma>\n  assume \"is_ground_cls (subst_cls C \\<sigma>)\"\n  then have ground_atms_\\<sigma>: \"\\<And>v. v \\<in> vars_clause C \\<Longrightarrow> is_ground_atm (\\<sigma> v)\"\n    by (meson is_ground_cls_is_ground_on_var)\n\n  define some_ground_trm :: \"('f, nat) term\" where \"some_ground_trm = (Fun undefined [])\"\n  have ground_trm: \"is_ground_atm some_ground_trm\"\n    unfolding is_ground_atm_def some_ground_trm_def by auto\n  define \\<tau> where \"\\<tau> = (\\<lambda>v. if v \\<in> vars_clause C then \\<sigma> v else some_ground_trm)\"\n  then have \\<tau>_\\<sigma>: \"\\<forall>v \\<in> vars_clause C. \\<sigma> v = \\<tau> v\"\n    unfolding \\<tau>_def by auto\n\n  have all_ground_\\<tau>: \"is_ground_atm (\\<tau> v)\" for v\n  proof (cases \"v \\<in> vars_clause C\")\n    case True\n    then show ?thesis\n      using ground_atms_\\<sigma> \\<tau>_\\<sigma> by auto\n  next\n    case False\n    then show ?thesis\n      unfolding \\<tau>_def using ground_trm by auto\n  qed\n  have \"is_ground_subst \\<tau>\"\n    unfolding is_ground_subst_def\n  proof\n    fix A\n    show \"is_ground_atm (subst_atm_abbrev A \\<tau>)\"\n    proof (induction A)\n      case (Var v)\n      then show ?case using all_ground_\\<tau> by auto\n    next\n      case (Fun f As)\n      then show ?case using all_ground_\\<tau>\n        by (simp add: is_ground_atm_def)\n    qed\n  qed\n  moreover have \"\\<forall>v \\<in> vars_clause C. \\<sigma> v = \\<tau> v\"\n    using \\<tau>_\\<sigma> unfolding vars_clause_list_def\n    by blast\n  then have \"subst_cls C \\<sigma> = subst_cls C \\<tau>\"\n    using same_on_vars_clause by auto\n  ultimately show \"\\<exists>\\<tau>. is_ground_subst \\<tau> \\<and> subst_cls C \\<tau> = subst_cls C \\<sigma>\"\n    by auto\nnext\n  show \"wfP (strictly_generalizes_atm :: ('f, 'v) term \\<Rightarrow> _ \\<Rightarrow> _)\"\n    unfolding wfP_def\n    by (rule wf_subset[OF wf_subsumes])\n      (auto simp: strictly_generalizes_atm_def generalizes_atm_def term_subsumable.subsumes_def\n        subsumeseq_term.simps)\nqed\n\nlemma vars_partitioned_var_disjoint:\n  assumes \"vars_partitioned Cs\"\n  shows \"var_disjoint Cs\"\n  unfolding var_disjoint_def\nproof (intro allI impI)\n  fix \\<sigma>s :: \\<open>('b \\<Rightarrow> ('a, 'b) term) list\\<close>\n  assume \"length \\<sigma>s = length Cs\"\n  with assms[unfolded vars_partitioned_def] Fun_More.fun_merge[of \"map vars_clause Cs\" \"nth \\<sigma>s\"]\n  obtain \\<sigma> where\n    \\<sigma>_p: \"\\<forall>i < length (map vars_clause Cs). \\<forall>x \\<in> map vars_clause Cs ! i. \\<sigma> x = (\\<sigma>s ! i) x\"\n    by auto\n  have \"\\<forall>i < length Cs. \\<forall>S. S \\<subseteq># Cs ! i \\<longrightarrow> subst_cls S (\\<sigma>s ! i) = subst_cls S \\<sigma>\"\n  proof (rule, rule, rule, rule)\n    fix i :: nat and S :: \"('a, 'b) term literal multiset\"\n    assume\n      \"i < length Cs\" and\n      \"S \\<subseteq># Cs ! i\"\n    then have \"\\<forall>v \\<in> vars_clause S. (\\<sigma>s ! i) v = \\<sigma> v\"\n      using vars_clause_mono[of S \"Cs ! i\"] \\<sigma>_p by auto\n    then show \"subst_cls S (\\<sigma>s ! i) = subst_cls S \\<sigma>\"\n      using same_on_vars_clause by auto\n  qed\n  then show \"\\<exists>\\<tau>. \\<forall>i<length Cs. \\<forall>S. S \\<subseteq># Cs ! i \\<longrightarrow> subst_cls S (\\<sigma>s ! i) = subst_cls S \\<tau>\"\n    by auto\nqed\n\nlemma vars_in_instance_in_range_term:\n  \"vars_term (subst_atm_abbrev A \\<sigma>) \\<subseteq> Union (image vars_term (range \\<sigma>))\"\n  by (induction A) auto\n\nlemma vars_in_instance_in_range_lit: \"vars_lit (subst_lit L \\<sigma>) \\<subseteq> Union (image vars_term (range \\<sigma>))\"\nproof (induction L)\n  case (Pos A)\n  have \"vars_term (A \\<cdot> \\<sigma>) \\<subseteq> Union (image vars_term (range \\<sigma>))\"\n    using vars_in_instance_in_range_term[of A \\<sigma>] by blast\n  then show ?case by auto\nnext\n  case (Neg A)\n  have \"vars_term (A \\<cdot> \\<sigma>) \\<subseteq> Union (image vars_term (range \\<sigma>))\"\n    using vars_in_instance_in_range_term[of A \\<sigma>] by blast\n  then show ?case by auto\nqed\n\nlemma vars_in_instance_in_range_cls:\n  \"vars_clause (subst_cls C \\<sigma>) \\<subseteq> Union (image vars_term (range \\<sigma>))\"\n  unfolding vars_clause_def subst_cls_def using vars_in_instance_in_range_lit[of _ \\<sigma>] by auto\n\nprimrec renamings_apart :: \"('f, nat) term clause list \\<Rightarrow> (('f, nat) subst) list\" where\n  \"renamings_apart [] = []\"\n| \"renamings_apart (C # Cs) =\n   (let \\<sigma>s = renamings_apart Cs in\n      (\\<lambda>v. Var (v + Max (vars_clause_list (subst_cls_lists Cs \\<sigma>s) \\<union> {0}) + 1)) # \\<sigma>s)\"\n\ndefinition var_map_of_subst :: \"('f, nat) subst \\<Rightarrow> nat \\<Rightarrow> nat\" where\n  \"var_map_of_subst \\<sigma> v = the_Var (\\<sigma> v)\"\n\nlemma len_renamings_apart: \"length (renamings_apart Cs) = length Cs\"\n  by (induction Cs) (auto simp: Let_def)\n\nlemma renamings_apart_is_Var: \"\\<forall>\\<sigma> \\<in> set (renamings_apart Cs). \\<forall>x. is_Var (\\<sigma> x)\"\n  by (induction Cs) (auto simp: Let_def)\n\nlemma renamings_apart_inj: \"\\<forall>\\<sigma> \\<in> set (renamings_apart Cs). inj \\<sigma>\"\nproof (induction Cs)\n  case (Cons a Cs)\n  then have \"inj (\\<lambda>v. Var (Suc (v + Max (vars_clause_list\n               (subst_cls_lists Cs (renamings_apart Cs)) \\<union> {0}))))\"\n    by (meson add_right_imp_eq injI nat.inject term.inject(1))\n  then show ?case\n    using Cons by (auto simp: Let_def)\nqed auto\n\nlemma finite_vars_clause[simp]: \"finite (vars_clause x)\"\n  unfolding vars_clause_def by auto\n\nlemma finite_vars_clause_list[simp]: \"finite (vars_clause_list Cs)\"\n  unfolding vars_clause_list_def by (induction Cs) auto\n\nlemma Suc_Max_notin_set: \"finite X \\<Longrightarrow> Suc (v + Max (insert 0 X)) \\<notin> X\"\n  by (metis Max.boundedE Suc_n_not_le_n empty_iff finite.insertI le_add2 vimageE vimageI\n      vimage_Suc_insert_0)\n\nlemma vars_partitioned_Nil[simp]: \"vars_partitioned []\"\n  unfolding vars_partitioned_def by auto\n\nlemma subst_cls_lists_Nil[simp]: \"subst_cls_lists Cs [] = []\"\n  unfolding subst_cls_lists_def by auto\n\nlemma vars_clause_hd_partitioned_from_tl:\n  assumes \"Cs \\<noteq>[]\"\n  shows \"vars_clause (hd (subst_cls_lists Cs (renamings_apart Cs)))\n    \\<inter> vars_clause_list (tl (subst_cls_lists Cs (renamings_apart Cs))) = {}\"\n  using assms\nproof (induction Cs)\n  case (Cons C Cs)\n  define \\<sigma>' :: \"nat \\<Rightarrow> nat\"\n    where \"\\<sigma>' = (\\<lambda>v. (Suc (v + Max ((vars_clause_list (subst_cls_lists Cs\n                        (renamings_apart Cs))) \\<union> {0}))))\"\n  define \\<sigma> :: \"nat \\<Rightarrow> ('a, nat) term\"\n    where \"\\<sigma> = (\\<lambda>v. Var (\\<sigma>' v))\"\n\n  have \"vars_clause (subst_cls C \\<sigma>) \\<subseteq> \\<Union> (vars_term ` range \\<sigma>)\"\n    using vars_in_instance_in_range_cls[of C \"hd (renamings_apart (C # Cs))\"] \\<sigma>_def \\<sigma>'_def\n    by (auto simp: Let_def)\n  moreover have \"\\<Union> (vars_term ` range \\<sigma>)\n    \\<inter> vars_clause_list (subst_cls_lists Cs (renamings_apart Cs)) = {}\"\n  proof -\n    have \"range \\<sigma>' \\<inter> vars_clause_list (subst_cls_lists Cs (renamings_apart Cs)) = {}\"\n      unfolding \\<sigma>'_def using Suc_Max_notin_set by auto\n    then show ?thesis\n      unfolding \\<sigma>_def \\<sigma>'_def by auto\n  qed\n  ultimately have \"vars_clause (subst_cls C \\<sigma>)\n     \\<inter> vars_clause_list (subst_cls_lists Cs (renamings_apart Cs)) = {}\"\n    by auto\n  then show ?case\n    unfolding \\<sigma>_def \\<sigma>'_def unfolding subst_cls_lists_def\n    by (simp add: Let_def subst_cls_lists_def)\nqed auto\n\nlemma vars_partitioned_renamings_apart: \"vars_partitioned (subst_cls_lists Cs (renamings_apart Cs))\"\nproof (induction Cs)\n  case (Cons C Cs)\n  {\n    fix i :: nat and j :: nat\n    assume ij:\n      \"i < Suc (length Cs)\"\n      \"j < i\"\n    have \"vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! i) \\<inter>\n        vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! j) =\n        {}\"\n    proof (cases i; cases j)\n      fix j' :: nat\n      assume i'j':\n        \"i = 0\"\n        \"j = Suc j'\"\n      then show \"vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! i) \\<inter>\n        vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! j) =\n        {}\"\n        using ij by auto\n    next\n      fix i' :: nat\n      assume i'j':\n        \"i = Suc i'\"\n        \"j = 0\"\n      have disjoin_C_Cs: \"vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! 0) \\<inter>\n        vars_clause_list ((subst_cls_lists Cs (renamings_apart Cs))) = {}\"\n        using vars_clause_hd_partitioned_from_tl[of \"C # Cs\"]\n        by (simp add: Let_def subst_cls_lists_def)\n      {\n        fix x\n        assume asm: \"x \\<in> vars_clause (subst_cls_lists Cs (renamings_apart Cs) ! i')\"\n        then have \"(subst_cls_lists Cs (renamings_apart Cs) ! i')\n          \\<in> set (subst_cls_lists Cs (renamings_apart Cs))\"\n          using i'j' ij unfolding subst_cls_lists_def\n          by (metis Suc_less_SucD length_map len_renamings_apart length_zip min_less_iff_conj\n              nth_mem)\n        moreover from asm have\n          \"x \\<in> vars_clause (subst_cls_lists Cs (renamings_apart Cs) ! i')\"\n          using i'j' ij\n          unfolding subst_cls_lists_def by simp\n        ultimately have \"\\<exists>D \\<in> set (subst_cls_lists Cs (renamings_apart Cs)). x \\<in> vars_clause D\"\n            by auto\n      }\n      then have \"vars_clause (subst_cls_lists Cs (renamings_apart Cs) ! i')\n        \\<subseteq> Union (set (map vars_clause ((subst_cls_lists Cs (renamings_apart Cs)))))\"\n        by auto\n      then have \"vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! 0) \\<inter>\n        vars_clause (subst_cls_lists Cs (renamings_apart Cs) ! i') =\n        {}\" using disjoin_C_Cs unfolding vars_clause_list_def by auto\n      moreover\n      have \"subst_cls_lists Cs (renamings_apart Cs) ! i' =\n        subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! i\"\n        using i'j' ij unfolding subst_cls_lists_def by (simp add: Let_def)\n      ultimately\n      show \"vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! i) \\<inter>\n        vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! j) =\n        {}\"\n        using i'j' by (simp add: Int_commute)\n    next\n      fix i' :: nat and j' :: nat\n      assume i'j':\n        \"i = Suc i'\"\n        \"j = Suc j'\"\n      have \"i'<length (subst_cls_lists Cs (renamings_apart Cs))\"\n        using ij i'j' unfolding subst_cls_lists_def by (auto simp: len_renamings_apart)\n      moreover\n      have \"j'<length (subst_cls_lists Cs (renamings_apart Cs))\"\n        using ij i'j' unfolding subst_cls_lists_def by (auto simp: len_renamings_apart)\n      moreover\n      have \"i' \\<noteq> j'\"\n        using \\<open>i = Suc i'\\<close> \\<open>j = Suc j'\\<close> ij by blast\n      ultimately\n      have \"vars_clause (subst_cls_lists Cs (renamings_apart Cs) ! i') \\<inter>\n          vars_clause (subst_cls_lists Cs (renamings_apart Cs) ! j') =\n          {}\"\n        using Cons unfolding vars_partitioned_def by auto\n      then show \"vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! i) \\<inter>\n        vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! j) =\n        {}\"\n        unfolding i'j'\n        by (simp add: subst_cls_lists_def Let_def)\n    next\n      assume\n        \\<open>i = 0\\<close> and\n        \\<open>j = 0\\<close>\n      then show \\<open>vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! i) \\<inter>\n        vars_clause (subst_cls_lists (C # Cs) (renamings_apart (C # Cs)) ! j) =\n        {}\\<close> using ij by auto\n    qed\n  }\n  then show ?case\n    unfolding vars_partitioned_def\n    by (metis (no_types, lifting) Int_commute Suc_lessI len_renamings_apart length_map\n        length_nth_simps(2) length_zip min.idem nat.inject not_less_eq subst_cls_lists_def)\nqed auto\n\ninterpretation substitution_renamings \"(\\<cdot>)\" \"Var :: _ \\<Rightarrow> ('f, nat) term\" \"(\\<circ>\\<^sub>s)\" renamings_apart \"Fun undefined\"\nproof unfold_locales\n  fix Cs :: \"('f, nat) term clause list\"\n  show \"length (renamings_apart Cs) = length Cs\"\n    using len_renamings_apart by auto\nnext\n  fix Cs :: \"('f, nat) term clause list\"\n  fix \\<rho> ::  \"nat \\<Rightarrow> ('f, nat) Term.term\"\n  assume \\<rho>_renaming: \"\\<rho> \\<in> set (renamings_apart Cs)\"\n  {\n    have inj_is_renaming:\n      \"\\<And>\\<sigma> :: ('f, nat) subst. (\\<And>x. is_Var (\\<sigma> x)) \\<Longrightarrow> inj \\<sigma> \\<Longrightarrow> is_renaming \\<sigma>\"\n    proof -\n      fix \\<sigma> :: \"('f, nat) subst\"\n      fix x\n      assume is_var_\\<sigma>: \"\\<And>x. is_Var (\\<sigma> x)\"\n      assume inj_\\<sigma>: \"inj \\<sigma>\"\n      define \\<sigma>' where \"\\<sigma>' = var_map_of_subst \\<sigma>\"\n      have \\<sigma>: \"\\<sigma> = Var \\<circ> \\<sigma>'\"\n        unfolding \\<sigma>'_def var_map_of_subst_def using is_var_\\<sigma> by auto\n\n      from is_var_\\<sigma> inj_\\<sigma> have \"inj \\<sigma>'\"\n        unfolding is_renaming_def unfolding subst_domain_def inj_on_def \\<sigma>'_def var_map_of_subst_def\n         by (metis term.collapse(1))\n      then have \"inv \\<sigma>' \\<circ> \\<sigma>' = id\"\n        using inv_o_cancel[of \\<sigma>'] by simp\n      then have \"Var \\<circ> (inv \\<sigma>' \\<circ> \\<sigma>') = Var\"\n        by simp\n      then have \"\\<forall>x. (Var \\<circ> (inv \\<sigma>' \\<circ> \\<sigma>')) x = Var x\"\n        by metis\n      then have \"\\<forall>x. ((Var \\<circ> \\<sigma>') \\<circ>\\<^sub>s (Var \\<circ> (inv \\<sigma>'))) x = Var x\"\n        unfolding subst_compose_def by auto\n      then have \"\\<sigma> \\<circ>\\<^sub>s (Var \\<circ> (inv \\<sigma>')) = Var\"\n        using \\<sigma> by auto\n      then show \"is_renaming \\<sigma>\"\n        unfolding is_renaming_def by blast\n    qed\n    then have \"\\<forall>\\<sigma> \\<in> (set (renamings_apart Cs)). is_renaming \\<sigma>\"\n      using renamings_apart_is_Var renamings_apart_inj by blast\n  }\n  then show \"is_renaming \\<rho>\"\n    using \\<rho>_renaming by auto\nnext\n  fix Cs :: \"('f, nat) term clause list\"\n  have \"vars_partitioned (subst_cls_lists Cs (renamings_apart Cs))\"\n    using vars_partitioned_renamings_apart by auto\n  then show \"var_disjoint (subst_cls_lists Cs (renamings_apart Cs))\"\n    using vars_partitioned_var_disjoint by auto\nnext\n  show \"\\<And>\\<sigma> As Bs. Fun undefined As \\<cdot> \\<sigma> = Fun undefined Bs \\<longleftrightarrow> map (\\<lambda>A. A \\<cdot> \\<sigma>) As = Bs\"\n    by simp\nqed\n\nfun pairs :: \"'a list \\<Rightarrow> ('a \\<times> 'a) list\" where\n  \"pairs (x # y # xs) = (x, y) # pairs (y # xs)\" |\n  \"pairs _ = []\"\n\nderive compare \"term\"\nderive compare \"literal\"\n\nlemma class_linorder_compare: \"class.linorder (le_of_comp compare) (lt_of_comp compare)\"\n  apply standard\n      apply (simp_all add: lt_of_comp_def le_of_comp_def split: order.splits)\n     apply (metis comparator.sym comparator_compare invert_order.simps(1) order.distinct(5))\n    apply (metis comparator_compare comparator_def order.distinct(5))\n   apply (metis comparator.sym comparator_compare invert_order.simps(1) order.distinct(5))\n  by (metis comparator.sym comparator_compare invert_order.simps(2) order.distinct(5))\n\ncontext begin\ninterpretation compare_linorder: linorder\n  \"le_of_comp compare\"\n  \"lt_of_comp compare\"\n  by (rule class_linorder_compare)\n\ndefinition Pairs where\n  \"Pairs AAA = concat (compare_linorder.sorted_list_of_set\n     ((pairs \\<circ> compare_linorder.sorted_list_of_set) ` AAA))\"\n\nlemma unifies_all_pairs_iff:\n  \"(\\<forall>p \\<in> set (pairs xs). fst p \\<cdot> \\<sigma> = snd p \\<cdot> \\<sigma>) \\<longleftrightarrow> (\\<forall>a \\<in> set xs. \\<forall>b \\<in> set xs. a \\<cdot> \\<sigma> = b \\<cdot> \\<sigma>)\"\nproof (induct xs rule: pairs.induct)\n  case (1 x y xs)\n  then show ?case\n    unfolding pairs.simps list.set ball_Un ball_simps simp_thms fst_conv snd_conv by metis\nqed simp_all\n\nlemma in_pair_in_set:\n  assumes \"(A,B) \\<in> set ((pairs As))\"\n  shows \"A \\<in> set As \\<and> B \\<in> set As\"\n  using assms\nproof (induction As)\n  case (Cons A As)\n  note Cons_outer = this\n  show ?case\n  proof (cases As)\n    case Nil\n    then show ?thesis\n      using Cons_outer by auto\n  next\n    case (Cons B As')\n    then show ?thesis using Cons_outer by auto\n  qed\nqed auto\n\nlemma in_pairs_sorted_list_of_set_in_set:\n  assumes\n    \"finite AAA\"\n    \"\\<forall>AA \\<in> AAA. finite AA\"\n    \"AB_pairs \\<in> (pairs \\<circ> compare_linorder.sorted_list_of_set) ` AAA\" and\n    \"(A :: _ :: compare, B) \\<in> set AB_pairs\"\n  shows \"\\<exists>AA. AA \\<in> AAA \\<and> A \\<in> AA \\<and> B \\<in> AA\"\nproof -\n  from assms have \"AB_pairs \\<in> (pairs \\<circ> compare_linorder.sorted_list_of_set) ` AAA\"\n    by auto\n  then obtain AA where\n    AA_p: \"AA \\<in> AAA \\<and> (pairs \\<circ> compare_linorder.sorted_list_of_set) AA = AB_pairs\"\n    by auto\n  have \"(A, B) \\<in> set (pairs (compare_linorder.sorted_list_of_set AA))\"\n    using AA_p[] assms(4) by auto\n  then have \"A \\<in> set (compare_linorder.sorted_list_of_set AA)\" and\n    \"B \\<in> set (compare_linorder.sorted_list_of_set AA)\"\n    using in_pair_in_set[of A] by auto\n  then show ?thesis\n    using assms(2) AA_p by auto\nqed\n\nlemma unifiers_Pairs:\n  assumes\n    \"finite AAA\" and\n    \"\\<forall>AA \\<in> AAA. finite AA\"\n  shows \"unifiers (set (Pairs AAA)) = {\\<sigma>. is_unifiers \\<sigma> AAA}\"\nproof (rule; rule)\n  fix \\<sigma> :: \"('a, 'b) subst\"\n  assume asm: \"\\<sigma> \\<in> unifiers (set (Pairs AAA))\"\n  have \"\\<And>AA. AA \\<in> AAA \\<Longrightarrow> card (AA \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<sigma>) \\<le> Suc 0\"\n  proof -\n    fix AA :: \"('a, 'b) term set\"\n    assume asm': \"AA \\<in> AAA\"\n    then have \"\\<forall>p \\<in> set (pairs (compare_linorder.sorted_list_of_set AA)).\n      subst_atm_abbrev (fst p) \\<sigma> = subst_atm_abbrev (snd p) \\<sigma>\"\n      using assms asm unfolding Pairs_def by auto\n    then have \"\\<forall>A \\<in> AA. \\<forall>B \\<in> AA. subst_atm_abbrev A \\<sigma> = subst_atm_abbrev B \\<sigma>\"\n      using assms asm' unfolding unifies_all_pairs_iff\n      using compare_linorder.sorted_list_of_set by blast\n    then show \"card (AA \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<sigma>) \\<le> Suc 0\"\n      by (smt imageE card.empty card_Suc_eq card_mono finite.intros(1) finite_insert le_SucI\n           singletonI subsetI)\n  qed\n  then show \"\\<sigma> \\<in> {\\<sigma>. is_unifiers \\<sigma> AAA}\"\n    using assms by (auto simp: is_unifiers_def is_unifier_def subst_atms_def)\nnext\n  fix \\<sigma> :: \"('a, 'b) subst\"\n  assume asm: \"\\<sigma> \\<in> {\\<sigma>. is_unifiers \\<sigma> AAA}\"\n\n  {\n    fix AB_pairs A B\n    assume\n      \"AB_pairs \\<in> set (compare_linorder.sorted_list_of_set\n         ((pairs \\<circ> compare_linorder.sorted_list_of_set) ` AAA))\" and\n      \"(A, B) \\<in> set AB_pairs\"\n    then have \"\\<exists>AA. AA \\<in> AAA \\<and> A \\<in> AA \\<and> B \\<in> AA\"\n      using assms by (simp add: in_pairs_sorted_list_of_set_in_set)\n    then obtain AA where\n     a: \"AA \\<in> AAA\" \"A \\<in> AA\" \"B \\<in> AA\"\n      by blast\n    from a assms asm have card_AA_\\<sigma>: \"card (AA \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<sigma>) \\<le> Suc 0\"\n      unfolding is_unifiers_def is_unifier_def subst_atms_def by auto\n    have \"subst_atm_abbrev A \\<sigma> = subst_atm_abbrev B \\<sigma>\"\n    proof (cases \"card (AA \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<sigma>) = Suc 0\")\n      case True\n      moreover\n      have \"subst_atm_abbrev A \\<sigma> \\<in> AA \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<sigma>\"\n        using a assms asm card_AA_\\<sigma> by auto\n      moreover\n      have \"subst_atm_abbrev B \\<sigma> \\<in> AA \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<sigma>\"\n        using a assms asm card_AA_\\<sigma> by auto\n      ultimately\n      show ?thesis\n        using a assms asm card_AA_\\<sigma> by (metis (no_types, lifting) card_Suc_eq singletonD)\n    next\n      case False\n      then have \"card (AA \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<sigma>) = 0\"\n        using a assms asm card_AA_\\<sigma>\n        by arith\n      then show ?thesis\n        using a assms asm card_AA_\\<sigma> by auto\n    qed\n  }\n  then show \"\\<sigma> \\<in> unifiers (set (Pairs AAA))\"\n    unfolding Pairs_def unifiers_def by auto\nqed\n\nend\n\ndefinition \"mgu_sets AAA = map_option subst_of (unify (Pairs AAA) [])\"\n\nlemma mgu_sets_is_imgu:\n  fixes AAA :: \"('a :: compare, nat) term set set\" and \\<sigma> :: \"('a, nat) subst\"\n  assumes fin: \"finite AAA\" \"\\<forall>AA \\<in> AAA. finite AA\" and \"mgu_sets AAA = Some \\<sigma>\"\n  shows \"is_imgu \\<sigma> AAA\"\nproof -\n  have \"Unifiers.is_imgu \\<sigma> (set (Pairs AAA))\"\n    using assms unify_sound unfolding mgu_sets_def by blast\n  thus ?thesis\n    unfolding Unifiers.is_imgu_def is_imgu_def unifiers_Pairs[OF fin]\n    by simp\nqed\n\ninterpretation mgu \"(\\<cdot>)\" \"Var :: _ \\<Rightarrow> ('f :: compare, nat) term\" \"(\\<circ>\\<^sub>s)\" renamings_apart\n  \"Fun undefined\" mgu_sets\nproof unfold_locales\n  fix AAA :: \"('a :: compare, nat) term set set\" and \\<sigma> :: \"('a, nat) subst\"\n  assume fin: \"finite AAA\" \"\\<forall>AA \\<in> AAA. finite AA\" and \"mgu_sets AAA = Some \\<sigma>\"\n  thus \"is_mgu \\<sigma> AAA\"\n    using mgu_sets_is_imgu by auto\nnext\n  fix AAA :: \"('a :: compare, nat) term set set\" and \\<sigma> :: \"('a, nat) subst\"\n  assume fin: \"finite AAA\" \"\\<forall>AA \\<in> AAA. finite AA\" and \"is_unifiers \\<sigma> AAA\"\n  then have \"\\<sigma> \\<in> unifiers (set (Pairs AAA))\"\n    unfolding is_mgu_def unifiers_Pairs[OF fin] by auto\n  then show \"\\<exists>\\<tau>. mgu_sets AAA = Some \\<tau>\"\n    using unify_complete unfolding mgu_sets_def by blast\nqed\n\ninterpretation imgu \"(\\<cdot>)\" \"Var :: _ \\<Rightarrow> ('f :: compare, nat) term\" \"(\\<circ>\\<^sub>s)\" renamings_apart\n  \"Fun undefined\" mgu_sets\nproof unfold_locales\n  fix AAA :: \"('a :: compare, nat) term set set\" and \\<sigma> :: \"('a, nat) subst\"\n  assume fin: \"finite AAA\" \"\\<forall>AA \\<in> AAA. finite AA\" and \"mgu_sets AAA = Some \\<sigma>\"\n  thus \"is_imgu \\<sigma> AAA\"\n    by (rule mgu_sets_is_imgu)\nqed\n\nderive linorder prod\nderive linorder list\n\ntext \\<open>\nThis part extends and integrates and the Knuth--Bendix order defined in\n\\textsf{IsaFoR}.\n\\<close>\n\nrecord 'f weights =\n  w :: \"'f \\<times> nat \\<Rightarrow> nat\"\n  w0 :: nat\n  pr_strict :: \"'f \\<times> nat \\<Rightarrow> 'f \\<times> nat \\<Rightarrow> bool\"\n  least :: \"'f \\<Rightarrow> bool\"\n  scf :: \"'f \\<times> nat \\<Rightarrow> nat \\<Rightarrow> nat\"\n\nclass weighted =\n  fixes weights :: \"'a weights\"\n  assumes weights_adm:\n    \"admissible_kbo\n       (w weights) (w0 weights) (pr_strict weights) ((pr_strict weights)\\<^sup>=\\<^sup>=) (least weights) (scf weights)\"\n  and pr_strict_total: \"fi = gj \\<or> pr_strict weights fi gj \\<or> pr_strict weights gj fi\"\n  and pr_strict_asymp: \"asymp (pr_strict weights)\"\n  and scf_ok: \"i < n \\<Longrightarrow> scf weights (f, n) i \\<le> 1\"\n\ninstantiation unit :: weighted begin\n\ndefinition weights_unit :: \"unit weights\" where \"weights_unit =\n  \\<lparr>w = Suc \\<circ> snd, w0 = 1, pr_strict = \\<lambda>(_, n) (_, m). n > m, least = \\<lambda>_. True, scf = \\<lambda>_ _. 1\\<rparr>\"\n\ninstance\n  by (intro_classes, unfold_locales) (auto simp: weights_unit_def SN_iff_wf irreflp_def\n      intro: asympI intro!: wf_subset[OF wf_inv_image[OF wf], of _ snd])\nend\n\nglobal_interpretation KBO:\n  admissible_kbo\n    \"w (weights :: 'f :: weighted weights)\" \"w0 (weights :: 'f :: weighted weights)\"\n    \"pr_strict weights\" \"((pr_strict weights)\\<^sup>=\\<^sup>=)\" \"least weights\" \"scf weights\"\n    defines weight = KBO.weight\n    and kbo = KBO.kbo\n  by (simp add: weights_adm)\n\nlemma kbo_code[code]: \"kbo s t =\n  (let wt = weight t; ws = weight s in\n  if vars_term_ms (KBO.SCF t) \\<subseteq># vars_term_ms (KBO.SCF s) \\<and> wt \\<le> ws\n  then\n    (if wt < ws then (True, True)\n    else\n      (case s of\n        Var y \\<Rightarrow> (False, case t of Var x \\<Rightarrow> True | Fun g ts \\<Rightarrow> ts = [] \\<and> least weights g)\n      | Fun f ss \\<Rightarrow>\n          (case t of\n            Var x \\<Rightarrow> (True, True)\n          | Fun g ts \\<Rightarrow>\n              if pr_strict weights (f, length ss) (g, length ts) then (True, True)\n              else if (f, length ss) = (g, length ts) then lex_ext_unbounded kbo ss ts\n              else (False, False))))\n  else (False, False))\"\n  by (subst KBO.kbo.simps) (auto simp: Let_def split: term.splits)\n\ndefinition \"less_kbo s t = fst (kbo t s)\"\n\nlemma less_kbo_gtotal: \"ground s \\<Longrightarrow> ground t \\<Longrightarrow> s = t \\<or> less_kbo s t \\<or> less_kbo t s\"\n  unfolding less_kbo_def using KBO.S_ground_total by (metis pr_strict_total subset_UNIV)\n\nlemma less_kbo_subst:\n  fixes \\<sigma> :: \"('f :: weighted, 'v) subst\"\n  shows \"less_kbo s t \\<Longrightarrow> less_kbo (s \\<cdot> \\<sigma>) (t \\<cdot> \\<sigma>)\"\n  unfolding less_kbo_def by (rule KBO.S_subst)\n\nlemma wfP_less_kbo: \"wfP less_kbo\"\nproof -\n  have \"SN {(x, y). fst (kbo x y)}\"\n    using pr_strict_asymp by (fastforce simp: asympI irreflp_def intro!: KBO.S_SN scf_ok)\n  then show ?thesis\n    unfolding SN_iff_wf wfP_def by (rule wf_subset) (auto simp: less_kbo_def)\nqed\n\ninstantiation \"term\" :: (weighted, type) linorder begin\n\ndefinition \"leq_term = (SOME leq. {(s,t). less_kbo s t} \\<subseteq> leq \\<and> Well_order leq \\<and> Field leq = UNIV)\"\n\nlemma less_trm_extension: \"{(s,t). less_kbo s t} \\<subseteq> leq_term\"\n  unfolding leq_term_def\n  by (rule someI2_ex[OF total_well_order_extension[OF wfP_less_kbo[unfolded wfP_def]]]) auto\n\nlemma less_trm_well_order: \"well_order leq_term\"\n  unfolding leq_term_def\n  by (rule someI2_ex[OF total_well_order_extension[OF wfP_less_kbo[unfolded wfP_def]]]) auto\n\ndefinition less_eq_term :: \"('a :: weighted, 'b) term \\<Rightarrow> _ \\<Rightarrow> bool\" where\n  \"less_eq_term = in_rel leq_term\"\ndefinition less_term :: \"('a :: weighted, 'b) term \\<Rightarrow> _ \\<Rightarrow> bool\" where\n  \"less_term s t = strict (\\<le>) s t\"\n\nlemma leq_term_minus_Id: \"leq_term - Id = {(x,y). x < y}\"\n  using less_trm_well_order\n  unfolding well_order_on_def linear_order_on_def partial_order_on_def antisym_def less_term_def less_eq_term_def\n  by auto\n\nlemma less_term_alt: \"(<) = in_rel (leq_term - Id)\"\n  by (simp add: in_rel_Collect_case_prod_eq leq_term_minus_Id)\n\ninstance\nproof (standard, goal_cases less_less_eq refl trans antisym total)\n  case (less_less_eq x y)\n  then show ?case unfolding less_term_def ..\nnext\ncase (refl x)\n  then show ?case using less_trm_well_order\n    unfolding well_order_on_def linear_order_on_def partial_order_on_def preorder_on_def refl_on_def\n      less_eq_term_def by auto\nnext\ncase (trans x y z)\n  then show ?case using less_trm_well_order\n    unfolding well_order_on_def linear_order_on_def partial_order_on_def preorder_on_def trans_def\n      less_eq_term_def by auto\nnext\n  case (antisym x y)\n  then show ?case using less_trm_well_order\n    unfolding well_order_on_def linear_order_on_def partial_order_on_def antisym_def\n      less_eq_term_def by auto\nnext\n  case (total x y)\n  then show ?case using less_trm_well_order\n    unfolding well_order_on_def linear_order_on_def partial_order_on_def preorder_on_def refl_on_def\n      Relation.total_on_def less_eq_term_def by (cases \"x = y\") auto\nqed\n\nend\n\ninstantiation \"term\" :: (weighted, type) wellorder begin\ninstance\n  using less_trm_well_order[unfolded well_order_on_def wf_def leq_term_minus_Id, THEN conjunct2]\n  by intro_classes (atomize, auto)\nend\n\nlemma ground_less_less_kbo: \"ground s \\<Longrightarrow> ground t \\<Longrightarrow> s < t \\<Longrightarrow> less_kbo s t\"\n  using less_kbo_gtotal[of s t] less_trm_extension\n  by (auto simp: less_term_def less_eq_term_def)\n\nlemma less_kbo_less: \"less_kbo s t \\<Longrightarrow> s < t\"\n  using less_trm_extension\n  by (auto simp: less_term_alt less_kbo_def KBO.S_irrefl)\n\nlemma is_ground_atm_ground: \"is_ground_atm t \\<longleftrightarrow> ground t\"\n  unfolding is_ground_atm_def\n  by (induct t) (fastforce simp: in_set_conv_nth list_eq_iff_nth_eq)+\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Functional_Ordered_Resolution_Prover/IsaFoR_Term.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5736784074525098, "lm_q1q2_score": 0.3291069151772477}}
{"text": "(*  Title:      Example_TLS.thy\n    Author:     Andreas Viktor Hess, DTU\n    SPDX-License-Identifier: BSD-3-Clause\n*)\n\nsection \\<open>Proving Type-Flaw Resistance of the TLS Handshake Protocol\\<close>\ntheory Example_TLS\nimports \"../Typed_Model\"\nbegin\n\ndeclare [[code_timing]]\n\nsubsection \\<open>TLS example: Datatypes and functions setup\\<close>\ndatatype ex_atom = PrivKey | SymKey | PubConst | Agent | Nonce | Bot\n\ndatatype ex_fun =\n  clientHello | clientKeyExchange | clientFinished\n| serverHello | serverCert | serverHelloDone\n| finished | changeCipher | x509 | prfun | master | pmsForm\n| sign | hash | crypt | pub | concat | privkey nat\n| pubconst ex_atom nat\n\ntype_synonym ex_type = \"(ex_fun, ex_atom) term_type\"\ntype_synonym ex_var = \"ex_type \\<times> nat\"\n\ninstance ex_atom::finite\nproof\n  let ?S = \"UNIV::ex_atom set\"\n  have \"?S = {PrivKey, SymKey, PubConst, Agent, Nonce, Bot}\" by (auto intro: ex_atom.exhaust)\n  thus \"finite ?S\" by (metis finite.emptyI finite.insertI) \nqed\n\ntype_synonym ex_term = \"(ex_fun, ex_var) term\"\ntype_synonym ex_terms = \"(ex_fun, ex_var) terms\"\n\nprimrec arity::\"ex_fun \\<Rightarrow> nat\" where\n  \"arity changeCipher = 0\"\n| \"arity clientFinished = 4\"\n| \"arity clientHello = 5\"\n| \"arity clientKeyExchange = 1\"\n| \"arity concat = 5\"\n| \"arity crypt = 2\"\n| \"arity finished = 1\"\n| \"arity hash = 1\"\n| \"arity master = 3\"\n| \"arity pmsForm = 1\"\n| \"arity prfun = 1\"\n| \"arity (privkey _) = 0\"\n| \"arity pub = 1\"\n| \"arity (pubconst _ _) = 0\"\n| \"arity serverCert = 1\"\n| \"arity serverHello = 5\"\n| \"arity serverHelloDone = 0\"\n| \"arity sign = 2\"\n| \"arity x509 = 2\"\n\nfun public::\"ex_fun \\<Rightarrow> bool\" where\n  \"public (privkey _) = False\"\n| \"public _ = True\"\n\nfun Ana\\<^sub>c\\<^sub>r\\<^sub>y\\<^sub>p\\<^sub>t::\"ex_term list \\<Rightarrow> (ex_term list \\<times> ex_term list)\" where\n  \"Ana\\<^sub>c\\<^sub>r\\<^sub>y\\<^sub>p\\<^sub>t [Fun pub [k],m] = ([k], [m])\"\n| \"Ana\\<^sub>c\\<^sub>r\\<^sub>y\\<^sub>p\\<^sub>t _ = ([], [])\"\n\nfun Ana\\<^sub>s\\<^sub>i\\<^sub>g\\<^sub>n::\"ex_term list \\<Rightarrow> (ex_term list \\<times> ex_term list)\" where\n  \"Ana\\<^sub>s\\<^sub>i\\<^sub>g\\<^sub>n [k,m] = ([], [m])\"\n| \"Ana\\<^sub>s\\<^sub>i\\<^sub>g\\<^sub>n _ = ([], [])\"\n\nfun Ana::\"ex_term \\<Rightarrow> (ex_term list \\<times> ex_term list)\" where\n  \"Ana (Fun crypt T) = Ana\\<^sub>c\\<^sub>r\\<^sub>y\\<^sub>p\\<^sub>t T\"\n| \"Ana (Fun finished T) = ([], T)\"\n| \"Ana (Fun master T) = ([], T)\"\n| \"Ana (Fun pmsForm T) = ([], T)\"\n| \"Ana (Fun serverCert T) = ([], T)\"\n| \"Ana (Fun serverHello T) = ([], T)\"\n| \"Ana (Fun sign T) = Ana\\<^sub>s\\<^sub>i\\<^sub>g\\<^sub>n T\"\n| \"Ana (Fun x509 T) = ([], T)\"\n| \"Ana _ = ([], [])\"\n\n\nsubsection \\<open>TLS example: Locale interpretation\\<close>\nlemma assm1:\n  \"Ana t = (K,M) \\<Longrightarrow> fv\\<^sub>s\\<^sub>e\\<^sub>t (set K) \\<subseteq> fv t\"\n  \"Ana t = (K,M) \\<Longrightarrow> (\\<And>g S'. Fun g S' \\<sqsubseteq> t \\<Longrightarrow> length S' = arity g)\n                \\<Longrightarrow> k \\<in> set K \\<Longrightarrow> Fun f T' \\<sqsubseteq> k \\<Longrightarrow> length T' = arity f\"\n  \"Ana t = (K,M) \\<Longrightarrow> K \\<noteq> [] \\<or> M \\<noteq> [] \\<Longrightarrow> Ana (t \\<cdot> \\<delta>) = (K \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<delta>, M \\<cdot>\\<^sub>l\\<^sub>i\\<^sub>s\\<^sub>t \\<delta>)\"\nby (rule Ana.cases[of \"t\"], auto elim!: Ana\\<^sub>c\\<^sub>r\\<^sub>y\\<^sub>p\\<^sub>t.elims Ana\\<^sub>s\\<^sub>i\\<^sub>g\\<^sub>n.elims)+\n\nlemma assm2: \"Ana (Fun f T) = (K, M) \\<Longrightarrow> set M \\<subseteq> set T\"\nby (rule Ana.cases[of \"Fun f T\"]) (auto elim!: Ana\\<^sub>c\\<^sub>r\\<^sub>y\\<^sub>p\\<^sub>t.elims Ana\\<^sub>s\\<^sub>i\\<^sub>g\\<^sub>n.elims)\n\nlemma assm6: \"0 < arity f \\<Longrightarrow> public f\" by (cases f) simp_all\n\nglobal_interpretation im: intruder_model arity public Ana\n  defines wf\\<^sub>t\\<^sub>r\\<^sub>m = \"im.wf\\<^sub>t\\<^sub>r\\<^sub>m\"\n    and wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s = \"im.wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s\"\nby unfold_locales (metis assm1(1), metis assm1(2), rule Ana.simps, metis assm2, metis assm1(3))\n\n\nsubsection \\<open>TLS Example: Typing function\\<close>\ndefinition \\<Gamma>\\<^sub>v::\"ex_var \\<Rightarrow> ex_type\" where\n  \"\\<Gamma>\\<^sub>v v = (if (\\<forall>t \\<in> subterms (fst v). case t of\n                (TComp f T) \\<Rightarrow> arity f > 0 \\<and> arity f = length T\n              | _ \\<Rightarrow> True)\n           then fst v else TAtom Bot)\"\n\nfun \\<Gamma>::\"ex_term \\<Rightarrow> ex_type\" where\n  \"\\<Gamma> (Var v) = \\<Gamma>\\<^sub>v v\"\n| \"\\<Gamma> (Fun (privkey _) _) = TAtom PrivKey\"\n| \"\\<Gamma> (Fun changeCipher _) = TAtom PubConst\"\n| \"\\<Gamma> (Fun serverHelloDone _) = TAtom PubConst\"\n| \"\\<Gamma> (Fun (pubconst \\<tau> _) _) = TAtom \\<tau>\"\n| \"\\<Gamma> (Fun f T) = TComp f (map \\<Gamma> T)\"\n\n\nsubsection \\<open>TLS Example: Locale interpretation (typed model)\\<close>\nlemma assm7: \"arity c = 0 \\<Longrightarrow> \\<exists>a. \\<forall>X. \\<Gamma> (Fun c X) = TAtom a\" by (cases c) simp_all\n\nlemma assm8: \"0 < arity f \\<Longrightarrow> \\<Gamma> (Fun f X) = TComp f (map \\<Gamma> X)\" by (cases f) simp_all\n\nlemma assm9: \"infinite {c. \\<Gamma> (Fun c []) = TAtom a \\<and> public c}\"\nproof -\n  let ?T = \"(range (pubconst a))::ex_fun set\"\n  have *:\n      \"\\<And>x y::nat. x \\<in> UNIV \\<Longrightarrow> y \\<in> UNIV \\<Longrightarrow> (pubconst a x = pubconst a y) = (x = y)\"\n      \"\\<And>x::nat. x \\<in> UNIV \\<Longrightarrow> pubconst a x \\<in> ?T\"\n      \"\\<And>y::ex_fun. y \\<in> ?T \\<Longrightarrow> \\<exists>x \\<in> UNIV. y = pubconst a x\"\n    by auto\n  have \"?T \\<subseteq> {c. \\<Gamma> (Fun c []) = TAtom a \\<and> public c}\" by auto\n  moreover have \"\\<exists>f::nat \\<Rightarrow> ex_fun. bij_betw f UNIV ?T\"\n    using bij_betwI'[OF *] by blast\n  hence \"infinite ?T\" by (metis nat_not_finite bij_betw_finite)\n  ultimately show ?thesis using infinite_super by blast\nqed\n\nlemma assm10:\n  assumes \"TComp f T \\<sqsubseteq> \\<Gamma> (Var x)\"\n  shows \"arity f > 0\"\nproof -\n  have *: \"TComp f T \\<sqsubseteq> \\<Gamma>\\<^sub>v x\" using assms by simp\n  hence \"\\<Gamma>\\<^sub>v x \\<noteq> TAtom Bot\" unfolding \\<Gamma>\\<^sub>v_def by force\n  hence \"\\<forall>t \\<in> subterms (fst x). case t of\n                (TComp f T) \\<Rightarrow> arity f > 0 \\<and> arity f = length T\n              | _ \\<Rightarrow> True\"\n    unfolding \\<Gamma>\\<^sub>v_def by argo\n  thus ?thesis using * unfolding \\<Gamma>\\<^sub>v_def by fastforce\nqed\n\nlemma assm11: \"im.wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<Gamma> (Var x))\"\nproof -\n  have \"im.wf\\<^sub>t\\<^sub>r\\<^sub>m (\\<Gamma>\\<^sub>v x)\" unfolding \\<Gamma>\\<^sub>v_def im.wf\\<^sub>t\\<^sub>r\\<^sub>m_def by auto \n  thus ?thesis by simp\nqed\n\nlemma assm12: \"\\<Gamma> (Var (\\<tau>, n)) = \\<Gamma> (Var (\\<tau>, m))\"\n  apply (cases \"\\<forall>t \\<in> subterms \\<tau>. case t of\n                (TComp f T) \\<Rightarrow> arity f > 0 \\<and> arity f = length T\n              | _ \\<Rightarrow> True\")\n  by (auto simp add: \\<Gamma>\\<^sub>v_def)\n\nlemma Ana_const: \"arity c = 0 \\<Longrightarrow> Ana (Fun c T) = ([],[])\"\nby (cases c) simp_all\n\nlemma Ana_keys_subterm: \"Ana t = (K,T) \\<Longrightarrow> k \\<in> set K \\<Longrightarrow> k \\<sqsubset> t\"\nproof (induct t rule: Ana.induct)\n  case (1 U)\n  then obtain m where \"U = [Fun pub [k], m]\" \"K = [k]\" \"T = [m]\"\n    by (auto elim!: Ana\\<^sub>c\\<^sub>r\\<^sub>y\\<^sub>p\\<^sub>t.elims Ana\\<^sub>s\\<^sub>i\\<^sub>g\\<^sub>n.elims)\n  thus ?case using Fun_subterm_inside_params[of k crypt U] by auto\nqed (auto elim!: Ana\\<^sub>c\\<^sub>r\\<^sub>y\\<^sub>p\\<^sub>t.elims Ana\\<^sub>s\\<^sub>i\\<^sub>g\\<^sub>n.elims)\n\nglobal_interpretation tm: typed_model' arity public Ana \\<Gamma>\n  by (unfold_locales, unfold wf\\<^sub>t\\<^sub>r\\<^sub>m_def[symmetric])\n     (metis assm7, metis assm8, metis assm10, metis assm11, metis assm12, metis Ana_const,\n      metis Ana_keys_subterm)\n\nsubsection \\<open>TLS example: Proving type-flaw resistance\\<close>\nabbreviation \\<Gamma>\\<^sub>v_clientHello where\n  \"\\<Gamma>\\<^sub>v_clientHello \\<equiv>\n    TComp clientHello [TAtom Nonce, TAtom Nonce, TAtom Nonce, TAtom Nonce, TAtom Nonce]\"\n\nabbreviation \\<Gamma>\\<^sub>v_serverHello where\n  \"\\<Gamma>\\<^sub>v_serverHello \\<equiv>\n    TComp serverHello [TAtom Nonce, TAtom Nonce, TAtom Nonce, TAtom Nonce, TAtom Nonce]\"\n\nabbreviation \\<Gamma>\\<^sub>v_pub where\n  \"\\<Gamma>\\<^sub>v_pub \\<equiv> TComp pub [TAtom PrivKey]\"\n\nabbreviation \\<Gamma>\\<^sub>v_x509 where\n  \"\\<Gamma>\\<^sub>v_x509 \\<equiv> TComp x509 [TAtom Agent, \\<Gamma>\\<^sub>v_pub]\"\n\nabbreviation \\<Gamma>\\<^sub>v_sign where\n  \"\\<Gamma>\\<^sub>v_sign \\<equiv> TComp sign [TAtom PrivKey, \\<Gamma>\\<^sub>v_x509]\"\n\nabbreviation \\<Gamma>\\<^sub>v_serverCert where\n  \"\\<Gamma>\\<^sub>v_serverCert \\<equiv> TComp serverCert [\\<Gamma>\\<^sub>v_sign]\"\n\nabbreviation \\<Gamma>\\<^sub>v_pmsForm where\n  \"\\<Gamma>\\<^sub>v_pmsForm \\<equiv> TComp pmsForm [TAtom SymKey]\"\n\nabbreviation \\<Gamma>\\<^sub>v_crypt where\n  \"\\<Gamma>\\<^sub>v_crypt \\<equiv> TComp crypt [\\<Gamma>\\<^sub>v_pub, \\<Gamma>\\<^sub>v_pmsForm]\"\n\nabbreviation \\<Gamma>\\<^sub>v_clientKeyExchange where\n  \"\\<Gamma>\\<^sub>v_clientKeyExchange \\<equiv>\n    TComp clientKeyExchange [\\<Gamma>\\<^sub>v_crypt]\"\n\nabbreviation \\<Gamma>\\<^sub>v_HSMsgs where\n  \"\\<Gamma>\\<^sub>v_HSMsgs \\<equiv> TComp concat [\n    \\<Gamma>\\<^sub>v_clientHello,\n    \\<Gamma>\\<^sub>v_serverHello,\n    \\<Gamma>\\<^sub>v_serverCert,\n    TAtom PubConst,\n    \\<Gamma>\\<^sub>v_clientKeyExchange]\"\n\n(* Variables from TLS *)\nabbreviation \"T\\<^sub>1 n \\<equiv> Var (TAtom Nonce,n)\"\nabbreviation \"T\\<^sub>2 n \\<equiv> Var (TAtom Nonce,n)\"\nabbreviation \"R\\<^sub>A n \\<equiv> Var (TAtom Nonce,n)\"\nabbreviation \"R\\<^sub>B n \\<equiv> Var (TAtom Nonce,n)\"\nabbreviation \"S n \\<equiv> Var (TAtom Nonce,n)\"\nabbreviation \"Cipher n \\<equiv> Var (TAtom Nonce,n)\"\nabbreviation \"Comp n \\<equiv> Var (TAtom Nonce,n)\"\nabbreviation \"B n \\<equiv> Var (TAtom Agent,n)\"\nabbreviation \"Pr\\<^sub>c\\<^sub>a n \\<equiv> Var (TAtom PrivKey,n)\"\nabbreviation \"PMS n \\<equiv> Var (TAtom SymKey,n)\"\nabbreviation \"P\\<^sub>B n \\<equiv> Var (TComp pub [TAtom PrivKey],n)\"\nabbreviation \"HSMsgs n \\<equiv> Var (\\<Gamma>\\<^sub>v_HSMsgs,n)\"\n\nsubsubsection \\<open>Defining the over-approximation set\\<close>\nabbreviation clientHello\\<^sub>t\\<^sub>r\\<^sub>m where\n  \"clientHello\\<^sub>t\\<^sub>r\\<^sub>m \\<equiv> Fun clientHello [T\\<^sub>1 0, R\\<^sub>A 1, S 2, Cipher 3, Comp 4]\"\n\nabbreviation serverHello\\<^sub>t\\<^sub>r\\<^sub>m where\n  \"serverHello\\<^sub>t\\<^sub>r\\<^sub>m \\<equiv> Fun serverHello [T\\<^sub>2 0, R\\<^sub>B 1, S 2, Cipher 3, Comp 4]\"\n\nabbreviation serverCert\\<^sub>t\\<^sub>r\\<^sub>m where\n  \"serverCert\\<^sub>t\\<^sub>r\\<^sub>m \\<equiv> Fun serverCert [Fun sign [Pr\\<^sub>c\\<^sub>a 0, Fun x509 [B 1, P\\<^sub>B 2]]]\"\n\nabbreviation serverHelloDone\\<^sub>t\\<^sub>r\\<^sub>m where\n  \"serverHelloDone\\<^sub>t\\<^sub>r\\<^sub>m \\<equiv> Fun serverHelloDone []\"\n\nabbreviation clientKeyExchange\\<^sub>t\\<^sub>r\\<^sub>m where\n  \"clientKeyExchange\\<^sub>t\\<^sub>r\\<^sub>m \\<equiv> Fun clientKeyExchange [Fun crypt [P\\<^sub>B 0, Fun pmsForm [PMS 1]]]\"\n\nabbreviation changeCipher\\<^sub>t\\<^sub>r\\<^sub>m where\n  \"changeCipher\\<^sub>t\\<^sub>r\\<^sub>m \\<equiv> Fun changeCipher []\"\n\nabbreviation finished\\<^sub>t\\<^sub>r\\<^sub>m where\n  \"finished\\<^sub>t\\<^sub>r\\<^sub>m \\<equiv> Fun finished [Fun prfun [\n      Fun clientFinished [\n          Fun prfun [Fun master [PMS 0, R\\<^sub>A 1, R\\<^sub>B 2]],\n          R\\<^sub>A 3, R\\<^sub>B 4, Fun hash [HSMsgs 5]\n      ]\n  ]]\"\n\ndefinition M\\<^sub>T\\<^sub>L\\<^sub>S::\"ex_term list\" where\n  \"M\\<^sub>T\\<^sub>L\\<^sub>S \\<equiv> [\n    clientHello\\<^sub>t\\<^sub>r\\<^sub>m,\n    serverHello\\<^sub>t\\<^sub>r\\<^sub>m,\n    serverCert\\<^sub>t\\<^sub>r\\<^sub>m,\n    serverHelloDone\\<^sub>t\\<^sub>r\\<^sub>m,\n    clientKeyExchange\\<^sub>t\\<^sub>r\\<^sub>m,\n    changeCipher\\<^sub>t\\<^sub>r\\<^sub>m,\n    finished\\<^sub>t\\<^sub>r\\<^sub>m\n]\"\n\n\nsubsection \\<open>Theorem: The TLS handshake protocol is type-flaw resistant\\<close>\ntheorem \"tm.tfr\\<^sub>s\\<^sub>e\\<^sub>t (set M\\<^sub>T\\<^sub>L\\<^sub>S)\"\nby (rule tm.tfr\\<^sub>s\\<^sub>e\\<^sub>t_if_comp_tfr\\<^sub>s\\<^sub>e\\<^sub>t') eval\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Stateful_Protocol_Composition_and_Typing/examples/Example_TLS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736783928749127, "lm_q2_score": 0.5736784074525098, "lm_q1q2_score": 0.32910690681439514}}
{"text": "chapter \\<open> Classical Soundness and Completeness \\label{sec:classical-propositional-calculus} \\<close>\n\ntheory Classical_Logic_Completeness\n  imports Classical_Logic\nbegin\n\ntext \\<open> The following presents soundness completeness of the classical propositional\n       calculus for propositional semantics. The classical propositional calculus\n       is sometimes referred to as the \\<^emph>\\<open>sentential calculus\\<close>.\n       We give a concrete algebraic data type for propositional\n       formulae in \\S\\ref{sec:classical-calculus-syntax}. We inductively\n       define a logical judgement \\<open>\\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p\\<close> for these formulae.\n       We also define the Tarski truth relation \\<open>\\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p\\<close> inductively,\n       which we present in \\S\\ref{sec:propositional-semantics}.\\<close>\n\ntext \\<open> The most significant results here are the \\<^emph>\\<open>embedding theorems\\<close>.\n       These theorems show that the propositional calculus\n       can be embedded in any logic extending @{class classical_logic}.\n       These theorems are proved in \\S\\ref{sec:propositional-embedding}. \\<close>\n\nsection \\<open> Syntax \\label{sec:classical-calculus-syntax} \\<close>\n\ntext \\<open> Here we provide the usual language for formulae in the propositional\n       calculus. It contains  \\<^emph>\\<open>falsum\\<close> \\<open>\\<^bold>\\<bottom>\\<close>, implication \\<open>(\\<^bold>\\<rightarrow>)\\<close>, and a way of\n       constructing \\<^emph>\\<open>atomic\\<close> propositions \\<open>\\<lambda> \\<phi> . \\<^bold>\\<langle> \\<phi> \\<^bold>\\<rangle>\\<close>. Defining the\n       language is straight-forward using an algebraic data type. \\<close>\n\ndatatype 'a classical_propositional_formula =\n      Falsum (\"\\<^bold>\\<bottom>\")\n    | Proposition 'a (\"\\<^bold>\\<langle> _ \\<^bold>\\<rangle>\" [45])\n    | Implication\n        \"'a classical_propositional_formula\"\n        \"'a classical_propositional_formula\" (infixr \"\\<^bold>\\<rightarrow>\" 70)\n\nsection \\<open> Propositional Calculus \\<close>\n\ntext \\<open> In this section we recursively define what a proof is in the classical\n       propositional calculus. We provide the familiar \\<^emph>\\<open>K\\<close> and \\<^emph>\\<open>S\\<close> axioms,\n       as well as \\<^emph>\\<open>double negation\\<close> and \\<^emph>\\<open>modus ponens\\<close>. \\<close>\n\nnamed_theorems classical_propositional_calculus\n  \"Rules for the Propositional Calculus\"\n\ninductive classical_propositional_calculus ::\n  \"'a classical_propositional_formula \\<Rightarrow> bool\" (\"\\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p _\" [60] 55)\n  where\n     axiom_k [classical_propositional_calculus]:\n       \"\\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<^bold>\\<rightarrow> \\<psi> \\<^bold>\\<rightarrow> \\<phi>\"\n   | axiom_s [classical_propositional_calculus]:\n       \"\\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p (\\<phi> \\<^bold>\\<rightarrow> \\<psi> \\<^bold>\\<rightarrow> \\<chi>) \\<^bold>\\<rightarrow> (\\<phi> \\<^bold>\\<rightarrow> \\<psi>) \\<^bold>\\<rightarrow> \\<phi> \\<^bold>\\<rightarrow> \\<chi>\"\n   | double_negation [classical_propositional_calculus]:\n       \"\\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p ((\\<phi> \\<^bold>\\<rightarrow> \\<^bold>\\<bottom>) \\<^bold>\\<rightarrow> \\<^bold>\\<bottom>) \\<^bold>\\<rightarrow> \\<phi>\"\n   | modus_ponens [classical_propositional_calculus]:\n        \"\\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<^bold>\\<rightarrow> \\<psi> \\<Longrightarrow> \\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<Longrightarrow> \\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<psi>\"\n\ntext \\<open> Our proof system for our propositional calculus is trivially\n       an instance of @{class classical_logic}. The introduction rules\n       for \\<open>\\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p\\<close> naturally reflect the axioms of the classical logic\n       axiom class. \\<close>\n\ninstantiation classical_propositional_formula\n  :: (type) classical_logic\nbegin\ndefinition [simp]: \"\\<bottom> = \\<^bold>\\<bottom>\"\ndefinition [simp]: \"\\<turnstile> \\<phi> = \\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\ndefinition [simp]: \"\\<phi> \\<rightarrow> \\<psi> = \\<phi> \\<^bold>\\<rightarrow> \\<psi>\"\ninstance by standard (simp add: classical_propositional_calculus)+\nend\n\nsection \\<open> Propositional Semantics \\label{sec:propositional-semantics} \\<close>\n\ntext \\<open> Below we give the typical definition of the Tarski truth relation\n       \\<open> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p\\<close>. \\<close>\n\nprimrec classical_propositional_semantics ::\n  \"'a set \\<Rightarrow> 'a classical_propositional_formula \\<Rightarrow> bool\"\n  (infix \"\\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p\" 65)\n  where\n       \"\\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<^bold>\\<langle> p \\<^bold>\\<rangle> = (p \\<in> \\<MM>)\"\n    |  \"\\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<^bold>\\<rightarrow> \\<psi> = (\\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<longrightarrow> \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<psi>)\"\n    |  \"\\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<^bold>\\<bottom> = False\"\n\ntext \\<open> Soundness of our calculus for these semantics is trivial. \\<close>\n\ntheorem classical_propositional_calculus_soundness:\n  \"\\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<Longrightarrow> \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n  by (induct rule: classical_propositional_calculus.induct, simp+)\n\nsection \\<open> Soundness and Completeness Proofs \\label{sec:classical-logic-completeness}\\<close>\n\ndefinition strong_classical_propositional_deduction ::\n  \"'a classical_propositional_formula set\n    \\<Rightarrow> 'a classical_propositional_formula \\<Rightarrow> bool\"\n  (infix \"\\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p\" 65)\n  where\n    [simp]: \"\\<Gamma> \\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<equiv> \\<Gamma> \\<tturnstile> \\<phi>\"\n\ndefinition strong_classical_propositional_tarski_truth ::\n  \"'a classical_propositional_formula set\n    \\<Rightarrow> 'a classical_propositional_formula \\<Rightarrow> bool\"\n  (infix \"\\<TTurnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p\" 65)\n  where\n    [simp]: \"\\<Gamma> \\<TTurnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<equiv> \\<forall> \\<MM>.(\\<forall> \\<gamma> \\<in> \\<Gamma>. \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<gamma>) \\<longrightarrow> \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n\ndefinition theory_propositions ::\n  \"'a classical_propositional_formula set \\<Rightarrow> 'a set\" (\"\\<^bold>\\<lbrace> _ \\<^bold>\\<rbrace>\" [50])\n  where\n    [simp]: \"\\<^bold>\\<lbrace> \\<Gamma> \\<^bold>\\<rbrace> = {p . \\<Gamma> \\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<^bold>\\<langle> p \\<^bold>\\<rangle>}\"\n\ntext \\<open> Below we give the main lemma for completeness: the \\<^emph>\\<open>truth lemma\\<close>.\n       This proof connects the maximally consistent sets developed in \\S\\ref{sec:implicational-maximally-consistent-sets}\n       and \\S\\ref{sec:mcs} with the semantics given in\n       \\S\\ref{sec:propositional-semantics}. \\<close>\n\ntext \\<open> All together, the technique we are using essentially follows the\n       approach by Blackburn et al. @{cite \\<open>\\S 4.2, pgs. 196-201\\<close> blackburnSectionCanonicalModels2001}. \\<close>\n\nlemma truth_lemma:\n  assumes \"MCS \\<Gamma>\"\n  shows \"\\<Gamma> \\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<equiv> \\<^bold>\\<lbrace> \\<Gamma> \\<^bold>\\<rbrace> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\nproof (induct \\<phi>)\n  case Falsum\n  then show ?case using assms by auto\nnext\n  case (Proposition x)\n  then show ?case by simp\nnext\n  case (Implication \\<psi> \\<chi>)\n  thus ?case\n    unfolding strong_classical_propositional_deduction_def\n    by (metis\n          assms\n          maximally_consistent_set_def\n          formula_maximally_consistent_set_def_implication\n          classical_propositional_semantics.simps(2)\n          implication_classical_propositional_formula_def\n          set_deduction_modus_ponens\n          set_deduction_reflection)\nqed\n\ntext \\<open> Here the truth lemma above is combined with @{thm formula_maximally_consistent_extension [no_vars]}\n proven in \\S\\ref{sec:propositional-semantics}.  These theorems together\n  give rise to strong completeness for the propositional calculus. \\<close>\n\ntheorem classical_propositional_calculus_strong_soundness_and_completeness:\n  \"\\<Gamma> \\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> = \\<Gamma> \\<TTurnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\nproof -\n  have soundness: \"\\<Gamma> \\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<Longrightarrow> \\<Gamma> \\<TTurnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n  proof -\n    assume \"\\<Gamma> \\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n    from this obtain \\<Gamma>' where \\<Gamma>': \"set \\<Gamma>' \\<subseteq> \\<Gamma>\" \"\\<Gamma>' :\\<turnstile> \\<phi>\"\n    by (simp add: set_deduction_def, blast)\n    {\n      fix \\<MM>\n      assume \"\\<forall> \\<gamma> \\<in> \\<Gamma>. \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<gamma>\"\n      hence \"\\<forall> \\<gamma> \\<in> set \\<Gamma>'. \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<gamma>\" using \\<Gamma>'(1) by auto\n      hence \"\\<forall> \\<phi>. \\<Gamma>' :\\<turnstile> \\<phi> \\<longrightarrow> \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n      proof (induct \\<Gamma>')\n        case Nil\n        then show ?case\n          by (simp add:\n                classical_propositional_calculus_soundness\n                list_deduction_def)\n      next\n        case (Cons \\<psi> \\<Gamma>')\n        thus ?case using list_deduction_theorem by fastforce\n      qed\n      with \\<Gamma>'(2) have \"\\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\" by blast\n    }\n    thus \"\\<Gamma> \\<TTurnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n      using strong_classical_propositional_tarski_truth_def by blast\n  qed\n  have completeness: \"\\<Gamma> \\<TTurnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<Longrightarrow> \\<Gamma> \\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n  proof (erule contrapos_pp)\n    assume \"\\<not> \\<Gamma> \\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n    hence \"\\<exists> \\<MM>. (\\<forall> \\<gamma> \\<in> \\<Gamma>. \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<gamma>) \\<and> \\<not> \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n    proof -\n      from \\<open>\\<not> \\<Gamma> \\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\\<close> obtain \\<Omega> where \\<Omega>: \"\\<Gamma> \\<subseteq> \\<Omega>\" \"\\<phi>-MCS \\<Omega>\"\n        by (meson\n              formula_consistent_def\n              formula_maximally_consistent_extension\n              strong_classical_propositional_deduction_def)\n      hence \"(\\<phi> \\<rightarrow> \\<bottom>) \\<in> \\<Omega>\"\n        using formula_maximally_consistent_set_def_negation by blast\n      hence \"\\<not> \\<^bold>\\<lbrace> \\<Omega> \\<^bold>\\<rbrace> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n        using \\<Omega>\n              formula_consistent_def\n              formula_maximal_consistency\n              formula_maximally_consistent_set_def_def\n              truth_lemma\n        unfolding strong_classical_propositional_deduction_def\n        by blast\n      moreover have \"\\<forall> \\<gamma> \\<in> \\<Gamma>. \\<^bold>\\<lbrace> \\<Omega> \\<^bold>\\<rbrace> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<gamma>\"\n        using\n          formula_maximal_consistency\n          truth_lemma\n          \\<Omega>\n          set_deduction_reflection\n        unfolding strong_classical_propositional_deduction_def\n        by blast\n      ultimately show ?thesis by auto\n    qed\n    thus \"\\<not> \\<Gamma> \\<TTurnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n      unfolding strong_classical_propositional_tarski_truth_def\n      by simp\n  qed\n  from soundness completeness show \"\\<Gamma> \\<tturnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> = \\<Gamma> \\<TTurnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>\"\n    by linarith\nqed\n\ntext \\<open> For our applications in \\S{sec:propositional-embedding},\n       we will only need a weaker form of soundness and completeness\n       rather than the stronger form proved above.\\<close>\n\ntheorem classical_propositional_calculus_soundness_and_completeness:\n  \"\\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> = (\\<forall>\\<MM>. \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi>)\"\n  using classical_propositional_calculus_soundness [where \\<phi>=\"\\<phi>\"]\n        classical_propositional_calculus_strong_soundness_and_completeness\n            [where \\<phi>=\"\\<phi>\" and \\<Gamma>=\"{}\"]\n        strong_classical_propositional_deduction_def\n            [where \\<phi>=\"\\<phi>\" and \\<Gamma>=\"{}\"]\n        strong_classical_propositional_tarski_truth_def\n            [where \\<phi>=\"\\<phi>\" and \\<Gamma>=\"{}\"]\n        deduction_classical_propositional_formula_def [where \\<phi>=\"\\<phi>\"]\n        set_deduction_base_theory [where \\<phi>=\"\\<phi>\"]\n  by metis\n\ninstantiation classical_propositional_formula\n  :: (type) consistent_classical_logic\nbegin\ninstance by standard\n  (simp add: classical_propositional_calculus_soundness_and_completeness)\nend\n\nsection \\<open> Embedding Theorem For the Propositional Calculus \\label{sec:propositional-embedding} \\<close>\n\ntext \\<open> A recurring technique to prove theorems in logic moving forward is\n       \\<^emph>\\<open>embed\\<close> our theorem into the classical propositional calculus. \\<close>\n\ntext \\<open> Using our embedding, we can leverage completeness to turn our\n       problem into semantics and dispatch to Isabelle/HOL's classical\n       theorem provers.\\<close>\n\ntext \\<open> In future work we may make a tactic for this, but for now we just\n       manually leverage the technique throughout our subsequent proofs. \\<close>\n\nprimrec (in classical_logic)\n   classical_propositional_formula_embedding\n   :: \"'a classical_propositional_formula \\<Rightarrow> 'a\" (\"\\<^bold>\\<lparr> _ \\<^bold>\\<rparr>\" [50]) where\n     \"\\<^bold>\\<lparr> \\<^bold>\\<langle> p \\<^bold>\\<rangle> \\<^bold>\\<rparr> = p\"\n   | \"\\<^bold>\\<lparr> \\<phi> \\<^bold>\\<rightarrow> \\<psi> \\<^bold>\\<rparr> = \\<^bold>\\<lparr> \\<phi> \\<^bold>\\<rparr> \\<rightarrow> \\<^bold>\\<lparr> \\<psi> \\<^bold>\\<rparr>\"\n   | \"\\<^bold>\\<lparr> \\<^bold>\\<bottom> \\<^bold>\\<rparr> = \\<bottom>\"\n\ntheorem (in classical_logic) propositional_calculus:\n  \"\\<turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<Longrightarrow> \\<turnstile> \\<^bold>\\<lparr> \\<phi> \\<^bold>\\<rparr>\"\n  by (induct rule: classical_propositional_calculus.induct,\n      (simp add: axiom_k axiom_s double_negation modus_ponens)+)\n\ntext \\<open> The following theorem in particular shows that it suffices to\n       prove theorems using classical semantics to prove theorems about\n       the logic under investigation. \\<close>\n\ntheorem (in classical_logic) propositional_semantics:\n  \"\\<forall>\\<MM>. \\<MM> \\<Turnstile>\\<^sub>p\\<^sub>r\\<^sub>o\\<^sub>p \\<phi> \\<Longrightarrow> \\<turnstile> \\<^bold>\\<lparr> \\<phi> \\<^bold>\\<rparr>\"\n  by (simp add:\n        classical_propositional_calculus_soundness_and_completeness\n        propositional_calculus)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Propositional_Logic_Class/Classical_Logic_Completeness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953797290152, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3290872733180048}}
{"text": "theory Lib\n  imports \"Timed_Automata.Timed_Automata\"\n          \"Timed_Automata.Approx_Beta\"\n          \"MDP_Aux\"\n          \"Finiteness\"\n          \"Sequence_LTL\"\n          \"Instantiate_Existentials\"\n          \"Graphs\"\nbegin\n\nsection \\<open>Misc\\<close>\n\nlemma measurable_pred_stream[measurable]:\n  fixes P shows \"Measurable.pred (stream_space (count_space UNIV)) (pred_stream P)\"\nproof -\n  have [measurable]: \"Measurable.pred (count_space UNIV) P\"\n    by measurable\n  then show ?thesis\n    unfolding stream.pred_set sset_range by simp\nqed\n\nlemma pmf_map_pmf_cong:\n  fixes f g and \\<mu> :: \"'a pmf\"\n  assumes \"\\<And> x. x \\<in> \\<mu> \\<Longrightarrow> f x = y1 \\<longleftrightarrow> g x = y2\"\n  shows \"pmf (map_pmf f \\<mu>) y1 = pmf (map_pmf g \\<mu>) y2\"\n  unfolding pmf_map\n  by (rule measure_pmf.finite_measure_eq_AE;\n      simp add: AE_measure_pmf_iff assms split: split_indicator\n     )\n\nlemma collect_pair_finite[intro]:\n  notes finite_subset[intro]\n  assumes \"finite {x. P x}\" \"finite {x. Q x}\"\n  shows \"finite {(x, y) . P x \\<and> Q y \\<and> R x y}\"\nusing assms\nproof -\n  from assms have \"finite {(x, y) . P x \\<and> Q y}\" by auto\n  moreover have \"{(x, y) . P x \\<and> (Q y \\<and> R x y)} \\<subseteq> {(x, y) . P x \\<and> Q y}\" by auto\n  ultimately show ?thesis by blast\nqed\n\nlemma collect_pair_finite'[intro]:\n  notes finite_subset[intro]\n  assumes \"finite {(x, y). P x y}\"\n  shows \"finite {(x, y) . P x y \\<and> R x y}\"\nusing assms\nproof -\n  from assms have \"finite {(x, y) . P x y}\" by auto\n  moreover have \"{(x, y) . P x y \\<and> R x y} \\<subseteq> {(x, y) . P x y}\" by auto\n  ultimately show ?thesis by blast\nqed\n\ntext \\<open>This is what we actually need in this theory\\<close>\nlemma collect_pair_finite''[intro]:\n  notes finite_subset[intro]\n  assumes \"finite {(x, y). P x \\<and> Q y}\"\n  shows \"finite {(x, y) . P x \\<and> Q y \\<and> R x y}\"\nusing assms\nproof -\n  from assms have \"finite {(x, y) . P x \\<and> Q y}\" by auto\n  moreover have \"{(x, y) . P x \\<and> Q y \\<and> R x y} \\<subseteq> {(x, y) . P x \\<and> Q y}\" by auto\n  ultimately show ?thesis by blast\nqed\n\nlemma finite_imageI'[intro]:\n  assumes \"finite {(x, y). P x y}\"\n  shows \"finite {f x y | x y. P x y}\"\nproof -\n  from assms have \"finite ((\\<lambda> (x, y). f x y) ` {(x, y). P x y})\" by auto\n  moreover have \"((\\<lambda> (x, y). f x y) ` {(x, y). P x y}) = {f x y | x y. P x y}\" by auto\n  ultimately show ?thesis by auto\nqed\n\nlemma finite_imageI''[intro]:\n  assumes \"finite (A \\<times> B)\"\n  shows \"finite {f x y | x y. x \\<in> A \\<and> y \\<in> B \\<and> R x y}\"\nproof -\n  from assms have \"finite {f x y | x y. x \\<in> A \\<and> y \\<in> B}\" by auto\n  moreover have \"{f x y | x y. x \\<in> A \\<and> y \\<in> B \\<and> R x y} \\<subseteq> {f x y | x y. x \\<in> A \\<and> y \\<in> B}\" by auto\n  ultimately show ?thesis by (blast intro: finite_subset)\nqed\n\n(* TODO: Move/should be somewhere already *)\nlemma pred_stream_stl: \"pred_stream \\<phi> xs \\<longrightarrow> pred_stream \\<phi> (stl xs)\"\n  by (cases xs) auto\n\n(* TODO: Should be somewhere already *)\nlemma stream_all_pred_stream:\n  \"stream_all = pred_stream\"\n  by (intro ext) (simp add: stream.pred_set)\n\nlemma pred_stream_iff: \"pred_stream P s \\<longleftrightarrow> Ball (sset s) P\"\n  using stream_all_iff[unfolded stream_all_pred_stream] .\n\n(* TODO: Move *)\nlemma measure_pmf_eq_1_iff:\n  \"emeasure (measure_pmf \\<mu>) {x} = 1 \\<longleftrightarrow> \\<mu> = return_pmf x\"\n  using measure_pmf.prob_eq_1[of \"{x}\" \\<mu>] set_pmf_subset_singleton[of \\<mu> x]\n  by (auto simp: measure_pmf.emeasure_eq_measure AE_measure_pmf_iff)\n\nlemma HLD_mono:\n  \"HLD S \\<omega>\" if \"HLD R \\<omega>\" \"R \\<subseteq> S\"\n  using that unfolding HLD_iff by auto\n\nlemma alw_HLD_smap:\n  \"alw (HLD (f ` S)) (smap f \\<omega>)\" if \"alw (HLD S) \\<omega>\"\n  using that by (auto 4 3 elim: HLD_mono alw_mono)\n\nlemma alw_disjoint_ccontr:\n  assumes \"alw (HLD S) \\<omega>\" \"ev (alw (HLD R)) \\<omega>\" \"R \\<inter> S = {}\"\n  shows False\nproof -\n  from assms(1,2) obtain \\<omega> where \"alw (HLD S) \\<omega>\" \"alw (HLD R) \\<omega>\"\n    by (auto intro: alw_sdrop sdrop_wait)\n  with \\<open>R \\<inter> S = {}\\<close> show False\n    by (auto 4 3 simp: HLD_iff dest: alwD)\nqed\n\n(* TODO: Move *)\nlemma stream_all2_refl: \"stream_all2 P x x = pred_stream (\\<lambda> x. P x x) x\"\n  by (simp add: stream.pred_rel eq_onp_def) (standard; coinduction arbitrary: x; auto)\n\nlemma AE_all_imp_countable:\n  assumes \"countable {x. Q x}\"\n  shows \"(AE x in M. \\<forall>y. Q y \\<longrightarrow> P x y) = (\\<forall>y. Q y \\<longrightarrow> (AE x in M. P x y))\"\n  using assms by (auto dest: AE_ball_countable)\n\nlemma AE_conj:\n  \"almost_everywhere M P = almost_everywhere M (\\<lambda> x. P x \\<and> Q x)\" if \"almost_everywhere M Q\"\n  by (auto intro: AE_mp[OF that])\n\n(* TODO: move *)\nlemma list_hd_lastD:\n  assumes \"length xs > 1\"\n  obtains x y ys where \"xs = x # ys @ [y]\"\n  using assms by atomize_elim (cases xs; simp; metis rev_exhaust)\n\n(* TODO: Move *)\nlemma SUP_eq_and_INF_eq:\n  assumes \"\\<And>i. i \\<in> A \\<Longrightarrow> \\<exists>j\\<in>B. f i = g j\"\n      and \"\\<And>j. j \\<in> B \\<Longrightarrow> \\<exists>i\\<in>A. g j = f i\"\n    shows \"\\<Squnion>((f :: _ \\<Rightarrow> _ :: complete_lattice) ` A) = \\<Squnion>(g ` B) \\<and> \\<Sqinter>(f ` A) = \\<Sqinter>(g ` B)\"\n  by (auto 4 3 intro!: INF_eq SUP_eq dest: assms)\n\n(* TODO: Move *)\nlemma measurable_alw_stream[measurable]:\n  fixes P assumes [measurable]: \"Measurable.pred (stream_space (count_space UNIV)) P\"\n  shows \"Measurable.pred (stream_space (count_space UNIV)) (alw P)\"\n  unfolding alw_iff_sdrop by measurable\n\n(* TODO: Move *)\nlemma ev_neq_start_implies_ev_neq:\n  assumes \"ev (Not o HLD {y}) (y ## xs)\"\n  shows \"ev (\\<lambda> xs. shd xs \\<noteq> shd (stl xs)) (y ## xs)\"\n  using assms\n  apply (induction \"y ## xs\" arbitrary: xs rule: ev.induct)\n   apply (simp; fail)\n  subgoal for xs\n    apply (cases \"shd xs = y\")\n    subgoal\n      apply safe\n      apply (rule ev.step)\n      apply simp\n      using stream.collapse[of xs, symmetric]\n      by blast\n    subgoal\n      by auto\n    done\n  done\n\n(* TODO: Move *)\n\n\n(* TODO: Move *)\nlemma pred_stream_sconst:\n  \"pred_stream ((=) x) (sconst x)\"\n  by coinduction simp\n\n(* TODO: Move *)\nlemma alw_Stream: \"alw P (x ## s) \\<longleftrightarrow> P (x ## s) \\<and> alw P s\"\n  by (subst alw.simps) simp\n\n(* TODO: Move *)\nlemma alw_True: \"alw (\\<lambda>x. True) \\<omega>\"\n  by (auto intro: all_imp_alw)\n\n(* TODO: Move *)\nlemma alw_conjI:\n  \"alw (P aand Q) xs\" if \"alw P xs\" \"alw Q xs\"\n  using that by (simp add: alw_aand)\n\n(* TODO: Move *)\nlemma alw_ev_cong:\n  \"alw (ev S) xs = alw (ev R) xs\" if \"alw P xs\" \"\\<And> x. P x \\<Longrightarrow> S x \\<longleftrightarrow> R x\"\n  by (rule alw_cong[where P = \"alw P\"]) (auto simp: HLD_iff that elim!: ev_cong)\n\nlemma alw_ev_HLD_cong:\n  \"alw (ev (HLD S)) xs = alw (ev (HLD R)) xs\" if \"alw (HLD P) xs\" \"\\<And> x. x \\<in> P \\<Longrightarrow> x \\<in> S \\<longleftrightarrow> x \\<in> R\"\n  by (rule alw_ev_cong, rule that; simp add: HLD_iff that)\n\n(* TODO: Move *)\nlemma measurable_eq_stream_space[measurable (raw)]:\n  assumes [measurable]: \"f \\<in> M \\<rightarrow>\\<^sub>M stream_space (count_space UNIV)\"\n  shows \"Measurable.pred M (\\<lambda>x. f x = c)\"\nproof -\n  have *: \"(\\<lambda>x. f x = c) = (\\<lambda>x. \\<forall>i. f x !! i = c !! i)\"\n    by (auto intro: eqI_snth simp: fun_eq_iff)\n  show ?thesis\n    unfolding * by measurable\nqed\n\n(* TODO: rename, and change to LTL constants i.e. HLD, aand, nxt etc. *)\nlemma prop_nth_sdrop:\n  assumes \"\\<forall> i\\<ge>j. P (\\<omega> !! i)\"\n  shows \"\\<forall> i. P (sdrop j \\<omega> !! i)\"\nusing assms by (induction j arbitrary: \\<omega>) fastforce+\n\nlemma prop_nth_sdrop_pair:\n  assumes \"\\<forall> i. P (\\<omega> !! i) (\\<omega>' !! i)\"\n  shows \"\\<forall> i. P (sdrop j \\<omega> !! i) (sdrop j \\<omega>' !! i)\"\n  using assms by (induction j arbitrary: \\<omega> \\<omega>') (auto, metis snth.simps(2))\n\nlemma prop_nth_stl:\n  \"\\<forall> i. P (xs !! i) \\<Longrightarrow> \\<forall> i. P (stl xs !! i)\"\n  by (metis snth.simps(2))\n\ncontext Graph_Defs\nbegin\n\nlemma steps_SCons_iff:\n  \"steps (x # y # xs) \\<longleftrightarrow> E x y \\<and> steps (y # xs)\"\n  by (auto elim: steps.cases)\n\nlemma steps_Single_True:\n  \"steps [x] = True\"\n  by auto\n\nlemma add_step_iff:\n  \"(\\<forall> xs y. steps (x # xs @ [y]) \\<and> length xs = Suc n \\<longrightarrow> P xs y)\n  \\<longleftrightarrow> (\\<forall> z xs y. steps (x # z # xs @ [y]) \\<and> length xs = n \\<longrightarrow> P (z # xs) y)\"\n  apply safe\n   apply fastforce\n  subgoal for xs y\n    by (cases xs) auto\n  done\n\nlemma compower_stepsD:\n  assumes \"(E ^^ n) s s'\"\n  obtains xs where \"steps xs\" \"hd xs = s\" \"last xs = s'\" \"length xs = n + 1\"\n  using assms\n  apply atomize_elim\nproof (induction n arbitrary: s')\n  case 0\n  then show ?case\n    by auto\nnext\n  case (Suc n)\n  from Suc.prems show ?case\n    by (auto 4 4 intro: steps_append_single dest: Suc.IH)\nqed\n\nlemma compower_stepsD':\n  assumes \"(E ^^ n) s s'\" \"n > 0\"\n  obtains xs where \"steps (s # xs @ [s'])\" \"length xs + 1 = n\"\n  apply (rule compower_stepsD[OF assms(1)])\n  subgoal for xs\n    by (auto simp: \\<open>n > 0\\<close> intro: list_hd_lastD[of xs])\n  done\n\nend\n\ncontext MC_syntax\nbegin\n\ntheorem AE_T_iff_n:\n  fixes P :: \"'s stream \\<Rightarrow> bool\" \n    and x :: \"'s\" \n  assumes \"Measurable.pred (stream_space (count_space UNIV)) P\" \"n > 0\"\n  shows \"almost_everywhere (T x) P =\n    (\\<forall>xs y. Graph_Defs.steps (\\<lambda> a b. b \\<in> K a) (x # xs @ [y]) \\<and> length xs + 1 = n\n      \\<longrightarrow> (AE \\<omega> in T y. P (xs @- y ## \\<omega>)))\"\n  using assms\n  apply (induction n arbitrary: x P)\n   apply (simp; fail)\n  subgoal for n x P\n    apply (cases n)\n    subgoal\n      by (subst AE_T_iff) (auto simp: Graph_Defs.steps_SCons_iff Graph_Defs.steps_Single_True)\n    subgoal premises prems for n'\n    proof -\n      have *: \"Measurable.pred (stream_space (count_space UNIV)) (\\<lambda> \\<omega>. P (y ## \\<omega>))\" for y\n        using prems(2) by measurable\n      with prems(1)[OF *] prems(3-) show ?thesis\n        by (auto simp: AE_T_iff[OF prems(2)] Graph_Defs.steps_SCons_iff Graph_Defs.add_step_iff)\n    qed\n    done\n  done\n\nlemma AE_alw_accD:\n  fixes P assumes P: \"Measurable.pred (stream_space (count_space UNIV)) P\"\n  assumes *: \"almost_everywhere (T s) (alw P)\" \"(s, s') \\<in> acc\"\n  shows \"almost_everywhere (T s') (alw P)\"\n  using *(2,1)\nproof induction\n  case (step y z)\n  then have \"almost_everywhere (T y) (alw P)\" \"z \\<in> K y\" by auto\n  then have \"AE \\<omega> in T z. alw P (z ## \\<omega>)\"\n    unfolding AE_T_iff[OF measurable_alw_stream[OF P], of y] by auto\n  then show ?case\n    by eventually_elim auto\nqed \n\nlemma acc_relfunD:\n  assumes \"(s, s') \\<in> acc\"\n  obtains n where \"((\\<lambda> a b. b \\<in> K a) ^^ n) s s'\"\n  using assms\n  apply atomize_elim\n  apply (drule rtrancl_imp_relpow)\n  apply (erule exE)\n  subgoal for n\n    by (inst_existentials n) (induction n arbitrary: s'; auto)\n  done\n\n(* TODO: If we can show measurable_alw_stream, then this subsumed by the lemma above *)\nlemma AE_all_accD:\n  assumes \"almost_everywhere (T s) (pred_stream P)\" \"(s, s') \\<in> acc\"\n  shows \"almost_everywhere (T s') (pred_stream P)\"\nproof -\n  from acc_relfunD[OF \\<open>_ \\<in> acc\\<close>] obtain n where *: \"((\\<lambda> a b. b \\<in> K a) ^^ n) s s'\" .\n  show ?thesis\n  proof (cases \"n = 0\")\n    case True\n    with * assms(1) show ?thesis\n      by auto\n  next\n    case False\n    then have \"n > 0\"\n      by simp\n    with * obtain xs where\n      \"Graph_Defs.steps (\\<lambda>a b. b \\<in> set_pmf (K a)) (s # xs @ [s'])\" \"Suc (length xs) = n\"\n      by (auto elim: Graph_Defs.compower_stepsD')\n    with assms(1)[unfolded AE_T_iff_n[OF measurable_pred_stream \\<open>n > 0\\<close>, of P s]] show ?thesis\n      by auto\n  qed\nqed\n\nlemma AE_T_ev_HLD_infinite_strong':\n  assumes \"0 \\<le> r\" \"r < 1\"\n    and r: \"\\<And>x. x \\<in> X \\<inter> Y \\<Longrightarrow> measure_pmf.prob (K x) Y \\<le> r\"\n    and ae: \"AE \\<omega> in T x. alw (\\<lambda> \\<omega>. HLD Y \\<omega> \\<longrightarrow> ev (HLD X) \\<omega>) \\<omega>\"\n  shows \"AE \\<omega> in T x. ev (HLD (- Y)) \\<omega>\"\nproof -\n  define run where \"run F = (HLD (Y - X)) suntil ((X \\<inter> Y) \\<cdot> Y \\<cdot> F)\" for F\n\n  have le_gfp: \"alw (HLD Y) aand alw (\\<lambda> \\<omega>. HLD Y \\<omega> \\<longrightarrow> ev (HLD X) \\<omega>) \\<le> gfp run\"\n  proof (rule gfp_upperbound; clarsimp)\n    fix \\<omega> assume \"alw (HLD Y) \\<omega>\" \"alw (\\<lambda>\\<omega>. HLD Y \\<omega> \\<longrightarrow> ev (HLD X) \\<omega>) \\<omega>\"\n    then have \"ev (HLD X) \\<omega>\" \"alw (HLD Y) \\<omega>\" \"alw (\\<lambda>\\<omega>. HLD Y \\<omega> \\<longrightarrow> ev (HLD X) \\<omega>) \\<omega>\"\n      by auto\n    then show \"run (\\<lambda>xs. alw (HLD Y) xs \\<and> alw (\\<lambda>\\<omega>. HLD Y \\<omega> \\<longrightarrow> ev (HLD X) \\<omega>) xs) \\<omega>\"\n    proof (induction \\<omega> rule: ev_induct_strong)\n      case (base \\<omega>) then show ?case by (cases \\<omega>) (auto intro!: suntil.base simp: alw_Stream run_def)\n    next\n      case (step \\<omega>)\n      show ?case\n        unfolding run_def\n        using \\<open>\\<not> HLD X \\<omega>\\<close> \\<open>alw (HLD Y) \\<omega>\\<close> step(3)[unfolded run_def] step(4,5)\n        by (auto 0 4 simp: HLD_def intro: suntil.step)\n    qed\n  qed\n\n  have cont_run: \"inf_continuous run\"\n    apply (auto simp: inf_continuous_def fun_eq_iff run_def)\n    subgoal premises that for M x f\n      by (rule suntil_mono[OF _ _ that(2) alw_True]) auto\n    subgoal premises that for M x\n      using that(2)[THEN spec, of 0] that(2)\n      proof (induction rule: suntil_induct_strong)\n        case (base \\<omega>) then show ?case \n          by (cases \\<omega>) (simp add: suntil_Stream)\n      next\n        case (step \\<omega>) then show ?case\n          by (cases \\<omega>) (simp add: suntil_Stream)\n      qed\n      done\n  have [measurable]: \"Measurable.pred (stream_space (count_space UNIV)) (gfp run)\"\n    apply measurable\n    apply (rule measurable_gfp[OF cont_run])\n    apply (auto simp: run_def)\n    done\n\n  have \"emeasure (T x) {\\<omega> \\<in> space (T x). alw (HLD Y) \\<omega>} \\<le>\n    emeasure (T x) {\\<omega> \\<in> space (T x). ((alw (HLD Y)) aand (alw (\\<lambda> \\<omega>. HLD Y \\<omega> \\<longrightarrow> ev (HLD X) \\<omega>))) \\<omega>}\"\n    apply (rule emeasure_mono_AE)\n    subgoal using ae by eventually_elim auto\n    by measurable\n  also have \"\\<dots> \\<le> emeasure (T x) {\\<omega> \\<in> space (T x). gfp run \\<omega>}\"\n    apply (rule emeasure_mono)\n    subgoal using le_gfp by auto\n    by measurable\n  also have \"\\<dots> \\<le> r ^ n\" for n\n  proof (induction n arbitrary: x)\n    case 0 then show ?case by (simp add: T.emeasure_le_1)\n  next\n    case (Suc n)\n    { fix x \n      have \"(\\<integral>\\<^sup>+ t. \\<integral>\\<^sup>+ t'. emeasure (T t') {x\\<in>space S. t\\<in>X \\<and> t\\<in>Y \\<and> t'\\<in>Y \\<and> gfp run x} \\<partial>K t \\<partial>K x) \\<le>\n        (\\<integral>\\<^sup>+ t. indicator (X \\<inter> Y) t * \\<integral>\\<^sup>+ t'. indicator Y t' * ennreal (r ^ n) \\<partial>K t \\<partial>K x)\"\n        using Suc by (auto intro!: nn_integral_mono split: split_indicator)\n      also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+ t. indicator (X \\<inter> Y) t * r \\<partial>K x) * ennreal (r^n)\"\n        by (auto intro!: nn_integral_mono mult_right_mono r ennreal_leI split: split_indicator\n                 simp: nn_integral_multc mult.assoc[symmetric] measure_pmf.emeasure_eq_measure)\n      also have \"\\<dots> = emeasure (K x) (X \\<inter> Y) * r^(Suc n)\"\n        by (simp add: ennreal_mult \\<open>0 \\<le> r\\<close> nn_integral_multc ennreal_indicator mult.assoc)\n      finally have *: \"(\\<integral>\\<^sup>+ t. \\<integral>\\<^sup>+ t'. emeasure (T t') {x\\<in>space S. t \\<in> X \\<and> t \\<in> Y \\<and> t' \\<in> Y \\<and> gfp run x} \\<partial>K t \\<partial>K x) \\<le>\n        emeasure (K x) (X \\<inter> Y) * r^Suc n\" .\n  \n      have \"(\\<integral>\\<^sup>+ t. \\<integral>\\<^sup>+ t'. emeasure (T t') {x \\<in> space S. t \\<in> X \\<and> t \\<in> Y \\<and> t' \\<in> Y \\<and> gfp run x} \\<partial>K t \\<partial>K x) +\n           ennreal (r^Suc n) * emeasure (measure_pmf (K x)) (Y - X) \\<le>\n        emeasure (K x) (X \\<inter> Y) * ennreal (r^Suc n) + ennreal (r^Suc n) * emeasure (measure_pmf (K x)) (Y - X)\"\n        by (intro add_mono_left *)\n      also have \"\\<dots> = emeasure (K x) ((X \\<inter> Y) \\<union> (Y - X)) * ennreal (r^Suc n)\"\n        by (subst plus_emeasure[symmetric]) (auto simp: field_simps)\n      also have \"\\<dots> \\<le> 1 * ennreal (r^Suc n)\"\n        by (intro mult_right_mono measure_pmf.emeasure_le_1) simp\n      finally have \"(\\<integral>\\<^sup>+ t. \\<integral>\\<^sup>+ t'. emeasure (T t') {x \\<in> space MC_syntax.S. t \\<in> X \\<and> t \\<in> Y \\<and> t' \\<in> Y \\<and> gfp run x} \\<partial>K t \\<partial>K x) +\n           ennreal (r^Suc n) * emeasure (measure_pmf (K x)) (Y - X) \\<le> 1 * ennreal (r^Suc n)\" by simp }\n    note * = this\n    \n    show ?case\n      apply (subst gfp_unfold[OF inf_continuous_mono[OF cont_run]])\n      apply (subst run_def)\n      apply (subst emeasure_suntil_disj)\n        apply measurable []\n      subgoal for s\n        by (rule AE_I2) (auto simp: HLD_iff)\n      apply (rule le_funD[of _ _ x])\n      apply (rule lfp_lowerbound)\n      apply (rule le_funI)\n      apply (subst emeasure_Collect_T)\n       apply measurable []\n      apply (subst emeasure_Collect_T)\n      apply simp\n      apply (simp add: nn_integral_cmult)\n      using * by simp\n  qed\n  finally have \"emeasure (T x) {\\<omega> \\<in> space (T x). alw (HLD Y) \\<omega>} \\<le> r^n\" for n .\n  then have \"emeasure (T x) {\\<omega> \\<in> space (T x). alw (HLD Y) \\<omega>} \\<le> ennreal 0\"\n    using \\<open>0 \\<le> r\\<close> \\<open>r < 1\\<close>\n    by (intro LIMSEQ_le_const[OF tendsto_ennrealI[OF LIMSEQ_power_zero[of r]]]) auto\n  then have *: \"emeasure (T x) {\\<omega> \\<in> space (T x). alw (HLD Y) \\<omega>} = 0\"\n    by simp\n  show ?thesis\n    by (rule AE_I[OF _ *]) (auto simp: not_ev_iff not_HLD[symmetric])\nqed\n\nend\n\ncontext Markov_Decision_Process\nbegin\n\nlemma cfg_on_inv:\n  \"pred_stream (\\<lambda> cfg. cfg \\<in> cfg_on (state cfg)) \\<omega>\" if\n  \"MC.enabled cfg \\<omega>\" \"cfg \\<in> cfg_on s\"\n  using that proof (coinduction arbitrary: \\<omega> cfg s)\n  case prems: stream_pred\n  note [simp] = \\<open>_ = \\<omega>\\<close>[symmetric]\n  from prems(2) have \"a \\<in> set_pmf (K_cfg cfg)\" \"MC.enabled a w\"\n    by (auto simp: MC.enabled_Stream)\n  moreover from \\<open>a \\<in> _\\<close> have \"a \\<in> cont cfg ` set_pmf (action cfg)\"\n    by (simp add: set_K_cfg)\n  ultimately show ?case\n    using \\<open>cfg \\<in> _\\<close> by auto\nqed\n\nlemma MC_T_not_sconst_strong:\n  assumes\n    \"\\<forall> l. \\<forall> cfg \\<in> (\\<Union> x \\<in> f -` {u}. cfg_on x) \\<inter> Y \\<inter> X. measure_pmf (action cfg) (f -` {u}) \\<le> r\"\n    \"r < 1\" \"cfg \\<in> cfg_on x\"\n    \"AE \\<omega> in MC.T cfg. pred_stream (\\<lambda> x. x \\<in> X) \\<omega>\"\n    \"AE \\<omega> in MC.T cfg. alw (\\<lambda> \\<omega>. HLD (f -` {u}) (smap state \\<omega>) \\<longrightarrow> ev (HLD Y) \\<omega>) \\<omega>\"\n  shows \"AE \\<omega> in MC.T cfg. smap (f o state) \\<omega> \\<noteq> sconst u\"\nproof -\n  let ?U = \"f -` {u}\"\n  let ?S = \"(\\<Union> x \\<in> f -` {u}. cfg_on x) \\<inter> X\"\n  let ?T = \"Y \\<inter> ((\\<Union> x \\<in> f -` {u}. cfg_on x) \\<inter> X)\"\n  have *: \"emeasure (K_cfg cfg) ?S \\<le> r\" if \"cfg \\<in> ?T\" for cfg\n  proof -\n    have \"emeasure (K_cfg cfg) ?S \\<le> emeasure (measure_pmf (action cfg)) ?U\"\n      unfolding K_cfg_def by (auto dest: cfg_onD_state intro!: emeasure_mono)\n    also from assms(1) \\<open>cfg \\<in> ?T\\<close> have \"\\<dots> \\<le> r\"\n      by auto\n    finally show ?thesis .\n  qed\n  have \"AE \\<omega> in MC.T cfg. ev (HLD (- ?S)) \\<omega>\"\n    apply (rule MC.AE_T_ev_HLD_infinite_strong'[where r = \"enn2real r\" and ?X = Y])\n    apply (simp; fail)\n    subgoal\n      using \\<open>r < 1\\<close>\n      by (metis ennreal_enn2real_if ennreal_less_one_iff zero_less_one)\n    subgoal for x\n     by (drule *)\n        (metis Sigma_Algebra.measure_def assms(2) enn2real_mono ennreal_one_less_top less_trans)\n    subgoal\n      using assms(5)\n      by (rule AE_mp) (rule AE_I2, intro impI, auto simp: HLD_iff elim: alw_mono)\n    done\n  then show ?thesis\n    apply (rule AE_mp)\n  proof (rule AE_mp[OF assms(4)], rule AE_mp[OF MC.AE_T_enabled], rule AE_I2, safe)\n    fix \\<omega> assume\n      \"\\<omega> \\<in> space (MC.T cfg)\" \"pred_stream (\\<lambda>\\<omega>. \\<omega> \\<in> X) \\<omega>\"\n      \"MC.enabled cfg \\<omega>\" \"ev (HLD (- ?S)) \\<omega>\" \"smap (f \\<circ> state) \\<omega> = sconst u\"\n    from this(2,3) \\<open>cfg \\<in> _\\<close>\n    have \"pred_stream (\\<lambda> x. x \\<in> cfg_on (state x)) \\<omega>\"\n      by (auto dest: cfg_onD_state intro!: cfg_on_inv)\n    from \\<open>smap _ \\<omega> = _\\<close> have \"pred_stream (\\<lambda> y. y \\<in> (\\<Union> x \\<in> ?U. cfg_on x)) \\<omega>\"\n    proof -\n      have \"(f o state) cfg = u\" if \"cfg \\<in> sset \\<omega>\" for cfg\n        using stream.set_map[of \"f o state\" \\<omega>] that \\<open>smap _ \\<omega> = _\\<close> by fastforce\n      with \\<open>pred_stream (\\<lambda> x. x \\<in> cfg_on (state x)) \\<omega>\\<close> show ?thesis\n        by (auto elim!: stream.pred_mono_strong)\n    qed\n    with \\<open>pred_stream (\\<lambda>\\<omega>. \\<omega> \\<in> X) \\<omega>\\<close> have \"pred_stream (\\<lambda> x. x \\<in> ?S) \\<omega>\"\n      by (coinduction arbitrary: \\<omega>) auto\n    then have \"alw (HLD ?S) \\<omega>\"\n      by (simp add: alw_holds_pred_stream_iff HLD_def)\n    with \\<open>ev (HLD (- ?S)) \\<omega>\\<close> show False\n      unfolding not_ev_not[symmetric] not_HLD by simp\n  qed\nqed\n\nlemma MC_T_not_sconst:\n  assumes\n    \"\\<forall> l. \\<forall> cfg \\<in> (\\<Union> x \\<in> f -` {u}. cfg_on x) \\<inter> X. measure_pmf (action cfg) (f -` {u}) \\<le> r\"\n    \"r < 1\" \"cfg \\<in> cfg_on x\"\n    \"AE \\<omega> in MC.T cfg. pred_stream (\\<lambda> x. x \\<in> X) \\<omega>\"\n  shows \"AE \\<omega> in MC.T cfg. smap (f o state) \\<omega> \\<noteq> sconst u\"\nproof -\n  let ?U = \"f -` {u}\"\n  let ?S = \"(\\<Union> x \\<in> f -` {u}. cfg_on x) \\<inter> X\"\n  have *: \"emeasure (K_cfg cfg) ?S \\<le> r\" if \"cfg \\<in> ?S\" for cfg\n  proof -\n    have \"emeasure (K_cfg cfg) ?S \\<le> emeasure (measure_pmf (action cfg)) ?U\"\n      unfolding K_cfg_def by (auto dest: cfg_onD_state intro!: emeasure_mono)\n    also from assms(1) \\<open>cfg \\<in> ?S\\<close> have \"\\<dots> \\<le> r\"\n      by auto\n    finally show ?thesis .\n  qed\n  have \"AE \\<omega> in MC.T cfg. ev (HLD (- ?S)) \\<omega>\"\n    apply (rule MC.AE_T_ev_HLD_infinite[where r = \"enn2real r\"])\n    subgoal\n      using \\<open>r < 1\\<close>\n      by (metis ennreal_enn2real_if ennreal_less_one_iff zero_less_one)\n    apply (drule *)\n    by (metis Sigma_Algebra.measure_def assms(2) enn2real_mono ennreal_one_less_top less_trans)\n  then show ?thesis\n    apply (rule AE_mp)\n  proof (rule AE_mp[OF assms(4)], rule AE_mp[OF MC.AE_T_enabled], rule AE_I2, safe)\n    fix \\<omega> assume\n      \"\\<omega> \\<in> space (MC.T cfg)\" \"pred_stream (\\<lambda>\\<omega>. \\<omega> \\<in> X) \\<omega>\"\n      \"MC.enabled cfg \\<omega>\" \"ev (HLD (- ?S)) \\<omega>\" \"smap (f \\<circ> state) \\<omega> = sconst u\"\n    from this(2,3) \\<open>cfg \\<in> _\\<close>\n    have \"pred_stream (\\<lambda> x. x \\<in> cfg_on (state x)) \\<omega>\"\n      by (auto dest: cfg_onD_state intro!: cfg_on_inv)\n    from \\<open>smap _ \\<omega> = _\\<close> have \"pred_stream (\\<lambda> y. y \\<in> (\\<Union> x \\<in> ?U. cfg_on x)) \\<omega>\"\n    proof -\n      have \"(f o state) cfg = u\" if \"cfg \\<in> sset \\<omega>\" for cfg\n        using stream.set_map[of \"f o state\" \\<omega>] that \\<open>smap _ \\<omega> = _\\<close> by fastforce\n      with \\<open>pred_stream (\\<lambda> x. x \\<in> cfg_on (state x)) \\<omega>\\<close> show ?thesis\n        by (auto elim!: stream.pred_mono_strong)\n    qed\n    with \\<open>pred_stream (\\<lambda>\\<omega>. \\<omega> \\<in> X) \\<omega>\\<close> have \"pred_stream (\\<lambda> x. x \\<in> ?S) \\<omega>\"\n      by (coinduction arbitrary: \\<omega>) auto\n    then have \"alw (HLD ?S) \\<omega>\"\n      by (simp add: alw_holds_pred_stream_iff HLD_def)\n    with \\<open>ev (HLD (- ?S)) \\<omega>\\<close> show False\n      unfolding not_ev_not[symmetric] not_HLD by simp\n  qed\nqed\n\nlemma MC_T_not_sconst':\n  assumes\n    \"\\<forall> cfg \\<in> cfg_on x \\<inter> X. measure_pmf (action cfg) {x} \\<le> r\" \"r < 1\" \"cfg \\<in> cfg_on x'\"\n    \"AE \\<omega> in MC.T cfg. pred_stream (\\<lambda> x. x \\<in> X) \\<omega>\"\n  shows \"AE \\<omega> in MC.T cfg. smap state \\<omega> \\<noteq> sconst x\"\n  using assms by (rule MC_T_not_sconst[where f = id, simplified])\n\nlemma K_cfg_cfg_onI:\n  \"cfg' \\<in> cfg_on (state cfg')\" if \"cfg \\<in> cfg_on x\" \"cfg' \\<in> K_cfg cfg\"\n  using that by (force simp: set_K_cfg)\n\nlemma MC_acc_cfg_onI:\n  \"cfg' \\<in> cfg_on (state cfg')\" if \"(cfg, cfg') \\<in> MC.acc\" \"cfg \\<in> cfg_on x\"\nproof -\n  from that(1) obtain n where \"((\\<lambda> a b. b \\<in> K_cfg a) ^^ n) cfg cfg'\"\n    by (erule MC.acc_relfunD)\n  with \\<open>cfg \\<in> cfg_on x\\<close> show ?thesis\n    by (induction n arbitrary: cfg') (auto intro: K_cfg_cfg_onI)\nqed\n\nlemma non_loop_tail_strong:\n  assumes\n    \"\\<forall> l. \\<forall> cfg \\<in> (\\<Union> x \\<in> f -` {u}. cfg_on x) \\<inter> Y \\<inter> X. measure_pmf (action cfg) (f -` {u}) \\<le> r\"\n    \"r < 1\" \"cfg \\<in> cfg_on x\"\n    \"AE \\<omega> in MC.T cfg. pred_stream (\\<lambda> x. x \\<in> X) \\<omega>\"\n    \"AE \\<omega> in MC.T cfg. alw (\\<lambda> \\<omega>. HLD (f -` {u}) (smap state \\<omega>) \\<longrightarrow> ev (HLD Y) \\<omega>) \\<omega>\"\n  shows \"AE \\<omega> in MC.T cfg. \\<not> (ev (alw (\\<lambda> xs. shd xs = u))) (smap (f o state) \\<omega>)\"\n    (is \"AE \\<omega> in ?M. ?P \\<omega>\")\nproof -\n  have *: \"?P \\<omega> \\<longleftrightarrow> alw (\\<lambda> xs. smap (f o state) xs \\<noteq> sconst u) \\<omega>\" for \\<omega>\n    apply (simp add: not_ev_iff)\n    apply (rule arg_cong2[where f = alw])\n     apply (rule ext)\n    subgoal for xs\n      using MC.alw_HLD_iff_sconst[of u \"smap (f o state) xs\"] by (simp add: HLD_iff)\n    by (rule HOL.refl)\n  have \"AE \\<omega> in ?M. alw (\\<lambda> xs. smap (f o state) xs \\<noteq> sconst u) \\<omega>\"\n    apply (rule MC.AE_T_alw)\n    subgoal by (intro pred_intros_logic measurable_eq_stream_space) measurable\n    using assms\n    by - (erule MC_T_not_sconst_strong,\n        auto intro: MC.AE_all_accD MC.AE_alw_accD elim: MC_acc_cfg_onI\n        )\n  with * show ?thesis\n    by simp\nqed\n\nlemma non_loop_tail:\n  assumes\n    \"\\<forall> l. \\<forall> cfg \\<in> (\\<Union> x \\<in> f -` {u}. cfg_on x) \\<inter> X. measure_pmf (action cfg) (f -` {u}) \\<le> r\"\n    \"r < 1\" \"cfg \\<in> cfg_on x\"\n    \"AE \\<omega> in MC.T cfg. pred_stream (\\<lambda> x. x \\<in> X) \\<omega>\"\n  shows \"AE \\<omega> in MC.T cfg. \\<not> (ev (alw (\\<lambda> xs. shd xs = u))) (smap (f o state) \\<omega>)\"\n    (is \"AE \\<omega> in ?M. ?P \\<omega>\")\nproof -\n  have *: \"?P \\<omega> \\<longleftrightarrow> alw (\\<lambda> xs. smap (f o state) xs \\<noteq> sconst u) \\<omega>\" for \\<omega>\n    apply (simp add: not_ev_iff)\n    apply (rule arg_cong2[where f = alw])\n     apply (rule ext)\n    subgoal for xs\n      using MC.alw_HLD_iff_sconst[of u \"smap (f o state) xs\"] by (simp add: HLD_iff)\n    by (rule HOL.refl)\n  have \"AE \\<omega> in ?M. alw (\\<lambda> xs. smap (f o state) xs \\<noteq> sconst u) \\<omega>\"\n    apply (rule MC.AE_T_alw)\n    subgoal by (intro pred_intros_logic measurable_eq_stream_space) measurable\n    using assms by - (erule MC_T_not_sconst, auto intro: MC.AE_all_accD elim: MC_acc_cfg_onI)\n  with * show ?thesis\n    by simp\nqed\n\nlemma non_loop_tail':\n  assumes\n    \"\\<forall> cfg \\<in> cfg_on x \\<inter> X. measure_pmf (action cfg) {x} \\<le> r\" \"r < 1\"\n    \"cfg \\<in> cfg_on y\"\n    \"AE \\<omega> in MC.T cfg. pred_stream (\\<lambda> x. x \\<in> X) \\<omega>\"\n  shows \"AE \\<omega> in MC.T cfg. \\<not> (ev (alw (\\<lambda> xs. shd xs = x))) (smap state \\<omega>)\"\n  using assms by simp (erule non_loop_tail[where f = id, simplified])\n\nend\n\nlemma (in Regions) intv_const_mono:\n  assumes \"u \\<in> region X I r\" \"c1 \\<in> X\" \"c2 \\<in> X\" \"u c1 \\<le> u c2\" \"\\<not> isGreater (I c2)\"\n  shows \"intv_const (I c1) \\<le> intv_const (I c2)\"\nproof -\n  from assms have \"intv_elem c1 u (I c1)\" \"intv_elem c2 u (I c2)\" by auto\n  with \\<open>u c1 \\<le> u c2\\<close> \\<open>\\<not> _\\<close> show ?thesis by (cases \"I c1\"; cases \"I c2\"; auto)\nqed\n\nlemma sset_sdrop:\n  assumes \"x \\<in> sset (sdrop i xs)\"\n  shows \"x \\<in> sset xs\"\nusing assms by (auto simp: sset_range)\n\nlemma holds_untilD:\n  assumes \"(holds P until holds Q) xs\" \"\\<forall> i \\<le> j. \\<not> Q (xs !! i)\"\n  shows \"P (xs !! j)\"\nusing assms\nproof (induction j arbitrary: xs)\n  case 0\n  then show ?case by cases auto\nnext\n  case (Suc j)\n  from Suc.prems show ?case by cases (auto dest!: Suc.IH)\nqed\n\n(* TODO: Move *)\nlemma frac_le_self:\n  assumes \"x \\<ge> 0\"\n  shows \"frac x \\<le> x\"\n  using assms less_trans [of \"frac x\" 1 x]\n  by (auto simp add: le_less frac_eq not_less frac_lt_1)\n\nlemma frac_le_1I:\n  assumes \"0 \\<le> x\" \"x \\<le> 1\" \"x \\<le> y\"\n  shows \"frac x \\<le> y\"\n  using assms dual_order.trans frac_le_self by auto\n\nlemma frac_le_1I':\n  assumes \"0 \\<le> x\" \"x \\<le> y\" \"y < 1\"\n  shows \"frac x \\<le> frac y\"\nproof -\n  from assms have \"frac y = y\" by (simp add: frac_eq)\n  moreover from assms have \"frac x \\<le> y\" by (auto intro: frac_le_1I)\n  ultimately show ?thesis by simp\nqed\n\n(* XXX Move *)\nlemmas [intro] = order.strict_implies_order[OF frac_lt_1]\n\n\n\nlemma nat_eventually_critical_path:\n  fixes i :: nat\n  assumes \"P i\" \"\\<not> P j\" \"i < j\"\n  shows \"\\<exists> k > i. k \\<le> j \\<and> \\<not> P k \\<and> (\\<forall> m \\<ge> i. m < k \\<longrightarrow> P m)\"\nproof -\n  let ?S = \"{k. i < k \\<and> k \\<le> j \\<and> \\<not> P k}\"\n  let ?k = \"Min ?S\"\n  from assms have \"j \\<in> ?S\" by auto\n  moreover have \"finite ?S\" by auto\n  ultimately have \"i < ?k\" \"?k \\<le> j\" \"\\<not> P ?k\" using Min_in[of ?S] by blast+\n  moreover have \"P m\" if \"i \\<le> m\" \"m < ?k\" for m\n  proof (cases \"i = m\")\n    case True with \\<open>P i\\<close> show ?thesis by simp\n  next\n    case False\n    with \\<open>i \\<le> m\\<close> have \"i < m\" by simp\n    with Min_le[OF \\<open>finite _\\<close>] \\<open>m < ?k\\<close> \\<open>?k \\<le> j\\<close> show ?thesis by fastforce\n  qed\n  ultimately show ?thesis using \\<open>P i\\<close> by - (rule exI[where x = ?k]; blast)\nqed\n\nsubsection \\<open>MDP Invariant\\<close>\n\nlocale Markov_Decision_Process_Invariant =\n  Markov_Decision_Process K for K :: \"'s \\<Rightarrow> 's pmf set\"+\nfixes S :: \"'s set\"\nassumes invariant: \"\\<And> s D. s \\<in> S \\<Longrightarrow> D \\<in> K s \\<Longrightarrow> (\\<forall>s' \\<in> D. s' \\<in> S)\"\nbegin\n\nlemma E_invariant:\n  \"{s'. (s, s') \\<in> E} \\<subseteq> S\" if \"s \\<in> S\"\n  using that by (auto dest: invariant simp: E_def)\n\ndefinition \"valid_cfg = (\\<Union>s\\<in>S. cfg_on s)\"\n\nlemma valid_cfgI: \"s \\<in> S \\<Longrightarrow> cfg \\<in> cfg_on s \\<Longrightarrow> cfg \\<in> valid_cfg\"\n  by (auto simp: valid_cfg_def)\n\nlemma valid_cfgD: \"cfg \\<in> valid_cfg \\<Longrightarrow> cfg \\<in> cfg_on (state cfg)\"\n  by (auto simp: valid_cfg_def)\n\nlemma action_closed: \"s \\<in> S \\<Longrightarrow> cfg \\<in> cfg_on s \\<Longrightarrow> t \\<in> action cfg \\<Longrightarrow> t \\<in> S\"\n  using cfg_onD_action[of cfg s] invariant[of s] by auto\n\nlemma\n  shows valid_cfg_state_in_S: \"cfg \\<in> valid_cfg \\<Longrightarrow> state cfg \\<in> S\"\n    and valid_cfg_action: \"cfg \\<in> valid_cfg \\<Longrightarrow> s \\<in> action cfg \\<Longrightarrow> s \\<in> S\"\n    and valid_cfg_cont: \"cfg \\<in> valid_cfg \\<Longrightarrow> s \\<in> action cfg \\<Longrightarrow> cont cfg s \\<in> valid_cfg\"\n  by (auto simp: valid_cfg_def intro!: bexI[of _ s] intro: action_closed)\n\nlemma valid_K_cfg[intro]: \"cfg \\<in> valid_cfg \\<Longrightarrow> cfg' \\<in> K_cfg cfg \\<Longrightarrow> cfg' \\<in> valid_cfg\"\n  by (auto simp add: K_cfg_def valid_cfg_cont)\n\nlemma pred_stream_valid_cfg:\n  assumes valid: \"cfg \\<in> valid_cfg\"\n  assumes enabled: \"MC.enabled cfg xs\"\n  shows \"pred_stream (\\<lambda> cfg. cfg \\<in> valid_cfg) xs\"\n  using assms by (coinduction arbitrary: cfg xs) (subst (asm) MC.enabled_iff; auto)\n\nlemma pred_stream_cfg_on:\n  assumes valid: \"cfg \\<in> valid_cfg\"\n  assumes enabled: \"MC.enabled cfg xs\"\n  shows \"pred_stream (\\<lambda> cfg. state cfg \\<in> S \\<and> cfg \\<in> cfg_on (state cfg)) xs\"\n  using valid pred_stream_valid_cfg[OF _ enabled] unfolding stream.pred_set\n  by (auto intro: valid_cfgI dest: valid_cfgD valid_cfg_state_in_S)\n\nlemma alw_S: \"almost_everywhere (T cfg) (pred_stream (\\<lambda>s. s \\<in> S))\" if \"cfg \\<in> valid_cfg\"\n  unfolding T_def using pred_stream_cfg_on \\<open>cfg \\<in> valid_cfg\\<close>\n  by (subst AE_distr_iff) (measurable, auto simp: stream.pred_set intro: AE_mp[OF MC.AE_T_enabled])\n\nend\n\ncontext Finite_Markov_Decision_Process\nbegin\n\nsublocale Invariant: Markov_Decision_Process_Invariant\n  rewrites \"Invariant.valid_cfg = valid_cfg\"\nproof -\n  show \"Markov_Decision_Process_Invariant K S\"\n    by standard (auto dest: set_pmf_closed)\n  then show \"Markov_Decision_Process_Invariant.valid_cfg K S = valid_cfg\"\n    by (subst Markov_Decision_Process_Invariant.valid_cfg_def; simp add: valid_cfg_def)\nqed\n\nlemmas pred_stream_cfg_on = Invariant.pred_stream_cfg_on\n   and pred_stream_valid_cfg = Invariant.pred_stream_valid_cfg\n   and alw_S = Invariant.alw_S\n   and valid_cfg_state_in_S = Invariant.valid_cfg_state_in_S\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Probabilistic_Timed_Automata/library/Lib.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.3290872650305218}}
{"text": "(*  Title:       The Relational Method with Message Anonymity for the Verification of Cryptographic Protocols\n    Author:      Pasquale Noce\n                 Software Engineer at HID Global, Italy\n                 pasquale dot noce dot lavoro at gmail dot com\n                 pasquale dot noce at hidglobal dot com\n*)\n\nsection \"The relational method and message anonymity\"\n\ntheory Definitions\n  imports Main\nbegin\n\ntext \\<open>\n\\null\n\n\\emph{This paper is dedicated to my mother, my favourite chess opponent -- in addition to being many\nother wonderful things!}\n\\<close>\n\n\nsubsection \"Introduction\"\n\ntext \\<open>\nAs Bertrand Russell says in the last pages of \\emph{A History of Western Philosophy}, a distinctive\nfeature of science is that \"we can make successive approximations to the truth, in which each new\nstage results from an improvement, not a rejection, of what has gone before\". When dealing with a\nformal verification method for information processing systems, such as Paulson's inductive method\nfor the verification of cryptographic protocols (cf. \\<^cite>\\<open>\"Paulson98\"\\<close>, \\<^cite>\\<open>\"Paulson20\"\\<close>), a\nmore modest goal for this iterative improvement process, yet of significant practical importance, is\nto streamline the definitions and proofs needed to model such a system and verify its properties.\n\nWith this aim, specially when it comes to verifying protocols using public key cryptography, this\npaper proposes an enhancement of the inductive method, named \\emph{relational method} for reasons\nclarified in what follows, and puts it into practice by verifying a sample protocol. This new method\nis the result of some changes to the way how events, states, spy's capabilities, and the protocol\nitself are formalized in the inductive method. Here below is a description of these changes, along\nwith a rationale for them.\n\n  \\<^descr>[Events.] In the inductive method, the fundamental building blocks of cryptographic protocols are\nevents of the form @{text \"Says A B X\"}, where @{text X} is a message being exchanged, @{text A} is\nthe agent that sends it, and @{text B} is the agent to which it is addressed.\n\\\\However, any exchanged message can be intercepted by the spy and forwarded to any other agent, so\nits intended recipient is not relevant for the protocol \\emph{security} correctness -- though of\ncourse being relevant for the protocol \\emph{functional} correctness. Moreover, a legitimate agent\nmay also generate messages, e.g. ephemeral private keys, that she will never exchange with any other\nagent. To model such an event, a datatype constructor other than @{text Says} should be used. How to\nmake things simpler?\n\\\\The solution adopted in the relational method is to model events just as ordered pairs of the form\n@{text \"(A, X)\"}, where @{text A} is an agent and @{text X} is a message. If event @{text \"(A, X)\"}\nstands for @{text A}'s sending of @{text X} to another agent, where @{text A} is a legitimate agent,\nthen this event will be accompanied by event @{text \"(Spy, X)\"}, representing the spy's interception\nof @{text X}. If event @{text \"(A, X)\"} rather stands for @{text A}'s generation of private message\n@{text X}, e.g. an ephemeral private key, for her own exclusive use -- and if the spy has not hacked\n@{text A} so as to steal her private messages as well --, then no companion event @{text \"(Spy, X)\"}\nwill occur instead.\n\n  \\<^descr>[States.] In the inductive method, the possible states of a cryptographic protocol are modeled as\nevent \\emph{traces}, i.e. lists, and the protocol itself is formalized as a set of such traces.\nConsequently, the protocol rules and security properties are expressed as formulae satisfied by any\nevent trace @{text evs} belonging to this set.\n\\\\However, these formulae are such that their truth values depend only on the events contained in\n@{text evs}, rather than on the actual order in which they occur -- in fact, robust protocol rules\nand security properties cannot depend on the exact sequence of message exchanges in a scenario where\nthe spy can freely intercept and forward messages, or even generate and send her own ones. Thus, one\nlibrary function, @{const set}, and two custom recursive functions, @{text used} and @{text knows},\nare needed to convert event traces into event sets and message sets, respectively.\n\\\\In the relational method, protocol states are simply modeled as event sets, so that the occurrence\nof event @{text \"(A, X)\"} in state @{text s} can be expressed as the transition to the augmented\nstate @{term \"insert (A, X) s\"}. Hence, states consist of relations between agents and messages. As\na result, function @{const set} need not be used any longer, whereas functions @{text used} and\n@{text spied} -- the latter one being a replacement for @{text \"knows Spy\"} --, which take a state\n@{text s} as input, are mere abbreviations for @{term \"Range s\"} and @{term \"s `` {Spy}\"}.\n\n  \\<^descr>[Spy's capabilities.] In the inductive method, the spy's attack capabilities are formalized via\ntwo inductively defined functions, @{text analz} and @{text synth}, used to construct the sets of\nall the messages that the spy can learn -- @{text \"analz (knows Spy evs)\"} -- and send to legitimate\nagents -- @{text \"synth (analz (knows Spy evs))\"} -- downstream of event trace @{text evs}.\n\\\\Indeed, the introduction of these functions goes in the direction of decoupling the formalization\nof the spy's capabilities from that of the protocol itself, consistently with the fact that what the\nspy can do is independent of how the protocol works -- which only matters when it comes to verifying\nprotocol security.\n\\\\In principle, this promises to provide a relevant benefit: these functions need to be defined, and\ntheir properties to be proven, just once, whereupon such definitions and properties can be reused in\nthe formalization and verification of whatever protocol.\n\\\\In practice, since both functions are of type @{text \"msg set \\<Rightarrow> msg set\"}, where @{text msg} is\nthe datatype defining all possible message formats, this benefit only applies as long as message\nformats remain unchanged. However, when it comes to verifying a protocol making use of public key\ncryptography, some new message format, and consequently some new related spy's capability as well,\nare likely to be required. An example of this will be provided right away by the protocol considered\nin this paper.\n\\\\In the relational method, the representation of events as agent-message pairs offers a simpler way\nto model the spy's capabilities, namely as supplementary protocol rules, analogous to the inductive\nmethod's @{text Fake} rule, augmenting a state by one or more events of the form @{text \"(Spy, X)\"}.\nIn addition to eliminating the need for functions @{text analz} and @{text synth} -- which, in light\nof the above considerations, does not significantly harm reusability --, this choice also abolishes\nany distinction between what the spy can learn and what she can send. In fact, a state containing\nevent @{text \"(Spy, X)\"} is interpreted as one where the spy both knows message @{text X} and may\nhave sent it to whatever legitimate agent. Actually, this formalizes the facts that a real-world\nattacker is free to send any message she has learned to any other party, and conversely to use any\nmessage she has generated to further augment her knowledge.\n\\\\In the inductive method, the former fact is modeled by property @{term \"H \\<subseteq> synth H\"} of function\n@{text synth}, but the latter one has no formal counterpart, as in general @{term \"H \\<subset> synth H\"}.\nThis limitation on the spy's capabilities is not significant as long as the protocol makes use of\nstatic keys only, but it is if session keys or ephemeral key pairs are generated -- as happens in\nkey establishment protocols, even in those using symmetric cryptography alone. In any such case, a\nrealistic spy must also be able to learn from anything she herself has generated, such as a nonce or\nan ephemeral private key -- a result achieved without effort in the relational method.\n\\\\An additional, nontrivial problem for the inductive method is that many protocols, including key\nestablishment ones, require the spy to be able to generate \\emph{fresh} ephemeral messages only, as\notherwise the spy could succeed in breaking the protocol by just guessing the ephemeral messages\nalready generated at random by some legitimate agent -- a quite unrealistic attack pattern, provided\nthat such messages vary in a sufficiently wide range. At first glance, this need could be addressed\nby extending the inductive definition of function @{text synth} with introduction rules of the form\n@{term \"Nonce n \\<notin> H \\<Longrightarrow> Nonce n \\<in> synth H\"} or @{term \"PriKey A \\<notin> H \\<Longrightarrow> PriKey A \\<in> synth H\"}.\nHowever, private ephemeral messages are not in general included in @{text \"analz (knows Spy evs)\"},\nsince nonces may be encrypted with uncompromised keys when exchanged and private keys are usually\nnot exchanged at all, so this approach would not work. The only satisfactory alternative would be to\nchange the signature of function @{text synth}, e.g. by adding a second input message set @{text H'}\nstanding for @{text \"used evs\"}, or else by replacing @{text H} with event trace @{text evs} itself,\nbut this would render the function definition much more convoluted -- a problem easily bypassed in\nthe relational method.\n\n  \\<^descr>[Protocol.] In the inductive method, a cryptographic protocol consists of an inductively defined\nset of event traces. This enables to prove the protocol security properties by induction using the\ninduction rule automatically generated as a result of such an inductive definition, i.e. by means of\n\\emph{rule induction}. Actually, this feature is exactly what gives the method its very name. Hence,\na consistent way to name a protocol verification method using some other form of induction would be\nto replace adjective \"inductive\" with another one referring to that form of induction.\n\\\\The relational method owes its name to this consideration. In this method, the introduction rules\ndefining \\emph{protocol rules}, i.e. the possible transitions between protocol states, are replaced\nwith \\emph{relations} between states, henceforth named \\emph{protocol relations}. That is, for any\ntwo states @{text s} and @{text s'}, there exists a transition leading from @{text s} to @{text s'}\njust in case the ordered pair @{term \"(s, s')\"} is contained in at least one protocol relation --\na state of affairs denoted using infix notation @{text \"s \\<turnstile> s'\"}. Then, the inductively defined set\nitself is replaced with the \\emph{reflexive transitive closure} of the union of protocol relations.\nNamely, any state @{text s} may be reached from \\emph{initial state} @{text s\\<^sub>0}, viz. is a possible\nprotocol state, just in case pair @{term \"(s\\<^sub>0, s)\"} lies within this reflexive transitive closure --\na state of affairs denoted using infix notation @{text \"s\\<^sub>0 \\<Turnstile> s\"}. As a result, rule induction is\nreplaced with induction over reflexive transitive closures via rule @{thm [source] rtrancl_induct},\nwhich is the circumstance that originates the method name.\n\\\\These changes provide the following important benefits.\n\n    \\<^item> Inserting and modifying the formal definition of a protocol is much more comfortable. In fact,\nany change even to a single introduction rule within a monolithic inductive set definition entails a\nre-evaluation of the whole definition, whereas each protocol relation will have its own stand-alone\ndefinition, which also makes it easier to find errors. This advantage may go almost unnoticed for a\nvery simple protocol providing for just a few protocol rules, but gets evident in case of a complex\nprotocol. An example of this will be provided by the protocol considered in this paper: when looking\nat the self-contained abbreviations used to define protocol relations, the reader will easily grasp\nhow much more convoluted an equivalent inductive set definition would have been.\n\n    \\<^item> In addition to induction via rule @{thm [source] rtrancl_induct}, a further powerful reasoning\npattern turns out to be available. It is based on the following general rule applying to reflexive\ntransitive closures (indeed, a rule so general and useful that it could rightfully become part of\nthe standard library), later on proven and assigned the name @{text rtrancl_start}:\n@{prop [display] \"\\<lbrakk>(x, y) \\<in> r\\<^sup>*; P y; \\<not> P x\\<rbrakk> \\<Longrightarrow>\n\\<exists>u v. (x, u) \\<in> r\\<^sup>* \\<and> (u, v) \\<in> r \\<and> (v, y) \\<in> r\\<^sup>* \\<and> \\<not> P u \\<and> P v\"}\nIn natural language, this rule states that for any chain of elements linked by a relation, if some\npredicate is false for the first element of the chain and true for the last one, there must exist a\nlink in the chain where the predicate becomes true.\n\\\\This rule can be used to prove propositions of the form @{text \"\\<lbrakk>s \\<Turnstile> s'; P s'[; Q]\\<rbrakk> \\<Longrightarrow> R s'\"} for\nany state @{text s} and predicate @{text P} such that @{term \"\\<not> P s\"}, with an optional additional\nassumption @{text Q}, without resorting to induction. Notably, \\emph{regularity lemmas} have exactly\nthis form, where @{term \"s = s\\<^sub>0\"}, @{term \"P = (\\<lambda>s. X \\<in> parts (used s))\"} for some term @{text X} of\ntype @{text msg}, and @{text Q}, if present, puts some constraint on @{text X} or its components.\n\\\\Such a proof consists of two steps. First, lemma @{text \"\\<lbrakk>s \\<turnstile> s'; P s'; \\<not> P s[; Q]\\<rbrakk> \\<Longrightarrow> R s'\"} is\nproven by simplification, using the definitions of protocol relations. Then, the target proposition\nis proven by applying rule @{text rtrancl_start} as a destruction rule (cf. \\<^cite>\\<open>\"Paulson20\"\\<close>) and\nproving @{term \"P s'\"} by assumption, @{term \"\\<not> P s\"} by simplification, and the residual subgoal\nby means of the previous lemma.\n\nIn addition to the relational method, this paper is aimed at introducing still another enhancement:\nbesides message confidentiality and authenticity, it takes into consideration a further important\nsecurity property, \\emph{message anonymity}. Being legitimate agents identified via natural numbers,\nthe fact that in state @{text s} the spy ignores that message @{text X\\<^sub>n} is associated with agent\n@{text n}, viz. @{text X\\<^sub>n}'s property of being \\emph{anonymous} in state @{text s}, can be expressed\nas @{text \"\\<langle>n, X\\<^sub>n\\<rangle> \\<notin> spied s\"}, where notation @{text \"\\<langle>n, X\\<^sub>n\\<rangle>\"} refers to a new constructor added to\ndatatype @{text msg} precisely for this purpose.\n\nA basic constraint upon any protocol relation augmenting the spy's knowledge with @{text \"\\<langle>n, X\\<rangle>\"}\nis that the spy must know message @{text X} in the current state, as it is impossible to identify\nthe agent associated with an unknown message. There is also an additional, more subtle constraint.\nAny such protocol relation either augments a state in which the spy knows @{text \"\\<langle>n, C X\\<^sub>1 \\<dots> X\\<^sub>m\\<rangle>\"},\ni.e. containing event @{text \"(Spy, \\<langle>n, C X\\<^sub>1 \\<dots> X\\<^sub>m\\<rangle>)\"}, with event @{text \"(Spy, \\<langle>n, X\\<^sub>i\\<rangle>)\"}, where\n$1 \\leq i \\leq m$ and @{text C} is some constructor of datatype @{text msg}, or conversely augments\na state containing event @{text \"(Spy, \\<langle>n, X\\<^sub>i\\<rangle>)\"} with @{text \"(Spy, \\<langle>n, C X\\<^sub>1 \\<dots> X\\<^sub>m\\<rangle>)\"}. However, the\nlatter spy's inference is justified only if the compound message @{text \"C X\\<^sub>1 \\<dots> X\\<^sub>m\"} is part of a\nmessage generated or accepted by some legitimate agent according to the protocol rules. Otherwise,\nthat is, if @{text \"C X\\<^sub>1 \\<dots> X\\<^sub>m\"} were just a message generated at random by the spy, her inference\nwould be as sound as those of most politicians and all advertisements: even if the conclusion were\ntrue, it would be so by pure chance.\n\nThis problem can be solved as follows.\n\n  \\<^item> A further constructor @{text Log}, taking a message as input, is added to datatype @{text msg},\nand every protocol relation modeling the generation or acceptance of a message @{text X} by some\nlegitimate agent must augment the current state with event @{term \"(Spy, Log X)\"}.\n\\\\In this way, the set of all the messages that have been generated or accepted by some legitimate\nagent in state @{text s} matches @{term \"Log -` spied s\"}.\n\n  \\<^item> A function @{text crypts} is defined inductively. It takes a message set @{text H} as input, and\nreturns the least message set @{text H'} such that @{term \"H \\<subseteq> H'\"} and for any (even empty) list\nof keys @{text KS}, if the encryption of @{text \"\\<lbrace>X, Y\\<rbrace>\"}, @{text \"\\<lbrace>Y, X\\<rbrace>\"}, or @{text \"Hash X\"}\nwith @{text KS} is contained in @{text H'}, then the encryption of @{text X} with @{text KS} is\ncontained in @{text H'} as well. \n\\\\In this way, the set of all the messages that are part of messages exchanged by legitimate agents,\nviz. that may be mapped to agents, in state @{text s} matches @{term \"crypts (Log -` spied s)\"}.\n\n  \\<^item> Another function @{text key_sets} is defined, too. It takes two inputs, a message @{text X} and\na message set @{text H}, and returns the set of the sets of @{text KS}' inverse keys for any list of\nkeys @{text KS} such that the encryption of @{text X} with @{text KS} is included in @{text H}.\n\\\\In this way, the fact that in state @{text s} the spy can map a compound message @{text X} to some\nagent, provided that she knows all the keys in set @{text U}, can be expressed through conditions\n@{term \"U \\<in> key_sets X (crypts (Log -` spied s))\"} and @{term \"U \\<subseteq> spied s\"}.\n\\\\The choice to define @{text key_sets} so as to collect the inverse keys of encryption keys, viz.\ndecryption ones, depends on the fact that the sample protocol verified in this paper uses symmetric\nkeys alone -- which match their own inverse keys -- for encryption, whereas asymmetric key pairs are\nused in cryptograms only for signature generation -- so that the inverse keys are public ones. In\ncase of a protocol (also) using public keys for encryption, encryption keys themselves should (also)\nbe collected, since the corresponding decryption keys, i.e. private keys, would be unknown to the\nspy by default. This would formalize the fact that encrypted messages can be mapped to agents not\nonly by decrypting them, but also by recomputing the cryptograms (provided that the plaintexts are\nknown) and checking whether they match the exchanged ones.\n\\<close>\n\n\nsubsection \"A sample protocol\"\n\ntext \\<open>\nAs previously mentioned, this paper tries the relational method, including message anonymity, by\napplying it to the verification of a sample authentication protocol in which Password Authenticated\nConnection Establishment (PACE) with Chip Authentication Mapping (cf. \\<^cite>\\<open>\"ICAO15\"\\<close>) is first\nused by an \\emph{owner} to establish a secure channel with her own \\emph{asset} and authenticate it,\nand then the owner sends a password (other than the PACE one) to the asset over that channel so as\nto authenticate herself. This enables to achieve a reliable mutual authentication even if the PACE\nkey is shared by multiple owners or is weak, as happens in electronic passports. Although the PACE\nmechanism is specified for use in electronic documents, nothing prevents it in principle from being\nused in other kinds of smart cards or even outside of the smart card world, which is the reason why\nthis paper uses the generic names \\emph{asset} and \\emph{owner} for the card and the cardholder,\nrespectively.\n\nIn more detail, this protocol provides for the following steps. In this list, messages are specified\nusing the same syntax that will be adopted in the formal text (for further information about PACE\nwith Chip Authentication Mapping, cf. \\<^cite>\\<open>\"ICAO15\"\\<close>).\n\n  \\<^enum> \\emph{Asset n} $\\rightarrow$ \\emph{Owner n}:\n\\\\\\hspace*{1em}@{text \"Crypt (Auth_ShaKey n) (PriKey S)\"}\n\n  \\<^enum> \\emph{Owner n} $\\rightarrow$ \\emph{Asset n}:\n\\\\\\hspace*{1em}@{text \"\\<lbrace>Num 1, PubKey A\\<rbrace>\"}\n\n  \\<^enum> \\emph{Asset n} $\\rightarrow$ \\emph{Owner n}:\n\\\\\\hspace*{1em}@{text \"\\<lbrace>Num 2, PubKey B\\<rbrace>\"}\n\n  \\<^enum> \\emph{Owner n} $\\rightarrow$ \\emph{Asset n}:\n\\\\\\hspace*{1em}@{text \"\\<lbrace>Num 3, PubKey C\\<rbrace>\"}\n\n  \\<^enum> \\emph{Asset n} $\\rightarrow$ \\emph{Owner n}:\n\\\\\\hspace*{1em}@{text \"\\<lbrace>Num 4, PubKey D\\<rbrace>\"}\n\n  \\<^enum> \\emph{Owner n} $\\rightarrow$ \\emph{Asset n}:\n\\\\\\hspace*{1em}@{text \"Crypt (SesK SK) (PubKey D)\"}\n\n  \\<^enum> \\emph{Asset n} $\\rightarrow$ \\emph{Owner n}:\n\\\\\\hspace*{1em}@{text \"\\<lbrace>Crypt (SesK SK) (PubKey C),\"}\n\\\\\\hspace*{1.5em}@{text \"Crypt (SesK SK) (Auth_PriK n \\<otimes> B),\"}\n\\\\\\hspace*{1.5em}@{text \"Crypt (SesK SK) (Crypt SigK\"}\n\\\\\\hspace*{2em}@{text \"\\<lbrace>Hash (Agent n), Hash (Auth_PubKey n)\\<rbrace>)\\<rbrace>\"}\n\n  \\<^enum> \\emph{Owner n} $\\rightarrow$ \\emph{Asset n}:\n\\\\\\hspace*{1em}@{text \"Crypt (SesK SK) (Pwd n)\"}\n\n  \\<^enum> \\emph{Asset n} $\\rightarrow$ \\emph{Owner n}:\n\\\\\\hspace*{1em}@{text \"Crypt (SesK SK) (Num 0)\"}\n\nLegitimate agents consist of an infinite population of assets and owners. For each natural number\n@{text n}, @{text \"Owner n\"} is an owner and @{text \"Asset n\"} is her own asset, and these agents\nare assigned the following authentication data.\n\n  \\<^item> @{text \"Key (Auth_ShaKey n)\"}: static symmetric PACE key shared by both agents.\n\n  \\<^item> @{text \"Auth_PriKey n\"}, @{text \"Auth_PubKey n\"}: static private and public keys stored on\n@{text \"Asset n\"} and used for @{text \"Asset n\"}'s authentication via Chip Authentication Mapping.\n\n  \\<^item> @{text \"Pwd n\"}: unique password (other than the PACE one) shared by both agents and used for\n@{text \"Owner n\"}'s authentication.\n\nFunction @{text Pwd} is defined as a constructor of datatype @{text msg} and then is injective,\nwhich formalizes the assumption that each asset-owner pair has a distinct password, whereas no such\nconstraint is put on functions @{text Auth_ShaKey}, @{text Auth_PriKey}, and @{text Auth_PubKey},\nwhich allows multiple asset-owner pairs to be assigned the same keys. On the other hand, function\n@{text Auth_PriKey} is constrained to be such that the complement of its range is infinite. As each\nprotocol run requires the generation of fresh ephemeral private keys, this constraint ensures that\nan unbounded number of protocol runs can be carried out. All assumptions are formalized by applying\nthe definitional approach, viz. without introducing any axiom, and so is this constraint, expressed\nby defining function @{text Auth_PriKey} using the indefinite description operator @{text SOME}.\n\nThe protocol starts with @{text \"Asset n\"} sending an ephemeral private key encrypted with the PACE\nkey to @{text \"Owner n\"}. Actually, if @{text \"Asset n\"} is a smart card, the protocol should rather\nstart with @{text \"Owner n\"} sending a plain request for such encrypted nonce, but this preliminary\nstep is omitted here as it is irrelevant for protocol security. After that, @{text \"Owner n\"} and\n@{text \"Asset n\"} generate two ephemeral key pairs each and send the respective public keys to the\nother party.\n\nThen, both parties agree on the same session key by deriving it from the ephemeral keys generated\npreviously (actually, two distinct session keys would be derived, one for encryption and the other\none for MAC computation, but such a level of detail is unnecessary for protocol verification). The\nsession key is modeled as @{text \"Key (SesK SK)\"}, where @{text SesK} is an apposite constructor\nadded to datatype @{text key} and @{term \"SK = (Some S, {A, B}, {C, D})\"}. The adoption of type\n@{typ \"nat option\"} for the first component enables to represent as @{term \"(None, {A, B}, {C, D})\"}\nthe wrong session key derived from @{text \"Owner n\"} if @{text \"PriKey S\"} was encrypted using a key\nother than @{text \"Key (Auth_ShaKey n)\"} -- which reflects the fact that the protocol goes on even\nwithout the two parties sharing the same session key. The use of type @{typ \"nat set\"} for the other\ntwo components enables the spy to compute @{text \"Key (SesK SK)\"} if she knows \\emph{either} private\nkey and the other public key referenced by each set, as long as she also knows @{text \"PriKey S\"} --\nwhich reflects the fact that given two key pairs, Diffie-Hellman key agreement generates the same\nshared secret independently of which of the respective private keys is used for computation.\n\nThis session key is used by both parties to compute their authentication tokens. Both encrypt the\nother party's second ephemeral public key, but @{text \"Asset n\"} appends two further fields: the\nEncrypted Chip Authentication Data, as provided for by Chip Authentication Mapping, and an encrypted\nsignature of the hash values of @{text \"Agent n\"} and @{text \"Auth_PubKey n\"}. Infix notation\n@{text \"Auth_PriK n \\<otimes> B\"} refers to a constructor of datatype @{text msg} standing for plain Chip\nAuthentication Data, and @{text Agent} is another such constructor standing for agent identification\ndata. @{text \"Owner n\"} is expected to validate this signature by also checking @{text \"Agent n\"}'s\nhash value against reference identification data known by other means -- otherwise, the spy would\nnot be forced to know @{text \"Auth_PriKey n\"} to masquerade as @{text \"Asset n\"}, since she could do\nthat by just knowing @{text \"Auth_PriKey m\"} for some other @{text m}, even if @{term \"Auth_PriKey m\n\\<noteq> Auth_PriKey n\"}. If @{text \"Asset n\"} is an electronic passport, the owner, i.e. the inspection\nsystem, could get cardholder's identification data by reading her personal data on the booklet, and\nsuch a signature could be retrieved from the chip (actually through a distinct message, but this is\nirrelevant for protocol security as long as the password is sent after the signature's validation)\nby reading the Document Security Object -- provided that @{text \"Auth_PubKey n\"} is included within\nData Group 14.\n\nThe protocol ends with @{text \"Owner n\"} sending her password, encrypted with the session key, to\n@{text \"Asset n\"}, who validates it and replies with an encrypted acknowledgment.\n\nHere below are some concluding remarks about the way how this sample protocol is formalized.\n\n  \\<^item> A single signature private key, unknown to the spy, is assumed to be used for all legitimate\nagents. Similarly, the spy might have hacked some legitimate agent so as to steal her ephemeral\nprivate keys and session keys as soon as they are generated, but here all legitimate agents are\nassumed to be out of the spy's reach in this respect. Of course, this is just the choice of one of\nmultiple possible modeling scenarios, and nothing prevents these assumptions from being dropped.\n\n  \\<^item> In the real world, a legitimate agent would use any one of her ephemeral private keys just once,\nafter which the key would be destroyed. On the contrary, no such constraint is enforced here, since\nit turns out to be unnecessary for protocol verification. There is a single exception, required for\nthe proof of a unicity lemma: after @{text \"Asset n\"} has used @{text \"PriKey B\"} to compute her\nauthentication token, she must discard @{text \"PriKey B\"} so as not to use this key any longer. The\nway how this requirement is expressed emphasizes once more the flexibility of the modeling of events\nin the relational method: @{text \"Asset n\"} may use @{text \"PriKey B\"} in this computation only if\nevent @{text \"(Asset n, PubKey B)\"} is not yet contained in the current state @{text s}, and then\n@{text s} is augmented with that event. Namely, events can also be used to model garbage collection!\n\n  \\<^item> The sets of the legitimate agents whose authentication data have been identified in advance (or\nequivalently, by means other than attacking the protocol, e.g. by social engineering) by the spy are\ndefined consistently with the constraint that known data alone can be mapped to agents, as well as\nwith the definition of initial state @{text s\\<^sub>0}. For instance, the set @{text bad_id_prikey} of the\nagents whose Chip Authentication private keys have been identified is defined as a subset of the set\n@{text bad_prikey} of the agents whose Chip Authentication private keys have been stolen. Moreover,\nall the signatures included in assets' authentication tokens are assumed to be already known to the\nspy in state @{text s\\<^sub>0}, so that @{text bad_id_prikey} includes also any agent whose identification\ndata or Chip Authentication public key have been identified in advance.\n\n  \\<^item> The protocol rules augmenting the spy's knowledge with some message of the form @{text \"\\<langle>n, X\\<rangle>\"}\ngenerally require the spy to already know some other message of the same form. There is just one\nexception: the spy can infer @{text \"\\<langle>n, Agent n\\<rangle>\"} from @{text \"Agent n\"}. This expresses the fact\nthat the detection of identification data within a message generated or accepted by some legitimate\nagent is in itself sufficient to map any known component of that message to the identified agent,\nregardless of whether any data were already mapped to that agent in advance.\n\n  \\<^item> As opposed to what happens for constructors @{text \"(\\<otimes>)\"} and @{text \"MPair\"}, there do not\nexist two protocol rules enabling the spy to infer @{text \"\\<langle>n, Crypt K X\\<rangle>\"} from @{text \"\\<langle>n, X\\<rangle>\"} or\n@{text \"\\<langle>n, Key K\\<rangle>\"} and vice versa. A single protocol rule is rather defined, which enables the spy\nto infer @{text \"\\<langle>n, X\\<rangle>\"} from @{text \"\\<langle>n, Key K\\<rangle>\"} or vice versa, provided that @{text \"Crypt K X\"}\nhas been exchanged by some legitimate agent. In fact, the protocol provides for just one compound\nmessage made up of cryptograms, i.e. the asset's authentication token, and all these cryptograms are\ngenerated using the same encryption key @{text \"Key (SesK SK)\"}. Thus, if two such cryptograms have\nplaintexts @{text X\\<^sub>1}, @{text X\\<^sub>2} and the spy knows @{text \"\\<langle>n, X\\<^sub>1\\<rangle>\"}, she can infer @{text \"\\<langle>n, X\\<^sub>2\\<rangle>\"}\nby inferring @{text \"\\<langle>n, Key (SesK SK)\\<rangle>\"}, viz. she need not know @{text \"\\<langle>n, Crypt (SesK SK) X\\<^sub>1\\<rangle>\"}\nto do that.\n\nThe formal content is split into the following sections.\n\n  \\<^item> Section \\ref{Definitions}, \\emph{Definitions}, contains all the definitions needed to formalize\nthe sample protocol by means of the relational method, including message anonymity.\n\n  \\<^item> Section \\ref{Authentication}, \\emph{Confidentiality and authenticity properties}, proves that\nthe following theorems hold under appropriate assumptions.\n\n    \\<^enum> Theorem @{text sigkey_secret}: the signature private key is secret.\n\n    \\<^enum> Theorem @{text auth_shakey_secret}: an asset-owner pair's PACE key is secret.\n\n    \\<^enum> Theorem @{text auth_prikey_secret}: an asset's Chip Authentication private key is secret.\n\n    \\<^enum> Theorem @{text owner_seskey_unique}: an owner's session key is unknown to other owners.\n\n    \\<^enum> Theorem @{text owner_seskey_secret}: an owner's session key is secret.\n\n    \\<^enum> Theorem @{text owner_num_genuine}: the encrypted acknowledgment received by an owner has been\nsent by the respective asset.\n\n    \\<^enum> Theorem @{text owner_token_genuine}: the PACE authentication token received by an owner has\nbeen generated by the respective asset, using her Chip Authentication private key and the same\nephemeral keys used to derive the session key.\n\n    \\<^enum> Theorem @{text pwd_secret}: an asset-owner pair's password is secret.\n\n    \\<^enum> Theorem @{text asset_seskey_unique}: an asset's session key is unknown to other assets, and\nmay be used by that asset to compute just one PACE authentication token.\n\n    \\<^enum> Theorem @{text asset_seskey_secret}: an asset's session key is secret.\n\n    \\<^enum> Theorem @{text asset_pwd_genuine}: the encrypted password received by an asset has been sent\nby the respective owner.\n\n    \\<^enum> Theorem @{text asset_token_genuine}: the PACE authentication token received by an asset has\nbeen generated by the respective owner, using the same ephemeral key used to derive the session key.\n\n    \\<^enum> Theorem @{text seskey_forward_secret}: a session key shared by an asset-owner pair is\nendowed with \\emph{forward secrecy}, viz. it is secret independently of the secrecy of static keys.\n\n  Particularly, these proofs confirm that the mutual authentication between an owner and her asset\nis reliable even if their PACE key is compromised, unless either their Chip Authentication private\nkey or their password also is -- namely, the protocol succeeds in implementing a two-factor mutual\nauthentication --, with the forward secrecy of the generated session keys being ensured as well.\n\n  \\<^item> Section \\ref{Anonymity}, \\emph{Anonymity properties}, proves that the following theorems hold\nunder appropriate assumptions.\n\n    \\<^enum> Theorem @{text pwd_anonymous}: an asset-owner pair's password is anonymous.\n\n    \\<^enum> Theorem @{text auth_prikey_anonymous}: an asset's Chip Authentication private key is\nanonymous.\n\n    \\<^enum> Theorem @{text auth_shakey_anonymous}: an asset-owner pair's PACE key is anonymous.\n\n  \\<^item> Section \\ref{Possibility}, \\emph{Possibility properties}, shows how possibility properties (cf.\n\\<^cite>\\<open>\"Paulson98\"\\<close>) can be proven by constructing sample protocol runs, either ordinary or attack\nones. Two such properties are proven:\n\n    \\<^enum> Theorem @{text runs_unbounded}: for any possible protocol state @{text s} and any asset-owner\npair, there exists a state @{text s'} reachable from @{text s} in which a protocol run has been\ncompleted by those agents using an ephemeral private key @{text \"PriKey S\"} not yet exchanged in\n@{text s} -- namely, an unbounded number of protocol runs can be carried out by legitimate agents.\n\n    \\<^enum> Theorem @{text pwd_compromised}: in a scenario not satisfying the assumptions of theorem\n@{text pwd_anonymous}, the spy can steal an asset-owner pair's password and even identify those\nagents.\n\n  The latter is an example of a possibility property aimed at confirming that the assumptions of a\ngiven confidentiality, authenticity, or anonymity property are necessary for it to hold.\n\nFor further information about the formal definitions and proofs contained in these sections, see\nIsabelle documentation, particularly \\<^cite>\\<open>\"Paulson20\"\\<close>, \\<^cite>\\<open>\"Nipkow20\"\\<close>, \\<^cite>\\<open>\"Krauss20\"\\<close>,\nand \\<^cite>\\<open>\"Nipkow11\"\\<close>.\n\n\\textbf{Important note.} This sample protocol was already considered in a former paper of mine (cf.\n\\<^cite>\\<open>\"Noce17\"\\<close>). For any purpose, that paper should be regarded as being obsolete and superseded\nby the present paper.\n\\<close>\n\n\nsubsection \"Definitions\"\n\ntext \\<open>\n\\label{Definitions}\n\\<close>\n\ntype_synonym agent_id = nat\n\ntype_synonym key_id = nat\n\ntype_synonym seskey_in = \"key_id option \\<times> key_id set \\<times> key_id set\"\n\ndatatype agent =\n  Asset agent_id |\n  Owner agent_id |\n  Spy\n\ndatatype key =\n  SigK |\n  VerK |\n  PriK key_id |\n  PubK key_id |\n  ShaK key_id |\n  SesK seskey_in\n\ndatatype msg =\n  Num nat |\n  Agent agent_id |\n  Pwd agent_id |\n  Key key |\n  Mult key_id key_id (infixl \"\\<otimes>\" 70) |\n  Hash msg |\n  Crypt key msg |\n  MPair msg msg |\n  IDInfo agent_id msg |\n  Log msg\n\nsyntax\n  \"_MPair\"  :: \"['a, args] \\<Rightarrow> 'a * 'b\"  (\"(2\\<lbrace>_,/ _\\<rbrace>)\")\n  \"_IDInfo\" :: \"[agent_id, msg] \\<Rightarrow> msg\"      (\"(2\\<langle>_,/ _\\<rangle>)\")\ntranslations\n  \"\\<lbrace>X, Y, Z\\<rbrace>\" \\<rightleftharpoons> \"\\<lbrace>X, \\<lbrace>Y, Z\\<rbrace>\\<rbrace>\"\n  \"\\<lbrace>X, Y\\<rbrace>\" \\<rightleftharpoons> \"CONST MPair X Y\"\n  \"\\<langle>n, X\\<rangle>\" \\<rightleftharpoons> \"CONST IDInfo n X\"\n\n\nabbreviation SigKey :: \"msg\" where\n\"SigKey \\<equiv> Key SigK\"\n\nabbreviation VerKey :: \"msg\" where\n\"VerKey \\<equiv> Key VerK\"\n\nabbreviation PriKey :: \"key_id \\<Rightarrow> msg\" where\n\"PriKey \\<equiv> Key \\<circ> PriK\"\n\nabbreviation PubKey :: \"key_id \\<Rightarrow> msg\" where\n\"PubKey \\<equiv> Key \\<circ> PubK\"\n\nabbreviation ShaKey :: \"key_id \\<Rightarrow> msg\" where\n\"ShaKey \\<equiv> Key \\<circ> ShaK\"\n\nabbreviation SesKey :: \"seskey_in \\<Rightarrow> msg\" where\n\"SesKey \\<equiv> Key \\<circ> SesK\"\n\nprimrec InvK :: \"key \\<Rightarrow> key\" where\n\"InvK SigK = VerK\" |\n\"InvK VerK = SigK\" |\n\"InvK (PriK A) = PubK A\" |\n\"InvK (PubK A) = PriK A\" |\n\"InvK (ShaK SK) = ShaK SK\" |\n\"InvK (SesK SK) = SesK SK\"\n\nabbreviation InvKey :: \"key \\<Rightarrow> msg\" where\n\"InvKey \\<equiv> Key \\<circ> InvK\"\n\n\ninductive_set parts :: \"msg set \\<Rightarrow> msg set\"\n  for H :: \"msg set\" where\n\nparts_used [intro]:\n  \"X \\<in> H \\<Longrightarrow> X \\<in> parts H\" |\n\nparts_crypt [intro]:\n  \"Crypt K X \\<in> parts H \\<Longrightarrow> X \\<in> parts H\" |\n\nparts_fst [intro]:\n  \"\\<lbrace>X, Y\\<rbrace> \\<in> parts H \\<Longrightarrow> X \\<in> parts H\" |\n\nparts_snd [intro]:\n  \"\\<lbrace>X, Y\\<rbrace> \\<in> parts H \\<Longrightarrow> Y \\<in> parts H\"\n\n\ninductive_set crypts :: \"msg set \\<Rightarrow> msg set\"\n  for H :: \"msg set\" where\n\ncrypts_used [intro]:\n  \"X \\<in> H \\<Longrightarrow> X \\<in> crypts H\" |\n\ncrypts_hash [intro]:\n  \"foldr Crypt KS (Hash X) \\<in> crypts H \\<Longrightarrow> foldr Crypt KS X \\<in> crypts H\" |\n\ncrypts_fst [intro]:\n  \"foldr Crypt KS \\<lbrace>X, Y\\<rbrace> \\<in> crypts H \\<Longrightarrow> foldr Crypt KS X \\<in> crypts H\" |\n\ncrypts_snd [intro]:\n  \"foldr Crypt KS \\<lbrace>X, Y\\<rbrace> \\<in> crypts H \\<Longrightarrow> foldr Crypt KS Y \\<in> crypts H\"\n\n\ndefinition key_sets :: \"msg \\<Rightarrow> msg set \\<Rightarrow> msg set set\" where\n\"key_sets X H \\<equiv> {InvKey ` set KS | KS. foldr Crypt KS X \\<in> H}\"\n\ndefinition parts_msg :: \"msg \\<Rightarrow> msg set\" where\n\"parts_msg X \\<equiv> parts {X}\"\n\ndefinition crypts_msg :: \"msg \\<Rightarrow> msg set\" where\n\"crypts_msg X \\<equiv> crypts {X}\"\n\ndefinition key_sets_msg :: \"msg \\<Rightarrow> msg \\<Rightarrow> msg set set\" where\n\"key_sets_msg X Y \\<equiv> key_sets X {Y}\"\n\nfun seskey_set :: \"seskey_in \\<Rightarrow> key_id set\" where\n\"seskey_set (Some S, U, V) = insert S (U \\<union> V)\" |\n\"seskey_set (None, U, V) = U \\<union> V\"\n\n\ndefinition Auth_PriK :: \"agent_id \\<Rightarrow> key_id\" where\n\"Auth_PriK \\<equiv> SOME f. infinite (- range f)\"\n\nabbreviation Auth_PriKey :: \"agent_id \\<Rightarrow> msg\" where\n\"Auth_PriKey \\<equiv> PriKey \\<circ> Auth_PriK\"\n\nabbreviation Auth_PubKey :: \"agent_id \\<Rightarrow> msg\" where\n\"Auth_PubKey \\<equiv> PubKey \\<circ> Auth_PriK\"\n\nconsts Auth_ShaK :: \"agent_id \\<Rightarrow> key_id\"\n\nabbreviation Auth_ShaKey :: \"agent_id \\<Rightarrow> key\" where\n\"Auth_ShaKey \\<equiv> ShaK \\<circ> Auth_ShaK\"\n\nabbreviation Sign :: \"agent_id \\<Rightarrow> key_id \\<Rightarrow> msg\" where\n\"Sign n A \\<equiv> Crypt SigK \\<lbrace>Hash (Agent n), Hash (PubKey A)\\<rbrace>\"\n\nabbreviation Token :: \"agent_id \\<Rightarrow> key_id \\<Rightarrow> key_id \\<Rightarrow> key_id \\<Rightarrow> seskey_in \\<Rightarrow> msg\"\nwhere \"Token n A B C SK \\<equiv> \\<lbrace>Crypt (SesK SK) (PubKey C),\n  Crypt (SesK SK) (A \\<otimes> B), Crypt (SesK SK) (Sign n A)\\<rbrace>\"\n\n\nconsts bad_agent :: \"agent_id set\"\n\nconsts bad_pwd :: \"agent_id set\"\n\nconsts bad_shak :: \"key_id set\"\n\nconsts bad_id_pwd :: \"agent_id set\"\n\nconsts bad_id_prik :: \"agent_id set\"\n\nconsts bad_id_pubk :: \"agent_id set\"\n\nconsts bad_id_shak :: \"agent_id set\"\n\ndefinition bad_prik :: \"key_id set\" where\n\"bad_prik \\<equiv> SOME U. U \\<subseteq> range Auth_PriK\"\n\nabbreviation bad_prikey :: \"agent_id set\" where\n\"bad_prikey \\<equiv> Auth_PriK -` bad_prik\"\n\nabbreviation bad_shakey :: \"agent_id set\" where\n\"bad_shakey \\<equiv> Auth_ShaK -` bad_shak\"\n\nabbreviation bad_id_password :: \"agent_id set\" where\n\"bad_id_password \\<equiv> bad_id_pwd \\<inter> bad_pwd\"\n\nabbreviation bad_id_prikey :: \"agent_id set\" where\n\"bad_id_prikey \\<equiv> (bad_agent \\<union> bad_id_pubk \\<union> bad_id_prik) \\<inter> bad_prikey\"\n\nabbreviation bad_id_pubkey :: \"agent_id set\" where\n\"bad_id_pubkey \\<equiv> bad_agent \\<union> bad_id_pubk \\<union> bad_id_prik \\<inter> bad_prikey\"\n\nabbreviation bad_id_shakey :: \"agent_id set\" where\n\"bad_id_shakey \\<equiv> bad_id_shak \\<inter> bad_shakey\"\n\n\ntype_synonym event = \"agent \\<times> msg\"\n\ntype_synonym state = \"event set\"\n\nabbreviation used :: \"state \\<Rightarrow> msg set\" where\n\"used s \\<equiv> Range s\"\n\nabbreviation spied :: \"state \\<Rightarrow> msg set\" where\n\"spied s \\<equiv> s `` {Spy}\"\n\nabbreviation s\\<^sub>0 :: state where\n\"s\\<^sub>0 \\<equiv> range (\\<lambda>n. (Asset n, Auth_PriKey n)) \\<union> {Spy} \\<times> insert VerKey\n  (range Num \\<union> range Auth_PubKey \\<union> range (\\<lambda>n. Sign n (Auth_PriK n)) \\<union>\n   Agent ` bad_agent \\<union> Pwd ` bad_pwd \\<union> PriKey ` bad_prik \\<union> ShaKey ` bad_shak \\<union>\n   (\\<lambda>n. \\<langle>n, Pwd n\\<rangle>) ` bad_id_password \\<union>\n   (\\<lambda>n. \\<langle>n, Auth_PriKey n\\<rangle>) ` bad_id_prikey \\<union>\n   (\\<lambda>n. \\<langle>n, Auth_PubKey n\\<rangle>) ` bad_id_pubkey \\<union>\n   (\\<lambda>n. \\<langle>n, Key (Auth_ShaKey n)\\<rangle>) ` bad_id_shakey)\"\n\n\nabbreviation rel_asset_i :: \"(state \\<times> state) set\" where\n\"rel_asset_i \\<equiv> {(s, s') | s s' n S.\n  s' = insert (Asset n, PriKey S) s \\<union>\n    {Asset n, Spy} \\<times> {Crypt (Auth_ShaKey n) (PriKey S)} \\<union>\n    {(Spy, Log (Crypt (Auth_ShaKey n) (PriKey S)))} \\<and>\n  PriKey S \\<notin> used s}\"\n\nabbreviation rel_owner_ii :: \"(state \\<times> state) set\" where\n\"rel_owner_ii \\<equiv> {(s, s') | s s' n S A K.\n  s' = insert (Owner n, PriKey A) s \\<union>\n    {Owner n, Spy} \\<times> {\\<lbrace>Num 1, PubKey A\\<rbrace>} \\<union>\n    {Spy} \\<times> Log ` {Crypt K (PriKey S), \\<lbrace>Num 1, PubKey A\\<rbrace>} \\<and>\n  Crypt K (PriKey S) \\<in> used s \\<and>\n  PriKey A \\<notin> used s}\"\n\nabbreviation rel_asset_ii :: \"(state \\<times> state) set\" where\n\"rel_asset_ii \\<equiv> {(s, s') | s s' n A B.\n  s' = insert (Asset n, PriKey B) s \\<union>\n    {Asset n, Spy} \\<times> {\\<lbrace>Num 2, PubKey B\\<rbrace>} \\<union>\n    {Spy} \\<times> Log ` {\\<lbrace>Num 1, PubKey A\\<rbrace>, \\<lbrace>Num 2, PubKey B\\<rbrace>} \\<and>\n  \\<lbrace>Num 1, PubKey A\\<rbrace> \\<in> used s \\<and>\n  PriKey B \\<notin> used s}\"\n\nabbreviation rel_owner_iii :: \"(state \\<times> state) set\" where\n\"rel_owner_iii \\<equiv> {(s, s') | s s' n B C.\n  s' = insert (Owner n, PriKey C) s \\<union>\n    {Owner n, Spy} \\<times> {\\<lbrace>Num 3, PubKey C\\<rbrace>} \\<union>\n    {Spy} \\<times> Log ` {\\<lbrace>Num 2, PubKey B\\<rbrace>, \\<lbrace>Num 3, PubKey C\\<rbrace>} \\<and>\n  \\<lbrace>Num 2, PubKey B\\<rbrace> \\<in> used s \\<and>\n  PriKey C \\<notin> used s}\"\n\nabbreviation rel_asset_iii :: \"(state \\<times> state) set\" where\n\"rel_asset_iii \\<equiv> {(s, s') | s s' n C D.\n  s' = insert (Asset n, PriKey D) s \\<union>\n    {Asset n, Spy} \\<times> {\\<lbrace>Num 4, PubKey D\\<rbrace>} \\<union>\n    {Spy} \\<times> Log ` {\\<lbrace>Num 3, PubKey C\\<rbrace>, \\<lbrace>Num 4, PubKey D\\<rbrace>} \\<and>\n  \\<lbrace>Num 3, PubKey C\\<rbrace> \\<in> used s \\<and>\n  PriKey D \\<notin> used s}\"\n\nabbreviation rel_owner_iv :: \"(state \\<times> state) set\" where\n\"rel_owner_iv \\<equiv> {(s, s') | s s' n S A B C D K SK.\n  s' = insert (Owner n, SesKey SK) s \\<union>\n    {Owner n, Spy} \\<times> {Crypt (SesK SK) (PubKey D)} \\<union>\n    {Spy} \\<times> Log ` {\\<lbrace>Num 4, PubKey D\\<rbrace>, Crypt (SesK SK) (PubKey D)} \\<and>\n  {Crypt K (PriKey S), \\<lbrace>Num 2, PubKey B\\<rbrace>, \\<lbrace>Num 4, PubKey D\\<rbrace>} \\<subseteq> used s \\<and>\n  {Owner n} \\<times> {\\<lbrace>Num 1, PubKey A\\<rbrace>, \\<lbrace>Num 3, PubKey C\\<rbrace>} \\<subseteq> s \\<and>\n  SK = (if K = Auth_ShaKey n then Some S else None, {A, B}, {C, D})}\"\n\nabbreviation rel_asset_iv :: \"(state \\<times> state) set\" where\n\"rel_asset_iv \\<equiv> {(s, s') | s s' n S A B C D SK.\n  s' = s \\<union> {Asset n} \\<times> {SesKey SK, PubKey B} \\<union>\n    {Asset n, Spy} \\<times> {Token n (Auth_PriK n) B C SK} \\<union>\n    {Spy} \\<times> Log ` {Crypt (SesK SK) (PubKey D),\n      Token n (Auth_PriK n) B C SK} \\<and>\n  {Asset n} \\<times> {Crypt (Auth_ShaKey n) (PriKey S),\n    \\<lbrace>Num 2, PubKey B\\<rbrace>, \\<lbrace>Num 4, PubKey D\\<rbrace>} \\<subseteq> s \\<and>\n  {\\<lbrace>Num 1, PubKey A\\<rbrace>, \\<lbrace>Num 3, PubKey C\\<rbrace>,\n    Crypt (SesK SK) (PubKey D)} \\<subseteq> used s \\<and>\n  (Asset n, PubKey B) \\<notin> s \\<and>\n  SK = (Some S, {A, B}, {C, D})}\"\n\nabbreviation rel_owner_v :: \"(state \\<times> state) set\" where\n\"rel_owner_v \\<equiv> {(s, s') | s s' n A B C SK.\n  s' = s \\<union> {Owner n, Spy} \\<times> {Crypt (SesK SK) (Pwd n)} \\<union>\n    {Spy} \\<times> Log ` {Token n A B C SK, Crypt (SesK SK) (Pwd n)} \\<and>\n  Token n A B C SK \\<in> used s \\<and>\n  (Owner n, SesKey SK) \\<in> s \\<and>\n  B \\<in> fst (snd SK)}\"\n\nabbreviation rel_asset_v :: \"(state \\<times> state) set\" where\n\"rel_asset_v \\<equiv> {(s, s') | s s' n SK.\n  s' = s \\<union> {Asset n, Spy} \\<times> {Crypt (SesK SK) (Num 0)} \\<union>\n    {Spy} \\<times> Log ` {Crypt (SesK SK) (Pwd n), Crypt (SesK SK) (Num 0)} \\<and>\n  (Asset n, SesKey SK) \\<in> s \\<and>\n  Crypt (SesK SK) (Pwd n) \\<in> used s}\"\n\n\nabbreviation rel_prik :: \"(state \\<times> state) set\" where\n\"rel_prik \\<equiv> {(s, s') | s s' A.\n  s' = insert (Spy, PriKey A) s \\<and>\n  PriKey A \\<notin> used s}\"\n\nabbreviation rel_pubk :: \"(state \\<times> state) set\" where\n\"rel_pubk \\<equiv> {(s, s') | s s' A.\n  s' = insert (Spy, PubKey A) s \\<and>\n  PriKey A \\<in> spied s}\"\n\nabbreviation rel_sesk :: \"(state \\<times> state) set\" where\n\"rel_sesk \\<equiv> {(s, s') | s s' A B C D S.\n  s' = insert (Spy, SesKey (Some S, {A, B}, {C, D})) s \\<and>\n  {PriKey S, PriKey A, PubKey B, PriKey C, PubKey D} \\<subseteq> spied s}\"\n\nabbreviation rel_fact :: \"(state \\<times> state) set\" where\n\"rel_fact \\<equiv> {(s, s') | s s' A B.\n  s' = s \\<union> {Spy} \\<times> {PriKey A, PriKey B} \\<and>\n  A \\<otimes> B \\<in> spied s \\<and>\n  (PriKey A \\<in> spied s \\<or> PriKey B \\<in> spied s)}\"\n\nabbreviation rel_mult :: \"(state \\<times> state) set\" where\n\"rel_mult \\<equiv> {(s, s') | s s' A B.\n  s' = insert (Spy, A \\<otimes> B) s \\<and>\n  {PriKey A, PriKey B} \\<subseteq> spied s}\"\n\nabbreviation rel_hash :: \"(state \\<times> state) set\" where\n\"rel_hash \\<equiv> {(s, s') | s s' X.\n  s' = insert (Spy, Hash X) s \\<and>\n  X \\<in> spied s}\"\n\nabbreviation rel_dec :: \"(state \\<times> state) set\" where\n\"rel_dec \\<equiv> {(s, s') | s s' K X.\n  s' = insert (Spy, X) s \\<and>\n  {Crypt K X, InvKey K} \\<subseteq> spied s}\"\n\nabbreviation rel_enc :: \"(state \\<times> state) set\" where\n\"rel_enc \\<equiv> {(s, s') | s s' K X.\n  s' = insert (Spy, Crypt K X) s \\<and>\n  {X, Key K} \\<subseteq> spied s}\"\n\nabbreviation rel_sep :: \"(state \\<times> state) set\" where\n\"rel_sep \\<equiv> {(s, s') | s s' X Y.\n  s' = s \\<union> {Spy} \\<times> {X, Y} \\<and>\n  \\<lbrace>X, Y\\<rbrace> \\<in> spied s}\"\n\nabbreviation rel_con :: \"(state \\<times> state) set\" where\n\"rel_con \\<equiv> {(s, s') | s s' X Y.\n  s' = insert (Spy, \\<lbrace>X, Y\\<rbrace>) s \\<and>\n  {X, Y} \\<subseteq> spied s}\"\n\n\nabbreviation rel_id_agent :: \"(state \\<times> state) set\" where\n\"rel_id_agent \\<equiv> {(s, s') | s s' n.\n  s' = insert (Spy, \\<langle>n, Agent n\\<rangle>) s \\<and>\n  Agent n \\<in> spied s}\"\n\nabbreviation rel_id_invk :: \"(state \\<times> state) set\" where\n\"rel_id_invk \\<equiv> {(s, s') | s s' n K.\n  s' = insert (Spy, \\<langle>n, InvKey K\\<rangle>) s \\<and>\n  {InvKey K, \\<langle>n, Key K\\<rangle>} \\<subseteq> spied s}\"\n\nabbreviation rel_id_sesk :: \"(state \\<times> state) set\" where\n\"rel_id_sesk \\<equiv> {(s, s') | s s' n A SK X U.\n  s' = s \\<union> {Spy} \\<times> {\\<langle>n, PubKey A\\<rangle>, \\<langle>n, SesKey SK\\<rangle>} \\<and>\n  {PubKey A, SesKey SK} \\<subseteq> spied s \\<and>\n  (\\<langle>n, PubKey A\\<rangle> \\<in> spied s \\<or> \\<langle>n, SesKey SK\\<rangle> \\<in> spied s) \\<and>\n  A \\<in> seskey_set SK \\<and>\n  SesKey SK \\<in> U \\<and>\n  U \\<in> key_sets X (crypts (Log -` spied s))}\"\n\nabbreviation rel_id_fact :: \"(state \\<times> state) set\" where\n\"rel_id_fact \\<equiv> {(s, s') | s s' n A B.\n  s' = s \\<union> {Spy} \\<times> {\\<langle>n, PriKey A\\<rangle>, \\<langle>n, PriKey B\\<rangle>} \\<and>\n  {PriKey A, PriKey B, \\<langle>n, A \\<otimes> B\\<rangle>} \\<subseteq> spied s}\"\n\nabbreviation rel_id_mult :: \"(state \\<times> state) set\" where\n\"rel_id_mult \\<equiv> {(s, s') | s s' n A B U.\n  s' = insert (Spy, \\<langle>n, A \\<otimes> B\\<rangle>) s \\<and>\n  U \\<union> {PriKey A, PriKey B, A \\<otimes> B} \\<subseteq> spied s \\<and>\n  (\\<langle>n, PriKey A\\<rangle> \\<in> spied s \\<or> \\<langle>n, PriKey B\\<rangle> \\<in> spied s) \\<and>\n  U \\<in> key_sets (A \\<otimes> B) (crypts (Log -` spied s))}\"\n\nabbreviation rel_id_hash :: \"(state \\<times> state) set\" where\n\"rel_id_hash \\<equiv> {(s, s') | s s' n X U.\n  s' = s \\<union> {Spy} \\<times> {\\<langle>n, X\\<rangle>, \\<langle>n, Hash X\\<rangle>} \\<and>\n  U \\<union> {X, Hash X} \\<subseteq> spied s \\<and>\n  (\\<langle>n, X\\<rangle> \\<in> spied s \\<or> \\<langle>n, Hash X\\<rangle> \\<in> spied s) \\<and>\n  U \\<in> key_sets (Hash X) (crypts (Log -` spied s))}\"\n\nabbreviation rel_id_crypt :: \"(state \\<times> state) set\" where\n\"rel_id_crypt \\<equiv> {(s, s') | s s' n X U.\n  s' = s \\<union> {Spy} \\<times> IDInfo n ` insert X U \\<and>\n  insert X U \\<subseteq> spied s \\<and>\n  (\\<langle>n, X\\<rangle> \\<in> spied s \\<or> (\\<exists>K \\<in> U. \\<langle>n, K\\<rangle> \\<in> spied s)) \\<and>\n  U \\<in> key_sets X (crypts (Log -` spied s))}\"\n\nabbreviation rel_id_sep :: \"(state \\<times> state) set\" where\n\"rel_id_sep \\<equiv> {(s, s') | s s' n X Y.\n  s' = s \\<union> {Spy} \\<times> {\\<langle>n, X\\<rangle>, \\<langle>n, Y\\<rangle>} \\<and>\n  {X, Y, \\<langle>n, \\<lbrace>X, Y\\<rbrace>\\<rangle>} \\<subseteq> spied s}\"\n\nabbreviation rel_id_con :: \"(state \\<times> state) set\" where\n\"rel_id_con \\<equiv> {(s, s') | s s' n X Y U.\n  s' = insert (Spy, \\<langle>n, \\<lbrace>X, Y\\<rbrace>\\<rangle>) s \\<and>\n  U \\<union> {X, Y, \\<lbrace>X, Y\\<rbrace>} \\<subseteq> spied s \\<and>\n  (\\<langle>n, X\\<rangle> \\<in> spied s \\<or> \\<langle>n, Y\\<rangle> \\<in> spied s) \\<and>\n  U \\<in> key_sets \\<lbrace>X, Y\\<rbrace> (crypts (Log -` spied s))}\"\n\n\ndefinition rel :: \"(state \\<times> state) set\" where\n\"rel \\<equiv> rel_asset_i \\<union> rel_owner_ii \\<union> rel_asset_ii \\<union> rel_owner_iii \\<union>\n  rel_asset_iii \\<union> rel_owner_iv \\<union> rel_asset_iv \\<union> rel_owner_v \\<union> rel_asset_v \\<union>\n  rel_prik \\<union> rel_pubk \\<union> rel_sesk \\<union> rel_fact \\<union> rel_mult \\<union> rel_hash \\<union> rel_dec \\<union>\n  rel_enc \\<union> rel_sep \\<union> rel_con \\<union> rel_id_agent \\<union> rel_id_invk \\<union> rel_id_sesk \\<union>\n  rel_id_fact \\<union> rel_id_mult \\<union> rel_id_hash \\<union> rel_id_crypt \\<union> rel_id_sep \\<union> rel_id_con\"\n\nabbreviation in_rel :: \"state \\<Rightarrow> state \\<Rightarrow> bool\" (infix \"\\<turnstile>\" 60) where\n\"s \\<turnstile> s' \\<equiv> (s, s') \\<in> rel\"\n\nabbreviation in_rel_rtrancl :: \"state \\<Rightarrow> state \\<Rightarrow> bool\" (infix \"\\<Turnstile>\" 60) where\n\"s \\<Turnstile> s' \\<equiv> (s, s') \\<in> rel\\<^sup>*\"\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Relational_Method/Definitions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3290872650305217}}
{"text": "(*  Title:      JinjaDCI/BV/BVSpec.thy\n\n    Author:     Cornelia Pusch, Gerwin Klein, Susannah Mansky\n    Copyright   1999 Technische Universitaet Muenchen, 2019-20 UIUC\n\n    Based on the Jinja theory BV/BVSpec.thy by Tobias Nipkow\n*)\n\nsection \\<open> The Bytecode Verifier \\label{sec:BVSpec} \\<close>\n\ntheory BVSpec\nimports Effect\nbegin\n\ntext \\<open>\n  This theory contains a specification of the BV. The specification\n  describes correct typings of method bodies; it corresponds \n  to type \\emph{checking}.\n\\<close>\n\n\ndefinition\n  \\<comment> \\<open>The method type only contains declared classes:\\<close>\n  check_types :: \"'m prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> bool\"\nwhere \n  \"check_types P mxs mxl \\<tau>s \\<equiv> set \\<tau>s \\<subseteq> states P mxs mxl\"\n\n  \\<comment> \\<open>An instruction is welltyped if it is applicable and its effect\\<close>\n  \\<comment> \\<open>is compatible with the type at all successor instructions:\\<close>\ndefinition\n  wt_instr :: \"['m prog,ty,nat,pc,ex_table,instr,pc,ty\\<^sub>m] \\<Rightarrow> bool\"\n  (\"_,_,_,_,_ \\<turnstile> _,_ :: _\" [60,0,0,0,0,0,0,61] 60)\nwhere\n  \"P,T,mxs,mpc,xt \\<turnstile> i,pc :: \\<tau>s \\<equiv>\n  app i P mxs T pc mpc xt (\\<tau>s!pc) \\<and> \n  (\\<forall>(pc',\\<tau>') \\<in> set (eff i P pc xt (\\<tau>s!pc)). P \\<turnstile> \\<tau>' \\<le>' \\<tau>s!pc')\"\n\n  \\<comment> \\<open>The type at @{text \"pc=0\"} conforms to the method calling convention:\\<close>\ndefinition wt_start :: \"['m prog,cname,staticb,ty list,nat,ty\\<^sub>m] \\<Rightarrow> bool\"\nwhere\n  \"wt_start P C b Ts mxl\\<^sub>0 \\<tau>s \\<equiv>\ncase b of NonStatic \\<Rightarrow> P \\<turnstile> Some ([],OK (Class C)#map OK Ts@replicate mxl\\<^sub>0 Err) \\<le>' \\<tau>s!0\n        | Static \\<Rightarrow>  P \\<turnstile> Some ([],map OK Ts@replicate mxl\\<^sub>0 Err) \\<le>' \\<tau>s!0\"\n\n  \\<comment> \\<open>A method is welltyped if the body is not empty,\\<close>\n  \\<comment> \\<open>if the method type covers all instructions and mentions\\<close>\n  \\<comment> \\<open>declared classes only, if the method calling convention is respected, and\\<close>\n  \\<comment> \\<open>if all instructions are welltyped.\\<close>\ndefinition wt_method :: \"['m prog,cname,staticb,ty list,ty,nat,nat,instr list,\n                 ex_table,ty\\<^sub>m] \\<Rightarrow> bool\"\nwhere\n  \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s \\<equiv> (b = Static \\<or> b = NonStatic) \\<and>\n  0 < size is \\<and> size \\<tau>s = size is \\<and>\n  check_types P mxs ((case b of Static \\<Rightarrow> 0 | NonStatic \\<Rightarrow> 1)+size Ts+mxl\\<^sub>0) (map OK \\<tau>s) \\<and>\n  wt_start P C b Ts mxl\\<^sub>0 \\<tau>s \\<and>\n  (\\<forall>pc < size is. P,T\\<^sub>r,mxs,size is,xt \\<turnstile> is!pc,pc :: \\<tau>s)\"\n\n  \\<comment> \\<open>A program is welltyped if it is wellformed and all methods are welltyped\\<close>\ndefinition  wf_jvm_prog_phi :: \"ty\\<^sub>P \\<Rightarrow> jvm_prog \\<Rightarrow> bool\" (\"wf'_jvm'_prog\\<^bsub>_\\<^esub>\")\nwhere\n  \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> \\<equiv>\n    wf_prog (\\<lambda>P C (M,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). \n      wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (\\<Phi> C M))\"\n\ndefinition wf_jvm_prog :: \"jvm_prog \\<Rightarrow> bool\"\nwhere\n  \"wf_jvm_prog P \\<equiv> \\<exists>\\<Phi>. wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\"\n\nlemma wt_jvm_progD:\n  \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P \\<Longrightarrow> \\<exists>wt. wf_prog wt P\"\n(*<*) by (unfold wf_jvm_prog_phi_def, blast) (*>*)\n\nlemma wt_jvm_prog_impl_wt_instr:\nassumes wf: \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\" and\n      sees: \"P \\<turnstile> C sees M,b:Ts \\<rightarrow> T = (mxs,mxl\\<^sub>0,ins,xt) in C\" and\n        pc: \"pc < size ins\"\nshows \"P,T,mxs,size ins,xt \\<turnstile> ins!pc,pc :: \\<Phi> C M\"\n(*<*)\nproof -\n  have wfm: \"wf_prog\n     (\\<lambda>P C (M, b, Ts, T\\<^sub>r, mxs, mxl\\<^sub>0, is, xt).\n         wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (\\<Phi> C M)) P\" using wf\n    by (unfold wf_jvm_prog_phi_def)\n  show ?thesis using sees_wf_mdecl[OF wfm sees] pc\n    by (simp add: wf_mdecl_def wt_method_def)\nqed\n(*>*)\n\nlemma wt_jvm_prog_impl_wt_start:\nassumes wf: \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\" and\n      sees: \"P \\<turnstile> C sees M,b:Ts \\<rightarrow> T = (mxs,mxl\\<^sub>0,ins,xt) in C\"\nshows \"0 < size ins \\<and> wt_start P C b Ts mxl\\<^sub>0 (\\<Phi> C M)\"\n(*<*)\nproof -\n  have wfm: \"wf_prog\n     (\\<lambda>P C (M, b, Ts, T\\<^sub>r, mxs, mxl\\<^sub>0, is, xt).\n         wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (\\<Phi> C M)) P\" using wf\n    by (unfold wf_jvm_prog_phi_def)\n  show ?thesis using sees_wf_mdecl[OF wfm sees]\n    by (simp add: wf_mdecl_def wt_method_def)\nqed\n(*>*)\n\nlemma wf_jvm_prog_nclinit:\nassumes wtp: \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\"\n  and meth:  \"P \\<turnstile> C sees M, b :  Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, ins, xt) in D\"\n  and wt:    \"P,T,mxs,size ins,xt \\<turnstile> ins!pc,pc :: \\<Phi> C M\"\n  and pc:    \"pc < length ins\" and \\<Phi>: \"\\<Phi> C M ! pc = Some(ST,LT)\"\n  and ins:   \"ins ! pc = Invokestatic C\\<^sub>0 M\\<^sub>0 n\"\nshows \"M\\<^sub>0 \\<noteq> clinit\"\n using assms by(simp add: wf_jvm_prog_phi_def wt_instr_def app_def)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/BV/BVSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.63341027751814, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3290701447142662}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                 August 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2009-2       |\n            |                October 2010  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2016         |\n            |                    May 2016  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory Domain_F_cms\nimports Domain_F Domain_T_cms Set_F_cms RS_pair RS_prod\nbegin\n\n(*****************************************************************\n\n         1. \n         2. \n         3. \n         4. \n\n *****************************************************************)\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n\n(*********************************************************\n                 Restriction in Dom_F\n *********************************************************)\n\n(*\ninstance domF :: (type) ms0\nby (intro_classes)\n*)\n\ndefinition\n restTF  :: \"'a domF => nat => 'a domTsetF\" (\"_ restTF _\" [84,900] 84)\n where\n restTF_def  : \n   \"F restTF n == (Rep_domF F) .|. n\"\n \ndefinition\n LimitTF :: \"'a domF infinite_seq => 'a domTsetF\"\n where\n  LimitTF_def : \n   \"LimitTF Fs == pair_Limit (Rep_domF o Fs)\"\n \ndefinition \n Limit_domF     :: \"'a domF infinite_seq => 'a domF\"\n where\n  Limit_domF_def     :\n   \"Limit_domF Fs == Abs_domF (LimitTF Fs)\"\n\n(* isabelle 2009-2 *)\n\ninstantiation domF :: (type) rs0\nbegin\n\ndefinition\n  rest_domF_def : \"F .|. n == Abs_domF (F restTF n)\"\n  instance ..\nend\n\n(*\ndefs (overloaded)\n  rest_domF_def : \"F .|. n == Abs_domF (F restTF n)\"\n*)\n\n(*********************************************************\n              Lemmas (Restriction in Dom_F)\n *********************************************************)\n\n(*** restTF (T2) ***)\n\nlemma restTF_T2: \"HC_T2 (F restTF n)\"\napply (simp add: HC_T2_def restTF_def)\napply (intro allI impI)\napply (simp add: pair_restriction_def)\n\napply (simp add: in_rest_domT)\napply (simp add: in_rest_setF)\nby (auto simp add: domTsetF_T2)\n\n(*** restTF (F3) ***)\n\nlemma restTF_F3: \"HC_F3 (F restTF n)\"\napply (simp add: HC_F3_def restTF_def)\napply (intro allI impI)\napply (simp add: pair_restriction_def)\n\napply (simp add: in_rest_domT)\napply (simp add: in_rest_setF)\nby (auto simp add: domTsetF_F3)\n\n(*** restTF (T3_F4) ***)\n\nlemma restTF_T3_F4: \"HC_T3_F4 (F restTF n)\"\napply (simp add: HC_T3_F4_def restTF_def)\napply (intro allI impI)\napply (simp add: pair_restriction_def)\n\napply (simp add: in_rest_domT)\napply (simp add: in_rest_setF)\napply (elim conjE)\nby (auto simp add: domTsetF_T3 domTsetF_F4)\n\n(*** restTF in domF ***)\n\nlemma restTF_in[simp]: \"F restTF n : domF\"\napply (simp add: domF_iff)\napply (simp add: restTF_T2)\napply (simp add: restTF_F3)\napply (simp add: restTF_T3_F4)\ndone\n\n(*********************************************************\n                     Dom_F --> RS\n *********************************************************)\n\n(*** rest_domF --> restTF ***)\n\nlemma Rep_rest_domF: \n  \"((F::'a domF) .|. n = E .|. m) =\n   ((Rep_domF F) .|. n = (Rep_domF E) .|. m)\"\napply (simp add: rest_domF_def)\napply (simp add: Abs_domF_inject)\napply (simp add: restTF_def)\ndone\n\n(*** zero_eq_rs_domF ***)\n\nlemma zero_eq_rs_domF: \"(F::'a domF) .|. 0 = E .|. 0\"\nby (simp add: Rep_rest_domF)\n\n(*** min_rs_domF ***)\n\nlemma min_rs_domF:\n  \"((F::'a domF) .|. m) .|. n = F .|. (min m n)\"\napply (simp add: Rep_rest_domF)\napply (simp add: rest_domF_def)\napply (simp add: Abs_domF_inverse)\napply (simp add: restTF_def)\napply (simp add: min_rs)\ndone\n\n(*** diff_rs_domF ***)\n\nlemma diff_rs_domF: \n  \"(F::'a domF) ~= E ==> (EX (n::nat). F .|. n ~= E .|. n)\"\napply (simp add: Rep_rest_domF)\napply (simp add: Rep_domF_inject[THEN sym])\napply (simp add: diff_rs)\ndone\n\n(***************************************************************\n                        domF ==> RS\n ***************************************************************)\n\ninstance domF :: (type) rs\napply (intro_classes)\napply (simp add: zero_eq_rs_domF)\napply (simp add: min_rs_domF)\napply (simp add: diff_rs_domF)\ndone\n\n(************************************************************\n                        domF ==> MS\n ************************************************************)\n\ninstantiation domF :: (type) ms0\nbegin\n\ndefinition\n  domF_distance_def:\n     \"distance (FF::('a domF * 'a domF)) = distance_rs FF\"\n  instance ..\nend\n\ninstance domF :: (type) ms\napply (intro_classes)\napply (simp_all add: domF_distance_def)\napply (simp add: diagonal_rs)\napply (simp add: symmetry_rs)\napply (simp add: triangle_inequality_rs)\ndone\n\n(************************************************************\n                 i.e.  domF ==> MS & RS \n ************************************************************)\n\ninstance domF :: (type) ms_rs\napply (intro_classes)\napply (simp add: domF_distance_def)\ndone\n\n\n(********************************************************** \n                      .|. decompo \n **********************************************************)\n\nlemma rest_decompo_domF:\n   \"(SF1 .|. n = SF2 .|. m)\n   = ((fstF SF1 .|. n = fstF SF2 .|. m &\n       sndF SF1 .|. n = sndF SF2 .|. m))\"\napply (simp add: rest_domF_def)\napply (simp add: Abs_domF_inject)\napply (simp add: restTF_def)\napply (simp add: pair_restriction_def)\napply (simp add: fold_fstF)\napply (simp add: fold_sndF)\ndone\n\n(***********************************************************\n                    lemmas (distance)\n ***********************************************************)\n\n(*** distance ***)\n\nlemma distance_Rep_domF:\n  \"distance((F::'a domF), E) = distance(Rep_domF F, Rep_domF E)\"\napply (simp add: to_distance_rs)\napply (simp add: Rep_rest_domF rest_distance_eq)\ndone\n\nlemma distance_Abs_domF:\n  \"[| (T1, F1) : domF ; (T2, F2) : domF |]\n   ==> distance (Abs_domF (T1, F1), Abs_domF (T2, F2))\n     = distance ((T1, F1), T2, F2)\"\nby (simp add: distance_Rep_domF Abs_domF_inverse)\n\n(*** normal ***)\n\nlemma normal_domF:\n  \"normal (Fs::'a domF infinite_seq) = normal (Rep_domF o Fs)\"\nby (simp add: normal_def distance_Rep_domF)\n\nlemma normal_domF_only_if:\n  \"normal (Fs::'a domF infinite_seq) ==> normal (Rep_domF o Fs)\"\nby (simp add: normal_domF)\n\n(* T and F *)\n\nlemma normal_of_domF:\n  \"normal (Fs::'a domF infinite_seq)\n   ==> (normal (fstF o Fs) & normal (sndF o Fs))\"\napply (simp add: normal_domF)\napply (simp add: fstF_def sndF_def)\napply (simp add: o_assoc[THEN sym])\napply (simp add: pair_normal_seq)\ndone\n\n(*** cauchy ***)\n\nlemma cauchy_domF:\n  \"cauchy (Fs::'a domF infinite_seq) = cauchy (Rep_domF o Fs)\"\nby (simp add: cauchy_def distance_Rep_domF)\n\nlemma cauchy_domF_only_if:\n  \"cauchy (Fs::'a domF infinite_seq) ==> cauchy (Rep_domF o Fs)\"\nby (simp add: cauchy_domF)\n\n(* T and F *)\n\nlemma cauchy_of_domF:\n  \"cauchy (Fs::'a domF infinite_seq)\n   ==> (cauchy (fstF o Fs) & cauchy (sndF o Fs))\"\napply (simp add: cauchy_domF)\napply (simp add: fstF_def sndF_def)\napply (simp add: o_assoc[THEN sym])\napply (simp add: pair_cauchy_seq)\ndone\n\n(***********************************************************\n                      lemmas (Limit)\n ***********************************************************)\n\n(*** convergeTo domF ***)\n\nlemma convergeTo_domF:\n  \"[| (Rep_domF o Fs) convergeTo TF ; TF : domF |]\n   ==> Fs convergeTo Abs_domF TF\"\napply (simp add: convergeTo_def)\napply (intro allI impI)\napply (drule_tac x=\"eps\" in spec)\napply (simp)\napply (erule exE)\napply (rule_tac x=\"n\" in exI)\napply (intro allI impI)\napply (drule_tac x=\"m\" in spec)\n\napply (simp add: distance_Rep_domF)\napply (simp add: Abs_domF_inverse)\ndone\n\n(*** LimitTF ***)\n\nlemma LimitTF_iff:\n  \"normal (Rep_domF o Fs) \n      ==> pair_Limit (Rep_domF o Fs)\n           = (Limit_domT (fstF o Fs) , Limit_setF (sndF o Fs))\"\napply (simp add: pair_Limit_def)\napply (simp add: fstF_def sndF_def)\napply (simp add: o_assoc[THEN sym])\napply (simp add: pair_normal_seq Limit_domT_Limit_eq Limit_setF_Limit_eq)\ndone\n\n(*******************************\n      LimitTF in domF\n *******************************)\n\n(*** F4 ***)\n\nlemma LimitTF_F4:\n  \"normal Fs ==> HC_F4 (Limit_domT (fstF o Fs) , Limit_setF (sndF o Fs))\"\napply (simp add: HC_F4_def)\napply (intro allI impI)\n\napply (simp add: normal_of_domF Limit_domT_memT)\napply (simp add: normal_of_domF Limit_setF_memF)\n\napply (subgoal_tac \"(Rep_domF (Fs (lengtht (s ^^^ <Tick>)))) : domF\")\napply (simp add: domF_def HC_F4_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (simp add: fstF_def sndF_def)\nby (simp)\n\n(*** T3 ***)\n\nlemma LimitTF_T3:\n  \"normal Fs ==> HC_T3 (Limit_domT (fstF o Fs) , Limit_setF (sndF o Fs))\"\napply (simp add: HC_T3_def)\napply (intro allI impI)\napply (simp add: normal_of_domF Limit_domT_memT)\napply (simp add: normal_of_domF Limit_setF_memF)\n\napply (subgoal_tac \"(Rep_domF (Fs (lengtht (s ^^^ <Tick>)))) : domF\")\napply (simp add: domF_def HC_T3_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (simp add: fstF_def sndF_def)\napply (rule disjI2)\napply (rule_tac x=\"s\" in exI)\napply (simp)\nby (simp)\n\n(*** F3 ***)\n\nlemma LimitTF_F3:\n  \"normal Fs ==> HC_F3 (Limit_domT (fstF o Fs) , Limit_setF (sndF o Fs))\"\napply (simp add: HC_F3_def)\napply (intro allI impI)\n\napply (simp add: normal_of_domF Limit_domT_memT)\napply (simp add: normal_of_domF Limit_setF_memF)\napply (elim conjE disjE)\n\napply (subgoal_tac \"(Rep_domF (Fs (Suc (lengtht s)))) : domF\")\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"Y\" in spec)\napply (simp add: fstF_def sndF_def)\napply (simp)\n\napply (erule exE)\napply (simp)\ndone\n\n(*** T2 ***)\n\nlemma LimitTF_T2:\n  \"normal Fs ==> HC_T2 (Limit_domT (fstF o Fs) , Limit_setF (sndF o Fs))\"\napply (simp add: HC_T2_def)\napply (intro allI impI)\n\napply (simp add: normal_of_domF Limit_domT_memT)\napply (simp add: normal_of_domF Limit_setF_memF)\napply (elim exE disjE)\n\napply (subgoal_tac \"(Rep_domF (Fs (Suc (lengtht s)))) : domF\")\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (simp add: fstF_def sndF_def)\napply (drule mp)\napply (rule_tac x=\"X\" in exI, simp)\napply (rule normal_seq_domT_if)\n apply (subgoal_tac \"(%u. fst (Rep_domF (Fs u))) = (fstF o Fs )\")\n apply (simp add: normal_of_domF)\n apply (simp add: fun_eq_iff fstF_def)\n apply (simp_all)\n\n(* *)\n\napply (elim conjE exE)\napply (subgoal_tac \"(Rep_domF (Fs (lengtht s))) : domF\")\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (simp add: fstF_def sndF_def)\napply (drule mp)\napply (rule_tac x=\"X\" in exI, simp)\napply (simp_all)\ndone\n\n(*** Limit_domFpari_in ***)\n\nlemma LimitTF_in:\n  \"normal Fs ==> LimitTF Fs : domF\"\napply (simp add: LimitTF_def)\napply (simp add: LimitTF_iff normal_domF_only_if)\napply (simp add: domF_def)\napply (simp add: LimitTF_F4)\napply (simp add: LimitTF_T3)\napply (simp add: LimitTF_F3)\napply (simp add: LimitTF_T2)\ndone\n\n(*** (normal) Fs converges to (Limit_domF Fs) ***)\n\nlemma Limit_domF_Limit: \"normal Fs ==> Fs convergeTo (Limit_domF Fs)\"\napply (simp add: Limit_domF_def)\napply (rule convergeTo_domF)\napply (simp add: LimitTF_def)\napply (simp add: pair_cms_cauchy_Limit normal_cauchy normal_domF)\n\nby (simp add: LimitTF_in)\n\n(*** (cauchy) Fs converges to (Limit_domF NF Fs) ***)\n\nlemma cauchy_Limit_domF_Limit:\n  \"cauchy Fs ==> Fs convergeTo (Limit_domF (NF Fs))\"\nby (simp add: Limit_domF_Limit normal_form_seq_same_Limit normal_form_seq_normal)\n\n(**************************************\n    Dom_F --> Complete Metric Space\n **************************************)\n\nlemma domF_cms:\n  \"cauchy (Fs::'a domF infinite_seq) ==> (EX F. Fs convergeTo F)\"\napply (rule_tac x=\"Limit_domF (NF Fs)\" in exI)\nby (simp add: cauchy_Limit_domF_Limit)\n\n(************************************************************\n                   domF ==> CMS and RS\n ************************************************************)\n\ninstance domF :: (type) cms\napply (intro_classes)\nby (simp add: domF_cms)\n\ninstance domF :: (type) cms_rs\nby (intro_classes)\n\n(*** (normal) Limit Fs = Limit_domF Fs ***)\n\nlemma Limit_domF_Limit_eq:\n  \"normal (Fs::'a domF infinite_seq) ==> Limit Fs = Limit_domF Fs\"\napply (rule unique_convergence[of Fs])\nby (simp_all add: Limit_domF_Limit Limit_is normal_cauchy)\n\n(************************************************************\n                 .|. domF decompostion\n ************************************************************)\n\nlemma rest_domF_decompo_sub:\n   \"ALL x. (f x, g x): domF ==>\n     ((f x1 ,, g x1) .|. n <= ((f x2 ,, g x2) .|. n))\n   = (f x1 .|. n <= f x2 .|. n &\n      g x1 .|. n <= g x2 .|. n)\"\napply (simp add: rest_domF_def)\napply (simp add: subdomF_def)\napply (simp add: Abs_domF_inverse)\n\napply (simp add: pairF_def)\napply (simp add: restTF_def)\napply (simp add: Abs_domF_inverse)\napply (simp add: pair_restriction_def)\napply (simp add: order_pair_def)\ndone\n\nlemma rest_domF_decompo:\n   \"ALL x. (f x, g x): domF ==>\n     ((f x1 ,, g x1) .|. n = ((f x2 ,, g x2) .|. n))\n   = (f x1 .|. n = f x2 .|. n &\n      g x1 .|. n = g x2 .|. n)\"\napply (rule)\napply (simp add: order_eq_iff)\napply (simp add: rest_domF_decompo_sub)\napply (simp add: order_eq_iff)\napply (simp add: rest_domF_decompo_sub)\ndone\n\n(************************************************************\n                  map domF decompostion\n ************************************************************)\n\n(* Abs_domF *)\n\nlemma map_alpha_Abs_domF:\n  \"ALL x. (f x, g x): domF ==>\n   map_alpha (%x. (f x,, g x)) alpha = map_alpha (f ** g) alpha\"\napply (simp add: pairF_def)\napply (simp add: contraction_alpha_def map_alpha_def)\napply (simp add: pair_fun_def)\napply (simp add: distance_Abs_domF)\ndone\n\n(* decompo *)\n\nlemma map_alpha_domF_decompo:\n  \"ALL (x::'a::ms_rs). (f x, g x): domF ==>\n   map_alpha  (%x. (f x,, g x)) alpha = \n   (map_alpha f alpha & map_alpha g alpha)\"\napply (simp add: map_alpha_Abs_domF)\napply (simp add: pair_map_alpha_compo)\ndone\n\nlemma non_expanding_domF_decompo:\n  \"ALL (x::'a::ms_rs). (f x, g x): domF ==>\n   non_expanding (%x. (f x,, g x)) =\n   (non_expanding f & non_expanding g)\"\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_domF_decompo)\ndone\n\nlemma contraction_alpha_domF_decompo:\n  \"ALL (x::'a::ms_rs). (f x, g x): domF ==>\n   contraction_alpha (%x. (f x,, g x)) alpha =\n   (contraction_alpha f alpha & contraction_alpha g alpha)\"\napply (simp add: contraction_alpha_def)\napply (simp add: map_alpha_domF_decompo)\napply (auto)\ndone\n\n(********************************************************** \n                non expanding (op o fstF)\n **********************************************************)\n\nlemma non_expanding_Rep_domF: \"non_expanding Rep_domF\"\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (simp add: distance_Rep_domF)\ndone\n\nlemma non_expanding_fstF: \"non_expanding fstF\"\napply (simp add: fstF_def)\napply (rule compo_non_expand)\napply (simp add: fst_non_expand)\napply (simp add: non_expanding_Rep_domF)\ndone\n\nlemma non_expanding_sndF: \"non_expanding sndF\"\napply (simp add: sndF_def)\napply (rule compo_non_expand)\napply (simp add: snd_non_expand)\napply (simp add: non_expanding_Rep_domF)\ndone\n\nlemma non_expanding_op_fstF: \"non_expanding (op o fstF)\"\napply (simp add: prod_non_expand)\napply (insert non_expanding_fstF)\napply (simp add: proj_fun_def)\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (intro allI)\napply (drule_tac x=\"x i\" in spec)\napply (drule_tac x=\"y i\" in spec)\napply (rule order_trans)\napply (simp)\n\napply (subgoal_tac \"non_expanding (proj_fun i)\")\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (simp add: proj_fun_def)\napply (fast)\n\napply (simp add: proj_non_expand)\ndone\n\nlemma non_expanding_op_sndF: \"non_expanding (op o sndF)\"\napply (simp add: prod_non_expand)\napply (insert non_expanding_sndF)\napply (simp add: proj_fun_def)\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (intro allI)\napply (drule_tac x=\"x i\" in spec)\napply (drule_tac x=\"y i\" in spec)\napply (rule order_trans)\napply (simp)\n\napply (subgoal_tac \"non_expanding (proj_fun i)\")\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (simp add: proj_fun_def)\napply (fast)\n\napply (simp add: proj_non_expand)\ndone\n\n(*** distance ***)\n\nlemma distance_fstF_compo_le: \n  \"distance (fstF o x, fstF o y) <= distance (x, y)\"\napply (insert non_expanding_op_fstF)\napply (simp add: non_expanding_def)\napply (simp add: map_alpha_def)\napply (auto)\ndone\n\nlemma alpha_distance_fstF_compo_le: \n  \"0 <= alpha ==> alpha * distance (fstF o x, fstF o y) <= alpha * distance (x, y)\"\napply (insert mult_left_mono\n       [of \"distance (fstF o x, fstF o y)\" \"distance (x, y)\" \"alpha\" ])\napply (simp add: distance_fstF_compo_le)\ndone\n\n(*----------------------------------------------------------*\n |                                                          |\n |                       cms rs order                       |\n |                                                          |\n *----------------------------------------------------------*)\n\ninstance domF :: (type) ms_rs_order0\napply (intro_classes)\ndone\n\ninstance domF :: (type) ms_rs_order\napply (intro_classes)\napply (intro allI)\napply (rule iffI)\napply (simp add: rest_domF_def)\napply (simp add: subdomF_def)\napply (simp add: Abs_domF_inverse)\napply (simp add: restTF_def)\napply (simp add: pair_restriction_def)\napply (simp add: order_pair_def)\napply (erule dist_ALL_conjE)\napply (simp add: rs_order_iff)\n\napply (intro allI)\napply (simp add: rest_domF_def)\napply (simp add: subdomF_def)\napply (simp add: Abs_domF_inverse)\napply (simp add: restTF_def)\napply (simp add: pair_restriction_def)\napply (simp add: order_pair_def)\napply (simp add: rs_order_if)\ndone\n\ninstance domF :: (type) cms_rs_order\nby (intro_classes)\n\n(*----------------------------------------------------------*\n |                                                          |\n |  i.e. lemma \"continuous_rs (Ref_fun (S::'a domF))\"       |\n |       by (simp add: continuous_rs_Ref_fun)               |\n |                                                          |\n |  see RS.thy                                              |\n |                                                          |\n *----------------------------------------------------------*)\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/Domain_F_cms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.63341027751814, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3290701447142662}}
{"text": "(*  Title:       The Embedding Path Order for Lambda-Free Higher-Order Terms\n    Author:      Alexander Bentkamp <a.bentkamp at vu.nl>, 2018\n    Maintainer:  Alexander Bentkamp <a.bentkamp at vu.nl>\n*)\n\nsection \\<open>The Embedding Path Order for Lambda-Free Higher-Order Terms\\<close>\n\ntheory Lambda_Free_EPO\nimports Chop Nested_Multisets_Ordinals.Multiset_More\nabbrevs \">t\" = \">\\<^sub>t\"\n  and \"\\<ge>t\" = \"\\<ge>\\<^sub>t\"\nbegin\n\ntext \\<open>\nThis theory defines the embedding path order for \\<open>\\<lambda>\\<close>-free\nhigher-order terms.\n\\<close>\n\nsubsection \\<open>Setup\\<close>\n\nlocale epo = ground_heads \"(>\\<^sub>s)\" arity_sym arity_var\n    for\n      gt_sym :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (infix \">\\<^sub>s\" 50) and\n      arity_sym :: \"'s \\<Rightarrow> enat\" and\n      arity_var :: \"'v \\<Rightarrow> enat\" +\n  fixes\n    extf :: \"'s \\<Rightarrow> (('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool) \\<Rightarrow> ('s, 'v) tm list \\<Rightarrow> ('s, 'v) tm list \\<Rightarrow> bool\"\n  assumes\n    extf_ext_trans_before_irrefl: \"ext_trans_before_irrefl (extf f)\" and\n    extf_ext_compat_list: \"ext_compat_list (extf f)\"\n  assumes extf_ext_compat_snoc: \"ext_compat_snoc (extf f)\"\n  assumes extf_ext_compat_cons: \"ext_compat_cons (extf f)\"\n  assumes extf_ext_snoc: \"ext_snoc (extf f)\"\n  assumes extf_min_empty: \"\\<not> extf f gt [] ss\" (* TODO: seperate definition? *)\nbegin\n\nlemma extf_ext_trans: \"ext_trans (extf f)\"\n  by (rule ext_trans_before_irrefl.axioms(1)[OF extf_ext_trans_before_irrefl])\n\nlemma extf_ext: \"ext (extf f)\"\n  by (rule ext_trans.axioms(1)[OF extf_ext_trans])\n\nlemmas extf_mono_strong = ext.mono_strong[OF extf_ext]\nlemmas extf_mono = ext.mono[OF extf_ext, mono]\nlemmas extf_map = ext.map[OF extf_ext]\nlemmas extf_trans = ext_trans.trans[OF extf_ext_trans]\nlemmas extf_irrefl_from_trans =\n  ext_trans_before_irrefl.irrefl_from_trans[OF extf_ext_trans_before_irrefl]\nlemmas extf_compat_list = ext_compat_list.compat_list[OF extf_ext_compat_list]\n\nlemmas extf_snoc = ext_snoc.snoc[OF extf_ext_snoc]\n\nlemmas extf_compat_append_right = ext_compat_snoc.compat_append_right[OF extf_ext_compat_snoc]\nlemmas extf_compat_append_left = ext_compat_cons.compat_append_left[OF extf_ext_compat_cons]\n\nlemma extf_ext_insert_arg: \"extf f gt (xs @ z # ys) (xs @ ys)\" \n  using extf_compat_append_left extf_compat_append_right extf_snoc[of f gt Nil z] \n  by fastforce\n\nsubsection \\<open>Inductive Definitions\\<close>\n\ndefinition\n  chkchop :: \"(('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool) \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\"\nwhere\n  [simp]: \"chkchop gt t s \\<longleftrightarrow> is_Hd s \\<or> gt t (chop s)\"\n\ndefinition\n  chkchop_same :: \"(('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool) \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\"\nwhere\n  [simp]: \"chkchop_same gt t s \\<longleftrightarrow> \n            (if is_Var (head t) \n            then is_Hd t \\<or> chkchop gt (chop t) s \n            else chkchop gt t s)\"\n\nlemma chkchop_mono[mono]: \"gt \\<le> gt' \\<Longrightarrow> chkchop gt \\<le> chkchop gt'\"\n  using chkchop_def by blast\n\nlemma chkchop_same_mono[mono]: \"gt \\<le> gt' \\<Longrightarrow> chkchop_same gt \\<le> chkchop_same gt'\"\n  using chkchop_same_def by fastforce\n\ninductive gt :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" (infix \">\\<^sub>t\" 50) where\n  gt_chop: \"is_App t \\<Longrightarrow> chop t >\\<^sub>t s \\<or> chop t = s \\<Longrightarrow> t >\\<^sub>t s\"\n| gt_diff: \"head t >\\<^sub>h\\<^sub>d head s \\<Longrightarrow> is_Sym (head s) \\<Longrightarrow> chkchop (>\\<^sub>t) t s \\<Longrightarrow> t >\\<^sub>t s\"\n| gt_same: \"head t = head s \\<Longrightarrow> chkchop_same (>\\<^sub>t) t s \\<Longrightarrow>\n    (\\<forall>f \\<in> ground_heads (head t). extf f (>\\<^sub>t) (args t) (args s)) \\<Longrightarrow> t >\\<^sub>t s\"\n\nabbreviation ge :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" (infix \"\\<ge>\\<^sub>t\" 50) where\n  \"t \\<ge>\\<^sub>t s \\<equiv> t >\\<^sub>t s \\<or> t = s\"\n\ninductive gt_chop :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" where\n  gt_chopI: \"is_App t \\<Longrightarrow> chop t \\<ge>\\<^sub>t s \\<Longrightarrow> gt_chop t s\"\n\ninductive gt_diff :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" where\n  gt_diffI: \"head t >\\<^sub>h\\<^sub>d head s \\<Longrightarrow> is_Sym (head s) \\<Longrightarrow> chkchop (>\\<^sub>t) t s \\<Longrightarrow> gt_diff t s\"\n\ninductive gt_same :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" where\n  gt_sameI: \"head t = head s \\<Longrightarrow> chkchop_same (>\\<^sub>t) t s \\<Longrightarrow>\n    (\\<forall>f \\<in> ground_heads (head t). extf f (>\\<^sub>t) (args t) (args s)) \\<Longrightarrow> gt_same t s\"\n\nlemma gt_iff_chop_diff_same: \"t >\\<^sub>t s \\<longleftrightarrow> gt_chop t s \\<or> gt_diff t s \\<or> gt_same t s\"\n  by (subst gt.simps) (auto simp: gt_chop.simps gt_diff.simps gt_same.simps)\n\nsubsection \\<open>Transitivity\\<close>\n\nlemma t_gt_chop_t: \"is_App t \\<Longrightarrow> t >\\<^sub>t chop t\"\n  by (simp add: gt_chop)\n\nlemma gt_imp_vars: \"t >\\<^sub>t s \\<Longrightarrow> vars t \\<supseteq> vars s\"\nproof (simp only: atomize_imp,\n    rule measure_induct_rule[of \"\\<lambda>(t, s). hsize t + hsize s\"\n      \"\\<lambda>(t, s). t >\\<^sub>t s \\<longrightarrow> vars t \\<supseteq> vars s\" \"(t, s)\", simplified prod.case],\n    simp only: split_paired_all prod.case atomize_imp[symmetric])\n  fix t s\n  assume\n    ih: \"\\<And>ta sa. hsize ta + hsize sa < hsize t + hsize s \\<Longrightarrow> ta >\\<^sub>t sa \\<Longrightarrow> vars ta \\<supseteq> vars sa\" and\n    t_gt_s: \"t >\\<^sub>t s\"\n  show \"vars t \\<supseteq> vars s\"\n    using t_gt_s\n  proof cases\n    case (gt_chop)\n    thus ?thesis\n      using ih\n      by (metis add_mono_thms_linordered_field(1) le_supI1 order_refl hsize_chop_lt vars_chop)\n  next\n    case gt_diff\n    show ?thesis \n    proof (cases s)\n      case Hd\n      thus ?thesis\n        using gt_diff(2) \n        by (metis empty_iff hd.collapse(2) hd.simps(18) subsetI tm.sel(1) tm.simps(17))\n    next\n      case (App s1 s2)\n      have \"vars (chop s) \\<subseteq> vars t\" using ih \n        using App chkchop_def local.gt_diff(3) nat_add_left_cancel_less hsize_chop_lt tm.disc(2) by blast\n      thus ?thesis \n        using  App  le_sup_iff local.gt_diff(2) tm.disc(2) vars_chop\n        by (metis empty_iff hd.collapse(2) hd.simps(18) subsetI)\n    qed\n  next\n    case gt_same\n    thus ?thesis\n    proof (cases \"head t\")\n      case (Var x)\n      then show ?thesis \n      proof (cases t)\n        case (Hd _)\n        then show ?thesis using gt_same extf_min_empty[of _ \"(>\\<^sub>t)\" \"args s\"]\n          by simp\n      next\n        case (App t1 t2)\n        then show ?thesis\n        proof (cases s)\n          case (Hd _)\n          then show ?thesis \n            using local.gt_same(1) vars_head_subseteq by fastforce\n        next\n          case (App s1 s2)\n          then have \"chop t >\\<^sub>t chop s\" \n            by (metis Var args.simps(1) chkchop_def chkchop_same_def epo.extf_min_empty \n                epo_axioms gt_hd_def gt_hd_irrefl hd.disc(1) local.gt_same(2) local.gt_same(3) tm.collapse(1) tm.disc(2))\n          then have \"vars (chop s) \\<subseteq> vars (chop t)\" using ih[OF _ \\<open>chop t >\\<^sub>t chop s\\<close>] \n            by (metis App add_mono_thms_linordered_field(5) args_Nil_iff_is_Hd extf_min_empty gt_hd_def gt_hd_irrefl local.gt_same(3) hsize_chop_lt tm.disc(2))\n          then show ?thesis using  gt_same(1) vars_chop[of t] vars_chop[of s]\n            by (metis App args_Nil_iff_is_Hd extf_min_empty gt_hd_def gt_hd_irrefl le_sup_iff local.gt_same(3) order_refl sup.coboundedI1 tm.disc(2))\n        qed\n      qed\n    next\n      case (Sym f)\n      then have \"chkchop (>\\<^sub>t) t s\" using gt_same chkchop_same_def by auto\n      then show ?thesis \n      proof (cases s)\n        case (Hd _)\n        then show ?thesis using local.gt_same(1) vars_head_subseteq by force \n      next\n        case (App s1 s2)\n        then show ?thesis unfolding chkchop_def using vars_chop ih[of t \"chop s\"] \n          by (metis \\<open>chkchop (>\\<^sub>t) t s\\<close> chkchop_def le_sup_iff local.gt_same(1) \n              nat_add_left_cancel_less hsize_chop_lt tm.disc(2) vars_head_subseteq)\n      qed\n    qed\n  qed      \nqed  \n\nlemma gt_trans: \"u >\\<^sub>t t \\<Longrightarrow> t >\\<^sub>t s \\<Longrightarrow> u >\\<^sub>t s\"\nproof (simp only: atomize_imp,\n    rule measure_induct_rule[of \"\\<lambda>(u, t, s). {#hsize u, hsize t, hsize s#}\"\n        \"\\<lambda>(u, t, s). u >\\<^sub>t t \\<longrightarrow> t >\\<^sub>t s \\<longrightarrow> u >\\<^sub>t s\" \"(u, t, s)\",\n      simplified prod.case],\n    simp only: split_paired_all prod.case atomize_imp[symmetric])\n  fix u t s\n  assume\n    ih: \"\\<And>ua ta sa. {#hsize ua, hsize ta, hsize sa#} < {#hsize u, hsize t, hsize s#} \\<Longrightarrow>\n      ua >\\<^sub>t ta \\<Longrightarrow> ta >\\<^sub>t sa \\<Longrightarrow> ua >\\<^sub>t sa\" and\n    u_gt_t: \"u >\\<^sub>t t\" and t_gt_s: \"t >\\<^sub>t s\"\n\n  have u_gt_s_if_ui: \"chop u \\<ge>\\<^sub>t t \\<Longrightarrow> u >\\<^sub>t s\" if ui_in: \"is_App u\"\n    using ih[of \"chop u\" t s, simplified] t_gt_s gt_chop hsize_chop_lt ui_in by blast\n\n  show \"u >\\<^sub>t s\"\n    using t_gt_s\n  proof cases\n    case gt_chop\n    have u_gt_s_if_chk_u_t: ?thesis if chk_u_t: \"chkchop (>\\<^sub>t) u t\"\n      using ih[of u \"chop u\" s] gt_chop chk_u_t \n      by (metis add_mset_lt_left_lt add_mset_lt_right_lt chkchop_def ih hsize_chop_lt)\n    show ?thesis \n      by (metis args_Nil_iff_is_Hd chkchop_def chkchop_same_def \n          epo.extf_min_empty epo_axioms gt.simps gt_hd_def gt_hd_irrefl\n          u_gt_s_if_chk_u_t u_gt_s_if_ui u_gt_t)\n  next\n    case gt_diff_t_s: gt_diff\n    show ?thesis\n      using u_gt_t\n    proof cases\n      case gt_chop\n      then show ?thesis \n        using u_gt_s_if_ui by blast\n    next\n      case gt_diff_u_t: gt_diff\n      have \"head u >\\<^sub>h\\<^sub>d head s\"\n        using gt_diff_u_t(1) gt_diff_t_s(1) by (auto intro: gt_hd_trans)\n      thus ?thesis\n        using add_mset_lt_left_lt add_mset_lt_right_lt chkchop_def  gt_diff gt_diff_t_s(3) ih hsize_chop_lt u_gt_t\n        by (metis gt_diff_t_s(2))\n    next\n      case gt_same_u_t: gt_same\n      have \"head u >\\<^sub>h\\<^sub>d head s\"\n        using gt_diff_t_s(1) gt_same_u_t(1) by auto\n      thus ?thesis\n        using add_mset_lt_left_lt add_mset_lt_right_lt chkchop_def gt_diff gt_diff_t_s(3) ih hsize_chop_lt u_gt_t\n        by (metis gt_diff_t_s(2))\n    qed\n  next\n    case gt_same_t_s: gt_same\n    show ?thesis\n      using u_gt_t\n    proof cases\n      case gt_chop\n      then show ?thesis \n        using u_gt_s_if_ui by linarith\n    next\n      case gt_diff_u_t: gt_diff\n      have \"head u >\\<^sub>h\\<^sub>d head s\"\n        using gt_diff_u_t(1) gt_same_t_s(1) by simp\n      thus ?thesis\n        using add_mset_lt_left_lt add_mset_lt_right_lt chkchop_def gt_diff gt_same_t_s ih hsize_chop_lt u_gt_t\n        by (metis chkchop_same_def gt_diff_u_t(2))\n    next\n      case gt_same_u_t: gt_same\n      have hd_u_s: \"head u = head s\"\n        using gt_same_u_t(1) gt_same_t_s(1) by simp\n\n      let ?S = \"set (args u) \\<union> set (args t) \\<union> set (args s)\"\n\n      have gt_trans_args: \"\\<forall>ua \\<in> ?S. \\<forall>ta \\<in> ?S. \\<forall>sa \\<in> ?S. ua >\\<^sub>t ta \\<longrightarrow> ta >\\<^sub>t sa \\<longrightarrow> ua >\\<^sub>t sa\"\n      proof clarify\n        fix sa ta ua\n        assume\n          ua_in: \"ua \\<in> ?S\" and ta_in: \"ta \\<in> ?S\" and sa_in: \"sa \\<in> ?S\" and\n          ua_gt_ta: \"ua >\\<^sub>t ta\" and ta_gt_sa: \"ta >\\<^sub>t sa\"\n        show \"ua >\\<^sub>t sa\"\n          by (auto intro!: ih[OF Max_lt_imp_lt_mset ua_gt_ta ta_gt_sa])\n            (meson ua_in ta_in sa_in Un_iff max.strict_coboundedI1 max.strict_coboundedI2\n               hsize_in_args)+\n      qed\n\n      have \"\\<forall>f \\<in> ground_heads (head u). extf f (>\\<^sub>t) (args u) (args s)\"\n      proof (clarify, rule extf_trans[OF _ _ _ gt_trans_args])\n        fix f\n        assume f_in_grounds: \"f \\<in> ground_heads (head u)\"\n        show \"extf f (>\\<^sub>t) (args u) (args t)\"\n          using f_in_grounds gt_same_u_t(3) by blast\n        show \"extf f (>\\<^sub>t) (args t) (args s)\"\n          using f_in_grounds gt_same_t_s(3) unfolding gt_same_u_t(1) by blast\n      qed auto\n      have \"chkchop_same (>\\<^sub>t) u s\"\n      proof (cases \"head u\")\n        case (Var x)\n        then show ?thesis\n        proof (cases u)\n          case (Hd _)\n          then show ?thesis \n            using Var by auto\n        next\n          case (App u1 u2)\n          then have \"chop u >\\<^sub>t chop t\" \n            by (metis Var args.simps(1) chkchop_def chkchop_same_def epo.extf_min_empty epo_axioms gt_hd_def gt_hd_irrefl gt_same_t_s(3) gt_same_u_t(2) hd.disc(1) tm.collapse(1) tm.disc(2))\n          then show ?thesis\n          proof (cases t)\n            case (Hd _)\n            then show ?thesis \n              using extf_min_empty gt_same_t_s(3) by auto\n          next\n            case t_App: (App t1 t2)\n            then have \"is_App s \\<Longrightarrow> chop t >\\<^sub>t chop s\" \n              using gt_same_t_s unfolding chkchop_same_def unfolding chkchop_def using Var hd_u_s by auto\n            then have \"chkchop (>\\<^sub>t) (chop u) s\" \n              unfolding chkchop_def using ih[of \"chop u\" \"chop t\" \"chop s\"]\n              by (metis App \\<open>chop u >\\<^sub>t chop t\\<close> t_App add_mset_lt_lt_le less_imp_le mset_lt_single_iff hsize_chop_lt tm.disc(2))\n            then show ?thesis unfolding chkchop_same_def \n              using Var by auto\n          qed\n        qed\n      next\n        case (Sym f)\n        have \"chkchop (>\\<^sub>t) u s\" \n         proof (cases s)\n           case (Hd _)\n           then show ?thesis \n             by simp\n         next\n           case (App s1 s2)\n           then have \"t >\\<^sub>t chop s\"\n             using Sym gt_same_t_s(1) gt_same_t_s(2) hd_u_s by auto\n           then have \"u >\\<^sub>t chop s\" using ih[of u t \"chop s\"] \n             by (metis App add_mset_lt_right_lt mset_lt_single_iff hsize_chop_lt tm.disc(2) u_gt_t)\n           then show ?thesis unfolding chkchop_def\n             by blast\n         qed\n        then show ?thesis\n          by (simp add: Sym) \n      qed\n      thus ?thesis \n        using \\<open>\\<forall>f\\<in>local.ground_heads (head u). extf f (>\\<^sub>t) (args u) (args s)\\<close> gt_same hd_u_s by blast\n    qed\n  qed\nqed\n\nsubsection \\<open>Irreflexivity\\<close>\n\ntheorem gt_irrefl: \"\\<not> s >\\<^sub>t s\"\nproof (standard, induct s rule: measure_induct_rule[of hsize])\n  case (less s)\n  note ih = this(1) and s_gt_s = this(2)\n\n  show False\n    using s_gt_s\n  proof cases\n    case gt_chop\n    then show False using ih[of \"chop s\"]\n      by (metis gt.gt_chop gt_trans hsize_chop_lt)\n  next\n    case gt_diff\n    thus False\n      by (cases \"head s\") (auto simp: gt_hd_irrefl)\n  next\n    case gt_same\n    note in_grounds = this(3)\n\n    obtain si where si_in_args: \"si \\<in> set (args s)\" and si_gt_si: \"si >\\<^sub>t si\"\n      using in_grounds\n      by (metis (full_types) all_not_in_conv extf_irrefl_from_trans ground_heads_nonempty gt_trans)\n    have \"hsize si < hsize s\"\n      by (rule hsize_in_args[OF si_in_args])\n    thus False\n      by (rule ih[OF _ si_gt_si])\n  qed\nqed\n\nlemma gt_antisym: \"t >\\<^sub>t s \\<Longrightarrow> \\<not> s >\\<^sub>t t\"\n  using gt_irrefl gt_trans by blast\n\n\nsubsection \"Compatibility with Embedding Relation\"\n\n(* TODO: move? *)\nlemma nth_drop_lemma:\n  assumes \"length xs = length ys\"\nand \"k \\<le> length xs\"\nand \"\\<And>i. i < length xs \\<longrightarrow> i \\<ge> k \\<longrightarrow> xs ! i = ys ! i\"\nshows \"drop k xs = drop k ys\"\n  using assms proof (induct arbitrary:k rule:list_induct2)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons x xs y ys)\n  then show ?case proof (cases k)\n    case 0\n    then have \"x # xs =  y # ys\" \n      by (metis Cons.hyps(1) Cons.prems(2) leI length_Cons not_less_zero nth_equalityI)\n    then show ?thesis \n      by blast\n  next\n    case (Suc m)\n    then have \"drop m xs = drop m ys\" \n      by (metis Cons.hyps(2) Cons.prems(1) Cons.prems(2) Suc_le_mono Suc_mono length_Cons nth_Cons_Suc)\n    then show ?thesis \n      by (simp add: Suc)\n  qed\nqed\n\nlemma gt_embedding_step_property:\n  assumes \"t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b s\"\n  shows \"t >\\<^sub>t s\"\n  using assms \n  apply(simp only: atomize_imp)\n  apply (rule measure_induct_rule[of \"\\<lambda>(t, s). hsize t + hsize s\"\n      \"\\<lambda>(t, s). t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b s \\<longrightarrow> t >\\<^sub>t s\" \"(t, s)\", simplified prod.case])\nproof(simp only: split_paired_all prod.case atomize_imp[symmetric])\n  fix s t :: \"('s,'v) tm\" \n  assume \"t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b s\" \n    and ih: \"\\<And>tt ss. hsize tt + hsize ss < hsize t + hsize s \\<Longrightarrow> tt \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b ss \\<Longrightarrow> tt >\\<^sub>t ss\"\n  have \"is_App t\" \n    by (metis \\<open>t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b s\\<close> emb_step_at_is_App emb_step_equiv)\n\n  obtain p d where \"emb_step_at p d t = s\" \"position_of t (p @ [d])\"\n    using \\<open>t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b s\\<close> emb_step_equiv by (metis position_if_emb_step_at)\n  define q where q_rep_t: \"q = replicate (num_args (fun t)) Left\"\n\n  show \"t >\\<^sub>t s\"\n  proof (cases \"list_all (\\<lambda>x. x = Left) p\")\n    case True\n    show ?thesis\n    proof (cases d)\n      text \\<open>Embedding removes an argument i\\<close>\n      case Left\n      define i where \"i = num_args t - Suc (length p)\"\n      then  have \" head t = head s\" \"i < num_args t\" \"args s = take i (args t) @ drop (Suc i) (args t)\"\n        using emb_step_at_remove_arg Left True \\<open>emb_step_at p d t = s\\<close> \\<open>position_of t (p @ [d])\\<close> \n        by metis+\n      have \"is_App s \\<Longrightarrow> chop t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b chop s\" \n      proof (cases \"p = q\")\n        case True\n        assume \"is_App s\"\n        show ?thesis \n        proof -          \n          have \"Suc (num_args (fun s)) = num_args (fun t)\" \n            by (metis One_nat_def Suc_num_args True \\<open>args s = take i (args t) @ drop (Suc i) (args t)\\<close> \\<open>is_App s\\<close> \\<open>is_App t\\<close> append_self_conv2 cancel_comm_monoid_add_class.diff_cancel diff_Suc_1 i_def length_drop length_replicate q_rep_t take_eq_Nil)\n          have \"emb_step_at (replicate (num_args (fun s)) Left) Right (chop t) =\n                emb_step_at (replicate (num_args (fun s)) Left) Right t\" \n            using merge_emb_step_at[of \"replicate (num_args (fun s)) Left\" Right Nil Right t, unfolded append_Nil2 opp_simps(1) replicate_append_same]\n            by (metis \\<open>Suc (num_args (fun s)) = num_args (fun t)\\<close> \\<open>is_App t\\<close> chop_emb_step_at replicate_Suc)\n          then have \"emb_step_at (replicate (num_args (fun s)) dir.Left) dir.Right (chop t) = chop s\" unfolding chop_emb_step_at[OF \\<open>is_App s\\<close>]\n            using merge_emb_step_at[of \"replicate (num_args (fun s)) Left\" Right Nil Left t, unfolded append_Nil2 opp_simps(1) replicate_append_same]\n            by (metis Left True \\<open>Suc (num_args (fun s)) = num_args (fun t)\\<close> \\<open>emb_step_at p d t = s\\<close> q_rep_t replicate_Suc)\n          then show \"chop t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b chop s\"\n            by (metis \\<open>is_App s\\<close> \\<open>is_App t\\<close> \\<open>t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b s\\<close> emb_step_equiv emb_step_hsize nat_neq_iff hsize_chop)\n        qed\n      next\n        case False\n        assume \"is_App s\" \n        have p_rep: \"p = replicate (length p) Left\" \n          by (metis (full_types) \\<open>list_all (\\<lambda>x. x = Left) p\\<close> list_all_iff replicate_length_same)\n        have length_p:\"length p < num_args t\" using no_position_replicate_num_args \\<open>position_of t (p @ [d])\\<close> \n            replicate_add[of \"num_args t\" \"length p - num_args t\" Left]  p_rep q_rep_t\n          by (metis Left add_diff_inverse_nat replicate_app_Cons_same replicate_append_same shallower_pos)\n        then have \"length p \\<le> length q\" \n          using Suc_num_args \\<open>is_App t\\<close> q_rep_t by fastforce\n        then have \"length p < length q\"\n          using False le_neq_implies_less p_rep q_rep_t by fastforce\n        then have \"take (Suc (length p)) q = p @ [Left]\" \n          by (metis (no_types, lifting) \\<open>length p \\<le> length q\\<close> length_replicate min.orderE nth_replicate p_rep q_rep_t take_Suc_conv_app_nth take_replicate)\n        then obtain q' where \"q = p @ [Left] @ q'\" \n          by (metis append.assoc append_take_drop_id)\n        have \"Suc (num_args (fun s)) = num_args (fun t)\" \n          by (metis (no_types, lifting) Cons_nth_drop_Suc Suc_num_args \\<open>args s = take i (args t) @ drop (Suc i) (args t)\\<close> \\<open>i < num_args t\\<close> \\<open>is_App s\\<close> \\<open>is_App t\\<close> add_Suc_right append_take_drop_id diff_Suc_1 length_Cons length_append)\n        then have \"chop s = emb_step_at p dir.Left (chop t)\"\n          using swap_nested_emb_step_at[of p q' Right Left t] chop_emb_step_at[OF \\<open>is_App s\\<close>]\n            chop_emb_step_at[OF \\<open>is_App t\\<close>]  \n          by (metis (no_types, lifting) Cons_replicate_eq Left \\<open>emb_step_at p d t = s\\<close> \\<open>q = p @ [dir.Left] @ q'\\<close> append.assoc append_Cons diff_Suc_1 p_rep q_rep_t replicate_append_same)\n        then show \"chop t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b chop s\" \n          by (metis Left \\<open>is_App t\\<close> \\<open>position_of t (p @ [d])\\<close> \\<open>q = p @ [dir.Left] @ q'\\<close> chop_emb_step_at emb_step_at_if_position pos_emb_step_at_nested q_rep_t)\n      qed\n      then have \"chkchop_same (>\\<^sub>t) t s\"\n      proof (cases \"is_Var (head t)\")\n        case True\n        then show ?thesis unfolding chkchop_same_def chkchop_def  using ih[of \"chop t\" \"chop s\"] \n           add_less_mono hsize_chop_lt \\<open>is_App s \\<Longrightarrow> chop t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b chop s\\<close> by metis\n      next\n        case False\n        then show ?thesis unfolding chkchop_same_def chkchop_def \n        using \\<open>is_App t\\<close> add_less_mono gt_chop ih hsize_chop_lt \n        \\<open>is_App s \\<Longrightarrow> chop t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b chop s\\<close> by metis\n      qed\n      have \"\\<forall>f\\<in>local.ground_heads (head t). extf f (>\\<^sub>t) (args t) (args s)\" \n        using extf_ext_insert_arg[of _ _ \"take i (args t)\" \"args t ! i\" \"drop (Suc i) (args t)\"]\n        using \\<open>args s = take i (args t) @ drop (Suc i) (args t)\\<close> \\<open>i < num_args t\\<close> id_take_nth_drop by fastforce\n      then show ?thesis using gt_same \\<open>head t = head s\\<close> \\<open>chkchop_same (>\\<^sub>t) t s\\<close> by blast\n    next\n      text \\<open>Embedding chops and might remove arguments from the left\\<close>\n      case Right\n      show ?thesis using emb_step_at_chop\n        by (metis Right True \\<open>emb_step_at p d t = s\\<close> \\<open>is_App t\\<close> \\<open>position_of t (p @ [d])\\<close> add_Suc gt_chop ih less_Suc_eq hsize_chop)\n    qed\n  next\n    text \\<open>Embedding operates under one of the arguments\\<close>\n    case False\n    have \"num_args t = num_args s\" using emb_step_under_args_num_args[OF False] \n      by (metis (no_types) \\<open>\\<And>t d. num_args (emb_step_at p d t) = num_args t\\<close> \\<open>emb_step_at p d t = s\\<close>)\n    then have \"is_App s\" using \\<open>num_args t = num_args s\\<close> \n      by (metis args_Nil_iff_is_Hd length_0_conv \\<open>is_App t\\<close>)\n\n    have q_rep_s: \"q = replicate (num_args (fun s)) Left\"\n      by (metis  q_rep_t \\<open>is_App s\\<close> \\<open>is_App t\\<close> \\<open>num_args t = num_args s\\<close> args.simps(2) butlast_snoc length_butlast tm.collapse(2))\n\n    have \"chop t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b chop s\"\n    proof (cases \"take (num_args (fun t)) p = q\")\n      case True\n      have  \"num_args (fun t) < length p\"\n      proof (rule ccontr)\n        assume \"\\<not> num_args (fun t) < length p\"\n        then have \"num_args (fun t) = length p\"  \"q = p\"\n          using True q_rep_t by auto\n        then show False using False \n          using list_all_length q_rep_t by fastforce\n      qed\n\n      have \"p ! (num_args (fun t)) = Right\" \n      proof (rule ccontr)\n        assume \"p ! num_args (fun t) \\<noteq> Right\"\n        then have \"p ! num_args (fun t) = Left\" using dir.exhaust by blast\n        then have \"take (num_args t) p = replicate (num_args t) Left\" using True Suc_num_args[OF \\<open>is_App t\\<close>] q_rep_t\n            take_Suc_conv_app_nth[of \"num_args (fun t)\" p]\n          by (metis \\<open>num_args (fun t) < length p\\<close> replicate_Suc replicate_append_same)\n        then show False \n          by (metis \\<open>num_args t = num_args s\\<close> \\<open>num_args t = num_args s\\<close> \\<open>position_of t (p @ [d])\\<close> \n              append.assoc append_eq_Cons_conv append_take_drop_id no_position_replicate_num_args shallower_pos)\n      qed\n\n      then obtain q' where \"p = q @ [Right] @ q'\"\n        by (metis Cons_nth_drop_Suc True \\<open>num_args (fun t) < length p\\<close> append_Cons append_Nil append_eq_conv_conj length_replicate q_rep_t)\n      have \"emb_step_at (q @ q') d (chop t) = chop s\"\n        unfolding chop_emb_step_at[OF \\<open>is_App t\\<close>] chop_emb_step_at[OF \\<open>is_App s\\<close>] \n        using swap_nested_emb_step_at[of q q' d Right t, unfolded] \\<open>emb_step_at p d t = s\\<close> \\<open>p = q @ [Right] @ q'\\<close> \n        q_rep_t q_rep_s by auto\n      moreover have \"chop t \\<noteq> chop s\"\n        by (metis \\<open>is_App s\\<close> \\<open>is_App t\\<close> \\<open>t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b s\\<close> emb_step_hsize nat_less_le hsize_chop)\n      ultimately show \"chop t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b chop s\" \n        using emb_step_equiv by blast\n    next\n      case False\n      then have takepq: \"take (length q) p \\<noteq> q\" \n        using q_rep_t by auto\n      have takeqp: \"length p \\<le> length q \\<Longrightarrow> take (length p) q \\<noteq> p\"\n        using \\<open>\\<not> list_all (\\<lambda>x. x = Left) p\\<close>[unfolded list_all_length]\n        using diff_diff_cancel take_replicate length_replicate  nth_replicate q_rep_s by metis\n      have \"chop s = emb_step_at p d (chop t)\" \n        using swap_disjunct_emb_step_at[of p q Right d t, OF takeqp takepq, unfolded \\<open>emb_step_at p d t = s\\<close>] \n        using \\<open>is_App s\\<close> \\<open>is_App t\\<close> chop_emb_step_at q_rep_s q_rep_t\n        by (simp add: chop_emb_step_at)\n      then show ?thesis \n        by (metis False \\<open>is_App t\\<close> \\<open>position_of t (p @ [d])\\<close> chop_emb_step_at emb_step_at_if_position length_replicate nat_le_linear pos_emb_step_at_disjunct q_rep_t take_all takeqp)\n    qed\n    then have gt1:\"chkchop_same (>\\<^sub>t) t s\"  \n    proof (cases \"head t\")\n      case (Var _)\n      then have \"chop t >\\<^sub>t chop s\" using ih[of \"chop t\" \"chop s\"]\n        by (meson \\<open>chop t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b chop s\\<close> \\<open>is_App s\\<close> \\<open>is_App t\\<close> add_strict_mono hsize_chop_lt)\n      then show ?thesis  unfolding chkchop_same_def\n        by (simp add: Var)\n    next\n      case (Sym _)\n      then show ?thesis unfolding chkchop_same_def using \\<open>chop t \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b chop s\\<close> \n         \\<open>is_App t\\<close> add_Suc add_Suc_shift chkchop_def gt_trans ih \n         less_Suc_eq hsize_chop t_gt_chop_t \n        by (metis (no_types, lifting))\n    qed\n      have gt2:\"head t = head s\"  \n      by (metis emb_step_under_args_head False \\<open>emb_step_at p d t = s\\<close>) \n    have gt3:\"\\<forall>f\\<in>local.ground_heads (head t). extf f (>\\<^sub>t) (args t) (args s)\" \n    proof (rule ballI)\n      fix f assume \"f\\<in>local.ground_heads (head t)\"\n      obtain i where i_def:\n        \"i < num_args t\"\n        \"args t ! i \\<rightarrow>\\<^sub>e\\<^sub>m\\<^sub>b args (emb_step_at p d t) ! i\"\n        \"\\<And>j. j < num_args t \\<Longrightarrow> i \\<noteq> j \\<Longrightarrow> args t ! j = args (emb_step_at p d t) ! j\"\n        using emb_step_under_args_emb_step[of p t d] \n        using False \\<open>position_of t (p @ [d])\\<close> by blast\n      have compat_list1: \"args t ! i >\\<^sub>t args s ! i\" \n        by (metis \\<open>num_args t = num_args s\\<close> \\<open>emb_step_at p d t = s\\<close>  add_less_mono i_def(1) i_def(2) ih nth_mem hsize_in_args)\n      have compat_list2: \"args t ! i \\<noteq> args s ! i\" \n        using emb_step_equiv i_def(2) \\<open>emb_step_at p d t = s\\<close>  by blast\n      have argst:\"args t = take i (args t) @ args t ! i # drop (Suc i) (args t)\" \n        by (simp add: Cons_nth_drop_Suc i_def(1))\n      have argss:\"args s = take i (args t) @ args (emb_step_at p d t) ! i # drop (Suc i) (args t)\"\n      proof -\n        have \"take i (args t) = take i (args s)\" \n          apply (rule nth_take_lemma) \n          using \\<open>num_args t = num_args s\\<close> i_def(1) i_def(3)[unfolded \\<open>emb_step_at p d t = s\\<close>] by auto\n        moreover have \"drop (Suc i) (args t) = drop (Suc i) (args s)\" \n          apply (rule nth_drop_lemma) \n            apply (simp add: \\<open>num_args t = num_args s\\<close>)\n           apply (simp add: Suc_le_eq i_def(1))\n          using Suc_n_not_le_n \\<open>emb_step_at p d t = s\\<close> i_def(3) by blast\n        ultimately show ?thesis\n          using \\<open>emb_step_at p d t = s\\<close> \\<open>num_args t = num_args s\\<close> i_def(1) id_take_nth_drop by auto\n      qed\n      show \"extf f (>\\<^sub>t) (args t) (args s)\"\n        using  extf_compat_list[of \"args t ! i\" \"args (emb_step_at p d t) ! i\" gt f \"take i (args t)\"  \"drop (Suc i) (args t)\"] \n        using \\<open>emb_step_at p d t = s\\<close> argss argst compat_list1 compat_list2 by force\n    qed\n    show ?thesis using gt_same using gt1 gt2 gt3 by blast\n  qed\nqed  \n\nlemma gt_embedding_property:\n  assumes \"t \\<unrhd>\\<^sub>e\\<^sub>m\\<^sub>b s\" \"t \\<noteq> s\"\n  shows \"t >\\<^sub>t s\"\n  using assms \nproof (induction)\n  case (refl t)\n  then show ?case by simp\nnext\n  case (step t u s)\n  then show ?case using gt_embedding_step_property gt_trans by blast\nqed\n\n\nsubsection \\<open>Subterm Property\\<close>\n  \ntheorem gt_proper_sub: \"proper_sub s t \\<Longrightarrow> t >\\<^sub>t s\" \n  using gt_embedding_property sub_emb by blast\n\nlemma\n  gt_emb_fun: \"App s t >\\<^sub>t s\" and\n  gt_emb_arg: \"App s t >\\<^sub>t t\"\n  by (simp_all add: gt_embedding_step_property left right)\n\n\nsubsection \\<open>Compatibility with Contexts\\<close>\n\nlemma gt_fun_imp: \"fun t >\\<^sub>t s \\<Longrightarrow> t >\\<^sub>t s\" \n  by (metis emb_step_fun gt_embedding_step_property gt_trans tm.disc(2) tm.exhaust_sel tm.sel(3))\n\nlemma gt_arg_imp: \"arg t >\\<^sub>t s \\<Longrightarrow> t >\\<^sub>t s\" \n  by (metis emb_step_arg gt_embedding_step_property gt_trans tm.disc(2) tm.exhaust_sel tm.sel(5))\n\nlemma gt_compat_fun:\n  assumes \"t' >\\<^sub>t t\"\n  shows \"App s t' >\\<^sub>t App s t\"\nusing assms  apply (simp only:atomize_imp)\nproof (induction rule:measure_induct_rule[of \"\\<lambda>(t, s). hsize t + hsize s\" \"\\<lambda>(t, s). t' >\\<^sub>t t \\<longrightarrow> App s t' >\\<^sub>t App s t\" \"(t,s)\", \n  simplified prod.case],\n  simp only: split_paired_all prod.case atomize_imp[symmetric])\n\n  fix t s ::\"('s, 'v) tm\" \n  assume ih:\"\\<And>ta sa. hsize ta + hsize sa < hsize t + hsize s \\<Longrightarrow> t' >\\<^sub>t ta \\<Longrightarrow> App sa t' >\\<^sub>t App sa ta\"\n  and t'_gt_t:\"t' >\\<^sub>t t\" \n\n  have t'_ne_t: \"t' \\<noteq> t\"\n    using gt_antisym t'_gt_t by blast\n  have extf_args_single: \"\\<forall>f \\<in> ground_heads (head s). extf f (>\\<^sub>t) (args s @ [t']) (args s @ [t])\"\n    by (simp add: extf_compat_list t'_gt_t t'_ne_t)\n\n  show  \"App s t' >\\<^sub>t App s t\"\n  proof (rule gt_same)\n    show \"head (App s t') = head (App s t)\" by simp\n    show \"\\<forall>f\\<in>local.ground_heads (head (App s t')). extf f (>\\<^sub>t) (args (App s t')) (args (App s t))\"\n      by (simp add: extf_args_single)\n    have 0: \"chop (App s t') >\\<^sub>t chop (App s t)\" \n    proof (cases s)\n      case (Hd _)\n      then show ?thesis using chop_App_Hd\n        by (simp add: chop_App_Hd t'_gt_t)\n    next\n      case (App s1 s2)\n      then show ?thesis using ih[of t \"chop s\"] chop_fun \n        by (metis nat_add_left_cancel_less hsize_chop_lt t'_gt_t tm.disc(2) tm.sel(4) tm.sel(6))\n    qed\n    show \"chkchop_same (>\\<^sub>t) (App s t') (App s t)\"\n    proof (cases \"is_Var (head (App s t'))\")\n      case True\n      then show ?thesis unfolding chkchop_same_def chkchop_def\n        using True 0 by auto\n    next\n      case False\n      have \"App s t' >\\<^sub>t chop (App s t)\" using 0 by (simp add: gt_chop)\n      then show ?thesis  unfolding chkchop_same_def chkchop_def \n        using False by auto\n    qed\n  qed\nqed\n\ntheorem gt_compat_arg:\n  shows \"s' >\\<^sub>t s \\<Longrightarrow> t' \\<ge>\\<^sub>t t \\<Longrightarrow> App s' t' >\\<^sub>t App s t\"\nproof (simp only:atomize_imp,induction rule:measure_induct[of \"\\<lambda>(s',s,t). hsize s' + hsize s + hsize t\" \"\\<lambda>(s',s,t). s' >\\<^sub>t s \\<longrightarrow> t' \\<ge>\\<^sub>t t \\<longrightarrow> App s' t' >\\<^sub>t App s t\" \"(s',s,t)\", simplified prod.case],\n    simp only: split_paired_all prod.case atomize_imp[symmetric] atomize_all[symmetric])\n  fix s' s t\n  assume ih:\"\\<And>ab ac ba. hsize ab + hsize ac + hsize ba < hsize s' + hsize s + hsize t \\<Longrightarrow> ab >\\<^sub>t ac \\<Longrightarrow> t' \\<ge>\\<^sub>t ba \\<Longrightarrow> App ab t' >\\<^sub>t App ac ba\" \n    and \"s' >\\<^sub>t s\" and \"t' \\<ge>\\<^sub>t t\" \n\n  {\n    fix s''::\"('s,'v) tm\" assume hsize_s'':\"hsize s'' \\<le> hsize s'\"\n    assume chkchop_s'_s: \"chkchop (>\\<^sub>t) s'' s\"\n    then have \"chkchop (>\\<^sub>t) (App s'' t') (App s t)\" \n    proof (cases \"is_Hd s\")\n      case True\n      then show ?thesis using chkchop_s'_s unfolding chkchop_def \n        by (metis \\<open>t' \\<ge>\\<^sub>t t\\<close> chop_App_Hd gt_arg_imp gt_emb_arg tm.sel(6))\n    next\n      case False\n      then show ?thesis using chkchop_s'_s unfolding chkchop_def\n        using ih[of s'' \"chop s\" t] hsize_s''\n        by (metis \\<open>t' \\<ge>\\<^sub>t t\\<close> add_less_mono add_mono_thms_linordered_field(1) chop_fun le_eq_less_or_eq nat_add_left_cancel_less hsize_chop_lt tm.sel(4) tm.sel(6))\n    qed\n  }\n  note chkchop_compat_arg = this\n\n  show \"App s' t' >\\<^sub>t App s t \" using \\<open>s' >\\<^sub>t s\\<close>\n  proof (cases rule:gt.cases)\n    case gt_chop\n    then show ?thesis \n    proof (cases \"t = t'\")\n      case True\n      show ?thesis using True gt.gt_chop[of \"App s' t'\" \"App s t\"] gt_chop chkchop_compat_arg[of \"chop s'\"]\n        by (metis add_strict_right_mono chop_fun ih hsize_chop_lt tm.disc(2) tm.sel(4) tm.sel(6))\n    next\n      case False\n      then have \"t' >\\<^sub>t t\"\n        using \\<open>t' \\<ge>\\<^sub>t t\\<close> by blast\n      have \"App s' t' >\\<^sub>t App (chop s') t'\" \n        by (simp add: context_left emb_step_chop gt_embedding_step_property local.gt_chop(1))\n      moreover have \"... >\\<^sub>t App s t\"  using ih[of \"chop s'\" s t]\n        using \\<open>t' >\\<^sub>t t\\<close> gt_compat_fun local.gt_chop(1) local.gt_chop(2) hsize_chop_lt by fastforce\n      ultimately show ?thesis using gt_trans by blast\n    qed\n  next\n    case gt_diff\n    then show ?thesis \n      using chkchop_compat_arg gt.gt_diff by auto\n  next\n    case gt_same\n    have hd_s'_eq_s: \"head s' = head s\" \n      by (simp add: local.gt_same(1))\n    {\n      fix f assume f_gh: \"f \\<in> ground_heads (head s)\"\n      have f_s_args: \n        \"extf f (>\\<^sub>t) (args s') (args s)\"\n        using local.gt_same(3) f_gh by (simp add: hd_s'_eq_s)\n      have f_compat_snoc: \n        \"\\<And>xs ys x. extf f (>\\<^sub>t) ys xs \\<Longrightarrow> extf f (>\\<^sub>t) (ys @ [x]) (xs @ [x])\" \n        by (simp add: extf_compat_append_right)\n     \n      have f_st_args2:\n        \"extf f (>\\<^sub>t) (args (App s' t)) (args (App s t))\"\n        by (simp add: f_compat_snoc f_s_args)\n      have 0:\"\\<forall>z\\<in>UNIV. \\<forall>y\\<in>UNIV. \\<forall>x\\<in>UNIV. z >\\<^sub>t y \\<longrightarrow> y >\\<^sub>t x \\<longrightarrow> z >\\<^sub>t x\" \n        using gt_trans by blast\n      then have f_trans:\"\\<And>xs ys zs. extf f (>\\<^sub>t) zs ys \\<Longrightarrow> extf f (>\\<^sub>t) ys xs \\<Longrightarrow> extf f (>\\<^sub>t) zs xs\" \n        using  extf_trans[of _ UNIV, unfolded lists_UNIV, OF UNIV_I UNIV_I UNIV_I 0] by metis\n      have \"extf f (>\\<^sub>t) (args (App s' t')) (args (App s t))\"\n      proof (cases \"t' = t\")\n        case True\n        then show ?thesis using f_st_args2 by metis\n      next\n        case False\n        have f_st_args1: \n          \"extf f (>\\<^sub>t) (args (App s' t')) (args (App s' t))\"\n          using extf_compat_list \\<open>t' \\<ge>\\<^sub>t t\\<close> False by simp\n        then show ?thesis using f_trans f_st_args1 f_st_args2 by metis\n      qed\n    }\n    note extf_cond = this\n    have \"chkchop_same (>\\<^sub>t) (App s' t') (App s t)\" unfolding chkchop_same_def\n      using args.simps(1) chop_fun chkchop_compat_arg[of \"chop s'\", unfolded le_eq_less_or_eq] \n      chkchop_compat_arg[of s'] chkchop_def chkchop_same_def \n      hsize_chop_lt   epo.extf_min_empty[OF epo_axioms] gt.gt_same gt_antisym hd_s'_eq_s head_App \n      leI less_irrefl_nat local.gt_same(2) local.gt_same(3) tm.collapse(1) tm.sel(4) tm.sel(6)\n      by metis\n    then show ?thesis \n      using extf_cond gt.gt_same hd_s'_eq_s by auto\n  qed\nqed\n\ntheorem gt_compat_fun_strong:\n  assumes t'_gt_t: \"t' >\\<^sub>t t\"\n  shows \"apps s (t' # us) >\\<^sub>t apps s (t # us)\" \nproof (induct us rule: rev_induct)\n  case Nil\n  then show ?case \n  by (simp add: gt_compat_fun t'_gt_t)\nnext\n  case (snoc x xs)\n  then show ?case unfolding App_apps[symmetric] append_Cons[symmetric]\n    using gt_compat_arg by blast\nqed\n\ntheorem gt_or_eq_compat_App: \"s' \\<ge>\\<^sub>t s \\<Longrightarrow> t' \\<ge>\\<^sub>t t \\<Longrightarrow> App s' t' \\<ge>\\<^sub>t App s t\"\n  using gt_compat_fun gt_compat_arg by blast\n\ntheorem gt_compat_App:\n  shows \"s' \\<ge>\\<^sub>t s \\<Longrightarrow> t' >\\<^sub>t t \\<Longrightarrow> App s' t' >\\<^sub>t App s t\"\n  using gt_compat_fun gt_compat_arg by blast\n\nsubsection \"Stability under Substitutions\"\n\n(* TODO: move *)\nlemma extf_map2:\n  assumes\n    \"\\<forall>y\\<in>set ys \\<union> set xs. \\<forall>x\\<in>set ys \\<union> set xs. y >\\<^sub>t x \\<longrightarrow> (h y) >\\<^sub>t (h x)\"\n    \"extf f (>\\<^sub>t) ys xs\"\n  shows\n    \"extf f (>\\<^sub>t) (map h ys) (map h xs)\"\n  apply (rule extf_map[of \"set ys \\<union> set xs\" ys xs \"(>\\<^sub>t)\" h f])\n        apply simp\n       apply (simp add: in_listsI)\n      apply (simp add: in_listsI)\n  using gt_antisym apply blast\n  using gt_trans apply blast\n  by (simp add: assms)+\n\ntheorem gt_sus: \n  assumes \\<rho>_wary: \"wary_subst \\<rho>\"\n  assumes ghd: \"\\<And>x. ground_heads (Var x) = UNIV\" (* This condition is only needed for gt_same, not for gt_diff ! *)\n  shows \"t >\\<^sub>t s \\<Longrightarrow> subst \\<rho> t >\\<^sub>t subst \\<rho> s\"\nproof (simp only:atomize_imp,induction rule:measure_induct[of \"\\<lambda>(t,s). {# hsize t, hsize s #}\" \"\\<lambda>(t,s). t >\\<^sub>t s \\<longrightarrow> subst \\<rho> t >\\<^sub>t subst \\<rho> s\" \"(t,s)\", simplified prod.case],\n    simp only: split_paired_all prod.case atomize_imp[symmetric] atomize_all[symmetric])\n  fix t s\n  assume ih:\"\\<And>tt ss.\n               {# hsize tt, hsize ss #} < {# hsize t, hsize s #} \\<Longrightarrow>\n               tt >\\<^sub>t ss \\<Longrightarrow> subst \\<rho> tt >\\<^sub>t subst \\<rho> ss\" \n    and \"t >\\<^sub>t s\" \n  show \"subst \\<rho> t >\\<^sub>t subst \\<rho> s\" using \\<open>t >\\<^sub>t s\\<close>\n  proof (cases)\n    case t_gt_s_chop: gt_chop\n    then show ?thesis \n      using emb_step_subst emb_step_chop[OF t_gt_s_chop(1)] gt_embedding_step_property \n       emb_step_hsize gt_trans ih[of \"chop t\" s] by (metis add_mset_lt_left_lt)\n  next\n    case t_gt_s_diff: gt_diff\n    have gt_diff1: \"head (subst \\<rho> t) >\\<^sub>h\\<^sub>d head (subst \\<rho> s)\" \n      by (meson assms gt_hd_def subsetCE t_gt_s_diff(1) wary_subst_ground_heads)\n    have gt_diff2: \"is_Sym (head (subst \\<rho> s))\"\n      by (metis ground_imp_subst_iden hd.collapse(2) hd.simps(18) head_subst t_gt_s_diff(2) tm.sel(1) tm.simps(17))\n    have gt_diff3: \"chkchop (>\\<^sub>t) (subst \\<rho> t) (subst \\<rho> s)\"    \n    proof (cases s)\n      case (Hd _)\n      then show ?thesis \n        using t_gt_s_diff unfolding chkchop_def \n        by (metis ground_imp_subst_iden hd.collapse(2) hd.simps(18) tm.disc(1) tm.sel(1) tm.simps(17))\n    next\n      case s_App: (App s1 s2)\n      then show ?thesis using t_gt_s_diff unfolding chkchop_def\n        using ih[of t \"chop s\"] chop_subst_Sym hsize_chop_lt tm.disc(2)\n        by (metis add_mset_lt_left_lt add_mset_lt_right_lt)\n    qed\n    show ?thesis\n      using gt_diff gt_diff1 gt_diff2 gt_diff3 by blast\n  next\n    case t_gt_s_same: gt_same\n    have gt_same1: \"head (subst \\<rho> t) = head (subst \\<rho> s)\" \n      by (simp add: t_gt_s_same(1))\n\n    have extf_map_ts:\"\\<forall>f\\<in>ground_heads (head t). extf f (>\\<^sub>t) (map (subst \\<rho>) (args t)) (map (subst \\<rho>) (args s))\"\n    proof -\n      have ih_args: \"\\<forall>y\\<in>set (args t) \\<union> set (args s). \\<forall>x\\<in>set (args t) \\<union> set (args s). y >\\<^sub>t x \\<longrightarrow> subst \\<rho> y >\\<^sub>t subst \\<rho> x\"\n        by (metis Un_iff less_multiset_doubletons hsize_in_args ih)\n      have \"\\<forall>f\\<in>ground_heads (head t). extf f (>\\<^sub>t) (args t) (args s)\"  \n        using ghd t_gt_s_same(3) by metis\n      then show ?thesis\n        using extf_map[of \"set (args t) \\<union> set (args s)\" \"args t\" \"args s\" gt \"subst \\<rho>\"]\n        using gt_irrefl gt_trans ih_args by blast\n    qed\n\n    show ?thesis\n    proof (cases \"head t\")\n      case (Var x1)\n      then have \"is_Var (head t)\" by simp\n      {\n        fix u :: \"('s, 'v) tm\"\n        assume \"ground_heads (head u) \\<subseteq> ground_heads (head t)\" \"hsize u \\<le> hsize (subst \\<rho> (Hd (head t)))\"\n        then have \"apps u (map (subst \\<rho>) (args t)) >\\<^sub>t apps u (map (subst \\<rho>) (args s))\" \n        proof (induct \"hsize u\" arbitrary:u rule:less_induct)\n          case less\n          then show ?case \n          proof (cases u)\n            case u_Hd: (Hd _)\n            then have \"args u = []\" \n              by simp\n            then show ?thesis \n            proof (cases s)\n              case s_Hd: (Hd _)\n              show ?thesis \n                apply (rule gt_same) \n                using extf_map_ts  args_Nil_iff_is_Hd s_Hd u_Hd \\<open>args u = []\\<close> less by fastforce+\n            next\n              case s_App: (App _ _)\n              then have \"is_App t\" \n                by (metis args_Nil_iff_is_Hd extf_min_empty gt_hd_def gt_hd_irrefl t_gt_s_same(3))\n  \n              have \"chop t >\\<^sub>t chop s\" \n                using \\<open>is_App t\\<close> \\<open>is_Var (head t)\\<close> s_App t_gt_s_same(2) by auto\n              then have \"subst \\<rho> (chop t) >\\<^sub>t subst \\<rho> (chop s)\" using ih\n                by (metis \\<open>is_App t\\<close> less_multiset_doubletons s_App hsize_chop_lt tm.disc(2))\n  \n              define ut where \"ut = apps u (map (subst \\<rho>) (args t))\"\n              define us where \"us = apps u (map (subst \\<rho>) (args s))\"\n              have 0:\"\\<And>ss. args (apps u ss) = ss\" \n                using  \\<open>args u = []\\<close> by simp\n              have chop_us: \"chop us = subst \\<rho> (chop s)\" \n                unfolding chop_def subst_apps us_def 0 using hd_map\n                by (metis (no_types, lifting) args_Nil_iff_is_Hd map_tl s_App tm.disc(2))\n              have chop_ut: \"chop ut = subst \\<rho> (chop t)\"\n                unfolding chop_def subst_apps ut_def 0 using \\<open>is_App t\\<close> \n                by (simp add: args_Nil_iff_is_Hd hd_map map_tl)\n  \n              have \"head ut = head us\" \n                by (simp add: us_def ut_def)\n              moreover have \"chkchop_same (>\\<^sub>t) ut us\" unfolding chkchop_def chkchop_same_def \n                by (metis \"0\" UNIV_witness \\<open>is_Var (head t)\\<close> \\<open>subst \\<rho> (chop t) >\\<^sub>t subst \\<rho> (chop s)\\<close> \n                    args.simps(1) chop_us chop_ut extf_map_ts extf_min_empty \n                    ghd gt_chop is_Var_def tm.collapse(1) ut_def)\n              moreover have \"\\<forall>f\\<in>local.ground_heads (head ut). extf f (>\\<^sub>t) (args ut) (args us)\" \n                using extf_map_ts less us_def ut_def using \"0\" by auto\n              ultimately show \"ut >\\<^sub>t us\" \n                using gt_same by blast\n            qed\n          next\n            case u_app: (App _ _)\n            let ?ut = \"apps u (map (subst \\<rho>) (args t))\"\n            let ?us = \"apps u (map (subst \\<rho>) (args s))\"\n            have 1:\"head ?ut = head ?ut\" \n              by simp\n            have \"apps (chop u) (map (subst \\<rho>) (args t)) >\\<^sub>t apps (chop u) (map (subst \\<rho>) (args s))\"\n              using less.hyps[of \"chop u\"] hsize_chop_lt \n              by (metis Var dual_order.trans ghd less.prems(2) less_or_eq_imp_le subset_UNIV tm.disc(2) u_app)\n            then have \"chop ?ut >\\<^sub>t chop ?us\" \n              by (simp add: chop_apps u_app)\n            then have 2:\"chkchop_same (>\\<^sub>t) ?ut ?us\" unfolding chkchop_same_def chkchop_def \n              by (metis UNIV_I \\<open>is_Var (head t)\\<close> args_Nil_iff_is_Hd args_apps extf_compat_append_left \n                  extf_map_ts extf_min_empty ghd gt_chop is_Var_def)\n            have 3:\"\\<forall>f\\<in>local.ground_heads (head ?ut). extf f (>\\<^sub>t) (args ?ut) (args ?us)\"\n              using extf_compat_append_left extf_map_ts less.prems(1) by auto\n            show ?thesis using gt_same 1 2 3 by simp\n          qed\n        qed\n      }\n      note inner_induction = this\n      show ?thesis using inner_induction[of \"subst \\<rho> (Hd (head t))\", unfolded subst_apps[symmetric]]\n        by (metis Var ghd order_refl subset_UNIV t_gt_s_same(1) tm_collapse_apps)\n    next\n      case (Sym _)\n      then have \"is_Sym (head (subst \\<rho> t))\" \"head (subst \\<rho> t) = head t\"\n        by simp_all\n      then have \"chkchop_same (>\\<^sub>t) t s\"\n        using t_gt_s_same unfolding chkchop_same_def chkchop_def\n        using Sym by metis\n      then have gt_same2: \"chkchop_same (>\\<^sub>t) (subst \\<rho> t) (subst \\<rho> s)\" unfolding chkchop_same_def chkchop_def\n         using ih[of t \"chop s\"] \n         by (metis (no_types, lifting) Sym \\<open>head (subst \\<rho> t) = head t\\<close> \\<open>is_Sym (head (subst \\<rho> t))\\<close> \n             add_mset_commute add_mset_lt_left_lt chop_subst_Sym ground_imp_subst_iden hd.simps(18) \n             hsize_chop_lt t_gt_s_same(1) tm.collapse(1) tm.simps(17))\n      have gt_same3: \"\\<forall>f\\<in>local.ground_heads (head (subst \\<rho> t)). extf f (>\\<^sub>t) (args (subst \\<rho> t)) (args (subst \\<rho> s))\"\n        using \\<open>head (subst \\<rho> t) = head t\\<close> extf_compat_append_left extf_map_ts t_gt_s_same(1) by auto\n      show ?thesis using gt_same gt_same1 gt_same2 gt_same3 by blast\n    qed\n  qed\nqed\n\n\nsubsection \\<open>Totality on Ground Terms\\<close>\n\ntheorem gt_total_ground:\n  assumes extf_total: \"\\<And>f. ext_total (extf f)\"\n  shows \"ground t \\<Longrightarrow> ground s \\<Longrightarrow> t >\\<^sub>t s \\<or> s >\\<^sub>t t \\<or> t = s\"\nproof (simp only: atomize_imp,\n    rule measure_induct_rule[of \"\\<lambda>(t, s). {# hsize t, hsize s #}\"\n      \"\\<lambda>(t, s). ground t \\<longrightarrow> ground s \\<longrightarrow> t >\\<^sub>t s \\<or> s >\\<^sub>t t \\<or> t = s\" \"(t, s)\", simplified prod.case],\n    simp only: split_paired_all prod.case atomize_imp[symmetric])\n  fix t s :: \"('s, 'v) tm\"\n  assume\n    ih: \"\\<And>ta sa. {# hsize ta, hsize sa #} < {# hsize t, hsize s #} \\<Longrightarrow> ground ta \\<Longrightarrow> ground sa \\<Longrightarrow>\n      ta >\\<^sub>t sa \\<or> sa >\\<^sub>t ta \\<or> ta = sa\" and\n    gr_t: \"ground t\" and gr_s: \"ground s\"\n\n  let ?case = \"t >\\<^sub>t s \\<or> s >\\<^sub>t t \\<or> t = s\"\n\n  have \"chkchop (>\\<^sub>t) t s \\<or> s >\\<^sub>t t\"\n    unfolding chkchop_def tm.case_eq_if using ih[of t \"chop s\"]\n    by (metis (no_types, lifting) add_mset_commute add_mset_lt_left_lt gr_s gr_t ground_chop gt_chop hsize_chop_lt)\n  moreover have \"chkchop (>\\<^sub>t) s t \\<or> t >\\<^sub>t s\"\n    unfolding chkchop_def tm.case_eq_if using ih[of \"chop t\" s]\n    by (metis add_mset_lt_left_lt gr_s gr_t ground_chop gt_chop.intros gt_iff_chop_diff_same hsize_chop_lt)\n  moreover\n  {\n    assume\n      chkembs_t_s: \"chkchop (>\\<^sub>t) t s\" and\n      chkembs_s_t: \"chkchop (>\\<^sub>t) s t\"\n\n    obtain g where g: \"head t = Sym g\"\n      using gr_t by (metis ground_head hd.collapse(2))\n    obtain f where f: \"head s = Sym f\"\n      using gr_s by (metis ground_head hd.collapse(2))\n\n    {\n      assume g_gt_f: \"g >\\<^sub>s f\"\n      have \"t >\\<^sub>t s\"\n        using chkembs_t_s f g g_gt_f gt_diff gt_sym_imp_hd by auto\n    }\n    moreover\n    {\n      assume f_gt_g: \"f >\\<^sub>s g\"\n      have \"s >\\<^sub>t t\" \n        using chkembs_s_t f f_gt_g g gt_diff gt_sym_imp_hd by auto\n    }\n    moreover\n    {\n      assume g_eq_f: \"g = f\"\n      hence hd_t: \"head t = head s\"\n        using g f by auto\n\n      let ?ts = \"args t\"\n      let ?ss = \"args s\"\n\n      have gr_ts: \"\\<forall>ta \\<in> set ?ts. ground ta\"\n        using ground_args[OF _ gr_t] by blast\n      have gr_ss: \"\\<forall>sa \\<in> set ?ss. ground sa\"\n        using ground_args[OF _ gr_s] by blast\n\n      {\n        assume ts_eq_ss: \"?ts = ?ss\"\n        have \"t = s\"\n          using hd_t ts_eq_ss by (rule tm_expand_apps)\n      }\n      moreover\n      {\n        assume ts_gt_ss: \"extf g (>\\<^sub>t) ?ts ?ss\"\n        have \"t >\\<^sub>t s\"\n          using chkembs_t_s g gt_same hd_t ts_gt_ss by auto\n      }\n      moreover\n      {\n        assume ss_gt_ts: \"extf g (>\\<^sub>t) ?ss ?ts\"\n        have \"s >\\<^sub>t t\"\n          using chkembs_s_t f g_eq_f gt_same hd_t ss_gt_ts by auto\n      }\n      ultimately have ?case\n        using ih gr_ss gr_ts\n          ext_total.total[OF extf_total, rule_format, of \"set ?ts \\<union> set ?ss\" \"(>\\<^sub>t)\" ?ts ?ss g]\n        using less_multiset_doubletons epo_axioms hsize_in_args in_listsI by (metis Un_iff)\n    }\n    ultimately have ?case\n      using gt_sym_total by blast\n  }\n  ultimately show ?case\n    by fast\nqed\n\nsubsection \\<open>Well-foundedness\\<close>\n\nabbreviation gtg :: \"('s, 'v) tm \\<Rightarrow> ('s, 'v) tm \\<Rightarrow> bool\" (infix \">\\<^sub>t\\<^sub>g\" 50) where\n  \"(>\\<^sub>t\\<^sub>g) \\<equiv> \\<lambda>t s. ground t \\<and> t >\\<^sub>t s\"\n\ntheorem gt_wf:\n  assumes ghd_UNIV: \"\\<And>x. ground_heads_var x = UNIV\"\n  assumes extf_wf: \"\\<And>f. ext_wf (extf f)\"\n  shows \"wfP (\\<lambda>s t. t >\\<^sub>t s)\"\nproof -\n  have ground_wfP: \"wfP (\\<lambda>s t. t >\\<^sub>t\\<^sub>g s)\"\n    unfolding wfP_iff_no_inf_chain\n  proof\n    assume \"\\<exists>f. inf_chain (>\\<^sub>t\\<^sub>g) f\"\n    then obtain t where t_bad: \"bad (>\\<^sub>t\\<^sub>g) t\"\n      unfolding inf_chain_def bad_def by blast\n\n    let ?ff = \"worst_chain (>\\<^sub>t\\<^sub>g) (\\<lambda>t s. hsize t > hsize s)\"\n    let ?U_of = \"\\<lambda>i. {u. (?ff i) \\<rhd>\\<^sub>e\\<^sub>m\\<^sub>b u}\"\n\n    note wf_sz = wf_app[OF wellorder_class.wf, of hsize, simplified]\n\n    define U where \"U = (\\<Union>i. ?U_of i)\"\n\n    have gr: \"\\<And>i. ground (?ff i)\"\n      using worst_chain_bad[OF wf_sz t_bad, unfolded inf_chain_def] by fast\n    have gr_u: \"\\<And>u. u \\<in> U \\<Longrightarrow> ground u\" unfolding U_def\n      using gr ground_emb by fastforce\n\n    have \"\\<not> bad (>\\<^sub>t\\<^sub>g) u\" if u_in: \"u \\<in> ?U_of i\" for u i\n    proof\n      let ?ti = \"?ff i\"\n\n      assume u_bad: \"bad (>\\<^sub>t\\<^sub>g) u\"\n      have sz_u: \"hsize u < hsize ?ti\"\n        using emb_hsize_neq u_in by blast\n\n      show False\n      proof (cases i)\n        case 0\n        thus False\n          using sz_u min_worst_chain_0[OF wf_sz u_bad] by simp\n      next\n        case Suc\n        hence \"?ff (i - 1) >\\<^sub>t ?ff i\"\n          using worst_chain_pred[OF wf_sz t_bad] by simp\n        moreover have \"?ff i >\\<^sub>t u\"\n          using gt_embedding_property u_in by blast\n        ultimately have \"?ff (i - 1) >\\<^sub>t u\"\n          by (rule gt_trans)\n        thus False\n          using Suc sz_u min_worst_chain_Suc[OF wf_sz u_bad] gr by fastforce\n      qed\n    qed\n    hence u_good: \"\\<And>u. u \\<in> U \\<Longrightarrow> \\<not> bad (>\\<^sub>t\\<^sub>g) u\"\n      unfolding U_def by blast\n\n    have bad_diff_same: \"inf_chain (\\<lambda>t s. ground t \\<and> (gt_diff t s \\<or> gt_same t s)) ?ff\"\n      unfolding inf_chain_def\n    proof (intro allI conjI)\n      fix i\n\n      show \"ground (?ff i)\"\n        by (rule gr)\n\n      have gt: \"?ff i >\\<^sub>t ?ff (Suc i)\"\n        using worst_chain_pred[OF wf_sz t_bad] by blast\n\n      have \"\\<not> gt_chop (?ff i) (?ff (Suc i))\" \n      proof\n        assume a: \"gt_chop (?ff i) (?ff (Suc i))\"\n        then have \"chop (?ff i) \\<in> ?U_of i\" \n          by (metis (mono_tags, lifting) emb_step_chop emb_step_is_emb gt_chop gt_chop.cases gt_irrefl mem_Collect_eq)\n        then have  uij_in:\"chop (?ff i) \\<in> U\" unfolding U_def by fast\n\n        have \"\\<And>n. ?ff n >\\<^sub>t ?ff (Suc n)\"\n          by (rule worst_chain_pred[OF wf_sz t_bad, THEN conjunct2])\n        hence uij_gt_i_plus_3: \"chop (?ff i) >\\<^sub>t ?ff (Suc (Suc i))\"\n          using gt_trans by (metis (mono_tags, lifting) a gt_chop.cases)\n\n        have \"inf_chain (>\\<^sub>t\\<^sub>g) (\\<lambda>j. if j = 0 then chop (?ff i) else ?ff (Suc (i + j)))\"\n          unfolding inf_chain_def\n          by (auto intro!: gr gr_u[OF uij_in] uij_gt_i_plus_3 worst_chain_pred[OF wf_sz t_bad])\n        hence \"bad (>\\<^sub>t\\<^sub>g) (chop (?ff i))\"\n          unfolding bad_def by fastforce\n        thus False\n          using u_good[OF uij_in] by sat\n      qed\n      thus \"gt_diff (?ff i) (?ff (Suc i)) \\<or> gt_same (?ff i) (?ff (Suc i))\"\n        using gt unfolding gt_iff_chop_diff_same by sat\n    qed\n\n    have \"wf {(s, t). ground s \\<and> ground t \\<and> sym (head t) >\\<^sub>s sym (head s)}\"\n      using gt_sym_wf unfolding wfP_def wf_iff_no_infinite_down_chain by fast\n    moreover have \"{(s, t). ground t \\<and> gt_diff t s}\n      \\<subseteq> {(s, t). ground s \\<and> ground t \\<and> sym (head t) >\\<^sub>s sym (head s)}\"\n    proof (clarsimp, intro conjI)\n      fix s t\n      assume gr_t: \"ground t\" and gt_diff_t_s: \"gt_diff t s\"\n      thus gr_s: \"ground s\"\n        using gt_iff_chop_diff_same gt_imp_vars by fastforce\n\n      show \"sym (head t) >\\<^sub>s sym (head s)\"\n        using gt_diff_t_s ground_head[OF gr_s] ground_head[OF gr_t]\n        by (cases; cases \"head s\"; cases \"head t\") (auto simp: gt_hd_def)\n    qed\n    ultimately have wf_diff: \"wf {(s, t). ground t \\<and> gt_diff t s}\"\n      by (rule wf_subset)\n\n    have diff_O_same: \"{(s, t). ground t \\<and> gt_diff t s} O {(s, t). ground t \\<and> gt_same t s}\n      \\<subseteq> {(s, t). ground t \\<and> gt_diff t s}\"\n      unfolding gt_diff.simps gt_same.simps\n      by clarsimp (metis chkchop_def chkchop_same_def gt_same gt_trans)\n\n    have diff_same_as_union: \"{(s, t). ground t \\<and> (gt_diff t s \\<or> gt_same t s)} =\n      {(s, t). ground t \\<and> gt_diff t s} \\<union> {(s, t). ground t \\<and> gt_same t s}\"\n      by auto\n\n    obtain k where bad_same: \"inf_chain (\\<lambda>t s. ground t \\<and> gt_same t s) (\\<lambda>i. ?ff (i + k))\"\n      using wf_infinite_down_chain_compatible[OF wf_diff _ diff_O_same, of ?ff] bad_diff_same\n      unfolding inf_chain_def diff_same_as_union[symmetric] by auto\n    hence hd_sym: \"\\<And>i. is_Sym (head (?ff (i + k)))\"\n      unfolding inf_chain_def by (simp add: ground_head)\n\n    define f where \"f = sym (head (?ff k))\"\n\n    have hd_eq_f: \"head (?ff (i + k)) = Sym f\" for i\n    proof (induct i)\n      case 0\n      thus ?case\n        by (auto simp: f_def hd.collapse(2)[OF hd_sym, of 0, simplified])\n    next\n      case (Suc ia)\n      thus ?case\n        using bad_same unfolding inf_chain_def gt_same.simps by simp\n    qed\n\n    let ?gtu = \"\\<lambda>t s. t \\<in> U \\<and> t >\\<^sub>t s\"\n    thm UnionI CollectI\n    have \"t \\<in> set (args (?ff i)) \\<Longrightarrow> t \\<in> U\" for t i\n      unfolding U_def apply (rule UnionI[of \"?U_of i\"]) \n      using arg_emb CollectI arg_emb hsize_in_args by fast+\n    moreover have \"\\<And>i. extf f (>\\<^sub>t\\<^sub>g) (args (?ff (i + k))) (args (?ff (Suc i + k)))\"\n      using bad_same hd_eq_f unfolding  inf_chain_def gt_same.simps f_def hd.collapse(2)[OF ground_head, OF gr]\n      using extf_mono_strong[of _ _ \"(>\\<^sub>t)\" \"(\\<lambda>t s. ground t \\<and> t >\\<^sub>t s)\" ] ground_hd_in_ground_heads \n      by (metis (no_types, lifting) ground_args)\n    ultimately have \"\\<And>i. extf f ?gtu (args (?ff (i + k))) (args (?ff (Suc i + k)))\"\n      using extf_mono_strong[of _ _ \"(\\<lambda>t s. ground t \\<and> t >\\<^sub>t s)\" \"\\<lambda>t s. t \\<in> U \\<and> t >\\<^sub>t s\"] unfolding U_def by blast\n    hence \"inf_chain (extf f ?gtu) (\\<lambda>i. args (?ff (i + k)))\"\n      unfolding inf_chain_def by blast\n    hence nwf_ext: \"\\<not> wfP (\\<lambda>xs ys. extf f ?gtu ys xs)\"\n      unfolding wfP_iff_no_inf_chain by fast\n\n    have gtu_le_gtg: \"?gtu \\<le> (>\\<^sub>t\\<^sub>g)\"\n      by (auto intro!: gr_u)\n\n    have \"wfP (\\<lambda>s t. ?gtu t s)\"\n      unfolding wfP_iff_no_inf_chain\n    proof (intro notI, elim exE)\n      fix f\n      assume bad_f: \"inf_chain ?gtu f\"\n      hence bad_f0: \"bad ?gtu (f 0)\"\n        by (rule inf_chain_bad)\n\n      have \"f 0 \\<in> U\"\n        using bad_f unfolding inf_chain_def by blast\n      hence good_f0: \"\\<not> bad ?gtu (f 0)\"\n        using u_good bad_f inf_chain_bad inf_chain_subset[OF _ gtu_le_gtg] by blast\n\n      show False\n        using bad_f0 good_f0 by sat\n    qed\n    hence wf_ext: \"wfP (\\<lambda>xs ys. extf f ?gtu ys xs)\"\n      by (rule ext_wf.wf[OF extf_wf, rule_format])\n\n    show False\n      using nwf_ext wf_ext by blast\n  qed\n\n  let ?subst = \"subst grounding_\\<rho>\"\n\n  have \"wfP (\\<lambda>s t. ?subst t >\\<^sub>t\\<^sub>g ?subst s)\"\n    by (rule wfP_app[OF ground_wfP])\n  hence \"wfP (\\<lambda>s t. ?subst t >\\<^sub>t ?subst s)\"\n    by (simp add: ground_grounding_\\<rho>)\n  thus ?thesis\n    using gt_sus ghd_UNIV ground_heads.simps(1) wary_grounding_\\<rho> wfP_eq_minimal\n    by (metis (no_types, lifting))\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Lambda_Free_EPO/Lambda_Free_EPO.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3290701375239353}}
{"text": "theory Case_Study\nimports Chunkval_Interface Serialize\nbegin\n\nfun stmt_list :: \"stmt list \\<Rightarrow> stmt\" where\n  \"stmt_list [] = Sskip\"\n| \"stmt_list [s] = s\"\n| \"stmt_list (s#ss) = Sseq s (stmt_list ss)\"\n\nsection \\<open>Case Study\\<close>\n\ndefinition Earray_offset where\n  \"Earray_offset var_name ofs \\<equiv> (Ebinop Oaddl\n          (Evar var_name)\n          (Econst (Olongconst (word_of_int ofs))))\"\n\ndefinition \"arr_name \\<equiv> STR ''array''\"\ndefinition \"var_name \\<equiv> STR ''res''\"\n\ndefinition \"case_study_stmts \\<equiv> [\n  Sbuiltin (Some arr_name) EF_malloc [Econst (Olongconst (word_of_nat 8))],\n  Sstore Mint32 (Earray_offset arr_name 0) (Econst (Ointconst (Int.repr 21))),\n  Sstore Mint32 (Earray_offset arr_name 4) (Econst (Ointconst (Int.repr 21))),\n  Sassign var_name (Ebinop Oadd\n    (Eload Mint32 (Earray_offset arr_name 0))\n    (Eload Mint32 (Earray_offset arr_name 4))),\n  Sbuiltin None EF_free [Evar arr_name],\n  Sreturn (Some (Evar var_name))\n  ]\"\n\n\n\nlemma case_study_proof:\n  \"stmt_ht ge f sp\n   (env.assn_is arr_name Vundef ** env.assn_is var_name Vundef)\n   (stmt_list case_study_stmts)\n   (\\<lambda>(t, out). \\<up>((t, out) = (E0, Out_return (Some (Vint 42))))\n    ** (EXS v1 v2. env.assn_is arr_name v1 ** env.assn_is var_name v2))\"\n  unfolding case_study_stmts_def Earray_offset_def\n  apply simp\n  apply vcg\n  apply simp\n  apply vcg\n   apply (simp add: sep_algebra_simps)\n   apply vcg_normalize\n   apply vcg\n  apply (simp add: mem.val_range_split[of 4 \"replicate 8 Undef\", simplified])\n   apply (simp add: mem.range_to_chunk[of \"replicate 4 Undef\" Mint32])\n   apply vcg\n  unfolding mem.mem_chunk_def\n   apply (simp add: sep_algebra_simps)\n  supply [simp] = mem.val_range_split[of 4 \"encode_val Mint32 (Vint 21) @ encode_val Mint32 (Vint 21)\" _ 0, symmetric, simplified]\n   apply (simp)\n   apply vcg_rl\n  sorry\n\ndefinition \"case_study_func \\<equiv>\n  (func.make signature_main [] [arr_name, var_name] 0 (stmt_list case_study_stmts))\"\n\ndefinition case_study_program :: Cminor_Syntax.program where\n\"case_study_program \\<equiv> program.make\n  [(STR ''main'', Gfun (Internal case_study_func)),\n  (STR ''malloc'', Gfun (External EF_malloc)),\n  (STR ''free'', Gfun (External EF_free))]\n  [] (STR ''main'')\"\n\ndefinition \"case_study_jsoned \\<equiv> show_json (to_json case_study_program)\"\n\n(* declare case_study_program_def[code del]\n\nschematic_goal [code]: \"case_study_program \\<equiv> ?x\"\n  unfolding case_study_program_def\n  unfolding case_study_func_def\n  unfolding case_study_stmts_def\n  apply (subst malloc_fix)\n  apply (subst free_fix)\n  by simp\n\nML_val \\<open>writeln @{code case_study_jsoned}\\<close>\n\nML_val \\<open>\nval using_master_directory =\n          File.full_path o Resources.master_directory o Proof_Context.theory_of;\nval path = using_master_directory @{context} (Path.basic \"case_study.cmj\");\nFile.write path @{code case_study_jsoned}\\<close> *)\n\nsection \\<open>Array Case Study\\<close>\n\ndefinition \"my_array \\<equiv> cv_array_def.make (STR ''array'') 4 2\"\n\nschematic_goal my_array_simps[simp]:\n  \"array_name my_array = ?x\"\n  \"array_elem_size my_array = ?y\"\n  \"array_length my_array = ?z\"\n  unfolding my_array_def\n  by (auto simp only: cv_array_def.defs cv_array_def.simps)\n\nlemma my_array_valid[iff]: \"array_def_valid my_array\"\n  unfolding my_array_def\n  apply (rule array_def_valid.intros)\n  by (auto simp: cv_array_def.defs array_size_def arch_max_size_def)\n\ndefinition [simp]: \"array_case_study_stmts \\<equiv>\n  [Sarray_alloc my_array,\n  Sarray_store my_array 0 Mint32 (Econst (Ointconst 21)),\n  Sarray_store my_array 1 Mint32 (Econst (Ointconst 21)),\n  Sassign (STR ''res'') (Ebinop Oadd\n    (Earray_load my_array 0 Mint32)\n    (Earray_load my_array 1 Mint32)),\n  Sarray_free my_array,\n  Sreturn (Some (Evar (STR ''res'')))]\"\n\nlemma def_extend: \"cv_array_def.extend \\<lparr>array_name = an, array_elem_size = aes, array_length = al\\<rparr>\n         (cv_array.fields ab acvs)\n    = \\<lparr>array_name = an, array_elem_size = aes, array_length = al, array_block = ab, array_chunkvals = acvs\\<rparr>\"\n  by (simp add: cv_array_def.defs cv_array.defs)\n\nlemmas [simp] = cv_array_def.defs cv_array.defs\nlemmas [simp] = chunk_fits_array_def array_set_val_def array_get_val_def sep_algebra_simps\n\nnotation stmt_ht (\"_ _ _ \\<Turnstile>\\<^sub>s {_} _ {_}\")\nnotation env.assn_is (\"_ \\<mapsto>\\<^sub>v _\")\n\nlemma array_case_study_proof:\n  \"ge f sp \\<Turnstile>\\<^sub>s\n   {EXS v1 v2. (STR ''array'') \\<mapsto>\\<^sub>v v1 \\<and>* (STR ''res'') \\<mapsto>\\<^sub>v v2}\n   (stmt_list array_case_study_stmts)\n   {\\<lambda>r. \\<up>(r = (E0, Out_return (Some (Vint 42))))\n    ** (EXS v1 v2. (STR ''array'') \\<mapsto>\\<^sub>v v1 \\<and>* (STR ''res'') \\<mapsto>\\<^sub>v v2)}\"\n  by vcg\n\n\ndefinition \"array_case_study_func \\<equiv>\n  (func.make signature_main [] [STR ''array'', STR ''res''] 0 (stmt_list array_case_study_stmts))\"\n\ndefinition array_case_study_program :: Cminor_Syntax.program where\n\"array_case_study_program \\<equiv> program.make\n  [(STR ''malloc'', Gfun (External EF_malloc)),\n  (STR ''free'', Gfun (External EF_free)),\n  (STR ''main'', Gfun (Internal array_case_study_func))]\n  [] (STR ''main'')\"\n\ndefinition \"array_case_study_jsoned \\<equiv> show_json (to_json array_case_study_program)\"\n\ndeclare array_case_study_program_def[code del]\n\n(* horrible hack *)\n\nlemma malloc_fix:\n  \"Sbuiltin r EF_malloc args = Scall r (ef_sig EF_malloc) (Econst (Oaddrsymbol (STR ''malloc'') 0)) args\"\n  sorry\n\nlemma free_fix:\n  \"Sbuiltin r EF_free args = Scall r (ef_sig EF_malloc) (Econst (Oaddrsymbol (STR ''free'') 0)) args\"\n  sorry\n\n(* don't prove anything after this point *)\n\nschematic_goal [code]: \"array_case_study_program \\<equiv> ?x\"\n  unfolding array_case_study_program_def\n  unfolding array_case_study_func_def\n  unfolding array_case_study_stmts_def\n  unfolding Sarray_alloc_def Sarray_free_def\n  apply (subst malloc_fix)\n  apply (subst free_fix)\n  by simp\n\nML_val \"writeln @{code array_case_study_jsoned}\"\n\nML \\<open>\nval using_master_directory =\n          File.full_path o Resources.master_directory o Proof_Context.theory_of;\nval path = using_master_directory @{context} (Path.basic \"array_case_study.cmj\");\nFile.write path @{code array_case_study_jsoned}\\<close>\n\nend", "meta": {"author": "mckirk", "repo": "Isabelle_Cminor", "sha": "76ae3d8bb8f84fefdf67f028f2db08020a79ceb1", "save_path": "github-repos/isabelle/mckirk-Isabelle_Cminor", "path": "github-repos/isabelle/mckirk-Isabelle_Cminor/Isabelle_Cminor-76ae3d8bb8f84fefdf67f028f2db08020a79ceb1/theory/src/Case_Study.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3290701375239353}}
{"text": "section \\<open>Definitions\\<close>\n\ntext \\<open>\nThis section contains all necessary definitions of this development. Section~\\ref{sec:pm} contains \nthe structural definition of our program model which includes the security specification as well \nas abstractions of control flow and data.  Executions of our program model are defined in \nsection~\\ref{sec:ex}.  Additional well-formedness properties are defined in section~\\ref{sec:wf}. \nOur security property is defined in section~\\ref{sec:sec}.  Our characterisation of how information\nis propagated by executions of our program model is defined in section~\\ref{sec:char-cp}, for which\nthe correctness result can be found in section~\\ref{sec:cor-cp}.  Section~\\ref{sec:char-scp} contains\nan additional approximation of this characterisation whose correctness result can be found in \nsection~\\ref{sec:cor-scp}.\n\\<close>\n\n\ntheory IFC\n  imports Main\nbegin\n\nsubsection \\<open>Program Model\\<close>\ntext_raw \\<open>\\label{sec:pm}\\<close>\n\ntext \\<open>Our program model contains all necessary components for the remaining development and consists of:\\<close>\n\nrecord ('n, 'var, 'val, 'obs) ifc_problem =  \n\\<comment> \\<open>A set of nodes representing program locations:\\<close>\n  nodes :: \\<open>'n set\\<close>\n\\<comment> \\<open>An initial node where all executions start:\\<close>\n  entry :: \\<open>'n\\<close>\n\\<comment> \\<open>A final node where executions can terminate:\\<close>\n  return :: \\<open>'n\\<close>\n\\<comment> \\<open>An abstraction of control flow in the form of an edge relation:\\<close>\n  edges :: \\<open>('n \\<times> 'n) set\\<close>\n\\<comment> \\<open>An abstraction of variables written at program locations:\\<close>\n  writes :: \\<open>'n \\<Rightarrow> 'var set\\<close>\n\\<comment> \\<open>An abstraction of variables read at program locations:\\<close>\n  reads :: \\<open>'n \\<Rightarrow> 'var set\\<close>\n\\<comment> \\<open>A set of variables containing the confidential information in the initial state:\\<close>\n  hvars :: \\<open>'var set\\<close>\n\\<comment> \\<open>A step function on location state pairs:\\<close>\n  step :: \\<open>('n \\<times> ('var \\<Rightarrow> 'val)) \\<Rightarrow> ('n \\<times> ('var \\<Rightarrow> 'val))\\<close>\n\\<comment> \\<open>An attacker model producing observations based on the reached state at certain locations:\\<close>\n  att :: \\<open>'n \\<rightharpoonup> (('var \\<Rightarrow> 'val) \\<Rightarrow> 'obs)\\<close>\n\ntext \\<open>We fix a program in the following in order to define the central concepts.  \nThe necessary well-formedness assumptions will be made in section~\\ref{sec:wf}.\\<close>\nlocale IFC_def =\nfixes prob :: \\<open>('n, 'var, 'val, 'obs) ifc_problem\\<close>\nbegin  \n\ntext \\<open>Some short hands to the components of the program which we will utilise exclusively in the following.\\<close>\ndefinition nodes where \\<open>nodes = ifc_problem.nodes prob\\<close>\ndefinition entry where \\<open>entry = ifc_problem.entry prob\\<close>\ndefinition return where \\<open>return = ifc_problem.return prob\\<close>\ndefinition edges where \\<open>edges = ifc_problem.edges prob\\<close>\ndefinition writes where \\<open>writes = ifc_problem.writes prob\\<close>\ndefinition reads where \\<open>reads = ifc_problem.reads prob\\<close>\ndefinition hvars where \\<open>hvars = ifc_problem.hvars prob\\<close>\ndefinition step where \\<open>step = ifc_problem.step prob\\<close>\ndefinition att where \\<open>att = ifc_problem.att prob\\<close>\n\ntext \\<open>The components of the step function for convenience.\\<close>\ndefinition suc where \\<open>suc n \\<sigma> = fst (step (n, \\<sigma>))\\<close>\ndefinition sem where \\<open>sem n \\<sigma> = snd (step (n, \\<sigma>))\\<close>\n\nlemma step_suc_sem: \\<open>step (n,\\<sigma>) = (suc n \\<sigma>, sem n \\<sigma>)\\<close> unfolding suc_def sem_def by auto\n\n\nsubsubsection \\<open>Executions\\<close>\ntext \\<open>\\label{sec:ex}\\<close>\ntext \\<open>In order to define what it means for a program to be well-formed, we first require concepts \nof executions and program paths.\\<close>\n\ntext \\<open>The sequence of nodes visited by the execution corresponding to an input state.\\<close>\ndefinition path where\n\\<open>path \\<sigma> k= fst ((step^^k) (entry,\\<sigma>))\\<close>\n\ntext \\<open>The sequence of states visited by the execution corresponding to an input state.\\<close>\ndefinition kth_state ( \\<open>_\\<^bsup>_\\<^esup>\\<close> [111,111] 110) where \n\\<open>\\<sigma>\\<^bsup>k\\<^esup> = snd ((step^^k) (entry,\\<sigma>))\\<close>\n\ntext \\<open>A predicate asserting that a sequence of nodes is a valid program path according to the\ncontrol flow graph.\\<close>\n\ndefinition is_path where\n\\<open>is_path \\<pi> = (\\<forall> n. (\\<pi> n, \\<pi> (Suc n)) \\<in> edges)\\<close> \nend\n\nsubsubsection \\<open>Well-formed Programs\\<close>\ntext_raw \\<open>\\label{sec:wf}\\<close>\n\ntext \\<open>The following assumptions define our notion of valid programs.\\<close>\nlocale IFC = IFC_def \\<open>prob\\<close> for prob:: \\<open>('n, 'var, 'val, 'out) ifc_problem\\<close> +\nassumes ret_is_node[simp,intro]: \\<open>return \\<in> nodes\\<close>\nand entry_is_node[simp,intro]: \\<open>entry \\<in> nodes\\<close>\nand writes: \\<open>\\<And> v n. (\\<exists>\\<sigma>. \\<sigma> v \\<noteq> sem n \\<sigma> v) \\<Longrightarrow> v \\<in> writes n\\<close>\nand writes_return: \\<open>writes return = {}\\<close>\nand uses_writes: \\<open>\\<And> n \\<sigma> \\<sigma>'. (\\<forall> v \\<in> reads n. \\<sigma> v = \\<sigma>' v) \\<Longrightarrow> \\<forall> v \\<in> writes n. sem n \\<sigma> v = sem n \\<sigma>' v\\<close>\nand uses_suc: \\<open>\\<And> n \\<sigma> \\<sigma>'. (\\<forall> v \\<in> reads n. \\<sigma> v = \\<sigma>' v) \\<Longrightarrow> suc n \\<sigma> = suc n \\<sigma>'\\<close>\nand uses_att: \\<open>\\<And> n f \\<sigma> \\<sigma>'. att n = Some f \\<Longrightarrow> (\\<forall> v \\<in> reads n. \\<sigma> v = \\<sigma>' v) \\<Longrightarrow> f \\<sigma> = f \\<sigma>'\\<close>\nand edges_complete[intro,simp]: \\<open>\\<And>m \\<sigma>. m \\<in> nodes \\<Longrightarrow> (m,suc m \\<sigma>) \\<in> edges\\<close>\nand edges_return : \\<open>\\<And>x. (return,x) \\<in> edges \\<Longrightarrow> x = return \\<close>\nand edges_nodes: \\<open>edges \\<subseteq> nodes \\<times> nodes\\<close>    \nand reaching_ret: \\<open>\\<And> x. x \\<in> nodes \\<Longrightarrow> \\<exists> \\<pi> n. is_path \\<pi> \\<and> \\<pi> 0 = x \\<and> \\<pi> n = return\\<close>\n\n\nsubsection \\<open>Security\\<close>\ntext_raw \\<open>\\label{sec:sec}\\<close>\n\ntext \\<open>We define our notion of security, which corresponds to what Bohannon et al.~\\<^cite>\\<open>\"Bohannon:2009:RN:1653662.1653673\"\\<close> \nrefer to as indistinguishable security.  In order to do so we require notions of observations made\nby the attacker, termination and equivalence of input states.\\<close>\n\ncontext IFC_def\nbegin\n\nsubsubsection \\<open>Observations\\<close>\ntext_raw \\<open>\\label{sec:obs}\\<close>\n\ntext \\<open>The observation made at a given index within an execution.\\<close>\ndefinition obsp where\n\\<open>obsp \\<sigma> k = (case att(path \\<sigma> k) of Some f \\<Rightarrow> Some (f (\\<sigma>\\<^bsup>k\\<^esup>)) | None \\<Rightarrow> None)\\<close>\n\ntext \\<open>The indices within a path where an observation is made.\\<close>\ndefinition obs_ids :: \\<open>(nat \\<Rightarrow> 'n) \\<Rightarrow> nat set\\<close> where\n\\<open>obs_ids \\<pi> = {k. att (\\<pi> k) \\<noteq> None}\\<close>\n\ntext \\<open>A predicate relating an observable index to the number of observations made before.\\<close>\ndefinition is_kth_obs :: \\<open>(nat \\<Rightarrow> 'n) \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool\\<close>where\n\\<open>is_kth_obs \\<pi> k i = (card (obs_ids \\<pi> \\<inter> {..<i}) = k \\<and> att (\\<pi> i) \\<noteq>  None)\\<close>\n\ntext \\<open>The final sequence of observations made for an execution.\\<close>\ndefinition obs where\n\\<open>obs \\<sigma> k = (if (\\<exists>i. is_kth_obs (path \\<sigma>) k i) then obsp \\<sigma> (THE i. is_kth_obs (path \\<sigma>) k i) else None)\\<close>\n\ntext \\<open>Comparability of observations.\\<close>\ndefinition obs_prefix :: \\<open>(nat \\<Rightarrow> 'obs option) \\<Rightarrow> (nat \\<Rightarrow> 'obs option) \\<Rightarrow> bool\\<close> (infix \\<open>\\<lesssim>\\<close> 50) where\n\\<open>a \\<lesssim> b \\<equiv> \\<forall> i. a i \\<noteq> None \\<longrightarrow> a i = b i\\<close>\n\ndefinition obs_comp (infix \\<open>\\<approx>\\<close> 50) where\n\\<open>a \\<approx> b \\<equiv> a \\<lesssim> b \\<or> b \\<lesssim> a\\<close>\n\nsubsubsection \\<open>Low equivalence of input states\\<close>\n\ndefinition restrict (infix \\<open>\\<restriction>\\<close> 100 ) where\n\\<open>f\\<restriction>U = (\\<lambda> n. if n \\<in> U then f n else undefined)\\<close>\n\ntext \\<open>Two input states are low equivalent if they coincide on the non high variables.\\<close>\ndefinition loweq (infix \\<open>=\\<^sub>L\\<close> 50) \nwhere \\<open>\\<sigma> =\\<^sub>L \\<sigma>' = (\\<sigma>\\<restriction>(-hvars) = \\<sigma>'\\<restriction>(-hvars))\\<close>\n\nsubsubsection \\<open>Termination\\<close>\n\ntext \\<open>An execution terminates iff it reaches the terminal node at any point.\\<close>\ndefinition terminates where\n\\<open>terminates \\<sigma> \\<equiv> \\<exists> i. path \\<sigma> i = return\\<close>\n\n\nsubsubsection \\<open>Security Property\\<close>\ntext \\<open>The fixed program is secure if and only if for all pairs of low equivalent inputs the observation\nsequences are comparable and if the execution for an input state terminates then the observation sequence \nis not missing any observations.\\<close>\n\ndefinition secure where\n\\<open>secure \\<equiv> \\<forall> \\<sigma> \\<sigma>'. \\<sigma> =\\<^sub>L \\<sigma>' \\<longrightarrow> (obs \\<sigma> \\<approx> obs \\<sigma>' \\<and> (terminates \\<sigma> \\<longrightarrow> obs \\<sigma>' \\<lesssim> obs \\<sigma>))\\<close>\n\n\n\nsubsection \\<open>Characterisation of Information Flows\\<close>\ntext \\<open>We now define our characterisation of information flows which tracks data and control dependencies \nwithin executions. To do so we first require some additional concepts.\\<close>\n\nsubsubsection \\<open>Post Dominance\\<close>\ntext \\<open>We utilise the post dominance relation in order to define control dependence.\\<close>\n\ntext \\<open>The basic post dominance relation.\\<close>\ndefinition is_pd (infix \\<open>pd\\<rightarrow>\\<close> 50) where \n\\<open>y pd\\<rightarrow> x \\<longleftrightarrow> x \\<in> nodes \\<and> (\\<forall> \\<pi> n. is_path \\<pi> \\<and> \\<pi> (0::nat) = x \\<and> \\<pi> n = return \\<longrightarrow> (\\<exists>k\\<le>n. \\<pi> k = y))\\<close>\n\ntext \\<open>The immediate post dominance relation.\\<close>\ndefinition is_ipd (infix \\<open>ipd\\<rightarrow>\\<close> 50)where\n\\<open>y ipd\\<rightarrow> x \\<longleftrightarrow> x \\<noteq> y \\<and> y pd\\<rightarrow> x \\<and> (\\<forall> z. z\\<noteq>x \\<and> z pd\\<rightarrow> x \\<longrightarrow> z pd\\<rightarrow> y)\\<close>\n\ndefinition ipd where \n\\<open>ipd x = (THE y. y ipd\\<rightarrow> x)\\<close>\n\ntext \\<open>The post dominance tree.\\<close>\ndefinition pdt where\n\\<open>pdt = {(x,y). x\\<noteq>y \\<and> y pd\\<rightarrow> x}\\<close>\n\n\nsubsubsection \\<open>Control Dependence\\<close>\n\ntext \\<open>An index on an execution path is control dependent upon another if the path does not visit\nthe immediate post domiator of the node reached by the smaller index.\\<close>\ndefinition is_cdi (\\<open>_ cd\\<^bsup>_\\<^esup>\\<rightarrow> _\\<close> [51,51,51]50) where\n\\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<longleftrightarrow> is_path \\<pi> \\<and> k < i \\<and> \\<pi> i \\<noteq> return \\<and> (\\<forall> j \\<in> {k..i}. \\<pi> j \\<noteq> ipd (\\<pi> k))\\<close> \n\ntext \\<open>The largest control dependency of an index is the immediate control dependency.\\<close>\ndefinition is_icdi (\\<open>_ icd\\<^bsup>_\\<^esup>\\<rightarrow> _\\<close> [51,51,51]50) where\n\\<open>n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n' \\<longleftrightarrow> is_path \\<pi> \\<and> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n' \\<and> (\\<forall> m \\<in> {n'<..<n}.\\<not> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m)\\<close>\n\ntext \\<open>For the definition of the control slice, which we will define next, we require the uniqueness \nof the immediate control dependency.\\<close>\n\nlemma icd_uniq: assumes  \\<open>m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> \\<open> m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n'\\<close> shows \\<open>n = n'\\<close>\nproof - \n  {\n    fix n n' assume *: \\<open>m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> \\<open> m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n'\\<close> \\<open>n < n'\\<close>\n    have \\<open>n'<m\\<close> using * unfolding is_icdi_def is_cdi_def by auto    \n    hence \\<open>\\<not> m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n'\\<close> using * unfolding is_icdi_def by auto\n    with *(2) have \\<open>False\\<close> unfolding is_icdi_def by auto\n  }\n  thus ?thesis using assms by (metis linorder_neqE_nat)\nqed\n\n\nsubsubsection \\<open>Control Slice\\<close>\ntext \\<open>We utilise the control slice, that is the sequence of nodes visited by the control dependencies \nof an index, to match indices between executions.\\<close>\n\nfunction cs:: \\<open>(nat \\<Rightarrow> 'n) \\<Rightarrow> nat \\<Rightarrow> 'n list\\<close> (\\<open>cs\\<^bsup>_\\<^esup> _\\<close> [51,70] 71) where\n\\<open>cs\\<^bsup>\\<pi>\\<^esup> n = (if (\\<exists> m. n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m) then (cs \\<pi> (THE m. n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m))@[\\<pi> n] else [\\<pi> n])\\<close> \nby pat_completeness auto  \ntermination \\<open>cs\\<close> proof\n  show \\<open>wf (measure snd)\\<close> by simp\n  fix \\<pi> n  \n  define m where \\<open>m == (The (is_icdi n \\<pi>))\\<close>\n  assume \\<open>Ex (is_icdi n \\<pi>)\\<close> \n  hence \\<open>n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> unfolding m_def by (metis (full_types) icd_uniq theI')\n  hence \\<open>m < n\\<close> unfolding is_icdi_def is_cdi_def by simp\n  thus \\<open>((\\<pi>, The (is_icdi n \\<pi>)), \\<pi>, n) \\<in> measure snd\\<close> by (metis in_measure m_def snd_conv)\nqed\n\ninductive cs_less (infix \\<open>\\<prec>\\<close> 50) where\n\\<open>length xs < length ys \\<Longrightarrow> take (length xs) ys = xs  \\<Longrightarrow> xs \\<prec> ys\\<close>     \n\ndefinition cs_select (infix \\<open>\\<exclamdown>\\<close> 50) where\n\\<open>\\<pi>\\<exclamdown>xs = (THE k. cs\\<^bsup>\\<pi>\\<^esup> k = xs)\\<close>\n\n\nsubsubsection \\<open>Data Dependence\\<close>\n\ntext \\<open>Data dependence is defined straight forward. An index is data dependent upon another, \nif the index reads a variable written by the earlier index and the variable in question has not \nbeen written by any index in between.\\<close>\ndefinition is_ddi (\\<open>_ dd\\<^bsup>_,_\\<^esup>\\<rightarrow> _\\<close> [51,51,51,51] 50) where\n\\<open>n dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> m \\<longleftrightarrow> is_path \\<pi> \\<and> m < n \\<and> v \\<in> reads (\\<pi> n) \\<inter> (writes (\\<pi> m)) \\<and> (\\<forall> l \\<in> {m<..<n}. v \\<notin> writes (\\<pi> l))\\<close>\n\n\n\nsubsubsection \\<open>Characterisation via Critical Paths\\<close>\ntext_raw \\<open>\\label{sec:char-cp}\\<close>\ntext \\<open>With the above we define the set of critical paths which as we will prove characterise the matching\npoints in executions where diverging data is read.\\<close>\n\ninductive_set cp where\n\n\\<comment> \\<open>Any pair of low equivalent input states and indices where a diverging high variable is first\nread is critical.\\<close>\n\n\\<open>\\<lbrakk>\\<sigma> =\\<^sub>L \\<sigma>'; \n  cs\\<^bsup>path \\<sigma>\\<^esup> n = cs\\<^bsup>path \\<sigma>'\\<^esup> n'; \n  h \\<in> reads(path \\<sigma> n); \n  (\\<sigma>\\<^bsup>n\\<^esup>) h \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) h; \n  \\<forall> k<n. h\\<notin>writes(path \\<sigma> k); \n  \\<forall> k'<n'. h\\<notin>writes(path \\<sigma>' k')\n \\<rbrakk> \\<Longrightarrow> ((\\<sigma>,n),(\\<sigma>',n')) \\<in> cp\\<close> |\n\n\\<comment> \\<open>If from a pair of critical indices in two executions there exist data dependencies from both\nindices to a pair of matching indices where the variable diverges, the later pair of indices is critical.\\<close>\n\n\\<open>\\<lbrakk>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp; \n  n dd\\<^bsup>path \\<sigma>,v\\<^esup>\\<rightarrow> k;\n  n' dd\\<^bsup>path \\<sigma>',v\\<^esup>\\<rightarrow> k'; \n  cs\\<^bsup>path \\<sigma>\\<^esup> n = cs\\<^bsup>path \\<sigma>'\\<^esup> n'; \n  (\\<sigma>\\<^bsup>n\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v\n \\<rbrakk> \\<Longrightarrow> ((\\<sigma>,n),(\\<sigma>',n')) \\<in> cp\\<close> |\n\n\\<comment> \\<open>If from a pair of critical indices the executions take different branches and one of the critical \nindices is a control dependency of an index that is data dependency of a matched index where diverging \ndata is read and the variable in question is not written by the other execution after the executions\nfirst reached matching indices again, then the later matching pair of indices is critical.\\<close>\n\n\\<open>\\<lbrakk>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp; \n  n dd\\<^bsup>path \\<sigma>,v\\<^esup>\\<rightarrow> l; \n  l cd\\<^bsup>path \\<sigma>\\<^esup>\\<rightarrow> k; \n  cs\\<^bsup>path \\<sigma>\\<^esup> n = cs\\<^bsup>path \\<sigma>'\\<^esup> n'; \n  path \\<sigma> (Suc k) \\<noteq> path \\<sigma>' (Suc k'); \n  (\\<sigma>\\<^bsup>n\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v; \n  \\<forall>j'\\<in>{(LEAST i'. k' < i' \\<and> (\\<exists>i. cs\\<^bsup>path \\<sigma>\\<^esup> i = cs\\<^bsup>path \\<sigma>'\\<^esup> i'))..<n'}. v\\<notin>writes (path \\<sigma>' j')\n \\<rbrakk> \\<Longrightarrow> ((\\<sigma>,n),(\\<sigma>',n')) \\<in> cp\\<close> | \n\n\\<comment> \\<open>The relation is symmetric.\\<close>\n\n\\<open>\\<lbrakk>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp\\<rbrakk> \\<Longrightarrow> ((\\<sigma>',k'),(\\<sigma>,k)) \\<in> cp\\<close>\n\n\ntext \\<open>Based on the set of critical paths, the critical observable paths are those that either directly \nreach observable nodes or are diverging control dependencies of an observable index.\\<close>\n\ninductive_set cop where\n\\<open>\\<lbrakk>((\\<sigma>,n),(\\<sigma>',n')) \\<in> cp;\n  path \\<sigma> n \\<in> dom att\n \\<rbrakk> \\<Longrightarrow> ((\\<sigma>,n),(\\<sigma>',n')) \\<in> cop\\<close> |\n\n\\<open>\\<lbrakk>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp; \n  n cd\\<^bsup>path \\<sigma>\\<^esup>\\<rightarrow> k; \n  path \\<sigma> (Suc k) \\<noteq> path \\<sigma>' (Suc k'); \n  path \\<sigma> n \\<in> dom att\n \\<rbrakk> \\<Longrightarrow> ((\\<sigma>,n),(\\<sigma>',k')) \\<in> cop\\<close>\n\n\n\nsubsubsection \\<open>Approximation via Single Critical Paths\\<close>\ntext_raw \\<open>\\label{sec:char-scp}\\<close>\n\ntext \\<open>For applications we also define a single execution approximation.\\<close>\n\ndefinition is_dcdi_via (\\<open>_ dcd\\<^bsup>_,_\\<^esup>\\<rightarrow> _ via _ _\\<close> [51,51,51,51,51,51] 50) where\n\\<open>n dcd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> m via \\<pi>' m' = (is_path \\<pi> \\<and> m < n \\<and> (\\<exists> l' n'. cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m' \\<and> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n' \\<and> n' dd\\<^bsup>\\<pi>',v\\<^esup>\\<rightarrow> l' \\<and> l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m') \\<and> (\\<forall> l \\<in> {m..<n}. v\\<notin> writes(\\<pi> l)))\\<close>\n\ninductive_set scp where\n\\<open>\\<lbrakk>h \\<in> hvars; h \\<in> reads (path \\<sigma> n); (\\<forall> k<n. h\\<notin> writes(path \\<sigma> k))\\<rbrakk> \\<Longrightarrow> (path \\<sigma>,n) \\<in> scp\\<close> |\n\\<open>\\<lbrakk>(\\<pi>,m) \\<in> scp; n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<rbrakk> \\<Longrightarrow> (\\<pi>,n) \\<in> scp\\<close>|\n\\<open>\\<lbrakk>(\\<pi>,m) \\<in> scp; n dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> m\\<rbrakk> \\<Longrightarrow> (\\<pi>,n) \\<in> scp\\<close>|\n\\<open>\\<lbrakk>(\\<pi>,m) \\<in> scp; (\\<pi>',m') \\<in> scp; n dcd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> m via \\<pi>' m'\\<rbrakk> \\<Longrightarrow> (\\<pi>,n) \\<in> scp\\<close>\n\ninductive_set scop where\n\\<open>\\<lbrakk>(\\<pi>,n) \\<in> scp; \\<pi> n \\<in> dom att\\<rbrakk> \\<Longrightarrow> (\\<pi>,n) \\<in> scop\\<close>\n\n\n\nsubsubsection \\<open>Further Definitions\\<close>\ntext \\<open>The following concepts are utilised by the proofs.\\<close>\n\ninductive contradicts (infix \\<open>\\<cc>\\<close> 50) where\n\\<open>\\<lbrakk>cs\\<^bsup>\\<pi>'\\<^esup> k' \\<prec> cs\\<^bsup>\\<pi>\\<^esup> k ; \\<pi> = path \\<sigma>;  \\<pi>' = path \\<sigma>' ; \\<pi> (Suc (\\<pi>\\<exclamdown>cs\\<^bsup>\\<pi>'\\<^esup> k')) \\<noteq> \\<pi>' (Suc k')\\<rbrakk> \\<Longrightarrow> (\\<sigma>', k') \\<cc> (\\<sigma>, k)\\<close>|\n\\<open>\\<lbrakk>cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>\\<^esup> k ; \\<pi> = path \\<sigma>;  \\<pi>' = path \\<sigma>' ; \\<sigma>\\<^bsup>k\\<^esup> \\<restriction> (reads (\\<pi> k)) \\<noteq> \\<sigma>'\\<^bsup>k'\\<^esup> \\<restriction> (reads (\\<pi> k))\\<rbrakk> \\<Longrightarrow> (\\<sigma>',k') \\<cc> (\\<sigma>,k)\\<close>\n\ndefinition path_shift (infixl \\<open>\\<guillemotleft>\\<close> 51) where \n[simp]: \\<open>\\<pi>\\<guillemotleft>m = (\\<lambda> n. \\<pi> (m+n))\\<close> \n\ndefinition path_append :: \\<open>(nat \\<Rightarrow> 'n) \\<Rightarrow> nat \\<Rightarrow> (nat \\<Rightarrow> 'n) \\<Rightarrow> (nat \\<Rightarrow> 'n)\\<close> (\\<open>_ @\\<^bsup>_\\<^esup> _\\<close> [0,0,999] 51) where\n[simp]: \\<open>\\<pi> @\\<^bsup>m\\<^esup> \\<pi>' = (\\<lambda>n.(if n \\<le> m then \\<pi> n else \\<pi>' (n-m)))\\<close> \n\ndefinition eq_up_to :: \\<open>(nat \\<Rightarrow> 'n) \\<Rightarrow> nat \\<Rightarrow> (nat \\<Rightarrow> 'n) \\<Rightarrow> bool\\<close> (\\<open>_ =\\<^bsub>_\\<^esub> _\\<close> [55,55,55] 50) where\n\\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>' = (\\<forall> i \\<le> k. \\<pi> i = \\<pi>' i)\\<close>\n\nend (* End of locale IFC_def *)\n\n\n\n\nsection \\<open>Proofs\\<close>\ntext_raw \\<open>\\label{sec:proofs}\\<close>\n\nsubsection \\<open>Miscellaneous Facts\\<close>\n\nlemma option_neq_cases: assumes \\<open>x \\<noteq> y\\<close> obtains (none1) a where \\<open>x = None\\<close> \\<open>y = Some a\\<close> | (none2) a where \\<open>x = Some a\\<close> \\<open>y = None\\<close> | (some) a b where \\<open>x = Some a\\<close> \\<open>y = Some b\\<close> \\<open>a \\<noteq> b\\<close> using assms by fastforce\n\nlemmas nat_sym_cases[case_names less sym eq] = linorder_less_wlog\n\nlemma mod_bound_instance: assumes \\<open>j < (i::nat)\\<close> obtains j' where \\<open>k < j'\\<close> and \\<open>j' mod i = j\\<close>  proof -\n  have \\<open>k < Suc k * i + j\\<close> using assms less_imp_Suc_add by fastforce\n  moreover\n  have \\<open>(Suc k * i + j) mod i = j\\<close> by (metis assms mod_less mod_mult_self3) \n  ultimately show \\<open>thesis\\<close> using that by auto\nqed\n\nlemma list_neq_prefix_cases: assumes \\<open>ls \\<noteq> ls'\\<close> and \\<open>ls \\<noteq> Nil\\<close> and \\<open>ls' \\<noteq> Nil\\<close>\n  obtains (diverge) xs x x' ys ys' where \\<open>ls = xs@[x]@ys\\<close> \\<open>ls' = xs@[x']@ys'\\<close> \\<open>x \\<noteq> x'\\<close> |\n   (prefix1) xs where \\<open>ls = ls'@xs\\<close> and \\<open>xs \\<noteq> Nil\\<close> |\n   (prefix2) xs where \\<open>ls@xs = ls'\\<close> and \\<open>xs \\<noteq> Nil\\<close> \nusing assms proof (induct \\<open>length ls\\<close> arbitrary: \\<open>ls\\<close> \\<open>ls'\\<close> rule: less_induct)\n  case (less ls ls')\n  obtain z zs z' zs' where\n  lz: \\<open>ls = z#zs\\<close> \\<open>ls' = z'#zs'\\<close> by (metis list.exhaust less(6,7))\n  show \\<open>?case\\<close> proof cases\n    assume zz: \\<open>z = z'\\<close>\n    hence zsz: \\<open>zs \\<noteq> zs'\\<close> using less(5) lz by auto\n    have lenz: \\<open>length zs < length ls\\<close> using lz by auto    \n    show \\<open>?case\\<close> proof(cases \\<open>zs = Nil\\<close>)\n      assume zs: \\<open>zs = Nil\\<close>\n      hence \\<open>zs' \\<noteq> Nil\\<close> using zsz by auto\n      moreover\n      have \\<open>ls@zs' = ls'\\<close> using zs lz zz by auto\n      ultimately\n      show \\<open>thesis\\<close> using less(4) by blast\n    next\n      assume zs: \\<open>zs \\<noteq> Nil\\<close>\n      show \\<open>thesis\\<close> proof (cases \\<open>zs' = Nil\\<close>)\n        assume \\<open>zs' = Nil\\<close>\n        hence \\<open>ls = ls'@zs\\<close> using lz zz by auto\n        thus \\<open>thesis\\<close> using zs less(3) by blast\n      next\n        assume zs': \\<open>zs' \\<noteq> Nil\\<close>\n        { fix xs x ys x' ys' \n          assume \\<open>zs = xs @ [x] @ ys\\<close> \\<open>zs' = xs @ [x'] @ ys'\\<close> and xx: \\<open>x \\<noteq> x'\\<close>\n          hence \\<open>ls = (z#xs) @ [x] @ ys\\<close> \\<open>ls' = (z#xs) @ [x'] @ ys'\\<close> using lz zz by auto\n          hence \\<open>thesis\\<close> using less(2) xx by blast\n        } note * = this\n        { fix xs \n          assume \\<open>zs = zs' @ xs\\<close> and xs: \\<open>xs \\<noteq> []\\<close>\n          hence \\<open>ls = ls' @ xs\\<close> using lz zz by auto\n          hence \\<open>thesis\\<close> using xs less(3) by blast\n        } note ** = this\n        { fix xs \n          assume \\<open>zs@xs = zs'\\<close> and xs: \\<open>xs \\<noteq> []\\<close>\n          hence \\<open>ls@xs = ls'\\<close> using lz zz by auto\n          hence \\<open>thesis\\<close> using xs less(4) by blast\n        } note *** = this\n        have \\<open>(\\<And>xs x ys x' ys'. zs = xs @ [x] @ ys \\<Longrightarrow> zs' = xs @ [x'] @ ys' \\<Longrightarrow> x \\<noteq> x' \\<Longrightarrow> thesis) \\<Longrightarrow> \n              (\\<And>xs. zs = zs' @ xs \\<Longrightarrow> xs \\<noteq> [] \\<Longrightarrow> thesis) \\<Longrightarrow> \n              (\\<And>xs. zs @ xs = zs' \\<Longrightarrow> xs \\<noteq> [] \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close> \n        using less(1)[OF lenz _ _ _ zsz zs zs' ] .\n        thus \\<open>thesis\\<close> using * ** *** by blast\n      qed\n    qed \n  next\n    assume \\<open>z \\<noteq> z'\\<close>\n    moreover\n    have \\<open>ls = []@[z]@zs\\<close> \\<open>ls' = []@[z']@zs'\\<close> using lz by auto\n    ultimately show \\<open>thesis\\<close> using less(2) by blast\n  qed\nqed\n\nlemma three_cases: assumes \\<open>A \\<or> B \\<or> C\\<close> obtains \\<open>A\\<close> | \\<open>B\\<close> | \\<open>C\\<close> using assms by auto\n\nlemma insort_greater: \\<open>\\<forall> x \\<in> set ls. x < y \\<Longrightarrow> insort y ls = ls@[y]\\<close> by (induction \\<open>ls\\<close>,auto) \n\nlemma insort_append_first: assumes \\<open>\\<forall> y \\<in> set ys. x \\<le> y\\<close> shows \\<open>insort x (xs@ys) = insort x xs @ ys\\<close> using assms by (induction \\<open>xs\\<close>,auto,metis insort_is_Cons)\n\nlemma sorted_list_of_set_append: assumes \\<open>finite xs\\<close> \\<open>finite ys\\<close> \\<open>\\<forall> x \\<in> xs. \\<forall> y \\<in> ys. x < y\\<close> shows \\<open>sorted_list_of_set (xs \\<union> ys) = sorted_list_of_set xs @ (sorted_list_of_set ys)\\<close>\nusing assms(1,3) proof (induction \\<open>xs\\<close>)\n  case empty thus \\<open>?case\\<close> by simp\nnext\n  case (insert x xs)\n  hence iv: \\<open>sorted_list_of_set (xs \\<union> ys) = sorted_list_of_set xs @ sorted_list_of_set ys\\<close> by blast\n  have le: \\<open>\\<forall> y \\<in> set (sorted_list_of_set ys). x < y\\<close> using insert(4) assms(2) sorted_list_of_set by auto\n  have \\<open>sorted_list_of_set (insert x xs \\<union> ys) = sorted_list_of_set (insert x (xs \\<union> ys))\\<close> by auto\n  also \n  have \\<open>\\<dots> = insort x (sorted_list_of_set (xs \\<union> ys))\\<close> by (metis Un_iff assms(2) finite_Un insert.hyps(1) insert.hyps(2) insert.prems insertI1 less_irrefl sorted_list_of_set_insert)\n  also \n  have \\<open>\\<dots> = insort x (sorted_list_of_set xs @ sorted_list_of_set ys)\\<close> using iv by simp\n  also\n  have \\<open>\\<dots> = insort x (sorted_list_of_set xs) @ sorted_list_of_set ys\\<close>  by (metis le insort_append_first less_le_not_le)\n  also \n  have \\<open>\\<dots> = sorted_list_of_set (insert x xs) @ sorted_list_of_set ys\\<close> using sorted_list_of_set_insert[OF insert(1),of \\<open>x\\<close>] insert(2) by auto\n  finally  \n  show \\<open>?case\\<close> .\nqed\n\nlemma filter_insort: \\<open>sorted xs \\<Longrightarrow> filter P (insort x xs) = (if P x then insort x (filter P xs) else filter P xs)\\<close> by (induction \\<open>xs\\<close>, simp) (metis filter_insort filter_insort_triv map_ident) \n\nlemma filter_sorted_list_of_set: assumes \\<open>finite xs\\<close> shows \\<open>filter P (sorted_list_of_set xs) = sorted_list_of_set {x \\<in> xs. P x}\\<close> using assms proof(induction \\<open>xs\\<close>)\n  case empty thus \\<open>?case\\<close> by simp\nnext  \n  case (insert x xs)\n  have *: \\<open>set (sorted_list_of_set xs) = xs\\<close> \\<open>sorted (sorted_list_of_set xs)\\<close> \\<open>distinct (sorted_list_of_set xs)\\<close> by (auto simp add: insert.hyps(1))\n  have **: \\<open>P x \\<Longrightarrow> {y \\<in> insert x xs. P y} = insert x {y \\<in> xs. P y}\\<close> by auto\n  have ***: \\<open>\\<not> P x \\<Longrightarrow> {y \\<in> insert x xs. P y} = {y \\<in> xs. P y}\\<close> by auto\n  note filter_insort[OF *(2),of \\<open>P\\<close> \\<open>x\\<close>] sorted_list_of_set_insert[OF insert(1), of \\<open>x\\<close>] insert(2,3) ** ***  \n  thus \\<open>?case\\<close> by (metis (mono_tags) \"*\"(1) List.finite_set distinct_filter distinct_insort distinct_sorted_list_of_set set_filter sorted_list_of_set_insert)\nqed\n\nlemma unbounded_nat_set_infinite: assumes \\<open>\\<forall> (i::nat). \\<exists> j\\<ge>i. j \\<in> A\\<close> shows \\<open>\\<not> finite A\\<close> using assms\nby (metis finite_nat_set_iff_bounded_le not_less_eq_eq)\n\nlemma infinite_ascending: assumes nf: \\<open>\\<not> finite (A::nat set)\\<close> obtains f where \\<open>range f = A\\<close> \\<open>\\<forall> i. f i < f (Suc i)\\<close> proof \n  let \\<open>?f\\<close> = \\<open>\\<lambda> i. (LEAST a. a \\<in> A \\<and> card (A \\<inter> {..<a}) = i)\\<close>\n  { fix i \n    obtain a where \\<open>a \\<in> A\\<close> \\<open>card (A \\<inter> {..<a}) = i\\<close> \n    proof (induction \\<open>i\\<close> arbitrary: \\<open>thesis\\<close>)\n      case 0\n      let \\<open>?a0\\<close> = \\<open>(LEAST a. a \\<in> A)\\<close>\n      have \\<open>?a0 \\<in> A\\<close> by (metis LeastI empty_iff finite.emptyI nf set_eq_iff)      \n      moreover\n      have \\<open>\\<And>b. b \\<in> A \\<Longrightarrow> ?a0 \\<le> b\\<close> by (metis Least_le)\n      hence \\<open>card (A \\<inter> {..<?a}) = 0\\<close> by force\n      ultimately\n      show \\<open>?case\\<close> using 0 by blast\n    next\n      case (Suc i)\n      obtain a where aa: \\<open>a \\<in> A\\<close> and card: \\<open>card (A \\<inter> {..<a}) = i\\<close> using Suc.IH by metis\n      have nf': \\<open>~ finite (A - {..a})\\<close> using nf by auto\n      let \\<open>?b\\<close> = \\<open>LEAST b. b \\<in> A - {..a}\\<close>\n      have bin: \\<open>?b \\<in> A-{..a}\\<close> by (metis LeastI empty_iff finite.emptyI nf' set_eq_iff)\n      have le: \\<open>\\<And>c. c \\<in> A-{..a} \\<Longrightarrow> ?b \\<le> c\\<close> by (metis Least_le)\n      have ab: \\<open>a < ?b\\<close> using bin by auto\n      have \\<open>\\<And> c. c \\<in> A \\<Longrightarrow> c < ?b \\<Longrightarrow> c \\<le> a\\<close> using le by force\n      hence \\<open>A \\<inter> {..<?b} = insert a (A \\<inter> {..<a})\\<close> using bin ab aa by force \n      hence \\<open>card (A \\<inter>{..<?b}) = Suc i\\<close> using card by auto\n      thus \\<open>?case\\<close> using Suc.prems bin by auto\n    qed\n    note \\<open>\\<And> thesis. ((\\<And>a. a \\<in> A \\<Longrightarrow> card (A \\<inter> {..<a}) = i \\<Longrightarrow> thesis) \\<Longrightarrow> thesis)\\<close>\n  }\n  note ex = this\n    \n  {\n    fix i\n    obtain a where a: \\<open>a \\<in> A \\<and> card (A \\<inter>{..<a}) = i\\<close>  using ex by blast\n    have ina: \\<open>?f i \\<in> A\\<close> and card: \\<open>card (A \\<inter>{..<?f i}) = i\\<close> using LeastI[of \\<open>\\<lambda> a. a \\<in> A \\<and> card (A \\<inter>{..<a}) = i\\<close> \\<open>a\\<close>, OF a] by auto    \n    obtain b where b: \\<open>b \\<in> A \\<and> card (A \\<inter>{..<b}) = Suc i\\<close>  using ex by blast\n    have inab: \\<open>?f (Suc i) \\<in> A\\<close> and cardb: \\<open>card (A \\<inter>{..<?f (Suc i)}) = Suc i\\<close> using LeastI[of \\<open>\\<lambda> a. a \\<in> A \\<and> card (A \\<inter>{..<a}) = Suc i\\<close> \\<open>b\\<close>, OF b] by auto\n    have \\<open>?f i < ?f (Suc i)\\<close> proof (rule ccontr)\n      assume \\<open>\\<not> ?f i < ?f (Suc i)\\<close>\n      hence \\<open>A \\<inter>{..<?f (Suc i)} \\<subseteq> A \\<inter>{..<?f i}\\<close> by auto\n      moreover have \\<open>finite (A \\<inter>{..<?f i})\\<close> by auto\n      ultimately have \\<open>card(A \\<inter>{..<?f (Suc i)}) \\<le> card (A \\<inter>{..<?f i})\\<close> by (metis (erased, lifting) card_mono)\n      thus \\<open>False\\<close> using card cardb by auto \n    qed\n    note this ina\n  }\n  note b = this\n  thus \\<open>\\<forall> i. ?f i < ?f (Suc i)\\<close> by auto\n  have *: \\<open>range ?f \\<subseteq> A\\<close> using b by auto\n  moreover\n  { \n    fix a assume ina: \\<open>a \\<in> A\\<close>\n    let \\<open>?i\\<close> = \\<open>card (A \\<inter> {..<a})\\<close>\n    obtain b where b: \\<open>b \\<in> A \\<and> card (A \\<inter>{..<b}) = ?i\\<close>  using ex by blast\n    have inab: \\<open>?f ?i \\<in> A\\<close> and cardb: \\<open>card (A \\<inter>{..<?f ?i}) = ?i\\<close> using LeastI[of \\<open>\\<lambda> a. a \\<in> A \\<and> card (A \\<inter>{..<a}) = ?i\\<close> \\<open>b\\<close>, OF b] by auto\n    have le: \\<open>?f ?i \\<le> a\\<close> using Least_le[of \\<open>\\<lambda> a. a \\<in> A \\<and> card (A \\<inter>{..<a}) = ?i\\<close> \\<open>a\\<close>] ina by auto    \n    have \\<open>a = ?f ?i\\<close> proof (rule ccontr)\n      have fin: \\<open>finite (A \\<inter> {..<a})\\<close> by auto\n      assume \\<open>a \\<noteq> ?f ?i\\<close>\n      hence \\<open>?f ?i < a\\<close> using le by simp\n      hence \\<open>?f ?i \\<in> A \\<inter> {..<a}\\<close> using inab by auto\n      moreover\n      have \\<open>A \\<inter> {..<?f ?i} \\<subseteq> A \\<inter> {..<a}\\<close> using le by auto\n      hence \\<open>A \\<inter> {..<?f ?i} = A \\<inter> {..<a}\\<close> using cardb card_subset_eq[OF fin] by auto\n      ultimately      \n      show \\<open>False\\<close> by auto\n    qed\n    hence \\<open>a \\<in> range ?f\\<close> by auto\n  }\n  hence \\<open>A \\<subseteq> range ?f\\<close> by auto \n  ultimately show \\<open>range ?f = A\\<close> by auto\nqed\n\nlemma mono_ge_id: \\<open>\\<forall> i. f i < f (Suc i) \\<Longrightarrow> i \\<le> f i\\<close> \n  apply (induction \\<open>i\\<close>,auto) \n  by (metis not_le not_less_eq_eq order_trans)\n\nlemma insort_map_mono: assumes mono: \\<open>\\<forall> n m. n < m \\<longrightarrow> f n < f m\\<close> shows \\<open>map f (insort n ns) = insort (f n) (map f ns)\\<close>\n  apply (induction \\<open>ns\\<close>)\n   apply auto\n     apply (metis not_less not_less_iff_gr_or_eq mono)\n    apply (metis antisym_conv1 less_imp_le mono)\n   apply (metis mono not_less)\n  by (metis mono not_less)  \n\nlemma sorted_list_of_set_map_mono: assumes mono: \\<open>\\<forall> n m. n < m \\<longrightarrow> f n < f m\\<close> and fin: \\<open>finite A\\<close>\nshows \\<open>map f (sorted_list_of_set A) = sorted_list_of_set (f`A)\\<close>\nusing fin proof (induction)\n  case empty thus \\<open>?case\\<close> by simp\nnext\n  case (insert x A)\n  have [simp]:\\<open>sorted_list_of_set (insert x A) = insort x (sorted_list_of_set A)\\<close> using insert sorted_list_of_set_insert by simp\n  have \\<open>f ` insert x A = insert (f x) (f ` A)\\<close> by auto\n  moreover\n  have \\<open>f x \\<notin> f`A\\<close> apply (rule ccontr) using insert(2) mono apply auto by (metis insert.hyps(2) mono neq_iff)\n  ultimately\n  have \\<open>sorted_list_of_set (f ` insert x A) = insort (f x) (sorted_list_of_set (f`A))\\<close> using insert(1) sorted_list_of_set_insert by simp\n  also\n  have \\<open>\\<dots> = insort (f x) (map f (sorted_list_of_set A))\\<close> using insert.IH by auto\n  also have \\<open>\\<dots> = map f (insort x (sorted_list_of_set A))\\<close> using insort_map_mono[OF mono] by auto\n  finally  \n  show \\<open>map f (sorted_list_of_set (insert x A)) = sorted_list_of_set (f ` insert x A)\\<close> by simp\nqed\n\nlemma GreatestIB:\nfixes n :: \\<open>nat\\<close> and P\nassumes a:\\<open>\\<exists>k\\<le>n. P k\\<close>\nshows GreatestBI: \\<open>P (GREATEST k. k\\<le>n \\<and> P k)\\<close> and GreatestB: \\<open>(GREATEST k. k\\<le>n \\<and> P k) \\<le> n\\<close> \nproof -\n  show \\<open>P (GREATEST k. k\\<le>n \\<and> P k)\\<close> using GreatestI_ex_nat[OF assms] by auto  \n  show \\<open>(GREATEST k. k\\<le>n \\<and> P k) \\<le> n\\<close> using GreatestI_ex_nat[OF assms] by auto\nqed\n\nlemma GreatestB_le:\nfixes n :: \\<open>nat\\<close>\nassumes \\<open>x\\<le>n\\<close> and \\<open>P x\\<close>\nshows \\<open>x \\<le> (GREATEST k. k\\<le>n \\<and> P k)\\<close> \nproof -\n  have *: \\<open>\\<forall> y. y\\<le>n \\<and> P y \\<longrightarrow> y<Suc n\\<close> by auto\n  then show \\<open>x \\<le> (GREATEST k. k\\<le>n \\<and> P k)\\<close> using assms by (blast intro: Greatest_le_nat)\nqed\n\nlemma LeastBI_ex: assumes \\<open>\\<exists>k \\<le> n. P k\\<close> shows \\<open>P (LEAST k::'c::wellorder. P k)\\<close> and \\<open>(LEAST k. P k) \\<le> n\\<close> \nproof -\n  from assms obtain k where k: \"k \\<le> n\" \"P k\" by blast\n  thus \\<open>P (LEAST k. P k)\\<close> using LeastI[of \\<open>P\\<close> \\<open>k\\<close>] by simp\n  show \\<open>(LEAST k. P k) \\<le> n\\<close> using Least_le[of \\<open>P\\<close> \\<open>k\\<close>] k by auto\nqed\n\nlemma allB_atLeastLessThan_lower:  assumes \\<open>(i::nat) \\<le> j\\<close> \\<open>\\<forall> x\\<in>{i..<n}. P x\\<close> shows \\<open>\\<forall> x\\<in>{j..<n}. P x\\<close> proof \n  fix x assume \\<open>x\\<in>{j..<n}\\<close> hence \\<open>x\\<in>{i..<n}\\<close> using assms(1) by simp\n  thus \\<open>P x\\<close> using assms(2) by auto\nqed\n\n\nsubsection \\<open>Facts about Paths\\<close>\n\ncontext IFC\nbegin\n\nlemma path0: \\<open>path \\<sigma> 0 = entry\\<close> unfolding path_def by auto\n\nlemma path_in_nodes[intro]: \\<open>path \\<sigma> k \\<in> nodes\\<close> proof (induction \\<open>k\\<close>)\n  case (Suc k)\n  hence \\<open>\\<And> \\<sigma>'. (path \\<sigma> k, suc (path \\<sigma> k) \\<sigma>') \\<in> edges\\<close> by auto\n  hence \\<open>(path \\<sigma> k, path \\<sigma> (Suc k)) \\<in> edges\\<close> unfolding path_def \n    by (metis suc_def comp_apply funpow.simps(2) prod.collapse) \n  thus \\<open>?case\\<close> using edges_nodes by force\nqed (auto simp add: path_def)\n\nlemma path_is_path[simp]: \\<open>is_path (path \\<sigma>)\\<close> unfolding is_path_def path_def using step_suc_sem apply auto\nby (metis path_def suc_def edges_complete path_in_nodes prod.collapse)\n\nlemma term_path_stable: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> i = return\\<close> and le: \\<open>i \\<le> j\\<close> shows \\<open>\\<pi> j = return\\<close> \nusing le proof (induction \\<open>j\\<close>)\n  case (Suc j) \n  show \\<open>?case\\<close> proof cases\n    assume \\<open>i\\<le>j\\<close>\n    hence \\<open>\\<pi> j = return\\<close> using Suc by simp\n    hence \\<open>(return, \\<pi> (Suc j)) \\<in> edges\\<close> using assms(1) unfolding is_path_def by metis\n    thus \\<open>\\<pi> (Suc j) = return\\<close> using edges_return by auto\n  next\n    assume \\<open>\\<not> i \\<le> j\\<close>\n    hence \\<open>Suc j = i\\<close> using Suc by auto\n    thus \\<open>?thesis\\<close> using assms(2) by auto\n  qed\nnext\n  case 0 thus \\<open>?case\\<close> using assms by simp\nqed \n\nlemma path_path_shift: assumes \\<open>is_path \\<pi>\\<close> shows \\<open>is_path (\\<pi>\\<guillemotleft>m)\\<close> \nusing assms unfolding is_path_def by simp\n\nlemma path_cons: assumes \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi> m = \\<pi>' 0\\<close> shows \\<open>is_path (\\<pi> @\\<^bsup>m\\<^esup> \\<pi>')\\<close> \nunfolding is_path_def proof(rule,cases)\n  fix n assume \\<open>m < n\\<close> thus \\<open>((\\<pi> @\\<^bsup>m\\<^esup> \\<pi>') n, (\\<pi> @\\<^bsup>m\\<^esup>  \\<pi>') (Suc n)) \\<in> edges\\<close> \n    using assms(2) unfolding is_path_def path_append_def\n    by (auto,metis Suc_diff_Suc diff_Suc_Suc less_SucI) \nnext\n  fix n assume *: \\<open>\\<not> m < n\\<close>  thus \\<open>((\\<pi> @\\<^bsup>m\\<^esup>  \\<pi>') n, (\\<pi> @\\<^bsup>m\\<^esup>  \\<pi>') (Suc n)) \\<in> edges\\<close> proof cases\n    assume [simp]: \\<open>n = m\\<close>\n    thus \\<open>?thesis\\<close> using assms unfolding is_path_def path_append_def by force\n  next\n    assume \\<open>n \\<noteq> m\\<close>\n    hence \\<open>Suc n \\<le> m\\<close> \\<open>n\\<le> m\\<close> using * by auto\n    with assms(1) show \\<open>?thesis\\<close> unfolding is_path_def by auto\n  qed\nqed\n\nlemma is_path_loop: assumes \\<open>is_path \\<pi>\\<close> \\<open>0 < i\\<close> \\<open>\\<pi> i = \\<pi> 0\\<close> shows \\<open>is_path (\\<lambda> n. \\<pi> (n mod i))\\<close> unfolding is_path_def proof (rule,cases)\n  fix n\n  assume \\<open>0 < Suc n mod i\\<close>\n  hence \\<open>Suc n mod i = Suc (n mod i)\\<close> by (metis mod_Suc neq0_conv)\n  moreover \n  have \\<open>(\\<pi> (n mod i), \\<pi> (Suc (n mod i))) \\<in> edges\\<close> using assms(1) unfolding is_path_def by auto\n  ultimately\n  show \\<open>(\\<pi> (n mod i), \\<pi> (Suc n mod i)) \\<in> edges\\<close> by simp\n  next\n  fix n\n  assume \\<open>\\<not> 0 < Suc n mod i\\<close>\n  hence \\<open>Suc n mod i = 0\\<close> by auto\n  moreover \n  hence \\<open>n mod i = i - 1\\<close> using assms(2) by (metis Zero_neq_Suc diff_Suc_1 mod_Suc)\n  ultimately\n  show \\<open>(\\<pi>(n mod i), \\<pi> (Suc n mod i)) \\<in> edges\\<close> using assms(1) unfolding is_path_def by (metis assms(3) mod_Suc)\nqed\n\nlemma path_nodes: \\<open>is_path \\<pi> \\<Longrightarrow> \\<pi> k \\<in> nodes\\<close> unfolding is_path_def using edges_nodes by force \n\nlemma direct_path_return': assumes \\<open>is_path \\<pi> \\<close> \\<open>\\<pi> 0 = x\\<close> \\<open>x \\<noteq> return\\<close> \\<open>\\<pi> n = return\\<close>\nobtains \\<pi>' n' where \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi>' 0 = x\\<close> \\<open>\\<pi>' n' = return\\<close> \\<open>\\<forall> i> 0. \\<pi>' i \\<noteq> x\\<close>\nusing assms proof (induction \\<open>n\\<close> arbitrary: \\<open>\\<pi>\\<close>  rule: less_induct)\n  case (less n \\<pi>) \n  hence ih: \\<open>\\<And> n' \\<pi>'. n' < n \\<Longrightarrow> is_path \\<pi>' \\<Longrightarrow> \\<pi>' 0 = x \\<Longrightarrow> \\<pi>' n' = return \\<Longrightarrow> thesis\\<close> using assms by auto\n  show \\<open>thesis\\<close> proof cases\n    assume \\<open>\\<forall> i>0. \\<pi> i \\<noteq> x\\<close> thus \\<open>thesis\\<close> using less by auto\n  next\n    assume \\<open>\\<not> (\\<forall> i>0. \\<pi> i \\<noteq> x)\\<close>\n    then obtain i where \\<open>0<i\\<close> \\<open>\\<pi> i = x\\<close> by auto\n    hence \\<open>(\\<pi>\\<guillemotleft>i) 0 = x\\<close> by auto\n    moreover\n    have \\<open>i < n\\<close> using less(3,5,6) \\<open>\\<pi> i = x\\<close> by (metis linorder_neqE_nat term_path_stable less_imp_le)    \n    hence \\<open>(\\<pi>\\<guillemotleft>i) (n-i) = return\\<close> using less(6) by auto\n    moreover\n    have \\<open>is_path (\\<pi>\\<guillemotleft>i)\\<close> using less(3) by (metis path_path_shift)\n    moreover\n    have \\<open>n - i < n\\<close> using \\<open>0<i\\<close> \\<open>i < n\\<close> by auto    \n    ultimately show \\<open>thesis\\<close> using ih by auto\n  qed\nqed\n\nlemma direct_path_return: assumes  \\<open>x \\<in> nodes\\<close> \\<open>x \\<noteq> return\\<close>\nobtains \\<pi> n where \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> 0 = x\\<close> \\<open>\\<pi> n = return\\<close> \\<open>\\<forall> i> 0. \\<pi> i \\<noteq> x\\<close>\nusing direct_path_return'[of _ \\<open>x\\<close>] reaching_ret[OF assms(1)] assms(2) by blast\n\nlemma path_append_eq_up_to: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') =\\<^bsub>k\\<^esub> \\<pi>\\<close>  unfolding eq_up_to_def by auto\n\nlemma eq_up_to_le: assumes \\<open>k \\<le> n\\<close> \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>'\\<close> shows \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>'\\<close> using assms unfolding eq_up_to_def by auto \n\nlemma eq_up_to_refl: shows \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>\\<close> unfolding eq_up_to_def by auto \n\nlemma eq_up_to_sym: assumes \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>'\\<close> shows \\<open>\\<pi>' =\\<^bsub>k\\<^esub> \\<pi>\\<close> using assms unfolding eq_up_to_def by auto\n\nlemma eq_up_to_apply: assumes \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>'\\<close> \\<open>j \\<le> k\\<close> shows \\<open>\\<pi> j = \\<pi>' j\\<close> using assms unfolding eq_up_to_def by auto\n\nlemma path_swap_ret: assumes \\<open>is_path \\<pi>\\<close> obtains \\<pi>' n where \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>'\\<close> \\<open>\\<pi>' n = return\\<close>\nproof -\n  have nd: \\<open>\\<pi> k \\<in> nodes\\<close> using assms path_nodes by simp\n  obtain \\<pi>' n where *: \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi>' 0 = \\<pi> k\\<close> \\<open>\\<pi>' n = return\\<close> using reaching_ret[OF nd] by blast\n  have \\<open>\\<pi> =\\<^bsub>k\\<^esub> (\\<pi>@\\<^bsup>k\\<^esup> \\<pi>')\\<close> by (metis eq_up_to_sym path_append_eq_up_to)\n  moreover\n  have \\<open>is_path (\\<pi>@\\<^bsup>k\\<^esup> \\<pi>')\\<close> using assms * path_cons by metis\n  moreover\n  have \\<open>(\\<pi>@\\<^bsup>k\\<^esup> \\<pi>') (k + n) = return\\<close> using * by auto\n  ultimately\n  show \\<open>thesis\\<close> using that by blast\nqed\n\nlemma path_suc: \\<open>path \\<sigma> (Suc k) = fst (step (path \\<sigma> k, \\<sigma>\\<^bsup>k\\<^esup>))\\<close> by (induction \\<open>k\\<close>, auto simp: path_def kth_state_def)\n\nlemma kth_state_suc: \\<open>\\<sigma>\\<^bsup>Suc k\\<^esup>  = snd (step (path \\<sigma> k, \\<sigma>\\<^bsup>k\\<^esup>))\\<close> by (induction \\<open>k\\<close>, auto simp: path_def kth_state_def)\n\n\nsubsection \\<open>Facts about Post Dominators\\<close>\n\nlemma pd_trans: assumes 1: \\<open>y pd\\<rightarrow> x\\<close> and 2: \\<open>z pd\\<rightarrow>y\\<close> shows \\<open>z pd\\<rightarrow>x\\<close> \nproof -\n  {\n    fix \\<pi> n\n    assume 3[simp]: \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> 0 = x\\<close> \\<open>\\<pi> n = return\\<close>\n    then obtain k where \\<open>\\<pi> k = y\\<close> and 7: \\<open>k \\<le> n\\<close> using 1 unfolding is_pd_def by blast\n    then have \\<open>(\\<pi>\\<guillemotleft>k) 0 = y\\<close> and \\<open>(\\<pi>\\<guillemotleft>k) (n-k) = return\\<close> by auto\n    moreover have \\<open>is_path (\\<pi>\\<guillemotleft>k)\\<close> by(metis 3(1) path_path_shift)\n    ultimately obtain k' where 8: \\<open>(\\<pi>\\<guillemotleft>k) k' = z\\<close> and \\<open>k' \\<le> n-k\\<close> using 2 unfolding is_pd_def by blast\n    hence \\<open>k+k'\\<le>n\\<close> and \\<open>\\<pi> (k+ k') = z\\<close> using 7 by auto\n    hence \\<open>\\<exists>k\\<le>n. \\<pi> k = z\\<close> using path_nodes by auto    \n  }\n  thus \\<open>?thesis\\<close> using 1 unfolding is_pd_def by blast\nqed\n\nlemma pd_path: assumes \\<open>y pd\\<rightarrow> x\\<close>\nobtains \\<pi> n k where \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> 0 = x\\<close> and \\<open>\\<pi> n = return\\<close> and \\<open>\\<pi> k = y\\<close> and \\<open>k \\<le> n\\<close>   \nusing assms unfolding is_pd_def using reaching_ret[of \\<open>x\\<close>] by blast\n\nlemma pd_antisym: assumes xpdy: \\<open>x pd\\<rightarrow> y\\<close> and ypdx: \\<open>y pd\\<rightarrow> x\\<close> shows \\<open>x = y\\<close>\nproof -\n  obtain \\<pi> n where path: \\<open>is_path \\<pi>\\<close> and \\<pi>0: \\<open>\\<pi> 0 = x\\<close> and \\<pi>n: \\<open>\\<pi> n = return\\<close> using pd_path[OF ypdx] by metis\n  hence kex: \\<open>\\<exists>k\\<le>n. \\<pi> k = y\\<close> using ypdx unfolding is_pd_def by auto\n  obtain k where k: \\<open>k = (GREATEST k. k\\<le>n \\<and> \\<pi> k = y)\\<close> by simp\n  have \\<pi>k: \\<open>\\<pi> k = y\\<close> and kn: \\<open>k \\<le> n\\<close> using k kex by (auto intro: GreatestIB)\n  \n  have kpath: \\<open>is_path (\\<pi>\\<guillemotleft>k)\\<close> by (metis path_path_shift path)\n  moreover have k0: \\<open>(\\<pi>\\<guillemotleft>k) 0 = y\\<close> using \\<pi>k by simp\n  moreover have kreturn: \\<open>(\\<pi>\\<guillemotleft>k) (n-k) = return\\<close> using kn \\<pi>n by simp\n  ultimately have ky': \\<open>\\<exists>k'\\<le>(n-k).(\\<pi>\\<guillemotleft>k) k' = x\\<close> using xpdy unfolding is_pd_def by simp      \n\n  obtain k' where k': \\<open>k' = (GREATEST k'. k'\\<le>(n-k) \\<and> (\\<pi>\\<guillemotleft>k) k' = x)\\<close> by simp\n\n  with ky' have \\<pi>k': \\<open>(\\<pi>\\<guillemotleft>k) k' = x\\<close> and kn': \\<open>k' \\<le> (n-k)\\<close>  by (auto intro: GreatestIB)\n  have k'path: \\<open>is_path (\\<pi>\\<guillemotleft>k\\<guillemotleft>k')\\<close> using kpath by(metis path_path_shift)\n  moreover have k'0: \\<open>(\\<pi>\\<guillemotleft>k\\<guillemotleft>k') 0 = x\\<close> using \\<pi>k' by simp\n  moreover have k'return: \\<open>(\\<pi>\\<guillemotleft>k\\<guillemotleft>k') (n-k-k') = return\\<close> using kn' kreturn by (metis path_shift_def le_add_diff_inverse)\n  ultimately have ky'': \\<open>\\<exists>k''\\<le>(n-k-k').(\\<pi>\\<guillemotleft>k\\<guillemotleft>k') k'' = y\\<close> using ypdx unfolding is_pd_def by blast\n\n  obtain k'' where k'': \\<open>k''= (GREATEST k''. k''\\<le>(n-k-k') \\<and> (\\<pi>\\<guillemotleft>k\\<guillemotleft>k') k'' = y)\\<close> by simp\n  with ky'' have \\<pi>k'': \\<open>(\\<pi>\\<guillemotleft>k\\<guillemotleft>k') k'' = y\\<close> and kn'': \\<open>k'' \\<le> (n-k-k')\\<close>  by (auto intro: GreatestIB)\n\n  from this(1) have  \\<open>\\<pi> (k + k' + k'') = y\\<close> by (metis path_shift_def add.commute add.left_commute)\n  moreover\n  have \\<open>k + k' +k'' \\<le> n\\<close> using kn'' kn' kn by simp\n  ultimately have \\<open>k + k' + k''\\<le> k\\<close> using k by(auto simp: GreatestB_le)\n  hence \\<open>k' = 0\\<close> by simp\n  with k0 \\<pi>k' show \\<open>x = y\\<close> by simp\nqed\n\nlemma pd_refl[simp]: \\<open>x \\<in> nodes \\<Longrightarrow> x pd\\<rightarrow> x\\<close> unfolding is_pd_def by blast\n\nlemma pdt_trans_in_pdt: \\<open>(x,y) \\<in> pdt\\<^sup>+ \\<Longrightarrow> (x,y) \\<in> pdt\\<close> \nproof (induction rule: trancl_induct)\n  case base thus \\<open>?case\\<close> by simp\nnext\n  case (step y z) show \\<open>?case\\<close> unfolding pdt_def proof (simp)\n    have *: \\<open>y pd\\<rightarrow> x\\<close> \\<open>z pd\\<rightarrow> y\\<close> using step unfolding pdt_def by auto\n    hence [simp]: \\<open>z pd\\<rightarrow> x\\<close> using pd_trans[where x=\\<open>x\\<close> and y=\\<open>y\\<close> and z=\\<open>z\\<close>] by simp\n    have \\<open>x\\<noteq>z\\<close> proof \n      assume \\<open>x = z\\<close>\n      hence \\<open>z pd\\<rightarrow> y\\<close> \\<open>y pd\\<rightarrow> z\\<close> using * by auto\n      hence \\<open>z = y\\<close> using pd_antisym by auto\n      thus \\<open>False\\<close> using step(2) unfolding pdt_def by simp\n    qed\n    thus \\<open>x \\<noteq> z \\<and> z pd\\<rightarrow> x\\<close> by auto\n  qed\nqed\n\nlemma pdt_trancl_pdt: \\<open>pdt\\<^sup>+ = pdt\\<close> using pdt_trans_in_pdt by fast\n\nlemma trans_pdt: \\<open>trans pdt\\<close> by (metis pdt_trancl_pdt trans_trancl)\n\ndefinition [simp]: \\<open>pdt_inv = pdt\\<inverse>\\<close>\n\nlemma wf_pdt_inv: \\<open>wf (pdt_inv)\\<close> proof (rule ccontr)\n  assume \\<open>\\<not> wf (pdt_inv)\\<close>\n  then obtain f where  \\<open>\\<forall>i. (f (Suc i), f i) \\<in> pdt\\<inverse>\\<close> using wf_iff_no_infinite_down_chain by force\n  hence *: \\<open>\\<forall> i. (f i, f (Suc i)) \\<in> pdt\\<close> by simp\n  have **:\\<open>\\<forall> i. \\<forall> j>i. (f i, f j) \\<in> pdt\\<close> proof(rule,rule,rule)\n    fix i j assume  \\<open>i < (j::nat)\\<close> thus \\<open>(f i, f j) \\<in> pdt\\<close> proof (induction \\<open>j\\<close> rule: less_induct)\n      case (less k)\n      show \\<open>?case\\<close> proof (cases \\<open>Suc i < k\\<close>)\n        case True\n        hence k:\\<open>k-1 < k\\<close> \\<open>i < k-1\\<close> and sk: \\<open>Suc (k-1) = k\\<close> by auto\n        show \\<open>?thesis\\<close> using less(1)[OF k] *[rule_format,of \\<open>k-1\\<close>,unfolded sk] trans_pdt[unfolded trans_def] by blast\n      next\n        case False\n        hence \\<open>Suc i = k\\<close> using less(2) by auto\n        then show \\<open>?thesis\\<close> using * by auto\n      qed\n    qed\n  qed\n  hence ***:\\<open>\\<forall> i. \\<forall> j > i. f j pd\\<rightarrow> f i\\<close> \\<open>\\<forall> i. \\<forall> j > i. f i \\<noteq>  f j\\<close> unfolding pdt_def by auto\n  hence ****:\\<open>\\<forall> i>0. f i pd\\<rightarrow> f 0\\<close> by simp\n  hence \\<open>f 0 \\<in> nodes\\<close>  using * is_pd_def by fastforce\n  then obtain \\<pi> n where \\<pi>:\\<open>is_path \\<pi>\\<close> \\<open>\\<pi> 0 = f 0\\<close> \\<open>\\<pi> n = return\\<close> using reaching_ret by blast  \n  hence \\<open>\\<forall> i>0. \\<exists> k\\<le>n. \\<pi> k = f i\\<close> using ***(1) \\<open>f 0 \\<in> nodes\\<close> unfolding is_pd_def by blast\n  hence \\<pi>f:\\<open>\\<forall> i. \\<exists> k\\<le>n. \\<pi> k = f i\\<close> using \\<pi>(2) by (metis le0 not_gr_zero)\n  have \\<open>range f \\<subseteq> \\<pi> ` {..n}\\<close> proof(rule subsetI)\n    fix x assume \\<open>x \\<in> range f\\<close>\n    then obtain i where \\<open>x = f i\\<close> by auto\n    then obtain k where \\<open>x = \\<pi> k\\<close> \\<open>k \\<le> n\\<close> using \\<pi>f by metis\n    thus \\<open>x \\<in> \\<pi> ` {..n}\\<close> by simp\n  qed\n  hence f:\\<open>finite (range f)\\<close> using finite_surj by auto\n  hence fi:\\<open>\\<exists> i. infinite {j. f j = f i}\\<close>  using pigeonhole_infinite[OF _ f] by auto\n  obtain i where \\<open>infinite {j. f j = f i}\\<close> using fi ..    \n  thus \\<open>False\\<close> \n    by (metis (mono_tags, lifting) \"***\"(2) bounded_nat_set_is_finite gt_ex mem_Collect_eq nat_neq_iff)\nqed\n\nlemma return_pd: assumes \\<open>x \\<in> nodes\\<close> shows \\<open>return pd\\<rightarrow> x\\<close> unfolding is_pd_def using assms by blast\n\nlemma pd_total: assumes xz: \\<open>x pd\\<rightarrow> z\\<close> and yz: \\<open>y pd\\<rightarrow> z\\<close> shows \\<open>x pd\\<rightarrow> y \\<or> y pd\\<rightarrow>x\\<close> \nproof -\n  obtain \\<pi> n where path: \\<open>is_path \\<pi>\\<close> and \\<pi>0: \\<open>\\<pi> 0 = z\\<close> and \\<pi>n: \\<open>\\<pi> n = return\\<close> using xz reaching_ret unfolding is_pd_def by force\n  have *: \\<open>\\<exists> k\\<le>n. (\\<pi> k = x \\<or> \\<pi> k = y)\\<close> (is \\<open>\\<exists> k\\<le>n. ?P k\\<close>) using path \\<pi>0 \\<pi>n xz yz unfolding is_pd_def by auto\n  obtain k where k: \\<open>k = (LEAST k. \\<pi> k = x \\<or> \\<pi> k = y)\\<close> by simp\n  hence kn: \\<open>k\\<le>n\\<close> and \\<pi>k: \\<open>\\<pi> k = x \\<or> \\<pi> k = y\\<close> using LeastBI_ex[OF *] by auto \n  note k_le = Least_le[where P = \\<open>?P\\<close>] \n  show \\<open>?thesis\\<close> proof (cases)\n    assume kx: \\<open>\\<pi> k = x\\<close>\n    have k_min: \\<open>\\<And> k'. \\<pi> k' = y \\<Longrightarrow> k \\<le> k'\\<close> using k_le unfolding k by auto\n    {\n      fix \\<pi>' \n      and n' :: \\<open>nat\\<close>\n      assume path': \\<open>is_path \\<pi>'\\<close> and \\<pi>'0: \\<open>\\<pi>' 0 = x\\<close> and \\<pi>'n': \\<open>\\<pi>' n' = return\\<close>\n      have path'': \\<open>is_path (\\<pi> @\\<^bsup>k\\<^esup> \\<pi>')\\<close> using path_cons[OF path path'] kx \\<pi>'0 by auto\n      have \\<pi>''0: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') 0 = z\\<close> using \\<pi>0 by simp\n      have \\<pi>''n: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') (k+n') = return\\<close> using \\<pi>'n' kx \\<pi>'0 by auto\n      obtain k' where k': \\<open>k' \\<le> k + n'\\<close> \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') k' = y\\<close> using yz path'' \\<pi>''0 \\<pi>''n unfolding is_pd_def by blast\n      have **: \\<open>k \\<le> k'\\<close> proof (rule ccontr)\n        assume \\<open>\\<not> k \\<le> k'\\<close>\n        hence \\<open>k' < k\\<close> by simp\n        moreover \n        hence \\<open>\\<pi> k' = y\\<close> using k' by auto\n        ultimately\n        show \\<open>False\\<close> using k_min by force\n     qed\n     hence \\<open>\\<pi>' (k' - k) = y\\<close> using k' \\<pi>'0 kx  by auto\n     moreover\n     have \\<open>(k' - k) \\<le> n'\\<close> using k' by auto\n     ultimately \n     have \\<open>\\<exists> k\\<le> n'. \\<pi>' k = y\\<close> by auto\n   }\n   hence \\<open>y pd\\<rightarrow> x\\<close> using kx path_nodes path unfolding is_pd_def by auto\n   thus \\<open>?thesis\\<close> ..\n next \\<comment> \\<open>This is analogous argument\\<close>\n   assume kx: \\<open>\\<pi> k \\<noteq> x\\<close>\n   hence ky: \\<open>\\<pi> k = y\\<close> using \\<pi>k by auto\n   have k_min: \\<open>\\<And> k'. \\<pi> k' = x \\<Longrightarrow> k \\<le> k'\\<close> using k_le unfolding k by auto\n    {\n      fix \\<pi>' \n      and n' :: \\<open>nat\\<close>\n      assume path': \\<open>is_path \\<pi>'\\<close> and \\<pi>'0: \\<open>\\<pi>' 0 = y\\<close> and \\<pi>'n': \\<open>\\<pi>' n' = return\\<close>\n      have path'': \\<open>is_path (\\<pi> @\\<^bsup>k\\<^esup> \\<pi>')\\<close> using path_cons[OF path path'] ky \\<pi>'0 by auto\n      have \\<pi>''0: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') 0 = z\\<close> using \\<pi>0 by simp\n      have \\<pi>''n: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') (k+n') = return\\<close> using \\<pi>'n' ky \\<pi>'0 by auto\n      obtain k' where k': \\<open>k' \\<le> k + n'\\<close> \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>') k' = x\\<close> using xz path'' \\<pi>''0 \\<pi>''n unfolding is_pd_def by blast\n      have **: \\<open>k \\<le> k'\\<close> proof (rule ccontr)\n        assume \\<open>\\<not> k \\<le> k'\\<close>\n        hence \\<open>k' < k\\<close> by simp\n        moreover \n        hence \\<open>\\<pi> k' = x\\<close> using k' by auto\n        ultimately\n        show \\<open>False\\<close> using k_min by force\n     qed\n     hence \\<open>\\<pi>' (k' - k) = x\\<close> using k' \\<pi>'0 ky  by auto\n     moreover\n     have \\<open>(k' - k) \\<le> n'\\<close> using k' by auto\n     ultimately \n     have \\<open>\\<exists> k\\<le> n'. \\<pi>' k = x\\<close> by auto\n   }\n   hence \\<open>x pd\\<rightarrow> y\\<close> using ky path_nodes path unfolding is_pd_def by auto\n   thus \\<open>?thesis\\<close> ..\n  qed\nqed    \n\nlemma pds_finite: \\<open>finite {y . (x,y) \\<in> pdt}\\<close> proof cases \n  assume \\<open>x \\<in> nodes\\<close>\n  then obtain \\<pi> n where \\<pi>:\\<open>is_path \\<pi>\\<close> \\<open>\\<pi> 0 = x\\<close> \\<open>\\<pi> n = return\\<close> using reaching_ret by blast\n  have *: \\<open>\\<forall> y \\<in> {y. (x,y)\\<in> pdt}. y pd\\<rightarrow> x\\<close> using pdt_def by auto\n  have \\<open>\\<forall> y \\<in> {y. (x,y)\\<in> pdt}. \\<exists> k \\<le> n. \\<pi> k = y\\<close>  using * \\<pi> is_pd_def by blast\n  hence \\<open>{y. (x,y)\\<in> pdt} \\<subseteq> \\<pi> ` {..n}\\<close>  by auto\n  then show \\<open>?thesis\\<close> using finite_surj by blast\nnext\n  assume \\<open>\\<not> x\\<in> nodes\\<close>\n  hence \\<open>{y. (x,y)\\<in>pdt} = {}\\<close> unfolding pdt_def is_pd_def using path_nodes reaching_ret by fastforce\n  then show \\<open>?thesis\\<close> by simp\nqed\n\nlemma ipd_exists: assumes node: \\<open>x \\<in> nodes\\<close> and not_ret: \\<open>x\\<noteq>return\\<close> shows \\<open>\\<exists>y. y ipd\\<rightarrow> x\\<close> \nproof -\n  let \\<open>?Q\\<close> = \\<open>{y. x\\<noteq>y \\<and> y pd\\<rightarrow> x}\\<close>\n  have *: \\<open>return \\<in> ?Q\\<close> using assms return_pd by simp    \n  hence **: \\<open>\\<exists> x. x\\<in> ?Q\\<close> by auto\n  have fin: \\<open>finite ?Q\\<close> using pds_finite unfolding pdt_def by auto\n  have tot: \\<open>\\<forall> y z. y\\<in>?Q \\<and> z \\<in> ?Q \\<longrightarrow> z pd\\<rightarrow> y \\<or> y pd\\<rightarrow> z\\<close> using pd_total by auto\n  obtain y where ymax: \\<open>y\\<in> ?Q\\<close> \\<open>\\<forall> z\\<in>?Q. z = y \\<or> z pd\\<rightarrow> y\\<close> using fin ** tot proof (induct)\n    case empty\n    then show \\<open>?case\\<close> by auto\n  next\n    case (insert x F) show \\<open>thesis\\<close> proof (cases \\<open>F = {}\\<close>)\n      assume \\<open>F = {}\\<close>\n      thus \\<open>thesis\\<close> using insert(4)[of \\<open>x\\<close>] by auto\n    next  \n      assume \\<open>F \\<noteq> {}\\<close>\n      hence \\<open>\\<exists> x. x\\<in> F\\<close> by auto\n      have \\<open>\\<And>y. y \\<in> F \\<Longrightarrow> \\<forall>z\\<in>F. z = y \\<or> z pd\\<rightarrow> y \\<Longrightarrow> thesis\\<close> proof -\n        fix y assume a: \\<open>y \\<in> F\\<close> \\<open>\\<forall>z\\<in>F. z = y \\<or> z pd\\<rightarrow> y\\<close>\n        have \\<open>x \\<noteq> y\\<close> using insert a by auto\n        have \\<open>x pd\\<rightarrow> y \\<or> y pd\\<rightarrow> x\\<close> using insert(6) a(1) by auto\n        thus \\<open>thesis\\<close> proof \n          assume \\<open>x pd\\<rightarrow> y\\<close>\n          hence \\<open>\\<forall>z\\<in>insert x F. z = y \\<or> z pd\\<rightarrow> y\\<close> using a(2) by blast\n          thus \\<open>thesis\\<close> using a(1) insert(4) by blast\n        next\n          assume \\<open>y pd\\<rightarrow> x\\<close>\n          have \\<open>\\<forall>z\\<in>insert x F. z = x \\<or> z pd\\<rightarrow> x\\<close> proof\n            fix z assume \\<open>z\\<in> insert x F\\<close> thus \\<open>z = x \\<or> z pd\\<rightarrow> x\\<close> proof(rule,simp)\n              assume \\<open>z\\<in>F\\<close>\n              hence \\<open>z = y \\<or> z pd\\<rightarrow> y\\<close> using a(2) by auto\n              thus \\<open>z = x \\<or> z pd\\<rightarrow> x\\<close> proof(rule,simp add: \\<open>y pd\\<rightarrow> x\\<close>)\n                assume \\<open>z pd\\<rightarrow> y\\<close>\n                show \\<open>z = x \\<or> z pd\\<rightarrow> x\\<close> using \\<open>y pd\\<rightarrow> x\\<close> \\<open>z pd\\<rightarrow> y\\<close> pd_trans by blast\n              qed \n            qed\n          qed \n          then show \\<open>thesis\\<close> using insert by blast\n        qed\n      qed\n      then show \\<open>thesis\\<close> using insert by blast\n    qed\n  qed    \n  hence ***: \\<open>y pd\\<rightarrow> x\\<close> \\<open>x\\<noteq>y\\<close> by auto\n  have \\<open>\\<forall> z. z \\<noteq> x \\<and> z pd\\<rightarrow> x \\<longrightarrow> z pd\\<rightarrow> y\\<close> proof (rule,rule)\n    fix z \n    assume a: \\<open> z \\<noteq> x \\<and> z pd\\<rightarrow> x\\<close>\n    hence b: \\<open>z \\<in> ?Q\\<close> by auto\n    have \\<open>y pd\\<rightarrow> z \\<or> z pd\\<rightarrow> y\\<close> using pd_total ***(1) a by auto\n    thus \\<open>z pd\\<rightarrow> y\\<close> proof\n      assume c: \\<open>y pd\\<rightarrow> z\\<close>\n      hence \\<open>y = z\\<close> using b ymax pdt_def pd_antisym by auto\n      thus \\<open>z pd\\<rightarrow> y\\<close> using c by simp\n    qed simp\n  qed\n  with *** have  \\<open>y ipd\\<rightarrow> x\\<close> unfolding is_ipd_def by simp\n  thus \\<open>?thesis\\<close> by blast\nqed\n\nlemma ipd_unique: assumes yipd: \\<open>y ipd\\<rightarrow> x\\<close> and y'ipd: \\<open>y' ipd\\<rightarrow> x\\<close> shows \\<open>y = y'\\<close> \nproof -  \n  have 1: \\<open>y pd\\<rightarrow> y'\\<close> and  2: \\<open>y' pd\\<rightarrow> y\\<close> using yipd y'ipd unfolding is_ipd_def by auto\n  show \\<open>?thesis\\<close> using pd_antisym[OF 1 2] .\nqed\n\nlemma ipd_is_ipd: assumes \\<open>x \\<in> nodes\\<close> and \\<open>x\\<noteq>return\\<close> shows \\<open>ipd x ipd\\<rightarrow> x\\<close> proof -\n  from assms obtain y where \\<open>y ipd\\<rightarrow> x\\<close> using ipd_exists by auto\n  moreover\n  hence \\<open>\\<And> z. z ipd\\<rightarrow>x \\<Longrightarrow> z = y\\<close> using ipd_unique by simp\n  ultimately show \\<open>?thesis\\<close> unfolding ipd_def by (auto intro: theI2)\nqed\n\nlemma is_ipd_in_pdt: \\<open>y ipd\\<rightarrow> x \\<Longrightarrow> (x,y) \\<in> pdt\\<close> unfolding is_ipd_def pdt_def by auto\n\nlemma ipd_in_pdt: \\<open>x \\<in> nodes \\<Longrightarrow> x\\<noteq>return \\<Longrightarrow> (x,ipd x) \\<in> pdt\\<close> by (metis ipd_is_ipd is_ipd_in_pdt)\n\nlemma no_pd_path: assumes \\<open>x \\<in> nodes\\<close> and \\<open>\\<not> y pd\\<rightarrow> x\\<close>\nobtains \\<pi> n where \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> 0 = x\\<close> and \\<open>\\<pi> n = return\\<close> and \\<open>\\<forall> k \\<le> n. \\<pi> k \\<noteq> y\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> thesis\\<close>\n  hence \\<open>\\<forall> \\<pi> n.  is_path \\<pi> \\<and> \\<pi> 0 = x \\<and> \\<pi> n = return \\<longrightarrow> (\\<exists> k\\<le>n . \\<pi> k = y)\\<close> using that by force\n  thus \\<open>False\\<close> using assms unfolding is_pd_def by auto\nqed\n\nlemma pd_pd_ipd: assumes \\<open>x \\<in> nodes\\<close> \\<open>x\\<noteq>return\\<close> \\<open>y\\<noteq>x\\<close> \\<open>y pd\\<rightarrow> x\\<close> shows \\<open>y pd\\<rightarrow> ipd x\\<close> \nproof -\n  have \\<open>ipd x pd\\<rightarrow> x\\<close> by (metis assms(1,2) ipd_is_ipd is_ipd_def)\n  hence \\<open>y pd\\<rightarrow> ipd x \\<or> ipd x pd\\<rightarrow> y\\<close> by (metis assms(4) pd_total)\n  thus \\<open>?thesis\\<close> proof\n    have 1: \\<open>ipd x ipd\\<rightarrow> x\\<close> by (metis assms(1,2) ipd_is_ipd)\n    moreover\n    assume \\<open>ipd x pd\\<rightarrow> y\\<close>\n    ultimately\n    show \\<open>y pd\\<rightarrow> ipd x\\<close> unfolding is_ipd_def using assms(3,4) by auto\n  qed auto\nqed\n\nlemma pd_nodes: assumes \\<open>y pd\\<rightarrow> x\\<close> shows pd_node1: \\<open>y \\<in> nodes\\<close> and pd_node2: \\<open>x \\<in> nodes\\<close>\nproof -\n  obtain \\<pi> k where \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> k = y\\<close> using assms unfolding is_pd_def using reaching_ret by force\n  thus \\<open>y \\<in> nodes\\<close> using path_nodes by auto\n  show \\<open>x \\<in> nodes\\<close> using assms unfolding is_pd_def by simp\nqed\n\nlemma pd_ret_is_ret: \\<open>x pd\\<rightarrow> return \\<Longrightarrow> x = return\\<close> by (metis pd_antisym pd_node1 return_pd)\n\nlemma ret_path_none_pd: assumes \\<open>x \\<in> nodes\\<close> \\<open>x\\<noteq>return\\<close> \nobtains \\<pi> n where \\<open>is_path \\<pi>\\<close>  \\<open>\\<pi> 0 = x\\<close> \\<open>\\<pi> n = return\\<close>  \\<open>\\<forall> i>0. \\<not> x pd\\<rightarrow> \\<pi> i\\<close>\nproof(rule ccontr)\n  assume \\<open>\\<not>thesis\\<close>\n  hence *: \\<open>\\<And> \\<pi> n. \\<lbrakk>is_path \\<pi>; \\<pi> 0 = x; \\<pi> n = return\\<rbrakk> \\<Longrightarrow> \\<exists>i>0. x pd\\<rightarrow> \\<pi> i\\<close> using that by blast\n  obtain \\<pi> n where **: \\<open>is_path \\<pi>\\<close>  \\<open>\\<pi> 0 = x\\<close> \\<open>\\<pi> n = return\\<close> \\<open>\\<forall> i>0. \\<pi> i \\<noteq> x\\<close> using direct_path_return[OF assms] by metis\n  then obtain i where ***: \\<open>i>0\\<close> \\<open>x pd\\<rightarrow> \\<pi> i\\<close> using * by blast\n  hence \\<open>\\<pi> i \\<noteq> return\\<close> using pd_ret_is_ret assms(2) by auto\n  hence \\<open>i < n\\<close> using assms(2) term_path_stable ** by (metis linorder_neqE_nat less_imp_le)\n  hence \\<open>(\\<pi>\\<guillemotleft>i)(n-i) = return\\<close> using **(3) by auto\n  moreover\n  have \\<open>(\\<pi>\\<guillemotleft>i) (0) = \\<pi> i\\<close> by simp\n  moreover \n  have \\<open>is_path (\\<pi>\\<guillemotleft>i)\\<close> using **(1) path_path_shift by metis\n  ultimately\n  obtain k where \\<open>(\\<pi>\\<guillemotleft>i) k = x\\<close> using ***(2) unfolding is_pd_def by metis\n  hence \\<open>\\<pi> (i + k) = x\\<close> by auto\n  thus \\<open>False\\<close> using **(4) \\<open>i>0\\<close> by auto\nqed\n\nlemma path_pd_ipd0': assumes \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> n \\<noteq> return\\<close> \\<open>\\<pi> n \\<noteq> \\<pi> 0\\<close> and \\<open>\\<pi> n pd\\<rightarrow> \\<pi> 0\\<close> \nobtains k where \\<open>k \\<le> n\\<close> and \\<open>\\<pi> k = ipd(\\<pi> 0)\\<close> \nproof(rule ccontr)  \n  have *: \\<open>\\<pi> n pd\\<rightarrow> ipd (\\<pi> 0)\\<close> by (metis is_pd_def assms(3,4) pd_pd_ipd pd_ret_is_ret)  \n  obtain \\<pi>' n' where **: \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi>' 0 = \\<pi> n\\<close> \\<open>\\<pi>' n' = return\\<close> \\<open>\\<forall> i>0. \\<not> \\<pi> n pd\\<rightarrow> \\<pi>' i\\<close>  by (metis assms(2) assms(4) pd_node1 ret_path_none_pd)\n  hence \\<open>\\<forall> i>0. \\<pi>' i \\<noteq> ipd (\\<pi> 0)\\<close> using * by metis\n  moreover\n  assume \\<open>\\<not> thesis\\<close>\n  hence \\<open>\\<forall> k\\<le>n. \\<pi> k \\<noteq> ipd (\\<pi> 0)\\<close> using that by blast\n  ultimately\n  have \\<open>\\<forall> i. (\\<pi>@\\<^bsup>n\\<^esup>  \\<pi>') i \\<noteq> ipd (\\<pi> 0)\\<close> by (metis diff_is_0_eq neq0_conv path_append_def)\n  moreover\n  have \\<open>(\\<pi>@\\<^bsup>n\\<^esup>  \\<pi>') (n + n') = return\\<close> \n    by (metis \\<open>\\<pi>' 0 = \\<pi> n\\<close> \\<open>\\<pi>' n' = return\\<close> add_diff_cancel_left' assms(2) diff_is_0_eq path_append_def)\n  moreover\n  have \\<open>(\\<pi>@\\<^bsup>n\\<^esup>  \\<pi>') 0 = \\<pi> 0\\<close> by (metis le0 path_append_def)\n  moreover\n  have \\<open>is_path (\\<pi>@\\<^bsup>n\\<^esup>  \\<pi>')\\<close> by (metis \\<open>\\<pi>' 0 = \\<pi> n\\<close> \\<open>is_path \\<pi>'\\<close> assms(1) path_cons)\n  moreover  \n  have \\<open>ipd (\\<pi> 0) pd\\<rightarrow> \\<pi> 0\\<close> by (metis **(2,3,4) assms(2) assms(4) ipd_is_ipd is_ipd_def neq0_conv pd_node2)\n  moreover\n  have \\<open>\\<pi> 0 \\<in> nodes\\<close> by (metis assms(1) path_nodes)\n  ultimately\n  show \\<open>False\\<close> unfolding is_pd_def by blast\nqed\n\nlemma path_pd_ipd0: assumes \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> 0 \\<noteq> return\\<close> \\<open>\\<pi> n \\<noteq> \\<pi> 0\\<close> and \\<open>\\<pi> n pd\\<rightarrow> \\<pi> 0\\<close> \nobtains k where \\<open>k \\<le> n\\<close> and \\<open>\\<pi> k = ipd(\\<pi> 0)\\<close> \nproof cases \n  assume *: \\<open>\\<pi> n = return\\<close>\n  have \\<open>ipd (\\<pi> 0) pd\\<rightarrow> (\\<pi> 0)\\<close> by (metis is_ipd_def is_pd_def assms(2,4) ipd_is_ipd)\n  with assms(1,2,3) * show \\<open>thesis\\<close> unfolding is_pd_def by (metis that)\nnext\n  assume \\<open>\\<pi> n \\<noteq> return\\<close> \n  from path_pd_ipd0' [OF assms(1) this assms(3,4)] that show \\<open>thesis\\<close> by auto\nqed\n\nlemma path_pd_ipd: assumes \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> k \\<noteq> return\\<close> \\<open>\\<pi> n \\<noteq> \\<pi> k\\<close> and \\<open>\\<pi> n pd\\<rightarrow> \\<pi> k\\<close> and kn: \\<open>k < n\\<close> \nobtains l where \\<open>k < l\\<close> and \\<open>l \\<le> n\\<close> and \\<open>\\<pi> l = ipd(\\<pi> k)\\<close> \nproof -\n  have \\<open>is_path (\\<pi> \\<guillemotleft> k)\\<close> \\<open>(\\<pi> \\<guillemotleft> k) 0 \\<noteq> return\\<close> \\<open>(\\<pi> \\<guillemotleft> k) (n - k) \\<noteq> (\\<pi> \\<guillemotleft> k) 0\\<close> \\<open>(\\<pi> \\<guillemotleft> k) (n - k) pd\\<rightarrow> (\\<pi> \\<guillemotleft> k) 0\\<close> \n  using assms path_path_shift by auto \n  with path_pd_ipd0[of \\<open>\\<pi>\\<guillemotleft>k\\<close> \\<open>n-k\\<close>]\n  obtain ka where \\<open>ka \\<le> n - k\\<close> \\<open>(\\<pi> \\<guillemotleft> k) ka = ipd ((\\<pi> \\<guillemotleft> k) 0)\\<close> .\n  hence \\<open>k + ka \\<le> n\\<close> \\<open>\\<pi> (k + ka) = ipd (\\<pi> k)\\<close> using kn by auto\n  moreover \n  hence \\<open>\\<pi> (k + ka) ipd\\<rightarrow> \\<pi> k\\<close> by (metis assms(1) assms(2) ipd_is_ipd path_nodes)\n  hence \\<open>k < k + ka\\<close> unfolding is_ipd_def by (metis nat_neq_iff not_add_less1)\n  ultimately\n  show \\<open>thesis\\<close> using that[of \\<open>k+ka\\<close>] by auto\nqed\n\nlemma path_ret_ipd: assumes \\<open>is_path \\<pi>\\<close> and \\<open>\\<pi> k \\<noteq> return\\<close> \\<open>\\<pi> n = return\\<close> \nobtains l where \\<open>k < l\\<close> and \\<open>l \\<le> n\\<close> and \\<open>\\<pi> l = ipd(\\<pi> k)\\<close> \nproof -\n  have \\<open>\\<pi> n \\<noteq> \\<pi> k\\<close> using assms by auto\n  moreover\n  have \\<open>k \\<le> n\\<close> apply (rule ccontr) using term_path_stable assms by auto\n  hence \\<open>k < n\\<close> by (metis assms(2,3) dual_order.order_iff_strict)\n  moreover\n  have \\<open>\\<pi> n pd\\<rightarrow> \\<pi> k\\<close> by (metis assms(1,3) path_nodes return_pd)\n  ultimately\n  obtain l where \\<open>k < l\\<close> \\<open>l \\<le> n\\<close> \\<open>\\<pi> l = ipd (\\<pi> k)\\<close> using assms path_pd_ipd by blast\n  thus \\<open>thesis\\<close> using that by auto\nqed\n\nlemma pd_intro: assumes \\<open>l pd\\<rightarrow> k\\<close> \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> 0 = k\\<close> \\<open>\\<pi> n = return\\<close> \nobtains i where \\<open>i \\<le> n\\<close> \\<open>\\<pi> i = l\\<close> using assms unfolding is_pd_def by metis\n\nlemma path_pd_pd0: assumes path:  \\<open>is_path \\<pi>\\<close> and lpdn: \\<open>\\<pi> l pd\\<rightarrow> n\\<close> and npd0: \\<open>n pd\\<rightarrow> \\<pi> 0\\<close> \nobtains k where \\<open>k \\<le> l\\<close> \\<open>\\<pi> k = n\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> thesis\\<close>\n  hence notn: \\<open>\\<And> k. k \\<le> l \\<Longrightarrow> \\<pi> k \\<noteq> n\\<close> using that by blast\n  have nret: \\<open>\\<pi> l \\<noteq> return\\<close> by (metis is_pd_def assms(1,3) notn)\n  \n  obtain \\<pi>' n' where path': \\<open>is_path \\<pi>'\\<close> and \\<pi>0': \\<open>\\<pi>' 0 = \\<pi> l\\<close> and \\<pi>n': \\<open>\\<pi>' n' = return\\<close> and nonepd: \\<open>\\<forall> i>0. \\<not> \\<pi> l pd\\<rightarrow> \\<pi>' i\\<close>\n  using nret path path_nodes ret_path_none_pd by metis\n  \n  have \\<open>\\<pi> l \\<noteq> n\\<close> using notn by simp\n  hence \\<open>\\<forall> i. \\<pi>' i \\<noteq> n\\<close> using nonepd \\<pi>0' lpdn by (metis neq0_conv)\n  \n  hence notn': \\<open>\\<forall> i. (\\<pi>@\\<^bsup>l\\<^esup> \\<pi>') i \\<noteq> n\\<close> using notn \\<pi>0' by auto\n\n  have \\<open>is_path (\\<pi>@\\<^bsup>l\\<^esup> \\<pi>')\\<close> using path path' by (metis \\<pi>0' path_cons)\n  moreover\n  have \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>') 0 = \\<pi> 0\\<close> by simp\n  moreover\n  have \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>') (n' + l) = return\\<close> using \\<pi>0' \\<pi>n' by auto\n  ultimately\n  show \\<open>False\\<close> using notn' npd0 unfolding is_pd_def by blast\nqed\n\n\nsubsection \\<open>Facts about Control Dependencies\\<close>\n\nlemma icd_imp_cd: \\<open>n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<Longrightarrow> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis is_icdi_def)\n\nlemma ipd_impl_not_cd:  assumes \\<open>j \\<in> {k..i}\\<close> and \\<open>\\<pi> j = ipd (\\<pi> k)\\<close> shows \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \n  by (metis assms(1) assms(2) is_cdi_def)\n\nlemma cd_not_ret: assumes \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<close> shows \\<open>\\<pi> k \\<noteq> return\\<close> by (metis is_cdi_def assms nat_less_le term_path_stable)\n\nlemma cd_path_shift: assumes \\<open>j \\<le> k\\<close> \\<open>is_path \\<pi> \\<close> shows \\<open>(i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = (i - j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow> k-j)\\<close> proof \n  assume a: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  hence b: \\<open>k < i\\<close> by (metis is_cdi_def)\n  hence \\<open>is_path (\\<pi> \\<guillemotleft> j)\\<close> \\<open>k - j < i - j\\<close> using assms apply (metis path_path_shift) \n  by (metis assms(1) b diff_less_mono)  \n  moreover \n  have c: \\<open>\\<forall> j \\<in> {k..i}. \\<pi> j \\<noteq> ipd (\\<pi> k)\\<close> by (metis a ipd_impl_not_cd)\n  hence \\<open>\\<forall> ja \\<in> {k - j..i - j}. (\\<pi> \\<guillemotleft> j) ja \\<noteq> ipd ((\\<pi> \\<guillemotleft> j) (k - j))\\<close> using b assms by auto fastforce\n  moreover \n  have \\<open>j < i\\<close> using assms(1) b by auto\n  hence \\<open>(\\<pi>\\<guillemotleft>j) (i - j) \\<noteq> return\\<close> using a unfolding is_cdi_def by auto \n  ultimately\n  show \\<open>i - j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow> k-j\\<close> unfolding is_cdi_def by simp\nnext\n  assume a: \\<open>i - j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow> k-j\\<close>\n  hence b: \\<open>k - j < i-j\\<close> by (metis is_cdi_def)\n  moreover\n  have c: \\<open>\\<forall> ja \\<in> {k - j..i - j}. (\\<pi> \\<guillemotleft> j) ja \\<noteq> ipd ((\\<pi> \\<guillemotleft> j) (k - j))\\<close> by (metis a ipd_impl_not_cd)\n  have \\<open>\\<forall> j \\<in> {k..i}. \\<pi> j \\<noteq> ipd (\\<pi> k)\\<close> proof (rule,goal_cases) case (1 n)\n    hence \\<open>n-j \\<in> {k-j..i-j}\\<close> using assms by auto\n    hence \\<open>\\<pi> (j + (n-j)) \\<noteq> ipd(\\<pi> (j + (k-j)))\\<close> by (metis c path_shift_def)\n    thus \\<open>?case\\<close> using 1 assms(1) by auto\n  qed\n  moreover\n  have \\<open>j < i\\<close> using assms(1) b by auto\n  hence \\<open>\\<pi> i \\<noteq> return\\<close> using a unfolding is_cdi_def by auto\n  ultimately\n  show \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> unfolding is_cdi_def by (metis assms(1) assms(2) diff_is_0_eq' le_diff_iff nat_le_linear nat_less_le)\nqed \n\nlemma cd_path_shift0: assumes \\<open>is_path \\<pi>\\<close> shows \\<open>(i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = (i-k cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow>0)\\<close>\n  using cd_path_shift[OF _ assms] by (metis diff_self_eq_0 le_refl)\n\nlemma icd_path_shift: assumes \\<open>l \\<le> k\\<close> \\<open>is_path \\<pi>\\<close> shows \\<open>(i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = (i - l icd\\<^bsup>\\<pi>\\<guillemotleft>l\\<^esup>\\<rightarrow> k - l)\\<close> \nproof -\n  have \\<open>is_path (\\<pi>\\<guillemotleft>l)\\<close> using path_path_shift assms(2) by auto\n  moreover\n  have \\<open>(i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = (i - l cd\\<^bsup>\\<pi>\\<guillemotleft>l\\<^esup>\\<rightarrow> k - l)\\<close> using assms cd_path_shift by auto\n  moreover \n  have \\<open>(\\<forall> m \\<in> {k<..<i}. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m) = (\\<forall> m \\<in> {k - l<..<i - l}. \\<not> i - l cd\\<^bsup>\\<pi> \\<guillemotleft> l\\<^esup>\\<rightarrow> m)\\<close> \n  proof -\n    {fix m assume *: \\<open>\\<forall> m \\<in> {k - l<..<i - l}. \\<not> i - l cd\\<^bsup>\\<pi> \\<guillemotleft> l\\<^esup>\\<rightarrow> m\\<close> \\<open>m \\<in> {k<..<i}\\<close> \n      hence \\<open>m-l \\<in> {k-l<..<i-l}\\<close> using assms(1) by auto\n      hence \\<open>\\<not> i - l cd\\<^bsup>\\<pi>\\<guillemotleft>l\\<^esup>\\<rightarrow>(m-l)\\<close> using * by blast\n      moreover\n      have \\<open>l \\<le> m\\<close> using * assms by auto\n      ultimately have \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>m\\<close> using assms(2) cd_path_shift by blast\n    }\n    moreover\n    {fix m assume *: \\<open>\\<forall> m \\<in> {k<..<i}. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> \\<open>m-l \\<in> {k-l<..<i-l}\\<close> \n      hence \\<open>m \\<in> {k<..<i}\\<close> using assms(1) by auto\n      hence \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>m\\<close> using * by blast\n      moreover\n      have \\<open>l \\<le> m\\<close> using * assms by auto\n      ultimately have \\<open>\\<not> i - l cd\\<^bsup>\\<pi>\\<guillemotleft>l\\<^esup>\\<rightarrow>(m-l)\\<close> using assms(2) cd_path_shift by blast\n    }\n    ultimately show \\<open>?thesis\\<close> by auto (metis diff_add_inverse)\n  qed\n  ultimately\n  show \\<open>?thesis\\<close> unfolding is_icdi_def using assms by blast\nqed\n\nlemma icd_path_shift0: assumes \\<open>is_path \\<pi>\\<close> shows \\<open>(i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = (i-k icd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow>0)\\<close>\n  using icd_path_shift[OF _ assms] by (metis diff_self_eq_0 le_refl)\n\nlemma cdi_path_swap: assumes \\<open>is_path \\<pi>'\\<close> \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> \\<open>\\<pi> =\\<^bsub>j\\<^esub>  \\<pi>'\\<close> shows \\<open>j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow>k\\<close> using assms unfolding eq_up_to_def is_cdi_def by auto\n\nlemma cdi_path_swap_le: assumes \\<open>is_path \\<pi>'\\<close> \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>'\\<close> \\<open>j \\<le> n\\<close> shows \\<open>j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow>k\\<close> by (metis assms cdi_path_swap eq_up_to_le)\n\nlemma not_cd_impl_ipd:  assumes \\<open>is_path \\<pi>\\<close> and \\<open>k < i\\<close> and \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and \\<open>\\<pi> i \\<noteq> return\\<close> obtains j where \\<open>j \\<in> {k..i}\\<close> and \\<open>\\<pi> j = ipd (\\<pi> k)\\<close>\nby (metis assms(1) assms(2) assms(3) assms(4) is_cdi_def)\n\nlemma icd_is_the_icd: assumes \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> shows \\<open>k = (THE k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> using assms icd_uniq \n  by (metis the1_equality)\n\nlemma all_ipd_imp_ret: assumes \\<open>is_path \\<pi>\\<close> and \\<open>\\<forall> i. \\<pi> i \\<noteq> return \\<longrightarrow> (\\<exists> j>i. \\<pi> j = ipd (\\<pi> i))\\<close> shows \\<open>\\<exists>j. \\<pi> j = return\\<close>\nproof - \n  { fix x assume *: \\<open>\\<pi> 0 = x\\<close>\n    have \\<open>?thesis\\<close> using wf_pdt_inv * assms  \n    proof(induction \\<open>x\\<close> arbitrary: \\<open>\\<pi>\\<close> rule: wf_induct_rule )\n    case (less x \\<pi>) show \\<open>?case\\<close> proof (cases \\<open>x = return\\<close>)\n      case True thus \\<open>?thesis\\<close> using less(2) by auto\n    next\n      assume not_ret: \\<open>x \\<noteq> return\\<close>\n      moreover\n      then obtain k where k_ipd: \\<open>\\<pi> k = ipd x\\<close> using less(2,4) by auto\n      moreover  \n      have \\<open>x \\<in> nodes\\<close> using less(2,3) by (metis path_nodes)\n      ultimately \n      have \\<open>(x, \\<pi> k) \\<in> pdt\\<close> by (metis ipd_in_pdt)\n      hence a: \\<open>(\\<pi> k, x) \\<in> pdt_inv\\<close> unfolding pdt_inv_def by simp     \n      have b: \\<open>is_path (\\<pi> \\<guillemotleft> k)\\<close> by (metis less.prems(2) path_path_shift)    \n      have c: \\<open>\\<forall> i. (\\<pi>\\<guillemotleft>k) i \\<noteq> return \\<longrightarrow> (\\<exists>j>i. (\\<pi>\\<guillemotleft>k) j = ipd ((\\<pi>\\<guillemotleft>k) i))\\<close> using less(4) apply auto\n        by (metis (full_types) ab_semigroup_add_class.add_ac(1) less_add_same_cancel1 less_imp_add_positive)\n      from less(1)[OF a _ b c]\n      have \\<open>\\<exists>j. (\\<pi>\\<guillemotleft>k) j = return\\<close> by auto    \n      thus \\<open>\\<exists>j. \\<pi> j = return\\<close> by auto\n    qed\n    qed\n  }\n  thus \\<open>?thesis\\<close> by simp\nqed\n\nlemma loop_has_cd: assumes \\<open>is_path \\<pi>\\<close> \\<open>0 < i\\<close> \\<open>\\<pi> i = \\<pi> 0\\<close> \\<open>\\<pi> 0 \\<noteq> return\\<close> shows \\<open>\\<exists> k < i. i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> proof (rule ccontr)\n  let \\<open>?\\<pi>\\<close> = \\<open>(\\<lambda> n. \\<pi> (n mod i))\\<close>  \n  assume \\<open>\\<not> (\\<exists>k<i. i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close>\n  hence \\<open>\\<forall> k <i. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by blast\n  hence *: \\<open>\\<forall> k<i. (\\<exists>j \\<in> {k..i}. \\<pi> j = ipd (\\<pi> k))\\<close> using assms(1,3,4) not_cd_impl_ipd by metis\n  have \\<open>\\<forall> k. (\\<exists> j > k. ?\\<pi> j = ipd (?\\<pi> k))\\<close> proof \n    fix k\n    have \\<open>k mod i < i\\<close> using assms(2) by auto\n    with * obtain j where \\<open>j \\<in> {(k mod i)..i}\\<close> \\<open>\\<pi> j = ipd (\\<pi> (k mod i))\\<close> by auto\n    then obtain j' where 1: \\<open>j' < i\\<close> \\<open>\\<pi> j' = ipd (\\<pi> (k mod i))\\<close> \n      by (cases \\<open>j = i\\<close>, auto ,metis assms(2) assms(3),metis le_neq_implies_less)\n    then obtain j'' where 2: \\<open>j'' > k\\<close> \\<open>j'' mod i = j'\\<close> by (metis mod_bound_instance)\n    hence \\<open>?\\<pi> j'' = ipd (?\\<pi> k)\\<close> using 1 by auto\n    with 2(1)\n    show \\<open>\\<exists> j > k. ?\\<pi> j = ipd (?\\<pi> k)\\<close> by auto\n  qed\n  moreover \n  have \\<open>is_path ?\\<pi>\\<close> by (metis assms(1) assms(2) assms(3) is_path_loop)\n  ultimately \n  obtain k where \\<open>?\\<pi> k = return\\<close> by (metis (lifting) all_ipd_imp_ret)\n  moreover \n  have \\<open>k mod i < i\\<close> by (simp add: assms(2)) \n  ultimately\n  have \\<open>\\<pi> i = return\\<close> by (metis assms(1) term_path_stable less_imp_le)\n  thus \\<open>False\\<close> by (metis assms(3) assms(4))\nqed\n\nlemma loop_has_cd': assumes \\<open>is_path \\<pi>\\<close> \\<open>j < i\\<close> \\<open>\\<pi> i = \\<pi> j\\<close> \\<open>\\<pi> j \\<noteq> return\\<close> shows \\<open>\\<exists> k \\<in> {j..<i}. i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \nproof -\n  have \\<open>\\<exists> k'< i-j. i-j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow>k'\\<close> \n    apply(rule loop_has_cd) \n    apply (metis assms(1) path_path_shift)\n    apply (auto simp add: assms less_imp_le)\n    done\n  then obtain k where k: \\<open>k<i-j\\<close> \\<open>i-j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow>k\\<close> by auto\n  hence k': \\<open>(k+j) < i\\<close>  \\<open>i-j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow> (k+j)-j\\<close>  by auto\n  note cd_path_shift[OF _ assms(1)]\n  hence \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k+j\\<close> using k'(2) by (metis le_add1 add.commute)\n  with k'(1) show \\<open>?thesis\\<close> by force\nqed  \n\nlemma claim'': assumes path\\<pi>: \\<open>is_path \\<pi>\\<close> and path\\<pi>': \\<open>is_path \\<pi>'\\<close> \nand \\<pi>i: \\<open>\\<pi> i = \\<pi>' i'\\<close> and \\<pi>j: \\<open>\\<pi> j = \\<pi>' j'\\<close> \nand not_cd:  \\<open>\\<forall> k. \\<not> j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>  \\<open>\\<forall> k. \\<not> i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k\\<close> \nand nret: \\<open>\\<pi> i \\<noteq> return\\<close>\nand ilj: \\<open>i < j\\<close>\nshows \\<open>i' < j'\\<close> proof (rule ccontr)\n  assume \\<open>\\<not> i' < j'\\<close>  \n  hence jlei: \\<open>j' \\<le> i'\\<close> by auto\n  show \\<open>False\\<close> proof (cases)\n  assume j'li': \\<open>j' < i'\\<close> \n  define \\<pi>'' where \\<open>\\<pi>'' \\<equiv> (\\<pi>@\\<^bsup>j\\<^esup>(\\<pi>'\\<guillemotleft>j'))\\<guillemotleft>i\\<close>\n  note \\<pi>''_def[simp]\n  have \\<open>\\<pi> j = (\\<pi>' \\<guillemotleft> j') 0\\<close> by (metis path_shift_def Nat.add_0_right \\<pi>j)\n  hence \\<open>is_path \\<pi>''\\<close> using path\\<pi> path\\<pi>' \\<pi>''_def path_path_shift path_cons by presburger\n  moreover \n  have \\<open>\\<pi>'' (j-i+(i'-j')) = \\<pi>'' 0\\<close>  using ilj jlei \\<pi>i \\<pi>j \n    by (auto, metis add_diff_cancel_left' le_antisym le_diff_conv le_eq_less_or_eq)\n  moreover\n  have \\<open>\\<pi>'' 0 \\<noteq> return\\<close> by (simp add: ilj less_or_eq_imp_le nret)\n  moreover\n  have \\<open>0 < j-i+(i'-j')\\<close> by (metis add_is_0 ilj neq0_conv zero_less_diff)\n  ultimately obtain k where k: \\<open>k < j-i+(i'-j')\\<close> \\<open>j-i+(i'-j') cd\\<^bsup>\\<pi>''\\<^esup>\\<rightarrow> k\\<close>   by (metis loop_has_cd)\n  hence *: \\<open>\\<forall> l \\<in> {k..j-i+(i'-j')}. \\<pi>'' l \\<noteq> ipd (\\<pi>'' k)\\<close> by (metis is_cdi_def)\n  show \\<open>False\\<close> proof (cases \\<open>k < j-i\\<close>)\n    assume a: \\<open>k < j - i\\<close>\n    hence b: \\<open>\\<pi>'' k = \\<pi> (i + k)\\<close> by auto\n    have \\<open>\\<forall> l \\<in> {i+k..j}. \\<pi> l \\<noteq> ipd (\\<pi> (i+k))\\<close> proof\n      fix l assume l: \\<open>l \\<in> {i + k..j}\\<close>\n      hence \\<open>\\<pi> l = \\<pi>'' (l - i)\\<close> by auto\n      moreover \n      from a l have \\<open>l-i \\<in> {k .. j-i + (i'-j')}\\<close> by force\n      ultimately show \\<open>\\<pi> l \\<noteq> ipd (\\<pi> (i + k))\\<close> using * b by auto\n    qed\n    moreover \n    have \\<open>i + k < j\\<close> using a by simp\n    moreover\n    have \\<open>\\<pi> j \\<noteq> return\\<close> by (metis \\<pi>i \\<pi>j j'li' nret path\\<pi>' term_path_stable less_imp_le) \n    ultimately\n    have \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i+k\\<close>  by (metis not_cd_impl_ipd path\\<pi>)\n    thus \\<open>False\\<close> by (metis not_cd(1))\n  next\n    assume \\<open>\\<not> k < j - i\\<close>\n    hence a: \\<open>j - i \\<le> k\\<close> by simp\n    hence b: \\<open>\\<pi>'' k = \\<pi>' (j' + (i + k) - j)\\<close> unfolding \\<pi>''_def path_shift_def path_append_def using ilj \n      by(auto,metis \\<pi>j add_diff_cancel_left' le_antisym le_diff_conv add.commute)\n    have \\<open>\\<forall> l \\<in> {j' + (i+k) - j..i'}. \\<pi>' l \\<noteq> ipd (\\<pi>' (j' + (i+k) - j))\\<close> proof\n      fix l assume l: \\<open>l \\<in> {j' + (i+k) - j..i'}\\<close>\n      hence \\<open>\\<pi>' l = \\<pi>'' (j + l - i - j')\\<close> unfolding \\<pi>''_def path_shift_def path_append_def using ilj\n        by (auto, metis Nat.diff_add_assoc \\<pi>j a add.commute add_diff_cancel_left' add_leD1 le_antisym le_diff_conv)\n      moreover \n      from a l have \\<open>j + l - i - j' \\<in> {k .. j-i + (i'-j')}\\<close> by force\n      ultimately show \\<open>\\<pi>' l \\<noteq> ipd (\\<pi>' (j' + (i + k) - j))\\<close> using * b by auto\n    qed\n    moreover \n    have \\<open>j' + (i+k) - j < i'\\<close> using a  j'li' ilj k(1) by linarith      \n    moreover \n    have \\<open>\\<pi>' i' \\<noteq> return\\<close> by (metis \\<pi>i nret)\n    ultimately    \n    have \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' + (i+k) - j\\<close> by (metis not_cd_impl_ipd path\\<pi>')\n    thus \\<open>False\\<close> by (metis not_cd(2))\n  qed\n  next\n  assume \\<open>\\<not> j' < i'\\<close>\n  hence \\<open>j' = i'\\<close> by (metis \\<open>\\<not> i' < j'\\<close> linorder_cases)\n  hence \\<open>\\<pi> i = \\<pi> j\\<close> by (metis \\<pi>i \\<pi>j)\n  thus \\<open>False\\<close> by (metis ilj loop_has_cd' not_cd(1) nret path\\<pi>)\nqed\nqed\n\nlemma other_claim': assumes path: \\<open>is_path \\<pi>\\<close> and eq: \\<open>\\<pi> i = \\<pi> j\\<close> and \\<open>\\<pi> i \\<noteq> return\\<close> \nand icd: \\<open>\\<forall> k. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and \\<open>\\<forall> k. \\<not> j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> shows \\<open>i = j\\<close>  \nproof (rule ccontr,cases)\n  assume \\<open>i < j\\<close> thus \\<open>False\\<close> using assms claim'' by blast\nnext\n  assume \\<open>\\<not> i < j\\<close> \\<open>i \\<noteq> j\\<close> \n  hence \\<open>j < i\\<close> by auto\n  thus \\<open>False\\<close> using assms claim'' by (metis loop_has_cd')\nqed  \n\nlemma icd_no_cd_path_shift: assumes \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> shows \\<open>(\\<forall> k. \\<not> i - 1 cd\\<^bsup>\\<pi>\\<guillemotleft>1\\<^esup>\\<rightarrow> k)\\<close> \nproof (rule,rule ccontr,goal_cases)\n  case (1 k)\n  hence *: \\<open>i - 1 cd\\<^bsup>\\<pi> \\<guillemotleft> 1\\<^esup>\\<rightarrow> k\\<close> by simp\n  have **: \\<open>1 \\<le> k + 1\\<close> by simp\n  have ***: \\<open>is_path \\<pi>\\<close> by (metis assms is_icdi_def)\n  hence \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k+1\\<close> using cd_path_shift[OF ** ***] * by auto\n  moreover \n  hence \\<open>k+1 < i\\<close> unfolding is_cdi_def by simp\n  moreover\n  have \\<open>0 < k + 1\\<close> by simp\n  ultimately show \\<open>False\\<close> using assms[unfolded is_icdi_def] by auto\nqed\n\nlemma claim': assumes path\\<pi>: \\<open>is_path \\<pi>\\<close> and path\\<pi>': \\<open>is_path \\<pi>'\\<close> and\n  \\<pi>i: \\<open>\\<pi> i = \\<pi>' i'\\<close> and \\<pi>j: \\<open>\\<pi> j = \\<pi>' j'\\<close> and not_cd:\n  \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> \\<open>j icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close>\n  \\<open>i' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> 0\\<close> \\<open>j' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> 0\\<close>\n   and ilj: \\<open>i < j\\<close>\n   and nret: \\<open>\\<pi> i \\<noteq> return\\<close>\n  shows \\<open>i' < j'\\<close> \nproof -\n  have g0: \\<open>0 < i\\<close> \\<open>0 < j\\<close> \\<open>0 < i'\\<close> \\<open>0 < j'\\<close>using not_cd[unfolded is_icdi_def is_cdi_def] by auto\n  have  \\<open>(\\<pi> \\<guillemotleft> 1) (i - 1) = (\\<pi>' \\<guillemotleft> 1) (i' - 1)\\<close> \\<open>(\\<pi> \\<guillemotleft> 1) (j - 1) = (\\<pi>' \\<guillemotleft> 1) (j' - 1)\\<close> using \\<pi>i \\<pi>j g0 by auto\n  moreover\n  have \\<open>\\<forall> k. \\<not> (j - 1) cd\\<^bsup>\\<pi>\\<guillemotleft>1\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<forall> k. \\<not> (i' - 1) cd\\<^bsup>\\<pi>'\\<guillemotleft>1\\<^esup>\\<rightarrow> k\\<close> \n    by (metis icd_no_cd_path_shift not_cd(2)) (metis icd_no_cd_path_shift not_cd(3))\n  moreover\n  have \\<open>is_path (\\<pi>\\<guillemotleft>1)\\<close> \\<open>is_path (\\<pi>'\\<guillemotleft>1)\\<close> using path\\<pi> path\\<pi>' path_path_shift by blast+\n  moreover \n  have \\<open>(\\<pi>\\<guillemotleft>1) (i - 1) \\<noteq> return\\<close> using g0 nret by auto\n  moreover \n  have \\<open>i - 1 < j - 1\\<close> using g0 ilj by auto\n  ultimately have \\<open>i' - 1 < j' - 1\\<close> using claim'' by blast\n  thus \\<open>i'<j'\\<close> by auto\nqed\n\nlemma other_claim: assumes path: \\<open>is_path \\<pi>\\<close> and eq: \\<open>\\<pi> i = \\<pi> j\\<close> and \\<open>\\<pi> i \\<noteq> return\\<close> \nand icd: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> and \\<open>j icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> shows \\<open>i = j\\<close>  proof (rule ccontr,cases)\n  assume \\<open>i < j\\<close> thus \\<open>False\\<close> using assms claim' by blast\nnext\n  assume \\<open>\\<not> i < j\\<close> \\<open>i \\<noteq> j\\<close> \n  hence \\<open>j < i\\<close> by auto\n  thus \\<open>False\\<close> using assms claim' by (metis less_not_refl)\nqed\n\nlemma cd_trans0: assumes \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> and \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>j\\<close> shows \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> proof (rule ccontr)    \n  have path: \\<open>is_path \\<pi>\\<close> and ij: \\<open>0 < j\\<close> and jk: \\<open>j < k\\<close> \n  and nret: \\<open>\\<pi> j \\<noteq> return\\<close> \\<open>\\<pi> k \\<noteq> return\\<close>\n  and noipdi: \\<open>\\<forall> l \\<in> {0..j}. \\<pi> l \\<noteq> ipd (\\<pi> 0)\\<close>\n  and noipdj: \\<open>\\<forall> l \\<in> {j..k}. \\<pi> l \\<noteq> ipd (\\<pi> j)\\<close>\n  using assms unfolding is_cdi_def by auto\n  assume \\<open>\\<not> k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close>\n  hence \\<open>\\<exists>l \\<in> {0..k}. \\<pi> l = ipd (\\<pi> 0)\\<close> unfolding is_cdi_def using path ij jk nret by force\n  then obtain l where \\<open>l \\<in> {0..k}\\<close> and l: \\<open>\\<pi> l = ipd (\\<pi> 0)\\<close> by auto\n  hence jl: \\<open>j<l\\<close> and lk: \\<open>l\\<le>k\\<close> using noipdi ij by auto\n  have pdj: \\<open>ipd (\\<pi> 0) pd\\<rightarrow> \\<pi> j\\<close> proof (rule ccontr)    \n    have \\<open>\\<pi> j \\<in> nodes\\<close> using path by (metis path_nodes)\n    moreover \n    assume \\<open>\\<not> ipd (\\<pi> 0) pd\\<rightarrow> \\<pi> j\\<close>\n    ultimately\n    obtain \\<pi>' n where *: \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi>' 0 = \\<pi> j\\<close> \\<open>\\<pi>' n = return\\<close> \\<open>\\<forall> k\\<le>n. \\<pi>' k \\<noteq> ipd(\\<pi> 0)\\<close> using no_pd_path by metis\n    hence path': \\<open>is_path (\\<pi> @\\<^bsup>j\\<^esup>  \\<pi>')\\<close> by (metis path path_cons) \n    moreover\n    have \\<open>\\<forall> k \\<le> j + n. (\\<pi>@\\<^bsup>j\\<^esup>  \\<pi>') k \\<noteq> ipd (\\<pi> 0)\\<close> using noipdi *(4) by auto\n    moreover \n    have \\<open>(\\<pi>@\\<^bsup>j\\<^esup>  \\<pi>') 0 = \\<pi> 0\\<close> by auto\n    moreover\n    have \\<open>(\\<pi>@\\<^bsup>j\\<^esup>  \\<pi>') (j + n) = return\\<close> using *(2,3) by auto\n    ultimately\n    have \\<open>\\<not> ipd (\\<pi> 0) pd\\<rightarrow> \\<pi> 0\\<close> unfolding is_pd_def by metis\n    thus \\<open>False\\<close> by (metis is_ipd_def ij ipd_is_ipd nret(1) path path_nodes term_path_stable less_imp_le)\n  qed\n  hence \\<open>(\\<pi>\\<guillemotleft>j) (l-j) pd\\<rightarrow> (\\<pi>\\<guillemotleft>j) 0\\<close> using jl l by auto\n  moreover\n  have \\<open>is_path (\\<pi>\\<guillemotleft>j)\\<close> by (metis path path_path_shift)\n  moreover\n  have \\<open>\\<pi> l \\<noteq> return\\<close> by (metis lk nret(2) path term_path_stable)\n  hence \\<open>(\\<pi>\\<guillemotleft>j) (l-j) \\<noteq> return\\<close> using jl by auto\n  moreover \n  have \\<open>\\<pi> j \\<noteq> ipd (\\<pi> 0)\\<close> using noipdi by force\n  hence \\<open>(\\<pi>\\<guillemotleft>j) (l-j) \\<noteq> (\\<pi>\\<guillemotleft>j) 0\\<close> using jl l by auto\n  ultimately\n  obtain k' where \\<open>k' \\<le> l-j\\<close> and \\<open>(\\<pi>\\<guillemotleft>j) k' = ipd ((\\<pi>\\<guillemotleft>j) 0)\\<close> using path_pd_ipd0' by blast\n  hence \\<open>j + k' \\<in> {j..k}\\<close> \\<open>\\<pi> (j+k') = ipd (\\<pi> j)\\<close> using jl lk by auto\n  thus \\<open>False\\<close> using noipdj by auto\nqed\n\nlemma cd_trans: assumes \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> and \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>j\\<close> shows \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> proof -\n  have path: \\<open>is_path \\<pi>\\<close> using assms is_cdi_def by auto\n  have ij: \\<open>i<j\\<close> using assms is_cdi_def by auto\n  let \\<open>?\\<pi>\\<close> = \\<open>\\<pi>\\<guillemotleft>i\\<close>\n  have \\<open>j-i cd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow> 0\\<close> using assms(1) cd_path_shift0 path by auto\n  moreover\n  have \\<open>k-i cd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow>j-i\\<close> by (metis assms(2) cd_path_shift is_cdi_def ij less_imp_le_nat)\n  ultimately\n  have \\<open>k-i cd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow> 0\\<close> using cd_trans0 by auto\n  thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> using path cd_path_shift0 by auto\nqed\n\nlemma excd_impl_exicd: assumes \\<open>\\<exists> k. i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> shows \\<open>\\<exists> k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> \nusing assms proof(induction \\<open>i\\<close> arbitrary: \\<open>\\<pi>\\<close> rule: less_induct)\n  case (less i) \n  then obtain k where k: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> by auto\n  hence ip: \\<open>is_path \\<pi>\\<close> unfolding is_cdi_def by auto\n  show \\<open>?case\\<close> proof (cases)\n    assume *: \\<open>\\<forall> m \\<in> {k<..<i}. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close>\n    hence \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> using k ip unfolding is_icdi_def by auto\n    thus \\<open>?case\\<close> by auto\n  next\n    assume \\<open>\\<not> (\\<forall> m \\<in> {k<..<i}. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m)\\<close>\n    then obtain m where m: \\<open>m \\<in> {k<..<i}\\<close> \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> by blast\n    hence \\<open>i - m cd\\<^bsup>\\<pi>\\<guillemotleft>m\\<^esup>\\<rightarrow> 0\\<close> by (metis cd_path_shift0 is_cdi_def)\n    moreover \n    have \\<open>i - m < i\\<close> using m by auto\n    ultimately\n    obtain k' where k': \\<open>i - m icd\\<^bsup>\\<pi>\\<guillemotleft>m\\<^esup>\\<rightarrow> k'\\<close> using less(1) by blast\n    hence \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k' + m\\<close> using ip \n    by (metis add.commute add_diff_cancel_right' icd_path_shift le_add1)\n    thus \\<open>?case\\<close> by auto\n  qed\nqed\n\nlemma cd_split: assumes \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and \\<open>\\<not> i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> obtains m where \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> and \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \nproof -\n  have ki: \\<open>k < i\\<close> using assms is_cdi_def by auto\n  obtain m where m: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using assms(1) by (metis excd_impl_exicd)\n  hence \\<open>k \\<le> m\\<close> unfolding is_icdi_def using ki assms(1) by force\n  hence km: \\<open>k < m\\<close>using m assms(2) by (metis le_eq_less_or_eq)\n  moreover have \\<open>\\<pi> m \\<noteq> return\\<close> using m unfolding is_icdi_def is_cdi_def by (simp, metis term_path_stable less_imp_le)\n  moreover have \\<open>m<i\\<close> using m unfolding is_cdi_def is_icdi_def by auto\n  ultimately \n  have \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using assms(1) unfolding is_cdi_def by auto\n  with m that show \\<open>thesis\\<close> by auto\nqed\n\nlemma cd_induct[consumes 1, case_names base IS]: assumes prem: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and base: \\<open>\\<And> i. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k \\<Longrightarrow> P i\\<close> \nand IH: \\<open>\\<And> k' i'. k' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<Longrightarrow> P k' \\<Longrightarrow> i' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k' \\<Longrightarrow> P i'\\<close> shows \\<open>P i\\<close> \nusing prem IH proof (induction \\<open>i\\<close> rule: less_induct,cases)\n  case (less i) \n  assume \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  thus \\<open>P i\\<close> using base by simp\nnext\n  case (less i')\n  assume \\<open>\\<not> i' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  then obtain k' where k': \\<open> i' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k'\\<close> \\<open>k' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using less cd_split by blast\n  hence icdk: \\<open>i' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k'\\<close> using is_icdi_def by auto\n  note ih=less(3)[OF k'(2)  _ k'(1)]\n  have ki: \\<open>k' < i'\\<close> using k' is_icdi_def is_cdi_def by auto\n  have \\<open>P k'\\<close> using less(1)[OF ki k'(2) ] less(3) by auto\n  thus \\<open>P i'\\<close> using ih by simp\nqed\n\nlemma cdi_prefix: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m \\<Longrightarrow> m < n' \\<Longrightarrow> n' \\<le> n \\<Longrightarrow> n' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close>  unfolding is_cdi_def \n  by (simp, metis term_path_stable)\n\nlemma cr_wn': assumes 1: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> and nc: \\<open>\\<not> m' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> and 3: \\<open>m < m'\\<close> shows \\<open>n < m'\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> n < m'\\<close>\n  hence \\<open>m' \\<le> n\\<close> by simp  \n  hence \\<open>m' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> by (metis 1 3 cdi_prefix)\n  thus \\<open>False\\<close> using nc by simp\nqed\n\nlemma cr_wn'': assumes \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> and \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> and \\<open>\\<not> m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> and  \\<open>i \\<le> j\\<close> shows \\<open>m \\<le> n\\<close> proof (rule ccontr) \n  assume \\<open>\\<not>m\\<le>n\\<close>\n  hence nm: \\<open>n < m\\<close> by auto\n  moreover \n  have \\<open>m<j\\<close> using assms(1) assms(4) unfolding is_cdi_def by auto\n  ultimately \n  have \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> using assms(2) cdi_prefix by auto\n  thus \\<open>False\\<close> using assms(3) by auto\nqed\n\nlemma ret_no_cd: assumes \\<open>\\<pi> n = return\\<close> shows \\<open>\\<not> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis assms is_cdi_def)\n\nlemma ipd_not_self: assumes \\<open>x \\<in> nodes\\<close> \\<open>x\\<noteq> return\\<close> shows \\<open>x \\<noteq> ipd x\\<close> by (metis is_ipd_def assms ipd_is_ipd)\n\nlemma icd_cs: assumes \\<open>l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>\\<^esup> k @ [\\<pi> l]\\<close>\nproof -\n  from assms have \\<open>k = (THE k. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> by (metis icd_is_the_icd)\n  with assms show \\<open>?thesis\\<close> by auto\nqed\n\nlemma cd_not_pd: assumes \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<pi> l \\<noteq> \\<pi> k\\<close> shows \\<open>\\<not> \\<pi> l pd\\<rightarrow> \\<pi> k\\<close> proof\n  assume pd: \\<open>\\<pi> l pd\\<rightarrow> \\<pi> k\\<close>\n  have nret: \\<open>\\<pi> k \\<noteq> return\\<close> by (metis assms(1) pd pd_ret_is_ret ret_no_cd)\n  have kl: \\<open>k < l\\<close> by (metis is_cdi_def assms(1))\n  have path: \\<open>is_path \\<pi>\\<close> by (metis is_cdi_def assms(1))\n  from path_pd_ipd[OF path nret assms(2) pd kl]\n  obtain n where \\<open>k < n\\<close> \\<open>n \\<le> l\\<close> \\<open>\\<pi> n = ipd (\\<pi> k)\\<close> .\n  thus \\<open>False\\<close> using assms(1) unfolding is_cdi_def by auto\nqed\n\nlemma cd_ipd_is_cd: assumes \\<open>k<m\\<close> \\<open>\\<pi> m = ipd (\\<pi> k)\\<close> \\<open>\\<forall> n \\<in> {k..<m}. \\<pi> n \\<noteq> ipd (\\<pi> k)\\<close> and mcdj: \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> shows \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> proof cases\n  assume \\<open>j < k\\<close> thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> by (metis mcdj assms(1) cdi_prefix less_imp_le_nat)\nnext\n  assume \\<open>\\<not> j < k\\<close>\n  hence kj: \\<open>k \\<le> j\\<close> by simp \n  have \\<open>k < j\\<close> apply (rule ccontr) using kj assms mcdj by (auto, metis is_cdi_def is_ipd_def cd_not_pd ipd_is_ipd path_nodes term_path_stable less_imp_le)\n  moreover \n  have \\<open>j < m\\<close> using mcdj is_cdi_def by auto\n  hence \\<open>\\<forall> n \\<in> {k..j}. \\<pi> n \\<noteq> ipd(\\<pi> k)\\<close> using assms(3) by force\n  ultimately\n  have \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis mcdj is_cdi_def term_path_stable less_imp_le)\n  hence \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis mcdj cd_trans)\n  hence \\<open>False\\<close> by (metis is_cdi_def is_ipd_def assms(2) cd_not_pd ipd_is_ipd path_nodes term_path_stable less_imp_le)\n  thus \\<open>?thesis\\<close> by simp\nqed\n\nlemma ipd_pd_cd0: assumes lcd: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> shows \\<open>ipd (\\<pi> 0) pd\\<rightarrow> (\\<pi> n)\\<close> \nproof -\n  obtain k l where \\<pi>0: \\<open>\\<pi> 0 = k\\<close> and \\<pi>n: \\<open>\\<pi> n = l\\<close> and cdi: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> 0\\<close> using lcd unfolding is_cdi_def by blast\n  have nret: \\<open>k \\<noteq> return\\<close> by (metis is_cdi_def \\<pi>0 cdi term_path_stable less_imp_le)\n  have  path: \\<open>is_path \\<pi>\\<close> and ipd: \\<open>\\<forall> i\\<le>n. \\<pi> i \\<noteq> ipd k\\<close> using cdi unfolding is_cdi_def \\<pi>0 by auto\n  {\n    fix \\<pi>' n'\n    assume path': \\<open>is_path \\<pi>'\\<close>\n    and \\<pi>'0: \\<open>\\<pi>' 0 = l\\<close>\n    and ret: \\<open>\\<pi>' n' = return\\<close>\n    have \\<open>is_path (\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>')\\<close> using path path' \\<pi>n \\<pi>'0 by (metis path_cons)\n    moreover\n    have \\<open>(\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>') (n+n') = return\\<close> using ret \\<pi>n \\<pi>'0 by auto\n    moreover\n    have \\<open>(\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>') 0 = k\\<close> using \\<pi>0 by auto\n    moreover    \n    have \\<open>ipd k pd\\<rightarrow> k\\<close> by (metis is_ipd_def path \\<pi>0 ipd_is_ipd nret path_nodes)\n    ultimately\n    obtain k' where k': \\<open>k' \\<le> n+n'\\<close> \\<open>(\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>') k' = ipd k\\<close> by (metis pd_intro)\n    have \\<open>\\<not> k'\\<le> n\\<close> proof \n      assume \\<open>k' \\<le> n\\<close> \n      hence \\<open>(\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>') k' = \\<pi> k'\\<close> by auto\n      thus \\<open>False\\<close> using k'(2) ipd by (metis \\<open>k' \\<le> n\\<close>)\n    qed\n    hence \\<open>(\\<pi> @\\<^bsup>n\\<^esup>  \\<pi>') k' = \\<pi>' (k' - n)\\<close> by auto\n    moreover \n    have \\<open>(k' - n) \\<le> n'\\<close> using k' by simp\n    ultimately\n    have \\<open>\\<exists> k'\\<le>n'. \\<pi>' k' = ipd k\\<close> unfolding k' by auto\n  }\n  moreover\n  have \\<open>l \\<in> nodes\\<close> by (metis \\<pi>n path path_nodes)\n  ultimately show \\<open>ipd (\\<pi> 0) pd\\<rightarrow> (\\<pi> n)\\<close> unfolding is_pd_def  by (simp add: \\<pi>0 \\<pi>n) \nqed\n\nlemma ipd_pd_cd: assumes lcd: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> shows \\<open>ipd (\\<pi> k) pd\\<rightarrow> (\\<pi> l)\\<close> \nproof - \n  have \\<open>l-k cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow>0\\<close> using lcd cd_path_shift0 is_cdi_def by blast \n  moreover\n  note ipd_pd_cd0[OF this]\n  moreover \n  have \\<open>(\\<pi> \\<guillemotleft> k) 0 = \\<pi> k\\<close> by auto\n  moreover\n  have \\<open>k < l\\<close> using lcd unfolding is_cdi_def by simp\n  then have \\<open>(\\<pi> \\<guillemotleft> k) (l - k) = \\<pi> l\\<close> by simp \n  ultimately show \\<open>?thesis\\<close> by simp\nqed\n\nlemma cd_is_cd_ipd: assumes km: \\<open>k<m\\<close> and ipd: \\<open>\\<pi> m = ipd (\\<pi> k)\\<close> \\<open>\\<forall> n \\<in> {k..<m}. \\<pi> n \\<noteq> ipd (\\<pi> k)\\<close> and cdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and nipdj: \\<open>ipd (\\<pi> j) \\<noteq> \\<pi> m\\<close> shows \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> proof -\n  have path: \\<open>is_path \\<pi>\\<close> \n  and jk: \\<open>j < k\\<close> \n  and nretj: \\<open>\\<pi> k \\<noteq> return\\<close> \n  and nipd: \\<open>\\<forall> l \\<in> {j..k}. \\<pi> l \\<noteq> ipd (\\<pi> j)\\<close> using  cdj is_cdi_def by auto\n  have pd: \\<open>ipd (\\<pi> j) pd\\<rightarrow> \\<pi> m\\<close> by (metis atLeastAtMost_iff cdj ipd(1) ipd_pd_cd jk le_refl less_imp_le nipd nretj path path_nodes pd_pd_ipd)  \n  have nretm: \\<open>\\<pi> m \\<noteq> return\\<close> by (metis nipdj pd pd_ret_is_ret)\n  have jm: \\<open>j < m\\<close> using jk km by simp\n  show \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> proof (rule ccontr)\n    assume ncdj: \\<open>\\<not> m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close>     \n    hence \\<open>\\<exists> l \\<in> {j..m}. \\<pi> l = ipd (\\<pi> j)\\<close> unfolding is_cdi_def by (metis jm nretm path)\n    then obtain l \n    where jl: \\<open>j \\<le> l\\<close> and \\<open>l \\<le> m\\<close> \n    and lipd: \\<open>\\<pi> l = ipd (\\<pi> j)\\<close> by force\n    hence lm: \\<open>l < m\\<close> using nipdj by (metis le_eq_less_or_eq)\n    have npd: \\<open>\\<not> ipd (\\<pi> k) pd\\<rightarrow> \\<pi> l\\<close> by (metis ipd(1) lipd nipdj pd pd_antisym)\n    have nd: \\<open>\\<pi> l \\<in> nodes\\<close> using path path_nodes by simp\n    from no_pd_path[OF nd npd]\n    obtain \\<pi>' n where path': \\<open>is_path \\<pi>'\\<close> and \\<pi>'0: \\<open>\\<pi>' 0 = \\<pi> l\\<close> and \\<pi>'n: \\<open>\\<pi>' n = return\\<close> and nipd: \\<open>\\<forall> ka\\<le>n. \\<pi>' ka \\<noteq> ipd (\\<pi> k)\\<close> .\n    let \\<open>?\\<pi>\\<close> = \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>') \\<guillemotleft> k\\<close>\n    have path'': \\<open>is_path ?\\<pi>\\<close> by (metis \\<pi>'0 path path' path_cons path_path_shift)\n    moreover\n    have kl: \\<open>k < l\\<close> using lipd cdj jl unfolding is_cdi_def by fastforce    \n    have \\<open>?\\<pi> 0 = \\<pi> k\\<close> using kl by auto\n    moreover\n    have \\<open>?\\<pi> (l + n - k) = return\\<close> using \\<pi>'n \\<pi>'0 kl by auto\n    moreover\n    have \\<open>ipd (\\<pi> k) pd\\<rightarrow> \\<pi> k\\<close> by (metis is_ipd_def ipd_is_ipd nretj path path_nodes)\n    ultimately\n    obtain l' where l': \\<open>l' \\<le> (l + n - k)\\<close> \\<open>?\\<pi> l' = ipd (\\<pi> k)\\<close> unfolding is_pd_def by blast\n    show \\<open>False\\<close> proof (cases )\n      assume *: \\<open>k + l' \\<le> l\\<close>\n      hence \\<open>\\<pi> (k + l') = ipd (\\<pi> k)\\<close> using l' by auto\n      moreover \n      have \\<open>k + l' < m\\<close> by (metis \"*\" dual_order.strict_trans2 lm)\n      ultimately\n      show \\<open>False\\<close> using ipd(2) by simp\n    next\n      assume \\<open>\\<not> k + l' \\<le> l\\<close>\n      hence \\<open>\\<pi>' (k + l' - l) = ipd (\\<pi> k)\\<close> using l' by auto\n      moreover\n      have \\<open>k + l' - l \\<le> n\\<close> using l' kl by linarith  \n      ultimately \n      show \\<open>False\\<close> using nipd by auto\n    qed\n  qed\nqed\n\nlemma ipd_icd_greatest_cd_not_ipd: assumes ipd: \\<open>\\<pi> m = ipd (\\<pi> k)\\<close> \\<open>\\<forall> n \\<in> {k..<m}. \\<pi> n \\<noteq> ipd (\\<pi> k)\\<close>\nand km: \\<open>k < m\\<close> and icdj: \\<open>m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> shows \\<open>j = (GREATEST j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> \\<pi> m)\\<close>\nproof -\n  let \\<open>?j\\<close> = \\<open>GREATEST j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> \\<pi> m\\<close>\n  have kcdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using assms cd_ipd_is_cd is_icdi_def by blast   \n  have nipd: \\<open>ipd (\\<pi> j) \\<noteq> \\<pi> m\\<close> using icdj unfolding is_icdi_def is_cdi_def by auto\n  have bound: \\<open>\\<And> j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> \\<pi> m \\<Longrightarrow> j \\<le> k\\<close> unfolding is_cdi_def by simp\n  have exists: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> \\<pi> m\\<close> (is \\<open>?P j\\<close>) using kcdj nipd by auto\n  note GreatestI_nat[of \\<open>?P\\<close> _ \\<open>k\\<close>, OF exists] Greatest_le_nat[of \\<open>?P\\<close> \\<open>j\\<close> \\<open>k\\<close>, OF exists]\n  hence kcdj': \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?j\\<close> and ipd': \\<open>ipd (\\<pi> ?j) \\<noteq> \\<pi> m\\<close> and jj: \\<open>j \\<le> ?j\\<close> using bound by auto\n  hence mcdj': \\<open>m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?j\\<close> using ipd km cd_is_cd_ipd by auto\n  show \\<open>j = ?j\\<close> proof (rule ccontr)\n    assume \\<open>j \\<noteq> ?j\\<close>\n    hence jlj: \\<open>j < ?j\\<close> using jj by simp\n    moreover \n    have \\<open>?j < m\\<close> using kcdj' km unfolding is_cdi_def by auto\n    ultimately\n    show \\<open>False\\<close> using icdj mcdj' unfolding is_icdi_def by auto\n  qed\nqed\n\nlemma cd_impl_icd_cd: assumes \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> and \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and \\<open>\\<not> i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> shows \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close>\n  using assms cd_split icd_uniq by metis\n\nlemma cdi_is_cd_icdi: assumes \\<open>k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> shows \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<longleftrightarrow> j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<or> i = j\\<close> \n  by (metis assms cd_impl_icd_cd cd_trans icd_imp_cd icd_uniq)\n\nlemma same_ipd_stable: assumes \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> \\<open>i<j\\<close> \\<open>ipd (\\<pi> i) = ipd (\\<pi> k)\\<close> shows \\<open>ipd (\\<pi> j) = ipd (\\<pi> k)\\<close>\nproof -\n  have jcdi: \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> by (metis is_cdi_def assms(1,2,3) cr_wn' le_antisym less_imp_le_nat)\n  have 1: \\<open>ipd (\\<pi> j) pd\\<rightarrow> \\<pi> k \\<close> by (metis assms(2) ipd_pd_cd)\n  have 2: \\<open>ipd (\\<pi> k) pd\\<rightarrow> \\<pi> j \\<close> by (metis assms(4) ipd_pd_cd jcdi)\n  have 3: \\<open>ipd (\\<pi> k) pd\\<rightarrow> (ipd (\\<pi> j))\\<close>  by (metis 2 IFC_def.is_cdi_def assms(1,2,4) atLeastAtMost_iff jcdi less_imp_le pd_node2 pd_pd_ipd) \n  have 4: \\<open>ipd (\\<pi> j) pd\\<rightarrow> (ipd (\\<pi> k))\\<close> by (metis 1 2 IFC_def.is_ipd_def assms(2) cd_not_pd ipd_is_ipd jcdi pd_node2 ret_no_cd) \n  show \\<open>?thesis\\<close> using 3 4 pd_antisym by simp\nqed\n\nlemma icd_pd_intermediate': assumes icd: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>  and j: \\<open>k < j\\<close> \\<open>j < i\\<close> shows \\<open>\\<pi> i pd\\<rightarrow> (\\<pi> j)\\<close>\nusing j proof (induction \\<open>i - j\\<close> arbitrary: \\<open>j\\<close> rule: less_induct)\n  case (less j)\n  have \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using less.prems icd unfolding is_icdi_def by force\n  moreover \n  have \\<open>is_path \\<pi>\\<close> using icd by (metis is_icdi_def)\n  moreover \n  have \\<open>\\<pi> i \\<noteq> return\\<close> using icd by (metis is_icdi_def ret_no_cd)\n  ultimately\n  have \\<open>\\<exists> l. j \\<le> l \\<and> l \\<le> i \\<and> \\<pi> l = ipd (\\<pi> j)\\<close> unfolding is_cdi_def using less.prems by auto\n  then obtain l where l: \\<open>j \\<le> l\\<close> \\<open>l \\<le> i\\<close> \\<open>\\<pi> l = ipd (\\<pi> j)\\<close> by blast\n  hence lpd: \\<open>\\<pi> l pd\\<rightarrow> (\\<pi> j)\\<close> by (metis is_ipd_def \\<open>\\<pi> i \\<noteq> return\\<close> \\<open>is_path \\<pi>\\<close> ipd_is_ipd path_nodes term_path_stable)\n  show \\<open>?case\\<close> proof (cases)\n    assume \\<open>l = i\\<close>\n    thus \\<open>?case\\<close> using lpd by auto\n  next\n    assume \\<open>l \\<noteq> i\\<close>\n    hence \\<open>l < i\\<close> using l by simp\n    moreover\n    have \\<open>j \\<noteq> l\\<close> using l by (metis is_ipd_def \\<open>\\<pi> i \\<noteq> return\\<close> \\<open>is_path \\<pi>\\<close> ipd_is_ipd path_nodes term_path_stable)\n    hence \\<open>j < l\\<close> using l by simp\n    moreover \n    hence \\<open>i - l < i - j\\<close> by (metis diff_less_mono2 less.prems(2))\n    moreover\n    have \\<open>k < l\\<close> by (metis l(1) less.prems(1) linorder_neqE_nat not_le order.strict_trans)\n    ultimately\n    have \\<open>\\<pi> i pd\\<rightarrow> (\\<pi> l)\\<close> using less.hyps by auto\n    thus \\<open>?case\\<close> using lpd by (metis pd_trans)\n  qed\nqed\n\nlemma icd_pd_intermediate: assumes icd: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>  and j: \\<open>k < j\\<close> \\<open>j \\<le> i\\<close> shows \\<open>\\<pi> i pd\\<rightarrow> (\\<pi> j)\\<close> \nusing assms icd_pd_intermediate'[OF assms(1,2)] apply (cases \\<open>j < i\\<close>,metis) by (metis is_icdi_def le_neq_trans path_nodes pd_refl)\n\nlemma no_icd_pd: assumes path: \\<open>is_path \\<pi>\\<close> and noicd: \\<open>\\<forall> l\\<ge>n. \\<not> k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> and nk: \\<open>n \\<le> k\\<close> shows \\<open>\\<pi> k pd\\<rightarrow> \\<pi> n\\<close>\nproof cases\n  assume \\<open>\\<pi> k = return\\<close> thus \\<open>?thesis\\<close> by (metis path path_nodes return_pd)  \nnext\n  assume nret: \\<open>\\<pi> k \\<noteq> return\\<close>\n  have nocd: \\<open>\\<And> l. n\\<le>l \\<Longrightarrow> \\<not> k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> proof \n    fix l assume kcd: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> and nl: \\<open>n \\<le> l\\<close>\n    hence \\<open>(k - n) cd\\<^bsup>\\<pi>\\<guillemotleft>n\\<^esup>\\<rightarrow> (l - n)\\<close> using cd_path_shift[OF nl path] by simp\n    hence \\<open>\\<exists> l. (k - n) icd\\<^bsup>\\<pi>\\<guillemotleft>n\\<^esup>\\<rightarrow> l\\<close> using excd_impl_exicd by blast\n    then obtain l' where \"k - n icd\\<^bsup>\\<pi> \\<guillemotleft> n\\<^esup>\\<rightarrow> l'\" ..\n    hence \\<open>k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> (l' + n)\\<close> using icd_path_shift[of \\<open>n\\<close> \\<open>l' + n\\<close> \\<open>\\<pi>\\<close> \\<open>k\\<close>] path by auto\n    thus \\<open>False\\<close> using noicd by auto\n  qed    \n  hence \\<open>\\<And>l. n \\<le> l \\<Longrightarrow> l<k \\<Longrightarrow> \\<exists> j \\<in> {l..k}. \\<pi> j = ipd (\\<pi> l)\\<close> using path nret unfolding is_cdi_def by auto \n  thus \\<open>?thesis\\<close> using nk proof (induction \\<open>k - n\\<close> arbitrary: \\<open>n\\<close> rule: less_induct,cases)\n    case (less n) \n    assume \\<open>n = k\\<close>\n    thus \\<open>?case\\<close> using pd_refl path path_nodes by auto\n  next\n    case (less n)\n    assume \\<open>n \\<noteq> k\\<close>\n    hence nk: \\<open>n < k\\<close> using less(3) by auto\n    with less(2) obtain j where jnk: \\<open>j \\<in> {n..k}\\<close> and ipdj: \\<open>\\<pi> j = ipd (\\<pi> n)\\<close> by blast\n    have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> using nk nret term_path_stable path by auto\n    with ipd_is_ipd path path_nodes is_ipd_def ipdj\n    have jpdn: \\<open>\\<pi> j pd\\<rightarrow> \\<pi> n\\<close> by auto\n    show \\<open>?case\\<close> proof cases\n      assume \\<open>j = k\\<close> thus \\<open>?case\\<close> using jpdn by simp\n    next\n      assume \\<open>j \\<noteq> k\\<close>\n      hence jk: \\<open>j < k\\<close> using jnk by auto\n      have \\<open>j \\<noteq> n\\<close> using ipdj by (metis ipd_not_self nretn path path_nodes)\n      hence nj: \\<open>n < j\\<close> using jnk by auto\n      have *: \\<open>k - j < k - n\\<close> using jk nj by auto\n      \n      with less(1)[OF *] less(2) jk nj\n      have \\<open>\\<pi> k pd\\<rightarrow> \\<pi> j\\<close> by auto\n\n      thus \\<open>?thesis\\<close> using jpdn pd_trans by metis\n    qed\n  qed\nqed\n\n\nlemma first_pd_no_cd: assumes path: \\<open>is_path \\<pi>\\<close> and pd: \\<open>\\<pi> n pd\\<rightarrow> \\<pi> 0\\<close> and first: \\<open>\\<forall> l < n. \\<pi> l \\<noteq> \\<pi> n\\<close> shows \\<open>\\<forall> l. \\<not> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> \nproof (rule ccontr, goal_cases)\n  case 1\n  then obtain l where ncdl: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> by blast\n  hence ln: \\<open>l < n\\<close> using is_cdi_def by auto\n  have \\<open>\\<not> \\<pi> n pd\\<rightarrow> \\<pi> l\\<close> using ncdl cd_not_pd by (metis ln first)\n  then obtain \\<pi>' n' where path': \\<open>is_path \\<pi>'\\<close> and \\<pi>0: \\<open>\\<pi>' 0 = \\<pi> l\\<close> and \\<pi>n: \\<open>\\<pi>' n' = return\\<close> and not\\<pi>n: \\<open>\\<forall> j\\<le> n'. \\<pi>' j \\<noteq> \\<pi> n\\<close> unfolding is_pd_def using path path_nodes by auto\n  let \\<open>?\\<pi>\\<close> = \\<open>\\<pi>@\\<^bsup>l\\<^esup> \\<pi>'\\<close>\n  \n  have \\<open>is_path ?\\<pi>\\<close> by (metis \\<pi>0 path path' path_cons)\n  moreover\n  have \\<open>?\\<pi> 0 = \\<pi> 0\\<close> by auto\n  moreover\n  have \\<open>?\\<pi> (n' + l) = return\\<close> using \\<pi>0 \\<pi>n by auto\n  ultimately\n  obtain j where j: \\<open>j \\<le> n' + l\\<close> and jn: \\<open>?\\<pi> j = \\<pi> n\\<close> using pd unfolding is_pd_def by blast\n  show \\<open>False\\<close> proof cases\n    assume \\<open>j \\<le> l\\<close> thus \\<open>False\\<close> using jn first ln by auto\n  next\n    assume \\<open>\\<not> j \\<le> l\\<close> thus \\<open>False\\<close> using j jn not\\<pi>n by auto\n  qed\nqed\n\nlemma first_pd_no_icd: assumes path: \\<open>is_path \\<pi>\\<close> and pd: \\<open>\\<pi> n pd\\<rightarrow> \\<pi> 0\\<close> and first: \\<open>\\<forall> l < n. \\<pi> l \\<noteq> \\<pi> n\\<close> shows \\<open>\\<forall> l. \\<not> n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close>\n  by (metis first first_pd_no_cd icd_imp_cd path pd)\n\nlemma path_nret_ex_nipd: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<forall> i. \\<pi> i \\<noteq> return\\<close> shows \\<open>\\<forall> i. (\\<exists> j\\<ge>i. (\\<forall> k>j. \\<pi> k \\<noteq> ipd (\\<pi> j)))\\<close> proof(rule, rule ccontr)\n  fix i\n  assume \\<open>\\<not> (\\<exists>j\\<ge>i. \\<forall> k>j. \\<pi> k \\<noteq> ipd (\\<pi> j))\\<close>\n  hence *: \\<open>\\<forall> j\\<ge>i. (\\<exists>k>j. \\<pi> k = ipd (\\<pi> j))\\<close> by blast\n  have \\<open>\\<forall> j. (\\<exists>k>j. (\\<pi>\\<guillemotleft>i) k = ipd ((\\<pi>\\<guillemotleft>i) j))\\<close> proof\n    fix j\n    have \\<open>i + j \\<ge> i\\<close> by auto\n    then obtain k where k: \\<open>k>i+j\\<close> \\<open>\\<pi> k = ipd (\\<pi> (i+j))\\<close> using * by blast\n    hence \\<open>(\\<pi>\\<guillemotleft>i) (k - i) = ipd ((\\<pi>\\<guillemotleft>i) j)\\<close> by auto\n    moreover  \n    have \\<open>k - i > j\\<close> using k by auto\n    ultimately\n    show \\<open>\\<exists>k>j. (\\<pi>\\<guillemotleft>i) k = ipd ((\\<pi>\\<guillemotleft>i) j)\\<close> by auto\n  qed\n  moreover\n  have \\<open>is_path (\\<pi>\\<guillemotleft>i)\\<close> using assms(1) path_path_shift by simp\n  ultimately\n  obtain k where \\<open>(\\<pi>\\<guillemotleft>i) k = return\\<close> using all_ipd_imp_ret by blast\n  thus \\<open>False\\<close> using assms(2) by auto\nqed\n\nlemma path_nret_ex_all_cd: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<forall> i. \\<pi> i \\<noteq> return\\<close> shows \\<open>\\<forall> i. (\\<exists> j\\<ge>i. (\\<forall> k>j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j))\\<close>\nunfolding is_cdi_def using assms path_nret_ex_nipd[OF assms] by (metis atLeastAtMost_iff ipd_not_self linorder_neqE_nat not_le path_nodes)\n\n\nlemma path_nret_inf_all_cd: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<forall> i. \\<pi> i \\<noteq> return\\<close> shows \\<open>\\<not> finite {j. \\<forall> k>j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j}\\<close> \nusing unbounded_nat_set_infinite path_nret_ex_all_cd[OF assms] by auto\n\nlemma path_nret_inf_icd_seq: assumes path: \\<open>is_path \\<pi>\\<close> and nret: \\<open>\\<forall> i. \\<pi> i \\<noteq> return\\<close> \nobtains f where \\<open>\\<forall> i. f (Suc i) icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f i\\<close> \\<open>range f = {i. \\<forall> j>i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}\\<close> \\<open>\\<not> (\\<exists>i. f 0 cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i)\\<close>\nproof -\n  note path_nret_inf_all_cd[OF assms]\n  then obtain f where ran: \\<open>range f = {j. \\<forall> k>j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j}\\<close> and asc: \\<open>\\<forall> i. f i < f (Suc i)\\<close> using infinite_ascending by blast\n  have mono: \\<open>\\<forall> i j. i < j \\<longrightarrow> f i < f j\\<close> using asc by (metis lift_Suc_mono_less)\n  {\n    fix i\n    have cd: \\<open>f (Suc i) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f i\\<close> using ran asc by auto\n    have \\<open>f (Suc i) icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f i\\<close> proof (rule ccontr)\n      assume \\<open>\\<not> f (Suc i) icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f i\\<close>\n      then obtain m where  im: \\<open>f i < m\\<close> and mi: \\<open> m < f (Suc i)\\<close> and cdm: \\<open>f (Suc i) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> unfolding is_icdi_def using assms(1) cd by auto\n      have \\<open>\\<forall> k>m. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>m\\<close> proof (rule,rule,cases)\n        fix k assume \\<open>f (Suc i) < k\\<close>\n        hence \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f (Suc i)\\<close> using ran by auto\n        thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cdm cd_trans by metis\n      next\n        fix k assume mk: \\<open>m < k\\<close> and \\<open>\\<not> f (Suc i) < k\\<close>\n        hence ik: \\<open>k \\<le> f (Suc i)\\<close> by simp\n        thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cdm by (metis cdi_prefix mk)\n      qed\n      hence \\<open>m \\<in> range f\\<close> using ran by blast\n      then obtain j where m: \\<open>m = f j\\<close> by blast\n      show \\<open>False\\<close> using im mi mono unfolding m by (metis Suc_lessI le_less not_le)\n    qed\n  }\n  moreover  \n  {\n    fix m\n    assume cdm: \\<open>f 0 cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close>\n    have \\<open>\\<forall> k>m. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>m\\<close> proof (rule,rule,cases)\n      fix k assume \\<open>f 0 < k\\<close>\n      hence \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> f 0\\<close> using ran by auto\n      thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cdm cd_trans by metis\n    next\n      fix k assume mk: \\<open>m < k\\<close> and \\<open>\\<not> f 0 < k\\<close>\n      hence ik: \\<open>k \\<le> f 0\\<close> by simp\n      thus \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cdm by (metis cdi_prefix mk)\n    qed\n    hence \\<open>m \\<in> range f\\<close> using ran by blast\n    then obtain j where m: \\<open>m = f j\\<close> by blast\n    hence fj0: \\<open>f j < f 0\\<close>  using cdm m is_cdi_def by auto\n    hence \\<open>0 < j\\<close> by (metis less_irrefl neq0_conv)\n    hence \\<open>False\\<close> using fj0 mono by fastforce\n  }\n  ultimately show \\<open>thesis\\<close> using that ran by blast\nqed\n\nlemma cdi_iff_no_strict_pd: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<longleftrightarrow> is_path \\<pi> \\<and> k < i \\<and> \\<pi> i \\<noteq> return \\<and> (\\<forall> j \\<in> {k..i}. \\<not> (\\<pi> k, \\<pi> j) \\<in> pdt)\\<close>\nproof\n  assume cd:\\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  have 1: \\<open>is_path \\<pi> \\<and> k < i \\<and> \\<pi> i \\<noteq> return\\<close> using cd unfolding is_cdi_def by auto\n  have 2: \\<open>\\<forall> j \\<in> {k..i}. \\<not> (\\<pi> k, \\<pi> j) \\<in> pdt\\<close> proof (rule ccontr)\n    assume \\<open> \\<not> (\\<forall>j\\<in>{k..i}. (\\<pi> k, \\<pi> j) \\<notin> pdt)\\<close>\n    then obtain j where \\<open>j \\<in> {k..i}\\<close> and \\<open>(\\<pi> k, \\<pi> j) \\<in> pdt\\<close> by auto\n    hence \\<open>\\<pi> j \\<noteq> \\<pi> k\\<close> and \\<open>\\<pi> j pd\\<rightarrow> \\<pi> k\\<close> unfolding pdt_def by auto\n    thus \\<open>False\\<close> using path_pd_ipd by (metis \\<open>j \\<in> {k..i}\\<close> atLeastAtMost_iff cd cd_not_pd cdi_prefix le_eq_less_or_eq) \n  qed\n  show \\<open>is_path \\<pi> \\<and> k < i \\<and> \\<pi> i \\<noteq> return \\<and> (\\<forall> j \\<in> {k..i}. \\<not> (\\<pi> k, \\<pi> j) \\<in> pdt)\\<close> using 1 2 by simp\nnext\n  assume \\<open>is_path \\<pi> \\<and> k < i \\<and> \\<pi> i \\<noteq> return \\<and> (\\<forall> j \\<in> {k..i}. \\<not> (\\<pi> k, \\<pi> j) \\<in> pdt)\\<close>\n  thus \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis ipd_in_pdt term_path_stable less_or_eq_imp_le not_cd_impl_ipd path_nodes)\nqed\n\n\nsubsection \\<open>Facts about Control Slices\\<close>\n\nlemma last_cs: \\<open>last (cs\\<^bsup>\\<pi>\\<^esup> i) = \\<pi> i\\<close> by auto\n\nlemma cs_not_nil: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n \\<noteq> []\\<close> by (auto)\n\nlemma cs_return: assumes \\<open>\\<pi> n = return\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = [\\<pi> n]\\<close> by (metis assms cs.elims icd_imp_cd ret_no_cd)\n\nlemma cs_0[simp]: \\<open>cs\\<^bsup>\\<pi>\\<^esup> 0 = [\\<pi> 0]\\<close> using is_icdi_def is_cdi_def by auto\n\nlemma cs_inj: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> n \\<noteq> return\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>\\<^esup> n'\\<close> shows \\<open>n = n'\\<close> \nusing assms proof (induction \\<open>cs\\<^bsup>\\<pi>\\<^esup> n\\<close> arbitrary: \\<open>\\<pi>\\<close> \\<open>n\\<close> \\<open>n'\\<close> rule:rev_induct)\n  case Nil hence \\<open>False\\<close> using cs_not_nil by metis thus \\<open>?case\\<close> by simp\nnext\n  case (snoc x xs \\<pi> n n') show \\<open>?case\\<close> proof (cases \\<open>xs\\<close>)\n  case Nil \n  hence *: \\<open>\\<not> (\\<exists> k. n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k)\\<close> using snoc(2) cs_not_nil \n    by (auto,metis append1_eq_conv append_Nil cs_not_nil)\n  moreover\n  have \\<open>[x] = cs\\<^bsup>\\<pi>\\<^esup> n'\\<close> using Nil snoc by auto\n  hence **: \\<open>\\<not> (\\<exists> k. n' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k)\\<close> using cs_not_nil\n    by (auto,metis append1_eq_conv append_Nil cs_not_nil)\n  ultimately\n  have \\<open>\\<forall> k. \\<not> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<forall> k. \\<not> n' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using excd_impl_exicd by auto blast+\n  moreover \n  hence  \\<open>\\<pi> n = \\<pi> n'\\<close> using snoc(5,2) by auto (metis * ** list.inject)\n  ultimately\n  show \\<open>n = n'\\<close> using other_claim' snoc by blast\nnext\n  case (Cons y ys)\n  hence *: \\<open>\\<exists> k. n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> using snoc(2) by auto (metis append_is_Nil_conv list.distinct(1) list.inject)\n  then obtain k where k: \\<open>n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> by auto\n  have \\<open>k = (THE k . n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> using k by (metis icd_is_the_icd)\n  hence xsk: \\<open>xs = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using * k snoc(2) unfolding cs.simps[of \\<open>\\<pi>\\<close> \\<open>n\\<close>] by auto\n  have **: \\<open>\\<exists> k. n' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> using snoc(2)[unfolded snoc(5)] by auto (metis Cons append1_eq_conv append_Nil list.distinct(1))\n  then obtain k' where k': \\<open>n' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k'\\<close> by auto\n  hence \\<open>k' = (THE k . n' icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> using k' by (metis icd_is_the_icd)\n  hence xsk': \\<open>xs = cs\\<^bsup>\\<pi>\\<^esup> k'\\<close> using ** k' snoc(5,2) unfolding cs.simps[of \\<open>\\<pi>\\<close> \\<open>n'\\<close>] by auto\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>\\<^esup> k'\\<close> using xsk by simp\n  moreover\n  have kn: \\<open>k < n\\<close> using k by (metis is_icdi_def is_cdi_def)\n  hence \\<open>\\<pi> k \\<noteq> return\\<close> using snoc by (metis term_path_stable less_imp_le)\n  ultimately\n  have kk'[simp]: \\<open>k' = k\\<close> using snoc(1) xsk snoc(3) by metis\n  have nk0: \\<open>n - k icd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> 0\\<close> \\<open>n' - k icd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> 0\\<close> using k k' icd_path_shift0 snoc(3) by auto\n  moreover \n  have nkr: \\<open>(\\<pi>\\<guillemotleft>k)(n-k) \\<noteq> return\\<close> using snoc(4) kn by auto\n  moreover \n  have \\<open>is_path (\\<pi>\\<guillemotleft>k)\\<close> by (metis path_path_shift snoc.prems(1))\n  moreover \n  have kn': \\<open>k < n'\\<close> using k' kk' by (metis is_icdi_def is_cdi_def)\n  have \\<open>\\<pi> n = \\<pi> n'\\<close> using snoc(5) * ** by auto\n  hence \\<open>(\\<pi>\\<guillemotleft>k)(n-k) = (\\<pi>\\<guillemotleft>k)(n'-k)\\<close> using kn kn' by auto \n  ultimately  \n  have \\<open>n - k = n' - k\\<close> using other_claim  by auto\n  thus \\<open>n = n'\\<close> using kn kn' by auto\nqed\nqed\n\nlemma cs_cases: fixes \\<pi> i \nobtains (base) \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = [\\<pi> i]\\<close> and \\<open>\\<forall> k. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> | \n(depend) k where  \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> k)@[\\<pi> i]\\<close> and \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \nproof cases\n  assume *: \\<open>\\<exists> k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  then obtain k where k: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> ..\n  hence \\<open>k = (THE k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close>  by (metis icd_is_the_icd)\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> k)@[\\<pi> i]\\<close> using * by auto\n  with k that show \\<open>thesis\\<close> by simp\nnext\n  assume *: \\<open>\\<not> (\\<exists> k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close>\n  hence \\<open>\\<forall> k. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> by (metis excd_impl_exicd)\n  moreover \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = [\\<pi> i]\\<close> using * by auto\n  ultimately\n  show \\<open>thesis\\<close> using that by simp\nqed\n\nlemma cs_length_one: assumes \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) = 1\\<close> shows  \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = [\\<pi> i]\\<close> and \\<open>\\<forall> k. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  apply (cases \\<open>i\\<close> \\<open>\\<pi>\\<close> rule: cs_cases)\n  using assms cs_not_nil \n    apply auto \n  apply (cases \\<open>i\\<close> \\<open>\\<pi>\\<close> rule: cs_cases) \n  using assms cs_not_nil \n  by auto\n\nlemma cs_length_g_one: assumes \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) \\<noteq> 1\\<close> obtains k where  \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> k)@[\\<pi> i]\\<close> and \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \n  apply (cases \\<open>i\\<close> \\<open>\\<pi>\\<close> rule: cs_cases) \n  using assms cs_not_nil by auto\n\nlemma claim: assumes  path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and  ii: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> and jj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> \nand bl: \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> i) = butlast (cs\\<^bsup>\\<pi>\\<^esup> j)\\<close> and nret: \\<open>\\<pi> i \\<noteq> return\\<close> and ilj: \\<open>i < j\\<close> \nshows \\<open>i' < j'\\<close>\nproof (cases )\n  assume *: \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) = 1\\<close>\n  hence **: \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) = 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> j) = 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>'\\<^esup> i') = 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>'\\<^esup> j') = 1\\<close>  \n    apply metis\n    apply (metis \"*\" bl butlast.simps(2) butlast_snoc cs_length_g_one cs_length_one(1) cs_not_nil) \n    apply (metis \"*\" ii)\n    by (metis \"*\" bl butlast.simps(2) butlast_snoc cs_length_g_one cs_length_one(1) cs_not_nil jj)\n  then obtain \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = [\\<pi> i]\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = [\\<pi> j]\\<close> \\<open>cs\\<^bsup>\\<pi>'\\<^esup> j' = [\\<pi>' j']\\<close> \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i'= [\\<pi>' i']\\<close> \n    \\<open>\\<forall> k. \\<not> j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<forall> k. \\<not> i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<forall> k. \\<not> j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k\\<close>\n  by (metis cs_length_one ** )\n  moreover \n  hence \\<open>\\<pi> i = \\<pi>' i'\\<close> \\<open>\\<pi> j = \\<pi>' j'\\<close> using  assms by auto\n  ultimately\n  show \\<open>i' < j'\\<close> using nret ilj path claim'' by blast\nnext\n  assume *: \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) \\<noteq> 1\\<close>\n  hence **: \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) \\<noteq> 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> j) \\<noteq> 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>'\\<^esup> i') \\<noteq> 1\\<close> \\<open>length (cs\\<^bsup>\\<pi>'\\<^esup> j') \\<noteq> 1\\<close>  \n    apply metis\n    apply (metis \"*\" bl butlast.simps(2) butlast_snoc cs_length_g_one cs_length_one(1) cs_not_nil)\n    apply (metis \"*\" ii)\n    by (metis \"*\" bl butlast.simps(2) butlast_snoc cs_length_g_one cs_length_one(1) cs_not_nil jj)\n  obtain k l k' l' where ***:\n    \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> k)@[\\<pi> i]\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = (cs\\<^bsup>\\<pi>\\<^esup> l)@[\\<pi> j]\\<close>  \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' = (cs\\<^bsup>\\<pi>'\\<^esup> k')@[\\<pi>' i']\\<close> \\<open>cs\\<^bsup>\\<pi>'\\<^esup> j' = (cs\\<^bsup>\\<pi>'\\<^esup> l')@[\\<pi>' j']\\<close> and\n    icds: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>j icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> \\<open>i' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> \\<open>j' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> l'\\<close>\n    by (metis ** cs_length_g_one)\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>\\<^esup> l\\<close> \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> using assms by auto\n  moreover\n  have \\<open>\\<pi> k \\<noteq> return\\<close> \\<open>\\<pi>' k' \\<noteq> return\\<close> using nret \n    apply (metis is_icdi_def icds(1) is_cdi_def term_path_stable less_imp_le) \n    by (metis is_cdi_def is_icdi_def icds(3) term_path_stable less_imp_le)\n  ultimately  \n  have lk[simp]: \\<open>l = k\\<close> \\<open>l' = k'\\<close> using path cs_inj by auto\n  let \\<open>?\\<pi>\\<close> = \\<open>\\<pi> \\<guillemotleft> k\\<close> \n  let \\<open>?\\<pi>'\\<close> = \\<open>\\<pi>'\\<guillemotleft>k'\\<close>\n  have \\<open>i-k icd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow> 0\\<close> \\<open>j-k icd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow> 0\\<close> \\<open>i'-k' icd\\<^bsup>?\\<pi>'\\<^esup>\\<rightarrow> 0\\<close> \\<open>j'-k' icd\\<^bsup>?\\<pi>'\\<^esup>\\<rightarrow> 0\\<close> using icd_path_shift0 path icds by auto\n  moreover\n  have ki: \\<open>k < i\\<close> using icds by (metis is_icdi_def is_cdi_def)\n  hence \\<open>i-k < j-k\\<close> by (metis diff_is_0_eq diff_less_mono ilj nat_le_linear order.strict_trans)\n  moreover\n  have \\<pi>i: \\<open>\\<pi> i = \\<pi>' i'\\<close> \\<open>\\<pi> j = \\<pi>' j'\\<close> using assms *** by auto\n  have \\<open>k' < i'\\<close> \\<open>k' < j'\\<close> using icds unfolding lk by (metis is_cdi_def is_icdi_def)+ \n  hence \\<open>?\\<pi> (i-k) = ?\\<pi>' (i'-k')\\<close> \\<open>?\\<pi> (j-k) = ?\\<pi>' (j'-k')\\<close> using \\<pi>i ki ilj by auto\n  moreover \n  have \\<open>?\\<pi> (i-k) \\<noteq> return\\<close> using nret ki by auto\n  moreover\n  have \\<open>is_path ?\\<pi>\\<close> \\<open>is_path ?\\<pi>'\\<close> using path path_path_shift by auto\n  ultimately\n  have \\<open>i'-k' < j' - k'\\<close> using claim' by blast\n  thus \\<open>i' < j'\\<close> by (metis diff_is_0_eq diff_less_mono less_nat_zero_code linorder_neqE_nat nat_le_linear)\nqed\n\nlemma cs_split': assumes \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs@[x,x']@ys\\<close>  shows \\<open>\\<exists> m. cs\\<^bsup>\\<pi>\\<^esup> m = xs@[x] \\<and> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> \nusing assms proof (induction \\<open>ys\\<close> arbitrary: \\<open>i\\<close> rule:rev_induct ) \n  case (snoc y ys)\n  hence \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) \\<noteq> 1\\<close> by auto\n  then obtain i' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> i') @ [\\<pi> i]\\<close> and *: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i'\\<close> using cs_length_g_one[of \\<open>\\<pi>\\<close> \\<open>i\\<close>] by metis\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> i' = xs@[x,x']@ys\\<close> using snoc(2) by (metis append1_eq_conv append_assoc)\n  then obtain m where **: \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = xs @ [x]\\<close> and \\<open>i' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using snoc(1) by blast\n  hence \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using * cd_trans by (metis is_icdi_def)\n  with ** show \\<open>?case\\<close> by blast\nnext\n  case Nil\n  hence \\<open>length (cs\\<^bsup>\\<pi>\\<^esup> i) \\<noteq> 1\\<close> by auto\n  then obtain i' where a: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (cs\\<^bsup>\\<pi>\\<^esup> i') @ [\\<pi> i]\\<close> and *: \\<open>i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i'\\<close> using cs_length_g_one[of \\<open>\\<pi>\\<close> \\<open>i\\<close>] by metis\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = (xs@[x])@[x']\\<close> using Nil by auto\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> i' = xs@[x]\\<close> using append1_eq_conv a by metis  \n  thus \\<open>?case\\<close> using * unfolding is_icdi_def by blast\nqed\n\nlemma cs_split: assumes \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs@[x]@ys@[\\<pi> i]\\<close>  shows \\<open>\\<exists> m. cs\\<^bsup>\\<pi>\\<^esup> m = xs@[x] \\<and> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> proof -\n  obtain x' ys' where \\<open>ys@[\\<pi> i] = [x']@ys'\\<close> by (metis append_Cons append_Nil neq_Nil_conv)\n  thus \\<open>?thesis\\<close> using cs_split'[of \\<open>\\<pi>\\<close> \\<open>i\\<close> \\<open>xs\\<close> \\<open>x\\<close> \\<open>x'\\<close> \\<open>ys'\\<close>] assms by auto\nqed\n\nlemma cs_less_split: assumes \\<open>xs \\<prec> ys\\<close> obtains a as where \\<open>ys = xs@a#as\\<close>\n  using assms unfolding cs_less.simps apply auto\nby (metis Cons_nth_drop_Suc append_take_drop_id)\n\nlemma cs_select_is_cs: assumes \\<open>is_path \\<pi>\\<close> \\<open>xs \\<noteq> Nil\\<close> \\<open>xs \\<prec> cs\\<^bsup>\\<pi>\\<^esup> k\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> (\\<pi>\\<exclamdown>xs) = xs\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> (\\<pi>\\<exclamdown>xs)\\<close>proof -\n  obtain b bs where b: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = xs@b#bs\\<close> using assms cs_less_split by blast\n  obtain a as where a: \\<open>xs = as@[a]\\<close> using assms by (metis rev_exhaust)\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = as@[a,b]@bs\\<close> using a b by auto\n  then obtain k' where csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k' = xs\\<close> and is_cd: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k'\\<close> using cs_split' a by blast\n  hence nret: \\<open>\\<pi> k' \\<noteq> return\\<close> by (metis is_cdi_def term_path_stable less_imp_le)\n  show a: \\<open>cs\\<^bsup>\\<pi>\\<^esup> (\\<pi>\\<exclamdown>xs) = xs\\<close> unfolding cs_select_def using cs_inj[OF assms(1) nret] csk the_equality[of _ \\<open>k'\\<close>]\n    by (metis (mono_tags))\n  show \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> (\\<pi>\\<exclamdown>xs)\\<close> unfolding cs_select_def by (metis a assms(1) cs_inj cs_select_def csk is_cd nret)\nqed\n\nlemma cd_in_cs: assumes \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> shows \\<open>\\<exists> ns. cs\\<^bsup>\\<pi>\\<^esup> n = (cs\\<^bsup>\\<pi>\\<^esup> m) @ ns @[\\<pi> n]\\<close> \nusing assms proof (induction rule: cd_induct)\n  case (base  n) thus \\<open>?case\\<close> by (metis append_Nil cs.simps icd_is_the_icd)\nnext\n  case (IS k n)\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>\\<^esup> k @ [\\<pi> n]\\<close> by (metis cs.simps icd_is_the_icd)  \n  thus \\<open>?case\\<close> using IS by force\nqed\n\nlemma butlast_cs_not_cd: assumes \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> m) = butlast (cs\\<^bsup>\\<pi>\\<^esup> n)\\<close> shows \\<open>\\<not> m cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>n\\<close>\nby (metis append_Cons append_Nil append_assoc assms cd_in_cs cs_not_nil list.distinct(1) self_append_conv snoc_eq_iff_butlast)\n\nlemma wn_cs_butlast: assumes \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> m) = butlast (cs\\<^bsup>\\<pi>\\<^esup> n)\\<close> \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> \\<open>m<n\\<close> shows \\<open>i<j\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> i < j\\<close>\n  moreover\n  have \\<open>\\<not> n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> by (metis assms(1) butlast_cs_not_cd)\n  ultimately\n  have \\<open>n \\<le> m\\<close> using assms(2,3) cr_wn'' by auto\n  thus \\<open>False\\<close> using assms(4) by auto\nqed\n\n\ntext \\<open>This is the central theorem making the control slice suitable for matching indices between executions.\\<close>\n\ntheorem cs_order: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> \nand csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> and nret: \\<open>\\<pi> i \\<noteq> return\\<close> and ilj: \\<open>i < j\\<close>   \nshows \\<open>i'<j'\\<close>\nproof -\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>\\<^esup> j\\<close> using cs_inj[OF path(1) nret] ilj by blast\n  moreover \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> Nil\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j \\<noteq> Nil\\<close> by (metis cs_not_nil)+\n  ultimately show \\<open>?thesis\\<close> proof (cases rule: list_neq_prefix_cases)\n    case (diverge xs x x' ys ys')\n    note csx = \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs @ [x] @ ys\\<close>\n    note csx' = \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = xs @ [x'] @ ys'\\<close>\n    note xx = \\<open>x \\<noteq> x'\\<close>\n    show \\<open>i' < j'\\<close> proof (cases \\<open>ys\\<close>) \n      assume ys: \\<open>ys = Nil\\<close>\n      show \\<open>?thesis\\<close> proof (cases \\<open>ys'\\<close>)\n        assume ys': \\<open>ys' = Nil\\<close>\n        have cs: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs @ [x]\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = xs @ [x']\\<close> by (metis append_Nil2 csx ys, metis append_Nil2 csx' ys')\n        hence bl: \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> i) = butlast (cs\\<^bsup>\\<pi>\\<^esup> j)\\<close> by auto        \n        show \\<open>i' < j'\\<close> using claim[OF path csi csj bl nret ilj] .\n      next\n        fix y' zs'\n        assume ys': \\<open>ys' = y'#zs'\\<close>\n        have cs: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs @ [x]\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = xs @ [x',y']@ zs'\\<close> by (metis append_Nil2 csx ys, metis append_Cons append_Nil csx' ys')         \n        obtain n where n: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = xs@[x']\\<close> and jn: \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> using cs cs_split' by blast\n        obtain n' where n': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n' = xs@[x']\\<close> and jn': \\<open>j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> using cs cs_split' unfolding csj by blast\n        have csn : \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and bl: \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> i) = butlast (cs\\<^bsup>\\<pi>\\<^esup> n)\\<close> using n n' cs by auto\n        hence bl': \\<open>butlast (cs\\<^bsup>\\<pi>'\\<^esup> i') = butlast (cs\\<^bsup>\\<pi>'\\<^esup> n')\\<close> using csi by auto\n        have notcd: \\<open>\\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> by (metis butlast_cs_not_cd bl)\n        have nin: \\<open>i \\<noteq> n\\<close> using cs n xx by auto\n        have iln: \\<open>i < n\\<close> apply (rule ccontr) using cr_wn'[OF jn notcd] nin ilj by auto\n        note claim[OF path csi csn bl nret iln]\n        hence \\<open>i' < n'\\<close> .\n        thus \\<open>i' < j'\\<close> using jn' unfolding is_cdi_def by auto\n      qed\n    next\n      fix y zs\n      assume ys: \\<open>ys = y#zs\\<close>\n      show \\<open>?thesis\\<close> proof (cases \\<open>ys'\\<close>)\n        assume ys' : \\<open>ys' = Nil\\<close>\n        have cs: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs @ [x,y]@zs\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = xs @ [x']\\<close> by (metis append_Cons append_Nil csx ys, metis append_Nil2 csx' ys')\n        obtain n where n: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = xs@[x]\\<close> and jn: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> using cs cs_split' by blast\n        obtain n' where n': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n' = xs@[x]\\<close> and jn': \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> using cs cs_split' unfolding csi by blast\n        have csn : \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and bl: \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> n) = butlast (cs\\<^bsup>\\<pi>\\<^esup> j)\\<close> using n n' cs by auto\n        hence bl': \\<open>butlast (cs\\<^bsup>\\<pi>'\\<^esup> j') = butlast (cs\\<^bsup>\\<pi>'\\<^esup> n')\\<close> using csj by auto\n        have notcd: \\<open>\\<not> j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> by (metis butlast_cs_not_cd bl')\n        have nin: \\<open>n < i\\<close> using jn unfolding is_cdi_def by auto\n        have nlj: \\<open>n < j\\<close> using nin ilj by auto\n        note claim[OF path csn csj bl _ nlj]\n        hence nj': \\<open>n' < j'\\<close> using term_path_stable[OF path(1) _] less_imp_le nin nret by auto\n        show \\<open>i' < j'\\<close> apply(rule ccontr) using cdi_prefix[OF jn' nj'] notcd by auto\n      next\n        fix y' zs'\n        assume ys' : \\<open>ys' = y'#zs'\\<close>\n        have cs: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = xs@[x,y]@zs\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = xs@[x',y']@zs'\\<close> by (metis append_Cons append_Nil csx ys,metis append_Cons append_Nil csx' ys')\n        have neq: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>\\<^esup> j\\<close> using cs_inj path nret ilj by blast\n        obtain m where m: \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = xs@[x]\\<close> and im: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cs cs_split' by blast\n        obtain n where n: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = xs@[x']\\<close> and jn: \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> using cs cs_split' by blast\n        obtain m' where m': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> m' = xs@[x]\\<close> and im': \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m'\\<close> using cs cs_split' unfolding csi by blast\n        obtain n' where n': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n' = xs@[x']\\<close> and jn': \\<open>j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> using cs cs_split' unfolding csj by blast\n        have \\<open>m \\<le> n\\<close> using ilj m n wn_cs_butlast[OF _ jn im] by force\n        moreover\n        have \\<open>m \\<noteq> n\\<close> using m n xx by (metis last_snoc)\n        ultimately \n        have mn: \\<open>m < n\\<close> by auto\n        moreover \n        have \\<open>\\<pi> m \\<noteq> return\\<close> by (metis last_cs last_snoc m mn n path(1) term_path_stable xx less_imp_le)\n        moreover  \n        have \\<open>butlast (cs\\<^bsup>\\<pi>\\<^esup> m) = butlast (cs\\<^bsup>\\<pi>\\<^esup> n)\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> using m n n' m' by auto\n        ultimately\n        have \\<open>m' < n'\\<close> using claim path by blast\n        thus \\<open>i' < j'\\<close> using m' n' im' jn' wn_cs_butlast by (metis butlast_snoc)        \n      qed\n    qed\n  next\n    case (prefix1 xs)\n    note pfx = \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> j @ xs\\<close>\n    note xs = \\<open>xs \\<noteq> []\\<close>\n    obtain a as where \\<open>xs = a#as\\<close> using xs by (metis list.exhaust)\n    moreover\n    obtain bs b where bj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = bs@[b]\\<close> using cs_not_nil by (metis rev_exhaust)\n    ultimately\n    have \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = bs@[b,a]@as\\<close> using pfx by auto\n    then obtain m where \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = bs@[b]\\<close> and cdep:  \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> m\\<close> using cs_split' by blast\n    hence mi: \\<open>m = j\\<close> using bj cs_inj by (metis is_cdi_def term_path_stable less_imp_le)\n    hence \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using cdep by auto\n    hence \\<open>False\\<close> using ilj unfolding is_cdi_def by auto\n    thus \\<open>i' < j'\\<close> ..\n  next\n    case (prefix2 xs)\n    have pfx : \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' @ xs = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using prefix2 csi csj by auto\n    note xs = \\<open>xs \\<noteq> []\\<close>\n     obtain a as where \\<open>xs = a#as\\<close> using xs by (metis list.exhaust)\n    moreover\n    obtain bs b where bj: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i'  = bs@[b]\\<close> using cs_not_nil by (metis rev_exhaust)\n    ultimately\n    have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> j' = bs@[b,a]@as\\<close> using pfx by auto\n    then obtain m where \\<open>cs\\<^bsup>\\<pi>'\\<^esup> m = bs@[b]\\<close> and cdep:  \\<open>j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m\\<close> using cs_split' by blast\n    hence mi: \\<open>m = i'\\<close> using bj cs_inj by (metis is_cdi_def term_path_stable less_imp_le)\n    hence \\<open>j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'\\<close> using cdep by auto\n    thus \\<open>i' < j'\\<close> unfolding is_cdi_def by auto  \n  qed\nqed\n\nlemma cs_order_le: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> \nand csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> and nret: \\<open>\\<pi> i \\<noteq> return\\<close> and ilj: \\<open>i \\<le> j\\<close>   \nshows \\<open>i'\\<le>j'\\<close> proof cases\n  assume \\<open>i < j\\<close> with cs_order[OF assms(1,2,3,4,5)] show \\<open>?thesis\\<close> by simp\nnext\n  assume \\<open>\\<not> i < j\\<close>\n  hence \\<open>i = j\\<close> using ilj by simp\n  hence csij: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using csi csj by simp  \n  have nret': \\<open>\\<pi>' i' \\<noteq> return\\<close> using nret last_cs csi by metis\n  show \\<open>?thesis\\<close> using cs_inj[OF path(2) nret' csij] by simp\nqed\n\nlemmas cs_induct[case_names cs] = cs.induct\n\nlemma icdi_path_swap: assumes \\<open>is_path \\<pi>'\\<close> \\<open>j icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> \\<open>\\<pi> =\\<^bsub>j\\<^esub>  \\<pi>'\\<close> shows \\<open>j icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow>k\\<close> using assms unfolding eq_up_to_def is_icdi_def is_cdi_def by auto\n\nlemma icdi_path_swap_le: assumes \\<open>is_path \\<pi>'\\<close> \\<open>j icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>k\\<close> \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>'\\<close> \\<open>j \\<le> n\\<close> shows \\<open>j icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow>k\\<close> by (metis assms icdi_path_swap eq_up_to_le)\n\nlemma cs_path_swap: assumes \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi> =\\<^bsub>k\\<^esub> \\<pi>'\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k\\<close> using assms(1,3) proof (induction \\<open>\\<pi>\\<close> \\<open>k\\<close> rule:cs_induct,cases)\n  case (cs \\<pi> k)     \n  let \\<open>?l\\<close> = \\<open>(THE l. k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l)\\<close>\n  assume *: \\<open>\\<exists>l. k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close>\n  have kicd: \\<open>k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?l\\<close> by (metis \"*\" icd_is_the_icd)\n  hence \\<open>?l < k\\<close> unfolding is_cdi_def[of \\<open>k\\<close> \\<open>\\<pi>\\<close> \\<open>?l\\<close>] is_icdi_def[of \\<open>k\\<close> \\<open>\\<pi>\\<close> \\<open>?l\\<close>] by auto\n  hence \\<open>\\<forall> i\\<le>?l. \\<pi> i = \\<pi>' i\\<close> using cs(2,3) unfolding eq_up_to_def by auto\n  hence csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?l = cs\\<^bsup>\\<pi>'\\<^esup> ?l\\<close> using cs(1,2) * unfolding eq_up_to_def by auto \n  have kicd: \\<open>k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?l\\<close> by (metis \"*\" icd_is_the_icd)\n  hence csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>\\<^esup> ?l @ [\\<pi> k]\\<close> using kicd by auto\n  have kicd': \\<open>k icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> ?l\\<close> using kicd icdi_path_swap[OF assms(2) _ cs(3)] by simp\n  hence \\<open>?l = (THE l. k icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> l)\\<close> by (metis icd_is_the_icd)\n  hence csk': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> ?l @ [\\<pi>' k]\\<close> using kicd' by auto\n  have \\<open>\\<pi>' k = \\<pi> k\\<close> using cs(3) unfolding eq_up_to_def by auto\n  with csl csk csk'  \n  show \\<open>?case\\<close> by auto\nnext\n  case (cs \\<pi> k)\n  assume *: \\<open>\\<not> (\\<exists>l. k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l)\\<close>\n  hence csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = [\\<pi> k]\\<close> by auto\n  have \\<open>\\<not> (\\<exists>l. k icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> l)\\<close> apply (rule ccontr) using * icdi_path_swap_le[OF cs(2) _, of \\<open>k\\<close> \\<open>\\<pi>'\\<close>] cs(3) by (metis eq_up_to_sym le_refl)\n  hence csk': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k = [\\<pi>' k]\\<close> by auto\n  with csk show \\<open>?case\\<close> using cs(3) eq_up_to_apply by auto\nqed\n\nlemma cs_path_swap_le: assumes \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>'\\<close> \\<open>k \\<le> n\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k\\<close> by (metis assms cs_path_swap eq_up_to_le)\n\nlemma cs_path_swap_cd: assumes \\<open>is_path \\<pi>\\<close> and \\<open>is_path \\<pi>'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \nobtains k' where \\<open>n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close>\nproof -\n  from cd_in_cs[OF assms(4)]\n  obtain ns where *: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>\\<^esup> k @ ns @ [\\<pi> n]\\<close> by blast\n  obtain xs x where csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = xs @ [x]\\<close> by (metis cs_not_nil rev_exhaust)\n  have \\<open>\\<pi> n = \\<pi>' n'\\<close> using assms(3) last_cs by metis\n  hence **: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n' = xs@[x]@ns@[\\<pi>' n']\\<close> using * assms(3) csk by auto\n  from cs_split[OF **]\n  obtain k' where \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k' = xs @ [x]\\<close> \\<open>n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> by blast\n  thus \\<open>thesis\\<close> using that csk by auto\nqed\n\nlemma path_ipd_swap: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> k \\<noteq> return\\<close> \\<open>k < n\\<close> \nobtains \\<pi>' m where \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>'\\<close> \\<open>k < m\\<close> \\<open>\\<pi>' m = ipd (\\<pi>' k)\\<close> \\<open>\\<forall> l \\<in> {k..<m}. \\<pi>' l \\<noteq> ipd (\\<pi>' k)\\<close>\nproof -\n  obtain \\<pi>' r where *: \\<open>\\<pi>' 0 = \\<pi> n\\<close> \\<open>is_path \\<pi>'\\<close> \\<open>\\<pi>' r = return\\<close> by (metis assms(1) path_nodes reaching_ret)\n  let \\<open>?\\<pi>\\<close> = \\<open>\\<pi>@\\<^bsup>n\\<^esup>  \\<pi>'\\<close>\n  have path: \\<open>is_path ?\\<pi>\\<close> and ret: \\<open>?\\<pi> (n + r) = return\\<close> and equpto:  \\<open>?\\<pi> =\\<^bsub>n\\<^esub>  \\<pi>\\<close> using assms path_cons * path_append_eq_up_to by auto\n  have \\<pi>k: \\<open>?\\<pi> k = \\<pi> k\\<close> by (metis assms(3) less_imp_le_nat path_append_def)\n  obtain j where j: \\<open>k < j \\<and> j \\<le> (n + r) \\<and> ?\\<pi> j = ipd (\\<pi> k)\\<close> (is \\<open>?P j\\<close> )by (metis \\<pi>k assms(2) path path_ret_ipd ret)\n  define m where m: \\<open>m \\<equiv> LEAST m . ?P m\\<close>\n  have Pm: \\<open>?P m\\<close> using LeastI[of \\<open>?P\\<close> \\<open>j\\<close>] j m by auto\n  hence km: \\<open>k < m\\<close> \\<open>m \\<le> (n + r)\\<close> \\<open>?\\<pi> m = ipd (\\<pi> k)\\<close> by auto\n  have le: \\<open>\\<And>l. ?P l \\<Longrightarrow> m \\<le> l\\<close> using Least_le[of \\<open>?P\\<close>] m by blast\n  have \\<pi>knipd: \\<open>?\\<pi> k \\<noteq> ipd (\\<pi> k)\\<close> by (metis \\<pi>k assms(1) assms(2) ipd_not_self path_nodes)\n  have nipd': \\<open>\\<And>l. k < l \\<Longrightarrow> l < m \\<Longrightarrow> ?\\<pi> l \\<noteq> ipd (\\<pi> k)\\<close> apply (rule ccontr) using le km(2) by force\n  have \\<open>\\<forall> l \\<in> {k..<m}. ?\\<pi> l \\<noteq> ipd(\\<pi> k)\\<close> using \\<pi>knipd nipd' by(auto, metis le_eq_less_or_eq,metis le_eq_less_or_eq)\n  thus \\<open>thesis\\<close> using that by (metis \\<pi>k eq_up_to_sym km(1) km(3) path path_append_eq_up_to)\nqed\n\nlemma cs_sorted_list_of_cd': \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = map \\<pi> (sorted_list_of_set { i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}) @ [\\<pi> k]\\<close> \nproof (induction \\<open>\\<pi>\\<close> \\<open>k\\<close> rule: cs.induct, cases)\n  case (1 \\<pi> k)\n  assume \\<open>\\<exists> j. k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close>\n  then obtain j where j: \"k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\" ..\n  hence csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = map \\<pi> (sorted_list_of_set {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}) @ [\\<pi> j]\\<close> by (metis \"1.IH\" icd_is_the_icd)\n  have \\<open>{i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = insert j {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}\\<close> using cdi_is_cd_icdi[OF j] by auto\n  moreover\n  have f: \\<open>finite {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}\\<close> unfolding is_cdi_def by auto\n  moreover\n  have \\<open>j \\<notin> {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}\\<close> unfolding is_cdi_def by auto\n  ultimately\n  have \\<open>sorted_list_of_set { i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = insort j (sorted_list_of_set { i . j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i})\\<close> using sorted_list_of_set_insert by auto\n  moreover\n  have \\<open>\\<forall> x \\<in>  {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}. x < j\\<close> unfolding is_cdi_def by auto\n  hence \\<open>\\<forall> x \\<in> set (sorted_list_of_set {i. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}). x < j\\<close> by (simp add: f) \n  ultimately\n  have \\<open>sorted_list_of_set { i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = (sorted_list_of_set { i . j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i})@[j]\\<close>  using insort_greater by auto\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = map \\<pi> (sorted_list_of_set { i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i})\\<close> using csj by auto\n  thus \\<open>?case\\<close> by (metis icd_cs j)\nnext\n  case (1 \\<pi> k)\n  assume *: \\<open>\\<not> (\\<exists> j. k icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j)\\<close>\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = [\\<pi> k]\\<close> by (metis cs_cases)\n  moreover \n  have \\<open>{ i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = {}\\<close> by (auto, metis * excd_impl_exicd)\n  ultimately \n  show \\<open>?case\\<close> by (metis append_Nil list.simps(8) sorted_list_of_set_empty)\nqed\n\nlemma cs_sorted_list_of_cd: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = map \\<pi> (sorted_list_of_set ({ i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k}))\\<close> proof -\n  have le: \\<open>\\<forall> x \\<in> {i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>i}.\\<forall> y \\<in> {k}. x < y\\<close> unfolding is_cdi_def by auto\n  have fin: \\<open>finite {i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>i}\\<close> \\<open>finite {k}\\<close> unfolding is_cdi_def by auto  \n  show \\<open>?thesis\\<close> unfolding cs_sorted_list_of_cd'[of \\<open>\\<pi>\\<close> \\<open>k\\<close>] sorted_list_of_set_append[OF fin le] by auto\nqed\n\nlemma cs_not_ipd: assumes \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k)\\<close> (is \\<open>?Q j\\<close>)\nshows \\<open>cs\\<^bsup>\\<pi>\\<^esup> (GREATEST j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k)) = [n\\<leftarrow>cs\\<^bsup>\\<pi>\\<^esup> k . ipd n \\<noteq> ipd (\\<pi> k)]\\<close>\n(is \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?j = filter ?P _\\<close>) \nproof -  \n  have csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = map \\<pi> (sorted_list_of_set ({ i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i } \\<union> {k}))\\<close> by (metis cs_sorted_list_of_cd)\n  have csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?j = map \\<pi> (sorted_list_of_set ({i. ?j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i } \\<union> {?j}))\\<close> by (metis cs_sorted_list_of_cd)\n  \n  have bound: \\<open>\\<forall> j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> ipd(\\<pi> k) \\<longrightarrow> j \\<le> k\\<close> unfolding is_cdi_def by simp\n    \n  have kcdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?j\\<close> and ipd': \\<open>ipd (\\<pi> ?j) \\<noteq> ipd(\\<pi> k)\\<close> using GreatestI_nat[of \\<open>?Q\\<close> \\<open>j\\<close> \\<open>k\\<close>, OF assms] bound by auto\n   \n  have greatest: \\<open>\\<And> j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<Longrightarrow> ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k) \\<Longrightarrow> j \\<le> ?j\\<close> using Greatest_le_nat[of \\<open>?Q\\<close>  _ \\<open>k\\<close>] bound by auto\n  have less_not_ipdk: \\<open>\\<And> j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<Longrightarrow> j < ?j \\<Longrightarrow> ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k)\\<close>   by (metis (lifting) ipd' kcdj same_ipd_stable)\n  hence le_not_ipdk: \\<open>\\<And> j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<Longrightarrow> j \\<le> ?j \\<Longrightarrow> ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k)\\<close> using kcdj ipd' by (case_tac \\<open>j = ?j\\<close>,auto)\n  have *: \\<open>{j \\<in> {i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>i} \\<union> {k}. ?P (\\<pi> j)} = insert ?j { i . ?j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<close> \n    apply auto  \n    apply (metis (lifting, no_types) greatest cr_wn'' kcdj le_antisym le_refl)\n    apply (metis kcdj)\n    apply (metis ipd')\n    apply (metis (full_types) cd_trans kcdj)\n    apply (subgoal_tac \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> x\\<close>)\n    apply (metis (lifting, no_types) is_cdi_def less_not_ipdk)\n    by (metis (full_types) cd_trans kcdj)\n  have \\<open>finite ({i . k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k})\\<close> unfolding is_cdi_def by auto\n  note filter_sorted_list_of_set[OF this, of \\<open>?P o \\<pi>\\<close>]\n  hence \\<open>[n\\<leftarrow>cs\\<^bsup>\\<pi>\\<^esup> k . ipd n \\<noteq> ipd(\\<pi> k)] = map \\<pi> (sorted_list_of_set {j \\<in> {i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>i} \\<union> {k}. ?P (\\<pi> j)})\\<close> unfolding csk filter_map by auto \n  also \n  have \\<open>\\<dots> =  map \\<pi> (sorted_list_of_set (insert ?j { i . ?j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}))\\<close> unfolding * by auto\n  also \n  have \\<open>\\<dots> = cs\\<^bsup>\\<pi>\\<^esup> ?j\\<close> using csj by auto\n  finally \n  show \\<open>?thesis\\<close> by metis\nqed\n\nlemma cs_ipd: assumes ipd: \\<open>\\<pi> m = ipd (\\<pi> k)\\<close> \\<open>\\<forall> n \\<in> {k..<m}. \\<pi> n \\<noteq> ipd (\\<pi> k)\\<close>\nand km: \\<open>k < m\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = [n\\<leftarrow>cs\\<^bsup>\\<pi>\\<^esup> k . ipd n \\<noteq> \\<pi> m] @ [\\<pi> m]\\<close>\nproof cases\n  assume \\<open>\\<exists> j. m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close>  \n  then obtain j where jicd: \\<open>m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> by blast\n  hence *: \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>\\<^esup> j @ [\\<pi> m]\\<close> by (metis icd_cs)\n  have j: \\<open>j = (GREATEST j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> ipd (\\<pi> j) \\<noteq> \\<pi> m)\\<close> using jicd assms ipd_icd_greatest_cd_not_ipd by blast\n  moreover\n  have \\<open>ipd (\\<pi> j) \\<noteq> ipd (\\<pi> k)\\<close> by (metis is_cdi_def is_icdi_def is_ipd_def cd_not_pd ipd(1) ipd_is_ipd jicd path_nodes less_imp_le term_path_stable)\n  moreover\n  have \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> unfolding j by (metis (lifting, no_types) assms(3) cd_ipd_is_cd icd_imp_cd ipd(1) ipd(2) j jicd)\n  ultimately\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = [n\\<leftarrow>cs\\<^bsup>\\<pi>\\<^esup> k . ipd n \\<noteq> \\<pi> m]\\<close> using cs_not_ipd[of \\<open>k\\<close> \\<open>\\<pi>\\<close> \\<open>j\\<close>] ipd(1) by metis\n  thus \\<open>?thesis\\<close> using * by metis\nnext\n  assume noicd: \\<open>\\<not> (\\<exists> j. m icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j)\\<close>  \n  hence csm: \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = [\\<pi> m]\\<close> by auto\n  have \\<open>\\<And>j. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow>j \\<Longrightarrow> ipd(\\<pi> j) = \\<pi> m\\<close> using cd_is_cd_ipd[OF km ipd] by (metis excd_impl_exicd noicd)\n  hence *: \\<open>{j \\<in> {i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k}. ipd (\\<pi> j) \\<noteq> \\<pi> m} = {}\\<close> using ipd(1) by auto\n  have **: \\<open>((\\<lambda>n. ipd n \\<noteq> \\<pi> m) o \\<pi>) = (\\<lambda>n. ipd (\\<pi> n) \\<noteq> \\<pi> m)\\<close> by auto\n  have fin: \\<open>finite ({i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k})\\<close> unfolding is_cdi_def by auto\n  note csk = cs_sorted_list_of_cd[of \\<open>\\<pi>\\<close> \\<open>k\\<close>]\n  hence \\<open>[n\\<leftarrow>cs\\<^bsup>\\<pi>\\<^esup> k . ipd n \\<noteq> \\<pi> m] = [n\\<leftarrow> (map \\<pi> (sorted_list_of_set ({i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k}))) . ipd n \\<noteq> \\<pi> m]\\<close> by simp\n  also\n  have \\<open>\\<dots> = map \\<pi> [n <- sorted_list_of_set ({i. k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {k}). ipd (\\<pi> n) \\<noteq> \\<pi> m]\\<close>  by (auto simp add: filter_map **) \n  also \n  have \\<open>\\<dots> = []\\<close> unfolding * filter_sorted_list_of_set[OF fin, of \\<open>\\<lambda>n. ipd (\\<pi> n) \\<noteq> \\<pi> m\\<close>] by auto\n  finally\n  show \\<open>?thesis\\<close> using csm by (metis append_Nil)\nqed\n\nlemma converged_ipd_same_icd: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and  converge: \\<open>l < m\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \nand csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and icd: \\<open>l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and suc: \\<open>\\<pi> (Suc k) = \\<pi>' (Suc k')\\<close>\nand ipd: \\<open>\\<pi>' m' = ipd (\\<pi> k)\\<close> \\<open>\\<forall> n \\<in> {k'..<m'}. \\<pi>' n \\<noteq> ipd (\\<pi> k)\\<close>\nshows \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\nproof cases\n  assume l: \\<open>l = Suc k\\<close>\n  hence \\<open>Suc k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using icd by (metis is_icdi_def)\n  hence \\<open>\\<pi> (Suc k) \\<noteq> ipd (\\<pi> k)\\<close> unfolding is_cdi_def by auto\n  hence \\<open>\\<pi>' (Suc k') \\<noteq> ipd (\\<pi>' k')\\<close> by (metis csk last_cs suc)\n  moreover \n  have \\<open>\\<pi>' (Suc k') \\<noteq> return\\<close> by (metis \\<open>Suc k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> ret_no_cd suc)\n  ultimately\n  have \\<open>Suc k' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> unfolding is_cdi_def using path(2) apply auto \n  by (metis ipd_not_self le_Suc_eq le_antisym path_nodes term_path_stable)\n  hence \\<open>Suc k' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> unfolding is_icdi_def using path(2) by fastforce  \n  hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (Suc k') = cs\\<^bsup>\\<pi>'\\<^esup> k' @[\\<pi>' (Suc k')]\\<close> using icd_cs by auto \n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>\\<^esup> k @ [\\<pi> l]\\<close> using icd icd_cs by auto\n  ultimately \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> (Suc k')\\<close> by (metis csk l suc)\n  thus \\<open>?thesis\\<close> by blast\nnext\n  assume nsuck: \\<open>l \\<noteq> Suc k\\<close>\n  have kk'[simp]: \\<open>\\<pi>' k' = \\<pi> k\\<close> by (metis csk last_cs)\n  have kl: \\<open>k < l\\<close> using icd unfolding is_icdi_def is_cdi_def by auto\n  hence skl: \\<open>Suc k < l\\<close> by (metis Suc_lessI nsuck)\n  hence lpd: \\<open>\\<pi> l pd\\<rightarrow> \\<pi> (Suc k)\\<close> using icd icd_pd_intermediate by auto\n  have km: \\<open>k < m\\<close> by (metis converge(1) kl order.strict_trans)  \n  have lcd: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using icd is_icdi_def by auto\n  hence ipdk_pdl: \\<open>ipd (\\<pi> k) pd\\<rightarrow> (\\<pi> l)\\<close> by (metis ipd_pd_cd)\n  have *: \\<open>ipd (\\<pi> k) \\<in> nodes\\<close> by (metis ipdk_pdl pd_node1)\n  have nretk: \\<open>\\<pi> k \\<noteq> return\\<close> by (metis kl lcd path(1) ret_no_cd term_path_stable less_imp_le)\n  have **: \\<open>\\<not> (\\<pi> l) pd\\<rightarrow> ipd (\\<pi> k)\\<close> proof \n    assume a: \\<open>\\<pi> l pd\\<rightarrow> ipd (\\<pi> k)\\<close>\n    hence \\<open>\\<pi> l pd\\<rightarrow> (\\<pi> k)\\<close> by (metis is_ipd_def \\<open>k < l\\<close> ipd_is_ipd ipdk_pdl path(1) path_nodes pd_antisym term_path_stable less_imp_le)\n    moreover \n    have \\<open>\\<pi> l \\<noteq> (\\<pi> k)\\<close> by (metis \"*\" a ipd_not_self ipdk_pdl lcd pd_antisym ret_no_cd)\n    ultimately\n    show \\<open>False\\<close> using lcd cd_not_pd by auto\n  qed\n\n  have km': \\<open>k' < m'\\<close> using cs_order[OF path csk converge(2) nretk km] . \n\n  obtain \\<pi>'' n'' where path'': \\<open>is_path \\<pi>''\\<close>  and \\<pi>''0: \\<open>\\<pi>'' 0 = ipd (\\<pi> k)\\<close> and \\<pi>''n: \\<open>\\<pi>'' n'' = return\\<close> and not\\<pi>l: \\<open>\\<forall> i\\<le>n''. \\<pi>'' i \\<noteq> \\<pi> l\\<close> using no_pd_path[OF * **] .\n  let \\<open>?\\<pi>'\\<close> = \\<open>(\\<pi>' @\\<^bsup>m'\\<^esup> \\<pi>'') \\<guillemotleft> Suc k'\\<close>\n  have \\<open>is_path ?\\<pi>'\\<close> by (metis \\<pi>''0 ipd(1) path'' path(2) path_cons path_path_shift)\n  moreover \n  have \\<open>?\\<pi>' 0 = \\<pi> (Suc k)\\<close> using km' suc by auto\n  moreover\n  have \\<open>?\\<pi>' (m' - Suc k' + n'') = return\\<close> using \\<pi>''n km' \\<pi>''0 ipd(1) by auto  \n  ultimately\n  obtain l'' where l'': \\<open>l'' \\<le> m' - Suc k' + n''\\<close> \\<open>?\\<pi>' l'' = \\<pi> l\\<close> using lpd unfolding is_pd_def by blast\n  have l''m: \\<open>l'' \\<le> m' - Suc k'\\<close> apply (rule ccontr) using l'' not\\<pi>l km' by (cases \\<open>Suc (k' + l'') \\<le> m'\\<close>, auto)\n  let \\<open>?l'\\<close> = \\<open>Suc ( k' + l'')\\<close>\n  have lm': \\<open>?l' \\<le> m'\\<close> using l''m km' by auto\n  \n  \\<comment> \\<open>Now we have found our desired l'\\<close>\n  have 1: \\<open>\\<pi>' ?l' = \\<pi> l\\<close> using  l'' l''m lm' by auto\n  have 2: \\<open>k' < ?l'\\<close> by simp  \n  have 3: \\<open>?l' < m'\\<close> apply (rule ccontr) using lm' by (simp, metis \"**\" 1 ipd(1) ipdk_pdl)  \n  \n  \\<comment> \\<open>Need the least such l'\\<close>\n\n  let \\<open>?P\\<close> = \\<open>\\<lambda> l'. \\<pi>' l' = \\<pi> l \\<and> k' < l' \\<and> l' < m'\\<close>\n\n  have *: \\<open>?P ?l'\\<close> using 1 2 3 by blast\n\n  define l' where l': \\<open>l' == LEAST l'. ?P l'\\<close>\n  \n  have \\<pi>l': \\<open>\\<pi>' l' = \\<pi> l\\<close> using l' 1 2 3 LeastI[of \\<open>?P\\<close>] by blast  \n  have kl': \\<open>k' < l'\\<close> using l' 1 2 3 LeastI[of \\<open>?P\\<close>] by blast\n  have lm': \\<open>l' < m'\\<close> using l' 1 2 3 LeastI[of \\<open>?P\\<close>] by blast  \n\n  have nretl': \\<open>\\<pi>' l' \\<noteq> return\\<close> by (metis \\<pi>''n \\<pi>l' le_refl not\\<pi>l)\n \n  have nipd': \\<open>\\<forall> j \\<in> {k'..l'}. \\<pi>' j \\<noteq> ipd (\\<pi>' k')\\<close> using lm' kk' ipd(2) kl' by force\n \n  have lcd': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> by (metis is_cdi_def kl' nipd' nretl' path(2))\n\n  have licd: \\<open>l' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> proof -\n    have \\<open>\\<forall> m \\<in> {k'<..<l'}. \\<not> l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m\\<close> proof (rule ccontr)\n      assume \\<open>\\<not> (\\<forall> m \\<in> {k'<..<l'}. \\<not> l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m)\\<close>\n      then obtain j' where kj': \\<open>k' < j'\\<close> and jl': \\<open>j' < l'\\<close> and lcdj': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> by force\n      have jm': \\<open>j'<m'\\<close> by (metis jl' lm' order.strict_trans)\n      have \\<open>\\<pi>' j' \\<noteq> \\<pi> l\\<close> apply (rule ccontr) using l' kj' jm' jl' Least_le[of \\<open>?P\\<close> \\<open>j'\\<close>] by auto       \n      hence \\<open>\\<not> \\<pi>' l' pd\\<rightarrow> \\<pi>' j'\\<close> using cd_not_pd lcdj' \\<pi>l' by metis\n      moreover have \\<open>\\<pi>' j' \\<in> nodes\\<close> using path(2) path_nodes by auto\n      ultimately\n      obtain \\<pi>\\<^sub>1 n\\<^sub>1 where path\\<^sub>1: \\<open>is_path \\<pi>\\<^sub>1\\<close> and \\<pi>0\\<^sub>1: \\<open>\\<pi>\\<^sub>1 0 = \\<pi>' j'\\<close> and \\<pi>n\\<^sub>1: \\<open>\\<pi>\\<^sub>1 n\\<^sub>1 = return\\<close> and nl': \\<open>\\<forall> l \\<le>n\\<^sub>1. \\<pi>\\<^sub>1 l \\<noteq> \\<pi>' l'\\<close> unfolding is_pd_def by blast\n      let \\<open>?\\<pi>''\\<close> = \\<open>(\\<pi>'@\\<^bsup>j'\\<^esup> \\<pi>\\<^sub>1) \\<guillemotleft> Suc k'\\<close>\n      have \\<open>is_path ?\\<pi>''\\<close> by (metis \\<pi>0\\<^sub>1 path(2) path\\<^sub>1 path_cons path_path_shift)\n      moreover\n      have \\<open>?\\<pi>'' 0 = \\<pi> (Suc k)\\<close> by (simp, metis kj' less_eq_Suc_le suc)\n      moreover\n      have kj': \\<open>Suc k' \\<le> j'\\<close> by (metis kj' less_eq_Suc_le)\n      hence \\<open>?\\<pi>'' (j' - Suc k' + n\\<^sub>1) = return\\<close> by (simp, metis \\<pi>0\\<^sub>1 \\<pi>n\\<^sub>1)\n      ultimately\n      obtain l'' where *: \\<open>?\\<pi>'' l'' = \\<pi> l\\<close> and **: \\<open>l'' \\<le>j' - Suc k' + n\\<^sub>1\\<close> using lpd is_pd_def by blast      \n      show \\<open>False\\<close> proof (cases)\n        assume a: \\<open>l'' \\<le> j' - Suc k'\\<close>        \n        hence \\<open>\\<pi>' (l'' + Suc k') = \\<pi> l\\<close> using * kj' by(simp, metis Nat.le_diff_conv2 add_Suc diff_add_inverse le_add1 le_add_diff_inverse2)\n        moreover \n        have \\<open>l'' + Suc k' < l'\\<close> by (metis a jl' add_diff_cancel_right' kj' le_add_diff_inverse less_imp_diff_less ordered_cancel_comm_monoid_diff_class.le_diff_conv2)\n        moreover\n        have \\<open>l'' + Suc k' < m'\\<close> by (metis Suc_lessD calculation(2) less_trans_Suc lm')\n        moreover \n        have \\<open>k' < l'' + Suc k'\\<close> by simp\n        ultimately\n        show \\<open>False\\<close> using Least_le[of \\<open>?P\\<close> \\<open>l'' + Suc k'\\<close>] l' by auto\n      next\n        assume a: \\<open>\\<not> l'' \\<le> j' - Suc k'\\<close>\n        hence \\<open>\\<not> Suc (k' + l'') \\<le> j'\\<close> by simp\n        hence \\<open>\\<pi>\\<^sub>1 (Suc (k' + l'') - j') = \\<pi> l\\<close> using * kj' by simp \n        moreover \n        have \\<open>Suc (k' + l'') - j' \\<le> n\\<^sub>1\\<close> using ** kj' by simp\n        ultimately\n        show \\<open>False\\<close> using nl' by (metis \\<pi>l')\n      qed\n    qed\n    thus \\<open>?thesis\\<close> unfolding is_icdi_def using lcd' path(2) by simp\n  qed\n  hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>'\\<^esup> k' @ [\\<pi>' l']\\<close> by (metis icd_cs)\n  hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> l\\<close> by (metis \\<pi>l' csk icd icd_cs)\n  thus \\<open>?thesis\\<close> by metis\nqed\n\nlemma converged_same_icd: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and converge: \\<open>l < n\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> \nand csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and icd: \\<open>l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and suc: \\<open>\\<pi> (Suc k) = \\<pi>' (Suc k')\\<close>\nshows \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> proof -\n  \n  have nret: \\<open>\\<pi> k \\<noteq> return\\<close> using icd unfolding is_icdi_def is_cdi_def using term_path_stable less_imp_le by metis \n  have kl: \\<open>k < l\\<close> using icd unfolding is_icdi_def is_cdi_def by auto\n  have kn: \\<open>k < n\\<close> using converge kl by simp\n  from path_ipd_swap[OF path(1) nret kn]\n  obtain \\<rho> m where path\\<rho>: \\<open>is_path \\<rho>\\<close> and \\<pi>\\<rho>: \\<open>\\<pi> =\\<^bsub>n\\<^esub>  \\<rho>\\<close> and km: \\<open>k < m\\<close> and ipd: \\<open>\\<rho> m = ipd (\\<rho> k)\\<close> \\<open>\\<forall> l \\<in> {k..<m}. \\<rho> l \\<noteq> ipd (\\<rho> k)\\<close> .\n  have csk1: \\<open>cs\\<^bsup>\\<rho>\\<^esup> k = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using cs_path_swap_le path path\\<rho> \\<pi>\\<rho> kn by auto\n  have suc\\<rho>: \\<open>\\<rho> (Suc k) = \\<pi> (Suc k)\\<close> by (metis \\<pi>\\<rho> eq_up_to_def kn less_eq_Suc_le)\n\n  have nret': \\<open>\\<pi>' k' \\<noteq> return\\<close> by (metis csk last_cs nret)\n  have kn': \\<open>k' < n'\\<close> using cs_order[OF path csk converge(2) nret kn] .\n  from path_ipd_swap[OF path(2) nret' kn']\n  obtain \\<rho>' m' where path\\<rho>': \\<open>is_path \\<rho>'\\<close> and \\<pi>\\<rho>': \\<open>\\<pi>' =\\<^bsub>n'\\<^esub> \\<rho>'\\<close> and km': \\<open>k' < m'\\<close> and ipd': \\<open>\\<rho>' m' = ipd (\\<rho>' k')\\<close> \\<open>\\<forall> l \\<in> {k'..<m'}. \\<rho>' l \\<noteq> ipd (\\<rho>' k')\\<close> .\n  have csk1': \\<open>cs\\<^bsup>\\<rho>'\\<^esup> k' = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> using cs_path_swap_le path path\\<rho>' \\<pi>\\<rho>' kn' by auto\n  have suc\\<rho>': \\<open>\\<rho>' (Suc k') = \\<pi>' (Suc k')\\<close> by (metis \\<pi>\\<rho>' eq_up_to_def kn' less_eq_Suc_le)\n  \n  have icd\\<rho>: \\<open>l icd\\<^bsup>\\<rho>\\<^esup>\\<rightarrow> k\\<close> using icdi_path_swap_le[OF path\\<rho> icd \\<pi>\\<rho>] converge by simp\n\n  have lm: \\<open>l < m\\<close> using ipd(1) icd\\<rho> km unfolding is_icdi_def is_cdi_def by auto\n\n  have csk': \\<open>cs\\<^bsup>\\<rho>\\<^esup> k = cs\\<^bsup>\\<rho>'\\<^esup> k'\\<close> using csk1 csk1' csk by auto\n\n  hence kk': \\<open>\\<rho>' k' = \\<rho> k\\<close> using last_cs by metis\n\n  have suc': \\<open>\\<rho> (Suc k) = \\<rho>' (Suc k')\\<close> using suc suc\\<rho> suc\\<rho>' by auto\n\n  have mm': \\<open>\\<rho>' m' = \\<rho> m\\<close> using ipd(1) ipd'(1) kk' by auto\n\n  from cs_ipd[OF ipd km] cs_ipd[OF ipd' km',unfolded mm', folded csk']  \n  have csm: \\<open>cs\\<^bsup>\\<rho>\\<^esup> m = cs\\<^bsup>\\<rho>'\\<^esup> m'\\<close> by metis\n\n  from converged_ipd_same_icd[OF path\\<rho> path\\<rho>' lm  csm csk' icd\\<rho> suc' ipd'[unfolded kk']]\n  obtain l' where csl: \\<open>cs\\<^bsup>\\<rho>\\<^esup> l = cs\\<^bsup>\\<rho>'\\<^esup> l'\\<close> by blast\n  \n  have csl\\<rho>: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<rho>\\<^esup> l\\<close> using \\<pi>\\<rho> converge(1) cs_path_swap_le less_imp_le_nat path(1) path\\<rho> by blast \n\n  have nretl: \\<open>\\<rho> l \\<noteq> return\\<close> by (metis icd\\<rho> icd_imp_cd ret_no_cd)\n\n  have csn': \\<open>cs\\<^bsup>\\<rho>\\<^esup> n = cs\\<^bsup>\\<rho>'\\<^esup> n'\\<close> using converge(2) cs_path_swap path path\\<rho> path\\<rho>' \\<pi>\\<rho> \\<pi>\\<rho>' by auto\n  \n  have ln': \\<open>l' < n'\\<close> using cs_order[OF path\\<rho> path\\<rho>' csl csn' nretl converge(1)] .\n    \n  have csl\\<rho>': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<rho>'\\<^esup> l'\\<close> using cs_path_swap_le[OF path(2) path\\<rho>' \\<pi>\\<rho>'] ln' by auto\n\n  have csl': \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> using csl\\<rho> csl\\<rho>' csl by auto\n  thus \\<open>?thesis\\<close> by blast\nqed\n\nlemma cd_is_cs_less: assumes \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> k \\<prec> cs\\<^bsup>\\<pi>\\<^esup> l\\<close> proof -\n  obtain xs where csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>\\<^esup> k @ xs @[\\<pi> l]\\<close> using cd_in_cs[OF assms] by blast\n  hence len: \\<open>length(cs\\<^bsup>\\<pi>\\<^esup> k) < length (cs\\<^bsup>\\<pi>\\<^esup> l)\\<close> by auto\n  have take: \\<open>take (length (cs\\<^bsup>\\<pi>\\<^esup> k)) (cs\\<^bsup>\\<pi>\\<^esup> l) = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using csl by auto\n  show \\<open>?thesis\\<close> using cs_less.intros[OF len take] . \nqed\n\nlemma cs_select_id: assumes \\<open>is_path \\<pi>\\<close> \\<open>\\<pi> k \\<noteq> return\\<close> shows \\<open>\\<pi>\\<exclamdown>cs\\<^bsup>\\<pi>\\<^esup> k = k\\<close> (is \\<open>?k = k\\<close>) proof -\n  have *: \\<open>\\<And> i . cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> k  \\<Longrightarrow> i = k\\<close> using cs_inj[OF assms] by metis  \n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?k = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> unfolding cs_select_def using theI[of \\<open>\\<lambda> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> \\<open>k\\<close>] by auto\n  thus \\<open>?k = k\\<close> using * by auto\nqed\n\nlemma cs_single_nocd: assumes \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = [x]\\<close> shows \\<open>\\<forall> k. \\<not> i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> proof -\n  have \\<open>\\<not> (\\<exists> k. i icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> apply (rule ccontr) using assms cs_not_nil by auto\n  hence \\<open>\\<not> (\\<exists> k. i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close> by (metis excd_impl_exicd)\n  thus \\<open>?thesis\\<close> by blast\nqed\n\nlemma cs_single_pd_intermed: assumes \\<open>is_path \\<pi>\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = [\\<pi> n]\\<close> \\<open>k \\<le> n\\<close> shows \\<open>\\<pi> n pd\\<rightarrow> \\<pi> k\\<close> proof -\n  have \\<open>\\<forall> l. \\<not> n icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> l\\<close> by (metis assms(2) cs_single_nocd icd_imp_cd)\n  thus \\<open>?thesis\\<close> by (metis assms(1) assms(3) no_icd_pd)\nqed\n\n\nlemma cs_first_pd:  assumes path: \\<open>is_path \\<pi>\\<close> and pd: \\<open>\\<pi> n pd\\<rightarrow> \\<pi> 0\\<close> and first: \\<open>\\<forall> l < n. \\<pi> l \\<noteq> \\<pi> n\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = [\\<pi> n]\\<close> \nby (metis cs_cases first first_pd_no_cd icd_imp_cd path pd)\n\nlemma converged_pd_cs_single: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and  converge: \\<open>l < m\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \nand \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> and mpdl: \\<open>\\<pi> m pd\\<rightarrow> \\<pi> l\\<close> and csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = [\\<pi> l]\\<close>\nshows \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> proof -\n  have *: \\<open>\\<pi> l pd\\<rightarrow> \\<pi>' 0\\<close> using cs_single_pd_intermed[OF path(1) csl] \\<pi>0[symmetric] by auto\n  have \\<pi>m: \\<open>\\<pi> m = \\<pi>' m'\\<close> by (metis converge(2) last_cs)\n  hence **: \\<open>\\<pi>' m' pd\\<rightarrow> \\<pi> l\\<close> using mpdl by metis\n  \n  obtain l' where lm': \\<open>l' \\<le> m'\\<close> and \\<pi>l:  \\<open>\\<pi>' l' = \\<pi> l\\<close> (is \\<open>?P l'\\<close>) using path_pd_pd0[OF path(2) ** *] .\n  \n  let \\<open>?l\\<close> = \\<open>(LEAST l'. \\<pi>' l' = \\<pi> l)\\<close>\n  \n  have \\<pi>l': \\<open>\\<pi>' ?l = \\<pi> l\\<close> using LeastI[of \\<open>?P\\<close>,OF \\<pi>l] .\n  moreover\n  have \\<open>\\<forall> i <?l. \\<pi>' i \\<noteq> \\<pi> l\\<close> using Least_le[of \\<open>?P\\<close>] by (metis not_less)\n  hence \\<open>\\<forall> i <?l. \\<pi>' i \\<noteq> \\<pi>' ?l\\<close> using \\<pi>l' by metis\n  moreover\n  have \\<open>\\<pi>' ?l pd\\<rightarrow> \\<pi>' 0\\<close> using * \\<pi>l' by metis\n  ultimately\n  have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> ?l = [\\<pi>' ?l]\\<close> using cs_first_pd[OF path(2)] by metis\n  thus \\<open>?thesis\\<close> using csl \\<pi>l' by metis\nqed\n\nlemma converged_cs_single: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and  converge: \\<open>l < m\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \nand \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> and csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = [\\<pi> l]\\<close>\nshows \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> proof cases\n  assume *: \\<open>\\<pi> l = return\\<close>  \n  hence \\<open>\\<pi> m = return\\<close> by (metis converge(1) path(1) term_path_stable less_imp_le)\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = [return]\\<close> using cs_return by auto\n  hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> m' = [return]\\<close> using converge by simp\n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = [return]\\<close> using * cs_return by auto\n  ultimately show \\<open>?thesis\\<close> by metis\nnext\n  assume nret: \\<open>\\<pi> l \\<noteq> return\\<close>\n  have \\<pi>m: \\<open>\\<pi> m = \\<pi>' m'\\<close> by (metis converge(2) last_cs)\n  \n  obtain \\<pi>\\<^sub>1 n where path1: \\<open>is_path \\<pi>\\<^sub>1\\<close> and upto: \\<open>\\<pi> =\\<^bsub>m\\<^esub> \\<pi>\\<^sub>1\\<close> and \\<pi>n: \\<open>\\<pi>\\<^sub>1 n = return\\<close> using path(1) path_swap_ret by blast\n\n  obtain \\<pi>\\<^sub>1' n' where path1': \\<open>is_path \\<pi>\\<^sub>1'\\<close> and upto': \\<open>\\<pi>' =\\<^bsub>m'\\<^esub>  \\<pi>\\<^sub>1'\\<close> and \\<pi>n': \\<open>\\<pi>\\<^sub>1' n' = return\\<close> using path(2) path_swap_ret by blast\n\n  have \\<pi>1l: \\<open>\\<pi>\\<^sub>1 l = \\<pi> l\\<close> using upto converge(1) by (metis eq_up_to_def nat_less_le)\n\n  have cs1l: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> l = cs\\<^bsup>\\<pi>\\<^esup> l\\<close> using cs_path_swap_le upto path1 path(1) converge(1) by auto\n\n  have csl1: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> l = [\\<pi>\\<^sub>1 l]\\<close> by (metis \\<pi>1l cs1l csl)\n  \n  have converge1: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> n = cs\\<^bsup>\\<pi>\\<^sub>1'\\<^esup> n'\\<close> using \\<pi>n \\<pi>n' cs_return by auto\n  \n  have ln: \\<open>l < n\\<close> using nret \\<pi>n \\<pi>1l term_path_stable[OF path1 \\<pi>n] by (auto, metis linorder_neqE_nat less_imp_le)\n\n  have \\<pi>01: \\<open>\\<pi>\\<^sub>1 0 = \\<pi>\\<^sub>1' 0\\<close> using \\<pi>0 eq_up_to_apply[OF upto] eq_up_to_apply[OF upto'] by auto\n\n  have pd: \\<open>\\<pi>\\<^sub>1 n pd\\<rightarrow> \\<pi>\\<^sub>1 l\\<close> using \\<pi>n by (metis path1 path_nodes return_pd)\n  \n  obtain l' where csl: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> l = cs\\<^bsup>\\<pi>\\<^sub>1'\\<^esup> l'\\<close> using converged_pd_cs_single[OF path1 path1' ln converge1 \\<pi>01 pd csl1] by blast\n\n  have cs1m: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> m = cs\\<^bsup>\\<pi>\\<^esup> m\\<close> using cs_path_swap upto path1 path(1) by auto\n  have cs1m': \\<open>cs\\<^bsup>\\<pi>\\<^sub>1'\\<^esup> m' = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> using cs_path_swap upto' path1' path(2) by auto\n  hence converge1: \\<open>cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> m = cs\\<^bsup>\\<pi>\\<^sub>1'\\<^esup> m'\\<close> using converge(2) cs1m by metis\n  \n  have nret1: \\<open>\\<pi>\\<^sub>1 l \\<noteq> return\\<close> using nret \\<pi>1l by auto\n  \n  have lm': \\<open>l' < m'\\<close> using cs_order[OF path1 path1' csl converge1 nret1 converge(1)] .\n  \n  have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^sub>1'\\<^esup> l'\\<close> using cs_path_swap_le[OF path(2) path1' upto'] lm' by auto\n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>\\<^sub>1\\<^esup> l\\<close> using cs_path_swap_le[OF path(1) path1 upto] converge(1) by auto\n  ultimately\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> using csl by auto\n  thus \\<open>?thesis\\<close> by blast\nqed\n\nlemma converged_cd_same_suc: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and init: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> \nand cd_suc: \\<open>\\<forall> k k'. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k' \\<and> l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<longrightarrow> \\<pi> (Suc k) = \\<pi>' (Suc k')\\<close> and converge: \\<open>l < m\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \nshows  \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\nusing path init cd_suc converge proof (induction \\<open>\\<pi>\\<close> \\<open>l\\<close> rule: cs_induct,cases)\n  case (cs \\<pi> l)\n  assume *: \\<open>\\<exists>k. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  let \\<open>?k\\<close> = \\<open>THE k. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close>\n  have icd: \\<open>l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?k\\<close> by (metis \"*\" icd_is_the_icd)\n  hence lcdk: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ?k\\<close> by (metis is_icdi_def)\n  hence kl: \\<open>?k<l\\<close> using is_cdi_def by metis\n  \n  have \\<open>\\<And> j. ?k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<Longrightarrow> l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using icd cd_trans is_icdi_def by fast\n  hence suc': \\<open>\\<forall> j j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j' \\<and> ?k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<longrightarrow> \\<pi> (Suc j) = \\<pi>' (Suc j')\\<close> using cs.prems(4) by blast\n\n  from cs.IH[OF * cs(2) path(2) cs(4) suc'] cs.prems kl \n  have \\<open>\\<exists>k'. cs\\<^bsup>\\<pi>\\<^esup> (THE k. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k) = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> by (metis Suc_lessD less_trans_Suc)\n  then obtain k' where csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> by blast\n  \n  have suc2: \\<open>\\<pi> (Suc ?k) = \\<pi>' (Suc k')\\<close> using cs.prems(4) lcdk csk by auto\n\n  have km: \\<open>?k < m\\<close> using kl cs.prems(5) by simp\n  \n  from converged_same_icd[OF cs(2) path(2) cs.prems(5) cs.prems(6) csk icd suc2]  \n  show \\<open>?case\\<close> .\nnext\n  case (cs \\<pi> l)\n  assume \\<open>\\<not> (\\<exists>k. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k)\\<close>\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = [\\<pi> l]\\<close> by auto\n  with cs converged_cs_single\n  show \\<open>?case\\<close> by metis\nqed\n\nlemma converged_cd_diverge: \nassumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and init: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> and notin: \\<open>\\<not> (\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l')\\<close> and converge: \\<open>l < m\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> \nobtains k k' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<pi> (Suc k) \\<noteq> \\<pi>' (Suc k')\\<close>\nusing assms converged_cd_same_suc by blast\n\n\n\nlemma converged_cd_same_suc_return: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> \nand cd_suc: \\<open>\\<forall> k k'. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k' \\<and> l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k \\<longrightarrow> \\<pi> (Suc k) = \\<pi>' (Suc k')\\<close> and ret: \\<open>\\<pi>' n' = return\\<close> \nshows  \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>proof cases\n  assume \\<open>\\<pi> l = return\\<close>\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> using ret cs_return by presburger\n  thus \\<open>?thesis\\<close> by blast\nnext\n  assume nretl: \\<open>\\<pi> l \\<noteq> return\\<close>\n  have \\<open>\\<pi> l \\<in> nodes\\<close> using path path_nodes by auto\n  then obtain \\<pi>l n where ipl: \\<open>is_path \\<pi>l\\<close> and \\<pi>l:  \\<open>\\<pi> l = \\<pi>l 0\\<close> and retn: \\<open>\\<pi>l n = return\\<close> and notl: \\<open>\\<forall> i>0. \\<pi>l i \\<noteq> \\<pi> l\\<close> by (metis direct_path_return nretl)\n  hence ip: \\<open>is_path (\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l)\\<close> and l: \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l) l = \\<pi> l\\<close> and retl: \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l) (l + n) = return\\<close> and nl: \\<open>\\<forall> i>l. (\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l) i \\<noteq> \\<pi> l\\<close> using path_cons[OF path(1) ipl \\<pi>l] by auto\n  \n  have \\<pi>0': \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l) 0 = \\<pi>' 0\\<close>  unfolding cs_0 using  \\<pi>l \\<pi>0  by auto\n\n  have csn: \\<open>cs\\<^bsup>\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  (l+n) = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> using ret retl cs_return by metis\n\n  have eql: \\<open>(\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l) =\\<^bsub>l\\<^esub> \\<pi>\\<close> by (metis path_append_eq_up_to)    \n\n  have csl': \\<open>cs\\<^bsup>\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  l = cs\\<^bsup>\\<pi>\\<^esup> l\\<close> using eql cs_path_swap ip path(1) by metis\n  \n  have \\<open>0 < n\\<close> using nretl[unfolded \\<pi>l] retn by (metis neq0_conv)\n  hence ln: \\<open>l < l + n\\<close> by simp\n\n  have *: \\<open>\\<forall> k k'. cs\\<^bsup>\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  k = cs\\<^bsup>\\<pi>'\\<^esup> k' \\<and> l cd\\<^bsup>\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>\\<rightarrow> k \\<longrightarrow> (\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l) (Suc k) = \\<pi>' (Suc k')\\<close> proof (rule,rule,rule)  \n    fix k k' assume *: \\<open>cs\\<^bsup>\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  k = cs\\<^bsup>\\<pi>'\\<^esup> k' \\<and> l cd\\<^bsup>\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>\\<rightarrow> k\\<close>\n    hence kl: \\<open>k < l\\<close> using is_cdi_def by auto\n    hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k' \\<and> l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> using eql * cs_path_swap_le[OF ip path(1) eql,of \\<open>k\\<close>] cdi_path_swap_le[OF path(1) _ eql,of \\<open>l\\<close> \\<open>k\\<close>] by auto\n    hence \\<open>\\<pi> (Suc k) = \\<pi>' (Suc k')\\<close> using cd_suc by blast\n    then show \\<open>(\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l) (Suc k) = \\<pi>' (Suc k')\\<close> using cs_path_swap_le[OF ip path(1) eql,of \\<open>Suc k\\<close>] kl by auto\n  qed \n  obtain l' where \\<open>cs\\<^bsup>\\<pi> @\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> using converged_cd_same_suc[OF ip path(2) \\<pi>0' * ln csn]  by blast\n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>@\\<^bsup>l\\<^esup> \\<pi>l\\<^esup>  l = cs\\<^bsup>\\<pi>\\<^esup> l\\<close> using eql by (metis cs_path_swap ip path(1))\n  ultimately\n  show \\<open>?thesis\\<close> by metis\nqed\n\nlemma converged_cd_diverge_return: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and init: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> \nand notin: \\<open>\\<not> (\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l')\\<close> and ret: \\<open>\\<pi>' m' = return\\<close> \nobtains k k' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>\\<pi> (Suc k) \\<noteq> \\<pi>' (Suc k')\\<close> using converged_cd_same_suc_return[OF path init _ ret, of \\<open>l\\<close>] notin by blast\n\nlemma returned_missing_cd_or_loop: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> \nand notin': \\<open>\\<not>(\\<exists> k'. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close> and nret: \\<open>\\<forall> n'. \\<pi>' n' \\<noteq> return\\<close> and ret: \\<open>\\<pi> n = return\\<close> \nobtains i i' where \\<open>i<k\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> \\<open>\\<pi> (Suc i) \\<noteq> \\<pi>' (Suc i')\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<or> (\\<forall> j'> i'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i')\\<close>\nproof -  \n  obtain f where icdf: \\<open>\\<forall> i'. f (Suc i') icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> f i'\\<close> and ran: \\<open>range f = {i'. \\<forall> j'>i'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'}\\<close> and icdf0: \\<open>\\<not> (\\<exists>i'. f 0 cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i')\\<close> using path(2) path_nret_inf_icd_seq nret by blast\n  show \\<open>thesis\\<close> proof cases\n    assume \\<open>\\<exists> j. \\<not> (\\<exists> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> (f j))\\<close>\n    then obtain j where ni\\<pi>: \\<open>\\<not> (\\<exists> i. cs\\<^bsup>\\<pi>'\\<^esup> (f j) = cs\\<^bsup>\\<pi>\\<^esup> i)\\<close> by metis\n    note converged_cd_diverge_return[OF path(2,1) \\<pi>0[symmetric] ni\\<pi> ret] that\n    then obtain i k' where csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and cdj: \\<open>f j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> and div:  \\<open>\\<pi> (Suc i) \\<noteq> \\<pi>' (Suc k')\\<close> by metis\n    have \\<open>k' \\<in> range f\\<close> using cdj proof (induction \\<open>j\\<close>)\n      case 0 thus \\<open>?case\\<close> using icdf0 by blast\n    next\n      case (Suc j)\n      have icdfj: \\<open>f (Suc j) icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> f j\\<close> using icdf by auto\n      show \\<open>?case\\<close> proof cases\n        assume \\<open>f (Suc j) icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close>\n        hence \\<open>k' = f j\\<close> using icdfj  by (metis icd_uniq)\n        thus \\<open>?case\\<close> by auto\n      next\n        assume \\<open>\\<not> f (Suc j) icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close>\n        hence \\<open>f j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> using cd_impl_icd_cd[OF Suc.prems icdfj] by auto\n        thus \\<open>?case\\<close> using Suc.IH by auto\n      qed\n    qed\n    hence alldep: \\<open>\\<forall> i'>k'. i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> using ran by auto\n    show \\<open>thesis\\<close> proof cases\n      assume \\<open>i < k\\<close> with alldep that[OF _ csk div] show \\<open>thesis\\<close> by blast\n    next\n      assume \\<open>\\<not> i < k\\<close>\n      hence ki: \\<open>k\\<le>i\\<close> by auto\n      have \\<open>k \\<noteq> i\\<close> using notin' csk by auto\n      hence ki': \\<open>k<i\\<close> using ki by auto\n      obtain ka k' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> ka = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ka\\<close> \\<open>\\<pi> (Suc ka) \\<noteq> \\<pi>' (Suc k')\\<close>\n      using converged_cd_diverge[OF path \\<pi>0 notin' ki' csk] by blast\n      moreover\n      hence \\<open>ka < k\\<close> unfolding is_cdi_def by auto\n      ultimately\n      show \\<open>?thesis\\<close> using that by blast\n    qed\n  next\n    assume \\<open>\\<not>(\\<exists> j. \\<not> (\\<exists> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> (f j)))\\<close>\n    hence allin: \\<open>\\<forall> j. (\\<exists> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> (f j))\\<close> by blast\n    define f' where f': \\<open>f' \\<equiv> \\<lambda> j. (SOME i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> (f j))\\<close>\n    have \\<open>\\<forall> i. f' i < f' (Suc i)\\<close> proof\n      fix i\n      have csi: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (f i) = cs\\<^bsup>\\<pi>\\<^esup> (f' i)\\<close> unfolding f' using allin by (metis (mono_tags) someI_ex)\n      have cssuci: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (f (Suc i)) = cs\\<^bsup>\\<pi>\\<^esup> (f' (Suc i))\\<close> unfolding f' using allin by (metis (mono_tags) someI_ex)\n      have fi: \\<open>f i < f (Suc i)\\<close> using icdf unfolding is_icdi_def is_cdi_def by auto\n      have \\<open>f (Suc i) cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> f i\\<close> using icdf unfolding is_icdi_def by blast\n      hence nreti: \\<open>\\<pi>' (f i) \\<noteq> return\\<close> by (metis cd_not_ret)\n      show \\<open>f' i < f' (Suc i)\\<close> using cs_order[OF path(2,1) csi cssuci nreti fi] .\n    qed\n    hence kle: \\<open>k < f' (Suc k)\\<close> using mono_ge_id[of \\<open>f'\\<close> \\<open>Suc k\\<close>] by auto\n    have cssk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> (f' (Suc k)) = cs\\<^bsup>\\<pi>'\\<^esup> (f (Suc k))\\<close> unfolding f' using allin by (metis (mono_tags) someI_ex)\n    obtain ka k' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> ka = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ka\\<close> \\<open>\\<pi> (Suc ka) \\<noteq> \\<pi>' (Suc k')\\<close>\n    using converged_cd_diverge[OF path \\<pi>0 notin' kle cssk] by blast\n    moreover\n    hence \\<open>ka < k\\<close> unfolding is_cdi_def by auto\n    ultimately\n    show \\<open>?thesis\\<close> using that by blast\n  qed\nqed\n\nlemma missing_cd_or_loop: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> and notin': \\<open>\\<not>(\\<exists> k'. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close>  \nobtains i i' where \\<open>i < k\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> \\<open>\\<pi> (Suc i) \\<noteq> \\<pi>' (Suc i')\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<or> (\\<forall> j'> i'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i')\\<close>\nproof cases\n  assume \\<open>\\<exists> n'. \\<pi>' n' = return\\<close>\n  then obtain n' where retn: \\<open>\\<pi>' n' = return\\<close> by blast\n  note converged_cd_diverge_return[OF path \\<pi>0 notin' retn]\n  then obtain ka k' where \\<open>cs\\<^bsup>\\<pi>\\<^esup> ka = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> ka\\<close> \\<open>\\<pi> (Suc ka) \\<noteq> \\<pi>' (Suc k')\\<close> by blast\n  moreover\n  hence \\<open>ka < k\\<close> unfolding is_cdi_def by auto\n  ultimately show \\<open>thesis\\<close> using that by simp\nnext\n  assume \\<open>\\<not> (\\<exists> n'. \\<pi>' n' = return)\\<close>\n  hence notret: \\<open>\\<forall> n'. \\<pi>' n' \\<noteq> return\\<close> by auto\n  then obtain \\<pi>l n where ipl: \\<open>is_path \\<pi>l\\<close> and \\<pi>l:  \\<open>\\<pi> k = \\<pi>l 0\\<close> and retn: \\<open>\\<pi>l n = return\\<close> using reaching_ret path(1) path_nodes by metis\n  hence ip: \\<open>is_path (\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l)\\<close> and l: \\<open>(\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l) k = \\<pi> k\\<close> and retl: \\<open>(\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l) (k + n) = return\\<close> using path_cons[OF path(1) ipl \\<pi>l] by auto\n  \n  have \\<pi>0': \\<open>(\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l) 0 = \\<pi>' 0\\<close>  unfolding cs_0 using  \\<pi>l \\<pi>0  by auto\n\n  have eql: \\<open>(\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l) =\\<^bsub>k\\<^esub> \\<pi>\\<close> by (metis path_append_eq_up_to)    \n\n  have csl': \\<open>cs\\<^bsup>\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l\\<^esup>  k = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using eql cs_path_swap ip path(1) by metis\n  \n  hence notin: \\<open>\\<not>(\\<exists> k'. cs\\<^bsup>\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l\\<^esup>  k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close> using notin' by auto\n\n  obtain i i' where *: \\<open>i < k\\<close> and csi: \\<open>cs\\<^bsup>\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l\\<^esup>  i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> and suci: \\<open>(\\<pi> @\\<^bsup>k\\<^esup> \\<pi>l) (Suc i) \\<noteq> \\<pi>' (Suc i')\\<close>  and cdloop: \\<open>k cd\\<^bsup>\\<pi>@\\<^bsup>k\\<^esup>\\<pi>l\\<^esup>\\<rightarrow> i \\<or> (\\<forall> j'>i'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i')\\<close>\n  using returned_missing_cd_or_loop[OF ip path(2) \\<pi>0' notin notret retl] by blast\n\n  have \\<open>i \\<noteq> k\\<close> using notin csi by auto\n  hence ik: \\<open>i < k\\<close> using * by auto\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using csi cs_path_swap_le[OF ip path(1) eql] by auto\n  moreover\n  have \\<open>\\<pi> (Suc i) \\<noteq> \\<pi>' (Suc i')\\<close> using ik eq_up_to_apply[OF eql, of \\<open>Suc i\\<close>] suci by auto\n  moreover\n  have \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<or> (\\<forall> j'>i'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i')\\<close> using cdloop cdi_path_swap_le[OF path(1) _ eql, of \\<open>k\\<close> \\<open>i\\<close>] by auto\n  ultimately\n  show \\<open>thesis\\<close> using that[OF *] by blast\nqed\n\n\nlemma path_shift_set_cd: assumes \\<open>is_path \\<pi>\\<close> shows \\<open>{k + j| j . n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> j } = {i. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i }\\<close>\nproof -\n  { fix i\n    assume \\<open>i\\<in>{k+j | j . n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> j }\\<close>\n    then obtain j where \\<open>i = k+j\\<close> \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> j\\<close> by auto\n    hence \\<open>k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i\\<close> using cd_path_shift[OF _ assms, of \\<open>k\\<close> \\<open>k+j\\<close> \\<open>k+n\\<close>] by simp\n    hence \\<open>i\\<in>{ i. k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i }\\<close> by blast\n  }\n  moreover\n  { fix i\n    assume \\<open>i\\<in>{ i. k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i }\\<close>\n    hence *: \\<open>k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i\\<close> by blast\n    then obtain j where i: \\<open>i = k+j\\<close> by (metis le_Suc_ex)\n    hence \\<open>k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k+j\\<close> using * by auto\n    hence \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> j\\<close> using cd_path_shift[OF _ assms, of \\<open>k\\<close> \\<open>k+j\\<close> \\<open>k+n\\<close>] by simp\n    hence \\<open>i\\<in>{k+j | j . n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> j }\\<close> using i by simp\n  }\n  ultimately show \\<open>?thesis\\<close> by blast\nqed\n\nlemma cs_path_shift_set_cd: assumes path: \\<open>is_path \\<pi>\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = map \\<pi> (sorted_list_of_set {i. k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i }) @ [\\<pi> (k+n)]\\<close>\nproof -\n  have mono:\\<open>\\<forall>n m. n < m \\<longrightarrow> k + n < k + m\\<close> by auto\n  have fin: \\<open>finite {i. n cd\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup>\\<rightarrow> i}\\<close> unfolding is_cdi_def by auto\n  have *: \\<open>(\\<lambda> x. k+x)`{i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i} = {k + i | i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i}\\<close> by auto\n  have \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = map (\\<pi>\\<guillemotleft>k) (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i}) @ [(\\<pi>\\<guillemotleft>k) n]\\<close> using cs_sorted_list_of_cd' by blast\n  also \n  have \\<open>\\<dots> = map \\<pi> (map (\\<lambda> x. k+x) (sorted_list_of_set{i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i})) @ [\\<pi> (k+n)]\\<close> by auto\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set ((\\<lambda> x. k+x)`{i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i})) @ [\\<pi> (k+n)]\\<close> using sorted_list_of_set_map_mono[OF mono fin] by auto\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set ({k + i | i. n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> i})) @ [\\<pi> (k+n)]\\<close> using * by auto\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set ({i. k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> (k+n)]\\<close> using path_shift_set_cd[OF path] by auto\n  finally\n  show \\<open>?thesis\\<close> .\nqed\n\nlemma cs_split_shift_cd: assumes \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and \\<open>j < k\\<close> and \\<open>k < n\\<close> and \\<open>\\<forall>j'<k. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j' \\<longrightarrow> j' \\<le> j\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>\\<^esup> j @ cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> (n-k)\\<close>\nproof -\n  have path: \\<open>is_path \\<pi>\\<close> using assms unfolding is_cdi_def by auto\n  have 1: \\<open>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} \\<union> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i}\\<close> by auto\n  have le: \\<open>\\<forall> i\\<in> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k}. \\<forall> j\\<in> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i}. i < j\\<close> by auto\n  \n  have 2: \\<open>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} = {i . j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {j}\\<close> proof - \n    { fix i assume \\<open>i\\<in>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k}\\<close> \n      hence cd: \\<open>n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> and ik:\\<open>i < k\\<close> by auto\n      have \\<open>i\\<in>{i . j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {j}\\<close> proof cases\n        assume \\<open>i < j\\<close> hence \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> by (metis is_cdi_def assms(1) cd cdi_prefix nat_less_le)\n        thus \\<open>?thesis\\<close> by simp\n      next\n        assume \\<open>\\<not> i < j\\<close>\n        moreover\n        have \\<open>i \\<le> j\\<close> using assms(4) ik cd by auto\n        ultimately\n        show \\<open>?thesis\\<close> by auto\n      qed\n    }\n    moreover\n    { fix i assume \\<open>i\\<in>{i . j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} \\<union> {j}\\<close>\n      hence \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<or> i = j\\<close> by auto\n      hence \\<open>i\\<in>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k}\\<close> using assms(1,2) cd_trans[OF _ assms(1)] apply auto unfolding is_cdi_def \n      by (metis (poly_guards_query) diff_diff_cancel diff_is_0_eq le_refl le_trans nat_less_le)\n    }\n    ultimately show \\<open>?thesis\\<close> by blast\n  qed\n  \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}) @ [\\<pi> n]\\<close> using cs_sorted_list_of_cd' by simp\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set ({i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} \\<union> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> n]\\<close> using 1 by metis\n  also \n  have \\<open>\\<dots> = map \\<pi> ((sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k}) @ (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> n]\\<close>\n    using sorted_list_of_set_append[OF _ _ le] is_cdi_def by auto\n  also \n  have \\<open>\\<dots> = (map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k})) @ (map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> n]\\<close> by auto\n  also\n  have \\<open>\\<dots> = cs\\<^bsup>\\<pi>\\<^esup> j @ (map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> n]\\<close> unfolding 2 using cs_sorted_list_of_cd by auto\n  also \n  have \\<open>\\<dots> = cs\\<^bsup>\\<pi>\\<^esup> j @ cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> (n-k)\\<close> using cs_path_shift_set_cd[OF path, of \\<open>k\\<close> \\<open>n-k\\<close>] assms(3) by auto\n  finally\n  show \\<open>?thesis\\<close> .\nqed\n\nlemma cs_split_shift_nocd: assumes \\<open>is_path \\<pi>\\<close> and \\<open>k < n\\<close> and \\<open>\\<forall>j. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<longrightarrow> k \\<le> j\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> (n-k)\\<close>\nproof -\n  have path: \\<open>is_path \\<pi>\\<close> using assms by auto\n  have 1: \\<open>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i} = {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} \\<union> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i}\\<close> by auto\n  have le: \\<open>\\<forall> i\\<in> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k}. \\<forall> j\\<in> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i}. i < j\\<close> by auto\n  have 2: \\<open>{i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} = {}\\<close> using assms by auto\n  \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i}) @ [\\<pi> n]\\<close> using cs_sorted_list_of_cd' by simp\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set ({i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> i < k} \\<union> {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i})) @ [\\<pi> n]\\<close> using 1 by metis\n  also \n  have \\<open>\\<dots> = map \\<pi> (sorted_list_of_set {i. n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i \\<and> k \\<le> i}) @ [\\<pi> n]\\<close>\n    unfolding 2 by auto\n  also \n  have \\<open>\\<dots> = cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> (n-k)\\<close> using cs_path_shift_set_cd[OF path, of \\<open>k\\<close> \\<open>n-k\\<close>] assms(2)  by auto\n  finally show \\<open>?thesis\\<close> .\nqed\n\nlemma shifted_cs_eq_is_eq: assumes \\<open>is_path \\<pi>\\<close> and \\<open>is_path \\<pi>'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n'\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k+n) = cs\\<^bsup>\\<pi>'\\<^esup> (k'+n')\\<close>\nproof (rule ccontr)\n  note path = assms(1,2)\n  note csk = assms(3)\n  note csn = assms(4)\n  assume ne: \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k+n) \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> (k'+n')\\<close>\n  have nretkn:\\<open>\\<pi> (k+n) \\<noteq> return\\<close> proof \n    assume 1:\\<open>\\<pi> (k+n) = return\\<close>\n    hence \\<open>(\\<pi>\\<guillemotleft>k) n = return\\<close> by auto\n    hence \\<open>(\\<pi>'\\<guillemotleft>k') n' = return\\<close> using last_cs assms(4) by metis\n    hence \\<open>\\<pi>' (k' + n') = return\\<close> by auto\n    thus \\<open>False\\<close> using ne 1 cs_return by auto\n  qed\n  hence nretk: \\<open>\\<pi> k \\<noteq> return\\<close> using term_path_stable[OF assms(1), of \\<open>k\\<close> \\<open>k +n\\<close>] by auto\n  have nretkn': \\<open>\\<pi>' (k'+n') \\<noteq> return\\<close> proof \n    assume 1:\\<open>\\<pi>' (k'+n') = return\\<close>\n    hence \\<open>(\\<pi>'\\<guillemotleft>k') n' = return\\<close> by auto\n    hence \\<open>(\\<pi>\\<guillemotleft>k) n = return\\<close> using last_cs assms(4) by metis\n    hence \\<open>\\<pi> (k + n) = return\\<close> by auto\n    thus \\<open>False\\<close> using ne 1 cs_return by auto\n  qed\n  hence nretk': \\<open>\\<pi>' k' \\<noteq> return\\<close> using term_path_stable[OF assms(2), of \\<open>k'\\<close> \\<open>k' +n'\\<close>] by auto\n  have n0:\\<open>n > 0\\<close> proof (rule ccontr)\n    assume *: \\<open>\\<not> 0 < n\\<close>    \n    hence 1:\\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> 0 = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n'\\<close> using assms(3,4) by auto\n    have \\<open>(\\<pi>\\<guillemotleft>k) 0 = (\\<pi>'\\<guillemotleft>k') 0\\<close> using assms(3) last_cs path_shift_def by (metis monoid_add_class.add.right_neutral)\n    hence \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> 0 = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n'\\<close> using 1 cs_0 by metis\n    hence n0': \\<open>n' = 0\\<close> using cs_inj[of \\<open>\\<pi>'\\<guillemotleft>k'\\<close> \\<open>0\\<close> \\<open>n'\\<close> ] * assms(2) by (metis path_shift_def assms(4) last_cs nretkn path_path_shift)\n    thus \\<open>False\\<close> using ne * assms(3) by fastforce\n  qed\n  have n0':\\<open>n' > 0\\<close> proof (rule ccontr)\n    assume *: \\<open>\\<not> 0 < n'\\<close>    \n    hence 1:\\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> 0 = cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n\\<close> using assms(3,4) by auto\n    have \\<open>(\\<pi>'\\<guillemotleft>k') 0 = (\\<pi>\\<guillemotleft>k) 0\\<close> using assms(3) last_cs path_shift_def by (metis monoid_add_class.add.right_neutral)\n    hence \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> 0 = cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n\\<close> using 1 cs_0 by metis\n    hence n0: \\<open>n = 0\\<close> using cs_inj[of \\<open>\\<pi>\\<guillemotleft>k\\<close> \\<open>0\\<close> \\<open>n\\<close> ] * assms(1) by (metis path_shift_def assms(4) last_cs nretkn path_path_shift)\n    thus \\<open>False\\<close> using ne * assms(3) by fastforce\n  qed\n  have cdleswap': \\<open>\\<forall> j'<k'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' \\<longrightarrow> (\\<exists>j<k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> proof (rule,rule,rule, rule ccontr)\n    fix j' assume jk': \\<open>j'<k'\\<close> and ncdj': \\<open>(k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> and ne: \\<open>\\<not> (\\<exists>j<k. k + n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\n    hence kcdj': \\<open>k' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> using cr_wn' by blast \n      \n      then obtain j where kcdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using csk cs_path_swap_cd path by metis\n      hence jk: \\<open>j < k\\<close> unfolding is_cdi_def by auto\n      \n      have ncdn: \\<open>\\<not> (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using ne csj jk by blast \n      \n      obtain l' where lnocd': \\<open>l' = n' \\<or> n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l'\\<close> and cslsing': \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l' = [(\\<pi>'\\<guillemotleft>k') l']\\<close>        \n        proof cases\n          assume \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n' = [(\\<pi>'\\<guillemotleft>k') n']\\<close> thus \\<open>thesis\\<close> using that[of \\<open>n'\\<close>] by auto\n        next\n          assume *: \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n' \\<noteq> [(\\<pi>'\\<guillemotleft>k') n']\\<close>\n          then obtain x ys where \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n' = [x]@ys@[(\\<pi>'\\<guillemotleft>k') n']\\<close> by (metis append_Cons append_Nil cs_length_g_one cs_length_one(1) neq_Nil_conv) \n          then obtain l' where \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l' = [x]\\<close> and cdl': \\<open>n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l'\\<close> using cs_split[of \\<open>\\<pi>'\\<guillemotleft>k'\\<close> \\<open>n'\\<close> \\<open>Nil\\<close> \\<open>x\\<close> \\<open>ys\\<close>] by auto\n          hence \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l' = [(\\<pi>'\\<guillemotleft>k') l']\\<close> using last_cs by (metis last.simps) \n          thus \\<open>thesis\\<close> using that cdl' by auto\n      qed\n      hence ln': \\<open>l'\\<le>n'\\<close> unfolding is_cdi_def by auto\n      hence lcdj': \\<open>k'+l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> using jk' ncdj'  by (metis add_le_cancel_left cdi_prefix trans_less_add1)\n            \n      obtain l where lnocd: \\<open>l = n \\<or> n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l\\<close> and csl: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l'\\<close> using lnocd' proof\n        assume \\<open>l' = n'\\<close> thus \\<open>thesis\\<close> using csn that[of \\<open>n\\<close>] by auto\n        next\n        assume \\<open>n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l'\\<close>\n        then obtain l where \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l\\<close> \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l'\\<close> using cs_path_swap_cd path csn by (metis path_path_shift)\n        thus \\<open>thesis\\<close> using that by auto\n      qed\n      \n      have cslsing: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = [(\\<pi>\\<guillemotleft>k) l]\\<close> using cslsing' last_cs csl last.simps by metis\n      \n      have ln: \\<open>l\\<le>n\\<close> using lnocd unfolding is_cdi_def by auto\n      hence nretkl: \\<open>\\<pi> (k + l) \\<noteq> return\\<close> using term_path_stable[of \\<open>\\<pi>\\<close> \\<open>k+l\\<close> \\<open>k+n\\<close>] nretkn path(1) by auto  \n      \n      have *: \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l \\<Longrightarrow> k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k+l\\<close> using cd_path_shift[of \\<open>k\\<close> \\<open>k+l\\<close> \\<open>\\<pi>\\<close> \\<open>k+n\\<close>] path(1) by auto\n      \n      have ncdl: \\<open>\\<not> (k+l) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> apply rule using lnocd apply rule using ncdn apply blast using cd_trans ncdn * by blast      \n      \n      hence \\<open>\\<exists> i\\<in> {j..k+l}. \\<pi> i = ipd (\\<pi> j)\\<close> unfolding is_cdi_def using path(1) jk nretkl by auto\n      hence \\<open>\\<exists> i\\<in> {k<..k+l}. \\<pi> i = ipd (\\<pi> j)\\<close> using kcdj unfolding is_cdi_def by force\n      \n      then obtain i where ki: \\<open>k < i\\<close> and il: \\<open>i \\<le> k+l\\<close> and ipdi: \\<open>\\<pi> i = ipd (\\<pi> j)\\<close> by force\n      \n      hence \\<open>(\\<pi>\\<guillemotleft>k) (i-k) = ipd (\\<pi> j)\\<close> \\<open>i-k \\<le> l\\<close> by auto\n      hence pd: \\<open>(\\<pi>\\<guillemotleft>k) l pd\\<rightarrow> ipd (\\<pi> j)\\<close> using cs_single_pd_intermed[OF _ cslsing] path(1) path_path_shift by metis\n      moreover\n      have \\<open>(\\<pi>\\<guillemotleft>k) l = \\<pi>' (k' + l')\\<close> using csl last_cs by (metis path_shift_def)\n      moreover\n      have \\<open>\\<pi> j = \\<pi>' j'\\<close> using csj last_cs by metis\n      ultimately\n      have \\<open>\\<pi>' (k'+l') pd\\<rightarrow> ipd (\\<pi>' j')\\<close> by simp\n      moreover\n      have \\<open>ipd (\\<pi>' j') pd\\<rightarrow> \\<pi>' (k'+l')\\<close> using ipd_pd_cd[OF lcdj'] .\n      ultimately\n      have \\<open>\\<pi>' (k'+l') = ipd (\\<pi>' j')\\<close> using pd_antisym by auto\n      thus \\<open>False\\<close> using lcdj' unfolding is_cdi_def by force\n  qed\n  \n  \\<comment> \\<open>Symmetric version of the above statement\\<close>\n  have cdleswap: \\<open>\\<forall> j<k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<longrightarrow> (\\<exists>j'<k'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' \\<and> cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> proof (rule,rule,rule, rule ccontr)\n    fix j assume jk: \\<open>j<k\\<close> and ncdj: \\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and ne: \\<open>\\<not> (\\<exists>j'<k'. k' + n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' \\<and> cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\n    hence kcdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using cr_wn' by blast\n      \n      then obtain j' where kcdj': \\<open>k' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> and csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using csk cs_path_swap_cd path by metis\n      hence jk': \\<open>j' < k'\\<close> unfolding is_cdi_def by auto\n      \n      have ncdn': \\<open>\\<not> (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> using ne csj jk' by blast \n      \n      obtain l where lnocd: \\<open>l = n \\<or> n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l\\<close> and cslsing: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = [(\\<pi>\\<guillemotleft>k) l]\\<close>        \n        proof cases\n          assume \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = [(\\<pi>\\<guillemotleft>k) n]\\<close> thus \\<open>thesis\\<close> using that[of \\<open>n\\<close>] by auto\n        next\n          assume *: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n \\<noteq> [(\\<pi>\\<guillemotleft>k) n]\\<close>\n          then obtain x ys where \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = [x]@ys@[(\\<pi>\\<guillemotleft>k) n]\\<close> by (metis append_Cons append_Nil cs_length_g_one cs_length_one(1) neq_Nil_conv) \n          then obtain l where \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = [x]\\<close> and cdl: \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l\\<close> using cs_split[of \\<open>\\<pi>\\<guillemotleft>k\\<close> \\<open>n\\<close> \\<open>Nil\\<close> \\<open>x\\<close> \\<open>ys\\<close>] by auto\n          hence \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = [(\\<pi>\\<guillemotleft>k) l]\\<close> using last_cs by (metis last.simps) \n          thus \\<open>thesis\\<close> using that cdl by auto\n      qed\n      hence ln: \\<open>l\\<le>n\\<close> unfolding is_cdi_def by auto\n      hence lcdj: \\<open>k+l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using jk ncdj  by (metis add_le_cancel_left cdi_prefix trans_less_add1)\n            \n      obtain l' where lnocd': \\<open>l' = n' \\<or> n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l'\\<close> and csl: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l'\\<close> using lnocd proof\n        assume \\<open>l = n\\<close> thus \\<open>thesis\\<close> using csn that[of \\<open>n'\\<close>] by auto\n        next\n        assume \\<open>n cd\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup>\\<rightarrow> l\\<close>\n        then obtain l' where \\<open>n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l'\\<close> \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> l = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l'\\<close> using cs_path_swap_cd path csn by (metis path_path_shift)\n        thus \\<open>thesis\\<close> using that by auto\n      qed\n      \n      have cslsing': \\<open>cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> l' = [(\\<pi>'\\<guillemotleft>k') l']\\<close> using cslsing last_cs csl last.simps by metis\n      \n      have ln': \\<open>l'\\<le>n'\\<close> using lnocd' unfolding is_cdi_def by auto\n      hence nretkl': \\<open>\\<pi>' (k' + l') \\<noteq> return\\<close> using term_path_stable[of \\<open>\\<pi>'\\<close> \\<open>k'+l'\\<close> \\<open>k'+n'\\<close>] nretkn' path(2) by auto  \n      \n      have *: \\<open>n' cd\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup>\\<rightarrow> l' \\<Longrightarrow> k'+n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'+l'\\<close> using cd_path_shift[of \\<open>k'\\<close> \\<open>k'+l'\\<close> \\<open>\\<pi>'\\<close> \\<open>k'+n'\\<close>] path(2) by auto\n      \n      have ncdl': \\<open>\\<not> (k'+l') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> apply rule using lnocd' apply rule using ncdn' apply blast using cd_trans ncdn' * by blast      \n      \n      hence \\<open>\\<exists> i'\\<in> {j'..k'+l'}. \\<pi>' i' = ipd (\\<pi>' j')\\<close> unfolding is_cdi_def using path(2) jk' nretkl' by auto\n      hence \\<open>\\<exists> i'\\<in> {k'<..k'+l'}. \\<pi>' i' = ipd (\\<pi>' j')\\<close> using kcdj' unfolding is_cdi_def by force\n      \n      then obtain i' where ki': \\<open>k' < i'\\<close> and il': \\<open>i' \\<le> k'+l'\\<close> and ipdi: \\<open>\\<pi>' i' = ipd (\\<pi>' j')\\<close> by force\n      \n      hence \\<open>(\\<pi>'\\<guillemotleft>k') (i'-k') = ipd (\\<pi>' j')\\<close> \\<open>i'-k' \\<le> l'\\<close> by auto\n      hence pd: \\<open>(\\<pi>'\\<guillemotleft>k') l' pd\\<rightarrow> ipd (\\<pi>' j')\\<close> using cs_single_pd_intermed[OF _ cslsing'] path(2) path_path_shift by metis\n      moreover\n      have \\<open>(\\<pi>'\\<guillemotleft>k') l' = \\<pi> (k + l)\\<close> using csl last_cs by (metis path_shift_def)\n      moreover\n      have \\<open>\\<pi>' j' = \\<pi> j\\<close> using csj last_cs by metis\n      ultimately\n      have \\<open>\\<pi> (k+l) pd\\<rightarrow> ipd (\\<pi> j)\\<close> by simp\n      moreover\n      have \\<open>ipd (\\<pi> j) pd\\<rightarrow> \\<pi> (k+l)\\<close> using ipd_pd_cd[OF lcdj] .\n      ultimately\n      have \\<open>\\<pi> (k+l) = ipd (\\<pi> j)\\<close> using pd_antisym by auto\n      thus \\<open>False\\<close> using lcdj unfolding is_cdi_def by force\n  qed\n  \n  have cdle: \\<open>\\<exists>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k\\<close> (is \\<open>\\<exists> j. ?P j\\<close>) proof (rule ccontr)\n    assume \\<open>\\<not> (\\<exists>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k)\\<close>\n    hence allge: \\<open>\\<forall>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<longrightarrow> k \\<le> j\\<close> by auto\n    have allge': \\<open>\\<forall>j'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' \\<longrightarrow> k' \\<le> j'\\<close> proof (rule, rule, rule ccontr)\n      fix j' \n      assume *: \\<open>k' + n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> and \\<open>\\<not> k' \\<le> j'\\<close>\n      then obtain j where \\<open>j<k\\<close> \\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using cdleswap' by (metis le_neq_implies_less nat_le_linear)\n      thus \\<open>False\\<close> using allge by auto\n    qed\n    have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k + n) = cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n\\<close> using cs_split_shift_nocd[OF assms(1) _ allge] n0 by auto\n    moreover\n    have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (k' + n') = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using cs_split_shift_nocd[OF assms(2) _ allge'] n0' by auto\n    ultimately\n    show \\<open>False\\<close> using ne assms(4) by auto\n  qed\n  \n  define j where  \\<open>j == GREATEST j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k\\<close>  \n  have cdj:\\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and jk: \\<open>j < k\\<close> and jge:\\<open>\\<forall> j'< k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j' \\<longrightarrow> j' \\<le> j\\<close> proof -\n    have bound: \\<open>\\<forall> y. ?P y \\<longrightarrow> y \\<le> k\\<close> by auto\n    show \\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using GreatestI_nat[of \\<open>?P\\<close>] j_def bound cdle by blast\n    show \\<open>j < k\\<close> using GreatestI_nat[of \\<open>?P\\<close>] bound j_def cdle by blast\n    show \\<open>\\<forall> j'< k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j' \\<longrightarrow> j' \\<le> j\\<close> using Greatest_le_nat[of \\<open>?P\\<close>] bound j_def by blast\n  qed\n    \n  obtain j' where cdj':\\<open>(k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> and csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close>  and jk': \\<open>j' < k'\\<close> using cdleswap cdj jk by blast\n  have jge':\\<open>\\<forall> i'< k'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i' \\<longrightarrow> i' \\<le> j'\\<close> proof(rule,rule,rule)\n    fix i'\n    assume ik': \\<open>i' < k'\\<close> and cdi': \\<open>k' + n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'\\<close>\n    then obtain i where cdi:\\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> and csi: \\<open> cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i\\<close> and ik: \\<open>i<k\\<close> using cdleswap' by force \n    have ij: \\<open>i \\<le> j\\<close> using jge cdi ik by auto\n    show \\<open>i' \\<le> j'\\<close> using cs_order_le[OF assms(1,2) csi[symmetric] csj _ ij] cd_not_ret[OF cdi] by simp\n  qed\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k + n) = cs\\<^bsup>\\<pi>\\<^esup> j @ cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n\\<close> using  cs_split_shift_cd[OF cdj jk _ jge] n0 by auto\n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (k' + n') = cs\\<^bsup>\\<pi>'\\<^esup> j' @ cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using  cs_split_shift_cd[OF cdj' jk' _ jge'] n0' by auto\n  ultimately\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k+n) = cs\\<^bsup>\\<pi>'\\<^esup> (k'+n')\\<close> using csj assms(4) by auto\n  thus \\<open>False\\<close> using ne by simp\nqed\n\nlemma cs_eq_is_eq_shifted: assumes \\<open>is_path \\<pi>\\<close> and \\<open>is_path \\<pi>'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k+n) = cs\\<^bsup>\\<pi>'\\<^esup> (k'+n')\\<close> shows \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n'\\<close>\nproof (rule ccontr)\n  assume ne: \\<open>cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n \\<noteq> cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close>\n  have nretkn:\\<open>\\<pi> (k+n) \\<noteq> return\\<close> proof \n    assume 1:\\<open>\\<pi> (k+n) = return\\<close>\n    hence 2:\\<open>\\<pi>' (k'+n') = return\\<close> using assms(4) last_cs by metis\n    hence \\<open>(\\<pi>\\<guillemotleft>k) n = return\\<close> \\<open>(\\<pi>'\\<guillemotleft>k') n' = return\\<close> using 1 by auto\n    hence \\<open>cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using cs_return by metis \n    thus \\<open>False\\<close> using ne by simp\n  qed\n  hence nretk: \\<open>\\<pi> k \\<noteq> return\\<close> using term_path_stable[OF assms(1), of \\<open>k\\<close> \\<open>k +n\\<close>] by auto\n  have nretkn': \\<open>\\<pi>' (k'+n') \\<noteq> return\\<close> proof \n    assume 1:\\<open>\\<pi>' (k'+n') = return\\<close>\n    hence 2:\\<open>\\<pi> (k+n) = return\\<close> using assms(4) last_cs by metis\n    hence \\<open>(\\<pi>\\<guillemotleft>k) n = return\\<close> \\<open>(\\<pi>'\\<guillemotleft>k') n' = return\\<close> using 1 by auto\n    hence \\<open>cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using cs_return by metis \n    thus \\<open>False\\<close> using ne by simp\n  qed\n  hence nretk': \\<open>\\<pi>' k' \\<noteq> return\\<close> using term_path_stable[OF assms(2), of \\<open>k'\\<close> \\<open>k' +n'\\<close>] by auto\n  have n0:\\<open>n > 0\\<close> proof (rule ccontr)\n    assume *: \\<open>\\<not> 0 < n\\<close>    \n    hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>'\\<^esup> (k'+ n')\\<close> using assms(3,4) by auto\n    hence n0: \\<open>n = 0\\<close> \\<open>n' = 0\\<close> using cs_inj[OF assms(2) nretkn', of \\<open>k'\\<close>] * by auto\n    have \\<open>cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> unfolding n0 cs_0 by (auto , metis last_cs assms(3))\n    thus \\<open>False\\<close> using ne by simp\n  qed\n  have n0':\\<open>n' > 0\\<close> proof (rule ccontr)\n    assume *: \\<open>\\<not> 0 < n'\\<close>    \n    hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>\\<^esup> (k+ n)\\<close> using assms(3,4) by auto\n    hence n0: \\<open>n = 0\\<close> \\<open>n' = 0\\<close> using cs_inj[OF assms(1) nretkn, of \\<open>k\\<close>] * by auto\n    have \\<open>cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> unfolding n0 cs_0 by (auto , metis last_cs assms(3))\n    thus \\<open>False\\<close> using ne by simp\n  qed\n  have cdle: \\<open>\\<exists>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k\\<close> (is \\<open>\\<exists> j. ?P j\\<close>) proof (rule ccontr)\n    assume \\<open>\\<not> (\\<exists>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k)\\<close>\n    hence allge: \\<open>\\<forall>j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<longrightarrow> k \\<le> j\\<close> by auto\n    have allge': \\<open>\\<forall>j'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j' \\<longrightarrow> k' \\<le> j'\\<close> proof (rule, rule)\n      fix j' \n      assume *: \\<open>k' + n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close>\n      obtain j where cdj: \\<open>k+n cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using cs_path_swap_cd[OF assms(2,1) assms(4)[symmetric] *] by metis\n      hence kj:\\<open>k \\<le> j\\<close> using allge by auto\n      thus kj': \\<open>k' \\<le> j'\\<close> using cs_order_le[OF assms(1,2,3) csj nretk] by simp\n    qed\n    have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k + n) = cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n\\<close> using cs_split_shift_nocd[OF assms(1) _ allge] n0 by auto\n    moreover\n    have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (k' + n') = cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using cs_split_shift_nocd[OF assms(2) _ allge'] n0' by auto\n    ultimately\n    show \\<open>False\\<close> using ne assms(4) by auto\n  qed\n  define j where  \\<open>j == GREATEST j. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j \\<and> j < k\\<close>  \n  have cdj:\\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> and jk: \\<open>j < k\\<close> and jge:\\<open>\\<forall> j'< k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j' \\<longrightarrow> j' \\<le> j\\<close> proof -\n    have bound: \\<open>\\<forall> y. ?P y \\<longrightarrow> y \\<le> k\\<close> by auto\n    show \\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> using GreatestI_nat[of \\<open>?P\\<close>] bound j_def cdle by blast\n    show \\<open>j < k\\<close> using GreatestI_nat[of \\<open>?P\\<close>] bound j_def cdle by blast\n    show \\<open>\\<forall> j'< k. (k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j' \\<longrightarrow> j' \\<le> j\\<close> using Greatest_le_nat[of \\<open>?P\\<close>] bound j_def by blast\n  qed\n  obtain j' where cdj':\\<open>(k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> j'\\<close> and csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using cs_path_swap_cd assms cdj by blast\n  have jge':\\<open>\\<forall> i'< k'. (k'+n') cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i' \\<longrightarrow> i' \\<le> j'\\<close> proof(rule,rule,rule)\n    fix i'\n    assume ik': \\<open>i' < k'\\<close> and cdi': \\<open>k' + n' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'\\<close>\n    then obtain i where cdi:\\<open>(k+n) cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> and csi: \\<open> cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i\\<close> using cs_path_swap_cd[OF assms(2,1) assms(4)[symmetric]] by blast\n    have nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close> by (metis cd_not_ret cdi')\n    have ik: \\<open>i < k\\<close> using cs_order[OF assms(2,1) csi _ nreti' ik'] assms(3) by auto\n    have ij: \\<open>i \\<le> j\\<close> using jge cdi ik by auto\n    show \\<open>i' \\<le> j'\\<close> using cs_order_le[OF assms(1,2) csi[symmetric] csj _ ij] cd_not_ret[OF cdi] by simp\n  qed\n  have jk': \\<open>j' < k'\\<close> using cs_order[OF assms(1,2) csj assms(3) cd_not_ret[OF cdj] jk] .\n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (k + n) = cs\\<^bsup>\\<pi>\\<^esup> j @ cs\\<^bsup>\\<pi> \\<guillemotleft> k\\<^esup> n\\<close> using  cs_split_shift_cd[OF cdj jk _ jge] n0 by auto\n  moreover\n  have \\<open>cs\\<^bsup>\\<pi>'\\<^esup> (k' + n') = cs\\<^bsup>\\<pi>'\\<^esup> j' @ cs\\<^bsup>\\<pi>' \\<guillemotleft> k'\\<^esup> n'\\<close> using  cs_split_shift_cd[OF cdj' jk' _ jge'] n0' by auto\n  ultimately\n  have \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>k\\<^esup> n = cs\\<^bsup>\\<pi>'\\<guillemotleft>k'\\<^esup> n'\\<close> using csj assms(4) by auto\n  thus \\<open>False\\<close> using ne by simp\nqed\n\nlemma converged_cd_diverge_cs: assumes \\<open>is_path \\<pi>\\<close> and \\<open>is_path \\<pi>'\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> j  = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> and \\<open>j<l\\<close> and \\<open>\\<not> (\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l')\\<close> and \\<open>l < m\\<close> and \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close>\nobtains k k' where \\<open>j\\<le>k\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> and \\<open>\\<pi> (Suc k) \\<noteq> \\<pi>' (Suc k')\\<close>\n  proof -  \n  have \\<open>is_path (\\<pi>\\<guillemotleft>j)\\<close> \\<open>is_path (\\<pi>'\\<guillemotleft>j')\\<close> using assms(1,2) path_path_shift by auto\n  moreover\n  have \\<open>(\\<pi>\\<guillemotleft>j) 0 = (\\<pi>'\\<guillemotleft>j') 0\\<close> using assms(3) last_cs by (metis path_shift_def add.right_neutral)\n  moreover\n  have \\<open>\\<not>(\\<exists>l'. cs\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup> (l-j) = cs\\<^bsup>\\<pi>'\\<guillemotleft>j'\\<^esup> l')\\<close> proof \n    assume \\<open>\\<exists>l'. cs\\<^bsup>\\<pi> \\<guillemotleft> j\\<^esup> (l - j) = cs\\<^bsup>\\<pi>' \\<guillemotleft> j'\\<^esup> l'\\<close>\n    then obtain l' where csl: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup> (l - j) = cs\\<^bsup>\\<pi>'\\<guillemotleft>j'\\<^esup> l'\\<close> by blast\n      \n    have \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> (j' + l')\\<close> using shifted_cs_eq_is_eq[OF assms(1,2,3) csl] assms(4) by auto\n    thus \\<open>False\\<close> using assms(5) by blast\n  qed\n  moreover\n  have \\<open>l-j < m-j\\<close> using assms by auto\n  moreover\n  have \\<open>\\<pi> j \\<noteq> return\\<close> using cs_return assms(1-5) term_path_stable by (metis nat_less_le) \n  hence \\<open>j'<m'\\<close> using cs_order[OF assms(1,2,3,7)] assms by auto\n  hence \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup> (m-j) = cs\\<^bsup>\\<pi>'\\<guillemotleft>j'\\<^esup> (m'-j')\\<close> using cs_eq_is_eq_shifted[OF assms(1,2,3),of \\<open>m-j\\<close> \\<open>m'-j'\\<close>] assms(4,6,7) by auto\n  ultimately\n  obtain k k' where csk: \\<open>cs\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup> k = cs\\<^bsup>\\<pi>'\\<guillemotleft>j'\\<^esup> k'\\<close> and lcdk: \\<open>l-j cd\\<^bsup>\\<pi>\\<guillemotleft>j\\<^esup>\\<rightarrow> k\\<close> and suc:\\<open>(\\<pi>\\<guillemotleft>j) (Suc k) \\<noteq> (\\<pi>'\\<guillemotleft>j') (Suc k')\\<close> using converged_cd_diverge by blast\n  \n  have \\<open>cs\\<^bsup>\\<pi>\\<^esup> (j+k) = cs\\<^bsup>\\<pi>'\\<^esup> (j'+k')\\<close> using shifted_cs_eq_is_eq[OF assms(1-3) csk] .\n  moreover\n  have \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j+k\\<close> using lcdk assms(1,2,4) by (metis add.commute add_diff_cancel_right' cd_path_shift le_add1)\n  moreover\n  have \\<open>\\<pi> (Suc (j+k)) \\<noteq> \\<pi>' (Suc (j'+ k'))\\<close> using suc by auto\n  moreover\n  have \\<open>j \\<le> j+k\\<close> by auto\n  ultimately\n  show \\<open>thesis\\<close> using that[of \\<open>j+k\\<close> \\<open>j'+k'\\<close>] by auto\nqed\n\n\nlemma cs_ipd_conv: assumes csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> and ipd: \\<open>\\<pi> l = ipd (\\<pi> k)\\<close> \\<open>\\<pi>' l' = ipd(\\<pi>' k')\\<close> \n  and nipd: \\<open>\\<forall>n\\<in>{k..<l}. \\<pi> n \\<noteq> ipd (\\<pi> k)\\<close> \\<open>\\<forall>n'\\<in>{k'..<l'}. \\<pi>' n' \\<noteq> ipd (\\<pi>' k')\\<close> and kl: \\<open>k < l\\<close> \\<open>k' < l'\\<close> \nshows \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> using cs_ipd[OF ipd(1) nipd(1) kl(1)] cs_ipd[OF ipd(2) nipd(2) kl(2)] csk ipd by (metis (no_types) last_cs)\n\nlemma cp_eq_cs: assumes \\<open>((\\<sigma>,k),(\\<sigma>',k'))\\<in>cp\\<close> shows \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close> \n  using assms \n  apply(induction rule: cp.induct) \n     apply blast+ \n  apply simp \n  done \n\nlemma cd_cs_swap: assumes \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> k\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> shows \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> k'\\<close> proof -\n  have \\<open>\\<exists> i. l icd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close> using assms(1) excd_impl_exicd by blast\n  hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> l \\<noteq> [\\<pi> l]\\<close> by auto\n  hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' \\<noteq> [\\<pi>' l']\\<close> using assms last_cs by metis\n  hence \\<open>\\<exists> i'. l' icd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'\\<close> by (metis cs_cases)\n  hence path': \\<open>is_path \\<pi>'\\<close> unfolding is_icdi_def is_cdi_def by auto\n  from cd_in_cs[OF assms(1)]\n  obtain ys where csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>\\<^esup> k @ ys @ [\\<pi> l]\\<close> by blast\n  obtain xs where csk: \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = xs@[\\<pi> k]\\<close> by (metis append_butlast_last_id cs_not_nil last_cs)\n  have \\<pi>l: \\<open>\\<pi> l = \\<pi>' l'\\<close> using assms last_cs by metis\n  have csl': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = xs@[\\<pi> k]@ys@[\\<pi>' l']\\<close> by (metis \\<pi>l append_eq_appendI assms(2) csk csl)\n  from cs_split[of \\<open>\\<pi>'\\<close> \\<open>l'\\<close> \\<open>xs\\<close> \\<open>\\<pi> k\\<close> \\<open>ys\\<close>]\n  obtain m where csm: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> m = xs @ [\\<pi> k]\\<close> and lcdm: \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> m\\<close> using csl' by metis \n  have csm': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> by (metis assms(3) csk csm)\n  have \\<open>\\<pi>' m \\<noteq> return\\<close> using lcdm unfolding is_cdi_def using term_path_stable by (metis nat_less_le)\n  hence \\<open>m = k'\\<close> using cs_inj path' csm' by auto\n  thus \\<open>?thesis\\<close> using lcdm by auto\nqed\n\n\nsubsection \\<open>Facts about Observations\\<close>\nlemma kth_obs_not_none: assumes \\<open>is_kth_obs (path \\<sigma>) k i\\<close> obtains a where \\<open>obsp \\<sigma> i = Some a\\<close> using assms unfolding is_kth_obs_def obsp_def by auto\n\nlemma kth_obs_unique: \\<open>is_kth_obs \\<pi> k i \\<Longrightarrow> is_kth_obs \\<pi> k j \\<Longrightarrow> i = j\\<close> proof (induction \\<open>i\\<close> \\<open>j\\<close> rule: nat_sym_cases)\n  case sym thus \\<open>?case\\<close> by simp\nnext\n  case eq thus \\<open>?case\\<close> by simp\nnext\n  case (less i j) \n  have \\<open>obs_ids \\<pi> \\<inter> {..<i} \\<subseteq> obs_ids \\<pi> \\<inter> {..<j}\\<close> using less(1) by auto\n  moreover\n  have \\<open>i \\<in> obs_ids \\<pi> \\<inter> {..<j}\\<close> using less unfolding is_kth_obs_def obs_ids_def by auto\n  moreover  \n  have \\<open>i \\<notin> obs_ids \\<pi> \\<inter> {..<i}\\<close> by auto\n  moreover \n  have \\<open>card (obs_ids \\<pi> \\<inter> {..<i}) = card (obs_ids \\<pi> \\<inter> {..<j})\\<close> using less.prems unfolding is_kth_obs_def by auto\n  moreover\n  have \\<open>finite (obs_ids \\<pi> \\<inter> {..<i})\\<close> \\<open>finite (obs_ids \\<pi> \\<inter> {..<j})\\<close> by auto\n  ultimately \n  have \\<open>False\\<close> by (metis card_subset_eq)\n  thus \\<open>?case\\<close> ..\nqed\n\nlemma obs_none_no_kth_obs: assumes \\<open>obs \\<sigma> k = None\\<close> shows \\<open>\\<not> (\\<exists> i. is_kth_obs (path \\<sigma>) k i)\\<close> \n  apply rule\n  using assms \n  unfolding obs_def obsp_def \n  apply (auto split: option.split_asm)  \n  by (metis assms kth_obs_not_none kth_obs_unique obs_def option.distinct(2) the_equality)\n\nlemma obs_some_kth_obs : assumes \\<open>obs \\<sigma> k \\<noteq> None\\<close> obtains i where \\<open>is_kth_obs (path \\<sigma>) k i\\<close> by (metis obs_def assms)\n\nlemma not_none_is_obs: assumes \\<open>att(\\<pi> i) \\<noteq> None\\<close> shows \\<open>is_kth_obs \\<pi> (card (obs_ids \\<pi> \\<inter> {..<i})) i\\<close>  unfolding is_kth_obs_def using assms by auto\n\nlemma in_obs_ids_is_kth_obs: assumes \\<open>i \\<in> obs_ids \\<pi>\\<close> obtains k where \\<open>is_kth_obs \\<pi> k i\\<close> proof \n  have \\<open>att (\\<pi> i) \\<noteq> None\\<close> using assms obs_ids_def by auto \n  thus \\<open>is_kth_obs \\<pi> (card (obs_ids \\<pi> \\<inter> {..<i})) i\\<close> using not_none_is_obs by auto\nqed\n\nlemma kth_obs_stable: assumes \\<open>is_kth_obs \\<pi> l j\\<close> \\<open>k < l\\<close> shows \\<open>\\<exists> i. is_kth_obs \\<pi> k i\\<close> using assms proof (induction \\<open>l\\<close> arbitrary: \\<open>j\\<close> rule: less_induct )\n  case (less l j)\n  have cardl: \\<open>card (obs_ids \\<pi> \\<inter> {..<j}) = l\\<close> using less is_kth_obs_def by auto\n  then obtain i where  ex: \\<open>i \\<in> obs_ids \\<pi> \\<inter> {..<j}\\<close> (is \\<open>?P i\\<close>) using less(3) by (metis card.empty empty_iff less_irrefl subsetI subset_antisym zero_diff zero_less_diff)\n  have bound: \\<open>\\<forall> i. i \\<in> obs_ids \\<pi> \\<inter> {..<j} \\<longrightarrow> i \\<le> j\\<close> by auto\n  let \\<open>?i\\<close> = \\<open>GREATEST i. i \\<in> obs_ids \\<pi> \\<inter> {..<j}\\<close>\n  have *: \\<open>?i < j\\<close> \\<open>?i \\<in> obs_ids \\<pi>\\<close> using GreatestI_nat[of \\<open>?P\\<close> \\<open>i\\<close> \\<open>j\\<close>] ex bound by auto\n  have **: \\<open>\\<forall> i. i \\<in> obs_ids \\<pi> \\<and> i<j \\<longrightarrow> i \\<le> ?i\\<close> using Greatest_le_nat[of \\<open>?P\\<close> _ \\<open>j\\<close>] ex bound by auto\n  have \\<open>(obs_ids \\<pi> \\<inter> {..<?i}) \\<union> {?i} = obs_ids \\<pi> \\<inter> {..<j}\\<close> apply rule apply auto using *[simplified] apply simp+ using **[simplified] by auto\n  moreover\n  have \\<open>?i \\<notin> (obs_ids \\<pi> \\<inter> {..<?i})\\<close> by auto\n  ultimately\n  have \\<open>Suc (card (obs_ids \\<pi> \\<inter> {..<?i})) = l\\<close> using cardl by (metis Un_empty_right Un_insert_right card_insert_disjoint finite_Int finite_lessThan)\n  hence \\<open>card (obs_ids \\<pi> \\<inter> {..<?i}) = l - 1\\<close> by auto\n  hence iko: \\<open>is_kth_obs \\<pi> (l - 1) ?i\\<close> using *(2) unfolding is_kth_obs_def obs_ids_def by auto\n  have ll: \\<open>l - 1 < l\\<close> by (metis One_nat_def diff_Suc_less less.prems(2) not_gr0 not_less0)\n  note IV=less(1)[OF ll iko]\n  show \\<open>?thesis\\<close> proof cases\n    assume \\<open>k < l - 1\\<close> thus \\<open>?thesis\\<close> using IV by simp\n  next\n    assume \\<open>\\<not> k < l - 1\\<close>\n    hence \\<open>k = l - 1\\<close> using less by auto\n    thus \\<open>?thesis\\<close> using iko by blast\n  qed\nqed\n\nlemma kth_obs_mono: assumes \\<open>is_kth_obs \\<pi> k i\\<close> \\<open>is_kth_obs \\<pi> l j\\<close> \\<open>k < l\\<close> shows \\<open>i < j\\<close> proof (rule ccontr)\n  assume \\<open>\\<not> i < j\\<close>\n  hence \\<open>{..<j} \\<subseteq> {..<i}\\<close> by auto\n  hence \\<open>obs_ids \\<pi> \\<inter> {..<j} \\<subseteq> obs_ids \\<pi> \\<inter> {..<i}\\<close> by auto\n  moreover \n  have \\<open>finite (obs_ids \\<pi> \\<inter> {..<i})\\<close> by auto\n  ultimately\n  have \\<open>card (obs_ids \\<pi> \\<inter> {..<j}) \\<le> card (obs_ids \\<pi> \\<inter> {..<i})\\<close> by (metis card_mono)\n  thus \\<open>False\\<close> using assms unfolding is_kth_obs_def by auto\nqed\n\nlemma kth_obs_le_iff: assumes \\<open>is_kth_obs \\<pi> k i\\<close> \\<open>is_kth_obs \\<pi> l j\\<close>  shows \\<open>k < l \\<longleftrightarrow> i < j\\<close> by (metis assms kth_obs_unique kth_obs_mono not_less_iff_gr_or_eq)\n\nlemma ret_obs_all_obs: assumes path: \\<open>is_path \\<pi>\\<close> and iki: \\<open>is_kth_obs \\<pi> k i\\<close> and ret: \\<open>\\<pi> i = return\\<close> and kl: \\<open>k < l\\<close> obtains j where \\<open>is_kth_obs \\<pi> l j\\<close>\nproof-\n  show \\<open>thesis\\<close>\n  using kl iki ret proof (induction \\<open>l - k\\<close> arbitrary: \\<open>k\\<close> \\<open>i\\<close> rule: less_induct)\n    case (less k i)\n    note kl = \\<open>k < l\\<close>\n    note iki = \\<open>is_kth_obs \\<pi> k i\\<close>\n    note ret = \\<open>\\<pi> i = return\\<close>  \n    have card: \\<open>card (obs_ids \\<pi> \\<inter> {..<i}) = k\\<close> and att_ret: \\<open>att return \\<noteq> None\\<close>using iki ret unfolding is_kth_obs_def by auto\n    have rets: \\<open>\\<pi> (Suc i) = return\\<close> using path ret term_path_stable by auto\n    hence attsuc: \\<open>att (\\<pi> (Suc i)) \\<noteq> None\\<close> using att_ret by auto\n    hence *: \\<open>i \\<in> obs_ids \\<pi>\\<close> using att_ret ret unfolding obs_ids_def by auto\n    have \\<open>{..< Suc i} = insert i {..<i}\\<close> by auto\n    hence a: \\<open>obs_ids \\<pi> \\<inter> {..< Suc i} = insert i (obs_ids \\<pi> \\<inter> {..<i})\\<close> using * by auto\n    have b: \\<open>i \\<notin> obs_ids \\<pi> \\<inter> {..<i}\\<close> by auto\n    have \\<open>finite (obs_ids \\<pi> \\<inter> {..<i})\\<close> by auto\n    hence \\<open>card (obs_ids \\<pi> \\<inter> {..<Suc i}) = Suc k\\<close> by (metis card card_insert_disjoint a b)\n    hence iksuc: \\<open>is_kth_obs \\<pi> (Suc k) (Suc i)\\<close> using attsuc unfolding is_kth_obs_def by auto\n    have suckl: \\<open>Suc k \\<le> l\\<close> using kl by auto\n    note less\n    thus \\<open>thesis\\<close> proof (cases \\<open>Suc k < l\\<close>) \n      assume skl: \\<open>Suc k < l\\<close> \n      from less(1)[OF _ skl iksuc rets] skl\n      show \\<open>thesis\\<close> by auto\n    next\n      assume \\<open>\\<not> Suc k < l\\<close>\n      hence \\<open>Suc k = l\\<close> using suckl by auto\n      thus \\<open>thesis\\<close> using iksuc that by auto\n    qed\n  qed\nqed\n\nlemma no_kth_obs_missing_cs: assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and iki: \\<open>is_kth_obs \\<pi> k i\\<close> and not_in_\\<pi>': \\<open>\\<not>(\\<exists>i'. is_kth_obs \\<pi>' k i')\\<close>  obtains  l j where \\<open>is_kth_obs \\<pi> l j\\<close> \\<open>\\<not> (\\<exists> j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\nproof (rule ccontr)\n  assume \\<open>\\<not> thesis\\<close>\n  hence all_in_\\<pi>': \\<open>\\<forall> l j. is_kth_obs \\<pi> l j \\<longrightarrow> (\\<exists> j' . cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> using that by blast\n  then obtain i' where csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using assms by blast    \n  hence \\<open>att(\\<pi>' i') \\<noteq> None\\<close> using iki by (metis is_kth_obs_def last_cs)\n  then obtain k' where ik': \\<open>is_kth_obs \\<pi>' k' i'\\<close> by (metis not_none_is_obs)\n  hence kk': \\<open>k' < k\\<close> using not_in_\\<pi>' kth_obs_stable by (auto, metis not_less_iff_gr_or_eq)\n  show \\<open>False\\<close> proof (cases \\<open>\\<pi> i = return\\<close>)\n    assume \\<open>\\<pi> i \\<noteq> return\\<close>\n    thus \\<open>False\\<close> using kk' ik' csi iki proof (induction \\<open>k\\<close> arbitrary: \\<open>i\\<close> \\<open>i'\\<close> \\<open>k'\\<close> )\n      case 0 thus \\<open>?case\\<close> by simp\n    next\n      case (Suc k i i' k')      \n      then obtain j where ikj: \\<open>is_kth_obs \\<pi> k j\\<close> by (metis kth_obs_stable lessI)\n      then obtain j' where csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using all_in_\\<pi>' by blast    \n      hence \\<open>att(\\<pi>' j') \\<noteq> None\\<close> using ikj by (metis is_kth_obs_def last_cs)\n      then obtain k2 where ik2: \\<open>is_kth_obs \\<pi>' k2 j'\\<close> by (metis not_none_is_obs)\n      have ji: \\<open>j < i\\<close> using kth_obs_mono [OF ikj \\<open>is_kth_obs \\<pi> (Suc k) i\\<close>] by auto\n      hence nretj: \\<open>\\<pi> j \\<noteq> return\\<close> using Suc(2) term_path_stable less_imp_le path(1) by metis    \n      have ji': \\<open>j' < i'\\<close> using cs_order[OF path _ _ nretj, of \\<open>j'\\<close> \\<open>i\\<close> \\<open>i'\\<close>] csj \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>  ji by auto\n      have \\<open>k2 \\<noteq> k'\\<close> using ik2 Suc(4) ji' kth_obs_unique[of \\<open>\\<pi>'\\<close> \\<open>k'\\<close> \\<open>i'\\<close> \\<open>j'\\<close>] by (metis less_irrefl)\n      hence k2k': \\<open>k2 < k'\\<close> using kth_obs_mono[OF \\<open>is_kth_obs \\<pi>' k' i'\\<close> ik2] ji' by (metis not_less_iff_gr_or_eq)\n      hence k2k: \\<open>k2 < k\\<close> using Suc by auto\n      from Suc.IH[OF nretj k2k ik2 csj ikj] show \\<open>False\\<close> .\n    qed\n  next\n    assume \\<open>\\<pi> i = return\\<close>\n    hence reti': \\<open>\\<pi>' i' = return\\<close> by (metis csi last_cs)\n    from ret_obs_all_obs[OF path(2) ik' reti' kk', of \\<open>False\\<close>] not_in_\\<pi>'\n    show \\<open>False\\<close> by blast\n  qed\nqed\n\nlemma kth_obs_cs_missing_cs:  assumes path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> and iki: \\<open>is_kth_obs \\<pi> k i\\<close> and iki': \\<open>is_kth_obs \\<pi>' k i'\\<close> and csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> \nobtains l j where \\<open>j \\<le> i\\<close> \\<open>is_kth_obs \\<pi> l j\\<close> \\<open>\\<not> (\\<exists> j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> | l' j' where \\<open>j' \\<le> i'\\<close> \\<open>is_kth_obs \\<pi>' l' j'\\<close> \\<open>\\<not> (\\<exists> j. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\nproof (rule ccontr)\n  assume nt: \\<open>\\<not> thesis\\<close> \n  show \\<open>False\\<close> using iki iki' csi that proof (induction \\<open>k\\<close> arbitrary: \\<open>i\\<close> \\<open>i'\\<close> rule: less_induct)\n    case (less k i i')\n    hence all_in_\\<pi>': \\<open>\\<forall> l j. j\\<le>i \\<and> is_kth_obs \\<pi> l j \\<longrightarrow> (\\<exists> j' . cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> \n    and all_in_\\<pi>: \\<open>\\<forall> l' j'. j' \\<le> i' \\<and> is_kth_obs \\<pi>' l' j' \\<longrightarrow> (\\<exists> j . cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> by (metis nt) (metis nt less(6))\n    obtain j j' where csji: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> and csij: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using all_in_\\<pi> all_in_\\<pi>' less by blast \n    then obtain l l' where ilj: \\<open>is_kth_obs \\<pi> l j\\<close> and ilj': \\<open>is_kth_obs \\<pi>' l' j'\\<close> by (metis is_kth_obs_def last_cs less.prems(1,2))\n    have lnk: \\<open>l \\<noteq> k\\<close> using ilj csji less(2) less(4) kth_obs_unique by auto\n    have lnk': \\<open>l' \\<noteq> k\\<close> using ilj' csij less(3) less(4) kth_obs_unique by auto\n    have cseq: \\<open>\\<forall> l j j'. l < k \\<and>  is_kth_obs \\<pi> l j \\<and> is_kth_obs \\<pi>' l j' \\<longrightarrow> cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> proof - \n      { fix t p p' assume tk: \\<open>t < k\\<close> and ikp: \\<open>is_kth_obs \\<pi> t p\\<close> and ikp': \\<open>is_kth_obs \\<pi>' t p'\\<close> \n        hence pi: \\<open>p < i\\<close> and pi': \\<open>p' < i'\\<close> by (metis kth_obs_mono less.prems(1)) (metis kth_obs_mono less.prems(2) tk ikp') \n        have *: \\<open>\\<And>j l. j \\<le> p \\<Longrightarrow> is_kth_obs \\<pi> l j \\<Longrightarrow> \\<exists>j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using pi all_in_\\<pi>' by auto\n        have **: \\<open>\\<And>j' l'. j' \\<le> p' \\<Longrightarrow> is_kth_obs \\<pi>' l' j' \\<Longrightarrow> \\<exists>j. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using pi' all_in_\\<pi> by auto\n        have \\<open>cs\\<^bsup>\\<pi>\\<^esup> p = cs\\<^bsup>\\<pi>'\\<^esup> p'\\<close> apply(rule ccontr) using less(1)[OF tk ikp ikp'] * ** by blast\n      }\n      thus \\<open>?thesis\\<close> by blast\n    qed\n    have ii'nret: \\<open>\\<pi> i \\<noteq> return \\<or> \\<pi>' i' \\<noteq> return\\<close> using less cs_return by auto\n    have a: \\<open>k < l \\<or> k < l'\\<close> proof (rule ccontr)\n      assume \\<open>\\<not>(k < l \\<or> k < l')\\<close> \n      hence *: \\<open>l < k\\<close> \\<open>l' < k\\<close> using lnk lnk' by auto\n      hence ji: \\<open>j < i\\<close> and ji': \\<open>j' < i'\\<close> using ilj ilj' less(2,3) kth_obs_mono by auto      \n      show \\<open>False\\<close> using ii'nret proof\n        assume nreti: \\<open>\\<pi> i \\<noteq> return\\<close>\n        hence nretj': \\<open>\\<pi>' j' \\<noteq> return\\<close> using last_cs csij by metis\n        show \\<open>False\\<close> using cs_order[OF path(2,1) csij[symmetric] csji[symmetric] nretj' ji'] ji by simp\n      next\n        assume nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close>\n        hence nretj': \\<open>\\<pi> j \\<noteq> return\\<close> using last_cs csji by metis\n        show \\<open>False\\<close> using cs_order[OF path csji csij nretj' ji] ji' by simp\n      qed\n    qed\n    have \\<open>l < k \\<or> l' < k\\<close> proof (rule ccontr)\n      assume \\<open>\\<not> (l< k \\<or> l' < k)\\<close>\n      hence \\<open>k < l\\<close> \\<open>k < l'\\<close> using lnk lnk' by auto\n      hence ji: \\<open>i < j\\<close> and ji': \\<open>i' < j'\\<close> using ilj ilj' less(2,3) kth_obs_mono by auto\n      show \\<open>False\\<close> using ii'nret proof\n        assume nreti: \\<open>\\<pi> i \\<noteq> return\\<close>\n        show \\<open>False\\<close> using cs_order[OF path csij csji nreti ji]  ji' by simp\n      next\n        assume nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close>\n        show \\<open>False\\<close> using cs_order[OF path(2,1) csji[symmetric] csij[symmetric] nreti' ji'] ji by simp\n      qed\n    qed    \n    hence \\<open>k < l \\<and> l' < k \\<or> k < l' \\<and> l < k\\<close> using a by auto\n    thus \\<open>False\\<close> proof\n      assume \\<open>k < l \\<and> l' < k\\<close>\n      hence kl: \\<open>k < l\\<close> and lk': \\<open>l' < k\\<close> by auto    \n      hence ij: \\<open>i < j\\<close> and ji': \\<open>j' < i'\\<close> using less(2,3) ilj ilj' kth_obs_mono by auto      \n      have nreti: \\<open>\\<pi> i \\<noteq> return\\<close> by (metis csji ii'nret ij last_cs path(1) term_path_stable less_imp_le)\n      obtain h where ilh: \\<open>is_kth_obs \\<pi> l' h\\<close> using ji' all_in_\\<pi> ilj' no_kth_obs_missing_cs path(1) path(2) by (metis kl lk' ilj kth_obs_stable)\n      hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> h = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> using cseq lk' ilj' by blast\n      hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> h\\<close> using csij by auto\n      hence hi: \\<open>h = i\\<close> using cs_inj nreti path(1) by metis      \n      have \\<open>l' = k\\<close> using less(2) ilh unfolding hi by (metis is_kth_obs_def)      \n      thus \\<open>False\\<close> using lk' by simp\n    next\n      assume \\<open>k < l' \\<and> l < k\\<close>\n      hence kl': \\<open>k < l'\\<close> and lk: \\<open>l < k\\<close> by auto    \n      hence ij': \\<open>i' < j'\\<close> and ji: \\<open>j < i\\<close> using less(2,3) ilj ilj' kth_obs_mono by auto      \n      have nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close> by (metis csij ii'nret ij' last_cs path(2) term_path_stable less_imp_le)\n      obtain h' where ilh': \\<open>is_kth_obs \\<pi>' l h'\\<close> using all_in_\\<pi>' ilj no_kth_obs_missing_cs path(1) path(2) kl' lk ilj' kth_obs_stable by metis\n      hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> h'\\<close> using cseq lk ilj by blast\n      hence \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>'\\<^esup> h'\\<close> using csji by auto\n      hence hi: \\<open>h' = i'\\<close> using cs_inj nreti' path(2) by metis      \n      have \\<open>l = k\\<close> using less(3) ilh' unfolding hi by (metis is_kth_obs_def)      \n      thus \\<open>False\\<close> using lk by simp\n    qed\n  qed\nqed\n\n\nsubsection \\<open>Facts about Data\\<close>\n\nlemma reads_restrict1: \\<open>\\<sigma> \\<restriction> (reads n) = \\<sigma>' \\<restriction> (reads n) \\<Longrightarrow> \\<forall> x \\<in> reads n. \\<sigma> x = \\<sigma>' x\\<close> by (metis restrict_def)\n\nlemma reads_restrict2: \\<open>\\<forall> x \\<in> reads n. \\<sigma> x = \\<sigma>' x \\<Longrightarrow> \\<sigma> \\<restriction> (reads n) = \\<sigma>' \\<restriction> (reads n)\\<close>  unfolding restrict_def by auto\n\nlemma reads_restrict: \\<open>(\\<sigma> \\<restriction> (reads n) = \\<sigma>' \\<restriction> (reads n)) = (\\<forall> x \\<in> reads n. \\<sigma> x = \\<sigma>' x)\\<close> using reads_restrict1 reads_restrict2 by metis\n\nlemma reads_restr_suc: \\<open>\\<sigma> \\<restriction> (reads n) = \\<sigma>' \\<restriction> (reads n) \\<Longrightarrow> suc n \\<sigma> = suc n \\<sigma>'\\<close> by (metis reads_restrict uses_suc)\n\nlemma reads_restr_sem: \\<open>\\<sigma> \\<restriction> (reads n) = \\<sigma>' \\<restriction> (reads n) \\<Longrightarrow> \\<forall> v \\<in> writes n. sem n \\<sigma> v = sem n \\<sigma>' v\\<close> by (metis reads_restrict1 uses_writes)\n\nlemma reads_obsp: assumes \\<open>path \\<sigma> k = path \\<sigma>' k'\\<close> \\<open>\\<sigma>\\<^bsup>k\\<^esup> \\<restriction> (reads (path \\<sigma> k)) = \\<sigma>'\\<^bsup>k'\\<^esup> \\<restriction> (reads (path \\<sigma> k))\\<close> shows \\<open>obsp \\<sigma> k = obsp \\<sigma>' k'\\<close> \n  using assms(2) uses_att \n  unfolding obsp_def assms(1) reads_restrict \n  apply (cases \\<open>att (path \\<sigma>' k')\\<close>)  \n  by auto\n\nlemma no_writes_unchanged0: assumes \\<open>\\<forall> l<k. v\\<notin> writes(path \\<sigma> l)\\<close> shows \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v = \\<sigma> v\\<close> using assms \nproof (induction \\<open>k\\<close>)\n  case 0 thus \\<open>?case\\<close> by(auto simp add: kth_state_def) \nnext\n  case (Suc k)\n  hence \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v = \\<sigma> v\\<close> by auto\n  moreover \n  have \\<open>\\<sigma>\\<^bsup>Suc k\\<^esup>  = snd ( step (path \\<sigma> k,\\<sigma>\\<^bsup>k\\<^esup>))\\<close> by (metis kth_state_suc)\n  hence \\<open>\\<sigma>\\<^bsup>Suc k\\<^esup>  = sem (path \\<sigma> k) (\\<sigma>\\<^bsup>k\\<^esup>)\\<close> by (metis step_suc_sem snd_conv)\n  moreover\n  have \\<open>v \\<notin> writes (path \\<sigma> k)\\<close> using Suc.prems by blast\n  ultimately \n  show \\<open>?case\\<close> using writes by metis\nqed\n\nlemma written_read_dd: assumes \\<open>is_path \\<pi>\\<close> \\<open>v \\<in> reads (\\<pi> k) \\<close> \\<open>v \\<in> writes (\\<pi> j)\\<close> \\<open>j<k\\<close> obtains l where \\<open>k dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> l\\<close> \nproof -\n  let \\<open>?l\\<close> = \\<open>GREATEST l. l < k \\<and> v \\<in> writes (\\<pi> l)\\<close>\n  have \\<open>?l < k\\<close> by (metis (no_types, lifting) GreatestI_ex_nat assms(3) assms(4) less_or_eq_imp_le)\n  moreover\n  have \\<open>v \\<in> writes (\\<pi> ?l)\\<close> by (metis (no_types, lifting) GreatestI_nat assms(3) assms(4) less_or_eq_imp_le) \n  hence \\<open>v \\<in> reads (\\<pi> k) \\<inter> writes (\\<pi> ?l)\\<close> using assms(2) by auto\n  moreover\n  note is_ddi_def\n  have \\<open>\\<forall> l \\<in> {?l<..<k}. v \\<notin> writes (\\<pi> l)\\<close> by (auto, metis (lifting, no_types) Greatest_le_nat le_antisym nat_less_le)\n  ultimately \n  have \\<open>k dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> ?l\\<close> using assms(1) unfolding is_ddi_def by blast\n  thus \\<open>thesis\\<close> using that by simp\nqed\n\nlemma no_writes_unchanged: assumes \\<open>k \\<le> l\\<close> \\<open>\\<forall> j \\<in> {k..<l}. v\\<notin> writes(path \\<sigma> j)\\<close> shows \\<open>(\\<sigma>\\<^bsup>l\\<^esup>) v = (\\<sigma>\\<^bsup>k\\<^esup>) v\\<close> using assms\nproof (induction \\<open>l - k\\<close> arbitrary: \\<open>l\\<close>)\n  case 0 thus \\<open>?case\\<close> by(auto) \nnext\n  case (Suc lk l)\n  hence kl: \\<open>k < l\\<close> by auto\n  then obtain l' where lsuc: \\<open>l = Suc l'\\<close> using lessE by blast\n  hence \\<open>lk = l' - k\\<close> using Suc by auto\n  moreover \n  have \\<open>\\<forall> j \\<in> {k..<l'}. v \\<notin> writes (path \\<sigma> j)\\<close> using Suc(4) lsuc by auto\n  ultimately  \n  have \\<open>(\\<sigma>\\<^bsup>l'\\<^esup>) v = (\\<sigma>\\<^bsup>k\\<^esup>) v\\<close> using Suc(1)[of \\<open>l'\\<close>] lsuc kl by fastforce\n  moreover \n  have \\<open>\\<sigma>\\<^bsup>l\\<^esup> = snd ( step (path \\<sigma> l',\\<sigma>\\<^bsup>l'\\<^esup>))\\<close> by (metis kth_state_suc lsuc)\n  hence \\<open>\\<sigma>\\<^bsup>l\\<^esup> = sem (path \\<sigma> l') (\\<sigma>\\<^bsup>l'\\<^esup>)\\<close> by (metis step_suc_sem snd_conv)\n  moreover\n  have \\<open>l' < l\\<close> \\<open>k \\<le> l'\\<close> using kl lsuc by auto\n  hence \\<open>v \\<notin> writes (path \\<sigma> l')\\<close> using Suc.prems(2) by auto\n  ultimately \n  show \\<open>?case\\<close> using writes by metis\nqed\n\nlemma ddi_value: assumes \\<open>l dd\\<^bsup>(path \\<sigma>),v\\<^esup>\\<rightarrow> k\\<close> shows \\<open>(\\<sigma>\\<^bsup>l\\<^esup>) v = (\\<sigma>\\<^bsup>Suc k\\<^esup> ) v\\<close>\nusing assms no_writes_unchanged[of \\<open>Suc k\\<close> \\<open>l\\<close> \\<open>v\\<close> \\<open>\\<sigma>\\<close>] unfolding is_ddi_def by auto\n\nlemma written_value: assumes \\<open>path \\<sigma> l = path \\<sigma>' l'\\<close> \\<open>\\<sigma>\\<^bsup>l\\<^esup> \\<restriction> reads (path \\<sigma> l) = \\<sigma>'\\<^bsup>l'\\<^esup> \\<restriction> reads (path \\<sigma> l)\\<close> \\<open>v \\<in> writes (path \\<sigma> l)\\<close> \nshows \\<open>(\\<sigma>\\<^bsup>Suc l\\<^esup> ) v = (\\<sigma>'\\<^bsup>Suc l'\\<^esup> ) v\\<close> \nby (metis assms reads_restr_sem snd_conv step_suc_sem kth_state_suc) \n\n\nsubsection \\<open>Facts about Contradicting Paths\\<close>\n\nlemma obsp_contradict: assumes csk: \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close> and obs: \\<open>obsp \\<sigma> k \\<noteq> obsp \\<sigma>' k'\\<close> shows \\<open>(\\<sigma>', k') \\<cc> (\\<sigma>, k)\\<close>\nproof -\n  have pk: \\<open>path \\<sigma> k = path \\<sigma>' k'\\<close> using assms last_cs by metis\n  hence \\<open>\\<sigma>\\<^bsup>k\\<^esup>\\<restriction>(reads (path \\<sigma> k)) \\<noteq> \\<sigma>'\\<^bsup>k'\\<^esup>\\<restriction>(reads (path \\<sigma> k))\\<close> using obs reads_obsp[OF pk] by auto\n  thus \\<open>(\\<sigma>',k') \\<cc> (\\<sigma>,k)\\<close> using contradicts.intros(2)[OF csk[symmetric]] by auto\nqed\n\nlemma missing_cs_contradicts: assumes notin: \\<open>\\<not>(\\<exists> k'. cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k')\\<close> and converge: \\<open>k<n\\<close> \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> n = cs\\<^bsup>path \\<sigma>'\\<^esup> n'\\<close> shows \\<open>\\<exists> j'. (\\<sigma>', j') \\<cc> (\\<sigma>, k)\\<close>\nproof -\n  let \\<open>?\\<pi>\\<close> = \\<open>path \\<sigma>\\<close>\n  let \\<open>?\\<pi>'\\<close> = \\<open>path \\<sigma>'\\<close>\n  have init: \\<open>?\\<pi> 0 = ?\\<pi>' 0\\<close> unfolding path_def by auto\n  have path: \\<open>is_path ?\\<pi>\\<close> \\<open>is_path ?\\<pi>'\\<close> using path_is_path by auto\n  obtain j j' where csj: \\<open>cs\\<^bsup>?\\<pi>\\<^esup> j = cs\\<^bsup>?\\<pi>'\\<^esup> j'\\<close> and cd: \\<open>k cd\\<^bsup>?\\<pi>\\<^esup>\\<rightarrow>j\\<close> and suc: \\<open>?\\<pi> (Suc j) \\<noteq> ?\\<pi>' (Suc j')\\<close> using converged_cd_diverge[OF path init notin converge] .\n  have less: \\<open>cs\\<^bsup>?\\<pi>\\<^esup> j \\<prec> cs\\<^bsup>?\\<pi>\\<^esup> k\\<close> using cd cd_is_cs_less by auto\n  have nretj: \\<open>?\\<pi> j \\<noteq> return\\<close> by (metis cd is_cdi_def term_path_stable less_imp_le)\n  have cs: \\<open>?\\<pi> \\<exclamdown> cs\\<^bsup>?\\<pi>'\\<^esup> j' = j\\<close> using csj cs_select_id nretj path_is_path by metis\n  have \\<open>(\\<sigma>',j') \\<cc> (\\<sigma>,k)\\<close> using contradicts.intros(1)[of \\<open>?\\<pi>'\\<close> \\<open>j'\\<close> \\<open>?\\<pi>\\<close> \\<open>k\\<close> \\<open>\\<sigma>\\<close> \\<open>\\<sigma>'\\<close>,unfolded cs] less suc csj by metis\n  thus \\<open>?thesis\\<close> by blast\nqed\n\ntheorem obs_neq_contradicts_term: fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> assumes ret: \\<open>\\<pi> n = return\\<close> \\<open>\\<pi>' n' = return\\<close> and obsne: \\<open>obs \\<sigma> \\<noteq> obs \\<sigma>'\\<close> \nshows \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom (att)) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom (att))\\<close>\nproof - \n  have path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> using \\<pi> \\<pi>' path_is_path by auto\n  obtain k1 where neq: \\<open>obs \\<sigma> k1 \\<noteq> obs \\<sigma>' k1\\<close> using obsne ext[of \\<open>obs \\<sigma>\\<close> \\<open>obs \\<sigma>'\\<close>] by blast  \n  hence \\<open>(\\<exists>k i i'. is_kth_obs \\<pi> k i \\<and> is_kth_obs \\<pi>' k i' \\<and> obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i' \\<and> cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i') \n  \\<or> (\\<exists> k i. is_kth_obs \\<pi> k i \\<and> \\<not> (\\<exists> i'. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')) \n  \\<or> (\\<exists> k i'. is_kth_obs \\<pi>' k i' \\<and> \\<not> (\\<exists> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))\\<close>\n  proof(cases rule: option_neq_cases)\n    case (none2 x)\n    have notin\\<pi>': \\<open>\\<not> (\\<exists> l. is_kth_obs \\<pi>' k1 l)\\<close> using none2(2) \\<pi>' obs_none_no_kth_obs by auto\n    obtain i where in\\<pi>: \\<open>is_kth_obs \\<pi> k1 i\\<close> using obs_some_kth_obs[of \\<open>\\<sigma>\\<close> \\<open>k1\\<close>] none2(1) \\<pi> by auto            \n    obtain l j where \\<open>is_kth_obs \\<pi> l j\\<close> \\<open>\\<not> (\\<exists> j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> using path in\\<pi> notin\\<pi>' by (metis no_kth_obs_missing_cs)\n    thus \\<open>?thesis\\<close> by blast\n  next\n    case (none1 x)\n    have notin\\<pi>: \\<open>\\<not> (\\<exists> l. is_kth_obs \\<pi> k1 l)\\<close> using none1(1) \\<pi> obs_none_no_kth_obs by auto\n    obtain i' where in\\<pi>': \\<open>is_kth_obs \\<pi>' k1 i'\\<close> using obs_some_kth_obs[of \\<open>\\<sigma>'\\<close> \\<open>k1\\<close>] none1(2) \\<pi>' by auto            \n    obtain l j where \\<open>is_kth_obs \\<pi>' l j\\<close> \\<open>\\<not> (\\<exists> j'. cs\\<^bsup>\\<pi>\\<^esup> j' = cs\\<^bsup>\\<pi>'\\<^esup> j)\\<close> using path in\\<pi>' notin\\<pi> by (metis no_kth_obs_missing_cs)\n    thus \\<open>?thesis\\<close> by blast\n  next  \n    case (some x y)\n    obtain i where in\\<pi>: \\<open>is_kth_obs \\<pi> k1 i\\<close> using obs_some_kth_obs[of \\<open>\\<sigma>\\<close> \\<open>k1\\<close>] some \\<pi> by auto\n    obtain i' where in\\<pi>': \\<open>is_kth_obs \\<pi>' k1 i'\\<close> using obs_some_kth_obs[of \\<open>\\<sigma>'\\<close> \\<open>k1\\<close>] some \\<pi>' by auto\n    show \\<open>?thesis\\<close> proof (cases)\n      assume *: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>\n      have \\<open>obsp \\<sigma> i = obs \\<sigma> k1\\<close> by (metis obs_def \\<pi> in\\<pi> kth_obs_unique the_equality)\n      moreover\n      have \\<open>obsp \\<sigma>' i' = obs \\<sigma>' k1\\<close> by (metis obs_def \\<pi>' in\\<pi>' kth_obs_unique the_equality)\n      ultimately\n      have \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i'\\<close> using neq by auto\n      thus \\<open>?thesis\\<close> using * in\\<pi> in\\<pi>' by blast\n    next\n      assume *: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>\n      note kth_obs_cs_missing_cs[OF path in\\<pi> in\\<pi>' *]\n      thus \\<open>?thesis\\<close> by metis\n    qed\n  qed\n  thus \\<open>?thesis\\<close> proof (cases rule: three_cases)\n    case 1\n    then obtain k i i' where iki: \\<open>is_kth_obs \\<pi> k i\\<close> \\<open>is_kth_obs \\<pi>' k i'\\<close> and obsne: \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i'\\<close> and csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> by auto\n    note obsp_contradict[OF csi[unfolded \\<pi> \\<pi>'] obsne]\n    moreover\n    have \\<open>\\<pi> i \\<in> dom att\\<close> using iki unfolding is_kth_obs_def by auto\n    ultimately\n    show \\<open>?thesis\\<close> by blast\n  next\n    case 2\n    then obtain k i where iki: \\<open>is_kth_obs \\<pi> k i\\<close> and notin\\<pi>': \\<open>\\<not> (\\<exists>i'. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')\\<close> by auto\n    let \\<open>?n\\<close> = \\<open>Suc (max n i)\\<close>\n    have nn: \\<open>n < ?n\\<close> by auto\n    have iln: \\<open>i < ?n\\<close> by auto\n    have retn: \\<open>\\<pi> ?n = return\\<close> using ret term_path_stable path by auto\n    hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> ?n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> using ret(2) cs_return by auto\n    then obtain i' where \\<open>(\\<sigma>',i') \\<cc> (\\<sigma>,i)\\<close> using missing_cs_contradicts[OF notin\\<pi>'[unfolded \\<pi> \\<pi>'] iln] \\<pi> \\<pi>' by auto\n    moreover\n    have \\<open>\\<pi> i \\<in> dom att\\<close> using iki is_kth_obs_def by auto\n    ultimately\n    show \\<open>?thesis\\<close> by blast\n  next\n    case 3\n    then obtain k i' where iki: \\<open>is_kth_obs \\<pi>' k i'\\<close> and notin\\<pi>': \\<open>\\<not> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')\\<close> by auto\n    let \\<open>?n\\<close> = \\<open>Suc (max n' i')\\<close>\n    have nn: \\<open>n' < ?n\\<close> by auto\n    have iln: \\<open>i' < ?n\\<close> by auto\n    have retn: \\<open>\\<pi>' ?n = return\\<close> using ret term_path_stable path by auto\n    hence \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> ?n\\<close> using ret(1) cs_return by auto\n    then obtain i where \\<open>(\\<sigma>,i) \\<cc> (\\<sigma>',i')\\<close> using missing_cs_contradicts notin\\<pi>' iln \\<pi> \\<pi>' by metis\n    moreover\n    have \\<open>\\<pi>' i' \\<in> dom att\\<close> using iki is_kth_obs_def by auto\n    ultimately\n    show \\<open>?thesis\\<close> by blast\n  qed\nqed\n\nlemma obs_neq_some_contradicts': fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \nassumes obsnecs: \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i' \\<or> cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>\nand iki: \\<open>is_kth_obs \\<pi> k i\\<close> and iki': \\<open>is_kth_obs \\<pi>' k i'\\<close>\nshows \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom att) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom att)\\<close>\nusing obsnecs iki iki' proof (induction \\<open>k\\<close> arbitrary: \\<open>i\\<close> \\<open>i'\\<close> rule: less_induct )\n  case (less k i i')  \n  note iki = \\<open>is_kth_obs \\<pi> k i\\<close>\n  and iki' = \\<open>is_kth_obs \\<pi>' k i'\\<close>\n  have domi: \\<open>\\<pi> i \\<in> dom att\\<close> by (metis is_kth_obs_def domIff iki)\n  have domi': \\<open>\\<pi>' i' \\<in> dom att\\<close> by (metis is_kth_obs_def domIff iki')\n  note obsnecs = \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i' \\<or> cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>  \n  show \\<open>?thesis\\<close> proof cases\n    assume csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>\n    hence *: \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i'\\<close> using obsnecs by auto\n    note obsp_contradict[OF _ *] csi domi \\<pi> \\<pi>'\n    thus \\<open>?thesis\\<close> by blast    \n  next      \n    assume ncsi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>  \n    have path: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> using \\<pi> \\<pi>' path_is_path by auto\n    have \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> unfolding \\<pi> \\<pi>' path_def by auto\n    note kth_obs_cs_missing_cs[of \\<open>\\<pi>\\<close> \\<open>\\<pi>'\\<close> \\<open>k\\<close> \\<open>i\\<close> \\<open>i'\\<close>] \\<pi> \\<pi>' path_is_path iki iki' ncsi \n    hence \\<open>(\\<exists> l j .j \\<le> i \\<and> is_kth_obs \\<pi> l j \\<and> \\<not> (\\<exists> j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')) \\<or> (\\<exists> l' j'. j' \\<le> i' \\<and> is_kth_obs \\<pi>' l' j' \\<and> \\<not> (\\<exists> j. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'))\\<close> by metis\n    thus \\<open>?thesis\\<close> proof\n      assume \\<open>\\<exists>l j. j \\<le> i \\<and> is_kth_obs \\<pi> l j \\<and> \\<not> (\\<exists>j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\n      then obtain l j where ji: \\<open>j\\<le>i\\<close> and iobs: \\<open>is_kth_obs \\<pi> l j\\<close> and notin: \\<open>\\<not> (\\<exists>j'. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close> by blast\n      have dom: \\<open>\\<pi> j \\<in> dom att\\<close> using iobs is_kth_obs_def by auto\n      obtain n n' where nj: \\<open>n < j\\<close> and csn: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and sucn:  \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close> and cdloop: \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n \\<or> (\\<forall> j'> n'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n')\\<close>\n      using missing_cd_or_loop[OF path \\<pi>0 notin] by blast\n      show \\<open>?thesis\\<close> using cdloop proof\n        assume cdjn: \\<open>j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close>\n        hence csnj: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n' \\<prec> cs\\<^bsup>\\<pi>\\<^esup> j\\<close> using csn by (metis cd_is_cs_less)\n        have cssel: \\<open>\\<pi> (Suc (\\<pi> \\<exclamdown> cs\\<^bsup>\\<pi>'\\<^esup> n')) = \\<pi> (Suc n)\\<close> using csn by (metis cdjn cd_not_ret cs_select_id path(1))\n        have \\<open>(\\<sigma>',n') \\<cc> (\\<sigma>,j)\\<close> using csnj apply(rule contradicts.intros(1)) using cssel \\<pi> \\<pi>' sucn by auto \n        thus \\<open>?thesis\\<close> using dom by auto\n      next\n        assume loop: \\<open>\\<forall> j'>n'. j' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close>\n        show \\<open>?thesis\\<close> proof cases\n          assume in': \\<open>i' \\<le> n'\\<close>\n          have nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close> by( metis le_eq_less_or_eq lessI loop not_le path(2) ret_no_cd term_path_stable)\n          show \\<open>?thesis\\<close> proof cases\n            assume \\<open>\\<exists> \\<iota>. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> \\<iota>\\<close>\n            then obtain \\<iota> where cs\\<iota>: \\<open>cs\\<^bsup>\\<pi>\\<^esup> \\<iota> = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> by metis            \n            have \\<iota>n: \\<open>\\<iota> \\<le> n\\<close> using cs_order_le[OF path(2,1) cs\\<iota>[symmetric] csn[symmetric] nreti' in'] .\n            hence \\<iota>i: \\<open>\\<iota> < i\\<close> using nj ji by auto \n            have dom\\<iota>: \\<open>\\<pi> \\<iota> \\<in> dom att\\<close> using domi' cs\\<iota> last_cs by metis\n            obtain \\<kappa> where i\\<kappa>\\<iota>: \\<open>is_kth_obs \\<pi> \\<kappa> \\<iota>\\<close> using dom\\<iota> by (metis is_kth_obs_def domIff)\n            hence \\<kappa>k: \\<open>\\<kappa> < k\\<close> using \\<iota>i iki by (metis kth_obs_le_iff)\n            obtain \\<iota>' where i\\<kappa>\\<iota>': \\<open>is_kth_obs \\<pi>' \\<kappa> \\<iota>'\\<close> using \\<kappa>k iki' by (metis kth_obs_stable)\n            have \\<open>\\<iota>' < i'\\<close> using \\<kappa>k iki' i\\<kappa>\\<iota>' by (metis kth_obs_le_iff)\n            hence cs\\<iota>': \\<open>cs\\<^bsup>\\<pi>\\<^esup> \\<iota> \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>'\\<close> unfolding cs\\<iota> using cs_inj[OF path(2) nreti', of \\<open>\\<iota>'\\<close>] by blast           \n            thus \\<open>?thesis\\<close> using less(1)[OF \\<kappa>k _ i\\<kappa>\\<iota> i\\<kappa>\\<iota>'] by auto\n          next\n            assume notin'': \\<open>\\<not>(\\<exists> \\<iota>. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> \\<iota>)\\<close>\n            obtain \\<iota> \\<iota>' where \\<iota>i': \\<open>\\<iota>' < i'\\<close> and cs\\<iota>: \\<open>cs\\<^bsup>\\<pi>\\<^esup> \\<iota> = cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>'\\<close> and suc\\<iota>: \\<open>\\<pi> (Suc \\<iota>) \\<noteq> \\<pi>' (Suc \\<iota>')\\<close> and cdloop': \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> \\<iota>' \\<or> (\\<forall> j>\\<iota>. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> \\<iota>)\\<close>\n            using missing_cd_or_loop[OF path(2,1) \\<pi>0[symmetric] notin''] by metis\n            show \\<open>?thesis\\<close> using cdloop' proof\n              assume cdjn: \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> \\<iota>'\\<close>\n              hence csnj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> \\<iota> \\<prec> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using cs\\<iota> by (metis cd_is_cs_less)\n              have cssel: \\<open>\\<pi>' (Suc (\\<pi>' \\<exclamdown> cs\\<^bsup>\\<pi>\\<^esup> \\<iota>)) = \\<pi>' (Suc \\<iota>')\\<close> using cs\\<iota> by (metis cdjn cd_not_ret cs_select_id path(2))\n              have \\<open>(\\<sigma>,\\<iota>) \\<cc> (\\<sigma>',i')\\<close> using csnj apply(rule contradicts.intros(1)) using cssel \\<pi> \\<pi>' suc\\<iota> by auto \n              thus \\<open>?thesis\\<close> using domi' by auto\n            next\n              assume loop': \\<open>\\<forall> j>\\<iota>. j cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> \\<iota>\\<close>\n              have \\<iota>n': \\<open>\\<iota>' < n'\\<close> using in' \\<iota>i' by auto\n              have nret\\<iota>': \\<open>\\<pi>' \\<iota>' \\<noteq> return\\<close> by (metis cs\\<iota> last_cs le_eq_less_or_eq lessI path(1) path(2) suc\\<iota> term_path_stable)\n              have \\<open>\\<iota> < n\\<close> using cs_order[OF path(2,1) cs\\<iota>[symmetric] csn[symmetric] nret\\<iota>' \\<iota>n'] .\n              hence \\<open>\\<iota> < i\\<close> using nj ji by auto\n              hence cdi\\<iota>: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> \\<iota>\\<close> using loop' by auto\n              hence cs\\<iota>i: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>' \\<prec> cs\\<^bsup>\\<pi>\\<^esup> i\\<close> using cs\\<iota> by (metis cd_is_cs_less)\n              have cssel: \\<open>\\<pi> (Suc (\\<pi> \\<exclamdown> cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>')) = \\<pi> (Suc \\<iota>)\\<close> using cs\\<iota> by (metis cdi\\<iota> cd_not_ret cs_select_id path(1))\n              have \\<open>(\\<sigma>',\\<iota>') \\<cc> (\\<sigma>,i)\\<close> using cs\\<iota>i apply(rule contradicts.intros(1)) using cssel \\<pi> \\<pi>' suc\\<iota> by auto \n              thus \\<open>?thesis\\<close> using domi by auto\n            qed\n          qed\n        next\n          assume \\<open>\\<not> i' \\<le> n'\\<close>\n          hence ni': \\<open>n'< i'\\<close> by simp\n          hence cdin: \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> using loop by auto\n          hence csni: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n \\<prec> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using csn by (metis cd_is_cs_less)\n          have cssel: \\<open>\\<pi>' (Suc (\\<pi>' \\<exclamdown> cs\\<^bsup>\\<pi>\\<^esup> n)) = \\<pi>' (Suc n')\\<close> using csn by (metis cdin cd_not_ret cs_select_id path(2))\n          have \\<open>(\\<sigma>,n) \\<cc> (\\<sigma>',i')\\<close> using csni apply(rule contradicts.intros(1)) using cssel \\<pi> \\<pi>' sucn by auto \n          thus \\<open>?thesis\\<close> using domi' by auto\n        qed\n      qed\n    next\n      \\<comment> \\<open>Symmetric case as above, indices might be messy.\\<close>\n      assume \\<open>\\<exists>l j. j \\<le> i' \\<and> is_kth_obs \\<pi>' l j \\<and> \\<not> (\\<exists>j'. cs\\<^bsup>\\<pi>\\<^esup> j' = cs\\<^bsup>\\<pi>'\\<^esup> j)\\<close>\n      then obtain l j where ji': \\<open>j\\<le>i'\\<close> and iobs: \\<open>is_kth_obs \\<pi>' l j\\<close> and notin: \\<open>\\<not> (\\<exists>j'. cs\\<^bsup>\\<pi>'\\<^esup> j = cs\\<^bsup>\\<pi>\\<^esup> j')\\<close> by metis\n      have dom: \\<open>\\<pi>' j \\<in> dom att\\<close> using iobs is_kth_obs_def by auto\n      obtain n n' where nj: \\<open>n < j\\<close> and csn: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n = cs\\<^bsup>\\<pi>\\<^esup> n'\\<close> and sucn:  \\<open>\\<pi>' (Suc n) \\<noteq> \\<pi> (Suc n')\\<close> and cdloop: \\<open>j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n \\<or> (\\<forall> j'> n'. j' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n')\\<close>\n      using missing_cd_or_loop[OF path(2,1) \\<pi>0[symmetric] ] notin by metis\n      show \\<open>?thesis\\<close> using cdloop proof\n        assume cdjn: \\<open>j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n\\<close>\n        hence csnj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n' \\<prec> cs\\<^bsup>\\<pi>'\\<^esup> j\\<close> using csn by (metis cd_is_cs_less)\n        have cssel: \\<open>\\<pi>' (Suc (\\<pi>' \\<exclamdown> cs\\<^bsup>\\<pi>\\<^esup> n')) = \\<pi>' (Suc n)\\<close> using csn by (metis cdjn cd_not_ret cs_select_id path(2))\n        have \\<open>(\\<sigma>,n') \\<cc> (\\<sigma>',j)\\<close> using csnj apply(rule contradicts.intros(1)) using cssel \\<pi>' \\<pi> sucn by auto \n        thus \\<open>?thesis\\<close> using dom by auto\n      next\n        assume loop: \\<open>\\<forall> j'>n'. j' cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n'\\<close>\n        show \\<open>?thesis\\<close> proof cases\n          assume in': \\<open>i \\<le> n'\\<close>\n          have nreti: \\<open>\\<pi> i \\<noteq> return\\<close> by (metis le_eq_less_or_eq lessI loop not_le path(1) ret_no_cd term_path_stable)\n          show \\<open>?thesis\\<close> proof cases\n            assume \\<open>\\<exists> \\<iota>. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>\\<close>\n            then obtain \\<iota> where cs\\<iota>: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> \\<iota> = cs\\<^bsup>\\<pi>\\<^esup> i\\<close> by metis            \n            have \\<iota>n: \\<open>\\<iota> \\<le> n\\<close> using cs_order_le[OF path cs\\<iota>[symmetric] csn[symmetric] nreti in'] .\n            hence \\<iota>i': \\<open>\\<iota> < i'\\<close> using nj ji' by auto \n            have dom\\<iota>: \\<open>\\<pi>' \\<iota> \\<in> dom att\\<close> using domi cs\\<iota> last_cs by metis\n            obtain \\<kappa> where i\\<kappa>\\<iota>: \\<open>is_kth_obs \\<pi>' \\<kappa> \\<iota>\\<close> using dom\\<iota> by (metis is_kth_obs_def domIff)\n            hence \\<kappa>k: \\<open>\\<kappa> < k\\<close> using \\<iota>i' iki' by (metis kth_obs_le_iff)\n            obtain \\<iota>' where i\\<kappa>\\<iota>': \\<open>is_kth_obs \\<pi> \\<kappa> \\<iota>'\\<close> using \\<kappa>k iki by (metis kth_obs_stable)\n            have \\<open>\\<iota>' < i\\<close> using \\<kappa>k iki i\\<kappa>\\<iota>' by (metis kth_obs_le_iff)\n            hence cs\\<iota>': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> \\<iota> \\<noteq> cs\\<^bsup>\\<pi>\\<^esup> \\<iota>'\\<close> unfolding cs\\<iota> using cs_inj[OF path(1) nreti, of \\<open>\\<iota>'\\<close>] by blast           \n            thus \\<open>?thesis\\<close> using less(1)[OF \\<kappa>k _ i\\<kappa>\\<iota>' i\\<kappa>\\<iota>] by auto\n          next\n            assume notin'': \\<open>\\<not>(\\<exists> \\<iota>. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>)\\<close>\n            obtain \\<iota> \\<iota>' where \\<iota>i: \\<open>\\<iota>' < i\\<close> and cs\\<iota>: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> \\<iota> = cs\\<^bsup>\\<pi>\\<^esup> \\<iota>'\\<close> and suc\\<iota>: \\<open>\\<pi>' (Suc \\<iota>) \\<noteq> \\<pi> (Suc \\<iota>')\\<close> and cdloop': \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> \\<iota>' \\<or> (\\<forall> j>\\<iota>. j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> \\<iota>)\\<close>\n            using missing_cd_or_loop[OF path \\<pi>0 notin''] by metis\n            show \\<open>?thesis\\<close> using cdloop' proof\n              assume cdjn: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> \\<iota>'\\<close>\n              hence csnj: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> \\<iota> \\<prec> cs\\<^bsup>\\<pi>\\<^esup> i\\<close> using cs\\<iota> by (metis cd_is_cs_less)\n              have cssel: \\<open>\\<pi> (Suc (\\<pi> \\<exclamdown> cs\\<^bsup>\\<pi>'\\<^esup> \\<iota>)) = \\<pi> (Suc \\<iota>')\\<close> using cs\\<iota> by (metis cdjn cd_not_ret cs_select_id path(1))\n              have \\<open>(\\<sigma>',\\<iota>) \\<cc> (\\<sigma>,i)\\<close> using csnj apply(rule contradicts.intros(1)) using cssel \\<pi>' \\<pi> suc\\<iota> by auto \n              thus \\<open>?thesis\\<close> using domi by auto\n            next\n              assume loop': \\<open>\\<forall> j>\\<iota>. j cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> \\<iota>\\<close>\n              have \\<iota>n': \\<open>\\<iota>' < n'\\<close> using in' \\<iota>i by auto\n              have nret\\<iota>': \\<open>\\<pi> \\<iota>' \\<noteq> return\\<close> by (metis cs\\<iota> last_cs le_eq_less_or_eq lessI path(1) path(2) suc\\<iota> term_path_stable)\n              have \\<open>\\<iota> < n\\<close> using cs_order[OF path cs\\<iota>[symmetric] csn[symmetric] nret\\<iota>' \\<iota>n'] .\n              hence \\<open>\\<iota> < i'\\<close> using nj ji' by auto\n              hence cdi\\<iota>: \\<open>i' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> \\<iota>\\<close> using loop' by auto\n              hence cs\\<iota>i': \\<open>cs\\<^bsup>\\<pi>\\<^esup> \\<iota>' \\<prec> cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using cs\\<iota> by (metis cd_is_cs_less)\n              have cssel: \\<open>\\<pi>' (Suc (\\<pi>' \\<exclamdown> cs\\<^bsup>\\<pi>\\<^esup> \\<iota>')) = \\<pi>' (Suc \\<iota>)\\<close> using cs\\<iota> by (metis cdi\\<iota> cd_not_ret cs_select_id path(2))\n              have \\<open>(\\<sigma>,\\<iota>') \\<cc> (\\<sigma>',i')\\<close> using cs\\<iota>i' apply(rule contradicts.intros(1)) using cssel \\<pi>' \\<pi> suc\\<iota> by auto \n              thus \\<open>?thesis\\<close> using domi' by auto\n            qed\n          qed\n        next\n          assume \\<open>\\<not> i \\<le> n'\\<close>\n          hence ni: \\<open>n'< i\\<close> by simp\n          hence cdin: \\<open>i cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n'\\<close> using loop by auto\n          hence csni': \\<open>cs\\<^bsup>\\<pi>'\\<^esup> n \\<prec> cs\\<^bsup>\\<pi>\\<^esup> i\\<close> using csn by (metis cd_is_cs_less)\n          have cssel: \\<open>\\<pi> (Suc (\\<pi> \\<exclamdown> cs\\<^bsup>\\<pi>'\\<^esup> n)) = \\<pi> (Suc n')\\<close> using csn by (metis cdin cd_not_ret cs_select_id path(1))\n          have \\<open>(\\<sigma>',n) \\<cc> (\\<sigma>,i)\\<close> using csni' apply(rule contradicts.intros(1)) using cssel \\<pi>' \\<pi> sucn by auto \n          thus \\<open>?thesis\\<close> using domi by auto\n        qed\n      qed\n    qed\n  qed\nqed\n\ntheorem obs_neq_some_contradicts: fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \nassumes obsne: \\<open>obs \\<sigma> k \\<noteq> obs \\<sigma>' k\\<close> and not_none: \\<open>obs \\<sigma> k \\<noteq> None\\<close> \\<open>obs \\<sigma>' k \\<noteq> None\\<close> \nshows \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom att) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom att)\\<close>\nproof -\n  obtain i where iki: \\<open>is_kth_obs \\<pi> k i\\<close> using not_none(1) by (metis \\<pi> obs_some_kth_obs)\n  obtain i' where iki': \\<open>is_kth_obs \\<pi>' k i'\\<close> using not_none(2) by (metis \\<pi>' obs_some_kth_obs)\n  have \\<open>obsp \\<sigma> i = obs \\<sigma> k\\<close> by (metis \\<pi> iki kth_obs_unique obs_def the_equality)\n  moreover\n  have \\<open>obsp \\<sigma>' i' = obs \\<sigma>' k\\<close> by (metis \\<pi>' iki' kth_obs_unique obs_def the_equality)\n  ultimately\n  have obspne: \\<open>obsp \\<sigma> i \\<noteq> obsp \\<sigma>' i'\\<close> using obsne by auto\n  show \\<open>?thesis\\<close> using obs_neq_some_contradicts'[OF _ iki[unfolded \\<pi>] iki'[unfolded \\<pi>']] using obspne \\<pi> \\<pi>' by metis\nqed\n\ntheorem obs_neq_ret_contradicts: fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \nassumes ret: \\<open>\\<pi> n = return\\<close> and obsne: \\<open>obs \\<sigma>' i \\<noteq> obs \\<sigma> i\\<close> and obs:\\<open>obs \\<sigma>' i \\<noteq> None\\<close>\nshows \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom (att)) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom (att))\\<close>\nproof (cases \\<open>\\<exists> j k'. is_kth_obs \\<pi>' j k' \\<and> (\\<nexists> k. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close>)\n  case True\n  obtain l k' where jk': \\<open>is_kth_obs \\<pi>' l k'\\<close> and unmatched: \\<open>(\\<nexists> k. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close> using True by blast\n  have \\<pi>0: \\<open>\\<pi> 0 = \\<pi>' 0\\<close> using \\<pi> \\<pi>' path0 by auto\n  obtain j j' where csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j'\\<close> and cd: \\<open>k' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow>j'\\<close> and suc: \\<open>\\<pi> (Suc j) \\<noteq> \\<pi>' (Suc j')\\<close>\n    using converged_cd_diverge_return[of \\<open>\\<pi>'\\<close> \\<open>\\<pi>\\<close> \\<open>k'\\<close> \\<open>n\\<close>] ret unmatched path_is_path \\<pi> \\<pi>' \\<pi>0 by metis \n  hence *: \\<open>(\\<sigma>, j) \\<cc> (\\<sigma>' ,k')\\<close> using contradicts.intros(1)[of \\<open>\\<pi>\\<close> \\<open>j\\<close> \\<open>\\<pi>'\\<close> \\<open>k'\\<close> \\<open>\\<sigma>'\\<close> \\<open>\\<sigma>\\<close>, unfolded csj] \\<pi> \\<pi>'\n    using cd_is_cs_less cd_not_ret cs_select_id by auto \n  have \\<open>\\<pi>' k' \\<in> dom(att)\\<close> using jk' by (meson domIff is_kth_obs_def) \n  thus \\<open>?thesis\\<close> using * by blast\nnext\n  case False\n  hence *: \\<open>\\<And> j k'. is_kth_obs \\<pi>' j k' \\<Longrightarrow> \\<exists> k. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> by auto\n  obtain k' where k': \\<open>is_kth_obs \\<pi>' i k'\\<close> using obs \\<pi>' obs_some_kth_obs by blast\n  obtain l where \\<open>is_kth_obs \\<pi> i l\\<close> using * \\<pi> \\<pi>' k' no_kth_obs_missing_cs path_is_path by metis\n  thus \\<open>?thesis\\<close> using \\<pi> \\<pi>' obs obs_neq_some_contradicts obs_none_no_kth_obs obsne by metis\nqed\n\n\nsubsection \\<open>Facts about Critical Observable Paths\\<close>\n\nlemma contradicting_in_cp: assumes leq:\\<open>\\<sigma> =\\<^sub>L \\<sigma>'\\<close> and cseq: \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close> \nand readv: \\<open>v\\<in>reads(path \\<sigma> k)\\<close> and vneq: \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v\\<close> shows \\<open>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp\\<close>\n  using cseq readv vneq proof(induction \\<open>k+k'\\<close> arbitrary: \\<open>k\\<close> \\<open>k'\\<close> \\<open>v\\<close> rule: less_induct)\n  fix k k' v     \n  assume csk: \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close>\n  assume vread: \\<open>v \\<in> reads (path \\<sigma> k)\\<close>\n  assume vneq: \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v\\<close>\n  assume IH: \\<open>\\<And>ka k'a v. ka + k'a < k + k' \\<Longrightarrow> cs\\<^bsup>path \\<sigma>\\<^esup> ka = cs\\<^bsup>path \\<sigma>'\\<^esup> k'a \\<Longrightarrow> v \\<in> reads (path \\<sigma> ka) \\<Longrightarrow> (\\<sigma>\\<^bsup>ka\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'a\\<^esup>) v \\<Longrightarrow> ((\\<sigma>, ka), \\<sigma>', k'a) \\<in> cp\\<close> \n  \n  define \\<pi> where  \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> \n  define \\<pi>' where \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \n  have path: \\<open>\\<pi> = path \\<sigma>\\<close> \\<open>\\<pi>' = path \\<sigma>'\\<close> using \\<pi>_def \\<pi>'_def path_is_path by auto  \n  have ip: \\<open>is_path \\<pi>\\<close> \\<open>is_path \\<pi>'\\<close> using path path_is_path by auto\n            \n  have \\<pi>0: \\<open>\\<pi>' 0 = \\<pi> 0\\<close> unfolding path path_def by auto\n  have vread': \\<open>v \\<in> reads (path \\<sigma>' k')\\<close> using csk vread by (metis last_cs)\n  have cseq: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using csk path by simp\n  \n  show \\<open>((\\<sigma>, k), \\<sigma>', k') \\<in> cp\\<close> proof cases\n    assume vnw: \\<open>\\<forall> l < k. v\\<notin>writes (\\<pi> l)\\<close>\n    hence \\<sigma>v: \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v = \\<sigma> v\\<close> by (metis no_writes_unchanged0 path(1))\n    show \\<open>?thesis\\<close> proof cases\n      assume vnw': \\<open>\\<forall> l < k'. v\\<notin>writes (\\<pi>' l)\\<close>\n      hence \\<sigma>v': \\<open>(\\<sigma>'\\<^bsup>k'\\<^esup>) v = \\<sigma>' v\\<close> by (metis no_writes_unchanged0 path(2))\n      with \\<sigma>v vneq have \\<open>\\<sigma> v \\<noteq> \\<sigma>' v\\<close> by auto\n      hence vhigh: \\<open>v \\<in> hvars\\<close> using leq unfolding loweq_def restrict_def by (auto,metis)\n      thus \\<open>?thesis\\<close> using cp.intros(1)[OF leq csk vread vneq] vnw vnw' path by simp\n    next\n      assume \\<open>\\<not>(\\<forall> l < k'. v\\<notin>writes (\\<pi>' l))\\<close>\n      then obtain l' where kddl': \\<open>k' dd\\<^bsup>\\<pi>',v\\<^esup>\\<rightarrow> l'\\<close> using path(2) path_is_path written_read_dd vread' by blast\n      hence lv': \\<open>v \\<in> writes (\\<pi>' l')\\<close> unfolding is_ddi_def by auto\n      have lk': \\<open>l' < k'\\<close> by (metis is_ddi_def kddl')\n      have nret: \\<open>\\<pi>' l' \\<noteq> return\\<close> using lv' writes_return by auto\n      \n      have notin\\<pi>: \\<open>\\<not> (\\<exists>l. cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> l)\\<close> proof\n        assume \\<open>\\<exists>l. cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> l\\<close>\n        then obtain l where \"cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> l\" ..\n        note csl = \\<open>cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> l\\<close>\n        have lk: \\<open>l < k\\<close> using lk' cseq ip cs_order[of \\<open>\\<pi>'\\<close> \\<open>\\<pi>\\<close> \\<open>l'\\<close> \\<open>l\\<close> \\<open>k'\\<close> \\<open>k\\<close>] csl nret path by force\n                  \n        have \\<open>v \\<in> writes (\\<pi> l)\\<close> using csl lv' last_cs by metis\n        thus \\<open>False\\<close> using lk vnw by blast\n      qed\n\n      from converged_cd_diverge[OF ip(2,1) \\<pi>0 notin\\<pi> lk' cseq]\n      obtain i i' where  csi: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i\\<close> and lcdi: \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> i'\\<close>  and div: \\<open>\\<pi>' (Suc i') \\<noteq> \\<pi> (Suc i)\\<close> .\n      \n      have 1: \\<open>\\<pi> (Suc i) = suc (\\<pi> i) (\\<sigma>\\<^bsup>i\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n      have 2: \\<open>\\<pi>' (Suc i') = suc (\\<pi>' i') (\\<sigma>'\\<^bsup>i'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n      have 3: \\<open>\\<pi>' i' = \\<pi> i\\<close> using csi last_cs by metis\n      have nreads: \\<open>\\<sigma>\\<^bsup>i\\<^esup> \\<restriction> reads (\\<pi> i) \\<noteq> \\<sigma>'\\<^bsup>i'\\<^esup> \\<restriction> reads (\\<pi> i)\\<close> by (metis 1 2 3 div reads_restr_suc)\n      then obtain v' where v'read: \\<open>v'\\<in> reads(path \\<sigma> i)\\<close> \\<open>(\\<sigma>\\<^bsup>i\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>i'\\<^esup>) v'\\<close> unfolding path by (metis reads_restrict)\n      \n      have nreti: \\<open>\\<pi>' i' \\<noteq> return\\<close> by (metis csi div ip(1) ip(2) last_cs lessI term_path_stable less_imp_le)\n      have ik': \\<open>i' < k'\\<close> using lcdi lk' is_cdi_def by auto            \n      have ik: \\<open>i < k\\<close> using cs_order[OF ip(2,1) csi cseq nreti ik'] .\n      \n      have cpi: \\<open>((\\<sigma>, i), (\\<sigma>', i')) \\<in> cp\\<close> using IH[of \\<open>i\\<close> \\<open>i'\\<close>] v'read csi ik ik' path by auto \n      hence cpi': \\<open>((\\<sigma>', i'), (\\<sigma>, i)) \\<in> cp\\<close> using cp.intros(4) by blast\n      \n      have nwvi: \\<open>\\<forall>j'\\<in>{LEAST i'. i < i' \\<and> (\\<exists>i. cs\\<^bsup>path \\<sigma>'\\<^esup> i = cs\\<^bsup>path \\<sigma>\\<^esup> i')..<k}. v \\<notin> writes (path \\<sigma> j')\\<close> using vnw[unfolded path] \n        by (metis (poly_guards_query) atLeastLessThan_iff)\n      \n      from cp.intros(3)[OF cpi' kddl'[unfolded path] lcdi[unfolded path] csk[symmetric] div[unfolded path] vneq[symmetric] nwvi] \n      \n      show \\<open>?thesis\\<close> using cp.intros(4) by simp \n    qed\n  next\n    assume wv: \\<open>\\<not> (\\<forall> l<k. v \\<notin> writes (\\<pi> l))\\<close> \n    then obtain l where kddl: \\<open>k dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> l\\<close> using path(1) path_is_path written_read_dd vread by blast\n    hence lv: \\<open>v \\<in> writes (\\<pi> l)\\<close> unfolding is_ddi_def by auto\n    have lk: \\<open>l < k\\<close> by (metis is_ddi_def kddl)\n    have nret: \\<open>\\<pi> l \\<noteq> return\\<close> using lv writes_return by auto\n    have nwb: \\<open>\\<forall> i \\<in> {Suc l..< k}. v\\<notin>writes(\\<pi> i)\\<close> using kddl unfolding is_ddi_def by auto\n    have \\<sigma>vk: \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v = (\\<sigma>\\<^bsup>Suc l\\<^esup> ) v\\<close> using kddl ddi_value path(1) by auto\n\n    show \\<open>?thesis\\<close> proof cases\n      assume vnw': \\<open>\\<forall> l < k'. v\\<notin>writes (\\<pi>' l)\\<close>\n      hence \\<sigma>v': \\<open>(\\<sigma>'\\<^bsup>k'\\<^esup>) v = \\<sigma>' v\\<close> by (metis no_writes_unchanged0 path(2))\n\n      have notin\\<pi>': \\<open>\\<not> (\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l')\\<close> proof\n        assume \\<open>\\<exists>l'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\n        then obtain l' where \"cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\" ..\n        note csl = \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\n        have lk: \\<open>l' < k'\\<close> using lk cseq ip cs_order[of \\<open>\\<pi>\\<close> \\<open>\\<pi>'\\<close> \\<open>l\\<close> \\<open>l'\\<close> \\<open>k\\<close> \\<open>k'\\<close>] csl nret by metis\n                  \n        have \\<open>v \\<in> writes (\\<pi>' l')\\<close> using csl lv last_cs by metis\n        thus \\<open>False\\<close> using lk vnw' by blast\n      qed\n\n      from converged_cd_diverge[OF ip(1,2) \\<pi>0[symmetric] notin\\<pi>' lk cseq[symmetric]]\n      obtain i i' where  csi: \\<open>cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i\\<close> and lcdi: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> i\\<close>  and div: \\<open>\\<pi> (Suc i) \\<noteq> \\<pi>' (Suc i')\\<close> by metis\n      \n      have 1: \\<open>\\<pi> (Suc i) = suc (\\<pi> i) (\\<sigma>\\<^bsup>i\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n      have 2: \\<open>\\<pi>' (Suc i') = suc (\\<pi>' i') (\\<sigma>'\\<^bsup>i'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n      have 3: \\<open>\\<pi>' i' = \\<pi> i\\<close> using csi last_cs by metis\n      have nreads: \\<open>\\<sigma>\\<^bsup>i\\<^esup> \\<restriction> reads (\\<pi> i) \\<noteq> \\<sigma>'\\<^bsup>i'\\<^esup> \\<restriction> reads (\\<pi> i)\\<close> by (metis 1 2 3 div reads_restr_suc)\n      have contri: \\<open>(\\<sigma>',i') \\<cc> (\\<sigma>,i)\\<close> using contradicts.intros(2)[OF csi path nreads] .\n      \n      have nreti: \\<open>\\<pi> i \\<noteq> return\\<close> by (metis csi div ip(1) ip(2) last_cs lessI term_path_stable less_imp_le)\n      have ik: \\<open>i < k\\<close> using lcdi lk is_cdi_def by auto            \n      have ik': \\<open>i' < k'\\<close> using cs_order[OF ip(1,2) csi[symmetric] cseq[symmetric] nreti ik] .\n      have nreads: \\<open>\\<sigma>\\<^bsup>i\\<^esup> \\<restriction> reads (\\<pi> i) \\<noteq> \\<sigma>'\\<^bsup>i'\\<^esup> \\<restriction> reads (\\<pi> i)\\<close> by (metis 1 2 3 div reads_restr_suc)\n      then obtain v' where v'read: \\<open>v'\\<in> reads(path \\<sigma> i)\\<close> \\<open>(\\<sigma>\\<^bsup>i\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>i'\\<^esup>) v'\\<close> unfolding path by (metis reads_restrict)\n      \n      \n      have cpi: \\<open>((\\<sigma>, i), (\\<sigma>', i')) \\<in> cp\\<close> using IH[of \\<open>i\\<close> \\<open>i'\\<close>] v'read csi ik ik' path by auto \n      hence cpi': \\<open>((\\<sigma>', i'), (\\<sigma>, i)) \\<in> cp\\<close> using cp.intros(4) by blast\n      \n      have vnwi: \\<open>\\<forall>j'\\<in>{LEAST i'a. i' < i'a \\<and> (\\<exists>i. cs\\<^bsup>path \\<sigma>\\<^esup> i = cs\\<^bsup>path \\<sigma>'\\<^esup> i'a)..<k'}. v \\<notin> writes (path \\<sigma>' j')\\<close> using vnw'[unfolded path]\n        by (metis (poly_guards_query) atLeastLessThan_iff)\n        \n      from cp.intros(3)[OF cpi kddl[unfolded path] lcdi[unfolded path] csk div[unfolded path] vneq vnwi]   \n      \n      show \\<open>?thesis\\<close> using cp.intros(4) by simp\n    next\n      assume \\<open>\\<not> (\\<forall> l<k'. v \\<notin> writes (\\<pi>' l))\\<close>\n      then obtain l' where kddl': \\<open>k' dd\\<^bsup>\\<pi>',v\\<^esup>\\<rightarrow> l'\\<close> using path(2) path_is_path written_read_dd vread' by blast\n      hence lv': \\<open>v \\<in> writes (\\<pi>' l')\\<close> unfolding is_ddi_def by auto\n      have lk': \\<open>l' < k'\\<close> by (metis is_ddi_def kddl')            \n      have nretl': \\<open>\\<pi>' l' \\<noteq> return\\<close> using lv' writes_return by auto\n      have nwb': \\<open>\\<forall> i' \\<in> {Suc l'..< k'}. v\\<notin>writes(\\<pi>' i')\\<close> using kddl' unfolding is_ddi_def by auto\n      have \\<sigma>vk': \\<open>(\\<sigma>'\\<^bsup>k'\\<^esup>) v = (\\<sigma>'\\<^bsup>Suc l'\\<^esup> ) v\\<close> using kddl' ddi_value path(2) by auto\n\n      show \\<open>?thesis\\<close> proof cases \n        assume csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\n        hence \\<pi>l: \\<open>\\<pi> l = \\<pi>' l'\\<close> by (metis last_cs)\n        have \\<sigma>vls: \\<open>(\\<sigma>\\<^bsup>Suc l\\<^esup> ) v \\<noteq> (\\<sigma>'\\<^bsup>Suc l'\\<^esup> ) v\\<close> by (metis \\<sigma>vk \\<sigma>vk' vneq)\n        have r\\<sigma>: \\<open>\\<sigma>\\<^bsup>l\\<^esup> \\<restriction> reads (\\<pi> l) \\<noteq> \\<sigma>'\\<^bsup>l'\\<^esup> \\<restriction> reads (\\<pi> l)\\<close> using path \\<pi>l \\<sigma>vls written_value lv by blast\n        then obtain v' where v'read: \\<open>v'\\<in> reads(path \\<sigma> l)\\<close> \\<open>(\\<sigma>\\<^bsup>l\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>l'\\<^esup>) v'\\<close> unfolding path by (metis reads_restrict)\n      \n      \n        have cpl: \\<open>((\\<sigma>, l), (\\<sigma>', l')) \\<in> cp\\<close> using IH[of \\<open>l\\<close> \\<open>l'\\<close>] v'read csl lk lk' path by auto \n        show \\<open>((\\<sigma>, k), (\\<sigma>', k')) \\<in> cp\\<close> using cp.intros(2)[OF cpl kddl[unfolded path] kddl'[unfolded path] csk vneq] .        \n      next\n        assume csl: \\<open>cs\\<^bsup>\\<pi>\\<^esup> l \\<noteq> cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\n        show \\<open>?thesis\\<close> proof cases\n          assume \\<open>\\<exists> i'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close>\n          then obtain i' where csli': \\<open>cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> by blast\n          have ilne': \\<open>i' \\<noteq> l'\\<close> using csl csli' by auto\n          have ij': \\<open>i' < k'\\<close> using cs_order[OF ip csli' cseq[symmetric] nret lk] .\n          have iv': \\<open>v \\<in> writes(\\<pi>' i')\\<close> using lv csli' last_cs by metis\n          have il': \\<open>i' < l'\\<close> using kddl' ilne' ij' iv' unfolding is_ddi_def by auto\n          have nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close> using csli' nret last_cs by metis\n\n          have l'notin\\<pi>: \\<open>\\<not>(\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> i )\\<close> proof\n            assume \\<open>\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> l' = cs\\<^bsup>\\<pi>\\<^esup> i\\<close>\n            then obtain i where csil: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> by metis\n            have ik: \\<open>i < k\\<close> using cs_order[OF ip(2,1) csil[symmetric] cseq nretl' lk'] .\n            have li: \\<open>l < i\\<close> using cs_order[OF ip(2,1) csli'[symmetric] csil[symmetric] nreti' il'] .\n            have iv: \\<open>v \\<in> writes(\\<pi> i)\\<close> using lv' csil last_cs by metis\n            show \\<open>False\\<close> using kddl ik li iv is_ddi_def by auto\n          qed\n          \n          obtain n n' where csn: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close>  and sucn: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close> and in': \\<open>i' \\<le> n'\\<close>\n          using converged_cd_diverge_cs [OF ip(2,1) csli'[symmetric] il' l'notin\\<pi> lk' cseq] by metis \n          \n          \\<comment> \\<open>Can apply the IH to n and n'\\<close>\n          \n          have 1: \\<open>\\<pi> (Suc n) = suc (\\<pi> n) (\\<sigma>\\<^bsup>n\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n          have 2: \\<open>\\<pi>' (Suc n') = suc (\\<pi>' n') (\\<sigma>'\\<^bsup>n'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n          have 3: \\<open>\\<pi>' n' = \\<pi> n\\<close> using csn last_cs by metis\n          have nreads: \\<open>\\<sigma>\\<^bsup>n\\<^esup> \\<restriction> reads (\\<pi> n) \\<noteq> \\<sigma>'\\<^bsup>n'\\<^esup> \\<restriction> reads (\\<pi> n)\\<close> by (metis 1 2 3 sucn reads_restr_suc)\n          then obtain v' where v'read: \\<open>v'\\<in>reads (path \\<sigma> n)\\<close> \\<open>(\\<sigma>\\<^bsup>n\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v'\\<close> by (metis path(1) reads_restrict)\n          moreover\n          have nl': \\<open>n' < l'\\<close> using lcdn' is_cdi_def by auto\n          have nk': \\<open>n' < k'\\<close> using nl' lk' by simp\n          have nretn': \\<open>\\<pi>' n' \\<noteq> return\\<close> by (metis ip(2) nl' nretl' term_path_stable less_imp_le)\n          have nk: \\<open>n < k\\<close> using cs_order[OF ip(2,1) csn[symmetric] cseq nretn' nk'] .\n          hence lenn: \\<open>n+n' < k+k'\\<close> using nk' by auto\n          ultimately  \n          have \\<open>((\\<sigma>, n), (\\<sigma>', n')) \\<in> cp\\<close> using IH csn path by auto\n          hence ncp: \\<open>((\\<sigma>', n'), (\\<sigma>, n)) \\<in> cp\\<close> using cp.intros(4) by auto\n          \n          have nles: \\<open>n < (LEAST i'. n < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> i'))\\<close> (is \\<open>_ < (LEAST i. ?P i)\\<close>) using nk cseq LeastI[of \\<open>?P\\<close> \\<open>k\\<close>] by metis\n          moreover\n          have ln: \\<open>l \\<le> n\\<close> using cs_order_le[OF ip(2,1) csli'[symmetric] csn[symmetric] nreti' in'] .\n          ultimately \n          have lles: \\<open>Suc l \\<le> (LEAST i'. n < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> i'))\\<close> by auto\n          \n          have nwcseq: \\<open>\\<forall>j'\\<in>{LEAST i'. n < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> i')..<k}. v \\<notin> writes (\\<pi> j')\\<close> proof \n            fix j' assume *: \\<open>j' \\<in> {LEAST i'. n < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> i')..<k}\\<close>\n            hence \\<open>(LEAST i'. n < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>'\\<^esup> i = cs\\<^bsup>\\<pi>\\<^esup> i')) \\<le> j'\\<close> by (metis (poly_guards_query) atLeastLessThan_iff)\n            hence \\<open>Suc l \\<le> j'\\<close> using lles by auto\n            moreover\n            have \\<open>j' < k\\<close> using * by (metis (poly_guards_query) atLeastLessThan_iff) \n            ultimately have \\<open>j'\\<in> {Suc l..<k}\\<close> by (metis (poly_guards_query) atLeastLessThan_iff)\n            thus \\<open>v\\<notin>writes (\\<pi> j')\\<close> using nwb by auto\n          qed\n          \n          from cp.intros(3)[OF ncp,folded path,OF kddl' lcdn' cseq sucn[symmetric] vneq[symmetric] nwcseq]\n          have \\<open>((\\<sigma>', k'), \\<sigma>, k) \\<in> cp\\<close> .\n          thus \\<open>((\\<sigma>, k), (\\<sigma>', k')) \\<in> cp\\<close> using cp.intros(4) by auto\n        next\n          assume lnotin\\<pi>': \\<open>\\<not> (\\<exists>i'. cs\\<^bsup>\\<pi>\\<^esup> l = cs\\<^bsup>\\<pi>'\\<^esup> i')\\<close>\n          show \\<open>?thesis\\<close> proof cases\n            assume \\<open>\\<exists> i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close>\n            then obtain i where csli: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> l'\\<close> by blast\n            have ilne: \\<open>i \\<noteq> l\\<close> using csl csli by auto\n            have ij: \\<open>i < k\\<close> using cs_order[OF ip(2,1) csli[symmetric] cseq nretl' lk'] .\n            have iv: \\<open>v \\<in> writes(\\<pi> i)\\<close> using lv' csli last_cs by metis\n            have il: \\<open>i < l\\<close> using kddl ilne ij iv unfolding is_ddi_def by auto\n            have nreti: \\<open>\\<pi> i \\<noteq> return\\<close> using csli nretl' last_cs by metis\n\n            obtain n n' where csn: \\<open>cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close>  and sucn: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close> and ilen: \\<open>i \\<le> n\\<close>\n            using converged_cd_diverge_cs [OF ip csli il lnotin\\<pi>' lk cseq[symmetric]] by metis \n          \n            \\<comment> \\<open>Can apply the IH to n and n'\\<close>\n          \n            have 1: \\<open>\\<pi> (Suc n) = suc (\\<pi> n) (\\<sigma>\\<^bsup>n\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n            have 2: \\<open>\\<pi>' (Suc n') = suc (\\<pi>' n') (\\<sigma>'\\<^bsup>n'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n            have 3: \\<open>\\<pi>' n' = \\<pi> n\\<close> using csn last_cs by metis\n            have nreads: \\<open>\\<sigma>\\<^bsup>n\\<^esup> \\<restriction> reads (\\<pi> n) \\<noteq> \\<sigma>'\\<^bsup>n'\\<^esup> \\<restriction> reads (\\<pi> n)\\<close> by (metis 1 2 3 sucn reads_restr_suc)\n            then obtain v' where v'read: \\<open>v'\\<in>reads (path \\<sigma> n)\\<close> \\<open>(\\<sigma>\\<^bsup>n\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v'\\<close> by (metis path(1) reads_restrict)\n            moreover  \n            have nl: \\<open>n < l\\<close> using lcdn is_cdi_def by auto\n            have nk: \\<open>n < k\\<close> using nl lk by simp\n            have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> by (metis ip(1) nl nret term_path_stable less_imp_le)\n            have nk': \\<open>n' < k'\\<close> using cs_order[OF ip csn cseq[symmetric] nretn nk] .\n            hence lenn: \\<open>n+n' < k+k'\\<close> using nk by auto\n            ultimately  \n            have ncp: \\<open>((\\<sigma>, n), (\\<sigma>', n')) \\<in> cp\\<close> using IH csn path by auto\n            \n            have nles': \\<open>n' < (LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))\\<close> (is \\<open>_ < (LEAST i. ?P i)\\<close>) using nk' cseq LeastI[of \\<open>?P\\<close> \\<open>k'\\<close>] by metis\n            moreover\n            have ln': \\<open>l' \\<le> n'\\<close> using cs_order_le[OF ip csli csn nreti ilen] .\n            ultimately \n            have lles': \\<open>Suc l' \\<le> (LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))\\<close> by auto\n          \n            have nwcseq': \\<open>\\<forall>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}. v \\<notin> writes (\\<pi>' j')\\<close> proof \n              fix j' assume *: \\<open>j' \\<in> {(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}\\<close>\n              hence \\<open>(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')) \\<le> j'\\<close> by (metis (poly_guards_query) atLeastLessThan_iff)\n              hence \\<open>Suc l' \\<le> j'\\<close> using lles' by auto\n              moreover\n              have \\<open>j' < k'\\<close> using * by (metis (poly_guards_query) atLeastLessThan_iff) \n              ultimately have \\<open>j'\\<in> {Suc l'..<k'}\\<close> by (metis (poly_guards_query) atLeastLessThan_iff)\n              thus \\<open>v\\<notin>writes (\\<pi>' j')\\<close> using nwb' by auto\n              qed\n            \n            from cp.intros(3)[OF ncp,folded path, OF kddl lcdn cseq[symmetric] sucn vneq nwcseq']\n            \n            show \\<open>((\\<sigma>, k), (\\<sigma>', k')) \\<in> cp\\<close> .\n          next\n            assume l'notin\\<pi>: \\<open>\\<not> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> l')\\<close>\n            define m where \\<open>m \\<equiv> 0::nat\\<close>\n            define m' where \\<open>m' \\<equiv> 0::nat\\<close>\n            have csm: \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close> unfolding m_def m'_def cs_0 by (metis \\<pi>0)\n            have ml: \\<open>m<l \\<or> m'<l'\\<close> using csm csl unfolding m_def m'_def by (metis neq0_conv)\n            have \\<open>\\<exists> n n'. cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n' \\<and> \\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n') \\<and> \n            (l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n \\<and> (\\<forall>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}. v\\<notin>writes (\\<pi>' j'))\n            \\<or> l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n' \\<and> (\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j)))\\<close>\n            using csm ml proof (induction \\<open>k+k'-(m+m')\\<close> arbitrary: \\<open>m\\<close> \\<open>m'\\<close> rule: less_induct)\n              case (less m m')\n              note csm = \\<open>cs\\<^bsup>\\<pi>\\<^esup> m = cs\\<^bsup>\\<pi>'\\<^esup> m'\\<close>\n              note lm = \\<open>m < l \\<or> m' < l'\\<close>\n              note IH = \\<open>\\<And> n n'. \n                k + k' - (n + n') < k + k' - (m + m') \\<Longrightarrow>\n                cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n' \\<Longrightarrow>\n                n < l \\<or> n' < l' \\<Longrightarrow> ?thesis\\<close>\n              show \\<open>?thesis\\<close> using lm proof\n                assume ml: \\<open>m < l\\<close>\n                obtain n n' where mn: \\<open>m \\<le> n\\<close> and csn: \\<open> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> and suc: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close>\n                  using  converged_cd_diverge_cs[OF ip csm ml lnotin\\<pi>' lk cseq[symmetric]] .\n                have nl: \\<open>n < l\\<close> using lcdn is_cdi_def by auto\n                hence nk: \\<open>n<k\\<close> using lk by auto\n                have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> using lcdn by (metis cd_not_ret)\n                have nk': \\<open>n'<k'\\<close> using cs_order[OF ip csn cseq[symmetric] nretn nk] .\n                show \\<open>?thesis\\<close> proof cases\n                  assume \\<open>\\<forall>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}. v\\<notin>writes (\\<pi>' j')\\<close>\n                  thus \\<open>?thesis\\<close> using lcdn csn suc by blast\n                next\n                  assume \\<open>\\<not>(\\<forall>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}. v\\<notin>writes (\\<pi>' j'))\\<close>\n                  then obtain j' where jin': \\<open>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}\\<close> and vwrite: \\<open>v\\<in>writes (\\<pi>' j')\\<close> by blast\n                  define i' where \\<open>i' \\<equiv> LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')\\<close>\n                  have Pk': \\<open>n' < k' \\<and> (\\<exists> k. cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close> (is \\<open>?P k'\\<close>) using nk' cseq[symmetric] by blast\n                  have ni': \\<open>n' < i'\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk'] i'_def by auto\n                  obtain i where csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk'] i'_def by blast\n                  have ij': \\<open>i'\\<le>j'\\<close> using jin'[folded i'_def] by auto\n                  have jk': \\<open>j'<k'\\<close> using jin'[folded i'_def] by auto\n                  have jl': \\<open>j' \\<le> l'\\<close> using kddl' jk' vwrite unfolding is_ddi_def by auto\n                  have nretn': \\<open>\\<pi>' n' \\<noteq> return\\<close> using nretn csn last_cs by metis\n                  have iln: \\<open>n<i\\<close> using cs_order[OF ip(2,1) csn[symmetric] csi[symmetric] nretn' ni'] .\n                  hence mi: \\<open>m < i\\<close> using mn by auto\n                  have nretm: \\<open>\\<pi> m \\<noteq> return\\<close> by (metis ip(1) mn nretn term_path_stable)\n                  have mi': \\<open>m'<i'\\<close> using cs_order[OF ip csm csi nretm mi] .\n                  have ik': \\<open>i' < k'\\<close> using ij' jk' by auto\n                  have nreti': \\<open>\\<pi>' i' \\<noteq> return\\<close> by (metis ij' jl' nretl' ip(2) term_path_stable)\n                  have ik: \\<open>i < k\\<close> using cs_order[OF ip(2,1) csi[symmetric] cseq nreti' ik'] .\n                  show \\<open>?thesis\\<close> proof cases\n                    assume il:\\<open>i < l\\<close>\n                    have le: \\<open>k + k' - (i +i') < k+k' - (m+m')\\<close> using mi mi' ik ik' by auto\n                    show \\<open>?thesis\\<close> using IH[OF le] using csi il by blast\n                  next\n                    assume \\<open>\\<not> i < l\\<close>\n                    hence li: \\<open>l \\<le> i\\<close> by auto\n                    have \\<open>i' \\<le> l'\\<close> using ij' jl' by auto\n                    hence il': \\<open>i' < l'\\<close> using  csi l'notin\\<pi> by fastforce \n                    obtain n n' where in': \\<open>i' \\<le> n'\\<close> and csn: \\<open> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> and suc: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close>\n                      using  converged_cd_diverge_cs[OF ip(2,1) csi[symmetric] il' _ lk' cseq] l'notin\\<pi> by metis\n                    have nk': \\<open>n' < k'\\<close> using lcdn' is_cdi_def lk' by auto\n                    have nretn': \\<open>\\<pi>' n' \\<noteq> return\\<close> by (metis cd_not_ret lcdn')\n                    have nk: \\<open>n < k\\<close> using cs_order[OF ip(2,1) csn[symmetric] cseq nretn' nk'] . \n                    define j where \\<open>j \\<equiv> LEAST j. n < j \\<and> (\\<exists>j'. cs\\<^bsup>\\<pi>'\\<^esup> j' = cs\\<^bsup>\\<pi>\\<^esup> j)\\<close>\n                    have Pk: \\<open>n < k \\<and> (\\<exists>j'. cs\\<^bsup>\\<pi>'\\<^esup> j' = cs\\<^bsup>\\<pi>\\<^esup> k)\\<close> (is \\<open>?P k\\<close>) using nk cseq by blast\n                    have nj: \\<open>n<j\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk] j_def by auto\n                    have ilen: \\<open>i \\<le> n\\<close> using cs_order_le[OF ip(2,1) csi[symmetric] csn[symmetric] nreti' in'] . \n                    hence lj: \\<open>l<j\\<close> using li nj by simp\n                    have \\<open>\\<forall>l\\<in>{l<..<k}. v \\<notin> writes (\\<pi> l)\\<close> using  kddl unfolding is_ddi_def by simp\n                    hence nw: \\<open>\\<forall>l\\<in>{j..<k}. v \\<notin> writes (\\<pi> l)\\<close> using lj by auto\n                    show \\<open>?thesis\\<close> using csn lcdn' suc nw[unfolded j_def] by blast\n                  qed\n                qed\n              next\n                assume ml': \\<open>m' < l'\\<close>\n                obtain n n' where mn': \\<open>m' \\<le> n'\\<close> and csn: \\<open> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> and suc: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close>\n                  using  converged_cd_diverge_cs[OF ip(2,1) csm[symmetric] ml' _ lk' cseq] l'notin\\<pi> by metis\n                have nl': \\<open>n' < l'\\<close> using lcdn' is_cdi_def by auto\n                hence nk': \\<open>n'<k'\\<close> using lk' by auto\n                have nretn': \\<open>\\<pi>' n' \\<noteq> return\\<close> using lcdn' by (metis cd_not_ret)\n                have nk: \\<open>n<k\\<close> using cs_order[OF ip(2,1) csn[symmetric] cseq nretn' nk'] .\n                show \\<open>?thesis\\<close> proof cases\n                  assume \\<open>\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j)\\<close>\n                  thus \\<open>?thesis\\<close> using lcdn' csn suc by blast\n                next\n                  assume \\<open>\\<not>(\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j))\\<close>\n                  then obtain j where jin: \\<open>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}\\<close> and vwrite: \\<open>v\\<in>writes (\\<pi> j)\\<close> by blast\n                  define i where \\<open>i \\<equiv> LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i)\\<close>\n                  have Pk: \\<open>n < k \\<and> (\\<exists> k'. cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>\\<^esup> k)\\<close> (is \\<open>?P k\\<close>) using nk cseq by blast\n                  have ni: \\<open>n < i\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk] i_def by auto\n                  obtain i' where csi: \\<open>cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk] i_def by metis\n                  have ij: \\<open>i\\<le>j\\<close> using jin[folded i_def] by auto\n                  have jk: \\<open>j<k\\<close> using jin[folded i_def] by auto\n                  have jl: \\<open>j \\<le> l\\<close> using kddl jk vwrite unfolding is_ddi_def by auto\n                  have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> using nretn' csn last_cs by metis\n                  have iln': \\<open>n'<i'\\<close> using cs_order[OF ip csn csi nretn ni] .\n                  hence mi': \\<open>m' < i'\\<close> using mn' by auto\n                  have nretm': \\<open>\\<pi>' m' \\<noteq> return\\<close> by (metis ip(2) mn' nretn' term_path_stable)\n                  have mi: \\<open>m<i\\<close> using cs_order[OF ip(2,1) csm[symmetric] csi[symmetric] nretm' mi'] .\n                  have ik: \\<open>i < k\\<close> using ij jk by auto\n                  have nreti: \\<open>\\<pi> i \\<noteq> return\\<close> by (metis ij ip(1) jl nret term_path_stable)\n                  have ik': \\<open>i' < k'\\<close> using cs_order[OF ip csi cseq[symmetric] nreti ik] .\n                  show \\<open>?thesis\\<close> proof cases\n                    assume il':\\<open>i' < l'\\<close>\n                    have le: \\<open>k + k' - (i +i') < k+k' - (m+m')\\<close> using mi mi' ik ik' by auto\n                    show \\<open>?thesis\\<close> using IH[OF le] using csi il' by blast\n                  next\n                    assume \\<open>\\<not> i' < l'\\<close>\n                    hence li': \\<open>l' \\<le> i'\\<close> by auto\n                    have \\<open>i \\<le> l\\<close> using ij jl by auto\n                    hence il: \\<open>i < l\\<close> using  csi lnotin\\<pi>' by fastforce \n                    obtain n n' where ilen: \\<open>i \\<le> n\\<close> and csn: \\<open> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and lcdn: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> and suc: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close>\n                      using  converged_cd_diverge_cs[OF ip csi il _ lk cseq[symmetric]] lnotin\\<pi>' by metis\n                    have nk: \\<open>n < k\\<close> using lcdn is_cdi_def lk by auto\n                    have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> by (metis cd_not_ret lcdn)\n                    have nk': \\<open>n' < k'\\<close> using cs_order[OF ip csn cseq[symmetric] nretn nk] . \n                    define j' where \\<open>j' \\<equiv> LEAST j'. n' < j' \\<and> (\\<exists>j. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> j')\\<close>\n                    have Pk': \\<open>n' < k' \\<and> (\\<exists>j. cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> k')\\<close> (is \\<open>?P k'\\<close>) using nk' cseq[symmetric] by blast\n                    have nj': \\<open>n'<j'\\<close> using LeastI[of \\<open>?P\\<close>, OF Pk'] j'_def by auto\n                    have in': \\<open>i' \\<le> n'\\<close> using cs_order_le[OF ip csi csn nreti ilen] . \n                    hence lj': \\<open>l'<j'\\<close> using li' nj' by simp\n                    have \\<open>\\<forall>l\\<in>{l'<..<k'}. v \\<notin> writes (\\<pi>' l)\\<close> using  kddl' unfolding is_ddi_def by simp\n                    hence nw': \\<open>\\<forall>l\\<in>{j'..<k'}. v \\<notin> writes (\\<pi>' l)\\<close> using lj' by auto\n                    show \\<open>?thesis\\<close> using csn lcdn suc nw'[unfolded j'_def] by blast\n                  qed\n                qed\n              qed\n            qed\n            then obtain n n' where csn: \\<open> cs\\<^bsup>\\<pi>\\<^esup> n = cs\\<^bsup>\\<pi>'\\<^esup> n'\\<close> and suc: \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close>\n            and cdor: \n            \\<open>(l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n \\<and> (\\<forall>j'\\<in>{(LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i'))..<k'}. v\\<notin>writes (\\<pi>' j'))\n            \\<or> l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n' \\<and> (\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j)))\\<close> \n            by blast\n            show \\<open>?thesis\\<close> using cdor proof\n              assume *: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n \\<and> (\\<forall>j'\\<in>{LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')..<k'}. v \\<notin> local.writes (\\<pi>' j'))\\<close>\n              hence lcdn: \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> by blast \n              have nowrite: \\<open>\\<forall>j'\\<in>{LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')..<k'}. v \\<notin> local.writes (\\<pi>' j')\\<close> using * by blast\n              show \\<open>?thesis\\<close> proof (rule cp.intros(3)[of \\<open>\\<sigma>\\<close> \\<open>n\\<close> \\<open>\\<sigma>'\\<close> \\<open>n'\\<close>,folded path])\n                show \\<open>l cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> n\\<close> using lcdn .\n                show \\<open>k dd\\<^bsup>\\<pi>,v\\<^esup>\\<rightarrow> l\\<close> using kddl .\n                show \\<open>cs\\<^bsup>\\<pi>\\<^esup> k = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> using cseq by simp\n                show \\<open>\\<pi> (Suc n) \\<noteq> \\<pi>' (Suc n')\\<close> using suc by simp\n                show \\<open>\\<forall>j'\\<in>{LEAST i'. n' < i' \\<and> (\\<exists>i. cs\\<^bsup>\\<pi>\\<^esup> i = cs\\<^bsup>\\<pi>'\\<^esup> i')..<k'}. v \\<notin> local.writes (\\<pi>' j')\\<close> using nowrite .\n                show \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v\\<close> using vneq .\n                have nk: \\<open>n < k\\<close> using lcdn lk is_cdi_def by auto\n                have nretn: \\<open>\\<pi> n \\<noteq> return\\<close> using cd_not_ret lcdn by metis\n                have nk': \\<open>n' < k'\\<close> using cs_order[OF ip csn cseq[symmetric] nretn nk] .\n                hence le: \\<open>n + n' < k + k'\\<close> using nk by auto\n                moreover\n                have 1: \\<open>\\<pi> (Suc n) = suc (\\<pi> n) (\\<sigma>\\<^bsup>n\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n                have 2: \\<open>\\<pi>' (Suc n') = suc (\\<pi>' n') (\\<sigma>'\\<^bsup>n'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n                have 3: \\<open>\\<pi>' n' = \\<pi> n\\<close> using csn last_cs by metis\n                have nreads: \\<open>\\<sigma>\\<^bsup>n\\<^esup> \\<restriction> reads (\\<pi> n) \\<noteq> \\<sigma>'\\<^bsup>n'\\<^esup> \\<restriction> reads (\\<pi> n)\\<close> by (metis 1 2 3 suc reads_restr_suc)\n                then obtain v' where v'read: \\<open>v'\\<in>reads (path \\<sigma> n)\\<close> \\<open>(\\<sigma>\\<^bsup>n\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v'\\<close> by (metis path(1) reads_restrict)\n                ultimately  \n                show \\<open>((\\<sigma>, n), (\\<sigma>', n')) \\<in> cp\\<close> using IH csn path by auto\n              qed\n            next\n              assume *: \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n' \\<and> (\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j))\\<close>\n              hence lcdn': \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> by blast \n              have nowrite: \\<open>\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j)\\<close> using * by blast\n              show \\<open>?thesis\\<close> proof (rule cp.intros(4), rule cp.intros(3)[of \\<open>\\<sigma>'\\<close> \\<open>n'\\<close> \\<open>\\<sigma>\\<close> \\<open>n\\<close>,folded path])\n                show \\<open>l' cd\\<^bsup>\\<pi>'\\<^esup>\\<rightarrow> n'\\<close> using lcdn' .\n                show \\<open>k' dd\\<^bsup>\\<pi>',v\\<^esup>\\<rightarrow> l'\\<close> using kddl' .\n                show \\<open>cs\\<^bsup>\\<pi>'\\<^esup> k' = cs\\<^bsup>\\<pi>\\<^esup> k\\<close> using cseq .\n                show \\<open>\\<pi>' (Suc n') \\<noteq> \\<pi> (Suc n)\\<close> using suc by simp\n                show \\<open>\\<forall>j\\<in>{(LEAST i. n < i \\<and> (\\<exists>i'. cs\\<^bsup>\\<pi>'\\<^esup> i' = cs\\<^bsup>\\<pi>\\<^esup> i))..<k}. v\\<notin>writes (\\<pi> j)\\<close> using nowrite .\n                show \\<open>(\\<sigma>'\\<^bsup>k'\\<^esup>) v \\<noteq> (\\<sigma>\\<^bsup>k\\<^esup>) v\\<close> using vneq by simp\n                have nk': \\<open>n' < k'\\<close> using lcdn' lk' is_cdi_def by auto\n                have nretn': \\<open>\\<pi>' n' \\<noteq> return\\<close> using cd_not_ret lcdn' by metis\n                have nk: \\<open>n < k\\<close> using cs_order[OF ip(2,1) csn[symmetric] cseq nretn' nk'] .\n                hence le: \\<open>n + n' < k + k'\\<close> using nk' by auto\n                moreover\n                have 1: \\<open>\\<pi> (Suc n) = suc (\\<pi> n) (\\<sigma>\\<^bsup>n\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(1) path_suc)\n                have 2: \\<open>\\<pi>' (Suc n') = suc (\\<pi>' n') (\\<sigma>'\\<^bsup>n'\\<^esup>)\\<close> by (metis step_suc_sem fst_conv path(2) path_suc)\n                have 3: \\<open>\\<pi>' n' = \\<pi> n\\<close> using csn last_cs by metis\n                have nreads: \\<open>\\<sigma>\\<^bsup>n\\<^esup> \\<restriction> reads (\\<pi> n) \\<noteq> \\<sigma>'\\<^bsup>n'\\<^esup> \\<restriction> reads (\\<pi> n)\\<close> by (metis 1 2 3 suc reads_restr_suc)\n                then obtain v' where v'read: \\<open>v'\\<in>reads (path \\<sigma> n)\\<close> \\<open>(\\<sigma>\\<^bsup>n\\<^esup>) v' \\<noteq> (\\<sigma>'\\<^bsup>n'\\<^esup>) v'\\<close> by (metis path(1) reads_restrict)\n                ultimately  \n                have \\<open>((\\<sigma>, n), (\\<sigma>', n')) \\<in> cp\\<close> using IH csn path by auto\n                thus \\<open>((\\<sigma>', n'), \\<sigma>, n) \\<in> cp\\<close> using cp.intros(4) by simp                \n              qed\n            qed\n          qed\n        qed\n      qed\n    qed\n  qed\nqed\n\n\ntheorem contradicting_in_cop: assumes \\<open>\\<sigma> =\\<^sub>L \\<sigma>'\\<close> and \\<open>(\\<sigma>',k') \\<cc> (\\<sigma>,k)\\<close> and \\<open>path \\<sigma> k \\<in> dom att\\<close> \nshows \\<open>((\\<sigma>,k),\\<sigma>',k') \\<in> cop\\<close> using assms(2) proof(cases) \n  case (1 \\<pi>' \\<pi>) \n  define j where \\<open>j \\<equiv> \\<pi> \\<exclamdown> cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close>\n  have csj: \\<open>cs\\<^bsup>\\<pi>\\<^esup> j = cs\\<^bsup>\\<pi>'\\<^esup> k'\\<close> unfolding j_def using 1 by (metis cs_not_nil cs_select_is_cs(1) path_is_path)\n  have suc: \\<open>\\<pi> (Suc j) \\<noteq> \\<pi>' (Suc k')\\<close> using 1 j_def by simp\n  have kcdj: \\<open>k cd\\<^bsup>\\<pi>\\<^esup>\\<rightarrow> j\\<close> by (metis cs_not_nil cs_select_is_cs(2) 1(1,2) j_def path_is_path)\n  obtain v where readv: \\<open>v\\<in>reads(path \\<sigma> j)\\<close> and vneq: \\<open>(\\<sigma>\\<^bsup>j\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v\\<close> using suc csj unfolding 1 by (metis IFC_def.suc_def 1(2) 1(3) last_cs path_suc reads_restr_suc reads_restrict)\n  have \\<open>((\\<sigma>,j),\\<sigma>',k') \\<in> cp\\<close> apply (rule contradicting_in_cp[OF assms(1)]) using readv vneq csj 1 by auto\n  thus \\<open>((\\<sigma>,k),\\<sigma>',k') \\<in> cop\\<close> using kcdj suc assms(3) cop.intros(2) unfolding 1 by auto\n  next\n  case (2 \\<pi>' \\<pi>)\n  obtain v where readv: \\<open>v\\<in>reads(path \\<sigma> k)\\<close> and vneq: \\<open>(\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v\\<close> using 2(2-4) by (metis reads_restrict)\n  have \\<open>((\\<sigma>,k),\\<sigma>',k') \\<in> cp\\<close> apply (rule contradicting_in_cp[OF assms(1)]) using readv vneq 2 by auto\n  thus \\<open>((\\<sigma>,k),\\<sigma>',k') \\<in> cop\\<close> using assms(3) cop.intros(1) unfolding 2 by auto\nqed\n\n\ntheorem cop_correct_term: fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \nassumes ret: \\<open>\\<pi> n = return\\<close> \\<open>\\<pi>' n' = return\\<close> and obsne: \\<open>obs \\<sigma> \\<noteq> obs \\<sigma>'\\<close> and leq: \\<open>\\<sigma> =\\<^sub>L \\<sigma>'\\<close>\nshows \\<open>\\<exists> k k'. ((\\<sigma>,k),\\<sigma>',k')\\<in> cop \\<or> ((\\<sigma>',k'),\\<sigma>,k)\\<in> cop\\<close>\nproof -\n  have *: \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom (att)) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom (att))\\<close> using  obs_neq_contradicts_term ret obsne \\<pi> \\<pi>' by auto\n  have leq' :\\<open>\\<sigma>' =\\<^sub>L \\<sigma>\\<close> using leq unfolding loweq_def by auto\n  from * contradicting_in_cop[OF leq] contradicting_in_cop[OF leq'] show \\<open>?thesis\\<close> unfolding \\<pi> \\<pi>' by metis\nqed\n\n\ntheorem cop_correct_ret: fixes \\<sigma> \\<sigma>' defines \\<pi>: \\<open>\\<pi> \\<equiv> path \\<sigma>\\<close> and \\<pi>': \\<open>\\<pi>' \\<equiv> path \\<sigma>'\\<close> \nassumes ret: \\<open>\\<pi> n = return\\<close> and obsne: \\<open>obs \\<sigma> i \\<noteq> obs \\<sigma>' i\\<close> and obs: \\<open>obs \\<sigma>' i \\<noteq> None\\<close> and leq: \\<open>\\<sigma> =\\<^sub>L \\<sigma>'\\<close>\nshows \\<open>\\<exists> k k'. ((\\<sigma>,k),\\<sigma>',k')\\<in> cop \\<or> ((\\<sigma>',k'),\\<sigma>,k)\\<in> cop\\<close>\nproof -\n  have *: \\<open>\\<exists> k k'. ((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> \\<pi> k \\<in> dom (att)) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> \\<pi>' k' \\<in> dom (att))\\<close>\n    by (metis (no_types, lifting) \\<pi> \\<pi>' obs obs_neq_ret_contradicts obsne ret) \n  have leq' :\\<open>\\<sigma>' =\\<^sub>L \\<sigma>\\<close> using leq unfolding loweq_def by auto\n  from * contradicting_in_cop[OF leq] contradicting_in_cop[OF leq'] show \\<open>?thesis\\<close> unfolding \\<pi> \\<pi>' by metis\nqed\n\n\ntheorem cop_correct_nterm: assumes obsne: \\<open>obs \\<sigma> k \\<noteq> obs \\<sigma>' k\\<close> \\<open>obs \\<sigma> k \\<noteq> None\\<close> \\<open>obs \\<sigma>' k \\<noteq> None\\<close> \nand leq: \\<open>\\<sigma> =\\<^sub>L \\<sigma>'\\<close>\nshows \\<open>\\<exists> k k'. ((\\<sigma>,k),\\<sigma>',k')\\<in> cop \\<or> ((\\<sigma>',k'),\\<sigma>,k)\\<in> cop\\<close>\nproof -\n  obtain k k' where \\<open>((\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> path \\<sigma> k \\<in> dom att) \\<or> ((\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> path \\<sigma>' k' \\<in> dom att)\\<close> \n  using obs_neq_some_contradicts[OF obsne] by metis\n  thus \\<open>?thesis\\<close> proof\n    assume *: \\<open>(\\<sigma>', k') \\<cc> (\\<sigma> ,k) \\<and> path \\<sigma> k \\<in> dom att\\<close>\n    hence \\<open>((\\<sigma>,k),\\<sigma>',k') \\<in> cop\\<close> using leq by (metis contradicting_in_cop)\n    thus \\<open>?thesis\\<close> using * by blast\n  next \n    assume *: \\<open>(\\<sigma>, k) \\<cc> (\\<sigma>' ,k') \\<and> path \\<sigma>' k' \\<in> dom att\\<close>\n    hence \\<open>((\\<sigma>',k'),\\<sigma>,k) \\<in> cop\\<close> using leq by (metis contradicting_in_cop loweq_def)\n    thus \\<open>?thesis\\<close> using * by blast\n  qed\nqed\n\n\nsubsection \\<open>Correctness of the Characterisation\\<close>\ntext_raw \\<open>\\label{sec:cor-cp}\\<close>\n\ntext \\<open>The following is our main correctness result. If there exist no critical observable paths,\nthen the program is secure.\\<close>\n\ntheorem cop_correct: assumes \\<open>cop = empty\\<close> shows \\<open>secure\\<close> proof (rule ccontr)\n  assume \\<open>\\<not> secure\\<close>\n  then obtain \\<sigma> \\<sigma>' where leq: \\<open> \\<sigma> =\\<^sub>L \\<sigma>'\\<close> \n    and **: \\<open>\\<not> obs \\<sigma> \\<approx> obs \\<sigma>' \\<or> (terminates \\<sigma> \\<and> \\<not> obs \\<sigma>' \\<lesssim> obs \\<sigma>)\\<close>\n    unfolding secure_def by blast\n  show \\<open>False\\<close> using ** proof\n    assume \\<open>\\<not> obs \\<sigma> \\<approx> obs \\<sigma>'\\<close>\n    then obtain k where \\<open>obs \\<sigma> k \\<noteq> obs \\<sigma>' k \\<and> obs \\<sigma> k \\<noteq> None \\<and> obs \\<sigma>' k \\<noteq> None\\<close> \n      unfolding obs_comp_def obs_prefix_def\n      by (metis kth_obs_stable linorder_neqE_nat obs_none_no_kth_obs obs_some_kth_obs) \n    thus \\<open>False\\<close> using cop_correct_nterm leq assms by auto\n  next\n    assume *: \\<open>terminates \\<sigma> \\<and> \\<not> obs \\<sigma>' \\<lesssim> obs \\<sigma>\\<close>\n    then obtain n where ret: \\<open>path \\<sigma> n = return\\<close>  \n      unfolding terminates_def by auto\n    obtain k where \\<open>obs \\<sigma> k \\<noteq> obs \\<sigma>' k \\<and> obs \\<sigma>' k \\<noteq> None\\<close> using * unfolding obs_prefix_def by metis \n    thus \\<open>False\\<close> using cop_correct_ret ret leq assms by (metis empty_iff) \n  qed\nqed\n\n\ntext \\<open>Our characterisation is not only correct, it is also precise in the way that \\<open>cp\\<close> characterises \nexactly the matching indices in executions for low equivalent input states where diverging data is read. \nThis follows easily as the inverse implication to lemma \\<open>contradicting_in_cp\\<close> can be shown by simple induction.\\<close>\n\ntheorem cp_iff_reads_contradict: \\<open>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cp \\<longleftrightarrow> \\<sigma> =\\<^sub>L \\<sigma>' \\<and> cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k' \\<and> (\\<exists> v\\<in>reads(path \\<sigma> k). (\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v)\\<close> \nproof\n  assume \\<open>\\<sigma> =\\<^sub>L \\<sigma>' \\<and> cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k' \\<and> (\\<exists>v\\<in>reads (path \\<sigma> k). (\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v)\\<close>\n  thus \\<open>((\\<sigma>, k), \\<sigma>', k') \\<in> cp\\<close> using contradicting_in_cp by blast \nnext\n  assume \\<open>((\\<sigma>, k), \\<sigma>', k') \\<in> cp\\<close> \n  thus \\<open>\\<sigma> =\\<^sub>L \\<sigma>' \\<and> cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k' \\<and> (\\<exists>v\\<in>reads (path \\<sigma> k). (\\<sigma>\\<^bsup>k\\<^esup>) v \\<noteq> (\\<sigma>'\\<^bsup>k'\\<^esup>) v)\\<close>\n  proof (induction)\n    case (1 \\<sigma> \\<sigma>' n n' h)\n    then show \\<open>?case\\<close> by blast \n  next\n    case (2 \\<sigma> k \\<sigma>' k' n v n')\n    have \\<open>v\\<in>reads (path \\<sigma> n)\\<close> using 2(2) unfolding is_ddi_def by auto\n    then show \\<open>?case\\<close> using 2 by auto\n  next\n    case (3 \\<sigma> k \\<sigma>' k' n v l n')\n    have \\<open>v\\<in>reads (path \\<sigma> n)\\<close> using 3(2) unfolding is_ddi_def by auto\n    then show \\<open>?case\\<close> using 3(4,6,8) by auto\n  next\n    case (4 \\<sigma> k \\<sigma>' k')\n    hence \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close> by simp\n    hence \\<open>path \\<sigma>' k' = path \\<sigma> k\\<close> by (metis last_cs) \n    moreover have \\<open>\\<sigma>' =\\<^sub>L \\<sigma>\\<close> using 4(2) unfolding loweq_def by simp\n    ultimately show \\<open>?case\\<close> using 4 by metis\n  qed\nqed\n\n\ntext \\<open>In the same way the inverse implication to \\<open>contradicting_in_cop\\<close> follows easily \nsuch that we obtain the following characterisation of \\<open>cop\\<close>.\\<close>\n\ntheorem cop_iff_contradicting: \\<open>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cop \\<longleftrightarrow> \\<sigma> =\\<^sub>L \\<sigma>' \\<and> (\\<sigma>',k') \\<cc> (\\<sigma>,k) \\<and> path \\<sigma> k \\<in> dom att\\<close> \nproof\n  assume \\<open>\\<sigma> =\\<^sub>L \\<sigma>' \\<and> (\\<sigma>', k') \\<cc> (\\<sigma>, k) \\<and> path \\<sigma> k \\<in> dom att\\<close> thus \\<open>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cop\\<close> using contradicting_in_cop by simp\nnext\n  assume \\<open>((\\<sigma>,k),(\\<sigma>',k')) \\<in> cop\\<close> \n  thus \\<open> \\<sigma> =\\<^sub>L \\<sigma>' \\<and> (\\<sigma>',k') \\<cc> (\\<sigma>,k) \\<and> path \\<sigma> k \\<in> dom att\\<close> proof (cases rule: cop.cases)\n    case 1\n    then show \\<open>?thesis\\<close> using cp_iff_reads_contradict contradicts.simps by (metis (full_types) reads_restrict1)\n  next\n    case (2 k)\n    then show \\<open>?thesis\\<close> using cp_iff_reads_contradict contradicts.simps\n      by (metis cd_is_cs_less cd_not_ret contradicts.intros(1) cs_select_id path_is_path) \n  qed\nqed\n\n\nsubsection \\<open>Correctness of the Single Path Approximation\\<close>\ntext_raw \\<open>\\label{sec:cor-scp}\\<close>\n\ntheorem cp_in_scp: assumes \\<open>((\\<sigma>,k),(\\<sigma>',k'))\\<in>cp\\<close> shows \\<open>(path \\<sigma>,k)\\<in>scp \\<and> (path \\<sigma>',k')\\<in>scp\\<close> \nusing assms proof(induction \\<open>\\<sigma>\\<close> \\<open>k\\<close> \\<open>\\<sigma>'\\<close> \\<open>k'\\<close> rule:cp.induct[case_names read_high dd dcd sym])\n  case (read_high \\<sigma> \\<sigma>' k k' h) \n  have \\<open>\\<sigma> h = (\\<sigma>\\<^bsup>k\\<^esup>) h\\<close> using read_high(5) by (simp add: no_writes_unchanged0)\n  moreover have \\<open>\\<sigma>' h = (\\<sigma>'\\<^bsup>k'\\<^esup>) h\\<close> using read_high(6) by (simp add: no_writes_unchanged0)\n  ultimately have \\<open>\\<sigma> h \\<noteq> \\<sigma>' h\\<close> using read_high(4) by simp \n  hence *: \\<open>h\\<in>hvars\\<close> using read_high(1) unfolding loweq_def by (metis Compl_iff IFC_def.restrict_def)\n  have 1: \\<open>(path \\<sigma>,k)\\<in>scp\\<close> using scp.intros(1) read_high(3,5) * by auto\n  have \\<open>path \\<sigma> k = path \\<sigma>' k'\\<close> using read_high(2) by (metis last_cs)\n  hence \\<open>(path \\<sigma>',k')\\<in>scp\\<close> using scp.intros(1) read_high(3,6) * by auto\n  thus \\<open>?case\\<close> using 1 by auto\nnext\n  case dd show \\<open>?case\\<close> using scp.intros(3) dd by auto  \nnext \n  case sym thus \\<open>?case\\<close> by blast\nnext\n  case (dcd \\<sigma> k \\<sigma>' k' n v l n')   \n  note scp.intros(4) is_dcdi_via_def cd_cs_swap cs_ipd\n  have 1: \\<open>(path \\<sigma>, n)\\<in>scp\\<close> using dcd.IH dcd.hyps(2) dcd.hyps(3) scp.intros(2) scp.intros(3) by blast \n  have csk: \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> k = cs\\<^bsup>path \\<sigma>'\\<^esup> k'\\<close> using cp_eq_cs[OF dcd(1)] .\n  have kn: \\<open>k<n\\<close> and kl: \\<open>k<l\\<close> and ln: \\<open>l<n\\<close> using dcd(2,3) unfolding is_ddi_def is_cdi_def by auto\n  have nret: \\<open>path \\<sigma> k \\<noteq> return\\<close> using cd_not_ret dcd.hyps(3) by auto\n  have \\<open>k' < n'\\<close> using kn csk dcd(4) cs_order nret path_is_path last_cs by blast\n  have 2: \\<open>(path \\<sigma>', n')\\<in>scp\\<close> proof cases    \n    assume j'ex: \\<open>\\<exists>j'\\<in>{k'..<n'}. v \\<in> writes (path \\<sigma>' j')\\<close>\n    hence \\<open>\\<exists>j'. j'\\<in>{k'..<n'} \\<and> v \\<in> writes (path \\<sigma>' j')\\<close> by auto\n    note * = GreatestI_ex_nat[OF this]\n    define j' where \\<open>j' == GREATEST j'. j'\\<in>{k'..<n'} \\<and> v \\<in> writes (path \\<sigma>' j')\\<close>\n    note ** = *[of \\<open>j'\\<close>,folded j'_def]  \n    have \\<open>k' \\<le> j'\\<close> \\<open>j'<n'\\<close> and j'write: \\<open>v \\<in> writes (path \\<sigma>' j')\\<close>\n      using \"*\" atLeastLessThan_iff j'_def nat_less_le by auto\n    have nowrite: \\<open>\\<forall> i'\\<in>{j'<..<n'}. v \\<notin> writes(path \\<sigma>' i')\\<close> proof (rule, rule ccontr)\n      fix i' assume \\<open>i' \\<in> {j'<..<n'}\\<close> \\<open>\\<not> v \\<notin> local.writes (path \\<sigma>' i')\\<close>\n      hence \\<open>i' \\<in> {k'..<n'} \\<and> v \\<in> local.writes (path \\<sigma>' i')\\<close> using \\<open>k' \\<le> j'\\<close> by auto\n      hence \\<open>i' \\<le> j'\\<close> using Greatest_le_nat\n        by (metis (no_types, lifting) atLeastLessThan_iff j'_def nat_less_le)\n      thus \\<open>False\\<close> using \\<open>i' \\<in> {j'<..<n'}\\<close> by auto\n    qed\n    have \\<open>path \\<sigma>' n' = path \\<sigma> n\\<close> using dcd(4) last_cs by metis\n    hence \\<open>v\\<in>reads(path \\<sigma>' n')\\<close> using dcd(2) unfolding is_ddi_def by auto    \n    hence nddj': \\<open>n' dd\\<^bsup>path \\<sigma>',v\\<^esup>\\<rightarrow> j'\\<close> using dcd(2) unfolding is_ddi_def using nowrite \\<open>j'<n'\\<close> j'write by auto \n    show \\<open>?thesis\\<close> proof cases\n      assume \\<open>j' cd\\<^bsup>path \\<sigma>'\\<^esup>\\<rightarrow> k'\\<close>\n      thus \\<open>(path \\<sigma>',n') \\<in> scp\\<close> using scp.intros(2) scp.intros(3) dcd.IH nddj' by fast\n    next\n      assume jcdk': \\<open>\\<not> j' cd\\<^bsup>path \\<sigma>'\\<^esup>\\<rightarrow> k'\\<close>\n      show \\<open>?thesis\\<close> proof cases\n        assume \\<open>j' = k'\\<close>\n        thus \\<open>?thesis\\<close> using scp.intros(3) dcd.IH nddj' by fastforce \n      next\n        assume \\<open>j' \\<noteq> k'\\<close> hence \\<open>k' < j'\\<close> using \\<open>k' \\<le> j'\\<close> by auto\n        have \\<open>path \\<sigma>' j' \\<noteq> return\\<close> using j'write writes_return by auto\n        hence ipdex':\\<open>\\<exists>j. j \\<in>{k'..j'} \\<and> path \\<sigma>' j = ipd (path \\<sigma>' k') \\<close> using path_is_path \\<open>k' < j'\\<close> jcdk' is_cdi_def by blast\n        define i' where \\<open>i' == LEAST j. j\\<in> {k'..j'} \\<and> path \\<sigma>' j = ipd (path \\<sigma>' k')\\<close>        \n        have iipd': \\<open>i'\\<in> {k'..j'}\\<close> \\<open>path \\<sigma>' i' = ipd (path \\<sigma>' k')\\<close> unfolding i'_def using LeastI_ex[OF ipdex'] by simp_all\n        have *:\\<open>\\<forall> i \\<in> {k'..<i'}. path \\<sigma>' i \\<noteq> ipd (path \\<sigma>' k')\\<close> proof (rule, rule ccontr)\n          fix i assume  *: \\<open>i \\<in> {k'..<i'}\\<close> \\<open>\\<not> path \\<sigma>' i \\<noteq> ipd (path \\<sigma>' k')\\<close>\n          hence **: \\<open>i \\<in>{k'..j'} \\<and> path \\<sigma>' i = ipd (path \\<sigma>' k')\\<close> (is \\<open>?P i\\<close>) using iipd'(1) by auto\n          thus \\<open>False\\<close> using Least_le[of \\<open>?P\\<close> \\<open>i\\<close>] i'_def * by auto\n        qed\n        have \\<open>i' \\<noteq> k'\\<close> using iipd'(2) by (metis csk last_cs nret path_in_nodes ipd_not_self)\n        hence \\<open>k'<i'\\<close> using iipd'(1) by simp\n        hence csi': \\<open>cs\\<^bsup>path \\<sigma>'\\<^esup> i' = [n\\<leftarrow>cs\\<^bsup>path \\<sigma>'\\<^esup> k' . ipd n \\<noteq> path \\<sigma>' i'] @ [path \\<sigma>' i']\\<close>using cs_ipd[OF iipd'(2) *] by fast \n        \n        have ncdk': \\<open>\\<not> n' cd\\<^bsup>path \\<sigma>'\\<^esup>\\<rightarrow> k'\\<close> using \\<open>j' < n'\\<close> \\<open>k' < j'\\<close> cdi_prefix jcdk' less_imp_le_nat by blast\n        hence ncdk: \\<open>\\<not> n cd\\<^bsup>path \\<sigma>\\<^esup>\\<rightarrow> k\\<close> using cd_cs_swap csk dcd(4) by blast        \n        have ipdex: \\<open>\\<exists>i. i\\<in>{k..n} \\<and> path \\<sigma> i = ipd (path \\<sigma> k)\\<close> (is \\<open>\\<exists>i. ?P i\\<close>) proof cases\n          assume *:\\<open>path \\<sigma> n = return\\<close> \n          from path_ret_ipd[of \\<open>path \\<sigma>\\<close> \\<open>k\\<close> \\<open>n\\<close>,OF path_is_path nret *]          \n          obtain i where \\<open>?P i\\<close> by fastforce thus \\<open>?thesis\\<close> by auto\n        next\n          assume *:\\<open>path \\<sigma> n \\<noteq> return\\<close>           \n          show \\<open>?thesis\\<close> using not_cd_impl_ipd [of \\<open>path \\<sigma>\\<close> \\<open>k\\<close> \\<open>n\\<close>, OF path_is_path \\<open>k<n\\<close> ncdk *] by auto\n        qed\n        \n        define i where  \\<open>i == LEAST j. j\\<in> {k..n} \\<and> path \\<sigma> j = ipd (path \\<sigma> k)\\<close>        \n        have iipd: \\<open>i\\<in> {k..n}\\<close> \\<open>path \\<sigma> i = ipd (path \\<sigma> k)\\<close> unfolding i_def using LeastI_ex[OF ipdex] by simp_all\n        have **:\\<open>\\<forall> i' \\<in> {k..<i}. path \\<sigma> i' \\<noteq> ipd (path \\<sigma> k)\\<close> proof (rule, rule ccontr)\n          fix i' assume  *: \\<open>i' \\<in> {k..<i}\\<close> \\<open>\\<not> path \\<sigma> i' \\<noteq> ipd (path \\<sigma> k)\\<close>\n          hence **: \\<open>i' \\<in>{k..n} \\<and> path \\<sigma> i' = ipd (path \\<sigma> k)\\<close> (is \\<open>?P i'\\<close>) using iipd(1) by auto\n          thus \\<open>False\\<close> using Least_le[of \\<open>?P\\<close> \\<open>i'\\<close>] i_def * by auto\n        qed\n        have \\<open>i \\<noteq> k\\<close> using iipd(2) by (metis nret path_in_nodes ipd_not_self)\n        hence \\<open>k<i\\<close> using iipd(1) by simp\n        hence \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> i = [n\\<leftarrow>cs\\<^bsup>path \\<sigma>\\<^esup> k . ipd n \\<noteq> path \\<sigma> i] @ [path \\<sigma> i]\\<close>using cs_ipd[OF iipd(2) **] by fast \n        hence csi: \\<open>cs\\<^bsup>path \\<sigma>\\<^esup> i = cs\\<^bsup>path \\<sigma>'\\<^esup> i'\\<close> using csi' csk unfolding iipd'(2) iipd(2) by (metis last_cs)\n        hence \\<open>(LEAST i'. k' < i' \\<and> (\\<exists>i. cs\\<^bsup>path \\<sigma>\\<^esup> i = cs\\<^bsup>path \\<sigma>'\\<^esup> i')) \\<le> i'\\<close> (is \\<open>(LEAST x. ?P x) \\<le> _\\<close>) \n          using \\<open>k' < i'\\<close> Least_le[of \\<open>?P\\<close> \\<open>i'\\<close>] by blast\n        hence nw: \\<open>\\<forall>j'\\<in>{i'..<n'}. v \\<notin> writes (path \\<sigma>' j')\\<close> using dcd(7) allB_atLeastLessThan_lower by blast  \n        moreover have \\<open>v \\<in> writes (path \\<sigma>' j')\\<close> using nddj' unfolding is_ddi_def by auto\n        moreover have \\<open>i' \\<le> j'\\<close> using iipd'(1) by auto\n        ultimately have \\<open>False\\<close>  using \\<open>j' < n'\\<close> by auto\n        thus \\<open>?thesis\\<close> ..\n      qed\n    qed\n  next\n    assume \\<open>\\<not> (\\<exists>j'\\<in>{k'..<n'}. v \\<in> writes (path \\<sigma>' j'))\\<close>\n    \n    hence \\<open>n' dcd\\<^bsup>path \\<sigma>',v\\<^esup>\\<rightarrow> k' via (path \\<sigma>) k\\<close> unfolding is_dcdi_via_def using dcd(2-4) csk \\<open>k'<n'\\<close> path_is_path by metis    \n    thus \\<open>?thesis\\<close> using dcd.IH scp.intros(4) by blast \n  qed\n  with 1 show \\<open>?case\\<close> ..\nqed   \n\n\ntheorem cop_in_scop: assumes \\<open>((\\<sigma>,k),(\\<sigma>',k'))\\<in>cop\\<close> shows \\<open>(path \\<sigma>,k)\\<in>scop \\<and> (path \\<sigma>',k')\\<in>scp\\<close>\n  using assms \n  apply (induct rule: cop.induct)\n   apply (simp add: cp_in_scp)\n  using cp_in_scp scop.intros scp.intros(2)\n   apply blast\n  using cp_in_scp scop.intros scp.intros(2)\n  apply blast\n  done\n\ntext \\<open>The main correctness result for out single execution approximation follows directly.\\<close>\n\ntheorem scop_correct: assumes \\<open>scop = empty\\<close> shows \\<open>secure\\<close> \n  using cop_correct assms cop_in_scop by fast \n\nend\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/IFC_Tracking/IFC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3290283238714608}}
{"text": "theory Hoare_Tactics\nimports Hoare_Typed RHL_Typed\nbegin\n\nsubsection {* Support lemmas for seq-tac *}\n\nfun rev_program_untyped :: \"program_rep \\<Rightarrow> program_rep \\<Rightarrow> program_rep\" where\n  \"rev_program_untyped p (Seq q r) = rev_program_untyped (Seq p q) r\"\n| \"rev_program_untyped p Skip = p\"\n| \"rev_program_untyped p q = Seq p q\"\n\nlemma rev_program_untyped_denotation: \"denotation_untyped (rev_program_untyped p q) = denotation_untyped (Seq p q)\"\n  by (induction q arbitrary: p, auto simp: denotation_untyped_assoc denotation_untyped_Skip[THEN ext])\nlemma rev_program_untyped_welltyped: \"well_typed p \\<Longrightarrow> well_typed q \\<Longrightarrow> well_typed (rev_program_untyped p q)\"\n  by (induction q arbitrary: p, auto)\n\nfun split_program_untyped :: \"nat \\<Rightarrow> nat \\<Rightarrow> program_rep \\<Rightarrow> program_rep \\<Rightarrow> program_rep\" where\n  \"split_program_untyped 0 m p (Seq q r) = Seq p (rev_program_untyped q r)\"\n| \"split_program_untyped 0 m p Skip = Seq p Skip\"\n| \"split_program_untyped (Suc n) m (Seq p q) r = split_program_untyped n m p (Seq q r)\"\n| \"split_program_untyped n m q r = Seq q r\"\n\n\nlemma split_program_untyped_denotation: \"denotation_untyped (split_program_untyped n m p q) = denotation_untyped (Seq p q)\"\n  apply (rule split_program_untyped.induct[where P=\"\\<lambda>n m p q. (denotation_untyped (split_program_untyped n m p q) = denotation_untyped (Seq p q))\"])\n  by (auto simp: rev_program_untyped_denotation denotation_untyped_assoc)\nlemma split_program_untyped_welltyped: \"well_typed p \\<Longrightarrow> well_typed q \\<Longrightarrow> well_typed (split_program_untyped n m p q)\"\n  apply (induction n arbitrary: p q)\n  close (case_tac q, auto simp: rev_program_untyped_welltyped)\n  by (case_tac p, auto)\ndefinition \"rev_program p q = Abs_program (rev_program_untyped (Rep_program p) (Rep_program q))\"\nlemma rev_program_seq: \"rev_program p (seq q r) == rev_program (seq p q) r\"\n  apply (rule eq_reflection)\n  by (metis rev_program_def Rep_seq rev_program_untyped.simps(1))\nlemma rev_program_skip: \"rev_program p Lang_Typed.skip == p\"\n  apply (rule eq_reflection)\n  by (metis Rep_program_inverse Rep_skip rev_program_def rev_program_untyped.simps(2)) \n  \n\ndefinition \"split_program n m p q = Abs_program (split_program_untyped n m (Rep_program p) (Rep_program q))\"\nlemma split_program_0_seq: \"split_program 0 m p (seq q r) == seq p (rev_program q r)\"\n  unfolding split_program_def seq_def rev_program_def\n  apply (subst Abs_program_inverse, auto)\n  by (subst Abs_program_inverse, auto simp: rev_program_untyped_welltyped)\nlemma split_program_0_skip: \"split_program 0 m p Lang_Typed.skip == seq p Lang_Typed.skip\"\n  unfolding split_program_def seq_def by simp\nlemma split_program_suc: \"split_program (Suc n) m (seq p q) r == split_program n m p (seq q r)\"\n  unfolding split_program_def seq_def rev_program_def \n  apply (subst Abs_program_inverse, auto)\n  by (subst Abs_program_inverse, auto)\n\ndefinition \"split_program_start n p == split_program n n p Lang_Typed.skip\"\n\nlemma denotation_split_program_start: \"denotation (split_program_start n p) = denotation p\"\n  unfolding split_program_start_def denotation_def split_program_def seq_def Rep_skip\n  by (subst Abs_program_inverse, auto simp: split_program_untyped_welltyped split_program_untyped_denotation)\n\nlemmas split_program_simps = split_program_start_def split_program_0_seq split_program_0_skip split_program_suc rev_program_seq rev_program_skip\n\nlemma insert_split: \n  assumes \"denotation (split_program_start n c) = denotation d\"\n  shows   \"denotation c = denotation d\"\nunfolding assms[symmetric]\nusing denotation_split_program_start[symmetric] .\n\n(*\nlemma insert_split: \n  fixes n\n  assumes \"hoare {P &m} \\<guillemotleft>split_program_start n c\\<guillemotright> {Q &m}\"\n  shows   \"hoare {P &m} \\<guillemotleft>c\\<guillemotright> {Q &m}\"\napply (rule denotation_eq_rule)\napply (fact denotation_split_program_start[symmetric])\nby (fact assms)\n*)\n\n\nsubsection {* Tactic/method declarations *}\n\nML_file \"hoare_tactics.ML\"\n\nmethod_setup wp = {* Hoare_Tactics.wp_config_parser >> (fn conf => fn ctx => (SIMPLE_METHOD' (Hoare_Tactics.wp_tac ctx conf))) *} \"weakest precondition (tail of program: if + assign + skip)\"\nmethod_setup wp1 = {* Hoare_Tactics.wp_config_parser >> (fn conf => fn ctx => (SIMPLE_METHOD' (Hoare_Tactics.wp1_tac ctx conf))) *} \"weakest precondition (last statement only)\"\nmethod_setup skip = {* Scan.succeed (K (SIMPLE_METHOD' Hoare_Tactics.skip_tac)) *} \"skip\"\nmethod_setup seq = {*\n (Scan.lift Parse.int -- \n  Scan.option (Scan.lift (Args.$$$ \"invariant\" |-- Args.colon) \n               |-- Hoare_Syntax.arg_parse_assertion))\n  >> (fn (n,inv) => fn ctx => (SIMPLE_METHOD' (Hoare_Tactics.seq_tac ctx n inv))) *}\n  \"seq n [invariant: term]\"\n\n\n(*lemma \"hoare {true} x := 1; y <- e x; x := 1 {y=1}\"\n  apply (wp sample)\n*)\n\n(* TODO:\n\n- conseq\n- exfalso\n- elim*\n- sp\n- wp n\n- rnd\n- if\n- while\n- call\n- proc\n- proc*\n- swap\n\n*)\n\nend\n\n", "meta": {"author": "dominique-unruh", "repo": "IsaCrypt", "sha": "1abc2041871af7b758adcc914b83f0d9135ec129", "save_path": "github-repos/isabelle/dominique-unruh-IsaCrypt", "path": "github-repos/isabelle/dominique-unruh-IsaCrypt/IsaCrypt-1abc2041871af7b758adcc914b83f0d9135ec129/Hoare_Tactics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.3290283238714608}}
{"text": "(*  Title:      HOL/Auth/n_mutualEx_lemma_inv__2_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_lemma_inv__2_on_rules imports n_mutualEx_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__2  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_TryVsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_CritVsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_ExitVsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_IdleVsinv__2) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mutualEx/n_mutualEx_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6959583250334526, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.3289680006597456}}
{"text": "header {* Compositionality of Resumption-Based Noninterference *}\n\ntheory Compositionality\nimports Resumption_Based\nbegin\n\n(* The results corresponding to the paper's Prop. 2 are marked below with \"theorem\". *)\n\ncontext PL_Indis\nbegin\n\nsubsection{* Compatibility and discreetness of atoms, tests and choices *}\n\ndefinition compatAtm where\n\"compatAtm atm \\<equiv>\n ALL s t. s \\<approx> t \\<longrightarrow> aval atm s \\<approx> aval atm t\"\n\ndefinition presAtm where\n\"presAtm atm \\<equiv>\n ALL s. s \\<approx> aval atm s\"\n\ndefinition compatTst where\n\"compatTst tst \\<equiv>\n ALL s t. s \\<approx> t \\<longrightarrow> tval tst s = tval tst t\"\n\nlemma discrAt_compatAt[simp]:\nassumes \"presAtm atm\"\nshows \"compatAtm atm\"\nusing assms unfolding compatAtm_def\nby (metis presAtm_def indis_sym indis_trans)\n\ndefinition compatCh where\n\"compatCh ch \\<equiv> \\<forall> s t. s \\<approx> t \\<longrightarrow> cval ch s = cval ch t\"\n\nlemma compatCh_cval[simp]:\nassumes \"compatCh ch\" and \"s \\<approx> t\"\nshows \" cval ch s = cval ch t\"\nusing assms unfolding compatCh_def by auto\n\n\nsubsection{* Compositionality of self-isomorphism *}\n\ntext{* Self-Isomorphism versus language constructs: *}\n\nlemma siso_Done[simp]:\n\"siso Done\"\nproof-\n  {fix c :: \"('test, 'atom, 'choice) cmd\"\n   assume \"c = Done\" hence \"siso c\"\n   apply induct by auto\n  }\n  thus ?thesis by blast\nqed\n\nlemma siso_Atm[simp]:\n\"siso (Atm atm) = compatAtm atm\"\nproof-\n  {fix c :: \"('test, 'atom, 'choice) cmd\"\n   assume \"\\<exists> atm. c = Atm atm \\<and> compatAtm atm\"\n   hence \"siso c\"\n   apply induct\n   apply (metis compatAtm_def eff_Atm cont_Atm wt_Atm)\n   by (metis cont_Atm siso_Done)\n  }\n  moreover have \"siso (Atm atm) \\<Longrightarrow> compatAtm atm\" unfolding compatAtm_def\n  by (metis brn.simps eff_Atm less_Suc_eq mult_less_cancel1 nat_mult_1 siso_cont_indis)\n  ultimately show ?thesis by blast\nqed\n\nlemma siso_Seq[simp]:\nassumes *: \"siso c1\" and **: \"siso c2\"\nshows \"siso (c1 ;; c2)\"\nproof-\n  {fix c :: \"('test, 'atom, 'choice) cmd\"\n   assume \"\\<exists> c1 c2. c = c1 ;; c2 \\<and> siso c1 \\<and> siso c2\"\n   hence \"siso c\"\n   proof induct\n     case (Obs c s t i)\n     then obtain c1 c2 where \"i < brn c1\"\n     and \"c = c1 ;; c2\" and \"siso c1 \\<and> siso c2\"\n     and \"s \\<approx> t\" by auto\n     thus ?case by (cases \"finished (cont c1 s i)\") auto\n   next\n     case (Cont c s i)\n     then obtain c1 c2 where \"i < brn c1\" and\n     \"c = c1 ;; c2 \\<and> siso c1 \\<and> siso c2\" by fastforce\n     thus ?case by(cases \"finished (cont c1 s i)\", auto)\n   qed\n  }\n  thus ?thesis using assms by blast\nqed\n\nlemma siso_While[simp]:\nassumes \"compatTst tst\" and \"siso c\"\nshows \"siso (While tst c)\"\nproof-\n  {fix c :: \"('test, 'atom, 'choice) cmd\"\n   assume\n   \"(\\<exists> tst d. compatTst tst \\<and> c = While tst d \\<and> siso d) \\<or>\n    (\\<exists> tst d1 d. compatTst tst \\<and> c = d1 ;; (While tst d) \\<and> siso d1 \\<and> siso d)\"\n   hence \"siso c\"\n   proof induct\n     case (Obs c s t i)\n     hence i: \" i < brn c\" and st: \"s \\<approx> t\" by auto\n     from Obs show ?case\n     proof(elim disjE exE conjE)\n       fix tst d\n       assume \"compatTst tst\" and \"c = While tst d\" and \"siso d\"\n       thus ?thesis using i st unfolding compatTst_def\n       by (cases \"tval tst s\", simp_all)\n     next\n       fix tst d1 d\n       assume \"compatTst tst\" and \"c = d1 ;; While tst d\"\n       and \"siso d1\" and \"siso d\"\n       thus ?thesis\n       using i st unfolding compatTst_def\n       apply(cases \"tval tst s\", simp_all)\n       by (cases \"finished (cont d1 s i)\", simp_all)+\n     qed\n   next\n     case (Cont c s i)\n     hence i: \" i < brn c\" by simp\n     from Cont show ?case\n     proof(elim disjE exE conjE)\n       fix tst d\n       assume \"compatTst tst\" and \"c = While tst d\" and \"siso d\"\n       thus ?thesis by (cases \"tval tst s\", simp_all)\n     next\n       fix tst d1 d\n       assume \"compatTst tst\" and \"c = d1 ;; While tst d\" and \"siso d1\" and \"siso d\"\n       thus ?thesis using i unfolding compatTst_def\n       apply (cases \"tval tst s\", simp_all)\n       by (cases \"finished (cont d1 s i)\", simp_all)+\n     qed\n   qed\n  }\n  thus ?thesis using assms by blast\nqed\n\nlemma siso_Ch[simp]:\nassumes \"compatCh ch\"\nand *: \"siso c1\" and **: \"siso c2\"\nshows \"siso (Ch ch c1 c2)\"\nproof-\n  {fix c :: \"('test, 'atom, 'choice) cmd\"\n   assume \"\\<exists> ch c1 c2. compatCh ch \\<and> c = Ch ch c1 c2 \\<and> siso c1 \\<and> siso c2\"\n   hence \"siso c\"\n   proof induct\n     case (Obs c s t i)\n     then obtain ch c1 c2 where \"i < 2\"\n     and \"compatCh ch\" and \"c = Ch ch c1 c2\" and \"siso c1 \\<and> siso c2\"\n     and \"s \\<approx> t\" by fastforce\n     thus ?case by (cases i) auto\n   next\n     case (Cont c s i)\n     then obtain ch c1 c2 where \"i < 2\" and\n     \"compatCh ch \\<and> c = Ch ch c1 c2 \\<and> siso c1 \\<and> siso c2\" by fastforce\n     thus ?case by (cases i) auto\n   qed\n  }\n  thus ?thesis using assms by blast\nqed\n\nlemma siso_Par[simp]:\nassumes \"properL cl\" and \"sisoL cl\"\nshows \"siso (Par cl)\"\nproof-\n  {fix c :: \"('test, 'atom, 'choice) cmd\"\n   assume \"\\<exists> cl. c = Par cl \\<and> properL cl \\<and> sisoL cl\"\n   hence \"siso c\"\n   proof induct\n     case (Obs c s t ii)\n     then obtain cl where ii: \"ii < brnL cl (length cl)\"\n     and cl: \"properL cl\"\n     and c: \"c = Par cl\" and siso: \"sisoL cl\"\n     and st: \"s \\<approx> t\" by auto\n     let ?N = \"length cl\"\n     from cl ii show ?case\n     apply(cases rule: brnL_cases)\n     using siso st cl unfolding c by fastforce\n   next\n     case (Cont c s ii)\n     then obtain cl where ii: \"ii < brnL cl (length cl)\"\n     and cl: \"properL cl\"\n     and c: \"c = Par cl\" and sisoL: \"sisoL cl\"\n     by auto\n     from cl ii show ?case\n     apply (cases rule: brnL_cases)\n     using cl sisoL unfolding c by auto\n   qed\n  }\n  thus ?thesis using assms by blast\nqed\n\nlemma siso_ParT[simp]:\nassumes \"properL cl\" and \"sisoL cl\"\nshows \"siso (ParT cl)\"\nproof-\n  {fix c :: \"('test, 'atom, 'choice) cmd\"\n   assume \"\\<exists> cl. c = ParT cl \\<and> properL cl \\<and> sisoL cl\"\n   hence \"siso c\"\n   proof induct\n     case (Obs c s t ii)\n     then obtain cl where ii: \"ii < brnL cl (length cl)\"\n     and cl: \"properL cl\"\n     and c: \"c = ParT cl\" and siso: \"sisoL cl\"\n     and st: \"s \\<approx> t\" by auto\n     let ?N = \"length cl\"\n     from cl ii show ?case proof (cases rule: brnL_cases)\n       case (Local n i)\n       show ?thesis (is \"?eff \\<and> ?wt \\<and> ?mv\")\n       proof-\n         have eff_mv: \"?eff \\<and> ?mv\" using Local siso cl st unfolding c by force\n         have wt: ?wt\n         proof(cases \"WtFT cl = 1\")\n           case True\n           thus ?thesis unfolding c using Local cl st siso True\n           by (cases \"n = pickFT cl \\<and> i = 0\") auto\n         next\n           case False\n           thus ?thesis unfolding c using Local cl st siso False\n           by (cases \"finished (cl!n)\") auto\n         qed\n         from eff_mv wt show ?thesis by simp\n       qed\n     qed\n   next\n     case (Cont c s ii)\n     then obtain cl where ii: \"ii < brnL cl (length cl)\"\n     and cl: \"properL cl\"\n     and c: \"c = ParT cl\" and siso: \"sisoL cl\"\n     by auto\n     from cl ii show ?case apply (cases rule: brnL_cases)\n     using siso cl unfolding c by force\n   qed\n  }\n  thus ?thesis using assms by blast\nqed\n\ntext{* Self-isomorphism implies strong bisimilarity: *}\n\nlemma bij_betw_emp[simp]:\n\"bij_betw f {} {}\"\nunfolding bij_betw_def by auto\n\nlemma part_full[simp]:\n\"part I {I}\"\nunfolding part_def by auto\n\ndefinition singlPart where\n\"singlPart I \\<equiv> {{i} | i . i \\<in> I}\"\n\nlemma part_singlPart[simp]:\n\"part I (singlPart I)\"\nunfolding part_def singlPart_def by auto\n\nlemma singlPart_inj_on[simp]:\n\"inj_on (image f) (singlPart I) = inj_on f I\"\nusing assms unfolding inj_on_def singlPart_def\napply auto\nby (metis image_insert insertI1 insert_absorb insert_code singleton_inject)\n\nlemma singlPart_surj[simp]:\n\"(image f) ` (singlPart I) = (singlPart J) \\<longleftrightarrow> f ` I = J\"\nusing assms unfolding inj_on_def singlPart_def apply auto by blast\n\nlemma singlPart_bij_betw[simp]:\n\"bij_betw (image f) (singlPart I) (singlPart J) = bij_betw f I J\"\nusing assms unfolding bij_betw_def by auto\n\nlemma singlPart_finite1:\nassumes \"finite (singlPart I)\"\nshows \"finite (I::'a set)\"\nproof-\n  def u \\<equiv> \"%i. {i::'a}\"\n  have \"u ` I \\<subseteq> singlPart I\" unfolding u_def singlPart_def by auto\n  moreover have \"inj_on u I\" unfolding u_def inj_on_def by auto\n  ultimately show ?thesis using assms\n  by (metis `inj_on u I` finite_imageD infinite_super)\nqed\n\n\n\nlemma emp_notIn_singlPart[simp]:\n\"{} \\<notin> singlPart I\"\nunfolding singlPart_def by auto\n\nlemma Sbis_coinduct[consumes 1, case_names step, coinduct set]:\n  \"R c d \\<Longrightarrow>\n    (\\<And>c d s t. R c d \\<Longrightarrow> s \\<approx> t \\<Longrightarrow>\n      \\<exists>P F. mC_C_part c d P F \\<and> inj_on F P \\<and> mC_C_wt c d s t P F \\<and>\n        (\\<forall>I\\<in>P. \\<forall>i\\<in>I. \\<forall>j\\<in>F I. \n                eff c s i \\<approx> eff d t j \\<and> (R (cont c s i) (cont d t j) \\<or> (cont c s i, cont d t j) \\<in> Sbis)))\n  \\<Longrightarrow> (c, d) \\<in> Sbis\"\n  using Sbis_coind[of \"{(x, y). R x y}\"]\n  unfolding Sretr_def matchC_C_def mC_C_def mC_C_eff_cont_def\n  apply (simp add: subset_eq Ball_def )\n  apply metis\n  done\n\n\n\nsubsection {* Discreetness versus language constructs: *}\n\nlemma discr_Done[simp]: \"discr Done\"\n  by coinduction auto\n\nlemma discr_Atm_presAtm[simp]: \"discr (Atm atm) = presAtm atm\"\nproof-\n  have \"presAtm atm \\<Longrightarrow> discr (Atm atm)\"\n    by (coinduction arbitrary: atm) (auto simp: presAtm_def)\n  moreover have \"discr (Atm atm) \\<Longrightarrow> presAtm atm\"\n    unfolding presAtm_def\n    by (metis One_nat_def brn.simps(2) discr.simps eff_Atm lessI)\n  ultimately show ?thesis by blast\nqed\n\nlemma discr_Seq[simp]:\n  \"discr c1 \\<Longrightarrow> discr c2 \\<Longrightarrow> discr (c1 ;; c2)\"\n  by (coinduction arbitrary: c1 c2)\n     (simp, metis cont_Seq_finished discr_cont cont_Seq_notFinished)\n\nlemma discr_While[simp]: assumes \"discr c\" shows \"discr (While tst c)\"\nproof-\n  {fix c :: \"('test, 'atom, 'choice) cmd\"\n   assume\n   \"(\\<exists> tst d. c = While tst d \\<and> discr d) \\<or>\n    (\\<exists> tst d1 d. c = d1 ;; (While tst d) \\<and> discr d1 \\<and> discr d)\"\n   hence \"discr c\"\n   apply induct apply safe\n   apply (metis eff_While indis_refl)\n   apply (metis cont_While_False discr_Done cont_While_True)\n   apply (metis eff_Seq discr.simps brn.simps)\n   by (metis cont_Seq_finished discr.simps cont_Seq_notFinished brn.simps)\n  }\n  thus ?thesis using assms by blast\nqed\n\nlemma discr_Ch[simp]: \"discr c1 \\<Longrightarrow> discr c2 \\<Longrightarrow> discr (Ch ch c1 c2)\"\n  by coinduction (simp, metis indis_refl less_2_cases cont_Ch_L cont_Ch_R)\n\nlemma discr_Par[simp]: \"properL cl \\<Longrightarrow> discrL cl \\<Longrightarrow> discr (Par cl)\"\nproof (coinduction arbitrary: cl, clarsimp)\n  fix cl ii s\n  assume *: \"properL cl\" \"ii < brnL cl (length cl)\" and \"discrL cl\"\n  from * show \"s \\<approx> eff (Par cl) s ii \\<and>\n    ((\\<exists>cl'. cont (Par cl) s ii = Par cl' \\<and> properL cl' \\<and> discrL cl') \\<or> discr (cont (Par cl) s ii))\"\n  proof (cases rule: brnL_cases)\n    case (Local n i)\n    with `discrL cl` have \"s \\<approx> eff (cl ! n) s i\" by simp\n    thus ?thesis\n      using Local `discrL cl` `properL cl` by auto\n  qed\nqed\n\nlemma discr_ParT[simp]: \"properL cl \\<Longrightarrow> discrL cl \\<Longrightarrow> discr (ParT cl)\"\nproof (coinduction arbitrary: cl, clarsimp)\n  fix p cl s ii assume \"properL cl\" \"ii < brnL cl (length cl)\" \"discrL cl\"\n  then show \"s \\<approx> eff (ParT cl) s ii \\<and>\n    ((\\<exists>cl'. cont (ParT cl) s ii = ParT cl' \\<and> properL cl' \\<and> discrL cl') \\<or> discr (cont (ParT cl) s ii))\"\n  proof (cases rule: brnL_cases)\n    case (Local n i)\n    have \"s \\<approx> eff (cl ! n) s i\" using Local `discrL cl` by simp\n    thus ?thesis using Local `discrL cl` `properL cl` by simp\n  qed\nqed\n\nlemma discr_finished[simp]: \"proper c \\<Longrightarrow> finished c \\<Longrightarrow> discr c\"\n  by (induct c rule: proper_induct) (auto simp: discrL_intro)\n\nsubsection{* Strong bisimilarity versus language constructs *}\n\nlemma Sbis_pres_discr_L:\n  \"c \\<approx>s d \\<Longrightarrow> discr d \\<Longrightarrow> discr c\"\nproof (coinduction arbitrary: d c, clarsimp)\n  fix c d s i\n  assume d: \"c \\<approx>s d\" \"discr d\" and i: \"i < brn c\" \n  then obtain P F where\n    match: \"mC_C Sbis c d s s P F\"\n    using Sbis_mC_C[of c d s s] by blast\n  hence \"\\<Union>P = {..<brn c}\"\n    using i unfolding mC_C_def mC_C_part_def part_def by simp\n  then obtain I where I: \"I \\<in> P\" and i: \"i \\<in> I\" using i by auto\n  obtain j where j: \"j \\<in> F I\"\n    using match I unfolding mC_C_def mC_C_part_def by blast\n  hence \"j < brn d\" using I match\n    unfolding mC_C_def mC_C_part_def part_def apply simp by blast\n  hence md: \"discr (cont d s j)\" and s: \"s \\<approx> eff d s j\"\n    using d discr_cont[of d j s] discr_eff_indis[of d j s] by auto\n  have \"eff c s i \\<approx> eff d s j\" and md2: \"cont c s i \\<approx>s cont d s j\"\n    using I i j match unfolding mC_C_def mC_C_eff_cont_def by auto\n  hence \"s \\<approx> eff c s i\" using s indis_sym indis_trans by blast\n  thus \"s \\<approx> eff c s i \\<and> ((\\<exists>d. cont c s i \\<approx>s d \\<and> discr d) \\<or> discr (cont c s i))\"\n    using md md2 by blast\nqed\n\nlemma Sbis_pres_discr_R:\nassumes \"discr c\" and \"c \\<approx>s d\"\nshows \"discr d\"\nusing assms Sbis_pres_discr_L Sbis_sym by blast\n\nlemma Sbis_finished_discr_L:\nassumes \"c \\<approx>s d\" and \"proper d\" and \"finished d\"\nshows \"discr c\"\nusing assms Sbis_pres_discr_L by auto\n\nlemma Sbis_finished_discr_R:\nassumes \"proper c\" and \"finished c\" and \"c \\<approx>s d\"\nshows \"discr d\"\nusing assms Sbis_pres_discr_R[of c d] by auto\n\n(*  *)\n\ndefinition thetaSD where\n\"thetaSD \\<equiv> {(c, d) | c d . proper c \\<and> proper d \\<and> discr c \\<and> discr d}\"\n\nlemma thetaSD_Sretr:\n\"thetaSD \\<subseteq> Sretr thetaSD\"\nunfolding Sretr_def matchC_C_def proof safe\n  fix c d s t\n  assume c_d: \"(c, d) \\<in> thetaSD\" and st: \"s \\<approx> t\"\n  hence p: \"proper c \\<and> proper d\" unfolding thetaSD_def by auto\n  let ?P = \"{{..<brn c}}\"\n  let ?F = \"% I. {..< brn d}\"\n  have 0: \"{..<brn c} \\<noteq> {}\"  \"{..<brn d} \\<noteq> {}\"\n  using p int_emp brn_gt_0 by blast+\n  show \"\\<exists>P F. mC_C thetaSD c d s t P F\"\n  apply -\n  apply(rule exI[of _ ?P]) apply(rule exI[of _ ?F])\n  unfolding mC_C_def proof(intro conjI)\n    show \"mC_C_part c d ?P ?F\"\n    unfolding mC_C_part_def using 0 unfolding part_def by auto\n  next\n    show \"inj_on ?F ?P\" unfolding inj_on_def by simp\n  next\n    show \"mC_C_wt c d s t ?P ?F\" unfolding mC_C_wt_def using p by auto\n  next\n    show \"mC_C_eff_cont thetaSD c d s t ?P ?F\"\n    unfolding mC_C_eff_cont_def proof clarify\n      fix I i j\n      assume i: \"i < brn c\" and j: \"j < brn d\"\n      hence \"s \\<approx> eff c s i\" using c_d unfolding thetaSD_def by simp\n      moreover have \"t \\<approx> eff d t j\" using i j c_d unfolding thetaSD_def by simp\n      ultimately have \"eff c s i \\<approx> eff d t j\" using st indis_sym indis_trans by blast\n      thus \"eff c s i \\<approx> eff d t j \\<and> (cont c s i, cont d t j) \\<in> thetaSD\"\n      using c_d i j unfolding thetaSD_def by auto\n    qed\n  qed\nqed\n\nlemma thetaSD_Sbis:\n\"thetaSD \\<subseteq> Sbis\"\nusing Sbis_raw_coind thetaSD_Sretr by blast\n\ntheorem discr_Sbis[simp]:\nassumes \"proper c\" and \"proper d\" and \"discr c\" and \"discr d\"\nshows \"c \\<approx>s d\"\nusing assms thetaSD_Sbis unfolding thetaSD_def by auto\n\n(* Done: *)\n\ndefinition thetaSDone where\n\"thetaSDone \\<equiv> {(Done, Done)}\"\n\nlemma thetaSDone_Sretr:\n\"thetaSDone \\<subseteq> Sretr thetaSDone\"\nunfolding Sretr_def matchC_C_def thetaSDone_def proof safe\n  fix s t assume st: \"s \\<approx> t\"\n  let ?P = \"{{0}}\" let ?F = id\n  show \"\\<exists>P F. mC_C {(Done, Done)} Done Done s t P F\"\n  apply(intro exI[of _ ?P]) apply(intro exI[of _ ?F])\n  unfolding m_defsAll part_def using st by auto\nqed\n\nlemma thetaSDone_Sbis:\n\"thetaSDone \\<subseteq> Sbis\"\nusing Sbis_raw_coind thetaSDone_Sretr by blast\n\ntheorem Done_Sbis[simp]:\n\"Done \\<approx>s Done\"\nusing thetaSDone_Sbis unfolding thetaSDone_def by auto\n\n(* Atm: *)\ndefinition thetaSAtm where\n\"thetaSAtm atm \\<equiv>\n {(Atm atm, Atm atm), (Done, Done)}\"\n\nlemma thetaSAtm_Sretr:\nassumes \"compatAtm atm\"\nshows \"thetaSAtm atm \\<subseteq> Sretr (thetaSAtm atm)\"\nunfolding Sretr_def matchC_C_def thetaSAtm_def proof safe\n  fix s t assume st: \"s \\<approx> t\"\n  let ?P = \"{{0}}\" let ?F = id\n  show \"\\<exists>P F. mC_C {(Atm atm, Atm atm), (Done, Done)} Done Done s t P F\"\n  apply(intro exI[of _ ?P]) apply(intro exI[of _ ?F])\n  unfolding m_defsAll part_def using st by auto\nnext\n  fix s t assume st: \"s \\<approx> t\"\n  let ?P = \"{{0}}\" let ?F = id\n  show \"\\<exists>P F. mC_C {(Atm atm, Atm atm), (Done, Done)} (Atm atm) (Atm atm) s t P F\"\n  apply(intro exI[of _ ?P]) apply(intro exI[of _ ?F])\n  unfolding m_defsAll part_def using st assms unfolding compatAtm_def by auto\nqed\n\nlemma thetaSAtm_Sbis:\nassumes \"compatAtm atm\"\nshows \"thetaSAtm atm \\<subseteq> Sbis\"\nusing assms Sbis_raw_coind thetaSAtm_Sretr by blast\n\ntheorem Atm_Sbis[simp]:\nassumes \"compatAtm atm\"\nshows \"Atm atm \\<approx>s Atm atm\"\nusing assms thetaSAtm_Sbis unfolding thetaSAtm_def by auto\n\n(* Seq *)\ndefinition thetaSSeqI where\n\"thetaSSeqI \\<equiv>\n {(e ;; c, e ;; d) | e c d . siso e \\<and> c \\<approx>s d}\"\n\nlemma thetaSSeqI_Sretr:\n\"thetaSSeqI \\<subseteq> Sretr (thetaSSeqI Un Sbis)\"\nunfolding Sretr_def matchC_C_def proof safe\n  fix c d s t\n  assume c_d: \"(c, d) \\<in> thetaSSeqI\" and st: \"s \\<approx> t\"\n  then obtain e c1 d1 where e: \"siso e\" and c1d1: \"c1 \\<approx>s d1\"\n  and c: \"c = e ;; c1\" and d: \"d = e ;; d1\"\n  unfolding thetaSSeqI_def by auto\n  let ?P = \"{{i} | i . i < brn e}\"\n  let ?F = \"%I. I\"\n  show \"\\<exists>P F. mC_C (thetaSSeqI Un Sbis) c d s t P F\"\n  apply(rule exI[of _ ?P]) apply(rule exI[of _ ?F])\n  unfolding mC_C_def proof (intro conjI)\n    show \"mC_C_part c d ?P ?F\"\n    unfolding mC_C_part_def proof (intro conjI)\n      show \"part {..<brn c} ?P\"\n      unfolding part_def proof safe\n        fix i assume \"i < brn c\"\n        thus \"i \\<in> \\<Union> ?P\" using c e st siso_cont_indis[of e s t] by auto\n      qed (unfold c, simp)\n      (*  *)\n      thus \"part {..<brn d} (?F ` ?P)\" unfolding c d by auto\n    qed auto\n  next\n    show \"mC_C_eff_cont (thetaSSeqI Un Sbis) c d s t ?P ?F\"\n    unfolding mC_C_eff_cont_def proof (intro impI allI, elim conjE)\n      fix I i j\n      assume I: \"I \\<in> ?P\" and i: \"i \\<in> I\" and j: \"j \\<in> I\"\n      show \"eff c s i \\<approx> eff d t j \\<and> (cont c s i, cont d t j) \\<in> thetaSSeqI \\<union> Sbis\"\n      proof(cases \"I = {}\")\n        case True thus ?thesis using i by simp\n      next\n        case False\n        then obtain i' where \"j \\<in> ?F {i'}\" and \"i' < brn e\"\n        using I j by auto\n        thus ?thesis\n        using st c_d e i j I unfolding c d thetaSSeqI_def\n        by (cases \"finished (cont e s i')\") auto\n      qed\n    qed\n  qed (insert st c_d c, unfold m_defsAll thetaSSeqI_def part_def, auto)\nqed\n\nlemma thetaSSeqI_Sbis:\n\"thetaSSeqI \\<subseteq> Sbis\"\nusing Sbis_coind thetaSSeqI_Sretr by blast\n\ntheorem Seq_siso_Sbis[simp]:\nassumes \"siso e\" and \"c2 \\<approx>s d2\"\nshows \"e ;; c2 \\<approx>s e ;; d2\"\nusing assms thetaSSeqI_Sbis unfolding thetaSSeqI_def by auto\n\n(*  *)\ndefinition thetaSSeqD where\n\"thetaSSeqD \\<equiv>\n {(c1 ;; c2, d1 ;; d2) |\n     c1 c2 d1 d2.\n        proper c1 \\<and> proper d1 \\<and> proper c2 \\<and> proper d2 \\<and>\n        discr c2 \\<and> discr d2 \\<and>\n        c1 \\<approx>s d1}\"\n\nlemma thetaSSeqD_Sretr:\n\"thetaSSeqD \\<subseteq> Sretr (thetaSSeqD Un Sbis)\"\nunfolding Sretr_def matchC_C_def proof safe\n  fix c d s t\n  assume c_d: \"(c, d) \\<in> thetaSSeqD\" and st: \"s \\<approx> t\"\n  then obtain c1 c2 d1 d2 where\n  c1d1: \"proper c1\" \"proper d1\" \"c1 \\<approx>s d1\" and\n  c2d2: \"proper c2\" \"proper d2\" \"discr c2\" \"discr d2\"\n  and c: \"c = c1 ;; c2\" and d: \"d = d1 ;; d2\"\n  unfolding thetaSSeqD_def by auto\n  from c1d1 st obtain P F\n  where match: \"mC_C Sbis c1 d1 s t P F\"\n  using Sbis_mC_C by blast\n  have P: \"\\<Union>P = {..<brn c1}\" and FP: \"\\<Union> (F ` P) = {..<brn d1}\"\n  using match unfolding mC_C_def mC_C_part_def part_def by metis+\n  show \"\\<exists>P F. mC_C (thetaSSeqD Un Sbis) c d s t P F\"\n  apply(rule exI[of _ P]) apply(rule exI[of _ F])\n  unfolding mC_C_def proof (intro conjI)\n    show \"mC_C_eff_cont (thetaSSeqD \\<union> Sbis) c d s t P F\"\n    unfolding mC_C_eff_cont_def proof(intro allI impI, elim conjE)\n      fix i j I assume I : \"I \\<in> P\" and i: \"i \\<in> I\" and j: \"j \\<in> F I\"\n      let ?c1' = \"cont c1 s i\"  let ?d1' = \"cont d1 t j\"\n      let ?s' = \"eff c1 s i\"  let ?t' = \"eff d1 t j\"\n      have \"i < brn c1\" using i I P by blast note i = this i\n      have \"j < brn d1\" using j I FP by blast note j = this j\n      have c1'd1': \"?c1' \\<approx>s ?d1'\"\n      \"proper ?c1'\" \"proper ?d1'\"\n      using c1d1 i j I match unfolding c mC_C_def mC_C_eff_cont_def by auto\n      show \"eff c s i \\<approx> eff d t j \\<and> (cont c s i, cont d t j) \\<in> thetaSSeqD \\<union> Sbis\"\n      (is \"?eff \\<and> ?cont\") proof\n        show ?eff using match I i j unfolding c d m_defsAll by simp\n      next\n        show ?cont\n        proof(cases \"finished ?c1'\")\n          case True note c1' = True\n          hence csi: \"cont c s i = c2\" using i match unfolding c m_defsAll by simp\n          show ?thesis\n          proof(cases \"finished ?d1'\")\n            case True\n            hence \"cont d t j = d2\" using j match unfolding d m_defsAll by simp\n            thus ?thesis using csi c2d2 by simp\n          next\n            case False\n            hence dtj: \"cont d t j = ?d1' ;; d2\"\n            using j match unfolding d m_defsAll by simp\n            have \"discr ?d1'\" using c1'd1'  c1' Sbis_finished_discr_R by blast\n            thus ?thesis using c1'd1' c2d2 unfolding csi dtj by simp\n          qed\n        next\n          case False note Done_c = False\n          hence csi: \"cont c s i = ?c1' ;; c2\"\n          using i match unfolding c m_defsAll by simp\n          show ?thesis\n          proof(cases \"finished (cont d1 t j)\")\n            case True note d1' = True\n            hence dtj: \"cont d t j = d2\" using j match unfolding d m_defsAll by simp\n            have \"discr ?c1'\" using c1'd1'  d1' Sbis_finished_discr_L by blast\n            thus ?thesis using c1'd1' c2d2 unfolding csi dtj by simp\n          next\n            case False\n            hence dtj: \"cont d t j = ?d1' ;; d2\" using j match unfolding d m_defsAll by simp\n            thus ?thesis unfolding csi dtj thetaSSeqD_def\n            using c1'd1' c2d2 by blast\n          qed\n        qed\n      qed\n    qed\n  qed(insert match, unfold m_defsAll c d, auto)\nqed\n\nlemma thetaSSeqD_Sbis:\n\"thetaSSeqD \\<subseteq> Sbis\"\nusing Sbis_coind thetaSSeqD_Sretr by blast\n\ntheorem Seq_Sbis[simp]:\nassumes \"proper c1\" and \"proper d1\" and \"proper c2\" and \"proper d2\"\nand \"c1 \\<approx>s d1\" and \"discr c2\" and \"discr d2\"\nshows \"c1 ;; c2 \\<approx>s d1 ;; d2\"\nusing assms thetaSSeqD_Sbis unfolding thetaSSeqD_def by auto\n\n(* Note: no compositionality w.r.t. while loop. *)\n\n(* Ch *)\ndefinition thetaSCh where\n\"thetaSCh ch c1 c2 d1 d2 \\<equiv> {(Ch ch c1 c2, Ch ch d1 d2)}\"\n\nlemma thetaSCh_Sretr:\nassumes \"compatCh ch\" and \"c1 \\<approx>s d1\" and \"c2 \\<approx>s d2\"\nshows \"thetaSCh ch c1 c2 d1 d2 \\<subseteq>\n       Sretr (thetaSCh ch c1 c2 d1 d2 \\<union> Sbis)\"\n(is \"?th \\<subseteq> Sretr (?th \\<union> Sbis)\")\nunfolding Sretr_def matchC_C_def proof safe\n  fix c d s t\n  assume c_d: \"(c, d) \\<in> ?th\" and st: \"s \\<approx> t\"\n  hence c: \"c = Ch ch c1 c2\" \"brn c = 2\"\n  and d: \"d = Ch ch d1 d2\" \"brn d = 2\"\n  unfolding thetaSCh_def by auto\n  let ?P = \"{{0}, {1}}\"\n  let ?F = \"%I. I\"\n  show \"\\<exists>P F. mC_C (?th Un Sbis) c d s t P F\"\n  apply(rule exI[of _ ?P]) apply(rule exI[of _ ?F])\n  using assms st c_d c unfolding m_defsAll thetaSCh_def part_def by auto\nqed\n\nlemma thetaSCh_Sbis:\nassumes \"compatCh ch\" and \"c1 \\<approx>s d1\" and \"c2 \\<approx>s d2\"\nshows \"thetaSCh ch c1 c2 d1 d2 \\<subseteq> Sbis\"\nusing Sbis_coind thetaSCh_Sretr[OF assms] by blast\n\ntheorem Ch_siso_Sbis[simp]:\nassumes \"compatCh ch\" and \"c1 \\<approx>s d1\" and \"c2 \\<approx>s d2\"\nshows \"Ch ch c1 c2 \\<approx>s Ch ch d1 d2\"\nusing thetaSCh_Sbis[OF assms] unfolding thetaSCh_def by auto\n\n(* Par: *)\n\ndefinition shift where\n\"shift cl n \\<equiv> image (%i. brnL cl n + i)\"\n\ndefinition \"back\" where\n\"back cl n \\<equiv> image (% ii. ii - brnL cl n)\"\n\nlemma emp_shift[simp]:\n\"shift cl n I = {} \\<longleftrightarrow> I = {}\"\nunfolding shift_def by auto\n\nlemma emp_shift_rev[simp]:\n\"{} = shift cl n I \\<longleftrightarrow> I = {}\"\nunfolding shift_def by auto\n\nlemma emp_back[simp]:\n\"back cl n II = {} \\<longleftrightarrow> II = {}\"\nunfolding back_def by force\n\nlemma emp_back_rev[simp]:\n\"{} = back cl n II \\<longleftrightarrow> II = {}\"\nunfolding back_def by force\n\nlemma in_shift[simp]:\n\"brnL cl n + i \\<in> shift cl n I \\<longleftrightarrow> i \\<in> I\"\nunfolding shift_def by auto\n\nlemma in_back[simp]:\n\"ii \\<in> II \\<Longrightarrow> ii - brnL cl n \\<in> back cl n II\"\nunfolding back_def by auto\n\nlemma in_back2[simp]:\nassumes \"ii > brnL cl n\" and \"II \\<subseteq> {brnL cl n ..<+ brn (cl!n)}\"\nshows \"ii - brnL cl n \\<in> back cl n II \\<longleftrightarrow> ii \\<in> II\" (is \"?L \\<longleftrightarrow> ?R\")\nusing assms unfolding back_def by force\n\nlemma shift[simp]:\nassumes \"I \\<subseteq> {..< brn (cl!n)}\"\nshows \"shift cl n I \\<subseteq> {brnL cl n ..<+ brn (cl!n)}\"\nusing assms unfolding shift_def by auto\n\nlemma shift2[simp]:\nassumes \"I \\<subseteq> {..< brn (cl!n)}\"\nand \"ii \\<in> shift cl n I\"\nshows \"brnL cl n \\<le> ii \\<and> ii < brnL cl n + brn (cl!n)\"\nusing assms unfolding shift_def by auto\n\nlemma shift3[simp]:\nassumes n: \"n < length cl\" and I: \"I \\<subseteq> {..< brn (cl!n)}\"\nand ii: \"ii \\<in> shift cl n I\"\nshows \"ii < brnL cl (length cl)\"\nproof-\n  have \"ii < brnL cl n + brn (cl!n)\" using I ii by simp\n  also have \"... \\<le> brnL cl (length cl)\" using n\n  by (metis brnL_Suc brnL_mono Suc_leI)\n  finally show ?thesis .\nqed\n\nlemma \"back\"[simp]:\nassumes \"II \\<subseteq> {brnL cl n ..<+ brn (cl!n)}\"\nshows \"back cl n II \\<subseteq> {..< brn (cl!n)}\"\nusing assms unfolding back_def by force\n\nlemma back2[simp]:\nassumes \"II \\<subseteq> {brnL cl n ..<+ brn (cl!n)}\"\nand \"i \\<in> back cl n II\"\nshows \"i < brn (cl!n)\"\nusing assms unfolding back_def by force\n\nlemma shift_inj[simp]:\n\"shift cl n I1 = shift cl n I2 \\<longleftrightarrow> I1 = I2\"\nunfolding shift_def by force\n\nlemma shift_mono[simp]:\n\"shift cl n I1 \\<subseteq> shift cl n I2 \\<longleftrightarrow> I1 \\<subseteq> I2\"\nunfolding shift_def by auto\n\nlemma shift_Int[simp]:\n\"shift cl n I1 \\<inter> shift cl n I2 = {} \\<longleftrightarrow> I1 \\<inter> I2 = {}\"\nunfolding shift_def by force\n\nlemma inj_shift: \"inj (shift cl n)\"\nunfolding inj_on_def by simp\n\n\n\nlemma back_shift[simp]:\n\"back cl n (shift cl n I) = I\"\nunfolding back_def shift_def by force\n\nlemma shift_back[simp]:\nassumes \"II \\<subseteq> {brnL cl n ..<+ brn (cl!n)}\"\nshows \"shift cl n (back cl n II) = II\"\nusing assms unfolding shift_def back_def atLeastLessThan_def by force\n\nlemma back_inj[simp]:\nassumes II1: \"II1 \\<subseteq> {brnL cl n ..<+ brn (cl!n)}\"\nand II2: \"II2 \\<subseteq> {brnL cl n ..<+ brn (cl!n)}\"\nshows \"back cl n II1 = back cl n II2 \\<longleftrightarrow> II1 = II2\" (is \"?L = ?R \\<longleftrightarrow> II1 = II2\")\nproof\n  have \"II1 = shift cl n ?L\" using II1 by simp\n  also assume \"?L = ?R\"\n  also have \"shift cl n ?R = II2\" using II2 by simp\n  finally show \"II1 = II2\" .\nqed auto\n\nlemma back_mono[simp]:\nassumes \"II1 \\<subseteq> {brnL cl n ..<+ brn (cl!n)}\"\nand \"II2 \\<subseteq> {brnL cl n ..< brnL cl n + brn (cl!n)}\"\nshows \"back cl n II1 \\<subseteq> back cl n II2 \\<longleftrightarrow> II1 \\<subseteq> II2\"\n(is \"?L \\<subseteq> ?R \\<longleftrightarrow> II1 \\<subseteq> II2\")\nproof-\n  have \"?L \\<subseteq> ?R \\<longleftrightarrow> shift cl n ?L \\<subseteq> shift cl n ?R\" by simp\n  also have \"... \\<longleftrightarrow> II1 \\<subseteq> II2\" using assms by simp\n  finally show ?thesis .\nqed\n\nlemma back_Int[simp]:\nassumes \"II1 \\<subseteq> {brnL cl n ..<+ brn (cl!n)}\"\nand \"II2 \\<subseteq> {brnL cl n ..< brnL cl n + brn (cl!n)}\"\nshows \"back cl n II1 \\<inter> back cl n II2 = {} \\<longleftrightarrow> II1 \\<inter> II2 = {}\"\n(is \"?L \\<inter> ?R = {} \\<longleftrightarrow> II1 \\<inter> II2 = {}\")\nproof-\n  have \"?L \\<inter> ?R = {} \\<longleftrightarrow> shift cl n ?L \\<inter> shift cl n ?R = {}\" by simp\n  also have \"... \\<longleftrightarrow> II1 \\<inter> II2 = {}\" using assms by simp\n  finally show ?thesis .\nqed\n\nlemma inj_on_back:\n\"inj_on (back cl n) (Pow {brnL cl n ..<+ brn (cl!n)})\"\nunfolding inj_on_def by simp\n\nlemma shift_surj:\nassumes \"II \\<subseteq> {brnL cl n ..<+ brn (cl!n)}\"\nshows \"\\<exists> I. I \\<subseteq> {..< brn (cl!n)} \\<and> shift cl n I = II\"\napply(intro exI[of _ \"back cl n II\"]) using assms by simp\n\nlemma back_surj:\nassumes \"I \\<subseteq> {..< brn (cl!n)}\"\nshows \"\\<exists> II. II \\<subseteq> {brnL cl n ..<+ brn (cl!n)} \\<and> back cl n II = I\"\napply(intro exI[of _ \"shift cl n I\"]) using assms by simp\n\nlemma shift_part[simp]:\nassumes \"part {..< brn (cl!n)} P\"\nshows \"part {brnL cl n ..<+ brn (cl!n)} (shift cl n ` P)\"\nunfolding part_def proof(intro conjI allI impI)\n  show \"\\<Union> (shift cl n ` P) = {brnL cl n ..<+ brn (cl!n)}\"\n  proof safe\n    fix ii I assume ii: \"ii \\<in> shift cl n I\" and \"I \\<in> P\"\n    hence \"I \\<subseteq> {..< brn (cl!n)}\" using assms unfolding part_def by blast\n    thus \"ii \\<in> {brnL cl n ..<+ brn (cl!n)}\" using ii by simp\n  next\n    fix ii assume ii_in: \"ii \\<in> {brnL cl n..<+brn (cl ! n)}\"\n    def i \\<equiv> \"ii - brnL cl n\"\n    have ii: \"ii = brnL cl n + i\" unfolding i_def using ii_in by force\n    have \"i \\<in> {..< brn (cl!n)}\" unfolding i_def using ii_in by auto\n    then obtain I where i: \"i \\<in> I\" and I: \"I \\<in> P\"\n    using assms unfolding part_def by blast\n    thus \"ii \\<in> \\<Union> (shift cl n ` P)\" unfolding ii by force\n  qed\nqed(insert assms, unfold part_def, force)\n\nlemma part_brn_disj1:\nassumes P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n)\"\nand n1: \"n1 < length cl\" and n2: \"n2 < length cl\"\nand II1: \"II1 \\<in> shift cl n1 ` (P n1)\" and II2: \"II2 \\<in> shift cl n2 ` (P n2)\" and d: \"n1 \\<noteq> n2\"\nshows \"II1 \\<inter> II2 = {}\"\nproof-\n  let ?N = \"length cl\"\n  obtain I1 I2 where I1: \"I1 \\<in> P n1\" and I2: \"I2 \\<in> P n2\"\n  and II1: \"II1 = shift cl n1 I1\" and II2: \"II2 = shift cl n2 I2\"\n  using II1 II2 by auto\n  have \"I1 \\<subseteq> {..< brn (cl!n1)}\" and \"I2 \\<subseteq> {..< brn (cl!n2)}\"\n  using n1 I1 n2 I2 P unfolding part_def by blast+\n  hence \"II1 \\<subseteq> {brnL cl n1 ..<+ brn (cl!n1)}\" and \"II2 \\<subseteq> {brnL cl n2 ..<+ brn (cl!n2)}\"\n  unfolding II1 II2 by auto\n  thus ?thesis using n1 n2 d brnL_Int by blast\nqed\n\n\n\nlemma part_brn_disj3:\nassumes P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n)\"\nand n1: \"n1 < length cl\" and n2: \"n2 < length cl\"\nand I1: \"I1 \\<in> P n1\" and I2: \"I2 \\<in> P n2\" and d: \"n1 \\<noteq> n2\"\nshows \"shift cl n1 I1 \\<inter> shift cl n2 I2 = {}\"\napply(rule part_brn_disj1)\nusing assms by auto\n\nlemma setsum_wt_Par_sub_shift[simp]:\nassumes cl: \"properL cl\" and n: \"n < length cl\" and\nI: \"I \\<subseteq> {..< brn (cl ! n)}\"\nshows\n\"setsum (wt (Par cl) s) (shift cl n I) =\n 1 / (length cl) * setsum (wt (cl ! n) s) I\"\nusing assms setsum_wt_Par_sub unfolding shift_def by simp\n\nlemma setsum_wt_ParT_sub_WtFT_pickFT_0_shift[simp]:\nassumes cl: \"properL cl\" and nf: \"WtFT cl = 1\"\nand I: \"I \\<subseteq> {..< brn (cl ! (pickFT cl))}\" \"0 \\<in> I\"\nshows\n\"setsum (wt (ParT cl) s) (shift cl (pickFT cl) I) = 1\"\nusing assms setsum_wt_ParT_sub_WtFT_pickFT_0\nunfolding shift_def by simp\n\nlemma setsum_wt_ParT_sub_WtFT_notPickFT_0_shift[simp]:\nassumes cl: \"properL cl\" and nf: \"WtFT cl = 1\" and n: \"n < length cl\"\nand I: \"I \\<subseteq> {..< brn (cl ! n)}\" and nI: \"n = pickFT cl \\<longrightarrow> 0 \\<notin> I\"\nshows \"setsum (wt (ParT cl) s) (shift cl n I) = 0\"\nusing assms setsum_wt_ParT_sub_WtFT_notPickFT_0 unfolding shift_def by simp\n\nlemma setsum_wt_ParT_sub_notWtFT_finished_shift[simp]:\nassumes cl: \"properL cl\" and nf: \"WtFT cl \\<noteq> 1\" and n: \"n < length cl\" and cln: \"finished (cl!n)\"\nand I: \"I \\<subseteq> {..< brn (cl ! n)}\"\nshows \"setsum (wt (ParT cl) s) (shift cl n I) = 0\"\nusing assms setsum_wt_ParT_sub_notWtFT_finished\nunfolding shift_def by simp\n\nlemma setsum_wt_ParT_sub_notWtFT_notFinished_shift[simp]:\nassumes cl: \"properL cl\" and nf: \"WtFT cl \\<noteq> 1\"\nand n: \"n < length cl\" and cln: \"\\<not> finished (cl!n)\"\nand I: \"I \\<subseteq> {..< brn (cl ! n)}\"\nshows\n\"setsum (wt (ParT cl) s) (shift cl n I) =\n (1 / (length cl)) / (1 - WtFT cl) * setsum (wt (cl ! n) s) I\"\nusing assms setsum_wt_ParT_sub_notWtFT_notFinished\nunfolding shift_def by simp\n\n(*  *)\n\ndefinition UNpart where\n\"UNpart cl P \\<equiv> \\<Union> n < length cl. shift cl n ` (P n)\"\n\nlemma UNpart_cases[elim, consumes 1, case_names Local]:\nassumes \"II \\<in> UNpart cl P\" and\n\"\\<And> n I. \\<lbrakk>n < length cl; I \\<in> P n; II = shift cl n I\\<rbrakk> \\<Longrightarrow> phi\"\nshows phi\nusing assms unfolding UNpart_def by auto\n\nlemma emp_UNpart:\nassumes \"\\<And> n. n < length cl \\<Longrightarrow> {} \\<notin> P n\"\nshows \"{} \\<notin> UNpart cl P\"\nusing assms unfolding UNpart_def by auto\n\nlemma part_UNpart:\nassumes cl: \"properL cl\" and\nP: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n)\"\nshows \"part {..< brnL cl (length cl)} (UNpart cl P)\"\n(is \"part ?J ?Q\")\nproof-\n  let ?N = \"length cl\"\n  have J: \"?J = (\\<Union> n \\<in> {..< ?N}. {brnL cl n ..<+ brn (cl!n)})\"\n  using cl brnL_UN by auto\n  have Q: \"?Q = (\\<Union> n \\<in> {..< ?N}. shift cl n ` (P n))\"\n  unfolding UNpart_def by auto\n  show ?thesis unfolding J Q apply(rule part_UN)\n  using P brnL_Int by auto\nqed\n\n(*  *)\n\ndefinition pickT_pred where\n\"pickT_pred cl P II n \\<equiv> n < length cl \\<and> II \\<in> shift cl n ` (P n)\"\n\ndefinition pickT where\n\"pickT cl P II \\<equiv> SOME n. pickT_pred cl P II n\"\n\nlemma pickT_pred:\nassumes \"II \\<in> UNpart cl P\"\nshows \"\\<exists> n. pickT_pred cl P II n\"\nusing assms unfolding UNpart_def pickT_pred_def by auto\n\nlemma pickT_pred_unique:\nassumes P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n)  \\<and> {} \\<notin> P n\"\nand 1: \"pickT_pred cl P II n1\" and 2: \"pickT_pred cl P II n2\"\nshows \"n1 = n2\"\nproof-\n  {assume \"n1 \\<noteq> n2\"\n   hence \"shift cl n1 ` (P n1) \\<inter> shift cl n2 ` (P n2) = {}\"\n   using assms part_brn_disj2 unfolding pickT_pred_def by blast\n   hence False using 1 2 unfolding pickT_pred_def by blast\n  }\n  thus ?thesis by auto\nqed\n\nlemma pickT_pred_pickT:\nassumes \"II \\<in> UNpart cl P\"\nshows \"pickT_pred cl P II (pickT cl P II)\"\nunfolding pickT_def apply(rule someI_ex)\nusing assms pickT_pred by auto\n\nlemma pickT_pred_pickT_unique:\nassumes P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand \"pickT_pred cl P II n\"\nshows \"n = pickT cl P II\"\nunfolding pickT_def apply(rule sym, rule some_equality)\nusing assms pickT_pred_unique[of cl P II] by auto\n\nlemma pickT_length[simp]:\nassumes \"II \\<in> UNpart cl P\"\nshows \"pickT cl P II < length cl\"\nusing assms pickT_pred_pickT unfolding pickT_pred_def by auto\n\nlemma pickT_shift[simp]:\nassumes \"II \\<in> UNpart cl P\"\nshows \"II \\<in> shift cl (pickT cl P II) ` (P (pickT cl P II))\"\nusing assms pickT_pred_pickT unfolding pickT_pred_def by auto\n\nlemma pickT_unique:\nassumes P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand \"n < length cl\" and \"II \\<in> shift cl n ` (P n)\"\nshows \"n = pickT cl P II\"\nusing assms pickT_pred_pickT_unique unfolding pickT_pred_def by auto\n\ndefinition UNlift where\n\"UNlift cl dl P F II \\<equiv>\n shift dl (pickT cl P II) (F (pickT cl P II) (back cl (pickT cl P II) II))\"\n\nlemma UNlift_shift[simp]:\nassumes P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand n: \"n < length cl\" and I: \"I \\<in> P n\"\nshows \"UNlift cl dl P F (shift cl n I) = shift dl n (F n I)\"\nproof-\n  let ?N = \"length cl\" def II \\<equiv> \"shift cl n I\"\n  have II: \"shift cl n I = II\" using II_def by simp\n  have n: \"n = pickT cl P II\" apply(rule pickT_unique)\n  using assms unfolding II_def by auto\n  have \"back cl n II = I\" unfolding II_def by simp\n  hence \"shift dl n (F n (back cl n II)) = shift dl n (F n I)\" by simp\n  thus ?thesis unfolding UNlift_def II n[THEN sym] .\nqed\n\nlemma UNlift_inj_on:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> part {..< brn (dl!n)} (F n ` (P n)) \\<and> {} \\<notin> F n ` (P n)\"\nand F: \"\\<And> n. n < length cl \\<Longrightarrow> inj_on (F n) (P n)\"\nshows \"inj_on (UNlift cl dl P F) (UNpart cl P)\" (is \"inj_on ?G ?Q\")\nunfolding inj_on_def proof clarify\n  fix II1 II2\n  assume II1: \"II1 \\<in> ?Q\" and II2: \"II2 \\<in> ?Q\" and G: \"?G II1 = ?G II2\"\n  from II1 show \"II1 = II2\"\n  proof(cases rule: UNpart_cases)\n    case (Local n1 I1)\n    hence n1: \"n1 < length cl\" \"n1 < length dl\" and I1: \"I1 \\<in> P n1\"\n    and II1: \"II1 = shift cl n1 I1\" using l by auto\n    hence G1_def: \"?G II1 = shift dl n1 (F n1 I1)\" using P by simp\n    have Pn1: \"part {..< brn (dl!n1)} (F n1 ` (P n1))\" \"{} \\<notin> F n1 ` (P n1)\"\n    using n1 FP by auto\n    have F1_in: \"F n1 I1 \\<in> F n1 ` (P n1)\" using I1 by simp\n    hence Fn1I1: \"F n1 I1 \\<noteq> {}\" \"F n1 I1 \\<subseteq> {..< brn (dl!n1)}\"\n    using Pn1 by (blast, unfold part_def, blast)\n    hence G1: \"?G II1 \\<noteq> {}\" \"?G II1 \\<subseteq> {brnL dl n1 ..<+ brn (dl!n1)}\"\n    unfolding G1_def by simp_all\n    from II2 show ?thesis\n    proof(cases rule: UNpart_cases)\n      case (Local n2 I2)\n      hence n2: \"n2 < length cl\" \"n2 < length dl\" and I2: \"I2 \\<in> P n2\"\n      and II2: \"II2 = shift cl n2 I2\" using l by auto\n      hence G2_def: \"?G II2 = shift dl n2 (F n2 I2)\" using P by simp\n      have Pn2: \"part {..< brn (dl!n2)} (F n2 ` (P n2))\" \"{} \\<notin> F n2 ` (P n2)\"\n      using n2 FP by auto\n      have F2_in: \"F n2 I2 \\<in> F n2 ` (P n2)\" using I2 by simp\n      hence Fn2I2: \"F n2 I2 \\<noteq> {}\" \"F n2 I2 \\<subseteq> {..< brn (dl!n2)}\"\n      using Pn2 by (blast, unfold part_def, blast)\n      hence G2: \"?G II2 \\<noteq> {}\" \"?G II2 \\<subseteq> {brnL dl n2 ..<+ brn (dl!n2)}\"\n      unfolding G2_def by simp_all\n      (*  *)\n      have n12: \"n1 = n2\" using n1 n2 G1 G2 G brnL_Int by blast\n      have \"F n1 I1 = F n2 I2\" using G unfolding G1_def G2_def n12 by simp\n      hence \"I1 = I2\" using I1 I2 n1 F unfolding n12 inj_on_def by simp\n      thus ?thesis unfolding II1 II2 n12 by simp\n    qed\n  qed\nqed\n\nlemma UNlift_UNpart:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nshows \"(UNlift cl dl P F) ` (UNpart cl P) = UNpart dl (%n. F n ` (P n))\" (is \"?G ` ?Q = ?R\")\nproof safe\n  fix II assume II: \"II \\<in> ?Q\"\n  thus \"?G II \\<in> ?R\"\n  proof(cases rule: UNpart_cases)\n    case (Local n I)\n    hence n: \"n < length cl\" \"n < length dl\" and I: \"I \\<in> P n\"\n    and II: \"II = shift cl n I\" using l by auto\n    hence G: \"?G II = shift dl n (F n I)\" using P by simp\n    show ?thesis using n I unfolding G UNpart_def by auto\n  qed\nnext\n  fix JJ assume JJ: \"JJ \\<in> ?R\"\n  thus \"JJ \\<in> ?G ` ?Q\"\n  proof(cases rule: UNpart_cases)\n    case (Local n J)\n    hence n: \"n < length cl\" \"n < length dl\" and J: \"J \\<in> F n ` (P n)\"\n    and JJ: \"JJ = shift dl n J\" using l by auto\n    then obtain I where I: \"I \\<in> P n\" and \"J = F n I\" by auto\n    hence \"JJ = shift dl n (F n I)\" using JJ by simp\n    also have \"... = UNlift cl dl P F (shift cl n I)\" using n I P by simp\n    finally have JJ: \"JJ = UNlift cl dl P F (shift cl n I)\" .\n    show ?thesis using n I unfolding JJ UNpart_def by auto\n  qed\nqed\n\nlemma emp_UNlift_UNpart:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> {} \\<notin> F n ` (P n)\"\nshows \"{} \\<notin> (UNlift cl dl P F) ` (UNpart cl P)\" (is \"{} \\<notin> ?R\")\nproof-\n  have R: \"?R = UNpart dl (%n. F n ` (P n))\"\n  apply(rule UNlift_UNpart) using assms by auto\n  show ?thesis unfolding R apply(rule emp_UNpart) using FP by simp\nqed\n\nlemma part_UNlift_UNpart:\nassumes l: \"length cl = length dl\" and dl: \"properL dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> part {..< brn (dl!n)} (F n ` (P n))\"\nshows \"part {..< brnL dl (length dl)} ((UNlift cl dl P F) ` (UNpart cl P))\" (is \"part ?C ?R\")\nproof-\n  have R: \"?R = UNpart dl (%n. F n ` (P n))\"\n  apply(rule UNlift_UNpart) using assms by auto\n  show ?thesis unfolding R apply(rule part_UNpart) using dl FP by auto\nqed\n\nlemma ss_wt_Par_UNlift:\nassumes l: \"length cl = length dl\"\nand cldl: \"properL cl\" \"properL dl\" and II: \"II \\<in> UNpart cl P\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> part {..< brn (dl!n)} (F n ` (P n))\"\nand sw:\n\"\\<And>n I. \\<lbrakk>n < length cl; I \\<in> P n\\<rbrakk> \\<Longrightarrow>\n     setsum (wt (cl ! n) s) I =\n     setsum (wt (dl ! n) t) (F n I)\"\nand st: \"s \\<approx> t\"\nshows\n\"setsum (wt (Par cl) s) II =\n setsum (wt (Par dl) t) (UNlift cl dl P F II)\" (is \"?L = ?R\")\nproof-\n  let ?N = \"length cl\"\n  let ?p = \"%n. 1 / ?N\" let ?q = \"%n. 1 / (length dl)\"\n  let ?ss = \"%n. s\" let ?tt = \"%n. t\"\n  have sstt: \"\\<And> n. n < ?N \\<Longrightarrow> ?ss n \\<approx> ?tt n\" using st by auto\n  have pq: \"\\<And> n. n < ?N \\<Longrightarrow> ?p n = ?q n\" and sstt: \"\\<And> n. n < ?N \\<Longrightarrow> ?ss n \\<approx> ?tt n\"\n  using assms l by auto\n  from II show ?thesis\n  proof(cases rule: UNpart_cases)\n    case (Local n I)\n    hence n: \"n < ?N\" \"n < length dl\" and I: \"I \\<in> P n\"\n    and II: \"II = shift cl n I\" using l by auto\n    have I_sub: \"I \\<subseteq> {..< brn (cl!n)}\" using n I P unfolding part_def by blast\n    hence FnI_sub: \"F n I \\<subseteq> {..< brn (dl!n)}\" using n I FP unfolding part_def by blast\n    have \"?L = (?p n) * setsum (wt (cl ! n) (?ss n)) I\"\n    unfolding II using n cldl I_sub by simp\n    also have \"... = (?q n) * setsum (wt (dl ! n) (?tt n)) (F n I)\"\n    using n pq apply simp using I sw[of n I] unfolding l by auto\n    also have \"... = ?R\"\n    unfolding II using l cldl n FnI_sub P I by simp\n    finally show ?thesis .\n  qed\nqed\n\n(* *)\n\ndefinition thetaSPar where\n\"thetaSPar \\<equiv>\n {(Par cl, Par dl) |\n    cl dl. properL cl \\<and> properL dl \\<and> SbisL cl dl}\"\n\nlemma cont_eff_Par_UNlift:\nassumes l: \"length cl = length dl\"\nand cldl: \"properL cl\" \"properL dl\" \"SbisL cl dl\"\nand II: \"II \\<in> UNpart cl P\" and ii: \"ii \\<in> II\" and jj: \"jj \\<in> UNlift cl dl P F II\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> part {..< brn (dl!n)} (F n ` (P n))\"\nand eff_cont:\n\"\\<And>n I i j. \\<lbrakk>n < length cl; I \\<in> P n; i \\<in> I; j \\<in> F n I\\<rbrakk> \\<Longrightarrow>\n  eff (cl!n) s i \\<approx> eff (dl!n) t j \\<and>\n  cont (cl!n) s i \\<approx>s cont (dl!n) t j\"\nand st: \"s \\<approx> t\"\nshows\n\"eff (Par cl) s ii \\<approx> eff (Par dl) t jj \\<and>\n (cont (Par cl) s ii, cont (Par dl) t jj) \\<in> thetaSPar\"\n(is \"?eff \\<and> ?cont\")\nproof-\n  let ?N = \"length cl\"\n  let ?p = \"%n. 1/?N\" let ?q = \"%n. 1/(length dl)\"\n  let ?ss = \"%n. s\" let ?tt = \"%n. t\"\n  have sstt: \"\\<And> n. n < ?N \\<Longrightarrow> ?ss n \\<approx> ?tt n\"\n  using st l by auto\n  have pq: \"\\<And> n. n < ?N \\<Longrightarrow> ?p n = ?q n\" and sstt: \"\\<And> n. n < ?N \\<Longrightarrow> ?ss n \\<approx> ?tt n\"\n  using assms l by auto\n  from II show ?thesis\n  proof(cases rule: UNpart_cases)\n    case (Local n I)\n    hence n: \"n < length cl\" \"n < length dl\" and I: \"I \\<in> P n\"\n    and II: \"II = shift cl n I\" using l by auto\n    from ii II obtain i where i: \"i \\<in> I\" and ii: \"ii = brnL cl n + i\"\n    unfolding shift_def by auto\n    have \"i < brn (cl!n)\" using i I n P unfolding part_def by blast note i = this i\n    have jj: \"jj \\<in> shift dl n (F n I)\" using jj P n I unfolding II by simp\n    from jj II obtain j where j: \"j \\<in> F n I\" and jj: \"jj = brnL dl n + j\"\n    unfolding shift_def by auto\n    have \"j < brn (dl!n)\" using j I n FP unfolding part_def by blast note j = this j\n    show ?thesis\n    proof\n      have \"eff (cl!n) (?ss n) i \\<approx> eff (dl!n) (?tt n) j\"\n      using n I i j eff_cont by blast\n      thus ?eff unfolding ii jj using st cldl n i j by simp\n    next\n      have \"cont (cl!n) (?ss n) i \\<approx>s cont (dl!n) (?tt n) j\"\n      using n I i j eff_cont by blast\n      thus ?cont unfolding ii jj thetaSPar_def using n i j l cldl by simp\n    qed\n  qed\nqed\n\nlemma thetaSPar_Sretr: \"thetaSPar \\<subseteq> Sretr (thetaSPar)\"\nunfolding Sretr_def matchC_C_def proof safe\n  fix c d s t\n  assume c_d: \"(c, d) \\<in> thetaSPar\" and st: \"s \\<approx> t\"\n  then obtain cl dl where\n  c: \"c = Par cl\" and d: \"d = Par dl\" and\n  cldl: \"properL cl\" \"properL dl\" \"SbisL cl dl\"\n  unfolding thetaSPar_def by blast\n  let ?N = \"length cl\"\n  let ?ss = \"%n. s\" let ?tt = \"%n. t\"\n  have N: \"?N = length dl\" using cldl by simp\n  have sstt: \"\\<And> n. n < ?N \\<Longrightarrow> ?ss n \\<approx> ?tt n\"\n  using assms st N by auto\n  let ?phi = \"%n PFn. mC_C Sbis (cl ! n) (dl ! n) (?ss n) (?tt n) (fst PFn) (snd PFn)\"\n  {fix n assume n: \"n < ?N\"\n   hence \"cl ! n \\<approx>s dl ! n\" using cldl by auto\n   hence \"\\<exists> PFn. ?phi n PFn\" using n Sbis_mC_C sstt by fastforce\n  }\n  then obtain PF where phi: \"\\<And>n. n < ?N \\<Longrightarrow> ?phi n (PF n)\"\n  using bchoice[of \"{..< ?N}\" ?phi] by blast\n  def P \\<equiv> \"fst o PF\" def F \\<equiv> \"snd o PF\"\n  have m: \"\\<And>n. n < ?N \\<Longrightarrow> mC_C Sbis (cl ! n) (dl ! n) (?ss n) (?tt n) (P n) (F n)\"\n  using phi unfolding P_def F_def by auto\n  (*  *)\n  have brn_c: \"brn c = brnL cl ?N\" unfolding c by simp\n  have brn_d: \"brn d = brnL dl (length dl)\" unfolding d by simp\n  have P: \"\\<And>n. n < ?N \\<Longrightarrow> part {..< brn (cl ! n)} (P n) \\<and> {} \\<notin> (P n)\"\n  using m unfolding m_defsAll part_def by auto\n  have FP: \"\\<And>n. n < length dl \\<Longrightarrow> part {..< brn (dl ! n)} (F n ` (P n)) \\<and> {} \\<notin> F n ` (P n)\"\n  using m N unfolding m_defsAll part_def by auto\n  have F: \"\\<And>n. n < ?N \\<Longrightarrow> inj_on (F n) (P n)\" using m unfolding m_defsAll by auto\n  have sw: \"\\<And>n I. \\<lbrakk>n < length cl; I \\<in> P n\\<rbrakk> \\<Longrightarrow>\n     setsum (wt (cl ! n) (?ss n)) I = setsum (wt (dl ! n) (?tt n)) (F n I)\"\n  using m unfolding mC_C_def mC_C_wt_def by auto\n  have eff_cont: \"\\<And>n I i j. \\<lbrakk>n < length cl; I \\<in> P n; i \\<in> I; j \\<in> F n I\\<rbrakk> \\<Longrightarrow>\n     eff (cl!n) (?ss n) i \\<approx> eff (dl!n) (?tt n) j \\<and>\n     cont (cl!n) (?ss n) i \\<approx>s cont (dl!n) (?tt n) j\"\n  using m unfolding mC_C_def mC_C_eff_cont_def by auto\n  (*  *)\n  def Q \\<equiv> \"UNpart cl P\" def G \\<equiv> \"UNlift cl dl P F\"\n  note defi = Q_def G_def brn_c brn_d\n  show \"\\<exists>Q G. mC_C (thetaSPar) c d s t Q G\"\n  apply(rule exI[of _ Q]) apply(rule exI[of _ G])\n  unfolding mC_C_def proof (intro conjI)\n    show \"mC_C_part c d Q G\" unfolding mC_C_part_def proof(intro conjI)\n      show \"{} \\<notin> Q\" unfolding defi apply(rule emp_UNpart) using P by simp\n      show \"{} \\<notin> G ` Q\" unfolding defi apply(rule emp_UNlift_UNpart) using N P FP by auto\n      show \"part {..<brn c} Q\"\n      unfolding defi apply(rule part_UNpart) using cldl P by auto\n      show \"part {..<brn d} (G ` Q)\"\n      unfolding defi apply(rule part_UNlift_UNpart) using N cldl P FP by auto\n    qed\n  next\n    show \"inj_on G Q\"\n    unfolding defi apply(rule UNlift_inj_on) using N P FP F by auto\n  next\n    show \"mC_C_wt c d s t Q G\"\n    unfolding mC_C_wt_def defi proof clarify\n      fix I assume \"I \\<in> UNpart cl P\"\n      thus \"setsum (wt c s) I = setsum (wt d t) (UNlift cl dl P F I)\"\n      unfolding c d apply(intro ss_wt_Par_UNlift)\n      using N cldl P FP sw st by auto\n    qed\n  next\n    show \"mC_C_eff_cont (thetaSPar) c d s t Q G\"\n    unfolding mC_C_eff_cont_def proof clarify\n      fix II ii jj assume II: \"II \\<in> Q\" and ii: \"ii \\<in> II\" and jj: \"jj \\<in> G II\"\n      thus \"eff c s ii \\<approx> eff d t jj \\<and> (cont c s ii, cont d t jj) \\<in> thetaSPar\"\n      unfolding defi c d apply(intro cont_eff_Par_UNlift)\n      using N cldl P FP eff_cont st by blast+\n    qed\n  qed\nqed\n\nlemma thetaSPar_Sbis: \"thetaSPar \\<subseteq> Sbis\"\nusing assms Sbis_raw_coind thetaSPar_Sretr by blast\n\ntheorem Par_Sbis[simp]:\nassumes \"properL cl\" and \"properL dl\" \"SbisL cl dl\"\nshows \"Par cl \\<approx>s Par dl\"\nusing assms thetaSPar_Sbis unfolding thetaSPar_def by blast\n\n\nsubsection{* 01-bisimilarity versus language constructs *}\n\n(* Discreetness: *)\nlemma ZObis_pres_discr_L: \"c \\<approx>01 d \\<Longrightarrow> discr d \\<Longrightarrow> discr c\"\nproof (coinduction arbitrary: d c, clarsimp)\n  fix s i c d assume i: \"i < brn c\" and d: \"discr d\" and c_d: \"c \\<approx>01 d\"\n  then obtain I0 P F where\n    match: \"mC_ZOC ZObis c d s s I0 P F\"\n    using ZObis_mC_ZOC[of c d s s] by blast\n  hence \"\\<Union>P = {..<brn c}\"\n    using i unfolding mC_ZOC_def mC_ZOC_part_def part_def by simp\n  then obtain I where I: \"I \\<in> P\" and i: \"i \\<in> I\" using i by auto\n  show \"s \\<approx> eff c s i \\<and> ((\\<exists>d. cont c s i \\<approx>01 d \\<and> discr d) \\<or> discr (cont c s i))\"\n  proof(cases \"I = I0\")\n    case False\n    then obtain j where j: \"j \\<in> F I\"\n      using match I False unfolding mC_ZOC_def mC_ZOC_part_def by blast\n    hence \"j < brn d\" using I match\n      unfolding mC_ZOC_def mC_ZOC_part_def part_def apply simp by blast\n    hence md: \"discr (cont d s j)\" and s: \"s \\<approx> eff d s j\"\n      using d discr_cont[of d j s] discr_eff_indis[of d j s] by auto\n    have \"eff c s i \\<approx> eff d s j\" and md2: \"cont c s i \\<approx>01 cont d s j\"\n      using I i j match False unfolding mC_ZOC_def mC_ZOC_eff_cont_def by auto\n    hence \"s \\<approx> eff c s i\" using s indis_sym indis_trans by blast\n    thus ?thesis using md md2 by blast\n  next\n    case True\n    hence \"s \\<approx> eff c s i \\<and> cont c s i \\<approx>01 d\"\n      using match i ZObis_sym unfolding mC_ZOC_def mC_ZOC_eff_cont0_def by blast\n    thus ?thesis using d by blast\n  qed\nqed\n\ntheorem ZObis_pres_discr_R:\nassumes \"discr c\" and \"c \\<approx>01 d\"\nshows \"discr d\"\nusing assms ZObis_pres_discr_L ZObis_sym by blast\n\ntheorem ZObis_finished_discr_L:\nassumes \"c \\<approx>01 d\" and \"proper d\" and \"finished d\"\nshows \"discr c\"\nusing assms ZObis_pres_discr_L by auto\n\ntheorem ZObis_finished_discr_R:\nassumes \"proper c\" and \"finished c\" and \"c \\<approx>01 d\"\nshows \"discr d\"\nusing assms ZObis_pres_discr_R[of c d] by auto\n\ntheorem discr_ZObis[simp]:\nassumes \"proper c\" and \"proper d\" and \"discr c\" and \"discr d\"\nshows \"c \\<approx>01 d\"\nusing assms by auto\n\n(* Done: *)\n theorem Done_ZObis[simp]:\n\"Done \\<approx>01 Done\"\nby simp\n\n(* Atm: *)\ntheorem Atm_ZObis[simp]:\nassumes \"compatAtm atm\"\nshows \"Atm atm \\<approx>01 Atm atm\"\nusing assms by simp\n\n(* Seq *)\n\ndefinition thetaZOSeqI where\n\"thetaZOSeqI \\<equiv>\n {(e ;; c, e ;; d) | e c d . siso e \\<and> c \\<approx>01 d}\"\n\nlemma thetaZOSeqI_ZOretr:\n\"thetaZOSeqI \\<subseteq> ZOretr (thetaZOSeqI Un ZObis)\"\nunfolding ZOretr_def matchC_LC_def proof safe\n  fix c d s t\n  assume c_d: \"(c, d) \\<in> thetaZOSeqI\" and st: \"s \\<approx> t\"\n  then obtain e c1 d1 where e: \"siso e\" and c1d1: \"c1 \\<approx>01 d1\"\n  and c: \"c = e ;; c1\" and d: \"d = e ;; d1\"\n  unfolding thetaZOSeqI_def by auto\n  let ?I0 = \"{}\" let ?J0 = \"{}\"\n  let ?P = \"{?I0} Un {{i} | i . i < brn e}\"\n  let ?F = \"%I. I\"\n  show \"\\<exists>I0 P F. mC_ZOC (thetaZOSeqI Un ZObis) c d s t I0 P F\"\n  apply(rule exI[of _ ?I0])\n  apply(rule exI[of _ ?P]) apply(rule exI[of _ ?F])\n  unfolding mC_ZOC_def proof (intro conjI)\n    show \"mC_ZOC_part c d s t ?I0 ?P ?F\"\n    unfolding mC_ZOC_part_def proof (intro conjI)\n      show \"part {..<brn c} ?P\"\n      unfolding part_def proof safe\n        fix i assume \"i < brn c\"\n        thus \"i \\<in> \\<Union> ?P\" using c e st siso_cont_indis[of e s t] by auto\n      qed (unfold c, simp)\n      (*  *)\n      thus \"part {..<brn d} (?F ` ?P)\" unfolding c d by auto\n    qed auto\n  next\n    show \"mC_ZOC_eff_cont (thetaZOSeqI Un ZObis) c d s t ?I0 ?P ?F\"\n    unfolding mC_ZOC_eff_cont_def proof(intro allI impI, elim conjE)\n      fix I i j\n      assume I: \"I \\<in> ?P - {?I0}\" and i: \"i \\<in> I\" and j: \"j \\<in> I\"\n      then obtain i' where \"j \\<in> ?F {i'}\" and \"i' < brn e\"\n      using I j by auto\n      thus \"eff c s i \\<approx> eff d t j \\<and> (cont c s i, cont d t j) \\<in> thetaZOSeqI \\<union> ZObis\"\n      using st c_d e i j I unfolding c d thetaZOSeqI_def\n      by (cases \"finished (cont e s i')\") auto\n    qed\n  qed (insert st c_d c, unfold m_defsAll thetaZOSeqI_def part_def, auto)\nqed\n\nlemma thetaZOSeqI_ZObis:\n\"thetaZOSeqI \\<subseteq> ZObis\"\nusing ZObis_coind thetaZOSeqI_ZOretr by blast\n\ntheorem Seq_siso_ZObis[simp]:\nassumes \"siso e\" and \"c2 \\<approx>01 d2\"\nshows \"e ;; c2 \\<approx>01 e ;; d2\"\nusing assms thetaZOSeqI_ZObis unfolding thetaZOSeqI_def by auto\n\n(*  *)\n\ndefinition thetaZOSeqD where\n\"thetaZOSeqD \\<equiv>\n {(c1 ;; c2, d1 ;; d2) |\n     c1 c2 d1 d2.\n        proper c1 \\<and> proper d1 \\<and> proper c2 \\<and> proper d2 \\<and>\n        discr c2 \\<and> discr d2 \\<and>\n        c1 \\<approx>01 d1}\"\n\nlemma thetaZOSeqD_ZOretr:\n\"thetaZOSeqD \\<subseteq> ZOretr (thetaZOSeqD Un ZObis)\"\nunfolding ZOretr_def matchC_LC_def proof safe\n  fix c d s t\n  assume c_d: \"(c, d) \\<in> thetaZOSeqD\" and st: \"s \\<approx> t\"\n  then obtain c1 c2 d1 d2 where\n  c1d1: \"proper c1\" \"proper d1\" \"c1 \\<approx>01 d1\" and\n  c2d2: \"proper c2\" \"proper d2\" \"discr c2\" \"discr d2\"\n  and c: \"c = c1 ;; c2\" and d: \"d = d1 ;; d2\"\n  unfolding thetaZOSeqD_def by auto\n  from c1d1 st obtain P F I0\n  where match: \"mC_ZOC ZObis c1 d1 s t I0 P F\"\n  using ZObis_mC_ZOC by blast\n  have P: \"\\<Union>P = {..<brn c1}\" and FP: \"\\<Union>(F ` P) = {..<brn d1}\"\n  using match unfolding mC_ZOC_def mC_ZOC_part_def part_def by metis+\n  show \"\\<exists>I0 P F. mC_ZOC (thetaZOSeqD Un ZObis) c d s t I0 P F\"\n  apply(intro exI[of _ I0] exI[of _ P] exI[of _ F])\n  unfolding mC_ZOC_def proof (intro conjI)\n    have I0: \"I0 \\<in> P\" using match unfolding m_defsAll by blast\n    show \"mC_ZOC_eff_cont0 (thetaZOSeqD \\<union> ZObis) c d s t I0 F\"\n    unfolding mC_ZOC_eff_cont0_def proof(intro conjI ballI)\n      fix i assume i: \"i \\<in> I0\"\n      let ?c1' = \"cont c1 s i\" let ?s' = \"eff c1 s i\"\n      have \"i < brn c1\" using i I0 P by blast note i = this i\n      have c1'd1: \"?c1' \\<approx>01 d1\" \"proper ?c1'\"\n      using c1d1 i I0 match unfolding mC_ZOC_def mC_ZOC_eff_cont0_def by auto\n      show \"s \\<approx> eff c s i\"\n        using i match unfolding c mC_ZOC_def mC_ZOC_eff_cont0_def by simp\n      show \"(cont c s i, d) \\<in> thetaZOSeqD \\<union> ZObis\"\n      proof(cases \"finished ?c1'\")\n        case False note f_c1' = False\n        hence csi: \"cont c s i = ?c1' ;; c2\" using i unfolding c by simp\n        hence \"(cont c s i, d) \\<in> thetaZOSeqD\"\n        using c1'd1 c1d1 c2d2 f_c1' i match\n        unfolding csi d thetaZOSeqD_def mC_ZOC_def mC_ZOC_eff_cont0_def by blast\n        thus ?thesis by simp\n      next\n        case True note f_c1' = True\n        hence csi: \"cont c s i = c2\" using i unfolding c by simp\n        have \"discr d1\" using f_c1' c1'd1 ZObis_finished_discr_R by blast\n        hence \"c2 \\<approx>01 d\" using c2d2 c1d1 unfolding d by simp\n        thus ?thesis unfolding csi by simp\n      qed\n    next\n      fix j assume j: \"j \\<in> F I0\"\n      let ?d1' = \"cont d1 t j\" let ?t' = \"eff d1 t j\"\n      have \"j < brn d1\" using j I0 FP by blast note j = this j\n      have c1d1': \"c1 \\<approx>01 ?d1'\" \"proper ?d1'\"\n      using c1d1 j I0 match unfolding mC_ZOC_def mC_ZOC_eff_cont0_def by auto\n      show \"t \\<approx> eff d t j\"\n        using j match unfolding d mC_ZOC_def mC_ZOC_eff_cont0_def by simp\n      show \"(c, cont d t j) \\<in> thetaZOSeqD \\<union> ZObis\"\n      proof (cases \"finished ?d1'\")\n        case False note f_d1' = False\n        hence dtj: \"cont d t j = ?d1' ;; d2\" using j unfolding d by simp\n        hence \"(c, cont d t j) \\<in> thetaZOSeqD\"\n        using c1d1' c1d1 c2d2 f_d1' j match\n        unfolding c dtj thetaZOSeqD_def mC_ZOC_def mC_ZOC_eff_cont0_def by blast\n        thus ?thesis by simp\n      next\n        case True note f_d1' = True\n        hence dtj: \"cont d t j = d2\" using j unfolding d by simp\n        hence \"discr c1\" using f_d1' c1d1' ZObis_finished_discr_L by blast\n        hence \"c \\<approx>01 d2\" using c2d2 c1d1 unfolding c by simp\n        thus ?thesis unfolding dtj by simp\n      qed\n    qed\n  next\n    show \"mC_ZOC_eff_cont (thetaZOSeqD \\<union> ZObis) c d s t I0 P F\"\n    unfolding mC_ZOC_eff_cont_def proof(intro allI impI, elim conjE)\n      fix i j I assume I : \"I \\<in> P - {I0}\" and i: \"i \\<in> I\" and j: \"j \\<in> F I\"\n      let ?c1' = \"cont c1 s i\"  let ?d1' = \"cont d1 t j\"\n      let ?s' = \"eff c1 s i\"  let ?t' = \"eff d1 t j\"\n      have \"i < brn c1\" using i I P by blast note i = this i\n      have \"j < brn d1\" using j I FP by blast note j = this j\n      have c1'd1': \"?c1' \\<approx>01 ?d1'\" \"proper ?c1'\" \"proper ?d1'\"\n      using c1d1 i j I match unfolding c mC_ZOC_def mC_ZOC_eff_cont_def by auto\n      show \"eff c s i \\<approx> eff d t j \\<and> (cont c s i, cont d t j) \\<in> thetaZOSeqD \\<union> ZObis\"\n      (is \"?eff \\<and> ?cont\") proof\n        show ?eff using match I i j unfolding c d m_defsAll apply simp by blast\n      next\n        show ?cont\n        proof(cases \"finished ?c1'\")\n          case True note c1' = True\n          hence csi: \"cont c s i = c2\" using i match unfolding c m_defsAll by simp\n          show ?thesis\n          proof(cases \"finished ?d1'\")\n            case True\n            hence \"cont d t j = d2\" using j match unfolding d m_defsAll by simp\n            thus ?thesis using csi c2d2 by simp\n          next\n            case False\n            hence dtj: \"cont d t j = ?d1' ;; d2\"\n            using j match unfolding d m_defsAll by simp\n            have \"discr ?d1'\" using c1'd1' c1' ZObis_finished_discr_R by blast\n            thus ?thesis using c1'd1' c2d2 unfolding csi dtj by simp\n          qed\n        next\n          case False\n          hence csi: \"cont c s i = ?c1' ;; c2\"\n          using i match unfolding c m_defsAll by simp\n          show ?thesis\n          proof(cases \"finished (cont d1 t j)\")\n            case True note d1' = True\n            hence dtj: \"cont d t j = d2\" using j match unfolding d m_defsAll by simp\n            have \"discr ?c1'\" using c1'd1' d1' ZObis_finished_discr_L by blast\n            thus ?thesis using c1'd1' c2d2 unfolding csi dtj by simp\n          next\n            case False\n            hence dtj: \"cont d t j = ?d1' ;; d2\" using j match unfolding d m_defsAll by simp\n            thus ?thesis unfolding csi dtj thetaZOSeqD_def\n            using c1'd1' c2d2 by blast\n          qed\n        qed\n      qed\n    qed\n  qed(insert match, unfold m_defsAll c d, auto)\nqed\n\nlemma thetaZOSeqD_ZObis:\n\"thetaZOSeqD \\<subseteq> ZObis\"\nusing ZObis_coind thetaZOSeqD_ZOretr by blast\n\ntheorem Seq_ZObis[simp]:\nassumes \"proper c1\" and \"proper d1\" and \"proper c2\" and \"proper d2\"\nand \"c1 \\<approx>01 d1\" and \"discr c2\" and \"discr d2\"\nshows \"c1 ;; c2 \\<approx>01 d1 ;; d2\"\nusing assms thetaZOSeqD_ZObis unfolding thetaZOSeqD_def by auto\n\n(* Ch *)\ndefinition thetaZOCh where\n\"thetaZOCh ch c1 c2 d1 d2 \\<equiv> {(Ch ch c1 c2, Ch ch d1 d2)}\"\n\nlemma thetaZOCh_Sretr:\nassumes \"compatCh ch\" and \"c1 \\<approx>01 d1\" and \"c2 \\<approx>01 d2\"\nshows \"thetaZOCh ch c1 c2 d1 d2 \\<subseteq>\n       Sretr (thetaZOCh ch c1 c2 d1 d2 \\<union> ZObis)\"\n(is \"?th \\<subseteq> Sretr (?th \\<union> ZObis)\")\nunfolding Sretr_def matchC_C_def proof safe\n  fix c d s t\n  assume c_d: \"(c, d) \\<in> ?th\" and st: \"s \\<approx> t\"\n  hence c: \"c = Ch ch c1 c2\" \"brn c = 2\"\n  and d: \"d = Ch ch d1 d2\" \"brn d = 2\"\n  unfolding thetaZOCh_def by auto\n  let ?P = \"{{0}, {1}}\"\n  let ?F = \"%I. I\"\n  show \"\\<exists>P F. mC_C (?th Un ZObis) c d s t P F\"\n  apply(rule exI[of _ ?P]) apply(rule exI[of _ ?F])\n  using assms st c_d c unfolding m_defsAll thetaZOCh_def part_def by auto\nqed\n\nlemma thetaZOCh_ZOretr:\nassumes \"compatCh ch\" and \"c1 \\<approx>01 d1\" and \"c2 \\<approx>01 d2\"\nshows \"thetaZOCh ch c1 c2 d1 d2 \\<subseteq>\n       ZOretr (thetaZOCh ch c1 c2 d1 d2 \\<union> ZObis)\"\nusing thetaZOCh_Sretr[OF assms]\nby (metis (no_types) Retr_incl subset_trans)\n\nlemma thetaZOCh_ZObis:\nassumes \"compatCh ch\" and \"c1 \\<approx>01 d1\" and \"c2 \\<approx>01 d2\"\nshows \"thetaZOCh ch c1 c2 d1 d2 \\<subseteq> ZObis\"\nusing ZObis_coind thetaZOCh_ZOretr[OF assms] by blast\n\ntheorem Ch_siso_ZObis[simp]:\nassumes \"compatCh ch\" and \"c1 \\<approx>01 d1\" and \"c2 \\<approx>01 d2\"\nshows \"Ch ch c1 c2 \\<approx>01 Ch ch d1 d2\"\nusing thetaZOCh_ZObis[OF assms] unfolding thetaZOCh_def by auto\n\n(*  *)\ndefinition theFTOne where\n\"theFTOne cl dl \\<equiv> theFT cl \\<union> theFT dl\"\n\ndefinition theNFTBoth where\n\"theNFTBoth cl dl \\<equiv> theNFT cl \\<inter> theNFT dl\"\n\nlemma theFTOne_sym: \"theFTOne cl dl = theFTOne dl cl\"\nunfolding theFTOne_def by auto\n\nlemma finite_theFTOne[simp]:\n\"finite (theFTOne cl dl)\"\nunfolding theFTOne_def by simp\n\n\n\nlemma theFTOne_length[simp]:\nassumes \"length cl = length dl\" and \"n \\<in> theFTOne cl dl\"\nshows \"n < length cl\" and \"n < length dl\"\nusing assms theFTOne_length_finished[of n cl dl] by auto\n\nlemma theFTOne_intro[intro]:\nassumes \"\\<And> n. (n < length cl \\<and> finished (cl!n)) \\<or> (n < length dl \\<and> finished (dl!n))\"\nshows \"n \\<in> theFTOne cl dl\"\nusing assms unfolding theFTOne_def by auto\n\nlemma pickFT_theFTOne[simp]:\nassumes \"WtFT cl = 1\"\nshows \"pickFT cl \\<in> theFTOne cl dl\"\nusing assms unfolding theFTOne_def by auto\n\nlemma finite_theNFTBoth[simp]:\n\"finite (theNFTBoth cl dl)\"\nunfolding theNFTBoth_def by simp\n\nlemma theNFTBoth_sym: \"theNFTBoth cl dl = theNFTBoth dl cl\"\nunfolding theNFTBoth_def by auto\n\nlemma theNFTBoth_length_finished[simp]:\nassumes \"n \\<in> theNFTBoth cl dl\"\nshows \"n < length cl\" and \"\\<not> finished (cl!n)\"\nand \"n < length dl\" and \"\\<not> finished (dl!n)\"\nusing assms unfolding theNFTBoth_def by auto\n\nlemma theNFTBoth_intro[intro]:\nassumes \"\\<And> n. n < length cl \\<and> \\<not> finished (cl!n) \\<and> n < length dl \\<and> \\<not> finished (dl!n)\"\nshows \"n \\<in> theNFTBoth cl dl\"\nusing assms unfolding theNFTBoth_def by auto\n\nlemma theFTOne_Int_theNFTBoth[simp]:\n\"theFTOne cl dl \\<inter> theNFTBoth cl dl = {}\"\nand \"theNFTBoth cl dl \\<inter> theFTOne cl dl = {}\"\nunfolding theFTOne_def theNFTBoth_def theFT_def theNFT_def by auto\n\nlemma theFT_Un_theNFT_One_Both[simp]:\nassumes \"length cl = length dl\"\nshows\n\"theFTOne cl dl \\<union> theNFTBoth cl dl = {..< length cl}\" and\n\"theNFTBoth cl dl \\<union> theFTOne cl dl = {..< length cl}\"\nusing assms\nunfolding theFTOne_def theNFTBoth_def theFT_def theNFT_def by auto\n\nlemma in_theFTOne_theNFTBoth[simp]:\nassumes \"n1 \\<in> theFTOne cl dl\" and \"n2 \\<in> theNFTBoth cl dl\"\nshows \"n1 \\<noteq> n2\" and \"n2 \\<noteq> n1\"\nusing assms theFTOne_Int_theNFTBoth by blast+\n\n\n(*  *)\n\ndefinition BrnFT where\n\"BrnFT cl dl \\<equiv> \\<Union> n \\<in> theFTOne cl dl. {brnL cl n ..<+ brn (cl!n)}\"\n\ndefinition BrnNFT where\n\"BrnNFT cl dl \\<equiv> \\<Union> n \\<in> theNFTBoth cl dl. {brnL cl n ..<+ brn (cl!n)}\"\n\nlemma BrnFT_elim[elim, consumes 1, case_names Local]:\nassumes \"ii \\<in> BrnFT cl dl\"\nand \"\\<And> n i. \\<lbrakk>n \\<in> theFTOne cl dl; i < brn (cl!n); ii = brnL cl n + i\\<rbrakk> \\<Longrightarrow> phi\"\nshows phi\nusing assms unfolding BrnFT_def by auto\n\nlemma finite_BrnFT[simp]:\n\"finite (BrnFT cl dl)\"\nunfolding BrnFT_def by auto\n\nlemma BrnFT_incl_brnL[simp]:\nassumes l: \"length cl = length dl\" and cl: \"properL cl\"\nshows \"BrnFT cl dl \\<subseteq> {..< brnL cl (length cl)}\" (is \"?L \\<subseteq> ?R\")\nproof-\n  have \"?L \\<subseteq> (\\<Union> n<length cl. {brnL cl n..<+brn (cl ! n)})\"\n  using l unfolding BrnFT_def theFTOne_def theFT_def by auto\n  also have \"... = ?R\" using cl brnL_UN by auto\n  finally show ?thesis .\nqed\n\nlemma BrnNFT_elim[elim, consumes 1, case_names Local]:\nassumes \"ii \\<in> BrnNFT cl dl\"\nand \"\\<And> n i. \\<lbrakk>n \\<in> theNFTBoth cl dl; i < brn (cl!n); ii = brnL cl n + i\\<rbrakk> \\<Longrightarrow> phi\"\nshows phi\nusing assms unfolding BrnNFT_def by auto\n\nlemma finite_BrnNFT[simp]:\n\"finite (BrnNFT cl dl)\"\nunfolding BrnNFT_def by auto\n\nlemma BrnNFT_incl_brnL[simp]:\nassumes cl: \"properL cl\"\nshows \"BrnNFT cl dl \\<subseteq> {..< brnL cl (length cl)}\" (is \"?L \\<subseteq> ?R\")\nproof-\n  have \"?L \\<subseteq> (\\<Union> n<length cl. {brnL cl n..<+brn (cl ! n)})\"\n  unfolding BrnNFT_def theNFTBoth_def theNFT_def by auto\n  also have \"... = ?R\" using cl brnL_UN by auto\n  finally show ?thesis .\nqed\n\nlemma BrnFT_Int_BrnNFT[simp]:\nassumes l: \"length cl = length dl\"\nshows\n\"BrnFT cl dl \\<inter> BrnNFT cl dl = {}\" (is \"?L\")\nand \"BrnNFT cl dl \\<inter> BrnFT cl dl = {}\" (is \"?R\")\nproof-\n  {fix ii assume 1: \"ii \\<in> BrnFT cl dl\" and 2: \"ii \\<in> BrnNFT cl dl\"\n   from 1 have False\n   proof (cases rule: BrnFT_elim)\n     case (Local n1 i1)\n     hence n1: \"n1 < length cl\" \"n1 < length dl\" \"n1 \\<in> theFTOne cl dl\"\n     and i1: \"i1 < brn (cl ! n1)\"\n     and ii1: \"ii = brnL cl n1 + i1\" using l by auto\n     from 2 show ?thesis\n     proof (cases rule: BrnNFT_elim)\n       case (Local n2 i2)\n       hence n2: \"n2 \\<in> theNFTBoth cl dl\" and i2: \"i2 < brn (cl ! n2)\"\n       and ii2: \"ii = brnL cl n2 + i2\" by auto\n       have n12: \"n1 \\<noteq> n2\" using n1 n2 by simp\n       show ?thesis\n       proof(cases \"n1 < n2\")\n         case True hence Suc: \"Suc n1 \\<le> n2\" by simp\n         have \"ii < brnL cl (Suc n1)\" unfolding ii1 using i1 n1 by simp\n         also have \"... \\<le> brnL cl n2\" using Suc by auto\n         also have \"... \\<le> ii\" unfolding ii2 by simp\n         finally show False by simp\n       next\n         case False hence Suc: \"Suc n2 \\<le> n1\" using n12 by simp\n         have \"ii < brnL cl (Suc n2)\" unfolding ii2 using i2 n2 by simp\n         also have \"... \\<le> brnL cl n1\" using Suc by auto\n         also have \"... \\<le> ii\" unfolding ii1 by simp\n         finally show False by simp\n       qed\n     qed\n   qed\n  }\n  thus ?L by blast  thus ?R by blast\nqed\n\nlemma BrnFT_Un_BrnNFT[simp]:\nassumes l: \"length cl = length dl\" and cl: \"properL cl\"\nshows \"BrnFT cl dl \\<union> BrnNFT cl dl = {..< brnL cl (length cl)}\" (is \"?L1 = ?R\")\nand \"BrnNFT cl dl \\<union> BrnFT cl dl = {..< brnL cl (length cl)}\" (is \"?L2 = ?R\")\nproof-\n  have R: \"?R = (\\<Union> n<length cl. {brnL cl n..<+brn (cl ! n)})\"\n  using cl brnL_UN by auto\n  thus \"?L1 = ?R\" unfolding R\n  unfolding l BrnFT_def BrnNFT_def\n  theFTOne_def theNFTBoth_def theFT_def theNFT_def by blast\n  thus \"?L2 = ?R\" by blast\nqed\n\nlemma BrnFT_part:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n)\"\nshows \"BrnFT cl dl = (\\<Union> n \\<in> theFTOne cl dl. Union (shift cl n ` (P n)))\" (is \"?L = ?R\")\nproof (safe elim!: BrnFT_elim)\n  fix x n i assume n: \"n \\<in> theFTOne cl dl\" and i: \"i < brn (cl ! n)\"\n  hence \"n < length cl\" \"n < length dl\" using l by auto note n = this n\n  hence \"i \\<in> Union (P n)\" using P i unfolding part_def by auto\n  then obtain I where \"i \\<in> I\" and \"I \\<in> P n\" by blast\n  thus \"brnL cl n + i \\<in> ?R\" using n unfolding shift_def by auto\nnext\n  fix n ii I assume n: \"n \\<in> theFTOne cl dl\" and ii: \"ii \\<in> shift cl n I\" and I: \"I \\<in> P n\"\n  hence \"n < length cl\" using l by simp\n  hence \"I \\<subseteq> {..< brn (cl ! n)}\" using I P unfolding part_def by blast\n  hence \"ii \\<in> {brnL cl n..<+brn (cl ! n)}\" using ii unfolding shift_def by auto\n  thus \"ii \\<in> ?L\" using n unfolding BrnFT_def by auto\nqed\n\nlemma brnL_pickFT_BrnFT[simp]:\nassumes \"properL cl\" and \"WtFT cl = 1\"\nshows \"brnL cl (pickFT cl) \\<in> BrnFT cl dl\"\nusing assms brn_gt_0_L unfolding BrnFT_def by auto\n\nlemma WtFT_ParT_BrnFT[simp]:\nassumes \"length cl = length dl\" \"properL cl\" and \"WtFT cl = 1\"\nshows \"setsum (wt (ParT cl) s) (BrnFT cl dl) = 1\"\nproof-\n  have \"brnL cl (pickFT cl) \\<in> BrnFT cl dl\" and\n  \"BrnFT cl dl \\<subseteq> {..<brnL cl (length cl)}\"\n  using assms BrnFT_incl_brnL by (simp, blast)\n  thus ?thesis using assms by simp\nqed\n\n(*  *)\n\ndefinition UNpart1 where\n\"UNpart1 cl dl P \\<equiv> \\<Union> n \\<in> theNFTBoth cl dl. shift cl n ` (P n)\"\n\ndefinition UNpart01 where\n\"UNpart01 cl dl P \\<equiv> {BrnFT cl dl} \\<union> UNpart1 cl dl P\"\n\nlemma BrnFT_UNpart01[simp]:\n\"BrnFT cl dl \\<in> UNpart01 cl dl P\"\nunfolding UNpart01_def by simp\n\n\n\nlemma UNpart01_cases[elim, consumes 1, case_names Local0 Local]:\nassumes \"II \\<in> UNpart01 cl dl P\" and \"II = BrnFT cl dl \\<Longrightarrow> phi\"\n\"\\<And> n I. \\<lbrakk>n \\<in> theNFTBoth cl dl; I \\<in> P n; II = shift cl n I; II \\<in> UNpart1 cl dl P\\<rbrakk> \\<Longrightarrow> phi\"\nshows phi\nusing assms unfolding UNpart01_def UNpart1_def by auto\n\nlemma emp_UNpart1:\nassumes \"\\<And> n. n < length cl \\<Longrightarrow> {} \\<notin> P n\"\nshows \"{} \\<notin> UNpart1 cl dl P\"\nusing assms unfolding UNpart1_def by auto\n\nlemma emp_UNpart01:\nassumes \"\\<And> n. n < length cl \\<Longrightarrow> {} \\<notin> P n\"\nshows \"{} \\<notin> UNpart01 cl dl P - {BrnFT cl dl}\"\nusing assms emp_UNpart1 unfolding UNpart01_def by auto\n\n\n\nlemma BrnFT_notIn_UNpart1:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nshows \"BrnFT cl dl \\<notin> UNpart1 cl dl P\"\nusing assms BrnFT_Int_UNpart1 emp_UNpart1 by (metis Int_absorb)\n\nlemma UNpart1_UNpart01:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nshows \"UNpart1 cl dl P = UNpart01 cl dl P - {BrnFT cl dl}\"\nproof-\n  have \"BrnFT cl dl \\<notin> UNpart1 cl dl P\"\n  apply(rule BrnFT_notIn_UNpart1) using assms by auto\n  thus ?thesis unfolding UNpart01_def by auto\nqed\n\nlemma part_UNpart1[simp]:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n)\"\nshows \"part (BrnNFT cl dl) (UNpart1 cl dl P)\"\nunfolding BrnNFT_def UNpart1_def apply(rule part_UN)\n  using l P apply fastforce\n  apply(rule brnL_Int) using l by auto\n\nlemma part_UNpart01:\nassumes cl: \"properL cl\" and l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nshows \"part {..< brnL cl (length cl)} (UNpart01 cl dl P)\"\nunfolding UNpart01_def apply(rule part_Un_singl2[of _ _ \"BrnNFT cl dl\"])\nusing assms using BrnFT_Int_UNpart1 by (simp, simp, blast)\n\n(*  *)\n\ndefinition UNlift01 where\n\"UNlift01 cl dl P F II \\<equiv>\n if II = BrnFT cl dl\n   then BrnFT dl cl\n   else shift dl (pickT cl P II) (F (pickT cl P II) (back cl (pickT cl P II) II))\"\n\nlemma UNlift01_BrnFT[simp]:\n\"UNlift01 cl dl P F (BrnFT cl dl) = BrnFT dl cl\"\nunfolding UNlift01_def by simp\n\nlemma UNlift01_shift[simp]:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand n: \"n \\<in> theNFTBoth cl dl\" and I: \"I \\<in> P n\"\nshows \"UNlift01 cl dl P F (shift cl n I) = shift dl n (F n I)\"\nproof-\n  let ?N = \"length cl\" def II \\<equiv> \"shift cl n I\"\n  have \"n < length cl\" using n l by auto note n = this n\n  have II: \"shift cl n I = II\" using II_def by simp\n  have \"II \\<in> UNpart1 cl dl P\" unfolding II_def UNpart1_def using n I by auto\n  hence \"II \\<noteq> BrnFT cl dl\" using BrnFT_notIn_UNpart1[of cl dl P] l n P by auto\n  hence 1: \"UNlift01 cl dl P F II =\n  shift dl (pickT cl P II) (F (pickT cl P II) (back cl (pickT cl P II) II))\"\n  unfolding UNlift01_def by simp\n  have n: \"n = pickT cl P II\" apply(rule pickT_unique)\n  using assms unfolding II_def by auto\n  have \"back cl n II = I\" unfolding II_def by simp\n  hence \"shift dl n (F n (back cl n II)) = shift dl n (F n I)\" by simp\n  thus ?thesis unfolding 1 II n[THEN sym] .\nqed\n\nlemma UNlift01_inj_on_UNpart1:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> part {..< brn (dl!n)} (F n ` (P n)) \\<and> {} \\<notin> F n ` (P n)\"\nand F: \"\\<And> n. n < length cl \\<Longrightarrow> inj_on (F n) (P n)\"\nshows \"inj_on (UNlift01 cl dl P F) (UNpart1 cl dl P)\" (is \"inj_on ?G ?Q\")\nunfolding inj_on_def proof clarify\n  fix II1 II2\n  assume II1: \"II1 \\<in> ?Q\" and II2: \"II2 \\<in> ?Q\" and G: \"?G II1 = ?G II2\"\n  from II1 show \"II1 = II2\"\n  proof(cases rule: UNpart1_cases)\n    case (Local n1 I1)\n    hence n1: \"n1 \\<in> theNFTBoth cl dl\" \"n1 < length cl\" \"n1 < length dl\" and I1: \"I1 \\<in> P n1\"\n    and II1: \"II1 = shift cl n1 I1\" using l by auto\n    hence G1_def: \"?G II1 = shift dl n1 (F n1 I1)\" using l P by simp\n    have Pn1: \"part {..< brn (dl!n1)} (F n1 ` (P n1))\" \"{} \\<notin> F n1 ` (P n1)\"\n    using n1 FP by auto\n    have F1_in: \"F n1 I1 \\<in> F n1 ` (P n1)\" using I1 by simp\n    hence Fn1I1: \"F n1 I1 \\<noteq> {}\" \"F n1 I1 \\<subseteq> {..< brn (dl!n1)}\"\n    using Pn1 by (blast, unfold part_def, blast)\n    hence G1: \"?G II1 \\<noteq> {}\" \"?G II1 \\<subseteq> {brnL dl n1 ..<+ brn (dl!n1)}\"\n    unfolding G1_def by simp_all\n    from II2 show ?thesis\n    proof(cases rule: UNpart1_cases)\n      case (Local n2 I2)\n      hence n2: \"n2 \\<in> theNFTBoth cl dl\" \"n2 < length cl\" \"n2 < length dl\"\n      and I2: \"I2 \\<in> P n2\" and II2: \"II2 = shift cl n2 I2\" using l by auto\n      hence G2_def: \"?G II2 = shift dl n2 (F n2 I2)\" using l P by auto\n      have Pn2: \"part {..< brn (dl!n2)} (F n2 ` (P n2))\" \"{} \\<notin> F n2 ` (P n2)\"\n      using n2 FP by auto\n      have F2_in: \"F n2 I2 \\<in> F n2 ` (P n2)\" using I2 by simp\n      hence Fn2I2: \"F n2 I2 \\<noteq> {}\" \"F n2 I2 \\<subseteq> {..< brn (dl!n2)}\"\n      using Pn2 by (blast, unfold part_def, blast)\n      hence G2: \"?G II2 \\<noteq> {}\" \"?G II2 \\<subseteq> {brnL dl n2 ..<+ brn (dl!n2)}\"\n      unfolding G2_def by simp_all\n      (*  *)\n      have n12: \"n1 = n2\" using n1 n2 G1 G2 G brnL_Int by blast\n      have \"F n1 I1 = F n2 I2\" using G unfolding G1_def G2_def n12 by simp\n      hence \"I1 = I2\" using I1 I2 n1 F unfolding n12 inj_on_def by blast\n      thus ?thesis unfolding II1 II2 n12 by simp\n    qed\n  qed\nqed\n\nlemma inj_on_singl:\nassumes \"inj_on f A\" and \"a0 \\<notin> A\" and \"\\<And> a. a \\<in> A \\<Longrightarrow> f a \\<noteq> f a0\"\nshows \"inj_on f ({a0} Un A)\"\nusing assms unfolding inj_on_def by fastforce\n\nlemma UNlift01_inj_on:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> part {..< brn (dl!n)} (F n ` (P n)) \\<and> {} \\<notin> F n ` (P n)\"\nand F: \"\\<And> n. n < length cl \\<Longrightarrow> inj_on (F n) (P n)\"\nshows \"inj_on (UNlift01 cl dl P F) (UNpart01 cl dl P)\"\nunfolding UNpart01_def proof(rule inj_on_singl)\n  show \"inj_on (UNlift01 cl dl P F) (UNpart1 cl dl P)\"\n  apply (rule UNlift01_inj_on_UNpart1) using assms by auto\nnext\n  show \"BrnFT cl dl \\<notin> UNpart1 cl dl P\"\n  apply(rule BrnFT_notIn_UNpart1) using l P by auto\nnext\n  let ?Q = \"%n. F n ` (P n)\"\n  fix II assume \"II \\<in> UNpart1 cl dl P\"\n  hence \"UNlift01 cl dl P F II \\<noteq> BrnFT dl cl\"\n  proof(cases rule: UNpart1_cases)\n    case (Local n I)\n    hence n: \"n \\<in> theNFTBoth cl dl\" \"n \\<in> theNFTBoth dl cl\" \"n < length cl\" \"n < length dl\"\n    and I: \"I \\<in> P n\" and II: \"II = shift cl n I\" using l theNFTBoth_sym by auto\n    have \"shift dl n (F n I) \\<in> UNpart1 dl cl ?Q\"\n    unfolding UNpart1_def shift_def using n I by auto\n    hence \"shift dl n (F n I) \\<noteq> BrnFT dl cl\"\n    using BrnFT_notIn_UNpart1[of dl cl ?Q] n l FP by auto\n    thus ?thesis unfolding II using n I l P by simp\n  qed\n  thus \"UNlift01 cl dl P F II \\<noteq> UNlift01 cl dl P F (BrnFT cl dl)\" by simp\nqed\n\nlemma UNlift01_UNpart1:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nshows \"(UNlift01 cl dl P F) ` (UNpart1 cl dl P) = UNpart1 dl cl (%n. F n ` (P n))\" (is \"?G ` ?Q = ?R\")\nproof safe\n  fix II assume II: \"II \\<in> ?Q\"\n  thus \"?G II \\<in> ?R\"\n  proof(cases rule: UNpart1_cases)\n    case (Local n I)\n    hence n: \"n \\<in> theNFTBoth cl dl\" \"n \\<in> theNFTBoth dl cl\" \"n < length cl\"\n    \"n < length dl\" and I: \"I \\<in> P n\"\n    and II: \"II = shift cl n I\" using l theNFTBoth_sym by auto\n    hence G: \"?G II = shift dl n (F n I)\" using l P by simp\n    show ?thesis using n I unfolding G UNpart1_def by auto\n  qed\nnext\n  fix JJ assume JJ: \"JJ \\<in> ?R\"\n  thus \"JJ \\<in> ?G ` ?Q\"\n  proof(cases rule: UNpart1_cases)\n    case (Local n J)\n    hence n: \"n \\<in> theNFTBoth cl dl\" \"n \\<in> theNFTBoth dl cl\" \"n < length cl\" \"n < length dl\"\n    and J: \"J \\<in> F n ` (P n)\"\n    and JJ: \"JJ = shift dl n J\" using l theNFTBoth_sym by auto\n    then obtain I where I: \"I \\<in> P n\" and \"J = F n I\" by auto\n    hence \"JJ = shift dl n (F n I)\" using JJ by simp\n    also have \"... = UNlift01 cl dl P F (shift cl n I)\" using n I l P by simp\n    finally have JJ: \"JJ = UNlift01 cl dl P F (shift cl n I)\" .\n    show ?thesis using n l I unfolding JJ UNpart1_def by auto\n  qed\nqed\n\nlemma UNlift01_UNpart01:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nshows \"(UNlift01 cl dl P F) ` (UNpart01 cl dl P) = UNpart01 dl cl (%n. F n ` (P n))\"\nusing assms UNlift01_UNpart1[of cl dl P] unfolding UNpart01_def by auto\n\nlemma emp_UNlift01_UNpart1:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> {} \\<notin> F n ` (P n)\"\nshows \"{} \\<notin> (UNlift01 cl dl P F) ` (UNpart1 cl dl P)\" (is \"{} \\<notin> ?R\")\nproof-\n  have R: \"?R = UNpart1 dl cl (%n. F n ` (P n))\"\n  apply(rule UNlift01_UNpart1) using assms by auto\n  show ?thesis unfolding R apply(rule emp_UNpart1) using FP by simp\nqed\n\nlemma emp_UNlift01_UNpart01:\nassumes l: \"length cl = length dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> {} \\<notin> F n ` (P n)\"\nshows \"{} \\<notin> (UNlift01 cl dl P F) ` (UNpart01 cl dl P - {BrnFT cl dl})\"\n(is \"{} \\<notin> ?U ` ?V\")\nproof-\n  have V: \"?V = UNpart1 cl dl P\" apply(rule UNpart1_UNpart01[THEN sym])\n  using assms by auto\n  show ?thesis unfolding V apply(rule emp_UNlift01_UNpart1)\n  using assms by auto\nqed\n\nlemma part_UNlift01_UNpart1:\nassumes l: \"length cl = length dl\" and dl: \"properL dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> part {..< brn (dl!n)} (F n ` (P n))\"\nshows \"part (BrnNFT dl cl) ((UNlift01 cl dl P F) ` (UNpart1 cl dl P))\" (is \"part ?C ?R\")\nproof-\n  let ?Q = \"%n. F n ` (P n)\"\n  have R: \"?R = UNpart1 dl cl ?Q\"\n  apply(rule UNlift01_UNpart1[of cl dl P F]) using assms by auto\n  show ?thesis unfolding R apply(rule part_UNpart1) using dl l FP by auto\nqed\n\nlemma part_UNlift01_UNpart01:\nassumes l: \"length cl = length dl\" and dl: \"properL dl\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> part {..< brn (dl!n)} (F n ` (P n)) \\<and> {} \\<notin> (F n ` (P n))\"\nshows \"part {..< brnL dl (length dl)} ((UNlift01 cl dl P F) ` (UNpart01 cl dl P))\"\n(is \"part ?K ?R\")\nproof-\n  let ?G = \"UNlift01 cl dl P F\" let ?Q = \"%n. F n ` (P n)\"\n  have R: \"?R = {?G (BrnFT cl dl)} \\<union> ?G ` (UNpart1 cl dl P)\"\n  unfolding UNpart01_def by simp\n  show ?thesis unfolding R apply(rule part_Un_singl2[of _ _ \"BrnNFT dl cl\"])\n  using assms part_UNlift01_UNpart1\n  apply(force, force)\n  using assms apply simp apply(rule BrnFT_Int_UNpart1[of dl cl ?Q])\n  apply(force, force) using UNlift01_UNpart1 by auto\nqed\n\n(* fixme: cont *)\nlemma diff_frac_eq_1:\nassumes \"b \\<noteq> (0::real)\"\nshows \"1 - a / b = (b - a) / b\"\nby (metis assms diff_divide_distrib divide_self_if)\n\nlemma diff_frac_eq_2:\nassumes \"b \\<noteq> (1::real)\"\nshows \"1 - (a - b) / (1 - b) = (1 - a) / (1 - b)\"\n(is \"?L = ?R\")\nproof-\n  have b: \"1 - b \\<noteq> 0\" using assms by simp\n  hence \"?L = (1 - b - (a - b)) / (1 - b)\"  (is \"?L = ?A / ?B\")\n  using diff_frac_eq_1 by blast\n  also have \"?A = 1 - a\" by simp\n  finally show ?thesis by simp\nqed\n\nlemma triv_div_mult:\nassumes vSF: \"vSF \\<noteq> (1::real)\"\nand L: \"L = (K - vSF) / (1 - vSF)\" and Ln: \"L \\<noteq> 1\"\nshows \"(VS / (1 - vSF) * V) / (1 - L) = (VS * V) / (1 - K)\"\n(is \"?A = ?B\")\nproof-\n  have vSF_0: \"1 - vSF \\<noteq> 0\" using vSF by simp\n  {assume \"K = 1\"\n   hence \"L = 1\" using L vSF by simp\n   hence False using Ln by simp\n  }\n  hence Kn: \"K \\<noteq> 1\" by auto\n  hence K_0: \"1 - K \\<noteq> 0\" by simp\n  have \"1 - L = (1 - K) / (1 - vSF)\" unfolding L using vSF diff_frac_eq_2 by blast\n  hence \"?A = (VS / (1 - vSF) * V) / ((1 - K) / (1 - vSF))\" by simp\n  also have \"... = ?B\" using vSF_0 K_0 by auto\n  finally show ?thesis .\nqed\n(* end fixme *)\n\nlemma ss_wt_ParT_UNlift01:\nassumes l: \"length cl = length dl\"\nand cldl: \"properL cl\" \"properL dl\" and II: \"II \\<in> UNpart01 cl dl P - {BrnFT cl dl}\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> part {..< brn (dl!n)} (F n ` (P n))\"\nand sw:\n\"\\<And>n I. \\<lbrakk>n < length cl; I \\<in> P n\\<rbrakk> \\<Longrightarrow>\n     setsum (wt (cl ! n) s) I =\n     setsum (wt (dl ! n) t) (F n I)\"\nand st: \"s \\<approx> t\"\nand le1: \"setsum (wt (ParT cl) s) (BrnFT cl dl) < 1\"\n\"setsum (wt (ParT dl) t) (BrnFT dl cl) < 1\"\nshows\n\"setsum (wt (ParT cl) s) II /\n (1 - setsum (wt (ParT cl) s) (BrnFT cl dl)) =\n setsum (wt (ParT dl) t) (UNlift01 cl dl P F II) /\n (1 - setsum (wt (ParT dl) t) (BrnFT dl cl))\"\n(is \"setsum ?vP II / (1 - setsum ?vP ?II_0) =\n     setsum ?wP ?JJ / (1 - setsum ?wP ?JJ_0)\")\nproof-\n  let ?N = \"length cl\"\n  let ?vS = \"%n. 1 / ?N\" let ?wS = \"%n. 1 / (length dl)\"\n  let ?vSF = \"WtFT cl\" let ?wSF = \"WtFT dl\"\n  let ?ss = \"%n. s\" let ?tt = \"%n. t\"\n  let ?v = \"%n. wt (cl ! n) (?ss n)\" let ?w = \"%n. wt (dl ! n) (?tt n)\"\n  (*  *)\n  have sstt: \"\\<And> n. n < ?N \\<Longrightarrow> ?ss n \\<approx> ?tt n\"\n  using st l by auto\n  have vSwS: \"\\<And> n. n < ?N \\<Longrightarrow> ?vS n = ?wS n\" and sstt: \"\\<And> n. n < ?N \\<Longrightarrow> ?ss n \\<approx> ?tt n\"\n  using assms by auto\n  have nf: \"?vSF \\<noteq> 1\" \"?wSF \\<noteq> 1\" using le1 cldl l by auto\n  have theFT_theNFT[simp]:\n  \"\\<And> n. n \\<in> theFT dl - theFT cl \\<Longrightarrow> n < length cl \\<and> \\<not> finished (cl ! n)\"\n  \"\\<And> n. n \\<in> theFT cl - theFT dl \\<Longrightarrow> n < length dl \\<and> \\<not> finished (dl ! n)\"\n  unfolding theFT_def using l by auto\n  have setsum_v[simp]:\n  \"\\<And> n. n < length cl \\<Longrightarrow> setsum (?v n) {..< brn (cl ! n)} = 1\"\n  using cldl by auto\n  have setsum_w[simp]:\n  \"\\<And> n. n < length dl \\<Longrightarrow> setsum (?w n) {..< brn (dl ! n)} = 1\"\n  using cldl by auto\n  have theFTOne: \"theFTOne cl dl = theFT dl - theFT cl \\<union> theFT cl\"\n  \"theFTOne dl cl = theFT cl - theFT dl \\<union> theFT dl\"\n  unfolding theFTOne_def by blast+\n  have setsum_vS_wS: \"setsum ?vS (theFTOne cl dl) = setsum ?wS (theFTOne dl cl)\"\n  unfolding theFTOne_sym[of cl dl] apply (rule setsum.cong)\n  using vSwS l unfolding theFTOne_def theFT_def theNFT_def by auto\n  (*  *)\n  have II: \"II \\<in> UNpart1 cl dl P\" using II l P UNpart1_UNpart01 by blast\n  thus ?thesis\n  proof(cases rule: UNpart1_cases)\n    case (Local n I)\n    hence n: \"n < ?N\" \"n < length dl\" \"n \\<in> theNFTBoth cl dl\"\n    \"\\<not> finished (cl!n)\"  \"\\<not> finished (dl!n)\"\n    and I: \"I \\<in> P n\"\n    and II: \"II = shift cl n I\" using l by auto\n    have I_sub: \"I \\<subseteq> {..< brn (cl!n)}\" using n I P unfolding part_def by blast\n    hence FnI_sub: \"F n I \\<subseteq> {..< brn (dl!n)}\" using n I FP unfolding part_def by blast\n    have JJ: \"?JJ = shift dl n (F n I)\"\n    unfolding II using l P n I by simp\n    (*  *)\n    have \"setsum ?vP ?II_0 =\n    setsum (%n. setsum ?vP {brnL cl n..<+brn (cl ! n)}) (theFTOne cl dl)\"\n    unfolding BrnFT_def apply(rule setsum.UNION_disjoint)\n    using brnL_Int l by auto\n    also have \"... =\n    setsum\n      (%n. setsum ?vP {brnL cl n..<+brn (cl ! n)})\n      ((theFT dl - theFT cl) \\<union> theFT cl)\" unfolding theFTOne_def\n    by (metis Un_Diff_cancel2 Un_commute)\n    also have \"... =\n    setsum\n      (%n. setsum ?vP {brnL cl n..<+brn (cl ! n)})\n      (theFT dl - theFT cl) +\n    setsum\n      (%n. setsum ?vP {brnL cl n..<+brn (cl ! n)})\n      (theFT cl)\" (is \"... = ?L + ?R\")\n    apply(rule setsum.union_disjoint) by auto\n    also have \"?R = 0\" apply(rule setsum.neutral) using cldl nf by auto\n    finally have \"setsum ?vP ?II_0 = ?L\" by simp\n    also have \"?L =\n    setsum\n      (%n. ?vS n / (1 - ?vSF) * setsum (?v n) {..< brn (cl ! n)})\n      (theFT dl - theFT cl)\"\n    apply(intro setsum.cong) using cldl nf\n    using theFT_theNFT setsum_wt_ParT_notWtFT_notFinished[of cl] by metis+\n    also have \"... =\n    setsum\n      (%n. ?vS n * setsum (?v n) {..< brn (cl ! n)})\n      (theFT dl - theFT cl) / (1 - ?vSF)\" (is \"... = ?L / (1 - ?vSF)\")\n    unfolding times_divide_eq_left setsum_divide_distrib by simp\n    also have \"?L = setsum ?vS (theFT dl - theFT cl)\"\n    apply(intro setsum.cong) by auto\n    finally have\n    \"setsum ?vP ?II_0 = (setsum ?vS (theFT dl - theFT cl)) / (1 - ?vSF)\"\n    (is \"... = ?L / ?R\") by simp\n    also have \"?L = setsum ?vS (theFTOne cl dl) - ?vSF\"\n    unfolding eq_diff_eq WtFT_def theFTOne\n    apply(rule setsum.union_disjoint[THEN sym]) by auto\n    finally have vPII0: \"setsum ?vP ?II_0 =\n    (setsum ?vS (theFTOne cl dl) - ?vSF) / (1 - ?vSF)\" by simp\n    (*  *)\n    (*  *)\n    have \"setsum ?wP ?JJ_0 =\n    setsum (%n. setsum ?wP {brnL dl n..<+brn (dl ! n)}) (theFTOne dl cl)\"\n    unfolding BrnFT_def apply(rule setsum.UNION_disjoint)\n    unfolding theFTOne_def theFT_def apply (force, force, clarify)\n    apply(rule brnL_Int) using l by auto\n    also have \"... =\n    setsum\n      (%n. setsum ?wP {brnL dl n..<+ brn (dl ! n)})\n      ((theFT cl - theFT dl) \\<union> theFT dl)\" unfolding theFTOne_def\n    by (metis Un_Diff_cancel2 Un_commute)\n    also have \"... =\n    setsum\n      (%n. setsum ?wP {brnL dl n..<+brn (dl ! n)})\n      (theFT cl - theFT dl) +\n    setsum\n      (%n. setsum ?wP {brnL dl n..<+brn (dl ! n)})\n      (theFT dl)\" (is \"... = ?L + ?R\")\n    apply(rule setsum.union_disjoint) by auto\n    also have \"?R = 0\" apply(rule setsum.neutral) using cldl nf by auto\n    finally have \"setsum ?wP ?JJ_0 = ?L\" by simp\n    also have \"?L =\n    setsum\n      (%n. ?wS n / (1 - ?wSF) * setsum (?w n) {..< brn (dl ! n)})\n      (theFT cl - theFT dl)\"\n    apply(intro setsum.cong) using cldl nf\n    using theFT_theNFT setsum_wt_ParT_notWtFT_notFinished[of dl] by metis+\n    also have \"... =\n    setsum\n      (%n. ?wS n * setsum (?w n) {..< brn (dl ! n)})\n      (theFT cl - theFT dl) / (1 - ?wSF)\" (is \"... = ?L / (1 - ?wSF)\")\n    unfolding times_divide_eq_left setsum_divide_distrib by simp\n    also have \"?L = setsum ?wS (theFT cl - theFT dl)\"\n    apply(intro setsum.cong) by auto\n    finally have\n    \"setsum ?wP ?JJ_0 = (setsum ?wS (theFT cl - theFT dl)) / (1 - ?wSF)\"\n    (is \"... = ?L / ?R\") by simp\n    also have \"?L = setsum ?wS (theFTOne dl cl) - ?wSF\"\n    unfolding eq_diff_eq WtFT_def theFTOne\n    apply(rule setsum.union_disjoint[THEN sym]) by auto\n    finally have wPJJ0: \"setsum ?wP ?JJ_0 =\n    (setsum ?wS (theFTOne dl cl) - ?wSF) / (1 - ?wSF)\" by simp\n    (*  *)\n    have \"setsum ?vP II / (1 - setsum ?vP ?II_0) =\n    (?vS n) / (1 - ?vSF) * (setsum (?v n) I) / (1 - setsum ?vP ?II_0)\"\n    unfolding II using n nf cldl I_sub by simp\n    also have \"... =\n    (?vS n) * (setsum (?v n) I) / (1 - setsum ?vS (theFTOne cl dl))\"\n    apply (rule triv_div_mult) using vPII0 nf le1 by auto\n    also have \"... =\n    (?wS n) * (setsum (?w n) (F n I)) / (1 - setsum ?wS (theFTOne dl cl))\"\n    using n vSwS[of n] sw[of n I] I unfolding setsum_vS_wS by simp\n    also have \"... =\n    (?wS n) / (1 - ?wSF) * (setsum (?w n) (F n I)) / (1 - setsum ?wP ?JJ_0)\"\n    apply (rule triv_div_mult[THEN sym]) using wPJJ0 nf le1 by auto\n    also have \"... = setsum ?wP ?JJ / (1 - setsum ?wP ?JJ_0)\"\n    unfolding JJ using n nf cldl FnI_sub by simp\n    finally show ?thesis .\n  qed\nqed\n\n(* *)\n\ndefinition thetaZOParT where\n\"thetaZOParT \\<equiv>\n {(ParT cl, ParT dl) |\n    cl dl.\n      properL cl \\<and> properL dl \\<and> SbisL cl dl}\"\n\nlemma cont_eff_ParT_BrnFT_L:\nassumes l: \"length cl = length dl\"\nand cldl: \"properL cl\" \"properL dl\" \"SbisL cl dl\"\nand ii: \"ii \\<in> BrnFT cl dl\"\nand eff_cont:\n\"\\<And>n I i j. \\<lbrakk>n < length cl; I \\<in> P n; i \\<in> I; j \\<in> F n I\\<rbrakk> \\<Longrightarrow>\n  eff (cl!n) s i \\<approx> eff (dl!n) t j \\<and>\n  cont (cl!n) s i \\<approx>s cont (dl!n) t j\"\nshows\n\"s \\<approx> eff (ParT cl) s ii \\<and>\n (cont (ParT cl) s ii, ParT dl) \\<in> thetaZOParT\"\n(is \"?eff \\<and> ?cont\")\nproof-\n  let ?N = \"length cl\" let ?p = \"%n. 1 / length cl\" let ?ss = \"%n. s\"\n  from ii show ?thesis\n  proof(cases rule: BrnFT_elim)\n    case (Local n i)\n    hence n: \"n \\<in> theFTOne cl dl\"\n    and i: \"i < brn (cl ! n)\" and ii: \"ii = brnL cl n + i\" by auto\n    from n have \"n < length cl\" \"n < length dl\" using l cldl\n    unfolding theFTOne_def theFT_def by auto note n = this n\n    have discr: \"discr (cl!n)\"\n    proof(cases \"finished (cl!n)\")\n      case True\n      thus ?thesis using n cldl discr_finished by auto\n    next\n      case False\n      hence \"finished (dl!n)\" using n unfolding theFTOne_def theFT_def by auto\n      moreover have \"proper (cl!n)\" and \"proper (dl!n)\" and \"cl!n \\<approx>01 dl!n\"\n      using n cldl by auto\n      ultimately show ?thesis using ZObis_finished_discr_L by blast\n    qed\n    hence eff: \"?ss n \\<approx> eff (cl!n) (?ss n) i\"\n    and cont: \"proper (cont (cl!n) (?ss n) i) \\<and> discr (cont (cl!n) (?ss n) i)\"\n    using i cldl n by auto\n    show ?thesis\n    proof\n      have \"s \\<approx> eff (cl!n) (?ss n) i\" using eff n indis_trans by blast\n      thus ?eff using i n cldl unfolding ii by simp\n    next\n      have \"cont (cl!n) (?ss n) i \\<approx>s cl!n\" using discr cont cldl n by auto\n      moreover have \"cl!n \\<approx>s dl!n\" using cldl n by auto\n      ultimately have \"cont (cl!n) (?ss n) i \\<approx>s dl!n\" using Sbis_trans by blast\n      thus ?cont using i n cldl unfolding ii thetaZOParT_def by auto\n    qed\n  qed\nqed\n\nlemma cont_eff_ParT_BrnFT_R:\nassumes l: \"length cl = length dl\"\nand cldl: \"properL cl\" \"properL dl\" \"SbisL cl dl\"\nand jj: \"jj \\<in> BrnFT dl cl\"\nand eff_cont:\n\"\\<And>n I i j. \\<lbrakk>n < length cl; I \\<in> P n; i \\<in> I; j \\<in> F n I\\<rbrakk> \\<Longrightarrow>\n  eff (cl!n) s i \\<approx> eff (dl!n) t j \\<and> cont (cl!n) s i \\<approx>s cont (dl!n) t j\"\nshows\n\"t \\<approx> eff (ParT dl) t jj \\<and>\n (ParT cl, cont (ParT dl) t jj) \\<in> thetaZOParT\"\n(is \"?eff \\<and> ?cont\")\nproof-\n  let ?N = \"length dl\"  let ?q = \"%n. 1 /?N\" let ?tt = \"%n. t\"\n  from jj show ?thesis\n  proof(cases rule: BrnFT_elim)\n    case (Local n j)\n    hence n: \"n \\<in> theFTOne dl cl\"\n    and j: \"j < brn (dl ! n)\" and jj: \"jj = brnL dl n + j\" by auto\n    from n have \"n < length cl\" \"n < length dl\" using l cldl\n    unfolding theFTOne_def theFT_def by auto note n = this n\n    have discr: \"discr (dl!n)\"\n    proof(cases \"finished (dl!n)\")\n      case True\n      thus ?thesis using n cldl discr_finished by auto\n    next\n      case False\n      hence \"finished (cl!n)\" using n unfolding theFTOne_def theFT_def by auto\n      moreover have \"proper (cl!n)\" and \"proper (dl!n)\" and \"cl!n \\<approx>01 dl!n\"\n      using n cldl by auto\n      ultimately show ?thesis using ZObis_finished_discr_R by blast\n    qed\n    hence eff: \"?tt n \\<approx> eff (dl!n) (?tt n) j\"\n    and cont: \"proper (cont (dl!n) (?tt n) j) \\<and> discr (cont (dl!n) (?tt n) j)\"\n    using j cldl n by auto\n    show ?thesis\n    proof\n      have \"t \\<approx> eff (dl!n) (?tt n) j\" using eff n indis_trans by blast\n      thus ?eff using j n cldl unfolding jj by simp\n    next\n      have \"cl!n \\<approx>s dl!n\" using cldl n by auto\n      moreover have \"dl!n \\<approx>s cont (dl!n) (?tt n) j\" using discr cont cldl n by auto\n      ultimately have \"cl!n \\<approx>s cont (dl!n) (?tt n) j\" using Sbis_trans by blast\n      thus ?cont using j n cldl unfolding jj thetaZOParT_def by simp\n    qed\n  qed\nqed\n\nlemma cont_eff_ParT_UNlift01:\nassumes l: \"length cl = length dl\"\nand cldl: \"properL cl\" \"properL dl\" \"SbisL cl dl\"\nand II: \"II \\<in> UNpart01 cl dl P - {BrnFT cl dl}\"\nand ii: \"ii \\<in> II\" and jj: \"jj \\<in> UNlift01 cl dl P F II\"\nand P: \"\\<And> n. n < length cl \\<Longrightarrow> part {..< brn (cl!n)} (P n) \\<and> {} \\<notin> P n\"\nand FP: \"\\<And> n. n < length dl \\<Longrightarrow> part {..< brn (dl!n)} (F n ` (P n))\"\nand eff_cont:\n\"\\<And>n I i j. \\<lbrakk>n < length cl; I \\<in> P n; i \\<in> I; j \\<in> F n I\\<rbrakk> \\<Longrightarrow>\n  eff (cl!n) s i \\<approx>\n  eff (dl!n) t j \\<and>\n  cont (cl!n) s i \\<approx>s\n  cont (dl!n) t j\"\nand st: \"s \\<approx> t\"\nshows\n\"eff (ParT cl) s ii \\<approx> eff (ParT dl) t jj \\<and>\n (cont (ParT cl) s ii, cont (ParT dl) t jj) \\<in> thetaZOParT\"\n(is \"?eff \\<and> ?cont\")\nproof-\n  let ?N = \"length cl\"\n  let ?p = \"%n. 1 / ?N\" let ?q = \"%n. 1 / (length dl)\"\n  let ?ss = \"%n. s\" let ?tt = \"%n. t\"\n  have sstt: \"\\<And> n. n < ?N \\<Longrightarrow> ?ss n \\<approx> ?tt n\" using st l by auto\n  have pq: \"\\<And> n. n < ?N \\<Longrightarrow> ?p n = ?q n\" and sstt: \"\\<And> n. n < ?N \\<Longrightarrow> ?ss n \\<approx> ?tt n\"\n  using assms l by auto\n  have II: \"II \\<in> UNpart1 cl dl P\" using II l P UNpart1_UNpart01 by blast\n  thus ?thesis\n  proof(cases rule: UNpart1_cases)\n    case (Local n I)\n    hence n: \"n < ?N\" \"n < length dl\" \"n \\<in> theNFTBoth cl dl\"\n    \"\\<not> finished (cl!n)\"  \"\\<not> finished (dl!n)\"\n    and I: \"I \\<in> P n\" and II: \"II = shift cl n I\" using l by auto\n    from ii II obtain i where i: \"i \\<in> I\" and ii: \"ii = brnL cl n + i\"\n    unfolding shift_def by auto\n    have \"i < brn (cl!n)\" using i I n P unfolding part_def by blast note i = this i\n    have jj: \"jj \\<in> shift dl n (F n I)\" using jj P n I l unfolding II by simp\n    from jj II obtain j where j: \"j \\<in> F n I\" and jj: \"jj = brnL dl n + j\"\n    unfolding shift_def by auto\n    have \"j < brn (dl!n)\" using j I n FP unfolding part_def by blast note j = this j\n    show ?thesis\n    proof\n      have \"eff (cl!n) (?ss n) i \\<approx> eff (dl!n) (?tt n) j\"\n      using n I i j eff_cont by blast\n      thus ?eff unfolding ii jj using st cldl n i j by simp\n    next\n      have 1: \"cont (cl!n) (?ss n) i \\<approx>s cont (dl!n) (?tt n) j\"\n      using n I i j eff_cont by blast\n      have \"(cont (ParT cl) s ii, cont (ParT dl) t jj) =\n            (ParT (cl[n := cont (cl ! n) (?ss n) i]),\n              ParT (dl[n := cont (dl ! n) (?tt n) j]))\"\n      (is \"?A = ?B\")\n      unfolding ii jj using n i j cldl by simp\n      moreover have \"?B \\<in> thetaZOParT\"\n      unfolding thetaZOParT_def apply (simp, safe)\n      apply(intro properL_update)\n        using cldl apply force\n        apply(rule proper_cont) using cldl i n apply (force,force)\n      apply(intro properL_update)\n        using cldl apply force\n        apply(rule proper_cont) using cldl j n apply (force,force)\n      apply(intro SbisL_update)\n      using 1 cldl n i apply (force,force)\n      done\n      ultimately show ?cont by auto\n    qed\n  qed\nqed\n\nlemma thetaZOParT_ZOretr: \"thetaZOParT \\<subseteq> ZOretr (thetaZOParT)\"\nunfolding ZOretr_def matchC_LC_def proof safe\n  fix c d s t\n  assume c_d: \"(c, d) \\<in> thetaZOParT\" and st: \"s \\<approx> t\"\n  then obtain cl dl where\n  c: \"c = ParT cl\" and d: \"d = ParT dl\" and\n  cldl: \"properL cl\" \"properL dl\" \"SbisL cl dl\"\n  unfolding thetaZOParT_def by blast\n  let ?N = \"length cl\"\n  let ?ss = \"%n. s\" let ?tt = \"%n. t\"\n  have N: \"?N = length dl\" using cldl by simp\n  have sstt: \"\\<And> n. n < ?N \\<Longrightarrow> ?ss n \\<approx> ?tt n\" using assms st N by auto\n  let ?phi = \"%n PFn. mC_C Sbis (cl ! n) (dl ! n) (?ss n) (?tt n) (fst PFn) (snd PFn)\"\n  {fix n assume n: \"n < ?N\"\n   hence \"cl ! n \\<approx>s dl ! n\" using cldl by auto\n   hence \"\\<exists> PFn. ?phi n PFn\" using n Sbis_mC_C sstt by fastforce\n  }\n  then obtain PF where phi: \"\\<And>n. n < ?N \\<Longrightarrow> ?phi n (PF n)\"\n  using bchoice[of \"{..< ?N}\" ?phi] by blast\n  def P \\<equiv> \"fst o PF\" def F \\<equiv> \"snd o PF\"\n  have m: \"\\<And>n. n < ?N \\<Longrightarrow> mC_C Sbis (cl ! n) (dl ! n) (?ss n) (?tt n) (P n) (F n)\"\n  using phi unfolding P_def F_def by auto\n  (*  *)\n  have brn_c: \"brn c = brnL cl ?N\" unfolding c by simp\n  have brn_d: \"brn d = brnL dl (length dl)\" unfolding d by simp\n  have P: \"\\<And>n. n < ?N \\<Longrightarrow> part {..< brn (cl ! n)} (P n) \\<and> {} \\<notin> (P n)\"\n  using m unfolding m_defsAll part_def by auto\n  have FP: \"\\<And>n. n < length dl \\<Longrightarrow> part {..< brn (dl ! n)} (F n ` (P n)) \\<and> {} \\<notin> F n ` (P n)\"\n  using m N unfolding m_defsAll part_def by auto\n  have F: \"\\<And>n. n < ?N \\<Longrightarrow> inj_on (F n) (P n)\" using m unfolding m_defsAll by auto\n  have sw: \"\\<And>n I. \\<lbrakk>n < length cl; I \\<in> P n\\<rbrakk> \\<Longrightarrow>\n     setsum (wt (cl ! n) (?ss n)) I = setsum (wt (dl ! n) (?tt n)) (F n I)\"\n  using m unfolding mC_C_def mC_C_wt_def by auto\n  have eff_cont: \"\\<And>n I i j. \\<lbrakk>n < length cl; I \\<in> P n; i \\<in> I; j \\<in> F n I\\<rbrakk> \\<Longrightarrow>\n     eff (cl!n) (?ss n) i \\<approx> eff (dl!n) (?tt n) j \\<and> cont (cl!n) (?ss n) i \\<approx>s cont (dl!n) (?tt n) j\"\n  using m unfolding mC_C_def mC_C_eff_cont_def by auto\n  (*  *)\n  def II0 \\<equiv> \"BrnFT cl dl\"\n  def Q \\<equiv> \"UNpart01 cl dl P\" def G \\<equiv> \"UNlift01 cl dl P F\"\n  note defi = II0_def Q_def G_def brn_c brn_d\n  show \"\\<exists>II0 Q G. mC_ZOC (thetaZOParT) c d s t II0 Q G\"\n  apply(rule exI[of _ II0]) apply(rule exI[of _ Q]) apply(rule exI[of _ G])\n  unfolding mC_ZOC_def proof (intro conjI)\n    show \"mC_ZOC_part c d s t II0 Q G\" unfolding mC_ZOC_part_def proof(intro conjI)\n      show \"{} \\<notin> Q - {II0}\" unfolding defi apply(rule emp_UNpart01) using P by simp\n      show \"{} \\<notin> G ` (Q - {II0})\" unfolding defi\n      apply(rule emp_UNlift01_UNpart01) using N P FP by auto\n      show \"II0 \\<in> Q\" unfolding defi by simp\n      show \"part {..<brn c} Q\"\n      unfolding defi apply(rule part_UNpart01) using cldl P by auto\n      show \"part {..<brn d} (G ` Q)\"\n      unfolding defi apply(rule part_UNlift01_UNpart01) using N cldl P FP by auto\n    qed\n  next\n    show \"inj_on G Q\"\n    unfolding defi apply(rule UNlift01_inj_on) using N P FP F by auto\n  next\n    show \"mC_ZOC_wt c d s t II0 Q G\"\n    unfolding mC_ZOC_wt_def proof (intro impI ballI, elim conjE)\n      fix II assume II: \"II \\<in> Q - {II0}\" and\n      le1: \"setsum (wt c s) II0 < 1\" \"setsum (wt d t) (G II0) < 1\"\n      thus\n      \"setsum (wt c s) II / (1 - setsum (wt c s) II0) =\n       setsum (wt d t) (G II) / (1 - setsum (wt d t) (G II0))\"\n      unfolding c d defi UNlift01_BrnFT apply(intro ss_wt_ParT_UNlift01)\n      using N cldl II P FP sw st by auto\n    qed\n  next\n    show \"mC_ZOC_eff_cont0 (thetaZOParT) c d s t II0 G\"\n    unfolding mC_ZOC_eff_cont0_def\n    proof(intro conjI[OF ballI ballI])\n      fix ii assume \"ii \\<in> II0\" thus \"s \\<approx> eff c s ii \\<and> (cont c s ii, d) \\<in> thetaZOParT\"\n      unfolding defi c d apply(intro cont_eff_ParT_BrnFT_L)\n      using N cldl P FP eff_cont st by (auto intro!: )\n    next\n      fix jj assume \"jj \\<in> G II0\"\n      hence \"jj \\<in> BrnFT dl cl\" unfolding defi UNlift01_BrnFT by simp\n      thus \"t \\<approx> eff d t jj \\<and> (c, cont d t jj) \\<in> thetaZOParT\"\n      unfolding defi c d apply(intro cont_eff_ParT_BrnFT_R)\n      using N cldl P FP eff_cont st by auto\n    qed\n  next\n    show \"mC_ZOC_eff_cont (thetaZOParT) c d s t II0 Q G\"\n    unfolding mC_ZOC_eff_cont_def proof (intro allI impI, elim conjE)\n      fix II ii jj assume II: \"II \\<in> Q - {II0}\" and ii: \"ii \\<in> II\" and jj: \"jj \\<in> G II\"\n      thus \"eff c s ii \\<approx> eff d t jj \\<and> (cont c s ii, cont d t jj) \\<in> thetaZOParT\"\n      unfolding defi c d apply(intro cont_eff_ParT_UNlift01)\n      using N cldl P FP eff_cont st by auto\n    qed\n  qed\nqed\n\nlemma thetaZOParT_ZObis: \"thetaZOParT \\<subseteq> ZObis\"\nusing ZObis_raw_coind thetaZOParT_ZOretr[OF assms] by auto\n\ntheorem ParT_ZObis[simp]:\nassumes \"properL cl\" and \"properL dl\" and \"SbisL cl dl\"\nshows \"ParT cl \\<approx>01 ParT dl\"\nusing assms thetaZOParT_ZObis unfolding thetaZOParT_def by blast\n\n\nend (* context PL_Indis *)\n(*******************************************)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Probabilistic_Noninterference/Compositionality.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.32893011953421425}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Sim\n  imports Weak_Early_Semantics Strong_Early_Sim_Pres\nbegin\n\ndefinition weakSimulation :: \"pi \\<Rightarrow> (pi \\<times> pi) set \\<Rightarrow> pi \\<Rightarrow> bool\" (\"_ \\<leadsto><_> _\" [80, 80, 80] 80)\n  where \"P \\<leadsto><Rel> Q \\<equiv> (\\<forall>a x Q'. Q \\<longmapsto>a<\\<nu>x> \\<prec> Q' \\<and> x \\<sharp> P \\<longrightarrow> (\\<exists>P'. P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel)) \\<and>\n                       (\\<forall>\\<alpha> Q'. Q \\<longmapsto>\\<alpha> \\<prec> Q' \\<longrightarrow> (\\<exists>P'. P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel))\"\n\n\n\n  assumes \"P \\<leadsto><A> P'\"\n  and     \"A \\<subseteq> B\"\n\n  shows \"P \\<leadsto><B> P'\"\nusing assms\nby(simp add: weakSimulation_def) blast\n\nlemma simCasesCont[consumes 1, case_names Bound Free]:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   C   :: \"'a::fs_name\"\n\n  assumes Eqvt:  \"eqvt Rel\"\n  and     Bound: \"\\<And>a x Q'. \\<lbrakk>Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'; x \\<sharp> P; x \\<sharp> Q; x \\<noteq> a; x \\<sharp> C\\<rbrakk> \\<Longrightarrow> \\<exists>P'. P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  and     Free:  \"\\<And>\\<alpha> Q'. Q \\<longmapsto> \\<alpha> \\<prec> Q' \\<Longrightarrow> \\<exists>P'. P \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n\n  shows \"P \\<leadsto><Rel> Q\"\nproof(auto simp add: weakSimulation_def)\n  fix a x Q'\n  assume QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" and \"x \\<sharp> P\"\n  obtain c::name where \"c \\<sharp> P\" and \"c \\<sharp> Q\" and \"c \\<noteq> a\" and \"c \\<sharp> Q'\" and \"c \\<sharp> C\" and \"c \\<noteq> x\"\n    by(generate_fresh \"name\") auto\n\n  from QTrans \\<open>c \\<sharp> Q'\\<close> have \"Q \\<longmapsto> a<\\<nu>c> \\<prec> ([(x, c)] \\<bullet> Q')\" by(simp add: alphaBoundOutput)\n  then obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>c> \\<prec> P'\" and P'RelQ': \"(P', [(x, c)] \\<bullet> Q') \\<in> Rel\"\n    using \\<open>c \\<sharp> P\\<close> \\<open>c \\<sharp> Q\\<close> \\<open>c \\<noteq> a\\<close> \\<open>c \\<sharp> C\\<close>\n    by(drule_tac Bound) auto\n\n  from PTrans \\<open>x \\<sharp> P\\<close> \\<open>c \\<noteq> x\\<close> have \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> ([(x, c)] \\<bullet> P')\"\n    by(force intro: weakTransitionAlpha simp add: name_swap)\n  moreover from Eqvt P'RelQ' have \"([(x, c)] \\<bullet> P', [(x, c)] \\<bullet> [(x, c)] \\<bullet> Q') \\<in> Rel\"\n    by(rule eqvtRelI)\n  hence \"([(x, c)] \\<bullet> P', Q') \\<in> Rel\" by simp\n  ultimately show \"\\<exists>P'. P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n    by blast\nnext\n  fix \\<alpha> Q'\n  assume \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\"\n  thus \"\\<exists>P'. P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n    by(rule Free)\nqed\n\nlemma simCases[case_names Bound Free]:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   C   :: \"'a::fs_name\"\n\n  assumes \"\\<And>Q' a x. \\<lbrakk>Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'; x \\<sharp> P\\<rbrakk> \\<Longrightarrow> \\<exists>P'. P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  and     \"\\<And>Q' \\<alpha>. Q \\<longmapsto> \\<alpha> \\<prec> Q' \\<Longrightarrow> \\<exists>P'. P \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n\n  shows \"P \\<leadsto><Rel> Q\"\nusing assms\nby(auto simp add: weakSimulation_def)\n\nlemma simE:\n  fixes P   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   Q   :: pi\n  and   a   :: name\n  and   x   :: name\n  and   Q'  :: pi\n\n  assumes \"P \\<leadsto><Rel> Q\"\n\n  shows \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q' \\<Longrightarrow> x \\<sharp> P \\<Longrightarrow> \\<exists>P'. P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  and   \"Q \\<longmapsto>\\<alpha> \\<prec> Q' \\<Longrightarrow> \\<exists>P'. P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\nusing assms by(simp add: weakSimulation_def)+\n\nlemma weakSimTauChain:\n  fixes P   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n  and   Q   :: pi\n  and   Q'  :: pi\n\n  assumes QChain: \"Q \\<Longrightarrow>\\<^sub>\\<tau> Q'\"\n  and     PRelQ: \"(P, Q) \\<in> Rel\"\n  and     PSimQ: \"\\<And>R S. (R, S) \\<in> Rel \\<Longrightarrow> R \\<leadsto><Rel> S\"\n\n  shows \"\\<exists>P'. P \\<Longrightarrow>\\<^sub>\\<tau> P' \\<and> (P', Q') \\<in> Rel\"\nproof -\n  from QChain show ?thesis\n  proof(induct rule: tauChainInduct)\n    case id\n    moreover have \"P \\<Longrightarrow>\\<^sub>\\<tau> P\" by simp\n    ultimately show ?case using PSimQ PRelQ by blast\n  next\n    case(ih Q' Q'')\n    have \"\\<exists>P'. P \\<Longrightarrow>\\<^sub>\\<tau> P' \\<and> (P', Q') \\<in> Rel\" by fact\n    then obtain P' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau> P'\" and P'Rel'Q': \"(P', Q') \\<in> Rel\" by blast\n    from P'Rel'Q' have \"P' \\<leadsto><Rel> Q'\" by(rule PSimQ)\n    moreover have Q'Trans: \"Q' \\<longmapsto>\\<tau> \\<prec> Q''\" by fact\n    ultimately obtain P'' where P'Trans: \"P' \\<Longrightarrow>\\<^sup>^\\<tau> \\<prec> P''\" and P''RelQ'': \"(P'', Q'') \\<in> Rel\"\n      by(blast dest: simE)\n    from P'Trans have \"P' \\<Longrightarrow>\\<^sub>\\<tau> P''\" by simp\n    with PChain have \"P \\<Longrightarrow>\\<^sub>\\<tau> P''\" by auto\n    with P''RelQ'' show ?case by blast\n  qed\nqed\n\nlemma simE2:\n  fixes P   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   Q   :: pi\n  and   a   :: name\n  and   x   :: name\n  and   Q'  :: pi\n\n  assumes Sim: \"\\<And>R S. (R, S) \\<in> Rel \\<Longrightarrow> R \\<leadsto><Rel> S\"\n  and     Eqvt: \"eqvt Rel\"\n  and     PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"Q \\<Longrightarrow>a<\\<nu>x> \\<prec> Q' \\<Longrightarrow> x \\<sharp> P \\<Longrightarrow> \\<exists>P'. P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  and   \"Q \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> Q' \\<Longrightarrow> \\<exists>P'. P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\nproof -\n  assume QTrans: \"Q \\<Longrightarrow>a<\\<nu>x> \\<prec> Q'\" and \"x \\<sharp> P\"\n  from QTrans obtain Q'' Q''' where QChain: \"Q \\<Longrightarrow>\\<^sub>\\<tau> Q'''\"\n                                and Q'''Trans: \"Q''' \\<longmapsto>a<\\<nu>x> \\<prec> Q''\"\n                                and Q''Chain: \"Q'' \\<Longrightarrow>\\<^sub>\\<tau> Q'\"\n    by(blast dest: transitionE)\n\n  from QChain PRelQ Sim obtain P''' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau> P'''\" and P'''RelQ''': \"(P''', Q''') \\<in> Rel\" \n    by(blast dest: weakSimTauChain)\n\n  from PChain \\<open>x \\<sharp> P\\<close> have \"x \\<sharp> P'''\" by(rule freshChain)\n      \n  from P'''RelQ''' have \"P''' \\<leadsto><Rel> Q'''\" by(rule Sim)\n  with Q'''Trans \\<open>x \\<sharp> P'''\\<close> obtain P'' where P'''Trans: \"P''' \\<Longrightarrow>a<\\<nu>x> \\<prec> P''\"\n                                         and P''RelQ'': \"(P'', Q'') \\<in> Rel\"\n    by(blast dest: simE)\n\n  from Q''Chain P''RelQ'' Sim obtain P' where P''Chain: \"P'' \\<Longrightarrow>\\<^sub>\\<tau> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n    by(blast dest: weakSimTauChain)\n  from PChain P'''Trans P''Chain  have \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n    by(blast dest: Weak_Early_Step_Semantics.chainTransitionAppend)\n  with P'RelQ' show \"\\<exists>P'. P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel\" by blast\nnext\n  assume \"Q \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> Q'\"\n  thus \"\\<exists>P'. P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  proof(induct rule: transitionCases)\n    case Step\n    have \"Q \\<Longrightarrow>\\<alpha> \\<prec> Q'\" by fact\n    then obtain Q'' Q''' where QChain: \"Q \\<Longrightarrow>\\<^sub>\\<tau> Q''\" \n                           and Q''Trans: \"Q'' \\<longmapsto>\\<alpha> \\<prec> Q'''\"\n                           and Q'''Chain: \"Q''' \\<Longrightarrow>\\<^sub>\\<tau> Q'\"\n      by(blast dest: transitionE)\n\n    from QChain PRelQ Sim have \"\\<exists>P''. P \\<Longrightarrow>\\<^sub>\\<tau> P'' \\<and> (P'', Q'') \\<in> Rel\"\n      by(rule weakSimTauChain)\n    then obtain P'' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau> P''\" and P''RelQ'': \"(P'', Q'') \\<in> Rel\" by blast\n    from P''RelQ'' have \"P'' \\<leadsto><Rel> Q''\" by(rule Sim)\n    with Q''Trans obtain P''' where P''Trans: \"P'' \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P'''\"\n                                and P'''RelQ''': \"(P''', Q''') \\<in> Rel\"\n      by(blast dest: simE)\n    \n    have \"\\<exists>P'. P''' \\<Longrightarrow>\\<^sub>\\<tau> P' \\<and> (P', Q') \\<in> Rel\" using Q'''Chain P'''RelQ''' Sim\n      by(rule weakSimTauChain)\n    then obtain P' where P'''Chain: \"P''' \\<Longrightarrow>\\<^sub>\\<tau> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" by blast\n    \n    from PChain P''Trans P'''Chain have \"P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P'\"\n      by(blast dest: chainTransitionAppend)\n    with P'RelQ' show ?case by blast\n  next\n    case Stay\n    have \"P \\<Longrightarrow>\\<^sup>^\\<tau> \\<prec> P\" by simp\n    thus ?case using PRelQ by blast\n  qed\nqed\n\nlemma eqvtI:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   perm :: \"name prm\"\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"(perm \\<bullet> P) \\<leadsto><Rel'> (perm \\<bullet> Q)\"\nproof(induct rule: simCases)\n  case(Bound Q' a x)\n  have xFreshP: \"x \\<sharp> perm \\<bullet> P\" by fact\n  have QTrans: \"(perm \\<bullet> Q) \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n\n  hence \"(rev perm \\<bullet> (perm \\<bullet> Q)) \\<longmapsto> rev perm \\<bullet> (a<\\<nu>x> \\<prec> Q')\" by(rule eqvts)\n  hence \"Q \\<longmapsto> (rev perm \\<bullet> a)<\\<nu>(rev perm \\<bullet> x)> \\<prec> (rev perm \\<bullet> Q')\" \n    by(simp add: name_rev_per)\n  moreover from xFreshP have \"(rev perm \\<bullet> x) \\<sharp> P\" by(simp add: name_fresh_left)\n  ultimately obtain P' where PTrans: \"P \\<Longrightarrow>(rev perm \\<bullet> a)<\\<nu>(rev perm \\<bullet> x)> \\<prec> P'\"\n                         and P'RelQ': \"(P', rev perm \\<bullet> Q') \\<in> Rel\" using PSimQ\n    by(blast dest: simE)\n  \n  from PTrans have \"(perm \\<bullet> P) \\<Longrightarrow>(perm \\<bullet> rev perm \\<bullet> a)<\\<nu>(perm \\<bullet> rev perm \\<bullet> x)> \\<prec> perm \\<bullet> P'\" \n    by(rule eqvts)\n  hence \"(perm \\<bullet> P) \\<Longrightarrow>a<\\<nu>x> \\<prec> (perm \\<bullet> P')\" by(simp add: name_per_rev)\n  moreover from P'RelQ' RelRel' have \"(P', rev perm \\<bullet> Q') \\<in> Rel'\" by blast\n  with EqvtRel' have \"(perm \\<bullet> P', perm \\<bullet> (rev perm \\<bullet> Q')) \\<in> Rel'\"\n    by(rule eqvtRelI)\n  hence \"(perm \\<bullet> P', Q') \\<in> Rel'\" by(simp add: name_per_rev)\n  ultimately show ?case by blast\nnext\n  case(Free Q' \\<alpha>)\n  have QTrans: \"(perm \\<bullet> Q) \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n\n  hence \"(rev perm \\<bullet> (perm \\<bullet> Q)) \\<longmapsto> rev perm \\<bullet> (\\<alpha> \\<prec> Q')\" by(rule eqvts)\n  hence \"Q \\<longmapsto> (rev perm \\<bullet> \\<alpha>) \\<prec> (rev perm \\<bullet> Q')\"  by(simp add: name_rev_per)\n  with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sup>^ (rev perm \\<bullet> \\<alpha>) \\<prec> P'\"\n                         and PRel: \"(P', (rev perm \\<bullet> Q')) \\<in> Rel\"\n    by(blast dest: simE)\n\n  from PTrans have \"(perm \\<bullet> P) \\<Longrightarrow>\\<^sup>^ (perm \\<bullet> rev perm \\<bullet> \\<alpha>) \\<prec> perm \\<bullet> P'\"\n    by(rule Weak_Early_Semantics.eqvtI)\n  hence L1: \"(perm \\<bullet> P) \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> (perm \\<bullet> P')\" by(simp add: name_per_rev)\n  from PRel EqvtRel' RelRel'  have \"((perm \\<bullet> P'), (perm \\<bullet> (rev perm \\<bullet> Q'))) \\<in> Rel'\"\n    by(force intro: eqvtRelI)\n  hence \"((perm \\<bullet> P'), Q') \\<in> Rel'\" by(simp add: name_per_rev)\n  with L1 show ?case by blast\nqed\n\n(*****************Reflexivity and transitivity*********************)\n\nlemma reflexive:\n  fixes P   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n\n  assumes \"Id \\<subseteq> Rel\"\n\n  shows \"P \\<leadsto><Rel> P\"\nusing assms\nby(auto intro: Weak_Early_Step_Semantics.singleActionChain\n   simp add: weakSimulation_def weakFreeTransition_def)\n\n\n\n  assumes QSimR: \"Q \\<leadsto><Rel'> R\"\n  and     Eqvt: \"eqvt Rel\"\n  and     Eqvt'': \"eqvt Rel''\"\n  and     Trans: \"Rel O Rel' \\<subseteq> Rel''\"\n  and     Sim: \"\\<And>S T. (S, T) \\<in> Rel \\<Longrightarrow> S \\<leadsto><Rel> T\"\n  and     PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"P \\<leadsto><Rel''> R\"\nproof -\n  from Eqvt'' show ?thesis\n  proof(induct rule: simCasesCont[where C=Q])\n    case(Bound a x R')\n    have RTrans: \"R \\<longmapsto>a<\\<nu>x> \\<prec> R'\" by fact\n    from \\<open>x \\<sharp> Q\\<close> QSimR RTrans obtain Q' where QTrans: \"Q \\<Longrightarrow>a<\\<nu>x> \\<prec> Q'\"\n                                          and Q'Rel'R': \"(Q', R') \\<in> Rel'\"\n      by(blast dest: simE)\n\n    from Sim Eqvt PRelQ QTrans \\<open>x \\<sharp> P\\<close> \n    obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(drule_tac simE2) auto\n(*      by(blast dest: simE2)*)\n    moreover from P'RelQ' Q'Rel'R' Trans have \"(P', R') \\<in> Rel''\" by blast\n    ultimately show ?case by blast\n  next\n    case(Free \\<alpha> R')\n    have RTrans: \"R \\<longmapsto> \\<alpha> \\<prec> R'\" by fact\n    with QSimR obtain Q' where QTrans: \"Q \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> Q'\" and Q'RelR': \"(Q', R') \\<in> Rel'\"\n      by(blast dest: simE)\n    from Sim Eqvt PRelQ QTrans have \"\\<exists>P'. P \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n      by(blast intro: simE2)\n    then obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" by blast\n    from P'RelQ' Q'RelR' Trans have \"(P', R') \\<in> Rel''\" by blast\n    with PTrans show ?case by blast\n  qed\nqed\n\nlemma strongAppend:\n  fixes P     :: pi\n  and   Q     :: pi\n  and   R     :: pi\n  and   Rel   :: \"(pi \\<times> pi) set\"\n  and   Rel'  :: \"(pi \\<times> pi) set\"\n  and   Rel'' :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     QSimR: \"Q \\<leadsto>[Rel'] R\"\n  and     Eqvt'': \"eqvt Rel''\"\n  and     Trans: \"Rel O Rel' \\<subseteq> Rel''\"\n\n  shows \"P \\<leadsto><Rel''> R\"\nproof -\n  from Eqvt'' show ?thesis\n  proof(induct rule: simCasesCont[where C=Q])\n    case(Bound a x R')\n    have RTrans: \"R \\<longmapsto>a<\\<nu>x> \\<prec> R'\" by fact\n    from QSimR RTrans \\<open>x \\<sharp> Q\\<close> obtain Q' where QTrans: \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\"\n                                          and Q'Rel'R': \"(Q', R') \\<in> Rel'\"\n      by(blast dest: Strong_Early_Sim.elim)\n\n    with PSimQ QTrans \\<open>x \\<sharp> P\\<close> obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" \n      by(blast dest: simE)\n    moreover from P'RelQ' Q'Rel'R' Trans have \"(P', R') \\<in> Rel''\" by blast\n    ultimately show ?case by blast\n  next\n    case(Free \\<alpha> R')\n    have RTrans: \"R \\<longmapsto> \\<alpha> \\<prec> R'\" by fact\n    with QSimR obtain Q' where QTrans: \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" and Q'RelR': \"(Q', R') \\<in> Rel'\"\n      by(blast dest: Strong_Early_Sim.elim)\n    from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from P'RelQ' Q'RelR' Trans have \"(P', R') \\<in> Rel''\" by blast\n    with PTrans show ?case by blast\n  qed\nqed\n\nlemma strongSimWeakSim:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto>[Rel] Q\"\n\n  shows \"P \\<leadsto><Rel> Q\"\nproof(induct rule: simCases)\n  case(Bound Q' a x)\n  have \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n  with PSimQ \\<open>x \\<sharp> P\\<close> obtain P' where PTrans: \"P \\<longmapsto>a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n    by(blast dest: Strong_Early_Sim.elim)\n  from PTrans have \"P \\<Longrightarrow>a<\\<nu>x> \\<prec>  P'\"\n    by(force intro: Weak_Early_Step_Semantics.singleActionChain simp add: weakFreeTransition_def)\n  with P'RelQ' show ?case by blast\nnext\n  case(Free Q' \\<alpha>)\n  have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  with PSimQ obtain P' where PTrans: \"P \\<longmapsto>\\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n    by(blast dest: Strong_Early_Sim.elim)\n  from PTrans have \"P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P'\" by(rule Weak_Early_Semantics.singleActionChain)\n  with P'RelQ' show ?case by blast\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Early_Sim.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.32893011953421425}}
{"text": "(* The value setup for reviewer confidentiality *)\ntheory Review_Value_Setup\nimports Review_Intro\nbegin\n\nconsts PID :: paperID  consts N :: nat\n\ntext \\<open>\\<^term>\\<open>(PID,N)\\<close> identifies uniquely the review under scrutiny\\<close>\n\nsubsection \\<open>Preliminaries\\<close>\n\ndeclare updates_commute_paper[simp]\n\ntext \\<open>Auxiliary definitions:\\<close>\n\ndefinition eqExcNth where\n\"eqExcNth xs ys n \\<equiv>\n length xs = length ys \\<and> (\\<forall> i < length xs. i \\<noteq> n \\<longrightarrow> xs!i = ys!i)\"\n\nlemma eqExcNth_eq[simp,intro!]: \"eqExcNth xs xs n\"\nunfolding eqExcNth_def by auto\n\nlemma eqExcNth_sym:\nassumes \"eqExcNth xs xs1 n\"\nshows \"eqExcNth xs1 xs n\"\nusing assms unfolding eqExcNth_def by auto\n\nlemma eqExcNth_trans:\nassumes \"eqExcNth xs xs1 n\" and \"eqExcNth xs1 xs2 n\"\nshows \"eqExcNth xs xs2 n\"\nusing assms unfolding eqExcNth_def by auto\n\nfun eqExcD :: \"paper \\<Rightarrow> paper \\<Rightarrow> bool\" where\n\"eqExcD (Paper name info ct reviews dis decs)\n        (Paper name1 info1 ct1 reviews1 dis1 decs1) =\n (name = name1 \\<and> info = info1 \\<and> ct = ct1 \\<and> dis = dis1 \\<and> decs = decs1 \\<and>\n  eqExcNth reviews reviews1 N)\"\n\nlemma eqExcD:\n\"eqExcD pap pap1 =\n (titlePaper pap = titlePaper pap1 \\<and> abstractPaper pap = abstractPaper pap1 \\<and>\n  contentPaper pap = contentPaper pap1 \\<and>\n  disPaper pap = disPaper pap1 \\<and> decsPaper pap = decsPaper pap1 \\<and>\n  eqExcNth (reviewsPaper pap) (reviewsPaper pap1) N)\"\nby(cases pap, cases pap1, auto)\n\nlemma eqExcD_eq[simp,intro!]: \"eqExcD pap pap\"\nunfolding eqExcD using eqExcNth_eq by auto\n\n\nlemma eqExcD_sym:\nassumes \"eqExcD pap pap1\"\nshows \"eqExcD pap1 pap\"\nusing assms unfolding eqExcD using eqExcNth_sym by auto\n\nlemma eqExcD_trans:\nassumes \"eqExcD pap pap1\" and \"eqExcD pap1 pap2\"\nshows \"eqExcD pap pap2\"\nusing assms unfolding eqExcD using eqExcNth_trans by auto\n\ndefinition eeqExcPID_N where\n\"eeqExcPID_N paps paps1 \\<equiv>\n \\<forall> pid. if pid = PID then eqExcD (paps pid) (paps1 pid) else paps pid = paps1 pid\"\n\nlemma eeqExcPID_N_eeq[simp,intro!]: \"eeqExcPID_N s s\"\nunfolding eeqExcPID_N_def by auto\n\nlemma eeqExcPID_N_sym:\nassumes \"eeqExcPID_N s s1\" shows \"eeqExcPID_N s1 s\"\nusing assms eqExcD_sym unfolding eeqExcPID_N_def by auto\n\nlemma eeqExcPID_N_trans:\nassumes \"eeqExcPID_N s s1\" and \"eeqExcPID_N s1 s2\" shows \"eeqExcPID_N s s2\"\nusing assms eqExcD_trans unfolding eeqExcPID_N_def by simp blast\n\nlemma eeqExcPID_N_imp:\n\"eeqExcPID_N paps paps1 \\<Longrightarrow> eqExcD (paps PID) (paps1 PID)\"\n\"\\<lbrakk>eeqExcPID_N paps paps1; pid \\<noteq> PID\\<rbrakk> \\<Longrightarrow> paps pid = paps1 pid\"\nunfolding eeqExcPID_N_def by auto\n\nlemma eeqExcPID_N_cong:\nassumes \"eeqExcPID_N paps paps1\"\nand \"pid = PID \\<Longrightarrow> eqExcD uu uu1\"\nand \"pid \\<noteq> PID \\<Longrightarrow> uu = uu1\"\nshows \"eeqExcPID_N (paps (pid := uu)) (paps1(pid := uu1))\"\nusing assms unfolding eeqExcPID_N_def by auto\n\nlemma eeqExcPID_N_RDD:\n\"eeqExcPID_N paps paps1 \\<Longrightarrow>\n titlePaper (paps PID) = titlePaper (paps1 PID) \\<and>\n abstractPaper (paps PID) = abstractPaper (paps1 PID) \\<and>\n contentPaper (paps PID) = contentPaper (paps1 PID) \\<and>\n disPaper (paps PID) = disPaper (paps1 PID) \\<and>\n decsPaper (paps PID) = decsPaper (paps1 PID)\"\nusing eeqExcPID_N_def unfolding eqExcD by auto\n\ntext \\<open>The notion of two states being equal everywhere except on the the review \\<^term>\\<open>(N,PID)\\<close>:\\<close>\n\ndefinition eqExcPID_N :: \"state \\<Rightarrow> state \\<Rightarrow> bool\" where\n\"eqExcPID_N s s1 \\<equiv>\n confIDs s = confIDs s1 \\<and> conf s = conf s1 \\<and>\n userIDs s = userIDs s1 \\<and> pass s = pass s1 \\<and> user s = user s1 \\<and> roles s = roles s1 \\<and>\n paperIDs s = paperIDs s1\n \\<and>\n eeqExcPID_N (paper s) (paper s1)\n \\<and>\n pref s = pref s1 \\<and>\n voronkov s = voronkov s1 \\<and>\n news s = news s1 \\<and> phase s = phase s1\"\n\nlemma eqExcPID_N_eq[simp,intro!]: \"eqExcPID_N s s\"\nunfolding eqExcPID_N_def by auto\n\nlemma eqExcPID_N_sym:\nassumes \"eqExcPID_N s s1\" shows \"eqExcPID_N s1 s\"\nusing assms eeqExcPID_N_sym unfolding eqExcPID_N_def by auto\n\nlemma eqExcPID_N_trans:\nassumes \"eqExcPID_N s s1\" and \"eqExcPID_N s1 s2\" shows \"eqExcPID_N s s2\"\nusing assms eeqExcPID_N_trans unfolding eqExcPID_N_def by auto\n\ntext \\<open>Implications from \\<^term>\\<open>eqExcPID_N\\<close>, including w.r.t. auxiliary operations:\\<close>\n\nlemma eqExcPID_N_imp:\n\"eqExcPID_N s s1 \\<Longrightarrow>\n confIDs s = confIDs s1 \\<and> conf s = conf s1 \\<and>\n userIDs s = userIDs s1 \\<and> pass s = pass s1 \\<and> user s = user s1 \\<and> roles s = roles s1 \\<and>\n paperIDs s = paperIDs s1\n \\<and>\n eeqExcPID_N (paper s) (paper s1)\n \\<and>\n pref s = pref s1 \\<and>\n voronkov s = voronkov s1 \\<and>\n news s = news s1 \\<and> phase s = phase s1 \\<and>\n\n getAllPaperIDs s = getAllPaperIDs s1 \\<and>\n isRev s cid uid pid = isRev s1 cid uid pid \\<and>\n getReviewIndex s cid uid pid = getReviewIndex s1 cid uid pid \\<and>\n getRevRole s cid uid pid = getRevRole s1 cid uid pid \\<and>\n length (reviewsPaper (paper s pid)) = length (reviewsPaper (paper s1 pid))\"\nunfolding eqExcPID_N_def getAllPaperIDs_def\nunfolding isRev_def getReviewIndex_def getRevRole_def apply auto\nunfolding eeqExcPID_N_def eqExcD eqExcNth_def by (cases \"pid = PID\") auto\n\nlemma eqExcPID_N_imp1:\n\"eqExcPID_N s s1 \\<Longrightarrow> eqExcD (paper s pid) (paper s1 pid)\"\n\"eqExcPID_N s s1 \\<Longrightarrow> pid \\<noteq> PID \\<or> PID \\<noteq> pid \\<Longrightarrow>\n    paper s pid = paper s1 pid \\<and>\n    getNthReview s pid n = getNthReview s1 pid n\"\nunfolding eqExcPID_N_def eeqExcPID_N_def getNthReview_def\napply auto by (metis eqExcD_eq)\n\nlemma eqExcPID_N_imp2:\nassumes \"eqExcPID_N s s1\" and \"pid \\<noteq> PID \\<or> PID \\<noteq> pid\"\nshows \"getReviewersReviews s cid pid = getReviewersReviews s1 cid pid\"\nproof-\n  have\n  \"(\\<lambda>uID. if isRev s cid uID pid then [(uID, getNthReview s pid (getReviewIndex s cid uID pid))] else []) =\n   (\\<lambda>uID. if isRev s1 cid uID pid then [(uID, getNthReview s1 pid (getReviewIndex s1 cid uID pid))] else [])\"\n  apply(rule ext)\n  using assms by (auto simp: eqExcPID_N_imp eqExcPID_N_imp1)\n  thus ?thesis unfolding getReviewersReviews_def using assms by (simp add: eqExcPID_N_imp)\nqed\n\nlemma eqExcPID_N_imp3:\n\"eqExcPID_N s s1 \\<Longrightarrow> pid \\<noteq> PID \\<or> PID \\<noteq> pid \\<or> (n < length (reviewsPaper (paper s PID)) \\<and> n \\<noteq> N)\n \\<Longrightarrow>\n getNthReview s pid n = getNthReview s1 pid n\"\n  unfolding eqExcPID_N_def\n  apply auto\n   apply (metis eeqExcPID_N_imp(2) getNthReview_def)\n  unfolding eeqExcPID_N_def apply simp unfolding eqExcD eqExcNth_def\n  by (metis getNthReview_def)\n\n\nlemma eqExcPID_N_imp3':\nassumes s: \"reach s\"\nand \"eqExcPID_N s s1\" and \"pid \\<noteq> PID \\<or> (isRevNth s cid uid pid n \\<and> n \\<noteq> N)\"\nshows \"getNthReview s pid n = getNthReview s1 pid n\"\nproof-\n  have \"isRevNth s cid uid pid n \\<Longrightarrow> pid \\<noteq> PID \\<or> n < length (reviewsPaper (paper s PID))\"\n  using s by (metis isRevNth_less_length)\n  thus ?thesis using eqExcPID_N_imp3 assms by auto\nqed\n\nlemma eqExcPID_N_RDD:\n\"eqExcPID_N s s1 \\<Longrightarrow>\n titlePaper (paper s PID) = titlePaper (paper s1 PID) \\<and>\n abstractPaper (paper s PID) = abstractPaper (paper s1 PID) \\<and>\n contentPaper (paper s PID) = contentPaper (paper s1 PID) \\<and>\n disPaper (paper s PID) = disPaper (paper s1 PID) \\<and>\n decsPaper (paper s PID) = decsPaper (paper s1 PID)\"\nusing eqExcPID_N_imp eeqExcPID_N_RDD by auto\n\nlemma eqExcPID_N_cong[simp, intro]:\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>confIDs := uu1\\<rparr>) (s1 \\<lparr>confIDs := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>conf := uu1\\<rparr>) (s1 \\<lparr>conf := uu2\\<rparr>)\"\n\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>userIDs := uu1\\<rparr>) (s1 \\<lparr>userIDs := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>pass := uu1\\<rparr>) (s1 \\<lparr>pass := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>user := uu1\\<rparr>) (s1 \\<lparr>user := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>roles := uu1\\<rparr>) (s1 \\<lparr>roles := uu2\\<rparr>)\"\n\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>paperIDs := uu1\\<rparr>) (s1 \\<lparr>paperIDs := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> eeqExcPID_N uu1 uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>paper := uu1\\<rparr>) (s1 \\<lparr>paper := uu2\\<rparr>)\"\n\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>pref := uu1\\<rparr>) (s1 \\<lparr>pref := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>voronkov := uu1\\<rparr>) (s1 \\<lparr>voronkov := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>news := uu1\\<rparr>) (s1 \\<lparr>news := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N (s \\<lparr>phase := uu1\\<rparr>) (s1 \\<lparr>phase := uu2\\<rparr>)\"\n\nunfolding eqExcPID_N_def by auto\n\nlemma eqExcPID_N_Paper:\nassumes s's1': \"eqExcPID_N s s1\"\nand \"paper s pid = Paper title abstract content reviews dis decs\"\nand \"paper s1 pid = Paper title1 abstract1 content1 reviews1 dis1 decs1\"\nshows \"title = title1 \\<and> abstract = abstract1 \\<and> content = content1 \\<and> dis = dis1 \\<and> decs = decs1\"\nusing assms unfolding eqExcPID_N_def apply (auto simp: eqExcD eeqExcPID_N_def)\nby (metis titlePaper.simps abstractPaper.simps contentPaper.simps disPaper.simps decsPaper.simps)+\n\ntext \\<open>Auxiliary definitions for a slightly weaker equivalence relation defined below:\\<close>\n\ndefinition eqExcNth2 where\n\"eqExcNth2 rl rl1 n \\<equiv>\n length rl = length rl1 \\<and>\n (\\<forall> i < length rl. i \\<noteq> n \\<longrightarrow> rl!i = rl1!i) \\<and>\n hd (rl!n) = hd (rl1!n)\"\n\nlemma eqExcNth2_eq[simp,intro!]: \"eqExcNth2 rl rl n\"\nunfolding eqExcNth2_def by auto\n\nlemma eqExcNth2_sym:\nassumes \"eqExcNth2 rl rl1 n\"\nshows \"eqExcNth2 rl1 rl n\"\nusing assms unfolding eqExcNth2_def by auto\n\nlemma eqExcNth2_trans:\nassumes \"eqExcNth2 rl rl1 n\" and \"eqExcNth2 rl1 rl2 n\"\nshows \"eqExcNth2 rl rl2 n\"\nusing assms unfolding eqExcNth2_def by auto\n\nfun eqExcD2 :: \"paper \\<Rightarrow> paper \\<Rightarrow> bool\" where\n\"eqExcD2 (Paper title abstract ct reviews dis decs)\n         (Paper title1 abstract1 ct1 reviews1 dis1 decs1) =\n (title = title1 \\<and> abstract = abstract1 \\<and> ct = ct1 \\<and> dis = dis1 \\<and> decs = decs1 \\<and>\n  eqExcNth2 reviews reviews1 N)\"\n\nlemma eqExcD2:\n\"eqExcD2 pap pap1 =\n (titlePaper pap = titlePaper pap1 \\<and> abstractPaper pap = abstractPaper pap1 \\<and>\n  contentPaper pap = contentPaper pap1 \\<and>\n  disPaper pap = disPaper pap1 \\<and> decsPaper pap = decsPaper pap1 \\<and>\n  eqExcNth2 (reviewsPaper pap) (reviewsPaper pap1) N)\"\nby(cases pap, cases pap1, auto)\n\nlemma eqExcD2_eq[simp,intro!]: \"eqExcD2 pap pap\"\nunfolding eqExcD2 using eqExcNth2_eq by auto\n\nlemma eqExcD2_sym:\nassumes \"eqExcD2 pap pap1\"\nshows \"eqExcD2 pap1 pap\"\nusing assms unfolding eqExcD2 using eqExcNth2_sym by auto\n\nlemma eqExcD2_trans:\nassumes \"eqExcD2 pap pap1\" and \"eqExcD2 pap1 pap2\"\nshows \"eqExcD2 pap pap2\"\nusing assms unfolding eqExcD2 using eqExcNth2_trans by auto\n\ndefinition eeqExcPID_N2 where\n\"eeqExcPID_N2 paps paps1 \\<equiv>\n \\<forall> pid. if pid = PID then eqExcD2 (paps pid) (paps1 pid) else paps pid = paps1 pid\"\n\nlemma eeqExcPID_N2_eeq[simp,intro!]: \"eeqExcPID_N2 s s\"\nunfolding eeqExcPID_N2_def by auto\n\nlemma eeqExcPID_N2_sym:\nassumes \"eeqExcPID_N2 s s1\" shows \"eeqExcPID_N2 s1 s\"\nusing assms eqExcD2_sym unfolding eeqExcPID_N2_def by auto\n\nlemma eeqExcPID_N2_trans:\nassumes \"eeqExcPID_N2 s s1\" and \"eeqExcPID_N2 s1 s2\" shows \"eeqExcPID_N2 s s2\"\nusing assms eqExcD2_trans unfolding eeqExcPID_N2_def by simp blast\n\nlemma eeqExcPID_N2_imp:\n\"eeqExcPID_N2 paps paps1 \\<Longrightarrow> eqExcD2 (paps PID) (paps1 PID)\"\n\"\\<lbrakk>eeqExcPID_N2 paps paps1; pid \\<noteq> PID\\<rbrakk> \\<Longrightarrow> paps pid = paps1 pid\"\nunfolding eeqExcPID_N2_def by auto\n\nlemma eeqExcPID_N2_cong:\nassumes \"eeqExcPID_N2 paps paps1\"\nand \"pid = PID \\<Longrightarrow> eqExcD2 uu uu1\"\nand \"pid \\<noteq> PID \\<Longrightarrow> uu = uu1\"\nshows \"eeqExcPID_N2 (paps (pid := uu)) (paps1(pid := uu1))\"\nusing assms unfolding eeqExcPID_N2_def by auto\n\nlemma eeqExcPID_N2_RDD:\n\"eeqExcPID_N2 paps paps1 \\<Longrightarrow>\n titlePaper (paps PID) = titlePaper (paps1 PID) \\<and>\n abstractPaper (paps PID) = abstractPaper (paps1 PID) \\<and>\n contentPaper (paps PID) = contentPaper (paps1 PID) \\<and>\n disPaper (paps PID) = disPaper (paps1 PID) \\<and>\n decsPaper (paps PID) = decsPaper (paps1 PID)\"\nusing eeqExcPID_N2_def unfolding eqExcD2 by auto\n\ntext \\<open>A weaker state equivalence that allows differences in old versions of the score and comments\nof the review \\<^term>\\<open>(N, PID)\\<close>.  It is used for the confidentiality property that does not cover\nPC members in the discussion phase, when they will learn about scores and comments.\\<close>\n\ndefinition eqExcPID_N2 :: \"state \\<Rightarrow> state \\<Rightarrow> bool\" where\n\"eqExcPID_N2 s s1 \\<equiv>\n confIDs s = confIDs s1 \\<and> conf s = conf s1 \\<and>\n userIDs s = userIDs s1 \\<and> pass s = pass s1 \\<and> user s = user s1 \\<and> roles s = roles s1 \\<and>\n paperIDs s = paperIDs s1\n \\<and>\n eeqExcPID_N2 (paper s) (paper s1)\n \\<and>\n pref s = pref s1 \\<and>\n voronkov s = voronkov s1 \\<and>\n news s = news s1 \\<and> phase s = phase s1\"\n\nlemma eqExcPID_N2_eq[simp,intro!]: \"eqExcPID_N2 s s\"\nunfolding eqExcPID_N2_def by auto\n\nlemma eqExcPID_N2_sym:\nassumes \"eqExcPID_N2 s s1\" shows \"eqExcPID_N2 s1 s\"\nusing assms eeqExcPID_N2_sym unfolding eqExcPID_N2_def by auto\n\nlemma eqExcPID_N2_trans:\nassumes \"eqExcPID_N2 s s1\" and \"eqExcPID_N2 s1 s2\" shows \"eqExcPID_N2 s s2\"\nusing assms eeqExcPID_N2_trans unfolding eqExcPID_N2_def by auto\n\ntext \\<open>Implications from \\<^term>\\<open>eqExcPID_N2\\<close>, including w.r.t. auxiliary operations:\\<close>\n\nlemma eqExcPID_N2_imp:\n\"eqExcPID_N2 s s1 \\<Longrightarrow>\n confIDs s = confIDs s1 \\<and> conf s = conf s1 \\<and>\n userIDs s = userIDs s1 \\<and> pass s = pass s1 \\<and> user s = user s1 \\<and> roles s = roles s1 \\<and>\n paperIDs s = paperIDs s1\n \\<and>\n eeqExcPID_N2 (paper s) (paper s1)\n \\<and>\n pref s = pref s1 \\<and>\n voronkov s = voronkov s1 \\<and>\n news s = news s1 \\<and> phase s = phase s1 \\<and>\n\n getAllPaperIDs s = getAllPaperIDs s1 \\<and>\n isRev s cid uid pid = isRev s1 cid uid pid \\<and>\n getReviewIndex s cid uid pid = getReviewIndex s1 cid uid pid \\<and>\n getRevRole s cid uid pid = getRevRole s1 cid uid pid \\<and>\n length (reviewsPaper (paper s pid)) = length (reviewsPaper (paper s1 pid))\"\nunfolding eqExcPID_N2_def getAllPaperIDs_def\nunfolding isRev_def getReviewIndex_def getRevRole_def apply auto\nunfolding eeqExcPID_N2_def eqExcD2 eqExcNth2_def by simp metis\n\nlemma eqExcPID_N2_imp1:\n\"eqExcPID_N2 s s1 \\<Longrightarrow> eqExcD2 (paper s pid) (paper s1 pid)\"\n\"eqExcPID_N2 s s1 \\<Longrightarrow> pid \\<noteq> PID \\<or> PID \\<noteq> pid \\<Longrightarrow>\n    paper s pid = paper s1 pid \\<and>\n    getNthReview s pid n = getNthReview s1 pid n\"\nunfolding eqExcPID_N2_def getNthReview_def eeqExcPID_N2_def\napply auto\nby (metis eqExcD2_eq)\n\nlemma eqExcPID_N2_imp2:\nassumes \"eqExcPID_N2 s s1\" and \"pid \\<noteq> PID \\<or> PID \\<noteq> pid\"\nshows \"getReviewersReviews s cid pid = getReviewersReviews s1 cid pid\"\nproof-\n  have\n  \"(\\<lambda>uID. if isRev s cid uID pid then [(uID, getNthReview s pid (getReviewIndex s cid uID pid))] else []) =\n   (\\<lambda>uID. if isRev s1 cid uID pid then [(uID, getNthReview s1 pid (getReviewIndex s1 cid uID pid))] else [])\"\n  apply(rule ext)\n  using assms by (auto simp: eqExcPID_N2_imp eqExcPID_N2_imp1)\n  thus ?thesis unfolding getReviewersReviews_def using assms by (simp add: eqExcPID_N2_imp)\nqed\n\nlemma eqExcPID_N2_eqExcPID_N:\n\"eqExcPID_N2 s s1 \\<Longrightarrow> eqExcPID_N s s1\"\nunfolding eqExcPID_N_def eqExcPID_N2_def eeqExcPID_N_def eeqExcPID_N2_def eqExcD2 eqExcD\nby (auto simp: eqExcNth_def eqExcNth2_def)\n\nlemma eqExcPID_N2_imp3:\n\"eqExcPID_N2 s s1 \\<Longrightarrow> pid \\<noteq> PID \\<or> PID \\<noteq> pid \\<or> (n < length (reviewsPaper (paper s PID)) \\<and> n \\<noteq> N)\n \\<Longrightarrow>\n getNthReview s pid n = getNthReview s1 pid n\"\nby (metis eqExcPID_N2_eqExcPID_N eqExcPID_N_imp3)\n\nlemma eqExcPID_N2_imp3':\nassumes s: \"reach s\"\nand \"eqExcPID_N2 s s1\" and \"pid \\<noteq> PID \\<or> (isRevNth s cid uid pid n \\<and> n \\<noteq> N)\"\nshows \"getNthReview s pid n = getNthReview s1 pid n\"\nby (metis assms eqExcPID_N2_eqExcPID_N eqExcPID_N_imp3')\n\nlemma eqExcPID_N2_imp33:\nassumes \"eqExcPID_N2 s s1\"\nshows \"hd (getNthReview s pid N) = hd (getNthReview s1 pid N)\"\nproof(cases \"pid = PID\")\n  case False thus ?thesis using eqExcPID_N2_imp3[OF assms] by auto\nnext\n  case True thus ?thesis apply simp\n  using assms unfolding eqExcPID_N2_def eeqExcPID_N2_def eqExcD2 eqExcNth2_def getNthReview_def by auto\nqed\n\n\nlemma eqExcPID_N2_RDD:\n\"eqExcPID_N2 s s1 \\<Longrightarrow>\n titlePaper (paper s PID) = titlePaper (paper s1 PID) \\<and>\n abstractPaper (paper s PID) = abstractPaper (paper s1 PID) \\<and>\n contentPaper (paper s PID) = contentPaper (paper s1 PID) \\<and>\n disPaper (paper s PID) = disPaper (paper s1 PID) \\<and>\n decsPaper (paper s PID) = decsPaper (paper s1 PID)\"\nusing eqExcPID_N2_imp eeqExcPID_N2_RDD by auto\n\nlemma eqExcPID_N2_cong[simp, intro]:\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>confIDs := uu1\\<rparr>) (s1 \\<lparr>confIDs := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>conf := uu1\\<rparr>) (s1 \\<lparr>conf := uu2\\<rparr>)\"\n\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>userIDs := uu1\\<rparr>) (s1 \\<lparr>userIDs := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>pass := uu1\\<rparr>) (s1 \\<lparr>pass := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>user := uu1\\<rparr>) (s1 \\<lparr>user := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>roles := uu1\\<rparr>) (s1 \\<lparr>roles := uu2\\<rparr>)\"\n\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>paperIDs := uu1\\<rparr>) (s1 \\<lparr>paperIDs := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> eeqExcPID_N2 uu1 uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>paper := uu1\\<rparr>) (s1 \\<lparr>paper := uu2\\<rparr>)\"\n\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>pref := uu1\\<rparr>) (s1 \\<lparr>pref := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>voronkov := uu1\\<rparr>) (s1 \\<lparr>voronkov := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>news := uu1\\<rparr>) (s1 \\<lparr>news := uu2\\<rparr>)\"\n\"\\<And> uu1 uu2. eqExcPID_N2 s s1 \\<Longrightarrow> uu1 = uu2 \\<Longrightarrow> eqExcPID_N2 (s \\<lparr>phase := uu1\\<rparr>) (s1 \\<lparr>phase := uu2\\<rparr>)\"\n\nunfolding eqExcPID_N2_def by auto\n\nlemma eqExcPID_N2_Paper:\nassumes s's1': \"eqExcPID_N2 s s1\"\nand \"paper s pid = Paper title abstract content reviews dis decs\"\nand \"paper s1 pid = Paper title1 abstract1 content1 reviews1 dis1 decs1\"\nshows \"title = title1 \\<and> abstract = abstract1 \\<and> content = content1 \\<and> dis = dis1 \\<and> decs = decs1\"\nusing assms unfolding eqExcPID_N2_def apply (auto simp: eqExcD2 eeqExcPID_N2_def)\nby (metis titlePaper.simps abstractPaper.simps contentPaper.simps disPaper.simps decsPaper.simps)+\n\n\n(* major *) lemma eqExcPID_N2_step:\nassumes ss1: \"eqExcPID_N2 s s1\"\nand step: \"step s a = (ou,s')\"\nand step1: \"step s1 a = (ou1,s1')\"\nand s: \"reach s\" and r: \"isRevNth s cid uid PID N\" (* new *)\nshows \"eqExcPID_N2 s' s1'\"\nproof -\n  note eqs = eqExcPID_N2_imp[OF ss1]\n  note eqs' = eqExcPID_N2_imp1[OF ss1]\n  have r: \"N < length (reviewsPaper (paper s PID))\" using s r by (metis isRevNth_less_length)\n  have r1: \"N < length (reviewsPaper (paper s1 PID))\"\n  using r eqs unfolding eeqExcPID_N2_def eqExcD2 eqExcNth2_def by simp\n\n  note simps[simp] = c_defs u_defs uu_defs r_defs l_defs Paper_dest_conv eqExcPID_N2_def eeqExcPID_N2_def eqExcD2 eqExcNth2_def\n  note * = step step1 eqs eqs' r r1\n\n  then show ?thesis\n  proof (cases a)\n    case (Cact x1)\n    with * show ?thesis\n    proof (cases x1)\n      case (cReview x81 x82 x83 x84 x85)\n      with Cact * show ?thesis\n        by (clarsimp; metis (no_types, lifting) less_SucE nth_append_length right_cons_left)\n    qed auto\n  next\n    case (Uact x2)\n    with * show ?thesis\n    proof (cases x2)\n      case (uReview x71 x72 x73 x74 x75 x76)\n      with Uact * show ?thesis\n        by (clarsimp; metis (no_types, lifting) nth_list_update nth_list_update_neq)\n    qed auto\n  next\n    case (UUact x3)\n    with * show ?thesis\n    proof (cases x3)\n      case (uuReview x31 x32 x33 x34 x35 x36)\n      with UUact * show ?thesis\n        by (clarsimp; smt list.sel(1) nth_list_update nth_list_update_neq)\n    qed auto\n  qed auto\nqed\n\n\nsubsection \\<open>Value Setup\\<close>\n\nfun \\<phi> :: \"(state,act,out) trans \\<Rightarrow> bool\" where\n\"\\<phi> (Trans _ (Uact (uReview cid uid p pid n rc)) ou _) =\n (pid = PID \\<and> n = N \\<and> ou = outOK)\"\n|\n\"\\<phi> (Trans _ (UUact (uuReview cid uid p pid n rc)) ou _) =\n (pid = PID \\<and> n = N \\<and> ou = outOK)\"\n|\n\"\\<phi> _ = False\"\n\nlemma \\<phi>_def2:\n\"\\<phi> (Trans s a ou s') =\n (ou = outOK \\<and>\n (\\<exists> cid uid p rc.\n     a = Uact (uReview cid uid p PID N rc)\n     \\<or>\n    a = UUact (uuReview cid uid p PID N rc)\n ))\"\n  apply(cases a)\n  subgoal by simp\n  subgoal for x2 apply (cases x2, auto) .\n  subgoal for x3  apply(cases x3, auto) .\n  by simp_all\n\nlemma uReview_uuReview_step_eqExcPID_N:\nassumes a:\n\"a = Uact (uReview cid uid p PID N rc) \\<or>\n a = UUact (uuReview cid uid p PID N rc)\"\nand \"step s a = (ou,s')\"\nshows \"eqExcPID_N s s'\"\nusing assms unfolding eqExcPID_N_def eeqExcPID_N_def by (auto simp: u_defs uu_defs eqExcNth_def)\n\nlemma \\<phi>_step_eqExcPID_N:\nassumes \\<phi>: \"\\<phi> (Trans s a ou s')\"\nand s: \"step s a = (ou,s')\"\nshows \"eqExcPID_N s s'\"\nusing \\<phi> uReview_uuReview_step_eqExcPID_N[OF _ s] unfolding \\<phi>_def2 by blast\n\n(* major *) lemma eqExcPID_N_step:\nassumes s's1': \"eqExcPID_N s s1\"\nand step: \"step s a = (ou,s')\"\nand step1: \"step s1 a = (ou1,s1')\"\nshows \"eqExcPID_N s' s1'\"\nproof -\n  note eqs = eqExcPID_N_imp[OF s's1']\n  note eqs' = eqExcPID_N_imp1[OF s's1']\n\n  note simps[simp] = c_defs u_defs uu_defs r_defs l_defs Paper_dest_conv eqExcPID_N_def eeqExcPID_N_def eqExcD eqExcNth_def\n  note * = step step1 eqs eqs'\n\n  then show ?thesis\n  proof (cases a)\n    case (Cact x1)\n    with * show ?thesis\n    proof (cases x1)\n      case (cReview x81 x82 x83 x84 x85)\n      with Cact * show ?thesis\n        by (clarsimp; metis (no_types, lifting) less_SucE nth_append_length right_cons_left)\n    qed auto\n  next\n    case (Uact x2)\n    with * show ?thesis\n    proof (cases x2)\n      case (uReview x71 x72 x73 x74 x75 x76)\n      with Uact * show ?thesis\n        by (clarsimp; metis (no_types, lifting) nth_list_update nth_list_update_neq)\n    qed auto\n  next\n    case (UUact x3)\n    with * show ?thesis\n    proof (cases x3)\n      case (uuReview x31 x32 x33 x34 x35 x36)\n      with UUact * show ?thesis\n        by (clarsimp; metis (no_types, lifting) nth_list_update nth_list_update_neq)\n    qed auto\n  qed auto\nqed\n\nlemma eqExcPID_N_step_\\<phi>_imp:\nassumes ss1: \"eqExcPID_N s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand \\<phi>: \"\\<phi> (Trans s a ou s')\"\nshows \"\\<phi> (Trans s1 a ou1 s1')\"\nusing assms unfolding \\<phi>_def2 by (auto simp add: u_defs uu_defs eqExcPID_N_imp)\n\nlemma eqExcPID_N_step_\\<phi>:\nassumes s's1': \"eqExcPID_N s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nshows \"\\<phi> (Trans s a ou s') = \\<phi> (Trans s1 a ou1 s1')\"\nby (metis eqExcPID_N_step_\\<phi>_imp eqExcPID_N_sym assms)\n\nlemma eqExcPID_N2_step_\\<phi>_imp:\nassumes ss1: \"eqExcPID_N2 s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nand r: \"N < length (reviewsPaper (paper s PID))\" (* new *)\nand \\<phi>: \"\\<phi> (Trans s a ou s')\"\nshows \"\\<phi> (Trans s1 a ou1 s1')\"\nusing assms unfolding \\<phi>_def2 by (auto simp add: u_defs uu_defs eqExcPID_N2_imp)\n\n(* More complex, roundabout proof than for other types of documents: *)\nlemma eqExcPID_N2_step_\\<phi>:\nassumes s: \"reach s\" and s1: \"reach s1\"\nand ss1: \"eqExcPID_N2 s s1\"\nand step: \"step s a = (ou,s')\" and step1: \"step s1 a = (ou1,s1')\"\nshows \"\\<phi> (Trans s a ou s') = \\<phi> (Trans s1 a ou1 s1')\"\nproof(cases \"\\<exists> cid uid. isRevNth s cid uid PID N\")\n  case False\n  hence \"\\<not> \\<phi> (Trans s a ou s')\" unfolding \\<phi>_def2 using step\n  by (auto simp add: u_defs uu_defs) (metis isRev_imp_isRevNth_getReviewIndex)+\n  moreover have \"\\<not> \\<phi> (Trans s1 a ou1 s1')\" using step1 False unfolding \\<phi>_def2\n  by (auto simp add: u_defs uu_defs) (metis eqExcPID_N2_def isRev_imp_isRevNth_getReviewIndex ss1)+\n  ultimately show ?thesis by auto\nnext\n  case True note r = True\n  note eqs = eqExcPID_N2_imp[OF ss1]\n  have r: \"N < length (reviewsPaper (paper s PID))\"\n  using isRevNth_less_length[OF s] r by auto\n  have r1: \"N < length (reviewsPaper (paper s1 PID))\"\n  using eqs r unfolding eeqExcPID_N2_def eqExcD2 eqExcNth2_def by simp\n  thus ?thesis by (metis eqExcPID_N2_step_\\<phi>_imp eqExcPID_N2_sym assms r)\nqed\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoCon/Review_Confidentiality/Review_Value_Setup.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011397337391, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3289301113998058}}
{"text": "section \\<open>Deterministic Co-Büchi Automata Combinations\\<close>\n\ntheory DCA_Combine\nimports DCA DGCA\nbegin\n\n  global_interpretation degeneralization: automaton_degeneralization_run\n    dgca dgca.alphabet dgca.initial dgca.transition dgca.rejecting \"\\<lambda> P w r p. cogen fins P (p ## r)\"\n    dca dca.alphabet dca.initial dca.transition dca.rejecting \"\\<lambda> P w r p. fins P (p ## r)\"\n    fst id\n    defines degeneralize = degeneralization.degeneralize\n    by (unfold_locales) (auto simp flip: sscan_smap)\n\n  lemmas degeneralize_language[simp] = degeneralization.degeneralize_language[folded DCA.language_def]\n  lemmas degeneralize_nodes_finite[iff] = degeneralization.degeneralize_nodes_finite[folded DCA.nodes_def]\n  lemmas degeneralize_nodes_card = degeneralization.degeneralize_nodes_card[folded DCA.nodes_def]\n\n  global_interpretation intersection: automaton_intersection_run\n    dca.dca dca.alphabet dca.initial dca.transition dca.rejecting \"\\<lambda> P w r p. fins P (p ## r)\"\n    dca.dca dca.alphabet dca.initial dca.transition dca.rejecting \"\\<lambda> P w r p. fins P (p ## r)\"\n    dca.dca dca.alphabet dca.initial dca.transition dca.rejecting \"\\<lambda> P w r p. fins P (p ## r)\"\n    \"\\<lambda> c\\<^sub>1 c\\<^sub>2 pq. (c\\<^sub>1 \\<circ> fst) pq \\<or> (c\\<^sub>2 \\<circ> snd) pq\"\n    defines intersect = intersection.product\n    by (unfold_locales) (simp del: comp_apply)\n\n  lemmas intersect_language = intersection.product_language\n  lemmas intersect_nodes_finite = intersection.product_nodes_finite\n  lemmas intersect_nodes_card = intersection.product_nodes_card\n\n  global_interpretation union: automaton_union_run\n    dca.dca dca.alphabet dca.initial dca.transition dca.rejecting \"\\<lambda> P w r p. fins P (p ## r)\"\n    dca.dca dca.alphabet dca.initial dca.transition dca.rejecting \"\\<lambda> P w r p. fins P (p ## r)\"\n    dgca.dgca dgca.alphabet dgca.initial dgca.transition dgca.rejecting \"\\<lambda> P w r p. cogen fins P (p ## r)\"\n    \"\\<lambda> c\\<^sub>1 c\\<^sub>2. [c\\<^sub>1 \\<circ> fst, c\\<^sub>2 \\<circ> snd]\"\n    defines union' = union.product\n    by unfold_locales auto\n\n  lemmas union'_language[simp] = union.product_language[folded DGCA.language_def]\n  lemmas union'_nodes_finite = union.product_nodes_finite[folded DGCA.nodes_def]\n  lemmas union'_nodes_card = union.product_nodes_card[folded DGCA.nodes_def]\n\n  global_interpretation intersection_list: automaton_intersection_list_run\n    dca.dca dca.alphabet dca.initial dca.transition dca.rejecting \"\\<lambda> P w r p. fins P (p ## r)\"\n    dca.dca dca.alphabet dca.initial dca.transition dca.rejecting \"\\<lambda> P w r p. fins P (p ## r)\"\n    \"\\<lambda> cs pp. \\<exists> k < length cs. (cs ! k) (pp ! k)\"\n    defines intersect_list = intersection_list.product\n    by (unfold_locales) (simp add: comp_def)\n\n  lemmas intersect_list_language = intersection_list.product_language\n  lemmas intersect_list_nodes_finite = intersection_list.product_nodes_finite\n  lemmas intersect_list_nodes_card = intersection_list.product_nodes_card\n\n  global_interpretation union_list: automaton_union_list_run\n    dca.dca dca.alphabet dca.initial dca.transition dca.rejecting \"\\<lambda> P w r p. fins P (p ## r)\"\n    dgca.dgca dgca.alphabet dgca.initial dgca.transition dgca.rejecting \"\\<lambda> P w r p. cogen fins P (p ## r)\"\n    \"\\<lambda> cs. map (\\<lambda> k pp. (cs ! k) (pp ! k)) [0 ..< length cs]\"\n    defines union_list' = union_list.product\n    by (unfold_locales) (auto simp: cogen_def comp_def)\n\n  lemmas union_list'_language[simp] = union_list.product_language[folded DGCA.language_def]\n  lemmas union_list'_nodes_finite = union_list.product_nodes_finite[folded DGCA.nodes_def]\n  lemmas union_list'_nodes_card = union_list.product_nodes_card[folded DGCA.nodes_def]\n\n  abbreviation union where \"union A B \\<equiv> degeneralize (union' A B)\"\n\n  lemma union_language[simp]:\n    assumes \"dca.alphabet A = dca.alphabet B\"\n    shows \"DCA.language (union A B) = DCA.language A \\<union> DCA.language B\"\n    using assms by simp\n  lemma union_nodes_finite:\n    assumes \"finite (DCA.nodes A)\" \"finite (DCA.nodes B)\"\n    shows \"finite (DCA.nodes (union A B))\"\n    using union'_nodes_finite assms by simp\n  lemma union_nodes_card:\n    assumes \"finite (DCA.nodes A)\" \"finite (DCA.nodes B)\"\n    shows \"card (DCA.nodes (union A B)) \\<le> 2 * card (DCA.nodes A) * card (DCA.nodes B)\"\n  proof -\n    have \"card (DCA.nodes (union A B)) \\<le>\n      max 1 (length (dgca.rejecting (union' A B))) * card (DGCA.nodes (union' A B))\"\n      using degeneralize_nodes_card by this\n    also have \"length (dgca.rejecting (union' A B)) = 2\" by simp\n    also have \"card (DGCA.nodes (union' A B)) \\<le> card (DCA.nodes A) * card (DCA.nodes B)\"\n      using union'_nodes_card assms by this\n    finally show ?thesis by simp\n  qed\n\n  abbreviation union_list where \"union_list AA \\<equiv> degeneralize (union_list' AA)\"\n\n  lemma union_list_language[simp]:\n    assumes \"\\<Inter> (dca.alphabet ` set AA) = \\<Union> (dca.alphabet ` set AA)\"\n    shows \"DCA.language (union_list AA) = \\<Union> (DCA.language ` set AA)\"\n    using assms by simp\n  lemma union_list_nodes_finite:\n    assumes \"list_all (finite \\<circ> DCA.nodes) AA\"\n    shows \"finite (DCA.nodes (union_list AA))\"\n    using union_list'_nodes_finite assms by simp\n  lemma union_list_nodes_card:\n    assumes \"list_all (finite \\<circ> DCA.nodes) AA\"\n    shows \"card (DCA.nodes (union_list AA)) \\<le> max 1 (length AA) * prod_list (map (card \\<circ> DCA.nodes) AA)\"\n  proof -\n    have \"card (DCA.nodes (union_list AA)) \\<le>\n      max 1 (length (dgca.rejecting (union_list' AA))) * card (DGCA.nodes (union_list' AA))\"\n      using degeneralize_nodes_card by this\n    also have \"length (dgca.rejecting (union_list' AA)) = length AA\" by simp\n    also have \"card (DGCA.nodes (union_list' AA)) \\<le> prod_list (map (card \\<circ> DCA.nodes) AA)\"\n      using union_list'_nodes_card assms by this\n    finally show ?thesis by simp\n  qed\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Transition_Systems_and_Automata/Automata/DCA/DCA_Combine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.32879269837837494}}
{"text": "theory Refine_Invar\n  imports\n    Refine_Unions\n    Refine_Intersection\nbegin\n\nconsts i_invar::\"interface \\<Rightarrow> interface \\<Rightarrow> interface\"\n\ndefinition [simp]: \"uninvar X = X\"\n\ndefinition with_invar::\"'invar \\<Rightarrow> 'a set \\<Rightarrow> 'a set\"\n  where [simp]: \"with_invar i X = X\"\n\ndefinition get_invar::\"('invar \\<Rightarrow> 'a set) \\<Rightarrow> 'a set \\<Rightarrow> ('a set \\<times> 'invar) nres\"\n  where [refine_vcg_def]: \"get_invar a X = SPEC (\\<lambda>(Y, invar). Y = X \\<and> Y \\<subseteq> a invar)\"\nlemma get_invar_pat[autoref_op_pat_def]: \"get_invar i \\<equiv> Autoref_Tagging.OP (get_invar i)\"\n  by auto\n\ndefinition split_with_invar::\"('c \\<Rightarrow> 'a set) \\<Rightarrow> 'a set \\<Rightarrow> (('a set \\<times> 'c) \\<times> 'a set) nres\"\n  where [refine_vcg_def]: \"split_with_invar i X = SPEC (\\<lambda>((Y, sctn), YS). X = Y \\<union> YS \\<and> Y \\<subseteq> i sctn)\"\nlemma split_with_invar_pat[autoref_op_pat_def]:\n  \"split_with_invar i \\<equiv> Autoref_Tagging.OP (split_with_invar i)\"\n  by auto\n\ncontext includes autoref_syntax begin\n\ndefinition invar_rel_internal:\n  \"invar_rel a X S = {((x, s'), y). \\<exists>s. (s', s) \\<in> X \\<and> (x, y) \\<in> S \\<and> y \\<subseteq> a s}\"\nlemma invar_rel_def: \"\\<langle>X, S\\<rangle>invar_rel a = {((x, s'), y). \\<exists>s. (s', s) \\<in> X \\<and> (x, y) \\<in> S \\<and> y \\<subseteq> a s}\"\n  by (auto simp: invar_rel_internal relAPP_def)\nlemmas [autoref_rel_intf] = REL_INTFI[of \"invar_rel a\" i_invar for a]\n\nlemma invar_rel_br: \"\\<langle>(br a' I'), (br a I)\\<rangle>invar_rel b =\n  br (\\<lambda>(x, s). a x) (\\<lambda>(x, s). I x \\<and> I' s \\<and> (a x \\<subseteq> b (a' s)))\"\n  by (auto simp: invar_rel_def br_def)\n\nlemma sv_appr_invar_rel[relator_props]: \"single_valued S \\<Longrightarrow> single_valued (\\<langle>X, S\\<rangle>invar_rel a)\"\n  and sv_inter_rel[relator_props]: \"single_valued S \\<Longrightarrow> single_valued T \\<Longrightarrow> single_valued (\\<langle>T, S\\<rangle>inter_rel)\"\n  unfolding relAPP_def\n   apply (auto simp: invar_rel_internal inter_rel_internal single_valued_def set_rel_def)\n     apply blast\n    apply blast\n  done\n\nlemma with_invar_impl[autoref_rules]:\n  assumes \"(sctni, sctn) \\<in> S\"\n  assumes \"(Xi, X) \\<in> clw_rel A\"\n  assumes \"PREFER single_valued A\"\n  assumes \"SIDE_PRECOND (X \\<subseteq> a sctn)\"\n  shows \"(map (\\<lambda>x. (x, sctni)) Xi, with_invar $ sctn $ X) \\<in> clw_rel (\\<langle>S,A\\<rangle>invar_rel a)\"\n  unfolding autoref_tag_defs\n  using assms\n  apply (auto simp: clw_rel_def elim!: single_valued_as_brE)\n  subgoal for a i Y Z\n    apply (rule relcompI)\n    apply (force simp: lw_rel_def br_def)\n    apply (rule relcompI[where b=Z])\n    apply (auto simp: set_rel_def lw_rel_def invar_rel_def br_def)\n    apply (metis Sup_le_iff)\n    apply (metis Sup_le_iff)\n    done\n  done\n\nlemma get_invar_autoref[autoref_rules]:\n  \"(\\<lambda>x. RETURN x, get_invar a) \\<in> \\<langle>X, S\\<rangle>invar_rel a \\<rightarrow> \\<langle>S \\<times>\\<^sub>r X\\<rangle>nres_rel\"\n  by (force simp: get_invar_def invar_rel_def nres_rel_def intro!: RETURN_SPEC_refine)\n\nlemma uninvar_autoref[autoref_rules]:\n  assumes \"PREFER single_valued A\"\n  assumes \"PREFER single_valued X\"\n  shows \"(map fst, uninvar) \\<in> clw_rel (\\<langle>X, A\\<rangle>invar_rel b) \\<rightarrow> clw_rel A\"\n  using assms\n  by (force simp: lw_rel_def Union_rel_br invar_rel_br elim!: single_valued_as_brE\n      dest!: brD\n      intro!: brI)\n\nabbreviation \"splitbysndimpl xs \\<equiv> do {\n  let s = snd (hd xs);\n  let (ys, zs) = List.partition (\\<lambda>(_, sctn). sctn = s) xs;\n  RETURN ((map fst ys, s), zs)\n}\"\n\nlemma split_with_invar_autoref[autoref_rules]:\n  assumes \"PREFER single_valued A\"\n  assumes \"PREFER single_valued S\"\n  assumes \"(xs, X) \\<in> clw_rel (\\<langle>S, A\\<rangle>invar_rel a)\"\n  shows\n    \"(if xs \\<noteq> [] then do { ((xs, sctn), ys) \\<leftarrow> splitbysndimpl xs; RETURN ((xs, sctn), ys) } else SUCCEED,\n    split_with_invar a $ X) \\<in>\n    \\<langle>(clw_rel A \\<times>\\<^sub>r S) \\<times>\\<^sub>r clw_rel (\\<langle>S, A\\<rangle>invar_rel a)\\<rangle>nres_rel\"\n  using assms\n  by (fastforce simp: Let_def split_with_invar_def split_beta'\n      lw_rel_def Union_rel_br ex_br_conj_iff invar_rel_br\n      elim!: single_valued_as_brE\n      intro!: nres_relI RETURN_SPEC_refine\n      dest!: brD)\n\nend\n\ndefinition\n  \"explicit_sctn_set po X0 =\n    do {\n      e \\<leftarrow> isEmpty_spec X0;\n      (_, _, Xis) \\<leftarrow> WHILE\\<^bsup>\\<lambda>(e, X, Y).\n          (e \\<longrightarrow> X = {}) \\<and>\n          X0 = X \\<union> (\\<Union>(sctn, IS)\\<in>Y. IS) \\<and>\n          (\\<forall>(sctn, IS) \\<in> Y. IS \\<subseteq> po sctn)\\<^esup>\n        (\\<lambda>(e, X, Y). \\<not>e)\n        (\\<lambda>(e, X, Y).\n          do {\n            ((S, sctn), X') \\<leftarrow> split_with_invar po X;\n            e \\<leftarrow> isEmpty_spec X';\n            RETURN (e, X', insert (sctn, S) Y)\n          }\n        )\n        (e,\n          X0,\n          {});\n      RETURN Xis\n    }\"\nlemma explicit_sctn_set_pat[autoref_op_pat_def]: \"explicit_sctn_set po \\<equiv> Autoref_Tagging.OP (explicit_sctn_set po)\"\n  by auto\n\ncontext includes autoref_syntax begin\n\nlemma pfi: \"PREFER single_valued R \\<Longrightarrow> ((#), OP insert ::: R \\<rightarrow> \\<langle>R\\<rangle>list_wset_rel \\<rightarrow> \\<langle>R\\<rangle>list_wset_rel) \\<in> R \\<rightarrow> \\<langle>R\\<rangle>list_wset_rel \\<rightarrow> \\<langle>R\\<rangle>list_wset_rel\"\n  using list_set_autoref_insert[of R]\n  by auto\n\nschematic_goal explicit_sctn_setc:\n  fixes po :: \"'d \\<Rightarrow> 'a::executable_euclidean_space set\"\n  assumes [THEN PREFER_sv_D, relator_props]: \"PREFER single_valued A\"\n  assumes [THEN PREFER_sv_D, relator_props]: \"PREFER single_valued S\"\n  assumes [autoref_rules]: \"(XSi, XS) \\<in> clw_rel (\\<langle>S, A\\<rangle>invar_rel po)\"\n  shows \"(nres_of ?f, explicit_sctn_set po $ XS) \\<in> \\<langle>\\<langle>S \\<times>\\<^sub>r clw_rel A\\<rangle>list_wset_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding explicit_sctn_set_def\n  by autoref_monadic\n\nconcrete_definition explicit_sctn_setc for XSi uses explicit_sctn_setc\nlemmas [autoref_rules] = explicit_sctn_setc.refine\n\nlemma explicit_sctn_set[THEN order_trans, refine_vcg]:\n  \"explicit_sctn_set po X \\<le> SPEC (\\<lambda>R. X = (\\<Union>(sctn, IS) \\<in> R. IS) \\<and> (\\<forall>(sctn, IS) \\<in> R. IS \\<subseteq> po sctn))\"\n  unfolding explicit_sctn_set_def\n  by (refine_vcg) (auto simp: split_beta' subset_iff)\nend\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Ordinary_Differential_Equations/Refinement/Refine_Invar.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.32879269837837494}}
{"text": "section \\<open>Sequential pattern matching\\<close>\n\ntheory Rewriting_Sterm\nimports Rewriting_Pterm\nbegin\n\ntype_synonym srule = \"name \\<times> sterm\"\n\nabbreviation closed_srules :: \"srule list \\<Rightarrow> bool\" where\n\"closed_srules \\<equiv> list_all (closed \\<circ> snd)\"\n\nprimrec srule :: \"srule \\<Rightarrow> bool\" where\n\"srule (_, rhs) \\<longleftrightarrow> wellformed rhs \\<and> closed rhs \\<and> is_abs rhs\"\n\nlemma sruleI[intro!]: \"wellformed rhs \\<Longrightarrow> closed rhs \\<Longrightarrow> is_abs rhs \\<Longrightarrow> srule (name, rhs)\"\nby simp\n\nlocale srules = constants C_info \"fst |`| fset_of_list rs\" for C_info and rs :: \"srule list\" +\n  assumes all_rules: \"list_all srule rs\"\n  assumes distinct: \"distinct (map fst rs)\"\n  assumes not_shadows: \"list_all (\\<lambda>(_, rhs). \\<not> shadows_consts rhs) rs\"\n  assumes swelldefined_rs: \"list_all (\\<lambda>(_, rhs). welldefined rhs) rs\"\nbegin\n\nlemma map: \"is_map (set rs)\"\nusing distinct by (rule distinct_is_map)\n\nlemma clausesE:\n  assumes \"(name, rhs) \\<in> set rs\"\n  obtains cs where \"rhs = Sabs cs\"\nproof -\n  from assms have \"is_abs rhs\"\n    using all_rules unfolding list_all_iff by auto\n  then obtain cs where \"rhs = Sabs cs\"\n    by (cases rhs) (auto simp: is_abs_def term_cases_def)\n  with that show thesis .\nqed\n\nend\n\nsubsubsection \\<open>Rewriting\\<close>\n\ninductive srewrite_step where\ncons_match: \"srewrite_step ((name, rhs) # rest) name rhs\" |\ncons_nomatch: \"name \\<noteq> name' \\<Longrightarrow> srewrite_step rs name rhs \\<Longrightarrow> srewrite_step ((name', rhs') # rs) name rhs\"\n\nlemma srewrite_stepI0:\n  assumes \"(name, rhs) \\<in> set rs\" \"is_map (set rs)\"\n  shows \"srewrite_step rs name rhs\"\nusing assms proof (induction rs)\n  case (Cons r rs)\n  then obtain name' rhs' where \"r = (name', rhs')\" by force\n  show ?case\n    proof (cases \"name = name'\")\n      case False\n      show ?thesis\n        unfolding \\<open>r = _\\<close>\n        apply (rule srewrite_step.cons_nomatch)\n        subgoal by fact\n        apply (rule Cons)\n        using False Cons(2) \\<open>r = _\\<close> apply force\n        using Cons(3) unfolding is_map_def by auto\n    next\n      case True\n      have \"rhs = rhs'\"\n        apply (rule is_mapD)\n          apply fact\n        unfolding \\<open>r = _\\<close>\n        using Cons(2) \\<open>r = _\\<close> apply simp\n        using True apply simp\n        done\n      show ?thesis\n        unfolding \\<open>r = _\\<close> \\<open>name = _\\<close> \\<open>rhs = _\\<close>\n        by (rule srewrite_step.cons_match)\n    qed\nqed auto\n\nlemma (in srules) srewrite_stepI: \"(name, rhs) \\<in> set rs \\<Longrightarrow> srewrite_step rs name rhs\"\nusing map\nby (metis srewrite_stepI0)\n\nhide_fact srewrite_stepI0\n\ninductive srewrite :: \"srule list \\<Rightarrow> sterm \\<Rightarrow> sterm \\<Rightarrow> bool\" (\"_/ \\<turnstile>\\<^sub>s/ _ \\<longrightarrow>/ _\" [50,0,50] 50) for rs where\nstep: \"srewrite_step rs name rhs \\<Longrightarrow> rs \\<turnstile>\\<^sub>s Sconst name \\<longrightarrow> rhs\" |\nbeta: \"rewrite_first cs t t' \\<Longrightarrow> rs \\<turnstile>\\<^sub>s Sabs cs $\\<^sub>s t \\<longrightarrow> t'\" |\n\"fun\": \"rs \\<turnstile>\\<^sub>s t \\<longrightarrow> t' \\<Longrightarrow> rs \\<turnstile>\\<^sub>s t $\\<^sub>s u \\<longrightarrow> t' $\\<^sub>s u\" |\narg: \"rs \\<turnstile>\\<^sub>s u \\<longrightarrow> u' \\<Longrightarrow> rs \\<turnstile>\\<^sub>s t $\\<^sub>s u \\<longrightarrow> t $\\<^sub>s u'\"\n\ncode_pred srewrite .\n\nabbreviation srewrite_rt :: \"srule list \\<Rightarrow> sterm \\<Rightarrow> sterm \\<Rightarrow> bool\" (\"_/ \\<turnstile>\\<^sub>s/ _ \\<longrightarrow>*/ _\" [50,0,50] 50) where\n\"srewrite_rt rs \\<equiv> (srewrite rs)\\<^sup>*\\<^sup>*\"\n\nglobal_interpretation srewrite: rewriting \"srewrite rs\" for rs\nby standard (auto intro: srewrite.intros simp: app_sterm_def)+\n\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) srewrite_step .\ncode_pred (modes: i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool) srewrite .\n\nsubsubsection \\<open>Translation from @{typ pterm} to @{typ sterm}\\<close>\n\ntext \\<open>\n  In principle, any function of type @{typ \\<open>('a \\<times> 'b) fset \\<Rightarrow> ('a \\<times> 'b) list\\<close>} that orders\n  by keys would do here. However, For simplicity's sake, we choose a fixed one\n  (@{const ordered_fmap}) here.\n\\<close>\n\nprimrec pterm_to_sterm :: \"pterm \\<Rightarrow> sterm\" where\n\"pterm_to_sterm (Pconst name) = Sconst name\" |\n\"pterm_to_sterm (Pvar name) = Svar name\" |\n\"pterm_to_sterm (t $\\<^sub>p u) = pterm_to_sterm t $\\<^sub>s pterm_to_sterm u\" |\n\"pterm_to_sterm (Pabs cs) = Sabs (ordered_fmap (map_prod id pterm_to_sterm |`| cs))\"\n\nlemma pterm_to_sterm:\n  assumes \"no_abs t\"\n  shows \"pterm_to_sterm t = convert_term t\"\nusing assms proof induction\n  case (free name)\n  show ?case\n    apply simp\n    apply (simp add: free_sterm_def free_pterm_def)\n    done\nnext\n  case (const name)\n  show ?case\n    apply simp\n    apply (simp add: const_sterm_def const_pterm_def)\n    done\nnext\n  case (app t\\<^sub>1 t\\<^sub>2)\n  then show ?case\n    apply simp\n    apply (simp add: app_sterm_def app_pterm_def)\n    done\nqed\n\ntext \\<open>\n  @{const sterm_to_pterm} has to be defined, for technical reasons, in\n  @{theory CakeML_Codegen.Pterm}.\n\\<close>\n\nlemma pterm_to_sterm_wellformed:\n  assumes \"wellformed t\"\n  shows \"wellformed (pterm_to_sterm t)\"\nusing assms proof (induction t rule: pterm_induct)\n  case (Pabs cs)\n  show ?case\n    apply simp\n    unfolding map_prod_def id_apply\n    apply (intro conjI)\n    subgoal\n      apply (subst list_all_iff_fset)\n      apply (subst ordered_fmap_set_eq)\n       apply (rule is_fmap_image)\n      using Pabs apply simp\n      apply (rule fBallI)\n      apply (erule fimageE)\n      apply auto[]\n      using Pabs(2) apply auto[]\n      apply (rule Pabs)\n      using Pabs(2) by auto\n    subgoal\n      apply (rule ordered_fmap_distinct)\n      apply (rule is_fmap_image)\n      using Pabs(2) by simp\n    subgoal\n      apply (subgoal_tac \"cs \\<noteq> {||}\")\n      including fset.lifting apply transfer\n      unfolding ordered_map_def\n      using Pabs(2) by auto\n    done\nqed auto\n\nlemma pterm_to_sterm_sterm_to_pterm:\n  assumes \"wellformed t\"\n  shows \"sterm_to_pterm (pterm_to_sterm t) = t\"\nusing assms proof (induction t)\n  case (Pabs cs)\n  note fset_of_list_map[simp del]\n  show ?case\n    apply simp\n    unfolding map_prod_def id_apply\n    apply (subst ordered_fmap_image)\n    subgoal\n      apply (rule is_fmap_image)\n      using Pabs by simp\n    apply (subst ordered_fmap_set_eq)\n    subgoal\n      apply (rule is_fmap_image)\n      apply (rule is_fmap_image)\n      using Pabs by simp\n    subgoal\n      apply (subst fset.map_comp)\n      apply (subst map_prod_def[symmetric])+\n      unfolding o_def\n      apply (subst prod.map_comp)\n      apply (subst id_def[symmetric])+\n      apply simp\n      apply (subst map_prod_def)\n      unfolding id_def\n      apply (rule fset_map_snd_id)\n      apply simp\n      apply (rule Pabs)\n      using Pabs(2) by (auto simp: fmember.rep_eq snds.simps)\n    done\nqed auto\n\ncorollary pterm_to_sterm_frees: \"wellformed t \\<Longrightarrow> frees (pterm_to_sterm t) = frees t\"\nby (metis pterm_to_sterm_sterm_to_pterm sterm_to_pterm_frees)\n\ncorollary pterm_to_sterm_closed:\n  \"closed_except t S \\<Longrightarrow> wellformed t \\<Longrightarrow> closed_except (pterm_to_sterm t) S\"\nunfolding closed_except_def\nby (simp add: pterm_to_sterm_frees)\n\ncorollary pterm_to_sterm_consts: \"wellformed t \\<Longrightarrow> consts (pterm_to_sterm t) = consts t\"\nby (metis pterm_to_sterm_sterm_to_pterm sterm_to_pterm_consts)\n\ncorollary (in constants) pterm_to_sterm_shadows:\n  \"wellformed t \\<Longrightarrow> shadows_consts t \\<longleftrightarrow> shadows_consts (pterm_to_sterm t)\"\nunfolding shadows_consts_def\nby (metis pterm_to_sterm_sterm_to_pterm sterm_to_pterm_all_frees)\n\ndefinition compile :: \"prule fset \\<Rightarrow> srule list\" where\n\"compile rs = ordered_fmap (map_prod id pterm_to_sterm |`| rs)\"\n\nsubsubsection \\<open>Correctness of translation\\<close>\n\ncontext prules begin\n\nlemma compile_heads: \"fst |`| fset_of_list (compile rs) = fst |`| rs\"\n  unfolding compile_def\n  apply (subst ordered_fmap_set_eq)\n   apply (subst map_prod_def, subst id_apply)\n   apply (rule is_fmap_image)\n   apply (rule fmap)\n  apply simp\n  done\n\nlemma compile_rules: \"srules C_info (compile rs)\"\nproof\n  show \"list_all srule (compile rs)\"\n    using fmap all_rules\n    unfolding compile_def list_all_iff\n    including fset.lifting\n    apply transfer\n    apply (subst ordered_map_set_eq)\n    subgoal by simp\n    subgoal\n      unfolding map_prod_def id_def\n      by (erule is_map_image)\n    subgoal\n      apply (rule ballI)\n      apply safe\n      subgoal\n        apply (rule pterm_to_sterm_wellformed)\n        apply fastforce\n        done\n      subgoal\n        apply (rule pterm_to_sterm_closed)\n         apply fastforce\n        apply fastforce\n        done\n      subgoal for _ _ a b\n        apply (erule ballE[where x = \"(a, b)\"])\n         apply (cases b; auto)\n            apply (auto simp: is_abs_def term_cases_def)\n        done\n      done\n    done\nnext\n  show \"distinct (map fst (compile rs))\"\n    unfolding compile_def\n    apply (rule ordered_fmap_distinct)\n    unfolding map_prod_def id_def\n    apply (rule is_fmap_image)\n    apply (rule fmap)\n    done\nnext\n  have \"list_all (\\<lambda>(_, rhs). welldefined rhs) (compile rs)\"\n    unfolding compile_def\n    apply (subst ordered_fmap_list_all)\n    subgoal\n      apply (subst map_prod_def)\n      apply (subst id_apply)\n      apply (rule is_fmap_image)\n      by (fact fmap)\n    apply simp\n    apply (rule fBallI)\n    subgoal for x\n      apply (cases x, simp)\n      apply (subst pterm_to_sterm_consts)\n      using all_rules apply force\n      using welldefined_rs by force\n    done\n  thus \"list_all (\\<lambda>(_, rhs). consts rhs |\\<subseteq>| pre_constants.all_consts C_info (fst |`| fset_of_list (compile rs))) (compile rs)\"\n    by (simp add: compile_heads)\nnext\n  interpret c: constants _ \"fset_of_list (map fst (compile rs))\"\n    by (simp add: constants_axioms compile_heads)\n  have all_consts: \"c.all_consts = all_consts\"\n    by (simp add: compile_heads)\n\n  note fset_of_list_map[simp del]\n  have \"list_all (\\<lambda>(_, rhs). \\<not> shadows_consts rhs) (compile rs)\"\n    unfolding compile_def\n    apply (subst list_all_iff_fset)\n    apply (subst ordered_fmap_set_eq)\n     apply (subst map_prod_def)\n    unfolding id_apply\n     apply (rule is_fmap_image)\n     apply (fact fmap)\n    apply simp\n    apply (rule fBall_pred_weaken[where P = \"\\<lambda>(_, rhs). \\<not> shadows_consts rhs\"])\n    subgoal for x\n      apply (cases x, simp)\n      apply (subst (asm) pterm_to_sterm_shadows)\n      using all_rules apply force\n      by simp\n    subgoal\n      using not_shadows by force\n    done\n  thus \"list_all (\\<lambda>(_, rhs). \\<not> pre_constants.shadows_consts C_info (fst |`| fset_of_list (compile rs)) rhs) (compile rs)\"\n    unfolding compile_heads all_consts .\nnext\n  show \"fdisjnt (fst |`| fset_of_list (compile rs)) C\"\n    unfolding compile_def\n    apply (subst fset_of_list_map[symmetric])\n    apply (subst ordered_fmap_keys)\n     apply (subst map_prod_def)\n     apply (subst id_apply)\n     apply (rule is_fmap_image)\n    using fmap disjnt by auto\nnext\n  show \"distinct all_constructors\"\n    by (fact distinct_ctr)\nqed\n\nsublocale prules_as_srules: srules C_info \"compile rs\"\nby (fact compile_rules)\n\nend\n\nglobal_interpretation srelated: term_struct_rel_strong \"(\\<lambda>p s. p = sterm_to_pterm s)\"\nproof (standard, goal_cases)\n  case (5 name t)\n  then show ?case by (cases t) (auto simp: const_sterm_def const_pterm_def split: option.splits)\nnext\n  case (6 u\\<^sub>1 u\\<^sub>2 t)\n  then show ?case by (cases t) (auto simp: app_sterm_def app_pterm_def split: option.splits)\nqed (auto simp: const_sterm_def const_pterm_def app_sterm_def app_pterm_def)\n\n\n\ncontext begin\n\nprivate lemma srewrite_step_non_empty: \"srewrite_step rs' name rhs \\<Longrightarrow> rs' \\<noteq> []\"\nby (induct rule: srewrite_step.induct) auto\n\nprivate lemma compile_consE:\n  assumes \"(name, rhs') # rest = compile rs\" \"is_fmap rs\"\n  obtains rhs where \"rhs' = pterm_to_sterm rhs\" \"(name, rhs) |\\<in>| rs\" \"rest = compile (rs - {| (name, rhs) |})\"\nproof -\n  from assms have \"ordered_fmap (map_prod id pterm_to_sterm |`| rs) = (name, rhs') # rest\"\n    unfolding compile_def\n    by simp\n  hence \"(name, rhs') \\<in> set (ordered_fmap (map_prod id pterm_to_sterm |`| rs))\"\n    by simp\n\n  have \"(name, rhs') |\\<in>| map_prod id pterm_to_sterm |`| rs\"\n    apply (rule ordered_fmap_sound)\n    subgoal\n      unfolding map_prod_def id_apply\n      apply (rule is_fmap_image)\n      apply fact\n      done\n    subgoal by fact\n    done\n  then obtain rhs where \"rhs' = pterm_to_sterm rhs\" \"(name, rhs) |\\<in>| rs\"\n    by auto\n\n  have \"rest = compile (rs - {| (name, rhs) |})\"\n    unfolding compile_def\n    apply (subst inj_on_fimage_set_diff[where C = rs])\n    subgoal\n      apply (rule inj_onI)\n      apply safe\n       apply auto\n      apply (subst (asm) fmember.rep_eq[symmetric])+\n      using \\<open>is_fmap rs\\<close> by (blast dest: is_fmapD)\n    subgoal by simp\n    subgoal using \\<open>(name, rhs) |\\<in>| rs\\<close> by simp\n    subgoal\n      apply simp\n      apply (subst ordered_fmap_remove)\n        apply (subst map_prod_def)\n      unfolding id_apply\n        apply (rule is_fmap_image)\n        apply fact\n      using \\<open>(name, rhs) |\\<in>| rs\\<close> apply force\n      apply (subst \\<open>rhs' = pterm_to_sterm rhs\\<close>[symmetric])\n      apply (subst \\<open>ordered_fmap _ = _\\<close>[unfolded id_def])\n      by simp\n    done\n\n  show thesis\n    by (rule that) fact+\nqed\n\nprivate lemma compile_correct_step:\n  assumes \"srewrite_step (compile rs) name rhs\" \"is_fmap rs\" \"fBall rs prule\"\n  shows \"(name, sterm_to_pterm rhs) |\\<in>| rs\"\nusing assms proof (induction \"compile rs\" name rhs arbitrary: rs)\n  case (cons_match name rhs' rest)\n  then obtain rhs where \"rhs' = pterm_to_sterm rhs\" \"(name, rhs) |\\<in>| rs\"\n    by (auto elim: compile_consE)\n\n  show ?case\n    unfolding \\<open>rhs' = _\\<close>\n    apply (subst pterm_to_sterm_sterm_to_pterm)\n    using fbspec[OF \\<open>fBall rs prule\\<close> \\<open>(name, rhs) |\\<in>| rs\\<close>] apply force\n    by fact\nnext\n  case (cons_nomatch name name\\<^sub>1 rest rhs rhs\\<^sub>1')\n  then obtain rhs\\<^sub>1 where \"rhs\\<^sub>1' = pterm_to_sterm rhs\\<^sub>1\" \"(name\\<^sub>1, rhs\\<^sub>1) |\\<in>| rs\" \"rest = compile (rs - {| (name\\<^sub>1, rhs\\<^sub>1) |})\"\n    by (auto elim: compile_consE)\n\n  let ?rs' = \"rs - {| (name\\<^sub>1, rhs\\<^sub>1) |}\"\n  have \"(name, sterm_to_pterm rhs) |\\<in>| ?rs'\"\n    proof (intro cons_nomatch)\n      show \"rest = compile ?rs'\"\n        by fact\n\n      show \"is_fmap (rs |-| {|(name\\<^sub>1, rhs\\<^sub>1)|})\"\n        using \\<open>is_fmap rs\\<close>\n        by (rule is_fmap_subset) auto\n\n      show \"fBall ?rs' prule\"\n        using cons_nomatch by blast\n    qed\n  thus ?case\n    by simp\nqed\n\nlemma compile_correct0:\n  assumes \"compile rs \\<turnstile>\\<^sub>s u \\<longrightarrow> u'\" \"prules C rs\"\n  shows \"rs \\<turnstile>\\<^sub>p sterm_to_pterm u \\<longrightarrow> sterm_to_pterm u'\"\nusing assms proof induction\n  case (beta cs t t')\n  then obtain pat rhs env where \"(pat, rhs) \\<in> set cs\" \"match pat t = Some env\" \"t' = subst rhs env\"\n    by (auto elim: rewrite_firstE)\n\n  then obtain env' where \"match pat (sterm_to_pterm t) = Some env'\" \"srelated.P_env env' env\"\n    by (metis option.distinct(1) option.inject option.rel_cases srelated.match_rel)\n  hence \"subst (sterm_to_pterm rhs) env' = sterm_to_pterm (subst rhs env)\"\n    by (simp add: srelated_subst)\n\n  let ?rhs' = \"sterm_to_pterm rhs\"\n\n  have \"(pat, ?rhs') |\\<in>| fset_of_list (map (map_prod id sterm_to_pterm) cs)\"\n    using \\<open>(pat, rhs) \\<in> set cs\\<close>\n    including fset.lifting\n    by transfer' force\n\n  note fset_of_list_map[simp del]\n  show ?case\n    apply simp\n    apply (rule prewrite.intros)\n     apply fact\n    unfolding rewrite_step.simps\n    apply (subst map_option_eq_Some)\n    apply (intro exI conjI)\n     apply fact\n    unfolding \\<open>t' = _\\<close>\n    by fact\nnext\n  case (step name rhs)\n  hence \"(name, sterm_to_pterm rhs) |\\<in>| rs\"\n    unfolding prules_def prules_axioms_def\n    by (metis compile_correct_step)\n  thus ?case\n    by (auto intro: prewrite.intros)\nqed (auto intro: prewrite.intros)\n\nend\n\nlemma (in prules) compile_correct:\n  assumes \"compile rs \\<turnstile>\\<^sub>s u \\<longrightarrow> u'\"\n  shows \"rs \\<turnstile>\\<^sub>p sterm_to_pterm u \\<longrightarrow> sterm_to_pterm u'\"\nby (rule compile_correct0) (fact | standard)+\n\nhide_fact compile_correct0\n\nsubsubsection \\<open>Completeness of translation\\<close>\n\nglobal_interpretation srelated': term_struct_rel_strong \"(\\<lambda>p s. pterm_to_sterm p = s)\"\nproof (standard, goal_cases)\n  case (1 t name)\n  then show ?case by (cases t) (auto simp: const_sterm_def const_pterm_def split: option.splits)\nnext\n  case (3 t u\\<^sub>1 u\\<^sub>2)\n  then show ?case by (cases t) (auto simp: app_sterm_def app_pterm_def split: option.splits)\nqed (auto simp: const_sterm_def const_pterm_def app_sterm_def app_pterm_def)\n\ncorollary srelated_env_unique:\n  \"srelated'.P_env penv senv \\<Longrightarrow> srelated'.P_env penv senv' \\<Longrightarrow> senv = senv'\"\napply (subst (asm) fmrel_iff)+\napply (subst (asm) option.rel_sel)+\napply (rule fmap_ext)\nby (metis option.exhaust_sel)\n\nlemma srelated_subst':\n  assumes \"srelated'.P_env penv senv\" \"wellformed t\"\n  shows \"pterm_to_sterm (subst t penv) = subst (pterm_to_sterm t) senv\"\nusing assms proof (induction t arbitrary: penv senv)\n  case (Pvar name)\n  thus ?case\n    by (cases rule: fmrel_cases[where x = name]) auto\nnext\n  case (Pabs cs)\n  hence \"is_fmap cs\"\n    by force\n\n  show ?case\n    apply simp\n    unfolding map_prod_def id_apply\n    apply (subst ordered_fmap_image[symmetric])\n     apply fact\n    apply (subst fset.map_comp[symmetric])\n    apply (subst ordered_fmap_image[symmetric])\n    subgoal by (rule is_fmap_image) fact\n    apply (subst ordered_fmap_image[symmetric])\n     apply fact\n    apply auto\n    apply (drule ordered_fmap_sound[OF \\<open>is_fmap cs\\<close>])\n    subgoal for pat rhs\n      apply (rule Pabs)\n         apply (subst (asm) fmember.rep_eq)\n         apply assumption\n        apply auto\n      using Pabs by force+\n    done\nqed auto\n\nlemma srelated_find_match:\n  assumes \"find_match cs t = Some (penv, pat, rhs)\" \"srelated'.P_env penv senv\"\n  shows \"find_match (map (map_prod id pterm_to_sterm) cs) (pterm_to_sterm t) = Some (senv, pat, pterm_to_sterm rhs)\"\nproof -\n  let ?cs' = \"map (map_prod id pterm_to_sterm) cs\"\n  let ?t' = \"pterm_to_sterm t\"\n  have *: \"list_all2 (rel_prod (=) (\\<lambda>p s. pterm_to_sterm p = s)) cs ?cs'\"\n    unfolding list.rel_map\n    by (auto intro: list.rel_refl)\n\n  obtain senv0\n    where \"find_match ?cs' ?t' = Some (senv0, pat, pterm_to_sterm rhs)\" \"srelated'.P_env penv senv0\"\n    using srelated'.find_match_rel[OF * refl, where t = t, unfolded assms]\n    unfolding option_rel_Some1 rel_prod_conv\n    by auto\n  with assms have \"senv = senv0\"\n    by (metis srelated_env_unique)\n  show ?thesis\n    unfolding \\<open>senv = _\\<close> by fact\nqed\n\nlemma (in prules) compile_complete:\n  assumes \"rs \\<turnstile>\\<^sub>p t \\<longrightarrow> t'\" \"wellformed t\"\n  shows \"compile rs \\<turnstile>\\<^sub>s pterm_to_sterm t \\<longrightarrow> pterm_to_sterm t'\"\nusing assms proof induction\n  case (step name rhs)\n  then show ?case\n    apply simp\n    apply rule\n    apply (rule prules_as_srules.srewrite_stepI)\n    unfolding compile_def\n    apply (subst fset_of_list_elem[symmetric])\n    apply (subst ordered_fmap_set_eq)\n     apply (insert fmap)\n     apply (rule is_fmapI)\n     apply (force dest: is_fmapD)\n    by (simp add: rev_fimage_eqI)\nnext\n  case (beta c cs t t')\n  from beta obtain pat rhs penv where \"c = (pat, rhs)\" \"match pat t = Some penv\" \"subst rhs penv = t'\"\n    by (metis (no_types, lifting) map_option_eq_Some rewrite_step.simps surj_pair)\n  then obtain senv where \"match pat (pterm_to_sterm t) = Some senv\" \"srelated'.P_env penv senv\"\n    by (metis option_rel_Some1 srelated'.match_rel)\n  have \"wellformed rhs\"\n    using beta \\<open>c = _\\<close> prules.all_rules prule.simps\n    by force\n  then have \"subst (pterm_to_sterm rhs) senv = pterm_to_sterm t'\"\n    using srelated_subst' \\<open>_ = t'\\<close> \\<open>srelated'.P_env _ _\\<close>\n    by metis\n  have \"(pat, pterm_to_sterm rhs) |\\<in>| map_prod id pterm_to_sterm |`| cs\"\n    using beta \\<open>c = _\\<close>\n    by (metis fimage_eqI id_def map_prod_simp)\n  have \"is_fmap cs\"\n    using beta\n    by auto\n  have \"find_match (ordered_fmap cs) t = Some (penv, pat, rhs)\"\n    apply (rule compatible_find_match)\n    subgoal\n      apply (subst ordered_fmap_set_eq[OF \\<open>is_fmap cs\\<close>])+\n      using beta by simp\n    subgoal\n      unfolding list_all_iff\n      apply rule\n      apply (rename_tac x, case_tac x)\n      apply simp\n      apply (drule ordered_fmap_sound[OF \\<open>is_fmap cs\\<close>])\n      using beta by auto\n    subgoal\n      apply (subst ordered_fmap_set_eq)\n      by fact\n    subgoal\n      by fact\n    subgoal\n      using beta(1) \\<open>c = _\\<close> \\<open>is_fmap cs\\<close>\n      using fset_of_list_elem ordered_fmap_set_eq by fast\n    done\n\n  show ?case\n    apply simp\n    apply rule\n    apply (subst \\<open>_ = pterm_to_sterm t'\\<close>[symmetric])\n    apply (rule find_match_rewrite_first)\n    unfolding map_prod_def id_apply\n    apply (subst ordered_fmap_image[symmetric])\n     apply fact\n    apply (subst map_prod_def[symmetric])\n    apply (subst id_def[symmetric])\n    apply (rule srelated_find_match)\n    by fact+\nqed (auto intro: srewrite.intros)\n\nsubsubsection \\<open>Computability\\<close>\n\nexport_code compile\n  checking Scala\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CakeML_Codegen/Rewriting/Rewriting_Sterm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.3287926903216}}
{"text": "(******************************************************************************)\n(* Project: The Isabelle/UTP Proof System                                     *)\n(* File: fmi.thy                                                              *)\n(* Authors: Frank Zeyda and Simon Foster (University of York, UK)             *)\n(* Emails: frank.zeyda@york.ac.uk and simon.foster@york.ac.uk                 *)\n(******************************************************************************)\n(* LAST REVIEWED: 20 Sep 2017 *)\n\nsection {* FMI {\\Circus} Model *}\n\ntheory fmi\nimports \"UTP-Toolkit.Positive\" Time\n  \"UTP-Axm.utp_axm\"\n  \"../theories/utp_circus\"\nbegin recall_syntax\n\ndeclare [[typedef_overloaded]]\ndeclare [[quick_and_dirty]]\n\ndefault_sort type\n\nsubsection {* Preliminaries *}\n\nsubsubsection {* Syntax Extensions *}\n\nparagraph \\<open>Application and update of HOL partial functions.\\<close>\n\ndefinition map_apply :: \"('a \\<rightharpoonup> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b\" where\n\"map_apply f = the o f\"\n\nadhoc_overloading uapply map_apply\n\ndefinition map_upd :: \"('a \\<rightharpoonup> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b \\<Rightarrow> ('a \\<rightharpoonup> 'b)\" where\n\"map_upd m x y = m(x \\<mapsto> y)\"\n\ntext \\<open>The commented-out overloading causes parsing ambiguities.\\<close>\n\nadhoc_overloading (* uupd fun_upd and *) uupd map_upd\n\nparagraph {* Positive Subtype *}\n\ntext \\<open>Lifted coercion operator from @{typ \"'a pos\"} to @{typ \"'a\"}.\\<close>\n\nsyntax \"_uRep_pos\" :: \"('a pos, '\\<alpha>) uexpr \\<Rightarrow> ('a, '\\<alpha>) uexpr\" (\"\\<section>'(_')\")\n\ntranslations \"_uRep_pos p\" \\<rightleftharpoons> \"(CONST uop) (CONST Rep_pos) p\"\n\nsubsubsection {* Class Instantiations *}\n\nlemma card_gt_two_witness:\n\"finite S \\<Longrightarrow> 2 \\<le> card S \\<Longrightarrow> (\\<exists>a\\<in>S. \\<exists>b\\<in>S. a \\<noteq> b)\"\napply (atomize (full))\napply (rule impI)\napply (erule finite.induct)\n-- {* Subgoal 1 *}\napply (simp)\n-- {* Subgoal 2 *}\napply (clarify)\napply (case_tac \"a \\<in> A\")\n-- {* Subgoal 2.1 *}\napply (simp add: insert_absorb)\n-- {* Subgoal 2.2 *}\napply (rule_tac x = \"a\" in bexI)\napply (clarsimp)\nusing card_le_Suc_iff apply (blast)\napply (simp)\ndone\n\ntheorem card_ge_two_unfold:\n\"finite S \\<Longrightarrow> 2 \\<le> card S = (\\<exists>x y. x \\<in> S \\<and> y \\<in> S \\<and> x \\<noteq> y)\"\napply (rule iffI)\n-- {* Subgoal 1 *}\nusing card_gt_two_witness apply (blast)\n-- {* Subgoal 2 *}\napply (case_tac \"card S = 0\")\napply (clarsimp)\napply (case_tac \"card S = 1\")\napply (clarsimp)\nusing card_eq_SucD apply (blast)\napply (clarsimp)\napply (meson card_eq_0_iff less_2_cases not_less)\ndone\n\ntheorem instance_twoI:\n\"\\<exists>x y. x \\<in> S \\<and> y \\<in> S \\<and> x \\<noteq> y \\<Longrightarrow> \\<not> finite S \\<or> 2 \\<le> card S\"\napply (case_tac \"finite S\")\napply (simp_all)\napply (subst card_ge_two_unfold)\napply (assumption)\napply (clarsimp)\ndone\n\ntext {* By default, the product type did not instantiate class @{class two}. *}\n\ninstance prod :: (two, two) two\napply (intro_classes)\napply (rule instance_twoI)\napply (subgoal_tac \"\\<exists>(a::'a) (b::'a). a \\<noteq> b\")\napply (subgoal_tac \"\\<exists>(c::'b) (d::'b). c \\<noteq> d\")\napply (clarsimp)\napply (rule two_diff)\napply (rule two_diff)\ndone\n\ntext {* By default, the product type did not instantiate @{class vst}. *}\n\ninstantiation prod :: (vst, vst) vst\nbegin\ndefinition vstore_lens_prod :: \"vstore \\<Longrightarrow> 'a \\<times> 'b\" where\n\"vstore_lens_prod = vstore_lens ;\\<^sub>L fst\\<^sub>L\"\ninstance\napply (intro_classes)\napply (unfold vstore_lens_prod_def)\napply (simp)\ndone\nend\n\nsubsection {* FMI Types  *}\n\ntext {* In this section, we encode the various FMI types in HOL. *}\n\nsubsubsection {* \\<open>TIME\\<close> and \\<open>NZTIME\\<close> *}\n\ntext {*\n  Our aim is to treat time abstractly in the FMI model via some arbitrary type\n  @{typ \"'\\<tau>\"} that must be a member of class @{class time}. We thus introduce\n  additional syntax below to impose the respective sort constraint(s). We also\n  require that time can be injected into deep variable stores. In particular,\n  membership to @{class linordered_ab_group_add} ensures @{class continuum}\n  closure under the @{typ \"'a pos\"} type.\n*}\n\nclass ctime = time + linordered_ab_group_add + continuum + two (* + injectable *)\n\nsyntax   \"_TIME\" :: \"type \\<Rightarrow> type\" (\"TIME'(_')\")\nsyntax \"_NZTIME\" :: \"type \\<Rightarrow> type\" (\"NZTIME'(_')\")\n\ntranslations (type) \"TIME('\\<tau>)\" \\<rightleftharpoons> (type) \"'\\<tau>::ctime\"\ntranslations (type) \"NZTIME('\\<tau>)\" \\<rightleftharpoons> (type) \"'\\<tau>::ctime pos\"\n\nsubsubsection {* \\<open>FMI2COMP\\<close> *}\n\ntext {*\n  The type @{text FMI2COMP} of FMI component identifiers is introduced as a\n  given (deferred) type. Concrete co-simulation models have to introduced an\n  axiomatisation in order to determine the elements of this type, along with\n  the additional property that they are distinct and partition the type.\n*}\n\ntypedecl FMI2COMP\n\ntext {* Syntactic sugar for \\<open>UNIV::FMI2COMP set\\<close>. *}\n\nabbreviation FMI2COMP :: \"FMI2COMP set\" where\n\"FMI2COMP \\<equiv> UNIV\"\n\ntext {*\n  We require the type @{type FMI2COMP} to be finite and containing at least two\n  elements. This is important so that we can later on instantiate it as members\n  of @{class two} and @{class continuum} for injection into the deep variable\n  model. We observe that FMI {\\Circus} processes use state and local variables\n  involving the type @{type FMI2COMP}. To avoid the need for axioms, locales\n  could perhaps be used.\n*}\n\naxiomatization where\n  FMI2COMP_finite: \"finite FMI2COMP\" and\n  FMI2COMP_gt_two: \"card FMI2COMP \\<ge> 2\"\n\ntext {* Instantiation of relevant classes for the axiomatic value model. *}\n\ninstantiation FMI2COMP :: typerep\nbegin\ndefinition typerep_FMI2COMP :: \"FMI2COMP itself \\<Rightarrow> utype\" where\n[typing]: \"typerep_FMI2COMP t = typerep.Typerep (STR ''fmi.FMI2COMP'') []\"\ninstance ..\nend\n\ninstantiation FMI2COMP :: typedep\nbegin\ndefinition typedep_FMI2COMP :: \"FMI2COMP itself \\<Rightarrow> utype set\" where\n[typing]: \"typedep_FMI2COMP t = {TYPEREP(FMI2COMP)}\"\ninstance ..\nend\n\ntext {* Injection into the axiomatic value model. *}\n\ninject_type FMI2COMP\n\ntext {* The below facilitates evaluation of the transitive closure of PDGs. *}\n\ninstantiation FMI2COMP :: equal\nbegin\ndefinition equal_FMI2COMP ::\"FMI2COMP \\<Rightarrow> FMI2COMP \\<Rightarrow> bool\" where\n\"equal_FMI2COMP x y = (x = y)\"\ninstance\napply (intro_classes)\napply (unfold equal_FMI2COMP_def)\napply (rule refl)\ndone\nend\n\ntext {* Instantiation of relevant classes for the deep value model. *}\n\ninstance FMI2COMP :: finite\napply (intro_classes)\napply (rule FMI2COMP_finite)\ndone\n\n-- {* The above already guarantees membership to class @{class continuum}. *}\n\ninstance FMI2COMP :: \"{continuum, two}\"\napply (intro_classes)\napply (rule disjI2)\napply (rule FMI2COMP_gt_two)\ndone\n\nsubsubsection {* \\<open>FMUSTATE\\<close> *}\n\ntext {*\n  Likewise, @{text FMUSTATE} is introduced as a given type for now. We may\n  need to review this in the future; for instance, the universal value model\n  could be used to encode a generic (monomorphic) state type able to encode\n  the state of any concrete FMU.\n*}\n\ntypedecl FMUSTATE\n\ntext {* Instantiation of relevant classes for the axiomatic value model. *}\n\ninstantiation FMUSTATE :: typerep\nbegin\ndefinition typerep_FMUSTATE :: \"FMUSTATE itself \\<Rightarrow> utype\" where\n[typing]: \"typerep_FMUSTATE t = typerep.Typerep (STR ''fmi.FMUSTATE'') []\"\ninstance ..\nend\n\ninstantiation FMUSTATE :: typedep\nbegin\ndefinition typedep_FMUSTATE :: \"FMUSTATE itself \\<Rightarrow> utype set\" where\n[typing]: \"typedep_FMUSTATE t = {TYPEREP(FMUSTATE)}\"\ninstance ..\nend\n\ntext {* Injection into the axiomatic value model. *}\n\ninject_type FMUSTATE\n\ntext {* Instantiation of relevant classes for the deep value model. *}\n\ntext {*\n  Clearly, it is not possible to prove that @{type FMUSTATE} is an instance of\n  either class @{class two} or @{class continuum} due to its abstract nature.\n  The only solution is once again to encapsulate the instantiation axioms as\n  global axiomatic properties of the @{type FMUSTATE} type. Likewise, it may\n  be safer to use a @{command locale} instead of an @{command axiomatization}.\n*}\n\naxiomatization where\n   FMUSTATE_continuum: \"OFCLASS(FMUSTATE, continuum_class)\" and\n   FMUSTATE_two:       \"OFCLASS(FMUSTATE, two_class)\"\n\ntext {* The instantiation below is proved by virtue of the axioms above. *}\n\ninstance FMUSTATE :: \"{continuum, two}\"\napply (rule FMUSTATE_continuum)\napply (rule FMUSTATE_two)\ndone\n\nsubsubsection {* \\<open>VAR\\<close> and \\<open>VAL\\<close> *}\n\ntext {* Type synonyms for permissible FMI 2.0 port types. *}\n\ntype_synonym fmi2Real = \"real\"\ntype_synonym fmi2Integer = \"int\"\ntype_synonym fmi2String = \"string\"\ntype_synonym fmi2Boolean = \"bool\"\n\ntext {*\n  The FMI types of \\<open>VAR\\<close> and \\<open>VAL\\<close> are equated with the unified variable and\n  value types of the axiomatic value model. While we could have alternatively\n  used deep variables here, an approach via axiomatic variables means that we\n  are not restricted to the standard FMI types. An issue is thought that \\<open>VAL\\<close>\n  itself is clearly not injectable. The ranked axiomatic model may provide a\n  solution to this problem, but this is work in progress for now.\n*}\n\ntype_synonym VAR = \"uvar.uvar\" (\"VAR\")\ntype_synonym VAL = \"uval.uval\" (\"VAL\")\n\ntext {* Translations for pretty-printing. *}\n\ntranslations (type) \"VAR\" \\<leftharpoondown> (type) \"uvar.uvar\"\ntranslations (type) \"VAL\" \\<leftharpoondown> (type) \"uval.uval\"\n\nsubsubsection {* \\<open>FMIST\\<close> and \\<open>FMISTF\\<close> *}\n\ntext {* We declare a datatype for \\<open>fmi2Status\\<close> flags the FMI API. *}\n\ndatatype FMI2ST =\n  fmi2OK |\n  fmi2Error |\n  fmi2Fatal\n  (*fmi2Warning *)\n  (*fmi2Penidng *)\n\ntext {* Instantiation of relevant classes for the axiomatic value model. *}\n\ninject_type FMI2ST\n\ntext {* Instantiation of relevant classes for the deep value model. *}\n\ntext {* We note that countability implies membership to @{class continuum} *}\n\ninstance FMI2ST :: countable\napply (countable_datatype)\ndone\n\ninstance FMI2ST :: continuum\napply (intro_classes)\ndone\n\ninstance FMI2ST :: two\napply (intro_classes)\napply (rule instance_twoI)\napply (rule_tac x = \"fmi2OK\" in exI)\napply (rule_tac x = \"fmi2Error\" in exI)\napply (clarsimp)\ndone\n\nsubsubsection {* \\<open>FMUSTF\\<close> *}\n\ndatatype FMI2STF =\n  fmi2Status (fmi2StatusOf: \"FMI2ST\") |\n  fmi2Discard\n\ntext {* Instantiation of relevant classes for the axiomatic value model. *}\n\ninject_type FMI2STF\n\ntext {* Instantiation of relevant classes for the deep value model. *}\n\ntext {* We note that countability implies membership to @{class continuum} *}\n\ninstance FMI2STF :: countable\napply (countable_datatype)\ndone\n\ninstance FMI2STF :: continuum\napply (intro_classes)\ndone\n\ninstance FMI2STF :: two\napply (intro_classes)\napply (rule instance_twoI)\napply (rule_tac x = \"fmi2Status _\" in exI)\napply (rule_tac x = \"fmi2Discard\" in exI)\napply (clarsimp)\ndone\n\nsubsubsection {* Error Flags *}\n\ntypedef ErrorFlag = \"{fmi2Error, fmi2Fatal}\"\napply (rule_tac x = \"fmi2Error\" in exI)\napply (clarsimp)\ndone\n\ntext {* Instantiation of relevant classes for the axiomatic value model. *}\n\ninject_type ErrorFlag\n\ntext {* Instantiation of relevant classes for the deep value model. *}\n\ntext {* We note that countability implies membership to @{class continuum} *}\n\ninstance ErrorFlag :: countable\napply (intro_classes)\napply (rule_tac x = \"to_nat o Rep_ErrorFlag\" in exI)\napply (rule inj_comp)\n-- {* Subgoal 1 *}\napply (simp)\n-- {* Subgoal 2 *}\napply (rule inj_onI; clarsimp)\napply (simp add: Rep_ErrorFlag_inject)\ndone\n\ninstance ErrorFlag :: continuum\napply (intro_classes)\ndone\n\ninstance ErrorFlag :: two\napply (intro_classes)\napply (rule instance_twoI)\napply (rule_tac x = \"Abs_ErrorFlag fmi2Error\" in exI)\napply (rule_tac x = \"Abs_ErrorFlag fmi2Fatal\" in exI)\napply (simp add: Abs_ErrorFlag_inject)\ndone\n\nsubsection {* FMI Events *}\n\ntext {*\n  While the trace type for CSP is fixed to @{typ \"'a list\"}, we still have to\n  define the event type @{typ \"'a\"}. Generally, we can think of events as sum\n  types. Since events may be parametric, as with states there is an issue how\n  to model events with different (HOL) types as a single unified type. A deep\n  model may encode them as pairs consisting of a name \\& type. Below, we adopt\n  a shallow model that uses a datatype construction wrapped into a @{type sum}\n  type as to make the datatype extensible. As an alternative, Simon mentioned\n  \\emph{prisms} as an analogue of lenses for sum types.\n*}\n\nsubsubsection {* FMI API Channels *}\n\ntext {*\n  We note that all constructor functions are of type @{type chan}. To obtain\n  extensible event types, we introduce a prefixing (scoping) operator for each\n  channel type that lifts the underlying datatype into a @{type sum} type with\n  an open slot for later extension. Eventually, those prefix operators will be\n  introduced automatically by the tool, namely through a custom @{text events}\n  command for defining channel events (future work).\n*}\n\ndatatype '\\<tau>::ctime fmi_event =\n  fmi2Get \"FMI2COMP \\<times> VAR \\<times> VAL \\<times> FMI2ST\" |\n  fmi2Set \"FMI2COMP \\<times> VAR \\<times> VAL \\<times> FMI2STF\" |\n  fmi2DoStep \"FMI2COMP \\<times> TIME('\\<tau>) \\<times> NZTIME('\\<tau>) \\<times> FMI2STF\" |\n  fmi2Instantiate \"FMI2COMP \\<times> bool\" |\n  fmi2SetUpExperiment \"FMI2COMP \\<times> TIME('\\<tau>) \\<times> bool \\<times> TIME('\\<tau>) \\<times> FMI2ST\" |\n  fmi2EnterInitializationMode \"FMI2COMP \\<times> FMI2ST\" |\n  fmi2ExitInitializationMode \"FMI2COMP \\<times> FMI2ST\" |\n  fmi2GetBooleanStatusfmi2Terminated \"FMI2COMP \\<times> bool \\<times> FMI2ST\" |\n  fmi2GetMaxStepSize \"FMI2COMP \\<times> TIME('\\<tau>) \\<times> FMI2ST\" |\n  fmi2Terminate \"FMI2COMP \\<times> FMI2ST\" |\n  fmi2FreeInstance \"FMI2COMP \\<times> FMI2ST\" |\n  fmi2GetFMUState \"FMI2COMP \\<times> FMUSTATE \\<times> FMI2ST\" |\n  fmi2SetFMUState \"FMI2COMP \\<times> FMUSTATE \\<times> FMI2ST\"\n\nabbreviation fmi_prefix ::\n  \"('a, '\\<tau>::ctime fmi_event) chan \\<Rightarrow>\n   ('a, ('\\<tau>::ctime fmi_event) + 'ext) chan\" where\n\"fmi_prefix c \\<equiv> Inl o c\"\n\nnotation fmi_prefix (\"fmi:_\" [1000] 1000)\n\nabbreviation \"FMIAPI \\<equiv>\n  \\<epsilon>(fmi:fmi2Get) \\<union>\n  \\<epsilon>(fmi:fmi2Set) \\<union>\n  \\<epsilon>(fmi:fmi2DoStep) \\<union>\n  \\<epsilon>(fmi:fmi2Instantiate) \\<union>\n  \\<epsilon>(fmi:fmi2SetUpExperiment) \\<union>\n  \\<epsilon>(fmi:fmi2EnterInitializationMode) \\<union>\n  \\<epsilon>(fmi:fmi2ExitInitializationMode) \\<union>\n  \\<epsilon>(fmi:fmi2GetBooleanStatusfmi2Terminated) \\<union>\n  \\<epsilon>(fmi:fmi2GetMaxStepSize) \\<union>\n  \\<epsilon>(fmi:fmi2Terminate) \\<union>\n  \\<epsilon>(fmi:fmi2FreeInstance) \\<union>\n  \\<epsilon>(fmi:fmi2GetFMUState) \\<union>\n  \\<epsilon>(fmi:fmi2SetFMUState)\"\n\nsubsubsection {* Timer Channels *}\n\ndatatype '\\<tau>::ctime timer_event =\n  setT \"TIME('\\<tau>)\" |\n  updateSS \"NZTIME('\\<tau>)\" |\n  step \"TIME('\\<tau>) \\<times> NZTIME('\\<tau>)\" |\n  endc \"unit\"\n\nabbreviation timer_prefix ::\n  \"('a, '\\<tau>::ctime timer_event) chan \\<Rightarrow>\n   ('a, ('\\<tau>::ctime fmi_event) + ('\\<tau>::ctime timer_event) + 'ext) chan\" where\n\"timer_prefix c \\<equiv> Inr o Inl o c\"\n\nnotation timer_prefix (\"tm:_\" [1000] 1000)\n\nabbreviation \"tm_events \\<equiv>\n  \\<epsilon>(tm:step) \\<union> \\<epsilon>(tm:endc) \\<union> \\<epsilon>(tm:setT) \\<union> \\<epsilon>(tm:updateSS)\"\n\nsubsubsection {* Control Channels *}\n\ntype_synonym error = (* \"ErrorFlag\" *) \"FMI2ST\"\n\ndatatype ctrl_event =\n  stepToComplete \"unit\" |\n  stepAnalysed \"unit\" |\n  stepComplete \"unit\" |\n  endsimulation \"unit\" |\n  error \"error\"\n\nabbreviation ctrl_prefix ::\n  \"('a, ctrl_event) chan \\<Rightarrow>\n   ('a, ('\\<tau>::ctime fmi_event) + ('\\<tau>::ctime timer_event) + (ctrl_event) + 'ext) chan\" where\n\"ctrl_prefix c \\<equiv> Inr o Inr o Inl o c\"\n\nnotation ctrl_prefix (\"ctr:_\" [1000] 1000)\n\nabbreviation \"ctrl_events \\<equiv>\n  \\<epsilon>(ctr:stepToComplete) \\<union>\n  \\<epsilon>(ctr:stepAnalysed) \\<union>\n  \\<epsilon>(ctr:stepComplete) \\<union>\n  \\<epsilon>(ctr:endsimulation) \\<union>\n  \\<epsilon>(ctr:error)\"\n\nsubsubsection {* FMI Process Type *}\n\ntype_synonym ('\\<sigma>, '\\<tau>, 'ext) fmi_action =\n  \"('\\<sigma>, '\\<tau> fmi_event + '\\<tau> timer_event + ctrl_event + 'ext) action\"\n\ntype_synonym ('\\<tau>, 'ext) fmi_process = \"(unit, '\\<tau>, 'ext) fmi_action\"\n\nsubsection {* FMI Ports *}\n\ntext {*\n  For readability, we introduce a @{command type_synonym} for FMI ports. A port\n  is encoded by a pair consisting of an FMI component (of type @{type FMI2COMP})\n  and a variable (of type @{type VAR}). We do not distinguish input and output\n  ports at the level of the encoding.\n*}\n\ntype_synonym port = \"FMI2COMP \\<times> VAR\" (\"PORT\")\n\ntext {* Shall we pretty-print the @{typ PORT} type too? *}\n\n(* translations (type) \"PORT\" \\<leftharpoondown> (type) \"FMI2COMP \\<times> VAR\" *)\n\ntext \\<open>Getter function to obtain the FMU and name of a port object.\\<close>\n\nabbreviation FMU :: \"PORT \\<Rightarrow> FMI2COMP\" where\n\"FMU port \\<equiv> (fst port)\"\n\nabbreviation name :: \"PORT \\<Rightarrow> VAR\" where\n\"name port \\<equiv> (snd port)\"\n\nsubsection {* FMI Configuration *}\n\ntext {*\n  The configuration for a particular FMI system is introduced abstractly via\n  HOL constants. A concrete model can provide overloaded definitions to give\n  concrete meanings to them; this may allow us to potentially prove additional\n  properties. An open question is whether some additional caveats need to be\n  specified already here (e.g.~acyclicity  of the port dependency graph). This\n  could possibly be done through a type definition. We note that we encode the\n  Z type @{text \"seq\"} by HOL's list type @{typ \"'a list\"}.\n*}\n\ntext {*\n  In line with the CSP model of Deliverable D2.2d, I added a separate list\n  \\<open>initialValues\\<close> rather than using the \\<open>inputs\\<close> sequence to provide initial\n  values for inputs. This also proves to be slightly more convenient in terms\n  of the mechanised model. Further, I changed the type of the port dependency\n  graph to bee a function rather than a relation, mapping each outputs to a\n  list of connected inputs. The advantage of this is that it facilitates the\n  definition of the @{text DistributeInputs} action since currently, iterated\n  sequence e.g.~of actions is only define for lists but not for (finite) sets.\n  Lastly, I included another relation \\<open>idd\\<close> to record the internal direct\n  dependencies of the FMI system. Conceptually, it turns out that it is not\n  the \\<open>pdg\\<close> that has to be acyclic but the union of the \\<open>pdg\\<close> and \\<open>idd\\<close> to\n  guarantee the absence of algebraic loops.\n*}\n\n-- \\<open>In D2.2d: \\<open>inputs :: FMI2COMP \\<times> VAR \\<times> VAL\\<close> and \\<open>pdg :: PORT relation\\<close>.\\<close>\n\nconsts\n  FMUs :: \"FMI2COMP list\"\n  parameters :: \"(FMI2COMP \\<times> VAR \\<times> VAL) list\"\n  initialValues :: \"(PORT \\<times> VAL) list\"\n  inputs :: \"PORT list\"\n  outputs :: \"PORT list\"\n  pdg :: \"PORT \\<Rightarrow> (PORT list)\" -- \\<open>Port Dependency Graph\\<close>\n  idd :: \"PORT \\<Rightarrow> (PORT list)\" -- \\<open>Internal Direct Dependencies\\<close>\n\nsubsection {* Simulation Parameters *}\n\n-- {* In line with the D2.2d example, I added these as global constants, too. *}\n\nconsts startTime :: \"TIME('\\<tau>)\"\nconsts stopTimeDefined :: \"bool\"\nconsts stopTime :: \"TIME('\\<tau>)\"\n\nsubsection {* FMI Processes *}\n\nsubsubsection {* \\<open>Timer\\<close> Process *}\n\nalphabet '\\<tau>::ctime timer_state =\n  currentTime :: \"TIME('\\<tau>)\"\n  stepSize :: \"NZTIME('\\<tau>)\"\n\ntype_synonym '\\<tau> timer_action =\n  \"('\\<tau> timer_state, '\\<tau> timer_event) action\"\n\ndefinition\n\"process Timer(ct::TIME('\\<tau>), hc::NZTIME('\\<tau>), tN::TIME('\\<tau>)) \\<triangleq> begin\n  state('\\<tau> timer_state)\n  Step = (\n    (tm:setT?(t : \\<guillemotleft>t \\<le> tN\\<guillemotright>) \\<^bold>\\<rightarrow> currentTime :=\\<^sub>C \\<guillemotleft>t\\<guillemotright>) \\<box>\n    (tm:updateSS?(ss) \\<^bold>\\<rightarrow> stepSize :=\\<^sub>C \\<guillemotleft>ss\\<guillemotright>) \\<box>\n    (tm:step!(&currentTime)!(&stepSize) \\<^bold>\\<rightarrow>\n      currentTime :=\\<^sub>C min\\<^sub>u(&currentTime + \\<section>(&stepSize), \\<guillemotleft>tN\\<guillemotright>)) \\<box>\n    (&currentTime =\\<^sub>u \\<guillemotleft>tN\\<guillemotright>) &\\<^sub>u tm:endc \\<^bold>\\<rightarrow> Stop) ;; Step\n  \\<bullet> (currentTime, stepSize) :=\\<^sub>C (\\<guillemotleft>ct\\<guillemotright>, \\<guillemotleft>hc\\<guillemotright>) ;; Step\nend\"\n\ntext \\<open>The same process definition using deep variables.\\<close>\n\ndefinition\n\"process DvarTimer(ct::TIME('\\<tau>), hc::NZTIME('\\<tau>), tN::TIME('\\<tau>)) \\<triangleq> begin\n  state(vstore)\n  Step = (\n    (tm:setT?(t : \\<guillemotleft>t \\<le> tN\\<guillemotright>) \\<^bold>\\<rightarrow> <currentTime> :=\\<^sub>C \\<guillemotleft>t\\<guillemotright>) \\<box>\n    (tm:updateSS?(ss) \\<^bold>\\<rightarrow> <stepSize> :=\\<^sub>C \\<guillemotleft>ss\\<guillemotright>) \\<box>\n    (tm:step!(&<currentTime>)!(&<stepSize>) \\<^bold>\\<rightarrow>\n      <currentTime> :=\\<^sub>C min\\<^sub>u(&<currentTime> + \\<section>(&<stepSize>), \\<guillemotleft>tN\\<guillemotright>)) \\<box>\n    (&<currentTime> =\\<^sub>u \\<guillemotleft>tN\\<guillemotright>) &\\<^sub>u tm:endc \\<^bold>\\<rightarrow> Stop) ;; Step\n  \\<bullet> (<currentTime>, <stepSize>) :=\\<^sub>C (\\<guillemotleft>ct\\<guillemotright>, \\<guillemotleft>hc\\<guillemotright>) ;; Step\nend\"\n\n(*<*)\n(*\ntext \\<open>The same process definition using axiomatic variables. FIX!\\<close>\n\ndefinition\n\"process AvarTimer(ct::TIME('\\<tau>), hc::NZTIME('\\<tau>), tN::TIME('\\<tau>)) \\<triangleq> begin\n  state(ust_store)\n  Step = (\n    (tm:setT?(t : \\<guillemotleft>t \\<le> tN\\<guillemotright>) \\<^bold>\\<rightarrow> {currentTime} :=\\<^sub>C \\<guillemotleft>t\\<guillemotright>) \\<box>\n    (tm:updateSS?(ss) \\<^bold>\\<rightarrow> {stepSize} :=\\<^sub>C \\<guillemotleft>ss\\<guillemotright>) \\<box>\n    (tm:step!(&{currentTime})!(&{stepSize}) \\<^bold>\\<rightarrow>\n      {currentTime} :=\\<^sub>C min\\<^sub>u(&{currentTime} + \\<section>(&{stepSize}), \\<guillemotleft>tN\\<guillemotright>)) \\<box>\n    (&{currentTime} =\\<^sub>u \\<guillemotleft>tN\\<guillemotright>) &\\<^sub>u tm:endc \\<^bold>\\<rightarrow> Stop) ;; Step\n  \\<bullet> ({currentTime}, {stepSize}) :=\\<^sub>C (\\<guillemotleft>ct\\<guillemotright>, \\<guillemotleft>hc\\<guillemotright>) ;; Step\nend\"\n*)\n(*>*)\n\ntext \\<open>Prove that @{const Timer} and @{const DvarTimer} do not diverge.\\<close>\n\nlemma \"pre\\<^sub>R(Timer(ct, hc, tN)) = true\\<^sub>r\"\napply (unfold Timer_def)\napply (rdes_calc)\napply (rel_simp)\ndone\n\nlemma \"pre\\<^sub>R(DvarTimer(ct, hc, tN)) = true\\<^sub>r\"\napply (unfold DvarTimer_def)\napply (rdes_calc)\napply (rel_simp)\ndone\n\nsubsubsection {* \\<open>Interaction\\<close> Process *}\n\ntext \\<open>\n  We here use the type @{typ \"PORT \\<rightharpoonup> VAL\"} for \\<open>rinps\\<close>, rather than the type\n  @{typ \"FMI2COMP \\<rightharpoonup> (VAR \\<rightharpoonup> VAL)\"} as in Figure 4 of D2.2d. Simon developed a\n  separate embedding of partial maps in theory @{theory Pfun}); it may be worth\n  considering using it here too. Importantly, the state space also includes a\n  store for local (deep) variables. I wonder if there is another solution for\n  integrating deep variables into alphabets. We could have, of course, also\n  encoded \\<open>rinps\\<close> as a deep variable, but this would then constrain its type\n  to be a member of the classes @{class \"continuum\"} and @{class \"two\"}.\n\\<close>\n\nalphabet ia_state =\n  rinps :: \"PORT \\<rightharpoonup> VAL\"\n  ia_locals :: \"vstore\"\n\ninstantiation ia_state_ext :: (type) vst\nbegin\ndefinition vstore_lens_ia_state_ext :: \"vstore \\<Longrightarrow> 'a ia_state_scheme\" where\n\"\\<V> = ia_locals\"\ninstance\napply (intro_classes)\napply (simp add: vstore_lens_ia_state_ext_def)\ndone\nend\n\ndefinition\n\"process Interaction \\<triangleq> begin\n  state(ia_state)\n\n  Instantiation = (;;\\<^sub>C i : FMUs \\<bullet>\n    fmi:fmi2Instantiate.(\\<guillemotleft>i\\<guillemotright>)?(sc) \\<^bold>\\<rightarrow> Skip) and\n\n  InstantiationMode =\n    (;;\\<^sub>C (i, x, v) : parameters \\<bullet>\n      fmi:fmi2Set!(\\<guillemotleft>i\\<guillemotright>)!(\\<guillemotleft>x\\<guillemotright>)!(\\<guillemotleft>v\\<guillemotright>)?(st) \\<^bold>\\<rightarrow> Skip) ;;\n    (;;\\<^sub>C i : FMUs \\<bullet>\n      fmi:fmi2SetUpExperiment!(\\<guillemotleft>i\\<guillemotright>)!(\\<guillemotleft>startTime\\<guillemotright>)\n        !(\\<guillemotleft>stopTimeDefined\\<guillemotright>)!(\\<guillemotleft>stopTime\\<guillemotright>)?(st) \\<^bold>\\<rightarrow> Skip) ;;\n    (;;\\<^sub>C i : FMUs \\<bullet>\n      fmi:fmi2EnterInitializationMode.(\\<guillemotleft>i\\<guillemotright>)?(st) \\<^bold>\\<rightarrow> Skip) and\n\n  InitializationMode =\n    (;;\\<^sub>C ((i, x), v) : initialValues \\<bullet>\n      fmi:fmi2Set!(\\<guillemotleft>i\\<guillemotright>)!(\\<guillemotleft>x\\<guillemotright>)!(\\<guillemotleft>v\\<guillemotright>)?(st) \\<^bold>\\<rightarrow> Skip) ;;\n    (;;\\<^sub>C i : FMUs \\<bullet>\n      fmi:fmi2ExitInitializationMode!(\\<guillemotleft>i\\<guillemotright>)?(st) \\<^bold>\\<rightarrow> Skip) and\n\n  TakeOutputs = rinps :=\\<^sub>C \\<guillemotleft>empty\\<guillemotright> ;;\n    (;;\\<^sub>C out : outputs \\<bullet>\n      fmi:fmi2Get.(\\<guillemotleft>FMU out\\<guillemotright>).(\\<guillemotleft>name out\\<guillemotright>)?(v)?(st) \\<^bold>\\<rightarrow>\n        (;;\\<^sub>C inp : pdg out \\<bullet> rinps :=\\<^sub>C &rinps(\\<guillemotleft>inp\\<guillemotright> \\<mapsto> \\<guillemotleft>v\\<guillemotright>)\\<^sub>u)) and\n\n  DistributeInputs = (;;\\<^sub>C inp : inputs \\<bullet>\n    fmi:fmi2Set.(\\<guillemotleft>FMU inp\\<guillemotright>).(\\<guillemotleft>name inp\\<guillemotright>)!(&rinps(\\<guillemotleft>inp\\<guillemotright>)\\<^sub>a)?(st) \\<^bold>\\<rightarrow> Skip) and\n\n  (* Review the function below, Casper hinted some possible issues. I recall\n   * this has to do with the use of fmi2GetMaxStepSize(_). Such ought to be\n   * called before the simulation step is performed via fmi2DoStep(_). Also,\n   * master algorithms may want to enquire the maximum predicted step size of\n   * all FMUs first, before performing any simulation steps. Lastly, it is\n   * not part of the FMI 2.0 Standard, hence should be model it here at all? *)\n\n  Step = (;;\\<^sub>C i : [0..(length FMUs)] \\<bullet>\n    (if i = 0 then\n      ctr:stepToComplete \\<^bold>\\<rightarrow>\n        (fmi:fmi2DoStep.(\\<guillemotleft>FMUs!0\\<guillemotright>).(&<t>).(&<hc>)?(st) \\<^bold>\\<rightarrow> Skip)\n    else if i < (length FMUs) then\n      (\\<mu>\\<^sub>C X \\<bullet>\n        (fmi:fmi2GetBooleanStatusfmi2Terminated.(\\<guillemotleft>FMUs!nat (i-1)\\<guillemotright>)?(b)?(st) \\<^bold>\\<rightarrow> X) \\<box>\n        (fmi:fmi2GetMaxStepSize.(\\<guillemotleft>FMUs!nat (i-1)\\<guillemotright>)?(t)?(st) \\<^bold>\\<rightarrow> X)) \\<box>\n        (fmi:fmi2DoStep.(\\<guillemotleft>FMUs!nat i\\<guillemotright>).(&<t>).(&<hc>)?(st) \\<^bold>\\<rightarrow> Skip)\n    else\n      (\\<mu>\\<^sub>C X \\<bullet>\n        (fmi:fmi2GetBooleanStatusfmi2Terminated.(\\<guillemotleft>FMUs!nat (i-1)\\<guillemotright>)?(b)?(st) \\<^bold>\\<rightarrow> X) \\<box>\n        (fmi:fmi2GetMaxStepSize.(\\<guillemotleft>FMUs!nat (i-1)\\<guillemotright>)?(t)?(st) \\<^bold>\\<rightarrow> X)) \\<box>\n        (ctr:stepAnalysed \\<^bold>\\<rightarrow> Skip)))\n    (* ;; NextStep *) and\n\n  Terminated =\n    (;;\\<^sub>C i : FMUs \\<bullet>\n      fmi:fmi2Terminate.(\\<guillemotleft>i\\<guillemotright>)?(st) \\<^bold>\\<rightarrow> fmi:fmi2FreeInstance.(\\<guillemotleft>i\\<guillemotright>)?(st) \\<^bold>\\<rightarrow> Skip) ;;\n    ctr:endsimulation \\<^bold>\\<rightarrow> Skip and\n\n  slaveInitialized =\n    (tm:endc \\<^bold>\\<rightarrow> Terminated) \\<box>\n    (tm:step?(t)?(hc) \\<^bold>\\<rightarrow> (\n      (<t>, <hc>) :=\\<^sub>C (\\<guillemotleft>t::TIME('\\<tau>)\\<guillemotright>, \\<guillemotleft>hc::NZTIME('\\<tau>)\\<guillemotright>));;\n    TakeOutputs ;; DistributeInputs ;; Step) and\n\n  (* I had to add the sequence ... ;; NextStep below to get around the issue of\n   * mutual recursion in the original CSP model of the Interaction process. *)\n\n  NextStep =\n    (tm:updateSS?(d) \\<^bold>\\<rightarrow> NextStep) \\<box>\n    (tm:setT?(t) \\<^bold>\\<rightarrow> NextStep) \\<box>\n    (slaveInitialized ;; NextStep) \\<box>\n    (Terminated)\n\n  \\<bullet> Instantiation ;; InstantiationMode ;; InitializationMode ;; slaveInitialized ;; NextStep\nend\"\n\ntheorem \"P Interaction\"\napply (unfold Interaction_def)\napply (simp add: circus_syntax Let_def)\noops\n\nlemma \"pre\\<^sub>R(Interaction) = true\\<^sub>r\"\napply (unfold Interaction_def)\napply (simp add: circus_syntax Let_def)\napply (rdes_calc)\noops\n\nsubsubsection {* End Simulation Process *}\n\ndefinition\n\"process endSimulation \\<triangleq> ctr:endsimulation \\<^bold>\\<rightarrow> Skip\"\n\nsubsubsection {* \\<open>FMUStatesManager\\<close> Process *}\n\ntext {* Since we only have a single state component. *}\n\nabbreviation fmu_state :: \"FMUSTATE \\<Longrightarrow> FMUSTATE\" where\n\"fmu_state \\<equiv> 1\\<^sub>L\"\n\ndefinition\n\"process FMUStateManager(i::FMI2COMP) \\<triangleq> begin\n  state(FMUSTATE)\n\n  AllowsGetsAndSets =\n    (fmi:fmi2GetFMUState!(\\<guillemotleft>i\\<guillemotright>)?(s)?(st) \\<^bold>\\<rightarrow>\n      (fmu_state :=\\<^sub>C \\<guillemotleft>s\\<guillemotright>) ;; AllowsGetsAndSets) \\<box>\n    (fmi:fmi2SetFMUState!(\\<guillemotleft>i\\<guillemotright>)!(&fmu_state)?(st) \\<^bold>\\<rightarrow> AllowsGetsAndSets) and\n\n  AllowAGet =\n    (fmi:fmi2GetFMUState!(\\<guillemotleft>i\\<guillemotright>)?(s)?(st) \\<^bold>\\<rightarrow>\n      (fmu_state :=\\<^sub>C \\<guillemotleft>s\\<guillemotright>) ;; AllowsGetsAndSets)\n\n  \\<bullet> fmi:fmi2Instantiate!(\\<guillemotleft>i\\<guillemotright>)?(b) \\<^bold>\\<rightarrow> AllowAGet\nend\"\n\ntext \\<open>The same process definition using deep variables.\\<close>\n\ndefinition\n\"process DVarFMUStateManager(i::FMI2COMP) \\<triangleq> begin\n  state(vstore)\n\n  AllowsGetsAndSets =\n    (fmi:fmi2GetFMUState!(\\<guillemotleft>i\\<guillemotright>)?(s)?(st) \\<^bold>\\<rightarrow>\n      (<fmu_state> :=\\<^sub>C \\<guillemotleft>s\\<guillemotright>) ;; AllowsGetsAndSets) \\<box>\n    (fmi:fmi2SetFMUState!(\\<guillemotleft>i\\<guillemotright>)!(&<fmu_state>)?(st) \\<^bold>\\<rightarrow> AllowsGetsAndSets) and\n\n  AllowAGet =\n    (fmi:fmi2GetFMUState!(\\<guillemotleft>i\\<guillemotright>)?(s)?(st) \\<^bold>\\<rightarrow>\n      (<fmu_state> :=\\<^sub>C \\<guillemotleft>s\\<guillemotright>) ;; AllowsGetsAndSets)\n\n  \\<bullet> fmi:fmi2Instantiate!(\\<guillemotleft>i\\<guillemotright>)?(b) \\<^bold>\\<rightarrow> AllowAGet\nend\"\n\ntext {* \\todo{Write the same process using the axiomatic model.} *}\n\ndefinition\n\"process FMUStatesManager \\<triangleq>\n  (||| i : FMUs \\<bullet> FMUStateManager(i)) \\<triangle> endSimulation\"\n\nsubsubsection {* Error Handling *}\n\ntext {*\n  The encoding of the \\<open>ErrorMonitor\\<close> is a bit more tricky due to the presence\n  of mutual recursion and parametrised actions. Parameters of actions are dealt\n  with through a state component \\<open>st_arg\\<close> to pass the argument. This works as\n  all calls are tail recursive. Mutual recursion is dealt with by defining one\n  of the mutually-recursive actions i.e.~\\<open>StopError\\<close> as a higher-order function\n  \\emph{outside} the scope of the process. Effectively, this mirrors expanding\n  \\<open>StopError\\<close> within the process definition, turning the mutual recursion into\n  a single-recursive action.\n*}\n\nhide_const (open) utp_rea_designs.st -- \\<open>Conflicts with the use of \\<open>st\\<close> below.\\<close>\n\ntext {* Since we only have a single state component. *}\n\nabbreviation st_arg :: \"error \\<Longrightarrow> error\" where\n\"st_arg \\<equiv> 1\\<^sub>L\"\n\ntext {*\n  To break the mutual recursion in the process definition, we encode the local\n  action \\<open>StopError\\<close> as a higher-order action. State component @{const st_arg}\n  is used to pass an argument back to the \\<open>Monitor\\<close> action.\n*}\n\ndefinition\n\"process StopError(Monitor, st, mst) \\<triangleq>\n  (let MonitorCall = (\\<lambda>st. st_arg :=\\<^sub>C \\<guillemotleft>st\\<guillemotright> ;; Monitor) in\n    (\\<guillemotleft>st = mst\\<guillemotright> &\\<^sub>u ctr:error!(\\<guillemotleft>mst\\<guillemotright>) \\<^bold>\\<rightarrow> MonitorCall(st)) \\<box>\n    (\\<guillemotleft>st \\<noteq> mst\\<guillemotright> &\\<^sub>u MonitorCall(st)))\"\n\ndefinition\n\"process ErrorMonitor(mst) \\<triangleq> begin\n  Monitor = (\n    (fmi:fmi2Get?(i)?(n)?(v)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, st, mst)) \\<box>\n    (fmi:fmi2Set?(i)?(n)?(v)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, (fmi2StatusOf st), mst)) \\<box>\n    (fmi:fmi2GetFMUState?(i)?(s)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, st, mst)) \\<box>\n    (fmi:fmi2SetFMUState?(i)?(s)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, st, mst)) \\<box>\n    (fmi:fmi2SetUpExperiment?(i)?(t)?(b)?(hc)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, st, mst)) \\<box>\n    (fmi:fmi2EnterInitializationMode?(i)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, st, mst)) \\<box>\n    (fmi:fmi2ExitInitializationMode?(i)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, st, mst)) \\<box>\n    (fmi:fmi2GetBooleanStatusfmi2Terminated?(i)?(b)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, st, mst)) \\<box>\n    (fmi:fmi2DoStep?(i)?(t)?(hc)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, (fmi2StatusOf st), mst)) \\<box>\n    (fmi:fmi2Terminate?(i)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, st, mst)) \\<box>\n    (fmi:fmi2GetMaxStepSize?(i)?(t)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, st, mst)) \\<box>\n    (fmi:fmi2Instantiate?(i)?(b) \\<^bold>\\<rightarrow>\n      (if b then StopError(Monitor, fmi2OK, mst)\n            else StopError(Monitor, fmi2Fatal, mst))) \\<box>\n    (fmi:fmi2FreeInstance?(i)?(st) \\<^bold>\\<rightarrow> StopError(Monitor, st, mst)))\n\n  \\<bullet> Monitor \\<triangle> (ctr:endsimulation \\<^bold>\\<rightarrow> Skip)\nend\"\n\ndefinition\n\"process ErrorHandler \\<triangleq>\n  ErrorMonitor(fmi2Error)\n    \\<lbrakk>(FMIAPI \\<union> \\<epsilon>(ctr:endsimulation))\\<rbrakk>\\<^sub>C\n  ErrorMonitor(fmi2Fatal)\"\n\ndefinition\n\"process FatalError \\<triangleq>\n  ctr:error.(\\<guillemotleft>fmi2Fatal\\<guillemotright>) \\<^bold>\\<rightarrow> ctr:endsimulation \\<^bold>\\<rightarrow> Skip\"\n\ndefinition\n\"process ShutdownCreated(i) \\<triangleq>\n  (ctr:error.(\\<guillemotleft>fmi2Error\\<guillemotright>) \\<^bold>\\<rightarrow> fmi:fmi2FreeInstance.(\\<guillemotleft>i\\<guillemotright>)?(st) \\<^bold>\\<rightarrow> Skip) \\<box>\n  (fmi:fmi2FreeInstance.(\\<guillemotleft>i\\<guillemotright>)?(st) \\<^bold>\\<rightarrow> Skip)\"\n\ndefinition\n\"process Shutdown(i) \\<triangleq>\n  (fmi:fmi2Instantiate.(\\<guillemotleft>i\\<guillemotright>)?(b) \\<^bold>\\<rightarrow> ShutdownCreated(i) ;; ctr:endsimulation \\<^bold>\\<rightarrow> Skip) \\<box>\n  (ctr:error.(\\<guillemotleft>fmi2Error\\<guillemotright>) \\<^bold>\\<rightarrow> ctr:endsimulation \\<^bold>\\<rightarrow> Skip)\"\n\ndefinition\n\"process ErrorManagement \\<triangleq>\n  (|| i : FMUs \\<bullet> [\\<epsilon>(ctr:error) \\<union> \\<epsilon>(ctr:endsimulation)] Shutdown(i))\"\n\ndefinition\n\"process ErrorManager \\<triangleq> FatalError \\<box> ErrorManagement\"\n\nsubsubsection {* Master Algorithm *}\n\n-- {* \\todo{Check why the below does not pretty-print correctly.} *}\n\ndefinition\n\"process TimedInteraction(t0, hc, tN) \\<triangleq>\n  (Timer(t0, hc, tN) \\<triangle> endSimulation\n    \\<lbrakk>(tm_events \\<union> \\<epsilon>(ctr:endsimulation))\\<rbrakk>\\<^sub>C Interaction) \\\\\n  tm_events \\<union> \\<epsilon>(ctr:stepAnalysed) \\<union> \\<epsilon>(ctr:stepComplete)\"\n\n(* print_theorems *)\n\ndefinition\n\"process MAlgorithm(t0, hc, tN) \\<triangleq>\n  (((TimedInteraction(t0, hc, tN)\n    \\<lbrakk>(\\<epsilon>(ctr:endsimulation) \\<union> \\<epsilon>(fmi:fmi2Instantiate))\\<rbrakk>\\<^sub>C\n      FMUStatesManager) \\<triangle> ErrorManager)\n    \\<lbrakk>(FMIAPI \\<union> \\<epsilon>(ctr:endsimulation) \\<union> \\<epsilon>(ctr:error))\\<rbrakk>\\<^sub>C ErrorHandler)\n  \\\\ \\<epsilon>(ctr:error)\"\n\nsubsection {* Concrete MAs *}\n\ndefinition\n\"process NoStatesManager \\<triangleq>\n  (||| i : FMUs \\<bullet> fmi:fmi2Instantiate!(\\<guillemotleft>i\\<guillemotright>)?(b) \\<^bold>\\<rightarrow> Stop) \\<triangle> endSimulation\"\n\ntheorem \"FMUStatesManager \\<sqsubseteq> NoStatesManager\"\napply (simp add: FMUStatesManager_def NoStatesManager_def)\n-- {* Need monotonicity of interrupt and iterated interleaving to continue. *}\noops\n\n(*<*)\n(*\nsubsection {* FMU Wrapping (TODO) *}\n\ndefinition RUN :: \"'\\<epsilon> set \\<Rightarrow> ('\\<sigma>, '\\<epsilon>) action\" where\n\"RUN evts = undefined\"\n\n(* I think the problem below is that the state space of i_b includes the whole\n   of the reactive alphabet whereas the guard operator only expects a predicate\n   on the state variables... *)\n\ndefinition\n\"process FMUInterface(i::FMI2COMP) \\<triangleq>\nbegin\n  Instantiated =\n    (&<st> =\\<^sub>u \\<guillemotleft>fmi2Fatal\\<guillemotright>) &\\<^sub>u RUN(fmi_events) and\n  Instantiation =\n    (fmi:fmi2Instantiate?\\<^sub>u(i_b : \\<pi>\\<^sub>1(\\<guillemotleft>i_b\\<guillemotright>) =\\<^sub>u \\<guillemotleft>i\\<guillemotright>) \\<rightarrow>\n      ((\\<pi>\\<^sub>2(&i_b) =\\<^sub>u \\<guillemotleft>True\\<guillemotright>) &\\<^sub>u Instantiated))\n  \\<bullet> Instantiation \\<triangle> endSimulation\nend\"\n*)\n(*>*)\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/fmi/fmi.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804196836383, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.32870195899609533}}
{"text": "(*  Title:      HOL/MicroJava/BV/JVM.thy\n\n    Author:     Tobias Nipkow, Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nheader {* \\isaheader{Kildall for the JVM}\\label{sec:JVM} *}\n\ntheory BVExec\nimports\n  \"../DFA/Abstract_BV\"\n  TF_JVM\nbegin\n\ndefinition kiljvm :: \"'addr jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> \n                    'addr instr list \\<Rightarrow> ex_table \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> ty\\<^sub>i' err list\"\nwhere\n  \"kiljvm P mxs mxl T\\<^sub>r is xt \\<equiv>\n  kildall (JVM_SemiType.le P mxs mxl) (JVM_SemiType.sup P mxs mxl) \n          (exec P mxs T\\<^sub>r xt is)\"\n\ndefinition  wt_kildall :: \"'addr jvm_prog \\<Rightarrow> cname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n                         'addr instr list \\<Rightarrow> ex_table \\<Rightarrow> bool\"\nwhere\n  \"wt_kildall P C' Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<equiv>\n   0 < size is \\<and> \n   (let first  = Some ([],[OK (Class C')]@(map OK Ts)@(replicate mxl\\<^sub>0 Err));\n        start  = OK first#(replicate (size is - 1) (OK None));\n        result = kiljvm P mxs (1+size Ts+mxl\\<^sub>0) T\\<^sub>r is xt  start\n    in \\<forall>n < size is. result!n \\<noteq> Err)\"\n\ndefinition wf_jvm_prog\\<^sub>k :: \"'addr jvm_prog \\<Rightarrow> bool\"\nwhere\n  \"wf_jvm_prog\\<^sub>k P \\<equiv>\n  wf_prog (\\<lambda>P C' (M,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). wt_kildall P C' Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt) P\"\n\n\ntheorem (in start_context) is_bcv_kiljvm:\n  \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n(*<*)\n  apply (insert wf)\n  apply (unfold kiljvm_def)\n  apply (fold r_def f_def step_def_exec)\n  apply (rule is_bcv_kildall)\n       apply simp\n       apply (rule Semilat.intro)\n       apply (fold sl_def2, erule semilat_JVM)\n      apply simp\n      apply blast\n     apply (simp add: JVM_le_unfold)\n    apply (rule exec_pres_type)\n   apply (rule bounded_step)\n  apply (erule step_mono)\n  done\n(*>*)\n\n(* FIXME: move? *)\nlemma subset_replicate [intro?]: \"set (replicate n x) \\<subseteq> {x}\"\n  by (induct n) auto\n\nlemma in_set_replicate:\n  assumes \"x \\<in> set (replicate n y)\"\n  shows \"x = y\"\n(*<*)\nproof -\n  note assms\n  also have \"set (replicate n y) \\<subseteq> {y}\" ..\n  finally show ?thesis by simp\nqed\n(*>*)\n\nlemma (in start_context) start_in_A [intro?]:\n  \"0 < size is \\<Longrightarrow> start \\<in> list (size is) A\"\n  using Ts C\n(*<*)\n  apply (simp add: JVM_states_unfold) \n  apply (force intro!: listI list_appendI dest!: in_set_replicate)\n  done   \n(*>*)\n\n\ntheorem (in start_context) wt_kil_correct:\n  assumes wtk: \"wt_kildall P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n  shows \"\\<exists>\\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n(*<*)\nproof -\n  from wtk obtain res where    \n    result:   \"res = kiljvm P mxs mxl T\\<^sub>r is xt start\" and\n    success:  \"\\<forall>n < size is. res!n \\<noteq> Err\" and\n    instrs:   \"0 < size is\" \n    by (unfold wt_kildall_def) simp\n      \n  have bcv: \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n    by (rule is_bcv_kiljvm)\n    \n  from instrs have \"start \\<in> list (size is) A\" ..\n  with bcv success result have \n    \"\\<exists>ts\\<in>list (size is) A. start [\\<sqsubseteq>\\<^sub>r] ts \\<and> wt_step r Err step ts\"\n    by (unfold is_bcv_def) blast\n  then obtain \\<tau>s' where\n    in_A: \"\\<tau>s' \\<in> list (size is) A\" and\n    s:    \"start [\\<sqsubseteq>\\<^sub>r] \\<tau>s'\" and\n    w:    \"wt_step r Err step \\<tau>s'\"\n    by blast\n  hence wt_err_step: \"wt_err_step (sup_state_opt P) step \\<tau>s'\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n\n  from in_A have l: \"size \\<tau>s' = size is\" by simp  \n  moreover {\n    from in_A  have \"check_types P mxs mxl \\<tau>s'\" by (simp add: check_types_def)\n    also from w have \"\\<forall>x \\<in> set \\<tau>s'. x \\<noteq> Err\" \n      by (auto simp add: wt_step_def all_set_conv_all_nth)\n    hence [symmetric]: \"map OK (map ok_val \\<tau>s') = \\<tau>s'\" \n      by (auto intro!: map_idI simp add: wt_step_def)\n    finally  have \"check_types P mxs mxl (map OK (map ok_val \\<tau>s'))\" .\n  } \n  moreover {  \n    from s have \"start!0 \\<sqsubseteq>\\<^sub>r \\<tau>s'!0\" by (rule le_listD) simp\n    moreover\n    from instrs w l \n    have \"\\<tau>s'!0 \\<noteq> Err\" by (unfold wt_step_def) simp\n    then obtain \\<tau>s0 where \"\\<tau>s'!0 = OK \\<tau>s0\" by auto\n    ultimately\n    have \"wt_start P C Ts mxl\\<^sub>0 (map ok_val \\<tau>s')\" using l instrs\n      by (unfold wt_start_def) \n         (simp add: lesub_def JVM_le_Err_conv Err.le_def)\n  }\n  moreover \n  from in_A have \"set \\<tau>s' \\<subseteq> A\" by simp  \n  with wt_err_step bounded_step\n  have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\<tau>s')\"\n    by (auto intro: wt_err_imp_wt_app_eff simp add: l)\n  ultimately\n  have \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\<tau>s')\"\n    using instrs by (simp add: wt_method_def2 check_types_def del: map_map)\n  thus ?thesis by blast\nqed\n(*>*)\n\n\ntheorem (in start_context) wt_kil_complete:\n  assumes wtm: \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n  shows \"wt_kildall P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\"\n(*<*)\nproof -\n  from wtm obtain\n    instrs:   \"0 < size is\" and\n    length:   \"length \\<tau>s = length is\" and \n    ck_type:  \"check_types P mxs mxl (map OK \\<tau>s)\" and\n    wt_start: \"wt_start P C Ts mxl\\<^sub>0 \\<tau>s\" and\n    app_eff:  \"wt_app_eff (sup_state_opt P) app eff \\<tau>s\"\n    by (simp add: wt_method_def2 check_types_def)\n\n  from ck_type\n  have in_A: \"set (map OK \\<tau>s) \\<subseteq> A\" \n    by (simp add: check_types_def)  \n  with app_eff in_A bounded_step\n  have \"wt_err_step (sup_state_opt P) (err_step (size \\<tau>s) app eff) (map OK \\<tau>s)\"\n    by - (erule wt_app_eff_imp_wt_err,\n          auto simp add: exec_def length states_def)\n  hence wt_err: \"wt_err_step (sup_state_opt P) step (map OK \\<tau>s)\" \n    by (simp add: length)\n  have is_bcv: \"is_bcv r Err step (size is) A (kiljvm P mxs mxl T\\<^sub>r is xt)\"\n    by (rule is_bcv_kiljvm)\n  moreover from instrs have \"start \\<in> list (size is) A\" ..\n  moreover\n  let ?\\<tau>s = \"map OK \\<tau>s\"  \n  have less_\\<tau>s: \"start [\\<sqsubseteq>\\<^sub>r] ?\\<tau>s\"\n  proof (rule le_listI)\n    from length instrs\n    show \"length start = length (map OK \\<tau>s)\" by simp\n  next\n    fix n\n    from wt_start have \"P \\<turnstile> ok_val (start!0) \\<le>' \\<tau>s!0\" \n      by (simp add: wt_start_def)\n    moreover from instrs length have \"0 < length \\<tau>s\" by simp\n    ultimately have \"start!0 \\<sqsubseteq>\\<^sub>r ?\\<tau>s!0\" \n      by (simp add: JVM_le_Err_conv lesub_def)\n    moreover {\n      fix n'\n      have \"OK None \\<sqsubseteq>\\<^sub>r ?\\<tau>s!n\"\n        by (auto simp add: JVM_le_Err_conv Err.le_def lesub_def \n                 split: err.splits)\n      hence \"\\<lbrakk>n = Suc n'; n < size start\\<rbrakk> \\<Longrightarrow> start!n \\<sqsubseteq>\\<^sub>r ?\\<tau>s!n\" by simp\n    }\n    ultimately\n    show \"n < size start \\<Longrightarrow> start!n \\<sqsubseteq>\\<^sub>r ?\\<tau>s!n\" by (cases n, blast+)   \n  qed\n  moreover\n  from ck_type length\n  have \"?\\<tau>s \\<in> list (size is) A\"\n    by (auto intro!: listI simp add: check_types_def)\n  moreover\n  from wt_err have \"wt_step r Err step ?\\<tau>s\" \n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  ultimately\n  have \"\\<forall>p. p < size is \\<longrightarrow> kiljvm P  mxs mxl T\\<^sub>r is xt start ! p \\<noteq> Err\" \n    by (unfold is_bcv_def) blast\n  with instrs \n  show \"wt_kildall P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt\" by (unfold wt_kildall_def) simp\nqed\n(*>*)\n\n\ntheorem jvm_kildall_correct:\n  \"wf_jvm_prog\\<^sub>k P = wf_jvm_prog P\"\n(*<*)\nproof \n  let ?\\<Phi> = \"\\<lambda>C M. let (C,Ts,T\\<^sub>r,meth) = method P C M; (mxs,mxl\\<^sub>0,is,xt) = the meth in \n              SOME \\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n\n  -- \"soundness\"\n  assume wt: \"wf_jvm_prog\\<^sub>k P\"\n  hence \"wf_jvm_prog\\<^bsub>?\\<Phi>\\<^esub> P\"\n    apply (unfold wf_jvm_prog_phi_def wf_jvm_prog\\<^sub>k_def)\n    apply (erule wf_prog_lift)\n    apply (auto intro: someI_ex[OF start_context.wt_kil_correct [OF start_context.intro]])\n    done\n  thus \"wf_jvm_prog P\" by (unfold wf_jvm_prog_def) fast\nnext\n  -- \"completeness\"\n  assume wt: \"wf_jvm_prog P\"\n  thus \"wf_jvm_prog\\<^sub>k P\"\n    apply (unfold wf_jvm_prog_def wf_jvm_prog_phi_def wf_jvm_prog\\<^sub>k_def)\n    apply (clarify)\n    apply (erule wf_prog_lift)\n    apply (auto intro!: start_context.wt_kil_complete start_context.intro)\n    done\nqed\n(*>*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/BV/BVExec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7310585903489892, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.3285323458650258}}
{"text": "(*  Title:      JinjaThreads/Common/Conform.thy\n    Author:     David von Oheimb, Tobias Nipkow, Andreas Lochbihler\n\n    Based on the Jinja theory Common/Conform.thy by David von Oheimb and Tobias Nipkow\n*)\n\nsection \\<open>Conformance Relations for Type Soundness Proofs\\<close>\n\ntheory Conform\nimports\n  StartConfig\nbegin\n\ncontext heap_base begin\n\ndefinition conf :: \"'m prog \\<Rightarrow> 'heap \\<Rightarrow> 'addr val \\<Rightarrow> ty \\<Rightarrow> bool\"   (\"_,_ \\<turnstile> _ :\\<le> _\"  [51,51,51,51] 50)\nwhere \"P,h \\<turnstile> v :\\<le> T  \\<equiv> \\<exists>T'. typeof\\<^bsub>h\\<^esub> v = Some T' \\<and> P \\<turnstile> T' \\<le> T\"\n\ndefinition lconf :: \"'m prog \\<Rightarrow> 'heap \\<Rightarrow> (vname \\<rightharpoonup> 'addr val) \\<Rightarrow> (vname \\<rightharpoonup> ty) \\<Rightarrow> bool\"   (\"_,_ \\<turnstile> _ '(:\\<le>') _\" [51,51,51,51] 50)\nwhere \"P,h \\<turnstile> l (:\\<le>) E  \\<equiv> \\<forall>V v. l V = Some v \\<longrightarrow> (\\<exists>T. E V = Some T \\<and> P,h \\<turnstile> v :\\<le> T)\"\n\nabbreviation confs :: \"'m prog \\<Rightarrow> 'heap \\<Rightarrow> 'addr val list \\<Rightarrow> ty list \\<Rightarrow> bool\" (\"_,_ \\<turnstile> _ [:\\<le>] _\" [51,51,51,51] 50)\nwhere \"P,h \\<turnstile> vs [:\\<le>] Ts  ==  list_all2 (conf P h) vs Ts\"\n\ndefinition tconf :: \"'m prog \\<Rightarrow> 'heap \\<Rightarrow> 'thread_id \\<Rightarrow> bool\" (\"_,_ \\<turnstile> _ \\<surd>t\" [51,51,51] 50)\nwhere \"P,h \\<turnstile> t \\<surd>t \\<equiv> \\<exists>C. typeof_addr h (thread_id2addr t) = \\<lfloor>Class_type C\\<rfloor> \\<and> P \\<turnstile> C \\<preceq>\\<^sup>* Thread\"\n\nend\n\nlocale heap_conf_base =\n  heap_base +\n  constrains addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  fixes hconf :: \"'heap \\<Rightarrow> bool\"\n  and P :: \"'m prog\"\n\nsublocale heap_conf_base < prog P .\n\nlocale heap_conf = \n  heap\n    addr2thread_id thread_id2addr\n    spurious_wakeups\n    empty_heap allocate typeof_addr heap_read heap_write \n    P\n  +\n  heap_conf_base\n    addr2thread_id thread_id2addr\n    spurious_wakeups\n    empty_heap allocate typeof_addr heap_read heap_write \n    hconf P\n  for addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  and hconf :: \"'heap \\<Rightarrow> bool\" \n  and P :: \"'m prog\" \n  +\n  assumes hconf_empty [iff]: \"hconf empty_heap\"\n  and typeof_addr_is_type: \"\\<lbrakk> typeof_addr h a = \\<lfloor>hT\\<rfloor>; hconf h \\<rbrakk> \\<Longrightarrow> is_type P (ty_of_htype hT)\"\n  and hconf_allocate_mono: \"\\<And>a. \\<lbrakk> (h', a) \\<in> allocate h hT; hconf h; is_htype P hT \\<rbrakk> \\<Longrightarrow> hconf h'\"\n  and hconf_heap_write_mono:\n  \"\\<And>T. \\<lbrakk> heap_write h a al v h'; hconf h; P,h \\<turnstile> a@al : T; P,h \\<turnstile> v :\\<le> T \\<rbrakk> \\<Longrightarrow> hconf h'\"\n\nlocale heap_progress =\n  heap_conf\n    addr2thread_id thread_id2addr\n    spurious_wakeups\n    empty_heap allocate typeof_addr heap_read heap_write\n    hconf P\n  for addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  and hconf :: \"'heap \\<Rightarrow> bool\" \n  and P :: \"'m prog\" \n  +\n  assumes heap_read_total: \"\\<lbrakk> hconf h; P,h \\<turnstile> a@al : T \\<rbrakk> \\<Longrightarrow> \\<exists>v. heap_read h a al v \\<and> P,h \\<turnstile> v :\\<le> T\"\n  and heap_write_total: \"\\<lbrakk> hconf h; P,h \\<turnstile> a@al : T; P,h \\<turnstile> v :\\<le> T \\<rbrakk> \\<Longrightarrow> \\<exists>h'. heap_write h a al v h'\"\n\nlocale heap_conf_read =\n  heap_conf\n    addr2thread_id thread_id2addr\n    spurious_wakeups\n    empty_heap allocate typeof_addr heap_read heap_write\n    hconf P\n  for addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  and hconf :: \"'heap \\<Rightarrow> bool\" \n  and P :: \"'m prog\" \n  +\n  assumes heap_read_conf: \"\\<lbrakk> heap_read h a al v; P,h \\<turnstile> a@al : T; hconf h \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T\"\n\nlocale heap_typesafe =\n  heap_conf_read +\n  heap_progress +\n  constrains addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  and hconf :: \"'heap \\<Rightarrow> bool\"\n  and P :: \"'m prog\"\n\ncontext heap_conf begin\n\nlemmas hconf_heap_ops_mono = \n  hconf_allocate_mono\n  hconf_heap_write_mono\n\nend\n\nsubsection\\<open>Value conformance \\<open>:\\<le>\\<close>\\<close>\n\ncontext heap_base begin\n\nlemma conf_Null [simp]: \"P,h \\<turnstile> Null :\\<le> T  =  P \\<turnstile> NT \\<le> T\"\nunfolding conf_def by(simp (no_asm))\n\nlemma typeof_conf[simp]: \"typeof\\<^bsub>h\\<^esub> v = Some T \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T\"\nunfolding conf_def by (cases v) auto\n\nlemma typeof_lit_conf[simp]: \"typeof v = Some T \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T\"\nby (rule typeof_conf[OF typeof_lit_typeof])\n\nlemma defval_conf[simp]: \"P,h \\<turnstile> default_val T :\\<le> T\"\nunfolding conf_def by (cases T) auto\n\nlemma conf_widen: \"P,h \\<turnstile> v :\\<le> T \\<Longrightarrow> P \\<turnstile> T \\<le> T' \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T'\"\nunfolding conf_def by (cases v) (auto intro: widen_trans)\n\nlemma conf_sys_xcpt:\n  \"\\<lbrakk>preallocated h; C \\<in> sys_xcpts\\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> Addr (addr_of_sys_xcpt C) :\\<le> Class C\"\nby(simp add: conf_def typeof_addr_sys_xcp)\n\nlemma conf_NT [iff]: \"P,h \\<turnstile> v :\\<le> NT = (v = Null)\"\nby (auto simp add: conf_def)\n\nlemma is_IntgI: \"P,h \\<turnstile> v :\\<le> Integer \\<Longrightarrow> is_Intg v\"\nby (unfold conf_def) auto\n\nlemma is_BoolI: \"P,h \\<turnstile> v :\\<le> Boolean \\<Longrightarrow> is_Bool v\"\nby (unfold conf_def) auto\n\nlemma is_RefI: \"P,h \\<turnstile> v :\\<le> T \\<Longrightarrow> is_refT T \\<Longrightarrow> is_Ref v\"\nby(cases v)(auto elim: is_refT.cases simp add: conf_def is_Ref_def)\n\nlemma non_npD:\n  \"\\<lbrakk> v \\<noteq> Null; P,h \\<turnstile> v :\\<le> Class C; C \\<noteq> Object \\<rbrakk> \n  \\<Longrightarrow> \\<exists>a C'. v = Addr a \\<and> typeof_addr h a = \\<lfloor>Class_type C'\\<rfloor> \\<and> P \\<turnstile> C' \\<preceq>\\<^sup>* C\"\nby(cases v)(auto simp add: conf_def widen_Class)\n\nlemma non_npD2:\n  \"\\<lbrakk>v \\<noteq> Null; P,h \\<turnstile> v :\\<le> Class C \\<rbrakk>\n  \\<Longrightarrow> \\<exists>a hT. v = Addr a \\<and> typeof_addr h a = \\<lfloor>hT\\<rfloor> \\<and> P \\<turnstile> class_type_of hT \\<preceq>\\<^sup>* C\"\nby(cases v)(auto simp add: conf_def widen_Class)\n\nend\n\ncontext heap begin\n\nlemma conf_hext: \"\\<lbrakk> h \\<unlhd> h'; P,h \\<turnstile> v :\\<le> T \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> v :\\<le> T\"\nunfolding conf_def by(cases v)(auto dest: typeof_addr_hext_mono)\n\nlemma conf_heap_ops_mono:\n  assumes \"P,h \\<turnstile> v :\\<le> T\"\n  shows conf_allocate_mono: \"(h', a) \\<in> allocate h hT \\<Longrightarrow> P,h' \\<turnstile> v :\\<le> T\"\n  and conf_heap_write_mono: \"heap_write h a al v' h' \\<Longrightarrow> P,h' \\<turnstile> v :\\<le> T\"\nusing assms\nby(auto intro: conf_hext dest: hext_heap_ops)\n\nend\n\nsubsection\\<open>Value list conformance \\<open>[:\\<le>]\\<close>\\<close>\n\ncontext heap_base begin\n\nlemma confs_widens [trans]: \"\\<lbrakk>P,h \\<turnstile> vs [:\\<le>] Ts; P \\<turnstile> Ts [\\<le>] Ts'\\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> vs [:\\<le>] Ts'\"\nby (rule list_all2_trans)(rule conf_widen)\n\nlemma confs_rev: \"P,h \\<turnstile> rev s [:\\<le>] t = (P,h \\<turnstile> s [:\\<le>] rev t)\"\nby(rule list_all2_rev1)\n\nlemma confs_conv_map:\n  \"P,h \\<turnstile> vs [:\\<le>] Ts' = (\\<exists>Ts. map typeof\\<^bsub>h\\<^esub> vs = map Some Ts \\<and> P \\<turnstile> Ts [\\<le>] Ts')\"\napply(induct vs arbitrary: Ts')\n apply simp\napply(case_tac Ts')\napply(auto simp add:conf_def)\napply(rule_tac x=\"T' # Ts\" in exI)\napply(simp add: fun_of_def)\ndone\n\nlemma confs_Cons2: \"P,h \\<turnstile> xs [:\\<le>] y#ys = (\\<exists>z zs. xs = z#zs \\<and> P,h \\<turnstile> z :\\<le> y \\<and> P,h \\<turnstile> zs [:\\<le>] ys)\"\nby (rule list_all2_Cons2)\n\nend\n\ncontext heap begin\n\nlemma confs_hext: \"P,h \\<turnstile> vs [:\\<le>] Ts \\<Longrightarrow> h \\<unlhd> h' \\<Longrightarrow> P,h' \\<turnstile> vs [:\\<le>] Ts\"\nby (erule list_all2_mono, erule conf_hext, assumption)\n\nend\n\nsubsection \\<open>Local variable conformance\\<close>\n\ncontext heap_base begin\n\nlemma lconf_upd:\n  \"\\<lbrakk> P,h \\<turnstile> l (:\\<le>) E; P,h \\<turnstile> v :\\<le> T; E V = Some T \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> l(V\\<mapsto>v) (:\\<le>) E\"\nunfolding lconf_def by auto\n\nlemma lconf_empty [iff]: \"P,h \\<turnstile> Map.empty (:\\<le>) E\"\nby(simp add:lconf_def)\n\nlemma lconf_upd2: \"\\<lbrakk>P,h \\<turnstile> l (:\\<le>) E; P,h \\<turnstile> v :\\<le> T\\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> l(V\\<mapsto>v) (:\\<le>) E(V\\<mapsto>T)\"\nby(simp add:lconf_def)\n\nend\n\ncontext heap begin\n\nlemma lconf_hext: \"\\<lbrakk> P,h \\<turnstile> l (:\\<le>) E; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> l (:\\<le>) E\"\nunfolding lconf_def by(fast elim: conf_hext)\n\nend\n\nsubsection \\<open>Thread object conformance\\<close>\n\ncontext heap_base begin\n\nlemma tconfI: \"\\<lbrakk> typeof_addr h (thread_id2addr t) = \\<lfloor>Class_type C\\<rfloor>; P \\<turnstile> C \\<preceq>\\<^sup>* Thread \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> t \\<surd>t\"\nby(simp add: tconf_def)\n\nlemma tconfD: \"P,h \\<turnstile> t \\<surd>t \\<Longrightarrow> \\<exists>C. typeof_addr h (thread_id2addr t) = \\<lfloor>Class_type C\\<rfloor> \\<and> P \\<turnstile> C \\<preceq>\\<^sup>* Thread\"\nby(auto simp add: tconf_def)\n\nend\n\ncontext heap begin\n \nlemma tconf_hext_mono: \"\\<lbrakk> P,h \\<turnstile> t \\<surd>t; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> t \\<surd>t\"\nby(auto simp add: tconf_def dest: typeof_addr_hext_mono)\n\nlemma tconf_heap_ops_mono:\n  assumes \"P,h \\<turnstile> t \\<surd>t\"\n  shows tconf_allocate_mono: \"(h', a) \\<in> allocate h hT \\<Longrightarrow> P,h' \\<turnstile> t \\<surd>t\"\n  and tconf_heap_write_mono: \"heap_write h a al v h' \\<Longrightarrow> P,h' \\<turnstile> t \\<surd>t\"\nusing tconf_hext_mono[OF assms, of h']\nby(blast intro: hext_heap_ops)+\n\nlemma tconf_start_heap_start_tid:\n  \"\\<lbrakk> start_heap_ok; wf_syscls P \\<rbrakk> \\<Longrightarrow> P,start_heap \\<turnstile> start_tid \\<surd>t\"\nunfolding start_tid_def start_heap_def start_heap_ok_def start_heap_data_def initialization_list_def addr_of_sys_xcpt_def start_addrs_def sys_xcpts_list_def \napply(clarsimp split: prod.split_asm simp add: create_initial_object_simps split: if_split_asm)\napply(erule not_empty_pairE)+\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule allocate_SomeD[where hT=\"Class_type Thread\"])\n apply simp\napply(rule tconfI)\n apply(erule typeof_addr_hext_mono[OF hext_allocate])+\n apply simp\napply blast\ndone\n\nlemma start_heap_write_typeable:\n  assumes \"WriteMem ad al v \\<in> set start_heap_obs\"\n  shows \"\\<exists>T. P,start_heap \\<turnstile> ad@al : T \\<and> P,start_heap \\<turnstile> v :\\<le> T\"\nusing assms\nunfolding start_heap_obs_def start_heap_def\nby clarsimp\n\nend\n\nsubsection \\<open>Well-formed start state\\<close>\n\ncontext heap_base begin\n\ninductive wf_start_state :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> 'addr val list \\<Rightarrow> bool\"\nfor P :: \"'m prog\" and C :: cname and M :: mname and vs :: \"'addr val list\"\nwhere\n  wf_start_state:\n  \"\\<lbrakk> P \\<turnstile> C sees M:Ts\\<rightarrow>T = \\<lfloor>meth\\<rfloor> in D; start_heap_ok; P,start_heap \\<turnstile> vs [:\\<le>] Ts \\<rbrakk>\n  \\<Longrightarrow> wf_start_state P C M vs\"\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Common/Conform.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.689305616785446, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.32850903032383977}}
{"text": "theory Logic\nimports\n  DirectLogic\nbegin\n\n\n\nfun unpairMsg :: \"execmsg \\<Rightarrow> trace\"\nwhere\n  \"unpairMsg (Tup x y) = MkUnt x y # unpairMsg x @ unpairMsg y\"\n| \"unpairMsg m         = []\"\n\nfun unpairTrace :: \"wt_subst \\<Rightarrow> trace \\<Rightarrow> trace\"\nwhere\n  \"unpairTrace s [] = []\"\n| \"unpairTrace s (MkStep tid (Send l msg) # es) = \n     MkStep tid (Send l msg) # \n     unpairMsg (subst s (spec2exec msg tid)) @\n     unpairTrace s es\"\n| \"unpairTrace s (MkDecr m k # es) =\n     MkDecr m k # \n     unpairMsg m @ \n     unpairTrace s es\"\n| \"unpairTrace s (e # es) = e # unpairTrace s es\"\n\nthm reachable_eout_extend_wts\n\nlemma unpairTrace_append [simp]:\n  \"unpairTrace s (t@t') = unpairTrace s t @ unpairTrace s t'\"\n  by(induct t rule: unpairTrace.induct, auto)\n\nlemma extend_wts_assoc:\n  \"extend_wts (extend_wts s s') s'' = extend_wts s (extend_wts s' s'')\"\n  sorry\n\n\nlemma reachable_unpairTrace_extend_wts [simp]:\n  \"(t, r, s) \\<in> reachable P\n   \\<Longrightarrow> unpairTrace (extend_wts s s') t = unpairTrace s t\"\n  apply(induct arbitrary: s' rule: reachable.induct)\n  apply(simp_all add: extend_wts_assoc extend_wts_conv_subst \n                      reachable_Send_ground)\n  done\n\nlemma knows_unpairTrace_subset: \n  \"knows s t \\<subseteq> knows s (unpairTrace s t)\"\n  by(induct t rule: unpairTrace.induct, auto)\n\nlemma reachable_append_unpairMsg:\n  \"\\<lbrakk> (t,r,s) \\<in> reachable P; m \\<in> knows s t \\<rbrakk>\n   \\<Longrightarrow> (t@unpairMsg m, r, s) \\<in> reachable P\"\nproof(induct m arbitrary: t)\n  case (Tup x y) show ?case using prems(3-4)\n    apply(simp)\n    apply(subgoal_tac \"t @ MkUnt x y # unpairMsg x @ unpairMsg y = \n                       (t @ MkUnt x y # unpairMsg x) @ unpairMsg y\")\n    apply(simp only:)\n    apply(rule prems(2))\n    apply(subgoal_tac \"t @ MkUnt x y # unpairMsg x =\n                       (t @ [MkUnt x y]) @ unpairMsg x\")\n    apply(simp only:)\n    apply(rule prems(1))\n    apply(erule reachable.intros)\n    apply(simp_all (no_asm))\n    done\nnext\n  case Lit thus ?case by simp next\n  case Enc thus ?case by simp next\n  case Hash thus ?case by simp next\n  case SK thus ?case by simp next\n  case PK thus ?case by simp next\n  case K thus ?case by simp next\nqed\n\n\nlemma reachable_unpairTrace_reachable:\n  \"(t,r,s) \\<in> reachable P \\<Longrightarrow>\n   (unpairTrace s t, r, s) \\<in> reachable P\"\nproof(induct rule: reachable.induct)\n  case init thus ?case by(simp add: reachable.init)\n  case (create t r s tid R \\<alpha>) thus ?case\n    apply(simp)\n    apply(rotate_tac 1)\n    apply(drule reachable.create)\n    apply(simp+)\n    apply(subgoal_tac \n     \"(\\<lambda>a. if a = tid then Some (newThread R) else r a) =  \n      r(tid \\<mapsto> newThread R)\")\n    apply(simp)\n    apply(rule ext, simp)\n    done\nnext\n  case (recv t r s l msg tid \\<alpha>) thus ?case\n    apply(simp)\n    apply(rule reachable.intros)\n    by(auto elim!: subsetD[OF knows_unpairTrace_subset])\nnext\n  case hash thus ?case\n    apply(simp)\n    apply(rule reachable.intros)\n    by(auto elim!: subsetD[OF knows_unpairTrace_subset])\nnext\n  case encr thus ?case\n    apply(simp)\n    apply(rule reachable.intros)\n    by(auto elim!: subsetD[OF knows_unpairTrace_subset])\nnext\n  case tuple thus ?case\n    apply(simp)\n    apply(rule reachable.intros)\n    by(auto elim!: subsetD[OF knows_unpairTrace_subset])\nnext\n  case untup thus ?case\n    apply(simp)\n    apply(rule reachable.intros)\n    by(auto elim!: subsetD[OF knows_unpairTrace_subset])\nnext\n  case (decr t r s m k) thus ?case\n    apply(simp add: reachable_append_unpairMsg)\n    apply(subgoal_tac \"unpairTrace s t @ MkDecr m k # unpairMsg m =\n                       (unpairTrace s t @ [MkDecr m k]) @ unpairMsg m\")\n    apply(simp only:)\n    apply(rule reachable_append_unpairMsg)\n    apply(erule reachable.intros)\n    by(auto elim!: subsetD[OF knows_unpairTrace_subset])\nnext\n  case (send t r s l msg tid) thus ?case\n    apply(simp add: reachable_append_unpairMsg)\n    apply(subgoal_tac \"unpairTrace s t @ MkStep tid (Send l msg) # unpairMsg (subst s (spec2exec msg tid)) =\n                       (unpairTrace s t @ [MkStep tid (Send l msg)]) @ unpairMsg (subst s (spec2exec msg tid))\")\n    apply(simp only:)\n    apply(rule reachable_append_unpairMsg)\n    apply(erule reachable.intros)\n    by(auto elim!: subsetD[OF knows_unpairTrace_subset])\nqed\n\nlemma unpairTrace_charn:\n  \"\\<lbrakk> m \\<in> knows s t; m' \\<in> unpair m \\<rbrakk> \\<Longrightarrow>\n   m' \\<in> knows s (unpairTrace s t)\"\n  apply(induct m)\n  apply(auto elim!: subsetD[OF knows_unpairTrace_subset])\n  apply(simp add: knows_conv_eout)\n  apply(erule disjE)\n  apply(force simp: IK0_def)\n  apply(clarsimp)\n  apply(case_tac x)\n  apply(case_tac rolestep)\n  apply(simp_all)\n  sorry\n\nfun out :: \"wt_subst \\<Rightarrow> execevent \\<Rightarrow> execmsg set\"\nwhere\n  \"out s (MkStep tid (Send lbl msg)) = \n     unpair (subst s (spec2exec msg tid))\"\n| \"out s (MkStep tid (Recv lbl msg)) = {}\"\n| \"out s (MkTup  x y)       = unpair x \\<union> unpair y\"\n| \"out s (MkUnt  x y)       = unpair x \\<union> unpair y\"\n| \"out s (MkHash m)         = {Hash m}\"\n| \"out s (MkEncr m k)       = {Enc m k}\"\n| \"out s (MkDecr m k)       = unpair m\"\n\ndefinition kn' :: \"state \\<Rightarrow> execmsg \\<Rightarrow> bool\"\nwhere \"kn' q m' = (case q of (t,r,s) \\<Rightarrow> \n                   \\<forall> m \\<in> unpair (subst s m').\n                     m \\<in> IK0 \\<or> (\\<exists> e \\<in> set t. m \\<in> out s e))\"\n\nlemma out_conv_eout:\n  \"out s e = (\\<Union> m \\<in> eout s e. unpair m)\"\n  by(induct e rule: out.induct, auto)\n\nlemma kn'_conv_knows:\n  \"kn' (t,r,s) m' = \n  (\\<forall> m \\<in> unpair m'. subst s m \\<in> knows s (unpairTrace s t))\"\n  apply(simp add: kn'_def)\n  apply(rule iffI)\n  apply(clarify)\n  apply(frule unpair_subst_distr)\n  apply(drule bspec)\n  apply(assumption)\n  apply(simp add: out_conv_eout knows_conv_eout)\n  apply(subgoal_tac \"subst s m \\<in> knows s t\")\n  \n\n\n\nsection{* Secrecy and Authentication Logic *}\n\nsubsection{* Abstract Events *}\n\ndatatype logicevent =\n   DoStep tid rolestep\n | DoHash execmsg\n | DoEncr execmsg execmsg\n | DoDecr execmsg execmsg\n\n\nfun substEv :: \"wt_subst \\<Rightarrow> logicevent \\<Rightarrow> logicevent\"\nwhere\n  \"substEv s (DoStep tid step) = DoStep tid step\"\n| \"substEv s (DoHash m)        = DoHash (subst s m)\"\n| \"substEv s (DoEncr m k)      = DoEncr (subst s m) (subst s k)\"\n| \"substEv s (DoDecr m k)      = DoDecr (subst s m) (subst s k)\"\n\nfun instEv :: \"logicevent \\<Rightarrow> execevent\"\nwhere\n  \"instEv (DoStep tid step) = MkStep tid step\"\n| \"instEv (DoHash m)        = MkHash m\"\n| \"instEv (DoEncr m k)      = MkEncr m k\"\n| \"instEv (DoDecr m k)      = MkDecr m k\"\n\nfun out :: \"wt_subst \\<Rightarrow> execevent \\<Rightarrow> execmsg set\"\nwhere\n  \"out s (MkStep tid (Send lbl msg)) = \n     unpair (subst s (spec2exec msg tid))\"\n| \"out s (MkStep tid (Recv lbl msg)) = {}\"\n| \"out s (MkTup  x y)       = unpair x \\<union> unpair y\"\n| \"out s (MkUnt  x y)       = unpair x \\<union> unpair y\"\n| \"out s (MkHash m)         = {Hash m}\"\n| \"out s (MkEncr m k)       = {Enc m k}\"\n| \"out s (MkDecr m k)       = unpair m\"\n\n\nsubsection{* Predicates *}\n\n\ndefinition kn :: \"state \\<Rightarrow> execmsg \\<Rightarrow> bool\"\nwhere \"kn q m' = (case q of (t,r,s) \\<Rightarrow> \n                   \\<forall> m \\<in> unpair (subst s m').\n                     m \\<in> IK0 \\<or> (\\<exists> e \\<in> set t. m \\<in> out s e))\"\n\ndefinition ev :: \"state \\<Rightarrow> logicevent \\<Rightarrow> bool\"\nwhere \"ev q e \\<equiv> (case q of (t,r,s) \\<Rightarrow> \n                  instEv (substEv s e) \\<in> set t)\"\n\ndefinition learn :: \"state \\<Rightarrow> logicevent \\<Rightarrow> execmsg \\<Rightarrow> bool\"\nwhere \"learn q e m' \\<equiv> (case q of (t,r,s) \\<Rightarrow>  \n                        instEv (substEv s e) \\<in> set t \\<and>                      \n                        (\\<forall> m \\<in> unpair (subst s m'). \n                            m \\<in> IK0 \\<or> \n                            m \\<in> out s (instEv (substEv s e)) \\<or>\n                           (\\<exists> e'. (e',(instEv (substEv s e))) \\<in> firstOccOrd t \\<and>\n                                   m \\<in> out s e')\n                        ) \\<and>\n                        (\\<exists> m \\<in> unpair (subst s m').\n                           m \\<notin> IK0 \\<and> \n                           m \\<in> out s (instEv (substEv s e)) \\<and> \n                          (\\<forall> e'. (e',instEv (substEv s e)) \\<in> firstOccOrd t \\<longrightarrow> \n                                  m \\<notin> out s e'\n                          )\n                        )\n                      )\"\n\ndefinition evbefore :: \"state \\<Rightarrow> logicevent \\<Rightarrow> logicevent \\<Rightarrow> bool\"\nwhere \"evbefore q e1 e2 \\<equiv> (case q of (t,r,s) \\<Rightarrow>  \n                            (instEv (substEv s e1), instEv (substEv s e2))\n                            \\<in> firstOccOrd t)\"\n\ndefinition knbefore :: \"state \\<Rightarrow> execmsg \\<Rightarrow> logicevent \\<Rightarrow> bool\"\nwhere \"knbefore q m' e \\<equiv> (case q of (t,r,s) \\<Rightarrow> \n                           instEv (substEv s e) \\<in> set t \\<and>\n                           (\\<forall> m \\<in> unpair (subst s m').\n                              m \\<in> IK0 \\<or>\n                              (\\<exists> e'. (e',instEv (substEv s e)) \\<in> firstOccOrd t \\<and> \n                                     m \\<in> out s e'\n                              )\n                            )\n                          )\"\n\ndefinition runs :: \"state \\<Rightarrow> tid \\<Rightarrow> role \\<Rightarrow> bool\"\nwhere \"runs q tid R \\<equiv> (case q of (t,r,s) \\<Rightarrow> \n                        (case r tid of\n                          Some (todo,done) \\<Rightarrow> Rep_role R = rev done @ todo\n                        | None             \\<Rightarrow> False))\"\n\nsubsection{* Properties of Conversion Operators *}\n\nlemma out_conv_eout:\n  \"out s e = (\\<Union> m \\<in> eout s e. unpair m)\"\n  by(induct e rule: out.induct, auto)\n\nlemma reachable_instEv_substEv_extend_wts [simp]:\n  \"\\<lbrakk> (t,r,s) \\<in> reachable P; instEv (substEv s e) \\<in> set t \\<rbrakk>\n    \\<Longrightarrow> instEv (substEv (extend_wts s s') e) = instEv (substEv s e)\"\n  apply(induct e rule: substEv.induct)\n  apply(auto simp: extend_wts_conv_subst \n             dest!: reachable_eventMsg_ground)\n  done\n\n\n\nsubsection{* Rules *}\n\nsubsubsection{* Simplification *}\n\nlemma kn_simps [simp]:\n  \"kn q (Tup x y) = (kn q x \\<and> kn q y)\"\n  \"kn q (Lit (EConst c))\"\n  \"kn q (Lit (EHonest a))\"\n  \"kn q (Lit (EveNonce n))\"\n  \"kn q (SK (Lit Eve))\"\n  \"kn q (PK (Lit (EHonest a)))\"\n  \"kn q (K (Lit (EHonest a)) (Lit Eve))\"\n  \"kn q (K (Lit Eve) (Lit (EHonest a)))\"\n  apply(cases q, simp add: add kn_def ball_Un)\n  by(cases q, simp add: IK0_def kn_def image_def)+\n\nlemma knbefore_simps:\n  \"knbefore q (Tup x y) e = (knbefore q x e \\<and> knbefore q y e)\"\n  \"ev q e \\<Longrightarrow> knbefore q (Lit (EConst c)) e\"\n  \"ev q e \\<Longrightarrow> knbefore q (Lit (EHonest a)) e\"\n  \"ev q e \\<Longrightarrow> knbefore q (Lit (EveNonce n)) e\"\n  \"ev q e \\<Longrightarrow> knbefore q (SK (Lit Eve)) e\"\n  \"ev q e \\<Longrightarrow> knbefore q (PK (Lit (EHonest a))) e\"\n  \"ev q e \\<Longrightarrow> knbefore q (K (Lit (EHonest a)) (Lit Eve)) e\"\n  \"ev q e \\<Longrightarrow> knbefore q (K (Lit Eve) (Lit (EHonest a))) e\"\n  apply(cases q, simp add: knbefore_def, force)\n  by(cases q, simp add: IK0_def knbefore_def image_def ev_def)+\n\n\nsubsubsection{* Purely Logical *}\n\nlemma evbeforeD1: \"evbefore q e1 e2 \\<Longrightarrow> ev q e1\"\n  by(auto dest: in_set_firstOccOrd1 simp: evbefore_def ev_def)\n\nlemma evbeforeD2: \"evbefore q e1 e2 \\<Longrightarrow> ev q e2\"\n  by(auto dest: in_set_firstOccOrd2 simp: evbefore_def ev_def)\n\nlemma knbeforeD1: \"knbefore q m e \\<Longrightarrow> kn q m\"\n  by(auto dest!: in_set_firstOccOrd1 simp: knbefore_def kn_def)\n\nlemma knbeforeD2: \"knbefore q m e \\<Longrightarrow> ev q e\"\n  by(auto dest!: in_set_firstOccOrd2 simp: knbefore_def ev_def)\n\nlemma learnD1: \"learn q e m \\<Longrightarrow> ev q e\"\n  by(auto simp: learn_def ev_def)\n\nlemma learnD2: \"learn q e m \\<Longrightarrow> kn q m\"\n  by(auto dest!: in_set_firstOccOrd1 simp add: learn_def kn_def)\n\nlemma ebefore_irr: \"\\<not>evbefore q e e\"\n  by(auto simp: evbefore_def)\n\nlemma ebefore_trans: \"\\<lbrakk> evbefore q e1 e2; evbefore q e2 e3 \\<rbrakk> \\<Longrightarrow> evbefore q e1 e3\"\n  by(auto simp: evbefore_def intro: firstOccOrd_trans)\n\nlemma learn_fun: \n  \"\\<lbrakk> learn q e1 m; learn q e2 m \\<rbrakk> \n  \\<Longrightarrow> instEv (substEv (sts q) e1) = instEv (substEv (sts q) e2)\"\n  apply(clarsimp simp: learn_def)\n  apply(drule firstOccOrd_cases)\n  apply(assumption)\n  apply(erule disjE)\n  apply(simp)\n  apply(erule disjE)\n  apply(thin_tac \"\\<forall> x \\<in> ?X. ?P x\")\n  apply(drule_tac x=ma in bspec)\n  apply(force)\n  apply(simp)\n  apply(force)\n  apply(auto)\n  by(auto simp: learn_def dest: firstOccOrd_cases)\n\nlemma learn_knbefore_evbefore:\n  \"\\<lbrakk> learn q e1 m; knbefore q m e2 \\<rbrakk> \\<Longrightarrow> evbefore q e1 e2\"\n  apply(clarsimp simp: learn_def knbefore_def evbefore_def)\n  apply(drule_tac y=\"instEv (substEv ya e2)\" in firstOccOrd_cases)\n  apply(drule in_set_firstOccOrd2, simp)\n  apply(safe)\n  apply(force)\n  apply(subgoal_tac \"(e', instEv (substEv ya e1)) \\<in> firstOccOrd xa\")\n  apply(force)\n  apply(rule firstOccOrd_trans)\n  apply(auto)\n  done\n\nlemma runs_fun: \"\\<lbrakk> runs q tid R1; runs q tid R2 \\<rbrakk> \\<Longrightarrow> R1 = R2\"\n  by(auto simp: runs_def Rep_role_inject[symmetric] split: option.splits )\n\nsubsubsection{* Role Order *}\n\n \nlemma evbefore_roleOrd:\n  \"\\<lbrakk> ev q (DoStep tid step);  runs q tid R;\n     (prev, step) \\<in> roleOrd R; q \\<in> reachable P \\<rbrakk> \n   \\<Longrightarrow> evbefore q (DoStep tid prev) (DoStep tid step)\"\n  apply(clarsimp simp: ev_def evbefore_def firstOccOrd_def runs_def\n                split: option.splits)\n  apply(rename_tac t r s todo \"done\")\n  apply(unfold roleOrd_def)\n  apply(rule reachable_roleOrd)\n  apply(assumption)\n  apply(assumption)\n  apply(auto dest: reachable_todo_notin_trace reachable_done_in_trace in_set_listOrd2)\n  done\n\n\nsubsubsection{* Input Messages *}\n\nfun einp :: \"wt_subst \\<Rightarrow> execevent \\<Rightarrow> execmsg set\"\nwhere\n  \"einp s (MkStep tid (Send l m)) = {}\"\n| \"einp s (MkStep tid (Recv l m)) = {subst s (spec2exec m tid)}\"\n| \"einp s (MkHash m)              = {m}\"\n| \"einp s (MkTup x y)             = {x, y}\"\n| \"einp s (MkUnt x y)             = {Tup x y}\"\n| \"einp s (MkEncr m k)            = {m, k}\"\n| \"einp s (MkDecr m k)            = {Enc m k, inv k}\"\n\nfun inp :: \"logicevent \\<Rightarrow> execmsg set\"\nwhere\n  \"inp (DoStep tid (Send l m)) = {}\"\n| \"inp (DoStep tid (Recv l m)) = unpair (spec2exec m tid)\"\n| \"inp (DoHash m)            = unpair m\"\n| \"inp (DoEncr m k)          = unpair m \\<union> unpair k\"\n| \"inp (DoDecr m k)          = insert (Enc m k) (unpair (inv k))\"\n\n\nlemma einp_ground_by_eventMsg_ground:\n  \"\\<lbrakk> m \\<in> einp s e; ground (eventMsg s e) \\<rbrakk> \\<Longrightarrow> ground m\"\n  by(induct e rule: einp.induct, auto)\n\nlemma reachable_einp_extend_wts [simp]:\n  \"\\<lbrakk> (t,r,s) \\<in> reachable P; e \\<in> set t \\<rbrakk>\n    \\<Longrightarrow> einp (extend_wts s s') e = einp s e\"\n  apply(induct rule: einp.induct)\n  apply(auto dest: reachable_eventMsg_ground \n             simp: extend_wts_conv_subst)\n  done\n\nlemma reachable_knows_einp:\n  \"\\<lbrakk> (t,r,s) \\<in> reachable P; e \\<in> set t; m \\<in> einp s e \\<rbrakk>\n   \\<Longrightarrow> m \\<in> knows s t\"\nthm reachable_knows_extend_wts\n\nthm reachable_einp_extend_wts\n\n  by(induct arbitrary: e rule: reachable.induct, auto)\n\nlemma reachable_knows_before_einp:\n  \"\\<lbrakk> (t,r,s) \\<in> reachable P; e \\<in> set t; m \\<in> einp s e \\<rbrakk>\n   \\<Longrightarrow> \n   m \\<in> IK0 \\<or> (\\<exists> e' \\<in> set t. (e', e) \\<in> firstOccOrd t \\<and> m \\<in> eout s e')\"\n  apply(induct arbitrary: e m rule: reachable.induct)\n  apply(simp_all)\n  apply(erule disjE, simp)\n  apply(force intro!: firstOccOrd_appendI1)\n  apply((thin_tac \"dom_wts ?x = ?X\")?, (thin_tac \"ran_wts ?x = ?X\")?)\n  apply(case_tac \"e \\<in> set t\")\n  apply(force intro!: firstOccOrd_appendI1)\n  apply(force simp: knows_conv_eout intro!: firstOccOrd_appendI2)\n  apply(case_tac \"e \\<in> set t\")\n  apply(force intro!: firstOccOrd_appendI1)\n  apply(force simp: knows_conv_eout intro!: firstOccOrd_appendI2)\n  apply(case_tac \"e \\<in> set t\")\n  apply(force intro!: firstOccOrd_appendI1)\n  apply(force simp: knows_conv_eout intro!: firstOccOrd_appendI2)\n  apply(case_tac \"e \\<in> set t\")\n  apply(force intro!: firstOccOrd_appendI1)\n  apply(force simp: knows_conv_eout intro!: firstOccOrd_appendI2)\n  apply(case_tac \"e \\<in> set t\")\n  apply(force intro!: firstOccOrd_appendI1)\n  apply(force simp: knows_conv_eout intro!: firstOccOrd_appendI2)\n  apply(case_tac \"e \\<in> set t\")\n  apply(force intro!: firstOccOrd_appendI1)\n  apply(force simp: knows_conv_eout intro!: firstOccOrd_appendI2)\n  done\n\n\n\nlemma Recv_knbefore:\n  \"\\<lbrakk>  ev q (DoStep tid (Recv l msg)); \n      m \\<in> unpair (spec2exec msg tid); \n      q \\<in> reachable P \\<rbrakk> \n   \\<Longrightarrow> knbefore q m (DoStep tid (Recv l msg))\"\n  apply(cases q, rename_tac t r s)\n  apply(simp add: ev_def knbefore_def)\n  apply(drule reachable_knows_before_einp, assumption, simp)\n  apply(drule unpair_subst_distr)\n  apply(simp add: out_conv_eout knows_conv_eout)\n  apply(erule disjE)\n  apply(drule in_IK0_by_unpair, assumption, simp)\n  apply(force)\n  done\n\nlemma Hash_knbefore:\n  \"\\<lbrakk>  ev q (DoHash m'); m \\<in> unpair m'; q \\<in> reachable P \\<rbrakk> \n   \\<Longrightarrow> knbefore q m (DoHash m')\"\n  apply(cases q, rename_tac t r s)\n  apply(simp add: ev_def knbefore_def)\n  apply(drule reachable_knows_before_einp, assumption, simp)\n  apply(drule unpair_subst_distr)\n  apply(simp add: out_conv_eout knows_conv_eout)\n  apply(erule disjE)\n  apply(drule in_IK0_by_unpair, assumption, simp)\n  apply(force)\n  done\n\nlemma Encr_knbefore_msg:\n  \"\\<lbrakk>  ev q (DoEncr m' k'); m \\<in> unpair m'; q \\<in> reachable P \\<rbrakk> \n   \\<Longrightarrow> knbefore q m (DoEncr m' k')\"\n  apply(cases q, rename_tac t r s)\n  apply(simp add: ev_def knbefore_def)\n  apply(drule reachable_knows_before_einp, assumption)\n  apply(simp, rule disjI1, rule refl)\n  apply(drule unpair_subst_distr)\n  apply(simp add: out_conv_eout knows_conv_eout)\n  apply(erule disjE)\n  apply(drule in_IK0_by_unpair, assumption, simp)\n  apply(force)\n  done\n\nlemma Encr_knbefore_key:\n  \"\\<lbrakk>  ev q (DoEncr m' k'); m \\<in> unpair k'; q \\<in> reachable P \\<rbrakk> \n   \\<Longrightarrow> knbefore q m (DoEncr m' k')\"\n  apply(cases q, rename_tac t r s)\n  apply(simp add: ev_def knbefore_def)\n  apply(drule reachable_knows_before_einp, assumption)\n  apply(simp, rule disjI2, rule refl)\n  apply(drule unpair_subst_distr)\n  apply(simp add: out_conv_eout knows_conv_eout)\n  apply(erule disjE)\n  apply(drule in_IK0_by_unpair, assumption, simp)\n  apply(force)\n  done\n\nlemma Decr_knbefore_enc:\n  \"\\<lbrakk>  ev q (DoDecr m k); q \\<in> reachable P \\<rbrakk> \n   \\<Longrightarrow> knbefore q (Enc m k) (DoDecr m k)\"\n  apply(cases q, rename_tac t r s)\n  apply(simp add: ev_def knbefore_def)\n  apply(drule reachable_knows_before_einp, assumption)\n  apply(simp, rule disjI1, rule refl)\n  apply(force simp: out_conv_eout knows_conv_eout)\n  done\n\nlemma Decr_knbefore_key:\n  \"\\<lbrakk>  ev q (DoDecr m' k'); m \\<in> unpair (inv k'); q \\<in> reachable P \\<rbrakk> \n   \\<Longrightarrow> knbefore q m (DoDecr m' k')\"\n  apply(cases q, rename_tac t r s)\n  apply(simp add: ev_def knbefore_def)\n  apply(drule reachable_knows_before_einp, assumption)\n  apply(simp, rule disjI2, rule refl)\n  apply(drule unpair_subst_distr)\n  apply(simp add: out_conv_eout knows_conv_eout)\n  apply(erule disjE)\n  apply(drule in_IK0_by_unpair, assumption, simp)\n  apply(force)\n  done\n\n\nlemmas Hash_kn = knbeforeD1[OF Hash_knbefore, rule_format]\n\n\n\nsubsubsection{* Decryption Chains *}\n\ntypes chain = \"(specmsg \\<times> specmsg) list \\<times> specmsg\"\n\nfun msgChains :: \"specmsg \\<Rightarrow> chain list\"\nwhere\n  \"msgChains (Lit (SNonce n))      = [([], Lit (SNonce n))]\"\n| \"msgChains (Lit (SVar (MVar n))) = [([], Lit (SVar (MVar n)))]\"\n| \"msgChains (Lit _)               = []\"\n| \"msgChains (Tup x y) = msgChains x @ msgChains y\"\n| \"msgChains (Enc m k) = \n     ([], Enc m k) # \n     map (\\<lambda> (encs,end). ((m,k)#encs,end)) (msgChains m)\"\n| \"msgChains (Hash m)  = [([], Hash m)]\"\n| \"msgChains (K a b)   = [([], K a b) ]\"\n| \"msgChains (PK a)    = [([], PK a)  ]\"\n| \"msgChains (SK a)    = [([], SK a)  ]\"\n\nfun chainStart :: \"chain \\<Rightarrow> specmsg\"\nwhere\n  \"chainStart ([],start)  = start\"\n| \"chainStart ((m,k)#_,_) = Enc m k\"\n\nfun chainEnd :: \"chain \\<Rightarrow> specmsg\"\nwhere \n  \"chainEnd (_,end) = end\"\n\nlemma chainEnd_in_parts:\n  \"c \\<in> set (msgChains msg) \\<Longrightarrow> chainEnd c \\<in> parts msg\"\n  apply(induct msg arbitrary: c, case_tac lit)\n  apply(auto)\n  by(case_tac varid, auto)\n\n(* if there are no long-term-keys in the parts of the message \n   then chain end is not part of it *)\nlemma no_ltkeys_chainEnd: \n  \"\\<lbrakk> no_ltkeys msg; c \\<in> set (msgChains msg) \\<rbrakk> \\<Longrightarrow> \n   K a b \\<noteq> chainEnd c \\<and> PK a \\<noteq> chainEnd c \\<and> SK a \\<noteq> chainEnd c\"\n  apply(induct msg arbitrary: c, case_tac lit)\n  apply(simp_all)\n  apply(case_tac varid)\n  by(simp+, force+)\n\n\nfun chain :: \"state \\<Rightarrow> tid \\<Rightarrow> chain \\<Rightarrow> bool\"\nwhere\n  \"chain q tid ([],      _  ) = True\"\n| \"chain q tid ([(m,k)], end) = \n     learn q (DoDecr (spec2exec m tid) \n                     (spec2exec k tid)) \n             (spec2exec end tid)\"\n| \"chain q tid ((m,k)#(m',k')#encs, end) =\n    (learn q (DoDecr (spec2exec m tid) \n                     (spec2exec k tid)) \n             (spec2exec (Enc m' k') tid)\n     \\<and> chain q tid ((m',k')#encs, end)\n    )\"\n\nlemma kn_rolemap_inv: \n  \"kn (t, r', s) m \\<Longrightarrow> kn (t, r, s) m\"\n  by(simp add: kn_def)\n\n(*\nlemma reachable_kn_extend_wts [simp]:\n  \"\\<lbrakk> (t,r,s) \\<in> reachable P \\<rbrakk>\n  \\<Longrightarrow> kn (t,r, extend_wts s s') m = kn (t,r,s) m\"\n  apply(simp add: kn_def)\n\n*)\n\nlemma kn_substI: \"kn q m \\<Longrightarrow> kn q (subst (sts q) m)\"\n  by(auto simp: kn_def)\n\nlemma kn_substE: \n  \"\\<lbrakk> kn q (subst s m); subst (sts q) (subst s m) = subst (sts q) m \\<rbrakk>\n  \\<Longrightarrow> kn q m\"\n  by(auto simp: kn_def)\n\nthm extend_wts_conv_subst\n\nlemma subst_subdomain: \n  \"dom_wts s' \\<subseteq> dom_wts s \\<Longrightarrow> subst s' (subst s m) = subst s m\"\n  apply(induct m rule: subst.induct, simp_all)\n  apply(case_tac \"l \\<in> dom_wts s\")\n  apply(auto simp: dom_wts_def)\n  done\n\nlemma substEv_subdomain:\n  \"dom_wts s' \\<subseteq> dom_wts s \\<Longrightarrow> substEv s' (substEv s e) = substEv s e\"\n  by(induct e rule: substEv.induct, auto intro!: subst_subdomain)\n\nlemma reachable_kn_extend_wts [simp]:\n  \"(t,r,s) \\<in> reachable P \\<Longrightarrow> \n   kn (t,r,extend_wts s s') m = kn (t,r,s) (subst (extend_wts s s') m)\"\n  apply(subgoal_tac \"subst s (subst (extend_wts s s') m) = \n                     subst (extend_wts s s') m\")\n  apply(auto simp: kn_def out_conv_eout\n           intro!: subst_subdomain)\n  done\n\n\n\nlemma reachable_learn_extend_wts [simp]:\n  \"(t,r',s) \\<in> reachable P \\<Longrightarrow> \n   learn (t,r,extend_wts s s') e m = \n   learn (t,r',s) (substEv (extend_wts s s') e) (subst (extend_wts s s') m)\"\n  apply(subgoal_tac \"subst s (subst (extend_wts s s') m) = \n                     subst (extend_wts s s') m\")\n  apply(subgoal_tac \"substEv s (substEv (extend_wts s s') e) = \n                     substEv (extend_wts s s') e\")\n  apply(simp add: learn_def out_conv_eout)\n  apply(rule iffI)\n  apply(force dest: in_set_firstOccOrd1)\n  apply(force dest: in_set_firstOccOrd1)\n  apply(auto intro!: substEv_subdomain subst_subdomain)\n  done\n\nlemma Rep_wt_subst_atomic: \"\\<exists> l'. Rep_wt_subst s l = Lit l'\"\n  apply(insert Rep_wt_subst_welltyped[of s])\n  apply(simp add: welltyped_def)\n  apply(drule_tac x=l in spec, auto)\n  done\n\nlemma Rep_wt_subst_noteq_simps [simp]: \n  \"Rep_wt_subst s l \\<noteq> Hash m\"\n  \"Rep_wt_subst s l \\<noteq> Enc m k\"\n  \"Rep_wt_subst s l \\<noteq> Tup x y\"\n  \"Rep_wt_subst s l \\<noteq> PK a\"\n  \"Rep_wt_subst s l \\<noteq> SK a\"\n  \"Rep_wt_subst s l \\<noteq> K a b\"\n  by(insert Rep_wt_subst_atomic[of s l], auto)\n\nlemma kn_append_cases: \n  \"kn (t@t', r, s) m \\<Longrightarrow> \n   kn (t, r, s) m \\<or>\n   (\\<exists> e \\<in> set t'. e \\<notin> set t \\<and> subst s m \\<in> out s e)\"\n  by(auto simp: kn_def)\n\nlemma firstOccOrd_Nil [simp]: \"firstOccOrd [] = {}\"\n  by(simp add: firstOccOrd_def)\n\nlemma firstOccOrd_Snoc1 [simp]: \n  \"x \\<in> set xs \\<Longrightarrow> firstOccOrd (xs@[x]) = firstOccOrd xs\"\n  by(induct xs rule: rev_induct, auto simp: firstOccOrd_def)\n\nlemma firstOccOrd_Snoc2 [simp]:\n  \"x \\<notin> set xs \\<Longrightarrow> \n   firstOccOrd (xs@[x]) = firstOccOrd xs \\<union> { (y,x) | y. y \\<in> set xs }\"\n  by(induct xs rule: rev_induct, auto simp: firstOccOrd_def)\n\nthm if_splits(1)\n\nlemma firstOccOrd_splits:\n  \"P (firstOccOrd (xs@[x])) =\n   ((x \\<in> set xs \\<longrightarrow> P (firstOccOrd xs)) \\<and>\n    (x \\<notin> set xs \\<longrightarrow> P (firstOccOrd xs \\<union> { (y,x) | y. y \\<in> set xs })))\"\n  by(auto, case_tac \"x \\<in> set xs\", auto)\n\nlemma firstOccOrd_decomp: \n  \"(e,e') \\<in> firstOccOrd t \n  \\<Longrightarrow> \\<exists> xs ys zs. t = xs@e#ys@e'#zs \\<and> \n                  e \\<notin> set xs \\<and> e' \\<notin> set xs \\<and> e \\<noteq> e' \\<and> e' \\<notin> set ys\"\n  apply(induct t rule: rev_induct)\n  apply(auto split: firstOccOrd_splits)\n  apply(case_tac \"x \\<in> set xs\")\n  apply(simp_all)\n  apply(force)\n  apply(erule disjE)\n  apply(force)\n  apply(clarsimp)\n  apply(drule split_list_first)\n  apply(clarsimp)\n  apply(auto)\n  done\n\n\nlemma append_eq_append_before_first:\n  \"\\<lbrakk> vs @ y#ws = xs @ y#ys; y \\<notin> set vs; y \\<notin> set xs;\n     x \\<in> set xs \\<rbrakk>\n   \\<Longrightarrow> x \\<in> set vs\"\n  apply(simp add: append_eq_append_conv2)\n  apply(auto)\n  apply(case_tac us)\n  apply(auto)\n  done\n\nlemma firstOccOrd_appendD1: \n  \"\\<lbrakk> (e,e') \\<in> firstOccOrd (t@t'); e' \\<in> set t \\<rbrakk> \\<Longrightarrow> (e,e') \\<in> firstOccOrd t\"\n  apply(drule firstOccOrd_decomp)\n  apply(clarsimp)\n  apply(drule split_list_first)\n  apply(clarsimp)\n  apply(rule firstOccOrd_appendI2)\n  apply(simp_all)\n  apply(simp add: append_eq_append_conv2)\n  apply(auto)\n  apply(case_tac us, auto)\n  apply(case_tac us, auto)\n  done\n\nlemma learn_appendI1: \n  \"learn (t,r,s) e m \\<Longrightarrow> learn (t@t', r', s) e m\"\n  by(auto simp: learn_def dest: firstOccOrd_appendD1)\n\nlemma learn_Snoc_MkTup [simp]:\n  \"learn (t@[MkTup x y],r,s) = learn (t,r,s)\"\n  apply(rule ext, rule ext, rename_tac e m, case_tac e)\n  by(auto simp: learn_def split: firstOccOrd_splits)\n\nlemma learn_Snoc_MkUnt [simp]:\n  \"learn (t@[MkUnt x y],r,s) = learn (t,r,s)\"\n  apply(rule ext, rule ext, rename_tac e m, case_tac e)\n  by(auto simp: learn_def split: firstOccOrd_splits)\n \nlemma runs_free_args:\n  \"runs (t',r,s') = runs (t,r,s)\"\n  by(rule ext,rule ext, simp add: runs_def)\n\n(* TODO: Using Isar this lemma should be removed *)\nlemma chain_Snoc_MkTup_aux [rule_format]:\n  \"q = (t,r,s) \\<longrightarrow> \n   chain (t@[MkTup x y],r,s) tid c = chain q tid c\"\n  by(induct c rule: chain.induct, auto)\n\nlemma chain_Snoc_MkTup [simp]:\n  \"chain (t@[MkTup x y],r,s) = chain (t,r,s)\"\n  by(rule ext, rule ext, auto intro!: chain_Snoc_MkTup_aux)\n\nthm kn_def\n\nlemma learn:\n  \"\\<lbrakk> (t,r,s) \\<in> reachable P; kn (t,r,s) m' \\<rbrakk> \\<Longrightarrow>\n   subst s m' \\<in> IK0 \\<or>\n   (\\<exists> m.   m' = Hash m   \\<and> learn (t,r,s) (DoHash m)   (Hash m)) \\<or>\n   (\\<exists> m k. m' = Enc  m k \\<and> learn (t,r,s) (DoEncr m k) (Enc m k)) \\<or>\n   (\\<exists> R \\<in> P. \\<exists> l msg. Send l msg \\<in> roleEvs R \\<and>\n      (\\<exists> c \\<in> set (msgChains msg). \\<exists> tid.\n         runs (t,r,s) tid R \\<and> \n         learn (t,r,s) (DoStep tid (Send l msg)) \n                       (spec2exec (chainStart c) tid) \\<and>\n         chain (t,r,s) tid c \\<and>\n         subst s m' = subst s (spec2exec (chainEnd c) tid)\n      )\n   )\"\nproof (induct arbitrary: m' rule: reachable.induct)\n  case init thus ?case by(simp add: kn_def)\nnext\n  case (tuple t r s x y) thus ?case\n    apply(simp)\n    apply(subst runs_free_args[where t=t and s=s])\n\n\nnext\n  case (hash t r s m) thus ?case\n    apply(insert kn_append_cases[OF prems(4)])\n    apply(erule disjE)\n    apply(drule prems(2))\n    apply(erule disjE)\n    apply(simp)\n    apply(erule disjE)\n    apply(rule disjI2, rule disjI1)\n    apply(simp add: learn_def)\n    apply(clarsimp)\n\n\n\n    apply(insert prems(1))\n    apply(rule disjI2, rule disjI1)\n\n\n\n  case (create t r s tid R \\<alpha>) show ?case using prems(1,7)\n    apply(drule_tac r=r in kn_rolemap_inv)\n    apply(simp)\n    apply(drule prems(2))\n    apply(erule disjE)\n    apply(subst (asm) subst_subdomain)\n    apply(force)\n    apply(simp)\n    apply(erule disjE)\n    apply(rule disjI2,rule disjI1)\n    apply(clarsimp)\n    apply(cases m')\n    apply(simp_all)\n    apply(erule disjE)\n    apply(rule disjI2, rule disjI2, rule disjI1)\n    apply(cases m')\n    apply(simp_all)\n    apply(rule disjI2, rule disjI2, rule disjI2)\n    apply(clarsimp)\n    apply(case_tac \"tida = tid\")\n    apply(clarsimp)\n    apply(insert prems(3))\n    apply(force simp: runs_def dom_def split: option.splits)\n    apply(rule bexI)\n    apply(rule exI, rule exI, rule conjI)\n    apply(assumption)\n    apply(rule_tac x=\"(a,b)\" in bexI)\n    apply(rule_tac x=\"tida\" in exI)\n    apply(simp add: runs_def)\n    sorry\nnext\n\n\n\nthm reachable_eout_extend_wts\n\n\n    apply(simp add: kn_def out_conv_eout)\n  sorry\n\nlemma learn_Hash:\n  \"\\<lbrakk> q \\<in> reachable P; kn q (Hash m) \\<rbrakk> \\<Longrightarrow>\n   learn q (DoHash m) (Hash m) \\<or>\n   (\\<exists> R \\<in> P. \\<exists> l msg. Send l msg \\<in> roleEvs R \\<and>\n      (\\<exists> c \\<in> set (msgChains msg). \\<exists> tid.\n         runs q tid R \\<and> \n         learn q (DoStep tid (Send l msg)) (spec2exec (chainStart c) tid) \\<and>\n         chain q tid c \\<and>\n         Hash (subst (sts q) m)  = subst (sts q) (spec2exec (chainEnd c) tid)\n      )\n   )\"\n  apply(drule learn, assumption)\n  by(auto simp: IK0_def)\n\nlemma learn_SK:\n  \"\\<lbrakk> q \\<in> reachable P; kn q (SK a) \\<rbrakk> \\<Longrightarrow>\n   subst (sts q) a = Lit Eve\"\n  apply(drule learn, assumption)\n  apply(auto)\n  apply(force simp: IK0_def)\n  apply(case_tac b, case_tac lit)\n  apply(simp_all)\n  apply(insert Rep_wt_subst_welltyped[of \"sts q\"])\n  apply(simp add: welltyped_def)\n  apply(drule_tac x=\"EVar varid tid\" in spec)\n  apply(force)\n  apply(simp add: roleEvs_def)\n  apply(drule Rep_role_Send_no_ltkeys)\n  apply(drule no_ltkeys_chainEnd)\n  apply(assumption)\n  apply(force)\n  done", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/data/isabelle/src/experiments/ImplicitLogic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056040203135, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.32850902424023737}}
{"text": "(*    This file is a part of IsarMathLib - \n    a library of formalized mathematics for Isabelle/Isar.\n\n    Copyright (C) 2005 - 2009  Slawomir Kolodynski\n\n    This program is free software; Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED \nWARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF \nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. \nIN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, \nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, \nPROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; \nOR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, \nWHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \nOTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, \nEVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\nsection \\<open>Integers 3\\<close>\n\ntheory Int_ZF_3 imports Int_ZF_2\n\nbegin\n\ntext\\<open>This theory is a continuation of \\<open>Int_ZF_2\\<close>. We consider \n  here the properties of slopes (almost homomorphisms on integers)\n  that allow to define the order relation and multiplicative\n  inverse on real numbers. We also prove theorems that allow to show \n  completeness of the order relation of real numbers we define in \\<open>Real_ZF\\<close>.\n\\<close>\n\nsubsection\\<open>Positive slopes\\<close>\n\ntext\\<open>This section provides background material for defining the order relation on real numbers.\\<close>\n\ntext\\<open>Positive slopes are functions (of course.)\\<close>\n\nlemma (in int1) Int_ZF_2_3_L1: assumes A1: \"f\\<in>\\<S>\\<^sub>+\" shows \"f:\\<int>\\<rightarrow>\\<int>\"\n  using assms AlmostHoms_def PositiveSet_def by simp\n\ntext\\<open>A small technical lemma to simplify the proof of the next theorem.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L1A: \n  assumes A1: \"f\\<in>\\<S>\\<^sub>+\" and A2: \"\\<exists>n \\<in> f``(\\<int>\\<^sub>+) \\<inter> \\<int>\\<^sub>+. a\\<lsq>n\"\n  shows \"\\<exists>M\\<in>\\<int>\\<^sub>+. a \\<lsq> f`(M)\"\nproof -\n from A1 have \"f:\\<int>\\<rightarrow>\\<int>\"  \"\\<int>\\<^sub>+ \\<subseteq> \\<int>\" \n    using AlmostHoms_def PositiveSet_def by auto\n with A2 show ?thesis using func_imagedef by auto\nqed\n\ntext\\<open>The next lemma is Lemma 3 in the Arthan's paper.\\<close>\n\nlemma (in int1) Arthan_Lem_3: \n  assumes A1: \"f\\<in>\\<S>\\<^sub>+\" and A2: \"D \\<in> \\<int>\\<^sub>+\"\n  shows \"\\<exists>M\\<in>\\<int>\\<^sub>+. \\<forall>m\\<in>\\<int>\\<^sub>+. (m\\<ra>\\<one>)\\<cdot>D \\<lsq> f`(m\\<cdot>M)\" \nproof -\n  let ?E = \"max\\<delta>(f) \\<ra> D\"\n  let ?A = \"f``(\\<int>\\<^sub>+) \\<inter> \\<int>\\<^sub>+\"\n  from A1 A2 have I: \"D\\<lsq>?E\"\n    using Int_ZF_1_5_L3 Int_ZF_2_1_L8 Int_ZF_2_L1A Int_ZF_2_L15D\n    by simp\n  from A1 A2 have \"?A \\<subseteq> \\<int>\\<^sub>+\"  \"?A \\<notin> Fin(\\<int>)\"  \"\\<two>\\<cdot>?E \\<in> \\<int>\" \n    using int_two_three_are_int Int_ZF_2_1_L8 PositiveSet_def Int_ZF_1_1_L5\n    by auto\n  with A1 have \"\\<exists>M\\<in>\\<int>\\<^sub>+.  \\<two>\\<cdot>?E \\<lsq> f`(M)\"\n    using Int_ZF_1_5_L2A Int_ZF_2_3_L1A by simp\n  then obtain M where II: \"M\\<in>\\<int>\\<^sub>+\"  and III: \"\\<two>\\<cdot>?E \\<lsq> f`(M)\"\n    by auto\n  { fix m assume \"m\\<in>\\<int>\\<^sub>+\" then have A4: \"\\<one>\\<lsq>m\"\n      using Int_ZF_1_5_L3 by simp\n    moreover from II III have \"(\\<one>\\<ra>\\<one>) \\<cdot>?E \\<lsq> f`(\\<one>\\<cdot>M)\"\n      using PositiveSet_def Int_ZF_1_1_L4 by simp\n    moreover have \"\\<forall>k. \n      \\<one>\\<lsq>k \\<and> (k\\<ra>\\<one>)\\<cdot>?E \\<lsq> f`(k\\<cdot>M) \\<longrightarrow> (k\\<ra>\\<one>\\<ra>\\<one>)\\<cdot>?E \\<lsq> f`((k\\<ra>\\<one>)\\<cdot>M)\"\n    proof -\n      { fix k assume A5: \"\\<one>\\<lsq>k\"  and A6: \"(k\\<ra>\\<one>)\\<cdot>?E \\<lsq> f`(k\\<cdot>M)\"\n\twith A1 A2 II have T:\n\t  \"k\\<in>\\<int>\"  \"M\\<in>\\<int>\"  \"k\\<ra>\\<one> \\<in> \\<int>\"  \"?E\\<in>\\<int>\"  \"(k\\<ra>\\<one>)\\<cdot>?E \\<in> \\<int>\"  \"\\<two>\\<cdot>?E \\<in> \\<int>\"\n\t  using Int_ZF_2_L1A PositiveSet_def int_zero_one_are_int \n\t    Int_ZF_1_1_L5 Int_ZF_2_1_L8 by auto\n\tfrom A1 A2 A5 II have \n\t  \"\\<delta>(f,k\\<cdot>M,M) \\<in> \\<int>\"   \"abs(\\<delta>(f,k\\<cdot>M,M)) \\<lsq> max\\<delta>(f)\"   \"\\<zero>\\<lsq>D\"\n\t  using Int_ZF_2_L1A PositiveSet_def Int_ZF_1_1_L5 \n\t    Int_ZF_2_1_L7 Int_ZF_2_L16C by auto\n\twith III A6 have \n\t  \"(k\\<ra>\\<one>)\\<cdot>?E \\<ra> (\\<two>\\<cdot>?E \\<rs> ?E) \\<lsq> f`(k\\<cdot>M) \\<ra> (f`(M) \\<ra> \\<delta>(f,k\\<cdot>M,M))\"\n\t  using Int_ZF_1_3_L19A int_ineq_add_sides by simp\n\twith A1 T have \"(k\\<ra>\\<one>\\<ra>\\<one>)\\<cdot>?E \\<lsq> f`((k\\<ra>\\<one>)\\<cdot>M)\"\n\t  using Int_ZF_1_1_L1 int_zero_one_are_int Int_ZF_1_1_L4 \n\t    Int_ZF_1_2_L11 Int_ZF_2_1_L13 by simp\n      } then show ?thesis by simp\n    qed\n    ultimately have \"(m\\<ra>\\<one>)\\<cdot>?E \\<lsq> f`(m\\<cdot>M)\" by (rule Induction_on_int)\n    with A4 I have \"(m\\<ra>\\<one>)\\<cdot>D \\<lsq> f`(m\\<cdot>M)\" using Int_ZF_1_3_L13A\n      by simp\n  } then have \"\\<forall>m\\<in>\\<int>\\<^sub>+.(m\\<ra>\\<one>)\\<cdot>D \\<lsq> f`(m\\<cdot>M)\" by simp\n  with II show ?thesis by auto\nqed\n\ntext\\<open>A special case of \\<open> Arthan_Lem_3\\<close> when $D=1$.\\<close>\n\ncorollary (in int1) Arthan_L_3_spec: assumes A1: \"f \\<in> \\<S>\\<^sub>+\"\n  shows \"\\<exists>M\\<in>\\<int>\\<^sub>+.\\<forall>n\\<in>\\<int>\\<^sub>+. n\\<ra>\\<one> \\<lsq> f`(n\\<cdot>M)\"\nproof -\n  have \"\\<forall>n\\<in>\\<int>\\<^sub>+. n\\<ra>\\<one> \\<in> \\<int>\"\n    using PositiveSet_def int_zero_one_are_int Int_ZF_1_1_L5\n    by simp\n  then have \"\\<forall>n\\<in>\\<int>\\<^sub>+. (n\\<ra>\\<one>)\\<cdot>\\<one> = n\\<ra>\\<one>\"\n    using Int_ZF_1_1_L4 by simp\n  moreover from A1 have \"\\<exists>M\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. (n\\<ra>\\<one>)\\<cdot>\\<one> \\<lsq> f`(n\\<cdot>M)\" \n    using int_one_two_are_pos Arthan_Lem_3 by simp\n  ultimately show ?thesis by simp\nqed\n\ntext\\<open>We know  from \\<open>Group_ZF_3.thy\\<close> that finite range functions are almost homomorphisms. \n  Besides reminding that fact for slopes the next lemma shows \n  that finite range functions do not belong to \\<open>\\<S>\\<^sub>+\\<close>. \n  This is important, because the projection\n  of the set of finite range functions defines zero in the real number construction in \\<open>Real_ZF_x.thy\\<close> \n  series, while the projection of \\<open>\\<S>\\<^sub>+\\<close> becomes the set of (strictly) positive reals. \n  We don't want zero to be positive, do we? The next lemma is a part of Lemma 5 in the Arthan's paper \n  \\cite{Arthan2004}.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L1B: \n  assumes A1: \"f \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\n  shows \"f\\<in>\\<S>\"   \"f \\<notin> \\<S>\\<^sub>+\"\nproof -\n  from A1 show \"f\\<in>\\<S>\" using Int_ZF_2_1_L1 group1.Group_ZF_3_3_L1\n    by auto\n  have \"\\<int>\\<^sub>+ \\<subseteq> \\<int>\" using PositiveSet_def by auto\n  with A1 have \"f``(\\<int>\\<^sub>+) \\<in> Fin(\\<int>)\"\n    using Finite1_L21 by simp\n  then have \"f``(\\<int>\\<^sub>+) \\<inter> \\<int>\\<^sub>+ \\<in> Fin(\\<int>)\"\n    using Fin_subset_lemma by blast\n  thus \"f \\<notin> \\<S>\\<^sub>+\" by auto\nqed\n\ntext\\<open>We want to show that if $f$ is a slope and neither $f$ nor $-f$ are in \\<open>\\<S>\\<^sub>+\\<close>, \n  then $f$ is bounded. The next lemma is the first step towards that goal and \n  shows that if slope is not in \\<open>\\<S>\\<^sub>+\\<close> then $f($\\<open>\\<int>\\<^sub>+\\<close>$)$ is bounded above.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L2: assumes A1: \"f\\<in>\\<S>\" and A2: \"f \\<notin> \\<S>\\<^sub>+\"\n  shows \"IsBoundedAbove(f``(\\<int>\\<^sub>+), IntegerOrder)\"\nproof -\n  from A1 have \"f:\\<int>\\<rightarrow>\\<int>\" using AlmostHoms_def by simp\n  then have \"f``(\\<int>\\<^sub>+) \\<subseteq> \\<int>\" using func1_1_L6 by simp\n  moreover from A1 A2 have \"f``(\\<int>\\<^sub>+) \\<inter> \\<int>\\<^sub>+ \\<in> Fin(\\<int>)\" by auto\n  ultimately show ?thesis using Int_ZF_2_T1 group3.OrderedGroup_ZF_2_L4\n    by simp\nqed\n\ntext\\<open>If $f$ is a slope and $-f\\notin$ \\<open>\\<S>\\<^sub>+\\<close>, then \n  $f($\\<open>\\<int>\\<^sub>+\\<close>$)$ is bounded below.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L3: assumes A1: \"f\\<in>\\<S>\" and A2: \"\\<fm>f \\<notin> \\<S>\\<^sub>+\"\n  shows \"IsBoundedBelow(f``(\\<int>\\<^sub>+), IntegerOrder)\"\nproof -\n  from A1 have T: \"f:\\<int>\\<rightarrow>\\<int>\" using AlmostHoms_def by simp\n  then have \"(\\<sm>(f``(\\<int>\\<^sub>+))) = (\\<fm>f)``(\\<int>\\<^sub>+)\"\n    using Int_ZF_1_T2 group0_2_T2 PositiveSet_def func1_1_L15C\n    by auto\n  with A1 A2 T show \"IsBoundedBelow(f``(\\<int>\\<^sub>+), IntegerOrder)\"\n    using Int_ZF_2_1_L12 Int_ZF_2_3_L2 PositiveSet_def func1_1_L6 \n      Int_ZF_2_T1 group3.OrderedGroup_ZF_2_L5 by simp\nqed\n\ntext\\<open>A slope that is bounded on \\<open>\\<int>\\<^sub>+\\<close> is bounded everywhere.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L4: \n  assumes A1: \"f\\<in>\\<S>\" and A2: \"m\\<in>\\<int>\" \n  and A3: \"\\<forall>n\\<in>\\<int>\\<^sub>+. abs(f`(n)) \\<lsq> L\"\n  shows \"abs(f`(m)) \\<lsq> \\<two>\\<cdot>max\\<delta>(f) \\<ra> L\"\nproof -\n  from A1 A3 have \n    \"\\<zero> \\<lsq> abs(f`(\\<one>))\"  \"abs(f`(\\<one>)) \\<lsq> L\"\n    using int_zero_one_are_int Int_ZF_2_1_L2B int_abs_nonneg int_one_two_are_pos\n    by auto\n  then have II: \"\\<zero>\\<lsq>L\" by (rule Int_order_transitive)\n  note A2\n  moreover have \"abs(f`(\\<zero>)) \\<lsq> \\<two>\\<cdot>max\\<delta>(f) \\<ra> L\"\n  proof -\n    from A1 have \n      \"abs(f`(\\<zero>)) \\<lsq> max\\<delta>(f)\"  \"\\<zero> \\<lsq> max\\<delta>(f)\" \n      and T: \"max\\<delta>(f) \\<in> \\<int>\"\n      using Int_ZF_2_1_L8 by auto\n    with II have \"abs(f`(\\<zero>)) \\<lsq> max\\<delta>(f) \\<ra> max\\<delta>(f) \\<ra> L\"\n      using Int_ZF_2_L15F by simp\n    with T show ?thesis using Int_ZF_1_1_L4 by simp\n  qed\n  moreover from A1 A3 II have \n    \"\\<forall>n\\<in>\\<int>\\<^sub>+. abs(f`(n)) \\<lsq> \\<two>\\<cdot>max\\<delta>(f) \\<ra> L\"\n    using Int_ZF_2_1_L8 Int_ZF_1_3_L5A Int_ZF_2_L15F \n    by simp\n  moreover have \"\\<forall>n\\<in>\\<int>\\<^sub>+. abs(f`(\\<rm>n)) \\<lsq> \\<two>\\<cdot>max\\<delta>(f) \\<ra> L\"\n  proof\n    fix n assume \"n\\<in>\\<int>\\<^sub>+\"\n    with A1 A3 have\n      \"\\<two>\\<cdot>max\\<delta>(f) \\<in> \\<int>\"\n      \"abs(f`(\\<rm>n)) \\<lsq> \\<two>\\<cdot>max\\<delta>(f) \\<ra> abs(f`(n))\"\n      \"abs(f`(n)) \\<lsq> L\"\n      using int_two_three_are_int Int_ZF_2_1_L8 Int_ZF_1_1_L5\n\tPositiveSet_def Int_ZF_2_1_L14 by auto\n    then show \"abs(f`(\\<rm>n)) \\<lsq> \\<two>\\<cdot>max\\<delta>(f) \\<ra> L\"\n      using Int_ZF_2_L15A by blast\n  qed    \n  ultimately show ?thesis by (rule Int_ZF_2_L19B)\nqed\n\ntext\\<open>A slope whose image of the set of positive integers is bounded\n  is a finite range function.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L4A: \n  assumes A1: \"f\\<in>\\<S>\" and A2: \"IsBounded(f``(\\<int>\\<^sub>+), IntegerOrder)\"\n  shows \"f \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\nproof -\n  have T1: \"\\<int>\\<^sub>+ \\<subseteq> \\<int>\" using PositiveSet_def by auto\n  from A1 have T2: \"f:\\<int>\\<rightarrow>\\<int>\" using AlmostHoms_def by simp\n  from A2 obtain L where \"\\<forall>a\\<in>f``(\\<int>\\<^sub>+). abs(a) \\<lsq> L\"\n    using Int_ZF_1_3_L20A by auto\n  with T2 T1 have \"\\<forall>n\\<in>\\<int>\\<^sub>+. abs(f`(n)) \\<lsq> L\"\n    by (rule func1_1_L15B)\n  with A1 have \"\\<forall>m\\<in>\\<int>. abs(f`(m)) \\<lsq> \\<two>\\<cdot>max\\<delta>(f) \\<ra> L\"\n    using Int_ZF_2_3_L4 by simp\n  with T2 have \"f``(\\<int>) \\<in> Fin(\\<int>)\"\n    by (rule Int_ZF_1_3_L20C)\n  with T2 show \"f \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\n    using FinRangeFunctions_def by simp\nqed\n\ntext\\<open>A slope whose image of the set of positive integers is bounded\n  below is a finite range function or a positive slope.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L4B: \n  assumes \"f\\<in>\\<S>\" and \"IsBoundedBelow(f``(\\<int>\\<^sub>+), IntegerOrder)\"\n  shows \"f \\<in> FinRangeFunctions(\\<int>,\\<int>) \\<or> f\\<in>\\<S>\\<^sub>+\"\n  using assms Int_ZF_2_3_L2 IsBounded_def Int_ZF_2_3_L4A\n  by auto\n\ntext\\<open>If one slope is not greater then another on positive integers,\n  then they are almost equal or the difference is a positive slope.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L4C: assumes A1: \"f\\<in>\\<S>\"  \"g\\<in>\\<S>\" and\n  A2: \"\\<forall>n\\<in>\\<int>\\<^sub>+. f`(n) \\<lsq> g`(n)\"\n  shows \"f\\<sim>g \\<or> g \\<fp> (\\<fm>f) \\<in> \\<S>\\<^sub>+\"\nproof -\n  let ?h = \"g \\<fp> (\\<fm>f)\"\n  from A1 have \"(\\<fm>f) \\<in> \\<S>\" using Int_ZF_2_1_L12 \n    by simp\n  with A1 have I: \"?h \\<in> \\<S>\" using Int_ZF_2_1_L12C \n    by simp\n  moreover have \"IsBoundedBelow(?h``(\\<int>\\<^sub>+), IntegerOrder)\"\n  proof -\n    from I have \n      \"?h:\\<int>\\<rightarrow>\\<int>\" and \"\\<int>\\<^sub>+\\<subseteq>\\<int>\" using AlmostHoms_def PositiveSet_def\n      by auto\n    moreover from A1 A2 have \"\\<forall>n\\<in>\\<int>\\<^sub>+. \\<langle>\\<zero>, ?h`(n)\\<rangle> \\<in> IntegerOrder\"\n      using Int_ZF_2_1_L2B PositiveSet_def Int_ZF_1_3_L10A \n\tInt_ZF_2_1_L12 Int_ZF_2_1_L12B Int_ZF_2_1_L12A\n      by simp\n    ultimately show \"IsBoundedBelow(?h``(\\<int>\\<^sub>+), IntegerOrder)\"\n      by (rule func_ZF_8_L1)\n  qed\n  ultimately have \"?h \\<in> FinRangeFunctions(\\<int>,\\<int>) \\<or> ?h\\<in>\\<S>\\<^sub>+\"\n    using Int_ZF_2_3_L4B by simp\n  with A1 show \"f\\<sim>g \\<or> g \\<fp> (\\<fm>f) \\<in> \\<S>\\<^sub>+\"\n    using Int_ZF_2_1_L9C by auto\nqed\n  \ntext\\<open>Positive slopes are arbitrarily large for large enough arguments.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L5: \n  assumes A1: \"f\\<in>\\<S>\\<^sub>+\" and A2: \"K\\<in>\\<int>\"\n  shows \"\\<exists>N\\<in>\\<int>\\<^sub>+. \\<forall>m. N\\<lsq>m \\<longrightarrow> K \\<lsq> f`(m)\"\nproof -\n  from A1 obtain M where I: \"M\\<in>\\<int>\\<^sub>+\" and II: \"\\<forall>n\\<in>\\<int>\\<^sub>+. n\\<ra>\\<one> \\<lsq> f`(n\\<cdot>M)\"\n    using Arthan_L_3_spec by auto\n  let ?j = \"GreaterOf(IntegerOrder,M,K \\<rs> (minf(f,\\<zero>..(M\\<rs>\\<one>)) \\<rs> max\\<delta>(f)) \\<rs> \\<one>)\"\n  from A1 I have T1: \n    \"minf(f,\\<zero>..(M\\<rs>\\<one>)) \\<rs> max\\<delta>(f) \\<in> \\<int>\"  \"M\\<in>\\<int>\"\n    using Int_ZF_2_1_L15 Int_ZF_2_1_L8 Int_ZF_1_1_L5 PositiveSet_def\n    by auto\n  with A2 I have T2: \n    \"K \\<rs> (minf(f,\\<zero>..(M\\<rs>\\<one>)) \\<rs> max\\<delta>(f)) \\<in> \\<int>\"\n    \"K \\<rs> (minf(f,\\<zero>..(M\\<rs>\\<one>)) \\<rs> max\\<delta>(f)) \\<rs> \\<one> \\<in> \\<int>\"\n    using Int_ZF_1_1_L5 int_zero_one_are_int by auto\n  with T1 have III: \"M \\<lsq> ?j\"  and \n    \"K \\<rs> (minf(f,\\<zero>..(M\\<rs>\\<one>)) \\<rs> max\\<delta>(f)) \\<rs> \\<one> \\<lsq> ?j\"\n    using Int_ZF_1_3_L18 by auto\n  with A2 T1 T2 have \n    IV: \"K \\<lsq> ?j\\<ra>\\<one> \\<ra> (minf(f,\\<zero>..(M\\<rs>\\<one>)) \\<rs> max\\<delta>(f))\"\n    using int_zero_one_are_int Int_ZF_2_L9C by simp\n  let ?N = \"GreaterOf(IntegerOrder,\\<one>,?j\\<cdot>M)\"\n  from T1 III have T3: \"?j \\<in> \\<int>\"  \"?j\\<cdot>M \\<in> \\<int>\"\n    using Int_ZF_2_L1A Int_ZF_1_1_L5 by auto\n  then have V: \"?N \\<in> \\<int>\\<^sub>+\" and VI: \"?j\\<cdot>M \\<lsq> ?N\"\n    using int_zero_one_are_int Int_ZF_1_5_L3 Int_ZF_1_3_L18 \n    by auto\n  { fix m\n    let ?n = \"m zdiv M\"\n    let ?k = \"m zmod M\"\n    assume \"?N\\<lsq>m\"\n    with VI have \"?j\\<cdot>M \\<lsq> m\" by (rule Int_order_transitive)\n    with I III have \n      VII: \"m = ?n\\<cdot>M\\<ra>?k\" \n      \"?j \\<lsq> ?n\"  and \n      VIII: \"?n \\<in> \\<int>\\<^sub>+\"  \"?k \\<in> \\<zero>..(M\\<rs>\\<one>)\"\n      using IntDiv_ZF_1_L5 by auto\n    with II have \n      \"?j \\<ra> \\<one> \\<lsq> ?n \\<ra> \\<one>\"  \"?n\\<ra>\\<one> \\<lsq> f`(?n\\<cdot>M)\"\n      using int_zero_one_are_int int_ord_transl_inv by auto\n    then have \"?j \\<ra> \\<one> \\<lsq>  f`(?n\\<cdot>M)\"\n      by (rule Int_order_transitive)\n    with T1 have \n      \"?j\\<ra>\\<one> \\<ra> (minf(f,\\<zero>..(M\\<rs>\\<one>)) \\<rs> max\\<delta>(f)) \\<lsq>  \n      f`(?n\\<cdot>M) \\<ra> (minf(f,\\<zero>..(M\\<rs>\\<one>)) \\<rs> max\\<delta>(f))\"\n      using int_ord_transl_inv by simp\n    with IV have \"K \\<lsq> f`(?n\\<cdot>M) \\<ra> (minf(f,\\<zero>..(M\\<rs>\\<one>)) \\<rs> max\\<delta>(f))\"\n      by (rule Int_order_transitive)\n    moreover from A1 I VIII have\n      \"f`(?n\\<cdot>M) \\<ra> (minf(f,\\<zero>..(M\\<rs>\\<one>))\\<rs> max\\<delta>(f)) \\<lsq> f`(?n\\<cdot>M\\<ra>?k)\"\n      using PositiveSet_def Int_ZF_2_1_L16 by simp\n    ultimately have \"K \\<lsq> f`(?n\\<cdot>M\\<ra>?k)\"\n      by (rule Int_order_transitive)\n    with VII have \"K \\<lsq> f`(m)\" by simp\n    } then have  \"\\<forall>m. ?N\\<lsq>m \\<longrightarrow> K \\<lsq> f`(m)\"\n      by simp\n    with V show ?thesis by auto\nqed\n\ntext\\<open>Positive slopes are arbitrarily small for small enough arguments.\n  Kind of dual to \\<open>Int_ZF_2_3_L5\\<close>.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L5A: assumes A1: \"f\\<in>\\<S>\\<^sub>+\" and A2: \"K\\<in>\\<int>\"\n  shows \"\\<exists>N\\<in>\\<int>\\<^sub>+. \\<forall>m. N\\<lsq>m \\<longrightarrow> f`(\\<rm>m) \\<lsq> K\"\nproof -\n  from A1 have T1: \"abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<in> \\<int>\"\n    using Int_ZF_2_1_L8 by auto\n  with A2 have \"abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> K \\<in> \\<int>\"\n    using Int_ZF_1_1_L5 by simp\n  with A1 have \n    \"\\<exists>N\\<in>\\<int>\\<^sub>+. \\<forall>m. N\\<lsq>m \\<longrightarrow> abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> K \\<lsq> f`(m)\"\n    using Int_ZF_2_3_L5 by simp\n  then obtain N where I: \"N\\<in>\\<int>\\<^sub>+\" and II:\n    \"\\<forall>m. N\\<lsq>m \\<longrightarrow>  abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> K \\<lsq> f`(m)\"\n    by auto\n  { fix m assume A3: \"N\\<lsq>m\"\n    with A1 have\n      \"f`(\\<rm>m) \\<lsq> abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> f`(m)\"\n      using Int_ZF_2_L1A Int_ZF_2_1_L14 by simp\n    moreover\n    from II T1 A3 have \"abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> f`(m) \\<lsq> \n      (abs(f`(\\<zero>)) \\<ra> max\\<delta>(f)) \\<rs>(abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> K)\"\n      using Int_ZF_2_L10 int_ord_transl_inv by simp\n    with A2 T1 have \"abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> f`(m) \\<lsq> K\"\n      using Int_ZF_1_2_L3 by simp\n    ultimately have \"f`(\\<rm>m) \\<lsq> K\"\n      by (rule Int_order_transitive)\n  } then have \"\\<forall>m. N\\<lsq>m  \\<longrightarrow> f`(\\<rm>m) \\<lsq> K\"\n    by simp\n  with I show ?thesis by auto\nqed\n\n(*lemma (in int1) Int_ZF_2_3_L5A: assumes A1: \"f\\<in>\\<S>\\<^sub>+\" and A2: \"K\\<in>\\<int>\"\n  shows \"\\<exists>N\\<in>\\<int>\\<^sub>+. \\<forall>m. m\\<lsq>(\\<rm>N) \\<longrightarrow> f`(m) \\<lsq> K\"\nproof -\n  from A1 have T1: \"abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<in> \\<int>\"\n    using Int_ZF_2_1_L8 by auto;\n  with A2 have \"abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> K \\<in> \\<int>\"\n    using Int_ZF_1_1_L5 by simp;\n  with A1 have \n    \"\\<exists>N\\<in>\\<int>\\<^sub>+. \\<forall>m. N\\<lsq>m \\<longrightarrow> abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> K \\<lsq> f`(m)\"\n    using Int_ZF_2_3_L5 by simp;\n  then obtain N where I: \"N\\<in>\\<int>\\<^sub>+\" and II:\n    \"\\<forall>m. N\\<lsq>m \\<longrightarrow>  abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> K \\<lsq> f`(m)\"\n    by auto;\n  { fix m assume A3: \"m\\<lsq>(\\<rm>N)\"\n    with A1 have T2: \"f`(m) \\<in> \\<int>\"\n      using Int_ZF_2_L1A Int_ZF_2_1_L2B by simp;\n    from A1 I II A3 have\n      \"abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> K \\<lsq> f`(\\<rm>m)\" and\n      \"f`(\\<rm>m) \\<lsq> abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> f`(m)\"\n       using PositiveSet_def Int_ZF_2_L10AA Int_ZF_2_L1A Int_ZF_2_1_L14\n       by auto;\n    then have \n      \"abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> K \\<lsq> abs(f`(\\<zero>)) \\<ra> max\\<delta>(f) \\<rs> f`(m)\"\n      by (rule Int_order_transitive)\n    with T1 A2 T2 have \"f`(m) \\<lsq> K\"\n      using Int_ZF_2_L10AB by simp; \n  } then have \"\\<forall>m. m\\<lsq>(\\<rm>N) \\<longrightarrow> f`(m) \\<lsq> K\"\n    by simp;\n  with I show ?thesis by auto;\nqed;*)\n\ntext\\<open>A special case of \\<open>Int_ZF_2_3_L5\\<close> where $K=1$.\\<close>\n\ncorollary (in int1) Int_ZF_2_3_L6: assumes \"f\\<in>\\<S>\\<^sub>+\"\n  shows \"\\<exists>N\\<in>\\<int>\\<^sub>+. \\<forall>m. N\\<lsq>m \\<longrightarrow> f`(m) \\<in> \\<int>\\<^sub>+\"\n  using assms int_zero_one_are_int Int_ZF_2_3_L5 Int_ZF_1_5_L3\n  by simp\n\ntext\\<open>A special case of \\<open>Int_ZF_2_3_L5\\<close> where $m=N$.\\<close> \n\ncorollary (in int1) Int_ZF_2_3_L6A: assumes \"f\\<in>\\<S>\\<^sub>+\" and \"K\\<in>\\<int>\"\n   shows \"\\<exists>N\\<in>\\<int>\\<^sub>+. K \\<lsq> f`(N)\"\nproof -\n  from assms have \"\\<exists>N\\<in>\\<int>\\<^sub>+. \\<forall>m. N\\<lsq>m \\<longrightarrow> K \\<lsq> f`(m)\"\n    using Int_ZF_2_3_L5 by simp\n  then obtain N where I: \"N \\<in> \\<int>\\<^sub>+\"  and II: \"\\<forall>m. N\\<lsq>m \\<longrightarrow> K \\<lsq> f`(m)\"\n    by auto\n  then show ?thesis using PositiveSet_def int_ord_is_refl refl_def\n    by auto\nqed\n\ntext\\<open>If values of a slope are not bounded above, \n  then the slope is positive.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L7: assumes A1: \"f\\<in>\\<S>\" \n  and A2: \"\\<forall>K\\<in>\\<int>. \\<exists>n\\<in>\\<int>\\<^sub>+. K \\<lsq> f`(n)\"\n  shows \"f \\<in> \\<S>\\<^sub>+\"\nproof -\n  { fix K assume \"K\\<in>\\<int>\"\n    with A2 obtain n where \"n\\<in>\\<int>\\<^sub>+\"  \"K \\<lsq> f`(n)\"\n      by auto\n    moreover from A1 have \"\\<int>\\<^sub>+ \\<subseteq> \\<int>\"  \"f:\\<int>\\<rightarrow>\\<int>\" \n      using PositiveSet_def AlmostHoms_def by auto\n    ultimately have \"\\<exists>m \\<in> f``(\\<int>\\<^sub>+). K \\<lsq> m\" \n      using func1_1_L15D by auto\n  } then have \"\\<forall>K\\<in>\\<int>. \\<exists>m \\<in> f``(\\<int>\\<^sub>+). K \\<lsq> m\" by simp\n  with A1 show \"f \\<in> \\<S>\\<^sub>+\" using Int_ZF_4_L9 Int_ZF_2_3_L2\n    by auto\nqed\n\ntext\\<open>For unbounded slope $f$ either $f\\in$\\<open>\\<S>\\<^sub>+\\<close> of \n  $-f\\in$\\<open>\\<S>\\<^sub>+\\<close>.\\<close>\n\ntheorem (in int1) Int_ZF_2_3_L8:\n  assumes A1: \"f\\<in>\\<S>\" and A2: \"f \\<notin> FinRangeFunctions(\\<int>,\\<int>)\"\n  shows \"(f \\<in> \\<S>\\<^sub>+) Xor ((\\<fm>f) \\<in> \\<S>\\<^sub>+)\"\nproof -\n  have T1: \"\\<int>\\<^sub>+ \\<subseteq> \\<int>\" using PositiveSet_def by auto\n  from A1 have T2: \"f:\\<int>\\<rightarrow>\\<int>\"  using AlmostHoms_def by simp\n  then have I: \"f``(\\<int>\\<^sub>+) \\<subseteq> \\<int>\" using func1_1_L6 by auto\n  from A1 A2 have \"f \\<in> \\<S>\\<^sub>+ \\<or> (\\<fm>f) \\<in> \\<S>\\<^sub>+\"\n    using Int_ZF_2_3_L2 Int_ZF_2_3_L3 IsBounded_def Int_ZF_2_3_L4A\n    by blast\n  moreover have \"\\<not>(f \\<in> \\<S>\\<^sub>+ \\<and> (\\<fm>f) \\<in> \\<S>\\<^sub>+)\"\n  proof -\n    { assume A3: \"f \\<in> \\<S>\\<^sub>+\"  and A4: \"(\\<fm>f) \\<in> \\<S>\\<^sub>+\"\n      from A3 obtain N1 where \n\tI: \"N1\\<in>\\<int>\\<^sub>+\" and II: \"\\<forall>m. N1\\<lsq>m \\<longrightarrow> f`(m) \\<in> \\<int>\\<^sub>+\"\n\tusing Int_ZF_2_3_L6 by auto\n      from A4 obtain N2 where \n\tIII: \"N2\\<in>\\<int>\\<^sub>+\" and IV: \"\\<forall>m. N2\\<lsq>m \\<longrightarrow> (\\<fm>f)`(m) \\<in> \\<int>\\<^sub>+\"\n\tusing Int_ZF_2_3_L6 by auto\n      let ?N = \"GreaterOf(IntegerOrder,N1,N2)\"\n      from I III have \"N1 \\<lsq> ?N\"  \"N2 \\<lsq> ?N\"\n\tusing PositiveSet_def Int_ZF_1_3_L18 by auto\n      with A1 II IV have\n\t\"f`(?N) \\<in> \\<int>\\<^sub>+\"  \"(\\<fm>f)`(?N) \\<in> \\<int>\\<^sub>+\"  \"(\\<fm>f)`(?N) = \\<rm>(f`(?N))\"\n\tusing Int_ZF_2_L1A PositiveSet_def Int_ZF_2_1_L12A\n\tby auto\n      then have False using Int_ZF_1_5_L8 by simp\n    } thus ?thesis by auto\n  qed\n  ultimately show \"(f \\<in> \\<S>\\<^sub>+) Xor ((\\<fm>f) \\<in> \\<S>\\<^sub>+)\"\n    using Xor_def by simp\nqed\n\ntext\\<open>The sum of positive slopes is a positive slope.\\<close>\n\ntheorem (in int1) sum_of_pos_sls_is_pos_sl: \n  assumes A1: \"f \\<in> \\<S>\\<^sub>+\"  \"g \\<in> \\<S>\\<^sub>+\"\n  shows \"f\\<fp>g \\<in> \\<S>\\<^sub>+\"\nproof -\n  { fix K assume \"K\\<in>\\<int>\"\n    with A1 have \"\\<exists>N\\<in>\\<int>\\<^sub>+. \\<forall>m. N\\<lsq>m \\<longrightarrow> K \\<lsq> f`(m)\"\n      using Int_ZF_2_3_L5 by simp\n    then obtain N where I: \"N\\<in>\\<int>\\<^sub>+\" and II: \"\\<forall>m. N\\<lsq>m \\<longrightarrow> K \\<lsq> f`(m)\"\n      by auto\n    from A1 have \"\\<exists>M\\<in>\\<int>\\<^sub>+. \\<forall>m. M\\<lsq>m \\<longrightarrow> \\<zero> \\<lsq> g`(m)\"\n      using int_zero_one_are_int Int_ZF_2_3_L5 by simp\n    then obtain M where III: \"M\\<in>\\<int>\\<^sub>+\" and IV: \"\\<forall>m. M\\<lsq>m \\<longrightarrow> \\<zero> \\<lsq> g`(m)\"\n      by auto\n    let ?L = \"GreaterOf(IntegerOrder,N,M)\"\n    from I III have V: \"?L \\<in> \\<int>\\<^sub>+\"  \"\\<int>\\<^sub>+ \\<subseteq> \\<int>\" \n      using GreaterOf_def PositiveSet_def by auto\n    moreover from A1 V have \"(f\\<fp>g)`(?L) = f`(?L) \\<ra> g`(?L)\"\n      using Int_ZF_2_1_L12B by auto\n    moreover from I II III IV have \"K \\<lsq> f`(?L) \\<ra> g`(?L)\"\n      using PositiveSet_def Int_ZF_1_3_L18 Int_ZF_2_L15F\n      by simp\n    ultimately have \"?L \\<in> \\<int>\\<^sub>+\"  \"K \\<lsq> (f\\<fp>g)`(?L)\"\n      by auto\n    then have \"\\<exists>n \\<in>\\<int>\\<^sub>+. K \\<lsq> (f\\<fp>g)`(n)\"\n      by auto\n  } with A1 show \"f\\<fp>g \\<in> \\<S>\\<^sub>+\"\n    using Int_ZF_2_1_L12C Int_ZF_2_3_L7 by simp\nqed\n\ntext\\<open>The composition of positive slopes is a positive slope.\\<close>\n\ntheorem (in int1) comp_of_pos_sls_is_pos_sl: \n  assumes A1: \"f \\<in> \\<S>\\<^sub>+\"  \"g \\<in> \\<S>\\<^sub>+\"\n  shows \"f\\<circ>g \\<in> \\<S>\\<^sub>+\"\nproof -\n  { fix K assume \"K\\<in>\\<int>\"\n    with A1 have \"\\<exists>N\\<in>\\<int>\\<^sub>+. \\<forall>m. N\\<lsq>m \\<longrightarrow> K \\<lsq> f`(m)\"\n      using Int_ZF_2_3_L5 by simp\n    then obtain N where \"N\\<in>\\<int>\\<^sub>+\" and I: \"\\<forall>m. N\\<lsq>m \\<longrightarrow> K \\<lsq> f`(m)\"\n      by auto\n    with A1 have \"\\<exists>M\\<in>\\<int>\\<^sub>+. N \\<lsq> g`(M)\"\n      using PositiveSet_def Int_ZF_2_3_L6A by simp\n    then obtain M where \"M\\<in>\\<int>\\<^sub>+\"  \"N \\<lsq> g`(M)\"\n      by auto\n    with A1 I have \"\\<exists>M\\<in>\\<int>\\<^sub>+. K \\<lsq> (f\\<circ>g)`(M)\"\n      using PositiveSet_def Int_ZF_2_1_L10\n      by auto\n  } with A1 show \"f\\<circ>g \\<in> \\<S>\\<^sub>+\"\n    using Int_ZF_2_1_L11 Int_ZF_2_3_L7\n    by simp\nqed\n\ntext\\<open>A slope equivalent to a positive one is positive.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L9: \n  assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and A2: \"\\<langle>f,g\\<rangle> \\<in> AlEqRel\" shows \"g \\<in> \\<S>\\<^sub>+\"\nproof -\n  from A2 have T: \"g\\<in>\\<S>\" and \"\\<exists>L\\<in>\\<int>. \\<forall>m\\<in>\\<int>. abs(f`(m)\\<rs>g`(m)) \\<lsq> L\"\n    using Int_ZF_2_1_L9A by auto\n   then obtain L where \n     I: \"L\\<in>\\<int>\"  and II: \"\\<forall>m\\<in>\\<int>. abs(f`(m)\\<rs>g`(m)) \\<lsq> L\"\n     by auto\n  { fix K assume A3: \"K\\<in>\\<int>\"\n    with I have \"K\\<ra>L \\<in> \\<int>\"\n      using Int_ZF_1_1_L5 by simp\n    with A1 obtain M where III: \"M\\<in>\\<int>\\<^sub>+\"  and IV: \"K\\<ra>L \\<lsq> f`(M)\"\n      using Int_ZF_2_3_L6A by auto\n    with A1 A3 I have  \"K \\<lsq> f`(M)\\<rs>L\"\n      using PositiveSet_def Int_ZF_2_1_L2B Int_ZF_2_L9B\n      by simp\n    moreover from A1 T II III have  \n      \"f`(M)\\<rs>L \\<lsq> g`(M)\"\n      using PositiveSet_def Int_ZF_2_1_L2B Int_triangle_ineq2\n      by simp\n    ultimately have \"K \\<lsq>  g`(M)\"\n      by (rule Int_order_transitive)\n    with III have \"\\<exists>n\\<in>\\<int>\\<^sub>+. K \\<lsq> g`(n)\"\n      by auto\n  } with T show \"g \\<in> \\<S>\\<^sub>+\"\n    using Int_ZF_2_3_L7 by simp\nqed\n\ntext\\<open>The set of positive slopes is saturated with respect to the relation of \n  equivalence of slopes.\\<close>\n\nlemma (in int1) pos_slopes_saturated: shows \"IsSaturated(AlEqRel,\\<S>\\<^sub>+)\"\nproof -\n  have \n    \"equiv(\\<S>,AlEqRel)\" \n    \"AlEqRel \\<subseteq> \\<S> \\<times> \\<S>\"\n    using Int_ZF_2_1_L9B by auto\n  moreover have \"\\<S>\\<^sub>+ \\<subseteq> \\<S>\" by auto\n  moreover have \"\\<forall>f\\<in>\\<S>\\<^sub>+. \\<forall>g\\<in>\\<S>. \\<langle>f,g\\<rangle> \\<in> AlEqRel \\<longrightarrow> g \\<in> \\<S>\\<^sub>+\"\n    using Int_ZF_2_3_L9 by blast\n  ultimately show \"IsSaturated(AlEqRel,\\<S>\\<^sub>+)\"\n    by (rule EquivClass_3_L3)\nqed\n  \ntext\\<open>A technical lemma involving a projection of the set of positive slopes\n  and a logical epression with exclusive or.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L10:\n  assumes A1: \"f\\<in>\\<S>\"  \"g\\<in>\\<S>\"\n  and A2: \"R = {AlEqRel``{s}. s\\<in>\\<S>\\<^sub>+}\"\n  and A3: \"(f\\<in>\\<S>\\<^sub>+) Xor (g\\<in>\\<S>\\<^sub>+)\"\n  shows \"(AlEqRel``{f} \\<in> R) Xor (AlEqRel``{g} \\<in> R)\"\nproof -\n  from A1 A2 A3 have \n    \"equiv(\\<S>,AlEqRel)\" \n    \"IsSaturated(AlEqRel,\\<S>\\<^sub>+)\"\n    \"\\<S>\\<^sub>+ \\<subseteq> \\<S>\"\n    \"f\\<in>\\<S>\"  \"g\\<in>\\<S>\"\n    \"R = {AlEqRel``{s}. s\\<in>\\<S>\\<^sub>+}\"\n    \"(f\\<in>\\<S>\\<^sub>+) Xor (g\\<in>\\<S>\\<^sub>+)\"\n    using pos_slopes_saturated Int_ZF_2_1_L9B by auto\n  then show ?thesis by (rule EquivClass_3_L7)\nqed\n\ntext\\<open>Identity function is a positive slope.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L11: shows \"id(\\<int>) \\<in> \\<S>\\<^sub>+\"\nproof -\n  let ?f = \"id(\\<int>)\"\n  { fix K assume \"K\\<in>\\<int>\" \n    then obtain n where T: \"n\\<in>\\<int>\\<^sub>+\" and \"K\\<lsq>n\"\n      using Int_ZF_1_5_L9 by auto\n    moreover from T have \"?f`(n) = n\"\n      using PositiveSet_def by simp\n    ultimately have  \"n\\<in>\\<int>\\<^sub>+\" and \"K\\<lsq>?f`(n)\"\n      by auto\n    then have \"\\<exists>n\\<in>\\<int>\\<^sub>+. K\\<lsq>?f`(n)\" by auto\n  } then show \"?f \\<in> \\<S>\\<^sub>+\"\n    using Int_ZF_2_1_L17 Int_ZF_2_3_L7 by simp\nqed\n      \ntext\\<open>The identity function is not almost equal to any bounded function.\\<close>\n\nlemma (in int1) Int_ZF_2_3_L12: assumes A1: \"f \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\n  shows \"\\<not>(id(\\<int>) \\<sim> f)\"\nproof -\n  { from A1 have \"id(\\<int>) \\<in> \\<S>\\<^sub>+\"\n      using Int_ZF_2_3_L11 by simp\n    moreover assume \"\\<langle>id(\\<int>),f\\<rangle> \\<in> AlEqRel\"\n    ultimately have  \"f \\<in> \\<S>\\<^sub>+\"\n      by (rule Int_ZF_2_3_L9)\n    with A1 have False using Int_ZF_2_3_L1B\n      by simp\n  } then show \"\\<not>(id(\\<int>) \\<sim> f)\" by auto\nqed\n\nsubsection\\<open>Inverting slopes\\<close>\n\ntext\\<open>Not every slope is a 1:1 function. However, we can still invert slopes \n  in the sense that if $f$ is a slope, then we can find a slope $g$ such that\n  $f\\circ g$  is almost equal to the identity function. \n  The goal of this this section is to establish this fact for positive slopes.\n\\<close>\n\ntext\\<open>If $f$ is a positive slope, then for every positive integer $p$ \n  the set $\\{n\\in Z_+: p\\leq f(n)\\}$ is a nonempty subset of positive integers.\n  Recall that $f^{-1}(p)$ is the notation for the smallest element of this set.\\<close>\n\nlemma (in int1) Int_ZF_2_4_L1: \n  assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and A2: \"p\\<in>\\<int>\\<^sub>+\" and A3: \"A = {n\\<in>\\<int>\\<^sub>+. p \\<lsq> f`(n)}\"\n  shows \n  \"A \\<subseteq> \\<int>\\<^sub>+\"  \n  \"A \\<noteq> 0\"\n  \"f\\<inverse>(p) \\<in> A\"\n  \"\\<forall>m\\<in>A. f\\<inverse>(p) \\<lsq> m\"\nproof -\n  from A3 show I: \"A \\<subseteq> \\<int>\\<^sub>+\" by auto\n  from A1 A2 have \"\\<exists>n\\<in>\\<int>\\<^sub>+. p \\<lsq> f`(n)\"\n    using PositiveSet_def Int_ZF_2_3_L6A by simp\n  with A3 show II: \"A \\<noteq> 0\" by auto\n  from A3 I II show \n    \"f\\<inverse>(p) \\<in> A\"\n    \"\\<forall>m\\<in>A. f\\<inverse>(p) \\<lsq> m\"\n    using Int_ZF_1_5_L1C by auto\nqed\n\ntext\\<open>If $f$ is a positive slope and $p$ is a positive integer $p$, then \n   $f^{-1}(p)$ (defined as the minimum of the set $\\{n\\in Z_+: p\\leq f(n)\\}$ ) \n  is a (well defined) positive integer.\\<close>\n\nlemma (in int1) Int_ZF_2_4_L2: \n  assumes \"f \\<in> \\<S>\\<^sub>+\" and \"p\\<in>\\<int>\\<^sub>+\"\n  shows \n  \"f\\<inverse>(p) \\<in> \\<int>\\<^sub>+\" \n  \"p \\<lsq> f`(f\\<inverse>(p))\"\n  using assms Int_ZF_2_4_L1 by auto\n\ntext\\<open>If $f$ is a positive slope and $p$ is a positive integer such \n  that $n\\leq f(p)$, then\n  $f^{-1}(n) \\leq p$.\\<close>\n\nlemma (in int1) Int_ZF_2_4_L3: \n  assumes \"f \\<in> \\<S>\\<^sub>+\" and  \"m\\<in>\\<int>\\<^sub>+\"  \"p\\<in>\\<int>\\<^sub>+\" and \"m \\<lsq> f`(p)\"\n  shows \"f\\<inverse>(m) \\<lsq> p\"\n  using assms Int_ZF_2_4_L1 by simp\n\ntext\\<open>An upper bound $f(f^{-1}(m) -1)$ for positive slopes.\\<close>\n\nlemma (in int1) Int_ZF_2_4_L4: \n  assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and A2: \"m\\<in>\\<int>\\<^sub>+\" and A3: \"f\\<inverse>(m)\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\"\n  shows \"f`(f\\<inverse>(m)\\<rs>\\<one>) \\<lsq> m\"   \"f`(f\\<inverse>(m)\\<rs>\\<one>) \\<noteq> m\"\nproof -\n  from A1 A2 have T: \"f\\<inverse>(m) \\<in> \\<int>\" using Int_ZF_2_4_L2 PositiveSet_def\n    by simp\n  from A1 A3 have \"f:\\<int>\\<rightarrow>\\<int>\"  and \"f\\<inverse>(m)\\<rs>\\<one> \\<in> \\<int>\"\n    using Int_ZF_2_3_L1 PositiveSet_def by auto\n  with A1 A2 have T1: \"f`(f\\<inverse>(m)\\<rs>\\<one>) \\<in> \\<int>\"  \"m\\<in>\\<int>\" \n    using apply_funtype PositiveSet_def by auto\n  { assume \"m \\<lsq> f`(f\\<inverse>(m)\\<rs>\\<one>)\"\n    with A1 A2 A3 have \"f\\<inverse>(m) \\<lsq> f\\<inverse>(m)\\<rs>\\<one>\" \n      by (rule Int_ZF_2_4_L3)\n    with T have False using Int_ZF_1_2_L3AA\n      by simp\n  } then have I: \"\\<not>(m \\<lsq> f`(f\\<inverse>(m)\\<rs>\\<one>))\" by auto\n  with T1 show \"f`(f\\<inverse>(m)\\<rs>\\<one>) \\<lsq> m\"   \n    by (rule Int_ZF_2_L19)\n  from T1 I show \"f`(f\\<inverse>(m)\\<rs>\\<one>) \\<noteq> m\"\n    by (rule Int_ZF_2_L19)\nqed\n\ntext\\<open>The (candidate for) the inverse of a positive slope is nondecreasing.\\<close>\n\nlemma (in int1) Int_ZF_2_4_L5:\n  assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and A2: \"m\\<in>\\<int>\\<^sub>+\" and A3: \"m\\<lsq>n\"\n  shows \"f\\<inverse>(m) \\<lsq> f\\<inverse>(n)\"\nproof -\n  from A2 A3 have T: \"n \\<in> \\<int>\\<^sub>+\" using Int_ZF_1_5_L7 by blast\n  with A1 have \"n \\<lsq> f`(f\\<inverse>(n))\" using Int_ZF_2_4_L2\n    by simp\n  with A3 have \"m \\<lsq> f`(f\\<inverse>(n))\" by (rule Int_order_transitive)\n  with A1 A2 T show \"f\\<inverse>(m) \\<lsq> f\\<inverse>(n)\"\n    using Int_ZF_2_4_L2 Int_ZF_2_4_L3 by simp\nqed\n  \ntext\\<open>If $f^{-1}(m)$ is positive and $n$ is a positive integer, then, \n  then $f^{-1}(m+n)-1$ is positive.\\<close>\n\nlemma (in int1) Int_ZF_2_4_L6: \n  assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and A2: \"m\\<in>\\<int>\\<^sub>+\"  \"n\\<in>\\<int>\\<^sub>+\" and \n  A3: \"f\\<inverse>(m)\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\"\n  shows \"f\\<inverse>(m\\<ra>n)\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\"\nproof -\n  from A1 A2 have \"f\\<inverse>(m)\\<rs>\\<one> \\<lsq>  f\\<inverse>(m\\<ra>n) \\<rs> \\<one>\"\n     using PositiveSet_def Int_ZF_1_5_L7A Int_ZF_2_4_L2 \n       Int_ZF_2_4_L5 int_zero_one_are_int Int_ZF_1_1_L4 \n       int_ord_transl_inv by simp\n  with A3 show \"f\\<inverse>(m\\<ra>n)\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\" using Int_ZF_1_5_L7\n    by blast\nqed\n\ntext\\<open>If $f$ is a slope, then $f(f^{-1}(m+n)-f^{-1}(m) - f^{-1}(n))$ is \n  uniformly bounded above and below. Will it be the messiest IsarMathLib\n  proof ever? Only time will tell.\\<close>\n\nlemma (in int1) Int_ZF_2_4_L7:  assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and\n  A2: \"\\<forall>m\\<in>\\<int>\\<^sub>+. f\\<inverse>(m)\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\"\n  shows \n  \"\\<exists>U\\<in>\\<int>. \\<forall>m\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n)) \\<lsq> U\"\n  \"\\<exists>N\\<in>\\<int>. \\<forall>m\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. N \\<lsq> f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n))\"\nproof -\n  from A1 have \"\\<exists>L\\<in>\\<int>. \\<forall>r\\<in>\\<int>. f`(r) \\<lsq> f`(r\\<rs>\\<one>) \\<ra> L\"\n    using Int_ZF_2_1_L28 by simp\n  then obtain L where \n    I: \"L\\<in>\\<int>\" and II: \"\\<forall>r\\<in>\\<int>. f`(r) \\<lsq> f`(r\\<rs>\\<one>) \\<ra> L\"\n    by auto\n  from A1 have \n    \"\\<exists>M\\<in>\\<int>. \\<forall>r\\<in>\\<int>.\\<forall>p\\<in>\\<int>.\\<forall>q\\<in>\\<int>. f`(r\\<rs>p\\<rs>q) \\<lsq> f`(r)\\<rs>f`(p)\\<rs>f`(q)\\<ra>M\"\n    \"\\<exists>K\\<in>\\<int>. \\<forall>r\\<in>\\<int>.\\<forall>p\\<in>\\<int>.\\<forall>q\\<in>\\<int>. f`(r)\\<rs>f`(p)\\<rs>f`(q)\\<ra>K \\<lsq> f`(r\\<rs>p\\<rs>q)\"\n    using Int_ZF_2_1_L30 by auto\n  then obtain M K where III: \"M\\<in>\\<int>\" and \n    IV: \"\\<forall>r\\<in>\\<int>.\\<forall>p\\<in>\\<int>.\\<forall>q\\<in>\\<int>. f`(r\\<rs>p\\<rs>q) \\<lsq> f`(r)\\<rs>f`(p)\\<rs>f`(q)\\<ra>M\" \n    and \n    V: \"K\\<in>\\<int>\" and VI: \"\\<forall>r\\<in>\\<int>.\\<forall>p\\<in>\\<int>.\\<forall>q\\<in>\\<int>. f`(r)\\<rs>f`(p)\\<rs>f`(q)\\<ra>K \\<lsq> f`(r\\<rs>p\\<rs>q)\"\n    by auto\n  from I III V have \n    \"L\\<ra>M \\<in> \\<int>\"  \"(\\<rm>L) \\<rs> L \\<ra> K \\<in> \\<int>\" \n    using Int_ZF_1_1_L4 Int_ZF_1_1_L5 by auto\n  moreover\n    { fix m n\n      assume A3: \"m\\<in>\\<int>\\<^sub>+\" \"n\\<in>\\<int>\\<^sub>+\" \n      have  \"f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n)) \\<lsq>  L\\<ra>M \\<and> \n\t(\\<rm>L)\\<rs>L\\<ra>K \\<lsq> f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n))\"\n      proof -\n\tlet ?r = \"f\\<inverse>(m\\<ra>n)\"\n\tlet ?p = \"f\\<inverse>(m)\"\n\tlet ?q = \"f\\<inverse>(n)\"\n\tfrom A1 A3 have T1:\n\t  \"?p \\<in> \\<int>\\<^sub>+\"  \"?q \\<in> \\<int>\\<^sub>+\"  \"?r \\<in> \\<int>\\<^sub>+\"\n\t  using Int_ZF_2_4_L2 pos_int_closed_add_unfolded by auto\n\twith A3 have T2:\n\t  \"m \\<in> \\<int>\"  \"n \\<in> \\<int>\"  \"?p \\<in> \\<int>\"  \"?q \\<in> \\<int>\"  \"?r \\<in> \\<int>\" \n\t  using PositiveSet_def by auto\n\tfrom A2 A3 have T3:\n\t  \"?r\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\" \"?p\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\"  \"?q\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\"\n\t  using pos_int_closed_add_unfolded by auto\n\tfrom A1 A3 have VII:\n\t  \"m\\<ra>n \\<lsq> f`(?r)\"\n\t  \"m \\<lsq> f`(?p)\"  \n\t  \"n \\<lsq> f`(?q)\"  \n\t  using Int_ZF_2_4_L2 pos_int_closed_add_unfolded by auto\n\tfrom A1 A3 T3 have VIII:\n\t  \"f`(?r\\<rs>\\<one>) \\<lsq> m\\<ra>n\"\n\t  \"f`(?p\\<rs>\\<one>) \\<lsq> m\"\n\t  \"f`(?q\\<rs>\\<one>) \\<lsq> n\"\n\t  using pos_int_closed_add_unfolded Int_ZF_2_4_L4 by auto\n\thave \"f`(?r\\<rs>?p\\<rs>?q) \\<lsq> L\\<ra>M\"\n\tproof -\n\t  from IV T2 have \"f`(?r\\<rs>?p\\<rs>?q) \\<lsq> f`(?r)\\<rs>f`(?p)\\<rs>f`(?q)\\<ra>M\"\n\t    by simp\n\t  moreover \n\t  from I II T2 VIII have\n\t    \"f`(?r) \\<lsq> f`(?r\\<rs>\\<one>) \\<ra> L\"\n\t    \"f`(?r\\<rs>\\<one>) \\<ra> L \\<lsq> m\\<ra>n\\<ra>L\"\n\t    using int_ord_transl_inv by auto\n\t  then have \"f`(?r) \\<lsq>  m\\<ra>n\\<ra>L\"\n\t    by (rule Int_order_transitive)\n\t  with VII have \"f`(?r) \\<rs> f`(?p) \\<lsq> m\\<ra>n\\<ra>L\\<rs>m\"\n\t    using int_ineq_add_sides by simp\n\t  with I T2 VII have \"f`(?r) \\<rs> f`(?p) \\<rs> f`(?q) \\<lsq> n\\<ra>L\\<rs>n\"\n\t    using Int_ZF_1_2_L9 int_ineq_add_sides by simp\n\t  with I III T2 have \"f`(?r) \\<rs> f`(?p) \\<rs> f`(?q) \\<ra> M \\<lsq> L\\<ra>M\"\n\t    using Int_ZF_1_2_L3 int_ord_transl_inv by simp\n\t  ultimately show \"f`(?r\\<rs>?p\\<rs>?q) \\<lsq> L\\<ra>M\"\n\t    by (rule Int_order_transitive)\n\tqed\n\tmoreover have \"(\\<rm>L)\\<rs>L \\<ra>K \\<lsq> f`(?r\\<rs>?p\\<rs>?q)\"\n\tproof -\n\t  from I II T2 VIII have\n\t    \"f`(?p) \\<lsq> f`(?p\\<rs>\\<one>) \\<ra> L\"\n\t    \"f`(?p\\<rs>\\<one>) \\<ra> L \\<lsq> m \\<ra>L\"\n\t    using int_ord_transl_inv by auto\n\t  then have \"f`(?p) \\<lsq>  m \\<ra>L\"\n\t    by (rule Int_order_transitive)\n\t  with VII have \"m\\<ra>n \\<rs>(m\\<ra>L) \\<lsq> f`(?r) \\<rs> f`(?p)\"\n\t    using int_ineq_add_sides by simp\n\t  with I T2 have \"n \\<rs> L \\<lsq>  f`(?r) \\<rs> f`(?p)\"\n\t    using Int_ZF_1_2_L9 by simp\n\t  moreover\n\t  from I II T2 VIII have\n\t    \"f`(?q) \\<lsq> f`(?q\\<rs>\\<one>) \\<ra> L\"\n\t    \"f`(?q\\<rs>\\<one>) \\<ra> L \\<lsq> n \\<ra>L\"\n\t    using int_ord_transl_inv by auto\n\t  then have \"f`(?q) \\<lsq>  n \\<ra>L\"\n\t    by (rule Int_order_transitive)\n\t  ultimately have \n\t    \"n \\<rs> L \\<rs> (n\\<ra>L) \\<lsq>  f`(?r) \\<rs> f`(?p) \\<rs> f`(?q)\"\n\t    using int_ineq_add_sides by simp\n\t  with I V T2 have \n\t    \"(\\<rm>L)\\<rs>L \\<ra>K \\<lsq>  f`(?r) \\<rs> f`(?p) \\<rs> f`(?q) \\<ra> K\"\n\t    using Int_ZF_1_2_L3 int_ord_transl_inv by simp\n\t  moreover from VI T2 have\n\t    \"f`(?r) \\<rs> f`(?p) \\<rs> f`(?q) \\<ra> K \\<lsq> f`(?r\\<rs>?p\\<rs>?q)\"\n\t    by simp\n\t  ultimately show \"(\\<rm>L)\\<rs>L \\<ra>K \\<lsq> f`(?r\\<rs>?p\\<rs>?q)\"\n\t    by (rule Int_order_transitive)\n\tqed\n\tultimately show\n\t  \"f`(?r\\<rs>?p\\<rs>?q) \\<lsq>  L\\<ra>M \\<and> \n\t  (\\<rm>L)\\<rs>L\\<ra>K \\<lsq> f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n))\" \n\t  by simp \n      qed \n    }\n  ultimately show \n    \"\\<exists>U\\<in>\\<int>. \\<forall>m\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n)) \\<lsq> U\"\n    \"\\<exists>N\\<in>\\<int>. \\<forall>m\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. N \\<lsq> f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n))\"\n    by auto\nqed\n\ntext\\<open>The expression $f^{-1}(m+n)-f^{-1}(m) - f^{-1}(n)$ is uniformly bounded\n  for all pairs $\\langle m,n \\rangle \\in$ \\<open>\\<int>\\<^sub>+\\<times>\\<int>\\<^sub>+\\<close>. \n  Recall that in the \\<open>int1\\<close>\n  context \\<open>\\<epsilon>(f,x)\\<close> is defined so that \n  $\\varepsilon(f,\\langle m,n \\rangle ) = f^{-1}(m+n)-f^{-1}(m) - f^{-1}(n)$.\\<close>\n\nlemma (in int1) Int_ZF_2_4_L8:  assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and\n  A2: \"\\<forall>m\\<in>\\<int>\\<^sub>+. f\\<inverse>(m)\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\"\n  shows \"\\<exists>M. \\<forall>x\\<in>\\<int>\\<^sub>+\\<times>\\<int>\\<^sub>+. abs(\\<epsilon>(f,x)) \\<lsq> M\"\nproof -\n  from A1 A2 have \n    \"\\<exists>U\\<in>\\<int>. \\<forall>m\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n)) \\<lsq> U\"\n    \"\\<exists>N\\<in>\\<int>. \\<forall>m\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. N \\<lsq> f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n))\"\n    using  Int_ZF_2_4_L7 by auto\n  then obtain U N where I:\n    \"\\<forall>m\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n)) \\<lsq> U\" \n    \"\\<forall>m\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. N \\<lsq> f`(f\\<inverse>(m\\<ra>n)\\<rs>f\\<inverse>(m)\\<rs>f\\<inverse>(n))\"\n    by auto\n  have \"\\<int>\\<^sub>+\\<times>\\<int>\\<^sub>+ \\<noteq> 0\" using int_one_two_are_pos by auto\n  moreover from A1 have \"f: \\<int>\\<rightarrow>\\<int>\"\n    using AlmostHoms_def by simp\n  moreover from A1 have\n    \"\\<forall>a\\<in>\\<int>.\\<exists>b\\<in>\\<int>\\<^sub>+.\\<forall>x. b\\<lsq>x \\<longrightarrow> a \\<lsq> f`(x)\"\n    using Int_ZF_2_3_L5 by simp\n  moreover from A1 have\n    \"\\<forall>a\\<in>\\<int>.\\<exists>b\\<in>\\<int>\\<^sub>+.\\<forall>y. b\\<lsq>y \\<longrightarrow> f`(\\<rm>y) \\<lsq> a\"\n    using Int_ZF_2_3_L5A by simp\n  moreover have \n    \"\\<forall>x\\<in>\\<int>\\<^sub>+\\<times>\\<int>\\<^sub>+. \\<epsilon>(f,x) \\<in> \\<int> \\<and> f`(\\<epsilon>(f,x)) \\<lsq> U \\<and> N \\<lsq> f`(\\<epsilon>(f,x))\"\n  proof -\n    { fix x assume A3: \"x \\<in> \\<int>\\<^sub>+\\<times>\\<int>\\<^sub>+\"\n      let ?m = \"fst(x)\"\n      let ?n = \"snd(x)\"\n      from A3 have T: \"?m \\<in> \\<int>\\<^sub>+\"  \"?n \\<in> \\<int>\\<^sub>+\"  \"?m\\<ra>?n \\<in> \\<int>\\<^sub>+\"\n\tusing pos_int_closed_add_unfolded by auto\n      with A1 have \n\t\"f\\<inverse>(?m\\<ra>?n) \\<in> \\<int>\"  \"f\\<inverse>(?m) \\<in> \\<int>\"  \"f\\<inverse>(?n) \\<in> \\<int>\"\n\tusing Int_ZF_2_4_L2 PositiveSet_def by auto\n      with I T have \n\t\"\\<epsilon>(f,x) \\<in> \\<int> \\<and> f`(\\<epsilon>(f,x)) \\<lsq> U \\<and> N \\<lsq> f`(\\<epsilon>(f,x))\"\n\tusing Int_ZF_1_1_L5 by auto \n    } thus ?thesis by simp\n    qed\n  ultimately show \"\\<exists>M.\\<forall>x\\<in>\\<int>\\<^sub>+\\<times>\\<int>\\<^sub>+. abs(\\<epsilon>(f,x)) \\<lsq> M\"\n    by (rule Int_ZF_1_6_L4)\nqed\n  \ntext\\<open>The (candidate for) inverse of a positive slope is a (well defined) \n  function on \\<open>\\<int>\\<^sub>+\\<close>.\\<close>\n\nlemma (in int1) Int_ZF_2_4_L9: \n  assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and A2: \"g = {\\<langle>p,f\\<inverse>(p)\\<rangle>. p\\<in>\\<int>\\<^sub>+}\"\n  shows \n  \"g : \\<int>\\<^sub>+\\<rightarrow>\\<int>\\<^sub>+\"\n  \"g : \\<int>\\<^sub>+\\<rightarrow>\\<int>\"\nproof -\n  from A1 have \n    \"\\<forall>p\\<in>\\<int>\\<^sub>+. f\\<inverse>(p) \\<in> \\<int>\\<^sub>+\" \n    \"\\<forall>p\\<in>\\<int>\\<^sub>+. f\\<inverse>(p) \\<in> \\<int>\" \n    using Int_ZF_2_4_L2 PositiveSet_def by auto\n  with A2 show \n    \"g : \\<int>\\<^sub>+\\<rightarrow>\\<int>\\<^sub>+\"  and  \"g : \\<int>\\<^sub>+\\<rightarrow>\\<int>\" \n    using ZF_fun_from_total by auto\nqed\n\ntext\\<open>What are the values of the (candidate for) the inverse of a positive slope?\\<close>\n\nlemma (in int1) Int_ZF_2_4_L10: \n  assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and A2: \"g = {\\<langle>p,f\\<inverse>(p)\\<rangle>. p\\<in>\\<int>\\<^sub>+}\" and A3: \"p\\<in>\\<int>\\<^sub>+\"\n  shows \"g`(p) = f\\<inverse>(p)\"\nproof -\n  from A1 A2 have  \"g : \\<int>\\<^sub>+\\<rightarrow>\\<int>\\<^sub>+\" using Int_ZF_2_4_L9 by simp\n  with A2 A3 show \"g`(p) = f\\<inverse>(p)\" using ZF_fun_from_tot_val by simp\nqed\n\ntext\\<open>The (candidate for) the inverse of a positive slope is a slope.\\<close>\n\nlemma (in int1) Int_ZF_2_4_L11: assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and \n  A2: \"\\<forall>m\\<in>\\<int>\\<^sub>+. f\\<inverse>(m)\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\" and\n  A3: \"g = {\\<langle>p,f\\<inverse>(p)\\<rangle>. p\\<in>\\<int>\\<^sub>+}\"\n  shows \"OddExtension(\\<int>,IntegerAddition,IntegerOrder,g) \\<in> \\<S>\"\nproof -\n  from A1 A2 have \"\\<exists>L. \\<forall>x\\<in>\\<int>\\<^sub>+\\<times>\\<int>\\<^sub>+. abs(\\<epsilon>(f,x)) \\<lsq> L\"\n    using Int_ZF_2_4_L8 by simp\n  then obtain L where I: \"\\<forall>x\\<in>\\<int>\\<^sub>+\\<times>\\<int>\\<^sub>+. abs(\\<epsilon>(f,x)) \\<lsq> L\"\n    by auto\n  from A1 A3 have \"g : \\<int>\\<^sub>+\\<rightarrow>\\<int>\" using Int_ZF_2_4_L9 \n    by simp\n  moreover have \"\\<forall>m\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. abs(\\<delta>(g,m,n)) \\<lsq> L\"\n  proof-\n    { fix m n\n      assume A4: \"m\\<in>\\<int>\\<^sub>+\"  \"n\\<in>\\<int>\\<^sub>+\"\n      then have \"\\<langle>m,n\\<rangle> \\<in> \\<int>\\<^sub>+\\<times>\\<int>\\<^sub>+\" by simp\n      with I have \"abs(\\<epsilon>(f,\\<langle>m,n\\<rangle>)) \\<lsq> L\" by simp\n      moreover have \"\\<epsilon>(f,\\<langle>m,n\\<rangle>) = f\\<inverse>(m\\<ra>n) \\<rs> f\\<inverse>(m) \\<rs> f\\<inverse>(n)\"\n\tby simp\n      moreover from A1 A3 A4 have\n\t\"f\\<inverse>(m\\<ra>n) = g`(m\\<ra>n)\"  \"f\\<inverse>(m) = g`(m)\"  \"f\\<inverse>(n) = g`(n)\"\n\tusing pos_int_closed_add_unfolded Int_ZF_2_4_L10 by auto\n      ultimately have \"abs(\\<delta>(g,m,n)) \\<lsq> L\" by simp\n    } thus \"\\<forall>m\\<in>\\<int>\\<^sub>+. \\<forall>n\\<in>\\<int>\\<^sub>+. abs(\\<delta>(g,m,n)) \\<lsq> L\" by simp\n  qed\n  ultimately show ?thesis by (rule Int_ZF_2_1_L24)\nqed\n  \ntext\\<open>Every positive slope that is at least $2$ on positive integers\n  almost has an inverse.\\<close>\n\n\nlemma (in int1) Int_ZF_2_4_L12: assumes A1: \"f \\<in> \\<S>\\<^sub>+\" and \n  A2: \"\\<forall>m\\<in>\\<int>\\<^sub>+. f\\<inverse>(m)\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\"\n  shows \"\\<exists>h\\<in>\\<S>. f\\<circ>h \\<sim> id(\\<int>)\"\nproof -\n  let ?g = \"{\\<langle>p,f\\<inverse>(p)\\<rangle>. p\\<in>\\<int>\\<^sub>+}\"\n  let ?h = \"OddExtension(\\<int>,IntegerAddition,IntegerOrder,?g)\"\n  from A1 have \n    \"\\<exists>M\\<in>\\<int>. \\<forall>n\\<in>\\<int>. f`(n) \\<lsq> f`(n\\<rs>\\<one>) \\<ra> M\"\n    using Int_ZF_2_1_L28 by simp\n  then obtain M where \n    I: \"M\\<in>\\<int>\" and II: \"\\<forall>n\\<in>\\<int>. f`(n) \\<lsq> f`(n\\<rs>\\<one>) \\<ra> M\"\n    by auto\n  from A1 A2 have T: \"?h \\<in> \\<S>\"\n    using Int_ZF_2_4_L11 by simp\n  moreover have  \"f\\<circ>?h \\<sim> id(\\<int>)\"\n  proof -\n    from A1 T have \"f\\<circ>?h \\<in> \\<S>\" using Int_ZF_2_1_L11 \n      by simp\n    moreover note I\n    moreover\n    { fix m assume A3: \"m\\<in>\\<int>\\<^sub>+\"\n      with A1 have \"f\\<inverse>(m) \\<in> \\<int>\"\n\tusing Int_ZF_2_4_L2 PositiveSet_def by simp \n      with II have \"f`(f\\<inverse>(m)) \\<lsq> f`(f\\<inverse>(m)\\<rs>\\<one>) \\<ra> M\"\n\tby simp\n      moreover from A1 A2 I A3 have \"f`(f\\<inverse>(m)\\<rs>\\<one>) \\<ra> M \\<lsq> m\\<ra>M\"\n\tusing Int_ZF_2_4_L4 int_ord_transl_inv by simp\n      ultimately have \"f`(f\\<inverse>(m)) \\<lsq> m\\<ra>M\"\n\tby (rule Int_order_transitive)\n      moreover from A1 A3 have \"m \\<lsq> f`(f\\<inverse>(m))\"\n\tusing Int_ZF_2_4_L2 by simp\n      moreover from A1 A2 T A3 have \"f`(f\\<inverse>(m)) = (f\\<circ>?h)`(m)\"\n\tusing Int_ZF_2_4_L9 Int_ZF_1_5_L11\n\t  Int_ZF_2_4_L10 PositiveSet_def Int_ZF_2_1_L10\n\tby simp\n      ultimately have \"m \\<lsq> (f\\<circ>?h)`(m) \\<and> (f\\<circ>?h)`(m) \\<lsq> m\\<ra>M\"\n\tby simp }\n    ultimately show \"f\\<circ>?h \\<sim> id(\\<int>)\" using Int_ZF_2_1_L32\n      by simp\n  qed \n  ultimately show \"\\<exists>h\\<in>\\<S>. f\\<circ>h \\<sim> id(\\<int>)\"\n    by auto\nqed\n\ntext\\<open>\\<open>Int_ZF_2_4_L12\\<close> is almost what we need, except that it has an assumption\n  that the values of the slope that we get the inverse for are not smaller than $2$ on\n  positive integers. The Arthan's proof of Theorem 11 has a mistake where he says \"note that\n  for all but finitely many $m,n\\in N$ $p=g(m)$ and $q=g(n)$ are both positive\". Of course\n  there may be infinitely many pairs $\\langle m,n \\rangle$ such that $p,q$ are not both \n  positive. This is however easy to workaround: we just modify the slope by adding a \n  constant so that the slope is large enough on positive integers and then look \n  for the inverse.\\<close>\n\ntheorem (in int1) pos_slope_has_inv: assumes A1: \"f \\<in> \\<S>\\<^sub>+\"\n  shows \"\\<exists>g\\<in>\\<S>. f\\<sim>g \\<and> (\\<exists>h\\<in>\\<S>. g\\<circ>h \\<sim> id(\\<int>))\"\nproof -\n  from A1 have \"f: \\<int>\\<rightarrow>\\<int>\"  \"\\<one>\\<in>\\<int>\"  \"\\<two> \\<in> \\<int>\"\n    using AlmostHoms_def int_zero_one_are_int int_two_three_are_int\n    by auto\n  moreover from A1 have\n     \"\\<forall>a\\<in>\\<int>.\\<exists>b\\<in>\\<int>\\<^sub>+.\\<forall>x. b\\<lsq>x \\<longrightarrow> a \\<lsq> f`(x)\"\n    using Int_ZF_2_3_L5 by simp\n  ultimately have \n    \"\\<exists>c\\<in>\\<int>. \\<two> \\<lsq> Minimum(IntegerOrder,{n\\<in>\\<int>\\<^sub>+. \\<one> \\<lsq> f`(n)\\<ra>c})\"\n    by (rule Int_ZF_1_6_L7)\n  then obtain c where I: \"c\\<in>\\<int>\" and\n    II: \"\\<two> \\<lsq> Minimum(IntegerOrder,{n\\<in>\\<int>\\<^sub>+. \\<one> \\<lsq> f`(n)\\<ra>c})\"\n    by auto\n  let ?g = \"{\\<langle>m,f`(m)\\<ra>c\\<rangle>. m\\<in>\\<int>}\"\n  from A1 I have III: \"?g\\<in>\\<S>\" and IV: \"f\\<sim>?g\" using Int_ZF_2_1_L33 \n    by auto\n  from IV have \"\\<langle>f,?g\\<rangle> \\<in> AlEqRel\" by simp\n  with A1 have T: \"?g \\<in> \\<S>\\<^sub>+\" by (rule Int_ZF_2_3_L9)\n  moreover have \"\\<forall>m\\<in>\\<int>\\<^sub>+. ?g\\<inverse>(m)\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\"\n  proof\n    fix m assume A2: \"m\\<in>\\<int>\\<^sub>+\"\n    from A1 I II have V: \"\\<two> \\<lsq> ?g\\<inverse>(\\<one>)\"\n      using Int_ZF_2_1_L33 PositiveSet_def by simp\n    moreover from A2 T have \"?g\\<inverse>(\\<one>) \\<lsq> ?g\\<inverse>(m)\"\n      using Int_ZF_1_5_L3 int_one_two_are_pos Int_ZF_2_4_L5\n      by simp\n    ultimately have \"\\<two> \\<lsq> ?g\\<inverse>(m)\"\n      by (rule Int_order_transitive)\n    then have \"\\<two>\\<rs>\\<one> \\<lsq> ?g\\<inverse>(m)\\<rs>\\<one>\"\n      using int_zero_one_are_int Int_ZF_1_1_L4 int_ord_transl_inv\n      by simp\n    then show  \"?g\\<inverse>(m)\\<rs>\\<one> \\<in> \\<int>\\<^sub>+\"\n      using int_zero_one_are_int Int_ZF_1_2_L3 Int_ZF_1_5_L3\n      by simp\n  qed\n  ultimately have \"\\<exists>h\\<in>\\<S>. ?g\\<circ>h \\<sim> id(\\<int>)\"\n    by (rule Int_ZF_2_4_L12)\n  with III IV show ?thesis by auto\nqed\n\nsubsection\\<open>Completeness\\<close>\n\ntext\\<open>In this section we consider properties of slopes that are\n  needed for the proof of completeness of real numbers constructred\n  in \\<open>Real_ZF_1.thy\\<close>. In particular we consider properties\n  of embedding of integers into the set of slopes by the mapping\n  $m \\mapsto m^S$ , where $m^S$ is defined by $m^S(n) = m\\cdot n$.\\<close>\n\ntext\\<open>If m is an integer, then $m^S$ is a slope whose value\n  is $m\\cdot n$ for every integer.\\<close>\n\nlemma (in int1) Int_ZF_2_5_L1: assumes A1: \"m \\<in> \\<int>\"\n  shows \n  \"\\<forall>n \\<in> \\<int>. (m\\<^sup>S)`(n) = m\\<cdot>n\"\n  \"m\\<^sup>S \\<in> \\<S>\"\nproof -\n  from A1 have I: \"m\\<^sup>S:\\<int>\\<rightarrow>\\<int>\"\n    using Int_ZF_1_1_L5 ZF_fun_from_total by simp\n  then show II: \"\\<forall>n \\<in> \\<int>. (m\\<^sup>S)`(n) = m\\<cdot>n\" using ZF_fun_from_tot_val\n    by simp\n  { fix n k\n    assume A2: \"n\\<in>\\<int>\"  \"k\\<in>\\<int>\"\n    with A1 have T: \"m\\<cdot>n \\<in> \\<int>\"  \"m\\<cdot>k \\<in> \\<int>\"\n      using Int_ZF_1_1_L5 by auto\n    from A1 A2 II T  have \"\\<delta>(m\\<^sup>S,n,k) = m\\<cdot>k \\<rs> m\\<cdot>k\"\n      using Int_ZF_1_1_L5 Int_ZF_1_1_L1 Int_ZF_1_2_L3\n      by simp\n    also from T have \"\\<dots> = \\<zero>\" using Int_ZF_1_1_L4\n      by simp\n    finally have \"\\<delta>(m\\<^sup>S,n,k) = \\<zero>\" by simp\n    then have \"abs(\\<delta>(m\\<^sup>S,n,k)) \\<lsq> \\<zero>\"\n      using Int_ZF_2_L18 int_zero_one_are_int int_ord_is_refl refl_def\n      by simp\n  } then have \"\\<forall>n\\<in>\\<int>.\\<forall>k\\<in>\\<int>. abs(\\<delta>(m\\<^sup>S,n,k)) \\<lsq> \\<zero>\"\n    by simp\n  with I show  \"m\\<^sup>S \\<in> \\<S>\" by (rule Int_ZF_2_1_L5)\nqed\n\ntext\\<open>For any slope $f$ there is an integer $m$ such that there is some slope $g$ \n  that is almost equal to $m^S$ and dominates $f$ in the sense that $f\\leq g$ \n  on positive integers (which implies that either $g$ is almost equal to $f$ or\n  $g-f$ is a positive slope. This will be used in \\<open>Real_ZF_1.thy\\<close> to show\n  that for any real number there is an integer that (whose real embedding) \n  is greater or equal.\\<close>\n\nlemma (in int1) Int_ZF_2_5_L2: assumes A1: \"f \\<in> \\<S>\"\n  shows \"\\<exists>m\\<in>\\<int>. \\<exists>g\\<in>\\<S>. (m\\<^sup>S\\<sim>g \\<and> (f\\<sim>g \\<or> g\\<fp>(\\<fm>f) \\<in> \\<S>\\<^sub>+))\"\nproof -\n  from A1 have \n    \"\\<exists>m k. m\\<in>\\<int> \\<and> k\\<in>\\<int> \\<and> (\\<forall>p\\<in>\\<int>. abs(f`(p)) \\<lsq> m\\<cdot>abs(p)\\<ra>k)\"\n    using Arthan_Lem_8 by simp\n  then obtain m k where I: \"m\\<in>\\<int>\" and II: \"k\\<in>\\<int>\" and \n    III: \"\\<forall>p\\<in>\\<int>. abs(f`(p)) \\<lsq> m\\<cdot>abs(p)\\<ra>k\"\n    by auto\n  let ?g = \"{\\<langle>n,m\\<^sup>S`(n) \\<ra>k\\<rangle>. n\\<in>\\<int>}\"\n  from I have IV: \"m\\<^sup>S \\<in> \\<S>\" using Int_ZF_2_5_L1 by simp\n  with II have V: \"?g\\<in>\\<S>\" and VI: \"m\\<^sup>S\\<sim>?g\" using Int_ZF_2_1_L33 \n    by auto\n  { fix n assume A2: \"n\\<in>\\<int>\\<^sub>+\"\n    with A1 have \"f`(n) \\<in> \\<int>\"\n      using Int_ZF_2_1_L2B PositiveSet_def by simp\n    then have \"f`(n) \\<lsq> abs(f`(n))\" using Int_ZF_2_L19C \n      by simp\n    moreover  \n    from III A2 have \"abs(f`(n)) \\<lsq> m\\<cdot>abs(n) \\<ra> k\"\n      using PositiveSet_def by simp\n    with A2 have \"abs(f`(n)) \\<lsq> m\\<cdot>n\\<ra>k\"\n      using Int_ZF_1_5_L4A by simp\n    ultimately have \"f`(n) \\<lsq> m\\<cdot>n\\<ra>k\"\n      by (rule Int_order_transitive)\n    moreover\n    from II IV A2 have \"?g`(n) = (m\\<^sup>S)`(n)\\<ra>k\"\n      using Int_ZF_2_1_L33 PositiveSet_def by simp\n    with I A2 have \"?g`(n) = m\\<cdot>n\\<ra>k\"\n      using Int_ZF_2_5_L1 PositiveSet_def by simp\n    ultimately have \"f`(n) \\<lsq> ?g`(n)\"\n      by simp\n  } then have \"\\<forall>n\\<in>\\<int>\\<^sub>+. f`(n) \\<lsq> ?g`(n)\"\n    by simp\n  with A1 V have \"f\\<sim>?g \\<or> ?g \\<fp> (\\<fm>f) \\<in> \\<S>\\<^sub>+\"\n    using Int_ZF_2_3_L4C by simp\n  with I V VI show ?thesis by auto\nqed\n\ntext\\<open>The negative of an integer embeds in slopes as a negative of the \n  orgiginal embedding.\\<close>\n\nlemma (in int1) Int_ZF_2_5_L3: assumes A1:  \"m \\<in> \\<int>\"\n  shows \"(\\<rm>m)\\<^sup>S = \\<fm>(m\\<^sup>S)\"\nproof -\n  from A1 have \"(\\<rm>m)\\<^sup>S: \\<int>\\<rightarrow>\\<int>\" and \"(\\<fm>(m\\<^sup>S)): \\<int>\\<rightarrow>\\<int>\"\n    using Int_ZF_1_1_L4 Int_ZF_2_5_L1 AlmostHoms_def Int_ZF_2_1_L12\n    by auto\n  moreover have \"\\<forall>n\\<in>\\<int>. ((\\<rm>m)\\<^sup>S)`(n) = (\\<fm>(m\\<^sup>S))`(n)\"\n  proof\n    fix n assume A2: \"n\\<in>\\<int>\"\n    with A1 have \n      \"((\\<rm>m)\\<^sup>S)`(n) = (\\<rm>m)\\<cdot>n\"\n      \"(\\<fm>(m\\<^sup>S))`(n) = \\<rm>(m\\<cdot>n)\"\n      using Int_ZF_1_1_L4 Int_ZF_2_5_L1 Int_ZF_2_1_L12A\n      by auto\n    with A1 A2 show \"((\\<rm>m)\\<^sup>S)`(n) = (\\<fm>(m\\<^sup>S))`(n)\"\n      using Int_ZF_1_1_L5 by simp\n  qed\n  ultimately show \"(\\<rm>m)\\<^sup>S = \\<fm>(m\\<^sup>S)\" using fun_extension_iff\n    by simp\nqed\n\n\ntext\\<open>The sum of embeddings is the embeding of the sum.\\<close>\n\nlemma (in int1) Int_ZF_2_5_L3A: assumes A1: \"m\\<in>\\<int>\"  \"k\\<in>\\<int>\"\n  shows \"(m\\<^sup>S) \\<fp> (k\\<^sup>S) = ((m\\<ra>k)\\<^sup>S)\"\nproof -\n  from A1 have T1: \"m\\<ra>k \\<in> \\<int>\" using Int_ZF_1_1_L5 \n    by simp\n  with A1 have T2:\n    \"(m\\<^sup>S) \\<in> \\<S>\"  \"(k\\<^sup>S) \\<in> \\<S>\"\n    \"(m\\<ra>k)\\<^sup>S  \\<in> \\<S>\"\n    \"(m\\<^sup>S) \\<fp> (k\\<^sup>S) \\<in> \\<S>\"\n    using Int_ZF_2_5_L1 Int_ZF_2_1_L12C by auto\n  then have \n    \"(m\\<^sup>S) \\<fp> (k\\<^sup>S) : \\<int>\\<rightarrow>\\<int>\"\n    \"(m\\<ra>k)\\<^sup>S : \\<int>\\<rightarrow>\\<int>\" \n    using AlmostHoms_def by auto\n  moreover have \"\\<forall>n\\<in>\\<int>. ((m\\<^sup>S) \\<fp> (k\\<^sup>S))`(n) = ((m\\<ra>k)\\<^sup>S)`(n)\"\n  proof\n    fix n assume A2: \"n\\<in>\\<int>\"\n    with A1 T1 T2 have  \"((m\\<^sup>S) \\<fp> (k\\<^sup>S))`(n) = (m\\<ra>k)\\<cdot>n\"\n      using Int_ZF_2_1_L12B Int_ZF_2_5_L1 Int_ZF_1_1_L1\n      by simp\n    also from T1 A2 have \"\\<dots> = ((m\\<ra>k)\\<^sup>S)`(n)\"\n      using Int_ZF_2_5_L1 by simp\n    finally show \"((m\\<^sup>S) \\<fp> (k\\<^sup>S))`(n) = ((m\\<ra>k)\\<^sup>S)`(n)\"\n      by simp\n  qed\n  ultimately show \"(m\\<^sup>S) \\<fp> (k\\<^sup>S) = ((m\\<ra>k)\\<^sup>S)\"\n    using fun_extension_iff by simp\nqed\n\ntext\\<open>The composition of embeddings is the embeding of the product.\\<close>\n\nlemma (in int1) Int_ZF_2_5_L3B: assumes A1: \"m\\<in>\\<int>\"  \"k\\<in>\\<int>\"\n  shows \"(m\\<^sup>S) \\<circ> (k\\<^sup>S) = ((m\\<cdot>k)\\<^sup>S)\"\nproof -\n  from A1 have T1: \"m\\<cdot>k \\<in> \\<int>\" using Int_ZF_1_1_L5 \n    by simp\n  with A1 have T2:\n    \"(m\\<^sup>S) \\<in> \\<S>\"  \"(k\\<^sup>S) \\<in> \\<S>\"\n    \"(m\\<cdot>k)\\<^sup>S  \\<in> \\<S>\"\n    \"(m\\<^sup>S) \\<circ> (k\\<^sup>S) \\<in> \\<S>\"\n    using Int_ZF_2_5_L1 Int_ZF_2_1_L11 by auto\n  then have \n    \"(m\\<^sup>S) \\<circ> (k\\<^sup>S) : \\<int>\\<rightarrow>\\<int>\"\n    \"(m\\<cdot>k)\\<^sup>S : \\<int>\\<rightarrow>\\<int>\" \n    using AlmostHoms_def by auto\n  moreover have \"\\<forall>n\\<in>\\<int>. ((m\\<^sup>S) \\<circ> (k\\<^sup>S))`(n) = ((m\\<cdot>k)\\<^sup>S)`(n)\"\n  proof\n    fix n assume A2: \"n\\<in>\\<int>\"\n    with A1 T2 have\n      \"((m\\<^sup>S) \\<circ> (k\\<^sup>S))`(n) = (m\\<^sup>S)`(k\\<cdot>n)\"\n       using Int_ZF_2_1_L10 Int_ZF_2_5_L1 by simp\n    moreover\n    from A1 A2 have \"k\\<cdot>n \\<in> \\<int>\" using Int_ZF_1_1_L5 \n      by simp\n    with A1 A2 have \"(m\\<^sup>S)`(k\\<cdot>n) = m\\<cdot>k\\<cdot>n\"\n      using Int_ZF_2_5_L1 Int_ZF_1_1_L7 by simp\n    ultimately have \"((m\\<^sup>S) \\<circ> (k\\<^sup>S))`(n) = m\\<cdot>k\\<cdot>n\"\n      by simp\n    also from T1 A2 have \"m\\<cdot>k\\<cdot>n = ((m\\<cdot>k)\\<^sup>S)`(n)\"\n      using Int_ZF_2_5_L1 by simp\n    finally show \"((m\\<^sup>S) \\<circ> (k\\<^sup>S))`(n) = ((m\\<cdot>k)\\<^sup>S)`(n)\"\n      by simp\n  qed\n  ultimately show \"(m\\<^sup>S) \\<circ> (k\\<^sup>S) = ((m\\<cdot>k)\\<^sup>S)\"\n    using fun_extension_iff by simp\nqed\n  \n\ntext\\<open>Embedding integers in slopes preserves order.\\<close>\n\nlemma (in int1) Int_ZF_2_5_L4: assumes A1:  \"m\\<lsq>n\"\n  shows \"(m\\<^sup>S) \\<sim> (n\\<^sup>S) \\<or> (n\\<^sup>S)\\<fp>(\\<fm>(m\\<^sup>S)) \\<in> \\<S>\\<^sub>+\"\nproof -\n  from A1 have \"m\\<^sup>S \\<in> \\<S>\" and \"n\\<^sup>S \\<in> \\<S>\"\n    using Int_ZF_2_L1A Int_ZF_2_5_L1 by auto\n  moreover from A1 have \"\\<forall>k\\<in>\\<int>\\<^sub>+. (m\\<^sup>S)`(k) \\<lsq> (n\\<^sup>S)`(k)\"\n    using Int_ZF_1_3_L13B Int_ZF_2_L1A PositiveSet_def Int_ZF_2_5_L1\n    by simp\n  ultimately show ?thesis using Int_ZF_2_3_L4C\n    by simp\nqed\n\ntext\\<open>We aim at showing that $m\\mapsto m^S$ is an injection modulo\n  the relation of almost equality. To do that we first show that if\n  $m^S$ has finite range, then $m=0$.\\<close>\n\nlemma (in int1) Int_ZF_2_5_L5: \n  assumes \"m\\<in>\\<int>\" and \"m\\<^sup>S \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\n  shows \"m=\\<zero>\"\n  using assms FinRangeFunctions_def Int_ZF_2_5_L1 AlmostHoms_def \n    func_imagedef Int_ZF_1_6_L8 by simp\n\ntext\\<open>Embeddings of two integers are almost equal only if \n  the integers are equal.\\<close>\n\nlemma (in int1) Int_ZF_2_5_L6: \n  assumes A1: \"m\\<in>\\<int>\"  \"k\\<in>\\<int>\" and A2: \"(m\\<^sup>S) \\<sim> (k\\<^sup>S)\"\n  shows \"m=k\"\nproof -\n  from A1 have T: \"m\\<rs>k \\<in> \\<int>\" using Int_ZF_1_1_L5 by simp\n  from A1 have \"(\\<fm>(k\\<^sup>S)) =  ((\\<rm>k)\\<^sup>S)\"\n    using Int_ZF_2_5_L3 by simp\n  then have \"m\\<^sup>S \\<fp> (\\<fm>(k\\<^sup>S)) = (m\\<^sup>S) \\<fp> ((\\<rm>k)\\<^sup>S)\"\n    by simp\n  with A1 have \"m\\<^sup>S \\<fp> (\\<fm>(k\\<^sup>S)) = ((m\\<rs>k)\\<^sup>S)\"\n    using Int_ZF_1_1_L4 Int_ZF_2_5_L3A by simp\n  moreover from A1 A2 have \"m\\<^sup>S \\<fp> (\\<fm>(k\\<^sup>S)) \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\n    using Int_ZF_2_5_L1 Int_ZF_2_1_L9D by simp\n  ultimately have \"(m\\<rs>k)\\<^sup>S \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\n    by simp\n  with T have \"m\\<rs>k = \\<zero>\" using Int_ZF_2_5_L5\n    by simp\n  with A1 show \"m=k\" by (rule Int_ZF_1_L15)\nqed\n\ntext\\<open>Embedding of $1$ is the identity slope and embedding of zero is a \n  finite range function.\\<close>\n\nlemma (in int1) Int_ZF_2_5_L7: shows \n  \"\\<one>\\<^sup>S = id(\\<int>)\"\n  \"\\<zero>\\<^sup>S \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\nproof -\n  have \"id(\\<int>) = {\\<langle>x,x\\<rangle>. x\\<in>\\<int>}\"\n    using id_def by blast\n  then show \"\\<one>\\<^sup>S = id(\\<int>)\" using Int_ZF_1_1_L4 by simp\n  have \"{\\<zero>\\<^sup>S`(n). n\\<in>\\<int>} = {\\<zero>\\<cdot>n. n\\<in>\\<int>}\"\n    using int_zero_one_are_int Int_ZF_2_5_L1 by simp\n  also have \"\\<dots> = {\\<zero>}\" using Int_ZF_1_1_L4 int_not_empty\n    by simp\n  finally have \"{\\<zero>\\<^sup>S`(n). n\\<in>\\<int>} = {\\<zero>}\" by simp\n  then have \"{\\<zero>\\<^sup>S`(n). n\\<in>\\<int>} \\<in> Fin(\\<int>)\"\n    using int_zero_one_are_int Finite1_L16 by simp\n  moreover have \"\\<zero>\\<^sup>S: \\<int>\\<rightarrow>\\<int>\" \n    using int_zero_one_are_int Int_ZF_2_5_L1 AlmostHoms_def \n    by simp\n  ultimately show \"\\<zero>\\<^sup>S \\<in> FinRangeFunctions(\\<int>,\\<int>)\"\n    using Finite1_L19 by simp  \nqed\n\ntext\\<open>A somewhat technical condition for a embedding of an integer \n  to be \"less  or equal\" (in the sense apriopriate for slopes) than \n  the composition of a slope and another integer (embedding).\\<close>\n\nlemma (in int1) Int_ZF_2_5_L8: \n  assumes A1: \"f \\<in> \\<S>\" and A2: \"N \\<in> \\<int>\"  \"M \\<in> \\<int>\" and\n  A3: \"\\<forall>n\\<in>\\<int>\\<^sub>+. M\\<cdot>n \\<lsq> f`(N\\<cdot>n)\"\n  shows \"M\\<^sup>S \\<sim> f\\<circ>(N\\<^sup>S) \\<or>  (f\\<circ>(N\\<^sup>S)) \\<fp> (\\<fm>(M\\<^sup>S)) \\<in> \\<S>\\<^sub>+\"\nproof -\n  from A1 A2 have \"M\\<^sup>S \\<in> \\<S>\"  \"f\\<circ>(N\\<^sup>S) \\<in> \\<S>\"\n    using Int_ZF_2_5_L1 Int_ZF_2_1_L11 by auto\n  moreover from A1 A2 A3 have \"\\<forall>n\\<in>\\<int>\\<^sub>+. (M\\<^sup>S)`(n) \\<lsq> (f\\<circ>(N\\<^sup>S))`(n)\"\n    using Int_ZF_2_5_L1 PositiveSet_def Int_ZF_2_1_L10\n    by simp\n  ultimately show ?thesis using Int_ZF_2_3_L4C\n    by simp\nqed\n\ntext\\<open>Another technical condition for the composition of a slope and \n  an integer (embedding) to be \"less  or equal\" (in the sense apriopriate \n  for slopes) than embedding of another integer.\\<close>\n\nlemma (in int1) Int_ZF_2_5_L9: \n  assumes A1: \"f \\<in> \\<S>\" and A2: \"N \\<in> \\<int>\"  \"M \\<in> \\<int>\" and\n  A3: \"\\<forall>n\\<in>\\<int>\\<^sub>+.  f`(N\\<cdot>n) \\<lsq> M\\<cdot>n \"\n  shows \"f\\<circ>(N\\<^sup>S) \\<sim> (M\\<^sup>S) \\<or> (M\\<^sup>S) \\<fp> (\\<fm>(f\\<circ>(N\\<^sup>S))) \\<in> \\<S>\\<^sub>+\"\nproof -\n  from A1 A2 have \"f\\<circ>(N\\<^sup>S) \\<in> \\<S>\"  \"M\\<^sup>S \\<in> \\<S>\"  \n    using Int_ZF_2_5_L1 Int_ZF_2_1_L11 by auto\n  moreover from A1 A2 A3 have \"\\<forall>n\\<in>\\<int>\\<^sub>+. (f\\<circ>(N\\<^sup>S))`(n) \\<lsq> (M\\<^sup>S)`(n) \"\n    using Int_ZF_2_5_L1 PositiveSet_def Int_ZF_2_1_L10\n    by simp\n  ultimately show ?thesis using Int_ZF_2_3_L4C\n    by simp\nqed\n\nend", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/Int_ZF_3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.6370308013713525, "lm_q1q2_score": 0.3284657681160618}}
{"text": "section \"Executable Signature and Theory\"\n\n(* Proofs are ugly, clean up if time *)\n\ntheory TheoryExe\n  imports SortsExe Theory Instances\nbegin\n\ndatatype exesignature = ExeSignature \n  (execonst_type_of: \"(name \\<times> typ) list\")\n  (exetyp_arity_of: \"(name \\<times> nat) list\")\n  (exesorts: exeosig)\n\nlemma exe_const_type_of_ok: \"\n  alist_conds cto \\<Longrightarrow>\n  (\\<forall>ty \\<in> Map.ran (map_of cto) . typ_ok_sig (map_of cto, ta, sa) ty)\n  \\<longleftrightarrow> (\\<forall>ty \\<in> snd ` set cto  . typ_ok_sig (map_of cto, ta, sa) ty)\"\n  by (simp add: ran_distinct)\n\nfun exe_wf_sig where\n  \"exe_wf_sig (ExeSignature cto tao sa) = (exe_wf_osig sa \\<and>\n  fst ` set (exetcsigs sa) = fst ` set tao \n  \\<and> (\\<forall>type \\<in> fst ` set (exetcsigs sa). \n    (\\<forall>ars \\<in> snd ` set (the (lookup (\\<lambda>k. k=type) (exetcsigs sa))) .\n      the (lookup (\\<lambda>k. k=type) tao) = length ars))\n  \\<and> (\\<forall>ty \\<in> snd ` set cto . typ_ok_sig (map_of cto, map_of tao, translate_osig sa) ty))\"\n\nlemma exe_wf_sig_imp_wf_sig:\n  assumes \"alist_conds cto\" \"alist_conds tao\" \"exe_osig_conds sa\" \"(exe_wf_osig sa\n  \\<and> fst ` set (exetcsigs sa) = fst ` set tao \n  \\<and> (\\<forall>type \\<in> fst ` set (exetcsigs sa).  \n      (\\<forall>ars \\<in> snd ` set (the (lookup (\\<lambda>k. k=type) (exetcsigs sa))) .\n      the (lookup (\\<lambda>k. k=type) tao) = length ars)))\n  \\<and> (\\<forall>ty \\<in> snd ` set cto . typ_ok_sig (map_of cto, map_of tao, translate_osig sa) ty)\"\n  shows \"wf_sig (map_of cto, map_of tao, translate_osig sa)\"\nproof-\n  {\n    fix type y\n    assume p: \"exe_osig_conds sa\" \"trans (fst (translate_osig sa))\" \"snd (translate_osig sa) type = Some y\"\n      hence \"exe_ars_conds (exetcsigs sa)\"\n        using exe_osig_conds_def by blast\n    from p have \"translate_ars (exetcsigs sa) type = Some y\"\n      by (metis snd_conv translate_osig.elims)\n    hence \"(type, y) \\<in> set (map (apsnd map_of) (exetcsigs sa))\"\n      using map_of_SomeD by force\n    hence \"type \\<in> fst ` set (exetcsigs sa)\" by force\n    from this obtain x where \"lookup (\\<lambda>x. x=type) (exetcsigs sa) = Some x\" \n      using key_present_imp_eq_lookup_finds_value by metis\n    hence \"map_of x = y\"\n      by (metis \\<open>exe_ars_conds (snd sa)\\<close> \\<open>translate_ars (snd sa) type = Some y\\<close> \n          exe_ars_conds_def in_alist_imp_in_map_of lookup_eq_map_of_ap \n          map_of_SomeD option.sel)\n    have \"\\<exists>y. (type, y) \\<in> set tao\"\n      using \\<open>type \\<in> fst ` set (exetcsigs sa)\\<close> assms(4) by auto\n  }\n  note 1 = this\n\n  {\n    fix ars type y\n    assume p: \"exe_osig_conds sa\"\n      \"trans (fst (translate_osig sa))\"\n      \"\\<forall>x\\<in>set cto. typ_ok_sig (map_of cto, map_of tao, translate_osig sa) (snd x)\"\n      \"ars \\<in> ran y\"\n      \"snd (translate_osig sa) type = Some y\"\n\n      hence \"exe_ars_conds (exetcsigs sa)\"\n        using exe_osig_conds_def by blast\n      from p(1-2) p(5) have \"translate_ars (exetcsigs sa) type = Some y\"\n        by (metis snd_conv translate_osig.elims)\n      hence \"(type, y) \\<in> set (map (apsnd map_of) (exetcsigs sa))\"\n        using map_of_SomeD by force\n      hence dom: \"type \\<in> fst ` set (exetcsigs sa)\" by force\n      from this obtain x where x: \"lookup (\\<lambda>x. x=type) (exetcsigs sa) = Some x\" \n        using key_present_imp_eq_lookup_finds_value by metis\n      hence \"map_of x = y\"\n        by (metis \\<open>exe_ars_conds (snd sa)\\<close> \\<open>translate_ars (snd sa) type = Some y\\<close> \n            exe_ars_conds_def in_alist_imp_in_map_of lookup_eq_map_of_ap map_of_SomeD option.sel)\n      have \"ars \\<in> snd ` set x\"\n        by (metis \\<open>map_of x = y\\<close> image_iff in_range_if_ex_key map_of_SomeD p(4) snd_conv)\n\n      have \"type \\<in> fst ` set tao\"\n        apply (simp add: \\<open>type \\<in> fst ` set (exetcsigs sa)\\<close> assms(4))\n        using assms(4) dom  by blast\n      moreover have 1: \"(\\<forall>ars \\<in> snd ` set (the (lookup (\\<lambda>k. k=type) (exetcsigs sa))) .\n        the (lookup (\\<lambda>k. k=type) tao) = length ars)\"\n        using \\<open>type \\<in> fst ` set (exetcsigs sa)\\<close> assms(4) by blast\n      \n      ultimately have \"the (lookup (\\<lambda>k. k = type) tao) = length ars\" \n        using \\<open>lookup (\\<lambda>x. x = type) (exetcsigs sa) = Some x\\<close> \\<open>map_of x = y\\<close> \n            in_range_if_ex_key map_of_SomeD option.sel p(3) snd_conv\n        by (simp add: 1 \\<open>ars \\<in> snd ` set x\\<close>)\n      hence \"the (map_of tao type) = length ars\"\n       by (metis \\<open>the (lookup (\\<lambda>k. k = type) tao) = length ars\\<close> lookup_eq_map_of_ap)\n  }\n  note 2 = this\n  {\n    fix a b x y\n    assume p: \"fst ` set b = fst ` set tao\"\n      \"(x, y) \\<in> set tao\"\n      \"sa = (a, b)\"\n\n    have \"x \\<in> fst ` set b\"\n      by (metis fst_conv image_iff p(1) p(2))\n    from this obtain ars where \"lookup (\\<lambda>k. k=x) b = Some ars\"\n      by (metis key_present_imp_eq_lookup_finds_value)\n    hence \"(x,ars) \\<in> set b\"\n      by (simp add: lookup_present_eq_key')\n    hence \"lookup (\\<lambda>k. k=x) (map (apsnd map_of) b) = Some (map_of ars)\"\n      by (metis assms(3) exe_ars_conds_def exe_osig_conds_def in_alist_imp_in_map_of\n          lookup_eq_map_of_ap p(3) snd_conv translate_ars.simps)\n    hence \"\\<exists>y. map_of (map (apsnd map_of) b) x = Some y\"\n      by (metis lookup_eq_map_of_ap)\n  }\n  note 3 = this\n  {\n    fix a b x\n    assume p: \"alist_conds cto\"\n      \"x \\<in> ran (map_of cto)\"\n      \"sa = (a, b)\"\n    have \"typ_ok_sig (map_of cto, map_of tao, set a,  map_of (map (apsnd map_of) b)) x\"\n      using assms(4) p(1) p(2) p(3) ran_distinct by fastforce\n  }\n  note 4 = this\n  have \"wf_osig (translate_osig sa)\"\n    using assms(4) wf_osig_iff_exe_wf_osig by simp\n  thus ?thesis apply (cases sa)\n    using 1 2 3 4 assms by auto\nqed\n\nlemma wf_sig_imp_exe_wf_sig:\n  assumes \"alist_conds cto\" \"alist_conds tao\" \"exe_osig_conds sa\"\n    \"wf_sig (map_of cto, map_of tao, translate_osig sa)\" \n  shows \"(exe_wf_osig sa\n    \\<and> fst ` set (exetcsigs sa) = fst ` set tao \n    \\<and> (\\<forall>type \\<in> fst ` set (exetcsigs sa). \n        (\\<forall>ars \\<in> snd ` set (the (lookup (\\<lambda>k. k=type) (exetcsigs sa))) .\n        the (lookup (\\<lambda>k. k=type) tao) = length ars)))\n    \\<and> (\\<forall>ty \\<in> snd ` set cto . typ_ok_sig (map_of cto, map_of tao, translate_osig sa) ty)\"\nproof-\n  {\n    fix a b x y\n    assume p: \"alist_conds tao\"\n      \"exe_ars_conds b\"\n      \"dom (map_of (map (apsnd map_of) b)) = dom (map_of tao)\"\n      \"(x, y) \\<in> set b\"\n\n    hence \"x \\<in> fst ` set tao\"\n      by (metis domIff dom_map_of_conv_image_fst exe_ars_conds_def \n          in_alist_imp_in_map_of option.distinct(1) translate_ars.simps)\n  }\n  note 1 = this\n  {\n    fix cl n ar and tcs :: \"(String.literal \\<times> (String.literal \\<times> String.literal set list) list) list\"\n    assume p: \"dom (map_of (map (apsnd map_of) tcs)) = dom (map_of tao)\"\n      \"alist_conds tao\"\n      \"(n, ar) \\<in> set tao\"\n    \n    obtain mgd where \"translate_ars tcs n = Some mgd\"\n      using p by (metis Some_eq_map_of_iff domI domIff option.exhaust_sel translate_ars.simps)\n    hence \"map_of (map (apsnd map_of) tcs) n = Some mgd\" \n      by (simp add: tcsigs_translate exe_osig_conds_def p)\n    hence \"n \\<in> fst ` set (map (apsnd map_of) tcs)\"\n      by (meson domI domIff map_of_eq_None_iff)\n    then have \"n \\<in> fst ` set tcs\" \n      by force\n  }\n  note 2 = this\n  {\n    fix cl tcs n K c Ss \n    assume p: \"(n, K) \\<in> set tcs\"\n      \"(c, Ss) \\<in> set (the (lookup (\\<lambda>k. k = n) tcs))\"\n      \"exe_ars_conds tcs\"\n      \"dom (map_of (map (apsnd map_of) tcs)) = dom (map_of tao)\"\n      \"\\<forall>type\\<in>dom (map_of tao). \\<forall>ars\\<in>ran (the (map_of (map (apsnd map_of) tcs) type)).\n          the (map_of tao type) = length ars\"\n    \n    have 1: \"translate_ars tcs n = Some (map_of K)\"\n      using exe_ars_conds_def in_alist_imp_in_map_of p(1-3) by blast\n    have 2: \"map_of K c = Some Ss\"\n      using p(1-3)\n      by (metis Some_eq_map_of_iff exe_ars_conds_def image_iff lookup_eq_map_of_ap\n          option.sel snd_conv)\n    have \"the (lookup (\\<lambda>k. k = n) tao) = length Ss\"\n      using 1 2 p(4,5)\n      by (metis domIff lookup_eq_map_of_ap option.distinct(1) option.sel ranI translate_ars.simps)\n  }\n  note 3 = this\n\n  have 1: \"wf_osig (translate_osig sa)\" \"dom (tcsigs (translate_osig sa)) = dom (map_of tao)\"\n    \"(\\<forall>type \\<in> dom (tcsigs (translate_osig sa)). \n    (\\<forall>ars \\<in> ran (the (tcsigs (translate_osig sa) type)) . the ((map_of tao) type) = length ars))\"\n    \"(\\<forall>ty \\<in> Map.ran (map_of cto) . wf_type (map_of cto, map_of tao, translate_osig sa) ty)\"\n    using assms(4) by auto\n  note pre = 1\n           \n  have \"exe_wf_osig sa\"\n    using \"1\"(1) wf_osig_iff_exe_wf_osig by blast\n  moreover have \"fst ` set (snd sa) = fst ` set tao\"\n  proof\n    show \"fst ` set (snd sa) \\<subseteq> fst ` set tao\"\n      using assms(3-4)\n      by (clarsimp simp add: dom_map_of_conv_image_fst exe_ars_conds_def exe_osig_conds_def)\n        (metis tcsigs_translate assms(3) domIff in_alist_imp_in_map_of option.simps(3))\n  next\n    show \"fst ` set (snd sa) \\<supseteq> fst ` set tao\" \n      using \"1\"(2) \"2\" assms(2-3) tcsigs_translate by auto\n  qed\n  moreover have \"(\\<forall>type\\<in>fst ` set (snd sa).  \\<forall>ars\\<in>snd ` set (the (lookup (\\<lambda>k. k = type) (snd sa))).\n        the (lookup (\\<lambda>k. k = type) tao) = length ars)\"\n  proof (standard+, goal_cases)\n    case (1 n Ss) \n    obtain c where c: \"(c, Ss) \\<in> set (the (lookup (\\<lambda>k. k = n) (snd sa)))\"\n      using \"1\"(2) by force\n    have \"dom (map_of (map (apsnd map_of) (snd sa))) = dom (map_of tao)\"\n      using assms(3) pre(2) tcsigs_translate by fastforce\n    show ?case\n      using assms(3) pre(2) c tcsigs_translate pre(2-3) domI \n      by (fastforce simp add: exe_osig_conds_def tcsigs_translate[OF assms(3)] \n          \"1\"(1) key_present_imp_eq_lookup_finds_value lookup_present_eq_key'\n          split: option.splits intro!: 3[of _ \"the (lookup (\\<lambda>k. k = n) (snd sa))\" \"snd sa\" c])+\n  qed\n  moreover have \"(\\<forall>ty \\<in> Map.ran (map_of cto) . wf_type (map_of cto, map_of tao, translate_osig sa) ty)\"\n    using \"1\"(4) by blast\n  ultimately show ?thesis \n    by (simp add: assms(1) ran_distinct)\nqed\n\nlemma wf_sig_iff_exe_wf_sig_pre: \"alist_conds cto \\<Longrightarrow> alist_conds tao \\<Longrightarrow> exe_osig_conds sa\n  \\<Longrightarrow> wf_sig (map_of cto, map_of tao, translate_osig sa) = (exe_wf_osig sa\n  \\<and> fst ` set (exetcsigs sa) = fst ` set tao  \n  \\<and> (\\<forall>type \\<in> fst ` set (exetcsigs sa).\n      (\\<forall>ars \\<in> snd ` set (the (lookup (\\<lambda>k. k=type) (exetcsigs sa))) .\n      the (lookup (\\<lambda>k. k=type) tao) = length ars))\n  \\<and> (\\<forall>ty \\<in> snd ` set cto . typ_ok_sig (map_of cto, map_of tao, translate_osig sa) ty))\"\n  using exe_wf_sig_imp_wf_sig wf_sig_imp_exe_wf_sig by meson\n\nlemma wf_sig_iff_exe_wf_sig: \"alist_conds cto \\<Longrightarrow> alist_conds tao \\<Longrightarrow> exe_osig_conds sa\n  \\<Longrightarrow> wf_sig (map_of cto, map_of tao, translate_osig sa)\n  \\<longleftrightarrow> exe_wf_sig (ExeSignature cto tao sa)\"\n  unfolding exe_wf_sig.simps\n  using wf_sig_iff_exe_wf_sig_pre by presburger\n\nfun translate_signature :: \"exesignature \\<Rightarrow> signature\" where\n  \"translate_signature (ExeSignature cto tao sa) \n    = (map_of cto, map_of tao, translate_osig sa)\"\n\nfun exetyp_ok_sig :: \"exesignature \\<Rightarrow> typ \\<Rightarrow> bool\" where\n  \"exetyp_ok_sig \\<Sigma> (Ty c Ts) = (case lookup (\\<lambda>k. k=c) (exetyp_arity_of \\<Sigma>) of\n    None \\<Rightarrow> False\n  | Some ar \\<Rightarrow> length Ts = ar \\<and> list_all (exetyp_ok_sig \\<Sigma>) Ts)\"\n| \"exetyp_ok_sig \\<Sigma> (Tv _ S) = exewf_sort (execlasses (exesorts \\<Sigma>)) S\"\n\nthm exewf_sort_def\ndefinition [simp]: \"exesort_ok_sig \\<Sigma> S \\<equiv> exesort_ex (execlasses (exesorts \\<Sigma>)) S \n  \\<and> exenormalized_sort (execlasses (exesorts \\<Sigma>)) S\"\n\nlemma typ_arity_lookup_code: \"type_arity (translate_signature \\<Sigma>) n = lookup (\\<lambda>k. k = n) (exetyp_arity_of \\<Sigma>)\"\n  by (cases \\<Sigma>) (simp add: lookup_eq_map_of_ap)\n\nlemma typ_ok_sig_code: \n  assumes \"exe_osig_conds (exesorts \\<Sigma>)\"\n  shows \"typ_ok_sig (translate_signature \\<Sigma>) ty = exetyp_ok_sig \\<Sigma> ty\"\n  using assms apply (induction ty) apply simp\n  apply (auto split: option.splits simp add: wf_sort_def list_all_iff typ_arity_lookup_code)[]\n  using wf_sort_code by (cases \\<Sigma>) (simp add: exe_osig_conds_def classes_translate)\n\nfun exe_wf_sig' where\n  \"exe_wf_sig' (ExeSignature cto tao sa) = (exe_wf_osig sa \\<and>\n  fst ` set (exetcsigs sa) = fst ` set tao \n  \\<and> (\\<forall>type \\<in> fst ` set (exetcsigs sa). \n    (\\<forall>ars \\<in> snd ` set (the (lookup (\\<lambda>k. k=type) (exetcsigs sa))) .\n      the (lookup (\\<lambda>k. k=type) tao) = length ars))\n  \\<and> (\\<forall>ty \\<in> snd ` set cto . exetyp_ok_sig (ExeSignature cto tao sa) ty))\"\n\nlemma exe_wf_sig_code[code]: \"exe_wf_sig \\<Sigma> = exe_wf_sig' \\<Sigma>\"\n  using typ_ok_sig_code by (cases \\<Sigma>, simp, metis exesignature.sel(3) translate_signature.simps)\n\nfun exeterm_ok' :: \"exesignature \\<Rightarrow> term \\<Rightarrow> bool\" where\n  \"exeterm_ok' \\<Sigma> (Fv _ T) = exetyp_ok_sig \\<Sigma> T\"\n| \"exeterm_ok' \\<Sigma> (Bv _) = True\"\n| \"exeterm_ok' \\<Sigma> (Ct s T) = (case lookup (\\<lambda>k. k=s) (execonst_type_of \\<Sigma>) of\n    None \\<Rightarrow> False\n  | Some ty \\<Rightarrow> exetyp_ok_sig \\<Sigma> T \\<and> tinstT T ty)\"\n| \"exeterm_ok' \\<Sigma> (t $ u) \\<longleftrightarrow> exeterm_ok' \\<Sigma> t \\<and> exeterm_ok' \\<Sigma> u\" \n| \"exeterm_ok' \\<Sigma> (Abs T t) \\<longleftrightarrow> exetyp_ok_sig \\<Sigma> T \\<and> exeterm_ok' \\<Sigma> t\"\n\nlemma const_type_of_lookup_code: \"const_type (translate_signature \\<Sigma>) n = lookup (\\<lambda>k. k = n) (execonst_type_of \\<Sigma>)\"\n  by (cases \\<Sigma>) (simp add: lookup_eq_map_of_ap)\n\nlemma wt_term_code: \n  assumes \"exe_osig_conds (exesorts \\<Sigma>)\"\n  shows \"term_ok' (translate_signature \\<Sigma>) t = exeterm_ok' \\<Sigma> t\"\n  by (induction t) (auto simp add: const_type_of_lookup_code assms typ_ok_sig_code split: option.splits)\n\ndatatype exetheory = ExeTheory (exesig: exesignature) (exeaxioms_of: \"term list\")\n\nlemma exetheory_full_exhaust: \"(\\<And>const_type typ_arity sorts axioms. \n    \\<Theta> = (ExeTheory (ExeSignature const_type typ_arity sorts) axioms) \\<Longrightarrow> P)\n  \\<Longrightarrow> P\"\n  apply (cases \\<Theta>) subgoal for \\<Sigma> axioms apply (cases \\<Sigma>) by auto done\n\ndefinition \"exe_sig_conds \\<Sigma> \\<equiv> alist_conds (execonst_type_of \\<Sigma>) \\<and> alist_conds (exetyp_arity_of \\<Sigma>) \n  \\<and> exe_osig_conds (exesorts \\<Sigma>)\"\n\nabbreviation \"illformed_theory \\<equiv>  ((Map.empty, Map.empty, illformed_osig), {})\"\n\nlemma illformed_theory_not_wf_theory: \"\\<not> wf_theory illformed_theory\" \n  by simp\n\nfun translate_theory :: \"exetheory \\<Rightarrow> theory\" where\n  \"translate_theory (ExeTheory \\<Sigma> ax) = (if exe_sig_conds \\<Sigma> then \n    (translate_signature \\<Sigma>, set ax) else illformed_theory)\"\n\nfun exe_wf_theory where \"exe_wf_theory (ExeTheory (ExeSignature cto tao sa) ax) \\<longleftrightarrow>\n  exe_sig_conds (ExeSignature cto tao sa) \\<and>\n    (\\<forall>p \\<in> set ax . term_ok (translate_theory (ExeTheory (ExeSignature cto tao sa) ax)) p \\<and> typ_of p = Some propT)\n  \\<and> is_std_sig (translate_signature (ExeSignature cto tao sa))\n  \\<and> exe_wf_sig (ExeSignature cto tao sa)\n  \\<and> eq_axs \\<subseteq> set ax\"\n\nlemma wf_sig_iff_exe_wf_sig': \"exe_sig_conds \\<Sigma> \\<Longrightarrow>\n    wf_sig (translate_signature \\<Sigma>) \\<longleftrightarrow>\n    exe_wf_sig \\<Sigma>\" \n  by (metis exe_sig_conds_def exesignature.exhaust_sel wf_sig_iff_exe_wf_sig translate_signature.simps)\n\nlemma wf_sig_imp_exe_wf_sig': \"exe_sig_conds \\<Sigma> \\<Longrightarrow>\n    wf_sig (translate_signature \\<Sigma>) \\<Longrightarrow>\n    exe_wf_sig \\<Sigma>\" \n  by (metis exe_sig_conds_def exesignature.exhaust_sel wf_sig_iff_exe_wf_sig translate_signature.simps)\n\nlemma exe_wf_sig_imp_wf_sig': \"exe_sig_conds \\<Sigma> \\<Longrightarrow>\n    exe_wf_sig \\<Sigma>\n    \\<Longrightarrow> wf_sig (translate_signature \\<Sigma>)\" \n  by (metis exe_sig_conds_def exesignature.exhaust_sel wf_sig_iff_exe_wf_sig translate_signature.simps)\n\nlemma wf_theory_translate_imp_exe_wf_theory:\n  assumes \"wf_theory (translate_theory a)\" shows \"exe_wf_theory a\" \nproof-\n  have \"exe_sig_conds (exesig a)\" using assms\n    by (metis exetheory.collapse illformed_theory_not_wf_theory translate_theory.simps)\n  moreover have \"wf_sig (translate_signature (exesig a))\n    \\<longleftrightarrow> exe_wf_sig (exesig a)\"\n    by (simp add: calculation(1) wf_sig_iff_exe_wf_sig')\n  ultimately show ?thesis using assms\n    by (cases a rule: exe_wf_theory.cases) (fastforce simp add: image_iff eq_fst_iff)\nqed\n\nlemma exe_wf_theory_translate_imp_wf_theory:\n  assumes \"exe_wf_theory a\" shows \"wf_theory (translate_theory a)\"\nproof-\n  have \"exe_sig_conds (exesig a)\" using assms\n    by (metis (full_types) exe_wf_theory.simps exesignature.exhaust_sel exetheory.sel(1) translate_theory.cases)\n  moreover hence \"\n  (\\<forall>ty \\<in> Map.ran (map_of (execonst_type_of (exesig a))) . typ_ok_sig (translate_signature (exesig a)) ty)\n  \\<longleftrightarrow> (\\<forall>ty \\<in> snd ` set (execonst_type_of (exesig a)) . typ_ok_sig (translate_signature (exesig a)) ty)\"\n    by (simp add: exe_sig_conds_def ran_distinct)\n  moreover have \"wf_sig (translate_signature (exesig a))\n    \\<longleftrightarrow> exe_wf_sig (exesig a)\"\n    by (simp add: calculation(1) wf_sig_iff_exe_wf_sig')\n  ultimately show ?thesis\n    using assms by (cases a rule: exe_wf_theory.cases) auto \nqed\n\nlemma wf_theory_translate_iff_exe_wf_theory:\n  \"wf_theory (translate_theory a) \\<longleftrightarrow> exe_wf_theory a\"\n  using exe_wf_theory_translate_imp_wf_theory wf_theory_translate_imp_exe_wf_theory by blast\n\nfun exeis_std_sig where \"exeis_std_sig (ExeSignature cto tao sorts) \\<longleftrightarrow>\n    lookup (\\<lambda>k. k = STR ''fun'') tao = Some 2 \\<and> lookup (\\<lambda>k. k = STR ''prop'') tao  = Some 0 \n  \\<and> lookup (\\<lambda>k. k = STR ''itself'') tao = Some 1\n  \\<and> lookup (\\<lambda>k. k = STR ''Pure.eq'') cto \n    = Some ((Tv (Var (STR '''a'', 0)) full_sort) \\<rightarrow> ((Tv (Var (STR '''a'', 0)) full_sort) \\<rightarrow> propT))\n  \\<and> lookup (\\<lambda>k. k = STR ''Pure.all'') cto = Some ((Tv (Var  (STR '''a'', 0)) full_sort \\<rightarrow> propT) \\<rightarrow> propT)\n  \\<and> lookup (\\<lambda>k. k = STR ''Pure.imp'') cto = Some (propT \\<rightarrow> (propT \\<rightarrow> propT))\n  \\<and> lookup (\\<lambda>k. k = STR ''Pure.type'') cto = Some (itselfT (Tv (Var (STR '''a'', 0)) full_sort))\"\n\nlemma is_std_sig_code: \"is_std_sig (translate_signature \\<Sigma>) = exeis_std_sig \\<Sigma>\"\n  by (cases \\<Sigma>) (auto simp add: lookup_eq_map_of_ap)\n\nfun exe_wf_theory' where \"exe_wf_theory' (ExeTheory (ExeSignature cto tao sa) ax) \\<longleftrightarrow>\n  exe_sig_conds (ExeSignature cto tao sa) \\<and>\n    (\\<forall>p \\<in> set ax . exeterm_ok' (ExeSignature cto tao sa) p \\<and> typ_of p = Some propT)\n  \\<and> exeis_std_sig (ExeSignature cto tao sa)\n  \\<and> exe_wf_sig (ExeSignature cto tao sa)\n  \\<and> eq_axs \\<subseteq> set ax\"\n\nlemma term_ok'_code: \n  assumes \"exe_osig_conds (exesorts (ExeSignature cto tao sa))\"\n  shows \"(term_ok' (translate_signature (ExeSignature cto tao sa)) p \\<and> typ_of p = Some propT)\n    = (exeterm_ok' (ExeSignature cto tao sa) p \\<and> typ_of p = Some propT)\"\n  using wt_term_code[OF assms] by force\n\nlemma term_ok_translate_code_step:\n  assumes \"exe_sig_conds (ExeSignature cto tao sa)\"\n  shows \"(term_ok (translate_theory (ExeTheory (ExeSignature cto tao sa) ax)) p \\<and> typ_of p = Some propT)\n    = (term_ok' (translate_signature (ExeSignature cto tao sa)) p \\<and> typ_of p = Some propT)\"\n  using assms by (auto simp add: wt_term_def split: if_splits)\n  \nlemma term_ok_theory_cond_code:\n  assumes \"exe_sig_conds (ExeSignature cto tao sa)\"\n  shows\"(\\<forall>p \\<in> set ax . term_ok (translate_theory (ExeTheory (ExeSignature cto tao sa) ax)) p \\<and> typ_of p = Some propT)\n    = (\\<forall>p \\<in> set ax . exeterm_ok' (ExeSignature cto tao sa) p \\<and> typ_of p = Some propT)\"\n  using assms wf_term_imp_term_ok' exe_sig_conds_def wt_term_code\n  by (fastforce simp add: term_ok_translate_code_step wt_term_code wt_term_def)\n  \nlemma exe_wf_theory_code[code]: \"exe_wf_theory \\<Theta> = exe_wf_theory' \\<Theta>\"\n  apply (cases \\<Theta> rule: exetheory_full_exhaust)\n  apply (simp only: exe_wf_theory.simps exe_wf_theory'.simps)\n  using term_ok_theory_cond_code is_std_sig_code by meson\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Metalogic_ProofChecker/TheoryExe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.328400491282156}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Late_Hennessy_Subst\n  imports Weak_Late_Bisim_Subst Weak_Late_Cong_Subst\nbegin\n\nlemma sim1:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  \n  assumes PSimQ: \"P \\<leadsto>\\<^sup>^<Rel> Q\"\n\n  shows \"\\<tau>.(P) \\<leadsto><Rel> Q\"\nproof(induct rule: simCases)\n  case(Bound Q' a x)\n  have \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n  moreover have xFreshP: \"x \\<sharp> P\"\n  proof -\n    have \"x \\<sharp> \\<tau>.(P)\" by fact\n    thus ?thesis by simp\n  qed\n  ultimately obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" using PSimQ\n    by(blast dest: Weak_Late_Sim.simE)\n  from PTrans have \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\"\n  proof(induct rule: transitionCases)\n    case Step\n    have \"P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\" by fact\n    with xFreshP obtain P''' P'' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau> P'''\"\n                                   and P'''Trans:  \"P''' \\<longmapsto>a<\\<nu>x> \\<prec> P''\"\n                                   and P''Chain: \"P'' \\<Longrightarrow>\\<^sub>\\<tau> P'\"\n      by(blast dest: transitionE)\n    have \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>\\<tau> P'''\"\n    proof -\n      have \"\\<tau>.(P) \\<longmapsto>\\<tau> \\<prec> P\" by(rule Late_Semantics.Tau)\n      thus ?thesis using PChain by auto\n    qed\n    thus ?case using P'''Trans P''Chain by(blast intro: Weak_Late_Step_Semantics.transitionI)\n  next\n    case Stay\n    have \"a<\\<nu>x> \\<prec> P' = \\<tau> \\<prec> P\" by fact\n    hence False by(simp add: residual.inject)\n    thus ?case by simp\n  qed\n  with P'RelQ' show ?case by blast\nnext\n  case(Input Q' a x)\n  have \"Q \\<longmapsto>a<x> \\<prec> Q'\" by fact\n  moreover have xFreshP: \"x \\<sharp> P\"\n  proof -\n    have \"x \\<sharp> \\<tau>.(P)\" by fact\n    thus ?thesis by simp\n  qed\n  ultimately obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\" using PSimQ\n    by(blast dest: Weak_Late_Sim.simE)\n  have \"\\<And>u. \\<exists>P'. \\<tau>.(P) \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\"\n  proof -\n    fix u\n    from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\" and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\" by blast    \n    from PTrans xFreshP obtain P''' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau> P'''\"\n                                     and P'''Trans:  \"P''' \\<longmapsto>a<x> \\<prec> P''\"\n                                     and P''Chain: \"P''[x::=u] \\<Longrightarrow>\\<^sub>\\<tau> P'\"\n      by(blast dest: transitionE)\n    have \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>\\<tau> P'''\"\n    proof -\n      have \"\\<tau>.(P) \\<longmapsto>\\<tau> \\<prec> P\" by(rule Late_Semantics.Tau)\n      thus ?thesis using PChain by auto\n    qed\n    hence \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\" using P'''Trans P''Chain by(blast intro: Weak_Late_Step_Semantics.transitionI)\n    with P'RelQ' show \"\\<exists>P'. \\<tau>.(P) \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\" by blast\n  qed\n  thus ?case by blast\nnext\n  case(Free Q' \\<alpha>)\n  have Trans: \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  then obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" using PSimQ\n    by(blast dest: Weak_Late_Sim.simE)\n  from PTrans have \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\"\n  proof(induct rule: transitionCases)\n    case Step\n    have \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by fact\n    then obtain P''' P'' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau> P'''\"\n                           and P'''Trans:  \"P''' \\<longmapsto>\\<alpha> \\<prec> P''\"\n                           and P''Chain: \"P'' \\<Longrightarrow>\\<^sub>\\<tau> P'\"\n      by(blast dest: transitionE)\n    have \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>\\<tau> P'''\"\n    proof -\n      have \"\\<tau>.(P) \\<longmapsto>\\<tau> \\<prec> P\" by(rule Late_Semantics.Tau)\n      thus ?thesis using PChain by auto\n    qed\n    thus ?case using P'''Trans P''Chain by(blast intro: Weak_Late_Step_Semantics.transitionI)\n  next\n    case Stay\n    have \"\\<alpha> \\<prec> P' = \\<tau> \\<prec> P\" by fact\n    hence \"\\<alpha> = \\<tau>\" and \"P = P'\" by(simp add: residual.inject)+\n    moreover have \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P\"\n    proof -\n      have \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>\\<tau>\\<tau>.(P)\" by simp\n      moreover have \"\\<tau>.(P) \\<longmapsto>\\<tau> \\<prec> P\" by(rule Late_Semantics.Tau)\n      moreover have \"P \\<Longrightarrow>\\<^sub>\\<tau> P\" by simp\n      ultimately show ?thesis by(blast intro: Weak_Late_Step_Semantics.transitionI)\n    qed\n    ultimately show ?case by force\n  qed\n  with P'RelQ' show ?case by blast\nqed\n\nlemma sim2:\n  fixes P  :: pi\n  and   Q  :: pi\n  and   P' :: pi\n\n  assumes PSimQ: \"P \\<leadsto>\\<^sup>^<Rel> Q\"\n  and     PRelQ: \"(P, Q) \\<in> Rel\"\n  and     PTrans: \"P \\<longmapsto>\\<tau> \\<prec> P'\"\n  and     P'RelP: \"(P', P) \\<in> Rel\"\n  and     Trans: \"\\<And>P Q R. \\<lbrakk>(P, Q) \\<in> Rel; (Q, R) \\<in> Rel\\<rbrakk> \\<Longrightarrow> (P, R) \\<in> Rel\"\n\n  shows \"P \\<leadsto><Rel> \\<tau>.(Q)\"\nproof(induct rule: simCases)\n  case(Bound Q' a x)\n  have \"\\<tau>.(Q) \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n  hence False by(force intro: tauCases)\n  thus ?case by simp\nnext\n  case(Input Q' a x)\n  have \"\\<tau>.(Q) \\<longmapsto> a<x> \\<prec> Q'\" by fact\n  hence False by(force intro: tauCases)\n  thus ?case by simp\nnext\n  case(Free Q' \\<alpha>)\n\n  have \"\\<tau>.(Q) \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  hence \"\\<alpha> = \\<tau>\" and \"Q = Q'\" by(drule_tac tauCases, auto simp add: pi.inject residual.inject)+\n  moreover from PTrans have \"P \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.singleActionChain)\n  moreover from P'RelP PRelQ have \"(P', Q) \\<in> Rel\" by(rule Trans)\n  ultimately show ?case by blast\nqed\n  \n\nlemma sim3:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto>\\<^sup>^<Rel> Q\"\n  and     PRelQ: \"(P, Q) \\<in> Rel\"\n  and     L1: \"\\<And>Q'. Q \\<longmapsto>\\<tau> \\<prec> Q' \\<Longrightarrow> (Q', Q) \\<notin> Rel\"\n  and     Trans: \"\\<And>P Q R. \\<lbrakk>(P, Q) \\<in> Rel; (Q, R) \\<in> Rel\\<rbrakk> \\<Longrightarrow> (P, R) \\<in> Rel\"\n  and     Sym: \"\\<And>P Q. (P, Q) \\<in> Rel \\<Longrightarrow> (Q, P) \\<in> Rel\"\n\n  shows \"P \\<leadsto><Rel> Q\"\nproof(induct rule: simCases)\n  case(Bound Q' a x)\n  have \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" and \"x \\<sharp> P\" by fact+\n  with PSimQ obtain P' where \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\" and \"(P', Q') \\<in> Rel\" by(blast dest: Weak_Late_Sim.simE)\n  thus ?case by(auto simp add: weakTransition_def)\nnext\n  case(Input Q' a x)\n  have \"Q \\<longmapsto>a<x> \\<prec> Q'\" and \"x \\<sharp> P\" by fact+\n  with PSimQ show ?case by(auto dest: Weak_Late_Sim.simE)\nnext\n  case(Free Q' \\<alpha>)\n  have QTrans: \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n    by(blast dest: Weak_Late_Sim.simE)\n  from PTrans show ?case\n  proof(induct rule: transitionCases)\n    case Step\n    have \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by fact\n    with P'RelQ' show ?case by blast\n  next\n    case Stay\n    have \"\\<alpha> \\<prec> P' = \\<tau> \\<prec> P\" by fact\n    hence \\<alpha>eq\\<tau>: \"\\<alpha> = \\<tau>\" and PeqP': \"P = P'\" by(simp add: residual.inject)+\n    from PRelQ P'RelQ' PeqP' Trans Sym have \"(Q, Q') \\<in> Rel\" by blast\n    moreover from QTrans \\<alpha>eq\\<tau> have \"(Q', Q) \\<notin> Rel\" by(blast dest: L1)\n    ultimately have False by(blast intro: Sym)\n    thus ?case by simp\n  qed\nqed\n\nlemma hennessy:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes PBisimQ: \"P \\<approx>\\<^sup>s Q\"\n\n  shows \"(\\<tau>.(P) \\<simeq>\\<^sup>s Q) \\<or> (P \\<simeq>\\<^sup>s Q) \\<or> (P \\<simeq>\\<^sup>s (\\<tau>.(Q)))\"\nproof(case_tac \"\\<exists>P'. P \\<longmapsto>\\<tau> \\<prec> P' \\<and> P' \\<approx> P\")\n  assume \"\\<exists>P'. P \\<longmapsto> \\<tau> \\<prec> P' \\<and> P' \\<approx> P\"\n  then obtain P' where PTrans: \"P \\<longmapsto>\\<tau> \\<prec> P'\" and P'BisimP: \"P' \\<approx> P\" by blast\n\n  have \"P \\<simeq>\\<^sup>s \\<tau>.(Q)\"\n  proof(rule_tac Weak_Late_Cong_Subst.unfoldI, auto)\n    fix s\n    from PBisimQ have \"P[<s>] \\<leadsto>\\<^sup>^<weakBisim> Q[<s>]\" by(force simp add: substClosed_def dest: Weak_Late_Bisim.unfoldE)\n    moreover from PBisimQ have \"P[<s>] \\<approx> Q[<s>]\" by(simp add: substClosed_def)\n    thus \"P[<s>]\\<leadsto><weakBisim> \\<tau>.(Q[<s>])\" using PTrans P'BisimP Weak_Late_Bisim.transitive by(rule sim2)\n    \n  have \"P \\<leadsto><weakBisim> \\<tau>.(Q)\"\n  proof -\n  qed\n  moreover have \"\\<tau>.(Q) \\<leadsto><weakBisim> P\"\n  proof -\n    from PBisimQ have \"Q \\<leadsto>\\<^sup>^<weakBisim> P\" by(blast dest: Weak_Late_Bisim.unfoldE)\n    thus ?thesis by(rule sim1)\n  qed\n  ultimately have \"\" by(simp add: congruence_def)\n  thus ?thesis by simp\nnext\n  assume \"\\<not>(\\<exists>P'. P \\<longmapsto>\\<tau> \\<prec> P' \\<and> P' \\<approx> P)\"\n  hence L1: \"\\<And>P'. P\\<longmapsto>\\<tau> \\<prec> P' \\<Longrightarrow> \\<not>(P' \\<approx> P)\" by simp\n  show ?thesis\n  proof(case_tac \"\\<exists>Q'. Q \\<longmapsto>\\<tau> \\<prec> Q' \\<and> Q' \\<approx> Q\")\n    assume \"\\<exists>Q'. Q \\<longmapsto>\\<tau> \\<prec> Q' \\<and> Q' \\<approx> Q\"\n    then obtain Q' where QTrans: \"Q \\<longmapsto>\\<tau> \\<prec> Q'\" and Q'BisimQ: \"Q' \\<approx> Q\" by blast\n    have \"\\<tau>.(P) \\<leadsto><weakBisim> Q\"\n    proof -\n      from PBisimQ have \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(blast dest: Weak_Late_Bisim.unfoldE)\n      thus ?thesis by(rule sim1)\n    qed\n    moreover have \"Q \\<leadsto><weakBisim> \\<tau>.(P)\"\n    proof -\n      from PBisimQ have \"Q \\<leadsto>\\<^sup>^<weakBisim> P\" by(blast dest: Weak_Late_Bisim.unfoldE)\n      moreover from PBisimQ have \"Q \\<approx> P\" by(rule Weak_Late_Bisim.symetric)\n      ultimately show ?thesis using QTrans Q'BisimQ Weak_Late_Bisim.transitive by(rule sim2)\n    qed\n    ultimately have \"\\<tau>.(P) \\<simeq> Q\" by(simp add: congruence_def)\n    thus ?thesis by simp\n  next\n    assume \"\\<not>(\\<exists>Q'. Q \\<longmapsto>\\<tau> \\<prec> Q' \\<and> Q' \\<approx> Q)\"\n    hence L2: \"\\<And>Q'. Q\\<longmapsto>\\<tau> \\<prec> Q' \\<Longrightarrow> \\<not>(Q' \\<approx> Q)\" by simp\n\n    have \"P \\<leadsto><weakBisim> Q\"\n    proof -\n      from PBisimQ have \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(blast dest: Weak_Late_Bisim.unfoldE)\n      thus ?thesis using PBisimQ L2 Weak_Late_Bisim.transitive Weak_Late_Bisim.symetric by(rule sim3)\n    qed\n    moreover have \"Q \\<leadsto><weakBisim> P\"\n    proof -\n      from PBisimQ have \"Q \\<leadsto>\\<^sup>^<weakBisim> P\" by(blast dest: Weak_Late_Bisim.unfoldE)\n      moreover from PBisimQ have \"Q \\<approx> P\" by(rule Weak_Late_Bisim.symetric)\n      ultimately show ?thesis using L1 Weak_Late_Bisim.transitive Weak_Late_Bisim.symetric by(rule sim3)\n    qed\n    ultimately have \"P \\<simeq> Q\" by(simp add: congruence_def)\n    thus ?thesis by simp\n  qed\nqed\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Late_Hennessy_Subst.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.328400491282156}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \\<open>32 bit standard platform-specific word size and alignment.\\<close>\n\ntheory Machine_Word_32_Basics\nimports \"HOL-Library.Word\" Word_32\nbegin\n\ntype_synonym machine_word_len = 32\n\ndefinition word_bits :: nat\nwhere\n  \\<open>word_bits = LENGTH(machine_word_len)\\<close>\n\nlemma word_bits_conv [code]:\n  \\<open>word_bits = 32\\<close>\n  by (simp add: word_bits_def)\n\ntext \\<open>The following two are numerals so they can be used as nats and words.\\<close>\n\ndefinition word_size_bits :: \\<open>'a :: numeral\\<close>\nwhere\n  \\<open>word_size_bits = 2\\<close>\n\ndefinition word_size :: \\<open>'a :: numeral\\<close>\nwhere\n  \\<open>word_size = 4\\<close>\n\nlemma n_less_word_bits:\n  \"(n < word_bits) = (n < 32)\"\n  by (simp add: word_bits_def word_size_def)\n\nlemmas upper_bits_unset_is_l2p_32 = upper_bits_unset_is_l2p [where 'a=32, folded word_bits_def]\n\nlemmas le_2p_upper_bits_32 = le_2p_upper_bits [where 'a=32, folded word_bits_def]\nlemmas le2p_bits_unset_32 = le2p_bits_unset[where 'a=32, folded word_bits_def]\n\nlemmas unat_power_lower32 [simp] = unat_power_lower32'[folded word_bits_def]\n\nlemmas word32_less_sub_le[simp] = word32_less_sub_le' [folded word_bits_def]\n\nlemmas word32_power_less_1[simp] = word32_power_less_1'[folded word_bits_def]\n\nlemma of_nat32_0:\n  \"\\<lbrakk>of_nat n = (0::word32); n < 2 ^ word_bits\\<rbrakk> \\<Longrightarrow> n = 0\"\n  by (erule of_nat_0, simp add: word_bits_def)\n\nlemmas unat_of_nat32 = unat_of_nat32'[folded word_bits_def]\n\nlemmas word_power_nonzero_32 = word_power_nonzero [where 'a=32, folded word_bits_def]\n\nlemmas div_power_helper_32 = div_power_helper [where 'a=32, folded word_bits_def]\n\nlemmas of_nat_less_pow_32 = of_nat_power [where 'a=32, folded word_bits_def]\n\nlemmas unat_mask_word32 = unat_mask_word32'[folded word_bits_def]\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Word_Lib/Machine_Word_32_Basics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3282884048402795}}
{"text": "theory flash91Bra  imports flash91Rev\n \n  begin\nlemma onInv91:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv91 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv91 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv91 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash91Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7431680199891789, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.3282372531024492}}
{"text": "theory flash98Bra  imports flash98Rev\n \n  begin\nlemma onInv98:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv98 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv98 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv98 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash98Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7431679972357829, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.32823724305288837}}
{"text": "(*  Title:      Uint16.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nchapter {* Unsigned words of 16 bits *}\n\ntheory Uint16 imports\n  Word_Misc\n  Bits_Integer\nbegin\n\ntext {*\n  Restriction for ML code generation:\n  This theory assumes that the ML system provides a Word16\n  implementation (mlton does, but PolyML 5.5 does not).\n  Therefore, the code setup lives in the target @{text SML_word}\n  rather than @{text SML}.  This ensures that code generation still\n  works as long as @{text \"uint16\"} is not involved.\n  For the target @{text SML} itself, no special code generation \n  for this type is set up. Nevertheless, it should work by emulation via @{typ \"16 word\"} \n  if the theory @{text Code_Target_Bits_Int} is imported.\n\n  Restriction for OCaml code generation:\n  OCaml does not provide an int16 type, so no special code generation \n  for this type is set up.\n*}\n\ndeclare prod.Quotient[transfer_rule]\n\nsection {* Type definition and primitive operations *}\n\ntypedef uint16 = \"UNIV :: 16 word set\" ..\n\nsetup_lifting type_definition_uint16\n\ntext {* Use an abstract type for code generation to disable pattern matching on @{term Abs_uint16}. *}\ndeclare Rep_uint16_inverse[code abstype]\n\ndeclare Quotient_uint16[transfer_rule]\n\ninstantiation uint16 :: \"{neg_numeral, modulo, comm_monoid_mult, comm_ring}\" begin\nlift_definition zero_uint16 :: uint16 is \"0\" .\nlift_definition one_uint16 :: uint16 is \"1\" .\nlift_definition plus_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op +\" .\nlift_definition minus_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op -\" .\nlift_definition uminus_uint16 :: \"uint16 \\<Rightarrow> uint16\" is uminus .\nlift_definition times_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op *\" .\nlift_definition divide_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op div\" .\nlift_definition modulo_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op mod\" .\ninstance by standard (transfer, simp add: algebra_simps)+\nend\n\ninstantiation uint16 :: linorder begin\nlift_definition less_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"op <\" .\nlift_definition less_eq_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"op \\<le>\" .\ninstance by standard (transfer, simp add: less_le_not_le linear)+\nend\n\nlemmas [code] = less_uint16.rep_eq less_eq_uint16.rep_eq\n\ninstantiation uint16 :: bitss begin\nlift_definition bitNOT_uint16 :: \"uint16 \\<Rightarrow> uint16\" is bitNOT .\nlift_definition bitAND_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitAND .\nlift_definition bitOR_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitOR .\nlift_definition bitXOR_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitXOR .\nlift_definition test_bit_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> bool\" is test_bit .\nlift_definition set_bit_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> bool \\<Rightarrow> uint16\" is set_bit .\nlift_definition set_bits_uint16 :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> uint16\" is \"set_bits\" .\nlift_definition lsb_uint16 :: \"uint16 \\<Rightarrow> bool\" is lsb .\nlift_definition shiftl_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is shiftl .\nlift_definition shiftr_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is shiftr .\nlift_definition msb_uint16 :: \"uint16 \\<Rightarrow> bool\" is msb .\ninstance ..\nend\n\nlemmas [code] = test_bit_uint16.rep_eq lsb_uint16.rep_eq msb_uint16.rep_eq\n\ninstantiation uint16 :: equal begin\nlift_definition equal_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"equal_class.equal\" .\ninstance by standard (transfer, simp add: equal_eq)\nend\n\nlemmas [code] = equal_uint16.rep_eq\n\ninstantiation uint16 :: size begin\nlift_definition size_uint16 :: \"uint16 \\<Rightarrow> nat\" is \"size\" .\ninstance ..\nend\n\nlemmas [code] = size_uint16.rep_eq\n\nlift_definition sshiftr_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" (infixl \">>>\" 55) is sshiftr .\n\nlift_definition uint16_of_int :: \"int \\<Rightarrow> uint16\" is \"word_of_int\" .\n\ndefinition uint16_of_nat :: \"nat \\<Rightarrow> uint16\"\nwhere \"uint16_of_nat = uint16_of_int \\<circ> int\"\n\nlift_definition int_of_uint16 :: \"uint16 \\<Rightarrow> int\" is \"uint\" .\nlift_definition nat_of_uint16 :: \"uint16 \\<Rightarrow> nat\" is \"unat\" .\n\ndefinition integer_of_uint16 :: \"uint16 \\<Rightarrow> integer\"\nwhere \"integer_of_uint16 = integer_of_int o int_of_uint16\"\n\ntext {* Use pretty numerals from integer for pretty printing *}\n\ncontext includes integer.lifting begin\n\nlift_definition Uint16 :: \"integer \\<Rightarrow> uint16\" is \"word_of_int\" .\n\nlemma Rep_uint16_numeral [simp]: \"Rep_uint16 (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint16_def Abs_uint16_inverse numeral.simps plus_uint16_def)\n\nlemma Rep_uint16_neg_numeral [simp]: \"Rep_uint16 (- numeral n) = - numeral n\"\nby(simp only: uminus_uint16_def)(simp add: Abs_uint16_inverse)\n\nlemma numeral_uint16_transfer [transfer_rule]:\n  \"(rel_fun op = cr_uint16) numeral numeral\"\nby(auto simp add: cr_uint16_def)\n\nlemma numeral_uint16 [code_unfold]: \"numeral n = Uint16 (numeral n)\"\nby transfer simp\n\nlemma neg_numeral_uint16 [code_unfold]: \"- numeral n = Uint16 (- numeral n)\"\nby transfer(simp add: cr_uint16_def)\n\nend\n\nlemma Abs_uint16_numeral [code_post]: \"Abs_uint16 (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint16_def numeral.simps plus_uint16_def Abs_uint16_inverse)\n\nlemma Abs_uint16_0 [code_post]: \"Abs_uint16 0 = 0\"\nby(simp add: zero_uint16_def)\n\nlemma Abs_uint16_1 [code_post]: \"Abs_uint16 1 = 1\"\nby(simp add: one_uint16_def)\n\nsection {* Code setup *}\n\ncode_printing code_module Uint16 \\<rightharpoonup> (SML_word)\n{*(* Test that words can handle numbers between 0 and 15 *)\nval _ = if 4 <= Word.wordSize then () else raise (Fail (\"wordSize less than 4\"));\n\nstructure Uint16 : sig\n  val set_bit : Word16.word -> IntInf.int -> bool -> Word16.word\n  val shiftl : Word16.word -> IntInf.int -> Word16.word\n  val shiftr : Word16.word -> IntInf.int -> Word16.word\n  val shiftr_signed : Word16.word -> IntInf.int -> Word16.word\n  val test_bit : Word16.word -> IntInf.int -> bool\nend = struct\n\nfun set_bit x n b =\n  let val mask = Word16.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))\n  in if b then Word16.orb (x, mask)\n     else Word16.andb (x, Word16.notb mask)\n  end\n\nfun shiftl x n =\n  Word16.<< (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr x n =\n  Word16.>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr_signed x n =\n  Word16.~>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun test_bit x n =\n  Word16.andb (x, Word16.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))) <> Word16.fromInt 0\n\nend; (* struct Uint16 *)*}\ncode_reserved SML_word Uint16\n\ncode_printing code_module Uint16 \\<rightharpoonup> (Haskell)\n{*import qualified Data.Word;\nimport qualified Data.Int;\n\ntype Int16 = Data.Int.Int16;\n\ntype Word16 = Data.Word.Word16;*}\ncode_reserved Haskell Uint16\n\ntext {* Scala provides unsigned 16-bit numbers as Char. *}\n\ncode_printing code_module Uint16 \\<rightharpoonup> (Scala)\n{*object Uint16 {\n\ndef set_bit(x: scala.Char, n: BigInt, b: Boolean) : scala.Char =\n  if (b)\n    (x | (1.toChar << n.intValue)).toChar\n  else\n    (x & (1.toChar << n.intValue).unary_~).toChar\n\ndef shiftl(x: scala.Char, n: BigInt) : scala.Char = (x << n.intValue).toChar\n\ndef shiftr(x: scala.Char, n: BigInt) : scala.Char = (x >>> n.intValue).toChar\n\ndef shiftr_signed(x: scala.Char, n: BigInt) : scala.Char = (x.toShort >> n.intValue).toChar\n\ndef test_bit(x: scala.Char, n: BigInt) : Boolean = (x & (1.toChar << n.intValue)) != 0\n\n} /* object Uint16 */*}\ncode_reserved Scala Uint16\n\ntext {* \n  Avoid @{term Abs_uint16} in generated code, use @{term Rep_uint16'} instead. \n  The symbolic implementations for code\\_simp use @{term Rep_uint16}.\n\n  The new destructor @{term Rep_uint16'} is executable.\n  As the simplifier is given the [code abstract] equations literally, \n  we cannot implement @{term Rep_uint16} directly, because that makes code\\_simp loop.\n\n  If code generation raises Match, some equation probably contains @{term Rep_uint16} \n  ([code abstract] equations for @{typ uint16} may use @{term Rep_uint16} because\n  these instances will be folded away.)\n\n  To convert @{typ \"16 word\"} values into @{typ uint16}, use @{term \"Abs_uint16'\"}.\n*}\n\ndefinition Rep_uint16' where [simp]: \"Rep_uint16' = Rep_uint16\"\n\nlemma Rep_uint16'_transfer [transfer_rule]:\n  \"rel_fun cr_uint16 op = (\\<lambda>x. x) Rep_uint16'\"\nunfolding Rep_uint16'_def by(rule uint16.rep_transfer)\n\n\n\nlift_definition Abs_uint16' :: \"16 word \\<Rightarrow> uint16\" is \"\\<lambda>x :: 16 word. x\" .\n\nlemma Abs_uint16'_code [code]:\n  \"Abs_uint16' x = Uint16 (integer_of_int (uint x))\"\nincluding integer.lifting by transfer simp\n\ndeclare [[code drop: \"term_of_class.term_of :: uint16 \\<Rightarrow> _\"]]\n\nlemma term_of_uint16_code [code]:\n  defines \"TR \\<equiv> typerep.Typerep\" and \"bit0 \\<equiv> STR ''Numeral_Type.bit0''\" shows\n  \"term_of_class.term_of x = \n   Code_Evaluation.App (Code_Evaluation.Const (STR ''Uint16.uint16.Abs_uint16'') (TR (STR ''fun'') [TR (STR ''Word.word'') [TR bit0 [TR bit0 [TR bit0 [TR bit0 [TR (STR ''Numeral_Type.num1'') []]]]]], TR (STR ''Uint16.uint16'') []]))\n       (term_of_class.term_of (Rep_uint16' x))\"\nby(simp add: term_of_anything)\n\nlemma Uin16_code [code abstract]: \"Rep_uint16 (Uint16 i) = word_of_int (int_of_integer_symbolic i)\"\nunfolding Uint16_def int_of_integer_symbolic_def by(simp add: Abs_uint16_inverse)\n\ncode_printing\n  type_constructor uint16 \\<rightharpoonup>\n  (SML_word) \"Word16.word\" and\n  (Haskell) \"Uint16.Word16\" and\n  (Scala) \"scala.Char\"\n| constant Uint16 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLargeInt (IntInf.toLarge _)\" and\n  (Haskell) \"(Prelude.fromInteger _ :: Uint16.Word16)\" and\n  (Haskell_Quickcheck) \"(Prelude.fromInteger (Prelude.toInteger _) :: Uint16.Word16)\" and\n  (Scala) \"_.charValue\"\n| constant \"0 :: uint16\" \\<rightharpoonup>\n  (SML_word) \"(Word16.fromInt 0)\" and\n  (Haskell) \"(0 :: Uint16.Word16)\" and\n  (Scala) \"0\"\n| constant \"1 :: uint16\" \\<rightharpoonup>\n  (SML_word) \"(Word16.fromInt 1)\" and\n  (Haskell) \"(1 :: Uint16.Word16)\" and\n  (Scala) \"1\"\n| constant \"plus :: uint16 \\<Rightarrow> _ \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.+ ((_), (_))\" and\n  (Haskell) infixl 6 \"+\" and\n  (Scala) \"(_ +/ _).toChar\"\n| constant \"uminus :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.~\" and\n  (Haskell) \"negate\" and\n  (Scala) \"(- _).toChar\"\n| constant \"minus :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.- ((_), (_))\" and\n  (Haskell) infixl 6 \"-\" and\n  (Scala) \"(_ -/ _).toChar\"\n| constant \"times :: uint16 \\<Rightarrow> _ \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.* ((_), (_))\" and\n  (Haskell) infixl 7 \"*\" and\n  (Scala) \"(_ */ _).toChar\"\n| constant \"HOL.equal :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"!((_ : Word16.word) = _)\" and\n  (Haskell) infix 4 \"==\" and\n  (Scala) infixl 5 \"==\"\n| class_instance uint16 :: equal \\<rightharpoonup> (Haskell) -\n| constant \"less_eq :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"Word16.<= ((_), (_))\" and\n  (Haskell) infix 4 \"<=\" and\n  (Scala) infixl 4 \"<=\"\n| constant \"less :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"Word16.< ((_), (_))\" and\n  (Haskell) infix 4 \"<\" and\n  (Scala) infixl 4 \"<\"\n| constant \"bitNOT :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.notb\" and\n  (Haskell) \"Data'_Bits.complement\" and\n  (Scala) \"_.unary'_~.toChar\"\n| constant \"bitAND :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.andb ((_),/ (_))\" and\n  (Haskell) infixl 7 \"Data_Bits..&.\" and\n  (Scala) \"(_ & _).toChar\"\n| constant \"bitOR :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.orb ((_),/ (_))\" and\n  (Haskell) infixl 5 \"Data_Bits..|.\" and\n  (Scala) \"(_ | _).toChar\"\n| constant \"bitXOR :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.xorb ((_),/ (_))\" and\n  (Haskell) \"Data'_Bits.xor\" and\n  (Scala) \"(_ ^ _).toChar\"\n\ndefinition uint16_div :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" \nwhere \"uint16_div x y = (if y = 0 then undefined (op div :: uint16 \\<Rightarrow> _) x (0 :: uint16) else x div y)\"\n\ndefinition uint16_mod :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" \nwhere \"uint16_mod x y = (if y = 0 then undefined (op mod :: uint16 \\<Rightarrow> _) x (0 :: uint16) else x mod y)\"\n\ncontext includes undefined_transfer begin\n\nlemma div_uint16_code [code]: \"x div y = (if y = 0 then 0 else uint16_div x y)\"\nunfolding uint16_div_def by transfer (simp add: word_div_def)\n\nlemma mod_uint16_code [code]: \"x mod y = (if y = 0 then x else uint16_mod x y)\"\nunfolding uint16_mod_def by transfer (simp add: word_mod_def)\n\nlemma uint16_div_code [code abstract]:\n  \"Rep_uint16 (uint16_div x y) =\n  (if y = 0 then Rep_uint16 (undefined (op div :: uint16 \\<Rightarrow> _) x (0 :: uint16)) else Rep_uint16 x div Rep_uint16 y)\"\nunfolding uint16_div_def by transfer simp\n\nlemma uint16_mod_code [code abstract]:\n  \"Rep_uint16 (uint16_mod x y) =\n  (if y = 0 then Rep_uint16 (undefined (op mod :: uint16 \\<Rightarrow> _) x (0 :: uint16)) else Rep_uint16 x mod Rep_uint16 y)\"\nunfolding uint16_mod_def by transfer simp\n\nend\n\ncode_printing constant uint16_div \\<rightharpoonup>\n  (SML_word) \"Word16.div ((_), (_))\" and\n  (Haskell) \"Prelude.div\" and\n  (Scala) \"(_ '/ _).toChar\"\n| constant uint16_mod \\<rightharpoonup>\n  (SML_word) \"Word16.mod ((_), (_))\" and\n  (Haskell) \"Prelude.mod\" and\n  (Scala) \"(_ % _).toChar\"\n\ndefinition uint16_test_bit :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> bool\"\nwhere [code del]:\n  \"uint16_test_bit x n =\n  (if n < 0 \\<or> 15 < n then undefined (test_bit :: uint16 \\<Rightarrow> _) x n\n   else x !! (nat_of_integer n))\"\n\nlemma test_bit_uint16_code [code]:\n  \"test_bit x n \\<longleftrightarrow> n < 16 \\<and> uint16_test_bit x (integer_of_nat n)\"\nunfolding uint16_test_bit_def including undefined_transfer integer.lifting \nby transfer(auto cong: conj_cong dest: test_bit_size simp add: word_size)\n\nlemma uint16_test_bit_code [code]:\n  \"uint16_test_bit w n =\n  (if n < 0 \\<or> 15 < n then undefined (test_bit :: uint16 \\<Rightarrow> _) w n else Rep_uint16 w !! nat_of_integer n)\"\nunfolding uint16_test_bit_def by(simp add: test_bit_uint16.rep_eq)\n\ncode_printing constant uint16_test_bit \\<rightharpoonup>\n  (SML_word) \"Uint16.test'_bit\" and\n  (Haskell) \"Data'_Bits.testBitBounded\" and\n  (Scala) \"Uint16.test'_bit\"\n\ndefinition uint16_set_bit :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> bool \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_set_bit x n b =\n  (if n < 0 \\<or> 15 < n then undefined (set_bit :: uint16 \\<Rightarrow> _) x n b\n   else set_bit x (nat_of_integer n) b)\"\n\nlemma set_bit_uint16_code [code]:\n  \"set_bit x n b = (if n < 16 then uint16_set_bit x (integer_of_nat n) b else x)\"\nincluding undefined_transfer integer.lifting unfolding uint16_set_bit_def\nby(transfer)(auto cong: conj_cong simp add: not_less set_bit_beyond word_size)\n\nlemma uint16_set_bit_code [code abstract]:\n  \"Rep_uint16 (uint16_set_bit w n b) = \n  (if n < 0 \\<or> 15 < n then Rep_uint16 (undefined (set_bit :: uint16 \\<Rightarrow> _) w n b)\n   else set_bit (Rep_uint16 w) (nat_of_integer n) b)\"\nincluding undefined_transfer unfolding uint16_set_bit_def by transfer simp\n\ncode_printing constant uint16_set_bit \\<rightharpoonup>\n  (SML_word) \"Uint16.set'_bit\" and\n  (Haskell) \"Data'_Bits.setBitBounded\" and\n  (Scala) \"Uint16.set'_bit\"\n\nlift_definition uint16_set_bits :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is set_bits_aux .\n\nlemma uint16_set_bits_code [code]:\n  \"uint16_set_bits f w n =\n  (if n = 0 then w \n   else let n' = n - 1 in uint16_set_bits f ((w << 1) OR (if f n' then 1 else 0)) n')\"\nby(transfer fixing: n)(cases n, simp_all)\n\nlemma set_bits_uint16 [code]:\n  \"(BITS n. f n) = uint16_set_bits f 0 16\"\nby transfer(simp add: set_bits_conv_set_bits_aux)\n\n\nlemma lsb_code [code]: fixes x :: uint16 shows \"lsb x = x !! 0\"\nby transfer(simp add: word_lsb_def word_test_bit_def)\n\n\ndefinition uint16_shiftl :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_shiftl x n = (if n < 0 \\<or> 16 \\<le> n then undefined (shiftl :: uint16 \\<Rightarrow> _) x n else x << (nat_of_integer n))\"\n\nlemma shiftl_uint16_code [code]: \"x << n = (if n < 16 then uint16_shiftl x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_shiftl_def\nby transfer(simp add: not_less shiftl_zero_size word_size)\n\nlemma uint16_shiftl_code [code abstract]:\n  \"Rep_uint16 (uint16_shiftl w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined (shiftl :: uint16 \\<Rightarrow> _) w n)\n   else Rep_uint16 w << nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_shiftl_def by transfer simp\n\ncode_printing constant uint16_shiftl \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftl\" and\n  (Haskell) \"Data'_Bits.shiftlBounded\" and\n  (Scala) \"Uint16.shiftl\"\n\ndefinition uint16_shiftr :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_shiftr x n = (if n < 0 \\<or> 16 \\<le> n then undefined (shiftr :: uint16 \\<Rightarrow> _) x n else x >> (nat_of_integer n))\"\n\nlemma shiftr_uint16_code [code]: \"x >> n = (if n < 16 then uint16_shiftr x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_shiftr_def\nby transfer(simp add: not_less shiftr_zero_size word_size)\n\nlemma uint16_shiftr_code [code abstract]:\n  \"Rep_uint16 (uint16_shiftr w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined (shiftr :: uint16 \\<Rightarrow> _) w n)\n   else Rep_uint16 w >> nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_shiftr_def by transfer simp\n\ncode_printing constant uint16_shiftr \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftr\" and\n  (Haskell) \"Data'_Bits.shiftrBounded\" and\n  (Scala) \"Uint16.shiftr\"\n\ndefinition uint16_sshiftr :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_sshiftr x n =\n  (if n < 0 \\<or> 16 \\<le> n then undefined sshiftr_uint16 x n else sshiftr_uint16 x (nat_of_integer n))\"\n\nlemma sshiftr_beyond: fixes x :: \"'a :: len word\" shows\n  \"size x \\<le> n \\<Longrightarrow> x >>> n = (if x !! (size x - 1) then -1 else 0)\"\nby(rule word_eqI)(simp add: nth_sshiftr word_size)\n\nlemma sshiftr_uint16_code [code]:\n  \"x >>> n = \n  (if n < 16 then uint16_sshiftr x (integer_of_nat n) else if x !! 15 then -1 else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_sshiftr_def\nby transfer (simp add: not_less sshiftr_beyond word_size)\n\nlemma uint16_sshiftr_code [code abstract]:\n  \"Rep_uint16 (uint16_sshiftr w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined sshiftr_uint16 w n)\n   else Rep_uint16 w >>> nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_sshiftr_def by transfer simp\n\ncode_printing constant uint16_sshiftr \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftr'_signed\" and\n  (Haskell) \n    \"(Prelude.fromInteger (Prelude.toInteger (Data'_Bits.shiftrBounded (Prelude.fromInteger (Prelude.toInteger _) :: Uint16.Int16) _)) :: Uint16.Word16)\" and\n  (Scala) \"Uint16.shiftr'_signed\"\n\nlemma uint16_msb_test_bit: \"msb x \\<longleftrightarrow> (x :: uint16) !! 15\"\nby transfer(simp add: msb_nth)\n\nlemma msb_uint16_code [code]: \"msb x \\<longleftrightarrow> uint16_test_bit x 15\"\nby(simp add: uint16_test_bit_def uint16_msb_test_bit)\n\nlemma uint16_of_int_code [code]: \"uint16_of_int i = Uint16 (integer_of_int i)\"\nincluding integer.lifting by transfer simp\n\nlemma int_of_uint16_code [code]:\n  \"int_of_uint16 x = int_of_integer (integer_of_uint16 x)\"\nby(simp add: integer_of_uint16_def)\n\nlemma nat_of_uint16_code [code]:\n  \"nat_of_uint16 x = nat_of_integer (integer_of_uint16 x)\"\nunfolding integer_of_uint16_def including integer.lifting by transfer (simp add: unat_def)\n\nlemma integer_of_uint16_code [code]:\n  \"integer_of_uint16 n = integer_of_int (uint (Rep_uint16' n))\"\nunfolding integer_of_uint16_def by transfer auto\n\ncode_printing\n  constant \"integer_of_uint16\" \\<rightharpoonup>\n  (SML_word) \"Word16.toInt _ : IntInf.int\" and\n  (Haskell) \"Prelude.toInteger\" and\n  (Scala) \"BigInt\"\n\nsection {* Quickcheck setup *}\n\ndefinition uint16_of_natural :: \"natural \\<Rightarrow> uint16\"\nwhere \"uint16_of_natural x \\<equiv> Uint16 (integer_of_natural x)\"\n\ninstantiation uint16 :: \"{random, exhaustive, full_exhaustive}\" begin\ndefinition \"random_uint16 \\<equiv> qc_random_cnv uint16_of_natural\"\ndefinition \"exhaustive_uint16 \\<equiv> qc_exhaustive_cnv uint16_of_natural\"\ndefinition \"full_exhaustive_uint16 \\<equiv> qc_full_exhaustive_cnv uint16_of_natural\"\ninstance ..\nend\n\ninstantiation uint16 :: narrowing begin\n\ninterpretation quickcheck_narrowing_samples\n  \"\\<lambda>i. let x = Uint16 i in (x, 0xFFFF - x)\" \"0\"\n  \"Typerep.Typerep (STR ''Uint16.uint16'') []\" .\n\ndefinition \"narrowing_uint16 d = qc_narrowing_drawn_from (narrowing_samples d) d\"\ndeclare [[code drop: \"partial_term_of :: uint16 itself \\<Rightarrow> _\"]]\nlemmas partial_term_of_uint16 [code] = partial_term_of_code\n\ninstance ..\nend\n\nno_notation sshiftr_uint16 (infixl \">>>\" 55)\n\nend\n", "meta": {"author": "PLSysSec", "repo": "ct-wasm-proofs", "sha": "3fa5c38ecda3d05c351096ba5e6d7ba1df793c21", "save_path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs", "path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs/ct-wasm-proofs-3fa5c38ecda3d05c351096ba5e6d7ba1df793c21/CT-WASM_model/AFP/Native_Word/Uint16.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3282330904745325}}
{"text": "theory Necessary\n  imports Computation\nbegin\n\nlocale necessary' = knft: kNFT ninit n\\<delta> naccept nQ + koTDFA init \\<delta> accept Q\n  for ninit :: \"'s\"\n  and n\\<delta> :: \"'s \\<Rightarrow> 'a :: finite \\<Rightarrow> 's \\<times> 'b list \\<Rightarrow> bool\"\n  and naccept :: \"'s \\<Rightarrow> bool\"\n  and nQ :: \"'s set\"\n  and init :: \"'t\"\n  and \\<delta> :: \"'t \\<Rightarrow> ('a :: finite) Al \\<times> 'b Al \\<Rightarrow> ('t \\<times> bool \\<times> bool) option\"\n  and accept :: \"'t \\<Rightarrow> bool\"\n  and Q :: \"'t set\" +\nassumes equiv: \"knft.\\<tau> = \\<tau>\"\nbegin\n\nabbreviation f\\<delta> :: \"'t \\<Rightarrow> 'b Al \\<times> 'a Al \\<Rightarrow> ('t \\<times> bool \\<times> bool) option\" where\n  \"f\\<delta> \\<equiv> (\\<lambda>q (b, a). case \\<delta> q (a, b) of None \\<Rightarrow> None | Some (q', b1, b2) \\<Rightarrow> Some (q', b2, b1))\"\n\ninterpretation flip: oTDFA init f\\<delta> accept Q\n  using finite_Q init_in_Q closed move_left move_right no_step move_one\n  apply unfold_locales\n        apply (auto split: option.splits)\n     apply fastforce+\n  done\n\nlemma flip_comp_intro: \"q \\<leadsto>(as, bs) q' \\<Longrightarrow> flip.computation q (bs, as) q'\"\n  by (induction q \"(as, bs)\" q' arbitrary: as bs rule: computation.induct) auto\n\nlemma flip_comp_dest: \"flip.computation q (bs, as) q' \\<Longrightarrow> q \\<leadsto>(as, bs) q'\"\n  by (induction q \"(bs, as)\" q' arbitrary: as bs rule: flip.computation.induct)\n     (auto split: option.splits)\n\nlemma flip_comp_eq: \"flip.computation q (bs, as) q' \\<longleftrightarrow> q \\<leadsto>(as, bs) q'\"\n  using flip_comp_intro flip_comp_dest\n  by blast\n\nlemmas flip_comp_to_states = flip.comp_to_states[unfolded flip_comp_eq]\nlemmas flip_states_to_comp = flip.states_to_comp[unfolded flip_comp_eq]\nlemmas flip_split_outs = flip.split_outs[unfolded flip_comp_eq]\n\nlemma split_long:\n  assumes \"length w \\<ge> n\"\n  shows \"\\<exists>v' v''. w = v' @ v'' \\<and> length v'' = n\"\n  using assms\n  by (metis append_take_drop_id diff_diff_cancel length_drop)\n\nlemma concat_filter: \"length qbs = length xs \\<Longrightarrow> length ns = length xs \\<Longrightarrow>\n  concat (map (\\<lambda>(n, (q, bs), tqs). bs) (filter (\\<lambda>(n, (q, bs), tqs). bs \\<noteq> [])\n  (zip ns (zip qbs xs)))) = concat (map snd qbs)\"\n  apply (induction qbs xs arbitrary: ns rule: list_induct2)\n   apply auto[1]\n  subgoal for x xs y ys ns\n    by (cases ns) auto\n  done\n\nlemma concat_length: \"(\\<And>n q bs tqs. (n, (q, bs), tqs) \\<in> set qss' \\<Longrightarrow> length bs \\<le> d) \\<Longrightarrow>\n  length (concat (map (\\<lambda>(n, (q, bs), tqs). bs) qss')) \\<le> length qss' * d\"\n  by (induction qss') fastforce+\n\nlemma sorted_dest: \"sorted xs \\<Longrightarrow> distinct xs \\<Longrightarrow> i < j \\<Longrightarrow> j < length xs \\<Longrightarrow> xs ! i < xs ! j\"\n  by (simp add: less_le nth_eq_iff_index_eq sorted_iff_nth_mono_less)\n\nlemma map2_zip: \"length qbs = length xs \\<Longrightarrow> length qbs = length ns \\<Longrightarrow>\n  qbs = map2 (\\<lambda>n ((q, bs), tqs). (q, bs)) ns (zip qbs xs)\"\n  apply (induction qbs xs arbitrary: ns rule: list_induct2)\n   apply auto[1]\n  subgoal for x xs y ys ns\n    by (cases ns) auto\n  done\n\nlemma map2_zip': \"length qbs = length xs \\<Longrightarrow> length qbs = length ns \\<Longrightarrow>\n  xs = map2 (\\<lambda>n ((q, bs), (bs', q')). (bs', q')) ns (zip qbs xs)\"\n  apply (induction qbs xs arbitrary: ns rule: list_induct2)\n   apply auto[1]\n  subgoal for x xs y ys ns\n    by (cases ns) auto\n  done\n\nlemma split_one: \"n < length xs \\<Longrightarrow> \\<exists>ys ys'. xs = ys @ (xs ! n) # ys' \\<and>\n  length ys = n \\<and> length ys' = length xs - (n + 1)\"\n  apply (induction n arbitrary: xs)\n  subgoal for xs\n    by (cases xs) auto\n  subgoal for n xs\n    apply (cases xs)\n     apply auto\n    apply (metis append_Cons length_Cons)\n    done\n  done\n\nlemma split_two: \"n < n' \\<Longrightarrow> n' < length xs \\<Longrightarrow>\n  \\<exists>ys ys' ys''. xs = ys @ (xs ! n) # ys' @ (xs ! n') # ys'' \\<and> length ys = n \\<and>\n  length ys' = n' - (n + 1) \\<and> length ys'' = length xs - (n' + 1)\"\nproof (induction n arbitrary: n' xs)\n  case 0\n  then show ?case\n  proof (cases xs)\n    case (Cons x xs')\n    then show ?thesis\n      using 0 split_one[of \"n' - 1\" xs']\n      by auto\n  qed auto\nnext\n  case (Suc n)\n  then show ?case\n  proof (cases xs)\n    case (Cons x xs')\n    have n'_shift: \"n < n' - 1\" \"n' - 1 < length xs'\"\n      using Suc(2,3)\n      by (auto simp add: Cons)\n    then obtain ys ys' ys'' where split: \"xs' = ys @ xs' ! n # ys' @ xs' ! (n' - 1) # ys''\"\n      \"length ys = n\" \"length ys' = n' - (Suc n + 1)\" \"length ys'' = length xs - (n' + 1)\"\n      using Suc(1)[OF n'_shift]\n      by (auto simp add: Cons)\n    show ?thesis\n      apply (rule exI[of _ \"x # ys\"])\n      using split Suc(2)\n      by (auto simp add: Cons)\n  qed auto\nqed\n\nlemma wits:\n  assumes \"\\<And>x. x \\<in> set xs \\<Longrightarrow> \\<exists>w. P w x\"\n  shows \"\\<exists>ws. length ws = length xs \\<and> (\\<forall>(w, x) \\<in> set (zip ws xs). P w x)\"\n  using assms\nproof (induction xs)\n  case (Cons x xs)\n  obtain w where w_def: \"P w x\"\n    using Cons(2)\n    by auto\n  obtain ws where ws_def: \"length ws = length xs\"\n    \"\\<And>a. a \\<in> set (zip ws xs) \\<Longrightarrow> case a of (a, b) \\<Rightarrow> P a b\"\n    using Cons\n    by fastforce\n  show ?case\n    using w_def ws_def\n    by (auto intro!: exI[of _ \"w # ws\"])\nqed auto\n\ndefinition \"sel1 \\<equiv> \\<lambda>a. case a of (x, y, z) \\<Rightarrow> x\"\ndefinition \"sel1' \\<equiv> \\<lambda>x y z. x\"\ndefinition \"sel2 \\<equiv> \\<lambda>a. case a of (x, y, z) \\<Rightarrow> y\"\ndefinition \"sel2' \\<equiv> \\<lambda>x y z. y\"\ndefinition \"sel3 \\<equiv> \\<lambda>a. case a of (x, y, z) \\<Rightarrow> z\"\ndefinition \"sel3' \\<equiv> \\<lambda>x y z. z\"\ndefinition \"sel4 \\<equiv> \\<lambda>a. case a of (x, y, z, w) \\<Rightarrow> z\"\ndefinition \"sel4' \\<equiv> \\<lambda>a. case a of (x, y, z, w) \\<Rightarrow> w\"\n\nlemma wits3:\n  assumes \"\\<And>x y z. (x, y, z) \\<in> set xs \\<Longrightarrow> \\<exists>w. P w x y z\"\n  shows \"\\<exists>ws. length ws = length xs \\<and> (\\<forall>(w, x, y, z) \\<in> set (zip ws xs). P w x y z)\"\n  using wits[OF assms, of _ sel1 sel2 sel3]\n  by (fastforce simp: sel1_def sel2_def sel3_def)\n\nfun trans :: \"nat \\<Rightarrow> 'x list list \\<Rightarrow> 'x list list\" where\n  \"trans 0 xss = []\"\n| \"trans (Suc n) xss = map hd xss # trans n (map tl xss)\"\n\nlemma len_trans: \"length (trans n xss) = n\"\n  by (induction n xss rule: trans.induct) auto\n\nlemma set_trans: \"(\\<And>xs. xs \\<in> set xss \\<Longrightarrow> set xs \\<subseteq> Q \\<and> length xs = n) \\<Longrightarrow>\n  set (trans n xss) \\<subseteq> {ys. set ys \\<subseteq> Q \\<and> length ys = length xss}\"\nproof (induction n xss rule: trans.induct)\n  case (2 n xss)\n  have \"set (trans n (map tl xss)) \\<subseteq> {ys. set ys \\<subseteq> Q \\<and> length ys = length (map tl xss)}\"\n    apply (rule 2(1))\n    apply (auto dest!: 2(2))\n    apply (metis list.sel(2) list.set_sel(2) subsetD)\n    done\n  then show ?case\n    using 2(2)\n    by auto (metis length_greater_0_conv list.set_sel(1) subsetD zero_less_Suc)\nqed auto\n\nlemma trans_nth: \"(\\<And>xs. xs \\<in> set xss \\<Longrightarrow> length xs = n) \\<Longrightarrow>\n  i < n \\<Longrightarrow> j < length xss \\<Longrightarrow> trans n xss ! i ! j = xss ! j ! i\"\n  apply (induction n xss arbitrary: i j rule: trans.induct)\n   apply auto\n  by (smt One_nat_def Suc_pred hd_conv_nth imageE length_0_conv length_tl less_Suc_eq_0_disj\n      nat.inject nat.simps(3) nth_Cons_0 nth_Cons_Suc nth_map nth_mem nth_tl)\n\nlemma one_loop_aux:\n  assumes \"knft.computation s (u, v) s'\" \"s \\<in> nQ\"\n    \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow> flip.computation r (([], w), (u, u')) r'\"\n    \"set (map (fst \\<circ> snd) ws) \\<subseteq> Q\"\n    \"length v \\<ge> (card nQ * card Q ^ length ws) * knft.output_speed + 1\"\n  shows \"\\<exists>u'' v''. length v'' < length v \\<and> knft.computation s (u'', v'') s' \\<and>\n    (\\<forall>(w, r, r') \\<in> set ws. flip.computation r (([], w), (u'', u')) r') \\<and>\n    safe_hd u = safe_hd u'' \\<and> safe_hd v = safe_hd v''\"\nproof -\n  obtain qbs where qbs_def: \"knft.computation_ext s (u, qbs) s'\" \"v = concat (map snd qbs)\"\n    using knft.computation_ext_complete[OF assms(1)]\n    by auto\n  note qbs_output_speed = knft.output_speed_ext_computation[OF qbs_def(1) assms(2)]\n  have len_qbs: \"length qbs = length u\"\n    using knft.computation_ext_length[OF qbs_def(1)]\n    by auto\n  obtain tqss' where tqss'_def: \"length tqss' = length ws\"\n    \"\\<And>tqs w r r'. (tqs, w, r, r') \\<in> set (zip tqss' ws) \\<Longrightarrow>\n      flip.computation_ext r (tqs, ([], w), (u, u')) r'\"\n    using wits3[OF flip.comp_to_ext[OF assms(3)]]\n    by fastforce\n  have set_tqss': \"\\<And>tqs w r r'. (tqs, w, r, r') \\<in> set (zip tqss' ws) \\<Longrightarrow> set tqs \\<subseteq> Q\"\n    apply (rule flip.ext_closed[OF tqss'_def(2)])\n    using assms(4)\n    by (auto simp: comp_def dest!: set_zip_rightD)\n  have len_tqss': \"\\<And>tqs w r r'. (tqs, w, r, r') \\<in> set (zip tqss' ws) \\<Longrightarrow> length tqs = length u\"\n    using flip.comp_ext_length[OF tqss'_def(2)]\n    by auto\n  define tqss where \"tqss = trans (length u) tqss'\"\n  define qss where \"qss = zip [0..<length qbs] (zip qbs tqss)\"\n  have len_tqss: \"length tqss = length u\"\n    by (auto simp: tqss_def len_trans)\n  have len_qss: \"length qss = length qbs\"\n    using len_qbs len_tqss\n    by (auto simp: qss_def)\n  have fst_qss_at: \"\\<And>i. i < length qss \\<Longrightarrow> fst (qss ! i) = i\"\n    using len_qbs\n    by (auto simp: qss_def)\n  have fst_set_qss: \"\\<And>x. x \\<in> set qss \\<Longrightarrow> fst x < length qss\"\n    using len_qbs len_tqss\n    by (auto simp: qss_def dest: set_zip_leftD)\n  define qss' where \"qss' = filter (\\<lambda>(n, (q, bs), tqs). bs \\<noteq> []) qss\"\n  have fst_set_qss': \"\\<And>x. x \\<in> set qss' \\<Longrightarrow> x \\<in> set qss\"\n    by (auto simp: qss'_def)\n  define qs where \"qs = map (\\<lambda>(n, (q, bs), tqs). (q, tqs)) qss'\"\n  have qss'_at: \"\\<And>i. i < length qss' \\<Longrightarrow>\n    fst (qss' ! i) < length qss \\<and> qss' ! i = qss ! (fst (qss' ! i))\"\n    using fst_qss_at fst_set_qss' fst_set_qss\n    by auto (metis fst_set_qss' in_set_conv_nth)\n  have qss'_nonempty: \"\\<And>n q bs tqs. (n, (q, bs), tqs) \\<in> set qss' \\<Longrightarrow> bs \\<noteq> []\"\n    by (auto simp: qss'_def)\n  have sorted_fst_qss: \"sorted (map fst qss)\" \"distinct (map fst qss)\"\n    using len_qbs len_tqss\n    by (auto simp: qss_def)\n  have sorted_fst_qss': \"sorted (map fst qss')\" \"distinct (map fst qss')\"\n    unfolding qss'_def\n    by (rule sorted_filter[OF sorted_fst_qss(1)])\n       (rule distinct_map_filter[OF sorted_fst_qss(2)])\n  have len_qs: \"length qs = length qss'\"\n    by (auto simp add: qs_def)\n  have set_qbs: \"\\<And>q bs. (q, bs) \\<in> set qbs \\<Longrightarrow> q \\<in> nQ\"\n    using knft.computation_ext_closed[OF qbs_def(1) assms(2)]\n    by auto\n  have tqs_tqss': \"\\<And>tqs. tqs \\<in> set tqss' \\<Longrightarrow> set tqs \\<subseteq> Q \\<and> length tqs = length u\"\n  proof -\n    fix tqs\n    assume \"tqs \\<in> set tqss'\"\n    then obtain i where i_def: \"i < length tqss'\" \"tqss' ! i = tqs\"\n      by (auto simp: in_set_conv_nth)\n    then have \"(tqs, fst (ws ! i), fst (snd (ws ! i)), snd (snd (ws ! i))) \\<in> set (zip tqss' ws)\"\n      using tqss'_def(1)\n      by (auto simp: in_set_conv_nth)\n    then show \"set tqs \\<subseteq> Q \\<and> length tqs = length u\"\n      using len_tqss' set_tqss'\n      by blast\n  qed\n  have concat_qss': \"concat (map (\\<lambda>(n, (q, bs), tqs). bs) qss') = concat (map snd qbs)\"\n    using concat_filter[of qbs tqss \"[0..<length qbs]\"] len_qbs len_tqss\n    by (auto simp: qss'_def qss_def)\n  have len_v_le: \"length v \\<le> length qss' * knft.output_speed\"\n    unfolding arg_cong[OF concat_qss', symmetric] qbs_def(2)\n    apply (rule concat_length[of qss' knft.output_speed])\n    using qbs_output_speed\n    by (auto simp: qss'_def qss_def dest: set_zip_leftD set_zip_rightD)\n  have len_qs_ge: \"length qs \\<ge> card nQ * card Q ^ length ws + 1\"\n  proof (rule ccontr)\n    assume \"\\<not>length qs \\<ge> card nQ * card Q ^ length ws + 1\"\n    then have \"length qs * knft.output_speed \\<le>\n      (card nQ * (card Q ^ (length ws))) * knft.output_speed\"\n      using knft.output_speed_pos\n      by simp\n    then show \"False\"\n      using le_trans[OF assms(5) len_v_le] le_trans\n      unfolding len_qs[symmetric]\n      by linarith\n  qed\n  have qs_sub: \"set qs \\<subseteq> nQ \\<times> {tqs. set tqs \\<subseteq> Q \\<and> length tqs = length ws}\"\n    using set_qbs set_trans[OF tqs_tqss'] len_qbs len_tqss tqss'_def(1)\n    by (fastforce simp: qs_def qss'_def qss_def tqss_def dest: set_zip_leftD set_zip_rightD)\n  have not_distinct: \"\\<not> distinct qs\"\n  proof (rule ccontr)\n    assume \"\\<not>\\<not> distinct qs\"\n    then have contr: \"distinct qs\"\n      by auto\n    have card_qs: \"card (set qs) \\<ge> card nQ * card Q ^ length ws + 1\"\n      using distinct_card[OF contr] len_qs_ge\n      by (auto simp add: qs_def)\n    have finite_lists: \"finite {tqs. set tqs \\<subseteq> Q \\<and> length tqs = length ws}\"\n      and card_lists: \"card {tqs. set tqs \\<subseteq> Q \\<and> length tqs = length ws} = (card Q) ^ (length ws)\"\n      using finite_lists_length_eq[OF finite_Q, of \"length ws\"]\n        card_lists_length_eq[OF finite_Q, of \"length ws\"]\n      by auto\n    have finite_prod: \"finite (nQ \\<times> {tqs. set tqs \\<subseteq> Q \\<and> length tqs = length ws})\"\n      using knft.finite_Q finite_lists\n      by blast\n    have card_prod: \"card (nQ \\<times> {tqs. set tqs \\<subseteq> Q \\<and> length tqs = length ws}) =\n      card nQ * (card Q) ^ (length ws)\"\n      unfolding card_cartesian_product card_lists ..\n    show \"False\"\n      using card_qs card_mono[OF finite_prod qs_sub]\n      by (auto simp add: card_prod)\n  qed\n  obtain qc qs' qs'' qs''' where qs_split: \"qs = qs' @ [qc] @ qs'' @ [qc] @ qs'''\"\n    using not_distinct_decomp[OF not_distinct]\n    by auto\n  define n where \"n = fst (qss' ! length qs')\"\n  define n' where \"n' = fst (qss' ! (length qs' + 1 + length qs''))\"\n  have valid_idx: \"length qs' < length qss'\" \"length qs' + 1 + length qs'' < length qss'\"\n    using qs_split len_qs len_qss\n    by auto\n  have qs_split_at: \"qs ! (length qs') = qc\" \"qs ! (length qs' + 1 + length qs'') = qc\"\n    using qs_split\n     apply auto\n    by (metis add_Suc_right nth_Cons_Suc nth_append_length nth_append_length_plus)\n  have n_n': \"n < n'\" \"n' < length qbs\" \"qss ! n = qss' ! length qs'\"\n    \"qss ! n' = qss' ! (length qs' + 1 + length qs'')\"\n    using qss'_at[OF valid_idx(1), folded n_def] qss'_at[OF valid_idx(2), folded n'_def]\n          len_qss valid_idx sorted_dest[OF sorted_fst_qss']\n    by (auto simp add: n_def n'_def)\n  have n_len_u: \"n < length u\" \"n' < length u\"\n    using n_n'(1,2) len_qbs\n    by auto\n  have qbs_map: \"qbs = map (\\<lambda>(n, (q, bs), tqs). (q, bs)) qss\"\n    using map2_zip[of qbs tqss \"[0..<length qbs]\"] len_qbs len_tqss\n    by (auto simp add: qss_def)\n  obtain qbs' qbs'' qbs''' where decomp: \"qbs = qbs' @ qbs ! n # qbs'' @ qbs ! n' # qbs'''\"\n    \"length qbs' = n\" \"length qbs'' = n' - (n + 1)\" \"length qbs''' = length qbs - (n' + 1)\"\n    using split_two[OF n_n'(1,2)]\n    by auto\n  obtain bs' where bs'_def: \"qbs ! n = (fst qc, bs')\" \"bs' \\<noteq> []\"\n    using qbs_map n_n' qs_def len_qs qs_split_at(1) valid_idx(1) qss'_nonempty\n    by (auto split: prod.splits) (metis in_set_conv_nth)\n  obtain bs'' where bs''_def: \"qbs ! n' = (fst qc, bs'')\" \"bs'' \\<noteq> []\"\n    using qbs_map n_n' qs_def len_qs qs_split_at(2) valid_idx(2) qss'_nonempty\n    by (auto split: prod.splits) (metis in_set_conv_nth)\n  have tqss_n: \"tqss ! n = snd qc\"\n    using qs_split_at(1) qs_def qss'_at[OF valid_idx(1), folded n_def] valid_idx(1)\n    by (auto simp: qss_def split: prod.splits)\n  have tqss_n': \"tqss ! n' = snd qc\"\n    using qs_split_at(2) qs_def qss'_at[OF valid_idx(2), folded n'_def] valid_idx(2)\n    by (auto simp: qss_def split: prod.splits)\n  obtain cs' cs'' cs''' c' c'' bs'a bs''' where new_comp:\n    \"knft.computation s (cs' @ c' # cs''', bs'a @ bs' @ bs''') s'\"\n    \"bs'a = concat (map snd qbs')\" \"bs''' = concat (map snd qbs''')\"\n    \"u = cs' @ c' # cs'' @ c'' # cs'''\" \"length cs' = length qbs'\" \"length cs'' = length qbs''\"\n    \"length cs''' = length qbs'''\"\n    using knft.computation_ext_rem[OF qbs_def(1)[unfolded decomp(1)[unfolded bs'_def bs''_def]]]\n    by auto\n  have new_length: \"length (bs'a @ bs' @ bs''') < length v\"\n    apply (auto simp add: new_comp(2,3) qbs_def(2))\n    apply (subst decomp(1))\n    apply (auto simp add: bs'_def bs''_def)\n    done\n  have rem_tqss': \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow>\n    flip.computation r (([], w), cs' @ c' # cs''', u') r'\"\n  proof -\n    fix w r r'\n    assume in_set: \"(w, r, r') \\<in> set ws\"\n    then obtain i where i_def: \"i < length ws\" \"(w, r, r') = ws ! i\"\n      using tqss'_def(1)\n      by (auto simp: in_set_conv_nth)\n    define tqs where \"tqs = tqss' ! i\"\n    have in_set_zip: \"(tqs, w, r, r') \\<in> set (zip tqss' ws)\"\n      using in_set i_def tqss'_def(1)\n      by (auto simp: in_set_conv_nth tqs_def)\n    note len_tqs = len_tqss'[OF in_set_zip]\n    have trans_n: \"trans (length u) tqss' ! n ! i = tqss' ! i ! n\"\n      apply (rule trans_nth)\n      using tqs_tqss' n_len_u(1) i_def(1) tqss'_def(1)\n      by auto\n    have trans_n': \"trans (length u) tqss' ! n' ! i = tqss' ! i ! n'\"\n      apply (rule trans_nth)\n      using tqs_tqss' n_len_u(2) i_def(1) tqss'_def(1)\n      by auto\n    have tqs_n_n': \"tqs ! n = tqs ! n'\"\n      using tqss_n tqss_n'\n      unfolding tqs_def trans_n[symmetric] trans_n'[symmetric] tqss_def[symmetric]\n      by auto\n    obtain ys ys' ys'' where tqs_split:\n      \"tqs = ys @ tqs ! n # ys' @ tqs ! n # ys''\"\n      \"length ys = n\" \"length ys' = n' - (n + 1)\" \"length ys'' = length tqs - (n' + 1)\"\n      using split_two[of n n' tqs] n_n'(1,2) len_qbs len_tqs\n      by (auto simp: tqs_n_n')\n    have comp_orig: \"flip.computation_ext r\n      (ys @ tqs ! n # ys' @ tqs ! n # ys'', ([], w), cs' @ c' # cs'' @ c'' # cs''', u') r'\"\n      using tqss'_def(2)[OF in_set_zip, unfolded new_comp(4)]\n      unfolding tqs_split(1)[symmetric] .\n    have comp_new: \"flip.computation_ext r (ys @ tqs ! n # ys'', ([], w), cs' @ c' # cs''', u') r'\"\n      using flip.ext_rem_loop[OF comp_orig] tqs_split(2,3)\n      by (auto simp: decomp(2,3) new_comp(5,6))\n    show \"flip.computation r (([], w), cs' @ c' # cs''', u') r'\"\n      using flip.ext_to_comp[OF comp_new] .\n  qed\n  have \"safe_hd u = safe_hd (cs' @ c' # cs''')\"\n    unfolding new_comp(4)\n    by (simp add: safe_hd_app_Cons)\n  moreover have \"safe_hd v = safe_hd (bs'a @ bs' @ bs''')\"\n    unfolding qbs_def(2)\n    apply (subst decomp(1))\n    using safe_hd_app'' bs'_def(2)\n    by (force simp: bs'_def(1) new_comp(2))\n  ultimately show ?thesis\n    using new_length new_comp(1) rem_tqss'\n    by blast\nqed\n\ndefinition tcard :: \"nat \\<Rightarrow> nat\" where\n  \"tcard n = (card nQ * card Q ^ n + 1) * knft.output_speed\"\n\nlemma one_loop:\n  assumes \"knft.computation s (u, v @ v') s'\" \"s \\<in> nQ\"\n    \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow> flip.computation r (([], w), (u, u')) r'\"\n    \"set (map (fst \\<circ> snd) ws) \\<subseteq> Q\" \"length v \\<ge> tcard (length ws) + 1\"\n  shows \"\\<exists>u'' v''. length v'' < length v \\<and> knft.computation s (u'', v'' @ v') s' \\<and>\n    (\\<forall>(w, r, r') \\<in> set ws. flip.computation r (([], w), (u'', u')) r') \\<and>\n    safe_hd u = safe_hd u'' \\<and> safe_hd (v @ v') = safe_hd (v'' @ v')\"\nproof -\n  obtain s'' as as' cs cs' where split:\n    \"knft.computation s (as, cs) s''\" \"knft.computation s'' (as', cs') s'\"\n    \"u = as @ as'\" \"v @ v' = cs @ cs'\" \"length cs \\<le> length v\"\n    \"length v - length cs \\<le> knft.output_speed\"\n    using knft.computation_split_out[OF assms(1,2)]\n    by auto\n  obtain es where v_def: \"v = cs @ es\"\n    using split_app[OF split(4)[symmetric] split(5)]\n    by auto\n  have cs'_def: \"cs' = es @ v'\"\n    using split(4)\n    by (auto simp: v_def)\n  obtain rs'' where rs''_def: \"length rs'' = length ws\"\n    \"\\<And>r'' w r r'. (r'', w, r, r') \\<in> set (zip rs'' ws) \\<Longrightarrow>\n      flip.computation r (([], w), as, as' @ u') r'' \\<and> flip.computation r'' (([], w), as', u') r'\"\n    using wits3[OF flip.comp_splitL[OF assms(3)[unfolded split(3)]], of ws sel1' sel2' sel3']\n    by (auto simp: sel1'_def sel2'_def sel3'_def split: prod.splits)\n  define ws' where \"ws' = map (\\<lambda>(r'', w, r, r'). (w, r, r'')) (zip rs'' ws)\"\n  have ws'_Q: \"set (map (fst \\<circ> snd) ws') \\<subseteq> Q\"\n    using assms(4) rs''_def(1)\n    by (auto simp: ws'_def dest!: set_zip_rightD)\n  have comp_ws': \"\\<And>w r r'. (w, r, r') \\<in> set ws' \\<Longrightarrow> flip.computation r (([], w), as, as' @ u') r'\"\n    using rs''_def\n    by (auto simp: ws'_def)\n  have len_ws': \"length ws' = length ws\"\n    using rs''_def(1)\n    by (auto simp: ws'_def)\n  have len_cs: \"(card nQ * card Q ^ length ws') * knft.output_speed + 1 \\<le> length cs\"\n    using assms(5) split(5,6)\n    unfolding len_ws'\n    by (auto simp: tcard_def)\n  obtain u'' v'' where rem: \"length v'' < length cs\"\n    \"knft.computation s (u'', v'') s''\"\n    \"\\<And>w r r'. (w, r, r') \\<in> set ws' \\<Longrightarrow> flip.computation r (([], w), u'', as' @ u') r'\"\n    \"safe_hd as = safe_hd u''\" \"safe_hd cs = safe_hd v''\"\n    using one_loop_aux[OF split(1) assms(2) comp_ws' ws'_Q len_cs]\n    by fastforce\n  have F1: \"length (v'' @ es) < length v\"\n    using rem(1)\n    by (auto simp: v_def)\n  have F3: \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow> flip.computation r (([], w), u'' @ as', u') r'\"\n  proof -\n    fix w r r'\n    assume \"(w, r, r') \\<in> set ws\"\n    then obtain i where i_def: \"i < length ws\" \"ws ! i = (w, r, r')\"\n      by (auto simp: in_set_conv_nth)\n    define r'' where \"r'' = rs'' ! i\"\n    have \"(w, r, r'') \\<in> set ws'\"\n      using rs''_def(1) i_def\n      by (auto simp: ws'_def r''_def)\n         (smt case_prod_conv image_iff len_ws' length_map nth_mem nth_zip ws'_def)\n    then have comp1: \"flip.computation r (([], w), u'', as' @ u') r''\"\n      using rem(3)\n      by auto\n    have \"(r'', w, r, r') \\<in> set (zip rs'' ws)\"\n      using rs''_def(1) i_def\n      by (auto simp: r''_def in_set_conv_nth)\n    then have comp2: \"flip.computation r'' (([], w), as', u') r'\"\n      using rs''_def(2)\n      by auto\n    show \"flip.computation r (([], w), u'' @ as', u') r'\"\n      using flip.comp_transR[OF comp1 comp2] .\n  qed\n  have F4: \"safe_hd (as @ as') = safe_hd (u'' @ as')\"\n    using rem(4) safe_hd_app\n    by auto\n  have F5: \"safe_hd (cs @ es @ v') = safe_hd ((v'' @ es) @ v')\"\n    using rem(5) safe_hd_app\n    by auto\n  show ?thesis\n    apply (rule exI[of _ \"u'' @ as'\"])\n    apply (rule exI[of _ \"v'' @ es\"])\n    using F1 knft.comp_trans[OF rem(2) split(2)] F3 F4 F5\n    unfolding split(3,4) cs'_def\n    by auto\nqed\n\nlemma one_conflict_aux:\n  assumes \"knft.computation s (u, v @ v') s'\" \"s \\<in> nQ\"\n    \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow> flip.computation r ((w, []), (u, [])) r'\"\n    \"set (map (fst \\<circ> snd) ws) \\<subseteq> Q\"\n    \"length v \\<ge> tcard (length ws) * (length (concat (map fst ws)) + 1) + 1\"\n  shows \"\\<exists>u'' v''. length v'' < length v \\<and> knft.computation s (u'', v'' @ v') s' \\<and>\n    (\\<forall>(w, r, r') \\<in> set ws. flip.computation r ((w, []), (u'', [])) r') \\<and>\n    safe_hd u = safe_hd u'' \\<and> safe_hd (v @ v') = safe_hd (v'' @ v')\"\n  using assms\nproof (induction \"length (concat (map fst ws))\" arbitrary: ws s u v)\n  case 0\n  have comp: \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow> flip.computation r (([], w), u, []) r'\"\n    using 0(1,4)\n    by auto\n  have len_v: \"tcard (length ws) + 1 \\<le> length v\"\n    using 0(1,6)\n    by auto\n  obtain u'' v'' where rem: \"length v'' < length v\"\n    \"knft.computation s (u'', v'' @ v') s'\"\n    \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow> flip.computation r (([], w), u'', []) r'\"\n    \"safe_hd u = safe_hd u''\" \"safe_hd (v @ v') = safe_hd (v'' @ v')\"\n    using one_loop[OF 0(2,3) comp 0(5) len_v]\n    by fastforce\n  have new_comp: \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow> flip.computation r ((w, []), u'', []) r'\"\n    using 0(1) rem(3)\n    by auto\n  show ?case\n    using rem(1,2) new_comp rem(4,5)\n    by fastforce\nnext\n  case (Suc l)\n  obtain cs cs' ts where wss_def: \"u = cs @ cs'\" \"length ts = length ws\"\n    \"\\<And>w r t r'. (t, w, r, r') \\<in> set (zip ts ws) \\<Longrightarrow>\n      flip.computation r (([], w), (cs, cs')) t \\<and> flip.computation t ((w, []), (cs', [])) r'\"\n    \"\\<exists>(t, w, r, r') \\<in> set (zip ts ws). \\<exists>t'.\n        f\\<delta> t (safe_hd w, safe_hd cs') = Some (t', True, False)\"\n    using flip.split_outss[of ws, OF Suc(5), simplified] Suc(2)\n    by (fastforce split: list.splits prod.splits)\n  obtain s'' bs bs' where knft_split: \"knft.computation s (cs, bs) s''\"\n    \"knft.computation s'' (cs', bs') s'\" \"v @ v' = bs @ bs'\"\n    using knft.computation_split[OF Suc(3)[unfolded wss_def(1)]]\n    by auto\n  have v_def: \"v = take (length v) (bs @ bs')\"\n    using knft_split(3) append_eq_conv_conj\n    by blast\n  have v'_def: \"v' = drop (length v) (bs @ bs')\"\n    using knft_split(3) append_eq_conv_conj\n    by blast\n  define vm where \"vm = tcard (length ws) + 1\"\n  have vm_len_v: \"vm \\<le> length v\"\n    using Suc(7)\n    by (auto simp: vm_def)\n  show ?case\n  proof (cases \"length bs \\<ge> vm\")\n    case True\n    define es where \"es = take vm bs\"\n    define es' where \"es' = drop vm bs\"\n    define es'' where \"es'' = drop vm (take (length v) (bs @ bs'))\"\n    have bs_def: \"bs = es @ es'\"\n      using True\n      by (simp add: es'_def es_def)\n    have v_def': \"v = es @ es''\"\n      using vm_len_v\n      apply (subst v_def)\n      apply (cases \"length bs \\<ge> length v\")\n       apply (auto simp: es_def es''_def True)\n      apply (metis drop_take le_add_diff_inverse take_add)\n      done\n    define ws' where \"ws' = map (\\<lambda>(t, w, r, r'). (w, r, t)) (zip ts ws)\"\n    have len_ws': \"length ws' = length ws\"\n      using wss_def(2)\n      by (auto simp: ws'_def)\n    have comp_ws': \"\\<And>w r r'. (w, r, r') \\<in> set ws' \\<Longrightarrow> flip.computation r (([], w), cs, cs') r'\"\n      using wss_def(2,3)\n      by (auto simp: ws'_def)\n    have ws'_Q: \"set (map (fst \\<circ> snd) ws') \\<subseteq> Q\"\n      using Suc(6)\n      by (auto simp: ws'_def dest!: set_zip_rightD)\n    have len_es: \"tcard (length ws') + 1 \\<le> length es\"\n      using True\n      by (auto simp: len_ws' es_def vm_def)\n    obtain u'' v'' where rem:\n      \"length v'' < length es\" \"knft.computation s (u'', v'' @ es') s''\"\n      \"\\<And>w r r'. (w, r, r') \\<in> set ws' \\<Longrightarrow> flip.computation r (([], w), u'', cs') r'\"\n      \"safe_hd cs = safe_hd u''\" \"safe_hd (es @ es') = safe_hd (v'' @ es')\"\n      using one_loop[OF knft_split(1)[unfolded bs_def] Suc(4) comp_ws' ws'_Q len_es]\n      by fastforce\n    have \"v @ v' = (es @ es'') @ v'\"\n      using v_def'\n      by auto\n    then have v''_app: \"(v'' @ es') @ bs' = (v'' @ es'') @ v'\"\n      unfolding bs_def knft_split(3)\n      by simp\n    have F1: \"length (v'' @ es'') < length v\"\n      using rem(1)\n      by (auto simp: v_def')\n    have F3: \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow> flip.computation r ((w, []), u'' @ cs', []) r'\"\n    proof -\n      fix w r r'\n      assume \"(w, r, r') \\<in> set ws\"\n      then obtain i where i_def: \"i < length ws\" \"ws ! i = (w, r, r')\"\n        by (auto simp: in_set_conv_nth)\n      have in_set_zip_ts_ws: \"(ts ! i, w, r, r') \\<in> set (zip ts ws)\"\n        using wss_def(2) i_def(1)\n        unfolding i_def(2)[symmetric]\n        by (auto simp: in_set_conv_nth)\n      then have comp_old: \"flip.computation r (([], w), cs, cs') (ts ! i)\"\n        \"flip.computation (ts ! i) ((w, []), cs', []) r'\"\n        using wss_def(3)\n        by auto\n      have comp_new: \"flip.computation r (([], w), u'', cs') (ts ! i)\"\n        apply (rule rem(3))\n        using in_set_zip_ts_ws image_iff\n        by (force simp: ws'_def)\n      show \"flip.computation r ((w, []), u'' @ cs', []) r'\"\n        using flip.comp_trans[OF comp_new comp_old(2)]\n        by auto\n    qed\n    have F4: \"safe_hd (cs @ cs') = safe_hd (u'' @ cs')\"\n      using rem(4) safe_hd_app\n      by auto\n    have F5: \"safe_hd ((es @ es') @ bs') = safe_hd ((v'' @ es') @ bs')\"\n      using rem(5) safe_hd_app\n      by fastforce\n    show ?thesis\n      apply (rule exI[of _ \"u'' @ cs'\"])\n      apply (rule exI[of _ \"v'' @ es''\"])\n      using F1 knft.comp_trans[OF rem(2) knft_split(2)] F3 F4 F5\n      unfolding v''_app[symmetric] wss_def(1) knft_split(3) bs_def\n      by auto\n  next\n    case False\n    obtain es where es_def: \"v = bs @ es\"\n      using split_app[OF knft_split(3)[symmetric]] False Suc(7)\n      by (auto simp: vm_def)\n    have bs'_def: \"bs' = es @ v'\"\n      using knft_split(3)\n      by (auto simp: es_def)\n    obtain i t' where i_def: \"i < length ts\"\n      \"f\\<delta> (ts ! i) (safe_hd (fst (ws ! i)), safe_hd cs') = Some (t', True, False)\"\n      using wss_def(2,4)\n      by (auto simp: in_set_conv_nth)\n    obtain x xs where wsi_def: \"fst (ws ! i) = x # xs\"\n      using flip.move_left[OF i_def(2)]\n      by (auto simp: safe_hd_def split: list.splits)\n    define ts' where \"ts' = take i ts @ t' # drop (Suc i) ts\"\n    define ws' where \"ws' = take i (map fst ws) @ tl (fst (ws ! i)) # drop (Suc i) (map fst ws)\"\n    define rs' where \"rs' = map (\\<lambda>(_, _, r'). r') ws\"\n    define wss' where \"wss' = zip ws' (zip ts' rs')\"\n    have len': \"length ts' = length ts\" \"length ws' = length ts\" \"length rs' = length ts\"\n      \"length wss' = length ws\"\n      using i_def(1) wss_def(2)\n      by (auto simp: ts'_def ws'_def rs'_def wss'_def)\n    have map_fst_wss': \"map fst wss' = ws'\"\n      using len'\n      by (auto simp: wss'_def)\n    have \"length (concat (map fst ws)) = length (concat (take i (map fst ws))) +\n      (Suc (length xs) + length (concat (drop (Suc i) (map fst ws))))\"\n      using i_def(1) wss_def(2)\n        arg_cong[of _ _ \"\\<lambda>x. length (concat (map fst x))\", OF id_take_nth_drop[of i ws]]\n      by (auto simp: wsi_def take_map drop_map)\n    then have l_def: \"l = length (concat (map fst wss'))\"\n      using Suc(2)\n      by (auto simp: map_fst_wss' ws'_def wsi_def)\n    have comp_wss': \"\\<And>w r r'. (w, r, r') \\<in> set wss' \\<Longrightarrow> flip.computation r ((w, []), cs', []) r'\"\n    proof -\n      fix w r r'\n      assume \"(w, r, r') \\<in> set wss'\"\n      then obtain j where j_def: \"j < length ws\" \"w = ws' ! j\" \"r = ts' ! j\" \"r' = rs' ! j\"\n        using len'\n        by (auto simp: wss'_def in_set_conv_nth)\n      show \"flip.computation r ((w, []), cs', []) r'\"\n      proof (cases \"j = i\")\n        case True\n        have \"case ws ! i of (w, _, r') \\<Rightarrow> flip.computation (ts ! i) ((w, []), cs', []) r'\"\n          using i_def(1) wss_def(2,3)\n          by (fastforce simp: in_set_conv_nth)\n        then show ?thesis\n          using i_def wss_def(2) wsi_def\n          by (auto simp: j_def(2,3,4) True ts'_def ws'_def rs'_def nth_append safe_hd_def\n              split: option.splits elim: flip.computation.cases)\n      next\n        case False\n        have \"(r, w, fst (snd (ws ! j)), r') \\<in> set (zip ts ws)\"\n          using False i_def(1) wss_def(2) j_def\n          by (auto simp: ws'_def ts'_def rs'_def nth_append min_def in_set_conv_nth\n              split: prod.splits)\n        then show ?thesis\n          using wss_def(3)\n          by auto\n      qed\n    qed\n    have len_es: \"tcard (length wss') * (length (concat (map fst wss')) + 1) + 1 \\<le> length es\"\n      using Suc(7)[unfolded es_def] False\n      by (auto simp: Suc(2)[symmetric] l_def[symmetric] len'(4) vm_def)\n    note s''_nQ = knft.comp_closed[OF knft_split(1) Suc(4)]\n    have wss'_Q: \"set (map (fst \\<circ> snd) wss') \\<subseteq> Q\"\n    proof (rule subsetI)\n      fix q\n      assume \"q \\<in> set (map (fst \\<circ> snd) wss')\"\n      then obtain j where j_def: \"j < length ws\" \"q = ts' ! j\"\n        using len'\n        by (auto simp: wss'_def in_set_conv_nth)\n      show \"q \\<in> Q\"\n      proof (cases \"j = i\")\n        case True\n        have \"(ts ! i, fst (ws ! i), fst (snd (ws ! i)), snd (snd (ws ! i))) \\<in> set (zip ts ws)\"\n          using i_def(1) wss_def(2)\n          by (auto simp: in_set_conv_nth)\n        then have \"flip.computation (fst (snd (ws ! i))) (([], fst (ws ! i)), cs, cs') (ts ! i)\"\n          using wss_def(3)\n          by fastforce\n        then have \"ts ! i \\<in> Q\"\n          apply (rule flip.comp_closed)\n          using Suc(6) i_def(1) wss_def(2)\n          by auto\n        then show ?thesis\n          using flip.closed[OF _ i_def(2)] i_def(1)\n          by (auto simp: j_def(2) True ts'_def nth_append min_def)\n      next\n        case False\n        have \"(q, fst (ws ! j), fst (snd (ws ! j)), snd (snd (ws ! j))) \\<in> set (zip ts ws)\"\n          using j_def(1) wss_def(2) False\n          by (auto simp: in_set_conv_nth j_def(2) ts'_def nth_append min_def split: prod.splits)\n        then have \"flip.computation (fst (snd (ws ! j))) (([], fst (ws ! j)), cs, cs') q\"\n          using wss_def(3)\n          by fastforce\n        then show ?thesis\n          apply (rule flip.comp_closed)\n          using Suc(6) j_def(1)\n          by auto\n      qed\n    qed\n    obtain u'' v'' where ind: \"length v'' < length es\"\n      \"knft.computation s'' (u'', v'' @ v') s'\"\n      \"\\<And>w r r'. (w, r, r') \\<in> set wss' \\<Longrightarrow> flip.computation r ((w, []), u'', []) r'\"\n      \"safe_hd cs' = safe_hd u''\" \"safe_hd (es @ v') = safe_hd (v'' @ v')\"\n      using Suc(1)[OF l_def knft_split(2)[unfolded bs'_def] s''_nQ comp_wss' wss'_Q len_es]\n      by fastforce\n    have flip_comp_trans: \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow>\n      flip.computation r ((w, []), cs @ u'', []) r'\"\n    proof -\n      fix w r r'\n      assume \"(w, r, r') \\<in> set ws\"\n      then obtain j where j_def: \"j < length ws\" \"ws ! j = (w, r, r')\"\n        by (auto simp: in_set_conv_nth)\n      have comp_fst: \"flip.computation r (([], w), cs, cs') (ts ! j)\"\n        apply (rule conjunct1[OF wss_def(3)])\n        using j_def wss_def(2)\n        by (auto simp: in_set_conv_nth)\n      show \"flip.computation r ((w, []), cs @ u'', []) r'\"\n      proof (cases \"j = i\")\n        case True\n        have w_def: \"w = x # xs\"\n          using j_def(2) wsi_def\n          by (auto simp: True)\n        have \"(xs, t', r') \\<in> set wss'\"\n          using i_def(1) wss_def(2) j_def(2) len' wsi_def\n          by (auto simp: in_set_conv_nth True wss'_def ws'_def ts'_def rs'_def nth_append min_def)\n        then have comp_snd': \"flip.computation t' ((xs, []), u'', []) r'\"\n          using ind(3)\n          by auto\n        have comp_snd: \"flip.computation (ts ! i) ((w, []), u'', []) r'\"\n          unfolding w_def\n          apply (rule flip.step_TF[OF _ comp_snd'])\n          using i_def(2)\n          by (auto simp: wsi_def ind(4) safe_hd_Cons)\n        show ?thesis\n          using flip.comp_trans[OF comp_fst[unfolded True] comp_snd] ind(4)\n          by auto\n      next\n        case False\n        have \"(w, ts ! j, r') \\<in> set wss'\"\n          using i_def(1) wss_def(2) j_def len' False\n          by (auto simp: in_set_conv_nth wss'_def ws'_def ts'_def rs'_def nth_append min_def)\n        then have comp_snd: \"flip.computation (ts ! j) ((w, []), u'', []) r'\"\n          using ind(3)\n          by auto\n        show ?thesis\n          using flip.comp_trans[OF comp_fst comp_snd] ind(4)\n          by auto\n      qed\n    qed\n    show ?thesis\n      apply (rule exI[of _ \"cs @ u''\"])\n      apply (rule exI[of _ \"bs @ v''\"])\n      using ind(1) knft.comp_trans[OF knft_split(1) ind(2)] flip_comp_trans ind(4,5)\n      by (auto simp: es_def wss_def(1) intro: safe_hd_app')\n  qed\nqed\n\nlemma one_conflict:\n  assumes \"knft.computation s (u, v) s'\" \"s \\<in> nQ\"\n    \"\\<And>w r r'. (w, r, r') \\<in> set ws \\<Longrightarrow> flip.computation r ((w, []), (u, [])) r'\"\n    \"set (map (fst \\<circ> snd) ws) \\<subseteq> Q\"\n    \"length v \\<ge> tcard (length ws) * (length (concat (map fst ws)) + 1) + 1\"\n  shows \"\\<exists>u'' v''. length v'' < length v \\<and>\n    length v - (tcard (length ws) * (length (concat (map fst ws)) + 1) + 1) \\<le> length v'' \\<and>\n    knft.computation s (u'', v'') s' \\<and>\n    (\\<forall>(w, r, r') \\<in> set ws. flip.computation r ((w, []), (u'', [])) r') \\<and>\n    safe_hd u = safe_hd u'' \\<and> safe_hd v = safe_hd v''\"\nproof -\n  define l where \"l = tcard (length ws) * (length (concat (map fst ws)) + 1) + 1\"\n  have knft_comp: \"knft.computation s (u, take l v @ drop l v) s'\"\n    using assms(1)\n    by auto\n  have len_take: \"tcard (length ws) * (length (concat (map fst ws)) + 1) + 1 \\<le> length (take l v)\"\n    using assms(5)\n    by (auto simp: l_def)\n  obtain u'' v'' where aux: \"length v'' < length (take l v)\"\n    \"knft.computation s (u'', v'' @ drop l v) s'\"\n    \"\\<forall>(w, r, r')\\<in>set ws. flip.computation r ((w, []), u'', []) r'\"\n    \"safe_hd u = safe_hd u''\" \"safe_hd (take l v @ drop l v) = safe_hd (v'' @ drop l v)\"\n    using one_conflict_aux[OF knft_comp assms(2,3,4) len_take]\n    by auto\n  show ?thesis\n    apply (rule exI[of _ u''])\n    apply (rule exI[of _ \"v'' @ drop l v\"])\n    using aux\n    by (auto simp add: l_def)\nqed\n\nfun minv :: \"nat \\<Rightarrow> nat\" where\n  \"minv 0 = (knft.sg + 1) * (card Q + 1) + (knft.sg + 1) * knft.output_speed\"\n| \"minv (Suc n) = tcard (Suc n) * ((sum_list (map minv [0..<Suc n]) + knft.output_speed) *\n    Suc n + 1) + knft.output_speed + 1\"\n\ndeclare minv.simps[simp del]\n\ndefinition sminv :: \"nat \\<Rightarrow> nat\" where\n  \"sminv n = sum_list (map minv [0..<Suc n])\"\n\nlemma sminv_Suc: \"sminv (Suc n) = sminv n + minv (Suc n)\"\n  by (auto simp: sminv_def)\n\nlemma sminv_ge_zero: \"minv 0 \\<le> sminv n\"\n  by (induction n) (auto simp: sminv_def)\n\nlemma tcard_pos: \"tcard x \\<ge> 1\"\n  using knft.output_speed_pos\n  by (auto simp: tcard_def)\n\nlemma sminv_Suc_ge_os: \"knft.output_speed \\<le> sminv (Suc n)\"\n  by (auto simp: sminv_Suc minv.simps)\n\nlemma minv_Suc_ge_sminv_os: \"sminv n + 2 * knft.output_speed \\<le> minv (Suc n)\"\nproof -\n  have \"sum_list (map minv [0..<n]) + minv n + knft.output_speed \\<le>\n    tcard (Suc n) * (sum_list (map minv [0..<n]) + minv n + knft.output_speed)\"\n    using tcard_pos[of \"Suc n\"]\n    by auto\n  moreover have \"\\<dots> \\<le> tcard (Suc n) * (sum_list (map minv [0..<n]) + minv n + knft.output_speed +\n    (sum_list (map minv [0..<n]) + minv n + knft.output_speed) * n)\"\n    by auto\n  finally show ?thesis\n    by (auto simp: minv.simps(2) sminv_def)\nqed\n\nlemma length_concat_le:\n  \"(\\<And>ws. ws \\<in> set wss \\<Longrightarrow> length ws \\<le> n) \\<Longrightarrow> length (concat wss) \\<le> n * length wss\"\n  by (induction wss) fastforce+\n\nlemma trans_list:\n  assumes \"(\\<And>x. x \\<in> set xs \\<Longrightarrow> \\<exists>x'. P x x' \\<and> P' x')\"\n  shows \"\\<exists>xs'. length xs = length xs' \\<and> (\\<forall>(x, x') \\<in> set (zip xs xs'). P x x') \\<and>\n    (\\<forall>x' \\<in> set xs'. P' x')\"\n  using assms\nproof (induction xs)\n  case (Cons x xs)\n  obtain x' xs' where \"P x x'\" \"P' x'\"\n    \"length xs = length xs'\" \"\\<forall>(x, x') \\<in> set (zip xs xs'). P x x'\" \"\\<forall>x' \\<in> set xs'. P' x'\"\n    using Cons\n    by fastforce\n  then show ?case\n    by (auto intro!: exI[of _ \"x' # xs'\"] split: prod.splits)\nqed auto\n\nlemma map_cong': \"length xs = length xs' \\<Longrightarrow>\n  (\\<And>x x'. (x, x') \\<in> set (zip xs xs') \\<Longrightarrow> f x = f' x') \\<Longrightarrow> map f xs = map f' xs'\"\n  by (induction xs xs' rule: list_induct2) auto\n\nlemma distinct_inj: \"inj f \\<Longrightarrow> distinct xs \\<Longrightarrow> distinct (map f xs)\"\n  by (induction xs) (auto simp: inj_def)\n\nlemma conflict_rec:\n  assumes \"knft.computation ninit (u0, v0) s\" \"knft.computation s (u, v @ v') s'\" \"naccept s'\"\n    \"init \\<leadsto>((u0, u), (v0 @ v, v')) r\" \"r \\<leadsto>((u, []), (v', [])) r'\" \"accept r'\"\n    \"length v' \\<le> minv 0\" \"sminv n \\<le> length (v @ v')\"\n    \"length (v @ v') \\<le> sminv n + knft.output_speed\"\n  shows \"\\<exists>u'' v'' ws. safe_hd u = safe_hd u'' \\<and> length ws = n \\<and>\n    knft.computation s (u'', v'') s' \\<and>\n    length v'' \\<le> length (v @ v') \\<and> distinct (map (\\<lambda>(cv, cw, r, r'). length (cv @ cw)) ws) \\<and>\n    (\\<forall>(cv, cw, r, r') \\<in> set ws. init \\<leadsto>((u0, u''), (v0 @ cv, cw)) r \\<and>\n      r \\<leadsto>((u'', []), (cw, [])) r' \\<and> accept r' \\<and>\n      length v'' < length (cv @ cw) \\<and> length (cv @ cw) \\<le> length (v @ v'))\"\n  using assms(1,2,4,5,7,8,9)\nproof (induction n arbitrary: u0 v0 s u v v' r)\n  case 0\n  show ?case\n    apply (rule exI[of _ u])\n    apply (rule exI[of _ \"v @ v'\"])\n    apply (rule exI[of _ \"[]\"])\n    using 0\n    by (auto simp: sminv_def)\nnext\n  case (Suc n)\n  have len_v'_le_sminv: \"length v' \\<le> sminv n\"\n    using Suc(6) sminv_ge_zero[of n]\n    by auto\n  have \"length v' \\<le> minv (Suc n)\"\n    using Suc(6) sminv_ge_zero[of n] minv_Suc_ge_sminv_os[of n]\n    by auto\n  then have len_v_ge_sminv: \"length v \\<ge> sminv n\"\n    using Suc(7) minv_Suc_ge_sminv_os[of n]\n    by (auto simp: sminv_Suc)\n  then have \"length v \\<ge> sminv n - length v'\"\n    by simp\n  then obtain es es' where es_def: \"v = es @ es'\"\n    \"length es' = sminv n - length v'\"\n    using split_long\n    by blast\n  have len_es_eq: \"length es = length v - sminv n + length v'\"\n    using len_v_ge_sminv len_v'_le_sminv\n    by (auto simp: es_def)\n  moreover have \"\\<dots> \\<ge> minv ((Suc n))\"\n    using Suc(7)\n    by (auto simp: sminv_Suc)\n  finally have len_es_ge: \"minv ((Suc n)) \\<le> length es\" .\n  have len_es_le: \"length es \\<le> minv ((Suc n)) + knft.output_speed\"\n    using Suc(8)[unfolded es_def(1)]\n    by (auto simp: es_def(2) sminv_Suc)\n  have knft_es: \"knft.computation s (u, es @ es' @ v') s'\"\n    using Suc(3)\n    by (auto simp: es_def(1))\n  note s_nQ = knft.comp_closed[OF Suc(2) knft.init_in_Q]\n  obtain s'' as as' cs cs' where knft_split:\n    \"knft.computation s (as, cs) s''\" \"knft.computation s'' (as', cs') s'\"\n    \"u = as @ as'\" \"es @ es' @ v' = cs @ cs'\" \"length cs \\<le> length es\"\n    \"length es - length cs \\<le> knft.output_speed\"\n    using knft.computation_split_out[OF knft_es s_nQ]\n    by auto\n  note s''_nQ = knft.comp_closed[OF knft_split(1) s_nQ]\n  obtain fs' where es_split: \"es = cs @ fs'\" \"cs' = fs' @ es' @ v'\"\n    using knft_split(4,5)\n    by (metis append_eq_append_conv_if append_eq_conv_conj)\n  have len_fs': \"length fs' \\<le> knft.output_speed\"\n    using knft_split(6)\n    by (auto simp: es_split(1))\n  obtain r'' ds ds' where tdfa_split: \"v' = ds @ ds'\" \"r\\<leadsto>((as, as' @ []), ds, ds' @ [])r''\"\n    \"r''\\<leadsto>((as', []), ds', [])r'\"\n    using comp_split[OF Suc(5)[unfolded knft_split(3)]]\n    by auto\n  note knft_fst = knft.comp_trans[OF Suc(2) knft_split(1)]\n  have knft_snd: \"knft.computation s'' (as', (fs' @ es' @ ds) @ ds') s'\"\n    using knft_split(2)\n    by (auto simp: es_split(2) tdfa_split(1))\n  have tdfa_fst: \"init \\<leadsto>((u0 @ as, as'), (v0 @ cs) @ fs' @ es' @ ds, ds')r''\"\n    using comp_trans[OF Suc(4) tdfa_split(2)]\n    by (auto simp: knft_split(3) tdfa_split(1) es_def(1) es_split(1,2))\n  have sminv_le: \"sminv n \\<le> length ((fs' @ es' @ ds) @ ds')\"\n    using Suc(7) es_def(2)\n    by (auto simp: es_def(1) tdfa_split(1) sminv_Suc)\n  have sminv_ge: \"length ((fs' @ es' @ ds) @ ds') \\<le> sminv n + knft.output_speed\"\n    using len_v'_le_sminv len_fs'\n    by (auto simp: es_def(2) tdfa_split(1))\n  have len_ds': \"length ds' \\<le> minv 0\"\n    using Suc(6)\n    by (auto simp: tdfa_split(1))\n  obtain u'' v'' ws where rec: \"safe_hd as' = safe_hd u''\" \"length ws = n\"\n    \"knft.computation s'' (u'', v'') s'\"\n    \"length v'' \\<le> length ((fs' @ es' @ ds) @ ds')\"\n    \"distinct (map (\\<lambda>(cv, cw, r, r'). length (cv @ cw)) ws)\"\n    \"\\<And>cv cw r r'. (cv, cw, r, r') \\<in> set ws \\<Longrightarrow> init\\<leadsto>((u0 @ as, u''), (v0 @ cs) @ cv, cw)r \\<and>\n      r\\<leadsto>((u'', []), cw, [])r' \\<and> accept r' \\<and> length v'' < length (cv @ cw) \\<and>\n      length (cv @ cw) \\<le> length ((fs' @ es' @ ds) @ ds')\"\n    using Suc(1)[OF knft_fst knft_snd tdfa_fst tdfa_split(3) len_ds' sminv_le sminv_ge]\n    by fastforce\n  have safe_hd_u''_as: \"safe_hd (as @ u'') = safe_hd u\"\n    using safe_hd_app'[OF rec(1)]\n    by (auto simp: knft_split(3))\n  obtain ws' where ws'_def: \"length ws = length ws'\" \"\\<forall>(x, x')\\<in>set (zip ws ws').\n    case x of (cv, cw, r, r') \\<Rightarrow> case x' of (cv', cw', s, s') \\<Rightarrow> cs @ cv @ cw = cv' @ cw'\"\n    \"\\<forall>x' \\<in> set ws'. case x' of (cv', cw', s, s') \\<Rightarrow> init\\<leadsto>((u0, as @ u''), v0 @ cv', cw')s \\<and>\n      s\\<leadsto>((as @ u'', []), cw', [])s' \\<and> accept s' \\<and> length (cs @ v'') < length (cv' @ cw') \\<and>\n      length (cv' @ cw') \\<le> length (v @ v') \\<and> length cw' \\<le> sminv n + knft.output_speed\"\n  proof (atomize_elim, rule trans_list)\n    fix x\n    assume x_in_ws: \"x \\<in> set ws\"\n    obtain cv cw cr cr' where x_def: \"x = (cv, cw, cr, cr')\"\n      by (cases x) auto\n    have comp_cr_cr': \"cr\\<leadsto>((u'', []), cw, [])cr'\"\n      using rec(6) x_in_ws\n      by (auto simp: x_def)\n    note rec_props = rec(6)[OF x_in_ws[unfolded x_def]]\n    obtain nv nw ns where ns_def: \"cv = nv @ nw\"\n      \"init\\<leadsto>((u0, as @ u''), (v0 @ cs) @ nv, nw @ cw)ns\" \"ns\\<leadsto>((as, u''), nw, cw)cr\"\n      using det_comp_safe[OF conjunct1[OF rec_props] _ safe_hd_u''_as]\n        Suc(4)\n      by (fastforce simp: es_def es_split(1))\n    have len_cv_cw: \"length nv + length nw + length cw \\<le> length ((fs' @ es' @ ds) @ ds')\"\n      using rec_props\n      by (auto simp: ns_def(1))\n    have len_v_v'_ge: \"length cs + length nv + (length nw + length cw) \\<le> length v + length v'\"\n      using len_cv_cw\n      by (auto simp: es_def(1) tdfa_split(1) es_split(1))\n    have comp_init_ns: \"init\\<leadsto>((u0, as @ u''), v0 @ cs @ nv, nw @ cw)ns\"\n      using ns_def(2) safe_hd_app'[OF rec(1)] comp_swap_same_hd\n      by auto\n    have comp_ns_cr': \"ns\\<leadsto>((as @ u'', []), nw @ cw, [])cr'\"\n      using comp_trans[OF ns_def(3) comp_cr_cr'] rec(1)\n      by auto\n    show \"\\<exists>x'. (case x of (cv, cw, r, r') \\<Rightarrow> case x' of (cv', cw', s, s') \\<Rightarrow>\n        cs @ cv @ cw = cv' @ cw') \\<and>\n      (case x' of (cv', cw', s, s') \\<Rightarrow> init\\<leadsto>((u0, as @ u''), v0 @ cv', cw')s \\<and>\n        s\\<leadsto>((as @ u'', []), cw', [])s' \\<and> accept s' \\<and> length (cs @ v'') < length (cv' @ cw') \\<and>\n        length (cv' @ cw') \\<le> length (v @ v') \\<and> length cw' \\<le> sminv n + knft.output_speed)\"\n      apply (rule exI[of _ \"(cs @ nv, nw @ cw, ns, cr')\"])\n      using ns_def rec_props knft_split(5) comp_init_ns comp_ns_cr' len_v_v'_ge sminv_ge\n      by (auto simp: x_def)\n  qed\n  have set_ws'_dest: \"\\<And>cv' cw' s s'. (cv', cw', s, s') \\<in> set ws' \\<Longrightarrow>\n    init\\<leadsto>((u0, as @ u''), v0 @ cv', cw')s \\<and> s\\<leadsto>((as @ u'', []), cw', [])s' \\<and> accept s' \\<and>\n    length (cs @ v'') < length (cv' @ cw') \\<and> length (cv' @ cw') \\<le> length (v @ v') \\<and>\n    length cw' \\<le> sminv n + knft.output_speed\"\n    using ws'_def\n    by auto\n  have \"(u0 @ as @ u'', v0 @ cs @ v'') \\<in> \\<tau>\"\n    using knft.comp_trans[OF Suc(2) knft.comp_trans[OF knft_split(1) rec(3)]] assms(3)\n    by (auto simp: knft.\\<tau>_def equiv[symmetric])\n  then obtain nr' where new_comp: \"init \\<leadsto>((u0 @ as @ u'', []), ((v0 @ cs) @ v'', [])) nr'\"\n    \"accept nr'\"\n    by (auto simp: \\<tau>_def)\n  have safe_hd_u_as: \"safe_hd u = safe_hd (as @ u'')\"\n    using safe_hd_app' rec(1)\n    by (fastforce simp: knft_split(3))\n  obtain nw nw' nr where nr_def: \"v'' = nw @ nw'\" \"init\\<leadsto>((u0, as @ u''), (v0 @ cs) @ nw, nw')nr\"\n    \"nr\\<leadsto>((as @ u'', []), nw', [])nr'\"\n    apply atomize_elim\n    using det_comp_safe[OF new_comp(1)] Suc(4) safe_hd_u_as\n    by (auto simp: es_def(1) es_split(1))\n  have len_nw': \"length nw' \\<le> sminv n + knft.output_speed\"\n    using rec(4) sminv_ge\n    by (auto simp: nr_def(1))\n  define nws where \"nws = ws' @ [(cs @ nw, nw', nr, nr')]\"\n  have len_nws: \"length nws = Suc n\"\n    by (auto simp: nws_def ws'_def(1)[symmetric] rec(2))\n  have flip_comp: \"\\<And>cw r r'. (cw, r, r') \\<in> set (map snd nws) \\<Longrightarrow>\n    flip.computation r ((cw, []), as @ u'', []) r'\"\n    using nr_def(3)\n    by (auto simp: flip_comp_eq nws_def dest: set_ws'_dest)\n  have tdfa_closed: \"set (map (fst \\<circ> snd) (map snd nws)) \\<subseteq> Q\"\n    using comp_closed[OF _ init_in_Q] nr_def(2)\n    by (auto simp: nws_def dest: set_ws'_dest)\n  have len_ws_rw: \"length ws = length (map fst (map snd ws))\"\n    by auto\n  note comp_s_s' = knft.comp_trans[OF knft_split(1) rec(3)]\n  have length_nws_ws: \"length nws = length (map fst (map snd nws))\"\n    by auto\n  have len_concat_sminv: \"length (concat (map fst (map snd nws))) \\<le>\n    (sminv n + knft.output_speed) * length nws\"\n    apply (subst length_nws_ws)\n    apply (rule length_concat_le)\n    using len_nw'\n    by (auto simp: nws_def dest: set_ws'_dest)\n  have len_cs_v'': \"tcard (length (map snd nws)) *\n    (length (concat (map fst (map snd nws))) + 1) + 1 \\<le> length (cs @ v'')\"\n  proof -\n    have \"tcard (length (map snd nws)) * (length (concat (map fst (map snd nws))) + 1) + 1 \\<le>\n      tcard (Suc n) * ((sminv n + knft.output_speed) * length nws + 1) + 1\"\n      using len_concat_sminv\n      by (auto simp: len_nws)\n    moreover have \"\\<dots> \\<le> minv (Suc n) - knft.output_speed\"\n      unfolding sminv_Suc minv.simps sminv_def[symmetric] len_nws\n      using knft.output_speed_pos\n      by simp\n    finally show ?thesis\n      using knft_split(6) len_es_ge\n      by simp\n  qed\n  obtain u''' v''' where conflict: \"length v''' < length (cs @ v'')\"\n    \"length (cs @ v'') - (tcard (length (map snd nws)) *\n      (length (concat (map fst (map snd nws))) + 1) + 1)  \\<le> length v'''\"\n    \"knft.computation s (u''', v''') s'\"\n    \"(\\<forall>(w, r, r')\\<in>set (map snd nws). r \\<leadsto>((u''', []), (w, [])) r')\"\n    \"safe_hd (as @ u'') = safe_hd u'''\" \"safe_hd (cs @ v'') = safe_hd v'''\"\n    using one_conflict[OF comp_s_s' s_nQ flip_comp tdfa_closed len_cs_v'']\n    by (auto simp: flip_comp_eq)\n  have safe_hd_u_u''': \"safe_hd u = safe_hd u'''\"\n    using safe_hd_u_as conflict(5)\n    by auto\n  have nr_swap: \"init\\<leadsto>((u0, u'''), (v0 @ cs) @ nw, nw')nr\"\n    using nr_def(2) comp_swap_same_hd[OF _ conflict(5) refl]\n    by simp\n  have len_cs_v''_le: \"length (cs @ v'') \\<le> length (v @ v')\"\n    using knft_split(4) rec(4)\n    by (auto simp: es_def(1) es_split(2) tdfa_split(1))\n  then have len_v'''_le: \"length v''' \\<le> length (v @ v')\"\n    using conflict(1)\n    by auto\n  have M1: \"map (\\<lambda>(cv, cw, r, r'). length (cs @ cv @ cw)) ws =\n    map (\\<lambda>n. length cs + n) (map (\\<lambda>(cv, cw, r, r'). length (cv @ cw)) ws)\"\n    by auto\n  have M2: \"map (\\<lambda>(cv, cw, r, r'). length (cs @ cv @ cw)) ws =\n    map (\\<lambda>(cv, cw, r, r'). length (cv @ cw)) ws'\"\n    apply (rule map_cong'[OF ws'_def(1)])\n    using ws'_def(2)\n    by fastforce\n  have \"distinct (map (\\<lambda>a. case a of (cv, cw, r, r') \\<Rightarrow> length (cv @ cw)) ws')\"\n    unfolding M2[symmetric] M1\n    by (rule distinct_inj[OF _ rec(5)]) (simp add: inj_def)\n  then have distinct_nws: \"distinct (map (\\<lambda>a. case a of (cv, cw, r, r') \\<Rightarrow> length (cv @ cw)) nws)\"\n    by (auto simp: nws_def nr_def(1) dest!: set_ws'_dest)\n  have nws_props: \"\\<forall>a\\<in>set nws. case a of (cv, cw, r, r') \\<Rightarrow>\n    init\\<leadsto>((u0, u'''), v0 @ cv, cw)r \\<and> r\\<leadsto>((u''', []), cw, [])r' \\<and>\n    accept r' \\<and> length v''' < length (cv @ cw) \\<and> length (cv @ cw) \\<le> length (v @ v')\"\n    using nr_swap new_comp(2) conflict(1,4) len_cs_v''_le comp_swap_same_hd[OF _ conflict(5) refl]\n      set_ws'_dest\n    by (fastforce simp: nws_def nr_def(1))\n  show ?case\n    apply (rule exI[of _ \"u'''\"])\n    apply (rule exI[of _ \"v'''\"])\n    apply (rule exI[of _ nws])\n    using safe_hd_u_u''' len_nws conflict(3) len_v'''_le distinct_nws nws_props\n    by simp\nqed\n\nlemma conflict:\n  assumes \"knft.computation ninit (u0, v0) s\" \"knft.computation s (u, v @ v') s'\" \"naccept s'\"\n    \"init \\<leadsto>((u0, u), (v0 @ v, v')) r\" \"r \\<leadsto>((u, []), (v', [])) r'\" \"accept r'\"\n    \"length v' \\<le> minv 0\" \"sminv n \\<le> length (v @ v')\"\n  shows \"\\<exists>u'' v'' ws. length ws = Suc n \\<and> distinct ws \\<and>\n    (\\<forall>cw \\<in> set ws. (u0 @ u'', v0 @ v'' @ cw) \\<in> \\<tau>)\"\nproof -\n  obtain es es' where es_def: \"v @ v' = es @ es'\"\n    \"length es' = sminv n\"\n    using split_long assms(8)\n    by blast\n  note s_nQ = knft.comp_closed[OF assms(1) knft.init_in_Q]\n  obtain s'' as as' cs cs' where knft_split:\n    \"knft.computation s (as, cs) s''\" \"knft.computation s'' (as', cs') s'\"\n    \"u = as @ as'\" \"es @ es' = cs @ cs'\" \"length cs \\<le> length es\"\n    \"length es - length cs \\<le> knft.output_speed\"\n    using knft.computation_split_out[OF assms(2)[unfolded es_def(1)] s_nQ]\n    by auto\n  obtain r'' fs fs' where tdfa_split: \"v' = fs @ fs'\" \"r\\<leadsto>((as, as'), fs, fs')r''\"\n    \"r''\\<leadsto>((as', []), fs', [])r'\"\n    using comp_split[OF assms(5)[unfolded knft_split(3)]]\n    by auto\n  have \"length v' \\<le> length es'\"\n    using assms(7) sminv_ge_zero[of n] minv_Suc_ge_sminv_os[of n]\n    by (auto simp: es_def(2) sminv_Suc)\n  then have \"length cs \\<le> length v\"\n    using arg_cong[OF es_def(1), of length] knft_split(5)\n    by auto\n  then obtain cs'' where cs'_split: \"cs' = cs'' @ v'\"\n    using split_app'[OF trans[OF es_def(1) knft_split(4), symmetric]]\n    by auto\n  have v_def: \"v = cs @ cs''\"\n    using trans[OF es_def(1) knft_split(4)]\n    by (auto simp: cs'_split)\n  have comp_init_r'': \"init\\<leadsto>((u0 @ as, as'), (v0 @ cs) @ cs'' @ fs, fs')r''\"\n    using comp_trans[OF assms(4) tdfa_split(2)]\n    by (auto simp: knft_split(3) tdfa_split(1) v_def)\n  have knft_comp_s''_s': \"knft.computation s'' (as', (cs'' @ fs) @ fs') s'\"\n    using knft_split(2)\n    by (auto simp: cs'_split tdfa_split(1))\n  note knft_comps = knft.comp_trans[OF assms(1) knft_split(1)]\n  have len_fs': \"length fs' \\<le> minv 0\"\n    using assms(7)\n    by (auto simp: tdfa_split(1))\n  have sminv_le: \"sminv n \\<le> length ((cs'' @ fs) @ fs')\"\n  proof -\n    have \"sminv n = length es'\"\n      using es_def(2)\n      by auto\n    moreover have \"\\<dots> \\<le> length cs'\"\n      using arg_cong[OF knft_split(4), of length] knft_split(5)\n      by auto\n    moreover have \"\\<dots> = length ((cs'' @ fs) @ fs')\"\n      by (auto simp: cs'_split tdfa_split(1))\n    ultimately show ?thesis\n      by simp\n  qed\n  have sminv_ge: \"length ((cs'' @ fs) @ fs') \\<le> sminv n + knft.output_speed\"\n  proof -\n    have \"length ((cs'' @ fs) @ fs') = length cs'\"\n      by (auto simp: cs'_split tdfa_split(1))\n    moreover have \"\\<dots> \\<le> sminv n + knft.output_speed\"\n      using arg_cong[OF knft_split(4), of length] knft_split(5,6) sminv_Suc_ge_os[of n]\n      by (simp add: es_def(2))\n    finally show ?thesis .\n  qed\n  obtain u'' v'' ws where conflict: \"length ws = n\" \"knft.computation s'' (u'', v'') s'\"\n    \"length v'' \\<le> length ((cs'' @ fs) @ fs')\"\n    \"distinct (map (\\<lambda>(cv, cw, r, r'). length (cv @ cw)) ws)\" \"(\\<forall>(cv, cw, r, r')\\<in>set ws.\n       init\\<leadsto>((u0 @ as, u''), (v0 @ cs) @ cv, cw)r \\<and> r\\<leadsto>((u'', []), cw, [])r' \\<and> accept r' \\<and>\n       length v'' < length (cv @ cw))\"\n    using conflict_rec[OF knft_comps knft_comp_s''_s' assms(3) comp_init_r'' tdfa_split(3) assms(6)\n      len_fs' sminv_le sminv_ge]\n    by fast\n  define ws' where \"ws' = map (\\<lambda>(cv, cw, r, r'). (cv @ cw, r')) ws\"\n  have ws'_comp: \"\\<And>cw r'. (cw, r') \\<in> set ws' \\<Longrightarrow>\n    init \\<leadsto>((u0 @ as @ u'', []), v0 @ cs @ cw, []) r' \\<and> accept r' \\<and> length v'' < length cw\"\n    using conflict(5) comp_trans\n    by (fastforce simp: ws'_def)\n  have map_ws_ws': \"map (\\<lambda>(cv, cw, r, r'). length (cv @ cw)) ws = map (length \\<circ> fst) ws'\"\n    by (auto simp: ws'_def in_set_zip)\n  have \"distinct (map fst ws')\"\n    using conflict(4)\n    unfolding map_ws_ws'\n    by (induction ws') force+\n  then have distinct_v''_ws': \"distinct (v'' # map fst ws')\"\n    by (auto dest: ws'_comp)\n  have len_ws': \"length ws' = n\"\n    using conflict(1)\n    by (auto simp: ws'_def)\n  have new_pair: \"(u0 @ as @ u'', v0 @ cs @ v'') \\<in> \\<tau>\"\n    using knft.comp_trans[OF assms(1) knft.comp_trans[OF knft_split(1) conflict(2)]] assms(3)\n    by (auto simp: knft.\\<tau>_def equiv[symmetric])\n  show ?thesis\n    apply (rule exI[of _ \"as @ u''\"])\n    apply (rule exI[of _ cs])\n    apply (rule exI[of _ \"v'' # map fst ws'\"])\n    using len_ws' distinct_v''_ws' ws'_comp new_pair\n    by (fastforce simp: \\<tau>_def)\nqed\n\nlemma bounded: \"\\<exists>K. knft.bounded K\"\nproof (rule ccontr)\n  (* home stretch *)\n  define h where \"h = (knft.sg + 1) * (card Q + 1)\"\n  (* trail length *)\n  define t where \"t = sminv kv\"\n  assume \"\\<not>(\\<exists>K. knft.bounded K)\"\n  then obtain q q' u v w where unbounded: \"knft.computation ninit (u, v @ w) q\"\n    \"knft.active q []\" \"knft.computation ninit (u, v) q'\" \"knft.active q' w\"\n    \"length w > t\"\n    by (auto simp add: knft.bounded_def) (metis less_or_eq_imp_le neqE)\n  note q_nQ = knft.comp_closed[OF unbounded(1) knft.init_in_Q]\n  note q'_nQ = knft.comp_closed[OF unbounded(3) knft.init_in_Q]\n  obtain u1 v1 nqf where ext: \"knft.computation q (u1, v1) nqf\" \"naccept nqf\"\n    \"length u1 \\<le> knft.sg\" \"length v1 \\<le> knft.sg * knft.output_speed\"\n    using knft.active_Nil_dest_sg[OF unbounded(2) q_nQ]\n    by auto\n  obtain u2 v2 nqf' where ext': \"knft.computation q' (u2, w @ v2) nqf'\" \"naccept nqf'\"\n    \"length v2 \\<le> (1 + knft.sg) * knft.output_speed\"\n    using knft.active_dest[OF unbounded(4) q'_nQ]\n    by auto\n  have len_w: \"h \\<le> length w\"\n    using unbounded(5) sminv_ge_zero[of kv]\n    by (auto simp: h_def t_def minv.simps(1))\n  obtain v' v'' where w_def: \"w = v' @ v''\" \"length v'' = h\"\n    using split_long[OF len_w]\n    by auto\n  have \"knft.computation ninit (u @ u1, (v @ v') @ v'' @ v1) nqf\"\n    using knft.comp_trans[OF unbounded(1) ext(1), unfolded w_def]\n    by auto\n  then obtain qf where qf_def: \"init \\<leadsto>((u @ u1, []), ((v @ v') @ v'' @ v1, [])) qf\" \"accept qf\"\n    using ext(2) equiv\n    by (fastforce simp add: knft.\\<tau>_def \\<tau>_def)\n  have \"knft.computation ninit (u @ u2, (v @ v') @ v'' @ v2) nqf'\"\n    using knft.comp_trans[OF unbounded(3) ext'(1), unfolded w_def]\n    by auto\n  then obtain qf' where qf'_def: \"init \\<leadsto>((u @ u2, []), ((v @ v') @ v'' @ v2, [])) qf'\"\n    \"accept qf'\"\n    using ext'(2) equiv\n    by (fastforce simp add: knft.\\<tau>_def \\<tau>_def)\n  have u_not_Nil: \"u \\<noteq> []\"\n    using knft.output_speed_computation[OF unbounded(1) knft.init_in_Q]\n      unbounded(5)[unfolded t_def]\n    by auto\n  have v''_not_Nil: \"v'' \\<noteq> []\"\n    using w_def(2)[unfolded h_def]\n    by auto\n  then have safe_hd_v'': \"safe_hd (v'' @ v1) = safe_hd (v'' @ v2)\"\n    using safe_hd_app''[OF v''_not_Nil]\n    by auto\n  have safe_hd_u1_u2: \"safe_hd (u @ u1) = safe_hd (u @ u2)\"\n    using safe_hd_app''[OF u_not_Nil]\n    by auto\n  have u_Nil_contr: \"u \\<noteq> [] \\<or> v @ v' \\<noteq> []\"\n    by (auto simp: u_not_Nil)\n  show \"False\"\n    using first_reaches[OF qf_def(1), OF u_Nil_contr]\n  proof (rule disjE)\n    assume \"\\<exists>ws ws' q''. v @ v' = ws @ ws' \\<and> ws' \\<noteq> [] \\<and>\n      init \\<leadsto>((u, u1 @ []), ws, ws' @ (v'' @ v1) @ []) q'' \\<and>\n      q'' \\<leadsto>((u1, []), ws' @ v'' @ v1, []) qf\"\n    then obtain ws ws' q'' where tail: \"v @ v' = ws @ ws'\"\n      \"init \\<leadsto>((u, u1 @ []), ws, ws' @ (v'' @ v1) @ []) q''\"\n      \"q'' \\<leadsto>((u1 @ [], []), ws' @ (v'' @ v1) @ [], []) qf\"\n      by auto\n    have le: \"(length (u1 @ []) + 1) * card Q \\<le> (knft.sg + 1) * card Q\"\n      using ext(3)\n      by auto\n    show \"False\"\n      using le_trans[OF lin_bounded[OF tail(2,3) qf_def(2)] le] w_def(2)\n      unfolding h_def\n      by auto\n  next\n    assume \"\\<exists>ws ws' q''. u = ws @ ws' \\<and> ws' \\<noteq> [] \\<and>\n      init\\<leadsto>((ws, ws' @ u1 @ []), v @ v', (v'' @ v1) @ [])q'' \\<and>\n      q''\\<leadsto>((ws' @ u1, []), v'' @ v1, [])qf\"\n    then obtain ws ws' q'' where tail': \"u = ws @ ws'\" \"ws' \\<noteq> []\"\n      \"init \\<leadsto>((ws, ws' @ u1 @ []), v @ v', (v'' @ v1) @ []) q''\"\n      \"q'' \\<leadsto>((ws' @ u1, []), v'' @ v1, []) qf\"\n      by auto\n    obtain f fs where u2_def: \"u2 = f # fs\"\n      using knft.output_speed_computation[OF ext'(1) q'_nQ] len_w\n      by (cases u2) (auto simp: h_def)\n    have comp_init_q'': \"init \\<leadsto>((ws, ws' @ u2 @ []), v @ v', (v'' @ v2) @ []) q''\"\n      by (rule comp_swap_same_hd[OF tail'(3)])\n         (simp add: safe_hd_app'' tail'(2) v''_not_Nil)+\n    have comp_q''_qf': \"q'' \\<leadsto>((ws' @ f # fs, []), (v'' @ v2, [])) qf'\"\n      using comp_pull[OF comp_init_q''] qf'_def(1)\n      by (simp add: tail'(1) u2_def)\n    obtain r ds ds' where tail: \"q'' \\<leadsto>((ws', f # fs), (ds, ds')) r\"\n      \"r \\<leadsto>((f # fs, []), (ds', [])) qf'\" \"v'' @ v2 = ds @ ds'\"\n      using comp_split[OF comp_q''_qf']\n      by auto\n    note r_Q = comp_closed[OF tail(1) comp_closed[OF tail'(3) init_in_Q]]\n    have comp': \"knft.computation q' (f # fs, (v' @ ds) @ ds') nqf'\"\n      using ext'(1)[unfolded w_def u2_def, simplified] tail(3)\n      by auto\n    have len_ds': \"length ds' \\<le> minv 0\"\n      using arg_cong[OF tail(3), of length] w_def(2) ext'(3)\n      by (auto simp: minv.simps h_def)\n    have comp_init_r: \"init\\<leadsto>((u, f # fs), v @ v' @ ds, ds')r\"\n      using comp_trans[OF comp_init_q'' tail(1)]\n      by (auto simp: tail'(1) u2_def tail(3))\n    have len_v': \"sminv kv \\<le> length ((v' @ ds) @ ds')\"\n      using unbounded(5)\n      by (auto simp: tail(3)[symmetric] w_def(1) t_def)\n    obtain u'' v'' ws where conflict:\n      \"length ws = Suc kv\" \"distinct ws\" \"\\<And>cw. cw\\<in>set ws \\<Longrightarrow> (u @ u'', v @ v'' @ cw) \\<in> \\<tau>\"\n      using conflict[OF unbounded(3) comp' ext'(2) comp_init_r tail(2) qf'_def(2) len_ds' len_v']\n      by auto\n    have sub: \"(\\<lambda>w. v @ v'' @ w) ` set ws \\<subseteq> {bs. (u @ u'', bs) \\<in> \\<tau>}\"\n      using conflict(3)\n      by auto\n    have \"card ((\\<lambda>w. v @ v'' @ w) ` set ws) = card (set ws)\"\n      by (rule card_image) (auto simp: inj_on_def)\n    moreover have \"\\<dots> = Suc kv\"\n      using distinct_card[OF conflict(2)]\n      by (auto simp: conflict(1))\n    finally show \"False\"\n      using sub kval[of \"u @ u''\"]\n      by (metis card_mono not_less_eq_eq)\n  qed\nqed\n\nend\n\nlocale necessary = knft: kNFT ninit n\\<delta> naccept nQ + kTDFA init \\<delta> accept Q\n  for ninit :: \"'s\"\n  and n\\<delta> :: \"'s \\<Rightarrow> 'a :: finite \\<Rightarrow> 's \\<times> 'b list \\<Rightarrow> bool\"\n  and naccept :: \"'s \\<Rightarrow> bool\"\n  and nQ :: \"'s set\"\n  and init :: \"'t\"\n  and \\<delta> :: \"'t \\<Rightarrow> 'a Al \\<times> 'b Al \\<Rightarrow> ('t \\<times> bool \\<times> bool) option\"\n  and accept :: \"'t \\<Rightarrow> bool\"\n  and Q :: \"'t set\" +\nassumes equiv: \"knft.\\<tau> = \\<tau>\"\nbegin\n\ninterpretation otdfa: oTDFA otdfa_init otdfa_delta otdfa_accept otdfa_Q\n  using otdfa_finite_Q otdfa_init_in_Q otdfa_closed[rotated]\n        otdfa_move_left otdfa_move_right otdfa_no_step otdfa_move_one\n  by unfold_locales auto\n\ninterpretation nec: necessary' kv ninit n\\<delta> naccept nQ otdfa_init otdfa_delta otdfa_accept otdfa_Q\n  using kval tdfa_equiv_otdfa\n  by unfold_locales (auto simp add: equiv tdfa_equiv_otdfa)\n\n(* Theorem 10 *)\n\nlemma bounded: \"\\<exists>K. knft.bounded K\"\n  using nec.bounded .\n\nend\n\nend", "meta": {"author": "stacs21", "repo": "automata", "sha": "ad3f66175122479d075b5ad9d996511035ea775a", "save_path": "github-repos/isabelle/stacs21-automata", "path": "github-repos/isabelle/stacs21-automata/automata-ad3f66175122479d075b5ad9d996511035ea775a/thys/Necessary.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3282330904745325}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |               November 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_law_SKIP_DIV\nimports CSP_F_law_SKIP CSP_F_law_DIV CSP_T.CSP_T_law_SKIP_DIV\nbegin\n\n(*********************************************************\n                   (SKIP [+] DIV)\n *********************************************************)\n\nlemma cspF_SKIP_DIV_Ext_choice1: \"(SKIP [+] DIV) =F[M1,M2] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_DIV_Ext_choice)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_traces in_failures)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_traces in_failures)\n apply (force)\ndone\n\n(*********************************************************\n                   (DIV [+] SKIP)\n *********************************************************)\n\nlemma cspF_SKIP_DIV_Ext_choice2: \"(DIV [+] SKIP) =F[M1,M2] SKIP\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_SKIP_DIV_Ext_choice1)\ndone\n\nlemmas cspF_SKIP_DIV_Ext_choice =\n       cspF_SKIP_DIV_Ext_choice1\n       cspF_SKIP_DIV_Ext_choice2\n\n(*********************************************************\n                    SKIP |[X]| DIV\n *********************************************************)\n\nlemma cspF_SKIP_DIV_Parallel1:\n   \"SKIP |[X]| DIV =F[M1,M2] DIV\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_DIV_Parallel1)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\ndone\n\nlemma cspF_SKIP_DIV_Parallel2:\n   \"DIV |[X]| SKIP =F[M1,M2] DIV\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_DIV_Parallel1)\napply (rule cspF_reflex)\ndone\n\nlemmas cspF_SKIP_DIV_Parallel =\n       cspF_SKIP_DIV_Parallel1\n       cspF_SKIP_DIV_Parallel2\n       cspF_Parallel_term\n       cspF_DIV_Parallel\n\n(*********************************************************\n                 DIV and Parallel-SKIP\n *********************************************************)\n\n(*********************************************************\n                      SKIP and Parallel\n *********************************************************)\n\n(*** SKIP and DIV ***)\n\nlemma cspF_DIV_Parallel_Ext_choice_SKIP_l:\n  \"(P [+] SKIP) |[X]| DIV =F[M,M] (P |[X]| DIV)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_DIV_Parallel_Ext_choice_SKIP_l)\napply (rule order_antisym)\napply (rule, simp add: in_failures)+\ndone\n\nlemma cspF_DIV_Parallel_Ext_choice_SKIP_r:\n  \"DIV |[X]| (P [+] SKIP) =F[M,M] (DIV |[X]| P)\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_DIV_Parallel_Ext_choice_SKIP_l)\napply (rule cspF_commut)\ndone\n\nlemmas cspF_DIV_Parallel_Ext_choice_SKIP =\n       cspF_DIV_Parallel_Ext_choice_SKIP_l\n       cspF_DIV_Parallel_Ext_choice_SKIP_r\n\nlemmas cspF_DIV_Parallel_Ext_choice =\n       cspF_DIV_Parallel_Ext_choice_SKIP\n       cspF_DIV_Parallel_Ext_choice_DIV\n\n(*********************************************************\n                 SKIP and Parallel-DIV\n *********************************************************)\n\n(*** DIV and SKIP ***)\n\nlemma cspF_SKIP_Parallel_Ext_choice_DIV_l:\n  \"((? :Y -> Pf) [+] DIV) |[X]| SKIP =F[M,M]\n   (? x:(Y - X) -> (Pf x |[X]| SKIP)) [+] DIV\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Parallel_Ext_choice_DIV_l)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (simp add: par_tr_nil_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp)\n  apply (rule_tac x=\"sb\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n\n  apply (simp add: par_tr_Tick_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp)\n  apply (rule_tac x=\"sb\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n\n  apply (simp add: in_traces)\n\n(* <= *)\n apply (rule, simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (simp add: in_traces)\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp add: par_tr_nil_right)\n  apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n  apply (simp add: image_iff)\n  apply (fast)\n\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp add: par_tr_Tick_right)\n  apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n  apply (simp add: image_iff)\n  apply (fast)\n\n  apply (simp add: in_traces)\n  apply (simp add: in_traces)\ndone\n\nlemma cspF_SKIP_Parallel_Ext_choice_DIV_r:\n  \"SKIP |[X]| ((? :Y -> Pf) [+] DIV) =F[M,M]\n   (? x:(Y - X) -> (SKIP |[X]| Pf x)) [+] DIV\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_Parallel_Ext_choice_DIV_l)\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_commut)\napply (rule cspF_reflex)\napply (rule cspF_reflex)\ndone\n\nlemmas cspF_SKIP_Parallel_Ext_choice_DIV =\n       cspF_SKIP_Parallel_Ext_choice_DIV_l\n       cspF_SKIP_Parallel_Ext_choice_DIV_r\n\nlemmas cspF_SKIP_Parallel_Ext_choice =\n       cspF_SKIP_Parallel_Ext_choice_SKIP\n       cspF_SKIP_Parallel_Ext_choice_DIV\n\n(*---------------------------------------------*\n |                 SKIP , DIV                  |\n *---------------------------------------------*)\n\nlemmas cspF_SKIP_DIV_Parallel_step =\n       cspF_Parallel_preterm\n       cspF_DIV_Parallel_step\n\nlemmas cspF_SKIP_DIV_Parallel_Ext_choice =\n       cspF_SKIP_Parallel_Ext_choice\n       cspF_DIV_Parallel_Ext_choice\n\nlemmas cspF_SKIP_DIV_Hiding_Id =\n       cspF_SKIP_Hiding_Id\n       cspF_DIV_Hiding_Id\n\nlemmas cspF_SKIP_DIV_Hiding_step =\n       cspF_DIV_Hiding_step\n       cspF_SKIP_Hiding_step\n\nlemmas cspF_SKIP_DIV_Renaming_Id =\n       cspF_SKIP_Renaming_Id\n       cspF_DIV_Renaming_Id\n\nlemmas cspF_SKIP_DIV_Seq_compo =\n       cspF_Seq_compo_unit\n       cspF_DIV_Seq_compo\n\nlemmas cspF_SKIP_DIV_Seq_compo_step =\n       cspF_SKIP_Seq_compo_step\n       cspF_DIV_Seq_compo_step\n\nlemmas cspF_SKIP_DIV_Depth_rest =\n       cspF_SKIP_Depth_rest\n       cspF_DIV_Depth_rest\n\nlemmas cspF_SKIP_DIV =\n       cspF_SKIP_DIV_Parallel_step\n       cspF_SKIP_DIV_Ext_choice\n       cspF_SKIP_DIV_Parallel\n       cspF_SKIP_DIV_Parallel_Ext_choice\n       cspF_SKIP_DIV_Hiding_Id\n       cspF_SKIP_DIV_Hiding_step\n       cspF_SKIP_DIV_Renaming_Id\n       cspF_SKIP_DIV_Seq_compo\n       cspF_SKIP_DIV_Seq_compo_step\n       cspF_SKIP_DIV_Depth_rest\n\n(*** resolve ***)\n\nlemmas cspF_Ext_choice_SKIP_DIV_resolve =\n       cspF_Ext_choice_SKIP_resolve\n       cspF_Ext_choice_DIV_resolve\n\n(*----------------------------------------------*\n |                                              |\n |        for convenienve  (SKIP or DIV)        |\n |                                              |\n *----------------------------------------------*)\n\n(*********************************************************\n            (SKIP or DIV [+] SKIP or DIV)\n *********************************************************)\n\nlemma cspF_SKIP_or_DIV_Ext_choice:\n  \"[| P = SKIP | P = DIV ; Q = SKIP | Q = DIV |] ==>\n   (P [+] Q) =F[M1,M2] (if (P = SKIP | Q = SKIP) then SKIP else DIV)\"\napply (elim disjE)\napply (simp_all)\napply (rule cspF_rw_left)\napply (rule cspF_Ext_choice_idem)\napply (simp)\napply (simp add: cspF_SKIP_DIV)\napply (simp add: cspF_SKIP_DIV)\napply (rule cspF_rw_left)\napply (rule cspF_Ext_choice_idem)\napply (simp)\ndone\n\n(*********************************************************\n            (SKIP or DIV |[X]| SKIP or DIV)\n *********************************************************)\n\nlemma cspF_SKIP_or_DIV_Parallel:\n  \"[| P = SKIP | P = DIV ; Q = SKIP | Q = DIV |] ==>\n   (P |[X]| Q) =F[M1,M2] (if (P = SKIP & Q = SKIP) then SKIP else DIV)\"\napply (elim disjE)\napply (simp_all add: cspF_SKIP_DIV)\ndone\n\n(*********************************************************\n                  (SKIP or DIV) and Hiding\n *********************************************************)\n\nlemma cspF_SKIP_or_DIV_Hiding_step:\n  \"Q = SKIP | Q = DIV ==>\n   ((? :Y -> Pf) [+] Q) -- X =F[M,M] \n   (((? x:(Y-X) -> (Pf x -- X)) [+] Q) |~| (! x:(Y Int X) .. (Pf x -- X)))\"\napply (erule disjE)\napply (simp_all add: cspF_SKIP_DIV)\ndone\n\n(*********************************************************\n                  SKIP or DIV |. Suc n\n *********************************************************)\n\nlemma cspF_SKIP_or_DIV_Depth_rest: \n   \"Q = SKIP | Q = DIV ==> Q |. (Suc n) =F[M1,M2] Q\"\napply (erule disjE)\napply (simp_all add: cspF_SKIP_DIV)\ndone\n\n(*********************************************************\n                    P [+] (SKIP or DIV)\n *********************************************************)\n\nlemma cspF_Ext_choice_SKIP_or_DIV_resolve:\n  \"Q = SKIP | Q = DIV ==> P [+] Q =F[M,M] P [> Q\"\napply (erule disjE)\napply (simp_all add: cspF_Ext_choice_SKIP_DIV_resolve)\ndone\n\nlemmas cspF_SKIP_or_DIV =\n       cspF_SKIP_or_DIV_Ext_choice\n       cspF_SKIP_or_DIV_Parallel\n       cspF_SKIP_or_DIV_Hiding_step\n       cspF_SKIP_or_DIV_Depth_rest\n\n       (* no resolv *)\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_law_SKIP_DIV.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6224593171945416, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3282330830882449}}
{"text": "(* \n    This file is a part of IsarMathLib - \n    a library of formalized mathematics written for Isabelle/Isar.\n\n    Copyright (C) 2013 Daniel de la Concepcion\n\n    This program is free software; Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED \nWARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF \nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. \nIN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, \nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, \nPROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; \nOR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, \nWHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \nOTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, \nEVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *)\n\nsection \\<open>Properties in Topology 3\\<close>\n\ntheory Topology_ZF_properties_3 imports Topology_ZF_7 Finite_ZF_1 Topology_ZF_1b Topology_ZF_9\n  Topology_ZF_properties_2 FinOrd_ZF\nbegin\n\ntext\\<open>This theory file deals with more topological properties and the\nrelation with the previous ones in other theory files.\\<close>\n\nsubsection\\<open>More anti-properties\\<close>\n\ntext\\<open>In this section we study more anti-properties.\\<close>\n\nsubsection\\<open>First examples\\<close>\n\ntext\\<open>A first example of an anti-compact space is the discrete space.\\<close>\n\nlemma pow_compact_imp_finite:\n  assumes \"B{is compact in}Pow(A)\"\n  shows \"Finite(B)\"\nproof-\n  from assms have B:\"B\\<subseteq>A\" \"\\<forall>M\\<in>Pow(Pow(A)). B\\<subseteq>\\<Union>M \\<longrightarrow>(\\<exists>N\\<in>FinPow(M). B\\<subseteq>\\<Union>N)\"\n    unfolding IsCompact_def by auto\n  from B(1) have \"{{x}. x\\<in>B}\\<in>Pow(Pow(A))\" \"B\\<subseteq>\\<Union>{{x}. x\\<in>B}\" by auto\n  with B(2) have \"\\<exists>N\\<in>FinPow({{x}. x\\<in>B}). B\\<subseteq>\\<Union>N\" by auto\n  then obtain N where \"N\\<in>FinPow({{x}. x\\<in>B})\" \"B\\<subseteq>\\<Union>N\" by auto\n  then have \"Finite(N)\" \"N\\<subseteq>{{x}. x\\<in>B}\" \"B\\<subseteq>\\<Union>N\" unfolding FinPow_def by auto\n  then have \"Finite(N)\" \"\\<forall>b\\<in>N. Finite(b)\" \"B\\<subseteq>\\<Union>N\" by auto\n  then have \"B\\<subseteq>\\<Union>N\" \"Finite(\\<Union>N)\" using Finite_Union[of \"N\"] by auto\n  then show \"Finite(B)\" using subset_Finite by auto\nqed\n    \ntheorem pow_anti_compact:\n  shows \"Pow(A){is anti-compact}\"\nproof-\n  {\n    fix B assume as:\"B\\<subseteq>\\<Union>Pow(A)\" \"(\\<Union>(Pow(A){restricted to}B)){is compact in}(Pow(A){restricted to}B)\"\n    then have sub:\"B\\<subseteq>A\" by auto\n    then have \"Pow(B)=Pow(A){restricted to}B\" unfolding RestrictedTo_def by blast\n    with as(2) have \"(\\<Union>Pow(B)){is compact in}Pow(B)\" by auto\n    then have \"B{is compact in}Pow(B)\" by auto\n    then have \"Finite(B)\" using pow_compact_imp_finite by auto\n    then have \"B{is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" using compact_spectrum by auto\n  }\n  then show ?thesis unfolding IsAntiComp_def antiProperty_def by auto\nqed\n\ntext\\<open>In a previous file, @{file \"Topology_ZF_5.thy\"}, we proved that\nthe spectrum of the lindelöf property depends on the axiom of countable choice\non subsets of the power set of the natural number.\\<close>\n\ntext\\<open>In this context, the examples depend on wether this choice principle holds or not.\nThis is the reason that the examples of anti-lindeloef topologies are left for the next\nsection.\\<close>\n\nsubsection\\<open>Structural results\\<close>\n\ntext\\<open>We first differenciate the spectrum of the lindeloef property depending\non some axiom of choice.\\<close>\n\nlemma lindeloef_spec1:\n  assumes \"{the axiom of} nat {choice holds for subsets}(Pow(nat))\"\n  shows \"(A {is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is lindeloef in}T))) \\<longleftrightarrow> (A\\<lesssim>nat)\"\n  using compactK_spectrum[OF assms Card_nat] unfolding IsLindeloef_def.\n\nlemma lindeloef_spec2:\n  assumes \"\\<not>({the axiom of} nat {choice holds for subsets}(Pow(nat)))\"\n  shows \"(A {is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is lindeloef in}T))) \\<longleftrightarrow> Finite(A)\"\nproof\n  assume \"Finite(A)\"\n  then have A:\"A{is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is compact in}T))\" using compact_spectrum by auto\n  have s:\"nat\\<lesssim>csucc(nat)\" using le_imp_lesspoll[OF Card_csucc[OF Ord_nat]] lt_csucc[OF Ord_nat] le_iff by auto\n  {\n    fix T assume \"T{is a topology}\" \"(\\<Union>T){is compact in}T\"\n    then have \"(\\<Union>T){is compact of cardinal}nat{in}T\" using Compact_is_card_nat by auto\n    then have \"(\\<Union>T){is compact of cardinal}csucc(nat){in}T\" using s compact_greater_card Card_csucc[OF Ord_nat] by auto\n    then have \"(\\<Union>T){is lindeloef in}T\" unfolding IsLindeloef_def by auto\n  }\n  then have \"\\<forall>T. T{is a topology} \\<longrightarrow> ((\\<Union>T){is compact in}T) \\<longrightarrow> ((\\<Union>T){is lindeloef in}T)\" by auto\n  with A show \"A {is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is lindeloef in}T))\" using P_imp_Q_spec_inv[\n    where Q=\"\\<lambda>T. ((\\<Union>T){is compact in}T)\" and P=\"\\<lambda>T. ((\\<Union>T){is lindeloef in}T)\"] by auto\nnext\n  assume A:\"A {is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is lindeloef in}T))\"\n  then have reg:\"\\<forall>T. T{is a topology}\\<and>\\<Union>T\\<approx>A \\<longrightarrow> ((\\<Union>T){is compact of cardinal} csucc(nat){in}T)\" using Spec_def\n    unfolding IsLindeloef_def by auto\n  then have \"A{is compact of cardinal} csucc(nat) {in} Pow(A)\" using Pow_is_top[of \"A\"] by auto\n  then have \"\\<forall>M\\<in>Pow(Pow(A)). A\\<subseteq>\\<Union>M \\<longrightarrow> (\\<exists>N\\<in>Pow(M). A\\<subseteq>\\<Union>N \\<and> N\\<prec>csucc(nat))\" unfolding IsCompactOfCard_def by auto\n  moreover\n  have \"{{x}. x\\<in>A}\\<in>Pow(Pow(A))\" by auto\n  moreover\n  have \"A=\\<Union>{{x}. x\\<in>A}\" by auto\n  ultimately have \"\\<exists>N\\<in>Pow({{x}. x\\<in>A}). A\\<subseteq>\\<Union>N \\<and> N\\<prec>csucc(nat)\" by auto\n  then obtain N where \"N\\<in>Pow({{x}. x\\<in>A})\" \"A\\<subseteq>\\<Union>N\" \"N\\<prec>csucc(nat)\" by auto\n  then have \"N\\<subseteq>{{x}. x\\<in>A}\" \"N\\<prec>csucc(nat)\" \"A\\<subseteq>\\<Union>N\" using FinPow_def by auto\n  {\n    fix t\n    assume \"t\\<in>{{x}. x\\<in>A}\"\n    then obtain x where \"x\\<in>A\"\"t={x}\" by auto\n    with \\<open>A\\<subseteq>\\<Union>N\\<close> have \"x\\<in>\\<Union>N\" by auto\n    then obtain B where \"B\\<in>N\"\"x\\<in>B\" by auto\n    with \\<open>N\\<subseteq>{{x}. x\\<in>A}\\<close> have \"B={x}\" by auto\n    with \\<open>t={x}\\<close>\\<open>B\\<in>N\\<close> have \"t\\<in>N\" by auto \n  }\n  with \\<open>N\\<subseteq>{{x}. x\\<in>A}\\<close> have \"N={{x}. x\\<in>A}\" by auto\n  let ?B=\"{\\<langle>x,{x}\\<rangle>. x\\<in>A}\"\n  from \\<open>N={{x}. x\\<in>A}\\<close> have \"?B:A\\<rightarrow> N\" unfolding Pi_def function_def by auto\n  with \\<open>N={{x}. x\\<in>A}\\<close> have \"?B:inj(A,N)\" unfolding inj_def using apply_equality by auto\n  then have \"A\\<lesssim>N\" using lepoll_def by auto\n  with \\<open>N\\<prec>csucc(nat)\\<close> have \"A\\<prec>csucc(nat)\" using lesspoll_trans1 by auto\n  then have \"A\\<lesssim>nat\" using Card_less_csucc_eq_le Card_nat by auto\n  then have \"A\\<prec>nat\\<or>A\\<approx>nat\" using lepoll_iff_leqpoll by auto moreover\n  {\n    assume \"A\\<approx>nat\"\n    then have \"nat\\<approx>A\" using eqpoll_sym by auto\n    with A have \"nat {is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is lindeloef in}T))\" using equipollent_spect[\n      where P=\"(\\<lambda>T. ((\\<Union>T){is lindeloef in}T))\"] by auto\n    moreover\n    have \"Pow(nat){is a topology}\" using Pow_is_top by auto\n    moreover\n    have \"\\<Union>Pow(nat)=nat\" by auto\n    then have \"\\<Union>Pow(nat)\\<approx>nat\" using eqpoll_refl by auto\n    ultimately\n    have \"nat {is compact of cardinal} csucc(nat){in}Pow(nat)\" using Spec_def unfolding IsLindeloef_def by auto\n    then have \"False\" using Q_disc_comp_csuccQ_eq_Q_choice_csuccQ[OF InfCard_nat] assms by auto\n  }\n  ultimately have \"A\\<prec>nat\" by auto\n  then show \"Finite(A)\" using lesspoll_nat_is_Finite by auto\nqed\n\ntext\\<open>If the axiom of countable choice on subsets of the pow of the natural numbers\ndoesn't hold, then anti-lindeloef spaces are anti-compact.\\<close>\n\ntheorem(in topology0) no_choice_imp_anti_lindeloef_is_anti_comp:\n  assumes \"\\<not>({the axiom of} nat {choice holds for subsets}(Pow(nat)) )\" \"T{is anti-lindeloef}\"\n  shows \"T{is anti-compact}\"\nproof-\n  have s:\"nat\\<lesssim>csucc(nat)\" using le_imp_lesspoll[OF Card_csucc[OF Ord_nat]] lt_csucc[OF Ord_nat] le_iff by auto\n  {\n    fix T assume \"T{is a topology}\" \"(\\<Union>T){is compact in}T\"\n    then have \"(\\<Union>T){is compact of cardinal}nat{in}T\" using Compact_is_card_nat by auto\n    then have \"(\\<Union>T){is compact of cardinal}csucc(nat){in}T\" using s compact_greater_card Card_csucc[OF Ord_nat] by auto\n    then have \"(\\<Union>T){is lindeloef in}T\" unfolding IsLindeloef_def by auto\n  }\n  then have \"\\<forall>T. T{is a topology} \\<longrightarrow> ((\\<Union>T){is compact in}T) \\<longrightarrow> ((\\<Union>T){is lindeloef in}T)\" by auto\n  from eq_spect_rev_imp_anti[OF this] lindeloef_spec2[OF assms(1)] compact_spectrum\n    show ?thesis using assms(2) unfolding IsAntiLin_def IsAntiComp_def by auto\nqed\n\ntext\\<open>If the axiom of countable choice holds for subsets of the power set of the\nnatural numbers, then there exists a topological space that is anti-lindeloef\nbut no anti-compact.\\<close>\n\ntheorem no_choice_imp_anti_lindeloef_is_anti_comp:\n  assumes \"({the axiom of} nat {choice holds for subsets}(Pow(nat)))\"\n  shows \"({one-point compactification of}Pow(nat)){is anti-lindeloef}\"\nproof-\n  have t:\"\\<Union>({one-point compactification of}Pow(nat))={nat}\\<union>nat\" using topology0.op_compact_total\n    unfolding topology0_def using Pow_is_top by auto\n  have \"{nat}\\<approx>1\" using singleton_eqpoll_1 by auto\n  then have \"{nat}\\<prec>nat\" using n_lesspoll_nat eq_lesspoll_trans by auto moreover\n  have s:\"nat\\<prec>csucc(nat)\" using lt_Card_imp_lesspoll[OF Card_csucc] lt_csucc[OF Ord_nat] by auto\n  ultimately have \"{nat}\\<prec>csucc(nat)\" using lesspoll_trans by blast\n  with s have \"{nat}\\<union>nat\\<prec>csucc(nat)\" using less_less_imp_un_less[OF _ _ InfCard_csucc[OF InfCard_nat]]\n    by auto\n  then have \"{nat}\\<union>nat\\<lesssim>nat\" using Card_less_csucc_eq_le[OF Card_nat] by auto\n  with t have r:\"\\<Union>({one-point compactification of}Pow(nat))\\<lesssim>nat\" by auto\n  {\n    fix A assume A:\"A\\<in>Pow(\\<Union>({one-point compactification of}Pow(nat)))\" \"(\\<Union>(({one-point compactification of}Pow(nat)){restricted to}A)){is lindeloef in}(({one-point compactification of}Pow(nat)){restricted to}A)\"\n    from A(1) have \"A\\<subseteq>\\<Union>({one-point compactification of}Pow(nat))\" by auto\n    with r have \"A\\<lesssim>nat\" using subset_imp_lepoll lepoll_trans by blast\n    then have \"A{is in the spectrum of}(\\<lambda>T. ((\\<Union>T){is lindeloef in}T))\" using assms\n      lindeloef_spec1 by auto\n  }\n  then show ?thesis unfolding IsAntiLin_def antiProperty_def by auto\nqed\n\ntheorem op_comp_pow_nat_no_anti_comp:\n  shows \"\\<not>(({one-point compactification of}Pow(nat)){is anti-compact})\"\nproof\n  let ?T=\"({one-point compactification of}Pow(nat)){restricted to}({nat} \\<union> nat)\"\n  assume antiComp:\"({one-point compactification of}Pow(nat)){is anti-compact}\"\n  have \"({nat} \\<union> nat){is compact in}({one-point compactification of}Pow(nat))\"\n    using topology0.compact_op[of \"Pow(nat)\"] Pow_is_top[of \"nat\"] unfolding topology0_def\n    by auto\n  then have \"({nat} \\<union> nat){is compact in}?T\" using compact_imp_compact_subspace Compact_is_card_nat by auto\n  moreover have \"\\<Union>?T=(\\<Union>({one-point compactification of}Pow(nat)))\\<inter>({nat} \\<union> nat)\" unfolding RestrictedTo_def by auto\n  then have \"\\<Union>?T={nat} \\<union> nat\" using topology0.op_compact_total unfolding topology0_def\n    using Pow_is_top by auto\n  ultimately have \"(\\<Union>?T){is compact in}?T\" by auto\n  with antiComp have \"({nat} \\<union> nat){is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" unfolding IsAntiComp_def\n    antiProperty_def using topology0.op_compact_total unfolding topology0_def using Pow_is_top by auto\n  then have \"Finite({nat} \\<union> nat)\" using compact_spectrum by auto\n  then have \"Finite(nat)\" using subset_Finite by auto\n  then show \"False\" using nat_not_Finite by auto\nqed\n\ntext\\<open>In coclusion, we reached another equivalence of this choice principle.\\<close>\n\ntext\\<open>The axiom of countable choice holds for subsets of the power set of the\nnatural numbers if and only if there exists a topological space which is anti-lindeloef\nbut not anti-compact; this space can be chosen as the one-point compactification\nof the discrete topology on $\\mathbb{N}$.\\<close>\n\ntheorem acc_pow_nat_equiv1:\n  shows \"({the axiom of} nat {choice holds for subsets}(Pow(nat))) \\<longleftrightarrow> (({one-point compactification of}Pow(nat)){is anti-lindeloef})\"\n  using op_comp_pow_nat_no_anti_comp no_choice_imp_anti_lindeloef_is_anti_comp\n  topology0.no_choice_imp_anti_lindeloef_is_anti_comp topology0.op_comp_is_top\n  Pow_is_top[of \"nat\"] unfolding topology0_def by auto\n\ntheorem acc_pow_nat_equiv2:\n  shows \"({the axiom of} nat {choice holds for subsets}(Pow(nat))) \\<longleftrightarrow> (\\<exists>T. T{is a topology}\n  \\<and> (T{is anti-lindeloef}) \\<and> \\<not>(T{is anti-compact}))\"\n  using op_comp_pow_nat_no_anti_comp no_choice_imp_anti_lindeloef_is_anti_comp\n  topology0.no_choice_imp_anti_lindeloef_is_anti_comp topology0.op_comp_is_top\n  Pow_is_top[of \"nat\"] unfolding topology0_def by auto\n\ntext\\<open>In the file @{file \"Topology_ZF_properties.thy\"}, it is proven that $\\mathbb{N}$ is\nlindeloef if and only if the axiom of countable choice holds for subsets of $Pow(\\mathbb{N})$.\nNow we check that, in ZF, this space is always anti-lindeloef.\\<close>\n\ntheorem nat_anti_lindeloef:\n  shows \"Pow(nat){is anti-lindeloef}\"\nproof-\n  {\n   fix A assume A:\"A\\<in>Pow(\\<Union>Pow(nat))\" \"(\\<Union>(Pow(nat){restricted to}A)){is lindeloef in}(Pow(nat){restricted to}A)\"\n    from A(1) have \"A\\<subseteq>nat\" by auto\n    then have \"Pow(nat){restricted to}A=Pow(A)\" unfolding RestrictedTo_def by blast\n    with A(2) have lin:\"A{is lindeloef in}Pow(A)\" using subset_imp_lepoll by auto\n    {\n      fix T assume T:\"T{is a topology}\" \"\\<Union>T\\<approx>A\"\n      then have \"A\\<approx>\\<Union>T\" using eqpoll_sym by auto\n      then obtain f where f:\"f\\<in>bij(A,\\<Union>T)\" unfolding eqpoll_def by auto\n      then have \"f\\<in>surj(A,\\<Union>T)\" unfolding bij_def by auto\n      moreover then have \"IsContinuous(Pow(A),T,f)\" unfolding IsContinuous_def\n        surj_def using func1_1_L3 by blast\n      moreover have \"two_top_spaces0(Pow(A),T,f)\" unfolding two_top_spaces0_def\n        using f T(1) Pow_is_top unfolding bij_def inj_def by auto\n      ultimately have \"(\\<Union>T){is lindeloef in}T\" using two_top_spaces0.cont_image_com\n        lin unfolding IsLindeloef_def by auto\n    }\n    then have \"A{is in the spectrum of} (\\<lambda>T. ((\\<Union>T){is lindeloef in}T))\" unfolding Spec_def by auto\n  }\n  then show ?thesis unfolding IsAntiLin_def antiProperty_def by auto   \nqed\n\ntext\\<open>This result is interesting because depending on the different axioms we add\nto ZF, it means two different things: \n\\begin{itemize}\n\\item Every subspace of $\\mathbb{N}$ is Lindeloef.\n\\item Only the compact subspaces of $\\mathbb{N}$ are Lindeloef.\n\\end{itemize}\n\\<close>\n\ntext\\<open>Now, we could wonder if the class of compact spaces and the class of lindeloef spaces being equal\nis consistent in ZF. Let's find a topological space which is lindeloef and no compact\nwithout assuming any axiom of choice or any negation of one. This will prove\nthat the class of lindeloef spaces and the class of compact spaces cannot be equal\nin any model of ZF.\\<close>\n\ntheorem lord_nat:\n  shows \"(LOrdTopology nat Le)={LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<union>{0}\"\nproof-\n  {\n    fix U assume U:\"U\\<subseteq>{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat}\" \"U\\<noteq>0\"\n    {\n      assume \"nat\\<in>U\"\n      with U have \"\\<Union>U=nat\" unfolding LeftRayX_def by auto\n      then have \"\\<Union>U\\<in>{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat}\\<union>{0}\" by auto\n    }\n    moreover\n    {\n      assume \"nat\\<notin>U\"\n      with U have UU:\"U\\<subseteq>{LeftRayX(nat,Le,n). n\\<in>nat}\\<union>{0}\" by auto\n      {\n        assume A:\"\\<exists>i. i\\<in>nat\\<and> \\<Union>U\\<subseteq> LeftRayX(nat,Le,i)\"\n        let ?M=\"\\<mu> i. i\\<in>nat \\<and> \\<Union>U\\<subseteq> LeftRayX(nat,Le,i)\"\n        from A have M:\"?M\\<in>nat\" \"\\<Union>U\\<subseteq> LeftRayX(nat,Le,?M)\" using LeastI[OF _ nat_into_Ord, where P=\"\\<lambda>i. i\\<in>nat \\<and> \\<Union>U\\<subseteq> LeftRayX(nat,Le,i)\"]\n          by auto\n        {\n          fix y assume V:\"y\\<in>LeftRayX(nat,Le,?M)\"\n          then have y:\"y\\<in>nat\" unfolding LeftRayX_def by auto\n          {\n            assume \"\\<forall>V\\<in>U. y\\<notin>V\"\n            then have \"\\<forall>m\\<in>{n\\<in>nat. LeftRayX(nat,Le,n)\\<in>U}. y\\<notin>LeftRayX(nat,Le,m)\" using UU by auto\n            then have \"\\<forall>m\\<in>{n\\<in>nat. LeftRayX(nat,Le,n)\\<in>U}. \\<langle>y,m\\<rangle>\\<notin>Le\\<or>y=m\" unfolding LeftRayX_def using y\n              by auto\n            then have RR:\"\\<forall>m\\<in>{n\\<in>nat. LeftRayX(nat,Le,n)\\<in>U}. \\<langle>m,y\\<rangle>\\<in>Le\" using Le_directs_nat(1) y unfolding IsLinOrder_def IsTotal_def by blast\n            {\n              fix rr V assume \"rr\\<in>\\<Union>U\"\n              then obtain V where V:\"V\\<in>U\" \"rr\\<in>V\" by auto\n              with UU obtain m where m:\"V=LeftRayX(nat,Le,m)\" \"m\\<in>nat\" by auto\n              with V(1) RR have a:\"\\<langle>m,y\\<rangle>\\<in>Le\" by auto\n              from V(2) m(1) have b:\"\\<langle>rr,m\\<rangle>\\<in>Le\" \"rr\\<in>nat-{m}\" unfolding LeftRayX_def by auto\n              from a b(1) have \"\\<langle>rr,y\\<rangle>\\<in>Le\" using Le_directs_nat(1) unfolding IsLinOrder_def\n                trans_def by blast moreover\n              {\n                assume \"rr=y\"\n                with a b have \"False\" using Le_directs_nat(1) unfolding IsLinOrder_def antisym_def by blast\n              }\n              ultimately have \"rr\\<in>LeftRayX(nat,Le,y)\" unfolding LeftRayX_def using b(2) by auto\n            }\n            then have \"\\<Union>U\\<subseteq>LeftRayX(nat,Le,y)\" by auto\n            with y M(1) have \"\\<langle>?M,y\\<rangle>\\<in>Le\" using Least_le by auto\n            with V have \"False\" unfolding LeftRayX_def using Le_directs_nat(1) unfolding IsLinOrder_def antisym_def by blast\n          }\n          then have \"y\\<in>\\<Union>U\" by auto\n        }\n        then have \"LeftRayX(nat,Le,?M)\\<subseteq>\\<Union>U\" by auto\n        with M(2) have \"\\<Union>U=LeftRayX(nat,Le,?M)\" by auto\n        with M(1) have \"\\<Union>U\\<in>{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat}\" by auto\n      }\n      moreover\n      {\n        assume \"\\<not>(\\<exists>i. i \\<in> nat \\<and> \\<Union>U \\<subseteq> LeftRayX(nat, Le, i))\"\n        then have A:\"\\<forall>i. i\\<in>nat \\<longrightarrow> \\<not>(\\<Union>U \\<subseteq> LeftRayX(nat, Le, i))\" by auto\n        {\n          fix i assume i:\"i\\<in>nat\"\n          with A have AA:\"\\<not>(\\<Union>U \\<subseteq> LeftRayX(nat, Le, i))\" by auto\n          {\n            assume \"i\\<notin>\\<Union>U\"\n            then have \"\\<forall>V\\<in>U. i\\<notin>V\" by auto\n            then have \"\\<forall>m\\<in>{n\\<in>nat. LeftRayX(nat, Le, n)\\<in>U}. i\\<notin>LeftRayX(nat, Le, m)\" by auto\n            with i have \"\\<forall>m\\<in>{n\\<in>nat. LeftRayX(nat, Le, n)\\<in>U}. \\<langle>i,m\\<rangle>\\<notin>Le\\<or>i=m\" unfolding LeftRayX_def by auto\n            with i have \"\\<forall>m\\<in>{n\\<in>nat. LeftRayX(nat, Le, n)\\<in>U}. \\<not>(i\\<le>m)\\<or>i=m\" unfolding Le_def by auto\n            then have \"\\<forall>m\\<in>{n\\<in>nat. LeftRayX(nat, Le, n)\\<in>U}. m<i\\<or>m=i\" using not_le_iff_lt[OF nat_into_Ord[OF i]\n              nat_into_Ord] by auto\n            then have M:\"\\<forall>m\\<in>{n\\<in>nat. LeftRayX(nat, Le, n)\\<in>U}. m\\<le>i\" using le_iff nat_into_Ord[OF i] by auto\n            {\n              fix s assume \"s\\<in>\\<Union>U\"\n              then obtain n where n:\"n\\<in>nat\" \"s\\<in>LeftRayX(nat, Le, n)\" \"LeftRayX(nat, Le, n)\\<in>U\"\n                using UU by auto\n              with M have ni:\"n\\<le>i\" by auto\n              from n(2) have sn:\"s\\<le>n\" \"s\\<noteq>n\" unfolding LeftRayX_def by auto\n              then have \"s\\<le>i\" \"s\\<noteq>i\" using le_trans[OF sn(1) ni] le_anti_sym[OF sn(1)] ni by auto\n              then have \"s\\<in>LeftRayX(nat, Le, i)\" using i le_in_nat unfolding LeftRayX_def by auto\n            }\n            with AA have \"False\" by auto\n          }\n          then have \"i\\<in>\\<Union>U\" by auto\n        }\n        then have \"nat\\<subseteq>\\<Union>U\" by auto\n        then have \"\\<Union>U=nat\" using UU unfolding LeftRayX_def by auto\n        then have \"\\<Union>U\\<in>{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<union>{0}\" by auto\n      }\n      ultimately have \"\\<Union>U\\<in>{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<union>{0}\" by auto\n    }\n    ultimately have \"\\<Union>U\\<in>{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<union>{0}\" by auto\n  }\n  moreover\n  {\n    fix U assume \"U=0\"\n    then have \"\\<Union>U\\<in>{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<union>{0}\" by auto\n  }\n  ultimately have \"\\<forall>U. U\\<subseteq>{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<longrightarrow> \\<Union>U\\<in>{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<union>{0}\"\n    by auto\n  then have \"{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<union>{0}={\\<Union>U. U\\<in>Pow({LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat})}\" by blast\n  then show ?thesis using LOrdtopology_ROrdtopology_are_topologies(2)[OF Le_directs_nat(1)]\n    unfolding IsAbaseFor_def by auto\nqed\n\nlemma countable_lord_nat:\n  shows \"{LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<union>{0}\\<prec>csucc(nat)\"\nproof-\n  {\n    fix e\n    have \"{e}\\<approx>1\" using singleton_eqpoll_1 by auto\n    then have \"{e}\\<prec>nat\" using n_lesspoll_nat eq_lesspoll_trans by auto moreover\n    have s:\"nat\\<prec>csucc(nat)\" using lt_Card_imp_lesspoll[OF Card_csucc] lt_csucc[OF Ord_nat] by auto\n    ultimately have \"{e}\\<prec>csucc(nat)\" using lesspoll_trans by blast\n  }\n  then have \"{nat} \\<union>{0}\\<prec>csucc(nat)\" using less_less_imp_un_less[OF _ _ InfCard_csucc[OF InfCard_nat], of \"{nat}\" \"{0}\"]\n    by auto moreover\n  let ?FF=\"{\\<langle>n,LeftRayX(nat,Le,n)\\<rangle>. n\\<in>nat}\"\n  have ff:\"?FF:nat\\<rightarrow>{LeftRayX(nat,Le,n). n\\<in>nat}\" unfolding Pi_def domain_def function_def by auto\n  then have su:\"?FF\\<in>surj(nat,{LeftRayX(nat,Le,n). n\\<in>nat})\" unfolding surj_def using apply_equality[\n    OF _ ff] by auto\n  then have \"{LeftRayX(nat,Le,n). n\\<in>nat}\\<lesssim>nat\" using surj_fun_inv_2[OF su lepoll_refl[of \"nat\"]] Ord_nat \n    by auto\n  then have \"{LeftRayX(nat,Le,n). n\\<in>nat}\\<prec>csucc(nat)\" using Card_less_csucc_eq_le[OF Card_nat] by auto\n  ultimately have \"{LeftRayX(nat, Le, n) . n \\<in> nat} \\<union> ({nat} \\<union> {0}) \\<prec> csucc(nat)\" using less_less_imp_un_less[OF _ _ InfCard_csucc[OF InfCard_nat]] by auto\n  moreover have \"{LeftRayX(nat, Le, n) . n \\<in> nat} \\<union> ({nat} \\<union> {0})={LeftRayX(nat, Le, n) . n \\<in> nat} \\<union> {nat} \\<union> {0}\" by auto\n  ultimately show ?thesis by auto\nqed\n\ncorollary lindelof_lord_nat:\n  shows \"nat{is lindeloef in}(LOrdTopology nat Le)\"\n  unfolding IsLindeloef_def using countable_lord_nat lord_nat card_top_comp[OF Card_csucc[OF Ord_nat]]\n    union_lordtopology_rordtopology(1)[OF Le_directs_nat(1)] by auto\n  \ntheorem not_comp_lord_nat:\n  shows \"\\<not>(nat{is compact in}(LOrdTopology nat Le))\"\nproof\n  assume \"nat{is compact in}(LOrdTopology nat Le)\"\n  with lord_nat have \"nat{is compact in}({LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<union>{0})\" by auto\n  then have \"\\<forall>M\\<in>Pow({LeftRayX(nat,Le,n). n\\<in>nat} \\<union>{nat} \\<union>{0}). nat\\<subseteq>\\<Union>M \\<longrightarrow> (\\<exists>N\\<in>FinPow(M). nat\\<subseteq>\\<Union>N)\"\n    unfolding IsCompact_def by auto moreover\n  {\n    fix n assume n:\"n\\<in>nat\"\n    then have \"n<succ(n)\" by auto\n    then have \"\\<langle>n,succ(n)\\<rangle>\\<in>Le\" \"n\\<noteq>succ(n)\" using n nat_succ_iff by auto\n    then have \"n\\<in>LeftRayX(nat,Le,succ(n))\" unfolding LeftRayX_def using n by auto\n    then have \"n\\<in>\\<Union>({LeftRayX(nat,Le,n). n\\<in>nat})\" using n nat_succ_iff by auto\n  }\n  ultimately have \"\\<exists>N\\<in>FinPow({LeftRayX(nat,Le,n). n\\<in>nat}). nat\\<subseteq>\\<Union>N\" by blast\n  then obtain N where \"N\\<in>FinPow({LeftRayX(nat,Le,n). n\\<in>nat})\" \"nat\\<subseteq>\\<Union>N\" by auto\n  then have N:\"N\\<subseteq>{LeftRayX(nat,Le,n). n\\<in>nat}\" \"Finite(N)\" \"nat\\<subseteq>\\<Union>N\" unfolding FinPow_def by auto\n  let ?F=\"{\\<langle>n,LeftRayX(nat,Le,n)\\<rangle>. n\\<in>{m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N}}\"\n  have ff:\"?F:{m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N} \\<rightarrow> N\" unfolding Pi_def function_def by auto\n  then have \"?F\\<in>surj({m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N}, N)\" unfolding surj_def using N(1) apply_equality[\n    OF _ ff] by blast moreover\n  {\n    fix x y assume xyF:\"x\\<in>{m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N}\" \"y\\<in>{m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N}\" \"?F`x=?F`y\"\n    then have \"?F`x=LeftRayX(nat,Le,x)\" \"?F`y=LeftRayX(nat,Le,y)\" using apply_equality[\n      OF _ ff] by auto\n    with xyF(3) have lxy:\"LeftRayX(nat,Le,x)=LeftRayX(nat,Le,y)\" by auto\n    {\n      fix r assume \"r<x\"\n      then have \"r\\<le>x\" \"r\\<noteq>x\" using leI by auto\n      with xyF(1) have \"r\\<in>LeftRayX(nat,Le,x)\" unfolding LeftRayX_def using le_in_nat by auto\n      then have \"r\\<in>LeftRayX(nat,Le,y)\" using lxy by auto\n      then have \"r\\<le>y\" \"r\\<noteq>y\" unfolding LeftRayX_def by auto\n      then have \"r<y\" using le_iff by auto\n    }\n    then have \"\\<forall>r. r<x \\<longrightarrow> r<y\" by auto\n    then have r:\"\\<not>(y<x)\" by auto\n    {\n      fix r assume \"r<y\"\n      then have \"r\\<le>y\" \"r\\<noteq>y\" using leI by auto\n      with xyF(2) have \"r\\<in>LeftRayX(nat,Le,y)\" unfolding LeftRayX_def using le_in_nat by auto\n      then have \"r\\<in>LeftRayX(nat,Le,x)\" using lxy by auto\n      then have \"r\\<le>x\" \"r\\<noteq>x\" unfolding LeftRayX_def by auto\n      then have \"r<x\" using le_iff by auto\n    }\n    then have \"\\<not>(x<y)\" by auto\n    with r have \"x=y\" using not_lt_iff_le[OF nat_into_Ord nat_into_Ord] xyF(1,2)\n      le_anti_sym by auto\n  }\n  then have \"?F\\<in>inj({m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N}, N)\" unfolding inj_def using ff by auto\n  ultimately have \"?F\\<in>bij({m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N}, N)\" unfolding bij_def by auto\n  then have \"{m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N}\\<approx> N\" unfolding eqpoll_def by auto\n  with N(2) have fin:\"Finite({m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N})\" using lepoll_Finite eqpoll_imp_lepoll\n    by auto\n  from N(3) have \"N\\<noteq>0\" by auto\n  then have nE:\"{m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N}\\<noteq>0\" using N(1) by auto\n  let ?M=\"Maximum(Le,{m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N})\"\n  have M:\"?M\\<in>nat\" \"LeftRayX(nat,Le,?M)\\<in>N\" \"\\<forall>\\<xx>\\<in>{m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N}. \\<langle>\\<xx>,?M\\<rangle>\\<in>Le\" using fin linord_max_props(1,3)[OF Le_directs_nat(1) _ nE]\n    unfolding FinPow_def by auto\n  {\n    fix V \\<xx> assume V:\"V\\<in>N\" \"\\<xx>\\<in>V\"\n    then obtain m where m:\"V=LeftRayX(nat,Le,m)\" \"LeftRayX(nat,Le,m)\\<in>N\" \"m\\<in>nat\" using N(1) by auto\n    with V(2) have xx:\"\\<langle>\\<xx>,m\\<rangle>\\<in>Le\" \"\\<xx>\\<noteq>m\" unfolding LeftRayX_def by auto\n    from m(2,3) have \"m\\<in>{m\\<in>nat. LeftRayX(nat,Le,m)\\<in>N}\" by auto\n    then have mM:\"\\<langle>m,?M\\<rangle>\\<in>Le\" using M(3) by auto\n    with xx(1) have \"\\<langle>\\<xx>,?M\\<rangle>\\<in>Le\" using le_trans unfolding Le_def by auto\n    moreover\n    {\n      assume \"\\<xx>=?M\"\n      with xx mM have \"False\" using le_anti_sym by auto\n    }\n    ultimately have \"\\<xx>\\<in>LeftRayX(nat,Le,?M)\" unfolding LeftRayX_def by auto\n  }\n  then have \"\\<Union>N\\<subseteq>LeftRayX(nat,Le,?M)\" by auto\n  with M(2) have \"\\<Union>N=LeftRayX(nat,Le,?M)\" by auto\n  with N(3) have \"nat\\<subseteq>LeftRayX(nat,Le,?M)\" by auto\n  moreover from M(1) have \"succ(?M)\\<in>nat\" using nat_succI by auto\n  ultimately have \"succ(?M)\\<in>LeftRayX(nat,Le,?M)\" by auto\n  then have \"\\<langle>succ(?M),?M\\<rangle>\\<in>Le\" unfolding LeftRayX_def by blast\n  then show \"False\" by auto\nqed\n      \nsubsection\\<open>More Separation properties\\<close>\n\ntext\\<open>In this section we study more separation properties.\\<close>\n\nsubsection\\<open>Definitions\\<close>\n\ntext\\<open>We start with a property that has already appeared in\n@{file \"Topology_ZF_1b.thy\"}. A KC-space is a space where\ncompact sets are closed.\\<close>\n\ndefinition\n  IsKC (\"_ {is KC}\") where\n  \"T{is KC} \\<equiv> \\<forall>A\\<in>Pow(\\<Union>T). A{is compact in}T \\<longrightarrow> A{is closed in}T\"\n\ntext\\<open>Another type of space is an US-space; those where sequences\nhave at most one limit.\\<close>\n\ndefinition\n  IsUS (\"_{is US}\") where\n  \"T{is US} \\<equiv> \\<forall>N x y. (N:nat\\<rightarrow>\\<Union>T) \\<and> NetConvTop(\\<langle>N,Le\\<rangle>,x,T) \\<and> NetConvTop(\\<langle>N,Le\\<rangle>,y,T) \\<longrightarrow> y=x\"\n\nsubsection\\<open>First results\\<close>\n\ntext\\<open>The proof in @{file \"Topology_ZF_1b.thy\"} shows that a Hausdorff space\nis KC.\\<close>\n\ncorollary(in topology0) T2_imp_KC:\n  assumes \"T{is T\\<^sub>2}\"\n  shows \"T{is KC}\"\nproof-\n  {\n    fix A assume \"A{is compact in}T\"\n    then have \"A{is closed in}T\" using in_t2_compact_is_cl assms by auto\n  }\n  then show ?thesis unfolding IsKC_def by auto\nqed\n\ntext\\<open>From the spectrum of compactness, it follows that any KC-space\nis $T_1$.\\<close>\n\nlemma(in topology0) KC_imp_T1:\n  assumes \"T{is KC}\"\n  shows \"T{is T\\<^sub>1}\"\nproof-\n  {\n    fix x assume A:\"x\\<in>\\<Union>T\"\n    have \"Finite({x})\" by auto\n    then have \"{x}{is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\"\n      using compact_spectrum by auto moreover\n    have \"(T{restricted to}{x}){is a topology}\" using Top_1_L4 by auto\n    moreover have \"\\<Union>(T{restricted to}{x})={x}\" using A unfolding RestrictedTo_def by auto\n    ultimately have com:\"{x}{is compact in}(T{restricted to}{x})\" unfolding Spec_def\n      by auto\n    then have \"{x}{is compact in}T\" using compact_subspace_imp_compact A by auto\n    then have \"{x}{is closed in}T\" using assms unfolding IsKC_def using A by auto\n  }\n  then show ?thesis using T1_iff_singleton_closed by auto\nqed\n\ntext\\<open>Even more, if a space is KC, then it is US. We already know that\nfor $T_2$ spaces, any net or filter has at most one limit; and that\nthis property is equivalent with $T_2$. The US property is much weaker\nbecause we don't know what happends with other nets that are not directed by\nthe order on the natural numbers.\\<close>\n\ntheorem(in topology0) KC_imp_US:\n  assumes \"T{is KC}\"\n  shows \"T{is US}\"\nproof-\n  {\n    fix N x y  assume A:\"N:nat\\<rightarrow>\\<Union>T\" \"\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N x\" \"\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N y\" \"x\\<noteq>y\"\n    have dir:\"Le directs nat\" using Le_directs_nat by auto moreover\n    from A(1) have dom:\"domain(N)=nat\" using func1_1_L1 by auto\n    moreover note A(1) ultimately have Net:\"\\<langle>N,Le\\<rangle>{is a net on}\\<Union>T\" unfolding IsNet_def\n      by auto\n    from A(3) have y:\"y\\<in>\\<Union>T\" unfolding NetConverges_def[OF Net] by auto\n    from A(2) have x:\"x\\<in>\\<Union>T\" unfolding NetConverges_def[OF Net] by auto\n    from A(2) have o1:\"\\<forall>U\\<in>Pow(\\<Union>T). x\\<in>int(U) \\<longrightarrow> (\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U)\" unfolding NetConverges_def[OF Net]\n       using dom by auto\n    {\n      assume B:\"\\<exists>n\\<in>nat. \\<forall>m\\<in>nat. \\<langle>n,m\\<rangle>\\<in>Le \\<longrightarrow> N`m=y\"\n      have \"{y}{is closed in}T\" using y T1_iff_singleton_closed KC_imp_T1 assms by auto\n      then have o2:\"\\<Union>T-{y}\\<in>T\" unfolding IsClosed_def by auto\n      then have \"int(\\<Union>T-{y})=\\<Union>T-{y}\" using Top_2_L3 by auto\n      with A(4) x have o3:\"x\\<in>int(\\<Union>T-{y})\" by auto\n      from o2 have \"\\<Union>T-{y}\\<in>Pow(\\<Union>T)\" by auto\n      with o1 o3 obtain r where r:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>\\<Union>T-{y}\" by auto\n      from B obtain n where n:\"n\\<in>nat\" \"\\<forall>m\\<in>nat. \\<langle>n,m\\<rangle>\\<in>Le \\<longrightarrow> N`m=y\" by auto\n      from dir r(1) n(1) obtain z where \"\\<langle>r,z\\<rangle>\\<in>Le\"\"\\<langle>n,z\\<rangle>\\<in>Le\"\"z\\<in>nat\" unfolding IsDirectedSet_def by auto\n      with r(2) n(2) have \"N`z\\<in>\\<Union>T-{y}\" \"N`z=y\" by auto\n      then have \"False\" by auto\n    }\n    then have reg:\"\\<forall>n\\<in>nat. \\<exists>m\\<in>nat. N`m\\<noteq>y \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" by auto\n    let ?NN=\"{\\<langle>n,N`(\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<rangle>. n\\<in>nat}\"\n    {\n      fix x z assume A1:\"\\<langle>x, z\\<rangle> \\<in> ?NN\"\n      {\n        fix y' assume A2:\"\\<langle>x,y'\\<rangle>\\<in>?NN\"\n        with A1 have \"z=y'\" by auto\n      }\n      then have \"\\<forall>y'. \\<langle>x,y'\\<rangle>\\<in>?NN \\<longrightarrow> z=y'\" by auto\n    }\n    then have \"\\<forall>x z. \\<langle>x, z\\<rangle> \\<in> ?NN \\<longrightarrow> (\\<forall>y'. \\<langle>x,y'\\<rangle>\\<in>?NN \\<longrightarrow> z=y')\" by auto\n    moreover\n    {\n      fix n assume as:\"n\\<in>nat\"\n      with reg obtain m where \"N`m\\<noteq>y \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\\<in>nat\" by auto\n      then have LI:\"N`(\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<noteq>y\" \"\\<langle>n,\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>n,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>y \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\"]\n        nat_into_Ord[of \"m\"] by auto\n      then have \"(\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<in>nat\" by auto\n      then have \"N`(\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<in>\\<Union>T\" using apply_type[OF A(1)] by auto\n      with as have \"\\<langle>n,N`(\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<rangle>\\<in>nat\\<times>\\<Union>T\" by auto\n    }\n    then have \"?NN\\<in>Pow(nat\\<times>\\<Union>T)\" by auto\n    ultimately have NFun:\"?NN:nat\\<rightarrow>\\<Union>T\" unfolding Pi_def function_def domain_def by auto\n    {\n      fix n assume as:\"n\\<in>nat\"\n      with reg obtain m where \"N`m\\<noteq>y \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\\<in>nat\" by auto\n      then have LI:\"N`(\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<noteq>y\" \"\\<langle>n,\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>n,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>y \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\"]\n        nat_into_Ord[of \"m\"] by auto\n      then have \"?NN`n\\<noteq>y\" using apply_equality[OF _ NFun] by auto\n    }\n    then have noy:\"\\<forall>n\\<in>nat. ?NN`n\\<noteq>y\" by auto\n    have dom2:\"domain(?NN)=nat\" by auto\n    then have net2:\"\\<langle>?NN,Le\\<rangle>{is a net on}\\<Union>T\" unfolding IsNet_def using NFun dir by auto\n    {\n      fix U assume \"U\\<in>Pow(\\<Union>T)\" \"x\\<in>int(U)\"\n      then have \"(\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U)\" using o1 by auto\n      then obtain r where r_def:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U\" by auto\n      {\n        fix s assume AA:\"\\<langle>r,s\\<rangle>\\<in>Le\"\n        with reg obtain m where \"N`m\\<noteq>y\" \"\\<langle>s,m\\<rangle>\\<in>Le\" by auto\n        then have \"\\<langle>s,\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>y \\<and> \\<langle>s,m\\<rangle>\\<in>Le\" \"m\"]\n          nat_into_Ord by auto\n        with AA have \"\\<langle>r,\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using le_trans by auto\n        with r_def(2) have \"N`(\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>s,i\\<rangle>\\<in>Le)\\<in>U\" by blast\n        then have \"?NN`s\\<in>U\" using apply_equality[OF _ NFun] AA by auto\n      }\n      then have \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\" by auto\n      with r_def(1) have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\" by auto\n    }\n    then have conv2:\"\\<langle>?NN,Le\\<rangle>\\<rightarrow>\\<^sub>N x\" unfolding NetConverges_def[OF net2] using x dom2 by auto\n    let ?A=\"{x}\\<union>?NN``nat\"\n    {\n      fix M assume Acov:\"?A\\<subseteq>\\<Union>M\" \"M\\<subseteq>T\"\n      then have \"x\\<in>\\<Union>M\" by auto\n      then obtain U where U:\"x\\<in>U\" \"U\\<in>M\" by auto\n      with Acov(2) have UT:\"U\\<in>T\" by auto\n      then have \"U=int(U)\" using Top_2_L3 by auto\n      with U(1) have \"x\\<in>int(U)\" by auto\n      with conv2 obtain r where rr:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\"\n        unfolding NetConverges_def[OF net2] using dom2 UT by auto\n      have NresFun:\"restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}):{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<rightarrow>\\<Union>T\" using restrict_fun\n        [OF NFun, of \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\"] by auto\n      then have \"restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le})\\<in>surj({n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le},range(restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le})))\"\n        using fun_is_surj by auto moreover\n      have \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<subseteq>nat\" by auto\n      then have \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<lesssim>nat\" using subset_imp_lepoll by auto\n      ultimately have \"range(restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}))\\<lesssim>{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\" using surj_fun_inv_2 by auto\n      moreover\n      have \"{n\\<in>nat. \\<langle>n,0\\<rangle>\\<in>Le}={0}\" by auto\n      then have \"Finite({n\\<in>nat. \\<langle>n,0\\<rangle>\\<in>Le})\" by auto moreover\n      {\n        fix j assume as:\"j\\<in>nat\" \"Finite({n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le})\"\n        {\n          fix t assume \"t\\<in>{n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le}\"\n          then have \"t\\<in>nat\" \"\\<langle>t,succ(j)\\<rangle>\\<in>Le\" by auto\n          then have \"t\\<le>succ(j)\" by auto\n          then have \"t\\<subseteq>succ(j)\" using le_imp_subset by auto\n          then have \"t\\<subseteq>j \\<union>{j}\" using succ_explained by auto\n          then have \"j\\<in>t\\<or>t\\<subseteq>j\" by auto\n          then have \"j\\<in>t\\<or>t\\<le>j\" using subset_imp_le \\<open>t\\<in>nat\\<close> \\<open>j\\<in>nat\\<close> nat_into_Ord by auto\n          then have \"j \\<union>{j}\\<subseteq>t\\<or>t\\<le>j\" using \\<open>t\\<in>nat\\<close> \\<open>j\\<in>nat\\<close> nat_into_Ord unfolding Ord_def\n            Transset_def by auto\n          then have \"succ(j)\\<subseteq>t\\<or>t\\<le>j\" using succ_explained by auto\n          with \\<open>t\\<subseteq>succ(j)\\<close> have \"t=succ(j)\\<or>t\\<le>j\" by auto\n          with \\<open>t\\<in>nat\\<close> \\<open>j\\<in>nat\\<close> have \"t\\<in>{n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le} \\<union> {succ(j)}\" by auto\n        }\n        then have \"{n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le} \\<subseteq>{n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le} \\<union> {succ(j)}\" by auto\n        moreover have \"Finite({n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le} \\<union> {succ(j)})\" using as(2) Finite_cons\n          by auto\n        ultimately have \"Finite({n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le})\" using subset_Finite by auto\n      }\n      then have \"\\<forall>j\\<in>nat. Finite({n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le}) \\<longrightarrow> Finite({n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le})\"\n        by auto\n      ultimately have \"Finite(range(restrict(?NN, {n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})))\"\n        using lepoll_Finite[of \"range(restrict(?NN, {n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}))\"\n          \"{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}\"] ind_on_nat[OF \\<open>r\\<in>nat\\<close>, where P=\"\\<lambda>t. Finite({n\\<in>nat. \\<langle>n,t\\<rangle>\\<in>Le})\"] by auto\n      then have \"Finite((restrict(?NN, {n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}))``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\" using range_image_domain[OF NresFun]\n        by auto\n      then have \"Finite(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\" using restrict_image by auto\n      then have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" using compact_spectrum by auto\n      moreover have \"\\<Union>(T{restricted to}?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})=\\<Union>T\\<inter>?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}\"\n        unfolding RestrictedTo_def by auto moreover\n      have \"\\<Union>T\\<inter>?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}=?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}\"\n        using func1_1_L6(2)[OF NFun] by blast\n      moreover have \"(T{restricted to}?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is a topology}\"\n        using Top_1_L4 by auto\n      ultimately have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is compact in}(T{restricted to}?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\"\n        unfolding Spec_def by force\n      then have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is compact in}T\" using compact_subspace_imp_compact by auto\n      moreover from Acov(1) have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\\<subseteq>\\<Union>M\" by auto\n      moreover note Acov(2) ultimately\n      obtain \\<NN> where \\<NN>:\"\\<NN>\\<in>FinPow(M)\" \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\\<subseteq>\\<Union>\\<NN>\"\n        unfolding IsCompact_def by blast\n      from \\<NN>(1) have \"\\<NN> \\<union>{U}\\<in>FinPow(M)\" using U(2) unfolding FinPow_def by auto moreover\n      {\n        fix s assume s:\"s\\<in>?A\" \"s\\<notin>U\"\n        with U(1) have \"s\\<in>?NN``nat\" by auto\n        then have \"s\\<in>{?NN`n. n\\<in>nat}\" using func_imagedef[OF NFun] by auto\n        then obtain n where n:\"n\\<in>nat\" \"s=?NN`n\" by auto\n        {\n          assume \"\\<langle>r,n\\<rangle>\\<in>Le\"\n          with rr have \"?NN`n\\<in>U\" by auto\n          with n(2) s(2) have \"False\" by auto\n        }\n        then have \"\\<langle>r,n\\<rangle>\\<notin>Le\" by auto\n        with rr(1) n(1) have \"\\<not>(r\\<le>n)\" by auto\n        then have \"n\\<le>r\" using Ord_linear_le[where thesis=\"\\<langle>n,r\\<rangle>\\<in>Le\"] nat_into_Ord[OF rr(1)]\n          nat_into_Ord[OF n(1)] by auto\n        with rr(1) n(1) have \"\\<langle>n,r\\<rangle>\\<in>Le\" by auto\n        with n(2) have \"s\\<in>{?NN`t. t\\<in>{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}}\" by auto moreover\n        have \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<subseteq>nat\" by auto\n        ultimately have \"s\\<in>?NN``{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\" using func_imagedef[OF NFun]\n          by auto\n        with \\<NN>(2) have \"s\\<in>\\<Union>\\<NN>\" by auto\n      }\n      then have \"?A\\<subseteq>\\<Union>\\<NN> \\<union> U\" by auto\n      then have \"?A\\<subseteq>\\<Union>(\\<NN> \\<union> {U})\" by auto ultimately\n      have \"\\<exists>\\<NN>\\<in>FinPow(M). ?A\\<subseteq>\\<Union>\\<NN>\" by auto\n    }\n    then have \"\\<forall>M\\<in>Pow(T). ?A\\<subseteq>\\<Union>M \\<longrightarrow> (\\<exists>\\<NN>\\<in>FinPow(M). ?A\\<subseteq>\\<Union>\\<NN>)\" by auto moreover\n    have \"?A\\<subseteq>\\<Union>T\" using func1_1_L6(2)[OF NFun] x by blast ultimately\n    have \"?A{is compact in}T\" unfolding IsCompact_def by auto\n    with assms have \"?A{is closed in}T\" unfolding IsKC_def IsCompact_def by auto\n    then have \"\\<Union>T-?A\\<in>T\" unfolding IsClosed_def by auto\n    then have \"\\<Union>T-?A=int(\\<Union>T-?A)\" using Top_2_L3 by auto moreover\n    {\n      assume \"y\\<in>?A\"\n      with A(4) have \"y\\<in>?NN``nat\" by auto\n      then have \"y\\<in>{?NN`n. n\\<in>nat}\" using func_imagedef[OF NFun] by auto\n      then obtain n where \"n\\<in>nat\"\"?NN`n=y\" by auto\n      with noy have \"False\" by auto\n    }\n    with y have \"y\\<in>\\<Union>T-?A\" by force ultimately\n    have \"y\\<in>int(\\<Union>T-?A)\" \"\\<Union>T-?A\\<in>Pow(\\<Union>T)\" by auto moreover\n    have \"(\\<forall>U\\<in>Pow(\\<Union>T).  y \\<in> int(U) \\<longrightarrow> (\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> U))\"\n      using A(3) dom unfolding NetConverges_def[OF Net] by auto\n    ultimately have \"\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> \\<Union>T-?A\" by blast\n    then obtain r where r_def:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>\\<Union>T-?A\" by auto\n    {\n        fix s assume AA:\"\\<langle>r,s\\<rangle>\\<in>Le\"\n        with reg obtain m where \"N`m\\<noteq>y\" \"\\<langle>s,m\\<rangle>\\<in>Le\" by auto\n        then have \"\\<langle>s,\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>y \\<and> \\<langle>s,m\\<rangle>\\<in>Le\" \"m\"]\n          nat_into_Ord by auto\n        with AA have \"\\<langle>r,\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using le_trans by auto\n        with r_def(2) have \"N`(\\<mu> i. N`i\\<noteq>y \\<and> \\<langle>s,i\\<rangle>\\<in>Le)\\<in>\\<Union>T-?A\" by force\n        then have \"?NN`s\\<in>\\<Union>T-?A\" using apply_equality[OF _ NFun] AA by auto\n        moreover have \"?NN`s\\<in>{?NN`t. t\\<in>nat}\" using AA by auto\n        then have \"?NN`s\\<in>?NN``nat\" using func_imagedef[OF NFun] by auto\n        then have \"?NN`s\\<in>?A\" by auto\n        ultimately have \"False\" by auto\n      }\n      moreover have \"r\\<subseteq>succ(r)\" using succ_explained by auto\n      then have \"r\\<le>succ(r)\" using subset_imp_le nat_into_Ord \\<open>r\\<in>nat\\<close> nat_succI\n        by auto\n      then have \"\\<langle>r,succ(r)\\<rangle>\\<in>Le\" using \\<open>r\\<in>nat\\<close> nat_succI by auto\n      ultimately have \"False\" by auto\n    }\n    then have \"\\<forall>N x y. (N:nat\\<rightarrow>\\<Union>T) \\<and> (\\<langle>N, Le\\<rangle> \\<rightarrow>\\<^sub>N x {in} T) \\<and> (\\<langle>N, Le\\<rangle> \\<rightarrow>\\<^sub>N y {in} T)\n      \\<longrightarrow> x=y\" by auto\n  then show ?thesis unfolding IsUS_def by auto\nqed\n\ntext\\<open>US spaces are also $T_1$.\\<close>\n\ntheorem (in topology0) US_imp_T1:\n  assumes \"T{is US}\"\n  shows \"T{is T\\<^sub>1}\"\nproof-\n  {\n    fix x assume x:\"x\\<in>\\<Union>T\"\n    then have \"{x}\\<subseteq>\\<Union>T\" by auto\n    {\n      fix y assume y:\"y\\<noteq>x\" \"y\\<in>cl({x})\"\n      then have r:\"\\<forall>U\\<in>T. y\\<in>U \\<longrightarrow> x\\<in>U\" using cl_inter_neigh[OF \\<open>{x}\\<subseteq>\\<Union>T\\<close>] by auto\n      let ?N=\"ConstantFunction(nat,x)\"\n      have fun:\"?N:nat\\<rightarrow>\\<Union>T\" using x func1_3_L1 by auto\n      then have dom:\"domain(?N)=nat\" using func1_1_L1 by auto\n      with fun have Net:\"\\<langle>?N,Le\\<rangle>{is a net on}\\<Union>T\" using Le_directs_nat unfolding IsNet_def\n        by auto\n      {\n        fix U assume \"U\\<in>Pow(\\<Union>T)\" \"x\\<in>int(U)\"\n        then have \"x\\<in>U\" using Top_2_L1 by auto\n        then have \"\\<forall>n\\<in>nat. ?N`n\\<in>U\" using func1_3_L2 by auto\n        then have \"\\<forall>n\\<in>nat. \\<langle>0,n\\<rangle>\\<in>Le \\<longrightarrow>?N`n\\<in>U\" by auto\n        then have \"\\<exists>r\\<in>nat. \\<forall>n\\<in>nat. \\<langle>r,n\\<rangle>\\<in>Le \\<longrightarrow>?N`n\\<in>U\" by auto\n      }\n      then have \"\\<langle>?N,Le\\<rangle> \\<rightarrow>\\<^sub>N x\" unfolding NetConverges_def[OF Net] using x dom by auto moreover\n      {\n        fix U assume \"U\\<in>Pow(\\<Union>T)\" \"y\\<in>int(U)\"\n        then have \"x\\<in>int(U)\" using r Top_2_L2 by auto\n        then have \"x\\<in>U\" using Top_2_L1 by auto\n        then have \"\\<forall>n\\<in>nat. ?N`n\\<in>U\" using func1_3_L2 by auto\n        then have \"\\<forall>n\\<in>nat. \\<langle>0,n\\<rangle>\\<in>Le \\<longrightarrow>?N`n\\<in>U\" by auto\n        then have \"\\<exists>r\\<in>nat. \\<forall>n\\<in>nat. \\<langle>r,n\\<rangle>\\<in>Le \\<longrightarrow>?N`n\\<in>U\" by auto\n      }\n      then have \"\\<langle>?N,Le\\<rangle> \\<rightarrow>\\<^sub>N y\" unfolding NetConverges_def[OF Net] using y(2) dom\n        Top_3_L11(1)[OF \\<open>{x}\\<subseteq>\\<Union>T\\<close>] by auto\n      ultimately have \"x=y\" using assms unfolding IsUS_def using fun by auto\n      with y(1) have \"False\" by auto\n    }\n    then have \"cl({x})\\<subseteq>{x}\" by auto\n    then have \"cl({x})={x}\" using cl_contains_set[OF \\<open>{x}\\<subseteq>\\<Union>T\\<close>] by auto\n    then have \"{x}{is closed in}T\" using Top_3_L8 x by auto\n  }\n  then show ?thesis using T1_iff_singleton_closed by auto\nqed\n\nsubsection\\<open>Counter-examples\\<close>\n\ntext\\<open>We need to find counter-examples that prove that this properties\nare new ones.\\<close>\n\ntext\\<open>We know that $T_2\\Rightarrow loc.T_2\\Rightarrow$ anti-hyperconnected $\\Rightarrow T_1$\nand $T_2\\Rightarrow KC\\Rightarrow US\\Rightarrow T_1$. The question is: What is the relation\nbetween $KC$ or $US$ and, $loc.T_2$ or anti-hyperconnected?\\<close>\n\ntext\\<open>In the file @{file \"Topology_ZF_properties_2.thy\"} we built a topological space\nwhich is locally-$T_2$ but no $T_2$. It happends actually that this space is not even US\ngiven the appropiate topology \\<open>T\\<close>.\\<close>\n\nlemma (in topology0) locT2_not_US_1:\n  assumes \"{m}\\<notin>T\" \"{m}{is closed in}T\" \"\\<exists>N\\<in>nat\\<rightarrow>\\<Union>T. (\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N m) \\<and> m\\<notin>N``nat\" \n  shows \"\\<exists>N\\<in>nat\\<rightarrow>\\<Union>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}). (\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N \\<Union>T {in} (T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}))\n    \\<and> (\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N m {in} (T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}))\"\nproof-\n  from assms(3) obtain N where N:\"N:nat\\<rightarrow>\\<Union>T\" \"\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N m\" \"m\\<notin>N``nat\" by auto\n  have \"\\<Union>T\\<subseteq>\\<Union>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})\" using assms(2) union_doublepoint_top\n    by auto\n  with N(1) have fun:\"N:nat\\<rightarrow>\\<Union>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})\" using func1_1_L1B by auto\n  then have dom:\"domain(N)=nat\" using func1_1_L1 by auto\n  with fun have Net:\"\\<langle>N,Le\\<rangle>{is a net on}\\<Union>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})\" unfolding\n    IsNet_def using Le_directs_nat by auto\n  from N(1) dom have Net2:\"\\<langle>N,Le\\<rangle>{is a net on}\\<Union>T\" unfolding IsNet_def using Le_directs_nat by auto\n  from N(2) have R:\"\\<forall>U\\<in>Pow(\\<Union>T). m\\<in>int(U) \\<longrightarrow>(\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U)\"\n    unfolding NetConverges_def[OF Net2] using dom by auto\n  {\n    fix U assume U:\"U\\<in>Pow(\\<Union>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}))\"  \"m\\<in>Interior(U,T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})\"\n    let ?I=\"Interior(U,T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})\"\n    have \"?I\\<in>T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}\" using topology0.Top_2_L2 assms(2) doble_point_top unfolding topology0_def by blast\n    then have \"(\\<Union>T)\\<inter>?I\\<in>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}){restricted to}\\<Union>T\" unfolding RestrictedTo_def by blast\n    then have \"(\\<Union>T)\\<inter>?I\\<in>T\" using open_subspace_double_point(1) assms(2) by auto moreover\n    then have \"int((\\<Union>T)\\<inter>?I)=(\\<Union>T)\\<inter>?I\" using Top_2_L3 by auto\n    with U(2) assms(2) have \"m\\<in>int((\\<Union>T)\\<inter>?I)\" unfolding IsClosed_def by auto\n    moreover note R ultimately have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>(\\<Union>T)\\<inter>?I\" by blast\n    then have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>?I\" by blast\n    then have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U\" using topology0.Top_2_L1[of \"T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}\"\"U\"] doble_point_top assms(2)\n      unfolding topology0_def by auto\n  }\n  then have \"\\<forall>U\\<in>Pow(\\<Union>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})). m\\<in>Interior(U,T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}) \\<longrightarrow>(\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U)\" by auto\n  moreover have tt:\"topology0(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})\" using doble_point_top[OF assms(2)] unfolding topology0_def. \n  have \"m\\<in>\\<Union>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})\" using assms(2) union_doublepoint_top unfolding IsClosed_def by auto ultimately\n  have con1:\"(\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N m {in} (T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}))\" unfolding topology0.NetConverges_def[OF tt Net]\n    using dom by auto\n  {\n    fix U assume U:\"U\\<in>Pow(\\<Union>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}))\"  \"\\<Union>T\\<in>Interior(U,T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})\"\n    let ?I=\"Interior(U,T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})\"\n    have \"?I\\<in>T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}\" using topology0.Top_2_L2 assms(2) doble_point_top unfolding topology0_def by blast\n    with U(2) mem_not_refl have \"?I\\<in>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}\" by auto\n    then obtain V W where VW:\"?I=(V-{m})\\<union>{\\<Union>T}\\<union>W\" \"W\\<in>T\" \"V\\<in>T\" \"m\\<in>V\" by auto\n    from VW(3,4) have \"m\\<in>int(V)\" using Top_2_L3 by auto moreover\n    have \"V\\<in>Pow(\\<Union>T)\" using VW(3) by auto moreover\n    note R ultimately\n    have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>V\" by blast moreover\n    from N(3) have \"\\<forall>s\\<in>nat. N`s\\<noteq>m\" using func_imagedef[OF N(1)] by auto ultimately\n    have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>V-{m}\" by blast\n    then have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>?I\" using VW(1) by auto\n    then have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U\" using topology0.Top_2_L1 assms(2) doble_point_top unfolding topology0_def by blast\n  }\n  then have \"\\<forall>U\\<in>Pow(\\<Union>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})). \\<Union>T\\<in>Interior(U,T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}) \\<longrightarrow> (\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U)\" by auto\n  moreover have \"\\<Union>T\\<in>\\<Union>(T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T})\" using assms(2) union_doublepoint_top by auto ultimately\n  have \"(\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N \\<Union>T {in} (T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}))\" unfolding topology0.NetConverges_def[OF tt Net]\n    using dom by auto\n  with con1 fun show ?thesis by auto\nqed\n\ncorollary (in topology0) locT2_not_US_2:\n  assumes \"{m}\\<notin>T\" \"{m}{is closed in}T\" \"\\<exists>N\\<in>nat\\<rightarrow>\\<Union>T. (\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N m) \\<and> m\\<notin>N``nat\"\n  shows \"\\<not>((T\\<union>{(U-{m})\\<union>{\\<Union>T}\\<union>W. \\<langle>U,W\\<rangle>\\<in>{V\\<in>T. m\\<in>V}\\<times>T}){is US})\"\nproof-\n  have \"m\\<noteq>\\<Union>T\" using assms(2) mem_not_refl unfolding IsClosed_def by auto \n  then show ?thesis using locT2_not_US_1 assms unfolding IsUS_def by blast\nqed\n\ntext\\<open>In particular, we also know that a locally-$T_2$ space doesn't need to be KC;\nsince KC$\\Rightarrow$US. Also we know that anti-hyperconnected spaces don't need to be\nKC or US, since locally-$T_2\\Rightarrow$anti-hyperconnected.\\<close>\n\ntext\\<open>Let's find a KC space that is not $T_2$, an US space which is not KC\nand a $T_1$ space which is not US.\\<close>\n\ntext\\<open>First, let's prove some lemmas about what relation\nis there between this properties under the influence of other ones. This will\nhelp us to find counter-examples.\\<close>\n\ntext\\<open>Anti-compactness ereases the differences between several properties.\\<close>\n\nlemma (in topology0) anticompact_KC_equiv_T1:\n  assumes \"T{is anti-compact}\"\n  shows \"T{is KC}\\<longleftrightarrow>T{is T\\<^sub>1}\"\nproof\n  assume \"T{is KC}\"\n  then show \"T{is T\\<^sub>1}\" using KC_imp_T1 by auto\nnext\n  assume AS:\"T{is T\\<^sub>1}\"\n  {\n    fix A assume A:\"A{is compact in}T\" \"A\\<in>Pow(\\<Union>T)\"\n    then have \"A{is compact in}(T{restricted to}A)\" \"A\\<in>Pow(\\<Union>T)\" using compact_imp_compact_subspace\n      Compact_is_card_nat by auto\n    moreover then have \"\\<Union>(T{restricted to}A)=A\" unfolding RestrictedTo_def by auto\n    ultimately have \"(\\<Union>(T{restricted to}A)){is compact in}(T{restricted to}A)\" \"A\\<in>Pow(\\<Union>T)\" by auto\n    with assms have \"Finite(A)\" unfolding IsAntiComp_def antiProperty_def using compact_spectrum by auto\n    then obtain n where \"n\\<in>nat\" \"A\\<approx>n\" unfolding Finite_def by auto\n    then have \"A\\<prec>nat\" using eq_lesspoll_trans n_lesspoll_nat by auto moreover\n    have \"\\<Union>T-(\\<Union>T-A)=A\" using A(2) by auto\n    ultimately have \"\\<Union>T-(\\<Union>T-A)\\<prec>nat\" by auto\n    then have \"\\<Union>T-A\\<in>CoFinite \\<Union>T\" unfolding Cofinite_def CoCardinal_def by auto\n    then have \"\\<Union>T-A\\<in>T\" using AS T1_cocardinal_coarser by auto\n    with A(2) have \"A{is closed in}T\" unfolding IsClosed_def by auto\n  }\n  then show \"T{is KC}\" unfolding IsKC_def by auto\nqed\n\ntext\\<open>Then if we find an anti-compact and $T_1$ but no $T_2$ space,\nthere is a counter-example for $KC\\Rightarrow T_2$. A counter-example for US doesn't\nneed to be KC mustn't be anti-compact.\\<close>\n\ntext\\<open>The cocountable topology on \\<open>csucc(nat)\\<close> is such a topology.\\<close>\ntext\\<open>The cocountable topology on $\\mathbb{N}^+$ is hyperconnected.\\<close>\n\nlemma cocountable_in_csucc_nat_HConn:\n  shows \"(CoCountable csucc(nat)){is hyperconnected}\"\nproof-\n  {\n    fix U V assume as:\"U\\<in>(CoCountable csucc(nat))\"\"V\\<in>(CoCountable csucc(nat))\"\"U\\<inter>V=0\"\n    then have \"csucc(nat)-U\\<prec>csucc(nat)\\<or>U=0\"\"csucc(nat)-V\\<prec>csucc(nat)\\<or>V=0\"\n      unfolding Cocountable_def CoCardinal_def by auto\n    then have \"(csucc(nat)-U)\\<union>(csucc(nat)-V)\\<prec>csucc(nat)\\<or>U=0\\<or>V=0\" using less_less_imp_un_less[\n      OF _ _ InfCard_csucc[OF InfCard_nat]] by auto moreover\n    {\n      assume \"(csucc(nat)-U)\\<union>(csucc(nat)-V)\\<prec>csucc(nat)\" moreover\n      have \"(csucc(nat)-U)\\<union>(csucc(nat)-V)=csucc(nat)-U\\<inter>V\" by auto\n      with as(3) have \"(csucc(nat)-U)\\<union>(csucc(nat)-V)=csucc(nat)\" by auto\n      ultimately have \"csucc(nat)\\<prec>csucc(nat)\" by auto\n      then have \"False\" by auto\n    }\n    ultimately have \"U=0\\<or>V=0\" by auto\n  }\n  then show \"(CoCountable csucc(nat)){is hyperconnected}\" unfolding IsHConnected_def by auto\nqed\n\ntext\\<open>The cocountable topology on $\\mathbb{N}^+$ is not anti-hyperconnected.\\<close>\n\ncorollary cocountable_in_csucc_nat_notAntiHConn:\n  shows \"\\<not>((CoCountable csucc(nat)){is anti-}IsHConnected)\"\nproof\n  assume as:\"(CoCountable csucc(nat)){is anti-}IsHConnected\"\n  have \"(CoCountable csucc(nat)){is hyperconnected}\" using cocountable_in_csucc_nat_HConn by auto moreover\n  have \"csucc(nat)\\<noteq>0\" using Ord_0_lt_csucc[OF Ord_nat] by auto\n  then have uni:\"\\<Union>(CoCountable csucc(nat))=csucc(nat)\" using union_cocardinal unfolding Cocountable_def by auto\n  have \"\\<forall>A\\<in>(CoCountable csucc(nat)). A\\<subseteq>\\<Union>(CoCountable csucc(nat))\" by fast\n  with uni have \"\\<forall>A\\<in>(CoCountable csucc(nat)). A\\<subseteq>csucc(nat)\" by auto\n  then have \"\\<forall>A\\<in>(CoCountable csucc(nat)). csucc(nat)\\<inter>A=A\" by auto\n  ultimately have \"((CoCountable csucc(nat)){restricted to}csucc(nat)){is hyperconnected}\"\n    unfolding RestrictedTo_def by auto\n  with as have \"(csucc(nat)){is in the spectrum of}IsHConnected\" unfolding antiProperty_def\n    using uni by auto\n  then have \"csucc(nat)\\<lesssim>1\" using HConn_spectrum by auto\n  then have \"csucc(nat)\\<prec>nat\" using n_lesspoll_nat lesspoll_trans1 by auto\n  then show \"False\" using lt_csucc[OF Ord_nat] lt_Card_imp_lesspoll[OF Card_csucc[OF Ord_nat]]\n    lesspoll_trans by auto\nqed\n\ntext\\<open>The cocountable topology on $\\mathbb{N}^+$ is not $T_2$.\\<close>\n\ntheorem cocountable_in_csucc_nat_noT2:\n  shows \"\\<not>(CoCountable csucc(nat)){is T\\<^sub>2}\"\nproof\n  assume \"(CoCountable csucc(nat)){is T\\<^sub>2}\" \n  then have antiHC:\"(CoCountable csucc(nat)){is anti-}IsHConnected\" \n    using topology0.T2_imp_anti_HConn[OF topology0_CoCardinal[OF InfCard_csucc[OF InfCard_nat]]]\n    unfolding Cocountable_def by auto\n  then show \"False\" using cocountable_in_csucc_nat_notAntiHConn by auto\nqed\n    \ntext\\<open>The cocountable topology on $\\mathbb{N}^+$ is $T_1$.\\<close>\n\ntheorem cocountable_in_csucc_nat_T1:\n  shows \"(CoCountable csucc(nat)){is T\\<^sub>1}\"\n  using cocardinal_is_T1[OF InfCard_csucc[OF InfCard_nat]] unfolding Cocountable_def by auto\n    \ntext\\<open>The cocountable topology on $\\mathbb{N}^+$ is anti-compact.\\<close>\n\ntheorem cocountable_in_csucc_nat_antiCompact:\n  shows \"(CoCountable csucc(nat)){is anti-compact}\"\nproof-\n  have noE:\"csucc(nat)\\<noteq>0\" using Ord_0_lt_csucc[OF Ord_nat] by auto \n  {\n    fix A assume as:\"A\\<subseteq>\\<Union>(CoCountable csucc(nat))\" \"(\\<Union>((CoCountable csucc(nat)){restricted to}A)){is compact in}((CoCountable csucc(nat)){restricted to}A)\"\n    from as(1) have ass:\"A\\<subseteq>csucc(nat)\" using union_cocardinal[OF noE] unfolding Cocountable_def by auto\n    have \"((CoCountable csucc(nat)){restricted to}A)=CoCountable (A\\<inter>csucc(nat))\" using subspace_cocardinal\n      unfolding Cocountable_def by auto moreover\n    from ass have \"A\\<inter>csucc(nat)=A\" by auto\n    ultimately have \"((CoCountable csucc(nat)){restricted to}A)=CoCountable A\" by auto\n    with as(2) have comp:\"(\\<Union>(CoCountable A)){is compact in}(CoCountable A)\" by auto   \n    {\n      assume as2:\"A\\<prec>csucc(nat)\" moreover\n      {\n        fix t assume t:\"t\\<in>A\"\n        have \"A-{t}\\<subseteq>A\" by auto\n        then have \"A-{t}\\<lesssim>A\" using subset_imp_lepoll by auto\n        with as2 have \"A-{t}\\<prec>csucc(nat)\" using lesspoll_trans1 by auto moreover note noE\n        ultimately have \"(A-{t}){is closed in}(CoCountable A)\" using closed_sets_cocardinal[of \"csucc(nat)\"\n          \"A-{t}\"\"A\"] unfolding Cocountable_def by auto\n        then have \"A-(A-{t})\\<in>(CoCountable A)\" unfolding IsClosed_def using union_cocardinal[OF noE, of \"A\"]\n          unfolding Cocountable_def by auto moreover\n        from t have \"A-(A-{t})={t}\" by auto ultimately\n        have \"{t}\\<in>(CoCountable A)\" by auto\n      }\n      then have r:\"\\<forall>t\\<in>A. {t}\\<in>(CoCountable A)\" by auto\n      {\n        fix U assume U:\"U\\<in>Pow(A)\"\n        {\n          fix t assume \"t\\<in>U\"\n          with U r have \"t\\<in>{t}\"\"{t}\\<subseteq>U\"\"{t}\\<in>(CoCountable A)\" by auto\n          then have \"\\<exists>V\\<in>(CoCountable A). t\\<in>V \\<and> V\\<subseteq>U\" by auto\n        }\n        then have \"U\\<in>(CoCountable A)\" using topology0.open_neigh_open[OF topology0_CoCardinal[\n          OF InfCard_csucc[OF InfCard_nat]]] unfolding Cocountable_def by auto\n      }\n      then have \"Pow(A)\\<subseteq>(CoCountable A)\" by auto moreover\n      {\n        fix B assume \"B\\<in>(CoCountable A)\"\n        then have \"B\\<in>Pow(\\<Union>(CoCountable A))\" by auto\n        then have \"B\\<in>Pow(A)\" using union_cocardinal[OF noE] unfolding Cocountable_def by auto\n      }\n      ultimately have p:\"Pow(A)=(CoCountable A)\" by auto\n      then have \"(CoCountable A){is anti-compact}\" using pow_anti_compact[of \"A\"] by auto moreover\n      from p have \"\\<Union>(CoCountable A)=\\<Union>Pow(A)\" by auto\n      then have tot:\"\\<Union>(CoCountable A)=A\" by auto\n      from comp have \"(\\<Union>((CoCountable A){restricted to}(\\<Union>(CoCountable A)))){is compact in}((CoCountable A){restricted to}(\\<Union>(CoCountable A)))\" using compact_imp_compact_subspace\n        Compact_is_card_nat tot unfolding RestrictedTo_def by auto\n      ultimately have \"A{is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\"\n        using comp tot unfolding IsAntiComp_def antiProperty_def by auto\n    }\n    moreover\n    {\n      assume as1:\"\\<not>(A\\<prec>csucc(nat))\"\n      from ass have \"A\\<lesssim>csucc(nat)\" using subset_imp_lepoll by auto\n      with as1 have \"A\\<approx>csucc(nat)\" using lepoll_iff_leqpoll by auto\n      then have \"csucc(nat)\\<approx>A\" using eqpoll_sym by auto\n      then have \"nat\\<prec>A\" using lesspoll_eq_trans lt_csucc[OF Ord_nat]\n        lt_Card_imp_lesspoll[OF Card_csucc[OF Ord_nat]] by auto\n      then have \"nat\\<lesssim>A\" using lepoll_iff_leqpoll by auto\n      then obtain f where \"f\\<in>inj(nat,A)\" unfolding lepoll_def by auto moreover\n      then have fun:\"f:nat\\<rightarrow>A\" unfolding inj_def by auto\n      then have \"f\\<in>surj(nat,range(f))\" using fun_is_surj by auto\n      ultimately have \"f\\<in>bij(nat,range(f))\" unfolding bij_def inj_def surj_def by auto\n      then have \"nat\\<approx>range(f)\" unfolding eqpoll_def by auto\n      then have e:\"range(f)\\<approx>nat\" using eqpoll_sym by auto\n      then have as2:\"range(f)\\<prec>csucc(nat)\" using lt_Card_imp_lesspoll[OF Card_csucc[OF Ord_nat]]\n        lt_csucc[OF Ord_nat] eq_lesspoll_trans by auto\n      then have \"range(f){is closed in}(CoCountable A)\" using closed_sets_cocardinal[of \"csucc(nat)\"\n          \"range(f)\"\"A\"] unfolding Cocountable_def using func1_1_L5B[OF fun] noE by auto\n      then have \"(A\\<inter>range(f)){is compact in}(CoCountable A)\" using compact_closed union_cocardinal[OF noE, of \"A\"]\n        comp Compact_is_card_nat unfolding Cocountable_def by auto\n      moreover have int:\"A\\<inter>range(f)=range(f)\"\"range(f)\\<inter>A=range(f)\" using func1_1_L5B[OF fun] by auto\n      ultimately have \"range(f){is compact in}(CoCountable A)\" by auto\n      then have \"range(f){is compact in}((CoCountable A){restricted to}range(f))\" using compact_imp_compact_subspace\n        Compact_is_card_nat by auto\n      moreover have \"((CoCountable A){restricted to}range(f))=CoCountable (range(f)\\<inter>A)\"\n        using subspace_cocardinal unfolding Cocountable_def by auto\n      with int(2) have \"((CoCountable A){restricted to}range(f))=CoCountable range(f)\" by auto\n      ultimately have comp2:\"range(f){is compact in}(CoCountable range(f))\" by auto\n      {\n        fix t assume t:\"t\\<in>range(f)\"\n        have \"range(f)-{t}\\<subseteq>range(f)\" by auto\n        then have \"range(f)-{t}\\<lesssim>range(f)\" using subset_imp_lepoll by auto\n        with as2 have \"range(f)-{t}\\<prec>csucc(nat)\" using lesspoll_trans1 by auto moreover note noE\n        ultimately have \"(range(f)-{t}){is closed in}(CoCountable range(f))\" using closed_sets_cocardinal[of \"csucc(nat)\"\n          \"range(f)-{t}\"\"range(f)\"] unfolding Cocountable_def by auto\n        then have \"range(f)-(range(f)-{t})\\<in>(CoCountable range(f))\" unfolding IsClosed_def using union_cocardinal[OF noE, of \"range(f)\"]\n          unfolding Cocountable_def by auto moreover\n        from t have \"range(f)-(range(f)-{t})={t}\" by auto ultimately\n        have \"{t}\\<in>(CoCountable range(f))\" by auto\n      }\n      then have r:\"\\<forall>t\\<in>range(f). {t}\\<in>(CoCountable range(f))\" by auto\n      {\n        fix U assume U:\"U\\<in>Pow(range(f))\"\n        {\n          fix t assume \"t\\<in>U\"\n          with U r have \"t\\<in>{t}\"\"{t}\\<subseteq>U\"\"{t}\\<in>(CoCountable range(f))\" by auto\n          then have \"\\<exists>V\\<in>(CoCountable range(f)). t\\<in>V \\<and> V\\<subseteq>U\" by auto\n        }\n        then have \"U\\<in>(CoCountable range(f))\" using topology0.open_neigh_open[OF topology0_CoCardinal[\n          OF InfCard_csucc[OF InfCard_nat]]] unfolding Cocountable_def by auto\n      }\n      then have \"Pow(range(f))\\<subseteq>(CoCountable range(f))\" by auto moreover\n      {\n        fix B assume \"B\\<in>(CoCountable range(f))\"\n        then have \"B\\<in>Pow(\\<Union>(CoCountable range(f)))\" by auto\n        then have \"B\\<in>Pow(range(f))\" using union_cocardinal[OF noE] unfolding Cocountable_def by auto\n      }\n      ultimately have p:\"Pow(range(f))=(CoCountable range(f))\" by blast\n      then have \"(CoCountable range(f)){is anti-compact}\" using pow_anti_compact[of \"range(f)\"] by auto moreover\n      from p have \"\\<Union>(CoCountable range(f))=\\<Union>Pow(range(f))\" by auto\n      then have tot:\"\\<Union>(CoCountable range(f))=range(f)\" by auto\n      from comp2 have \"(\\<Union>((CoCountable range(f)){restricted to}(\\<Union>(CoCountable range(f))))){is compact in}((CoCountable range(f)){restricted to}(\\<Union>(CoCountable range(f))))\" using compact_imp_compact_subspace\n        Compact_is_card_nat tot unfolding RestrictedTo_def by auto\n      ultimately have \"range(f){is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\"\n        using comp tot unfolding IsAntiComp_def antiProperty_def by auto\n      then have \"Finite(range(f))\" using compact_spectrum by auto\n      then have \"Finite(nat)\" using e eqpoll_imp_Finite_iff by auto\n      then have \"False\" using nat_not_Finite by auto\n    }\n    ultimately have \"A{is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" by auto\n  }\n  then have \"\\<forall>A\\<in>Pow(\\<Union>(CoCountable csucc(nat))). ((\\<Union>((CoCountable csucc(nat)) {restricted to} A)) {is compact in} ((CoCountable csucc(nat)) {restricted to} A))\n    \\<longrightarrow> (A{is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T))\" by auto\n  then show ?thesis unfolding IsAntiComp_def antiProperty_def by auto\nqed\n\ntext\\<open>In conclusion, the cocountable topology defined on \\<open>csucc(nat)\\<close>\nis KC but not $T_2$. Also note that is KC but not anti-hyperconnected, hence KC or US\nspaces need not to be sober.\\<close>\n\ntext\\<open>The cofinite topology on the natural numbers is $T_1$, but\nnot US.\\<close>\n\ntheorem cofinite_not_US:\n  shows \"\\<not>((CoFinite nat){is US})\"\nproof\n  assume A:\"(CoFinite nat){is US}\"\n  let ?N=\"id(nat)\"\n  have f:\"?N:nat\\<rightarrow>nat\" using id_type by auto\n  then have fun:\"?N:nat\\<rightarrow>\\<Union>(CoCardinal(nat,nat))\" using union_cocardinal unfolding Cofinite_def by auto\n  then have dom:\"domain(?N)=nat\" using func1_1_L1 by auto\n  with fun have NET:\"\\<langle>?N,Le\\<rangle>{is a net on}\\<Union>(CoCardinal(nat,nat))\" unfolding IsNet_def\n    using Le_directs_nat by auto\n  have tot:\"\\<Union>(CoCardinal(nat,nat))=nat\" using union_cocardinal by auto\n  {\n    fix U n assume U:\"U\\<in>Pow(\\<Union>(CoFinite nat))\" \"n\\<in>Interior(U,(CoFinite nat))\"\n    have \"Interior(U,(CoFinite nat))\\<in>(CoFinite nat)\" using topology0.Top_2_L2\n      topology0_CoCardinal[OF InfCard_nat] unfolding Cofinite_def by auto\n    then have \"nat-Interior(U,(CoFinite nat))\\<prec>nat\" using U(2) unfolding Cofinite_def\n      CoCardinal_def by auto\n    then have \"Finite(nat-Interior(U,(CoFinite nat)))\" using lesspoll_nat_is_Finite by auto moreover\n    have \"nat-U\\<subseteq>nat-Interior(U,(CoFinite nat))\" using topology0.Top_2_L1\n      topology0_CoCardinal[OF InfCard_nat] unfolding Cofinite_def by auto\n    ultimately have fin:\"Finite(nat-U)\" using subset_Finite by auto\n    moreover have lin:\"IsLinOrder(nat,Le)\" using Le_directs_nat(1) by auto\n    then have \"IsLinOrder(nat-U,Le)\" using ord_linear_subset[of \"nat\" \"Le\" \"nat-U\"] by auto\n    ultimately have r:\"nat-U=0 \\<or> (\\<forall>r\\<in>nat-U. \\<langle>r,Maximum(Le,nat-U)\\<rangle>\\<in>Le)\" using linord_max_props(3)[of \"nat-U\"\"Le\"\"nat-U\"]\n      unfolding FinPow_def by auto\n    {\n      assume reg:\"\\<forall>s\\<in>nat. \\<exists>r\\<in>nat. \\<langle>s,r\\<rangle>\\<in>Le \\<and> ?N`r\\<notin>U\"\n      with r have s:\"(\\<forall>r\\<in>nat-U. \\<langle>r,Maximum(Le,nat-U)\\<rangle>\\<in>Le)\" \"nat-U\\<noteq>0\" using apply_type[OF f] by auto\n      have \"Maximum(Le,nat-U)\\<in>nat\" using linord_max_props(2)[OF lin _ s(2)] fin\n        unfolding FinPow_def by auto\n      then have \"succ(Maximum(Le,nat-U))\\<in>nat\" using nat_succI by auto\n      with reg have \"\\<exists>r\\<in>nat. \\<langle>succ(Maximum(Le,nat-U)),r\\<rangle>\\<in>Le \\<and> ?N`r\\<notin>U\" by auto\n      then obtain r where r_def:\"r\\<in>nat\" \"\\<langle>succ(Maximum(Le,nat-U)),r\\<rangle>\\<in>Le\" \"?N`r\\<notin>U\" by auto\n      from r_def(1,3) have \"?N`r\\<in>nat-U\" using apply_type[OF f] by auto\n      with s(1) have \"\\<langle>?N`r,Maximum(Le,nat-U)\\<rangle>\\<in>Le\" by auto\n      then have \"\\<langle>r,Maximum(Le,nat-U)\\<rangle>\\<in>Le\" using id_conv r_def(1) by auto\n      then have \"r<succ(Maximum(Le,nat-U))\" by auto\n      with r_def(2) have \"r<r\" using lt_trans2 by auto\n      then have \"False\" by auto\n    }\n    then have \"\\<exists>s\\<in>nat. \\<forall>r\\<in>nat. \\<langle>s,r\\<rangle>\\<in>Le \\<longrightarrow> ?N`r\\<in>U\" by auto\n  }\n  then have \"\\<forall>n\\<in>nat. \\<forall>U\\<in>Pow(\\<Union>(CoFinite nat)). n\\<in>Interior(U,CoFinite nat) \\<longrightarrow> (\\<exists>s\\<in>nat. \\<forall>r\\<in>nat. \\<langle>s,r\\<rangle>\\<in>Le \\<longrightarrow> ?N`r\\<in>U)\" by auto\n  with tot have \"\\<forall>n\\<in>\\<Union>(CoCardinal(nat,nat)). \\<forall>U\\<in>Pow(\\<Union>(CoCardinal(nat,nat))). n\\<in>Interior(U,CoCardinal(nat,nat)) \\<longrightarrow> (\\<exists>s\\<in>nat. \\<forall>r\\<in>nat. \\<langle>s,r\\<rangle>\\<in>Le \\<longrightarrow> ?N`r\\<in>U)\"\n    unfolding Cofinite_def by auto\n  then have \"\\<forall>n\\<in>\\<Union>(CoCardinal(nat,nat)). (\\<langle>?N,Le\\<rangle>\\<rightarrow>\\<^sub>N n {in}(CoCardinal(nat,nat)))\" unfolding topology0.NetConverges_def[OF topology0_CoCardinal[OF InfCard_nat] NET]\n    using dom by auto\n  with tot have \"\\<forall>n\\<in>nat. (\\<langle>?N,Le\\<rangle>\\<rightarrow>\\<^sub>N n {in}(CoFinite nat))\" unfolding Cofinite_def by auto\n  then have \"(\\<langle>?N,Le\\<rangle>\\<rightarrow>\\<^sub>N 0 {in}(CoFinite nat)) \\<and> (\\<langle>?N,Le\\<rangle>\\<rightarrow>\\<^sub>N 1 {in}(CoFinite nat)) \\<and> 0\\<noteq>1\" by auto\n  then show \"False\" using A unfolding IsUS_def using fun unfolding Cofinite_def by auto\nqed\n\ntext\\<open>To end, we need a space which is US but no KC. This example\ncomes from the one point compactification of a $T_2$, anti-compact\nand non discrete space. This $T_2$, anti-compact and non discrete space\ncomes from a construction over the cardinal $\\mathbb{N}^+$ or \\<open>csucc(nat)\\<close>.\\<close>\n\ntheorem extension_pow_top:\n  shows \"(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){is a topology}\"\nproof-\n  have noE:\"csucc(nat)\\<noteq>0\" using Ord_0_lt_csucc[OF Ord_nat] by auto \n  {\n    fix M assume M:\"M\\<subseteq>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n    let ?MP=\"{U\\<in>M. U\\<in>Pow(csucc(nat))}\"\n    let ?MN=\"{U\\<in>M. U\\<notin>Pow(csucc(nat))}\"\n    have unM:\"\\<Union>M=(\\<Union>?MP)\\<union>(\\<Union>?MN)\" by auto\n    have \"csucc(nat)\\<notin>csucc(nat)\" using mem_not_refl by auto\n    with M have MN:\"?MN={U\\<in>M. U\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}}\" by auto\n    have unMP:\"\\<Union>?MP\\<in>Pow(csucc(nat))\" by auto\n    then have \"?MN=0\\<longrightarrow>\\<Union>M\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n      using unM by auto moreover\n    {\n      assume \"?MN\\<noteq>0\"\n      with MN have \"{U\\<in>M. U\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}}\\<noteq>0\" by auto\n      then obtain U where U:\"U\\<in>M\" \"U\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" by blast\n      then obtain S where S:\"U={csucc(nat)}\\<union>S\" \"S\\<in>(CoCountable csucc(nat))-{0}\" by auto\n      with U MN have \"csucc(nat)\\<in>U\" \"U\\<in>?MN\" by auto\n      then have a1:\"csucc(nat)\\<in>\\<Union>?MN\" by auto\n      let ?SC=\"{S\\<in>(CoCountable csucc(nat)). {csucc(nat)}\\<union>S\\<in>M}\"\n      have unSC:\"\\<Union>?SC\\<in>(CoCountable csucc(nat))\" using CoCar_is_topology[OF InfCard_csucc[OF InfCard_nat]]\n        unfolding IsATopology_def unfolding Cocountable_def by blast\n      {\n        fix s assume \"s\\<in>{csucc(nat)}\\<union>\\<Union>?SC\"\n        then have \"s=csucc(nat)\\<or>s\\<in>\\<Union>?SC\" by auto\n        then have \"s\\<in>\\<Union>?MN\\<or>(\\<exists>S\\<in>?SC. s\\<in>S)\" using a1 by auto\n        then have \"s\\<in>\\<Union>?MN\\<or>(\\<exists>S\\<in>(CoCountable csucc(nat)). {csucc(nat)}\\<union>S\\<in>M \\<and> s\\<in>S)\" by auto\n        with MN have \"s\\<in>\\<Union>?MN\\<or>(\\<exists>S\\<in>(CoCountable csucc(nat)). {csucc(nat)}\\<union>S\\<in>?MN \\<and> s\\<in>S)\" by auto\n        then have \"s\\<in>\\<Union>?MN\" by blast\n      }\n      then have \"{csucc(nat)}\\<union>\\<Union>?SC\\<subseteq>\\<Union>?MN\" by blast\n      moreover\n      {\n        fix s assume \"s\\<in>\\<Union>?MN\"\n        then obtain U where U:\"s\\<in>U\" \"U\\<in>M\" \"U\\<notin>Pow(csucc(nat))\" by auto\n        with M have \"U\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))}\" by auto\n        then obtain S where S:\"U={csucc(nat)}\\<union>S\" \"S\\<in>(CoCountable csucc(nat))\" by auto\n        with U(1) have \"s=csucc(nat)\\<or>s\\<in>S\" by auto\n        with S U(2) have \"s=csucc(nat)\\<or>s\\<in>\\<Union>?SC\" by auto\n        then have \"s\\<in>{csucc(nat)}\\<union>\\<Union>?SC\" by auto\n      }\n      then have \"\\<Union>?MN\\<subseteq>{csucc(nat)}\\<union>\\<Union>?SC\" by blast\n      ultimately have unMN:\"\\<Union>?MN={csucc(nat)}\\<union>\\<Union>?SC\" by auto\n      from unSC have b1:\"csucc(nat)-\\<Union>?SC\\<prec>csucc(nat)\\<or>\\<Union>?SC=0\" unfolding Cocountable_def CoCardinal_def\n        by auto\n      {\n        assume \"0\\<in>?SC\"\n        then have \"{csucc(nat)}\\<in>M\" by auto\n        then have \"{csucc(nat)}\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" using mem_not_refl\n          M by auto\n        then obtain S where S:\"S\\<in>(CoCountable csucc(nat))-{0}\" \"{csucc(nat)}={csucc(nat)}\\<union>S\" by auto\n        {\n          fix x assume \"x\\<in>S\"\n          then have \"x\\<in>{csucc(nat)}\\<union>S\" by auto\n          with S(2) have \"x\\<in>{csucc(nat)}\" by auto\n          then have \"x=csucc(nat)\" by auto\n        }\n        then have \"S\\<subseteq>{csucc(nat)}\" by auto\n        with S(1) have \"S={csucc(nat)}\" by auto\n        with S(1) have \"csucc(nat)-{csucc(nat)}\\<prec>csucc(nat)\" unfolding Cocountable_def CoCardinal_def\n          by auto moreover\n        then have \"csucc(nat)-{csucc(nat)}=csucc(nat)\" using mem_not_refl[of \"csucc(nat)\"] by force\n        ultimately have \"False\" by auto\n      }\n      then have \"0\\<notin>?SC\" by auto moreover\n      from S U(1) have \"S\\<in>?SC\" by auto\n      ultimately have \"S\\<subseteq>\\<Union>?SC\" \"S\\<noteq>0\" by auto\n      then have noe:\"\\<Union>?SC\\<noteq>0\" by auto\n      with b1 have \"csucc(nat)-\\<Union>?SC\\<prec>csucc(nat)\" by auto\n      moreover have \"csucc(nat)-(\\<Union>?SC \\<union> \\<Union>?MP)\\<subseteq>csucc(nat)-\\<Union>?SC\" by auto\n      then have \"csucc(nat)-(\\<Union>?SC \\<union> \\<Union>?MP)\\<lesssim>csucc(nat)-\\<Union>?SC\" using subset_imp_lepoll by auto\n      ultimately have \"csucc(nat)-(\\<Union>?SC \\<union> \\<Union>?MP)\\<prec>csucc(nat)\" using lesspoll_trans1 by auto moreover\n      have \"\\<Union>?SC\\<subseteq>\\<Union>(CoCountable csucc(nat))\" using unSC by auto\n      then have \"\\<Union>?SC\\<subseteq>csucc(nat)\" using union_cocardinal[OF noE] unfolding Cocountable_def by auto\n      ultimately have \"(\\<Union>?SC \\<union> \\<Union>?MP)\\<in>(CoCountable csucc(nat))\"\n        using unMP unfolding Cocountable_def CoCardinal_def by auto\n      then have \"{csucc(nat)}\\<union>(\\<Union>?SC \\<union> \\<Union>?MP)\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n        using noe by auto moreover\n      from unM unMN have \"\\<Union>M=({csucc(nat)}\\<union>\\<Union>?SC) \\<union> \\<Union>?MP\" by auto\n      then have \"\\<Union>M={csucc(nat)}\\<union>(\\<Union>?SC \\<union> \\<Union>?MP)\" by auto\n      ultimately have \"\\<Union>M\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n    }\n    ultimately have \"\\<Union>M\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n  }\n  then have \"\\<forall>M\\<in>Pow(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}). \\<Union>M\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n  moreover\n  {\n    fix U V assume UV:\"U\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" \"V\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n    {\n      assume \"csucc(nat)\\<notin>U\\<or>csucc(nat)\\<notin>V\"\n      with UV have \"U\\<in>Pow(csucc(nat))\\<or>V\\<in>Pow(csucc(nat))\" by auto\n      then have \"U\\<inter>V\\<in>Pow(csucc(nat))\" by auto\n      then have \"U\\<inter>V\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n    }\n    moreover\n    {\n      assume \"csucc(nat)\\<in>U\\<and>csucc(nat)\\<in>V\"\n      then obtain SU SV where S:\"U={csucc(nat)}\\<union>SU\" \"V={csucc(nat)}\\<union>SV\" \"SU\\<in>(CoCountable csucc(nat))-{0}\"\n        \"SV\\<in>(CoCountable csucc(nat))-{0}\" using UV mem_not_refl by auto\n      from S(1,2) have \"U\\<inter>V={csucc(nat)}\\<union>(SU\\<inter>SV)\" by auto moreover\n      from S(3,4) have \"SU\\<inter>SV\\<in>(CoCountable csucc(nat))\" using CoCar_is_topology[OF InfCard_csucc[OF InfCard_nat]] unfolding IsATopology_def\n        unfolding Cocountable_def by blast moreover\n      from S(3,4) have \"SU\\<inter>SV\\<noteq>0\" using cocountable_in_csucc_nat_HConn unfolding IsHConnected_def\n        by auto ultimately\n      have \"U\\<inter>V\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" by auto\n      then have \"U\\<inter>V\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n    }\n    ultimately have \"U\\<inter>V\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n  }\n  then have \"\\<forall>U\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}). \\<forall>V\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}). U\\<inter>V\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n  ultimately show ?thesis unfolding IsATopology_def by auto\nqed\n\ntext\\<open>This topology is defined over $\\mathbb{N}^+\\cup\\{\\mathbb{N}^+\\}$ or \\<open>csucc(nat)\\<union>{csucc(nat)}\\<close>.\\<close>\n\nlemma extension_pow_union:\n  shows \"\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})=csucc(nat)\\<union>{csucc(nat)}\"\nproof\n  have noE:\"csucc(nat)\\<noteq>0\" using Ord_0_lt_csucc[OF Ord_nat] by auto \n  have \"\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})=\\<Union>(Pow(csucc(nat))) \\<union> (\\<Union>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n    by blast\n  also have \"\\<dots>=csucc(nat) \\<union> (\\<Union>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n  ultimately have A:\"\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})=csucc(nat) \\<union> (\\<Union>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n  have \"\\<Union>(CoCountable csucc(nat))\\<in>(CoCountable csucc(nat))\" using CoCar_is_topology[OF InfCard_csucc[OF InfCard_nat]]\n    unfolding IsATopology_def Cocountable_def by auto\n  then have \"csucc(nat)\\<in>(CoCountable csucc(nat))\" using union_cocardinal[OF noE] unfolding Cocountable_def\n    by auto\n  with noE have \"csucc(nat)\\<in>(CoCountable csucc(nat))-{0}\" by auto\n  then have \"{csucc(nat)}\\<union>csucc(nat)\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" by auto\n  then have \"{csucc(nat)}\\<union>csucc(nat)\\<subseteq>\\<Union>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" by blast\n  with A show \"csucc(nat)\\<union>{csucc(nat)}\\<subseteq>\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n    by auto\n  {\n    fix x assume x:\"x\\<in>(\\<Union>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" \"x\\<noteq>csucc(nat)\"\n    then obtain U where U:\"U\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" \"x\\<in>U\" by blast\n    then obtain S where S:\"U={csucc(nat)}\\<union>S\" \"S\\<in>(CoCountable csucc(nat))-{0}\" by auto\n    with U(2) x(2) have \"x\\<in>S\" by auto\n    with S(2) have \"x\\<in>\\<Union>(CoCountable csucc(nat))\" by auto\n    then have \"x\\<in>csucc(nat)\" using union_cocardinal[OF noE] unfolding Cocountable_def by auto\n  }\n  then have \"(\\<Union>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\\<subseteq>csucc(nat) \\<union>{csucc(nat)}\" by blast\n  with A show \"\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\\<subseteq>csucc(nat)\\<union>{csucc(nat)}\"\n    by blast\nqed\n\ntext\\<open>This topology has a discrete open subspace.\\<close>\n\nlemma extension_pow_subspace:\n  shows \"(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat)=Pow(csucc(nat))\"\n  and \"csucc(nat)\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\nproof\n  show \"csucc(nat)\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n  {\n    fix x assume \"x\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat)\"\n    then obtain R where \"x=csucc(nat)\\<inter>R\" \"R\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" unfolding RestrictedTo_def\n      by auto\n    then have \"x\\<in>Pow(csucc(nat))\" by auto\n  }\n  then show \"(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat)\\<subseteq>Pow(csucc(nat))\" by auto\n  {\n    fix x assume x:\"x\\<in>Pow(csucc(nat))\"\n    then have \"x=csucc(nat)\\<inter>x\" by auto\n    with x have \"x\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat)\"\n      unfolding RestrictedTo_def by auto\n  }\n  then show \"Pow(csucc(nat))\\<subseteq>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat)\" by auto\nqed\n\ntext\\<open>This topology is Hausdorff.\\<close>\n\ntheorem extension_pow_T2:\n  shows \"(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){is T\\<^sub>2}\"\nproof-\n  have noE:\"csucc(nat)\\<noteq>0\" using Ord_0_lt_csucc[OF Ord_nat] by auto \n  {\n    fix A B assume \"A\\<in>\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n      \"B\\<in>\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" \"A\\<noteq>B\"\n    then have AB:\"A\\<in>csucc(nat)\\<union>{csucc(nat)}\" \"B\\<in>csucc(nat)\\<union>{csucc(nat)}\" \"A\\<noteq>B\" using extension_pow_union by auto\n    {\n      assume \"A\\<noteq>csucc(nat)\" \"B\\<noteq>csucc(nat)\"\n      then have \"A\\<in>csucc(nat)\" \"B\\<in>csucc(nat)\" using AB by auto\n      then have sub:\"{A}\\<in>Pow(csucc(nat))\" \"{B}\\<in>Pow(csucc(nat))\" by auto\n      then have \"{A}\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat)\" \n        \"{B}\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat)\" using extension_pow_subspace(1)\n        by auto \n      then obtain RA RB where \"{A}=csucc(nat)\\<inter>RA\" \"{B}=csucc(nat)\\<inter>RB\" \"RA\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n        \"RB\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" unfolding RestrictedTo_def by auto\n      then have \"{A}\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" \"{B}\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n        using extension_pow_subspace(2) extension_pow_top unfolding IsATopology_def by auto\n      moreover\n      from AB(3) have \"{A}\\<inter>{B}=0\" by auto ultimately\n      have \"\\<exists>U\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}). \\<exists>V\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}). A\\<in>U\\<and>B\\<in>V\\<and>U\\<inter>V=0\" by auto\n    }\n    moreover\n    {\n      assume \"A=csucc(nat)\\<or>B=csucc(nat)\"\n      with AB(3) have disj:\"(A=csucc(nat)\\<and>B\\<noteq>csucc(nat))\\<or>(B=csucc(nat)\\<and>A\\<noteq>csucc(nat))\" by auto\n      {\n        assume ass:\"A=csucc(nat)\\<and>B\\<noteq>csucc(nat)\" \n        then have p:\"B\\<in>csucc(nat)\" using AB(2) by auto\n        have \"{B}\\<approx>1\" using singleton_eqpoll_1 by auto\n        then have \"{B}\\<prec>nat\" using eq_lesspoll_trans n_lesspoll_nat by auto\n        then have \"{B}\\<lesssim>nat\" using lesspoll_imp_lepoll by auto\n        then have \"{B}\\<prec>csucc(nat)\" using Card_less_csucc_eq_le[OF Card_nat] by auto\n        with p have \"{B}{is closed in}(CoCountable csucc(nat))\" unfolding Cocountable_def\n          using closed_sets_cocardinal[OF noE] by auto\n        then have \"csucc(nat)-{B}\\<in>(CoCountable csucc(nat))\" unfolding IsClosed_def\n          Cocountable_def using union_cocardinal[OF noE] by auto moreover\n        {\n          assume \"csucc(nat)-{B}=0\"\n          with p have \"csucc(nat)={B}\" by auto\n          then have \"csucc(nat)\\<approx>1\" using singleton_eqpoll_1 by auto\n          then have \"csucc(nat)\\<lesssim>nat\" using eq_lesspoll_trans n_lesspoll_nat lesspoll_imp_lepoll by auto\n          then have \"csucc(nat)\\<prec>csucc(nat)\" using Card_less_csucc_eq_le[OF Card_nat] by auto\n          then have \"False\" by auto\n        }\n        ultimately\n        have \"{csucc(nat)}\\<union>(csucc(nat)-{B})\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" by auto\n        then have U1:\"{csucc(nat)}\\<union>(csucc(nat)-{B})\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n        have \"{B}\\<in>Pow(csucc(nat))\" using p by auto\n        then have \"{B}\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat)\"\n          using extension_pow_subspace(1) by auto\n        then obtain R where \"R\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" \"{B}=csucc(nat)\\<inter>R\"\n          unfolding RestrictedTo_def by auto\n        then have U2:\"{B}\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" using extension_pow_subspace(2)\n          extension_pow_top unfolding IsATopology_def by auto\n        have \"({csucc(nat)}\\<union>(csucc(nat)-{B}))\\<inter>{B}=0\" using p mem_not_refl[of \"csucc(nat)\"] by auto\n        with U1 U2 have \"\\<exists>U\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}. \\<exists>V\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}.\n          A\\<in>U\\<and>B\\<in>V\\<and>U\\<inter>V=0\" using ass(1) by auto\n      }\n      moreover\n      {\n        assume \"\\<not>(A=csucc(nat)\\<and>B\\<noteq>csucc(nat))\" \n        then have ass:\"B = csucc(nat) \\<and> A \\<noteq> csucc(nat)\" using disj by auto\n        then have p:\"A\\<in>csucc(nat)\" using AB(1) by auto\n        have \"{A}\\<approx>1\" using singleton_eqpoll_1 by auto\n        then have \"{A}\\<prec>nat\" using eq_lesspoll_trans n_lesspoll_nat by auto\n        then have \"{A}\\<lesssim>nat\" using lesspoll_imp_lepoll by auto\n        then have \"{A}\\<prec>csucc(nat)\" using Card_less_csucc_eq_le[OF Card_nat] by auto\n        with p have \"{A}{is closed in}(CoCountable csucc(nat))\" unfolding Cocountable_def\n          using closed_sets_cocardinal[OF noE] by auto\n        then have \"csucc(nat)-{A}\\<in>(CoCountable csucc(nat))\" unfolding IsClosed_def\n          Cocountable_def using union_cocardinal[OF noE] by auto moreover\n        {\n          assume \"csucc(nat)-{A}=0\"\n          with p have \"csucc(nat)={A}\" by auto\n          then have \"csucc(nat)\\<approx>1\" using singleton_eqpoll_1 by auto\n          then have \"csucc(nat)\\<lesssim>nat\" using eq_lesspoll_trans n_lesspoll_nat lesspoll_imp_lepoll by auto\n          then have \"csucc(nat)\\<prec>csucc(nat)\" using Card_less_csucc_eq_le[OF Card_nat] by auto\n          then have \"False\" by auto\n        }\n        ultimately\n        have \"{csucc(nat)}\\<union>(csucc(nat)-{A})\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" by auto\n        then have U1:\"{csucc(nat)}\\<union>(csucc(nat)-{A})\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n        have \"{A}\\<in>Pow(csucc(nat))\" using p by auto\n        then have \"{A}\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat)\"\n          using extension_pow_subspace(1) by auto\n        then obtain R where \"R\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" \"{A}=csucc(nat)\\<inter>R\"\n          unfolding RestrictedTo_def by auto\n        then have U2:\"{A}\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" using extension_pow_subspace(2)\n          extension_pow_top unfolding IsATopology_def by auto\n        have int:\"{A}\\<inter>({csucc(nat)}\\<union>(csucc(nat)-{A}))=0\" using p mem_not_refl[of \"csucc(nat)\"] by auto\n        have \"A\\<in>{A}\" \"csucc(nat)\\<in>({csucc(nat)}\\<union>(csucc(nat)-{A}))\" by auto\n        with int U1 have \"\\<exists>V\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}.\n          A\\<in>{A}\\<and>csucc(nat)\\<in>V\\<and>{A}\\<inter>V=0\" by auto\n        with U2 have \"\\<exists>U\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}. \\<exists>V\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}.\n          A\\<in>U\\<and>csucc(nat)\\<in>V\\<and>U\\<inter>V=0\" using exI[where P=\"\\<lambda>U. U\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\\<and>(\\<exists>V\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}.\n          A\\<in>U\\<and>csucc(nat)\\<in>V\\<and>U\\<inter>V=0)\" and x=\"{A}\"] unfolding Bex_def by auto\n        then have \"\\<exists>U\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}. \\<exists>V\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}.\n          A\\<in>U\\<and>B\\<in>V\\<and>U\\<inter>V=0\" using ass by auto\n      } \n      ultimately have \"\\<exists>U\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}. \\<exists>V\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}.\n          A\\<in>U\\<and>B\\<in>V\\<and>U\\<inter>V=0\" by auto\n    }\n    ultimately have \"\\<exists>U\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}. \\<exists>V\\<in>Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}.\n          A\\<in>U\\<and>B\\<in>V\\<and>U\\<inter>V=0\" by auto\n  }\n  then show ?thesis unfolding isT2_def by auto\nqed\n\ntext\\<open>The topology we built is not discrete; i.e., not every set is open.\\<close>\n\ntheorem extension_pow_notDiscrete:\n  shows \"{csucc(nat)}\\<notin>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\nproof\n  assume \"{csucc(nat)}\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n  then have \"{csucc(nat)}\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" using mem_not_refl by auto\n  then obtain S where S:\"S\\<in>(CoCountable csucc(nat))-{0}\" \"{csucc(nat)}={csucc(nat)}\\<union>S\" by auto\n  {\n    fix x assume \"x\\<in>S\"\n    then have \"x\\<in>{csucc(nat)}\\<union>S\" by auto\n    with S(2) have \"x\\<in>{csucc(nat)}\" by auto\n    then have \"x=csucc(nat)\" by auto\n  }\n  then have \"S\\<subseteq>{csucc(nat)}\" by auto\n  with S(1) have \"S={csucc(nat)}\" by auto\n  with S(1) have \"csucc(nat)-{csucc(nat)}\\<prec>csucc(nat)\" unfolding Cocountable_def CoCardinal_def\n    by auto moreover\n  then have \"csucc(nat)-{csucc(nat)}=csucc(nat)\" using mem_not_refl[of \"csucc(nat)\"] by force\n  ultimately show \"False\" by auto\nqed\n\ntext\\<open>The topology we built is anti-compact.\\<close>\n\ntheorem extension_pow_antiCompact:\n  shows \"(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){is anti-compact}\"\nproof-\n  have noE:\"csucc(nat)\\<noteq>0\" using Ord_0_lt_csucc[OF Ord_nat] by auto \n  {\n    fix K assume K:\"K\\<subseteq>\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" \n      \"(\\<Union>((Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}K)){is compact in}((Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}K)\"\n    from K(1) have sub:\"K\\<subseteq>csucc(nat) \\<union>{csucc(nat)}\" using extension_pow_union by auto\n    have \"(\\<Union>((Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}K))=(csucc(nat) \\<union>{csucc(nat)})\\<inter>K\"\n      using extension_pow_union unfolding RestrictedTo_def by auto moreover\n    from sub have \"(csucc(nat) \\<union>{csucc(nat)})\\<inter>K=K\" by auto\n    ultimately have \"(\\<Union>((Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}K))=K\" by auto\n    with K(2) have \"K{is compact in}((Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}K)\" by auto\n    then have comp:\"K{is compact in}(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" using \n      compact_subspace_imp_compact by auto\n    {\n      assume ss:\"K\\<subseteq>csucc(nat)\"\n      then have \"K{is compact in}((Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat))\"\n        using compact_imp_compact_subspace comp Compact_is_card_nat by auto\n      then have \"K{is compact in}Pow(csucc(nat))\" using extension_pow_subspace(1) by auto\n      then have \"K{is compact in}(Pow(csucc(nat)){restricted to}K)\" using compact_imp_compact_subspace\n        Compact_is_card_nat by auto moreover\n      have \"\\<Union>(Pow(csucc(nat)){restricted to}K)=K\" using ss unfolding RestrictedTo_def by auto\n      ultimately have \"(\\<Union>(Pow(csucc(nat)){restricted to}K)){is compact in}(Pow(csucc(nat)){restricted to}K)\" by auto\n      then have \"K{is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" using pow_anti_compact \n        unfolding IsAntiComp_def antiProperty_def using ss by auto\n    }\n    moreover\n    {\n      assume \"\\<not>(K\\<subseteq>csucc(nat))\"\n      with sub have \"csucc(nat)\\<in>K\" by auto\n      with sub have ss:\"K-{csucc(nat)}\\<subseteq>csucc(nat)\" by auto\n      {\n        assume prec:\"K-{csucc(nat)}\\<prec>csucc(nat)\"\n        then have \"(K-{csucc(nat)}){is closed in}(CoCountable csucc(nat))\"\n          using closed_sets_cocardinal[OF noE] ss unfolding Cocountable_def by auto\n        then have \"csucc(nat)-(K-{csucc(nat)})\\<in>(CoCountable csucc(nat))\" unfolding IsClosed_def\n          Cocountable_def using union_cocardinal[OF noE] by auto moreover\n        {\n          assume \"csucc(nat)-(K-{csucc(nat)})=0\"\n          with ss have \"csucc(nat)=(K-{csucc(nat)})\" by auto\n          with prec have \"False\" by auto\n        }\n        ultimately have \"{csucc(nat)} \\<union>(csucc(nat)-(K-{csucc(nat)}))\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\"\n          by auto\n        moreover have \"{csucc(nat)} \\<union>(csucc(nat)-(K-{csucc(nat)}))=({csucc(nat)} \\<union> csucc(nat))-(K-{csucc(nat)})\" by blast\n        ultimately have \"({csucc(nat)} \\<union> csucc(nat))-(K-{csucc(nat)})\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" by auto\n        then have \"({csucc(nat)} \\<union> csucc(nat))-(K-{csucc(nat)})\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n          by auto moreover\n        have \"csucc(nat) \\<union> {csucc(nat)}={csucc(nat)} \\<union> csucc(nat)\" by auto\n        ultimately have \"(csucc(nat) \\<union> {csucc(nat)})-(K-{csucc(nat)})\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n          by auto\n        then have \"(\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}))-(K-{csucc(nat)})\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n          using extension_pow_union by auto\n        then have \"(K-{csucc(nat)}){is closed in}(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n          unfolding IsClosed_def using ss by auto\n        with comp have \"(K\\<inter>(K-{csucc(nat)})){is compact in}(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" using compact_closed\n          Compact_is_card_nat by auto\n        moreover have \"K\\<inter>(K-{csucc(nat)})=(K-{csucc(nat)})\" by auto\n        ultimately have \"(K-{csucc(nat)}){is compact in}(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n        with ss have \"(K-{csucc(nat)}){is compact in}((Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat))\"\n          using compact_imp_compact_subspace comp Compact_is_card_nat by auto\n        then have \"(K-{csucc(nat)}){is compact in}(Pow(csucc(nat)))\" using extension_pow_subspace(1) by auto\n        then have \"(K-{csucc(nat)}){is compact in}(Pow(csucc(nat)){restricted to}(K-{csucc(nat)}))\" using compact_imp_compact_subspace\n          Compact_is_card_nat by auto moreover\n        have \"\\<Union>(Pow(csucc(nat)){restricted to}(K-{csucc(nat)}))=(K-{csucc(nat)})\" using ss unfolding RestrictedTo_def by auto\n        ultimately have \"(\\<Union>(Pow(csucc(nat)){restricted to}(K-{csucc(nat)}))){is compact in}(Pow(csucc(nat)){restricted to}(K-{csucc(nat)}))\" by auto\n        then have \"(K-{csucc(nat)}){is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" using pow_anti_compact \n          unfolding IsAntiComp_def antiProperty_def using ss by auto\n        then have \"Finite(K-{csucc(nat)})\" using compact_spectrum by auto moreover\n        have \"Finite({csucc(nat)})\" by auto ultimately\n        have \"Finite(K)\" using Diff_Finite[of \"{csucc(nat)}\" \"K\"] by auto\n        then have \"K{is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" using compact_spectrum by auto\n      }\n      moreover\n      {\n        assume \"\\<not>(K-{csucc(nat)}\\<prec>csucc(nat))\"\n        with ss have \"K-{csucc(nat)}\\<approx>csucc(nat)\" using lepoll_iff_leqpoll subset_imp_lepoll[of \"K-{csucc(nat)}\"\n          \"csucc(nat)\"] by auto\n        then have \"csucc(nat)\\<approx>K-{csucc(nat)}\" using eqpoll_sym by auto\n        then have \"nat\\<prec>K-{csucc(nat)}\" using lesspoll_eq_trans lt_csucc[OF Ord_nat]\n          lt_Card_imp_lesspoll[OF Card_csucc[OF Ord_nat]] by auto\n        then have \"nat\\<lesssim>K-{csucc(nat)}\" using lepoll_iff_leqpoll by auto\n        then obtain f where \"f\\<in>inj(nat,K-{csucc(nat)})\" unfolding lepoll_def by auto moreover\n        then have fun:\"f:nat\\<rightarrow>K-{csucc(nat)}\" unfolding inj_def by auto\n        then have \"f\\<in>surj(nat,range(f))\" using fun_is_surj by auto\n        ultimately have \"f\\<in>bij(nat,range(f))\" unfolding bij_def inj_def surj_def by auto\n        then have \"nat\\<approx>range(f)\" unfolding eqpoll_def by auto\n        then have e:\"range(f)\\<approx>nat\" using eqpoll_sym by auto\n        then have as2:\"range(f)\\<prec>csucc(nat)\" using lt_Card_imp_lesspoll[OF Card_csucc[OF Ord_nat]]\n          lt_csucc[OF Ord_nat] eq_lesspoll_trans by auto\n        then have \"range(f){is closed in}(CoCountable csucc(nat))\" using closed_sets_cocardinal[of \"csucc(nat)\"\n            \"range(f)\"\"csucc(nat)\"] unfolding Cocountable_def using func1_1_L5B[OF fun] ss noE by auto\n        then have \"csucc(nat)-(range(f))\\<in>(CoCountable csucc(nat))\" unfolding IsClosed_def\n          Cocountable_def using union_cocardinal[OF noE] by auto moreover\n        {\n          assume \"csucc(nat)-(range(f))=0\"\n          with ss func1_1_L5B[OF fun] have \"csucc(nat)=(range(f))\" by blast\n          with as2 have \"False\" by auto\n        }\n        ultimately have \"{csucc(nat)} \\<union>(csucc(nat)-(range(f)))\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\"\n          by auto\n        moreover have \"{csucc(nat)} \\<union>(csucc(nat)-(range(f)))=({csucc(nat)} \\<union> csucc(nat))-(range(f))\" using func1_1_L5B[OF fun] by blast\n        ultimately have \"({csucc(nat)} \\<union> csucc(nat))-(range(f))\\<in>{{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" by auto\n        then have \"({csucc(nat)} \\<union> csucc(nat))-(range(f))\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n          by auto moreover\n        have \"csucc(nat) \\<union> {csucc(nat)}={csucc(nat)} \\<union> csucc(nat)\" by auto\n        ultimately have \"(csucc(nat) \\<union> {csucc(nat)})-(range(f))\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n          by auto\n        then have \"(\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}))-(range(f))\\<in>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n          using extension_pow_union by auto moreover\n        have \"range(f)\\<subseteq>\\<Union>(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" using ss func1_1_L5B[OF fun] by auto\n        ultimately have \"(range(f)){is closed in}(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n          unfolding IsClosed_def by blast\n        with comp have \"(K\\<inter>(range(f))){is compact in}(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" using compact_closed\n          Compact_is_card_nat by auto\n        moreover have \"K\\<inter>(range(f))=(range(f))\" using func1_1_L5B[OF fun] by auto\n        ultimately have \"(range(f)){is compact in}(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\" by auto\n        with ss func1_1_L5B[OF fun] have \"(range(f)){is compact in}((Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}){restricted to}csucc(nat))\"\n          using compact_imp_compact_subspace[of \"range(f)\" \"nat\" \"Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}}\" \"csucc(nat)\"] comp Compact_is_card_nat by auto\n        then have \"(range(f)){is compact in}(Pow(csucc(nat)))\" using extension_pow_subspace(1) by auto\n        then have \"(range(f)){is compact in}(Pow(csucc(nat)){restricted to}(range(f)))\" using compact_imp_compact_subspace\n          Compact_is_card_nat by auto moreover\n        have \"\\<Union>(Pow(csucc(nat)){restricted to}(range(f)))=(range(f))\" using ss func1_1_L5B[OF fun] unfolding RestrictedTo_def by auto\n        ultimately have \"(\\<Union>(Pow(csucc(nat)){restricted to}(range(f)))){is compact in}(Pow(csucc(nat)){restricted to}(range(f)))\" by auto\n        then have \"(range(f)){is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" using pow_anti_compact[of \"csucc(nat)\"]\n          unfolding IsAntiComp_def antiProperty_def using ss func1_1_L5B[OF fun] by auto\n        then have \"Finite(range(f))\" using compact_spectrum by auto moreover\n        then have \"Finite(nat)\" using e eqpoll_imp_Finite_iff by auto ultimately\n        have \"False\" using nat_not_Finite by auto\n      }\n      ultimately have \"K {is in the spectrum of}( \\<lambda>T. (\\<Union>T) {is compact in} T)\" by auto\n    }\n    ultimately have \"K {is in the spectrum of}( \\<lambda>T. (\\<Union>T) {is compact in} T)\" by auto\n  }\n  then show ?thesis unfolding IsAntiComp_def antiProperty_def by auto\nqed\n\ntext\\<open>If a topological space is KC, then its one-point compactification\nis US.\\<close>\n\ntheorem (in topology0) KC_imp_OP_comp_is_US:\n  assumes \"T{is KC}\"\n  shows \"({one-point compactification of}T){is US}\"\nproof-\n  {\n    fix N x y assume A:\"N:nat\\<rightarrow>\\<Union>({one-point compactification of}T)\" \"\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N x{in}({one-point compactification of}T)\" \"\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N y{in}({one-point compactification of}T)\" \"x\\<noteq>y\"\n    have dir:\"Le directs nat\" using Le_directs_nat(2).\n    from A(1) have dom:\"domain(N)=nat\" using func1_1_L1 by auto\n    with dir A(1) have NET:\"\\<langle>N,Le\\<rangle>{is a net on}\\<Union>({one-point compactification of}T)\" unfolding IsNet_def by auto\n    have xy:\"x\\<in>\\<Union>({one-point compactification of}T)\" \"y\\<in>\\<Union>({one-point compactification of}T)\"\n      using A(2,3) topology0.NetConverges_def[OF _ NET] unfolding topology0_def using op_comp_is_top dom by auto \n    then have pp:\"x\\<in>\\<Union>T \\<union>{\\<Union>T}\" \"y\\<in>\\<Union>T \\<union>{\\<Union>T}\" using op_compact_total by auto\n    from A(2) have comp:\"\\<forall>U\\<in>Pow(\\<Union>{one-point compactification of}T).\n        x \\<in> Interior(U, {one-point compactification of}T) \\<longrightarrow>\n        (\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> U)\" using topology0.NetConverges_def[OF _ NET, of \"x\"]\n        unfolding topology0_def using op_comp_is_top dom op_compact_total by auto\n    from A(3) have op2:\"\\<forall>U\\<in>Pow(\\<Union>{one-point compactification of}T).\n        y \\<in> Interior(U, {one-point compactification of}T) \\<longrightarrow>\n        (\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> U)\" using topology0.NetConverges_def[OF _ NET, of \"y\"]\n        unfolding topology0_def using op_comp_is_top dom op_compact_total by auto\n    {\n      assume p:\"x\\<in>\\<Union>T\" \"y\\<in>\\<Union>T\"\n      {\n        assume B:\"\\<exists>n\\<in>nat. \\<forall>m\\<in>nat. \\<langle>n,m\\<rangle>\\<in>Le \\<longrightarrow> N`m=\\<Union>T\"\n        have \"\\<Union>T\\<in>({one-point compactification of}T)\" using open_subspace by auto\n        then have \"\\<Union>T=Interior(\\<Union>T,{one-point compactification of}T)\" using topology0.Top_2_L3\n          unfolding topology0_def using op_comp_is_top by auto\n        then have \"x\\<in>Interior(\\<Union>T,{one-point compactification of}T)\" using p(1) by auto moreover\n        have \"\\<Union>T\\<in>Pow(\\<Union>({one-point compactification of}T))\" using open_subspace(1) by auto\n        ultimately have \"\\<exists>t\\<in>domain(fst(\\<langle>N, Le\\<rangle>)). \\<forall>m\\<in>domain(fst(\\<langle>N, Le\\<rangle>)). \\<langle>t, m\\<rangle> \\<in> snd(\\<langle>N, Le\\<rangle>) \\<longrightarrow> fst(\\<langle>N, Le\\<rangle>) ` m \\<in> \\<Union>T\" using A(2)\n          using topology0.NetConverges_def[OF _ NET] op_comp_is_top unfolding topology0_def by blast\n        then have \"\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> \\<Union>T\" using dom by auto\n        then obtain t where t:\"t\\<in>nat\" \"\\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> \\<Union>T\" by auto\n        from B obtain n where n:\"n\\<in>nat\" \"\\<forall>m\\<in>nat. \\<langle>n,m\\<rangle>\\<in>Le \\<longrightarrow> N`m=\\<Union>T\" by auto\n        from t(1) n(1) dir obtain z where z:\"z\\<in>nat\" \"\\<langle>n,z\\<rangle>\\<in>Le\" \"\\<langle>t,z\\<rangle>\\<in>Le\" unfolding IsDirectedSet_def\n          by auto\n        from t(2) z(1,3) have \"N`z\\<in>\\<Union>T\" by auto moreover\n        from n(2) z(1,2) have \"N`z=\\<Union>T\" by auto ultimately\n        have \"False\" using mem_not_refl by auto\n      }\n      then have reg:\"\\<forall>n\\<in>nat. \\<exists>m\\<in>nat. N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" by auto\n      let ?NN=\"{\\<langle>n,N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<rangle>. n\\<in>nat}\"\n      {\n        fix x z assume A1:\"\\<langle>x, z\\<rangle> \\<in> ?NN\"\n        {\n          fix y' assume A2:\"\\<langle>x,y'\\<rangle>\\<in>?NN\"\n          with A1 have \"z=y'\" by auto\n        }\n        then have \"\\<forall>y'. \\<langle>x,y'\\<rangle>\\<in>?NN \\<longrightarrow> z=y'\" by auto\n      }\n      then have \"\\<forall>x z. \\<langle>x, z\\<rangle> \\<in> ?NN \\<longrightarrow> (\\<forall>y'. \\<langle>x,y'\\<rangle>\\<in>?NN \\<longrightarrow> z=y')\" by auto\n      moreover\n      {\n      fix n assume as:\"n\\<in>nat\"\n        with reg obtain m where \"N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\\<in>nat\" by auto\n        then have LI:\"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<noteq>\\<Union>T\" \"\\<langle>n,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\"]\n          nat_into_Ord[of \"m\"] by auto\n        then have \"(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<in>nat\" by auto\n        then have \"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<in>\\<Union>({one-point compactification of}T)\" using apply_type[OF A(1)] op_compact_total by auto\n        with as have \"\\<langle>n,N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<rangle>\\<in>nat\\<times>\\<Union>({one-point compactification of}T)\" by auto\n      }\n      then have \"?NN\\<in>Pow(nat\\<times>\\<Union>({one-point compactification of}T))\" by auto\n      ultimately have NFun:\"?NN:nat\\<rightarrow>\\<Union>({one-point compactification of}T)\" unfolding Pi_def function_def domain_def by auto\n      {\n        fix n assume as:\"n\\<in>nat\"\n        with reg obtain m where \"N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\\<in>nat\" by auto\n        then have LI:\"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<noteq>\\<Union>T\" \"\\<langle>n,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\"]\n          nat_into_Ord[of \"m\"] by auto\n        then have \"?NN`n\\<noteq>\\<Union>T\" using apply_equality[OF _ NFun] by auto\n      }\n      then have noy:\"\\<forall>n\\<in>nat. ?NN`n\\<noteq>\\<Union>T\" by auto\n      then have \"\\<forall>n\\<in>nat. ?NN`n\\<in>\\<Union>T\" using apply_type[OF NFun] op_compact_total by auto\n      then have R:\"?NN:nat\\<rightarrow>\\<Union>T\" using func1_1_L1A[OF NFun] by auto\n      have dom2:\"domain(?NN)=nat\" by auto\n      then have net2:\"\\<langle>?NN,Le\\<rangle>{is a net on}\\<Union>T\" unfolding IsNet_def using R dir by auto\n      {\n        fix U assume U:\"U\\<subseteq>\\<Union>T\" \"x\\<in>int(U)\"\n        have intT:\"int(U)\\<in>T\" using Top_2_L2 by auto\n        then have \"int(U)\\<in>({one-point compactification of}T)\" unfolding OPCompactification_def\n          by auto\n        then have \"Interior(int(U),{one-point compactification of}T)=int(U)\" using topology0.Top_2_L3\n          unfolding topology0_def using op_comp_is_top by auto\n        with U(2) have \"x\\<in>Interior(int(U),{one-point compactification of}T)\" by auto\n        with intT have \"(\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>int(U))\" using comp op_compact_total by auto\n        then obtain r where r_def:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U\" using Top_2_L1 by auto\n        {\n          fix s assume AA:\"\\<langle>r,s\\<rangle>\\<in>Le\"\n          with reg obtain m where \"N`m\\<noteq>\\<Union>T\" \"\\<langle>s,m\\<rangle>\\<in>Le\" by auto\n          then have \"\\<langle>s,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>s,m\\<rangle>\\<in>Le\" \"m\"]\n            nat_into_Ord by auto\n          with AA have \"\\<langle>r,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using le_trans by auto\n          with r_def(2) have \"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le)\\<in>U\" by blast\n          then have \"?NN`s\\<in>U\" using apply_equality[OF _ NFun] AA by auto\n        }\n        then have \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\" by auto\n        with r_def(1) have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\" by auto\n      }\n      then have \"\\<forall>U\\<in>Pow(\\<Union>T). x \\<in> int(U)\n        \\<longrightarrow> (\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r, s\\<rangle> \\<in> Le \\<longrightarrow> ?NN ` s \\<in> U)\" by auto\n      then have conx:\"\\<langle>?NN,Le\\<rangle>\\<rightarrow>\\<^sub>N x{in}T\" using NetConverges_def[OF net2] p(1) op_comp_is_top \n        unfolding topology0_def using xy(1) dom2 by auto\n      {\n        fix U assume U:\"U\\<subseteq>\\<Union>T\" \"y\\<in>int(U)\"\n        have intT:\"int(U)\\<in>T\" using Top_2_L2 by auto\n        then have \"int(U)\\<in>({one-point compactification of}T)\" unfolding OPCompactification_def\n          by auto\n        then have \"Interior(int(U),{one-point compactification of}T)=int(U)\" using topology0.Top_2_L3\n          unfolding topology0_def using op_comp_is_top by auto\n        with U(2) have \"y\\<in>Interior(int(U),{one-point compactification of}T)\" by auto\n        with intT have \"(\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>int(U))\" using op2 op_compact_total by auto\n        then obtain r where r_def:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U\" using Top_2_L1 by auto\n        {\n          fix s assume AA:\"\\<langle>r,s\\<rangle>\\<in>Le\"\n          with reg obtain m where \"N`m\\<noteq>\\<Union>T\" \"\\<langle>s,m\\<rangle>\\<in>Le\" by auto\n          then have \"\\<langle>s,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>s,m\\<rangle>\\<in>Le\" \"m\"]\n            nat_into_Ord by auto\n          with AA have \"\\<langle>r,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using le_trans by auto\n          with r_def(2) have \"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le)\\<in>U\" by blast\n          then have \"?NN`s\\<in>U\" using apply_equality[OF _ NFun] AA by auto\n        }\n        then have \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\" by auto\n        with r_def(1) have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\" by auto\n      }\n      then have \"\\<forall>U\\<in>Pow(\\<Union>T). y \\<in> int(U)\n        \\<longrightarrow> (\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r, s\\<rangle> \\<in> Le \\<longrightarrow> ?NN ` s \\<in> U)\" by auto\n      then have cony:\"\\<langle>?NN,Le\\<rangle>\\<rightarrow>\\<^sub>N y{in}T\" using NetConverges_def[OF net2] p(2) op_comp_is_top \n        unfolding topology0_def using xy(2) dom2 by auto\n      with conx assms have \"x=y\" using KC_imp_US unfolding IsUS_def using R by auto\n      with A(4) have \"False\" by auto\n    }\n    moreover\n    {\n      assume AAA:\"x\\<notin>\\<Union>T\\<or>y\\<notin>\\<Union>T\"\n      with pp have \"x=\\<Union>T\\<or>y=\\<Union>T\" by auto\n      {\n        assume x:\"x=\\<Union>T\"\n        with A(4) have y:\"y\\<in>\\<Union>T\" using pp(2) by auto\n        {\n          assume B:\"\\<exists>n\\<in>nat. \\<forall>m\\<in>nat. \\<langle>n,m\\<rangle>\\<in>Le \\<longrightarrow> N`m=\\<Union>T\"\n          have \"\\<Union>T\\<in>({one-point compactification of}T)\" using open_subspace by auto\n          then have \"\\<Union>T=Interior(\\<Union>T,{one-point compactification of}T)\" using topology0.Top_2_L3\n            unfolding topology0_def using op_comp_is_top by auto\n          then have \"y\\<in>Interior(\\<Union>T,{one-point compactification of}T)\" using y by auto moreover\n          have \"\\<Union>T\\<in>Pow(\\<Union>({one-point compactification of}T))\" using open_subspace(1) by auto\n          ultimately have \"\\<exists>t\\<in>domain(fst(\\<langle>N, Le\\<rangle>)). \\<forall>m\\<in>domain(fst(\\<langle>N, Le\\<rangle>)). \\<langle>t, m\\<rangle> \\<in> snd(\\<langle>N, Le\\<rangle>) \\<longrightarrow> fst(\\<langle>N, Le\\<rangle>) ` m \\<in> \\<Union>T\" using A(3)\n            using topology0.NetConverges_def[OF _ NET] op_comp_is_top unfolding topology0_def by blast\n          then have \"\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> \\<Union>T\" using dom by auto\n          then obtain t where t:\"t\\<in>nat\" \"\\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> \\<Union>T\" by auto\n          from B obtain n where n:\"n\\<in>nat\" \"\\<forall>m\\<in>nat. \\<langle>n,m\\<rangle>\\<in>Le \\<longrightarrow> N`m=\\<Union>T\" by auto\n          from t(1) n(1) dir obtain z where z:\"z\\<in>nat\" \"\\<langle>n,z\\<rangle>\\<in>Le\" \"\\<langle>t,z\\<rangle>\\<in>Le\" unfolding IsDirectedSet_def\n            by auto\n          from t(2) z(1,3) have \"N`z\\<in>\\<Union>T\" by auto moreover\n          from n(2) z(1,2) have \"N`z=\\<Union>T\" by auto ultimately\n          have \"False\" using mem_not_refl by auto\n        }\n        then have reg:\"\\<forall>n\\<in>nat. \\<exists>m\\<in>nat. N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" by auto\n        let ?NN=\"{\\<langle>n,N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<rangle>. n\\<in>nat}\"\n        {\n          fix x z assume A1:\"\\<langle>x, z\\<rangle> \\<in> ?NN\"\n          {\n            fix y' assume A2:\"\\<langle>x,y'\\<rangle>\\<in>?NN\"\n            with A1 have \"z=y'\" by auto\n          }\n          then have \"\\<forall>y'. \\<langle>x,y'\\<rangle>\\<in>?NN \\<longrightarrow> z=y'\" by auto\n        }\n        then have \"\\<forall>x z. \\<langle>x, z\\<rangle> \\<in> ?NN \\<longrightarrow> (\\<forall>y'. \\<langle>x,y'\\<rangle>\\<in>?NN \\<longrightarrow> z=y')\" by auto\n        moreover\n        {\n          fix n assume as:\"n\\<in>nat\"\n          with reg obtain m where \"N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\\<in>nat\" by auto\n          then have LI:\"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<noteq>\\<Union>T\" \"\\<langle>n,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\"]\n            nat_into_Ord[of \"m\"] by auto\n          then have \"(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<in>nat\" by auto\n          then have \"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<in>\\<Union>({one-point compactification of}T)\" using apply_type[OF A(1)] op_compact_total by auto\n          with as have \"\\<langle>n,N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<rangle>\\<in>nat\\<times>\\<Union>({one-point compactification of}T)\" by auto\n        }\n        then have \"?NN\\<in>Pow(nat\\<times>\\<Union>({one-point compactification of}T))\" by auto\n        ultimately have NFun:\"?NN:nat\\<rightarrow>\\<Union>({one-point compactification of}T)\" unfolding Pi_def function_def domain_def by auto\n        {\n          fix n assume as:\"n\\<in>nat\"\n          with reg obtain m where \"N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\\<in>nat\" by auto\n          then have LI:\"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<noteq>\\<Union>T\" \"\\<langle>n,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\"]\n            nat_into_Ord[of \"m\"] by auto\n          then have \"?NN`n\\<noteq>\\<Union>T\" using apply_equality[OF _ NFun] by auto\n        }\n        then have noy:\"\\<forall>n\\<in>nat. ?NN`n\\<noteq>\\<Union>T\" by auto\n        then have \"\\<forall>n\\<in>nat. ?NN`n\\<in>\\<Union>T\" using apply_type[OF NFun] op_compact_total by auto\n        then have R:\"?NN:nat\\<rightarrow>\\<Union>T\" using func1_1_L1A[OF NFun] by auto\n        have dom2:\"domain(?NN)=nat\" by auto\n        then have net2:\"\\<langle>?NN,Le\\<rangle>{is a net on}\\<Union>T\" unfolding IsNet_def using R dir by auto\n        {\n          fix U assume U:\"U\\<subseteq>\\<Union>T\" \"y\\<in>int(U)\"\n          have intT:\"int(U)\\<in>T\" using Top_2_L2 by auto\n          then have \"int(U)\\<in>({one-point compactification of}T)\" unfolding OPCompactification_def\n            by auto\n          then have \"Interior(int(U),{one-point compactification of}T)=int(U)\" using topology0.Top_2_L3\n            unfolding topology0_def using op_comp_is_top by auto\n          with U(2) have \"y\\<in>Interior(int(U),{one-point compactification of}T)\" by auto\n          with intT have \"(\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>int(U))\" using op2 op_compact_total by auto\n          then obtain r where r_def:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U\" using Top_2_L1 by auto\n          {\n            fix s assume AA:\"\\<langle>r,s\\<rangle>\\<in>Le\"\n            with reg obtain m where \"N`m\\<noteq>\\<Union>T\" \"\\<langle>s,m\\<rangle>\\<in>Le\" by auto\n            then have \"\\<langle>s,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>s,m\\<rangle>\\<in>Le\" \"m\"]\n              nat_into_Ord by auto\n            with AA have \"\\<langle>r,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using le_trans by auto\n            with r_def(2) have \"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le)\\<in>U\" by blast\n            then have \"?NN`s\\<in>U\" using apply_equality[OF _ NFun] AA by auto\n          }\n          then have \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\" by auto\n          with r_def(1) have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\" by auto\n        }\n        then have \"\\<forall>U\\<in>Pow(\\<Union>T). y \\<in> int(U)\n          \\<longrightarrow> (\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r, s\\<rangle> \\<in> Le \\<longrightarrow> ?NN ` s \\<in> U)\" by auto\n        then have cony:\"\\<langle>?NN,Le\\<rangle>\\<rightarrow>\\<^sub>N y{in}T\" using NetConverges_def[OF net2] y op_comp_is_top \n          unfolding topology0_def using xy(2) dom2 by auto\n        let ?A=\"{y}\\<union>?NN``nat\"\n        {\n          fix M assume Acov:\"?A\\<subseteq>\\<Union>M\" \"M\\<subseteq>T\"\n          then have \"y\\<in>\\<Union>M\" by auto\n          then obtain V where V:\"y\\<in>V\" \"V\\<in>M\" by auto\n          with Acov(2) have VT:\"V\\<in>T\" by auto\n          then have \"V=int(V)\" using Top_2_L3 by auto\n          with V(1) have \"y\\<in>int(V)\" by auto\n          with cony obtain r where rr:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>V\"\n            unfolding NetConverges_def[OF net2, of \"y\"] using dom2 VT y by auto\n          have NresFun:\"restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}):{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<rightarrow>\\<Union>T\" using restrict_fun\n            [OF R, of \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\"] by auto\n          then have \"restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le})\\<in>surj({n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le},range(restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le})))\"\n            using fun_is_surj by auto moreover\n          have \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<subseteq>nat\" by auto\n          then have \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<lesssim>nat\" using subset_imp_lepoll by auto\n          ultimately have \"range(restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}))\\<lesssim>{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\" using surj_fun_inv_2 by auto\n          moreover\n          have \"{n\\<in>nat. \\<langle>n,0\\<rangle>\\<in>Le}={0}\" by auto\n          then have \"Finite({n\\<in>nat. \\<langle>n,0\\<rangle>\\<in>Le})\" by auto moreover\n          {\n            fix j assume as:\"j\\<in>nat\" \"Finite({n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le})\"\n            {\n              fix t assume \"t\\<in>{n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le}\"\n              then have \"t\\<in>nat\" \"\\<langle>t,succ(j)\\<rangle>\\<in>Le\" by auto\n              then have \"t\\<le>succ(j)\" by auto\n              then have \"t\\<subseteq>succ(j)\" using le_imp_subset by auto\n              then have \"t\\<subseteq>j \\<union>{j}\" using succ_explained by auto\n              then have \"j\\<in>t\\<or>t\\<subseteq>j\" by auto\n              then have \"j\\<in>t\\<or>t\\<le>j\" using subset_imp_le \\<open>t\\<in>nat\\<close> \\<open>j\\<in>nat\\<close> nat_into_Ord by auto\n              then have \"j \\<union>{j}\\<subseteq>t\\<or>t\\<le>j\" using \\<open>t\\<in>nat\\<close> \\<open>j\\<in>nat\\<close> nat_into_Ord unfolding Ord_def\n                Transset_def by auto\n              then have \"succ(j)\\<subseteq>t\\<or>t\\<le>j\" using succ_explained by auto\n              with \\<open>t\\<subseteq>succ(j)\\<close> have \"t=succ(j)\\<or>t\\<le>j\" by auto\n              with \\<open>t\\<in>nat\\<close> \\<open>j\\<in>nat\\<close> have \"t\\<in>{n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le} \\<union> {succ(j)}\" by auto\n            }\n            then have \"{n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le} \\<subseteq>{n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le} \\<union> {succ(j)}\" by auto\n            moreover have \"Finite({n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le} \\<union> {succ(j)})\" using as(2) Finite_cons\n              by auto\n            ultimately have \"Finite({n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le})\" using subset_Finite by auto\n          }\n          then have \"\\<forall>j\\<in>nat. Finite({n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le}) \\<longrightarrow> Finite({n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le})\"\n            by auto\n          ultimately have \"Finite(range(restrict(?NN, {n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})))\"\n            using lepoll_Finite[of \"range(restrict(?NN, {n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}))\"\n              \"{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}\"] ind_on_nat[OF \\<open>r\\<in>nat\\<close>, where P=\"\\<lambda>t. Finite({n\\<in>nat. \\<langle>n,t\\<rangle>\\<in>Le})\"] by auto\n          then have \"Finite((restrict(?NN, {n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}))``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\" using range_image_domain[OF NresFun]\n            by auto\n          then have \"Finite(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\" using restrict_image by auto\n          then have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" using compact_spectrum by auto\n          moreover have \"\\<Union>(T{restricted to}?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})=\\<Union>T\\<inter>?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}\"\n            unfolding RestrictedTo_def by auto moreover\n          have \"\\<Union>T\\<inter>?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}=?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}\"\n            using func1_1_L6(2)[OF R] by blast\n          moreover have \"(T{restricted to}?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is a topology}\"\n            using Top_1_L4 unfolding topology0_def by auto\n          ultimately have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is compact in}(T{restricted to}?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\"\n            unfolding Spec_def by force\n          then have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is compact in}(T)\" using compact_subspace_imp_compact by auto\n          moreover from Acov(1) have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\\<subseteq>\\<Union>M\" by auto\n          moreover note Acov(2) ultimately\n          obtain \\<NN> where \\<NN>:\"\\<NN>\\<in>FinPow(M)\" \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\\<subseteq>\\<Union>\\<NN>\"\n            unfolding IsCompact_def by blast\n          from \\<NN>(1) have \"\\<NN> \\<union>{V}\\<in>FinPow(M)\" using V(2) unfolding FinPow_def by auto moreover\n          {\n            fix s assume s:\"s\\<in>?A\" \"s\\<notin>V\"\n            with V(1) have \"s\\<in>?NN``nat\" by auto\n            then have \"s\\<in>{?NN`n. n\\<in>nat}\" using func_imagedef[OF NFun] by auto\n            then obtain n where n:\"n\\<in>nat\" \"s=?NN`n\" by auto\n            {\n              assume \"\\<langle>r,n\\<rangle>\\<in>Le\"\n              with rr have \"?NN`n\\<in>V\" by auto\n              with n(2) s(2) have \"False\" by auto\n            }\n            then have \"\\<langle>r,n\\<rangle>\\<notin>Le\" by auto\n            with rr(1) n(1) have \"\\<not>(r\\<le>n)\" by auto\n            then have \"n\\<le>r\" using Ord_linear_le[where thesis=\"\\<langle>n,r\\<rangle>\\<in>Le\"] nat_into_Ord[OF rr(1)]\n              nat_into_Ord[OF n(1)] by auto\n            with rr(1) n(1) have \"\\<langle>n,r\\<rangle>\\<in>Le\" by auto\n            with n(2) have \"s\\<in>{?NN`t. t\\<in>{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}}\" by auto moreover\n            have \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<subseteq>nat\" by auto\n            ultimately have \"s\\<in>?NN``{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\" using func_imagedef[OF NFun]\n              by auto\n            with \\<NN>(2) have \"s\\<in>\\<Union>\\<NN>\" by auto\n          }\n          then have \"?A\\<subseteq>\\<Union>\\<NN> \\<union> V\" by auto\n          then have \"?A\\<subseteq>\\<Union>(\\<NN> \\<union> {V})\" by auto ultimately\n          have \"\\<exists>\\<NN>\\<in>FinPow(M). ?A\\<subseteq>\\<Union>\\<NN>\" by auto\n        }\n        then have \"\\<forall>M\\<in>Pow(T). ?A\\<subseteq>\\<Union>M \\<longrightarrow> (\\<exists>\\<NN>\\<in>FinPow(M). ?A\\<subseteq>\\<Union>\\<NN>)\" by auto moreover\n        have ss:\"?A\\<subseteq>\\<Union>(T)\" using func1_1_L6(2)[OF R] y by blast ultimately\n        have \"?A{is compact in}(T)\" unfolding IsCompact_def by auto moreover\n        with assms have \"?A{is closed in}(T)\" unfolding IsKC_def IsCompact_def by auto ultimately\n        have \"?A\\<in>{B\\<in>Pow(\\<Union>T). B{is compact in}(T)\\<and>B{is closed in}(T)}\" using ss by auto\n        then have \"{\\<Union>T}\\<union>(\\<Union>T-?A)\\<in>({one-point compactification of}T)\" unfolding OPCompactification_def\n          by auto\n        then have \"{\\<Union>T}\\<union>(\\<Union>T-?A)=Interior({\\<Union>T}\\<union>(\\<Union>T-?A),{one-point compactification of}T)\" using topology0.Top_2_L3 op_comp_is_top\n          unfolding topology0_def by auto moreover\n        {\n          assume \"x\\<in>?A\"\n          with A(4) have \"x\\<in>?NN``nat\" by auto\n          then have \"x\\<in>{?NN`n. n\\<in>nat}\" using func_imagedef[OF NFun] by auto\n          then obtain n where \"n\\<in>nat\"\"?NN`n=x\" by auto\n          with noy x have \"False\" by auto\n        }\n        with y have \"x\\<in>{\\<Union>T}\\<union>(\\<Union>T-?A)\" using x by force ultimately\n        have \"x\\<in>Interior({\\<Union>T}\\<union>(\\<Union>T-?A),{one-point compactification of}T)\" \"{\\<Union>T}\\<union>(\\<Union>T-?A)\\<in>Pow(\\<Union>({one-point compactification of}T))\"\n          using op_compact_total by auto moreover\n        have \"(\\<forall>U\\<in>Pow(\\<Union>({one-point compactification of}T)).  x \\<in> Interior(U,{one-point compactification of}T) \\<longrightarrow> (\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> U))\"\n          using A(2) dom topology0.NetConverges_def[OF _ NET] op_comp_is_top unfolding topology0_def by auto\n        ultimately have \"\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> {\\<Union>T}\\<union>(\\<Union>T-?A)\" by blast\n        then obtain r where r_def:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>{\\<Union>T}\\<union>(\\<Union>T-?A)\" by auto\n        {\n          fix s assume AA:\"\\<langle>r,s\\<rangle>\\<in>Le\"\n          with reg obtain m where \"N`m\\<noteq>\\<Union>T\" \"\\<langle>s,m\\<rangle>\\<in>Le\" by auto\n          then have \"\\<langle>s,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>s,m\\<rangle>\\<in>Le\" \"m\"]\n            nat_into_Ord by auto\n          with AA have \"\\<langle>r,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using le_trans by auto\n          with r_def(2) have \"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le)\\<in>{\\<Union>T}\\<union>(\\<Union>T-?A)\" by auto\n          then have \"?NN`s\\<in>{\\<Union>T}\\<union>(\\<Union>T-?A)\" using apply_equality[OF _ NFun] AA by auto\n          with noy have \"?NN`s\\<in>(\\<Union>T-?A)\" using AA by auto\n          moreover have \"?NN`s\\<in>{?NN`t. t\\<in>nat}\" using AA by auto\n          then have \"?NN`s\\<in>?NN``nat\" using func_imagedef[OF NFun] by auto\n          then have \"?NN`s\\<in>?A\" by auto\n          ultimately have \"False\" by auto\n        }\n        moreover have \"r\\<subseteq>succ(r)\" using succ_explained by auto\n        then have \"r\\<le>succ(r)\" using subset_imp_le nat_into_Ord \\<open>r\\<in>nat\\<close> nat_succI\n          by auto\n        then have \"\\<langle>r,succ(r)\\<rangle>\\<in>Le\" using \\<open>r\\<in>nat\\<close> nat_succI by auto\n        ultimately have \"False\" by auto\n      }\n      then have \"x\\<noteq>\\<Union>T\" by auto\n      with xy(1) AAA have \"y\\<notin>\\<Union>T\" \"x\\<in>\\<Union>T\" using op_compact_total by auto\n      with xy(2) have y:\"y=\\<Union>T\" and x:\"x\\<in>\\<Union>T\" using op_compact_total by auto\n      {\n        assume B:\"\\<exists>n\\<in>nat. \\<forall>m\\<in>nat. \\<langle>n,m\\<rangle>\\<in>Le \\<longrightarrow> N`m=\\<Union>T\"\n        have \"\\<Union>T\\<in>({one-point compactification of}T)\" using open_subspace by auto\n        then have \"\\<Union>T=Interior(\\<Union>T,{one-point compactification of}T)\" using topology0.Top_2_L3\n          unfolding topology0_def using op_comp_is_top by auto\n        then have \"x\\<in>Interior(\\<Union>T,{one-point compactification of}T)\" using x by auto moreover\n        have \"\\<Union>T\\<in>Pow(\\<Union>({one-point compactification of}T))\" using open_subspace(1) by auto\n        ultimately have \"\\<exists>t\\<in>domain(fst(\\<langle>N, Le\\<rangle>)). \\<forall>m\\<in>domain(fst(\\<langle>N, Le\\<rangle>)). \\<langle>t, m\\<rangle> \\<in> snd(\\<langle>N, Le\\<rangle>) \\<longrightarrow> fst(\\<langle>N, Le\\<rangle>) ` m \\<in> \\<Union>T\" using A(2)\n          using topology0.NetConverges_def[OF _ NET] op_comp_is_top unfolding topology0_def by blast\n        then have \"\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> \\<Union>T\" using dom by auto\n        then obtain t where t:\"t\\<in>nat\" \"\\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> \\<Union>T\" by auto\n        from B obtain n where n:\"n\\<in>nat\" \"\\<forall>m\\<in>nat. \\<langle>n,m\\<rangle>\\<in>Le \\<longrightarrow> N`m=\\<Union>T\" by auto\n        from t(1) n(1) dir obtain z where z:\"z\\<in>nat\" \"\\<langle>n,z\\<rangle>\\<in>Le\" \"\\<langle>t,z\\<rangle>\\<in>Le\" unfolding IsDirectedSet_def\n          by auto\n        from t(2) z(1,3) have \"N`z\\<in>\\<Union>T\" by auto moreover\n        from n(2) z(1,2) have \"N`z=\\<Union>T\" by auto ultimately\n        have \"False\" using mem_not_refl by auto\n      }\n      then have reg:\"\\<forall>n\\<in>nat. \\<exists>m\\<in>nat. N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" by auto\n      let ?NN=\"{\\<langle>n,N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<rangle>. n\\<in>nat}\"\n      {\n        fix x z assume A1:\"\\<langle>x, z\\<rangle> \\<in> ?NN\"\n        {\n          fix y' assume A2:\"\\<langle>x,y'\\<rangle>\\<in>?NN\"\n          with A1 have \"z=y'\" by auto\n        }\n        then have \"\\<forall>y'. \\<langle>x,y'\\<rangle>\\<in>?NN \\<longrightarrow> z=y'\" by auto\n      }\n      then have \"\\<forall>x z. \\<langle>x, z\\<rangle> \\<in> ?NN \\<longrightarrow> (\\<forall>y'. \\<langle>x,y'\\<rangle>\\<in>?NN \\<longrightarrow> z=y')\" by auto\n      moreover\n      {\n        fix n assume as:\"n\\<in>nat\"\n        with reg obtain m where \"N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\\<in>nat\" by auto\n        then have LI:\"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<noteq>\\<Union>T\" \"\\<langle>n,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\"]\n          nat_into_Ord[of \"m\"] by auto\n        then have \"(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<in>nat\" by auto\n        then have \"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<in>\\<Union>({one-point compactification of}T)\" using apply_type[OF A(1)] op_compact_total by auto\n        with as have \"\\<langle>n,N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<rangle>\\<in>nat\\<times>\\<Union>({one-point compactification of}T)\" by auto\n      }\n      then have \"?NN\\<in>Pow(nat\\<times>\\<Union>({one-point compactification of}T))\" by auto\n      ultimately have NFun:\"?NN:nat\\<rightarrow>\\<Union>({one-point compactification of}T)\" unfolding Pi_def function_def domain_def by auto\n      {\n        fix n assume as:\"n\\<in>nat\"\n        with reg obtain m where \"N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\\<in>nat\" by auto\n        then have LI:\"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le)\\<noteq>\\<Union>T\" \"\\<langle>n,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>n,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>n,m\\<rangle>\\<in>Le\" \"m\"]\n          nat_into_Ord[of \"m\"] by auto\n        then have \"?NN`n\\<noteq>\\<Union>T\" using apply_equality[OF _ NFun] by auto\n      }\n      then have noy:\"\\<forall>n\\<in>nat. ?NN`n\\<noteq>\\<Union>T\" by auto\n      then have \"\\<forall>n\\<in>nat. ?NN`n\\<in>\\<Union>T\" using apply_type[OF NFun] op_compact_total by auto\n      then have R:\"?NN:nat\\<rightarrow>\\<Union>T\" using func1_1_L1A[OF NFun] by auto\n      have dom2:\"domain(?NN)=nat\" by auto\n      then have net2:\"\\<langle>?NN,Le\\<rangle>{is a net on}\\<Union>T\" unfolding IsNet_def using R dir by auto\n      {\n        fix U assume U:\"U\\<subseteq>\\<Union>T\" \"x\\<in>int(U)\"\n        have intT:\"int(U)\\<in>T\" using Top_2_L2 by auto\n        then have \"int(U)\\<in>({one-point compactification of}T)\" unfolding OPCompactification_def\n          by auto\n        then have \"Interior(int(U),{one-point compactification of}T)=int(U)\" using topology0.Top_2_L3\n          unfolding topology0_def using op_comp_is_top by auto\n        with U(2) have \"x\\<in>Interior(int(U),{one-point compactification of}T)\" by auto\n        with intT have \"(\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>int(U))\" using comp op_compact_total by auto\n        then obtain r where r_def:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>U\" using Top_2_L1 by auto\n        {\n          fix s assume AA:\"\\<langle>r,s\\<rangle>\\<in>Le\"\n          with reg obtain m where \"N`m\\<noteq>\\<Union>T\" \"\\<langle>s,m\\<rangle>\\<in>Le\" by auto\n          then have \"\\<langle>s,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>s,m\\<rangle>\\<in>Le\" \"m\"]\n            nat_into_Ord by auto\n          with AA have \"\\<langle>r,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using le_trans by auto\n          with r_def(2) have \"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le)\\<in>U\" by blast\n          then have \"?NN`s\\<in>U\" using apply_equality[OF _ NFun] AA by auto\n        }\n        then have \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\" by auto\n        with r_def(1) have \"\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>U\" by auto\n      }\n      then have \"\\<forall>U\\<in>Pow(\\<Union>T). x \\<in> int(U)\n        \\<longrightarrow> (\\<exists>r\\<in>nat. \\<forall>s\\<in>nat. \\<langle>r, s\\<rangle> \\<in> Le \\<longrightarrow> ?NN ` s \\<in> U)\" by auto\n      then have cony:\"\\<langle>?NN,Le\\<rangle>\\<rightarrow>\\<^sub>N x{in}T\" using NetConverges_def[OF net2] x op_comp_is_top \n        unfolding topology0_def using xy(2) dom2 by auto\n      let ?A=\"{x}\\<union>?NN``nat\"\n      {\n        fix M assume Acov:\"?A\\<subseteq>\\<Union>M\" \"M\\<subseteq>T\"\n        then have \"x\\<in>\\<Union>M\" by auto\n        then obtain V where V:\"x\\<in>V\" \"V\\<in>M\" by auto\n        with Acov(2) have VT:\"V\\<in>T\" by auto\n        then have \"V=int(V)\" using Top_2_L3 by auto\n        with V(1) have \"x\\<in>int(V)\" by auto\n        with cony VT obtain r where rr:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> ?NN`s\\<in>V\"\n          unfolding NetConverges_def[OF net2, of \"x\"] using dom2 y by auto\n        have NresFun:\"restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}):{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<rightarrow>\\<Union>T\" using restrict_fun\n          [OF R, of \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\"] by auto\n        then have \"restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le})\\<in>surj({n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le},range(restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le})))\"\n          using fun_is_surj by auto moreover\n        have \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<subseteq>nat\" by auto\n        then have \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<lesssim>nat\" using subset_imp_lepoll by auto\n        ultimately have \"range(restrict(?NN,{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}))\\<lesssim>{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\" using surj_fun_inv_2 by auto\n        moreover\n        have \"{n\\<in>nat. \\<langle>n,0\\<rangle>\\<in>Le}={0}\" by auto\n        then have \"Finite({n\\<in>nat. \\<langle>n,0\\<rangle>\\<in>Le})\" by auto moreover\n        {\n          fix j assume as:\"j\\<in>nat\" \"Finite({n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le})\"\n          {\n            fix t assume \"t\\<in>{n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le}\"\n            then have \"t\\<in>nat\" \"\\<langle>t,succ(j)\\<rangle>\\<in>Le\" by auto\n            then have \"t\\<le>succ(j)\" by auto\n            then have \"t\\<subseteq>succ(j)\" using le_imp_subset by auto\n            then have \"t\\<subseteq>j \\<union>{j}\" using succ_explained by auto\n            then have \"j\\<in>t\\<or>t\\<subseteq>j\" by auto\n            then have \"j\\<in>t\\<or>t\\<le>j\" using subset_imp_le \\<open>t\\<in>nat\\<close> \\<open>j\\<in>nat\\<close> nat_into_Ord by auto\n            then have \"j \\<union>{j}\\<subseteq>t\\<or>t\\<le>j\" using \\<open>t\\<in>nat\\<close> \\<open>j\\<in>nat\\<close> nat_into_Ord unfolding Ord_def\n              Transset_def by auto\n            then have \"succ(j)\\<subseteq>t\\<or>t\\<le>j\" using succ_explained by auto\n            with \\<open>t\\<subseteq>succ(j)\\<close> have \"t=succ(j)\\<or>t\\<le>j\" by auto\n            with \\<open>t\\<in>nat\\<close> \\<open>j\\<in>nat\\<close> have \"t\\<in>{n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le} \\<union> {succ(j)}\" by auto\n          }\n          then have \"{n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le} \\<subseteq>{n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le} \\<union> {succ(j)}\" by auto\n          moreover have \"Finite({n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le} \\<union> {succ(j)})\" using as(2) Finite_cons\n            by auto\n          ultimately have \"Finite({n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le})\" using subset_Finite by auto\n        }\n        then have \"\\<forall>j\\<in>nat. Finite({n\\<in>nat. \\<langle>n,j\\<rangle>\\<in>Le}) \\<longrightarrow> Finite({n\\<in>nat. \\<langle>n,succ(j)\\<rangle>\\<in>Le})\"\n          by auto\n        ultimately have \"Finite(range(restrict(?NN, {n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})))\"\n          using lepoll_Finite[of \"range(restrict(?NN, {n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}))\"\n            \"{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}\"] ind_on_nat[OF \\<open>r\\<in>nat\\<close>, where P=\"\\<lambda>t. Finite({n\\<in>nat. \\<langle>n,t\\<rangle>\\<in>Le})\"] by auto\n        then have \"Finite((restrict(?NN, {n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}))``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\" using range_image_domain[OF NresFun]\n          by auto\n        then have \"Finite(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\" using restrict_image by auto\n        then have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" using compact_spectrum by auto\n        moreover have \"\\<Union>(T{restricted to}?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})=\\<Union>T\\<inter>?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}\"\n          unfolding RestrictedTo_def by auto moreover\n        have \"\\<Union>T\\<inter>?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}=?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}\"\n          using func1_1_L6(2)[OF R] by blast\n        moreover have \"(T{restricted to}?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is a topology}\"\n          using Top_1_L4 unfolding topology0_def by auto\n        ultimately have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is compact in}(T{restricted to}?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\"\n          unfolding Spec_def by force\n        then have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le}){is compact in}(T)\" using compact_subspace_imp_compact by auto\n        moreover from Acov(1) have \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\\<subseteq>\\<Union>M\" by auto\n        moreover note Acov(2) ultimately\n        obtain \\<NN> where \\<NN>:\"\\<NN>\\<in>FinPow(M)\" \"(?NN``{n \\<in> nat . \\<langle>n, r\\<rangle> \\<in> Le})\\<subseteq>\\<Union>\\<NN>\"\n          unfolding IsCompact_def by blast\n        from \\<NN>(1) have \"\\<NN> \\<union>{V}\\<in>FinPow(M)\" using V(2) unfolding FinPow_def by auto moreover\n        {\n          fix s assume s:\"s\\<in>?A\" \"s\\<notin>V\"\n          with V(1) have \"s\\<in>?NN``nat\" by auto\n          then have \"s\\<in>{?NN`n. n\\<in>nat}\" using func_imagedef[OF NFun] by auto\n          then obtain n where n:\"n\\<in>nat\" \"s=?NN`n\" by auto\n          {\n            assume \"\\<langle>r,n\\<rangle>\\<in>Le\"\n            with rr have \"?NN`n\\<in>V\" by auto\n            with n(2) s(2) have \"False\" by auto\n          }\n          then have \"\\<langle>r,n\\<rangle>\\<notin>Le\" by auto\n          with rr(1) n(1) have \"\\<not>(r\\<le>n)\" by auto\n          then have \"n\\<le>r\" using Ord_linear_le[where thesis=\"\\<langle>n,r\\<rangle>\\<in>Le\"] nat_into_Ord[OF rr(1)]\n            nat_into_Ord[OF n(1)] by auto\n          with rr(1) n(1) have \"\\<langle>n,r\\<rangle>\\<in>Le\" by auto\n          with n(2) have \"s\\<in>{?NN`t. t\\<in>{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}}\" by auto moreover\n          have \"{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\\<subseteq>nat\" by auto\n          ultimately have \"s\\<in>?NN``{n\\<in>nat. \\<langle>n,r\\<rangle>\\<in>Le}\" using func_imagedef[OF NFun]\n            by auto\n          with \\<NN>(2) have \"s\\<in>\\<Union>\\<NN>\" by auto\n        }\n        then have \"?A\\<subseteq>\\<Union>\\<NN> \\<union> V\" by auto\n        then have \"?A\\<subseteq>\\<Union>(\\<NN> \\<union> {V})\" by auto ultimately\n        have \"\\<exists>\\<NN>\\<in>FinPow(M). ?A\\<subseteq>\\<Union>\\<NN>\" by auto\n      }\n      then have \"\\<forall>M\\<in>Pow(T). ?A\\<subseteq>\\<Union>M \\<longrightarrow> (\\<exists>\\<NN>\\<in>FinPow(M). ?A\\<subseteq>\\<Union>\\<NN>)\" by auto moreover\n      have ss:\"?A\\<subseteq>\\<Union>(T)\" using func1_1_L6(2)[OF R] x by blast ultimately\n      have \"?A{is compact in}(T)\" unfolding IsCompact_def by auto moreover\n      with assms have \"?A{is closed in}(T)\" unfolding IsKC_def IsCompact_def by auto ultimately\n      have \"?A\\<in>{B\\<in>Pow(\\<Union>T). B{is compact in}(T)\\<and>B{is closed in}(T)}\" using ss by auto\n      then have \"{\\<Union>T}\\<union>(\\<Union>T-?A)\\<in>({one-point compactification of}T)\" unfolding OPCompactification_def\n        by auto\n      then have \"{\\<Union>T}\\<union>(\\<Union>T-?A)=Interior({\\<Union>T}\\<union>(\\<Union>T-?A),{one-point compactification of}T)\" using topology0.Top_2_L3 op_comp_is_top\n        unfolding topology0_def by auto moreover\n      {\n        assume \"y\\<in>?A\"\n        with A(4) have \"y\\<in>?NN``nat\" by auto\n        then have \"y\\<in>{?NN`n. n\\<in>nat}\" using func_imagedef[OF NFun] by auto\n        then obtain n where \"n\\<in>nat\"\"?NN`n=y\" by auto\n        with noy y have \"False\" by auto\n      }\n      with y have \"y\\<in>{\\<Union>T}\\<union>(\\<Union>T-?A)\" by force ultimately\n      have \"y\\<in>Interior({\\<Union>T}\\<union>(\\<Union>T-?A),{one-point compactification of}T)\" \"{\\<Union>T}\\<union>(\\<Union>T-?A)\\<in>Pow(\\<Union>({one-point compactification of}T))\"\n        using op_compact_total by auto moreover\n      have \"(\\<forall>U\\<in>Pow(\\<Union>({one-point compactification of}T)). y \\<in> Interior(U,{one-point compactification of}T) \\<longrightarrow> (\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> U))\"\n        using A(3) dom topology0.NetConverges_def[OF _ NET] op_comp_is_top unfolding topology0_def by auto\n      ultimately have \"\\<exists>t\\<in>nat. \\<forall>m\\<in>nat. \\<langle>t, m\\<rangle> \\<in> Le \\<longrightarrow> N ` m \\<in> {\\<Union>T}\\<union>(\\<Union>T-?A)\" by blast\n      then obtain r where r_def:\"r\\<in>nat\" \"\\<forall>s\\<in>nat. \\<langle>r,s\\<rangle>\\<in>Le \\<longrightarrow> N`s\\<in>{\\<Union>T}\\<union>(\\<Union>T-?A)\" by auto\n      {\n        fix s assume AA:\"\\<langle>r,s\\<rangle>\\<in>Le\"\n        with reg obtain m where \"N`m\\<noteq>\\<Union>T\" \"\\<langle>s,m\\<rangle>\\<in>Le\" by auto\n        then have \"\\<langle>s,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using LeastI[of \"\\<lambda>m. N`m\\<noteq>\\<Union>T \\<and> \\<langle>s,m\\<rangle>\\<in>Le\" \"m\"]\n          nat_into_Ord by auto\n        with AA have \"\\<langle>r,\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le\\<rangle>\\<in>Le\" using le_trans by auto\n        with r_def(2) have \"N`(\\<mu> i. N`i\\<noteq>\\<Union>T \\<and> \\<langle>s,i\\<rangle>\\<in>Le)\\<in>{\\<Union>T}\\<union>(\\<Union>T-?A)\" by auto\n        then have \"?NN`s\\<in>{\\<Union>T}\\<union>(\\<Union>T-?A)\" using apply_equality[OF _ NFun] AA by auto\n        with noy have \"?NN`s\\<in>(\\<Union>T-?A)\" using AA by auto\n        moreover have \"?NN`s\\<in>{?NN`t. t\\<in>nat}\" using AA by auto\n        then have \"?NN`s\\<in>?NN``nat\" using func_imagedef[OF NFun] by auto\n        then have \"?NN`s\\<in>?A\" by auto\n        ultimately have \"False\" by auto\n      }\n      moreover have \"r\\<subseteq>succ(r)\" using succ_explained by auto\n      then have \"r\\<le>succ(r)\" using subset_imp_le nat_into_Ord \\<open>r\\<in>nat\\<close> nat_succI\n        by auto\n      then have \"\\<langle>r,succ(r)\\<rangle>\\<in>Le\" using \\<open>r\\<in>nat\\<close> nat_succI by auto\n      ultimately have \"False\" by auto\n    }\n    ultimately have \"False\" by auto\n  }\n  then have \"\\<forall>N x y. N:nat\\<rightarrow>(\\<Union>{one-point compactification of}T) \\<and> (\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N x{in}({one-point compactification of}T))\n    \\<and> (\\<langle>N,Le\\<rangle>\\<rightarrow>\\<^sub>N y{in}({one-point compactification of}T)) \\<longrightarrow> x=y\" by auto\n  then show ?thesis unfolding IsUS_def by auto\nqed\n\ntext\\<open>In the one-point compactification of an anti-compact space,\never subspace that contains the infinite point is compact.\\<close>\n\ntheorem (in topology0) anti_comp_imp_OP_inf_comp:\n  assumes \"T{is anti-compact}\" \"A\\<subseteq>\\<Union>({one-point compactification of}T)\" \"\\<Union>T\\<in>A\"\n  shows \"A{is compact in}({one-point compactification of}T)\"\nproof-\n  {\n    fix M assume M:\"M\\<subseteq>({one-point compactification of}T)\" \"A\\<subseteq>\\<Union>M\"\n    with assms(3) obtain U where U:\"\\<Union>T\\<in>U\" \"U\\<in>M\" by auto\n    with M(1) obtain K where K:\"K{is compact in}T\" \"K{is closed in}T\" \"U={\\<Union>T}\\<union>(\\<Union>T-K)\"\n      unfolding OPCompactification_def using mem_not_refl[of \"\\<Union>T\"] by auto\n    from K(1) have \"K{is compact in}(T{restricted to}K)\" using compact_imp_compact_subspace Compact_is_card_nat\n      by auto\n    moreover have \"\\<Union>(T{restricted to}K)=\\<Union>T\\<inter>K\" unfolding RestrictedTo_def by auto\n    with K(1) have \"\\<Union>(T{restricted to}K)=K\" unfolding IsCompact_def by auto ultimately\n    have \"(\\<Union>(T{restricted to}K)){is compact in}(T{restricted to}K)\" by auto\n    with assms(1) have \"K{is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" unfolding IsAntiComp_def\n      antiProperty_def using K(1) unfolding IsCompact_def by auto\n    then have finK:\"Finite(K)\" using compact_spectrum by auto\n    from assms(2) have \"A-U\\<subseteq>(\\<Union>T \\<union>{\\<Union>T}) -U\" using op_compact_total by auto\n    with K(3) have \"A-U\\<subseteq>K\" by auto\n    with finK have \"Finite(A-U)\" using subset_Finite by auto\n    then have \"(A-U){is in the spectrum of}(\\<lambda>T. (\\<Union>T){is compact in}T)\" using compact_spectrum by auto moreover\n    have \"\\<Union>(({one-point compactification of}T){restricted to}(A-U))=A-U\" unfolding RestrictedTo_def using assms(2) K(3)\n      op_compact_total by auto moreover\n    have \"(({one-point compactification of}T){restricted to}(A-U)){is a topology}\" using topology0.Top_1_L4\n      op_comp_is_top unfolding topology0_def by auto\n    ultimately have \"(A-U){is compact in}(({one-point compactification of}T){restricted to}(A-U))\"\n      unfolding Spec_def by auto\n    then have \"(A-U){is compact in}({one-point compactification of}T)\" using compact_subspace_imp_compact by auto\n    moreover have \"A-U\\<subseteq>\\<Union>M\" using M(2) by auto moreover\n    note M(1) ultimately obtain N where N:\"N\\<in>FinPow(M)\" \"A-U\\<subseteq>\\<Union>N\" unfolding IsCompact_def by blast\n    from N(1) U(2) have \"N \\<union>{U}\\<in>FinPow(M)\" unfolding FinPow_def by auto moreover\n    from N(2) have \"A\\<subseteq>\\<Union>(N \\<union>{U})\" by auto\n    ultimately have \"\\<exists>R\\<in>FinPow(M). A\\<subseteq>\\<Union>R\" by auto\n  }\n  then show ?thesis using op_compact_total assms(2) unfolding IsCompact_def by auto\nqed\n\ntext\\<open>As a last result in this section, the one-point compactification of our topology is not a KC space.\\<close>\n\ntheorem extension_pow_OP_not_KC:\n  shows \"\\<not>(({one-point compactification of}(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})){is KC})\"\nproof\n  have noE:\"csucc(nat)\\<noteq>0\" using Ord_0_lt_csucc[OF Ord_nat] by auto\n  let ?T=\"(Pow(csucc(nat)) \\<union> {{csucc(nat)}\\<union>S. S\\<in>(CoCountable csucc(nat))-{0}})\"\n  assume ass:\"({one-point compactification of}?T){is KC}\"\n  from extension_pow_notDiscrete have \"{csucc(nat)} \\<notin> (Pow(csucc(nat)) \\<union> {{csucc(nat)} \\<union> S . S \\<in> (CoCountable csucc(nat)) - {0}})\"\n    by auto\n  {\n    assume \"csucc(nat)=csucc(nat)\\<union>{csucc(nat)}\" moreover\n    have \"csucc(nat)\\<in>csucc(nat)\\<union>{csucc(nat)}\" by auto\n    ultimately have \"csucc(nat)\\<in>csucc(nat)\" by auto\n    then have \"False\" using mem_not_refl by auto\n  }\n  then have dist:\"csucc(nat)\\<noteq>csucc(nat)\\<union>{csucc(nat)}\" by blast\n  {\n    assume \"{csucc(nat)}\\<in>({one-point compactification of}(Pow(csucc(nat)) \\<union> {{csucc(nat)} \\<union> S . S \\<in> (CoCountable csucc(nat)) - {0}}))\"\n    then have \"{csucc(nat)}\\<in>{{\\<Union>?T}\\<union>((\\<Union>?T)-K). K\\<in>{B\\<in>Pow(\\<Union>?T). B{is compact in}?T \\<and> B{is closed in}?T}}\"\n      unfolding OPCompactification_def using extension_pow_notDiscrete by auto\n    then obtain K where \"{csucc(nat)}={\\<Union>?T}\\<union>((\\<Union>?T)-K)\" by auto moreover\n    have \"\\<Union>?T\\<in>{\\<Union>?T}\\<union>((\\<Union>?T)-K)\" by auto\n    ultimately have \"\\<Union>?T\\<in>{csucc(nat)}\" by auto\n    with dist have \"False\" using extension_pow_union by auto\n  }\n  then have \"{csucc(nat)}\\<notin>({one-point compactification of}?T)\" by auto moreover\n  have \"\\<Union>({one-point compactification of}?T)-(\\<Union>({one-point compactification of}?T)-{csucc(nat)})={csucc(nat)}\" using extension_pow_union\n    topology0.op_compact_total unfolding topology0_def using extension_pow_top by auto ultimately\n  have di:\"\\<Union>({one-point compactification of}?T)-(\\<Union>({one-point compactification of}?T)-{csucc(nat)})\\<notin>({one-point compactification of}?T)\" by auto\n  {\n    assume \"(\\<Union>({one-point compactification of}?T)-{csucc(nat)}){is closed in}({one-point compactification of}?T)\"\n    then have \"\\<Union>({one-point compactification of}?T)-(\\<Union>({one-point compactification of}?T)-{csucc(nat)})\\<in>({one-point compactification of}?T)\" unfolding IsClosed_def by auto\n    with di have \"False\" by auto\n  }\n  then have n:\"\\<not>((\\<Union>({one-point compactification of}?T)-{csucc(nat)}){is closed in}({one-point compactification of}?T))\" by auto moreover\n  from dist have \"\\<Union>?T\\<in>(\\<Union>({one-point compactification of}?T)-{csucc(nat)})\" using topology0.op_compact_total unfolding topology0_def using extension_pow_top\n    extension_pow_union by auto\n  then have \"(\\<Union>({one-point compactification of}?T)-{csucc(nat)}){is compact in}({one-point compactification of}?T)\" using topology0.anti_comp_imp_OP_inf_comp[of \"?T\"\n    \"(\\<Union>({one-point compactification of}?T)-{csucc(nat)})\"] unfolding topology0_def using extension_pow_antiCompact extension_pow_top by auto\n  with ass have \"(\\<Union>({one-point compactification of}?T)-{csucc(nat)}){is closed in}({one-point compactification of}?T)\" unfolding IsKC_def by auto\n  with n show \"False\" by auto\nqed\n    \ntext\\<open>In conclusion, $US\\not\\Rightarrow KC$.\\<close>\n\nsubsection\\<open>Other types of properties\\<close>\n\ntext\\<open>In this section we will define new properties that\naren't defined as anti-properties and that are not separation axioms.\nIn some cases we will consider their anti-properties.\\<close>\n\nsubsection\\<open>Definitions\\<close>\n\ntext\\<open>A space is called perfect if it has no isolated points.\nThis definition may vary in the literature to similar, but not equivalent definitions.\\<close>\n\ndefinition\n  IsPerf (\"_ {is perfect}\") where\n  \"T{is perfect} \\<equiv> \\<forall>x\\<in>\\<Union>T. {x}\\<notin>T\"\n\ntext\\<open>An anti-perfect space is called scattered.\\<close>\n\ndefinition\n  IsScatt (\"_ {is scattered}\") where\n  \"T{is scattered} \\<equiv> T{is anti-}IsPerf\"\n\ntext\\<open>A topological space with two disjoint dense subspaces\nis called resolvable.\\<close>\n\ndefinition\n  IsRes (\"_ {is resolvable}\") where\n  \"T{is resolvable} \\<equiv> \\<exists>U\\<in>Pow(\\<Union>T). \\<exists>V\\<in>Pow(\\<Union>T). Closure(U,T)=\\<Union>T \\<and> Closure(V,T)=\\<Union>T \\<and> U\\<inter>V=0\"\n\ntext\\<open>A topological space where every dense subset is open\nis called submaximal.\\<close>\n\ndefinition\n  IsSubMax (\"_ {is submaximal}\") where\n  \"T{is submaximal} \\<equiv> \\<forall>U\\<in>Pow(\\<Union>T). Closure(U,T)=\\<Union>T \\<longrightarrow> U\\<in>T\"\n\ntext\\<open>A subset of a topological space is nowhere-dense if\nthe interior of its closure is empty.\\<close>\n\ndefinition\n  IsNowhereDense (\"_ {is nowhere dense in} _\") where\n  \"A{is nowhere dense in}T \\<equiv> A\\<subseteq>\\<Union>T \\<and> Interior(Closure(A,T),T)=0\"\n\ntext\\<open>A topological space is then a Luzin space if\nevery nowhere-dense subset is countable.\\<close>\n\ndefinition\n  IsLuzin (\"_ {is luzin}\") where\n  \"T{is luzin} \\<equiv> \\<forall>A\\<in>Pow(\\<Union>T). (A{is nowhere dense in}T) \\<longrightarrow> A\\<lesssim>nat\"\n\ntext\\<open>An also useful property is local-connexion.\\<close>\n\ndefinition\n  IsLocConn (\"_{is locally-connected}\") where\n  \"T{is locally-connected} \\<equiv> T{is locally}(\\<lambda>T. \\<lambda>B. ((T{restricted to}B){is connected}))\"\n\ntext\\<open>An SI-space is an anti-resolvable perfect space.\\<close>\n\ndefinition\n  IsAntiRes (\"_{is anti-resolvable}\") where\n  \"T{is anti-resolvable} \\<equiv> T{is anti-}IsRes\"\n\ndefinition\n  IsSI (\"_{is Strongly Irresolvable}\") where\n  \"T{is Strongly Irresolvable} \\<equiv> (T{is anti-resolvable}) \\<and> (T{is perfect})\"\n\nsubsection\\<open>First examples\\<close>\n\ntext\\<open>Firstly, we need to compute the spectrum of\nthe being perfect.\\<close>\n\nlemma spectrum_perfect:\n  shows \"(A{is in the spectrum of}IsPerf) \\<longleftrightarrow> A=0\"\nproof\n  assume \"A{is in the spectrum of}IsPerf\"\n  then have \"Pow(A){is perfect}\" unfolding Spec_def using Pow_is_top by auto\n  then have \"\\<forall>b\\<in>A. {b}\\<notin>Pow(A)\" unfolding IsPerf_def by auto\n  then show \"A=0\" by auto\nnext\n  assume A:\"A=0\"\n  {\n    fix T assume T:\"T{is a topology}\" \"\\<Union>T\\<approx>A\"\n    with T(2) A have \"\\<Union>T\\<approx>0\" by auto\n    then have \"\\<Union>T=0\" using eqpoll_0_is_0 by auto\n    then have \"T{is perfect}\" unfolding IsPerf_def by auto\n  }\n  then show \"A{is in the spectrum of}IsPerf\" unfolding Spec_def by auto\nqed\n\ntext\\<open>The discrete space is clearly scattered:\\<close>\n\nlemma pow_is_scattered:\n  shows \"Pow(A){is scattered}\"\nproof-\n  {\n    fix B assume B:\"B\\<subseteq>\\<Union>Pow(A)\" \"(Pow(A){restricted to}B){is perfect}\"\n    from B(1) have \"Pow(A){restricted to}B=Pow(B)\" unfolding RestrictedTo_def by blast\n    with B(2) have \"Pow(B){is perfect}\" by auto\n    then have \"\\<forall>b\\<in>B. {b}\\<notin>Pow(B)\" unfolding IsPerf_def by auto\n    then have \"B=0\" by auto\n  }\n  then show ?thesis using spectrum_perfect unfolding IsScatt_def antiProperty_def by auto\nqed\n\ntext\\<open>The trivial topology is perfect, if it is defined over a set with more than one point.\\<close>\n\nlemma trivial_is_perfect:\n  assumes \"\\<exists>x y. x\\<in>X \\<and> y\\<in>X \\<and> x\\<noteq>y\"\n  shows \"{0,X}{is perfect}\"\nproof-\n  {\n    fix r assume \"{r}\\<in>{0,X}\"\n    then have \"X={r}\" by auto\n    with assms have \"False\" by auto\n  }\n  then show ?thesis unfolding IsPerf_def by auto\nqed\n\ntext\\<open>The trivial topology is resolvable, if it is defined over a set with more than one point.\\<close>\n\nlemma trivial_is_resolvable:\n  assumes \"\\<exists>x y. x\\<in>X \\<and> y\\<in>X \\<and> x\\<noteq>y\"\n  shows \"{0,X}{is resolvable}\"\nproof-\n  from assms obtain x y where xy:\"x\\<in>X\" \"y\\<in>X\" \"x\\<noteq>y\" by auto\n  {\n    fix A assume A:\"A{is closed in}{0,X}\" \"A\\<subseteq>X\"\n    then have \"X-A\\<in>{0,X}\" unfolding IsClosed_def by auto\n    then have \"X-A=0\\<or>X-A=X\" by auto\n    with A(2) have \"A=X\\<or>X-A=X\" by auto moreover\n    {\n      assume \"X-A=X\"\n      then have \"X-(X-A)=0\" by auto\n      with A(2) have \"A=0\" by auto\n    }\n    ultimately have \"A=X\\<or>A=0\" by auto\n    then have \"A=0\\<or>A=X\" by auto\n  }\n  then have cl:\"\\<forall>A\\<in>Pow(X). A{is closed in}{0,X} \\<longrightarrow> A=0\\<or>A=X\" by auto\n  from xy(3) have \"{x}\\<inter>{y}=0\" by auto moreover\n  {\n    have \"{X}{is a partition of}X\" using indiscrete_partition xy(1) by auto\n    then have top:\"topology0(PTopology X {X})\" using topology0_ptopology by auto\n    have \"X\\<noteq>0\" using xy(1) by auto\n    then have \"(PTopology X {X})={0,X}\" using indiscrete_ptopology[of \"X\"] by auto\n    with top have top0:\"topology0({0,X})\" by auto\n    then have \"x\\<in>Closure({x},{0,X})\" using topology0.cl_contains_set xy(1) by auto moreover\n    have \"Closure({x},{0,X}) {is closed in}{0,X}\" using topology0.cl_is_closed top0 xy(1) by auto\n    moreover note cl\n    moreover have \"Closure({x},{0,X})\\<subseteq>X\" using topology0.Top_3_L11(1) top0 xy(1) by auto\n    ultimately have \"Closure({x},{0,X})=X\" by auto\n  }\n  moreover\n  {\n    have \"{X}{is a partition of}X\" using indiscrete_partition xy(1) by auto\n    then have top:\"topology0(PTopology X {X})\" using topology0_ptopology by auto\n    have \"X\\<noteq>0\" using xy(1) by auto\n    then have \"(PTopology X {X})={0,X}\" using indiscrete_ptopology[of \"X\"] by auto\n    with top have top0:\"topology0({0,X})\" by auto\n    then have \"y\\<in>Closure({y},{0,X})\" using topology0.cl_contains_set xy(2) by auto moreover\n    have \"Closure({y},{0,X}) {is closed in}{0,X}\" using topology0.cl_is_closed top0 xy(2) by auto\n    moreover note cl\n    moreover have \"Closure({y},{0,X})\\<subseteq>X\" using topology0.Top_3_L11(1) top0 xy(2) by auto\n    ultimately have \"Closure({y},{0,X})=X\" by auto\n  } \n  ultimately show ?thesis using xy(1,2) unfolding IsRes_def by auto\nqed\n\ntext\\<open>The spectrum of Luzin spaces is the class of countable sets, so there\nare lots of examples of Luzin spaces.\\<close>\n\nlemma spectrum_Luzin:\n  shows \"(A{is in the spectrum of}IsLuzin) \\<longleftrightarrow> A\\<lesssim>nat\"\nproof\n  assume A:\"A{is in the spectrum of}IsLuzin\"\n  {\n    assume \"A=0\"\n    then have \"A\\<lesssim>nat\" using empty_lepollI by auto\n  }\n  moreover\n  {\n    assume \"A\\<noteq>0\"\n    then obtain x where x:\"x\\<in>A\" by auto\n    {\n      fix M assume \"M\\<subseteq>{0,{x},A}\"\n      then have \"\\<Union>M\\<in>{0,{x},A}\" using x by blast\n    }\n    moreover\n    {\n      fix U V assume \"U\\<in>{0,{x},A}\" \"V\\<in>{0,{x},A}\"\n      then have \"U\\<inter>V\\<in>{0,{x},A}\" by auto\n    }\n    ultimately have top:\"{0,{x},A}{is a topology}\" unfolding IsATopology_def by auto\n    moreover have tot:\"\\<Union>{0,{x},A}=A\" using x by auto\n    moreover note A ultimately have luz:\"{0,{x},A}{is luzin}\" unfolding Spec_def by auto\n    moreover have \"{x}\\<in>{0,{x},A}\" by auto\n    then have \"((\\<Union>{0,{x},A})-{x}){is closed in}{0,{x},A}\" using topology0.Top_3_L9\n      unfolding topology0_def using top by blast\n    then have \"(A-{x}){is closed in}{0,{x},A}\" using tot by auto\n    then have \"Closure(A-{x},{0,{x},A})=A-{x}\" using tot top topology0.Top_3_L8[of \"{0,{x},A}\"]\n      unfolding topology0_def by auto\n    then have B:\"Interior(Closure(A-{x},{0,{x},A}),{0,{x},A})=Interior(A-{x},{0,{x},A})\" by auto\n    then have C:\"Interior(Closure(A-{x},{0,{x},A}),{0,{x},A})\\<subseteq>A-{x}\" using top topology0.Top_2_L1\n      unfolding topology0_def by auto\n    then have D:\"Interior(Closure(A-{x},{0,{x},A}),{0,{x},A})\\<in>{0,{x},A}\" using topology0.Top_2_L2 \n      unfolding topology0_def using top by auto\n    from x have \"\\<not>(A\\<subseteq>A-{x})\" by auto\n    with C D have \"Interior(Closure(A-{x},{0,{x},A}),{0,{x},A})=0\" by auto\n    then have \"(A-{x}){is nowhere dense in}{0,{x},A}\" unfolding IsNowhereDense_def using tot\n      by auto\n    with luz have \"A-{x}\\<lesssim>nat\" unfolding IsLuzin_def using tot by auto\n    then have U1:\"A-{x}\\<prec>csucc(nat)\" using Card_less_csucc_eq_le[OF Card_nat] by auto\n    have \"{x}\\<approx>1\" using singleton_eqpoll_1 by auto\n    then have \"{x}\\<prec>nat\" using n_lesspoll_nat eq_lesspoll_trans by auto\n    then have \"{x}\\<lesssim>nat\" using lesspoll_imp_lepoll by auto\n    then have U2:\"{x}\\<prec>csucc(nat)\" using Card_less_csucc_eq_le[OF Card_nat] by auto\n    with U1 have U:\"(A-{x})\\<union>{x}\\<prec>csucc(nat)\" using less_less_imp_un_less[OF _ _ InfCard_csucc[OF InfCard_nat]]\n      by auto\n    have \"(A-{x})\\<union>{x}=A\" using x by auto\n    with U have \"A\\<prec>csucc(nat)\" by auto\n    then have \"A\\<lesssim>nat\" using Card_less_csucc_eq_le[OF Card_nat] by auto\n  }\n  ultimately\n  show \"A\\<lesssim>nat\" by auto\nnext\n  assume A:\"A\\<lesssim>nat\"\n  {\n    fix T assume T:\"T{is a topology}\" \"\\<Union>T\\<approx>A\"\n    {\n      fix B assume \"B\\<subseteq>\\<Union>T\" \"B{is nowhere dense in}T\"\n      then have \"B\\<lesssim>\\<Union>T\" using subset_imp_lepoll by auto\n      with T(2) have \"B\\<lesssim>A\" using lepoll_eq_trans by auto\n      with A have \"B\\<lesssim>nat\" using lepoll_trans by blast\n    }\n    then have \"\\<forall>B\\<in>Pow(\\<Union>T). (B{is nowhere dense in}T) \\<longrightarrow> B\\<lesssim>nat\" by auto\n    then have \"T{is luzin}\" unfolding IsLuzin_def by auto\n  }\n  then show \"A{is in the spectrum of}IsLuzin\" unfolding Spec_def by auto\nqed\n\nsubsection\\<open>Structural results\\<close>\n\ntext\\<open>Every resolvable space is also perfect.\\<close>\n\ntheorem (in topology0) resolvable_imp_perfect:\n  assumes \"T{is resolvable}\"\n  shows \"T{is perfect}\"\nproof-\n  {\n    assume \"\\<not>(T{is perfect})\"\n    then obtain x where x:\"x\\<in>\\<Union>T\" \"{x}\\<in>T\" unfolding IsPerf_def by auto\n    then have cl:\"(\\<Union>T-{x}){is closed in}T\" using Top_3_L9 by auto\n    from assms obtain U V where UV:\"U\\<subseteq>\\<Union>T\" \"V\\<subseteq>\\<Union>T\" \"cl(U)=\\<Union>T\" \"cl(V)=\\<Union>T\" \"U\\<inter>V=0\" unfolding IsRes_def by auto\n    {\n      fix W assume \"x\\<notin>W\" \"W\\<subseteq>\\<Union>T\"\n      then have \"W\\<subseteq>\\<Union>T-{x}\" by auto\n      then have \"cl(W)\\<subseteq>\\<Union>T-{x}\" using cl Top_3_L13 by auto\n      with x(1) have \"\\<not>(\\<Union>T\\<subseteq>cl(W))\" by auto\n      then have \"\\<not>(cl(W)=\\<Union>T)\" by auto\n    }\n    with UV have \"False\" by auto\n  }\n  then show ?thesis by auto\nqed\n   \ntext\\<open>The spectrum of being resolvable follows:\\<close>\n\ncorollary spectrum_resolvable:\n  shows \"(A{is in the spectrum of}IsRes) \\<longleftrightarrow> A=0\"\nproof\n  assume A:\"A{is in the spectrum of}IsRes\"\n  have \"\\<forall>T. T{is a topology} \\<longrightarrow> IsRes(T) \\<longrightarrow> IsPerf(T)\" using topology0.resolvable_imp_perfect \n    unfolding topology0_def by auto\n  with A have \"A{is in the spectrum of}IsPerf\" using P_imp_Q_spec_inv[of IsRes IsPerf] by auto\n  then show \"A=0\" using spectrum_perfect by auto\nnext\n  assume A:\"A=0\"\n  {\n    fix T assume T:\"T{is a topology}\" \"\\<Union>T\\<approx>A\"\n    with T(2) A have \"\\<Union>T\\<approx>0\" by auto\n    then have \"\\<Union>T=0\" using eqpoll_0_is_0 by auto\n    then have \"Closure(0,T)=\\<Union>T\" using topology0.Top_3_L2 T(1)\n      topology0.Top_3_L8 unfolding topology0_def by auto\n    then have \"T{is resolvable}\" unfolding IsRes_def by auto\n  }\n  then show \"A{is in the spectrum of}IsRes\" unfolding Spec_def by auto\nqed\n\ntext\\<open>The cofinite space over $\\mathbb{N}$ is a $T_1$, perfect and luzin space.\\<close>\n\ntheorem cofinite_nat_perfect:\n  shows \"(CoFinite nat){is perfect}\"\nproof-\n  {\n    fix x assume x:\"x\\<in>\\<Union>(CoFinite nat)\" \"{x}\\<in>(CoFinite nat)\"\n    then have xn:\"x\\<in>nat\" using union_cocardinal unfolding Cofinite_def by auto\n    with x(2) have \"nat-{x}\\<prec>nat\" unfolding Cofinite_def CoCardinal_def by auto\n    moreover have \"Finite({x})\" by auto\n    then have \"{x}\\<prec>nat\" unfolding Finite_def using n_lesspoll_nat eq_lesspoll_trans by auto\n    ultimately have \"(nat-{x})\\<union>{x}\\<prec>nat\" using less_less_imp_un_less[OF _ _ InfCard_nat] by auto\n    moreover have \"(nat-{x})\\<union>{x}=nat\" using xn by auto\n    ultimately have \"False\" by auto\n  }\n  then show ?thesis unfolding IsPerf_def by auto\nqed\n\ntheorem cofinite_nat_luzin:\n  shows \"(CoFinite nat){is luzin}\"\nproof-\n  have \"nat{is in the spectrum of}IsLuzin\" using spectrum_Luzin by auto moreover\n  have \"\\<Union>(CoFinite nat)=nat\" using union_cocardinal unfolding Cofinite_def by auto\n  moreover have \"(CoFinite nat){is a topology}\" unfolding Cofinite_def using CoCar_is_topology[OF InfCard_nat]\n    by auto\n  ultimately show ?thesis unfolding Spec_def by auto\nqed\n\ntext\\<open>The cocountable topology on $\\mathbb{N}^+$ or \\<open>csucc(nat)\\<close> is also $T_1$,\nperfect and luzin; but defined on a set not in the spectrum.\\<close>\n\ntheorem cocountable_csucc_nat_perfect:\n  shows \"(CoCountable csucc(nat)){is perfect}\"\nproof-\n  have noE:\"csucc(nat)\\<noteq>0\" using lt_csucc[OF Ord_nat] by auto \n  {\n    fix x assume x:\"x\\<in>\\<Union>(CoCountable csucc(nat))\" \"{x}\\<in>(CoCountable csucc(nat))\"\n    then have xn:\"x\\<in>csucc(nat)\" using union_cocardinal noE unfolding Cocountable_def by auto\n    with x(2) have \"csucc(nat)-{x}\\<prec>csucc(nat)\" unfolding Cocountable_def CoCardinal_def by auto\n    moreover have \"Finite({x})\" by auto\n    then have \"{x}\\<prec>nat\" unfolding Finite_def using n_lesspoll_nat eq_lesspoll_trans by auto\n    then have \"{x}\\<lesssim>nat\" using lesspoll_imp_lepoll by auto\n    then have \"{x}\\<prec>csucc(nat)\" using Card_less_csucc_eq_le[OF Card_nat] by auto\n    ultimately have \"(csucc(nat)-{x})\\<union>{x}\\<prec>csucc(nat)\" using less_less_imp_un_less[OF _ _ InfCard_csucc[OF InfCard_nat]] by auto\n    moreover have \"(csucc(nat)-{x})\\<union>{x}=csucc(nat)\" using xn by auto\n    ultimately have \"False\" by auto\n  }\n  then show ?thesis unfolding IsPerf_def by auto\nqed\n\ntheorem cocountable_csucc_nat_luzin:\n  shows \"(CoCountable csucc(nat)){is luzin}\"\nproof-\n  have noE:\"csucc(nat)\\<noteq>0\" using lt_csucc[OF Ord_nat] by auto \n  {\n    fix B assume B:\"B\\<in>Pow(\\<Union>(CoCountable csucc(nat)))\" \"B{is nowhere dense in}(CoCountable csucc(nat))\" \"\\<not>(B\\<lesssim>nat)\"\n    from B(1) have \"B\\<subseteq>csucc(nat)\" using union_cocardinal noE unfolding Cocountable_def by auto moreover\n    from B(3) have \"\\<not>(B\\<prec>csucc(nat))\" using Card_less_csucc_eq_le[OF Card_nat] by auto ultimately\n    have \"Closure(B,CoCountable csucc(nat))=csucc(nat)\" using closure_set_cocardinal noE unfolding Cocountable_def by auto\n    then have \"Interior(Closure(B,CoCountable csucc(nat)),CoCountable csucc(nat))=Interior(csucc(nat),CoCountable csucc(nat))\" by auto\n    with B(2) have \"0=Interior(csucc(nat),CoCountable csucc(nat))\" unfolding IsNowhereDense_def by auto moreover\n    have \"csucc(nat)-csucc(nat)=0\" by auto\n    then have \"csucc(nat)-csucc(nat)\\<prec>csucc(nat)\" using empty_lepollI Card_less_csucc_eq_le[OF Card_nat] by auto\n    then have \"Interior(csucc(nat),CoCountable csucc(nat))=csucc(nat)\" using interior_set_cocardinal noE unfolding Cocountable_def by auto\n    ultimately have \"False\" using noE by auto\n  }\n  then have \"\\<forall>B\\<in>Pow(\\<Union>(CoCountable csucc(nat))). (B{is nowhere dense in}(CoCountable csucc(nat))) \\<longrightarrow> B\\<lesssim>nat\" by auto\n  then show ?thesis unfolding IsLuzin_def by auto\nqed\n\ntext\\<open>The existence of $T_2$, uncountable, perfect and luzin spaces is unprovable in \\emph{ZFC}.\nIt is related to the \\emph{CH} and Martin's axiom.\\<close>\n\nend\n\n\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/Topology_ZF_properties_3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165085228824, "lm_q2_score": 0.6224593312018546, "lm_q1q2_score": 0.3282330812268504}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nchapter {* More properties of maps plus map disjuction. *}\n\ntheory MapExtra\nimports \"~~/src/HOL/Main\"\nbegin\n\ntext {*\n  BEWARE: we are not interested in using the @{term \"dom x \\<inter> dom y = {}\"}\n  rules from Map for our separation logic proofs. As such, we overwrite the\n  Map rules where that form of disjointness is in the assumption conflicts\n  with a name we want to use with @{text \"\\<bottom>\"}. *}\n\ntext {*\n  A note on naming:\n  Anything not involving heap disjuction can potentially be incorporated\n  directly into Map.thy, thus uses @{text \"m\"}.\n  Anything involving heap disjunction is not really mergeable with Map, is\n  destined for use in separation logic, and hence uses @{text \"h\"}\n*}\n\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\ntext {* Things that should go into Option Type *}\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\n\ntext {* Misc option lemmas *}\n\nlemma None_not_eq: \"(None \\<noteq> x) = (\\<exists>y. x = Some y)\" by (cases x) auto\n\nlemma None_com: \"(None = x) = (x = None)\" by fast\n\nlemma Some_com: \"(Some y = x) = (x = Some y)\" by fast\n\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\ntext {* Things that should go into Map.thy *}\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\n\ntext {* Map intersection: set of all keys for which the maps agree. *}\n\ndefinition\n  map_inter :: \"('a \\<rightharpoonup> 'b) \\<Rightarrow> ('a \\<rightharpoonup> 'b) \\<Rightarrow> 'a set\" (infixl \"\\<inter>\\<^sub>m\" 70) where\n  \"m\\<^sub>1 \\<inter>\\<^sub>m m\\<^sub>2 \\<equiv> {x \\<in> dom m\\<^sub>1. m\\<^sub>1 x = m\\<^sub>2 x}\"\n\ntext {* Map restriction via domain subtraction *}\n\ndefinition\n  sub_restrict_map :: \"('a \\<rightharpoonup> 'b) => 'a set => ('a \\<rightharpoonup> 'b)\" (infixl \"`-\"  110)\n  where\n  \"m `- S \\<equiv> (\\<lambda>x. if x \\<in> S then None else m x)\"\n\nsubsection {* Properties of maps not related to restriction *}\n\nlemma empty_forall_equiv: \"(m = empty) = (\\<forall>x. m x = None)\"\n  by (fastforce intro!: ext)\n\nlemma map_le_empty2 [simp]:\n  \"(m \\<subseteq>\\<^sub>m empty) = (m = empty)\"\n  by (auto simp: map_le_def intro: ext)\n\nlemma dom_iff:\n  \"(\\<exists>y. m x = Some y) = (x \\<in> dom m)\"\n  by auto\n\nlemma non_dom_eval:\n  \"x \\<notin> dom m \\<Longrightarrow> m x = None\"\n  by auto\n\nlemma non_dom_eval_eq:\n  \"x \\<notin> dom m = (m x = None)\"\n  by auto\n\nlemma map_add_same_left_eq:\n  \"m\\<^sub>1 = m\\<^sub>1' \\<Longrightarrow> (m\\<^sub>0 ++ m\\<^sub>1 = m\\<^sub>0 ++ m\\<^sub>1')\"\n  by simp\n\nlemma map_add_left_cancelI [intro!]:\n  \"m\\<^sub>1 = m\\<^sub>1' \\<Longrightarrow> m\\<^sub>0 ++ m\\<^sub>1 = m\\<^sub>0 ++ m\\<^sub>1'\"\n  by simp\n\nlemma dom_empty_is_empty:\n  \"(dom m = {}) = (m = empty)\"\nproof (rule iffI)\n  assume a: \"dom m = {}\"\n  { assume \"m \\<noteq> empty\"\n    hence \"dom m \\<noteq> {}\"\n      by - (subst (asm) empty_forall_equiv, simp add: dom_def)\n    hence False using a by blast\n  }\n  thus \"m = empty\" by blast\nnext\n  assume a: \"m = empty\"\n  thus \"dom m = {}\" by simp\nqed\n\nlemma map_add_dom_eq:\n  \"dom m = dom m' \\<Longrightarrow> m ++ m' = m'\"\n  by (rule ext) (auto simp: map_add_def split: option.splits)\n\nlemma map_add_right_dom_eq:\n  \"\\<lbrakk> m\\<^sub>0 ++ m\\<^sub>1 = m\\<^sub>0' ++ m\\<^sub>1'; dom m\\<^sub>1 = dom m\\<^sub>1' \\<rbrakk> \\<Longrightarrow> m\\<^sub>1 = m\\<^sub>1'\"\n  unfolding map_add_def\n  by (rule ext, rule ccontr,\n      drule_tac x=x in fun_cong, clarsimp split: option.splits,\n      drule sym, drule sym, force+)\n\nlemma map_le_same_dom_eq:\n  \"\\<lbrakk> m\\<^sub>0 \\<subseteq>\\<^sub>m m\\<^sub>1 ; dom m\\<^sub>0 = dom m\\<^sub>1 \\<rbrakk> \\<Longrightarrow> m\\<^sub>0 = m\\<^sub>1\"\n  by (auto intro!: ext simp: map_le_def elim!: ballE)\n\nsubsection {* Properties of map restriction *}\n\nlemma restrict_map_cancel:\n  \"(m |` S = m |` T) = (dom m \\<inter> S = dom m \\<inter> T)\"\n  by (fastforce intro: set_eqI ext dest: fun_cong\n               simp: restrict_map_def None_not_eq\n               split: if_split_asm)\n\nlemma map_add_restricted_self [simp]:\n  \"m ++ m |` S = m\"\n  by (auto intro: ext simp: restrict_map_def map_add_def split: option.splits)\n\nlemma map_add_restrict_dom_right [simp]:\n  \"(m ++ m') |` dom m' = m'\"\n  by (rule ext, auto simp: restrict_map_def map_add_def split: option.splits)\n\nlemma restrict_map_UNIV [simp]:\n  \"m |` UNIV = m\"\n  by (simp add: restrict_map_def)\n\nlemma restrict_map_dom:\n  \"S = dom m \\<Longrightarrow> m |` S = m\"\n  by (auto intro!: ext simp: restrict_map_def None_not_eq)\n\nlemma restrict_map_subdom:\n  \"dom m \\<subseteq> S \\<Longrightarrow> m |` S = m\"\n  by (fastforce simp: restrict_map_def None_com intro: ext)\n\nlemma map_add_restrict:\n  \"(m\\<^sub>0 ++ m\\<^sub>1) |` S = ((m\\<^sub>0 |` S) ++ (m\\<^sub>1 |` S))\"\n  by (force simp: map_add_def restrict_map_def intro: ext)\n\nlemma map_le_restrict:\n  \"m \\<subseteq>\\<^sub>m m' \\<Longrightarrow> m = m' |` dom m\"\n  by (force simp: map_le_def restrict_map_def None_com intro: ext)\n\nlemma restrict_map_le:\n  \"m |` S \\<subseteq>\\<^sub>m m\"\n  by (auto simp: map_le_def)\n\nlemma restrict_map_remerge:\n  \"\\<lbrakk> S \\<inter> T = {} \\<rbrakk> \\<Longrightarrow> m |` S ++ m |` T = m |` (S \\<union> T)\"\n  by (rule ext, clarsimp simp: restrict_map_def map_add_def\n                         split: option.splits)\n\nlemma restrict_map_empty:\n  \"dom m \\<inter> S = {} \\<Longrightarrow> m |` S = empty\"\n  by (fastforce simp: restrict_map_def intro: ext)\n\nlemma map_add_restrict_comp_right [simp]:\n  \"(m |` S ++ m |` (UNIV - S)) = m\"\n  by (force simp: map_add_def restrict_map_def split: option.splits intro: ext)\n\nlemma map_add_restrict_comp_right_dom [simp]:\n  \"(m |` S ++ m |` (dom m - S)) = m\"\n  by (auto simp: map_add_def restrict_map_def split: option.splits intro!: ext)\n\nlemma map_add_restrict_comp_left [simp]:\n  \"(m |` (UNIV - S) ++ m |` S) = m\"\n  by (subst map_add_comm, auto)\n\nlemma restrict_self_UNIV:\n  \"m |` (dom m - S) = m |` (UNIV - S)\"\n  by (auto intro!: ext simp: restrict_map_def)\n\nlemma map_add_restrict_nonmember_right:\n  \"x \\<notin> dom m' \\<Longrightarrow> (m ++ m') |` {x} = m |` {x}\"\n  by (rule ext, auto simp: restrict_map_def map_add_def split: option.splits)\n\nlemma map_add_restrict_nonmember_left:\n  \"x \\<notin> dom m \\<Longrightarrow> (m ++ m') |` {x} = m' |` {x}\"\n  by (rule ext, auto simp: restrict_map_def map_add_def split: option.splits)\n\nlemma map_add_restrict_right:\n  \"x \\<subseteq> dom m' \\<Longrightarrow> (m ++ m') |` x = m' |` x\"\n  by (rule ext, auto simp: restrict_map_def map_add_def split: option.splits)\n\nlemma restrict_map_compose:\n  \"\\<lbrakk> S \\<union> T = dom m ; S \\<inter> T = {} \\<rbrakk> \\<Longrightarrow> m |` S ++ m |` T = m\"\n  by (fastforce intro: ext simp: map_add_def restrict_map_def)\n\nlemma map_le_dom_subset_restrict:\n  \"\\<lbrakk> m' \\<subseteq>\\<^sub>m m; dom m' \\<subseteq> S \\<rbrakk> \\<Longrightarrow> m' \\<subseteq>\\<^sub>m (m |` S)\"\n  by (force simp: restrict_map_def map_le_def)\n\nlemma map_le_dom_restrict_sub_add:\n  \"m' \\<subseteq>\\<^sub>m m \\<Longrightarrow> m |` (dom m - dom m') ++ m' = m\"\n  by (auto simp: None_com map_add_def restrict_map_def map_le_def\n           split: option.splits\n           intro!: ext)\n     (force simp: Some_com)+\n\nlemma subset_map_restrict_sub_add:\n  \"T \\<subseteq> S \\<Longrightarrow> m |` (S - T) ++ m |` T = m |` S\"\n  by (auto simp: restrict_map_def map_add_def intro!: ext split: option.splits)\n\nlemma restrict_map_sub_union:\n  \"m |` (dom m - (S \\<union> T)) = (m |` (dom m - T)) |` (dom m - S)\"\n  by (auto intro!: ext simp: restrict_map_def)\n\nlemma prod_restrict_map_add:\n  \"\\<lbrakk> S \\<union> T = U; S \\<inter> T = {} \\<rbrakk> \\<Longrightarrow> m |` (X \\<times> S) ++ m |` (X \\<times> T) = m |` (X \\<times> U)\"\n  by (auto simp: map_add_def restrict_map_def intro!: ext split: option.splits)\n\n\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\ntext {* Things that should NOT go into Map.thy *}\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\n\nsection {* Definitions *}\n\ntext {* Map disjuction *}\n\ndefinition\n  map_disj :: \"('a \\<rightharpoonup> 'b) \\<Rightarrow> ('a \\<rightharpoonup> 'b) \\<Rightarrow> bool\" (infix \"\\<bottom>\" 51) where\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<equiv> dom h\\<^sub>0 \\<inter> dom h\\<^sub>1 = {}\"\n\ndeclare None_not_eq [simp]\n\ntext {* Heap monotonicity and the frame property *}\n\ndefinition\n  heap_mono :: \"(('a \\<rightharpoonup> 'b) \\<Rightarrow> 'c option) \\<Rightarrow> bool\" where\n  \"heap_mono f \\<equiv> \\<forall>h h' v. h \\<bottom> h' \\<and> f h = Some v \\<longrightarrow> f (h ++ h') = Some v\"\n\nlemma heap_monoE:\n  \"\\<lbrakk> heap_mono f ; f h = Some v ; h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> f (h ++ h') = Some v\"\n  unfolding heap_mono_def by blast\n\nlemma heap_mono_simp:\n  \"\\<lbrakk> heap_mono f ; f h = Some v ; h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> f (h ++ h') = f h\"\n  by (frule (2) heap_monoE, simp)\n\ndefinition\n  heap_frame :: \"(('a \\<rightharpoonup> 'b) \\<Rightarrow> 'c option) \\<Rightarrow> bool\" where\n  \"heap_frame f \\<equiv> \\<forall>h h' v. h \\<bottom> h' \\<and> f (h ++ h') = Some v\n                           \\<longrightarrow> (f h = Some v \\<or> f h = None)\"\n\nlemma heap_frameE:\n  \"\\<lbrakk> heap_frame f ; f (h ++ h') = Some v ; h \\<bottom> h' \\<rbrakk>\n   \\<Longrightarrow> f h = Some v \\<or> f h = None\"\n  unfolding heap_frame_def by fastforce\n\n\nsection {* Properties of @{term \"sub_restrict_map\"} *}\n\n\n\nlemma restrict_map_sub_add: \"h |` S ++ h `- S = h\"\n  by (fastforce simp: sub_restrict_map_def restrict_map_def map_add_def\n               split: option.splits if_split)\n\n\nsection {* Properties of map disjunction *}\n\nlemma map_disj_empty_right [simp]:\n  \"h \\<bottom> empty\"\n  by (simp add: map_disj_def)\n\nlemma map_disj_empty_left [simp]:\n  \"empty \\<bottom> h\"\n  by (simp add: map_disj_def)\n\nlemma map_disj_com:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 = h\\<^sub>1 \\<bottom> h\\<^sub>0\"\n  by (simp add: map_disj_def, fast)\n\nlemma map_disjD:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> dom h\\<^sub>0 \\<inter> dom h\\<^sub>1 = {}\"\n  by (simp add: map_disj_def)\n\nlemma map_disjI:\n  \"dom h\\<^sub>0 \\<inter> dom h\\<^sub>1 = {} \\<Longrightarrow> h\\<^sub>0 \\<bottom> h\\<^sub>1\"\n  by (simp add: map_disj_def)\n\n\nsubsection {* Map associativity-commutativity based on map disjuction *}\n\nlemma map_add_com:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>1 ++ h\\<^sub>0\"\n  by (drule map_disjD, rule map_add_comm, force)\n\nlemma map_add_left_commute:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 ++ (h\\<^sub>1 ++ h\\<^sub>2) = h\\<^sub>1 ++ (h\\<^sub>0 ++ h\\<^sub>2)\"\n  by (simp add: map_add_com map_disj_com map_add_assoc)\n\nlemma map_add_disj:\n  \"h\\<^sub>0 \\<bottom> (h\\<^sub>1 ++ h\\<^sub>2) = (h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<and> h\\<^sub>0 \\<bottom> h\\<^sub>2)\"\n  by (simp add: map_disj_def, fast)\n\nlemma map_add_disj':\n  \"(h\\<^sub>1 ++ h\\<^sub>2) \\<bottom> h\\<^sub>0 = (h\\<^sub>1 \\<bottom> h\\<^sub>0 \\<and> h\\<^sub>2 \\<bottom> h\\<^sub>0)\"\n  by (simp add: map_disj_def, fast)\n\ntext {*\n  We redefine @{term \"map_add\"} associativity to bind to the right, which\n  seems to be the more common case.\n  Note that when a theory includes Map again, @{text \"map_add_assoc\"} will\n  return to the simpset and will cause infinite loops if its symmetric\n  counterpart is added (e.g. via @{text \"map_ac_simps\"})\n  *}\n\ndeclare map_add_assoc [simp del]\n\ntext {*\n  Since the associativity-commutativity of @{term \"map_add\"} relies on\n  map disjunction, we include some basic rules into the ac set.\n  *}\n\nlemmas map_ac_simps =\n  map_add_assoc[symmetric] map_add_com map_disj_com\n  map_add_left_commute map_add_disj map_add_disj'\n\n\nsubsection {* Basic properties *}\n\nlemma map_disj_None_right:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; x \\<in> dom h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> h\\<^sub>1 x = None\"\n  by (auto simp: map_disj_def dom_def)\n\nlemma map_disj_None_left:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; x \\<in> dom h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 x = None\"\n  by (auto simp: map_disj_def dom_def)\n\nlemma map_disj_None_left':\n  \"\\<lbrakk> h\\<^sub>0 x = Some y ; h\\<^sub>1 \\<bottom> h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> h\\<^sub>1 x = None \"\n  by (auto simp: map_disj_def)\n\nlemma map_disj_None_right':\n  \"\\<lbrakk> h\\<^sub>1 x = Some y ; h\\<^sub>1 \\<bottom> h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 x = None \"\n  by (auto simp: map_disj_def)\n\nlemma map_disj_common:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; h\\<^sub>0 p = Some v ; h\\<^sub>1 p = Some v' \\<rbrakk> \\<Longrightarrow> False\"\n  by (frule (1) map_disj_None_left', simp)\n\n\nsubsection {* Map disjunction and addition *}\n\nlemma map_add_eval_left:\n  \"\\<lbrakk> x \\<in> dom h ; h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> (h ++ h') x = h x\"\n  by (auto dest!: map_disj_None_right simp: map_add_def cong: option.case_cong)\n\nlemma map_add_eval_right:\n  \"\\<lbrakk> x \\<in> dom h' ; h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> (h ++ h') x = h' x\"\n  by (auto elim!: map_disjD simp: map_add_comm map_add_eval_left map_disj_com)\n\n\n\nlemma map_add_eval_right':\n  \"\\<lbrakk> x \\<notin> dom h ; h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> (h ++ h') x = h' x\"\n  by (clarsimp simp: map_disj_def map_add_def split: option.splits)\n\nlemma map_add_left_dom_eq:\n  assumes eq: \"h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>0' ++ h\\<^sub>1'\"\n  assumes etc: \"h\\<^sub>0 \\<bottom> h\\<^sub>1\" \"h\\<^sub>0' \\<bottom> h\\<^sub>1'\" \"dom h\\<^sub>0 = dom h\\<^sub>0'\"\n  shows \"h\\<^sub>0 = h\\<^sub>0'\"\nproof -\n  from eq have \"h\\<^sub>1 ++ h\\<^sub>0 = h\\<^sub>1' ++ h\\<^sub>0'\" using etc by (simp add: map_ac_simps)\n  thus ?thesis using etc\n    by (fastforce elim!: map_add_right_dom_eq simp: map_ac_simps)\nqed\n\nlemma map_add_left_eq:\n  assumes eq: \"h\\<^sub>0 ++ h = h\\<^sub>1 ++ h\"\n  assumes disj: \"h\\<^sub>0 \\<bottom> h\" \"h\\<^sub>1 \\<bottom> h\"\n  shows \"h\\<^sub>0 = h\\<^sub>1\"\nproof (rule ext)\n  fix x\n  from eq have eq': \"(h\\<^sub>0 ++ h) x = (h\\<^sub>1 ++ h) x\" by (auto intro!: ext)\n  { assume \"x \\<in> dom h\"\n    hence \"h\\<^sub>0 x = h\\<^sub>1 x\" using disj by (simp add: map_disj_None_left)\n  } moreover {\n    assume \"x \\<notin> dom h\"\n    hence \"h\\<^sub>0 x = h\\<^sub>1 x\" using disj eq' by (simp add: map_add_eval_left')\n  }\n  ultimately show \"h\\<^sub>0 x = h\\<^sub>1 x\" by cases\nqed\n\n\nlemma map_add_right_eq:\n  \"\\<lbrakk>h ++ h\\<^sub>0 = h ++ h\\<^sub>1; h\\<^sub>0 \\<bottom> h; h\\<^sub>1 \\<bottom> h\\<rbrakk> \\<Longrightarrow> h\\<^sub>0 = h\\<^sub>1\"\n  by (rule_tac h=h in map_add_left_eq, auto simp: map_ac_simps)\n\nlemma map_disj_add_eq_dom_right_eq:\n  assumes merge: \"h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>0' ++ h\\<^sub>1'\" and d: \"dom h\\<^sub>0 = dom h\\<^sub>0'\" and\n      ab_disj: \"h\\<^sub>0 \\<bottom> h\\<^sub>1\" and cd_disj: \"h\\<^sub>0' \\<bottom> h\\<^sub>1'\"\n  shows \"h\\<^sub>1 = h\\<^sub>1'\"\nproof (rule ext)\n  fix x\n  from merge have merge_x: \"(h\\<^sub>0 ++ h\\<^sub>1) x = (h\\<^sub>0' ++ h\\<^sub>1') x\" by simp\n  with d ab_disj cd_disj show  \"h\\<^sub>1 x = h\\<^sub>1' x\"\n    by - (case_tac \"h\\<^sub>1 x\", case_tac \"h\\<^sub>1' x\", simp, fastforce simp: map_disj_def,\n          case_tac \"h\\<^sub>1' x\", clarsimp, simp add: Some_com,\n          force simp: map_disj_def, simp)\nqed\n\nlemma map_disj_add_eq_dom_left_eq:\n  assumes add: \"h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>0' ++ h\\<^sub>1'\" and\n          dom: \"dom h\\<^sub>1 = dom h\\<^sub>1'\" and\n          disj: \"h\\<^sub>0 \\<bottom> h\\<^sub>1\" \"h\\<^sub>0' \\<bottom> h\\<^sub>1'\"\n  shows \"h\\<^sub>0 = h\\<^sub>0'\"\nproof -\n  have \"h\\<^sub>1 ++ h\\<^sub>0 = h\\<^sub>1' ++ h\\<^sub>0'\" using add disj by (simp add: map_ac_simps)\n  thus ?thesis using dom disj\n    by - (rule map_disj_add_eq_dom_right_eq, auto simp: map_disj_com)\nqed\n\nlemma map_add_left_cancel:\n  assumes disj: \"h\\<^sub>0 \\<bottom> h\\<^sub>1\" \"h\\<^sub>0 \\<bottom> h\\<^sub>1'\"\n  shows \"(h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>0 ++ h\\<^sub>1') = (h\\<^sub>1 = h\\<^sub>1')\"\nproof (rule iffI, rule ext)\n  fix x\n  assume \"(h\\<^sub>0 ++ h\\<^sub>1) = (h\\<^sub>0 ++ h\\<^sub>1')\"\n  hence \"(h\\<^sub>0 ++ h\\<^sub>1) x = (h\\<^sub>0 ++ h\\<^sub>1') x\" by (auto intro!: ext)\n  hence \"h\\<^sub>1 x = h\\<^sub>1' x\" using disj\n    by - (cases \"x \\<in> dom h\\<^sub>0\",\n          simp_all add: map_disj_None_right map_add_eval_right')\n  thus \"h\\<^sub>1 x = h\\<^sub>1' x\" by (auto intro!: ext)\nqed auto\n\nlemma map_add_lr_disj:\n  \"\\<lbrakk> h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>0' ++ h\\<^sub>1'; h\\<^sub>1 \\<bottom> h\\<^sub>1'  \\<rbrakk> \\<Longrightarrow> dom h\\<^sub>1 \\<subseteq> dom h\\<^sub>0'\"\n  by (clarsimp simp: map_disj_def map_add_def, drule_tac x=x in fun_cong)\n     (auto split: option.splits)\n\n\nsubsection {* Map disjunction and updates *}\n\nlemma map_disj_update_left [simp]:\n  \"p \\<in> dom h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 \\<bottom> h\\<^sub>1(p \\<mapsto> v) = h\\<^sub>0 \\<bottom> h\\<^sub>1\"\n  by (clarsimp simp add: map_disj_def, blast)\n\nlemma map_disj_update_right [simp]:\n  \"p \\<in> dom h\\<^sub>1 \\<Longrightarrow> h\\<^sub>1(p \\<mapsto> v) \\<bottom> h\\<^sub>0 = h\\<^sub>1 \\<bottom> h\\<^sub>0\"\n  by (simp add: map_disj_com)\n\nlemma map_add_update_left:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; p \\<in> dom h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> (h\\<^sub>0 ++ h\\<^sub>1)(p \\<mapsto> v) = (h\\<^sub>0(p \\<mapsto> v) ++ h\\<^sub>1)\"\n  by (drule (1) map_disj_None_right)\n     (auto intro: ext simp: map_add_def cong: option.case_cong)\n\nlemma map_add_update_right:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; p \\<in> dom h\\<^sub>1  \\<rbrakk> \\<Longrightarrow> (h\\<^sub>0 ++ h\\<^sub>1)(p \\<mapsto> v) = (h\\<^sub>0 ++ h\\<^sub>1 (p \\<mapsto> v))\"\n  by (drule (1) map_disj_None_left)\n     (auto intro: ext simp: map_add_def cong: option.case_cong)\n\n\n\n\nsubsection {* Map disjunction and @{term \"map_le\"} *}\n\nlemma map_le_override [simp]:\n  \"\\<lbrakk> h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> h \\<subseteq>\\<^sub>m h ++ h'\"\n  by (auto simp: map_le_def map_add_def map_disj_def split: option.splits)\n\nlemma map_leI_left:\n  \"\\<lbrakk> h = h\\<^sub>0 ++ h\\<^sub>1 ; h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 \\<subseteq>\\<^sub>m h\" by auto\n\nlemma map_leI_right:\n  \"\\<lbrakk> h = h\\<^sub>0 ++ h\\<^sub>1 ; h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>1 \\<subseteq>\\<^sub>m h\" by auto\n\nlemma map_disj_map_le:\n  \"\\<lbrakk> h\\<^sub>0' \\<subseteq>\\<^sub>m h\\<^sub>0; h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0' \\<bottom> h\\<^sub>1\"\n  by (force simp: map_disj_def map_le_def)\n\nlemma map_le_on_disj_left:\n  \"\\<lbrakk> h' \\<subseteq>\\<^sub>m h ; h\\<^sub>0 \\<bottom> h\\<^sub>1 ; h' = h\\<^sub>0 ++ h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 \\<subseteq>\\<^sub>m h\"\n  unfolding map_le_def\n  by (rule ballI, erule_tac x=a in ballE, auto simp: map_add_eval_left)+\n\nlemma map_le_on_disj_right:\n  \"\\<lbrakk> h' \\<subseteq>\\<^sub>m h ; h\\<^sub>0 \\<bottom> h\\<^sub>1 ; h' = h\\<^sub>1 ++ h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 \\<subseteq>\\<^sub>m h\"\n  by (auto simp: map_le_on_disj_left map_ac_simps)\n\nlemma map_le_add_cancel:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; h\\<^sub>0' \\<subseteq>\\<^sub>m h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0' ++ h\\<^sub>1 \\<subseteq>\\<^sub>m h\\<^sub>0 ++ h\\<^sub>1\"\n  by (auto simp: map_le_def map_add_def map_disj_def split: option.splits)\n\nlemma map_le_override_bothD:\n  assumes subm: \"h\\<^sub>0' ++ h\\<^sub>1 \\<subseteq>\\<^sub>m h\\<^sub>0 ++ h\\<^sub>1\"\n  assumes disj': \"h\\<^sub>0' \\<bottom> h\\<^sub>1\"\n  assumes disj: \"h\\<^sub>0 \\<bottom> h\\<^sub>1\"\n  shows \"h\\<^sub>0' \\<subseteq>\\<^sub>m h\\<^sub>0\"\nunfolding map_le_def\nproof (rule ballI)\n  fix a\n  assume a: \"a \\<in> dom h\\<^sub>0'\"\n  hence sumeq: \"(h\\<^sub>0' ++ h\\<^sub>1) a = (h\\<^sub>0 ++ h\\<^sub>1) a\"\n    using subm unfolding map_le_def by auto\n  from a have \"a \\<notin> dom h\\<^sub>1\" using disj' by (auto dest!: map_disj_None_right)\n  thus \"h\\<^sub>0' a = h\\<^sub>0 a\" using a sumeq disj disj'\n    by (simp add: map_add_eval_left map_add_eval_left')\nqed\n\nlemma map_le_conv:\n  \"(h\\<^sub>0' \\<subseteq>\\<^sub>m h\\<^sub>0 \\<and> h\\<^sub>0' \\<noteq> h\\<^sub>0) = (\\<exists>h\\<^sub>1. h\\<^sub>0 = h\\<^sub>0' ++ h\\<^sub>1 \\<and> h\\<^sub>0' \\<bottom> h\\<^sub>1 \\<and> h\\<^sub>0' \\<noteq> h\\<^sub>0)\"\n  unfolding map_le_def map_disj_def map_add_def\n  by (rule iffI,\n      clarsimp intro!: exI[where x=\"\\<lambda>x. if x \\<notin> dom h\\<^sub>0' then h\\<^sub>0 x else None\"])\n     (fastforce intro: ext intro: set_eqI split: option.splits if_split_asm)+\n\nlemma map_le_conv2:\n  \"h\\<^sub>0' \\<subseteq>\\<^sub>m h\\<^sub>0 = (\\<exists>h\\<^sub>1. h\\<^sub>0 = h\\<^sub>0' ++ h\\<^sub>1 \\<and> h\\<^sub>0' \\<bottom> h\\<^sub>1)\"\n  by (case_tac \"h\\<^sub>0'=h\\<^sub>0\", insert map_le_conv, auto intro: exI[where x=empty])\n\n\nsubsection {* Map disjunction and restriction *}\n\nlemma map_disj_comp [simp]:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 |` (UNIV - dom h\\<^sub>0)\"\n  by (force simp: map_disj_def)\n\nlemma restrict_map_disj:\n  \"S \\<inter> T = {} \\<Longrightarrow> h |` S \\<bottom> h |` T\"\n  by (auto simp: map_disj_def restrict_map_def dom_def)\n\nlemma map_disj_restrict_dom [simp]:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 |` (dom h\\<^sub>1 - dom h\\<^sub>0)\"\n  by (force simp: map_disj_def)\n\nlemma restrict_map_disj_dom_empty:\n  \"h \\<bottom> h' \\<Longrightarrow> h |` dom h' = empty\"\n  by (fastforce simp: map_disj_def restrict_map_def intro: ext)\n\nlemma restrict_map_univ_disj_eq:\n  \"h \\<bottom> h' \\<Longrightarrow> h |` (UNIV - dom h') = h\"\n  by (rule ext, auto simp: map_disj_def restrict_map_def)\n\nlemma restrict_map_disj_dom:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> h |` dom h\\<^sub>0 \\<bottom> h |` dom h\\<^sub>1\"\n  by (auto simp: map_disj_def restrict_map_def dom_def)\n\nlemma map_add_restrict_dom_left:\n  \"h \\<bottom> h' \\<Longrightarrow> (h ++ h') |` dom h = h\"\n  by (rule ext, auto simp: restrict_map_def map_add_def dom_def map_disj_def\n                     split: option.splits)\n\n\n\nlemma restrict_map_disj_right:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 \\<bottom> h\\<^sub>1 |` S\"\n  by (auto simp: map_disj_def)\n\nlemmas restrict_map_disj_both = restrict_map_disj_right restrict_map_disj_left\n\nlemma map_dom_disj_restrict_right:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> (h\\<^sub>0 ++ h\\<^sub>0') |` dom h\\<^sub>1 = h\\<^sub>0' |` dom h\\<^sub>1\"\n  by (simp add: map_add_restrict restrict_map_empty map_disj_def)\n\nlemma restrict_map_on_disj:\n  \"h\\<^sub>0' \\<bottom> h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 |` dom h\\<^sub>0' \\<bottom> h\\<^sub>1\"\n  unfolding map_disj_def by auto\n\nlemma restrict_map_on_disj':\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 \\<bottom> h\\<^sub>1 |` S\"\n  by (auto simp: map_disj_def map_add_def)\n\nlemma map_le_sub_dom:\n  \"\\<lbrakk> h\\<^sub>0 ++ h\\<^sub>1 \\<subseteq>\\<^sub>m h ; h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 \\<subseteq>\\<^sub>m h |` (dom h - dom h\\<^sub>1)\"\n  by (rule map_le_override_bothD, subst map_le_dom_restrict_sub_add)\n     (auto elim: map_add_le_mapE simp: map_ac_simps)\n\nlemma map_submap_break:\n  \"\\<lbrakk> h \\<subseteq>\\<^sub>m h' \\<rbrakk> \\<Longrightarrow> h' = (h' |` (UNIV - dom h)) ++ h\"\n  by (fastforce intro!: ext split: option.splits\n               simp: map_le_restrict restrict_map_def map_le_def map_add_def\n                     dom_def)\n\nlemma map_add_disj_restrict_both:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1; S \\<inter> S' = {}; T \\<inter> T' = {} \\<rbrakk>\n   \\<Longrightarrow> (h\\<^sub>0 |` S) ++ (h\\<^sub>1 |` T) \\<bottom> (h\\<^sub>0 |` S') ++ (h\\<^sub>1 |` T')\"\n  by (auto simp: map_ac_simps intro!: restrict_map_disj_both restrict_map_disj)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/c-parser/umm_heap/MapExtra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.6513548714339145, "lm_q1q2_score": 0.3282217389197254}}
{"text": "theory Friend_Request\n  imports\n    \"Friend_Request_Value_Setup\"\n    \"Bounded_Deducibility_Security.Compositional_Reasoning\"\nbegin\n\nsubsection \\<open>Declassification bound\\<close>\n\ncontext Friend\nbegin\n\nfun T :: \"(state,act,out) trans \\<Rightarrow> bool\"\nwhere \"T trn = False\"\n\ntext \\<open>Friendship updates form an alternating sequence of friending and unfriending,\nand every successful friend creation is preceded by one or two friendship requests.\\<close>\n\nfun validValSeq :: \"value list \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> bool\" where\n  \"validValSeq [] _ _ _ = True\"\n| \"validValSeq (FRVal U1 req # vl) st r1 r2 \\<longleftrightarrow> (\\<not>st) \\<and> (\\<not>r1) \\<and> validValSeq vl st True r2\"\n| \"validValSeq (FRVal U2 req # vl) st r1 r2 \\<longleftrightarrow> (\\<not>st) \\<and> (\\<not>r2) \\<and> validValSeq vl st r1 True\"\n| \"validValSeq (FVal True # vl) st r1 r2 \\<longleftrightarrow> (\\<not>st) \\<and> (r1 \\<or> r2) \\<and> validValSeq vl True False False\"\n| \"validValSeq (FVal False # vl) st r1 r2 \\<longleftrightarrow> st \\<and> (\\<not>r1) \\<and> (\\<not>r2) \\<and> validValSeq vl False False False\"\n| \"validValSeq (OVal True # vl) st r1 r2 \\<longleftrightarrow> validValSeq vl st r1 r2\"\n| \"validValSeq (OVal False # vl) st r1 r2 \\<longleftrightarrow> validValSeq vl st r1 r2\"\n\nabbreviation validValSeqFrom :: \"value list \\<Rightarrow> state \\<Rightarrow> bool\"\nwhere \"validValSeqFrom vl s\n \\<equiv> validValSeq vl (friends12 s) (UID1 \\<in>\\<in> pendingFReqs s UID2) (UID2 \\<in>\\<in> pendingFReqs s UID1)\"\n\ntext \\<open>With respect to the friendship status updates, we use the same\n``while-or-last-before'' bound as for friendship status confidentiality.\\<close>\n\ninductive BO :: \"value list \\<Rightarrow> value list \\<Rightarrow> bool\"\nand BC :: \"value list \\<Rightarrow> value list \\<Rightarrow> bool\"\nwhere\n BO_FVal[simp,intro!]:\n  \"BO (map FVal fs) (map FVal fs)\"\n|BO_BC[intro]:\n  \"BC vl vl1 \\<Longrightarrow>\n   BO (map FVal fs @ OVal False # vl) (map FVal fs @ OVal False # vl1)\"\n(*  *)\n|BC_FVal[simp,intro!]:\n  \"BC (map FVal fs) (map FVal fs1)\"\n|BC_BO[intro]:\n  \"BO vl vl1 \\<Longrightarrow> (fs = [] \\<longleftrightarrow> fs1 = []) \\<Longrightarrow> (fs \\<noteq> [] \\<Longrightarrow> last fs = last fs1) \\<Longrightarrow>\n   BC (map FVal fs  @ OVal True # vl)\n      (map FVal fs1 @ OVal True # vl1)\"\n\ntext \\<open>Taking into account friendship requests, two value sequences \\<open>vl\\<close> and \\<open>vl1\\<close> are in the bound if\n  \\<^item> \\<open>vl1\\<close> (with friendship requests) forms a valid value sequence,\n  \\<^item> \\<open>vl\\<close> and \\<open>vl1\\<close> are in \\<open>BO\\<close> (without friendship requests),\n  \\<^item> \\<open>vl1\\<close> is empty if \\<open>vl\\<close> is empty, and\n  \\<^item> \\<open>vl1\\<close> begins with \\<^term>\\<open>OVal False\\<close> if \\<open>vl\\<close> begins with \\<^term>\\<open>OVal False\\<close>.\n\nThe last two points are due to the fact that \\<^term>\\<open>UID1\\<close> and \\<^term>\\<open>UID1\\<close> might not exist yet\nif \\<open>vl\\<close> is empty (or before \\<^term>\\<open>OVal False\\<close>), in which case the observer can deduce that no\nfriendship request has happened yet.\\<close>\n\ndefinition \"B vl vl1 \\<equiv> BO (filter (Not o isFRVal) vl) (filter (Not o isFRVal) vl1) \\<and>\n                       validValSeqFrom vl1 istate \\<and>\n                       (vl = [] \\<longrightarrow> vl1 = []) \\<and>\n                       (vl \\<noteq> [] \\<and> hd vl = OVal False \\<longrightarrow> vl1 \\<noteq> [] \\<and> hd vl1 = OVal False)\"\n\n\nlemma BO_Nil_iff: \"BO vl vl1 \\<Longrightarrow> vl = [] \\<longleftrightarrow> vl1 = []\"\nby (cases rule: BO.cases) auto\n\n\nsublocale BD_Security_IO where\nistate = istate and step = step and\n\\<phi> = \\<phi> and f = f and \\<gamma> = \\<gamma> and g = g and T = T and B = B\ndone\n\nsubsection \\<open>Unwinding proof\\<close>\n\n(* sanity check *) lemma validFrom_validValSeq:\nassumes \"validFrom s tr\"\nand \"reach s\"\nshows \"validValSeqFrom (V tr) s\"\nusing assms proof (induction tr arbitrary: s)\n  case (Cons trn tr s)\n    then obtain a ou s' where trn: \"trn = Trans s a ou s'\"\n                          and step: \"step s a = (ou, s')\"\n                          and tr: \"validFrom s' tr\"\n                          and s': \"reach s'\"\n      by (cases trn) (auto iff: validFrom_Cons intro: reach_PairI)\n    then have vVS_tr: \"validValSeqFrom (V tr) s'\" by (intro Cons.IH)\n    show ?case proof cases\n      assume \\<phi>: \"\\<phi> (Trans s a ou s')\"\n      then have V: \"V (Trans s a ou s' # tr) = f (Trans s a ou s') # V tr\" by auto\n      from \\<phi> vVS_tr Cons.prems step show ?thesis unfolding trn V by (elim \\<phi>E) auto\n    next\n      assume \"\\<not>\\<phi> (Trans s a ou s')\"\n      then have \"V (Trans s a ou s' # tr) = V tr\" and \"friends12 s' = friends12 s\"\n            and \"UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s UID2\"\n            and \"UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s UID1\"\n        using step_friends12_\\<phi>[OF step] step_pendingFReqs_\\<phi>[OF step] by auto\n      with vVS_tr show ?thesis unfolding trn by auto\n    qed\nqed auto\n\nlemma \"validFrom istate tr \\<Longrightarrow> validValSeqFrom (V tr) istate\"\nusing validFrom_validValSeq[of istate] reach.Istate unfolding istate_def friends12_def\nby auto\n\n\n(* helper *) lemma produce_FRVal:\nassumes rs: \"reach s\"\nand IDs: \"IDsOK s [UID1, UID2] [] [] []\"\nand vVS: \"validValSeqFrom (FRVal u req # vl) s\"\nobtains a uid uid' s'\nwhere \"step s a = (outOK, s')\"\n  and \"a = Cact (cFriendReq uid (pass s uid) uid' req)\"\n  and \"uid = UID1 \\<and> uid' = UID2 \\<or> uid = UID2 \\<and> uid' = UID1\"\n  and \"\\<phi> (Trans s a outOK s')\"\n  and \"f (Trans s a outOK s') = FRVal u req\"\n  and \"validValSeqFrom vl s'\"\nproof (cases u)\n  case U1\n    then have \"step s (Cact (cFriendReq UID1 (pass s UID1) UID2 req)) =\n                 (outOK, createFriendReq s UID1 (pass s UID1) UID2 req)\"\n          and \"\\<not>friends12 (createFriendReq s UID1 (pass s UID1) UID2 req)\"\n      using IDs vVS reach_friendIDs_symmetric[OF rs] by (auto simp: c_defs friends12_def)\n    then show thesis using U1 vVS UID1_UID2 by (intro that[of _ _ UID1 UID2]) (auto simp: c_defs)\nnext\n  case U2\n    then have \"step s (Cact (cFriendReq UID2 (pass s UID2) UID1 req)) =\n                 (outOK, createFriendReq s UID2 (pass s UID2) UID1 req)\"\n          and \"\\<not>friends12 (createFriendReq s UID2 (pass s UID2) UID1 req)\"\n      using IDs vVS reach_friendIDs_symmetric[OF rs] by (auto simp: c_defs friends12_def)\n    then show thesis using U2 vVS UID1_UID2 by (intro that[of _ _ UID2 UID1]) (auto simp: c_defs)\nqed\n\n(* helper *) lemma toggle_friends12_True:\nassumes rs: \"reach s\"\n    and IDs: \"IDsOK s [UID1, UID2] [] [] []\"\n    and nf12: \"\\<not>friends12 s\"\n    and vVS: \"validValSeqFrom (FVal True # vl) s\"\nobtains a uid uid' s'\nwhere \"step s a = (outOK, s')\"\n  and \"a = Cact (cFriend uid (pass s uid) uid')\"\n  and \"s' = createFriend s UID1 (pass s UID1) UID2\"\n  and \"uid = UID1 \\<and> uid' = UID2 \\<or> uid = UID2 \\<and> uid' = UID1\"\n  and \"friends12 s'\"\n  and \"eqButUID s s'\"\n  and \"\\<phi> (Trans s a outOK s')\"\n  and \"f (Trans s a outOK s') = FVal True\"\n  and \"\\<not>\\<gamma> (Trans s a outOK s')\"\n  and \"validValSeqFrom vl s'\"\nproof -\n  from vVS have \"UID1 \\<in>\\<in> pendingFReqs s UID2 \\<or> UID2 \\<in>\\<in> pendingFReqs s UID1\" by auto\n  then show thesis proof\n    assume pFR: \"UID1 \\<in>\\<in> pendingFReqs s UID2\"\n    let ?a = \"Cact (cFriend UID2 (pass s UID2) UID1)\"\n    let ?s' = \"createFriend s UID1 (pass s UID1) UID2\"\n    let ?trn = \"Trans s ?a outOK ?s'\"\n    have step: \"step s ?a = (outOK, ?s')\" using IDs pFR UID1_UID2\n      unfolding createFriend_sym[of \"s\" \"UID1\" \"pass s UID1\" \"UID2\" \"pass s UID2\"]\n      by (auto simp add: c_defs)\n    moreover then have \"\\<phi> ?trn\" and \"f ?trn = FVal True\" and \"friends12 ?s'\"\n                   and \"UID1 \\<notin> set (pendingFReqs ?s' UID2)\"\n                   and \"UID2 \\<notin> set (pendingFReqs ?s' UID1)\"\n      using reach_distinct_friends_reqs[OF rs] by (auto simp: c_defs friends12_def)\n    moreover have \"\\<not>\\<gamma> ?trn\" using UID1_UID2_UIDs by auto\n    ultimately show thesis using nf12 rs vVS\n      by (intro that[of \"?a\" \"?s'\" UID2 UID1]) (auto intro: Cact_cFriend_step_eqButUID)\n  next\n    assume pFR: \"UID2 \\<in>\\<in> pendingFReqs s UID1\"\n    let ?a = \"Cact (cFriend UID1 (pass s UID1) UID2)\"\n    let ?s' = \"createFriend s UID1 (pass s UID1) UID2\"\n    let ?trn = \"Trans s ?a outOK ?s'\"\n    have step: \"step s ?a = (outOK, ?s')\" using IDs pFR UID1_UID2 by (auto simp add: c_defs)\n    moreover then have \"\\<phi> ?trn\" and \"f ?trn = FVal True\" and \"friends12 ?s'\"\n                   and \"UID1 \\<notin> set (pendingFReqs ?s' UID2)\"\n                   and \"UID2 \\<notin> set (pendingFReqs ?s' UID1)\"\n      using reach_distinct_friends_reqs[OF rs] by (auto simp: c_defs friends12_def)\n    moreover have \"\\<not>\\<gamma> ?trn\" using UID1_UID2_UIDs by auto\n    ultimately show thesis using nf12 rs vVS\n      by (intro that[of \"?a\" \"?s'\" UID1 UID2]) (auto intro: Cact_cFriend_step_eqButUID)\n  qed\nqed\n\n(* helper *) lemma toggle_friends12_False:\nassumes rs: \"reach s\"\n    and IDs: \"IDsOK s [UID1, UID2] [] [] []\"\n    and f12: \"friends12 s\"\n    and vVS: \"validValSeqFrom (FVal False # vl) s\"\nobtains a s'\nwhere \"step s a = (outOK, s')\"\n  and \"a = Dact (dFriend UID1 (pass s UID1) UID2)\"\n  and \"s' = deleteFriend s UID1 (pass s UID1) UID2\"\n  and \"\\<not>friends12 s'\"\n  and \"eqButUID s s'\"\n  and \"\\<phi> (Trans s a outOK s')\"\n  and \"f (Trans s a outOK s') = FVal False\"\n  and \"\\<not>\\<gamma> (Trans s a outOK s')\"\n  and \"validValSeqFrom vl s'\"\nproof -\n  let ?a = \"Dact (dFriend UID1 (pass s UID1) UID2)\"\n  let ?s' = \"deleteFriend s UID1 (pass s UID1) UID2\"\n  let ?trn = \"Trans s ?a outOK ?s'\"\n  have \"UID1 \\<notin> set (pendingFReqs s UID2)\" \"UID2 \\<notin> set (pendingFReqs s UID1)\"\n    using f12 reach_distinct_friends_reqs[OF rs] unfolding friends12_def by auto\n  then have step: \"step s ?a = (outOK, ?s')\"\n        and \"UID1 \\<notin> set (pendingFReqs ?s' UID2)\" \"UID2 \\<notin> set (pendingFReqs ?s' UID1)\"\n    using IDs f12 UID1_UID2 by (auto simp add: d_defs friends12_def)\n  moreover then have \"\\<phi> ?trn\" and \"f ?trn = FVal False\" and \"\\<not>friends12 ?s'\"\n    using reach_friendIDs_symmetric[OF rs] by (auto simp: d_defs friends12_def)\n  moreover have \"\\<not>\\<gamma> ?trn\" using UID1_UID2_UIDs by auto\n  ultimately show thesis using f12 rs vVS\n    by (intro that[of ?a ?s']) (auto intro: Dact_dFriend_step_eqButUID)\nqed\n\nlemma toggle_friends12:\nassumes rs: \"reach s\"\n    and IDs: \"IDsOK s [UID1, UID2] [] [] []\"\n    and f12: \"friends12 s \\<noteq> fv\"\n    and vVS: \"validValSeqFrom (FVal fv # vl) s\"\nobtains a s'\nwhere \"step s a = (outOK, s')\"\n  and \"friends12 s' = fv\"\n  and \"eqButUID s s'\"\n  and \"\\<phi> (Trans s a outOK s')\"\n  and \"f (Trans s a outOK s') = FVal fv\"\n  and \"\\<not>\\<gamma> (Trans s a outOK s')\"\n  and \"validValSeqFrom vl s'\"\nproof (cases \"friends12 s\")\n  case True\n    moreover then have \"UID1 \\<notin> set (pendingFReqs s UID2)\" \"UID2 \\<notin> set (pendingFReqs s UID1)\"\n                   and \"fv = False\"\n                   and vVS: \"validValSeqFrom (FVal False # vl) s\"\n      using reach_distinct_friends_reqs[OF rs] vVS f12 unfolding friends12_def by auto\n    moreover then have \"UID1 \\<notin> set (pendingFReqs (deleteFriend s UID1 (pass s UID1) UID2) UID2)\"\n                       \"UID2 \\<notin> set (pendingFReqs (deleteFriend s UID1 (pass s UID1) UID2) UID1)\"\n      by (auto simp: d_defs)\n    ultimately show thesis using assms\n      by (elim toggle_friends12_False, blast, blast, blast) (elim that, blast+)\nnext\n  case False\n    moreover then have \"fv = True\"\n                   and vVS: \"validValSeqFrom (FVal True # vl) s\"\n      using vVS f12 by auto\n    moreover have \"UID1 \\<notin> set (pendingFReqs (createFriend s UID1 (pass s UID1) UID2) UID2)\"\n                  \"UID2 \\<notin> set (pendingFReqs (createFriend s UID1 (pass s UID1) UID2) UID1)\"\n      using reach_distinct_friends_reqs[OF rs] by (auto simp: c_defs)\n    ultimately show thesis using assms\n      by (elim toggle_friends12_True, blast, blast, blast) (elim that, blast+)\nqed\n\n\n(* helper *) lemma BO_cases:\nassumes \"BO vl vl1\"\nobtains (Nil) \"vl = []\" and \"vl1 = []\"\n      | (FVal) fv vl' vl1' where \"vl = FVal fv # vl'\" and \"vl1 = FVal fv # vl1'\" and \"BO vl' vl1'\"\n      | (OVal) vl' vl1' where \"vl = OVal False # vl'\" and \"vl1 = OVal False # vl1'\" and \"BC vl' vl1'\"\nusing assms proof (cases rule: BO.cases)\n  case (BO_FVal fs) then show thesis by (cases fs) (auto intro: Nil FVal) next\n  case (BO_BC vl'' vl1'' fs) then show thesis by (cases fs) (auto intro: FVal OVal)\nqed\n\n(* helper *) lemma BC_cases:\nassumes \"BC vl vl1\"\nobtains (Nil) \"vl = []\" and \"vl1 = []\"\n      | (FVal) fv fs where \"vl = FVal fv # map FVal fs\" and \"vl1 = []\"\n      | (FVal1) fv fs fs1 where \"vl = map FVal fs\" and \"vl1 = FVal fv # map FVal fs1\"\n      | (BO_FVal) fv fv' fs vl' vl1' where \"vl = FVal fv # map FVal fs @ FVal fv' # OVal True # vl'\"\n                                       and \"vl1 = FVal fv' # OVal True # vl1'\" and \"BO vl' vl1'\"\n      | (BO_FVal1) fv fv' fs fs1 vl' vl1' where \"vl = map FVal fs @ FVal fv' # OVal True # vl'\"\n                                       and \"vl1 = FVal fv # map FVal fs1 @ FVal fv' # OVal True # vl1'\"\n                                       and \"BO vl' vl1'\"\n      | (FVal_BO) fv vl' vl1' where \"vl = FVal fv # OVal True # vl'\"\n                                and \"vl1 = FVal fv # OVal True # vl1'\" and \"BO vl' vl1'\"\n      | (OVal) vl' vl1' where \"vl = OVal True # vl'\" and \"vl1 = OVal True # vl1'\" and \"BO vl' vl1'\"\nusing assms proof (cases rule: BC.cases)\n  case (BC_FVal fs fs1)\n    then show ?thesis proof (induction fs1)\n      case Nil then show ?case by (induction fs) (auto intro: that(1,2)) next\n      case (Cons fv fs1') then show ?case by (intro that(3)) auto\n    qed\nnext\n  case (BC_BO vl' vl1' fs fs1)\n    then show ?thesis proof (cases fs1 rule: rev_cases)\n      case Nil then show ?thesis using BC_BO by (intro that(7)) auto next\n      case (snoc fs1' fv')\n        moreover then obtain fs' where \"fs = fs' ## fv'\" using BC_BO\n          by (induction fs rule: rev_induct) auto\n        ultimately show ?thesis using BC_BO proof (induction fs1')\n          case Nil\n            then show ?thesis proof (induction fs')\n              case Nil then show ?thesis by (intro that(6)) auto next\n              case (Cons fv'' fs'') then show ?thesis by (intro that(4)) auto\n            qed\n        next\n          case (Cons fv'' fs1'') then show ?thesis by (intro that(5)) auto\n        qed\n    qed\nqed\n\n\ndefinition \\<Delta>0 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>0 s vl s1 vl1 \\<equiv>\n s = s1 \\<and> B vl vl1 \\<and> open s \\<and> (\\<not>IDsOK s [UID1, UID2] [] [] [])\"\n\ndefinition \\<Delta>1 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>1 s vl s1 vl1 \\<equiv>\n eqButUID s s1 \\<and> friendIDs s = friendIDs s1 \\<and> open s \\<and>\n BO (filter (Not o isFRVal) vl) (filter (Not o isFRVal) vl1) \\<and>\n validValSeqFrom vl1 s1 \\<and>\n IDsOK s1 [UID1, UID2] [] [] []\"\n\ndefinition \\<Delta>2 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>2 s vl s1 vl1 \\<equiv> (\\<exists>fs fs1.\n eqButUID s s1 \\<and> \\<not>open s \\<and>\n validValSeqFrom vl1 s1 \\<and>\n filter (Not o isFRVal) vl  = map FVal fs  \\<and>\n filter (Not o isFRVal) vl1 = map FVal fs1)\"\n\ndefinition \\<Delta>3 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>3 s vl s1 vl1 \\<equiv> (\\<exists>fs fs1 vlr vlr1.\n eqButUID s s1 \\<and> \\<not>open s \\<and> BO vlr vlr1 \\<and>\n validValSeqFrom vl1 s1 \\<and>\n (fs = [] \\<longleftrightarrow> fs1 = []) \\<and>\n (fs \\<noteq> [] \\<longrightarrow> last fs = last fs1) \\<and>\n (fs = [] \\<longrightarrow> friendIDs s = friendIDs s1) \\<and>\n filter (Not o isFRVal) vl  = map FVal fs  @ OVal True # vlr \\<and>\n filter (Not o isFRVal) vl1 = map FVal fs1 @ OVal True # vlr1)\"\n\n\nlemma \\<Delta>2_I:\nassumes \"eqButUID s s1\" \"\\<not>open s\"\n        \"validValSeqFrom vl1 s1\"\n        \"filter (Not o isFRVal) vl  = map FVal fs\"\n        \"filter (Not o isFRVal) vl1 = map FVal fs1\"\nshows \"\\<Delta>2 s vl s1 vl1\"\nusing assms unfolding \\<Delta>2_def by blast\n\nlemma \\<Delta>3_I:\nassumes \"eqButUID s s1\" \"\\<not>open s\" \"BO vlr vlr1\"\n        \"validValSeqFrom vl1 s1\"\n        \"fs = [] \\<longleftrightarrow> fs1 = []\" \"fs \\<noteq> [] \\<longrightarrow> last fs = last fs1\"\n        \"fs = [] \\<longrightarrow> friendIDs s = friendIDs s1\"\n        \"filter (Not o isFRVal) vl  = map FVal fs  @ OVal True # vlr\"\n        \"filter (Not o isFRVal) vl1 = map FVal fs1 @ OVal True # vlr1\"\nshows \"\\<Delta>3 s vl s1 vl1\"\nusing assms unfolding \\<Delta>3_def by blast\n\n\nlemma istate_\\<Delta>0:\nassumes B: \"B vl vl1\"\nshows \"\\<Delta>0 istate vl istate vl1\"\nusing assms unfolding \\<Delta>0_def istate_def B_def open_def openByA_def openByF_def friends12_def\nby auto\n\nlemma unwind_cont_\\<Delta>0: \"unwind_cont \\<Delta>0 {\\<Delta>0,\\<Delta>1,\\<Delta>2,\\<Delta>3}\"\nproof(rule, simp)\n  let ?\\<Delta> = \"\\<lambda>s vl s1 vl1. \\<Delta>0 s vl s1 vl1 \\<or>\n                           \\<Delta>1 s vl s1 vl1 \\<or>\n                           \\<Delta>2 s vl s1 vl1 \\<or>\n                           \\<Delta>3 s vl s1 vl1\"\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\<Delta>0: \"\\<Delta>0 s vl s1 vl1\"\n  then have rs: \"reach s\" and ss1: \"s1 = s\" and B: \"B vl vl1\" and os: \"open s\"\n        and IDs: \"\\<not>IDsOK s [UID1, UID2] [] [] []\"\n    using reachNT_reach unfolding \\<Delta>0_def by auto\n  from IDs have \"UID1 \\<notin> set (pendingFReqs s UID2)\" and \"\\<not>friends12 s\"\n            and \"UID2 \\<notin> set (pendingFReqs s UID1)\"\n    using reach_IDs_used_IDsOK[OF rs] unfolding friends12_def by auto\n  with B have BO: \"BO (filter (Not \\<circ> isFRVal) vl) (filter (Not \\<circ> isFRVal) vl1)\"\n          and vl_vl1: \"vl = [] \\<longrightarrow> vl1 = []\"\n          and vl_OVal: \"vl \\<noteq> [] \\<and> hd vl = OVal False \\<longrightarrow> vl1 \\<noteq> [] \\<and> hd vl1 = OVal False\"\n          and vVS: \"validValSeqFrom vl1 s\"\n    unfolding B_def by (auto simp: istate_def friends12_def)\n  show \"iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof -\n    have ?react proof\n      fix a :: act and ou :: out and s' :: state and vl'\n      let ?trn = \"Trans s a ou s'\"\n      assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n      show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n      proof cases\n        assume \\<phi>: \"\\<phi> ?trn\"\n        then obtain uid p uid' p' where a: \"a = Cact (cUser uid p uid' p')\"\n                                     \"\\<not>openByA s'\" \"\\<not>openByF s'\"\n                                     \"ou = outOK\" \"f ?trn = OVal False\"\n                                     \"friends12 s' = friends12 s\"\n                                     \"UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s UID2\"\n                                     \"UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s UID1\"\n          using step rs IDs by (elim \\<phi>E) (auto simp: openByA_def)\n        with c \\<phi> have vl: \"vl = OVal False # vl'\" unfolding consume_def by auto\n        with vl_OVal obtain vl1' where vl1: \"vl1 = OVal False # vl1'\" by (cases vl1) auto\n        from BO vl vl1 have BC': \"BC (filter (Not \\<circ> isFRVal) vl') (filter (Not \\<circ> isFRVal) vl1')\"\n          by (cases rule: BO_cases) auto\n        then have \"\\<Delta>2 s' vl' s' vl1' \\<or> \\<Delta>3 s' vl' s' vl1'\" using vVS a unfolding vl1\n        proof (cases rule: BC.cases)\n          case BC_FVal\n            then show ?thesis using vVS a unfolding vl1\n              by (intro disjI1 \\<Delta>2_I) (auto simp: open_def)\n        next\n          case BC_BO\n            then show ?thesis using vVS a unfolding vl1\n              by (intro disjI2 \\<Delta>3_I) (auto simp: open_def)\n        qed\n        then have ?match using step a \\<phi> unfolding ss1 vl1\n          by (intro matchI[of s a ou s']) (auto simp: consume_def)\n        then show ?thesis ..\n      next\n        assume n\\<phi>: \"\\<not>\\<phi> ?trn\"\n        then have s': \"open s'\" \"friends12 s' = friends12 s\"\n                      \"UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s UID2\"\n                      \"UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s UID1\"\n          using os step_open_\\<phi>[OF step] step_friends12_\\<phi>[OF step] step_pendingFReqs_\\<phi>[OF step]\n          by auto\n        moreover have \"vl' = vl\" using n\\<phi> c by (auto simp: consume_def)\n        ultimately have \"\\<Delta>0 s' vl' s' vl1 \\<or> \\<Delta>1 s' vl' s' vl1\"\n          using vVS B BO unfolding \\<Delta>0_def \\<Delta>1_def\n          by (cases \"IDsOK s' [UID1, UID2] [] [] []\") auto\n        then have ?match using step c n\\<phi> unfolding ss1\n          by (intro matchI[of s a ou s']) (auto simp: consume_def)\n        then show ?thesis ..\n      qed\n    qed\n    then show ?thesis using vl_vl1 by auto\n  qed\nqed\n\nlemma unwind_cont_\\<Delta>1: \"unwind_cont \\<Delta>1 {\\<Delta>1,\\<Delta>2,\\<Delta>3}\"\nproof(rule, simp)\n  let ?\\<Delta> = \"\\<lambda>s vl s1 vl1. \\<Delta>1 s vl s1 vl1 \\<or>\n                           \\<Delta>2 s vl s1 vl1 \\<or>\n                           \\<Delta>3 s vl s1 vl1\"\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\<Delta>1: \"\\<Delta>1 s vl s1 vl1\"\n  then have rs: \"reach s\" and ss1: \"eqButUID s s1\" and fIDs: \"friendIDs s = friendIDs s1\"\n        and os: \"open s\" and BO: \"BO (filter (Not o isFRVal) vl) (filter (Not o isFRVal) vl1)\"\n        and vVS1: \"validValSeq vl1 (friends12 s1)\n                                   (UID1 \\<in>\\<in> pendingFReqs s1 UID2)\n                                   (UID2 \\<in>\\<in> pendingFReqs s1 UID1)\" (is \"?vVS vl1 s1\")\n        and IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\"\n    using reachNT_reach unfolding \\<Delta>1_def by auto\n  show \"iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof cases\n    assume \"\\<exists>u req vl1'. vl1 = FRVal u req # vl1'\"\n    then obtain u req vl1' where vl1: \"vl1 = FRVal u req # vl1'\" by auto\n    obtain a uid uid' s1' where step1: \"step s1 a = (outOK, s1')\" and \"\\<phi> (Trans s1 a outOK s1')\"\n                            and a: \"a = Cact (cFriendReq uid (pass s1 uid) uid' req)\"\n                            and uid: \"uid = UID1 \\<and> uid' = UID2 \\<or> uid = UID2 \\<and> uid' = UID1\"\n                            and \"f (Trans s1 a outOK s1') = FRVal u req\" and \"?vVS vl1' s1'\"\n      using rs1 IDs1 vVS1 UID1_UID2_UIDs unfolding vl1 by (blast intro: produce_FRVal)\n    moreover then have \"\\<not>\\<gamma> (Trans s1 a outOK s1')\" using UID1_UID2_UIDs by auto\n    moreover have \"eqButUID s1 s1'\" using step1 a uid by (auto intro: Cact_cFriendReq_step_eqButUID)\n    moreover have \"friendIDs s1' = friendIDs s1\" and \"IDsOK s1' [UID1, UID2] [] [] []\"\n      using step1 a uid by (auto simp: c_defs)\n    ultimately have \"?iact\" using ss1 fIDs os BO unfolding vl1\n      by (intro iactionI[of s1 a \"outOK\" s1']) (auto simp: consume_def \\<Delta>1_def intro: eqButUID_trans)\n    then show ?thesis ..\n  next\n    assume nFRVal1: \"\\<not> (\\<exists>u req vl1'. vl1 = FRVal u req # vl1')\"\n    have ?react proof\n      fix a :: act and ou :: out and s' :: state and vl'\n      let ?trn = \"Trans s a ou s'\"\n      assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n      show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n      proof cases\n        assume \\<phi>: \"\\<phi> ?trn\"\n        then have vl: \"vl = f ?trn # vl'\" using c by (auto simp: consume_def)\n        from BO show ?thesis proof (cases \"f ?trn\")\n          case (FVal fv)\n            with BO obtain vl1' where vl1: \"vl1 = f ?trn # vl1'\"\n              using BO_Nil_iff[OF BO] FVal vl nFRVal1\n              by (cases rule: BO_cases; cases vl1; cases \"hd vl1\") auto\n            with BO have BO': \"BO (filter (Not o isFRVal) vl') (filter (Not o isFRVal) vl1')\"\n              using FVal vl by (cases rule: BO_cases) auto\n            from fIDs have f12: \"friends12 s = friends12 s1\" unfolding friends12_def by auto\n            have ?match using \\<phi> step rs FVal proof (cases rule: \\<phi>E)\n              case (Friend uid p uid')\n                then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\"\n                  using ss1 unfolding eqButUID_def by auto\n                let ?s1' = \"createFriend s1 UID1 (pass s1 UID1) UID2\"\n                have s': \"s' = createFriend s UID1 p UID2\"\n                  using Friend step by (auto simp: createFriend_sym)\n                have ss': \"eqButUID s s'\" using rs step Friend\n                  by (auto intro: Cact_cFriend_step_eqButUID)\n                moreover then have os': \"open s'\" using os eqButUID_open_eq by auto\n                moreover obtain a1 uid1 uid1' p1\n                where \"step s1 a1 = (outOK, ?s1')\" \"friends12 ?s1'\"\n                      \"a1 = Cact (cFriend uid1 p1 uid1')\"\n                      \"uid1 = UID1 \\<and> uid1' = UID2 \\<or> uid1 = UID2 \\<and> uid1' = UID1\"\n                      \"\\<phi> (Trans s1 a1 outOK ?s1')\"\n                      \"f (Trans s1 a1 outOK ?s1') = FVal True\"\n                      \"eqButUID s1 ?s1'\" \"?vVS vl1' ?s1'\"\n                  using rs1 IDs1 Friend vVS1 unfolding vl1 f12 Friend(3)\n                  by (elim toggle_friends12_True) blast+\n                moreover then have \"IDsOK ?s1' [UID1, UID2] [] [] []\" by (auto simp: c_defs)\n                moreover have \"friendIDs s' = friendIDs ?s1'\"\n                  using Friend(6) f12 unfolding s'\n                  by (intro eqButUID_createFriend12_friendIDs_eq[OF ss1 rs rs1]) auto\n                ultimately show ?match using ss1 BO' Friend UID1_UID2_UIDs unfolding vl1 \\<Delta>1_def\n                  by (intro matchI[of s1 a1 \"outOK\" ?s1'])\n                     (auto simp: consume_def intro: eqButUID_trans eqButUID_sym)\n            next\n              case (Unfriend uid p uid')\n                then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\"\n                  using ss1 unfolding eqButUID_def by auto\n                let ?s1' = \"deleteFriend s1 UID1 (pass s1 UID1) UID2\"\n                have s': \"s' = deleteFriend s UID1 p UID2\"\n                  using Unfriend step by (auto simp: deleteFriend_sym)\n                have ss': \"eqButUID s s'\" using rs step Unfriend\n                  by (auto intro: Dact_dFriend_step_eqButUID)\n                moreover then have os': \"open s'\" using os eqButUID_open_eq by auto\n                moreover obtain a1 uid1 uid1' p1\n                where \"step s1 a1 = (outOK, ?s1')\" \"\\<not>friends12 ?s1'\"\n                      \"a1 = Dact (dFriend uid1 p1 uid1')\"\n                      \"uid1 = UID1 \\<and> uid1' = UID2 \\<or> uid1 = UID2 \\<and> uid1' = UID1\"\n                      \"\\<phi> (Trans s1 a1 outOK ?s1')\"\n                      \"f (Trans s1 a1 outOK ?s1') = FVal False\"\n                      \"eqButUID s1 ?s1'\" \"?vVS vl1' ?s1'\"\n                  using rs1 IDs1 Unfriend vVS1 unfolding vl1 f12 Unfriend(3)\n                  by (elim toggle_friends12_False) blast+\n                moreover have \"friendIDs s' = friendIDs ?s1'\" \"IDsOK ?s1' [UID1, UID2] [] [] []\"\n                  using fIDs IDs1 unfolding s' by (auto simp: d_defs)\n                ultimately show ?match using ss1 BO' Unfriend UID1_UID2_UIDs unfolding vl1 \\<Delta>1_def\n                  by (intro matchI[of s1 a1 \"outOK\" ?s1'])\n                     (auto simp: consume_def intro: eqButUID_trans eqButUID_sym)\n            qed auto\n            then show ?thesis ..\n        next\n          case (OVal ov)\n            with BO obtain vl1' where vl1': \"vl1 = OVal False # vl1'\"\n              using BO_Nil_iff[OF BO] OVal vl nFRVal1\n              by (cases rule: BO_cases; cases vl1; cases \"hd vl1\") auto\n            with BO have BC': \"BC (filter (Not o isFRVal) vl') (filter (Not o isFRVal) vl1')\"\n              using OVal vl by (cases rule: BO_cases) auto\n            from BO vl OVal have \"f ?trn = OVal False\" by (cases rule: BO_cases) auto\n            with \\<phi> step rs have ?match proof (cases rule: \\<phi>E)\n              case (CloseF uid p uid')\n                let ?s1' = \"deleteFriend s1 uid p uid'\"\n                let ?trn1 = \"Trans s1 a outOK ?s1'\"\n                have s': \"s' = deleteFriend s uid p uid'\" using CloseF step by auto\n                have step1: \"step s1 a = (outOK, ?s1')\"\n                 and pFR1': \"pendingFReqs ?s1' = pendingFReqs s1\"\n                  using CloseF step ss1 fIDs unfolding eqButUID_def by (auto simp: d_defs)\n                have s's1': \"eqButUID s' ?s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n                moreover have os': \"\\<not>open s'\" using CloseF os unfolding open_def by auto\n                moreover have fIDs': \"friendIDs s' = friendIDs ?s1'\"\n                  using fIDs unfolding s' by (auto simp: d_defs)\n                moreover have f12s1: \"friends12 s1 = friends12 ?s1'\"\n                  using CloseF(2) UID1_UID2_UIDs unfolding friends12_def d_defs by auto\n                from BC' have \"\\<Delta>2 s' vl' ?s1' vl1' \\<or> \\<Delta>3 s' vl' ?s1' vl1'\"\n                proof (cases rule: BC.cases)\n                  case (BC_FVal fs fs1)\n                    then show ?thesis using vVS1 os' fIDs' f12s1 s's1' pFR1'\n                      unfolding \\<Delta>2_def vl1' by auto\n                next\n                  case (BC_BO vlr vlr1 fs fs1)\n                    then have \"\\<Delta>3 s' vl' ?s1' vl1'\" using s's1' os' vVS1 f12s1 fIDs' pFR1'\n                      unfolding vl1' by (intro \\<Delta>3_I[of _ _ _ _ _ fs fs1]) auto\n                    then show ?thesis ..\n                qed\n                moreover have \"open s1\" \"\\<not>open ?s1'\"\n                  using ss1 os s's1' os' by (auto simp: eqButUID_open_eq)\n                moreover then have \"\\<phi> ?trn1\" unfolding CloseF by auto\n                ultimately show ?match using step1 vl1' CloseF UID1_UID2 UID1_UID2_UIDs\n                  by (intro matchI[of s1 a outOK ?s1' vl1 vl1']) (auto simp: consume_def)\n            next\n              case (CloseA uid p uid' p')\n                let ?s1' = \"createUser s1 uid p uid' p'\"\n                let ?trn1 = \"Trans s1 a outOK ?s1'\"\n                have s': \"s' = createUser s uid p uid' p'\" using CloseA step by auto\n                have step1: \"step s1 a = (outOK, ?s1')\"\n                 and pFR1': \"pendingFReqs ?s1' = pendingFReqs s1\"\n                  using CloseA step ss1 unfolding eqButUID_def by (auto simp: c_defs)\n                have s's1': \"eqButUID s' ?s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n                moreover have os': \"\\<not>open s'\" using CloseA os unfolding open_def by auto\n                moreover have fIDs': \"friendIDs s' = friendIDs ?s1'\"\n                  using fIDs unfolding s' by (auto simp: c_defs)\n                moreover have f12s1: \"friends12 s1 = friends12 ?s1'\"\n                  unfolding friends12_def by (auto simp: c_defs)\n                from BC' have \"\\<Delta>2 s' vl' ?s1' vl1' \\<or> \\<Delta>3 s' vl' ?s1' vl1'\"\n                proof (cases rule: BC.cases)\n                  case (BC_FVal fs fs1)\n                    then show ?thesis using vVS1 os' fIDs' f12s1 s's1' pFR1'\n                      unfolding \\<Delta>2_def vl1' by auto\n                next\n                  case (BC_BO vlr vlr1 fs fs1)\n                    then have \"\\<Delta>3 s' vl' ?s1' vl1'\" using s's1' os' vVS1 f12s1 fIDs' pFR1'\n                      unfolding vl1' by (intro \\<Delta>3_I[of _ _ _ _ _ fs fs1]) auto\n                    then show ?thesis ..\n                qed\n                moreover have \"open s1\" \"\\<not>open ?s1'\"\n                  using ss1 os s's1' os' by (auto simp: eqButUID_open_eq)\n                moreover then have \"\\<phi> ?trn1\" unfolding CloseA by auto\n                ultimately show ?match using step1 vl1' CloseA UID1_UID2 UID1_UID2_UIDs\n                  by (intro matchI[of s1 a outOK ?s1' vl1 vl1']) (auto simp: consume_def)\n            qed auto\n            then show ?thesis ..\n        next\n          case (FRVal u req)\n            obtain p\n            where a: \"(a = Cact (cFriendReq UID1 p UID2 req) \\<and> UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<and>\n                       UID1 \\<notin> set (pendingFReqs s UID2) \\<and>\n                       (UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s UID1)) \\<or>\n                      (a = Cact (cFriendReq UID2 p UID1 req) \\<and> UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<and>\n                       UID2 \\<notin> set (pendingFReqs s UID1) \\<and>\n                       (UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s UID2))\"\n                     \"ou = outOK\" \"\\<not>friends12 s\" \"\\<not>friends12 s'\" \"open s' = open s\"\n              using \\<phi> step rs FRVal by (cases rule: \\<phi>E) fastforce+\n            then have fIDs': \"friendIDs s' = friendIDs s\" using step by (auto simp: c_defs)\n            have \"eqButUID s s'\" using a step\n              by (auto intro: Cact_cFriendReq_step_eqButUID)\n            then have \"\\<Delta>1 s' vl' s1 vl1\"\n              unfolding \\<Delta>1_def using ss1 fIDs' fIDs os a(5) vVS1 IDs1 BO vl FRVal\n              by (auto intro: eqButUID_trans eqButUID_sym)\n            moreover from \\<phi> step rs a have \"\\<not>\\<gamma> (Trans s a ou s')\"\n              using UID1_UID2_UIDs by (cases rule: \\<phi>E) auto\n            ultimately have ?ignore by (intro ignoreI) auto\n            then show ?thesis ..\n        qed\n      next\n        assume n\\<phi>: \"\\<not>\\<phi> ?trn\"\n        then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n          using step_open_\\<phi>[OF step] step_friends12_\\<phi>[OF step] by auto\n        have vl': \"vl' = vl\" using n\\<phi> c by (auto simp: consume_def)\n        show ?thesis proof (cases \"\\<forall>req. a \\<noteq> Cact (cFriend UID1 (pass s UID1) UID2) \\<and>\n                                         a \\<noteq> Cact (cFriend UID2 (pass s UID2) UID1) \\<and>\n                                         a \\<noteq> Cact (cFriendReq UID2 (pass s UID2) UID1 req) \\<and>\n                                         a \\<noteq> Cact (cFriendReq UID1 (pass s UID1) UID2 req) \\<and>\n                                         a \\<noteq> Dact (dFriend UID1 (pass s UID1) UID2) \\<and>\n                                         a \\<noteq> Dact (dFriend UID2 (pass s UID2) UID1)\")\n          case True\n            obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n            let ?trn1 = \"Trans s1 a ou1 s1'\"\n            have fIDs': \"friendIDs s' = friendIDs s1'\" using True\n              by (intro eqButUID_step_friendIDs_eq[OF ss1 rs rs1 step step1 _ fIDs]) auto\n            from True n\\<phi> have n\\<phi>': \"\\<not>\\<phi> ?trn1\" using eqButUID_step_\\<phi>[OF ss1 rs rs1 step step1] by auto\n            then have f12s1': \"friends12 s1 = friends12 s1'\"\n                  and pFRs': \"UID1 \\<in>\\<in> pendingFReqs s1 UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s1' UID2\"\n                             \"UID2 \\<in>\\<in> pendingFReqs s1 UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s1' UID1\"\n              using step_friends12_\\<phi>[OF step1] step_pendingFReqs_\\<phi>[OF step1]\n              by auto\n            have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n            then have \"\\<Delta>1 s' vl' s1' vl1\" using os fIDs' vVS1 BO IDsOK_mono[OF step1 IDs1]\n              unfolding \\<Delta>1_def os' f12s1' pFRs' vl' by auto\n            then have ?match\n              using step1 n\\<phi>' fIDs eqButUID_step_\\<gamma>_out[OF ss1 step step1]\n              by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n            then show \"?match \\<or> ?ignore\" ..\n        next\n          case False\n            with n\\<phi> have \"ou \\<noteq> outOK\" by auto\n            then have \"s' = s\" using step False by auto\n            then have ?ignore using \\<Delta>1 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n            then show \"?match \\<or> ?ignore\" ..\n        qed\n      qed\n    qed\n    moreover have \"vl = [] \\<longrightarrow> vl1 = []\" proof\n      assume \"vl = []\"\n      with BO have \"filter (Not \\<circ> isFRVal) vl1 = []\" using BO_Nil_iff[OF BO] by auto\n      with nFRVal1 show \"vl1 = []\" by (cases vl1; cases \"hd vl1\") auto\n    qed\n    ultimately show ?thesis by auto\n  qed\nqed\n\nlemma unwind_cont_\\<Delta>2: \"unwind_cont \\<Delta>2 {\\<Delta>2, \\<Delta>1}\"\nproof(rule, simp)\n  let ?\\<Delta> = \"\\<lambda>s vl s1 vl1. \\<Delta>2 s vl s1 vl1 \\<or> \\<Delta>1 s vl s1 vl1\"\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsT: \"reachNT s\" and rs1: \"reach s1\" and 2: \"\\<Delta>2 s vl s1 vl1\"\n  from rsT have rs: \"reach s\" by (intro reachNT_reach)\n  from 2 obtain fs fs1\n  where ss1: \"eqButUID s s1\" and os: \"\\<not>open s\"\n    and vVS1: \"validValSeqFrom vl1 s1\"\n    and fs:  \"filter (Not o isFRVal) vl =  map FVal fs\"\n    and fs1: \"filter (Not o isFRVal) vl1 = map FVal fs1\"\n    unfolding \\<Delta>2_def by auto\n  from os have IDs: \"IDsOK s [UID1, UID2] [] [] []\" unfolding open_defs by auto\n  then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\" using ss1 unfolding eqButUID_def by auto\n  show \"iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof cases\n    assume vl1: \"vl1 = []\"\n    have ?react proof\n      fix a :: act and ou :: out and s' :: state and vl'\n      let ?trn = \"Trans s a ou s'\"\n      assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n      show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n      proof cases\n        assume \\<phi>: \"\\<phi> ?trn\"\n        with c have vl: \"vl = f ?trn # vl'\" by (auto simp: consume_def)\n        with fs have ?ignore proof (cases \"f ?trn\")\n          case (FRVal u req)\n            obtain p\n            where a: \"(a = Cact (cFriendReq UID1 p UID2 req) \\<and> UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<and>\n                       UID1 \\<notin> set (pendingFReqs s UID2) \\<and>\n                       (UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s UID1)) \\<or>\n                      (a = Cact (cFriendReq UID2 p UID1 req) \\<and> UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<and>\n                       UID2 \\<notin> set (pendingFReqs s UID1) \\<and>\n                       (UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s UID2))\"\n                     \"ou = outOK\" \"\\<not>friends12 s\" \"\\<not>friends12 s'\" \"open s' = open s\"\n              using \\<phi> step rs FRVal by (cases rule: \\<phi>E) fastforce+\n            then have fIDs': \"friendIDs s' = friendIDs s\" using step by (auto simp: c_defs)\n            have \"eqButUID s s'\" using a step\n              by (auto intro: Cact_cFriendReq_step_eqButUID)\n            then have \"\\<Delta>2 s' vl' s1 vl1\"\n              unfolding \\<Delta>2_def using ss1 os a(5) vVS1 vl fs fs1\n              by (auto intro: eqButUID_trans eqButUID_sym)\n            moreover from \\<phi> step rs a have \"\\<not>\\<gamma> (Trans s a ou s')\"\n              using UID1_UID2_UIDs by (cases rule: \\<phi>E) auto\n            ultimately show ?ignore by (intro ignoreI) auto\n        next\n          case (FVal fv)\n            with fs vl obtain fs' where fs': \"fs = fv # fs'\" by (cases fs) auto\n            from \\<phi> step rs FVal have ss': \"eqButUID s s'\"\n              by (elim \\<phi>E) (auto intro: Cact_cFriend_step_eqButUID Dact_dFriend_step_eqButUID)\n            then have \"\\<not>open s'\" using os by (auto simp: eqButUID_open_eq)\n            moreover have \"eqButUID s' s1\" using ss1 ss' by (auto intro: eqButUID_sym eqButUID_trans)\n            ultimately have \"\\<Delta>2 s' vl' s1 vl1\"\n              using vVS1 fs' fs unfolding \\<Delta>2_def vl vl1 FVal by auto\n            moreover have \"\\<not>\\<gamma> ?trn\" using \\<phi> step rs FVal UID1_UID2_UIDs by (elim \\<phi>E) auto\n            ultimately show ?ignore by (intro ignoreI) auto\n        qed auto\n        then show ?thesis ..\n      next\n        assume n\\<phi>: \"\\<not>\\<phi> ?trn\"\n        then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n          using step_open_\\<phi>[OF step] step_friends12_\\<phi>[OF step] by auto\n        have vl': \"vl' = vl\" using n\\<phi> c by (auto simp: consume_def)\n        show ?thesis proof (cases \"\\<forall>req. a \\<noteq> Cact (cFriend UID1 (pass s UID1) UID2) \\<and>\n                                         a \\<noteq> Cact (cFriend UID2 (pass s UID2) UID1) \\<and>\n                                         a \\<noteq> Cact (cFriendReq UID2 (pass s UID2) UID1 req) \\<and>\n                                         a \\<noteq> Cact (cFriendReq UID1 (pass s UID1) UID2 req) \\<and>\n                                         a \\<noteq> Dact (dFriend UID1 (pass s UID1) UID2) \\<and>\n                                         a \\<noteq> Dact (dFriend UID2 (pass s UID2) UID1)\")\n          case True\n            obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n            let ?trn1 = \"Trans s1 a ou1 s1'\"\n            from True n\\<phi> have n\\<phi>': \"\\<not>\\<phi> ?trn1\"\n              using eqButUID_step_\\<phi>[OF ss1 rs rs1 step step1] by auto\n            then have f12s1': \"friends12 s1 = friends12 s1'\"\n                  and pFRs': \"UID1 \\<in>\\<in> pendingFReqs s1 UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s1' UID2\"\n                             \"UID2 \\<in>\\<in> pendingFReqs s1 UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s1' UID1\"\n              using step_friends12_\\<phi>[OF step1] step_pendingFReqs_\\<phi>[OF step1]\n              by auto\n            have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n            then have \"\\<Delta>2 s' vl' s1' vl1\" using os vVS1 fs fs1\n              unfolding \\<Delta>2_def os' f12s1' pFRs' vl' by auto\n            then have ?match\n              using step1 n\\<phi>' os eqButUID_step_\\<gamma>_out[OF ss1 step step1]\n              by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n            then show \"?match \\<or> ?ignore\" ..\n        next\n          case False\n            with n\\<phi> have \"ou \\<noteq> outOK\" by auto\n            then have \"s' = s\" using step False by auto\n            then have ?ignore using 2 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n            then show \"?match \\<or> ?ignore\" ..\n        qed\n      qed\n    qed\n    then show ?thesis using vl1 by auto\n  next\n    assume \"vl1 \\<noteq> []\"\n    then obtain v vl1' where vl1: \"vl1 = v # vl1'\" by (cases vl1) auto\n    with fs1 have ?iact proof (cases v)\n      case (FRVal u req)\n        obtain a uid uid' s1' where step1: \"step s1 a = (outOK, s1')\" and \"\\<phi> (Trans s1 a outOK s1')\"\n                                and a: \"a = Cact (cFriendReq uid (pass s1 uid) uid' req)\"\n                                and uid: \"uid = UID1 \\<and> uid' = UID2 \\<or> uid = UID2 \\<and> uid' = UID1\"\n                                and \"f (Trans s1 a outOK s1') = FRVal u req\"\n                                and vVS1': \"validValSeqFrom vl1' s1'\"\n          using rs1 IDs1 vVS1 UID1_UID2_UIDs unfolding vl1 FRVal by (blast intro: produce_FRVal)\n        moreover then have \"\\<not>\\<gamma> (Trans s1 a outOK s1')\" using UID1_UID2_UIDs by auto\n        moreover have \"eqButUID s1 s1'\" using step1 a uid\n          by (auto intro: Cact_cFriendReq_step_eqButUID)\n        moreover then have \"\\<Delta>2 s vl s1' vl1'\" using ss1 os vVS1' fs fs1 unfolding vl1 FRVal\n          by (intro \\<Delta>2_I[of s s1' vl1' vl fs fs1]) (auto intro: eqButUID_trans)\n        ultimately show \"?iact\" using ss1 os unfolding vl1 FRVal\n          by (intro iactionI[of s1 a \"outOK\" s1']) (auto simp: consume_def intro: eqButUID_trans)\n    next\n      case (FVal fv)\n        then obtain fs1' where fs1': \"fs1 = fv # fs1'\"\n          using vl1 fs1 by (cases fs1) auto\n        from FVal vVS1 vl1 have f12: \"friends12 s1 \\<noteq> fv\"\n                            and vVS1: \"validValSeqFrom (FVal fv # vl1') s1\" by auto\n        then show ?iact using rs1 IDs1 vl1 FVal ss1 os fs fs1 fs1' vl1 FVal\n          by (elim toggle_friends12[of s1 fv vl1'], blast, blast, blast)\n             (intro iactionI[of s1 _ _ _ vl1 vl1'],\n              auto simp: consume_def intro: \\<Delta>2_I[of s _ vl1' vl fs fs1'] eqButUID_trans)\n    qed auto\n    then show ?thesis ..\n  qed\nqed\n\n(*\n        then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n          using step_open_\\<phi>[OF step] step_friends12_\\<phi>[OF step] by auto\n        have vl': \"vl' = vl\" using n\\<phi> c by (auto simp: consume_def)\n        show ?thesis proof (cases \"a \\<noteq> Cact (cFriend UID1 (pass s UID1) UID2) \\<and>\n                                   a \\<noteq> Cact (cFriend UID2 (pass s UID2) UID1) \\<and>\n                                   a \\<noteq> Dact (dFriend UID1 (pass s UID1) UID2) \\<and>\n                                   a \\<noteq> Dact (dFriend UID2 (pass s UID2) UID1)\")\n          case True\n            obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n            let ?trn1 = \"Trans s1 a ou1 s1'\"\n            from True n\\<phi> have n\\<phi>': \"\\<not>\\<phi> ?trn1\" using eqButUID_step_\\<phi>[OF ss1 rs rs1 step step1] by auto\n            then have f12s1': \"friends12 s1 = friends12 s1'\"\n              using step_friends12_\\<phi>[OF step1] by auto\n            have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n            then have \"\\<Delta>1 s' vl' s1' vl1\" using os aF1 vl vl1\n              unfolding \\<Delta>1_def os' vl' f12s1' by auto\n            then have ?match\n              using step1 n\\<phi>' os eqButUID_step_\\<gamma>_out[OF ss1 step step1]\n              by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n            then show \"?match \\<or> ?ignore\" ..\n        next\n          case False\n            with n\\<phi> have \"ou \\<noteq> outOK\" by auto\n            then have \"s' = s\" using step False by auto\n            then have ?ignore using 1 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n            then show \"?match \\<or> ?ignore\" ..\n        qed\n      qed\n    qed\n    then show ?thesis using fs1 unfolding vl1 by auto\n  next\n    assume \"fs1 \\<noteq> []\"\n    then obtain fs1' where fs1: \"fs1 = (\\<not>friends12 s1) # fs1'\"\n                       and aF1': \"alternatingFriends (map FVal fs1') (\\<not>friends12 s1)\"\n      using aF1 unfolding vl1 by (cases fs1) auto\n    obtain al oul s1' where \"sstep s1 al = (oul, s1')\" \"al \\<noteq> []\" \"eqButUID s1 s1'\"\n                            \"friends12 s1' = (\\<not>friends12 s1)\"\n                            \"O (traceOf s1 al) = []\" \"V (traceOf s1 al) = [FVal (\\<not>friends12 s1)]\"\n      using rs1 IDs1\n      by (cases \"friends12 s1\") (auto intro: toggle_friends12_True toggle_friends12_False)\n    moreover then have \"\\<Delta>1 s vl s1' (map FVal fs1')\"\n      using os aF1' vl ss1 unfolding \\<Delta>1_def by (auto intro: eqButUID_sym eqButUID_trans)\n    ultimately have ?iact using vl1 unfolding fs1\n      by (intro iactionI_ms[of s1 al oul s1'])\n         (auto simp: consumeList_def O_Nil_never list_ex_iff_length_V)\n    then show ?thesis ..\n  qed\nqed\n*)\n\nlemma unwind_cont_\\<Delta>3: \"unwind_cont \\<Delta>3 {\\<Delta>3,\\<Delta>1}\"\nproof(rule, simp)\n  let ?\\<Delta> = \"\\<lambda>s vl s1 vl1. \\<Delta>3 s vl s1 vl1 \\<or> \\<Delta>1 s vl s1 vl1\"\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsT: \"reachNT s\" and rs1: \"reach s1\" and 3: \"\\<Delta>3 s vl s1 vl1\"\n  from rsT have rs: \"reach s\" by (intro reachNT_reach)\n  obtain fs fs1 vlr vlr1\n  where ss1: \"eqButUID s s1\" and os: \"\\<not>open s\" and BO: \"BO vlr vlr1\"\n    and vVS1: \"validValSeqFrom vl1 s1\"\n    and fs:  \"filter (Not o isFRVal) vl =  map FVal fs  @ OVal True # vlr\"\n    and fs1: \"filter (Not o isFRVal) vl1 = map FVal fs1 @ OVal True # vlr1\"\n    and fs_fs1: \"fs = [] \\<longleftrightarrow> fs1 = []\"\n    and last_fs: \"fs \\<noteq> [] \\<longrightarrow> last fs = last fs1\"\n    and fs_fIDs: \"fs = [] \\<longrightarrow> friendIDs s = friendIDs s1\"\n    using 3 unfolding \\<Delta>3_def by auto\n  have BC: \"BC (map FVal fs @ OVal True # vlr) (map FVal fs1 @ OVal True # vlr1)\"\n    using fs fs1 fs_fs1 last_fs BO by auto\n  from os have IDs: \"IDsOK s [UID1, UID2] [] [] []\" unfolding open_defs by auto\n  then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\" using ss1 unfolding eqButUID_def by auto\n  show \"iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof cases\n    assume \"\\<exists>u req vl1'. vl1 = FRVal u req # vl1'\"\n    then obtain u req vl1' where vl1: \"vl1 = FRVal u req # vl1'\" by auto\n    obtain a uid uid' s1' where step1: \"step s1 a = (outOK, s1')\" and \\<phi>: \"\\<phi> (Trans s1 a outOK s1')\"\n                            and a: \"a = Cact (cFriendReq uid (pass s1 uid) uid' req)\"\n                            and uid: \"uid = UID1 \\<and> uid' = UID2 \\<or> uid = UID2 \\<and> uid' = UID1\"\n                            and f: \"f (Trans s1 a outOK s1') = FRVal u req\"\n                            and \"validValSeqFrom vl1' s1'\"\n      using rs1 IDs1 vVS1 UID1_UID2_UIDs unfolding vl1 by (blast intro: produce_FRVal)\n    moreover have \"eqButUID s1 s1'\" using step1 a uid by (auto intro: Cact_cFriendReq_step_eqButUID)\n    moreover have \"friendIDs s1' = friendIDs s1\" and \"IDsOK s1' [UID1, UID2] [] [] []\"\n      using step1 a uid by (auto simp: c_defs)\n    ultimately have \"\\<Delta>3 s vl s1' vl1'\" using ss1 os BO fs_fs1 last_fs fs_fIDs fs fs1 unfolding vl1\n      by (intro \\<Delta>3_I[of _ _ vlr vlr1 vl1' fs fs1 vl])\n         (auto simp: consume_def intro: eqButUID_trans)\n    moreover have \"\\<not>\\<gamma> (Trans s1 a outOK s1')\" using a uid UID1_UID2_UIDs by auto\n    ultimately have \"?iact\" using step1 \\<phi> f unfolding vl1\n      by (intro iactionI[of s1 a \"outOK\" s1']) (auto simp: consume_def)\n    then show ?thesis ..\n  next\n    assume nFRVal1: \"\\<not>(\\<exists>u req vl1'. vl1 = FRVal u req # vl1')\"\n    from BC show ?thesis proof (cases rule: BC_cases)\n      case (BO_FVal fv fv' fs' vl'' vl1'')\n        then have fs': \"filter (Not o isFRVal) vl = map FVal (fv # fs' ## fv') @ OVal True # vl''\"\n              and fs1': \"filter (Not o isFRVal) vl1 = FVal fv' # OVal True # vl1''\"\n          using fs fs1 by auto\n        have ?react proof\n          fix a :: act and ou :: out and s' :: state and vl'\n          let ?trn = \"Trans s a ou s'\"  let ?trn1 = \"Trans s1 a ou s'\"\n          assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n          show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n          proof cases\n            assume \\<phi>: \"\\<phi> ?trn\"\n            with c have vl: \"vl = f ?trn # vl'\" by (auto simp: consume_def)\n            with fs' have ?ignore proof (cases \"f ?trn\")\n              case (FRVal u req)\n                obtain p\n                where a: \"(a = Cact (cFriendReq UID1 p UID2 req) \\<and> UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<and>\n                           UID1 \\<notin> set (pendingFReqs s UID2) \\<and>\n                           (UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s UID1)) \\<or>\n                          (a = Cact (cFriendReq UID2 p UID1 req) \\<and> UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<and>\n                           UID2 \\<notin> set (pendingFReqs s UID1) \\<and>\n                           (UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s UID2))\"\n                         \"ou = outOK\" \"\\<not>friends12 s\" \"\\<not>friends12 s'\" \"open s' = open s\"\n                  using \\<phi> step rs FRVal by (cases rule: \\<phi>E) fastforce+\n                then have fIDs': \"friendIDs s' = friendIDs s\" using step by (auto simp: c_defs)\n                have \"eqButUID s s'\" using a step\n                  by (auto intro: Cact_cFriendReq_step_eqButUID)\n                then have \"\\<Delta>3 s' vl' s1 vl1\"\n                  using ss1 a os BO vVS1 fs_fs1 last_fs fs_fIDs fs fs1 fIDs' vl FRVal\n                  by (intro \\<Delta>3_I[of s' s1 vlr vlr1 vl1 fs fs1 vl'])\n                     (auto intro: eqButUID_trans eqButUID_sym)\n                moreover from \\<phi> step rs a have \"\\<not>\\<gamma> (Trans s a ou s')\"\n                  using UID1_UID2_UIDs by (cases rule: \\<phi>E) auto\n                ultimately show ?ignore by (intro ignoreI) auto\n            next\n              case (FVal fv'')\n                with vl fs' have FVal: \"f ?trn = FVal fv\"\n                             and vl': \"filter (Not \\<circ> isFRVal) vl' = map FVal (fs' ## fv') @ OVal True # vl''\"\n                  by auto\n                from \\<phi> step rs FVal have ss': \"eqButUID s s'\"\n                  by (elim \\<phi>E) (auto intro: Cact_cFriend_step_eqButUID Dact_dFriend_step_eqButUID)\n                then have \"\\<not>open s'\" using os by (auto simp: eqButUID_open_eq)\n                moreover have \"eqButUID s' s1\" using ss1 ss' by (auto intro: eqButUID_sym eqButUID_trans)\n                ultimately have \"\\<Delta>3 s' vl' s1 vl1\" using BO_FVal(3) vVS1 vl' fs1'\n                  by (intro \\<Delta>3_I[of s' s1 vl'' vl1'' vl1 \"fs' ## fv'\" \"[fv']\" vl']) auto\n                moreover have \"\\<not>\\<gamma> ?trn\" using \\<phi> step rs FVal UID1_UID2_UIDs by (elim \\<phi>E) auto\n                ultimately show ?ignore by (intro ignoreI) auto\n            qed auto\n            then show ?thesis ..\n          next\n            assume n\\<phi>: \"\\<not>\\<phi> ?trn\"\n            then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n              using step_open_\\<phi>[OF step] step_friends12_\\<phi>[OF step] by auto\n            have vl': \"vl' = vl\" using n\\<phi> c by (auto simp: consume_def)\n            show ?thesis proof (cases \"\\<forall>req. a \\<noteq> Cact (cFriend UID1 (pass s UID1) UID2) \\<and>\n                                             a \\<noteq> Cact (cFriend UID2 (pass s UID2) UID1) \\<and>\n                                             a \\<noteq> Cact (cFriendReq UID2 (pass s UID2) UID1 req) \\<and>\n                                             a \\<noteq> Cact (cFriendReq UID1 (pass s UID1) UID2 req) \\<and>\n                                             a \\<noteq> Dact (dFriend UID1 (pass s UID1) UID2) \\<and>\n                                             a \\<noteq> Dact (dFriend UID2 (pass s UID2) UID1)\")\n              case True\n                obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n                let ?trn1 = \"Trans s1 a ou1 s1'\"\n                from True n\\<phi> have n\\<phi>': \"\\<not>\\<phi> ?trn1\"\n                  using eqButUID_step_\\<phi>[OF ss1 rs rs1 step step1] by auto\n                then have f12s1': \"friends12 s1 = friends12 s1'\"\n                      and pFRs': \"UID1 \\<in>\\<in> pendingFReqs s1 UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s1' UID2\"\n                                 \"UID2 \\<in>\\<in> pendingFReqs s1 UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s1' UID1\"\n                  using step_friends12_\\<phi>[OF step1] step_pendingFReqs_\\<phi>[OF step1]\n                  by auto\n                have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n                thm \\<Delta>3_I[of s' s1' vl'' vl1'' vl1 \"fv # fs' ## fv'\" \"[fv']\" vl']\n                then have \"\\<Delta>3 s' vl' s1' vl1\" using os vVS1 fs' fs1' BO_FVal\n                  unfolding os' f12s1' pFRs' vl'\n                  by (intro \\<Delta>3_I[of s' s1' vl'' vl1'' vl1 \"fv # fs' ## fv'\" \"[fv']\" vl]) auto\n                then have ?match\n                  using step1 n\\<phi>' os eqButUID_step_\\<gamma>_out[OF ss1 step step1]\n                  by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n                then show \"?match \\<or> ?ignore\" ..\n            next\n              case False\n                with n\\<phi> have \"ou \\<noteq> outOK\" by auto\n                then have \"s' = s\" using step False by auto\n                then have ?ignore using 3 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n                then show \"?match \\<or> ?ignore\" ..\n            qed\n          qed\n        qed\n        then show ?thesis using fs' by auto\n    next\n      case (BO_FVal1 fv fv' fs' fs1' vl'' vl1'')\n        then have fs': \"filter (Not o isFRVal) vl = map FVal (fs' ## fv') @ OVal True # vl''\"\n              and fs1': \"filter (Not o isFRVal) vl1 = map FVal (fv # fs1' ## fv') @ OVal True # vl1''\"\n          using fs fs1 by auto\n        with nFRVal1 obtain vl1'\n        where vl1: \"vl1 = FVal fv # vl1'\"\n          and vl1': \"filter (Not o isFRVal) vl1' = map FVal (fs1' ## fv') @ OVal True # vl1''\"\n          by (cases vl1; cases \"hd vl1\") auto\n        with vVS1 have f12: \"friends12 s1 \\<noteq> fv\"\n                   and vVS1: \"validValSeqFrom (FVal fv # vl1') s1\" by auto\n        then have ?iact using rs1 IDs1 vl1 ss1 os BO_FVal1(3) fs' vl1'\n          by (elim toggle_friends12[of s1 fv vl1'], blast, blast, blast)\n             (intro iactionI[of s1 _ _ _ vl1 vl1'],\n              auto simp: consume_def\n                   intro: \\<Delta>3_I[of s _ vl'' vl1'' vl1' \"fs' ## fv'\" \"fs1' ## fv'\" vl]\n                          eqButUID_trans)\n        then show ?thesis ..\n    next\n      case (FVal_BO fv vl'' vl1'')\n        then have fs': \"filter (Not o isFRVal) vl = FVal fv # OVal True # vl''\"\n              and fs1': \"filter (Not o isFRVal) vl1 = FVal fv # OVal True # vl1''\"\n          using fs fs1 by auto\n        have ?react proof\n          fix a :: act and ou :: out and s' :: state and vl'\n          let ?trn = \"Trans s a ou s'\"  let ?trn1 = \"Trans s1 a ou s'\"\n          assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n          show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n          proof cases\n            assume \\<phi>: \"\\<phi> ?trn\"\n            with c have vl: \"vl = f ?trn # vl'\" by (auto simp: consume_def)\n            with fs' show ?thesis proof (cases \"f ?trn\")\n              case (FRVal u req)\n                obtain p\n                where a: \"(a = Cact (cFriendReq UID1 p UID2 req) \\<and> UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<and>\n                           UID1 \\<notin> set (pendingFReqs s UID2) \\<and>\n                           (UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s UID1)) \\<or>\n                          (a = Cact (cFriendReq UID2 p UID1 req) \\<and> UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<and>\n                           UID2 \\<notin> set (pendingFReqs s UID1) \\<and>\n                           (UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s UID2))\"\n                         \"ou = outOK\" \"\\<not>friends12 s\" \"\\<not>friends12 s'\" \"open s' = open s\"\n                  using \\<phi> step rs FRVal by (cases rule: \\<phi>E) fastforce+\n                then have fIDs': \"friendIDs s' = friendIDs s\" using step by (auto simp: c_defs)\n                have \"eqButUID s s'\" using a step\n                  by (auto intro: Cact_cFriendReq_step_eqButUID)\n                then have \"\\<Delta>3 s' vl' s1 vl1\"\n                  using ss1 a os BO vVS1 fs_fs1 last_fs fs_fIDs fs fs1 fIDs' vl FRVal\n                  by (intro \\<Delta>3_I[of s' s1 vlr vlr1 vl1 fs fs1 vl'])\n                     (auto intro: eqButUID_trans eqButUID_sym)\n                moreover from \\<phi> step rs a have \"\\<not>\\<gamma> (Trans s a ou s')\"\n                  using UID1_UID2_UIDs by (cases rule: \\<phi>E) auto\n                ultimately have ?ignore by (intro ignoreI) auto\n                then show ?thesis ..\n            next\n              case (FVal fv'')\n                with vl fs' have FVal: \"f ?trn = FVal fv\"\n                             and vl': \"filter (Not \\<circ> isFRVal) vl' = OVal True # vl''\"\n                  by auto\n                from fs1' nFRVal1 obtain vl1'\n                where vl1: \"vl1 = FVal fv # vl1'\"\n                  and vl1': \"filter (Not \\<circ> isFRVal) vl1' = OVal True # vl1''\"\n                  by (cases vl1; cases \"hd vl1\") auto\n                have ?match using \\<phi> step rs FVal proof (cases rule: \\<phi>E)\n                  case (Friend uid p uid')\n                    then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\"\n                          and f12s1: \"\\<not>friends12 s1\"\n                          and fv: \"fv = True\"\n                      using ss1 vVS1 FVal unfolding eqButUID_def vl1 by auto\n                    let ?s1' = \"createFriend s1 UID1 (pass s1 UID1) UID2\"\n                    have s': \"s' = createFriend s UID1 p UID2\"\n                      using Friend step by (auto simp: createFriend_sym)\n                    have ss': \"eqButUID s s'\" using rs step Friend\n                      by (auto intro: Cact_cFriend_step_eqButUID)\n                    moreover then have os': \"\\<not>open s'\" using os eqButUID_open_eq by auto\n                    moreover obtain a1 uid1 uid1' p1\n                    where \"step s1 a1 = (outOK, ?s1')\" \"friends12 ?s1'\"\n                          \"a1 = Cact (cFriend uid1 p1 uid1')\"\n                          \"uid1 = UID1 \\<and> uid1' = UID2 \\<or> uid1 = UID2 \\<and> uid1' = UID1\"\n                          \"\\<phi> (Trans s1 a1 outOK ?s1')\"\n                          \"f (Trans s1 a1 outOK ?s1') = FVal True\"\n                          \"eqButUID s1 ?s1'\" \"validValSeqFrom vl1' ?s1'\"\n                      using rs1 IDs1 Friend vVS1 f12s1 unfolding vl1 FVal\n                      by (elim toggle_friends12_True; blast)\n                    moreover then have \"IDsOK ?s1' [UID1, UID2] [] [] []\" by (auto simp: c_defs)\n                    moreover have \"friendIDs s' = friendIDs ?s1'\"\n                      using Friend(6) f12s1 unfolding s'\n                      by (intro eqButUID_createFriend12_friendIDs_eq[OF ss1 rs rs1]) auto\n                    ultimately show ?match\n                      using ss1 FVal_BO Friend UID1_UID2_UIDs vl' vl1' unfolding vl1 fv\n                      by (intro matchI[of s1 a1 \"outOK\" ?s1'])\n                         (auto simp: consume_def intro: eqButUID_trans eqButUID_sym\n                               intro!: \\<Delta>3_I[of s' ?s1' vl'' vl1'' vl1' \"[]\" \"[]\" vl'])\n                next\n                  case (Unfriend uid p uid')\n                    then have IDs1: \"IDsOK s1 [UID1, UID2] [] [] []\"\n                          and f12s1: \"friends12 s1\"\n                          and fv: \"fv = False\"\n                      using ss1 vVS1 FVal unfolding eqButUID_def vl1 by auto\n                    let ?s1' = \"deleteFriend s1 UID1 (pass s1 UID1) UID2\"\n                    have s': \"s' = deleteFriend s UID1 p UID2\"\n                      using Unfriend step by (auto simp: deleteFriend_sym)\n                    have ss': \"eqButUID s s'\" using rs step Unfriend\n                      by (auto intro: Dact_dFriend_step_eqButUID)\n                    moreover then have os': \"\\<not>open s'\" using os eqButUID_open_eq by auto\n                    moreover obtain a1 uid1 uid1' p1\n                    where \"step s1 a1 = (outOK, ?s1')\" \"\\<not>friends12 ?s1'\"\n                          \"a1 = Dact (dFriend uid1 p1 uid1')\"\n                          \"uid1 = UID1 \\<and> uid1' = UID2 \\<or> uid1 = UID2 \\<and> uid1' = UID1\"\n                          \"\\<phi> (Trans s1 a1 outOK ?s1')\"\n                          \"f (Trans s1 a1 outOK ?s1') = FVal False\"\n                          \"eqButUID s1 ?s1'\" \"validValSeqFrom vl1' ?s1'\"\n                      using rs1 IDs1 Unfriend vVS1 f12s1 unfolding vl1 FVal\n                      by (elim toggle_friends12_False; blast)\n                    moreover then have \"IDsOK ?s1' [UID1, UID2] [] [] []\" by (auto simp: d_defs)\n                    moreover have \"friendIDs s' = friendIDs ?s1'\"\n                      using Unfriend(6) f12s1 unfolding s'\n                      by (intro eqButUID_deleteFriend12_friendIDs_eq[OF ss1 rs rs1])\n                    ultimately show ?match\n                      using ss1 FVal_BO Unfriend UID1_UID2_UIDs vl' vl1' unfolding vl1 fv\n                      by (intro matchI[of s1 a1 \"outOK\" ?s1'])\n                         (auto simp: consume_def intro: eqButUID_trans eqButUID_sym\n                               intro!: \\<Delta>3_I[of s' ?s1' vl'' vl1'' vl1' \"[]\" \"[]\" vl'])\n                qed auto\n                then show ?thesis ..\n            qed auto\n          next\n            assume n\\<phi>: \"\\<not>\\<phi> ?trn\"\n            then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n              using step_open_\\<phi>[OF step] step_friends12_\\<phi>[OF step] by auto\n            have vl': \"vl' = vl\" using n\\<phi> c by (auto simp: consume_def)\n            show ?thesis proof (cases \"\\<forall>req. a \\<noteq> Cact (cFriend UID1 (pass s UID1) UID2) \\<and>\n                                             a \\<noteq> Cact (cFriend UID2 (pass s UID2) UID1) \\<and>\n                                             a \\<noteq> Cact (cFriendReq UID2 (pass s UID2) UID1 req) \\<and>\n                                             a \\<noteq> Cact (cFriendReq UID1 (pass s UID1) UID2 req) \\<and>\n                                             a \\<noteq> Dact (dFriend UID1 (pass s UID1) UID2) \\<and>\n                                             a \\<noteq> Dact (dFriend UID2 (pass s UID2) UID1)\")\n              case True\n                obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n                let ?trn1 = \"Trans s1 a ou1 s1'\"\n                from True n\\<phi> have n\\<phi>': \"\\<not>\\<phi> ?trn1\"\n                  using eqButUID_step_\\<phi>[OF ss1 rs rs1 step step1] by auto\n                then have f12s1': \"friends12 s1 = friends12 s1'\"\n                      and pFRs': \"UID1 \\<in>\\<in> pendingFReqs s1 UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s1' UID2\"\n                                 \"UID2 \\<in>\\<in> pendingFReqs s1 UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s1' UID1\"\n                  using step_friends12_\\<phi>[OF step1] step_pendingFReqs_\\<phi>[OF step1]\n                  by auto\n                have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n                thm \\<Delta>3_I[of s' s1' vl'' vl1'' vl1 \"[fv]\" \"[fv]\" vl']\n                then have \"\\<Delta>3 s' vl' s1' vl1\" using os vVS1 fs' fs1' FVal_BO\n                  unfolding os' f12s1' pFRs' vl'\n                  by (intro \\<Delta>3_I[of s' s1' vl'' vl1'' vl1 \"[fv]\" \"[fv]\" vl]) auto\n                then have ?match\n                  using step1 n\\<phi>' os eqButUID_step_\\<gamma>_out[OF ss1 step step1]\n                  by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n                then show \"?match \\<or> ?ignore\" ..\n            next\n              case False\n                with n\\<phi> have \"ou \\<noteq> outOK\" by auto\n                then have \"s' = s\" using step False by auto\n                then have ?ignore using 3 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n                then show \"?match \\<or> ?ignore\" ..\n            qed\n          qed\n        qed\n        then show ?thesis using fs' by auto\n    next\n      case (OVal vl'' vl1'')\n        then have fs': \"filter (Not o isFRVal) vl = OVal True # vl''\"\n              and fs1': \"filter (Not o isFRVal) vl1 = OVal True # vl1''\"\n              and BO'': \"BO vl'' vl1''\"\n          using fs fs1 by auto\n        from fs fs' have fs: \"fs = []\" by (cases fs) auto\n        with fs_fIDs have fIDs: \"friendIDs s = friendIDs s1\" by auto\n        have ?react proof\n          fix a :: act and ou :: out and s' :: state and vl'\n          let ?trn = \"Trans s a ou s'\"  let ?trn1 = \"Trans s1 a ou s'\"\n          assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n          show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n          proof cases\n            assume \\<phi>: \"\\<phi> ?trn\"\n            with c have vl: \"vl = f ?trn # vl'\" by (auto simp: consume_def)\n            with fs' show ?thesis proof (cases \"f ?trn\")\n              case (FRVal u req)\n                obtain p\n                where a: \"(a = Cact (cFriendReq UID1 p UID2 req) \\<and> UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<and>\n                           UID1 \\<notin> set (pendingFReqs s UID2) \\<and>\n                           (UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s UID1)) \\<or>\n                          (a = Cact (cFriendReq UID2 p UID1 req) \\<and> UID2 \\<in>\\<in> pendingFReqs s' UID1 \\<and>\n                           UID2 \\<notin> set (pendingFReqs s UID1) \\<and>\n                           (UID1 \\<in>\\<in> pendingFReqs s' UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s UID2))\"\n                         \"ou = outOK\" \"\\<not>friends12 s\" \"\\<not>friends12 s'\" \"open s' = open s\"\n                  using \\<phi> step rs FRVal by (cases rule: \\<phi>E) fastforce+\n                then have fIDs': \"friendIDs s' = friendIDs s\" using step by (auto simp: c_defs)\n                have \"eqButUID s s'\" using a step\n                  by (auto intro: Cact_cFriendReq_step_eqButUID)\n                then have \"\\<Delta>3 s' vl' s1 vl1\"\n                  using ss1 a os OVal(3) vVS1 fs' fs1' fs fs_fs1 fIDs' fIDs unfolding vl FRVal\n                  by (intro \\<Delta>3_I[of s' s1 vl'' vl1'' vl1 fs fs1 vl'])\n                     (auto intro: eqButUID_trans eqButUID_sym)\n                moreover from \\<phi> step rs a have \"\\<not>\\<gamma> (Trans s a ou s')\"\n                  using UID1_UID2_UIDs by (cases rule: \\<phi>E) auto\n                ultimately have ?ignore by (intro ignoreI) auto\n                then show ?thesis ..\n            next\n              case (OVal ov')\n                with vl fs' have OVal: \"f ?trn = OVal True\"\n                             and vl': \"filter (Not \\<circ> isFRVal) vl' = vl''\"\n                  by auto\n                from fs1' nFRVal1 obtain vl1'\n                where vl1: \"vl1 = OVal True # vl1'\"\n                  and vl1': \"filter (Not \\<circ> isFRVal) vl1' = vl1''\"\n                  by (cases vl1; cases \"hd vl1\") auto\n                have ?match using \\<phi> step rs OVal proof (cases rule: \\<phi>E)\n                  case (OpenF uid p uid')\n                    let ?s1' = \"createFriend s1 uid p uid'\"\n                    have s': \"s' = createFriend s uid p uid'\"\n                      using OpenF step by auto\n                    from OpenF(2) have uids: \"uid \\<noteq> UID1 \\<and> uid \\<noteq> UID2 \\<and> uid' = UID1 \\<or>\n                                        uid \\<noteq> UID1 \\<and> uid \\<noteq> UID2 \\<and> uid' = UID2 \\<or>\n                                        uid' \\<noteq> UID1 \\<and> uid' \\<noteq> UID2 \\<and> uid = UID1 \\<or>\n                                        uid' \\<noteq> UID1 \\<and> uid' \\<noteq> UID2 \\<and> uid = UID2\"\n                      using UID1_UID2_UIDs by auto\n                    have \"eqButUIDf (pendingFReqs s) (pendingFReqs s1)\"\n                      using ss1 unfolding eqButUID_def by auto\n                    then have \"uid' \\<in>\\<in> pendingFReqs s uid \\<longleftrightarrow> uid' \\<in>\\<in> pendingFReqs s1 uid\"\n                      using OpenF by (intro eqButUIDf_not_UID') auto\n                    then have step1: \"step s1 a = (outOK, ?s1')\"\n                      using OpenF step ss1 fIDs unfolding eqButUID_def by (auto simp: c_defs)\n                    have s's1': \"eqButUID s' ?s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n                    moreover have os': \"open s'\" using OpenF unfolding open_def by auto\n                    moreover have fIDs': \"friendIDs s' = friendIDs ?s1'\"\n                      using fIDs unfolding s' by (auto simp: c_defs)\n                    moreover have f12s1: \"friends12 s1 = friends12 ?s1'\"\n                                  \"UID1 \\<in>\\<in> pendingFReqs s1 UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs ?s1' UID2\"\n                                  \"UID2 \\<in>\\<in> pendingFReqs s1 UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs ?s1' UID1\"\n                      using uids unfolding friends12_def c_defs by auto\n                    moreover then have \"validValSeqFrom vl1' ?s1'\" using vVS1 unfolding vl1 by auto\n                    ultimately have \"\\<Delta>1 s' vl' ?s1' vl1'\"\n                      using BO'' IDsOK_mono[OF step1 IDs1] unfolding \\<Delta>1_def vl' vl1' by auto\n                    moreover have \"\\<phi> ?trn \\<longleftrightarrow> \\<phi> (Trans s1 a outOK ?s1')\"\n                      using OpenF(1) uids by (intro eqButUID_step_\\<phi>[OF ss1 rs rs1 step step1]) auto\n                    ultimately show ?match using step1 \\<phi> OpenF(1,3,4) unfolding vl1\n                      by (intro matchI[of s1 a outOK ?s1' _ vl1']) (auto simp: consume_def)\n                qed auto\n                then show ?thesis ..\n            qed auto\n        next\n          assume n\\<phi>: \"\\<not>\\<phi> ?trn\"\n            then have os': \"open s = open s'\" and f12s': \"friends12 s = friends12 s'\"\n              using step_open_\\<phi>[OF step] step_friends12_\\<phi>[OF step] by auto\n            have vl': \"vl' = vl\" using n\\<phi> c by (auto simp: consume_def)\n            show ?thesis proof (cases \"\\<forall>req. a \\<noteq> Cact (cFriend UID1 (pass s UID1) UID2) \\<and>\n                                             a \\<noteq> Cact (cFriend UID2 (pass s UID2) UID1) \\<and>\n                                             a \\<noteq> Cact (cFriendReq UID2 (pass s UID2) UID1 req) \\<and>\n                                             a \\<noteq> Cact (cFriendReq UID1 (pass s UID1) UID2 req) \\<and>\n                                             a \\<noteq> Dact (dFriend UID1 (pass s UID1) UID2) \\<and>\n                                             a \\<noteq> Dact (dFriend UID2 (pass s UID2) UID1)\")\n              case True\n                obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\") auto\n                let ?trn1 = \"Trans s1 a ou1 s1'\"\n                from True n\\<phi> have n\\<phi>': \"\\<not>\\<phi> ?trn1\"\n                  using eqButUID_step_\\<phi>[OF ss1 rs rs1 step step1] by auto\n                then have f12s1': \"friends12 s1 = friends12 s1'\"\n                      and pFRs': \"UID1 \\<in>\\<in> pendingFReqs s1 UID2 \\<longleftrightarrow> UID1 \\<in>\\<in> pendingFReqs s1' UID2\"\n                                 \"UID2 \\<in>\\<in> pendingFReqs s1 UID1 \\<longleftrightarrow> UID2 \\<in>\\<in> pendingFReqs s1' UID1\"\n                  using step_friends12_\\<phi>[OF step1] step_pendingFReqs_\\<phi>[OF step1]\n                  by auto\n                have \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n                moreover have \"friendIDs s' = friendIDs s1'\"\n                  using eqButUID_step_friendIDs_eq[OF ss1 rs rs1 step step1 _ fIDs] True\n                  by auto\n                ultimately have \"\\<Delta>3 s' vl' s1' vl1\" using os vVS1 fs' fs1' OVal\n                  unfolding os' f12s1' pFRs' vl'\n                  by (intro \\<Delta>3_I[of s' s1' vl'' vl1'' vl1 \"[]\" \"[]\" vl]) auto\n                then have ?match\n                  using step1 n\\<phi>' os eqButUID_step_\\<gamma>_out[OF ss1 step step1]\n                  by (intro matchI[of s1 a ou1 s1' vl1 vl1]) (auto simp: consume_def)\n                then show \"?match \\<or> ?ignore\" ..\n            next\n              case False\n                with n\\<phi> have \"ou \\<noteq> outOK\" by auto\n                then have \"s' = s\" using step False by auto\n                then have ?ignore using 3 False UID1_UID2_UIDs unfolding vl' by (intro ignoreI) auto\n                then show \"?match \\<or> ?ignore\" ..\n            qed\n          qed\n        qed\n        then show ?thesis using fs' by auto\n    next\n      case (FVal1 fv fs' fs1')\n        from this(1) have \"False\" proof (induction fs' arbitrary: fs)\n          case (Cons fv'' fs'')\n            then obtain fs''' where \"map FVal (fv'' # fs''') @ OVal True # vlr = map FVal (fv'' # fs'')\"\n              by (cases fs) auto\n            with Cons.IH[of fs'''] show \"False\" by auto\n        qed auto\n        then show ?thesis ..\n    next\n      case (FVal) then show ?thesis by (induction fs) auto next\n      case (Nil) then show ?thesis by auto\n    qed\n  qed\nqed\n\n\n\ndefinition Gr where\n\"Gr =\n {\n (\\<Delta>0, {\\<Delta>0,\\<Delta>1,\\<Delta>2,\\<Delta>3}),\n (\\<Delta>1, {\\<Delta>1,\\<Delta>2,\\<Delta>3}),\n (\\<Delta>2, {\\<Delta>2,\\<Delta>1}),\n (\\<Delta>3, {\\<Delta>3,\\<Delta>1})\n }\"\n\n\ntheorem secure: secure\napply (rule unwind_decomp_secure_graph[of Gr \\<Delta>0])\nunfolding Gr_def\napply (simp, smt insert_subset order_refl)\nusing\nistate_\\<Delta>0 unwind_cont_\\<Delta>0 unwind_cont_\\<Delta>1 unwind_cont_\\<Delta>2 unwind_cont_\\<Delta>3\nunfolding Gr_def by (auto intro: unwind_cont_mono)\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMeDis/Friend_Request_Confidentiality/Friend_Request.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3282217355093589}}
{"text": "(*  Title:      Lazy_Intruder.thy\n    Author:     Andreas Viktor Hess, DTU\n    SPDX-License-Identifier: BSD-3-Clause\n*)\n\nsection \\<open>The Lazy Intruder\\<close>\ntheory Lazy_Intruder\nimports Strands_and_Constraints Intruder_Deduction\nbegin\n\ncontext intruder_model\nbegin\n\nsubsection \\<open>Definition of the Lazy Intruder\\<close>\ntext \\<open>The lazy intruder constraint reduction system, defined as a relation on constraint states\\<close>\ninductive_set LI_rel::\n    \"((('fun,'var) strand \\<times> (('fun,'var) subst)) \\<times>\n       ('fun,'var) strand \\<times> (('fun,'var) subst)) set\"\n  and LI_rel' (infix \"\\<leadsto>\" 50)\n  and LI_rel_trancl (infix \"\\<leadsto>\\<^sup>+\" 50)\n  and LI_rel_rtrancl (infix \"\\<leadsto>\\<^sup>*\" 50)\nwhere\n  \"A \\<leadsto> B \\<equiv> (A,B) \\<in> LI_rel\"\n| \"A \\<leadsto>\\<^sup>+ B \\<equiv> (A,B) \\<in> LI_rel\\<^sup>+\"\n| \"A \\<leadsto>\\<^sup>* B \\<equiv> (A,B) \\<in> LI_rel\\<^sup>*\"\n\n| Compose: \"\\<lbrakk>simple S; length T = arity f; public f\\<rbrakk>\n            \\<Longrightarrow> (S@Send [Fun f T]#S',\\<theta>) \\<leadsto> (S@(map Send1 T)@S',\\<theta>)\"\n| Unify: \"\\<lbrakk>simple S; Fun f T' \\<in> ik\\<^sub>s\\<^sub>t S; Some \\<delta> = mgu (Fun f T) (Fun f T')\\<rbrakk>\n          \\<Longrightarrow> (S@Send [Fun f T]#S',\\<theta>) \\<leadsto> ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>,\\<theta> \\<circ>\\<^sub>s \\<delta>)\"\n| Equality: \"\\<lbrakk>simple S; Some \\<delta> = mgu t t'\\<rbrakk>\n          \\<Longrightarrow> (S@Equality _ t t'#S',\\<theta>) \\<leadsto> ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>,\\<theta> \\<circ>\\<^sub>s \\<delta>)\"\n\n\ntext \\<open>A \"pre-processing step\" to be applied before constraint reduction. It transforms constraints\nsuch that exactly one message is transmitted in each message transmission step. It is sound and\ncomplete and preserves the various well-formedness properties required by the lazy intruder.\\<close>\nfun LI_preproc where\n  \"LI_preproc [] = []\"\n| \"LI_preproc (Send ts#S) = map Send1 ts@LI_preproc S\"\n| \"LI_preproc (Receive ts#S) = map Receive1 ts@LI_preproc S\"\n| \"LI_preproc (x#S) = x#LI_preproc S\"\n\ndefinition LI_preproc_prop where\n  \"LI_preproc_prop S \\<equiv> \\<forall>ts. Send ts \\<in> set S \\<or> Receive ts \\<in> set S \\<longrightarrow> (\\<exists>t. ts = [t])\" \n\n\nsubsection \\<open>Lemmata: Preprocessing \\<close>\nlemma LI_preproc_preproc_prop:\n  \"LI_preproc_prop (LI_preproc S)\"\nby (induct S rule: LI_preproc.induct) (auto simp add: LI_preproc_prop_def)\n\nlemma LI_preproc_sem_eq:\n  \"\\<lbrakk>M; S\\<rbrakk>\\<^sub>c \\<I> \\<longleftrightarrow> \\<lbrakk>M; LI_preproc S\\<rbrakk>\\<^sub>c \\<I>\" (is \"?A \\<longleftrightarrow> ?B\")\nproof\n  show \"?A \\<Longrightarrow> ?B\"\n  proof (induction S rule: strand_sem_induct)\n    case (ConsSnd M ts S)\n    hence \"\\<lbrakk>M; LI_preproc S\\<rbrakk>\\<^sub>c \\<I>\" \"\\<lbrakk>M; map Send1 ts\\<rbrakk>\\<^sub>c \\<I>\" using strand_sem_Send_map(5) by auto\n    moreover have \"ik\\<^sub>s\\<^sub>t (map Send1 ts) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> = {}\" unfolding ik\\<^sub>s\\<^sub>t_is_rcv_set by fastforce\n    ultimately show ?case using strand_sem_append(1) by simp\n  next\n    case (ConsRcv M ts S)\n    hence \"\\<lbrakk>(set ts \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>) \\<union> M; LI_preproc S\\<rbrakk>\\<^sub>c \\<I>\" \"\\<lbrakk>M; map Receive1 ts\\<rbrakk>\\<^sub>c \\<I>\"\n      using strand_sem_Receive_map(3) by auto\n    moreover have \"ik\\<^sub>s\\<^sub>t (map Receive1 ts) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> = set ts \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" unfolding ik\\<^sub>s\\<^sub>t_is_rcv_set by force\n    ultimately show ?case using strand_sem_append(1) by (simp add: Un_commute)\n  qed simp_all\n\n  show \"?B \\<Longrightarrow> ?A\"\n  proof (induction S arbitrary: M rule: LI_preproc.induct)\n    case (2 ts S)\n    have \"ik\\<^sub>s\\<^sub>t (map Send1 ts) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> = {}\" unfolding ik\\<^sub>s\\<^sub>t_is_rcv_set by fastforce\n    hence \"\\<lbrakk>M; S\\<rbrakk>\\<^sub>c \\<I>\" \"\\<lbrakk>M; map Send1 ts\\<rbrakk>\\<^sub>c \\<I>\" using 2 strand_sem_append(1) by auto\n    thus ?case using strand_sem_Send_map(5) by simp\n  next\n    case (3 ts S)\n    have \"ik\\<^sub>s\\<^sub>t (map Receive1 ts) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> = set ts \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" unfolding ik\\<^sub>s\\<^sub>t_is_rcv_set by force\n    hence \"\\<lbrakk>M \\<union> (set ts \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>); S\\<rbrakk>\\<^sub>c \\<I>\" \"\\<lbrakk>M; map Receive1 ts\\<rbrakk>\\<^sub>c \\<I>\"\n      using 3 strand_sem_append(1) by auto\n    thus ?case using strand_sem_Receive_map(3) by (simp add: Un_commute)\n  qed simp_all\nqed\n\nlemma LI_preproc_sem_eq':\n  \"(\\<I> \\<Turnstile>\\<^sub>c \\<langle>S, \\<theta>\\<rangle>) \\<longleftrightarrow> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>LI_preproc S, \\<theta>\\<rangle>)\"\nusing LI_preproc_sem_eq unfolding constr_sem_c_def by simp\n\nlemma LI_preproc_vars_eq:\n  \"fv\\<^sub>s\\<^sub>t (LI_preproc S) = fv\\<^sub>s\\<^sub>t S\"\n  \"bvars\\<^sub>s\\<^sub>t (LI_preproc S) = bvars\\<^sub>s\\<^sub>t S\"\n  \"vars\\<^sub>s\\<^sub>t (LI_preproc S) = vars\\<^sub>s\\<^sub>t S\"\nby (induct S rule: LI_preproc.induct) auto\n\nlemma LI_preproc_trms_eq:\n  \"trms\\<^sub>s\\<^sub>t (LI_preproc S) = trms\\<^sub>s\\<^sub>t S\"\nby (induct S rule: LI_preproc.induct) auto\n\nlemma LI_preproc_wf\\<^sub>s\\<^sub>t:\n  assumes \"wf\\<^sub>s\\<^sub>t X S\"\n  shows \"wf\\<^sub>s\\<^sub>t X (LI_preproc S)\"\n  using assms\nproof (induction S arbitrary: X rule: wf\\<^sub>s\\<^sub>t_induct)\n  case (ConsRcv X ts S)\n  hence \"fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts) \\<subseteq> X\" \"wf\\<^sub>s\\<^sub>t X (LI_preproc S)\" by auto\n  thus ?case using wf_Receive1_prefix by simp\nnext\n  case (ConsSnd X ts S)\n  hence \"wf\\<^sub>s\\<^sub>t (X \\<union> fv\\<^sub>s\\<^sub>e\\<^sub>t (set ts)) (LI_preproc S)\" by simp\n  thus ?case using wf_Send1_prefix by simp\nqed simp_all\n\nlemma LI_preproc_preserves_wellformedness:\n  assumes \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S \\<theta>\"\n  shows \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r (LI_preproc S) \\<theta>\"\nusing assms LI_preproc_vars_eq[of S] LI_preproc_wf\\<^sub>s\\<^sub>t[of \"{}\" S] unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def by argo\n\nlemma LI_preproc_prop_SendE:\n  assumes \"LI_preproc_prop S\"\n    and \"Send ts \\<in> set S\"\n  shows \"(\\<exists>x. ts = [Var x]) \\<or> (\\<exists>f T. ts = [Fun f T])\"\nproof -\n  obtain t where \"ts = [t]\" using assms unfolding LI_preproc_prop_def by auto\n  thus ?thesis by (cases t) auto\nqed\n\nlemma LI_preproc_prop_split:\n  \"LI_preproc_prop (S@S') \\<longleftrightarrow> LI_preproc_prop S \\<and> LI_preproc_prop S'\" (is \"?A \\<longleftrightarrow> ?B\")\nproof\n  show \"?A \\<Longrightarrow> ?B\"\n  proof (induction S)\n    case (Cons x S) thus ?case unfolding LI_preproc_prop_def by (cases x) auto\n  qed (simp add: LI_preproc_prop_def)\n\n  show \"?B \\<Longrightarrow> ?A\"\n  proof (induction S)\n    case (Cons x S) thus ?case unfolding LI_preproc_prop_def by (cases x) auto\n  qed (simp add: LI_preproc_prop_def)\nqed\n\nsubsection \\<open>Lemma: The Lazy Intruder is Well-founded\\<close>\ncontext\nbegin\nprivate lemma LI_compose_measure_lt:\n  \"((S@(map Send1 T)@S',\\<theta>\\<^sub>1), (S@Send [Fun f T]#S',\\<theta>\\<^sub>2)) \\<in> measure\\<^sub>s\\<^sub>t\"\nusing strand_fv_card_map_fun_eq[of S f T S'] strand_size_map_fun_lt[of T f]\nby (simp add: measure\\<^sub>s\\<^sub>t_def size\\<^sub>s\\<^sub>t_def)\n\nprivate lemma LI_unify_measure_lt:\n  assumes \"Some \\<delta> = mgu (Fun f T) t\" \"fv t \\<subseteq> fv\\<^sub>s\\<^sub>t S\"\n  shows \"(((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>,\\<theta>\\<^sub>1), (S@Send [Fun f T]#S',\\<theta>\\<^sub>2)) \\<in> measure\\<^sub>s\\<^sub>t\"\nproof (cases \"\\<delta> = Var\")\n  assume \"\\<delta> = Var\"\n  hence \"(S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta> = S@S'\" by blast\n  thus ?thesis\n    using strand_fv_card_rm_fun_le[of S S' f T]\n    by (auto simp add: measure\\<^sub>s\\<^sub>t_def size\\<^sub>s\\<^sub>t_def)\nnext\n  assume \"\\<delta> \\<noteq> Var\"\n  then obtain v where \"v \\<in> fv (Fun f T) \\<union> fv t\" \"subst_elim \\<delta> v\"\n    using mgu_eliminates[OF assms(1)[symmetric]] by metis\n  hence v_in: \"v \\<in> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n    using assms(2) by (auto simp add: measure\\<^sub>s\\<^sub>t_def size\\<^sub>s\\<^sub>t_def)\n  \n  have \"range_vars \\<delta> \\<subseteq> fv (Fun f T) \\<union> fv\\<^sub>s\\<^sub>t S\"\n    using assms(2) mgu_vars_bounded[OF assms(1)[symmetric]] by auto\n  hence img_bound: \"range_vars \\<delta> \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\" by auto\n\n  have finite_fv: \"finite (fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S'))\" by auto\n\n  have \"v \\<notin> fv\\<^sub>s\\<^sub>t ((S@Send [Fun f T]#S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)\"\n    using strand_fv_subst_subset_if_subst_elim[OF \\<open>subst_elim \\<delta> v\\<close>] v_in by metis\n  hence v_not_in: \"v \\<notin> fv\\<^sub>s\\<^sub>t ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)\" by auto\n  \n  have \"fv\\<^sub>s\\<^sub>t ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n    using strand_subst_fv_bounded_if_img_bounded[OF img_bound] by simp\n  hence \"fv\\<^sub>s\\<^sub>t ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<subset> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\" using v_in v_not_in by blast\n  hence \"card (fv\\<^sub>s\\<^sub>t ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)) < card (fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S'))\"\n    using psubset_card_mono[OF finite_fv] by simp\n  thus ?thesis by (auto simp add: measure\\<^sub>s\\<^sub>t_def size\\<^sub>s\\<^sub>t_def)\nqed\n\nprivate lemma LI_equality_measure_lt:\n  assumes \"Some \\<delta> = mgu t t'\"\n  shows \"(((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>,\\<theta>\\<^sub>1), (S@Equality a t t'#S',\\<theta>\\<^sub>2)) \\<in> measure\\<^sub>s\\<^sub>t\"\nproof (cases \"\\<delta> = Var\")\n  assume \"\\<delta> = Var\"\n  hence \"(S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta> = S@S'\" by blast\n  thus ?thesis\n    using strand_fv_card_rm_eq_le[of S S' a t t']\n    by (auto simp add: measure\\<^sub>s\\<^sub>t_def size\\<^sub>s\\<^sub>t_def)\nnext\n  assume \"\\<delta> \\<noteq> Var\"\n  then obtain v where \"v \\<in> fv t \\<union> fv t'\" \"subst_elim \\<delta> v\"\n    using mgu_eliminates[OF assms(1)[symmetric]] by metis\n  hence v_in: \"v \\<in> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\" using assms by auto\n  \n  have \"range_vars \\<delta> \\<subseteq> fv t \\<union> fv t' \\<union> fv\\<^sub>s\\<^sub>t S\"\n    using assms mgu_vars_bounded[OF assms(1)[symmetric]] by auto\n  hence img_bound: \"range_vars \\<delta> \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\" by auto\n\n  have finite_fv: \"finite (fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S'))\" by auto\n\n  have \"v \\<notin> fv\\<^sub>s\\<^sub>t ((S@Equality a t t'#S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)\"\n    using strand_fv_subst_subset_if_subst_elim[OF \\<open>subst_elim \\<delta> v\\<close>] v_in by metis\n  hence v_not_in: \"v \\<notin> fv\\<^sub>s\\<^sub>t ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)\" by auto\n  \n  have \"fv\\<^sub>s\\<^sub>t ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n    using strand_subst_fv_bounded_if_img_bounded[OF img_bound] by simp\n  hence \"fv\\<^sub>s\\<^sub>t ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<subset> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\" using v_in v_not_in by blast\n  hence \"card (fv\\<^sub>s\\<^sub>t ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)) < card (fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S'))\"\n    using psubset_card_mono[OF finite_fv] by simp\n  thus ?thesis by (auto simp add: measure\\<^sub>s\\<^sub>t_def size\\<^sub>s\\<^sub>t_def)\nqed\n\nprivate lemma LI_in_measure: \"(S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto> (S\\<^sub>2,\\<theta>\\<^sub>2) \\<Longrightarrow> ((S\\<^sub>2,\\<theta>\\<^sub>2),(S\\<^sub>1,\\<theta>\\<^sub>1)) \\<in> measure\\<^sub>s\\<^sub>t\"\nproof (induction rule: LI_rel.induct)\n  case (Compose S T f S' \\<theta>) thus ?case using LI_compose_measure_lt[of S T S'] by metis\nnext\n  case (Unify S f U \\<delta> T S' \\<theta>)\n  hence \"fv (Fun f U) \\<subseteq> fv\\<^sub>s\\<^sub>t S\"\n    using fv_snd_rcv_strand_subset(2)[of S] by force\n  thus ?case using LI_unify_measure_lt[OF Unify.hyps(3), of S S'] by metis\nqed (metis LI_equality_measure_lt)\n\nprivate lemma LI_in_measure_trans: \"(S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto>\\<^sup>+ (S\\<^sub>2,\\<theta>\\<^sub>2) \\<Longrightarrow> ((S\\<^sub>2,\\<theta>\\<^sub>2),(S\\<^sub>1,\\<theta>\\<^sub>1)) \\<in> measure\\<^sub>s\\<^sub>t\"\nby (induction rule: trancl.induct, metis surjective_pairing LI_in_measure)\n   (metis (no_types, lifting) surjective_pairing LI_in_measure measure\\<^sub>s\\<^sub>t_trans trans_def)\n\nprivate lemma LI_converse_wellfounded_trans: \"wf ((LI_rel\\<^sup>+)\\<inverse>)\"\nproof -\n  have \"(LI_rel\\<^sup>+)\\<inverse> \\<subseteq> measure\\<^sub>s\\<^sub>t\" using LI_in_measure_trans by auto\n  thus ?thesis using measure\\<^sub>s\\<^sub>t_wellfounded wf_subset by metis\nqed\n\nprivate lemma LI_acyclic_trans: \"acyclic (LI_rel\\<^sup>+)\"\nusing wf_acyclic[OF LI_converse_wellfounded_trans] acyclic_converse by metis\n\nprivate lemma LI_acyclic: \"acyclic LI_rel\"\nusing LI_acyclic_trans acyclic_subset by (simp add: acyclic_def)\n\nlemma LI_no_infinite_chain: \"\\<not>(\\<exists>f. \\<forall>i. f i \\<leadsto>\\<^sup>+ f (Suc i))\"\nproof -\n  have \"\\<not>(\\<exists>f. \\<forall>i. (f (Suc i), f i) \\<in> (LI_rel\\<^sup>+)\\<inverse>)\"\n    using wf_iff_no_infinite_down_chain LI_converse_wellfounded_trans by metis\n  thus ?thesis by simp\nqed\n\nprivate lemma LI_unify_finite:\n  assumes \"finite M\"\n  shows \"finite {((S@Send [Fun f T]#S',\\<theta>), ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>,\\<theta> \\<circ>\\<^sub>s \\<delta>)) | \\<delta> T'. \n                   simple S \\<and> Fun f T' \\<in> M \\<and> Some \\<delta> = mgu (Fun f T) (Fun f T')}\"\nusing assms\nproof (induction M rule: finite_induct)\n  case (insert m M) thus ?case\n  proof (cases m)\n    case (Fun g U)\n    let ?a = \"\\<lambda>\\<delta>. ((S@Send [Fun f T]#S',\\<theta>), ((S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<delta>,\\<theta> \\<circ>\\<^sub>s \\<delta>))\"\n    let ?A = \"\\<lambda>B. {?a \\<delta> | \\<delta> T'. simple S \\<and> Fun f T' \\<in> B \\<and> Some \\<delta> = mgu (Fun f T) (Fun f T')}\"\n\n    have \"?A (insert m M) = (?A M) \\<union> (?A {m})\" by auto\n    moreover have \"finite (?A {m})\"\n    proof (cases \"\\<exists>\\<delta>. Some \\<delta> = mgu (Fun f T) (Fun g U)\")\n      case True\n      then obtain \\<delta> where \\<delta>: \"Some \\<delta> = mgu (Fun f T) (Fun g U)\" by blast\n      \n      have A_m_eq: \"\\<And>\\<delta>'. ?a \\<delta>' \\<in> ?A {m} \\<Longrightarrow> ?a \\<delta> = ?a \\<delta>'\"\n      proof -\n        fix \\<delta>' assume \"?a \\<delta>' \\<in> ?A {m}\"\n        hence \"\\<exists>\\<sigma>. Some \\<sigma> = mgu (Fun f T) (Fun g U) \\<and> ?a \\<sigma> = ?a \\<delta>'\"\n          using \\<open>m = Fun g U\\<close> by auto\n        thus \"?a \\<delta> = ?a \\<delta>'\" by (metis \\<delta> option.inject)\n      qed\n\n      have \"?A {m} = {} \\<or> ?A {m} = {?a \\<delta>}\"\n      proof (cases \"simple S \\<and> ?A {m} \\<noteq> {}\")\n        case True\n        hence \"simple S\" \"?A {m} \\<noteq> {}\" by meson+\n        hence \"?A {m} = {?a \\<delta> | \\<delta>. Some \\<delta> = mgu (Fun f T) (Fun g U)}\" using \\<open>m = Fun g U\\<close> by auto\n        hence \"?a \\<delta> \\<in> ?A {m}\" using \\<delta> by auto\n       show ?thesis\n        proof (rule ccontr)\n          assume \"\\<not>(?A {m} = {} \\<or> ?A {m} = {?a \\<delta>})\"\n          then obtain B where B: \"?A {m} = insert (?a \\<delta>) B\" \"?a \\<delta> \\<notin> B\" \"B \\<noteq> {}\"\n            using \\<open>?A {m} \\<noteq> {}\\<close> \\<open>?a \\<delta> \\<in> ?A {m}\\<close> by (metis (no_types, lifting) Set.set_insert)\n          then obtain b where b: \"?a \\<delta> \\<noteq> b\" \"b \\<in> B\" by (metis (no_types, lifting) ex_in_conv)\n          then obtain \\<delta>' where \\<delta>': \"b = ?a \\<delta>'\" using B(1) by blast\n          moreover have \"?a \\<delta>' \\<in> ?A {m}\" using B(1) b(2) \\<delta>' by auto\n          hence \"?a \\<delta> = ?a \\<delta>'\" by (blast dest!: A_m_eq)\n          ultimately show False using b(1) by simp\n        qed\n      qed auto\n      thus ?thesis by (metis (no_types, lifting) finite.emptyI finite_insert) \n    next\n      case False\n      hence \"?A {m} = {}\" using \\<open>m = Fun g U\\<close> by blast\n      thus ?thesis by (metis finite.emptyI)\n    qed\n    ultimately show ?thesis using insert.IH by auto\n  qed simp\nqed fastforce\nend\n\n\nsubsection \\<open>Lemma: The Lazy Intruder Preserves Well-formedness\\<close>\ncontext\nbegin\nprivate lemma LI_preserves_subst_wf_single:\n  assumes \"(S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto> (S\\<^sub>2,\\<theta>\\<^sub>2)\" \"fv\\<^sub>s\\<^sub>t S\\<^sub>1 \\<inter> bvars\\<^sub>s\\<^sub>t S\\<^sub>1 = {}\" \"wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\\<^sub>1\"\n  and \"subst_domain \\<theta>\\<^sub>1 \\<inter> vars\\<^sub>s\\<^sub>t S\\<^sub>1 = {}\" \"range_vars \\<theta>\\<^sub>1 \\<inter> bvars\\<^sub>s\\<^sub>t S\\<^sub>1 = {}\"\n  shows \"fv\\<^sub>s\\<^sub>t S\\<^sub>2 \\<inter> bvars\\<^sub>s\\<^sub>t S\\<^sub>2 = {}\" \"wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\\<^sub>2\"\n  and \"subst_domain \\<theta>\\<^sub>2 \\<inter> vars\\<^sub>s\\<^sub>t S\\<^sub>2 = {}\" \"range_vars \\<theta>\\<^sub>2 \\<inter> bvars\\<^sub>s\\<^sub>t S\\<^sub>2 = {}\"\nusing assms\nproof (induction rule: LI_rel.induct)\n  case (Compose S X f S' \\<theta>)\n  { case 1 thus ?case using vars_st_snd_map by auto }\n  { case 2 thus ?case using vars_st_snd_map by auto }\n  { case 3 thus ?case using vars_st_snd_map by force }\n  { case 4 thus ?case using vars_st_snd_map by auto }\nnext\n  case (Unify S f U \\<delta> T S' \\<theta>)\n  hence \"fv (Fun f U) \\<subseteq> fv\\<^sub>s\\<^sub>t S\" using fv_subset_if_in_strand_ik' by blast\n  hence *: \"subst_domain \\<delta> \\<union> range_vars \\<delta> \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n    using mgu_vars_bounded[OF Unify.hyps(3)[symmetric]]\n    unfolding range_vars_alt_def by (fastforce simp del: subst_range.simps)\n\n  have \"fv\\<^sub>s\\<^sub>t (S@S') \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\" \"vars\\<^sub>s\\<^sub>t (S@S') \\<subseteq> vars\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n    by auto\n  hence **: \"fv\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n            \"vars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<subseteq> vars\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n    using subst_sends_strand_fv_to_img[of \"S@S'\" \\<delta>]\n          strand_subst_vars_union_bound[of \"S@S'\" \\<delta>] *\n    by blast+\n\n  have \"wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\" by (fact mgu_gives_wellformed_subst[OF Unify.hyps(3)[symmetric]])\n  \n  { case 1\n    have \"bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = bvars\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n      using bvars_subst_ident[of \"S@S'\" \\<delta>] by auto\n    thus ?case using 1 ** by blast\n  }\n  { case 2\n    hence \"subst_domain \\<theta> \\<inter> subst_domain \\<delta> = {}\" \"subst_domain \\<theta> \\<inter> range_vars \\<delta> = {}\"\n      using * by blast+\n    thus ?case by (metis wf_subst_compose[OF \\<open>wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\\<close> \\<open>wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\\<close>])\n  }\n  { case 3\n    hence \"subst_domain \\<theta> \\<inter> vars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\" using ** by blast\n    moreover have \"v \\<in> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\" when \"v \\<in> subst_domain \\<delta>\" for v\n      using * that by blast\n    hence \"subst_domain \\<delta> \\<inter> fv\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\"\n      using mgu_eliminates_dom[OF Unify.hyps(3)[symmetric],\n                THEN strand_fv_subst_subset_if_subst_elim, of _ \"S@Send [Fun f T]#S'\"]\n      unfolding subst_elim_def by auto\n    moreover have \"bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = bvars\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n      using bvars_subst_ident[of \"S@S'\" \\<delta>] by auto\n    hence \"subst_domain \\<delta> \\<inter> bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\" using 3(1) * by blast\n    ultimately show ?case\n      using ** * subst_domain_compose[of \\<theta> \\<delta>] vars\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>t[of \"S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\"]\n      by blast\n  }\n  { case 4\n    have ***: \"bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = bvars\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n      using bvars_subst_ident[of \"S@S'\" \\<delta>] by auto\n    hence \"range_vars \\<delta> \\<inter> bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\" using 4(1) * by blast\n    thus ?case using subst_img_comp_subset[of \\<theta> \\<delta>] 4(4) *** by blast\n  }\nnext\n  case (Equality S \\<delta> t t' a S' \\<theta>)\n  hence *: \"subst_domain \\<delta> \\<union> range_vars \\<delta> \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n    using mgu_vars_bounded[OF Equality.hyps(2)[symmetric]]\n    unfolding range_vars_alt_def by fastforce\n\n  have \"fv\\<^sub>s\\<^sub>t (S@S') \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\" \"vars\\<^sub>s\\<^sub>t (S@S') \\<subseteq> vars\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n    by auto\n  hence **: \"fv\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n            \"vars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<subseteq> vars\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n    using subst_sends_strand_fv_to_img[of \"S@S'\" \\<delta>]\n          strand_subst_vars_union_bound[of \"S@S'\" \\<delta>] *\n    by blast+\n\n  have \"wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\" by (fact mgu_gives_wellformed_subst[OF Equality.hyps(2)[symmetric]])\n  \n  { case 1\n    have \"bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = bvars\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n      using bvars_subst_ident[of \"S@S'\" \\<delta>] by auto\n    thus ?case using 1 ** by blast\n  }\n  { case 2\n    hence \"subst_domain \\<theta> \\<inter> subst_domain \\<delta> = {}\" \"subst_domain \\<theta> \\<inter> range_vars \\<delta> = {}\"\n      using * by blast+\n    thus ?case by (metis wf_subst_compose[OF \\<open>wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\\<close> \\<open>wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<delta>\\<close>])\n  }\n  { case 3\n    hence \"subst_domain \\<theta> \\<inter> vars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\" using ** by blast\n    moreover have \"v \\<in> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\" when \"v \\<in> subst_domain \\<delta>\" for v\n      using * that by blast\n    hence \"subst_domain \\<delta> \\<inter> fv\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\"\n      using mgu_eliminates_dom[OF Equality.hyps(2)[symmetric],\n                THEN strand_fv_subst_subset_if_subst_elim, of _ \"S@Equality a t t'#S'\"]\n      unfolding subst_elim_def by auto\n    moreover have \"bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = bvars\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n      using bvars_subst_ident[of \"S@S'\" \\<delta>] by auto\n    hence \"subst_domain \\<delta> \\<inter> bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\" using 3(1) * by blast\n    ultimately show ?case\n      using ** * subst_domain_compose[of \\<theta> \\<delta>] vars\\<^sub>s\\<^sub>t_is_fv\\<^sub>s\\<^sub>t_bvars\\<^sub>s\\<^sub>t[of \"S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\"]\n      by blast\n  }\n  { case 4\n    have ***: \"bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = bvars\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n      using bvars_subst_ident[of \"S@S'\" \\<delta>] by auto\n    hence \"range_vars \\<delta> \\<inter> bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\" using 4(1) * by blast\n    thus ?case using subst_img_comp_subset[of \\<theta> \\<delta>] 4(4) *** by blast\n  }\nqed\n\nprivate lemma LI_preserves_subst_wf:\n  assumes \"(S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto>\\<^sup>* (S\\<^sub>2,\\<theta>\\<^sub>2)\" \"fv\\<^sub>s\\<^sub>t S\\<^sub>1 \\<inter> bvars\\<^sub>s\\<^sub>t S\\<^sub>1 = {}\" \"wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\\<^sub>1\"\n  and \"subst_domain \\<theta>\\<^sub>1 \\<inter> vars\\<^sub>s\\<^sub>t S\\<^sub>1 = {}\" \"range_vars \\<theta>\\<^sub>1 \\<inter> bvars\\<^sub>s\\<^sub>t S\\<^sub>1 = {}\"\n  shows \"fv\\<^sub>s\\<^sub>t S\\<^sub>2 \\<inter> bvars\\<^sub>s\\<^sub>t S\\<^sub>2 = {}\" \"wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t \\<theta>\\<^sub>2\"\n  and \"subst_domain \\<theta>\\<^sub>2 \\<inter> vars\\<^sub>s\\<^sub>t S\\<^sub>2 = {}\" \"range_vars \\<theta>\\<^sub>2 \\<inter> bvars\\<^sub>s\\<^sub>t S\\<^sub>2 = {}\"\nusing assms\nproof (induction S\\<^sub>2 \\<theta>\\<^sub>2 rule: rtrancl_induct2)\n  case (step S\\<^sub>i \\<theta>\\<^sub>i S\\<^sub>j \\<theta>\\<^sub>j)\n  { case 1 thus ?case using LI_preserves_subst_wf_single[OF \\<open>(S\\<^sub>i,\\<theta>\\<^sub>i) \\<leadsto> (S\\<^sub>j,\\<theta>\\<^sub>j)\\<close>] step.IH by metis }\n  { case 2 thus ?case using LI_preserves_subst_wf_single[OF \\<open>(S\\<^sub>i,\\<theta>\\<^sub>i) \\<leadsto> (S\\<^sub>j,\\<theta>\\<^sub>j)\\<close>] step.IH by metis }\n  { case 3 thus ?case using LI_preserves_subst_wf_single[OF \\<open>(S\\<^sub>i,\\<theta>\\<^sub>i) \\<leadsto> (S\\<^sub>j,\\<theta>\\<^sub>j)\\<close>] step.IH by metis }\n  { case 4 thus ?case using LI_preserves_subst_wf_single[OF \\<open>(S\\<^sub>i,\\<theta>\\<^sub>i) \\<leadsto> (S\\<^sub>j,\\<theta>\\<^sub>j)\\<close>] step.IH by metis }\nqed metis\n\nlemma LI_preserves_wellformedness:\n  assumes \"(S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto>\\<^sup>* (S\\<^sub>2,\\<theta>\\<^sub>2)\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\"\n  shows \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>2 \\<theta>\\<^sub>2\"\nproof -\n  have *: \"wf\\<^sub>s\\<^sub>t {} S\\<^sub>j\"\n    when \"(S\\<^sub>i, \\<theta>\\<^sub>i) \\<leadsto> (S\\<^sub>j, \\<theta>\\<^sub>j)\" \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>i \\<theta>\\<^sub>i\" for S\\<^sub>i \\<theta>\\<^sub>i S\\<^sub>j \\<theta>\\<^sub>j\n    using that\n  proof (induction rule: LI_rel.induct)\n    case (Compose S T f S' \\<theta>) thus ?case by (metis wf_send_compose wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n  next\n    case (Unify S f U \\<delta> T S' \\<theta>)\n    have \"fv (Fun f T) \\<union> fv (Fun f U) \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\" using Unify.hyps(2) by force\n    hence \"subst_domain \\<delta> \\<union> range_vars \\<delta> \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n      using mgu_vars_bounded[OF Unify.hyps(3)[symmetric]] by (metis subset_trans)\n    hence \"(subst_domain \\<delta> \\<union> range_vars \\<delta>) \\<inter> bvars\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S') = {}\"\n      using Unify.prems unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def by blast\n    thus ?case\n      using wf_unify[OF _ Unify.hyps(2) MGU_is_Unifier[OF mgu_gives_MGU], of \"{}\",\n                     OF _ Unify.hyps(3)[symmetric], of S'] Unify.prems(1)\n      by (auto simp add: wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n  next\n    case (Equality S \\<delta> t t' a S' \\<theta>)\n    have \"fv t \\<union> fv t' \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\" using Equality.hyps(2) by force\n    hence \"subst_domain \\<delta> \\<union> range_vars \\<delta> \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n      using mgu_vars_bounded[OF Equality.hyps(2)[symmetric]] by (metis subset_trans)\n    hence \"(subst_domain \\<delta> \\<union> range_vars \\<delta>) \\<inter> bvars\\<^sub>s\\<^sub>t (S@Equality a t t'#S') = {}\"\n      using Equality.prems unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def by blast\n    thus ?case\n      using wf_equality[OF _ Equality.hyps(2)[symmetric], of \"{}\" S a S'] Equality.prems(1)\n      by (auto simp add: wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n  qed\n\n  show ?thesis using assms\n  proof (induction rule: rtrancl_induct2)\n    case (step S\\<^sub>i \\<theta>\\<^sub>i S\\<^sub>j \\<theta>\\<^sub>j) thus ?case\n      using LI_preserves_subst_wf_single[OF \\<open>(S\\<^sub>i,\\<theta>\\<^sub>i) \\<leadsto> (S\\<^sub>j,\\<theta>\\<^sub>j)\\<close>] *[OF \\<open>(S\\<^sub>i,\\<theta>\\<^sub>i) \\<leadsto> (S\\<^sub>j,\\<theta>\\<^sub>j)\\<close>]\n      by (metis wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n  qed simp\nqed\n\n\n\n      { fix s assume \"s \\<in> set (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)\"\n        hence \"\\<exists>s' \\<in> set (S@S'). s = s' \\<cdot>\\<^sub>s\\<^sub>t\\<^sub>p \\<delta> \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p s')\"\n          using Unify.prems(1) by (auto simp add: subst_apply_strand_def)\n        moreover {\n          fix s' assume s': \"s = s' \\<cdot>\\<^sub>s\\<^sub>t\\<^sub>p \\<delta>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p s')\" \"s' \\<in> set (S@S')\"\n          from s'(2) have \"trms\\<^sub>s\\<^sub>t\\<^sub>p (s' \\<cdot>\\<^sub>s\\<^sub>t\\<^sub>p \\<delta>) = trms\\<^sub>s\\<^sub>t\\<^sub>p s' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t (rm_vars (set (bvars\\<^sub>s\\<^sub>t\\<^sub>p s')) \\<delta>)\"\n          proof (induction s')\n            case (Inequality X F) thus ?case by (induct F) (auto simp add: subst_apply_pairs_def)\n          qed auto\n          hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p s)\"\n            using wf_trm_subst[OF wf_trms_subst_rm_vars'[OF range_wf]] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p s')\\<close> s'(1)\n            by simp\n        }\n        ultimately have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p s)\" by auto\n      }\n      thus ?case by auto\n    next\n      case (Equality S \\<delta> t t' a S' \\<theta>)\n      hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m t\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m t'\" by simp_all\n      hence range_wf: \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (subst_range \\<delta>)\"\n        using mgu_wf_trm[OF Equality.hyps(2)[symmetric]] by simp\n\n      { fix s assume \"s \\<in> set (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)\"\n        hence \"\\<exists>s' \\<in> set (S@S'). s = s' \\<cdot>\\<^sub>s\\<^sub>t\\<^sub>p \\<delta> \\<and> wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p s')\"\n          using Equality.prems(1) by (auto simp add: subst_apply_strand_def)\n        moreover {\n          fix s' assume s': \"s = s' \\<cdot>\\<^sub>s\\<^sub>t\\<^sub>p \\<delta>\" \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p s')\" \"s' \\<in> set (S@S')\"\n          from s'(2) have \"trms\\<^sub>s\\<^sub>t\\<^sub>p (s' \\<cdot>\\<^sub>s\\<^sub>t\\<^sub>p \\<delta>) = trms\\<^sub>s\\<^sub>t\\<^sub>p s' \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t (rm_vars (set (bvars\\<^sub>s\\<^sub>t\\<^sub>p s')) \\<delta>)\"\n          proof (induction s')\n            case (Inequality X F) thus ?case by (induct F) (auto simp add: subst_apply_pairs_def)\n          qed auto\n          hence \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p s)\"\n            using wf_trm_subst[OF wf_trms_subst_rm_vars'[OF range_wf]] \\<open>wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p s')\\<close> s'(1)\n            by simp\n        }\n        ultimately have \"wf\\<^sub>t\\<^sub>r\\<^sub>m\\<^sub>s (trms\\<^sub>s\\<^sub>t\\<^sub>p s)\" by auto\n      }\n      thus ?case by auto\n    qed\n  }\n  with assms show ?thesis by (induction rule: rtrancl_induct2) metis+\nqed\n\nlemma LI_preproc_prop_subst:\n  \"LI_preproc_prop S \\<longleftrightarrow> LI_preproc_prop (S \\<cdot>\\<^sub>s\\<^sub>t \\<delta>)\"\nproof (induction S)\n  case (Cons x S) thus ?case unfolding LI_preproc_prop_def by (cases x) auto\nqed (simp add: LI_preproc_prop_def)\n\nlemma LI_preserves_LI_preproc_prop:\n  assumes \"(S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto>\\<^sup>* (S\\<^sub>2,\\<theta>\\<^sub>2)\" \"LI_preproc_prop S\\<^sub>1\"\n  shows \"LI_preproc_prop S\\<^sub>2\"\nusing assms\nproof (induction rule: rtrancl_induct2)\n  case (step S\\<^sub>i \\<theta>\\<^sub>i S\\<^sub>j \\<theta>\\<^sub>j)\n  hence \"LI_preproc_prop S\\<^sub>i\" by metis\n  with step.hyps(2) show ?case \n  proof (induction rule: LI_rel.induct)\n    case (Unify S f T' \\<delta> T S' \\<theta>) thus ?case\n      using LI_preproc_prop_subst LI_preproc_prop_split\n      by (metis append.left_neutral append_Cons)\n  next\n    case (Equality S \\<delta> t t' uu S' \\<theta>) thus ?case\n      using LI_preproc_prop_subst LI_preproc_prop_split\n      by (metis append.left_neutral append_Cons)\n  qed (auto simp add: LI_preproc_prop_def)\nqed simp\n\nend\n\nsubsection \\<open>Theorem: Soundness of the Lazy Intruder\\<close>\ncontext\nbegin\nprivate lemma LI_soundness_single:\n  assumes \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\" \"(S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto> (S\\<^sub>2,\\<theta>\\<^sub>2)\" \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>2,\\<theta>\\<^sub>2\\<rangle>\"\n  shows \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1,\\<theta>\\<^sub>1\\<rangle>\"\nusing assms(2,1,3)\nproof (induction rule: LI_rel.induct)\n  case (Compose S T f S' \\<theta>)\n  have \"ik\\<^sub>s\\<^sub>t (map Send1 T) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<theta> = {}\" by fastforce\n  hence *: \"\\<lbrakk>{}; S\\<rbrakk>\\<^sub>c \\<I>\" \"\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; map Send1 T\\<rbrakk>\\<^sub>c \\<I>\" \"\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; S'\\<rbrakk>\\<^sub>c \\<I>\"\n    using Compose unfolding constr_sem_c_def\n    by (force, force, fastforce)\n\n  have \"ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c Fun f T \\<cdot> \\<I>\"\n    using *(2) Compose.hyps(2) ComposeC[OF _ Compose.hyps(3), of \"map (\\<lambda>x. x \\<cdot> \\<I>) T\"]\n    unfolding subst_compose_def by force\n  thus \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S@Send [Fun f T]#S',\\<theta>\\<rangle>\"\n    using *(1,3) \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S@map Send1 T@S',\\<theta>\\<rangle>\\<close>\n    by (auto simp add: constr_sem_c_def)\nnext\n  case (Unify S f U \\<delta> T S' \\<theta>)\n  have \"(\\<theta> \\<circ>\\<^sub>s \\<delta>) supports \\<I>\" \"\\<lbrakk>{}; S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\\<rbrakk>\\<^sub>c \\<I>\"\n    using Unify.prems(2) unfolding constr_sem_c_def by metis+\n  then obtain \\<sigma> where \\<sigma>: \"\\<theta> \\<circ>\\<^sub>s \\<delta> \\<circ>\\<^sub>s \\<sigma> = \\<I>\" unfolding subst_compose_def by auto\n\n  have \\<theta>fun_id: \"Fun f U \\<cdot> \\<theta> = Fun f U\" \"Fun f T \\<cdot> \\<theta> = Fun f T\"\n    using Unify.prems(1) trm_subst_ident[of \"Fun f U\" \\<theta>]\n          fv_subset_if_in_strand_ik[of \"Fun f U\" S] Unify.hyps(2)\n          fv_snd_rcv_strand_subset(2)[of S]\n          strand_vars_split(1)[of S \"Send [Fun f T]#S'\"]\n    unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def apply blast\n    using Unify.prems(1) trm_subst_ident[of \"Fun f T\" \\<theta>]\n    unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def by fastforce\n  hence \\<theta>\\<delta>_disj:\n      \"subst_domain \\<theta> \\<inter> subst_domain \\<delta> = {}\"\n      \"subst_domain \\<theta> \\<inter> range_vars \\<delta> = {}\"\n      \"subst_domain \\<theta> \\<inter> range_vars \\<theta> = {}\" \n    using trm_subst_disj mgu_vars_bounded[OF Unify.hyps(3)[symmetric]] apply (blast,blast)\n    using Unify.prems(1) unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by blast\n  hence \\<theta>\\<delta>_support: \"\\<theta> supports \\<I>\" \"\\<delta> supports \\<I>\"\n    by (simp_all add: subst_support_comp_split[OF \\<open>(\\<theta> \\<circ>\\<^sub>s \\<delta>) supports \\<I>\\<close>])\n\n  have \"fv (Fun f T) \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\" \"fv (Fun f U) \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n    using Unify.hyps(2) by force+\n  hence \\<delta>_vars_bound: \"subst_domain \\<delta> \\<union> range_vars \\<delta> \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Send [Fun f T]#S')\"\n    using mgu_vars_bounded[OF Unify.hyps(3)[symmetric]] by blast\n\n  have \"\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; [Send [Fun f T]]\\<rbrakk>\\<^sub>c \\<I>\"\n  proof -\n    from Unify.hyps(2) have \"Fun f U \\<cdot> \\<I> \\<in> ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" by blast\n    hence \"Fun f U \\<cdot> \\<I> \\<in> ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" by blast\n    moreover have \"Unifier \\<delta> (Fun f T) (Fun f U)\"\n      by (fact MGU_is_Unifier[OF mgu_gives_MGU[OF Unify.hyps(3)[symmetric]]])\n    ultimately have \"Fun f T \\<cdot> \\<I> \\<in> ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\"\n      using \\<sigma> by (metis \\<theta>fun_id subst_subst_compose) \n    thus ?thesis by simp\n  qed\n\n  have \"\\<lbrakk>{}; S\\<rbrakk>\\<^sub>c \\<I>\" \"\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; S'\\<rbrakk>\\<^sub>c \\<I>\"\n  proof -\n    have \"(S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<cdot>\\<^sub>s\\<^sub>t \\<theta> = S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\" \"(S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<theta> = S@S'\"\n    proof -\n      have \"subst_domain \\<theta> \\<inter> vars\\<^sub>s\\<^sub>t (S@S') = {}\"\n        using Unify.prems(1) by (auto simp add: wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n      hence \"subst_domain \\<theta> \\<inter> vars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\"\n        using \\<theta>\\<delta>_disj(2) strand_subst_vars_union_bound[of \"S@S'\" \\<delta>] by blast\n      thus \"(S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<cdot>\\<^sub>s\\<^sub>t \\<theta> = S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\" \"(S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<theta> = S@S'\"\n        using strand_subst_comp \\<open>subst_domain \\<theta> \\<inter> vars\\<^sub>s\\<^sub>t (S@S') = {}\\<close> by (blast,blast)\n    qed\n    moreover have \"subst_idem \\<delta>\" by (fact mgu_gives_subst_idem[OF Unify.hyps(3)[symmetric]])\n    moreover have\n        \"(subst_domain \\<theta> \\<union> range_vars \\<theta>) \\<inter> bvars\\<^sub>s\\<^sub>t (S@S') = {}\"\n        \"(subst_domain \\<theta> \\<union> range_vars \\<theta>) \\<inter> bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\"\n        \"(subst_domain \\<delta> \\<union> range_vars \\<delta>) \\<inter> bvars\\<^sub>s\\<^sub>t (S@S') = {}\"\n      using wf_constr_bvars_disj[OF Unify.prems(1)]\n            wf_constr_bvars_disj'[OF Unify.prems(1) \\<delta>_vars_bound]\n      by auto\n    ultimately have \"\\<lbrakk>{}; S@S'\\<rbrakk>\\<^sub>c \\<I>\"\n      using \\<open>\\<lbrakk>{}; S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\\<rbrakk>\\<^sub>c \\<I>\\<close> \\<sigma>\n            strand_sem_subst(1)[of \\<theta> \"S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\" \"{}\" \"\\<delta> \\<circ>\\<^sub>s \\<sigma>\"]\n            strand_sem_subst(2)[of \\<theta> \"S@S'\" \"{}\" \"\\<delta> \\<circ>\\<^sub>s \\<sigma>\"] \n            strand_sem_subst_subst_idem[of \\<delta> \"S@S'\" \"{}\" \\<sigma>]\n      unfolding constr_sem_c_def\n      by (metis subst_compose_assoc)\n    thus \"\\<lbrakk>{}; S\\<rbrakk>\\<^sub>c \\<I>\" \"\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; S'\\<rbrakk>\\<^sub>c \\<I>\" by auto\n  qed\n  \n  show \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S@Send [Fun f T]#S',\\<theta>\\<rangle>\"\n    using \\<theta>\\<delta>_support(1) \\<open>\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; [Send [Fun f T]]\\<rbrakk>\\<^sub>c \\<I>\\<close> \\<open>\\<lbrakk>{}; S\\<rbrakk>\\<^sub>c \\<I>\\<close> \\<open>\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; S'\\<rbrakk>\\<^sub>c \\<I>\\<close>\n    by (auto simp add: constr_sem_c_def)\nnext\n  case (Equality S \\<delta> t t' a S' \\<theta>)\n  have \"(\\<theta> \\<circ>\\<^sub>s \\<delta>) supports \\<I>\" \"\\<lbrakk>{}; S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\\<rbrakk>\\<^sub>c \\<I>\"\n    using Equality.prems(2) unfolding constr_sem_c_def by metis+\n  then obtain \\<sigma> where \\<sigma>: \"\\<theta> \\<circ>\\<^sub>s \\<delta> \\<circ>\\<^sub>s \\<sigma> = \\<I>\" unfolding subst_compose_def by auto\n\n  have \"fv t \\<subseteq> vars\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\" \"fv t' \\<subseteq> vars\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n    by auto\n  moreover have \"subst_domain \\<theta> \\<inter> vars\\<^sub>s\\<^sub>t (S@Equality a t t'#S') = {}\"\n    using Equality.prems(1) unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def by auto\n  ultimately have \\<theta>fun_id: \"t \\<cdot> \\<theta> = t\" \"t' \\<cdot> \\<theta> = t'\"\n    using trm_subst_ident[of t \\<theta>] trm_subst_ident[of t' \\<theta>]\n    by auto\n  hence \\<theta>\\<delta>_disj:\n      \"subst_domain \\<theta> \\<inter> subst_domain \\<delta> = {}\"\n      \"subst_domain \\<theta> \\<inter> range_vars \\<delta> = {}\"\n      \"subst_domain \\<theta> \\<inter> range_vars \\<theta> = {}\" \n    using trm_subst_disj mgu_vars_bounded[OF Equality.hyps(2)[symmetric]] apply (blast,blast)\n    using Equality.prems(1) unfolding wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def wf\\<^sub>s\\<^sub>u\\<^sub>b\\<^sub>s\\<^sub>t_def by blast\n  hence \\<theta>\\<delta>_support: \"\\<theta> supports \\<I>\" \"\\<delta> supports \\<I>\"\n    by (simp_all add: subst_support_comp_split[OF \\<open>(\\<theta> \\<circ>\\<^sub>s \\<delta>) supports \\<I>\\<close>])\n\n  have \"fv t \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\" \"fv t' \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\" by auto\n  hence \\<delta>_vars_bound: \"subst_domain \\<delta> \\<union> range_vars \\<delta> \\<subseteq> fv\\<^sub>s\\<^sub>t (S@Equality a t t'#S')\"\n    using mgu_vars_bounded[OF Equality.hyps(2)[symmetric]] by blast\n\n  have \"\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; [Equality a t t']\\<rbrakk>\\<^sub>c \\<I>\"\n  proof -\n    have \"t \\<cdot> \\<delta> = t' \\<cdot> \\<delta>\"\n      using MGU_is_Unifier[OF mgu_gives_MGU[OF Equality.hyps(2)[symmetric]]]\n      by metis\n    hence \"t \\<cdot> (\\<theta> \\<circ>\\<^sub>s \\<delta>) = t' \\<cdot> (\\<theta> \\<circ>\\<^sub>s \\<delta>)\" by (metis \\<theta>fun_id subst_subst_compose)\n    hence \"t \\<cdot> \\<I> = t' \\<cdot> \\<I>\" by (metis \\<sigma> subst_subst_compose) \n    thus ?thesis by simp\n  qed\n\n  have \"\\<lbrakk>{}; S\\<rbrakk>\\<^sub>c \\<I>\" \"\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; S'\\<rbrakk>\\<^sub>c \\<I>\"\n  proof -\n    have \"(S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<cdot>\\<^sub>s\\<^sub>t \\<theta> = S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\" \"(S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<theta> = S@S'\"\n    proof -\n      have \"subst_domain \\<theta> \\<inter> vars\\<^sub>s\\<^sub>t (S@S') = {}\"\n        using Equality.prems(1)\n        by (fastforce simp add: wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def simp del: subst_range.simps)\n      hence \"subst_domain \\<theta> \\<inter> fv\\<^sub>s\\<^sub>t (S@S') = {}\" by blast\n      hence \"subst_domain \\<theta> \\<inter> fv\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\"\n        using \\<theta>\\<delta>_disj(2) subst_sends_strand_fv_to_img[of \"S@S'\" \\<delta>] by blast\n      thus \"(S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) \\<cdot>\\<^sub>s\\<^sub>t \\<theta> = S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\" \"(S@S') \\<cdot>\\<^sub>s\\<^sub>t \\<theta> = S@S'\"\n        using strand_subst_comp \\<open>subst_domain \\<theta> \\<inter> vars\\<^sub>s\\<^sub>t (S@S') = {}\\<close> by (blast,blast)\n    qed\n    moreover have\n        \"(subst_domain \\<theta> \\<union> range_vars \\<theta>) \\<inter> bvars\\<^sub>s\\<^sub>t (S@S') = {}\"\n        \"(subst_domain \\<theta> \\<union> range_vars \\<theta>) \\<inter> bvars\\<^sub>s\\<^sub>t (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>) = {}\"\n        \"(subst_domain \\<delta> \\<union> range_vars \\<delta>) \\<inter> bvars\\<^sub>s\\<^sub>t (S@S') = {}\"\n      using wf_constr_bvars_disj[OF Equality.prems(1)]\n            wf_constr_bvars_disj'[OF Equality.prems(1) \\<delta>_vars_bound]\n      by auto\n    ultimately have \"\\<lbrakk>{}; S@S'\\<rbrakk>\\<^sub>c \\<I>\"\n      using \\<open>\\<lbrakk>{}; S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\\<rbrakk>\\<^sub>c \\<I>\\<close> \\<sigma>\n            strand_sem_subst(1)[of \\<theta> \"S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\" \"{}\" \"\\<delta> \\<circ>\\<^sub>s \\<sigma>\"]\n            strand_sem_subst(2)[of \\<theta> \"S@S'\" \"{}\" \"\\<delta> \\<circ>\\<^sub>s \\<sigma>\"] \n            strand_sem_subst_subst_idem[of \\<delta> \"S@S'\" \"{}\" \\<sigma>]\n            mgu_gives_subst_idem[OF Equality.hyps(2)[symmetric]]\n      unfolding constr_sem_c_def\n      by (metis subst_compose_assoc)\n    thus \"\\<lbrakk>{}; S\\<rbrakk>\\<^sub>c \\<I>\" \"\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; S'\\<rbrakk>\\<^sub>c \\<I>\" by auto\n  qed\n  \n  show \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S@Equality a t t'#S',\\<theta>\\<rangle>\"\n    using \\<theta>\\<delta>_support(1) \\<open>\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; [Equality a t t']\\<rbrakk>\\<^sub>c \\<I>\\<close> \\<open>\\<lbrakk>{}; S\\<rbrakk>\\<^sub>c \\<I>\\<close> \\<open>\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; S'\\<rbrakk>\\<^sub>c \\<I>\\<close>\n    by (auto simp add: constr_sem_c_def)\nqed\n\ntheorem LI_soundness:\n  assumes \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\" \"(LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto>\\<^sup>* (S\\<^sub>2,\\<theta>\\<^sub>2)\" \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>2, \\<theta>\\<^sub>2\\<rangle>\"\n  shows \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\"\nusing assms(2,1,3)\nproof (induction S\\<^sub>2 \\<theta>\\<^sub>2 rule: rtrancl_induct2)\n  case (step S\\<^sub>i \\<theta>\\<^sub>i S\\<^sub>j \\<theta>\\<^sub>j) thus ?case\n    using LI_preproc_preserves_wellformedness[OF \\<open>wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\\<close>]\n          LI_preserves_wellformedness[OF \\<open>(LI_preproc S\\<^sub>1, \\<theta>\\<^sub>1) \\<leadsto>\\<^sup>* (S\\<^sub>i, \\<theta>\\<^sub>i)\\<close>]\n          LI_soundness_single[OF _ \\<open>(S\\<^sub>i, \\<theta>\\<^sub>i) \\<leadsto> (S\\<^sub>j, \\<theta>\\<^sub>j)\\<close> \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>j, \\<theta>\\<^sub>j\\<rangle>\\<close>]\n    by metis\nqed (metis LI_preproc_sem_eq')\nend\n\nsubsection \\<open>Theorem: Completeness of the Lazy Intruder\\<close>\ncontext\nbegin\nprivate lemma LI_completeness_single:\n  assumes \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\" \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\" \"\\<not>simple S\\<^sub>1\" \"LI_preproc_prop S\\<^sub>1\"\n  shows \"\\<exists>S\\<^sub>2 \\<theta>\\<^sub>2. (S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto> (S\\<^sub>2,\\<theta>\\<^sub>2) \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>2, \\<theta>\\<^sub>2\\<rangle>)\"\nusing not_simple_elim[OF \\<open>\\<not>simple S\\<^sub>1\\<close>]\nproof -\n  { \\<comment> \\<open>In this case \\<open>S\\<^sub>1\\<close> isn't simple because it contains an equality constraint,\n        so we can simply proceed with the reduction by computing the MGU for the equation\\<close>\n    assume \"\\<exists>S' S'' a t t'. S\\<^sub>1 = S'@Equality a t t'#S'' \\<and> simple S'\"\n    then obtain S a t t' S' where S\\<^sub>1: \"S\\<^sub>1 = S@Equality a t t'#S'\" \"simple S\" by moura\n    hence *: \"wf\\<^sub>s\\<^sub>t {} S\" \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S, \\<theta>\\<^sub>1\\<rangle>\" \"\\<theta>\\<^sub>1 supports \\<I>\" \"t \\<cdot> \\<I> = t' \\<cdot> \\<I>\"\n      using \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\\<close> \\<open>wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\\<close> wf_eq_fv[of \"{}\" S t t' S']\n            fv_snd_rcv_strand_subset(5)[of S]\n      by (auto simp add: constr_sem_c_def wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n\n    from * have \"Unifier \\<I> t t'\" by simp\n    then obtain \\<delta> where \\<delta>:\n        \"Some \\<delta> = mgu t t'\" \"subst_idem \\<delta>\" \"subst_domain \\<delta> \\<union> range_vars \\<delta> \\<subseteq> fv t \\<union> fv t'\"\n      using mgu_always_unifies mgu_gives_subst_idem mgu_vars_bounded by metis+\n    \n    have \"\\<delta> \\<preceq>\\<^sub>\\<circ> \\<I>\"\n      using mgu_gives_MGU[OF \\<delta>(1)[symmetric]]\n      by (metis \\<open>Unifier \\<I> t t'\\<close>)\n    hence \"\\<delta> supports \\<I>\" using subst_support_if_mgt_subst_idem[OF _ \\<delta>(2)] by metis\n    hence \"(\\<theta>\\<^sub>1 \\<circ>\\<^sub>s \\<delta>) supports \\<I>\" using subst_support_comp \\<open>\\<theta>\\<^sub>1 supports \\<I>\\<close> by metis\n    \n    have \"\\<lbrakk>{}; S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\\<rbrakk>\\<^sub>c \\<I>\"\n    proof -\n      have \"subst_domain \\<delta> \\<union> range_vars \\<delta> \\<subseteq> fv\\<^sub>s\\<^sub>t S\\<^sub>1\" using \\<delta>(3) S\\<^sub>1(1) by auto\n      hence \"\\<lbrakk>{}; S\\<^sub>1 \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\\<rbrakk>\\<^sub>c \\<I>\"\n        using \\<open>subst_idem \\<delta>\\<close> \\<open>\\<delta> \\<preceq>\\<^sub>\\<circ> \\<I>\\<close> \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\\<close> strand_sem_subst\n              wf_constr_bvars_disj'(1)[OF assms(1)]\n        unfolding subst_idem_def constr_sem_c_def\n        by (metis (no_types) subst_compose_assoc)\n      thus \"\\<lbrakk>{}; S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\\<rbrakk>\\<^sub>c \\<I>\" using S\\<^sub>1(1) by force\n    qed\n    moreover have \"(S@Equality a t t'#S', \\<theta>\\<^sub>1) \\<leadsto> (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>, \\<theta>\\<^sub>1 \\<circ>\\<^sub>s \\<delta>)\"\n      using LI_rel.Equality[OF \\<open>simple S\\<close> \\<delta>(1)] S\\<^sub>1 by metis\n    ultimately have ?thesis\n      using S\\<^sub>1(1) \\<open>(\\<theta>\\<^sub>1 \\<circ>\\<^sub>s \\<delta>) supports \\<I>\\<close>\n      by (auto simp add: constr_sem_c_def)\n  } moreover {\n    \\<comment> \\<open>In this case \\<open>S\\<^sub>1\\<close> isn't simple because it contains a deduction constraint for a composed\n        term, so we must look at how this composed term is derived under the interpretation \\<open>\\<I>\\<close>\\<close>\n    assume \"\\<exists>S' S'' ts. S\\<^sub>1 = S'@Send ts#S'' \\<and> (\\<nexists>x. ts = [Var x]) \\<and> simple S'\"\n    hence \"\\<exists>S' S'' f T. S\\<^sub>1 = S'@Send [Fun f T]#S'' \\<and> simple S'\"\n      using LI_preproc_prop_SendE[OF \\<open>LI_preproc_prop S\\<^sub>1\\<close>]\n      by fastforce\n    with assms obtain S f T S' where S\\<^sub>1: \"S\\<^sub>1 = S@Send [Fun f T]#S'\" \"simple S\" by moura\n    hence \"wf\\<^sub>s\\<^sub>t {} S\" \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S, \\<theta>\\<^sub>1\\<rangle>\" \"\\<theta>\\<^sub>1 supports \\<I>\"\n      using \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\\<close> \\<open>wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\\<close>\n      by (auto simp add: constr_sem_c_def wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r_def)\n  \n    \\<comment> \\<open>Lemma for a common subcase\\<close>\n    have fun_sat: \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S@(map Send1 T)@S', \\<theta>\\<^sub>1\\<rangle>\"\n      when T: \"\\<And>t. t \\<in> set T \\<Longrightarrow> ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\"\n    proof -\n      have \"\\<And>t. t \\<in> set T \\<Longrightarrow> \\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; [Send1 t]\\<rbrakk>\\<^sub>c \\<I>\" using T by simp\n      hence \"\\<lbrakk>ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; map Send1 T\\<rbrakk>\\<^sub>c \\<I>\"\n        using \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\\<close> strand_sem_Send_map by blast \n      moreover have \"ik\\<^sub>s\\<^sub>t (S@[Send1 (Fun f T)]) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> = ik\\<^sub>s\\<^sub>t (S@(map Send1 T)) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" by auto\n      hence \"\\<lbrakk>ik\\<^sub>s\\<^sub>t (S@(map Send1 T)) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>; S'\\<rbrakk>\\<^sub>c \\<I>\"\n        using \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\\<close> unfolding S\\<^sub>1(1) constr_sem_c_def by force\n      ultimately show ?thesis\n        using \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S, \\<theta>\\<^sub>1\\<rangle>\\<close> strand_sem_append(1)[of \"{}\" S \\<I> \"map Send1 T\"]\n              strand_sem_append(1)[of \"{}\" \"S@map Send1 T\" \\<I> S']\n        unfolding constr_sem_c_def by simp\n    qed\n  \n    from S\\<^sub>1 \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\\<close> have \"ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c Fun f T \\<cdot> \\<I>\" by (auto simp add: constr_sem_c_def)\n    hence ?thesis\n    proof cases\n      \\<comment> \\<open>Case 1: \\<open>\\<I>(f(T))\\<close> has been derived using the \\<open>AxiomC\\<close> rule.\\<close>\n      case AxiomC\n      hence ex_t: \"\\<exists>t. t \\<in> ik\\<^sub>s\\<^sub>t S \\<and> Fun f T \\<cdot> \\<I> = t \\<cdot> \\<I>\" by auto\n      show ?thesis\n      proof (cases \"\\<forall>T'. Fun f T' \\<in> ik\\<^sub>s\\<^sub>t S \\<longrightarrow> Fun f T \\<cdot> \\<I> \\<noteq> Fun f T' \\<cdot> \\<I>\")\n        \\<comment> \\<open>Case 1.1: \\<open>f(T)\\<close> is equal to a variable in the intruder knowledge under \\<open>\\<I>\\<close>.\n            Hence there must exists a deduction constraint in the simple prefix of the constraint\n            in which this variable occurs/\"is sent\" for the first time. Since this variable itself\n            cannot have been derived from the \\<open>AxiomC\\<close> rule (because it must be equal under the\n            interpretation to \\<open>f(T)\\<close>, which is by assumption not in the intruder knowledge under\n            \\<open>\\<I>\\<close>) it must be the case that we can derive it using the \\<open>ComposeC\\<close> rule. Hence we can\n            apply the \\<open>Compose\\<close> rule of the lazy intruder to \\<open>f(T)\\<close>.\\<close>\n        case True\n        have \"\\<exists>v. Var v \\<in> ik\\<^sub>s\\<^sub>t S \\<and> Fun f T \\<cdot> \\<I> = \\<I> v\"\n        proof -\n          obtain t where \"t \\<in> ik\\<^sub>s\\<^sub>t S\" \"Fun f T \\<cdot> \\<I> = t \\<cdot> \\<I>\" using ex_t by moura\n          thus ?thesis\n            using \\<open>\\<forall>T'. Fun f T' \\<in> ik\\<^sub>s\\<^sub>t S \\<longrightarrow> Fun f T \\<cdot> \\<I> \\<noteq> Fun f T' \\<cdot> \\<I>\\<close>\n            by (cases t) auto\n        qed\n        hence \"\\<exists>v \\<in> wfrestrictedvars\\<^sub>s\\<^sub>t S. Fun f T \\<cdot> \\<I> = \\<I> v\"\n          using vars_subset_if_in_strand_ik2[of _ S] by fastforce\n        then obtain v S\\<^sub>p\\<^sub>r\\<^sub>e S\\<^sub>s\\<^sub>u\\<^sub>f\n          where S: \"S = S\\<^sub>p\\<^sub>r\\<^sub>e@Send [Var v]#S\\<^sub>s\\<^sub>u\\<^sub>f\" \"Fun f T \\<cdot> \\<I> = \\<I> v\"\n                   \"\\<not>(\\<exists>w \\<in> wfrestrictedvars\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e. Fun f T \\<cdot> \\<I> = \\<I> w)\"\n          using \\<open>wf\\<^sub>s\\<^sub>t {} S\\<close> wf_simple_strand_first_Send_var_split[OF _ \\<open>simple S\\<close>, of \"Fun f T\" \\<I>]\n          by auto\n        hence \"\\<forall>w. Var w \\<in> ik\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e \\<longrightarrow> \\<I> v \\<noteq> Var w \\<cdot> \\<I>\" by force\n        moreover have \"\\<forall>T'. Fun f T' \\<in> ik\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e \\<longrightarrow> Fun f T \\<cdot> \\<I> \\<noteq> Fun f T' \\<cdot> \\<I>\"\n          using \\<open>\\<forall>T'. Fun f T' \\<in> ik\\<^sub>s\\<^sub>t S \\<longrightarrow> Fun f T \\<cdot> \\<I> \\<noteq> Fun f T' \\<cdot> \\<I>\\<close> S(1)\n          by (meson contra_subsetD ik_append_subset(1))\n        hence \"\\<forall>g T'. Fun g T' \\<in> ik\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e \\<longrightarrow> \\<I> v \\<noteq> Fun g T' \\<cdot> \\<I>\" using S(2) by simp\n        ultimately have \"\\<forall>t \\<in> ik\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e. \\<I> v \\<noteq> t \\<cdot> \\<I>\" by (metis term.exhaust)\n        hence \"\\<I> v \\<notin> (ik\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e) \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" by auto\n  \n        have \"ik\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c \\<I> v\"\n          using S\\<^sub>1(1) S(1) \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\\<close>\n          by (auto simp add: constr_sem_c_def)\n        hence \"ik\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c Fun f T \\<cdot> \\<I>\" using \\<open>Fun f T \\<cdot> \\<I> = \\<I> v\\<close> by metis\n        hence \"length T = arity f\" \"public f\" \"\\<And>t. t \\<in> set T \\<Longrightarrow> ik\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\"\n          using \\<open>Fun f T \\<cdot> \\<I> = \\<I> v\\<close> \\<open>\\<I> v \\<notin> ik\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\\<close>\n                intruder_synth.simps[of \"ik\\<^sub>s\\<^sub>t S\\<^sub>p\\<^sub>r\\<^sub>e \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I>\" \"\\<I> v\"]\n          by auto\n        hence *: \"\\<And>t. t \\<in> set T \\<Longrightarrow> ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c t \\<cdot> \\<I>\"\n          using S(1) by (auto intro: ideduct_synth_mono)\n        hence \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S@(map Send1 T)@S', \\<theta>\\<^sub>1\\<rangle>\" by (metis fun_sat)\n        moreover have \"(S@Send [Fun f T]#S', \\<theta>\\<^sub>1) \\<leadsto> (S@map Send1 T@S', \\<theta>\\<^sub>1)\"\n          by (metis LI_rel.Compose[OF \\<open>simple S\\<close> \\<open>length T = arity f\\<close> \\<open>public f\\<close>])\n        ultimately show ?thesis using S\\<^sub>1 by auto\n      next\n        \\<comment> \\<open>Case 1.2: \\<open>\\<I>(f(T))\\<close> can be derived from an interpreted composed term in the intruder\n            knowledge. Use the \\<open>Unify\\<close> rule on this composed term to further reduce the constraint.\\<close>\n        case False\n        then obtain T' where t: \"Fun f T' \\<in> ik\\<^sub>s\\<^sub>t S\" \"Fun f T \\<cdot> \\<I> = Fun f T' \\<cdot> \\<I>\"\n          by auto\n        hence \"fv (Fun f T') \\<subseteq> fv\\<^sub>s\\<^sub>t S\\<^sub>1\"\n          using S\\<^sub>1(1) fv_subset_if_in_strand_ik'[OF t(1)]\n                fv_snd_rcv_strand_subset(2)[of S]\n          by auto\n        from t have \"Unifier \\<I> (Fun f T) (Fun f T')\" by simp\n        then obtain \\<delta> where \\<delta>:\n            \"Some \\<delta> = mgu (Fun f T) (Fun f T')\" \"subst_idem \\<delta>\"\n            \"subst_domain \\<delta> \\<union> range_vars \\<delta> \\<subseteq> fv (Fun f T) \\<union> fv (Fun f T')\"\n          using mgu_always_unifies mgu_gives_subst_idem mgu_vars_bounded by metis+\n        \n        have \"\\<delta> \\<preceq>\\<^sub>\\<circ> \\<I>\"\n          using mgu_gives_MGU[OF \\<delta>(1)[symmetric]]\n          by (metis \\<open>Unifier \\<I> (Fun f T) (Fun f T')\\<close>)\n        hence \"\\<delta> supports \\<I>\" using subst_support_if_mgt_subst_idem[OF _ \\<delta>(2)] by metis\n        hence \"(\\<theta>\\<^sub>1 \\<circ>\\<^sub>s \\<delta>) supports \\<I>\" using subst_support_comp \\<open>\\<theta>\\<^sub>1 supports \\<I>\\<close> by metis\n        \n        have \"\\<lbrakk>{}; S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\\<rbrakk>\\<^sub>c \\<I>\"\n        proof -\n          have \"subst_domain \\<delta> \\<union> range_vars \\<delta> \\<subseteq> fv\\<^sub>s\\<^sub>t S\\<^sub>1\"\n            using \\<delta>(3) S\\<^sub>1(1) \\<open>fv (Fun f T') \\<subseteq> fv\\<^sub>s\\<^sub>t S\\<^sub>1\\<close>\n            unfolding range_vars_alt_def by (fastforce simp del: subst_range.simps)\n          hence \"\\<lbrakk>{}; S\\<^sub>1 \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\\<rbrakk>\\<^sub>c \\<I>\"\n            using \\<open>subst_idem \\<delta>\\<close> \\<open>\\<delta> \\<preceq>\\<^sub>\\<circ> \\<I>\\<close> \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\\<close> strand_sem_subst\n                  wf_constr_bvars_disj'(1)[OF assms(1)]\n            unfolding subst_idem_def constr_sem_c_def\n            by (metis (no_types) subst_compose_assoc)\n          thus \"\\<lbrakk>{}; S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>\\<rbrakk>\\<^sub>c \\<I>\" using S\\<^sub>1(1) by force\n        qed\n        moreover have \"(S@Send [Fun f T]#S', \\<theta>\\<^sub>1) \\<leadsto> (S@S' \\<cdot>\\<^sub>s\\<^sub>t \\<delta>, \\<theta>\\<^sub>1 \\<circ>\\<^sub>s \\<delta>)\"\n          using LI_rel.Unify[OF \\<open>simple S\\<close> t(1) \\<delta>(1)] S\\<^sub>1 by metis\n        ultimately show ?thesis\n          using S\\<^sub>1(1) \\<open>(\\<theta>\\<^sub>1 \\<circ>\\<^sub>s \\<delta>) supports \\<I>\\<close>\n          by (auto simp add: constr_sem_c_def)\n      qed\n    next\n      \\<comment> \\<open>Case 2: \\<open>\\<I>(f(T))\\<close> has been derived using the \\<open>ComposeC\\<close> rule.\n          Simply use the \\<open>Compose\\<close> rule of the lazy intruder to proceed with the reduction.\\<close>\n      case (ComposeC T' g)\n      hence \"f = g\" \"length T = arity f\" \"public f\"\n        and \"\\<And>x. x \\<in> set T \\<Longrightarrow> ik\\<^sub>s\\<^sub>t S \\<cdot>\\<^sub>s\\<^sub>e\\<^sub>t \\<I> \\<turnstile>\\<^sub>c x \\<cdot> \\<I>\"\n        by auto\n      hence \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S@(map Send1 T)@S', \\<theta>\\<^sub>1\\<rangle>\" using fun_sat by metis\n      moreover have \"(S\\<^sub>1, \\<theta>\\<^sub>1) \\<leadsto> (S@(map Send1 T)@S', \\<theta>\\<^sub>1)\"\n        using S\\<^sub>1 LI_rel.Compose[OF \\<open>simple S\\<close> \\<open>length T = arity f\\<close> \\<open>public f\\<close>]\n        by metis\n      ultimately show ?thesis by metis\n    qed\n  } moreover have \"\\<And>A B X F. S\\<^sub>1 = A@Inequality X F#B \\<Longrightarrow> ineq_model \\<I> X F\"\n    using assms(2) by (auto simp add: constr_sem_c_def)\n  ultimately show ?thesis using not_simple_elim[OF \\<open>\\<not>simple S\\<^sub>1\\<close>] by metis\nqed\n\ntheorem LI_completeness:\n  assumes \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\" \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\"\n  shows \"\\<exists>S\\<^sub>2 \\<theta>\\<^sub>2. (LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto>\\<^sup>* (S\\<^sub>2,\\<theta>\\<^sub>2) \\<and> simple S\\<^sub>2 \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>2, \\<theta>\\<^sub>2\\<rangle>)\"\nproof (cases \"simple (LI_preproc S\\<^sub>1)\")\n  case False\n  let ?Stuck = \"\\<lambda>S\\<^sub>2 \\<theta>\\<^sub>2. \\<not>(\\<exists>S\\<^sub>3 \\<theta>\\<^sub>3. (S\\<^sub>2,\\<theta>\\<^sub>2) \\<leadsto> (S\\<^sub>3,\\<theta>\\<^sub>3) \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>3, \\<theta>\\<^sub>3\\<rangle>))\"\n  let ?Sats = \"{((S,\\<theta>),(S',\\<theta>')). (S,\\<theta>) \\<leadsto> (S',\\<theta>') \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S, \\<theta>\\<rangle>) \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S', \\<theta>'\\<rangle>)}\"\n\n  have simple_if_stuck:\n      \"\\<And>S\\<^sub>2 \\<theta>\\<^sub>2. \\<lbrakk>(LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto>\\<^sup>+ (S\\<^sub>2,\\<theta>\\<^sub>2); \\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>2, \\<theta>\\<^sub>2\\<rangle>; ?Stuck S\\<^sub>2 \\<theta>\\<^sub>2\\<rbrakk> \\<Longrightarrow> simple S\\<^sub>2\"\n    using LI_preproc_preserves_wellformedness[OF \\<open>wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\\<close>]\n          LI_preserves_LI_preproc_prop[OF _ LI_preproc_preproc_prop]\n          LI_completeness_single[OF LI_preserves_wellformedness]\n          trancl_into_rtrancl\n    by metis\n\n  have base: \"\\<exists>b. ((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),b) \\<in> ?Sats\"\n    using LI_preproc_preserves_wellformedness[OF \\<open>wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\\<close>]\n          LI_completeness_single[OF _ _ False LI_preproc_preproc_prop]\n          LI_preproc_sem_eq' \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\\<close>\n    by auto\n\n  have *: \"\\<And>S \\<theta> S' \\<theta>'. ((S,\\<theta>),(S',\\<theta>')) \\<in> ?Sats\\<^sup>+ \\<Longrightarrow> (S,\\<theta>) \\<leadsto>\\<^sup>+ (S',\\<theta>') \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S', \\<theta>'\\<rangle>)\"\n  proof -\n    fix S \\<theta> S' \\<theta>'\n    assume \"((S,\\<theta>),(S',\\<theta>')) \\<in> ?Sats\\<^sup>+\"\n    thus \"(S,\\<theta>) \\<leadsto>\\<^sup>+ (S',\\<theta>') \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S', \\<theta>'\\<rangle>)\"\n      by (induct rule: trancl_induct2) auto\n  qed\n\n  have \"\\<exists>S\\<^sub>2 \\<theta>\\<^sub>2. ((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),(S\\<^sub>2,\\<theta>\\<^sub>2)) \\<in> ?Sats\\<^sup>+ \\<and> ?Stuck S\\<^sub>2 \\<theta>\\<^sub>2\"\n  proof (rule ccontr)\n    assume \"\\<not>(\\<exists>S\\<^sub>2 \\<theta>\\<^sub>2. ((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),(S\\<^sub>2,\\<theta>\\<^sub>2)) \\<in> ?Sats\\<^sup>+ \\<and> ?Stuck S\\<^sub>2 \\<theta>\\<^sub>2)\"\n    hence sat_not_stuck: \"\\<And>S\\<^sub>2 \\<theta>\\<^sub>2. ((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),(S\\<^sub>2,\\<theta>\\<^sub>2)) \\<in> ?Sats\\<^sup>+ \\<Longrightarrow> \\<not>?Stuck S\\<^sub>2 \\<theta>\\<^sub>2\" by blast\n\n    have \"\\<forall>S \\<theta>. ((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),(S,\\<theta>)) \\<in> ?Sats\\<^sup>+ \\<longrightarrow> (\\<exists>b. ((S,\\<theta>),b) \\<in> ?Sats)\"\n    proof (intro allI impI)\n      fix S \\<theta> assume a: \"((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),(S,\\<theta>)) \\<in> ?Sats\\<^sup>+\"\n      have \"\\<And>b. ((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),b) \\<in> ?Sats\\<^sup>+ \\<Longrightarrow> \\<exists>c. b \\<leadsto> c \\<and> ((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),c) \\<in> ?Sats\\<^sup>+\"\n      proof -\n        fix b assume in_sat: \"((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),b) \\<in> ?Sats\\<^sup>+\"\n        hence \"\\<exists>c. (b,c) \\<in> ?Sats\" using * sat_not_stuck by (cases b) blast\n        thus \"\\<exists>c. b \\<leadsto> c \\<and> ((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),c) \\<in> ?Sats\\<^sup>+\"\n          using trancl_into_trancl[OF in_sat] by blast\n      qed\n      hence \"\\<exists>S' \\<theta>'. (S,\\<theta>) \\<leadsto> (S',\\<theta>') \\<and> ((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),(S',\\<theta>')) \\<in> ?Sats\\<^sup>+\" using a by auto\n      then obtain S' \\<theta>' where S'\\<theta>': \"(S,\\<theta>) \\<leadsto> (S',\\<theta>')\" \"((LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1),(S',\\<theta>')) \\<in> ?Sats\\<^sup>+\" by auto\n      hence \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S', \\<theta>'\\<rangle>\" using * by blast\n      moreover have \"(LI_preproc S\\<^sub>1, \\<theta>\\<^sub>1) \\<leadsto>\\<^sup>+ (S,\\<theta>)\" using a trancl_mono by blast\n      ultimately have \"((S,\\<theta>),(S',\\<theta>')) \\<in> ?Sats\" using S'\\<theta>'(1) * a by blast\n      thus \"\\<exists>b. ((S,\\<theta>),b) \\<in> ?Sats\" using S'\\<theta>'(2) by blast \n    qed\n    hence \"\\<exists>f. \\<forall>i::nat. (f i, f (Suc i)) \\<in> ?Sats\"\n      using infinite_chain_intro'[OF base] by blast\n    moreover have \"?Sats \\<subseteq> LI_rel\\<^sup>+\" by auto\n    hence \"\\<not>(\\<exists>f. \\<forall>i::nat. (f i, f (Suc i)) \\<in> ?Sats)\"\n      using LI_no_infinite_chain infinite_chain_mono by blast\n    ultimately show False by auto\n  qed\n  hence \"\\<exists>S\\<^sub>2 \\<theta>\\<^sub>2. (LI_preproc S\\<^sub>1, \\<theta>\\<^sub>1) \\<leadsto>\\<^sup>+ (S\\<^sub>2, \\<theta>\\<^sub>2) \\<and> simple S\\<^sub>2 \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>2, \\<theta>\\<^sub>2\\<rangle>)\"\n    using simple_if_stuck * by blast\n  thus ?thesis by (meson trancl_into_rtrancl)\nqed (use LI_preproc_sem_eq' \\<open>\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle>\\<close> in blast) \nend\n\n\nsubsection \\<open>Corollary: Soundness and Completeness as a Single Theorem\\<close>\ncorollary LI_soundness_and_completeness:\n  assumes \"wf\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>s\\<^sub>t\\<^sub>r S\\<^sub>1 \\<theta>\\<^sub>1\"\n  shows \"\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>1, \\<theta>\\<^sub>1\\<rangle> \\<longleftrightarrow> (\\<exists>S\\<^sub>2 \\<theta>\\<^sub>2. (LI_preproc S\\<^sub>1,\\<theta>\\<^sub>1) \\<leadsto>\\<^sup>* (S\\<^sub>2,\\<theta>\\<^sub>2) \\<and> simple S\\<^sub>2 \\<and> (\\<I> \\<Turnstile>\\<^sub>c \\<langle>S\\<^sub>2, \\<theta>\\<^sub>2\\<rangle>))\"\nby (metis LI_soundness[OF assms] LI_completeness[OF assms])\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Stateful_Protocol_Composition_and_Typing/Lazy_Intruder.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.32822173550935885}}
{"text": "(* AUTHOR: Qiyuan Xu, 2022 *)\n\ntheory VDT_Example\n  imports \"Virtual_Datatype.Virtual_Datatype\" \"Phi_Document.Base\"\nbegin\n\nsection \\<open>Introduction\\<close>\n\ntext \\<open>Virtual Datatype (VDT) provides a locale approach for inheritance of datatypes\n  and any proof elements including theorems, definitions, and notations about these datatypes.\n  In essence, it is a locale that constrains and assumes partially some constructors of\n  a concrete type parameter, and the inheritance is merging the assumptions, i.e., combination\n  of locales.\n  As a set of assumptions and constraints, it is not a concrete type but more like an abstract\n  interface.\n  Theories and proofs above it are therefore abstract and available for any concrete types\n  that match the interface, via interpreting the locale by @{command interpretation}.\n\nRecursive datatype is supported.\nFor each constructor, a corresponding destructor is provided.\nCase-split is not supported right now but is planned, for case-splitting only assumed constructors\nand leaving future constructors in underscore, e.g. \\<open>case x of Known_Constructor v \\<Rightarrow> f v | _ \\<Rightarrow>\nthe_case_for_future_constructors.\\<close>\n\nA typical usage of the virtual datatype is formalizing program semantics partially and modularly.\nFor example, it is suitable to model the deep representation of program values.\nA minimal common set of the semantics can be provided, including maybe only integer values.\nThen for a language having enumeration values, corresponding formalization can extend the previous\nvirtual datatype of integers.\n\nVirtual datatype is implemented by locales.\nActually, it is the dual of the Statespace by Norbert Schirmer~\\cite{Statespace}.\nMaintained by locales, a Statespace is essentially a function \\<open>Name \\<Rightarrow> Value\\<close> from a set of\ndistinct \\<open>Names\\<close> to a deep embedding of \\<open>Values\\<close>.\nBy contrast, Virtual Datatype is a production \\<open>Constructor \\<times> Value\\<close> where the \\<open>Value\\<close> is\nstill the deep embedding of that \\<open>Value\\<close> in Statespace, and \\<open>Constructor\\<close> is the counterpart of\nthe \\<open>Name\\<close> in Statespace. Indeed, the \\<open>Constructor\\<close> and the \\<open>Name\\<close> are only different in\nhow we name them. \\<close>\n\n\nsection \\<open>Syntax\\<close>\n\ntext \\<open>\nA virtual datatype is declared by command @{command virtual_datatype}.\n\n  \\begin{matharray}{rcl}\n    @{command_def virtual_datatype} & : & \\<open>theory \\<rightarrow> theory\\<close>\\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command virtual_datatype} @{syntax environ}? @{syntax vdt_name} ('=' @{syntax vdt_descr})?\n    ;\n    @{syntax_def environ}: '(' 'in' @{syntax name} ')'\n    ;\n    @{syntax_def vdt_name}: @{syntax tyargs}? @{syntax name} ('::' @{syntax sort})?\n    ;\n    @{syntax_def tyargs}: (@{syntax typefree} | '(' (@{syntax typefree} + @{syntax typefree}) ')')\n    ;\n    @{syntax_def vdt_descr}: (@{syntax parents} | @{syntax constructors} | @{syntax parents} '+' @{syntax constructors})\n    ;\n    @{syntax_def constructors}: (@{syntax name} '::' @{syntax type} + @{syntax constructors})\n    ;\n    @{syntax_def parents}: (@{syntax parent} + @{syntax parent})\n    ;\n    @{syntax_def parent}: (@{syntax qualifier} ':')? (@{syntax tyinsts})?\n          @{syntax name} (@{syntax renames})?\n    ;\n    @{syntax_def tyinsts}: (@{syntax type} | '(' (@{syntax type} + @{syntax type}) ')')\n    ;\n    @{syntax_def renames}: '[' ((@{syntax name} '=' @{syntax name}) + @{syntax renames}) ']'\n  \\<close>\n\n\\<^descr> Optional @{syntax environ} indicates the locale of virtual datatype to extend the @{syntax environ}\n  locale. Constructors of the virtual datatype are able to use types fixed or defined in the\n  @{syntax environ}.\n  If not given, no @{syntax environ} locale is used.\n\n\\<^descr> @{syntax vdt_name} indicates the name of the VDT,\n  together with type arguments and the sort of the VDT.\n  @{syntax tyargs} is a sequence of type variables parameterize the VDT, which resembles that in\n  @{command datatype}.\n  The actual sort of the VDT is the meet (intersection) of the given sort and the sorts of all\n  parents.\n\n\\<^descr> @{syntax vdt_descr} describes the parents and new constructors of the VDT.\n  If it is not given, the command defines an empty VDT that contains no constructors.\n\n  In @{syntax vdt_descr}, a special type variable \\<^typ>\\<open>'self\\<close> denotes the type of the VDT itself,\n  allowing to define recursive VDT. Examples are given in the next section.\n\n\\<^descr> @{syntax constructors} are a sequence of name-type pairs for each constructor.\n  A constructor should has exactly one argument.\n  Multiple arguments can be aggregated into a tuple.\n  None argument can be a unit.\n\n\\<^descr> @{syntax parents} give the parent VDTs to be inherit.\n  The syntax resembles locale expression as in \\cite{Isar}.\n  @{syntax qualifier} is exactly that in locale expression, cf. \\cite{Isar}.\n  @{syntax tyinsts} are optional type instantiations for type parameters of the parent.\n  @{syntax renames} can optionally rename constructors in the parent.\n  \\<^verbatim>\\<open>[A=A',B=B']\\<close> renames constructors \\<^verbatim>\\<open>A,B\\<close> in the parent to \\<^verbatim>\\<open>A',B'\\<close> in the child VDT.\n  By this, it enables to inherit the same parent twice with different names of constructors.\n\\<close>\n\ntext \\<open>\\<^emph>\\<open>Remark\\<close>: different with inheriting a parent, it is unfeasible to rename constructors in\n  a \\<open>environ\\<close> locale. A \\<open>environ\\<close> locale is opened using @{command context} during the parse\n  phase.\\<close>\n\nsection \\<open>Usage through Examples\\<close>\n\nsubsection \\<open>Declare a VDT\\<close>\n\ntext \\<open>The following example defines a VDT named \\<open>T1\\<close> in sort \\<open>plus\\<close>, having two constructors\n  \\<open>C1\\<close> and \\<open>C2\\<close> for \\<^typ>\\<open>nat\\<close> and \\<^typ>\\<open>bool\\<close> respectively.\\<close>\n\nvirtual_datatype T1 :: plus =\n  C1 :: nat\n  C2 :: bool\n\ntext \\<open>The essence of a VDT is a locale.\\<close>\n\nlocale T1_demo =\n  fixes CONS_OF :: \"'rep::plus \\<Rightarrow> 'CONS_NAME\"\n    and C1 :: \"('CONS_NAME, 'rep, nat)  Virtual_Datatype.Field\"\n    and C2 :: \"('CONS_NAME, 'rep, bool) Virtual_Datatype.Field\"\n  assumes \"Field.project C1 (Field.inject C1 n) = n\"\n    and   \"Field.project C2 (Field.inject C2 b) = b\"\n    and  \\<open>Field.name C1 \\<noteq> Field.name C2\\<close>\n\ndatatype ('CONS_NAME,'rep,'T) Field_demo =\n  Field_demo (name: 'CONS_NAME) (project: \"'rep \\<Rightarrow> 'T\") (inject: \"'T \\<Rightarrow> 'rep\")\n\ntext \\<open>\\<^typ>\\<open>'CONS_NAME\\<close> can be any type that identifies constructors, e.g. \\<^typ>\\<open>string\\<close> or \\<^typ>\\<open>nat\\<close>.\n\\<^typ>\\<open>'rep\\<close> is the representation type of instances in the VDT.\nA constructor of argument type \\<open>'T\\<close> is an injector from \\<open>'T\\<close> to \\<open>'rep\\<close> and reversely\na destructor is a projector from \\<open>'rep\\<close> to \\<open>'T\\<close>.\nType \\<open>Field\\<close> describes a constructor-destructor pair, together with the name of the constructor.\n\\<^term>\\<open>CONS_OF\\<close> gives the constructor of a given instance.\n\nAssumptions constrain the injectors are injective and the projectors are their inverse functions.\nThe last assumption constrains the names of constructors are distinct.\n\\<close>\n\n\nsubsection \\<open>Operations in VDT\\<close>\n\ntext \\<open>Operations are available inside the locale \\<open>T1\\<close> of the VDT.\\<close>\n\ncontext T1 begin\n\nsubsubsection \\<open>Representation Type\\<close>\n\ntext \\<open>\\<^typ>\\<open>'rep\\<close> is a sort plus!\\<close>\ntyp \\<open>'rep :: plus\\<close>\n\nsubsubsection \\<open>Constructor\\<close>\n\nterm \\<open>C1.mk 42 :: 'rep\\<close> \\<comment> \\<open>Make an instance by constructor \\<^term>\\<open>\\<f>\\<i>\\<e>\\<l>\\<d>_C1\\<close>\\<close>\n\nlemma \\<open>C1.mk = Virtual_Datatype.Field.inject \\<f>\\<i>\\<e>\\<l>\\<d>_C1\\<close>\n  \\<comment> \\<open>\\<open>C1.mk\\<close> is merely a syntax sugar of \\<open>Virtual_Datatype.Field.inject C1\\<close>\\<close>\n  by simp\n\nML \\<open>@{term C1.mk} = @{term \\<open>Virtual_Datatype.Field.inject \\<f>\\<i>\\<e>\\<l>\\<d>_C1\\<close>}\\<close> \\<comment> \\<open>is True!\\<close>\n\nsubsubsection \\<open>Destructor\\<close>\n\nterm \\<open>C1.dest :: 'rep \\<Rightarrow> nat\\<close> \\<comment> \\<open>Destructor corresponding to \\<^term>\\<open>\\<f>\\<i>\\<e>\\<l>\\<d>_C1\\<close>\\<close>\n\nlemma \\<open>C1.dest = Virtual_Datatype.Field.project \\<f>\\<i>\\<e>\\<l>\\<d>_C1\\<close>\n  \\<comment> \\<open>Yet another syntax sugar\\<close>\n  by simp\n\nlemma \\<open>C1.dest (C1.mk x) = x\\<close>\n  \\<comment> \\<open>Automation for destruction is prepared.\\<close>\n  by simp\n\nsubsubsection \\<open>Constructor Name\\<close>\n\nterm \\<open>C1.name :: 'CONS_NAME\\<close> \\<comment> \\<open>The name of the constructor \\<open>\\<f>\\<i>\\<e>\\<l>\\<d>_C1\\<close>\\<close>\n\nlemma \\<open>C1.name = Virtual_Datatype.Field.name \\<f>\\<i>\\<e>\\<l>\\<d>_C1\\<close>\n  \\<comment> \\<open>Yet another syntax sugar\\<close>\n  by simp\n\nlemma \"C1.name \\<noteq> C2.name\"\n  \\<comment> \\<open>Names are distinct.\\<close>\n  by simp\n\nsubsubsection \\<open>Equality\\<close>\n\nlemma \"C1.mk x \\<noteq> C2.mk y\"\n  \\<comment> \\<open>Representations under different constructor are different\\<close>\n  by simp\n\nlemma \"C1.mk x = C1.mk y \\<longleftrightarrow> x = y\"\n  \\<comment> \\<open>Representations under the same constructor are injective w.r.t the constructor.\\<close>\n  by simp\n\nsubsubsection \\<open>Misc\\<close>\n\nlemma \"CONS_OF (C1.mk x) = C1.name\"\n  \\<comment> \\<open>You can use \\<open>CONS_OF\\<close> to get the constructor from a representation.\\<close>\n  by simp\n\nlemma \\<open>C1.is_instance (C1.mk x)\\<close>\n      \\<open>\\<not> C2.is_instance (C1.mk x)\\<close>\n      \\<open>C1.is_instance v \\<longleftrightarrow> (\\<exists>x. v = C1.mk x)\\<close>\n  \\<comment> \\<open>\\<open>C.is_instance\\<close> asserts whether a representation is an instance of the constructor.\\<close>\n  unfolding C1.is_instance_def by simp+\nend\n\n\nsubsection \\<open>Inheritance\\<close>\n\ntext \\<open>It is feasible to declare a new VDT inheriting the previous VDTs.\\<close>\n\nvirtual_datatype T2 = T1 +\n  C3 :: int\n\ntext \\<open>The locale of @{locale T2} extends all locales of its parents.\\<close>\n\nlocale T2_demo =\n  fixes CONS_OF :: \"'rep::plus \\<Rightarrow> 'CONS_NAME\"\n    and C1 :: \"('CONS_NAME, 'rep, nat)  Virtual_Datatype.Field\"\n    and C2 :: \"('CONS_NAME, 'rep, bool) Virtual_Datatype.Field\"\n    and C3 :: \"('CONS_NAME, 'rep, int) Virtual_Datatype.Field\"\n  assumes \"Field.project C1 (Field.inject C1 n) = n\"\n    and   \"Field.project C2 (Field.inject C2 b) = b\"\n    and   \"Field.project C3 (Field.inject C3 i) = i\"\n    and \\<open>distinct [Field.name C1, Field.name C2, Field.name C3]\\<close>\n\ntext \\<open>Proof elements defined on the parent VDT locales, are feasible on the children VDTs.\\<close>\n\ndefinition (in T1) \"trn vx = C1.mk (if C2.dest vx then 1 else 0)\"\n\nlemma (in T1) trn: \\<open>trn (C2.mk True) = C1.mk 1\\<close>\n  unfolding trn_def by simp\n\ncontext T2 begin\nthm trn  \\<comment>  \\<open>\\<open>trn (C2.mk True) = C1.mk 1\\<close>\\<close>\nend\n\ntext \\<open>A parent may be inherited by multiple times in a child and\nconstructors in the parent are able to be renamed.\n\nAs an example, this \\<open>T3\\<close> inherits \\<open>T1\\<close> twice, by qualifying the second inheritance with name \\<open>t1'\\<close>\nand renaming only the constructor \\<open>C1\\<close>.\\<close>\n\nvirtual_datatype T3 = T1 + t1': T1[C1=C1']\n\ntext \\<open>The resulting locale is like this. Note we only rename the \\<open>C1\\<close> so the constructor \\<open>C2\\<close>\nis shared between two copies of \\<open>T1\\<close>.\\<close>\n\nprint_locale T3\n\nlocale T3_demo =\n  fixes CONS_OF :: \"'rep::plus \\<Rightarrow> 'CONS_NAME\"\n    and C1 :: \"('CONS_NAME, 'rep, nat)  Virtual_Datatype.Field\"\n    and C2 :: \"('CONS_NAME, 'rep, bool) Virtual_Datatype.Field\"\n    and C1' :: \"('CONS_NAME, 'rep, nat) Virtual_Datatype.Field\"\n  assumes \"Field.project C1 (Field.inject C1 n) = n\"\n    and   \"Field.project C2 (Field.inject C2 b) = b\"\n    and   \"Field.project C1' (Field.inject C1' n) = n\"\n    and \\<open>distinct [Field.name C1, Field.name C2, Field.name C1']\\<close>\n\ntext \\<open>Proof elements of \\<open>T1\\<close> represent also two copies in \\<open>T3\\<close>\\<close>\n\ncontext T3 begin\nthm trn     \\<comment> \\<open>@{thm trn}\\<close>\nthm t1'.trn \\<comment> \\<open>@{thm t1'.trn}\\<close>\nend\n\ntext \\<open>Note there are two theorems \\<open>trn\\<close>, two constant \\<open>trn\\<close> and \\<open>t1'.trn\\<close>.\nTwo theorems share the same constructor \\<open>C2\\<close> but use their own different \\<open>C1\\<close> and \\<open>C1'\\<close>.\\<close>\n\n\nsubsection \\<open>Recursion\\<close>\n\ntext \\<open>Recursion is feasible by using \\<^typ>\\<open>'self\\<close>.\nFor example, the following implements a list using VDT.\\<close>\n\nvirtual_datatype TR =\n  R_NIL :: \"unit\"\n  R_CONS :: \"nat \\<times> 'self\"\n\ntext \\<open>A limitation is, lacking of case-split and Bounded Natural Functor (BNF)~\\cite{datatypes},\nit is unfeasible to define recursive functions over VDTs right now.\nIt is not a theoretical limitation and is planned in future.\\<close>\n\ncontext TR begin\n\ndefinition \"sth = R_CONS.mk (3, R_CONS.mk (2, R_NIL.mk ()))\"\n  \\<comment> \\<open>Instead, we use some trivial things to demonstrate the basic recursion.\\<close>\n\nend\n\ntext \\<open>Recall VDT is by locale-based approach. It is a set of assumptions which can be inconsistent.\\<close>\n\nvirtual_datatype Inconsistent =\n  Inconsit :: \"'self \\<Rightarrow> bool\"\n\ntext \\<open>Therefore, any conclusion proven on VDTs is valid only until the VDTs are interpreted.\\<close>\n\nsubsection \\<open>Interpretation of VDT locale\\<close>\n\ndatatype cons_names = MY_R_NIL | MY_R_CONS\n\ninterpretation interp1: TR\n  \"(\\<lambda>l. case l of [] \\<Rightarrow> MY_R_NIL | _ \\<Rightarrow> MY_R_CONS)\" _ _\n  \\<open>Virtual_Datatype.Field MY_R_NIL (\\<lambda>_. ()) (\\<lambda>_. [])\\<close>\n  \\<open>Virtual_Datatype.Field MY_R_CONS (\\<lambda>l. case l of (a#l') \\<Rightarrow> (a,l')) (\\<lambda>(a,l'). a#l')\\<close>\n  by unfold_locales (auto split: list.split unit.split)\n\nthm interp1.sth_def[simplified] \\<comment> \\<open>@{thm interp1.sth_def[simplified]}\\<close>\n\n\n\nsection \\<open>Documentation of Inner Implementation for Developers\\<close>\n\ntext \\<open>The essence of a VDT is three locales.\n@{locale T1_names} is for names of constructors, @{locale T1_prjs} describes the projectors\nand injectors of each constructor, and @{locale T1} combines them two.\\<close>\n\nprint_locale T1_names\nprint_locale T1_prjs\nprint_locale T1\n\n\n\n\n\nend", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_Semantics_Framework/Virt_Datatype/example/VDT_Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.6513548511303338, "lm_q1q2_score": 0.3282217286886258}}
{"text": "\\<^marker>\\<open>creator Florian Keßler\\<close>\n\nsection \"IMP-- to SAS++ Correctness\"\n\ntheory IMP_Minus_Minus_To_SAS_Plus_Plus_Correctness \n  imports IMP_Minus_Minus_To_SAS_Plus_Plus_Reduction SAS_Plus_Plus\nbegin \n\ntext \\<open> We show correctness for the IMP-- to SAS++ reduction. \\<close>\n\nlemma sas_plus_state_to_imp_minus_of_effect: \n  assumes \"op \\<in> set (com_to_operators c1)\"\n  shows \"sas_plus_state_to_imp_minus (imp_minus_state_to_sas_plus (c, is) ++ map_of (effect_of op)) \n  = (pc_to_com (effect_of op), \n  snd (sas_plus_state_to_imp_minus (imp_minus_state_to_sas_plus (c, is) ++ map_of (effect_of op))))\"\nproof -\n  have \"fst (sas_plus_state_to_imp_minus \n    (imp_minus_state_to_sas_plus (c, is) ++ map_of (effect_of op))) = pc_to_com (effect_of op)\"\n    using assms by(auto simp: imp_minus_state_to_sas_plus_def sas_plus_state_to_imp_minus_def \n                   com_to_operators_variables_distinct) \n  moreover have \"snd (sas_plus_state_to_imp_minus \n    (imp_minus_state_to_sas_plus (c, is) ++ map_of (effect_of op))) a = (is ++ ((\\<lambda>x. (case x of \n      EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \\<circ>\\<^sub>m (map_of (effect_of op)) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) a\"\n    for a using assms\n    by(auto simp: imp_minus_state_to_sas_plus_def sas_plus_state_to_imp_minus_def \n      option.case_eq_if map_comp_def map_add_def com_to_operators_variables_distinct \n      split: domain_element.splits)\n  moreover then have \"snd (sas_plus_state_to_imp_minus \n    (imp_minus_state_to_sas_plus (c, is) ++ map_of (effect_of op))) = (is \n   ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \\<circ>\\<^sub>m (map_of (effect_of op)) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x))))\"\n    by auto\n  ultimately show ?thesis using assms by (metis prod.collapse)\nqed\n\nlemma imp_minus_state_to_sas_plus_update_PC[simp]: \n  \"(imp_minus_state_to_sas_plus (c1, is1))(PC \\<mapsto> PCV c2) \n  = imp_minus_state_to_sas_plus (c2, is1)\"\n  by(auto simp: imp_minus_state_to_sas_plus_def option.case_eq_if)\n\nlemma sas_plus_state_to_imp_minus_of_lambda_PC[simp]: \"sas_plus_state_to_imp_minus\n  (\\<lambda>a. if a = PC then Some (PCV c1)\n       else ss a)\n  = (c1, snd (sas_plus_state_to_imp_minus ss))\"\n  by (auto simp: imp_minus_state_to_sas_plus_def sas_plus_state_to_imp_minus_def map_comp_def)\n\nlemma sas_plus_state_to_imp_minus_of_PC_updated[simp]: \n  \"sas_plus_state_to_imp_minus (ss(PC \\<mapsto> PCV c)) \n  = (c, snd (sas_plus_state_to_imp_minus ss))\"\n  by (auto simp: sas_plus_state_to_imp_minus_def map_comp_def)\n\nlemma imp_minus_state_to_sas_plus_VN_eq_Some_Iff[simp]: \n  \"(imp_minus_state_to_sas_plus (c, s) (VN x) = Some y) \n  \\<longleftrightarrow> ((map_option EV (s x)) = Some y)\"\n  by (simp add: imp_minus_state_to_sas_plus_def map_comp_Some_iff)\n\nlemma imp_minus_state_to_sas_plus_add_effect: \n  assumes \"op \\<in> set (com_to_operators c)\"\n  shows \"imp_minus_state_to_sas_plus (c1, is) ++ map_of (effect_of op) \n      = imp_minus_state_to_sas_plus (pc_to_com (effect_of op), is) ++ map_of (effect_of op)\"\n  using assms com_to_operators_variables_distinct \n  by(auto simp: map_add_def imp_minus_state_to_sas_plus_def fun_eq_iff split: option.splits)\n  \nlemma imp_minus_state_to_sas_plus_of_effect: \n  assumes \"op \\<in> set (com_to_operators cB)\"\n  shows \"((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))(PC \\<mapsto> PCV c2) =\n    imp_minus_state_to_sas_plus (c2, s')) \\<longleftrightarrow> ((s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) = s')\"\nproof\n  assume *: \"(imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))(PC \\<mapsto> PCV c2) \n    = imp_minus_state_to_sas_plus (c2, s')\"\n  have \"\\<forall>a. (s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) a = s' a\"\n  proof(rule ccontr)\n    assume \"\\<not>(\\<forall>a. (s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n      \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) a = s' a)\"\n    then obtain a where \"(s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n      \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) a \\<noteq> s' a\" by auto\n    then have \"((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))(PC \\<mapsto> PCV c2)) (VN a)\n      \\<noteq> imp_minus_state_to_sas_plus (c2, s') (VN a)\"\n      by(auto simp: imp_minus_state_to_sas_plus_def map_comp_def map_add_def domD domIff \n            split: option.splits)\n    then show \"False\" using * by auto\n  qed\n  then show \"((s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) = s')\" by auto\nnext\n  assume *: \"((s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) = s')\"\n  then have \"((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))(PC \\<mapsto> PCV c2)) a\n      = imp_minus_state_to_sas_plus (c2, s') a\" for a\n    using assms by(cases a) (auto simp: com_to_operators_variables_distinct \n        imp_minus_state_to_sas_plus_def map_comp_def map_add_def option.case_eq_if\n        split: option.splits domain_element.splits)\n  then show \"(imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))(PC \\<mapsto> PCV c2) \n    = imp_minus_state_to_sas_plus (c2, s')\" by auto\nqed\n\nlemma imp_minus_state_to_sas_plus_of_effect': \n  assumes \"op \\<in> set (com_to_operators cB)\"\n  shows \"((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op)) =\n    imp_minus_state_to_sas_plus (c2, s')) \\<longleftrightarrow> ((pc_to_com (effect_of op) = c2) \\<and> \n  (s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) = s')\"\nproof -\n  have \"imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op) = \n    ((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))\n    (PC \\<mapsto> PCV (pc_to_com (effect_of op))))\"\n    using assms com_to_operators_variables_distinct by auto\n  moreover have \"((imp_minus_state_to_sas_plus (c1, s) ++ map_of (effect_of op))\n  (PC \\<mapsto> PCV (pc_to_com (effect_of op))) =\n    imp_minus_state_to_sas_plus ((pc_to_com (effect_of op)), s')) \n    \\<longleftrightarrow> ((s ++ ((\\<lambda>x. (case x of EV y \\<Rightarrow> Some y | _ \\<Rightarrow> None)) \n    \\<circ>\\<^sub>m map_of (effect_of op) \\<circ>\\<^sub>m (\\<lambda>x. Some (VN x)))) = s')\" \n    using assms imp_minus_state_to_sas_plus_of_effect by blast\n  ultimately show ?thesis using assms imp_minus_state_to_sas_plus_def map_upd_eqD1 \n    by (metis domain_element.inject fst_conv)\nqed\n\nlemma updated_state_is_sane:\n  assumes \"op \\<in> set (com_to_operators c)\" \n    \"sane_sas_plus_state ss1\"\n  shows \"sane_sas_plus_state (ss1 \\<then>\\<^sub>+ op)\"\nproof -\n  have \"\\<exists>x. (VN v, EV x) \\<in> set (effect_of op) \\<or> map_of (effect_of op) (VN v) = None\" for v\n    using assms variables_in_effect by simp\n  then show ?thesis using assms \n    apply(auto simp: sane_sas_plus_state_def com_to_operators_variables_distinct \n        map_add_Some_iff) \n    using in_set_effect by blast\nqed\n\nlemma imp_minus_state_to_sas_plus_update_VN[simp]: \"(\\<lambda>a. if a = PC then Some (PCV c2) \n   else (imp_minus_state_to_sas_plus (c1, is1)(VN x \\<mapsto> EV y)) a) \n    = imp_minus_state_to_sas_plus (c2, is1(x \\<mapsto> y))\"\nproof -\n  have \"(if a = PC then Some (PCV c2) else ((imp_minus_state_to_sas_plus (c1, is1)(VN x \\<mapsto> EV y)) a))\n    = (imp_minus_state_to_sas_plus (c2, is1(x \\<mapsto> y))) a\" for a\n    by (auto simp: imp_minus_state_to_sas_plus_def map_comp_def split: variable.splits)\n  then show ?thesis by auto\nqed\n\nlemma VN_PC_map_le_iff[simp]: \"[VN v \\<mapsto> y, PC \\<mapsto> x] \\<subseteq>\\<^sub>m (imp_minus_state_to_sas_plus (c1, is)) \n  = (x = PCV c1 \\<and> map_option EV (is v) = Some y)\"\n  by (auto simp: map_le_def imp_minus_state_to_sas_plus_def option.case_eq_if map_comp_def)\n\nlemma operator_with_PC_updated_applicable_iff[simp]: \"op \\<in> set (com_to_operators c1) \\<Longrightarrow> \n  map_of (precondition_of op)(PC \\<mapsto> PCV c2) \\<subseteq>\\<^sub>m imp_minus_state_to_sas_plus (c2, s)\n  \\<longleftrightarrow>  map_of (precondition_of op) \\<subseteq>\\<^sub>m imp_minus_state_to_sas_plus (c1, s)\"\n  by(auto simp: imp_minus_state_to_sas_plus_def map_le_def)\n\nlemma applicable_in_imp_minus_then[simp]: \n  \"is_operator_applicable_in (imp_minus_state_to_sas_plus (c1, is)) \n  \\<lparr>precondition_of = [(PC, x), (VN v, y)], effect_of = effect\\<rparr> \n  \\<longleftrightarrow> (x = PCV c1 \\<and> map_option EV (is v) = Some y)\"\n  by (auto simp: map_le_def imp_minus_state_to_sas_plus_def option.case_eq_if map_comp_def)\n\n\n\nlemma PC_map_le_iff[simp]: \"[PC \\<mapsto> x] \\<subseteq>\\<^sub>m (imp_minus_state_to_sas_plus (c1, is)) \n  = (x = PCV c1)\"\n  by (auto simp: map_le_def imp_minus_state_to_sas_plus_def)\n\nlemma map_of_list_update: \"distinct (map fst l) \\<Longrightarrow> length l > 0 \\<Longrightarrow> fst (l ! 0) = x  \\<Longrightarrow> z \\<noteq> x\n  \\<Longrightarrow> map_of (list_update l 0 (x, y)) z = map_of l z\"\n  by (induction l) auto\n\nlemma map_of_update_PC_in_effect_of_op[simp]: assumes \"op \\<in> set (com_to_operators c)\"\n  shows \"map_of (list_update (effect_of op) 0 (PC, y)) = (map_of (effect_of op))(PC \\<mapsto> y)\"\nproof -\n  have \"map_of (list_update (effect_of op) 0 (PC, y)) x = ((map_of (effect_of op))(PC \\<mapsto> y)) x\" for x\n    using assms com_to_operators_variables_distinct effect_nonempty \n      map_of_list_update[where ?l = \"effect_of op\"]\n    by (auto) \n      (metis effect_nonempty fst_of_effect map_of_eq_Some_iff set_update_memI update_preserve_distinct)\n  then show ?thesis by auto\nqed\n\nlemma map_of_update_PC_in_precondition_of_op[simp]: assumes \"op \\<in> set (com_to_operators c)\"\n  shows \"map_of (list_update (precondition_of op) 0 (PC, y)) = (map_of (precondition_of op))(PC \\<mapsto> y)\"\nproof -\n  have \"map_of (list_update (precondition_of op) 0 (PC, y)) x = ((map_of (precondition_of op))(PC \\<mapsto> y)) x\" for x\n    using assms com_to_operators_variables_distinct precondition_nonempty \n      map_of_list_update[where ?l = \"precondition_of op\"]\n    by (auto) \n     (metis precondition_nonempty fst_of_precondition map_of_eq_Some_iff set_update_memI update_preserve_distinct)\n  then show ?thesis by auto\nqed\n\nlemma pc_of_op: \n  assumes \"op \\<in> set (com_to_operators c2)\"\n    \"ss2 = imp_minus_state_to_sas_plus (c1, is)\" \n    \"ss1 \\<then>\\<^sub>+ op = ss2\"\n  shows \"pc_to_com (effect_of op) = c1\" \nproof -\n  have \"(ss1 \\<then>\\<^sub>+ op) PC = Some (PCV c1)\" using assms by simp\n  then show ?thesis using assms com_to_operators_variables_distinct by auto\nqed\n\nlemma effect_in_updated[simp]: \n  assumes \"op' \\<in> set (com_to_operators c)\" \n    \"map_of (precondition_of op') = (map_of (precondition_of op))(PC \\<mapsto> PCV c)\"\n    \"map_of (effect_of op') = (map_of (effect_of op))(PC \\<mapsto> PCV (pc_to_com (effect_of op')))\"\n    \"s \\<then>\\<^sub>+ op = s'\"\n  shows \"s(PC \\<mapsto> PCV c) \\<then>\\<^sub>+ op' = s'(PC \\<mapsto> PCV (pc_to_com (effect_of op')))\" \nproof -\n  have \"(s(PC \\<mapsto> PCV c)  \\<then>\\<^sub>+ op') x = (s'(PC \\<mapsto> PCV (pc_to_com (effect_of op')))) x\" for x\n    using assms PC_in_effect_precondition com_to_operators_variables_distinct apply auto\n    by (metis fun_upd_other map_add_def)\n  then show ?thesis by auto\nqed\n\nlemma applicable_in_PC_updated: \"m \\<subseteq>\\<^sub>m s(PC \\<mapsto> y) \\<Longrightarrow> s PC = Some x \\<Longrightarrow> m(PC \\<mapsto> x) \\<subseteq>\\<^sub>m s\"\n  by (simp add: map_le_def)\n\ntext \\<open> We first show that every operation in SAS++ corresponds to a single step in IMP-- \\<close>\n\nlemma sas_plus_plus_to_imp_minus_minus_single_step:\n  \"op \\<in> set (com_to_operators c1)\n  \\<Longrightarrow> c1 \\<in> set (enumerate_subprograms c) \\<Longrightarrow> t > 0 \n  \\<Longrightarrow> is_operator_applicable_in (imp_minus_state_to_sas_plus (c1, is1)) op\n  \\<Longrightarrow> (c1, is1) \\<rightarrow>\n  sas_plus_state_to_imp_minus ((imp_minus_state_to_sas_plus (c1, is1)) \\<then>\\<^sub>+ op)\"\nproof (induction c1 arbitrary: op is1)\n  case (Seq cA cB)\n  have \"cA = SKIP \\<or> cA \\<noteq> SKIP\" by auto\n  then show ?case using Seq\n  proof (elim disjE)\n    assume \"cA \\<noteq> SKIP\"\n    then obtain op' where op'_def: \"op' \\<in> set (com_to_operators cA)\"\n      \"op = (let c1' = pc_to_com (effect_of op') in \n      \\<lparr> precondition_of = list_update (precondition_of op') 0 (PC, PCV (cA ;; cB)),\n        effect_of = list_update (effect_of op') 0 (PC, PCV (c1' ;; cB))\\<rparr>)\" using Seq by auto\n    let ?c1' = \"pc_to_com (effect_of op')\"\n    let ?ss1' = \"(imp_minus_state_to_sas_plus ((cA ;; cB), is1))(PC \\<mapsto> PCV cA)\"\n    let ?ss2' = \"((imp_minus_state_to_sas_plus ((cA ;; cB), is1)) \\<then>\\<^sub>+ op)(PC \\<mapsto> PCV ?c1')\"\n    have \"cA \\<in> set (enumerate_subprograms c)\" \n      using \\<open>cA;;cB \\<in> set (enumerate_subprograms c)\\<close> c_in_all_subprograms_c\n      by (force intro!: enumerate_subprograms_transitive[where ?c2.0 = \"cA;; cB\"])\n    then have \"(cA, is1) \\<rightarrow> sas_plus_state_to_imp_minus ?ss2'\"\n      using \\<open>0 < t\\<close> op'_def Seq  imp_minus_state_to_sas_plus_add_effect[where ?c1.0=\"cA;; cB\"]\n      imp_minus_state_to_sas_plus_add_effect[where ?c1.0=\"cA\"] \n      by(auto simp: com_to_operators_variables_distinct fun_upd_idem)\n    then show ?thesis using op'_def by auto\n  qed auto\nqed(auto simp: Let_def map_leq_imp_minus_state_to_sas_plus_iff)\n\n\ntext \\<open> Next, we show that a plan in SAS++ corresponds to executing several steps in IMP-- \\<close>\n\nlemma sas_plus_plus_to_imp_minus_minus_aux:\n  \"set ops \\<subseteq> set ((imp_minus_minus_to_sas_plus c I G)\\<^sub>\\<O>\\<^sub>+) \n  \\<Longrightarrow> sane_sas_plus_state ss1\n  \\<Longrightarrow> execute_serial_plan_sas_plus ss1 ops = ss2\n  \\<Longrightarrow> (\\<exists>t'. t' \\<le> length ops \n    \\<and> sas_plus_state_to_imp_minus ss1 \\<rightarrow>\\<^bsup>t'\\<^esup> sas_plus_state_to_imp_minus ss2)\"\nproof (induction ops arbitrary: ss1)\n  case (Cons op ops)\n  let ?c1 = \"fst (sas_plus_state_to_imp_minus ss1)\"\n  let ?is1 = \"snd (sas_plus_state_to_imp_minus ss1)\"\n  let ?ss1' = \"ss1 \\<then>\\<^sub>+ op\" \n  have \"is_operator_applicable_in ss1 op \\<or> \\<not>(is_operator_applicable_in ss1 op)\" by auto\n  then show ?case using Cons\n  proof (elim disjE)\n    assume a: \"is_operator_applicable_in ss1 op\"\n    then have op_in_cto_c1: \"op \\<in> set (com_to_operators ?c1)\" using Cons by auto\n    moreover then have \"?c1 \\<in> set (enumerate_subprograms c)\" using Cons a \n      apply(auto simp: imp_minus_minus_to_sas_plus_def Let_def coms_to_operators_def)\n      by (metis PC_of_precondition domain_element.simps op_in_cto_c1)\n    ultimately have c1_to_c1': \"(?c1, ?is1) \\<rightarrow> sas_plus_state_to_imp_minus \n      (imp_minus_state_to_sas_plus (?c1, ?is1) \\<then>\\<^sub>+ op)\" \n      apply(rule sas_plus_plus_to_imp_minus_minus_single_step)\n      using Cons a op_in_cto_c1 by auto\n    moreover then have \"execute_serial_plan_sas_plus ?ss1' ops = ss2\"\n      and \"sane_sas_plus_state ?ss1'\" \n      using Cons a op_in_cto_c1 updated_state_is_sane by auto \n    ultimately have \"\\<exists>t'. t' \\<le> length ops \\<and> sas_plus_state_to_imp_minus ?ss1' \n      \\<rightarrow>\\<^bsup>t'\\<^esup> sas_plus_state_to_imp_minus ss2\"\n      using Cons by(auto)\n    moreover have \"imp_minus_state_to_sas_plus (?c1, ?is1) \\<then>\\<^sub>+ op = ?ss1'\" using Cons by auto\n    ultimately show ?case using c1_to_c1' by auto\n  qed auto\nqed auto\n\nlemma all_zero_than_zero_map_le: \"\\<forall>b\\<in>set bs. s b = Some Zero \n  \\<Longrightarrow> map_of (map (\\<lambda>v. (v, Zero)) (remdups bs)) \\<subseteq>\\<^sub>m s\" \n  apply(induction bs) \n  by(auto simp: map_le_def)\n\ntext \\<open> For the other direction, we again first show that a single step in IMP-- always \n      corresponds to applying one operation in SAS++ \\<close>\n\nlemma imp_minus_minus_to_sas_plus_plus_single_step:\n   \"(c1, is1) \\<rightarrow> (c2, is2) \n  \\<Longrightarrow> c1 \\<in> set (enumerate_subprograms c)\n  \\<Longrightarrow> dom is1 = set (enumerate_variables c)\n  \\<Longrightarrow> (\\<exists>op \\<in> set (com_to_operators c1).\n      execute_operator_sas_plus (imp_minus_state_to_sas_plus (c1, is1)) op \n        =  imp_minus_state_to_sas_plus (c2, is2)\n    \\<and> is_operator_applicable_in (imp_minus_state_to_sas_plus (c1, is1)) op)\"\nproof (induction c1 is1 c2 is2 rule: small_step_induct)\n  case (Assign x a s)\n  thus ?case by auto\nnext\n  case (Seq2 c\\<^sub>1 s c\\<^sub>1' s' c\\<^sub>2)\n  have \"c\\<^sub>1 \\<in> set (enumerate_subprograms (c\\<^sub>1 ;; c\\<^sub>2))\" using c_in_all_subprograms_c by auto\n  then have \"c\\<^sub>1 \\<in> set (enumerate_subprograms c)\" using Seq2 enumerate_subprograms_transitive by blast\n  then obtain op' where op'_def: \"op' \\<in> set (com_to_operators c\\<^sub>1) \\<and>\n    execute_operator_sas_plus (imp_minus_state_to_sas_plus (c\\<^sub>1, s)) op'\n        =  imp_minus_state_to_sas_plus (c\\<^sub>1', s')\n    \\<and> is_operator_applicable_in (imp_minus_state_to_sas_plus (c\\<^sub>1, s)) op'\" \n    using Seq2 by fastforce\n  let ?op = \"\\<lparr> precondition_of = list_update (precondition_of op') 0 (PC, PCV (c\\<^sub>1 ;; c\\<^sub>2)),\n        effect_of = list_update (effect_of op') 0 (PC, PCV (c\\<^sub>1' ;; c\\<^sub>2))\\<rparr>\"\n  have \"?op \\<in> set (com_to_operators (c\\<^sub>1 ;; c\\<^sub>2))\"\n    and \"execute_operator_sas_plus (imp_minus_state_to_sas_plus ((c\\<^sub>1 ;; c\\<^sub>2), s)) ?op \n        = imp_minus_state_to_sas_plus ((c\\<^sub>1' ;; c\\<^sub>2), s')\"\n    and \"is_operator_applicable_in (imp_minus_state_to_sas_plus ((c\\<^sub>1 ;; c\\<^sub>2), s)) ?op\"\n    using Seq2 op'_def imp_minus_state_to_sas_plus_of_effect imp_minus_state_to_sas_plus_of_effect'\n    by auto\n  then show ?case using Seq2 by blast\nnext\n  case (IfTrue bs s c\\<^sub>1 c\\<^sub>2)\n  have \"set bs \\<subseteq> set (enumerate_variables c)\" \n    using IfTrue enumerate_subprograms_enumerate_variables by fastforce\n  hence \"\\<forall>b \\<in> set bs. \\<exists>y. s b = Some y\" using \\<open>dom s = set (enumerate_variables c)\\<close> by auto\n  then show ?case using IfTrue by (auto simp: Let_def) \nnext\n  case (IfFalse bs s c\\<^sub>1 c\\<^sub>2)\n  hence \"set bs \\<subseteq> set (enumerate_variables c)\" \n    using enumerate_subprograms_enumerate_variables by fastforce\n  thus ?case using IfFalse \n    by(auto simp: Let_def map_leq_imp_minus_state_to_sas_plus_iff all_zero_than_zero_map_le) \nnext\n  case (WhileTrue bs s c1)\n  hence \"set bs \\<subseteq> set (enumerate_variables c)\" \n    using  enumerate_subprograms_enumerate_variables by fastforce\n  then show ?case using WhileTrue\n    by(force simp: Let_def map_leq_imp_minus_state_to_sas_plus_iff all_zero_than_zero_map_le)\nnext\n  case (WhileFalse bs s c1)\n   hence \"set bs \\<subseteq> set (enumerate_variables c)\" \n    using  enumerate_subprograms_enumerate_variables by fastforce\n  then show ?case using WhileFalse\n    by(force simp: Let_def map_leq_imp_minus_state_to_sas_plus_iff all_zero_than_zero_map_le)\nqed auto\n\ntext \\<open> Next, we show that taking multiple steps in IMP-- corresponds to executing multiple\n      operations in SAS++ \\<close>\n\nlemma imp_minus_minus_to_sas_plus_plus_aux:\n   \"(c1, is1) \\<rightarrow>\\<^bsup>t\\<^esup> (c2, is2)\n  \\<Longrightarrow> c1 \\<in> set (enumerate_subprograms c)\n  \\<Longrightarrow> dom is1 = set (enumerate_variables c)\n  \\<Longrightarrow> (\\<exists>ops. set ops \\<subseteq> set ((imp_minus_minus_to_sas_plus c I G)\\<^sub>\\<O>\\<^sub>+)\n     \\<and> length ops = t\n     \\<and> (execute_serial_plan_sas_plus (imp_minus_state_to_sas_plus (c1, is1)) ops)\n        = imp_minus_state_to_sas_plus (c2, is2))\"\nproof (induction t arbitrary: c1 is1)\n  case (Suc t)\n  obtain c1' is1' where c1'_def: \"(c1, is1) \\<rightarrow> (c1', is1')\n    \\<and> (c1', is1') \\<rightarrow>\\<^bsup>t\\<^esup> (c2, is2)\" using Suc by auto\n  then obtain op where op_def: \"op \\<in> set (com_to_operators c1)\n    \\<and> execute_operator_sas_plus (imp_minus_state_to_sas_plus (c1, is1)) op \n        =  imp_minus_state_to_sas_plus (c1', is1')\n    \\<and> is_operator_applicable_in (imp_minus_state_to_sas_plus (c1, is1)) op\" \n    using imp_minus_minus_to_sas_plus_plus_single_step Suc by metis\n  then have \"dom is1' = set (enumerate_variables c)\" \n    using c1'_def Suc step_doesnt_add_variables\n     apply (auto simp: domIff)\n    by (metis domD domIff option.simps(3) step_doesnt_add_variables)+\n  moreover have \"c1' \\<in> set (enumerate_subprograms c)\" using c1'_def enumerate_subprograms_transitive \n    enumerate_subprograms_complete_step\n    using Suc.prems by blast+\n  ultimately obtain ops where ops_def: \"set ops \\<subseteq> set ((imp_minus_minus_to_sas_plus c I G)\\<^sub>\\<O>\\<^sub>+)\n     \\<and> length ops = t\n     \\<and> (execute_serial_plan_sas_plus (imp_minus_state_to_sas_plus (c1', is1')) ops)\n        = imp_minus_state_to_sas_plus (c2, is2)\"\n    using Suc c1'_def Suc_lessD by blast\n  let ?ops' = \"op # ops\"\n  have \"set ?ops' \\<subseteq> set ((imp_minus_minus_to_sas_plus c I G)\\<^sub>\\<O>\\<^sub>+)\n     \\<and> length ?ops' = Suc t\n     \\<and> (execute_serial_plan_sas_plus (imp_minus_state_to_sas_plus (c1, is1)) ?ops')\n        = imp_minus_state_to_sas_plus (c2, is2)\"\n    using Suc c1'_def op_def ops_def\n    by (auto simp: imp_minus_minus_to_sas_plus_def Let_def coms_to_operators_def)\n  then show ?case by blast\nqed auto\n\ntext \\<open> In the previous correctness lemmas, we formulated the statements as to permit arbitrary\n       initial and final states that could occur sometime during the execution. We now proceed \n       to reformulate them in simpler terms, using the initial initial and final states as specified\n       in the SAS++ problem translated from IMP--. \\<close>\n\nlemma imp_minus_minus_to_sas_plus_plus:\n  assumes \"(c, is1) \\<rightarrow>\\<^bsup>t\\<^esup> (SKIP, is2)\"\n   \"dom is1 = set (enumerate_variables c)\"\n   \"I \\<subseteq>\\<^sub>m is1\"\n   \"G \\<subseteq>\\<^sub>m is2\"\n   \"t \\<le> t'\"\n  shows \"(\\<exists>plan.\n     is_serial_solution_for_problem_sas_plus_plus (imp_minus_minus_to_sas_plus c I G) plan\n     \\<and> length plan \\<le> t')\"\nproof -\n  let ?\\<Psi> = \"imp_minus_minus_to_sas_plus c I G\"\n  let ?I' = \"imp_minus_state_to_sas_plus (c, is1)\" \n  obtain plan where plan_def: \"set plan \\<subseteq> set ((?\\<Psi>)\\<^sub>\\<O>\\<^sub>+)\n     \\<and> length plan = t\n     \\<and> (execute_serial_plan_sas_plus ?I' plan)\n        = imp_minus_state_to_sas_plus (SKIP, is2)\"\n    using imp_minus_minus_to_sas_plus_plus_aux[OF assms(1)] assms c_in_all_subprograms_c by blast\n  moreover then have \"(?\\<Psi>)\\<^sub>G\\<^sub>+ \\<subseteq>\\<^sub>m execute_serial_plan_sas_plus ?I' plan\"\n    and \"dom ?I' = set (((?\\<Psi>))\\<^sub>\\<V>\\<^sub>+)\"\n    and \"(\\<forall> v \\<in> set ((?\\<Psi>)\\<^sub>\\<V>\\<^sub>+). the (?I' v) \\<in> range_of' ?\\<Psi> v)\"\n    and \"((?\\<Psi>)\\<^sub>I\\<^sub>+) \\<subseteq>\\<^sub>m ?I'\"\n    using assms plan_def c_in_all_subprograms_c\n    apply(auto simp: imp_minus_minus_to_sas_plus_def Let_def \n        range_of'_def imp_minus_state_to_sas_plus_def map_comp_def map_le_def)\n        apply (auto split: option.splits variable.splits)\n    by (metis domIff option.distinct option.inject)+\n  ultimately have \"is_serial_solution_for_problem_sas_plus_plus ?\\<Psi> plan\" \n    using assms\n    by(auto simp: is_serial_solution_for_problem_sas_plus_plus_def Let_def list_all_def ListMem_iff)\n  then show ?thesis using plan_def \\<open>t \\<le> t'\\<close>\n    by blast\nqed\n\nlemma sas_plus_plus_to_imp_minus_minus:\n  assumes \"is_serial_solution_for_problem_sas_plus_plus (imp_minus_minus_to_sas_plus c I G) plan\"\n    \"EV ` (ran I) \\<subseteq> set domain\"\n    \"EV ` (ran G) \\<subseteq> set domain\"\n  shows \"\\<exists>is1 is2 t. (I|` set (enumerate_variables c)) \\<subseteq>\\<^sub>m is1 \\<and> dom is1 = set (enumerate_variables c)\n    \\<and> (G|` set (enumerate_variables c)) \\<subseteq>\\<^sub>m is2 \\<and> t \\<le> length plan \n    \\<and> (c, is1) \\<rightarrow>\\<^bsup>t\\<^esup> (SKIP, is2)\" \nproof -\n  let ?\\<Psi> = \"imp_minus_minus_to_sas_plus c I G\"\n  obtain I' where I'_def: \"((?\\<Psi>)\\<^sub>I\\<^sub>+) \\<subseteq>\\<^sub>m I' \\<and> dom I' = set ((?\\<Psi>)\\<^sub>\\<V>\\<^sub>+) \n        \\<and> (\\<forall>v \\<in> set ((?\\<Psi>)\\<^sub>\\<V>\\<^sub>+). the (I' v) \\<in> range_of' ?\\<Psi> v)\n        \\<and> ((?\\<Psi>)\\<^sub>G\\<^sub>+) \\<subseteq>\\<^sub>m execute_serial_plan_sas_plus I' plan\" \n    using assms by (auto simp: is_serial_solution_for_problem_sas_plus_plus_def Let_def)\n  let ?ss2 = \"execute_serial_plan_sas_plus I' plan\"\n  let ?is1 = \"snd (sas_plus_state_to_imp_minus I')\"\n  let ?is2 = \"snd (sas_plus_state_to_imp_minus ?ss2)\"\n  have \"\\<forall>v\\<in>set (enumerate_variables c). (\\<exists>y \\<in> set domain. I' (VN v) = Some y)\" using I'_def \n    apply (auto simp: imp_minus_minus_to_sas_plus_def Let_def range_of'_def)\n    by (metis domIff image_insert insertI1 insertI2 mk_disjoint_insert option.collapse)\n  then have \"sane_sas_plus_state I'\" using I'_def assms\n    apply (auto simp: sane_sas_plus_state_def imp_minus_minus_to_sas_plus_def Let_def map_le_def \n         range_of'_def)\n    by (metis domIff insertI1 option.collapse)\n  then obtain t where t_def: \"t \\<le> length plan \\<and> sas_plus_state_to_imp_minus I' \n    \\<rightarrow>\\<^bsup>t\\<^esup> sas_plus_state_to_imp_minus ?ss2\"\n    apply - apply(rule exE[OF sas_plus_plus_to_imp_minus_minus_aux[where ?ops=plan]])\n    using assms I'_def  \n    by(auto simp: is_serial_solution_for_problem_sas_plus_plus_def Let_def list_all_def ListMem_iff)\n    \n  moreover have \"fst (sas_plus_state_to_imp_minus I') = c\"\n    and \"fst (sas_plus_state_to_imp_minus ?ss2) = SKIP\"\n    using assms I'_def apply(auto simp: imp_minus_minus_to_sas_plus_def Let_def \n         sas_plus_state_to_imp_minus_def map_le_def imp_minus_state_to_sas_plus_def\n        sane_sas_plus_state_def)\n    by (metis (no_types, lifting) domain_element.inject domain_element.simps option.sel \n        option.inject variable.simps)+\n  ultimately have \"((c, ?is1) \\<rightarrow>\\<^bsup>t\\<^esup> (SKIP, ?is2))\" \n    using I'_def by (metis prod.collapse)\n  moreover have \"(I|` set (enumerate_variables c)) \\<subseteq>\\<^sub>m ?is1\"\n    \"(G|` set (enumerate_variables c)) \\<subseteq>\\<^sub>m ?is2\"\n    using assms(2) I'_def \n    by (auto simp: imp_minus_minus_to_sas_plus_def imp_minus_state_to_sas_plus_map_le_then Let_def \n        range_of'_def)\n  moreover have \"dom ?is1 = set (enumerate_variables c)\"\n    using \\<open>sane_sas_plus_state I'\\<close> I'_def by(auto simp: imp_minus_minus_to_sas_plus_def \n        dom_snd_sas_plus_state_to_imp_minus Let_def)\n  ultimately show ?thesis using I'_def t_def by auto\nqed\n    \n    \nend", "meta": {"author": "AlexiosFan", "repo": "BA_NP_Reduction", "sha": "0e37ddc58cb822b0a09b2ce7c15e7b88652e154c", "save_path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction", "path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction/BA_NP_Reduction-0e37ddc58cb822b0a09b2ce7c15e7b88652e154c/poly-reductions/Cook_Levin/IMP-_To_SAS+/IMP--_To_SAS++/IMP_Minus_Minus_To_SAS_Plus_Plus_Correctness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.546738151984614, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.328145874384602}}
{"text": "theory HEAP01ReifyProofs\nimports HEAP01ReifyLemmas\nbegin\n\n(*========================================================================*)\nsection {* Refinement L0-L1 proof *}\n(*========================================================================*)\n\n(* +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *)\nsubsubsection {* Adequacy proof *}\n(* +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *)\n\n(*\nlemma \"F0_inv f0 \\<Longrightarrow> \\<exists> f1  . F1_inv f1 \\<and> f0 = retr0 f1\"\nunfolding retr0_def F1_inv_def F0_inv_def\nthm finite_induct[of f0 \"(\\<lambda> x . \\<exists> f1  . F1_inv f1 \\<and> x = retr0 f1)\"]\napply (rule finite_induct)\napply simp\napply (rule_tac x=empty in exI)\napply (metis l_nat1_map_empty l_disjoint_empty l_finite_empty l_locs_empty_iff l_sep_empty)\napply (elim conjE exE)\napply simp\napply (rule_tac x=f1 in exI)\napply simp\noops\n\nlemma \"F0_inv f0 \\<Longrightarrow> \\<exists> f1  . F1_inv f1 \\<and> f0 = retr0 f1\"\nunfolding retr0_def F1_inv_def F0_inv_def\napply (rule exI)\napply (intro conjI)\nprefer 5\nunfolding locs_def\napply (simp_all)\napply (rule finite_map_upd_induct)\noops\n*)\n\n(*\nlemma r_l01_retr_adequacy: \n   \"PO_l01_adequacy\"\nunfolding PO_l01_adequacy_def F0_inv_def\napply auto -- this doesn't allow me to call the inductive rule, why? TODO: Ask Iain?\n*)\n\ntheorem r_l01_retr_adequacy:\n   \"PO_l01_adequacy\"\nunfolding PO_l01_adequacy_def F0_inv_def\nfind_theorems simp:\"\\<exists>! _ . _\" intro --\"ex1I isn't quite right\"\napply (intro allI impI ex_ex1I)\ndefer\napply (metis F1_inv_def l_locs_ext retr0_def)\napply (induct_tac rule: contig_nonabut_finite_set_induct) (* Aha! Needs to be induct_tac because of the \\<And> f0 ! *)\napply assumption\napply (rule_tac x=empty in exI)\napply (rule conjI)\napply (metis l_locs_empty_iff retr0_def)\napply (metis l_F1_inv_empty)\napply (elim conjE exE)\n  (*apply (rule_tac x=\"f1(Min(F') \\<mapsto> card F')\" in exI)*)\napply (rule_tac x=\"f1 \\<union>m [Min F' \\<mapsto> card F']\" in exI)\napply (subgoal_tac \"Min F' \\<notin> dom f1\")\n  defer\n  apply (metis l_disjoint_retr0_not_in_dom f_F1_inv_nat1_map)\n  \n  (* choice of witness *)\n  apply (rule conjI)\n  unfolding retr0_def\n  apply (subst l_locs_munion_iff)\n    apply (metis f_F1_inv_nat1_map)\n    apply (metis l_nat1_map_singleton l_nat1_card)\n    find_theorems \"locs [_ \\<mapsto> _]\"\n    apply simp\n    apply (subst l_locs_singleton_iff)\n      apply (metis l_nat1_card)\n    thm b_contiguous_locs_off_iff\n    apply (simp add: b_contiguous_locs_off_iff)\n\n  (* invariant over chosen witness *)\n  apply (rule l_F1_inv_singleton_upd)\n    apply (simp add: card_gt_0_iff)\n    apply simp\n    apply simp\n    apply (simp add: b_contiguous_locs_off_iff retr0_def l_disjoint_comm)\n    apply (frule_tac[!] f_F1_inv_nat1_map)\n\n    unfolding sep0_def\n    apply (rule ballI)\n    apply simp\n\n    unfolding contiguous_def\n    apply (frule_tac f=f1 and x=l in f_nat1_map_nat1_elem,simp)\n    apply (erule_tac[!] exE)+\n    apply (erule_tac[!] conjE)\n    apply (rule notI)\n    find_theorems simp:\"disjoint _ _\"\n    apply (simp_all add: l_locs_of_min l_locs_of_card)\n    \n    unfolding non_abutting_def\n    find_theorems \"_ \\<in> dom _ \\<Longrightarrow> _ \\<in> locs _\"\n    apply (frule_tac x=l and f=f1 in f_in_dom_locs,simp)\n    apply (erule_tac x=m in ballE)\n    apply (erule_tac x=\"l+ ((the (f1 l)))\" in ballE)\n    apply (simp_all add: l_locs_of_itself)\n    \n    apply (frule_tac f=f1 and x=l in f_nat1_map_nat1_elem,simp) \n\n\n    defer\n    apply (rule notI)\n    apply (frule_tac x=\"m+l\" and f=f1 in f_in_dom_locs,simp)\n    apply (erule_tac)\n    find_theorems \"(_ + _) \\<notin> dom _\"\n    apply (subst l_disjoint_mapupd_keep_sep)\n      apply simp\n      apply (simp add: f_F1_inv_disjoint)\n    find_theorems name:ind name:Nat\n    apply (erule_tac n=\"the(f l)\" in nat_induct)\n    apply simp\n    find_theorems \"_ \\<in> locs_of _ _\"\n    \n    apply simp_all\n    apply (erule disjE)\n    \n    unfolding disjoint_def \n    find_theorems \"locs_of _ _ \\<inter> locs _\"\n    apply (simp add: k_inter_locs_iff f_F1_inv_nat1_map)\n    apply (erule_tac x=l in ballE,simp_all)\n    apply (simp add: disjoint_iff_not_equal)\n    (*\n    find_theorems \"the(_ ) > 0\"\n    apply (frule f_F1_inv_nat1_map)\n    apply (frule_tac f=f1 and x=l in f_nat1_map_nat1_elem)\n    apply (simp add: b_locs_of_as_set_interval)\n    *)\n    apply (erule_tac x=m in ballE)\n    apply (erule_tac x=l in ballE)\n    apply simp_all\n    apply (rule notI)\n    apply simp\n    apply (elim notE)\n    \n    find_theorems \"locs_of _ _ = _\"\n    apply (frule f_F1_inv_sep)\n    unfolding sep_def\n    apply (erule_tac x=l in ballE)\n    apply simp_all\n    \n    \n\n    (* see IJW sep_non_abutt and its uses *)\n\n    (* abuttiness goal is the last one to go... argh *)\noops\n\n(* +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *)\nsubsubsection {* Pre/post refinement proof *}\n(* +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *)\n\n(* see IJWv2 widen pre *)\nlemma r_free01_widen_pre: \n  \"PO_l01_new_widen_pre\"\n\nunfolding PO_l01_new_widen_pre_def new1_pre_def new0_pre_def is_block_def retr0_def\napply safe\napply (rename_tac k)\nfind_theorems simp:\"_ \\<subseteq> _\" \napply (simp add: subset_eq)\napply (erule_tac x=k in ballE)\napply (simp_all add: l_locs_of_itself)\napply (frule f_F1_inv_nat1_map)\nfind_theorems simp:\"_ \\<in> locs _\"\napply (simp add: k_in_locs_iff)\napply (erule bexE)\napply (case_tac \"k \\<noteq> y\")\napply (case_tac \"k \\<in> dom f1\")\napply (rule_tac x=k in bexI,simp_all) \nunfolding locs_of_def\napply (simp add: f_nat1_map_nat1_elem)\n\napply (rule_tac x=y in bexI,simp_all)\nnitpick\n(* IJWs *)\napply (rule_tac x=k in bexI)\napply (rule locs_subset_free1_map)\napply simp\napply (simp add: nat1)\napply (simp only: inv)\napply simp\n\n(* Leos *)\napply (elim exE conjE)\nfind_theorems simp:\"_ \\<subseteq> _\"\napply (simp add: subset_eq)\nfind_theorems \"_ \\<in> locs _\"\napply (simp add: k_in_locs_iff f_F1_inv_nat1_map)\napply (erule_tac x=l in allE) \napply (elim impE)\napply simp\napply (elim bexE)\napply (frule f_F1_inv_nat1_map)\napply (frule f_nat1_map_nat1_elem)\napply simp\napply (rule_tac x=y in bexI)\napply simp_all\nunfolding locs_of_def\napply simp\napply (erule conjE)\nnitpick\noops\n\nlemma r_free01_narrow_post: \n  \"F1_inv f1 \\<Longrightarrow> F1_inv f1' \\<Longrightarrow> nat1 s1 \\<Longrightarrow> new0_pre (retr0 f1) s1 \\<Longrightarrow> \n      new1_post f1 s1 f1' r \\<Longrightarrow> new0_post (retr0 f1) s1 (retr0 f1') r\"\nsorry\n(* see IJWv2 narrow post *)\n\nend\n", "meta": {"author": "leouk", "repo": "VDM_Toolkit", "sha": "791013909961d45949fcd96d937ae18f0174c7ec", "save_path": "github-repos/isabelle/leouk-VDM_Toolkit", "path": "github-repos/isabelle/leouk-VDM_Toolkit/VDM_Toolkit-791013909961d45949fcd96d937ae18f0174c7ec/experiments/vdm/Heap/isa/HEAP01ReifyProofs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.32814587438460197}}
{"text": "subsection \\<open>1-out-of-4 OT to GMW\\<close>\n\ntext\\<open>We prove security for the gates of the GMW protocol in the semi honest model. We assume security on\n1-out-of-4 OT.\\<close>\n\ntheory GMW imports\n  Semi_Honest\nbegin\n(*TODO: secret sharing scheme stuff got taken out*)\ndatatype gmw_outputs = Q bool\n\ndatatype inputs_ot12 = M2 \"(bool \\<times> bool)\" | C1 bool\n\ndatatype outputs_ot = P bool | U unit\n\nfun K where \"K (P x) = Q x\"\n\nfun xor :: \"outputs_ot \\<Rightarrow> outputs_ot \\<Rightarrow> bool\"\n  where \"xor (P a) (P b) = a \\<oplus> b\"\n\nfun f_ot12 :: \"inputs_ot12 list \\<Rightarrow> (outputs_ot list)\"\n  where \"f_ot12 [M2 (m0,m1), C1 \\<sigma>] =  [U (), if \\<sigma> then (P m1) else (P m0)]\"\n\nfun valid_inputs_ot12 :: \"inputs_ot12 list \\<Rightarrow> bool\"\n  where \"valid_inputs_ot12 [M2 (b0, b1), C1 \\<sigma>] = True\" \n\ndatatype inputs_ot14 = M4 \"(bool \\<times> bool \\<times> bool \\<times> bool)\" | C2 \"(bool \\<times> bool)\"\n\nfun f_ot14 :: \"inputs_ot14 list \\<Rightarrow> (outputs_ot list)\"\n  where \"f_ot14 [M4 (m00, m01, m10, m11), C2 (c0,c1)] \n              = ([U (), if c0 then (if c1 then P (m11) else (P m10)) else (if c1 then (P m01) else (P m00))])\"\n\nfun valid_inputs_ot14 :: \"inputs_ot14 list \\<Rightarrow> bool\"\n  where \"valid_inputs_ot14 [M4 (m00, m01, m10, m11), C2 (c0,c1)] = True\" \n\ntype_synonym share_1 = bool \ntype_synonym share_2 = bool\n\ntype_synonym shares_1 = \"bool list\"\ntype_synonym shares_2 = \"bool list\"\n\ntype_synonym share_wire = \"(share_1 \\<times> share_2)\"\n\ntype_synonym gmw_inputs = \"share_wire\"\n\ntype_synonym input1 = \"bool \\<times> bool \\<times> bool \\<times> bool\"\ntype_synonym input2 = \"bool \\<times> bool\"\ntype_synonym 'ot12_view1' view1 = \"(inputs_ot14 \\<times> (bool \\<times> bool \\<times> bool \\<times> bool \\<times> bool \\<times> bool) \\<times> 'ot12_view1' \\<times> 'ot12_view1' \\<times> 'ot12_view1')\"\ntype_synonym 'ot12_view2' view2 = \"(inputs_ot14 \\<times> (bool \\<times> bool \\<times> bool \\<times> bool) \\<times> 'ot12_view2' \\<times> 'ot12_view2' \\<times> 'ot12_view2')\"\n\nlocale gmw =   ot14: semi_honest_det_correctness f_ot14 protocol_ot14 valid_inputs_ot14 \n  + ot14_1: semi_honest_det_security f_ot14 protocol_ot14 valid_inputs_ot14 0 R1_OT14 S1_OT14 \n  + ot14_2: semi_honest_det_security f_ot14 protocol_ot14 valid_inputs_ot14 1 R2_OT14 S2_OT14\n  for R1_OT14 :: \"inputs_ot14 list \\<Rightarrow> 'ot14_view1 spmf\"\n    and S1_OT14 \n    and R2_OT14 :: \"inputs_ot14 list \\<Rightarrow> 'ot14_view2 spmf\"\n    and  S2_OT14 protocol_ot14\n    +\n  fixes ot14_adv_P1 :: real\n  assumes ot14_advantage_P1: \"ot14_1.advantage [M4 (m00, m01, m10, m11), C2 (c0,c1)] D \\<le> ot14_adv_P1\"\n    and ot14_perfect_security_P2: \"ot14_2.perfect_security [M4 (m00, m01, m10, m11), C2 (c0,c1)]\"\n    and ot14_correct: \"ot14.correctness [M4 (m00, m01, m10, m11), C2 (c0,c1)]\"\nbegin\n\nlemma ot14_correct_unfold: \"\\<forall> c0 c1 m00 m01 m10 m11. protocol_ot14 [M4 (m00, m01, m10, m11), C2 (c0,c1)] =  return_spmf (f_ot14 [M4 (m00, m01, m10, m11), C2 (c0,c1)])\"\n  using ot14_correct unfolding ot14.correctness_def by auto\n\nlemma inf_th_14_OT_P4: \"ot14_2.real_view [M4 (m00, m01, m10, m11), C2 (c0,c1)] = (return_spmf (f_ot14 [M4 (m00, m01, m10, m11), C2 (c0,c1)]) \\<bind> (\\<lambda> outputs_ot. ot14_2.ideal_view (C2 (c0,c1)) (nth outputs_ot 1)))\" \n  using ot14_perfect_security_P2[unfolded ot14_2.perfect_security_def] by auto\n\nlemma ass_adv_14_OT: \"\\<bar>spmf (bind_spmf (ot14_1.ideal_view (M4 (m00, m01, m10, m11)) (U())) (\\<lambda> view. (D view))) True - \n                    spmf (bind_spmf (ot14_1.real_view [M4 (m00, m01, m10, m11), C2 (c0,c1)]) (\\<lambda> view. (D view))) True \\<bar> \\<le> ot14_adv_P1\"\n  using ot14_advantage_P1 unfolding ot14_1.advantage_def \n  by (simp add: abs_minus_commute)\n\ntext \\<open>The sharing scheme\\<close>\n\ndefinition share :: \"bool \\<Rightarrow> share_wire spmf\"\n  where \"share x = do {\n    a\\<^sub>1 \\<leftarrow> coin_spmf;\n    let b\\<^sub>1 = x \\<oplus> a\\<^sub>1;\n    return_spmf (a\\<^sub>1, b\\<^sub>1)}\" \n\nlemma lossless_share [simp]: \"lossless_spmf (share x)\" \n  by(simp add: share_def)\n\ndefinition reconstruct :: \"(share_1 \\<times> share_2) \\<Rightarrow> bool spmf\"\n  where \"reconstruct shares = do {\n    let (a,b) = shares;\n    return_spmf (a \\<oplus> b)}\"\n\nlemma lossless_reconstruct [simp]: \"lossless_spmf (reconstruct s)\" \n  by(simp add: reconstruct_def split_def)\n\nlemma reconstruct_share : \"(bind_spmf (share x) reconstruct) = (return_spmf x)\"\nproof-\n  have \"y = (y = x) = x\" for y by auto\n  thus ?thesis \n    by(auto simp add: share_def reconstruct_def bind_spmf_const eq_commute)  \nqed\n\nlemma \"(reconstruct (s1,s2) \\<bind> (\\<lambda> rec. share rec \\<bind> (\\<lambda> shares. reconstruct shares))) = return_spmf (s1 \\<oplus> s2)\"\n  apply(simp add: reconstruct_share reconstruct_def share_def)\n  apply(cases s1; cases s2) by(auto simp add: bind_spmf_const)\n\ndefinition xor_evaluate ::  \"bool \\<Rightarrow> bool \\<Rightarrow> bool spmf\"\n  where \"xor_evaluate A B = return_spmf (A \\<oplus> B)\"\n\nfun xor_funct :: \"share_wire list \\<Rightarrow> bool list\"\n  where \"xor_funct [A,B] = do {\n    let (a1, b1) = A;\n    let (a2, b2) = B;\n    [a1 \\<oplus> a2, b1 \\<oplus> b2]}\"\n\nfun xor_protocol :: \"share_wire list \\<Rightarrow> bool list spmf\"\n  where \"xor_protocol [A,B] = do {\n    let (a1, b1) = A;\n    let (a2, b2) = B;\n    return_spmf ([a1 \\<oplus> a2, b1 \\<oplus> b2])}\"\n\nfun valid_inptuts_xor where \"valid_inptuts_xor [(a1, b1),(a2,b2)] = True\"\n\nlemma share_xor_reconstruct: \n  shows \"share x \\<bind> (\\<lambda> w1. share y \\<bind> (\\<lambda> w2. xor_protocol [w1, w2] \n              \\<bind> (\\<lambda> outputs. reconstruct (nth outputs 0, nth outputs 1)))) = xor_evaluate x y\"\nproof-\n  have \"(ya = (\\<not> yb)) = ((x = (\\<not> ya)) = (y = (\\<not> yb))) = (x = (\\<not> y))\" for ya yb\n    by auto\n  then show ?thesis\n    by(simp add: share_def reconstruct_def xor_evaluate_def bind_spmf_const)\nqed\n\nfun R1_xor :: \"share_wire list \\<Rightarrow> (bool \\<times> bool) spmf\"\n  where \"R1_xor [A, B] = return_spmf A\"\n\ndefinition S1_xor :: \"share_wire \\<Rightarrow> bool \\<Rightarrow> (bool \\<times> bool) spmf\"\n  where \"S1_xor A out  = return_spmf A\"\n\nfun  R2_xor :: \"share_wire list \\<Rightarrow> (bool \\<times> bool) spmf\"\n  where \"R2_xor [A, B] = return_spmf B\"\n\ndefinition S2_xor :: \"share_wire \\<Rightarrow> bool \\<Rightarrow> (bool \\<times> bool) spmf\"\n  where \"S2_xor B out  = return_spmf B\"\n\nlemma lossless_S2_xor: \"lossless_spmf (S2_xor A out)\" \n  by(simp add: S2_xor_def)\n\nsublocale gmw_xor_correct: semi_honest_det_correctness xor_funct xor_protocol valid_inptuts_xor .\n\ntheorem correct_xor: \"gmw_xor_correct.correctness [A,B]\"\n  unfolding gmw_xor_correct.correctness_def \n  by (simp add: split_def) \n\nsublocale gmw_xor_1: semi_honest_det_security xor_funct xor_protocol valid_inptuts_xor 0 R1_xor S1_xor .\n\nsublocale gmw_xor_2: semi_honest_det_security xor_funct xor_protocol valid_inptuts_xor 1 R2_xor S2_xor .\n\nlemma \"gmw_xor_1.perfect_security [s1, s2]\"\n  using gmw_xor_1.perfect_security_def  \n  by (simp add: S1_xor_def gmw_xor_1.ideal_view_def gmw_xor_1.real_view_def)\n\nlemma \"gmw_xor_2.perfect_security [s1, s2]\"\n  using gmw_xor_2.perfect_security_def[of \"[s1, s2]\"]\n  by (auto simp add: split_def S2_xor_def gmw_xor_2.ideal_view_def gmw_xor_2.real_view_def semi_honest_det_security.real_view_def)\n\nfun and_funct :: \"share_wire list \\<Rightarrow> (gmw_outputs list) spmf\"\n  where \"and_funct [A, B] = do {\n    let (a1, a2) = A;\n    let (b1,b2) = B;\n    \\<sigma> \\<leftarrow> coin_spmf;\n    return_spmf ([Q \\<sigma>, Q(\\<sigma> \\<oplus> ((a1 \\<oplus> b1) \\<and> (a2 \\<oplus> b2)))])}\"\n\nfun valid_inputs_and where \"valid_inputs_and [A, B] = True\"\n\ndefinition and_evaluate :: \"bool \\<Rightarrow> bool \\<Rightarrow> bool spmf\"\n  where \"and_evaluate A B  = return_spmf (A \\<and> B)\"\n\nfun and_protocol :: \"share_wire list \\<Rightarrow> (gmw_outputs list) spmf\"\n  where \"and_protocol [A, B] = do {\n    let (a1, b1) = A;\n    let (a2,b2) = B;\n    \\<sigma> :: bool \\<leftarrow> coin_spmf;\n    let s0 = \\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (b1 \\<oplus> False));   \n    let s1 = \\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (b1 \\<oplus> True));   \n    let s2 = \\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (b1 \\<oplus> False));   \n    let s3 = \\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (b1 \\<oplus> True)); \n    outputs :: outputs_ot list \\<leftarrow> protocol_ot14 [M4 (s0,s1,s2,s3), C2 (a2,b2)];\n    return_spmf ([Q \\<sigma>, K (nth outputs 1)])}\" \n\nlemma and_correct: \"and_protocol [(a1, b1), (a2,b2)] = and_funct [(a1, b1), (a2,b2)]\"\n  apply(auto simp add: ot14_correct) \n  by(cases b2 ; cases b1; cases a1; cases a2; auto simp add:  ot14_correct_unfold) \n\nfun  and_R1 :: \"gmw_inputs list \\<Rightarrow> (( bool \\<times> 'ot14_view1)) spmf\"\n  where \"and_R1 [A, B] = do {\n    let (a1, a2) = A;\n    let (b1,b2) = B;\n    \\<sigma> \\<leftarrow> coin_spmf;\n    let s0 = \\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False));   \n    let s1 = \\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True));   \n    let s2 = \\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False));   \n    let s3 = \\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True)); \n    V :: 'ot14_view1 \\<leftarrow> R1_OT14 [M4 (s0,s1,s2,s3), C2 (b1,b2)];\n    return_spmf ((\\<sigma>, V))}\"\n\nfun and_outputs_1 :: \"gmw_inputs list \\<Rightarrow> (bool \\<times> 'ot14_view1) \\<Rightarrow> (gmw_outputs list) spmf\"\n  where \"and_outputs_1 [A, B] view = do {\n            let (\\<sigma>, v) = view;\n            let (a1, a2) = A;\n            let (b1,b2) = B;\n            let s0 = \\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False));   \n            let s1 = \\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True));   \n            let s2 = \\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False));   \n            let s3 = \\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True)); \n            outputs :: outputs_ot list \\<leftarrow> protocol_ot14 [M4 (s0,s1,s2,s3), C2 (b1,b2)];\n            return_spmf ([Q \\<sigma>, K (nth outputs 1)])}\" \n\nfun and_outputs_2 :: \"gmw_inputs list \\<Rightarrow> ('ot14_view2 \\<times> bool) \\<Rightarrow> (gmw_outputs list) spmf\"\n  where \"and_outputs_2 [A, B] view = do {\n            let (v, s) = view;\n            let (a1, a2) = A;\n            let (b1,b2) = B;\n            let \\<sigma> = s \\<oplus> ((a1 \\<oplus> b1) \\<and> (a2 \\<oplus> b2));\n            return_spmf ([Q \\<sigma>, Q s])}\"\n\nfun S1_and :: \"gmw_inputs \\<Rightarrow> gmw_outputs \\<Rightarrow> ((bool \\<times> 'ot14_view1)) spmf\"\n  where \"S1_and A (Q \\<sigma>) = do {\n    let (a1,a2) = A;\n    let s0 = \\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False));   \n    let s1 = \\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True));   \n    let s2 = \\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False));   \n    let s3 = \\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True)); \n    V \\<leftarrow> S1_OT14 (M4 (s0,s1,s2,s3)) (U ());\n    return_spmf (\\<sigma>, V)}\"\n\nsublocale gmw_and_1: semi_honest_prob 0 and_funct and_outputs_1 and_R1 S1_and valid_inputs_and  .\n\nlemma sec_ex_P1_and: \n  shows \"\\<exists> (A :: (inputs_ot14 \\<times> 'ot14_view1) \\<Rightarrow> bool \\<Rightarrow> bool spmf).\n          \\<bar>spmf ((gmw_and_1.real_view [(a1,a2),(b1,b2)]) \\<bind> D) True - spmf ((gmw_and_1.ideal_view [(a1,a2),(b1,b2)] \n            \\<bind> (D :: ((bool \\<times> bool) \\<times> (bool \\<times> 'ot14_view1) \\<times> gmw_outputs list) \\<Rightarrow> bool spmf))) True\\<bar> =\n              \\<bar>spmf (coin_spmf \\<bind> (\\<lambda> \\<sigma> :: bool. ot14_1.real_view [(M4 ((\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True))))), (C2 (b1, b2))] \n                    \\<bind> (\\<lambda> view. A view \\<sigma>))) True - spmf (coin_spmf \\<bind> (\\<lambda> \\<sigma>. ot14_1.ideal_view (M4((\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True))))) (U ()) \n                \\<bind>  (\\<lambda> view. A view \\<sigma>))) True \\<bar>\"\n  including monad_normalisation\nproof-\n  define A' :: \"((inputs_ot14 \\<times> 'ot14_view1)) \\<Rightarrow> bool \\<Rightarrow> bool spmf\" \n    where \"A' == \\<lambda> (inputs, view) \\<sigma>.  (D ((a1,a2), (\\<sigma>, view), [Q \\<sigma>, Q (\\<sigma> \\<oplus> ((a1 \\<oplus> b1) \\<and> (a2 \\<oplus> b2)))]))\" \n  have \"\\<bar>spmf ((gmw_and_1.real_view [(a1,a2),(b1,b2)]) \\<bind> (D)) True - spmf ((gmw_and_1.ideal_view [(a1,a2),(b1,b2)]  \n          \\<bind> (D))) True\\<bar> =\n              \\<bar>spmf (coin_spmf \\<bind> (\\<lambda> \\<sigma>. ot14_1.real_view [M4((\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True)))), C2 (b1, b2)] \n                  \\<bind> (\\<lambda> view. A' view \\<sigma>))) True - spmf (coin_spmf \\<bind> (\\<lambda> \\<sigma>. ot14_1.ideal_view ((M4 ((\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True)))))) (U ()) \n                \\<bind>  (\\<lambda> view. A' view \\<sigma>))) True\\<bar>\"\n    by(auto simp add: ot14_1.real_view_def ot14_1.ideal_view_def semi_honest_prob.ideal_view_def gmw_and_1.real_view_def  A'_def   Let_def split_def ot14_correct_unfold ; cases a1; cases a2; cases b1; cases b2; auto)\n    then show ?thesis by auto\nqed\n\nlemma bound_14_OT:\n  \"\\<bar>spmf (coin_spmf \\<bind> (\\<lambda> \\<sigma>. ot14_1.real_view [M4 ((\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True)))), C2 (b1, b2)] \n              \\<bind> (\\<lambda> view. A view \\<sigma>))) True - spmf (coin_spmf \\<bind> (\\<lambda> \\<sigma>. ot14_1.ideal_view (M4 ((\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True))))) (U ()) \n        \\<bind>  (\\<lambda> view. (A :: (inputs_ot14 \\<times> 'ot14_view1) \\<Rightarrow> bool \\<Rightarrow> bool spmf) view \\<sigma>))) True\\<bar> \\<le> ot14_adv_P1\"\n  (is \"?lhs \\<le> ot14_adv_P1\")\nproof-\n  have int1: \"integrable (measure_spmf coin_spmf) (\\<lambda>x. spmf (ot14_1.ideal_view (M4 (x \\<oplus> (a1 \\<oplus> False \\<and> a2 \\<oplus> False), x \\<oplus> (a1 \\<oplus> False \\<and> a2 \\<oplus> True), x \\<oplus> (a1 \\<oplus> True \\<and> a2 \\<oplus> False), x \\<oplus> (a1 \\<oplus> True \\<and> a2 \\<oplus> True))) (U ()) \\<bind> (\\<lambda>view. A view x)) True)\"\n    and int2: \"integrable (measure_spmf coin_spmf) (\\<lambda>x. spmf (ot14_1.real_view [M4 (x \\<oplus> (a1 \\<oplus> False \\<and> a2 \\<oplus> False), x \\<oplus> (a1 \\<oplus> False \\<and> a2 \\<oplus> True), x \\<oplus> (a1 \\<oplus> True \\<and> a2 \\<oplus> False), x \\<oplus> (a1 \\<oplus> True \\<and> a2 \\<oplus> True)), C2 (b1, b2)] \\<bind> (\\<lambda>view. A view x)) True)\"\n    by(rule measure_spmf.integrable_const_bound[where B=1]; simp add: pmf_le_1)+\n  have \"?lhs = \\<bar>LINT x|measure_spmf coin_spmf.\n        spmf (ot14_1.ideal_view (M4 (x \\<oplus> (a1 \\<oplus> False \\<and> a2 \\<oplus> False), x \\<oplus> (a1 \\<oplus> False \\<and> a2 \\<oplus> True), x \\<oplus> (a1 \\<oplus> True \\<and> a2 \\<oplus> False), x \\<oplus> (a1 \\<oplus> True \\<and> a2 \\<oplus> True))) (U ()) \\<bind> (\\<lambda>view. A view x)) True -\n        spmf (ot14_1.real_view [(M4 (x \\<oplus> (a1 \\<oplus> False \\<and> a2 \\<oplus> False), x \\<oplus> (a1 \\<oplus> False \\<and> a2 \\<oplus> True), x \\<oplus> (a1 \\<oplus> True \\<and> a2 \\<oplus> False), x \\<oplus> (a1 \\<oplus> True \\<and> a2 \\<oplus> True))), C2 (b1, b2)] \\<bind> (\\<lambda>view. A view x)) True\\<bar>\"\n    apply(subst (1 2) spmf_bind) using int1 int2 by simp\n  also have \"... \\<le> LINT x|measure_spmf coin_spmf. \\<bar>spmf (ot14_1.ideal_view (M4 (x = (a1 \\<longrightarrow> \\<not> a2), x = (a1 \\<longrightarrow> a2), x = (a1 \\<or> \\<not> a2), x = (a1 \\<or> a2))) (U ()) \\<bind> (\\<lambda>view. A view x)) True \n                - spmf (ot14_1.real_view [M4 (x = (a1 \\<longrightarrow> \\<not> a2), x = (a1 \\<longrightarrow> a2), x = (a1 \\<or> \\<not> a2), x = (a1 \\<or> a2)), C2 (b1, b2)] \\<bind> (\\<lambda>view. A view x)) True\\<bar>\"\n    by(rule integral_abs_bound[THEN order_trans]; simp add: split_beta)\n  ultimately have \"?lhs \\<le> LINT x|measure_spmf coin_spmf. \\<bar>spmf (ot14_1.ideal_view (M4 (x = (a1 \\<longrightarrow> \\<not> a2), x = (a1 \\<longrightarrow> a2), x = (a1 \\<or> \\<not> a2), x = (a1 \\<or> a2))) (U ()) \\<bind> (\\<lambda>view. A view x)) True \n                - spmf (ot14_1.real_view [M4 (x = (a1 \\<longrightarrow> \\<not> a2), x = (a1 \\<longrightarrow> a2), x = (a1 \\<or> \\<not> a2), x = (a1 \\<or> a2)), C2 (b1, b2)] \\<bind> (\\<lambda>view. A view x)) True\\<bar>\"\n    by simp\n  also have \"LINT x|measure_spmf coin_spmf. \\<bar>spmf (ot14_1.ideal_view (M4 (x = (a1 \\<longrightarrow> \\<not> a2), x = (a1 \\<longrightarrow> a2), x = (a1 \\<or> \\<not> a2), x = (a1 \\<or> a2))) (U ()) \\<bind> (\\<lambda>view. A view x)) True \n                - spmf (ot14_1.real_view [M4 (x = (a1 \\<longrightarrow> \\<not> a2), x = (a1 \\<longrightarrow> a2), x = (a1 \\<or> \\<not> a2), x = (a1 \\<or> a2)), C2 (b1, b2)] \\<bind> (\\<lambda>view. A view x)) True\\<bar> \\<le> ot14_adv_P1\"\n    apply(rule integral_mono[THEN order_trans]) \n       apply(rule measure_spmf.integrable_const_bound[where B=2])\n        apply clarsimp\n        apply(rule abs_triangle_ineq4[THEN order_trans])\n        apply(cases a1) apply(cases a2) \n    subgoal for M\n      using pmf_le_1[of \"ot14_1.real_view [M4 (\\<not> M, M, M, M), C2 (b1,b2)] \\<bind>  (\\<lambda> view. A view M)\" \"Some True\"]\n        pmf_le_1[of \"ot14_1.ideal_view (M4 (\\<not> M, M, M, M)) (U ()) \\<bind>  (\\<lambda> view. A view M)\" \"Some True\"] \n      by simp\n    subgoal for M \n      using pmf_le_1[of \"ot14_1.real_view [M4 (M, \\<not> M, M, M), C2 (b1,b2)] \\<bind>  (\\<lambda> view. A view M)\" \"Some True\"] \n        pmf_le_1[of \"ot14_1.ideal_view (M4 (M, \\<not> M, M, M)) (U ()) \\<bind>  (\\<lambda> view. A view M)\" \"Some True\"] \n      by simp\n        apply(cases a2) apply(auto)\n    subgoal for M\n      using pmf_le_1[of \"ot14_1.real_view [M4 (M, M, \\<not> M, M), C2 (b1,b2)] \\<bind>  (\\<lambda> view. A view M)\" \"Some True\"] \n        pmf_le_1[of \"ot14_1.ideal_view (M4 (M, M, \\<not> M, M)) (U ()) \\<bind>  (\\<lambda> view. A view M)\" \"Some True\"] \n      by(simp)\n    subgoal for M\n      using pmf_le_1[of \"ot14_1.real_view [M4 (M, M, M, \\<not> M), C2 (b1,b2)] \\<bind>  (\\<lambda> view. A view M)\" \"Some True\"] \n        pmf_le_1[of \"ot14_1.ideal_view (M4 (M, M, M, \\<not> M)) (U ()) \\<bind>  (\\<lambda> view. A view M)\" \"Some True\"] \n      by(simp)\n    using ass_adv_14_OT by fast\n  ultimately show ?thesis by simp\nqed\n\nlemma and_advantage_P1:\n  shows \"gmw_and_1.advantage [(a1,a2),(b1,b2)] D \\<le> ot14_adv_P1\"\nproof-\n  obtain A :: \"(inputs_ot14 \\<times> 'ot14_view1) \\<Rightarrow> bool \\<Rightarrow> bool spmf\" where \"\\<bar>spmf ((gmw_and_1.real_view [(a1,a2),(b1,b2)]) \\<bind> D) True - spmf ((gmw_and_1.ideal_view [(a1,a2),(b1,b2)] \n            \\<bind> (D :: ((bool \\<times> bool) \\<times> (bool \\<times> 'ot14_view1) \\<times> gmw_outputs list) \\<Rightarrow> bool spmf))) True\\<bar> =\n              \\<bar>spmf (coin_spmf \\<bind> (\\<lambda> \\<sigma>. ot14_1.real_view [(M4 ((\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True))))), (C2 (b1, b2))] \n                    \\<bind> (\\<lambda> view. A view \\<sigma>))) True - spmf (coin_spmf \\<bind> (\\<lambda> \\<sigma>. ot14_1.ideal_view (M4((\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False))), (\\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True))))) (U ()) \n                \\<bind>  (\\<lambda> view. A view \\<sigma>))) True\\<bar>\"\n    using sec_ex_P1_and by blast \n  thus ?thesis \n  unfolding gmw_and_1.advantage_def gmw_and_1.real_view_def gmw_and_1.ideal_view_def using sec_ex_P1_and bound_14_OT by auto\nqed\n\nfun and_R2 :: \"gmw_inputs list \\<Rightarrow> ('ot14_view2 \\<times> bool) spmf\"\n  where \"and_R2 [A, B] = do {\n    let (a1, a2) = A;\n    let (c0,c1) = B;\n    \\<sigma> \\<leftarrow> coin_spmf;\n    let m00 = \\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> False));   \n    let m01 = \\<sigma> \\<oplus> ((a1 \\<oplus> False) \\<and> (a2 \\<oplus> True));   \n    let m10 = \\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> False));   \n    let m11 = \\<sigma> \\<oplus> ((a1 \\<oplus> True) \\<and> (a2 \\<oplus> True)); \n    V :: 'ot14_view2 \\<leftarrow> R2_OT14 [M4 (m00,m01,m10,m11), C2 B];\n    let s = (if c0 then (if c1 then (m11) else (m10)) else (if c1 then (m01) else (m00)));\n    return_spmf (V, s)}\"\n\nfun S2_and :: \"gmw_inputs \\<Rightarrow> gmw_outputs \\<Rightarrow> ('ot14_view2 \\<times> bool) spmf\"\n  where \"S2_and B (Q s2) =  do {\n    let (b1,b2) = B;\n    V :: 'ot14_view2 \\<leftarrow> S2_OT14 (C2 B) (P s2);\n    return_spmf (V, s2)}\"\n\nsublocale gmw_and_2: semi_honest_prob 1 and_funct and_outputs_2 and_R2 S2_and valid_inputs_and .\n\nlemma 1: \" R2_OT14 [M4 (m00, m01, m10, m11), C2 (c0, c1)] \n              = return_spmf (f_ot14 [M4 (m00, m01, m10, m11), C2 (c0, c1)]) \n                  \\<bind> (\\<lambda> outputs. S2_OT14 (C2 (c0, c1)) (outputs ! 1))\"\n  using ot14_perfect_security_P2[of m00 m01 m10  m11 c0 c1] \n using ot14_2.views_equal_all by auto \n\nlemma and_perfect_security_P2:\n  shows \"gmw_and_2.perfect_security [(a1,a2),(b1,b2)]\"\n  unfolding gmw_and_2.perfect_security_def gmw_and_2.real_view_def gmw_and_2.ideal_view_def\n  apply(auto simp add: Let_def)    \n  apply(intro bind_spmf_cong[OF refl]; clarsimp?)+ using 1\n  by(cases b1;cases b2; cases a1; cases a2; auto)\n \nend \n\nlocale gmw_asym = \n  fixes R1_OT14 :: \"nat \\<Rightarrow> inputs_ot14 list \\<Rightarrow> 'ot14_view1 spmf\"\n    and S1_OT14 :: \"nat \\<Rightarrow> inputs_ot14 \\<Rightarrow> outputs_ot \\<Rightarrow> 'ot14_view1 spmf\"\n    and R2_OT14 :: \"nat \\<Rightarrow> inputs_ot14 list \\<Rightarrow> 'ot14_view2 spmf\"\n    and S2_OT14 :: \"nat \\<Rightarrow> inputs_ot14 \\<Rightarrow> outputs_ot \\<Rightarrow> 'ot14_view2 spmf\"\n    and protocol_ot14 :: \"nat \\<Rightarrow> inputs_ot14 list \\<Rightarrow> outputs_ot list spmf\"\n    and ot14_adv_P1 :: \"nat \\<Rightarrow> real\"\n  assumes gmw: \"\\<And> (n::nat). gmw (R1_OT14 n) (S1_OT14 n) (R2_OT14 n) (S2_OT14 n) (protocol_ot14 n) (ot14_adv_P1 n)\"\nbegin \n\nsublocale gmw \"(R1_OT14 n)\" \"(S1_OT14 n)\" \"(R2_OT14 n)\" \"(S2_OT14 n)\" \"(protocol_ot14 n)\" \"(ot14_adv_P1 n)\"\n  by (simp add: gmw)\n\nlemma \"gmw_xor_1.perfect_security [s1, s2]\"\n  unfolding gmw_xor_1.perfect_security_def gmw_xor_1.real_view_def gmw_xor_1.ideal_view_def \n  by(auto simp add: split_def S1_xor_def)\n\nlemma \"gmw_xor_2.perfect_security [s1, s2]\"\n  unfolding gmw_xor_2.perfect_security_def gmw_xor_2.real_view_def gmw_xor_2.ideal_view_def \n  by(auto simp add: split_def S2_xor_def)\n\nlemma and_advantage_P1:\n  assumes \"negligible (\\<lambda> n. ot14_adv_P1 n)\"\n  shows \"negligible (\\<lambda>n.  gmw_and_1.advantage n [(a1,a2),(b1,b2)] D)\"\nproof-\n  have \"gmw_and_1.advantage n [(a1,a2),(b1,b2)] D \\<le> ot14_adv_P1 n\" \n    for n \n    by (simp add: and_advantage_P1)\n  thus ?thesis \n    using assms gmw_and_1.advantage_def negligible_le by auto\nqed\n\nlemma \"gmw_and_2.perfect_security n [(a1,a2),(b1,b2)]\"\n  by(rule and_perfect_security_P2)\n\n\nend\n\nend\n\n\n", "meta": {"author": "Davetbutler", "repo": "Privacy-ID", "sha": "a9d67b9ef02dea9ae51e5c6de8630666c4d0a148", "save_path": "github-repos/isabelle/Davetbutler-Privacy-ID", "path": "github-repos/isabelle/Davetbutler-Privacy-ID/Privacy-ID-a9d67b9ef02dea9ae51e5c6de8630666c4d0a148/Multi_Party_Computation/GMW.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.32814587438460197}}
{"text": "(* \n    This file is a part of IsarMathLib - \n    a library of formalized mathematics written for Isabelle/Isar.\n\n    Copyright (C) 2013 Daniel de la Concepcion\n\n    This program is free software; Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED \nWARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF \nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. \nIN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, \nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, \nPROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; \nOR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, \nWHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR \nOTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, \nEVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *)\n\nsection \\<open>Topology 11\\<close>\n\ntheory Topology_ZF_11 imports Topology_ZF_7 Finite_ZF_1\n\nbegin\n\ntext\\<open>This file deals with order topologies. The order topology\nis already defined in @{file \"Topology_ZF_examples_1.thy\"}.\\<close>\n\nsubsection\\<open>Order topologies\\<close>\n\ntext\\<open>We will assume\nmost of the time that the ordered set has more than one point.\nIt is natural to think that the topological properties\ncan be translated to properties of the order; since every\norder rises one and only one topology in a set.\\<close>\n\nsubsection\\<open>Separation properties\\<close>\n\ntext\\<open>Order topologies have a lot of separation properties.\\<close>\n\ntext\\<open>Every order topology is Hausdorff.\\<close>\n\ntheorem order_top_T2:\n  assumes \"IsLinOrder(X,r)\" \"\\<exists>x y. x\\<noteq>y\\<and>x\\<in>X\\<and>y\\<in>X\"\n  shows \"(OrdTopology X r){is T\\<^sub>2}\"\nproof-\n  {\n    fix x y assume A1:\"x\\<in>\\<Union>(OrdTopology X r)\"\"y\\<in>\\<Union>(OrdTopology X r)\"\"x\\<noteq>y\"\n    then have AS:\"x\\<in>X\"\"y\\<in>X\"\"x\\<noteq>y\" using union_ordtopology[OF assms(1) assms(2)] by auto\n    {\n      assume A2:\"\\<exists>z\\<in>X-{x,y}. (\\<langle>x,y\\<rangle>\\<in>r\\<longrightarrow>\\<langle>x,z\\<rangle>\\<in>r\\<and>\\<langle>z,y\\<rangle>\\<in>r)\\<and>(\\<langle>y,x\\<rangle>\\<in>r\\<longrightarrow>\\<langle>y,z\\<rangle>\\<in>r\\<and>\\<langle>z,x\\<rangle>\\<in>r)\"\n      from AS(1,2) assms(1) have \"\\<langle>x,y\\<rangle>\\<in>r\\<or>\\<langle>y,x\\<rangle>\\<in>r\" unfolding IsLinOrder_def IsTotal_def by auto moreover\n      {\n        assume \"\\<langle>x,y\\<rangle>\\<in>r\"\n        with AS A2 obtain z where z:\"\\<langle>x,z\\<rangle>\\<in>r\"\"\\<langle>z,y\\<rangle>\\<in>r\"\"z\\<in>X\"\"z\\<noteq>x\"\"z\\<noteq>y\" by auto\n        with AS(1,2) have \"x\\<in>LeftRayX(X,r,z)\"\"y\\<in>RightRayX(X,r,z)\" unfolding LeftRayX_def RightRayX_def\n          by auto moreover\n        have \"LeftRayX(X,r,z)\\<inter>RightRayX(X,r,z)=0\" using inter_lray_rray[OF z(3) z(3) assms(1)]\n          unfolding IntervalX_def using Order_ZF_2_L4[OF total_is_refl _ z(3)] assms(1) unfolding IsLinOrder_def\n          by auto moreover\n        have \"LeftRayX(X,r,z)\\<in>(OrdTopology X r)\"\"RightRayX(X,r,z)\\<in>(OrdTopology X r)\"\n          using z(3) base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]] by auto\n        ultimately have \"\\<exists>U\\<in>(OrdTopology X r). \\<exists>V\\<in>(OrdTopology X r). x\\<in>U \\<and> y\\<in>V \\<and> U\\<inter>V=0\" by auto\n      }\n      moreover\n      {\n        assume \"\\<langle>y,x\\<rangle>\\<in>r\"\n        with AS A2 obtain z where z:\"\\<langle>y,z\\<rangle>\\<in>r\"\"\\<langle>z,x\\<rangle>\\<in>r\"\"z\\<in>X\"\"z\\<noteq>x\"\"z\\<noteq>y\" by auto\n        with AS(1,2) have \"y\\<in>LeftRayX(X,r,z)\"\"x\\<in>RightRayX(X,r,z)\" unfolding LeftRayX_def RightRayX_def\n          by auto moreover\n        have \"LeftRayX(X,r,z)\\<inter>RightRayX(X,r,z)=0\" using inter_lray_rray[OF z(3) z(3) assms(1)]\n          unfolding IntervalX_def using Order_ZF_2_L4[OF total_is_refl _ z(3)] assms(1) unfolding IsLinOrder_def\n          by auto moreover\n        have \"LeftRayX(X,r,z)\\<in>(OrdTopology X r)\"\"RightRayX(X,r,z)\\<in>(OrdTopology X r)\"\n          using z(3) base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]] by auto\n        ultimately have \"\\<exists>U\\<in>(OrdTopology X r). \\<exists>V\\<in>(OrdTopology X r). x\\<in>U \\<and> y\\<in>V \\<and> U\\<inter>V=0\" by auto\n      }\n      ultimately have \"\\<exists>U\\<in>(OrdTopology X r). \\<exists>V\\<in>(OrdTopology X r). x\\<in>U \\<and> y\\<in>V \\<and> U\\<inter>V=0\" by auto\n    }\n    moreover\n    {\n      assume A2:\"\\<forall>z\\<in>X - {x, y}. (\\<langle>x, y\\<rangle> \\<in> r \\<and> (\\<langle>x, z\\<rangle> \\<notin> r \\<or> \\<langle>z, y\\<rangle> \\<notin> r)) \\<or> (\\<langle>y, x\\<rangle> \\<in> r \\<and> (\\<langle>y, z\\<rangle> \\<notin> r \\<or> \\<langle>z, x\\<rangle> \\<notin> r))\"\n      from AS(1,2) assms(1) have disj:\"\\<langle>x,y\\<rangle>\\<in>r\\<or>\\<langle>y,x\\<rangle>\\<in>r\" unfolding IsLinOrder_def IsTotal_def by auto moreover\n      {\n        assume TT:\"\\<langle>x,y\\<rangle>\\<in>r\"\n        with AS assms(1) have T:\"\\<langle>y,x\\<rangle>\\<notin>r\" unfolding IsLinOrder_def antisym_def by auto\n        from TT AS(1-3) have \"x\\<in>LeftRayX(X,r,y)\"\"y\\<in>RightRayX(X,r,x)\" unfolding LeftRayX_def RightRayX_def\n          by auto moreover\n        {\n          fix z assume \"z\\<in>LeftRayX(X,r,y)\\<inter>RightRayX(X,r,x)\"\n          then have \"\\<langle>z,y\\<rangle>\\<in>r\"\"\\<langle>x,z\\<rangle>\\<in>r\"\"z\\<in>X-{x,y}\" unfolding RightRayX_def LeftRayX_def by auto\n          with A2 T have \"False\" by auto\n        }\n        then have \"LeftRayX(X,r,y)\\<inter>RightRayX(X,r,x)=0\" by auto moreover\n        have \"LeftRayX(X,r,y)\\<in>(OrdTopology X r)\"\"RightRayX(X,r,x)\\<in>(OrdTopology X r)\"\n          using base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]] AS by auto\n        ultimately have \"\\<exists>U\\<in>(OrdTopology X r). \\<exists>V\\<in>(OrdTopology X r). x\\<in>U \\<and> y\\<in>V \\<and> U\\<inter>V=0\" by auto\n      }\n      moreover\n      {\n        assume TT:\"\\<langle>y,x\\<rangle>\\<in>r\"\n        with AS assms(1) have T:\"\\<langle>x,y\\<rangle>\\<notin>r\" unfolding IsLinOrder_def antisym_def by auto\n        from TT AS(1-3) have \"y\\<in>LeftRayX(X,r,x)\"\"x\\<in>RightRayX(X,r,y)\" unfolding LeftRayX_def RightRayX_def\n          by auto moreover\n        {\n          fix z assume \"z\\<in>LeftRayX(X,r,x)\\<inter>RightRayX(X,r,y)\"\n          then have \"\\<langle>z,x\\<rangle>\\<in>r\"\"\\<langle>y,z\\<rangle>\\<in>r\"\"z\\<in>X-{x,y}\" unfolding RightRayX_def LeftRayX_def by auto\n          with A2 T have \"False\" by auto\n        }\n        then have \"LeftRayX(X,r,x)\\<inter>RightRayX(X,r,y)=0\" by auto moreover\n        have \"LeftRayX(X,r,x)\\<in>(OrdTopology X r)\"\"RightRayX(X,r,y)\\<in>(OrdTopology X r)\"\n          using base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]] AS by auto\n        ultimately have \"\\<exists>U\\<in>(OrdTopology X r). \\<exists>V\\<in>(OrdTopology X r). x\\<in>U \\<and> y\\<in>V \\<and> U\\<inter>V=0\" by auto\n      }\n      ultimately have \"\\<exists>U\\<in>(OrdTopology X r). \\<exists>V\\<in>(OrdTopology X r). x\\<in>U \\<and> y\\<in>V \\<and> U\\<inter>V=0\" by auto\n    }\n    ultimately have \"\\<exists>U\\<in>(OrdTopology X r). \\<exists>V\\<in>(OrdTopology X r). x\\<in>U \\<and> y\\<in>V \\<and> U\\<inter>V=0\" by auto\n  }\n  then show ?thesis unfolding isT2_def by auto\nqed\n\ntext\\<open>Every order topology is $T_4$, but the proof needs lots of machinery.\nAt the end of the file, we will prove that every order topology is normal; sooner\nor later.\\<close>\n\nsubsection\\<open>Connectedness properties\\<close>\n\ntext\\<open>Connectedness is related to two properties of orders: completeness and density\\<close>\n\ntext\\<open>Some order-dense properties:\\<close>\n\ndefinition\n  IsDenseSub (\"_ {is dense in}_{with respect to}_\") where\n  \"A {is dense in}X{with respect to}r \\<equiv> \n  \\<forall>x\\<in>X. \\<forall>y\\<in>X. \\<langle>x,y\\<rangle>\\<in>r \\<and> x\\<noteq>y  \\<longrightarrow> (\\<exists>z\\<in>A-{x,y}. \\<langle>x,z\\<rangle>\\<in>r\\<and>\\<langle>z,y\\<rangle>\\<in>r)\"\n\ndefinition\n  IsDenseUnp (\"_ {is not-properly dense in}_{with respect to}_\") where\n  \"A {is not-properly dense in}X{with respect to}r \\<equiv> \n  \\<forall>x\\<in>X. \\<forall>y\\<in>X. \\<langle>x,y\\<rangle>\\<in>r \\<and> x\\<noteq>y  \\<longrightarrow> (\\<exists>z\\<in>A. \\<langle>x,z\\<rangle>\\<in>r\\<and>\\<langle>z,y\\<rangle>\\<in>r)\"\n\ndefinition\n  IsWeaklyDenseSub (\"_ {is weakly dense in}_{with respect to}_\") where\n  \"A {is weakly dense in}X{with respect to}r \\<equiv> \n  \\<forall>x\\<in>X. \\<forall>y\\<in>X. \\<langle>x,y\\<rangle>\\<in>r \\<and> x\\<noteq>y  \\<longrightarrow> ((\\<exists>z\\<in>A-{x,y}. \\<langle>x,z\\<rangle>\\<in>r\\<and>\\<langle>z,y\\<rangle>\\<in>r)\\<or> IntervalX(X,r,x,y)=0)\"\n\ndefinition\n  IsDense (\"_ {is dense with respect to}_\") where\n  \"X {is dense with respect to}r \\<equiv> \n  \\<forall>x\\<in>X. \\<forall>y\\<in>X. \\<langle>x,y\\<rangle>\\<in>r \\<and> x\\<noteq>y  \\<longrightarrow> (\\<exists>z\\<in>X-{x,y}. \\<langle>x,z\\<rangle>\\<in>r\\<and>\\<langle>z,y\\<rangle>\\<in>r)\"\n\nlemma dense_sub:\n  shows \"(X {is dense with respect to}r) \\<longleftrightarrow> (X {is dense in}X{with respect to}r)\"\n  unfolding IsDenseSub_def IsDense_def by auto\n\nlemma not_prop_dense_sub:\n  shows \"(A {is dense in}X{with respect to}r) \\<longrightarrow> (A {is not-properly dense in}X{with respect to}r)\"\n  unfolding IsDenseSub_def IsDenseUnp_def by auto\n\ntext\\<open>In densely ordered sets, intervals are infinite.\\<close>\n\ntheorem dense_order_inf_intervals:\n  assumes \"IsLinOrder(X,r)\" \"IntervalX(X, r, b, c)\\<noteq>0\"\"b\\<in>X\"\"c\\<in>X\" \"X{is dense with respect to}r\"\n  shows \"\\<not>Finite(IntervalX(X, r, b, c))\"\nproof\n  assume fin:\"Finite(IntervalX(X, r, b, c))\"\n  have sub:\"IntervalX(X, r, b, c)\\<subseteq>X\" unfolding IntervalX_def by auto\n  have p:\"Minimum(r,IntervalX(X, r, b, c))\\<in>IntervalX(X, r, b, c)\" using Finite_ZF_1_T2(2)[OF assms(1) Finite_Fin[OF fin sub] assms(2)]\n    by auto\n  then have \"\\<langle>b,Minimum(r,IntervalX(X, r, b, c))\\<rangle>\\<in>r\"\"b\\<noteq>Minimum(r,IntervalX(X, r, b, c))\"\n    unfolding IntervalX_def using Order_ZF_2_L1 by auto\n  with assms(3,5) sub p obtain z1 where z1:\"z1\\<in>X\"\"z1\\<noteq>b\"\"z1\\<noteq>Minimum(r,IntervalX(X, r, b, c))\"\"\\<langle>b,z1\\<rangle>\\<in>r\"\"\\<langle>z1,Minimum(r,IntervalX(X, r, b, c))\\<rangle>\\<in>r\"\n    unfolding IsDense_def by blast\n  from p have B:\"\\<langle>Minimum(r,IntervalX(X, r, b, c)),c\\<rangle>\\<in>r\" unfolding IntervalX_def using Order_ZF_2_L1 by auto moreover\n  have \"trans(r)\" using assms(1) unfolding IsLinOrder_def by auto moreover\n  note z1(5) ultimately have z1a:\"\\<langle>z1,c\\<rangle>\\<in>r\" unfolding trans_def by fast\n  {\n    assume \"z1=c\"\n    with B have \"\\<langle>Minimum(r,IntervalX(X, r, b, c)),z1\\<rangle>\\<in>r\" by auto\n    with z1(5) have \"z1=Minimum(r,IntervalX(X, r, b, c))\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n    then have \"False\" using z1(3) by auto\n  }\n  then have \"z1\\<noteq>c\" by auto\n  with z1(1,2,4) z1a have \"z1\\<in>IntervalX(X, r, b, c)\" unfolding IntervalX_def using Order_ZF_2_L1 by auto\n  then have \"\\<langle>Minimum(r,IntervalX(X, r, b, c)),z1\\<rangle>\\<in>r\" using Finite_ZF_1_T2(4)[OF assms(1) Finite_Fin[OF fin sub] assms(2)] by auto\n  with z1(5) have \"z1=Minimum(r,IntervalX(X, r, b, c))\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n  with z1(3) show \"False\" by auto\nqed\n\ntext\\<open>Left rays are infinite.\\<close>\n\ntheorem dense_order_inf_lrays:\n  assumes \"IsLinOrder(X,r)\" \"LeftRayX(X,r,c)\\<noteq>0\"\"c\\<in>X\"  \"X{is dense with respect to}r\"\n  shows \"\\<not>Finite(LeftRayX(X,r,c))\"\nproof-\n  from assms(2) obtain b where \"b\\<in>X\"\"\\<langle>b,c\\<rangle>\\<in>r\"\"b\\<noteq>c\" unfolding LeftRayX_def by auto\n  with assms(3) obtain z where \"z\\<in>X-{b,c}\"\"\\<langle>b,z\\<rangle>\\<in>r\"\"\\<langle>z,c\\<rangle>\\<in>r\" using assms(4) unfolding IsDense_def by auto\n  then have \"IntervalX(X, r, b, c)\\<noteq>0\" unfolding IntervalX_def using Order_ZF_2_L1 by auto\n  then have nFIN:\"\\<not>Finite(IntervalX(X, r, b, c))\" using dense_order_inf_intervals[OF assms(1) _ _ assms(3,4)]\n    \\<open>b\\<in>X\\<close> by auto\n  {\n    fix d assume \"d\\<in>IntervalX(X, r, b, c)\"\n    then have \"\\<langle>b,d\\<rangle>\\<in>r\"\"\\<langle>d,c\\<rangle>\\<in>r\"\"d\\<in>X\"\"d\\<noteq>b\"\"d\\<noteq>c\" unfolding IntervalX_def using Order_ZF_2_L1 by auto\n    then have \"d\\<in>LeftRayX(X,r,c)\" unfolding LeftRayX_def by auto\n  }\n  then have \"IntervalX(X, r, b, c)\\<subseteq>LeftRayX(X,r,c)\" by auto\n  with nFIN show ?thesis using subset_Finite by auto\nqed\n\ntext\\<open>Right rays are infinite.\\<close>\n\ntheorem dense_order_inf_rrays:\n  assumes \"IsLinOrder(X,r)\" \"RightRayX(X,r,b)\\<noteq>0\"\"b\\<in>X\"  \"X{is dense with respect to}r\"\n  shows \"\\<not>Finite(RightRayX(X,r,b))\"\nproof-\n  from assms(2) obtain c where \"c\\<in>X\"\"\\<langle>b,c\\<rangle>\\<in>r\"\"b\\<noteq>c\" unfolding RightRayX_def by auto\n  with assms(3) obtain z where \"z\\<in>X-{b,c}\"\"\\<langle>b,z\\<rangle>\\<in>r\"\"\\<langle>z,c\\<rangle>\\<in>r\" using assms(4) unfolding IsDense_def by auto\n  then have \"IntervalX(X, r, b, c)\\<noteq>0\" unfolding IntervalX_def using Order_ZF_2_L1 by auto\n  then have nFIN:\"\\<not>Finite(IntervalX(X, r, b, c))\" using dense_order_inf_intervals[OF assms(1) _ assms(3) _ assms(4)]\n    \\<open>c\\<in>X\\<close> by auto\n  {\n    fix d assume \"d\\<in>IntervalX(X, r, b, c)\"\n    then have \"\\<langle>b,d\\<rangle>\\<in>r\"\"\\<langle>d,c\\<rangle>\\<in>r\"\"d\\<in>X\"\"d\\<noteq>b\"\"d\\<noteq>c\" unfolding IntervalX_def using Order_ZF_2_L1 by auto\n    then have \"d\\<in>RightRayX(X,r,b)\" unfolding RightRayX_def by auto\n  }\n  then have \"IntervalX(X, r, b, c)\\<subseteq>RightRayX(X,r,b)\" by auto\n  with nFIN show ?thesis using subset_Finite by auto\nqed\n\ntext\\<open>The whole space in a densely ordered set is infinite.\\<close>\n\ncorollary dense_order_infinite:\n  assumes \"IsLinOrder(X,r)\"  \"X{is dense with respect to}r\"\n    \"\\<exists>x y. x\\<noteq>y\\<and>x\\<in>X\\<and>y\\<in>X\"\n  shows \"\\<not>(X\\<prec>nat)\"\nproof-\n  from assms(3) obtain b c where B:\"b\\<in>X\"\"c\\<in>X\"\"b\\<noteq>c\" by auto\n  {\n    assume \"\\<langle>b,c\\<rangle>\\<notin>r\"\n    with assms(1) have \"\\<langle>c,b\\<rangle>\\<in>r\" unfolding IsLinOrder_def IsTotal_def using \\<open>b\\<in>X\\<close>\\<open>c\\<in>X\\<close> by auto\n    with assms(2) B obtain z where \"z\\<in>X-{b,c}\"\"\\<langle>c,z\\<rangle>\\<in>r\"\"\\<langle>z,b\\<rangle>\\<in>r\" unfolding IsDense_def by auto\n    then have \"IntervalX(X,r,c,b)\\<noteq>0\" unfolding IntervalX_def using Order_ZF_2_L1 by auto\n    then have \"\\<not>(Finite(IntervalX(X,r,c,b)))\" using dense_order_inf_intervals[OF assms(1) _ \\<open>c\\<in>X\\<close>\\<open>b\\<in>X\\<close> assms(2)]\n      by auto moreover\n    have \"IntervalX(X,r,c,b)\\<subseteq>X\" unfolding IntervalX_def by auto\n    ultimately have \"\\<not>(Finite(X))\" using subset_Finite by auto\n    then have \"\\<not>(X\\<prec>nat)\" using lesspoll_nat_is_Finite by auto\n  }\n  moreover\n  {\n    assume \"\\<langle>b,c\\<rangle>\\<in>r\"\n    with assms(2) B obtain z where \"z\\<in>X-{b,c}\"\"\\<langle>b,z\\<rangle>\\<in>r\"\"\\<langle>z,c\\<rangle>\\<in>r\" unfolding IsDense_def by auto\n    then have \"IntervalX(X,r,b,c)\\<noteq>0\" unfolding IntervalX_def using Order_ZF_2_L1 by auto\n    then have \"\\<not>(Finite(IntervalX(X,r,b,c)))\" using dense_order_inf_intervals[OF assms(1) _ \\<open>b\\<in>X\\<close>\\<open>c\\<in>X\\<close> assms(2)]\n      by auto moreover\n    have \"IntervalX(X,r,b,c)\\<subseteq>X\" unfolding IntervalX_def by auto\n    ultimately have \"\\<not>(Finite(X))\" using subset_Finite by auto\n    then have \"\\<not>(X\\<prec>nat)\" using lesspoll_nat_is_Finite by auto\n  }\n  ultimately show ?thesis by auto\nqed\n\ntext\\<open>If an order topology is connected, then the order is complete.\nIt is equivalent to assume that $r\\subseteq X\\times X$ or prove that\n$r\\cap X\\times X$ is complete.\\<close>\n\ntheorem conn_imp_complete:\n  assumes \"IsLinOrder(X,r)\" \"\\<exists>x y. x\\<noteq>y\\<and>x\\<in>X\\<and>y\\<in>X\" \"r\\<subseteq>X\\<times>X\"\n     \"(OrdTopology X r){is connected}\"\n  shows \"r{is complete}\"\nproof-\n  {\n    assume \"\\<not>(r{is complete})\"\n    then obtain A where A:\"A\\<noteq>0\"\"IsBoundedAbove(A,r)\"\"\\<not>(HasAminimum(r, \\<Inter>b\\<in>A. r `` {b}))\" unfolding\n      IsComplete_def by auto\n    from A(3) have r1:\"\\<forall>m\\<in>\\<Inter>b\\<in>A. r `` {b}. \\<exists>x\\<in>\\<Inter>b\\<in>A. r `` {b}. \\<langle>m,x\\<rangle>\\<notin>r\" unfolding HasAminimum_def\n      by force\n    from A(1,2) obtain b where r2:\"\\<forall>x\\<in>A. \\<langle>x, b\\<rangle> \\<in> r\" unfolding IsBoundedAbove_def by auto\n    with assms(3) A(1) have \"A\\<subseteq>X\"\"b\\<in>X\" by auto\n    with assms(3) have r3:\"\\<forall>c\\<in>A. r `` {c}\\<subseteq>X\" using image_iff by auto\n    from r2 have \"\\<forall>x\\<in>A. b\\<in>r``{x}\" using image_iff by auto\n    then have noE:\"b\\<in>(\\<Inter>b\\<in>A. r `` {b})\" using A(1) by auto\n    {\n      fix x assume \"x\\<in>(\\<Inter>b\\<in>A. r `` {b})\"\n      then have \"\\<forall>c\\<in>A. x\\<in>r``{c}\" by auto\n      with A(1) obtain c where \"c\\<in>A\" \"x\\<in>r``{c}\" by auto\n      with r3 have \"x\\<in>X\" by auto\n    }\n    then have sub:\"(\\<Inter>b\\<in>A. r `` {b})\\<subseteq>X\" by auto\n    {\n      fix x assume x:\"x\\<in>(\\<Inter>b\\<in>A. r `` {b})\"\n      with r1 have \"\\<exists>z\\<in>\\<Inter>b\\<in>A. r `` {b}. \\<langle>x,z\\<rangle>\\<notin>r\" by auto\n      then obtain z where z:\"z\\<in>(\\<Inter>b\\<in>A. r `` {b})\"\"\\<langle>x,z\\<rangle>\\<notin>r\" by auto\n      from x z(1) sub have \"x\\<in>X\"\"z\\<in>X\" by auto\n      with z(2) have \"\\<langle>z,x\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def IsTotal_def by auto\n      then have xx:\"x\\<in>RightRayX(X,r,z)\" unfolding RightRayX_def using \\<open>x\\<in>X\\<close>\\<open>\\<langle>x,z\\<rangle>\\<notin>r\\<close>\n        assms(1) unfolding IsLinOrder_def using total_is_refl unfolding refl_def by auto\n      {\n        fix m assume \"m\\<in>RightRayX(X,r,z)\"\n        then have m:\"m\\<in>X-{z}\"\"\\<langle>z,m\\<rangle>\\<in>r\" unfolding RightRayX_def by auto\n        {\n          fix c assume \"c\\<in>A\"\n          with z(1) have \"\\<langle>c,z\\<rangle>\\<in>r\" using image_iff by auto\n          with m(2) have \"\\<langle>c,m\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by fast\n          then have \"m\\<in>r``{c}\" using image_iff by auto\n        }\n        with A(1) have \"m\\<in>(\\<Inter>b\\<in>A. r `` {b})\" by auto\n      }\n      then have sub1:\"RightRayX(X,r,z)\\<subseteq>(\\<Inter>b\\<in>A. r `` {b})\" by auto\n      have \"RightRayX(X,r,z)\\<in>(OrdTopology X r)\" using \n        base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]] \\<open>z\\<in>X\\<close> by auto\n      with sub1 xx have \"\\<exists>U\\<in>(OrdTopology X r). x\\<in>U \\<and> U\\<subseteq>(\\<Inter>b\\<in>A. r `` {b})\" by auto\n    }\n    then have \"(\\<Inter>b\\<in>A. r `` {b})\\<in>(OrdTopology X r)\" using topology0.open_neigh_open[OF topology0_ordtopology[OF assms(1)]]\n      by auto moreover\n    {\n      fix x assume \"x\\<in>X-(\\<Inter>b\\<in>A. r `` {b})\"\n      then have \"x\\<in>X\"\"x\\<notin>(\\<Inter>b\\<in>A. r `` {b})\" by auto\n      with A(1) obtain b where \"x\\<notin>r``{b}\"\"b\\<in>A\" by auto\n      then have \"\\<langle>b,x\\<rangle>\\<notin>r\" using image_iff by auto\n      with \\<open>A\\<subseteq>X\\<close> \\<open>b\\<in>A\\<close>\\<open>x\\<in>X\\<close> have \"\\<langle>x,b\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def\n        IsTotal_def by auto\n      then have xx:\"x\\<in>LeftRayX(X,r,b)\" unfolding LeftRayX_def using \\<open>x\\<in>X\\<close> \\<open>\\<langle>b,x\\<rangle>\\<notin>r\\<close>\n        assms(1) unfolding IsLinOrder_def using total_is_refl unfolding refl_def by auto\n      {\n        fix y assume \"y\\<in>LeftRayX(X,r,b)\\<inter>(\\<Inter>b\\<in>A. r `` {b})\"\n        then have \"y\\<in>X-{b}\"\"\\<langle>y,b\\<rangle>\\<in>r\"\"\\<forall>c\\<in>A. y\\<in>r``{c}\" unfolding LeftRayX_def by auto\n        then have \"y\\<in>X\"\"\\<langle>y,b\\<rangle>\\<in>r\"\"\\<forall>c\\<in>A. \\<langle>c,y\\<rangle>\\<in>r\" using image_iff by auto\n        with \\<open>b\\<in>A\\<close> have \"y=b\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n        then have \"False\" using \\<open>y\\<in>X-{b}\\<close> by auto\n      }\n      then have sub1:\"LeftRayX(X,r,b)\\<subseteq>X-(\\<Inter>b\\<in>A. r `` {b})\" unfolding LeftRayX_def by auto\n      have \"LeftRayX(X,r,b)\\<in>(OrdTopology X r)\" using \n        base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]] \\<open>b\\<in>A\\<close>\\<open>A\\<subseteq>X\\<close> by blast\n      with sub1 xx have \"\\<exists>U\\<in>(OrdTopology X r). x\\<in>U\\<and>U\\<subseteq>X-(\\<Inter>b\\<in>A. r `` {b})\" by auto\n    }\n    then have \"X - (\\<Inter>b\\<in>A. r `` {b})\\<in>(OrdTopology X r)\" using topology0.open_neigh_open[OF topology0_ordtopology[OF assms(1)]]\n      by auto\n    then have \"\\<Union>(OrdTopology X r)-(\\<Inter>b\\<in>A. r `` {b})\\<in>(OrdTopology X r)\" using union_ordtopology[OF assms(1,2)] by auto\n    then have \"(\\<Inter>b\\<in>A. r `` {b}){is closed in}(OrdTopology X r)\" unfolding IsClosed_def using union_ordtopology[OF assms(1,2)]\n      sub by auto\n    moreover note assms(4) ultimately\n    have \"(\\<Inter>b\\<in>A. r `` {b})=0\\<or>(\\<Inter>b\\<in>A. r `` {b})=X\" using union_ordtopology[OF assms(1,2)] unfolding IsConnected_def\n      by auto\n    then have e1:\"(\\<Inter>b\\<in>A. r `` {b})=X\" using noE by auto\n    then have \"\\<forall>x\\<in>X. \\<forall>b\\<in>A. x\\<in>r``{b}\" by auto\n    then have r4:\"\\<forall>x\\<in>X. \\<forall>b\\<in>A. \\<langle>b,x\\<rangle>\\<in>r\" using image_iff by auto\n    {\n      fix a1 a2 assume aA:\"a1\\<in>A\"\"a2\\<in>A\"\"a1\\<noteq>a2\"\n      with \\<open>A\\<subseteq>X\\<close> have aX:\"a1\\<in>X\"\"a2\\<in>X\" by auto\n      with r4 aA(1,2) have \"\\<langle>a1,a2\\<rangle>\\<in>r\"\"\\<langle>a2,a1\\<rangle>\\<in>r\" by auto\n      then have \"a1=a2\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n      with aA(3) have \"False\" by auto\n    }\n    moreover\n    from A(1) obtain t where \"t\\<in>A\" by auto\n    ultimately have \"A={t}\" by auto\n    with r4 have \"\\<forall>x\\<in>X. \\<langle>t,x\\<rangle>\\<in>r\"\"t\\<in>X\" using \\<open>A\\<subseteq>X\\<close> by auto\n    then have \"HasAminimum(r,X)\" unfolding HasAminimum_def by auto\n    with e1 have \"HasAminimum(r,\\<Inter>b\\<in>A. r `` {b})\" by auto\n    with A(3) have \"False\" by auto\n  }\n  then show ?thesis by auto\nqed\n\ntext\\<open>If an order topology is connected, then the order is dense.\\<close>\n\ntheorem conn_imp_dense:\n  assumes \"IsLinOrder(X,r)\" \"\\<exists>x y. x\\<noteq>y\\<and>x\\<in>X\\<and>y\\<in>X\"\n     \"(OrdTopology X r){is connected}\"\n  shows \"X {is dense with respect to}r\"\nproof-\n  {\n    assume \"\\<not>(X {is dense with respect to}r)\"\n    then have \"\\<exists>x1\\<in>X. \\<exists>x2\\<in>X. \\<langle>x1,x2\\<rangle>\\<in>r\\<and>x1\\<noteq>x2\\<and>(\\<forall>z\\<in>X-{x1,x2}. \\<langle>x1,z\\<rangle>\\<notin>r\\<or>\\<langle>z,x2\\<rangle>\\<notin>r)\"\n      unfolding IsDense_def by auto\n    then obtain x1 x2 where x:\"x1\\<in>X\"\"x2\\<in>X\"\"\\<langle>x1,x2\\<rangle>\\<in>r\"\"x1\\<noteq>x2\"\"(\\<forall>z\\<in>X-{x1,x2}. \\<langle>x1,z\\<rangle>\\<notin>r\\<or>\\<langle>z,x2\\<rangle>\\<notin>r)\" by auto\n    from x(1,2) have P:\"LeftRayX(X,r,x2)\\<in>(OrdTopology X r)\"\"RightRayX(X,r,x1)\\<in>(OrdTopology X r)\"\n      using  base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]] by auto\n    {\n      fix x assume \"x\\<in>X-LeftRayX(X,r,x2)\"\n      then have \"x\\<in>X\" \"x\\<notin>LeftRayX(X,r,x2)\" by auto\n      then have \"\\<langle>x,x2\\<rangle>\\<notin>r\\<or>x=x2\" unfolding LeftRayX_def by auto\n      then have \"\\<langle>x2,x\\<rangle>\\<in>r\\<or>x=x2\" using assms(1) \\<open>x\\<in>X\\<close> \\<open>x2\\<in>X\\<close> unfolding IsLinOrder_def\n        IsTotal_def by auto\n      then have s:\"\\<langle>x2,x\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def using total_is_refl \\<open>x2\\<in>X\\<close>\n        unfolding refl_def by auto\n      with x(3) have \"\\<langle>x1,x\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by fast\n      then have \"x=x1\\<or>x\\<in>RightRayX(X,r,x1)\" unfolding RightRayX_def using \\<open>x\\<in>X\\<close> by auto\n      with s have \"\\<langle>x2,x1\\<rangle>\\<in>r\\<or>x\\<in>RightRayX(X,r,x1)\" by auto\n      with x(3) have \"x1=x2 \\<or> x\\<in>RightRayX(X,r,x1)\" using assms(1) unfolding IsLinOrder_def\n        antisym_def by auto\n      with x(4) have \"x\\<in>RightRayX(X,r,x1)\" by auto\n    }\n    then have \"X-LeftRayX(X,r,x2)\\<subseteq>RightRayX(X,r,x1)\" by auto moreover\n    {\n      fix x assume \"x\\<in>RightRayX(X,r,x1)\"\n      then have xr:\"x\\<in>X-{x1}\"\"\\<langle>x1,x\\<rangle>\\<in>r\" unfolding RightRayX_def by auto\n      {\n        assume \"x\\<in>LeftRayX(X,r,x2)\"\n        then have xl:\"x\\<in>X-{x2}\"\"\\<langle>x,x2\\<rangle>\\<in>r\" unfolding LeftRayX_def by auto\n        from xl xr x(5) have \"False\" by auto\n      }\n      with xr(1) have \"x\\<in>X-LeftRayX(X,r,x2)\" by auto\n    }\n    ultimately have \"RightRayX(X,r,x1)=X-LeftRayX(X,r,x2)\" by auto\n    then have \"LeftRayX(X,r,x2){is closed in}(OrdTopology X r)\" using P(2) union_ordtopology[\n      OF assms(1,2)] unfolding IsClosed_def LeftRayX_def by auto\n    with P(1) have \"LeftRayX(X,r,x2)=0\\<or>LeftRayX(X,r,x2)=X\" using union_ordtopology[\n      OF assms(1,2)] assms(3) unfolding IsConnected_def by auto\n    with x(1,3,4) have \"LeftRayX(X,r,x2)=X\" unfolding LeftRayX_def by auto\n    then have \"x2\\<in>LeftRayX(X,r,x2)\" using x(2) by auto\n    then have \"False\" unfolding LeftRayX_def by auto\n  }\n  then show ?thesis by auto\nqed\n\ntext\\<open>Actually a connected order topology is one that comes from a dense\nand complete order.\\<close>\n\ntext\\<open>First a lemma. In a complete ordered set, every non-empty set bounded from below has\na maximum lower bound.\\<close>\n\nlemma complete_order_bounded_below:\n  assumes \"r{is complete}\" \"IsBoundedBelow(A,r)\" \"A\\<noteq>0\" \"r\\<subseteq>X\\<times>X\"\n  shows \"HasAmaximum(r,\\<Inter>c\\<in>A. r-``{c})\"\nproof-\n  let ?M=\"\\<Inter>c\\<in>A. r-``{c}\"\n  from assms(3) obtain t where A:\"t\\<in>A\" by auto\n  {\n    fix m assume \"m\\<in>?M\"\n    with A have \"m\\<in>r-``{t}\" by auto\n    then have \"\\<langle>m,t\\<rangle>\\<in>r\" by auto\n  }\n  then have \"(\\<forall>x\\<in>\\<Inter>c\\<in>A. r -`` {c}. \\<langle>x, t\\<rangle> \\<in> r)\" by auto\n  then have \"IsBoundedAbove(?M,r)\" unfolding IsBoundedAbove_def by auto\n  moreover\n  from assms(2,3) obtain l where \" \\<forall>x\\<in>A. \\<langle>l, x\\<rangle> \\<in> r\" unfolding IsBoundedBelow_def by auto\n  then have \"\\<forall>x\\<in>A. l \\<in> r-``{x}\" using vimage_iff by auto\n  with assms(3) have \"l\\<in>?M\" by auto\n  then have \"?M\\<noteq>0\" by auto moreover note assms(1)\n  ultimately have \"HasAminimum(r,\\<Inter>c\\<in>?M. r `` {c})\" unfolding IsComplete_def by auto\n  then obtain rr where rr:\"rr\\<in>(\\<Inter>c\\<in>?M. r `` {c})\" \"\\<forall>s\\<in>(\\<Inter>c\\<in>?M. r `` {c}). \\<langle>rr,s\\<rangle>\\<in>r\" unfolding HasAminimum_def\n    by auto\n  {\n    fix aa assume A:\"aa\\<in>A\"\n    {\n      fix c assume M:\"c\\<in>?M\"\n      with A have \"\\<langle>c,aa\\<rangle>\\<in>r\" by auto\n      then have \"aa\\<in>r``{c}\" by auto\n    }\n    then have \"aa\\<in>(\\<Inter>c\\<in>?M. r `` {c})\" using rr(1) by auto\n  }\n  then have \"A\\<subseteq>(\\<Inter>c\\<in>?M. r `` {c})\" by auto\n  with rr(2) have \"\\<forall>s\\<in>A. \\<langle>rr,s\\<rangle>\\<in>r\" by auto\n  then have \"rr\\<in>?M\" using assms(3) by auto\n  moreover\n  {\n    fix m assume \"m\\<in>?M\"\n    then have \"rr\\<in>r``{m}\" using rr(1) by auto\n    then have \"\\<langle>m,rr\\<rangle>\\<in>r\" by auto\n  }\n  then have \"\\<forall>m\\<in>?M. \\<langle>m,rr\\<rangle>\\<in>r\" by auto\n  ultimately show ?thesis unfolding HasAmaximum_def by auto\nqed \n\ntheorem comp_dense_imp_conn:\n  assumes \"IsLinOrder(X,r)\" \"\\<exists>x y. x\\<noteq>y\\<and>x\\<in>X\\<and>y\\<in>X\" \"r\\<subseteq>X\\<times>X\"\n     \"X {is dense with respect to}r\" \"r{is complete}\"\n  shows \"(OrdTopology X r){is connected}\"\nproof-\n  {\n    assume \"\\<not>((OrdTopology X r){is connected})\"\n    then obtain U where U:\"U\\<noteq>0\"\"U\\<noteq>X\"\"U\\<in>(OrdTopology X r)\"\"U{is closed in}(OrdTopology X r)\"\n      unfolding IsConnected_def using union_ordtopology[OF assms(1,2)] by auto\n    from U(4) have A:\"X-U\\<in>(OrdTopology X r)\"\"U\\<subseteq>X\" unfolding IsClosed_def using union_ordtopology[OF assms(1,2)] by auto\n    from U(1) obtain u where \"u\\<in>U\" by auto\n    from A(2) U(1,2) have \"X-U\\<noteq>0\" by auto\n    then obtain v where \"v\\<in>X-U\" by auto\n    with \\<open>u\\<in>U\\<close> \\<open>U\\<subseteq>X\\<close> have \"\\<langle>u,v\\<rangle>\\<in>r\\<or>\\<langle>v,u\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def IsTotal_def\n      by auto\n    {\n      assume \"\\<langle>u,v\\<rangle>\\<in>r\"\n      have \"LeftRayX(X,r,v)\\<in>(OrdTopology X r)\" using base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]]\n        \\<open>v\\<in>X-U\\<close> by auto\n      then have \"U\\<inter>LeftRayX(X,r,v)\\<in>(OrdTopology X r)\" using U(3) using Ordtopology_is_a_topology(1)\n        [OF assms(1)] unfolding IsATopology_def by auto\n      {\n        fix b assume \"b\\<in>(U)\\<inter>LeftRayX(X,r,v)\"\n        then have \"\\<langle>b,v\\<rangle>\\<in>r\" unfolding LeftRayX_def by auto\n      }\n      then have bound:\"IsBoundedAbove(U\\<inter>LeftRayX(X,r,v),r)\" unfolding IsBoundedAbove_def by auto moreover\n      with \\<open>\\<langle>u,v\\<rangle>\\<in>r\\<close>\\<open>u\\<in>U\\<close>\\<open>U\\<subseteq>X\\<close>\\<open>v\\<in>X-U\\<close> have nE:\"U\\<inter>LeftRayX(X,r,v)\\<noteq>0\" unfolding LeftRayX_def by auto\n      ultimately have Hmin:\"HasAminimum(r,\\<Inter>c\\<in>U\\<inter>LeftRayX(X,r,v). r``{c})\" using assms(5) unfolding IsComplete_def\n        by auto\n      let ?min=\"Supremum(r,U\\<inter>LeftRayX(X,r,v))\"\n      {\n        fix c assume \"c\\<in>U\\<inter>LeftRayX(X,r,v)\"\n        then have \"\\<langle>c,v\\<rangle>\\<in>r\" unfolding LeftRayX_def by auto\n      }\n      then have a1:\"\\<langle>?min,v\\<rangle>\\<in>r\" using Order_ZF_5_L3[OF _ nE Hmin] assms(1) unfolding IsLinOrder_def\n        by auto\n      {\n        assume ass:\"?min\\<in>U\"\n        then obtain V where V:\"?min\\<in>V\"\"V\\<subseteq>U\"\n          \"V\\<in>{IntervalX(X,r,b,c). \\<langle>b,c\\<rangle>\\<in>X\\<times>X}\\<union>{LeftRayX(X,r,b). b\\<in>X}\\<union>{RightRayX(X,r,b). b\\<in>X}\" using point_open_base_neigh\n          [OF Ordtopology_is_a_topology(2)[OF assms(1)] \\<open>U\\<in>(OrdTopology X r)\\<close> ass] by blast\n        {\n          assume \"V\\<in>{RightRayX(X,r,b). b\\<in>X}\"\n          then obtain b where b:\"b\\<in>X\" \"V=RightRayX(X,r,b)\" by auto\n          note a1 moreover\n          from V(1) b(2) have a2:\"\\<langle>b,?min\\<rangle>\\<in>r\"\"?min\\<noteq>b\" unfolding RightRayX_def by auto\n          ultimately have \"\\<langle>b,v\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by blast moreover\n          {\n            assume \"b=v\"\n            with a1 a2(1) have \"b=?min\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n            with a2(2) have \"False\" by auto\n          }\n          ultimately have \"False\" using V(2) b(2) unfolding RightRayX_def using \\<open>v\\<in>X-U\\<close> by auto\n        }\n        moreover\n        {\n          assume \"V\\<in>{LeftRayX(X,r,b). b\\<in>X}\"\n          then obtain b where b:\"V=LeftRayX(X,r,b)\" \"b\\<in>X\" by auto\n          {\n            assume \"\\<langle>v,b\\<rangle>\\<in>r\"\n            then have \"b=v\\<or>v\\<in>LeftRayX(X,r,b)\" unfolding LeftRayX_def using \\<open>v\\<in>X-U\\<close> by auto\n            then have \"b=v\" using b(1) V(2) \\<open>v\\<in>X-U\\<close> by auto\n          }\n          then have bv:\"\\<langle>b,v\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def IsTotal_def using b(2)\n            \\<open>v\\<in>X-U\\<close> by auto\n          from b(1) V(1) have \"\\<langle>?min,b\\<rangle>\\<in>r\"\"?min\\<noteq>b\" unfolding LeftRayX_def by auto\n          with assms(4) obtain z where z:\"\\<langle>?min,z\\<rangle>\\<in>r\"\"\\<langle>z,b\\<rangle>\\<in>r\"\"z\\<in>X-{b,?min}\" unfolding IsDense_def\n            using b(2) V(1,2) \\<open>U\\<subseteq>X\\<close> by blast\n          then have rayb:\"z\\<in>LeftRayX(X,r,b)\" unfolding LeftRayX_def by auto\n          from z(2) bv have \"\\<langle>z,v\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by fast\n          moreover\n          {\n            assume \"z=v\"\n            with bv have \"\\<langle>b,z\\<rangle>\\<in>r\" by auto\n            with z(2) have \"b=z\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n            then have \"False\" using z(3) by auto\n          }\n          ultimately have \"z\\<in>LeftRayX(X,r,v)\" unfolding LeftRayX_def using z(3) by auto\n          with rayb have \"z\\<in>U\\<inter>LeftRayX(X,r,v)\" using V(2) b(1) by auto\n          then have \"?min\\<in>r``{z}\" using Order_ZF_4_L4(1)[OF _ Hmin] assms(1) unfolding Supremum_def IsLinOrder_def\n            by auto\n          then have \"\\<langle>z,?min\\<rangle>\\<in>r\" by auto\n          with z(1,3) have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n        }\n        moreover\n        {\n          assume \"V\\<in>{IntervalX(X,r,b,c). \\<langle>b,c\\<rangle>\\<in>X\\<times>X}\"\n          then obtain b c where b:\"V=IntervalX(X,r,b,c)\" \"b\\<in>X\"\"c\\<in>X\" by auto\n          from b V(1) have m:\"\\<langle>?min,c\\<rangle>\\<in>r\"\"\\<langle>b,?min\\<rangle>\\<in>r\"\"?min\\<noteq>b\" \"?min\\<noteq>c\" unfolding IntervalX_def Interval_def by auto  \n          {\n            assume A:\"\\<langle>c,v\\<rangle>\\<in>r\"\n            from m obtain z where z:\"\\<langle>z,c\\<rangle>\\<in>r\" \"\\<langle>?min,z\\<rangle>\\<in>r\"\"z\\<in>X-{c,?min}\" using assms(4) unfolding IsDense_def\n              using b(3) V(1,2) \\<open>U\\<subseteq>X\\<close> by blast\n            from z(2) have \"\\<langle>b,z\\<rangle>\\<in>r\" using m(2) assms(1) unfolding IsLinOrder_def trans_def\n              by fast\n            with z(1) have \"z\\<in>IntervalX(X,r,b,c)\\<or>z=b\" using z(3) unfolding IntervalX_def\n              Interval_def by auto\n            then have \"z\\<in>IntervalX(X,r,b,c)\" using m(2) z(2,3) using assms(1) unfolding IsLinOrder_def\n              antisym_def by auto\n            with b(1) V(2) have \"z\\<in>U\" by auto moreover\n            from A z(1) have \"\\<langle>z,v\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by fast\n            moreover have \"z\\<noteq>v\" using A z(1,3) assms(1) unfolding IsLinOrder_def antisym_def by auto\n            ultimately have \"z\\<in>U\\<inter>LeftRayX(X,r,v)\" unfolding LeftRayX_def using z(3) by auto\n            then have \"?min\\<in>r``{z}\" using Order_ZF_4_L4(1)[OF _ Hmin] assms(1) unfolding Supremum_def IsLinOrder_def\n              by auto\n            then have \"\\<langle>z,?min\\<rangle>\\<in>r\" by auto\n            with z(2,3) have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n          }\n          then have vc:\"\\<langle>v,c\\<rangle>\\<in>r\"\"v\\<noteq>c\" using assms(1) unfolding IsLinOrder_def IsTotal_def using \\<open>v\\<in>X-U\\<close>\n            b(3) by auto\n          {\n            assume \"?min=v\"\n            with V(2,1) \\<open>v\\<in>X-U\\<close> have \"False\" by auto\n          }\n          then have \"?min\\<noteq>v\" by auto\n          with a1 obtain z where z:\"\\<langle>?min,z\\<rangle>\\<in>r\"\"\\<langle>z,v\\<rangle>\\<in>r\"\"z\\<in>X-{?min,v}\" using assms(4) unfolding IsDense_def\n            using V(1,2) \\<open>U\\<subseteq>X\\<close>\\<open>v\\<in>X-U\\<close> by blast\n          from z(2) vc(1) have zc:\"\\<langle>z,c\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def\n            by fast moreover\n          from m(2) z(1) have \"\\<langle>b,z\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def\n            by fast ultimately\n          have \"z\\<in>Interval(r,b,c)\" using Order_ZF_2_L1B by auto moreover\n          {\n            assume \"z=c\"\n            then have \"False\" using z(2) vc using assms(1) unfolding IsLinOrder_def antisym_def\n              by fast\n          }\n          then have \"z\\<noteq>c\" by auto moreover\n          {\n            assume \"z=b\"\n            then have \"z=?min\" using m(2) z(1) using assms(1) unfolding IsLinOrder_def\n              antisym_def by auto\n            with z(3) have \"False\" by auto\n          }\n          then have \"z\\<noteq>b\" by auto moreover\n          have \"z\\<in>X\" using z(3) by auto ultimately\n          have \"z\\<in>IntervalX(X,r,b,c)\" unfolding IntervalX_def by auto\n          then have \"z\\<in>V\" using b(1) by auto\n          then have \"z\\<in>U\" using V(2) by auto moreover\n          from z(2,3) have \"z\\<in>LeftRayX(X,r,v)\" unfolding LeftRayX_def by auto ultimately\n          have \"z\\<in>U\\<inter>LeftRayX(X,r,v)\" by auto\n          then have \"?min\\<in>r``{z}\" using Order_ZF_4_L4(1)[OF _ Hmin] assms(1) unfolding Supremum_def IsLinOrder_def\n            by auto\n          then have \"\\<langle>z,?min\\<rangle>\\<in>r\" by auto\n          with z(1,3) have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n        }\n        ultimately have \"False\" using V(3) by auto\n      }\n      then have ass:\"?min\\<in>X-U\" using a1 assms(3) by auto\n      then obtain V where V:\"?min\\<in>V\"\"V\\<subseteq>X-U\"\n        \"V\\<in>{IntervalX(X,r,b,c). \\<langle>b,c\\<rangle>\\<in>X\\<times>X}\\<union>{LeftRayX(X,r,b). b\\<in>X}\\<union>{RightRayX(X,r,b). b\\<in>X}\" using point_open_base_neigh\n        [OF Ordtopology_is_a_topology(2)[OF assms(1)] \\<open>X-U\\<in>(OrdTopology X r)\\<close> ass] by blast\n      {\n        assume \"V\\<in>{IntervalX(X,r,b,c). \\<langle>b,c\\<rangle>\\<in>X\\<times>X}\"\n        then obtain b c where b:\"V=IntervalX(X,r,b,c)\"\"b\\<in>X\"\"c\\<in>X\" by auto\n        from b V(1) have m:\"\\<langle>?min,c\\<rangle>\\<in>r\"\"\\<langle>b,?min\\<rangle>\\<in>r\"\"?min\\<noteq>b\" \"?min\\<noteq>c\" unfolding IntervalX_def Interval_def by auto  \n        {\n          fix x assume A:\"x\\<in>U\\<inter>LeftRayX(X,r,v)\"\n          then have \"\\<langle>x,v\\<rangle>\\<in>r\"\"x\\<in>U\" unfolding LeftRayX_def by auto\n          then have \"x\\<notin>V\" using V(2) by auto\n          then have \"x\\<notin>Interval(r, b, c) \\<inter> X\\<or>x=b\\<or>x=c\" using b(1) unfolding IntervalX_def by auto\n          then have \"(\\<langle>b,x\\<rangle>\\<notin>r\\<or>\\<langle>x,c\\<rangle>\\<notin>r)\\<or>x=b\\<or>x=c\"\"x\\<in>X\" using Order_ZF_2_L1B \\<open>x\\<in>U\\<close>\\<open>U\\<subseteq>X\\<close> by auto\n          then have \"(\\<langle>x,b\\<rangle>\\<in>r\\<or>\\<langle>c,x\\<rangle>\\<in>r)\\<or>x=b\\<or>x=c\" using assms(1) unfolding IsLinOrder_def IsTotal_def\n            using b(2,3) by auto\n          then have \"(\\<langle>x,b\\<rangle>\\<in>r\\<or>\\<langle>c,x\\<rangle>\\<in>r)\" using assms(1) unfolding IsLinOrder_def using total_is_refl\n            unfolding refl_def using b(2,3) by auto moreover\n          from A have \"\\<langle>x,?min\\<rangle>\\<in>r\" using Order_ZF_4_L4(1)[OF _ Hmin] assms(1) unfolding Supremum_def IsLinOrder_def\n            by auto\n          ultimately have \"(\\<langle>x,b\\<rangle>\\<in>r\\<or>\\<langle>c,?min\\<rangle>\\<in>r)\" using assms(1) unfolding IsLinOrder_def trans_def\n            by fast\n          with m(1) have \"(\\<langle>x,b\\<rangle>\\<in>r\\<or>c=?min)\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n          with m(4) have \"\\<langle>x,b\\<rangle>\\<in>r\" by auto\n        }\n        then have \"\\<langle>?min,b\\<rangle>\\<in>r\" using Order_ZF_5_L3[OF _ nE Hmin] assms(1) unfolding IsLinOrder_def by auto\n        with m(2,3) have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n      }\n      moreover\n      {\n        assume \"V\\<in>{RightRayX(X,r,b). b\\<in>X}\"\n        then obtain b where b:\"V=RightRayX(X,r,b)\" \"b\\<in>X\" by auto\n        from b V(1) have m:\"\\<langle>b,?min\\<rangle>\\<in>r\"\"?min\\<noteq>b\" unfolding RightRayX_def by auto\n        {\n          fix x assume A:\"x\\<in>U\\<inter>LeftRayX(X,r,v)\"\n          then have \"\\<langle>x,v\\<rangle>\\<in>r\"\"x\\<in>U\" unfolding LeftRayX_def by auto\n          then have \"x\\<notin>V\" using V(2) by auto\n          then have \"x\\<notin>RightRayX(X,r, b)\" using b(1) by auto\n          then have \"(\\<langle>b,x\\<rangle>\\<notin>r\\<or>x=b)\"\"x\\<in>X\" unfolding RightRayX_def using \\<open>x\\<in>U\\<close>\\<open>U\\<subseteq>X\\<close> by auto\n          then have \"\\<langle>x,b\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def using total_is_refl unfolding\n            refl_def unfolding IsTotal_def using b(2) by auto\n        }\n        then have \"\\<langle>?min,b\\<rangle>\\<in>r\" using Order_ZF_5_L3[OF _ nE Hmin] assms(1) unfolding IsLinOrder_def by auto\n        with m(2,1) have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n      } moreover\n      {\n         assume \"V\\<in>{LeftRayX(X,r,b). b\\<in>X}\"\n        then obtain b where b:\"V=LeftRayX(X,r,b)\" \"b\\<in>X\" by auto\n        from b V(1) have m:\"\\<langle>?min,b\\<rangle>\\<in>r\"\"?min\\<noteq>b\" unfolding LeftRayX_def by auto\n        {\n          fix x assume A:\"x\\<in>U\\<inter>LeftRayX(X,r,v)\"\n          then have \"\\<langle>x,v\\<rangle>\\<in>r\"\"x\\<in>U\" unfolding LeftRayX_def by auto\n          then have \"x\\<notin>V\" using V(2) by auto\n          then have \"x\\<notin>LeftRayX(X,r, b)\" using b(1) by auto\n          then have \"(\\<langle>x,b\\<rangle>\\<notin>r\\<or>x=b)\"\"x\\<in>X\" unfolding LeftRayX_def using \\<open>x\\<in>U\\<close>\\<open>U\\<subseteq>X\\<close> by auto\n          then have \"\\<langle>b,x\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def using total_is_refl unfolding\n            refl_def unfolding IsTotal_def using b(2) by auto\n          with m(1) have \"\\<langle>?min,x\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by fast\n          moreover \n          from bound A have \"\\<exists>g. \\<forall>y\\<in>U\\<inter>LeftRayX(X,r,v). \\<langle>y,g\\<rangle>\\<in>r\" using nE\n            unfolding IsBoundedAbove_def by auto\n          then obtain g where g:\"\\<forall>y\\<in>U\\<inter>LeftRayX(X,r,v). \\<langle>y,g\\<rangle>\\<in>r\" by auto\n          with nE obtain t where \"t\\<in>U\\<inter>LeftRayX(X,r,v)\" by auto\n          with g have \"\\<langle>t,g\\<rangle>\\<in>r\" by auto\n          with assms(3) have \"g\\<in>X\" by auto\n          with g have boundX:\"\\<exists>g\\<in>X. \\<forall>y\\<in>U\\<inter>LeftRayX(X,r,v). \\<langle>y,g\\<rangle>\\<in>r\" by auto\n          have \"\\<langle>x,?min\\<rangle>\\<in>r\" using Order_ZF_5_L7(2)[OF assms(3) _ assms(5) _  boundX]\n            assms(1) \\<open>U\\<subseteq>X\\<close> A unfolding LeftRayX_def IsLinOrder_def by auto\n          ultimately have \"x=?min\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n        }\n        then have \"U\\<inter>LeftRayX(X,r,v)\\<subseteq>{?min}\" by auto moreover\n        {\n          assume \"?min\\<in>U\\<inter>LeftRayX(X,r,v)\"\n          then have \"?min\\<in>U\" by auto\n          then have \"False\" using V(1,2) by auto\n        }\n        ultimately have \"False\" using nE by auto\n      }\n      moreover note V(3)\n      ultimately have \"False\" by auto\n    }\n    with assms(1) have \"\\<langle>v,u\\<rangle>\\<in>r\" unfolding IsLinOrder_def IsTotal_def using \\<open>u\\<in>U\\<close>\\<open>U\\<subseteq>X\\<close>\n      \\<open>v\\<in>X-U\\<close> by auto\n    have \"RightRayX(X,r,v)\\<in>(OrdTopology X r)\" using base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]]\n      \\<open>v\\<in>X-U\\<close> by auto\n    then have \"U\\<inter>RightRayX(X,r,v)\\<in>(OrdTopology X r)\" using U(3) using Ordtopology_is_a_topology(1)\n      [OF assms(1)] unfolding IsATopology_def by auto\n    {\n      fix b assume \"b\\<in>(U)\\<inter>RightRayX(X,r,v)\"\n      then have \"\\<langle>v,b\\<rangle>\\<in>r\" unfolding RightRayX_def by auto\n    }\n    then have bound:\"IsBoundedBelow(U\\<inter>RightRayX(X,r,v),r)\" unfolding IsBoundedBelow_def by auto\n    with \\<open>\\<langle>v,u\\<rangle>\\<in>r\\<close>\\<open>u\\<in>U\\<close>\\<open>U\\<subseteq>X\\<close>\\<open>v\\<in>X-U\\<close> have nE:\"U\\<inter>RightRayX(X,r,v)\\<noteq>0\" unfolding RightRayX_def by auto\n    have Hmax:\"HasAmaximum(r,\\<Inter>c\\<in>U\\<inter>RightRayX(X,r,v). r-``{c})\" using complete_order_bounded_below[OF assms(5) bound nE assms(3)].\n    let ?max=\"Infimum(r,U\\<inter>RightRayX(X,r,v))\"\n    {\n      fix c assume \"c\\<in>U\\<inter>RightRayX(X,r,v)\"\n      then have \"\\<langle>v,c\\<rangle>\\<in>r\" unfolding RightRayX_def by auto\n    }\n    then have a1:\"\\<langle>v,?max\\<rangle>\\<in>r\" using Order_ZF_5_L4[OF _ nE Hmax] assms(1) unfolding IsLinOrder_def\n      by auto\n    {\n      assume ass:\"?max\\<in>U\"\n      then obtain V where V:\"?max\\<in>V\"\"V\\<subseteq>U\"\n        \"V\\<in>{IntervalX(X,r,b,c). \\<langle>b,c\\<rangle>\\<in>X\\<times>X}\\<union>{LeftRayX(X,r,b). b\\<in>X}\\<union>{RightRayX(X,r,b). b\\<in>X}\" using point_open_base_neigh\n        [OF Ordtopology_is_a_topology(2)[OF assms(1)] \\<open>U\\<in>(OrdTopology X r)\\<close> ass] by blast\n      {\n        assume \"V\\<in>{RightRayX(X,r,b). b\\<in>X}\"\n        then obtain b where b:\"b\\<in>X\" \"V=RightRayX(X,r,b)\" by auto\n        from V(1) b(2) have a2:\"\\<langle>b,?max\\<rangle>\\<in>r\"\"?max\\<noteq>b\" unfolding RightRayX_def by auto\n        {\n          assume \"\\<langle>b,v\\<rangle>\\<in>r\"\n          then have \"b=v\\<or>v\\<in>RightRayX(X,r,b)\" unfolding RightRayX_def using \\<open>v\\<in>X-U\\<close> by auto\n          then have \"b=v\" using b(2) V(2) \\<open>v\\<in>X-U\\<close> by auto\n        }\n        then have bv:\"\\<langle>v,b\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def IsTotal_def using b(1)\n          \\<open>v\\<in>X-U\\<close> by auto\n        from a2 assms(4) obtain z where z:\"\\<langle>b,z\\<rangle>\\<in>r\"\"\\<langle>z,?max\\<rangle>\\<in>r\"\"z\\<in>X-{b,?max}\" unfolding IsDense_def\n          using b(1) V(1,2) \\<open>U\\<subseteq>X\\<close> by blast\n        then have rayb:\"z\\<in>RightRayX(X,r,b)\" unfolding RightRayX_def by auto\n        from z(1) bv have \"\\<langle>v,z\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by fast moreover\n        {\n          assume \"z=v\"\n          with bv have \"\\<langle>z,b\\<rangle>\\<in>r\" by auto\n          with z(1) have \"b=z\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n          then have \"False\" using z(3) by auto\n        }\n        ultimately have \"z\\<in>RightRayX(X,r,v)\" unfolding RightRayX_def using z(3) by auto\n        with rayb have \"z\\<in>U\\<inter>RightRayX(X,r,v)\" using V(2) b(2) by auto\n        then have \"?max\\<in>r-``{z}\" using Order_ZF_4_L3(1)[OF _ Hmax] assms(1) unfolding Infimum_def IsLinOrder_def\n          by auto\n        then have \"\\<langle>?max,z\\<rangle>\\<in>r\" by auto\n        with z(2,3) have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n      }\n      moreover\n      {\n        assume \"V\\<in>{LeftRayX(X,r,b). b\\<in>X}\"\n        then obtain b where b:\"V=LeftRayX(X,r,b)\" \"b\\<in>X\" by auto\n        note a1 moreover\n        from V(1) b(1) have a2:\"\\<langle>?max,b\\<rangle>\\<in>r\"\"?max\\<noteq>b\" unfolding LeftRayX_def by auto\n        ultimately have \"\\<langle>v,b\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by blast moreover\n        {\n          assume \"b=v\"\n          with a1 a2(1) have \"b=?max\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n          with a2(2) have \"False\" by auto\n        }\n        ultimately have \"False\" using V(2) b(1) unfolding LeftRayX_def using \\<open>v\\<in>X-U\\<close> by auto\n      }\n      moreover\n      {\n        assume \"V\\<in>{IntervalX(X,r,b,c). \\<langle>b,c\\<rangle>\\<in>X\\<times>X}\"\n        then obtain b c where b:\"V=IntervalX(X,r,b,c)\" \"b\\<in>X\"\"c\\<in>X\" by auto\n        from b V(1) have m:\"\\<langle>?max,c\\<rangle>\\<in>r\"\"\\<langle>b,?max\\<rangle>\\<in>r\"\"?max\\<noteq>b\" \"?max\\<noteq>c\" unfolding IntervalX_def Interval_def by auto  \n        {\n          assume A:\"\\<langle>v,b\\<rangle>\\<in>r\"\n          from m obtain z where z:\"\\<langle>z,?max\\<rangle>\\<in>r\" \"\\<langle>b,z\\<rangle>\\<in>r\"\"z\\<in>X-{b,?max}\" using assms(4) unfolding IsDense_def\n            using b(2) V(1,2) \\<open>U\\<subseteq>X\\<close> by blast\n          from z(1) have \"\\<langle>z,c\\<rangle>\\<in>r\" using m(1) assms(1) unfolding IsLinOrder_def trans_def\n            by fast\n          with z(2) have \"z\\<in>IntervalX(X,r,b,c)\\<or>z=c\" using z(3) unfolding IntervalX_def\n            Interval_def by auto\n          then have \"z\\<in>IntervalX(X,r,b,c)\" using m(1) z(1,3) using assms(1) unfolding IsLinOrder_def\n            antisym_def by auto\n          with b(1) V(2) have \"z\\<in>U\" by auto moreover\n          from A z(2) have \"\\<langle>v,z\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by fast\n          moreover have \"z\\<noteq>v\" using A z(2,3) assms(1) unfolding IsLinOrder_def antisym_def by auto\n          ultimately have \"z\\<in>U\\<inter>RightRayX(X,r,v)\" unfolding RightRayX_def using z(3) by auto\n          then have \"?max\\<in>r-``{z}\" using Order_ZF_4_L3(1)[OF _ Hmax] assms(1) unfolding Infimum_def IsLinOrder_def\n            by auto\n          then have \"\\<langle>?max,z\\<rangle>\\<in>r\" by auto\n          with z(1,3) have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n        }\n        then have vc:\"\\<langle>b,v\\<rangle>\\<in>r\"\"v\\<noteq>b\" using assms(1) unfolding IsLinOrder_def IsTotal_def using \\<open>v\\<in>X-U\\<close>\n          b(2) by auto\n        {\n          assume \"?max=v\"\n          with V(2,1) \\<open>v\\<in>X-U\\<close> have \"False\" by auto\n        }\n        then have \"v\\<noteq>?max\" by auto moreover\n        note a1 moreover\n        have \"?max\\<in>X\" using V(1,2) \\<open>U\\<subseteq>X\\<close> by auto\n        moreover have \"v\\<in>X\" using \\<open>v\\<in>X-U\\<close> by auto\n        ultimately obtain z where z:\"\\<langle>v,z\\<rangle>\\<in>r\"\"\\<langle>z,?max\\<rangle>\\<in>r\"\"z\\<in>X-{v,?max}\" using assms(4) unfolding IsDense_def\n          by auto\n        from z(1) vc(1) have zc:\"\\<langle>b,z\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def\n          by fast moreover\n        from m(1) z(2) have \"\\<langle>z,c\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def\n          by fast ultimately\n        have \"z\\<in>Interval(r,b,c)\" using Order_ZF_2_L1B by auto moreover\n        {\n          assume \"z=b\"\n          then have \"False\" using z(1) vc using assms(1) unfolding IsLinOrder_def antisym_def\n            by fast\n        }\n        then have \"z\\<noteq>b\" by auto moreover\n        {\n          assume \"z=c\"\n          then have \"z=?max\" using m(1) z(2) using assms(1) unfolding IsLinOrder_def\n            antisym_def by auto\n          with z(3) have \"False\" by auto\n        }\n        then have \"z\\<noteq>c\" by auto moreover\n        have \"z\\<in>X\" using z(3) by auto ultimately\n        have \"z\\<in>IntervalX(X,r,b,c)\" unfolding IntervalX_def by auto\n        then have \"z\\<in>V\" using b(1) by auto\n        then have \"z\\<in>U\" using V(2) by auto moreover\n        from z(1,3) have \"z\\<in>RightRayX(X,r,v)\" unfolding RightRayX_def by auto ultimately\n        have \"z\\<in>U\\<inter>RightRayX(X,r,v)\" by auto\n        then have \"?max\\<in>r-``{z}\" using Order_ZF_4_L3(1)[OF _ Hmax] assms(1) unfolding Infimum_def IsLinOrder_def\n          by auto\n        then have \"\\<langle>?max,z\\<rangle>\\<in>r\" by auto\n        with z(2,3) have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n      }\n      ultimately have \"False\" using V(3) by auto\n    }\n    then have ass:\"?max\\<in>X-U\" using a1 assms(3) by auto\n    then obtain V where V:\"?max\\<in>V\"\"V\\<subseteq>X-U\"\n      \"V\\<in>{IntervalX(X,r,b,c). \\<langle>b,c\\<rangle>\\<in>X\\<times>X}\\<union>{LeftRayX(X,r,b). b\\<in>X}\\<union>{RightRayX(X,r,b). b\\<in>X}\" using point_open_base_neigh\n      [OF Ordtopology_is_a_topology(2)[OF assms(1)] \\<open>X-U\\<in>(OrdTopology X r)\\<close> ass] by blast\n    {\n      assume \"V\\<in>{IntervalX(X,r,b,c). \\<langle>b,c\\<rangle>\\<in>X\\<times>X}\"\n      then obtain b c where b:\"V=IntervalX(X,r,b,c)\"\"b\\<in>X\"\"c\\<in>X\" by auto\n      from b V(1) have m:\"\\<langle>?max,c\\<rangle>\\<in>r\"\"\\<langle>b,?max\\<rangle>\\<in>r\"\"?max\\<noteq>b\" \"?max\\<noteq>c\" unfolding IntervalX_def Interval_def by auto  \n      {\n        fix x assume A:\"x\\<in>U\\<inter>RightRayX(X,r,v)\"\n        then have \"\\<langle>v,x\\<rangle>\\<in>r\"\"x\\<in>U\" unfolding RightRayX_def by auto\n        then have \"x\\<notin>V\" using V(2) by auto\n        then have \"x\\<notin>Interval(r, b, c) \\<inter> X\\<or>x=b\\<or>x=c\" using b(1) unfolding IntervalX_def by auto\n        then have \"(\\<langle>b,x\\<rangle>\\<notin>r\\<or>\\<langle>x,c\\<rangle>\\<notin>r)\\<or>x=b\\<or>x=c\"\"x\\<in>X\" using Order_ZF_2_L1B \\<open>x\\<in>U\\<close>\\<open>U\\<subseteq>X\\<close> by auto\n        then have \"(\\<langle>x,b\\<rangle>\\<in>r\\<or>\\<langle>c,x\\<rangle>\\<in>r)\\<or>x=b\\<or>x=c\" using assms(1) unfolding IsLinOrder_def IsTotal_def\n          using b(2,3) by auto\n        then have \"(\\<langle>x,b\\<rangle>\\<in>r\\<or>\\<langle>c,x\\<rangle>\\<in>r)\" using assms(1) unfolding IsLinOrder_def using total_is_refl\n          unfolding refl_def using b(2,3) by auto moreover\n        from A have \"\\<langle>?max,x\\<rangle>\\<in>r\" using Order_ZF_4_L3(1)[OF _ Hmax] assms(1) unfolding Infimum_def IsLinOrder_def\n          by auto\n        ultimately have \"(\\<langle>?max,b\\<rangle>\\<in>r\\<or>\\<langle>c,x\\<rangle>\\<in>r)\" using assms(1) unfolding IsLinOrder_def trans_def\n          by fast\n        with m(2) have \"(?max=b\\<or>\\<langle>c,x\\<rangle>\\<in>r)\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n        with m(3) have \"\\<langle>c,x\\<rangle>\\<in>r\" by auto\n      }\n      then have \"\\<langle>c,?max\\<rangle>\\<in>r\" using Order_ZF_5_L4[OF _ nE Hmax] assms(1) unfolding IsLinOrder_def by auto\n      with m(1,4) have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n    }\n    moreover\n    {\n      assume \"V\\<in>{RightRayX(X,r,b). b\\<in>X}\"\n      then obtain b where b:\"V=RightRayX(X,r,b)\" \"b\\<in>X\" by auto\n      from b V(1) have m:\"\\<langle>b,?max\\<rangle>\\<in>r\"\"?max\\<noteq>b\" unfolding RightRayX_def by auto\n      {\n        fix x assume A:\"x\\<in>U\\<inter>RightRayX(X,r,v)\"\n        then have \"\\<langle>v,x\\<rangle>\\<in>r\"\"x\\<in>U\" unfolding RightRayX_def by auto\n        then have \"x\\<notin>V\" using V(2) by auto\n        then have \"x\\<notin>RightRayX(X,r, b)\" using b(1) by auto\n        then have \"(\\<langle>b,x\\<rangle>\\<notin>r\\<or>x=b)\"\"x\\<in>X\" unfolding RightRayX_def using \\<open>x\\<in>U\\<close>\\<open>U\\<subseteq>X\\<close> by auto\n        then have \"\\<langle>x,b\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def using total_is_refl unfolding\n          refl_def unfolding IsTotal_def using b(2) by auto moreover\n        from A have \"\\<langle>?max,x\\<rangle>\\<in>r\" using Order_ZF_4_L3(1)[OF _ Hmax] assms(1) unfolding Infimum_def IsLinOrder_def\n          by auto ultimately\n        have \"\\<langle>?max,b\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by fast\n        with m have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n      }\n      then have \"False\" using nE by auto\n    } moreover\n    {\n       assume \"V\\<in>{LeftRayX(X,r,b). b\\<in>X}\"\n      then obtain b where b:\"V=LeftRayX(X,r,b)\" \"b\\<in>X\" by auto\n      from b V(1) have m:\"\\<langle>?max,b\\<rangle>\\<in>r\"\"?max\\<noteq>b\" unfolding LeftRayX_def by auto\n      {\n        fix x assume A:\"x\\<in>U\\<inter>RightRayX(X,r,v)\"\n        then have \"\\<langle>v,x\\<rangle>\\<in>r\"\"x\\<in>U\" unfolding RightRayX_def by auto\n        then have \"x\\<notin>V\" using V(2) by auto\n        then have \"x\\<notin>LeftRayX(X,r, b)\" using b(1) by auto\n        then have \"(\\<langle>x,b\\<rangle>\\<notin>r\\<or>x=b)\"\"x\\<in>X\" unfolding LeftRayX_def using \\<open>x\\<in>U\\<close>\\<open>U\\<subseteq>X\\<close> by auto\n        then have \"\\<langle>b,x\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def using total_is_refl unfolding\n          refl_def unfolding IsTotal_def using b(2) by auto\n        then have \"b\\<in>r-``{x}\" by auto\n      }\n      with nE have \"b\\<in>(\\<Inter>c\\<in>U\\<inter>RightRayX(X,r,v). r-``{c})\" by auto\n      then have \"\\<langle>b,?max\\<rangle>\\<in>r\" unfolding Infimum_def using Order_ZF_4_L3(2)[OF _ Hmax] assms(1)\n        unfolding IsLinOrder_def by auto\n      with m have \"False\" using assms(1) unfolding IsLinOrder_def antisym_def by auto\n    }\n    moreover note V(3)\n    ultimately have \"False\" by auto\n  } \n  then show ?thesis by auto\nqed\n\nsubsection\\<open>Numerability axioms\\<close>\n\ntext\\<open>A $\\kappa$-separable order topology is in relation with order density.\\<close>\n\ntext\\<open>If an order topology has a subset $A$ which is topologically\ndense, then that subset is weakly order-dense in $X$.\\<close>\n\nlemma dense_top_imp_Wdense_ord:\n  assumes \"IsLinOrder(X,r)\" \"Closure(A,OrdTopology X r)=X\" \"A\\<subseteq>X\" \"\\<exists>x y. x \\<noteq> y \\<and> x \\<in> X \\<and> y \\<in> X\"\n  shows \"A{is weakly dense in}X{with respect to}r\"\nproof-\n  {\n    fix r1 r2 assume \"r1\\<in>X\"\"r2\\<in>X\"\"r1\\<noteq>r2\" \"\\<langle>r1,r2\\<rangle>\\<in>r\"\n    then have \"IntervalX(X,r,r1,r2)\\<in>{IntervalX(X, r, b, c) . \\<langle>b,c\\<rangle> \\<in> X \\<times> X} \\<union> {LeftRayX(X, r, b) . b \\<in> X} \\<union>\n      {RightRayX(X, r, b) . b \\<in> X}\" by auto\n    then have P:\"IntervalX(X,r,r1,r2)\\<in>(OrdTopology X r)\" using base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]]\n      by auto\n    have \"IntervalX(X,r,r1,r2)\\<subseteq>X\" unfolding IntervalX_def by auto\n    then have int:\"Closure(A,OrdTopology X r)\\<inter>IntervalX(X,r,r1,r2)=IntervalX(X,r,r1,r2)\" using assms(2) by auto\n    {\n      assume \"IntervalX(X,r,r1,r2)\\<noteq>0\"\n      then have \"A\\<inter>(IntervalX(X,r,r1,r2))\\<noteq>0\" using topology0.cl_inter_neigh[OF topology0_ordtopology[OF assms(1)] _ P , of \"A\"]\n        using assms(3) union_ordtopology[OF assms(1,4)] int by auto\n    }\n    then have \"(\\<exists>z\\<in>A-{r1,r2}. \\<langle>r1,z\\<rangle>\\<in>r\\<and>\\<langle>z,r2\\<rangle>\\<in>r)\\<or>IntervalX(X,r,r1,r2)=0\" unfolding IntervalX_def\n      Interval_def by auto\n  }\n  then show ?thesis unfolding IsWeaklyDenseSub_def by auto\nqed\n\ntext\\<open>Conversely, a weakly order-dense set is topologically dense if it is also considered\nthat: if there is a maximum or a minimum elements whose singletons are open, this points\nhave to be in $A$. In conclusion, weakly order-density is a property closed to topological density.\\<close>\n\ntext\\<open>Another way to see this: Consider a weakly order-dense set $A$:\n\\begin{itemize}\n\\item If $X$ has a maximum and a minimum and $\\{min,max\\}$ is open: $A$ is topologically dense in $X\\setminus\\{min,max\\}$, where $min$ is the minimum in $X$ and $max$ is the maximum in $X$.\n\\item If $X$ has a maximum, $\\{max\\}$ is open and $X$ has no minimum\n  or $\\{min\\}$ isn't open: $A$ is topologically dense in $X\\setminus\\{max\\}$, where $max$ is the maximum in $X$.\n\\item If $X$ has a minimum, $\\{min\\}$ is open and $X$ has no maximum\n  or $\\{max\\}$ isn't open $A$ is topologically dense in $X\\setminus\\{min\\}$, where $min$ is the minimum in $X$.\n\\item If $X$ has no minimum or maximum, or $\\{min,max\\}$ has no proper open sets: $A$ is topologically dense in $X$.\n\\end{itemize}\n\\<close>\n\nlemma Wdense_ord_imp_dense_top:\n  assumes \"IsLinOrder(X,r)\" \"A{is weakly dense in}X{with respect to}r\" \"A\\<subseteq>X\" \"\\<exists>x y. x \\<noteq> y \\<and> x \\<in> X \\<and> y \\<in> X\"\n    \"HasAminimum(r,X)\\<longrightarrow>{Minimum(r,X)}\\<in>(OrdTopology X r)\\<longrightarrow>Minimum(r,X)\\<in>A\"\n    \"HasAmaximum(r,X)\\<longrightarrow>{Maximum(r,X)}\\<in>(OrdTopology X r)\\<longrightarrow>Maximum(r,X)\\<in>A\"\n  shows \"Closure(A,OrdTopology X r)=X\"\nproof-\n  {\n    fix x assume \"x\\<in>X\"\n  {\n    fix U assume ass:\"x\\<in>U\"\"U\\<in>(OrdTopology X r)\"\n    then have \"\\<exists>V\\<in>{IntervalX(X, r, b, c) . \\<langle>b,c\\<rangle> \\<in> X \\<times> X} \\<union> {LeftRayX(X, r, b) . b \\<in> X} \\<union> {RightRayX(X, r, b) . b \\<in> X} . V\\<subseteq>U\\<and>x\\<in>V\"\n      using point_open_base_neigh[OF Ordtopology_is_a_topology(2)[OF assms(1)]] by auto\n    then obtain V where V:\"V\\<in>{IntervalX(X, r, b, c) . \\<langle>b,c\\<rangle> \\<in> X \\<times> X} \\<union> {LeftRayX(X, r, b) . b \\<in> X} \\<union> {RightRayX(X, r, b) . b \\<in> X}\" \"V\\<subseteq>U\" \"x\\<in>V\"\n      by blast\n    note V(1) moreover\n    {\n      assume \"V\\<in>{IntervalX(X, r, b, c) . \\<langle>b,c\\<rangle> \\<in> X \\<times> X}\"\n      then obtain b c where b:\"b\\<in>X\"\"c\\<in>X\"\"V=IntervalX(X, r, b, c)\" by auto\n      with V(3) have x:\"\\<langle>b,x\\<rangle>\\<in>r\" \"\\<langle>x,c\\<rangle>\\<in>r\" \"x\\<noteq>b\" \"x\\<noteq>c\" unfolding IntervalX_def Interval_def by auto\n      then have \"\\<langle>b,c\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def trans_def by fast\n      moreover from x(1-3) have \"b\\<noteq>c\" using assms(1) unfolding IsLinOrder_def antisym_def by fast\n      moreover note assms(2) b V(3)\n      ultimately have \"\\<exists>z\\<in>A-{b,c}. \\<langle>b,z\\<rangle>\\<in>r\\<and>\\<langle>z,c\\<rangle>\\<in>r\" unfolding IsWeaklyDenseSub_def by auto\n      then obtain z where \"z\\<in>A\"\"z\\<noteq>b\"\"z\\<noteq>c\"\"\\<langle>b,z\\<rangle>\\<in>r\"\"\\<langle>z,c\\<rangle>\\<in>r\" by auto\n      with assms(3) have \"z\\<in>A\"\"z\\<in>IntervalX(X, r, b, c)\" unfolding IntervalX_def Interval_def by auto\n      then have \"A\\<inter>U\\<noteq>0\" using V(2) b(3) by auto\n    }\n    moreover\n    {\n      assume \"V\\<in>{RightRayX(X, r, b) . b \\<in> X}\"\n      then obtain b where b:\"b\\<in>X\"\"V=RightRayX(X, r, b)\" by auto\n      with V(3) have x:\"\\<langle>b,x\\<rangle>\\<in>r\" \"b\\<noteq>x\" unfolding RightRayX_def by auto moreover\n      note b(1) moreover\n      have \"U\\<subseteq>\\<Union>(OrdTopology X r)\" using ass(2) by auto\n      then have \"U\\<subseteq>X\" using union_ordtopology[OF assms(1,4)] by auto\n      then have \"x\\<in>X\" using ass(1) by auto moreover\n      note assms(2) ultimately\n      have disj:\"(\\<exists>z\\<in>A-{b,x}. \\<langle>b,z\\<rangle>\\<in>r\\<and>\\<langle>z,x\\<rangle>\\<in>r)\\<or> IntervalX(X, r, b, x) = 0\" unfolding IsWeaklyDenseSub_def by auto\n      {\n        assume B:\"IntervalX(X, r, b, x) = 0\"\n        {\n          assume \"\\<exists>y\\<in>X. \\<langle>x,y\\<rangle>\\<in>r \\<and> x\\<noteq>y\"\n          then obtain y where y:\"y\\<in>X\"\"\\<langle>x,y\\<rangle>\\<in>r\" \"x\\<noteq>y\" by auto\n          with x have \"x\\<in>IntervalX(X,r,b,y)\" unfolding IntervalX_def Interval_def\n            using \\<open>x\\<in>X\\<close> by auto moreover\n          have \"\\<langle>b,y\\<rangle>\\<in>r\" using y(2) x(1) assms(1) unfolding IsLinOrder_def trans_def by fast\n          moreover have \"b\\<noteq>y\" using y(2,3) x(1) assms(1) unfolding IsLinOrder_def antisym_def by fast\n          ultimately\n          have \"(\\<exists>z\\<in>A-{b,y}. \\<langle>b,z\\<rangle>\\<in>r\\<and>\\<langle>z,y\\<rangle>\\<in>r)\" using assms(2) unfolding IsWeaklyDenseSub_def\n            using y(1) b(1) by auto\n          then obtain z where \"z\\<in>A\"\"\\<langle>b,z\\<rangle>\\<in>r\"\"b\\<noteq>z\" by auto\n          then have \"z\\<in>A\\<inter>V\" using b(2) unfolding RightRayX_def using assms(3) by auto\n          then have \"z\\<in>A\\<inter>U\" using V(2) by auto\n          then have \"A\\<inter>U\\<noteq>0\" by auto\n        }\n        moreover\n        {\n          assume R:\"\\<forall>y\\<in>X. \\<langle>x,y\\<rangle>\\<in>r\\<longrightarrow>x=y\"\n          {\n            fix y assume \"y\\<in>RightRayX(X,r,b)\"\n            then have y:\"\\<langle>b,y\\<rangle>\\<in>r\" \"y\\<in>X-{b}\" unfolding RightRayX_def by auto\n            {\n              assume A:\"y\\<noteq>x\"\n              then have \"\\<langle>x,y\\<rangle>\\<notin>r\" using R y(2) by auto\n              then have \"\\<langle>y,x\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def IsTotal_def\n                using \\<open>x\\<in>X\\<close> y(2) by auto\n              with A y have \"y\\<in>IntervalX(X,r,b,x)\" unfolding IntervalX_def Interval_def\n                by auto\n              then have \"False\" using B by auto\n            }\n            then have \"y=x\" by auto\n          }\n          then have \"RightRayX(X,r,b)={x}\" using V(3) b(2) by blast\n          moreover\n          {\n            fix t assume T:\"t\\<in>X\"\n            {\n              assume \"t=x\"\n              then have \"\\<langle>t,x\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def\n                using Order_ZF_1_L1 T by auto\n            }\n            moreover\n            {\n              assume \"t\\<noteq>x\"\n              then have \"\\<langle>x,t\\<rangle>\\<notin>r\" using R T by auto\n              then have \"\\<langle>t,x\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def IsTotal_def\n                using T \\<open>x\\<in>X\\<close> by auto\n            }\n            ultimately have \"\\<langle>t,x\\<rangle>\\<in>r\" by auto\n          }\n          with \\<open>x\\<in>X\\<close> have HM:\"HasAmaximum(r,X)\" unfolding HasAmaximum_def by auto\n          then have \"Maximum(r,X)\\<in>X\"\"\\<forall>t\\<in>X. \\<langle>t,Maximum(r,X)\\<rangle>\\<in>r\" using Order_ZF_4_L3 assms(1) unfolding IsLinOrder_def\n            by auto\n          with R \\<open>x\\<in>X\\<close> have xm:\"x=Maximum(r,X)\" by auto\n          moreover note b(2)\n          ultimately have \"V={Maximum(r,X)}\" by auto\n          then have \"{Maximum(r,X)}\\<in>(OrdTopology X r)\" using base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]]\n            V(1) by auto\n          with HM have \"Maximum(r,X)\\<in>A\" using assms(6) by auto\n          with xm have \"x\\<in>A\" by auto\n          with V(2,3) have \"A\\<inter>U\\<noteq>0\" by auto\n        }\n        ultimately have \"A\\<inter>U\\<noteq>0\" by auto\n      }\n      moreover\n      {\n        assume \"IntervalX(X, r, b, x) \\<noteq> 0\"\n        with disj have \"\\<exists>z\\<in>A-{b,x}. \\<langle>b,z\\<rangle>\\<in>r\\<and>\\<langle>z,x\\<rangle>\\<in>r\" by auto\n        then obtain z where \"z\\<in>A\"\"z\\<noteq>b\"\"\\<langle>b,z\\<rangle>\\<in>r\" by auto\n        then have \"z\\<in>A\"\"z\\<in>RightRayX(X,r,b)\" unfolding RightRayX_def using assms(3) by auto\n        then have \"z\\<in>A\\<inter>U\" using V(2) b(2) by auto\n        then have \"A\\<inter>U\\<noteq>0\" by auto\n      }\n      ultimately have \"A\\<inter>U\\<noteq>0\" by auto\n    }\n    moreover\n    {\n      assume \"V\\<in>{LeftRayX(X, r, b) . b \\<in> X}\"\n      then obtain b where b:\"b\\<in>X\"\"V=LeftRayX(X, r, b)\" by auto\n      with V(3) have x:\"\\<langle>x,b\\<rangle>\\<in>r\" \"b\\<noteq>x\" unfolding LeftRayX_def by auto moreover\n      note b(1) moreover\n      have \"U\\<subseteq>\\<Union>(OrdTopology X r)\" using ass(2) by auto\n      then have \"U\\<subseteq>X\" using union_ordtopology[OF assms(1,4)] by auto\n      then have \"x\\<in>X\" using ass(1) by auto moreover\n      note assms(2) ultimately\n      have disj:\"(\\<exists>z\\<in>A-{b,x}. \\<langle>x,z\\<rangle>\\<in>r\\<and>\\<langle>z,b\\<rangle>\\<in>r)\\<or> IntervalX(X, r, x, b) = 0\" unfolding IsWeaklyDenseSub_def by auto\n      {\n        assume B:\"IntervalX(X, r, x, b) = 0\"\n        {\n          assume \"\\<exists>y\\<in>X. \\<langle>y,x\\<rangle>\\<in>r \\<and> x\\<noteq>y\"\n          then obtain y where y:\"y\\<in>X\"\"\\<langle>y,x\\<rangle>\\<in>r\" \"x\\<noteq>y\" by auto\n          with x have \"x\\<in>IntervalX(X,r,y,b)\" unfolding IntervalX_def Interval_def\n            using \\<open>x\\<in>X\\<close> by auto moreover\n          have \"\\<langle>y,b\\<rangle>\\<in>r\" using y(2) x(1) assms(1) unfolding IsLinOrder_def trans_def by fast\n          moreover have \"b\\<noteq>y\" using y(2,3) x(1) assms(1) unfolding IsLinOrder_def antisym_def by fast\n          ultimately\n          have \"(\\<exists>z\\<in>A-{b,y}. \\<langle>y,z\\<rangle>\\<in>r\\<and>\\<langle>z,b\\<rangle>\\<in>r)\" using assms(2) unfolding IsWeaklyDenseSub_def\n            using y(1) b(1) by auto\n          then obtain z where \"z\\<in>A\"\"\\<langle>z,b\\<rangle>\\<in>r\"\"b\\<noteq>z\" by auto\n          then have \"z\\<in>A\\<inter>V\" using b(2) unfolding LeftRayX_def using assms(3) by auto\n          then have \"z\\<in>A\\<inter>U\" using V(2) by auto\n          then have \"A\\<inter>U\\<noteq>0\" by auto\n        }\n        moreover\n        {\n          assume R:\"\\<forall>y\\<in>X. \\<langle>y,x\\<rangle>\\<in>r\\<longrightarrow>x=y\"\n          {\n            fix y assume \"y\\<in>LeftRayX(X,r,b)\"\n            then have y:\"\\<langle>y,b\\<rangle>\\<in>r\" \"y\\<in>X-{b}\" unfolding LeftRayX_def by auto\n            {\n              assume A:\"y\\<noteq>x\"\n              then have \"\\<langle>y,x\\<rangle>\\<notin>r\" using R y(2) by auto\n              then have \"\\<langle>x,y\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def IsTotal_def\n                using \\<open>x\\<in>X\\<close> y(2) by auto\n              with A y have \"y\\<in>IntervalX(X,r,x,b)\" unfolding IntervalX_def Interval_def\n                by auto\n              then have \"False\" using B by auto\n            }\n            then have \"y=x\" by auto\n          }\n          then have \"LeftRayX(X,r,b)={x}\" using V(3) b(2) by blast\n          moreover\n          {\n            fix t assume T:\"t\\<in>X\"\n            {\n              assume \"t=x\"\n              then have \"\\<langle>x,t\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def\n                using Order_ZF_1_L1 T by auto\n            }\n            moreover\n            {\n              assume \"t\\<noteq>x\"\n              then have \"\\<langle>t,x\\<rangle>\\<notin>r\" using R T by auto\n              then have \"\\<langle>x,t\\<rangle>\\<in>r\" using assms(1) unfolding IsLinOrder_def IsTotal_def\n                using T \\<open>x\\<in>X\\<close> by auto\n            }\n            ultimately have \"\\<langle>x,t\\<rangle>\\<in>r\" by auto\n          }\n          with \\<open>x\\<in>X\\<close> have HM:\"HasAminimum(r,X)\" unfolding HasAminimum_def by auto\n          then have \"Minimum(r,X)\\<in>X\"\"\\<forall>t\\<in>X. \\<langle>Minimum(r,X),t\\<rangle>\\<in>r\" using Order_ZF_4_L4 assms(1) unfolding IsLinOrder_def\n            by auto\n          with R \\<open>x\\<in>X\\<close> have xm:\"x=Minimum(r,X)\" by auto\n          moreover note b(2)\n          ultimately have \"V={Minimum(r,X)}\" by auto\n          then have \"{Minimum(r,X)}\\<in>(OrdTopology X r)\" using base_sets_open[OF Ordtopology_is_a_topology(2)[OF assms(1)]]\n            V(1) by auto\n          with HM have \"Minimum(r,X)\\<in>A\" using assms(5) by auto\n          with xm have \"x\\<in>A\" by auto\n          with V(2,3) have \"A\\<inter>U\\<noteq>0\" by auto\n        }\n        ultimately have \"A\\<inter>U\\<noteq>0\" by auto\n      }\n      moreover\n      {\n        assume \"IntervalX(X, r, x, b) \\<noteq> 0\"\n        with disj have \"\\<exists>z\\<in>A-{b,x}. \\<langle>x,z\\<rangle>\\<in>r\\<and>\\<langle>z,b\\<rangle>\\<in>r\" by auto\n        then obtain z where \"z\\<in>A\"\"z\\<noteq>b\"\"\\<langle>z,b\\<rangle>\\<in>r\" by auto\n        then have \"z\\<in>A\"\"z\\<in>LeftRayX(X,r,b)\" unfolding LeftRayX_def using assms(3) by auto\n        then have \"z\\<in>A\\<inter>U\" using V(2) b(2) by auto\n        then have \"A\\<inter>U\\<noteq>0\" by auto\n      }\n      ultimately have \"A\\<inter>U\\<noteq>0\" by auto\n    }\n    ultimately have \"A\\<inter>U\\<noteq>0\" by auto\n  }\n  then have \"\\<forall>U\\<in>(OrdTopology X r). x\\<in>U \\<longrightarrow> U\\<inter>A\\<noteq>0\" by auto\n  moreover note \\<open>x\\<in>X\\<close> moreover\n  note assms(3) topology0.inter_neigh_cl[OF topology0_ordtopology[OF assms(1)]]\n  union_ordtopology[OF assms(1,4)] ultimately have \"x\\<in>Closure(A,OrdTopology X r)\"\n    by auto\n  }\n  then have \"X\\<subseteq>Closure(A,OrdTopology X r)\" by auto\n  with topology0.Top_3_L11(1)[OF topology0_ordtopology[OF assms(1)]]\n    assms(3) union_ordtopology[OF assms(1,4)] show ?thesis by auto\nqed\n\ntext\\<open>The conclusion is that an order topology is $\\kappa$-separable\niff there is a set $A$ with cardinality strictly less than $\\kappa$\nwhich is weakly-dense in $X$.\\<close>\n\ntheorem separable_imp_wdense:\n  assumes \"(OrdTopology X r){is separable of cardinal}Q\" \"\\<exists>x y. x \\<noteq> y \\<and> x \\<in> X \\<and> y \\<in> X\"\n    \"IsLinOrder(X,r)\"\n  shows \"\\<exists>A\\<in>Pow(X). A\\<prec>Q \\<and> (A{is weakly dense in}X{with respect to}r)\"\nproof-\n  from assms obtain U where \"U\\<in>Pow(\\<Union>(OrdTopology X r))\" \"Closure(U,OrdTopology X r)=\\<Union>(OrdTopology X r)\" \"U\\<prec>Q\"\n    unfolding IsSeparableOfCard_def by auto\n  then have \"U\\<in>Pow(X)\" \"Closure(U,OrdTopology X r)=X\" \"U\\<prec>Q\" using union_ordtopology[OF assms(3,2)]\n    by auto\n  with dense_top_imp_Wdense_ord[OF assms(3) _ _ assms(2)] show ?thesis by auto\nqed\n\ntheorem wdense_imp_separable:\n  assumes \"\\<exists>x y. x \\<noteq> y \\<and> x \\<in> X \\<and> y \\<in> X\" \"(A{is weakly dense in}X{with respect to}r)\"\n    \"IsLinOrder(X,r)\" \"A\\<prec>Q\" \"InfCard(Q)\" \"A\\<subseteq>X\"\n  shows \"(OrdTopology X r){is separable of cardinal}Q\"\nproof-\n  {\n    assume Hmin:\"HasAmaximum(r,X)\"\n    then have MaxX:\"Maximum(r,X)\\<in>X\" using Order_ZF_4_L3(1) assms(3) unfolding IsLinOrder_def\n      by auto\n    {\n      assume HMax:\"HasAminimum(r,X)\"\n      then have MinX:\"Minimum(r,X)\\<in>X\" using Order_ZF_4_L4(1) assms(3) unfolding IsLinOrder_def\n        by auto\n      let ?A=\"A \\<union>{Maximum(r,X),Minimum(r,X)}\"\n      have \"Finite({Maximum(r,X),Minimum(r,X)})\" by auto\n      then have \"{Maximum(r,X),Minimum(r,X)}\\<prec>nat\" using n_lesspoll_nat\n        unfolding Finite_def using eq_lesspoll_trans by auto\n      moreover\n      from assms(5) have \"nat\\<prec>Q\\<or>nat=Q\" unfolding InfCard_def\n        using lt_Card_imp_lesspoll[of \"Q\"\"nat\"] unfolding lt_def succ_def\n        using Card_is_Ord[of \"Q\"] by auto\n      ultimately have \"{Maximum(r,X),Minimum(r,X)}\\<prec>Q\" using lesspoll_trans by auto\n      with assms(4,5) have C:\"?A\\<prec>Q\" using less_less_imp_un_less\n        by auto\n      have WeakDense:\"?A{is weakly dense in}X{with respect to}r\" using assms(2) unfolding\n        IsWeaklyDenseSub_def by auto\n      from MaxX MinX assms(6) have S:\"?A\\<subseteq>X\" by auto\n      then have \"Closure(?A,OrdTopology X r)=X\" using Wdense_ord_imp_dense_top\n        [OF assms(3) WeakDense _ assms(1)] by auto\n      then have ?thesis unfolding IsSeparableOfCard_def using union_ordtopology[OF assms(3,1)]\n        S C by auto\n    }\n    moreover\n    {\n      assume nmin:\"\\<not>HasAminimum(r,X)\"\n       let ?A=\"A \\<union>{Maximum(r,X)}\"\n      have \"Finite({Maximum(r,X)})\" by auto\n      then have \"{Maximum(r,X)}\\<prec>nat\" using n_lesspoll_nat\n        unfolding Finite_def using eq_lesspoll_trans by auto\n      moreover\n      from assms(5) have \"nat\\<prec>Q\\<or>nat=Q\" unfolding InfCard_def\n        using lt_Card_imp_lesspoll[of \"Q\"\"nat\"] unfolding lt_def succ_def\n        using Card_is_Ord[of \"Q\"] by auto\n      ultimately have \"{Maximum(r,X)}\\<prec>Q\" using lesspoll_trans by auto\n      with assms(4,5) have C:\"?A\\<prec>Q\" using less_less_imp_un_less\n        by auto\n      have WeakDense:\"?A{is weakly dense in}X{with respect to}r\" using assms(2) unfolding\n        IsWeaklyDenseSub_def by auto\n      from MaxX assms(6) have S:\"?A\\<subseteq>X\" by auto\n      then have \"Closure(?A,OrdTopology X r)=X\" using Wdense_ord_imp_dense_top\n        [OF assms(3) WeakDense _ assms(1)] nmin by auto\n      then have ?thesis unfolding IsSeparableOfCard_def using union_ordtopology[OF assms(3,1)]\n        S C by auto\n    }\n    ultimately have ?thesis by auto\n  }\n  moreover\n  {\n    assume nmax:\"\\<not>HasAmaximum(r,X)\"\n    {\n      assume HMin:\"HasAminimum(r,X)\"\n      then have MinX:\"Minimum(r,X)\\<in>X\" using Order_ZF_4_L4(1) assms(3) unfolding IsLinOrder_def\n        by auto\n      let ?A=\"A \\<union>{Minimum(r,X)}\"\n      have \"Finite({Minimum(r,X)})\" by auto\n      then have \"{Minimum(r,X)}\\<prec>nat\" using n_lesspoll_nat\n        unfolding Finite_def using eq_lesspoll_trans by auto\n      moreover\n      from assms(5) have \"nat\\<prec>Q\\<or>nat=Q\" unfolding InfCard_def\n        using lt_Card_imp_lesspoll[of \"Q\"\"nat\"] unfolding lt_def succ_def\n        using Card_is_Ord[of \"Q\"] by auto\n      ultimately have \"{Minimum(r,X)}\\<prec>Q\" using lesspoll_trans by auto\n      with assms(4,5) have C:\"?A\\<prec>Q\" using less_less_imp_un_less\n        by auto\n      have WeakDense:\"?A{is weakly dense in}X{with respect to}r\" using assms(2) unfolding\n        IsWeaklyDenseSub_def by auto\n      from MinX assms(6) have S:\"?A\\<subseteq>X\" by auto\n      then have \"Closure(?A,OrdTopology X r)=X\" using Wdense_ord_imp_dense_top\n        [OF assms(3) WeakDense _ assms(1)] nmax by auto\n      then have ?thesis unfolding IsSeparableOfCard_def using union_ordtopology[OF assms(3,1)]\n        S C by auto\n    }\n    moreover\n    {\n      assume nmin:\"\\<not>HasAminimum(r,X)\"\n      let ?A=\"A\"\n      from assms(4,5) have C:\"?A\\<prec>Q\" by auto\n      have WeakDense:\"?A{is weakly dense in}X{with respect to}r\" using assms(2) unfolding\n        IsWeaklyDenseSub_def by auto\n      from assms(6) have S:\"?A\\<subseteq>X\" by auto\n      then have \"Closure(?A,OrdTopology X r)=X\" using Wdense_ord_imp_dense_top\n        [OF assms(3) WeakDense _ assms(1)] nmin nmax by auto\n      then have ?thesis unfolding IsSeparableOfCard_def using union_ordtopology[OF assms(3,1)]\n        S C by auto\n    }\n    ultimately have ?thesis by auto\n  }\n  ultimately show ?thesis by auto\nqed\n\n\nend\n\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/Topology_ZF_11.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.32814587438460197}}
{"text": "section\\<open>The Axiom of Unions in $M[G]$\\<close>\ntheory Union_Axiom\n  imports Names\nbegin\n\ncontext forcing_data\nbegin\n\n\ndefinition Union_name_body :: \"[i,i,i,i] \\<Rightarrow> o\" where\n  \"Union_name_body(P',leq',\\<tau>,\\<theta>p) \\<equiv> (\\<exists> \\<sigma>[##M].\n           \\<exists> q[##M]. (q\\<in> P' \\<and> (\\<langle>\\<sigma>,q\\<rangle> \\<in> \\<tau> \\<and>\n            (\\<exists> r[##M].r\\<in>P' \\<and> (\\<langle>fst(\\<theta>p),r\\<rangle> \\<in> \\<sigma> \\<and> \\<langle>snd(\\<theta>p),r\\<rangle> \\<in> leq' \\<and> \\<langle>snd(\\<theta>p),q\\<rangle> \\<in> leq')))))\"\n\ndefinition Union_name_fm :: \"i\" where\n  \"Union_name_fm \\<equiv>\n    Exists(\n    Exists(And(pair_fm(1,0,2),\n    Exists (\n    Exists (And(Member(0,7),\n      Exists (And(And(pair_fm(2,1,0),Member(0,6)),\n        Exists (And(Member(0,9),\n         Exists (And(And(pair_fm(6,1,0),Member(0,4)),\n          Exists (And(And(pair_fm(6,2,0),Member(0,10)),\n          Exists (And(pair_fm(7,5,0),Member(0,11)))))))))))))))))\"\n\nlemma Union_name_fm_type [TC]:\n  \"Union_name_fm \\<in>formula\"\n  unfolding Union_name_fm_def by simp\n\n\nlemma arity_Union_name_fm :\n  \"arity(Union_name_fm) = 4\"\n  unfolding Union_name_fm_def upair_fm_def pair_fm_def\n  by(auto simp add: nat_simp_union)\n\nlemma sats_Union_name_fm :\n  \"\\<lbrakk> a \\<in> M; b \\<in> M ; P' \\<in> M ; p \\<in> M ; \\<theta> \\<in> M ; \\<tau> \\<in> M ; leq' \\<in> M \\<rbrakk> \\<Longrightarrow>\n     sats(M,Union_name_fm,[\\<langle>\\<theta>,p\\<rangle>,\\<tau>,leq',P']@[a,b]) \\<longleftrightarrow>\n     Union_name_body(P',leq',\\<tau>,\\<langle>\\<theta>,p\\<rangle>)\"\n  unfolding Union_name_fm_def Union_name_body_def tuples_in_M\n  by (subgoal_tac \"\\<langle>\\<theta>,p\\<rangle> \\<in> M\", auto simp add : tuples_in_M)\n\n\nlemma domD :\n  assumes \"\\<tau> \\<in> M\" \"\\<sigma> \\<in> domain(\\<tau>)\"\n  shows \"\\<sigma> \\<in> M\"\n  using assms Transset_M trans_M\n  by (simp flip: setclass_iff)\n\n\ndefinition Union_name :: \"i \\<Rightarrow> i\" where\n  \"Union_name(\\<tau>) \\<equiv>\n    {u \\<in> domain(\\<Union>(domain(\\<tau>))) \\<times> P . Union_name_body(P,leq,\\<tau>,u)}\"\n\nlemma Union_name_M : assumes \"\\<tau> \\<in> M\"\n  shows \"{u \\<in> domain(\\<Union>(domain(\\<tau>))) \\<times> P . Union_name_body(P,leq,\\<tau>,u)} \\<in> M\"\n  unfolding Union_name_def\nproof -\n  let ?P=\"\\<lambda> x . sats(M,Union_name_fm,[x,\\<tau>,leq]@[P,\\<tau>,leq])\"\n  let ?Q=\"\\<lambda> x . Union_name_body(P,leq,\\<tau>,x)\"\n  from \\<open>\\<tau>\\<in>M\\<close>\n  have \"domain(\\<Union>(domain(\\<tau>)))\\<in>M\" (is \"?d \\<in> _\") using domain_closed Union_closed by simp\n  then\n  have \"?d \\<times> P \\<in> M\" using cartprod_closed P_in_M by simp\n  have \"arity(Union_name_fm)\\<le>6\" using arity_Union_name_fm by simp\n  from assms P_in_M leq_in_M  arity_Union_name_fm\n  have \"[\\<tau>,leq] \\<in> list(M)\" \"[P,\\<tau>,leq] \\<in> list(M)\" by auto\n  with assms assms P_in_M leq_in_M  \\<open>arity(Union_name_fm)\\<le>6\\<close>\n  have \"separation(##M,?P)\"\n    using separation_ax by simp\n  with \\<open>?d \\<times> P \\<in> M\\<close>\n  have A:\"{ u \\<in> ?d \\<times> P . ?P(u) } \\<in> M\"\n    using  separation_iff by force\n  have \"?P(x)\\<longleftrightarrow> ?Q(x)\" if \"x\\<in> ?d\\<times>P\" for x\n  proof -\n    from \\<open>x\\<in> ?d\\<times>P\\<close>\n    have \"x = \\<langle>fst(x),snd(x)\\<rangle>\" using Pair_fst_snd_eq by simp\n    with \\<open>x\\<in>?d\\<times>P\\<close> \\<open>?d\\<in>M\\<close>\n    have \"fst(x) \\<in> M\" \"snd(x) \\<in> M\"\n      using mtrans fst_type snd_type P_in_M unfolding M_trans_def by auto\n    then\n    have \"?P(\\<langle>fst(x),snd(x)\\<rangle>) \\<longleftrightarrow>  ?Q(\\<langle>fst(x),snd(x)\\<rangle>)\"\n      using P_in_M sats_Union_name_fm P_in_M \\<open>\\<tau>\\<in>M\\<close> leq_in_M by simp\n    with \\<open>x = \\<langle>fst(x),snd(x)\\<rangle>\\<close>\n    show \"?P(x) \\<longleftrightarrow> ?Q(x)\" using that by simp\n  qed\n  then show ?thesis using Collect_cong A by simp\nqed\n\n\n\nlemma Union_MG_Eq :\n  assumes \"a \\<in> M[G]\" and \"a = val(G,\\<tau>)\" and \"filter(G)\" and \"\\<tau> \\<in> M\"\n  shows \"\\<Union> a = val(G,Union_name(\\<tau>))\"\nproof -\n  {\n    fix x\n    assume \"x \\<in> \\<Union> (val(G,\\<tau>))\"\n    then obtain i where \"i \\<in> val(G,\\<tau>)\" \"x \\<in> i\" by blast\n    with \\<open>\\<tau> \\<in> M\\<close> obtain \\<sigma> q where\n      \"q \\<in> G\" \"\\<langle>\\<sigma>,q\\<rangle> \\<in> \\<tau>\" \"val(G,\\<sigma>) = i\" \"\\<sigma> \\<in> M\"\n      using elem_of_val_pair domD by blast\n    with \\<open>x \\<in> i\\<close> obtain \\<theta> r where\n      \"r \\<in> G\" \"\\<langle>\\<theta>,r\\<rangle> \\<in> \\<sigma>\" \"val(G,\\<theta>) = x\" \"\\<theta> \\<in> M\"\n      using elem_of_val_pair domD by blast\n    with \\<open>\\<langle>\\<sigma>,q\\<rangle>\\<in>\\<tau>\\<close> have \"\\<theta> \\<in> domain(\\<Union>(domain(\\<tau>)))\" by auto\n    with \\<open>filter(G)\\<close> \\<open>q\\<in>G\\<close> \\<open>r\\<in>G\\<close> obtain p where\n      A: \"p \\<in> G\" \"\\<langle>p,r\\<rangle> \\<in> leq\" \"\\<langle>p,q\\<rangle> \\<in> leq\" \"p \\<in> P\" \"r \\<in> P\" \"q \\<in> P\"\n      using low_bound_filter filterD  by blast\n    then have \"p \\<in> M\" \"q\\<in>M\" \"r\\<in>M\"\n      using mtrans P_in_M unfolding M_trans_def by auto\n    with A \\<open>\\<langle>\\<theta>,r\\<rangle> \\<in> \\<sigma>\\<close> \\<open>\\<langle>\\<sigma>,q\\<rangle> \\<in> \\<tau>\\<close> \\<open>\\<theta> \\<in> M\\<close> \\<open>\\<theta> \\<in> domain(\\<Union>(domain(\\<tau>)))\\<close>  \\<open>\\<sigma>\\<in>M\\<close> have\n      \"\\<langle>\\<theta>,p\\<rangle> \\<in> Union_name(\\<tau>)\" unfolding Union_name_def Union_name_body_def\n      by auto\n    with \\<open>p\\<in>P\\<close> \\<open>p\\<in>G\\<close> have \"val(G,\\<theta>) \\<in> val(G,Union_name(\\<tau>))\"\n      using val_of_elem by simp\n    with \\<open>val(G,\\<theta>)=x\\<close> have \"x \\<in> val(G,Union_name(\\<tau>))\" by simp\n  }\n  with \\<open>a=val(G,\\<tau>)\\<close> have 1: \"x \\<in> \\<Union> a \\<Longrightarrow> x \\<in> val(G,Union_name(\\<tau>))\" for x by simp\n  {\n    fix x\n    assume \"x \\<in> (val(G,Union_name(\\<tau>)))\"\n    then obtain \\<theta> p where\n      \"p \\<in> G\" \"\\<langle>\\<theta>,p\\<rangle> \\<in> Union_name(\\<tau>)\" \"val(G,\\<theta>) = x\"\n      using elem_of_val_pair by blast\n    with \\<open>filter(G)\\<close> have \"p\\<in>P\" using filterD by simp\n    from \\<open>\\<langle>\\<theta>,p\\<rangle> \\<in> Union_name(\\<tau>)\\<close> obtain \\<sigma> q r where\n      \"\\<sigma> \\<in> domain(\\<tau>)\"  \"\\<langle>\\<sigma>,q\\<rangle> \\<in> \\<tau> \" \"\\<langle>\\<theta>,r\\<rangle> \\<in> \\<sigma>\" \"r\\<in>P\" \"q\\<in>P\" \"\\<langle>p,r\\<rangle> \\<in> leq\" \"\\<langle>p,q\\<rangle> \\<in> leq\"\n      unfolding Union_name_def Union_name_body_def by force\n    with \\<open>p\\<in>G\\<close> \\<open>filter(G)\\<close> have \"r \\<in> G\" \"q \\<in> G\"\n      using filter_leqD by auto\n    with \\<open>\\<langle>\\<theta>,r\\<rangle> \\<in> \\<sigma>\\<close> \\<open>\\<langle>\\<sigma>,q\\<rangle>\\<in>\\<tau>\\<close> \\<open>q\\<in>P\\<close> \\<open>r\\<in>P\\<close> have\n      \"val(G,\\<sigma>) \\<in> val(G,\\<tau>)\" \"val(G,\\<theta>) \\<in> val(G,\\<sigma>)\"\n      using val_of_elem by simp+\n    then have \"val(G,\\<theta>) \\<in> \\<Union> val(G,\\<tau>)\" by blast\n    with \\<open>val(G,\\<theta>)=x\\<close> \\<open>a=val(G,\\<tau>)\\<close> have\n      \"x \\<in> \\<Union> a\" by simp\n  }\n  with \\<open>a=val(G,\\<tau>)\\<close>\n  have \"x \\<in> val(G,Union_name(\\<tau>)) \\<Longrightarrow> x \\<in> \\<Union> a\" for x by blast\n  then\n  show ?thesis using 1 by blast\nqed\n\nlemma union_in_MG : assumes \"filter(G)\"\n  shows \"Union_ax(##M[G])\"\nproof -\n  { fix a\n    assume \"a \\<in> M[G]\"\n    then\n    interpret mgtrans : M_trans \"##M[G]\"\n      using transitivity_MG by (unfold_locales; auto)\n    from \\<open>a\\<in>_\\<close> obtain \\<tau> where \"\\<tau> \\<in> M\" \"a=val(G,\\<tau>)\" using GenExtD by blast\n    then\n    have \"Union_name(\\<tau>) \\<in> M\" (is \"?\\<pi> \\<in> _\") using Union_name_M unfolding Union_name_def by simp\n    then\n    have \"val(G,?\\<pi>) \\<in> M[G]\" (is \"?U \\<in> _\") using GenExtI by simp\n    with \\<open>a\\<in>_\\<close>\n    have \"(##M[G])(a)\" \"(##M[G])(?U)\" by auto\n    with \\<open>\\<tau> \\<in> M\\<close> \\<open>filter(G)\\<close> \\<open>?U \\<in> M[G]\\<close> \\<open>a=val(G,\\<tau>)\\<close>\n    have \"big_union(##M[G],a,?U)\"\n      using Union_MG_Eq Union_abs  by simp\n    with \\<open>?U \\<in> M[G]\\<close>\n    have \"\\<exists>z[##M[G]]. big_union(##M[G],a,z)\" by force\n  }\n  then\n  have \"Union_ax(##M[G])\" unfolding Union_ax_def by force\n  then\n  show ?thesis by simp\nqed\n\ntheorem Union_MG : \"M_generic(G) \\<Longrightarrow> Union_ax(##M[G])\"\n  by (simp add:M_generic_def union_in_MG)\n\nend (* forcing_data *)\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Forcing/Union_Axiom.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.32814587438460197}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory WordLemmaBucket\nimports\n  Lib\n  MoreDivides\n  Aligned\n  HOLLemmaBucket\n  DistinctPropLemmaBucket\n  \"~~/src/HOL/Library/Sublist\"\n  \"~~/src/HOL/Library/Prefix_Order\"\nbegin\n\n(* Setup \"quickcheck\" to support words. *)\n\nquickcheck_generator word\n  constructors:\n    \"zero_class.zero :: ('a::len) word\",\n    \"numeral :: num \\<Rightarrow> ('a::len) word\",\n    \"uminus :: ('a::len) word \\<Rightarrow> ('a::len) word\"\n\ninstantiation Enum.finite_1 :: len\nbegin\n  definition \"len_of_finite_1 (x :: Enum.finite_1 itself) \\<equiv> (1 :: nat)\"\n  instance\n    by (default, auto simp: len_of_finite_1_def)\nend\n\ninstantiation Enum.finite_2 :: len\nbegin\n  definition \"len_of_finite_2 (x :: Enum.finite_2 itself) \\<equiv> (2 :: nat)\"\n  instance\n    by (default, auto simp: len_of_finite_2_def)\nend\n\ninstantiation Enum.finite_3 :: len\nbegin\n  definition \"len_of_finite_3 (x :: Enum.finite_3 itself) \\<equiv> (4 :: nat)\"\n  instance\n    by (default, auto simp: len_of_finite_3_def)\nend\n\n(* Provide wf and less_induct for word.\n   wf may be more useful in loop proofs, less_induct in recursion proofs. *)\nlemma word_less_wf: \"wf {(a, b). a < (b :: ('a::len) word)}\"\n  apply (rule wf_subset)\n  apply (rule wf_measure)\n  apply safe\n  apply (subst in_measure)\n  apply (erule unat_mono)\n  done\n\nlemma word_less_induct:\n  \"\\<lbrakk> \\<And>x::('a::len) word. (\\<And>y. y < x \\<Longrightarrow> P y) \\<Longrightarrow> P x \\<rbrakk> \\<Longrightarrow> P a\"\n  using word_less_wf\n  apply induct\n  apply blast\n  done\n\ninstantiation word :: (len) wellorder\nbegin\ninstance\n  apply (intro_classes)\n  apply (metis word_less_induct)\n  done\nend\n\n\nlemma word_plus_mono_left:\n  fixes x :: \"'a :: len word\"\n  shows \"\\<lbrakk>y \\<le> z; x \\<le> x + z\\<rbrakk> \\<Longrightarrow> y + x \\<le> z + x\"\n  by unat_arith\n\nlemma word_2p_mult_inc:\n  assumes x: \"2 * 2 ^ n < (2::'a::len word) * 2 ^ m\"\n  assumes suc_n: \"Suc n < len_of TYPE('a::len)\"\n  assumes suc_m: \"Suc m < len_of TYPE('a::len)\"\n  assumes 2: \"unat (2::'a::len word) = 2\"\n  shows \"2^n < (2::'a::len word)^m\"\nproof -\n  from suc_n\n  have \"(2::nat) * 2 ^ n mod 2 ^ len_of TYPE('a::len) = 2 * 2^n\"\n    apply (subst mod_less)\n     apply (subst power_Suc[symmetric])\n     apply (rule power_strict_increasing)\n      apply simp\n     apply simp\n    apply simp\n    done\n  moreover\n  from suc_m\n  have \"(2::nat) * 2 ^ m mod 2 ^ len_of TYPE('a::len) = 2 * 2^m\"\n    apply (subst mod_less)\n     apply (subst power_Suc[symmetric])\n     apply (rule power_strict_increasing)\n      apply simp\n     apply simp\n    apply simp\n    done\n  ultimately\n  have \"2 * 2 ^ n < (2::nat) * 2 ^ m\" using x\n    apply (unfold word_less_nat_alt)\n    apply simp\n    apply (subst (asm) unat_word_ariths(2))+\n    apply (subst (asm) 2)+\n    apply (subst (asm) word_unat_power, subst (asm) unat_of_nat)+\n    apply (simp add: mod_mult_right_eq[symmetric])\n    done\n  with suc_n suc_m\n  show ?thesis\n    unfolding word_less_nat_alt\n    apply (subst word_unat_power, subst unat_of_nat)+\n    apply simp\n    done\nqed\n\n\n\nlemma word_shiftl_add_distrib:\n  fixes x :: \"'a :: len word\"\n  shows \"(x + y) << n = (x << n) + (y << n)\"\n  by (simp add: shiftl_t2n ring_distribs)\n\nlemma upper_bits_unset_is_l2p:\n  \"n < word_bits \\<Longrightarrow> (\\<forall>n' \\<ge> n. n' < word_bits \\<longrightarrow> \\<not> p !! n') = ((p::word32) < 2 ^ n)\"\n  apply (rule iffI)\n   prefer 2\n   apply (clarsimp simp: word_bits_def)\n   apply (drule bang_is_le)\n   apply (drule_tac y=p in order_le_less_trans, assumption)\n   apply (drule word_power_increasing)\n      apply simp\n     apply simp\n    apply simp\n   apply simp\n  apply (subst mask_eq_iff_w2p [symmetric])\n   apply (clarsimp simp: word_size word_bits_def)\n  apply (rule word_eqI)\n  apply (clarsimp simp: word_size word_bits_def)\n  apply (case_tac \"na < n\", auto)\n  done\n\nlemma up_ucast_inj:\n  \"\\<lbrakk> ucast x = (ucast y::'b::len word); len_of TYPE('a) \\<le> len_of TYPE ('b) \\<rbrakk> \\<Longrightarrow> x = (y::'a::len word)\"\n  apply (subst (asm) bang_eq)\n  apply (fastforce simp: nth_ucast word_size intro: word_eqI)\n  done\n\nlemma up_ucast_inj_eq:\n  \"len_of TYPE('a) \\<le> len_of TYPE ('b) \\<Longrightarrow> (ucast x = (ucast y::'b::len word)) = (x = (y::'a::len word))\"\n  by (fastforce dest: up_ucast_inj)\n\nlemma ucast_up_inj:\n  \"\\<lbrakk> ucast x = (ucast y :: 'b::len word); len_of TYPE('a) \\<le> len_of TYPE('b) \\<rbrakk>\n  \\<Longrightarrow> x = (y :: 'a::len word)\"\n  apply (subst (asm) bang_eq)\n  apply (rule word_eqI)\n  apply (simp add: word_size nth_ucast)\n  apply (erule_tac x=n in allE)\n  apply simp\n  done\n\nlemma ucast_8_32_inj:\n  \"inj (ucast ::  8 word \\<Rightarrow> 32 word)\"\n  apply (rule down_ucast_inj)\n  apply (clarsimp simp: is_down_def target_size source_size)\n  done\n\nlemma no_plus_overflow_neg:\n  \"(x :: ('a :: len) word) < -y \\<Longrightarrow> x \\<le> x + y\"\n  apply (simp add: no_plus_overflow_uint_size\n                   word_less_alt uint_word_ariths\n                   word_size)\n  apply (subst(asm) zmod_zminus1_eq_if)\n  apply (simp split: split_if_asm)\n  done\n\nlemma ucast_ucast_eq:\n  fixes x :: \"'a::len word\"\n  fixes y :: \"'b::len word\"\n  shows\n  \"\\<lbrakk> ucast x = (ucast (ucast y::'a::len word)::'c::len word);\n    len_of TYPE('a) \\<le> len_of TYPE('b);\n    len_of TYPE('b) \\<le> len_of TYPE('c) \\<rbrakk> \\<Longrightarrow>\n  x = ucast y\"\n  apply (rule word_eqI)\n  apply (subst (asm) bang_eq)\n  apply (erule_tac x=n in allE)\n  apply (simp add: nth_ucast word_size)\n  done\n\n(******** GeneralLib ****************)\n\n\nlemma neq_into_nprefixeq:\n  \"\\<lbrakk> x \\<noteq> take (length x) y \\<rbrakk> \\<Longrightarrow> \\<not> x \\<le> y\"\n  by (clarsimp simp: prefixeq_def less_eq_list_def)\n\nlemma suffixeq_drop [simp]:\n  \"suffixeq (drop n as) as\"\n  unfolding suffixeq_def\n  apply (rule exI [where x = \"take n as\"])\n  apply simp\n  done\n\nlemma suffixeq_eqI:\n  \"\\<lbrakk> suffixeq xs as; suffixeq xs bs; length as = length bs;\n    take (length as - length xs) as \\<le> take (length bs - length xs) bs\\<rbrakk> \\<Longrightarrow> as = bs\"\n  by (clarsimp elim!: prefixE suffixeqE)\n\nlemma suffixeq_Cons_mem:\n  \"suffixeq (x # xs) as \\<Longrightarrow> x \\<in> set as\"\n  apply (drule suffixeq_set_subset)\n  apply simp\n  done\n\nlemma distinct_imply_not_in_tail:\n  \"\\<lbrakk> distinct list; suffixeq (y # ys) list\\<rbrakk> \\<Longrightarrow> y \\<notin> set ys\"\n  by (clarsimp simp:suffixeq_def)\n\nlemma list_induct_suffixeq [case_names Nil Cons]:\n  assumes nilr: \"P []\"\n  and    consr: \"\\<And>x xs. \\<lbrakk>P xs; suffixeq (x # xs) as \\<rbrakk> \\<Longrightarrow> P (x # xs)\"\n  shows  \"P as\"\nproof -\n  def as' == as\n\n  have \"suffixeq as as'\" unfolding as'_def by simp\n  thus ?thesis\n  proof (induct as)\n    case Nil show ?case by fact\n  next\n    case (Cons x xs)\n\n    show ?case\n    proof (rule consr)\n      from Cons.prems show \"suffixeq (x # xs) as\" unfolding as'_def .\n      hence \"suffixeq xs as'\" by (auto dest: suffixeq_ConsD simp: as'_def)\n      thus \"P xs\" using Cons.hyps by simp\n    qed\n  qed\nqed\n\ntext {* Parallel etc. and lemmas for list prefix *}\n\nlemma prefix_induct [consumes 1, case_names Nil Cons]:\n  fixes prefix\n  assumes np: \"prefix \\<le> lst\"\n  and base:   \"\\<And>xs. P [] xs\"\n  and rl:     \"\\<And>x xs y ys. \\<lbrakk> x = y; xs \\<le> ys; P xs ys \\<rbrakk> \\<Longrightarrow> P (x#xs) (y#ys)\"\n  shows \"P prefix lst\"\n  using np\nproof (induct prefix arbitrary: lst)\n  case Nil show ?case by fact\nnext\n  case (Cons x xs)\n\n  have prem: \"(x # xs) \\<le> lst\" by fact\n  then obtain y ys where lv: \"lst = y # ys\"\n    by (rule prefixE, auto)\n\n  have ih: \"\\<And>lst. xs \\<le> lst \\<Longrightarrow> P xs lst\" by fact\n\n  show ?case using prem\n    by (auto simp: lv intro!: rl ih)\nqed\n\nlemma not_prefix_cases:\n  fixes prefix\n  assumes pfx: \"\\<not> prefix \\<le> lst\"\n  and c1: \"\\<lbrakk> prefix \\<noteq> []; lst = [] \\<rbrakk> \\<Longrightarrow> R\"\n  and c2: \"\\<And>a as x xs. \\<lbrakk> prefix = a#as; lst = x#xs; x = a; \\<not> as \\<le> xs\\<rbrakk> \\<Longrightarrow> R\"\n  and c3: \"\\<And>a as x xs. \\<lbrakk> prefix = a#as; lst = x#xs; x \\<noteq> a\\<rbrakk> \\<Longrightarrow> R\"\n  shows \"R\"\nproof (cases prefix)\n  case Nil thus ?thesis using pfx by simp\nnext\n  case (Cons a as)\n\n  have c: \"prefix = a#as\" by fact\n\n  show ?thesis\n  proof (cases lst)\n    case Nil thus ?thesis\n      by (intro c1, simp add: Cons)\n  next\n    case (Cons x xs)\n    show ?thesis\n    proof (cases \"x = a\")\n      case True\n      show ?thesis\n      proof (intro c2)\n     \tshow \"\\<not> as \\<le> xs\" using pfx c Cons True\n\t  by simp\n      qed fact+\n    next\n      case False\n      show ?thesis by (rule c3) fact+\n    qed\n  qed\nqed\n\nlemma not_prefix_induct [consumes 1, case_names Nil Neq Eq]:\n  fixes prefix\n  assumes np: \"\\<not> prefix \\<le> lst\"\n  and base:   \"\\<And>x xs. P (x#xs) []\"\n  and r1:     \"\\<And>x xs y ys. x \\<noteq> y \\<Longrightarrow> P (x#xs) (y#ys)\"\n  and r2:     \"\\<And>x xs y ys. \\<lbrakk> x = y; \\<not> xs \\<le> ys; P xs ys \\<rbrakk> \\<Longrightarrow> P (x#xs) (y#ys)\"\n  shows \"P prefix lst\"\n  using np\nproof (induct lst arbitrary: prefix)\n  case Nil thus ?case\n    by (auto simp: neq_Nil_conv elim!: not_prefix_cases intro!: base)\nnext\n  case (Cons y ys)\n\n  have npfx: \"\\<not> prefix \\<le> (y # ys)\" by fact\n  then obtain x xs where pv: \"prefix = x # xs\"\n    by (rule not_prefix_cases) auto\n\n  have ih: \"\\<And>prefix. \\<not> prefix \\<le> ys \\<Longrightarrow> P prefix ys\" by fact\n\n  show ?case using npfx\n    by (simp only: pv) (erule not_prefix_cases, auto intro: r1 r2 ih)\nqed\n\ntext {* right-padding a word to a certain length *}\n\nlemma bl_pad_to_prefix:\n  \"bl \\<le> bl_pad_to bl sz\"\n  by (simp add: bl_pad_to_def)\n\nlemma same_length_is_parallel:\n  assumes len: \"\\<forall>y \\<in> set as. length y = x\"\n  shows  \"\\<forall>x \\<in> set as. \\<forall>y \\<in> set as - {x}. x \\<parallel> y\"\nproof (rule, rule)\n  fix x y\n  assume xi: \"x \\<in> set as\" and yi: \"y \\<in> set as - {x}\"\n  from len obtain q where len': \"\\<forall>y \\<in> set as. length y = q\" ..\n\n  show \"x \\<parallel> y\"\n  proof (rule not_equal_is_parallel)\n    from xi yi show \"x \\<noteq> y\" by auto\n    from xi yi len' show \"length x = length y\" by (auto dest: bspec)\n  qed\nqed\n\ntext {* Lemmas about words *}\n\nlemma word_bits_len_of: \"len_of TYPE (32) = word_bits\"\n  by (simp add: word_bits_conv)\n\nlemmas unat_power_lower32 [simp] = unat_power_lower[where 'a=32, unfolded word_bits_len_of]\n\nlemmas and_bang = word_and_nth\n\nlemma of_drop_to_bl:\n  \"of_bl (drop n (to_bl x)) = (x && mask (size x - n))\"\n  apply (clarsimp simp: bang_eq test_bit_of_bl rev_nth cong: rev_conj_cong)\n  apply (safe, simp_all add: word_size to_bl_nth)\n  done\n\nlemma word_add_offset_less:\n  fixes x :: \"'a :: len word\"\n  assumes yv: \"y < 2 ^ n\"\n  and     xv: \"x < 2 ^ m\"\n  and     mnv: \"sz < len_of TYPE('a :: len)\"\n  and    xv': \"x < 2 ^ (len_of TYPE('a :: len) - n)\"\n  and     mn: \"sz = m + n\"\n  shows   \"x * 2 ^ n + y < 2 ^ sz\"\nproof (subst mn)\n  from mnv mn have nv: \"n < len_of TYPE('a)\" and mv: \"m < len_of TYPE('a)\"  by auto\n\n  have uy: \"unat y < 2 ^ n\"\n     by (rule order_less_le_trans [OF unat_mono [OF yv] order_eq_refl],\n       rule unat_power_lower[OF nv])\n\n  have ux: \"unat x < 2 ^ m\"\n     by (rule order_less_le_trans [OF unat_mono [OF xv] order_eq_refl],\n       rule unat_power_lower[OF mv])\n\n  thus \"x * 2 ^ n + y < 2 ^ (m + n)\" using ux uy nv mnv xv'\n  apply (subst word_less_nat_alt)\n  apply (subst unat_word_ariths word_bits_len_of)+\n  apply (subst mod_less)\n   apply simp\n   apply (subst mult.commute)\n   apply (rule nat_less_power_trans [OF _ order_less_imp_le [OF nv]])\n    apply (rule order_less_le_trans [OF unat_mono [OF xv']])\n    apply (cases \"n = 0\")\n       apply simp\n      apply simp\n    apply (subst unat_power_lower[OF nv])\n    apply (subst mod_less)\n   apply (erule order_less_le_trans [OF nat_add_offset_less], assumption)\n    apply (rule mn)\n   apply simp\n  apply (simp add: mn mnv)\n  apply (erule nat_add_offset_less)\n  apply simp+\n  done\nqed\n\nlemma word_less_power_trans:\n  fixes n :: \"'a :: len word\"\n  assumes nv: \"n < 2 ^ (m - k)\"\n  and     kv: \"k \\<le> m\"\n  and     mv: \"m < len_of TYPE ('a)\"\n  shows \"2 ^ k * n < 2 ^ m\"\n  using nv kv mv\n  apply -\n  apply (subst word_less_nat_alt)\n  apply (subst unat_word_ariths)\n  apply (subst mod_less)\n   apply simp\n   apply (rule nat_less_power_trans)\n    apply (erule order_less_trans [OF unat_mono])\n    apply simp\n   apply simp\n  apply simp\n  apply (rule nat_less_power_trans)\n   apply (subst unat_power_lower[where 'a = 'a, symmetric])\n    apply simp\n   apply (erule unat_mono)\n  apply simp\n  done\n\nlemma word_less_sub_le[simp]:\n  fixes x :: \"'a :: len word\"\n  assumes nv: \"n < len_of TYPE('a)\"\n  shows \"(x \\<le> 2 ^ n - 1) = (x < 2 ^ n)\"\nproof -\n  have \"Suc (unat ((2::'a word) ^ n - 1)) = unat ((2::'a word) ^ n)\" using nv\n    by (metis Suc_pred' power_2_ge_iff unat_gt_0 unat_minus_one word_not_simps(1))\n\n  thus ?thesis using nv\n    apply -\n    apply (subst word_le_nat_alt)\n    apply (subst less_Suc_eq_le [symmetric])\n    apply (erule ssubst)\n    apply (subst word_less_nat_alt)\n    apply (rule refl)\n    done\nqed\n\nlemmas word32_less_sub_le[simp] =\n       word_less_sub_le[where 'a = 32, folded word_bits_def]\n\nlemma Suc_unat_diff_1:\n  fixes x :: \"'a :: len word\"\n  assumes lt: \"1 \\<le> x\"\n  shows \"Suc (unat (x - 1)) = unat x\"\nproof -\n  have \"0 < unat x\"\n    by (rule order_less_le_trans [where y = 1], simp, subst unat_1 [symmetric], rule iffD1 [OF word_le_nat_alt lt])\n\n  thus ?thesis\n    by ((subst unat_sub [OF lt])+, simp only:  unat_1)\nqed\n\nlemma word_div_sub:\n  fixes x :: \"'a :: len word\"\n  assumes yx: \"y \\<le> x\"\n  and     y0: \"0 < y\"\n  shows \"(x - y) div y = x div y - 1\"\n  apply (rule word_unat.Rep_eqD)\n  apply (subst unat_div)\n  apply (subst unat_sub [OF yx])\n  apply (subst unat_sub)\n   apply (subst word_le_nat_alt)\n   apply (subst unat_div)\n   apply (subst le_div_geq)\n     apply (rule order_le_less_trans [OF _ unat_mono [OF y0]])\n     apply simp\n    apply (subst word_le_nat_alt [symmetric], rule yx)\n   apply simp\n  apply (subst unat_div)\n  apply (subst le_div_geq [OF _ iffD1 [OF word_le_nat_alt yx]])\n   apply (rule order_le_less_trans [OF _ unat_mono [OF y0]])\n   apply simp\n  apply simp\n  done\n\nlemma word_mult_less_mono1:\n  fixes i :: \"'a :: len word\"\n  assumes ij: \"i < j\"\n  and    knz: \"0 < k\"\n  and    ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"i * k < j * k\"\nproof -\n  from ij ujk knz have jk: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n    by (auto intro: order_less_subst2 simp: word_less_nat_alt elim: mult_less_mono1)\n\n  thus ?thesis using ujk knz ij\n    by (auto simp: word_less_nat_alt iffD1 [OF unat_mult_lem])\nqed\n\nlemma word_mult_less_dest:\n  fixes i :: \"'a :: len word\"\n  assumes ij: \"i * k < j * k\"\n  and    uik: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n  and    ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"i < j\"\n  using uik ujk ij\n  by (auto simp: word_less_nat_alt iffD1 [OF unat_mult_lem] elim: mult_less_mono1)\n\nlemma word_mult_less_cancel:\n  fixes k :: \"'a :: len word\"\n  assumes knz: \"0 < k\"\n  and    uik: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n  and    ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n  shows \"(i * k < j * k) = (i < j)\"\n  by (rule iffI [OF word_mult_less_dest [OF _ uik ujk] word_mult_less_mono1 [OF _ knz ujk]])\n\nlemma Suc_div_unat_helper:\n  assumes szv: \"sz < len_of TYPE('a :: len)\"\n  and   usszv: \"us \\<le> sz\"\n  shows \"2 ^ (sz - us) = Suc (unat (((2::'a :: len word) ^ sz - 1) div 2 ^ us))\"\nproof -\n  note usv = order_le_less_trans [OF usszv szv]\n\n  from usszv obtain q where qv: \"sz = us + q\" by (auto simp: le_iff_add)\n\n  have \"Suc (unat (((2:: 'a word) ^ sz - 1) div 2 ^ us)) =\n    (2 ^ us + unat ((2:: 'a word) ^ sz - 1)) div 2 ^ us\"\n    apply (subst unat_div unat_power_lower[OF usv])+\n    apply (subst div_add_self1, simp+)\n    done\n\n  also have \"\\<dots> = ((2 ^ us - 1) + 2 ^ sz) div 2 ^ us\" using szv\n    apply (subst unat_minus_one)\n     apply (simp add: p2_eq_0)\n    apply simp\n    done\n\n  also have \"\\<dots> = 2 ^ q + ((2 ^ us - 1) div 2 ^ us)\"\n    apply (subst qv)\n    apply (subst power_add)\n    apply (subst div_mult_self2)\n    apply simp\n    apply (rule refl)\n    done\n\n  also have \"\\<dots> = 2 ^ (sz - us)\" using qv by simp\n\n  finally show ?thesis ..\nqed\n\nlemma upto_enum_red':\n  assumes lt: \"1 \\<le> X\"\n  shows \"[(0::'a :: len word) .e. X - 1] =  map of_nat [0 ..< unat X]\"\nproof -\n  have lt': \"unat X < 2 ^ len_of TYPE('a)\"\n    by (rule unat_lt2p)\n\n  show ?thesis\n    apply (subst upto_enum_red)\n    apply (simp del: upt.simps)\n    apply (subst Suc_unat_diff_1 [OF lt])\n    apply (rule map_cong [OF refl])\n    apply (rule toEnum_of_nat)\n    apply simp\n    apply (erule order_less_trans [OF _ lt'])\n    done\nqed\n\nlemma upto_enum_red2:\n  assumes szv: \"sz < len_of TYPE('a :: len)\"\n  shows \"[(0:: 'a :: len word) .e. 2 ^ sz - 1] =\n  map of_nat [0 ..< 2 ^ sz]\" using szv\n  apply (subst unat_power_lower[OF szv, symmetric])\n  apply (rule upto_enum_red')\n  apply (subst word_le_nat_alt, simp)\n  done\n\n(* FIXME: WordEnum.upto_enum_step_def is fixed to word32. *)\nlemma upto_enum_step_red:\n  assumes szv: \"sz < word_bits\"\n  and   usszv: \"us \\<le> sz\"\n  shows \"[0 , 2 ^ us .e. 2 ^ sz - 1] =\n  map (\\<lambda>x. of_nat x * 2 ^ us) [0 ..< 2 ^ (sz - us)]\" using szv\n  unfolding upto_enum_step_def\n  apply (subst if_not_P)\n   apply (rule leD)\n   apply (subst word_le_nat_alt)\n   apply (subst unat_minus_one)\n    apply (simp add: p2_eq_0 word_bits_def)\n   apply simp\n  apply simp\n  apply (subst upto_enum_red)\n  apply (simp del: upt.simps)\n  apply (subst Suc_div_unat_helper [where 'a = 32, folded word_bits_def, OF szv usszv, symmetric])\n  apply clarsimp\n  apply (subst toEnum_of_nat)\n   apply (subst word_bits_len_of)\n   apply (erule order_less_trans)\n   using szv\n   apply simp\n  apply simp\n  done\n\nlemma upto_enum_word:\n  \"[x .e. y] = map of_nat [unat x ..< Suc (unat y)]\"\n  apply (subst upto_enum_red)\n  apply clarsimp\n  apply (subst toEnum_of_nat)\n   prefer 2\n   apply (rule refl)\n  apply (erule disjE, simp)\n  apply clarsimp\n  apply (erule order_less_trans)\n  apply simp\n  done\n\ntext {* Lemmas about upto and upto_enum *}\n\nlemma word_upto_Cons_eq:\n  \"\\<lbrakk>x = z; x < y; Suc (unat y) < 2 ^ len_of TYPE('a)\\<rbrakk>\n   \\<Longrightarrow> [x::'a::len word .e. y] = z # [x + 1 .e. y]\"\n  apply (subst upto_enum_red)\n  apply (subst upt_conv_Cons)\n   apply (simp)\n   apply (drule unat_mono)\n   apply arith\n  apply (simp only: list.map)\n  apply (subst list.inject)\n  apply rule\n   apply (rule to_from_enum)\n   apply (subst upto_enum_red)\n  apply (rule map_cong [OF _ refl])\n  apply (rule arg_cong2 [where f = \"\\<lambda>x y. [x ..< y]\"])\n   apply unat_arith\n  apply simp\n  done\n\nlemma distinct_enum_upto:\n  \"distinct [(0 :: 'a::len word) .e. b]\"\nproof -\n  have \"\\<And>(b::'a word). [0 .e. b] = sublist enum {..< Suc (fromEnum b)}\"\n    apply (subst upto_enum_red)\n    apply (subst sublist_upt_eq_take)\n    apply (subst enum_word_def)\n    apply (subst take_map)\n    apply (subst take_upt)\n     apply (simp only: add_0 fromEnum_unat)\n     apply (rule order_trans [OF _ order_eq_refl])\n      apply (rule Suc_leI [OF unat_lt2p])\n     apply simp\n    apply clarsimp\n    apply (rule toEnum_of_nat)\n    apply (erule order_less_trans [OF _ unat_lt2p])\n    done\n\n  thus ?thesis\n    by (rule ssubst) (rule distinct_sublistI, simp)\nqed\n\nlemma upto_enum_set_conv [simp]:\n  fixes a :: \"'a :: len word\"\n  shows \"set [a .e. b] = {x. a \\<le> x \\<and> x \\<le> b}\"\n  apply (subst upto_enum_red)\n  apply (subst set_map)\n  apply safe\n    apply simp\n    apply clarsimp\n    apply (erule disjE)\n     apply simp\n     apply (erule iffD2 [OF word_le_nat_alt])\n    apply clarsimp\n    apply (erule word_unat.Rep_cases [OF unat_le [OF order_less_imp_le]])\n    apply simp\n    apply (erule iffD2 [OF word_le_nat_alt])\n   apply simp\n\n   apply clarsimp\n   apply (erule disjE)\n    apply simp\n   apply clarsimp\n   apply (rule word_unat.Rep_cases [OF unat_le  [OF order_less_imp_le]])\n    apply assumption\n   apply simp\n   apply (erule order_less_imp_le [OF iffD2 [OF word_less_nat_alt]])\n  apply clarsimp\n  apply (rule_tac x=\"fromEnum x\" in image_eqI)\n   apply clarsimp\n  apply clarsimp\n  apply (rule conjI)\n   apply (subst word_le_nat_alt [symmetric])\n   apply simp\n  apply safe\n   apply (simp add: word_le_nat_alt [symmetric])\n  apply (simp add: word_less_nat_alt [symmetric])\n  done\n\nlemma upto_enum_less:\n  assumes xin: \"x \\<in> set [(a::'a::len word).e.2 ^ n - 1]\"\n  and     nv:  \"n < len_of TYPE('a::len)\"\n  shows   \"x < 2 ^ n\"\nproof (cases n)\n  case 0\n  thus ?thesis using xin by simp\nnext\n  case (Suc m)\n  show ?thesis using xin nv by simp\nqed\n\nlemma upto_enum_len_less:\n  \"\\<lbrakk> n \\<le> length [a, b .e. c]; n \\<noteq> 0 \\<rbrakk> \\<Longrightarrow> a \\<le> c\"\n  unfolding upto_enum_step_def\n  by (simp split: split_if_asm)\n\nlemma length_upto_enum_step:\n  fixes x :: word32\n  shows \"x \\<le> z \\<Longrightarrow> length [x , y .e. z] = (unat ((z - x) div (y - x))) + 1\"\n  unfolding upto_enum_step_def\n  by (simp add: upto_enum_red)\n\nlemma length_upto_enum_one:\n  fixes x :: word32\n  assumes lt1: \"x < y\" and lt2: \"z < y\" and lt3: \"x \\<le> z\"\n  shows \"[x , y .e. z] = [x]\"\nunfolding upto_enum_step_def\nproof (subst upto_enum_red, subst if_not_P [OF leD [OF lt3]], clarsimp, rule)\n  show \"unat ((z - x) div (y - x)) = 0\"\n  proof (subst unat_div, rule div_less)\n    have syx: \"unat (y - x) = unat y - unat x\"\n      by (rule unat_sub [OF order_less_imp_le]) fact\n    moreover have \"unat (z - x) = unat z - unat x\"\n      by (rule unat_sub) fact\n\n    ultimately show \"unat (z - x) < unat (y - x)\"\n      using lt3\n      apply simp\n      apply (rule diff_less_mono[OF unat_mono, OF lt2])\n      apply (simp add: word_le_nat_alt[symmetric])\n      done\n  qed\n\n  thus \"toEnum (unat ((z - x) div (y - x))) * (y - x) = 0\" by simp\nqed\n\nlemma map_length_unfold_one:\n  fixes x :: \"'a::len word\"\n  assumes xv: \"Suc (unat x) < 2 ^ len_of TYPE('a)\"\n  and     ax: \"a < x\"\n  shows   \"map f [a .e. x] = f a # map f [a + 1 .e. x]\"\n  by (subst word_upto_Cons_eq, auto, fact+)\n\nlemma upto_enum_triv [simp]:\n  \"[x .e. x] = [x]\"\n  unfolding upto_enum_def by simp\n\n\n\nlemma of_nat_unat [simp]:\n  \"of_nat \\<circ> unat = id\"\n  by (rule ext, simp)\n\nlemma Suc_unat_minus_one [simp]:\n  \"x \\<noteq> 0 \\<Longrightarrow> Suc (unat (x - 1)) = unat x\"\n  by (metis Suc_diff_1 unat_gt_0 unat_minus_one)\n\ntext {* Lemmas about alignment *}\n\nlemma word_bits_size:\n  \"size (w::word32) = word_bits\"\n  by (simp add: word_bits_def word_size)\n\ntext {* Lemmas about defs in the specs *}\n\nlemma and_commute:\n  \"(X and Y) = (Y and X)\"\n  unfolding pred_conj_def by (auto simp: fun_eq_iff)\n\nlemma ptr_add_0 [simp]:\n  \"ptr_add ref 0 = ref \"\n  unfolding ptr_add_def by simp\n\n(* Other word lemmas *)\n\nlemma word_add_le_dest:\n  fixes i :: \"'a :: len word\"\n  assumes le: \"i + k \\<le> j + k\"\n  and    uik: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n  and    ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"i \\<le> j\"\n  using uik ujk le\n  by (auto simp: word_le_nat_alt iffD1 [OF unat_add_lem] elim: add_le_mono1)\n\nlemma mask_shift:\n  \"(x && ~~ mask y) >> y = x >> y\"\n  apply (rule word_eqI)\n  apply (simp add: nth_shiftr word_size)\n  apply safe\n  apply (drule test_bit.Rep[simplified, rule_format])\n  apply (simp add: word_size word_ops_nth_size)\n  done\n\nlemma word_add_le_mono1:\n  fixes i :: \"'a :: len word\"\n  assumes ij: \"i \\<le> j\"\n  and    ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"i + k \\<le> j + k\"\nproof -\n  from ij ujk have jk: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n    by (auto elim: order_le_less_subst2 simp: word_le_nat_alt elim: add_le_mono1)\n\n  thus ?thesis using ujk ij\n    by (auto simp: word_le_nat_alt iffD1 [OF unat_add_lem])\nqed\n\nlemma word_add_le_mono2:\n  fixes i :: \"('a :: len) word\"\n  shows \"\\<lbrakk>i \\<le> j; unat j + unat k < 2 ^ len_of TYPE('a)\\<rbrakk> \\<Longrightarrow> k + i \\<le> k + j\"\n  by (subst field_simps, subst field_simps, erule (1) word_add_le_mono1)\n\nlemma word_add_le_iff:\n  fixes i :: \"'a :: len word\"\n  assumes uik: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n  and     ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"(i + k \\<le> j + k) = (i \\<le> j)\"\nproof\n  assume \"i \\<le> j\"\n  show \"i + k \\<le> j + k\" by (rule word_add_le_mono1) fact+\nnext\n  assume \"i + k \\<le> j + k\"\n  show \"i \\<le> j\" by (rule word_add_le_dest) fact+\nqed\n\nlemma word_add_less_mono1:\n  fixes i :: \"'a :: len word\"\n  assumes ij: \"i < j\"\n  and    ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"i + k < j + k\"\nproof -\n  from ij ujk have jk: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n    by (auto elim: order_le_less_subst2 simp: word_less_nat_alt elim: add_less_mono1)\n\n  thus ?thesis using ujk ij\n    by (auto simp: word_less_nat_alt iffD1 [OF unat_add_lem])\nqed\n\nlemma word_add_less_dest:\n  fixes i :: \"'a :: len word\"\n  assumes le: \"i + k < j + k\"\n  and    uik: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n  and    ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"i < j\"\n  using uik ujk le\n  by (auto simp: word_less_nat_alt iffD1 [OF unat_add_lem] elim: add_less_mono1)\n\nlemma word_add_less_iff:\n  fixes i :: \"'a :: len word\"\n  assumes uik: \"unat i + unat k < 2 ^ len_of TYPE ('a)\"\n  and     ujk: \"unat j + unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"(i + k < j + k) = (i < j)\"\nproof\n  assume \"i < j\"\n  show \"i + k < j + k\" by (rule word_add_less_mono1) fact+\nnext\n  assume \"i + k < j + k\"\n  show \"i < j\" by (rule word_add_less_dest) fact+\nqed\n\nlemma shiftr_div_2n':\n  \"unat (w >> n) = unat w div 2 ^ n\"\n  apply (unfold unat_def)\n  apply (subst shiftr_div_2n)\n  apply (subst nat_div_distrib)\n   apply simp\n  apply (simp add: nat_power_eq)\n  done\n\nlemma shiftl_shiftr_id:\n  assumes nv: \"n < len_of TYPE('a :: len)\"\n  and     xv: \"x < 2 ^ (len_of TYPE('a :: len) - n)\"\n  shows \"x << n >> n = (x::'a::len word)\"\n  apply (simp add: shiftl_t2n)\n  apply (rule word_unat.Rep_eqD)\n  apply (subst shiftr_div_2n')\n  apply (cases n)\n   apply simp\n  apply (subst iffD1 [OF unat_mult_lem])+\n   apply (subst unat_power_lower[OF nv])\n   apply (rule nat_less_power_trans [OF _ order_less_imp_le [OF nv]])\n   apply (rule order_less_le_trans [OF unat_mono [OF xv] order_eq_refl])\n   apply (rule unat_power_lower)\n   apply simp\n  apply (subst unat_power_lower[OF nv])\n  apply simp\n  done\n\nlemma word_mult_less_iff:\n  fixes i :: \"'a :: len word\"\n  assumes knz: \"0 < k\"\n  and     uik: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n  and     ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"(i * k < j * k) = (i < j)\"\nproof\n  assume \"i < j\"\n  show \"i * k < j * k\" by (rule word_mult_less_mono1) fact+\nnext\n  assume p: \"i * k < j * k\"\n\n  have \"0 < unat k\" using knz by (simp add: word_less_nat_alt)\n  thus \"i < j\" using p\n    by (clarsimp simp: word_less_nat_alt iffD1 [OF unat_mult_lem uik]\n      iffD1 [OF unat_mult_lem ujk])\nqed\n\nlemma word_le_imp_diff_le:\n  fixes n :: \"'a::len word\"\n  shows \"\\<lbrakk>k \\<le> n; n \\<le> m\\<rbrakk> \\<Longrightarrow> n - k \\<le> m\"\n  by (clarsimp simp: unat_sub word_le_nat_alt intro!: le_imp_diff_le)\n\nlemma word_less_imp_diff_less:\n  fixes n :: \"'a::len word\"\n  shows \"\\<lbrakk>k \\<le> n; n < m\\<rbrakk> \\<Longrightarrow> n - k < m\"\n  by (clarsimp simp: unat_sub word_less_nat_alt\n             intro!: less_imp_diff_less)\n\nlemma word_mult_le_mono1:\n  fixes i :: \"'a :: len word\"\n  assumes ij: \"i \\<le> j\"\n  and    knz: \"0 < k\"\n  and    ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"i * k \\<le> j * k\"\nproof -\n  from ij ujk knz have jk: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n    by (auto elim: order_le_less_subst2 simp: word_le_nat_alt elim: mult_le_mono1)\n\n  thus ?thesis using ujk knz ij\n    by (auto simp: word_le_nat_alt iffD1 [OF unat_mult_lem])\nqed\n\nlemma word_mult_le_iff:\n  fixes i :: \"'a :: len word\"\n  assumes knz: \"0 < k\"\n  and     uik: \"unat i * unat k < 2 ^ len_of TYPE ('a)\"\n  and     ujk: \"unat j * unat k < 2 ^ len_of TYPE ('a)\"\n  shows  \"(i * k \\<le> j * k) = (i \\<le> j)\"\nproof\n  assume \"i \\<le> j\"\n  show \"i * k \\<le> j * k\" by (rule word_mult_le_mono1) fact+\nnext\n  assume p: \"i * k \\<le> j * k\"\n\n  have \"0 < unat k\" using knz by (simp add: word_less_nat_alt)\n  thus \"i \\<le> j\" using p\n    by (clarsimp simp: word_le_nat_alt iffD1 [OF unat_mult_lem uik]\n      iffD1 [OF unat_mult_lem ujk])\nqed\n\nlemma word_diff_less:\n  fixes n :: \"'a :: len word\"\n  shows \"\\<lbrakk>0 < n; 0 < m; n \\<le> m\\<rbrakk> \\<Longrightarrow> m - n < m\"\n  apply (subst word_less_nat_alt)\n  apply (subst unat_sub)\n   apply assumption\n  apply (rule diff_less)\n   apply (simp_all add: word_less_nat_alt)\n   done\n\nlemma MinI:\n  assumes fa: \"finite A\"\n  and     ne: \"A \\<noteq> {}\"\n  and     xv: \"m \\<in> A\"\n  and    min: \"\\<forall>y \\<in> A. m \\<le> y\"\n  shows \"Min A = m\" using fa ne xv min\nproof (induct A arbitrary: m rule: finite_ne_induct)\n  case singleton thus ?case by simp\nnext\n  case (insert y F)\n\n  from insert.prems have yx: \"m \\<le> y\" and fx: \"\\<forall>y \\<in> F. m \\<le> y\" by auto\n  have \"m \\<in> insert y F\" by fact\n  thus ?case\n  proof\n    assume mv: \"m = y\"\n\n    have mlt: \"m \\<le> Min F\"\n      by (rule iffD2 [OF Min_ge_iff [OF insert.hyps(1) insert.hyps(2)] fx])\n\n    show ?case\n      apply (subst Min_insert [OF insert.hyps(1) insert.hyps(2)])\n      apply (subst mv [symmetric])\n      apply (rule iffD2 [OF linorder_min_same1 mlt])\n      done\n  next\n    assume \"m \\<in> F\"\n    hence mf: \"Min F = m\"\n      by (rule insert.hyps(4) [OF _ fx])\n\n    show ?case\n      apply (subst Min_insert [OF insert.hyps(1) insert.hyps(2)])\n      apply (subst mf)\n      apply (rule iffD2 [OF linorder_min_same2 yx])\n      done\n  qed\nqed\n\nlemma length_upto_enum [simp]:\n  fixes a :: \"('a :: len) word\"\n  shows \"length [a .e. b] = Suc (unat b) - unat a\"\n  apply (simp add: word_le_nat_alt upto_enum_red)\n  apply (clarsimp simp: Suc_diff_le)\n  done\n\nlemma length_upto_enum_less_one:\n  \"\\<lbrakk>a \\<le> b; b \\<noteq> 0\\<rbrakk>\n  \\<Longrightarrow> length [a .e. b - 1] = unat (b - a)\"\n  apply clarsimp\n  apply (subst unat_sub[symmetric], assumption)\n  apply clarsimp\n  done\n\nlemma drop_upto_enum:\n  \"drop (unat n) [0 .e. m] = [n .e. m]\"\n  apply (clarsimp simp: upto_enum_def)\n  apply (induct m, simp)\n  by (metis drop_map drop_upt plus_nat.add_0)\n\nlemma distinct_enum_upto' [simp]:\n  \"distinct [a::'a::len word .e. b]\"\n  apply (subst drop_upto_enum [symmetric])\n  apply (rule distinct_drop)\n  apply (rule distinct_enum_upto)\n  done\n\nlemma length_interval:\n  \"\\<lbrakk>set xs = {x. (a::'a::len word) \\<le> x \\<and> x \\<le> b}; distinct xs\\<rbrakk>\n  \\<Longrightarrow> length xs = Suc (unat b) - unat a\"\n  apply (frule distinct_card)\n  apply (subgoal_tac \"set xs = set [a .e. b]\")\n   apply (cut_tac distinct_card [where xs=\"[a .e. b]\"])\n    apply (subst (asm) length_upto_enum)\n    apply clarsimp\n   apply (rule distinct_enum_upto')\n  apply simp\n  done\n\nlemma not_empty_eq:\n  \"(S \\<noteq> {}) = (\\<exists>x. x \\<in> S)\"\n  by auto\n\nlemma range_subset_lower:\n  fixes c :: \"'a ::linorder\"\n  shows \"\\<lbrakk> {a..b} \\<subseteq> {c..d}; x \\<in> {a..b} \\<rbrakk> \\<Longrightarrow> c \\<le> a\"\n  apply (frule (1) subsetD)\n  apply (rule classical)\n  apply clarsimp\n  done\n\nlemma range_subset_upper:\n  fixes c :: \"'a ::linorder\"\n  shows \"\\<lbrakk> {a..b} \\<subseteq> {c..d}; x \\<in> {a..b} \\<rbrakk> \\<Longrightarrow> b \\<le> d\"\n  apply (frule (1) subsetD)\n  apply (rule classical)\n  apply clarsimp\n  done\n\nlemma range_subset_eq:\n  fixes a::\"'a::linorder\"\n  assumes non_empty: \"a \\<le> b\"\n  shows \"({a..b} \\<subseteq> {c..d}) = (c \\<le> a \\<and> b \\<le> d)\"\n  apply (insert non_empty)\n  apply (rule iffI)\n   apply (frule range_subset_lower [where x=a], simp)\n   apply (drule range_subset_upper [where x=a], simp)\n   apply simp\n  apply auto\n  done\n\nlemma range_eq:\n  fixes a::\"'a::linorder\"\n  assumes non_empty: \"a \\<le> b\"\n  shows \"({a..b} = {c..d}) = (a = c \\<and> b = d)\"\n  by (metis atLeastatMost_subset_iff eq_iff non_empty)\n\nlemma range_strict_subset_eq:\n  fixes a::\"'a::linorder\"\n  assumes non_empty: \"a \\<le> b\"\n  shows \"({a..b} \\<subset> {c..d}) = (c \\<le> a \\<and> b \\<le> d \\<and> (a = c \\<longrightarrow> b \\<noteq> d))\"\n  apply (insert non_empty)\n  apply (subst psubset_eq)\n  apply (subst range_subset_eq, assumption+)\n  apply (subst range_eq, assumption+)\n  apply simp\n  done\n\nlemma range_subsetI:\n  fixes x :: \"'a :: order\"\n  assumes xX: \"X \\<le> x\"\n  and     yY: \"y \\<le> Y\"\n  shows   \"{x .. y} \\<subseteq> {X .. Y}\"\n  using xX yY by auto\n\nlemma set_False [simp]:\n  \"(set bs \\<subseteq> {False}) = (True \\<notin> set bs)\" by auto\n\ndeclare of_nat_power [simp del]\n\n(* TODO: move to word *)\nlemma unat_of_bl_length:\n  \"unat (of_bl xs :: 'a::len word) < 2 ^ (length xs)\"\nproof (cases \"length xs < len_of TYPE('a)\")\n  case True\n  hence \"(of_bl xs::'a::len word) < 2 ^ length xs\"\n    by (simp add: of_bl_length_less)\n  with True\n  show ?thesis\n    by (simp add: word_less_nat_alt word_unat_power unat_of_nat)\nnext\n  case False\n  have \"unat (of_bl xs::'a::len word) < 2 ^ len_of TYPE('a)\"\n    by (simp split: unat_split)\n  also\n  from False\n  have \"len_of TYPE('a) \\<le> length xs\" by simp\n  hence \"2 ^ len_of TYPE('a) \\<le> (2::nat) ^ length xs\"\n    by (rule power_increasing) simp\n  finally\n  show ?thesis .\nqed\n\nlemma is_aligned_0'[simp]:\n  \"is_aligned 0 n\"\n  by (simp add: is_aligned_def)\n\nlemma p_assoc_help:\n  fixes p :: \"'a::{ring,power,numeral,one}\"\n  shows \"p + 2^sz - 1 = p + (2^sz - 1)\"\n  by simp\n\nlemma word_add_increasing:\n  fixes x :: \"'a :: len word\"\n  shows \"\\<lbrakk> p + w \\<le> x; p \\<le> p + w \\<rbrakk> \\<Longrightarrow> p \\<le> x\"\n  by unat_arith\n\nlemma word_random:\n  fixes x :: \"'a :: len word\"\n  shows \"\\<lbrakk> p \\<le> p + x'; x \\<le> x' \\<rbrakk> \\<Longrightarrow> p \\<le> p + x\"\n  by unat_arith\n\nlemma word_sub_mono:\n  \"\\<lbrakk> a \\<le> c; d \\<le> b; a - b \\<le> a; c - d \\<le> c \\<rbrakk>\n    \\<Longrightarrow> (a - b) \\<le> (c - d :: ('a :: len) word)\"\n  by unat_arith\n\nlemma power_not_zero:\n  \"n < len_of TYPE('a::len) \\<Longrightarrow> (2 :: 'a word) ^ n \\<noteq> 0\"\n  by (metis p2_gt_0 word_neq_0_conv)\n\nlemma word_gt_a_gt_0:\n  \"a < n \\<Longrightarrow> (0 :: 'a::len word) < n\"\n  apply (case_tac \"n = 0\")\n   apply clarsimp\n  apply (clarsimp simp: word_neq_0_conv)\n  done\n\nlemma word_shift_nonzero:\n  \"\\<lbrakk> (x\\<Colon>'a\\<Colon>len word) \\<le> 2 ^ m; m + n < len_of TYPE('a\\<Colon>len); x \\<noteq> 0\\<rbrakk>\n   \\<Longrightarrow> x << n \\<noteq> 0\"\n  apply (simp only: word_neq_0_conv word_less_nat_alt\n                    shiftl_t2n mod_0 unat_word_ariths\n                    unat_power_lower word_le_nat_alt)\n  apply (subst mod_less)\n   apply (rule order_le_less_trans)\n    apply (erule mult_le_mono2)\n   apply (subst power_add[symmetric])\n   apply (rule power_strict_increasing)\n    apply simp\n   apply simp\n  apply simp\n  done\n\nlemma word_power_less_1 [simp]:\n  \"sz < len_of TYPE('a\\<Colon>len) \\<Longrightarrow> (2::'a word) ^ sz - 1 < 2 ^ sz\"\n  apply (simp add: word_less_nat_alt word_bits_def)\n  apply (subst unat_minus_one)\n  apply (simp add: word_unat.Rep_inject [symmetric])\n  apply simp\n  done\n\nlemmas word32_power_less_1[simp] =\n       word_power_less_1[where 'a = 32, folded word_bits_def]\n\nlemma nasty_split_lt:\n  \"\\<lbrakk> (x :: 'a:: len word) < 2 ^ (m - n); n \\<le> m; m < len_of TYPE('a\\<Colon>len) \\<rbrakk>\n     \\<Longrightarrow> x * 2 ^ n + (2 ^ n - 1) \\<le> 2 ^ m - 1\"\n  apply (simp only: add_diff_eq word_bits_def)\n  apply (subst mult_1[symmetric], subst distrib_right[symmetric])\n  apply (rule word_sub_mono)\n     apply (rule order_trans)\n      apply (rule word_mult_le_mono1)\n        apply (rule inc_le)\n        apply assumption\n       apply (subst word_neq_0_conv[symmetric])\n       apply (rule power_not_zero)\n       apply (simp add: word_bits_def)\n      apply (subst unat_power_lower, simp)+\n      apply (subst power_add[symmetric])\n      apply (rule power_strict_increasing)\n       apply (simp add: word_bits_def)\n      apply simp\n     apply (subst power_add[symmetric])\n     apply simp\n    apply simp\n   apply (rule word_sub_1_le)\n   apply (subst mult.commute)\n   apply (subst shiftl_t2n[symmetric])\n   apply (rule word_shift_nonzero)\n     apply (erule inc_le)\n    apply (simp add: word_bits_def)\n   apply (unat_arith)\n  apply (drule word_power_less_1[unfolded word_bits_def])\n  apply simp\n  done\n\nlemma nasty_split_less:\n  \"\\<lbrakk>m \\<le> n; n \\<le> nm; nm < len_of TYPE('a\\<Colon>len); x < 2 ^ (nm - n)\\<rbrakk>\n   \\<Longrightarrow> (x :: 'a word) * 2 ^ n + (2 ^ m - 1) < 2 ^ nm\"\n  apply (simp only: word_less_sub_le[symmetric])\n  apply (rule order_trans [OF _ nasty_split_lt])\n     apply (rule word_plus_mono_right)\n      apply (rule word_sub_mono)\n         apply (simp add: word_le_nat_alt)\n        apply simp\n       apply (simp add: word_sub_1_le[OF power_not_zero])\n      apply (simp add: word_sub_1_le[OF power_not_zero])\n     apply (rule is_aligned_no_wrap')\n      apply (rule is_aligned_mult_triv2)\n     apply simp\n    apply (erule order_le_less_trans, simp)\n   apply simp+\n  done\n\nlemma int_not_emptyD:\n  \"A \\<inter> B \\<noteq> {} \\<Longrightarrow> \\<exists>x. x \\<in> A \\<and> x \\<in> B\"\n  by (erule contrapos_np, clarsimp simp: disjoint_iff_not_equal)\n\nlemma unat_less_power:\n  fixes k :: \"'a::len word\"\n  assumes szv: \"sz < len_of TYPE('a)\"\n  and     kv:  \"k < 2 ^ sz\"\n  shows   \"unat k < 2 ^ sz\"\n  using szv unat_mono [OF kv] by simp\n\n(* This should replace some crud \\<dots> search for unat_of_nat *)\nlemma unat_mult_power_lem:\n  assumes kv: \"k < 2 ^ (len_of TYPE('a::len) - sz)\"\n  shows \"unat (2 ^ sz * of_nat k :: (('a::len) word)) = 2 ^ sz * k\"\nproof cases\n  assume szv: \"sz < len_of TYPE('a::len)\"\n  show ?thesis\n  proof (cases \"sz = 0\")\n    case True\n    thus ?thesis using kv szv\n     by (simp add: unat_of_nat)\n  next\n    case False\n    hence sne: \"0 < sz\" ..\n\n    have uk: \"unat (of_nat k :: 'a word) = k\"\n      apply (subst unat_of_nat)\n      apply (simp add: nat_mod_eq less_trans[OF kv] sne)\n      done\n\n    show ?thesis using szv\n      apply (subst iffD1 [OF unat_mult_lem])\n      apply (simp add: uk nat_less_power_trans[OF kv order_less_imp_le [OF szv]])+\n      done\n  qed\nnext\n  assume \"\\<not> sz < len_of TYPE('a)\"\n  with kv show ?thesis by (simp add: not_less power_overflow)\nqed\n\nlemma aligned_add_offset_no_wrap:\n  fixes off :: \"('a::len) word\"\n  and     x :: \"'a word\"\n  assumes al: \"is_aligned x sz\"\n  and   offv: \"off < 2 ^ sz\"\n  shows  \"unat x + unat off < 2 ^ len_of TYPE('a)\"\nproof cases\n  assume szv: \"sz < len_of TYPE('a)\"\n  from al obtain k where xv: \"x = 2 ^ sz * (of_nat k)\"\n    and kl: \"k < 2 ^ (len_of TYPE('a) - sz)\"\n    by (auto elim: is_alignedE)\n\n  show ?thesis using szv\n    apply (subst xv)\n    apply (subst unat_mult_power_lem[OF kl])\n    apply (subst mult.commute, rule nat_add_offset_less)\n      apply (rule less_le_trans[OF unat_mono[OF offv, simplified]])\n      apply (erule eq_imp_le[OF unat_power_lower])\n     apply (rule kl)\n    apply simp\n   done\nnext\n  assume \"\\<not> sz < len_of TYPE('a)\"\n  with offv show ?thesis by (simp add: not_less power_overflow )\nqed\n\nlemma aligned_add_offset_mod:\n  fixes x :: \"('a::len) word\"\n  assumes al: \"is_aligned x sz\"\n  and     kv: \"k < 2 ^ sz\"\n  shows   \"(x + k) mod 2 ^ sz = k\"\nproof cases\n  assume szv: \"sz < len_of TYPE('a)\"\n\n  have ux: \"unat x + unat k < 2 ^ len_of TYPE('a)\"\n    by (rule aligned_add_offset_no_wrap) fact+\n\n  show ?thesis using al szv\n    apply -\n    apply (erule is_alignedE)\n    apply (subst word_unat.Rep_inject [symmetric])\n    apply (subst unat_mod)\n    apply (subst iffD1 [OF unat_add_lem], rule ux)\n    apply simp\n    apply (subst unat_mult_power_lem, assumption+)\n    apply (subst mod_add_left_eq)\n    apply (simp)\n    apply (rule mod_less[OF less_le_trans[OF unat_mono], OF kv])\n    apply (erule eq_imp_le[OF unat_power_lower])\n    done\nnext\n  assume \"\\<not> sz < len_of TYPE('a)\"\n  with al show ?thesis\n    by (simp add: not_less power_overflow is_aligned_mask mask_def\n                  word_mod_by_0)\nqed\n\nlemma word_plus_mcs_4:\n  \"\\<lbrakk>v + x \\<le> w + x; x \\<le> v + x\\<rbrakk> \\<Longrightarrow> v \\<le> (w::'a::len word)\"\n  by uint_arith\n\nlemma word_plus_mcs_3:\n  \"\\<lbrakk>v \\<le> w; x \\<le> w + x\\<rbrakk> \\<Longrightarrow> v + x \\<le> w + (x::'a::len word)\"\n  by unat_arith\n\n\n\n    have rl: \"\\<And>(p::'a word) k w. \\<lbrakk>uint p + uint k < 2 ^ len_of TYPE('a); w = p + k; w \\<le> p + (2 ^ sz - 1) \\<rbrakk>\n      \\<Longrightarrow> k < 2 ^ sz\"\n      apply -\n      apply simp\n      apply (subst (asm) add.commute, subst (asm) add.commute, drule word_plus_mcs_4)\n      apply (subst add.commute, subst no_plus_overflow_uint_size)\n      apply (simp add: word_size_bl)\n      apply (erule iffD1 [OF word_less_sub_le[OF szv]])\n      done\n\n    from xb obtain kx where\n      kx: \"z = x + kx\" and\n      kxl: \"uint x + uint kx < 2 ^ len_of TYPE('a)\"\n      by (clarsimp dest!: word_le_exists')\n\n    from yb obtain ky where\n      ky: \"z = y + ky\" and\n      kyl: \"uint y + uint ky < 2 ^ len_of TYPE('a)\"\n      by (clarsimp dest!: word_le_exists')\n\n    have \"x = y\"\n    proof -\n      have \"kx = z mod 2 ^ sz\"\n      proof (subst kx, rule sym, rule aligned_add_offset_mod)\n        show \"kx < 2 ^ sz\" by (rule rl) fact+\n      qed fact+\n\n      also have \"\\<dots> = ky\"\n      proof (subst ky, rule aligned_add_offset_mod)\n        show \"ky < 2 ^ sz\"\n          using kyl ky yt by (rule rl)\n      qed fact+\n\n      finally have kxky: \"kx = ky\" .\n      moreover have \"x + kx = y + ky\" by (simp add: kx [symmetric] ky [symmetric])\n      ultimately show ?thesis by simp\n    qed\n\n    thus False using neq by simp\n  qed\nnext\n  assume \"\\<not> sz < len_of TYPE('a)\"\n  with neq alx aly\n  have False by (simp add: is_aligned_mask mask_def power_overflow)\n  thus ?thesis ..\nqed\n\nlemma less_two_pow_divD:\n  \"\\<lbrakk> (x :: nat) < 2 ^ n div 2 ^ m \\<rbrakk>\n    \\<Longrightarrow> n \\<ge> m \\<and> (x < 2 ^ (n - m))\"\n  apply (rule context_conjI)\n   apply (rule ccontr)\n   apply (simp add: power_strict_increasing)\n  apply (simp add: power_sub)\n  done\n\nlemma less_two_pow_divI:\n  \"\\<lbrakk> (x :: nat) < 2 ^ (n - m); m \\<le> n \\<rbrakk> \\<Longrightarrow> x < 2 ^ n div 2 ^ m\"\n  by (simp add: power_sub)\n\nlemma word_less_two_pow_divI:\n  \"\\<lbrakk> (x :: 'a::len word) < 2 ^ (n - m); m \\<le> n; n < len_of TYPE('a) \\<rbrakk> \\<Longrightarrow> x < 2 ^ n div 2 ^ m\"\n  apply (simp add: word_less_nat_alt)\n  apply (subst unat_word_ariths)\n  apply (subst mod_less)\n   apply (rule order_le_less_trans [OF div_le_dividend])\n   apply (rule unat_lt2p)\n  apply (simp add: power_sub)\n  done\n\nlemma word_less_two_pow_divD:\n  \"\\<lbrakk> (x :: 'a::len word) < 2 ^ n div 2 ^ m \\<rbrakk>\n     \\<Longrightarrow> n \\<ge> m \\<and> (x < 2 ^ (n - m))\"\n  apply (cases \"n < len_of TYPE('a)\")\n   apply (cases \"m < len_of TYPE('a)\")\n    apply (simp add: word_less_nat_alt)\n    apply (subst(asm) unat_word_ariths)\n    apply (subst(asm) mod_less)\n     apply (rule order_le_less_trans [OF div_le_dividend])\n     apply (rule unat_lt2p)\n    apply (clarsimp dest!: less_two_pow_divD)\n   apply (simp add: power_overflow)\n   apply (simp add: word_div_def)\n  apply (simp add: power_overflow word_div_def)\n  done\n\nlemma of_nat_less_two_pow_div_set:\n  \"\\<lbrakk> n < len_of TYPE('a) \\<rbrakk> \\<Longrightarrow>\n   {x. x < (2 ^ n div 2 ^ m :: 'a::len word)}\n      = of_nat ` {k. k < 2 ^ n div 2 ^ m}\"\n  apply (simp add: image_def)\n  apply (safe dest!: word_less_two_pow_divD less_two_pow_divD\n             intro!: word_less_two_pow_divI)\n   apply (rule_tac x=\"unat x\" in exI)\n   apply (simp add: power_sub[symmetric])\n   apply (subst unat_power_lower[symmetric, where 'a='a])\n    apply simp\n   apply (erule unat_mono)\n  apply (subst word_unat_power)\n  apply (rule of_nat_mono_maybe)\n   apply (rule power_strict_increasing)\n    apply simp\n   apply simp\n  apply assumption\n  done\n\n(* FIXME: generalise! *)\nlemma upto_2_helper:\n  \"{0..<2 :: word32} = {0, 1}\"\n  apply (safe, simp_all)\n  apply unat_arith\n  done\n\n(* TODO: MOVE to word *)\nlemma  word_less_power_trans2:\n  fixes n :: \"'a::len word\"\n  shows \"\\<lbrakk>n < 2 ^ (m - k); k \\<le> m; m < len_of TYPE('a)\\<rbrakk> \\<Longrightarrow> n * 2 ^ k < 2 ^ m\"\n  by (subst field_simps, rule word_less_power_trans)\n\nlemma ucast_less:\n  \"len_of TYPE('b) < len_of TYPE('a) \\<Longrightarrow>\n   (ucast (x :: ('b :: len) word) :: (('a :: len) word)) < 2 ^ len_of TYPE('b)\"\n  apply (subst mask_eq_iff_w2p[symmetric])\n   apply (simp add: word_size)\n  apply (rule word_eqI)\n  apply (simp add: word_size nth_ucast)\n  apply safe\n  apply (simp add: test_bit.Rep[simplified])\n  done\n\nlemma ucast_less_shiftl_helper:\n  \"\\<lbrakk> len_of TYPE('b) + 2 < word_bits;\n     2 ^ (len_of TYPE('b) + 2) \\<le> n\\<rbrakk>\n    \\<Longrightarrow> (ucast (x :: ('b :: len) word) << 2) < (n :: word32)\"\n  apply (erule order_less_le_trans[rotated])\n  apply (cut_tac ucast_less[where x=x and 'a=32])\n   apply (simp only: shiftl_t2n field_simps)\n   apply (rule word_less_power_trans2)\n     apply (simp_all add: word_bits_def)\n  done\n\nlemma ucast_range_less:\n  \"len_of TYPE('a :: len) < len_of TYPE('b :: len) \\<Longrightarrow>\n   range (ucast :: 'a word \\<Rightarrow> 'b word)\n       = {x. x < 2 ^ len_of TYPE ('a)}\"\n  apply safe\n   apply (erule ucast_less)\n  apply (simp add: image_def)\n  apply (rule_tac x=\"ucast x\" in exI)\n  apply (drule less_mask_eq)\n  apply (rule word_eqI)\n  apply (drule_tac x=n in word_eqD)\n  apply (simp add: word_size nth_ucast)\n  done\n\nlemma word_power_less_diff:\n  \"\\<lbrakk>2 ^ n * q < (2::'a::len word) ^ m; q < 2 ^ (len_of TYPE('a) - n)\\<rbrakk> \\<Longrightarrow> q < 2 ^ (m - n)\"\n  apply (case_tac \"m \\<ge> len_of TYPE('a)\")\n   apply (simp add: power_overflow)\n  apply (case_tac \"n \\<ge> len_of TYPE('a)\")\n   apply (simp add: power_overflow)\n  apply (cases \"n = 0\")\n   apply simp\n  apply (subst word_less_nat_alt)\n  apply (subst unat_power_lower)\n   apply simp\n  apply (rule nat_power_less_diff)\n  apply (simp add: word_less_nat_alt)\n  apply (subst (asm) iffD1 [OF unat_mult_lem])\n   apply (simp add:nat_less_power_trans)\n  apply simp\n  done\n\nlemmas word_diff_ls' = word_diff_ls [where xa=x and x=x for x, simplified]\n\nlemmas word_l_diffs = word_l_diffs [where xa=x and x=x for x, simplified]\n\nlemma is_aligned_diff:\n  fixes m :: \"'a::len word\"\n  assumes alm: \"is_aligned m s1\"\n  and     aln: \"is_aligned n s2\"\n  and    s2wb: \"s2 < len_of TYPE('a)\"\n  and      nm: \"m \\<in> {n .. n + (2 ^ s2 - 1)}\"\n  and    s1s2: \"s1 \\<le> s2\"\n  and     s10: \"0 < s1\" (* Probably can be folded into the proof \\<dots> *)\n  shows  \"\\<exists>q. m - n = of_nat q * 2 ^ s1 \\<and> q < 2 ^ (s2 - s1)\"\nproof -\n  have rl: \"\\<And>m s. \\<lbrakk> m < 2 ^ (len_of TYPE('a) - s); s < len_of TYPE('a) \\<rbrakk> \\<Longrightarrow> unat ((2::'a word) ^ s * of_nat m) = 2 ^ s * m\"\n  proof -\n    fix m :: nat and  s\n    assume m: \"m < 2 ^ (len_of TYPE('a) - s)\" and s: \"s < len_of TYPE('a)\"\n    hence \"unat ((of_nat m) :: 'a word) = m\"\n      apply (subst unat_of_nat)\n      apply (subst mod_less)\n       apply (erule order_less_le_trans)\n       apply (rule power_increasing)\n        apply simp_all\n      done\n\n    thus \"?thesis m s\" using s m\n      apply (subst iffD1 [OF unat_mult_lem])\n      apply (simp add: nat_less_power_trans)+\n      done\n  qed\n  have s1wb: \"s1 < len_of TYPE('a)\" using s2wb s1s2 by simp\n  from alm obtain mq where mmq: \"m = 2 ^ s1 * of_nat mq\" and mq: \"mq < 2 ^ (len_of TYPE('a) - s1)\"\n    by (auto elim: is_alignedE simp: field_simps)\n  from aln obtain nq where nnq: \"n = 2 ^ s2 * of_nat nq\" and nq: \"nq < 2 ^ (len_of TYPE('a) - s2)\"\n    by (auto elim: is_alignedE simp: field_simps)\n  from s1s2 obtain sq where sq: \"s2 = s1 + sq\" by (auto simp: le_iff_add)\n\n  note us1 = rl [OF mq s1wb]\n  note us2 = rl [OF nq s2wb]\n\n  from nm have \"n \\<le> m\" by clarsimp\n  hence \"(2::'a word) ^ s2 * of_nat nq \\<le> 2 ^ s1 * of_nat mq\" using nnq mmq by simp\n  hence \"2 ^ s2 * nq \\<le> 2 ^ s1 * mq\" using s1wb s2wb\n    by (simp add: word_le_nat_alt us1 us2)\n  hence nqmq: \"2 ^ sq * nq \\<le> mq\" using sq by (simp add: power_add)\n\n  have \"m - n = 2 ^ s1 * of_nat mq - 2 ^ s2 * of_nat nq\" using mmq nnq by simp\n  also have \"\\<dots> = 2 ^ s1 * of_nat mq - 2 ^ s1 * 2 ^ sq * of_nat nq\" using sq by (simp add: power_add)\n  also have \"\\<dots> = 2 ^ s1 * (of_nat mq - 2 ^ sq * of_nat nq)\" by (simp add: field_simps)\n  also have \"\\<dots> = 2 ^ s1 * of_nat (mq - 2 ^ sq * nq)\" using s1wb s2wb us1 us2 nqmq\n    by (simp add:  word_unat_power)\n  finally have mn: \"m - n = of_nat (mq - 2 ^ sq * nq) * 2 ^ s1\" by simp\n  moreover\n  from nm have \"m - n \\<le> 2 ^ s2 - 1\"\n    by - (rule word_diff_ls', (simp add: field_simps)+)\n  hence \"(2::'a word) ^ s1 * of_nat (mq - 2 ^ sq * nq) < 2 ^ s2\" using mn s2wb by (simp add: field_simps)\n  hence \"of_nat (mq - 2 ^ sq * nq) < (2::'a word) ^ (s2 - s1)\"\n  proof (rule word_power_less_diff)\n    have mm: \"mq - 2 ^ sq * nq < 2 ^ (len_of TYPE('a) - s1)\" using mq by simp\n    moreover from s10 have \"len_of TYPE('a) - s1 < len_of TYPE('a)\"\n      by (rule diff_less, simp)\n    ultimately show \"of_nat (mq - 2 ^ sq * nq) < (2::'a word) ^ (len_of TYPE('a) - s1)\"\n      apply (simp add: word_less_nat_alt)\n      apply (subst unat_of_nat)\n      apply (subst mod_less)\n       apply (erule order_less_le_trans)\n       apply simp+\n      done\n  qed\n  hence \"mq - 2 ^ sq * nq < 2 ^ (s2 - s1)\" using mq s2wb\n    apply (simp add: word_less_nat_alt)\n    apply (subst (asm) unat_of_nat)\n    apply (subst (asm) mod_less)\n    apply (rule order_le_less_trans)\n    apply (rule diff_le_self)\n    apply (erule order_less_le_trans)\n    apply simp\n    apply assumption\n    done\n  ultimately show ?thesis by auto\nqed\n\nlemma word_less_sub_1:\n  \"x < (y :: ('a :: len) word) \\<Longrightarrow> x \\<le> y - 1\"\n  apply (erule udvd_minus_le')\n   apply (simp add: udvd_def)+\n  done\n\nlemma word_sub_mono2:\n  \"\\<lbrakk> a + b \\<le> c + d; c \\<le> a; b \\<le> a + b; d \\<le> c + d \\<rbrakk>\n    \\<Longrightarrow> b \\<le> (d :: ('a :: len) word)\"\n  apply (drule(1) word_sub_mono)\n    apply simp\n   apply simp\n  apply simp\n  done\n\n\n\nlemma word_subset_less:\n  \"\\<lbrakk> {x .. x + r - 1} \\<subseteq> {y .. y + s - 1};\n     x \\<le> x + r - 1; y \\<le> y + (s :: ('a :: len) word) - 1;\n     s \\<noteq> 0 \\<rbrakk>\n     \\<Longrightarrow> r \\<le> s\"\n  apply (frule subsetD[where c=x])\n   apply simp\n  apply (drule subsetD[where c=\"x + r - 1\"])\n   apply simp\n  apply (clarsimp simp: add_diff_eq[symmetric])\n  apply (drule(1) word_sub_mono2)\n    apply (simp_all add: olen_add_eqv[symmetric])\n  apply (erule word_le_minus_cancel)\n  apply (rule ccontr)\n  apply (simp add: word_not_le)\n  done\n\nlemma two_power_strict_part_mono:\n  \"strict_part_mono {..31} (\\<lambda>x. (2 :: word32) ^ x)\"\n  by (simp | subst strict_part_mono_by_steps)+\n\nlemma uint_power_lower:\n  \"n < len_of TYPE('a) \\<Longrightarrow> uint (2 ^ n :: 'a :: len word) = (2 ^ n :: int)\"\n  by (simp add: uint_nat int_power)\n\nlemma power_le_mono:\n  \"\\<lbrakk>2 ^ n \\<le> (2::'a::len word) ^ m; n < len_of TYPE('a); m < len_of TYPE('a)\\<rbrakk>\n   \\<Longrightarrow> n \\<le> m\"\n  apply (clarsimp simp add: le_less)\n  apply safe\n  apply (simp add: word_less_nat_alt)\n  apply (simp only: uint_arith_simps(3))\n  apply (drule uint_power_lower)+\n  apply simp\n  done\n\nlemma sublist_equal_part:\n  \"xs \\<le> ys \\<Longrightarrow> take (length xs) ys = xs\"\n  by (clarsimp simp: prefixeq_def less_eq_list_def)\n\nlemma take_n_subset_le:\n  \"\\<lbrakk> {x. take n (to_bl x) = take n xs} \\<subseteq> {y :: word32. take m (to_bl y) = take m ys};\n     n \\<le> 32; m \\<le> 32; length xs = 32; length ys = 32 \\<rbrakk>\n    \\<Longrightarrow> m \\<le> n\"\n  apply (rule ccontr, simp add: le_def)\n  apply (simp add: subset_iff)\n  apply (drule spec[where x=\"of_bl (take n xs @ take (32 - n) (map Not (drop n ys)))\"])\n  apply (simp add: word_bl.Abs_inverse)\n  apply (subgoal_tac \"\\<exists>p. m = n + p\")\n   apply clarsimp\n   apply (simp add: take_add take_map_Not)\n  apply (rule exI[where x=\"m - n\"])\n  apply simp\n  done\n\nlemma two_power_eq:\n  \"\\<lbrakk>n < len_of TYPE('a); m < len_of TYPE('a)\\<rbrakk>\n   \\<Longrightarrow> ((2::'a::len word) ^ n = 2 ^ m) = (n = m)\"\n  apply safe\n  apply (rule order_antisym)\n   apply (simp add: power_le_mono[where 'a='a])+\n  done\n\nlemma less_list_def': \"(xs < ys) = (prefix xs ys)\"\n  apply (metis prefix_order.eq_iff prefix_def less_list_def less_eq_list_def)\n  done\n\nlemma prefix_length_less:\n  \"xs < ys \\<Longrightarrow> length xs < length ys\"\n  apply (clarsimp simp: less_list_def' prefix_def)\n  apply (frule prefixeq_length_le)\n  apply (rule ccontr, simp)\n  apply (clarsimp simp: prefixeq_def)\n  done\n\nlemmas strict_prefix_simps [simp, code] = prefix_simps [folded less_list_def']\nlemmas take_strict_prefix = take_prefix [folded less_list_def']\n\nlemma not_prefix_longer:\n  \"\\<lbrakk> length xs > length ys \\<rbrakk> \\<Longrightarrow> \\<not> xs \\<le> ys\"\n  by (clarsimp dest!: prefix_length_le)\n\nlemma of_bl_length:\n  \"length xs < len_of TYPE('a) \\<Longrightarrow> of_bl xs < (2 :: 'a::len word) ^ length xs\"\n  by (simp add: of_bl_length_less)\n\n(* FIXME: do we need this? *)\nlemma power_overflow_simp [simp]:\n  \"(2 ^ n = (0::'a :: len word)) = (len_of TYPE ('a) \\<le> n)\"\n  by (rule WordLib.p2_eq_0)\n\nlemma unat_of_nat_eq:\n  \"x < 2 ^ len_of TYPE('a) \\<Longrightarrow> unat (of_nat x ::'a::len word) = x\"\n  by (simp add: unat_of_nat)\n\nlemmas unat_of_nat32 = unat_of_nat_eq[where 'a=32, unfolded word_bits_len_of]\n\nlemma unat_eq_of_nat:\n  \"n < 2 ^ len_of TYPE('a) \\<Longrightarrow> (unat (x :: 'a::len word) = n) = (x = of_nat n)\"\n  by (subst unat_of_nat_eq[where x=n, symmetric], simp+)\n\nlemma unat_less_helper:\n  \"x < of_nat n \\<Longrightarrow> unat x < n\"\n  apply (simp add: word_less_nat_alt)\n  apply (erule order_less_le_trans)\n  apply (simp add: unat_of_nat)\n  done\n\nlemma of_nat_0:\n  \"\\<lbrakk>of_nat n = (0::('a::len) word); n < 2 ^ len_of (TYPE('a))\\<rbrakk> \\<Longrightarrow> n = 0\"\n  by (drule unat_of_nat_eq, simp)\n\nlemma of_nat32_0:\n  \"\\<lbrakk>of_nat n = (0::word32); n < 2 ^ word_bits\\<rbrakk> \\<Longrightarrow> n = 0\"\n  by (erule of_nat_0, simp add: word_bits_def)\n\nlemma unat_mask_2_less_4:\n  \"unat (p && mask 2 :: word32) < 4\"\n  apply (rule unat_less_helper)\n  apply (rule order_le_less_trans, rule word_and_le1)\n  apply (simp add: mask_def)\n  done\n\nlemma minus_one_helper3:\n  \"x < y \\<Longrightarrow> x \\<le> (y :: ('a :: len) word) - 1\"\n  apply (simp add: word_less_nat_alt word_le_nat_alt)\n  apply (subst unat_minus_one)\n   apply clarsimp\n  apply arith\n  done\n\nlemma minus_one_helper:\n  \"\\<lbrakk> x \\<le> y; x \\<noteq> 0 \\<rbrakk> \\<Longrightarrow> x - 1 < (y :: ('a :: len) word)\"\n  apply (simp add: word_less_nat_alt word_le_nat_alt)\n  apply (subst unat_minus_one)\n   apply assumption\n  apply (cases \"unat x\")\n   apply (simp add: unat_eq_zero)\n  apply arith\n  done\n\nlemma minus_one_helper5:\n  fixes x :: \"'a::len word\"\n  shows \"\\<lbrakk>y \\<noteq> 0; x \\<le> y - 1 \\<rbrakk> \\<Longrightarrow> x < y\"\n  by (metis leD minus_one_helper not_leE)\n\nlemma plus_one_helper[elim!]:\n  \"x < n + (1 :: ('a :: len) word) \\<Longrightarrow> x \\<le> n\"\n  apply (simp add: word_less_nat_alt word_le_nat_alt field_simps)\n  apply (case_tac \"1 + n = 0\")\n   apply simp\n  apply (subst(asm) unatSuc, assumption)\n  apply arith\n  done\n\n\n\nlemma not_greatest_aligned:\n  \"\\<lbrakk> x < y; is_aligned x n; is_aligned y n \\<rbrakk>\n      \\<Longrightarrow> x + 2 ^ n \\<noteq> 0\"\n  apply (rule notI)\n  apply (erule is_aligned_get_word_bits[where p=y])\n   apply (simp add: eq_diff_eq[symmetric])\n   apply (frule minus_one_helper3)\n   apply (drule le_minus'[where a=\"x\" and c=\"y - x\" and b=\"- 1\" for x y, simplified])\n   apply (simp add: field_simps)\n   apply (frule is_aligned_less_sz[where a=y])\n     apply clarsimp\n   apply (erule notE)\n   apply (rule minus_one_helper5)\n    apply simp\n   apply (metis is_aligned_no_overflow minus_one_helper3 order_le_less_trans)\n  apply simp\n  done\n\nlemma of_nat_inj:\n  \"\\<lbrakk>x < 2 ^ len_of TYPE('a); y < 2 ^ len_of TYPE('a)\\<rbrakk> \\<Longrightarrow>\n   (of_nat x = (of_nat y :: 'a :: len word)) = (x = y)\"\n  by (simp add: word_unat.norm_eq_iff [symmetric])\n\nlemma map_prefixI:\n  \"xs \\<le> ys \\<Longrightarrow> map f xs \\<le> map f ys\"\n  by (clarsimp simp: less_eq_list_def prefixeq_def)\n\nlemma if_Some_None_eq_None:\n  \"((if P then Some v else None) = None) = (\\<not> P)\"\n  by simp\n\nlemma CollectPairFalse [iff]:\n  \"{(a,b). False} = {}\"\n  by (simp add: split_def)\n\n\n\nlemma if_P_True1:\n  \"Q \\<Longrightarrow> (if P then True else Q)\"\n  by simp\n\nlemma if_P_True2:\n  \"Q \\<Longrightarrow> (if P then Q else True)\"\n  by simp\n\nlemma list_all2_induct [consumes 1, case_names Nil Cons]:\n  assumes lall: \"list_all2 Q xs ys\"\n  and     nilr: \"P [] []\"\n  and    consr: \"\\<And>x xs y ys. \\<lbrakk>list_all2 Q xs ys; Q x y; P xs ys\\<rbrakk> \\<Longrightarrow> P (x # xs) (y # ys)\"\n  shows  \"P xs ys\"\n  using lall\nproof (induct rule: list_induct2 [OF list_all2_lengthD [OF lall]])\n  case 1 thus ?case by auto fact+\nnext\n  case (2 x xs y ys)\n\n  show ?case\n  proof (rule consr)\n    from \"2.prems\" show \"list_all2 Q xs ys\" and \"Q x y\" by simp_all\n    thus \"P xs ys\" by (intro \"2.hyps\")\n  qed\nqed\n\nlemma list_all2_induct_suffixeq [consumes 1, case_names Nil Cons]:\n  assumes lall: \"list_all2 Q as bs\"\n  and     nilr: \"P [] []\"\n  and    consr: \"\\<And>x xs y ys.\n  \\<lbrakk>list_all2 Q xs ys; Q x y; P xs ys; suffixeq (x # xs) as; suffixeq (y # ys) bs\\<rbrakk>\n  \\<Longrightarrow> P (x # xs) (y # ys)\"\n  shows  \"P as bs\"\nproof -\n  def as' == as\n  def bs' == bs\n\n  have \"suffixeq as as' \\<and> suffixeq bs bs'\" unfolding as'_def bs'_def by simp\n  thus ?thesis using lall\n  proof (induct rule: list_induct2 [OF list_all2_lengthD [OF lall]])\n    case 1 show ?case by fact\n  next\n    case (2 x xs y ys)\n\n    show ?case\n    proof (rule consr)\n      from \"2.prems\" show \"list_all2 Q xs ys\" and \"Q x y\" by simp_all\n      thus \"P xs ys\" using \"2.hyps\" \"2.prems\" by (auto dest: suffixeq_ConsD)\n      from \"2.prems\" show \"suffixeq (x # xs) as\" and \"suffixeq (y # ys) bs\"\n\tby (auto simp: as'_def bs'_def)\n    qed\n  qed\nqed\n\nlemma distinct_prop_enum:\n  \"\\<lbrakk> \\<And>x y. \\<lbrakk> x \\<le> stop; y \\<le> stop; x \\<noteq> y \\<rbrakk>\n             \\<Longrightarrow> P x y \\<rbrakk>\n     \\<Longrightarrow> distinct_prop P [(0 :: word32) .e. stop]\"\n  apply (simp add: upto_enum_def distinct_prop_map\n              del: upt.simps)\n  apply (rule distinct_prop_distinct)\n   apply simp\n  apply (simp add: less_Suc_eq_le del: upt.simps)\n  apply (erule_tac x=\"of_nat x\" in meta_allE)\n  apply (erule_tac x=\"of_nat y\" in meta_allE)\n  apply (frule_tac y=x in unat_le)\n  apply (frule_tac y=y in unat_le)\n  apply (erule word_unat.Rep_cases)+\n  apply (simp add: toEnum_of_nat[OF unat_lt2p]\n                   word_le_nat_alt)\n  done\n\nlemma distinct_prop_enum_step:\n  \"\\<lbrakk> \\<And>x y. \\<lbrakk> x \\<le> stop div step; y \\<le> stop div step; x \\<noteq> y \\<rbrakk>\n             \\<Longrightarrow> P (x * step) (y * step) \\<rbrakk>\n     \\<Longrightarrow> distinct_prop P [0, step .e. stop]\"\n  apply (simp add: upto_enum_step_def distinct_prop_map)\n  apply (rule distinct_prop_enum)\n  apply simp\n  done\n\nlemma if_apply_def2:\n  \"(if P then F else G) = (\\<lambda>x. (P \\<longrightarrow> F x) \\<and> (\\<not> P \\<longrightarrow> G x))\"\n  by simp\n\nlemma case_bool_If:\n  \"case_bool P Q b = (if b then P else Q)\"\n  by simp\n\nlemma case_option_If:\n  \"case_option P (\\<lambda>x. Q) v = (if v = None then P else Q)\"\n  by clarsimp\n\nlemma case_option_If2:\n  \"case_option P Q v = If (v \\<noteq> None) (Q (the v)) P\"\n  by (simp split: option.split)\n\nlemma if3_fold:\n  \"(if P then x else if Q then y else x)\n     = (if P \\<or> \\<not> Q then x else y)\"\n  by simp\n\nlemma word32_shift_by_2:\n  \"x * 4 = (x::word32) << 2\"\n  by (simp add: shiftl_t2n)\n\n(* TODO: move to Aligned *)\nlemma add_mask_lower_bits:\n  \"\\<lbrakk>is_aligned (x :: 'a :: len word) n;\n    \\<forall>n' \\<ge> n. n' < len_of TYPE('a) \\<longrightarrow> \\<not> p !! n'\\<rbrakk> \\<Longrightarrow> x + p && ~~mask n = x\"\n  apply (subst word_plus_and_or_coroll)\n   apply (rule word_eqI)\n   apply (clarsimp simp: word_size is_aligned_nth)\n   apply (erule_tac x=na in allE)+\n   apply simp\n  apply (rule word_eqI)\n  apply (clarsimp simp: word_size is_aligned_nth word_ops_nth_size)\n  apply (erule_tac x=na in allE)+\n  apply (case_tac \"na < n\")\n   apply simp\n  apply simp\n  done\n\nlemma findSomeD:\n  \"find P xs = Some x \\<Longrightarrow> P x \\<and> x \\<in> set xs\"\n  by (induct xs) (auto split: split_if_asm)\n\nlemma findNoneD:\n  \"find P xs = None \\<Longrightarrow> \\<forall>x \\<in> set xs. \\<not>P x\"\n  by (induct xs) (auto split: split_if_asm)\n\nlemma dom_upd:\n  \"dom (\\<lambda>x. if x = y then None else f x) = dom f - {y}\"\n  by (rule set_eqI) (auto split: split_if_asm)\n\nlemma ran_upd:\n  \"\\<lbrakk> inj_on f (dom f); f y = Some z \\<rbrakk> \\<Longrightarrow> ran (\\<lambda>x. if x = y then None else f x) = ran f - {z}\"\n  apply (rule set_eqI)\n  apply (unfold ran_def)\n  apply simp\n  apply (rule iffI)\n   apply clarsimp\n   apply (rule conjI, blast)\n   apply clarsimp\n   apply (drule_tac x=a and y=y in inj_onD, simp)\n     apply blast\n    apply blast\n   apply simp\n  apply clarsimp\n  apply (rule_tac x=a in exI)\n  apply clarsimp\n  done\n\nlemma maxBound_word:\n  \"(maxBound::'a::len word) = -1\"\n  apply (simp add: maxBound_def enum_word_def)\n  apply (subst last_map)\n   apply clarsimp\n  apply simp\n  done\n\nlemma minBound_word:\n  \"(minBound::'a::len word) = 0\"\n  apply (simp add: minBound_def enum_word_def)\n  apply (subst map_upt_unfold)\n   apply simp\n  apply simp\n  done\n\nlemma maxBound_max_word:\n  \"(maxBound::'a::len word) = max_word\"\n  apply (subst maxBound_word)\n  apply (subst max_word_minus [symmetric])\n  apply (rule refl)\n  done\n\n\n\nlemma is_aligned_andI1:\n  \"is_aligned x n \\<Longrightarrow> is_aligned (x && y) n\"\n  by (simp add: is_aligned_nth)\n\nlemma is_aligned_andI2:\n  \"is_aligned y n \\<Longrightarrow> is_aligned (x && y) n\"\n  by (simp add: is_aligned_nth)\n\nlemma is_aligned_shiftl:\n  \"is_aligned w (n - m) \\<Longrightarrow> is_aligned (w << m) n\"\n  by (simp add: is_aligned_nth nth_shiftl)\n\nlemma is_aligned_shiftr:\n  \"is_aligned w (n + m) \\<Longrightarrow> is_aligned (w >> m) n\"\n  by (simp add: is_aligned_nth nth_shiftr)\n\nlemma is_aligned_shiftl_self:\n  \"is_aligned (p << n) n\"\n  by (rule is_aligned_shiftl) simp\n\nlemma is_aligned_neg_mask_eq:\n  \"is_aligned p n \\<Longrightarrow> p && ~~ mask n = p\"\n  apply (simp add: is_aligned_nth)\n  apply (rule word_eqI)\n  apply (clarsimp simp: word_size word_ops_nth_size)\n  apply fastforce\n  done\n\nlemma is_aligned_shiftr_shiftl:\n  \"is_aligned w n \\<Longrightarrow> w >> n << n = w\"\n  apply (simp add: shiftr_shiftl1)\n  apply (erule is_aligned_neg_mask_eq)\n  done\n\nlemma rtrancl_insert:\n  assumes x_new: \"\\<And>y. (x,y) \\<notin> R\"\n  shows \"R^* `` insert x S = insert x (R^* `` S)\"\nproof -\n  have \"R^* `` insert x S = R^* `` ({x} \\<union> S)\" by simp\n  also\n  have \"R^* `` ({x} \\<union> S) = R^* `` {x} \\<union> R^* `` S\"\n    by (subst Image_Un) simp\n  also\n  have \"R^* `` {x} = {x}\"\n    apply (clarsimp simp: Image_singleton)\n    apply (rule set_eqI, clarsimp)\n    apply (rule iffI)\n     apply (drule rtranclD)\n     apply (erule disjE, simp)\n     apply clarsimp\n     apply (drule tranclD)\n     apply (clarsimp simp: x_new)\n    apply fastforce\n    done\n  finally\n  show ?thesis by simp\nqed\n\nlemma ran_del_subset:\n  \"y \\<in> ran (f (x := None)) \\<Longrightarrow> y \\<in> ran f\"\n  by (auto simp: ran_def split: split_if_asm)\n\nlemma trancl_sub_lift:\n  assumes sub: \"\\<And>p p'. (p,p') \\<in> r \\<Longrightarrow> (p,p') \\<in> r'\"\n  shows \"(p,p') \\<in> r^+ \\<Longrightarrow> (p,p') \\<in> r'^+\"\n  by (fastforce intro: trancl_mono sub)\n\nlemma trancl_step_lift:\n  assumes x_step: \"\\<And>p p'. (p,p') \\<in> r' \\<Longrightarrow> (p,p') \\<in> r \\<or> (p = x \\<and> p' = y)\"\n  assumes y_new: \"\\<And>p'. \\<not>(y,p') \\<in> r\"\n  shows \"(p,p') \\<in> r'^+ \\<Longrightarrow> (p,p') \\<in> r^+ \\<or> ((p,x) \\<in> r^+ \\<and> p' = y) \\<or> (p = x \\<and> p' = y)\"\n  apply (erule trancl_induct)\n   apply (drule x_step)\n   apply fastforce\n  apply (erule disjE)\n   apply (drule x_step)\n   apply (erule disjE)\n    apply (drule trancl_trans, drule r_into_trancl, assumption)\n    apply blast\n   apply clarsimp\n  apply (erule disjE)\n   apply clarsimp\n   apply (drule x_step)\n   apply (erule disjE)\n    apply (simp add: y_new)\n   apply simp\n  apply clarsimp\n  apply (drule x_step)\n  apply (simp add: y_new)\n  done\n\nlemma upto_enum_step_shift:\n  \"\\<lbrakk> is_aligned p n \\<rbrakk> \\<Longrightarrow>\n  ([p , p + 2 ^ m .e. p + 2 ^ n - 1])\n      = map (op + p) [0, 2 ^ m .e. 2 ^ n - 1]\"\n  apply (erule is_aligned_get_word_bits)\n   prefer 2\n   apply (simp add: map_idI)\n  apply (clarsimp simp: upto_enum_step_def)\n  apply (frule is_aligned_no_overflow)\n  apply (simp add: linorder_not_le [symmetric])\n  done\n\nlemma upto_enum_step_shift_red:\n  \"\\<lbrakk> is_aligned p sz; sz < word_bits; us \\<le> sz \\<rbrakk>\n     \\<Longrightarrow> [p, p + 2 ^ us .e. p + 2 ^ sz - 1]\n          = map (\\<lambda>x. p + of_nat x * 2 ^ us) [0 ..< 2 ^ (sz - us)]\"\n  apply (subst upto_enum_step_shift, assumption)\n  apply (simp add: upto_enum_step_red)\n  done\n\nlemma div_to_mult_word_lt:\n  \"\\<lbrakk> (x :: ('a :: len) word) \\<le> y div z \\<rbrakk> \\<Longrightarrow> x * z \\<le> y\"\n  apply (cases \"z = 0\")\n   apply simp\n  apply (simp add: word_neq_0_conv)\n  apply (rule order_trans)\n   apply (erule(1) word_mult_le_mono1)\n   apply (simp add: unat_div)\n   apply (rule order_le_less_trans [OF div_mult_le])\n   apply simp\n  apply (rule word_div_mult_le)\n  done\n\nlemma upto_enum_step_subset:\n  \"set [x, y .e. z] \\<subseteq> {x .. z}\"\n  apply (clarsimp simp: upto_enum_step_def linorder_not_less)\n  apply (drule div_to_mult_word_lt)\n  apply (rule conjI)\n   apply (erule word_random[rotated])\n   apply simp\n  apply (rule order_trans)\n   apply (erule word_plus_mono_right)\n   apply simp\n  apply simp\n  done\n\nlemma shiftr_less_t2n':\n  fixes x :: \"('a :: len) word\"\n  shows \"\\<lbrakk> x && mask (n + m) = x; m < len_of TYPE('a) \\<rbrakk>\n              \\<Longrightarrow> (x >> n) < 2 ^ m\"\n  apply (subst mask_eq_iff_w2p[symmetric])\n   apply (simp add: word_size)\n  apply (rule word_eqI)\n  apply (drule_tac x=\"na + n\" in word_eqD)\n  apply (simp add: nth_shiftr word_size)\n  apply safe\n  done\n\nlemma shiftr_less_t2n:\n  fixes x :: \"('a :: len) word\"\n  shows \"x < 2 ^ (n + m) \\<Longrightarrow> (x >> n) < 2 ^ m\"\n  apply (rule shiftr_less_t2n')\n   apply (erule less_mask_eq)\n  apply (rule ccontr)\n  apply (simp add: not_less)\n  apply (subst (asm) p2_eq_0[symmetric])\n  apply (simp add: power_add)\n  done\n\nlemma shiftr_eq_0:\n  \"n \\<ge> len_of TYPE('a :: len) \\<Longrightarrow> ((w::('a::len word)) >> n) = 0\"\napply (cut_tac shiftr_less_t2n'[of w n 0], simp)\n apply (simp add: mask_eq_iff)\napply (simp add: lt2p_lem)\napply simp\ndone\n\nlemma shiftr_not_mask_0:\n  \"n+m\\<ge>len_of TYPE('a :: len) \\<Longrightarrow> ((w::('a::len word)) >> n) && ~~ mask m = 0\"\n  apply (simp add: and_not_mask shiftr_less_t2n shiftr_shiftr)\n  apply (subgoal_tac \"w >> n + m = 0\", simp)\n  apply (simp add: le_mask_iff[symmetric] mask_def le_def)\n  apply (subst (asm) p2_gt_0[symmetric])\n  apply (simp add: power_add not_less)\ndone\n\nlemma shiftl_less_t2n:\n  fixes x :: \"('a :: len) word\"\n  shows \"\\<lbrakk> x < (2 ^ (m - n)); m < len_of TYPE('a) \\<rbrakk> \\<Longrightarrow> (x << n) < 2 ^ m\"\n  apply (subst mask_eq_iff_w2p[symmetric])\n   apply (simp add: word_size)\n  apply (drule less_mask_eq)\n  apply (rule word_eqI)\n  apply (drule_tac x=\"na - n\" in word_eqD)\n  apply (simp add: nth_shiftl word_size)\n  apply (cases \"n \\<le> m\")\n   apply safe\n   apply simp\n  apply simp\n  done\n\nlemma shiftl_less_t2n':\n  \"(x::'a::len word) < 2 ^ m \\<Longrightarrow> m+n < len_of TYPE('a) \\<Longrightarrow> x << n < 2 ^ (m + n)\"\nby (rule shiftl_less_t2n) simp_all\n\nlemma ucast_ucast_mask:\n  \"(ucast :: ('a :: len) word \\<Rightarrow> ('b :: len) word) (ucast x) = x && mask (len_of TYPE ('a))\"\n  apply (rule word_eqI)\n  apply (simp add: nth_ucast word_size)\n  done\n\nlemma ucast_ucast_len:\n  \"\\<lbrakk> x < 2 ^ len_of TYPE('b) \\<rbrakk> \\<Longrightarrow>\n  ucast (ucast x::'b::len word) = (x::'a::len word)\"\n  apply (subst ucast_ucast_mask)\n  apply (erule less_mask_eq)\n  done\n\nlemma unat_ucast: \"unat (ucast x :: ('a :: len0) word) = unat x mod 2 ^ (len_of TYPE('a))\"\n  apply (simp add: unat_def ucast_def)\n  apply (subst word_uint.eq_norm)\n  apply (subst nat_mod_distrib)\n    apply simp\n   apply simp\n  apply (subst nat_power_eq)\n   apply simp\n  apply simp\n  done\n\nlemma ucast_less_ucast:\n  \"len_of TYPE('a) < len_of TYPE('b) \\<Longrightarrow>\n   (ucast x < ((ucast (y :: ('a::len) word)) :: ('b::len) word)) = (x < y)\"\n  apply (simp add: word_less_nat_alt unat_ucast)\n  apply (subst mod_less)\n   apply(rule less_le_trans[OF unat_lt2p], simp)\n  apply (subst mod_less)\n   apply(rule less_le_trans[OF unat_lt2p], simp)\n  apply simp\n  done\n\nlemma sints_subset:\n  \"m \\<le> n \\<Longrightarrow> sints m \\<subseteq> sints n\"\n  apply (simp add: sints_num)\n  apply clarsimp\n  apply (rule conjI)\n   apply (erule order_trans[rotated])\n   apply simp\n  apply (erule order_less_le_trans)\n  apply simp\n  done\n\nlemma up_scast_inj:\n      \"\\<lbrakk> scast x = (scast y :: ('b :: len) word); size x \\<le> len_of TYPE('b) \\<rbrakk>\n         \\<Longrightarrow> x = y\"\n  apply (simp add: scast_def)\n  apply (subst(asm) word_sint.Abs_inject)\n    apply (erule subsetD [OF sints_subset])\n    apply (simp add: word_size)\n   apply (erule subsetD [OF sints_subset])\n   apply (simp add: word_size)\n  apply simp\n  done\n\nlemma up_scast_inj_eq:\n  \"len_of TYPE('a) \\<le> len_of TYPE ('b) \\<Longrightarrow> (scast x = (scast y::'b::len word)) = (x = (y::'a::len word))\"\n  by (fastforce dest: up_scast_inj simp: word_size)\n\nlemma nth_bounded:\n  \"\\<lbrakk>(x :: 'a :: len word) !! n; x < 2 ^ m; m \\<le> len_of TYPE ('a)\\<rbrakk> \\<Longrightarrow> n < m\"\n  apply (frule test_bit_size)\n  apply (clarsimp simp: test_bit_bl word_size)\n  apply (simp add: nth_rev)\n  apply (subst(asm) is_aligned_add_conv[OF is_aligned_0',\n                                        simplified add_0_left, rotated])\n   apply assumption+\n  apply (simp only: to_bl_0 word_bits_len_of)\n  apply (simp add: nth_append split: split_if_asm)\n  done\n\nlemma is_aligned_add_or:\n  \"\\<lbrakk>is_aligned p n; d < 2 ^ n\\<rbrakk> \\<Longrightarrow> p + d = p || d\"\n  apply (rule word_plus_and_or_coroll)\n  apply (erule is_aligned_get_word_bits)\n   apply (rule word_eqI)\n   apply (clarsimp simp add: is_aligned_nth)\n   apply (frule(1) nth_bounded)\n    apply simp+\n  done\n\nlemma two_power_increasing:\n  \"\\<lbrakk> n \\<le> m; m < len_of TYPE('a) \\<rbrakk> \\<Longrightarrow> (2 :: 'a :: len word) ^ n \\<le> 2 ^ m\"\n  by (simp add: word_le_nat_alt)\n\nlemma is_aligned_add_less_t2n:\n  \"\\<lbrakk>is_aligned (p\\<Colon>'a\\<Colon>len word) n; d < 2^n; n \\<le> m; p < 2^m\\<rbrakk> \\<Longrightarrow> p + d < 2^m\"\n  apply (case_tac \"m < len_of TYPE('a)\")\n   apply (subst mask_eq_iff_w2p[symmetric])\n    apply (simp add: word_size)\n   apply (simp add: is_aligned_add_or word_ao_dist less_mask_eq)\n   apply (subst less_mask_eq)\n    apply (erule order_less_le_trans)\n    apply (erule(1) two_power_increasing)\n   apply simp\n  apply (simp add: power_overflow)\n  done\n\n(* FIXME: generalise? *)\nlemma le_2p_upper_bits:\n  \"\\<lbrakk> (p::word32) \\<le> 2^n - 1; n < word_bits \\<rbrakk> \\<Longrightarrow> \\<forall>n'\\<ge>n. n' < word_bits \\<longrightarrow> \\<not> p !! n'\"\n  apply (subst upper_bits_unset_is_l2p, assumption)\n  apply simp\n  done\n\nlemma ran_upd':\n  \"\\<lbrakk>inj_on f (dom f); f y = Some z\\<rbrakk>\n  \\<Longrightarrow> ran (f (y := None)) = ran f - {z}\"\n  apply (drule (1) ran_upd)\n  apply (simp add: ran_def)\n  done\n\n(* FIXME: generalise? *)\nlemma le2p_bits_unset:\n  \"p \\<le> 2 ^ n - 1 \\<Longrightarrow> \\<forall>n'\\<ge>n. n' < word_bits \\<longrightarrow> \\<not> (p::word32) !! n'\"\n  apply (case_tac \"n < word_bits\")\n   apply (frule upper_bits_unset_is_l2p [where p=p])\n   apply simp_all\n  done\n\nlemma aligned_offset_non_zero:\n  \"\\<lbrakk> is_aligned x n; y < 2 ^ n; x \\<noteq> 0 \\<rbrakk> \\<Longrightarrow> x + y \\<noteq> 0\"\n  apply (cases \"y = 0\")\n   apply simp\n  apply (subst word_neq_0_conv)\n  apply (subst gt0_iff_gem1)\n  apply (erule is_aligned_get_word_bits)\n   apply (subst field_simps[symmetric], subst plus_le_left_cancel_nowrap)\n     apply (rule is_aligned_no_wrap')\n      apply simp\n     apply (rule minus_one_helper)\n      apply simp\n     apply assumption\n    apply (erule (1) is_aligned_no_wrap')\n   apply (simp add: gt0_iff_gem1 [symmetric] word_neq_0_conv)\n  apply simp\n  done\n\nlemma le_imp_power_dvd_int:\n  \"n \\<le> m \\<Longrightarrow> (b ^ n :: int) dvd b ^ m\"\n  apply (simp add: dvd_def)\n  apply (rule exI[where x=\"b ^ (m - n)\"])\n  apply (simp add: power_add[symmetric])\n  done\n\n    (* FIXME: this is identical to mask_eqs(1), unnecessary? *)\nlemma mask_inner_mask:\n  \"((p && mask n) + q) && mask n\n       = (p + q) && mask n\"\n  apply (rule mask_eqs(1))\n  done\n\nlemma mask_add_aligned:\n  \"is_aligned p n\n     \\<Longrightarrow> (p + q) && mask n = q && mask n\"\n  apply (simp add: is_aligned_mask)\n  apply (subst mask_inner_mask [symmetric])\n  apply simp\n  done\n\nlemma take_prefix:\n  \"(take (length xs) ys = xs) = (xs \\<le> ys)\"\nproof (induct xs arbitrary: ys)\n  case Nil thus ?case by simp\nnext\n  case Cons thus ?case by (cases ys) auto\nqed\n\nlemma rel_comp_Image:\n  \"(R O R') `` S = R' `` (R `` S)\"\n  by blast\n\nlemma trancl_power:\n  \"x \\<in> r^+ = (\\<exists>n > 0. x \\<in> r^^n)\"\n  apply (cases x)\n  apply simp\n  apply (rule iffI)\n   apply (drule tranclD2)\n   apply (clarsimp simp: rtrancl_is_UN_relpow)\n   apply (rule_tac x=\"Suc n\" in exI)\n   apply fastforce\n  apply clarsimp\n  apply (case_tac n, simp)\n  apply clarsimp\n  apply (drule relpow_imp_rtrancl)\n  apply fastforce\n  done\n\nlemma take_is_prefix:\n  \"take n xs \\<le> xs\"\n  apply (simp add: less_eq_list_def prefixeq_def)\n  apply (rule_tac x=\"drop n xs\" in exI)\n  apply simp\n  done\n\nlemma cart_singleton_empty:\n  \"(S \\<times> {e} = {}) = (S = {})\"\n  by blast\n\nlemma word_div_1:\n  \"(n :: ('a :: len) word) div 1 = n\"\n  by (simp add: word_div_def)\n\nlemma word_minus_one_le:\n  \"-1 \\<le> (x :: ('a :: len) word) = (x = -1)\"\n  apply (insert word_n1_ge[where y=x])\n  apply safe\n  apply (erule(1) order_antisym)\n  done\n\nlemmas word32_minus_one_le =\n    word_minus_one_le[where 'a=32, simplified]\n\nlemma mask_out_sub_mask:\n  \"(x && ~~ mask n) = x - (x && mask n)\"\n  by (simp add: field_simps word_plus_and_or_coroll2)\n\nlemma is_aligned_addD1:\n  assumes al1: \"is_aligned (x + y) n\"\n  and     al2: \"is_aligned (x::'a::len word) n\"\n  shows \"is_aligned y n\"\n  using al2\nproof (rule is_aligned_get_word_bits)\n  assume \"x = 0\" thus ?thesis using al1 by simp\nnext\n  assume nv: \"n < len_of TYPE('a)\"\n  from al1 obtain q1\n    where xy: \"x + y = 2 ^ n * of_nat q1\" and \"q1 < 2 ^ (len_of TYPE('a) - n)\"\n    by (rule is_alignedE)\n  moreover from al2 obtain q2\n    where x: \"x = 2 ^ n * of_nat q2\" and \"q2 < 2 ^ (len_of TYPE('a) - n)\"\n    by (rule is_alignedE)\n  ultimately have \"y = 2 ^ n * (of_nat q1 - of_nat q2)\"\n    by (simp add: field_simps)\n  thus ?thesis using nv by (simp add: is_aligned_mult_triv1)\nqed\n\nlemmas is_aligned_addD2 =\n       is_aligned_addD1[OF subst[OF add.commute,\n                                 of \"%x. is_aligned x n\" for n]]\n\nlemma is_aligned_add:\n  \"\\<lbrakk>is_aligned p n; is_aligned q n\\<rbrakk> \\<Longrightarrow> is_aligned (p + q) n\"\n  by (simp add: is_aligned_mask mask_add_aligned)\n\nlemma my_BallE: \"\\<lbrakk> \\<forall>x \\<in> A. P x; y \\<in> A; P y \\<Longrightarrow> Q \\<rbrakk> \\<Longrightarrow> Q\"\n  by (simp add: Ball_def)\n\nlemma word_le_add:\n  fixes x :: \"'a :: len word\"\n  shows \"x \\<le> y \\<Longrightarrow> \\<exists>n. y = x + of_nat n\"\n  apply (rule exI [where x = \"unat (y - x)\"])\n  apply simp\n  done\n\n\n\nlemma zipWith_nth:\n  \"\\<lbrakk> n < min (length xs) (length ys) \\<rbrakk> \\<Longrightarrow> zipWith f xs ys ! n = f (xs ! n) (ys ! n)\"\n  unfolding zipWith_def by simp\n\nlemma length_zipWith:\n  \"length (zipWith f xs ys) = min (length xs) (length ys)\"\n  unfolding zipWith_def by simp\n\nlemma distinct_prop_nth:\n  \"\\<lbrakk> distinct_prop P ls; n < n'; n' < length ls \\<rbrakk> \\<Longrightarrow> P (ls ! n) (ls ! n')\"\n  apply (induct ls arbitrary: n n')\n   apply simp\n  apply simp\n  apply (case_tac n')\n   apply simp\n  apply simp\n  apply (case_tac n)\n   apply simp\n  apply simp\n  done\n\nlemma shiftl_mask_is_0 :\n  \"(x << n) && mask n = 0\"\n  apply (rule iffD1 [OF is_aligned_mask])\n  apply (rule is_aligned_shiftl_self)\n  done\n\nlemma word_power_nonzero:\n  \"\\<lbrakk> (x :: word32) < 2 ^ (word_bits - n); n < word_bits; x \\<noteq> 0 \\<rbrakk> \\<Longrightarrow> x * 2 ^ n \\<noteq> 0\"\n  apply (cases \"n = 0\")\n   apply simp\n  apply (simp only: word_neq_0_conv word_less_nat_alt\n                    shiftl_t2n mod_0 unat_word_ariths\n                    unat_power_lower word_le_nat_alt word_bits_def)\n  apply (unfold word_bits_len_of)\n  apply (subst mod_less)\n   apply (subst mult.commute, erule nat_less_power_trans)\n   apply simp\n  apply simp\n  done\n\nlemmas unat_mult_simple = iffD1 [OF unat_mult_lem [where 'a = 32, unfolded word_bits_len_of]]\n\ndefinition\n  sum_map :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('c \\<Rightarrow> 'd) \\<Rightarrow> 'a + 'c \\<Rightarrow> 'b + 'd\" where\n \"sum_map f g x \\<equiv> case x of Inl v \\<Rightarrow> Inl (f v) | Inr v' \\<Rightarrow> Inr (g v')\"\n\nlemma sum_map_simps[simp]:\n  \"sum_map f g (Inl v) = Inl (f v)\"\n  \"sum_map f g (Inr w) = Inr (g w)\"\n  by (simp add: sum_map_def)+\n\nlemma if_and_helper:\n  \"(If x v v') && v'' = If x (v && v'') (v' && v'')\"\n  by (simp split: split_if)\n\nlemma unat_Suc2:\n  fixes n :: \"('a :: len) word\"\n  shows\n  \"n \\<noteq> -1 \\<Longrightarrow> unat (n + 1) = Suc (unat n)\"\n  apply (subst add.commute, rule unatSuc)\n  apply (subst eq_diff_eq[symmetric], simp add: minus_equation_iff)\n  done\n\nlemmas unat_eq_1\n    = unat_eq_0 word_unat.Rep_inject[where y=1, simplified]\n\nlemma cart_singleton_image:\n  \"S \\<times> {s} = (\\<lambda>v. (v, s)) ` S\"\n  by auto\n\nlemma singleton_eq_o2s:\n  \"({x} = set_option v) = (v = Some x)\"\n  by (cases v, auto)\n\nlemma ran_option_map_restrict_eq:\n  \"\\<lbrakk> x \\<in> ran (option_map f o g); x \\<notin> ran (option_map f o (g |` (- {y}))) \\<rbrakk>\n        \\<Longrightarrow> \\<exists>v. g y = Some v \\<and> f v = x\"\n  apply (clarsimp simp: elim!: ranE)\n  apply (rename_tac w z)\n  apply (case_tac \"w = y\")\n   apply clarsimp\n  apply (erule notE, rule_tac a=w in ranI)\n  apply (simp add: restrict_map_def)\n  done\n\nlemma option_set_singleton_eq:\n  \"(set_option opt = {v}) = (opt = Some v)\"\n  by (cases opt, simp_all)\n\nlemmas option_set_singleton_eqs\n    = option_set_singleton_eq\n      trans[OF eq_commute option_set_singleton_eq]\n\nlemma option_map_comp2:\n  \"option_map (f o g) = option_map f o option_map g\"\n  by (simp add: option.map_comp fun_eq_iff)\n\nlemma rshift_sub_mask_eq:\n  \"(a >> (size a - b)) && mask b = a >> (size a - b)\"\n  using shiftl_shiftr2[where a=a and b=0 and c=\"size a - b\"]\n  apply (cases \"b < size a\")\n   apply simp\n  apply (simp add: linorder_not_less mask_def word_size\n                   p2_eq_0[THEN iffD2])\n  done\n\nlemma shiftl_shiftr3:\n  \"b \\<le> c \\<Longrightarrow> a << b >> c = (a >> c - b) && mask (size a - c)\"\n  apply (cases \"b = c\")\n   apply (simp add: shiftl_shiftr1)\n  apply (simp add: shiftl_shiftr2)\n  done\n\nlemma and_mask_shiftr_comm:\n  \"m\\<le>size w \\<Longrightarrow> (w && mask m) >> n = (w >> n) && mask (m-n)\"\n   by (simp add: and_mask shiftr_shiftr) (simp add: word_size shiftl_shiftr3)\n\n\n\nlemma and_not_mask_twice:\n  \"(w && ~~ mask n) && ~~ mask m = w && ~~ mask (max m n)\"\napply (simp add: and_not_mask)\napply (case_tac \"n<m\")\n apply (simp_all add: shiftl_shiftr2 shiftl_shiftr1 not_less max_def\n                      shiftr_shiftr shiftl_shiftl)\n apply (cut_tac and_mask_shiftr_comm\n                [where w=w and m=\"size w\" and n=m, simplified,symmetric])\n apply (simp add: word_size mask_def)\napply (cut_tac and_mask_shiftr_comm\n               [where w=w and m=\"size w\" and n=n, simplified,symmetric])\napply (simp add: word_size mask_def)\ndone\n\n(* FIXME: move *)\nlemma word_less_cases:\n  \"x < y \\<Longrightarrow> x = y - 1 \\<or> x < y - (1 ::'a::len word)\"\n  apply (drule word_less_sub_1)\n  apply (drule order_le_imp_less_or_eq)\n  apply auto\n  done\n\nlemma eq_eqI:\n  \"a = b \\<Longrightarrow> (a = x) = (b = x)\"\n  by simp\n\nlemma mask_and_mask:\n  \"mask a && mask b = mask (min a b)\"\n  apply (rule word_eqI)\n  apply (simp add: word_size)\n  done\n\nlemma mask_eq_0_eq_x:\n  \"(x && w = 0) = (x && ~~ w = x)\"\n  using word_plus_and_or_coroll2[where x=x and w=w]\n  by auto\n\nlemma mask_eq_x_eq_0:\n  \"(x && w = x) = (x && ~~ w = 0)\"\n  using word_plus_and_or_coroll2[where x=x and w=w]\n  by auto\n\ndefinition\n  \"limited_and (x :: ('a :: len) word) y = (x && y = x)\"\n\nlemma limited_and_eq_0:\n  \"\\<lbrakk> limited_and x z; y && ~~ z = y \\<rbrakk> \\<Longrightarrow> x && y = 0\"\n  unfolding limited_and_def\n  apply (subst arg_cong2[where f=\"op &&\"])\n    apply (erule sym)+\n  apply (simp(no_asm) add: word_bw_assocs word_bw_comms word_bw_lcs)\n  done\n\nlemma limited_and_eq_id:\n  \"\\<lbrakk> limited_and x z; y && z = z \\<rbrakk> \\<Longrightarrow> x && y = x\"\n  unfolding limited_and_def\n  by (erule subst, fastforce simp: word_bw_lcs word_bw_assocs word_bw_comms)\n\nlemma lshift_limited_and:\n  \"limited_and x z \\<Longrightarrow> limited_and (x << n) (z << n)\"\n  unfolding limited_and_def\n  by (simp add: shiftl_over_and_dist[symmetric])\n\nlemma rshift_limited_and:\n  \"limited_and x z \\<Longrightarrow> limited_and (x >> n) (z >> n)\"\n  unfolding limited_and_def\n  by (simp add: shiftr_over_and_dist[symmetric])\n\nlemmas limited_and_simps1 = limited_and_eq_0 limited_and_eq_id\n\nlemmas is_aligned_limited_and\n    = is_aligned_neg_mask_eq[unfolded mask_def, folded limited_and_def]\n\nlemma compl_of_1: \"~~ 1 = (-2 :: ('a :: len) word)\"\n  apply (rule word_bool_alg.compl_eq_compl_iff[THEN iffD1])\n  apply simp\n  done\n\nlemmas limited_and_simps = limited_and_simps1\n       limited_and_simps1[OF is_aligned_limited_and]\n       limited_and_simps1[OF lshift_limited_and]\n       limited_and_simps1[OF rshift_limited_and]\n       limited_and_simps1[OF rshift_limited_and, OF is_aligned_limited_and]\n       compl_of_1 shiftl_shiftr1[unfolded word_size mask_def]\n       shiftl_shiftr2[unfolded word_size mask_def]\n\nlemma isRight_case_sum: \"isRight x \\<Longrightarrow> case_sum f g x = g (theRight x)\"\n  by (clarsimp simp add: isRight_def)\n\nlemma split_word_eq_on_mask:\n  \"(x = y) = (x && m = y && m \\<and> x && ~~ m = y && ~~ m)\"\n  apply safe\n  apply (rule word_eqI)\n  apply (drule_tac x=n in word_eqD)+\n  apply (simp add: word_size word_ops_nth_size)\n  apply auto\n  done\n\nlemma inj_case_bool:\n  \"inj (case_bool a b) = (a \\<noteq> b)\"\n  by (auto dest: inj_onD[where x=True and y=False]\n          intro: inj_onI split: bool.split_asm)\n\nlemma zip_map2:\n  \"zip as (map f bs) = map (\\<lambda>(a, b). (a, f b)) (zip as bs)\"\n  apply (induct bs arbitrary: as)\n   apply simp\n  apply (case_tac as)\n   apply simp\n  apply simp\n  done\n\nlemma zip_same: \"zip xs xs = map (\\<lambda>v. (v, v)) xs\"\n  by (induct xs, simp+)\n\nlemma foldl_fun_upd:\n  \"foldl (\\<lambda>s r. s (r := g r)) f rs\n     = (\\<lambda>x. if x \\<in> set rs then g x else f x)\"\n  apply (induct rs arbitrary: f)\n   apply simp\n  apply (auto simp: fun_eq_iff split: split_if)\n  done\n\nlemma all_rv_choice_fn_eq_pred:\n  \"\\<lbrakk> \\<And>rv. P rv \\<Longrightarrow> \\<exists>fn. f rv = g fn \\<rbrakk>\n    \\<Longrightarrow> \\<exists>fn. \\<forall>rv. P rv \\<longrightarrow> f rv = g (fn rv)\"\n  apply (rule_tac x=\"\\<lambda>rv. SOME h. f rv = g h\" in exI)\n  apply (clarsimp split: split_if)\n  apply (erule meta_allE, drule(1) meta_mp, elim exE)\n  apply (erule someI)\n  done\n\nlemma ex_const_function:\n  \"\\<exists>f. \\<forall>s. f (f' s) = v\"\n  by force\n\nlemma sum_to_zero:\n  \"(a :: 'a :: ring) + b = 0 \\<Longrightarrow> a = (- b)\"\n  by (drule arg_cong[where f=\"\\<lambda> x. x - a\"], simp)\n\nlemma nat_le_Suc_less_imp:\n  \"x < y \\<Longrightarrow> x \\<le> y - Suc 0\"\n  by arith\n\nlemma list_case_If2:\n  \"case_list f g xs = If (xs = []) f (g (hd xs) (tl xs))\"\n  by (simp split: list.split)\n\nlemma length_ineq_not_Nil:\n  \"length xs > n \\<Longrightarrow> xs \\<noteq> []\"\n  \"length xs \\<ge> n \\<Longrightarrow> n \\<noteq> 0 \\<longrightarrow> xs \\<noteq> []\"\n  \"\\<not> length xs < n \\<Longrightarrow> n \\<noteq> 0 \\<longrightarrow> xs \\<noteq> []\"\n  \"\\<not> length xs \\<le> n \\<Longrightarrow> xs \\<noteq> []\"\n  by auto\n\nlemma numeral_eqs:\n  \"2 = Suc (Suc 0)\"\n  \"3 = Suc (Suc (Suc 0))\"\n  \"4 = Suc (Suc (Suc (Suc 0)))\"\n  \"5 = Suc (Suc (Suc (Suc (Suc 0))))\"\n  \"6 = Suc (Suc (Suc (Suc (Suc (Suc 0)))))\"\n  by simp+\n\nlemma psubset_singleton:\n  \"(S \\<subset> {x}) = (S = {})\"\n  by blast\n\nlemma ucast_not_helper:\n  fixes a::word8\n  assumes a: \"a \\<noteq> 0xFF\"\n  shows \"ucast a \\<noteq> (0xFF::word32)\"\nproof\n  assume \"ucast a = (0xFF::word32)\"\n  also\n  have \"(0xFF::word32) = ucast (0xFF::word8)\" by simp\n  finally\n  show False using a\n    apply -\n    apply (drule up_ucast_inj, simp)\n    apply simp\n    done\nqed\n\nlemma length_takeWhile_ge:\n  \"length (takeWhile f xs) = n\n     \\<Longrightarrow> length xs = n \\<or> (length xs > n \\<and> \\<not> f (xs ! n))\"\n  apply (induct xs arbitrary: n)\n   apply simp\n  apply (simp split: split_if_asm)\n  apply (case_tac n, simp_all)\n  done\n\nlemma length_takeWhile_le:\n  \"\\<not> f (xs ! n) \\<Longrightarrow>\n     length (takeWhile f xs) \\<le> n\"\n  apply (induct xs arbitrary: n)\n   apply simp\n  apply (clarsimp split: split_if)\n  apply (case_tac n, simp_all)\n  done\n\nlemma length_takeWhile_gt:\n  \"n < length (takeWhile f xs)\n       \\<Longrightarrow> (\\<exists>ys zs. length ys = Suc n \\<and> xs = ys @ zs \\<and> takeWhile f xs = ys @ takeWhile f zs)\"\n  apply (induct xs arbitrary: n)\n   apply simp\n  apply (simp split: split_if_asm)\n  apply (case_tac n, simp_all)\n   apply (rule_tac x=\"[a]\" in exI)\n   apply simp\n  apply (erule meta_allE, drule(1) meta_mp)\n  apply clarsimp\n  apply (rule_tac x=\"a # ys\" in exI)\n  apply simp\n  done\n\nlemma hd_drop_conv_nth2:\n  \"n < length xs \\<Longrightarrow> hd (drop n xs) = xs ! n\"\n  by (rule hd_drop_conv_nth, clarsimp+)\n\nlemma map_upt_eq_vals_D:\n  \"\\<lbrakk> map f [0 ..< n] = ys; m < length ys \\<rbrakk> \\<Longrightarrow> f m = ys ! m\"\n  by clarsimp\n\nlemma length_le_helper:\n  \"\\<lbrakk> n \\<le> length xs; n \\<noteq> 0 \\<rbrakk> \\<Longrightarrow> xs \\<noteq> [] \\<and> n - 1 \\<le> length (tl xs)\"\n  by (cases xs, simp_all)\n\nlemma all_ex_eq_helper:\n  \"(\\<forall>v. (\\<exists>v'. v = f v' \\<and> P v v') \\<longrightarrow> Q v)\n      = (\\<forall>v'. P (f v') v' \\<longrightarrow> Q (f v'))\"\n  by auto\n\nlemma less_4_cases:\n  \"(x::word32) < 4 \\<Longrightarrow> x=0 \\<or> x=1 \\<or> x=2 \\<or> x=3\"\n  apply clarsimp\n  apply (drule word_less_cases, erule disjE, simp, simp)+\n  done\n\nlemma if_n_0_0:\n  \"((if P then n else 0) \\<noteq> 0) = (P \\<and> n \\<noteq> 0)\"\n  by (simp split: split_if)\n\nlemma insert_dom:\n  assumes fx: \"f x = Some y\"\n  shows   \"insert x (dom f) = dom f\"\n  unfolding dom_def using fx by auto\n\nlemma map_comp_subset_dom:\n  \"dom (prj \\<circ>\\<^sub>m f) \\<subseteq> dom f\"\n  unfolding dom_def\n  by (auto simp: map_comp_Some_iff)\n\nlemmas map_comp_subset_domD = subsetD [OF map_comp_subset_dom]\n\nlemma dom_map_comp:\n  \"x \\<in> dom (prj \\<circ>\\<^sub>m f) = (\\<exists>y z. f x = Some y \\<and> prj y = Some z)\"\n  by (fastforce simp: dom_def map_comp_Some_iff)\n\nlemma option_map_Some_eq2:\n  \"(Some y = option_map f x) = (\\<exists>z. x = Some z \\<and> f z = y)\"\n  by (metis map_option_eq_Some)\n\nlemma option_map_eq_dom_eq:\n  assumes ome: \"option_map f \\<circ> g = option_map f \\<circ> g'\"\n  shows   \"dom g = dom g'\"\nproof (rule set_eqI)\n  fix x\n  {\n    assume \"x \\<in> dom g\"\n    hence \"Some (f (the (g x))) = (option_map f \\<circ> g) x\"\n      by (auto simp: map_option_case split: option.splits)\n    also have \"\\<dots> = (option_map f \\<circ> g') x\" by (simp add: ome)\n    finally have \"x \\<in> dom g'\"\n      by (auto simp: map_option_case split: option.splits)\n  } moreover\n  {\n    assume \"x \\<in> dom g'\"\n    hence \"Some (f (the (g' x))) = (option_map f \\<circ> g') x\"\n      by (auto simp: map_option_case split: option.splits)\n    also have \"\\<dots> = (option_map f \\<circ> g) x\" by (simp add: ome)\n    finally have \"x \\<in> dom g\"\n      by (auto simp: map_option_case split: option.splits)\n  } ultimately show \"(x \\<in> dom g) = (x \\<in> dom g')\" by auto\nqed\n\nlemma map_comp_eqI:\n  assumes dm: \"dom g = dom g'\"\n  and     fg: \"\\<And>x. x \\<in> dom g' \\<Longrightarrow> f (the (g' x)) = f (the (g x))\"\n  shows  \"f \\<circ>\\<^sub>m g = f \\<circ>\\<^sub>m g'\"\n  apply (rule ext)\n  apply (case_tac \"x \\<in> dom g\")\n   apply (frule subst [OF dm])\n   apply (clarsimp split: option.splits)\n   apply (frule domI [where m = g'])\n   apply (drule fg)\n   apply simp\n  apply (frule subst [OF dm])\n  apply clarsimp\n  apply (drule not_sym)\n  apply (clarsimp simp: map_comp_Some_iff)\n  done\n\nlemma is_aligned_0:\n  \"is_aligned 0 n\"\n  unfolding is_aligned_def\n  by simp\n\nlemma compD:\n  \"\\<lbrakk>f \\<circ> g = f \\<circ> g'; g x = v \\<rbrakk> \\<Longrightarrow> f (g' x) = f v\"\n  apply clarsimp\n  apply (subgoal_tac \"(f (g x)) = (f \\<circ> g) x\")\n   apply simp\n  apply (simp (no_asm))\n  done\n\nlemma option_map_comp_eqE:\n  assumes om: \"option_map f \\<circ> mp = option_map f \\<circ> mp'\"\n  and     p1: \"\\<lbrakk> mp x = None; mp' x = None \\<rbrakk> \\<Longrightarrow> P\"\n  and     p2: \"\\<And>v v'. \\<lbrakk> mp x = Some v; mp' x = Some v'; f v = f v' \\<rbrakk> \\<Longrightarrow> P\"\n  shows \"P\"\nproof (cases \"mp x\")\n  case None\n  hence \"x \\<notin> dom mp\" by (simp add: domIff)\n  hence \"mp' x = None\" by (simp add: option_map_eq_dom_eq [OF om] domIff)\n  with None show ?thesis by (rule p1)\nnext\n  case (Some v)\n  hence \"x \\<in> dom mp\" by clarsimp\n  then obtain v' where Some': \"mp' x = Some v'\" by (clarsimp simp add: option_map_eq_dom_eq [OF om])\n  with Some show ?thesis\n  proof (rule p2)\n    show \"f v = f v'\" using Some' compD [OF om, OF Some] by simp\n  qed\nqed\n\nlemma Some_the:\n  \"x \\<in> dom f \\<Longrightarrow> f x = Some (the (f x))\"\n  by clarsimp\n\nlemma map_comp_update:\n  \"f \\<circ>\\<^sub>m (g(x \\<mapsto> v)) = (f \\<circ>\\<^sub>m g)(x := f v)\"\n  apply (rule ext)\n  apply clarsimp\n  apply (case_tac \"g xa\")\n   apply simp\n  apply simp\n  done\n\nlemma restrict_map_eqI:\n  assumes req: \"A |` S = B |` S\"\n  and     mem: \"x \\<in> S\"\n  shows   \"A x = B x\"\nproof -\n  from mem have \"A x = (A |` S) x\" by simp\n  also have \"\\<dots> = (B |` S) x\" using req by simp\n  also have \"\\<dots> = B x\" using mem by simp\n  finally show ?thesis .\nqed\n\nlemma word_or_zero:\n  \"(a || b = 0) = (a = 0 \\<and> b = 0)\"\n  apply (safe, simp_all)\n   apply (rule word_eqI, drule_tac x=n in word_eqD, simp)+\n  done\n\nlemma aligned_shiftr_mask_shiftl:\n  \"is_aligned x n \\<Longrightarrow> ((x >> n) && mask v) << n = x && mask (v + n)\"\n  apply (rule word_eqI)\n  apply (simp add: word_size nth_shiftl nth_shiftr)\n  apply (subgoal_tac \"\\<forall>m. x !! m \\<longrightarrow> m \\<ge> n\")\n   apply auto[1]\n  apply (clarsimp simp: is_aligned_mask)\n  apply (drule_tac x=m in word_eqD)\n  apply (frule test_bit_size)\n  apply (simp add: word_size)\n  done\n\nlemma word_and_1_shiftl:\n  fixes x :: \"('a :: len) word\" shows\n  \"x && (1 << n) = (if x !! n then (1 << n) else 0)\"\n  apply (rule word_eqI)\n  apply (simp add: word_size nth_shiftl split: split_if del: shiftl_1)\n  apply auto\n  done\n\nlemmas word_and_1_shiftls\n    = word_and_1_shiftl[where n=0, simplified]\n      word_and_1_shiftl[where n=1, simplified]\n      word_and_1_shiftl[where n=2, simplified]\n\nlemma word_and_mask_shiftl:\n  \"x && (mask n << m) = ((x >> m) && mask n) << m\"\n  apply (rule word_eqI)\n  apply (simp add: word_size nth_shiftl nth_shiftr)\n  apply auto\n  done\n\nlemma toEnum_eq_to_fromEnum_eq:\n  fixes v :: \"'a :: enum\" shows\n  \"n \\<le> fromEnum (maxBound :: 'a) \\<Longrightarrow> (toEnum n = v) = (n = fromEnum v)\"\n  apply (rule iffI)\n   apply (drule arg_cong[where f=fromEnum])\n   apply simp\n  apply (drule arg_cong[where f=\"toEnum :: nat \\<Rightarrow> 'a\"])\n  apply simp\n  done\n\nlemma if_Const_helper:\n  \"If P (Con x) (Con y) = Con (If P x y)\"\n  by (simp split: split_if)\n\nlemmas if_Some_helper = if_Const_helper[where Con=Some]\n\nlemma expand_restrict_map_eq:\n  \"(m |` S = m' |` S) = (\\<forall>x. x \\<in> S \\<longrightarrow> m x = m' x)\"\n  by (simp add: fun_eq_iff restrict_map_def split: split_if)\n\nlemma unat_ucast_8_32:\n  fixes x :: \"word8\"\n  shows \"unat (ucast x :: word32) = unat x\"\n  unfolding ucast_def unat_def\n  apply (subst int_word_uint)\n  apply (subst mod_pos_pos_trivial)\n    apply simp\n   apply (rule lt2p_lem)\n   apply simp\n  apply simp\n  done\n\nlemma disj_imp_rhs:\n  \"(P \\<Longrightarrow> Q) \\<Longrightarrow> (P \\<or> Q) = Q\"\n  by blast\n\nlemma remove1_filter:\n  \"distinct xs \\<Longrightarrow> remove1 x xs = filter (\\<lambda>y. x \\<noteq> y) xs\"\n  apply (induct xs)\n   apply simp\n  apply clarsimp\n  apply (rule sym, rule filter_True)\n  apply clarsimp\n  done\n\nlemma if_then_1_else_0:\n  \"((if P then 1 else 0) = (0 :: word32)) = (\\<not> P)\"\n  by simp\n\nlemma if_then_0_else_1:\n  \"((if P then 0 else 1) = (0 :: word32)) = (P)\"\n  by simp\n\nlemmas if_then_simps = if_then_0_else_1 if_then_1_else_0\n\n\n\nlemma nat_less_cases':\n  \"(x::nat) < y \\<Longrightarrow> x = y - 1 \\<or> x < y - 1\"\n  by (fastforce intro: nat_less_cases)\n\nlemma word32_FF_is_mask:\n  \"0xFF = mask 8 \"\n  by (simp add: mask_def)\n\nlemma filter_to_shorter_upto:\n  \"n \\<le> m \\<Longrightarrow> filter (\\<lambda>x. x < n) [0 ..< m] = [0 ..< n]\"\n  apply (induct m)\n   apply simp\n  apply clarsimp\n  apply (erule le_SucE)\n   apply simp\n  apply simp\n  done\n\nlemma in_emptyE: \"\\<lbrakk> A = {}; x \\<in> A \\<rbrakk> \\<Longrightarrow> P\" by blast\n\nlemma ucast_of_nat_small:\n  \"x < 2 ^ len_of TYPE('a) \\<Longrightarrow>\n     ucast (of_nat x :: ('a :: len) word) = (of_nat x :: ('b :: len) word)\"\n  apply (rule sym, subst word_unat.inverse_norm)\n  apply (simp add: ucast_def word_of_int[symmetric]\n                   of_nat_nat[symmetric] unat_def[symmetric])\n  apply (simp add: unat_of_nat)\n  done\n\nlemma word_le_make_less:\n  fixes x :: \"('a :: len) word\"\n  shows \"y \\<noteq> -1 \\<Longrightarrow> (x \\<le> y) = (x < (y + 1))\"\n  apply safe\n  apply (erule plus_one_helper2)\n  apply (simp add: eq_diff_eq[symmetric])\n  done\n\nlemma Ball_emptyI:\n  \"S = {} \\<Longrightarrow> (\\<forall>x \\<in> S. P x)\"\n  by simp\n\nlemma allfEI:\n  \"\\<lbrakk> \\<forall>x. P x; \\<And>x. P (f x) \\<Longrightarrow> Q x \\<rbrakk> \\<Longrightarrow> \\<forall>x. Q x\"\n  by fastforce\n\nlemma arith_is_1:\n  \"\\<lbrakk> x \\<le> Suc 0; x > 0 \\<rbrakk> \\<Longrightarrow> x = 1\"\n  by arith\n\n(* sjw: combining lemmas here :( *)\nlemma cart_singleton_empty2:\n  \"({x} \\<times> S = {}) = (S = {})\"\n  \"({} = S \\<times> {e}) = (S = {})\"\n  by auto\n\nlemma cases_simp_conj:\n  \"((P \\<longrightarrow> Q) \\<and> (\\<not> P \\<longrightarrow> Q) \\<and> R) = (Q \\<and> R)\"\n  by fastforce\n\nlemma domE :\n  \"\\<lbrakk> x \\<in> dom m; \\<And>r. \\<lbrakk>m x = Some r\\<rbrakk> \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> P\"\n  by clarsimp\n\nlemma dom_eqD:\n  \"\\<lbrakk> f x = Some v; dom f = S \\<rbrakk> \\<Longrightarrow> x \\<in> S\"\n  by clarsimp\n\nlemma exception_set_finite:\n  \"finite {x. P x} \\<Longrightarrow> finite {x. (x = y \\<longrightarrow> Q x) \\<and> P x}\"\n  \"finite {x. P x} \\<Longrightarrow> finite {x. x \\<noteq> y \\<longrightarrow> P x}\"\n   apply (simp add: Collect_conj_eq)\n  apply (subst imp_conv_disj, subst Collect_disj_eq)\n  apply simp\n  done\n\nlemma exfEI:\n  \"\\<lbrakk> \\<exists>x. P x; \\<And>x. P x \\<Longrightarrow> Q (f x) \\<rbrakk> \\<Longrightarrow> \\<exists>x. Q x\"\n  by fastforce\n\nlemma finite_word: \"finite (S :: (('a :: len) word) set)\"\n  by (rule finite)\n\nlemma if_f:\n  \"(if a then f b else f c) = f (if a then b else c)\"\n  by simp\n\nlemma in_16_range:\n  \"0 \\<in> S \\<Longrightarrow> r \\<in> (\\<lambda>x. r + x * (16 :: word32)) ` S\"\n  \"n - 1 \\<in> S \\<Longrightarrow> (r + (16 * n - 16)) \\<in> (\\<lambda>x :: word32. r + x * 16) ` S\"\n  by (clarsimp simp: image_def\n              elim!: bexI[rotated])+\n\ndefinition\n  \"modify_map m p f \\<equiv> m (p := option_map f (m p))\"\n\nlemma modify_map_id:\n  \"modify_map m p id = m\"\n  by (auto simp add: modify_map_def map_option_case split: option.splits)\n\nlemma modify_map_addr_com:\n  assumes com: \"x \\<noteq> y\"\n  shows \"modify_map (modify_map m x g) y f = modify_map (modify_map m y f) x g\"\n  by (rule ext)\n     (simp add: modify_map_def map_option_case com split: option.splits)\n\nlemma modify_map_dom :\n  \"dom (modify_map m p f) = dom m\"\n  unfolding modify_map_def\n  apply (cases \"m p\")\n   apply simp\n   apply (simp add: dom_def)\n  apply simp\n  apply (rule insert_absorb)\n  apply (simp add: dom_def)\n  done\n\nlemma modify_map_None:\n  \"m x = None \\<Longrightarrow> modify_map m x f = m\"\n  by (rule ext) (simp add: modify_map_def)\n\nlemma modify_map_ndom :\n  \"x \\<notin> dom m \\<Longrightarrow> modify_map m x f = m\"\n  by (rule modify_map_None) clarsimp\n\nlemma modify_map_app:\n  \"(modify_map m p f) q = (if p = q then option_map f (m p) else m q)\"\n  unfolding modify_map_def by simp\n\nlemma modify_map_apply:\n  \"m p = Some x \\<Longrightarrow> modify_map m p f = m (p \\<mapsto> f x)\"\n  by (simp add: modify_map_def)\n\nlemma modify_map_com:\n  assumes com: \"\\<And>x. f (g x) = g (f x)\"\n  shows \"modify_map (modify_map m x g) y f = modify_map (modify_map m y f) x g\"\n  using assms by (auto simp: modify_map_def map_option_case split: option.splits)\n\nlemma modify_map_comp:\n  \"modify_map m x (f o g) = modify_map (modify_map m x g) x f\"\n  by (rule ext) (simp add: modify_map_def option.map_comp)\n\nlemma modify_map_exists_eq:\n  \"(\\<exists>cte. modify_map m p' f p= Some cte) = (\\<exists>cte. m p = Some cte)\"\n  by (auto simp: modify_map_def split: if_splits)\n\nlemma modify_map_other:\n  \"p \\<noteq> q \\<Longrightarrow> (modify_map m p f) q = (m q)\"\n  by (simp add: modify_map_app)\n\nlemma modify_map_same:\n  \"(modify_map m p f) p = (option_map f (m p))\"\n  by (simp add: modify_map_app)\n\nlemma next_update_is_modify:\n  \"\\<lbrakk> m p = Some cte'; cte = f cte' \\<rbrakk> \\<Longrightarrow> (m(p \\<mapsto> cte)) = (modify_map m p f)\"\n  unfolding modify_map_def by simp\n\nlemma nat_power_minus_less:\n  \"a < 2 ^ (x - n) \\<Longrightarrow> (a :: nat) < 2 ^ x\"\n  apply (erule order_less_le_trans)\n  apply simp\n  done\n\nlemma neg_rtranclI:\n  \"\\<lbrakk> x \\<noteq> y; (x, y) \\<notin> R\\<^sup>+ \\<rbrakk> \\<Longrightarrow> (x, y) \\<notin> R\\<^sup>*\"\n  apply (erule contrapos_nn)\n  apply (drule rtranclD)\n  apply simp\n  done\n\nlemma neg_rtrancl_into_trancl:\n  \"\\<not> (x, y) \\<in> R\\<^sup>* \\<Longrightarrow> \\<not> (x, y) \\<in> R\\<^sup>+\"\n  by (erule contrapos_nn, erule trancl_into_rtrancl)\n\nlemma set_neqI:\n  \"\\<lbrakk> x \\<in> S; x \\<notin> S' \\<rbrakk> \\<Longrightarrow> S \\<noteq> S'\"\n  by clarsimp\n\nlemma set_pair_UN:\n  \"{x. P x} = UNION {xa. \\<exists>xb. P (xa, xb)} (\\<lambda>xa. {xa} \\<times> {xb. P (xa, xb)})\"\n  apply safe\n  apply (rule_tac a=a in UN_I)\n   apply blast+\n  done\n\nlemma singleton_elemD:\n  \"S = {x} \\<Longrightarrow> x \\<in> S\"\n  by simp\n\nlemma word_to_1_set:\n  \"{0 ..< (1 :: ('a :: len) word)} = {0}\"\n  by fastforce\n\nlemma ball_ran_eq:\n  \"(\\<forall>y \\<in> ran m. P y) = (\\<forall>x y. m x = Some y \\<longrightarrow> P y)\"\n  by (auto simp add: ran_def)\n\nlemma cart_helper:\n  \"({} = {x} \\<times> S) = (S = {})\"\n  by blast\n\nlemmas converse_trancl_induct' = converse_trancl_induct [consumes 1, case_names base step]\n\nlemma disjCI2: \"(\\<not> P \\<Longrightarrow> Q) \\<Longrightarrow> P \\<or> Q\" by blast\n\nlemma insert_UNIV :\n  \"insert x UNIV = UNIV\"\n  by blast\n\nlemma not_singletonE:\n  \"\\<lbrakk> \\<forall>p. S \\<noteq> {p}; S \\<noteq> {}; \\<And>p p'. \\<lbrakk> p \\<noteq> p'; p \\<in> S; p' \\<in> S \\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  by blast\n\nlemma not_singleton_oneE:\n  \"\\<lbrakk> \\<forall>p. S \\<noteq> {p}; p \\<in> S; \\<And>p'. \\<lbrakk> p \\<noteq> p'; p' \\<in> S \\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  apply (erule not_singletonE)\n   apply clarsimp\n  apply (case_tac \"p = p'\")\n   apply fastforce\n  apply fastforce\n  done\n\nlemma interval_empty:\n  \"({m..n} = {}) = (\\<not> m \\<le> (n::'a::order))\"\n  apply (rule iffI)\n   apply clarsimp\n  apply auto\n  done\n\nlemma range_subset_eq2:\n  \"{a :: word32 .. b} \\<noteq> {} \\<Longrightarrow> ({a .. b} \\<subseteq> {c .. d}) = (c \\<le> a \\<and> b \\<le> d)\"\n  by (simp add: interval_empty)\n\nlemma singleton_eqD: \"A = {x} \\<Longrightarrow> x \\<in> A\" by blast\n\nlemma ball_ran_fun_updI:\n  \"\\<lbrakk> \\<forall>v \\<in> ran m. P v; \\<forall>v. y = Some v \\<longrightarrow> P v \\<rbrakk>\n        \\<Longrightarrow> \\<forall>v \\<in> ran (m (x := y)). P v\"\n  by (auto simp add: ran_def)\n\nlemma ball_ran_modify_map_eq:\n  \"\\<lbrakk> \\<forall>v. m x = Some v \\<longrightarrow> P (f v) = P v \\<rbrakk>\n        \\<Longrightarrow> (\\<forall>v \\<in> ran (modify_map m x f). P v) = (\\<forall>v \\<in> ran m. P v)\"\n  apply (simp add: ball_ran_eq)\n  apply (rule iff_allI)\n  apply (auto simp: modify_map_def)\n  done\n\nlemma disj_imp: \"(P \\<or> Q) = (\\<not>P \\<longrightarrow> Q)\" by blast\n\nlemma eq_singleton_redux:\n  \"\\<lbrakk> S = {x} \\<rbrakk> \\<Longrightarrow> x \\<in> S\"\n  by simp\n\nlemma if_eq_elem_helperE:\n  \"\\<lbrakk> x \\<in> (if P then S else S');\n    \\<lbrakk> P;   x \\<in> S  \\<rbrakk> \\<Longrightarrow> a = b;\n    \\<lbrakk> \\<not> P; x \\<in> S' \\<rbrakk> \\<Longrightarrow> a = c\n   \\<rbrakk> \\<Longrightarrow> a = (if P then b else c)\"\n  by fastforce\n\nlemma if_option_Some :\n  \"((if P then None else Some x) = Some y) = (\\<not>P \\<and> x = y)\"\n  by simp\n\nlemma insert_minus_eq:\n  \"x \\<notin> A \\<Longrightarrow> A - S = (A - (S - {x}))\"\n  by auto\n\nlemma map2_Cons_2_3:\n  \"(map2 f xs (y # ys) = (z # zs)) = (\\<exists>x xs'. xs = x # xs' \\<and> f x y = z \\<and> map2 f xs' ys = zs)\"\n  by (case_tac xs, simp_all)\n\nlemma map2_xor_replicate_False:\n  \"map2 (\\<lambda>(x\\<Colon>bool) y\\<Colon>bool. x = (\\<not> y)) xs (replicate n False) = take n xs\"\n  apply (induct xs arbitrary: n)\n   apply simp\n  apply (case_tac n)\n   apply (simp add: map2_def)\n  apply simp\n  done\n\nlemma modify_map_K_D:\n  \"modify_map m p (\\<lambda>x. y) p' = Some v \\<Longrightarrow> (m (p \\<mapsto> y)) p' = Some v\"\n  by (simp add: modify_map_def split: split_if_asm)\n\nlemmas tranclE2' = tranclE2 [consumes 1, case_names base trancl]\n\nlemma weak_imp_cong:\n  \"\\<lbrakk> P = R; Q = S \\<rbrakk> \\<Longrightarrow> (P \\<longrightarrow> Q) = (R \\<longrightarrow> S)\"\n  by simp\n\nlemma Collect_Diff_restrict_simp:\n  \"T - {x \\<in> T. Q x} = T - {x. Q x}\"\n  by (auto intro: Collect_cong)\n\nlemma Collect_Int_pred_eq:\n  \"{x \\<in> S. P x} \\<inter> {x \\<in> T. P x} = {x \\<in> (S \\<inter> T). P x}\"\n  by (simp add: Collect_conj_eq [symmetric] conj_comms)\n\nlemma Collect_restrict_predR:\n  \"{x. P x} \\<inter> T = {} \\<Longrightarrow> {x. P x} \\<inter> {x \\<in> T. Q x} = {}\"\n  apply (subst Collect_conj_eq [symmetric])\n  apply (simp add: disjoint_iff_not_equal)\n  apply rule\n  apply (drule_tac x = x in spec)\n  apply clarsimp\n  apply (drule (1) bspec)\n  apply simp\n  done\n\nlemma Diff_Un2:\n  assumes emptyad: \"A \\<inter> D = {}\"\n  and     emptybc: \"B \\<inter> C = {}\"\n  shows   \"(A \\<union> B) - (C \\<union> D) = (A - C) \\<union> (B - D)\"\nproof -\n  have \"(A \\<union> B) - (C \\<union> D) = (A \\<union> B - C) \\<inter> (A \\<union> B - D)\"\n    by (rule Diff_Un)\n  also have \"\\<dots> = ((A - C) \\<union> B) \\<inter> (A \\<union> (B - D))\" using emptyad emptybc\n    by (simp add: Un_Diff Diff_triv)\n  also have \"\\<dots> = (A - C) \\<union> (B - D)\"\n  proof -\n    have \"(A - C) \\<inter> (A \\<union> (B - D)) = A - C\" using  emptyad emptybc\n      by (metis Diff_Int2 Diff_Int_distrib2 inf_sup_absorb)\n    moreover\n    have \"B \\<inter> (A \\<union> (B - D)) = B - D\" using emptyad emptybc\n      by (metis Int_Diff Un_Diff Un_Diff_Int Un_commute Un_empty_left inf_sup_absorb)\n    ultimately show ?thesis\n      by (simp add: Int_Un_distrib2)\n  qed\n  finally show ?thesis .\nqed\n\nlemma ballEI:\n  \"\\<lbrakk> \\<forall>x \\<in> S. Q x; \\<And>x. \\<lbrakk> x \\<in> S; Q x \\<rbrakk> \\<Longrightarrow> P x \\<rbrakk> \\<Longrightarrow> \\<forall>x \\<in> S. P x\"\n  by auto\n\nlemma dom_if_None:\n  \"dom (\\<lambda>x. if P x then None else f x)\n     = dom f - {x. P x}\"\n  by (simp add: dom_def, fastforce)\n\nlemma notemptyI:\n  \"x \\<in> S \\<Longrightarrow> S \\<noteq> {}\"\n  by clarsimp\n\nlemma plus_Collect_helper:\n  \"op + x ` {xa. P (xa :: ('a :: len) word)} = {xa. P (xa - x)}\"\n  by (fastforce simp add: image_def)\n\nlemma plus_Collect_helper2:\n  \"op + (- x) ` {xa. P (xa :: ('a :: len) word)} = {xa. P (x + xa)}\"\n  by (simp add: field_simps plus_Collect_helper)\n\nlemma restrict_map_Some_iff:\n  \"((m |` S) x = Some y) = (m x = Some y \\<and> x \\<in> S)\"\n  by (cases \"x \\<in> S\", simp_all)\n\nlemma context_case_bools:\n  \"\\<lbrakk> \\<And>v. P v \\<Longrightarrow> R v; \\<lbrakk> \\<not> P v; \\<And>v. P v \\<Longrightarrow> R v \\<rbrakk> \\<Longrightarrow> R v \\<rbrakk> \\<Longrightarrow> R v\"\n  by (cases \"P v\", simp_all)\n\nlemma inj_on_fun_upd_strongerI:\n  \"\\<lbrakk>inj_on f A; y \\<notin> f ` (A - {x})\\<rbrakk> \\<Longrightarrow> inj_on (f(x := y)) A\"\n  apply (simp add: inj_on_def)\n  apply blast\n  done\n\nlemma less_handy_casesE:\n  \"\\<lbrakk> m < n; m = 0 \\<Longrightarrow> R;\n     \\<And>m' n'. \\<lbrakk> n = Suc n'; m = Suc m'; m < n \\<rbrakk> \\<Longrightarrow> R \\<rbrakk>\n     \\<Longrightarrow> R\"\n  apply (case_tac n, simp_all)\n  apply (case_tac m, simp_all)\n  done\n\nlemma subset_drop_Diff_strg:\n  \"(A \\<subseteq> C) \\<longrightarrow> (A - B \\<subseteq> C)\"\n  by blast\n\nlemma word32_count_from_top:\n  \"n \\<noteq> 0 \\<Longrightarrow> {0 ..< n :: word32} = {0 ..< n - 1} \\<union> {n - 1}\"\n  apply (rule set_eqI, rule iffI)\n   apply simp\n   apply (drule minus_one_helper3)\n   apply (rule disjCI)\n   apply simp\n  apply simp\n  apply (erule minus_one_helper5)\n  apply fastforce\n  done\n\nlemma Int_Union_empty:\n  \"(\\<And>x. x \\<in> S \\<Longrightarrow> A \\<inter> P x = {}) \\<Longrightarrow> A \\<inter> (\\<Union>x \\<in> S. P x) = {}\"\n  by auto\n\nlemma UN_Int_empty:\n  \"(\\<And>x. x \\<in> S \\<Longrightarrow> P x \\<inter> T = {}) \\<Longrightarrow> (\\<Union>x \\<in> S. P x) \\<inter> T = {}\"\n  by auto\n\nlemma disjointI:\n  \"\\<lbrakk>\\<And>x y. \\<lbrakk> x \\<in> A; y \\<in> B \\<rbrakk> \\<Longrightarrow> x \\<noteq> y \\<rbrakk> \\<Longrightarrow> A \\<inter> B = {}\"\n  by auto\n\nlemma UN_disjointI:\n  assumes rl: \"\\<And>x y. \\<lbrakk> x \\<in> A; y \\<in> B \\<rbrakk> \\<Longrightarrow> P x \\<inter> Q y = {}\"\n  shows \"(\\<Union>x \\<in> A. P x) \\<inter> (\\<Union>x \\<in> B. Q x) = {}\"\n  apply (rule disjointI)\n  apply clarsimp\n  apply (drule (1) rl)\n  apply auto\n  done\n\nlemma UN_set_member:\n  assumes sub: \"A \\<subseteq> (\\<Union>x \\<in> S. P x)\"\n  and      nz: \"A \\<noteq> {}\"\n  shows    \"\\<exists>x \\<in> S. P x \\<inter> A \\<noteq> {}\"\nproof -\n  from nz obtain z where zA: \"z \\<in> A\" by fastforce\n  with sub obtain x where \"x \\<in> S\" and \"z \\<in> P x\" by auto\n  hence \"P x \\<inter> A \\<noteq> {}\" using zA by auto\n  thus ?thesis using sub nz by auto\nqed\n\nlemma append_Cons_cases [consumes 1, case_names pre mid post]:\n  \"\\<lbrakk>(x, y) \\<in> set (as @ b # bs);\n  (x, y) \\<in> set as \\<Longrightarrow> R;\n  \\<lbrakk>(x, y) \\<notin> set as; (x, y) \\<notin> set bs; (x, y) = b\\<rbrakk> \\<Longrightarrow> R;\n  (x, y) \\<in> set bs \\<Longrightarrow> R\\<rbrakk>\n  \\<Longrightarrow> R\" by auto\n\nlemma cart_singletons:\n  \"{a} \\<times> {b} = {(a, b)}\"\n  by blast\n\nlemma disjoint_subset_neg1:\n  \"\\<lbrakk> B \\<inter> C = {}; A \\<subseteq> B; A \\<noteq> {} \\<rbrakk> \\<Longrightarrow> \\<not> A \\<subseteq> C\"\n  by auto\n\nlemma disjoint_subset_neg2:\n  \"\\<lbrakk> B \\<inter> C = {}; A \\<subseteq> C; A \\<noteq> {} \\<rbrakk> \\<Longrightarrow> \\<not> A \\<subseteq> B\"\n  by auto\n\nlemma iffE2:\n  \"\\<lbrakk> P = Q; \\<lbrakk> P; Q \\<rbrakk> \\<Longrightarrow> R; \\<lbrakk> \\<not> P; \\<not> Q \\<rbrakk> \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  by blast\n\nlemma minus_one_helper2:\n  \"\\<lbrakk> x - 1 < y \\<rbrakk> \\<Longrightarrow> x \\<le> (y :: ('a :: len) word)\"\n  apply (cases \"x = 0\")\n   apply simp\n  apply (simp add: word_less_nat_alt word_le_nat_alt)\n  apply (subst(asm) unat_minus_one)\n   apply (simp add: word_less_nat_alt)\n  apply (cases \"unat x\")\n   apply (simp add: unat_eq_zero)\n  apply arith\n  done\n\nlemma mod_mod_power:\n  fixes k :: nat\n  shows \"k mod 2 ^ m mod 2 ^ n = k mod 2 ^ (min m n)\"\nproof (cases \"m \\<le> n\")\n  case True\n\n  hence \"k mod 2 ^ m mod 2 ^ n = k mod 2 ^ m\"\n    apply -\n    apply (subst mod_less [where n = \"2 ^ n\"])\n    apply (rule order_less_le_trans [OF mod_less_divisor])\n    apply simp+\n    done\n  also have \"\\<dots> = k mod  2 ^ (min m n)\" using True by simp\n  finally show ?thesis .\nnext\n  case False\n  hence \"n < m\" by simp\n  then obtain d where md: \"m = n + d\"\n    by (auto dest: less_imp_add_positive)\n  hence \"k mod 2 ^ m = 2 ^ n * (k div 2 ^ n mod 2 ^ d) + k mod 2 ^ n\"\n    by (simp add: mod_mult2_eq power_add)\n  hence \"k mod 2 ^ m mod 2 ^ n = k mod 2 ^ n\"\n    by (simp add: mod_add_left_eq)\n  thus ?thesis using False\n    by simp\nqed\nlemma word_div_less:\n  fixes m :: \"'a :: len word\"\n  shows \"m < n \\<Longrightarrow> m div n = 0\"\n  apply (rule word_unat.Rep_eqD)\n  apply (simp add: word_less_nat_alt unat_div)\n  done\n\nlemma word_must_wrap:\n  \"\\<lbrakk> x \\<le> n - 1; n \\<le> x \\<rbrakk> \\<Longrightarrow> n = (0 :: ('a :: len) word)\"\n  apply (rule ccontr)\n  apply (drule(1) order_trans)\n  apply (drule word_sub_1_le)\n  apply (drule(1) order_antisym)\n  apply simp\n  done\n\nlemma upt_add_eq_append':\n  assumes a1: \"i \\<le> j\" and a2: \"j \\<le> k\"\n  shows \"[i..<k] = [i..<j] @ [j..<k]\"\n  using a1 a2\n  by (clarsimp simp: le_iff_add intro!:  upt_add_eq_append)\n\nlemma range_subset_card:\n  \"\\<lbrakk> {a :: ('a :: len) word .. b} \\<subseteq> {c .. d}; b \\<ge> a \\<rbrakk>\n     \\<Longrightarrow> d \\<ge> c \\<and> d - c \\<ge> b - a\"\n  apply (subgoal_tac \"a \\<in> {a .. b}\")\n   apply (frule(1) range_subset_lower)\n   apply (frule(1) range_subset_upper)\n   apply (rule context_conjI, simp)\n   apply (rule word_sub_mono, assumption+)\n    apply (erule word_sub_le)\n   apply (erule word_sub_le)\n  apply simp\n  done\n\nlemma less_1_simp:\n  \"n - 1 < m = (n \\<le> (m :: ('a :: len) word) \\<and> n \\<noteq> 0)\"\n  by unat_arith\n\nlemma alignUp_div_helper:\n  fixes a :: \"'a::len word\"\n  assumes kv: \"k < 2 ^ (len_of TYPE('a) - n)\"\n  and     xk: \"x = 2 ^ n * of_nat k\"\n  and    le: \"a \\<le> x\"\n  and    sz: \"n < len_of TYPE('a)\"\n  and   anz: \"a mod 2 ^ n \\<noteq> 0\"\n  shows \"a div 2 ^ n < of_nat k\"\nproof -\n  have kn: \"unat (of_nat k :: 'a word) * unat ((2::'a word) ^ n)\n            < 2 ^ len_of TYPE('a)\"\n    using xk kv sz\n    apply (subst unat_of_nat_eq)\n     apply (erule order_less_le_trans)\n     apply simp\n    apply (subst unat_power_lower, simp add: word_bits_def)\n    apply (subst mult.commute)\n    apply (rule nat_less_power_trans)\n     apply simp\n    apply simp\n    done\n\n  have \"unat a div 2 ^ n * 2 ^ n \\<noteq> unat a\"\n  proof -\n    have \"unat a = unat a div 2 ^ n * 2 ^ n + unat a mod 2 ^ n\"\n      by (simp add: mod_div_equality)\n    also have \"\\<dots> \\<noteq> unat a div 2 ^ n * 2 ^ n\" using sz anz\n      by (simp add: unat_arith_simps word_bits_def)\n    finally show ?thesis ..\n  qed\n\n  hence \"a div 2 ^ n * 2 ^ n < a\" using sz anz\n    apply (subst word_less_nat_alt)\n    apply (subst unat_word_ariths)\n    apply (subst unat_div)\n    apply simp\n    apply (rule order_le_less_trans [OF mod_le_dividend])\n    apply (erule order_le_neq_trans [OF div_mult_le])\n    done\n\n  also from xk le have \"\\<dots> \\<le> of_nat k * 2 ^ n\" by (simp add: field_simps)\n  finally show ?thesis using sz kv\n    apply -\n    apply (erule word_mult_less_dest [OF _ _ kn])\n    apply (simp add: unat_div)\n    apply (rule order_le_less_trans [OF div_mult_le])\n    apply (rule unat_lt2p)\n    done\nqed\n\nlemma nat_mod_power_lem:\n  fixes a :: nat\n  shows \"1 < a \\<Longrightarrow> a ^ n mod a ^ m = (if m \\<le> n then 0 else a ^ n)\"\n  apply (clarsimp)\n  apply (clarsimp simp add: le_iff_add power_add)\n  done\n\nlemma power_mod_div:\n  fixes x :: \"nat\"\n  shows \"x mod 2 ^ n div 2 ^ m = x div 2 ^ m mod 2 ^ (n - m)\" (is \"?LHS = ?RHS\")\nproof (cases \"n \\<le> m\")\n  case True\n  hence \"?LHS = 0\"\n    apply -\n    apply (rule div_less)\n    apply (rule order_less_le_trans [OF mod_less_divisor])\n     apply simp\n    apply simp\n    done\n  also have \"\\<dots> = ?RHS\" using True\n    by simp\n  finally show ?thesis .\nnext\n  case False\n  hence lt: \"m < n\" by simp\n  then obtain q where nv: \"n = m + q\" and \"0 < q\"\n    by (auto dest: less_imp_Suc_add)\n\n  hence \"x mod 2 ^ n = 2 ^ m * (x div 2 ^ m mod 2 ^ q) + x mod 2 ^ m\"\n    by (simp add: power_add mod_mult2_eq)\n\n  hence \"?LHS = x div 2 ^ m mod 2 ^ q\"\n    by (simp add: div_add1_eq)\n\n  also have \"\\<dots> = ?RHS\" using nv\n    by simp\n\n  finally show ?thesis .\nqed\n\nlemma word_power_mod_div:\n  fixes x :: \"'a::len word\"\n  shows \"\\<lbrakk> n < len_of TYPE('a); m < len_of TYPE('a)\\<rbrakk>\n  \\<Longrightarrow> x mod 2 ^ n div 2 ^ m = x div 2 ^ m mod 2 ^ (n - m)\"\n  apply (simp add: word_arith_nat_div unat_mod power_mod_div)\n  apply (subst unat_arith_simps(3))\n  apply (subst unat_mod)\n  apply (subst unat_of_nat)+\n  apply (simp add: mod_mod_power min.commute)\n  done\n\n(* FIXME: stronger version of GenericLib.p_assoc_help *)\nlemma x_power_minus_1:\n  fixes x :: \"'a :: {ab_group_add, power, numeral, one}\"\n  shows \"x + (2::'a) ^ n - (1::'a) = x + (2 ^ n - 1)\" by simp\n\nlemma nat_le_power_trans:\n  fixes n :: nat\n  shows \"\\<lbrakk>n \\<le> 2 ^ (m - k); k \\<le> m\\<rbrakk> \\<Longrightarrow> 2 ^ k * n \\<le> 2 ^ m\"\n  apply (drule order_le_imp_less_or_eq)\n  apply (erule disjE)\n   apply (drule (1) nat_less_power_trans)\n   apply (erule order_less_imp_le)\n  apply (simp add: power_add [symmetric])\n  done\n\nlemma nat_diff_add:\n  fixes i :: nat\n  shows \"\\<lbrakk> i + j = k \\<rbrakk> \\<Longrightarrow> i = k - j\"\n  by arith\n\nlemma word_range_minus_1':\n  fixes a :: \"'a :: len word\"\n  shows \"a \\<noteq> 0 \\<Longrightarrow> {a - 1<..b} = {a..b}\"\n  by (simp add: greaterThanAtMost_def atLeastAtMost_def greaterThan_def atLeast_def less_1_simp)\n\nlemma word_range_minus_1:\n  fixes a :: word32\n  shows \"b \\<noteq> 0 \\<Longrightarrow> {a..b - 1} = {a..<b}\"\n  apply (simp add: atLeastLessThan_def atLeastAtMost_def atMost_def lessThan_def)\n  apply (rule arg_cong [where f = \"\\<lambda>x. {a..} \\<inter> x\"])\n  apply rule\n   apply clarsimp\n   apply (erule contrapos_pp)\n   apply (simp add: linorder_not_less linorder_not_le word_must_wrap)\n  apply (clarsimp)\n  apply (drule minus_one_helper3)\n  apply (auto simp: word_less_sub_1)\n  done\n\nlemma ucast_nat_def:\n  \"of_nat (unat x) = (ucast :: ('a :: len) word \\<Rightarrow> ('b :: len) word) x\"\n  by (simp add: ucast_def word_of_int_nat unat_def)\n\nlemma delete_remove1 :\n  \"delete x xs = remove1 x xs\"\n  by (induct xs, auto)\n\nlemma list_case_If:\n  \"(case xs of [] \\<Rightarrow> P | _ \\<Rightarrow> Q)\n    = (if xs = [] then P else Q)\"\n  by (clarsimp simp: neq_Nil_conv)\n\nlemma remove1_Nil_in_set:\n  \"\\<lbrakk> remove1 x xs = []; xs \\<noteq> [] \\<rbrakk> \\<Longrightarrow> x \\<in> set xs\"\n  by (induct xs) (auto split: split_if_asm)\n\nlemma remove1_empty:\n  \"(remove1 v xs = []) = (xs = [v] \\<or> xs = [])\"\n  by (cases xs, simp_all)\n\nlemma set_remove1:\n  \"x \\<in> set (remove1 y xs) \\<Longrightarrow> x \\<in> set xs\"\n  apply (induct xs)\n   apply simp\n  apply (case_tac \"y = a\")\n   apply clarsimp+\n  done\n\nlemma If_rearrage:\n  \"(if P then if Q then x else y else z)\n     = (if P \\<and> Q then x else if P then y else z)\"\n  by simp\n\nlemma cases_simp_left:\n  \"((P \\<longrightarrow> Q) \\<and> (\\<not> P \\<longrightarrow> Q) \\<and> R) = (Q \\<and> R)\"\n  by fastforce\n\nlemma disjI2_strg:\n  \"Q \\<longrightarrow> (P \\<or> Q)\"\n  by simp\n\nlemma eq_2_32_0:\n  \"(2 ^ 32 :: word32) = 0\"\n  by simp\n\nlemma eq_imp_strg:\n  \"P t \\<longrightarrow> (t = s \\<longrightarrow> P s)\"\n  by clarsimp\n\nlemma if_fun_split:\n  \"(if P then \\<lambda>s. Q s else (\\<lambda>s. R s)) = (\\<lambda>s. (P \\<longrightarrow> Q s) \\<and> (\\<not>P \\<longrightarrow> R s))\"\n  by simp\n\nlemma i_hate_words_helper:\n  \"i \\<le> (j - k :: nat) \\<Longrightarrow> i \\<le> j\"\n  by simp\n\nlemma i_hate_words:\n  \"unat (a :: 'a word) \\<le> unat (b :: ('a :: len) word) - Suc 0\n    \\<Longrightarrow> a \\<noteq> -1\"\n  apply (frule i_hate_words_helper)\n  apply (subst(asm) word_le_nat_alt[symmetric])\n  apply (clarsimp simp only: word_minus_one_le)\n  apply (simp only: linorder_not_less[symmetric])\n  apply (erule notE)\n  apply (rule diff_Suc_less)\n  apply (subst neq0_conv[symmetric])\n  apply (subst unat_eq_0)\n  apply (rule notI, drule arg_cong[where f=\"op + 1\"])\n  apply simp\n  done\n\nlemma if_both_strengthen:\n  \"P \\<and> Q \\<longrightarrow> (if G then P else Q)\"\n  by simp\n\nlemma if_both_strengthen2:\n  \"P s \\<and> Q s \\<longrightarrow> (if G then P else Q) s\"\n  by simp\n\nlemma if_swap:\n  \"(if P then Q else R) = (if \\<not>P then R else Q)\" by simp\n\nlemma ignore_if:\n  \"(y and z) s \\<Longrightarrow> (if x then y else z) s\"\n  by (clarsimp simp: pred_conj_def)\n\nlemma imp_consequent:\n  \"P \\<longrightarrow> Q \\<longrightarrow> P\" by simp\n\nlemma list_case_helper:\n  \"xs \\<noteq> [] \\<Longrightarrow> case_list f g xs = g (hd xs) (tl xs)\"\n  by (cases xs, simp_all)\n\nlemma list_cons_rewrite:\n  \"(\\<forall>x xs. L = x # xs \\<longrightarrow> P x xs) = (L \\<noteq> [] \\<longrightarrow> P (hd L) (tl L))\"\n  by (auto simp: neq_Nil_conv)\n\nlemma list_not_Nil_manip:\n  \"\\<lbrakk> xs = y # ys; case xs of [] \\<Rightarrow> False | (y # ys) \\<Rightarrow> P y ys \\<rbrakk> \\<Longrightarrow> P y ys\"\n  by simp\n\nlemma ran_ball_triv:\n  \"\\<And>P m S. \\<lbrakk> \\<forall>x \\<in> (ran S). P x ; m \\<in> (ran S) \\<rbrakk> \\<Longrightarrow> P m\"\n  by blast\n\nlemma singleton_tuple_cartesian:\n  \"({(a, b)} = S \\<times> T) = ({a} = S \\<and> {b} = T)\"\n  \"(S \\<times> T = {(a, b)}) = ({a} = S \\<and> {b} = T)\"\n  by blast+\n\nlemma strengthen_ignore_if:\n  \"A s \\<and> B s \\<longrightarrow> (if P then A else B) s\"\n  by clarsimp\n\nlemma case_sum_True :\n  \"(case r of Inl a \\<Rightarrow> True | Inr b \\<Rightarrow> f b)\n  = (\\<forall>b. r = Inr b \\<longrightarrow> f b)\"\n  by (cases r) auto\n\nlemma sym_ex_elim:\n  \"F x = y \\<Longrightarrow> \\<exists>x. y = F x\"\n  by auto\n\nlemma tl_drop_1 :\n  \"tl xs = drop 1 xs\"\n  by (simp add: drop_Suc)\n\nlemma upt_lhs_sub_map:\n  \"[x ..< y] = map (op + x) [0 ..< y - x]\"\n  apply (induct y)\n   apply simp\n  apply (clarsimp simp: Suc_diff_le)\n  done\n\nlemma upto_0_to_4:\n  \"[0..<4] = 0 # [1..<4]\"\n  apply (subst upt_rec)\n  apply simp\n  done\n\nlemma disjEI:\n  \"\\<lbrakk> P \\<or> Q; P \\<Longrightarrow> R; Q \\<Longrightarrow> S \\<rbrakk>\n     \\<Longrightarrow> R \\<or> S\"\n  by fastforce\n\nlemma dom_fun_upd2:\n  \"s x = Some z \\<Longrightarrow> dom (s (x \\<mapsto> y)) = dom s\"\n  by (simp add: insert_absorb domI)\n\nlemma foldl_True :\n  \"foldl op \\<or> True bs\"\n  by (induct bs) auto\n\nlemma image_set_comp:\n  \"f ` {g x | x. Q x} = (f \\<circ> g) ` {x. Q x}\"\n  by fastforce\n\nlemma mutual_exE:\n  \"\\<lbrakk> \\<exists>x. P x; \\<And>x. P x \\<Longrightarrow> Q x \\<rbrakk> \\<Longrightarrow> \\<exists>x. Q x\"\n  apply clarsimp\n  apply blast\n  done\n\nlemma nat_diff_eq:\n  fixes x :: nat\n  shows \"\\<lbrakk> x - y = x - z; y < x\\<rbrakk> \\<Longrightarrow> y = z\"\n  by arith\n\nlemma overflow_plus_one_self:\n  \"(1 + p \\<le> p) = (p = (-1 :: word32))\"\n  apply (safe, simp_all)\n  apply (rule ccontr)\n  apply (drule plus_one_helper2)\n   apply (rule notI)\n   apply (drule arg_cong[where f=\"\\<lambda>x. x - 1\"])\n   apply simp\n  apply (simp add: field_simps)\n  done\n\nlemma plus_1_less:\n  \"(x + 1 \\<le> (x :: ('a :: len) word)) = (x = -1)\"\n  apply (rule iffI)\n   apply (rule ccontr)\n   apply (cut_tac plus_one_helper2[where x=x, OF order_refl])\n    apply simp\n   apply clarsimp\n   apply (drule arg_cong[where f=\"\\<lambda>x. x - 1\"])\n   apply simp\n  apply simp\n  done\n\nlemma pos_mult_pos_ge:\n  \"[|x > (0::int); n>=0 |] ==> n * x >= n*1\"\n  apply (simp only: mult_left_mono)\n  done\n\nlemma If_eq_obvious:\n  \"x \\<noteq> z \\<Longrightarrow> ((if P then x else y) = z) = (\\<not> P \\<and> y = z)\"\n  by simp\n\nlemma Some_to_the:\n  \"v = Some x \\<Longrightarrow> x = the v\"\n  by simp\n\nlemma dom_if_Some:\n  \"dom (\\<lambda>x. if P x then Some (f x) else g x) = {x. P x} \\<union> dom g\"\n  by fastforce\n\nlemma dom_insert_absorb:\n  \"x \\<in> dom f \\<Longrightarrow> insert x (dom f) = dom f\" by auto\n\nlemma emptyE2:\n  \"\\<lbrakk> S = {}; x \\<in> S \\<rbrakk> \\<Longrightarrow> P\"\n  by simp\n\nlemma mod_div_equality_div_eq:\n  \"a div b * b = (a - (a mod b) :: int)\"\n  by (simp add: field_simps)\n\nlemma zmod_helper:\n  \"n mod m = k \\<Longrightarrow> ((n :: int) + a) mod m = (k + a) mod m\"\n  by (metis add.commute mod_add_right_eq)\n\nlemma int_div_sub_1:\n  \"\\<lbrakk> m \\<ge> 1 \\<rbrakk> \\<Longrightarrow> (n - (1 :: int)) div m = (if m dvd n then (n div m) - 1 else n div m)\"\n  apply (subgoal_tac \"m = 0 \\<or> (n - (1 :: int)) div m = (if m dvd n then (n div m) - 1 else n div m)\")\n   apply fastforce\n  apply (subst mult_cancel_right[symmetric])\n  apply (simp only: left_diff_distrib split: split_if)\n  apply (simp only: mod_div_equality_div_eq)\n  apply (clarsimp simp: field_simps)\n  apply (clarsimp simp: dvd_eq_mod_eq_0)\n  apply (cases \"m = 1\")\n   apply simp\n  apply (subst mod_diff_eq, simp add: zmod_minus1 mod_pos_pos_trivial)\n  apply clarsimp\n  apply (subst diff_add_cancel[where b=1, symmetric])\n  apply (subst push_mods(1))\n  apply (simp add: field_simps mod_pos_pos_trivial)\n  apply (rule mod_pos_pos_trivial)\n   apply (subst add_0_right[where a=0, symmetric])\n   apply (rule add_mono)\n    apply simp\n   apply simp\n  apply (cases \"(n - 1) mod m = m - 1\")\n   apply (drule zmod_helper[where a=1])\n   apply simp\n  apply (subgoal_tac \"1 + (n - 1) mod m \\<le> m\")\n   apply simp\n  apply (subst field_simps, rule zless_imp_add1_zle)\n  apply simp\n  done\n\nlemmas nat_less_power_trans_16 =\n   subst [OF mult.commute, where P=\"\\<lambda>x. x < v\" for v,\n          OF nat_less_power_trans[where k=4, simplified]]\n\nlemmas nat_less_power_trans_256 =\n   subst [OF mult.commute, where P=\"\\<lambda>x. x < v\" for v,\n          OF nat_less_power_trans[where k=8, simplified]]\nlemmas nat_less_power_trans_4096 =\n   subst [OF mult.commute, where P=\"\\<lambda>x. x < v\" for v,\n          OF nat_less_power_trans[where k=12, simplified]]\n\nlemma ptr_add_image_multI:\n  \"\\<lbrakk> \\<And>x y. (x * val = y * val') = (x * val'' = y); x * val'' \\<in> S \\<rbrakk> \\<Longrightarrow>\n     ptr_add ptr (x * val) \\<in> (\\<lambda>p. ptr_add ptr (p * val')) ` S\"\n  apply (simp add: image_def)\n  apply (erule rev_bexI)\n  apply (rule arg_cong[where f=\"ptr_add ptr\"])\n  apply simp\n  done\n\nlemma shift_times_fold:\n  \"(x :: word32) * (2 ^ n) << m = x << (m + n)\"\n  by (simp add: shiftl_t2n ac_simps power_add)\n\nlemma word_plus_strict_mono_right:\n  fixes x :: \"'a :: len word\"\n  shows \"\\<lbrakk>y < z; x \\<le> x + z\\<rbrakk> \\<Longrightarrow> x + y < x + z\"\n  by unat_arith\n\nlemma comp_upd_simp:\n  \"(f \\<circ> (g (x := y))) = ((f \\<circ> g) (x := f y))\"\n  by (rule ext, simp add: o_def)\n\nlemma dom_option_map:\n  \"dom (option_map f o m) = dom m\"\n  by (simp add: dom_def)\n\nlemma drop_imp:\n  \"P \\<Longrightarrow> (A \\<longrightarrow> P) \\<and> (B \\<longrightarrow> P)\" by blast\n\nlemma inj_on_fun_updI2:\n  \"\\<lbrakk> inj_on f A; y \\<notin> f ` (A - {x}) \\<rbrakk>\n       \\<Longrightarrow> inj_on (f(x := y)) A\"\n  apply (rule inj_onI)\n  apply (simp split: split_if_asm)\n   apply (erule notE, rule image_eqI, erule sym)\n   apply simp\n  apply (erule(3) inj_onD)\n  done\n\nlemma inj_on_fun_upd_elsewhere:\n  \"x \\<notin> S \\<Longrightarrow> inj_on (f (x := y)) S = inj_on f S\"\n  apply (simp add: inj_on_def)\n  apply blast\n  done\n\nlemma not_Some_eq_tuple:\n  \"(\\<forall>y z. x \\<noteq> Some (y, z)) = (x = None)\"\n  by (cases x, simp_all)\n\nlemma ran_option_map:\n  \"ran (option_map f o m) = f ` ran m\"\n  by (auto simp add: ran_def)\n\nlemma All_less_Ball:\n  \"(\\<forall>x < n. P x) = (\\<forall>x\\<in>{..< n}. P x)\"\n  by fastforce\n\nlemma Int_image_empty:\n  \"\\<lbrakk> \\<And>x y. f x \\<noteq> g y \\<rbrakk>\n       \\<Longrightarrow> f ` S \\<inter> g ` T = {}\"\n  by auto\n\nlemma Max_prop:\n  \"\\<lbrakk> Max S \\<in> S \\<Longrightarrow> P (Max S); (S :: ('a :: {finite, linorder}) set) \\<noteq> {} \\<rbrakk> \\<Longrightarrow> P (Max S)\"\n  apply (erule meta_mp)\n  apply (rule Max_in)\n   apply simp\n  apply assumption\n  done\n\nlemma Min_prop:\n  \"\\<lbrakk> Min S \\<in> S \\<Longrightarrow> P (Min S); (S :: ('a :: {finite, linorder}) set) \\<noteq> {} \\<rbrakk> \\<Longrightarrow> P (Min S)\"\n  apply (erule meta_mp)\n  apply (rule Min_in)\n   apply simp\n  apply assumption\n  done\n\ndefinition\n  is_inv :: \"('a \\<rightharpoonup> 'b) \\<Rightarrow> ('b \\<rightharpoonup> 'a) \\<Rightarrow> bool\" where\n  \"is_inv f g \\<equiv> ran f = dom g \\<and> (\\<forall>x y. f x = Some y \\<longrightarrow> g y = Some x)\"\n\nlemma is_inv_NoneD:\n  assumes \"g x = None\"\n  assumes \"is_inv f g\"\n  shows \"x \\<notin> ran f\"\nproof -\n  from assms\n  have \"x \\<notin> dom g\" by (auto simp: ran_def)\n  moreover\n  from assms\n  have \"ran f = dom g\"\n    by (simp add: is_inv_def)\n  ultimately\n  show ?thesis by simp\nqed\n\nlemma is_inv_SomeD:\n  \"\\<lbrakk> f x = Some y; is_inv f g \\<rbrakk> \\<Longrightarrow> g y = Some x\"\n  by (simp add: is_inv_def)\n\nlemma is_inv_com:\n  \"is_inv f g \\<Longrightarrow> is_inv g f\"\n  apply (unfold is_inv_def)\n  apply safe\n    apply (clarsimp simp: ran_def dom_def set_eq_iff)\n    apply (erule_tac x=a in allE)\n    apply clarsimp\n   apply (clarsimp simp: ran_def dom_def set_eq_iff)\n   apply blast\n  apply (clarsimp simp: ran_def dom_def set_eq_iff)\n  apply (erule_tac x=x in allE)\n  apply clarsimp\n  done\n\nlemma is_inv_inj:\n  \"is_inv f g \\<Longrightarrow> inj_on f (dom f)\"\n  apply (frule is_inv_com)\n  apply (clarsimp simp: inj_on_def)\n  apply (drule (1) is_inv_SomeD)\n  apply (drule_tac f=f in is_inv_SomeD, assumption)\n  apply simp\n  done\n\nlemma is_inv_None_upd:\n  \"\\<lbrakk> is_inv f g; g x = Some y\\<rbrakk> \\<Longrightarrow> is_inv (f(y := None)) (g(x := None))\"\n  apply (subst is_inv_def)\n  apply (clarsimp simp add: dom_upd)\n  apply (drule is_inv_SomeD, erule is_inv_com)\n  apply (frule is_inv_inj)\n  apply (simp add: ran_upd')\n  apply (rule conjI)\n   apply (simp add: is_inv_def)\n  apply (drule (1) is_inv_SomeD)\n  apply (clarsimp simp: is_inv_def)\n  done\n\nlemma is_inv_inj2:\n  \"is_inv f g \\<Longrightarrow> inj_on g (dom g)\"\n  apply (drule is_inv_com)\n  apply (erule is_inv_inj)\n  done\n\nlemma range_convergence1:\n  \"\\<lbrakk> \\<forall>z. x < z \\<and> z \\<le> y \\<longrightarrow> P z; \\<forall>z > y. P (z :: 'a :: linorder) \\<rbrakk>\n     \\<Longrightarrow> \\<forall>z > x. P z\"\n  apply clarsimp\n  apply (case_tac \"z \\<le> y\")\n   apply simp\n  apply (simp add: linorder_not_le)\n  done\n\nlemma range_convergence2:\n  \"\\<lbrakk> \\<forall>z. x < z \\<and> z \\<le> y \\<longrightarrow> P z; \\<forall>z. z > y \\<and> z < w \\<longrightarrow> P (z :: 'a :: linorder) \\<rbrakk>\n     \\<Longrightarrow> \\<forall>z. z > x \\<and> z < w \\<longrightarrow> P z\"\n  apply (cut_tac range_convergence1[where P=\"\\<lambda>z. z < w \\<longrightarrow> P z\" and x=x and y=y])\n    apply simp\n   apply simp\n  apply simp\n  done\n\nlemma replicate_minus:\n  \"k < n \\<Longrightarrow> replicate n False = replicate (n - k) False @ replicate k False\"\n  by (subst replicate_add [symmetric]) simp\n\nlemmas map_prod_split_imageI\n  = map_prod_imageI[where f=\"split f\" and g=\"split g\"\n                    and a=\"(a, b)\" and b=\"(c, d)\" for a b c d f g, simplified]\n\nlemma word_div_mult:\n  fixes c :: \"('a::len) word\"\n  shows \"\\<lbrakk>0 < c; a < b * c \\<rbrakk> \\<Longrightarrow> a div c < b\"\n  apply (simp add: word_less_nat_alt unat_div)\n  apply (subst td_gal_lt [symmetric])\n   apply assumption\n  apply (erule order_less_le_trans)\n  apply (subst unat_word_ariths)\n  by (metis Divides.mod_less_eq_dividend)\n\nlemma word_less_power_trans_ofnat:\n  \"\\<lbrakk>n < 2 ^ (m - k); k \\<le> m; m < len_of TYPE('a)\\<rbrakk>\n   \\<Longrightarrow> of_nat n * 2 ^ k < (2::'a::len word) ^ m\"\n  apply (subst mult.commute)\n  apply (rule word_less_power_trans)\n    apply (simp add: word_less_nat_alt)\n    apply (subst unat_of_nat_eq)\n     apply (erule order_less_trans)\n     apply simp+\n    done\n\nlemma div_power_helper:\n  \"\\<lbrakk> x \\<le> y; y < word_bits \\<rbrakk> \\<Longrightarrow> (2 ^ y - 1) div (2 ^ x :: word32) = 2 ^ (y - x) - 1\"\n  apply (rule word_uint.Rep_eqD)\n  apply (simp only: uint_word_ariths uint_div uint_power_lower word_bits_len_of)\n  apply (subst mod_pos_pos_trivial, fastforce, fastforce)+\n  apply (subst mod_pos_pos_trivial)\n    apply (simp add: le_diff_eq uint_2p_alt[where 'a=32, unfolded word_bits_len_of])\n   apply (rule less_1_helper)\n   apply (rule power_increasing)\n    apply (simp add: word_bits_def)\n   apply simp\n  apply (subst mod_pos_pos_trivial)\n    apply (simp add: uint_2p_alt[where 'a=32, unfolded word_bits_len_of])\n   apply (rule less_1_helper)\n   apply (rule power_increasing)\n    apply (simp add: word_bits_def)\n   apply simp\n  apply (subst int_div_sub_1)\n    apply simp\n   apply (simp add: uint_2p_alt[where 'a=32, unfolded word_bits_len_of])\n  apply (subst power_0[symmetric, where a=2])\n  apply (simp add: uint_2p_alt[where 'a=32, unfolded word_bits_len_of]\n                   le_imp_power_dvd_int power_sub_int)\n  done\n\nlemma n_less_word_bits:\n  \"(n < word_bits) = (n < 32)\"\n  by (simp add: word_bits_def)\n\nlemma of_nat_less_pow:\n  \"\\<lbrakk> x < 2 ^ n; n < word_bits \\<rbrakk> \\<Longrightarrow> of_nat x < (2 :: word32) ^ n\"\n  apply (subst word_unat_power)\n  apply (rule of_nat_mono_maybe)\n   apply (rule power_strict_increasing)\n    apply (simp add: word_bits_def)\n   apply simp\n  apply assumption\n  done\n\nlemma power_helper:\n  \"\\<lbrakk> (x :: word32) < 2 ^ (m - n); n \\<le> m; m < word_bits \\<rbrakk> \\<Longrightarrow> x * (2 ^ n) < 2 ^ m\"\n  apply (drule word_mult_less_mono1[where k=\"2 ^ n\"])\n    apply (simp add: word_neq_0_conv[symmetric] word_bits_def)\n   apply (simp only: unat_power_lower[where 'a=32, unfolded word_bits_len_of]\n                     power_add[symmetric])\n   apply (rule power_strict_increasing)\n    apply (simp add: word_bits_def)\n   apply simp\n  apply (simp add: power_add[symmetric])\n  done\n\nlemma word_1_le_power:\n  \"n < len_of TYPE('a) \\<Longrightarrow> (1 :: 'a :: len word) \\<le> 2 ^ n\"\n  by (rule inc_le[where i=0, simplified], erule iffD2[OF p2_gt_0])\n\nlemma enum_word_div:\n  fixes v :: \"('a :: len) word\" shows\n  \"\\<exists>xs ys. enum = xs @ [v] @ ys\n             \\<and> (\\<forall>x \\<in> set xs. x < v)\n             \\<and> (\\<forall>y \\<in> set ys. v < y)\"\n  apply (simp only: enum_word_def)\n  apply (subst upt_add_eq_append'[where j=\"unat v\"])\n    apply simp\n   apply (rule order_less_imp_le, simp)\n  apply (simp add: upt_conv_Cons)\n  apply (intro exI conjI)\n    apply fastforce\n   apply clarsimp\n   apply (drule of_nat_mono_maybe[rotated, where 'a='a])\n    apply simp\n   apply simp\n  apply (clarsimp simp: Suc_le_eq)\n  apply (drule of_nat_mono_maybe[rotated, where 'a='a])\n   apply simp\n  apply simp\n  done\n\nlemma less_x_plus_1:\n  fixes x :: \"('a :: len) word\" shows\n  \"x \\<noteq> max_word \\<Longrightarrow> (y < (x + 1)) = (y < x \\<or> y = x)\"\n  apply (rule iffI)\n   apply (rule disjCI)\n   apply (drule plus_one_helper)\n   apply simp\n  apply (subgoal_tac \"x < x + 1\")\n   apply (erule disjE, simp_all)\n  apply (rule plus_one_helper2 [OF order_refl])\n  apply (rule notI, drule max_word_wrap)\n  apply simp\n  done\n\nlemma of_bool_nth:\n  \"of_bool (x !! v) = (x >> v) && 1\"\n  apply (rule word_eqI)\n  apply (simp add: nth_shiftr cong: rev_conj_cong)\n  done\n\nlemma unat_1_0:\n  \"1 \\<le> (x::word32) = (0 < unat x)\"\n  by (auto simp add: word_le_nat_alt)\n\nlemma x_less_2_0_1:\n  fixes x :: word32 shows\n  \"x < 2 \\<Longrightarrow> x = 0 \\<or> x = 1\"\n  by unat_arith\n\nlemma x_less_2_0_1':\n  fixes x :: \"('a::len) word\"\n  shows \"\\<lbrakk>len_of TYPE('a) \\<noteq> 1; x < 2\\<rbrakk> \\<Longrightarrow> x = 0 \\<or> x = 1\"\n  apply (induct x)\n   apply clarsimp+\n  by (metis Suc_eq_plus1 add_lessD1 less_irrefl one_add_one unatSuc word_less_nat_alt)\n\nlemma Collect_int_vars:\n  \"{s. P rv s} \\<inter> {s. rv = xf s} = {s. P (xf s) s} \\<inter> {s. rv = xf s}\"\n  by auto\n\nlemma if_0_1_eq:\n  \"((if P then 1 else 0) = (case Q of True \\<Rightarrow> of_nat 1 | False \\<Rightarrow> of_nat 0)) = (P = Q)\"\n  by (simp add: case_bool_If split: split_if)\n\nlemma modify_map_exists_cte :\n  \"(\\<exists>cte. modify_map m p f p' = Some cte) = (\\<exists>cte. m p' = Some cte)\"\n  by (simp add: modify_map_def)\n\nlemmas word_add_le_iff2 = word_add_le_iff [folded no_olen_add_nat]\n\nlemma mask_32_max_word :\n  shows \"mask 32 = (max_word :: word32)\"\n  unfolding mask_def\n  by (simp add: max_word_def)\n\nlemma dom_eqI:\n  assumes c1: \"\\<And>x y. P x = Some y \\<Longrightarrow> \\<exists>y. Q x = Some y\"\n  and     c2: \"\\<And>x y. Q x = Some y \\<Longrightarrow> \\<exists>y. P x = Some y\"\n  shows \"dom P = dom Q\"\n  unfolding dom_def by (auto simp: c1 c2)\n\nlemma dvd_reduce_multiple:\n  fixes k :: nat\n  shows \"(k dvd k * m + n) = (k dvd n)\"\n  by (induct m) (auto simp: add_ac)\n\nlemma image_iff:\n  \"inj f \\<Longrightarrow> f x \\<in> f ` S = (x \\<in> S)\"\n  by (rule inj_image_mem_iff)\n\n\n\nlemma of_nat_n_less_equal_power_2:\n  \"n < len_of TYPE('a::len) \\<Longrightarrow> ((of_nat n)::'a word) < 2 ^ n\"\n  apply (induct n)\n   apply clarsimp\n  apply clarsimp\n  apply (metis WordLemmaBucket.of_nat_power\n               n_less_equal_power_2 of_nat_Suc power_Suc)\n  done\n\nlemma of_nat32_n_less_equal_power_2:\n \"n < 32 \\<Longrightarrow> ((of_nat n)::32 word) < 2 ^ n\"\n  by (rule of_nat_n_less_equal_power_2, clarsimp simp: word_size)\n\nlemma map_comp_restrict_map_Some_iff:\n  \"((g \\<circ>\\<^sub>m (m |` S)) x = Some y) = ((g \\<circ>\\<^sub>m m) x = Some y \\<and> x \\<in> S)\"\n  by (auto simp add: map_comp_Some_iff restrict_map_Some_iff)\n\nlemma range_subsetD:\n  fixes a :: \"'a :: order\"\n  shows \"\\<lbrakk> {a..b} \\<subseteq> {c..d}; a \\<le> b \\<rbrakk> \\<Longrightarrow> c \\<le> a \\<and> b \\<le> d\"\n  apply (rule conjI)\n   apply (drule subsetD [where c = a])\n    apply simp\n   apply simp\n  apply (drule subsetD [where c = b])\n   apply simp\n  apply simp\n  done\n\nlemma case_option_dom:\n  \"(case f x of None \\<Rightarrow> a | Some v \\<Rightarrow> b v)\n      = (if x \\<in> dom f then b (the (f x)) else a)\"\n  by (auto split: split_if option.split)\n\nlemma contrapos_imp:\n  \"P \\<longrightarrow> Q \\<Longrightarrow> \\<not> Q \\<longrightarrow> \\<not> P\"\n  by clarsimp\n\nlemma eq_mask_less:\n  fixes w :: \"('a::len) word\"\n  assumes eqm: \"w = w && mask n\"\n  and      sz: \"n < len_of TYPE ('a)\"\n  shows \"w < (2::'a word) ^ n\"\n  by (subst eqm, rule and_mask_less' [OF sz])\n\nlemma of_nat_mono_maybe':\n  fixes Y :: \"nat\"\n  assumes xlt: \"X < 2 ^ len_of TYPE ('a :: len)\"\n  assumes ylt: \"Y < 2 ^ len_of TYPE ('a :: len)\"\n  shows   \"(Y < X) = (of_nat Y < (of_nat X :: 'a :: len word))\"\n  apply (subst word_less_nat_alt)\n  apply (subst unat_of_nat)+\n  apply (subst mod_less)\n   apply (rule ylt)\n  apply (subst mod_less)\n   apply (rule xlt)\n  apply simp\n  done\n\n(* FIXME: MOVE *)\nlemma shiftr_mask_eq:\n  fixes x :: \"'a :: len word\"\n  shows \"(x >> n) && mask (size x - n) = x >> n\"\n  apply (rule word_eqI)\n  apply (simp add: word_size nth_shiftr)\n  apply (rule iffI)\n   apply clarsimp\n  apply (clarsimp)\n  apply (drule test_bit_size)\n  apply (simp add: word_size)\n  done\n\n(* FIXME: move *)\nlemma shiftr_mask_eq':\n  fixes x :: \"'a :: len word\"\n  shows \"m = (size x - n) \\<Longrightarrow> (x >> n) && mask m = x >> n\"\n  by (simp add: shiftr_mask_eq)\n\nlemma zipWith_Nil2 :\n  \"zipWith f xs [] = []\"\n  unfolding zipWith_def by simp\n\nlemma zip_upt_Cons:\n  \"a < b \\<Longrightarrow> zip [a ..< b] (x # xs)\n        = (a, x) # zip [Suc a ..< b] xs\"\n  by (simp add: upt_conv_Cons)\n\nlemma map_comp_eq:\n  \"(f \\<circ>\\<^sub>m g) = (case_option None f \\<circ> g)\"\n  apply (rule ext)\n  apply (case_tac \"g x\")\n   apply simp\n  apply simp\n  done\n\nlemma dom_If_Some:\n   \"dom (\\<lambda>x. if x \\<in> S then Some v else f x) = (S \\<union> dom f)\"\n  by (auto split: split_if)\n\nlemma foldl_fun_upd_const:\n  \"foldl (\\<lambda>s x. s(f x := v)) s xs\n    = (\\<lambda>x. if x \\<in> f ` set xs then v else s x)\"\n  apply (induct xs arbitrary: s)\n   apply simp\n  apply (rule ext, simp)\n  done\n\nlemma foldl_id:\n  \"foldl (\\<lambda>s x. s) s xs = s\"\n  apply (induct xs)\n   apply simp\n  apply simp\n  done\n\nlemma SucSucMinus: \"2 \\<le> n \\<Longrightarrow> Suc (Suc (n - 2)) = n\" by arith\n\nlemma ball_to_all:\n  \"(\\<And>x. (x \\<in> A) = (P x)) \\<Longrightarrow> (\\<forall>x \\<in> A. B x) = (\\<forall>x. P x \\<longrightarrow> B x)\"\n  by blast\n\nlemma bang_big: \"n \\<ge> size (x::'a::len0 word) \\<Longrightarrow> (x !! n) = False\"\n  by (simp add: test_bit_bl word_size)\n\nlemma bang_conj_lt:\n  fixes x :: \"'a :: len word\"\n  shows \"(x !! m \\<and> m < len_of TYPE('a)) = x !! m\"\n  apply (cases \"m < len_of TYPE('a)\")\n   apply simp\n  apply (simp add: not_less bang_big  word_size)\n  done\n\nlemma dom_if:\n  \"dom (\\<lambda>a. if a \\<in> addrs then Some (f a) else g a)  = addrs \\<union> dom g\"\n  by (auto simp: dom_def split: split_if)\n\nlemma less_is_non_zero_p1:\n  fixes a :: \"'a :: len word\"\n  shows \"a < k \\<Longrightarrow> a + 1 \\<noteq> 0\"\n  apply (erule contrapos_pn)\n  apply (drule max_word_wrap)\n  apply (simp add: not_less)\n  done\n\nlemma lt_word_bits_lt_pow:\n  \"sz < word_bits \\<Longrightarrow> sz < 2 ^ word_bits\"\n  by (simp add: word_bits_conv)\n\n(* FIXME: shadows an existing thm *)\nlemma of_nat_mono_maybe_le:\n  \"\\<lbrakk>X < 2 ^ len_of TYPE('a); Y < 2 ^ len_of TYPE('a)\\<rbrakk> \\<Longrightarrow>\n   (Y \\<le> X) = ((of_nat Y :: 'a :: len word) \\<le> of_nat X)\"\n  apply (clarsimp simp: le_less)\n  apply (rule disj_cong)\n   apply (rule of_nat_mono_maybe', assumption+)\n  apply (simp add: word_unat.norm_eq_iff [symmetric])\n  done\n\nlemma neg_mask_bang:\n  \"(~~ mask n :: 'a :: len word) !! m = (n \\<le> m \\<and> m < len_of TYPE('a))\"\n  apply (cases \"m < len_of TYPE('a)\")\n   apply (simp add: word_ops_nth_size word_size not_less)\n  apply (simp add: not_less bang_big  word_size)\n  done\n\nlemma mask_AND_NOT_mask:\n  \"(w && ~~ mask n) && mask n = 0\"\nby (rule word_eqI) (clarsimp simp add: word_size neg_mask_bang)\n\nlemma AND_NOT_mask_plus_AND_mask_eq:\n  \"(w && ~~ mask n) + (w && mask n) = w\"\napply (rule word_eqI)\napply (rename_tac m)\napply (simp add: word_size)\napply (cut_tac word_plus_and_or_coroll[of \"w && ~~ mask n\" \"w && mask n\"])\n apply (simp add: word_ao_dist2[symmetric] word_size neg_mask_bang)\napply (rule word_eqI)\napply (rename_tac m)\napply (simp add: word_size neg_mask_bang)\ndone\n\nlemma mask_eqI:\n  fixes x :: \"'a :: len word\"\n  assumes m1: \"x && mask n = y && mask n\"\n  and     m2: \"x && ~~ mask n = y && ~~ mask n\"\n  shows \"x = y\"\nproof (subst bang_eq, rule allI)\n  fix m\n\n  show \"x !! m = y !! m\"\n  proof (cases \"m < n\")\n    case True\n    hence \"x !! m = ((x && mask n) !! m)\"\n      by (simp add: word_size bang_conj_lt)\n    also have \"\\<dots> = ((y && mask n) !! m)\" using m1 by simp\n    also have \"\\<dots> = y !! m\" using True\n      by (simp add: word_size bang_conj_lt)\n    finally show ?thesis .\n  next\n    case False\n    hence \"x !! m = ((x && ~~ mask n) !! m)\"\n      by (simp add: neg_mask_bang bang_conj_lt)\n    also have \"\\<dots> = ((y && ~~ mask n) !! m)\" using m2 by simp\n    also have \"\\<dots> = y !! m\" using False\n      by (simp add: neg_mask_bang bang_conj_lt)\n    finally show ?thesis .\n  qed\nqed\n\nlemma nat_less_power_trans2:\n  fixes n :: nat\n  shows \"\\<lbrakk>n < 2 ^ (m - k); k \\<le> m\\<rbrakk> \\<Longrightarrow> n * 2 ^ k  < 2 ^ m\"\n  by (subst mult.commute, erule (1) nat_less_power_trans)\n\nlemma nat_move_sub_le: \"(a::nat) + b \\<le> c \\<Longrightarrow> a \\<le> c - b\" by arith\n\nlemma neq_0_no_wrap:\n  fixes x :: \"'a :: len word\"\n  shows \"\\<lbrakk> x \\<le> x + y; x \\<noteq> 0 \\<rbrakk> \\<Longrightarrow> x + y \\<noteq> 0\"\n  by clarsimp\n\nlemma plus_minus_one_rewrite:\n  \"v + (- 1 :: ('a :: {ring, one, uminus})) \\<equiv> v - 1\"\n  by (simp add: field_simps)\n\nlemma power_minus_is_div:\n  \"b \\<le> a \\<Longrightarrow> (2 :: nat) ^ (a - b) = 2 ^ a div 2 ^ b\"\n  apply (induct a arbitrary: b)\n   apply simp\n  apply (erule le_SucE)\n   apply (clarsimp simp:Suc_diff_le le_iff_add power_add)\n  apply simp\n  done\n\nlemma two_pow_div_gt_le:\n  \"v < 2 ^ n div (2 ^ m :: nat) \\<Longrightarrow> m \\<le> n\"\n  by (clarsimp dest!: less_two_pow_divD)\n\n\n\nlemma unat_less_word_bits:\n  fixes y :: word32\n  shows \"x < unat y \\<Longrightarrow> x < 2 ^ word_bits\"\n  unfolding word_bits_def\n  by (rule order_less_trans [OF _ unat_lt2p])\n\nlemma word_add_power_off:\n  fixes a :: word32\n  assumes ak: \"a < k\"\n  and kw: \"k < 2 ^ (word_bits - m)\"\n  and mw: \"m < word_bits\"\n  and off: \"off < 2 ^ m\"\n  shows \"(a * 2 ^ m) + off < k * 2 ^ m\"\nproof (cases \"m = 0\")\n  case True\n  thus ?thesis using off ak by simp\nnext\n  case False\n\n  from ak have ak1: \"a + 1 \\<le> k\" by (rule inc_le)\n  hence \"(a + 1) * 2 ^ m \\<noteq> 0\"\n    apply -\n    apply (rule word_power_nonzero)\n    apply (erule order_le_less_trans  [OF _ kw])\n    apply (rule mw)\n    apply (rule less_is_non_zero_p1 [OF ak])\n    done\n  hence \"(a * 2 ^ m) + off < ((a + 1) * 2 ^ m)\" using kw mw\n    apply -\n    apply (simp add: distrib_right)\n    apply (rule word_plus_strict_mono_right [OF off])\n    apply (rule is_aligned_no_overflow'')\n    apply (rule is_aligned_mult_triv2)\n    apply assumption\n    done\n  also have \"\\<dots> \\<le> k * 2 ^ m\" using ak1 mw kw False\n    apply -\n    apply (erule word_mult_le_mono1)\n    apply (simp add: p2_gt_0 word_bits_def)\n    apply (simp add: word_bits_len_of word_less_nat_alt word_bits_def)\n    apply (rule nat_less_power_trans2[where m=32, simplified])\n    apply (simp add: word_less_nat_alt)\n    apply simp\n    done\n  finally show ?thesis .\nqed\n\nlemma word_of_nat_less:\n  \"\\<lbrakk> n < unat x \\<rbrakk> \\<Longrightarrow> of_nat n < x\"\n  apply (simp add: word_less_nat_alt)\n  apply (erule order_le_less_trans[rotated])\n  apply (simp add: unat_of_nat)\n  done\n\nlemma word_rsplit_0:\n  \"word_rsplit (0 :: word32) = [0, 0, 0, 0 :: word8]\"\n  apply (simp add: word_rsplit_def bin_rsplit_def Let_def)\n  done\n\nlemma word_of_nat_le:\n  \"n \\<le> unat x \\<Longrightarrow> of_nat n \\<le> x\"\n  apply (simp add: word_le_nat_alt unat_of_nat)\n  apply (erule order_trans[rotated])\n  apply simp\n  done\n\nlemma word_unat_less_le:\n   \"a \\<le> of_nat b \\<Longrightarrow> unat a \\<le> b\"\n   by (metis eq_iff le_cases le_unat_uoi word_of_nat_le)\n\nlemma filter_eq_If:\n  \"distinct xs \\<Longrightarrow> filter (\\<lambda>v. v = x) xs = (if x \\<in> set xs then [x] else [])\"\n  apply (induct xs)\n   apply simp\n  apply (clarsimp split: split_if)\n  done\n\n(*FIXME: isabelle-2012 *)\nlemma (in semigroup_add) foldl_assoc:\nshows \"foldl op+ (x+y) zs = x + (foldl op+ y zs)\"\nby (induct zs arbitrary: y) (simp_all add:add.assoc)\n\nlemma (in monoid_add) foldl_absorb0:\nshows \"x + (foldl op+ 0 zs) = foldl op+ x zs\"\nby (induct zs) (simp_all add:foldl_assoc)\n\nlemma foldl_conv_concat:\n  \"foldl (op @) xs xss = xs @ concat xss\"\nproof (induct xss arbitrary: xs)\n  case Nil show ?case by simp\nnext\n  interpret monoid_add \"op @\" \"[]\" proof qed simp_all\n  case Cons then show ?case by (simp add: foldl_absorb0)\nqed\n\nlemma foldl_concat_concat:\n  \"foldl op @ [] (xs @ ys) = foldl op @ [] xs @ foldl op @ [] ys\"\n  by (simp add: foldl_conv_concat)\n\nlemma foldl_does_nothing:\n  \"\\<lbrakk> \\<And>x. x \\<in> set xs \\<Longrightarrow> f s x = s \\<rbrakk> \\<Longrightarrow> foldl f s xs = s\"\n  by (induct xs, simp_all)\n\nlemma foldl_use_filter:\n  \"\\<lbrakk> \\<And>v x. \\<lbrakk> \\<not> g x; x \\<in> set xs \\<rbrakk> \\<Longrightarrow> f v x = v \\<rbrakk>\n     \\<Longrightarrow>\n    foldl f v xs = foldl f v (filter g xs)\"\n  apply (induct xs arbitrary: v)\n   apply simp\n  apply (simp split: split_if)\n  done\n\nlemma split_upt_on_n:\n  \"n < m \\<Longrightarrow> [0 ..< m] = [0 ..< n] @ [n] @ [Suc n ..< m]\"\n  apply (subst upt_add_eq_append', simp, erule order_less_imp_le)\n  apply (simp add: upt_conv_Cons)\n  done\n\nlemma unat_ucast_10_32 :\n  fixes x :: \"10 word\"\n  shows \"unat (ucast x :: word32) = unat x\"\n  unfolding ucast_def unat_def\n  apply (subst int_word_uint)\n  apply (subst mod_pos_pos_trivial)\n    apply simp\n   apply (rule lt2p_lem)\n   apply simp\n  apply simp\n  done\n\nlemma map_comp_update_lift:\n  assumes fv: \"f v = Some v'\"\n  shows \"(f \\<circ>\\<^sub>m (g(ptr \\<mapsto> v))) = ((f \\<circ>\\<^sub>m g)(ptr \\<mapsto> v'))\"\n  unfolding map_comp_def\n  apply (rule ext)\n  apply (simp add: fv)\n  done\n\nlemma restrict_map_cong:\n  assumes sv: \"S = S'\"\n  and     rl: \"\\<And>p. p \\<in> S' \\<Longrightarrow> mp p = mp' p\"\n  shows   \"mp |` S = mp' |` S'\"\n  apply (simp add: sv)\n  apply (rule ext)\n  apply (case_tac \"x \\<in> S'\")\n   apply (simp add: rl )\n  apply simp\n  done\n\nlemma and_eq_0_is_nth:\n  fixes x :: \"('a :: len) word\"\n  shows \"y = 1 << n \\<Longrightarrow> ((x && y) = 0) = (\\<not> (x !! n))\"\n  apply safe\n   apply (drule_tac u=\"(x && (1 << n))\" and x=n in word_eqD)\n   apply (simp add: nth_w2p)\n   apply (simp add: test_bit_bin)\n  apply (rule word_eqI)\n  apply (simp add: nth_w2p)\n  done\n\nlemmas and_neq_0_is_nth = arg_cong [where f=Not, OF and_eq_0_is_nth, simplified]\n\nlemma ucast_le_ucast_8_32:\n  \"(ucast x \\<le> (ucast y :: word32)) = (x \\<le> (y :: word8))\"\n  by (simp add: word_le_nat_alt unat_ucast_8_32)\n\nlemma mask_Suc_0 : \"mask (Suc 0) = 1\"\n  by (simp add: mask_def)\n\nlemma ucast_ucast_add:\n  fixes x :: \"('a :: len) word\"\n  fixes y :: \"('b :: len) word\"\n  shows\n  \"len_of TYPE('b) \\<ge> len_of TYPE('a) \\<Longrightarrow>\n    ucast (ucast x + y) = x + ucast y\"\n  apply (rule word_unat.Rep_eqD)\n  apply (simp add: unat_ucast unat_word_ariths mod_mod_power\n                   min.absorb2 unat_of_nat)\n  apply (subst mod_add_left_eq)\n  apply (simp add: mod_mod_power min.absorb2)\n  apply (subst mod_add_right_eq)\n  apply simp\n  done\n\nlemma word_shift_zero:\n  \"\\<lbrakk> x << n = 0; x \\<le> 2^m; m + n < len_of TYPE('a)\\<rbrakk> \\<Longrightarrow> (x::'a::len word) = 0\"\n  apply (rule ccontr)\n  apply (drule (2) word_shift_nonzero)\n  apply simp\n  done\n\nlemma neg_mask_mono_le:\n  \"(x :: 'a :: len word) \\<le> y \\<Longrightarrow> x && ~~ mask n \\<le> y && ~~ mask n\"\nproof (rule ccontr, simp add: linorder_not_le, cases \"n < len_of TYPE('a)\")\n  case False\n  show \"y && ~~ mask n < x && ~~ mask n \\<Longrightarrow> False\"\n    using False\n    by (simp add: mask_def linorder_not_less\n                  power_overflow)\nnext\n  case True\n  assume a: \"x \\<le> y\" and b: \"y && ~~ mask n < x && ~~ mask n\"\n  have word_bits:\n    \"n < len_of TYPE('a)\"\n    using True by assumption\n  have \"y \\<le> (y && ~~ mask n) + (y && mask n)\"\n    by (simp add: word_plus_and_or_coroll2 add.commute)\n  also have \"\\<dots> \\<le> (y && ~~ mask n) + 2 ^ n\"\n    apply (rule word_plus_mono_right)\n     apply (rule order_less_imp_le, rule and_mask_less_size)\n     apply (simp add: word_size word_bits)\n    apply (rule is_aligned_no_overflow'',\n           simp_all add: is_aligned_neg_mask word_bits)\n    apply (rule not_greatest_aligned, rule b)\n     apply (simp_all add: is_aligned_neg_mask)\n    done\n  also have \"\\<dots> \\<le> x && ~~ mask n\"\n    using b\n    apply -\n    apply (subst add.commute, rule le_plus)\n     apply (rule aligned_at_least_t2n_diff,\n            simp_all add: is_aligned_neg_mask)\n    apply (rule ccontr, simp add: linorder_not_le)\n    apply (drule aligned_small_is_0[rotated], simp_all add: is_aligned_neg_mask)\n    done\n  also have \"\\<dots> \\<le> x\"\n    by (rule word_and_le2)\n  also have \"x \\<le> y\" by fact\nfinally\n  show \"False\" using b\n    by simp\nqed\n\nlemma isRight_right_map:\n  \"isRight (case_sum Inl (Inr o f) v) = isRight v\"\n  by (simp add: isRight_def split: sum.split)\n\nlemma bool_mask [simp]:\n  fixes x :: word32\n  shows \"(0 < x && 1) = (x && 1 = 1)\"\n  apply (rule iffI)\n   prefer 2\n   apply simp\n  apply (subgoal_tac \"x && mask 1 < 2^1\")\n   prefer 2\n   apply (rule and_mask_less_size)\n   apply (simp add: word_size)\n  apply (simp add: mask_def)\n  apply (drule word_less_cases [where y=2])\n  apply (erule disjE, simp)\n  apply simp\n  done\n\nlemma case_option_over_if:\n  \"case_option P Q (if G then None else Some v)\n        = (if G then P else Q v)\"\n  \"case_option P Q (if G then Some v else None)\n        = (if G then Q v else P)\"\n  by (simp split: split_if)+\n\n\n\nlemma scast_eq_ucast:\n  \"\\<not> msb x \\<Longrightarrow> scast x = ucast x\"\n  by (simp add: scast_def ucast_def sint_eq_uint)\n\n(* MOVE *)\n\nlemma lt1_neq0:\n  fixes x :: \"'a :: len word\"\n  shows \"(1 \\<le> x) = (x \\<noteq> 0)\" by unat_arith\n\nlemma word_plus_one_nonzero:\n  fixes x :: \"'a :: len word\"\n  shows \"\\<lbrakk>x \\<le> x + y; y \\<noteq> 0\\<rbrakk> \\<Longrightarrow> x + 1 \\<noteq> 0\"\n  apply (subst lt1_neq0 [symmetric])\n  apply (subst olen_add_eqv [symmetric])\n  apply (erule word_random)\n  apply (simp add: lt1_neq0)\n  done\n\nlemma word_sub_plus_one_nonzero:\n  fixes n :: \"'a :: len word\"\n  shows \"\\<lbrakk>n' \\<le> n; n' \\<noteq> 0\\<rbrakk> \\<Longrightarrow> (n - n') + 1 \\<noteq> 0\"\n  apply (subst lt1_neq0 [symmetric])\n  apply (subst olen_add_eqv [symmetric])\n  apply (rule word_random [where x' = n'])\n   apply simp\n   apply (erule word_sub_le)\n  apply (simp add: lt1_neq0)\n  done\n\nlemma word_le_minus_mono_right:\n  fixes x :: \"'a :: len word\"\n  shows \"\\<lbrakk> z \\<le> y; y \\<le> x; z \\<le> x \\<rbrakk> \\<Longrightarrow> x - y \\<le> x - z\"\n  apply (rule word_sub_mono)\n     apply simp\n    apply assumption\n   apply (erule word_sub_le)\n  apply (erule word_sub_le)\n  done\n\nlemma drop_append_miracle:\n  \"n = length xs \\<Longrightarrow> drop n (xs @ ys) = ys\"\n  by simp\n\nlemma foldr_does_nothing_to_xf:\n  \"\\<lbrakk> \\<And>x s. x \\<in> set xs \\<Longrightarrow> xf (f x s) = xf s \\<rbrakk> \\<Longrightarrow> xf (foldr f xs s) = xf s\"\n  by (induct xs, simp_all)\n\nlemma nat_less_mult_monoish: \"\\<lbrakk> a < b; c < (d :: nat) \\<rbrakk> \\<Longrightarrow> (a + 1) * (c + 1) <= b * d\"\n  apply (drule Suc_leI)+\n  apply (drule(1) mult_le_mono)\n  apply simp\n  done\n\nlemma word_0_sle_from_less[unfolded word_size]:\n  \"\\<lbrakk> x < 2 ^ (size x - 1) \\<rbrakk>  \\<Longrightarrow> 0 <=s x\"\n  apply (clarsimp simp: word_sle_msb_le)\n  apply (simp add: word_msb_nth)\n  apply (subst (asm) word_test_bit_def [symmetric])\n  apply (drule less_mask_eq)\n  apply (drule_tac x=\"size x - 1\" in word_eqD)\n  apply (simp add: word_size)\n  done\n\nlemma not_msb_from_less:\n  \"(v :: 'a word) < 2 ^ (len_of TYPE('a :: len) - 1) \\<Longrightarrow> \\<not> msb v\"\n  apply (clarsimp simp add: msb_nth)\n  apply (drule less_mask_eq)\n  apply (drule word_eqD, drule(1) iffD2)\n  apply simp\n  done\n\nlemma distinct_lemma: \"f x \\<noteq> f y \\<Longrightarrow> x \\<noteq> y\" by auto\n\n\nlemma ucast_sub_ucast:\n  fixes x :: \"'a::len word\"\n  assumes \"y \\<le> x\"\n  assumes T: \"len_of TYPE('a) \\<le> len_of TYPE('b)\"\n  shows \"ucast (x - y) = (ucast x - ucast y :: 'b::len word)\"\nproof -\n  from T\n  have P: \"unat x < 2 ^ len_of TYPE('b)\" \"unat y < 2 ^ len_of TYPE('b)\"\n    by (fastforce intro!: less_le_trans[OF unat_lt2p])+\n  thus ?thesis\n    by (simp add: unat_arith_simps unat_ucast assms[simplified unat_arith_simps])\nqed\n\nlemma word_1_0:\n  \"\\<lbrakk>a + (1::('a::len) word) \\<le> b; a < of_nat ((2::nat) ^ len_of TYPE(32) - 1)\\<rbrakk> \\<Longrightarrow> a < b\"\n  by unat_arith\n\nlemma unat_of_nat_less:\"\\<lbrakk> a < b; unat b = c \\<rbrakk> \\<Longrightarrow> a < of_nat c\"\n  by fastforce\n\nlemma word_le_plus_1: \"\\<lbrakk> (y::('a::len) word) < y + n; a < n \\<rbrakk> \\<Longrightarrow> y + a \\<le> y + a + 1\"\n  by unat_arith\n\nlemma word_le_plus:\"\\<lbrakk>(a::('a::len) word) < a + b; c < b\\<rbrakk> \\<Longrightarrow> a \\<le> a + c\"\nby (metis order_less_imp_le word_random)\n\n(*\n * Basic signed arithemetic properties.\n *)\n\nlemma sint_minus1 [simp]: \"(sint x = -1) = (x = -1)\"\n  by (metis sint_n1 word_sint.Rep_inverse')\n\nlemma sint_0 [simp]: \"(sint x = 0) = (x = 0)\"\n  by (metis sint_0 word_sint.Rep_inverse')\n\n(* It is not always that case that \"sint 1 = 1\", because of 1-bit word sizes.\n * This lemma produces the different cases. *)\nlemma sint_1_cases:\n  \"\\<lbrakk> \\<lbrakk> len_of TYPE ('a::len) = 1; (a::'a word) = 0; sint a = 0 \\<rbrakk> \\<Longrightarrow> P;\n     \\<lbrakk> len_of TYPE ('a) = 1; a = 1; sint (1 :: 'a word) = -1 \\<rbrakk> \\<Longrightarrow> P;\n      \\<lbrakk> len_of TYPE ('a) > 1; sint (1 :: 'a word) = 1 \\<rbrakk> \\<Longrightarrow> P \\<rbrakk>\n                \\<Longrightarrow> P\"\n   apply atomize_elim\n  apply (case_tac \"len_of TYPE ('a) = 1\")\n   apply clarsimp\n   apply (subgoal_tac \"(UNIV :: 'a word set) = {0, 1}\")\n    apply (metis UNIV_I insert_iff singletonE)\n   apply (subst word_unat.univ)\n   apply (clarsimp simp: unats_def image_def)\n   apply (rule set_eqI, rule iffI)\n    apply clarsimp\n    apply (metis One_nat_def less_2_cases of_nat_1 semiring_1_class.of_nat_0)\n   apply clarsimp\n   apply (metis Abs_fnat_hom_0 Suc_1 lessI of_nat_1 zero_less_Suc)\n  apply clarsimp\n  apply (metis One_nat_def arith_is_1 le_def len_gt_0)\n  done\n\nlemma sint_int_min:\n  \"sint (- (2 ^ (len_of TYPE('a) - Suc 0)) :: ('a::len) word) = - (2 ^ (len_of TYPE('a) - Suc 0))\"\n  apply (subst word_sint.Abs_inverse' [where r=\"- (2 ^ (len_of TYPE('a) - Suc 0))\"])\n    apply (clarsimp simp: sints_num)\n   apply (clarsimp simp: wi_hom_syms word_of_int_2p)\n  apply clarsimp\n  done\n\nlemma sint_int_max_plus_1:\n  \"sint (2 ^ (len_of TYPE('a) - Suc 0) :: ('a::len) word) = - (2 ^ (len_of TYPE('a) - Suc 0))\"\n  apply (subst word_of_int_2p [symmetric])\n  apply (subst int_word_sint)\n  apply clarsimp\n  apply (metis Suc_pred int_word_uint len_gt_0 power_Suc uint_eq_0 word_of_int_2p word_pow_0)\n  done\n\nlemma word32_bounds:\n  \"- (2 ^ (size (x :: word32) - 1)) = (-2147483648 :: int)\"\n  \"((2 ^ (size (x :: word32) - 1)) - 1) = (2147483647 :: int)\"\n  \"- (2 ^ (size (y :: 32 signed word) - 1)) = (-2147483648 :: int)\"\n  \"((2 ^ (size (y :: 32 signed word) - 1)) - 1) = (2147483647 :: int)\"\n  by (simp_all add: word_size)\n\n\n\nlemma sbintrunc_If:\n  \"- 3 * (2 ^ n) \\<le> x \\<and> x < 3 * (2 ^ n)\n    \\<Longrightarrow> sbintrunc n x = (if x < - (2 ^ n) then x + 2 * (2 ^ n)\n        else if x \\<ge> 2 ^ n then x - 2 * (2 ^ n) else x)\"\n  apply (simp add: no_sbintr_alt2, safe)\n    apply (simp add: mod_pos_geq mod_pos_pos_trivial)\n   apply (subst mod_add_self1[symmetric], simp)\n   apply (simp add: mod_pos_pos_trivial)\n  apply (simp add: mod_pos_pos_trivial)\n  done\n\nlemma signed_arith_eq_checks_to_ord:\n  \"(sint a + sint b = sint (a + b ))\n    = ((a <=s a + b) = (0 <=s b))\"\n  \"(sint a - sint b = sint (a - b ))\n    = ((0 <=s a - b) = (b <=s a))\"\n  \"(- sint a = sint (- a)) = (0 <=s (- a) = (a <=s 0))\"\n  using sint_range'[where x=a] sint_range'[where x=b]\n  apply (simp_all add: sint_word_ariths\n                word_sle_def word_sless_alt sbintrunc_If)\n  apply arith+\n  done\n\n(* Basic proofs that signed word div/mod operations are\n * truncations of their integer counterparts. *)\n\nlemma signed_div_arith:\n    \"sint ((a::('a::len) word) sdiv b) = sbintrunc (len_of TYPE('a) - 1) (sint a sdiv sint b)\"\n  apply (subst word_sbin.norm_Rep [symmetric])\n  apply (subst bin_sbin_eq_iff' [symmetric])\n   apply simp\n  apply (subst uint_sint [symmetric])\n  apply (clarsimp simp: sdiv_int_def sdiv_word_def)\n  apply (metis word_ubin.eq_norm)\n  done\n\nlemma signed_mod_arith:\n    \"sint ((a::('a::len) word) smod b) = sbintrunc (len_of TYPE('a) - 1) (sint a smod sint b)\"\n  apply (subst word_sbin.norm_Rep [symmetric])\n  apply (subst bin_sbin_eq_iff' [symmetric])\n   apply simp\n  apply (subst uint_sint [symmetric])\n  apply (clarsimp simp: smod_int_def smod_word_def)\n  apply (metis word_ubin.eq_norm)\n  done\n\n(* Signed word arithmetic overflow constraints. *)\n\nlemma signed_arith_ineq_checks_to_eq:\n  \"((- (2 ^ (size a - 1)) \\<le> (sint a + sint b)) \\<and> (sint a + sint b \\<le> (2 ^ (size a - 1) - 1)))\n    = (sint a + sint b = sint (a + b ))\"\n  \"((- (2 ^ (size a - 1)) \\<le> (sint a - sint b)) \\<and> (sint a - sint b \\<le> (2 ^ (size a - 1) - 1)))\n    = (sint a - sint b = sint (a - b))\"\n  \"((- (2 ^ (size a - 1)) \\<le> (- sint a)) \\<and> (- sint a) \\<le> (2 ^ (size a - 1) - 1))\n    = ((- sint a) = sint (- a))\"\n  \"((- (2 ^ (size a - 1)) \\<le> (sint a * sint b)) \\<and> (sint a * sint b \\<le> (2 ^ (size a - 1) - 1)))\n    = (sint a * sint b = sint (a * b))\"\n  \"((- (2 ^ (size a - 1)) \\<le> (sint a sdiv sint b)) \\<and> (sint a sdiv sint b \\<le> (2 ^ (size a - 1) - 1)))\n    = (sint a sdiv sint b = sint (a sdiv b))\"\n  \"((- (2 ^ (size a - 1)) \\<le> (sint a smod sint b)) \\<and> (sint a smod sint b \\<le> (2 ^ (size a - 1) - 1)))\n    = (sint a smod sint b = sint (a smod b))\"\n  by (auto simp: sint_word_ariths word_size signed_div_arith signed_mod_arith\n                    sbintrunc_eq_in_range range_sbintrunc)\n\nlemmas signed_arith_ineq_checks_to_eq_word32\n    = signed_arith_ineq_checks_to_eq[where 'a=32, unfolded word32_bounds]\n      signed_arith_ineq_checks_to_eq[where 'a=\"32 signed\", unfolded word32_bounds]\n\nlemma signed_arith_sint:\n  \"((- (2 ^ (size a - 1)) \\<le> (sint a + sint b)) \\<and> (sint a + sint b \\<le> (2 ^ (size a - 1) - 1)))\n    \\<Longrightarrow> sint (a + b) = (sint a + sint b)\"\n  \"((- (2 ^ (size a - 1)) \\<le> (sint a - sint b)) \\<and> (sint a - sint b \\<le> (2 ^ (size a - 1) - 1)))\n    \\<Longrightarrow> sint (a - b) = (sint a - sint b)\"\n  \"((- (2 ^ (size a - 1)) \\<le> (- sint a)) \\<and> (- sint a) \\<le> (2 ^ (size a - 1) - 1))\n    \\<Longrightarrow> sint (- a) = (- sint a)\"\n  \"((- (2 ^ (size a - 1)) \\<le> (sint a * sint b)) \\<and> (sint a * sint b \\<le> (2 ^ (size a - 1) - 1)))\n    \\<Longrightarrow> sint (a * b) = (sint a * sint b)\"\n  \"((- (2 ^ (size a - 1)) \\<le> (sint a sdiv sint b)) \\<and> (sint a sdiv sint b \\<le> (2 ^ (size a - 1) - 1)))\n    \\<Longrightarrow> sint (a sdiv b) = (sint a sdiv sint b)\"\n  \"((- (2 ^ (size a - 1)) \\<le> (sint a smod sint b)) \\<and> (sint a smod sint b \\<le> (2 ^ (size a - 1) - 1)))\n    \\<Longrightarrow> sint (a smod b) = (sint a smod sint b)\"\n  by (metis signed_arith_ineq_checks_to_eq)+\n\nlemma signed_mult_eq_checks_double_size:\n  assumes mult_le: \"(2 ^ (len_of TYPE ('a) - 1) + 1) ^ 2\n       \\<le> (2 :: int) ^ (len_of TYPE ('b) - 1)\"\n    and le: \"2 ^ (len_of TYPE('a) - 1) \\<le> (2 :: int) ^ (len_of TYPE ('b) - 1)\"\n  shows\n  \"(sint (a :: ('a :: len) word) * sint b = sint (a * b))\n    = (scast a * scast b = (scast (a * b) :: ('b :: len) word))\"\nproof -\n  have P: \"sbintrunc (size a - 1) (sint a * sint b) \\<in> range (sbintrunc (size a - 1))\"\n    by simp\n\n  have abs: \"!! x :: 'a word. abs (sint x) < 2 ^ (size a - 1) + 1\"\n    apply (cut_tac x=x in sint_range')\n    apply (simp add: abs_le_iff word_size)\n    done\n  have abs_ab: \"abs (sint a * sint b) < 2 ^ (len_of TYPE('b) - 1)\"\n    using abs_mult_less[OF abs[where x=a] abs[where x=b]] mult_le\n    by (simp add: abs_mult power2_eq_square word_size)\n  show ?thesis\n    using P[unfolded range_sbintrunc] abs_ab le\n    apply (simp add: sint_word_ariths scast_def)\n    apply (simp add: wi_hom_mult)\n    apply (subst word_sint.Abs_inject, simp_all)\n     apply (simp add: sints_def range_sbintrunc\n                      abs_less_iff)\n    apply clarsimp\n    apply (simp add: sints_def range_sbintrunc word_size)\n    apply (auto elim: order_less_le_trans order_trans[rotated])\n    done\nqed\n\nlemmas signed_mult_eq_checks32_to_64\n    = signed_mult_eq_checks_double_size[where 'a=32 and 'b=64, simplified]\n      signed_mult_eq_checks_double_size[where 'a=\"32 signed\" and 'b=64, simplified]\n\n(* Properties about signed division. *)\n\nlemma int_sdiv_simps [simp]:\n    \"(a :: int) sdiv 1 = a\"\n    \"(a :: int) sdiv 0 = 0\"\n    \"(a :: int) sdiv -1 = -a\"\n  apply (auto simp: sdiv_int_def sgn_if)\n  done\n\nlemma sgn_div_eq_sgn_mult:\n    \"a div b \\<noteq> 0 \\<Longrightarrow> sgn ((a :: int) div b) = sgn (a * b)\"\n  apply (clarsimp simp: sgn_if zero_le_mult_iff neg_imp_zdiv_nonneg_iff not_less)\n  apply (metis less_le mult_le_0_iff neg_imp_zdiv_neg_iff not_less pos_imp_zdiv_neg_iff zdiv_eq_0_iff)\n  done\n\nlemma sgn_sdiv_eq_sgn_mult:\n    \"a sdiv b \\<noteq> 0 \\<Longrightarrow> sgn ((a :: int) sdiv b) = sgn (a * b)\"\n  apply (clarsimp simp: sdiv_int_def sgn_times)\n  apply (subst sgn_div_eq_sgn_mult)\n   apply simp\n  apply (clarsimp simp: sgn_times)\n  apply (metis abs_mult div_0 div_mult_self2_is_id sgn_0_0 sgn_1_pos sgn_times zero_less_abs_iff)\n  done\n\nlemma int_sdiv_same_is_1 [simp]:\n    \"a \\<noteq> 0 \\<Longrightarrow> ((a :: int) sdiv b = a) = (b = 1)\"\n  apply (rule iffI)\n   apply (clarsimp simp: sdiv_int_def)\n   apply (subgoal_tac \"b > 0\")\n    apply (case_tac \"a > 0\")\n     apply (clarsimp simp: sgn_if sign_simps)\n    apply (clarsimp simp: sign_simps not_less)\n    apply (metis int_div_same_is_1 le_neq_trans minus_minus neg_0_le_iff_le neg_equal_0_iff_equal)\n   apply (case_tac \"a > 0\")\n    apply (case_tac \"b = 0\")\n     apply (clarsimp simp: sign_simps)\n    apply (rule classical)\n    apply (clarsimp simp: sign_simps sgn_times not_less)\n    apply (metis le_less neg_0_less_iff_less not_less_iff_gr_or_eq pos_imp_zdiv_neg_iff)\n   apply (rule classical)\n   apply (clarsimp simp: sign_simps sgn_times not_less sgn_if split: if_splits)\n   apply (metis antisym less_le neg_imp_zdiv_nonneg_iff)\n  apply (clarsimp simp: sdiv_int_def sgn_if)\n  done\n\nlemma int_sdiv_negated_is_minus1 [simp]:\n    \"a \\<noteq> 0 \\<Longrightarrow> ((a :: int) sdiv b = - a) = (b = -1)\"\n  apply (clarsimp simp: sdiv_int_def)\n  apply (rule iffI)\n   apply (subgoal_tac \"b < 0\")\n    apply (case_tac \"a > 0\")\n     apply (clarsimp simp: sgn_if sign_simps not_less)\n    apply (case_tac \"sgn (a * b) = -1\")\n     apply (clarsimp simp: not_less sign_simps)\n    apply (clarsimp simp: sign_simps not_less)\n   apply (rule classical)\n   apply (case_tac \"b = 0\")\n    apply (clarsimp simp: sign_simps not_less sgn_times)\n   apply (case_tac \"a > 0\")\n    apply (clarsimp simp: sign_simps not_less sgn_times)\n    apply (metis less_le neg_less_0_iff_less not_less_iff_gr_or_eq pos_imp_zdiv_neg_iff)\n   apply (clarsimp simp: sign_simps not_less sgn_times)\n   apply (metis div_minus_right eq_iff neg_0_le_iff_le neg_imp_zdiv_nonneg_iff not_leE)\n  apply (clarsimp simp: sgn_if)\n  done\n\nlemma sdiv_int_range:\n    \"(a :: int) sdiv b \\<in> { - (abs a) .. (abs a) }\"\n  apply (unfold sdiv_int_def)\n  apply (subgoal_tac \"(abs a) div (abs b) \\<le> (abs a)\")\n   apply (clarsimp simp: sgn_if)\n   apply (metis Divides.transfer_nat_int_function_closures(1) abs_ge_zero\n              abs_less_iff abs_of_nonneg less_asym less_minus_iff not_less)\n  apply (metis abs_eq_0 abs_ge_zero div_by_0 zdiv_le_dividend zero_less_abs_iff)\n  done\n\n\n\nlemma sdiv_int_div_0 [simp]:\n  \"(x :: int) sdiv 0 = 0\"\n  by (clarsimp simp: sdiv_int_def)\n\nlemma sdiv_int_0_div [simp]:\n  \"0 sdiv (x :: int) = 0\"\n  by (clarsimp simp: sdiv_int_def)\n\nlemma word_sdiv_div0 [simp]:\n    \"(a :: ('a::len) word) sdiv 0 = 0\"\n  apply (auto simp: sdiv_word_def sdiv_int_def sgn_if)\n  done\n\nlemma word_sdiv_div_minus1 [simp]:\n    \"(a :: ('a::len) word) sdiv -1 = -a\"\n  apply (auto simp: sdiv_word_def sdiv_int_def sgn_if)\n  apply (metis wi_hom_neg word_sint.Rep_inverse')\n  done\n\nlemmas word_sdiv_0 = word_sdiv_div0\n\nlemma sdiv_word_min:\n    \"- (2 ^ (size a - 1)) \\<le> sint (a :: ('a::len) word) sdiv sint (b :: ('a::len) word)\"\n  apply (clarsimp simp: word_size)\n  apply (cut_tac sint_range' [where x=a])\n  apply (cut_tac sint_range' [where x=b])\n  apply clarsimp\n  apply (insert sdiv_int_range [where a=\"sint a\" and b=\"sint b\"])\n  apply (clarsimp simp: max_def abs_if split: split_if_asm)\n  done\n\nlemma sdiv_word_max:\n    \"(sint (a :: ('a::len) word) sdiv sint (b :: ('a::len) word) < (2 ^ (size a - 1))) =\n          ((a \\<noteq> - (2 ^ (size a - 1)) \\<or> (b \\<noteq> -1)))\"\n    (is \"?lhs = (\\<not> ?a_int_min \\<or> \\<not> ?b_minus1)\")\nproof (rule classical)\n  assume not_thesis: \"\\<not> ?thesis\"\n\n  have not_zero: \"b \\<noteq> 0\"\n    using not_thesis\n    by (clarsimp)\n\n  have result_range: \"sint a sdiv sint b \\<in> (sints (size a)) \\<union> {2 ^ (size a - 1)}\"\n    apply (cut_tac sdiv_int_range [where a=\"sint a\" and b=\"sint b\"])\n    apply (erule rev_subsetD)\n    using sint_range' [where x=a]  sint_range' [where x=b]\n    apply (auto simp: max_def abs_if word_size sints_num)\n    done\n\n  have result_range_overflow: \"(sint a sdiv sint b = 2 ^ (size a - 1)) = (?a_int_min \\<and> ?b_minus1)\"\n    apply (rule iffI [rotated])\n     apply (clarsimp simp: sdiv_int_def sgn_if word_size sint_int_min)\n    apply (rule classical)\n    apply (case_tac \"?a_int_min\")\n     apply (clarsimp simp: word_size sint_int_min)\n     apply (metis diff_0_right\n              int_sdiv_negated_is_minus1 minus_diff_eq minus_int_code(2)\n              power_eq_0_iff sint_minus1 zero_neq_numeral)\n    apply (subgoal_tac \"abs (sint a) < 2 ^ (size a - 1)\")\n     apply (insert sdiv_int_range [where a=\"sint a\" and b=\"sint b\"])[1]\n     apply (clarsimp simp: word_size)\n    apply (insert sdiv_int_range [where a=\"sint a\" and b=\"sint b\"])[1]\n    apply (insert word_sint.Rep [where x=\"a\"])[1]\n    apply (clarsimp simp: minus_le_iff word_size abs_if sints_num split: split_if_asm)\n    apply (metis minus_minus sint_int_min word_sint.Rep_inject)\n    done\n\n  have result_range_simple: \"(sint a sdiv sint b \\<in> (sints (size a))) \\<Longrightarrow> ?thesis\"\n    apply (insert sdiv_int_range [where a=\"sint a\" and b=\"sint b\"])\n    apply (clarsimp simp: word_size sints_num sint_int_min)\n    done\n\n  show ?thesis\n    apply (rule UnE [OF result_range result_range_simple])\n     apply simp\n    apply (clarsimp simp: word_size)\n    using result_range_overflow\n    apply (clarsimp simp: word_size)\n    done\nqed\n\nlemmas sdiv_word_min' = sdiv_word_min [simplified word_size, simplified]\nlemmas sdiv_word_max' = sdiv_word_max [simplified word_size, simplified]\nlemmas sdiv_word32_max = sdiv_word_max [where 'a=32, simplified word_size, simplified]\n    sdiv_word_max [where 'a=\"32 signed\", simplified word_size, simplified]\nlemmas sdiv_word32_min = sdiv_word_min [where 'a=32, simplified word_size, simplified]\n    sdiv_word_min [where 'a=\"32 signed\", simplified word_size, simplified]\n\nlemmas word_sdiv_numerals_lhs = sdiv_word_def[where a=\"numeral x\" for x]\n    sdiv_word_def[where a=0] sdiv_word_def[where a=1]\n\nlemmas word_sdiv_numerals = word_sdiv_numerals_lhs[where b=\"numeral y\" for y]\n    word_sdiv_numerals_lhs[where b=0] word_sdiv_numerals_lhs[where b=1]\n\n(*\n * Signed modulo properties.\n *)\n\nlemma smod_int_alt_def:\n     \"(a::int) smod b = sgn (a) * (abs a mod abs b)\"\n  apply (clarsimp simp: smod_int_def sdiv_int_def)\n  apply (clarsimp simp: zmod_zdiv_equality' abs_sgn sgn_times sgn_if sign_simps)\n  done\n\nlemma smod_int_range:\n  \"b \\<noteq> 0 \\<Longrightarrow> (a::int) smod b \\<in> { - abs b + 1 .. abs b - 1 }\"\n  apply (case_tac  \"b > 0\")\n   apply (insert pos_mod_conj [where a=a and b=b])[1]\n   apply (insert pos_mod_conj [where a=\"-a\" and b=b])[1]\n   apply (clarsimp simp: smod_int_alt_def sign_simps sgn_if\n              abs_if not_less add1_zle_eq [simplified add.commute])\n   apply (metis add_le_cancel_left monoid_add_class.add.right_neutral\n             int_one_le_iff_zero_less less_le_trans mod_minus_right neg_less_0_iff_less\n             neg_mod_conj not_less pos_mod_conj)\n  apply (insert neg_mod_conj [where a=a and b=\"b\"])[1]\n  apply (insert neg_mod_conj [where a=\"-a\" and b=\"b\"])[1]\n  apply (clarsimp simp: smod_int_alt_def sign_simps sgn_if\n            abs_if not_less add1_zle_eq [simplified add.commute])\n  apply (metis neg_0_less_iff_less neg_mod_conj not_le not_less_iff_gr_or_eq order_trans pos_mod_conj)\n  done\n\nlemma smod_int_compares:\n   \"\\<lbrakk> 0 \\<le> a; 0 < b \\<rbrakk> \\<Longrightarrow> (a :: int) smod b < b\"\n   \"\\<lbrakk> 0 \\<le> a; 0 < b \\<rbrakk> \\<Longrightarrow> 0 \\<le> (a :: int) smod b\"\n   \"\\<lbrakk> a \\<le> 0; 0 < b \\<rbrakk> \\<Longrightarrow> -b < (a :: int) smod b\"\n   \"\\<lbrakk> a \\<le> 0; 0 < b \\<rbrakk> \\<Longrightarrow> (a :: int) smod b \\<le> 0\"\n   \"\\<lbrakk> 0 \\<le> a; b < 0 \\<rbrakk> \\<Longrightarrow> (a :: int) smod b < - b\"\n   \"\\<lbrakk> 0 \\<le> a; b < 0 \\<rbrakk> \\<Longrightarrow> 0 \\<le> (a :: int) smod b\"\n   \"\\<lbrakk> a \\<le> 0; b < 0 \\<rbrakk> \\<Longrightarrow> (a :: int) smod b \\<le> 0\"\n   \"\\<lbrakk> a \\<le> 0; b < 0 \\<rbrakk> \\<Longrightarrow> b \\<le> (a :: int) smod b\"\n  apply (insert smod_int_range [where a=a and b=b])\n  apply (auto simp: add1_zle_eq smod_int_alt_def sgn_if)\n  done\n\nlemma smod_int_mod_0 [simp]:\n  \"x smod (0 :: int) = x\"\n  by (clarsimp simp: smod_int_def)\n\nlemma smod_int_0_mod [simp]:\n  \"0 smod (x :: int) = 0\"\n  by (clarsimp simp: smod_int_alt_def)\n\nlemma smod_word_mod_0 [simp]:\n  \"x smod (0 :: ('a::len) word) = x\"\n  by (clarsimp simp: smod_word_def)\n\nlemma smod_word_0_mod [simp]:\n  \"0 smod (x :: ('a::len) word) = 0\"\n  by (clarsimp simp: smod_word_def)\n\nlemma smod_word_max:\n    \"sint (a::'a word) smod sint (b::'a word) < 2 ^ (len_of TYPE('a::len) - Suc 0)\"\n  apply (case_tac \"b = 0\")\n   apply (insert word_sint.Rep [where x=a, simplified sints_num])[1]\n   apply (clarsimp)\n  apply (insert word_sint.Rep [where x=\"b\", simplified sints_num])[1]\n  apply (insert smod_int_range [where a=\"sint a\" and b=\"sint b\"])\n  apply (clarsimp simp: abs_if split: split_if_asm)\n  done\n\nlemma smod_word_min:\n    \"- (2 ^ (len_of TYPE('a::len) - Suc 0)) \\<le> sint (a::'a word) smod sint (b::'a word)\"\n  apply (case_tac \"b = 0\")\n   apply (insert word_sint.Rep [where x=a, simplified sints_num])[1]\n   apply clarsimp\n  apply (insert word_sint.Rep [where x=b, simplified sints_num])[1]\n  apply (insert smod_int_range [where a=\"sint a\" and b=\"sint b\"])\n  apply (clarsimp simp: abs_if add1_zle_eq split: split_if_asm)\n  done\n\nlemma smod_word_alt_def:\n  \"(a :: ('a::len) word) smod b = a - (a sdiv b) * b\"\n  apply (case_tac \"a \\<noteq> - (2 ^ (len_of TYPE('a) - 1)) \\<or> b \\<noteq> -1\")\n   apply (clarsimp simp: smod_word_def sdiv_word_def smod_int_def\n             minus_word.abs_eq [symmetric] times_word.abs_eq [symmetric])\n  apply (clarsimp simp: smod_word_def smod_int_def)\n  done\n\nlemmas word_smod_numerals_lhs = smod_word_def[where a=\"numeral x\" for x]\n    smod_word_def[where a=0] smod_word_def[where a=1]\n\nlemmas word_smod_numerals = word_smod_numerals_lhs[where b=\"numeral y\" for y]\n    word_smod_numerals_lhs[where b=0] word_smod_numerals_lhs[where b=1]\n\nlemma sint_of_int_eq:\n  \"\\<lbrakk> - (2 ^ (len_of TYPE('a) - 1)) \\<le> x; x < 2 ^ (len_of TYPE('a) - 1) \\<rbrakk> \\<Longrightarrow> sint (of_int x :: ('a::len) word) = x\"\n  apply (clarsimp simp: word_of_int int_word_sint)\n  apply (subst int_mod_eq')\n    apply simp\n   apply (subst (2) power_minus_simp)\n    apply clarsimp\n   apply clarsimp\n  apply clarsimp\n  done\n\nlemmas sint32_of_int_eq = sint_of_int_eq [where 'a=32, simplified]\n\nlemma of_int_sint [simp]:\n    \"of_int (sint a) = a\"\n  apply (insert word_sint.Rep [where x=a])\n  apply (clarsimp simp: word_of_int)\n  done\n\n\nlemma ucast_of_nats [simp]:\n     \"(ucast (of_nat x :: word32) :: sword32) = (of_nat x)\"\n     \"(ucast (of_nat x :: word32) :: sword16) = (of_nat x)\"\n     \"(ucast (of_nat x :: word32) :: sword8) = (of_nat x)\"\n     \"(ucast (of_nat x :: word16) :: sword16) = (of_nat x)\"\n     \"(ucast (of_nat x :: word16) :: sword8) = (of_nat x)\"\n     \"(ucast (of_nat x :: word8) :: sword8) = (of_nat x)\"\n  apply (auto simp: ucast_of_nat is_down)\n  done\n\nlemma nth_w2p_scast [simp]:\n  \"((scast ((2::'a::len signed word) ^ n) :: 'a word) !! m)\n         \\<longleftrightarrow> ((((2::'a::len  word) ^ n) :: 'a word) !! m)\"\n  apply (subst nth_w2p)\n  apply (case_tac \"n \\<ge> len_of TYPE('a)\")\n   apply (subst power_overflow, simp)\n   apply clarsimp\n  apply (metis nth_w2p scast_def bang_conj_lt\n               len_signed nth_word_of_int word_sint.Rep_inverse)\n  done\n\nlemma scast_2_power [simp]: \"scast ((2 :: 'a::len signed word) ^ x) = ((2 :: 'a word) ^ x)\"\n  by (clarsimp simp: word_eq_iff)\n\nlemma scast_bit_test [simp]:\n    \"scast ((1 :: 'a::len signed word) << n) = (1 :: 'a word) << n\"\n  by (clarsimp simp: word_eq_iff)\n\nlemma ucast_nat_def':\n  \"of_nat (unat x) = (ucast :: ('a :: len) word \\<Rightarrow> ('b :: len) signed word) x\"\n  by (simp add: ucast_def word_of_int_nat unat_def)\n\nlemma mod_mod_power_int:\n  fixes k :: int\n  shows \"k mod 2 ^ m mod 2 ^ n = k mod 2 ^ (min m n)\"\n  by (metis bintrunc_bintrunc_min bintrunc_mod2p min.commute)\n\n(* Normalise combinations of scast and ucast. *)\n\nlemma ucast_distrib:\n  fixes M :: \"'a::len word \\<Rightarrow> 'a::len word \\<Rightarrow> 'a::len word\"\n  fixes M' :: \"'b::len word \\<Rightarrow> 'b::len word \\<Rightarrow> 'b::len word\"\n  fixes L :: \"int \\<Rightarrow> int \\<Rightarrow> int\"\n  assumes lift_M: \"\\<And>x y. uint (M x y) = L (uint x) (uint y)  mod 2 ^ len_of TYPE('a)\"\n  assumes lift_M': \"\\<And>x y. uint (M' x y) = L (uint x) (uint y)  mod 2 ^ len_of TYPE('b)\"\n  assumes distrib: \"\\<And>x y. (L (x mod (2 ^ len_of TYPE('b))) (y mod (2 ^ len_of TYPE('b)))) mod (2 ^ len_of TYPE('b))\n                               = (L x y) mod (2 ^ len_of TYPE('b))\"\n  assumes is_down: \"is_down (ucast :: 'a word \\<Rightarrow> 'b word)\"\n  shows \"ucast (M a b) = M' (ucast a) (ucast b)\"\n  apply (clarsimp simp: word_of_int ucast_def)\n  apply (subst lift_M)\n  apply (subst of_int_uint [symmetric], subst lift_M')\n  apply (subst (1 2) int_word_uint)\n  apply (subst word_of_int)\n  apply (subst word.abs_eq_iff)\n  apply (subst (1 2) bintrunc_mod2p)\n  apply (insert is_down)\n  apply (unfold is_down_def)\n  apply (clarsimp simp: target_size source_size)\n  apply (clarsimp simp: mod_mod_power_int min_def)\n  apply (rule distrib [symmetric])\n  done\n\nlemma ucast_down_add:\n    \"is_down (ucast:: 'a word \\<Rightarrow> 'b word) \\<Longrightarrow>  ucast ((a :: 'a::len word) + b) = (ucast a + ucast b :: 'b::len word)\"\n  by (rule ucast_distrib [where L=\"op +\"], (clarsimp simp: uint_word_ariths)+, presburger, simp)\n\nlemma ucast_down_minus:\n    \"is_down (ucast:: 'a word \\<Rightarrow> 'b word) \\<Longrightarrow>  ucast ((a :: 'a::len word) - b) = (ucast a - ucast b :: 'b::len word)\"\n  apply (rule ucast_distrib [where L=\"op -\"], (clarsimp simp: uint_word_ariths)+)\n  apply (metis zdiff_zmod_left zdiff_zmod_right)\n  apply simp\n  done\n\nlemma ucast_down_mult:\n    \"is_down (ucast:: 'a word \\<Rightarrow> 'b word) \\<Longrightarrow>  ucast ((a :: 'a::len word) * b) = (ucast a * ucast b :: 'b::len word)\"\n  apply (rule ucast_distrib [where L=\"op *\"], (clarsimp simp: uint_word_ariths)+)\n  apply (metis mod_mult_eq)\n  apply simp\n  done\n\nlemma scast_distrib:\n  fixes M :: \"'a::len word \\<Rightarrow> 'a::len word \\<Rightarrow> 'a::len word\"\n  fixes M' :: \"'b::len word \\<Rightarrow> 'b::len word \\<Rightarrow> 'b::len word\"\n  fixes L :: \"int \\<Rightarrow> int \\<Rightarrow> int\"\n  assumes lift_M: \"\\<And>x y. uint (M x y) = L (uint x) (uint y)  mod 2 ^ len_of TYPE('a)\"\n  assumes lift_M': \"\\<And>x y. uint (M' x y) = L (uint x) (uint y)  mod 2 ^ len_of TYPE('b)\"\n  assumes distrib: \"\\<And>x y. (L (x mod (2 ^ len_of TYPE('b))) (y mod (2 ^ len_of TYPE('b)))) mod (2 ^ len_of TYPE('b))\n                               = (L x y) mod (2 ^ len_of TYPE('b))\"\n  assumes is_down: \"is_down (scast :: 'a word \\<Rightarrow> 'b word)\"\n  shows \"scast (M a b) = M' (scast a) (scast b)\"\n  apply (subst (1 2 3) down_cast_same [symmetric])\n   apply (insert is_down)\n   apply (clarsimp simp: is_down_def target_size source_size is_down)\n  apply (rule ucast_distrib [where L=L, OF lift_M lift_M' distrib])\n  apply (insert is_down)\n  apply (clarsimp simp: is_down_def target_size source_size is_down)\n  done\n\nlemma scast_down_add:\n    \"is_down (scast:: 'a word \\<Rightarrow> 'b word) \\<Longrightarrow>  scast ((a :: 'a::len word) + b) = (scast a + scast b :: 'b::len word)\"\n  by (rule scast_distrib [where L=\"op +\"], (clarsimp simp: uint_word_ariths)+, presburger, simp)\n\nlemma scast_down_minus:\n    \"is_down (scast:: 'a word \\<Rightarrow> 'b word) \\<Longrightarrow>  scast ((a :: 'a::len word) - b) = (scast a - scast b :: 'b::len word)\"\n  apply (rule scast_distrib [where L=\"op -\"], (clarsimp simp: uint_word_ariths)+)\n  apply (metis zdiff_zmod_left zdiff_zmod_right)\n  apply simp\n  done\n\nlemma scast_down_mult:\n    \"is_down (scast:: 'a word \\<Rightarrow> 'b word) \\<Longrightarrow>  scast ((a :: 'a::len word) * b) = (scast a * scast b :: 'b::len word)\"\n  apply (rule scast_distrib [where L=\"op *\"], (clarsimp simp: uint_word_ariths)+)\n  apply (metis mod_mult_eq)\n  apply simp\n  done\n\n\n\nlemma scast_ucast_3:\n  \"\\<lbrakk> is_down (ucast :: 'a word \\<Rightarrow> 'c word); is_down (ucast :: 'b word \\<Rightarrow> 'c word) \\<rbrakk> \\<Longrightarrow>\n         (scast (ucast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = ucast a\"\n  by (metis down_cast_same ucast_def ucast_down_wi)\n\nlemma scast_ucast_4:\n  \"\\<lbrakk> is_up (ucast :: 'a word \\<Rightarrow> 'b word); is_down (ucast :: 'b word \\<Rightarrow> 'c word) \\<rbrakk> \\<Longrightarrow>\n         (scast (ucast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = ucast a\"\n  by (metis down_cast_same ucast_def ucast_down_wi)\n\nlemma scast_scast_b:\n  \"\\<lbrakk> is_up (scast :: 'a word \\<Rightarrow> 'b word) \\<rbrakk> \\<Longrightarrow>\n     (scast (scast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = scast a\"\n  by (metis scast_def sint_up_scast)\n\nlemma ucast_scast_1:\n  \"\\<lbrakk> is_down (scast :: 'a word \\<Rightarrow> 'b word); is_down (ucast :: 'b word \\<Rightarrow> 'c word) \\<rbrakk> \\<Longrightarrow>\n            (ucast (scast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = scast a\"\n  by (metis scast_def ucast_down_wi)\n\n\n\nlemma ucast_scast_4:\n  \"\\<lbrakk> is_up (scast :: 'a word \\<Rightarrow> 'b word); is_down (ucast :: 'b word \\<Rightarrow> 'c word) \\<rbrakk> \\<Longrightarrow>\n     (ucast (scast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = scast a\"\n  by (metis down_cast_same scast_def sint_up_scast)\n\nlemma ucast_ucast_a:\n  \"\\<lbrakk> is_down (ucast :: 'b word \\<Rightarrow> 'c word) \\<rbrakk> \\<Longrightarrow>\n        (ucast (ucast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = ucast a\"\n  by (metis down_cast_same ucast_def ucast_down_wi)\n\nlemma ucast_ucast_b:\n  \"\\<lbrakk> is_up (ucast :: 'a word \\<Rightarrow> 'b word) \\<rbrakk> \\<Longrightarrow>\n     (ucast (ucast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = ucast a\"\n  by (metis ucast_up_ucast)\n\nlemma scast_scast_a:\n  \"\\<lbrakk> is_down (scast :: 'b word \\<Rightarrow> 'c word) \\<rbrakk> \\<Longrightarrow>\n            (scast (scast (a :: 'a::len word) :: 'b::len word) :: 'c::len word) = scast a\"\n  apply (clarsimp simp: scast_def)\n  apply (metis down_cast_same is_up_down scast_def ucast_down_wi)\n  done\n\nlemma scast_down_wi [OF refl]:\n  \"uc = scast \\<Longrightarrow> is_down uc \\<Longrightarrow> uc (word_of_int x) = word_of_int x\"\n  by (metis down_cast_same is_up_down ucast_down_wi)\n\nlemmas cast_simps =\n  is_down is_up\n  scast_down_add scast_down_minus scast_down_mult\n  ucast_down_add ucast_down_minus ucast_down_mult\n  scast_ucast_1 scast_ucast_3 scast_ucast_4\n  ucast_scast_1 ucast_scast_3 ucast_scast_4\n  ucast_ucast_a ucast_ucast_b\n  scast_scast_a scast_scast_b\n  ucast_down_bl\n  ucast_down_wi scast_down_wi\n  ucast_of_nat scast_of_nat\n  uint_up_ucast sint_up_scast\n  up_scast_surj up_ucast_surj\n\nlemma smod_mod_positive:\n    \"\\<lbrakk> 0 \\<le> (a :: int); 0 \\<le> b \\<rbrakk> \\<Longrightarrow> a smod b = a mod b\"\n  by (clarsimp simp: smod_int_alt_def zsgn_def)\n\nlemmas signed_shift_guard_simpler_32\n    = power_strict_increasing_iff[where b=\"2 :: nat\" and y=31, simplified]\n\nlemma nat_mult_power_less_eq:\n  \"b > 0 \\<Longrightarrow> (a * b ^ n < (b :: nat) ^ m) = (a < b ^ (m - n))\"\n  using mult_less_cancel2[where m = a and k = \"b ^ n\" and n=\"b ^ (m - n)\"]\n        mult_less_cancel2[where m=\"a * b ^ (n - m)\" and k=\"b ^ m\" and n=1]\n  apply (simp only: power_add[symmetric] nat_minus_add_max)\n  apply (simp only: power_add[symmetric] nat_minus_add_max ac_simps)\n  apply (simp add: max_def split: split_if_asm)\n  done\n\nlemma signed_shift_guard_to_word:\n  \"\\<lbrakk> n < len_of TYPE ('a); n > 0 \\<rbrakk>\n    \\<Longrightarrow> (unat (x :: ('a :: len) word) * 2 ^ y < 2 ^ n)\n    = (x = 0 \\<or> x < (1 << n >> y))\"\n  apply (simp only: nat_mult_power_less_eq)\n  apply (cases \"y \\<le> n\")\n   apply (simp only: shiftl_shiftr1)\n   apply (subst less_mask_eq)\n    apply (simp add: word_less_nat_alt word_size)\n    apply (rule order_less_le_trans[rotated], rule power_increasing[where n=1])\n      apply simp\n     apply simp\n    apply simp\n   apply (simp add: nat_mult_power_less_eq word_less_nat_alt word_size)\n   apply auto[1]\n  apply (simp only: shiftl_shiftr2, simp add: unat_eq_0)\n  done\n\nlemma word32_31_less:\n  \"31 < len_of TYPE (32 signed)\" \"31 > (0 :: nat)\"\n  \"31 < len_of TYPE (32)\" \"31 > (0 :: nat)\"\n  by auto\n\nlemmas signed_shift_guard_to_word_32\n    = signed_shift_guard_to_word[OF word32_31_less(1-2)]\n    signed_shift_guard_to_word[OF word32_31_less(3-4)]\n\nlemma sint_ucast_eq_uint:\n    \"\\<lbrakk> \\<not> is_down (ucast :: ('a::len word \\<Rightarrow> 'b::len word)) \\<rbrakk>\n            \\<Longrightarrow> sint ((ucast :: ('a::len word \\<Rightarrow> 'b::len word)) x) = uint x\"\n  apply (subst sint_eq_uint)\n   apply (clarsimp simp: msb_nth nth_ucast is_down)\n   apply (metis Suc_leI Suc_pred bang_conj_lt len_gt_0)\n  apply (clarsimp simp: uint_up_ucast is_up is_down)\n  done\n\nlemma word_less_nowrapI':\n  \"(x :: 'a :: len0 word) \\<le> z - k \\<Longrightarrow> k \\<le> z \\<Longrightarrow> 0 < k \\<Longrightarrow> x < x + k\"\n  by uint_arith\n\nlemma mask_plus_1:\n  \"mask n + 1 = 2 ^ n\"\n  by (clarsimp simp: mask_def)\n\nlemma unat_inj: \"inj unat\"\n  by (metis eq_iff injI word_le_nat_alt)\n\nlemma unat_ucast_upcast:\n  \"is_up (ucast :: 'b word \\<Rightarrow> 'a word)\n      \\<Longrightarrow> unat (ucast x :: ('a::len) word) = unat (x :: ('b::len) word)\"\n  unfolding ucast_def unat_def\n  apply (subst int_word_uint)\n  apply (subst mod_pos_pos_trivial)\n    apply simp\n   apply (rule lt2p_lem)\n   apply (clarsimp simp: is_up)\n  apply simp\n  done\n\nlemma ucast_mono:\n  \"\\<lbrakk> (x :: 'b :: len word) < y; y < 2 ^ len_of TYPE('a) \\<rbrakk>\n   \\<Longrightarrow> ucast x < ((ucast y) :: ('a :: len) word)\"\n  apply (simp add: ucast_nat_def [symmetric])\n  apply (rule of_nat_mono_maybe)\n  apply (rule unat_less_helper)\n  apply (simp add: Power.of_nat_power)\n  apply (simp add: word_less_nat_alt)\n  done\n\nlemma ucast_mono_le:\n  \"\\<lbrakk>x \\<le> y; y < 2 ^ len_of TYPE('b)\\<rbrakk> \\<Longrightarrow> (ucast (x :: 'a :: len word) :: 'b :: len word) \\<le> ucast y\"\n  apply (simp add: ucast_nat_def [symmetric])\n  apply (subst of_nat_mono_maybe_le[symmetric])\n    apply (rule unat_less_helper)\n    apply (simp add: Power.of_nat_power)\n   apply (rule unat_less_helper)\n   apply (erule le_less_trans)\n   apply (simp add: Power.of_nat_power)\n  apply (simp add: word_le_nat_alt)\n  done\n\nlemma zero_sle_ucast_up:\n  \"\\<not> is_down (ucast :: 'a word \\<Rightarrow> 'b signed word) \\<Longrightarrow>\n          (0 <=s ((ucast (b::('a::len) word)) :: ('b::len) signed word))\"\n  apply (subgoal_tac \"\\<not> msb (ucast b :: 'b signed word)\")\n   apply (clarsimp simp: word_sle_msb_le)\n  apply (clarsimp simp: is_down not_le msb_nth nth_ucast)\n  apply (subst (asm) bang_conj_lt [symmetric])\n  apply clarsimp\n  apply arith\n  done\n\nlemma msb_ucast_eq:\n    \"len_of TYPE('a) = len_of TYPE('b) \\<Longrightarrow>\n         msb (ucast x :: ('a::len) word) = msb (x :: ('b::len) word)\"\n  apply (clarsimp simp: word_msb_alt)\n  apply (subst ucast_down_drop [where n=0])\n   apply (clarsimp simp: source_size_def target_size_def word_size)\n  apply clarsimp\n  done\n\nlemma msb_big:\n     \"msb (a :: ('a::len) word) = (a \\<ge> 2 ^ (len_of TYPE('a)  - Suc 0))\"\n  apply (rule iffI)\n   apply (clarsimp simp: msb_nth)\n   apply (drule bang_is_le)\n   apply simp\n  apply (rule ccontr)\n  apply (subgoal_tac \"a = a && mask (len_of TYPE('a) - Suc 0)\")\n   apply (cut_tac and_mask_less' [where w=a and n=\"len_of TYPE('a) - Suc 0\"])\n    apply (clarsimp simp: word_not_le [symmetric])\n   apply clarsimp\n  apply (rule sym, subst and_mask_eq_iff_shiftr_0)\n  apply (clarsimp simp: msb_shift)\n  done\n\nlemma zero_sle_ucast:\n  \"(0 <=s ((ucast (b::('a::len) word)) :: ('a::len) signed word))\n                = (uint b < 2 ^ (len_of (TYPE('a)) - 1))\"\n  apply (case_tac \"msb b\")\n   apply (clarsimp simp: word_sle_msb_le not_less msb_ucast_eq del: notI)\n   apply (clarsimp simp: msb_big word_le_def uint_2p_alt)\n  apply (clarsimp simp: word_sle_msb_le not_less msb_ucast_eq del: notI)\n  apply (clarsimp simp: msb_big word_le_def uint_2p_alt)\n  done\n\n\n(* to_bool / from_bool. *)\n\ndefinition\n  from_bool :: \"bool \\<Rightarrow> 'a::len word\" where\n  \"from_bool b \\<equiv> case b of True \\<Rightarrow> of_nat 1\n                         | False \\<Rightarrow> of_nat 0\"\n\nlemma from_bool_0:\n  \"(from_bool x = 0) = (\\<not> x)\"\n  by (simp add: from_bool_def split: bool.split)\n\ndefinition\n  to_bool :: \"'a::len word \\<Rightarrow> bool\" where\n  \"to_bool \\<equiv> (op \\<noteq>) 0\"\n\nlemma to_bool_and_1:\n  \"to_bool (x && 1) = (x !! 0)\"\n  apply (simp add: to_bool_def)\n  apply (rule iffI)\n   apply (rule classical, erule notE, rule word_eqI)\n   apply clarsimp\n   apply (case_tac n, simp_all)[1]\n  apply (rule notI, drule word_eqD[where x=0])\n  apply simp\n  done\n\nlemma to_bool_from_bool:\n  \"to_bool (from_bool r) = r\"\n  unfolding from_bool_def to_bool_def\n  by (simp split: bool.splits)\n\nlemma from_bool_neq_0:\n  \"(from_bool b \\<noteq> 0) = b\"\n  by (simp add: from_bool_def split: bool.splits)\n\nlemma from_bool_mask_simp:\n  \"((from_bool r) :: word32) && 1 = from_bool r\"\n  unfolding from_bool_def\n  apply (clarsimp split: bool.splits)\n  done\n\nlemma scast_from_bool:\n  \"scast (from_bool P::word32) = (from_bool P::word32)\"\n  by (clarsimp simp: from_bool_def scast_id split: bool.splits)\n\nlemma from_bool_1:\n  \"(from_bool P = 1) = P\"\n  by (simp add: from_bool_def split: bool.splits)\n\nlemma ge_0_from_bool:\n  \"(0 < from_bool P) = P\"\n  by (simp add: from_bool_def split: bool.splits)\n\nlemma limited_and_from_bool:\n  \"limited_and (from_bool b) 1\"\n  by (simp add: from_bool_def limited_and_def split: bool.split)\n\nlemma to_bool_1 [simp]: \"to_bool 1\" by (simp add: to_bool_def)\nlemma to_bool_0 [simp]: \"\\<not>to_bool 0\" by (simp add: to_bool_def)\n\nlemma from_bool_eq_if:\n  \"(from_bool Q = (if P then 1 else 0)) = (P = Q)\"\n  by (simp add: case_bool_If from_bool_def split: split_if)\n\nlemma to_bool_eq_0:\n  \"(\\<not> to_bool x) = (x = 0)\"\n  by (simp add: to_bool_def)\n\nlemma to_bool_neq_0:\n  \"(to_bool x) = (x \\<noteq> 0)\"\n  by (simp add: to_bool_def)\n\nlemma from_bool_all_helper:\n  \"(\\<forall>bool. from_bool bool = val \\<longrightarrow> P bool)\n      = ((\\<exists>bool. from_bool bool = val) \\<longrightarrow> P (val \\<noteq> 0))\"\n  by (auto simp: from_bool_0)\n\nlemma word_rsplit_upt:\n  \"\\<lbrakk> size x = len_of TYPE('a :: len) * n; n \\<noteq> 0 \\<rbrakk>\n    \\<Longrightarrow> word_rsplit x = map (\\<lambda>i. ucast (x >> i * len_of TYPE ('a)) :: 'a word) (rev [0 ..< n])\"\n  apply (subgoal_tac \"length (word_rsplit x :: 'a word list) = n\")\n   apply (rule nth_equalityI, simp)\n   apply (intro allI word_eqI impI)\n   apply (simp add: test_bit_rsplit_alt word_size)\n   apply (simp add: nth_ucast nth_shiftr nth_rev field_simps)\n  apply (simp add: length_word_rsplit_exp_size)\n  apply (metis mult.commute given_quot_alt word_size word_size_gt_0)\n  done\n\nlemma aligned_shift:\n  \"\\<lbrakk>x < 2 ^ n; is_aligned (y :: 'a :: len word) n;n \\<le> len_of TYPE('a)\\<rbrakk>\n   \\<Longrightarrow> x + y >> n = y >> n\"\n  apply (subst word_plus_and_or_coroll)\n   apply (rule word_eqI)\n   apply (clarsimp simp: is_aligned_nth)\n   apply (drule(1) nth_bounded)\n    apply simp\n   apply simp\n  apply (rule word_eqI)\n  apply (simp add: nth_shiftr)\n  apply safe\n  apply (drule(1) nth_bounded)\n  apply simp+\n  done\n\nlemma aligned_shift':\n  \"\\<lbrakk>x < 2 ^ n; is_aligned (y :: 'a :: len word) n;n \\<le> len_of TYPE('a)\\<rbrakk>\n   \\<Longrightarrow> y + x >> n = y >> n\"\n  apply (subst word_plus_and_or_coroll)\n   apply (rule word_eqI)\n   apply (clarsimp simp: is_aligned_nth)\n   apply (drule(1) nth_bounded)\n    apply simp\n   apply simp\n  apply (rule word_eqI)\n  apply (simp add: nth_shiftr)\n  apply safe\n  apply (drule(1) nth_bounded)\n  apply simp+\ndone\n\nlemma neg_mask_add_mask:\n  \"((x:: 'a :: len word) && ~~ mask n) + (2 ^ n - 1) = x || mask n\"\n  apply (simp add:mask_2pm1[symmetric])\n  apply (rule word_eqI)\n  apply (rule iffI)\n    apply (clarsimp simp:word_size not_less)\n    apply (cut_tac w = \"((x && ~~ mask n) + mask n)\" and\n      m = n and n = \"na - n\" in nth_shiftr[symmetric])\n    apply clarsimp\n    apply (subst (asm) aligned_shift')\n  apply (simp add:mask_lt_2pn nth_shiftr is_aligned_neg_mask word_size word_bits_def )+\n  apply (case_tac \"na<n\")\n    apply clarsimp\n    apply (subst word_plus_and_or_coroll)\n    apply (rule iffD1[OF is_aligned_mask])\n    apply (simp add:is_aligned_neg_mask word_size not_less)+\n  apply (cut_tac w = \"((x && ~~ mask n) + mask n)\" and\n      m = n and n = \"na - n\" in nth_shiftr[symmetric])\n  apply clarsimp\n  apply (subst (asm) aligned_shift')\n  apply (simp add:mask_lt_2pn is_aligned_neg_mask word_bits_def nth_shiftr neg_mask_bang)+\ndone\n\nlemma subtract_mask:\n  \"p - (p && mask n) = (p && ~~ mask n)\"\n  \"p - (p && ~~ mask n) = (p && mask n)\"\n  by (simp add: field_simps word_plus_and_or_coroll2)+\n\nlemma and_neg_mask_plus_mask_mono: \"(p && ~~ mask n) + mask n \\<ge> p\"\n  apply (rule word_le_minus_cancel[where x = \"p && ~~ mask n\"])\n   apply (clarsimp simp: subtract_mask)\n   using word_and_le1[where a = \"mask n\" and y = p]\n   apply (clarsimp simp: mask_def word_le_less_eq)\n  apply (rule is_aligned_no_overflow'[folded mask_2pm1])\n  apply (clarsimp simp: is_aligned_neg_mask)\n  done\n\nlemma word_neg_and_le:\n  \"ptr \\<le> (ptr && ~~ mask n) + (2 ^ n - 1)\"\n  by (simp add: and_neg_mask_plus_mask_mono mask_2pm1[symmetric])\n\nlemma aligned_less_plus_1:\n  \"\\<lbrakk> is_aligned x n; n > 0 \\<rbrakk> \\<Longrightarrow> x < x + 1\"\n  apply (rule plus_one_helper2)\n   apply (rule order_refl)\n  apply (clarsimp simp: field_simps)\n  apply (drule arg_cong[where f=\"\\<lambda>x. x - 1\"])\n  apply (clarsimp simp: is_aligned_mask)\n  apply (drule word_eqD[where x=0])\n  apply simp\n  done\n\nlemma aligned_add_offset_less:\n  \"\\<lbrakk>is_aligned x n; is_aligned y n; x < y; z < 2 ^ n\\<rbrakk> \\<Longrightarrow> x + z < y\"\n  apply (cases \"y = 0\")\n   apply simp\n  apply (erule is_aligned_get_word_bits[where p=y], simp_all)\n  apply (cases \"z = 0\", simp_all)\n  apply (drule(2) aligned_at_least_t2n_diff[rotated -1])\n  apply (drule plus_one_helper2)\n   apply (rule less_is_non_zero_p1)\n   apply (rule aligned_less_plus_1)\n    apply (erule aligned_sub_aligned[OF _ _ order_refl],\n           simp_all add: is_aligned_triv)[1]\n   apply (cases n, simp_all)[1]\n  apply (simp only: trans[OF diff_add_eq diff_diff_eq2[symmetric]])\n  apply (drule word_less_add_right)\n   apply (rule ccontr, simp add: linorder_not_le)\n   apply (drule aligned_small_is_0, erule order_less_trans)\n    apply (clarsimp simp: power_overflow)\n   apply simp\n  apply (erule order_le_less_trans[rotated],\n         rule word_plus_mono_right)\n   apply (erule minus_one_helper3)\n  apply (simp add: is_aligned_no_wrap' is_aligned_no_overflow field_simps)\n  done\n\nlemma is_aligned_add_helper:\n  \"\\<lbrakk> is_aligned p n; d < 2 ^ n \\<rbrakk>\n     \\<Longrightarrow> (p + d && mask n = d) \\<and> (p + d && (~~ mask n) = p)\"\n  apply (subst(asm) is_aligned_mask)\n  apply (drule less_mask_eq)\n  apply (rule context_conjI)\n   apply (subst word_plus_and_or_coroll)\n    apply (rule word_eqI)\n    apply (drule_tac x=na in word_eqD)+\n    apply (simp add: word_size)\n    apply blast\n   apply (rule word_eqI)\n   apply (drule_tac x=na in word_eqD)+\n   apply (simp add: word_ops_nth_size word_size)\n   apply blast\n  apply (insert word_plus_and_or_coroll2[where x=\"p + d\" and w=\"mask n\"])\n  apply simp\n  done\n\nlemma is_aligned_sub_helper:\n  \"\\<lbrakk> is_aligned (p - d) n; d < 2 ^ n \\<rbrakk>\n     \\<Longrightarrow> (p && mask n = d) \\<and> (p && (~~ mask n) = p - d)\"\n  by (drule(1) is_aligned_add_helper, simp)\n\nlemma mask_twice:\n  \"(x && mask n) && mask m = x && mask (min m n)\"\n  apply (rule word_eqI)\n  apply (simp add: word_size conj_comms)\n  done\n\nlemma is_aligned_after_mask:\n  \"\\<lbrakk>is_aligned k m;m\\<le> n\\<rbrakk> \\<Longrightarrow> is_aligned (k && mask n) m\"\n  by (metis is_aligned_andI1)\n\nlemma and_mask_plus:\n  \"\\<lbrakk>is_aligned ptr m; m \\<le> n; n < 32; a < 2 ^ m\\<rbrakk>\n   \\<Longrightarrow> (ptr) + a && mask n = (ptr && mask n) + a\"\n  apply (rule mask_eqI[where n = m])\n   apply (simp add:mask_twice min_def)\n    apply (simp add:is_aligned_add_helper)\n    apply (subst is_aligned_add_helper[THEN conjunct1])\n      apply (erule is_aligned_after_mask)\n     apply simp\n    apply simp\n   apply simp\n  apply (subgoal_tac \"(ptr + a && mask n) && ~~ mask m\n     = (ptr + a && ~~ mask m ) && mask n\")\n   apply (simp add:is_aligned_add_helper)\n   apply (subst is_aligned_add_helper[THEN conjunct2])\n     apply (simp add:is_aligned_after_mask)\n    apply simp\n   apply simp\n  apply (simp add:word_bw_comms word_bw_lcs)\n  done\n\nlemma le_step_down_word:\"\\<lbrakk>(i::('a::len) word) \\<le> n; i = n \\<longrightarrow> P; i \\<le> n - 1 \\<longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  apply unat_arith\n  done\n\nlemma le_step_down_word_2:\n  fixes x :: \"'a::len word\"\n  shows \"\\<lbrakk>x \\<le>  y; x \\<noteq> y\\<rbrakk> \\<Longrightarrow> x \\<le> y - 1\"\n  by (subst (asm) word_le_less_eq,\n      clarsimp,\n      simp add: minus_one_helper3)\n\nlemma le_step_down_word_3:\n  fixes x :: \"32 word\"\n  shows \"\\<lbrakk>x \\<le>  y; x \\<noteq> y; y < 2 ^ 32 - 1\\<rbrakk> \\<Longrightarrow> x \\<le> y - 1\"\n  by (rule le_step_down_word_2, assumption+)\n\nlemma NOT_mask_AND_mask[simp]: \"(w && mask n) && ~~ mask n = 0\"\n  apply (clarsimp simp:mask_def)\n  by (metis word_bool_alg.conj_cancel_right word_bool_alg.conj_zero_right word_bw_comms(1) word_bw_lcs(1))\n\nlemma and_and_not[simp]:\"(a && b) && ~~ b = 0\"\n  apply (subst word_bw_assocs(1))\n  apply clarsimp\n  done\n\nlemma mask_shift_and_negate[simp]:\"(w && mask n << m) && ~~ (mask n << m) = 0\"\n  apply (clarsimp simp:mask_def)\n  by (metis (erased, hide_lams) mask_eq_x_eq_0 shiftl_over_and_dist word_bool_alg.conj_absorb word_bw_assocs(1))\n\nlemma shiftr_1[simplified]:\"(x::word32) >> 1 = 0 \\<Longrightarrow> x < 2\"\n  apply word_bitwise apply clarsimp\n  done\n\nlemma le_step_down_nat:\"\\<lbrakk>(i::nat) \\<le> n; i = n \\<longrightarrow> P; i \\<le> n - 1 \\<longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  apply arith\n  done\n\nlemma le_step_down_int:\"\\<lbrakk>(i::int) \\<le> n; i = n \\<longrightarrow> P; i \\<le> n - 1 \\<longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by arith\n\nlemma mask_step_down:\"(b::32word) && 0x1 = (1::32word) \\<Longrightarrow> (\\<exists>x. x < 32 \\<and> mask x = b >> 1) \\<Longrightarrow> (\\<exists>x. mask x = b)\"\n  apply clarsimp\n  apply (rule_tac x=\"x + 1\" in exI)\n  apply (subgoal_tac \"x \\<le> 31\")\n   apply (erule le_step_down_nat, clarsimp simp:mask_def, word_bitwise, clarsimp+)+\n   apply (clarsimp simp:mask_def, word_bitwise, clarsimp)\n  apply clarsimp\n  done\n\nlemma mask_1[simp]: \"(\\<exists>x. mask x = 1)\"\n  apply (rule_tac x=1 in exI)\n  apply (simp add:mask_def)\n  done\n\nlemma not_switch:\"~~ a = x \\<Longrightarrow> a = ~~ x\"\n  by auto\n\n(* The seL4 bitfield generator produces functions containing mask and shift operations, such that\n * invoking two of them consecutively can produce something like the following. Note that it is\n * unlikely you'll be able to use this lemma directly, hence the second one below.\n *)\nlemma bitfield_op_twice':\"(x && ~~ (mask n << m) || ((y && mask n) << m)) && ~~ (mask n << m) = x && ~~ (mask n << m)\"\n  apply (induct n arbitrary: m)\n   apply simp \n  apply (subst word_ao_dist)\n  apply (simp add:AND_twice)\n  done\n\n(* Helper to get bitfield_op_twice' to apply to code produced by the bitfield generator as it\n * appears in the wild. You'll probably need e.g.\n *  apply (clarsimp simp:bitfield_op_twice[unfolded mask_def, where n=5 and m=3, simplified])\n *)\nlemma bitfield_op_twice:\n  \"((x::word32) && ~~ (mask n << m) || ((y && mask n) << m)) && ~~ (mask n << m) = x && ~~ (mask n << m)\"\n  by (rule bitfield_op_twice')\n\nlemma bitfield_op_twice'': \"\\<lbrakk>~~ a = b << c; \\<exists>x. b = mask x\\<rbrakk> \\<Longrightarrow> (x && a || (y && b << c)) && a = x && a\"\n  apply clarsimp\n  apply (cut_tac n=xa and m=c and x=x and y=y in bitfield_op_twice')\n  apply (clarsimp simp:mask_def)\n  apply (drule not_switch)\n  apply clarsimp\n  done\n\nlemma bit_twiddle_min:\" (y::sword32) xor (((x::sword32) xor y) && (if x < y then -1 else 0)) = min x y\"\n  by (metis (mono_tags) min_def word_bitwise_m1_simps(2) word_bool_alg.xor_left_commute word_bool_alg.xor_self word_bool_alg.xor_zero_right word_bw_comms(1) word_le_less_eq word_log_esimps(7))\n\nlemma bit_twiddle_max:\"(x::sword32) xor (((x::sword32) xor y) && (if x < y then -1 else 0)) = max x y\"\n  by (metis (mono_tags) max_def word_bitwise_m1_simps(2) word_bool_alg.xor_left_self word_bool_alg.xor_zero_right word_bw_comms(1) word_le_less_eq word_log_esimps(7))\n   \nlemma has_zero_byte:\n  \"~~ (((((v::word32) && 0x7f7f7f7f) + 0x7f7f7f7f) || v) || 0x7f7f7f7f) \\<noteq> 0\n    \\<Longrightarrow> v && 0xff000000 = 0 \\<or> v && 0xff0000 = 0 \\<or> v && 0xff00 = 0 \\<or> v && 0xff = 0\"\n  apply clarsimp\n  apply word_bitwise\n  by metis\n\nlemma swap_with_xor:\"\\<lbrakk>(x::word32) = a xor b; y = b xor x; z = x xor y\\<rbrakk> \\<Longrightarrow> z = b \\<and> y = a\"\n  by (metis word_bool_alg.xor_assoc word_bool_alg.xor_commute word_bool_alg.xor_self word_bool_alg.xor_zero_right)\n\nlemma scast_nop_1:\"((scast ((of_int x)::('a::len) word))::'a sword) = of_int x\"\n  apply (clarsimp simp:scast_def word_of_int)\n  by (metis len_signed sint_sbintrunc' word_sint.Rep_inverse)\n\nlemma scast_nop_2:\"((scast ((of_int x)::('a::len) sword))::'a word) = of_int x\"\n  apply (clarsimp simp:scast_def word_of_int)\n  by (metis len_signed sint_sbintrunc' word_sint.Rep_inverse)\n\nlemmas scast_nop[simp] = scast_nop_1 scast_nop_2 scast_id\n\nlemma le_mask_imp_and_mask:\"(x::word32) \\<le> mask n \\<Longrightarrow> x && mask n = x\"\n  by (metis and_mask_eq_iff_le_mask)\n\nlemma or_not_mask_nop:\"((x::word32) || ~~ mask n) && mask n = x && mask n\"\n  by (metis word_and_not word_ao_dist2 word_bw_comms(1) word_log_esimps(3))\n\nlemma mask_exceed:\"n \\<ge> 32 \\<Longrightarrow> (x::word32) && ~~ mask n = 0\"\n  apply (metis (erased, hide_lams) is_aligned_neg_mask is_aligned_neg_mask_eq mask_32_max_word\n                                   word_bool_alg.compl_one word_bool_alg.conj_zero_right)\n  done\n\nlemma mask_subsume:\"\\<lbrakk>n \\<le> m\\<rbrakk> \\<Longrightarrow> ((x::word32) || y && mask n) && ~~ mask m = x && ~~ mask m\"\n  apply (subst word_ao_dist)\n  apply (subgoal_tac \"(y && mask n) && ~~ mask m = 0\")\n   apply simp\n  by (metis (no_types, hide_lams) is_aligned_mask is_aligned_weaken word_and_not word_bool_alg.conj_zero_right word_bw_comms(1) word_bw_lcs(1))\n\nlemma mask_twice2:\"n \\<le> m \\<Longrightarrow> ((x::word32) && mask m) && mask n = x && mask n\"\n  by (metis mask_twice min_def)\n\n(* Helper for dealing with casts of IPC buffer message register offsets.\n * XXX: There is almost certainly a more pleasant way to do this proof.\n *)\nlemma unat_nat:\"\\<lbrakk>i \\<ge> 0; i \\<le>2 ^ 31\\<rbrakk> \\<Longrightarrow> (unat ((of_int i)::sword32)) = nat i\"\n  unfolding unat_def apply (subst eq_nat_nat_iff, clarsimp+)\n  apply (subst Int.ring_1_class.of_nat_nat[symmetric], clarsimp+,\n         subst Word.word_of_int_nat[symmetric], clarsimp+)\n  apply (rule Word.word_uint.Abs_inverse)\n  apply clarsimp\n  apply (subst Word.uints_unats)\n  apply (induct i, (simp add:unats_def)+)\n  done\n\n(* FIXME: MOVE *)\nlemma pow_2_gt:\"n \\<ge> 2 \\<Longrightarrow> (2::int) < 2 ^ n\"\n  apply (induct n)\n   apply simp+\n  done\n\nlemma uint_2_id:\"len_of TYPE('a) \\<ge> 2 \\<Longrightarrow> uint (2::('a::len) word) = 2\"\n  apply clarsimp\n  apply (subgoal_tac \"2 \\<in> uints (len_of TYPE('a))\")\n   apply (subst (asm) Word.word_ubin.set_iff_norm)\n   apply simp\n  apply (subst word_uint.set_iff_norm)\n  apply clarsimp\n  apply (rule int_mod_eq')\n   apply simp\n  apply (rule pow_2_gt)\n  apply simp\n  done\n\n(* FIXME: MOVE *)\nlemma bintrunc_id:\"\\<lbrakk>of_nat n \\<ge> m; m > 0\\<rbrakk> \\<Longrightarrow> bintrunc n m = m\"\n  apply (subst bintrunc_mod2p)\n  apply (rule int_mod_eq')\n   apply simp+\n  apply (induct n arbitrary:m)\n   apply simp+\n  by force\n\nlemma shiftr1_unfold:\"shiftr1 x = x >> 1\"\n  by (metis One_nat_def comp_apply funpow.simps(1) funpow.simps(2) id_apply shiftr_def)\n\nlemma shiftr1_is_div_2:\"(x::('a::len) word) >> 1 = x div 2\"\n  apply (case_tac \"len_of TYPE('a) = 1\")\n   apply simp\n   apply (subgoal_tac \"x = 0 \\<or> x = 1\")\n    apply (erule disjE)\n     apply (clarsimp simp:word_div_def)+\n   apply (metis One_nat_def less_irrefl_nat sint_1_cases)\n  apply clarsimp\n  apply (subst word_div_def)\n  apply clarsimp\n  apply (subst bintrunc_id)\n    apply (subgoal_tac \"2 \\<le> len_of TYPE('a)\")\n     apply simp\n    apply (metis (no_types) le_0_eq le_SucE lens_not_0(2) not_less_eq_eq numeral_2_eq_2)\n   apply simp\n  apply (subst bin_rest_def[symmetric])\n  apply (subst shiftr1_def[symmetric])\n  apply (clarsimp simp:shiftr1_unfold)\n  done\n\nlemma shiftl1_is_mult: \"(x << 1) = (x :: 'a::len word) * 2\"\n  by (metis One_nat_def mult_2 mult_2_right one_add_one\n        power_0 power_Suc shiftl_t2n)\n\nlemma div_of_0_id[simp]:\"(0::('a::len) word) div n = 0\"\n  by (simp add: word_div_def)\n\nlemma degenerate_word:\"len_of TYPE('a) = 1 \\<Longrightarrow> (x::('a::len) word) = 0 \\<or> x = 1\"\n  by (metis One_nat_def less_irrefl_nat sint_1_cases)\n\nlemma div_by_0_word:\"(x::('a::len) word) div 0 = 0\"\n  by (metis div_0 div_by_0 unat_0 word_arith_nat_defs(6) word_div_1)\n\nlemma div_less_dividend_word:\"\\<lbrakk>x \\<noteq> 0; n \\<noteq> 1\\<rbrakk> \\<Longrightarrow> (x::('a::len) word) div n < x\"\n  apply (case_tac \"n = 0\")\n   apply clarsimp\n   apply (subst div_by_0_word)\n   apply (simp add:word_neq_0_conv)\n  apply (subst word_arith_nat_div)\n  apply (rule word_of_nat_less)\n  apply (rule div_less_dividend)\n   apply (metis (poly_guards_query) One_nat_def less_one nat_neq_iff unat_eq_1(2) unat_eq_zero)\n  apply (simp add:unat_gt_0)\n  done\n\nlemma shiftr1_lt:\"x \\<noteq> 0 \\<Longrightarrow> (x::('a::len) word) >> 1 < x\"\n  apply (subst shiftr1_is_div_2)\n  apply (rule div_less_dividend_word)\n   apply simp+\n  done\n\nlemma word_less_div:\n  fixes x :: \"('a::len) word\"\n    and y :: \"('a::len) word\"\n  shows \"x div y = 0 \\<Longrightarrow> y = 0 \\<or> x < y\"\n  apply (case_tac \"y = 0\", clarsimp+)\n  by (metis One_nat_def Suc_le_mono le0 le_div_geq not_less unat_0 unat_div unat_gt_0 word_less_nat_alt zero_less_one)\n\nlemma not_degenerate_imp_2_neq_0:\"len_of TYPE('a) > 1 \\<Longrightarrow> (2::('a::len) word) \\<noteq> 0\"\n  by (metis numerals(1) power_not_zero power_zero_numeral)\n\n\n\nlemma word_overflow:\"(x::('a::len) word) + 1 > x \\<or> x + 1 = 0\"\n  apply clarsimp\n  by (metis diff_0 eq_diff_eq less_x_plus_1 max_word_max plus_1_less)\n\nlemma word_overflow_unat:\"unat ((x::('a::len) word) + 1) = unat x + 1 \\<or> x + 1 = 0\"\n  by (metis Suc_eq_plus1 add.commute unatSuc)\n\nlemma even_word_imp_odd_next:\"even (unat (x::('a::len) word)) \\<Longrightarrow> x + 1 = 0 \\<or> odd (unat (x + 1))\"\n  apply (cut_tac x=x in word_overflow_unat)\n  apply clarsimp\n  done\n\nlemma odd_word_imp_even_next:\"odd (unat (x::('a::len) word)) \\<Longrightarrow> x + 1 = 0 \\<or> even (unat (x + 1))\"\n  apply (cut_tac x=x in word_overflow_unat)\n  apply clarsimp\n  done\n\nlemma overflow_imp_lsb:\"(x::('a::len) word) + 1 = 0 \\<Longrightarrow> x !! 0\"\n  by (metis add.commute add_left_cancel max_word_max not_less word_and_1 word_bool_alg.conj_one_right word_bw_comms(1) word_overflow zero_neq_one)\n\nlemma word_lsb_nat:\"lsb w = (unat w mod 2 = 1)\"\n  unfolding word_lsb_def bin_last_def\n  by (metis (no_types, hide_lams) nat_mod_distrib nat_numeral not_mod_2_eq_1_eq_0 numeral_One uint_eq_0 uint_nonnegative unat_0 unat_def zero_le_numeral)\n\nlemma odd_iff_lsb:\"odd (unat (x::('a::len) word)) = x !! 0\"\n  apply (simp add:even_iff_mod_2_eq_zero)\n  apply (subst word_lsb_nat[unfolded One_nat_def, symmetric])\n  apply (rule word_lsb_alt)\n  done\n\nlemma of_nat_neq_iff_word:\n      \"x mod 2 ^ len_of TYPE('a) \\<noteq> y mod 2 ^ len_of TYPE('a) \\<Longrightarrow>\n         (((of_nat x)::('a::len) word) \\<noteq> of_nat y) = (x \\<noteq> y)\"\n  apply (rule iffI)\n   apply (case_tac \"x = y\")\n   apply (subst (asm) of_nat_eq_iff[symmetric])\n   apply simp+\n  apply (case_tac \"((of_nat x)::('a::len) word) = of_nat y\")\n   apply (subst (asm) word_unat.norm_eq_iff[symmetric])\n   apply simp+\n  done\n\nlemma shiftr1_irrelevant_lsb:\"(x::('a::len) word) !! 0 \\<or> x >> 1 = (x + 1) >> 1\"\n  apply (case_tac \"len_of TYPE('a) = 1\")\n   apply clarsimp\n   apply (drule_tac x=x in degenerate_word[unfolded One_nat_def])\n   apply (erule disjE)\n    apply clarsimp+\n  apply (subst (asm) shiftr1_is_div_2[unfolded One_nat_def])+\n  apply (subst (asm) word_arith_nat_div)+\n  apply clarsimp\n  apply (subst (asm) bintrunc_id)\n    apply (subgoal_tac \"len_of TYPE('a) > 0\")\n     apply linarith\n    apply clarsimp+\n  apply (subst (asm) bintrunc_id)\n    apply (subgoal_tac \"len_of TYPE('a) > 0\")\n     apply linarith\n    apply clarsimp+\n  apply (case_tac \"x + 1 = 0\")\n   apply (clarsimp simp:overflow_imp_lsb)\n  apply (cut_tac x=x in word_overflow_unat)\n  apply clarsimp\n  apply (case_tac \"even (unat x)\")\n   apply (subgoal_tac \"unat x div 2 = Suc (unat x) div 2\")\n    apply metis\n   apply (subst numeral_2_eq_2)+\n   apply simp\n  apply (simp add:odd_iff_lsb)\n  done\n\nlemma shiftr1_0_imp_only_lsb:\"((x::('a::len) word) + 1) >> 1 = 0 \\<Longrightarrow> x = 0 \\<or> x + 1 = 0\"\n  by (metis One_nat_def shiftr1_0_or_1 word_less_1 word_overflow)\n\nlemma shiftr1_irrelevant_lsb':\"\\<not>((x::('a::len) word) !! 0) \\<Longrightarrow> x >> 1 = (x + 1) >> 1\"\n  by (metis shiftr1_irrelevant_lsb)\n\nlemma lsb_this_or_next:\"\\<not>(((x::('a::len) word) + 1) !! 0) \\<Longrightarrow> x !! 0\"\n  by (metis (poly_guards_query) even_word_imp_odd_next odd_iff_lsb overflow_imp_lsb)\n\n(* Bit population count. Equivalent of __builtin_popcount.\n * FIXME: MOVE\n *)\ndefinition\n  pop_count :: \"('a::len) word \\<Rightarrow> nat\"\nwhere\n  \"pop_count w \\<equiv> length (filter id (to_bl w))\"\n\nlemma pop_count_0[simp]:\"pop_count 0 = 0\"\n  by (clarsimp simp:pop_count_def)\n\nlemma pop_count_1[simp]:\"pop_count 1 = 1\"\n  by (clarsimp simp:pop_count_def to_bl_1)\n\nlemma pop_count_0_imp_0:\"(pop_count w = 0) = (w = 0)\"\n  apply (rule iffI)\n   apply (clarsimp simp:pop_count_def)\n   apply (subst (asm) filter_empty_conv)\n   apply (clarsimp simp:eq_zero_set_bl)\n   apply fast\n  apply simp\n  done\n\n(* Perhaps this one should be a simp lemma, but it seems a little dangerous. *)\nlemma cast_chunk_assemble_id:\n  \"\\<lbrakk>n = len_of TYPE('a::len); m = len_of TYPE('b::len); n * 2 = m\\<rbrakk> \\<Longrightarrow>\n  (((ucast ((ucast (x::'b word))::'a word))::'b word) || (((ucast ((ucast (x >> n))::'a word))::'b word) << n)) = x\"\n  apply (subgoal_tac \"((ucast ((ucast (x >> n))::'a word))::'b word) = x >> n\")\n   apply clarsimp\n   apply (subst and_not_mask[symmetric])\n   apply (subst ucast_ucast_mask)\n   apply (subst word_ao_dist2[symmetric])\n   apply clarsimp\n  apply (rule ucast_ucast_len)\n  apply (rule shiftr_less_t2n')\n   apply (subst and_mask_eq_iff_le_mask)\n   apply (clarsimp simp:mask_def)\n   apply (metis max_word_eq max_word_max mult_2_right)\n  apply (metis add_diff_cancel_left' diff_less len_gt_0 mult_2_right)\n  done\n\n(* Helper for packing then unpacking a 64-bit variable. *)\nlemma cast_chunk_assemble_id_64[simp]:\n  \"(((ucast ((ucast (x::64 word))::32 word))::64 word) || (((ucast ((ucast (x >> 32))::32 word))::64 word) << 32)) = x\"\n  by (simp add:cast_chunk_assemble_id)\n\nlemma cast_chunk_scast_assemble_id:\n  \"\\<lbrakk>n = len_of TYPE('a::len); m = len_of TYPE('b::len); n * 2 = m\\<rbrakk> \\<Longrightarrow>\n  (((ucast ((scast (x::'b word))::'a word))::'b word) || (((ucast ((scast (x >> n))::'a word))::'b word) << n)) = x\"\n  apply (subgoal_tac \"((scast x)::'a word) = ((ucast x)::'a word)\")\n   apply (subgoal_tac \"((scast (x >> n))::'a word) = ((ucast (x >> n))::'a word)\")\n    apply (simp add:cast_chunk_assemble_id)\n   apply (subst down_cast_same[symmetric], subst is_down, arith, simp)+\n  done\n\n(* Another variant of packing and unpacking a 64-bit variable. *)\nlemma cast_chunk_assemble_id_64'[simp]:\n  \"(((ucast ((scast (x::64 word))::32 word))::64 word) || (((ucast ((scast (x >> 32))::32 word))::64 word) << 32)) = x\"\n  by (simp add:cast_chunk_scast_assemble_id)\n\n(* Specialiasations of down_cast_same for adding to local simpsets. *)\nlemma cast_down_u64: \"(scast::64 word \\<Rightarrow> 32 word) = (ucast::64 word \\<Rightarrow> 32 word)\"\n  apply (subst down_cast_same[symmetric])\n   apply (simp add:is_down)+\n  done\nlemma cast_down_s64: \"(scast::64 sword \\<Rightarrow> 32 word) = (ucast::64 sword \\<Rightarrow> 32 word)\"\n  apply (subst down_cast_same[symmetric])\n   apply (simp add:is_down)+\n  done\n\nlemma mask_or_not_mask:\"x && mask n || x && ~~ mask n = x\"\n  apply (subst word_oa_dist)\n  apply simp\n  apply (subst word_oa_dist2)\n  apply simp\n  done\n\nlemma is_aligned_add_not_aligned:\n    \"\\<lbrakk>is_aligned (p::word32) n; \\<not> is_aligned (q::word32) n\\<rbrakk> \\<Longrightarrow>\n          \\<not> is_aligned (p + q) n\"\n  by (metis is_aligned_addD1)\n\nlemma dvd_not_suc:\"\\<lbrakk> 2 ^ n dvd (p::nat); n > 0; i > 0; i < 2 ^ n; p + i > p; n < 32\\<rbrakk> \\<Longrightarrow>\n          \\<not> (2 ^ n dvd (p + i))\"\n  by (metis dvd_def dvd_reduce_multiple nat_dvd_not_less)\n\nlemma word32_gr0_conv_Suc:\"(m::word32) > 0 \\<Longrightarrow> \\<exists>n. m = n + 1\"\n  by (metis add.commute add_minus_cancel)\n\nlemma offset_not_aligned:\n  \"\\<lbrakk> is_aligned (p::word32) n; i > 0; i < 2 ^ n; n < 32\\<rbrakk>\n     \\<Longrightarrow> \\<not> is_aligned (p + of_nat i) n\"\n  apply (erule is_aligned_add_not_aligned)\n  unfolding is_aligned_def apply clarsimp\n  apply (subst (asm) unat_of_nat_len)\n   apply (metis len32 unat_less_word_bits unat_power_lower32 word_bits_conv)\n  apply (metis nat_dvd_not_less)\n  done\n\nlemma neg_mask_add_aligned:\n  \"\\<lbrakk> is_aligned p n; q < 2 ^ n \\<rbrakk>\n     \\<Longrightarrow> (p + q) && ~~ mask n = p && ~~ mask n\"\n  by (metis is_aligned_add_helper is_aligned_neg_mask_eq)\n\nlemma word_sless_sint_le:\"x <s y \\<Longrightarrow> sint x \\<le> sint y - 1\"\n  by (metis word_sless_alt zle_diff1_eq)\n\nlemma word_ge_min:\"sint (x::32 word) \\<ge> -2147483648\"\n  by (metis sint_ge word32_bounds(1) word_size)\n\nlemma set_enum_word8_def:\n  \"((set enum)::word8 set) = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,\n                              20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36,\n                              37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53,\n                              54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70,\n                              71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87,\n                              88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103,\n                              104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117,\n                              118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131,\n                              132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145,\n                              146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159,\n                              160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173,\n                              174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187,\n                              188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201,\n                              202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215,\n                              216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229,\n                              230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243,\n                              244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255}\"\n  by (eval)\n\nlemma word8_exhaust:\n  fixes x :: word8\n  shows \"\\<lbrakk>x \\<noteq> 0; x \\<noteq> 1; x \\<noteq> 2; x \\<noteq> 3; x \\<noteq> 4; x \\<noteq> 5; x \\<noteq> 6; x \\<noteq> 7; x \\<noteq> 8; x \\<noteq> 9; x \\<noteq> 10; x \\<noteq> 11; x \\<noteq>\n          12; x \\<noteq> 13; x \\<noteq> 14; x \\<noteq> 15; x \\<noteq> 16; x \\<noteq> 17; x \\<noteq> 18; x \\<noteq> 19; x \\<noteq> 20; x \\<noteq> 21; x \\<noteq> 22; x \\<noteq>\n          23; x \\<noteq> 24; x \\<noteq> 25; x \\<noteq> 26; x \\<noteq> 27; x \\<noteq> 28; x \\<noteq> 29; x \\<noteq> 30; x \\<noteq> 31; x \\<noteq> 32; x \\<noteq> 33; x \\<noteq>\n          34; x \\<noteq> 35; x \\<noteq> 36; x \\<noteq> 37; x \\<noteq> 38; x \\<noteq> 39; x \\<noteq> 40; x \\<noteq> 41; x \\<noteq> 42; x \\<noteq> 43; x \\<noteq> 44; x \\<noteq>\n          45; x \\<noteq> 46; x \\<noteq> 47; x \\<noteq> 48; x \\<noteq> 49; x \\<noteq> 50; x \\<noteq> 51; x \\<noteq> 52; x \\<noteq> 53; x \\<noteq> 54; x \\<noteq> 55; x \\<noteq>\n          56; x \\<noteq> 57; x \\<noteq> 58; x \\<noteq> 59; x \\<noteq> 60; x \\<noteq> 61; x \\<noteq> 62; x \\<noteq> 63; x \\<noteq> 64; x \\<noteq> 65; x \\<noteq> 66; x \\<noteq>\n          67; x \\<noteq> 68; x \\<noteq> 69; x \\<noteq> 70; x \\<noteq> 71; x \\<noteq> 72; x \\<noteq> 73; x \\<noteq> 74; x \\<noteq> 75; x \\<noteq> 76; x \\<noteq> 77; x \\<noteq>\n          78; x \\<noteq> 79; x \\<noteq> 80; x \\<noteq> 81; x \\<noteq> 82; x \\<noteq> 83; x \\<noteq> 84; x \\<noteq> 85; x \\<noteq> 86; x \\<noteq> 87; x \\<noteq> 88; x \\<noteq>\n          89; x \\<noteq> 90; x \\<noteq> 91; x \\<noteq> 92; x \\<noteq> 93; x \\<noteq> 94; x \\<noteq> 95; x \\<noteq> 96; x \\<noteq> 97; x \\<noteq> 98; x \\<noteq> 99; x \\<noteq>\n          100; x \\<noteq> 101; x \\<noteq> 102; x \\<noteq> 103; x \\<noteq> 104; x \\<noteq> 105; x \\<noteq> 106; x \\<noteq> 107; x \\<noteq> 108; x \\<noteq> 109; x \\<noteq>\n          110; x \\<noteq> 111; x \\<noteq> 112; x \\<noteq> 113; x \\<noteq> 114; x \\<noteq> 115; x \\<noteq> 116; x \\<noteq> 117; x \\<noteq> 118; x \\<noteq> 119; x \\<noteq>\n          120; x \\<noteq> 121; x \\<noteq> 122; x \\<noteq> 123; x \\<noteq> 124; x \\<noteq> 125; x \\<noteq> 126; x \\<noteq> 127; x \\<noteq> 128; x \\<noteq> 129; x \\<noteq>\n          130; x \\<noteq> 131; x \\<noteq> 132; x \\<noteq> 133; x \\<noteq> 134; x \\<noteq> 135; x \\<noteq> 136; x \\<noteq> 137; x \\<noteq> 138; x \\<noteq> 139; x \\<noteq>\n          140; x \\<noteq> 141; x \\<noteq> 142; x \\<noteq> 143; x \\<noteq> 144; x \\<noteq> 145; x \\<noteq> 146; x \\<noteq> 147; x \\<noteq> 148; x \\<noteq> 149; x \\<noteq>\n          150; x \\<noteq> 151; x \\<noteq> 152; x \\<noteq> 153; x \\<noteq> 154; x \\<noteq> 155; x \\<noteq> 156; x \\<noteq> 157; x \\<noteq> 158; x \\<noteq> 159; x \\<noteq>\n          160; x \\<noteq> 161; x \\<noteq> 162; x \\<noteq> 163; x \\<noteq> 164; x \\<noteq> 165; x \\<noteq> 166; x \\<noteq> 167; x \\<noteq> 168; x \\<noteq> 169; x \\<noteq>\n          170; x \\<noteq> 171; x \\<noteq> 172; x \\<noteq> 173; x \\<noteq> 174; x \\<noteq> 175; x \\<noteq> 176; x \\<noteq> 177; x \\<noteq> 178; x \\<noteq> 179; x \\<noteq>\n          180; x \\<noteq> 181; x \\<noteq> 182; x \\<noteq> 183; x \\<noteq> 184; x \\<noteq> 185; x \\<noteq> 186; x \\<noteq> 187; x \\<noteq> 188; x \\<noteq> 189; x \\<noteq>\n          190; x \\<noteq> 191; x \\<noteq> 192; x \\<noteq> 193; x \\<noteq> 194; x \\<noteq> 195; x \\<noteq> 196; x \\<noteq> 197; x \\<noteq> 198; x \\<noteq> 199; x \\<noteq>\n          200; x \\<noteq> 201; x \\<noteq> 202; x \\<noteq> 203; x \\<noteq> 204; x \\<noteq> 205; x \\<noteq> 206; x \\<noteq> 207; x \\<noteq> 208; x \\<noteq> 209; x \\<noteq>\n          210; x \\<noteq> 211; x \\<noteq> 212; x \\<noteq> 213; x \\<noteq> 214; x \\<noteq> 215; x \\<noteq> 216; x \\<noteq> 217; x \\<noteq> 218; x \\<noteq> 219; x \\<noteq>\n          220; x \\<noteq> 221; x \\<noteq> 222; x \\<noteq> 223; x \\<noteq> 224; x \\<noteq> 225; x \\<noteq> 226; x \\<noteq> 227; x \\<noteq> 228; x \\<noteq> 229; x \\<noteq>\n          230; x \\<noteq> 231; x \\<noteq> 232; x \\<noteq> 233; x \\<noteq> 234; x \\<noteq> 235; x \\<noteq> 236; x \\<noteq> 237; x \\<noteq> 238; x \\<noteq> 239; x \\<noteq>\n          240; x \\<noteq> 241; x \\<noteq> 242; x \\<noteq> 243; x \\<noteq> 244; x \\<noteq> 245; x \\<noteq> 246; x \\<noteq> 247; x \\<noteq> 248; x \\<noteq> 249; x \\<noteq>\n          250; x \\<noteq> 251; x \\<noteq> 252; x \\<noteq> 253; x \\<noteq> 254; x \\<noteq> 255\\<rbrakk> \\<Longrightarrow> P\"\n  by (subgoal_tac \"x \\<in> set enum\",\n       subst (asm) set_enum_word8_def,\n       simp,\n      simp)\n\nlemma upper_trivial:\n  fixes x :: \"'a::len word\"\n  shows \"x \\<noteq> 2 ^ len_of TYPE('a) - 1 \\<Longrightarrow> x < 2 ^ len_of TYPE('a) - 1\"\n  by (cut_tac n=x and 'a='a in max_word_max,\n      clarsimp simp:max_word_def,\n      simp add: less_le)\n\nlemma constraint_expand:\n  fixes x :: \"'a::len word\"\n  shows \"x \\<in> {y. lower \\<le> y \\<and> y \\<le> upper} = (lower \\<le> x \\<and> x \\<le> upper)\"\n  by simp\n\nlemma card_map_elide:\n  \"n \\<le> CARD(32 word) \\<Longrightarrow> card ((of_nat::nat \\<Rightarrow> 32 word) ` {0..<n}) = card {0..<n}\"\n  apply clarsimp\n  apply (induct n)\n   apply clarsimp+\n  apply (subgoal_tac \"{0..<Suc n} = {0..<n} \\<union> {n}\")\n   prefer 2\n   apply clarsimp\n   apply fastforce\n  apply clarsimp\n  apply (subst card_insert_disjoint)\n    apply clarsimp\n   apply (subst atLeast0LessThan)\n   apply (subgoal_tac \"(of_nat::nat \\<Rightarrow> 32 word) ` {..<n} = {..<of_nat n}\")\n    prefer 2\n    apply (rule equalityI)\n     apply clarsimp\n     apply (subst (asm) card_word)\n     apply clarsimp\n     apply (rule of_nat_mono_maybe)\n      apply clarsimp+\n      apply (subgoal_tac \"x \\<in> of_nat ` {..<n} = (\\<exists>y\\<in>{..<n}. of_nat y = x)\")\n       prefer 2\n       apply blast\n      apply simp\n      apply (rule bexI) (* sorry for schematics *)\n       apply (rule word_unat.Rep_inverse')\n       apply force\n      apply clarsimp \n      apply (subst (asm) card_word)\n      apply clarsimp\n      apply (metis (erased, hide_lams) Divides.mod_less_eq_dividend order_less_le_trans unat_of_nat word_less_nat_alt)\n     by clarsimp+\n\nlemma card_map_elide2: \"n \\<le> CARD(32 word) \\<Longrightarrow> card ((of_nat::nat \\<Rightarrow> 32 word) ` {0..<n}) = n\"\n  apply (subst card_map_elide)\n   by clarsimp+\n\nlemma le_max_word_ucast_id:\n  \"(x::'a::len word) \\<le> ucast (max_word::'b::len word) \\<Longrightarrow> ucast ((ucast x)::'b word) = x\"\n  apply (unfold ucast_def)\n  apply (subst word_ubin.eq_norm)\n  apply (subst and_mask_bintr[symmetric])\n  apply (subst and_mask_eq_iff_le_mask)\n  apply (clarsimp simp:max_word_def mask_def)\n  proof -\n    assume a1: \"x \\<le> word_of_int (uint (word_of_int (2 ^ len_of (TYPE('b)\\<Colon>'b itself) - 1)\\<Colon>'b word))\"\n    have f2: \"((\\<exists>i ia. (0\\<Colon>int) \\<le> i \\<and> \\<not> 0 \\<le> i + - 1 * ia \\<and> i mod ia \\<noteq> i) \\<or> \\<not> (0\\<Colon>int) \\<le> - 1 + 2 ^ len_of (TYPE('b)\\<Colon>'b itself) \\<or> (0\\<Colon>int) \\<le> - 1 + 2 ^ len_of (TYPE('b)\\<Colon>'b itself) + - 1 * 2 ^ len_of (TYPE('b)\\<Colon>'b itself) \\<or> (- (1\\<Colon>int) + 2 ^ len_of (TYPE('b)\\<Colon>'b itself)) mod 2 ^ len_of (TYPE('b)\\<Colon>'b itself) = - 1 + 2 ^ len_of (TYPE('b)\\<Colon>'b itself)) = ((\\<exists>i ia. (0\\<Colon>int) \\<le> i \\<and> \\<not> 0 \\<le> i + - 1 * ia \\<and> i mod ia \\<noteq> i) \\<or> \\<not> (1\\<Colon>int) \\<le> 2 ^ len_of (TYPE('b)\\<Colon>'b itself) \\<or> 2 ^ len_of (TYPE('b)\\<Colon>'b itself) + - (1\\<Colon>int) * ((- 1 + 2 ^ len_of (TYPE('b)\\<Colon>'b itself)) mod 2 ^ len_of (TYPE('b)\\<Colon>'b itself)) = 1)\"\n      by force\n    have f3: \"\\<forall>i ia. \\<not> (0\\<Colon>int) \\<le> i \\<or> 0 \\<le> i + - 1 * ia \\<or> i mod ia = i\"\n      using mod_pos_pos_trivial by force\n    have \"(1\\<Colon>int) \\<le> 2 ^ len_of (TYPE('b)\\<Colon>'b itself)\"\n      by simp\n    hence \"2 ^ len_of (TYPE('b)\\<Colon>'b itself) + - (1\\<Colon>int) * ((- 1 + 2 ^ len_of (TYPE('b)\\<Colon>'b itself)) mod 2 ^ len_of (TYPE('b)\\<Colon>'b itself)) = 1\"\n      using f3 f2 by blast\n    hence f4: \"- (1\\<Colon>int) + 2 ^ len_of (TYPE('b)\\<Colon>'b itself) = (- 1 + 2 ^ len_of (TYPE('b)\\<Colon>'b itself)) mod 2 ^ len_of (TYPE('b)\\<Colon>'b itself)\"\n      by linarith\n    have f5: \"x \\<le> word_of_int (uint (word_of_int (- 1 + 2 ^ len_of (TYPE('b)\\<Colon>'b itself))\\<Colon>'b word))\"\n      using a1 by force\n    have f6: \"2 ^ len_of (TYPE('b)\\<Colon>'b itself) + - (1\\<Colon>int) = - 1 + 2 ^ len_of (TYPE('b)\\<Colon>'b itself)\"\n      by force\n    have f7: \"- (1\\<Colon>int) * 1 = - 1\"\n      by auto\n    have \"\\<forall>x0 x1. (x1\\<Colon>int) - x0 = x1 + - 1 * x0\"\n      by force\n    thus \"x \\<le> 2 ^ len_of (TYPE('b)\\<Colon>'b itself) - 1\"\n      using f7 f6 f5 f4 by (metis uint_word_of_int wi_homs(2) word_arith_wis(8) word_of_int_2p)\n  qed\n\n(*enumerations of words*)\nlemma remdups_enum_upto: fixes s::\"'a::len word\" shows \"remdups [s .e. e] = [s .e. e]\" by(simp)\n\nlemma card_enum_upto: fixes s::\"'a::len word\" shows \"card (set [s .e. e]) = Suc (unat e) - unat s\"\n  apply(subst List.card_set)\n  apply(simp add: remdups_enum_upto)\n  done\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/lib/WordLemmaBucket.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3281458665646787}}
{"text": "theory flash95Bra  imports flash95Rev\n \n  begin\nlemma onInv95:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv95 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv95 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv95 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash95Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.749087201911703, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.3279679798826485}}
{"text": "theory RingBuffer_BD_latest_3\nimports Main HOL.List\nbegin \n\n(*-------------------------------------------------------------------\n      W_step_side                           R_step_side\nLOCAL preserves inv    (done)         LOCAL preserves inv    (done)\nLOCAL shows preW       (done)         LOCAL shows preR       (done) \nGLOBAL preserves preR  (done)         GLOBAL preserves preW  (done)  \n---------------------------------------------------------------------*)\n\n\ndatatype PCW =\n  A1 | A2 | A3 | A4 | A5 | A6 | A7 | A8\n| Enqueue | idleW | OOM | FinishedW |  Write | BTS\n\ndatatype PCR =\n Release | idleR | Read\n\ndatatype F = W | R | Q | B | D | None\ndatatype Pointer = Head | Tail\nconsts N :: nat   (*size of buffer, input*)\nconsts n :: nat   (*number of Arr\\<^sub>W entries*)\n\ndefinition \"F1_set={W,B,Q,R}\"\ndefinition \"W_pre_acquire_set={A1,A2,A3,A4,A5,A6,A7,A8,idleW,FinishedW,OOM,BTS}\"\ndefinition \"W_post_acquire_set={Write,Enqueue}\"\ndefinition \"R_pre_dequeue_set={idleR}\"\ndefinition \"R_post_dequeue_set={Read, Release}\"\n\nlemmas sets [simp]= F1_set_def W_pre_acquire_set_def W_post_acquire_set_def\n                              R_pre_dequeue_set_def R_post_dequeue_set_def\n\n(*Recorded variables*)\nrecord rb_state =\n  H :: nat\n  T :: nat\n  hW ::  nat               (*local copy of W*)\n  tW ::  nat               (*local copy of W*)\n  offset :: nat\n  q :: \"(nat \\<times> nat) list\"\n  tempR :: \"(nat \\<times> nat)\"          (*local copy of word by R*)\n\n\n  data_index :: \"(nat \\<times> nat) \\<Rightarrow> nat\"   (*state of the buffer contents*)\n  pcW :: PCW           (*records program counter of W*)\n  pcR :: PCR           (*records program counter of W*)\n  Data:: \"nat  \\<Rightarrow> nat\"     (*returns a word Data_i*)\n\n  tR :: nat\n  numReads :: nat     (* how many words the reader has read *)\n  numWrites :: nat    (* how many words the writer has written *)\n  numEnqs :: nat  (* how many words from Data the writer has enqueued  *)\n  numDeqs :: nat  (* how many words from Data the reader has retrieved *)\n  ownT ::  F\n  ownD :: \"nat \\<Rightarrow> F\" (* ownership of Data indices *)\n  ownB :: \"nat \\<Rightarrow> F\" (* ownership of bytes in buffer *)\n\n  \n\ndefinition \"con_assms s \\<equiv>   0 < N \\<and> 0<n  \\<and> N>n \\<and> numEnqs s\\<le>n \\<and> (numDeqs s\\<le>numEnqs s)\n                             \\<and> (\\<forall>i.(i<n)\\<longrightarrow>Data s i\\<le>N \\<and> Data s i>0 )\"\n\ndefinition push_H :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`H := _\" [200])\n  where \n  \"push_H v \\<equiv> \\<lambda>s. s \\<lparr>H := v\\<rparr>\"\ndefinition push_T :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`T := _\" [200])\n  where \n  \"push_T v \\<equiv> \\<lambda>s. s \\<lparr>T := v\\<rparr>\"\ndefinition write_data_index :: \"nat \\<times> nat \\<Rightarrow> nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`B.write _ := _\" [200])  where\n  \"write_data_index a v  \\<equiv>  \n      \\<lambda>s. s \\<lparr> data_index  := \\<lambda> x. if  a = x  then v else data_index s x \\<rparr>\"  \ndefinition change_writes :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`numWrites := _\" [200])\n  where \n  \"change_writes v \\<equiv> \\<lambda>s. s \\<lparr>numWrites := v\\<rparr>\"\ndefinition change_reads :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`numReads := _\" [200])\n  where \n  \"change_reads v \\<equiv> \\<lambda>s. s \\<lparr>numReads := v\\<rparr>\"\ndefinition push_offset :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`offset := _\" [200])\n  where \n  \"push_offset v \\<equiv> \\<lambda>s. s \\<lparr>offset := v\\<rparr>\"\n\n\ndefinition trans_ownT :: \"F \\<Rightarrow> F \\<Rightarrow> rb_state \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"transownT [_ _ _]\" [200]) where\n  \"trans_ownT a b s \\<equiv> if ownT s = a then (\\<lambda>s. s \\<lparr> ownT := b \\<rparr>)\n                                    else (\\<lambda>s. s \\<lparr> ownT := ownT s\\<rparr>)\"\n\ndefinition transfer_ownB :: \"F \\<Rightarrow> F \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"transownB [_ _]\" [200]) where\n  \"transfer_ownB a b \\<equiv> (\\<lambda>s. s \\<lparr> ownB := \\<lambda> i. if (ownB s i = a)\\<and>i\\<le>N then b else (ownB s) i\\<rparr>)\"\n\ndefinition set_ownB :: \"nat\\<times>nat\\<Rightarrow> F \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"setownB [_ _]\" [200]) where\n  \"set_ownB x a \\<equiv> (\\<lambda>s. s \\<lparr> ownB := \\<lambda> i. if ((i\\<ge>fst(x)) \\<and> (i<snd(x))) then a else (ownB s) i\\<rparr>)\"\n\ndefinition transfer_ownD :: \"nat\\<Rightarrow> F \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"transownD [_ _]\" [200]) where\n  \"transfer_ownD x a \\<equiv> (\\<lambda>s. s \\<lparr> ownD := \\<lambda> i. if i=x then a else (ownD s) i\\<rparr>)\"\n\n\n\n\n(*-----------------------*)\n\ndefinition set_hW :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`hW := _\" [200])  where\n  \"set_hW v  \\<equiv> \\<lambda>s. s \\<lparr> hW  := v\\<rparr>\"\ndefinition set_tW :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`tW := _\" [200])  where\n  \"set_tW v  \\<equiv> \\<lambda>s. s \\<lparr> tW  := v\\<rparr>\"\ndefinition set_tR :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`tR := _\" [200])  where\n  \"set_tR v  \\<equiv> \\<lambda>s. s \\<lparr> tR  := v\\<rparr>\"\ndefinition set_tempR :: \"(nat \\<times> nat) \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`tempR := _\" [200]) where\n  \"set_tempR v \\<equiv> \\<lambda>s. s \\<lparr> tempR := v\\<rparr>\"\ndefinition update_numEnqs :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`numEnqs := _\" [200]) where\n  \"update_numEnqs v\\<equiv> \\<lambda>s. s \\<lparr> numEnqs := v\\<rparr>\"\ndefinition update_numDeqs :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`numDeqs := _\" [200]) where\n  \"update_numDeqs v\\<equiv> \\<lambda>s. s \\<lparr> numDeqs := v\\<rparr>\"\ndefinition update_pcW :: \"PCW \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`pcW := _\" [200]) where\n  \"update_pcW v \\<equiv> \\<lambda>s. s \\<lparr> pcW := v\\<rparr>\"\ndefinition update_pcR :: \"PCR \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`pcR := _\" [200]) where\n  \"update_pcR v \\<equiv> \\<lambda>s. s \\<lparr> pcR := v\\<rparr>\"\nabbreviation update_b_err :: \"rb_state \\<Rightarrow> rb_state\" (\"ERROOM\") where\n  \"update_b_err \\<equiv> \\<lambda>s. s \\<lparr> pcW := OOM \\<rparr>\"\nabbreviation update_bts_err :: \"rb_state \\<Rightarrow> rb_state\" (\"ERRBTS\") where\n  \"update_bts_err \\<equiv> \\<lambda>s. s \\<lparr> pcW := BTS \\<rparr>\"\ndefinition update_q :: \"(nat \\<times> nat) list \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`q := _\" [200])\n  where \n  \"update_q v  \\<equiv> \\<lambda>s. s \\<lparr>q := v\\<rparr>\"\nlemmas functs [simp] = push_H_def push_T_def set_hW_def set_tW_def\n                        update_numEnqs_def update_numDeqs_def\n                        set_tempR_def \n                        update_pcW_def update_pcR_def\n                        transfer_ownB_def transfer_ownD_def trans_ownT_def\n                        update_q_def\n                        push_offset_def write_data_index_def\n                        change_writes_def change_reads_def\n                        set_tR_def set_ownB_def\n\n\n\n\n\n(*  Define the if statement \"guards\"  *)\n\ndefinition \"off bo \\<equiv> fst bo\"\ndefinition \"len bo \\<equiv> snd bo\"\ndefinition \"grd1 s \\<equiv> (tW s = hW s) \\<and> (Data s (numEnqs s) \\<le> N)\"\ndefinition \"grd2 s \\<equiv> (tW s > hW s) \\<and> (Data s (numEnqs s) < (tW s - hW s))\"\ndefinition \"grd3 s \\<equiv> tW s < hW s\"\ndefinition \"grd4 s \\<equiv> Data s (numEnqs s) \\<le> N - hW s\"\ndefinition \"grd5 s \\<equiv> Data s (numEnqs s) < tW s\"\ndefinition \"no_space_for_word s \\<equiv> (grd1 s \\<longrightarrow> \\<not>(Data s (numEnqs s) \\<le> N))\\<and>\n                                  (grd2 s \\<longrightarrow> \\<not>(Data s (numEnqs s) < (tW s - hW s)))\\<and>\n                                  (grd3 s \\<longrightarrow> \\<not>(Data s (numEnqs s) \\<le> N - hW s \\<or> Data s (numEnqs s) < tW s))\"\nlemmas grd_simps [simp] = off_def len_def grd1_def grd2_def grd3_def grd4_def grd5_def no_space_for_word_def \n(***********************************************************************)\n\n\n\n\n\n(*  Initial State  *)\n\ndefinition \"init s \\<equiv> (H s = 0) \\<and> (T s = 0) \\<and> (offset s = 0) \\<and> q s = [] \\<and> (hW s = 0) \\<and> (tW s = 0) \\<and> (tR s = 0)\n                        \\<and> numReads s = 0 \\<and> numWrites s = 0 \\<and> (numEnqs s = 0) \\<and> (numDeqs s = 0)\n                        \\<and> ( pcW s = idleW)\n                        \\<and> ( pcR s = idleR)\n                        \\<and> (\\<forall>l. (l<n) \\<longrightarrow>  ((Data s l > 0)\\<and>(Data s l \\<le> N)))\n                        \\<and> (\\<forall>i. (i<n) \\<longrightarrow>  ownD s i = W)\n                        \\<and> (\\<forall>i. (i<N) \\<longrightarrow>  ownB s i = B)\n                        \\<and> (ownB s N = None)\n                        \\<and> (ownT s = Q)\n                        \\<and> (tempR s = (0,0))\n                        \\<and> (\\<forall>i. (i\\<le>N)\\<longrightarrow>(\\<forall>j.(j\\<le>N)\\<longrightarrow>data_index s (i,j) <n))\"\n(***********************************************************************)\n\n\n\ndefinition \"case_1_pred a b c d s  \\<equiv> 0\\<le>a \\<and> a\\<le>b \\<and> b\\<le>c \\<and> c\\<le>d \\<and> d\\<le>N \n                                        \\<and>(\\<forall>i.(0\\<le>i \\<and> i<a)\\<longrightarrow>ownB s i = B)\n                                        \\<and>(\\<forall>i.(a\\<le>i \\<and> i<b)\\<longrightarrow>ownB s i = R)\n                                        \\<and>(\\<forall>i.(b\\<le>i \\<and> i<c)\\<longrightarrow>ownB s i = Q)\n                                        \\<and>(\\<forall>i.(c\\<le>i \\<and> i<d)\\<longrightarrow>ownB s i = W)\n                                        \\<and>(\\<forall>i.(d\\<le>i \\<and> i<N)\\<longrightarrow>ownB s i = B)\n                                        \\<and>(ownB s N = None)\n                                \\<comment>\\<open>general case rules\\<close>\n                                      \\<comment>\\<open>rules are simple\\<close>\n                                \\<comment>\\<open>describe T using ownB\\<close>\n                                  \\<and>(T s = a)\n                                \\<comment>\\<open>describe H using ownB\\<close>\n                                  \\<and>(H s = d)\n                                \\<comment>\\<open>describe W view (tempW) using ownB\\<close>\n                                  \\<and>(d>c\\<longrightarrow>offset s=c)\n                                  \\<and>(d>c\\<longrightarrow>Data s (numEnqs s)=d-c)\n                                \\<comment>\\<open>describe R view (tempR) using ownB\\<close>\n                                  \\<and>(b>a\\<longrightarrow>fst(tempR s)=a)\n                                  \\<and>(b>a\\<longrightarrow>snd(tempR s)=b-a)\n                                \\<comment>\\<open>describe Q view (hd(Q), last(Q)) using ownB\\<close>\n                                  \\<and>(c>b\\<longleftrightarrow>length(q s)>0)\n                                  \\<and>(c>b\\<longrightarrow>fst(hd(q s)) =b)\n                                  \\<and>(c>b\\<longrightarrow>fst(last(q s))+snd(last(q s)) =c)\n                                \\<comment>\\<open>describe ownT using ownB\\<close>\n                                  \\<and>(ownT s = R\\<longrightarrow>b>a)\n                                  \\<and>((b=a\\<and>c>b)\\<longrightarrow>ownT s = Q)\n                                  \\<and>((b=a\\<and>c=b)\\<longrightarrow>ownT s \\<in> {Q,W})\n                                  \\<and> (ownT s=W\\<longrightarrow>((c=0\\<and>d>0)\\<or>(H s=T s)))\n\"\ndefinition \"case_1 s  \\<equiv> \\<exists>a b c d. case_1_pred a b c d s\"\n\nlemmas case_1_lemmas = case_1_def case_1_pred_def\n\nlemma can_a_equal_d:\n  assumes \"\\<forall>i.(i<N)\\<longrightarrow>ownB s i=B\"\n  and \"ownT s=Q\"\n  and \"H s=k\"\n  and \"T s=k\"\n  and \"k<N\"  \n  and \"q s=[]\"\n  and \"ownB s N=None\"\n  shows \"case_1 s\"\n  using assms apply (simp add:case_1_lemmas)\n  apply (rule_tac exI [where x =\"k\"])\n  apply (rule_tac exI [where x =\"k\"])\n  apply simp\n  apply (rule_tac exI [where x =\"k\"])\n  by simp\n\ndefinition \"case_2_pred a b c d e f s \\<equiv>\n0\\<le>a \\<and> a\\<le>b \\<and> b\\<le>c \\<and> c<d \\<and> d\\<le>e \\<and> e\\<le>f \\<and> f\\<le>N\n                                        \\<and>(\\<forall>i.(0\\<le>i \\<and> i<a)\\<longrightarrow>ownB s i = R)\n                                        \\<and>(\\<forall>i.(a\\<le>i \\<and> i<b)\\<longrightarrow>ownB s i = Q)\n                                        \\<and>(\\<forall>i.(b\\<le>i \\<and> i<c)\\<longrightarrow>ownB s i = W)\n                                        \\<and>(\\<forall>i.(c\\<le>i \\<and> i<d)\\<longrightarrow>ownB s i = B)\n                                        \\<and>(\\<forall>i.(d\\<le>i \\<and> i<e)\\<longrightarrow>ownB s i = R)\n                                        \\<and>(\\<forall>i.(e\\<le>i \\<and> i<f)\\<longrightarrow>ownB s i = Q)\n                                        \\<and>(\\<forall>i.(f\\<le>i \\<and> i<N)\\<longrightarrow>ownB s i = D)\n                                        \\<and>(ownB s N = None)\n                                \\<comment>\\<open>general case rules\\<close>\n                                  \\<and>(a>0\\<longrightarrow>e=d)                  \\<comment>\\<open>only 1 continuous read\\<close>  \n                                  \\<and>(e>d\\<longrightarrow>a=0)                  \\<comment>\\<open>only 1 continuous read\\<close>  \n                                  \\<and>(f>e\\<longrightarrow>a=0)                  \\<comment>\\<open>only 1 continuous queue\\<close> \n                                  \\<and>(c>0)                  \\<comment>\\<open>create the overlap, any way possible\\<close> \n                                \\<comment>\\<open>describe T using ownB\\<close>\n                                  \\<and>(T s = d)\n                                \\<comment>\\<open>describe H using ownB\\<close>\n                                  \\<and>(H s = c)\n                                \\<comment>\\<open>describe W view (tempW) using ownB\\<close>\n                                  \\<and>(c>b\\<longrightarrow>offset s = b)\n                                  \\<and>(c>b\\<longrightarrow>Data s (numEnqs s) = c-b)\n                                \\<comment>\\<open>describe R view (tempR) using ownB\\<close>\n                                  \\<and>(a>0\\<longrightarrow>fst(tempR s)=0) \n                                  \\<and>(a>0\\<longrightarrow>snd(tempR s)=a)  \n                                  \\<and>(e>d\\<longrightarrow>fst(tempR s)=d) \n                                  \\<and>(e>d\\<longrightarrow>snd(tempR s)=e-d)  \n                                \\<comment>\\<open>describe Q view (hd(Q), last(Q)) using ownB\\<close>\n                                  \\<and>((f>e\\<or>b>a)\\<longleftrightarrow>length(q s)>0)\n                                  \\<and>(f>e\\<longrightarrow>fst(hd(q s)) =e)\n                                  \\<and>((f=e\\<and>b>a)\\<longrightarrow>fst(hd(q s)) =a)\n                                  \\<and>(b>a\\<longrightarrow>fst(last(q s))+snd(last(q s)) =b)\n                                  \\<and>((b=a\\<and>f>e)\\<longrightarrow>fst(last(q s))+snd(last(q s)) =f)\n                                \\<comment>\\<open>describe ownT using ownB\\<close>\n                                  \\<and>(ownT s = R\\<longrightarrow>(a>0\\<or>e>d))\n                                  \\<and>((a=0\\<and>e=d)\\<longrightarrow>ownT s = Q)\n                                  \\<and>(ownT s\\<noteq>W)\"\n\ndefinition \"case_2 s  \\<equiv> \\<exists>a b c d e f. case_2_pred a b c d e f s\"\n\nlemmas case_2_lemmas = case_2_def case_2_pred_def\n\n\nlemma case_split:\n  shows \"H s\\<ge>T s\\<Longrightarrow> (case_1 s \\<or> case_2 s) \\<Longrightarrow> case_1 s\"\n  apply (simp add:case_1_lemmas case_2_lemmas) apply clarify\n  by linarith\n\n\nlemma case_split_2:\n  shows \"H s\\<ge>T s\\<Longrightarrow> (case_1 s \\<or> case_2 s) \\<Longrightarrow>\\<not> case_2 s\"\n  by (simp add:case_1_lemmas case_2_lemmas) \n\nlemma case_split_3:\n  shows \"H s<T s\\<Longrightarrow> (case_1 s \\<or> case_2 s) \\<Longrightarrow> case_2 s\"\n  apply (simp add:case_1_lemmas case_2_lemmas) apply clarify\n  by linarith\n\n\nlemma case_split_4:\n  shows \"H s<T s\\<Longrightarrow> (case_1 s \\<or> case_2 s) \\<Longrightarrow>\\<not> case_1 s\"\n  by (simp add:case_1_lemmas case_2_lemmas)\n\n\nlemma case_split_5:\n  shows \"(case_1 s \\<and> case_2 s) \\<Longrightarrow>False\"\n  apply (case_tac \"H s\\<ge>T s\") \n  apply (metis case_split_2)\n  using case_split_4 not_le_imp_less by blast\n\n\n\n\n\n\n\ndefinition  \"end x \\<equiv> fst x + snd x\"\n\nlemmas end_simp [simp] = end_def \n\ndefinition \"Q_boundness qs \\<equiv> \n     \\<forall>x. (x \\<in> set qs) \\<longrightarrow> end x \\<le> N\" \n\n\ndefinition \"Q_offsets_differ qs \\<equiv> \n  \\<forall>i j. i<length qs \\<and> j<length qs \\<and> i\\<noteq>j \\<longrightarrow> fst(qs !i) \\<noteq> fst(qs!j) \"\n\ndefinition \"Q_gap_structure qs   \\<equiv> \n          (\\<forall>i. (i < length qs \\<and> i > 0) \\<longrightarrow>((end( qs!(i-1)) = fst( qs !i))\\<or> (fst( qs !i) =0)))\"\n\ndefinition \"Q_has_no_uroboros  qs \\<equiv>\n(\\<forall>x. x \\<in> set ( qs)\\<longrightarrow> fst x \\<noteq> end (last ( qs)))\"\n\n(*I would call this Q elements ordered *)\ndefinition \"Q_has_no_overlaps qs \\<equiv>\n(\\<forall> x y. (x \\<in> set qs \\<and> y \\<in> set qs) \\<longrightarrow> (fst(x) < fst(y) \\<longrightarrow> end x \\<le> fst y))\"\n(*Q has no overlaps looks like this this *)\ndefinition \"pairtoset x \\<equiv>\n{k | k. fst x \\<le> k \\<and> k < end x}\"\n\ndefinition \"Q_has_no_overlaps_2 qs \\<equiv>\n(\\<forall> x y. x \\<in> set qs \\<and> y \\<in> set qs \\<and> x \\<noteq> y \\<longrightarrow> pairtoset x \\<inter> pairtoset y = {})\"\n\n\n\n\ndefinition \"Q_elem_size qs       \\<equiv> \\<forall>x.(x\\<in>set(qs))\\<longrightarrow>snd(x)>0\"\n\ndefinition \"Q_basic_struct qs \\<equiv> Q_boundness qs \\<and> Q_gap_structure qs \\<and> Q_offsets_differ qs\n                              \\<and> Q_has_no_overlaps qs \\<and> Q_has_no_uroboros qs \\<and> Q_elem_size qs\"\n\n\nlemmas Q_basic_lemmas = Q_basic_struct_def  Q_has_no_overlaps_def \n                        Q_gap_structure_def Q_has_no_uroboros_def\n                        Q_boundness_def     Q_offsets_differ_def\n                        Q_elem_size_def\n\nlemma Q_boundness_list:\n\"Q_boundness qs \\<Longrightarrow> \\<forall>i.(i<length qs) \\<longrightarrow> end(qs !i)\\<le>N\"\n  by (simp add: Q_boundness_def)\n\nlemma proof_no_overlaps2:\n\"Q_offsets_differ qs \\<Longrightarrow> x\\<in>set qs \\<Longrightarrow> y\\<in>set qs \\<Longrightarrow> x \\<noteq> y \\<Longrightarrow> fst(x)\\<noteq>fst(y)\"\n  using  Q_offsets_differ_def \n  by (metis in_set_conv_nth)\n\nlemma proof_no_overlaps:\n  assumes \"Q_gap_structure (q s)\"\n  and \"Q_offsets_differ (q s)\"\n  and \"Q_has_no_overlaps (q s)\"\nshows \"\\<forall>x y.(x\\<in>set(q s)\\<and>y\\<in>set(q s)\\<and>fst(x)\\<noteq>fst(y))\\<longrightarrow>\n  (\\<forall>j.(fst(x)\\<le>j \\<and> j<end(x))\\<longrightarrow>(j<fst(y)\\<or>j\\<ge>end(y)))\"\n  using assms apply (simp add:Q_basic_lemmas) \n  apply safe \n  by (smt (verit, best) bot_nat_0.not_eq_extremum diff_is_0_eq le_trans linorder_neqE_nat zero_less_diff)\n\n\nlemma tail_preserves_Q_boundness:\n  assumes \"Q_boundness qs\"\nshows \"Q_boundness (tl qs)\"\n  using assms  apply (simp add:Q_boundness_def)\n  by (metis Nil_tl list.set_sel(2))\n\nlemma tail_preserves_Q_offsets_differ:\n  assumes \"Q_offsets_differ qs\"\nshows \"Q_offsets_differ (tl qs)\"\n  using assms  apply (simp add:Q_offsets_differ_def) \n  by (simp add: less_diff_conv nth_tl)\n\nlemma tail_preserves_Q_gap_structure:\n  assumes \"Q_gap_structure qs\"\nshows \"Q_gap_structure (tl qs)\"\n  using assms  apply (simp add:Q_gap_structure_def) \n  by (smt (verit) One_nat_def Suc_pred add_diff_cancel_left' length_tl less_Suc_eq less_diff_conv not_less_eq nth_tl plus_1_eq_Suc)\n\nlemma tail_preserves_Q_has_no_uroboros:\n  assumes \"Q_has_no_uroboros qs\"\nshows \"Q_has_no_uroboros (tl qs)\"\n  using assms  apply (simp add:Q_has_no_uroboros_def) \n  by (metis last_tl length_pos_if_in_set less_nat_zero_code list.sel(2) list.set_sel(2) list.size(3))\n\nlemma tail_preserves_Q_has_no_overlaps:\n  assumes \"Q_has_no_overlaps qs\"\nshows \"Q_has_no_overlaps (tl qs)\"\n  using assms  apply (simp add:Q_has_no_overlaps_def) \n  by (metis list.sel(2) list.set_sel(2))\n\nlemma tail_preserves_Q_elem_size_2:\n  assumes \"Q_elem_size qs\"\nshows \"Q_elem_size (tl qs)\"\n  using assms  using Q_elem_size_def \n  by (metis list.sel(2) list.set_sel(2))\n\nlemma tail_preserves_Q_basic_struct:\n  assumes \"Q_basic_struct qs\"\nshows \"Q_basic_struct (tl qs)\"\n  using assms  apply (simp add:Q_basic_struct_def)\n  by (simp add: tail_preserves_Q_boundness tail_preserves_Q_elem_size_2 tail_preserves_Q_gap_structure tail_preserves_Q_has_no_overlaps tail_preserves_Q_has_no_uroboros tail_preserves_Q_offsets_differ)\n  \n\n\n\n\n\ndefinition \"tempR_bounded tr     \\<equiv> end tr\\<le>N\"\ndefinition \"Q_no_overlap_tempR qs tr\\<equiv> (\\<forall>x. (x \\<in> set qs)\\<longrightarrow>\n                  ((fst tr <fst(x)\\<and>end tr\\<le> fst(x))\n                  \\<or>(fst(x)<fst tr\\<and>end(x)<fst tr)))\"\ndefinition \"Q_relates_tempR qs tr   \\<equiv> (end tr = fst(hd qs)) \\<or> (fst(hd qs) = 0)\"\nlemmas tmepR_extra_lemmas [simp] = tempR_bounded_def Q_no_overlap_tempR_def Q_relates_tempR_def\n\n\n\n\n\n\ndefinition \"Q_holds_bytes s     \\<equiv> (\\<forall>x.(x\\<in>set(q s))\\<longrightarrow>(\\<forall>j.(fst(x)\\<le>j \\<and> j<end(x))\\<longrightarrow>ownB s j=Q))\"\ndefinition \"Q_reflects_writes s \\<equiv> (\\<forall>i.(i<length(q s))\\<longrightarrow>data_index s (q s!i) = ((numDeqs s) +i))\"\n\ndefinition \"Q_elem_rel s        \\<equiv> (\\<forall>i.(i<length(q s))\\<longrightarrow>snd(q s!i) =Data s ((numDeqs s) +i))\"\n\ndefinition \"Q_reflects_ownD s   \\<equiv> (\\<forall>i.(i<length(q s))\\<longrightarrow>ownD s (i+(numDeqs s)) =B)\"\n\n\nlemma Q_holds_bytes_index: \n\"Q_holds_bytes s \\<Longrightarrow> i<length(q s) \\<Longrightarrow>fst(q s!i)\\<le>j \\<Longrightarrow> j<end(q s!i) \\<Longrightarrow>ownB s j=Q\"\n  using Q_holds_bytes_def nth_mem by blast\n\n\n\nlemma tail_preserves_Q_holds_bytes:\n  assumes \"Q_holds_bytes s\"\n  and \"x\\<in>set(tl(q s))\"\n  and \"fst(x)\\<le>j\" \"j<end(x)\"\nshows \"ownB s j=Q\"\n  using assms  apply (simp add:Q_holds_bytes_def) \n  apply(case_tac \"tl(q s)\\<noteq>[]\") prefer 2\n  apply force\n  by (metis list.sel(2) list.set_sel(2) prod.collapse)\n\nlemma tail_preserves_Q_reflects_writes:\n  assumes \"Q_reflects_writes s\"\n  and \"i<length(tl(q s))\"\nshows \"data_index s ((tl(q s))!i) = ((numDeqs s) +i +1)\"\n  using assms  apply (simp add:Q_reflects_writes_def)\n  by (simp add: nth_tl)\n\nlemma tail_preserves_Q_elem_size:\n  assumes \"Q_elem_rel s\"\n  and \"i<length(tl(q s))\"\nshows \"snd(tl(q s)!i) =Data s ((numDeqs s) +i +1)\"\n  using assms  apply (simp add:Q_elem_size_def)\n  by (simp add: Q_elem_rel_def nth_tl)\n\nlemma tail_preserves_Q_reflects_ownD:\n  assumes \"Q_reflects_ownD s\"\n  and \"i<length(tl(q s))\"\nshows \"ownD s (i+(numDeqs s) +1) =B\"\n  using assms  apply (simp add:Q_reflects_ownD_def) \n  by (metis One_nat_def Suc_eq_plus1 add.assoc less_diff_conv plus_1_eq_Suc)\n\nlemma Q_head_relates_tail:\n  assumes \"Q_offsets_differ qs\"\n  and \"i<length(tl qs)\"\n  shows \"fst(qs!0)\\<noteq> fst((tl qs)!i)\"\n  using assms apply (simp add:Q_offsets_differ_def)\n  by (metis One_nat_def Suc_pred length_tl less_Suc_eq_0_disj not_less_eq nth_tl zero_less_diff)\n  \nlemma Q_hd_zero_implies_structure:\n  assumes \"Q_offsets_differ qs \"\n  and \"Q_gap_structure qs\"\n  and \"fst(hd qs) =0\"\n  and \"i<length(qs)\" \"i>0\"\nshows \"end(qs!(i-1)) =fst(qs!i)\"\n  using assms apply(simp add:Q_basic_lemmas) \n  by (metis drop0 hd_drop_conv_nth less_Suc_eq_0_disj less_imp_Suc_add not_gr_zero)\n\nlemma data_index_preserved_lemma:\n  assumes \"Q_reflects_writes s\"\n  and \"length(q s)>0\"\n  shows \"data_index s(q s!0) = numDeqs s\"\n  using assms by (simp add:Q_reflects_writes_def)\n\ndefinition \"Q_structure s \\<equiv> Q_basic_struct (q s) \\<and> \n                                      \\<comment> \\<open>Q_holds_bytes s \\<and>\\<close>\n                                      Q_reflects_writes s \\<and> \n                                      Q_elem_rel s \\<and> \n                                      Q_reflects_ownD s\"\n\nlemma Q_structure_nempty:\n  \"q s=[] \\<Longrightarrow> Q_structure s\"\n  by (simp add: Q_basic_struct_def Q_boundness_def Q_elem_rel_def Q_elem_size_def Q_gap_structure_def Q_has_no_overlaps_def Q_has_no_uroboros_def Q_offsets_differ_def Q_reflects_ownD_def Q_reflects_writes_def Q_structure_def)\n\n\n\nlemmas Q_lemmas = Q_holds_bytes_def Q_reflects_writes_def Q_reflects_ownD_def\n                  Q_structure_def Q_relates_tempR_def Q_elem_rel_def\n                  Q_elem_size_def Q_no_overlap_tempR_def\n\n\n\nlemma head_q0:\n  assumes \"length qs>0\"\n  shows \"hd qs = (qs!0)\"\n  using assms apply (simp add:Q_reflects_writes_def)\n  by (simp add: hd_conv_nth)\n\n\n\nlemma Q_gap_lemmas_4:\n  assumes \"Q_structure s\"\n  and \"x\\<in>set(q s)\" \"y\\<in>set(q s)\" \"fst(y)>fst(x)\"\n  shows \"end(y)>fst(x)\"\n  using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n\n\nlemma Q_gap_lemmas_15:\n  assumes \"Q_structure s\" \n  and \"x\\<in>set(q s)\" \"y\\<in>set(q s)\" \"end(y)>end(x)\"\n  shows \"fst(y)\\<noteq>fst(x)\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis fst_conv in_set_conv_nth nat_neq_iff old.prod.inject)\n\nlemma Q_gap_lemmas_14:\n  assumes \"Q_structure s\"\n  and \"x\\<in>set(q s)\" \"y\\<in>set(q s)\" \"end(y)>end(x)\" \nshows \"fst(y)\\<ge>end(x)\"\nproof - \n  from assms Q_gap_lemmas_15 have c1: \"fst(y)\\<noteq>fst(x)\"\n    by blast\n  from this assms show ?thesis apply simp \n    apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n    by (metis (mono_tags, lifting) leD not_less_iff_gr_or_eq prod.collapse trans_le_add1)\nqed\n\n\n\n\n\n\n\n\n\n\nlemma Q_gap_lemmas_1_list:\n  assumes \"Q_structure s\"\n  and \"i<length(q s)\" \"j<length(q s)\" \"i\\<noteq>j\"\nshows \"fst(q s!i) \\<noteq> fst(q s!j)\"\n  using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n\nlemma Q_gap_lemmas_2:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>i.(i<length(q s))\\<longrightarrow>(q s!i)\\<in>set(q s)\"\n  using assms by (simp add:con_assms_def)\n\n\nlemma Q_gap_lemmas_2_list:\n  assumes \"Q_structure s\"\n  and \"i<length(q s)\" \"j<length(q s)\" \"fst(q s!i)>fst(q s!j)\"\nshows \"end(q s!i)>fst(q s!j)\"\n  using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n\n\n\nlemma Q_gap_lemmas_4_list:\n  assumes \"Q_structure s\"\n  and \"i<length(q s)\" \"j<length(q s)\" \"fst(q s!i)>fst(q s!j)\"\nshows \"fst(q s!i)\\<ge>end(q s!j)\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis nth_mem prod.collapse)\n\n\n\n\n(*tempR used to be part of Q so:.....*)\n\n definition \"tempR_boundness tr \\<equiv> (end (tr) \\<le> N)\" \n\ndefinition \"tempR_offsets_differ qs tr \\<equiv> (\\<forall>i.(i<length(qs))\\<longrightarrow>(fst(qs!i)\\<noteq>fst(tr)))\"\n\ndefinition \"tempR_gap_structure qs tr  \\<equiv> (end(tr) = fst(hd(qs)))\\<or> (fst(hd(qs)) =0)\"\n\ndefinition \"tempR_has_no_uroboros qs tr \\<equiv> (fst (tr) \\<noteq> end (last (qs)))\"\n\ndefinition \"tempR_has_no_overlaps qs tr \\<equiv>(\\<forall>i.(i<length(qs))\\<longrightarrow>((fst(tr)<fst(qs!i)\\<longrightarrow>end(tr)\\<le>fst(qs!i))\n                                                           \\<and>(fst(tr)>fst(qs!i)\\<longrightarrow>end(qs!i)\\<le>fst(tr))))\"\n\ndefinition \"tempR_basic_struct qs tr \\<equiv> tempR_boundness tr \\<and> (qs\\<noteq>[]\\<longrightarrow> (tempR_gap_structure qs tr \\<and> tempR_offsets_differ qs tr\n                              \\<and> tempR_has_no_overlaps qs tr \\<and> tempR_has_no_uroboros qs tr)) \"\n\n\nlemmas tempR_basic_lemmas = tempR_basic_struct_def  tempR_has_no_overlaps_def \n                            tempR_gap_structure_def tempR_has_no_uroboros_def\n                            tempR_boundness_def     tempR_offsets_differ_def\n\n\ndefinition \"tempR_holds_bytes s     \\<equiv> (\\<forall>j.(fst(tempR s)\\<le>j \\<and> j<end(tempR s))\\<longrightarrow>ownB s j=R)\"\n\ndefinition \"tempR_reflects_writes s \\<equiv> (data_index s (tempR s) = ((numDeqs s) -1))\"\n\ndefinition \"tempR_elem_size s       \\<equiv> (snd(tempR s) =Data s ((numDeqs s) -1))\"\n\n\ndefinition \"tempR_structure s \\<equiv>(tempR_basic_struct (q s) (tempR s) \\<and> \n                                      tempR_holds_bytes s \\<and> tempR_reflects_writes s \\<and> tempR_elem_size s)\"\n\n\nlemmas tempR_lemmas = tempR_holds_bytes_def tempR_reflects_writes_def \n                      tempR_elem_size_def   tempR_structure_def\n                      \n\n\n(*tempW will be part of Q so:.....*)\ndefinition \"tempW s \\<equiv> (offset s, Data s (numEnqs s))\"\n\n definition \"tempW_boundness tw \\<equiv> (end ( tw) \\<le> N)\" \n\ndefinition \"tempW_offsets_differ qs tw \\<equiv> (\\<forall>i.(i<length(qs))\\<longrightarrow>(fst(qs!i)\\<noteq>fst(tw)))\"\n\ndefinition \"tempW_gap_structure qs tw  \\<equiv> (fst(tw) = end(last(qs)))\\<or> (fst(tw) =0)\"\n\ndefinition \"tempW_has_no_uroboros qs tw \\<equiv> (end((tw)) \\<noteq> fst (hd (qs)))\"\n\ndefinition \"tempW_has_no_overlaps qs tw \\<equiv>(\\<forall>i.(i<length(qs))\\<longrightarrow>((fst(tw)<fst(qs!i)\\<longrightarrow>end(tw)<fst(qs!i))\n                                                           \\<and>(fst(tw)>fst(qs!i)\\<longrightarrow>end(qs!i)\\<le>fst(tw))))\"\n\ndefinition \"tempW_basic_struct qs tw \\<equiv> tempW_boundness tw \\<and> (qs\\<noteq>[]\\<longrightarrow> (tempW_gap_structure qs tw \\<and> tempW_offsets_differ qs tw\n                              \\<and> tempW_has_no_overlaps qs tw \\<and> tempW_has_no_uroboros qs tw))\"\n\n\nlemmas tempW_basic_lemmas = tempW_basic_struct_def  tempW_has_no_overlaps_def \n                            tempW_gap_structure_def tempW_has_no_uroboros_def\n                            tempW_boundness_def     tempW_offsets_differ_def\n                            tempW_def\n\n\ndefinition \"tempW_holds_bytes s     \\<equiv> (\\<forall>j.(fst(tempW s)\\<le>j \\<and> j<end(tempW s))\\<longrightarrow>ownB s j=W)\"\n\ndefinition \"tempW_reflects_writes s \\<equiv> (data_index s (offset s, Data s (numEnqs s)) = numEnqs s)\"\n\ndefinition \"tempW_structure s \\<equiv>(tempW_basic_struct (q s) (tempW s) \\<and> \n                                      tempW_holds_bytes s )\"\n\n\nlemmas tempW_lemmas = tempW_holds_bytes_def tempW_reflects_writes_def \n                      tempW_structure_def\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*Writer Thread Behaviour*)\n\ndefinition \"B_acquire s s' \\<equiv> s' = (`pcW := A1) s\"\n\ndefinition \"trans_A3 s = ((`T := 0) \\<circ> (`H := (Data s (numEnqs s))) \n                        \\<circ> (`offset := 0) \\<circ> (`pcW := Write) \n                        \\<circ> setownB [(0,(Data s (numEnqs s))) W]) s\"\n\ndefinition \"trans_A4 s = ((`H := ((hW s) + (Data s (numEnqs s)))) \\<circ> (`offset := (hW s)) \\<circ> (`pcW := Write)\n                        \\<circ> setownB [(hW s,hW s+Data s (numEnqs s)) W]) s\"\n\ndefinition \"trans_A6 s = ((`H := ((hW s) + (Data s (numEnqs s)))) \\<circ> (`offset := (hW s)) \\<circ> (`pcW := Write)\n                        \\<circ> setownB [(hW s,hW s+Data s (numEnqs s)) W]) s\"\n\ndefinition \"trans_A7 s = ((`H := (Data s (numEnqs s))) \\<circ> (`offset := 0) \n                        \\<circ> (`pcW := Write) \\<circ> (setownB [(hW s,N) D])\n                        \\<circ> (setownB [(0,Data s (numEnqs s)) W])) s\"\n\nfun rbW_step :: \"PCW \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" where\n  \"rbW_step A1 s = ((`hW := (H s)) \\<circ> (`tW := (T s)) \\<circ> (`pcW := A2)) s \"\n| \"rbW_step A2 s = (if grd1 s then ((`pcW := A3) \\<circ> (transownT [Q W s]))\n                     else if grd2 s then (`pcW := A4) \n                     else if grd3 s then (`pcW := A5) \n                     else (`pcW :=A8)) s\"\n| \"rbW_step A3 s = trans_A3 s\" \n| \"rbW_step A4 s = trans_A4 s\"\n| \"rbW_step A5 s = (if grd4 s then (`pcW := A6)  \n                     else if grd5 s then (`pcW := A7)\n                     else (`pcW := A8)) s\"\n| \"rbW_step A6 s = trans_A6 s\"\n| \"rbW_step A7 s = trans_A7 s\"\n| \"rbW_step A8 s = (if ((Data s (numEnqs s))>N) then ERRBTS s\n                        else (ERROOM \\<circ> (`tW := (T s))) s)\"\n\n| \"rbW_step Write s = s\"\n| \"rbW_step Enqueue s = s\"| \"rbW_step idleW s = s\" | \"rbW_step FinishedW s = s\"| \"rbW_step BTS s = s\"| \"rbW_step OOM s = s\"\n\n\n\ndefinition \"Q_enqueue s s' \\<equiv> s' = (`q:=(append (q s) [(offset s,Data s (numEnqs s))])\n                     \\<circ> `pcW := idleW\n                     \\<circ>  transownB [W Q]\n                     \\<circ> `numEnqs := (numEnqs s + 1)\n                     \\<circ>  transownT [W Q s]) s\"\n\ndefinition \"B_write s s' \\<equiv> s' = ((`B.write ((offset s), (Data s (numEnqs s))):= (numEnqs s))\n                     \\<circ> (transownD [(numWrites s) B]) \n                     \\<circ> `pcW := Enqueue \n                     \\<circ> (`numWrites := ((numWrites s )+1))) s\"\n\ndefinition cW_step :: \"PCW \\<Rightarrow> rb_state \\<Rightarrow> rb_state \\<Rightarrow> bool\" where\n \"cW_step pcw s s' \\<equiv> \n    case pcw of\n        idleW     \\<Rightarrow>  if ((numEnqs s) < n) then B_acquire s s'\n                          else s' = (`pcW := FinishedW ) s\n      | Write     \\<Rightarrow>  B_write s s'   \n      | Enqueue   \\<Rightarrow>  Q_enqueue s s'\n      | OOM       \\<Rightarrow>  if tW s \\<noteq> T s then s' = (`pcW := idleW ) s else s = s'\n      | FinishedW \\<Rightarrow>  s = s'\n      | BTS       \\<Rightarrow>  s = s'\n      | _         \\<Rightarrow>  s' = rbW_step pcw s \"\n\n\nlemmas W_functs [simp] = B_acquire_def B_write_def Q_enqueue_def\n(*---------Tailored assertions to Writer-------*)\ndefinition \"pre_acquire_inv s   \\<equiv> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq> W)\n                                \\<and> (T s=H s \\<longrightarrow> (\\<forall>i.(i\\<ge>0 \\<and> i<N)\\<longrightarrow>ownB s i=B) \\<and> ownT s = Q \\<and> q s= [] \\<and> numDeqs s = numEnqs s)\n                                \\<and> (T s>H s \\<longrightarrow> (\\<forall>i.(i\\<ge>H s \\<and> i<T s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (T s<H s \\<longrightarrow> (\\<forall>i.((i\\<ge>H s \\<and> i<N) \\<or> i<T s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[]) \n                                \\<and> (numEnqs s\\<le>n)\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n\"\ndefinition \"pre_A1_inv s        \\<equiv> (T s=H s\\<longrightarrow>((\\<forall>i.(i\\<ge>0 \\<and> i<N)\\<longrightarrow>ownB s i=B) \\<and> ownT s =Q \\<and> q s=[]))\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (T s>H s \\<longrightarrow> (\\<forall>i.(i\\<ge>H s \\<and> i<T s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (T s<H s \\<longrightarrow> (\\<forall>i.((i\\<ge>H s \\<and> i<N) \\<or> i<T s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A2_inv s        \\<equiv> (tW s=hW s\\<longrightarrow>((\\<forall>i.(i\\<ge>0 \\<and> i<N)\\<longrightarrow>ownB s i=B) \\<and> ownT s =Q \\<and> q s=[] \\<and> tW s=T s))\n                                \\<and> (tW s>hW s \\<longrightarrow> ((\\<forall>i.(i\\<ge>hW s \\<and> i<tW s)\\<longrightarrow>ownB s i=B) \\<and> (T s\\<ge>tW s \\<or> T s\\<le>H s)))\n                                \\<and> (tW s<hW s \\<longrightarrow> ((\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B) \\<and> T s\\<ge>tW s \\<and> H s\\<ge>T s))\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A3_inv s        \\<equiv> ((\\<forall>i.(i\\<ge>0 \\<and> i<N)\\<longrightarrow>ownB s i=B))\n                                \\<and> (grd1 s)\n                                \\<and> (ownT s =W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s) \\<and> q s=[]\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s=tW s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A4_inv s        \\<equiv> (\\<forall>i.(i\\<ge>hW s \\<and> i<tW s)\\<longrightarrow>ownB s i=B)\n                                \\<and> (grd2 s) \\<and> (\\<not>grd1 s)\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s) \n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s\\<ge>tW s \\<or> T s\\<le>H s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A5_inv s        \\<equiv> (\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B)\n                                \\<and> (grd3 s) \\<and> (\\<not>grd1 s) \\<and> (\\<not>grd2 s)\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s\\<ge>tW s \\<and> T s\\<le>H s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A6_inv s        \\<equiv> (\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B)\n                                \\<and> (grd4 s) \\<and> (grd3 s) \\<and> (\\<not>grd1 s) \\<and> (\\<not>grd2 s)\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s) \n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s\\<ge>tW s \\<and> T s\\<le>H s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A7_inv s        \\<equiv> (\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B)\n                                \\<and> (grd5 s) \\<and> (grd3 s) \\<and> (\\<not>grd1 s) \\<and> (\\<not>grd2 s) \\<and> (\\<not>grd4 s)\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s) \n                                \\<and> (numEnqs s<n) \n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s\\<ge>tW s \\<and> T s\\<le>H s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A8_inv s        \\<equiv> (tW s\\<le>hW s \\<longrightarrow>(\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (tW s>hW s \\<longrightarrow>(\\<forall>i.(hW s \\<le>i \\<and> i<tW s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (no_space_for_word s) \n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s\\<ge>tW s \\<or> T s\\<le>H s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \"\ndefinition \"pre_write_inv s     \\<equiv> (\\<forall>i.(i\\<ge>offset s \\<and> i< ((offset s)+(Data s (numEnqs s))))\\<longrightarrow>ownB s i=W)\n                                \\<and> ((tW s>hW s)\\<longrightarrow>(\\<forall>i.(i\\<ge>((offset s)+(Data s (numEnqs s)))\\<and>i<tW s)\\<longrightarrow>ownB s i =B))\n                                \\<and> ((tW s<hW s \\<and> offset s\\<noteq>0)\\<longrightarrow>(\\<forall>i.((i\\<ge>((offset s)+(Data s (numEnqs s))) \\<and> i<N)\\<or>i<tW s)\\<longrightarrow>ownB s i =B))\n                                \\<and> ((tW s<hW s \\<and> offset s=0)\\<longrightarrow>((\\<forall>i.(i\\<ge>((offset s)+(Data s (numEnqs s))) \\<and> i<tW s)\\<longrightarrow>ownB s i =B) \\<and> (\\<forall>i.(i\\<ge>hW s \\<and> i<N)\\<longrightarrow>ownB s i=D)))\n                                \\<and> (tW s=hW s\\<longrightarrow>(ownT s=W \\<and> q s=[]))\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (tempW_structure s)\n                                \\<and> (ownD s(numWrites s) =W)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[]) \n                                \\<and> (offset s=hW s \\<or> offset s=0)\n                                \\<and> (H s=offset s + Data s (numEnqs s))\n                                \" \ndefinition \"pre_enqueue_inv s   \\<equiv> (\\<forall>i.(i\\<ge>offset s \\<and> i< end(tempW s))\\<longrightarrow>ownB s i=W)\n                                \\<and> (\\<forall>i.(i<offset s \\<or> (i\\<ge> end(tempW s)\\<and>i\\<le>N))\\<longrightarrow>ownB s i\\<noteq>W)\n                                \\<and> ((tW s>hW s)\\<longrightarrow>(\\<forall>i.(i\\<ge>end(tempW s)\\<and>i<tW s)\\<longrightarrow>ownB s i =B))\n                                \\<and> ((tW s<hW s \\<and> offset s\\<noteq>0)\\<longrightarrow>(\\<forall>i.((i\\<ge>end(tempW s) \\<and> i<N)\\<or>i<tW s)\\<longrightarrow>ownB s i =B))\n                                \\<and> ((tW s<hW s \\<and> offset s=0)\\<longrightarrow>((\\<forall>i.(i\\<ge>end(tempW s) \\<and> i<tW s)\\<longrightarrow>ownB s i =B) \\<and> (\\<forall>i.(i\\<ge>hW s \\<and> i<N)\\<longrightarrow>ownB s i=D)))\n                                \\<and> (tW s=hW s\\<longrightarrow>(ownT s=W \\<and> q s=[]))\n                                \\<and> (numWrites s=numEnqs s +1)\n                                \\<and> (numEnqs s<n)\n                                \\<and> ((ownT s = W)\\<longrightarrow>q s=[])\n                                \\<and> (tempW_structure s)\n                                \\<and> (tempW_reflects_writes s)\n                                \\<and> (ownD s(numEnqs s) =B)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[]) \n                                \\<and> (offset s=hW s \\<or> offset s=0)\n                                \\<and> (H s=offset s + Data s (numEnqs s))\n                                \" \ndefinition \"pre_OOM_inv s       \\<equiv> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (tW s>hW s \\<longrightarrow> (\\<forall>i.(i\\<ge>tW s \\<and> i<hW s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (tW s<hW s \\<longrightarrow> (\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (numWrites s=numEnqs s) \n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[]) \n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_finished_inv s  \\<equiv> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s=n)\n                                \\<and> (H s>0)\n                                \" \ndefinition \"pre_BTS_inv s       \\<equiv> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[]) \n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \n\nlemmas writer_lemmas  = pre_A1_inv_def pre_A2_inv_def pre_A3_inv_def pre_A4_inv_def\n                              pre_A5_inv_def pre_A6_inv_def pre_A7_inv_def pre_A8_inv_def\n                              pre_BTS_inv_def pre_OOM_inv_def pre_acquire_inv_def\n                              pre_finished_inv_def pre_enqueue_inv_def pre_write_inv_def\n(***********************************************************************)\n\n\n(*Reader Thread Behaviour*)\n\ndefinition \"B_release s s' \\<equiv> s' = (`T := (end(tempR s)) \n                        \\<circ> (`pcR := idleR) \n                        \\<circ> (`tempR := (0,0))\n                        \\<circ> (transownB [R B]) \n                        \\<circ> (if tR s\\<noteq> fst(tempR s) then setownB [(tR s,N) B] else id) \n                        \\<circ> transownT [R Q s]) s\"\n\ndefinition \"B_read s s' \\<equiv> s' = (((transownD [(data_index s (tempR s)) R]) \n                        \\<circ> (`pcR := Release)) \n                        \\<circ> (`numReads := (numReads s+1))  \n                        \\<circ> (`tR := (T s))) s\"\n\ndefinition \"Q_dequeue s s' \\<equiv>  s' = ((`q:= (tl(q s)))\n                                          \\<circ> (`pcR := Read)\n                                          \\<circ> (`tempR := (hd(q s)))\n                                          \\<circ> (transownT [Q R s])\n                                          \\<circ> (`numDeqs :=(numDeqs s+1))\n                                          \\<circ> (setownB [(off(hd(q s)),(end(hd(q s)))) R])) s\"\n\ndefinition cR_step :: \"PCR \\<Rightarrow> rb_state \\<Rightarrow> rb_state \\<Rightarrow> bool\" where\n \"cR_step pcr s s' \\<equiv> \n    case pcr of\n        idleR \\<Rightarrow> if (q s=[]) then (s=s') else (Q_dequeue s s')\n      | Read \\<Rightarrow>  B_read s s' \n      | Release \\<Rightarrow>  B_release s s'\"\n\n\nlemmas R_functs [simp] = B_release_def B_read_def Q_dequeue_def\n(*---------Tailored assertions to Reader-------*)\ndefinition \"pre_dequeue_inv s \\<equiv>  (tempR s = (0,0))\n                              \\<and> (numDeqs s \\<le> n)\n                              \\<and> (numDeqs s \\<ge> 0)\n                              \\<and> (numDeqs s = numReads s)\n                              \\<and> (numDeqs s \\<le> numEnqs s)\n                              \\<and> (pcR s = idleR)\n                              \\<and> (q s\\<noteq>[] \\<longrightarrow> ownT s=Q)\n                              \\<and> (q s\\<noteq>[] \\<longrightarrow> H s>0)\n                              \\<and> ((T s\\<noteq>fst(hd(q s))\\<and>q s\\<noteq>[])\\<longrightarrow>(\\<forall>x j.(x\\<in>set(q s) \\<and> j<N \\<and> j\\<ge>T s)\\<longrightarrow>end(x)<j))\n                              \\<and> (q s\\<noteq>[]\\<longrightarrow>(\\<forall>i.(fst(hd(q s))\\<le>i \\<and> i<end(hd(q s)))\\<longrightarrow>ownB s i = Q))\n                              \\<and> (\\<forall>i.(i<fst(tempR s) \\<or> (i\\<ge>end(tempR s)\\<and> i\\<le>N))\\<longrightarrow>ownB s i \\<noteq> R)\n\"\ndefinition \"pre_Read_inv s    \\<equiv>  (snd(tempR s) = Data s (numReads s))\n                              \\<and> (numReads s=data_index s (tempR s))\n                              \\<and> (numDeqs s\\<le>n) \n                              \\<and> (numDeqs s\\<ge>0) \n                              \\<and> (numReads s+1=numDeqs s)\n                              \\<and> (numDeqs s\\<ge>1)\n                              \\<and> (numEnqs s\\<ge>numDeqs s) \n                              \\<and> (pcR s=Read)\n                              \\<and> (ownT s = R)\n                              \\<and> (ownD s (numReads s) = B)\n                              \\<and> (tempR s\\<noteq>(0,0))\n                              \\<and> (tempR_structure s)\n                              \\<and> (\\<forall>i.(fst(tempR s)\\<le>i \\<and> i<end(tempR s))\\<longrightarrow>ownB s i = R)\n                              \\<and> (\\<forall>i.(i<fst(tempR s) \\<or> (i\\<ge>end(tempR s)\\<and> i\\<le>N))\\<longrightarrow>ownB s i \\<noteq> R)\n                              \\<and> (H s>0)\n\"\ndefinition \"pre_Release_inv s \\<equiv> (snd(tempR s) = Data s (numReads s -1))\n                              \\<and> (data_index s (tempR s) = numReads s -1)\n                              \\<and> (q s\\<noteq>[]\\<longrightarrow>(numReads s=data_index s (hd(q s))))\n                              \\<and> (ownT s = R)\n                              \\<and> (numEnqs s\\<ge>numDeqs s)\n                              \\<and> (ownD s (numReads s -1) = R)\n                              \\<and> (numDeqs s\\<le>n \\<and> numDeqs s\\<ge>1)\n                              \\<and> (numDeqs s = numReads s)\n                              \\<and> (pcR s=Release)\n                              \\<and> (tR s=T s)\n                              \\<and> (tempR s\\<noteq>(0,0))\n                              \\<and> (tempR_structure s)\n                              \\<and> (\\<forall>i.(fst(tempR s)\\<le>i \\<and> i<end(tempR s))\\<longrightarrow>ownB s i = R)\n                              \\<and> (\\<forall>i.(i<fst(tempR s) \\<or> (i\\<ge>end(tempR s)\\<and> i\\<le>N))\\<longrightarrow>ownB s i \\<noteq> R)\n                              \\<and> (H s>0)\n\"\n\n\n\nlemmas reader_lemmas  = pre_Release_inv_def pre_Read_inv_def pre_dequeue_inv_def\n(***********************************************************************)\n\n\n\n\n\nlemma Q_structure_preserved1:\n  assumes \"Q_structure s\"\n  and \"pre_dequeue_inv s\"\n  and \"Q_dequeue s s'\"\n  shows \"Q_structure s'\"\n  using assms apply(simp add:Q_structure_def pre_dequeue_inv_def split:if_splits)\n  apply(simp add:Q_reflects_writes_def Q_reflects_ownD_def Q_elem_rel_def) \n  apply (smt (verit, del_insts) One_nat_def Q_structure_def add.assoc add.commute assms(1) length_tl less_diff_conv plus_1_eq_Suc tail_preserves_Q_basic_struct tail_preserves_Q_elem_size tail_preserves_Q_reflects_writes)\n  by(simp add:Q_reflects_writes_def Q_reflects_ownD_def Q_elem_rel_def) \n\nlemma Q_structure_preserved2:\n  assumes \"Q_structure s\"\n  and \"pre_Read_inv s\"\n  and \"B_read s s'\"\n  shows \"Q_structure s'\"\n  using assms apply(simp add:Q_structure_def)\n  by(simp_all add:Q_reflects_writes_def Q_elem_rel_def Q_reflects_ownD_def pre_Read_inv_def) \n\nlemma Q_structure_preserved3:\n  assumes \"Q_structure s\"\n  and \"pre_Release_inv s\"\n  and \"s' = (`T := (off(tempR s) +len(tempR s)) \n          \\<circ> (`pcR := idleR) \n          \\<circ> (`tempR := (0,0))\n          \\<circ> (transownB [R B]) \n          \\<circ> (if tR s\\<noteq> fst(tempR s) then setownB [(tR s,N) B] else id) \n          \\<circ> transownT [R Q s]) s\"\n  shows \"Q_structure s'\"\n  using assms \n  apply (simp add:Q_structure_def) \n  by(simp add:pre_Release_inv_def Q_reflects_writes_def Q_elem_rel_def Q_reflects_ownD_def)\n\n  \n\n\n\n\n\n\n\n\ndefinition \"inRange v \\<equiv> 0 \\<le> v \\<and> v \\<le> N\"\ndefinition \"inRangeHT s \\<equiv> inRange (H s) \\<and> inRange (T s)\"\ndefinition \"H0_T0 s \\<equiv> H s = 0 \\<longrightarrow> T s = 0\"\ndefinition \"inRangeht s \\<equiv> inRange (hW s) \\<and> inRange (tW s)\"\ndefinition \"basic_pointer_movement s \\<equiv> inRangeHT s \\<and> inRangeht s \\<and> H0_T0 s \"\n\nlemmas basic_pointer_movement_lemmas [simp] = basic_pointer_movement_def inRangeHT_def inRangeht_def H0_T0_def inRange_def\n\ndefinition \"mainInv s \\<equiv> \\<forall> i. (i<numReads s \\<longrightarrow> ownD s i=R) \n                           \\<and> (numReads s \\<le> i \\<and> i < numWrites s \\<longrightarrow> ownD s i = B) \n                           \\<and> (numWrites s \\<le> i \\<and> i < n \\<longrightarrow> ownD s i = W) \"\ndefinition \"counter_bounds s \\<equiv> numReads s \\<le>n \\<and> numWrites s\\<le>n \\<and> numEnqs s\\<le>n \\<and> numDeqs s \\<le> n\"\ndefinition \"counter_q_rel s \\<equiv> (numEnqs s-numDeqs s=length(q s))\\<and> numWrites s\\<ge>numReads s \\<and> numEnqs s\\<ge>numDeqs s\" \n\ndefinition \"data_index_bouded s \\<equiv> \\<forall>i. (i\\<le>N)\\<longrightarrow>(\\<forall>j.(j\\<le>N)\\<longrightarrow>data_index s (i,j)<n)\"\n\nlemmas invariant_lemmas [simp] = con_assms_def mainInv_def\n                          counter_q_rel_def \n                          counter_bounds_def data_index_bouded_def\n                          \ndefinition \"ran_indices a b \\<equiv> {i . a \\<le> i \\<and> i < b}\"\n\ndefinition \"Q_indices qs \\<equiv> \\<Union> {ran_indices a (a + b) | a b. (a, b) \\<in> set qs}\"\n\ndefinition \"Q_owns_bytes s \\<equiv> \\<forall>i.(i\\<in>Q_indices (q s))\\<longleftrightarrow>(i\\<le>N \\<and> ownB s i=Q)\"\n\nlemma Q_ind_imp_tail_ind_1:\n  \"tl qs \\<noteq> [] \\<Longrightarrow> hd qs = qs!0\"\n  apply (simp add:hd_def) \n  by (metis Nil_tl hd_conv_nth hd_def)\n\nlemma ran_indices_lem:\n  \"Q_basic_struct qs \\<Longrightarrow> \n    i<length qs \\<Longrightarrow> fst(qs!i) \\<in> ran_indices (fst(qs ! i)) (end (qs!i))\"\n  apply (simp add: Q_lemmas Q_basic_lemmas ran_indices_def)\n  by (metis nth_mem prod.collapse)\n\n\nlemma ran_indices_lem5:\n  \"Q_basic_struct qs \\<Longrightarrow> i<length qs \\<Longrightarrow> fst(qs!i)\\<in>Q_indices qs\"\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  by (metis (full_types) end_simp nth_mem prod.collapse ran_indices_def ran_indices_lem)\n\n\n\n\n\n\n\n\n\n\n\n(*------------------------ Invariant ------------------------------------*)\ndefinition inv  where\n\"inv   s \\<equiv> basic_pointer_movement s \n               \\<and> mainInv s\n               \\<and> counter_q_rel s\n               \\<and> counter_bounds s \n               \\<and> Q_structure s\n               \\<and> data_index_bouded s\n               \\<and> (case_1 s \\<or> case_2 s)\n               \\<and> Q_owns_bytes s\n\"\n\ndefinition pre_W where\n  \"pre_W pcw s \\<equiv> (case pcw of\n      idleW \\<Rightarrow> pre_acquire_inv s \n    | A1 \\<Rightarrow> pre_A1_inv s \n    | A2 \\<Rightarrow> pre_A2_inv s \n    | A3 \\<Rightarrow> pre_A3_inv s \n    | A4 \\<Rightarrow> pre_A4_inv s \n    | A5 \\<Rightarrow> pre_A5_inv s \n    | A6 \\<Rightarrow> pre_A6_inv s \n    | A7 \\<Rightarrow> pre_A7_inv s \n    | A8 \\<Rightarrow> pre_A8_inv s \n    | Write \\<Rightarrow> pre_write_inv s \n    | OOM \\<Rightarrow> pre_OOM_inv s \n    | BTS \\<Rightarrow> pre_BTS_inv s \n    | Enqueue \\<Rightarrow> pre_enqueue_inv s  \n    | FinishedW \\<Rightarrow> pre_finished_inv s)\"\n\ndefinition pre_R where\n  \"pre_R pcr s \\<equiv>\n  (case pcr of\n     idleR \\<Rightarrow> pre_dequeue_inv s \n    | Read \\<Rightarrow> pre_Read_inv s  \n    | Release \\<Rightarrow> pre_Release_inv s)\"\n\n\nlemmas inv_simps =  inv_def cW_step_def cR_step_def init_def\n\n\n(*******************************************************************)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(**********************Supporting lemmas for LOCAL W transitions*********************************)\n\n\nlemma case_trans_A2_to_A3_2:\n  shows \"s'=(s\\<lparr>ownT := W, pcW := A3\\<rparr>) \\<Longrightarrow> T s=H s\\<Longrightarrow> case_1 s \n            \\<Longrightarrow> case_1 s'\"\n  apply (simp add:case_1_lemmas cW_step_def)\n  apply clarify \n  by (smt (z3) diff_is_0_eq le_trans less_irrefl_nat zero_less_diff)\n\n\nlemma case_trans_A2_to_A4_1:\n  shows \"s'=(s\\<lparr>pcW := A4\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> (i\\<le>N)\\<longrightarrow>ownB s' i = ownB s i\"\n  by (simp add:case_1_lemmas cW_step_def)\n\nlemma case_trans_A2_to_A4_2:\n  shows \"s'=(s\\<lparr>pcW := A4\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> case_1 s'\"\n  by (simp add:case_1_lemmas cW_step_def)\n\nlemma case_trans_A2_to_A4_3:\n  shows \"s'=(s\\<lparr>pcW := A4\\<rparr>) \\<Longrightarrow> case_2 s \\<Longrightarrow> T s>H s\n            \\<Longrightarrow> case_2 s'\"\n  by (simp add:case_2_lemmas cW_step_def)\n\nlemma case_trans_A2_to_A5_1:\n  shows \"s'=(s\\<lparr>pcW := A5\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> (i\\<le>N)\\<longrightarrow>ownB s' i = ownB s i\"\n  by (simp add:case_1_lemmas cW_step_def)\n\nlemma case_trans_A2_to_A5_2:\n  shows \"s'=(s\\<lparr>pcW := A5\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> case_1 s'\"\n  by (simp add:case_1_lemmas cW_step_def)\n\nlemma case_trans_A2_to_A5_3:\n  shows \"s'=(s\\<lparr>pcW := A5\\<rparr>) \\<Longrightarrow> case_2 s \\<Longrightarrow> T s\\<le>H s\n            \\<Longrightarrow> case_2 s'\"\n  by (simp add:case_2_lemmas cW_step_def)\n\nlemma case_trans_A2_to_A8_1:\n  shows \"s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> (i\\<le>N)\\<longrightarrow>ownB s' i = ownB s i\"\n  by (simp add:case_1_lemmas cW_step_def)\n\n\nlemma case_trans_A2_to_A8_2:\n  shows \"s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> case_1 s'\"\n  by (simp add:case_1_lemmas cW_step_def)\n\nlemma case_trans_A2_to_A8_3:\n  shows \"s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow> case_2 s \\<Longrightarrow> T s\\<le>H s\n            \\<Longrightarrow> case_2 s'\"\n  by (simp add:case_2_lemmas cW_step_def)\n\nlemma case_trans_A2_to_A8_4:\n  shows \"s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow> case_2 s \\<Longrightarrow> T s>H s\n            \\<Longrightarrow> case_2 s'\"\n  by (simp add:case_2_lemmas cW_step_def)\n\nlemma case_trans_A3_1:\n  shows \"pre_A3_inv s \\<Longrightarrow> case_2 s \\<Longrightarrow> False\"\n  by (simp add:case_2_lemmas pre_A3_inv_def)\n\nlemma case_trans_A3_2:\n  shows \"pre_A3_inv s \\<Longrightarrow>con_assms s\\<Longrightarrow>inv s\\<Longrightarrow> case_1 s\"\n  apply (simp add:pre_A3_inv_def con_assms_def basic_pointer_movement_def inv_def)\n  apply(subgoal_tac \"H s=T s\") prefer 2\n  apply simp apply clarify \n  apply(subgoal_tac \"\\<not>case_2 s\") prefer 2\n  apply (metis case_split_2 less_or_eq_imp_le)\n  by blast\n\n\n\n\nlemma case_trans_A3_to_write_1:\n  shows \"pre_A3_inv s \\<Longrightarrow> s' = trans_A3 s \\<Longrightarrow> inv s\\<Longrightarrow> H s'\\<ge>T s'\"\n  by (simp add:pre_A3_inv_def trans_A3_def inv_def)\n\nlemma case_trans_A3_to_write_2:\n  shows \"pre_A3_inv s \\<Longrightarrow> s' = trans_A3 s \\<Longrightarrow> inv s\\<Longrightarrow> \\<not>case_2 s'\"\n  by (simp add:pre_A3_inv_def inv_def case_2_pred_def trans_A3_def case_2_lemmas)\n\nlemma case_trans_A3_to_write_3:\n  shows \"s' = trans_A3 s \\<Longrightarrow> \n         i\\<ge>T s' \\<Longrightarrow> i<H s' \\<Longrightarrow> ownB s' i=W\"\n  by (simp add:pre_A3_inv_def inv_def trans_A3_def case_1_lemmas)\n\nlemma case_trans_A3_to_write_4:\n  shows \"pre_A3_inv s \\<Longrightarrow> s' = trans_A3 s \\<Longrightarrow> i\\<ge>H s' \\<Longrightarrow> i<N  \\<Longrightarrow> ownB s' i=B\"\n  by (simp add:pre_A3_inv_def inv_def trans_A3_def case_1_lemmas)\n\nlemma case_trans_A3_to_write_7:\n  shows \"pre_A3_inv s \\<Longrightarrow> s' = trans_A3 s \\<Longrightarrow> inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> case_1 s'\"\n  apply (simp add:pre_A3_inv_def inv_def trans_A3_def case_1_lemmas) \n  apply (rule_tac exI [where x =\"0\"]) \n  apply (rule_tac exI [where x =\"0\"]) apply simp  \n  by (metis case_split_2 less_or_eq_imp_le)\n\n\n\nlemma case_trans_A4_1:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<ge>tW s\\<Longrightarrow> case_1 s \\<Longrightarrow> False\"\n  apply (simp add:case_1_lemmas pre_A4_inv_def)\n  by (metis diff_is_0_eq le_trans less_nat_zero_code)\n\nlemma case_trans_A4_2:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<le>hW s\\<Longrightarrow> case_2 s \\<Longrightarrow> False\"\n  apply (simp add:case_2_lemmas pre_A4_inv_def) \n  by (metis le_antisym less_irrefl_nat less_or_eq_imp_le)\n\nlemma case_trans_A4_3:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s>hW s \\<Longrightarrow> T s<tW s  \\<Longrightarrow> False\"\n  by (simp add:case_2_lemmas pre_A4_inv_def) \n\nlemma case_trans_A4_4:\n  shows \"pre_A4_inv s \\<Longrightarrow> inv s\\<Longrightarrow> T s\\<ge>tW s \\<Longrightarrow> case_2 s\"\n  using RingBuffer_BD_latest_3.inv_def case_trans_A4_1 by blast\n\nlemma case_trans_A4_5:\n  shows \"pre_A4_inv s \\<Longrightarrow> inv s\\<Longrightarrow> T s\\<le>hW s\\<Longrightarrow> case_1 s\"\n  apply (simp add: pre_A4_inv_def inv_def) using case_trans_A4_2 [where s=s]\n  by (metis RingBuffer_BD_latest_3.case_split)\n\n\n\n\nlemma case_trans_A4_to_write_3:\n  shows \"s' = trans_A4 s \\<Longrightarrow>  hW s \\<le>i \\<Longrightarrow> i<H s' \\<Longrightarrow> W=ownB s' i\"\n  by (simp add:case_2_lemmas pre_A4_inv_def inv_def trans_A4_def) \n\n\n\nlemma case_trans_A4_to_write_7:\n  assumes a1: \"pre_A4_inv s\" and \n          a2: \"T s\\<ge>tW s\" and \n          a3: \"s' = trans_A4 s \" and \n          a4: \"con_assms s\" and \n          a5: \"inv s\"\n  shows \"case_2 s'\"\nproof - \n  have c0: \"H s<H s'\" using a1 a3 a4 by (simp add: pre_A4_inv_def trans_A4_def) \n  have c1: \"H s'<T s'\" \n    using a1 a2 a3 unfolding pre_A4_inv_def trans_A4_def \n    using less_diff_conv less_le_trans by auto  \n  have c2: \"T s=T s'\"  using a3 by (simp add: trans_A4_def) \n  have c3: \"q s=q s'\"  using a3 by (simp add: trans_A4_def) \n  have c4: \"ownT s=ownT s'\" using a3 by (simp add: trans_A4_def) \n  have c5: \"Data s (numEnqs s) = Data s' (numEnqs s')\"  using a3 by (simp add: trans_A4_def) \n  have c6: \"H s'-H s=Data s (numEnqs s)\"  using a1 a3 by (simp add: pre_A4_inv_def trans_A4_def)\n  have c7: \"offset s'=hW s\" using a3 by (simp add: trans_A4_def) \n  have c8: \"tempR s = tempR s'\"  using a3 by (simp add: trans_A4_def) \n  have c9: \"\\<forall> i. i\\<ge>H s' \\<longrightarrow> ownB s i=ownB s' i\" using a3 by (simp add: trans_A4_def) \n  have c10: \"\\<forall> i. i<offset s' \\<longrightarrow> ownB s i=ownB s' i\" using a3 by (simp add: trans_A4_def)     \n  have \"case_2 s\"  by (simp add: a1 a2 a5 case_trans_A4_4)\n  from this show ?thesis\n    apply (simp add: case_2_def) apply clarify \n  proof - \n    fix a b c d e f\n    assume ea: \"case_2_pred a b c d e f s\" \n      from ea have \"\\<forall> i. 0 \\<le> i \\<and> i < a \\<longrightarrow> ownB s i = R\" unfolding case_2_pred_def by metis\n      from this a1 a3 c7 have ea1: \"\\<And>i. 0 \\<le> i \\<and> i < a \\<longrightarrow> ownB s' i = R\" \n        unfolding case_2_pred_def pre_A4_inv_def \n        by (metis F.distinct(13) c10 gr_implies_not0 grd2_def leI le_less_trans less_or_eq_imp_le)\n      from ea a1 a3 c7 have ea2: \"\\<And>i. a \\<le> i \\<and> i < b \\<longrightarrow> ownB s' i = Q\"\n        unfolding case_2_pred_def pre_A4_inv_def \n        by (metis c10 less_le_trans)      \n      from ea a1 a3 c7 c10 have ea3: \"\\<And>i. b \\<le> i \\<and> i < H s' \\<longrightarrow> ownB s' i = W\"\n        unfolding case_2_pred_def pre_A4_inv_def \n        by (metis case_trans_A4_to_write_3 leI)\n      from ea a1 c7 have ea4: \"offset s' = b\"\n        unfolding case_2_pred_def pre_A4_inv_def \n        by (metis le_neq_implies_less le_trans less_imp_le order_refl)\n      from ea a1 c5 c6 have ea5: \"Data s' (numEnqs s') = H s' - b\"\n        unfolding case_2_pred_def pre_A4_inv_def \n        by (metis c7 ea4)        \n      show \"\\<exists>a b c d e f. case_2_pred a b c d e f s'\"\n    using ea apply(rule_tac ?x = \"a\" in exI)\n    apply(rule_tac ?x = \"b\" in exI)\n    apply(rule_tac exI [where x =\"H s'\"])\n    apply(rule_tac exI [where x =\"T s'\"])\n    apply(rule_tac ?x = \"e\" in exI)\n    apply(rule_tac ?x = \"f\" in exI) \n    unfolding case_2_pred_def \n    using c0 c1 c2 c3 c4  c8 c9 ea1 ea2 ea3 ea4 ea5 \n    by (smt (z3) le_eq_less_or_eq le_less_trans)\nqed \nqed\n\n\n\n\nlemma case_trans_A4_to_write_8:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<le>H s  \\<Longrightarrow> con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s\"\n  using case_trans_A4_5 [where s=s] apply (simp add:case_1_lemmas)\n  by (simp add: pre_A4_inv_def)\n\n\nlemma case_trans_A4_to_write_9:\n  assumes a1: \"pre_A4_inv s\" and \n          a2: \"T s\\<le>H s \" and \n          a3: \"s' = trans_A4 s \" and \n          a4: \"con_assms s\" and \n          a5: \"inv s\"\n        shows \"case_1 s'\"\nproof - \n  have c0: \"H s<H s'\" using a1 a3 a4 by (simp add: pre_A4_inv_def trans_A4_def) \n  have c1: \"T s=T s'\"  using a3 by (simp add: trans_A4_def) \n  have c2: \"T s'\\<le>H s\" \n  using a1 a2 a3 c1 unfolding pre_A4_inv_def trans_A4_def \n  using less_diff_conv less_le_trans by linarith \n  have c3: \"q s=q s'\"  using a3 by (simp add: trans_A4_def) \n  have c4: \"ownT s=ownT s'\" using a3 by (simp add: trans_A4_def) \n  have c5: \"Data s (numEnqs s) = Data s' (numEnqs s')\"  using a3 by (simp add: trans_A4_def) \n  have c6: \"H s'-H s=Data s (numEnqs s)\"  using a1 a3 by (simp add: pre_A4_inv_def trans_A4_def)\n  have c7: \"offset s'=hW s\" using a3 by (simp add: trans_A4_def) \n  have c8: \"tempR s = tempR s'\"  using a3 by (simp add: trans_A4_def) \n  have c9: \"\\<forall> i. i\\<ge>H s' \\<longrightarrow> ownB s i=ownB s' i\" using a3 by (simp add: trans_A4_def) \n  have c10: \"\\<forall> i. i<offset s' \\<longrightarrow> ownB s i=ownB s' i\" using a3 by (simp add: trans_A4_def) \n  have \"case_1 s\"  \n    using a1 a2 a4 a5 case_trans_A4_to_write_8 by blast\n  from this show ?thesis \n    apply (simp add: case_1_def) apply clarify \n  proof-\n    fix a b c d\n    assume ea: \"case_1_pred a b c d s\"\n    from ea have ea1: \"\\<And>i.  0 \\<le> i \\<and> i < T s \\<longrightarrow> ownB s i = B\" unfolding case_1_pred_def by metis \n    from ea a1 c7 have ea4: \"offset s' = c\"\n        unfolding case_1_pred_def pre_A4_inv_def \n        by (metis le_refl le_trans nat_less_le)\n    from this a1 a3 c7 ea1 have ea2: \"\\<And>i. 0 \\<le> i \\<and> i < T s' \\<longrightarrow> ownB s' i = B\" \n        unfolding case_1_pred_def pre_A4_inv_def \n        by (metis c1 c10 c2 less_le_trans)\n     from ea have ea3: \"\\<And>i.  a \\<le> i \\<and> i < b \\<longrightarrow> ownB s i = R\" unfolding case_1_pred_def \n       by presburger\n    from this a1 a3 c7 ea3 have ea4: \"\\<And>i. a \\<le> i \\<and> i < b \\<longrightarrow> ownB s' i = R\" \n        unfolding case_1_pred_def pre_A4_inv_def \n        by (smt (verit) F.distinct(13) c10 c6 c9 dual_order.strict_trans1 grd2_def less_diff_iff not_less not_less_iff_gr_or_eq)\n     from ea have ea5: \"\\<And>i.  b \\<le> i \\<and> i < c \\<longrightarrow> ownB s i = Q\" unfolding case_1_pred_def \n       by presburger\n     from this a1 a3 c7 ea5 have ea6: \"\\<And>i. b \\<le> i \\<and> i < c \\<longrightarrow> ownB s' i = Q\" \n        unfolding case_1_pred_def pre_A4_inv_def \n        by (smt (verit) F.distinct(19) c10 c6 c9 dual_order.strict_trans1 grd2_def leI less_diff_iff not_less_iff_gr_or_eq)\n     from ea have ea7: \"\\<And>i.  c \\<le> i \\<and> i < H s \\<longrightarrow> ownB s i = W\" unfolding case_1_pred_def \n       by presburger\n     from this a1 a3 c7 ea7 have ea8: \"\\<And>i. c \\<le> i \\<and> i < H s' \\<longrightarrow> ownB s' i = W\" \n        unfolding case_1_pred_def pre_A4_inv_def \n        using case_trans_A4_to_write_3 \n        by (metis c10 leI) \n\n    show \"\\<exists>a b c d. case_1_pred a b c d s'\"\n    using ea apply(rule_tac ?x = \"T s'\" in exI)\n    apply(rule_tac ?x = \"b\" in exI)\n    apply(rule_tac exI [where x =\"c\"])\n    apply(rule_tac exI [where x =\"H s'\"])\n    unfolding case_1_pred_def \n    apply (intro conjI impI; elim conjE)\n    apply blast\n    apply (simp add: c1) \n    apply fastforce\n    apply (metis c0 less_le less_trans)\n    defer \n    using ea2 apply blast\n    using c1 ea4 apply presburger\n    using ea6 apply fastforce\n    using ea8 apply fastforce\n    apply (metis c0 c9 le_trans less_le)\n    apply (smt (verit, best) F.distinct(27) a1 c6 c9 grd2_def leI le_add_diff_inverse2 less_diff_conv less_trans pre_A4_inv_def)\n    apply meson\n    apply blast\n    apply (smt (verit) a1 c7 less_le_trans order.order_iff_strict pre_A4_inv_def)\n    apply (smt (verit, best) a1 c5 c6 le_trans not_less not_less_iff_gr_or_eq pre_A4_inv_def)\n    apply (metis c1 c8 c3 c4)+\n    apply (smt (verit, best) a1 c4 pre_A4_inv_def)\n    by (smt (z3) F.distinct(27) a1 c6 grd2_def le_add_diff_inverse2 le_less_trans less_diff_conv nat_le_linear pre_A4_inv_def)\nqed \nqed\n\n\nlemma case_trans_A5_1:\n  shows \"pre_A5_inv s \\<Longrightarrow> inv s\\<Longrightarrow> case_1 s\"\n  apply (simp add: pre_A5_inv_def inv_def)\n  by (metis RingBuffer_BD_latest_3.case_split) \n\n\n\nlemma case_trans_A5_to_A6_2:\n  shows \" s'=(s\\<lparr>pcW := A6\\<rparr>)  \\<Longrightarrow> \n    case_1 s' = case_1 s\"\n  by(simp add:case_1_lemmas)\n\nlemma case_trans_A5_to_A6_3:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A6\\<rparr>)  \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s'\"\n  using case_trans_A5_1 \n  using case_trans_A5_to_A6_2 by blast \n\n\n\nlemma case_trans_A5_to_A6_5:\n  shows \"s'=(s\\<lparr>pcW := A7\\<rparr>) \\<Longrightarrow>\n    case_1 s' = case_1 s\"\n  by(simp add:case_1_lemmas)\n\nlemma case_trans_A5_to_A6_6:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A7\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s'\"\n  using case_trans_A5_to_A6_5 [where s=s and s'=s']\n  using case_trans_A5_1 by blast\n\n\n(*\nlemma case_trans_A5_to_A6_7:\n  shows \"s'=(s\\<lparr>pcW := A8\\<rparr>)   \\<Longrightarrow>\n    i\\<le>N \\<Longrightarrow> ownB s i=ownB s' i\"\n  by(simp add:case_1_lemmas pre_A5_inv_def inv_def)\n*)\n\n\nlemma case_trans_A5_to_A6_9:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s'\"\n  by (metis case_trans_A2_to_A8_2 case_trans_A5_1)\n\n\nlemma case_trans_A6_2:\n  shows \"pre_A6_inv s \\<Longrightarrow> inv s\\<Longrightarrow> case_2 s \\<Longrightarrow> False\"\n  apply (simp add: pre_A6_inv_def inv_def)\n  by (metis case_split_2)\n\n\n(*\nlemma case_trans_A6_to_write_1:\n  shows \"pre_A6_inv s \\<Longrightarrow> s' = s\n    \\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i,\n       pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>\\<Longrightarrow>inv s\\<Longrightarrow> H s'\\<ge>T s'\"\n  by (simp add:pre_A6_inv_def inv_def)\n*)\n(*\nlemma case_trans_A6_to_write_2:\n  shows \"pre_A6_inv s \\<Longrightarrow> s' = s\n    \\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i,\n       pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>\\<Longrightarrow>inv s\\<Longrightarrow>con_assms s\\<Longrightarrow> \\<not>case_2 s'\" \n  using case_split_2 case_trans_A6_to_write_1 by auto\n*)\n\n\nlemma case_trans_A6_to_write_7:\n  \"pre_A6_inv s \\<Longrightarrow> s' = trans_A6 s \\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> case_1 s'\"\n  apply(subgoal_tac \"\\<not>case_2 s\") prefer 2\n  using case_trans_A6_2 apply blast\n  apply (simp add:pre_A6_inv_def inv_def case_1_lemmas trans_A6_def)\n  apply(intro conjI impI) \n  apply (metis (no_types, lifting) add_le_cancel_left le_add_diff_inverse le_antisym less_imp_le_nat nat_neq_iff)\n  apply clarify\n  apply (rule_tac exI [where x =\"T s\"]) \n  apply(rule_tac ?x = \"b\" in exI) apply (intro conjI impI)\n  apply blast \n  apply(rule_tac ?x = \"c\" in exI)\n  apply (intro conjI impI)\n  apply linarith\n  apply linarith \n  apply (metis le_trans nat_less_le)\n  apply (metis le_trans nat_less_le)\n  apply (metis le_trans nat_less_le)\n  apply (metis F.distinct(17) F.distinct(23) le_refl nat_less_le nat_neq_iff)\n  apply (metis)\n  apply (metis le_trans nat_less_le)\n  apply (metis le_neq_implies_less le_refl le_trans)\n  apply (metis Nat.add_diff_assoc2 diff_self_eq_0 le_refl le_trans nat_less_le plus_nat.add_0)\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  by meson\n\n \n\n\nlemma case_trans_A7_2:\n  shows \"pre_A7_inv s \\<Longrightarrow>  case_2 s \\<Longrightarrow> False\"\n  apply (simp add: pre_A7_inv_def inv_def)\n  by (metis case_split_2)\n\nlemma case_trans_A7_to_write_2:\n  shows \"pre_A7_inv s \\<Longrightarrow> s' = trans_A7 s \\<Longrightarrow>  \\<not>case_1 s'\"\n  by (simp add:pre_A7_inv_def inv_def trans_A7_def case_1_lemmas)\n  \n\nlemma case_trans_A7_to_write_7:\n  shows \"pre_A7_inv s \\<Longrightarrow> s' = trans_A7 s \\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> case_2 s'\"\n  apply(subgoal_tac \"\\<not>case_2 s\") prefer 2\n  using case_trans_A7_to_write_2 [where s=s and s'=s']\n  using case_trans_A7_2 apply blast \n  apply (simp add:pre_A7_inv_def trans_A7_def inv_def) \n  apply(thin_tac \"\\<not>case_2 s\") \n  apply(simp add:case_1_lemmas case_2_lemmas)\n  apply clarify\n  apply(rule_tac ?x = \"0\" in exI) \n  apply(rule_tac ?x = \"0\" in exI) apply (intro conjI impI)\n  apply blast \n  apply(rule_tac ?x = \"Data s (numEnqs s)\" in exI)\n  apply (intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply (intro conjI impI) \n  apply linarith \n  apply(rule_tac ?x = \"b\" in exI) \n  apply (intro conjI impI) \n  apply linarith \n  apply(rule_tac ?x = \"c\" in exI) \n  apply (intro conjI impI) \n  apply linarith \n  apply (metis le_trans)\n  apply blast\n  apply blast\n  apply blast  \n  apply (metis le_antisym le_trans nat_less_le) \n  apply (metis le_antisym le_trans nat_less_le)\n  apply (metis le_antisym le_trans nat_less_le)\n  apply (metis le_trans nat_le_linear nat_less_le)\n  apply blast\n  apply fastforce\n  apply blast  \n  apply blast  \n  apply metis\n  apply blast\n  apply blast\n  apply blast \n  apply (metis diff_zero) \n  apply force\n  apply fastforce\n  apply meson\n  apply meson \n  apply (metis zero_less_iff_neq_zero)\n  apply force\n  apply force\n  apply force\n  apply fastforce\n  apply meson\n  by (metis le_neq_implies_less)\n  \n\n\n\nlemma case_trans_Write_to_Enqueue_case_3:\n  shows \"pre_write_inv s \\<Longrightarrow> inv s\\<Longrightarrow> s'=s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n       ownD :=\n         \\<lambda>i. if i = numWrites s then B\n             else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n       data_index :=\n         \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s\n             else data_index\n                   (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                        ownD :=\n                          \\<lambda>i. if i = numWrites s then B\n                              else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>)\n                   x\\<rparr> \\<Longrightarrow>case_1 s \\<or> case_2 s \\<Longrightarrow> con_assms s\n     \\<Longrightarrow>case_1 s' \\<or> case_2 s'\"\n  by (simp add:pre_write_inv_def case_1_lemmas case_2_lemmas)\n\n\n\n\n\n(**********************Supporting lemmas for R trans*********************************)\n\nlemma R_idle_to_nidle_lemma_case_1_5:\n  assumes \n   a1: \"case_1 s\"  and \n   a2: \" con_assms s\" and \n   a3: \"pcR s = idleR\" and\n   a4: \" pre_R (pcR s) s \" and\n   a5: \" s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\"and\n   a6: \"inv s\" and \n   a7: \"q s\\<noteq>[]\"\n shows \"case_1 s'\"\n  using assms apply (simp add: case_1_def) apply(simp add:case_1_lemmas inv_def) \n  apply(clarify) apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(subgoal_tac \"fst (last (q s)) + snd (last (q s))\\<le>N\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"q s\\<noteq>[]\\<longrightarrow>hd(q s) \\<in>set(q s)\") prefer 2 \n  apply (metis list.set_sel(1))\n  using a7 apply (metis diff_is_0_eq less_nat_zero_code prod.collapse zero_less_diff)\n   apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = \"end(hd(q s))\" in exI)\n  apply(intro conjI impI)\n  apply (metis cancel_comm_monoid_add_class.diff_cancel end_simp le_0_eq le_neq_implies_less length_0_conv trans_le_add1)\n  apply(rule_tac ?x = \"fst (last (q s)) + snd (last (q s))\" in exI)\n  apply(simp add:pre_R_def  pre_dequeue_inv_def) \n  apply(intro conjI impI) \n  defer\n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(3) diff_is_0_eq le_0_eq le_neq_implies_less length_0_conv nat_le_linear)\n  apply (metis (no_types, hide_lams) F.distinct(3)) \n  defer\n  apply (metis le_neq_implies_less le_refl)\n  apply (metis diff_add_inverse eq_imp_le le_neq_implies_less) \n defer\n  apply(subgoal_tac \"hd(q s) = (q s!0)\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = (q s!1)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def diff_add_inverse2 hd_conv_nth last_conv_nth length_greater_0_conv length_tl less_diff_conv list.size(3) nth_tl)\n  apply(case_tac \"fst(q s!0) = 0\") \n  apply (metis (no_types, hide_lams) Nat.add_0_right add.commute diff_add_inverse2 diff_is_0_eq last_conv_nth lessI not_less plus_1_eq_Suc trans_le_add1)\n  apply(subgoal_tac \"ownB s 0 \\<noteq> Q\") prefer 2 \n  apply (metis F.distinct(19) gr0I le_numeral_extra(3))\n  apply(subgoal_tac \"\\<nexists>a b. (a,b) \\<in> set(q s) \\<and> a=0\") prefer 2 \n  apply (metis (no_types, lifting) bot_nat_0.extremum mem_Collect_eq plus_nat.add_0)\n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_Suc_1 last_conv_nth length_greater_0_conv less_le less_one nth_mem prod.collapse)\n  apply (metis (no_types, hide_lams) Nitpick.size_list_simp(2) hd_conv_nth last_conv_nth last_tl length_tl less_not_refl)\n  apply (metis (no_types, lifting) diff_add_inverse diff_is_0_eq' le_0_eq le_eq_less_or_eq length_0_conv linorder_neqE_nat list.set_sel(1) nat_less_le not_add_less1 prod.collapse)\n  apply (metis diff_add_inverse diff_is_0_eq' le_eq_less_or_eq less_nat_zero_code list.set_sel(1) prod.collapse)                       \n  apply (metis (no_types, hide_lams) F.distinct(19) F.distinct(3) le_eq_less_or_eq not_less)\n  using le_eq_less_or_eq \n  apply (metis (no_types, lifting) F.distinct(19) add_lessD1 le_add_diff_inverse less_imp_le_nat nat_neq_iff)\n  apply (subgoal_tac \"((fst (hd (q s)) + snd (hd (q s)) < fst (last (q s)) + snd (last (q s))) \\<longrightarrow> (Suc 0 < length (q s))) \\<and>\n   ((Suc 0 < length (q s)\\<longrightarrow>fst (hd (q s)) + snd (hd (q s)) < fst (last (q s)) + snd (last (q s))))\")\n   apply blast  \n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) One_nat_def Suc_eq_plus1 Suc_lessI add.commute diff_add_zero hd_conv_nth last_conv_nth length_greater_0_conv less_not_refl2)\n  apply(subgoal_tac \"hd(q s)\\<in> set(q s) \\<and> last(q s) \\<in>set(q s)\") prefer 2 \n  apply (metis last_in_set list.set_sel(1))\n  apply(subgoal_tac \"fst(hd(q s)) < fst(last(q s))\") \n  apply (metis (no_types, lifting) linorder_neqE_nat nat_less_le prod.collapse trans_less_add1)\n  apply(subgoal_tac \"hd(q s) = (q s!0) \\<and> last(q s) = (q s!(length(q s)-1))\") prefer 2\n  apply (metis hd_conv_nth last_conv_nth)\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  by (metis (no_types, lifting) One_nat_def diff_is_0_eq diff_less leD length_pos_if_in_set less_one linorder_neqE_nat prod.collapse)\n\n\n\n(*\nlemma R_idle_to_nidle_lemma_case_1_5:\n  assumes \n   a1: \"case_1 s\"  and \n   a2: \" con_assms s\" and \n   a3: \"pcR s = idleR\" and\n   a4: \" pre_R (pcR s) s \" and\n   a5: \" s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\"and\n   a6: \"inv s\" and \n   a7: \"q s\\<noteq>[]\"\n shows \"case_1 s'\"\n  using assms apply(simp add:case_1_lemmas inv_def) \n  apply(clarify) apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(subgoal_tac \"fst (last (q s)) + snd (last (q s))\\<le>N\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"q s\\<noteq>[]\\<longrightarrow>hd(q s) \\<in>set(q s)\") prefer 2 \n  apply (metis list.set_sel(1))\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 \n  apply blast\n  apply (metis diff_is_0_eq less_nat_zero_code prod.collapse zero_less_diff)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = \"end(hd(q s))\" in exI)\n  apply(intro conjI impI)\n  apply (metis cancel_comm_monoid_add_class.diff_cancel end_simp le_0_eq le_neq_implies_less length_0_conv trans_le_add1)\n  apply(rule_tac ?x = \"fst (last (q s)) + snd (last (q s))\" in exI)\n  apply(simp add:pre_R_def  pre_dequeue_inv_def) \n  apply(intro conjI impI) \n  apply(subgoal_tac \"last(q s) \\<in>set(q s) \\<and> hd(q s)\\<in>set(q s)\") prefer 2 \n  apply (metis last_in_set list.set_sel(1))\n  defer\n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(3) diff_is_0_eq le_0_eq le_neq_implies_less length_0_conv nat_le_linear)\n  apply (metis (no_types, hide_lams) F.distinct(3)) \n  defer\n  apply (metis le_neq_implies_less le_refl)\n  apply (metis diff_add_inverse eq_imp_le le_neq_implies_less) \n  apply (subgoal_tac \"((fst (hd (q s)) + snd (hd (q s)) < fst (last (q s)) + snd (last (q s))) \\<longrightarrow> (Suc 0 < length (q s))) \\<and>\n   ((Suc 0 < length (q s)\\<longrightarrow>fst (hd (q s)) + snd (hd (q s)) < fst (last (q s)) + snd (last (q s))))\")\n  apply blast defer\n  apply(subgoal_tac \"hd(q s) = (q s!0)\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = (q s!1)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def diff_add_inverse2 hd_conv_nth last_conv_nth length_greater_0_conv length_tl less_diff_conv list.size(3) nth_tl)\n  apply(case_tac \"fst(q s!0) = 0\") \n  apply(subgoal_tac \"fst(hd(q s)) = 0\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j \\<longrightarrow> fst(q s!i) \\<noteq>fst(q s!j)\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"i<(length(q s))\\<and>i>0\\<and> fst(q s!0) = 0\\<longrightarrow> fst(q s!(i-1)) + snd(q s!(i-1)) = fst(q s!i)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def length_greater_0_conv)\n  apply(case_tac \"length(q s) > 1\") \n  apply(subgoal_tac \"fst(q s!0) = 0\\<longrightarrow> fst(q s!(0)) + snd(q s!(0)) = fst(q s!1)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 length_greater_0_conv less_one)\n  apply presburger\n  apply (metis diff_self_eq_0 last_conv_nth length_0_conv less_nat_zero_code less_one nat_neq_iff)\n  apply(subgoal_tac \"fst(hd(q s))>0\") prefer 2 \n  using gr0I apply presburger\n  apply(subgoal_tac \"ownB s 0 \\<noteq> Q\") prefer 2 \n  apply (metis F.distinct(19) gr0I le_numeral_extra(3))\n  apply(subgoal_tac \" \\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"0\\<le>N\") prefer 2\n  apply blast\n  apply(subgoal_tac \"(\\<nexists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\")\n  prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<nexists>a b. (a,b) \\<in> set(q s) \\<and> a=0\") prefer 2 \n  apply (metis (no_types, lifting) bot_nat_0.extremum mem_Collect_eq plus_nat.add_0)\n  apply(subgoal_tac \"i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"(sta,wlength)\\<in>set(q s) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> (sta,wlength) = q s!i))\") prefer 2\n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>sta wlength. (sta,wlength)\\<in>set(q s) \\<longrightarrow> sta\\<noteq>0\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"i<length(q s) \\<longrightarrow>fst(q s!i)\\<noteq>0\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"i<(length(q s))\\<and>i>0\\<longrightarrow> fst(q s!(i-1)) + snd(q s!(i-1)) = fst(q s!i)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def)\n  apply(case_tac \"length(q s)>1\") \n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 less_one nth_mem prod.collapse)\n  apply(case_tac \"length(q s) = 0\")\n  apply fastforce\n  apply(subgoal_tac \"length(q s) = 1\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"length(tl(q s)) = 0\") prefer 2\n  apply (metis diff_self_eq_0 length_tl)\n  apply (metis diff_self_eq_0 last_conv_nth le_neq_implies_less less_irrefl_nat not_one_le_zero)\n  apply(case_tac \"length(q s) \\<le>1\")\n  apply (metis bot_nat_0.extremum_uniqueI diff_add_inverse2 diff_is_0_eq' head_q0 last_conv_nth le_neq_implies_less length_greater_0_conv less_diff_conv less_numeral_extra(3))\n  apply (metis (no_types, lifting) One_nat_def diff_is_0_eq last_tl le_Suc_eq le_neq_implies_less length_tl list.size(3))\n  apply (metis (no_types, lifting) diff_add_inverse diff_is_0_eq' le_0_eq le_eq_less_or_eq length_0_conv linorder_neqE_nat list.set_sel(1) nat_less_le not_add_less1 prod.collapse)\n  apply (metis diff_add_inverse diff_is_0_eq' le_eq_less_or_eq less_nat_zero_code list.set_sel(1) prod.collapse)                       \n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"(\\<forall>a b aa bb . ((a, b) \\<in> set (q s) \\<and>  (aa, bb) \\<in> set (q s)) \\<longrightarrow> a + b \\<ge> aa + bb \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, lifting) less_add_same_cancel1 nat_le_iff_add trans_less_add1)\n  apply(subgoal_tac \"(\\<forall>a b aa bb . ((a, b) \\<in> set (q s) \\<and>  (aa, bb) \\<in> set (q s)) \\<longrightarrow> a <  aa \\<longrightarrow> a + b \\<le> aa + bb)\") prefer 2\n  apply (meson trans_le_add1)\n  apply(case_tac \"hd(q s) \\<noteq> last(q s)\")\n  apply(subgoal_tac \"fst(hd(q s)) < fst(last(q s))\")\n  apply (metis (no_types, lifting) prod.collapse)\n  apply(subgoal_tac \"i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j \\<longrightarrow> fst(q s!i)\\<noteq>fst(q s!j)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s (fst(q s!0)) = Q\") prefer 2 \n  apply (metis (no_types, lifting) head_q0 le_eq_less_or_eq length_greater_0_conv)\n  apply(subgoal_tac \"ownB s (fst(last(q s))) = Q\") prefer 2\n  apply (metis (no_types, lifting) less_add_same_cancel1 prod.collapse)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i=Q \\<and> i\\<le>N)\\<longrightarrow>i\\<ge>fst(q s!0)\") prefer 2 \n  apply (metis F.distinct(19) hd_conv_nth less_Suc_eq_le not_less_eq)\n  apply(subgoal_tac \"hd(q s) = (q s!0) \\<and> last(q s) = (q s!(length(q s)-1))\") prefer 2\n  apply (metis hd_conv_nth last_conv_nth) \n  apply (metis (no_types, lifting) diff_less length_pos_if_in_set less_one nat_less_le prod.collapse)\n  using le_eq_less_or_eq apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply blast\n  apply(subgoal_tac \"hd(q s) \\<in>set(q s)\") prefer 2\n  apply (metis hd_in_set)\n  apply(case_tac \"hd(q s) = last(q s)\") \n  apply (metis Suc_diff_le Suc_leI Suc_neq_Zero diff_is_0_eq le_trans)\n  apply(subgoal_tac \"i\\<ge>H s \\<and> i\\<le>N \\<longrightarrow> ownB s i \\<noteq>Q\") prefer 2\n  apply (metis F.distinct(19) F.distinct(23) le_eq_less_or_eq)\n  apply(subgoal_tac \"i\\<ge>fst(q s!0) \\<and> i<fst(q s!0) + snd(q s!0)\\<longrightarrow> ownB s i = Q\") prefer 2\n  apply (metis (no_types, lifting) head_q0 length_greater_0_conv)\n  defer\n  apply(intro conjI impI)\n  apply(subgoal_tac \"hd(q s) = (q s!0) \\<and> last(q s) = (q s!(length(q s)-1))\") prefer 2 \n  apply (meson hd_conv_nth last_conv_nth)\n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_self_eq_0 length_greater_0_conv less_not_refl2)\n  apply(subgoal_tac \"hd(q s)\\<in> set(q s) \\<and> last(q s) \\<in>set(q s)\") prefer 2 \n  apply (metis last_in_set list.set_sel(1))\n  apply(subgoal_tac \"(a,b)\\<in>set(q s)\\<longrightarrow>b>0\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"fst(hd(q s)) < fst(last(q s))\") \n  apply (metis (no_types, lifting) linorder_neqE_nat nat_less_le prod.collapse trans_less_add1)\n  apply(subgoal_tac \"i<fst(hd(q s)) \\<longrightarrow> ownB s i \\<noteq>Q\") prefer 2\n  apply (metis F.distinct(19) le_eq_less_or_eq)\n  apply(subgoal_tac \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j)\\<longrightarrow>fst(q s!i)\\<noteq>fst(q s!j)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \n   \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> a\\<le>i \\<and> i<a+b) \\<longrightarrow>ownB s i = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow>ownB s a = Q\") prefer 2 \n  apply (metis le_eq_less_or_eq less_add_same_cancel1)\n  apply(subgoal_tac \"i<length(q s) \\<longrightarrow> (\\<exists>a b.((a,b)\\<in>set(q s) \\<and> (a,b) = (q s!i)))\") prefer 2\n  apply (metis nth_mem prod.collapse)\n  apply(subgoal_tac \"i<length(q s) \\<longrightarrow> ownB s (fst(q s!i)) = Q\") prefer 2\n  apply (metis fst_eqD)\n  apply(subgoal_tac \"hd(q s) = (q s!0) \\<and> last(q s) = (q s!(length(q s)-1))\") prefer 2\n  apply (metis hd_conv_nth last_conv_nth)\n  defer \n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> a\\<le>i \\<and> i<a+b) \\<longrightarrow> ownB s i = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"hd(q s) \\<in> set (q s)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.( fst(hd(q s))\\<le>i \\<and> i<fst(hd(q s))+snd(hd(q s))) \\<longrightarrow> ownB s i = Q\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i.(ownB s i\\<noteq>Q \\<and> i>fst(hd(q s))) \\<longrightarrow> i\\<ge>end(last(q s))\") prefer 2 \n  apply (metis (no_types, lifting) end_simp le_eq_less_or_eq nat_le_linear)\n  apply(subgoal_tac \"end(last(q s))\\<le>H s\") prefer 2 \n  apply (metis end_simp)\n  apply (metis (no_types, lifting) F.distinct(19) add_lessD1 le_add_diff_inverse less_imp_le_nat nat_neq_iff)\n  apply(subgoal_tac \"hd(q s)\\<noteq>last(q s)\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessD diff_less less_one zero_less_diff)\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"(\\<forall>a b aa bb . ((a, b) \\<in> set (q s) \\<and>  (aa, bb) \\<in> set (q s)) \\<longrightarrow> a + b \\<ge> aa + bb \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, lifting) less_add_same_cancel1 nat_le_iff_add trans_less_add1)\n  apply(subgoal_tac \"(\\<forall>a b aa bb . ((a, b) \\<in> set (q s) \\<and>  (aa, bb) \\<in> set (q s)) \\<longrightarrow> a <  aa \\<longrightarrow> a + b \\<le> aa + bb)\") prefer 2\n  apply (metis (no_types, lifting) trans_le_add1)\n  by (metis (no_types, lifting) Suc_lessD diff_less less_one nat_less_le prod.collapse)\n*)\n\n  \nlemma pec_prelim_1:\n\" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n  \\<Longrightarrow> 0\\<le>N \\<and> ownB s 0=Q \\<Longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s))\\<and> 0\\<in>x)\"\n  by (metis (no_types, lifting) mem_Collect_eq)\n\nlemma pec_prelim_2:\n\" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n  \\<Longrightarrow> 0\\<le>N \\<and> ownB s 0=Q \\<Longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s))\\<and> 0\\<in>x) \\<Longrightarrow> \\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\"\n  by fastforce\n\n\nlemma pec_prelim_3:\n\" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n\\<Longrightarrow> ownB s (fst(hd(q s)) + snd(hd(q s))) = Q \\<and> (fst(hd(q s)) + snd(hd(q s)))\\<le>N  \n\\<Longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s))\\<and> fst(hd(q s)) + snd(hd(q s))\\<in>x) \n\\<Longrightarrow> \\<exists>a b.((a,b)\\<in>set(q s) \\<and> a\\<le>fst(hd(q s)) + snd(hd(q s)) \\<and> fst(hd(q s)) + snd(hd(q s))<a+b)\" \n  by blast\n\n\nlemma pec_prelim_4:\n\"Q_structure s \\<Longrightarrow> length(q s)>1\n\\<Longrightarrow>\n\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j \\<and> fst(q s!j)<fst(q s!i))\\<longrightarrow>fst(q s!j) + snd(q s!j) < fst(q s!i)+ snd(q s!i)\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply clarify \n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>(q s!i)\\<in>set(q s)\") prefer 2 \n  apply (meson nth_mem)\n  apply(subgoal_tac \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j)\\<longrightarrow>fst(q s!i)\\<noteq>fst(q s!j)\") prefer 2\n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa)\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> b>0\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"\\<forall>a b aa ba. ((a, b) \\<in> set (q s) \\<and>  (aa, ba) \\<in> set (q s) \\<and> a < aa) \\<longrightarrow> a + b < aa+ba\") prefer 2\n  apply (metis Nat.add_diff_assoc2 add_gr_0 zero_less_diff)\n  apply(subgoal_tac \"(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j \\<and> fst(q s!j)<fst(q s!i)) \n\\<longrightarrow> ((q s!i)\\<in>set(q s) \\<and> (q s!j)\\<in>set(q s) \\<and> fst(q s!j)<fst(q s!i))\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(\\<exists>a b aa ba.((a, b) \\<in> set (q s) \\<and>  (aa, ba) \\<in> set (q s) \\<and> a < aa) \\<and> (q s!i) = (aa, ba) \\<and> (q s!j) =(a,b))\") prefer 2 \n  apply (metis prod.collapse)\n  apply(clarify)\n  apply(subgoal_tac \"a+b<aa+ba\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"fst(q s!i) = aa\") prefer 2\n  apply (metis fst_conv)\n  apply(subgoal_tac \"fst(q s!j) = a\") prefer 2\n  apply (metis fst_conv)\n  apply(subgoal_tac \"snd(q s!j) = b\") prefer 2\n  apply (metis snd_conv)\n  apply(subgoal_tac \"snd(q s!i) = ba\") prefer 2\n  apply (metis snd_conv)\n  by metis\n\nlemma pec_prelim_5:\n\"Q_structure s \\<Longrightarrow> length(q s)>1\n\\<Longrightarrow>\n\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j )\\<longrightarrow>fst(q s!j) + snd(q s!j) \\<noteq> fst(q s!i)+ snd(q s!i)\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply clarify apply(case_tac \"fst(q s!i)<fst(q s!j)\") \n  using pec_prelim_4 [where s=s]\n  apply (metis diff_add_inverse diff_is_0_eq less_nat_zero_code list.size(3) nth_mem prod.collapse)\n  using pec_prelim_4 [where s=s]\n  apply(subgoal_tac \"fst(q s!i)>fst(q s!j)\") \n  apply (metis diff_add_inverse diff_is_0_eq less_nat_zero_code list.size(3) nth_mem prod.collapse)\n  by (metis less_nat_zero_code linorder_neqE_nat list.size(3))\n\nlemma pec_prelim_6:\n\"Q_structure s \\<Longrightarrow> length(q s)>2\n\\<Longrightarrow>\n\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j )\\<longrightarrow>fst(q s!j) + snd(q s!j) \\<noteq> fst(q s!i)+ snd(q s!i)\"\n  using pec_prelim_5 [where s=s]\n  by (metis add_lessD1 nat_1_add_1)\n\nlemma pec_prelim_7:\n\"Q_structure s \\<Longrightarrow> length(q s)>2\n\\<Longrightarrow> fst(q s!1) = 0 \\<Longrightarrow>\n\\<forall>i.(i<length(q s) \\<and> i>1)\\<longrightarrow>fst(q s!0) + snd(q s!0) \\<noteq> fst(q s!i)\"\n  using pec_prelim_6 [where s=s] Q_lemmas Q_basic_lemmas \n  by (smt (z3) add_lessD1 diff_add_inverse end_simp less_imp_add_positive list.size(3) nat_neq_iff not_add_less2)\n  \nlemma pec_prelim_8:\n\"Q_structure s \\<Longrightarrow> \n\\<forall>a b aa bb.((a,b)\\<in>set(q s) \\<and> (aa,bb)\\<in>set(q s) \\<and> a+b<aa+bb)\\<longrightarrow>a+b\\<le>aa\"\n  using Q_lemmas Q_basic_lemmas \n  by (smt (verit) Q_gap_lemmas_14 Q_gap_lemmas_15 end_simp fst_eqD length_pos_if_in_set snd_eqD)\n\nlemma pec_prelim_9:\n\"(\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N) \\<and>\n    (\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow> fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0) \\<and>\n    (\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)) \\<and>\n    (\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa) \\<and>\n    (\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s))) \\<and>\n    (\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b) \\<and>\n    (\\<forall>i<length (q s). data_index s (q s ! i) = numDeqs s + i) \\<and>\n    (\\<forall>i<length (q s). snd (q s ! i) = Data s (numDeqs s + i)) \\<and>\n    (\\<forall>i<length (q s). ownD s (i + numDeqs s) = B) \\<and> (\\<forall>i\\<le>N. \\<forall>j\\<le>N. data_index s (i, j) < n)\n\\<Longrightarrow> Q_structure s\"\n  by (simp add:Q_lemmas Q_basic_lemmas)\n\nlemma pec_prelim_10:\n\"(\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N) \\<and>\n    (\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow> fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0) \\<and>\n    (\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)) \\<and>\n    (\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa) \\<and>\n    (\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s))) \\<and>\n    (\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b) \\<and>\n    (\\<forall>i<length (q s). data_index s (q s ! i) = numDeqs s + i) \\<and>\n    (\\<forall>i<length (q s). snd (q s ! i) = Data s (numDeqs s + i)) \\<and>\n    (\\<forall>i<length (q s). ownD s (i + numDeqs s) = B)\n\\<Longrightarrow> Q_structure s\"\n  by (simp add:Q_lemmas Q_basic_lemmas)\n\nlemma pec_prelim_11:\n\"Q_structure s \\<Longrightarrow> \nlength(q s)>2 \\<Longrightarrow> \ni<length(q s) \\<Longrightarrow> \nj<length(q s)\\<Longrightarrow> \nfst(q s!i) = 0 \\<Longrightarrow>\ni\\<noteq>0 \\<Longrightarrow> \nfst(q s!j) = fst(q s!0)+snd(q s!0) \\<Longrightarrow>\nj=1\"\n  apply(simp add: Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using pec_prelim_10 [where s=s]\n  apply auto[1]\n  apply (subgoal_tac \"fst(q s!j)\\<noteq>0\") prefer 2 \n  apply (metis add_is_0 bot_nat_0.not_eq_extremum length_0_conv not_numeral_less_zero nth_mem prod.collapse) \n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> i>1)\\<longrightarrow>fst(q s!0) + snd(q s!0) \\<noteq> fst(q s!i)\")\n  prefer 2 using pec_prelim_7 [where s=s] \n  apply (metis One_nat_def Suc_1 Suc_lessD diff_is_0_eq' le_numeral_extra(4) less_numeral_extra(1) list.size(3) nat_neq_iff)\n  apply(subgoal_tac \"j\\<noteq>i\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> fst(q s!0) + snd(q s!0) =fst(q s!i))\\<longrightarrow>i\\<le>1\")\n  prefer 2 \n  apply (meson less_Suc_eq_le not_less_eq)\n  apply(subgoal_tac \"(i<length(q s) \\<and> fst(q s!0) + snd(q s!0) =fst(q s!i))\\<longrightarrow>i=1\")\n  prefer 2 \n  apply presburger\n  by (metis Suc_diff_1 bot_nat_0.not_eq_extremum diff_add_inverse diff_is_0_eq' diff_self_eq_0 length_0_conv nth_mem surjective_pairing)\n\n\nlemma R_idle_to_nidle_lemma_case_1_6_1:\n  \"case_2 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> fst(hd(q s)) = T s \\<Longrightarrow> H s = fst(last(q s))+snd(last(q s))\n\\<Longrightarrow>case_2 s'\"\n  apply(subgoal_tac \"T s\\<noteq>0\") prefer 2\n  apply(simp add:case_2_lemmas) \n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply (metis RingBuffer_BD_latest_3.inv_def)\n  apply (metis gr0I less_nat_zero_code)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using pec_prelim_9 [where s=s]\n  apply blast\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:pre_R_def pre_dequeue_inv_def)\n  apply(simp add:case_2_lemmas ) \n  apply(clarify) \n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) le_antisym less_or_eq_imp_le list.set_sel(1) nat_neq_iff prod.collapse)\n  apply(rule_tac ?x = \"0\" in exI)\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI)  \n  apply blast\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) \n  apply fastforce  \n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply(subgoal_tac \"H s < T s\") prefer 2\n  apply linarith\n  apply linarith\n  apply(rule_tac ?x = \"fst(hd(q s)) + snd(hd(q s))\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"f\" in exI)\n  apply(intro conjI impI)  \n  apply (metis (no_types, lifting) F.distinct(21) le_eq_less_or_eq linorder_neqE_nat)\n  apply linarith \n  apply metis \n  apply (metis Suc_leI le_less_Suc_eq le_trans less_or_eq_imp_le not_less_eq not_less_eq_eq)\n  apply (metis le_antisym less_irrefl_nat less_or_eq_imp_le)\n  apply (metis Suc_leI not_less_eq_eq)\n  apply (metis trans_less_add1)\n  apply (metis diff_is_0_eq' le_add1 le_less_Suc_eq le_trans not_less_eq zero_less_diff)\n  apply clarify\n  apply(intro conjI impI) \n  apply (metis (no_types, lifting) F.distinct(21) le_eq_less_or_eq le_less_trans)\n  apply metis\n  apply metis\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  using add_gr_0 apply presburger\n  apply meson\n  apply linarith\n  apply force\n  apply force\n  apply force\n  apply force\n  apply force\n  using diff_add_inverse apply presburger\n  apply(intro iffI) prefer 2 \n  apply (metis bot_nat_0.not_eq_extremum)\n  apply(subgoal_tac \"H s>0\") prefer 2 \n  using add_gr_0 apply presburger\n  apply(subgoal_tac \"ownB s 0 = Q \\<and> 0\\<le>N\") prefer 2\n  apply (metis gr_zeroI zero_le)\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\") prefer 2 using pec_prelim_2 [where s=s]\n  apply presburger\n  apply(subgoal_tac \"hd(q s) \\<in> set(q s)\") prefer 2\n  apply (metis list.set_sel(1))\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"\\<exists>j.(j<length(q s) \\<and> fst(q s!j) = 0)\") prefer 2 \n  apply (metis (no_types, lifting) fst_eqD in_set_conv_nth)\n  apply(subgoal_tac \"length(q s)\\<ge>2\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq length_0_conv less_2_cases_iff less_Suc0 neq0_conv zero_less_diff)\n  apply linarith\n  defer\n  apply(subgoal_tac \"ownB s (f) \\<noteq> Q\") prefer 2 \n  apply (metis F.distinct(21) F.distinct(23) eq_imp_le le_neq_implies_less)\n  apply(subgoal_tac \"length(q s) > 1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_Suc_1 hd_conv_nth last_conv_nth length_greater_0_conv not_add_less1)\n  apply(subgoal_tac \" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {j. a \\<le> j \\<and> j < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<forall>star b.((star,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> star \\<in> x)\") prefer 2\n  apply (metis (no_types, lifting) diff_add_inverse le_refl mem_Collect_eq zero_less_diff)\n  apply(subgoal_tac \"\\<forall>star b.((star,b)\\<in>set(q s))\\<longrightarrow> (star \\<le> N \\<and> ownB s star = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s 0 = Q\") prefer 2\n  apply (metis bot_nat_0.extremum bot_nat_0.not_eq_extremum)\n  apply(subgoal_tac \"fst(q s!1) = fst(q s!0)+snd(q s!0) \\<longrightarrow> ownB s f = Q\") prefer 2 \n  apply (metis hd_conv_nth nth_mem prod.collapse)\n  apply(subgoal_tac \"fst(q s!1) = fst(tl(q s)!0)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def Suc_leI diff_is_0_eq diffs0_imp_equal length_0_conv length_greater_0_conv length_tl less_not_refl3 nth_tl)\n  apply(subgoal_tac \"fst(q s!1) = fst(hd(tl(q s)))\") prefer 2 \n  apply (metis diff_is_0_eq' hd_conv_nth length_tl list.size(3) zero_less_diff)\n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 zero_less_Suc)\n  apply(subgoal_tac \"tl(q s)\\<noteq>[]\")\n  apply (metis last_tl)\n  defer\n  apply (metis bot_nat_0.not_eq_extremum)\n  apply (metis add_cancel_right_right hd_in_set less_SucE less_add_Suc1 prod.exhaust_sel)\n  apply (metis add_eq_self_zero list.set_sel(1) prod.collapse)\n  apply(subgoal_tac \"ownB s (fst (hd (q s)) + snd (hd (q s))) = Q\") prefer 2\n  apply (metis le_add1 le_less_Suc_eq not_less_eq)\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_Suc_1 hd_conv_nth last_conv_nth length_greater_0_conv not_add_less1)\n  apply(subgoal_tac \"(hd (tl (q s))) = (q s!1) \") prefer 2\n  apply (metis (no_types, lifting) One_nat_def hd_conv_nth length_tl lessI list.size(3) not_less_eq nth_tl zero_less_diff)\n  defer\n  apply(subgoal_tac \"ownB s 0 = Q\") prefer 2\n  apply (metis gr_zeroI zero_le)\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {j. a \\<le> j \\<and> j < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\") prefer 2 \n  using bot_nat_0.extremum apply presburger\n  apply (metis head_q0 last_conv_nth length_pos_if_in_set length_tl list.size(3) not_add_less1)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s))\\<le>N \\<and> ownB s (fst (hd (q s)) + snd (hd (q s))) = Q\")\n  prefer 2 \n  apply (metis Suc_le_lessD not_less_eq_eq)\n  apply(subgoal_tac \" (\\<exists>x. (\\<exists>a b. x = {j. a \\<le> j \\<and> j < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> (fst (hd (q s)) + snd (hd (q s))) \\<in> x) \") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a \\<le> fst (hd (q s)) + snd (hd (q s)) \\<and> fst (hd (q s)) + snd (hd (q s))<a+b)\") prefer 2\n  using pec_prelim_3 [where s=s] \n  apply presburger\n  apply(subgoal_tac \"ownB s 0 = Q \\<and> 0\\<le>N\") prefer 2 \n  apply (metis bot_nat_0.not_eq_extremum zero_le)\n  apply clarify\n  apply(subgoal_tac \"(fst(hd(q s)),snd(hd(q s))) \\<in>set (q s)\") prefer 2 \n  apply (metis hd_in_set prod.collapse)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"ab\\<ge> fst(hd(q s)) + snd(hd(q s))\") prefer 2\n  using pec_prelim_8 [where s=s] \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a \\<le> 0 \\<and> 0<a+b)\") prefer 2\n  using pec_prelim_3 [where s=s] \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(clarify)\n  apply(subgoal_tac \"(aa,ba)\\<noteq>(hd(q s))\") prefer 2\n  apply (metis Pair_inject less_irrefl_nat prod.collapse)\n  apply(subgoal_tac \"(0,bc)\\<noteq>(hd(q s))\") prefer 2 \n  apply (metis fst_conv)\n  apply(subgoal_tac \"(aa,ba)\\<noteq>(0,bc)\") prefer 2 \n  apply (metis (no_types, lifting) \\<open>Q_structure s \\<Longrightarrow> \\<forall>a b aa bb. (a, b) \\<in> set (q s) \\<and> (aa, bb) \\<in> set (q s) \\<and> a + b < aa + bb \\<longrightarrow> a + b \\<le> aa\\<close> add_eq_0_iff_both_eq_0 le_zero_eq prod.inject)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> (q s!i) = (a,b)))\") prefer 2\n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<exists>i.(i<length(q s) \\<and> (aa,ba) =(q s!i))\") prefer 2\n  apply metis\n  apply(subgoal_tac \"\\<exists>i.(i<length(q s) \\<and> (0,bc) =(q s!i))\") prefer 2\n  apply metis\n  apply (subgoal_tac \"length(q s) > 2\") prefer 2 \n  apply (metis Suc_lessI hd_conv_nth less_Suc_eq less_one nat_1_add_1 plus_1_eq_Suc)\n  apply(subgoal_tac \"\\<exists>ass.(ass <length(q s) \\<and> (q s!ass) = (0,bc) \\<and> fst(q s!ass) = 0)\") prefer 2 \n  apply (metis prod.collapse prod.inject)\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a = fst(hd(q s)) + snd(hd(q s)))\") prefer 2\n  apply (metis le_antisym)\n  apply clarify \n  apply(subgoal_tac \"\\<exists>tru.(tru<length(q s) \\<and> (fst (hd (q s)) + snd (hd (q s)), bd) =(q s!tru))\")\n  prefer 2 \n  apply metis\n  apply clarify\n  apply(subgoal_tac \"ass<length(q s)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"tru<length(q s)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"ass\\<noteq>0\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"fst(q s!tru) = fst(q s!0)+snd(q s!0) \") prefer 2 \n  apply (metis fst_conv hd_conv_nth)\n  apply(subgoal_tac \"tru = 1\") \n  apply (metis fst_conv)\n  proof -\n  fix a :: nat and b :: nat and c :: nat and d :: nat and e :: nat and f :: nat and x :: \"nat set\" and aa :: nat and ba :: nat and ab :: nat and bb :: nat and ac :: nat and bc :: nat and i :: nat and ia :: nat and assa :: nat and ad :: nat and bd :: nat and trua :: nat\n  assume a1: \"Q_structure s\"\n  assume a2: \"2 < length (q s)\"\n  assume a3: \"assa < length (q s)\"\n  assume a4: \"fst (q s ! assa) = 0\"\n  assume a5: \"trua < length (q s)\"\n  assume a6: \"assa \\<noteq> 0\"\n  assume \"fst (q s ! trua) = fst (q s ! 0) + snd (q s ! 0)\"\n  then show \"trua = 1\"\n    using a6 a5 a4 a3 a2 a1 by (meson pec_prelim_11)\n  next\n  qed\n\n\nlemma str_pec_3:\n  \"Q_structure s \\<Longrightarrow> fst(hd(q s)) = 0 \\<Longrightarrow> length(q s)>1 \n\\<Longrightarrow> fst(q s!(length(q s) -1))\\<ge>fst(q s!0)+snd(q s!0)\"\n  apply(simp add:Q_lemmas Q_basic_lemmas) \n  apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n  apply (metis Suc_lessD head_q0)\n  by (metis diff_less lessI less_nat_zero_code list.size(3) nat_neq_iff nth_mem prod.collapse zero_less_diff)\n  \n\nlemma str_pec_4:\n  \"Q_structure s \\<Longrightarrow> fst(hd(q s)) = 0 \\<Longrightarrow> length(q s)>1 \n\\<Longrightarrow> fst(last(q s))\\<ge>fst(hd(q s))+snd(hd(q s))\"\n  apply(subgoal_tac \"fst(q s!(length(q s) -1))\\<ge>fst(q s!0)+snd(q s!0)\") prefer 2\n  using str_pec_3 [where s=s]\n  apply blast\n  apply(simp add:Q_lemmas Q_basic_lemmas) \n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis Suc_lessD head_q0)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1)\") prefer 2\n  apply (metis last_conv_nth less_nat_zero_code list.size(3))\n  by (metis One_nat_def plus_nat.add_0)\n  \n\nlemma str_pec_5:\n  \"Q_structure s \\<Longrightarrow> fst(hd(q s)) = 0 \\<Longrightarrow> length(q s)>1 \n\\<Longrightarrow> snd(last(q s))+fst(last(q s))>fst(hd(q s))+snd(hd(q s))\"\n  apply(subgoal_tac \"fst(last(q s))\\<ge>fst(hd(q s))+snd(hd(q s))\") prefer 2\n  using str_pec_4 [where s=s]\n  apply blast \n  apply(simp add:Q_lemmas Q_basic_lemmas) apply(subgoal_tac \"snd(last(q s))>0\") prefer 2 \n  apply (metis last_in_set less_nat_zero_code list.size(3) prod.collapse)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis Suc_lessD head_q0)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1)\") prefer 2\n  apply (metis last_conv_nth less_nat_zero_code list.size(3)) \n  by linarith\n\n\nlemma R_idle_to_nidle_lemma_case_1_6_2:\n  \"case_2 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> fst(hd(q s)) \\<noteq> T s \\<Longrightarrow> H s \\<noteq> fst(last(q s))+snd(last(q s))\n\\<Longrightarrow>case_2 s'\"\n  apply(subgoal_tac \"T s\\<noteq>0\") prefer 2\n  apply(simp add:case_2_lemmas) \n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply (metis RingBuffer_BD_latest_3.inv_def)\n  apply (metis gr0I less_nat_zero_code)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using pec_prelim_9 [where s=s]\n  apply blast\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:pre_R_def pre_dequeue_inv_def)\n  apply(simp add:case_2_lemmas ) \n  apply(clarify) \n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) le_antisym less_or_eq_imp_le list.set_sel(1) nat_neq_iff prod.collapse)\n  apply(rule_tac ?x = \"fst (hd (q s))+snd(hd(q s))\" in exI)\n  apply(rule_tac ?x = \"fst (last (q s)) + snd (last (q s))\" in exI)\n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) F.distinct(3) bot_nat_0.not_eq_extremum diff_diff_cancel diff_is_0_eq diff_is_0_eq' eq_imp_le le_antisym linorder_neqE_nat zero_less_diff)\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) \n  apply (metis le_neq_implies_less)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply linarith \n  apply (metis bot_nat_0.extremum le_neq_implies_less)\n  apply (metis Suc_leI le_add1 le_neq_implies_less le_trans not_less_eq_eq) \n  apply (metis (no_types, lifting) F.distinct(3) le_neq_implies_less)\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply (metis le_neq_implies_less)\n  apply (metis Suc_diff_Suc Zero_not_Suc diff_is_0_eq')\n  apply (metis (no_types, hide_lams) F.distinct(21) nat_less_le)\n  apply blast\n  apply blast\n  apply fastforce\n  apply fastforce\n  apply blast\n  apply blast\n  apply blast \n  apply (metis nat_less_le)\n  apply (metis nat_less_le)\n  apply (metis le_neq_implies_less)\n  apply (metis add_cancel_right_left le_neq_implies_less)\n  apply (metis le_neq_implies_less)\n  apply (metis le_neq_implies_less)\n  defer \n  apply fastforce\n  defer defer \n  apply force\n  apply (metis add_cancel_right_left le_neq_implies_less list.set_sel(1) prod.collapse)\n  apply (metis add_cancel_right_left le_neq_implies_less list.set_sel(1) prod.collapse)\n  apply(intro iffI)\n  prefer 2 \n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1 ) \") prefer 2 \n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"last(q s) \\<noteq> hd(q s) \\<longrightarrow> length(q s)>1\") prefer 2 \n  apply (metis One_nat_def)\n  using str_pec_5 [where s=s] \n  apply (metis (no_types, hide_lams) One_nat_def add.commute nat_less_le)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s)) < fst (last (q s)) + snd (last (q s))\") prefer 2\n  apply force\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1 ) \") prefer 2 \n  apply (metis last_conv_nth)\n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_self_eq_0 length_greater_0_conv less_not_refl2)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = q s!1\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def hd_conv_nth last_conv_nth length_greater_0_conv length_tl list.size(3) nat_neq_iff nth_tl)\n  apply(subgoal_tac \"fst(q s!0) = 0\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s)) = fst(q s!0) + snd(q s!0)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)\") prefer 2\n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_add_inverse last_conv_nth length_greater_0_conv nat_neq_iff plus_1_eq_Suc)\n  apply(subgoal_tac \"fst(q s!0) \\<noteq> fst(q s!1)\") prefer 2 \n  apply (metis (no_types, hide_lams) bot_nat_0.not_eq_extremum length_greater_0_conv less_one)\n  apply (metis (no_types, hide_lams) Suc_diff_1 diff_self_eq_0 less_one)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s)-1)\") prefer 2 \n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"length(tl(q s)) = length(q s)-1\") prefer 2\n  apply (metis length_tl)\n  apply(subgoal_tac \"last(tl(q s)) = (tl(q s)!(length(tl(q s)) -1))\") prefer 2 \n  apply (metis (no_types, lifting) hd_conv_nth last_conv_nth length_0_conv less_not_refl2)\n  apply(subgoal_tac \"last(tl(q s)) = (tl(q s)!(length(q s) -2))\") prefer 2 \n  apply (metis Suc_1 diff_Suc_eq_diff_pred)\n  by (metis (no_types, hide_lams) hd_conv_nth last_tl length_0_conv nat_less_le)\n\n\nlemma R_idle_to_nidle_lemma_case_1_6_3:\n  \"case_2 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> fst(hd(q s)) = T s \\<Longrightarrow> H s \\<noteq> fst(last(q s))+snd(last(q s))\n\\<Longrightarrow>case_2 s'\"\n  apply(subgoal_tac \"T s\\<noteq>0\") prefer 2\n  apply(simp add:case_2_lemmas) \n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply (metis RingBuffer_BD_latest_3.inv_def)\n  apply (metis gr0I less_nat_zero_code)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using pec_prelim_9 [where s=s]\n  apply blast\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:pre_R_def pre_dequeue_inv_def)\n  apply(simp add:case_2_lemmas ) \n  apply(clarify) \n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) le_antisym less_or_eq_imp_le list.set_sel(1) nat_neq_iff prod.collapse)\n  apply(rule_tac ?x = \"0\" in exI)\n  apply(rule_tac ?x = \"offset s\" in exI)\n  apply(intro conjI impI)  \n  apply blast\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) \n  apply (metis nat_less_le)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply(subgoal_tac \"H s < T s\") prefer 2\n  apply linarith\n  apply linarith\n  apply(rule_tac ?x = \"fst(hd(q s)) + snd(hd(q s))\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"f\" in exI)\n  apply(intro conjI impI)  \n  apply (metis (no_types, lifting) F.distinct(21) le_eq_less_or_eq linorder_neqE_nat)\n  apply linarith \n  apply metis \n  apply (metis Suc_leI le_less_Suc_eq le_trans less_or_eq_imp_le not_less_eq not_less_eq_eq) \n  apply (metis F.distinct(3) bot_nat_0.not_eq_extremum le_neq_implies_less)\n  apply (metis Suc_leI not_less_eq_eq)\n  apply (metis trans_less_add1)\n  apply (metis diff_is_0_eq' le_add1 le_less_Suc_eq le_trans not_less_eq zero_less_diff)\n  apply clarify\n  apply(intro conjI impI)\n  apply(subgoal_tac \"ownB s i = Q\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"j\\<ge>f \\<and> j\\<le>N \\<longrightarrow> ownB s j \\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(21) F.distinct(23) le_neq_implies_less)\n  apply(subgoal_tac \" T s + snd (hd (q s)) \\<le>N\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \" T s + snd (hd (q s)) \\<le>f\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(21) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"i < T s + snd (hd (q s))\") prefer 2\n  apply meson\n  apply linarith\n  apply metis\n  apply metis\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  using add_gr_0 apply presburger\n  apply meson\n  apply linarith\n  apply force \n  apply (metis nat_less_le)\n  apply force\n  apply force\n  apply force\n  using diff_add_inverse apply presburger\n  apply(intro iffI) prefer 2 \n  apply(subgoal_tac \"(fst(q s!1) = fst(q s!0)+snd(q s!0)) \\<or> fst(q s!1) =0\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 less_one)\n  apply(subgoal_tac \"(q s!0) =hd(q s)\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"(q s!1) =hd(tl(q s))\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def hd_conv_nth length_tl lessI list.size(3) not_less_eq nth_tl zero_less_diff)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"(q s!1)\\<in>set(q s)\") prefer 2 \n  apply (metis One_nat_def nth_mem)\n  apply(subgoal_tac \"(q s!1) = (sta,leng) \\<longrightarrow> (sta,leng)\\<in>set(q s)\") prefer 2 \n  apply metis\n  apply(case_tac \"fst(q s!1) = 0\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(21) le_eq_less_or_eq linorder_neqE_nat prod.collapse)\n  apply(subgoal_tac \"0<offset s\") \n  apply meson\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. ( x = {i. fst(hd(tl(q s))) \\<le> i \\<and> i < fst(hd(tl(q s))) + snd(hd(tl(q s)))} ) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\") prefer 2\n  apply(subgoal_tac \"(fst(hd(tl(q s))),snd(hd(tl(q s))))\\<in>set(q s)\") prefer 2 \n  apply (metis prod.collapse)\n  apply (metis (no_types, lifting) mem_Collect_eq) defer \n  apply(case_tac \"0<offset s\") \n  apply(subgoal_tac \"\\<exists>i.(fst(q s!i) =0 \\<and> i<length(q s))\") \n  apply (metis Suc_lessI hd_conv_nth length_greater_0_conv less_Suc0)\n  apply(subgoal_tac \"ownB s 0 = Q\") prefer 2 \n  apply (metis gr_zeroI zero_le)\n  apply(subgoal_tac \"\\<forall>i. (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(0 \\<le> N \\<and> ownB s 0 = Q)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<exists>sta leng.((sta,leng)\\<in>set(q s) \\<and> sta=0)\") prefer 2 \n  apply (metis gr_implies_not_zero mem_Collect_eq nat_less_le)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> q s!i=(a,b)))\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply clarify\n  apply(subgoal_tac \"k<length(q s) \\<and> (q s!k) = (0,leng) \\<longrightarrow> k\\<noteq>0\") prefer 2\n  apply (metis fst_conv hd_conv_nth)\n  apply (metis fst_eqD)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s)) < f\") prefer 2 \n  apply meson\n  apply(subgoal_tac \"i\\<ge>fst (hd (q s)) + snd (hd (q s)) \\<and> i<f \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis add_leD1 le_eq_less_or_eq)\n  apply(subgoal_tac \"\\<forall>i. (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s))\\<le>N \\<and> ownB s (fst (hd (q s)) + snd (hd (q s))) = Q\") prefer 2\n  apply (metis Suc_le_lessD le_add1 le_neq_implies_less not_less_eq_eq)\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a\\<le>fst (hd (q s)) + snd (hd (q s)) \\<and> fst (hd (q s)) + snd (hd (q s))<a+b)\")\n  prefer 2 \n  using pec_prelim_3 [where s=s ]\n  apply presburger apply clarify\n  apply(subgoal_tac \"\\<exists>i.(i<length(q s) \\<and> q s!i = (aa,ba))\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"aa\\<noteq>fst(hd(q s))\") prefer 2 \n  apply (metis (no_types, lifting) fst_eqD hd_conv_nth length_pos_if_in_set nat_neq_iff snd_eqD)\n  apply clarify\n  apply(subgoal_tac \"ia\\<noteq>0\") prefer 2 \n  apply (metis fst_eqD hd_conv_nth)\n  apply linarith\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = q s!1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def diff_is_0_eq' hd_conv_nth last_conv_nth le_add1 le_add_diff_inverse2 le_less_Suc_eq le_trans length_greater_0_conv length_tl less_or_eq_imp_le list.size(3) not_less_eq nth_tl)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2\n  apply presburger\n  apply(case_tac \"b=0\")\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s 0\\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(3))\n  apply(subgoal_tac \"i<fst(q s!0) \\<longrightarrow> ownB s i\\<noteq>Q\") prefer 2 \n  apply (metis (no_types, hide_lams) F.distinct(19) bot_nat_0.extremum diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x.(x = {i. a\\<le>i \\<and> i < a + b} \\<and> a\\<in>x))\") prefer 2\n  apply (metis Nat.add_0_right le_refl mem_Collect_eq nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> ownB s a = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis One_nat_def Suc_lessI diff_Suc_1 last_conv_nth length_greater_0_conv nat_neq_iff)\n  apply(subgoal_tac \"\\<nexists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\") prefer 2\n  apply metis\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> q s!i = (a,b)))\")\n  prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"fst(q s!1)\\<noteq>0\") prefer 2\n  apply (metis nth_mem prod.collapse)\n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 less_one)\n  apply(subgoal_tac \"\\<forall>i.  (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s 0 = Q \\<and> 0\\<le>N\") prefer 2\n  apply (metis gr_zeroI zero_le)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\") prefer 2\n  using pec_prelim_2 [where s=s] \n  apply presburger\n  apply clarify\n  apply(subgoal_tac \"ownB s (fst (hd (q s)) + snd (hd (q s))) = Q \\<and> fst (hd (q s)) + snd (hd (q s))\\<le>N\") prefer 2 \n  apply (metis Suc_le_lessD le_add1 le_less_Suc_eq not_less_eq_eq)\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> fst (hd (q s)) + snd (hd (q s)) \\<in> x)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.(a\\<le>fst (hd (q s)) + snd (hd (q s)) \\<and> fst (hd (q s)) + snd (hd (q s))<a+b \\<and> (a,b)\\<in>set(q s))\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply clarify\n  apply(subgoal_tac \"\\<exists>ass. (ass<length(q s) \\<and> q s!ass = (0,ba))\") prefer 2 \n  apply (metis in_set_conv_nth) \n  apply(subgoal_tac \"\\<exists>tru. (tru<length(q s) \\<and> q s!tru = (ad,bd))\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(clarify)\n  apply(subgoal_tac \"ad = fst(hd(q s))+snd(hd(q s))\") prefer 2\n  apply (metis (no_types, lifting) hd_in_set le_antisym pec_prelim_8 prod.collapse)\n  apply(subgoal_tac \"ad\\<noteq>0\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"ass\\<noteq>tru\") prefer 2\n  apply (metis fst_conv)\n  apply(subgoal_tac \"ass\\<noteq>0\") prefer 2 \n  apply (metis fst_conv)\n  apply(subgoal_tac \"tru\\<noteq>0\") prefer 2\n  apply (metis fst_conv less_irrefl_nat snd_conv)\n  apply(subgoal_tac \"length(q s)>2\") prefer 2\n  using Nat.lessE Suc_1 Suc_diff_1 Suc_lessI bot_nat_0.not_eq_extremum apply linarith\n  apply(subgoal_tac \"Q_structure s\") prefer 2 apply presburger \n  apply(subgoal_tac \"fst(q s!ass) = 0\") prefer 2\n  apply (metis prod.collapse prod.inject)\n  apply(subgoal_tac \"fst(q s!tru) = fst(q s!0) + snd(q s!0)\") prefer 2 \n  apply (metis prod.collapse prod.inject)\n  apply(subgoal_tac \"ass<length(q s) \\<and> tru<length(q s)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"tru=1\") prefer 2   \n  defer using pec_prelim_11 [where s=s and i=ass and j=tru]\n  apply metis\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI add_leD1 diff_Suc_1 hd_conv_nth last_conv_nth le_antisym le_neq_implies_less length_greater_0_conv less_or_eq_imp_le)\n  apply(subgoal_tac \"ownB s (fst(hd(q s))+snd(hd(q s))) \\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(21) F.distinct(23) eq_imp_le le_neq_implies_less)\n  apply(subgoal_tac \"\\<forall>i.  (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x.(x = {i. a\\<le>i \\<and> i < a + b} \\<and> a\\<in>x))\") prefer 2\n  apply (metis Nat.add_0_right le_refl mem_Collect_eq nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> ownB s a = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow>(a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.set_sel(2))\n  apply(subgoal_tac \"hd(tl(q s))\\<in>set(tl(q s))\") prefer 2 \n  apply (metis diff_is_0_eq' hd_in_set length_tl list.size(3) zero_less_diff)\n  apply(subgoal_tac \"hd(tl(q s)) \\<in>set (q s)\") prefer 2\n  apply (metis list.set_sel(2))\n  apply(subgoal_tac \"ownB s (fst(hd(tl(q s)))) = Q\") prefer 2 \n  apply (metis prod.collapse)\n  apply(subgoal_tac \"ownB s (fst(hd(q s))+snd(hd(q s))) \\<noteq>Q\") prefer 2\n  apply blast\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = q s!1\") prefer 2 \n  apply (metis One_nat_def hd_conv_nth length_greater_0_conv length_pos_if_in_set nth_tl)\n  apply(subgoal_tac \"fst(hd(tl(q s)))\\<noteq>fst(hd(q s))+snd(hd(q s))\") prefer 2\n  apply metis\n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 less_one)\n  apply(subgoal_tac \"fst(last(q s)) + snd(last(q s)) = offset s\") prefer 2\n  apply (metis nat_less_le)\n  apply(subgoal_tac \"0<b\") prefer 2 \n  apply (metis bot_nat_0.not_eq_extremum)\n  apply(subgoal_tac \"\\<forall>i.  (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s 0 = Q \\<and> 0\\<le>N\") prefer 2\n  apply (metis gr_zeroI zero_le)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\") prefer 2\n  using pec_prelim_2 [where s=s] \n  apply presburger\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> (a,b) = q s!i))\") prefer 2\n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"length(q s)>1\") prefer 2\n  apply (metis One_nat_def Suc_lessI add_leD1 diff_Suc_1 hd_conv_nth last_conv_nth le_antisym length_pos_if_in_set less_or_eq_imp_le nat_neq_iff)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s)-1)\") prefer 2\n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"length(tl(q s)) = length(q s)-1\") prefer 2 \n  apply (metis length_tl)\n  apply(subgoal_tac \"last(tl(q s)) = q s!(length(q s)-1)\") prefer 2\n  apply (metis F.distinct(11) last_tl list.size(3) zero_less_diff)\n  apply metis\n  apply(subgoal_tac \"offset s = b\") prefer 2\n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"\\<forall>i.  (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x.(x = {i. a\\<le>i \\<and> i < a + b} \\<and> a\\<in>x))\") prefer 2\n  apply (metis Nat.add_0_right le_refl mem_Collect_eq nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> ownB s a = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow>(a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.set_sel(2))\n  apply(subgoal_tac \"ownB s (fst (hd (q s)) + snd (hd (q s))) = Q \\<and> fst (hd (q s)) + snd (hd (q s))\\<le>N\") prefer 2 \n  apply (metis Suc_le_lessD le_add1 le_less_Suc_eq not_less_eq_eq)\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> fst (hd (q s)) + snd (hd (q s)) \\<in> x)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.(a\\<le>fst (hd (q s)) + snd (hd (q s)) \\<and> fst (hd (q s)) + snd (hd (q s))<a+b \\<and> (a,b)\\<in>set(q s))\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply clarify\n  apply(subgoal_tac \"\\<exists>tru. (tru<length(q s) \\<and> q s!tru = (ab,bb))\") prefer 2 \n  apply (metis (no_types, lifting) in_set_conv_nth)\n  apply(clarify)\n  apply(subgoal_tac \"tru\\<noteq>0\") prefer 2 \n  apply (metis fst_conv hd_conv_nth less_irrefl_nat snd_conv) apply(subgoal_tac \"length(q s)>1\") \n  prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow>(a,b)\\<in>set(q s)\") prefer 2\n  apply meson\n  apply(subgoal_tac \"last(q s) = last(tl(q s))\") prefer 2\n  apply (metis diff_is_0_eq' last_tl length_tl list.size(3) zero_less_diff)\n  apply (metis nat_less_le)\n  apply (metis diff_add_inverse diff_is_0_eq' le_less_Suc_eq linorder_neqE_nat list.set_sel(1) not_add_less1 not_less_eq prod.collapse)\n  apply (metis add_eq_self_zero list.set_sel(1) prod.collapse)\n  proof -\n  fix a :: nat and b :: nat and c :: nat and d :: nat and e :: nat and f :: nat and x :: \"nat set\" and aa :: nat and ba :: nat and ab :: nat and bb :: nat and xa :: \"nat set\" and ac :: nat and bc :: nat and ad :: nat and bd :: nat and assa :: nat and trua :: nat\n  assume a1: \"Q_structure s\"\n  assume a2: \"assa < length (q s)\"\n  assume a3: \"trua < length (q s)\"\n  assume a4: \"assa \\<noteq> 0\"\n  assume a5: \"2 < length (q s)\"\n  assume a6: \"fst (q s ! assa) = 0\"\n  assume \"fst (q s ! trua) = fst (q s ! 0) + snd (q s ! 0)\"\n  then show \"trua = 1\"\n  using a6 a5 a4 a3 a2 a1 by (metis (no_types) pec_prelim_11)\n  next\n  show \" \\<And>a b c d e f.\n       pcR s = idleR \\<Longrightarrow> s' = s\n       \\<lparr>ownB := \\<lambda>i. if T s \\<le> i \\<and> i < T s + snd (hd (q s)) then R else ownB s i, numDeqs := Suc (numReads s), ownT := R,\n          tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr> \\<Longrightarrow>  q s \\<noteq> [] \\<Longrightarrow>  fst (hd (q s)) = T s \\<Longrightarrow> H s \\<noteq> fst (last (q s)) + snd (last (q s)) \\<Longrightarrow> 0 < T s \\<Longrightarrow> Q_structure s \\<Longrightarrow> 0 < n \\<Longrightarrow> tempR s = (0, 0) \\<Longrightarrow> H s \\<le> N \\<Longrightarrow> 0 \\<le> b \\<Longrightarrow> n < N \\<Longrightarrow>  numDeqs s = numReads s \\<Longrightarrow> T s \\<le> N \\<Longrightarrow>   b \\<le> H s \\<Longrightarrow>  numEnqs s \\<le> n \\<Longrightarrow> ownT s = Q \\<Longrightarrow> hW s \\<le> N \\<Longrightarrow>   H s < T s \\<Longrightarrow> numReads s \\<le> numEnqs s \\<Longrightarrow> \\<forall>i<n. Data s i \\<le> N \\<and> 0 < Data s i \\<Longrightarrow> \\<forall>i. T s \\<le> i \\<and> i < T s + snd (hd (q s)) \\<longrightarrow> ownB s i = Q \\<Longrightarrow> \\<forall>i. (i < fst (tempR s) \\<longrightarrow> ownB s i \\<noteq> R) \\<and> (fst (tempR s) + snd (tempR s) \\<le> i \\<and> i \\<le> N \\<longrightarrow> ownB s i \\<noteq> R) \\<Longrightarrow>\n       tW s \\<le> N \\<Longrightarrow>  T s \\<le> e \\<Longrightarrow>  0 < H s \\<Longrightarrow> e \\<le> f \\<Longrightarrow> \\<forall>i. (i < numReads s \\<longrightarrow> ownD s i = R) \\<and>\n           (numReads s \\<le> i \\<and> i < numWrites s \\<longrightarrow> ownD s i = B) \\<and> (numWrites s \\<le> i \\<and> i < n \\<longrightarrow> ownD s i = W) \\<Longrightarrow>\n       f \\<le> N \\<Longrightarrow>  numEnqs s - numReads s = length (q s) \\<Longrightarrow> \\<forall>i<0. ownB s i = R \\<Longrightarrow> numReads s \\<le> numWrites s \\<Longrightarrow>\\<forall>i. 0 \\<le> i \\<and> i < b \\<longrightarrow> ownB s i = Q \\<Longrightarrow> numWrites s \\<le> n \\<Longrightarrow> \\<forall>i. b \\<le> i \\<and> i < H s \\<longrightarrow> ownB s i = W \\<Longrightarrow>\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N \\<Longrightarrow> \\<forall>i. H s \\<le> i \\<and> i < T s \\<longrightarrow> ownB s i = B \\<Longrightarrow> \\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n           fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \\<Longrightarrow>\n       \\<forall>i. T s \\<le> i \\<and> i < e \\<longrightarrow> ownB s i = R \\<Longrightarrow>\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j) \\<Longrightarrow>\\<forall>i. e \\<le> i \\<and> i < f \\<longrightarrow> ownB s i = Q \\<Longrightarrow> \\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa \\<Longrightarrow>\\<forall>i. f \\<le> i \\<and> i < N \\<longrightarrow> ownB s i = D \\<Longrightarrow>\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s)) \\<Longrightarrow> ownB s N = F.None \\<Longrightarrow> \\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b \\<Longrightarrow> 0 < 0 \\<longrightarrow> e = T s \\<Longrightarrow> \\<forall>i<length (q s). data_index s (q s ! i) = numReads s + i \\<Longrightarrow>\n       T s < e \\<longrightarrow> 0 = 0 \\<Longrightarrow>\\<forall>i<length (q s). snd (q s ! i) = Data s (numReads s + i) \\<Longrightarrow>e < f \\<longrightarrow> 0 = 0 \\<Longrightarrow> \\<forall>i<length (q s). ownD s (i + numReads s) = B \\<Longrightarrow> 0 < H s \\<Longrightarrow>\\<forall>i\\<le>N. \\<forall>j\\<le>N. data_index s (i, j) < n \\<Longrightarrow>\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q) \\<Longrightarrow>\n       b < H s \\<longrightarrow> offset s = b \\<Longrightarrow>b < H s \\<longrightarrow> Data s (numEnqs s) = H s - b \\<Longrightarrow> T s < e \\<longrightarrow> T s = 0 \\<Longrightarrow>\\<not> T s < e \\<Longrightarrow> e < f \\<or> 0 < b \\<Longrightarrow> e < f \\<longrightarrow> T s = e \\<Longrightarrow> f = e \\<and> 0 < b \\<longrightarrow> T s = 0 \\<Longrightarrow>0 < b \\<longrightarrow> fst (last (q s)) + snd (last (q s)) = b \\<Longrightarrow>b = 0 \\<and> e < f \\<longrightarrow> fst (last (q s)) + snd (last (q s)) = f \\<Longrightarrow>\\<not> N < T s + snd (hd (q s)) \\<Longrightarrow>Suc 0 < length (q s) \\<Longrightarrow>fst (q s ! 1) = fst (q s ! 0) + snd (q s ! 0) \\<or> fst (q s ! 1) = 0 \\<Longrightarrow>q s ! 0 = hd (q s) \\<Longrightarrow> q s ! 1 = hd (tl (q s)) \\<Longrightarrow>\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> i \\<le> N \\<and> ownB s i = Q \\<Longrightarrow>\n       q s ! 1 \\<in> set (q s) \\<Longrightarrow> q s ! 1 = (sta, leng) \\<longrightarrow> (sta, leng) \\<in> set (q s) \\<Longrightarrow>fst (q s ! 1) = 0 \\<Longrightarrow> \\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> i \\<le> N \\<and> ownB s i = Q \\<Longrightarrow>\n       \\<forall>i. (\\<exists>x. x = {i. fst (hd (tl (q s))) \\<le> i \\<and> i < fst (hd (tl (q s))) + snd (hd (tl (q s)))} \\<and> i \\<in> x) \\<longrightarrow>\n           i \\<le> N \\<and> ownB s i = Q \\<Longrightarrow>0 < offset s\"\n  proof -\n  fix a :: nat and b :: nat and c :: nat and d :: nat and e :: nat and f :: nat\n  assume a1: \"H s \\<noteq> fst (last (q s)) + snd (last (q s))\"\n  assume \"0 < n\"\n  assume a2: \"0 \\<le> b\"\n  assume a3: \"b \\<le> H s\"\n  assume \"H s < T s\"\n  assume \"T s \\<le> e\"\n  assume a4: \"0 < H s\"\n  assume a5: \"\\<forall>i. b \\<le> i \\<and> i < H s \\<longrightarrow> ownB s i = W\"\n  assume a6: \"\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b\"\n  assume a7: \"b < H s \\<longrightarrow> offset s = b\"\n  assume \"\\<not> T s < e\"\n  assume \"e < f \\<or> 0 < b\"\n  assume a8: \"0 < b \\<longrightarrow> fst (last (q s)) + snd (last (q s)) = b\"\n  assume a9: \"q s ! 1 = hd (tl (q s))\"\n  assume a10: \"q s ! 1 \\<in> set (q s)\"\n  assume a11: \"fst (q s ! 1) = 0\"\n  assume a12: \"\\<forall>i. (\\<exists>x. x = {i. fst (hd (tl (q s))) \\<le> i \\<and> i < fst (hd (tl (q s))) + snd (hd (tl (q s)))} \\<and> i \\<in> x) \\<longrightarrow> i \\<le> N \\<and> ownB s i = Q\"\n  have \"\\<not> (0::nat) \\<le> 0 \\<or> fst (hd (tl (q s))) \\<le> 0 \\<and> 0 < fst (hd (tl (q s))) + snd (hd (tl (q s)))\"\n  using a11 a10 a9 a6 by (metis (no_types) plus_nat.add_0 prod.collapse)\n  then have \"0 \\<noteq> b\"\n  using a12 a5 a4 by force\n  then show \"0 < offset s\"\n  using a8 a7 a3 a2 a1 by (metis nat_less_le)\n  qed\n  qed\n\n\nlemma R_idle_to_nidle_lemma_case_1_6_4:\n  \"case_2 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> fst(hd(q s)) \\<noteq> T s \\<Longrightarrow> H s = fst(last(q s))+snd(last(q s))\n\\<Longrightarrow>case_2 s'\"\n  apply(subgoal_tac \"T s\\<noteq>0\") prefer 2\n  apply(simp add:case_2_lemmas) \n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply (metis RingBuffer_BD_latest_3.inv_def)\n  apply (metis gr0I less_nat_zero_code)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using pec_prelim_9 [where s=s]\n  apply blast\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:pre_R_def pre_dequeue_inv_def)\n  apply(simp add:case_2_lemmas ) \n  apply(clarify) \n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) le_antisym less_or_eq_imp_le list.set_sel(1) nat_neq_iff prod.collapse)\n  apply(rule_tac ?x = \"fst (hd (q s))+snd(hd(q s))\" in exI)\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) defer\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) \n  apply (metis le_neq_implies_less)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply linarith \n  apply (metis bot_nat_0.extremum le_neq_implies_less)\n  apply (metis Suc_leI le_add1 le_neq_implies_less le_trans not_less_eq_eq) \n  apply (metis (no_types, lifting) F.distinct(3) le_neq_implies_less)\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply (metis le_neq_implies_less)\n  apply (metis Suc_diff_Suc Zero_not_Suc diff_is_0_eq')\n  apply (metis (no_types, hide_lams) F.distinct(21) nat_less_le)\n  apply blast\n  apply blast\n  apply fastforce\n  apply fastforce\n  using add_gr_0 apply presburger\n  apply blast \n  apply presburger\n  apply (metis nat_less_le)\n  apply (metis nat_less_le)\n  apply (metis le_neq_implies_less)\n  apply (metis add_cancel_right_left le_neq_implies_less)\n  apply (metis le_neq_implies_less)\n  apply (metis le_neq_implies_less) \n  defer \n  apply fastforce\n  apply(subgoal_tac \"fst(hd(q s)) = 0\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"fst (hd (tl (q s))) = fst(q s!1)\") prefer 2 \n  apply (metis One_nat_def hd_conv_nth last_conv_nth length_greater_0_conv length_tl list.size(3) nat_neq_iff nth_tl)\n  apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"fst (hd (tl (q s))) = fst(q s!1)\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"hd (q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd (tl(q s)) = q s!1\") prefer 2\n  apply (metis One_nat_def hd_conv_nth last_conv_nth length_greater_0_conv length_tl list.size(3) nat_neq_iff nth_tl)\n  defer defer\n  apply force\n  apply (metis add_cancel_right_left le_neq_implies_less list.set_sel(1) prod.collapse)\n  apply (metis add_cancel_right_left le_neq_implies_less list.set_sel(1) prod.collapse)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N) \\<longrightarrow> i<H s\") prefer 2 \n  apply (metis F.distinct(19) F.distinct(21) F.distinct(23) le_neq_implies_less less_or_eq_imp_le linorder_neqE_nat)\n  apply(subgoal_tac \"\\<forall>i.(fst(hd(q s))\\<le>i \\<and> i<fst(hd(q s))+snd(hd(q s))) \\<longrightarrow> ownB s i = Q\") prefer 2\n  apply meson\n  apply (metis (no_types, hide_lams) bot_nat_0.not_eq_extremum diff_diff_cancel diff_is_0_eq diff_self_eq_0 zero_less_diff)\n  apply(intro iffI)\n  apply(case_tac \"T s < T s\") \n  apply force apply(subgoal_tac \"\\<not>T s < T s \\<and> ((T s < T s \\<or> fst (hd (q s)) + snd (hd (q s)) < H s)) \\<longrightarrow> H s > fst (hd (q s)) + snd (hd (q s))\") prefer 2\n  apply blast\n  apply(subgoal_tac \"H s > fst (hd (q s)) + snd (hd (q s))\") prefer 2\n  apply force\n  apply(subgoal_tac \"\\<forall>i.  (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x.(x = {i. a\\<le>i \\<and> i < a + b} \\<and> a\\<in>x))\") prefer 2\n  apply (metis Nat.add_0_right le_refl mem_Collect_eq nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> ownB s a = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow>(a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.set_sel(2))\n  apply(subgoal_tac \"fst (hd (q s)) + snd(hd(q s)) \\<le>N\") prefer 2 \n  apply (metis (no_types, lifting) Suc_le_lessD bot_nat_0.extremum le_neq_implies_less not_less_eq_eq)\n  apply(subgoal_tac \"ownB s (fst (hd (q s)) + snd(hd(q s))) = Q\") prefer 2 \n  apply (metis le_add1 le_neq_implies_less)\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> fst (hd (q s)) + snd (hd (q s)) \\<in> x)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.(a\\<le>fst (hd (q s)) + snd (hd (q s)) \\<and> fst (hd (q s)) + snd (hd (q s))<a+b \\<and> (a,b)\\<in>set(q s))\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply clarify\n  apply(subgoal_tac \"\\<exists>tru. (tru<length(q s) \\<and> q s!tru = (ab,bb))\") prefer 2 \n  apply (metis (no_types, lifting) in_set_conv_nth)\n  apply(clarify)\n  apply(subgoal_tac \"tru\\<noteq>0\") prefer 2 \n  apply (metis fst_conv hd_conv_nth less_irrefl_nat snd_conv) apply(subgoal_tac \"length(q s)>1\") \n  prefer 2 \n  apply linarith\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1 ) \") prefer 2 \n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"last(q s) \\<noteq> hd(q s) \\<longrightarrow> length(q s)>1\") prefer 2 \n  apply (metis One_nat_def)\n  using str_pec_5 [where s=s] \n  apply (metis (no_types, hide_lams) One_nat_def add.commute nat_less_le)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s)) < H s\") prefer 2 \n  apply (metis (no_types, hide_lams) One_nat_def add.commute le_neq_implies_less str_pec_5)\n  apply force\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1 ) \") prefer 2 \n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = q s!1\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def hd_conv_nth last_conv_nth length_greater_0_conv length_tl list.size(3) nat_neq_iff nth_tl)\n  apply(subgoal_tac \"fst(q s!0) = 0\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s)) = fst(q s!0) + snd(q s!0)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)\") prefer 2\n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_add_inverse last_conv_nth length_greater_0_conv nat_neq_iff plus_1_eq_Suc)\n  apply(subgoal_tac \"fst(q s!0) \\<noteq> fst(q s!1)\") prefer 2 \n  apply (metis (no_types, hide_lams) bot_nat_0.not_eq_extremum length_greater_0_conv less_one)\n  apply (metis (no_types, hide_lams) Suc_diff_1 diff_self_eq_0 less_one)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s)-1)\") prefer 2 \n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"length(tl(q s)) = length(q s)-1\") prefer 2\n  apply (metis length_tl)\n  apply(subgoal_tac \"last(tl(q s)) = (tl(q s)!(length(tl(q s)) -1))\") prefer 2 \n  apply (metis (no_types, lifting) hd_conv_nth last_conv_nth length_0_conv less_not_refl2)\n  apply(subgoal_tac \"last(tl(q s)) = (tl(q s)!(length(q s) -2))\") prefer 2 \n  apply (metis Suc_1 diff_Suc_eq_diff_pred)\n  by (metis (no_types, hide_lams) hd_conv_nth last_tl length_0_conv nat_less_le)\n\n\n\nlemma R_idle_to_nidle_lemma_case_1_6:\n  \"case_2 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[]\n\\<Longrightarrow>case_2 s'\"\n  apply (case_tac \"fst(hd(q s)) = T s\") \n  apply (case_tac[!] \"H s = fst(last(q s))+snd(last(q s))\") \n  using R_idle_to_nidle_lemma_case_1_6_1 [where s=s and s'=s'] \n  apply blast \n  using R_idle_to_nidle_lemma_case_1_6_3 [where s=s and s'=s']\n  apply blast \n  using R_idle_to_nidle_lemma_case_1_6_4 [where s=s and s'=s'] \n  apply blast\n  using R_idle_to_nidle_lemma_case_1_6_2 [where s=s and s'=s'] \n  by blast\n    \n\n\nlemma strange_things_7_1:\n  \" Q_structure s\n\\<Longrightarrow> \\<forall>y x.(x \\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> fst(x)>fst(y))\\<longrightarrow>fst(x)\\<ge>end(y)\n\"\n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  by(simp add:Q_lemmas Q_basic_lemmas)\n\nlemma strange_things_7_2:\n  \" Q_structure s\n\\<Longrightarrow> \\<forall>a b aa bb.((a,b) \\<in>set(q s) \\<and> (aa,bb)\\<in>set(q s) \\<and> a>aa)\\<longrightarrow>a\\<ge>aa+bb\n\"\n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  using strange_things_7_1 fst_def end_def \n  by (metis old.prod.inject surjective_pairing)\n  \n\nlemma strange_things_7_3:\n  \" Q_structure s\n\\<Longrightarrow> \\<forall>a b aa bb.((a,b) \\<in>set(q s) \\<and> (aa,bb)\\<in>set(q s) \\<and> a\\<noteq>aa)\\<longrightarrow>(a>aa \\<or> a<aa)\n\"\n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  using strange_things_7_1 fst_def end_def\n  using nat_neq_iff by blast\n\n\nlemma strange_things_7_5:\n  \" Q_structure s \n\\<Longrightarrow> \\<forall>x.(x \\<in>set(tl(q s)))\\<longrightarrow>(fst(x)\\<noteq>fst(hd(q s)))\n\" apply clarify \n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"(\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j))\")\n  prefer 2 \n  apply (metis less_nat_zero_code list.size(3)) apply clarify\n  apply(subgoal_tac \"\\<nexists>i.(i<length(q s) \\<and> i>0 \\<and> (fst (hd (q s)), b) = q s!i)\") prefer 2 \n  apply (metis fst_conv gr_implies_not_zero hd_conv_nth length_greater_0_conv)\n  apply(subgoal_tac \"\\<forall>i j.(fst (q s ! i) = fst (q s ! j))\\<longrightarrow> (i=j\\<or>i \\<ge> length (q s) \\<or> j \\<ge>  length (q s))\") prefer 2 \n  apply (meson bot_nat_0.not_eq_extremum diff_is_0_eq zero_less_diff) \n  apply(case_tac \"tl(q s) = []\") \n  apply (metis length_greater_0_conv length_pos_if_in_set)\n  apply clarsimp\n  apply(subgoal_tac \"(fst (hd (q s)), b) \\<in> set (tl (q s))\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set((q s)) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> q s!i = (a, b)))\") prefer 2 \n  apply (meson in_set_conv_nth)\n  apply(subgoal_tac \"length(q s) -1 = length(tl(q s))\") prefer 2 \n  apply (metis length_tl)\n  apply(subgoal_tac \"hd(q s) = q s !0\") prefer 2 \n  apply (meson Q_ind_imp_tail_ind_1)\n  apply(subgoal_tac \"\\<forall>i.(i<length(tl(q s)))\\<longrightarrow>tl(q s)!i = q s!(i+1)\") prefer 2 \n  apply (metis Suc_eq_plus1 nth_tl)\n  by (smt (z3) One_nat_def diff_Suc_less gr_implies_not0 in_set_conv_nth length_greater_0_conv lessI less_trans_Suc nth_tl)\n\nlemma strange_things_7_almost_there_1:\n  \" Q_structure s\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> tl(q s)\\<noteq>[]\n\\<Longrightarrow>\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa \"\n  apply(simp add:Q_lemmas Q_basic_lemmas) \n  by (metis le_antisym le_eq_less_or_eq nat_neq_iff)\n\nlemma strange_things_7_almost_there_2:\n  \" Q_structure s\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> tl(q s)\\<noteq>[]\n\\<Longrightarrow>\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a \\<ge> aa \\<and> a\\<noteq>aa \\<longrightarrow> a>aa\"\n  by(simp add:Q_lemmas Q_basic_lemmas) \n\n\nlemma strange_things_7_almost_there_3:\n  \" Q_structure s\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> tl(q s)\\<noteq>[]\n\\<Longrightarrow>\\<forall>a b aa ba. (a, b) \\<in> set (q s) \\<and> (aa, ba) \\<in> set (q s) \\<longrightarrow> a>aa \\<longrightarrow> a\\<ge>aa+ba\"\n  by (meson strange_things_7_2)\n\nlemma strange_things_7_almost_there_4:\n  \" Q_structure s\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> tl(q s)\\<noteq>[]\n\\<Longrightarrow>\\<forall>a b aa ba. (a, b) \\<in> set (q s) \\<and> (aa, ba) \\<in> set (q s) \\<longrightarrow> a\\<ge>aa+ba \\<longrightarrow> a+b>aa+ba\"\n  apply(simp add:Q_lemmas Q_basic_lemmas) \n  by (metis le_eq_less_or_eq less_add_same_cancel1 trans_less_add1)\n\nlemma strange_things_7:\n  \" Q_structure s\n\\<Longrightarrow> i \\<in> {i. fst(hd(q s)) \\<le>i \\<and> i<fst(hd(q s)) + snd(hd(q s))}\n\\<Longrightarrow>\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow> (a\\<ge>fst(hd(q s)) + snd(hd(q s)) \\<or> a+b\\<le>fst(hd(q s)))\n\\<Longrightarrow> \\<forall>a b.(a,b)\\<in>set(tl(q s)) \\<longrightarrow> i \\<notin> {i. a \\<le>i \\<and> i<a+b}\n\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  by (meson Suc_leI le_trans not_less_eq_eq)\n\n\n\nlemma strange_things_8_1_4_4:\n  \"Q_structure s \\<Longrightarrow> case_1 s \\<or> case_2 s \\<Longrightarrow> Q_owns_bytes s \\<Longrightarrow>\n\\<forall>i.(i<length(q s) \\<and> i>0 \\<and> fst(q s!i)<fst(q s!0)) \\<longrightarrow> end(q s!i)<fst(q s!0)\" \n  apply(simp add:Q_lemmas Q_basic_lemmas) apply(clarify)\n  apply(subgoal_tac \"(fst(q s!i), snd(q s!i)) \\<in>set(q s)\") prefer 2 \n  apply (metis nth_mem prod.collapse)\n  apply(subgoal_tac \"(fst(q s!0), snd(q s!0)) \\<in>set(q s)\") prefer 2 \n  apply (metis length_pos_if_in_set nth_mem prod.exhaust_sel)\n  apply(subgoal_tac \"fst (q s ! i) + snd (q s ! i) \\<le> fst (q s ! 0)\") prefer 2\n  apply (metis less_asym' list.size(3))\n  apply(subgoal_tac \"fst (q s ! i) + snd (q s ! i) \\<noteq> fst (q s ! 0)\")\n  using le_neq_implies_less apply presburger\n  apply(case_tac \"i=length(q s)-1\") \n  apply (metis last_conv_nth less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"fst(q s!(i+1)) = end(q s!i) \\<or> fst(q s!(i+1)) = 0\") prefer 2 \n  apply (smt (z3) Nat.add_0_right One_nat_def add_Suc_right add_diff_cancel_right' add_gr_0 end_simp list.size(3) nat_neq_iff not_less_eq)\n  apply(case_tac \"fst(q s!(i+1)) = end(q s!i)\") apply simp \n  apply (metis One_nat_def Suc_mono diff_add_inverse less_zeroE list.size(3) not_gr0 not_less_less_Suc_eq plus_1_eq_Suc)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add:case_1_lemmas) \n  apply(clarify)\n  apply(subgoal_tac \"b = fst(q s!0)\") prefer 2 \n  apply (metis head_q0 length_greater_0_conv less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"snd(q s!i)>0\") prefer 2\n  apply metis\n  apply(subgoal_tac \"b>0\") prefer 2 \n  apply linarith \n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(subgoal_tac \"(q s!i)\\<in>set(q s)\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply fastforce\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply meson\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) = q s!i))\") prefer 2\n  apply (metis prod.exhaust_sel)\n  apply(clarify)\n  apply(subgoal_tac \"fst(q s!i)>fst(q s!0)\") \n  apply linarith\n  apply(subgoal_tac \"fst(q s!i)\\<noteq>fst(q s!0)\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>i.(\\<exists>x.( x = {i. a \\<le> i \\<and> i < a + ba} )\\<and> i\\<in>x)\\<longrightarrow>ownB s i = Q\") prefer 2\n  apply metis\n  apply(subgoal_tac \"ba>0\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"a\\<in>{i. a \\<le> i \\<and> i < a + ba}\") prefer 2\n  apply (metis le_eq_less_or_eq less_add_same_cancel1 mem_Collect_eq)\n  apply(subgoal_tac \"ownB s a = Q\") prefer 2\n  apply metis\n  apply (metis F.distinct(11) F.distinct(19) fst_eqD leI linorder_neqE_nat)\n  apply(subgoal_tac \"case_2 s\") prefer 2 \n  apply fastforce\n  apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:case_2_lemmas)\n  apply clarify\n  apply(subgoal_tac \"f>e \\<or> a<b\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"e= fst(hd(q s)) \\<or> a = fst(hd(q s))\") prefer 2 \n  apply (metis le_eq_less_or_eq)\n  apply(case_tac \"a = fst(hd(q s))\")\n  apply(subgoal_tac \"(q s!i)\\<in>set(q s)\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply fastforce\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply meson\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) = q s!i))\") prefer 2\n  apply (metis prod.exhaust_sel)\n  apply(clarify)\n  apply(subgoal_tac \"fst(q s!i)>fst(q s!0)\") \n  apply linarith\n  apply(subgoal_tac \"fst(q s!i)\\<noteq>fst(q s!0)\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>i.(\\<exists>x.( x = {i. aa \\<le> i \\<and> i < aa + ba} )\\<and> i\\<in>x)\\<longrightarrow>ownB s i = Q\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"ba>0\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"aa\\<in>{i. aa \\<le> i \\<and> i < aa + ba}\") prefer 2\n  apply (metis le_eq_less_or_eq less_add_same_cancel1 mem_Collect_eq)\n  apply(subgoal_tac \"ownB s aa = Q\") prefer 2 \n  apply metis \n  apply (metis F.distinct(11) fst_conv hd_conv_nth)\n  apply(subgoal_tac \"e = fst (hd (q s))\") prefer 2 \n  apply force\n  apply(subgoal_tac \"b = end(last(q s)) \\<or> f = end(last(q s))\") prefer 2 \n  apply (metis end_simp nat_less_le)\n  apply(case_tac \"f = end(last(q s))\") \n  apply(subgoal_tac \"(q s!i)\\<in>set(q s)\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply fastforce\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply meson\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) = q s!i))\") prefer 2\n  apply (metis prod.exhaust_sel)\n  apply(clarify)\n  apply(subgoal_tac \"fst(q s!i)>fst(q s!0)\") \n  apply linarith\n  apply(subgoal_tac \"fst(q s!i)\\<noteq>fst(q s!0)\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>i.(\\<exists>x.( x = {i. aa \\<le> i \\<and> i < aa + ba} )\\<and> i\\<in>x)\\<longrightarrow>ownB s i = Q\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"ba>0\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"aa\\<in>{i. aa \\<le> i \\<and> i < aa + ba}\") prefer 2\n  apply (metis le_eq_less_or_eq less_add_same_cancel1 mem_Collect_eq)\n  apply(subgoal_tac \"ownB s aa = Q\") prefer 2 \n  apply metis \n  apply(subgoal_tac \"a=b\") prefer 2 \n  apply (metis (no_types, lifting) end_simp less_trans nat_less_le)\n  apply(subgoal_tac \"\\<forall>i.(i<fst(q s!0))\\<longrightarrow>ownB s i\\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(11) F.distinct(19) F.distinct(3) hd_conv_nth leI)\n  apply (metis fst_eqD)\n  apply(subgoal_tac \"f>e \\<and> b>a\") prefer 2 \n  apply (metis end_simp nat_less_le)\n  apply(subgoal_tac \"fst(q s!i)<fst(hd(q s))\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"(q s!i)\\<in>set(q s)\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply fastforce\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply meson\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) = q s!i))\") prefer 2\n  apply (metis prod.exhaust_sel)\n  apply(clarify)\n  apply(subgoal_tac \"fst(q s!i)>fst(q s!0)\") \n  apply linarith\n  apply(subgoal_tac \"fst(q s!i)\\<noteq>fst(q s!0)\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>i.(\\<exists>x.( x = {i. aa \\<le> i \\<and> i < aa + ba} )\\<and> i\\<in>x)\\<longrightarrow>ownB s i = Q\") prefer 2\n  apply metis\n  apply(subgoal_tac \"ba>0\") prefer 2 \n  apply (metis)\n  apply(subgoal_tac \"aa\\<in>{i. aa \\<le> i \\<and> i < aa + ba}\") prefer 2\n  apply (metis le_eq_less_or_eq less_add_same_cancel1 mem_Collect_eq)\n  apply(subgoal_tac \"ownB s aa = Q\") prefer 2 \n  apply metis \n  apply(subgoal_tac \"\\<forall>i.(i<fst(q s!0) \\<and> i\\<ge>end(last(q s)))\\<longrightarrow>ownB s i\\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(11) F.distinct(19) F.distinct(3) hd_conv_nth leI)\n  apply(subgoal_tac \"fst(q s!i)<end(last(q s))\") prefer 2 \n  apply (metis fst_eqD leI)\n  apply(subgoal_tac \"\\<forall>i.(i\\<in>{j. j\\<le>aa \\<and> j<aa+ba})\\<longrightarrow>ownB s i = Q\") prefer 2 \n  apply (metis fst_eqD leI le_trans less_eq_nat.simps(1) mem_Collect_eq)\n  apply(subgoal_tac \"aa\\<le>aa+ba \\<and> aa+ba\\<le>end(last(q s))\") prefer 2\n  apply (metis fst_eqD leI le_eq_less_or_eq mem_Collect_eq snd_conv)  \n  apply(subgoal_tac \"fst(q s!i)<aa+ba\") prefer 2 \n  apply (metis fst_conv snd_conv)\n  apply(subgoal_tac \"fst(q s!i)<end(last(q s))\") prefer 2 \n  apply fastforce\n  apply(subgoal_tac \"end(last(q s)) < fst(q s!0)\") prefer 2 \n  apply (metis (no_types, hide_lams) fst_conv head_q0 le_imp_less_Suc le_trans not_less_eq order.strict_trans snd_conv)\n  by (metis eq_fst_iff not_le snd_conv)\n\n\n\n\nlemma strange_things_8_1:\n  \" Q_structure s \\<Longrightarrow> case_1 s \\<or> case_2 s \\<Longrightarrow> Q_owns_bytes s \n\\<Longrightarrow>\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow> (a\\<ge>fst(hd(q s)) + snd(hd(q s)) \\<or> a+b<fst(hd(q s)))\"\n  apply clarify \n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"tl(q s)=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (simp add:Q_lemmas Q_basic_lemmas)apply(subgoal_tac \"Q_structure s\") prefer 2 \n  using pec_prelim_9 [where s=s] \n  apply (simp add: pec_prelim_10)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2 \n  using Q_ind_imp_tail_ind_1 apply auto[1]\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s)) \\<longrightarrow> (a,b)\\<in>set(q s)\") prefer 2\n  apply (meson list.set_sel(2))\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s) \\<and> (a,b)\\<noteq>hd(q s)) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> i>0 \\<and> (a,b) = q s!i))\") prefer 2\n  apply (metis gr0I in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s)) \\<longrightarrow> a>fst(hd(q s)) \\<or> a<fst(hd(q s))\") prefer 2\n  using strange_things_7_3 [where s=s] pec_prelim_10 [where s=s] strange_things_7_5 [where s=s]  \n   apply clarsimp \n  apply (meson nat_neq_iff)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set((q s)) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> q s!i = (a, b)))\") prefer 2 \n  apply (meson in_set_conv_nth)\n  apply(subgoal_tac \"length(q s) -1 = length(tl(q s))\") prefer 2 \n  apply (metis length_tl)\n  apply(subgoal_tac \"hd(q s) = q s !0\") prefer 2 \n  apply (meson Q_ind_imp_tail_ind_1)\n  apply(subgoal_tac \"\\<forall>i.(i<length(tl(q s)))\\<longrightarrow>tl(q s)!i = q s!(i+1)\") prefer 2 \n   apply (metis Suc_eq_plus1 nth_tl) apply clarsimp \n  apply(subgoal_tac \"\\<exists>i.(i<length(q s) \\<and> i>0 \\<and> (a,b)\\<in>set(q s))\") prefer 2 \n  apply (metis \\<open>Q_structure s \\<Longrightarrow> \\<forall>x. x \\<in> set (tl (q s)) \\<longrightarrow> fst x \\<noteq> fst (hd (q s))\\<close>)\n  apply(subgoal_tac \"fst (q s ! 0)\\<le>a\") \n   apply (metis add_cancel_right_right le_imp_less_Suc length_pos_if_in_set less_SucE nth_mem surjective_pairing)\n  apply(subgoal_tac \"fst(q s!0) < a\")  \n  apply linarith\n  apply clarsimp\n  apply (thin_tac \"\\<forall>i<length (q s). snd (q s ! i) = Data s (numDeqs s + i)\")\n  apply (thin_tac \"\\<forall>i<length (q s). data_index s (q s ! i) = numDeqs s + i\")\n  apply (thin_tac \"\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)\")\n  apply(thin_tac \"\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n           fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \")\n  apply (thin_tac \"\\<forall>a. (\\<exists>b. (a, b) \\<in> set (tl (q s))) \\<longrightarrow> fst (q s ! 0) < a \\<or> a < fst (q s ! 0)\")\n  apply (subgoal_tac \"(a,b)\\<in>set(q s)\") prefer 2 \n  apply meson\n  apply(case_tac \"(a,b)= last(q s)\")\n  apply (metis Q_gap_lemmas_2 Suc_le_lessD \\<open>Q_structure s \\<Longrightarrow> \\<forall>x. x \\<in> set (tl (q s)) \\<longrightarrow> fst x \\<noteq> fst (hd (q s))\\<close> fst_conv le_neq_implies_less length_greater_0_conv not_less_eq_eq prod.collapse snd_conv)\n  apply(subgoal_tac \" a + b \\<noteq> fst (q s ! 0)\")\n  apply (metis \\<open>Q_structure s \\<Longrightarrow> \\<forall>x. x \\<in> set (tl (q s)) \\<longrightarrow> fst x \\<noteq> fst (hd (q s))\\<close> fst_conv hd_in_set le_neq_implies_less linorder_neqE_nat prod.collapse)\n  apply(subgoal_tac \"a + b > fst (q s ! 0)\") \n  apply linarith\n  apply(subgoal_tac \"(a,b) \\<noteq> last(q s)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"(a,b) \\<noteq> last(tl(q s))\") prefer 2 \n   apply (metis last_tl)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1)\") prefer 2\n  apply (meson last_conv_nth)\n  apply(subgoal_tac \"(a,b)\\<noteq> q s!(length(q s) -1)\") prefer 2 \n   apply metis\n  apply(subgoal_tac \"(a,b)\\<noteq> q s!0\") prefer 2 \n  apply (metis \\<open>Q_structure s \\<Longrightarrow> \\<forall>x. x \\<in> set (tl (q s)) \\<longrightarrow> fst x \\<noteq> fst (hd (q s))\\<close>)\n  apply(subgoal_tac \"\\<exists>k.((a,b) = q s!k \\<and> k>0 \\<and> k<length(q s)-1)\") prefer 2 \n  apply (metis Suc_diff_1 length_greater_0_conv not_less_less_Suc_eq)\n  apply clarify \n  apply(case_tac \"fst(q s!k) <fst(q s!0)\") prefer 2 \n  apply (metis fst_conv less_add_same_cancel1 linorder_neqE_nat)\n  apply(subgoal_tac \"fst(q s!k) < fst(q s!0)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"fst(q s!k) +snd(q s!k) \\<le> fst(q s!0)\") prefer 2 \n  apply (metis hd_in_set prod.collapse)\n  apply(subgoal_tac \"a+b \\<le> fst(q s!0)\") prefer 2 \n  apply (metis fst_conv snd_conv)\n  by (metis end_simp fst_conv snd_conv strange_things_8_1_4_4)\n\n\n\nlemma strange_things_8:\n  \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n\\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\n\\<Longrightarrow>\n\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl(q s))) \\<and> (i \\<in> x)) \n\\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\n\\<Longrightarrow> Q_structure s\n\\<Longrightarrow>\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow> (a\\<ge>fst(hd(q s)) + snd(hd(q s)) \\<or> a+b<fst(hd(q s)))\n\\<Longrightarrow> i \\<in> {i. fst(hd(q s)) \\<le>i \\<and> i<fst(hd(q s)) + snd(hd(q s))}\n\\<Longrightarrow> \\<forall>a b.(a,b)\\<in>set(tl(q s)) \\<longrightarrow> i \\<notin> {i. a \\<le>i \\<and> i<a+b}\n\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(tl(q s))) \\<longrightarrow> (a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.sel(2) list.set_sel(2))\n  apply clarify \n  by (meson Suc_leI le_trans less_or_eq_imp_le not_less_eq_eq)\n\n\nlemma strange_things_11_6:\n  \"Q_structure s\n\\<Longrightarrow> (i\\<le>N \\<and> ownB s i = Q)\\<longrightarrow>\n(\\<exists>a b. i\\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set ((q s))))\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> fst(hd(q s)) \\<le> i \\<longrightarrow> \\<not>i < fst(hd(q s))+snd(hd(q s))\n\\<Longrightarrow>(i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow>\n(\\<exists>x. (((\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (tl(q s)))) \\<and> i \\<in> x)))\" \n  by (metis (no_types, lifting) fst_conv list.collapse mem_Collect_eq set_ConsD snd_conv)\n\n\nlemma strange_things_11:\n  \" Q_structure s\n\\<Longrightarrow> \\<forall>i. (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow>\n(\\<exists>x. (((\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (q s))) \\<and> i \\<in> x)))\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow>fst(hd(q s))\\<le>i\\<longrightarrow>\\<not>i<fst(hd(q s))+snd(hd(q s))\n\\<Longrightarrow> (i \\<le> N \\<and> ownB s i = Q) \\<Longrightarrow>\n(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x)\"\n  using strange_things_11_6 [where s=s and i=i] \n  by fastforce\n\nlemma strange_things_12:\n  \" Q_structure s\n\\<Longrightarrow> \\<forall>i. (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow>\n(\\<exists>x. (((\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (q s))) \\<and> i \\<in> x)))\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> \\<forall>i. (i \\<le> N \\<and> ownB s i = Q \\<and> (fst(hd(q s))\\<le>i\\<longrightarrow>\\<not>i<fst(hd(q s))+snd(hd(q s))) ) \\<longrightarrow>\n(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x)\"\n  using strange_things_11 [where s=s and i=i] \n  by (simp add: strange_things_11)\n\n\nlemma R_idle_to_nidle_lemma_case_1_7:\n  \"con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[]\n\\<Longrightarrow>Q_owns_bytes s'\"\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply(simp add: Q_owns_bytes_def )\n  apply(simp add:Q_lemmas Q_basic_lemmas) apply(subgoal_tac \"Q_structure s\") prefer 2 \n  using pec_prelim_9 [where s=s] apply presburger\n  apply(intro allI conjI)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow> (a\\<ge>fst(hd(q s)) + snd(hd(q s)) \\<or> a+b<fst(hd(q s)))\")\n  apply(simp add:Q_indices_def ran_indices_def)\n  using strange_things_8 [where s=s and i=i] apply clarsimp \n  defer using strange_things_8_1 [where s=s]\n  apply (simp add: pec_prelim_9) \n  using Q_owns_bytes_def apply auto[1]\n  apply clarify\n  apply(intro iffI)\n  apply(simp add:Q_indices_def ran_indices_def)  \n  defer \n  apply(simp add:Q_indices_def ran_indices_def)\n  apply clarify\n  apply(subgoal_tac \"(i \\<le> N \\<and> ownB s i = Q)\") prefer 2 \n  apply fastforce\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> i \\<le> N \\<and> ownB s i = Q\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"Q_structure s\") prefer 2 apply presburger\n  apply(subgoal_tac \"\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x\")\n  using strange_things_11 [where s=s and i=i]  \n  apply blast\n  using strange_things_11 [where s=s and i=i]  \n  defer\n  apply simp\n  apply safe[1] apply clarsimp \n  using Suc_leI le_trans less_or_eq_imp_le not_less_eq_eq\nproof -\n  fix ia :: nat and a :: nat and b :: nat\n  assume a1: \"(a, b) \\<in> set (tl (q s))\"\n  assume a2: \"ia < a + b\"\n  assume a3: \"a \\<le> ia\"\n  assume a4: \"ia < fst (hd (q s)) + snd (hd (q s))\"\n  assume a5: \"fst (hd (q s)) \\<le> ia\"\n  assume a6: \"\\<forall>a b. (a, b) \\<in> set (tl (q s)) \\<longrightarrow> fst (hd (q s)) + snd (hd (q s)) \\<le> a \\<or> a + b < fst (hd (q s))\"\n  have f7: \"\\<not> Suc ia \\<le> fst (hd (q s))\"\n  using a5 by simp\n  have \"\\<not> Suc ia \\<le> a\"\n  using a3 by (metis (full_types) not_less_eq_eq)\n  then show False\n  using f7 a6 a4 a2 a1 by (meson Suc_leI le_trans less_or_eq_imp_le)\n  next \n  fix ia :: nat and a :: nat and b :: nat\n  assume a1: \"(a, b) \\<in> set (tl (q s))\"\n  assume a2: \"ia < a + b\"\n  assume a3: \"a \\<le> ia\"\n  assume a4: \"ia < fst (hd (q s)) + snd (hd (q s))\"\n  assume a5: \"fst (hd (q s)) \\<le> ia\"\n  assume a6: \"\\<forall>a b. (a, b) \\<in> set (tl (q s)) \\<longrightarrow> fst (hd (q s)) + snd (hd (q s)) \\<le> a \\<or> a + b < fst (hd (q s))\"\n  have f7: \"\\<not> Suc ia \\<le> fst (hd (q s))\"\n  using a5 by simp\n  have \"\\<not> Suc ia \\<le> a\"\n  using a3 by (metis (full_types) not_less_eq_eq)\n  then show False\n  using f7 a6 a4 a2 a1 by (meson Suc_leI le_trans less_or_eq_imp_le)\n  next\n  fix ia :: nat and a :: nat and b :: nat\n  assume a1: \"(a, b) \\<in> set (tl (q s))\"\n  assume a2: \"ia < a + b\"\n  assume a3: \"a \\<le> ia\"\n  assume a4: \"ia < fst (hd (q s)) + snd (hd (q s))\"\n  assume a5: \"fst (hd (q s)) \\<le> ia\"\n  assume a6: \"\\<forall>a b. (a, b) \\<in> set (tl (q s)) \\<longrightarrow> fst (hd (q s)) + snd (hd (q s)) \\<le> a \\<or> a + b < fst (hd (q s))\"\n  have f7: \"\\<not> Suc ia \\<le> fst (hd (q s))\"\n  using a5 by simp\n  have \"\\<not> Suc ia \\<le> a\"\n  using a3 by (metis (full_types) not_less_eq_eq)\n  then show False\n  using f7 a6 a4 a2 a1 by (meson Suc_leI le_trans less_or_eq_imp_le)\n  next \n  fix ia :: nat and a :: nat and b :: nat\n  assume a1: \"(a, b) \\<in> set (tl (q s))\"\n  assume a2: \"ia < a + b\"\n  assume a3: \"a \\<le> ia\"\n  assume a4: \"ia < fst (hd (q s)) + snd (hd (q s))\"\n  assume a5: \"fst (hd (q s)) \\<le> ia\"\n  assume a6: \"\\<forall>a b. (a, b) \\<in> set (tl (q s)) \\<longrightarrow> fst (hd (q s)) + snd (hd (q s)) \\<le> a \\<or> a + b < fst (hd (q s))\"\n  have f7: \"\\<not> Suc ia \\<le> fst (hd (q s))\"\n  using a5 by simp\n  have \"\\<not> Suc ia \\<le> a\"\n  using a3 by (metis (full_types) not_less_eq_eq)\n  then show False\n  using f7 a6 a4 a2 a1 by (meson Suc_leI le_trans less_or_eq_imp_le)\n  next show \"\\<And>i. pcR s = idleR \\<Longrightarrow>  s' = s   \\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n            numDeqs := Suc (numReads s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr> \\<Longrightarrow>  q s \\<noteq> [] \\<Longrightarrow>  Q_structure s \\<Longrightarrow>   0 < n \\<Longrightarrow>   tempR s = (0, 0) \\<Longrightarrow>   H s \\<le> N \\<Longrightarrow>    n < N \\<Longrightarrow>    numDeqs s = numReads s \\<Longrightarrow>   T s \\<le> N \\<Longrightarrow>    numEnqs s \\<le> n \\<Longrightarrow>   ownT s = Q \\<Longrightarrow>  hW s \\<le> N \\<Longrightarrow>   numReads s \\<le> numEnqs s \\<Longrightarrow>  \\<forall>i<n. Data s i \\<le> N \\<and> 0 < Data s i \\<Longrightarrow>  0 < H s \\<Longrightarrow>  tW s \\<le> N \\<Longrightarrow> T s \\<noteq> fst (hd (q s)) \\<longrightarrow> (\\<forall>a b j. (a, b) \\<in> set (q s) \\<and> j < N \\<and> T s \\<le> j \\<longrightarrow> a + b < j) \\<Longrightarrow> \\<forall>i. (i < numReads s \\<longrightarrow> ownD s i = R) \\<and>\n             (numReads s \\<le> i \\<and> i < numWrites s \\<longrightarrow> ownD s i = B) \\<and> (numWrites s \\<le> i \\<and> i < n \\<longrightarrow> ownD s i = W) \\<Longrightarrow>\n         \\<forall>i. fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) \\<longrightarrow> ownB s i = Q \\<Longrightarrow>    \\<forall>i\\<le>N. ownB s i \\<noteq> R \\<Longrightarrow>  numEnqs s - numReads s = length (q s) \\<Longrightarrow>   numReads s \\<le> numWrites s \\<Longrightarrow>numWrites s \\<le> n \\<Longrightarrow>\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N \\<Longrightarrow>  \\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \\<Longrightarrow>  \\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j) \\<Longrightarrow>  \\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa \\<Longrightarrow>  \\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s)) \\<Longrightarrow> \\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b \\<Longrightarrow> \\<forall>i<length (q s). data_index s (q s ! i) = numReads s + i \\<Longrightarrow> \\<forall>i<length (q s). snd (q s ! i) = Data s (numReads s + i) \\<Longrightarrow> \\<forall>i<length (q s). ownD s (i + numReads s) = B \\<Longrightarrow>  \\<forall>i\\<le>N. \\<forall>j\\<le>N. data_index s (i, j) < n \\<Longrightarrow> case_1 s \\<or> case_2 s \\<Longrightarrow> \\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q) \\<Longrightarrow>\n         fst (hd (q s)) \\<le> i \\<longrightarrow> \\<not> i < fst (hd (q s)) + snd (hd (q s)) \\<Longrightarrow> i \\<le> N \\<Longrightarrow> ownB s i = Q \\<Longrightarrow>i \\<le> N \\<and> ownB s i = Q \\<Longrightarrow> \\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> i \\<le> N \\<and> ownB s i = Q \\<Longrightarrow>\n         Q_structure s \\<Longrightarrow> (\\<And>m n. m < n \\<Longrightarrow> Suc m \\<le> n) \\<Longrightarrow>(\\<And>i j k. i \\<le> j \\<Longrightarrow> j \\<le> k \\<Longrightarrow> i \\<le> k) \\<Longrightarrow> (\\<And>m n. m < n \\<or> m = n \\<Longrightarrow> m \\<le> n) \\<Longrightarrow>(\\<And>m n. (\\<not> m \\<le> n) = (Suc n \\<le> m)) \\<Longrightarrow>\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x\"\n    apply(case_tac \"q s=[]\") \n    apply blast\n    apply(subgoal_tac \" \\<forall>i. i \\<le> N \\<and> ownB s i = Q \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x)\") prefer 2 \n    apply presburger\n    apply(subgoal_tac \"Q_structure s\") prefer 2 apply presburger \n    apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 apply presburger \n    apply(subgoal_tac \"fst (hd (q s)) \\<le> i \\<longrightarrow> \\<not> i < fst (hd (q s)) + snd (hd (q s))\") prefer 2 \n    apply meson\n    using strange_things_12 [where s=s] \n    by blast\n  next show \"\\<And>i. pcR s = idleR \\<Longrightarrow>  s' = s \\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n            numDeqs := Suc (numReads s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr> \\<Longrightarrow>  q s \\<noteq> [] \\<Longrightarrow>\n         Q_structure s \\<Longrightarrow>  0 < n \\<Longrightarrow> tempR s = (0, 0) \\<Longrightarrow>   H s \\<le> N \\<Longrightarrow>   n < N \\<Longrightarrow>numDeqs s = numReads s \\<Longrightarrow>\n         T s \\<le> N \\<Longrightarrow> numEnqs s \\<le> n \\<Longrightarrow> ownT s = Q \\<Longrightarrow>   hW s \\<le> N \\<Longrightarrow>   numReads s \\<le> numEnqs s \\<Longrightarrow>    \\<forall>i<n. Data s i \\<le> N \\<and> 0 < Data s i \\<Longrightarrow>\n         0 < H s \\<Longrightarrow> tW s \\<le> N \\<Longrightarrow>  T s \\<noteq> fst (hd (q s)) \\<longrightarrow> (\\<forall>a b j. (a, b) \\<in> set (q s) \\<and> j < N \\<and> T s \\<le> j \\<longrightarrow> a + b < j) \\<Longrightarrow>\n         \\<forall>i. (i < numReads s \\<longrightarrow> ownD s i = R) \\<and> (numReads s \\<le> i \\<and> i < numWrites s \\<longrightarrow> ownD s i = B) \\<and> (numWrites s \\<le> i \\<and> i < n \\<longrightarrow> ownD s i = W) \\<Longrightarrow>\n         \\<forall>i. fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) \\<longrightarrow> ownB s i = Q \\<Longrightarrow> \\<forall>i\\<le>N. ownB s i \\<noteq> R \\<Longrightarrow>\n         numEnqs s - numReads s = length (q s) \\<Longrightarrow>  numReads s \\<le> numWrites s \\<Longrightarrow>  numWrites s \\<le> n \\<Longrightarrow>  \\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N \\<Longrightarrow>    \\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n             fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \\<Longrightarrow>  \\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j) \\<Longrightarrow> \\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa \\<Longrightarrow>  \\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s)) \\<Longrightarrow>  \\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b \\<Longrightarrow>   \\<forall>i<length (q s). data_index s (q s ! i) = numReads s + i \\<Longrightarrow> \\<forall>i<length (q s). snd (q s ! i) = Data s (numReads s + i) \\<Longrightarrow>  \\<forall>i<length (q s). ownD s (i + numReads s) = B \\<Longrightarrow>  \\<forall>i\\<le>N. \\<forall>j\\<le>N. data_index s (i, j) < n \\<Longrightarrow>  case_1 s \\<or> case_2 s \\<Longrightarrow>  \\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q) \\<Longrightarrow>\n         fst (hd (q s)) \\<le> i \\<longrightarrow> \\<not> i < fst (hd (q s)) + snd (hd (q s)) \\<Longrightarrow>  \\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x \\<Longrightarrow>   (\\<And>m n. m < n \\<Longrightarrow> Suc m \\<le> n) \\<Longrightarrow> (\\<And>i j k. i \\<le> j \\<Longrightarrow> j \\<le> k \\<Longrightarrow> i \\<le> k) \\<Longrightarrow>   (\\<And>m n. m < n \\<or> m = n \\<Longrightarrow> m \\<le> n) \\<Longrightarrow> (\\<And>m n. (\\<not> m \\<le> n) = (Suc n \\<le> m)) \\<Longrightarrow> i \\<le> N \\<and> ownB s i = Q\" \n  proof -\n    fix i :: nat\n    assume a1: \"q s \\<noteq> []\"\n    assume a2: \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\"\n    assume a3: \"\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x\"\n    have \"\\<forall>n. ((\\<exists>N. n \\<in> N \\<and> (\\<exists>n na. (n, na) \\<in> set (q s) \\<and> {nb. n \\<le> nb \\<and> nb < n + na} = N)) \\<or> Q \\<noteq> ownB s n \\<or> \\<not> n \\<le> N) \\<and> (Q = ownB s n \\<and> n \\<le> N \\<or> (\\<forall>N. n \\<notin> N \\<or> (\\<forall>n na. (n, na) \\<notin> set (q s) \\<or> {nb. n \\<le> nb \\<and> nb < n + na} \\<noteq> N)))\"\n    using a2 by (metis (full_types))\n    then show \"i \\<le> N \\<and> ownB s i = Q\"\n    using a3 a1 by (metis (no_types) list.set_sel(2))\n  qed\nqed\n\n\n\n\nlemma R_read_to_release_lemma_case_1:\n  \"con_assms s \\<Longrightarrow> pcR s = Read\\<Longrightarrow>pre_Read_inv s\n  \\<Longrightarrow>s'=(s\\<lparr>tR := T s, numReads := Suc (data_index s (tempR s)),\n          pcR := Release,\n          ownD :=\n            \\<lambda>i. if i = data_index s (tempR s) then R\n                 else ownD\n                       (s\\<lparr>tR := T s,\n                            numReads := Suc (data_index s (tempR s)),\n                            pcR := Release\\<rparr>)\n                       i\\<rparr>)\n\\<Longrightarrow>inv s \n\\<Longrightarrow>case_1 s\n\\<Longrightarrow>case_1 s'\"\n  by(simp add:case_1_lemmas)\n\nlemma R_read_to_release_lemma_case_2:\n  \"con_assms s \\<Longrightarrow> pcR s = Read\\<Longrightarrow>pre_Read_inv s\n  \\<Longrightarrow>s'=(s\\<lparr>tR := T s, numReads := Suc (data_index s (tempR s)),\n          pcR := Release,\n          ownD :=\n            \\<lambda>i. if i = data_index s (tempR s) then R\n                 else ownD\n                       (s\\<lparr>tR := T s,\n                            numReads := Suc (data_index s (tempR s)),\n                            pcR := Release\\<rparr>)\n                       i\\<rparr>)\n\\<Longrightarrow>inv s \n\\<Longrightarrow>case_2 s\n\\<Longrightarrow>case_2 s'\"\n  by(simp add:case_2_lemmas)\n\nlemma R_read_to_release_lemma_2:\n  \"con_assms s \\<Longrightarrow> pcR s = Read\\<Longrightarrow>pre_Read_inv s\n  \\<Longrightarrow>s'=(s\\<lparr>tR := T s, numReads := Suc (data_index s (tempR s)),\n          pcR := Release,\n          ownD :=\n            \\<lambda>i. if i = data_index s (tempR s) then R\n                 else ownD\n                       (s\\<lparr>tR := T s,\n                            numReads := Suc (data_index s (tempR s)),\n                            pcR := Release\\<rparr>)\n                       i\\<rparr>)\n\\<Longrightarrow>inv s \n\\<Longrightarrow>Q_owns_bytes s\n\\<Longrightarrow>Q_owns_bytes s'\"\n  by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\nlemma T_modification_rule:\n  \"s'=(s\\<lparr>T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>) \\<Longrightarrow> T s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n  by simp\n\nlemma T_modification_rule_2:\n  \"s'=(s\\<lparr>ownT := Q,\n          ownB :=\n            \\<lambda>i. if (if T s \\<le> i \\<and> i < N then B else ownB (s\\<lparr>ownT := Q\\<rparr>) i) = R \\<and> i \\<le> N then B\n                else ownB (setownB [(tR s, N) B] (s\\<lparr>ownT := Q\\<rparr>)) i,\n          tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>) \\<Longrightarrow> T s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n  by simp\n\nlemma T_push:\n  \" T s = fst (tempR s) \\<Longrightarrow>s'=s \\<lparr>ownT := Q,\n          ownB :=\n            \\<lambda>i. if ownB s i = R \\<and> i \\<le> N then B\n                else ownB ((if T s \\<noteq> fst (tempR s) then setownB [(tR s, N) B] else id) (s\\<lparr>ownT := Q\\<rparr>)) i,\n          tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr> \\<Longrightarrow>\nT s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n  by simp\n\nlemma T_push_2 :\n  \" T s = fst (tempR s) \\<Longrightarrow>s'=(s\\<lparr>ownT := Q, ownB := \\<lambda>i. if ownB s i = R \\<and> i \\<le> N then B else ownB (id (s\\<lparr>ownT := Q\\<rparr>)) i, tempR := (0, 0), pcR := idleR,\n          T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>) \\<Longrightarrow>\nT s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n  by simp\n\nlemma R_release_to_idle_lemma_1:\n  \"con_assms s \\<Longrightarrow> pcR s = Release \\<Longrightarrow> pre_Release_inv s\n  \\<Longrightarrow> s'=s \\<lparr>ownT := Q,\n          ownB :=\n            \\<lambda>i. if ownB s i = R \\<and> i \\<le> N then B\n                else ownB ((if T s \\<noteq> fst (tempR s) then setownB [(tR s, N) B] else id) (s\\<lparr>ownT := Q\\<rparr>)) i,\n          tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>\n\\<Longrightarrow>inv s \\<Longrightarrow> T s = fst (tempR s)\n\\<Longrightarrow>case_1 s\n\\<Longrightarrow>case_1 s'\"\n  apply (simp add:inv_def)       \n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"T s' = fst (tempR s) + Data s (numReads s - Suc 0)\") prefer 2 \n  using T_push [where s =s and s'=s'] \n  apply fastforce\n  apply(simp add:case_1_lemmas)\n  apply clarify \n  apply(rule_tac ?x = \"b\" in exI)\n  apply(rule_tac ?x = \"b\" in exI) \n  apply(intro conjI impI)\n  apply fastforce \n  apply(rule_tac ?x = \"c\" in exI) \n  apply(intro conjI impI) \n  apply blast\n  apply blast \n  apply (metis (no_types, lifting) le_trans less_or_eq_imp_le linorder_neqE_nat)\n  apply (metis Suc_leI not_less_eq_eq)\n  apply (metis F.distinct(11)) \n  apply (metis F.distinct(1)) \n  apply metis    \n  apply meson\n  apply (metis le_add_diff_inverse)\n  apply meson\n  apply meson\n  apply fastforce\n  apply blast\n  apply blast\n  apply meson\n  by meson\n\n\n\nlemma R_release_nequal_case_2:\n  \"con_assms s \\<Longrightarrow> pcR s = Release \\<Longrightarrow> pre_Release_inv s\n\\<Longrightarrow>inv s \\<Longrightarrow> T s \\<noteq> fst (tempR s)\n\\<Longrightarrow>case_2 s\"\n  apply (simp add:inv_def)       \n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) \n  apply(simp add:case_1_lemmas)\n  apply(subgoal_tac \"H s>T s\") prefer 2 \n  apply metis\n  apply(simp add:case_2_lemmas)\n  by metis\n\n\nlemma R_release_nequal_case_2_2:\n  \"con_assms s \\<Longrightarrow> pcR s = Release \\<Longrightarrow> pre_Release_inv s\n\\<Longrightarrow>inv s \\<Longrightarrow> T s \\<noteq> fst (tempR s) \\<Longrightarrow> s' = s\n    \\<lparr>ownT := Q,\n       ownB :=\n         \\<lambda>i. if (if T s \\<le> i \\<and> i < N then B else ownB (s\\<lparr>ownT := Q\\<rparr>) i) = R \\<and> i \\<le> N then B\n             else ownB ((if T s \\<noteq> fst (tempR s) then setownB [(tR s, N) B] else id) (s\\<lparr>ownT := Q\\<rparr>)) i,\n       tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>\n\\<Longrightarrow>case_1 s'\"\n  apply(subgoal_tac \"case_2 s\") prefer 2 using  R_release_nequal_case_2 [where s=s]\n  apply blast\n  apply (simp add:inv_def)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"H s < T s\") prefer 2 \n  apply(simp add:case_2_lemmas)\n  apply meson\n  apply(simp add:case_2_lemmas case_1_lemmas)\n  apply clarify\n  apply(rule_tac ?x = \"a\" in exI)\n  apply(rule_tac ?x = \"a\" in exI)\n  apply(intro conjI impI)\n  apply blast\n  apply(rule_tac ?x = \"b\" in exI)\n  apply(intro conjI impI)\n  apply blast\n  apply blast\n  apply (metis add_cancel_left_left le_trans less_or_eq_imp_le)\n  apply (metis le_antisym less_irrefl_nat less_or_eq_imp_le)\n  apply (metis F.distinct(11) F.distinct(21) gr0_conv_Suc nat.discI nat_less_le)\n  apply (metis F.distinct(1))\n  apply (metis nat_le_linear nat_less_le)\n  apply meson\n  apply (metis add_cancel_right_left)\n  apply fastforce\n  apply meson\n  apply force\n  apply blast\n  apply (metis add_cancel_left_left diff_self_eq_0 le_neq_implies_less)\n  apply (metis le_neq_implies_less)\n  by meson\n\n\nlemma R_release_nequal_case_1_1:\n  \"con_assms s \\<Longrightarrow> pcR s = Release \\<Longrightarrow> pre_Release_inv s\n\\<Longrightarrow>inv s \\<Longrightarrow> T s = fst (tempR s) \\<Longrightarrow> s'=(s\\<lparr>ownT := Q, ownB := \\<lambda>i. if ownB s i = R \\<and> i \\<le> N then B else ownB (id (s\\<lparr>ownT := Q\\<rparr>)) i, tempR := (0, 0), pcR := idleR,\n          T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>) \\<Longrightarrow> case_1 s\n\\<Longrightarrow>case_1 s'\"\n  apply (simp add:inv_def)       \n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"T s' = fst (tempR s) + Data s (numReads s - Suc 0)\") prefer 2 \n  using T_push_2 [where s=s and s'=s']\n  apply fastforce\n  apply(simp add:case_1_lemmas) \n  apply clarify \n  apply(rule_tac ?x = \"b\" in exI)\n  apply(rule_tac ?x = \"b\" in exI) \n  apply(intro conjI impI)\n  apply fastforce \n  apply(rule_tac ?x = \"c\" in exI) \n  apply(intro conjI impI) \n  apply blast\n  apply blast\n  apply (metis diff_commute diff_diff_cancel diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply (metis le_imp_less_Suc not_less_eq)\n  apply (metis F.distinct(11))\n  apply (metis F.distinct(1))\n  apply metis\n  apply blast\n  apply (metis le_add_diff_inverse)\n  apply meson\n  apply fastforce\n  apply fastforce\n  apply force\n  apply blast\n  apply meson\n  by fastforce\n\n\n\nlemma R_release_equal_case_2_3:\n  \"con_assms s \\<Longrightarrow> pcR s = Release \\<Longrightarrow> pre_Release_inv s\n\\<Longrightarrow>inv s \\<Longrightarrow> T s = fst (tempR s) \\<Longrightarrow> s'=(s\\<lparr>ownT := Q, ownB := \\<lambda>i. if ownB s i = R \\<and> i \\<le> N then B else ownB (id (s\\<lparr>ownT := Q\\<rparr>)) i, tempR := (0, 0), pcR := idleR,\n          T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>) \\<Longrightarrow> case_2 s\n\\<Longrightarrow>case_2 s'\"\n  apply (simp add:inv_def)       \n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"T s' = fst (tempR s) + Data s (numReads s - Suc 0)\") prefer 2 \n  using T_push_2 [where s =s and s'=s'] \n  apply fastforce apply(simp_all)\n  apply(simp add:case_2_lemmas)\n  apply clarify \n  apply(rule_tac ?x = \"0\" in exI)\n  apply(rule_tac ?x = \"b\" in exI) \n  apply(intro conjI impI)\n  apply fastforce \n  apply(rule_tac ?x = \"H s\" in exI) \n  apply(intro conjI impI) \n  apply fastforce\n  apply(rule_tac ?x = \"e\" in exI)\n  apply(intro conjI impI) \n  apply (metis le_add_diff_inverse trans_less_add1)\n  apply(rule_tac ?x = \"e\" in exI)\n  apply(intro conjI impI) \n  apply fastforce\n  apply(rule_tac ?x = \"f\" in exI)\n  apply(intro conjI impI) \n  apply fastforce\n  apply blast\n  apply blast\n  apply (metis F.distinct(11) less_nat_zero_code)\n  apply (metis F.distinct(1))\n  apply (metis (mono_tags, hide_lams) diff_is_0_eq' le_trans linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply (metis le_imp_less_Suc not_less_eq)\n  apply (metis F.distinct(11))\n  apply (metis F.distinct(15))\n  apply fastforce\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply (metis gr_implies_not_zero le_add_diff_inverse)\n  apply blast\n  apply meson\n  apply meson\n  apply blast\n  apply fastforce\n  apply blast\n  apply (metis less_nat_zero_code)\n  apply meson\n  apply (metis less_nat_zero_code)\n  apply (metis less_nat_zero_code)\n  by (metis less_nat_zero_code)\n\n\n\n  \n\n\n\n\nlemma Q_continues_to_own_through_release:\n  \"Q_owns_bytes s \\<Longrightarrow> inv s \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \n  \\<Longrightarrow> pre_Release_inv s\n  \\<Longrightarrow> Q_owns_bytes s'\"\n  apply simp\n  apply(simp add:Q_lemmas Q_basic_lemmas inv_def pre_Release_inv_def)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply metis\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\") \n  by (metis F.distinct(21) nat_less_le)\n\n\n\nlemma Q_structure_continues_to_own_through_release:\n  \"Q_structure s \\<Longrightarrow> inv s \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \n  \\<Longrightarrow> pre_Release_inv s\n  \\<Longrightarrow> Q_structure s'\"\n  apply simp\n  apply(simp add:Q_lemmas Q_basic_lemmas inv_def pre_Release_inv_def)\n  by(simp add:cR_step_def)\n\n\n\n\n(************************************Local R_step shows inv  *********************************************)\n\n\nlemma R_local_release_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = Release\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n  using assms apply simp \n  apply(subgoal_tac \"Q_owns_bytes s\") prefer 2\n  using inv_def\n  apply blast\n  apply(subgoal_tac \"inv s\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"cR_step (pcR s) s s'\") prefer 2\n  apply metis\n  apply(subgoal_tac \"pcR s = Release \") prefer 2\n   apply metis \n  apply(subgoal_tac \"pre_Release_inv s\") prefer 2 \n  apply(simp add:pre_R_def)\n  apply(subgoal_tac \"Q_owns_bytes s'\") prefer 2\n  using Q_continues_to_own_through_release [where s=s and s'=s'] \n  apply blast\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using inv_def\n  apply blast\n  apply(subgoal_tac \"Q_structure s'\") prefer 2 \n  using Q_structure_continues_to_own_through_release [where s=s and s'=s']\n  apply blast\n  apply(simp add:inv_def)\n  apply(subgoal_tac \"inv s\") prefer 2 \n  using assms(1) apply linarith\n  apply(simp add:pre_R_def)\n  apply(subgoal_tac \"B_release s s'\") prefer 2 using B_release_def [where s=s and s'=s']\n  apply (metis PCR.simps(7) cR_step_def) \n  apply(subgoal_tac \"ownT s = R\") prefer 2 using pre_Release_inv_def [where s=s] \n  apply presburger\n  apply(subgoal_tac \"Q_structure s'\")\n  using Q_structure_preserved3 [where s=s and s'=s']  prefer 2 \n  apply (metis \\<open>B_release s s' \\<equiv> s' = (`T := end (tempR s) \\<circ> `pcR := idleR \\<circ> `tempR := (0, 0) \\<circ> transownB [R B] \\<circ> (if tR s \\<noteq> fst (tempR s) then setownB [(tR s, N) B] else id) \\<circ> transownT [R Q s]) s\\<close> end_simp len_def off_def)\n  apply(simp add:pre_Release_inv_def)\n  apply(intro conjI impI) apply(simp add:tempR_lemmas tempR_basic_lemmas) prefer 2\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(subgoal_tac \"T s \\<noteq> fst (tempR s)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"pre_R Release s\") prefer 2 using assms \n  apply presburger\n  apply(simp add:pre_R_def)\n  apply(subgoal_tac \"pre_Release_inv s\") prefer 2\n  apply blast\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  using R_release_nequal_case_2 [where s=s]\n  using assms(2) apply fastforce\n  apply(simp_all)\n  apply(subgoal_tac \"case_1 s'\") prefer 2 using R_release_nequal_case_2_2 [where s'=s' and s=s] \n  using assms(2) apply blast\n  apply presburger\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(case_tac[!] \"T s = fst(tempR s)\") apply(simp_all)\n  apply(subgoal_tac \"case_1 s'\") \n  using R_release_nequal_case_1_1 [where s=s and s'=s'] \n  apply presburger\n  apply(subgoal_tac \"pre_R (pcR s) s\") prefer 2 \n  using assms(4) apply blast\n  apply(simp add:pre_R_def) apply(subgoal_tac \"pre_Release_inv s\") prefer 2 \n  apply blast\n  using R_release_nequal_case_1_1 [where s=s and s'=s']\n  using assms(2) apply presburger\n  apply(subgoal_tac \"case_2 s'\")\n  using R_release_equal_case_2_3 [where s=s and s'=s']\n  apply presburger\n  apply(subgoal_tac \"pre_R (pcR s) s\") prefer 2 \n  using assms(4) apply blast\n  apply(simp add:pre_R_def) apply(subgoal_tac \"pre_Release_inv s\") prefer 2 \n  apply blast\n  using R_release_equal_case_2_3 [where s=s and s'=s']\n  using assms(2) by presburger\n\n\n\nlemma R_local_idle_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = idleR\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n  using assms apply simp\n  apply(simp add:pre_R_def cR_step_def)\n  apply(case_tac \"q s=[]\")  apply(case_tac \"pcR s'\") apply (simp,simp,simp)\n  apply(subgoal_tac \"Q_structure s'\") prefer 2 \n  using Q_structure_preserved1 [where s=s and s'=s'] inv_def\n  apply meson \n  apply (simp add: RingBuffer_BD_latest_3.inv_def)  apply simp\n  apply(simp add:pre_dequeue_inv_def)\n  apply(subgoal_tac \"s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"Q_owns_bytes s'\") prefer 2\n  using R_idle_to_nidle_lemma_case_1_7 [where s=s and s'=s'] assms\n  apply fastforce\n  apply(simp add:inv_def)\n  apply(clarify)\n  apply(intro conjI impI)\n  apply (metis add.right_neutral add_Suc_right diff_diff_left)\n  apply (metis diff_is_0_eq length_0_conv not_less_eq_eq)\n  apply (metis diff_is_0_eq' le_trans length_0_conv not_less_eq_eq)\n  apply(case_tac \"case_1 s\") apply simp \n  apply(subgoal_tac \"case_1 s'\\<longrightarrow>case_1 s' \\<or> case_2 s'\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"case_1 s'\") \n  apply blast\n  apply simp \n  using R_idle_to_nidle_lemma_case_1_5 [where s=s and s'=s'] \n  using assms(1) assms(2) assms(4) \n  apply presburger\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast\n  apply(thin_tac \"\\<not>case_1 s\") apply simp \n  using R_idle_to_nidle_lemma_case_1_6 [where s=s and s'=s'] \n  using assms(1) assms(2) assms(4) by presburger\n\n\n\nlemma R_local_read_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = Read\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n  using assms apply simp\n  apply(simp add:inv_def)\n  apply(simp add:pre_R_def)\n  apply(subgoal_tac \"B_read s s'\") prefer 2 using B_read_def [where s=s and s'=s'] \n   apply (metis PCR.simps(9) cR_step_def)\n  apply(subgoal_tac \"ownT s = R\") prefer 2 using pre_Read_inv_def [where s=s] \n  apply presburger\n  apply(subgoal_tac \"Q_structure s'\")\n  using Q_structure_preserved2 [where s=s and s'=s']  prefer 2\n  apply blast\n  apply(simp add:pre_Read_inv_def)\n  apply(intro conjI impI)\n  apply (metis F.distinct(5) le_antisym le_eq_less_or_eq not_less_eq_eq)\n  apply (metis F.distinct(5) Suc_leI le_eq_less_or_eq not_less_eq_eq)\n   apply(case_tac \"case_1 s\")\n    apply(subgoal_tac \"case_1 s'\")\n     apply fastforce\n  apply(subgoal_tac \"pre_Read_inv s\") prefer 2\n  apply (metis PCR.simps(9) assms(4) pre_R_def)\n  using R_read_to_release_lemma_case_1 [where s=s and s'=s']\n  using assms(1) assms(2) apply fastforce\n  apply(subgoal_tac \"case_2 s\") prefer 2\n    apply blast\n   apply(thin_tac \"\\<not>case_1 s\") \n  apply(subgoal_tac \"case_2 s'\")\n  apply force\n  using R_read_to_release_lemma_case_2 [where s=s and s'=s']\n  apply (metis PCR.simps(9) assms(1) assms(2) assms(4) pre_R_def)\n  using R_read_to_release_lemma_2 [where s=s and s'=s']\n  by (metis PCR.simps(9) assms(1) assms(2) assms(4) pre_R_def)\n\n\nlemma R_step_preserves_inv:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n  using assms apply(case_tac \"pcR s\") \n  using R_local_release_lemma [where s=s and s'=s'] apply blast       \n  using R_local_idle_lemma [where s=s and s'=s'] apply blast         \n  using R_local_read_lemma [where s=s and s'=s'] by blast         \n\n\n\n\n\n\n\n\n\n(*******************************LOCAL W_step shows inv s'*************************************)\n\n\nlemma W_inv_A1_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A1\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A1_inv_def)\n  apply (intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\")\n  apply(simp add:case_1_lemmas)\n  apply(simp add:case_2_lemmas)\n  by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\n\n\nlemma W_inv_A2_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A2\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A2_inv_def)\n  apply(case_tac \"tW s = hW s\", simp_all)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (elim conjE disjE)\n  apply(case_tac \"case_1 s'\") \n  using case_trans_A2_to_A3_2 [where s=s]\n  apply blast \n  using \\<open>\\<And>s'. \\<lbrakk>s' = s\\<lparr>ownT := W, pcW := A3\\<rparr>; T s = H s; case_1 s\\<rbrakk> \\<Longrightarrow> case_1 s'\\<close> apply presburger\n  apply (metis case_split_2 le_refl)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(case_tac \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (elim conjE disjE)\n  apply(subgoal_tac \"\\<not>case_1 s\") prefer 2\n  apply (metis case_split_4 less_eqE trans_less_add1)\n  apply meson\n  apply(subgoal_tac \"case_2 s'\")\n  apply blast apply simp\n  using  case_trans_A2_to_A4_3 [where s=s]\n  apply (meson case_split_2 not_less)\n  apply (metis case_trans_A2_to_A4_2)\n  apply (metis case_split_2)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(case_tac \"tW s < hW s\", simp_all)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (metis case_split_2 case_trans_A2_to_A5_2)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (elim conjE disjE)\n  apply (metis case_split_4 less_eqE linorder_neqE_nat trans_less_add1)\n  apply (metis case_split_2 case_trans_A2_to_A8_4 linear nat_less_le)\n  apply (metis case_trans_A2_to_A8_2)\n  apply (metis case_split_2)\n  by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\n\nlemma W_inv_A3_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A3\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def trans_A3_def pre_A3_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas) defer\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) \n  apply(subgoal_tac \"case_1 s\") prefer 2 \n  apply (metis RingBuffer_BD_latest_3.case_split le_refl)\n  apply(subgoal_tac \"\\<not>case_2 s'\") prefer 2 \n  using case_trans_A3_to_write_2 [where s=s and s'=s'] \n  apply (simp add: assms(1) pre_A3_inv_def trans_A3_def)\n  apply simp\n  using case_trans_A3_to_write_7 [where s=s]\n  by (simp add: assms(1) pre_A3_inv_def trans_A3_def)\n\n\nlemma W_inv_A4_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A4\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def trans_A4_def)\n  apply(intro conjI impI)  apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def trans_A4_def)\n  apply (simp add: less_diff_conv)  apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas) defer  apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)  \n  apply (metis (no_types, lifting) F.distinct(19) add.commute add_lessD1 canonically_ordered_monoid_add_class.lessE less_diff_conv) \n  apply(case_tac \"T s\\<ge>tW s\")\n  apply(subgoal_tac \"case_2 s'\") prefer 2 \n  using case_trans_A4_to_write_7 [where s=s and s'=s'] \n  apply (simp add: assms(1) assms(2) pre_A4_inv_def trans_A4_def)\n  apply meson \n  using case_trans_A4_to_write_9 [where s=s and s'=s'] \n  using assms(1) pre_A4_inv_def trans_A4_def by auto\n\n\n\nlemma W_inv_A5_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A5\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A5_inv_def)\n  apply(case_tac \"Data s (numEnqs s) \\<le> N - hW s\", simp_all) defer\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all) defer defer\n  apply(intro conjI impI) apply(simp add:Q_lemmas Q_basic_lemmas)\n  prefer 2 \n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) defer\n  apply(intro conjI impI) apply(simp add:Q_lemmas Q_basic_lemmas)\n  prefer 2 \n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) defer\n  apply(intro conjI impI) apply(simp add:Q_lemmas Q_basic_lemmas)\n  prefer 2 \n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) defer\n  using case_trans_A5_to_A6_3 [where s=s and s'=s'] \n  apply (metis PCW.simps(187) assms(1) assms(2) assms(4) pre_W_def)\n  using case_trans_A5_to_A6_6 [where s=s and s'=s']\n  apply (simp add: assms(1) pre_A5_inv_def)\n  using case_trans_A5_to_A6_9 [where s=s and s'=s']\n  by (metis case_split_2 case_trans_A2_to_A8_2)\n\n\n\nlemma W_inv_A6_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A6\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A6_inv_def trans_A6_def)\n  apply(intro conjI impI)\n  apply (metis Nat.le_diff_conv2 add.commute)\n  apply(simp add:Q_lemmas Q_basic_lemmas) prefer 2\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) prefer 2 \n  using case_trans_A6_to_write_7 [where s=s and s'=s']\n  apply (metis (no_types, lifting) PCW.simps(188) assms(1) assms(2) assms(4) pre_W_def)\n  by (smt (z3) F.distinct(19) diff_add_inverse le_diff_iff le_neq_implies_less le_trans less_imp_add_positive less_or_eq_imp_le not_add_less1)\n\n\n\nlemma W_inv_A7_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A7\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A7_inv_def trans_A7_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas) prefer 2\n   apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) \n  using case_trans_A7_to_write_7 [where s=s and s'=s'] \n  by (metis (no_types, lifting) PCW.simps(189) assms(1) assms(2) assms(4) pre_W_def)\n\nlemma W_inv_A8_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A8\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A8_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n  apply (metis leD)\n  apply (metis leD)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas) \n  apply(simp add:case_2_lemmas)\n  by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\nlemma W_inv_Enqueue_lemma_prelim_1:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \\<Longrightarrow> cW_step (pcW s) s s'\n  \\<Longrightarrow> q s= []\n\\<Longrightarrow> Q_structure s'\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \" q s' = [(offset s, Data s (numDeqs s))]\")\n  prefer 2 apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply (metis le_antisym)\n  apply(intro conjI impI)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis gr0I)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  by (metis le_antisym)\n\nlemma W_inv_Enqueue_lemma_prelim_2:\n  \"con_assms s \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> cW_step (pcW s) s s'\n  \\<Longrightarrow> ownT s \\<noteq> W\n\\<Longrightarrow> q s @ [(offset s, Data s (numEnqs s))] = q s'\"\n  apply simp\n  by(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n\nlemma W_inv_Enqueue_lemma_prelim_3:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \\<Longrightarrow> cW_step (pcW s) s s'\n  \\<Longrightarrow> ownT s \\<noteq> W \\<Longrightarrow> q s = []\n\\<Longrightarrow> Q_structure s'\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \" q s' = [(offset s, Data s (numDeqs s))]\")\n  prefer 2 apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply (metis le_antisym)\n  apply(intro conjI impI)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis gr0I)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  by (metis le_antisym)\n\nlemma W_inv_Enqueue_lemma_prelim_4:\n  \"\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N \\<Longrightarrow> offset s + Data s (numEnqs s)\\<le>N\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>a b. (a, b) \\<in> set (q s') \\<longrightarrow> a + b \\<le> N\"\n  by (metis old.prod.inject rotate1.simps(2) set_ConsD set_rotate1)\n\n\nlemma W_inv_Enqueue_lemma_prelim_5:\n  \"length(q s)>0\\<Longrightarrow>\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n        fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \\<Longrightarrow>\noffset s = fst(last(q s)) + snd(last(q s)) \\<or> offset s = 0\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>i. i < length (q s') \\<and> 0 < i \\<longrightarrow>\n        fst (q s' ! (i - Suc 0)) + snd (q s' ! (i - Suc 0)) = fst (q s' ! i) \\<or> fst (q s' ! i) = 0\"\n  apply (subgoal_tac \"last(q s) = q s!(length(q s)-1)\") prefer 2 \n  using last_conv_nth apply blast\n  by (smt (z3) One_nat_def Suc_diff_1 Suc_less_eq fst_conv length_append_singleton less_antisym nth_append nth_append_length)\n\nlemma W_inv_Enqueue_lemma_prelim_6:\n  \"length(q s)>0\\<Longrightarrow>\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j) \\<Longrightarrow>\n\\<forall>i.(i<length(q s))\\<longrightarrow>offset s \\<noteq> fst(q s!i)\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>i j. i < length (q s') \\<and> j < length (q s') \\<and> i \\<noteq> j \\<longrightarrow> fst (q s' ! i) \\<noteq> fst (q s' ! j)\"\n  by (smt (z3) butlast_snoc diff_diff_cancel diff_less_mono2 fstI le_eq_less_or_eq length_butlast less_one linorder_neqE_nat nth_append nth_append_length zero_less_diff zero_less_one)\n  \nlemma W_inv_Enqueue_lemma_prelim_7:\n  \"q s\\<noteq>[]\\<Longrightarrow>\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa \\<Longrightarrow>\n\\<forall>a b. (a, b) \\<in> set (q s)  \\<longrightarrow> ((offset s> a \\<longrightarrow> a+b\\<le>offset s) \\<and> (offset s< a \\<longrightarrow> offset s + Data s (numEnqs s) \\<le>a))\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>a b aa. (a, b) \\<in> set (q s') \\<and> (\\<exists>b. (aa, b) \\<in> set (q s')) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa\" \n  by (metis nat_neq_iff old.prod.inject rotate1.simps(2) set_ConsD set_rotate1)\n  \nlemma pec_1:\n  \"q s\\<noteq>[] \\<Longrightarrow>(\\<forall>i<length (q s).\n        (offset s < fst (q s ! i) \\<longrightarrow> offset s + Data s (numEnqs s) < fst (q s ! i)) \\<and>\n        (fst (q s ! i) < offset s \\<longrightarrow> fst (q s ! i) + snd (q s ! i) \\<le> offset s)) \\<Longrightarrow>\n\\<forall>a b. (a, b) \\<in> set (q s)  \\<longrightarrow> ((offset s> a \\<longrightarrow> a+b\\<le>offset s) \\<and> (offset s< a \\<longrightarrow> offset s + Data s (numEnqs s) \\<le>a))\n\"\n  by (metis fst_conv in_set_conv_nth less_or_eq_imp_le snd_conv)\n\nlemma pec_2:\n  \"q s\\<noteq>[] \\<Longrightarrow>(\\<forall>i<length (q s).\n        (offset s < fst (q s ! i) \\<longrightarrow> offset s + Data s (numEnqs s) < fst (q s ! i)) \\<and>\n        (fst (q s ! i) < offset s \\<longrightarrow> fst (q s ! i) + snd(q s!i) \\<le> offset s)) \\<Longrightarrow>\nData s (numEnqs s)>0\\<Longrightarrow>\n\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s))\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> a\"\n  by (metis fst_conv in_set_conv_nth less_add_same_cancel1 less_irrefl_nat)\n\n\nlemma W_inv_Enqueue_lemma_prelim_8:\n  \"q s\\<noteq>[]\\<Longrightarrow>\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s)) \\<Longrightarrow>\n    \\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s))  \\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> a \\<Longrightarrow> Data s (numEnqs s)>0\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s')) \\<longrightarrow> a \\<noteq> fst (last (q s')) + snd (last (q s'))\" \n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>i. (i<length(q s) \\<and> (q s!i) = (a,b)))\") prefer 2\n  apply (simp add: in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow> q s!i = q s'!i\") prefer 2\n  apply (metis length_append_singleton nat_diff_split_asm nth_append plus_1_eq_Suc)\n  apply(subgoal_tac \"i=length(q s')-1 \\<longrightarrow> q s'!i = (offset s, Data s (numEnqs s))\") prefer 2\n  apply (metis Nil_is_append_conv last_conv_nth last_snoc)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> fst(q s!i)\") prefer 2\n  apply (metis nth_mem prod.exhaust_sel)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> fst(q s'!i)\") prefer 2\n  apply (metis diff_Suc_1 length_append_singleton)\n  apply(subgoal_tac \"fst (last (q s')) + snd (last (q s')) = offset s + Data s (numEnqs s)\") prefer 2 \n  apply (metis fst_conv last_snoc snd_conv)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s'))\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> fst(q s'!i)\") prefer 2\n  apply (metis One_nat_def Suc_pred add_eq_self_zero append_is_Nil_conv bot_nat_0.not_eq_extremum last_conv_nth last_snoc length_greater_0_conv less_SucE snd_conv)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s'))\\<longrightarrow>fst (last (q s')) + snd (last (q s')) \\<noteq> fst(q s'!i)\") prefer 2\n  apply presburger\n  by (metis fst_conv in_set_conv_nth)\n\nlemma W_inv_Enqueue_lemma_prelim_9:\n  \"q s\\<noteq>[]\\<Longrightarrow>\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b \\<Longrightarrow>\n    0< Data s (numEnqs s) \n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>a b. (a, b) \\<in> set (q s') \\<longrightarrow> 0 < b\" \n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow> q s!i = q s'!i\") prefer 2\n  apply (metis length_append_singleton nat_diff_split_asm nth_append plus_1_eq_Suc)\n  apply(subgoal_tac \"i=length(q s')-1 \\<longrightarrow> q s'!i = (offset s, Data s (numEnqs s))\") prefer 2\n  apply (metis Nil_is_append_conv last_conv_nth last_snoc)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>0< snd(q s!i)\") prefer 2\n  apply (metis nth_mem prod.exhaust_sel)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow>0< snd(q s'!i)\") prefer 2\n  apply (metis diff_Suc_1 length_append_singleton)\n  apply(subgoal_tac \"last(q s') = (offset s, Data s (numEnqs s))\") prefer 2 \n  apply (metis fst_conv last_snoc snd_conv)\n  apply(subgoal_tac \"snd(last(q s')) = Data s (numEnqs s)\") prefer 2 \n  apply (metis snd_conv)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s'))\\<longrightarrow>0< snd(q s'!i)\") prefer 2\n  apply (metis One_nat_def Suc_pred add_eq_self_zero append_is_Nil_conv bot_nat_0.not_eq_extremum last_conv_nth last_snoc length_greater_0_conv less_SucE snd_conv)\n  by (metis in_set_conv_nth snd_conv)\n  \n\nlemma W_inv_Enqueue_lemma_prelim_10:\n  \"q s\\<noteq>[]\\<Longrightarrow>\\<forall>i<length (q s). data_index s (q s ! i) = numDeqs s + i \\<Longrightarrow>\n    data_index s ((offset s, Data s (numEnqs s))) = numEnqs s\n\\<Longrightarrow> q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> numDeqs s = numDeqs s'\n\\<Longrightarrow> length(q s) = numEnqs s - numDeqs s\n\\<Longrightarrow> data_index s = data_index s'\n\\<Longrightarrow> numEnqs s +1 = numEnqs s'\n\\<Longrightarrow> Data s = Data s'\n\\<Longrightarrow> offset s= offset s'\n\\<Longrightarrow> \\<forall>i<length (q s'). data_index s' (q s' ! i) = numDeqs s' + i\" \n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow> q s!i = q s'!i\") prefer 2\n  apply (metis length_append_singleton nat_diff_split_asm nth_append plus_1_eq_Suc)\n  apply(subgoal_tac \"\\<forall>i<length (q s). data_index s' (q s' ! i) = numDeqs s' + i\") prefer 2 \n  apply (metis nth_append)\n  apply(subgoal_tac \"data_index s ((offset s, Data s (numEnqs s' -1))) = numEnqs s' -1\") prefer 2\n  apply (metis add_implies_diff)\n  apply(subgoal_tac \"data_index s' ((offset s, Data s (numEnqs s' -1))) = numEnqs s' -1\") prefer 2\n  apply metis\n  apply(subgoal_tac \"data_index s' ((offset s', Data s' (numEnqs s' -1))) = numEnqs s' -1\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<forall>i<length (q s')-1. data_index s' (q s' ! i) = numDeqs s' + i\") prefer 2\n  apply (metis add.commute append.left_neutral append_Cons length_append length_tl list.sel(3))\n  apply(subgoal_tac \"(q s' ! (length (q s')-1 )) = (offset s, Data s (numEnqs s))\") prefer 2 \n  apply (metis append_is_Nil_conv last_conv_nth last_snoc)\n  apply(subgoal_tac \"(q s' ! (length (q s')-1 )) = (offset s', Data s' (numEnqs s' -1))\") prefer 2\n  apply (metis add.commute diff_add_inverse)\n  apply(subgoal_tac \"numDeqs s + length (q s) = data_index s' (offset s', Data s' (numEnqs s' -1))\") prefer 2\n  apply (metis diff_is_0_eq' le_add_diff_inverse length_0_conv nat_le_linear)\n  apply(subgoal_tac \"length (q s') -1  = length(q s)\") prefer 2\n  apply (metis add.comm_neutral add_implies_diff length_0_conv length_append length_tl less_one linordered_semidom_class.add_diff_inverse list.sel(3) not_Cons_self2)\n  apply(subgoal_tac \"numDeqs s + length (q s') -1 = data_index s' (offset s', Data s' (numEnqs s' -1))\") prefer 2\n  apply (metis Nat.add_diff_assoc diff_is_0_eq' length_0_conv nat_le_linear)\n  by (metis Nat.lessE diff_Suc_1)\n\n\nlemma pec_3:\n  \"inv s \\<Longrightarrow> cW_step (pcW s) s s' \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \\<Longrightarrow> con_assms s \n\\<Longrightarrow> length(q s) = numEnqs s - numDeqs s\n\"\n  by(simp add:cW_step_def pre_W_def inv_def )\n\n\nlemma pec_4:\n  \"cW_step (pcW s) s s' \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \\<Longrightarrow> con_assms s \\<Longrightarrow> \n     numDeqs s = numDeqs s' \n  \\<and> data_index s = data_index s' \n  \\<and> numEnqs s +1 = numEnqs s'\n  \\<and> Data s = Data s'\n  \\<and> offset s= offset s'\n  \\<and> ownD s = ownD s'\n\"\n  by(simp add:cW_step_def )\n\n\n\n\nlemma W_inv_Enqueue_lemma_prelim_11:\n  \"q s\\<noteq>[]\\<Longrightarrow> \\<forall>i<length (q s). snd (q s ! i) = Data s (numDeqs s + i) \\<Longrightarrow>\nq s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> numDeqs s = numDeqs s'\n\\<Longrightarrow> length(q s) = numEnqs s - numDeqs s\n\\<Longrightarrow> data_index s = data_index s'\n\\<Longrightarrow> numEnqs s +1 = numEnqs s'\n\\<Longrightarrow> Data s = Data s'\n\\<Longrightarrow> offset s= offset s'\n\\<Longrightarrow>  \\<forall>i<length (q s'). snd (q s' ! i) = Data s' (numDeqs s' + i)\"\n  apply(subgoal_tac \"snd(offset s, Data s (numEnqs s)) = Data s (numEnqs s)\") prefer 2\n  apply simp\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow> q s!i = q s'!i\") prefer 2\n  apply (metis length_append_singleton nat_diff_split_asm nth_append plus_1_eq_Suc)\n  apply(subgoal_tac \"\\<forall>i<length (q s). snd(q s' ! i) = Data s' (numDeqs s' + i)\") prefer 2 \n  apply (metis nth_append)\n  apply(subgoal_tac \"snd ((offset s, Data s (numEnqs s' -1))) = Data s(numEnqs s' -1)\") prefer 2\n  apply (metis add_implies_diff)\n  apply(subgoal_tac \"snd((offset s', Data s' (numEnqs s' -1))) = Data s' (numEnqs s' -1)\") prefer 2\n  apply metis\n  apply(subgoal_tac \"\\<forall>i<length (q s')-1. snd (q s' ! i) = Data s' (numDeqs s' + i)\") prefer 2\n  apply (metis add.commute append.left_neutral append_Cons length_append length_tl list.sel(3))\n  apply(subgoal_tac \"(q s' ! (length (q s')-1 )) = (offset s, Data s (numEnqs s))\") prefer 2 \n  apply (metis append_is_Nil_conv last_conv_nth last_snoc)\n  apply(subgoal_tac \"(q s' ! (length (q s')-1 )) = (offset s', Data s' (numEnqs s' -1))\") prefer 2\n  apply (metis add.commute diff_add_inverse) \n  apply(subgoal_tac \"length (q s') -1  = length(q s)\") prefer 2\n  apply (metis add.comm_neutral add_implies_diff length_0_conv length_append length_tl less_one linordered_semidom_class.add_diff_inverse list.sel(3) not_Cons_self2)\n  by (metis Nat.lessE add.commute diff_Suc_1 le_add_diff_inverse2 length_greater_0_conv less_or_eq_imp_le zero_less_diff)\n\nlemma W_inv_Enqueue_lemma_prelim_12:\n  \"length(q s)>0\\<Longrightarrow>\\<forall>i<length (q s). ownD s (i + numDeqs s) = B\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow>ownD s = ownD s'\n\\<Longrightarrow>numDeqs s = numDeqs s'\n\\<Longrightarrow>length(q s) = numEnqs s - numDeqs s\n\\<Longrightarrow>ownD s (numEnqs s) = B\n\\<Longrightarrow> \\<forall>i<length (q s'). ownD s' (i + numDeqs s') = B\"\n  apply(subgoal_tac \"length(q s)+1 = length(q s')\") prefer 2 \n  apply (metis Suc_eq_plus1 length_append_singleton)\n  apply(subgoal_tac \" \\<forall>i<length (q s')-1 . ownD s (i + numDeqs s) = B\")\n  prefer 2 \n  apply simp\n  apply(subgoal_tac \" \\<forall>i<length (q s')-1 . ownD s' (i + numDeqs s') = B\")\n  prefer 2 \n  apply simp\n  apply(subgoal_tac \"ownD s' (length (q s')-1 + numDeqs s') = B\") \n  apply (smt (z3) add.commute add_diff_cancel_left' discrete le_eq_less_or_eq less_diff_conv)\n  apply(subgoal_tac \"length (q s')-1 + numDeqs s' = numEnqs s\") prefer 2 \n  apply linarith\n  by presburger\n\n\nlemma W_inv_Enqueue_lemma_prelim_13:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \\<Longrightarrow> cW_step (pcW s) s s'\n  \\<Longrightarrow> ownT s \\<noteq> W\n\\<Longrightarrow> Q_structure s'\"\n  apply(subgoal_tac \"numDeqs s = numDeqs s' \\<and> ownD s = ownD s' \\<and> data_index s = data_index s' \\<and> numEnqs s +1 = numEnqs s'\\<and>  Data s = Data s'\\<and> offset s= offset s'\") \n  prefer 2 using pec_4 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"length(q s) = numEnqs s - numDeqs s\") prefer 2\n  using pec_3 apply blast\n  apply(subgoal_tac \"q s @ [(offset s, Data s (numEnqs s))] = q s'\") prefer 2\n  using W_inv_Enqueue_lemma_prelim_2 [where s=s and s'=s'] \n  apply linarith\n  apply(case_tac \"q s=[]\")\n  using W_inv_Enqueue_lemma_prelim_3 [where s=s and s'=s'] \n  apply blast\n  apply(simp add:Q_structure_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_basic_struct_def)\n  apply(intro conjI impI)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  using W_inv_Enqueue_lemma_prelim_4 [where s=s and s'=s'] \n  apply presburger\n  apply(simp add:Q_gap_structure_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n        fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \\<Longrightarrow>\n        offset s = fst(last(q s)) + snd(last(q s)) \\<or> offset s = 0\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"q s @ [(offset s, Data s (numEnqs s))] = q s'\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"length(q s) > 0\") prefer 2 \n  apply blast\n  using W_inv_Enqueue_lemma_prelim_5 [where s=s and s'=s']\n  apply presburger\n  apply(simp add:Q_offsets_differ_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"length(q s) > 0\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i<length (q s). offset s \\<noteq> fst (q s ! i)\") prefer 2\n  apply metis\n  using W_inv_Enqueue_lemma_prelim_6 [where s=s and s'=s']\n  apply presburger\n  apply(simp add:Q_has_no_overlaps_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>a b. (a, b) \\<in> set (q s)  \\<longrightarrow> ((offset s> a \\<longrightarrow> a+b\\<le>offset s) \\<and> (offset s< a \\<longrightarrow> offset s + Data s (numEnqs s) \\<le>a))\")\n  prefer 2 using pec_1 [where s=s] \n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_7 [where s=s and s'=s']\n  apply presburger\n  apply(simp add: Q_has_no_uroboros_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s))\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> a\") prefer 2\n  using pec_2 [where s=s] \n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_8 [where s=s and s'=s'] \n  apply presburger\n  apply(simp add: Q_elem_size_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  using W_inv_Enqueue_lemma_prelim_9 [where s=s and s'=s']\n  apply presburger\n  apply(simp add: Q_reflects_writes_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"data_index s ((offset s, Data s (numEnqs s))) = numEnqs s\") prefer 2\n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_10 [where s=s and s'=s']\n  apply (metis (no_types, lifting) Suc_eq_plus1)\n  apply(simp add:Q_elem_rel_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  using W_inv_Enqueue_lemma_prelim_11 [where s=s and s'=s'] \n  apply (metis (no_types, lifting) Suc_eq_plus1)\n  apply(simp add:Q_reflects_ownD_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"ownD s (numEnqs s) = B\") prefer 2\n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_12 [where s=s and s'=s']\n  by (metis (no_types, lifting) length_greater_0_conv)\n \nlemma pec_5:\n  \"cW_step (pcW s) s s' \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \n\\<Longrightarrow> H s = H s' \\<and> T s = T s'\n\"\n  by(simp add:cW_step_def pre_W_def inv_def )\n\nlemma W_inv_Enqueue_cases_split_1:\n  \"case_1 s \\<Longrightarrow>  pcW s = Enqueue \\<Longrightarrow>pre_W (pcW s) s \\<Longrightarrow> cW_step (pcW s) s s'\n\\<Longrightarrow> \\<not>case_2 s'\"    \n  apply(subgoal_tac \"H s = H s' \\<and> T s = T s'\") prefer 2 using pec_5 apply blast\n  apply(simp add:case_1_lemmas) apply(simp add:case_2_lemmas)\n  by (metis dual_order.strict_iff_order less_trans)\n\nlemma W_inv_Enqueue_cases_split_2:\n  \"case_2 s \\<Longrightarrow>  pcW s = Enqueue \\<Longrightarrow>pre_W (pcW s) s \\<Longrightarrow> cW_step (pcW s) s s'\n\\<Longrightarrow> \\<not>case_1 s'\"    \n  apply(subgoal_tac \"H s = H s' \\<and> T s = T s'\") prefer 2 using pec_5 apply blast\n  apply(simp add:case_1_lemmas) apply(simp add:case_2_lemmas) \n  by (metis leD le_trans)\n\n\n\n\n\nlemma W_inv_Enqueue_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = Enqueue\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  apply(subgoal_tac \"H s = H s' \\<and> T s = T s'\") prefer 2 \n  using pec_5\n  using assms(1) assms(2) assms(3) assms(4) assms(5) apply blast\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(intro conjI impI)\n  apply (metis Suc_diff_le length_0_conv)\n  defer\n  defer \n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:tempW_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_1_lemmas) apply clarify apply(intro conjI impI)\n  apply (metis F.distinct(5) diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply (metis (mono_tags, hide_lams) F.distinct(5) F.distinct(9) le_antisym less_Suc_eq_le minus_nat.diff_0 not_less_eq plus_nat.add_0)\n  apply(subgoal_tac \"i<N \\<and> ownB s i=W\\<longrightarrow>offset s\\<le>i \\<and> i<offset s + Data s (numEnqs s)\") prefer 2\n  apply (metis nat_less_le)\n  apply(subgoal_tac \"i>N \\<and> ownB s i=W\\<longrightarrow>i>offset s + Data s (numEnqs s)\")\n  apply (metis (no_types, lifting) diff_is_0_eq le_eq_less_or_eq linorder_neqE_nat zero_less_diff)\n  apply(subgoal_tac \"end(tempW s)\\<le>N\", unfold tempW_def)[1] prefer 2\n  apply (metis end_simp fst_conv snd_conv) \n  apply (metis (no_types, lifting) less_trans_Suc nat_less_le nat_neq_iff not_less_eq_eq)\n  apply(subgoal_tac \"case_2 s\") apply simp apply(thin_tac \"\\<not>case_1 s\")[1]\n  prefer 2 apply blast apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_2_lemmas) apply clarify \n  using Suc_diff_le apply presburger\n  defer defer\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply clarify\n  apply(intro conjI impI)\n  apply(rule_tac ?x = \"{i. offset s \\<le> i \\<and> i < offset s + Data s (numEnqs s)}\" in exI)\n  apply (intro conjI impI)\n  apply metis\n  apply(case_tac \"case_1 s\") apply(simp)\n  apply(simp add:case_1_lemmas) apply clarify apply(intro conjI impI)\n  apply (metis F.distinct(5) diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply (metis (no_types, lifting) Suc_le_lessD fst_conv not_less_eq_eq snd_conv tempW_def)\n  apply(subgoal_tac \"case_2 s\") apply simp apply(thin_tac \"\\<not>case_1 s\")[1]\n  prefer 2 apply blast apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_2_lemmas) apply clarify \n  apply (intro conjI impI)\n  apply (metis le_eq_less_or_eq nat_le_linear)\n  apply(subgoal_tac \"i\\<ge>H s\\<and>i<T s\\<longrightarrow>ownB s i=B\") prefer 2\n  apply metis\n  apply(subgoal_tac \"i\\<ge>T s\\<and>i<e\\<longrightarrow>ownB s i=R\") prefer 2\n  apply metis\n  apply(subgoal_tac \"i\\<ge>e\\<and>i<f\\<longrightarrow>ownB s i=Q\") prefer 2\n  apply metis\n  apply(subgoal_tac \"i\\<ge>f\\<and>i<N\\<longrightarrow>ownB s i=D\") prefer 2\n  apply metis\n  apply(subgoal_tac \"i\\<ge>H s\\<and>i<N\\<longrightarrow>ownB s i\\<noteq>W\") prefer 2 \n  apply (metis F.distinct(1) F.distinct(3) F.distinct(5) F.distinct(7) diff_is_0_eq neq0_conv zero_less_diff)\n  apply (metis (no_types, lifting) diff_is_0_eq gr0I zero_less_diff)\n  apply(clarsimp)\n  apply(intro iffI)\n  apply clarify apply simp\n  apply(case_tac \"(a, b) \\<in> set (q s)\") apply simp \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"(i\\<le>N \\<and> ownB s i\\<noteq>Q)\\<longrightarrow>(\\<nexists>a b. ((a,b)\\<in>set(q s)\\<and> a\\<le>i \\<and> i<a+b))\")\n  prefer 2 \n  apply (metis fst_eqD snd_eqD tempW_def)\n  apply(subgoal_tac \"a = offset s \\<and> b = Data s (numEnqs s)\") prefer 2\n  apply meson\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply clarify apply simp\n  apply(subgoal_tac \"ownB s i=Q \\<and> i\\<le>N\\<longleftrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x)\")\n  prefer 2 \n  apply presburger\n  apply simp \n  apply metis\n  apply clarify\n  apply(case_tac \"ownT s = W\", simp_all)\n  apply(subgoal_tac \"Q_structure s'\") \n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_1 [where s=s and s'=s'] assms \n  apply fastforce\n  prefer 2\n  apply(subgoal_tac \"Q_structure s'\") \n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_13 [where s=s and s'=s'] assms \n  apply fastforce\n  apply(case_tac \"case_1 s\", simp_all) prefer 2 apply(simp add:case_2_lemmas)\n  prefer 2\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(subgoal_tac \"\\<not>case_2 s'\") prefer 2 using W_inv_Enqueue_cases_split_1 [where s=s and s'=s'] assms\n  apply fastforce\n  prefer 2\n  apply(subgoal_tac \"\\<not>case_1 s'\") prefer 2 using W_inv_Enqueue_cases_split_2 [where s=s and s'=s'] assms\n  apply fastforce\n  apply(simp_all)\n  apply(thin_tac \"\\<not>case_1 s\") \n  apply(subgoal_tac \"case_2 s'\") \n  apply presburger\n  apply(thin_tac \"\\<not> case_1(s\\<lparr>numEnqs := Suc (numEnqs s),ownB := \\<lambda>i. if ownB s i = W \\<and> i \\<le> N then Q\n                   else ownB ((if ownT s = W then ownT_update (\\<lambda>_. Q) else (\\<lambda>s. s\\<lparr>ownT := ownT s\\<rparr>)) s\\<lparr>numEnqs := Suc (numEnqs s)\\<rparr>)i, pcW := idleW, q := q s @ [(offset s, Data s (numEnqs s))]\\<rparr>)\")\n  defer\n  apply(subgoal_tac \"case_1 s'\") \n  apply presburger\n  apply(thin_tac \"\\<not> case_2 (s\\<lparr>numEnqs := Suc (numEnqs s),ownB := \\<lambda>i. if ownB s i = W \\<and> i \\<le> N then Q\n                   else ownB ((if ownT s = W then ownT_update (\\<lambda>_. Q) else (\\<lambda>s. s\\<lparr>ownT := ownT s\\<rparr>)) s\\<lparr>numEnqs := Suc (numEnqs s)\\<rparr>)  i,  pcW := idleW, q := q s @ [(offset s, Data s (numEnqs s))]\\<rparr>)\")\n  defer\n  apply(subgoal_tac \"case_1 s'\")\n  apply presburger\n  defer                      \n  apply(simp add:case_2_lemmas)\n  apply clarify\n  apply(intro conjI impI) \n  using F.distinct(9) apply presburger\n  apply(rule_tac ?x = \"a\" in exI)\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"e\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"f\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply linarith\n  apply (metis F.distinct(1))\n  apply (metis (mono_tags, hide_lams) le_eq_less_or_eq le_trans nat_le_linear)\n  apply (metis Suc_diff_Suc Zero_not_Suc diff_is_0_eq')\n  apply (metis F.distinct(5))\n  apply (metis F.distinct(1))\n  apply (metis (mono_tags, hide_lams))\n  apply (metis F.distinct(7))\n  apply blast\n  apply meson\n  apply meson\n  apply meson\n  apply blast\n  apply meson\n  apply meson\n  apply force\n  apply force\n  apply force\n  apply force\n  apply force\n  apply force\n  apply (metis (mono_tags, hide_lams) F.distinct(1) F.distinct(13) add_diff_cancel_left' eq_imp_le fst_eqD linorder_neqE_nat snd_eqD tempW_def zero_less_diff)\n  apply (metis hd_append2)\n  apply (metis fst_eqD hd_append le_neq_implies_less less_irrefl_nat list.sel(1))\n  apply force\n  apply (metis add_is_0)\n  apply force\n  apply fastforce\n  apply(case_tac \"q s=[]\")\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_1_lemmas)\n  apply(clarify)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = \"b\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply linarith\n  apply (metis F.distinct(5))\n  apply (metis F.distinct(1))\n  apply (metis le_trans less_eq_Suc_le less_or_eq_imp_le not_less_eq_eq)\n  apply (metis le_imp_less_Suc not_less_eq)\n  apply (metis)\n  apply blast\n  apply blast\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  apply (metis F.distinct(1) F.distinct(5) Nat.add_0_right le_eq_less_or_eq nat_add_left_cancel_less nat_le_linear)\n  apply (metis fst_eqD hd_append2 list.sel(1) nat_less_le self_append_conv2)\n  apply blast\n  apply meson\n  apply (metis le_neq_implies_less)\n  apply (metis le_neq_implies_less)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_1_lemmas)\n  apply(clarify)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = \"fst (hd (q s))\" in exI)\n  apply(intro conjI impI)\n  apply blast\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply linarith\n  apply (metis F.distinct(5))\n  apply (metis F.distinct(1))\n  apply (smt (z3) le_eq_less_or_eq le_trans linorder_neqE_nat)\n  apply (metis le_trans less_eq_Suc_le less_or_eq_imp_le not_less_eq_eq)\n  apply (metis le_imp_less_Suc not_less_eq)\n  apply (metis)\n  apply blast\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  apply linarith\n  apply fastforce\n  apply (metis F.distinct(1) F.distinct(5) Nat.add_0_right le_eq_less_or_eq nat_add_left_cancel_less nat_le_linear)\n  apply metis\n  apply force\n  apply meson\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_1_lemmas)\n  apply(clarify)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = \"b\" in exI)\n  apply(intro conjI impI)\n  apply blast\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply blast\n  apply (metis F.distinct(5))\n  apply (metis F.distinct(1))\n  apply (metis le_neq_implies_less le_trans less_imp_le_nat)\n  apply (metis le_imp_less_Suc not_less_eq)\n  apply (metis F.distinct(5))\n  apply metis\n  apply metis\n  apply fastforce\n  apply force\n  apply metis\n  apply meson\n  apply (metis (mono_tags, hide_lams) F.distinct(5) Nat.add_0_right le_refl less_nat_zero_code linorder_neqE_nat nat_add_left_cancel_less)\n  apply (metis nat_less_le)\n  by blast\n\n\n\nlemma W_inv_idleW_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = idleW\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_acquire_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply (metis leD)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas) \n  apply(simp add:case_2_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas) \n  apply(subgoal_tac \"case_2 (s\\<lparr>pcW := FinishedW\\<rparr>)\")\n  apply blast apply simp apply(thin_tac \"\\<not> case_1 s \") \n  apply(simp add:case_2_lemmas)\n  prefer 2 \n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply clarify\n  apply(rule_tac ?x = \"a\" in exI)\n  apply(rule_tac ?x = \"b\" in exI)\n  apply(intro conjI impI) apply metis\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) \n  apply blast\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply blast\n  apply(rule_tac ?x = \"e\" in exI)\n  apply(intro conjI impI) \n  apply blast\n  apply(rule_tac ?x = \"f\" in exI)\n  apply(intro conjI impI) \n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast \n  apply meson\n  apply metis\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  by meson\n\n\n\nlemma W_inv_OOM_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = OOM\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_OOM_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas)\n  apply(simp add:case_2_lemmas)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\n\n\n\nlemma W_inv_FinishedW_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = FinishedW\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms by(simp add:inv_def pre_W_def cW_step_def pre_OOM_inv_def)\n\n\n\nlemma W_inv_Write_lemma_prelim_1:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\n\\<Longrightarrow>q s=q s' \\<and> numDeqs s = numDeqs s'\"\n  apply simp \n  by(simp add:cW_step_def)\n\nlemma W_inv_Write_lemma_prelim_2:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\n\\<Longrightarrow>\\<forall>a b. ((a,b)\\<noteq>(offset s, Data s (numEnqs s)))\\<longrightarrow> data_index s' (a,b) = data_index s (a,b)\"\n  apply simp \n  by(simp add:cW_step_def)\n\nlemma W_inv_Write_lemma_prelim_3:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\n\\<Longrightarrow>\\<forall>i. i<length(q s) \\<longrightarrow> ((q s ! i)\\<noteq>(offset s, Data s (numEnqs s)))\\<longrightarrow> data_index s' ((q s ! i)) = data_index s ((q s ! i))\"\n  apply simp \n  by(simp add:cW_step_def)\n\n\nlemma W_inv_Write_lemma_prelim_4:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s\n\\<Longrightarrow>\\<forall>i<length (q s). data_index s' (q s ! i) = data_index s (q s ! i)\"\n  apply simp \n  apply(simp add:cW_step_def pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  by (metis fst_conv less_nat_zero_code list.size(3))\n\nlemma W_inv_Write_lemma_prelim_5:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s). Data s (numDeqs s + i) = snd(q s ! i)\"\n  apply simp \n  apply(simp add:cW_step_def pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  by(simp add:inv_def Q_lemmas Q_basic_lemmas) \n\nlemma W_inv_Write_lemma_prelim_6:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s). Data s (numDeqs s + i) = Data s' (numDeqs s' + i)\"\n  apply simp \n  by(simp add:cW_step_def pre_write_inv_def)\n\nlemma W_inv_Write_lemma_prelim_7:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s). snd(q s ! i) = snd(q s' ! i)\"\n  apply simp \n  using W_inv_Write_lemma_prelim_1 by auto\n\nlemma W_inv_Write_lemma_prelim_8:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s'). Data s' (numDeqs s' + i) = snd(q s' ! i)\"\n  apply simp \n  using W_inv_Write_lemma_prelim_1 W_inv_Write_lemma_prelim_5 W_inv_Write_lemma_prelim_6 by presburger\n  \nlemma W_inv_Write_lemma_prelim_9:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s). ownD s (numDeqs s + i) = B\"\n  apply simp \n  apply(simp add:cW_step_def pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  by (metis add.commute less_nat_zero_code list.size(3))\n  \nlemma W_inv_Write_lemma_prelim_10:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s'). ownD s' (numDeqs s' + i) = B\"\n  apply simp \n  apply(simp add:cW_step_def pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  by (metis add.commute less_nat_zero_code list.size(3))\n\nlemma W_inv_Write_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = Write\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply simp\n  apply(subgoal_tac \"case_1 s \\<or> case_2 s\") prefer 2 using inv_def pre_W_def\n  apply blast\n  apply(subgoal_tac \"pre_write_inv s\") prefer 2 using inv_def pre_W_def assms\n  apply (metis PCW.simps(195))\n  apply(simp add:pre_W_def cW_step_def)\n  apply(simp add:inv_def)\n  apply(intro conjI impI) \n  apply (simp add: pre_write_inv_def) defer\n  apply (simp add: pre_write_inv_def) defer defer defer \n  apply(subgoal_tac \"case_1 s' \\<or> case_2 s'\")\n  apply meson using case_trans_Write_to_Enqueue_case_3 [where s=s and s'=s']\n  using assms(1) assms(2) apply blast\n  apply(simp add:Q_indices_def ran_indices_def Q_owns_bytes_def)\n  apply(subgoal_tac \"q s= q s'\") prefer 2 using W_inv_Write_lemma_prelim_1 [where s=s and s'=s'] \n  using assms(5) apply blast\n  apply(unfold Q_lemmas Q_basic_lemmas)\n  apply(intro conjI impI)\n  apply presburger\n  apply (metis (no_types, lifting))\n  apply force\n  apply presburger\n  apply metis\n  apply presburger\n  apply(subgoal_tac \"numDeqs s = numDeqs s'\") prefer 2\n  using case_trans_Write_to_Enqueue_case_3 [where s=s and s'=s'] using assms(1) assms(2) \n  using \\<open>\\<lbrakk>pcW s = Write; cW_step (pcW s) s s'\\<rbrakk> \\<Longrightarrow> q s = q s' \\<and> numDeqs s = numDeqs s'\\<close> assms(5) apply fastforce\n  apply(subgoal_tac \"data_index(s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue, ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n             data_index :=\\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s else data_index  (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue, ownD :=\\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>) x\\<rparr>) = data_index s'\") prefer 2\n  apply meson\n  apply(subgoal_tac \"(\\<forall>i. (i<length(q s')) \\<longrightarrow> data_index s' (q s' ! i) =  numDeqs s' + i) \\<longrightarrow> (\\<forall>i<length (q (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,  ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n                data_index := \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s else data_index (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue, ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>) x\\<rparr>)). data_index (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue, ownD :=  \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n             data_index :=  \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s  else data_index (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,   ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>) x\\<rparr>)  (q (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,  data_index := \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s  else data_index (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue, ownD := \\<lambda>i. if i = numWrites s then B  else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>)  x\\<rparr>) !  i) =\n           numDeqs (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,    ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,  data_index := \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s else data_index (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue, ownD :=   \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>) x\\<rparr>) + i) \") prefer 2 \n  apply force\n  apply(subgoal_tac \"(\\<forall>i. (i<length (q s')) \\<longrightarrow> data_index s' (q s' ! i) = numDeqs s' + i)\") \n  apply meson\n  apply(subgoal_tac \"length(q s)= length(q s')\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i<length (q s). data_index s' (q s ! i) = numDeqs s' + i\")\n  apply presburger\n  apply(subgoal_tac \"\\<forall>i<length (q s). data_index s' (q s ! i) = data_index s (q s!i)\")\n  apply metis\n  apply(subgoal_tac \"\\<forall>a b. ((a,b)\\<noteq>(offset s, Data s (numEnqs s)))\\<longrightarrow> data_index s' (a,b) = data_index s (a,b)\")\n  prefer 2 \n  using W_inv_Write_lemma_prelim_2 [where s=s and s'=s']\n  using assms(5) apply fastforce\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> ((q s ! i)\\<noteq>(offset s, Data s (numEnqs s)))\\<longrightarrow> data_index s' ((q s ! i)) = data_index s ((q s ! i))\")\n  prefer 2 using W_inv_Write_lemma_prelim_3 [where s=s and s'=s']\n  using assms(5) apply fastforce \n  using W_inv_Write_lemma_prelim_4 [where s=s and s'=s']\n  using assms(5) apply fastforce\n  using W_inv_Write_lemma_prelim_8 [where s=s and s'=s']\n  using assms(1) assms(5) \n  apply (metis less_nat_zero_code list.size(3)) \n  using W_inv_Write_lemma_prelim_10 [where s=s and s'=s']\n  using assms(1) assms(5) \n  by (metis add.commute)\n\nlemma W_inv_BTS_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = BTS\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms by(simp add:inv_def pre_W_def cW_step_def pre_OOM_inv_def)\n\nlemma local_pre_W_inv: \n  assumes \"con_assms s\"\n  and \"pcw = pcW s\"\n  and \"pre_W pcw s\"\n  and \"inv s\"\n  and \"cW_step pcw s s'\"\nshows \"inv s'\"\n  using assms apply(case_tac \"pcW s\") \n  using W_inv_A1_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A2_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A3_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A4_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A5_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A6_lemma [where s=s and s'=s'] apply blast \n  using W_inv_A7_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A8_lemma [where s=s and s'=s'] apply blast \n  using W_inv_Enqueue_lemma [where s=s and s'=s'] apply blast             \n  using W_inv_idleW_lemma [where s=s and s'=s'] apply blast \n  using W_inv_OOM_lemma [where s=s and s'=s'] apply blast    \n  using W_inv_FinishedW_lemma [where s=s and s'=s'] apply blast \n  using W_inv_Write_lemma [where s=s and s'=s'] apply blast \n  using W_inv_BTS_lemma [where s=s and s'=s'] by blast   \n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************LOCAL W_step shows preW*************************************)\n\n\nlemma W_local_A1_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A1\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  by(simp add:inv_def pre_W_def cW_step_def pre_A1_inv_def pre_A2_inv_def)\n\nlemma W_local_A2_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A2\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:inv_def pre_W_def cW_step_def pre_A2_inv_def pre_A3_inv_def)\n  apply(case_tac \"tW s = hW s\") apply simp_all \n  apply(case_tac \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\") \n  apply(simp_all add: pre_A4_inv_def)\n  apply metis\n  apply(case_tac \"tW s < hW s\", simp_all) \n  apply(simp add:pre_A5_inv_def) \n  apply(simp add:pre_A8_inv_def)\n  by metis\n\n\nlemma W_local_A3_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A3\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:inv_def pre_W_def cW_step_def trans_A3_def pre_A3_inv_def pre_write_inv_def)\n  by(simp add:tempW_lemmas tempW_basic_lemmas)\n\n\n\nlemma W_local_A4_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A4\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:inv_def pre_W_def cW_step_def trans_A4_def pre_A4_inv_def pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(intro conjI impI)\n  apply (simp add: less_diff_conv)\n  apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\<not>case_2 s\") apply simp \n  apply(thin_tac \"\\<not> case_2 s\")\n  apply(simp add:case_1_lemmas) \n  apply(subgoal_tac \"hW s = fst (last (q s)) + snd (last (q s))\") \n  apply blast\n  apply (metis cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq length_0_conv less_nat_zero_code)\n  apply (metis case_split_5)\n  apply(subgoal_tac \"case_2 s\") apply simp \n  apply(thin_tac \"\\<not>case_1 s\") \n  apply(simp add:case_2_lemmas) \n  apply (metis (no_types, lifting) add_diff_cancel_left' cancel_comm_monoid_add_class.diff_cancel diff_is_0_eq diff_zero le_trans length_greater_0_conv nat_less_le)\n  apply (metis)\n  apply(simp add:Q_lemmas Q_basic_lemmas tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\<not>case_2 s\") apply simp\n  apply(thin_tac \"\\<not> case_2 s\")\n  apply(simp add:case_1_lemmas)\n  apply (metis (no_types, hide_lams) diff_is_0_eq' le_eq_less_or_eq length_pos_if_in_set nth_mem prod.exhaust_sel zero_less_diff)\n  apply (metis case_split_5)\n  apply(subgoal_tac \"case_2 s\") apply simp \n  apply(thin_tac \"\\<not>case_1 s\") \n  apply(simp add:case_2_lemmas)\n  apply clarify \n  apply(subgoal_tac \"ownB s (H s) \\<noteq> Q\") prefer 2 \n  apply (metis F.distinct(19) le_refl)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"i<length(q s) \\<longrightarrow> snd(q s!i) > 0\") prefer 2\n  apply (metis nth_mem prod.collapse)\n  apply(subgoal_tac \"hW s = end(last(q s))\") prefer 2 \n  apply (metis add.commute add_diff_inverse_nat diff_is_0_eq' end_simp le_eq_less_or_eq le_trans minus_nat.diff_0 nat_less_le)\n  apply (metis end_simp nth_mem prod.collapse)\n  apply metis\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  defer \n  apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\<not>case_2 s\") apply simp \n  apply(thin_tac \"\\<not> case_2 s\")\n  apply(simp add:case_1_lemmas)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply (metis (no_types, lifting) add_leD1 cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq le_zero_eq length_0_conv)\n  apply (metis case_split_5)\n  apply(subgoal_tac \"case_2 s\") apply simp \n  apply(thin_tac \"\\<not>case_1 s\") \n  apply(simp add:case_2_lemmas)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(clarify)\n  apply(case_tac \"fst(hd(q s)) = 0\") \n  apply (metis add_is_0)\n  apply(subgoal_tac \"fst(hd(q s)) = e\") prefer 2\n  apply (metis (no_types, lifting) add_diff_cancel_right' add_lessD1 cancel_comm_monoid_add_class.diff_cancel le_neq_implies_less length_greater_0_conv not_add_less1 ordered_cancel_comm_monoid_diff_class.add_diff_inverse)\n  apply(subgoal_tac \"hW s<T s\") prefer 2\n  apply blast\n  apply(subgoal_tac \" hW s + Data s (numEnqs s) = hW s\") prefer 2\n  apply (metis add.commute diff_add less_diff_conv nat_less_le trans_less_add2)\n  apply(subgoal_tac \"T s \\<le> fst(hd(q s))\") prefer 2\n  apply meson\n  apply(subgoal_tac \"d> Data s (numEnqs s) + hW s \") prefer 2 \n  apply (metis add.commute less_add_same_cancel2)\n  apply(subgoal_tac \"d=e\") prefer 2 \n  apply (metis less_add_same_cancel1)\n  apply (metis not_add_less2)\n  apply blast\n  apply(clarify)\n  apply(intro conjI impI)\n  apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\<not>case_2 s\") apply simp \n  apply(thin_tac \"\\<not> case_2 s\")\n  apply(simp add:case_1_lemmas)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(subgoal_tac \"\\<forall>j. j<length(q s) \\<longrightarrow> hW s > fst(q s!j)\")\n  apply (metis Suc_lessD less_natE not_add_less1)\n  apply(subgoal_tac \"\\<forall> a b j. ((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b) \\<longrightarrow> ownB s (j) = Q\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(clarify) \n  apply(subgoal_tac \"\\<forall>i.(ownB s i=Q \\<and> i\\<le>N) \\<longrightarrow> i<fst (last (q s)) + snd (last (q s))\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow> ownB s (fst(q s!0)) = Q\") prefer 2\n  apply (metis (no_types, lifting) hd_conv_nth le_eq_less_or_eq)\n  apply(subgoal_tac \"fst (last (q s)) + snd (last (q s))\\<le>hW s\") prefer 2\n  apply blast\n  apply(subgoal_tac \"fst(q s!j) + snd(q s!j) \\<le>N\") prefer 2 \n  apply (metis nth_mem prod.collapse)\n  apply(subgoal_tac \"fst(q s!j) \\<le>N\") prefer 2 \n  apply (metis add_leD1)\n  apply (metis (no_types, lifting) le_eq_less_or_eq less_add_same_cancel1 nth_mem prod.collapse)\n  apply (metis case_split_5)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\<not>case_2 s\") apply simp \n  apply (metis case_split_5)\n  apply(simp add:case_2_lemmas)\n  apply(thin_tac \"\\<not> case_1 s\")\n  apply clarify\n  apply(case_tac \"H s \\<ge> T s\") \n  apply (metis le_imp_less_Suc less_or_eq_imp_le not_less_eq)\n  apply(subgoal_tac \"H s < T s \") prefer 2\n  apply metis\n  apply(thin_tac \"\\<not> T s \\<le> H s\")\n  apply(subgoal_tac \"\\<forall>i.(hW s \\<le>i \\<and> i<hW s + Data s (numEnqs s)) \\<longrightarrow> ownB s i = B\") prefer 2 \n  apply (metis (no_types, lifting) Suc_lessD add.commute less_diff_conv less_trans_Suc)\n  apply(case_tac \"e=f\") \n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i<b\") prefer 2\n  apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) F.distinct(21) F.distinct(23) F.distinct(3) Suc_pred bot_nat_0.not_eq_extremum diff_Suc_Suc diff_diff_cancel diff_is_0_eq old.nat.inject zero_less_Suc zero_less_diff)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2\n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>i. (i<length(q s)) \\<longrightarrow> (\\<exists>a b. ((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b = snd(q s!i)))\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> ownB s (fst(q s!i)) = Q\") prefer 2 \n  apply (metis (no_types, hide_lams))\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> fst(q s!i) < N)\\<longrightarrow> fst(q s!i)<b\") prefer 2 \n  apply (metis less_imp_le_nat)\n  apply(subgoal_tac \"fst(q s!i) + snd(q s!i)\\<le>N\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow> fst(q s!i)<b\") prefer 2 \n  apply (metis (no_types, lifting) add_leD1)\n  apply (metis (no_types, lifting) add_lessD1 le_imp_less_Suc less_imp_add_positive not_less_eq)\n  apply(case_tac \"fst(q s!i) < hW s\") \n  apply linarith\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2\n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>i. (i<length(q s)) \\<longrightarrow> (\\<exists>a b. ((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b = snd(q s!i)))\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> ownB s (fst(q s!i)) = Q\") prefer 2 \n  apply (metis (no_types, hide_lams))\n  apply(subgoal_tac \"fst(q s!i) + snd(q s!i)\\<le>N\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse)\n  apply(subgoal_tac \"fst(q s!i) \\<ge>e\") \n  apply (metis (no_types, lifting) F.distinct(19) add.commute less_diff_conv less_or_eq_imp_le linorder_neqE_nat)\n  apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) bot_nat_0.not_eq_extremum diff_is_0_eq diff_self_eq_0 zero_less_diff)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas)\n  apply clarify \n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2\n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>i. (i<length(q s)) \\<longrightarrow> (\\<exists>a b. ((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b = snd(q s!i)))\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j\\<le>a+b-1)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 le_imp_less_Suc)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a+b\\<le>hW s\")\n  apply (metis (no_types, lifting) less_or_eq_imp_le)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N) \\<longrightarrow> i<fst (last (q s)) + snd (last (q s))\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a+b\\<le>N\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>b>0\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s) \\<and> a\\<le>a+b-1 \\<and> a+b-1\\<le>a+b-1)\\<longrightarrow>ownB s (a+b-1) = Q\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 le_imp_less_Suc)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a\\<le>a+b-1 \\<and> a+b-1\\<le>a+b-1\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 le_eq_less_or_eq less_Suc_eq_le less_add_same_cancel1)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>ownB s (a+b-1) = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a+b-1 <fst (last (q s)) + snd (last (q s))\") prefer 2 \n  apply (metis diff_le_self le_trans)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a+b-1 <a+b\") prefer 2 \n  apply (metis Suc_pred' add_gr_0 lessI)\n  apply(subgoal_tac \"hW s\\<ge>fst (last (q s)) + snd (last (q s))\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a+b-1 <hW s\") prefer 2 \n  apply (metis (no_types, lifting) eq_imp_le le_neq_implies_less)\n  apply (metis (no_types, lifting) Suc_leI Suc_pred' add_gr_0)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply(clarify)\n  apply(case_tac \"e=f\") \n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i<b\") prefer 2\n  apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) F.distinct(21) F.distinct(23) F.distinct(3) Suc_pred bot_nat_0.not_eq_extremum diff_Suc_Suc diff_diff_cancel diff_is_0_eq old.nat.inject zero_less_Suc zero_less_diff)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j\\<le>a+b-1)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 le_imp_less_Suc)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> b>0\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a\\<le>a+b-1 \\<and> a+b-1\\<le>a+b\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 diff_le_self less_Suc_eq_le less_add_same_cancel1)\n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a+b-1) = Q\") prefer 2\n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>i. (i<length(q s)) \\<longrightarrow> (\\<exists>a b. ((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b = snd(q s!i)))\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> ownB s (fst(q s!i)+snd(q s!i)-1) = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> fst(q s!i)+snd(q s!i)-1 \\<le> N)\\<longrightarrow> fst(q s!i)+snd(q s!i)-1<b\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"fst(q s!i) + snd(q s!i)\\<le>N\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse)\n  apply(subgoal_tac \"fst(q s!i) + snd(q s!i)-1\\<le>N\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"i<length(q s)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"fst(q s!i)+snd(q s!i)-1<b\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply (metis Suc_leI diff_Suc_1 le_trans less_natE)\n  apply(case_tac \"fst(q s!i) > hW s\") \n  apply linarith\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j\\<le>a+b-1)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis Suc_pred' add_gr_0 le_imp_less_Suc)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2\n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> b>0\") prefer 2\n  apply meson\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a\\<le>a+b-1\\<and> a+b-1\\<le>a+b-1\") prefer 2  \n  apply (metis Suc_diff_1 add_gr_0 le_eq_less_or_eq less_Suc_eq_le less_add_same_cancel1)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s))\\<longrightarrow>ownB s (a+b-1) = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>i. (i<length(q s)) \\<longrightarrow> (\\<exists>a b. ((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b = snd(q s!i)))\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> ownB s (fst(q s!i)+snd(q s!i)-1) = Q\") prefer 2 \n  apply (metis (no_types, hide_lams))\n  apply(subgoal_tac \"fst(q s!i) + snd(q s!i)\\<le>N\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"fst(q s!i) < hW s\") prefer 2 \n  apply blast\n  by (metis (no_types, hide_lams) F.distinct(19) diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n\n\nlemma W_local_A5_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A5\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:inv_def pre_W_def cW_step_def pre_A5_inv_def pre_write_inv_def)\n  apply(case_tac \"Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(simp_all add: pre_A6_inv_def)\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(simp_all add: pre_A7_inv_def)  \n  by(simp_all add: pre_A8_inv_def)\n\n\nlemma W_local_A6_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A6\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def trans_A6_def)\n  apply(simp add:inv_def pre_A6_inv_def)\n  apply(subgoal_tac \"H s\\<ge>T s\") prefer 2 \n  apply meson apply(subgoal_tac \"\\<not>case_2 s\") prefer 2\n  apply (metis case_split_2)\n  apply(subgoal_tac \"case_1 s\") prefer 2\n  apply blast\n  apply(thin_tac \"\\<not>case_2 s\") \n  apply(simp add:pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(intro conjI impI)\n  apply (metis Nat.le_diff_conv2 add.commute)\n  apply(simp add:case_1_lemmas)\n  apply (metis cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq le_zero_eq length_0_conv) \n  apply (metis F.distinct(19) Q_owns_bytes_def Q_structure_def bot_nat_0.extremum_uniqueI cancel_comm_monoid_add_class.diff_cancel less_or_eq_imp_le nat_less_le ran_indices_lem5)\n  apply(simp add:case_1_lemmas)\n  defer\n  apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq le_zero_eq length_0_conv trans_le_add1)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(subgoal_tac \"hW s = H s\") prefer 2 \n  apply presburger\n  apply(clarify)\n  apply(intro conjI impI)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i<fst (last (q s)) + snd (last (q s))\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s)\\<and>a \\<le> j \\<and> j<a+b ) \\<longrightarrow> ownB s j = Q\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2 \n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> a<N\") prefer 2 \n  apply (metis F.distinct(23) add_leD1 nat_less_le)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> a<hW s\")\n  apply (metis (no_types, lifting) le_eq_less_or_eq nth_mem prod.collapse)\n  apply (metis le_neq_implies_less less_or_eq_imp_le)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i<fst (last (q s)) + snd (last (q s))\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s)\\<and>a \\<le> j \\<and> j<a+b ) \\<longrightarrow> ownB s j = Q\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s)\\<longrightarrow>a \\<le> a+b-1 \\<and> a+b-1<a+b\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 diff_less less_Suc_eq_le less_add_same_cancel1 less_one)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a+b-1) = Q\") prefer 2\n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b=Data s (numDeqs s + i))\") prefer 2\n  apply (metis nth_mem prod.collapse)\n  by (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n\n\n\n\nlemma W_local_A7_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A7\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def trans_A7_def)\n  apply(simp add:inv_def pre_A7_inv_def)\n  apply(subgoal_tac \"H s\\<ge>T s\") prefer 2 \n  apply meson apply(subgoal_tac \"\\<not>case_2 s\") prefer 2\n  apply (metis case_split_2)\n  apply(subgoal_tac \"case_1 s\") prefer 2\n  apply blast\n  apply(thin_tac \"\\<not>case_2 s\") \n  apply(simp add:pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(intro conjI impI)\n  apply (metis F.distinct(19) Q_owns_bytes_def Q_structure_def less_nat_zero_code not_gr0 ran_indices_lem5)\n  apply(simp add:case_1_lemmas) \n  defer\n  apply(simp add:case_1_lemmas)\n  apply (metis F.distinct(19) cancel_comm_monoid_add_class.diff_cancel diff_is_0_eq le_neq_implies_less le_zero_eq length_0_conv)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(subgoal_tac \"hW s = H s\") prefer 2 \n  apply presburger\n  apply(clarify)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i\\<ge>fst (hd (q s))\") prefer 2 \n  apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s)\\<and>a \\<le> j \\<and> j<a+b ) \\<longrightarrow> ownB s j = Q\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2 \n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> a<N\") prefer 2 \n  apply (metis F.distinct(23) add_leD1 nat_less_le)\n  apply(subgoal_tac \"\\<forall>i.(i\\<le>Data s (numEnqs s))\\<longrightarrow>ownB s i = B\") prefer 2 \n  apply (metis add_lessD1 nat_le_iff_add)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> a>Data s (numEnqs s)\") prefer 2\n  apply (metis F.distinct(19) Suc_le_lessD not_less_eq_eq)\n  by (metis nth_mem prod.collapse)\n   \nlemma W_local_A8_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A8\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def)\n  apply(simp add:inv_def pre_A8_inv_def)\n  apply(case_tac \"N < Data s (numEnqs s)\") \n  apply (metis leD) apply(intro conjI impI) \n  apply linarith apply(simp add:pre_OOM_inv_def) apply(intro conjI impI)\n  defer \n  apply(case_tac \"case_1 s\") apply simp  apply(simp add:case_1_lemmas)\n  apply metis\n  apply meson apply(case_tac \"case_1 s\") apply simp  apply(simp add:case_1_lemmas)\n  apply metis\n  apply(simp add:case_2_lemmas)\n  by (metis le_antisym less_or_eq_imp_le)\n\nlemma W_local_Enqueue_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = Enqueue\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def)\n  apply(simp add:inv_def pre_enqueue_inv_def)\n  apply(intro conjI impI) \n  apply(simp add:pre_acquire_inv_def) apply(intro conjI impI)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas) \n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis F.distinct(5) eq_imp_le less_add_same_cancel1)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply clarify\n  apply(intro conjI impI)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas) apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas) apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas)\n  apply (metis add_cancel_left_left less_imp_le_nat old.prod.inject prod.collapse tempW_def)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply(simp add:pre_acquire_inv_def)\n  apply(intro conjI impI) \n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  by (metis Suc_diff_Suc Zero_not_Suc diff_is_0_eq' less_or_eq_imp_le)\n\nlemma W_local_idleW_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = idleW\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def)\n  apply(simp add:inv_def pre_acquire_inv_def) \n  apply(case_tac \" numEnqs s < n\", simp_all)\n  apply(simp add: pre_A1_inv_def) \n  apply blast\n  by(simp add: pre_finished_inv_def) \n\nlemma W_local_OOM_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = OOM\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def)\n  apply(simp add:inv_def pre_OOM_inv_def)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:inv_def pre_acquire_inv_def)\n  apply(case_tac \"case_1 s\") apply(simp ) apply(simp add:case_1_lemmas)\n  apply(intro conjI impI) \n  apply (metis eq_imp_le less_imp_le_nat linorder_neqE_nat)\n  apply (metis le_neq_implies_less le_refl)\n  apply (metis diff_self_eq_0 le_neq_implies_less le_refl le_zero_eq length_0_conv) \n  apply (metis le_refl length_0_conv nat_less_le ordered_cancel_comm_monoid_diff_class.le_imp_diff_is_add plus_nat.add_0)\n  apply (metis diff_self_eq_0 le_antisym le_refl nat_less_le zero_less_diff)\n  apply metis\n  apply(simp add:case_2_lemmas)\n  apply(intro conjI impI) \n  apply (metis)\n  apply (metis)\n  apply (metis)\n  apply (metis)\n  apply metis \n  apply (metis le_antisym nat_less_le)\n  apply(simp add:pre_OOM_inv_def)\n  by blast\n\nlemma W_local_FinishedW_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = FinishedW\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  by(simp add:cW_step_def pre_W_def)\n\nlemma W_local_Write_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = Write\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:pre_W_def cW_step_def)\n  apply(simp add:inv_def pre_write_inv_def)\n  apply(simp add:pre_enqueue_inv_def)\n  apply(intro conjI impI)\n  apply clarify\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) apply clarify\n  apply(intro conjI impI)\n  apply(subgoal_tac \"i<T s\\<longrightarrow>ownB s i=B\") prefer 2\n  apply metis\n  apply(subgoal_tac \"T s\\<le>i \\<and> i<b\\<longrightarrow>ownB s i = R\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"b\\<le>i \\<and> i<c\\<longrightarrow>ownB s i = Q\") prefer 2 \n  apply metis\n  apply (metis (mono_tags, lifting) F.distinct(1) F.distinct(3) F.distinct(5) Suc_le_lessD le_eq_less_or_eq not_less_eq_eq trans_less_add1)\n  apply(subgoal_tac \"end(tempW s)\\<le>i \\<and> i<N\\<longrightarrow> ownB s i = B\") prefer 2\n  apply metis\n  apply (metis F.distinct(5) F.distinct(9) le_neq_implies_less)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(clarify)\n  apply(intro conjI impI) \n  apply (metis F.distinct(1) F.distinct(3) eq_imp_le linorder_neqE_nat nat_less_le trans_less_add1)\n  apply (metis F.distinct(1) F.distinct(3) F.distinct(5) F.distinct(7) F.distinct(9) le_neq_implies_less less_or_eq_imp_le linorder_neqE_nat)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas) \n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp add:case_1_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(subgoal_tac \"case_2 s\") prefer 2 \n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp add:case_1_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(subgoal_tac \"case_2 s\") prefer 2 \n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp add:case_1_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply (metis le_antisym le_trans less_nat_zero_code)\n  apply(subgoal_tac \"case_2 s\") prefer 2 \n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  by(simp add:tempW_lemmas tempW_basic_lemmas)\n\nlemma W_local_BTS_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = BTS\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  by(simp add:cW_step_def pre_W_def)\n\nlemma local_pre_W_pre: \n  assumes \"con_assms s\"\n  and \"pcw = pcW s\"\n  and \"pre_W pcw s\"\n  and \"inv s\"\n  and \"cW_step pcw s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply(case_tac \"pcW s\") \n  using W_local_A1_lemma [where s=s and s'=s'] apply blast \n  using W_local_A2_lemma [where s=s and s'=s'] apply blast \n  using W_local_A3_lemma [where s=s and s'=s'] apply blast  \n  using W_local_A4_lemma [where s=s and s'=s'] apply blast   \n  using W_local_A5_lemma [where s=s and s'=s'] apply blast  \n  using W_local_A6_lemma [where s=s and s'=s'] apply blast    \n  using W_local_A7_lemma [where s=s and s'=s'] apply blast     \n  using W_local_A8_lemma [where s=s and s'=s'] apply blast       \n  using W_local_Enqueue_lemma [where s=s and s'=s'] apply blast  \n  using W_local_idleW_lemma [where s=s and s'=s'] apply blast    \n  using W_local_OOM_lemma [where s=s and s'=s'] apply blast         \n  using W_local_FinishedW_lemma [where s=s and s'=s'] apply blast   \n  using W_local_Write_lemma [where s=s and s'=s'] apply blast   \n  using W_local_BTS_lemma [where s=s and s'=s'] by blast       \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************Local R pre post lemmas*************************************)\nlemma R_local_release_pre_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = Release\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n  using assms apply(simp add:pre_R_def) apply clarify\n  apply(subgoal_tac \"ownT s' \\<noteq> R\") prefer 2 \n  apply(simp add:pre_dequeue_inv_def)\n  apply(simp add:cR_step_def)\n  apply(subgoal_tac \"ownT s = R\") prefer 2 \n  apply(simp add:pre_Release_inv_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s = fst(tempR s)\") apply simp_all\n  apply(simp add:pre_dequeue_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:pre_Release_inv_def)\n  apply(simp add:pre_Release_inv_def)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"hd(q s)\\<in>set(q s)\") prefer 2 \n  apply (metis hd_in_set)\n  apply(subgoal_tac \"fst(q s!0) = 0\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(case_tac \"case_1 s \") apply simp apply(simp add:case_1_lemmas)\n  apply (metis diff_self_eq_0 le_neq_implies_less length_pos_if_in_set less_nat_zero_code)\n  apply(simp) apply(thin_tac \"\\<not> case_1 s\") apply(simp add:case_2_lemmas)\n  apply(clarify)\n  apply(subgoal_tac \"e=f\") prefer 2\n  apply (metis gr_implies_not0 le_neq_implies_less)\n  apply(subgoal_tac \"(i<N \\<and> ownB s i = Q )\\<longrightarrow> i<ba\") prefer 2 \n  apply (metis (mono_tags, hide_lams) F.distinct(11) F.distinct(19) F.distinct(21) F.distinct(3) diff_is_0_eq neq0_conv zero_less_diff)\n  apply(subgoal_tac \"aa=0\") prefer 2\n  apply (metis gr_implies_not0)\n  apply(subgoal_tac \"a+b\\<le>ba\")\n  apply (metis (no_types, lifting) Suc_le_eq le_add1 le_trans not_less_eq_eq)\n  apply(subgoal_tac \"(a\\<le>i \\<and> i<a+b) \\<longrightarrow> (ownB s i = Q)\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"a = i\\<longrightarrow> ownB s i = Q\") prefer 2\n  apply (metis le_refl less_add_same_cancel1)\n  apply(subgoal_tac \"fst(tempR s) = T s \\<longrightarrow> ownB s (T s) =R\") prefer 2\n  apply (metis gr_implies_not0 le_refl)\n  apply(subgoal_tac \"T s > ba\") prefer 2\n  apply (metis le0 less_nat_zero_code nat_neq_iff)\n  apply(subgoal_tac \"a=i\\<longrightarrow>i<ba\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(23) le_add1 le_neq_implies_less le_trans)\n  apply(subgoal_tac \"a+b-1 = i \\<longrightarrow>ownB s i=Q\") prefer 2\n  apply (metis Suc_diff_1 add_gr_0 lessI less_Suc_eq_le less_add_same_cancel1)\n  apply(subgoal_tac \"\\<nexists>i.(i\\<ge>ba \\<and> ownB s i = Q \\<and> i\\<le>N)\") prefer 2 \n  apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) F.distinct(21) F.distinct(23) F.distinct(3) bot_nat_0.not_eq_extremum diff_diff_cancel diff_is_0_eq diff_self_eq_0 zero_less_diff)\n  apply(subgoal_tac \"a=i \\<and> ownB s i = Q \\<longrightarrow> i<ba\") prefer 2\n  apply meson\n  defer defer\n  apply(simp add:pre_dequeue_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:pre_Release_inv_def)\n  apply(simp add:pre_Release_inv_def)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"fst(hd(q s)) = 0\") prefer 2 \n  apply blast\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas)\n  apply metis\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis head_q0 length_greater_0_conv)\n  prefer 3 \n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas pre_Release_inv_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(clarify) apply(intro conjI impI)\n  apply (metis (no_types, lifting) bot_nat_0.extremum_uniqueI diff_self_eq_0 le_neq_implies_less length_0_conv)\n  apply(subgoal_tac \"hd(q s) \\<in> set(q s)\") prefer 2\n  apply (metis hd_in_set)\n  apply(subgoal_tac \"i\\<le>N\") prefer 2\n  apply (metis (no_types, lifting) le_trans less_or_eq_imp_le prod.collapse)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\") prefer 2 apply blast\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply (metis (no_types, lifting) prod.collapse)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:case_1_lemmas pre_Release_inv_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(clarify) apply(intro conjI impI) \n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\") prefer 2 apply blast\n  apply(subgoal_tac \"hd(q s) \\<in> set(q s)\") prefer 2\n  apply (metis hd_in_set)\n  apply(subgoal_tac \"a = 0\") prefer 2 \n  apply (metis less_nat_zero_code)\n  apply(case_tac \"fst(hd(q s)) = e\") \n  apply (metis gr_implies_not0)\n  apply(subgoal_tac \"fst(hd(q s)) = 0\") prefer 2\n  apply metis\n  apply(subgoal_tac \"b\\<le>H s\") prefer 2\n  apply fastforce\n  apply(subgoal_tac \"H s< T s\") prefer 2\n  apply fastforce\n  apply(subgoal_tac \"b< T s\") prefer 2\n  apply (metis le0 le_refl less_nat_zero_code nat_neq_iff)\n  apply(subgoal_tac \"i\\<ge>end(hd(q s))\") \n  apply (metis Suc_leI end_simp not_less_eq_eq)\n  apply(subgoal_tac \"e = f\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"i\\<ge>T s\") prefer 2\n  apply (metis less_Suc_eq_le not_less_eq)\n  apply(subgoal_tac \"\\<forall>i.(i\\<ge>a \\<and> i<end(hd(q s))) \\<longrightarrow> ownB s i = Q\")\n  prefer 2 \n  apply (metis (no_types, lifting) end_simp prod.collapse)\n  apply (metis F.distinct(11) less_Suc_eq_le not_less_eq)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\") apply simp \n  apply(simp add:case_1_lemmas pre_Release_inv_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply metis\n  apply(simp add:case_2_lemmas pre_Release_inv_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(clarify)\n  apply(intro conjI impI)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply (metis (no_types, hide_lams) F.distinct(21) less_imp_Suc_add list.set_sel(1) nat.distinct(1) nat_less_le prod.exhaust_sel)\n  apply (metis head_q0 length_greater_0_conv)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"aa=0\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> a+b\\<le>N\") prefer 2\n  apply meson\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>j.(a\\<le>j \\<and> j<b+a) \\<longrightarrow> ownB s j = Q\") prefer 2\n  apply (metis add.commute)\n  by (metis (no_types, hide_lams) Suc_eq_plus1 add_diff_inverse_nat add_leD1 diff_add_inverse2 diff_le_self less_eq_Suc_le zero_less_diff)\n\nlemma R_local_idle_pre_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = idleR\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n  using assms apply(simp add:pre_R_def) apply clarify\n  apply(case_tac \"q s=[]\") \n  using cR_step_def apply auto[1] apply(subgoal_tac \"ownT s = Q\") prefer 2 \n  apply(simp add:pre_dequeue_inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis add_cancel_right_right head_q0 length_greater_0_conv)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis add_cancel_right_right head_q0 length_greater_0_conv)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis diff_is_0_eq' le_trans length_0_conv not_less_eq_eq)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis diff_is_0_eq' length_0_conv not_less_eq_eq)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis length_greater_0_conv plus_nat.add_0)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis hd_in_set less_nat_zero_code)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI) \n  apply(subgoal_tac \"(\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n         fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n  apply (metis Q_ind_imp_tail_ind_1)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2 \n  apply (metis One_nat_def hd_conv_nth length_greater_0_conv nth_tl)\n  apply (metis (no_types, lifting) One_nat_def Q_ind_imp_tail_ind_1 diff_Suc_1 length_greater_0_conv length_tl less_one zero_less_diff)\n  apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n  apply (metis Q_ind_imp_tail_ind_1)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2 \n  apply (metis One_nat_def hd_conv_nth length_greater_0_conv nth_tl)\n  apply (metis (no_types, lifting) One_nat_def Suc_eq_plus1 Suc_neq_Zero length_greater_0_conv length_tl less_diff_conv nth_tl)\n  apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n  apply (metis Q_ind_imp_tail_ind_1)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2 \n  apply (metis One_nat_def hd_conv_nth length_greater_0_conv nth_tl)\n  apply(subgoal_tac \"i<length(q s) - Suc 0 \\<longrightarrow> (tl (q s) ! i )\\<in>set (q s)\") prefer 2\n  apply (metis One_nat_def length_tl list.set_sel(2) nth_mem)\n  apply(subgoal_tac \"(hd (q s))\\<in>set (q s)\") prefer 2\n  apply (metis hd_in_set)\n  apply simp apply clarify\n  apply (intro conjI impI) apply(subgoal_tac \"snd(hd(q s)) = snd(q s!0)\") prefer 2 \n  apply (metis Q_ind_imp_tail_ind_1) apply simp \n  apply(subgoal_tac \"\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) -1)\\<longrightarrow>(tl(q s)!i)\\<in>set(q s)\") prefer 2\n  apply (metis length_tl list.set_sel(2) nth_mem)\n  apply(subgoal_tac \"tl(q s)!ia \\<in>set(q s)\") prefer 2\n  apply (metis One_nat_def)\n  apply(subgoal_tac \"fst(tl(q s)!ia) >fst(hd(q s))\") prefer 2\n  apply presburger\n  apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n  apply(subgoal_tac \"\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) -1)\\<longrightarrow>(tl(q s)!i)\\<in>set(q s)\") prefer 2\n  apply (metis length_tl list.set_sel(2) nth_mem)\n  apply(subgoal_tac \"tl(q s)!ia \\<in>set(q s)\") prefer 2\n  apply (metis One_nat_def)\n  apply(subgoal_tac \"fst(tl(q s)!ia) <fst(hd(q s))\") prefer 2\n  apply presburger\n  apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n  apply(subgoal_tac \"hd(q s)\\<in>set(q s)\") prefer 2 \n  apply (metis hd_in_set)\n  apply(subgoal_tac \"last (tl (q s))\\<in>set(q s)\") prefer 2\n  apply (metis last_in_set last_tl) \n  apply (metis fst_conv last_tl surj_pair)\n  apply (metis Nat.add_0_right hd_conv_nth length_greater_0_conv)\n  apply (metis add_cancel_right_right head_q0 length_greater_0_conv) defer\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_lemmas) \n  apply (metis bot_nat_0.extremum_uniqueI bot_nat_0.not_eq_extremum diff_is_0_eq' length_greater_0_conv)\n  apply(simp) apply(thin_tac \"\\<not> case_1 s\") apply(simp add:case_2_lemmas)\n  apply meson\n  apply(simp add:inv_def)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(subgoal_tac \"hd(q s)\\<in>set(q s)\") prefer 2 \n  apply (metis hd_in_set) \n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis F.distinct(13) bot_nat_0.extremum_uniqueI diff_self_eq_0 le_neq_implies_less length_0_conv)\n  apply simp apply(thin_tac \"\\<not>case_1 s\")  apply(simp add:case_2_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  by (metis fst_conv le0 le_trans nat_less_le plus_nat.add_0 snd_conv)\n\nlemma R_local_read_pre_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = Read\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n  using assms apply(simp add:pre_R_def) apply clarify\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_Release_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:inv_def) apply(simp add:Q_lemmas Q_basic_lemmas) apply(subgoal_tac \"hd(q s)\\<in>set(q s)\")\n  prefer 2 \n  apply (meson list.set_sel(1))\n  apply (metis Nat.add_0_right hd_conv_nth length_pos_if_in_set)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(intro conjI impI)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"snd (tempR s) = Data s (numDeqs s - Suc 0)\") prefer 2\n  apply blast\n  apply metis\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"snd (tempR s) = Data s (numDeqs s - Suc 0)\") prefer 2\n  apply blast \n  apply force\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  by(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n\nlemma R_local_pre_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n  using assms apply(case_tac \"pcR s\") \n  using R_local_release_pre_lemma [where s=s and s'=s'] apply blast       \n  using R_local_idle_pre_lemma [where s=s and s'=s'] apply blast      \n  using R_local_read_pre_lemma [where s=s and s'=s'] by blast      \n\n\n\n\n\n\n\n\n\n(*******************************GLOBAL W_step shows preR*************************************)\n\n\nlemma pcR_doesnt_change_with_W:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pcR s'=pcR s\"\n using assms apply simp\n  apply(case_tac \"pcW s \", simp add:cW_step_def trans_A3_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def trans_A3_def)\n  apply(simp add:cW_step_def trans_A4_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def trans_A6_def)\n  apply(simp add:cW_step_def trans_A7_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def) apply(cases \"numEnqs s < n\") \n  apply(simp add:B_acquire_def) apply(simp add:B_acquire_def) \n  apply(simp add:cW_step_def) apply(cases \"tW s \\<noteq> T s\") \n  apply(simp add:cW_step_def) \n  apply(simp add:cW_step_def) \n  apply(simp add:cW_step_def) \n  apply(simp add:cW_step_def) \n  by(simp add:cW_step_def) \n\nlemma supporting_strange:\n  \"\\<forall>i<(length (q s)).\n       (fst (tempR s) < fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) \\<longrightarrow>\n        fst (tempR s) + snd (tempR s) \\<le> fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i)) \\<and>\n       (fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) < fst (tempR s) \\<longrightarrow>\n        fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) +\n        snd ((q s @ [(offset s, Data s (numEnqs s))]) ! i)\n        \\<le> fst (tempR s)) \\<Longrightarrow> \n       (fst (tempR s) < fst ((offset s, Data s (numEnqs s))) \\<longrightarrow>\n        fst (tempR s) + snd (tempR s) \\<le> fst ((offset s, Data s (numEnqs s)))) \\<and>\n       (fst ((offset s, Data s (numEnqs s))) < fst (tempR s) \\<longrightarrow>\n        fst ((offset s, Data s (numEnqs s))) +\n        snd ((offset s, Data s (numEnqs s)))\n        \\<le> fst (tempR s))\n\\<Longrightarrow>\n \\<forall>i<Suc (length (q s)).\n       (fst (tempR s) < fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) \\<longrightarrow>\n        fst (tempR s) + snd (tempR s) \\<le> fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i)) \\<and>\n       (fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) < fst (tempR s) \\<longrightarrow>\n        fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) +\n        snd ((q s @ [(offset s, Data s (numEnqs s))]) ! i)\n        \\<le> fst (tempR s))\"\n  by (metis less_SucE nth_append_length)\n\n\n\nlemma preRead_doesnt_change_with_W:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_Read_inv s\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_Read_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_Read_inv_def) \n  apply(intro conjI impI)\n  apply(simp add:pre_W_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(cases \"pcW s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:pre_W_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(cases \"pcW s\", simp_all)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all )\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all )\n  apply(simp add:pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def)\n  apply (metis F.distinct(1) eq_imp_le fst_eqD less_add_same_cancel1 snd_eqD)\n  apply(cases \"pcW s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply metis\n  apply(case_tac \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply metis\n  apply(case_tac \" hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all, metis)\n  apply(case_tac \"tW s < hW s\", simp_all,metis, metis)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def, metis, metis)\n  apply(case_tac \" Data s (numEnqs s) \\<le> N - hW s\", simp_all, metis)\n  apply(case_tac \" Data s (numEnqs s) < tW s\", simp_all, metis, metis, metis, metis, metis, metis)\n  apply(case_tac \"numEnqs s < n\", simp_all, metis, metis)\n  apply(cases \"tW s \\<noteq> T s\", simp_all, metis, metis, metis, metis, metis)\n  apply(case_tac \"pcW s\", simp_all add:cW_step_def)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)  \n  apply(cases \"pcW s\", simp_all) \n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(case_tac \" tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all) \n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(case_tac \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(case_tac \"tW s < hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply (metis (no_types, lifting) F.distinct(13) Suc_lessD add.commute less_diff_conv less_trans_Suc)\n  apply(case_tac \" Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply metis\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply metis\n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le nat_neq_iff)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(clarify)\n  apply(intro conjI impI)\n  apply (metis F.distinct(13) Suc_lessD less_trans_Suc)\n  apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le linorder_neqE_nat)\n  apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n  apply(simp add:pre_W_def pre_A8_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_A8_inv_def)  defer\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(simp add:pre_W_def pre_acquire_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_acquire_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_OOM_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply metis\n  apply metis\n  apply(simp add:pre_W_def pre_write_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right eq_imp_le fst_eqD nat_add_left_cancel_less snd_eqD)\n  defer\n  defer\n  defer \n  apply(simp add:pre_W_def pre_enqueue_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(intro conjI impI)\n  apply(simp add: tempW_def)\n  apply(case_tac \"q s\\<noteq>[]\") \n  apply (metis (no_types, hide_lams) hd_append2)\n  apply(subgoal_tac \"q s=[]\") prefer 2 \n  apply force\n  apply(subgoal_tac \"tempR s \\<noteq>(0,0)\") prefer 2 \n  apply blast\n  apply(case_tac \"offset s = 0\")\n  apply (metis append_Nil fst_conv list.sel(1))\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply clarify \n  apply(subgoal_tac \"c=b\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"end(tempR s) = b\") prefer 2 \n  apply (metis end_simp le_add_diff_inverse)\n  apply(subgoal_tac \"offset s = hW s\") prefer 2\n  apply meson \n  apply(subgoal_tac \"i\\<ge>c \\<and> i<H s \\<longrightarrow>ownB s i = W\") prefer 2\n  apply metis\n  apply(subgoal_tac \"H s\\<le>N\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"(i<c \\<or> i\\<ge>H s \\<and> i\\<le>N) \\<longrightarrow>ownB s i\\<noteq>W\") prefer 2 \n  apply (metis F.distinct(1) F.distinct(5) bot_nat_0.not_eq_extremum diff_is_0_eq zero_less_diff)\n  apply (metis F.distinct(1) add_leD1 end_simp le_eq_less_or_eq linorder_neqE_nat nat_less_le)  \n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\") \n  apply clarify \n  apply (metis eq_imp_le le_add1 le_neq_implies_less plus_nat.add_0)\n  apply(simp add: tempW_def)\n  apply(case_tac \"q s=[]\")\n  apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right Suc_le_lessD Suc_lessD Suc_pred add_lessD1 fst_eqD le_add_diff_inverse less_Suc0 less_Suc_eq_le less_add_same_cancel1 list.size(3) nat_add_left_cancel_le nth_Cons_0 self_append_conv2)\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>i<length (q s). fst ((q s) ! i) \\<noteq> fst (tempR s)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"fst((offset s, Data s (numEnqs s))) \\<noteq> fst(tempR s)\") \n  apply (metis less_SucE nth_append nth_append_length)\n  apply(subgoal_tac \"offset s \\<noteq> fst(tempR s)\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n  apply(case_tac \"case_1 s\", simp_all) \n  apply(subgoal_tac \"Data s (numReads s) = snd(tempR s)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"Data s (numDeqs s - Suc 0) = snd(tempR s)\") prefer 2\n  apply presburger \n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>i<length (q s).\n       (fst (tempR s) < fst ((q s ) ! i) \\<longrightarrow>\n        fst (tempR s) + Data s (numDeqs s - Suc 0) \\<le> fst ((q s ) ! i)) \\<and>\n       (fst ((q s) ! i) < fst (tempR s) \\<longrightarrow>\n        fst ((q s) ! i) + snd ((q s ) ! i)\n        \\<le> fst (tempR s))\")\n       prefer 2 \n  apply (metis (no_types, lifting) gr_implies_not0 length_0_conv)\n  apply(subgoal_tac \"(fst (tempR s) < fst(offset s, Data s (numEnqs s)) \\<longrightarrow>\n        fst (tempR s) + Data s (numDeqs s - Suc 0) \\<le> fst(offset s, Data s (numEnqs s))) \\<and>\n       (fst(offset s, Data s (numEnqs s)) < fst (tempR s) \\<longrightarrow>\n        fst(offset s, Data s (numEnqs s)) +\n        snd(offset s, Data s (numEnqs s))\n        \\<le> fst (tempR s))\") \n  apply(subgoal_tac \"((q s @ [(offset s, Data s (numEnqs s))]) ! length (q s)) = (offset s, Data s (numEnqs s))\") prefer 2 \n  apply (metis nth_append_length)\n  apply(subgoal_tac \"\\<forall>i<(length (q s)).\n       (fst (tempR s) < fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) \\<longrightarrow>\n        fst (tempR s) + snd (tempR s) \\<le> fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i)) \\<and>\n       (fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) < fst (tempR s) \\<longrightarrow>\n        fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) +\n        snd ((q s @ [(offset s, Data s (numEnqs s))]) ! i)\n        \\<le> fst (tempR s))\") prefer 2 \n  apply (metis (no_types, hide_lams) nth_append)\n  using supporting_strange [where s=s] \n  apply presburger\n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) Nat.add_0_right fst_eqD le_eq_less_or_eq less_add_same_cancel1 less_nat_zero_code nat_neq_iff snd_eqD tempW_def)\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply (simp add:case_1_lemmas)\n  apply(clarify)\n  apply (metis (no_types, lifting) F.distinct(1) diff_is_0_eq le_refl less_imp_le_nat not_gr0 prod.collapse prod.inject tempW_def zero_less_diff)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\") \n  apply clarify\n  apply (metis less_or_eq_imp_le zero_less_iff_neq_zero)\n  apply(simp add: tempW_def)\n  apply(subgoal_tac \"fst((offset s, Data s (numEnqs s))) + snd((offset s, Data s (numEnqs s)))  \\<noteq> fst(tempR s)\")\n  apply (metis fst_eqD snd_eqD)\n  apply(subgoal_tac \"offset s \\<noteq> fst(tempR s)\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add:case_1_lemmas)\n  apply(clarify)\n  apply linarith\n  apply(simp add:case_2_lemmas) apply (thin_tac \"\\<not>case_1 s\") \n  apply(clarify)\n  apply (metis add_gr_0 nat_neq_iff)\n  apply(case_tac \"pcW s\", simp_all add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:case_2_lemmas)\n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply (metis (no_types, lifting) le_add_diff_inverse le_eq_less_or_eq less_trans_Suc not_less_eq_eq)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not> case_1 s\")\n  apply(simp add:pre_W_def pre_A4_inv_def) \n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(clarify)\n  apply(subgoal_tac \"fst(tempR s) = 0 \\<or> fst(tempR s) = T s\") prefer 2\n  apply meson\n  apply(case_tac \"fst(tempR s) = T s\")\n  apply(subgoal_tac \"hW s = b\") prefer 2 \n  apply (metis le_imp_less_Suc le_refl le_trans not_less_less_Suc_eq)\n  apply(subgoal_tac \"T s > hW s + Data s (numEnqs s)\") prefer 2 \n  apply(subgoal_tac \"ownB s (T s) = R\") prefer 2\n  apply (metis gr_implies_not0 le_refl)\n  apply(subgoal_tac \"tW s = T s\") prefer 2\n  apply (metis (no_types, lifting) add.commute le_trans less_diff_conv nat_less_le)\n  apply(subgoal_tac \"Data s (numEnqs s) < (tW s - hW s)\") prefer 2 \n  apply fastforce\n  apply (metis add.commute less_diff_conv)\n  apply (metis Suc_leI le_trans less_or_eq_imp_le not_less_eq_eq)\n  apply(subgoal_tac \"fst(tempR s) = 0\") prefer 2\n  apply fastforce\n  apply(subgoal_tac \"end(tempR s) = a\") prefer 2 \n  apply (metis add_cancel_left_left end_simp)\n  apply(subgoal_tac \"hW s\\<ge>a\") prefer 2 \n  apply (metis le_trans)\n  apply (metis Suc_leI end_simp le_trans not_less_eq_eq)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply(simp add:pre_W_def pre_A6_inv_def) \n  apply (metis le_add_diff_inverse le_trans less_or_eq_imp_le)\n  apply(simp add:case_2_lemmas)\n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply(simp add:pre_W_def pre_A7_inv_def) \n  apply clarify\n  apply(intro conjI impI)\n  apply linarith\n  apply (metis le_add_diff_inverse le_trans less_or_eq_imp_le)\n  apply(simp add:case_2_lemmas)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply clarify\n  apply(intro conjI impI)\n  apply linarith\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  prefer 2\n  apply(case_tac \"pcW s\", simp_all)\n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"pcW s \", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  by(case_tac \"tW s \\<noteq> T s\", simp_all) \n\n\nlemma preIdleR_doesnt_change_with_W:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_dequeue_inv s\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_dequeue_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_dequeue_inv_def) \n  apply(intro conjI impI)\n  apply(simp add:pre_W_def)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def pre_W_def)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def pre_W_def)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def pre_W_def)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply(cases \"ownT s = Q\", simp_all) \n  apply(simp add:pre_A2_inv_def)\n  apply(cases \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(cases \"tW s < hW s\", simp_all) \n  apply(case_tac \"T s = hW s\", simp_all)\n  apply(cases \"ownT s = Q\", simp_all) \n  using pre_A2_inv_def apply auto[1]\n  apply(cases \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(cases \"tW s < hW s\", simp_all) \n  apply(cases \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply(cases \"ownT s = Q\", simp_all) \n  using pre_A2_inv_def apply auto[1]\n  apply(cases \"tW s = hW s \\<and> Data s n \\<le> N\", simp_all)\n  apply(cases \"hW s < tW s \\<and> Data s n < tW s - hW s\", simp_all) \n  apply(cases \"tW s < hW s\", simp_all) \n  apply(cases \"Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(cases \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(cases \"N < Data s (numEnqs s)\", simp_all)\n  apply(cases \"ownT s = W\", simp_all add:pre_enqueue_inv_def inv_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas)\n  apply (metis nat_less_le)\n  apply simp apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis nat_less_le)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply(cases \"ownT s = W\", simp_all add:pre_enqueue_inv_def inv_def)\n  apply(cases \"ownT s = W\", simp_all add:pre_A2_inv_def inv_def)\n  apply(cases \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(cases \"tW s < hW s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(simp add:pre_A3_inv_def)\n  apply(simp add:pre_A4_inv_def)\n  apply(simp add:pre_A5_inv_def)\n  apply(simp add:pre_A6_inv_def)\n  apply(simp add:pre_A7_inv_def)\n  apply(simp add:pre_A8_inv_def)\n  apply(cases \"N < Data s (numEnqs s)\", simp_all)\n  apply(simp add:pre_acquire_inv_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all) defer\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all add:pre_enqueue_inv_def inv_def)\n  apply(cases \"ownT s = W\", simp_all add:pre_A2_inv_def inv_def)\n  apply(cases \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(cases \"tW s < hW s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(simp add:pre_A3_inv_def)\n  apply(simp add:pre_A4_inv_def)\n  apply (metis (no_types, lifting) F.distinct(19) add.commute add_lessD1 less_diff_conv less_imp_add_positive)\n  apply(simp add:pre_A5_inv_def)\n  apply(cases \"Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(cases \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(simp add:pre_A6_inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply clarify\n  apply(subgoal_tac \"offset s = hW s\") prefer 2\n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) add_lessD1 diff_is_0_eq' le_0_eq le_eq_less_or_eq length_0_conv nat_le_iff_add)\n  apply (metis (no_types, lifting) F.distinct(19) add_lessD1 diff_self_eq_0 le_0_eq le_add_diff_inverse le_neq_implies_less length_0_conv)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\") \n  apply (metis Suc_leI not_less_eq_eq)\n  apply(simp add:pre_A7_inv_def) \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply clarify\n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) add_lessD1 diff_is_0_eq' le_0_eq le_eq_less_or_eq length_0_conv nat_le_iff_add)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\") \n  apply (metis Suc_leI not_less_eq_eq)\n  apply(simp add:pre_A8_inv_def)\n  apply(cases \"N < Data s (numEnqs s)\", simp_all)\n  apply(cases \"ownT s = W\", simp_all)\n  apply (metis fst_conv le_trans nat_less_le snd_conv tempW_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add:case_1_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"q s=[]\")\n  apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = offset s\") prefer 2\n  apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n  apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = Data s (numEnqs s)\") prefer 2\n  apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n  apply (metis le_trans less_imp_le_nat)\n  apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = fst(hd(q s))\") prefer 2\n  apply (metis (no_types, lifting) hd_append2)\n  apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = snd(hd(q s))\") prefer 2\n  apply (metis (no_types, lifting) hd_append2)\n  apply presburger\n  apply(simp add:case_2_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"q s=[]\")\n  apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = offset s\") prefer 2\n  apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n  apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = Data s (numEnqs s)\") prefer 2\n  apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n  apply (metis le_trans less_imp_le_nat)\n  apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = fst(hd(q s))\") prefer 2\n  apply (metis (no_types, lifting) hd_append2)\n  apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = snd(hd(q s))\") prefer 2\n  apply (metis (no_types, lifting) hd_append2)\n  apply presburger\n  apply(case_tac \"numEnqs s< n\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"pcW s\", simp_all)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply(case_tac \"numEnqs s< n\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"pcW s\", simp_all)\n  apply(case_tac \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \" hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s \", simp_all)\n  apply(case_tac \"tW s < hW s\", simp_all)\n  apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(simp_all add:cW_step_def trans_A3_def trans_A4_def trans_A6_def trans_A7_def)\n  apply (simp add: pre_A3_inv_def)\n  apply(case_tac \" Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n  apply(case_tac \"ownT s = W\", simp_all)\n  apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(simp add:pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply clarify\n  apply (metis (no_types, hide_lams) Nat.add_0_right diff_is_0_eq le_refl nat_add_left_cancel_less nat_neq_iff zero_less_diff)\n  apply(simp add:case_2_lemmas) \n  apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(simp add:pre_enqueue_inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply clarify\n  apply (metis (no_types, hide_lams) diff_self_eq_0 fst_eqD hd_append le_zero_eq length_0_conv less_add_same_cancel1 less_or_eq_imp_le list.sel(1) nat_less_le snd_eqD tempW_def)\n  apply(simp add:case_2_lemmas) \n  apply(subgoal_tac \"\\<forall>a b j. ((a, b) \\<in> set (q s)) \\<and> j < N \\<and> T s \\<le> j \\<longrightarrow> a + b < j\") prefer 2\n  apply (metis (no_types, lifting) hd_append length_greater_0_conv length_pos_if_in_set)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"offset s + Data s (numEnqs s)<T s\") prefer 2 \n  apply force\n  apply(subgoal_tac \"\\<forall> j. T s \\<le> j \\<longrightarrow> offset s + Data s (numEnqs s) < j\") prefer 2 \n  apply (metis (mono_tags, hide_lams) diff_is_0_eq le_trans nat_less_le zero_less_diff)\n  apply (metis (no_types, lifting))\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  by(case_tac \"tW s \\<noteq> T s\", simp_all)\n\n\nlemma preRelease_doesnt_change_with_W:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_Release_inv s\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_Release_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_Release_inv_def) \n  apply(intro conjI impI)\n  apply(simp add:cW_step_def)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp_all add:cW_step_def)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:pre_W_def pre_write_inv_def)\n  apply (metis F.distinct(1) fst_eqD less_add_same_cancel1 nat_le_linear snd_eqD)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply(cases \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(cases \"tW s < hW s\", simp_all)\n  apply(case_tac \"Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n  apply(simp add:pre_W_def pre_enqueue_inv_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply (metis Nat.le_imp_diff_is_add hd_append length_0_conv list.sel(1) plus_nat.add_0 tempW_reflects_writes_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:pre_W_def pre_write_inv_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis fst_eqD head_q0 length_greater_0_conv)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:pre_W_def pre_write_inv_def)\n  apply (metis F.distinct(1))\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all) defer\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply (metis (no_types, lifting) F.distinct(13) Suc_lessD add.commute less_diff_conv less_trans_Suc) \n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply (metis (mono_tags, hide_lams) F.distinct(13) le_antisym le_trans less_or_eq_imp_le nat_neq_iff)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply (metis (no_types, hide_lams) F.distinct(13) Suc_lessD less_trans_Suc)  \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)    \n  apply(cases \"pcW s\", simp_all add:trans_A3_def trans_A4_def trans_A6_def trans_A7_def) \n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(case_tac \" tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all) \n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(case_tac \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(case_tac \"tW s < hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply (metis (no_types, lifting) F.distinct(13) Suc_lessD add.commute less_diff_conv less_trans_Suc)\n  apply(case_tac \" Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply metis\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply metis\n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le nat_neq_iff)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(clarify)\n  apply(intro conjI impI)\n  apply (metis F.distinct(13) Suc_lessD less_trans_Suc)\n  apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le linorder_neqE_nat)\n  apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n  apply(simp add:pre_W_def pre_A8_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_A8_inv_def)  defer\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(simp add:pre_W_def pre_acquire_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_acquire_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_OOM_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply metis\n  apply metis\n  apply(simp add:pre_W_def pre_write_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right eq_imp_le fst_eqD nat_add_left_cancel_less snd_eqD)\n  apply(simp add:pre_W_def pre_enqueue_inv_def)   \n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(intro conjI impI)\n  apply(simp add: tempW_def)\n  apply(case_tac \"q s\\<noteq>[]\") \n  apply (metis (no_types, hide_lams) hd_append2)\n  apply(subgoal_tac \"q s=[]\") prefer 2 \n  apply force\n  apply(subgoal_tac \"tempR s \\<noteq>(0,0)\") prefer 2 \n  apply blast\n  apply(case_tac \"offset s = 0\")\n  apply (metis append_Nil fst_conv list.sel(1))\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply clarify \n  apply(subgoal_tac \"c=b\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"end(tempR s) = b\") prefer 2 \n  apply (metis end_simp le_add_diff_inverse)\n  apply(subgoal_tac \"offset s = hW s\") prefer 2\n  apply meson \n  apply(subgoal_tac \"i\\<ge>c \\<and> i<H s \\<longrightarrow>ownB s i = W\") prefer 2\n  apply metis\n  apply(subgoal_tac \"H s\\<le>N\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"(i<c \\<or> i\\<ge>H s \\<and> i\\<le>N) \\<longrightarrow>ownB s i\\<noteq>W\") prefer 2 \n  apply (metis F.distinct(1) F.distinct(5) bot_nat_0.not_eq_extremum diff_is_0_eq zero_less_diff)\n  apply (metis F.distinct(1) add_leD1 end_simp le_eq_less_or_eq linorder_neqE_nat nat_less_le)  \n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\") \n  apply clarify \n  apply (metis eq_imp_le le_add1 le_neq_implies_less plus_nat.add_0)\n  apply(simp add: tempW_def)\n  apply(case_tac \"q s=[]\")\n  apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right Suc_le_lessD Suc_lessD Suc_pred add_lessD1 fst_eqD le_add_diff_inverse less_Suc0 less_Suc_eq_le less_add_same_cancel1 list.size(3) nat_add_left_cancel_le nth_Cons_0 self_append_conv2)\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>i<length (q s). fst ((q s) ! i) \\<noteq> fst (tempR s)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"fst((offset s, Data s (numEnqs s))) \\<noteq> fst(tempR s)\") \n  apply (metis less_SucE nth_append nth_append_length)\n  apply(subgoal_tac \"offset s \\<noteq> fst(tempR s)\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n  apply(case_tac \"case_1 s\", simp_all) \n  apply(subgoal_tac \"\\<forall>i<length (q s).\n       (fst (tempR s) < fst ((q s ) ! i) \\<longrightarrow>\n        fst (tempR s) + Data s (numReads s - Suc 0) \\<le> fst ((q s ) ! i)) \\<and>\n       (fst ((q s) ! i) < fst (tempR s) \\<longrightarrow>\n        fst ((q s) ! i) + snd ((q s ) ! i)\n        \\<le> fst (tempR s))\")\n  prefer 2 \n  apply (metis (no_types, lifting) gr_implies_not0 length_0_conv)\n  apply(subgoal_tac \"(fst (tempR s) < fst(offset s, Data s (numEnqs s)) \\<longrightarrow>\n        fst (tempR s) + Data s (numReads s - Suc 0) \\<le> fst(offset s, Data s (numEnqs s))) \\<and>\n       (fst(offset s, Data s (numEnqs s)) < fst (tempR s) \\<longrightarrow>\n        end(offset s, Data s (numEnqs s))\n        \\<le> fst (tempR s))\")\n  apply (smt (z3) end_simp less_SucE nth_append nth_append_length)\n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) Nat.add_0_right fst_eqD le_eq_less_or_eq less_add_same_cancel1 less_nat_zero_code nat_neq_iff snd_eqD tempW_def)\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply (simp add:case_1_lemmas)\n  apply(clarify)\n  apply (metis (no_types, lifting) F.distinct(1) diff_is_0_eq le_refl less_imp_le_nat not_gr0 prod.collapse prod.inject tempW_def zero_less_diff)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\") \n  apply clarify\n  apply (metis less_or_eq_imp_le zero_less_iff_neq_zero)\n  apply(simp add: tempW_def)\n  apply(subgoal_tac \"end((offset s, Data s (numEnqs s))) \\<noteq> fst(tempR s)\") \n  apply (metis end_simp fst_conv snd_conv)\n  apply(subgoal_tac \"offset s \\<noteq> fst(tempR s)\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add:case_1_lemmas)\n  apply(clarify)\n  apply linarith\n  apply(simp add:case_2_lemmas) apply (thin_tac \"\\<not>case_1 s\") \n  apply(clarify)\n  by (metis add_gr_0 nat_neq_iff)\n\nlemma GLOBAL_W_step_shows_preR:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_R (pcR s') s'\"\n  using assms apply simp\n  apply(subgoal_tac \"pcR s' = pcR s\") prefer 2\n  using pcR_doesnt_change_with_W [where s=s and s'=s']\n  apply simp\n  apply(simp add:pre_R_def) apply(case_tac \"pcR s\") apply simp_all\n  using preRelease_doesnt_change_with_W [where s=s and s'=s'] apply simp    \n  using preIdleR_doesnt_change_with_W [where s=s and s'=s'] apply simp     \n  using preRead_doesnt_change_with_W [where s=s and s'=s'] \n  by simp\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************GLOBAL R_step shows preW*************************************)\n\nlemma pcW_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"pre_W (pcW s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pcW s'=pcW s\"\n using assms apply simp\n  apply(case_tac \"pcR s \", simp_all add:cR_step_def)\n  by(case_tac \"q s=[]\", simp_all)\n\n\nlemma ownB_by_W_doesnt_change_after_release:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Release_inv s \\<Longrightarrow> cR_step Release s s'\n  \\<Longrightarrow>ownB s i = W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_Release_inv_def)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\") \n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas)\n  apply metis\n  apply simp apply(simp add:case_2_lemmas)\n  apply (metis F.distinct(7) nat_less_le) \n  apply(case_tac \"case_1 s\") apply simp by(simp add:case_1_lemmas)\n  \nlemma ownB_not_by_W_doesnt_change_after_release:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Release_inv s \\<Longrightarrow> cR_step Release s s'\n  \\<Longrightarrow>ownB s i \\<noteq> W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i \\<noteq> W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\nlemma ownB_by_W_doesnt_change_after_read:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Read_inv s \\<Longrightarrow> cR_step Read s s'\n  \\<Longrightarrow>ownB s i = W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\nlemma ownB_not_by_W_doesnt_change_after_read:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Read_inv s \\<Longrightarrow> cR_step Read s s'\n  \\<Longrightarrow>ownB s i \\<noteq> W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i \\<noteq> W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\nlemma ownB_by_W_doesnt_change_after_dequeue:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_dequeue_inv s \\<Longrightarrow> cR_step idleR s s'\n  \\<Longrightarrow>ownB s i = W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"q s=[]\")\n  apply presburger\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas) \n  apply (metis (no_types, hide_lams) F.distinct(3))\n  apply simp apply(simp add:case_2_lemmas)\n  by (metis (no_types, hide_lams) F.distinct(3))\n\n\nlemma ownB_not_by_W_doesnt_change_after_dequeue:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_dequeue_inv s \\<Longrightarrow> cR_step idleR s s'\n  \\<Longrightarrow>ownB s i \\<noteq> W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i \\<noteq> W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"q s=[]\")\n  apply presburger\n  apply(case_tac \"case_1 s\") apply simp by(simp add:case_1_lemmas) \n\nlemma ownB_by_W_doesnt_change_with_R:\n  \"inv s \\<Longrightarrow> con_assms s  \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \\<longrightarrow> pre_Release_inv s \\<Longrightarrow>\n     pcR s = Read \\<longrightarrow> pre_Read_inv s \\<Longrightarrow> pcR s = idleR \\<longrightarrow> pre_dequeue_inv s\n  \\<Longrightarrow>ownB s i = W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = W \\<and> i\\<le>N\"\n  apply(case_tac \"pcR s \") apply simp_all\n  using ownB_by_W_doesnt_change_after_release [where s=s and s'=s' and i=i]\n  apply auto[1] \n  using ownB_by_W_doesnt_change_after_dequeue [where s=s and s'=s' and i=i]\n  apply auto[1]\n  using ownB_by_W_doesnt_change_after_read [where s=s and s'=s' and i=i]\n  by auto[1]\n\nlemma ownB_not_by_W_doesnt_change_with_R:\n  \"inv s \\<Longrightarrow> con_assms s  \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \\<longrightarrow> pre_Release_inv s \\<Longrightarrow>\n     pcR s = Read \\<longrightarrow> pre_Read_inv s \\<Longrightarrow> pcR s = idleR \\<longrightarrow> pre_dequeue_inv s\n  \\<Longrightarrow>ownB s i \\<noteq> W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i \\<noteq> W \\<and> i\\<le>N\"\n  apply(case_tac \"pcR s \") apply simp_all\n  using ownB_not_by_W_doesnt_change_after_release [where s=s and s'=s' and i=i]\n  apply auto[1] \n  using ownB_not_by_W_doesnt_change_after_dequeue [where s=s and s'=s' and i=i]\n  apply auto[1]\n  using ownB_not_by_W_doesnt_change_after_read [where s=s and s'=s' and i=i]\n  by auto[1]\n\n\nlemma ownB_by_B_doesnt_change_after_release:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Release_inv s \\<Longrightarrow> cR_step Release s s'\n  \\<Longrightarrow>ownB s i = B \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = B \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\nlemma ownB_by_B_doesnt_change_after_read:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Read_inv s \\<Longrightarrow> cR_step Read s s'\n  \\<Longrightarrow>ownB s i = B \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = B \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\nlemma ownB_by_B_doesnt_change_after_dequeue:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_dequeue_inv s \\<Longrightarrow> cR_step idleR s s'\n  \\<Longrightarrow>ownB s i = B \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = B \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"q s=[]\")\n  apply presburger\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas)\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  by force\n\nlemma ownB_by_B_doesnt_change_with_R:\n  \"inv s \\<Longrightarrow> con_assms s  \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \\<longrightarrow> pre_Release_inv s \\<Longrightarrow>\n     pcR s = Read \\<longrightarrow> pre_Read_inv s \\<Longrightarrow> pcR s = idleR \\<longrightarrow> pre_dequeue_inv s\n  \\<Longrightarrow>ownB s i = B \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = B \\<and> i\\<le>N\"\n  apply(case_tac \"pcR s \") apply simp_all\n  using ownB_by_B_doesnt_change_after_release [where s=s and s'=s' and i=i]\n  apply auto[1] \n  using ownB_by_B_doesnt_change_after_dequeue [where s=s and s'=s' and i=i]\n  apply auto[1]\n  using ownB_by_B_doesnt_change_after_read [where s=s and s'=s' and i=i]\n  by auto[1]\n\n\n\nlemma ownB_by_D_doesnt_change_after_release:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Release_inv s \\<Longrightarrow> cR_step Release s s' \\<Longrightarrow>tR s = fst(tempR s)\n  \\<Longrightarrow>ownB s i = D \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = D \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n  \n\nlemma ownB_by_D_doesnt_change_after_read:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Read_inv s \\<Longrightarrow> cR_step Read s s'\n  \\<Longrightarrow>ownB s i = D \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = D \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\n\nlemma ownB_by_D_doesnt_change_after_dequeue:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_dequeue_inv s \\<Longrightarrow> cR_step idleR s s'\n  \\<Longrightarrow>ownB s i = D \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = D \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"q s=[]\", simp_all) \n  by force\n\n\nlemma W_items_dont_change_with_R:\n  \"cR_step (pcR s) s s' \n  \\<Longrightarrow>offset s = offset s' \\<and> Data s (numEnqs s) = Data s' (numEnqs s') \\<and> numEnqs s = numEnqs s' \"\n  apply(case_tac \"pcR s \") apply simp_all apply(simp_all add:cR_step_def)\n  by(cases \"q s=[]\", simp_all) \n\nlemma W_items_dont_change_with_R_2:\n  \"cR_step (pcR s) s s' \n  \\<Longrightarrow>tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\"\n  apply(case_tac \"pcR s \") apply simp_all apply(simp_all add:cR_step_def tempW_def)\n  by(cases \"q s=[]\", simp_all) \n\nlemma W_items_dont_change_with_R_3:\n  \"cR_step (pcR s) s s' \n  \\<Longrightarrow>numWrites s=numWrites s' \\<and> H s= H s'\"\n  apply(case_tac \"pcR s \") apply simp_all apply(simp_all add:cR_step_def tempW_def)\n  by(cases \"q s=[]\", simp_all) \n\nlemma ownB_by_D_relation_with_R:\n  \"inv s \\<Longrightarrow>con_assms s  \\<Longrightarrow> pre_Read_inv s \\<Longrightarrow> pre_enqueue_inv s \\<Longrightarrow>  \noffset s \\<noteq> fst(tempR s)\"\n  apply (simp add:inv_def pre_Read_inv_def pre_enqueue_inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply(clarify)\n  apply(case_tac \"q s=[]\")\n  apply(subgoal_tac \"b=c\") prefer 2\n  apply (metis nat_less_le) apply(unfold tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"offset s = c\") prefer 2\n  apply (metis F.distinct(1) F.distinct(5) fst_conv le_iff_add less_or_eq_imp_le nat_less_le snd_conv)\n  apply(subgoal_tac \"offset s = b\") prefer 2 \n  apply force\n  apply(subgoal_tac \"fst(tempR s )\\<ge>T s\") prefer 2 \n  apply linarith apply(unfold tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"snd( tempR s )>0\")\n  apply metis\n  apply metis\n  apply(subgoal_tac \"b<c\") prefer 2 \n  apply (metis diff_self_eq_0 le_zero_eq length_0_conv nat_less_le)\n  apply(subgoal_tac \"offset s = c\") prefer 2\n  apply (metis F.distinct(1) F.distinct(5) fst_conv le_iff_add less_or_eq_imp_le nat_less_le snd_conv)\n  apply(subgoal_tac \"snd(tempR s)>0\") \n  apply (metis end_simp)\n  apply (metis end_simp)\n  apply simp\n  apply(simp add:case_2_lemmas)\n  apply clarify\n  apply(case_tac \"q s=[]\")\n  apply(subgoal_tac \"d = fst(tempR s)\") prefer 2 \n  apply (metis F.distinct(1) Nat.add_0_right le0 less_nat_zero_code nat_add_left_cancel_less)\n  apply(subgoal_tac \"fst(tempW s) = b\") prefer 2 \n  apply (metis F.distinct(1) diff_is_0_eq le0 nat_neq_iff zero_less_diff)\n  apply(subgoal_tac \"snd(tempW s) > 0\") prefer 2\n  apply (metis snd_eqD tempW_def)\n  apply (metis fst_eqD le_neq_implies_less tempW_def)\n  by (metis F.distinct(1) add_gr_0 le0)\n\n\nlemma R_doesnt_change_q_read_release:\n  \"inv s \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s\\<noteq>idleR \\<Longrightarrow> q s=q s'\"\n  apply(simp add:inv_def cR_step_def)\n  by(case_tac \"pcR s\", simp_all)\n\nlemma R_changes_q_dequeue:\n  \"inv s \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s=idleR \\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> tl(q s)=q s'\"\n  by(simp add:inv_def cR_step_def)\n\nlemma strange_but_Q_2:\n  \"length(q s)>1 \\<Longrightarrow>hd(tl(q s)) = tl(q s)!0\"\n  by (metis One_nat_def hd_conv_nth length_tl less_nat_zero_code list.size(3) zero_less_diff)\n\nlemma strange_but_Q_4:\n  \"length(q s)>1 \\<Longrightarrow>hd(tl(q s)) = q s!1\"\n  by (simp add: nth_tl strange_but_Q_2)\n\nlemma R_doesnt_change_ownD_release_dequeue:\n  \"cR_step (pcR s) s s'\\<Longrightarrow> pcR s\\<noteq>Read \\<Longrightarrow>\n  ownD s= ownD s'\"\n  apply(simp add: cR_step_def) \n  apply(case_tac \"pcR s\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n\nlemma R_doesnt_change_ownD_read_except:\n  \"cR_step (pcR s) s s'\\<Longrightarrow> pcR s=Read \\<Longrightarrow> \n  i\\<ge>0 \\<and> i\\<noteq> data_index s (tempR s) \\<longrightarrow> ownD s i= ownD s' i\"\n  by(simp add: cR_step_def) \n\nlemma Q_empty_R_step_result:\n  \"cR_step (pcR s) s s' \\<Longrightarrow> q s=[] \\<Longrightarrow> pcR s=idleR \\<Longrightarrow>\nq s'=[]\"\n  by (simp add:cR_step_def)\n\nlemma Q_W_relation_through_R_1:\n  \"cR_step (pcR s) s s' \\<Longrightarrow> q s'\\<noteq>[] \\<Longrightarrow> q s\\<noteq>[] \\<Longrightarrow> pcR s = idleR \\<Longrightarrow>\n\\<forall>i<length (q s).\n       (offset s < fst (q s ! i) \\<longrightarrow> offset s + Data s (numEnqs s) < fst (q s ! i)) \\<and>\n       (fst (q s ! i) < offset s \\<longrightarrow> fst (q s ! i) + snd (q s ! i) \\<le> offset s)\n\\<Longrightarrow>\n\\<forall>i<length (q s').\n       (offset s' < fst (q s' ! i) \\<longrightarrow> offset s' + Data s' (numEnqs s') < fst (q s' ! i)) \\<and>\n       (fst (q s' ! i) < offset s' \\<longrightarrow> fst (q s' ! i) + snd (q s' ! i) \\<le> offset s')\"\n  apply(simp add:cR_step_def)\n  by (simp add: length_greater_0_conv nth_tl)\n\nlemma Q_W_relation_through_R_2:\n  \"cR_step (pcR s) s s'  \\<Longrightarrow> pcR s = Read \\<Longrightarrow>\n\\<forall>i<length (q s).\n       (offset s < fst (q s ! i) \\<longrightarrow> offset s + Data s (numEnqs s) < fst (q s ! i)) \\<and>\n       (fst (q s ! i) < offset s \\<longrightarrow> fst (q s ! i) + snd (q s ! i) \\<le> offset s)\n\\<Longrightarrow>\n\\<forall>i<length (q s').\n       (offset s' < fst (q s' ! i) \\<longrightarrow> offset s' + Data s' (numEnqs s') < fst (q s' ! i)) \\<and>\n       (fst (q s' ! i) < offset s' \\<longrightarrow> fst (q s' ! i) + snd (q s' ! i) \\<le> offset s')\"\n  by(simp add:cR_step_def)\n\n\nlemma Q_W_relation_through_R_3:\n  \"cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \\<Longrightarrow>\n\\<forall>i<length (q s).\n       (offset s < fst (q s ! i) \\<longrightarrow> offset s + Data s (numEnqs s) < fst (q s ! i)) \\<and>\n       (fst (q s ! i) < offset s \\<longrightarrow> fst (q s ! i) + snd (q s ! i) \\<le> offset s)\n\\<Longrightarrow>\n\\<forall>i<length (q s').\n       (offset s' < fst (q s' ! i) \\<longrightarrow> offset s' + Data s' (numEnqs s') < fst (q s' ! i)) \\<and>\n       (fst (q s' ! i) < offset s' \\<longrightarrow> fst (q s' ! i) + snd (q s' ! i) \\<le> offset s')\"\n  by(simp add:cR_step_def) \n\n\nlemma pre_write_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_write_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_write_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_write_inv_def)\n  apply(subgoal_tac \"end(tempW s )\\<le>N\") prefer 2 apply(simp_all add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:pre_R_def)\n  apply(intro conjI impI)\n  apply(case_tac[!] \"pcR s\")\n  apply simp_all apply(subgoal_tac \"\\<forall>i. offset s \\<le> i \\<and> i < fst (tempW s) + snd (tempW s) \\<longrightarrow> ownB s i = W\") prefer 2 \n  apply (metis fst_eqD snd_eqD tempW_def)\n  apply(subgoal_tac \"hW s = hW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s = tW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  using ownB_by_W_doesnt_change_after_release [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_3.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (smt (z3) PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_3.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (smt (z3) PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_3.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (smt (z3) PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply clarify   \n  apply(intro conjI impI)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(1) assms(2) less_or_eq_imp_le)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (smt (z3) PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) le_add_same_cancel1 le_trans less_or_eq_imp_le not_gr_zero)\n  apply clarify\n  apply(intro conjI impI)        \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_dequeue prod.inject tempW_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify\n  apply(intro conjI impI)        \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_read prod.inject tempW_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify       \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (smt (z3) PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply clarify       \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (smt (z3) PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply clarify\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (smt (z3) PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply(case_tac \"tR s = fst(tempR s)\")\n  using ownB_by_D_doesnt_change_after_release [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) nat_less_le)\n  apply (simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add: case_1_lemmas) \n  apply (metis (no_types, hide_lams) F.distinct(25) F.distinct(7) \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> le0 le_refl nat_less_le nat_neq_iff prod.inject tempW_def)\n  apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:pre_Release_inv_def)\n  apply(subgoal_tac \"T s\\<noteq>fst(tempR s)\") prefer 2 \n  apply blast\n  apply(simp add:case_2_lemmas)\n  apply clarify\n  apply(subgoal_tac \"fst(tempR s) = T s \\<or> fst(tempR s) = 0\") prefer 2 \n  apply meson\n  apply(subgoal_tac \"fst(tempR s) = 0\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s (fst(tempR s)) = R\") prefer 2\n  apply metis\n  apply(subgoal_tac \"ownB s (offset s) = W\") prefer 2 \n  apply (metis Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply (metis F.distinct(1) W_items_dont_change_with_R)\n  using ownB_by_D_doesnt_change_after_dequeue [where s=s and s'=s'] \n  using W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) less_or_eq_imp_le \n  apply presburger\n  using ownB_by_D_doesnt_change_after_read [where s=s and s'=s'] \n  using W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) less_or_eq_imp_le \n  apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply (simp add: pre_Release_inv_def) \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply (simp add: pre_dequeue_inv_def inv_def Q_lemmas Q_basic_lemmas cR_step_def) \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(simp add: pre_Read_inv_def) \n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply (metis last_tl)\n  apply (metis last_tl)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis assms(5))\n  apply(subgoal_tac \"(\\<forall>i<length (q s). fst (q s ! i) \\<noteq> offset s)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(\\<forall>i<length (tl(q s)). fst (tl(q s) ! i) \\<noteq> offset s)\") prefer 2\n  apply (metis Suc_diff_Suc diff_Suc_eq_diff_pred diff_add_0 length_tl linordered_semidom_class.add_diff_inverse nat.discI nth_tl)\n  apply(subgoal_tac \"length(q s) - Suc 0 = length(tl(q s))\") prefer 2 \n  apply (metis One_nat_def length_tl)\n  apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis assms(5))\n  apply(subgoal_tac \"(\\<forall>i<length (q s). fst (q s ! i) \\<noteq> offset s)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(\\<forall>i<length (tl(q s)). fst (tl(q s) ! i) \\<noteq> offset s)\") prefer 2                  \n  apply (metis Suc_diff_Suc diff_Suc_eq_diff_pred diff_add_0 length_tl linordered_semidom_class.add_diff_inverse nat.discI nth_tl)\n  apply (metis One_nat_def length_tl)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis assms(5))\n  apply(subgoal_tac \"(\\<forall>i<length (q s). fst (q s ! i) \\<noteq> offset s)\") prefer 2 \n  apply (metis length_0_conv less_nat_zero_code)\n  apply(subgoal_tac \"offset s' = offset s\") prefer 2\n  apply (metis fst_conv tempW_def)\n  apply(subgoal_tac \"q s= q s'\") \n  apply metis\n  using R_doesnt_change_q_read_release [where s=s and s'=s']\n  apply (metis PCR.distinct(5) assms(5))                \n  using Q_W_relation_through_R_3 [where s=s and s'=s'] \n  apply (simp add: \\<open>\\<lbrakk>RingBuffer_BD_latest_3.inv s; cR_step (pcR s) s s'; pcR s \\<noteq> idleR\\<rbrakk> \\<Longrightarrow> q s = q s'\\<close>)\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 \n  apply (metis Q_empty_R_step_result)\n  using Q_W_relation_through_R_1 [where s=s and s'=s']\n  apply presburger       \n  using Q_W_relation_through_R_2 [where s=s and s'=s']\n  apply (simp add: \\<open>\\<lbrakk>RingBuffer_BD_latest_3.inv s; cR_step (pcR s) s s'; pcR s \\<noteq> idleR\\<rbrakk> \\<Longrightarrow> q s = q s'\\<close>)\n  apply(subgoal_tac \"q s=q s'\") prefer 2 \n  using R_doesnt_change_q_read_release [where s=s and s'=s']\n  using PCR.distinct(1) apply presburger\n  apply(subgoal_tac \"offset s + Data s (numEnqs s) \\<noteq> fst (hd (q s))\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"tempW s=tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis)\n  apply (metis W_items_dont_change_with_R)\n  apply(subgoal_tac \"offset s + Data s (numEnqs s) \\<noteq> fst (hd (q s))\") prefer 2   \n  using cR_step_def apply force\n  apply(subgoal_tac \"i<length(q s)\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> fst(q s ! i)\") prefer 2 \n  apply (metis diff_add_zero length_0_conv less_irrefl_nat less_nat_zero_code linordered_semidom_class.add_diff_inverse)\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 \n  using PCR.simps(8) cR_step_def apply force\n  apply(subgoal_tac \"fst(hd(q s')) = fst(hd(tl(q s)))\") prefer 2 \n  using R_changes_q_dequeue apply presburger\n  apply(subgoal_tac \"tempW s=tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"offset s' = offset s\") prefer 2\n  apply (metis fst_conv tempW_def)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2\n  using strange_but_Q_4 [where s=s] fst_def \n  apply (metis R_changes_q_dequeue length_greater_0_conv length_tl zero_less_diff)\n  apply (metis R_changes_q_dequeue cancel_comm_monoid_add_class.diff_cancel le_iff_add length_0_conv length_tl less_one linorder_neqE_nat nat_less_le snd_conv tempW_def)\n  apply(subgoal_tac \"q s=q s'\") prefer 2 \n  using R_doesnt_change_q_read_release [where s=s and s'=s']\n  using PCR.distinct(5) apply presburger\n  apply(subgoal_tac \"offset s + Data s (numEnqs s) \\<noteq> fst (hd (q s))\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"tempW s=tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis)\n  apply (metis W_items_dont_change_with_R)\n  apply clarify\n  using W_items_dont_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s' and i=j]\n  apply (metis \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_3.inv s; con_assms s; pre_Release_inv s; cR_step Release s s'; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> assms(1) assms(2) le_trans less_imp_le_nat)\n  apply clarify\n  using W_items_dont_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s' and i=j]\n  apply (metis PCR.distinct(1) PCR.distinct(5) \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_3.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\<longrightarrow> pre_Release_inv s; pcR s = Read \\<longrightarrow> pre_Read_inv s; pcR s = idleR \\<longrightarrow> pre_dequeue_inv s; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> assms(2) le_trans less_imp_le_nat)\n  using W_items_dont_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s' and i=j]\n  apply (metis PCR.distinct(3) PCR.distinct(5) \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_3.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\<longrightarrow> pre_Release_inv s; pcR s = Read \\<longrightarrow> pre_Read_inv s; pcR s = idleR \\<longrightarrow> pre_dequeue_inv s; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> assms(2) le_trans less_imp_le_nat)\n  apply(subgoal_tac \"numWrites s= numWrites s'\") prefer 2\n  apply (metis W_items_dont_change_with_R_3 assms(5))\n  using R_doesnt_change_ownD_release_dequeue [where s=s and s'=s']\n  apply (metis PCR.distinct(3))\n  apply(subgoal_tac \"numWrites s= numWrites s'\") prefer 2\n  apply (metis W_items_dont_change_with_R_3 assms(5))\n  using R_doesnt_change_ownD_release_dequeue [where s=s and s'=s']\n  apply (metis PCR.distinct(5))\n  apply(subgoal_tac \"numWrites s= numWrites s'\") prefer 2\n  apply (metis W_items_dont_change_with_R_3 assms(5))\n  apply(subgoal_tac \"numWrites s \\<noteq> data_index s (tempR s) \") prefer 2 \n  apply(simp add:pre_Read_inv_def)\n  using R_doesnt_change_ownD_read_except [where s=s and s'=s']\n  apply (metis less_eq_nat.simps(1))\n  apply(subgoal_tac \"q s=q s'\") prefer 2\n  using R_doesnt_change_q_read_release [where s=s and s'=s']\n  using PCR.distinct(1) apply presburger\n  apply (metis W_items_dont_change_with_R)\n  apply(simp add:inv_def pre_dequeue_inv_def)\n  apply(subgoal_tac \"numEnqs s= 0\") prefer 2\n  using W_items_dont_change_with_R apply presburger\n  apply(subgoal_tac \"numDeqs s = 0\") prefer 2\n  apply (metis less_nat_zero_code nat_less_le)\n  apply(subgoal_tac \"q s=[]\") prefer 2\n  apply meson\n  apply(simp add:cR_step_def) \n  apply(subgoal_tac \"q s=q s'\") prefer 2\n  using R_doesnt_change_q_read_release [where s=s and s'=s']\n  using PCR.distinct(5) apply presburger\n  apply (metis W_items_dont_change_with_R)\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply metis\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply metis\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply metis\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using W_items_dont_change_with_R_3 [where s=s and s'=s']\n  apply (metis)\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using W_items_dont_change_with_R_3 [where s=s and s'=s']\n  apply (metis)\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using W_items_dont_change_with_R_3 [where s=s and s'=s']\n  by (metis)\n\n\nlemma pre_enqueue_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_enqueue_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_enqueue_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_enqueue_inv_def)\n  apply(subgoal_tac \"end(tempW s )\\<le>N\") prefer 2 apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:pre_R_def)\n  apply(intro conjI impI)\n  apply(case_tac[!] \"pcR s\")\n  apply simp_all apply(subgoal_tac \"\\<forall>i. offset s \\<le> i \\<and> i < fst (tempW s) + snd (tempW s) \\<longrightarrow> ownB s i = W\") prefer 2\n  apply metis   apply(subgoal_tac \"\\<forall>i. offset s > i \\<or> i \\<ge> fst (tempW s) + snd (tempW s) \\<and> i\\<le>N \\<longrightarrow> ownB s i \\<noteq> W\") prefer 2\n  apply metis\n  apply(subgoal_tac \"hW s = hW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s = tW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  using ownB_by_W_doesnt_change_after_release [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) end_simp le_trans less_or_eq_imp_le)\n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply clarify\n  apply (intro conjI impI)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply clarify\n  apply (intro conjI impI)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv le_imp_less_Suc nat_le_linear not_less_eq order_trans tempW_def)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv le_imp_less_Suc nat_le_linear not_less_eq order_trans tempW_def)\n  apply clarify\n  apply (intro conjI impI) \n  apply(subgoal_tac \"i<offset s \\<longrightarrow>ownB s i\\<noteq>W\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"offset s = offset s'\") prefer 2 \n  using PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) apply presburger\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_3.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(3) assms(2) le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_3.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(1) PCR.distinct(5) assms(2) le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_3.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(3) PCR.distinct(5) assms(2) le_trans less_or_eq_imp_le)\n  apply clarify\n  apply(intro conjI impI)        \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def)\n  apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_release prod.inject tempW_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify\n  apply(intro conjI impI)        \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_dequeue prod.inject tempW_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify\n  apply(intro conjI impI)        \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_read prod.inject tempW_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify       \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify       \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply(case_tac \"tR s = fst(tempR s)\")\n  using ownB_by_D_doesnt_change_after_release [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) nat_less_le)\n  apply (simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add: case_1_lemmas)\n  apply (metis F.distinct(15) F.distinct(21) F.distinct(25) F.distinct(7) W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> less_eq_Suc_le not_less_eq_eq)\n  apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:pre_Release_inv_def)\n  apply(subgoal_tac \"T s\\<noteq>fst(tempR s)\") prefer 2 \n  apply blast\n  apply(simp add:case_2_lemmas)\n  apply clarify\n  apply(subgoal_tac \"fst(tempR s) = T s \\<or> fst(tempR s) = 0\") prefer 2 \n  apply meson\n  apply(subgoal_tac \"fst(tempR s) = 0\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s (fst(tempR s)) = R\") prefer 2\n  apply metis\n  apply(subgoal_tac \"ownB s (offset s) = W\") prefer 2 \n  apply (metis \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> fst_eqD nat_le_iff_add plus_nat.add_0 snd_eqD tempW_def)\n  apply (metis F.distinct(1) W_items_dont_change_with_R)\n  using ownB_by_D_doesnt_change_after_dequeue [where s=s and s'=s'] \n  using W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) less_or_eq_imp_le \n  apply presburger\n  using ownB_by_D_doesnt_change_after_read [where s=s and s'=s'] \n  using W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) less_or_eq_imp_le \n  apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply (simp add: pre_Release_inv_def) \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply (simp add: pre_dequeue_inv_def inv_def Q_lemmas Q_basic_lemmas cR_step_def) \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(simp add: pre_Read_inv_def) \n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(intro conjI impI)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger \n  apply (metis fst_conv snd_conv tempW_def)\n  apply (metis PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n  apply (metis PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n  apply (metis (no_types, lifting) PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R assms(1) assms(5))\n  apply (metis PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R) \n  apply (metis W_items_dont_change_with_R \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_3.inv s; con_assms s; pre_Release_inv s; cR_step Release s s'; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> assms(2) le_trans less_imp_le_nat)\n  prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(intro conjI impI)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger \n  apply (metis fst_conv snd_conv tempW_def) \n  apply (metis PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n  apply (metis PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n  apply (metis (no_types, lifting) PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R assms(1) assms(5))\n  apply (metis PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n  apply (metis PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_3.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\<longrightarrow> pre_Release_inv s; pcR s = Read \\<longrightarrow> pre_Read_inv s; pcR s = idleR \\<longrightarrow> pre_dequeue_inv s; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_3.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\<longrightarrow> pre_Release_inv s; pcR s = Read \\<longrightarrow> pre_Read_inv s; pcR s = idleR \\<longrightarrow> pre_dequeue_inv s; ownB s i \\<noteq> W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i \\<noteq> W \\<and> i \\<le> N\\<close> assms(2) le_trans less_imp_le_nat)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)   \n  apply(intro conjI impI) apply(simp add:pre_dequeue_inv_def)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger               \n  apply (metis fst_conv snd_conv tempW_def) \n  apply(case_tac \"length(q s)>1\", simp_all)\n  apply(subgoal_tac \"last(q s) = last(tl(q s))\") prefer 2 \n  apply (metis R_changes_q_dequeue last_tl)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger    \n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2\n  apply (metis length_0_conv less_nat_zero_code)\n  apply (simp add: R_changes_q_dequeue W_items_dont_change_with_R)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger    \n  apply(subgoal_tac \"length(q s) = 1 \\<longrightarrow> tl(q s) = []\") prefer 2 \n  apply (metis cancel_comm_monoid_add_class.diff_cancel length_greater_0_conv length_tl not_gr0)\n  apply(case_tac \"q s=[]\") prefer 2 \n  apply (metis One_nat_def R_changes_q_dequeue Suc_lessI length_greater_0_conv)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(subgoal_tac \"q s= []\") prefer 2\n  apply blast\n  apply(subgoal_tac \"q s'=[]\") prefer 2\n  using Q_empty_R_step_result [where s=s and s'=s'] \n  apply presburger\n  apply linarith\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2\n  using \\<open>\\<lbrakk>cR_step (pcR s) s s'; q s = []; pcR s = idleR\\<rbrakk> \\<Longrightarrow> q s' = []\\<close> apply presburger\n  apply(subgoal_tac \"q s'= tl(q s)\") prefer 2\n  using R_changes_q_dequeue apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger  \n  apply (metis in_set_conv_nth list.set_sel(2) prod.inject tempW_def)\n  using Q_W_relation_through_R_1 [where s=s and s'=s']\n  using \\<open>\\<lbrakk>cR_step (pcR s) s s'; q s = []; pcR s = idleR\\<rbrakk> \\<Longrightarrow> q s' = []\\<close> apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger  \n  apply(subgoal_tac \"q s'= tl(q s)\") prefer 2\n  using R_changes_q_dequeue \n  using \\<open>\\<lbrakk>cR_step (pcR s) s s'; q s = []; pcR s = idleR\\<rbrakk> \\<Longrightarrow> q s' = []\\<close> apply presburger\n  apply(subgoal_tac \"offset s = offset s' \\<and>  numEnqs s = numEnqs s'\") prefer 2\n  using W_items_dont_change_with_R [where s=s and s'=s']\n  apply presburger\n  apply (metis Nat.add_0_right \\<open>\\<lbrakk>cR_step (pcR s) s s'; q s = []; pcR s = idleR\\<rbrakk> \\<Longrightarrow> q s' = []\\<close> \\<open>cR_step (pcR s) s s' \\<Longrightarrow> offset s = offset s' \\<and> Data s (numEnqs s) = Data s' (numEnqs s') \\<and> numEnqs s = numEnqs s'\\<close> hd_in_set in_set_conv_nth less_not_refl list.set_sel(2) nat_add_left_cancel_less)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger  \n  apply(subgoal_tac \"offset s = offset s'\") prefer 2\n  using \\<open>cR_step (pcR s) s s' \\<Longrightarrow> offset s = offset s' \\<and> Data s (numEnqs s) = Data s' (numEnqs s') \\<and> numEnqs s = numEnqs s'\\<close> apply presburger\n  apply(subgoal_tac \"Data s' (numEnqs s') = Data s (numEnqs s)\") prefer 2 \n  apply (metis \\<open>cR_step (pcR s) s s' \\<Longrightarrow> offset s = offset s' \\<and> Data s (numEnqs s) = Data s' (numEnqs s') \\<and> numEnqs s = numEnqs s'\\<close>)\n  apply(subgoal_tac \"\\<forall>j. offset s \\<le> j \\<and> j < offset s + Data s (numEnqs s) \\<longrightarrow> ownB s j = W\") prefer 2 \n  apply presburger\n  apply(clarify)  \n  using ownB_by_W_doesnt_change_after_dequeue [where s=s and s'=s' and i=j]\n  apply (metis PCR.distinct(1) PCR.distinct(5) \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_3.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\<longrightarrow> pre_Release_inv s; pcR s = Read \\<longrightarrow> pre_Read_inv s; pcR s = idleR \\<longrightarrow> pre_dequeue_inv s; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> assms(2) le_trans less_or_eq_imp_le)\n  apply(simp add:tempW_reflects_writes_def)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(simp add: pre_Read_inv_def)\n  apply(subgoal_tac \"data_index s (offset s, Data s (numEnqs s)) = numEnqs s\") prefer 2\n  apply meson\n  apply(subgoal_tac \"data_index s = data_index s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R)\n  apply(simp add:tempW_reflects_writes_def)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(simp add: pre_Read_inv_def)\n  apply(subgoal_tac \"data_index s (offset s, Data s (numEnqs s)) = numEnqs s\") prefer 2\n  apply meson\n  apply(subgoal_tac \"data_index s = data_index s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R)\n  apply(simp add:tempW_reflects_writes_def)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(simp add: pre_Read_inv_def)\n  apply(subgoal_tac \"data_index s (offset s, Data s (numEnqs s)) = numEnqs s\") prefer 2\n  apply meson\n  apply(subgoal_tac \"data_index s = data_index s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis)\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \" tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \" ownT s = R\", simp_all)\n  apply(case_tac \" ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \" ownT s = Q\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(simp add:cR_step_def)\n\n\n\nlemma pre_A1_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A1_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A1_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A1_inv_def) \n  apply(intro conjI impI)\n  apply(simp add:cR_step_def)\n  apply(cases \"pcR s\", simp_all) \n  apply(cases \" tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def) \n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas) apply metis\n  apply(simp) apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) diff_is_0_eq le0 nat_neq_iff zero_less_diff)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas) \n  apply (metis Nat.add_diff_assoc diff_diff_left diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(simp) apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis not_add_less1)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \" ownT s = Q \", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n  apply(simp add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas) apply metis\n  apply(simp) apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis diff_self_eq_0 le_antisym le_neq_implies_less length_greater_0_conv less_imp_Suc_add nat.distinct(1) plus_nat.add_0)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas) \n  apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n  apply(simp) apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis not_add_less1)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \" ownT s = Q \", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas) apply metis\n  apply(simp) apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_refl)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas) \n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp) apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) le_add_diff_inverse le_trans less_or_eq_imp_le linorder_neqE_nat nat_less_le)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \" ownT s = Q \", simp_all)\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas)\n  apply (metis le_antisym nat_less_le)\n  apply(simp) apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas) \n  apply (metis F.distinct(13) F.distinct(17) le_eq_less_or_eq)\n  apply(simp) apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_lemmas) \n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp) apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) le_add_diff_inverse le_trans less_or_eq_imp_le linorder_neqE_nat nat_less_le)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply (metis le_eq_less_or_eq nat_le_linear)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \" ownT s = Q \", simp_all)\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  by(case_tac \"q s = []\", simp_all)\n\nlemma pre_A2_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A2_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A2_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A2_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all) \n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all) \n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all) \n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def) \n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all) \n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all) \n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def) \n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply metis\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"q s = []\", simp_all)\n  apply metis\n  apply metis\n  apply metis\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply blast\n  by(simp_all add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n\n\nlemma pre_A3_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A3_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A3_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A3_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  by(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n\n\nlemma pre_A4_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A4_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A4_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A4_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply metis+\n  apply(case_tac \"q s=[]\", simp_all)\n  by metis+\n\n\nlemma pre_A5_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A5_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A5_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A5_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis le_add_diff_inverse le_trans)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n  \n\nlemma pre_A6_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A6_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A6_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A6_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis le_add_diff_inverse le_trans)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n\n\nlemma pre_A7_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A7_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A7_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A7_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis le_add_diff_inverse le_trans)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n\n\n\n\n\nlemma pre_A8_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A8_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A8_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A8_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all) \n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply metis\n  apply metis\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply metis\n  apply metis\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"q s=[]\", simp_all) \n  apply metis+\n  apply(case_tac \"q s=[]\", simp_all)\n  by metis+\n\n\nlemma pre_acquire_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_acquire_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_acquire_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_acquire_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply metis\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis eq_imp_le less_imp_le_nat linorder_neqE_nat plus_nat.add_0)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis eq_imp_le less_imp_le_nat linorder_neqE_nat plus_nat.add_0)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left diff_add_inverse2 le_0_eq le_antisym length_0_conv nat_less_le)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis not_add_less1)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\") \n  apply (metis add_cancel_left_left diff_is_0_eq' le_neq_implies_less length_greater_0_conv zero_less_diff)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas) \n  apply (metis le_add_diff_inverse le_imp_less_Suc length_greater_0_conv nat_less_le not_less_eq zero_less_diff)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis not_add_less1)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis less_or_eq_imp_le plus_nat.add_0)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis le_add_diff_inverse le_trans less_nat_zero_code less_or_eq_imp_le nat_less_le nat_neq_iff)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis (mono_tags, hide_lams) F.distinct(19))\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis plus_nat.add_0)\n  apply (metis le_add_diff_inverse le_trans less_nat_zero_code less_or_eq_imp_le nat_less_le nat_neq_iff)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis (mono_tags, hide_lams) F.distinct(19))\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n\nlemma pre_OOM_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_OOM_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_OOM_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_OOM_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all) \n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_lemmas)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp add:case_2_lemmas) apply(thin_tac \"\\<not>case_1 s\")\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all) \n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all) \n  apply blast\n  by(simp_all add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n\nlemma pre_finished_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_finished_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_finished_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_finished_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n\nlemma pre_BTS_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_BTS_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_BTS_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_BTS_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply blast\n  by(simp_all add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n \n\n\n\n\n(*******************************GLOBAL R_step preserves preW*************************************)\n\n\n\nlemma GLOBAL_R_step_shows_preW:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"pre_W (pcW s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(subgoal_tac \"pcW s' = pcW s\") prefer 2\n  using pcW_doesnt_change_with_R [where s=s and s'=s']\n  apply simp\n  apply(simp add:pre_W_def) apply(case_tac \"pcW s\") apply simp_all\n  using pre_A1_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A2_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A3_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A4_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A5_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A6_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A7_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A8_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_enqueue_doesnt_change_with_R [where s=s and s'=s'] apply simp \n  using pre_acquire_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_OOM_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_finished_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_write_doesnt_change_with_R [where s=s and s'=s'] apply simp  \n  using pre_BTS_doesnt_change_with_R [where s=s and s'=s'] by simp\n\n\n", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/RingBuffer_BD_latest_3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737214979746, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3279621193755871}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      StateSpace.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\<open>State Space Template\\<close>\ntheory StateSpace imports Hoare\nbegin\n\nrecord 'g state = \"globals\"::'g\n\ndefinition\n  upd_globals:: \"('g \\<Rightarrow> 'g) \\<Rightarrow> ('g,'z) state_scheme \\<Rightarrow> ('g,'z) state_scheme\"\nwhere\n  \"upd_globals upd s = s\\<lparr>globals := upd (globals s)\\<rparr>\" \n\nrecord ('g, 'n, 'val) stateSP = \"'g state\" +\n  locals :: \"'n \\<Rightarrow> 'val\"\n\nlemma upd_globals_conv: \"upd_globals f = (\\<lambda>s. s\\<lparr>globals := f (globals s)\\<rparr>)\"\n  by (rule ext) (simp add: upd_globals_def)\n\nend\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/StateSpace.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737214979745, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.32796211937558706}}
{"text": "(*\n * Copyright (C) 2014, National ICT Australia Limited. All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n *  * Redistributions of source code must retain the above copyright\n *    notice, this list of conditions and the following disclaimer.\n *\n *  * Redistributions in binary form must reproduce the above copyright\n *    notice, this list of conditions and the following disclaimer in the\n *    documentation and/or other materials provided with the distribution.\n *\n *  * The name of National ICT Australia Limited nor the names of its\n *    contributors may be used to endorse or promote products derived from\n *    this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS\n * IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED\n * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\n * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n *)\n\ntheory MoreDivides\nimports \"~~/src/HOL/Main\"\nbegin\n\n(* FIXME: to Isabelle lib *)\nlemma div_mult_le:\n  \"(a::nat) div b * b \\<le> a\"\napply(subgoal_tac \"a = a div b * b + a mod b\")\n apply arith\napply simp\ndone\n\n\n(* FIXME: to Isabelle lib *)\nlemma mod_le_dividend:\n  \"m mod n \\<le> (m::nat)\"\n  by (induct m) (auto simp: mod_Suc)\n\n(* diff_mod_le now also in Num_lemmas.ML *)\n(* FIXME: to Isabelle lib? *)\nlemma diff_mod_le:\n  \"\\<lbrakk> (a::nat) < d; b dvd d \\<rbrakk> \\<Longrightarrow> a - a mod b \\<le> d - b\"\napply(subst mult_div_cancel [symmetric])\napply(clarsimp simp: dvd_def)\napply(case_tac \"b = 0\")\n apply simp\napply(subgoal_tac \"a div b \\<le> k - 1\")\n prefer 2\n apply(subgoal_tac \"a div b < k\")\n  apply(simp add: less_Suc_eq_le [symmetric])\n apply(subgoal_tac \"b * (a div b) < b * ((b * k) div b)\")\n  apply clarsimp\n apply(subst div_mult_self1_is_m)\n  apply arith\n apply(rule le_less_trans)\n  apply simp\n  apply(subst mult.commute)\n  apply(rule div_mult_le)\n apply assumption\napply clarsimp\napply(subgoal_tac \"b * (a div b) \\<le> b * (k - 1)\")\n apply(erule le_trans)\n apply(simp add: diff_mult_distrib2)\napply simp\ndone\n\nlemma int_div_same_is_1 [simp]:\n    \"0 < a \\<Longrightarrow> ((a :: int) div b = a) = (b = 1)\"\n  by (metis div_by_1 abs_ge_zero abs_of_pos int_div_less_self neq_iff nonneg1_imp_zdiv_pos_iff zabs_less_one_iff)\n\nlemma nat_div_same_is_1 [simp]:\n    \"a \\<noteq> 0 \\<Longrightarrow> ((a :: nat) div b = a) = (b = 1)\"\n  by (metis div_by_0 div_by_1 div_le_dividend div_less_dividend div_self nat_less_le)\n\nlemma int_div_minus_is_minus1 [simp]:\n    \"a < 0 \\<Longrightarrow> ((a :: int) div b = -a) = (b = -1)\"\n  by (metis div_minus_right equation_minus_iff int_div_same_is_1 neg_0_less_iff_less)\n\nend\n", "meta": {"author": "jcaesar", "repo": "fixed-topos-header-space-analysis", "sha": "2da808ab41e5924d616ad1af15e8f50cb986c803", "save_path": "github-repos/isabelle/jcaesar-fixed-topos-header-space-analysis", "path": "github-repos/isabelle/jcaesar-fixed-topos-header-space-analysis/fixed-topos-header-space-analysis-2da808ab41e5924d616ad1af15e8f50cb986c803/thy/autocorres-0.98/lib/MoreDivides.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.6039318337259583, "lm_q1q2_score": 0.3278524180688652}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Extract_Conjunct\nimports\n  \"Main\"\n  \"Eisbach_Methods\"\nbegin\n\nsection \\<open>Extracting conjuncts in the conclusion\\<close>\n\ntext \\<open>\nMethods for extracting a conjunct from a nest of conjuncts in the conclusion\nof a goal, typically by pattern matching.\n\nWhen faced with a conclusion which is a big conjunction, it is often the case\nthat a small number of conjuncts require special attention, while the rest can\nbe solved easily by @{method clarsimp}, @{method auto} or similar. However,\nsometimes the method that would solve the bulk of the conjuncts would put some\nof the conjuncts into a more difficult or unsolvable state.\n\nThe higher-order methods defined here provide an efficient way to select a\nconjunct requiring special treatment, so that it can be dealt with first. Once\nall such conjuncts have been removed, the remaining conjuncts can all be solved\ntogether by some automated method.\n\nEach method takes an inner method as an argument, and selects the leftmost\nconjunct for which that inner method succeeds. The methods differ according to\nwhat they do with the selected conjunct. See below for more information and\nsome simple examples.\n\\<close>\n\ncontext begin\n\nsubsection \\<open>Focused conjunct with context\\<close>\n\ntext \\<open>\nWe define a predicate which allows us to identify a particular sub-tree and its\ncontext within a nest of conjunctions. We express this sub-tree-with-context using\na function which reconstructs the original nest of conjunctions. The context\nconsists of a list of parent contexts, where each parent context consists of a\nsibling sub-tree, and a tag indicating whether the focused sub-tree is on the left\nor right. Rebuilding the original tree works from the focused sub-tree up towards\nthe root of the original structure. This sub-tree-with-context is sometimes known\nas a zipper.\n\\<close>\n\nprivate fun focus_conj :: \"bool \\<Rightarrow> bool list \\<Rightarrow> bool\" where\n  \"focus_conj current [] = current\"\n| \"focus_conj current (sibling # parents) = focus_conj (current \\<and> sibling) parents\"\n\nprivate definition \"focus \\<equiv> focus_conj\"\n\nprivate definition \"tag t P \\<equiv> P\"\nprivate lemmas focus_defs = focus_def tag_def\n\nprivate abbreviation \"left \\<equiv> tag Left\"\nprivate abbreviation \"right \\<equiv> tag Right\"\n\nprivate lemma focus_example:\n  \"focus C [right B, left D, left E, right A] \\<longleftrightarrow> A \\<and> ((B \\<and> C) \\<and> D) \\<and> E\"\n  unfolding focus_defs by auto\n\nsubsection \\<open>Moving the focus\\<close>\n\ntext \\<open>\nWe now prove some rules which allow us to switch between focused and unfocused\nstructures, and to move the focus around. Some versions of these rules carry an\nextra conjunct @{term E} outside the structure. Once we find the conjunct we want,\nthis @{term E} allows to keep track of it while we reassemble the rest of the\noriginal structure.\n\nFirst, we have rules for going between focused and unfocused structures.\n\\<close>\n\nprivate lemma focus_top_iff: \"E \\<and> focus P [] \\<longleftrightarrow> E \\<and> P\"\n  unfolding focus_def by simp\n\nprivate lemmas to_focus = focus_top_iff[where E=True, simplified, THEN iffD1]\nprivate lemmas from_focusE = focus_top_iff[THEN iffD2]\nprivate lemmas from_focus = from_focusE[where E=True, simplified]\n\ntext \\<open>\nNext, we have rules for moving the focus to and from the left conjunct.\n\\<close>\n\nprivate lemma focus_left_iff: \"E \\<and> focus L (left R # P) \\<longleftrightarrow> E \\<and> focus (L \\<and> R) P\"\n  unfolding focus_defs by simp\n\nprivate lemmas focus_left = focus_left_iff[where E=True, simplified, THEN iffD1]\nprivate lemmas unfocusE_left = focus_left_iff[THEN iffD2]\nprivate lemmas unfocus_left = unfocusE_left[where E=True, simplified]\n\ntext \\<open>\nNext, we have rules for moving the focus to and from the right conjunct.\n\\<close>\n\nprivate lemma focus_right_iff: \"E \\<and> focus R (right L # P) \\<longleftrightarrow> E \\<and> focus (L \\<and> R) P\"\n  unfolding focus_defs using conj_commute by simp\n\nprivate lemmas focus_right = focus_right_iff[where E=True, simplified, THEN iffD1]\nprivate lemmas unfocusE_right = focus_right_iff[THEN iffD2]\nprivate lemmas unfocus_right = unfocusE_right[where E=True, simplified]\n\ntext \\<open>\nFinally, we have rules for extracting the current focus. The sibling of the\nextracted focus becomes the new focus of the remaining structure.\n\\<close>\n\nprivate lemma extract_focus_iff: \"focus C (tag t S # P) \\<longleftrightarrow> (C \\<and> focus S P)\"\n  unfolding focus_defs by (induct P arbitrary: S) auto\n\nprivate lemmas extract_focus = extract_focus_iff[THEN iffD2]\n\nsubsection \\<open>Primitive methods for navigating a conjunction\\<close>\n\ntext \\<open>\nUsing these rules as transitions, we implement a machine which navigates a tree\nof conjunctions, searching from left to right for a conjunct for which a given\nmethod will succeed. Once a matching conjunct is found, it is extracted, and the\nremaining conjuncts are reassembled.\n\\<close>\n\ntext \\<open>From the current focus, move to the leftmost sub-conjunct.\\<close>\nprivate method focus_leftmost = (intro focus_left)?\n\ntext \\<open>Find the furthest ancestor for which the current focus is still on the right.\\<close>\nprivate method unfocus_rightmost = (intro unfocus_right)?\n\ntext \\<open>Move to the immediate-right sibling.\\<close>\nprivate method focus_right_sibling = (rule unfocus_left, rule focus_right)\n\ntext \\<open>Move to the next conjunct in right-to-left ordering.\\<close>\nprivate method focus_next_conjunct = (unfocus_rightmost, focus_right_sibling, focus_leftmost)\n\ntext \\<open>Search from current focus toward the right until we find a matching conjunct.\\<close>\nprivate method find_match methods m = (rule extract_focus, m | focus_next_conjunct, find_match m)\n\ntext \\<open>Search within nest of conjuncts, leaving remaining structure focused.\\<close>\nprivate method extract_match methods m = (rule to_focus, focus_leftmost, find_match m)\n\ntext \\<open>Move all the way out of focus, keeping track of any extracted conjunct.\\<close>\nprivate method unfocusE = ((intro unfocusE_right unfocusE_left)?, rule from_focusE)\nprivate method unfocus = ((intro unfocus_right unfocus_left)?, rule from_focus)\n\nsubsection \\<open>Methods for selecting the leftmost matching conjunct\\<close>\n\ntext \\<open>\nSee the introduction at the top of this theory for motivation, and below for\nsome simple examples.\n\\<close>\n\ntext \\<open>\nAssuming the conclusion of the goal is a nest of conjunctions, method\n@{text lift_conjunct} finds the leftmost conjunct for which the given method\nsucceeds, and moves it to the front of the conjunction in the goal.\n\\<close>\nmethod lift_conjunct methods m = (extract_match \\<open>succeeds \\<open>rule conjI, m\\<close>\\<close>, unfocusE)\n\ntext \\<open>\nMethod @{text extract_conjunct} finds the leftmost conjunct for which the\ngiven method succeeds, and splits it into a fresh subgoal, leaving the remaining\nconjuncts untouched in the second subgoal. It is equivalent to @{method lift_conjunct}\nfollowed by @{method rule} @{thm conjI}.\n\\<close>\nmethod extract_conjunct methods m = (extract_match \\<open>rule conjI, succeeds m\\<close>; unfocus?)\n\ntext \\<open>\nMethod @{text apply_conjunct} finds the leftmost conjunct for which the given\nmethod succeeds, leaving any subgoals created by the application of that method,\nand a subgoal containing the remaining conjuncts untouched. It is equivalent to\n@{method extract_conjunct} followed by the given method, but more efficient.\n\\<close>\nmethod apply_conjunct methods m = (extract_match \\<open>rule conjI, m\\<close>; unfocus?)\n\nsubsection \\<open>Examples\\<close>\n\ntext \\<open>\nGiven an inner method based on @{method match}, which only succeeds on the desired\nconjunct @{term C}, @{method lift_conjunct} moves the conjunct @{term C} to the\nfront. The body of the @{method match} here is irrelevant, since @{method lift_conjunct}\nalways discards the effect of the method it is given.\n\\<close>\nlemma \"\\<lbrakk> A; B; \\<lbrakk> A; B; D; E \\<rbrakk> \\<Longrightarrow> C; D; E \\<rbrakk> \\<Longrightarrow> A \\<and> ((B \\<and> C) \\<and> D) \\<and> E\"\n  apply (lift_conjunct \\<open>match conclusion in C \\<Rightarrow> \\<open>-\\<close>\\<close>)\n  \\<comment> \\<open>@{term C} as been moved to the front of the conclusion.\\<close>\n  apply (match conclusion in \\<open>C \\<and> A \\<and> (B \\<and> D) \\<and> E\\<close> \\<Rightarrow> \\<open>-\\<close>)\n  oops\n\ntext \\<open>\nMethod @{method extract_conjunct} works similarly, but peels of the matched conjunct\nas a separate subgoal. As for @{method lift_conjunct}, the effect of the given method\nis discarded, so the body of the @{method match} is irrelevant.\n\\<close>\nlemma \"\\<lbrakk> A; B; \\<lbrakk> A; B; D; E \\<rbrakk> \\<Longrightarrow> C; D; E \\<rbrakk> \\<Longrightarrow> A \\<and> ((B \\<and> C) \\<and> D) \\<and> E\"\n  apply (extract_conjunct \\<open>match conclusion in C \\<Rightarrow> \\<open>-\\<close>\\<close>)\n  \\<comment> \\<open>@{method extract_conjunct} gives us the matched conjunct @{term C} as a separate subgoal.\\<close>\n   apply (match conclusion in C \\<Rightarrow> \\<open>-\\<close>)\n   apply blast\n  \\<comment> \\<open>The other subgoal contains the remaining conjuncts untouched.\\<close>\n  apply (match conclusion in \\<open>A \\<and> (B \\<and> D) \\<and> E\\<close> \\<Rightarrow> \\<open>-\\<close>)\n  oops\n\ntext \\<open>\nMethod @{method apply_conjunct} goes one step further, and applies the given method\nto the extracted subgoal.\n\\<close>\nlemma \"\\<lbrakk> A; B; \\<lbrakk> A; B; D; E \\<rbrakk> \\<Longrightarrow> C; D; E \\<rbrakk> \\<Longrightarrow> A \\<and> ((B \\<and> C) \\<and> D) \\<and> E\"\n  apply (apply_conjunct \\<open>match conclusion in C \\<Rightarrow> \\<open>match premises in H: _ \\<Rightarrow> \\<open>rule H\\<close>\\<close>\\<close>)\n  \\<comment> \\<open>We get four subgoals from applying the given method to the matched conjunct @{term C}.\\<close>\n      apply (match premises in H: A \\<Rightarrow> \\<open>rule H\\<close>)\n     apply (match premises in H: B \\<Rightarrow> \\<open>rule H\\<close>)\n    apply (match premises in H: D \\<Rightarrow> \\<open>rule H\\<close>)\n   apply (match premises in H: E \\<Rightarrow> \\<open>rule H\\<close>)\n  \\<comment> \\<open>The last subgoal contains the remaining conjuncts untouched.\\<close>\n  apply (match conclusion in \\<open>A \\<and> (B \\<and> D) \\<and> E\\<close> \\<Rightarrow> \\<open>-\\<close>)\n  oops\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/Extract_Conjunct.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.640635854839898, "lm_q1q2_score": 0.32782400449042315}}
{"text": "section {*I\\_kparser\\_base*}\ntheory\n  I_kparser_base\n\nimports\n  PRJ_08__ENTRY\n\nbegin\n\nrecord ('stack, 'event) parser_step_label =\n  rule_lpop :: \"'stack list\"\n  rule_rpop :: \"'event list\"\n  rule_lpush :: \"'stack list\"\n  rule_rpush :: \"'event list\"\n\nrecord ('stack, 'event, 'marker) parser =\n  parser_nonterms :: \"'stack set\"\n  parser_events :: \"'event set\"\n  parser_initial :: \"'stack\"\n  parser_marking :: \"'stack set\"\n  parser_rules :: \"('stack, 'event) parser_step_label set\"\n  parser_marker :: \"('stack, 'event) parser_step_label \\<Rightarrow> 'marker\"\n  parser_bottom :: \"'event\"\n\ndefinition valid_parser_step_label :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> ('stack, 'event) parser_step_label\n  \\<Rightarrow> bool\"\n  where\n    \"valid_parser_step_label G e \\<equiv>\n  (\\<exists>k. rule_rpop e \\<in> (kPrefix k) `\n    {w @ [parser_bottom G] | w.\n      set w \\<subseteq> parser_events G - {parser_bottom G}})\n  \\<and> set (rule_rpush e) \\<subseteq> parser_events G\n  \\<and> set (rule_lpop e) \\<subseteq> parser_nonterms G\n  \\<and> set (rule_lpush e) \\<subseteq> parser_nonterms G\n  \\<and> rule_lpop e \\<noteq> []\n  \\<and> rule_lpush e \\<noteq> []\n  \\<and> (\\<exists>x. x @ rule_rpush e = rule_rpop e)\n  \\<and> ((\\<exists>x. x @ [parser_bottom G] = rule_rpop e)\n      \\<longrightarrow> (\\<exists>x. x @ [parser_bottom G] = rule_rpush e))\"\n\nlemma kPrefix_vs_take: \"\n  kPrefix k w = take k w\"\n  apply(simp add: kPrefix_def)\n  done\n\ndefinition valid_parser :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"valid_parser G \\<equiv>\n  finite (parser_events G)\n  \\<and> finite (parser_nonterms G)\n  \\<and> parser_initial G \\<in> parser_nonterms G\n  \\<and> parser_marking G \\<subseteq> parser_nonterms G\n  \\<and> finite (parser_rules G)\n  \\<and> (\\<forall>e \\<in> parser_rules G.\n      valid_parser_step_label G e)\n  \\<and> parser_bottom G \\<in> parser_events G\"\n\ndefinition parser_step_labels :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> ('stack, 'event) parser_step_label set\"\n  where\n    \"parser_step_labels G \\<equiv>\n  parser_rules G\"\n\ndatatype ('stack, 'event) parser_destinations =\n  state \"'stack\"\n  | rule \"('stack, 'event) parser_step_label\"\n\ndefinition parser_destinations :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> ('stack, 'event) parser_destinations set\"\n  where\n    \"parser_destinations G \\<equiv>\n  state ` (parser_nonterms G)\n  \\<union> rule ` (parser_rules G)\"\n\ndefinition parser_markers :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list set\"\n  where\n    \"parser_markers G \\<equiv>\n  {w. set w \\<subseteq> parser_events G}\"\n\ndefinition parser_schedulers :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list set\"\n  where\n    \"parser_schedulers G \\<equiv>\n  {w. \\<exists>v.\n    set v \\<subseteq> parser_events G\n    \\<and> parser_bottom G \\<notin> set v\n    \\<and> w = v @ [parser_bottom G]}\"\n\ndefinition parser_fixed_schedulers :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list set\"\n  where\n    \"parser_fixed_schedulers G \\<equiv>\n  prefix_closure (parser_schedulers G)\"\n\ndefinition parser_unfixed_schedulers :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list set\"\n  where\n    \"parser_unfixed_schedulers G \\<equiv>\n  suffix_closure (parser_schedulers G)\"\n\ndefinition parser_scheduler_fragments :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list set\"\n  where\n    \"parser_scheduler_fragments G \\<equiv>\n  {w. set w \\<subseteq> parser_events G \\<and> parser_bottom G \\<notin> set w}\"\n\ndefinition parser_no_top_rules :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"parser_no_top_rules G \\<equiv>\n  \\<forall>e \\<in> parser_rules G. rule_rpush e = []\"\n\ndefinition parser_observes_input_terminator :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"parser_observes_input_terminator G \\<equiv>\n  \\<exists>e \\<in> parser_rules G. parser_bottom G \\<in> set (rule_rpop e)\"\n\ndefinition parser_not_observes_input_terminator :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"parser_not_observes_input_terminator G \\<equiv>\n  \\<forall>e \\<in> parser_rules G. parser_bottom G \\<notin> set (rule_rpush e)\"\n\ndefinition parser_no_access_final_with_read :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"parser_no_access_final_with_read G \\<equiv>\n  \\<forall>e \\<in> parser_rules G. \\<forall>a.\n  rule_rpop e = [a]\n  \\<and> rule_rpush e = []\n  \\<and> last (rule_lpush e) \\<in> parser_marking G\n  \\<longrightarrow> False\"\n\ndefinition parser_no_leave_final_with_empty_step :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"parser_no_leave_final_with_empty_step G \\<equiv>\n  \\<forall>q \\<in> parser_marking G.\n  \\<forall>e \\<in> parser_rules G.\n  last (rule_lpop e) = q\n  \\<and> rule_rpop e \\<in> {[parser_bottom G], []}\n  \\<longrightarrow> last (rule_lpush e) \\<in> parser_marking G\"\n\nprimrec tau :: \"\n  ('a \\<Rightarrow> 'b option option)\n  \\<Rightarrow> 'a option list\n  \\<Rightarrow> 'b option list\"\n  where\n    \"tau f [] = []\"\n  | \"tau f (a # w) =\n  (case a\n  of None \\<Rightarrow> []\n  | Some a' \\<Rightarrow> (case (f a')\n                of None \\<Rightarrow> []\n                | Some a'' \\<Rightarrow> (case a''\n                              of None \\<Rightarrow> []\n                              | Some a''' \\<Rightarrow> [Some a'''])))\n  @ tau f w\"\n\nlemma tau_select: \"\n  x \\<in> set (tau f w)\n  \\<Longrightarrow> (\\<exists>y. x \\<in> set (tau f [y]) \\<and> y \\<in> set w)\"\n  apply(induct w)\n   apply(clarsimp)\n  apply(rename_tac a w)(*strict*)\n  apply(clarsimp)\n  apply(erule disjE)\n   apply(rename_tac a w)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac w uu_ uua_)(*strict*)\n   apply(rename_tac x1 x2)\n   apply(rename_tac w x1 x2)(*strict*)\n   apply(rule_tac\n      x=\"Some x2\"\n      in exI)\n   apply(clarsimp)\n  apply(rename_tac a w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a w uu_ uua_)(*strict*)\n  apply(rename_tac x1 x2)\n  apply(rename_tac a w x1 x2)(*strict*)\n  apply(rule_tac\n      x=\"Some x2\"\n      in exI)\n  apply(clarsimp)\n  done\n\ndefinition valid_bounded_parser :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> nat\n  \\<Rightarrow> bool\"\n  where\n    \"valid_bounded_parser G k \\<equiv>\n  valid_parser G\n  \\<and> (\\<forall>e \\<in> parser_rules G. length (rule_rpop e) \\<le> k)\"\n\nlemma valid_parser_initial_in_nonterms: \"\n  valid_parser P\n  \\<Longrightarrow> parser_initial P \\<in> parser_nonterms P\"\n  apply(simp add: valid_parser_def)\n  done\n\nlemma valid_parser_bottom_in_parser_events: \"\n  valid_parser P\n  \\<Longrightarrow> parser_bottom P \\<in> parser_events P\"\n  apply(simp add: valid_parser_def)\n  done\n\nlemma valid_parser_step_label_not_parser_bottom_random_insertion: \"\n  valid_parser_step_label G e\n  \\<Longrightarrow> (\\<exists>x. x@[parser_bottom G]=rule_rpush e) \\<longrightarrow> (\\<exists>x. x@[parser_bottom G]=rule_rpop e)\"\n  apply(simp add: valid_parser_step_label_def)\n  apply(erule conjE)+\n  apply(rule impI)\n  apply(erule exE)+\n  apply(rename_tac k x xa)(*strict*)\n  apply(rule_tac\n      x=\"x@xa\"\n      in exI)\n  apply(force)\n  done\n\nlemma valid_parser_step_label_also_req_for_rpush: \"\n  valid_parser_step_label G e\n  \\<Longrightarrow> (\\<exists>k. rule_rpush e \\<in> ((kPrefix k) ` ({w@[parser_bottom G]|w. set w\\<subseteq> (parser_events G)-{parser_bottom G}})))\"\n  apply(simp add: valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac k w xa)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac k w xa rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k w xa rule_lpop rule_lpush rule_rpush)(*strict*)\n  apply(simp add: kPrefix_def)\n  apply(case_tac \"k-length w>0\")\n   apply(rename_tac k w xa rule_lpop rule_lpush rule_rpush)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac k xa rule_lpop rule_lpush x)(*strict*)\n   apply(rule_tac\n      x=\"Suc (length x)\"\n      in exI)\n   apply(rule inMap)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"x@[parser_bottom G]\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: kPrefix_def)\n  apply(rename_tac k w xa rule_lpop rule_lpush rule_rpush)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"rule_rpush\")\n   apply(rename_tac k w xa rule_lpop rule_lpush rule_rpush)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac k w rule_lpop rule_lpush)(*strict*)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule inMap)\n   apply(rule_tac\n      x=\"[parser_bottom G]\"\n      in bexI)\n    apply(rename_tac k w rule_lpop rule_lpush)(*strict*)\n    apply(simp add: kPrefix_def)\n   apply(rename_tac k w rule_lpop rule_lpush)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac k w xa rule_lpop rule_lpush rule_rpush a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. rule_rpush = w' @ [x']\")\n   apply(rename_tac k w xa rule_lpop rule_lpush rule_rpush a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac k w xa rule_lpop rule_lpush rule_rpush a list)(*strict*)\n  apply(thin_tac \"rule_rpush = a # list\")\n  apply(clarsimp)\n  apply(rename_tac k w xa rule_lpop rule_lpush w' x')(*strict*)\n  apply(case_tac \"x'=parser_bottom G\")\n   apply(rename_tac k w xa rule_lpop rule_lpush w' x')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac k w xa rule_lpop rule_lpush w')(*strict*)\n   apply(rule_tac\n      x=\"Suc(length w')\"\n      in exI)\n   apply(rule inMap)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"w' @ [parser_bottom G]\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: kPrefix_def)\n   apply(rule_tac\n      B=\"set w\"\n      in subset_trans)\n    apply(rename_tac k w xa rule_lpop rule_lpush w')(*strict*)\n    apply(rule_tac\n      B=\"set (take k w)\"\n      in subset_trans)\n     apply(rename_tac k w xa rule_lpop rule_lpush w')(*strict*)\n     apply(rule_tac\n      B=\"set (xa @ w' @ [parser_bottom G])\"\n      in subset_trans)\n      apply(rename_tac k w xa rule_lpop rule_lpush w')(*strict*)\n      apply(rule set_bi_append)\n     apply(rename_tac k w xa rule_lpop rule_lpush w')(*strict*)\n     apply(force)\n    apply(rename_tac k w xa rule_lpop rule_lpush w')(*strict*)\n    apply(rule set_take_subset)\n   apply(rename_tac k w xa rule_lpop rule_lpush w')(*strict*)\n   apply(force)\n  apply(rename_tac k w xa rule_lpop rule_lpush w' x')(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"Suc(length w')\"\n      in exI)\n  apply(rule inMap)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"w' @ [x'] @ [parser_bottom G]\"\n      in exI)\n  apply(clarsimp)\n  apply(simp add: kPrefix_def)\n  apply(rule_tac\n      B=\"set w\"\n      in subset_trans)\n   apply(rename_tac k w xa rule_lpop rule_lpush w' x')(*strict*)\n   apply(rule_tac\n      B=\"set (take k w)\"\n      in subset_trans)\n    apply(rename_tac k w xa rule_lpop rule_lpush w' x')(*strict*)\n    apply(rule_tac\n      B=\"set (xa @ w' @ [x'])\"\n      in subset_trans)\n     apply(rename_tac k w xa rule_lpop rule_lpush w' x')(*strict*)\n     apply(rule set_bi_append)\n    apply(rename_tac k w xa rule_lpop rule_lpush w' x')(*strict*)\n    apply(force)\n   apply(rename_tac k w xa rule_lpop rule_lpush w' x')(*strict*)\n   apply(rule set_take_subset)\n  apply(rename_tac k w xa rule_lpop rule_lpush w' x')(*strict*)\n  apply(force)\n  done\n\nlemma tau_append_commutes: \"\n  tau f (w@v) = tau f w @ (tau f v)\"\n  apply(induct w)\n   apply(clarsimp)\n  apply(rename_tac a w)(*strict*)\n  apply(clarsimp)\n  done\n\nprimrec parser_fixed_input_length_recN :: \"\n  (('stack, 'event) parser_step_label, 'abstr_parser_conf)derivation\n  \\<Rightarrow> nat\n  \\<Rightarrow> nat\"\n  where\n    \"parser_fixed_input_length_recN d 0 = 0\"\n  | \"parser_fixed_input_length_recN d (Suc n) =\n    (case d (Suc n) of\n      Some (pair (Some e) c) \\<Rightarrow>\n          max\n            (parser_fixed_input_length_recN d n)\n            (length (rule_rpop e))\n          - (length (rule_rpop e) - length (rule_rpush e))\n    | _ \\<Rightarrow> parser_fixed_input_length_recN d n)\"\n\ndefinition parser_fixed_input_length_foldl :: \"\n  (('stack, 'event) parser_step_label, 'abstr_parser_conf)derivation\n  \\<Rightarrow> nat\n  \\<Rightarrow> nat\"\n  where\n    \"parser_fixed_input_length_foldl d n \\<equiv>\n  foldl\n    (\\<lambda>x s. (case s of [a, b] \\<Rightarrow> (max x a) - (a - b)))\n    0\n    (map\n      (\\<lambda>n.\n        case d n of\n          Some (pair (Some e) c) \\<Rightarrow>\n            [length (rule_rpop e), length (rule_rpush e)])\n      (nat_seq (Suc 0) n))\"\n\nprimrec parser_fixed_input_length_rec1 :: \"\n  (('stack, 'event) parser_step_label, 'abstr_parser_conf)derivation\n  \\<Rightarrow> nat\n  \\<Rightarrow> nat\"\n  where\n    \"parser_fixed_input_length_rec1 d 0 = 0\"\n  | \"(parser_fixed_input_length_rec1 d (Suc n)) =\n    (case d (Suc n) of\n      Some (pair (Some e) c) \\<Rightarrow>\n        (case rule_rpop e of\n            [] \\<Rightarrow> parser_fixed_input_length_rec1 d n\n            | _ \\<Rightarrow> length (rule_rpush e))\n      | _ \\<Rightarrow> parser_fixed_input_length_rec1 d n)\"\n\n(*\n  The unmarked language should be contained in the prefixclosure of the set of words which (if the parser is started with one of them) can touch every every DT_symbol.\n  Furthermore, an element of this prefixclosure is only contained, if\n\n  r·s in unmarked_language\n  \\<longleftrightarrow> \\<exists>d t. d start with r·s·t·$ and ends with s·t·$ where s (and (if t=\\<lambda>) possibly $) has been seen and t has not been seen\n  \\<longleftrightarrow> \\<exists>d. d start with r·s·$ and ends with s·$ where s (and possibly $) has been seen\n\n  Note, the translation of a parser into a topfree parser should preserve marked and unmarked language.\n  Therefore the interpretation is reasonable.\n\n  Example:\n  derivation: q0 | ab$ \\<Rightarrow> (q0, ab$, q1, $) \\<Rightarrow> q1|$\n  unmarked_language_element: i=0: \\<lambda>\n  unmarked_language_element: i=1: ab\n  derivation: q0 | ab$ \\<Rightarrow> (q0, ab, q1, b) \\<Rightarrow> q1|b$\n  unmarked_language_element: i=0: \\<lambda>\n  unmarked_language_element: i=1: ab\n  derivation: q0 | ab$ \\<Rightarrow> (q0, a, q1, \\<lambda>) \\<Rightarrow> q1|b$\n  unmarked_language_element: i=0: \\<lambda>\n  unmarked_language_element: i=1: a\n*)\n\nlemma parser_inst_AX_empty_fixed_scheduler_in_fixed_schedulers: \"\n  \\<forall>G. valid_parser G \\<longrightarrow> [] \\<in> parser_fixed_schedulers G\"\n  apply(simp add: parser_fixed_schedulers_def prefix_closure_def prefix_def parser_schedulers_def)\n  apply(clarsimp)\n  apply(rename_tac G)(*strict*)\n  apply(rule_tac\n      x=\"[]\"\n      in exI)\n  apply(force)\n  done\n\nlemma parser_inst_AX_empty_scheduler_fragment_in_scheduler_fragments: \"\n  \\<forall>G. valid_parser G \\<longrightarrow> [] \\<in> parser_scheduler_fragments G\"\n  apply(simp add: parser_scheduler_fragments_def)\n  done\n\nlemma parser_inst_AX_join_scheduler_fragments_closed : \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>sE1. sE1 \\<in> parser_scheduler_fragments G \\<longrightarrow> (\\<forall>sE2. sE2 \\<in> parser_scheduler_fragments G \\<longrightarrow> sE1 @ sE2 \\<in> parser_scheduler_fragments G)))\"\n  apply(simp add: parser_scheduler_fragments_def)\n  done\n\nlemma parser_inst_AX_join_scheduler_fragments_foldl_split: \"\n  (\\<forall>w v. foldl (@) (foldl (@) [] w) v = foldl (@) [] w @ foldl (@) [] v)\"\n  apply (metis concat_conv_foldl foldl_conv_concat)\n  done\n\nlemma parser_inst_AX_foldl_join_scheduler_fragments : \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>sE. sE \\<in> parser_scheduler_fragments G \\<longrightarrow> (\\<forall>w. set w \\<subseteq> parser_scheduler_fragments G \\<longrightarrow> foldl (@) sE w = sE @ foldl (@) [] w)))\"\n  apply(clarsimp)\n  apply(rename_tac G sE w)(*strict*)\n  apply (metis concat_conv_foldl foldl_conv_concat)\n  done\n\nlemma parser_inst_AX_extend_unfixed_scheduler_unfixed_scheduler_right_quotient_empty: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>sUF. sUF \\<in> parser_unfixed_schedulers G \\<longrightarrow> the (right_quotient_word sUF []) = sUF))\"\n  apply(simp add: right_quotient_word_def)\n  done\n\nlemma parser_inst_AX_unfixed_scheduler_right_quotient_all: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>sUF. sUF \\<in> parser_unfixed_schedulers G \\<longrightarrow> right_quotient_word sUF sUF = Some []))\"\n  apply(clarsimp)\n  apply(rename_tac G sUF)(*strict*)\n  apply(simp add: right_quotient_word_def)\n  done\n\nlemma parser_inst_AX_empty_unfixed_scheduler_in_unfixed_schedulers: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> [] \\<in> parser_unfixed_schedulers G)\"\n  apply(simp add: parser_unfixed_schedulers_def suffix_closure_def suffix_def parser_schedulers_def)\n  apply(clarsimp)\n  apply(rename_tac G)(*strict*)\n  apply(rule_tac\n      x=\"[]\"\n      in exI)\n  apply(force)\n  done\n\nlemma parser_inst_AX_extend_unfixed_scheduler_closed: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>sE. sE \\<in> parser_scheduler_fragments G \\<longrightarrow> (\\<forall>sUF. sUF \\<in> parser_unfixed_schedulers G \\<longrightarrow> sUF \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> sE @ sUF \\<in> parser_unfixed_schedulers G)))\"\n  apply(simp add: suffix_def parser_unfixed_schedulers_def parser_scheduler_fragments_def parser_schedulers_def suffix_closure_def)\n  apply(clarsimp)\n  apply(rename_tac G sE c ca)(*strict*)\n  apply(rule_tac\n      x=\"sE@ca@[parser_bottom G]\"\n      in exI)\n  apply(clarsimp)\n  done\n\nlemma parser_inst_AX_extend_scheduler_closed: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>sE. sE \\<in> parser_scheduler_fragments G \\<longrightarrow> (\\<forall>s. s \\<in> parser_schedulers G \\<longrightarrow> sE @ s \\<in> parser_schedulers G)))\"\n  apply(clarsimp)\n  apply(rename_tac G sE s)(*strict*)\n  apply(simp add: parser_schedulers_def parser_scheduler_fragments_def)\n  apply(clarsimp)\n  done\n\nlemma parser_inst_AX_extend_unfixed_scheduler_preserves_unfixed_scheduler_extendable: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>sUF. sUF \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> (\\<forall>sE. (sE @ sUF) \\<sqsupseteq> [parser_bottom G])))\"\n  apply(clarsimp)\n  apply(rename_tac G sUF sE)(*strict*)\n  apply(simp add: suffix_def)\n  apply(force)\n  done\n\nlemma parser_inst_AX_empty_scheduler_in_schedulers: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> [parser_bottom G] \\<in> parser_schedulers G)\"\n  apply(simp add: parser_schedulers_def)\n  done\n\nlemma parser_inst_AX_join_fixed_scheduler_unfixed_scheduler_closed: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>sF. sF \\<in> parser_fixed_schedulers G \\<longrightarrow> (\\<forall>sUF. sUF \\<in> parser_unfixed_schedulers G \\<longrightarrow> (\\<not> sF \\<sqsupseteq> [parser_bottom G]) = sUF \\<sqsupseteq> [parser_bottom G] \\<longrightarrow> sF @ sUF \\<in> parser_schedulers G)))\"\n  apply(clarsimp)\n  apply(rename_tac G sF sUF)(*strict*)\n  apply(simp add: suffix_def)\n  apply(simp add: parser_schedulers_def parser_fixed_schedulers_def parser_unfixed_schedulers_def prefix_closure_def prefix_def suffix_closure_def suffix_def)\n  apply(clarsimp)\n  apply(rename_tac G sF sUF vb c vc ca)(*strict*)\n  apply(case_tac sUF)\n   apply(rename_tac G sF sUF vb c vc ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G vb c vc cb)(*strict*)\n   apply(case_tac c)\n    apply(rename_tac G vb c vc cb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G vb c vc cb a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n    apply(rename_tac G vb c vc cb a list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac G vb c vc cb a list)(*strict*)\n   apply(thin_tac \"c = a # list\")\n   apply(clarsimp)\n  apply(rename_tac G sF sUF vb c vc ca a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. sUF = w' @ [x']\")\n   apply(rename_tac G sF sUF vb c vc ca a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G sF sUF vb c vc ca a list)(*strict*)\n  apply(thin_tac \"sUF = a # list\")\n  apply(clarsimp)\n  apply(rename_tac G sF vb c ca w')(*strict*)\n  apply(case_tac c)\n   apply(rename_tac G sF vb c ca w')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G sF vb c ca w' a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n   apply(rename_tac G sF vb c ca w' a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G sF vb c ca w' a list)(*strict*)\n  apply(thin_tac \"c = a # list\")\n  apply(clarsimp)\n  done\n\nlemma valid_bounded_parser_vs_valid_parser: \"\n  valid_bounded_parser G k\n  \\<Longrightarrow> valid_parser G\"\n  apply(simp add: valid_bounded_parser_def)\n  done\n\nlemma parser1X_inst_AX_empty_fixed_scheduler_in_fixed_schedulers: \"\n  \\<forall>G. valid_bounded_parser G (Suc 0) \\<longrightarrow> [] \\<in> parser_fixed_schedulers G\"\n  apply(metis valid_bounded_parser_vs_valid_parser parser_inst_AX_empty_fixed_scheduler_in_fixed_schedulers)\n  done\n\nlemma parser_inst_AX_fixed_scheduler_extendable_vs_unfixed_scheduler_extendable: \"\n  (\\<forall>G. valid_parser G \\<longrightarrow> (\\<forall>sF. sF \\<in> parser_fixed_schedulers G \\<longrightarrow> (\\<forall>sUF. sUF \\<in> parser_unfixed_schedulers G \\<longrightarrow> sF @ sUF \\<in> parser_schedulers G \\<longrightarrow> (\\<not> sF \\<sqsupseteq> [parser_bottom G]) = sUF \\<sqsupseteq> [parser_bottom G])))\"\n  apply(clarsimp)\n  apply(rename_tac G sF sUF)(*strict*)\n  apply(simp add: suffix_closure_def prefix_closure_def prefix_def suffix_def parser_schedulers_def parser_fixed_schedulers_def parser_unfixed_schedulers_def)\n  apply(clarsimp)\n  apply(rename_tac G sF sUF vb vc c vd ca)(*strict*)\n  apply(case_tac sF)\n   apply(rename_tac G sF sUF vb vc c vd ca)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G sF sUF vb vc c vd ca a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. sF = w' @ [x']\")\n   apply(rename_tac G sF sUF vb vc c vd ca a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G sF sUF vb vc c vd ca a list)(*strict*)\n  apply(thin_tac \"sF = a # list\")\n  apply(clarsimp)\n  apply(rename_tac G sUF vb vc c vd ca w' x')(*strict*)\n  apply(case_tac c)\n   apply(rename_tac G sUF vb vc c vd ca w' x')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G sUF vb vc c vd ca w' x' a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. c = w' @ [x']\")\n   apply(rename_tac G sUF vb vc c vd ca w' x' a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac G sUF vb vc c vd ca w' x' a list)(*strict*)\n  apply(thin_tac \"c = a # list\")\n  apply(clarsimp)\n  apply(rename_tac G sUF vb vd ca w' x' w'a)(*strict*)\n  apply(metis last_append last_snoc snoc_eq_iff_butlast)\n  done\n\nlemma valid_parser_rules_rhs_gets_shorter: \"\n  valid_parser P\n  \\<Longrightarrow> e \\<in> parser_rules P\n  \\<Longrightarrow> length (rule_rpush e) \\<le> length (rule_rpop e)\"\n  apply(simp add: valid_parser_def)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"e\"\n      in ballE)\n   apply(auto)\n  apply(simp add: valid_parser_step_label_def)\n  apply(clarsimp)\n  apply(rename_tac k w xa)(*strict*)\n  apply(rule_tac\n      t=\"kPrefix k (w @ [parser_bottom P])\"\n      and s=\"xa @ rule_rpush e\"\n      in ssubst)\n   apply(rename_tac k w xa)(*strict*)\n   apply(force)\n  apply(rename_tac k w xa)(*strict*)\n  apply(simp (no_asm_use))\n  done\n\ndefinition parser_empty_fixed_scheduler :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list\"\n  where\n    \"parser_empty_fixed_scheduler G \\<equiv>\n  []\"\ndeclare parser_empty_fixed_scheduler_def [simp add]\n\ndefinition parser_empty_unfixed_scheduler :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list\"\n  where\n    \"parser_empty_unfixed_scheduler G \\<equiv>\n  []\"\ndeclare parser_empty_unfixed_scheduler_def [simp add]\n\ndefinition parser_fixed_scheduler_extendable :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> bool\"\n  where\n    \"parser_fixed_scheduler_extendable G w \\<equiv>\n  \\<not> suffix w [parser_bottom G]\"\ndeclare parser_fixed_scheduler_extendable_def [simp add]\n\ndefinition parser_unfixed_scheduler_extendable :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> bool\"\n  where\n    \"parser_unfixed_scheduler_extendable G w \\<equiv>\n  suffix w [parser_bottom G]\"\ndeclare parser_unfixed_scheduler_extendable_def [simp add]\n\ndefinition parser_empty_history :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list\"\n  where\n    \"parser_empty_history G \\<equiv>\n  []\"\ndeclare parser_empty_history_def [simp add]\n\ndefinition parser_empty_history_fragment :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list\"\n  where\n    \"parser_empty_history_fragment G \\<equiv>\n  []\"\ndeclare parser_empty_history_fragment_def [simp add]\n\ndefinition parser_empty_scheduler :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list\"\n  where\n    \"parser_empty_scheduler G \\<equiv>\n  [parser_bottom G]\"\ndeclare parser_empty_scheduler_def [simp add]\n\ndefinition parser_empty_scheduler_fragment :: \"\n  ('stack, 'event, 'marker) parser\n  \\<Rightarrow> 'event list\"\n  where\n    \"parser_empty_scheduler_fragment G \\<equiv>\n  []\"\ndeclare parser_empty_scheduler_fragment_def [simp add]\n\nlemma parser_inst_ATS_SchedF_Basic_axioms: \"\n  ATS_SchedF_Basic_axioms valid_parser parser_fixed_schedulers\n     parser_empty_fixed_scheduler\"\n  apply(simp add: ATS_SchedF_Basic_axioms_def)\n  apply(simp add: parser_inst_AX_empty_fixed_scheduler_in_fixed_schedulers )\n  done\n\nlemma parser_inst_ATS_Scheduler_Fragment_axioms: \"\n  ATS_Scheduler_Fragment_axioms valid_parser parser_scheduler_fragments\n     parser_empty_scheduler_fragment (@)\"\n  apply(simp add: ATS_Scheduler_Fragment_axioms_def)\n  apply(simp add: parser_inst_AX_join_scheduler_fragments_closed parser_inst_AX_join_scheduler_fragments_foldl_split parser_inst_AX_empty_scheduler_fragment_in_scheduler_fragments )\n  apply(simp add: parser_inst_AX_foldl_join_scheduler_fragments)\n  done\n\nlemma parser_inst_ATS_SchedUF_Basic_axioms: \"\n  ATS_SchedUF_Basic_axioms valid_parser parser_scheduler_fragments\n     parser_empty_scheduler_fragment parser_unfixed_schedulers\n     parser_empty_unfixed_scheduler right_quotient_word (@)\n     parser_unfixed_scheduler_extendable\"\n  apply(simp add: ATS_SchedUF_Basic_axioms_def)\n  apply(simp add: parser_inst_AX_extend_unfixed_scheduler_preserves_unfixed_scheduler_extendable parser_inst_AX_extend_unfixed_scheduler_unfixed_scheduler_right_quotient_empty parser_inst_AX_unfixed_scheduler_right_quotient_all parser_inst_AX_empty_unfixed_scheduler_in_unfixed_schedulers parser_inst_AX_extend_unfixed_scheduler_closed )\n  done\n\nlemma parser_inst_ATS_Sched_Basic_axioms: \"\n  ATS_Sched_Basic_axioms valid_parser parser_fixed_schedulers\n     parser_fixed_scheduler_extendable parser_unfixed_schedulers\n     parser_unfixed_scheduler_extendable parser_schedulers (@)\"\n  apply(simp add: ATS_Sched_Basic_axioms_def)\n  apply(simp add: parser_inst_AX_join_fixed_scheduler_unfixed_scheduler_closed )\n  done\n\nlemmas parser_interpretations =\n  parser_inst_ATS_SchedF_Basic_axioms\n  parser_inst_ATS_Sched_Basic_axioms\n  parser_inst_ATS_Scheduler_Fragment_axioms\n  parser_inst_ATS_SchedUF_Basic_axioms\n\nlemma PARSER_rule_rpop_in_parser_events: \"\n  valid_parser G\n  \\<Longrightarrow> e \\<in> parser_rules G\n  \\<Longrightarrow> set (rule_rpop e) \\<subseteq> parser_events G\"\n  apply(simp add: valid_parser_def valid_parser_step_label_def kPrefix_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule_tac\n      x=\"e\"\n      in ballE)\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x k w xb)(*strict*)\n  apply(simp add: valid_parser_def valid_parser_step_label_def kPrefix_def)\n  apply(erule disjE)\n   apply(rename_tac x k w xb)(*strict*)\n   apply(rule_tac\n      A=\"set w\"\n      in set_mp)\n    apply(rename_tac x k w xb)(*strict*)\n    apply(force)\n   apply(rename_tac x k w xb)(*strict*)\n   apply (metis in_set_takeD)\n  apply(rename_tac x k w xb)(*strict*)\n  apply(case_tac \"k-length w\")\n   apply(rename_tac x k w xb)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x k w xb nat)(*strict*)\n  apply(clarsimp)\n  done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_08/I_kparser_base.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544085240401, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.3278039123431482}}
{"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\<open>Representable and corepresentable functors\\<close>\ntheory CZH_UCAT_Representable\n  imports\n    CZH_Elementary_Categories.CZH_ECAT_Yoneda\n    CZH_UCAT_Pointed\n    CZH_UCAT_Limit\nbegin\n\n\n\nsubsection\\<open>Representable and corepresentable functors\\<close>\n\n\nsubsubsection\\<open>Definitions and elementary properties\\<close>\n\n\ntext\\<open>\nSee Chapter III-2 in \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close> \nor Section 2.1 in \\<^cite>\\<open>\"riehl_category_2016\"\\<close>.\n\\<close>\n\ndefinition cat_representation :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> bool\"\n  where \"cat_representation \\<alpha> \\<FF> c \\<psi> \\<longleftrightarrow>\n    c \\<in>\\<^sub>\\<circ> \\<FF>\\<lparr>HomDom\\<rparr>\\<lparr>Obj\\<rparr> \\<and>\n    \\<psi> : Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<alpha>\\<^esub>\\<FF>\\<lparr>HomDom\\<rparr>(c,-) \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o \\<FF> : \\<FF>\\<lparr>HomDom\\<rparr> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n\ndefinition cat_corepresentation :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> bool\"\n  where \"cat_corepresentation \\<alpha> \\<FF> c \\<psi> \\<longleftrightarrow>\n    c \\<in>\\<^sub>\\<circ> \\<FF>\\<lparr>HomDom\\<rparr>\\<lparr>Obj\\<rparr> \\<and>\n    \\<psi> : Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<alpha>\\<^esub>op_cat (\\<FF>\\<lparr>HomDom\\<rparr>)(-,c) \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o \\<FF> : \\<FF>\\<lparr>HomDom\\<rparr> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n\n\ntext\\<open>Rules.\\<close>\n\ncontext\n  fixes \\<alpha> \\<CC> \\<FF>\n  assumes \\<FF>: \"\\<FF> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\nbegin\n\ninterpretation \\<FF>: is_functor \\<alpha> \\<CC> \\<open>cat_Set \\<alpha>\\<close> \\<FF> by (rule \\<FF>)\n\nmk_ide rf cat_representation_def[where \\<alpha>=\\<alpha> and \\<FF>=\\<FF>, unfolded cat_cs_simps]\n  |intro cat_representationI|\n  |dest cat_representationD'|\n  |elim cat_representationE'|\n\nend\n\nlemmas cat_representationD[dest] = cat_representationD'[rotated]\n  and  cat_representationE[elim] = cat_representationE'[rotated]\n\nlemma cat_corepresentationI:\n  assumes \"category \\<alpha> \\<CC>\"\n    and \"\\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n    and \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    and \"\\<psi> : Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<alpha>\\<^esub>\\<CC>(-,c) \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o \\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n  shows \"cat_corepresentation \\<alpha> \\<FF> c \\<psi>\"\nproof-\n  interpret category \\<alpha> \\<CC> by (rule assms(1)) \n  interpret \\<FF>: is_functor \\<alpha> \\<open>op_cat \\<CC>\\<close> \\<open>cat_Set \\<alpha>\\<close> \\<FF> by (rule assms(2))\n  note [cat_op_simps] = \\<FF>.HomDom.cat_op_cat_cf_Hom_snd[\n      symmetric, unfolded cat_op_simps, OF assms(3)\n      ]\n  show ?thesis\n    unfolding cat_corepresentation_def\n    by (intro conjI, unfold cat_cs_simps cat_op_simps; intro assms)\nqed\n\nlemma cat_corepresentationD:\n  assumes \"cat_corepresentation \\<alpha> \\<FF> c \\<psi>\"\n    and \"category \\<alpha> \\<CC>\"\n    and \"\\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n  shows \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    and \"\\<psi> : Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<alpha>\\<^esub>\\<CC>(-,c) \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o \\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\nproof-\n  interpret category \\<alpha> \\<CC> by (rule assms(2)) \n  interpret \\<FF>: is_functor \\<alpha> \\<open>op_cat \\<CC>\\<close> \\<open>cat_Set \\<alpha>\\<close> \\<FF> by (rule assms(3))\n  note c\\<psi> = cat_corepresentation_def[\n      THEN iffD1, OF assms(1), unfolded cat_cs_simps cat_op_simps\n      ]\n  from c\\<psi>(1) show c: \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\n  note [cat_op_simps] = \\<FF>.HomDom.cat_op_cat_cf_Hom_snd[\n      symmetric, unfolded cat_op_simps, OF c\n      ]\n  show \"\\<psi> : Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<alpha>\\<^esub>\\<CC>(-,c) \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o \\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n    by (rule conjunct2[OF c\\<psi>, unfolded cat_op_simps])\nqed\n\nlemma cat_corepresentationE:\n  assumes \"cat_corepresentation \\<alpha> \\<FF> c \\<psi>\"\n    and \"category \\<alpha> \\<CC>\"\n    and \"\\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n  obtains \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    and \"\\<psi> : Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<alpha>\\<^esub>\\<CC>(-,c) \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o \\<FF> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n  by (simp add: cat_corepresentationD[OF assms])\n\n\nsubsubsection\\<open>Representable functors and universal arrows\\<close>\n\nlemma universal_arrow_of_if_cat_representation:\n  \\<comment>\\<open>See Proposition 2 in Chapter III-2 in \\cite{mac_lane_categories_2010}.\\<close>\n  assumes \"\\<KK> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n    and \"cat_representation \\<alpha> \\<KK> r \\<psi>\"\n    and \"\\<aa> \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"universal_arrow_of\n    \\<KK> (set {\\<aa>}) r (ntcf_paa \\<aa> (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>) (\\<psi>\\<lparr>NTMap\\<rparr>\\<lparr>r\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>\\<CC>\\<lparr>CId\\<rparr>\\<lparr>r\\<rparr>\\<rparr>))\"\nproof-\n  note r\\<psi> = cat_representationD[OF assms(2,1)]\n  interpret \\<KK>: is_functor \\<alpha> \\<CC> \\<open>cat_Set \\<alpha>\\<close> \\<KK> by (rule assms(1))\n  interpret \\<psi>: is_iso_ntcf \\<alpha> \\<CC> \\<open>cat_Set \\<alpha>\\<close> \\<open>Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<alpha>\\<^esub>\\<CC>(r,-)\\<close> \\<KK> \\<psi> \n    by (rule r\\<psi>(2))\n  from assms(3) have set_\\<aa>: \"set {\\<aa>} \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    by (simp add: Limit_vsingleton_in_VsetI cat_Set_components(1))\n  from\n    ntcf_cf_comp_is_iso_ntcf[\n      OF \\<KK>.ntcf_pointed_inv_is_iso_ntcf[OF assms(3)] assms(1)\n      ]\n  have \\<aa>\\<KK>: \"ntcf_pointed_inv \\<alpha> \\<aa> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> :\n    \\<KK> \\<mapsto>\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>i\\<^sub>s\\<^sub>o Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<alpha>\\<^esub>cat_Set \\<alpha> (set {\\<aa>},-) \\<circ>\\<^sub>C\\<^sub>F \\<KK> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n    by (cs_prems cs_simp: cat_cs_simps)\n  from iso_ntcf_is_iso_arr(1)[OF \\<aa>\\<KK>] r\\<psi> assms(3) have [cat_cs_simps]:\n    \"((ntcf_pointed_inv \\<alpha> \\<aa> \\<circ>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F\\<^sub>-\\<^sub>C\\<^sub>F \\<KK> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<psi>)\\<lparr>NTMap\\<rparr>\\<lparr>r\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>\\<CC>\\<lparr>CId\\<rparr>\\<lparr>r\\<rparr>\\<rparr>) =\n      ntcf_paa \\<aa> (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>) (\\<psi>\\<lparr>NTMap\\<rparr>\\<lparr>r\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>\\<CC>\\<lparr>CId\\<rparr>\\<lparr>r\\<rparr>\\<rparr>)\"\n    by\n      (\n        cs_concl\n          cs_simp: cat_cs_simps\n          cs_intro: cat_Set_cs_intros cat_cs_intros cat_op_intros\n      )\n  show \"universal_arrow_of\n    \\<KK> (set {\\<aa>}) r (ntcf_paa \\<aa> (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>) (\\<psi>\\<lparr>NTMap\\<rparr>\\<lparr>r\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>\\<CC>\\<lparr>CId\\<rparr>\\<lparr>r\\<rparr>\\<rparr>))\"\n    by\n      (\n        rule \\<KK>.cf_universal_arrow_of_if_is_iso_ntcf\n          [\n            OF r\\<psi>(1) set_\\<aa> ntcf_vcomp_is_iso_ntcf[OF \\<aa>\\<KK> r\\<psi>(2)], \n            unfolded cat_cs_simps\n          ]\n      )\nqed\n\nlemma universal_arrow_of_if_cat_corepresentation:\n  \\<comment>\\<open>See Proposition 2 in Chapter III-2 in \\cite{mac_lane_categories_2010}.\\<close>\n  assumes \"category \\<alpha> \\<CC>\"\n    and \"\\<KK> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n    and \"cat_corepresentation \\<alpha> \\<KK> r \\<psi>\"\n    and \"\\<aa> \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"universal_arrow_of\n    \\<KK> (set {\\<aa>}) r (ntcf_paa \\<aa> (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>) (\\<psi>\\<lparr>NTMap\\<rparr>\\<lparr>r\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>\\<CC>\\<lparr>CId\\<rparr>\\<lparr>r\\<rparr>\\<rparr>))\"\nproof-\n  interpret \\<CC>: category \\<alpha> \\<CC> by (rule assms(1))\n  note r\\<psi> = cat_corepresentationD[OF assms(3,1,2)]\n  note [cat_op_simps] = \\<CC>.cat_op_cat_cf_Hom_snd[OF r\\<psi>(1)]\n  have rep: \"cat_representation \\<alpha> \\<KK> r \\<psi>\"\n    by (intro cat_representationI, rule assms(2), unfold cat_op_simps; rule r\\<psi>)\n  show ?thesis\n    by \n      (\n        rule universal_arrow_of_if_cat_representation[\n          OF assms(2) rep assms(4), unfolded cat_op_simps\n          ]\n      )\nqed\n\nlemma cat_representation_if_universal_arrow_of:\n  \\<comment>\\<open>See Proposition 2 in Chapter III-2 in \\cite{mac_lane_categories_2010}.\\<close>\n  assumes \"\\<KK> : \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n    and \"\\<aa> \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"universal_arrow_of \\<KK> (set {\\<aa>}) r u\"\n  shows \"cat_representation \\<alpha> \\<KK> r (Yoneda_arrow \\<alpha> \\<KK> r (u\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr>))\"\nproof-\n\n  let ?Y = \\<open>Yoneda_component \\<KK> r (u\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr>)\\<close>\n\n  interpret \\<KK>: is_functor \\<alpha> \\<CC> \\<open>cat_Set \\<alpha>\\<close> \\<KK> by (rule assms(1))\n\n  note ua = \\<KK>.universal_arrow_ofD[OF assms(3)]\n\n  from ua(2) have u\\<aa>: \"u\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr> \\<in>\\<^sub>\\<circ> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>\"\n    by \n      (\n        cs_concl cs_shallow \n          cs_intro: V_cs_intros cat_Set_cs_intros cat_cs_intros\n      )\n\n  have [cat_cs_simps]: \"Yoneda_arrow \\<alpha> \\<KK> r (u\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr>)\\<lparr>NTMap\\<rparr>\\<lparr>c\\<rparr> = ?Y c\"\n    if \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" for c\n    using that \n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n  from ua(1) have [cat_cs_simps]: \"Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<alpha>\\<^esub>\\<CC>(r,-)\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> = Hom \\<CC> r c\"\n    if \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" for c\n    using that \n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_op_intros)\n\n  show ?thesis\n  proof\n    (\n      intro cat_representationI is_iso_ntcfI, \n      rule assms(1), \n      rule ua(1), \n      rule \\<KK>.HomDom.cat_Yoneda_arrow_is_ntcf[OF assms(1) ua(1) u\\<aa>],\n      rule cat_Set_is_iso_arrI,\n      simp_all only: cat_cs_simps \n    )\n\n    fix c assume prems: \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    with ua(1,2) show Yc: \"?Y c : Hom \\<CC> r c \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\"\n      by \n        (\n          cs_concl cs_shallow \n            cs_intro: V_cs_intros cat_Set_cs_intros cat_cs_intros\n        )\n\n    note YcD = cat_Set_is_arrD[OF Yc]\n\n    interpret Yc: arr_Set \\<alpha> \\<open>?Y c\\<close> by (rule YcD(1))\n\n    show dom_Yc: \"\\<D>\\<^sub>\\<circ> (?Y c\\<lparr>ArrVal\\<rparr>) = Hom \\<CC> r c\"\n      by (simp add: \\<KK>.Yoneda_component_ArrVal_vdomain)\n\n    show \"v11 (?Y c\\<lparr>ArrVal\\<rparr>)\"\n    proof(intro Yc.ArrVal.vsv_valeq_v11I, unfold dom_Yc in_Hom_iff)\n\n      fix g f assume prems': \n        \"g : r \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c\" \"f : r \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c\" \"?Y c\\<lparr>ArrVal\\<rparr>\\<lparr>g\\<rparr> = ?Y c\\<lparr>ArrVal\\<rparr>\\<lparr>f\\<rparr>\"\n\n      from prems have c: \"c \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\n\n      from prems'(3,1,2) have \\<KK>gu\\<aa>_\\<KK>fu\\<aa>:\n        \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>u\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr>\\<rparr> = \\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>u\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr>\\<rparr>\"\n        by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n\n      from prems'(1,2) ua(1,2) have \\<KK>g_u: \n        \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u : set {\\<aa>} \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\"\n        and \\<KK>f_u: \n        \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u : set {\\<aa>} \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\"\n        by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)+\n      then have dom_lhs: \"\\<D>\\<^sub>\\<circ> ((\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u)\\<lparr>ArrVal\\<rparr>) = set {\\<aa>}\"\n        and dom_rhs: \"\\<D>\\<^sub>\\<circ> ((\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u)\\<lparr>ArrVal\\<rparr>) = set {\\<aa>}\"\n        by (cs_concl cs_shallow cs_simp: cat_cs_simps)+\n\n      have \\<KK>g_\\<KK>f: \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u = \\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u\"\n      proof(rule arr_Set_eqI)\n        from \\<KK>g_u show arr_Set_\\<KK>g_u: \"arr_Set \\<alpha> (\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u)\"\n          by (auto dest: cat_Set_is_arrD)\n        from \\<KK>f_u show arr_Set_\\<KK>f_u: \"arr_Set \\<alpha> (\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u)\"\n          by (auto dest: cat_Set_is_arrD)\n        show \n          \"(\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u)\\<lparr>ArrVal\\<rparr> =\n            (\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u)\\<lparr>ArrVal\\<rparr>\"\n        proof(rule vsv_eqI, unfold dom_lhs dom_rhs vsingleton_iff; (simp only:)?)\n          from prems'(1,2) ua(2) show \n            \"(\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u)\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr> =\n              (\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u)\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr>\"\n            by\n              (\n                cs_concl cs_shallow\n                  cs_simp: cat_cs_simps \\<KK>gu\\<aa>_\\<KK>fu\\<aa> \n                  cs_intro: V_cs_intros cat_cs_intros\n              )\n        qed (use arr_Set_\\<KK>g_u arr_Set_\\<KK>f_u in auto)\n      qed (use \\<KK>g_u \\<KK>f_u in \\<open>cs_concl cs_shallow cs_simp: cat_cs_simps\\<close>)+\n      from prems'(1) ua(2) have\n        \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u : set {\\<aa>} \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\"\n        by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      from ua(3)[OF c this] obtain h where h: \"h : r \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c\"\n        and \\<KK>g_u_def: \n          \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u = umap_of \\<KK> (set {\\<aa>}) r u c\\<lparr>ArrVal\\<rparr>\\<lparr>h\\<rparr>\"\n        and h_unique: \"\\<And>h'.\n          \\<lbrakk>\n            h' : r \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c;\n            \\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u = umap_of \\<KK> (set {\\<aa>}) r u c\\<lparr>ArrVal\\<rparr>\\<lparr>h'\\<rparr>\n          \\<rbrakk> \\<Longrightarrow> h' = h\"\n        by metis\n      from prems'(1,2) ua(2) have\n        \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u = umap_of \\<KK> (set {\\<aa>}) r u c\\<lparr>ArrVal\\<rparr>\\<lparr>g\\<rparr>\"\n        \"\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u = umap_of \\<KK> (set {\\<aa>}) r u c\\<lparr>ArrVal\\<rparr>\\<lparr>f\\<rparr>\"\n        by \n          (\n            cs_concl cs_shallow \n              cs_simp: cat_cs_simps \\<KK>g_\\<KK>f cs_intro: cat_cs_intros\n          )+\n      from h_unique[OF prems'(1) this(1)] h_unique[OF prems'(2) this(2)] show \n        \"g = f\"\n        by simp\n    qed\n\n    show \"\\<R>\\<^sub>\\<circ> (?Y c\\<lparr>ArrVal\\<rparr>) = \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\"\n    proof\n      (\n        intro \n          vsubset_antisym Yc.arr_Par_ArrVal_vrange[unfolded YcD] \n          vsubsetI\n      ) \n      fix y assume prems': \"y \\<in>\\<^sub>\\<circ> \\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\"\n      from prems have \\<KK>c: \"\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr> \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n        by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n      from ua(3)[OF prems \\<KK>.ntcf_paa_is_arr[OF assms(2) \\<KK>c prems']] obtain f \n        where f: \"f : r \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c\"\n          and ntcf_paa_y:\n            \"ntcf_paa \\<aa> (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>) y = umap_of \\<KK> (set {\\<aa>}) r u c\\<lparr>ArrVal\\<rparr>\\<lparr>f\\<rparr>\"\n          and f_unique: \"\\<And>f'.\n            \\<lbrakk>\n              f' : r \\<mapsto>\\<^bsub>\\<CC>\\<^esub> c;\n              ntcf_paa \\<aa> (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>) y = umap_of \\<KK> (set {\\<aa>}) r u c\\<lparr>ArrVal\\<rparr>\\<lparr>f'\\<rparr>\n            \\<rbrakk> \\<Longrightarrow> f' = f\"\n        by metis\n      from ntcf_paa_y f ua(2) have \n        \"ntcf_paa \\<aa> (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>) y = \\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u\"\n        by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      then have \n        \"ntcf_paa \\<aa> (\\<KK>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>) y\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr> =\n          (\\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> u)\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr>\"\n        by simp\n      from this f ua(2) have [symmetric, cat_cs_simps]: \n        \"y = \\<KK>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>u\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr>\\<rparr>\"\n        by \n          (\n            cs_prems cs_shallow\n              cs_simp: cat_cs_simps cs_intro: V_cs_intros cat_cs_intros\n          )\n      show \"y \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (?Y c\\<lparr>ArrVal\\<rparr>)\"\n        by (intro Yc.ArrVal.vsv_vimageI2')\n          (\n            use f in \n              \\<open>\n                cs_concl cs_shallow\n                  cs_simp: cat_cs_simps cs_intro: cat_cs_intros\n              \\<close>\n          )+\n    qed\n  qed\n\nqed\n\nlemma cat_corepresentation_if_universal_arrow_of:\n  \\<comment>\\<open>See Proposition 2 in Chapter III-2 in \\cite{mac_lane_categories_2010}.\\<close>\n  assumes \"category \\<alpha> \\<CC>\"\n    and \"\\<KK> : op_cat \\<CC> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Set \\<alpha>\"\n    and \"\\<aa> \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"universal_arrow_of \\<KK> (set {\\<aa>}) r u\"\n  shows \"cat_corepresentation \\<alpha> \\<KK> r (Yoneda_arrow \\<alpha> \\<KK> r (u\\<lparr>ArrVal\\<rparr>\\<lparr>\\<aa>\\<rparr>))\"\nproof-\n  interpret \\<CC>: category \\<alpha> \\<CC> by (rule assms(1))\n  interpret \\<KK>: is_functor \\<alpha> \\<open>op_cat \\<CC>\\<close> \\<open>cat_Set \\<alpha>\\<close> \\<KK> by (rule assms(2))\n  note ua = \\<KK>.universal_arrow_ofD[OF assms(4), unfolded cat_op_simps]\n  note [cat_op_simps] = \\<CC>.cat_op_cat_cf_Hom_snd[OF ua(1)]\n  show ?thesis\n    by \n      (\n        intro cat_corepresentationI,\n        rule assms(1),\n        rule assms(2),\n        rule ua(1),\n        rule cat_representationD(2)\n          [\n            OF\n              cat_representation_if_universal_arrow_of[OF assms(2,3,4)] \n              assms(2),\n            unfolded cat_op_simps\n          ]\n      )\nqed\n\n\n\nsubsection\\<open>Limits and colimits as universal cones\\<close>\n\nlemma is_tm_cat_limit_if_cat_corepresentation:\n  \\<comment>\\<open>See Definition 3.1.5 in Section 3.1 in \\cite{riehl_category_2016}.\\<close>\n  assumes \"\\<FF> : \\<JJ> \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \n    and \"cat_corepresentation \\<alpha> (tm_cf_Cone \\<alpha> \\<FF>) r \\<psi>\"\n    (is \\<open>cat_corepresentation \\<alpha> ?Cone r \\<psi>\\<close>)\n  shows \"ntcf_of_ntcf_arrow \\<JJ> \\<CC> (\\<psi>\\<lparr>NTMap\\<rparr>\\<lparr>r\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>\\<CC>\\<lparr>CId\\<rparr>\\<lparr>r\\<rparr>\\<rparr>) :\n    r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<FF> : \\<JJ> \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    (is \\<open>ntcf_of_ntcf_arrow \\<JJ> \\<CC> ?\\<psi>r1r : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<FF> : \\<JJ> \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>\\<close>)\nproof-\n\n  let ?P = \\<open>ntcf_paa 0\\<close> and ?Funct = \\<open>cat_Funct \\<alpha> \\<JJ> \\<CC>\\<close>\n\n  interpret \\<FF>: is_tm_functor \\<alpha> \\<JJ> \\<CC> \\<FF> by (rule assms(1))\n  interpret Funct: category \\<alpha> ?Funct\n    by\n      (\n        cs_concl cs_shallow cs_intro: \n          cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n      )\n  note r\\<psi> = cat_corepresentationD[\n      OF assms(2) \\<FF>.HomCod.category_axioms \\<FF>.tm_cf_cf_Cone_is_functor\n      ]\n  interpret \\<psi>: is_iso_ntcf \\<alpha> \\<open>op_cat \\<CC>\\<close> \\<open>cat_Set \\<alpha>\\<close> \\<open>Hom\\<^sub>O\\<^sub>.\\<^sub>C\\<^bsub>\\<alpha>\\<^esub>\\<CC>(-,r)\\<close> ?Cone \\<psi>\n    by (rule r\\<psi>(2))\n  have 0: \"0 \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" unfolding cat_Set_components by auto\n  note ua = universal_arrow_of_if_cat_corepresentation[\n      OF \\<FF>.HomCod.category_axioms \\<FF>.tm_cf_cf_Cone_is_functor assms(2) 0\n      ]\n\n  show ?thesis\n  proof(rule is_tm_cat_limitI')\n    \n    from r\\<psi>(1) have [cat_FUNCT_cs_simps]:\n      \"cf_of_cf_map \\<JJ> \\<CC> (cf_map (cf_const \\<JJ> \\<CC> r)) = cf_const \\<JJ> \\<CC> r\"\n      by\n        (\n          cs_concl \n            cs_simp: cat_FUNCT_cs_simps\n            cs_intro: cat_cs_intros cat_FUNCT_cs_intros\n        )\n    from \\<psi>.ntcf_NTMap_is_arr[unfolded cat_op_simps, OF r\\<psi>(1)] r\\<psi>(1) have \n      \"\\<psi>\\<lparr>NTMap\\<rparr>\\<lparr>r\\<rparr> :\n        Hom \\<CC> r r \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> Hom ?Funct (cf_map (cf_const \\<JJ> \\<CC> r)) (cf_map \\<FF>)\"\n      by\n        (\n          cs_prems \n            cs_simp: cat_small_cs_simps cat_cs_simps cat_op_simps\n            cs_intro: cat_cs_intros\n        )\n    with r\\<psi>(1) have \\<psi>r_r: \n      \"?\\<psi>r1r : cf_map (cf_const \\<JJ> \\<CC> r) \\<mapsto>\\<^bsub>?Funct\\<^esub> cf_map \\<FF>\"\n      by\n        (\n          cs_concl cs_shallow cs_intro:\n            cat_Set_cs_intros cat_cs_intros in_Hom_iff[symmetric]\n        )\n\n    from r\\<psi>(1) cat_Funct_is_arrD(1)[OF \\<psi>r_r, unfolded cat_FUNCT_cs_simps]\n    show \"ntcf_of_ntcf_arrow \\<JJ> \\<CC> ?\\<psi>r1r : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<FF> : \\<JJ> \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n      by (intro is_tm_cat_coneI) \n        (cs_concl cs_shallow cs_intro: cat_cs_intros cat_small_cs_intros)\n\n    fix r' u' assume \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<FF> : \\<JJ> \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    then interpret u': is_tm_cat_cone \\<alpha> r' \\<JJ> \\<CC> \\<FF> u' .\n\n    have Cone_r': \"tm_cf_Cone \\<alpha> \\<FF>\\<lparr>ObjMap\\<rparr>\\<lparr>r'\\<rparr> \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n      by (cs_concl cs_intro: cat_lim_cs_intros cat_cs_intros cat_op_intros)\n    from r\\<psi>(1) have Cone_r: \"tm_cf_Cone \\<alpha> \\<FF>\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr> \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n      by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_op_intros)\n    from r\\<psi>(1) have \\<psi>r1r: \n      \"\\<psi>\\<lparr>NTMap\\<rparr>\\<lparr>r\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>\\<CC>\\<lparr>CId\\<rparr>\\<lparr>r\\<rparr>\\<rparr> \\<in>\\<^sub>\\<circ> tm_cf_Cone \\<alpha> \\<FF>\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>\"\n      by\n        (\n          cs_concl cs_shallow\n            cs_simp: cat_small_cs_simps cat_cs_simps cat_op_simps \n            cs_intro: cat_cs_intros\n        )\n    have u': \"ntcf_arrow u' \\<in>\\<^sub>\\<circ> ?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r'\\<rparr>\"\n      by\n        (\n          cs_concl \n            cs_simp: cat_small_cs_simps\n            cs_intro: cat_small_cs_intros cat_FUNCT_cs_intros cat_cs_intros\n        )\n\n    have [cat_cs_simps]: \n      \"cf_of_cf_map \\<JJ> \\<CC> (cf_map \\<FF>) = \\<FF>\"\n      \"cf_of_cf_map \\<JJ> \\<CC> (cf_map (cf_const \\<JJ> \\<CC> r)) = cf_const \\<JJ> \\<CC> r\"\n      by (cs_concl cs_simp: cat_FUNCT_cs_simps)+\n\n    from Cone_r 0 \\<psi>r1r r\\<psi>(1) have \\<psi>r1r_is_arr: \"\\<psi>\\<lparr>NTMap\\<rparr>\\<lparr>r\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>\\<CC>\\<lparr>CId\\<rparr>\\<lparr>r\\<rparr>\\<rparr> :\n      cf_map (cf_const \\<JJ> \\<CC> r) \\<mapsto>\\<^bsub>?Funct\\<^esub> cf_map \\<FF>\"\n      by\n        (\n          cs_concl cs_shallow\n            cs_simp: cat_cs_simps cat_small_cs_simps \n            cs_intro: cat_cs_intros cat_op_intros\n        )\n\n    from r\\<psi>(1) have [cat_cs_intros]:\n      \"Hom ?Funct (cf_map (cf_const \\<JJ> \\<CC> r)) (cf_map \\<FF>) \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n      unfolding cat_Set_components(1)\n      by (intro Funct.cat_Hom_in_Vset)\n        (\n          cs_concl\n            cs_simp: cat_FUNCT_cs_simps \n            cs_intro: cat_small_cs_intros cat_FUNCT_cs_intros cat_cs_intros\n        )+\n\n    note \\<psi>r1r_is_arrD = cat_Funct_is_arrD[OF \\<psi>r1r_is_arr, unfolded cat_cs_simps]\n\n    from is_functor.universal_arrow_ofD(3)\n      [\n        OF \\<FF>.tm_cf_cf_Cone_is_functor ua,\n        unfolded cat_op_simps,\n        OF u'.cat_cone_obj \\<FF>.ntcf_paa_is_arr[OF 0 Cone_r' u'] \n      ]\n    obtain f where f: \"f : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> r\"\n      and Pf: \"?P (?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r'\\<rparr>) (ntcf_arrow u') =\n        umap_of ?Cone (set {0}) r (?P (?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>) ?\\<psi>r1r) r'\\<lparr>ArrVal\\<rparr>\\<lparr>f\\<rparr>\"\n      and f_unique: \"\\<And>f'.\n        \\<lbrakk>\n          f' : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> r;\n          ?P (?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r'\\<rparr>) (ntcf_arrow u') =\n            umap_of ?Cone (set {0}) r (?P (?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>) ?\\<psi>r1r) r'\\<lparr>ArrVal\\<rparr>\\<lparr>f'\\<rparr>\n        \\<rbrakk> \\<Longrightarrow> f' = f\"\n      by metis\n\n    show \"\\<exists>!f.\n      f : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> r \\<and>\n      u' = ntcf_of_ntcf_arrow \\<JJ> \\<CC> ?\\<psi>r1r \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\<JJ> \\<CC> f\"\n    proof(intro ex1I conjI; (elim conjE)?)\n      show \"f : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> r\" by (rule f)\n      from Pf Cone_r 0 f \\<psi>r1r \\<psi>r1r_is_arr \\<psi>r1r_is_arrD(1) show\n        \"u' = ntcf_of_ntcf_arrow \\<JJ> \\<CC> ?\\<psi>r1r \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\<JJ> \\<CC> f\"\n        by (subst (asm) \\<psi>r1r_is_arrD(2))\n          (\n            cs_prems\n              cs_simp: cat_FUNCT_cs_simps cat_small_cs_simps cat_cs_simps\n              cs_intro:\n                cat_small_cs_intros\n                cat_cs_intros\n                cat_FUNCT_cs_intros\n                cat_prod_cs_intros\n                cat_op_intros\n          )\n\n      fix f' assume prems: \n        \"f' : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> r\"\n        \"u' = ntcf_of_ntcf_arrow \\<JJ> \\<CC> ?\\<psi>r1r \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\<JJ> \\<CC> f'\"\n      from Pf Cone_r 0 f \\<psi>r1r \\<psi>r1r_is_arr \\<psi>r1r_is_arrD(1) prems(1) have\n        \"?P (?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r'\\<rparr>) (ntcf_arrow u') =\n          umap_of ?Cone (set {0}) r (?P (?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>) ?\\<psi>r1r) r'\\<lparr>ArrVal\\<rparr>\\<lparr>f'\\<rparr>\"\n        by (subst \\<psi>r1r_is_arrD(2))\n          (\n            cs_concl\n              cs_simp: cat_FUNCT_cs_simps cat_small_cs_simps cat_cs_simps prems(2)\n              cs_intro:\n                cat_small_cs_intros\n                cat_FUNCT_cs_intros\n                cat_cs_intros\n                cat_prod_cs_intros\n                cat_op_intros\n          )\n      from f_unique[OF prems(1) this] show \"f' = f\" .\n    qed\n\n  qed\n\nqed\n\nlemma cat_corepresentation_if_is_tm_cat_limit:\n  \\<comment>\\<open>See Definition 3.1.5 in Section 3.1 in \\cite{riehl_category_2016}.\\<close>\n  assumes \"\\<psi> : r <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>t\\<^sub>m\\<^sub>.\\<^sub>l\\<^sub>i\\<^sub>m \\<FF> : \\<JJ> \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"cat_corepresentation\n    \\<alpha> (tm_cf_Cone \\<alpha> \\<FF>) r (Yoneda_arrow \\<alpha> (tm_cf_Cone \\<alpha> \\<FF>) r (ntcf_arrow \\<psi>))\"\n    (is \\<open>cat_corepresentation \\<alpha> ?Cone r ?Y\\<psi>\\<close>)\nproof-\n\n  let ?Funct = \\<open>cat_Funct \\<alpha> \\<JJ> \\<CC>\\<close>\n    and ?P_\\<psi> = \\<open>ntcf_paa 0 (?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>) (ntcf_arrow \\<psi>)\\<close>\n    and ?ntcf_of = \\<open>ntcf_of_ntcf_arrow \\<JJ> \\<CC>\\<close>\n\n  interpret \\<psi>: is_tm_cat_limit \\<alpha> \\<JJ> \\<CC> \\<FF> r \\<psi> by (rule assms(1))\n  interpret Funct: category \\<alpha> ?Funct\n    by\n      (\n        cs_concl cs_shallow cs_intro:\n          cat_small_cs_intros cat_cs_intros cat_FUNCT_cs_intros\n      )\n  interpret Cone: is_functor \\<alpha> \\<open>op_cat \\<CC>\\<close> \\<open>cat_Set \\<alpha>\\<close> \\<open>?Cone\\<close>\n    by (rule \\<psi>.NTCod.tm_cf_cf_Cone_is_functor)\n\n  have 0: \"0 \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" unfolding cat_Set_components by auto\n  have ntcf_arrow_\\<psi>: \n    \"ntcf_arrow \\<psi> : cf_map (cf_const \\<JJ> \\<CC> r) \\<mapsto>\\<^bsub>?Funct\\<^esub> cf_map \\<FF>\"\n    by (cs_concl cs_shallow cs_intro: cat_small_cs_intros cat_FUNCT_cs_intros)\n  from \\<psi>.cat_cone_obj 0 ntcf_arrow_\\<psi> have P_\\<psi>:\n    \"?P_\\<psi> : set {0} \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>\"\n    by\n      (\n        cs_concl cs_shallow\n          cs_intro: cat_cs_intros cat_op_intros \n          cs_simp: cat_small_cs_simps cat_FUNCT_cs_simps\n      )\n\n  have \"universal_arrow_of ?Cone (set {0}) r ?P_\\<psi>\"\n  proof(rule Cone.universal_arrow_ofI, unfold cat_op_simps, rule \\<psi>.cat_cone_obj)\n\n    from 0 \\<psi>.cat_cone_obj show \"?P_\\<psi> : set {0} \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r\\<rparr>\"\n      by\n        (\n          cs_concl\n            cs_intro:\n              cat_small_cs_intros\n              cat_cs_intros\n              cat_FUNCT_cs_intros\n              cat_op_intros\n            cs_simp: cat_small_cs_simps\n        )\n\n    fix r' u' assume prems:\n      \"r' \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" \"u' : set {0} \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Cone\\<lparr>ObjMap\\<rparr>\\<lparr>r'\\<rparr>\"\n\n    let ?const_r' = \\<open>cf_map (cf_const \\<JJ> \\<CC> r')\\<close>\n    let ?Hom_r\\<FF> = \\<open>Hom ?Funct ?const_r' (cf_map \\<FF>)\\<close>\n\n    from prems(2,1) have u': \"u' : set {0} \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Hom_r\\<FF>\"\n      by\n        (\n          cs_prems cs_shallow\n            cs_simp: cat_small_cs_simps cat_cs_simps cs_intro: cat_cs_intros\n        )\n    from prems(1) have [cat_FUNCT_cs_simps]:\n      \"cf_of_cf_map \\<JJ> \\<CC> ?const_r' = cf_const \\<JJ> \\<CC> r'\"\n      by \n        (\n          cs_concl \n            cs_simp: cat_cs_simps cat_FUNCT_cs_simps cs_intro: cat_cs_intros\n        )\n\n    from\n      cat_Set_ArrVal_app_vrange[OF prems(2) vintersection_vsingleton] \n      prems(1)\n    have \"u'\\<lparr>ArrVal\\<rparr>\\<lparr>0\\<rparr> : ?const_r' \\<mapsto>\\<^bsub>?Funct\\<^esub> cf_map \\<FF>\"\n      by (cs_prems cs_shallow cs_simp: cat_small_cs_simps cat_cs_simps)\n    note u'0 = cat_Funct_is_arrD[OF this, unfolded cat_FUNCT_cs_simps]\n\n    interpret u'0: is_tm_cat_cone \\<alpha> r' \\<JJ> \\<CC> \\<FF> \\<open>?ntcf_of (u'\\<lparr>ArrVal\\<rparr>\\<lparr>0\\<rparr>)\\<close>\n      by\n        (\n          rule is_tm_cat_coneI[\n            OF is_tm_ntcfD(1)[OF u'0(1)] \\<psi>.NTCod.is_tm_functor_axioms prems(1)\n            ]\n        )\n\n    from \\<psi>.tm_cat_lim_ua_fo[OF u'0.is_cat_cone_axioms] obtain f \n      where f: \"f : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> r\"\n        and u'0_def: \"?ntcf_of (u'\\<lparr>ArrVal\\<rparr>\\<lparr>0\\<rparr>) = \\<psi> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\<JJ> \\<CC> f\"\n        and f_unique: \"\\<And>f'.\n          \\<lbrakk>\n            f' : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> r;\n            ?ntcf_of (u'\\<lparr>ArrVal\\<rparr>\\<lparr>0\\<rparr>) = \\<psi> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const \\<JJ> \\<CC> f'\n          \\<rbrakk> \\<Longrightarrow> f' = f\"\n      by metis\n\n    note [cat_FUNCT_cs_simps] = \n      \\<psi>.ntcf_paa_ArrVal u'0(2)[symmetric] u'0_def[symmetric]\n\n    show \"\\<exists>!f'.\n      f' : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> r \\<and> u' = umap_of ?Cone (set {0}) r ?P_\\<psi> r'\\<lparr>ArrVal\\<rparr>\\<lparr>f'\\<rparr>\"\n    proof(intro ex1I conjI; (elim conjE)?; (rule f)?)\n\n      from f 0 u' ntcf_arrow_\\<psi> show \n        \"u' = umap_of ?Cone (set {0}) r ?P_\\<psi> r'\\<lparr>ArrVal\\<rparr>\\<lparr>f\\<rparr>\"\n        by (*slow*)\n          (\n            cs_concl\n              cs_simp: cat_cs_simps\n              cs_intro:\n                cat_small_cs_intros\n                cat_FUNCT_cs_intros\n                cat_prod_cs_intros\n                cat_cs_intros\n                cat_op_intros\n              cs_simp: cat_FUNCT_cs_simps cat_small_cs_simps\n          )\n\n      fix f' assume prems':\n        \"f' : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> r\"\n        \"u' = umap_of ?Cone (set {0}) r ?P_\\<psi> r'\\<lparr>ArrVal\\<rparr>\\<lparr>f'\\<rparr>\"\n\n      let ?f' = \\<open>ntcf_const \\<JJ> \\<CC> f'\\<close>\n\n      from prems'(2,1) 0 ntcf_arrow_\\<psi> P_\\<psi> have \n        \"u' = ntcf_paa 0 ?Hom_r\\<FF> (ntcf_arrow (\\<psi> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?f'))\"\n        unfolding \n          Cone.umap_of_ArrVal_app[unfolded cat_op_simps, OF prems'(1) P_\\<psi>]\n        by (*very slow*)\n          (\n            cs_prems\n              cs_simp: cat_FUNCT_cs_simps cat_small_cs_simps cat_cs_simps\n              cs_intro:\n                cat_small_cs_intros\n                cat_FUNCT_cs_intros\n                cat_prod_cs_intros\n                cat_cs_intros\n                cat_op_intros\n          )\n      then have\n        \"?ntcf_of (u'\\<lparr>ArrVal\\<rparr>\\<lparr>0\\<rparr>) =\n          ?ntcf_of ((ntcf_paa 0 ?Hom_r\\<FF> (ntcf_arrow (\\<psi> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?f')))\\<lparr>ArrVal\\<rparr>\\<lparr>0\\<rparr>)\"\n        by simp\n      from this prems'(1) have \"?ntcf_of (u'\\<lparr>ArrVal\\<rparr>\\<lparr>0\\<rparr>) = \\<psi> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ?f'\"\n        by\n          (\n            cs_prems cs_shallow\n              cs_simp: cat_cs_simps cat_FUNCT_cs_simps cs_intro: cat_cs_intros\n          )\n      from f_unique[OF prems'(1) this] show \"f' = f\" . \n\n    qed\n\n  qed\n\n  from \n    cat_corepresentation_if_universal_arrow_of[\n      OF \\<psi>.NTDom.HomCod.category_axioms Cone.is_functor_axioms 0 this\n      ]\n  show \"cat_corepresentation \\<alpha> ?Cone r ?Y\\<psi>\"\n    by (cs_prems cs_shallow cs_simp: cat_cs_simps)\n\nqed\n\ntext\\<open>\\newpage\\<close>\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Universal_Constructions/czh_ucategories/CZH_UCAT_Representable.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.32772614262559757}}
{"text": "(*  Title:      HOL/Auth/n_mesi_lemma_inv__2_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mesi Protocol Case Study*} \n\ntheory n_mesi_lemma_inv__2_on_rules imports n_mesi_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__2  p__Inv0 p__Inv2)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t1  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_t2 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_t3 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_t4 N i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t1  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t1Vsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t2 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t2Vsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t3 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t3Vsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t4 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t4Vsinv__2) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mesi/n_mesi_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.754914997895581, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.32761911658915627}}
{"text": "theory Friend_Traceback\nimports Traceback_Intro\nbegin\n\n\nsubsection \\<open>Tracing Back Friendship Status\\<close>\n\ntext \\<open>We prove the following traceback property:\nIf, at some point \\<open>t\\<close> on a system trace, the users \\<open>UID\\<close> and \\<open>UID'\\<close> are friends,\nthen one of the following holds:\n\\begin{itemize}\n\\item Either \\<open>UID\\<close> had issued a friend request to \\<open>UID'\\<close>, eventually followed by an approval\n(i.e., a successful \\<open>UID\\<close>-friend creation action) by \\<open>UID'\\<close> such that between\nthat approval and \\<open>t\\<close> there was no successful \\<open>UID'\\<close>-unfriending (i.e., friend deletion)\nby \\<open>UID\\<close> or \\<open>UID\\<close>-unfriending by \\<open>UID'\\<close>\n\\item Or vice versa (with \\<open>UID\\<close> and \\<open>UID'\\<close> swapped)\n\\end{itemize}\n\nThis property is captured by the predicate \\<open>proper\\<close>, which decomposes any valid system trace tr\nstarting in the initial state\nfor which the target state \\<open>tgtOf (last tr)\\<close> has \\<open>UID\\<close> and \\<open>UID'\\<close> as friends,\nas follows: tr is the concatenation of \\<open>tr1\\<close>, \\<open>trn\\<close>, \\<open>tr2\\<close>, \\<open>trnn\\<close> and \\<open>tr3\\<close> where\n\\begin{itemize}\n\\item \\<open>trn\\<close> represents the time of the relevant friend request\n\\item \\<open>trnn\\<close> represents the time of the approval of this request\n\\item \\<open>tr3\\<close> contains no unfriending between the two users\n\\end{itemize}\n\nThe main theorem states that \\<open>proper tr\\<close>\nholds for any trace \\<open>tr\\<close> that leads to \\<open>UID\\<close> and \\<open>UID'\\<close> being friends.\n\\<close>\n\nconsts UID :: userID\nconsts UID' :: userID\n\ntext \\<open>\\<open>SFRC\\<close> means ``is a successful friend request creation''\\<close>\n\nfun SFRC :: \"userID \\<Rightarrow> userID \\<Rightarrow> (state,act,out) trans \\<Rightarrow> bool\" where\n\"SFRC uidd uidd' (Trans s (Cact (cFriendReq uid p uid' _)) ou s') = (ou = outOK \\<and> (uid,uid') = (uidd,uidd'))\"\n|\n\"SFRC uidd uidd' _ = False\"\n\ntext \\<open>\\<open>SFC\\<close> means ``is a successful friend creation'' \\<close>\n\nfun SFC :: \"userID \\<Rightarrow> userID \\<Rightarrow> (state,act,out) trans \\<Rightarrow> bool\" where\n\"SFC uidd uidd' (Trans s (Cact (cFriend uid p uid')) ou s') = (ou = outOK \\<and> (uid,uid') = (uidd,uidd'))\"\n|\n\"SFC uidd uidd' _ = False\"\n\ntext \\<open>\\<open>SFD\\<close> means ``is a successful friend deletion'' \\<close>\n\nfun SFD :: \"userID \\<Rightarrow> userID \\<Rightarrow> (state,act,out) trans \\<Rightarrow> bool\" where\n\"SFD uidd uidd' (Trans s (Dact (dFriend uid p uid')) ou s') = (ou = outOK \\<and> (uid,uid') = (uidd,uidd'))\"\n|\n\"SFD uidd uidd' _ = False\"\n\ndefinition proper1 :: \"(state,act,out) trans trace \\<Rightarrow> bool\" where\n\"proper1 tr \\<equiv>\n \\<exists> trr trnn tr3. tr = trr @ trnn # tr3 \\<and>\n                 (SFC UID UID' trnn \\<or> SFC UID' UID trnn) \\<and>\n                 never (SFD UID UID') tr3 \\<and> never (SFD UID' UID) tr3\"\n\nlemma SFC_validTrans:\nassumes \"validTrans trn\"\nand \"\\<not> UID' \\<in>\\<in> friendIDs (srcOf trn) UID\"\nand \"UID' \\<in>\\<in> friendIDs (tgtOf trn) UID\"\nshows \"SFC UID UID' trn \\<or> SFC UID' UID trn\"\nproof(cases trn)\n  case (Trans s a ou s')\n  then show ?thesis\n    using assms\n    by (cases a) (auto elim: step_elims simp: all_defs)\nqed\n\nlemma SFD_validTrans:\nassumes \"validTrans trn\"\nand \"UID' \\<in>\\<in> friendIDs (tgtOf trn) UID\"\nshows \"\\<not> SFD UID UID' trn \\<and> \\<not> SFD UID' UID trn\"\nproof(cases trn)\n  case (Trans s a ou s')\n  then show ?thesis\n    using assms\n    by (cases a) (auto elim: step_elims simp: all_defs)\nqed\n\nlemma SFC_SFD:\nassumes \"SFC uid1 uid2 trn\" shows \"\\<not> SFD uid3 uid4 trn\"\nproof(cases trn)\n  case (Trans s a ou s') note trn = Trans\n  show ?thesis using assms unfolding trn\n  by (cases \"a\") auto\nqed\n\nlemma proper1_valid:\nassumes \"valid tr\"\nand \"\\<not> UID' \\<in>\\<in> friendIDs (srcOf (hd tr)) UID\"\nand \"UID' \\<in>\\<in> friendIDs (tgtOf (last tr)) UID\"\nshows \"proper1 tr\"\nusing assms unfolding valid_valid2 proof induct\n  case (Singl trn)\n  then show ?case unfolding proper1_def using SFC_validTrans\n  by (intro exI[of _ \"[]\"] exI[of _ trn]) auto\nnext\n  case (Rcons tr trn)\n  show ?case\n  proof(cases \"UID' \\<in>\\<in> friendIDs (srcOf trn) UID\")\n    case False\n    hence \"SFC UID UID' trn \\<or> SFC UID' UID trn\"\n    using Rcons SFC_validTrans by auto\n    thus ?thesis unfolding proper1_def\n    apply - apply (rule exI[of _ tr]) by (intro exI[of _ trn] exI[of _ \"[]\"]) auto\n  next\n    case True\n    hence \"proper1 tr\" using Rcons by auto\n    then obtain trr trnn tr3 where\n    tr: \"tr = trr @ trnn # tr3\" and\n    SFC: \"SFC UID UID' trnn \\<or> SFC UID' UID trnn\" and\n    n: \"never (SFD UID UID') tr3 \\<and> never (SFD UID' UID) tr3\"\n    unfolding proper1_def by auto\n    have \"UID' \\<in>\\<in> friendIDs (tgtOf trn) UID\" using Rcons.prems(2) by auto\n    hence SFD: \"\\<not> SFD UID UID' trn \\<and> \\<not> SFD UID' UID trn\"\n    using SFD_validTrans \\<open>validTrans trn\\<close> by auto\n    show ?thesis using SFC n SFD unfolding proper1_def tr\n    apply - apply (rule exI[of _ trr])\n    by (intro exI[of _ trnn] exI[of _ \"tr3 ## trn\"]) simp\n  qed\nqed\n\nlemma istate_friendIDs:\n\"\\<not> UID' \\<in>\\<in> friendIDs (istate) UID\"\nunfolding istate_def by simp\n\nlemma proper1_valid_istate:\nassumes \"valid tr\" and \"srcOf (hd tr) = istate\"\nand \"UID' \\<in>\\<in> friendIDs (tgtOf (last tr)) UID\"\nshows \"proper1 tr\"\nusing assms istate_friendIDs proper1_valid by auto\n\n(*  *)\n\ndefinition proper2 :: \"userID \\<Rightarrow> userID \\<Rightarrow> (state,act,out) trans trace \\<Rightarrow> bool\" where\n\"proper2 uid uid' tr \\<equiv>\n \\<exists> tr1 trnn tr2. tr = tr1 @ trnn # tr2 \\<and> SFRC uid uid' trnn\"\n\nlemma SFRC_validTrans:\nassumes \"validTrans trn\"\nand \"\\<not> uid \\<in>\\<in> pendingFReqs (srcOf trn) uid'\"\nand \"uid \\<in>\\<in> pendingFReqs (tgtOf trn) uid'\"\nshows \"SFRC uid uid' trn\"\nproof(cases trn)\n  case (Trans s a ou s')\n  then show ?thesis\n    using assms\n    by (cases \"a\") (auto elim: step_elims simp: all_defs)\nqed\n\nlemma proper2_valid:\nassumes \"valid tr\"\nand \"\\<not> uid \\<in>\\<in> pendingFReqs (srcOf (hd tr)) uid'\"\nand \"uid \\<in>\\<in> pendingFReqs (tgtOf (last tr)) uid'\"\nshows \"proper2 uid uid' tr\"\nusing assms unfolding valid_valid2 proof induct\n  case (Singl trn)\n  thus ?case unfolding proper2_def using SFRC_validTrans\n  by (intro exI[of _ \"[]\"] exI[of _ trn]) auto\nnext\n  case (Rcons tr trn)\n  show ?case\n  proof(cases \"uid \\<in>\\<in> pendingFReqs (srcOf trn) uid'\")\n    case False\n    hence \"SFRC uid uid' trn\"\n    using Rcons SFRC_validTrans by auto\n    thus ?thesis unfolding proper2_def\n    apply - apply (rule exI[of _ tr]) by (intro exI[of _ trn] exI[of _ \"[]\"]) auto\n  next\n    case True\n    hence \"proper2 uid uid' tr\" using Rcons by auto\n    then obtain trr trnn tr3 where\n    tr: \"tr = trr @ trnn # tr3\" and SFRC: \"SFRC uid uid' trnn\"\n    unfolding proper2_def by auto\n    have \"uid \\<in>\\<in> pendingFReqs (tgtOf trn) uid'\" using Rcons.prems(2) by auto\n    show ?thesis using SFRC unfolding proper2_def tr\n    apply - apply (rule exI[of _ trr])\n    by (intro exI[of _ trnn] exI[of _ \"tr3 ## trn\"]) simp\n  qed\nqed\n\nlemma istate_pendingFReqs:\n\"\\<not> uid \\<in>\\<in> pendingFReqs (istate) uid'\"\nunfolding istate_def by simp\n\nlemma proper2_valid_istate:\nassumes \"valid tr\" and \"srcOf (hd tr) = istate\"\nand \"uid \\<in>\\<in> pendingFReqs (tgtOf (last tr)) uid'\"\nshows \"proper2 uid uid' tr\"\nusing assms istate_pendingFReqs proper2_valid by auto\n\n(*  *)\n\nlemma SFC_pendingFReqs:\nassumes \"validTrans trn\"\nand \"SFC uid' uid trn\"\nshows \"uid \\<in>\\<in> pendingFReqs (srcOf trn) uid'\"\nproof(cases trn)\n  case (Trans s a ou s')\n  then show ?thesis\n    using assms\n    by (cases \"a\") (auto elim: step_elims simp: all_defs)\nqed\n\n\ndefinition proper :: \"(state,act,out) trans trace \\<Rightarrow> bool\" where\n\"proper tr \\<equiv>\n \\<exists> tr1 trn tr2 trnn tr3. tr = tr1 @ trn # tr2 @ trnn # tr3 \\<and>\n                 (SFRC UID' UID trn \\<and> SFC UID UID' trnn \\<or>\n                  SFRC UID UID' trn \\<and> SFC UID' UID trnn) \\<and>\n                 never (SFD UID UID') tr3 \\<and> never (SFD UID' UID) tr3\"\n\ntheorem friend_accountability:\nassumes v: \"valid tr\" and i: \"srcOf (hd tr) = istate\"\nand UID: \"UID' \\<in>\\<in> friendIDs (tgtOf (last tr)) UID\"\nshows \"proper tr\"\nproof-\n  have \"proper1 tr\" using proper1_valid_istate[OF assms] .\n  then obtain trr trnn tr3 where\n  tr: \"tr = trr @ trnn # tr3\" and\n  SFC: \"SFC UID UID' trnn \\<or> SFC UID' UID trnn\" (is \"?A \\<or> ?B\") and\n  n: \"never (SFD UID UID') tr3 \\<and> never (SFD UID' UID) tr3\"\n  unfolding proper1_def by auto\n  have trnn: \"validTrans trnn\" and trr: \"valid trr\" using tr\n  apply (metis valid_Cons_iff append_self_conv2 assms(1) list.distinct(1) valid_append)\n  by (metis SFC SFC_pendingFReqs append_self_conv2 i istate_pendingFReqs list.distinct(1) list.sel(1) tr v valid_Cons_iff valid_append)\n  show ?thesis using SFC proof\n    assume SFC: ?A\n    have 0: \"UID' \\<in>\\<in> pendingFReqs (srcOf trnn) UID\"\n    using SFC_pendingFReqs[OF trnn SFC] .\n    hence \"srcOf trnn \\<noteq> istate\" unfolding istate_def by auto\n    hence 2: \"trr \\<noteq> []\" using i unfolding tr by auto\n    hence i: \"srcOf (hd trr) = istate\" using i unfolding tr by auto\n    have \"srcOf trnn = tgtOf (last trr)\" using tr v valid_append 2 by auto\n    hence 1: \"UID' \\<in>\\<in> pendingFReqs (tgtOf (last trr)) UID\" using 0 by simp\n    have \"proper2 UID' UID trr\" using proper2_valid_istate[OF trr i 1] .\n    then obtain tr1 trn tr2 where\n    trr: \"trr = tr1 @ trn # tr2\" and SFRC: \"SFRC UID' UID trn\"\n    unfolding proper2_def by auto\n    show ?thesis unfolding proper_def\n    apply(rule exI[of _ tr1], rule exI[of _ trn], rule exI[of _ tr2],\n          rule exI[of _ trnn], rule exI[of _ tr3])\n    unfolding tr trr using SFRC SFC n by simp\n  next\n    assume SFC: ?B\n    have 0: \"UID \\<in>\\<in> pendingFReqs (srcOf trnn) UID'\"\n    using SFC_pendingFReqs[OF trnn SFC] .\n    hence \"srcOf trnn \\<noteq> istate\" unfolding istate_def by auto\n    hence 2: \"trr \\<noteq> []\" using i unfolding tr by auto\n    hence i: \"srcOf (hd trr) = istate\" using i unfolding tr by auto\n    have \"srcOf trnn = tgtOf (last trr)\" using tr v valid_append 2 by auto\n    hence 1: \"UID \\<in>\\<in> pendingFReqs (tgtOf (last trr)) UID'\" using 0 by simp\n    have \"proper2 UID UID' trr\" using proper2_valid_istate[OF trr i 1] .\n    then obtain tr1 trn tr2 where\n    trr: \"trr = tr1 @ trn # tr2\" and SFRC: \"SFRC UID UID' trn\"\n    unfolding proper2_def by auto\n    show ?thesis unfolding proper_def\n    apply(rule exI[of _ tr1], rule exI[of _ trn], rule exI[of _ tr2],\n          rule exI[of _ trnn], rule exI[of _ tr3])\n    unfolding tr trr using SFRC SFC n by simp\n  qed\nqed\n\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMed/Traceback_Properties/Friend_Traceback.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3275202523698191}}
{"text": "theory Eq\nimports Base\nbegin\n\nchapter \\<open>Equational reasoning\\<close>\n\ntext \\<open>Equality is one of the most fundamental concepts of\n  mathematics.  The Isabelle/Pure logic (\\chref{ch:logic}) provides a\n  builtin relation @{text \"\\<equiv> :: \\<alpha> \\<Rightarrow> \\<alpha> \\<Rightarrow> prop\"} that expresses equality\n  of arbitrary terms (or propositions) at the framework level, as\n  expressed by certain basic inference rules (\\secref{sec:eq-rules}).\n\n  Equational reasoning means to replace equals by equals, using\n  reflexivity and transitivity to form chains of replacement steps,\n  and congruence rules to access sub-structures.  Conversions\n  (\\secref{sec:conv}) provide a convenient framework to compose basic\n  equational steps to build specific equational reasoning tools.\n\n  Higher-order matching is able to provide suitable instantiations for\n  giving equality rules, which leads to the versatile concept of\n  @{text \"\\<lambda>\"}-term rewriting (\\secref{sec:rewriting}).  Internally\n  this is based on the general-purpose Simplifier engine of Isabelle,\n  which is more specific and more efficient than plain conversions.\n\n  Object-logics usually introduce specific notions of equality or\n  equivalence, and relate it with the Pure equality.  This enables to\n  re-use the Pure tools for equational reasoning for particular\n  object-logic connectives as well.\n\\<close>\n\n\nsection \\<open>Basic equality rules \\label{sec:eq-rules}\\<close>\n\ntext \\<open>Isabelle/Pure uses @{text \"\\<equiv>\"} for equality of arbitrary\n  terms, which includes equivalence of propositions of the logical\n  framework.  The conceptual axiomatization of the constant @{text \"\\<equiv>\n  :: \\<alpha> \\<Rightarrow> \\<alpha> \\<Rightarrow> prop\"} is given in \\figref{fig:pure-equality}.  The\n  inference kernel presents slightly different equality rules, which\n  may be understood as derived rules from this minimal axiomatization.\n  The Pure theory also provides some theorems that express the same\n  reasoning schemes as theorems that can be composed like object-level\n  rules as explained in \\secref{sec:obj-rules}.\n\n  For example, @{ML Thm.symmetric} as Pure inference is an ML function\n  that maps a theorem @{text \"th\"} stating @{text \"t \\<equiv> u\"} to one\n  stating @{text \"u \\<equiv> t\"}.  In contrast, @{thm [source]\n  Pure.symmetric} as Pure theorem expresses the same reasoning in\n  declarative form.  If used like @{text \"th [THEN Pure.symmetric]\"}\n  in Isar source notation, it achieves a similar effect as the ML\n  inference function, although the rule attribute @{attribute THEN} or\n  ML operator @{ML \"op RS\"} involve the full machinery of higher-order\n  unification (modulo @{text \"\\<beta>\\<eta>\"}-conversion) and lifting of @{text\n  \"\\<And>/\\<Longrightarrow>\"} contexts.\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML Thm.reflexive: \"cterm -> thm\"} \\\\\n  @{index_ML Thm.symmetric: \"thm -> thm\"} \\\\\n  @{index_ML Thm.transitive: \"thm -> thm -> thm\"} \\\\\n  @{index_ML Thm.abstract_rule: \"string -> cterm -> thm -> thm\"} \\\\\n  @{index_ML Thm.combination: \"thm -> thm -> thm\"} \\\\[0.5ex]\n  @{index_ML Thm.equal_intr: \"thm -> thm -> thm\"} \\\\\n  @{index_ML Thm.equal_elim: \"thm -> thm -> thm\"} \\\\\n  \\end{mldecls}\n\n  See also @{file \"~~/src/Pure/thm.ML\" } for further description of\n  these inference rules, and a few more for primitive @{text \"\\<beta>\"} and\n  @{text \"\\<eta>\"} conversions.  Note that @{text \"\\<alpha>\"} conversion is\n  implicit due to the representation of terms with de-Bruijn indices\n  (\\secref{sec:terms}).\\<close>\n\n\nsection \\<open>Conversions \\label{sec:conv}\\<close>\n\ntext \\<open>\n  %FIXME\n\n  The classic article that introduces the concept of conversion (for\n  Cambridge LCF) is @{cite \"paulson:1983\"}.\n\\<close>\n\n\nsection \\<open>Rewriting \\label{sec:rewriting}\\<close>\n\ntext \\<open>Rewriting normalizes a given term (theorem or goal) by\n  replacing instances of given equalities @{text \"t \\<equiv> u\"} in subterms.\n  Rewriting continues until no rewrites are applicable to any subterm.\n  This may be used to unfold simple definitions of the form @{text \"f\n  x\\<^sub>1 \\<dots> x\\<^sub>n \\<equiv> u\"}, but is slightly more general than that.\n\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML rewrite_rule: \"Proof.context -> thm list -> thm -> thm\"} \\\\\n  @{index_ML rewrite_goals_rule: \"Proof.context -> thm list -> thm -> thm\"} \\\\\n  @{index_ML rewrite_goal_tac: \"Proof.context -> thm list -> int -> tactic\"} \\\\\n  @{index_ML rewrite_goals_tac: \"Proof.context -> thm list -> tactic\"} \\\\\n  @{index_ML fold_goals_tac: \"Proof.context -> thm list -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML rewrite_rule}~@{text \"ctxt rules thm\"} rewrites the whole\n  theorem by the given rules.\n\n  \\item @{ML rewrite_goals_rule}~@{text \"ctxt rules thm\"} rewrites the\n  outer premises of the given theorem.  Interpreting the same as a\n  goal state (\\secref{sec:tactical-goals}) it means to rewrite all\n  subgoals (in the same manner as @{ML rewrite_goals_tac}).\n\n  \\item @{ML rewrite_goal_tac}~@{text \"ctxt rules i\"} rewrites subgoal\n  @{text \"i\"} by the given rewrite rules.\n\n  \\item @{ML rewrite_goals_tac}~@{text \"ctxt rules\"} rewrites all subgoals\n  by the given rewrite rules.\n\n  \\item @{ML fold_goals_tac}~@{text \"ctxt rules\"} essentially uses @{ML\n  rewrite_goals_tac} with the symmetric form of each member of @{text\n  \"rules\"}, re-ordered to fold longer expression first.  This supports\n  to idea to fold primitive definitions that appear in expended form\n  in the proof state.\n\n  \\end{description}\n\\<close>\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/Doc/Implementation/Eq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.6076631698328917, "lm_q1q2_score": 0.3275202523698191}}
{"text": "theory Recognising_Automata\nimports Cheri_axioms_lemmas Sail.Sail2_state_lemmas Trace_Assumptions\nbegin\n\nsubsection \\<open>Verification tools for CHERI properties\\<close>\n\ntext \\<open>For proving that a concrete ISA satisfies the CHERI axioms, we define an automaton for\neach axiom that only accepts traces satisfying the axiom.  The state of the automaton keeps track\nof relevant information, e.g. the capabilities read so far.\n\nThis makes it easy to decompose proofs about complete instruction traces into proofs about parts\nof a trace, e.g. corresponding to calls to auxiliary functions.\\<close>\n\nlocale Deterministic_Automaton =\n  fixes enabled :: \"'s \\<Rightarrow> 'rv event \\<Rightarrow> bool\"\n    and step :: \"'s \\<Rightarrow> 'rv event \\<Rightarrow> 's\"\n    and initial :: \"'s\"\n    and final :: \"'s \\<Rightarrow> bool\"\nbegin\n\nfun trace_enabled :: \"'s \\<Rightarrow> 'rv trace \\<Rightarrow> bool\" where\n  \"trace_enabled s [] = True\"\n| \"trace_enabled s (e # t) = (enabled s e \\<and> trace_enabled (step s e) t)\"\n\nabbreviation run :: \"'s \\<Rightarrow> 'rv trace \\<Rightarrow> 's\" where \"run s t \\<equiv> foldl step s t\"\n\ndefinition accepts_from :: \"'s \\<Rightarrow> 'rv trace \\<Rightarrow> bool\" where\n  \"accepts_from s t \\<equiv> trace_enabled s t \\<and> final (run s t)\"\n\nabbreviation \"accepts \\<equiv> accepts_from initial\"\n\nlemma trace_enabled_append_iff: \"trace_enabled s (t @ t') \\<longleftrightarrow> trace_enabled s t \\<and> trace_enabled (run s t) t'\"\n  by (induction t arbitrary: s) auto\n\nlemma accepts_from_append_iff: \"accepts_from s (t @ t') \\<longleftrightarrow> trace_enabled s t \\<and> accepts_from (run s t) t'\"\n  by (auto simp: accepts_from_def trace_enabled_append_iff)\n\nlemma accepts_from_Cons[simp]: \"accepts_from s (e # t) \\<longleftrightarrow> enabled s e \\<and> accepts_from (step s e) t\"\n  by (auto simp: accepts_from_def)\n\nlemma accepts_from_id_take_nth_drop:\n  assumes \"i < length t\"\n  shows \"accepts_from s t = accepts_from s (take i t @ t ! i # drop (Suc i) t)\"\n  using assms\n  by (auto simp: id_take_nth_drop[symmetric])\n\nlemma accepts_from_trace_enabledI:\n  assumes \"accepts_from s t\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (auto simp: accepts_from_def)\n\nlemma accepts_from_trace_enabled_takeI:\n  assumes \"accepts_from s t\"\n  shows \"trace_enabled s (take i t)\"\n  using assms\n  by (cases \"i < length t\") \n     (auto simp: accepts_from_id_take_nth_drop accepts_from_append_iff intro: accepts_from_trace_enabledI)\n\nlemma accepts_from_nth_enabledI:\n  assumes \"accepts_from s t\"\n    and \"i < length t\"\n  shows \"enabled (run s (take i t)) (t ! i)\"\n  using assms\n  by (auto simp: accepts_from_id_take_nth_drop accepts_from_append_iff)\n\nlemma accepts_from_iff_all_enabled_final:\n  \"accepts_from s t \\<longleftrightarrow> (\\<forall>i < length t. enabled (run s (take i t)) (t ! i)) \\<and> final (run s t)\"\n  by (induction t arbitrary: s)\n     (auto simp: accepts_from_def nth_Cons split: nat.splits)\n\nlemma trace_enabled_acceptI:\n  assumes \"trace_enabled s t\" and \"final (run s t)\"\n  shows \"accepts_from s t\"\n  using assms\n  by (auto simp: accepts_from_def)\n\nnamed_theorems trace_simp\nnamed_theorems trace_elim\n\nlemma Nil_trace_enabled[trace_elim]:\n  assumes \"t = []\"\n  shows \"trace_enabled s t\"\n  using assms\n  by auto\n\nlemma bind_TracesE:\n  assumes \"(m \\<bind> f, t, m') \\<in> Traces\"\n    and \"\\<And>tm tf m''. (m, tm, m'') \\<in> Traces \\<Longrightarrow> t = tm @ tf \\<Longrightarrow> P tm\"\n    and \"\\<And>tm am tf. (f am, tf, m') \\<in> Traces \\<Longrightarrow> Run m tm am \\<Longrightarrow> t = tm @ tf \\<Longrightarrow> P tm \\<Longrightarrow> P (tm @ tf)\"\n  shows \"P t\"\nproof (use assms in \\<open>cases rule: bind_Traces_cases\\<close>)\n  case (Left m'')\n  then show ?thesis using assms(2)[where tm = t and tf = \"[]\"] by auto\nnext\n  case (Bind tm am tf)\n  then show ?thesis using assms(2) assms(3) by auto\nqed\n\nlemma Run_bind_trace_enabled[trace_elim]:\n  assumes \"Run (m \\<bind> f) t a\"\n    and \"\\<And>tm tf am. t = tm @ tf \\<Longrightarrow> Run m tm am \\<Longrightarrow> trace_enabled s tm\"\n    and \"\\<And>tm tf am. t = tm @ tf \\<Longrightarrow> Run m tm am \\<Longrightarrow> Run (f am) tf a \\<Longrightarrow> trace_enabled (run s tm) tf\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (elim Run_bindE) (auto simp: trace_enabled_append_iff)\n\nlemma Exception_bind_trace_enabled:\n  assumes \"(m \\<bind> f, t, Exception e) \\<in> Traces\"\n    and \"(m, t, Exception e) \\<in> Traces \\<Longrightarrow> trace_enabled s t\"\n    and \"\\<And>tm tf am. t = tm @ tf \\<Longrightarrow> Run m tm am \\<Longrightarrow> trace_enabled s tm\"\n    and \"\\<And>tm tf am. t = tm @ tf \\<Longrightarrow> Run m tm am \\<Longrightarrow> (f am, tf, Exception e) \\<in> Traces \\<Longrightarrow> trace_enabled (run s tm) tf\"\n  shows \"trace_enabled s t\"\nproof (use assms in \\<open>cases rule: bind_Traces_cases\\<close>)\n  case (Left m'')\n  then consider (Ex) \"m'' = Exception e\" | (Done) a where \"m'' = Done a\" and \"f a = Exception e\"\n    by (cases m'') auto\n  then show ?thesis\n    using \\<open>(m, t, m'') \\<in> Traces\\<close> assms\n    by cases auto\nnext\n  case (Bind tm am tf)\n  then show ?thesis\n    using assms\n    by (auto simp: trace_enabled_append_iff)\nqed\n\nlemma bind_Traces_trace_enabled[trace_elim]:\n  assumes \"(m \\<bind> f, t, m') \\<in> Traces\"\n    and \"\\<And>tm tf m''. (m, tm, m'') \\<in> Traces \\<Longrightarrow> t = tm @ tf \\<Longrightarrow> trace_enabled s tm\"\n    and \"\\<And>tm am tf. (f am, tf, m') \\<in> Traces \\<Longrightarrow> Run m tm am \\<Longrightarrow> t = tm @ tf \\<Longrightarrow> trace_enabled (run s tm) tf\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (elim bind_TracesE) (auto simp: trace_enabled_append_iff)\n\nlemma try_catch_trace_enabled[trace_elim]:\n  assumes \"(try_catch m h, t, m') \\<in> Traces\"\n    and \"\\<And>n m''. (m, take n t, m'') \\<in> Traces \\<Longrightarrow> trace_enabled s (take n t)\"\n    and \"\\<And>tm ex th. (h ex, th, m') \\<in> Traces \\<Longrightarrow> (m, tm, Exception ex) \\<in> Traces \\<Longrightarrow> t = tm @ th \\<Longrightarrow> trace_enabled (run s tm) th\"\n  shows \"trace_enabled s t\"\nproof (use assms in \\<open>cases rule: try_catch_Traces_cases\\<close>)\n  case (NoEx m'')\n  then show ?thesis using assms(2)[of \"length t\" m''] by auto\nnext\n  case (Ex tm ex th)\n  then show ?thesis using assms(2)[of \"length tm\"] assms(3) by (auto simp: trace_enabled_append_iff)\nqed\n\nlemma if_Traces_trace_enabled[trace_elim]:\n  assumes \"(if b then m1 else m2, t, m') \\<in> Traces\"\n    and \"b \\<Longrightarrow> (m1, t, m') \\<in> Traces \\<Longrightarrow> trace_enabled s t\"\n    and \"\\<not>b \\<Longrightarrow> (m2, t, m') \\<in> Traces \\<Longrightarrow> trace_enabled s t\"\n  shows \"trace_enabled s t\"\n  using assms by (cases b) auto\n\nlemma let_Traces_trace_enabled[trace_elim]:\n  assumes \"(let x = y in f x, t, m') \\<in> Traces\"\n    and \"(f y, t, m') \\<in> Traces \\<Longrightarrow> trace_enabled s t\"\n  shows \"trace_enabled s t\"\n  using assms by auto\n\nlemma case_prod_Traces_trace_enabled[trace_elim]:\n  assumes \"(case p of (a, b) \\<Rightarrow> f a b, t, m') \\<in> Traces\"\n    and \"\\<And>x y. p = (x, y) \\<Longrightarrow> (f x y, t, m') \\<in> Traces \\<Longrightarrow> trace_enabled s t\"\n  shows \"trace_enabled s t\"\n  using assms by (cases p) auto\n\nlemma case_option_Traces_trace_enabled[trace_elim]:\n  assumes \"(case x of Some y \\<Rightarrow> f y | None \\<Rightarrow> m, t, m') \\<in> Traces\"\n    and \"\\<And>y. (f y, t, m') \\<in> Traces \\<Longrightarrow> x = Some y \\<Longrightarrow> trace_enabled s t\"\n    and \"(m, t, m') \\<in> Traces \\<Longrightarrow> x = None \\<Longrightarrow> trace_enabled s t\"\n  shows \"trace_enabled s t\"\n  using assms by (cases x) auto\n\nlemma return_trace_enabled[trace_elim]:\n  assumes \"(return a, t, m') \\<in> Traces\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (auto simp: return_def)\n\nlemma throw_trace_enabled[trace_elim]:\n  assumes \"(throw e, t, m') \\<in> Traces\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (auto simp: throw_def)\n\nlemma early_return_trace_enabled[trace_elim]:\n  assumes \"(early_return a, t, m') \\<in> Traces\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (auto simp: early_return_def elim!: trace_elim)\n\nlemma catch_early_return_trace_enabled[trace_elim]:\n  assumes \"(catch_early_return m, t, m') \\<in> Traces\"\n    and \"\\<And>n m''. (m, take n t, m'') \\<in> Traces \\<Longrightarrow> trace_enabled s (take n t)\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (auto simp: catch_early_return_def elim!: trace_elim split: sum.splits)\n\nlemma liftR_trace_enabled[trace_elim]:\n  assumes \"(liftR m, t, m') \\<in> Traces\"\n    and \"\\<And>n m''. (m, take n t, m'') \\<in> Traces \\<Longrightarrow> trace_enabled s (take n t)\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (auto simp: liftR_def elim!: trace_elim)\n\nlemma foreachM_inv_trace_enabled:\n  assumes \"(foreachM xs vars body, t, m') \\<in> Traces\"\n    and \"\\<And>s x vars t m'. (body x vars, t, m') \\<in> Traces \\<Longrightarrow> P s \\<Longrightarrow> x \\<in> set xs \\<Longrightarrow> trace_enabled s t\"\n    and \"\\<And>s x vars t vars'. Run (body x vars) t vars' \\<Longrightarrow> P s \\<Longrightarrow> x \\<in> set xs \\<Longrightarrow> P (run s t)\"\n    and \"P s\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (induction xs arbitrary: s t vars) (auto simp: trace_enabled_append_iff elim!: trace_elim)\n\nlemma foreachM_const_trace_enabled[trace_elim]:\n  assumes \"(foreachM xs vars body, t, m') \\<in> Traces\"\n    and \"\\<And>x vars t m'. (body x vars, t, m') \\<in> Traces \\<Longrightarrow> x \\<in> set xs \\<Longrightarrow> trace_enabled s t\"\n    and \"\\<And>x vars t vars'. Run (body x vars) t vars' \\<Longrightarrow> x \\<in> set xs \\<Longrightarrow> run s t = s\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (elim foreachM_inv_trace_enabled[where P = \"\\<lambda>s'. s' = s\"]) auto\n\nlemma Run_and_boolM_trace_enabled[trace_elim]:\n  assumes \"Run (and_boolM l r) t a\"\n    and \"\\<And>tl tr al. t = tl @ tr \\<Longrightarrow> Run l tl al \\<Longrightarrow> trace_enabled s tl\"\n    and \"\\<And>tl tr. t = tl @ tr \\<Longrightarrow> Run l tl True \\<Longrightarrow> Run r tr a \\<Longrightarrow> trace_enabled (run s tl) tr\"\n  shows \"trace_enabled s t\"\n  using assms\n  unfolding and_boolM_def\n  by (elim Run_bind_trace_enabled) (auto simp: return_def split: if_splits)\n\nlemma and_boolM_trace_enabled[trace_elim]:\n  assumes \"(and_boolM m1 m2, t, m') \\<in> Traces\"\n    and \"\\<And>tm tf m''. (m1, tm, m'') \\<in> Traces \\<Longrightarrow> t = tm @ tf \\<Longrightarrow> trace_enabled s tm\"\n    and \"\\<And>tm tf. (m2, tf, m') \\<in> Traces \\<Longrightarrow> Run m1 tm True \\<Longrightarrow> t = tm @ tf \\<Longrightarrow> trace_enabled (run s tm) tf\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (auto simp: and_boolM_def elim!: trace_elim)\n\nlemma Run_or_boolM_trace_enabled[trace_elim]:\n  assumes \"Run (or_boolM l r) t a\"\n    and \"\\<And>tl tr al. t = tl @ tr \\<Longrightarrow> Run l tl al \\<Longrightarrow> trace_enabled s tl\"\n    and \"\\<And>tl tr. t = tl @ tr \\<Longrightarrow> Run l tl False \\<Longrightarrow> Run r tr a \\<Longrightarrow> trace_enabled (run s tl) tr\"\n  shows \"trace_enabled s t\"\n  using assms\n  unfolding or_boolM_def\n  by (elim Run_bind_trace_enabled) (auto simp: return_def split: if_splits)\n\nlemma or_boolM_trace_enabled[trace_elim]:\n  assumes \"(or_boolM m1 m2, t, m') \\<in> Traces\"\n    and \"\\<And>tm tf m''. (m1, tm, m'') \\<in> Traces \\<Longrightarrow> t = tm @ tf \\<Longrightarrow> trace_enabled s tm\"\n    and \"\\<And>tm tf. (m2, tf, m') \\<in> Traces \\<Longrightarrow> Run m1 tm False \\<Longrightarrow> t = tm @ tf \\<Longrightarrow> trace_enabled (run s tm) tf\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (auto simp: or_boolM_def elim!: trace_elim)\n\nend\n\ntext \\<open>An automaton for the axiom that capabilities stored to memory must be derivable from\naccessible capabilities\\<close>\n\nrecord ('cap, 'regval) axiom_state =\n  accessed_caps :: \"'cap set\"\n  system_reg_access :: bool\n  read_from_KCC :: \"'regval set\"\n  written_regs :: \"string set\"\n\nlocale Cap_Axiom_Automaton = Capability_ISA CC ISA\n  for CC :: \"'cap Capability_class\" and ISA :: \"('cap, 'regval, 'instr, 'e) isa\" +\n  fixes enabled :: \"('cap, 'regval) axiom_state \\<Rightarrow> 'regval event \\<Rightarrow> bool\"\nbegin\n\ndefinition accessible_regs :: \"('cap, 'regval) axiom_state \\<Rightarrow> register_name set\" where\n  \"accessible_regs s = {r. r \\<notin> written_regs s \\<and> (r \\<in> privileged_regs ISA \\<longrightarrow> system_reg_access s)}\"\n\ndefinition axiom_step :: \"('cap, 'regval) axiom_state \\<Rightarrow> 'regval event \\<Rightarrow> ('cap, 'regval) axiom_state\" where\n  \"axiom_step s e = \\<lparr>accessed_caps = accessed_caps s \\<union> accessed_mem_caps e \\<union> accessed_reg_caps (accessible_regs s) e,\n                     system_reg_access = system_reg_access s \\<or> allows_system_reg_access (accessible_regs s) e,\n                     read_from_KCC = read_from_KCC s \\<union> {v. \\<exists>r \\<in> KCC ISA. e = E_read_reg r v},\n                     written_regs = written_regs s \\<union> {r. \\<exists>v c. e = E_write_reg r v \\<and> c \\<in> caps_of_regval ISA v \\<and> is_tagged_method CC c}\\<rparr>\"\n\nlemma step_selectors[simp]:\n  \"accessed_caps (axiom_step s e) = accessed_caps s \\<union> accessed_mem_caps e \\<union> accessed_reg_caps (accessible_regs s) e\"\n  \"system_reg_access (axiom_step s e) \\<longleftrightarrow> system_reg_access s \\<or> allows_system_reg_access (accessible_regs s) e\"\n  \"read_from_KCC (axiom_step s e) = read_from_KCC s \\<union> {v. \\<exists>r \\<in> KCC ISA. e = E_read_reg r v}\"\n  \"written_regs (axiom_step s e) = written_regs s \\<union> {r. \\<exists>v c. e = E_write_reg r v \\<and> c \\<in> caps_of_regval ISA v \\<and> is_tagged_method CC c}\"\n  by (auto simp: axiom_step_def)\n\nabbreviation \"initial \\<equiv> \\<lparr>accessed_caps = {}, system_reg_access = False, read_from_KCC = {}, written_regs = {}\\<rparr>\"\n\nlemma accessible_regs_initial_iff[simp]:\n  \"r \\<in> accessible_regs initial \\<longleftrightarrow> r \\<notin> privileged_regs ISA\"\n  by (auto simp: accessible_regs_def)\n\nsublocale Deterministic_Automaton enabled axiom_step initial \"\\<lambda>_. True\" .\n\nlemma cap_reg_written_before_idx_written_regs:\n  \"cap_reg_written_before_idx CC ISA i r t \\<longleftrightarrow> r \\<in> written_regs (run initial (take i t))\"\nproof (induction i)\n  case (Suc i)\n  then show ?case\n    by (cases \"i < length t\") (auto simp: take_Suc_conv_app_nth)\nqed auto\n\nlemma accessible_regs_axiom_step:\n  \"accessible_regs (axiom_step s e) =\n     accessible_regs s \\<union>\n     (if allows_system_reg_access (accessible_regs s) e then privileged_regs ISA else {}) -\n     written_regs (axiom_step s e)\"\n  by (auto simp: accessible_regs_def)\n\nlemma system_reg_access_run_take_eq[simp]:\n  \"system_access_permitted_before_idx CC ISA i t \\<longleftrightarrow> system_reg_access (run initial (take i t))\"\n    (is \"?sys_reg_access i\")\n  \"accessible_regs_at_idx i t = accessible_regs (run initial (take i t))\"\n    (is \"?accessible_regs i\")\nproof (induction i)\n  case (Suc i)\n  show \"?accessible_regs (Suc i)\"\n    by (cases \"i < length t\")\n       (auto simp: Suc.IH accessible_regs_def accessible_regs_at_idx_def\n                   cap_reg_written_before_idx_written_regs take_Suc_conv_app_nth)\n  show \"?sys_reg_access (Suc i)\"\n    by (cases \"i < length t\") (auto simp: Suc.IH take_Suc_conv_app_nth)\nqed (auto simp: accessible_regs_def)\n\nlemma accessed_caps_run_take_eq[simp]:\n  \"available_caps CC ISA i t = accessed_caps (run initial (take i t))\"\nproof (induction i)\n  case (Suc i)\n  then show ?case\n    by (cases \"i < length t\") (auto simp add: available_caps_Suc take_Suc_conv_app_nth)\nqed auto\n\nlemma read_from_KCC_run_take_eq:\n  \"read_from_KCC (run initial (take i t)) = {v. \\<exists>r j. j < i \\<and> j < length t \\<and> t ! j = E_read_reg r v \\<and> r \\<in> KCC ISA}\"\nproof (induction i)\n  case (Suc i)\n  then show ?case\n    using system_reg_access_run_take_eq(1)[of i t]\n    by (cases \"i < length t\") (auto simp: take_Suc_conv_app_nth less_Suc_eq)\nqed auto\n\nlemma write_only_regs_run_take_eq:\n  \"written_regs (run initial (take i t)) = {r. \\<exists>v c j. t ! j = E_write_reg r v \\<and> j < i \\<and> j < length t \\<and> c \\<in> caps_of_regval ISA v \\<and> is_tagged_method CC c}\"\nproof (induction i)\n  case (Suc i)\n  then show ?case\n    by (cases \"i < length t\") (auto simp: take_Suc_conv_app_nth less_Suc_eq)\nqed auto\n\nlemmas step_defs = axiom_step_def reads_mem_cap_def\n\nabbreviation \"special_reg_names \\<equiv> PCC ISA \\<union> IDC ISA \\<union> KCC ISA \\<union> privileged_regs ISA\"\n\ndefinition non_cap_reg :: \"('regstate, 'regval, 'a) register_ref \\<Rightarrow> bool\" where\n  \"non_cap_reg r \\<equiv>\n     name r \\<notin> PCC ISA \\<union> IDC ISA \\<union> KCC ISA \\<union> privileged_regs ISA \\<and>\n     (\\<forall>rv v. of_regval r rv = Some v \\<longrightarrow> caps_of_regval ISA rv = {}) \\<and>\n     (\\<forall>v. caps_of_regval ISA (regval_of r v) = {})\"\n\nfun non_cap_event :: \"'regval event \\<Rightarrow> bool\" where\n  \"non_cap_event (E_read_reg r v) = (r \\<notin> PCC ISA \\<union> IDC ISA \\<union> KCC ISA \\<union> privileged_regs ISA \\<and> caps_of_regval ISA v = {})\"\n| \"non_cap_event (E_write_reg r v) = (r \\<notin> PCC ISA \\<union> IDC ISA \\<union> KCC ISA \\<union> privileged_regs ISA \\<and> caps_of_regval ISA v = {})\"\n| \"non_cap_event (E_read_memt _ _ _ _) = False\"\n| \"non_cap_event (E_read_mem _ _ _ _) = False\"\n| \"non_cap_event (E_write_memt _ _ _ _ _ _) = False\"\n| \"non_cap_event (E_write_mem _ _ _ _ _) = False\"\n| \"non_cap_event _ = True\"\n\nfun non_mem_event :: \"'regval event \\<Rightarrow> bool\" where\n  \"non_mem_event (E_read_memt _ _ _ _) = False\"\n| \"non_mem_event (E_read_mem _ _ _ _) = False\"\n| \"non_mem_event (E_write_memt _ _ _ _ _ _) = False\"\n| \"non_mem_event (E_write_mem _ _ _ _ _) = False\"\n| \"non_mem_event _ = True\"\n\ndefinition non_cap_trace :: \"'regval trace \\<Rightarrow> bool\" where\n  \"non_cap_trace t \\<equiv> (\\<forall>e \\<in> set t. non_cap_event e)\"\n\ndefinition non_mem_trace :: \"'regval trace \\<Rightarrow> bool\" where\n  \"non_mem_trace t \\<equiv> (\\<forall>e \\<in> set t. non_mem_event e)\"\n\nlemma non_cap_trace_Nil[intro, simp]:\n  \"non_cap_trace []\"\n  by (auto simp: non_cap_trace_def)\n\nlemma non_cap_trace_Cons[iff]:\n  \"non_cap_trace (e # t) \\<longleftrightarrow> non_cap_event e \\<and> non_cap_trace t\"\n  by (auto simp: non_cap_trace_def)\n\nlemma non_cap_trace_append[iff]:\n  \"non_cap_trace (t1 @ t2) \\<longleftrightarrow> non_cap_trace t1 \\<and> non_cap_trace t2\"\n  by (induction t1) auto\n\nlemma non_mem_trace_Nil[intro, simp]:\n  \"non_mem_trace []\"\n  by (auto simp: non_mem_trace_def)\n\nlemma non_mem_trace_Cons[iff]:\n  \"non_mem_trace (e # t) \\<longleftrightarrow> non_mem_event e \\<and> non_mem_trace t\"\n  by (auto simp: non_mem_trace_def)\n\nlemma non_mem_trace_append[iff]:\n  \"non_mem_trace (t1 @ t2) \\<longleftrightarrow> non_mem_trace t1 \\<and> non_mem_trace t2\"\n  by (induction t1) auto\n\nlemma non_cap_event_non_mem_event:\n  \"non_mem_event e\" if \"non_cap_event e\"\n  using that\n  by (cases e) auto\n\nlemma non_cap_trace_non_mem_trace:\n  \"non_mem_trace t\" if \"non_cap_trace t\"\n  using that\n  by (auto simp: non_mem_trace_def non_cap_trace_def intro: non_cap_event_non_mem_event)\n\nlemma non_cap_event_axiom_step_inv:\n  assumes \"non_cap_event e\"\n  shows \"axiom_step s e = s\"\n  using assms\n  by (elim non_cap_event.elims) (auto simp: step_defs bind_eq_Some_conv split: option.splits)\n\nlemma non_cap_trace_run_inv:\n  assumes \"non_cap_trace t\"\n  shows \"run s t = s\"\n  using assms\n  by (induction t) (auto simp: non_cap_event_axiom_step_inv)\n\ndefinition non_cap_exp :: \"('regval, 'a, 'exception) monad \\<Rightarrow> bool\" where\n  \"non_cap_exp m = (\\<forall>t m'. (m, t, m') \\<in> Traces \\<longrightarrow> (non_cap_trace t \\<or> (\\<exists>t' r v msg. t = t' @ [E_read_reg r v] \\<and> r \\<notin> special_reg_names \\<and> non_cap_trace t' \\<and> m' = Fail msg)))\"\n\ndefinition non_mem_exp :: \"('regval, 'a, 'exception) monad \\<Rightarrow> bool\" where\n  \"non_mem_exp m = (\\<forall>t m'. (m, t, m') \\<in> Traces \\<longrightarrow> non_mem_trace t)\"\n\nlemma non_cap_exp_Traces_cases:\n  assumes \"non_cap_exp m\"\n    and \"(m, t, m') \\<in> Traces\"\n  obtains (Non_cap) \"non_cap_trace t\"\n  | (Fail) t' r v msg where \"t = t' @ [E_read_reg r v]\" and \"r \\<notin> special_reg_names\" and \"m' = Fail msg\" and \"non_cap_trace t'\"\n  using assms\n  unfolding non_cap_exp_def\n  by blast\n\nlemma non_cap_exp_non_mem_exp:\n  \"non_mem_exp m\" if \"non_cap_exp m\"\n  by (auto simp: non_mem_exp_def elim!: non_cap_exp_Traces_cases[OF that] intro: non_cap_trace_non_mem_trace)\n\nlemma non_cap_exp_Run_non_cap_trace:\n  assumes m: \"non_cap_exp m\"\n    and t: \"Run m t a\"\n  shows \"non_cap_trace t\"\n  using t\n  by (elim non_cap_exp_Traces_cases[OF m]) auto\n\nlemmas non_cap_exp_Run_run_invI = non_cap_exp_Run_non_cap_trace[THEN non_cap_trace_run_inv]\n\nnamed_theorems non_cap_expI\nnamed_theorems non_mem_expI\n\nlemma non_cap_exp_return[non_cap_expI]:\n  \"non_cap_exp (return a)\"\n  by (auto simp: non_cap_exp_def return_def)\n\nlemma non_cap_exp_bindI[intro!]:\n  assumes m: \"non_cap_exp m\"\n    and f: \"\\<And>t a. Run m t a \\<Longrightarrow> non_cap_exp (f a)\"\n  shows \"non_cap_exp (m \\<bind> f)\"\nproof (unfold non_cap_exp_def, intro allI impI)\n  fix t m'\n  assume \"(m \\<bind> f, t, m') \\<in> Traces\"\n  then show \"non_cap_trace t \\<or> (\\<exists>t' r v msg. t = t' @ [E_read_reg r v] \\<and> r \\<notin> special_reg_names \\<and> non_cap_trace t' \\<and> m' = Fail msg)\"\n  proof (cases rule: bind_Traces_cases)\n    case (Left m'')\n    then show ?thesis\n      by (elim non_cap_exp_Traces_cases[OF m]) auto\n  next\n    case (Bind tm am tf)\n    then show ?thesis\n      using non_cap_exp_Run_non_cap_trace[OF m \\<open>Run m tm am\\<close>]\n      by (elim f[OF \\<open>Run m tm am\\<close>, THEN non_cap_exp_Traces_cases]) auto\n  qed\nqed\n\nlemma non_mem_exp_bindI[intro!]:\n  assumes \"non_mem_exp m\"\n    and \"\\<And>t a. Run m t a \\<Longrightarrow> non_mem_exp (f a)\"\n  shows \"non_mem_exp (m \\<bind> f)\"\n  using assms\n  by (fastforce simp: non_mem_exp_def elim!: bind_Traces_cases)\n\nlemma non_cap_exp_try_catch[intro!]:\n  assumes m: \"non_cap_exp m\"\n    and h: \"\\<And>t ex. (m, t, Exception ex) \\<in> Traces \\<Longrightarrow> non_cap_exp (h ex)\"\n  shows \"non_cap_exp (try_catch m h)\"\nproof (unfold non_cap_exp_def, intro allI impI)\n  fix t m'\n  assume \"(try_catch m h, t, m') \\<in> Traces\"\n  then show \"non_cap_trace t \\<or> (\\<exists>t' r v msg. t = t' @ [E_read_reg r v] \\<and> r \\<notin> special_reg_names \\<and> non_cap_trace t' \\<and> m' = Fail msg)\"\n  proof (cases rule: try_catch_Traces_cases)\n    case (NoEx m'')\n    then show ?thesis\n      by (elim non_cap_exp_Traces_cases[OF m]) auto\n  next\n    case (Ex tm ex th)\n    then show ?thesis\n      by (elim non_cap_exp_Traces_cases[OF m]\n               h[OF \\<open>(m, tm, Exception ex) \\<in> Traces\\<close>, THEN non_cap_exp_Traces_cases])\n         auto\n  qed\nqed\n\nlemma non_mem_exp_try_catch:\n  assumes \"non_mem_exp m\"\n    and \"\\<And>t ex. (m, t, Exception ex) \\<in> Traces \\<Longrightarrow> non_mem_exp (h ex)\"\n  shows \"non_mem_exp (try_catch m h)\"\n  using assms\n  by (fastforce simp: non_mem_exp_def elim!: try_catch_Traces_cases)\n\nlemma non_cap_exp_throw[non_cap_expI]:\n  \"non_cap_exp (throw e)\"\n  by (auto simp: non_cap_exp_def)\n\nlemma non_cap_exp_early_return[non_cap_expI]:\n  \"non_cap_exp (early_return a)\"\n  by (auto simp: early_return_def intro!: non_cap_expI)\n\nlemma non_cap_exp_catch_early_return[intro!]:\n  \"non_cap_exp (catch_early_return m)\" if \"non_cap_exp m\"\n  by (auto simp: catch_early_return_def intro!: that non_cap_expI split: sum.splits)\n\nlemma non_mem_exp_catch_early_return:\n  \"non_mem_exp (catch_early_return m)\" if \"non_mem_exp m\"\n  by (auto simp: catch_early_return_def intro!: that non_mem_exp_try_catch non_cap_expI[THEN non_cap_exp_non_mem_exp] split: sum.splits)\n\nlemma non_cap_exp_liftR[intro!]:\n  \"non_cap_exp (liftR m)\" if \"non_cap_exp m\"\n  by (auto simp: liftR_def intro!: that non_cap_expI)\n\nlemma non_mem_exp_liftR:\n  \"non_mem_exp (liftR m)\" if \"non_mem_exp m\"\n  by (auto simp: liftR_def intro!: that non_mem_exp_try_catch non_cap_expI[THEN non_cap_exp_non_mem_exp])\n\nlemma non_cap_exp_assert_exp[non_cap_expI]:\n  \"non_cap_exp (assert_exp c msg)\"\n  by (auto simp: assert_exp_def non_cap_exp_def)\n\nlemma non_cap_exp_foreachM[intro]:\n  assumes \"\\<And>x vars. x \\<in> set xs \\<Longrightarrow> non_cap_exp (body x vars)\"\n  shows \"non_cap_exp (foreachM xs vars body)\"\n  using assms\n  by (induction xs vars body rule: foreachM.induct) (auto intro: non_cap_expI)\n\nlemma non_mem_exp_foreachM:\n  assumes \"\\<And>x vars. x \\<in> set xs \\<Longrightarrow> non_mem_exp (body x vars)\"\n  shows \"non_mem_exp (foreachM xs vars body)\"\n  using assms\n  by (induction xs vars body rule: foreachM.induct) (auto intro: non_cap_expI[THEN non_cap_exp_non_mem_exp])\n\nlemma non_cap_exp_choose_bool[non_cap_expI]:\n  \"non_cap_exp (choose_bool desc)\"\n  by (auto simp: choose_bool_def non_cap_exp_def elim: Traces_cases)\n\nlemma non_cap_exp_undefined_bool[non_cap_expI]:\n  \"non_cap_exp (undefined_bool ())\"\n  by (auto simp: undefined_bool_def intro: non_cap_expI)\n\nlemma non_cap_exp_bool_of_bitU_nondet[non_cap_expI]:\n  \"non_cap_exp (bool_of_bitU_nondet b)\"\n  unfolding bool_of_bitU_nondet_def\n  by (cases b) (auto intro: non_cap_expI)\n\nlemma non_cap_exp_genlistM:\n  assumes \"\\<And>n. non_cap_exp (f n)\"\n  shows \"non_cap_exp (genlistM f n)\"\n  using assms\n  by (auto simp: genlistM_def intro!: non_cap_expI)\n\nlemma non_cap_exp_choose_bools[non_cap_expI]:\n  \"non_cap_exp (choose_bools desc n)\"\n  by (auto simp: choose_bools_def intro: non_cap_expI non_cap_exp_genlistM)\n\nlemma non_cap_exp_Fail[non_cap_expI]:\n  \"non_cap_exp (Fail msg)\"\n  by (auto simp: non_cap_exp_def)\n\nlemma non_cap_exp_exit[non_cap_expI]:\n  \"non_cap_exp (exit0 ())\"\n  unfolding exit0_def\n  by (rule non_cap_exp_Fail)\n\nlemma non_cap_exp_chooseM[non_cap_expI]:\n  \"non_cap_exp (chooseM desc xs)\"\n  by (auto simp: chooseM_def intro!: non_cap_expI split: option.splits)\n\nlemma non_cap_exp_internal_pick[non_cap_expI]:\n  \"non_cap_exp (internal_pick xs)\"\n  by (auto simp: internal_pick_def intro!: non_cap_expI)\n\nlemma non_cap_exp_and_boolM[intro!]:\n  \"non_cap_exp (and_boolM m1 m2)\" if \"non_cap_exp m1\" and \"non_cap_exp m2\"\n  by (auto simp: and_boolM_def intro!: that non_cap_expI)\n\nlemma non_mem_exp_and_boolM:\n  \"non_mem_exp (and_boolM m1 m2)\" if \"non_mem_exp m1\" and \"non_mem_exp m2\"\n  by (auto simp: and_boolM_def intro!: that non_cap_expI[THEN non_cap_exp_non_mem_exp])\n\nlemma non_cap_exp_or_boolM[intro!]:\n  \"non_cap_exp (or_boolM m1 m2)\" if \"non_cap_exp m1\" and \"non_cap_exp m2\"\n  by (auto simp: or_boolM_def intro!: that non_cap_expI)\n\nlemma non_mem_exp_or_boolM:\n  \"non_mem_exp (or_boolM m1 m2)\" if \"non_mem_exp m1\" and \"non_mem_exp m2\"\n  by (auto simp: or_boolM_def intro!: that non_cap_expI[THEN non_cap_exp_non_mem_exp])\n\nlemma non_cap_exp_let[intro!]:\n  \"non_cap_exp (let x = a in m x)\" if \"non_cap_exp (m a)\"\n  by (auto intro: that)\n\nlemma non_mem_exp_let:\n  \"non_mem_exp (let x = a in m x)\" if \"non_mem_exp (m a)\"\n  by (auto intro: that)\n\nlemma non_cap_exp_if:\n  assumes \"c \\<Longrightarrow> non_cap_exp m1\" and \"\\<not>c \\<Longrightarrow> non_cap_exp m2\"\n  shows \"non_cap_exp (if c then m1 else m2)\"\n  using assms\n  by auto\n\nlemma non_mem_exp_if:\n  assumes \"c \\<Longrightarrow> non_mem_exp m1\" and \"\\<not>c \\<Longrightarrow> non_mem_exp m2\"\n  shows \"non_mem_exp (if c then m1 else m2)\"\n  using assms\n  by auto\n\nlemma non_cap_exp_read_non_cap_reg:\n  assumes \"non_cap_reg r\"\n  shows \"non_cap_exp (read_reg r :: ('regval, 'r, 'exception) monad)\"\nproof -\n  have \"non_cap_trace t \\<or> (\\<exists>v msg. t = [E_read_reg (name r) v] \\<and> name r \\<notin> special_reg_names \\<and> m' = Fail msg)\"\n    if \"(read_reg r, t, m' :: ('regval, 'r, 'exception) monad) \\<in> Traces\" for t m'\n    using that assms\n    by (auto simp: read_reg_def non_cap_exp_def non_cap_reg_def elim!: Read_reg_TracesE split: option.splits)\n  then show ?thesis\n    unfolding non_cap_exp_def\n    by blast\nqed\n\nlemma\n  non_mem_exp_read_reg[non_mem_expI]: \"non_mem_exp (read_reg r)\" and\n  non_mem_exp_write_reg[non_mem_expI]: \"non_mem_exp (write_reg r v)\"\n  unfolding non_mem_exp_def read_reg_def write_reg_def\n  by (auto elim!: Read_reg_TracesE Write_reg_TracesE split: option.splits)\n\nlemma non_cap_exp_write_non_cap_reg:\n  assumes \"non_cap_reg r\"\n  shows \"non_cap_exp (write_reg r v)\"\n  using assms\n  unfolding write_reg_def\n  by (auto simp: non_cap_exp_def non_cap_reg_def elim!: Write_reg_TracesE)\n\nmethod non_cap_expI uses simp =\n  (auto simp: simp intro!: non_cap_expI non_cap_exp_if non_cap_exp_read_non_cap_reg non_cap_exp_write_non_cap_reg\n        split del: if_split split: option.split sum.split prod.split)\n\nlemmas non_mem_exp_combinators =\n  non_mem_exp_bindI non_mem_exp_if non_mem_exp_let non_mem_exp_and_boolM non_mem_exp_or_boolM\n  non_mem_exp_foreachM non_mem_exp_try_catch non_mem_exp_catch_early_return non_mem_exp_liftR\n\nmethod non_mem_expI uses simp =\n  (auto simp: simp intro!: non_mem_expI non_mem_exp_combinators non_cap_expI[THEN non_cap_exp_non_mem_exp]\n        split del: if_split split: option.split sum.split prod.split)\n\nlemma Run_write_reg_no_cap[trace_simp]:\n  assumes \"Run (write_reg r v) t a\"\n    and \"non_cap_reg r\"\n  shows \"run s t = s\"\n  using assms\n  by (cases s) (auto simp: write_reg_def step_defs non_cap_reg_def elim!: Write_reg_TracesE)\n\nlemma Run_write_reg_run_gen:\n  assumes \"Run (write_reg r v) t a\"\n  shows \"run s t =\n           s\\<lparr>written_regs := written_regs s \\<union>\n                                (if (\\<exists>c \\<in> caps_of_regval ISA (regval_of r v). is_tagged_method CC c)\n                                 then {name r} else {})\\<rparr>\"\n  using assms\n  by (cases s) (auto simp: write_reg_def step_defs elim!: Write_reg_TracesE)\n\nlemma Run_read_non_cap_reg_run[trace_simp]:\n  assumes \"Run (read_reg r) t v\"\n    and \"non_cap_reg r\"\n  shows \"run s t = s\"\n  using assms\n  by (auto simp: step_defs non_cap_reg_def elim!: Run_read_regE)\n\nlemma no_reg_writes_to_written_regs_run_inv[trace_simp]:\n  assumes \"Run m t a\"\n    and \"no_reg_writes_to UNIV m\"\n  shows \"written_regs (run s t) = written_regs s\"\nproof -\n  have \"E_write_reg r v \\<notin> set t\" for r v\n    using assms\n    by (auto simp: no_reg_writes_to_def)\n  then show ?thesis\n    by (induction t rule: rev_induct) auto\nqed\n\nmethod trace_enabledI uses simp elim =\n  (auto simp: simp trace_simp elim!: elim trace_elim)\n\nend\n\n(*locale Store_Cap_Mem_Automaton = Capability_ISA CC ISA\n  for CC :: \"'cap Capability_class\"\n  and ISA :: \"('cap, 'regval, 'instr, 'e) isa\"\nbegin\n\ndefinition enabled :: \"('cap, 'regval) axiom_state \\<Rightarrow> 'regval event \\<Rightarrow> bool\" where\n  \"enabled s e \\<equiv> (\\<forall> c. \\<forall> addr. \\<forall> sz. \n     ((writes_mem_cap CC e = Some (addr, sz, c)) \\<and> (is_tagged_method   CC) c)\n     \\<longrightarrow>\n     (c \\<in> derivable (accessed_caps s)))\"\n\nsublocale Cap_Axiom_Automaton CC ISA enabled ..\n\nlemma non_cap_event_enabledI:\n  assumes \"non_cap_event e\"\n  shows \"enabled s e\"\n  using assms\n  by (elim non_cap_event.elims) (auto simp: enabled_def writes_mem_cap_def bind_eq_Some_conv)\n\nlemma non_cap_trace_enabledI:\n  assumes \"non_cap_trace t\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (induction t) (auto simp: non_cap_event_enabledI non_cap_event_axiom_step_inv)\n\nlemma enabled_E_read_reg:\n  \"enabled s (E_read_reg r v)\"\n  by (auto simp: enabled_def writes_mem_cap_def)\n\nlemma non_cap_exp_trace_enabledI:\n  assumes \"non_cap_exp m\"\n    and \"(m, t, m') \\<in> Traces\"\n  shows \"trace_enabled s t\"\n  by (cases rule: non_cap_exp_Traces_cases[OF assms])\n     (auto intro: non_cap_trace_enabledI enabled_E_read_reg simp: trace_enabled_append_iff)\n\nlemma recognises_store_cap_mem_axiom:\n  \"store_cap_mem_axiom CC ISA t \\<longleftrightarrow> accepts t\"\n  by (auto simp: accepts_from_iff_all_enabled_final store_cap_mem_axiom_def enabled_def\n                 cap_derivable_iff_derivable writes_mem_cap_Some_iff)\n\nend*)\n\nlocale Write_Cap_Automaton = Capability_ISA CC ISA\n  for CC :: \"'cap Capability_class\" and ISA :: \"('cap, 'regval, 'instr, 'e) isa\" +\n  fixes ex_traces :: bool and invocation_traces :: bool\nbegin\n\nfun enabled :: \"('cap, 'regval) axiom_state \\<Rightarrow> 'regval event \\<Rightarrow> bool\" where\n  \"enabled s (E_write_reg r v) =\n     (\\<forall>c. (c \\<in> caps_of_regval ISA v \\<and> is_tagged_method CC c)\n         \\<longrightarrow>\n         (c \\<in> derivable (accessed_caps s) \\<or>\n          (c \\<in> exception_targets ISA (read_from_KCC s) \\<and> ex_traces \\<and> r \\<in> PCC ISA) \\<or>\n          (\\<exists>cc cd. invocation_traces \\<and> cc \\<in> derivable (accessed_caps s) \\<and> cd \\<in> derivable (accessed_caps s) \\<and>\n                   invokable CC cc cd \\<and> (r \\<in> PCC ISA \\<and> leq_cap CC c (unseal CC cc True) \\<or> r \\<in> IDC ISA \\<and> leq_cap CC c (unseal CC cd True)))))\"\n| \"enabled s (E_read_reg r v) = (r \\<in> privileged_regs ISA \\<longrightarrow> (system_reg_access s \\<or> ex_traces))\"\n| \"enabled s (E_write_memt _ addr sz bytes tag _) =\n     (\\<forall>c.  cap_of_mem_bytes_method CC bytes tag = Some c \\<and> is_tagged_method CC c \\<longrightarrow> c \\<in> derivable (accessed_caps s))\"\n| \"enabled s _ = True\"\n\nlemma enabled_E_write_reg_cases:\n  assumes \"enabled s (E_write_reg r v)\"\n    and \"c \\<in> caps_of_regval ISA v\"\n    and \"is_tagged_method CC c\"\n  obtains (Derivable) \"c \\<in> derivable (accessed_caps s)\"\n  | (KCC) \"c \\<in> exception_targets ISA (read_from_KCC s)\" and \"ex_traces\" and\n      \"r \\<in> PCC ISA\" and \"c \\<notin> derivable (accessed_caps s)\"\n  | (CCall) cc cd where \"invocation_traces\" and \"invokable CC cc cd\" and\n      \"cc \\<in> derivable (accessed_caps s)\" and \"cd \\<in> derivable (accessed_caps s)\" and\n      \"r \\<in> PCC ISA \\<and> leq_cap CC c (unseal CC cc True) \\<or> r \\<in> IDC ISA \\<and> leq_cap CC c (unseal CC cd True)\" and\n      \"c \\<notin> derivable (accessed_caps s)\"\n  using assms by (cases \"c \\<in> derivable (accessed_caps s)\") auto\n\nsublocale Cap_Axiom_Automaton CC ISA enabled ..\n\nlemma non_cap_event_enabledI:\n  assumes \"non_cap_event e\"\n  shows \"enabled s e\"\n  using assms\n  by (elim non_cap_event.elims) auto\n\nlemma non_cap_trace_enabledI:\n  assumes \"non_cap_trace t\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (induction t) (auto simp: non_cap_event_enabledI non_cap_event_axiom_step_inv)\n\nlemma non_cap_exp_trace_enabledI:\n  assumes \"non_cap_exp m\"\n    and \"(m, t, m') \\<in> Traces\"\n  shows \"trace_enabled s t\"\n  by (cases rule: non_cap_exp_Traces_cases[OF assms])\n     (auto intro: non_cap_trace_enabledI simp: trace_enabled_append_iff)\n\n(*lemma accepts_E_write_reg_not_read_after:\n  assumes \"accepts t\"\n    and \"i < length t\"\n    and \"index t i = Some (E_write_reg r v)\"\n    and \"c \\<in> caps_of_regval ISA v\"\n    and \"is_tagged_method CC c\"\n    and \"c \\<notin> derivable (available_caps CC ISA i t)\"\n    and \"r \\<in> PCC ISA \\<or> r \\<in> IDC ISA\"\n  shows \"reg_not_read_after i r t\"\n  using assms\n  unfolding accepts_from_iff_all_enabled_final reg_not_read_after_def\n  by (auto elim!: enabled.elims simp: write_only_regs_run_take_eq)*)\n\nlemma index_eq_some': \"(index l n = Some x) = (n < length l \\<and> l ! n = x)\"\n  by auto\n\nlemma recognises_store_cap_reg_read_reg_axioms:\n  assumes t: \"accepts t\"\n  shows \"store_cap_reg_axiom CC ISA ex_traces invocation_traces t\"\n    and \"store_cap_mem_axiom CC ISA t\"\n    and \"read_reg_axiom CC ISA ex_traces t\"\nproof -\n  show \"read_reg_axiom CC ISA ex_traces t\"\n    using assms (*read_from_KCC_run_take_eq[of \"length t\" t]*)\n    unfolding accepts_from_iff_all_enabled_final read_reg_axiom_def\n    by (auto elim!: enabled.elims)\n  show \"store_cap_reg_axiom CC ISA ex_traces invocation_traces t\"\n  proof (unfold store_cap_reg_axiom_def, intro allI impI, goal_cases Idx)\n    case (Idx i c r)\n    then show ?case\n    proof cases\n      assume i: \"i < length t\"\n      then obtain v where e: \"index t i = Some (E_write_reg r v)\"\n        and c: \"c \\<in> caps_of_regval ISA v\"\n        and tag: \"is_tagged_method CC c\"\n        using Idx\n        by (cases \"t ! i\") auto\n      then have \"enabled (run initial (take i t)) (E_write_reg r v)\"\n        using accepts_from_nth_enabledI[OF t i]\n        by auto\n      from this c tag\n      show ?thesis\n      proof (cases rule: enabled_E_write_reg_cases)\n        case Derivable\n        then show ?thesis\n          by (auto simp: cap_derivable_iff_derivable)\n      next\n        case KCC\n        (*then obtain r' j\n          where v': \"t ! j = E_read_reg r' v'\" and j: \"j < i\" and r': \"r' \\<in> KCC ISA\"\n          by (auto simp: read_from_KCC_run_take_eq)*)\n        show ?thesis\n          using (*j i v'[symmetric] r'*) KCC\n          unfolding index_eq_some'\n          by (auto simp: cap_derivable_iff_derivable read_from_KCC_run_take_eq)\n      next\n        case (CCall cc cd)\n        then show ?thesis\n          by (auto simp: cap_derivable_iff_derivable)\n      qed\n    qed auto\n  qed\n  show \"store_cap_mem_axiom CC ISA t\"\n    using assms\n    unfolding accepts_from_iff_all_enabled_final store_cap_mem_axiom_def\n    by (auto simp: cap_derivable_iff_derivable writes_mem_cap_Some_iff)\nqed\n\nend\n\nlocale Cap_Axiom_Inv_Automaton = Cap_Axiom_Automaton CC ISA enabled +\n  State_Invariant get_regval set_regval invariant inv_regs\n  for CC :: \"'cap Capability_class\" and ISA :: \"('cap, 'regval, 'instr, 'e) isa\"\n    and enabled :: \"('cap, 'regval) axiom_state \\<Rightarrow> 'regval event \\<Rightarrow> bool\"\n    and get_regval :: \"string \\<Rightarrow> 'regstate \\<Rightarrow> 'regval option\"\n    and set_regval :: \"string \\<Rightarrow> 'regval \\<Rightarrow> 'regstate \\<Rightarrow> 'regstate option\"\n    and invariant :: \"'regstate \\<Rightarrow> bool\" and inv_regs :: \"register_name set\" +\n  fixes ex_traces :: bool\n  assumes non_cap_event_enabled: \"\\<And>e. non_cap_event e \\<Longrightarrow> enabled s e\"\n    and read_non_special_regs_enabled: \"\\<And>r v. r \\<notin> PCC ISA \\<union> IDC ISA \\<union> KCC ISA \\<union> privileged_regs ISA \\<Longrightarrow> enabled s (E_read_reg r v)\"\nbegin\n\ndefinition \"isException m \\<equiv> ((\\<exists>e. m = Exception e) \\<or> (\\<exists>msg. m = Fail msg)) \\<and> ex_traces\"\n\ndefinition finished :: \"('regval,'a,'ex) monad \\<Rightarrow> bool\" where\n  \"finished m = ((\\<exists>a. m = Done a) \\<or> isException m)\"\n\nlemma finishedE:\n  assumes \"finished m\"\n  obtains (Done) a where \"m = Done a\"\n  | (Ex) \"isException m\"\n  using assms\n  by (auto simp: finished_def)\n\nlemma finished_cases:\n  assumes \"finished m\"\n  obtains (Done) a where \"m = Done a\" | (Fail) msg where \"m = Fail msg\" | (Ex) e where \"m = Exception e\"\n  using assms\n  by (auto simp: finished_def isException_def)\n\nlemma finished_Done[intro, simp]:\n  \"finished (Done a)\"\n  by (auto simp: finished_def)\n\nlemma finished_Fail[intro, simp]:\n  \"finished (Fail msg) \\<Longrightarrow> finished (Fail msg')\"\n  unfolding finished_def isException_def\n  by auto\n\nlemma finished_Exception[intro, simp]:\n  \"finished (Exception e) \\<Longrightarrow> finished (Exception e')\"\n  unfolding finished_def isException_def\n  by auto\n\nlemma finished_isException[intro, simp]:\n  \"isException m \\<Longrightarrow> finished m\"\n  by (auto simp: finished_def)\n\nlemma finished_bind_left:\n  assumes \"finished (m \\<bind> f)\"\n  shows \"finished m\"\n  using assms\n  unfolding finished_def isException_def\n  by (cases m) auto\n\ndefinition\n  \"traces_enabled m s regs \\<equiv>\n     \\<forall>t m'. (m, t, m') \\<in> Traces \\<and> finished m' \\<and> reads_regs_from inv_regs t regs \\<and> invariant regs \\<longrightarrow> trace_enabled s t\"\n\nlemma traces_enabled_accepts_fromI:\n  assumes \"hasTrace t m\" and \"traces_enabled m s regs\" and \"hasException t m \\<or> hasFailure t m \\<longrightarrow> ex_traces\"\n    and \"reads_regs_from inv_regs t regs\" and \"invariant regs\"\n  shows \"accepts_from s t\"\n  using assms\n  unfolding traces_enabled_def finished_def isException_def\n  unfolding hasTrace_iff_Traces_final hasException_iff_Traces_Exception hasFailure_iff_Traces_Fail\n  unfolding runTrace_iff_Traces[symmetric]\n  by (intro trace_enabled_acceptI) (auto elim!: final_cases)\n\nnamed_theorems traces_enabledI\n\nlemma traces_enabled_bind[traces_enabledI]:\n  assumes \"runs_preserve_invariant m\" and \"traces_enabled m s regs\"\n    and \"\\<And>t a. Run_inv m t a regs \\<Longrightarrow> traces_enabled (f a) (run s t) (the (updates_regs inv_regs t regs))\"\n  shows \"traces_enabled (m \\<bind> f) s regs\"\n  using assms\n  by (auto simp: traces_enabled_def Run_inv_def regstate_simp trace_enabled_append_iff\n           dest!: finished_bind_left elim!: bind_Traces_cases elim!: runs_preserve_invariantE; fastforce)\n\nlemma non_cap_trace_enabledI:\n  assumes \"non_cap_trace t\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (induction t) (auto simp: non_cap_event_enabled non_cap_event_axiom_step_inv)\n\nlemma non_cap_exp_trace_enabledI:\n  assumes m: \"non_cap_exp m\"\n    and t: \"(m, t, m') \\<in> Traces\"\n  shows \"trace_enabled s t\"\n  by (cases rule: non_cap_exp_Traces_cases[OF m t])\n     (auto intro: non_cap_trace_enabledI read_non_special_regs_enabled simp: trace_enabled_append_iff)\n\nlemma non_cap_exp_traces_enabledI:\n  assumes \"non_cap_exp m\"\n  shows \"traces_enabled m s regs\"\n  using assms\n  by (auto simp: traces_enabled_def intro: non_cap_exp_trace_enabledI)\n\nlemma Run_inv_RunI[simp]: \"Run_inv m t a regs \\<Longrightarrow> Run m t a\"\n  by (simp add: Run_inv_def)\n\nlemma traces_enabled_let[traces_enabledI]:\n  assumes \"traces_enabled (f y) s regs\"\n  shows \"traces_enabled (let x = y in f x) s regs\"\n  using assms\n  by auto\n\nlemma traces_enabled_case_prod[traces_enabledI]:\n  assumes \"\\<And>x y. z = (x, y) \\<Longrightarrow> traces_enabled (f x y) s regs\"\n  shows \"traces_enabled (case z of (x, y) \\<Rightarrow> f x y) s regs\"\n  using assms\n  by auto\n\nlemma traces_enabled_if[traces_enabledI]:\n  assumes \"c \\<Longrightarrow> traces_enabled m1 s regs\" and \"\\<not>c \\<Longrightarrow> traces_enabled m2 s regs\"\n  shows \"traces_enabled (if c then m1 else m2) s regs\"\n  using assms\n  by auto\n\nlemma traces_enabled_if_ignore_cond:\n  assumes \"traces_enabled m1 s regs\" and \"traces_enabled m2 s regs\"\n  shows \"traces_enabled (if c then m1 else m2) s regs\"\n  using assms\n  by auto\n\nlemma traces_enabled_and_boolM[traces_enabledI]:\n  assumes \"runs_preserve_invariant m1\" and \"traces_enabled m1 s regs\"\n    and \"\\<And>t. Run_inv m1 t True regs \\<Longrightarrow> traces_enabled m2 (run s t) (the (updates_regs inv_regs t regs))\"\n  shows \"traces_enabled (and_boolM m1 m2) s regs\"\n  using assms\n  by (auto simp: and_boolM_def intro!: traces_enabledI intro: non_cap_exp_traces_enabledI non_cap_expI)\n\nlemma traces_enabled_or_boolM[traces_enabledI]:\n  assumes \"runs_preserve_invariant m1\" and \"traces_enabled m1 s regs\"\n    and \"\\<And>t. Run_inv m1 t False regs \\<Longrightarrow> traces_enabled m2 (run s t) (the (updates_regs inv_regs t regs))\"\n  shows \"traces_enabled (or_boolM m1 m2) s regs\"\n  using assms\n  by (auto simp: or_boolM_def intro!: traces_enabledI intro: non_cap_exp_traces_enabledI non_cap_expI)\n\nlemma traces_enabled_foreachM_inv:\n  assumes \"\\<And>x vars s regs. P vars s regs \\<Longrightarrow> x \\<in> set xs \\<Longrightarrow> traces_enabled (body x vars) s regs\"\n    and \"\\<And>x vars. x \\<in> set xs \\<Longrightarrow> runs_preserve_invariant (body x vars)\"\n    and \"\\<And>x vars s regs t vars'. P vars s regs \\<Longrightarrow> x \\<in> set xs \\<Longrightarrow> Run_inv (body x vars) t vars' regs \\<Longrightarrow> P vars' (run s t) (the (updates_regs inv_regs t regs))\"\n    and \"P vars s regs\"\n  shows \"traces_enabled (foreachM xs vars body) s regs\"\n  by (use assms in \\<open>induction xs arbitrary: vars s regs\\<close>;\n      fastforce intro!: traces_enabledI intro: non_cap_exp_traces_enabledI non_cap_expI)\n\nlemma traces_enabled_try_catch:\n  assumes \"traces_enabled m s regs\"\n    and \"\\<And>tm e th m'.\n           (m, tm, Exception e) \\<in> Traces \\<Longrightarrow> (h e, th, m') \\<in> Traces \\<Longrightarrow> finished m' \\<Longrightarrow>\n           reads_regs_from inv_regs (tm @ th) regs \\<Longrightarrow> invariant regs \\<Longrightarrow>\n           trace_enabled s (tm @ th)\"\n  shows \"traces_enabled (try_catch m h) s regs\"\nproof -\n  (* have *: \"isException (try_catch m h) \\<longleftrightarrow> (\\<exists>em eh. m = Exception em \\<and> h em = Exception eh \\<and> finished (Exception eh :: ('regval, 'a, 'c) monad))\" for m *)\n  (*have *: \"isException (try_catch m h) \\<longleftrightarrow> (\\<exists>msg. m = Fail msg \\<and> finished (Fail msg :: ('regval, 'a, 'b) monad)) \\<or> (\\<exists>em eh. m = Exception em \\<and> isException (h em))\" for m\n    unfolding isException_def finished_def\n    by (cases m) auto\n  have **: \"try_catch m h = Done a \\<longleftrightarrow> m = Done a \\<or> (\\<exists>e. m = Exception e \\<and> h e = Done a)\" for a m\n    by (cases m) auto\n  have ***: \"try_catch m h = Fail msg \\<longleftrightarrow> m = Fail msg \\<or> (\\<exists>e. m = Exception e \\<and> h e = Fail msg)\" for msg m\n    by (cases m) auto*)\n  have *: \"finished (try_catch m h) \\<longleftrightarrow> (\\<exists>a. m = Done a) \\<or> (\\<exists>msg. m = Fail msg \\<and> finished m) \\<or> (\\<exists>e. m = Exception e \\<and> (h e, [], h e) \\<in> Traces \\<and> finished (h e))\" for m\n    by (cases m) (auto simp: finished_def isException_def)\n  show ?thesis\n    using assms\n    by (fastforce simp: traces_enabled_def regstate_simp trace_enabled_append_iff Run_inv_def *\n             elim!: try_catch_Traces_cases elim: traces_preserve_invariantE)\nqed\n\nlemma traces_enabled_liftR[traces_enabledI]:\n  assumes \"traces_enabled m s regs\"\n  shows \"traces_enabled (liftR m) s regs\"\n  using assms\n  unfolding liftR_def\n  by (intro traces_enabled_try_catch) (auto simp: traces_enabled_def Run_inv_def)\n\ndefinition\n  \"early_returns_enabled m s regs \\<equiv>\n     traces_enabled m s regs \\<and>\n     (\\<forall>t a. (m, t, Exception (Inl a)) \\<in> Traces \\<and> reads_regs_from inv_regs t regs \\<and> invariant regs \\<longrightarrow> trace_enabled s t)\"\n\nlemma traces_enabled_catch_early_return[traces_enabledI]:\n  assumes \"early_returns_enabled m s regs\"\n  shows \"traces_enabled (catch_early_return m) s regs\"\n  using assms\n  unfolding catch_early_return_def\n  by (intro traces_enabled_try_catch)\n     (auto simp: traces_enabled_def early_returns_enabled_def Run_inv_def split: sum.splits)\n\nlemma liftR_no_early_return[simp]:\n  shows \"(liftR m, t, Exception (Inl e)) \\<in> Traces \\<longleftrightarrow> False\"\n  by (induction m arbitrary: t) (auto simp: liftR_def elim: Traces_cases)\n\nlemma early_returns_enabled_liftR[traces_enabledI]:\n  assumes \"traces_enabled m s regs\"\n  shows \"early_returns_enabled (liftR m) s regs\"\n  using assms\n  by (auto simp: early_returns_enabled_def intro: traces_enabled_liftR)\n\nlemma early_returns_enabled_return[traces_enabledI]:\n  \"early_returns_enabled (return a) s regs\"\n  by (auto simp: early_returns_enabled_def traces_enabled_def)\n\nlemma early_returns_enabled_bind[traces_enabledI]:\n  assumes inv: \"traces_preserve_invariant m\"\n    and m: \"early_returns_enabled m s regs\"\n    and f: \"\\<And>t a. Run_inv m t a regs \\<Longrightarrow> early_returns_enabled (f a) (run s t) (the (updates_regs inv_regs t regs))\"\n  shows \"early_returns_enabled (m \\<bind> f) s regs\"\nproof -\n  { fix t a\n    assume \"(m \\<bind> f, t, Exception (Inl a)) \\<in> Traces\" and t: \"reads_regs_from inv_regs t regs\" and regs: \"invariant regs\"\n    then have \"trace_enabled s t\"\n    proof (cases rule: bind_Traces_cases)\n      case (Left m'')\n      then consider \"m'' = Exception (Inl a)\" | a' where \"m'' = Done a'\" and \"f a' = Exception (Inl a)\"\n        by (cases m'') auto\n      then show ?thesis\n        using Left m t regs\n        by cases (auto simp: early_returns_enabled_def traces_enabled_def)\n    next\n      case (Bind tm am tf)\n      then obtain regs'\n        where \"updates_regs inv_regs tm regs = Some regs'\" and \"invariant regs'\"\n          and \"reads_regs_from inv_regs tm regs\" and \"reads_regs_from inv_regs tf regs'\"\n        using t regs\n        by (elim traces_preserve_invariantE[OF inv]) (auto simp: regstate_simp)\n      then show ?thesis\n        using Bind m f[of tm am] regs\n        by (auto simp: trace_enabled_append_iff early_returns_enabled_def traces_enabled_def Run_inv_def)\n    qed\n  }\n  then show ?thesis\n    using assms\n    by (auto intro: traces_enabled_bind traces_runs_preserve_invariantI simp: early_returns_enabled_def)\nqed\n\nlemma early_returns_enabled_early_return[traces_enabledI]:\n  \"early_returns_enabled (early_return a) s regs\"\n  by (auto simp: early_returns_enabled_def early_return_def throw_def traces_enabled_def)\n\nlemma early_returns_enabled_let[traces_enabledI]:\n  assumes \"early_returns_enabled (f y) s regs\"\n  shows \"early_returns_enabled (let x = y in f x) s regs\"\n  using assms\n  by auto\n\nlemma early_returns_enabled_case_prod[traces_enabledI]:\n  assumes \"\\<And>x y. z = (x, y) \\<Longrightarrow> early_returns_enabled (f x y) s regs\"\n  shows \"early_returns_enabled (case z of (x, y) \\<Rightarrow> f x y) s regs\"\n  using assms\n  by auto\n\nlemma early_returns_enabled_if[traces_enabledI]:\n  assumes \"c \\<Longrightarrow> early_returns_enabled m1 s regs\" and \"\\<not>c \\<Longrightarrow> early_returns_enabled m2 s regs\"\n  shows \"early_returns_enabled (if c then m1 else m2) s regs\"\n  using assms\n  by auto\n\nlemma early_returns_enabled_if_ignore_cond:\n  assumes \"early_returns_enabled m1 s regs\" and \"early_returns_enabled m2 s regs\"\n  shows \"early_returns_enabled (if c then m1 else m2) s regs\"\n  using assms\n  by auto\n\nlemma early_returns_enabled_and_boolM[traces_enabledI]:\n  assumes \"traces_preserve_invariant m1\" and \"early_returns_enabled m1 s regs\"\n    and \"\\<And>t. Run_inv m1 t True regs \\<Longrightarrow> early_returns_enabled m2 (run s t) (the (updates_regs inv_regs t regs))\"\n  shows \"early_returns_enabled (and_boolM m1 m2) s regs\"\n  using assms\n  by (auto simp: and_boolM_def intro!: traces_enabledI intro: non_cap_exp_traces_enabledI non_cap_expI)\n\nlemma early_returns_enabled_or_boolM[traces_enabledI]:\n  assumes \"traces_preserve_invariant m1\" and \"early_returns_enabled m1 s regs\"\n    and \"\\<And>t. Run_inv m1 t False regs \\<Longrightarrow> early_returns_enabled m2 (run s t) (the (updates_regs inv_regs t regs))\"\n  shows \"early_returns_enabled (or_boolM m1 m2) s regs\"\n  using assms\n  by (auto simp: or_boolM_def intro!: traces_enabledI intro: non_cap_exp_traces_enabledI non_cap_expI)\n\nlemma early_returns_enabled_foreachM_inv:\n  assumes \"\\<And>x vars s regs. P vars s regs \\<Longrightarrow> x \\<in> set xs \\<Longrightarrow> early_returns_enabled (body x vars) s regs\"\n    and \"\\<And>x vars. x \\<in> set xs \\<Longrightarrow> traces_preserve_invariant (body x vars)\"\n    and \"\\<And>x vars s regs t vars'. P vars s regs \\<Longrightarrow> x \\<in> set xs \\<Longrightarrow> Run_inv (body x vars) t vars' regs \\<Longrightarrow> P vars' (run s t) (the (updates_regs inv_regs t regs))\"\n    and \"P vars s regs\"\n  shows \"early_returns_enabled (foreachM xs vars body) s regs\"\n  by (use assms in \\<open>induction xs arbitrary: vars s regs\\<close>;\n      fastforce intro!: traces_enabledI intro: non_cap_exp_traces_enabledI non_cap_expI)\n\nlemma non_cap_exp_Run_inv_traces_enabled_runE:\n  assumes \"Run_inv m1 t a regs\" and \"non_cap_exp m1\" and \"traces_enabled m2 s regs'\"\n  shows \"traces_enabled m2 (run s t) regs'\"\n  using assms\n  by (auto simp: Run_inv_def non_cap_exp_Run_run_invI)\n\nlemma no_reg_writes_Run_inv_traces_enabled_updates_regsE:\n  assumes \"Run_inv m1 t a regs\" and \"no_reg_writes_to inv_regs m1\" and \"traces_enabled m2 s regs\"\n  shows \"traces_enabled m2 s (the (updates_regs inv_regs t regs))\"\n  using assms\n  by (auto simp: Run_inv_def)\n\nlemma non_cap_exp_Run_inv_early_returns_enabled_runE:\n  assumes \"Run_inv m1 t a regs\" and \"non_cap_exp m1\" and \"early_returns_enabled m2 s regs'\"\n  shows \"early_returns_enabled m2 (run s t) regs'\"\n  using assms\n  by (auto simp: Run_inv_def non_cap_exp_Run_run_invI)\n\nlemma no_reg_writes_Run_inv_early_returns_enabled_updates_regsE:\n  assumes \"Run_inv m1 t a regs\" and \"no_reg_writes_to inv_regs m1\" and \"early_returns_enabled m2 s regs\"\n  shows \"early_returns_enabled m2 s (the (updates_regs inv_regs t regs))\"\n  using assms\n  by (auto simp: Run_inv_def)\n\nlemma accessible_regs_no_writes_run:\n  assumes t: \"Run m t a\"\n    and m: \"runs_no_reg_writes_to {r} m\"\n    and s: \"r \\<in> accessible_regs s\"\n  shows \"r \\<in> accessible_regs (run s t)\"\nproof -\n  have no_write: \"\\<forall>v. E_write_reg r v \\<notin> set t\"\n    using m t\n    by (auto simp: runs_no_reg_writes_to_def Run_inv_def)\n  show ?thesis\n  proof (use s no_write in \\<open>induction t arbitrary: s\\<close>)\n    case (Cons e t)\n    then have \"r \\<in> accessible_regs (axiom_step s e)\" and \"\\<forall>v. E_write_reg r v \\<notin> set t\"\n      by (auto simp: accessible_regs_def)\n    from Cons.IH[OF this] show ?case by auto\n  qed auto\nqed\n\nlemma no_reg_writes_to_mono:\n  assumes \"runs_no_reg_writes_to Rs m\"\n    and \"Rs' \\<subseteq> Rs\"\n  shows \"runs_no_reg_writes_to Rs' m\"\n  using assms\n  by (auto simp: runs_no_reg_writes_to_def)\n\nlemma accessible_regs_no_writes_run_subset:\n  assumes t: \"Run m t a\" and m: \"runs_no_reg_writes_to Rs m\"\n    and Rs: \"Rs \\<subseteq> accessible_regs s\"\n  shows \"Rs \\<subseteq> accessible_regs (run s t)\"\n  using t Rs no_reg_writes_to_mono[OF m]\n  by (auto intro: accessible_regs_no_writes_run)\n\nlemma accessible_regs_no_writes_run_inv_subset:\n  assumes t: \"Run_inv m t a regs\" and m: \"runs_no_reg_writes_to Rs m\"\n    and Rs: \"Rs \\<subseteq> accessible_regs s\"\n  shows \"Rs \\<subseteq> accessible_regs (run s t)\"\n  using assms\n  by (intro accessible_regs_no_writes_run_subset) (auto simp: Run_inv_def)\n\n(*method accessible_regsI uses simp assms =\n  (match conclusion in \\<open>Rs \\<subseteq> accessible_regs (run s t)\\<close> for Rs s t \\<Rightarrow>\n     \\<open>match premises in t: \\<open>Run_inv m t a regs\\<close> for m a regs \\<Rightarrow>\n        \\<open>rule accessible_regs_no_writes_run_subset[OF t],\n         solves \\<open>use assms in \\<open>no_reg_writes_toI simp: simp\\<close>,\n         accessible_regsI simp: simp assms: assms\\<close>\\<close>\\<close>\n   \\<bar> \\<open>Rs \\<subseteq> accessible_regs s\\<close> for Rs s \\<Rightarrow> \\<open>use assms in \\<open>auto simp: simp\\<close>\\<close>)*)\n\nnamed_theorems accessible_regsE\nnamed_theorems accessible_regsI\n\nmethod accessible_regs_step uses simp assms =\n  ((erule accessible_regsE eqTrueE)\n    | (rule accessible_regsI preserves_invariantI TrueI)\n    | (erule accessible_regs_no_writes_run_inv_subset accessible_regs_no_writes_run_subset,\n       solves \\<open>use assms in \\<open>no_reg_writes_toI simp: simp\\<close>\\<close>))\n\nmethod accessible_regsI_with methods solve uses simp assms =\n  ((erule accessible_regsE eqTrueE; accessible_regsI_with solve simp: simp assms: assms)\n    | (rule accessible_regsI preserves_invariantI TrueI; accessible_regsI_with solve simp: simp assms: assms)\n    | (erule accessible_regs_no_writes_run_inv_subset accessible_regs_no_writes_run_subset,\n       solves \\<open>use assms in \\<open>no_reg_writes_toI simp: simp\\<close>\\<close>,\n       accessible_regsI_with solve simp: simp assms: assms)\n    | solve)\n\nmethod accessible_regsI uses simp assms =\n  (accessible_regsI_with\n     \\<open>(use assms in \\<open>no_reg_writes_toI simp: simp\\<close>)\n       | (use assms in \\<open>auto simp: simp\\<close>)\\<close>\n     simp: simp assms: assms)\n\ndefinition \"derivable_caps s \\<equiv> {c. is_tagged_method CC c \\<longrightarrow> c \\<in> derivable (accessed_caps s)}\"\n\nnamed_theorems derivable_capsI\nnamed_theorems derivable_capsE\n\nlemma accessed_caps_run_mono:\n  \"accessed_caps s \\<subseteq> accessed_caps (run s t)\"\n  by (rule subsetI) (induction t arbitrary: s; auto)\n\nlemma derivable_caps_run_mono:\n  \"derivable_caps s \\<subseteq> derivable_caps (run s t)\"\n  using derivable_mono[OF accessed_caps_run_mono]\n  by (auto simp: derivable_caps_def)\n\nlemma derivable_caps_run_imp:\n  \"c \\<in> derivable_caps s \\<Longrightarrow> c \\<in> derivable_caps (run s t)\"\n  using derivable_caps_run_mono\n  by auto\n\nmethod derivable_caps_step =\n  (rule derivable_capsI preserves_invariantI TrueI\n      | erule derivable_capsE eqTrueE\n      | rule derivable_caps_run_imp)\n\nmethod derivable_capsI_with methods solve uses simp assms =\n  ((rule derivable_capsI preserves_invariantI TrueI\n      | erule derivable_capsE eqTrueE\n      | rule derivable_caps_run_imp\n      | solve (*\n      | solves \\<open>use assms in \\<open>auto simp: simp\\<close>\\<close>*));\n   derivable_capsI_with solve simp: simp assms: assms)\n\nmethod derivable_capsI uses simp assms =\n  (derivable_capsI_with \\<open>solves \\<open>accessible_regsI simp: simp assms: assms\\<close>\\<close> simp: simp assms: assms)\n\nmethod try_simp_traces_enabled =\n  ((match conclusion in \\<open>traces_enabled m2 (run s t) (the (updates_regs inv_regs t regs))\\<close> for m2 s t regs \\<Rightarrow>\n     \\<open>match premises in m1: \\<open>Run_inv m1 t a regs\\<close> for m1 a \\<Rightarrow>\n        \\<open>(rule non_cap_exp_Run_inv_traces_enabled_runE[OF m1], solves \\<open>non_cap_expI\\<close>)?,\n         (rule no_reg_writes_Run_inv_traces_enabled_updates_regsE[OF m1], solves \\<open>no_reg_writes_toI\\<close>)?\\<close>\\<close>\n   \\<bar> \\<open>early_returns_enabled m2 (run s t) (the (updates_regs inv_regs t regs))\\<close> for m2 s t regs \\<Rightarrow>\n     \\<open>match premises in m1: \\<open>Run_inv m1 t a regs\\<close> for m1 a \\<Rightarrow>\n        \\<open>(rule non_cap_exp_Run_inv_early_returns_enabled_runE[OF m1], solves \\<open>non_cap_expI\\<close>)?,\n         (rule no_reg_writes_Run_inv_early_returns_enabled_updates_regsE[OF m1], solves \\<open>no_reg_writes_toI\\<close>)?\\<close>\\<close>)?)\n\nnamed_theorems traces_enabled_combinatorI\n\nlemmas traces_enabled_builtin_combinatorsI =\n  traces_enabled_bind traces_enabled_and_boolM traces_enabled_or_boolM\n  early_returns_enabled_bind early_returns_enabled_and_boolM early_returns_enabled_or_boolM\n\nnamed_theorems traces_enabled_split\ndeclare option.split[where P = \"\\<lambda>m. traces_enabled m s regs\" for s regs, traces_enabled_split]\ndeclare prod.split[where P = \"\\<lambda>m. traces_enabled m s regs\" for s regs, traces_enabled_split]\n\nmethod traces_enabled_step uses intro elim =\n  ((rule intro TrueI)\n    | (erule elim eqTrueE)\n    | ((rule traces_enabled_combinatorI traces_enabled_builtin_combinatorsI[rotated 2], try_simp_traces_enabled))\n    | (rule traces_enabledI preserves_invariantI)\n    | (rule traces_enabled_split[THEN iffD2]; intro conjI impI))\n\nmethod traces_enabledI_with methods solve uses intro elim =\n  ((rule intro TrueI; traces_enabledI_with solve intro: intro elim: elim)\n    | (erule elim eqTrueE; traces_enabledI_with solve intro: intro elim: elim)\n    | ((rule traces_enabled_combinatorI traces_enabled_builtin_combinatorsI[rotated 2], try_simp_traces_enabled); traces_enabledI_with solve intro: intro elim: elim)\n    | (rule traces_enabledI; traces_enabledI_with solve intro: intro elim: elim)\n    | (preserves_invariantI intro: intro elim: elim; traces_enabledI_with solve intro: intro elim: elim)\n    | (rule traces_enabled_split[THEN iffD2]; intro conjI impI; traces_enabledI_with solve intro: intro elim: elim)\n    | solve)\n\n(*method traces_enabledI uses simp intro elim assms =\n  (traces_enabledI_with\n     \\<open>(solves \\<open>accessible_regsI simp: simp assms: assms\\<close>)\n      | (solves \\<open>derivable_capsI simp: simp assms: assms\\<close>)\n      | (use assms in \\<open>auto intro!: intro elim!: elim simp: simp\\<close>)?\\<close>\n     intro: intro)*)\n\nmethod traces_enabledI uses simp intro elim assms =\n  ((traces_enabled_step intro: intro elim: elim; traces_enabledI simp: simp intro: intro elim: elim assms: assms)\n    | (accessible_regs_step simp: simp assms: assms; solves \\<open>traces_enabledI simp: simp intro: intro elim: elim assms: assms\\<close>)\n    | (derivable_caps_step; solves \\<open>traces_enabledI simp: simp intro: intro elim: elim assms: assms\\<close>)\n    | (solves \\<open>no_reg_writes_toI simp: simp\\<close>)\n    | (solves \\<open>preserves_invariantI simp: simp\\<close>)\n    | (use assms in \\<open>auto intro!: intro elim!: elim simp: simp\\<close>)?)\n\n(* method traces_enabledI = (intro traces_enabledI preserves_invariantI) *)\n\nlemma if_derivable_capsI[derivable_capsI]:\n  assumes \"cond \\<Longrightarrow> c1 \\<in> derivable_caps s\" and \"\\<not>cond \\<Longrightarrow> c2 \\<in> derivable_caps s\"\n  shows \"(if cond then c1 else c2) \\<in> derivable_caps s\"\n  using assms\n  by auto\n\nend\n\nlocale Write_Cap_Inv_Automaton =\n  Write_Cap_Automaton CC ISA ex_traces invocation_traces +\n  State_Invariant get_regval set_regval invariant inv_regs\n  for CC :: \"'cap Capability_class\" and ISA :: \"('cap, 'regval, 'instr, 'e) isa\"\n    and ex_traces :: bool and invocation_traces :: bool\n    and get_regval :: \"string \\<Rightarrow> 'regstate \\<Rightarrow> 'regval option\"\n    and set_regval :: \"string \\<Rightarrow> 'regval \\<Rightarrow> 'regstate \\<Rightarrow> 'regstate option\"\n    and invariant :: \"'regstate \\<Rightarrow> bool\" and inv_regs :: \"register_name set\"\nbegin\n\nsublocale Cap_Axiom_Inv_Automaton where enabled = enabled\nproof\n  fix s e\n  assume \"non_cap_event e\"\n  then show \"enabled s e\"\n    by (cases e) auto\nnext\n  fix s r v\n  assume \"r \\<notin> special_reg_names\"\n  then show \"enabled s (E_read_reg r v)\"\n    by auto\nqed\n\nlemma read_reg_trace_enabled:\n  assumes t: \"(read_reg r, t, m') \\<in> Traces\"\n    and r: \"name r \\<in> privileged_regs ISA \\<longrightarrow> system_reg_access s \\<or> ex_traces\"\n  shows \"trace_enabled s t\"\n  by (use t in \\<open>auto simp: read_reg_def elim!: Read_reg_TracesE split: option.splits\\<close>)\n     (use r in \\<open>auto\\<close>)\n\nlemma traces_enabled_read_reg:\n  assumes \"name r \\<in> privileged_regs ISA \\<longrightarrow> (system_reg_access s \\<or> ex_traces)\"\n  shows \"traces_enabled (read_reg r) s regs\"\n  using assms\n  unfolding traces_enabled_def\n  by (blast intro: read_reg_trace_enabled)\n\nlemma write_reg_trace_enabled:\n  assumes \"(write_reg r v, t, m') \\<in> Traces\"\n    and \"enabled s (E_write_reg (name r) (regval_of r v))\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (auto simp add: write_reg_def simp del: enabled.simps elim!: Write_reg_TracesE)\n\nlemma traces_enabled_write_reg:\n  assumes \"enabled s (E_write_reg (name r) (regval_of r v))\"\n  shows \"traces_enabled (write_reg r v) s regs\"\n  using assms\n  unfolding traces_enabled_def\n  by (blast intro: write_reg_trace_enabled)\n\nlemma traces_enabled_reg_axioms:\n  assumes \"traces_enabled m initial regs\" and \"hasTrace t m\"\n    and \"reads_regs_from inv_regs t regs\" and \"invariant regs\"\n    and \"hasException t m \\<or> hasFailure t m \\<longrightarrow> ex_traces\"\n  shows \"store_cap_reg_axiom CC ISA ex_traces invocation_traces t\"\n    and \"store_cap_mem_axiom CC ISA t\"\n    and \"read_reg_axiom CC ISA ex_traces t\"\n  using assms\n  by (intro recognises_store_cap_reg_read_reg_axioms;\n      elim traces_enabled_accepts_fromI[where regs = regs];\n      auto)+\n\nend\n\nlocale Capability_ISA_Fixed_Translation = Capability_ISA CC ISA\n  for CC :: \"'cap Capability_class\" and ISA :: \"('cap, 'regval, 'instr, 'e) isa\" +\n  fixes translation_assm :: \"'regval trace \\<Rightarrow> bool\"\n  assumes fixed_translation_tables: \"\\<And>i t. translation_assm t \\<Longrightarrow> translation_tables ISA (take i t) = translation_tables ISA []\"\n    and fixed_translation: \"\\<And>i t addr load. translation_assm t \\<Longrightarrow> translate_address ISA addr load (take i t) = translate_address ISA addr load []\"\n\nfun non_store_event :: \"'regval event \\<Rightarrow> bool\" where\n  \"non_store_event (E_write_mem _ paddr sz v _) = False\"\n| \"non_store_event (E_write_memt _ paddr sz v tag _) = False\"\n| \"non_store_event _ = True\"\n\nabbreviation non_store_trace :: \"'regval trace \\<Rightarrow> bool\" where\n  \"non_store_trace t \\<equiv> (\\<forall>e \\<in> set t. non_store_event e)\"\n\nlemma (in Cap_Axiom_Automaton) non_mem_trace_mem_axiomsI:\n  assumes \"non_mem_trace t\"\n  shows \"store_mem_axiom CC ISA t\" and \"store_tag_axiom CC ISA t\" and \"load_mem_axiom CC ISA is_fetch t\"\nproof -\n  have i: \"non_mem_event (t ! i)\" if \"i < length t\" for i\n    using assms that\n    by (auto simp: non_mem_trace_def)\n  show \"store_mem_axiom CC ISA t\"\n    using i\n    by (fastforce simp: store_mem_axiom_def writes_mem_val_at_idx_def bind_eq_Some_conv elim!: writes_mem_val.elims)\n  show \"store_tag_axiom CC ISA t\"\n    using i\n    by (fastforce simp: store_tag_axiom_def writes_mem_val_at_idx_def bind_eq_Some_conv elim!: writes_mem_val.elims)\n  show \"load_mem_axiom CC ISA is_fetch t\"\n    using i\n    by (fastforce simp: load_mem_axiom_def reads_mem_val_at_idx_def bind_eq_Some_conv elim!: reads_mem_val.elims)\nqed\n\nlocale Mem_Automaton = Capability_ISA_Fixed_Translation where CC = CC and ISA = ISA\n  for CC :: \"'cap Capability_class\" and ISA :: \"('cap, 'regval, 'instr, 'e) isa\" +\n  fixes is_fetch :: bool\nbegin\n\ndefinition paddr_in_mem_region :: \"'cap \\<Rightarrow> acctype \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"paddr_in_mem_region c acctype paddr sz =\n     (\\<exists>vaddr. set (address_range vaddr sz) \\<subseteq> get_mem_region_method CC c \\<and>\n              translate_address ISA vaddr acctype [] = Some paddr)\"\n\ndefinition has_access_permission :: \"perms \\<Rightarrow> acctype \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> bool\" where\n  \"has_access_permission perms acctype is_cap is_local_cap =\n     (case acctype of\n        Fetch \\<Rightarrow> permit_execute perms\n      | Load \\<Rightarrow> permit_load perms \\<and> (is_cap \\<longrightarrow> permit_load_capability perms)\n      | Store \\<Rightarrow> permit_store perms \\<and> (is_cap \\<longrightarrow> permit_store_capability perms) \\<and> (is_local_cap \\<longrightarrow> permit_store_local_capability perms))\"\n\ndefinition authorises_access :: \"'cap \\<Rightarrow> acctype \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"authorises_access c acctype is_cap is_local_cap paddr sz =\n     (is_tagged_method CC c \\<and> \\<not>is_sealed_method CC c \\<and> paddr_in_mem_region c acctype paddr sz \\<and>\n      has_access_permission (get_perms_method CC c) acctype is_cap is_local_cap)\"\n\ndefinition access_enabled :: \"('cap, 'regval) axiom_state \\<Rightarrow> acctype \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> memory_byte list \\<Rightarrow> bitU \\<Rightarrow> bool\" where\n  \"access_enabled s acctype paddr sz v tag =\n     ((tag \\<noteq> B0 \\<longrightarrow> address_tag_aligned ISA paddr \\<and> sz = tag_granule ISA) \\<and>\n      (case acctype of Load \\<Rightarrow> True\n         | Store \\<Rightarrow> (tag = B0 \\<or> tag = B1) \\<and> length v = sz\n         | Fetch \\<Rightarrow> tag = B0) \\<and>\n      (paddr \\<in> translation_tables ISA [] \\<or>\n       (\\<exists>c' \\<in> derivable (accessed_caps s).\n          let is_cap = tag \\<noteq> B0 in\n          let is_local_cap = mem_val_is_local_cap CC ISA v tag \\<and> tag = B1 in\n          authorises_access c' acctype is_cap is_local_cap paddr sz)))\"\n\nlemmas access_enabled_defs = access_enabled_def authorises_access_def paddr_in_mem_region_def has_access_permission_def\n\nfun enabled :: \"('cap, 'regval) axiom_state \\<Rightarrow> 'regval event \\<Rightarrow> bool\" where\n  \"enabled s (E_write_mem _ paddr sz v _) = access_enabled s Store paddr sz v B0\"\n| \"enabled s (E_write_memt _ paddr sz v tag _) = access_enabled s Store paddr sz v tag\"\n| \"enabled s (E_read_mem _ paddr sz v) = access_enabled s (if is_fetch then Fetch else Load) paddr sz v B0\"\n| \"enabled s (E_read_memt _ paddr sz v_tag) = access_enabled s (if is_fetch then Fetch else Load) paddr sz (fst v_tag) (snd v_tag)\"\n| \"enabled s _ = True\"\n\nsublocale Cap_Axiom_Automaton where enabled = enabled ..\n\nlemma accepts_store_mem_axiom:\n  assumes *: \"translation_assm t\" and  **: \"accepts t\"\n  shows \"store_mem_axiom CC ISA t\"\n  using accepts_from_nth_enabledI[OF **]\n  unfolding store_mem_axiom_def\n  unfolding writes_mem_val_at_idx_def cap_derivable_iff_derivable\n  unfolding fixed_translation_tables[OF *] fixed_translation[OF *]\n  by (fastforce simp: access_enabled_defs bind_eq_Some_conv elim!: writes_mem_val.elims)\n\nlemma accepts_store_tag_axiom:\n  assumes \"accepts t\"\n  shows \"store_tag_axiom CC ISA t\"\n  using accepts_from_nth_enabledI[OF assms]\n  unfolding store_tag_axiom_def writes_mem_val_at_idx_def\n  by (fastforce simp: access_enabled_defs bind_eq_Some_conv elim!: writes_mem_val.elims)\n\nlemma accepts_load_mem_axiom:\n  assumes *: \"translation_assm t\" and  **: \"accepts t\"\n  shows \"load_mem_axiom CC ISA is_fetch t\"\n  unfolding load_mem_axiom_def\n  unfolding reads_mem_val_at_idx_def cap_derivable_iff_derivable\n  unfolding fixed_translation_tables[OF *] fixed_translation[OF *]\n  by (auto simp: bind_eq_Some_conv elim!: reads_mem_val.elims dest!: accepts_from_nth_enabledI[OF **] split del: if_split;\n      cases is_fetch; fastforce simp: access_enabled_defs)\n\nlemma non_mem_event_enabledI:\n  \"enabled s e\" if \"non_mem_event e\"\n  using that\n  by (auto elim: non_mem_event.elims)\n\nlemma non_mem_trace_enabledI:\n  \"trace_enabled s t\" if \"non_mem_trace t\"\n  using that\n  by (induction t arbitrary: s) (auto intro: non_mem_event_enabledI)\n\nend\n\nlocale Mem_Inv_Automaton =\n  Mem_Automaton translation_assm CC ISA is_fetch +\n  State_Invariant get_regval set_regval invariant inv_regs\n  for CC :: \"'cap Capability_class\" and ISA :: \"('cap, 'regval, 'instr, 'e) isa\"\n    and translation_assm :: \"'regval event list \\<Rightarrow> bool\"\n    and is_fetch :: bool and ex_traces :: bool\n    and get_regval :: \"string \\<Rightarrow> 'regstate \\<Rightarrow> 'regval option\"\n    and set_regval :: \"string \\<Rightarrow> 'regval \\<Rightarrow> 'regstate \\<Rightarrow> 'regstate option\"\n    and invariant :: \"'regstate \\<Rightarrow> bool\" and inv_regs :: \"register_name set\"\nbegin\n\nsublocale Cap_Axiom_Inv_Automaton where enabled = enabled and ex_traces = ex_traces\nproof\n  fix s e\n  assume \"non_cap_event e\"\n  then show \"enabled s e\"\n    by (cases e) auto\nnext\n  fix s r v\n  assume \"r \\<notin> special_reg_names\"\n  then show \"enabled s (E_read_reg r v)\"\n    by auto\nqed\n\nlemma non_mem_exp_trace_enabledI:\n  \"trace_enabled s t\" if \"non_mem_exp m\" and \"(m, t, m') \\<in> Traces\"\n  using that\n  by (auto simp: non_mem_exp_def intro: non_mem_trace_enabledI)\n\nlemma non_mem_exp_traces_enabledI:\n  \"traces_enabled m s regs\" if \"non_mem_exp m\"\n  using that\n  by (auto simp: traces_enabled_def intro: non_mem_exp_trace_enabledI)\n\nlemma traces_enabled_mem_axioms:\n  assumes \"traces_enabled m initial regs\" and \"hasTrace t m\"\n    and \"reads_regs_from inv_regs t regs\" and \"invariant regs\"\n    and \"hasException t m \\<or> hasFailure t m \\<longrightarrow> ex_traces\"\n    and \"translation_assm t\"\n  shows \"store_mem_axiom CC ISA t\"\n    and \"store_tag_axiom CC ISA t\"\n    and \"load_mem_axiom CC ISA is_fetch t\"\n  using assms\n  by (intro accepts_store_mem_axiom accepts_store_tag_axiom accepts_load_mem_axiom\n            traces_enabled_accepts_fromI[where m = m and regs = regs];\n      auto)+\n\nend\n\n(*locale Store_Mem_Automaton = Capability_ISA_Fixed_Translation CC ISA\n  for CC :: \"'cap Capability_class\" and ISA :: \"('cap, 'regval, 'instr, 'e) isa\"\nbegin\n\nfun store_enabled :: \"('cap, 'regval) axiom_state \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> memory_byte list \\<Rightarrow> bitU \\<Rightarrow> bool\" where\n  \"store_enabled s paddr sz v tag =\n     (length v = sz \\<and>\n      (tag = B0 \\<or> tag = B1) \\<and>\n      (tag = B1 \\<longrightarrow> address_tag_aligned ISA paddr \\<and> sz = tag_granule ISA) \\<and>\n      (paddr \\<in> translation_tables ISA [] \\<or>\n       (\\<exists>c' vaddr. c' \\<in> derivable (accessed_caps s) \\<and>\n          is_tagged_method CC c' \\<and>\n          \\<not> is_sealed_method CC c' \\<and>\n          translate_address ISA vaddr Store [] = Some paddr \\<and>\n          set (address_range vaddr sz) \\<subseteq> get_mem_region_method CC c' \\<and>\n          (if mem_val_is_cap CC ISA v tag \\<and> tag = B1\n           then permit_store_capability (get_perms_method CC c')\n           else permit_store (get_perms_method CC c')) \\<and>\n          (mem_val_is_local_cap CC ISA v tag \\<and> tag = B1 \\<longrightarrow>\n           permit_store_local_capability (get_perms_method CC c')))))\"\n\nfun enabled :: \"('cap, 'regval) axiom_state \\<Rightarrow> 'regval event \\<Rightarrow> bool\" where\n  \"enabled s (E_write_mem _ paddr sz v _) = store_enabled s paddr sz v B0\"\n| \"enabled s (E_write_memt _ paddr sz v tag _) = store_enabled s paddr sz v tag\"\n| \"enabled s _ = True\"\n\nsublocale Cap_Axiom_Automaton CC ISA enabled ..\n\nlemma non_store_event_enabledI:\n  assumes \"non_store_event e\"\n  shows \"enabled s e\"\n  using assms\n  by (cases e) auto\n\nlemma non_store_trace_enabledI:\n  assumes \"non_store_trace t\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (induction t arbitrary: s) (auto intro: non_store_event_enabledI)\n\nlemma non_cap_event_enabledI:\n  assumes \"non_cap_event e\"\n  shows \"enabled s e\"\n  using assms\n  by (elim non_cap_event.elims) auto\n\nlemma non_cap_trace_enabledI:\n  assumes \"non_cap_trace t\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (induction t) (auto simp: non_cap_event_enabledI non_cap_event_axiom_step_inv)\n\nlemma non_cap_exp_trace_enabledI:\n  assumes \"non_cap_exp m\"\n    and \"(m, t, m') \\<in> Traces\"\n  shows \"trace_enabled s t\"\n  by (cases rule: non_cap_exp_Traces_cases[OF assms])\n     (auto intro: non_cap_trace_enabledI simp: trace_enabled_append_iff)\n\nlemma accepts_iff_store_mem_tag_axioms:\n  assumes \"translation_assm t\"\n  shows \"accepts t \\<longleftrightarrow> store_mem_axiom CC ISA t \\<and> store_tag_axiom CC ISA t\"\nproof\n  assume *: \"accepts t\"\n  show \"store_mem_axiom CC ISA t \\<and> store_tag_axiom CC ISA t\"\n  proof (unfold store_mem_axiom_def store_tag_axiom_def, fold all_conj_distrib, intro allI, goal_cases Idx)\n    case (Idx i paddr sz v tag)\n    then show ?case\n      using accepts_from_nth_enabledI[OF *]\n      unfolding writes_mem_val_at_idx_def cap_derivable_iff_derivable\n      unfolding fixed_translation_tables[OF assms] fixed_translation[OF assms]\n      by (fastforce simp: bind_eq_Some_conv elim!: writes_mem_val.elims)\n  qed\nnext\n  assume *: \"store_mem_axiom CC ISA t \\<and> store_tag_axiom CC ISA t\"\n  show \"accepts t\"\n  proof (unfold accepts_from_iff_all_enabled_final, intro conjI allI impI TrueI)\n    fix i\n    assume \"i < length t\"\n    then show \"enabled (run initial (take i t)) (t ! i)\"\n      using *[unfolded store_mem_axiom_def store_tag_axiom_def, folded all_conj_distrib, rule_format, of i]\n      unfolding writes_mem_val_at_idx_def cap_derivable_iff_derivable\n      unfolding fixed_translation_tables[OF assms] fixed_translation[OF assms]\n      by (cases \"t ! i\") (auto cong: conj_cong disj_cong)\n  qed\nqed\n\nlemma recognises_store_mem_tag_axioms:\n  assumes \"translation_assm t\" and \"accepts t\"\n  shows \"store_mem_axiom CC ISA t\" and \"store_tag_axiom CC ISA t\"\n  using assms(2)\n  unfolding accepts_iff_store_mem_tag_axioms[OF assms(1)]\n  by auto\n\nend\n\nfun non_load_event :: \"'regval event \\<Rightarrow> bool\" where\n  \"non_load_event (E_read_mem _ paddr sz v) = False\"\n| \"non_load_event (E_read_memt _ paddr sz v_tag) = False\"\n| \"non_load_event _ = True\"\n\nabbreviation non_load_trace :: \"'regval trace \\<Rightarrow> bool\" where\n  \"non_load_trace t \\<equiv> (\\<forall>e \\<in> set t. non_load_event e)\"\n\nlemma non_load_trace_load_mem_axiomI:\n  assumes \"non_load_trace t\"\n  shows \"load_mem_axiom CC ISA is_fetch t\"\nproof -\n  have i: \"non_load_event (t ! i)\" if \"i < length t\" for i\n    using assms that\n    by auto\n  show \"load_mem_axiom CC ISA is_fetch t\"\n    using i\n    by (fastforce simp: load_mem_axiom_def reads_mem_val_at_idx_def bind_eq_Some_conv elim!: reads_mem_val.elims)\nqed\n\nlocale Load_Mem_Automaton = Capability_ISA_Fixed_Translation CC ISA\n  for CC :: \"'cap Capability_class\" and ISA :: \"('cap, 'regval, 'instr, 'e) isa\" +\n  fixes is_fetch :: bool\nbegin\n\nfun load_enabled :: \"('cap, 'regval) axiom_state \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> memory_byte list \\<Rightarrow> bitU \\<Rightarrow> bool\" where\n  \"load_enabled s paddr sz v tag =\n    (paddr \\<in> translation_tables ISA [] \\<or>\n    (\\<exists>c' vaddr.\n        c' \\<in> derivable (accessed_caps s) \\<and>\n        is_tagged_method CC c' \\<and>\n        \\<not> is_sealed_method CC c' \\<and>\n        translate_address ISA vaddr (if is_fetch then Load else Fetch) [] = Some paddr \\<and>\n        set (address_range vaddr sz) \\<subseteq> get_mem_region_method CC c' \\<and>\n        (if is_fetch \\<and> tag = B0\n         then permit_execute (get_perms_method CC c')\n         else permit_load (get_perms_method CC c')) \\<and>\n        (tag \\<noteq> B0 \\<longrightarrow> permit_load_capability (get_perms_method CC c') \\<and> sz = tag_granule ISA \\<and>\n                      address_tag_aligned ISA paddr)))\"\n\nfun enabled :: \"('cap, 'regval) axiom_state \\<Rightarrow> 'regval event \\<Rightarrow> bool\" where\n  \"enabled s (E_read_mem _ paddr sz v) = load_enabled s paddr sz v B0\"\n| \"enabled s (E_read_memt _ paddr sz v_tag) = load_enabled s paddr sz (fst v_tag) (snd v_tag)\"\n| \"enabled s _ = True\"\n\nsublocale Cap_Axiom_Automaton CC ISA enabled ..\n\nlemma non_load_event_enabledI:\n  assumes \"non_load_event e\"\n  shows \"enabled s e\"\n  using assms\n  by (cases e) auto\n\nlemma non_load_trace_enabledI:\n  assumes \"non_load_trace t\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (induction t arbitrary: s) (auto intro: non_load_event_enabledI)\n\nlemma non_cap_event_enabledI:\n  assumes \"non_cap_event e\"\n  shows \"enabled s e\"\n  using assms\n  by (elim non_cap_event.elims) auto\n\nlemma non_cap_trace_enabledI:\n  assumes \"non_cap_trace t\"\n  shows \"trace_enabled s t\"\n  using assms\n  by (induction t) (auto simp: non_cap_event_enabledI non_cap_event_axiom_step_inv)\n\nlemma non_cap_exp_trace_enabledI:\n  assumes \"non_cap_exp m\"\n    and \"(m, t, m') \\<in> Traces\"\n  shows \"trace_enabled s t\"\n  by (cases rule: non_cap_exp_Traces_cases[OF assms])\n     (auto intro: non_cap_trace_enabledI simp: trace_enabled_append_iff)\n\nlemma recognises_load_mem_axiom:\n  assumes \"translation_assm t\"\n  shows \"accepts t \\<longleftrightarrow> load_mem_axiom CC ISA is_fetch t\"\nproof\n  assume *: \"accepts t\"\n  show \"load_mem_axiom CC ISA is_fetch t\"\n  proof (unfold load_mem_axiom_def, intro allI impI, elim conjE, goal_cases Idx)\n    case (Idx i paddr sz v tag)\n    then show ?case\n      using accepts_from_nth_enabledI[OF *]\n      unfolding cap_derivable_iff_derivable reads_mem_val_at_idx_def\n      unfolding fixed_translation_tables[OF assms] fixed_translation[OF assms]\n      by (cases \"t ! i\"; fastforce simp add: bind_eq_Some_conv)\n  qed\nnext\n  assume *: \"load_mem_axiom CC ISA is_fetch t\"\n  show \"accepts t\"\n  proof (unfold accepts_from_iff_all_enabled_final, intro conjI allI impI TrueI)\n    fix i\n    assume \"i < length t\"\n    then show \"enabled (run initial (take i t)) (t ! i)\"\n      using *[unfolded load_mem_axiom_def, rule_format, of i]\n      unfolding reads_mem_val_at_idx_def cap_derivable_iff_derivable\n      unfolding fixed_translation_tables[OF assms] fixed_translation[OF assms]\n      by (cases \"t ! i\"; fastforce)\n  qed\nqed\n\nend*)\n\nend\n", "meta": {"author": "CTSRD-CHERI", "repo": "sail-cheri-mips-proofs", "sha": "38d00591864abe3bd03d1fcd9efcb0a77921593a", "save_path": "github-repos/isabelle/CTSRD-CHERI-sail-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-sail-cheri-mips-proofs/sail-cheri-mips-proofs-38d00591864abe3bd03d1fcd9efcb0a77921593a/proof/Recognising_Automata.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.538983220687684, "lm_q1q2_score": 0.327520252369819}}
{"text": "section \\<open>Syntax extensions for UTP\\<close>\n\ntheory utp_extensions\nimports\n  BitOps\n  \"../../Isabelle-UTP/utp/utp\"\n  \"~~/src/HOL/Library/Multiset\"\nbegin\nrecall_syntax \\<comment> \\<open>Fixes notation issue with inclusion of HOL libraries.\\<close>\n\nsubsection \\<open>Notation\\<close>\n\ntext \\<open>We need multisets for concise list invariants for sorting. Also, int/nat conversion is\nsometimes needed as some loop methods mix array indices and loop variables (which sometimes rely on\ngoing below 0 for termination). Bitwise operations and record access/update are included for\ncompleteness.\\<close>\n\ntext \\<open>A helper function for record updating.\\<close>\nlift_definition rec_update_wrapper :: \\<open>('a, '\\<alpha>) uexpr \\<Rightarrow> ('a \\<Rightarrow> 'a, '\\<alpha>) uexpr\\<close> is\n  \\<open>\\<lambda>v s _. v s\\<close> .\n\nsyntax\n  \"_umset\" :: \\<open>('a list, '\\<alpha>) uexpr \\<Rightarrow> ('a multiset, '\\<alpha>) uexpr\\<close> (\"mset\\<^sub>u'(_')\")\n  \"_unat\" :: \\<open>(nat, '\\<alpha>) uexpr \\<Rightarrow> (int, '\\<alpha>) uexpr\\<close> (\"int\\<^sub>u'(_')\")\n  \"_uint\" :: \\<open>(int, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr\\<close> (\"nat\\<^sub>u'(_')\")\n  \"_uapply_rec\" :: \\<open>('a, '\\<alpha>) uexpr \\<Rightarrow> utuple_args \\<Rightarrow> ('b, '\\<alpha>) uexpr\\<close> (\"_\\<lparr>_\\<rparr>\\<^sub>r\" [999,0] 999)\n  \"_uupd_rec\"   :: \\<open>('a, '\\<alpha>) uexpr \\<Rightarrow> (('b \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'a) \\<Rightarrow> ('b, '\\<alpha>) uexpr \\<Rightarrow> ('a, '\\<alpha>) uexpr\\<close> (\"_/'(_ /\\<mapsto>/ _')\\<^sub>r\" [900,0,0] 900)\n  \"_ubs_and\"    :: \\<open>(int, '\\<alpha>) uexpr \\<Rightarrow> (int, '\\<alpha>) uexpr \\<Rightarrow> (int, '\\<alpha>) uexpr\\<close> (infixl \"\\<and>\\<^sub>b\\<^sub>s\" 85)\n  \"_ubu_and\"    :: \\<open>(nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr\\<close> (infixl \"\\<and>\\<^sub>b\\<^sub>u\" 85)\n  \"_ubs_or\"     :: \\<open>(int, '\\<alpha>) uexpr \\<Rightarrow> (int, '\\<alpha>) uexpr \\<Rightarrow> (int, '\\<alpha>) uexpr\\<close> (infixl \"\\<or>\\<^sub>b\\<^sub>s\" 80)\n  \"_ubu_or\"     :: \\<open>(nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr\\<close> (infixl \"\\<or>\\<^sub>b\\<^sub>u\" 80)\n  \"_ubs_lsh\"    :: \\<open>(int, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (int, '\\<alpha>) uexpr\\<close>\t(\"_ \\<lless>\\<^bsub>s'/_\\<^esub> _\" [100,100,101] 100)\n  \"_ubu_lsh\"    :: \\<open>(nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr\\<close>\t(\"_ \\<lless>\\<^bsub>u'/_\\<^esub> _\" [100,100,101] 100)\n  \"_ubs_rsh\"    :: \\<open>(int, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (int, '\\<alpha>) uexpr\\<close>\t(\"_ \\<ggreater>\\<^bsub>s'/_\\<^esub> _\" [100,100,101] 100)\n  \"_ubu_rsh\"    :: \\<open>(nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr\\<close>\t(\"_ \\<ggreater>\\<^bsub>u'/_\\<^esub> _\" [100,100,101] 100)\n  \"_ubs_not\"    :: \\<open>(nat, '\\<alpha>) uexpr \\<Rightarrow> (int, '\\<alpha>) uexpr \\<Rightarrow> (int, '\\<alpha>) uexpr\\<close> (\"\\<not>\\<^bsub>s'/_\\<^esub> _\" [200, 150] 150)\n  \"_ubu_not\"    :: \\<open>(nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr\\<close>\t (\"\\<not>\\<^bsub>u'/_\\<^esub> _\" [200, 150] 150)\n  \"_ubu_neg\"    :: \\<open>(nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr \\<Rightarrow> (nat, '\\<alpha>) uexpr\\<close>\t (\"-\\<^bsub>u'/_\\<^esub> _\" [200, 150] 150)\n\ntranslations\n  \"_umset\" \\<rightleftharpoons> \"CONST uop CONST mset\"\n  \"_uint\" \\<rightleftharpoons> \"CONST uop CONST int\"\n  \"_unat\" \\<rightleftharpoons> \"CONST uop CONST nat\"\n  \"f\\<lparr>kf\\<rparr>\\<^sub>r\" \\<rightharpoonup> \"CONST uop kf f\"\n  \"f(k \\<mapsto> v)\\<^sub>r\" \\<rightharpoonup> \"CONST bop k (CONST rec_update_wrapper v) f\"\n  \"_ubs_and\" \\<rightleftharpoons> \"CONST bop (CONST s_bitop (op AND))\"\n  \"_ubu_and\" \\<rightleftharpoons> \"CONST bop (CONST u_bitop (op AND))\"\n  \"_ubs_or\" \\<rightleftharpoons> \"CONST bop (CONST s_bitop (op OR))\"\n  \"_ubu_or\" \\<rightleftharpoons> \"CONST bop (CONST u_bitop (op OR))\"\n  \"_ubs_lsh\" \\<rightleftharpoons> \"CONST trop CONST s_lsh\"\n  \"_ubu_lsh\" \\<rightleftharpoons> \"CONST trop CONST u_lsh\"\n  \"_ubs_rsh\" \\<rightleftharpoons> \"CONST trop CONST s_rsh\"\n  \"_ubu_rsh\" \\<rightleftharpoons> \"CONST trop CONST u_rsh\"\n  \"_ubs_not\" \\<rightleftharpoons> \"CONST bop CONST s_not\"\n  \"_ubu_not\" \\<rightleftharpoons> \"CONST bop CONST u_not\"\n  \"_ubu_neg\" \\<rightleftharpoons> \"CONST bop CONST u_neg\"\n\nsubsection \\<open>Extra stuff to work more-arg functions into UTP\\<close>\n\nlift_definition qiop ::\n  \\<open>('a \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'd \\<Rightarrow> 'e \\<Rightarrow> 'f) \\<Rightarrow>\n   ('a, '\\<alpha>) uexpr \\<Rightarrow> ('b, '\\<alpha>) uexpr \\<Rightarrow> ('c, '\\<alpha>) uexpr \\<Rightarrow> ('d, '\\<alpha>) uexpr \\<Rightarrow> ('e, '\\<alpha>) uexpr \\<Rightarrow>\n   ('f, '\\<alpha>) uexpr\\<close>\n  is \\<open>\\<lambda>f u v w x y b. f (u b) (v b) (w b) (x b) (y b)\\<close> .\nlift_definition sxop ::\n  \\<open>('a \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'd \\<Rightarrow> 'e \\<Rightarrow> 'f \\<Rightarrow> 'g) \\<Rightarrow>\n   ('a, '\\<alpha>) uexpr \\<Rightarrow> ('b, '\\<alpha>) uexpr \\<Rightarrow> ('c, '\\<alpha>) uexpr \\<Rightarrow> ('d, '\\<alpha>) uexpr \\<Rightarrow> ('e, '\\<alpha>) uexpr \\<Rightarrow>\n   ('f, '\\<alpha>) uexpr \\<Rightarrow> ('g, '\\<alpha>) uexpr\\<close>\n  is \\<open>\\<lambda>f u v w x y z b. f (u b) (v b) (w b) (x b) (y b) (z b)\\<close> .\nlift_definition sepop ::\n  \\<open>('a \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'd \\<Rightarrow> 'e \\<Rightarrow> 'f \\<Rightarrow> 'g \\<Rightarrow> 'h) \\<Rightarrow>\n   ('a, '\\<alpha>) uexpr \\<Rightarrow> ('b, '\\<alpha>) uexpr \\<Rightarrow> ('c, '\\<alpha>) uexpr \\<Rightarrow> ('d, '\\<alpha>) uexpr \\<Rightarrow> ('e, '\\<alpha>) uexpr \\<Rightarrow>\n   ('f, '\\<alpha>) uexpr \\<Rightarrow> ('g, '\\<alpha>) uexpr \\<Rightarrow> ('h, '\\<alpha>) uexpr\\<close>\n  is \\<open>\\<lambda>f u v w x y z a b. f (u b) (v b) (w b) (x b) (y b) (z b) (a b)\\<close> .\nupdate_uexpr_rep_eq_thms \\<comment> \\<open>Necessary to get the above utilized by \\{pred,rel\\}\\_\\{auto,simp\\}\\<close>\n\ntext \\<open>The below lemmas do not seem useful in general but are included for completeness.\\<close>\nlemma qiop_ueval [ueval]: \\<open>\\<lbrakk>qiop f v x y z w\\<rbrakk>\\<^sub>e b = f (\\<lbrakk>v\\<rbrakk>\\<^sub>e b) (\\<lbrakk>x\\<rbrakk>\\<^sub>e b) (\\<lbrakk>y\\<rbrakk>\\<^sub>e b) (\\<lbrakk>z\\<rbrakk>\\<^sub>e b) (\\<lbrakk>w\\<rbrakk>\\<^sub>e b)\\<close>\n  by transfer simp\n\nlemma subst_qiop [usubst]: \\<open>\\<sigma> \\<dagger> qiop f t u v w x = qiop f (\\<sigma> \\<dagger> t) (\\<sigma> \\<dagger> u) (\\<sigma> \\<dagger> v) (\\<sigma> \\<dagger> w) (\\<sigma> \\<dagger> x)\\<close>\n  by transfer simp\n\nlemma unrest_qiop [unrest]: \\<open>\\<lbrakk>x \\<sharp> t; x \\<sharp> u; x \\<sharp> v; x \\<sharp> w; x \\<sharp> y\\<rbrakk> \\<Longrightarrow> x \\<sharp> qiop f t u v w y\\<close>\n  by transfer simp\n\nlemma aext_qiop [alpha]:\n  \\<open>qiop f t u v w x \\<oplus>\\<^sub>p a = qiop f (t \\<oplus>\\<^sub>p a) (u \\<oplus>\\<^sub>p a) (v \\<oplus>\\<^sub>p a) (w \\<oplus>\\<^sub>p a) (x \\<oplus>\\<^sub>p a)\\<close>\n  by pred_auto\n\nlemma lit_qiop_simp [lit_simps]:\n  \\<open>\\<guillemotleft>i x y z u t\\<guillemotright> = qiop i \\<guillemotleft>x\\<guillemotright> \\<guillemotleft>y\\<guillemotright> \\<guillemotleft>z\\<guillemotright> \\<guillemotleft>u\\<guillemotright> \\<guillemotleft>t\\<guillemotright>\\<close>\n  by transfer simp\n\nlemma sxop_ueval [ueval]: \\<open>\\<lbrakk>sxop f v x y z w t\\<rbrakk>\\<^sub>e b = f (\\<lbrakk>v\\<rbrakk>\\<^sub>eb) (\\<lbrakk>x\\<rbrakk>\\<^sub>eb) (\\<lbrakk>y\\<rbrakk>\\<^sub>eb) (\\<lbrakk>z\\<rbrakk>\\<^sub>eb) (\\<lbrakk>w\\<rbrakk>\\<^sub>eb) (\\<lbrakk>t\\<rbrakk>\\<^sub>eb)\\<close>\n  by transfer simp\n\nlemma subst_sxop [usubst]:\n  \\<open>\\<sigma> \\<dagger> sxop f t u v w x y = sxop f (\\<sigma> \\<dagger> t) (\\<sigma> \\<dagger> u) (\\<sigma> \\<dagger> v) (\\<sigma> \\<dagger> w) (\\<sigma> \\<dagger> x) (\\<sigma> \\<dagger> y)\\<close>\n  by transfer simp\n\nlemma unrest_sxop [unrest]: \\<open>\\<lbrakk>x \\<sharp> t; x \\<sharp> u; x \\<sharp> v; x \\<sharp> w; x \\<sharp> y; x \\<sharp> z\\<rbrakk> \\<Longrightarrow> x \\<sharp> sxop f t u v w y z\\<close>\n  by transfer simp\n\nlemma aext_sxop [alpha]:\n  \\<open>sxop f t u v w x y \\<oplus>\\<^sub>p a = sxop f (t \\<oplus>\\<^sub>p a) (u \\<oplus>\\<^sub>p a) (v \\<oplus>\\<^sub>p a) (w \\<oplus>\\<^sub>p a) (x \\<oplus>\\<^sub>p a) (y \\<oplus>\\<^sub>p a)\\<close>\n  by pred_auto\n\nlemma lit_sxop_simp [lit_simps]:\n  \\<open>\\<guillemotleft>i x y z u t v\\<guillemotright> = sxop i \\<guillemotleft>x\\<guillemotright> \\<guillemotleft>y\\<guillemotright> \\<guillemotleft>z\\<guillemotright> \\<guillemotleft>u\\<guillemotright> \\<guillemotleft>t\\<guillemotright> \\<guillemotleft>v\\<guillemotright>\\<close>\n  by transfer simp\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP-Extended/utils/utp_extensions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631556226292, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3275202447107261}}
{"text": "section \\<open>Refined Test Suite Calculation\\<close>\n\ntext \\<open>This theory refines some of the algorithms defined in @{text \"Test_Suite_Calculation\"}\n      using containers from the Containers framework.\\<close>\n\ntheory Test_Suite_Calculation_Refined\n  imports Test_Suite_Calculation \n          \"../Util_Refined\"\n          Deriving.Compare\n          Containers.Containers\nbegin\n\n\n\nsubsection \\<open>New Instances\\<close>\n\nsubsubsection \\<open>Order on FSMs\\<close>\n\ninstantiation fsm :: (ord,ord,ord) ord\nbegin\n\nfun less_eq_fsm ::  \"('a,'b,'c) fsm \\<Rightarrow> ('a,'b,'c) fsm \\<Rightarrow> bool\" where\n  \"less_eq_fsm M1 M2 = \n    (if initial M1 < initial M2 \n      then True\n      else ((initial M1 = initial M2) \\<and> (if set_less_aux (states M1)  (states M2)\n        then True\n        else ((states M1 = states M2) \\<and> (if set_less_aux (inputs M1) (inputs M2)\n          then True\n          else ((inputs M1 = inputs M2) \\<and> (if set_less_aux (outputs M1) (outputs M2)\n            then True\n            else ((outputs M1 = outputs M2) \\<and> (set_less_aux (transitions M1) (transitions M2) \\<or> (transitions M1) = (transitions M2))))))))))\"\n\nfun less_fsm ::  \"('a,'b,'c) fsm \\<Rightarrow> ('a,'b,'c) fsm \\<Rightarrow> bool\" where\n  \"less_fsm a b = (a \\<le> b \\<and> a \\<noteq> b)\"\n\ninstance by (intro_classes)\nend\n\n\ninstantiation fsm :: (linorder,linorder,linorder) linorder\nbegin\n\nlemma less_le_not_le_FSM :\n  fixes x :: \"('a,'b,'c) fsm\"\n  and   y :: \"('a,'b,'c) fsm\"\nshows \"(x < y) = (x \\<le> y \\<and> \\<not> y \\<le> x)\"\nproof \n  show \"x < y \\<Longrightarrow> x \\<le> y \\<and> \\<not> y \\<le> x\" \n       \n  proof -\n    assume \"x < y\"\n    then show \"x \\<le> y \\<and> \\<not> y \\<le> x\"\n    proof (cases \"FSM.initial x < FSM.initial y\")\n      case True\n      then show ?thesis unfolding less_fsm.simps less_eq_fsm.simps by auto\n    next\n      case False\n      then have *: \"FSM.initial x = FSM.initial y\"\n        using \\<open>x < y\\<close> unfolding less_fsm.simps less_eq_fsm.simps by auto\n      \n      show ?thesis proof (cases \"set_less_aux (FSM.states x) (FSM.states y)\")\n        case True\n        then show ?thesis \n          unfolding less_fsm.simps less_eq_fsm.simps \n          using * set_less_aux_antisym by fastforce\n      next\n        case False\n        then have **: \"FSM.states x = FSM.states y\"\n          using \\<open>x < y\\<close> * unfolding less_fsm.simps less_eq_fsm.simps by auto\n        \n        show ?thesis proof (cases \"set_less_aux (FSM.inputs x) (FSM.inputs y)\")\n          case True\n          then show ?thesis \n            unfolding less_fsm.simps less_eq_fsm.simps \n            using * ** set_less_aux_antisym by fastforce\n        next\n          case False\n          then have ***: \"FSM.inputs x = FSM.inputs y\"\n            using \\<open>x < y\\<close> * ** \n            unfolding less_fsm.simps less_eq_fsm.simps \n            by (simp add: set_less_def)\n          \n          show ?thesis proof (cases \"set_less_aux (FSM.outputs x) (FSM.outputs y)\")\n            case True\n            then show ?thesis \n              unfolding less_fsm.simps less_eq_fsm.simps \n              using * ** *** set_less_aux_antisym \n              by fastforce\n          next\n            case False\n            then have ****: \"FSM.outputs x = FSM.outputs y\"\n              using \\<open>x < y\\<close> * ** *** \n              unfolding less_fsm.simps less_eq_fsm.simps \n              by (simp add: set_less_def)\n\n\n            have \"x \\<noteq> y\" using \\<open>x < y\\<close> by auto\n            then have \"FSM.transitions x \\<noteq> FSM.transitions y\"\n              using * ** *** **** apply transfer\n              by (metis fsm_impl.exhaust_sel) \n            then have *****: \"set_less_aux (FSM.transitions x) (FSM.transitions y)\"\n              using \\<open>x < y\\<close> * ** *** **** \n              unfolding less_fsm.simps less_eq_fsm.simps \n              by (simp add: set_less_aux_def)\n\n            then have \"\\<not>(set_less_aux (FSM.transitions y) (FSM.transitions x) \\<or> transitions y = transitions x)\"\n              using \\<open>FSM.transitions x \\<noteq> FSM.transitions y\\<close> fsm_transitions_finite set_less_aux_antisym \n              by auto\n            then have \"\\<not> y \\<le> x\"\n              using * ** *** **** \n              unfolding less_fsm.simps less_eq_fsm.simps \n              by (simp add: set_less_def)\n            then show ?thesis using \\<open>x < y\\<close> \n              using less_fsm.elims(2) \n              by blast\n          qed\n        qed\n      qed\n    qed\n  qed\n\n  show \"x \\<le> y \\<and> \\<not> y \\<le> x \\<Longrightarrow> x < y\"\n    using less_fsm.elims(3) \n    by blast\nqed\n\n    \nlemma order_refl_FSM :\n  fixes x :: \"('a,'b,'c) fsm\"\n  shows \"x \\<le> x\" \n  by auto\n\nlemma order_trans_FSM :\n  fixes x :: \"('a,'b,'c) fsm\"\n  fixes y :: \"('a,'b,'c) fsm\"\n  fixes z :: \"('a,'b,'c) fsm\"\n  shows \"x \\<le> y \\<Longrightarrow> y \\<le> z \\<Longrightarrow> x \\<le> z\"\n  unfolding less_eq_fsm.simps \n  using less_trans[of \"initial x\" \"initial y\" \"initial z\"]\n        set_less_aux_trans[of \"states x\" \"states y\" \"states z\"]\n        set_less_aux_trans[of \"inputs x\" \"inputs y\" \"inputs z\"]\n        set_less_aux_trans[of \"outputs x\" \"outputs y\" \"outputs z\"]\n        set_less_aux_trans[of \"transitions x\" \"transitions y\" \"transitions z\"]\n  by metis\n\nlemma antisym_FSM :\n  fixes x :: \"('a,'b,'c) fsm\"\n  fixes y :: \"('a,'b,'c) fsm\"\nshows \"x \\<le> y \\<Longrightarrow> y \\<le> x \\<Longrightarrow> x = y\"\n  unfolding less_eq_fsm.simps\n  using equal_fsm_def[of x y] \n  unfolding equal_class.equal\n  by (metis order.asym set_less_aux_antisym)\n\nlemma linear_FSM :\n  fixes x :: \"('a,'b,'c) fsm\"\n  fixes y :: \"('a,'b,'c) fsm\"\nshows \"x \\<le> y \\<or> y \\<le> x\"\n  unfolding less_eq_fsm.simps \n  by (metis fsm_inputs_finite fsm_states_finite fsm_outputs_finite fsm_transitions_finite neq_iff set_less_aux_finite_total) \n\n\ninstance \n  using less_le_not_le_FSM order_refl_FSM order_trans_FSM antisym_FSM linear_FSM \n  by (intro_classes; metis+)\nend\n\n\n\n\ninstantiation fsm :: (linorder,linorder,linorder) compare\nbegin \nfun compare_fsm :: \"('a, 'b, 'c) fsm \\<Rightarrow> ('a, 'b, 'c) fsm \\<Rightarrow> order\" where\n  \"compare_fsm x y = comparator_of x y\"\n\ninstance   \n  using comparator_of compare_fsm.elims\n  by (intro_classes; simp add: comparator_def)\nend\n\n(* The above order on FSMs is currently not used in code generation,\n   as there are few sets of FSMs and hence on evaluated examples it is\n   more efficient to simply store FSMs using d-lists.*)\n(*\ninstantiation fsm :: (linorder,linorder,linorder) ccompare\nbegin\ndefinition ccompare_fsm :: \"(('a, 'b, 'c) fsm \\<Rightarrow> ('a, 'b, 'c) fsm \\<Rightarrow> order) option\" where\n  \"ccompare_fsm = Some compare\"\n\ninstance by (intro_classes; simp add: ccompare_fsm_def comparator_compare)\nend\n*)\n\n\nsubsubsection \\<open>Derived Instances\\<close>\n\nderive (eq) ceq fsm\n\nderive (dlist) set_impl fsm\nderive (assoclist) mapping_impl fsm\n\nderive (no) cenum fsm\nderive (no) ccompare fsm\n\n\nsubsubsection \\<open>Finiteness and Cardinality Instantiations for FSMs\\<close>\n\n(*\ntext \\<open>The following type class partially encodes infinity of a type.\n      This is done because later instantiations assume the universe of FSMs to be infinite in \n      order to reduce the effort required to instantiate proper intervals over FSMs.\n      This class is not a good idea for any general usage, as many types (e.g. pairs) have\n      conflicting instantiations (see for example https://lists.cam.ac.uk/pipermail/cl-isabelle-users/2013-July/msg00104.html).\\<close>\nclass infinite_UNIV =\n  assumes infinite_UNIV: \"infinite (UNIV :: 'a set)\"\nbegin\nend\n\ninstantiation integer :: infinite_UNIV begin\ninstance apply intro_classes\n  by (simp add: infinite_UNIV_char_0) \nend\n\ninstantiation nat :: infinite_UNIV begin\ninstance apply intro_classes\n  by (simp add: infinite_UNIV_char_0) \nend\n\ninstantiation int :: infinite_UNIV begin\ninstance apply intro_classes\n  by (simp add: infinite_UNIV_char_0) \nend\n\n(* too restrictive *)\ninstantiation sum :: (infinite_UNIV,type) infinite_UNIV begin\ninstance apply intro_classes\n  by (simp add: infinite_UNIV)\nend\n\n(* too restrictive *)\ninstantiation prod :: (infinite_UNIV,type) infinite_UNIV begin\ninstance apply intro_classes\n  by (simp add: finite_prod infinite_UNIV)  \nend\n\nlemma infinite_UNIV_fsm : \n  shows \"infinite (UNIV :: ('a :: infinite_UNIV,'b,'c) fsm set)\"\nproof -\n  (* if infinitely many states exist, then infinitely many distinct singleton fsms can be created *)\n  define f :: \"'a \\<Rightarrow> ('a,'b,'c) fsm\" where f_def: \"f = (\\<lambda> q . fsm_from_list q [])\"\n  have \"inj f\" \n  proof \n    fix x y assume \"x \\<in> (UNIV :: 'a set)\" and \"y \\<in> UNIV\" and \"f x = f y\" \n    then show \"x = y\" unfolding f_def by (transfer; auto)\n  qed\n  moreover have \"infinite (UNIV :: 'a set)\"\n    using infinite_UNIV by auto\n  ultimately show ?thesis\n    by (meson finite_imageD infinite_iff_countable_subset top_greatest) \nqed\n*)\n\n\nlemma finiteness_fsm_UNIV : \"finite (UNIV :: ('a,'b,'c) fsm set) = \n                              (finite (UNIV :: 'a set) \\<and> finite (UNIV :: 'b set) \\<and> finite (UNIV :: 'c set))\"\nproof \n\n  define f :: \"'a \\<Rightarrow> ('a) fset\" where f_def: \"f = (\\<lambda> q . {| q |})\"\n  have \"inj f\" \n  proof \n    fix x y assume \"x \\<in> (UNIV :: 'a set)\" and \"y \\<in> UNIV\" and \"f x = f y\" \n    then show \"x = y\" unfolding f_def by (transfer; auto)\n  qed\n\n  show \"finite (UNIV :: ('a,'b,'c) fsm set) \\<Longrightarrow> (finite (UNIV :: 'a set) \\<and> finite (UNIV :: 'b set) \\<and> finite (UNIV :: 'c set))\"\n  proof (rule ccontr)\n\n    obtain q where \"q \\<in> (UNIV :: 'a set)\" by auto\n    obtain x where \"x \\<in> (UNIV :: 'b set)\" by auto\n    obtain y where \"y \\<in> (UNIV :: 'c set)\" by auto\n\n    assume \"finite (UNIV :: ('a,'b,'c) fsm set)\" and \"\\<not> (finite (UNIV :: 'a set) \\<and> finite (UNIV :: 'b set) \\<and> finite (UNIV :: 'c set))\"\n\n    then consider (a) \"\\<not> finite (UNIV :: 'a set)\" | (b) \"\\<not> finite (UNIV :: 'b set)\" | (c) \"\\<not> finite (UNIV :: 'c set)\"\n      by blast\n    then show \"False\" proof cases\n      case a\n      define f :: \"'a \\<Rightarrow> ('a,'b,'c) fsm\" where \"f = (\\<lambda> q . fsm_from_list q [])\"\n      have \"inj f\" \n        unfolding inj_def f_def by (transfer; auto)\n      then have \"\\<not> finite (f ` UNIV)\"\n        using \\<open>inj f\\<close> finite_imageD a by auto\n      then have \"\\<not> finite (UNIV :: ('a,'b,'c) fsm set)\" \n        by (meson infinite_iff_countable_subset top_greatest) \n      then show ?thesis \n        using \\<open>finite (UNIV :: ('a,'b,'c) fsm set)\\<close> by blast\n    next\n      case b\n      define f :: \"'b \\<Rightarrow> ('a,'b,'c) fsm\" where \"f = (\\<lambda> x . fsm_from_list q [(q,x,y,q)])\"\n      have \"inj f\" \n        unfolding inj_def f_def by (transfer; auto)\n      then have \"\\<not> finite (f ` UNIV)\"\n        using \\<open>inj f\\<close> finite_imageD b by auto\n      then have \"\\<not> finite (UNIV :: ('a,'b,'c) fsm set)\" \n        by (meson infinite_iff_countable_subset top_greatest) \n      then show ?thesis \n        using \\<open>finite (UNIV :: ('a,'b,'c) fsm set)\\<close> by blast\n    next\n      case c\n      define f :: \"'c \\<Rightarrow> ('a,'b,'c) fsm\" where \"f = (\\<lambda> y . fsm_from_list q [(q,x,y,q)])\"\n      have \"inj f\" \n        unfolding inj_def f_def by (transfer; auto)\n      then have \"\\<not> finite (f ` UNIV)\"\n        using \\<open>inj f\\<close> finite_imageD c by auto\n      then have \"\\<not> finite (UNIV :: ('a,'b,'c) fsm set)\" \n        by (meson infinite_iff_countable_subset top_greatest) \n      then show ?thesis \n        using \\<open>finite (UNIV :: ('a,'b,'c) fsm set)\\<close> by blast\n    qed\n  qed\n\n  show \"(finite (UNIV :: 'a set) \\<and> finite (UNIV :: 'b set) \\<and> finite (UNIV :: 'c set)) \\<Longrightarrow> finite (UNIV :: ('a,'b,'c) fsm set)\"\n  proof -\n    define f :: \"('a,'b,'c) fsm \\<Rightarrow> ('a \\<times> 'a set \\<times> 'b set \\<times> 'c set \\<times> ('a \\<times> 'b \\<times> 'c \\<times> 'a) set)\" where\n      \"f = (\\<lambda> m . (initial m, states m, inputs m, outputs m, transitions m))\"\n    assume \"(finite (UNIV :: 'a set) \\<and> finite (UNIV :: 'b set) \\<and> finite (UNIV :: 'c set))\"\n    then have \"finite (UNIV :: ('a \\<times> 'a set \\<times> 'b set \\<times> 'c set \\<times> ('a \\<times> 'b \\<times> 'c \\<times> 'a) set) set)\"\n      by (simp add: Finite_Set.finite_set finite_prod)\n    moreover have \"f ` (UNIV :: ('a,'b,'c) fsm set) \\<subseteq> (UNIV :: ('a \\<times> 'a set \\<times> 'b set \\<times> 'c set \\<times> ('a \\<times> 'b \\<times> 'c \\<times> 'a) set) set)\"\n      by auto\n    moreover have \"inj f\"\n      unfolding inj_def f_def apply transfer\n      by (simp add: fsm_impl.expand) \n    ultimately show ?thesis by (metis inj_on_finite)\n  qed\nqed\n\n\ninstantiation fsm :: (finite_UNIV,finite_UNIV,finite_UNIV) finite_UNIV begin\ndefinition \"finite_UNIV = Phantom(('a,'b,'c) fsm) (of_phantom (finite_UNIV :: 'a finite_UNIV) \\<and>\n                                                   of_phantom (finite_UNIV :: 'b finite_UNIV) \\<and>\n                                                   of_phantom (finite_UNIV :: 'c finite_UNIV))\"\n\ninstance by(intro_classes)(simp add: finite_UNIV_fsm_def finite_UNIV finiteness_fsm_UNIV)\nend\n\n\n\n\n\n\n\ninstantiation fsm :: (card_UNIV,card_UNIV,card_UNIV) card_UNIV begin\n\ndefinition \"card_UNIV = Phantom(('a,'b,'c) fsm) \n  (if CARD('a) = 0 \\<or> CARD('b) = 0 \\<or> CARD('c) = 0 \n    then 0 \n    else card ((\\<lambda>(q::'a, Q, X::'b set, Y::'c set, T). FSM.create_fsm_from_sets q Q X Y T) ` UNIV))\"\ninstance apply intro_classes \nproof (cases \"CARD('a) = 0 \\<or> CARD('b) = 0 \\<or> CARD('c) = 0\")\n  case True \n  then have \"\\<not> (finite (UNIV :: 'a set) \\<and> finite (UNIV :: 'b set) \\<and> finite (UNIV :: 'c set))\"\n    by force\n  then have \"infinite (UNIV :: ('a, 'b, 'c) fsm set)\" \n    using finiteness_fsm_UNIV by blast\n  then have \"card (UNIV :: ('a, 'b, 'c) fsm set) = 0\"\n    by auto\n  then show \"card_UNIV_class.card_UNIV = Phantom(('a, 'b, 'c) fsm) CARD(('a, 'b, 'c) fsm)\"\n    using True\n    by (simp add: card_UNIV_fsm_def) \nnext\n  case False\n  then have \"finite (UNIV :: 'a set)\" and \"finite (UNIV :: 'b set)\" and \"finite (UNIV :: 'c set)\"\n    by force+\n  then have \"surj (\\<lambda>(q::'a, Q, X::'b set, Y::'c set, T). FSM.create_fsm_from_sets q Q X Y T)\"\n    using create_fsm_from_sets_surj by blast\n  then show \"card_UNIV_class.card_UNIV = Phantom(('a, 'b, 'c) fsm) CARD(('a, 'b, 'c) fsm)\" \n    using False\n    by (simp add: card_UNIV_fsm_def) \nqed\nend\n\n\ninstantiation fsm :: (type,type,type) cproper_interval begin\ndefinition cproper_interval_fsm :: \"(('a,'b,'c) fsm) proper_interval\" where\n  \"cproper_interval_fsm m1 m2 = undefined\"\ninstance by(intro_classes)(simp add: ID_None ccompare_fsm_def)\nend \n\n\n\n\n\nsubsection \\<open>Updated Code Equations\\<close>\n\nsubsubsection \\<open>New Code Equations for @{text \"remove_proper_prefixes\"}\\<close>\n\ndeclare [[code drop: remove_proper_prefixes]]\n\n\nlemma remove_proper_prefixes_refined[code] :\n  fixes t :: \"('a :: ccompare) list set_rbt\" \nshows \"remove_proper_prefixes (RBT_set t) = (case ID CCOMPARE(('a list)) of\n  Some _ \\<Rightarrow> (if (is_empty t) then {} else set (paths (from_list (RBT_Set2.keys t)))) |\n  None   \\<Rightarrow> Code.abort (STR ''remove_proper_prefixes RBT_set: ccompare = None'') (\\<lambda>_. remove_proper_prefixes (RBT_set t)))\"\n  (is \"?v1 = ?v2\")\nproof (cases \"ID CCOMPARE(('a list))\")\n  case None\n  then show ?thesis by simp\nnext\n  case (Some a)\n  then have *:\"ID ccompare \\<noteq> (None :: ('a::ccompare list \\<Rightarrow> 'a::ccompare list \\<Rightarrow> order) option)\" by auto\n  \n  show ?thesis proof (cases \"is_empty t\")\n    case True\n    then show ?thesis unfolding Some remove_proper_prefixes_def by auto\n  next\n    case False\n    then have \"?v2 = set (paths (from_list (RBT_Set2.keys t)))\" using Some by auto\n    moreover have \"?v1 = set (paths (from_list (RBT_Set2.keys t)))\"\n      using False unfolding RBT_set_conv_keys[OF *, of t] remove_proper_prefixes_code_trie \n      by (cases \"RBT_Set2.keys t\"; auto)\n    ultimately show ?thesis by simp\n  qed\nqed\n\n\n\n\n\nsubsubsection \\<open>Special Handling for @{text \"set_as_map\"} on @{text \"image\"}\\<close>\n\n\ntext \\<open>Avoid creating an intermediate set for @{text \"(image f xs)\"} when evaluating @{text \"(set_as_map (image f xs))\"}.\\<close>\n\ndefinition set_as_map_image :: \"('a1 \\<times> 'a2) set \\<Rightarrow> (('a1 \\<times> 'a2) \\<Rightarrow> ('b1 \\<times> 'b2)) \\<Rightarrow> ('b1 \\<Rightarrow> 'b2 set option)\" where \n  \"set_as_map_image xs f = (set_as_map (image f xs))\"\n\n(* combine two separate set_as_map_image calls on the same set *)\ndefinition dual_set_as_map_image :: \"('a1 \\<times> 'a2) set \\<Rightarrow> (('a1 \\<times> 'a2) \\<Rightarrow> ('b1 \\<times> 'b2)) \\<Rightarrow> (('a1 \\<times> 'a2) \\<Rightarrow> ('c1 \\<times> 'c2)) \\<Rightarrow> (('b1 \\<Rightarrow> 'b2 set option) \\<times> ('c1 \\<Rightarrow> 'c2 set option))\" where \n  \"dual_set_as_map_image xs f1 f2 = (set_as_map (image f1 xs), set_as_map (image f2 xs))\"\n\n\nlemma set_as_map_image_code[code]  :\n  fixes t :: \"('a1 ::ccompare \\<times> 'a2 :: ccompare) set_rbt\" \n  and   f1 :: \"('a1 \\<times> 'a2) \\<Rightarrow> ('b1 :: ccompare \\<times> 'b2 ::ccompare)\"\nshows \"set_as_map_image (RBT_set t) f1 = (case ID CCOMPARE(('a1 \\<times> 'a2)) of\n           Some _ \\<Rightarrow> Mapping.lookup \n                      (RBT_Set2.fold (\\<lambda> kv m1 .\n                        ( case f1 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m1 (x) of None \\<Rightarrow> Mapping.update (x) {z} m1 | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m1)))\n                      t\n                      Mapping.empty) |\n           None   \\<Rightarrow> Code.abort (STR ''set_as_map_image RBT_set: ccompare = None'') \n                                (\\<lambda>_. set_as_map_image (RBT_set t) f1))\"\nproof (cases \"ID CCOMPARE(('a1 \\<times> 'a2))\")\n  case None\n  then show ?thesis by auto\nnext\n  case (Some a)\n\n  let ?f' = \"\\<lambda> t . (RBT_Set2.fold (\\<lambda> kv m1 .\n                        ( case f1 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m1 (x) of None \\<Rightarrow> Mapping.update (x) {z} m1 | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m1)))\n                      t\n                      Mapping.empty)\"\n\n  let ?f = \"\\<lambda> xs . (fold (\\<lambda> kv m1 . case f1 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m1 (x) of None \\<Rightarrow> Mapping.update (x) {z} m1 | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m1))\n                            xs Mapping.empty)\"\n  have \"\\<And> xs :: ('a1 \\<times> 'a2) list . Mapping.lookup (?f xs) = (\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` set xs) then Some {z . (x,z) \\<in> f1 ` set xs} else None)\"\n  proof -\n    fix xs :: \"('a1 \\<times> 'a2) list\"\n    show \"Mapping.lookup (?f xs) = (\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` set xs) then Some {z . (x,z) \\<in> f1 ` set xs} else None)\"\n    proof (induction xs rule: rev_induct)\n      case Nil\n      then show ?case \n        by (simp add: Mapping.empty.abs_eq Mapping.lookup.abs_eq) \n    next\n      case (snoc xz xs)\n      then obtain x z where \"f1  xz = (x,z)\" \n        by (metis (mono_tags, opaque_lifting) surj_pair)\n  \n      then have *: \"(?f (xs@[xz])) = (case Mapping.lookup (?f xs) x of\n                                  None \\<Rightarrow> Mapping.update x {z} (?f xs) |\n                                  Some zs \\<Rightarrow> Mapping.update x (Set.insert z zs) (?f xs))\"\n        by auto\n  \n      then show ?case proof (cases \"Mapping.lookup (?f xs) x\")\n        case None\n        then have **: \"Mapping.lookup (?f (xs@[xz])) = Mapping.lookup (Mapping.update x {z} (?f xs))\" using * by auto\n  \n        have scheme: \"\\<And> m k v . Mapping.lookup (Mapping.update k v m) = (\\<lambda>k' . if k' = k then Some v else Mapping.lookup m k')\"\n          by (metis lookup_update')\n  \n  \n        have m1: \"Mapping.lookup (?f (xs@[xz])) = (\\<lambda> x' . if x' = x then Some {z} else Mapping.lookup (?f xs) x')\"\n          unfolding ** \n          unfolding scheme by force\n  \n        have \"(\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` set xs) then Some {z . (x,z) \\<in> f1 ` set xs} else None) x = None\"\n        using None snoc by auto\n        then have \"\\<not>(\\<exists> z . (x,z) \\<in> f1 ` set xs)\"\n          by (metis (mono_tags, lifting) option.distinct(1))\n        then have \"(\\<exists> z' . (x,z') \\<in> f1 ` set (xs@[xz]))\" and \"{z' . (x,z') \\<in> f1 ` set (xs@[xz])} = {z}\"\n          using \\<open>f1  xz = (x,z)\\<close> by fastforce+\n        then have m2: \"(\\<lambda> x' . if (\\<exists> z' . (x',z') \\<in> f1 ` set (xs@[xz])) then Some {z' . (x',z') \\<in> f1 ` set (xs@[xz])} else None)\n                     = (\\<lambda> x' . if x' = x then Some {z} else (\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` set xs) then Some {z . (x,z) \\<in> f1 ` set xs} else None) x')\"\n          using \\<open>f1  xz = (x,z)\\<close> by fastforce\n        \n        show ?thesis using m1 m2 snoc\n          using \\<open>f1 xz = (x, z)\\<close> by presburger\n      next\n        case (Some zs)\n        then have **: \"Mapping.lookup (?f (xs@[xz])) = Mapping.lookup (Mapping.update x (Set.insert z zs) (?f xs))\" using * by auto\n        have scheme: \"\\<And> m k v . Mapping.lookup (Mapping.update k v m) = (\\<lambda>k' . if k' = k then Some v else Mapping.lookup m k')\"\n          by (metis lookup_update')\n  \n        have m1: \"Mapping.lookup (?f (xs@[xz])) = (\\<lambda> x' . if x' = x then Some (Set.insert z zs) else Mapping.lookup (?f xs) x')\"\n          unfolding ** \n          unfolding scheme by force\n  \n  \n        have \"(\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` set xs) then Some {z . (x,z) \\<in> f1 ` set xs} else None) x = Some zs\"\n          using Some snoc by auto\n        then have \"(\\<exists> z' . (x,z') \\<in> f1 ` set xs)\"\n          unfolding case_prod_conv using  option.distinct(2) by metis\n        then have \"(\\<exists> z' . (x,z') \\<in> f1 ` set (xs@[xz]))\" by fastforce\n  \n        have \"{z' . (x,z') \\<in> f1 ` set (xs@[xz])} = Set.insert z zs\"\n        proof -\n          have \"Some {z . (x,z) \\<in> f1 ` set xs} = Some zs\"\n            using \\<open>(\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` set xs) then Some {z . (x,z) \\<in> f1 ` set xs} else None) x = Some zs\\<close>\n            unfolding case_prod_conv using  option.distinct(2) by metis\n          then have \"{z . (x,z) \\<in> f1 ` set xs} = zs\" by auto\n          then show ?thesis \n            using \\<open>f1 xz = (x, z)\\<close> by auto\n        qed\n  \n        have \"\\<And> a  . (\\<lambda> x' . if (\\<exists> z' . (x',z') \\<in> f1 ` set (xs@[xz])) then Some {z' . (x',z') \\<in> f1 ` set (xs@[xz])} else None) a\n                   = (\\<lambda> x' . if x' = x then Some (Set.insert z zs) else (\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` set xs) then Some {z . (x,z) \\<in> f1 ` set xs} else None) x') a\" \n        proof -\n          fix a show \"(\\<lambda> x' . if (\\<exists> z' . (x',z') \\<in> f1 ` set (xs@[xz])) then Some {z' . (x',z') \\<in> f1 ` set (xs@[xz])} else None) a\n                     = (\\<lambda> x' . if x' = x then Some (Set.insert z zs) else (\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` set xs) then Some {z . (x,z) \\<in> f1 ` set xs} else None) x') a\"\n          using \\<open>{z' . (x,z') \\<in> f1 ` set (xs@[xz])} = Set.insert z zs\\<close> \\<open>(\\<exists> z' . (x,z') \\<in> f1 ` set (xs@[xz]))\\<close> \\<open>f1 xz = (x, z)\\<close>\n          by (cases \"a = x\"; auto)\n        qed\n\n        then have m2: \"(\\<lambda> x' . if (\\<exists> z' . (x',z') \\<in> f1 ` set (xs@[xz])) then Some {z' . (x',z') \\<in> f1 ` set (xs@[xz])} else None)\n                     = (\\<lambda> x' . if x' = x then Some (Set.insert z zs) else (\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` set xs) then Some {z . (x,z) \\<in> f1 ` set xs} else None) x')\"\n          by auto\n  \n  \n        show ?thesis using m1 m2 snoc\n          using \\<open>f1 xz = (x, z)\\<close> by presburger\n      qed\n    qed\n  qed\n\n\n  \n  then have \"Mapping.lookup (?f' t) = (\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` set (RBT_Set2.keys t)) then Some {z . (x,z) \\<in> f1 ` set (RBT_Set2.keys t)} else None)\"\n    unfolding fold_conv_fold_keys by metis\n  moreover have \"set (RBT_Set2.keys t) = (RBT_set t)\" \n    using Some by (simp add: RBT_set_conv_keys) \n  ultimately have \"Mapping.lookup (?f' t) = (\\<lambda> x . if (\\<exists> z . (x,z) \\<in> f1 ` (RBT_set t)) then Some {z . (x,z) \\<in> f1 ` (RBT_set t)} else None)\"\n    by force\n  then show ?thesis \n    using Some unfolding set_as_map_image_def set_as_map_def by simp\nqed\n\n\nlemma dual_set_as_map_image_code[code] :\n  fixes t :: \"('a1 ::ccompare \\<times> 'a2 :: ccompare) set_rbt\" \n  and   f1 :: \"('a1 \\<times> 'a2) \\<Rightarrow> ('b1 :: ccompare \\<times> 'b2 ::ccompare)\"\n  and   f2 :: \"('a1 \\<times> 'a2) \\<Rightarrow> ('c1 :: ccompare \\<times> 'c2 ::ccompare)\"\n  shows \"dual_set_as_map_image (RBT_set t) f1 f2 = (case ID CCOMPARE(('a1 \\<times> 'a2)) of\n           Some _ \\<Rightarrow> let mm = (RBT_Set2.fold (\\<lambda> kv (m1,m2) .\n                        ( case f1 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m1 (x) of None \\<Rightarrow> Mapping.update (x) {z} m1 | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m1)\n                        , case f2 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m2 (x) of None \\<Rightarrow> Mapping.update (x) {z} m2 | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m2)))\n                      t\n                      (Mapping.empty,Mapping.empty))\n                     in (Mapping.lookup (fst mm), Mapping.lookup (snd mm)) |\n           None   \\<Rightarrow> Code.abort (STR ''dual_set_as_map_image RBT_set: ccompare = None'') \n                                (\\<lambda>_. (dual_set_as_map_image (RBT_set t) f1 f2)))\"\nproof (cases \"ID CCOMPARE(('a1 \\<times> 'a2))\")\n  case None\n  then show ?thesis by auto\nnext\n  case (Some a)\n\n  let ?f1 = \"\\<lambda> xs . (fold (\\<lambda> kv m . case f1 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m (x) of None \\<Rightarrow> Mapping.update (x) {z} m | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m)) xs Mapping.empty)\"\n  let ?f2 = \"\\<lambda> xs . (fold (\\<lambda> kv m . case f2 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m (x) of None \\<Rightarrow> Mapping.update (x) {z} m | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m)) xs Mapping.empty)\"\n\n  let ?f12 = \"\\<lambda> xs . fold (\\<lambda> kv (m1,m2) .\n                        ( case f1 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m1 (x) of None \\<Rightarrow> Mapping.update (x) {z} m1 | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m1)\n                        , case f2 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m2 (x) of None \\<Rightarrow> Mapping.update (x) {z} m2 | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m2)))\n                      xs\n                      (Mapping.empty,Mapping.empty)\"\n\n  let ?f1' = \"\\<lambda> t . (RBT_Set2.fold (\\<lambda> kv m . case f1 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m (x) of None \\<Rightarrow> Mapping.update (x) {z} m | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m)) t Mapping.empty)\"\n  let ?f2' = \"\\<lambda> t . (RBT_Set2.fold (\\<lambda> kv m . case f2 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m (x) of None \\<Rightarrow> Mapping.update (x) {z} m | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m)) t Mapping.empty)\"\n\n  let ?f12' = \"\\<lambda> t . RBT_Set2.fold (\\<lambda> kv (m1,m2) .\n                        ( case f1 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m1 (x) of None \\<Rightarrow> Mapping.update (x) {z} m1 | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m1)\n                        , case f2 kv of (x,z) \\<Rightarrow> (case Mapping.lookup m2 (x) of None \\<Rightarrow> Mapping.update (x) {z} m2 | Some zs \\<Rightarrow> Mapping.update (x) (Set.insert z zs) m2)))\n                      t\n                      (Mapping.empty,Mapping.empty)\"\n\n  have \"\\<And>xs . ?f12 xs = (?f1 xs, ?f2 xs)\"\n    unfolding fold_dual[symmetric] by simp\n  then have \"?f12 (RBT_Set2.keys t) = (?f1 (RBT_Set2.keys t), ?f2 (RBT_Set2.keys t))\"\n    by simp\n  then have \"?f12' t = (?f1' t, ?f2' t)\"\n    unfolding fold_conv_fold_keys by metis\n\n  have \"Mapping.lookup (fst (?f12' t)) = set_as_map (f1 ` (RBT_set t))\" \n    unfolding \\<open>?f12' t = (?f1' t, ?f2' t)\\<close> fst_conv set_as_map_image_def[symmetric]\n    using set_as_map_image_code[of t f1] Some by simp\n  moreover have \"Mapping.lookup (snd (?f12' t)) = set_as_map (f2 ` (RBT_set t))\" \n    unfolding \\<open>?f12' t = (?f1' t, ?f2' t)\\<close> snd_conv set_as_map_image_def[symmetric]\n    using set_as_map_image_code[of t f2] Some by simp\n  ultimately show ?thesis\n    unfolding dual_set_as_map_image_def Let_def using Some by simp\nqed\n\n\n\nsubsubsection \\<open>New Code Equations for @{text \"h\"}\\<close>\n\ndeclare [[code drop: h]]\nlemma h_refined[code] : \"h M (q,x) \n  = (let m = set_as_map_image (transitions M) (\\<lambda>(q,x,y,q') . ((q,x),y,q')) \n      in (case m (q,x) of Some yqs \\<Rightarrow> yqs | None \\<Rightarrow> {}))\"\n  apply transfer\n  unfolding h_code set_as_map_image_def by simp\n\n\n\nsubsubsection \\<open>New Code Equations for @{text \"canonical_separator'\"}\\<close>\n\nlemma canonical_separator'_refined[code] : \n  fixes M :: \"('a,'b,'c) fsm_impl\"\n  shows\n\"FSM_Impl.canonical_separator' M P q1 q2 = (if FSM_Impl.fsm_impl.initial P = (q1,q2) \n  then\n    (let f'  = set_as_map_image (FSM_Impl.fsm_impl.transitions M) (\\<lambda>(q,x,y,q') . ((q,x),y));\n         f   = (\\<lambda>qx . (case f' qx of Some yqs \\<Rightarrow> yqs | None \\<Rightarrow> {}));\n         shifted_transitions' = shifted_transitions (FSM_Impl.fsm_impl.transitions P);\n         distinguishing_transitions_lr = distinguishing_transitions f q1 q2 (FSM_Impl.fsm_impl.states P) (FSM_Impl.fsm_impl.inputs P);\n         ts = shifted_transitions' \\<union> distinguishing_transitions_lr\n     in FSMI\n          (Inl (q1,q2))\n          ((image Inl (FSM_Impl.fsm_impl.states P)) \\<union> {Inr q1, Inr q2})\n          (FSM_Impl.fsm_impl.inputs M \\<union> FSM_Impl.fsm_impl.inputs P)\n          (FSM_Impl.fsm_impl.outputs M \\<union> FSM_Impl.fsm_impl.outputs P)\n          (ts))\n  else FSMI\n          (Inl (q1,q2)) {Inl (q1,q2)} {} {} {})\"\n  unfolding set_as_map_image_def by simp\n\n\nsubsubsection \\<open>New Code Equations for @{text \"calculate_test_paths\"}\\<close>\n\nlemma calculate_test_paths_refined[code] : \n  \"calculate_test_paths M m d_reachable_states r_distinguishable_pairs repetition_sets =\n    (let\n         paths_with_witnesses \n              = (image (\\<lambda> q . (q,m_traversal_paths_with_witness M q repetition_sets m)) d_reachable_states);\n         get_paths                        \n              = m2f (set_as_map paths_with_witnesses);\n         PrefixPairTests                    \n              = \\<Union> q \\<in> d_reachable_states . \\<Union> mrsps \\<in> get_paths q . prefix_pair_tests q mrsps;\n         PreamblePrefixTests\n              = \\<Union> q \\<in> d_reachable_states . \\<Union> mrsps \\<in> get_paths q . preamble_prefix_tests q mrsps d_reachable_states;\n         PreamblePairTests\n              = preamble_pair_tests (\\<Union> (q,pw) \\<in> paths_with_witnesses . ((\\<lambda> (p,(rd,dr)) . dr) ` pw)) r_distinguishable_pairs;\n         tests\n              = PrefixPairTests \\<union> PreamblePrefixTests \\<union> PreamblePairTests; \n         tps'  \n              = m2f_by \\<Union> (set_as_map_image paths_with_witnesses (\\<lambda> (q,p) . (q, image fst p)));\n         dual_maps \n              =  dual_set_as_map_image tests (\\<lambda> (q,p,q') . (q,p)) (\\<lambda> (q,p,q') . ((q,p),q'));\n         tps''  \n              = m2f (fst dual_maps);\n         tps  \n              = (\\<lambda> q . tps' q \\<union> tps'' q);\n         rd_targets \n              = m2f (snd dual_maps)     \n    in ( tps, rd_targets))\"\n\n  unfolding calculate_test_paths_def Let_def dual_set_as_map_image_def fst_conv snd_conv set_as_map_image_def \n  by simp\n\n\nsubsubsection \\<open>New Code Equations for @{text \"prefix_pair_tests\"}\\<close>\n\nfun target' :: \"'state \\<Rightarrow> ('state, 'input, 'output) path \\<Rightarrow> 'state\" where\n  \"target' q [] = q\" |\n  \"target' q p = t_target (last p)\"\n\nlemma target_refined[code] :\n  \"target q p = target' q p\" \nproof (cases p rule: rev_cases)\n  case Nil\n  then show ?thesis by auto\nnext\n  case (snoc p' t)\n  then have \"p \\<noteq> []\" by auto\n  then show ?thesis unfolding snoc target.simps visited_states.simps\n    by (metis (no_types, lifting) last_ConsR last_map list.map_disc_iff target'.elims) \nqed\n\ndeclare [[code drop: prefix_pair_tests]]\nlemma prefix_pair_tests_refined[code] :\nfixes t :: \"(('a ::ccompare,'b::ccompare,'c::ccompare) traversal_path \\<times> ('a set \\<times> 'a set)) set_rbt\" \nshows \"prefix_pair_tests q (RBT_set t) = (case ID CCOMPARE((('a,'b,'c) traversal_path \\<times> ('a set \\<times> 'a set))) of\n  Some _ \\<Rightarrow> set \n    (concat (map (\\<lambda> (p,(rd,dr)) . \n                      (concat (map (\\<lambda> (p1,p2) . [(q,p1,(target q p2)), (q,p2,(target q p1))])\n                                    (filter (\\<lambda> (p1,p2) . (target q p1) \\<noteq> (target q p2) \\<and> (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd) (prefix_pairs p)))))\n                 (RBT_Set2.keys t))) |\n  None   \\<Rightarrow> Code.abort (STR ''prefix_pair_tests RBT_set: ccompare = None'') \n                                  (\\<lambda>_. (prefix_pair_tests q (RBT_set t))))\"\n  (is \"prefix_pair_tests q (RBT_set t) = ?C\")\nproof (cases \"ID CCOMPARE((('a ::ccompare,'b::ccompare,'c::ccompare) traversal_path \\<times> ('a set \\<times> 'a set)))\")\n  case None\n  then show ?thesis by auto\nnext\n  case (Some a)   \n\n  have *: \"?C = (\\<Union>(image (\\<lambda> (p,(rd,dr)) . \\<Union> (set (map (\\<lambda> (p1,p2) . {(q,p1,(target q p2)), (q,p2,(target q p1))}) (filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p))))) (set (RBT_Set2.keys t))))\"\n  proof -\n    let ?S1 = \"set (concat (map (\\<lambda> (p,(rd,dr)) . (concat (map (\\<lambda> (p1,p2) . [(q,p1,(target q p2)), (q,p2,(target q p1))]) (filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p))))) (RBT_Set2.keys t)))\"\n    let ?S2 = \"(\\<Union>(image (\\<lambda> (p,(rd,dr)) . \\<Union> (set (map (\\<lambda> (p1,p2) . {(q,p1,(target q p2)), (q,p2,(target q p1))}) (filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p))))) (set (RBT_Set2.keys t))))\"\n\n    have *: \"?C = ?S1\"\n    proof -\n      have *: \"\\<And> rd p . (filter (\\<lambda> (p1,p2) . (target q p1) \\<noteq> (target q p2) \\<and> (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd) (prefix_pairs p)) = (filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p))\"\n        by meson\n      have \"?C = set (concat (map (\\<lambda> (p,(rd,dr)) . (concat (map (\\<lambda> (p1,p2) . [(q,p1,(target q p2)), (q,p2,(target q p1))]) (filter (\\<lambda> (p1,p2) . (target q p1) \\<noteq> (target q p2) \\<and> (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd) (prefix_pairs p))))) (RBT_Set2.keys t)))\"\n        using Some by auto\n      then show ?thesis \n        unfolding * by presburger\n    qed\n\n    have union_filter_helper: \"\\<And> xs f x1 x2  y . y \\<in> f (x1,x2) \\<Longrightarrow> (x1,x2) \\<in> set xs \\<Longrightarrow> y \\<in> \\<Union> (set (map f xs))\"\n      by auto \n    have concat_set_helper : \"\\<And> xss xs x . x \\<in> set xs \\<Longrightarrow> xs \\<in> set xss \\<Longrightarrow> x \\<in> set (concat xss)\" \n      by auto\n\n    have \"\\<And> x . x \\<in> ?S1 \\<Longrightarrow> x \\<in> ?S2\" \n    proof -\n      fix x assume \"x \\<in> ?S1\"\n      then obtain p rd dr p1 p2 where \"(p,(rd,dr)) \\<in> set (RBT_Set2.keys t)\"\n                                and   \"(p1,p2) \\<in> set ((filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p)))\"\n                                and   \"x \\<in> set [(q,p1,(target q p2)), (q,p2,(target q p1))]\"\n        by auto\n      then have \"x \\<in> {(q,p1,(target q p2)), (q,p2,(target q p1))}\"\n        by auto\n      then have \"x \\<in> \\<Union> (set (map (\\<lambda> (p1,p2) . {(q,p1,(target q p2)), (q,p2,(target q p1))}) (filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p))))\"\n        using union_filter_helper[OF _ \\<open>(p1,p2) \\<in> set ((filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p)))\\<close>, of x \"(\\<lambda>(p1, p2). {(q, p1, target q p2), (q, p2, target q p1)})\"] by simp\n      then show \"x \\<in> ?S2\"\n        using \\<open>(p,(rd,dr)) \\<in> set (RBT_Set2.keys t)\\<close> by blast\n    qed\n\n    moreover have \"\\<And> x . x \\<in> ?S2 \\<Longrightarrow> x \\<in> ?S1\" \n    proof -\n      fix x assume \"x \\<in> ?S2\"\n      then obtain p rd dr p1 p2 where \"(p,(rd,dr)) \\<in> set (RBT_Set2.keys t)\"\n                                and   \"(p1,p2) \\<in> set ((filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p)))\"\n                                and   \"x \\<in> {(q,p1,(target q p2)), (q,p2,(target q p1))}\"\n        by auto\n      \n      then have *: \"x \\<in> set [(q,p1,(target q p2)), (q,p2,(target q p1))]\" by auto\n      have **: \"[(q,p1,(target q p2)), (q,p2,(target q p1))] \\<in> set (map (\\<lambda> (p1,p2) . [(q,p1,(target q p2)), (q,p2,(target q p1))]) (filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p)))\"\n        using \\<open>(p1,p2) \\<in> set ((filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p)))\\<close> by force\n      have ***: \"(concat (map (\\<lambda> (p1,p2) . [(q,p1,(target q p2)), (q,p2,(target q p1))]) (filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p)))) \\<in> set ((map (\\<lambda> (p,(rd,dr)) . (concat (map (\\<lambda> (p1,p2) . [(q,p1,(target q p2)), (q,p2,(target q p1))]) (filter (\\<lambda> (p1,p2) . (target q p1) \\<in> rd \\<and> (target q p2) \\<in> rd \\<and> (target q p1) \\<noteq> (target q p2)) (prefix_pairs p))))) (RBT_Set2.keys t)))\"\n        using \\<open>(p,(rd,dr)) \\<in> set (RBT_Set2.keys t)\\<close> by force\n      \n      show \"x \\<in> ?S1\"\n        using concat_set_helper[OF concat_set_helper[OF * **] ***] by assumption\n    qed\n  \n    ultimately show ?thesis unfolding * by blast\n  qed\n\n  show ?thesis\n    unfolding * unfolding prefix_pair_tests_code \n    using Some by (simp add: RBT_set_conv_keys)\nqed\n\n\nsubsubsection \\<open>New Code Equations for @{text \"preamble_prefix_tests\"}\\<close>\n\ndeclare [[code drop: preamble_prefix_tests]]\nlemma preamble_prefix_tests_refined[code] :\n  fixes t1 :: \"(('a ::ccompare,'b::ccompare,'c::ccompare) traversal_path \\<times> ('a set \\<times> 'a set)) set_rbt\"  \n  and   t2 :: \"'a set_rbt\"\nshows \"preamble_prefix_tests q (RBT_set t1) (RBT_set t2) = (case ID CCOMPARE((('a,'b,'c) traversal_path \\<times> ('a set \\<times> 'a set))) of\nSome _ \\<Rightarrow> (case ID CCOMPARE('a) of\n  Some _ \\<Rightarrow> set (concat (map (\\<lambda> (p,(rd,dr)) . \n                 (concat (map (\\<lambda> (p1,q2) . [(q,p1,q2), (q2,[],(target q p1))])     \n                             (filter (\\<lambda> (p1,q2) . (target q p1) \\<noteq> q2 \\<and> (target q p1) \\<in> rd \\<and> q2 \\<in> rd) \n                                     (List.product (prefixes p) (RBT_Set2.keys t2))))))\n                 (RBT_Set2.keys t1))) |\n  None \\<Rightarrow> Code.abort (STR ''prefix_pair_tests RBT_set: ccompare = None'') (\\<lambda>_. (preamble_prefix_tests q (RBT_set t1) (RBT_set t2)))) |\nNone \\<Rightarrow> Code.abort (STR ''prefix_pair_tests RBT_set: ccompare = None'') (\\<lambda>_. (preamble_prefix_tests q (RBT_set t1) (RBT_set t2))))\"\n  (is \"preamble_prefix_tests q (RBT_set t1) (RBT_set t2) = ?C\")\nproof (cases \"ID CCOMPARE((('a,'b,'c) traversal_path \\<times> ('a set \\<times> 'a set)))\")\n  case None\n  then show ?thesis by auto\nnext\n  case (Some a)\n  then have k1: \"(RBT_set t1) = set (RBT_Set2.keys t1)\" \n    by (simp add: RBT_set_conv_keys)\n  \n  show ?thesis proof (cases \"ID CCOMPARE('a)\")\n    case None\n    then show ?thesis using Some by auto\n  next\n    case (Some b)\n    then have k2: \"(RBT_set t2) = set (RBT_Set2.keys t2)\" \n      by (simp add: RBT_set_conv_keys)\n\n    have \"preamble_prefix_tests q (RBT_set t1) (RBT_set t2) = (\\<Union>(p, rd, dr)\\<in> set (RBT_Set2.keys t1). \\<Union>(p1, q2)\\<in>Set.filter (\\<lambda>(p1, q2). target q p1 \\<in> rd \\<and> q2 \\<in> rd \\<and> target q p1 \\<noteq> q2) (set (prefixes p) \\<times> (set (RBT_Set2.keys t2))). {(q, p1, q2), (q2, [], target q p1)})\"\n      unfolding preamble_prefix_tests_code  k1 k2 by simp\n      \n\n    moreover have \"?C = (\\<Union>(p, rd, dr)\\<in> set (RBT_Set2.keys t1). \\<Union>(p1, q2)\\<in>Set.filter (\\<lambda>(p1, q2). target q p1 \\<in> rd \\<and> q2 \\<in> rd \\<and> target q p1 \\<noteq> q2) (set (prefixes p) \\<times> (set (RBT_Set2.keys t2))). {(q, p1, q2), (q2, [], target q p1)})\"\n    proof -\n      let ?S1 = \"set (concat (map (\\<lambda> (p,(rd,dr)) . (concat (map (\\<lambda> (p1,q2) . [(q,p1,q2), (q2,[],(target q p1))]) (filter (\\<lambda> (p1,q2) . (target q p1) \\<in> rd \\<and> q2 \\<in> rd \\<and> (target q p1) \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2)))))) (RBT_Set2.keys t1)))\"\n      let ?S2 = \"(\\<Union>(p, rd, dr)\\<in> set (RBT_Set2.keys t1). \\<Union>(p1, q2)\\<in>Set.filter (\\<lambda>(p1, q2). target q p1 \\<in> rd \\<and> q2 \\<in> rd \\<and> target q p1 \\<noteq> q2) (set (prefixes p) \\<times> (set (RBT_Set2.keys t2))). {(q, p1, q2), (q2, [], target q p1)})\"\n  \n      have *: \"?C = ?S1\" \n      proof -\n        have *: \"\\<And> rd p . (filter (\\<lambda> (p1,q2) . (target q p1) \\<noteq> q2 \\<and> (target q p1) \\<in> rd \\<and> q2 \\<in> rd) (List.product (prefixes p) (RBT_Set2.keys t2))) = (filter (\\<lambda> (p1,q2) . (target q p1) \\<in> rd \\<and> q2 \\<in> rd \\<and> (target q p1) \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2)))\"\n          by meson\n        have \"?C = set (concat (map (\\<lambda> (p,(rd,dr)) . (concat (map (\\<lambda> (p1,q2) . [(q,p1,q2), (q2,[],(target q p1))]) (filter (\\<lambda> (p1,q2) . (target q p1) \\<noteq> q2 \\<and> (target q p1) \\<in> rd \\<and> q2 \\<in> rd) (List.product (prefixes p) (RBT_Set2.keys t2)))))) (RBT_Set2.keys t1)))\"\n          using Some \\<open>ID ccompare = Some a\\<close> by auto\n        then show ?thesis \n          unfolding * by presburger\n      qed\n  \n      have union_filter_helper: \"\\<And> xs f x1 x2  y . y \\<in> f (x1,x2) \\<Longrightarrow> (x1,x2) \\<in> set xs \\<Longrightarrow> y \\<in> \\<Union> (set (map f xs))\"\n        by auto \n      have concat_set_helper : \"\\<And> xss xs x . x \\<in> set xs \\<Longrightarrow> xs \\<in> set xss \\<Longrightarrow> x \\<in> set (concat xss)\" \n        by auto\n  \n      have \"\\<And> x . x \\<in> ?S1 \\<Longrightarrow> x \\<in> ?S2\" \n      proof -\n        fix x assume \"x \\<in> ?S1\"\n        \n        obtain prddr where \"prddr \\<in> set (RBT_Set2.keys t1)\"\n                            and   \"x \\<in> set ((\\<lambda> (p,(rd,dr)) . (concat (map (\\<lambda> (p1,q2) . [(q,p1,q2), (q2,[],(target q p1))]) (filter (\\<lambda> (p1,q2) . (target q p1) \\<in> rd \\<and> q2 \\<in> rd \\<and> (target q p1) \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2)))))) prddr)\"\n          using concat_map_elem[OF \\<open>x \\<in> ?S1\\<close>] by blast\n\n        moreover obtain p rd dr where \"prddr = (p,(rd,dr))\"\n          using prod_cases3 by blast \n        \n        ultimately have \"(p,(rd,dr)) \\<in> set (RBT_Set2.keys t1)\"\n                   and  \"x \\<in> set ((concat (map (\\<lambda> (p1,q2) . [(q,p1,q2), (q2,[],(target q p1))]) (filter (\\<lambda> (p1,q2) . (target q p1) \\<in> rd \\<and> q2 \\<in> rd \\<and> (target q p1) \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2))))))\"\n          by auto\n        then obtain p1 q2 where \"(p1,q2) \\<in> set ((filter (\\<lambda> (p1,q2) . (target q p1) \\<in> rd \\<and> q2 \\<in> rd \\<and> (target q p1) \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2))))\"\n                          and   \"x \\<in> set [(q,p1,q2), (q2,[],(target q p1))]\"\n          by auto\n\n        then have \"x \\<in> {(q,p1,q2), (q2,[],(target q p1))}\"\n          by auto\n        then have \"x \\<in> \\<Union> (set (map (\\<lambda>(p1, q2). {(q, p1, q2), (q2, [], target q p1)}) (filter (\\<lambda>(p1, q2). target q p1 \\<in> rd \\<and> q2 \\<in> rd \\<and> target q p1 \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2)))))\"\n          using union_filter_helper[OF _ \\<open>(p1,q2) \\<in> set ((filter (\\<lambda> (p1,q2) . (target q p1) \\<in> rd \\<and> q2 \\<in> rd \\<and> (target q p1) \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2))))\\<close>, of x \"(\\<lambda> (p1,q2) . {(q,p1,q2), (q2,[],(target q p1))})\"] by simp\n        then have \"x \\<in> (\\<Union>(p1, q2)\\<in>Set.filter (\\<lambda>(p1, q2). target q p1 \\<in> rd \\<and> q2 \\<in> rd \\<and> target q p1 \\<noteq> q2) (set (prefixes p) \\<times> (set (RBT_Set2.keys t2))). {(q, p1, q2), (q2, [], target q p1)})\"\n          by auto\n        then show \"x \\<in> ?S2\"\n          using \\<open>(p,(rd,dr)) \\<in> set (RBT_Set2.keys t1)\\<close> by blast\n      qed\n\n      moreover have \"\\<And> x . x \\<in> ?S2 \\<Longrightarrow> x \\<in> ?S1\"\n      proof -\n        fix x assume \"x \\<in> ?S2\"\n        then obtain p rd dr p1 q2 where \"(p, rd, dr)\\<in> set (RBT_Set2.keys t1)\"\n                                  and   \"(p1, q2)\\<in>Set.filter (\\<lambda>(p1, q2). target q p1 \\<in> rd \\<and> q2 \\<in> rd \\<and> target q p1 \\<noteq> q2) (set (prefixes p) \\<times> (set (RBT_Set2.keys t2)))\"\n                                  and   \"x \\<in> {(q, p1, q2), (q2, [], target q p1)}\"\n          by blast\n\n        then have *:\"x \\<in> set [(q, p1, q2), (q2, [], target q p1)]\"\n          by auto\n\n        have \"(p1,q2) \\<in> set (filter (\\<lambda>(p1, q2). target q p1 \\<in> rd \\<and> q2 \\<in> rd \\<and> target q p1 \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2)))\"\n          using \\<open>(p1, q2)\\<in>Set.filter (\\<lambda>(p1, q2). target q p1 \\<in> rd \\<and> q2 \\<in> rd \\<and> target q p1 \\<noteq> q2) (set (prefixes p) \\<times> (set (RBT_Set2.keys t2)))\\<close>\n          by auto \n        then have **:\"[(q, p1, q2), (q2, [], target q p1)] \\<in> set ((map (\\<lambda> (p1,q2) . [(q,p1,q2), (q2,[],(target q p1))]) (filter (\\<lambda> (p1,q2) . (target q p1) \\<in> rd \\<and> q2 \\<in> rd \\<and> (target q p1) \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2)))))\"\n          by force\n        \n          \n        have ***: \"(concat (map (\\<lambda> (p1,q2) . [(q,p1,q2), (q2,[],(target q p1))]) (filter (\\<lambda> (p1,q2) . (target q p1) \\<in> rd \\<and> q2 \\<in> rd \\<and> (target q p1) \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2))))) \\<in> set (map (\\<lambda> (p,(rd,dr)) . (concat (map (\\<lambda> (p1,q2) . [(q,p1,q2), (q2,[],(target q p1))]) (filter (\\<lambda> (p1,q2) . (target q p1) \\<in> rd \\<and> q2 \\<in> rd \\<and> (target q p1) \\<noteq> q2) (List.product (prefixes p) (RBT_Set2.keys t2)))))) (RBT_Set2.keys t1))\"\n          using \\<open>(p, rd, dr)\\<in> set (RBT_Set2.keys t1)\\<close> by force\n\n        \n        show \"x \\<in> ?S1\"\n          using concat_set_helper[OF concat_set_helper[OF * **] ***] by assumption\n      qed\n\n      ultimately show ?thesis unfolding * by blast\n    qed\n\n    ultimately show ?thesis by simp\n  qed\nqed\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/FSM_Tests/AdaptiveStateCounting/Test_Suite_Calculation_Refined.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.327520244710726}}
{"text": "theory flash16Bra  imports flash16Rev\n \n  begin\nlemma onInv16:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv16  iInv1  iInv2  iInv3 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX1VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_GetXVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ShWbVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX7VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak2VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX5VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_WbVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_GetVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceShrVldVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_2VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak2VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_ReplaceVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_HomeVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put2VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX11VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX6VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put2VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1_HomeVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak1VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak1VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak2VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak3VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX2VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put1VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutXVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis StoreVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_FAckVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX3VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutXVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put1VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis StoreHomeVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_NakVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_PutXVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX4VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_NakVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak1VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_ClearVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_PutXVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak3VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX9VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetXVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv16  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put3VsInv16 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash16Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3275071823985273}}
{"text": "\\<^marker>\\<open>creator Bernhard Pöttinger\\<close>\n\nchapter \\<open>PIP Invariant\\<close>\ntheory Pip_Invariant\nimports Pip_Shared\nbegin\n\nparagraph \\<open>Summary\\<close>\ntext \\<open>This theory proves that in our PIP data structure the current priorities are an upper\nbound of the default priorities of default priorities of predecessors.\\<close>\n\ndefinition path where\n\"path Fs x y \\<equiv> \\<exists>xs. hd xs = x \\<and> last xs = y \\<and> (\\<forall>i \\<in> {0..length xs - 1}. fields_y (Fs (xs!i)) = Some (xs!(i+1)))\"\n\nlemma edge_flow_iff1:\n  assumes \"x \\<in> X\" \"H \\<noteq> bot\" \"dom_fg H = X\" \"H \\<noteq> bot\"\n  shows \"ff.Gr \\<eta> Fs X H \\<Longrightarrow>\\<^sub>A ff.Gr \\<eta> Fs X H * \\<up>(\\<exists>m. \\<gamma> (\\<eta> x) x (Fs x) m \\<and> flow_fg H x = m \\<and>\n    edge_fg H x = (\\<lambda>y m. if Some y = fields_y (Fs x) then {# Max_mset (m + {# fields_q0 (Fs x) #}) #} else {#}))\"\n  apply (rule ent_trans[OF ff.Gr_dom])\n  apply (rule ent_trans[OF ent_frame_fwd[OF ff.unfold_N[of x X H]]])\n  using assms apply simp\n  using assms apply simp\n  apply frame_inference+\n  apply (cases \"Fs x\")\n  apply sep_auto\n    apply (subst flow_fg_plus_fg_on1')\n  using assms apply simp\n  using assms plus_fg_ops_exist dom_fg_fg apply blast\n  using assms plus_fg_ops_exist apply (metis flow_fg_fg singletonI)\n  using assms unfolding fields_y_def apply clarsimp\n    apply (subst edge_fg_plus_fg_on1')\n  using assms plus_fg_ops_exist apply blast\n  using assms plus_fg_ops_exist dom_fg_fg apply blast\n  apply (subst edge_fg_fg)\n  using assms plus_fg_ops_exist apply blast\n   apply simp\n   apply (rule ext, simp)\n  apply (case_tac \"Fs x\", auto simp: fields_q0_def split: fields.splits)[1]\n  apply sep_auto\n  apply (rule ent_trans[OF ff.fold_N[where g=\"\\<eta> x\"]])\n      apply simp\n     apply (metis ab_semigroup_add_class.add.commute assms(2) dom_fg_fg dom_fg_plus_fg1 plus_fg_ops_exist)\n  apply (metis ab_semigroup_add_class.add.commute assms(2))\n   apply simp\n  apply (rule ff.Gr_cong)\n  using assms by auto\n\nlemma sum_insert_multiset:\n  assumes \"finite X\" \"a \\<in> X\"\n  shows \"f a \\<subseteq># sum f X\"\nproof -\n  have \"sum f (insert a (X - {a})) = f a + sum f (X - {a})\"\n    by (rule sum.insert, simp_all add: assms)\n  then show ?thesis\n    using le_iff_add insert_absorb[of a X] assms\n    by auto\nqed\n\nlemma onI:\n  assumes \"\\<And>x. x \\<in> X \\<Longrightarrow> f x = g x\"\n  shows \"f = g on X\"\n  using assms by blast\n\nlemma path_flow:\n  assumes \"xs \\<noteq> []\" \"\\<forall>i \\<in> {0..<length xs}. fields_y (Fs (xs!i)) = Some ((xs @ [y])!(i+1))\"\n    \"set xs \\<subseteq> X\" \"y \\<in> X\" \"H \\<noteq> bot\" \"X = dom_fg H\"\n  shows \"ff.Gr \\<eta> Fs X H \\<Longrightarrow>\\<^sub>A ff.Gr \\<eta> Fs X H * \\<up>(fields_q (Fs (hd xs)) \\<le> fields_q (Fs y))\"\n  using assms\n  apply (induction xs rule: list_nonempty_induct)\n  subgoal for x\n   apply (rule_tac ent_trans[OF edge_flow_iff1[where x=x]], simp, simp, simp, simp)\n    apply (rule_tac ent_trans[OF ent_frame_fwd[OF edge_flow_iff1[where x=y]]], simp, simp, simp, simp)\n    apply (frame_inference)+\n    apply clarsimp\n    subgoal premises prems for a b\n    proof -\n      have \"{#fields_q (Fs x)#} = {#Max (insert (fields_q0 (Fs x)) (set_mset (flow_fg H x)))#}\"\n        using prems by (cases \"Fs x\", simp split: prod.splits add: fields_q_def fields_q0_def)\n      also have \"... = edge_fg H x y (flow_fg H x)\"\n        using prems by (cases \"\\<eta> x\", simp, cases \"Fs x\", simp)\n      also have \"... \\<subseteq># (\\<Sum>x \\<in> dom_fg H. edge_fg H x y (flow_fg H x))\"\n        apply (rule sum_insert_multiset[where f=\"\\<lambda>x. edge_fg H x y (flow_fg H x)\" and a=x])\n        using prems by auto\n      also have \"... \\<subseteq># inf_fg H y + (\\<Sum>x \\<in> dom_fg H. edge_fg H x y (flow_fg H x))\"\n        by simp\n      also have \"... = flow_fg H y\"\n        using flow_eq_ne_bot[of H] prems by (cases xs, auto)\n      finally have \"fields_q (Fs x) \\<in># flow_fg H y\"\n        by simp\n      then have \"fields_q (Fs x) \\<le> Max (insert (fields_q0 (Fs y)) (set_mset (flow_fg H y)))\"\n        by simp\n      also have \"... = fields_q (Fs y)\"\n        using prems by (cases \"Fs y\", simp split: prod.splits add: fields_q_def fields_q0_def)\n      finally show ?thesis .\n  qed\n  done\n  subgoal for x xs\n   apply (rule_tac ent_trans[OF edge_flow_iff1[where x=x]], simp, simp, simp, simp)\n    apply (rule_tac ent_trans[OF ent_frame_fwd[OF edge_flow_iff1[where x=\"hd xs\" and X=X and H=H]]], simp)\n        apply (meson basic_trans_rules(31) hd_in_set)\n        apply simp\n        apply simp\n    apply simp\n      apply (frame_inference+)\n    apply clarsimp\n    subgoal premises prems for a b\n    proof -\n      have *: \"(\\<lambda>i. fields_y (Fs (xs ! i))) = \\<lambda>i. Some ((xs @ [y]) ! (Suc i)) on {0..<length xs}\"\n        using prems(3) by force\n\n      then have \"fields_y (Fs ((x # xs) ! 0)) = Some ((xs @ [y]) ! 0)\"\n        using atLeastLessThan_iff prems by blast\n      then have S: \"fields_y (Fs x) = Some (hd xs)\"\n        by (simp add: hd_conv_nth prems(1))\n\n      have \"{#fields_q (Fs x)#} = {#Max (insert (fields_q0 (Fs x)) (set_mset (flow_fg H x)))#}\"\n        using prems by (cases \"Fs x\", simp split: prod.splits add: fields_q_def fields_q0_def)\n      also have \"... = edge_fg H x (hd xs) (flow_fg H x)\"\n        using prems S by (cases \"\\<eta> x\", simp, cases \"Fs x\", simp add: fields_q0_def fields_y_def)\n      also have \"... \\<subseteq># (\\<Sum>x \\<in> dom_fg H. edge_fg H x (hd xs) (flow_fg H x))\"\n        using sum_insert_multiset[where f=\"\\<lambda>x. edge_fg H x (hd xs) (flow_fg H x)\" and a=x]\n        using prems by auto\n      also have \"... \\<subseteq># inf_fg H (hd xs) + (\\<Sum>x \\<in> dom_fg H. edge_fg H x (hd xs) (flow_fg H x))\"\n        by simp\n      also have \"... = flow_fg H (hd xs)\"\n        using flow_eq_ne_bot[of H] prems by (cases xs, auto)\n      finally have \"fields_q (Fs x) \\<in># flow_fg H (hd xs)\"\n        by simp\n      then have \"fields_q (Fs x) \\<le> Max (insert (fields_q0 (Fs (hd xs))) (set_mset (flow_fg H (hd xs))))\"\n        by simp\n      also have \"... = fields_q (Fs (hd xs))\"\n        using prems by (cases \"Fs (hd xs)\", simp split: prod.splits add: fields_q_def fields_q0_def)\n      also have \"... \\<le> fields_q (Fs y)\"\n        using prems(2)[OF *] prems by blast\n      finally show ?thesis .\n    qed\n    done\n  done\n\nlemma path_flow':\n  assumes \"xs \\<noteq> []\" \"\\<forall>i \\<in> {0..<length xs}. fields_y (Fs (xs!i)) = Some ((xs @ [y])!(i+1))\"\n    \"set xs \\<subseteq> X\" \"y \\<in> X\" \"H \\<noteq> bot\" \"X = dom_fg H\"\n  shows \"ff.Gr \\<eta> Fs X H \\<Longrightarrow>\\<^sub>A ff.Gr \\<eta> Fs X H * \\<up>(fields_q0 (Fs (hd xs)) \\<le> fields_q (Fs y))\"\nproof -\n  have X: \"\\<gamma> (\\<eta> (hd xs)) (hd xs) (Fs (hd xs)) m \\<Longrightarrow> fields_q0 (Fs (hd xs)) \\<le> fields_q (Fs (hd xs))\"\n    for xs m\n  proof -\n    assume A: \"\\<gamma> (\\<eta> (hd xs)) (hd xs) (Fs (hd xs)) m\"\n\n    have \"fields_q0 (Fs (hd xs)) \\<le> Max_mset ({#fields_q0 (Fs (hd xs))#} + m)\"\n      by simp\n    also have \"... = fields_q (Fs (hd xs))\"\n      using assms A by (cases \"Fs (hd xs)\", simp split: prod.splits add: fields_q_def fields_q0_def)\n    finally show ?thesis .\n  qed\n\n  show ?thesis\n    apply (rule ent_trans[OF path_flow[of xs]])\n    using assms apply blast\n    using assms apply blast\n    using assms apply blast\n    using assms apply blast\n    using assms apply blast\n    using assms apply blast\n    apply (simp only: ent_pure_pre_iff, intro impI)\n    apply (rule ent_trans[OF ff.unfold_N[where x=\"hd xs\"]])\n    using assms apply auto[1]\n    using assms apply simp\n    apply auto[1]\n     apply (rule order_trans[OF X])\n     apply simp\n     apply simp\n    apply sep_auto\n    subgoal for m h'\n    apply (rule ent_frame_fwd[OF ff.fold_N])\n         defer\n         defer\n    defer\n         defer\n         apply frame_inference+\n        apply sep_auto\n    apply (rule ff.Gr_cong)\n    using assms hd_in_set apply blast\n    using assms apply simp\n    using assms apply simp\n    using assms apply simp\n    using assms apply simp\n    using assms apply simp\n    subgoal\n      by (metis ab_semigroup_add_class.add.commute assms(5) assms(6)\n          dom_fg_fg dom_fg_plus_fg1 plus_fg_ops_exist)\n    using assms subgoal\n      by (metis plus_fg_comm)\n    using assms apply simp\n    done\n  done\nqed\n\nabbreviation \"paths Fs X y \\<equiv>\n  { xs | xs. xs \\<noteq> []\n       \\<and> (\\<forall>i \\<in> {0..length xs}. fields_y (Fs (xs!i)) = Some ((xs @ [y])!(i+1)))\n       \\<and> set xs \\<subseteq> X }\"\n\nlemma upper_bound:\n  assumes \"finite P\" \"X = dom_fg H\" \"y \\<in> X\" \"P \\<subseteq> paths Fs X y\" \"H \\<noteq> bot\"\n  shows \"ff.Gr \\<eta> Fs X H \\<Longrightarrow>\\<^sub>A ff.Gr \\<eta> Fs X H *\n    \\<up>(fields_q (Fs y) \\<ge>\n      Max ({fields_q0 (Fs (hd xs)) | xs. xs \\<in> P } \\<union> {fields_q0 (Fs y)}))\"\n  using assms\nproof (induction P rule: finite_induct)\n  case empty\n  show ?case\n    apply (rule ent_trans[OF ff.unfold_N[where x=y]])\n    using empty apply simp\n    using empty apply simp\n    apply (intro ent_ex_preI)\n    unfolding fields_q0_def fields_q_def\n    apply (cases \"Fs y\")\n    apply sep_auto\n    apply (rule ent_trans[OF ff.fold_N[where g=\"\\<eta> y\"]])\n    apply simp\n    subgoal premises prems for h' x3 x4\n    proof -\n      let ?h1 = \"fg {y} (\\<lambda>_. edge y (Fields (\\<eta> y) (Max (insert x3 (set_mset x4))) x3 x4)) (\\<lambda>_. x4)\"\n      have \"dom_fg ?h1 = {y}\"\n        using empty prems plus_fg_ops_exist[of ?h1 h'] by simp\n      moreover have \"dom_fg H = dom_fg ?h1 \\<union> dom_fg h'\"\n        using empty prems plus_fg_dom_un by blast\n      moreover have \"dom_fg ?h1 \\<inter> dom_fg h' = {}\"\n        using empty prems plus_fg_dom_disj by blast\n      ultimately show ?thesis\n        using empty by blast\n    qed\n    using assms apply (simp add: algebra_simps)\n    apply simp\n    apply (rule ff.Gr_cong)\n    using assms by auto\nnext\n  case (insert xs F)\n  show ?case \n    apply (rule ent_trans[OF path_flow'[of xs Fs y]])\n    using insert apply simp\n    using insert apply simp\n    using insert apply simp\n    using insert apply simp\n    using insert apply simp\n    using insert apply simp\n    apply (rule ent_frame_fwd[OF insert.IH])\n    using insert apply simp\n    using insert apply simp\n    using insert apply simp\n    using insert apply simp\n    apply frame_inference\n    using insert by simp\nqed\n\nend\n", "meta": {"author": "bpoettinger", "repo": "Flow", "sha": "c95ea5f88a0a3d39e44421e0cc36139a3c3687de", "save_path": "github-repos/isabelle/bpoettinger-Flow", "path": "github-repos/isabelle/bpoettinger-Flow/Flow-c95ea5f88a0a3d39e44421e0cc36139a3c3687de/Pip_Invariant.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947425132315, "lm_q2_score": 0.5, "lm_q1q2_score": 0.32744737125661577}}
{"text": "\nheader {* Abstract syntax for Hybrid CSP. *}\n\ntheory HCSP_Com \n  imports  Main\n\"DCSequents/DCSequent\"\nbegin\n\n\n\ntype_synonym cname = string\ntype_synonym time = real\ntype_synonym bexp = fform\ntype_synonym Inv = fform\ntype_synonym Rg = fform\ntype_synonym mid = \"fform * fform\"\n\ndatatype typeid = R | S | B\n\ndatatype proc\n= \"Skip\"\n| \"Stop\"\n| Ass \"exp\" \"exp\"          (\"_ := _\" [99, 95] 94)   \n| Send \"cname\" \"exp\"         (\"_!!_\" [110,108] 100)      \n| Receive \"cname\" \"exp\"    (\"_??_\" [110,108] 100) \n| Seq \"proc\" \"mid\" \" proc\"                   (\"_; _ ; _\"        [91,90 ] 90)\n| Cond \"bexp\" \"proc\"                 (\"IF _ _\"   [95,94]93)\n| Nondeter \"typeid\" \"string\" \"bexp\" \"proc\"                 (\"NON _ _ : _ _\"   [95,94]93)\n| Pref   \"proc\" \"proc\"                  (\"_\\<rightarrow>_\"   [95,94]93)           \n| join \"proc\" \"proc\"                   (infixr \"[[\" 90)\n| meet \"proc\" \"proc\"                  (\"_<<_\" [90,90] 90)\n| Par    \"proc\" \"proc\"                  (infixr \"||\" 89)\n| Rep    \"proc\"                               (\"_*\"[91] 90)\n| RepA    \"proc\"                              (\"_***\"[91] 90)\n| RepN    \"proc\" \"nat\"                               (\"_**_\"[91,92] 90)\n| Cont  \"Inv\" \"bexp\" \"Rg\"                (\"<_&&_> : _\" [95,96]94)\n| Cont2  \"flow\" \"Inv\" \"bexp\" \"Rg\"                (\"<_&&_&&_> : _\" [95,95,96]94)\n| TimeOut \"proc\" \"time\" \"proc\"    (\"_|>_ _\" [95,96,94]94)\n| Interp   \"proc\" \"proc\" (\"_[[>_\"[95,94]94)\n| empty \"exp\" (\"empty _\" 94)\n| addL \"exp\" \"exp\" (\"addL _ _\" 94)\n| delL \"exp\" (\"delL _\" 94)\n\ndefinition isEmpty :: \"exp => fform\" where\n\"isEmpty(e1) == (case e1 of\n        (List ls) => (case ls of [] => WTrue | _ => WFalse) |\n        _ => WFalse)\"\n\ndefinition readL :: \"exp => exp\" where\n\"readL(e1) == (case e1 of\n      (List ls) => hd(ls) |\n      _ => (Real 0))\"\n\n\ntype_synonym pair = \"exp * exp\"\n\n\nprimrec map :: \"pair list => exp => exp\" where\n\"map ([]) (a) = a\" |\n\"map (x#xs) (a) = (if (fst (x) = a) then (snd (x)) else (map (xs) (a)))\"\n\n\nlemma \"map ([(RVar ''x'', Real 2), (RVar ''y'', RVar z)],  RVar ''x'') = (Real 2)\"\napply (induct, auto)\ndone\n\nlemma fact1 : \"map ([(RVar ''x'', Real 2), (RVar ''y'', RVar z)]) (RVar ''z'') = RVar ''z''\"\napply (induct, auto)\ndone\n\n(*Expression substitution: \"map\" records the substitution mapping.*)\nprimrec substE :: \"pair list => exp => exp\" where\n\"substE (mp, (RVar x)) = map (mp, (RVar x))\"  |\n\"substE (mp, (SVar x)) = map (mp, (SVar x))\"  |\n\"substE (mp, (BVar x)) = map (mp, (BVar x))\"  |\n\"substE (mp, (List x)) = List x\"  |\n\"substE (mp, (Real m)) = map (mp, (Real m))\"  |\n\"substE (mp, (Bool b)) = map (mp, (Bool b))\"  |\n\"substE (mp, (String s)) = map (mp, (String s))\"  |\n\"substE (mp, (e1 [+] e2)) = substE (mp, e1) [+] substE (mp, e2)\"  |\n\"substE (mp, (e1 [-] e2)) = substE (mp, e1) [-] substE (mp, e2)\"|\n\"substE (mp, (e1 [*] e2)) = substE (mp, e1) [*] substE (mp, e2)\"|\n\"substE (mp, (e1 [**] e2)) = substE (mp, e1) [**] substE (mp, e2)\"\n\nlemma \"(% x. x [+] x = RVar ''z'' [+] RVar ''z'') (RVar ''z'')\"\napply auto\ndone\n\nlemma \"substE ([(RVar ''x'', Real 1), (RVar ''y'', RVar ''z'')], (RVar ''y'' [+] RVar ''z'')) \n        = RVar ''z'' [+] RVar ''z''\"\napply (induct, auto)\ndone \n\n\n(*Tip: for theory built on Pure, application is written by f(x) rather than f x as usual. *)\n\nprimrec lVarE :: \"pair list => string => pair list\" where\n\"lVarE ([],s) = []\" |\n\"lVarE (x#xs,s) = (if (fst (x) = (RVar s)) then xs else x#lVarE(xs, s))\"\n\nprimrec inExp :: \"string => exp => bool\" where\n\"inExp (s, (RVar x)) = (s=x)\"  |\n\"inExp (s, (SVar x)) = (s=x)\"  |\n\"inExp (s, (BVar x)) = (s=x)\"  |\n(*\"inExp (s, (List x)) = (s=x)\"  |*)\n\"inExp (s, (Real m)) = (False)\"  |\n\"inExp (s, (Bool b)) = (False)\"  |\n\"inExp (s, (String r)) = (False)\"  |\n\"inExp (s, (e1 [+] e2)) = (inExp (s, e1) | inExp (s, e2))\"  |\n\"inExp (s, (e1 [-] e2)) = (inExp (s, e1) | inExp (s, e2))\"|\n\"inExp (s, (e1 [*] e2)) = (inExp (s, e1) | inExp (s, e2))\"\n\nprimrec inPairL :: \"pair list => string => bool\" where\n\"inPairL ([],s) = False\" |\n\"inPairL (x#xs,s) = (if (inExp (s, fst (x))) then True else inPairL(xs, s))\"\n\nprimrec inPairR :: \"pair list => string => bool\" where\n\"inPairR ([],s) = False\" |\n\"inPairR (x#xs,s) = (if (inExp (s, snd (x))) then True else inPairR(xs, s))\"\n\n(*Check if the quantifiers of a formula occur in mp*)\nprimrec inPairForm :: \"pair list => fform => bool\" where\n \"inPairForm (mp) (WTrue) = False\" |\n \"inPairForm (mp) (WFalse) = False\" |\n \"inPairForm (mp) (e1 [=] e2) =False\" |\n \"inPairForm (mp) (e1 [<] e2) = False\" |\n \"inPairForm (mp) (e1 [>] e2) =False\" |\n \"inPairForm (mp) ([~]p) = (inPairForm (mp) (p))\" |\n \"inPairForm (mp) (p [&] q) = ((inPairForm (mp) (p)) | (inPairForm (mp) (q)))\" |\n \"inPairForm (mp) (p [|] q) = ((inPairForm (mp) (p)) | (inPairForm (mp) (q)))\" |\n \"inPairForm (mp) (p [-->] q) = ((inPairForm (mp) (p)) | (inPairForm (mp) (q)))\" |\n \"inPairForm (mp) (p [<->] q) = ((inPairForm (mp) (p)) | (inPairForm (mp) (q)))\" |\n \"inPairForm (mp) (WALL i p) = (inPairL (mp, i) | inPairR (mp, i) | inPairForm (mp)(p))\" |\n \"inPairForm (mp) (WEX i p) = (inPairL (mp, i) | inPairR (mp, i) | inPairForm (mp)(p))\"\n\n(*Formula sustitution.*)\nprimrec substF :: \"pair list => fform => fform\" where\n \"substF (mp) (WTrue) = WTrue\" |\n \"substF (mp) (WFalse) = WFalse\" |\n \"substF (mp) (e1 [=] e2) = ((substE (mp, e1)) [=] (substE (mp, e2)))\" |\n \"substF (mp) (e1 [<] e2) = ((substE (mp, e1)) [<] (substE (mp, e2)))\" |\n \"substF (mp) (e1 [>] e2) = (substE (mp, e1) [>] substE (mp, e2))\" |\n \"substF (mp) ([~]p) = ([~](substF (mp) (p)))\" |\n \"substF (mp) (p [&] q) = ((substF (mp) (p)) [&] (substF (mp) (q)))\" |\n \"substF (mp) (p [|] q) = ((substF (mp) (p)) [|] (substF (mp) (q)))\" |\n \"substF (mp) (p [-->] q) = ((substF (mp) (p)) [-->] (substF (mp) (q)))\" |\n \"substF (mp) (p [<->] q) = ((substF (mp) (p)) [<->] (substF (mp) (q)))\" |\n \"substF (mp) (WALL i p) = (if ((~inPairL (mp, i)) & (~inPairR (mp, i))) then (WALL i (substF (mp)(p))) \n                           else WFalse)\" |\n \"substF (mp) (WEX i p) = (if ((~inPairL (mp, i)) & (~inPairR (mp, i))) then (WEX i (substF (mp)(p))) \n                           else WFalse)\"\n\nlemma allEX : \"substF([(RVar ''x'', RVar ''m''), (RVar ''y'', RVar ''z'')], \n                 ((RVar ''x'')[=]Real 2) [&] (WALL ''w'' ((RVar ''w'') [>] (RVar ''z''))))\n             = (((RVar ''m'')[=]Real 2) [&] (WALL ''w'' ((RVar ''w'') [>] (RVar ''z''))))\"\napply auto\ndone\n\n\nlemma fact : \"substF ([(RVar ''x'', Real 2), (RVar ''y'', RVar ''z'')]) (RVar ''x'' [>] Real 1) = (Real 2 [>] Real 1)\"\napply (induct, auto)\ndone\n\n\nend\n\n\n\n\n", "meta": {"author": "wangslyl", "repo": "hhlprover", "sha": "500e7ae1f93f0decb67b55ec2e0b4f756ae9ede0", "save_path": "github-repos/isabelle/wangslyl-hhlprover", "path": "github-repos/isabelle/wangslyl-hhlprover/hhlprover-500e7ae1f93f0decb67b55ec2e0b4f756ae9ede0/HHLProver/HCSP_Com.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297746074044135, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3271813365706013}}
{"text": "theory FinsetEquivalence\n  imports Main\n         \"Category3.ProductCategory\"\n         \"Category3.EquivalenceOfCategories\"\n         Gamma\n         PointedSet\n         SubcategoryFactorization\nbegin\n\n\n\n\ncontext begin\n\n\n\n\ninterpretation pointed_set\n  done\n\nfun get_with_default :: \"'a \\<Rightarrow> 'a list \\<Rightarrow> (nat \\<Rightarrow> 'a)\" where\n  \"get_with_default x [] n = x\" |\n  \"get_with_default x (a # as) 0 = a\" |\n  \"get_with_default x (a # as) (Suc n) = get_with_default x as n\" \n\nlemma get_get_with_def : \"k < (length f) \\<longrightarrow> get_with_default x f k = get f k\"\n  apply (rule_tac get.induct)\n  by simp_all\n\nlemma get_out_of_range : \"k \\<ge> (length f) \\<longrightarrow> get_with_default x f k = x\"\n  apply (induction k arbitrary: f)\n   apply auto\nproof-\n  fix k f\n  have \"get_with_default x f k =  get_with_default x f k\" by simp\n  assume ind: \"(\\<And>f. length f \\<le> k \\<longrightarrow> get_with_default x f k = x)\"\n  have \"length f \\<le> Suc k \\<longrightarrow> get_with_default x f (Suc k) = x\"\n    apply (induction f)\n     apply auto\n    by (simp add: ind)\n  then show \"length f \\<le> Suc k \\<Longrightarrow> get_with_default x f (Suc k) = x\" by simp\nqed\n\n\n\n\n\n\n\nfun interval :: \"nat \\<Rightarrow> 'a LC pointed_set\" where\n  \"interval m = (K 0, {x. (\\<exists>n. n < m \\<and> x = K n)})\"\n\n\n\nlemma interval_obj : \"n > 0 \\<Longrightarrow> Obj' (interval n)\"\n  unfolding Obj'_def by simp\n\n\n\ndefinition inclusionFunctor :: \"gamma  \\<Rightarrow> 'a LC parr option  \" where\n  \"inclusionFunctor \\<equiv> MkFunctor\n                  pointed_fin_set.comp\n                  pointed_set_comp\n                  (\\<lambda>f. Some (pointed_set.MkArr \n                   (interval (length (snd (the f))))\n                   (interval (fst (the f)))\n                   ((\\<lambda>x. K (get (snd (the f)) (SOME n. K n = x))))))\"\n\n\nlemma pointed_fin_set_smash_arr : \"partial_magma.arr pointed_fin_set.comp f \\<Longrightarrow>\n            pointed_fin_set.PointedArr' f \\<and>\n            f \\<noteq> None \\<and> fin_set.Arr' (the f)\n            \\<and> snd (the f) \\<noteq> []\n            \\<and> get (snd (the f)) 0 = 0\n            \\<and> fst (the f) \\<noteq> 0\"\n  apply safe\nproof-\n  fix f\n  assume arr_f: \"partial_magma.arr pointed_fin_set.comp f\"\n  have \"partial_magma.arr pointed_fin_set.comp f \\<longrightarrow>\n       pointed_fin_set.PointedArr' f\"\n    unfolding pointed_fin_set.comp_def\n    apply (subst subcategory.arr_char)\n     apply (simp add: pointed_fin_set.is_subcategory)\n    by simp\n  from this and arr_f show p_arr_f: \"pointed_fin_set.PointedArr' f\" by simp\n  have \"pointed_fin_set.PointedArr' f \\<longrightarrow>\n        (f \\<noteq> None \\<and> fin_set.Arr' (the f))\"\n    unfolding pointed_fin_set.PointedArr'_def fin_set.comp_def\n    apply (subst classical_category.arr_char)\n    using fin_set.is_classical_category apply blast\n    by simp\n  from this and p_arr_f have f_arr_f : \"(f \\<noteq> None \\<and> fin_set.Arr' (the f))\" by simp\n  from f_arr_f show \"\\<exists>y. f = Some y\" by simp\n  from f_arr_f show \"fin_set.Arr' (the f)\" by simp\n  from p_arr_f show \"snd (the f) = [] \\<Longrightarrow> False\" unfolding pointed_fin_set.PointedArr'_def by simp\n  from p_arr_f show \"get (snd (the f)) 0 = 0\" unfolding pointed_fin_set.PointedArr'_def by simp\n\n  show \"0 < fst (the f)\"\n    using f_arr_f unfolding fin_set.Arr'_def \\<open>get (snd (the f)) 0 = 0\\<close> \\<open>snd (the f) = [] \\<Longrightarrow> False\\<close>\n    using p_arr_f pointed_fin_set.PointedArr'_def by auto\nqed\n\nlemma pointed_fin_set_unsmash_arr : \"f \\<noteq> None \\<Longrightarrow> fin_set.Arr' (the f)\n            \\<Longrightarrow> snd (the f) \\<noteq> []\n            \\<Longrightarrow> get (snd (the f)) 0 = 0\n            \\<Longrightarrow> fst (the f) \\<noteq> 0 \\<Longrightarrow>\n            partial_magma.arr pointed_fin_set.comp f\"\n  unfolding pointed_fin_set.comp_def\n  using pointed_fin_set.is_subcategory apply (simp add: subcategory.arr_char)\n  unfolding pointed_fin_set.PointedArr'_def apply simp\n  unfolding fin_set.comp_def\n  using fin_set.is_classical_category by (simp add: classical_category.arr_char)\n\n\n\nlemma inclusion_arr: \"partial_magma.arr pointed_fin_set.comp f \\<Longrightarrow>\n         partial_magma.arr pointed_set_comp (inclusionFunctor f)\"\nproof-\n  fix f\n  assume arr_f: \"partial_magma.arr pointed_fin_set.comp f\"\n  from arr_f and pointed_fin_set_smash_arr have p_arr_f: \"pointed_fin_set.PointedArr' f\" by simp\n  from arr_f and pointed_fin_set_smash_arr have f_arr_f : \"(f \\<noteq> None \\<and> fin_set.Arr' (the f))\" by simp\n  from p_arr_f have \"snd (the f) \\<noteq> []\" unfolding pointed_fin_set.PointedArr'_def by simp\n  from p_arr_f have \"get (snd (the f)) 0 = 0\" unfolding pointed_fin_set.PointedArr'_def by simp\n  show \"partial_magma.arr pointed_fin_set.comp f \\<Longrightarrow>\n         partial_magma.arr pointed_set_comp (inclusionFunctor f)\"\n    unfolding pointed_set_comp_def\n    apply (subst classical_category.arr_char)\n    using ccpf apply blast\n    unfolding inclusionFunctor_def apply simp\n    unfolding Arr'_def apply auto\n    unfolding setcat.Arr_def pointed_set.MkArr_def apply auto\n    using f_arr_f unfolding fin_set.Arr'_def apply simp\n  proof-\n    have \"length (snd (the f)) > 0\" by (simp add: \\<open>snd (the f) \\<noteq> []\\<close>)\n    then show \"Obj' (K 0, {x. \\<exists>n<length (snd (the f)). x = K n})\" using interval_obj by auto\n    have \"fst (the f) > 0\" using f_arr_f \\<open>get (snd (the f)) 0 = 0\\<close> \\<open>0 < length (snd (the f))\\<close>\n      unfolding fin_set.Arr'_def by auto\n    then show \"Obj' (K 0, {x. \\<exists>n<fst (the f). x = K n})\" using interval_obj by auto\n    show \"get (snd (the f)) 0 = 0\" using \\<open>get (snd (the f)) 0 = 0\\<close>.\n    show \"snd (the f) = [] \\<Longrightarrow> undefined = K 0\" by (simp add: \\<open>snd (the f) \\<noteq> []\\<close>)\n  qed\nqed\n\n\nlemma inclusion_id : \"0<n \\<Longrightarrow> inclusionFunctor (Some (fin_set.Id' n)) = Some (Id' (interval n))\"\nproof-\n  assume \"0<n\"\n  have arr_id: \"partial_magma.arr pointed_fin_set.comp (Some (fin_set.Id' n))\"\n    unfolding pointed_fin_set.comp_def\n    apply (subst subcategory.arr_char)\n     apply (simp add: pointed_fin_set.is_subcategory)\n    unfolding pointed_fin_set.PointedArr'_def apply auto\n    unfolding fin_set.comp_def\n      apply (subst classical_category.arr_char)\n    using fin_set.is_classical_category apply blast\n    apply simp\n    using fin_set.is_classical_category apply (simp add: classical_category.Arr_Id)\n    unfolding fin_set.Id'_def apply simp\n     apply (subst get_rev_get)\n      apply (simp_all add: \\<open>0<n\\<close>)\n    by (metis \\<open>0 < n\\<close> less_numeral_extra(3) list.size(3) rev_get_length)\n  have int_obj: \"Obj' (K 0, {x. \\<exists>na<n. x = K na})\"\n    using interval_obj \\<open>0<n\\<close> by auto\n  have rev_nn: \"rev_get n (\\<lambda>k. k) \\<noteq> []\"\n    by (metis \\<open>0 < n\\<close> less_numeral_extra(3) list.size(3) rev_get_length)\n  show \"inclusionFunctor (Some (fin_set.Id' n)) = Some (Id' (interval n)) \"\n    unfolding inclusionFunctor_def MkArr_def using arr_id apply simp\n    apply (rule_tac fun_eq_char)\n    unfolding Arr'_def setcat.Arr_def apply auto\n    unfolding fin_set.Id'_def apply auto\n                 apply (simp_all add: int_obj)\n              apply (subst get_rev_get)\n               apply (simp_all add: \\<open>0<n\\<close>)\n             apply (simp_all add: rev_nn)\n    unfolding Id'_def apply auto\n       apply (simp_all add: int_obj)\n    using \\<open>0<n\\<close> by simp\nqed\n\nlemma inclusion_dom : \"partial_magma.arr pointed_fin_set.comp f \\<Longrightarrow>\n         partial_magma.dom pointed_set_comp (inclusionFunctor f) =\n         inclusionFunctor (partial_magma.dom pointed_fin_set.comp f)\"\nproof-\n  fix f\n  assume arr_f: \"partial_magma.arr pointed_fin_set.comp f\"\n  then have \"snd (the f) \\<noteq> []\" by (simp add: pointed_fin_set_smash_arr)\n  have dom_eq1: \"partial_magma.dom pointed_set_comp (inclusionFunctor f) =\n        Some (Id' (fst (snd (the (inclusionFunctor f)))))\"\n    apply (rule_tac dom_char)\n    using arr_f by (simp add: inclusion_arr)\n\n  have dom_eq2: \"partial_magma.dom pointed_fin_set.comp f = \n        Some (fin_set.Id' (length (snd (the f))))\"\n    apply (rule_tac pointed_fin_set.dom_char)\n    using arr_f.\n\n  show \"partial_magma.dom pointed_set_comp (inclusionFunctor f) =\n         inclusionFunctor (partial_magma.dom pointed_fin_set.comp f)\"\n    apply (subst dom_eq1)\n    apply (subst dom_eq2)\n    apply (subst inclusion_id)\n     apply (simp add: \\<open>snd (the f) \\<noteq> []\\<close>)\n    unfolding inclusionFunctor_def MkArr_def using arr_f by simp\nqed\n\nlemma inclusion_cod : \"partial_magma.arr pointed_fin_set.comp f \\<Longrightarrow>\n         partial_magma.cod pointed_set_comp (inclusionFunctor f) =\n         inclusionFunctor (partial_magma.cod pointed_fin_set.comp f)\"\nproof-\n  fix f\n  assume arr_f: \"partial_magma.arr pointed_fin_set.comp f\"\n  then have \"fst (the f) \\<noteq> 0\" by (simp add: pointed_fin_set_smash_arr)\n  have cod_eq1: \"partial_magma.cod pointed_set_comp (inclusionFunctor f) =\n        Some (Id' (snd (snd (the (inclusionFunctor f)))))\"\n    apply (rule_tac cod_char)\n    using arr_f by (simp add: inclusion_arr)\n\n  have cod_eq2: \"partial_magma.cod pointed_fin_set.comp f = \n        Some (fin_set.Id' (fst (the f)))\"\n    apply (rule_tac pointed_fin_set.cod_char)\n    using arr_f.\n\n  show \"partial_magma.cod pointed_set_comp (inclusionFunctor f) =\n         inclusionFunctor (partial_magma.cod pointed_fin_set.comp f)\"\n    apply (subst cod_eq1)\n    apply (subst cod_eq2)\n    apply (subst inclusion_id)\n    using \\<open>fst (the f) \\<noteq> 0\\<close> apply auto\n    unfolding inclusionFunctor_def MkArr_def using arr_f by simp\nqed\n\n\n\n\nlemma inclusion_functor : \"functor \n                  pointed_fin_set.comp\n                  pointed_set_comp\n                  inclusionFunctor\"\n  unfolding functor_def\n  apply (simp add: is_category pointed_fin_set.is_category)\n  unfolding functor_axioms_def apply safe\nproof-\n  fix f\n  show \" \\<not> partial_magma.arr pointed_fin_set.comp f \\<Longrightarrow>\n         inclusionFunctor f = partial_magma.null pointed_set_comp\"\n    unfolding inclusionFunctor_def by simp\n  assume arr_f: \"partial_magma.arr pointed_fin_set.comp f\"\n\n  then show arr_inc_f: \"partial_magma.arr pointed_set_comp (inclusionFunctor f)\"\n    using arr_f by (simp add: inclusion_arr)\n\n  show \"partial_magma.dom pointed_set_comp (inclusionFunctor f) =\n         inclusionFunctor (partial_magma.dom pointed_fin_set.comp f)\"\n    apply (rule_tac inclusion_dom)\n    using arr_f.\n\n  show \"partial_magma.cod pointed_set_comp (inclusionFunctor f) =\n         inclusionFunctor (partial_magma.cod pointed_fin_set.comp f)\"\n    apply (rule_tac inclusion_cod)\n    using arr_f.\nnext\n  fix f g\n  assume arr_gf: \"partial_magma.arr pointed_fin_set.comp (pointed_fin_set.comp g f)\"\n  then have arr_f: \"partial_magma.arr pointed_fin_set.comp f\"\n    by (meson category.seqE pointed_fin_set.is_category)\n  from arr_gf have arr_g : \"partial_magma.arr pointed_fin_set.comp g\"\n    by (meson category.seqE pointed_fin_set.is_category)\n  from arr_gf have seq: \"partial_magma.dom pointed_fin_set.comp g =\n                         partial_magma.cod pointed_fin_set.comp f\"\n    by (meson category.seqE pointed_fin_set.is_category)\n  from arr_f have arr_inc_f : \"partial_magma.arr pointed_set_comp (inclusionFunctor f)\"\n    by (simp add: inclusion_arr)\n  then have arr_inc_f' : \"Arr' (the (inclusionFunctor f))\" using arr_char by blast\n  from arr_g have arr_inc_g : \"partial_magma.arr pointed_set_comp (inclusionFunctor g)\"\n    by (simp add: inclusion_arr)\n  then have arr_inc_g' : \"Arr' (the (inclusionFunctor g))\" using arr_char by blast\n  from seq have seq_inc : \"partial_magma.dom pointed_set_comp (inclusionFunctor g) =\n                           partial_magma.cod pointed_set_comp (inclusionFunctor f)\"\n    apply (simp add: arr_g inclusion_dom)\n    by (simp add: arr_f inclusion_cod)\n  then have seq_inc' : \"snd (snd (the (inclusionFunctor f))) = fst (snd (the (inclusionFunctor g)))\"\n    apply (subst seq_char)\n    using arr_inc_f apply blast\n    using arr_inc_g apply simp\n    using arr_inc_g apply simp\n    by simp\n    \n  have arr_inc_gf : \"partial_magma.arr pointed_set_comp\n           (pointed_set_comp (inclusionFunctor g) (inclusionFunctor f ))\"\n    by (simp add: arr_inc_f arr_inc_g seq_inc category.seqI pointed_set.is_category)\n\n  show \"inclusionFunctor (pointed_fin_set.comp g f) =\n           pointed_set_comp (inclusionFunctor g) (inclusionFunctor f)\"\n    apply (subst comp_char)\n       apply (simp_all add: arr_inc_f arr_inc_g seq_inc)\n    apply (subst pointed_fin_set.comp_char)\n       apply (simp_all add: arr_f arr_g seq)\n  proof-\n    have arr_gf2: \"partial_magma.arr pointed_fin_set.comp (Some (fin_set.Comp' (the g) (the f)))\"\n      using pointed_fin_set.comp_char arr_f arr_g seq arr_gf by simp\n    have arr_inc_gf2 : \"partial_magma.arr pointed_set_comp (inclusionFunctor (Some (fin_set.Comp' (the g) (the f))))\"\n      using inclusion_arr arr_gf2 by blast\n    have non_null : \"inclusionFunctor (Some (fin_set.Comp' (the g) (the f))) \\<noteq> None\"\n    using arr_inc_gf2 pointed_set.arr_char by blast\n\n    have \"the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f)))) =\n          the (inclusionFunctor g) \\<cdot> the (inclusionFunctor f)\"\n      apply (rule_tac fun_eq_char)\n    proof-\n      from arr_gf2 have \"partial_magma.arr pointed_set_comp (inclusionFunctor (Some (fin_set.Comp' (the g) (the f))))\"\n        using inclusion_arr by blast\n      then show \"Arr' (the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f)))))\"\n        unfolding pointed_set_comp_def \n        using classical_category.arr_char ccpf by blast\n      have \"partial_magma.arr pointed_set_comp (Some (the (inclusionFunctor g) \\<cdot> the (inclusionFunctor f)))\"\n        using arr_inc_gf by (simp add: arr_inc_f arr_inc_g pointed_set.comp_char seq_inc)\n      then show \"Arr' (the (inclusionFunctor g) \\<cdot> the (inclusionFunctor f))\"\n        by (simp add: arr_char)\n\n      have dom_eq1: \"fst (snd (the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f)))))) =\n    fst (snd (the (inclusionFunctor f)))\"\n        unfolding inclusionFunctor_def MkArr_def using arr_gf2 arr_f apply simp\n        apply (subst fin_set.comp_length)\n        by simp\n\n      have \"Some (Id' (fst (snd (the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f)))))))) =\n         Some (Id' (fst (snd (the (inclusionFunctor g) \\<cdot> the (inclusionFunctor f)))))\"\n        apply (subst dom_comp)\n        apply (simp add: arr_inc_f')\n          apply (simp add: arr_inc_g')\n        apply (simp add: seq_inc')\n        apply (subst dom_eq1)\n        by simp\n      \n      then show \"fst (snd (the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f)))))) =\n    fst (snd (the (inclusionFunctor g) \\<cdot> the (inclusionFunctor f)))\"\n        unfolding Id'_def by auto\n\n      have cod_eq1: \"snd (snd (the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f)))))) =\n    snd (snd (the (inclusionFunctor g)))\"\n        unfolding inclusionFunctor_def MkArr_def using arr_gf2 arr_g apply simp\n        unfolding fin_set.Comp'_def by simp\n\n      have \"Some (Id' (snd (snd (the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f)))))))) =\n    Some (Id' (snd (snd (the (inclusionFunctor g) \\<cdot> the (inclusionFunctor f)))))\"\n        apply (subst cod_comp)\n        using arr_char arr_inc_f apply blast\n        using arr_char arr_inc_g apply blast\n         apply (subst seq_char)\n        using arr_inc_f apply simp\n        using arr_inc_g apply simp\n        using seq_inc apply simp\n         apply simp\n        apply (subst cod_eq1)\n        by simp\n\n      then show \"snd (snd (the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f)))))) =\n    snd (snd (the (inclusionFunctor g) \\<cdot> the (inclusionFunctor f)))\"\n        unfolding Id'_def by auto\n      fix x\n      assume \" x \\<in> snd (fst (snd (the (inclusionFunctor\n                                  (Some (fin_set.Comp' (the g) (the f)))))))\"\n      then have \"x \\<in> snd (interval (length (snd (fin_set.Comp' (the g) (the f)))))\" \n        unfolding inclusionFunctor_def MkArr_def\n        using arr_gf2 by simp\n      then have ex_n_gf : \"\\<exists>n< length (snd (fin_set.Comp' (the g) (the f))). x = K n\" by simp\n      then have ex_n_f : \"\\<exists>n< length (snd (the f)). x = K n\" using fin_set.comp_length by simp\n      have x_in_f: \"x \\<in> snd (fst (snd (the (inclusionFunctor f))))\"\n        unfolding inclusionFunctor_def MkArr_def using arr_f ex_n_f by simp\n      from ex_n_f obtain n where n_def: \"n < length (snd (the f)) \\<and> x = K n\" by blast\n      have \"(SOME n. K n = x) = n\"\n      proof\n        show \"K n = x\" using n_def by simp\n        show \"\\<And>na. K na = x \\<Longrightarrow> na = n\" using n_def by simp\n      qed\n      then have seq2: \"get (snd (the f)) (SOME n. K n = x) < length (snd (the g))\"\n        apply simp\n        using arr_f arr_g fin_set.Arr'_def fin_set.Id'_def n_def pointed_fin_set.cod_char pointed_fin_set.dom_char pointed_fin_set_smash_arr seq by fastforce\n      \n      show \"fst (the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f))))) x =\n         fst (the (inclusionFunctor g) \\<cdot> the (inclusionFunctor f)) x\"\n        unfolding Comp'_def using arr_inc_f' arr_inc_g' seq_inc' x_in_f apply auto\n      proof-\n        show \"fst (the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f))))) x =\n    fst (the (inclusionFunctor g)) (fst (the (inclusionFunctor f)) x)\"\n          unfolding inclusionFunctor_def MkArr_def \n          using arr_g arr_f arr_gf2 ex_n_gf ex_n_f seq2 apply simp\n          using n_def apply simp\n          unfolding fin_set.Comp'_def\n          by simp\n      qed\n    qed\n    then have \"Some (the (inclusionFunctor (Some (fin_set.Comp' (the g) (the f))))) =\n    Some (the (inclusionFunctor g) \\<cdot> the (inclusionFunctor f))\" by simp\n    then show \"inclusionFunctor (Some (fin_set.Comp' (the g) (the f))) =\n    Some (the (inclusionFunctor g) \\<cdot> the (inclusionFunctor f))\"\n      by (simp add: non_null)\n  qed\nqed\n\n\n\ninterpretation \"functor\" \n                  pointed_fin_set.comp\n                  pointed_set_comp\n                  inclusionFunctor\n  using inclusion_functor.\n\n\n\nlemma eval_inclusion_functor : \"A.arr f \\<Longrightarrow>\n       n < length (snd (the f)) \\<Longrightarrow>\n       x = K n \\<Longrightarrow> fst (the (inclusionFunctor f)) x = K (get (snd (the f)) n)\"\n  unfolding inclusionFunctor_def MkArr_def by simp\n\n    \n\nlemma inclusion_dom2 : \"A.arr f \\<Longrightarrow> fst (snd (the (inclusionFunctor f))) = interval (fst (the (A.dom f)))\"\n  unfolding inclusionFunctor_def MkArr_def apply simp\n  apply (subst pointed_fin_set.dom_char)\n   apply simp\n  unfolding fin_set.Id'_def by simp\n\n\nlemma inclusion_cod2 : \"A.arr f \\<Longrightarrow> snd (snd (the (inclusionFunctor f))) = interval (fst (the (A.cod f)))\"\n  unfolding inclusionFunctor_def MkArr_def apply simp\n  apply (subst pointed_fin_set.cod_char)\n   apply simp\n  unfolding fin_set.Id'_def by simp\n\nlemma fully_faithful: \"fully_faithful_functor \n                  pointed_fin_set.comp\n                  pointed_set_comp\n                  inclusionFunctor\"\n  unfolding fully_faithful_functor_def\n  unfolding faithful_functor_def full_functor_def\n  apply (simp add: inclusion_functor)\n  apply (rule_tac conjI)\nproof-\n\n  (* We first prove faithfulness for a functor that is exactly like inclusionFunctor,\nbecause Isabelle for some reason is incapable of proving\n                       \"inclusionFunctor f = inclusionFunctor g \\<Longrightarrow>\n                       inclusionFunctor f = inclusionFunctor g\"\nwhile it has no problems proving \"inclusionLike f = inclusionLike g \\<Longrightarrow>\n                                  inclusionLike f = inclusionLike g\" \nI have no idea why this is necessary, but it is.*)\n\n  have faithful: \"\\<And> inclusionLike :: (nat \\<times> nat list) option \\<Rightarrow> 'b LC parr option. \n         (\\<And>f x n. A.arr f \\<Longrightarrow>\n               n<length (snd (the f)) \\<Longrightarrow> x = K n \\<Longrightarrow>\n               fst (the (inclusionLike f)) x =\n               K (get (snd (the f)) n)) \\<Longrightarrow>\n         faithful_functor_axioms pointed_fin_set.comp inclusionLike\"\n    unfolding faithful_functor_axioms_def apply auto\n  proof-\n    fix inclusionLike :: \"(nat \\<times> nat list) option \\<Rightarrow> 'b LC parr option\"\n    fix f g :: \"(nat \\<times> nat list) option\"\n    assume inc_eval : \"(\\<And>f x n.\n           A.arr f \\<Longrightarrow>\n           n < length (snd (the f)) \\<Longrightarrow>\n           x = K n \\<Longrightarrow> fst (the (inclusionLike f)) (K n) = K (get (snd (the f)) n))\"\n    assume arr_f: \"A.arr f\"\n    assume arr_g: \"A.arr g\"\n    assume dom_eq: \"A.dom f = A.dom g\"\n    assume cod_eq: \"A.cod f = A.cod g\"\n    assume inc_eq: \"inclusionLike f = inclusionLike g\"\n    have \"the f = the g\"\n    proof\n      show fst_eq: \"fst (the f) = fst (the g)\"\n        using arr_f arr_g cod_eq fin_set.Id'_def pointed_fin_set.cod_char by auto\n      have length_eq: \"length (snd (the f)) = length (snd (the g))\"\n        using arr_f arr_g dom_eq fin_set.Id'_def pointed_fin_set.dom_char by auto\n      show \"snd (the f) = snd (the g)\"\n        apply (rule_tac getFaithful)\n         apply (simp add: length_eq)\n      proof-\n        fix n\n        assume nlf : \"n < length (snd (the f))\"\n        then have nlg : \"n < length (snd (the g))\" using length_eq by simp\n        obtain x :: \"'a LC\" where x_def : \"x = K n\" by simp\n        then have ex_n : \"\\<exists>n<length (snd (the f)). x = K n\"\n          using nlf by blast\n        have eq1: \"fst (the (inclusionLike f)) (K n) = K (get (snd (the f)) n)\"\n          apply (rule_tac inc_eval)\n          by (simp_all add: arr_f nlf)\n        have eq2: \"fst (the (inclusionLike g)) (K n) = K (get (snd (the g)) n)\"\n          apply (rule_tac inc_eval)\n          by (simp_all add: arr_g nlg x_def)\n        from eq1 and eq2 and inc_eq have \"K (get (snd (the f)) n) = K (get (snd (the g)) n)\" by simp\n        then show \"get (snd (the f)) n = get (snd (the g)) n\" by simp\n      qed\n    qed\n    then show \"f = g\"\n      by (simp add: arr_f arr_g option.expand pointed_fin_set_smash_arr)\n  qed\n  term inclusionFunctor\n  show \"faithful_functor_axioms pointed_fin_set.comp inclusionFunctor\"\n    apply (rule_tac faithful)\n    using eval_inclusion_functor.\n\n  show \"full_functor_axioms pointed_fin_set.comp pointed_set_comp inclusionFunctor\"\n    unfolding full_functor_axioms_def apply auto\n  proof\n    fix a b g\n    assume ide_a : \"A.ide a\"\n    then have \"0 < fst (the a)\"\n      using A.ideD(1) pointed_fin_set_smash_arr by blast\n    from ide_a have arr_a : \"A.arr a\" by simp\n    from ide_a have \"fst (the a) = length (snd (the a))\"\n      by (metis A.ideD(2) arr_a fin_set.Id'_def option.sel pointed_fin_set.dom_char prod.collapse prod.simps(1))\n    assume ide_b : \"A.ide b\"\n    then have \"0 < fst (the b)\"\n      using A.ideD(1) pointed_fin_set_smash_arr by blast\n    from ide_b have arr_b : \"A.arr b\" by simp\n    from ide_b have \"fst (the b) = length (snd (the b))\"\n      by (metis A.ideD(2) arr_b fin_set.Id'_def option.sel pointed_fin_set.dom_char prod.collapse prod.simps(1))\n    assume gab : \"B.in_hom g (inclusionFunctor b) (inclusionFunctor a)\"\n\n    from gab have dom_g: \"B.dom g = inclusionFunctor b\" using category.in_homE by blast\n    from gab have cod_g: \"B.cod g = inclusionFunctor a\" using category.in_homE by blast\n    from gab have arr_g : \"B.arr g\" using category.in_homE by blast\n\n    from dom_g have \"Some (Id' (fst (snd (the g)))) = Some (Id' (interval (fst (the b))))\"\n      using arr_g apply (simp add: pointed_set.dom_char)\n      unfolding inclusionFunctor_def MkArr_def using arr_b apply simp\n      unfolding Id'_def using \\<open>fst (the b) = length (snd (the b))\\<close> by auto\n    then have dom_g2: \"fst (snd (the g)) = interval (fst (the b))\"\n      unfolding Id'_def by simp\n\n    from cod_g have \"Some (Id' (snd (snd (the g)))) = Some (Id' (interval (fst (the a))))\"\n      using arr_g apply (simp add: pointed_set.cod_char)\n      unfolding inclusionFunctor_def MkArr_def using arr_a apply simp\n      unfolding Id'_def using \\<open>fst (the a) = length (snd (the a))\\<close> by auto\n    then have cod_g2: \"snd (snd (the g)) = interval (fst (the a))\"\n      unfolding Id'_def by simp\n\n    from arr_g have \"fst (the g) (fst (fst (snd (the g)))) = fst (snd (snd (the g)))\"\n      unfolding pointed_set.arr_char unfolding Arr'_def by simp\n    then have \"fst (the g) (K 0) = K 0\"\n      using dom_g2 cod_g2 by simp\n\n    define f where f_def: \"f = Some (fst (the a),rev_get (fst (the b))\n                           (\\<lambda>n. (SOME m. fst (the g) (K n) = K m)))\"\n    show \"A.in_hom f b a \\<and> inclusionFunctor f = g\"\n      apply auto\n    proof\n      show arr_f: \"A.arr f\"\n        apply (rule_tac pointed_fin_set_unsmash_arr)\n        unfolding f_def apply simp_all\n        unfolding fin_set.Arr'_def apply simp\n           apply auto[1]\n      proof-\n        have \"length (rev_get (fst (the b)) (\\<lambda>n. SOME m. fst (the g) (K n) = K m)) \\<noteq> length []\"\n          by (simp add: \\<open>0 < fst (the b)\\<close>)\n        then show \"rev_get (fst (the b)) (\\<lambda>n. SOME m. fst (the g) (K n) = K m) \\<noteq> []\"\n          by force\n        show \"get (rev_get (fst (the b)) (\\<lambda>n. SOME m. fst (the g) (K n) = K m)) 0 = 0\"\n          using \\<open>0 < fst (the b)\\<close> apply simp\n        proof\n          show \"fst (the g) (K 0) = K 0\" using \\<open>fst (the g) (K 0) = K 0\\<close>.\n          fix m\n          show \"fst (the g) (K 0) = K m \\<Longrightarrow> m = 0\"\n            by (simp add: \\<open>fst (the g) (K 0) = K 0\\<close>)\n        qed\n        show \"0 < fst (the a)\" using \\<open>0 < fst (the a)\\<close>.\n        fix n\n        assume \"n < fst (the b)\"\n        then have \"K n \\<in> snd (fst (snd (the g)))\"\n          by (simp add: dom_g2)\n        then have \"fst (the g) (K n) \\<in> snd (snd (snd (the g)))\"\n          using arr_g by (simp add: arr_char pointed_set.maps_to_char)\n        then have \"fst (the g) (K n) \\<in> {x. \\<exists>m<fst (the a). x = K m}\"\n          by (simp add: cod_g2)\n        then have \"\\<exists>m<fst (the a). fst (the g) (K n) = K m\" by simp\n        then obtain m where m_def: \"m < fst (the a) \\<and> fst (the g) (K n) = K m\" by auto\n        have m_some: \"(SOME m. fst (the g) (K n) = K m) = m\"\n        proof\n          show \"fst (the g) (K n) = K m\" using m_def by simp\n          show \"\\<And>ma. fst (the g) (K n) = K ma \\<Longrightarrow> ma = m\" using m_def by simp\n        qed\n        show \"(SOME m. fst (the g) (K n) = K m) < fst (the a)\"\n          apply (subst m_some)\n          by (simp add: m_def)\n      qed\n      show dom_f: \"A.dom f = b\"\n        using arr_f apply (simp add: pointed_fin_set.dom_char)\n        unfolding f_def apply simp\n      proof-\n        have \"Some (fin_set.Id' (fst (the b))) = A.cod b\"\n          using arr_b by (simp add: pointed_fin_set.cod_char)\n        then show \"Some (fin_set.Id' (fst (the b))) = b\"\n          by (simp add: ide_b)\n      qed\n      then have dom_f2: \"fst (snd (the (inclusionFunctor f))) = interval (fst (the b))\"\n        using arr_f by (simp add: inclusion_dom2)\n\n      show cod_f: \"A.cod f = a\"\n        using arr_f apply (simp add: pointed_fin_set.cod_char)\n        unfolding f_def apply simp\n      proof-\n        have \"Some (fin_set.Id' (fst (the a))) = A.cod a\"\n          using arr_a by (simp add: pointed_fin_set.cod_char)\n        then show \"Some (fin_set.Id' (fst (the a))) = a\"\n          by (simp add: ide_a)\n      qed\n      then have cod_f2 : \"snd (snd (the (inclusionFunctor f))) = interval (fst (the a))\"\n        using arr_f by (simp add: inclusion_cod2)\n      have the_eq: \"the (inclusionFunctor f) = the g\"\n        apply (rule_tac fun_eq_char)\n        using arr_f pointed_set.arr_char apply auto[1]\n        using arr_g pointed_set.arr_char apply auto[1]\n        using dom_g2 dom_f2 apply simp\n        using cod_g2 cod_f2 apply simp\n        apply (simp add: dom_f2)\n      proof-\n        fix x :: \"'c LC\"\n        assume ex_n : \"\\<exists>n<fst (the b). x = K n\"\n        then obtain n where n_def: \"n < fst (the b) \\<and> x = K n\" by auto\n        have \"K n \\<in> snd (fst (snd (the g)))\" using dom_g2 n_def by simp\n        then have \"fst (the g) (K n) \\<in> snd (snd (snd (the g)))\" \n          using arr_g by (simp add: arr_char pointed_set.maps_to_char) \n        then have \"fst (the g) (K n) \\<in> {x. \\<exists>m<fst (the a). x = K m}\" using cod_g2 by simp\n        then have ex_m : \"\\<exists>m<fst(the a). fst (the g) (K n) = K m\" by simp\n        then obtain m where m_def : \"m < fst (the a) \\<and> fst (the g) (K n) = K m\" by auto\n        have m_some: \"(SOME m. fst (the g) (K n) = K m) = m\"\n        proof\n          show \"fst (the g) (K n) = K m\" using m_def by simp\n          show \"\\<And>ma. fst (the g) (K n) = K ma \\<Longrightarrow> ma = m\" using m_def by simp\n        qed\n        have eq: \"fst (the (inclusionFunctor f)) x = K (get (snd (the f)) n)\"\n          apply (rule_tac eval_inclusion_functor)\n            apply (simp add: arr_f)\n          by (simp_all add: n_def f_def)\n        show \"fst (the (inclusionFunctor f)) x = fst (the g) x\"\n          apply (subst eq)\n          unfolding f_def apply simp\n          apply (simp add: n_def get_rev_get)\n          using m_some m_def by simp\n      qed\n      from arr_f have \"B.arr (inclusionFunctor f)\" by blast\n      then have inc_f_nn: \"inclusionFunctor f \\<noteq> None\" \n        apply (simp add: arr_char)\n        by blast\n      from arr_g have g_nn: \"g \\<noteq> None\"\n        by (simp add: arr_char)\n      from the_eq show \"inclusionFunctor f = g\"\n        by (simp add: g_nn inc_f_nn option.expand)\n    qed\n  qed\nqed\n\nlemma interval_finite : \"finite (snd (interval n))\"\n  by simp\n\n\n\n\n\nlemma inclusion_factors_over_finite_sets :\n   \"factorization pointed_fin_set.comp pointed_set_comp inclusionFunctor FiniteArr'\"\n  unfolding factorization_def\n  apply (simp add: pointed_fin_set.is_category)\n  apply (simp add: is_category)\n  apply (simp add: finite_subcat)\n  apply (simp add: inclusion_functor)\n  unfolding factorization_axioms_def\n  apply auto\nproof-\n  fix a\n  assume arr_a: \"A.arr a\"\n  show \"FiniteArr' (inclusionFunctor a)\"\n    unfolding FiniteArr'_def\n    using arr_a by (simp add: inclusion_dom2 inclusion_cod2)\nqed\n\nlemma inclusion_functor_to_fin_set : \n     \"functor pointed_fin_set.comp pointed_finite_subcat inclusionFunctor\"\n  unfolding pointed_finite_subcat_def\n  apply (rule_tac factorization.is_functor)\n  using inclusion_factors_over_finite_sets.\n\n\nlemma inclusion_essentially_surjective:\n    \"essentially_surjective_functor\n     pointed_fin_set.comp pointed_finite_subcat inclusionFunctor\"\n  unfolding essentially_surjective_functor_def\n  apply (simp add: inclusion_functor_to_fin_set)\n  unfolding essentially_surjective_functor_axioms_def\n  apply auto\nproof-\n  fix b :: \"'a LC parr option\"\n  assume fin_ide_b: \"partial_magma.ide pointed_finite_subcat b\"\n  then have ide_b: \"B.ide b\"\n    unfolding pointed_finite_subcat_def\n    by (simp add: finite_subcat subcategory.ide_char)\n  from fin_ide_b have \"partial_magma.arr pointed_finite_subcat b\"\n    by (simp add: finite_subcat pointed_finite_subcat_def subcategory.ide_char)\n  then have fin_arr_b : \"FiniteArr' b\"\n    unfolding pointed_finite_subcat_def\n    by (simp add: finite_subcat subcategory.arr_char)\n  then have fin_b : \"finite (snd (Dom' (the b)))\"\n    unfolding FiniteArr'_def by simp\n  from fin_arr_b have arr_b : \"Arr' (the b)\"\n    unfolding FiniteArr'_def\n    using pointed_set.arr_char by blast\n\n  have obj_b : \"Obj' (Dom' (the b))\"\n    using dom_obj [OF arr_b].\n\n\n  from pointed_finite_imp_nat_seg_image_inj_on [OF obj_b \\<open>finite (snd (Dom' (the b)))\\<close>]\n  obtain n :: nat and f2 where f2n_def: \"bij_betw f2 {i. i < n} (snd (fst (snd (the b)))) \\<and> f2 0 = fst (fst (snd (the b)))\" \n    by auto\n  from obj_b have \"fst (Dom' (the b)) \\<in> snd (Dom' (the b))\"\n    unfolding Obj'_def.\n  then have \"fst (Dom' (the b)) \\<in> f2 ` {i. i < n}\"\n    using f2n_def unfolding bij_betw_def by simp\n  then obtain i where \"i < n\" by auto\n  then have \"n > 0\" by simp\n  show \"\\<exists>a. A.ide a \\<and> category.isomorphic pointed_finite_subcat (inclusionFunctor a) b\"\n    apply (rule_tac exI)\n  proof\n    define a where \"a = Some (fin_set.Id' n)\"\n    show \"A.ide a\"\n      apply (subst pointed_fin_set.ide_char)\n      unfolding a_def apply simp\n      unfolding fin_set.Id'_def apply simp\n      by (metis \\<open>n>0\\<close> list.size(3) less_numeral_extra(3) rev_get_length)\n    show \"category.isomorphic pointed_finite_subcat (inclusionFunctor (Some (fin_set.Id' n))) b\"\n      apply (subst category.isomorphic_def)\n      unfolding pointed_finite_subcat_def\n      using subcategory.is_category [OF finite_subcat] apply simp\n      apply (rule_tac exI)\n    proof\n      term MkArr\n      define \\<phi> where \"\\<phi> = Some (MkArr (interval n) (Dom' (the b)) \n                   (\\<lambda>x. f2 (SOME n. K n = x)))\"\n      define \\<psi> where \"\\<psi> = Some (MkArr (Dom' (the b)) (interval n)\n                   (\\<lambda>x. K (SOME m. m<n \\<and> f2 m = x)))\"\n      show \\<phi>_in_hom: \"partial_magma.in_hom (subcategory.comp pointed_set_comp FiniteArr') \\<phi>\n     (inclusionFunctor (Some (fin_set.Id' n))) b\"\n        apply (subst subcategory.in_hom_char [OF finite_subcat])\n        apply auto\n      proof-\n        have \"A.ide (Some (fin_set.Id' n))\"\n          apply (subst pointed_fin_set.ide_char)\n          unfolding fin_set.Id'_def by (simp add: \\<open>0<n\\<close>)\n        then have arr_id_n: \"A.arr (Some (fin_set.Id' n))\" by simp\n        show \"partial_magma.arr (subcategory.comp pointed_set_comp FiniteArr')\n     (inclusionFunctor (Some (fin_set.Id' n)))\"\n          using functor.preserves_arr [OF inclusion_functor_to_fin_set arr_id_n]\n          unfolding pointed_finite_subcat_def.\n        show \"partial_magma.arr (subcategory.comp pointed_set_comp FiniteArr') b\"\n          using \\<open>partial_magma.arr pointed_finite_subcat b\\<close> \n          unfolding pointed_finite_subcat_def.\n        show arr_\\<phi>: \"partial_magma.arr (subcategory.comp pointed_set_comp FiniteArr') \\<phi>\"\n          apply (subst subcategory.arr_char [OF finite_subcat])\n          unfolding FiniteArr'_def apply auto\n          unfolding pointed_set_comp_def\n            apply (subst classical_category.arr_char [OF ccpf])\n          unfolding Arr'_def apply safe\n        proof-\n          show \"\\<exists>y. \\<phi> = Some y\"\n            unfolding \\<phi>_def by blast\n          show \"setcat.Arr (forget (the \\<phi>))\"\n            unfolding setcat.Arr_def \\<phi>_def MkArr_def apply simp\n          proof\n            fix x\n            assume \"x \\<in> {x. \\<exists>m<n. x = K m}\"\n            then have ex_m : \"\\<exists>m < n. x = K m\" by simp\n            then obtain m where m_def: \"m < n \\<and> x = K m\" by auto\n            have some_m : \"(SOME m. K m = x) = m\"\n            proof\n              show \"K m = x\" using m_def by simp\n              show \"\\<And>ma. K ma = x \\<Longrightarrow> ma = m\" using m_def by simp\n            qed\n            show \"f2 (SOME m. K m = x) \\<in> snd (fst (snd (the b)))\"\n              apply (subst some_m)\n              using f2n_def m_def unfolding bij_betw_def by blast\n          qed\n          show \"Obj' (fst (snd (the \\<phi>)))\"\n            unfolding \\<phi>_def MkArr_def apply simp\n            using interval_obj [OF \\<open>0<n\\<close>] unfolding interval.simps.\n          show \"Obj' (snd (snd (the \\<phi>)))\"\n            unfolding \\<phi>_def MkArr_def apply simp\n            using dom_obj [OF arr_b].\n          show \"fst (the \\<phi>) (fst (fst (snd (the \\<phi>)))) = fst (snd (snd (the \\<phi>)))\"\n            unfolding \\<phi>_def MkArr_def apply (simp add: \\<open>0<n\\<close>)\n            using f2n_def by simp\n          show \"finite (snd (fst (snd (the \\<phi>))))\"\n            unfolding \\<phi>_def MkArr_def by simp\n          show \"finite (snd (snd (snd (the \\<phi>))))\"\n            unfolding \\<phi>_def MkArr_def apply simp\n            using fin_b.\n        qed\n        then have \"FiniteArr' \\<phi>\"\n          using subcategory.arr_char [OF finite_subcat] by blast\n        then have \"B.arr \\<phi>\"\n          unfolding FiniteArr'_def by simp\n        show \"B.in_hom \\<phi> (inclusionFunctor (Some (fin_set.Id' n))) b\"\n          apply (rule_tac category.in_homI)\n             apply (simp add: is_category)\n            apply (simp add: \\<open>B.arr \\<phi>\\<close>)\n           apply (subst inclusion_id [OF \\<open>0<n\\<close>])\n           apply (subst dom_char [OF \\<open>B.arr \\<phi>\\<close>])\n           apply (simp add: \\<phi>_def MkArr_def)\n          apply (subst cod_char [OF \\<open>B.arr \\<phi>\\<close>])\n          unfolding \\<phi>_def MkArr_def apply simp\n          using classical_category.ide_char [OF ccpf]\n          using ide_b unfolding pointed_set_comp_def\n          by (simp add: \\<open>\\<And>a. partial_magma.ide (classical_category.comp Arr' (\\<lambda>t. fst (snd t)) (\\<lambda>t. snd (snd t)) (\\<cdot>)) a = (Arr' (the a) \\<and> a = Some (Id' (fst (snd (the a)))))\\<close>)\n      qed\n      have arr_\\<phi>: \"partial_magma.arr (subcategory.comp pointed_set_comp FiniteArr') \\<phi>\"\n        using category.in_homE [OF subcategory.is_category[OF finite_subcat] \\<phi>_in_hom]\n        by blast\n      then have fin_arr_\\<phi>: \"FiniteArr' \\<phi>\" \n        using subcategory.arr_char [OF finite_subcat] by blast\n      then have \"B.arr \\<phi>\"\n        unfolding FiniteArr'_def by simp\n      then have arr'_\\<phi>: \"Arr' (the \\<phi>)\"\n        using arr_char by blast\n      have \\<psi>_in_hom : \"partial_magma.in_hom (subcategory.comp pointed_set_comp FiniteArr') \\<psi>\n     b (inclusionFunctor (Some (fin_set.Id' n)))\"\n        apply (subst subcategory.in_hom_char [OF finite_subcat])\n        apply auto\n      proof-\n        have \"A.ide (Some (fin_set.Id' n))\"\n          apply (subst pointed_fin_set.ide_char)\n          unfolding fin_set.Id'_def by (simp add: \\<open>0<n\\<close>)\n        then have arr_id_n: \"A.arr (Some (fin_set.Id' n))\" by simp\n        show \"partial_magma.arr (subcategory.comp pointed_set_comp FiniteArr')\n     (inclusionFunctor (Some (fin_set.Id' n)))\"\n          using functor.preserves_arr [OF inclusion_functor_to_fin_set arr_id_n]\n          unfolding pointed_finite_subcat_def.\n        show \"partial_magma.arr (subcategory.comp pointed_set_comp FiniteArr') b\"\n          using \\<open>partial_magma.arr pointed_finite_subcat b\\<close> \n          unfolding pointed_finite_subcat_def.\n        show \"partial_magma.arr (subcategory.comp pointed_set_comp FiniteArr') \\<psi>\"\n          apply (subst subcategory.arr_char [OF finite_subcat])\n          unfolding FiniteArr'_def apply auto\n          unfolding pointed_set_comp_def\n            apply (subst classical_category.arr_char [OF ccpf])\n          unfolding Arr'_def apply safe\n        proof-\n          show \"\\<exists>y. \\<psi> = Some y\"\n            unfolding \\<psi>_def by blast\n          show \"setcat.Arr (forget (the \\<psi>))\"\n            unfolding setcat.Arr_def \\<psi>_def MkArr_def apply simp\n          proof\n            fix x\n            assume \"x \\<in> snd (Dom' (the b))\"\n            then have \"x \\<in> f2 ` {i. i < n}\"\n              using f2n_def unfolding bij_betw_def by simp\n            then obtain i where i_def: \"i<n \\<and> f2 i = x\" by auto\n            have i_some : \"(SOME m. m<n \\<and> f2 m = x) = i\"\n            proof\n              show \"i < n \\<and> f2 i = x\" by (simp add: i_def)\n              fix m\n              assume m_def: \"m < n \\<and> f2 m = x\"\n              then have f2_eq: \"f2 m = f2 i\" by (simp add: i_def)\n              have inj: \"\\<And> x y. x < n \\<Longrightarrow> y < n \\<Longrightarrow> (f2 x = f2 y \\<Longrightarrow> x = y)\"\n                using f2n_def unfolding bij_betw_def inj_on_def by auto\n              show \"m = i\"\n                apply (rule_tac inj)\n                by (simp_all add: m_def f2_eq i_def)\n            qed\n            show \"K (SOME m. m < n \\<and> f2 m = x) \\<in> {x. \\<exists>na<n. x = K na}\"\n              apply (subst i_some)\n            proof\n              show \"\\<exists>na<n. K i = K na\"\n              proof\n                show \"i < n \\<and> K i = K i\" by (simp add: i_def)\n              qed\n            qed\n          qed\n          show \"Obj' (fst (snd (the \\<psi>)))\"\n            unfolding \\<psi>_def MkArr_def apply simp\n            using dom_obj [OF arr_b].\n          have b_pointed: \"fst (fst (snd (the b))) \\<in> snd (fst (snd (the b)))\"\n            using dom_obj [OF arr_b] unfolding Obj'_def.\n          show \"Obj' (snd (snd (the \\<psi>)))\"\n            unfolding \\<psi>_def MkArr_def apply simp\n            using interval_obj [OF \\<open>0<n\\<close>] unfolding interval.simps.\n          show \"fst (the \\<psi>) (fst (fst (snd (the \\<psi>)))) = fst (snd (snd (the \\<psi>)))\"\n            unfolding \\<psi>_def MkArr_def apply (simp add: b_pointed)\n          proof\n            show \"0 < n \\<and> f2 0 = fst (fst (snd (the b)))\"\n              apply (simp add: \\<open>0<n\\<close>)\n              using f2n_def by simp\n            fix m\n            assume m_def: \"m < n \\<and> f2 m = fst (fst (snd (the b)))\"\n            have inj: \"\\<And> x y. x < n \\<Longrightarrow> y < n \\<Longrightarrow> (f2 x = f2 y \\<Longrightarrow> x = y)\"\n              using f2n_def unfolding bij_betw_def inj_on_def by auto\n            show \"m = 0\"\n              apply (rule_tac inj)\n                apply (simp_all add: m_def \\<open>0<n\\<close>)\n              using f2n_def by simp\n          qed\n          show \"finite (snd (fst (snd (the \\<psi>))))\"\n            unfolding \\<psi>_def MkArr_def by (simp add: fin_b)\n          show \"finite (snd (snd (snd (the \\<psi>))))\"\n            unfolding \\<psi>_def MkArr_def by simp\n        qed\n        then have \"FiniteArr' \\<psi>\"\n          using subcategory.arr_char [OF finite_subcat] by blast\n        then have \"B.arr \\<psi>\"\n          unfolding FiniteArr'_def by simp\n        show \"B.in_hom \\<psi> b (inclusionFunctor (Some (fin_set.Id' n)))\"\n          apply (rule_tac category.in_homI)\n             apply (simp add: is_category)\n            apply (simp add: \\<open>B.arr \\<psi>\\<close>)\n           apply (subst dom_char [OF \\<open>B.arr \\<psi>\\<close>])\n          apply (simp add: \\<psi>_def MkArr_def)\n          using classical_category.ide_char [OF ccpf]\n          using ide_b\n           apply (simp add: pointed_set_comp_def \\<open>\\<And>a. partial_magma.ide (classical_category.comp Arr' (\\<lambda>t. fst (snd t)) (\\<lambda>t. snd (snd t)) (\\<cdot>)) a = (Arr' (the a) \\<and> a = Some (Id' (fst (snd (the a)))))\\<close>)\n          apply (subst inclusion_id [OF \\<open>0<n\\<close>])\n          apply (subst cod_char [OF \\<open>B.arr \\<psi>\\<close>])\n          unfolding \\<psi>_def MkArr_def by simp\n      qed\n      have arr_\\<psi>: \"partial_magma.arr (subcategory.comp pointed_set_comp FiniteArr') \\<psi>\"\n        using category.in_homE [OF subcategory.is_category[OF finite_subcat] \\<psi>_in_hom]\n        by blast\n      then have fin_arr_\\<psi>: \"FiniteArr' \\<psi>\" \n        using subcategory.arr_char [OF finite_subcat] by blast\n      then have \"B.arr \\<psi>\"\n        unfolding FiniteArr'_def by simp\n      then have arr'_\\<psi>: \"Arr' (the \\<psi>)\"\n        using arr_char by blast\n      have \\<phi>_rev_def : \"Some (MkArr (interval n) (fst (snd (the b))) (\\<lambda>x. f2 (SOME n. K n = x))) = \\<phi>\" \n        unfolding \\<phi>_def by simp\n      show \"category.iso (subcategory.comp pointed_set_comp FiniteArr')\n     (Some (MkArr (interval n) (fst (snd (the b))) (\\<lambda>x. f2 (SOME n. K n = x))))\"\n        apply (subst \\<phi>_rev_def)\n        apply (subst category.iso_def)\n         apply (simp add: subcategory.is_category [OF finite_subcat])\n      proof\n        show \"category.inverse_arrows (subcategory.comp pointed_set_comp FiniteArr') \\<phi> \\<psi>\"\n          apply (subst category.inverse_arrows_def)\n           apply (simp add: subcategory.is_category [OF finite_subcat])\n        proof\n          have \\<psi>\\<phi>_in_hom: \"partial_magma.in_hom (subcategory.comp pointed_set_comp FiniteArr')\n   (subcategory.comp pointed_set_comp FiniteArr' \\<psi> \\<phi>)\n                (inclusionFunctor (Some (fin_set.Id' n)))\n                (inclusionFunctor (Some (fin_set.Id' n)))\"\n            apply (rule_tac category.comp_in_homI [OF subcategory.is_category [OF finite_subcat]])\n            using \\<phi>_in_hom apply blast\n            using \\<psi>_in_hom.\n          then have arr_\\<psi>\\<phi> : \"partial_magma.arr (subcategory.comp pointed_set_comp FiniteArr')\n   (subcategory.comp pointed_set_comp FiniteArr' \\<psi> \\<phi>)\"\n            using category.in_homE [OF subcategory.is_category [OF finite_subcat] \\<psi>\\<phi>_in_hom]\n            by blast\n\n          have \\<phi>\\<psi>_in_hom : \"partial_magma.in_hom (subcategory.comp pointed_set_comp FiniteArr')\n   (subcategory.comp pointed_set_comp FiniteArr' \\<phi> \\<psi>) b b\"\n            apply (rule_tac category.comp_in_homI [OF subcategory.is_category [OF finite_subcat]])\n            using \\<psi>_in_hom apply blast\n            using \\<phi>_in_hom.\n          then have arr_\\<phi>\\<psi> : \"partial_magma.arr (subcategory.comp pointed_set_comp FiniteArr')\n   (subcategory.comp pointed_set_comp FiniteArr' \\<phi> \\<psi>)\"\n            using category.in_homE [OF subcategory.is_category [OF finite_subcat] \\<phi>\\<psi>_in_hom]\n            by blast\n          have seq\\<psi>\\<phi>: \"B.seq \\<psi> \\<phi>\"\n            apply (rule_tac category.seqI' [OF is_category])\n            using \\<phi>_in_hom\n            using subcategory.in_hom_char [OF finite_subcat]\n             apply blast\n            using \\<psi>_in_hom\n            using subcategory.in_hom_char [OF finite_subcat]\n            by blast\n          have seq\\<phi>\\<psi>: \"B.seq \\<phi> \\<psi>\"\n            apply (rule_tac category.seqI' [OF is_category])\n            using \\<psi>_in_hom\n            using subcategory.in_hom_char [OF finite_subcat]\n             apply blast\n            using \\<phi>_in_hom\n            using subcategory.in_hom_char [OF finite_subcat]\n            by blast\n\n          show \"partial_magma.ide (subcategory.comp pointed_set_comp FiniteArr')\n     (subcategory.comp pointed_set_comp FiniteArr' \\<psi> \\<phi>)\"\n            apply (subst subcategory.ide_char [OF finite_subcat])\n            apply (subst subcategory.arr_char [OF finite_subcat])\n            apply auto\n            using arr_\\<psi>\\<phi> subcategory.arr_char [OF finite_subcat] apply blast\n            apply (subst ide_char)\n            apply auto\n          proof-\n            have \"FiniteArr'\n   (subcategory.comp pointed_set_comp FiniteArr' \\<psi> \\<phi>)\"\n              using arr_\\<psi>\\<phi> subcategory.arr_char [OF finite_subcat] by blast\n            then show arr'_\\<psi>\\<phi>: \"Arr' (the\n   (subcategory.comp pointed_set_comp FiniteArr' \\<psi> \\<phi>))\"\n              unfolding FiniteArr'_def\n              using arr_char by blast\n            have comp_\\<psi>\\<phi>: \"(subcategory.comp pointed_set_comp FiniteArr' \\<psi> \\<phi>) =\n                    Some (the \\<psi> \\<cdot> the \\<phi>)\"\n              apply (subst subcategory.comp_char [OF finite_subcat])\n              apply (simp add: arr_\\<phi> arr_\\<psi> seq\\<psi>\\<phi>)\n              apply (subst comp_char)\n              using arr_\\<phi> subcategory.arr_char [OF finite_subcat] \n              unfolding FiniteArr'_def apply blast\n              using arr_\\<psi> subcategory.arr_char [OF finite_subcat] \n              unfolding FiniteArr'_def apply blast\n              using seq\\<psi>\\<phi> apply blast\n              by simp\n\n            show \"subcategory.comp pointed_set_comp FiniteArr' \\<psi> \\<phi> =\n    Some (Id' (fst (snd (the (subcategory.comp pointed_set_comp FiniteArr' \\<psi> \\<phi>)))))\"\n              apply (subst comp_\\<psi>\\<phi>)\n              apply (subst comp_\\<psi>\\<phi>)\n              apply simp\n              apply (rule_tac fun_eq_char)\n            proof-\n              show \"Arr' (the \\<psi> \\<cdot> the \\<phi>)\"\n                using arr'_\\<psi>\\<phi> comp_\\<psi>\\<phi> by simp\n              then show \"Arr' (Id' (fst (snd (the \\<psi> \\<cdot> the \\<phi>))))\"\n                using classical_category.Arr_Id [OF ccpf dom_obj] by blast\n              show \"fst (snd (the \\<psi> \\<cdot> the \\<phi>)) = fst (snd (Id' (fst (snd (the \\<psi> \\<cdot> the \\<phi>)))))\"\n                unfolding Id'_def by simp\n              have seq'\\<psi>\\<phi>: \"snd (snd (the \\<phi>)) = fst (snd (the \\<psi>))\"\n                 apply (subst seq_char [OF \\<open>B.arr \\<phi>\\<close> \\<open>B.arr \\<psi>\\<close>])\n                using seq\\<psi>\\<phi> apply blast\n                by simp\n              show \"snd (snd (the \\<psi> \\<cdot> the \\<phi>)) = snd (snd (Id' (fst (snd (the \\<psi> \\<cdot> the \\<phi>)))))\"\n                unfolding Id'_def apply simp\n                apply (subst dom_comp [OF arr'_\\<phi> arr'_\\<psi> seq'\\<psi>\\<phi>])\n                apply (subst cod_comp [OF arr'_\\<phi> arr'_\\<psi> seq'\\<psi>\\<phi>])\n                unfolding \\<phi>_def \\<psi>_def MkArr_def by simp\n              fix x\n              assume \"x \\<in> snd (fst (snd (the \\<psi> \\<cdot> the \\<phi>)))\"\n              then have x_in_\\<phi>: \"x \\<in> snd (fst (snd (the \\<phi>)))\"\n                using dom_comp [OF arr'_\\<phi> arr'_\\<psi> seq'\\<psi>\\<phi>] by simp\n              show \"fst (the \\<psi> \\<cdot> the \\<phi>) x = fst (Id' (fst (snd (the \\<psi> \\<cdot> the \\<phi>)))) x\"\n                unfolding Comp'_def using arr'_\\<phi> arr'_\\<psi> seq'\\<psi>\\<phi> x_in_\\<phi> apply simp\n              proof-\n                have \"x \\<in> snd (interval n)\"\n                  using x_in_\\<phi> unfolding \\<phi>_def MkArr_def by simp\n                then have ex_m : \"\\<exists>m<n. x = K m\" by simp\n                then obtain m where m_def: \"m < n \\<and> x = K m\" by auto\n                then have \"m \\<in> {i. i<n}\" by simp\n                then have f2mb: \"f2 m \\<in> snd (fst (snd (the b)))\"\n                  using f2n_def unfolding bij_betw_def by blast \n                have m_some : \"(SOME ma. ma < n \\<and> f2 ma = f2 m) = m\"\n                proof\n                  show \"m < n \\<and> f2 m = f2 m\" by (simp add: m_def)\n                  fix k\n                  assume k_def: \"k < n \\<and> f2 k = f2 m\" \n                  have inj: \"\\<And> x y. x < n \\<Longrightarrow> y < n \\<Longrightarrow> (f2 x = f2 y \\<Longrightarrow> x = y)\"\n                    using f2n_def unfolding bij_betw_def inj_on_def by auto\n                  show \"k = m\"\n                    apply (rule_tac inj)\n                    by (simp_all add: m_def k_def)\n                qed\n                show \"fst (the \\<psi>) (fst (the \\<phi>) x) = fst (Id' (fst (snd (the \\<phi>)))) x\"\n                  apply (subst m_def)\n                  apply (subst m_def)\n                  unfolding \\<phi>_def MkArr_def using m_def apply simp\n                  unfolding \\<psi>_def MkArr_def using f2mb apply simp\n                  apply (subst m_some)\n                  unfolding Id'_def by simp\n              qed\n            qed\n          qed\n          show \"partial_magma.ide (subcategory.comp pointed_set_comp FiniteArr')\n     (subcategory.comp pointed_set_comp FiniteArr' \\<phi> \\<psi>)\"\n            apply (subst subcategory.ide_char [OF finite_subcat])\n            apply (subst subcategory.arr_char [OF finite_subcat])\n            apply auto\n            using arr_\\<phi>\\<psi> subcategory.arr_char [OF finite_subcat] apply blast\n            apply (subst ide_char)\n            apply auto\n          proof-\n            have \"FiniteArr'\n   (subcategory.comp pointed_set_comp FiniteArr' \\<phi> \\<psi>)\"\n              using arr_\\<phi>\\<psi> subcategory.arr_char [OF finite_subcat] by blast\n            then show arr'_\\<phi>\\<psi>: \"Arr' (the\n   (subcategory.comp pointed_set_comp FiniteArr' \\<phi> \\<psi>))\"\n              unfolding FiniteArr'_def\n              using arr_char by blast\n            have comp_\\<phi>\\<psi>: \"(subcategory.comp pointed_set_comp FiniteArr' \\<phi> \\<psi>) =\n                    Some (the \\<phi> \\<cdot> the \\<psi>)\"\n              apply (subst subcategory.comp_char [OF finite_subcat])\n              apply (simp add: arr_\\<phi> arr_\\<psi> seq\\<phi>\\<psi>)\n              apply (subst comp_char)\n              using arr_\\<psi> subcategory.arr_char [OF finite_subcat] \n              unfolding FiniteArr'_def apply blast\n              using arr_\\<phi> subcategory.arr_char [OF finite_subcat] \n              unfolding FiniteArr'_def apply blast\n              using seq\\<phi>\\<psi> apply blast\n              by simp\n\n            show \"subcategory.comp pointed_set_comp FiniteArr' \\<phi> \\<psi> =\n    Some (Id' (fst (snd (the (subcategory.comp pointed_set_comp FiniteArr' \\<phi> \\<psi>)))))\"\n              apply (subst comp_\\<phi>\\<psi>)\n              apply (subst comp_\\<phi>\\<psi>)\n              apply simp\n              apply (rule_tac fun_eq_char)\n            proof-\n              show \"Arr' (the \\<phi> \\<cdot> the \\<psi>)\"\n                using arr'_\\<phi>\\<psi> comp_\\<phi>\\<psi> by simp\n              then show \"Arr' (Id' (fst (snd (the \\<phi> \\<cdot> the \\<psi>))))\"\n                using classical_category.Arr_Id [OF ccpf dom_obj] by blast\n              show \"fst (snd (the \\<phi> \\<cdot> the \\<psi>)) = fst (snd (Id' (fst (snd (the \\<phi> \\<cdot> the \\<psi>)))))\"\n                unfolding Id'_def by simp\n              have seq'\\<phi>\\<psi>: \"snd (snd (the \\<psi>)) = fst (snd (the \\<phi>))\"\n                 apply (subst seq_char [OF \\<open>B.arr \\<psi>\\<close> \\<open>B.arr \\<phi>\\<close>])\n                using seq\\<phi>\\<psi> apply blast\n                by simp\n              show \"snd (snd (the \\<phi> \\<cdot> the \\<psi>)) = snd (snd (Id' (fst (snd (the \\<phi> \\<cdot> the \\<psi>)))))\"\n                unfolding Id'_def apply simp\n                apply (subst dom_comp [OF arr'_\\<psi> arr'_\\<phi> seq'\\<phi>\\<psi>])\n                apply (subst cod_comp [OF arr'_\\<psi> arr'_\\<phi> seq'\\<phi>\\<psi>])\n                unfolding \\<phi>_def \\<psi>_def MkArr_def by simp\n              fix x\n              assume \"x \\<in> snd (fst (snd (the \\<phi> \\<cdot> the \\<psi>)))\"\n              then have x_in_\\<psi>: \"x \\<in> snd (fst (snd (the \\<psi>)))\"\n                using dom_comp [OF arr'_\\<psi> arr'_\\<phi> seq'\\<phi>\\<psi>] by simp\n              show \"fst (the \\<phi> \\<cdot> the \\<psi>) x = fst (Id' (fst (snd (the \\<phi> \\<cdot> the \\<psi>)))) x\"\n                unfolding Comp'_def using arr'_\\<psi> arr'_\\<phi> seq'\\<phi>\\<psi> x_in_\\<psi> apply simp\n              proof-\n                have x_in_b : \"x \\<in> snd (fst (snd (the b)))\"\n                  using x_in_\\<psi> unfolding \\<psi>_def MkArr_def by simp\n                then have \"x \\<in> f2 ` {i. i < n}\"\n                  using f2n_def unfolding bij_betw_def by simp\n                then obtain m where m_def : \"m < n \\<and> f2 m = x\" by auto\n                have m_some : \"(SOME m. m < n \\<and> f2 m = x) = m\"\n                proof\n                  show \"m < n \\<and> f2 m = x\" by (simp add: m_def)\n                  fix k\n                  assume k_def: \"k < n \\<and> f2 k = x\"\n                  have inj: \"\\<And> x y. x < n \\<Longrightarrow> y < n \\<Longrightarrow> (f2 x = f2 y \\<Longrightarrow> x = y)\"\n                    using f2n_def unfolding bij_betw_def inj_on_def by auto\n                  show \"k = m\"\n                    apply (rule_tac inj)\n                    by (simp_all add: k_def m_def)\n                qed\n                show \"fst (the \\<phi>) (fst (the \\<psi>) x) = fst (Id' (fst (snd (the \\<psi>)))) x\"\n                  unfolding \\<psi>_def MkArr_def using x_in_\\<psi> x_in_b apply simp\n                  apply (subst m_some)\n                  unfolding \\<phi>_def MkArr_def using m_def apply simp\n                  unfolding Id'_def by simp\n              qed\n            qed\n          qed\n        qed\n      qed\n    qed\n  qed\nqed\n\n\n\ntheorem inclusion_ff_and_essurj: \"fully_faithful_and_essentially_surjective_functor \n         pointed_finite_subcat\n         pointed_fin_set.comp\n         inclusionFunctor\"\n  unfolding fully_faithful_and_essentially_surjective_functor_def\n  apply auto\n  unfolding pointed_finite_subcat_def\n  using subcategory.is_category [OF finite_subcat] apply simp\n  using pointed_fin_set.is_category apply simp\n   apply (rule_tac factorization.fully_faithful)\n  using inclusion_factors_over_finite_sets apply simp\n  using fully_faithful apply simp\n  using inclusion_essentially_surjective\n  unfolding pointed_finite_subcat_def.\n\ntheorem inclusion_equivalence: \"equivalence_functor\n         pointed_fin_set.comp\n         pointed_finite_subcat\n         inclusionFunctor\"\n  apply (rule_tac fully_faithful_and_essentially_surjective_functor.is_equivalence_functor)\n  using inclusion_ff_and_essurj.\n\n\ndefinition inclusion_inverse where\n  \"inclusion_inverse \\<equiv> (SOME F. \\<exists> \\<eta> \\<epsilon>. equivalence_of_categories\n                         pointed_fin_set.comp pointed_finite_subcat F inclusionFunctor \\<eta> \\<epsilon>)\"\n\n\n\nlemma finset_equivalence: \"\\<exists>\\<eta> \\<epsilon>.  equivalence_of_categories\n       pointed_fin_set.comp pointed_finite_subcat inclusion_inverse inclusionFunctor \\<eta> \\<epsilon>\"\nproof-\n  have ex_F: \"\\<exists>F. (\\<exists> \\<eta> \\<epsilon>.  equivalence_of_categories\n       pointed_fin_set.comp pointed_finite_subcat F inclusionFunctor \\<eta> \\<epsilon>)\"\n    using equivalence_functor.induces_equivalence [OF inclusion_equivalence].\n  show \"(\\<exists> \\<eta> \\<epsilon>.  equivalence_of_categories\n       pointed_fin_set.comp pointed_finite_subcat inclusion_inverse\n       inclusionFunctor \\<eta> \\<epsilon>)\"\n    unfolding inclusion_inverse_def\n    using Hilbert_Choice.someI_ex [OF ex_F].\nqed\n    \n\n\n\n\n\nend\n\nend\n\n\n", "meta": {"author": "peterjbonart", "repo": "Isabelle", "sha": "5bd013befdcdaaaf8987d5cb523672e72c0e17b0", "save_path": "github-repos/isabelle/peterjbonart-Isabelle", "path": "github-repos/isabelle/peterjbonart-Isabelle/Isabelle-5bd013befdcdaaaf8987d5cb523672e72c0e17b0/FinsetEquivalence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.32718133657060117}}
{"text": "theory \"Arity-Nominal\"\nimports Arity \"../Launchbury/Nominal-HOLCF\"\nbegin\n\nlemma join_eqvt[eqvt]: \"\\<pi> \\<bullet> (x \\<squnion> (y :: 'a :: {Finite_Join_cpo, cont_pt})) = (\\<pi> \\<bullet> x) \\<squnion> (\\<pi> \\<bullet> y)\"\n  by (rule is_joinI[symmetric]) (auto simp add: perm_below_to_right)\n\n\ninstantiation Arity :: pure\nbegin\n  definition \"p \\<bullet> (a::Arity) = a\"\ninstance\n  apply standard\n  apply (auto simp add: permute_Arity_def)\n  done\nend\n\n\ninstance Arity :: cont_pt by standard (simp add: pure_permute_id)\ninstance Arity :: pure_cont_pt ..\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/Arity-Nominal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3271451523403124}}
{"text": "theory combine1\n  imports sch\nbegin\n\n\nlemma entails_tassn_disjI1:\n  \"P \\<Longrightarrow>\\<^sub>t Q \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>t (Q \\<or>\\<^sub>t R)\"\n  by (auto simp add: entails_tassn_def disj_assn_def)\n\nlemma entails_tassn_disjI2:\n  \"P \\<Longrightarrow>\\<^sub>t R \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>t (Q \\<or>\\<^sub>t R)\"\n  by (auto simp add: entails_tassn_def disj_assn_def)\n\nlemma entails_tassn_disjE:\n  \"P \\<Longrightarrow>\\<^sub>t R \\<Longrightarrow> Q \\<Longrightarrow>\\<^sub>t R \\<Longrightarrow> (P \\<or>\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t R\"\n  by (auto simp add: entails_tassn_def disj_assn_def)\n\nlemma entails_tassn_conj:\n  \"P \\<Longrightarrow>\\<^sub>t Q \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>t R \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>t Q \\<and>\\<^sub>t R\"\n  by (auto simp add: entails_tassn_def conj_assn_def)\n\nlemma waitin_assn_decomp:\n  \"waitin_assn d p ch v rdy = wait_assn d p rdy @\\<^sub>t in_0assn ch v\"\n  apply(auto simp add: join_assn_def)\n  apply(rule ext)\n  apply auto\n  subgoal for tr\n    apply(cases rule:waitin_assn.cases[of d p ch v rdy tr])\n      apply auto\n    subgoal\n     apply(rule exI[where x=\"[WaitBlk d p rdy]\"])\n      apply auto\n       apply rule apply auto\n      apply rule done\n    apply(auto simp add:emp_assn_def)\n    apply(rule) done\n  subgoal for tr1 tr2\n    apply(cases rule:in_0assn.cases[of ch v tr2])\n     apply auto\n    apply(cases rule:wait_assn.cases[of d p rdy tr1])\n      apply auto\n     apply rule apply auto\n    apply rule by auto\n  done\n\n\nlemma combine_assn_left_tran:\n\"P1 \\<Longrightarrow>\\<^sub>t Q1 \\<Longrightarrow>  combine_assn chs P1 R \\<Longrightarrow>\\<^sub>t combine_assn chs Q1 R\"\n  unfolding entails_tassn_def combine_assn_def\n  by auto\n\nlemma combine_assn_right_tran:\n\"P2 \\<Longrightarrow>\\<^sub>t Q2 \\<Longrightarrow>  combine_assn chs R P2 \\<Longrightarrow>\\<^sub>t combine_assn chs R Q2\"\n  unfolding entails_tassn_def combine_assn_def\n  by auto\n\nlemma combine_assn_both_tran:\n\"P1 \\<Longrightarrow>\\<^sub>t Q1 \\<Longrightarrow> P2 \\<Longrightarrow>\\<^sub>t Q2 \\<Longrightarrow> combine_assn chs P1 P2 \\<Longrightarrow>\\<^sub>t combine_assn chs Q1 Q2\"\n  unfolding entails_tassn_def combine_assn_def\n  by auto\n\nlemma combine_assn_left_disj:\n\"combine_assn chs (P1) Q \\<Longrightarrow>\\<^sub>t R \\<Longrightarrow> combine_assn chs (P2) Q \\<Longrightarrow>\\<^sub>t R \\<Longrightarrow>  combine_assn chs (P1 \\<or>\\<^sub>t P2) Q \\<Longrightarrow>\\<^sub>t R\"\n  unfolding entails_tassn_def combine_assn_def disj_assn_def\n  by blast\n\nlemma combine_assn_wait_emp':\n  \"combine_assn chs (Wait\\<^sub>t d p rdy @\\<^sub>t P) emp\\<^sub>t \\<Longrightarrow>\\<^sub>t combine_assn chs P emp\\<^sub>t \"\n  unfolding combine_assn_def entails_tassn_def\n  apply (auto)\n  apply (simp add: entails_tassn_def wait_assn.simps emp_assn_def join_assn_def)\n  by (auto elim!: sync_elims)\n\nlemma combine_assn_wait_emp'':\n  \"combine_assn chs (Wait\\<^sub>t d p rdy @\\<^sub>t P) emp\\<^sub>t \\<Longrightarrow>\\<^sub>t \\<up>(d\\<le>0) \\<and>\\<^sub>t combine_assn chs P emp\\<^sub>t \"\n  unfolding combine_assn_def entails_tassn_def\n  apply (auto)\n  apply (simp add: entails_tassn_def wait_assn.simps emp_assn_def join_assn_def)\n  by (auto elim!: sync_elims)\n\nlemma combine_assn_emp_wait':\n  \"combine_assn chs emp\\<^sub>t (Wait\\<^sub>t d p rdy @\\<^sub>t P) \\<Longrightarrow>\\<^sub>t combine_assn chs emp\\<^sub>t P\"\n  unfolding combine_assn_def entails_tassn_def\n  apply (auto )\n  apply (simp add: entails_tassn_def wait_assn.simps emp_assn_def join_assn_def)\n  by (auto elim!: sync_elims)\n\nlemma combine_assn_emp_wait'':\n  \"combine_assn chs emp\\<^sub>t (Wait\\<^sub>t d p rdy @\\<^sub>t P) \\<Longrightarrow>\\<^sub>t \\<up>(d\\<le>0) \\<and>\\<^sub>t combine_assn chs emp\\<^sub>t P\"\n  unfolding combine_assn_def entails_tassn_def\n  apply (auto )\n  apply (simp add: entails_tassn_def wait_assn.simps emp_assn_def join_assn_def)\n  by (auto elim!: sync_elims)\n\n\nlemma combine_or_right:\n\"combine_assn chs p q1 \\<Longrightarrow>\\<^sub>t R \\<Longrightarrow> combine_assn chs p q2 \\<Longrightarrow>\\<^sub>t R \\<Longrightarrow> combine_assn chs (p) (q1 \\<or>\\<^sub>t q2) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def disj_assn_def entails_tassn_def\n  apply auto\n  by blast\n\nlemma combine_or_left:\n\"combine_assn chs p1 q \\<Longrightarrow>\\<^sub>t R \\<Longrightarrow> combine_assn chs p2 q \\<Longrightarrow>\\<^sub>t R \\<Longrightarrow> combine_assn chs (p1 \\<or>\\<^sub>t p2) q \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def disj_assn_def entails_tassn_def\n  apply auto\n  by blast\n\n\nlemma combine_assn_ex_pre_left':\n  assumes \"\\<And>x. combine_assn chs (P x) Q \\<Longrightarrow>\\<^sub>t R\"\n  shows \"combine_assn chs (\\<exists>\\<^sub>t x. P x) Q \\<Longrightarrow>\\<^sub>t R\"\n  using assms by (auto simp add: ex_assn_def combine_assn_def entails_tassn_def)\n\nlemma combine_assn_ex_pre_right':\n  assumes \"\\<And>x. combine_assn chs P (Q x) \\<Longrightarrow>\\<^sub>t R\"\n  shows \"combine_assn chs P (\\<exists>\\<^sub>t x. Q x) \\<Longrightarrow>\\<^sub>t R\"\n  using assms by (auto simp add: ex_assn_def combine_assn_def entails_tassn_def)\n\nlemma combine_assn_pure_pre_left':\n  assumes \"b \\<Longrightarrow> combine_assn chs P Q \\<Longrightarrow>\\<^sub>t R\"\n  shows \"combine_assn chs (\\<up>b \\<and>\\<^sub>t P) (Q) \\<Longrightarrow>\\<^sub>t R\"\n  using assms by (auto simp add: pure_assn_def combine_assn_def entails_tassn_def conj_assn_def)\n\n\nlemma combine_assn_pure_pre_right':\n  assumes \"b \\<Longrightarrow> combine_assn chs P (Q) \\<Longrightarrow>\\<^sub>t R\"\n  shows \"combine_assn chs P (\\<up>b \\<and>\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t R\"\n  using assms by (auto simp add: pure_assn_def combine_assn_def entails_tassn_def conj_assn_def)\n\n\nlemma combine_assn_emp_waitin:\n  assumes \"ch \\<in> chs\"\n  shows \"combine_assn chs emp\\<^sub>t (Waitin\\<^sub>t d p ch v rdy @\\<^sub>t P) = false\\<^sub>A\"\n  unfolding combine_assn_def false_assn_def\n  apply (auto simp add: entails_tassn_def join_assn_def emp_assn_def false_assn_def waitin_assn.simps)\n  using assms \n  by(auto elim!: sync_elims)\n\nlemma combine_assn_waitin_emp:\n  assumes \"ch \\<in> chs\"\n  shows \"combine_assn chs (Waitin\\<^sub>t d p ch v rdy @\\<^sub>t P) emp\\<^sub>t = false\\<^sub>A\"\n  unfolding combine_assn_def false_assn_def\n  apply (auto simp add: entails_tassn_def join_assn_def emp_assn_def false_assn_def waitin_assn.simps)\n  using assms \n  by(auto elim!: sync_elims)\n\n\nlemma combine_assn_inrdy_emp:\n  assumes \"ch \\<in> chs\"\n  shows \"combine_assn chs (Inrdy\\<^sub>t s ch v rdy @\\<^sub>t P) emp\\<^sub>t = false\\<^sub>A\"\n  unfolding combine_assn_def false_assn_def\n  apply (auto simp add: entails_tassn_def join_assn_def emp_assn_def false_assn_def inrdy_assn.simps)\n  using assms by (auto elim!: sync_elims)\n\n\nlemma combine_assn_inrdy_emp':\n  assumes \"ch \\<notin> chs\"\n  shows \"combine_assn chs (Inrdy\\<^sub>t s ch v rdy @\\<^sub>t P) emp\\<^sub>t \\<Longrightarrow>\\<^sub>t In0\\<^sub>t ch v @\\<^sub>t (combine_assn chs P emp\\<^sub>t)\"\n  unfolding combine_assn_def\n  apply (auto simp add: entails_tassn_def join_assn_def emp_assn_def false_assn_def inrdy_assn.simps)\n  using assms apply (auto elim!: sync_elims)\n  apply(rule exI[where x=\"[InBlock ch v]\"])\n  apply auto\n  apply(rule )\n  done\n\n\nlemma combine_assn_emp_outrdy:\n  \"ch \\<in> chs \\<Longrightarrow> combine_assn chs emp\\<^sub>t (Outrdy\\<^sub>t s ch v rdy @\\<^sub>t P) = false\\<^sub>A\"\n  unfolding combine_assn_def\n  apply (rule ext)\n  apply (auto simp add: false_assn_def emp_assn_def join_assn_def elim!: outrdy_assn.cases)\n  by (auto elim: sync_elims)\n\n\nlemma combine_assn_emp_inrdy:\n  \"ch \\<in> chs \\<Longrightarrow> combine_assn chs emp\\<^sub>t (Inrdy\\<^sub>t s ch v rdy @\\<^sub>t P) = false\\<^sub>A\"\n  unfolding combine_assn_def\n  apply (rule ext)\n  apply (auto simp add: false_assn_def emp_assn_def join_assn_def elim!: inrdy_assn.cases)\n  by (auto elim: sync_elims)\n\nlemma combine_assn_out0_emp:\n  assumes \"ch \\<in> chs\"\n  shows \"combine_assn chs (Out0\\<^sub>t ch v @\\<^sub>t P) emp\\<^sub>t = false\\<^sub>A\"\n  unfolding combine_assn_def false_assn_def\n  apply (auto simp add: entails_tassn_def join_assn_def emp_assn_def false_assn_def out_0assn.simps)\n  using assms by (auto elim: sync_elims)\n\nlemma combine_assn_out0_emp':\n  assumes \"ch \\<notin> chs\"\n  shows \"combine_assn chs (Out0\\<^sub>t ch v @\\<^sub>t P) emp\\<^sub>t \\<Longrightarrow>\\<^sub>t Out0\\<^sub>t ch v @\\<^sub>t (combine_assn chs P emp\\<^sub>t)\"\n  unfolding combine_assn_def\n  apply (auto simp add: entails_tassn_def join_assn_def emp_assn_def false_assn_def out_0assn.simps)\n  using assms by (auto elim!: sync_elims)\n\n\nlemma combine_assn_waitp_emp:\n \"combine_assn chs (wait_passn rdy @\\<^sub>t P) emp\\<^sub>t = false\\<^sub>A\"\n  unfolding combine_assn_def false_assn_def\n  apply (auto simp add: entails_tassn_def join_assn_def emp_assn_def false_assn_def wait_passn.simps)\n  by (auto elim!: sync_elims)\n\n\nlemma combine_assn_inrdy_wait:\n  assumes \"ch \\<in> chs \\<and> compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (Inrdy\\<^sub>t s ch v rdy1 @\\<^sub>t P)(Wait\\<^sub>t d p rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t Wait\\<^sub>t d (\\<lambda> t. ParState (EState s) (p t)) (merge_rdy rdy1 rdy2) @\\<^sub>t (combine_assn chs (Inrdy\\<^sub>t s ch v rdy1 @\\<^sub>t P) Q)\"\n  unfolding combine_assn_def\n  apply (auto simp add: entails_tassn_def join_assn_def)\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule: inrdy_assn.cases[of s ch v rdy1 tr1a])\n      apply auto\n    subgoal\n      apply(cases rule: wait_assn.cases[of d p rdy2 tr1b])\n        apply auto\n      subgoal using assms\n        by (auto elim!: sync_elims)\n      subgoal using assms\n        apply (auto elim: sync_elims)\n        unfolding emp_assn_def\n        apply auto\n        apply(rule exI[where x=\"(InBlock ch v # tr2a)\"])\n        by auto\n      done\n    subgoal for dd\n      apply(cases rule: wait_assn.cases[of d p rdy2 tr1b])\n        apply auto\n      subgoal using assms\n        apply(cases \"d<dd\")\n        subgoal\n          apply (auto elim!: combine_blocks_waitE4)\n          apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (EState s) (p t)) (merge_rdy rdy1 rdy2)]\"])\n          apply auto\n          subgoal apply rule by auto\n          apply(rule exI[where x=\"WaitBlk (dd - d) (\\<lambda>t. EState s) rdy1 # InBlock ch v # tr2a\"])\n          apply auto\n          apply(rule exI[where x=\"WaitBlk (dd - d) (\\<lambda>t. EState s) rdy1 # [InBlock ch v]\"])\n          apply auto\n          apply(rule )\n          by auto\n        apply(cases \"d>dd\")\n        subgoal\n          apply (auto elim!: combine_blocks_waitE3)\n          by (auto elim:combine_blocks_pairE2)\n        apply(cases \"d=dd\")\n        subgoal\n          apply (auto elim!: combine_blocks_waitE2)\n          apply(rule exI[where x=\"[WaitBlk dd (\\<lambda>t. ParState (EState s) (p t)) (merge_rdy rdy1 rdy2)]\"])\n          apply auto\n          subgoal apply(rule) by auto\n          apply(rule exI[where x=\"(InBlock ch v # tr2a)\"])\n          apply auto\n          apply(rule exI[where x=\"[InBlock ch v]\"])\n          apply auto\n          apply(rule)\n          done\n        by auto\n      subgoal\n        apply(auto simp add:emp_assn_def)\n        apply(rule exI[where x=\"(WaitBlk dd (\\<lambda>_. EState s) rdy1 # InBlock ch v # tr2a)\"])\n        by auto\n      done\n    done\n  done\n\n\nlemma combine_assn_inrdy_wait':\n  assumes \"ch \\<notin> chs \\<and> compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (Inrdy\\<^sub>t s ch v rdy1 @\\<^sub>t P)(Wait\\<^sub>t d p rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t \n   (Wait\\<^sub>t d (\\<lambda> t. ParState (EState s) (p t)) (merge_rdy rdy1 rdy2) @\\<^sub>t (combine_assn chs (Inrdy\\<^sub>t s ch v rdy1 @\\<^sub>t P) Q))\n\\<or>\\<^sub>t (\\<exists>\\<^sub>ttt. \\<up>(0 \\<le> tt \\<and> tt < d) \\<and>\\<^sub>t Waitin\\<^sub>t tt (\\<lambda> t. ParState (EState s) (p t)) ch v (merge_rdy rdy1 rdy2) @\\<^sub>t combine_assn chs P (Wait\\<^sub>t (d-tt) (\\<lambda> t. p(t+tt)) rdy2 @\\<^sub>t Q))\"\n  unfolding combine_assn_def\n  apply (auto simp add: entails_tassn_def join_assn_def)\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule: inrdy_assn.cases[of s ch v rdy1 tr1a])\n      apply auto\n    subgoal\n      apply(cases rule:wait_assn.cases[of d p rdy2 tr1b])\n        apply auto\n      subgoal using assms\n        apply (auto elim!: combine_blocks_unpairE3)\n        unfolding disj_assn_def\n        apply(rule disjI2)\n        apply(auto simp add:ex_assn_def)\n        apply(rule exI[where x=0])\n        apply auto\n        apply(rule exI[where x=\"[InBlock ch v]\"])\n        apply auto\n        subgoal apply rule by auto\n        apply(rule exI[where x=tr2a])\n        apply auto\n        apply(rule exI[where x=\"(WaitBlk d p rdy2 # tr2b)\"])\n        by auto\n      subgoal unfolding disj_assn_def\n        apply(rule disjI1)\n        apply(auto simp add:emp_assn_def)\n        apply(rule exI[where x=\"(InBlock ch v # tr2a)\"])\n        by auto\n      done\n    subgoal for dd\n      apply(cases rule:wait_assn.cases[of d p rdy2 tr1b])\n        apply auto\n      subgoal\n        apply(cases \"d<dd\")\n        subgoal\n          using assms\n          apply (auto elim!: combine_blocks_waitE4)\n          unfolding disj_assn_def\n          apply(rule disjI1)\n          apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (EState s) (p t)) (merge_rdy rdy1 rdy2)]\"])\n          apply auto\n          subgoal\n            apply(rule) by auto \n          apply(rule exI[where x=\"(WaitBlk (dd - d) (\\<lambda>t. EState s) rdy1 # InBlock ch v # tr2a)\"])\n          apply auto\n          apply(rule exI[where x=\"WaitBlk (dd - d) (\\<lambda>t. EState s) rdy1 # [InBlock ch v]\"])\n          apply auto\n          apply(rule ) by auto\n        apply(cases \"d>dd\")\n        subgoal\n          using assms\n          apply (auto elim!: combine_blocks_waitE3 combine_blocks_unpairE3)\n          unfolding disj_assn_def\n          apply(rule disjI2)\n          unfolding ex_assn_def\n          apply(rule exI[where x=dd])\n          apply auto\n          apply(rule exI[where x=\"WaitBlk dd (\\<lambda>t. ParState (EState s) (p t)) (merge_rdy rdy1 rdy2) # [InBlock ch v]\"])\n          apply auto\n          subgoal apply rule by auto\n          apply(rule exI[where x= tr2a])\n          apply auto\n          apply(rule exI[where x=\"(WaitBlk (d - dd) (\\<lambda>t. p (t + dd)) rdy2 # tr2b)\"])\n          apply auto\n          apply(rule exI[where x=\"[WaitBlk (d - dd) (\\<lambda>t. p (t + dd)) rdy2]\"])\n          apply auto\n          apply rule by auto\n        apply(cases \"d=dd\")\n        subgoal\n          using assms\n          apply (auto elim!: combine_blocks_waitE2)\n          unfolding disj_assn_def\n          apply(rule disjI1)\n          apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (EState s) (p t)) (merge_rdy rdy1 rdy2)]\"])\n          apply auto\n          subgoal\n            apply(rule) by auto \n          apply(rule exI[where x=\"(InBlock ch v # tr2a)\"])\n          apply auto\n          apply(rule exI[where x=\"[InBlock ch v]\"])\n          apply auto\n          apply(rule ) \n          done\n        by auto\n      subgoal unfolding disj_assn_def\n        apply(rule disjI1)\n        apply (auto simp add:emp_assn_def)\n        apply(rule exI[where x=\"(WaitBlk dd (\\<lambda>_. EState s) rdy1 # InBlock ch v # tr2a)\"])\n        by auto\n      done\n    done\n  done\n\n\nlemma combine_assn_out0_wait:\n  assumes \"ch\\<in>chs \\<and> d>0\"\n  shows \"combine_assn chs (out_0assn ch v @\\<^sub>t P) (wait_assn d p rdy @\\<^sub>t Q) \n          \\<Longrightarrow>\\<^sub>t R\"\n  unfolding Valid_def combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch v tr1a])\n     apply auto\n    apply(cases rule:wait_assn.cases[of d p rdy tr1b])\n      apply auto\n    apply(elim combine_blocks_pairE2)\n    apply auto\n    done\n  done\nlemma combine_assn_out0_wait'':\n  \"ch \\<in> chs \\<Longrightarrow> combine_assn chs (out_0assn ch v @\\<^sub>t P) (wait_assn d p rdy @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n   \\<up>(d\\<le>0) \\<and>\\<^sub>t combine_assn chs (out_0assn ch v @\\<^sub>t P) Q\"\nunfolding Valid_def combine_assn_def entails_tassn_def join_assn_def\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch v tr1a])\n     apply auto\n    apply(cases rule:wait_assn.cases[of d p rdy tr1b])\n      apply auto\n    apply(elim combine_blocks_pairE2)\n     apply auto\n    apply(rule exI[where x=\"(OutBlock ch v # tr2a)\"])\n    by auto\n  done\n\nlemma combine_assn_out0_wait':\n  assumes \"ch\\<notin>chs \\<and> d>0\"\n  shows \"combine_assn chs (out_0assn ch v @\\<^sub>t P) (wait_assn d p rdy @\\<^sub>t Q) \n          \\<Longrightarrow>\\<^sub>t out_0assn ch v @\\<^sub>t (combine_assn chs P (wait_assn d p rdy @\\<^sub>t Q))\"\n  unfolding Valid_def combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch v tr1a])\n     apply auto\n    apply(cases rule:wait_assn.cases[of d p rdy tr1b])\n      apply auto\n    apply(elim combine_blocks_unpairE3)\n    apply auto\n    apply(rule exI[where x=\"[OutBlock ch v]\"])\n    apply auto\n    apply(rule exI[where x=\"tr2a\"])\n    apply auto\n    apply(rule exI[where x=\"(WaitBlk d p rdy # tr2b)\"])\n    apply auto\n    done\n  done\n\n\nlemma combine_assn_waitp_wait:\n  assumes \"compat_rdy rdy1 rdy2 \\<and> d > 0\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P) (wait_assn d p2 rdy2 @\\<^sub>t Q)\n      \\<Longrightarrow>\\<^sub>t wait_passn (merge_rdy rdy1 rdy2) @\\<^sub>t true\\<^sub>A\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n     apply auto\n    apply(cases rule:wait_assn.cases[of d p2 rdy2 tr1b])\n      apply auto\n    subgoal for dd p1\n      apply(cases \"dd < d\")\n      subgoal \n        apply(elim combine_blocks_waitE3)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk dd (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      apply(cases \"dd>d\")\n      subgoal\n       apply(elim combine_blocks_waitE4)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      apply(cases \"dd= d\")\n      subgoal\n        apply simp\n       apply(elim combine_blocks_waitE2)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      by auto\n    done\n  done\n\nlemma combine_assn_waitp_wait':\n  assumes \"\\<not>compat_rdy rdy1 rdy2 \\<and> d > 0\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P) (wait_assn d p2 rdy2 @\\<^sub>t Q)\n      \\<Longrightarrow>\\<^sub>t R \"\n  unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n     apply auto\n    apply(cases rule:wait_assn.cases[of d p2 rdy2 tr1b])\n      apply auto\n    subgoal for dd p1\n      apply(elim combine_blocks_waitE1)\n           apply auto\n      done\n    done\n  done\n\nlemma combine_assn_waitp_wait'':\n  assumes \"\\<not>compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P) (wait_assn d p2 rdy2 @\\<^sub>t Q)\n      \\<Longrightarrow>\\<^sub>t \\<up>(d \\<le> 0) \\<and>\\<^sub>t combine_assn chs (wait_passn rdy1 @\\<^sub>t P) Q \"\n  apply(cases \"d\\<le>0\")\n   apply auto\n  apply(rule combine_assn_waitp_wait')\n  using assms by auto\n  \n\nlemma combine_assn_out0_waitin:\n  assumes \"ch\\<in>chs\"\n  shows \"combine_assn chs (out_0assn ch v2 @\\<^sub>t P) (waitin_assn d p ch v1 rdy @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n            \\<up>(v1 = v2 \\<and> d \\<le> 0) \\<and>\\<^sub>t  combine_assn chs P Q\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch v2 tr1a])\n     apply auto\n    apply(cases rule:waitin_assn.cases[of d p ch v1 rdy tr1b])\n      apply auto\n    subgoal\n      by(auto elim!:combine_blocks_pairE2)\n    subgoal\n      apply(auto elim!:combine_blocks_pairE)\n      by blast\n    done\n  done\n\nlemma combine_assn_out0_waitin':\n  assumes \"ch1\\<in>chs \\<and> ch2\\<notin>chs\"\n  shows \"combine_assn chs (out_0assn ch2 v2 @\\<^sub>t P) (waitin_assn d p ch1 v1 rdy @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n            out_0assn ch2 v2 @\\<^sub>t combine_assn chs P (waitin_assn d p ch1 v1 rdy @\\<^sub>t Q)\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch2 v2 tr1a])\n     apply auto\n    apply(cases rule:waitin_assn.cases[of d p ch1 v1 rdy tr1b])\n      apply auto\n    subgoal\n      apply(auto elim!:combine_blocks_unpairE3)\n      apply(rule exI[where x=\"[OutBlock ch2 v2]\"])\n      apply auto\n      apply(rule exI[where x=tr2a])\n      apply auto\n      apply(rule exI[where x=\"(WaitBlk d p rdy # InBlock ch1 v1 # tr2b)\"])\n      by auto\n    subgoal\n      apply(auto elim!:combine_blocks_unpairE1)\n      apply(rule exI[where x=\"[OutBlock ch2 v2]\"])\n      apply auto\n      apply(rule exI[where x=tr2a])\n      apply auto\n      apply(rule exI[where x=\"(InBlock ch1 v1 # tr2b)\"])\n      by auto\n    done\n  done\n\n\nlemma combine_assn_waitp_waitin:\n  assumes \"ch\\<in>chs \\<and> compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P) (waitin_assn d p2 ch v rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n           wait_passn  (merge_rdy rdy1 rdy2) @\\<^sub>t true\\<^sub>A\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n     apply auto\n    apply(cases rule:waitin_assn.cases[of d p2 ch v rdy2 tr1b])\n      apply auto\n    subgoal for dd p1\n      apply(cases \"dd < d\")\n      subgoal \n        apply(elim combine_blocks_waitE3)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk dd (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      apply(cases \"dd>d\")\n      subgoal\n       apply(elim combine_blocks_waitE4)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      apply(cases \"dd= d\")\n      subgoal\n        apply simp\n       apply(elim combine_blocks_waitE2)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      by auto\n    subgoal for dd\n      apply(auto elim: combine_blocks_pairE2')\n      done\n    done\n  done\n\nlemma combine_assn_waitp_waitin':\n  assumes \"ch\\<in>chs \\<and> \\<not> compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P) (waitin_assn d p2 ch v rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n           R\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n     apply auto\n    apply(cases rule:waitin_assn.cases[of d p2 ch v rdy2 tr1b])\n      apply auto\n    subgoal for dd p1\n      by(auto elim!: combine_blocks_waitE1)\n    subgoal for dd\n      apply(auto elim: combine_blocks_pairE2')\n      done\n    done\n  done\n\nlemma combine_assn_inrdy_out:\n  assumes \"ch\\<in>chs \\<and> ch \\<in> snd rdy\"\n  shows \"combine_assn chs (inrdy_assn s ch v rdy @\\<^sub>t P) (out_assn s' ch v' @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n           \\<up>(v=v') \\<and>\\<^sub>t combine_assn chs P Q\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:inrdy_assn.cases[of s ch v rdy tr1a])\n      apply auto\n    subgoal\n      apply(cases rule:out_assn.cases[of s' ch v' tr1b])\n        apply auto\n      subgoal\n        apply (auto elim!: combine_blocks_pairE)\n        by blast\n      subgoal for d\n        by(auto elim:combine_blocks_pairE2)\n      done\n    subgoal for d'\n      apply(cases rule:out_assn.cases[of s' ch v' tr1b])\n      apply auto\n      subgoal\n        by(auto elim:combine_blocks_pairE2')\n      subgoal for d\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        by auto\n      done\n    done\n  done\n\n\nlemma combine_assn_inrdy_out':\n  assumes \"ch\\<in>chs \\<and> ch \\<in> snd rdy \\<and> ch'\\<notin> chs\"\n  shows \"combine_assn chs (inrdy_assn s ch' v rdy @\\<^sub>t P) (out_assn s' ch v' @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n           in_0assn ch' v @\\<^sub>t combine_assn chs P (out_assn s' ch v' @\\<^sub>t Q)\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:inrdy_assn.cases[of s ch' v rdy tr1a])\n      apply auto\n    subgoal\n      apply(cases rule:out_assn.cases[of s' ch v' tr1b])\n        apply auto\n      subgoal\n        apply(auto elim!:combine_blocks_unpairE1)\n        apply(rule exI[where x=\"[InBlock ch' v]\"])\n        apply auto\n        subgoal apply rule done\n        apply(rule exI[where x=tr2a])\n        apply auto\n        apply(rule exI[where x=\"(OutBlock ch v' # tr2b)\"])\n        apply auto\n        done\n      subgoal for d\n        apply(auto elim!:combine_blocks_unpairE3)\n        apply(rule exI[where x=\"[InBlock ch' v]\"])\n        apply auto\n        subgoal apply rule done\n        apply(rule exI[where x=tr2a])\n        apply auto\n        apply(rule exI[where x=\"(WaitBlk d (\\<lambda>_. s') ({ch}, {}) # OutBlock ch v' # tr2b)\"])\n        by auto\n      done\n    subgoal for dd\n      apply(cases rule:out_assn.cases[of s' ch v' tr1b])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal for d\n        apply (auto elim!: combine_blocks_waitE1)\n        apply(cases rdy)\n        by auto\n      done\n    done\n  done\n\nlemma combine_assn_inrdy_out'':\n  assumes \"ch1\\<in>chs \\<and> ch2\\<in>chs \\<and> ch1\\<noteq>ch2\"\n  shows \"combine_assn chs (inrdy_assn s ch1 v rdy @\\<^sub>t P) (out_assn s' ch2 v' @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n           R\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:inrdy_assn.cases[of s ch1 v rdy tr1a])\n      apply auto\n    subgoal\n      apply(cases rule:out_assn.cases[of s' ch2 v' tr1b])\n        apply auto\n        subgoal\n          by (auto elim!: combine_blocks_pairE)\n        subgoal\n          by (auto elim!: sync_elims)\n        done\n      subgoal for d1\n        apply(cases rule:out_assn.cases[of s' ch2 v' tr1b])\n        apply auto\n        subgoal\n          by (auto elim!: sync_elims)\n        subgoal for d2\n          apply(cases \"\\<not> compat_rdy rdy ({ch2}, {})\")\n          subgoal by (auto elim!: sync_elims)\n          apply(cases \"d1<d2\")\n          subgoal\n            apply(elim combine_blocks_waitE3)\n            by (auto elim!: sync_elims)\n          apply(cases \"d1>d2\")\n          subgoal\n            apply(elim combine_blocks_waitE4)\n            by (auto elim!: sync_elims)\n          apply auto\n          apply(elim combine_blocks_waitE2)\n          by (auto elim!: combine_blocks_pairE)\n        done\n      done\n    done\n\n\nlemma combine_assn_inrdy_outrdy':\n  assumes \"ch\\<in>chs \\<and> \\<not>compat_rdy rdy1 rdy2 \\<and> ch'\\<notin> chs\"\n  shows \"combine_assn chs (inrdy_assn s ch' v rdy1 @\\<^sub>t P) (outrdy_assn s' ch v' rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n           in_0assn ch' v @\\<^sub>t combine_assn chs P (outrdy_assn s' ch v' rdy2 @\\<^sub>t Q)\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:inrdy_assn.cases[of s ch' v rdy1 tr1a])\n      apply auto\n    subgoal\n      apply(cases rule:outrdy_assn.cases[of s' ch v' rdy2 tr1b])\n        apply auto\n      subgoal\n        apply(auto elim!:combine_blocks_unpairE1)\n        apply(rule exI[where x=\"[InBlock ch' v]\"])\n        apply auto\n        subgoal apply rule done\n        apply(rule exI[where x=tr2a])\n        apply auto\n        apply(rule exI[where x=\"(OutBlock ch v' # tr2b)\"])\n        apply auto\n        done\n      subgoal for d\n        apply(auto elim!:combine_blocks_unpairE3)\n        apply(rule exI[where x=\"[InBlock ch' v]\"])\n        apply auto\n        subgoal apply rule done\n        apply(rule exI[where x=tr2a])\n        apply auto\n        apply(rule exI[where x=\"(WaitBlk d (\\<lambda>_. EState s') rdy2 # OutBlock ch v' # tr2b)\"])\n        by auto\n      done\n    subgoal for dd\n      apply(cases rule:outrdy_assn.cases[of s' ch v' rdy2 tr1b])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal for d\n        apply (auto elim!: combine_blocks_waitE1)\n        done\n      done\n    done\n  done\n\nlemma combine_assn_inrdy_outrdy'':\n  assumes \"ch1\\<in>chs \\<and> ch2\\<in>chs \\<and> ch1\\<noteq>ch2\"\n  shows \"combine_assn chs (inrdy_assn s ch1 v rdy1 @\\<^sub>t P) (outrdy_assn s' ch2 v' rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n           R\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:inrdy_assn.cases[of s ch1 v rdy1 tr1a])\n      apply auto\n    subgoal\n      apply(cases rule:outrdy_assn.cases[of s' ch2 v' rdy2 tr1b])\n        apply auto\n        subgoal\n          by (auto elim!: combine_blocks_pairE)\n        subgoal\n          by (auto elim!: sync_elims)\n        done\n      subgoal for d1\n        apply(cases rule:outrdy_assn.cases[of s' ch2 v' rdy2 tr1b])\n        apply auto\n        subgoal\n          by (auto elim!: sync_elims)\n        subgoal for d2\n          apply(cases \"\\<not> compat_rdy rdy1 rdy2\")\n          subgoal by (auto elim!: sync_elims)\n          apply(cases \"d1<d2\")\n          subgoal\n            apply(elim combine_blocks_waitE3)\n            by (auto elim!: sync_elims)\n          apply(cases \"d1>d2\")\n          subgoal\n            apply(elim combine_blocks_waitE4)\n            by (auto elim!: sync_elims)\n          apply auto\n          apply(elim combine_blocks_waitE2)\n          by (auto elim!: combine_blocks_pairE)\n        done\n      done\n    done\n\n\nlemma combine_assn_out0_outrdy1:\n  assumes \"ch2\\<in>chs \\<and> ch1\\<in>chs\"\n  shows \"combine_assn chs (out_0assn ch2 v2 @\\<^sub>t P)(outrdy_assn s ch1 v1 rdy @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         R\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch2 v2 tr1a])\n     apply auto\n    apply(cases rule:outrdy_assn.cases[of s ch1 v1 rdy tr1b])\n      apply auto\n    subgoal\n      by(auto elim!: combine_blocks_pairE)\n    subgoal for d\n      by(auto elim!: combine_blocks_pairE2)\n    done\n  done\n\nlemma combine_assn_out0_outrdy2:\n  assumes \"ch2\\<notin>chs \\<and> ch1\\<in>chs\"\n  shows \"combine_assn chs (out_0assn ch2 v2 @\\<^sub>t P)(outrdy_assn s ch1 v1 rdy @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         out_0assn ch2 v2 @\\<^sub>t combine_assn chs P (outrdy_assn s ch1 v1 rdy @\\<^sub>t Q)\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch2 v2 tr1a])\n     apply auto\n    apply(cases rule:outrdy_assn.cases[of s ch1 v1 rdy tr1b])\n      apply auto\n    subgoal\n      apply(auto elim!: combine_blocks_unpairE1)\n      apply(rule exI[where x=\"[OutBlock ch2 v2]\"])\n      apply auto\n      apply(rule exI[where x= tr2a])\n      apply auto\n      apply(rule exI[where x= \"(OutBlock ch1 v1 # tr2b)\"])\n      apply auto\n      done\n    subgoal for d\n      apply(auto elim!: combine_blocks_unpairE3)\n      apply(rule exI[where x=\"[OutBlock ch2 v2]\"])\n      apply auto\n      apply(rule exI[where x= tr2a])\n      apply auto\n      apply(rule exI[where x= \"(WaitBlk d (\\<lambda>_. EState s) rdy # OutBlock ch1 v1 # tr2b)\"])\n      apply auto\n      done\n    done\n  done\n\nlemma combine_assn_out0_out1:\n  assumes \"ch2\\<in>chs \\<and> ch1\\<in>chs\"\n  shows \"combine_assn chs (out_0assn ch2 v2 @\\<^sub>t P)(out_assn s ch1 v1 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         R\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch2 v2 tr1a])\n     apply auto\n    apply(cases rule:out_assn.cases[of s ch1 v1 tr1b])\n      apply auto\n    subgoal\n      by(auto elim!: combine_blocks_pairE)\n    subgoal for d\n      by(auto elim!: combine_blocks_pairE2)\n    done\n  done\n\nlemma combine_assn_out0_out2:\n  assumes \"ch2\\<notin>chs \\<and> ch1\\<in>chs\"\n  shows \"combine_assn chs (out_0assn ch2 v2 @\\<^sub>t P)(out_assn s ch1 v1 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         out_0assn ch2 v2 @\\<^sub>t combine_assn chs P (out_assn s ch1 v1 @\\<^sub>t Q)\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch2 v2 tr1a])\n     apply auto\n    apply(cases rule:out_assn.cases[of s ch1 v1 tr1b])\n      apply auto\n    subgoal\n      apply(auto elim!: combine_blocks_unpairE1)\n      apply(rule exI[where x=\"[OutBlock ch2 v2]\"])\n      apply auto\n      apply(rule exI[where x= tr2a])\n      apply auto\n      apply(rule exI[where x= \"(OutBlock ch1 v1 # tr2b)\"])\n      apply auto\n      done\n    subgoal for d\n      apply(auto elim!: combine_blocks_unpairE3)\n      apply(rule exI[where x=\"[OutBlock ch2 v2]\"])\n      apply auto\n      apply(rule exI[where x= tr2a])\n      apply auto\n      apply(rule exI[where x= \"(WaitBlk d (\\<lambda>_. s) ({ch1}, {}) # OutBlock ch1 v1 # tr2b)\"])\n      apply auto\n      done\n    done\n  done\n\n\nlemma combine_assn_out0_inrdy1:\n  assumes \"ch2\\<in>chs \\<and> ch1\\<in>chs\"\n  shows \"combine_assn chs (out_0assn ch2 v2 @\\<^sub>t P)(inrdy_assn s ch1 v1 rdy @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         \\<up>(ch1 = ch2 \\<and> v1 = v2) \\<and>\\<^sub>t combine_assn chs P Q\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch2 v2 tr1a])\n     apply auto\n    apply(cases rule:inrdy_assn.cases[of s ch1 v1 rdy tr1b])\n      apply auto\n    subgoal\n      apply(auto elim!: combine_blocks_pairE)\n      by blast\n    subgoal for d\n      by(auto elim!: combine_blocks_pairE2)\n    done\n  done\n\n\nlemma combine_assn_out0_inrdy2:\n  assumes \"ch2\\<notin>chs \\<and> ch1\\<in>chs\"\n  shows \"combine_assn chs (out_0assn ch2 v2 @\\<^sub>t P)(inrdy_assn s ch1 v1 rdy @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         out_0assn ch2 v2 @\\<^sub>t combine_assn chs P (inrdy_assn s ch1 v1 rdy @\\<^sub>t Q)\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:out_0assn.cases[of ch2 v2 tr1a])\n     apply auto\n    apply(cases rule:inrdy_assn.cases[of s ch1 v1 rdy tr1b])\n      apply auto\n    subgoal\n      apply(auto elim!: combine_blocks_unpairE1)\n      apply(rule exI[where x=\"[OutBlock ch2 v2]\"])\n      apply auto\n      apply(rule exI[where x= tr2a])\n      apply auto\n      apply(rule exI[where x= \"(InBlock ch1 v1 # tr2b)\"])\n      apply auto\n      done\n    subgoal for d\n      apply(auto elim!: combine_blocks_unpairE3)\n      apply(rule exI[where x=\"[OutBlock ch2 v2]\"])\n      apply auto\n      apply(rule exI[where x= tr2a])\n      apply auto\n      apply(rule exI[where x= \"(WaitBlk d (\\<lambda>_. EState s) rdy # InBlock ch1 v1 # tr2b)\"])\n      apply auto\n      done\n    done\n  done\n\n\nlemma combine_assn_waitp_outrdy:\n  assumes \"ch1\\<in>chs \\<and> compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P)(outrdy_assn s ch1 v1 rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         wait_passn (merge_rdy rdy1 rdy2) @\\<^sub>t true\\<^sub>A\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n     apply auto\n    subgoal for dd p\n      apply(cases rule:outrdy_assn.cases[of s ch1 v1 rdy2 tr1b])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal for d\n        apply(cases \"dd < d\")\n      subgoal \n        apply(elim combine_blocks_waitE3)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk dd (\\<lambda>t. ParState (p t) (EState s)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      apply(cases \"dd>d\")\n      subgoal\n       apply(elim combine_blocks_waitE4)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (p t) (EState s)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      apply(cases \"dd= d\")\n      subgoal\n        apply simp\n       apply(elim combine_blocks_waitE2)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (p t) (EState s)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      by auto\n    done\n  done\n  done\n\n\nlemma combine_assn_waitp_outrdy':\n  assumes \"ch1\\<in>chs \\<and> \\<not> compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P)(outrdy_assn s ch1 v1 rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         R\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n     apply auto\n    subgoal for dd p\n      apply(cases rule:outrdy_assn.cases[of s ch1 v1 rdy2 tr1b])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal for d\n        apply(elim combine_blocks_waitE1)\n           by auto\n         done\n       done\n     done\n\nlemma combine_assn_waitp_out:\n  assumes \"ch1\\<in>chs \\<and> ch1 \\<notin> snd rdy1\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P)(out_assn s ch1 v1 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         wait_passn (merge_rdy rdy1 ({ch1}, {})) @\\<^sub>t true\\<^sub>A\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n     apply auto\n    subgoal for dd p\n      apply(cases rule:out_assn.cases[of s ch1 v1 tr1b])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal for d\n        apply(cases \"dd < d\")\n      subgoal \n        apply(elim combine_blocks_waitE3)\n           apply auto\n        subgoal apply(cases rdy1)\n          by auto\n        apply(rule exI[where x=\"[WaitBlk dd (\\<lambda>t. ParState (p t) s) (merge_rdy rdy1 ({ch1}, {}))]\"])\n        apply auto\n        apply(rule) by auto\n      apply(cases \"dd>d\")\n      subgoal\n       apply(elim combine_blocks_waitE4)\n           apply auto\n        subgoal apply(cases rdy1)\n          by auto\n        apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (p t) s) (merge_rdy rdy1 ({ch1}, {}))]\"])\n        apply auto\n        apply(rule) by auto\n      apply(cases \"dd= d\")\n      subgoal\n        apply simp\n       apply(elim combine_blocks_waitE2)\n         apply auto\n        subgoal apply(cases rdy1)\n          by auto\n        apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (p t) s) (merge_rdy rdy1 ({ch1}, {}))]\"])\n        apply auto\n        apply(rule) by auto\n      by auto\n    done\n  done\n  done\n\n\nlemma combine_assn_waitp_out':\n  assumes \"ch1\\<in>chs \\<and> ch1 \\<in> snd rdy1\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P)(out_assn s ch1 v1 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         R\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n     apply auto\n    subgoal for dd p\n      apply(cases rule:out_assn.cases[of s ch1 v1 tr1b])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal for d\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy1)\n           by auto\n         done\n       done\n  done\n\n\nlemma combine_assn_waitp_inrdy:\n  assumes \"ch1\\<in>chs \\<and> compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P)(inrdy_assn s ch1 v1 rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         wait_passn (merge_rdy rdy1 rdy2) @\\<^sub>t true\\<^sub>A\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n     apply auto\n    subgoal for dd p\n      apply(cases rule:inrdy_assn.cases[of s ch1 v1 rdy2 tr1b])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal for d\n        apply(cases \"dd < d\")\n      subgoal \n        apply(elim combine_blocks_waitE3)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk dd (\\<lambda>t. ParState (p t) (EState s)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      apply(cases \"dd>d\")\n      subgoal\n       apply(elim combine_blocks_waitE4)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (p t) (EState s)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      apply(cases \"dd= d\")\n      subgoal\n        apply simp\n       apply(elim combine_blocks_waitE2)\n           apply auto\n        apply(rule exI[where x=\"[WaitBlk d (\\<lambda>t. ParState (p t) (EState s)) (merge_rdy rdy1 rdy2)]\"])\n        apply auto\n        apply(rule) by auto\n      by auto\n    done\n  done\n  done\n\nlemma combine_assn_waitp_inrdy':\n  assumes \"ch1\\<in>chs \\<and> \\<not>compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (wait_passn rdy1 @\\<^sub>t P)(inrdy_assn s ch1 v1 rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t\n         R\"\n  unfolding combine_assn_def entails_tassn_def join_assn_def true_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:wait_passn.cases[of rdy1 tr1a])\n     apply auto\n    subgoal for dd p\n      apply(cases rule:inrdy_assn.cases[of s ch1 v1 rdy2 tr1b])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal for d\n        apply(elim combine_blocks_waitE1)\n           by auto\n    done\n  done\n  done\n\n\nlemma combine_assn_inrdy_waitin:\n  assumes \"ch1\\<in>chs \\<and> ch2\\<in>chs\"\n  shows \"combine_assn chs (Inrdy\\<^sub>t s ch1 v1 rdy1 @\\<^sub>t P) (Waitin\\<^sub>t d p ch2 v2 rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding entails_tassn_def combine_assn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:inrdy_assn.cases[of s ch1 v1 rdy1])\n      apply auto\n    subgoal\n      apply(cases rule:waitin_assn.cases[of d p ch2 v2 rdy2 tr1b])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      done\n    subgoal for dd\n      apply(cases rule:waitin_assn.cases[of d p ch2 v2 rdy2 tr1b])\n        apply auto\n      subgoal\n        apply(cases \"\\<not> compat_rdy rdy1 rdy2\")\n        subgoal by (auto elim!: sync_elims)\n        apply(cases \"dd<d\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply(cases \"dd>d\")\n        subgoal\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply auto\n        apply(elim combine_blocks_waitE2)\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\n\nlemma combine_assn_inrdy_waitin':\n  assumes \"ch1\\<notin>chs \\<and> ch2\\<in>chs \\<and> compat_rdy rdy1 rdy2 \\<and> d\\<ge>0\"\n  shows \"combine_assn chs (Inrdy\\<^sub>t s ch1 v1 rdy1 @\\<^sub>t P) (Waitin\\<^sub>t d p ch2 v2 rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t \n          (\\<exists>\\<^sub>ttt. \\<up>(0 \\<le> tt \\<and> tt \\<le> d) \\<and>\\<^sub>t Waitin\\<^sub>t tt (\\<lambda> t. ParState (EState s) (p t)) ch1 v1 (merge_rdy rdy1 rdy2) @\\<^sub>t combine_assn chs P (Waitin\\<^sub>t (d-tt) (\\<lambda> t. p(t+tt)) ch2 v2 rdy2 @\\<^sub>t Q))\"\n  unfolding entails_tassn_def combine_assn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:inrdy_assn.cases[of s ch1 v1 rdy1])\n      apply auto\n    subgoal\n      apply(cases rule:waitin_assn.cases[of d p ch2 v2 rdy2 tr1b])\n        apply auto\n      subgoal\n        apply (elim combine_blocks_unpairE3)\n         apply (auto simp add: ex_assn_def pure_assn_def conj_assn_def)\n        apply(rule exI[where x= 0])\n        apply auto\n        apply(rule exI[where x=\"[InBlock ch1 v1]\"])\n        apply auto\n        subgoal apply rule by auto\n        apply(rule exI[where x=tr2a])\n        apply auto\n        apply(rule exI[where x=\"(WaitBlk d p rdy2 # InBlock ch2 v2 # tr2b)\"])\n        by auto\n      subgoal\n        apply(elim combine_blocks_unpairE1)\n          apply (auto simp add: ex_assn_def pure_assn_def conj_assn_def)\n        apply(rule exI[where x= 0])\n        apply auto\n        apply(rule exI[where x=\"[InBlock ch1 v1]\"])\n        apply auto\n        subgoal apply rule by auto\n        apply(rule exI[where x=tr2a])\n        apply auto\n        apply(rule exI[where x=\"(InBlock ch2 v2 # tr2b)\"])\n        by auto\n      done\n    subgoal for dd\n      apply(cases rule:waitin_assn.cases[of d p ch2 v2 rdy2 tr1b])\n        apply auto\n      subgoal\n        apply(cases \"dd<d\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          apply(elim combine_blocks_unpairE3)\n           apply (auto simp add: ex_assn_def pure_assn_def conj_assn_def)\n          apply(rule exI[where x=dd])\n          apply auto\n          apply(rule exI[where x=\"WaitBlk dd (\\<lambda>t. ParState (EState s) (p t)) (merge_rdy rdy1 rdy2) #[InBlock ch1 v1]\"])\n          apply auto\n          subgoal apply rule by auto\n          apply(rule exI[where x= tr2a])\n          apply auto\n          apply(rule exI[where x=\"(WaitBlk (d - dd) (\\<lambda>t. p (t + dd)) rdy2 # InBlock ch2 v2 # tr2b)\"])\n          apply auto\n          apply(rule exI[where x = \"WaitBlk (d - dd) (\\<lambda>t. p (t + dd)) rdy2 # [InBlock ch2 v2]\"])\n          apply auto\n          apply rule by auto\n        apply(cases \"dd>d\")\n        subgoal\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply auto\n        apply(elim combine_blocks_waitE2)\n        apply auto\n        apply(elim combine_blocks_unpairE1)\n          apply (auto simp add: ex_assn_def pure_assn_def conj_assn_def)\n        apply(rule exI[where x= d])\n        apply auto\n        apply(rule exI[where x=\"WaitBlk d (\\<lambda>t. ParState (EState s) (p t)) (merge_rdy rdy1 rdy2) # [InBlock ch1 v1]\"])\n        apply auto\n        subgoal apply rule by auto\n        apply(rule exI[where x=tr2a])\n        apply auto\n        apply(rule exI[where x=\"(InBlock ch2 v2 # tr2b)\"])\n        apply auto\n        apply(rule exI[where x=\"[InBlock ch2 v2]\"])\n        apply auto\n        apply rule\n        by auto\n      subgoal by (auto elim!: sync_elims)\n      done\n    done\n  done\n\n\nlemma combine_assn_inrdy_inrdy:\n  assumes \"ch1\\<in>chs \\<and> ch2\\<in>chs\"\n  shows \"combine_assn chs (Inrdy\\<^sub>t s ch1 v1 rdy1 @\\<^sub>t P) (Inrdy\\<^sub>t s' ch2 v2 rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding entails_tassn_def combine_assn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:inrdy_assn.cases[of s ch1 v1 rdy1])\n      apply auto\n    subgoal\n      apply(cases rule:inrdy_assn.cases[of s' ch2 v2 rdy2])\n        apply auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    subgoal for dd\n      apply(cases rule:inrdy_assn.cases[of s' ch2 v2 rdy2])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal for d\n        apply(cases \"\\<not> compat_rdy rdy1 rdy2\")\n        subgoal by (auto elim!: sync_elims)\n        apply(cases \"dd<d\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply(cases \"dd>d\")\n        subgoal\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply auto\n        apply(elim combine_blocks_waitE2)\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      done\n    done\n  done\n\n\n\nlemma combine_assn_inrdy_inrdy':\n  assumes \"ch1\\<notin>chs \\<and> ch2\\<in>chs \\<and> \\<not> compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (Inrdy\\<^sub>t s ch1 v1 rdy1 @\\<^sub>t P) (Inrdy\\<^sub>t s' ch2 v2 rdy2 @\\<^sub>t Q) \\<Longrightarrow>\\<^sub>t \n         In0\\<^sub>t ch1 v1 @\\<^sub>t combine_assn chs P (Inrdy\\<^sub>t s' ch2 v2 rdy2 @\\<^sub>t Q)\"\n  unfolding entails_tassn_def combine_assn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:inrdy_assn.cases[of s ch1 v1 rdy1])\n      apply auto\n    subgoal\n      apply(cases rule:inrdy_assn.cases[of s' ch2 v2 rdy2])\n        apply auto\n      subgoal\n        apply(elim combine_blocks_unpairE1)\n          apply auto\n        apply(rule exI[where x=\"[InBlock ch1 v1]\"])\n        apply auto\n        subgoal apply rule done\n        apply(rule exI[where x=tr2a])\n        apply auto\n        apply(rule exI[where x=\"(InBlock ch2 v2 # tr2b)\"])\n        by auto\n      subgoal for d2\n        apply(elim combine_blocks_unpairE3)\n         apply auto\n        apply(rule exI[where x=\"[InBlock ch1 v1]\"])\n        apply auto\n        subgoal apply rule done\n        apply(rule exI[where x=tr2a])\n        apply auto\n        apply(rule exI[where x=\"(WaitBlk d2 (\\<lambda>_. EState s') rdy2 # InBlock ch2 v2 # tr2b)\"])\n        by auto\n      done\n    subgoal for d1\n      apply(cases rule:inrdy_assn.cases[of s' ch2 v2 rdy2])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal for d2\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\n\nlemma combine_assn_inrdy_outrdy:\n  assumes \"ch1\\<in>chs \\<and> ch2\\<in>chs \\<and> \\<not>compat_rdy rdy1 rdy2\"\n  shows \"combine_assn chs (inrdy_assn s1 ch1 v1 rdy1 @\\<^sub>t P)(outrdy_assn s2 ch2 v2 rdy2 @\\<^sub>t Q)\n         \\<Longrightarrow>\\<^sub>t \\<up>(ch1 = ch2 \\<and> v1= v2) \\<and>\\<^sub>t combine_assn chs P Q\"\n  unfolding entails_tassn_def combine_assn_def join_assn_def\n  using assms\n  apply auto\n  subgoal for tr tr1a tr2a tr1b tr2b\n    apply(cases rule:inrdy_assn.cases[of s1 ch1 v1 rdy1 tr1a])\n      apply auto\n    subgoal\n      apply(cases rule:outrdy_assn.cases[of s2 ch2 v2 rdy2 tr1b])\n        apply auto\n      subgoal\n        apply(auto elim!: combine_blocks_pairE)\n        by blast\n      by (auto elim!: sync_elims)\n    subgoal\n      apply(cases rule:outrdy_assn.cases[of s2 ch2 v2 rdy2 tr1b])\n        apply auto\n      by (auto elim!: sync_elims)\n    done\n  done\n\n\n\n\n\n\n\n\n\n\nfun combine1 :: \"nat \\<Rightarrow> nat \\<Rightarrow> estate ext_state \\<Rightarrow> estate ext_state \\<Rightarrow> estate tassn\" where\n  \"combine1 0 0 (Sch p rn rp,ss) (Task st ent tp,ts) = (emp\\<^sub>t)\"\n| \"combine1 0 (Suc k) (Sch p rn rp,ss) (Task WAIT ent tp,ts) = \n   (combine1 0 k (Sch p rn rp,ss) (Task READY ezero tp,ts(T := 0))) \"\n| \"combine1 0 (Suc k) (Sch p rn rp,ss) (Task READY ent tp,ts) = false\\<^sub>A\"\n| \"combine1 0 (Suc k) (Sch p rn rp,ss) (Task RUNNING ent tp,ts) = false\\<^sub>A\"\n| \"combine1 (Suc k) 0 (Sch p rn rp,ss) (Task st ent tp,ts) = (\n    (In0\\<^sub>t (req_ch 2) 1 @\\<^sub>t (if 1\\<le>rp then combine1 k 0 (Sch (p@[(1,2)]) rn rp,ss(Pr:=1)) (Task st ent tp,ts)\n                                  else \\<up>(rn \\<noteq> 1) \\<and>\\<^sub>t Out0\\<^sub>t (run_ch 2) 0 @\\<^sub>t combine1 k 0 (Sch p 2 1, ss(Pr := 1)) (Task st ent tp,ts)))\n \\<or>\\<^sub>t (\\<exists>\\<^sub>t v. \\<up> (v \\<noteq> 1) \\<and>\\<^sub>t In0\\<^sub>t (req_ch 2) v @\\<^sub>t true\\<^sub>A )\n \\<or>\\<^sub>t (\\<exists>\\<^sub>t v. In0\\<^sub>t (free_ch 2) v @\\<^sub>t (if length p > 0 then Out0\\<^sub>t (run_ch 2) 0 @\\<^sub>t combine1 k 0 (sched_get_max'(Sch p rn rp),ss(G:=v)) (Task st ent tp,ts) else \n                                   combine1 k 0 (Sch [] (-1) (-1),ss(G:=v)) (Task st ent tp,ts)))   \n \\<or>\\<^sub>t (\\<exists>\\<^sub>t v. In0\\<^sub>t (exit_ch 2) v @\\<^sub>t combine1 k 0 (Sch (del_proc p 2) rn rp,ss(G:=v)) (Task st ent tp,ts))\n)\"\n| \"combine1 (Suc sk) (Suc tk) (Sch p rn rp,ss) (Task WAIT ent tp,ts) = (\n     (Wait\\<^sub>t (9 / 200 - ts T) (\\<lambda>t. ParState (EState (Sch p rn rp, ss)) (EState (Task WAIT ent tp, ts(T:= ts T + t)))) ({},{req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t\n      combine1 (Suc sk) tk (Sch p rn rp,ss) (Task READY ezero tp,ts(T:=0)))\n    \\<or>\\<^sub>t   (\\<exists>\\<^sub>ttt. \\<up> (0 \\<le> tt \\<and> tt < 9 / 200 - ts T) \\<and>\\<^sub>t\n        Waitin\\<^sub>t tt (\\<lambda>t. ParState (EState (Sch p rn rp, ss)) (EState (Task WAIT ent tp, ts(T:= ts T + t))))\n         (req_ch 2) 1 ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\n       @\\<^sub>t (if 1\\<le>rp then combine1 sk (Suc tk) (Sch (p@[(1,2)]) rn rp,ss(Pr:=1)) (Task WAIT ent tp,ts(T:= ts T + tt)) \n                   else (Out0\\<^sub>t (run_ch 2) 0 @\\<^sub>t combine1 sk (Suc tk) (Sch p 2 1,ss(Pr:=1)) (Task WAIT ent tp,ts(T:= ts T + tt))\n                        \\<or>\\<^sub>t Waitp\\<^sub>t ({run_ch 2},{}) @\\<^sub>t true\\<^sub>A)))\n    \\<or>\\<^sub>t  (\\<exists>\\<^sub>ttt v.\\<up> (0 \\<le> tt \\<and> tt < 9 / 200 - ts T \\<and> v\\<noteq>1) \\<and>\\<^sub>t\n        Waitin\\<^sub>t tt (\\<lambda>t. ParState (EState (Sch p rn rp, ss)) (EState (Task WAIT ent tp, ts(T := ts T + t))))\n         (req_ch 2) v ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t true\\<^sub>A)\n    \\<or>\\<^sub>t  (\\<exists>\\<^sub>ttt v.\\<up> (0 \\<le> tt \\<and> tt < 9 / 200 - ts T) \\<and>\\<^sub>t \n        Waitin\\<^sub>t tt (\\<lambda>t. ParState (EState (Sch p rn rp, ss)) (EState (Task WAIT ent tp, ts(T := ts T + t))))\n         (free_ch 2) v ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\n          @\\<^sub>t (if length p > 0 then (Out0\\<^sub>t (run_ch 2) 0 @\\<^sub>t combine1 sk (Suc tk) (Sch (del_proc p 2) 2 1,ss(G:=v)) (Task WAIT ent tp,ts(T:= ts T + tt))\n                                     \\<or>\\<^sub>t Waitp\\<^sub>t  ({run_ch 2},{}) @\\<^sub>t true\\<^sub>A ) \n              else combine1 sk (Suc tk) (Sch [] (-1) (-1),ss(G:=v)) (Task WAIT ent tp,ts(T:= ts T + tt))))\n    \\<or>\\<^sub>t  (\\<exists>\\<^sub>ttt v.\\<up> (0 \\<le> tt \\<and> tt < 9 / 200 - ts T) \\<and>\\<^sub>t\n        Waitin\\<^sub>t tt(\\<lambda>t. ParState (EState (Sch p rn rp, ss))(EState (Task WAIT ent tp, ts(T := ts T + t))))\n         (exit_ch 2) v ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\n            @\\<^sub>t combine1 sk (Suc tk) (Sch (del_proc p 2) rn rp,ss(G:=v)) (Task WAIT ent tp,ts(T:= ts T + tt)))\n)\"\n| \"combine1 (Suc sk) (Suc tk) (Sch p rn rp,ss) (Task READY ent tp,ts) = (\n   (if rn = 2 then Out0\\<^sub>t (preempt_ch 2) 0 @\\<^sub>t combine1 sk tk (Sch p 1 2,ss(Pr:=2)) (Task RUNNING ent tp,ts(F:=0))\n                \\<or>\\<^sub>t  Waitp\\<^sub>t ({preempt_ch 2}, {run_ch 1}) @\\<^sub>t true\\<^sub>A \n                \\<or>\\<^sub>t  Waitp\\<^sub>t ({exit_ch 1, preempt_ch 2}, {run_ch 1}) @\\<^sub>t true\\<^sub>A \n              else combine1 sk tk (Sch p 1 2,ss(Pr:=2)) (Task RUNNING ent tp,ts(F:=0)))\n \\<or>\\<^sub>t (In0\\<^sub>t (req_ch 2) 1 @\\<^sub>t (if 1\\<le>rp then combine1 sk (Suc tk) (Sch (p @ [(1, 2)]) rn rp, ss(Pr := 1)) (Task READY ent tp,ts) \n                                   else (Out0\\<^sub>t (run_ch 2) 0  @\\<^sub>t combine1 sk (Suc tk) (Sch p 2 1, ss(Pr := 1)) (Task READY ent tp,ts)\n                                        \\<or>\\<^sub>t  Waitp\\<^sub>t ({req_ch 1, run_ch 2},{}) @\\<^sub>t true\\<^sub>A)))\n \\<or>\\<^sub>t (\\<exists>\\<^sub>tv. \\<up> (v \\<noteq> 1) \\<and>\\<^sub>t In0\\<^sub>t (req_ch 2) v @\\<^sub>t true\\<^sub>A)\n \\<or>\\<^sub>t (\\<exists>\\<^sub>tv. In0\\<^sub>t (free_ch 2) v @\\<^sub>t (if length p > 0 then (Out0\\<^sub>t (run_ch 2) 0  @\\<^sub>t combine1 sk (Suc tk) (Sch (del_proc p 2) 2 1, ss(G := v)) (Task READY ent tp,ts)\n                                        \\<or>\\<^sub>t  Waitp\\<^sub>t ({req_ch 1, run_ch 2},{}) @\\<^sub>t true\\<^sub>A) \n                                 else combine1 sk (Suc tk) (Sch [] (- 1) (- 1), ss(G := v)) (Task READY ent tp,ts)))\n \\<or>\\<^sub>t (\\<exists>\\<^sub>tv. In0\\<^sub>t (exit_ch 2) v @\\<^sub>t combine1 sk (Suc tk) (Sch (del_proc p 2) rn rp, ss(G := v)) (Task READY ent tp,ts))\n)\"\n| \"combine1 (Suc sk) (Suc tk) (Sch p rn rp,ss) (Task RUNNING ent tp,ts) = (\n  (Wait\\<^sub>t (min (45 / 10 ^ 3 - ts T) (1 / 10\\<^sup>2 - C_upd ent (ts C)))\n     (\\<lambda>t. ParState (EState (Sch p rn rp, ss))\n           (EState (Task RUNNING eone tp, ts(T := ts T + t, C := C_upd ent (ts C) + t))))\n     ({}, {preempt_ch 1, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2}) @\\<^sub>t \n     (if length p > 0 then out_0assn (run_ch 2) 0 @\\<^sub>t combine1 sk tk (Sch (del_proc p 2) 2 1,ss(G:=0)) (Task WAIT eone tp, ts(T:=ts T + min(0.045-ts T)(0.01-C_upd ent (ts C)),C:=C_upd ent (ts C) + min(0.045-ts T)(0.01-C_upd ent (ts C))))\n                           \\<or>\\<^sub>t Waitp\\<^sub>t ({run_ch 2}, {}) @\\<^sub>t true\\<^sub>A \\<or>\\<^sub>t Waitp\\<^sub>t ({req_ch 1, run_ch 2}, {}) @\\<^sub>t true\\<^sub>A\n                      else combine1 sk tk (Sch [] (-1) (-1),ss(G:=0)) (Task WAIT eone tp, ts(T:=ts T + min(0.045-ts T)(0.01-C_upd ent (ts C)),C:=C_upd ent (ts C) + min(0.045-ts T)(0.01-C_upd ent (ts C))))))\n\\<or>\\<^sub>t  (\\<exists>\\<^sub>t t. \\<up> (0 \\<le> t \\<and> t \\<le> min (45 / 10 ^ 3 - ts T) (1 / 10\\<^sup>2 - C_upd ent (ts C))) \\<and>\\<^sub>t\n           Waitin\\<^sub>t t (\\<lambda>t. ParState (EState (Sch p rn rp, ss))\n                  (EState (Task RUNNING eone 2, ts\n                     (T := ts T + t,\n                      C := C_upd ent (ts C) + t))))\n            (req_ch 2) 1 ({}, {preempt_ch 1, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\n               @\\<^sub>t combine1 sk (Suc tk) (Sch (p@[(1,2)]) 1 2,ss(Pr:=1)) (Task RUNNING eone tp,ts\n                 (T := ts T + t,\n                  C := C_upd ent (ts C) + t)))\n\\<or>\\<^sub>t  (\\<exists>\\<^sub>t t v. \\<up> (0 \\<le> t \\<and> t \\<le> min (45 / 10 ^ 3 - ts T) (1 / 10\\<^sup>2 - C_upd ent (ts C)) \\<and> v \\<noteq> 1) \\<and>\\<^sub>t\n           Waitin\\<^sub>t t (\\<lambda>t. ParState (EState (Sch p rn rp, ss))\n                  (EState (Task RUNNING eone 2, ts\n                     (T := ts T + t,\n                      C := C_upd ent (ts C) + t))))\n            (req_ch 2) v ({}, {preempt_ch 1, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\n               @\\<^sub>t true\\<^sub>A)\n\\<or>\\<^sub>t  (\\<exists>\\<^sub>t t v. \\<up> (0 \\<le> t \\<and> t \\<le> min (45 / 10 ^ 3 - ts T) (1 / 10\\<^sup>2 - C_upd ent (ts C))) \\<and>\\<^sub>t\n           Waitin\\<^sub>t t (\\<lambda>t. ParState (EState (Sch p rn rp, ss))\n                  (EState (Task RUNNING eone 2, ts\n                     (T := ts T + t,\n                      C := C_upd ent (ts C) + t))))\n            (free_ch 2) v ({}, {preempt_ch 1, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\n               @\\<^sub>t true\\<^sub>A)\n\\<or>\\<^sub>t  (\\<exists>\\<^sub>t t v. \\<up> (0 \\<le> t \\<and> t \\<le> min (45 / 10 ^ 3 - ts T) (1 / 10\\<^sup>2 - C_upd ent (ts C))) \\<and>\\<^sub>t\n           Waitin\\<^sub>t t (\\<lambda>t. ParState (EState (Sch p rn rp, ss))\n                  (EState (Task RUNNING eone 2, ts\n                     (T := ts T + t,\n                      C := C_upd ent (ts C) + t))))\n            (exit_ch 2) v ({}, {preempt_ch 1, req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2})\n               @\\<^sub>t combine1 sk (Suc tk) (Sch (del_proc p 2) 1 2,ss(G := v)) (Task RUNNING eone tp,ts\n                 (T := ts T + t,\n                  C := C_upd ent (ts C) + t)))\n\n)\"\n\n\n\ndefinition propc :: \"nat \\<Rightarrow> estate \\<Rightarrow> estate \\<Rightarrow> bool\" where\n\"propc k schs task_es = (k>0 \\<longrightarrow>(status task_es = RUNNING \\<longleftrightarrow> run_now schs = 1))\"\n\n\nlemma combine_SCH_T1:\n\"propc nt (Sch p rn rp) (Task st ent 2) \\<Longrightarrow>\n   proper (Sch p rn rp) \\<Longrightarrow>\n   inv_s ts \\<Longrightarrow>\n combine_assn {req_ch 1, preempt_ch 1, run_ch 1, free_ch 1, exit_ch 1} \n (SCH_tr ns (Sch p rn rp,ss)) (T1_tr nt (Task st ent 2,ts)) \\<Longrightarrow>\\<^sub>t\n combine1 ns nt (Sch p rn rp,ss) (Task st ent 2,ts) \"\nproof(induction \" nt+ns\"  arbitrary: nt ns p rn rp ts st ent ss rule: less_induct)\n  case less\n  then show ?case \n    apply(cases ns)\n    subgoal\n      apply(cases nt)\n      subgoal\n        by auto\n      subgoal for nt'\n        apply(cases st)\n        apply auto\n        subgoal premises pre\n          apply(rule entails_tassn_trans)\n           apply(rule combine_assn_emp_wait')\n          using pre(1)[of nt' 0 p rn rp READY ezero \"ts(T := 0)\" ss] pre(2,3,4)\n          apply(subgoal_tac \"propc nt' (Sch p rn rp) (Task READY ezero 2)\")\n          subgoal unfolding proper_def inv_s_def by auto\n          subgoal unfolding propc_def \n            apply(cases nt') subgoal by auto\n            by (metis estate.sel(4) less.prems(1) pre(5) pre(6) propc_def status.distinct(3) status.distinct(5) zero_less_Suc)\n          done\n        subgoal\n          apply(rule combine_or_right)\n          subgoal\n            apply(rule combine_assn_ex_pre_right')+\n            apply(rule combine_assn_pure_pre_right')\n            by(simp add: combine_assn_emp_out)\n          subgoal\n            by(simp add: combine_assn_emp_out)\n          done\n        subgoal\n          apply(rule combine_or_right)\n          subgoal\n            apply(rule combine_assn_ex_pre_right')+\n            apply(rule combine_assn_pure_pre_right')\n            apply(simp add: combine_assn_emp_waitin)\n            done\n          subgoal\n            apply(rule entails_tassn_trans)\n             apply(rule combine_assn_emp_wait')\n            apply(rule combine_or_right)\n            subgoal by(simp add: combine_assn_emp_outrdy)\n            subgoal apply(rule combine_assn_ex_pre_right')\n              by(simp add: combine_assn_emp_inrdy)\n            done\n          done\n        done\n      done\n    subgoal for ns'\n      apply(cases nt)\n      subgoal\n        apply (simp only: SCH_tr.simps T1_tr.simps)\n        apply(rule combine_or_left)\n        subgoal\n          apply(simp add: combine_assn_inrdy_emp)\n          done\n        apply(rule combine_or_left)\n        subgoal\n          apply(rule combine_assn_ex_pre_left')+\n          apply(rule combine_assn_pure_pre_left')\n          apply(simp add: combine_assn_inrdy_emp)\n          done\n        apply(rule combine_or_left)\n        subgoal premises pre\n          apply(simp only:combine1.simps)\n          apply(rule entails_tassn_disjI1)\n          apply(rule entails_tassn_trans)\n           apply(rule combine_assn_inrdy_emp')\n          subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n          apply(rule entails_tassn_cancel_left)\n          apply(cases \"1\\<le>rp\")\n          subgoal apply simp\n            using pre(1)[of 0 ns' \"(p @ [(1, 2)])\" rn rp st ent ts \"ss(Pr := 1)\"] pre(2,3,4) properl_p1[of p 1 2]\n            by(auto simp add:propc_def proper_def properp_def inv_s_def)\n          apply(cases \"rn = 1\")\n          subgoal apply simp\n            apply(rule combine_or_left)\n            subgoal\n              apply(simp add: combine_assn_out0_emp)\n              done\n            apply(rule combine_or_left)\n            subgoal\n              apply(simp add: combine_assn_waitp_emp)\n              done\n            subgoal\n              apply(simp add: combine_assn_out0_emp)\n              done\n            done\n          apply simp\n          apply(rule combine_or_left)\n            subgoal\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_out0_emp')\n              subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n              apply(rule entails_tassn_cancel_left)\n              using pre(1)[of 0 ns' p 2 1 st ent ts \"ss(Pr := 1)\" ] pre(2,3,4)\n              by (auto simp add:propc_def proper_def properp_def)\n            subgoal\n              apply(simp add: combine_assn_waitp_emp)\n              done\n            done\n          apply(rule combine_or_left)\n          subgoal premises pre\n            apply(simp only:combine1.simps)\n            apply(rule entails_tassn_disjI2)\n            apply(rule entails_tassn_disjI1)\n            apply(rule combine_assn_ex_pre_left')\n            subgoal for v\n            apply(rule combine_assn_pure_pre_left')\n              apply(rule entails_tassn_exI[where x=v])\n              apply simp\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_inrdy_emp')\n              subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n              apply(rule entails_tassn_cancel_left)\n              by(auto simp add: entails_tassn_def true_assn_def)\n            done\n          apply(rule combine_or_left)\n          subgoal\n            apply(rule combine_assn_ex_pre_left')\n            apply(simp add: combine_assn_inrdy_emp)\n            done\n          apply(rule combine_or_left)\n          subgoal premises pre\n            apply(simp only:combine1.simps)\n            apply(rule entails_tassn_disjI2)\n            apply(rule entails_tassn_disjI2)\n            apply(rule entails_tassn_disjI1)\n            apply(rule combine_assn_ex_pre_left')\n            subgoal for v\n              apply(rule entails_tassn_exI[where x=v])\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_inrdy_emp')\n              subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n              apply(rule entails_tassn_cancel_left)\n              apply(cases \"length p > 0\")\n              subgoal \n                apply(subgoal_tac\"get_max p = (1, 2)\")\n                 prefer 2\n                 subgoal using pre(3) properl_p5[of p]\n                  apply auto\n                  apply(cases \"get_max p\")\n                  by (auto simp add: proper_def properp_def)\n                apply simp\n                apply(rule combine_or_left)\n                subgoal\n                 apply(rule entails_tassn_trans)\n                  apply(rule combine_assn_out0_emp')\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                apply(rule entails_tassn_cancel_left)\n                using pre(1)[of 0 ns' \"(del_proc p 2)\" 2 1 st ent ts \"ss(G := v)\"] pre(2,3,4) properl_p4[of p 2]\n                by(auto simp add:propc_def proper_def properp_def)\n              subgoal\n                apply(simp add: combine_assn_waitp_emp)\n                done\n              done\n            subgoal\n              apply simp\n              using pre(1)[of 0 ns' \"[]\" \"-1\" \"-1\" st ent ts \"ss(G := v)\"] pre(2,3,4) properl_p4[of p 2]\n              by(auto simp add:propc_def proper_def properp_def)\n            done\n          done\n        apply(rule combine_or_left)\n        subgoal\n          apply(rule combine_assn_ex_pre_left')\n            apply(simp add: combine_assn_inrdy_emp)\n          done\n        subgoal premises pre\n            apply(simp only:combine1.simps)\n            apply(rule entails_tassn_disjI2)\n          apply(rule entails_tassn_disjI2)\n          apply(rule entails_tassn_disjI2)\n            apply(rule combine_assn_ex_pre_left')\n            subgoal for v\n              apply(rule entails_tassn_exI[where x=v])\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_inrdy_emp')\n              subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n              apply(rule entails_tassn_cancel_left)\n              using pre(1)[of 0 ns' \"(del_proc p 2)\" rn rp st ent ts \"ss(G := v)\"] pre(2,3,4) properl_p4[of p 2]\n              by(auto simp add:propc_def proper_def properp_def)\n            done\n          done\n        subgoal for nt'\n\n\n\n\n\n\n          apply(cases st)\n            apply (simp only: SCH_tr.simps T1_tr.simps)\n          subgoal premises pre\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_inrdy_wait)\n              subgoal by auto\n              apply(auto simp only: merge_rdy.simps)\n              unfolding combine1.simps\n              apply(rule entails_tassn_disjI1)\n              apply(rule entails_tassn_cancel_both)\n              subgoal by auto\n              thm pre\n              apply(rule entails_tassn_trans)\n               prefer 2\n               apply(rule pre)\n              subgoal by auto\n              subgoal using pre(2) unfolding propc_def by auto\n              subgoal using pre(3) by auto\n              subgoal using pre(4) unfolding inv_s_def by auto\n              apply(rule combine_assn_left_tran)\n              apply(simp only: SCH_tr.simps)\n              apply(rule entails_tassn_disjI1)\n              by auto\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule combine_assn_pure_pre_left')\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_inrdy_wait)\n              subgoal by auto\n              apply(auto simp only: merge_rdy.simps)\n              unfolding combine1.simps\n              apply(rule entails_tassn_disjI1)\n              apply(rule entails_tassn_cancel_both)\n              subgoal by auto\n              thm pre\n              apply(rule entails_tassn_trans)\n               prefer 2\n               apply(rule pre)\n              subgoal by auto\n              subgoal using pre(2) unfolding propc_def by auto\n              subgoal using pre(3) by auto\n              subgoal using pre(4) unfolding inv_s_def by auto\n              apply(rule combine_assn_left_tran)\n              apply(simp only: SCH_tr.simps)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI1)\n              subgoal for v\n                apply(rule entails_tassn_exI[where x= v])\n                by simp\n              done\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_inrdy_wait')\n              subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n              apply(rule entails_tassn_disjE)\n              subgoal\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_cancel_both)\n                subgoal by auto\n                thm pre\n                apply(rule entails_tassn_trans)\n                 prefer 2\n                 apply(rule pre)\n                subgoal by auto\n                subgoal using pre(2) unfolding propc_def by auto\n                subgoal using pre(3) by auto\n                subgoal using pre(4) unfolding inv_s_def by auto\n                apply(rule combine_assn_left_tran)\n                apply(simp only: SCH_tr.simps)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI1)\n                by auto\n              subgoal\n                apply(cases \"1\\<le>rp\")\n                subgoal apply simp\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI1)\n                  apply(rule ex_tran)\n                  apply auto\n                  apply(rule entails_tassn_cancel_left)\n                  apply(rule entails_tassn_trans)\n                   prefer 2\n                   apply(rule pre)\n                  subgoal by auto\n                  subgoal using pre(2) unfolding propc_def by auto\n                  subgoal using pre(2,3) properl_p1[of p 1 2] unfolding proper_def properp_def\n                    by auto\n                  subgoal using pre(4) unfolding inv_s_def C_def T_def by auto\n                  apply(rule combine_assn_right_tran)\n                  apply simp\n                  thm pre\n                  subgoal premises pre' for tt\n                  proof-\n                    have 1:\"(9 / 200 - (ts T + tt)) = (9 / 200 - ts T - tt)\"\n                      by auto\n                    have 2:\"(\\<lambda>t. EState (Task WAIT ent 2, ts(T := ts T + tt + t))) = (\\<lambda>t. EState (Task WAIT ent 2, ts(T := ts T + (t + tt))))\"\n                      apply(rule ext)\n                      by auto\n                    show ?thesis\n                      by(auto simp add:1 2)\n                  qed\n                  done\n                subgoal \n                  apply(subgoal_tac\"rn\\<noteq>1\")\n                   prefer 2\n                  subgoal using pre(2) unfolding propc_def by auto\n                  apply simp\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI1)\n                  apply(rule ex_tran)\n                  apply auto\n                  apply(rule entails_tassn_cancel_left)\n                  apply(rule combine_assn_left_disj)\n                  subgoal for tt\n                    apply(rule entails_tassn_disjI1)\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_out0_wait')\n                    subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    apply(rule entails_tassn_cancel_left)\n                    apply(rule entails_tassn_trans)\n                     prefer 2\n                     apply(rule pre)\n                    subgoal by auto\n                    subgoal using pre(2) unfolding propc_def by auto\n                    subgoal using pre(2,3) properl_p1[of p 1 2] unfolding proper_def properp_def\n                      by auto\n                    subgoal using pre(4) unfolding inv_s_def C_def T_def  by auto\n                    apply(rule combine_assn_right_tran)\n                    apply simp\n                    thm pre\n                    subgoal premises pre'\n                    proof-\n                      have 1:\"(9 / 200 - (ts T + tt)) = (9 / 200 - ts T - tt)\"\n                        by auto\n                      have 2:\"(\\<lambda>t. EState (Task WAIT ent 2, ts(T := ts T + tt + t))) = (\\<lambda>t. EState (Task WAIT ent 2, ts(T := ts T + (t + tt))))\"\n                        apply(rule ext)\n                        by auto\n                      show ?thesis\n                        by(auto simp add:1 2)\n                    qed\n                    done\n                  subgoal for tt\n                    apply(rule entails_tassn_disjI2)\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_waitp_wait)\n                    subgoal by auto\n                    by auto\n                  done\n                done\n              done\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule combine_assn_pure_pre_left')\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_inrdy_wait')\n              subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n              apply(rule entails_tassn_disjE)\n              subgoal for v\n                apply simp\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_cancel_left)\n                apply(rule entails_tassn_trans)\n                 prefer 2\n                 apply(rule pre)\n                subgoal by auto\n                subgoal using pre(2) unfolding propc_def by auto\n                subgoal using pre(3) by auto\n                subgoal using pre(4) unfolding inv_s_def by auto\n                apply(rule combine_assn_left_tran)\n                unfolding SCH_tr.simps\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_exI[where x= v])\n                by auto\n              subgoal for v\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI1)\n                apply(rule ex_tran)\n                apply auto\n                apply(rule entails_tassn_exI[where x= v])\n                apply auto\n                apply(rule entails_tassn_cancel_left)\n                unfolding entails_tassn_def true_assn_def\n                by auto\n              done\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule entails_tassn_trans)\n              apply(rule combine_assn_inrdy_wait)\n              subgoal by auto\n              unfolding combine1.simps\n              apply(rule entails_tassn_disjI1)\n              apply(rule entails_tassn_cancel_both)\n              subgoal by auto\n              apply(rule entails_tassn_trans)\n                prefer 2\n                apply(rule pre)\n              subgoal by auto\n              subgoal using pre(2) unfolding propc_def by auto\n              subgoal using pre(3) by auto\n              subgoal using pre(4) unfolding inv_s_def by auto\n              apply(rule combine_assn_left_tran)\n              unfolding SCH_tr.simps\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI1)\n              subgoal for v\n                apply(rule entails_tassn_exI[where x= v])\n                by auto\n              done\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_inrdy_wait')\n              subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n              apply(rule entails_tassn_disjE)\n              subgoal for v\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_cancel_both)\n                subgoal by auto\n                apply(rule entails_tassn_trans)\n                 prefer 2\n                 apply(rule pre)\n                subgoal by auto\n                subgoal using pre(2) unfolding propc_def by auto\n                subgoal using pre(3) by auto\n                subgoal using pre(4) unfolding inv_s_def by auto\n                apply(rule combine_assn_left_tran)\n                unfolding SCH_tr.simps\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_exI[where x= v])\n                by auto\n              subgoal for v\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI1)\n                apply(rule ex_tran)\n                apply(cases \"length p > 0\")\n                subgoal for tt\n                  apply(subgoal_tac\"get_max p = (1, 2)\")\n                   prefer 2\n                  subgoal using pre(3) properl_p5[of p]\n                  apply auto\n                  apply(cases \"get_max p\")\n                    by (auto simp add: proper_def properp_def)\n                  apply auto\n                  apply(rule entails_tassn_exI[where x= v])\n                  apply(rule entails_tassn_cancel_left)\n                  apply(rule combine_assn_left_disj)\n                  subgoal\n                    apply(rule entails_tassn_disjI1)\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_out0_wait')\n                    subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    apply(rule entails_tassn_cancel_left)\n                    apply(rule entails_tassn_trans)\n                     prefer 2\n                     apply(rule pre)\n                    subgoal by auto\n                    subgoal using pre(2) unfolding propc_def by auto\n                    subgoal using pre(2,3) properl_p4[of p 2] unfolding proper_def properp_def\n                      by auto\n                    subgoal using pre(4) unfolding inv_s_def C_def T_def by auto\n                    apply(rule combine_assn_right_tran)\n                    unfolding T1_tr.simps\n                    apply simp\n                    thm pre\n                    subgoal premises pre'\n                    proof-\n                      have 1:\"(9 / 200 - (ts T + tt)) = (9 / 200 - ts T - tt)\"\n                        by auto\n                      have 2:\"(\\<lambda>t. EState (Task WAIT ent 2, ts(T := ts T + tt + t))) = (\\<lambda>t. EState (Task WAIT ent 2, ts(T := ts T + (t + tt))))\"\n                        apply(rule ext)\n                        by auto\n                      show ?thesis\n                        by(auto simp add:1 2)\n                    qed\n                    done\n                  subgoal \n                    apply(rule entails_tassn_disjI2)\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_waitp_wait)\n                    subgoal by auto\n                    by auto\n                  done\n                subgoal for tt\n                  apply auto\n                  apply(rule entails_tassn_exI[where x= v])\n                  apply(rule entails_tassn_cancel_left)\n                    apply(rule entails_tassn_trans)\n                     prefer 2\n                     apply(rule pre)\n                    subgoal by auto\n                    subgoal using pre(2) unfolding propc_def by auto\n                    subgoal using pre(2,3) properl_p4[of p 2] unfolding proper_def properp_def\n                      by auto\n                    subgoal using pre(4) unfolding inv_s_def C_def T_def by auto\n                    apply(rule combine_assn_right_tran)\n                    unfolding T1_tr.simps\n                    apply simp\n                    thm pre\n                    subgoal premises pre'\n                    proof-\n                      have 1:\"(9 / 200 - (ts T + tt)) = (9 / 200 - ts T - tt)\"\n                        by auto\n                      have 2:\"(\\<lambda>t. EState (Task WAIT ent 2, ts(T := ts T + tt + t))) = (\\<lambda>t. EState (Task WAIT ent 2, ts(T := ts T + (t + tt))))\"\n                        apply(rule ext)\n                        by auto\n                      show ?thesis\n                        by(auto simp add:1 2)\n                    qed\n                    done\n                  done\n                done\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule entails_tassn_trans)\n              apply(rule combine_assn_inrdy_wait)\n              subgoal by auto\n              unfolding combine1.simps\n              apply(rule entails_tassn_disjI1)\n              apply(rule entails_tassn_cancel_both)\n              subgoal by auto\n              apply(rule entails_tassn_trans)\n                prefer 2\n                apply(rule pre)\n              subgoal by auto\n              subgoal using pre(2) unfolding propc_def by auto\n              subgoal using pre(3) by auto\n              subgoal using pre(4) unfolding inv_s_def by auto\n              apply(rule combine_assn_left_tran)\n              unfolding SCH_tr.simps\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI1)\n              subgoal for v\n                apply(rule entails_tassn_exI[where x= v])\n                by auto\n              done\n            subgoal\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_inrdy_wait')\n              subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n              unfolding combine1.simps\n              apply(rule entails_tassn_disjE)\n              subgoal for v\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_cancel_both)\n                subgoal by auto\n                apply(rule entails_tassn_trans)\n                prefer 2\n                apply(rule pre)\n                subgoal by auto\n                subgoal using pre(2) unfolding propc_def by auto\n                subgoal using pre(2,3) properl_p4[of p 2] unfolding proper_def properp_def\n                  by auto\n                subgoal using pre(4) unfolding inv_s_def by auto\n                apply(rule combine_assn_left_tran)\n                unfolding SCH_tr.simps\n                apply(rule entails_tassn_disjI2)+\n                apply(rule entails_tassn_exI[where x= v])\n                by auto\n              subgoal for v\n                apply(rule entails_tassn_disjI2)+\n                apply(rule ex_tran)\n                subgoal for tt\n                  apply(rule entails_tassn_exI[where x= v])\n                  apply auto\n                  apply(rule entails_tassn_cancel_left)\n                  apply(rule entails_tassn_trans)\n                     prefer 2\n                     apply(rule pre)\n                    subgoal by auto\n                    subgoal using pre(2) unfolding propc_def by auto\n                    subgoal using pre(2,3) properl_p4[of p 2] unfolding proper_def properp_def\n                      by auto\n                    subgoal using pre(4) unfolding inv_s_def C_def T_def by auto\n                    apply(rule combine_assn_right_tran)\n                    unfolding T1_tr.simps\n                    apply simp\n                    thm pre\n                    subgoal premises pre'\n                    proof-\n                      have 1:\"(9 / 200 - (ts T + tt)) = (9 / 200 - ts T - tt)\"\n                        by auto\n                      have 2:\"(\\<lambda>t. EState (Task WAIT ent 2, ts(T := ts T + tt + t))) = (\\<lambda>t. EState (Task WAIT ent 2, ts(T := ts T + (t + tt))))\"\n                        apply(rule ext)\n                        by auto\n                      show ?thesis\n                        by(auto simp add:1 2)\n                    qed\n                    done\n                  done\n                done\n              done\n\n\n\n\n          apply (simp only: SCH_tr.simps T1_tr.simps)\n          subgoal premises pre\n            apply(rule combine_or_left)\n            subgoal \n              unfolding combine1.simps\n              apply(rule entails_tassn_disjI1)\n              apply(rule combine_or_right)\n              subgoal\n               apply(rule combine_assn_ex_pre_right')+\n                apply(rule combine_assn_pure_pre_right')\n                subgoal for v tt\n                  apply(rule entails_tassn_trans)\n                  apply(rule combine_assn_inrdy_out)\n                  subgoal by auto\n                  apply(subgoal_tac\"rp<2\")\n                   prefer 2\n                  subgoal premises pre'\n                  proof-\n                    have 1:\"rn \\<noteq> 1\"\n                      using pre(2,3) unfolding propc_def by auto\n                    have 2:\"rp \\<noteq> 2\"\n                      using pre(2,3) unfolding propc_def proper_def properp_def  by auto\n                    then show ?thesis\n                      using pre(2,3) unfolding propc_def proper_def properp_def by auto\n                  qed\n                  apply(cases \"rn = 2\")\n                   apply auto\n                  subgoal\n                    apply(rule combine_or_left)\n                    subgoal\n                      apply(rule entails_tassn_disjI1)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_out0_waitin')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      apply(rule entails_tassn_cancel_left)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_out0_waitin)\n                      subgoal by auto\n                      apply auto\n                      apply(rule entails_tassn_trans)\n                       prefer 2\n                       apply(rule pre(1))\n                      subgoal by auto\n                      subgoal unfolding propc_def by auto\n                      subgoal using pre(3) unfolding proper_def properp_def by auto\n                      subgoal using pre(4) unfolding inv_s_def by auto\n                      by auto\n                    apply(rule combine_or_left)\n                    subgoal\n                      apply(rule entails_tassn_disjI2)\n                      apply(rule entails_tassn_disjI1)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_waitp_waitin)\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      by auto\n                    subgoal\n                      apply(rule entails_tassn_disjI1)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_out0_waitin')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      apply(rule entails_tassn_cancel_left)\n                      apply(rule combine_assn_waitp_waitin')\n                      by auto\n                    done\n                  apply(rule combine_or_left)\n                  subgoal\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_out0_waitin)\n                    subgoal by auto\n                    apply(rule entails_tassn_trans)\n                    prefer 2\n                     apply(rule pre(1))\n                    subgoal by auto\n                    subgoal unfolding propc_def by auto\n                    subgoal using pre(3) unfolding proper_def properp_def by auto\n                    subgoal using pre(4) unfolding inv_s_def by auto\n                    by auto\n                  subgoal\n                    apply(rule combine_assn_waitp_waitin')\n                    by auto\n                  done\n                done\n              subgoal \n                apply(rule entails_tassn_trans)\n                apply(rule combine_assn_inrdy_out)\n                subgoal by auto\n                apply(subgoal_tac\"rp<2\")\n                 prefer 2\n                subgoal premises pre'\n                  proof-\n                  have 1:\"rn \\<noteq> 1\"\n                      using pre(2,3) unfolding propc_def by auto\n                    have 2:\"rp \\<noteq> 2\"\n                      using pre(2,3) unfolding propc_def proper_def properp_def  by auto\n                    then show ?thesis\n                      using pre(2,3) unfolding propc_def proper_def properp_def by auto\n                  qed\n               apply(cases \"rn = 2\")\n                 apply auto\n                  subgoal\n                    apply(cases \"(9 / 200 - ts T) \\<le> 0\")\n                    subgoal apply simp\n                      apply(rule combine_or_left)\n                      subgoal\n                        apply(rule combine_or_right)\n                        subgoal\n                          apply(rule entails_tassn_disjI1)\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_assn_out0_outrdy2)\n                          subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule combine_assn_out0_outrdy1)\n                          by auto\n                        subgoal\n                          apply(rule combine_assn_ex_pre_right')\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_assn_out0_inrdy2)\n                          subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                          apply(rule entails_tassn_disjI1)\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_assn_out0_inrdy1)\n                          subgoal by auto\n                          using pre(4) unfolding inv_s_def\n                          apply auto\n                          apply(subgoal_tac \"ts(F := 0) = ts(T := 9 / 200, F := 0)\")\n                           prefer 2\n                          subgoal\n                            by(auto simp add:T_def F_def)\n                          apply simp\n                          apply(rule entails_tassn_trans)\n                           apply(rule pre(1))\n                          subgoal by auto\n                          subgoal using pre(2) unfolding propc_def by auto\n                          subgoal using pre(3) unfolding proper_def properp_def by auto\n                          subgoal using pre(4) unfolding inv_s_def by auto\n                          by auto\n                        done\n                      apply(rule combine_or_left)\n                      subgoal\n                        apply(rule combine_or_right)\n                        subgoal apply(rule entails_tassn_disjI2)+\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_assn_waitp_outrdy)\n                          subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                          by auto\n                        subgoal apply(rule entails_tassn_disjI2)+\n                          apply(rule combine_assn_ex_pre_right')\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_assn_waitp_inrdy)\n                          subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                          by auto\n                        done\n                      subgoal\n                        apply(rule combine_or_right)\n                        subgoal\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_assn_out0_outrdy2)\n                          subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                          apply(rule entails_tassn_disjI1)\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule combine_assn_waitp_outrdy')\n                          by auto\n                        subgoal\n                          apply(rule entails_tassn_disjI1)\n                          apply(rule combine_assn_ex_pre_right')\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_assn_out0_inrdy2)\n                          subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule combine_assn_waitp_inrdy')\n                          by auto\n                        done\n                      done\n                    apply(rule combine_or_left)\n                    subgoal\n                      apply(rule entails_tassn_disjI1)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_out0_wait')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      apply(rule entails_tassn_cancel_left)\n                      apply(rule combine_assn_out0_wait)\n                      by auto\n                    apply(rule combine_or_left)\n                    subgoal\n                      apply(rule entails_tassn_disjI2)\n                      apply(rule entails_tassn_disjI1)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_waitp_wait)\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      by auto\n                    subgoal\n                      apply(rule entails_tassn_disjI1)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_out0_wait')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      apply(rule entails_tassn_cancel_left)\n                      apply(rule combine_assn_waitp_wait')\n                      by auto\n                    done\n                  apply(cases \"(9 / 200 - ts T) \\<le> 0\")\n                    subgoal apply simp\n                      apply(rule combine_or_left)\n                      subgoal\n                        apply(rule combine_or_right)\n                        subgoal\n                          apply(rule combine_assn_out0_outrdy1)\n                          by auto\n                        subgoal\n                          apply(rule combine_assn_ex_pre_right')\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_assn_out0_inrdy1)\n                          subgoal by auto\n                          apply auto\n                          using pre(4) unfolding inv_s_def\n                          apply auto\n                          apply(subgoal_tac \"ts(F := 0) = ts(T := 9 / 200, F := 0)\")\n                           prefer 2\n                          subgoal\n                            by(auto simp add:T_def F_def)\n                          apply simp\n                          apply(rule entails_tassn_trans)\n                           apply(rule pre(1))\n                          subgoal by auto\n                          subgoal using pre(2) unfolding propc_def by auto\n                          subgoal using pre(3) unfolding proper_def properp_def by auto\n                          subgoal using pre(4) unfolding inv_s_def T_def C_def by auto\n                          by auto\n                        done\n                      subgoal\n                      apply(rule combine_or_right)\n                        subgoal\n                          apply(rule combine_assn_waitp_outrdy')\n                          by auto\n                        subgoal\n                          apply(rule combine_assn_ex_pre_right')\n                          apply(rule combine_assn_waitp_inrdy')\n                          by auto\n                        done\n                      done\n                    subgoal\n                      apply(rule combine_or_left)\n                      subgoal\n                        apply(rule combine_assn_out0_wait)\n                        by auto\n                      subgoal\n                        apply(rule combine_assn_waitp_wait')\n                        by auto\n                      done\n                    done\n                  done\n                apply(rule combine_or_left)\n                subgoal\n                  apply(rule combine_or_right)\n                  subgoal\n                    apply(rule combine_assn_ex_pre_left')\n                    apply(rule combine_assn_pure_pre_left')\n                    apply(rule combine_assn_ex_pre_right')+\n                    apply(rule combine_assn_pure_pre_right')\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_inrdy_out)\n                    subgoal by auto\n                    by auto\n                  subgoal\n                    apply(rule combine_assn_ex_pre_left')\n                    apply(rule combine_assn_pure_pre_left')\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_inrdy_out)\n                    subgoal by auto\n                    by auto\n                  done\n                apply(rule combine_or_left)\n                subgoal\n                  unfolding combine1.simps\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI1)\n                  apply(rule combine_or_right)\n                  subgoal\n                    apply(rule combine_assn_ex_pre_right')+\n                    apply(rule combine_assn_pure_pre_right')\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_inrdy_out')\n                    subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    apply(rule entails_tassn_cancel_left)\n                    apply(cases \"1\\<le>rp\")\n                    subgoal for v tt\n                      apply simp\n                      apply(rule entails_tassn_trans)\n                       prefer 2\n                       apply(rule pre(1))\n                      subgoal by auto\n                      subgoal using pre(2) unfolding propc_def by auto\n                      subgoal using pre(3) properl_p1[of p 1 2] unfolding proper_def properp_def by auto\n                      subgoal using pre(4) by auto\n                      apply(rule combine_assn_right_tran)\n                      unfolding T1_tr.simps\n                      apply(rule entails_tassn_disjI1)\n                      apply(rule entails_tassn_exI[where x=v])\n                      apply(rule entails_tassn_exI[where x=tt])\n                      by auto\n                    subgoal for v tt\n                      apply(subgoal_tac\"rn\\<noteq>1\")\n                       prefer 2\n                      subgoal using pre(2) unfolding propc_def by auto\n                      apply simp\n                      apply(rule combine_or_left)\n                      subgoal\n                        apply(rule entails_tassn_disjI1)\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_assn_out0_out2)\n                        subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                        apply(rule entails_tassn_cancel_left)\n                        apply(rule entails_tassn_trans)\n                         prefer 2\n                         apply(rule pre(1))\n                        subgoal by auto\n                        subgoal using pre(2) unfolding propc_def by auto\n                        subgoal using pre(3) unfolding proper_def properp_def by auto\n                        subgoal using pre(4) by auto\n                        apply(rule combine_assn_right_tran)\n                        unfolding T1_tr.simps\n                        apply(rule entails_tassn_disjI1)\n                        apply(rule entails_tassn_exI[where x=v])\n                        apply(rule entails_tassn_exI[where x=tt])\n                        by auto \n                      subgoal\n                        apply(rule entails_tassn_disjI2)\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_assn_waitp_out)\n                        subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                        by auto\n                      done\n                    done\n                  subgoal\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_inrdy_out')\n                    subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    apply(rule entails_tassn_cancel_left)\n                    apply(cases \"1\\<le>rp\")\n                    subgoal \n                      apply simp\n                      apply(rule entails_tassn_trans)\n                       prefer 2\n                       apply(rule pre(1))\n                      subgoal by auto\n                      subgoal using pre(2) unfolding propc_def by auto\n                      subgoal using pre(3) properl_p1[of p 1 2] unfolding proper_def properp_def by auto\n                      subgoal using pre(4) by auto\n                      apply(rule combine_assn_right_tran)\n                      unfolding T1_tr.simps\n                      apply(rule entails_tassn_disjI2)\n                      by auto\n                    subgoal \n                      apply(subgoal_tac\"rn\\<noteq>1\")\n                       prefer 2\n                      subgoal using pre(2) unfolding propc_def by auto\n                      apply simp\n                      apply(rule combine_or_left)\n                      subgoal\n                        apply(rule entails_tassn_disjI1)\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_assn_out0_out2)\n                        subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                        apply(rule entails_tassn_cancel_left)\n                        apply(rule entails_tassn_trans)\n                         prefer 2\n                         apply(rule pre(1))\n                        subgoal by auto\n                        subgoal using pre(2) unfolding propc_def by auto\n                        subgoal using pre(3) unfolding proper_def properp_def by auto\n                        subgoal using pre(4) by auto\n                        apply(rule combine_assn_right_tran)\n                        unfolding T1_tr.simps\n                        apply(rule entails_tassn_disjI2)\n                        by auto \n                      subgoal\n                        apply(rule entails_tassn_disjI2)\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_assn_waitp_out)\n                        subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                        by auto\n                      done\n                    done\n                  done\n                apply(rule combine_or_left)\n                subgoal\n                  unfolding combine1.simps\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI1)\n                  apply(rule combine_assn_ex_pre_left')\n                  apply(rule combine_assn_pure_pre_left')\n                  subgoal for v\n                    apply(rule combine_or_right)\n                    subgoal\n                      apply(rule combine_assn_ex_pre_right')+\n                      apply(rule combine_assn_pure_pre_right')\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_inrdy_out')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      subgoal for vv tt\n                        apply(rule entails_tassn_exI[where x=v])\n                        apply auto\n                        apply(rule entails_tassn_cancel_left)\n                        by(auto simp add:true_assn_def entails_tassn_def)\n                      done\n                    subgoal\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_inrdy_out')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      subgoal \n                        apply(rule entails_tassn_exI[where x=v])\n                        apply auto\n                        apply(rule entails_tassn_cancel_left)\n                        by(auto simp add:true_assn_def entails_tassn_def)\n                      done\n                    done\n                  done\n                apply(rule combine_or_left)\n                subgoal\n                  apply(rule combine_assn_ex_pre_left')\n                  subgoal for v\n                    apply(rule combine_or_right)\n                    subgoal\n                      apply(rule combine_assn_ex_pre_right')+\n                      apply(rule combine_assn_pure_pre_right')\n                      apply(rule combine_assn_inrdy_out'')\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    subgoal\n                      apply(rule combine_assn_inrdy_out'')\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    done\n                  done\n                apply(rule combine_or_left)\n                subgoal\n                  unfolding combine1.simps\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI1)\n                  apply(rule combine_assn_ex_pre_left')\n                  subgoal for v\n                    apply(rule combine_or_right)\n                    subgoal\n                      apply(rule combine_assn_ex_pre_right')+\n                      apply(rule combine_assn_pure_pre_right')\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_inrdy_out')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      subgoal for vv tt\n                        apply(cases \"0<length p\")\n                        subgoal\n                          apply(subgoal_tac\"get_max p = (1,2)\")\n                          prefer 2\n                          subgoal using pre(3) properl_p5[of p]\n                            apply auto\n                             apply(cases \"get_max p\")\n                            by (auto simp add: proper_def properp_def)\n                          apply simp\n                          apply(rule entails_tassn_exI[where x= v])\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule combine_or_left)\n                          subgoal\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_assn_out0_out2)\n                            subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                            apply(rule entails_tassn_disjI1)\n                            apply(rule entails_tassn_cancel_left)\n                            apply(rule entails_tassn_trans)\n                             prefer 2\n                             apply(rule pre(1))\n                            subgoal by auto\n                            subgoal using pre(2) unfolding propc_def by auto\n                            subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                            subgoal using pre(4) by auto\n                            apply(rule combine_assn_right_tran)\n                            unfolding T1_tr.simps\n                            apply(rule entails_tassn_disjI1)\n                            apply(rule entails_tassn_exI[where x=vv])\n                            apply(rule entails_tassn_exI[where x=tt])\n                            by auto \n                          subgoal\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_assn_waitp_out)\n                            subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                            apply(rule entails_tassn_disjI2)\n                            by auto\n                          done\n                        subgoal\n                          apply simp\n                          apply(rule entails_tassn_exI[where x=v])\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule entails_tassn_trans)\n                          prefer 2\n                           apply(rule pre(1))\n                          subgoal by auto\n                          subgoal using pre(2) unfolding propc_def by auto\n                          subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                          subgoal using pre(4) by auto\n                          apply(rule combine_assn_right_tran)\n                          unfolding T1_tr.simps\n                          apply(rule entails_tassn_disjI1)\n                          apply(rule entails_tassn_exI[where x=vv])\n                          apply(rule entails_tassn_exI[where x=tt])\n                          by auto \n                        done\n                      done\n                    subgoal\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_inrdy_out')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      subgoal \n                        apply(cases \"0<length p\")\n                        subgoal\n                          apply(subgoal_tac\"get_max p = (1,2)\")\n                          prefer 2\n                          subgoal using pre(3) properl_p5[of p]\n                            apply auto\n                             apply(cases \"get_max p\")\n                            by (auto simp add: proper_def properp_def)\n                          apply simp\n                          apply(rule entails_tassn_exI[where x= v])\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule combine_or_left)\n                          subgoal\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_assn_out0_out2)\n                            subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                            apply(rule entails_tassn_disjI1)\n                            apply(rule entails_tassn_cancel_left)\n                            apply(rule entails_tassn_trans)\n                             prefer 2\n                             apply(rule pre(1))\n                            subgoal by auto\n                            subgoal using pre(2) unfolding propc_def by auto\n                            subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                            subgoal using pre(4) by auto\n                            apply(rule combine_assn_right_tran)\n                            unfolding T1_tr.simps\n                            apply(rule entails_tassn_disjI2)                            \n                            by auto \n                          subgoal\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_assn_waitp_out)\n                            subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                            apply(rule entails_tassn_disjI2)\n                            by auto\n                          done\n                        subgoal\n                          apply simp\n                          apply(rule entails_tassn_exI[where x=v])\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule entails_tassn_trans)\n                          prefer 2\n                           apply(rule pre(1))\n                          subgoal by auto\n                          subgoal using pre(2) unfolding propc_def by auto\n                          subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                          subgoal using pre(4) by auto\n                          apply(rule combine_assn_right_tran)\n                          unfolding T1_tr.simps\n                          apply(rule entails_tassn_disjI2)                         \n                          by auto \n                        done\n                      done\n                    done\n                  done\n                apply(rule combine_or_left)\n                subgoal\n                  apply(rule combine_assn_ex_pre_left')\n                  subgoal for v\n                    apply(rule combine_or_right)\n                    subgoal\n                      apply(rule combine_assn_ex_pre_right')+\n                      apply(rule combine_assn_pure_pre_right')\n                      apply(rule combine_assn_inrdy_out'')\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    subgoal\n                      apply(rule combine_assn_inrdy_out'')\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    done\n                  done\n                subgoal\n                  unfolding combine1.simps\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule combine_assn_ex_pre_left')\n                  subgoal for v\n                    apply(rule combine_or_right)\n                    subgoal\n                      apply(rule combine_assn_ex_pre_right')+\n                      apply(rule combine_assn_pure_pre_right')\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_inrdy_out')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      subgoal for vv tt\n                        apply(rule entails_tassn_exI[where x = v])\n                        apply(rule entails_tassn_cancel_left)\n                        apply(rule entails_tassn_trans)\n                          prefer 2\n                           apply(rule pre(1))\n                          subgoal by auto\n                          subgoal using pre(2) unfolding propc_def by auto\n                          subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                          subgoal using pre(4) by auto\n                          apply simp\n                          apply(rule combine_assn_right_tran)\n                          unfolding T1_tr.simps\n                          apply(rule entails_tassn_disjI1)\n                          apply(rule entails_tassn_exI[where x=vv])\n                          apply(rule entails_tassn_exI[where x=tt])\n                          by auto \n                        done\n                    subgoal\n                       apply(rule entails_tassn_trans)\n                       apply(rule combine_assn_inrdy_out')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                      subgoal \n                        apply(rule entails_tassn_exI[where x = v])\n                        apply(rule entails_tassn_cancel_left)\n                        apply(rule entails_tassn_trans)\n                          prefer 2\n                           apply(rule pre(1))\n                          subgoal by auto\n                          subgoal using pre(2) unfolding propc_def by auto\n                          subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                          subgoal using pre(4) by auto\n                          apply simp\n                          apply(rule combine_assn_right_tran)\n                          unfolding T1_tr.simps\n                          apply(rule entails_tassn_disjI2)                       \n                          by auto \n                        done\n                      done\n                    done\n                  done\n\n\n\n\n\n\n        apply (simp only: SCH_tr.simps T1_tr.simps)\n          subgoal premises pre\n            apply(rule combine_or_left)\n            subgoal \n              apply(rule combine_or_right)\n              subgoal\n                apply(rule combine_assn_ex_pre_right')+\n                apply(rule combine_assn_pure_pre_right')\n                apply(rule combine_assn_inrdy_waitin)\n                by auto\n              subgoal\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_wait)\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                apply(rule entails_tassn_cancel_both)\n                subgoal by auto\n                apply(rule combine_or_right)\n                subgoal\n                  apply(rule combine_assn_inrdy_outrdy'')\n                  subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                  done\n                subgoal\n                  apply(rule combine_assn_ex_pre_right')\n                  apply(rule combine_assn_inrdy_inrdy)\n                  subgoal by auto\n                  done\n                done\n              done\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule combine_assn_pure_pre_left')\n              apply(rule combine_or_right)\n              subgoal for v\n                apply(rule combine_assn_ex_pre_right')+\n                apply(rule combine_assn_pure_pre_right')\n                apply(rule combine_assn_inrdy_waitin)\n                by auto\n              subgoal for v\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_wait)\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_cancel_both)\n                subgoal by auto\n                apply(rule combine_or_right)\n                subgoal\n                  apply(rule combine_assn_inrdy_outrdy'')\n                  subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                  done\n                subgoal\n                  apply(rule combine_assn_ex_pre_right')\n                  apply(rule combine_assn_inrdy_inrdy)\n                  by auto\n                done\n              done\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule combine_or_right)\n              subgoal\n                apply(rule combine_assn_ex_pre_right')+\n                apply(rule combine_assn_pure_pre_right')\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_waitin')\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI1)\n                apply(rule ex_tran)\n                apply(subgoal_tac\"rp = 2 \\<and> rn = 1\")\n                 prefer 2\n                subgoal using pre(2,3)\n                  unfolding propc_def proper_def properp_def \n                  by auto\n                apply (auto simp add:T_def C_def)\n                apply(rule entails_tassn_cancel_left)\n                apply(rule entails_tassn_trans)\n                 prefer 2\n                 apply(rule pre(1))\n                subgoal by auto\n                subgoal using pre(2) unfolding propc_def by auto\n                subgoal using pre(3) properl_p1[of p 1 2] unfolding proper_def properp_def by auto\n                subgoal using pre(4) unfolding inv_s_def T_def C_def by auto\n                apply(rule combine_assn_right_tran)\n                unfolding T1_tr.simps\n                subgoal for v tt tta\n                  apply(rule entails_tassn_disjI1)\n                  apply(rule entails_tassn_exI[where x=v])\n                  apply(rule entails_tassn_exI[where x=\"tt-tta\"])\n                  apply(auto simp add:C_def T_def C_upd_def)\n                  subgoal\n                    apply(rule entails_tassn_cancel_right)\n                    subgoal premises pre'\n                    proof-\n                      have \"(\\<lambda>t. EState\n                          (Task RUNNING eone 2, ts\n                          (CHR ''t'' := ts CHR ''t'' + tta + t, CHR ''c'' := tta + t)))\n                          = (\\<lambda>t. EState\n                          (Task RUNNING eone 2, ts\n                          (CHR ''t'' := ts CHR ''t'' + (t + tta), CHR ''c'' := t + tta)))\"\n                        apply(rule ext)\n                        by auto\n                      then show ?thesis\n                        by auto\n                    qed\n                    done\n                  subgoal\n                    apply(rule entails_tassn_cancel_right)\n                    subgoal premises pre'\n                    proof-\n                      have \"(\\<lambda>t. EState\n           (Task RUNNING eone 2, ts\n            (CHR ''t'' := ts CHR ''t'' + tta + t, CHR ''c'' := ts CHR ''c'' + tta + t)))\n                          = (\\<lambda>t. EState\n           (Task RUNNING eone 2, ts\n            (CHR ''t'' := ts CHR ''t'' + (t + tta),CHR ''c'' := ts CHR ''c'' + (t + tta))))\"\n                        apply(rule ext)\n                        by auto\n                      then show ?thesis\n                        by auto\n                    qed\n                    done\n                  done\n                done\n              subgoal\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_wait')\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                apply(rule entails_tassn_disjE)\n                subgoal\n                  apply(subgoal_tac\"rp = 2 \\<and> rn = 1\")\n                   prefer 2\n                  subgoal using pre(2,3)\n                  unfolding propc_def proper_def properp_def \n                  by auto\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_exI[where x=\"min (9 / 200 - ts T) (1 / 100 - C_upd ent (ts C))\"])\n                apply auto\n                apply(subgoal_tac\"ts T * 200 \\<le> 9 \\<and> C_upd ent (ts C) * 100 \\<le> 1\")\n                 prefer 2\n                subgoal using pre(4) unfolding inv_s_def C_upd_def by auto\n                apply auto\n                apply(simp add:waitin_assn_decomp join_assoc)\n                  apply(rule entails_tassn_cancel_left)\n                apply(rule combine_or_right)\n                subgoal\n                  apply(rule entails_tassn_trans)\n                  apply(rule combine_assn_inrdy_outrdy')\n                  subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                  apply(rule entails_tassn_cancel_left)\n                  apply(rule entails_tassn_trans)\n                   prefer 2\n                   apply(rule pre(1))\n                  subgoal by auto\n                  subgoal using pre(2) unfolding propc_def by auto\n                  subgoal using pre(3) properl_p1[of p 1 2] unfolding proper_def properp_def by auto\n                  subgoal using pre(4) unfolding inv_s_def \n                    apply(cases \"(9 / 200 - ts T) \\<le> (1 / 100 - C_upd ent (ts C))\")\n                    subgoal by(auto simp add:T_def C_def)\n                    subgoal by(auto simp add:T_def C_def)\n                    done\n                  apply(rule combine_assn_right_tran)\n                  unfolding T1_tr.simps\n                  apply(rule entails_tassn_disjI2)\n                  apply(cases \"(9 / 200 - ts T) \\<le> (1 / 100 - C_upd ent (ts C))\")\n                  subgoal apply (auto simp add:T_def C_def C_upd_def)\n                    subgoal apply(rule entails_tassn_disjI1) by auto\n                    subgoal apply(rule entails_tassn_disjI1) by auto\n                    done\n                  subgoal apply (auto simp add:T_def C_def C_upd_def)\n                    subgoal apply(rule entails_tassn_disjI1) by auto\n                    subgoal apply(rule entails_tassn_disjI1) by auto\n                    done\n                  done\n                apply(rule combine_assn_ex_pre_right')\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_inrdy')\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                  apply(rule entails_tassn_cancel_left)\n                  apply(rule entails_tassn_trans)\n                   prefer 2\n                   apply(rule pre(1))\n                  subgoal by auto\n                  subgoal using pre(2) unfolding propc_def by auto\n                  subgoal using pre(3) properl_p1[of p 1 2] unfolding proper_def properp_def by auto\n                  subgoal using pre(4) unfolding inv_s_def \n                    apply(cases \"(9 / 200 - ts T) \\<le> (1 / 100 - C_upd ent (ts C))\")\n                    subgoal by(auto simp add:T_def C_def)\n                    subgoal by(auto simp add:T_def C_def)\n                    done\n                  apply(rule combine_assn_right_tran)\n                  unfolding T1_tr.simps\n                  apply(rule entails_tassn_disjI2)\n                  apply(cases \"(9 / 200 - ts T) \\<le> (1 / 100 - C_upd ent (ts C))\")\n                  subgoal for v apply (auto simp add:T_def C_def C_upd_def)\n                    subgoal apply(rule entails_tassn_disjI2) apply(rule entails_tassn_exI[where x= v]) by auto\n                    subgoal apply(rule entails_tassn_disjI2) apply(rule entails_tassn_exI[where x= v]) by auto\n                    done\n                  subgoal for v apply (auto simp add:T_def C_def C_upd_def)\n                    subgoal apply(rule entails_tassn_disjI2) apply(rule entails_tassn_exI[where x= v]) by auto\n                    subgoal apply(rule entails_tassn_disjI2) apply(rule entails_tassn_exI[where x= v]) by auto\n                    done\n                  done\n                subgoal\n                  unfolding combine1.simps\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule entails_tassn_disjI1)\n                  apply(rule ex_tran)\n                  apply(subgoal_tac\"rp = 2 \\<and> rn = 1\")\n                   prefer 2\n                  subgoal using pre(2,3)\n                  unfolding propc_def proper_def properp_def \n                  by auto\n                  apply auto\n                  apply(rule entails_tassn_cancel_left)\n                  apply(rule entails_tassn_trans)\n                   prefer 2\n                   apply(rule pre(1))\n                  subgoal by auto\n                  subgoal using pre(2) unfolding propc_def by auto\n                  subgoal using pre(3) properl_p1[of p 1 2] unfolding proper_def properp_def by auto\n                  subgoal using pre(4) unfolding inv_s_def C_def T_def by auto\n                  apply(rule combine_assn_right_tran)\n                  unfolding T1_tr.simps\n                  apply(rule entails_tassn_disjI2)\n                  apply (auto simp add:T_def C_def)\n                  apply(rule entails_tassn_cancel_both) \n                  subgoal premises pre' for tt\n                  proof-\n                    have 1:\"(min (9 / 200 - (ts CHR ''t'' + tt))\n                      (1 / 100 - (C_upd ent (ts CHR ''c'') + tt))) = \n                    (min (9 / 200 - ts CHR ''t'') (1 / 100 - C_upd ent (ts CHR ''c'')) - tt)\"\n                      by(auto simp add: C_upd_def)\n                    have 2:\"(\\<lambda>\\<tau>. EState\n           (Task RUNNING eone 2, ts\n            (CHR ''t'' := ts CHR ''t'' + tt + \\<tau>,\n             CHR ''c'' := (C_upd ent (ts CHR ''c'') + tt) + \\<tau>))) = \n                            (\\<lambda>t. EState\n           (Task RUNNING eone 2, ts\n            (CHR ''t'' := ts CHR ''t'' + (t + tt),\n             CHR ''c'' := C_upd ent (ts CHR ''c'') + (t + tt))))\"\n                      apply(rule ext)\n                      by(auto simp add: C_upd_def)\n                    show ?thesis\n                      by(simp add:1 2)\n                  qed\n                  apply(rule entails_tassn_disjE)\n                  subgoal for tt\n                    apply(rule entails_tassn_disjI1)\n                    subgoal premises pre'\n                    proof-\n                      have \"ts\n       (CHR ''t'' :=\n         ts CHR ''t'' +\n         min (9 / 200 - ts CHR ''t'') (1 / 100 - C_upd ent (ts CHR ''c'')),\n       CHR ''c'' :=\n         C_upd ent (ts CHR ''c'') +\n         min (9 / 200 - ts CHR ''t'') (1 / 100 - C_upd ent (ts CHR ''c'')))\n                    =     ts\n      (CHR ''t'' :=\n         ts CHR ''t'' + tt +\n         min (9 / 200 - (ts CHR ''t'' + tt)) (1 / 100 - (C_upd ent (ts CHR ''c'') + tt)),\n       CHR ''c'' :=\n         C_upd ent (ts CHR ''c'') + tt +\n         min (9 / 200 - (ts CHR ''t'' + tt))\n          (1 / 100 - (C_upd ent (ts CHR ''c'') + tt))) \"\n                        apply(rule ext)\n                        by auto\n                      then show ?thesis by auto\n                    qed\n                    done\n                  apply(rule entails_tassn_disjI2)\n                  apply(rule ex_tran)\n                  subgoal premises pre' for tt v\n                  proof-\n                    have \"ts (CHR ''t'' :=\n         ts CHR ''t'' +\n         min (9 / 200 - ts CHR ''t'') (1 / 100 - C_upd ent (ts CHR ''c'')),\n       CHR ''c'' :=\n         C_upd ent (ts CHR ''c'') +\n         min (9 / 200 - ts CHR ''t'') (1 / 100 - C_upd ent (ts CHR ''c''))) = \n                          ts (CHR ''t'' :=\n         ts CHR ''t'' + tt +\n         min (9 / 200 - (ts CHR ''t'' + tt)) (1 / 100 - (C_upd ent (ts CHR ''c'') + tt)),\n       CHR ''c'' :=\n         C_upd ent (ts CHR ''c'') + tt +\n         min (9 / 200 - (ts CHR ''t'' + tt))\n          (1 / 100 - (C_upd ent (ts CHR ''c'') + tt)))\"\n                      apply(rule ext)\n                      apply auto\n                      done\n                    then show ?thesis\n                      by(auto simp add: F_def)\n                  qed\n                  done\n                done\n              done\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule combine_assn_pure_pre_left')\n              apply(rule combine_or_right)\n              subgoal for v\n                apply(rule combine_assn_ex_pre_right')+\n                apply(rule combine_assn_pure_pre_right')\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_waitin')\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI1)\n                apply(rule ex_tran)\n                apply(rule entails_tassn_exI[where x=v])\n                apply auto\n                apply(rule entails_tassn_cancel_left)\n                by(auto simp add:entails_tassn_def true_assn_def)\n              subgoal for v\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI2)\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_wait')\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                apply(rule entails_tassn_disjE)\n                subgoal\n                  apply(rule entails_tassn_exI[where x=\"min (45 / 10 ^ 3 - ts T) (1 / 10\\<^sup>2 - C_upd ent (ts C))\"])\n                  apply(rule entails_tassn_exI[where x=v])\n                  apply auto\n                  apply(subgoal_tac\"ts T * 200 \\<le> 9 \\<and> C_upd ent (ts C) * 100 \\<le> 1\")\n                   prefer 2\n                  subgoal using pre(4) unfolding inv_s_def\n                    apply auto\n                    apply(cases ent)\n                    by(auto simp add:C_upd_def)\n                  apply auto\n                  apply(simp add: waitin_assn_decomp join_assoc)\n                  apply(rule entails_tassn_cancel_left)\n                  apply(rule combine_or_right)\n                  subgoal\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_inrdy_outrdy')\n                    subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    apply(rule entails_tassn_cancel_left)\n                    by(auto simp add:entails_tassn_def true_assn_def)\n                  subgoal\n                    apply(rule combine_assn_ex_pre_right')\n                    apply(rule entails_tassn_trans)\n                    apply(rule combine_assn_inrdy_inrdy')\n                    subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    apply(rule entails_tassn_cancel_left)\n                    by(auto simp add:entails_tassn_def true_assn_def)\n                  done\n                subgoal\n                  apply(rule ex_tran)\n                  apply(rule entails_tassn_exI[where x=v])\n                  apply auto\n                  apply(rule entails_tassn_cancel_left)\n                  by(auto simp add:entails_tassn_def true_assn_def)\n                done\n              done\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule combine_or_right)\n              subgoal for v\n                apply(rule combine_assn_ex_pre_right')+\n                apply(rule combine_assn_pure_pre_right')\n                apply(rule combine_assn_inrdy_waitin)\n                by auto\n              subgoal for v\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_wait)\n                subgoal by auto\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_cancel_both)\n                subgoal by auto\n                apply(rule combine_or_right)\n                subgoal\n                  apply(rule entails_tassn_trans)\n                   apply(rule combine_assn_inrdy_outrdy)\n                  subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                  apply(cases \"length p > 0\")\n                  subgoal\n                    apply(subgoal_tac\"get_max p =(1,2)\")\n                     prefer 2\n                    subgoal using pre(3) properl_p5[of p]\n                      unfolding propc_def proper_def properp_def\n                      by (metis estate.sel(1) insert_iff less_minus_one_simps(3) prod.exhaust_sel singletonD)\n                    apply auto\n                    apply(rule combine_or_left)\n                    subgoal\n                      apply(rule entails_tassn_disjI1)\n                      apply(cases nt')\n                      subgoal apply auto\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_assn_out0_emp')\n                        subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                        apply(rule entails_tassn_cancel_left)\n                        apply(rule entails_tassn_trans)\n                         prefer 2\n                         apply(rule pre(1))\n                        subgoal by auto\n                        subgoal using pre(2) unfolding propc_def by auto\n                        subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                        subgoal using pre(4) unfolding inv_s_def C_def T_def \n                          apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                          by auto\n                        by auto\n                      subgoal for nt''\n                        apply(simp only:T1_tr.simps)\n                        apply(cases \"(9 / 200 -\n        (ts(T := ts T + min (9 / 200 - ts T) (1 / 100 - C_upd ent (ts C)),\n            C := C_upd ent (ts C) + min (9 / 200 - ts T) (1 / 100 - C_upd ent (ts C))))\n         T) > 0\")\n                        subgoal\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_assn_out0_wait')\n                          subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule entails_tassn_trans)\n                           prefer 2\n                           apply(rule pre(1))\n                          subgoal by auto\n                          subgoal using pre(2) unfolding propc_def by auto\n                          subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                          subgoal using pre(4) unfolding inv_s_def C_def T_def \n                          apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                            by auto\n                          by auto\n                        apply (auto simp add:T_def C_def)\n                        apply(cases nt'')\n                        subgoal\n                          apply simp\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_assn_out0_emp')\n                          subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule entails_tassn_trans)\n                           prefer 2\n                           apply(rule pre(1))\n                          subgoal by auto\n                          subgoal using pre(2) unfolding propc_def by auto\n                          subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                          subgoal using pre(4) unfolding inv_s_def C_def T_def \n                            apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                            by auto\n                          apply(rule combine_assn_right_tran)\n                          unfolding T1_tr.simps\n                          by (auto simp add:C_def T_def)\n                        subgoal for nt'''\n                          apply(simp only:T1_tr.simps)\n                          apply(rule combine_or_right)\n                          subgoal\n                            apply(rule combine_assn_ex_pre_right')+\n                            apply(rule combine_assn_pure_pre_right')\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_assn_out0_out2)\n                            subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule entails_tassn_trans)\n                           prefer 2\n                           apply(rule pre(1))\n                          subgoal by auto\n                          subgoal using pre(2) unfolding propc_def by auto\n                          subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                          subgoal using pre(4) unfolding inv_s_def C_def T_def \n                            apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                            by auto\n                          apply(rule combine_assn_right_tran)\n                          unfolding T1_tr.simps\n                          apply (auto simp add:C_def T_def)\n                          apply(rule entails_tassn_disjI1)\n                          subgoal for vv tt\n                            apply(rule entails_tassn_exI[where x=vv])\n                            apply(rule entails_tassn_exI[where x=tt])\n                            by auto\n                          done\n                        subgoal\n                          apply(rule entails_tassn_trans)\n                             apply(rule combine_assn_out0_out2)\n                            subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                          apply(rule entails_tassn_cancel_left)\n                          apply(rule entails_tassn_trans)\n                           prefer 2\n                           apply(rule pre(1))\n                          subgoal by auto\n                          subgoal using pre(2) unfolding propc_def by auto\n                          subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                          subgoal using pre(4) unfolding inv_s_def C_def T_def \n                            apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                            by auto\n                          apply(rule combine_assn_right_tran)\n                          unfolding T1_tr.simps\n                          apply (auto simp add:C_def T_def)\n                          apply(rule entails_tassn_disjI2)\n                          by auto\n                        done\n                      done\n                    done\n                  subgoal\n                    apply(rule entails_tassn_disjI2)\n                    apply(cases nt')\n                    subgoal\n                      apply simp\n                      apply(simp add: combine_assn_waitp_emp)\n                      done\n                    subgoal for nt''\n                      apply (simp only:T1_tr.simps)\n                      apply(cases \"(9 / 200 -\n        (ts(T := ts T + min (9 / 200 - ts T) (1 / 100 - C_upd ent (ts C)),\n            C := C_upd ent (ts C) + min (9 / 200 - ts T) (1 / 100 - C_upd ent (ts C))))\n         T) > 0\")\n                      subgoal\n                        apply (simp add:T_def C_def)\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_assn_waitp_wait)\n                        subgoal by auto\n                        apply(rule entails_tassn_disjI1)\n                        by auto\n                      subgoal\n                        apply (simp add:T_def C_def)\n                        apply(cases nt'')\n                        subgoal\n                          apply simp\n                          apply(simp add: combine_assn_waitp_emp)\n                          done\n                        subgoal for nt'''\n                          apply(simp only:T1_tr.simps)\n                          apply(rule combine_or_right)\n                          subgoal\n                            apply(rule combine_assn_ex_pre_right')+\n                            apply(rule combine_assn_pure_pre_right')\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_assn_waitp_out)\n                            subgoal by auto\n                            apply(rule entails_tassn_disjI2)\n                            by auto\n                          subgoal\n                            apply(rule entails_tassn_trans)\n                            apply(rule combine_assn_waitp_out)\n                            subgoal by auto\n                            apply(rule entails_tassn_disjI2)\n                            by auto\n                          done\n                        done\n                      done\n                    done\n                  done\n                subgoal\n                  apply auto\n                  apply(rule entails_tassn_trans)\n                   prefer 2\n                   apply(rule pre(1))\n                  subgoal by auto\n                  subgoal using pre(2) unfolding propc_def by auto\n                  subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                  subgoal using pre(4) unfolding inv_s_def C_def T_def \n                    apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                    by auto\n                  by auto\n                done\n              subgoal\n                apply(rule combine_assn_ex_pre_right')\n                apply(rule combine_assn_inrdy_inrdy)\n                by auto\n              done\n            done\n          apply(rule combine_or_left)\n          subgoal\n            unfolding combine1.simps\n            apply(rule entails_tassn_disjI2)\n            apply(rule entails_tassn_disjI2)\n            apply(rule entails_tassn_disjI2)\n            apply(rule entails_tassn_disjI1)\n            apply(rule combine_assn_ex_pre_left')\n            apply(rule combine_or_right)\n            subgoal for v\n              apply(rule combine_assn_ex_pre_right')+\n              apply(rule combine_assn_pure_pre_right')\n              apply(rule entails_tassn_trans)\n               apply(rule combine_assn_inrdy_waitin')\n              subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n              apply(rule ex_tran)\n              apply(rule entails_tassn_exI[where x= v])\n              apply auto\n                subgoal\n                  apply(rule entails_tassn_cancel_left) \n                  by(auto simp add:true_assn_def entails_tassn_def)\n                subgoal\n                  apply(rule entails_tassn_cancel_left) \n                  by(auto simp add:true_assn_def entails_tassn_def)\n                subgoal\n                  apply(rule entails_tassn_cancel_left) \n                  by(auto simp add:true_assn_def entails_tassn_def)\n                done\n              subgoal for v\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_wait')\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                apply(rule entails_tassn_disjE)\n                subgoal\n                  apply(rule entails_tassn_exI[where x= \"(min (45 / 10 ^ 3 - ts T) (1 / 10\\<^sup>2 - C_upd ent (ts C)))\"])\n                  apply(rule entails_tassn_exI[where x= v])\n                  apply(rule entails_tassn_conj)\n                  subgoal\n                    using pre(4)\n                    unfolding inv_s_def entails_tassn_def pure_assn_def C_upd_def\n                    apply(cases ent)\n                    by auto\n                  apply(simp only:waitin_assn_decomp join_assoc)\n                  apply(rule entails_tassn_cancel_both)\n                  subgoal by auto\n                  apply(rule combine_or_right)\n                  subgoal\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_inrdy_outrdy')\n                    subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    apply(rule entails_tassn_cancel_left)\n                    by(auto simp add:entails_tassn_def true_assn_def)\n                  apply(rule combine_assn_ex_pre_right')\n                  apply(rule entails_tassn_trans)\n                   apply(rule combine_assn_inrdy_inrdy')\n                  subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    apply(rule entails_tassn_cancel_left)\n                  by(auto simp add:entails_tassn_def true_assn_def)\n                subgoal\n                  apply(rule ex_tran)\n                  apply(rule entails_tassn_exI[where x=v])\n                  apply(rule entails_tassn_conj)\n                  subgoal by auto\n                  apply(simp only:pure_assn_entails)\n                  apply(rule impI)\n                  apply(rule entails_tassn_cancel_both) \n                  subgoal by auto\n                  by auto\n                done\n              done\n            apply(rule combine_or_left)\n            subgoal\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule combine_or_right)\n              subgoal for v\n                apply(rule combine_assn_ex_pre_right')+\n                apply(rule combine_assn_pure_pre_right')\n                apply(rule combine_assn_inrdy_waitin)\n                subgoal by auto\n                done\n              subgoal for v\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_wait)\n                subgoal by auto\n                unfolding combine1.simps\n                apply(rule entails_tassn_disjI1)\n                apply(rule entails_tassn_cancel_both)\n                subgoal by auto\n                apply(rule combine_or_right)\n                subgoal\n                  apply(rule combine_assn_inrdy_outrdy'')\n                  subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                  done\n                subgoal\n                  apply(rule combine_assn_ex_pre_right')\n                  apply(rule combine_assn_inrdy_inrdy)\n                  by auto\n                done\n              done\n            subgoal\n              unfolding combine1.simps\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule entails_tassn_disjI2)\n              apply(rule combine_assn_ex_pre_left')\n              apply(rule combine_or_right)\n              subgoal for v\n                apply(rule combine_assn_ex_pre_right')+\n                apply(rule combine_assn_pure_pre_right')\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_waitin')\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                apply(rule ex_tran)\n                apply(rule entails_tassn_exI[where x=v])\n                apply auto\n                apply(rule entails_tassn_cancel_left)\n                apply(rule entails_tassn_trans)\n                   prefer 2\n                   apply(rule pre(1))\n                  subgoal by auto\n                  subgoal using pre(2) unfolding propc_def by auto\n                  subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                  subgoal using pre(4) unfolding inv_s_def C_def T_def \n                    apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                    by auto\n                  apply(subgoal_tac\"rp = 2 \\<and> rn = 1\")\n                   prefer 2\n                  subgoal using pre(2,3)\n                  unfolding propc_def proper_def properp_def \n                  by auto\n                  apply(simp add:T_def C_def)\n                apply(rule combine_assn_right_tran)\n                apply(rule entails_tassn_disjI1)\n                subgoal for v tt tta\n                  apply(rule entails_tassn_exI[where x= v])\n                  apply(rule entails_tassn_exI[where x= \"tt-tta\"])\n                  apply auto\n                  subgoal premises pre'\n                  proof-\n                    have \"(\\<lambda>t. EState\n           (Task RUNNING eone 2, ts\n            (CHR ''t'' := ts CHR ''t'' + tta + t,\n             CHR ''c'' := C_upd ent (ts CHR ''c'') + tta + t))) = \n                          (\\<lambda>t. EState\n           (Task RUNNING eone 2, ts\n            (CHR ''t'' := ts CHR ''t'' + (t + tta),\n             CHR ''c'' := C_upd ent (ts CHR ''c'') + (t + tta))))\"\n                      apply (rule ext)\n                      by auto\n                    then show ?thesis\n                      by auto\n                  qed\n                  done\n                done\n              subgoal for v\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_assn_inrdy_wait')\n                subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                apply auto\n                apply(rule entails_tassn_disjE)\n                subgoal\n                  apply(rule entails_tassn_exI[where x=\"(min (9 / 200 - ts T) (1 / 100 - C_upd ent (ts C)))\"])\n                  apply(rule entails_tassn_exI[where x=v])\n                  apply auto\n                  apply(subgoal_tac\"ts T * 200 \\<le> 9 \\<and> C_upd ent (ts C) * 100 \\<le> 1\")\n                   prefer 2\n                  subgoal using pre(4) unfolding inv_s_def C_upd_def\n                    apply(cases ent)\n                    by auto\n                  apply(simp add:waitin_assn_decomp join_assoc)\n                  apply(rule entails_tassn_cancel_left)\n                  apply(rule combine_or_right)\n                  subgoal\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_inrdy_outrdy')\n                    subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    apply(rule entails_tassn_cancel_left)\n                    apply(rule entails_tassn_trans)\n                     prefer 2\n                     apply(rule pre(1))\n                    subgoal by auto\n                    subgoal using pre(2) unfolding propc_def by auto\n                    subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                    subgoal using pre(4) unfolding inv_s_def C_def T_def \n                      apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                      by auto\n                    apply(subgoal_tac\"rp = 2 \\<and> rn = 1\")\n                     prefer 2\n                    subgoal using pre(2,3)\n                      unfolding propc_def proper_def properp_def \n                      by auto\n                    apply(simp add:T_def C_def)\n                    apply(rule combine_assn_right_tran)\n                    apply(rule entails_tassn_disjI2)\n                    apply(rule entails_tassn_disjI1)\n                    apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                    by auto\n                  subgoal\n                    apply(rule combine_assn_ex_pre_right')\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_assn_inrdy_inrdy')\n                    subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def)\n                    apply(rule entails_tassn_cancel_left)\n                    apply(rule entails_tassn_trans)\n                     prefer 2\n                     apply(rule pre(1))\n                    subgoal by auto\n                    subgoal using pre(2) unfolding propc_def by auto\n                    subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                    subgoal using pre(4) unfolding inv_s_def C_def T_def \n                      apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                      by auto\n                    apply(subgoal_tac\"rp = 2 \\<and> rn = 1\")\n                     prefer 2\n                    subgoal using pre(2,3)\n                      unfolding propc_def proper_def properp_def \n                      by auto\n                    apply(simp add:T_def C_def)\n                    apply(rule combine_assn_right_tran)\n                    apply(rule entails_tassn_disjI2)\n                    apply(rule entails_tassn_disjI2)\n                    subgoal for vv\n                      apply(rule entails_tassn_exI[where x=vv])\n                      apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                      by auto\n                    done\n                  done\n                subgoal\n                  apply(rule ex_tran)\n                  apply(rule entails_tassn_exI[where x=v])\n                  apply auto\n                  apply(rule entails_tassn_cancel_left)\n                  apply(rule entails_tassn_trans)\n                   prefer 2\n                   apply(rule pre(1))\n                  subgoal by auto\n                  subgoal using pre(2) unfolding propc_def by auto\n                  subgoal using pre(3) properl_p4[of p 2] unfolding proper_def properp_def by auto\n                    subgoal using pre(4) unfolding inv_s_def C_def T_def \n                      apply(cases \"(9 / 200 - ts CHR ''t'') \\<le> (1 / 100 - C_upd ent (ts CHR ''c''))\")\n                      by auto\n                    apply(subgoal_tac\"rp = 2 \\<and> rn = 1\")\n                     prefer 2\n                    subgoal using pre(2,3)\n                      unfolding propc_def proper_def properp_def \n                      by auto\n                    apply(simp add:T_def C_def)\n                    apply(rule combine_assn_right_tran)\n                    apply(rule entails_tassn_disjI2)\n                    apply auto\n                    apply(rule entails_tassn_cancel_both)\n                    subgoal premises pre' for tt\n                    proof-\n                      have 1:\"(\\<lambda>\\<tau>. EState\n           (Task RUNNING eone 2, ts\n            (CHR ''t'' := ts CHR ''t'' + tt + \\<tau>,\n             CHR ''c'' := C_upd ent (ts CHR ''c'') + tt + \\<tau>))) =\n                            (\\<lambda>t. EState\n           (Task RUNNING eone 2, ts\n            (CHR ''t'' := ts CHR ''t'' + (t + tt),\n             CHR ''c'' := C_upd ent (ts CHR ''c'') + (t + tt))))\"\n                        apply (rule ext)\n                        by auto\n                      have 2:\"(min (9 / 200 - (ts CHR ''t'' + tt))\n             (1 / 100 - (C_upd ent (ts CHR ''c'') + tt))) =\n              (min (9 / 200 - ts CHR ''t'') (1 / 100 - C_upd ent (ts CHR ''c'')) - tt)\"\n                        by auto\n                      show ?thesis\n                        using 1 2 \n                        by auto\n                    qed\n                    subgoal premises pre' for tt\n                    proof-\n                      have \"ts\n             (CHR ''t'' :=\n                ts CHR ''t'' + tt +\n                min (9 / 200 - (ts CHR ''t'' + tt))\n                 (1 / 100 - (C_upd ent (ts CHR ''c'') + tt)),\n              CHR ''c'' :=\n                C_upd ent (ts CHR ''c'') + tt +\n                min (9 / 200 - (ts CHR ''t'' + tt))\n                 (1 / 100 - (C_upd ent (ts CHR ''c'') + tt))) = ts\n       (CHR ''t'' :=\n          ts CHR ''t'' +\n          min (9 / 200 - ts CHR ''t'') (1 / 100 - C_upd ent (ts CHR ''c'')),\n        CHR ''c'' :=\n          C_upd ent (ts CHR ''c'') +\n          min (9 / 200 - ts CHR ''t'') (1 / 100 - C_upd ent (ts CHR ''c'')))\"\n                        apply(rule ext)\n                        by auto\n                      then show ?thesis\n                        by simp\n                    qed\n                    done\n                  done\n                done\n              done\n            done\n          done\n        done\n    qed\n\n\n\n\n\nend", "meta": {"author": "AgHHL", "repo": "lics2023", "sha": "e2ea9c15a8c0e1bf658679274ee87f30baf4abc3", "save_path": "github-repos/isabelle/AgHHL-lics2023", "path": "github-repos/isabelle/AgHHL-lics2023/lics2023-e2ea9c15a8c0e1bf658679274ee87f30baf4abc3/case2/combine1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3271451523403124}}
{"text": "theory flash108Bra  imports flash108Rev\n \n  begin\nlemma onInv108:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv108 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv108 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv108 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash108Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7217432062975979, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.3271386594789993}}
{"text": "theory Proof_1\n  imports trafficLights Requirements VCTheoryLemmas\nbegin\n\nlemma minimalRed_not_vc3: \"toEnvP s1 \\<and> substate s1 s \\<and> toEnvNum emptyState s1 > MINIMAL_RED_TIME_LIMIT \\<and>\ngetPstate s1 Ctrl = minimalRed \\<and>\n(\\<forall> s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = minimalRed \\<longrightarrow>\n(\\<exists> s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green \\<and> toEnvNum s2 s1 = ltimeEnv s1 Ctrl) \\<or>\ntoEnvNum emptyState s1 \\<le> MINIMAL_RED_TIME_LIMIT \\<and>\n(\\<forall> s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green)) \\<and>\n(\\<forall> s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = green \\<longrightarrow> getVarBool s1 trafficLight = GREEN) \\<longrightarrow>\n(\\<exists> s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getVarBool s2 trafficLight = GREEN \\<and> toEnvNum s2 s1 \\<le> ltimeEnv s1 Ctrl)\"\n  by (metis (no_types, lifting) leD order_le_less substate_trans)\n\nlemma redAfterMinimalRed_not_vc3: \"toEnvP s1 \\<and> substate s1 s \\<and> toEnvNum emptyState s1 > MINIMAL_RED_TIME_LIMIT + 1  \\<and>\ngetPstate s1 Ctrl =redAfterMinimalRed \\<and> getVarBool s1 requestButtonPressed \\<and>\n(\\<forall> s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = minimalRed \\<longrightarrow>\n(\\<exists> s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green \\<and> toEnvNum s2 s1 = ltimeEnv s1 Ctrl) \\<or>\ntoEnvNum emptyState s1 \\<le> MINIMAL_RED_TIME_LIMIT \\<and>\n(\\<forall> s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green)) \\<and>\n(\\<forall>s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = redAfterMinimalRed \\<and> getVarBool s1 redAfterMinimalRed \\<longrightarrow>\n      (\\<exists>s2. toEnvP s2 \\<and>\n            substate s2 s1 \\<and>\n            toEnvNum s2 s1 = Ctrl \\<and>\n            getPstate s2 Ctrl = minimalRed \\<and>\n            ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n            (getVarBool s2 redAfterMinimalRed \\<or> getVarBool s1 Ctrl = PRESSED))) \\<and>\n(\\<forall> s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = green \\<longrightarrow> getVarBool s1 trafficLight = GREEN) \\<longrightarrow>\n(\\<exists> s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getVarBool s2 trafficLight = GREEN \\<and> toEnvNum s2 s1 \\<le>MINIMAL_RED_TIME_LIMIT + 1)\"\n  apply(rule impI)\n apply(rule cut_rl[of \"(\\<exists>s2. toEnvP s2 \\<and>\n            substate s2 s1 \\<and>\n            toEnvNum s2 s1 = Ctrl \\<and>\n            getPstate s2 Ctrl = minimalRed \\<and>\n            ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n            (getVarBool s2 redAfterMinimalRed \\<or> getVarBool s1 Ctrl = PRESSED))\"])\n  using minimalRed_not_vc3\n   apply (metis (no_types, opaque_lifting) order.order_iff_strict substate_trans toEnvNum3 toEnvP.simps(2))\n  by auto\n \n\nlemma minimalRed_notPressed: \"  toEnvP s1 \\<and>\n          substate s1 s \\<and>\n          MINIMAL_RED_TIME_LIMIT + Ctrl < toEnvNum emptyState s1 \\<and>\n          getPstate s1 Ctrl = redAfterMinimalRed \\<and>\n          \\<not> getVarBool s1 redAfterMinimalRed \\<and>\n          (\\<forall>s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = minimalRed \\<longrightarrow>\n                (\\<exists>s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green \\<and> toEnvNum s2 s1 = ltimeEnv s1 Ctrl) \\<or>\n                toEnvNum emptyState s1 \\<le> MINIMAL_RED_TIME_LIMIT \\<and>\n                (\\<forall>s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green)) \\<and>\n          (\\<forall>s1. toEnvP s1 \\<and>\n                substate s1 s \\<and>\n                getPstate s1 Ctrl = redAfterMinimalRed \\<and> getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\<longrightarrow>\n                (\\<exists>s2. toEnvP s2 \\<and>\n                      substate s2 s1 \\<and>\n                      getPstate s2 Ctrl = minimalRed \\<and>\n                      ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n                      getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<and>\n                      (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s1 \\<and> s2 \\<noteq> s3 \\<longrightarrow>\n                            getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n                            getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED))) \\<and>\n          (\\<forall>s1 s2.\n              toEnvP s1 \\<and>\n              toEnvP s2 \\<and>\n              substate s1 s2 \\<and>\n              substate s2 s \\<and>\n              toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\<and>\n              getPstate s2 Ctrl = minimalRed \\<and> getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<longrightarrow>\n              getVarBool s1 Ctrl = NOT_PRESSED) \\<and>\n          (\\<forall>s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = green \\<longrightarrow> getVarBool s1 minimalRed = PRESSED) \\<Longrightarrow>\n          \\<exists>s2. toEnvP s2 \\<and>\n               substate s2 s1 \\<and>\n               getPstate s2 Ctrl = minimalRed \\<and>\n               ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n               getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<and>\n               (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s1 \\<and> s2 \\<noteq> s3 \\<longrightarrow>\n                     getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n                     getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED) \\<Longrightarrow>\n          toEnvP x \\<and>\n          substate x s1 \\<and>\n          getPstate x Ctrl = minimalRed \\<and>\n          ltimeEnv x Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n          getVarBool x redAfterMinimalRed = NOT_PRESSED \\<and>\n          (\\<forall>s3. toEnvP s3 \\<and> substate x s3 \\<and> substate s3 s1 \\<and> x \\<noteq> s3 \\<longrightarrow>\n                getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n                getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED) \\<Longrightarrow>\n          \\<exists>s3. toEnvP s3 \\<and> substate s3 s1 \\<and> toEnvNum s3 s1 = T1 \\<and> getVarBool s3 minimalRed = NOT_PRESSED \\<Longrightarrow>\n          \\<not> (toEnvNum x s1 \\<le> T1 - MINIMAL_RED_TIME_LIMIT \\<and> MINIMAL_RED_TIME_LIMIT < toEnvNum emptyState x) \\<Longrightarrow>\n          toEnvNum x s1 \\<noteq> T1 - MINIMAL_RED_TIME_LIMIT + Ctrl \\<Longrightarrow>\n          T1 - MINIMAL_RED_TIME_LIMIT + Ctrl < toEnvNum x s1 \\<Longrightarrow>\n          toEnvP s2 \\<and> substate s2 s1 \\<and> toEnvNum s2 s1 < T1 \\<longrightarrow> getVarBool s2 Ctrl = NOT_PRESSED\"\n  apply(cases \"substate s2 x\")\n  using toEnvNum3[of s2 x s1] substate_trans[of x s1 s]\n  apply (smt (verit) Nat.add_diff_assoc2 add.commute add_lessD1 less_diff_conv less_diff_conv2 less_or_eq_imp_le linordered_semidom_class.add_diff_inverse trans_le_add2 verit_comp_simplify1(3))\n  using  substate_asym\n  by (metis substate_total)\n\nlemma toEnvP_gtime_ge_0: \"toEnvP s \\<Longrightarrow> toEnvNum emptyState s > 0\"\n  apply(cases s)\n  by auto\n\nlemma minimalRed_firstIter: \"toEnvP s1 \\<and>\n    substate s1 s \\<and>\n    MINIMAL_RED_TIME_LIMIT + Ctrl < toEnvNum emptyState s1 \\<and>\n    getPstate s1 Ctrl = redAfterMinimalRed \\<and>\n    \\<not> getVarBool s1 redAfterMinimalRed \\<and>\n    (\\<forall>s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = minimalRed \\<longrightarrow>\n          (\\<exists>s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green \\<and> toEnvNum s2 s1 = ltimeEnv s1 Ctrl) \\<or>\n          toEnvNum emptyState s1 \\<le> MINIMAL_RED_TIME_LIMIT \\<and>\n          (\\<forall>s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green)) \\<and>\n    (\\<forall>s1. toEnvP s1 \\<and>\n          substate s1 s \\<and> getPstate s1 Ctrl = redAfterMinimalRed \\<and> getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\<longrightarrow>\n          (\\<exists>s2. toEnvP s2 \\<and>\n                substate s2 s1 \\<and>\n                getPstate s2 Ctrl = minimalRed \\<and>\n                ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n                getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<and>\n                (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s1 \\<and> s2 \\<noteq> s3 \\<longrightarrow>\n                      getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n                      getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED))) \\<and>\n    (\\<forall>s1 s2.\n        toEnvP s1 \\<and>\n        toEnvP s2 \\<and>\n        substate s1 s2 \\<and>\n        substate s2 s \\<and>\n        toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\<and>\n        getPstate s2 Ctrl = minimalRed \\<and> getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<longrightarrow>\n        getVarBool s1 Ctrl = NOT_PRESSED) \\<and>\n    (\\<forall>s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = green \\<longrightarrow> getVarBool s1 minimalRed = PRESSED) \\<Longrightarrow>\n    \\<exists>s2. toEnvP s2 \\<and>\n         substate s2 s1 \\<and>\n         getPstate s2 Ctrl = minimalRed \\<and>\n         ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n         getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s1 \\<and> s2 \\<noteq> s3 \\<longrightarrow>\n               getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n               getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED) \\<Longrightarrow>\n    toEnvP x \\<and>\n    substate x s1 \\<and>\n    getPstate x Ctrl = minimalRed \\<and>\n    ltimeEnv x Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n    getVarBool x redAfterMinimalRed = NOT_PRESSED \\<and>\n    (\\<forall>s3. toEnvP s3 \\<and> substate x s3 \\<and> substate s3 s1 \\<and> x \\<noteq> s3 \\<longrightarrow>\n          getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n          getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED) \\<Longrightarrow>\n    \\<not> (toEnvNum x s1 \\<le> T1 - MINIMAL_RED_TIME_LIMIT \\<and> MINIMAL_RED_TIME_LIMIT < toEnvNum emptyState x) \\<Longrightarrow>\n    toEnvNum x s1 \\<noteq> T1 - MINIMAL_RED_TIME_LIMIT + Ctrl \\<Longrightarrow>\n    \\<not> T1 - MINIMAL_RED_TIME_LIMIT + Ctrl < toEnvNum x s1 \\<Longrightarrow>\n(\\<exists> s3. toEnvP s3 \\<and> substate s3 s1 \\<and> toEnvNum s3 s1 = T1 \\<and> getVarBool s3 trafficLight = RED) \\<Longrightarrow>\n     toEnvP s2 \\<and> substate s2 s1 \\<and> toEnvNum s2 s1 < T1 \\<longrightarrow> getVarBool s2 Ctrl = NOT_PRESSED\"\n  apply(cases \"substate s2 x\")\n   apply(rule cut_rl[of \"toEnvNum emptyState s1 \\<le> T1\"])\n    apply(rule cut_rl[of \"toEnvNum emptyState s1 > T1\"])\n     apply arith\n  using toEnvP_gtime_ge_0 toEnvNum3[of emptyState _ s1]\n    apply (metis diff_add_inverse2 diff_is_0_eq emptyState_substate linorder_not_less minus_nat.diff_0)\n   apply(rule cut_rl[of \"toEnvNum emptyState x \\<le> MINIMAL_RED_TIME_LIMIT \\<and> toEnvNum x s1 \\<le> T1 - MINIMAL_RED_TIME_LIMIT\"])\n   apply (metis \\<open>\\<And>s2. substate emptyState s2 \\<and> substate s2 s1 \\<Longrightarrow> toEnvNum emptyState s1 = toEnvNum emptyState s2 + toEnvNum s2 s1\\<close> diff_add_inverse emptyState_substate le_antisym ltime_le_toEnvNum nat_add_left_cancel_le)\n   apply arith\n  using substate_total substate_asym\n  by metis\n  \n\nlemma minimalRed_notPressed_or_green: \"toEnvP s1 \\<and>\n         substate s1 s \\<and>\n         MINIMAL_RED_TIME_LIMIT + Ctrl < toEnvNum emptyState s1 \\<and>\n         getPstate s1 Ctrl = redAfterMinimalRed \\<and>\n         \\<not> getVarBool s1 redAfterMinimalRed \\<and>\n         (\\<forall>s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = minimalRed \\<longrightarrow>\n               (\\<exists>s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green \\<and> toEnvNum s2 s1 = ltimeEnv s1 Ctrl) \\<or>\n               toEnvNum emptyState s1 \\<le> MINIMAL_RED_TIME_LIMIT \\<and>\n               (\\<forall>s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green)) \\<and>\n         (\\<forall>s1. toEnvP s1 \\<and>\n               substate s1 s \\<and>\n               getPstate s1 Ctrl = redAfterMinimalRed \\<and> getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\<longrightarrow>\n               (\\<exists>s2. toEnvP s2 \\<and>\n                     substate s2 s1 \\<and>\n                     getPstate s2 Ctrl = minimalRed \\<and>\n                     ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n                     getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<and>\n                     (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s1 \\<and> s2 \\<noteq> s3 \\<longrightarrow>\n                           getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n                           getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED))) \\<and>\n         (\\<forall>s1 s2.\n             toEnvP s1 \\<and>\n             toEnvP s2 \\<and>\n             substate s1 s2 \\<and>\n             substate s2 s \\<and>\n             toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\<and>\n             getPstate s2 Ctrl = minimalRed \\<and> getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<longrightarrow>\n             getVarBool s1 Ctrl = NOT_PRESSED) \\<and>\n         (\\<forall>s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = green \\<longrightarrow> getVarBool s1 minimalRed = PRESSED) \\<Longrightarrow>\n         \\<exists>s2. toEnvP s2 \\<and>\n              substate s2 s1 \\<and>\n              getPstate s2 Ctrl = minimalRed \\<and>\n              ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n              getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<and>\n              (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s1 \\<and> s2 \\<noteq> s3 \\<longrightarrow>\n                    getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n                    getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED) \\<Longrightarrow>\n         toEnvP x \\<and>\n         substate x s1 \\<and>\n         getPstate x Ctrl = minimalRed \\<and>\n         ltimeEnv x Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n         getVarBool x redAfterMinimalRed = NOT_PRESSED \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and> substate x s3 \\<and> substate s3 s1 \\<and> x \\<noteq> s3 \\<longrightarrow>\n               getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n               getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED) \\<Longrightarrow>\n(\\<exists> s3. toEnvP s3 \\<and> substate s3 s1 \\<and> toEnvNum s3 s1 = T1 \\<and> getVarBool s3 trafficLight = RED) \\<Longrightarrow>\n         (\\<exists>s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getVarBool s2 minimalRed = PRESSED \\<and> toEnvNum s2 s1 \\<le> T1) \\<or>\n         (\\<forall>s2. toEnvP s2 \\<and> substate s2 s1 \\<and> toEnvNum s2 s1 < T1 \\<longrightarrow> getVarBool s2 requestButton = NOT_PRESSED)\"\n  apply(cases \"toEnvNum x s1 \\<le> T1 - MINIMAL_RED_TIME_LIMIT \\<and> toEnvNum emptyState x > MINIMAL_RED_TIME_LIMIT\")\n   apply(rule disjI1)\n   apply(rule cut_rl[of \"(\\<exists>s2. toEnvP s2 \\<and> substate s2 x \\<and> getVarBool s2 minimalRed = PRESSED \\<and>\n toEnvNum s2 x \\<le> MINIMAL_RED_TIME_LIMIT)\"])\n  using toEnvNum3[of _ x s1]\n    apply (smt (z3) add_le_mono diff_add_inverse substate_trans)\n  using substate_trans minimalRed_not_vc3\n   apply (smt (verit) nat_le_linear)\n  apply(rule disjI2)\n  apply(cases \"toEnvNum x s1 = T1 - MINIMAL_RED_TIME_LIMIT + 1\")\n   apply(rule cut_rl[of \"\\<forall>s2. toEnvP s2 \\<and> (substate x s2 \\<and> substate s2 s1 \\<and>  x \\<noteq> s2 \\<or>\n substate s2 x \\<and> toEnvNum s2 x <  MINIMAL_RED_TIME_LIMIT - 1)  \\<longrightarrow> getVarBool s2 Ctrl = NOT_PRESSED\"])\n  apply (smt (verit) Nat.add_diff_assoc \\<open>\\<And>s1a. substate s1a x \\<and> substate x s1 \\<Longrightarrow> toEnvNum s1a s1 = toEnvNum s1a x + toEnvNum x s1\\<close> diff_add_inverse le_add1 less_diff_conv less_diff_conv2 substate_total trans_le_add2)\n   apply (smt (z3) substate_trans)\n   apply(cases \"toEnvNum x s1 > T1 - MINIMAL_RED_TIME_LIMIT + 1\")\n   apply(rule allI)\n   apply ((rule minimalRed_notPressed);blast)\n  apply(rule allI)\n  by ((rule minimalRed_firstIter);blast)\n\n\nlemma redAfterMinimalRed_notPressed_not_vc3: \"toEnvP s1 \\<and> substate s1 s \\<and> toEnvNum emptyState s1 > MINIMAL_RED_TIME_LIMIT + 1  \\<and>\ngetPstate s1 Ctrl =redAfterMinimalRed \\<and> \\<not>getVarBool s1 requestButtonPressed \\<and>\n(\\<forall> s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = minimalRed \\<longrightarrow>\n(\\<exists> s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green \\<and> toEnvNum s2 s1 = ltimeEnv s1 Ctrl) \\<or>\ntoEnvNum emptyState s1 \\<le> MINIMAL_RED_TIME_LIMIT \\<and>\n(\\<forall> s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getPstate s2 Ctrl = green)) \\<and>\n(\\<forall>s1. toEnvP s1 \\<and>\n      substate s1 s \\<and> getPstate s1 Ctrl = redAfterMinimalRed \\<and> getVarBool s1 redAfterMinimalRed = NOT_PRESSED \\<longrightarrow>\n      (\\<exists>s2. toEnvP s2 \\<and>\n            substate s2 s1 \\<and>\n            getPstate s2 Ctrl = minimalRed \\<and>\n            ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n            getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<and>\n            (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s1 \\<and> s2 \\<noteq> s3 \\<longrightarrow>\n                  getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n                  getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED))) \\<and>\n(\\<forall>s1 s2.\n    toEnvP s1 \\<and>\n    toEnvP s2 \\<and>\n    substate s1 s2 \\<and>\n    substate s2 s \\<and>\n    toEnvNum s1 s2 < ltimeEnv s2 Ctrl - Ctrl \\<and>\n    getPstate s2 Ctrl = minimalRed \\<and> getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<longrightarrow>\n    getVarBool s1 Ctrl = NOT_PRESSED) \\<and>\n(\\<forall> s1. toEnvP s1 \\<and> substate s1 s \\<and> getPstate s1 Ctrl = green \\<longrightarrow> getVarBool s1 trafficLight = GREEN) \\<Longrightarrow>\n(\\<exists> s3. toEnvP s3 \\<and> substate s3 s1 \\<and> toEnvNum s3 s1 = T1 \\<and> getVarBool s3 trafficLight = RED)\n \\<Longrightarrow>\n(\\<exists> s2. toEnvP s2 \\<and> substate s2 s1 \\<and> getVarBool s2 trafficLight = GREEN \\<and> toEnvNum s2 s1 \\<le>T1) \\<or>\n(\\<forall> s2. toEnvP s2 \\<and> substate s2 s1 \\<and> toEnvNum s2 s1 < T1 \\<longrightarrow> getVarBool s2 requestButton = NOT_PRESSED)\"\n  apply(rule cut_rl[of \" (\\<exists>s2. toEnvP s2 \\<and>\n            substate s2 s1 \\<and>\n            getPstate s2 Ctrl = minimalRed \\<and>\n            ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n            getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<and>\n            (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s1 \\<and> s2 \\<noteq> s3 \\<longrightarrow>\n                  getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n                  getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED))\"])\n  apply(rule exE[of \"(\\<lambda> s2. toEnvP s2 \\<and>\n            substate s2 s1 \\<and>\n            getPstate s2 Ctrl = minimalRed \\<and>\n            ltimeEnv s2 Ctrl = MINIMAL_RED_TIME_LIMIT \\<and>\n            getVarBool s2 redAfterMinimalRed = NOT_PRESSED \\<and>\n            (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s1 \\<and> s2 \\<noteq> s3 \\<longrightarrow>\n                  getPstate s3 Ctrl = redAfterMinimalRed \\<and>\n                  getVarBool s3 redAfterMinimalRed = NOT_PRESSED \\<and> getVarBool s3 Ctrl = NOT_PRESSED))\"])\n    apply fast\n   apply((rule minimalRed_notPressed_or_green);blast)\n  by blast\n  ", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/trafficLights/Proof_1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7154240079185319, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.3270465821194453}}
{"text": "theory BaseLogicDeepExperimental\nimports CoreStructures Namespace \"../HeapLang/PrimitiveLaws\" Frac DerivedConstructions\n  \"../SpanningTree/SpanningTreeCameras\" \"../HeapLang/State\"\nbegin\n\ntext \\<open> An experimental approach to a deep embedding of the Iris base/core logic.\\<close>\n\ntext \\<open>Deep embedding of camera objects\\<close>\ndatatype 'a cmra_term = ConstC 'a | Core \\<open>'a cmra_term\\<close> | Op \\<open>'a cmra_term\\<close> \\<open>'a cmra_term\\<close>\n\ntext \\<open>Deep embedding of step-index predicates about camera objects\\<close>\ndatatype 'a cmra_atom = \n  Own \\<open>'a cmra_term\\<close> \\<comment> \\<open>Holds for camera objects which include the given partial resource\\<close>\n| Valid \\<open>'a cmra_term\\<close>\n\ntext \\<open>Predicate connectives\\<close>\ndatatype 'a iprop = \n  Atom \\<open>'a cmra_atom\\<close> \\<comment> \\<open>An atomic predicate about camera resources\\<close>\n  \\<comment> \\<open>Standard separation logic connectives\\<close>\n| Sep \"'a iprop\" \"'a iprop\" \\<comment> \\<open>Separating conjunction\\<close>\n| Wand \"'a iprop\" \"'a iprop\" \\<comment> \\<open>Wand combinator, i.e. resource specific implication\\<close>\n| Pure bool \\<comment> \\<open>Wrapper for pure Isabelle/HOL propositions\\<close>\n  \\<comment> \\<open>Iris specific modalities\\<close>\n| Persistent \"'a iprop\" \\<comment> \\<open>Predicate holds for core of the camera argument\\<close>\n| Plain \"'a iprop\" \\<comment> \\<open>Predicate holds for unit camera object\\<close>\n| Later \"'a iprop\" \\<comment> \\<open>Increases step index by one (also holds for n=0)\\<close>\n| BUpd \"'a iprop\" \\<comment> \\<open>Predicate holds after one frame-preserving update\\<close>\n  \\<comment> \\<open>Standard logic connectives\\<close>\n| Impl \"'a iprop\" \"'a iprop\"\n| Conj \"'a iprop\" \"'a iprop\"\n| Disj \"'a iprop\" \"'a iprop\"\n\ndatatype 'a inv = Inv \\<open>(name, 'a res iprop later) map_view \\<times> name dset \\<times> name dfset\\<close>\n  and 'a res = Res \"(gname \\<rightharpoonup> 'a inv) \\<times> 'a\"\n\ndefinition \"invariant_name :: gname \\<equiv> 1\" \ndefinition \"enabled_name :: gname \\<equiv> 2\" \ndefinition \"disabled_name :: gname \\<equiv> 3\"\n\nfun get_inv :: \"gname \\<Rightarrow> 'a res \\<Rightarrow> 'a inv option\" where \"get_inv \\<gamma> (Res (i,a)) = i \\<gamma>\"\ndefinition constr_inv :: \"gname \\<Rightarrow> 'a::ucamera inv \\<Rightarrow> 'a res\" where\n  \"constr_inv \\<gamma> i = Res ([\\<gamma>\\<mapsto>i],\\<epsilon>)\"\n \ninstance inv :: (type) ucamera sorry\ninstance res :: (type) ucamera sorry\ninstance iprop :: (type) ofe sorry\n\ntype_synonym 'a atom = \"'a cmra_atom\"\n\nprimrec cmra_eval :: \"'a::ucamera cmra_term \\<Rightarrow> 'a\" where\n  \"cmra_eval (ConstC a) = a\"\n| \"cmra_eval (Core a) = core (cmra_eval a)\"\n| \"cmra_eval (Op a b) = (cmra_eval a) \\<cdot> (cmra_eval b)\"\n\ntype_synonym 'a upred = \"'a \\<Rightarrow> nat \\<Rightarrow> bool\"\n\nprimrec atom_sem :: \"'a::ucamera atom \\<Rightarrow> 'a upred\" where\n  \"atom_sem (Own a) b n = n_incl n (cmra_eval a) b\"\n| \"atom_sem (Valid a) _ n = n_valid (cmra_eval a) n\"\n\nfun pred_sem :: \"'a::ucamera iprop \\<Rightarrow> 'a upred\"\nwhere\n  \"pred_sem (Atom a) = (\\<lambda>b n. atom_sem a b n)\"\n| \"pred_sem (Sep P Q) = (\\<lambda>a n. (\\<exists>b1 b2. n_equiv n a (b1 \\<cdot> b2) \\<and> pred_sem P b1 n \\<and> pred_sem Q b2 n))\"\n| \"pred_sem (Wand P Q) = (\\<lambda>a n.\n  (\\<forall>m b. m\\<le>n \\<and> n_valid (a \\<cdot> b) m \\<longrightarrow> pred_sem P b m \\<longrightarrow> pred_sem Q (a \\<cdot> b) m))\"\n| \"pred_sem (Pure b) = (\\<lambda>_ _.  b)\"\n| \"pred_sem (Persistent P) = (\\<lambda>a n. pred_sem P (core a) n)\"\n| \"pred_sem (Plain P) = (\\<lambda>_ n. pred_sem P \\<epsilon> n)\"\n| \"pred_sem (Later P) = (\\<lambda>a n. (n=0 \\<or> pred_sem P a (n-1)))\"\n| \"pred_sem (BUpd P) = (\\<lambda>a n.\n  (\\<forall>m a'. m\\<le>n \\<and> n_valid (a \\<cdot> a') m \\<longrightarrow> (\\<exists>b. n_valid (b \\<cdot> a') m \\<and> pred_sem P b m)))\"\n| \"pred_sem (Impl P Q) = (\\<lambda>a n.\n  (\\<forall>m b. m\\<le>n \\<and> incl a b \\<and> n_valid b m \\<longrightarrow> pred_sem P b m \\<longrightarrow> pred_sem Q b m))\"\n| \"pred_sem (Conj P Q) = (\\<lambda>a n. (pred_sem P a n \\<and> pred_sem Q a n))\"\n| \"pred_sem (Disj P Q) = (\\<lambda>a n. (pred_sem P a n \\<or> pred_sem Q a n))\"\n  \ndefinition uniform :: \"'a::ucamera upred \\<Rightarrow> bool\" where\n  \"uniform f \\<longleftrightarrow> (\\<forall>n m x y. f x n \\<longrightarrow> n_incl m x y \\<longrightarrow> m\\<le>n \\<longrightarrow> f y m)\"\n\nlemma upred_weaken: \"\\<lbrakk>n_equiv n x y; m\\<le>n;uniform f; f x n\\<rbrakk> \\<Longrightarrow> f y m\"\n  using total_n_inclI uniform_def by fast\n\nlemma upred_weaken_simple: \"\\<lbrakk>uniform f; f x n; m\\<le>n\\<rbrakk> \\<Longrightarrow> f x m\"\n  using ofe_refl upred_weaken by blast\n  \nlemma atom_sem_uniform: \"uniform (atom_sem a)\"\nproof (induct a)\n  case (Own x)\n  then show ?case unfolding uniform_def n_incl_def atom_sem.simps\n  using camera_assoc op_equiv_subst by (metis (no_types, lifting))\nnext\n  case (Valid x)\n  then show ?case by (simp add: uniform_def)\nqed\n\nlemma pred_sem_uniform: \"uniform (pred_sem P)\"\nproof (induct P rule: iprop.induct)\n  case (Atom x)\n  then show ?case by (simp) (rule atom_sem_uniform)\nnext\n  case (Sep P Q)\n  then have Q: \"\\<And>n m x y. \\<lbrakk>(pred_sem Q) x n; n_incl m x y; m\\<le>n\\<rbrakk> \\<Longrightarrow> (pred_sem Q) y m\"\n    by (auto simp: uniform_def)\n  {\n    fix n m x y\n    assume assms: \"pred_sem (Sep P Q) x n\" \"n_incl m x y\" \"m\\<le>n\"\n    then obtain b1 b2 where bs: \"n_equiv n x (b1 \\<cdot> b2)\" \"(pred_sem P) b1 n\" \"(pred_sem Q) b2 n\"\n      by auto\n    from assms(2) obtain z where z: \"n_equiv m y (x \\<cdot> z)\" by (auto simp: n_incl_def)\n    from op_equiv_subst[OF this bs(1) assms(3)] camera_assoc have \"n_equiv m y (b1 \\<cdot> (b2 \\<cdot> z))\" \n      by (metis (no_types, lifting))\n    with upred_weaken_simple[OF Sep(1) bs(2) assms(3)] Q[OF bs(3) n_incl_op_extend assms(3), of z]\n    have \"pred_sem (Sep P Q) y m\" unfolding pred_sem.simps by blast\n  }\n  then show ?case by (simp add: uniform_def)\nnext\n  case (Wand P Q)\n  then have Q: \"\\<And>n m x y. \\<lbrakk>(pred_sem Q) x n; n_incl m x y; m\\<le>n\\<rbrakk> \\<Longrightarrow> (pred_sem Q) y m\"\n    by (auto simp: uniform_def)\n  {\n    fix n m x y\n    assume assms: \"pred_sem (Wand P Q) x n\" \"n_incl m x y\" \"m\\<le>n\"\n    then have I: \"\\<And>m b. \\<lbrakk>m\\<le>n; n_valid (x \\<cdot> b) m; (pred_sem P) b m\\<rbrakk> \\<Longrightarrow> (pred_sem Q) (x \\<cdot> b) m\" \n      by auto\n    {\n      fix m' z\n      assume assms2: \"m'\\<le>m\" \"n_valid (y \\<cdot> z) m'\" \"(pred_sem P) z m'\"\n      from assms(3) assms2(1) have \"m'\\<le>n\" by linarith\n      from Q[OF I[OF this n_valid_incl_subst[OF assms(2) assms2(2,1)] assms2(3)] \n        n_incl_extend[OF assms(2) assms2(1), of z] order.refl]\n      have \"(pred_sem Q) (y \\<cdot> z) m'\" .\n    }\n    then have \"pred_sem (Wand P Q) y m\" by simp\n  }\n  then show ?case by (simp add: uniform_def)\nnext\n  case (Pure b)  \n  then show ?case by (simp add: uniform_def)\nnext\n  case (Persistent P)\n  {\n    fix n m x y\n    assume assms: \"pred_sem (Persistent P) x n\" \"n_incl m x y\" \"m\\<le>n\"\n    then have I: \"pred_sem P (core x) n\" by simp\n    from assms(2) have \"n_incl m (core x) (core y)\" by (rule camera_core_mono_n)\n    with Persistent I assms(3) have \"pred_sem (Persistent P) y m\" \n      unfolding pred_sem.simps uniform_def by blast\n  }\n  then show ?case by (simp add: uniform_def)\nnext\n  case (Plain P)\n  then show ?case by (simp add: uniform_def)\nnext\n  case (Later P)\n  then show ?case by (auto simp: uniform_def camera_n_incl_le diff_le_mono) \nnext\n  case (BUpd P)\n  then show ?case by (simp add: uniform_def n_valid_incl_subst order.trans)\nnext\n  case (Impl P Q)\n  then have P: \"\\<And>n m x y. \\<lbrakk>(pred_sem P) x n; n_incl m x y; m\\<le>n\\<rbrakk> \\<Longrightarrow> (pred_sem P) y m\"\n    by (auto simp: uniform_def)\n  from Impl(2) have Q: \"\\<And>n m x y. \\<lbrakk>(pred_sem Q) x n; n_incl m x y; m\\<le>n\\<rbrakk> \\<Longrightarrow> (pred_sem Q) y m\"\n    by (auto simp: uniform_def)  \n  {\n    fix n m x y\n    assume assms: \"pred_sem (Impl P Q) x n\" \"n_incl m x y\" \"m\\<le>n\"\n    then have I: \"\\<And>m' z. \\<lbrakk>m'\\<le>n;incl x z; n_valid z m'; pred_sem P z m'\\<rbrakk> \\<Longrightarrow> pred_sem Q z m'\"\n      by auto\n    {\n      fix m' z\n      assume assms2: \"m'\\<le>m\" \"incl y z\" \"n_valid z m'\" \"pred_sem P z m'\"\n      with assms(3) have \"m'\\<le>n\" by linarith\n      from assms(2) obtain y' where y': \"n_equiv m y (x\\<cdot>y')\" using n_incl_def by blast\n      with ofe_sym ofe_mono[OF assms2(1)] have y'_sym: \"n_equiv m' (x\\<cdot>y') y\" by fast\n      from assms2(2) obtain z' where z': \"z=y\\<cdot>z'\" using incl_def by blast\n      from valid_op_op_weaken[OF ofe_mono[OF assms2(1) y'] assms2(3)[simplified this]] \n        have \"n_valid ((x\\<cdot>y')\\<cdot>z') m'\" .\n      moreover have \"incl x ((x\\<cdot>y')\\<cdot>z')\" using incl_op_extend incl_def by blast\n      moreover from P[OF assms2(4) _ order.refl, simplified z', OF total_n_incl_extend[OF y' assms2(1)]]\n        have \"pred_sem P ((x\\<cdot>y')\\<cdot>z') m'\".\n      ultimately have \"pred_sem Q ((x\\<cdot>y')\\<cdot>z') m'\" using I[OF \\<open>m'\\<le>n\\<close>] by simp\n      from Q[OF this, of m' z, simplified z', OF total_n_incl_extend[OF y'_sym order.refl] order.refl] \n      have \"pred_sem Q z m'\" unfolding z' .\n    }\n    then have \"pred_sem (Impl P Q) y m\" by (simp add: uniform_def)\n  }\n  then show ?case using uniform_def by blast\nnext\n  case (Conj P Q)\n  then show ?case by (auto simp: uniform_def)\nnext\n  case (Disj P Q)\n  then show ?case by (auto simp: uniform_def)\nqed\n\ncontext assumes \"SORT_CONSTRAINT('a::ucamera)\" begin\n\ndefinition upred_entails :: \"'a upred \\<Rightarrow> 'a upred \\<Rightarrow> bool\" where\n  \"upred_entails P Q \\<equiv> \\<forall>a n. n_valid a n \\<longrightarrow> P a n \\<longrightarrow> Q a n\"\ndefinition pred_entails :: \"'a iprop \\<Rightarrow> 'a iprop \\<Rightarrow> bool\" where\n  \"pred_entails P Q = upred_entails (pred_sem P) (pred_sem Q)\"  \n  \ndefinition upred_holds :: \"'a upred \\<Rightarrow> bool\" where\n  \"upred_holds P \\<equiv> \\<forall>a n. n_valid a n \\<longrightarrow>  P a n\"\ndefinition pred_holds :: \"'a iprop \\<Rightarrow> bool\" where\n  \"pred_holds P = upred_holds (pred_sem P)\"\nend\n\ncontext assumes \"SORT_CONSTRAINT('a::ucamera)\" begin\ndefinition own_inv :: \"gname \\<Rightarrow> 'a inv \\<Rightarrow> 'a res iprop\" where\n  \"own_inv \\<gamma> i = Atom (Own(ConstC (constr_inv \\<gamma> i)))\"\n\ndefinition sep_map_set :: \"('b\\<Rightarrow>'a res iprop) \\<Rightarrow> 'b set \\<Rightarrow> 'a res iprop\" where\n  \"sep_map_set f s = folding_on.F (\\<lambda>x a. Sep a (f x)) (Pure True) s\"\n\ndefinition ownI :: \"name \\<Rightarrow> 'a res iprop \\<Rightarrow> 'a res iprop\" where\n  \"ownI \\<iota> P = own_inv invariant_name (Inv (view_frag [\\<iota>\\<mapsto>(DfracDiscarded,to_ag (Next P))],\\<epsilon>,\\<epsilon>))\"\n\ndefinition inv :: \"namespace \\<Rightarrow> 'a res iprop \\<Rightarrow> 'a res iprop\" where\n  \"inv N P = Pure (\\<exists> \\<iota>. pred_holds (Conj (Pure (\\<iota>\\<in>names N)) ((ownI \\<iota> P))))\"\n  \ndefinition ownE :: \"name set \\<Rightarrow> 'a res iprop\" where\n  \"ownE E = own_inv enabled_name (Inv (\\<epsilon>,DSet E,\\<epsilon>))\"\n\ndefinition ownD :: \"name fset \\<Rightarrow> 'a res iprop\" where\n  \"ownD D = own_inv disabled_name (Inv (\\<epsilon>,\\<epsilon>,DFSet D))\"\n  \ndefinition lift_inv_fmap :: \"(name,'a res iprop) fmap \\<Rightarrow> (name,'a res iprop later) fmap\" where\n  \"lift_inv_fmap m = Abs_fmap (map_option Next \\<circ> (fmlookup m))\"\n\ndefinition wsat :: \"'a res iprop\" where\n  \"wsat \\<equiv> Pure (\\<exists>(I::(name,'a res iprop) fmap). pred_holds\n    (Sep (own_inv invariant_name (Inv(view_auth_full(lift_inv_fmap I),\\<epsilon>,\\<epsilon>)))\n     (sep_map_set (\\<lambda>\\<iota>. Disj (Sep (Later((the \\<circ> (fmlookup I)) \\<iota>)) (ownD {|\\<iota>|}))\n      (ownE {\\<iota>})) (fmdom' I))))\"\nend\n      \ncontext\nfixes get_heap :: \"gname \\<Rightarrow> 'a::ucamera res \\<Rightarrow> heap_lang_heap option\"\n  and constr_heap :: \"gname \\<Rightarrow> heap_lang_heap \\<Rightarrow> 'a res\"\nassumes inG_heap: \"inG get_heap constr_heap\"\nbegin\n\ndefinition heap_name :: gname where \"heap_name = 42\"\n\nabbreviation own_heap :: \"heap_lang_heap \\<Rightarrow> 'a res iprop\" where\n  \"own_heap h \\<equiv> Atom (Own (ConstC (constr_heap heap_name h)))\"\n\ndefinition points_to :: \"loc \\<Rightarrow> dfrac \\<Rightarrow> val \\<Rightarrow> 'a res iprop\" where\n  \"points_to l dq v = own_heap(view_frag [l\\<mapsto>(dq, to_ag (Some v))])\"\nabbreviation points_to_disc :: \"loc \\<Rightarrow> val \\<Rightarrow> 'a res iprop\" where \n  \"points_to_disc \\<equiv> \\<lambda>l v. points_to l DfracDiscarded v\"\nabbreviation points_to_own :: \"loc \\<Rightarrow> frac \\<Rightarrow> val \\<Rightarrow> 'a res iprop\" where\n  \"points_to_own \\<equiv> \\<lambda>l p v. points_to l (DfracOwn p) v\"\nabbreviation points_to_full :: \"loc \\<Rightarrow> val \\<Rightarrow> 'a res iprop\" where\n  \"points_to_full \\<equiv> \\<lambda>l v. points_to_own l 1 v\"\n\ndefinition own_state_heap :: \"state \\<Rightarrow> 'a res iprop\" where\n  \"own_state_heap s = own_heap (view_auth_full (heap s))\"\nend\n\ntype_synonym res1 = \"(gname \\<rightharpoonup> heap_lang_heap) res\"\n\nfun get_heap :: \"gname \\<Rightarrow> res1 \\<Rightarrow> heap_lang_heap option\" where\n  \"get_heap \\<gamma> (Res (_,h)) = h \\<gamma>\"\ndefinition constr_heap :: \"gname \\<Rightarrow> heap_lang_heap \\<Rightarrow> res1\" where\n  \"constr_heap \\<gamma> h = Res (\\<epsilon>, [\\<gamma>\\<mapsto>h])\"\n\nlemma res_n_equiv: \"n_equiv n (Res r1) (Res r2) \\<longleftrightarrow> n_equiv n r1 r2\" sorry\nlemma res_valid: \"n_valid (Res r) n \\<longleftrightarrow> n_valid r n\" sorry\nlemma res_pcore: \"pcore (Res r) = map_option Res (pcore r)\" sorry\nlemma res_\\<epsilon>: \"\\<epsilon> = Res \\<epsilon>\" sorry\nlemma res_op: \"Res r1 \\<cdot> Res r2 = Res (r1\\<cdot>r2)\" sorry\n\ninterpretation inG_heap: inG get_heap constr_heap \napply (auto simp: inG_def constr_heap_def non_expansive_def res_n_equiv res_valid prod_n_valid_def \\<epsilon>_n_valid res_pcore\n  pcore_prod_def \\<epsilon>_pcore pcore_fun_alt ofe_refl  res_\\<epsilon> res_op op_prod_def \\<epsilon>_left_id\n  split: option.splits)\nby (auto simp: \\<epsilon>_fun_def \\<epsilon>_option_def)\n\n\nlemma ownE_singleton_twice: \"pred_entails (Sep (ownE {i}) (ownE {i})) (Pure False)\"\napply (auto simp: pred_entails_def upred_entails_def ownE_def own_inv_def constr_inv_def n_incl_def)\nsubgoal for a n b1 b2 c d\napply (cases c; cases d; cases b1; cases b2)\napply (auto simp: res_n_equiv res_op op_prod_def \\<epsilon>_left_id op_fun_def op_option_def n_equiv_fun_def\n  n_equiv_option_def split: option.splits)\nsorry\ndone\nend", "meta": {"author": "firefighterduck", "repo": "isariris", "sha": "d02268e1e11cf681cae70b366b52843cbd90cc49", "save_path": "github-repos/isabelle/firefighterduck-isariris", "path": "github-repos/isabelle/firefighterduck-isariris/isariris-d02268e1e11cf681cae70b366b52843cbd90cc49/IrisCore/BaseLogicDeepExperimental.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7401743620390163, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.32691503519766907}}
{"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n *  Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Subtraction_Hoare_Typed\n  imports VHDL_Hoare_Typed Bits_Int_Aux\nbegin\n\ndatatype sig = A | B | C\n\ndefinition sub :: \"sig conc_stmt\" where\n  \"sub \\<equiv> process {A, B} : Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1\"\n\nlemma potential_tyenv:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1)\"\n  shows \"\\<exists>len1>0. \\<exists>len2>0. \\<Gamma> A = Lty Uns len1 \\<and> \\<Gamma> B = Lty Uns len2 \\<and> \\<Gamma> C = Lty Uns (max len1 len2)\n                   \\<or> \\<Gamma> A = Lty Sig len1 \\<and> \\<Gamma> B = Lty Sig len2 \\<and> \\<Gamma> C = Lty Sig (max len1 len2)\"\nproof (rule seq_wt_cases(4)[OF assms])\n  assume \"bexp_wt \\<Gamma> (Bsub (Bsig A) (Bsig B)) (\\<Gamma> C)\"\n  obtain len1 len2 where \" \\<Gamma> A = Lty Uns len1 \\<and> \\<Gamma> B = Lty Uns len2 \\<and> \\<Gamma> C = Lty Uns (max len1 len2)\n                              \\<or> \\<Gamma> A = Lty Sig len1 \\<and> \\<Gamma> B = Lty Sig len2 \\<and> \\<Gamma> C = Lty Sig (max len1 len2)\"\n      and \"0 < len1\" and \"0 < len2\"\n    apply (rule bexp_wt_cases_slice(6)[OF \\<open>bexp_wt \\<Gamma> (Bsub (Bsig A) (Bsig B)) (\\<Gamma> C)\\<close>])\n    by (metis bexp_wt_cases_slice(2))+\n thus ?thesis\n    by auto\nqed\n\nlocale unsigned_subtraction =\n  fixes \\<Gamma> :: \"sig tyenv\"\n  fixes len len1 len2 :: nat\n  assumes len_def: \"len = max len1 len2\"\n  assumes atype: \"\\<Gamma> A = Lty Uns len1\" and btype: \"\\<Gamma> B = Lty Uns len2\" and ctype: \"\\<Gamma> C = Lty Uns len\"\n  assumes len1: \"0 < len1\" and len2: \"0 < len2\"\nbegin\n\nlemma well_typed:\n  \"seq_wt \\<Gamma> (Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1)\"\n  apply (rule seq_wt.intros(4))\n  unfolding ctype len_def apply (rule bexp_wt.intros(19))\n      apply (rule bexp_wt.intros(3))\n      apply (rule atype[THEN sym] )\n      apply (rule bexp_wt.intros(3))\n      apply (rule btype[THEN sym] )\n  using len1 len2 by auto\n\nabbreviation \"lof_wline tw sig n \\<equiv> lval_of (wline_of tw sig n)\"\n\ndefinition inv :: \"sig assn2\" where\n  \"inv tw \\<equiv> lof_wline tw C (fst tw) = bin_to_bl len (bl_to_bin (lof_wline tw A (fst tw - 1)) - bl_to_bin (lof_wline tw B (fst tw - 1)))\"\n\ndefinition inv2 :: \"sig assn2\" where\n  \"inv2 tw \\<equiv> (disjnt {A, B} (event_of tw) \\<longrightarrow> (\\<forall>i > fst tw. lof_wline tw C i = lof_wline tw C (fst tw)))\"\n\nlemma inv_next_time:\n  fixes tw\n  defines \"v \\<equiv> eval_world_raw2 tw (Bsub (Bsig A) (Bsig B))\"\n  defines \"tw' \\<equiv> tw[C, 1 :=\\<^sub>2 v]\"\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  shows   \"inv (fst tw' + 1, snd tw')\"\nproof - \n  have bexpA: \"bexp_wt \\<Gamma> (Bsig A) (Lty Uns len1)\" and bexpB: \"bexp_wt \\<Gamma> (Bsig B) (Lty Uns len2)\"\n    using unsigned_subtraction_axioms unfolding unsigned_subtraction_def by (metis bexp_wt.intros(3))+\n  obtain bsA bsB where evalA: \"eval_world_raw (fst tw) (snd tw) (Bsig A) = Lv Uns bsA\" and\" length bsA = len1 \" and\n                       evalB: \"eval_world_raw (fst tw) (snd tw) (Bsig B) = Lv Uns bsB\" and\" length bsB = len2 \"\n      using eval_world_raw_lv[OF bexpA `wityping \\<Gamma> (snd tw)`] eval_world_raw_lv[OF bexpB `wityping \\<Gamma> (snd tw)`] by blast\n  have \"lof_wline tw' C (fst tw + 1) = lval_of v\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = bin_to_bl len (bl_to_bin (lof_wline tw A (fst tw)) - bl_to_bin (lof_wline tw B (fst tw)))\"\n    using evalA evalB `length bsA = len1` `length bsB = len2`\n    unfolding v_def eval_world_raw.simps eval_arith.simps len_def Let_def by auto\n  finally show ?thesis\n    unfolding inv_def tw'_def worldline_upd2_def worldline_upd_def  by auto\nqed\n\nlemma inv2_next_time:\n  fixes tw v\n  defines \"tw' \\<equiv> tw[C, 1 :=\\<^sub>2 v]\"\n  shows   \"inv2 (fst tw' + 1, snd tw')\"\n  unfolding inv2_def tw'_def worldline_upd2_def worldline_upd_def by auto\n\n\nlemma sub_conc_hoare:\n  \"\\<And>tw. inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw) \\<Longrightarrow> inv (fst tw + 1, snd tw)\"\nproof -\n  fix tw\n  assume \"inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw)\"\n  hence \"inv tw\" and \"inv2 tw\" and \"disjnt {A, B} (event_of tw)\"\n    by auto\n  have \"lof_wline tw C (fst tw + 1) = lof_wline tw C (fst tw)\"\n    using `inv2 tw` `disjnt {A, B} (event_of tw)` unfolding inv2_def by auto \n  also have \"... = bin_to_bl len (bl_to_bin (lval_of (wline_of tw A (get_time tw - 1))) - bl_to_bin (lval_of (wline_of tw B (get_time tw - 1))))\"\n    using `inv tw` unfolding inv_def by auto\n  also have \"... = bin_to_bl len (bl_to_bin (lval_of (wline_of tw A (fst tw))) - bl_to_bin (lval_of (wline_of tw B (fst tw))))\"\n    using `disjnt {A, B} (event_of tw)`  unfolding event_of_alt_def  \n    by (smt diff_0_eq_0 disjnt_insert1 mem_Collect_eq)\n  finally show \"inv (fst tw + 1, snd tw)\"\n    unfolding inv_def by auto\nqed\n\nlemma sub_conc_hoare2:\n  \"\\<And>tw. inv2 tw \\<and> disjnt {A, B} (event_of tw) \\<Longrightarrow> inv2 (fst tw + 1, snd tw)\"\n  unfolding inv2_def by auto\n\nlemma conc_stmt_wf_sub:\n  \"conc_stmt_wf sub\"\n  unfolding sub_def conc_stmt_wf_def by auto  \n\nlemma nonneg_delay_conc_sub:\n  \"nonneg_delay_conc sub\"\n  unfolding sub_def by auto\n\nlemma nonneg_delay_conc_sub':\n  \"nonneg_delay_conc ( process {A, B} : Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1)\"\n  using nonneg_delay_conc_sub unfolding sub_def by auto\n\nlemma conc_wt_sub:\n  \"conc_wt \\<Gamma> sub\"\n  unfolding sub_def  by (meson conc_wt.intros(1) well_typed)\n\nlemma conc_wt_sub':\n  \"conc_wt \\<Gamma> ( process {A, B} : Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1)\"\n  using conc_wt_sub unfolding sub_def by auto\n\n\nlemma sub_conc_sim2':\n  \"\\<Gamma> \\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. inv tw \\<and> inv2 tw\\<rbrace> sub \\<lbrace>\\<lambda>tw. inv tw \\<and> inv2 tw\\<rbrace>\"\n  apply (rule While_Suc)\n  apply (rule Conseq'[where P=\"wp3_conc \\<Gamma> sub (\\<lambda>tw. inv  (fst tw + 1, snd tw) \\<and> \n                                                      inv2 (fst tw + 1, snd tw))\", rotated])\n  apply (rule wp3_conc_is_pre, rule conc_stmt_wf_sub, rule nonneg_delay_conc_sub, rule conc_wt_sub, simp)\n  unfolding sub_def  wp3_conc_single'[OF conc_wt_sub' nonneg_delay_conc_sub'] wp3_fun.simps\n  using inv_next_time inv2_next_time sub_conc_hoare sub_conc_hoare2 by presburger\n\ntext \\<open>Initialisation preserves the invariant\\<close>\n\nlemma nonneg_delay_sub:\n  \" nonneg_delay (Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1)\"\n  using nonneg_delay_conc_sub' by auto\n\nlemma init_sat_nand_inv_comb:\n  \"init_sim2_hoare_wt \\<Gamma> (\\<lambda>tw. fst tw = 0) sub (\\<lambda>tw. inv tw \\<and> inv2 tw)\"\n  unfolding sub_def\n  apply (rule AssignI_suc, rule SingleI)\n  apply (rule Conseq3[where Q=\"\\<lambda>tw. inv (fst tw + 1, snd tw) \\<and> inv2 (fst tw + 1, snd tw)\", rotated])\n  apply (rule wp3_fun_is_pre[OF well_typed nonneg_delay_sub], simp)\n  unfolding wp3_fun.simps using inv_next_time inv2_next_time by blast\n\nlemma correctness:\n  assumes \"sim_fin2 w (i + 1) sub tw'\" and \"wityping \\<Gamma> w\"\n  shows \"lof_wline tw' C (i + 1) = bin_to_bl len (bl_to_bin (lof_wline tw' A i) - bl_to_bin (lof_wline tw' B i))\"\n  using grand_correctness[OF assms conc_stmt_wf_sub conc_wt_sub nonneg_delay_conc_sub sub_conc_sim2' init_sat_nand_inv_comb]\n  unfolding sub_def inv_def by (metis (no_types, lifting) add_diff_cancel_right' assms(1)\n  sim_fin2.cases world_maxtime_lt_fst_tres)\n\nend\n", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Subtraction_Hoare_Typed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.566018549837479, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.3268730891403386}}
{"text": "theory sugar \nimports Main\nbegin\n\nsubsection {* Syntactic sugar *}\n\ntext {* Here we define some helper functions, to shorten the notation in this document. *}\n\ndefinition orElse (infixr \"orElse\" 25) where\n\"x orElse y \\<equiv> (case x of Some a \\<Rightarrow> a | None \\<Rightarrow> y)\"\n\nlemma orElse_some[simp]: \"(Some x orElse y) = x\"\n  by (simp add: orElse_def)\n\nlemma orElse_none[simp]: \"(None orElse x) = x\"\n  by (simp add: orElse_def)\n\ndefinition compose_forward (infixl \"|>\" 25) where\n\"x |> f \\<equiv> f x\"\n\nlemma \"(1 |> op+ 1 |> op* 2) = (4 :: int)\"\n  by eval\n\n\nend", "meta": {"author": "peterzeller", "repo": "ref-crdt", "sha": "b5678901b2489d87a7676188d14addf3778e235f", "save_path": "github-repos/isabelle/peterzeller-ref-crdt", "path": "github-repos/isabelle/peterzeller-ref-crdt/ref-crdt-b5678901b2489d87a7676188d14addf3778e235f/sugar.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185498374789, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.32687308914033847}}
{"text": "theory Rustv\n  imports Defs BorrowStack\nbegin\n\nabbreviation \"collect_tags_stack == BorrowStack.collect_tags\"\nabbreviation \"pop_tags_stack == BorrowStack.pop_tags\"\nabbreviation \"permission_is_stack == BorrowStack.permission_is\"\nabbreviation \"readable_stack == BorrowStack.readable\"\nabbreviation \"writable_stack == BorrowStack.writable\"\nabbreviation \"reborrow_comp_stack == BorrowStack.reborrow_comp\"\nabbreviation \"reborrow_stack == BorrowStack.reborrow\"\n\nrecord globals_ram =\n  memory :: \"val list\"\n  tags :: \"(ref_kind * tag set) stack list\"\n  issued_tags :: \"tag list\"\n\nfun wf_tags :: \"(ref_kind * tag set) stack list \\<Rightarrow> bool\" where\n  \"wf_tags [] = True\" |\n  \"wf_tags (stack # ts) = (wf_reborrow stack \\<and> stack_finite stack \\<and> wf_tags ts)\"\n\nlemma wf_tags_spec:\n  \"wf_tags ts \\<longleftrightarrow> (\\<forall>stack \\<in> set ts. wf_reborrow stack \\<and> stack_finite stack)\"\nproof (induction ts)\nqed auto\n\nlemma wf_tags_snoc:\n  \"wf_tags (ts @ [stack]) \\<longleftrightarrow> wf_tags ts \\<and> wf_reborrow stack \\<and> stack_finite stack\"\n  using wf_tags_spec by auto\n\nlemma list_update_forall:\n  \"\\<lbrakk>\\<forall>x \\<in> set xs. P x; P x'\\<rbrakk> \\<Longrightarrow> \\<forall>x \\<in> set (xs[p := x']). P x\"\n  using set_update_subset_insert by fastforce\n\nlemma wf_tags_update:\n  assumes\n    \"wf_tags ts\"\n    \"wf_reborrow stack\"\n    \"stack_finite stack\"\n  shows \"wf_tags (ts[p := stack])\"\n  using assms set_update_subset_insert wf_tags_spec by fastforce\n\nfun collect_tags :: \"(ref_kind * tag set) stack list \\<Rightarrow> tag set\" where\n  \"collect_tags [] = {}\" |\n  \"collect_tags (stack # ts) = collect_tags_stack stack \\<union> collect_tags ts\"\nlemma collect_tags_spec:\n  \"t \\<in> collect_tags ts \\<longleftrightarrow> (\\<exists>stack \\<in> set ts. \\<exists>entry \\<in> set (map snd stack). t \\<in> entry)\"\nproof (induction ts)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons stack ts)\n  show ?case\n  proof\n    assume \"t \\<in> collect_tags (stack # ts)\"\n    then have \"t \\<in> \\<Union>(set (map snd stack)) \\<or> t \\<in> collect_tags ts\" by simp\n    then show \"\\<exists>s \\<in> set (stack # ts). \\<exists>entry \\<in> set (map snd s). t \\<in> entry\"\n    proof (rule disjE)\n      assume \"t \\<in> \\<Union>(set (map snd stack))\"\n      then show ?thesis by simp\n    next\n      assume \"t \\<in> collect_tags ts\"\n      then show ?thesis by (simp add: Cons.IH)\n    qed\n  next\n    assume \"\\<exists>stack \\<in> set (stack # ts). \\<exists>entry \\<in> set (map snd stack). t \\<in> entry\"\n    then obtain s entry where\n      1: \"s \\<in> set (stack # ts)\" and\n      2: \"entry \\<in> set (map snd s)\" and\n      3: \"t \\<in> entry\"\n      by auto\n\n    have \"s = stack \\<or> s \\<in> set ts\" using 1 by auto\n    then show \"t \\<in> collect_tags (stack # ts)\"\n    proof (rule disjE)\n      assume \"s = stack\"\n      then have \"\\<exists>entry \\<in> set (map snd stack). t \\<in> entry\" using 2 3 by auto\n      then show ?thesis by simp\n    next\n      assume \"s \\<in> set ts\"\n      then have \"\\<exists>s \\<in> set ts. \\<exists>entry \\<in> set (map snd s). t \\<in> entry\"\n        using 2 3 by auto\n      then show ?thesis by (simp add: Cons.IH)\n    qed\n  qed\nqed\n\nlemma collect_tags_spec':\n  \"t \\<in> collect_tags ts \\<longleftrightarrow> (\\<exists>stack \\<in> set ts. t \\<in> collect_tags_stack stack)\"\n  using collect_tags_spec by fastforce\n\nlemma collect_tags_update[simp, intro]:\n  \"t \\<in> collect_tags (ts[p := stack]) \\<Longrightarrow> t \\<in> collect_tags ts \\<or> t \\<in> collect_tags_stack stack\"\n  using collect_tags_spec set_update_subset_insert subset_code(1) by fastforce\n\nlemma collect_tags_update_subset:\n  \"collect_tags (ts[p := stack]) \\<subseteq> collect_tags_stack stack \\<union> collect_tags ts\"\n  using collect_tags_update by blast\n\nlemma collect_tags_last[simp, intro]:\n  \"collect_tags (ts @ [stack]) = collect_tags_stack stack \\<union> (collect_tags ts)\"\nproof (induction ts)\nqed auto\n\nlemma collect_tags_finite[simp, intro]: \"wf_tags ts \\<Longrightarrow> finite (collect_tags ts)\"\nproof (induction ts)\n  case (Cons stack ts)\n  then have \"stack_finite stack \\<and> finite (collect_tags ts)\" by auto\n  then show ?case using collect_tags_stack_finite by auto\nqed auto\n\nfun wf_heap :: \"'a globals_ram_scheme \\<Rightarrow> bool\" where\n  \"wf_heap s \\<longleftrightarrow>\n    length (memory s) = length (tags s)\n    \\<and> wf_tags (tags s)\n    \\<and> collect_tags (tags s) \\<subseteq> set (issued_tags s)\"\n\nfun pop_tags :: \"tagged_ref \\<Rightarrow> 'a globals_ram_scheme \\<Rightarrow> 'a globals_ram_scheme\" where\n  \"pop_tags r s =\n    (let p = the_ptr (pointer r);\n         stack = tags s ! p;\n         stack' = pop_tags_stack (tag r) stack in\n    s\\<lparr> tags := (tags s)[p := stack'] \\<rparr>)\"\n\nfun_cases pop_tags_elims: \"pop_tags r s = s'\"\n\nlemma pop_tags_wf_tags:\n  assumes\n    \"pop_tags r s = s'\"\n    \"the_ptr (pointer r) < length (tags s)\"\n    \"(tags s') ! the_ptr (pointer r) \\<noteq> []\"\n    \"wf_tags (tags s)\"\n  shows \"wf_tags (tags s')\"\n  using assms(1) apply (rule pop_tags_elims, simp add: Let_def)\n  apply (rule wf_tags_update)\n  using assms(4) apply simp\n  using assms dropWhile_stack_reborrow wf_tags_spec apply simp\n  using assms dropWhile_stack_finite wf_tags_spec by simp\n\nlemma hd_pop_tags:\n  assumes\n    \"pop_tags r s = s'\"\n    \"the_ptr (pointer r) < length (tags s)\"\n    \"tag r \\<in> collect_tags_stack ((tags s) ! the_ptr (pointer r))\"\n  shows \"tag r \\<in> snd (hd ((tags s') ! the_ptr (pointer r)))\"\n  using assms(1) apply (rule pop_tags_elims)\n  using assms hd_dropWhile_stack Let_def  by (auto simp add: Let_def)\n\nlemma pop_tags_memory[intro]:\n  \"pop_tags r s = s' \\<Longrightarrow> memory s' = memory s\"\n  apply (erule pop_tags.elims)\n  by (simp add: Let_def)\n\nlemma pop_tags_tags_length:\n  assumes \"pop_tags r s = s'\"\n  shows \"length (tags s) = length (tags s')\"\nusing assms proof (rule pop_tags_elims, auto simp add: Let_def)\nqed\n\nlemma pop_tags_result:\n  assumes\n    \"pop_tags r s = s'\"\n    \"the_ptr (pointer r) < length (tags s)\"\n    \"p < length (tags s)\"\n  shows \"\\<exists>start. (tags s) ! p =\n    (if p = the_ptr (pointer r) then\n      start @ (tags s') ! p\n    else\n       (tags s') ! p)\"\nproof -\n  have \"p \\<noteq> the_ptr (pointer r) \\<Longrightarrow> (tags s) ! p = (tags s') ! p\"\n    using assms(1) apply (rule pop_tags_elims)\n    by (auto simp add: Let_def)\n  moreover have \"p = the_ptr (pointer r) \\<Longrightarrow> \\<exists>start. (tags s) ! p = start @ (tags s') ! p\"\n    using assms(1) apply (rule pop_tags_elims)\n    apply (auto simp add: Let_def)\n    by (metis assms(2) takeWhile_dropWhile_id nth_list_update_eq)\n  ultimately show ?thesis by simp\nqed\n\nfun memread :: \"tagged_ref \\<Rightarrow> 'a globals_ram_scheme \\<Rightarrow> val\" where\n  \"memread p s =\n    (let memory = memory s in\n    memory ! (the_ptr (pointer p)))\"\n\nfun memwrite :: \"tagged_ref \\<Rightarrow> val \\<Rightarrow> 'a globals_ram_scheme \\<Rightarrow> 'a globals_ram_scheme\"\n  where\n  \"memwrite p v s =\n    (let memory = memory s in\n    let memory' = memory[the_ptr (pointer p) := v] in\n    s\\<lparr> memory := memory' \\<rparr>)\"\n\nlemma memwrite_written[simp]:\n  fixes p v s s'\n  assumes \"s' = memwrite p v s\"\n          \"the_ptr (pointer p) < length (memory s)\"\n  shows \"(memory s') ! the_ptr (pointer p) = v\"\n  by (simp add: assms(1) assms(2))\nlemma memwrite_not_written[simp]:\n  fixes p p' v s s'\n  assumes \"s' = memwrite p v s\"\n          \"pointer p \\<noteq> pointer p'\"\n        shows \"(memory s') ! the_ptr (pointer p') = (memory s) ! the_ptr (pointer p')\"\n  apply (simp add: assms(1))\n  by (metis assms(2) nth_list_update_neq the_ptr.elims)\nlemma memwrite_tags:\n  fixes p v s s'\n  assumes \"s' = memwrite p v s\"\n  shows \"tags s' = tags s\"\n  by (simp add: assms)\n\nfun max_list :: \"nat list \\<Rightarrow> nat\" where\n  \"max_list [] = 0\" |\n  \"max_list (x # xs) = max x (max_list xs)\"\n\nlemma max_list_ge: \"\\<forall>x \\<in> set xs. max_list xs \\<ge> x\"\nproof (induction xs)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons x' xs)\n  then show ?case by auto\nqed\n\nlemma suc_max_list_gt: \"\\<forall>x \\<in> set xs. Suc (max_list xs) > x\"\n  using max_list_ge by fastforce\n\nlemma max_simp[simp]: \"max (Suc n) n = Suc n\"\n  by simp\n\nfun new_tag :: \"'a globals_ram_scheme \\<Rightarrow> tag\" where\n  \"new_tag s = tag_val (Suc (max_list (map the_tag (issued_tags s))))\"\n\nfun_cases new_tag_elims: \"new_tag s = t\"\n\nlemma new_tag_gt: \"\\<forall>t \\<in> set (issued_tags s). the_tag (new_tag s) > the_tag t\"\n  using suc_max_list_gt by simp\n\nlemma new_tag_notin[simp, intro]: \"new_tag s = t \\<Longrightarrow> t \\<notin> set (issued_tags s)\"\n  using new_tag_gt by blast\n\nlemma new_tag_notin_at:\n  assumes\n    \"wf_heap s\"\n    \"new_tag s = t\"\n    \"r < length (tags s)\"\n  shows \"t \\<notin> collect_tags_stack (tags s ! r)\"\nproof -\n  have \"t \\<notin> set (issued_tags s)\" using assms by auto\n  then have \"t \\<notin> collect_tags (tags s)\" using assms by auto\n  thus ?thesis using assms using collect_tags_spec' nth_mem by blast\nqed\n\nfun permission_is :: \"ref_kind \\<Rightarrow> tagged_ref \\<Rightarrow> 'a globals_ram_scheme \\<Rightarrow> bool\" where\n  \"permission_is k r s =\n    (let p = the_ptr (pointer r) in\n    let t = tag r in\n    p < length (memory s) \\<and> permission_is_stack k t (tags s ! p))\"\n\nfun readable :: \"tagged_ref \\<Rightarrow> 'a globals_ram_scheme \\<Rightarrow> bool\" where\n  \"readable r s =\n    (let p = the_ptr (pointer r) in\n    let t = tag r in\n    p < length (memory s) \\<and> readable_stack t (tags s ! p))\"\n\nfun writable :: \"tagged_ref \\<Rightarrow> 'a globals_ram_scheme \\<Rightarrow> bool\" where\n  \"writable r s =\n    (let p = the_ptr (pointer r) in\n    let t = tag r in\n    p < length (memory s) \\<and> writable_stack t (tags s ! p))\"\n\nlemma writable_update[simp]: \"writable r (memwrite r' v s) = writable r s\"\n  by simp\n\nlemma pop_tags_writable[intro]: \"\\<lbrakk>writable r s; wf_heap s\\<rbrakk> \\<Longrightarrow> writable r (pop_tags r s)\"\n  apply (auto simp del: BorrowStack.pop_tags.simps)\n  by (metis nth_list_update_eq writable_pop_tags)\n\nfun new_pointer :: \"'a globals_ram_scheme \\<Rightarrow> pointer\" where\n  \"new_pointer s = ptr_val (length (memory s))\"\n\nfun heap_new :: \"val \\<Rightarrow> 'a globals_ram_scheme \\<Rightarrow> tagged_ref * 'a globals_ram_scheme\" where\n  \"heap_new v s =\n    (let p = new_pointer s;\n         t = new_tag s in\n    (\\<lparr> pointer = p, tag = t \\<rparr>,\n     s\\<lparr> memory := memory s @ [v],\n        tags := tags s @ [[(Unique, {t})]],\n        issued_tags := t # issued_tags s \\<rparr>))\"\n\nfun_cases heap_new_elims: \"heap_new v s = (r, s')\"\n\nlemma heap_new_writable: \"\\<lbrakk>wf_heap s; heap_new v s = (r', s')\\<rbrakk> \\<Longrightarrow> writable r' s'\"\n  apply (erule heap_new_elims)\n  by (simp add: Let_def)\n\nlemma heap_new_wf_heap_update: \"\\<lbrakk>wf_heap s; heap_new v s = (r', s')\\<rbrakk> \\<Longrightarrow> wf_heap s'\"\n  apply (erule heap_new_elims)\n  by (auto simp add: Let_def wf_tags_snoc BorrowRoot)\n\nfun reborrow :: \"ref_kind \\<Rightarrow> tagged_ref \\<Rightarrow> 'a globals_ram_scheme \\<Rightarrow> tagged_ref * 'a globals_ram_scheme\" where\n  \"reborrow k r s =\n    (let p = the_ptr (pointer r) in\n    let t = new_tag s in\n    let tags = (tags s)[p := reborrow_comp_stack k t (tag r) ((tags s) ! p)] in\n    (\\<lparr> pointer = pointer r, tag = t \\<rparr>,  s\\<lparr> tags := tags, issued_tags := t # issued_tags s \\<rparr>))\"\n\ndeclare BorrowStack.reborrow_comp.simps [simp del]\nfun_cases reborrow_elims: \"reborrow k r s = (r', s')\"\ndeclare BorrowStack.reborrow_comp.simps [simp]\n\nlemma collect_tags_stack_reborrow_subset:\n  assumes\n    \"pop_tags_stack parent stack = popped\"\n    \"reborrow_stack k child popped = stack'\"\n  shows \"collect_tags_stack stack' \\<subseteq> {child} \\<union> collect_tags_stack stack\"\nproof -\n  have \"collect_tags_stack stack' \\<subseteq> {child} \\<union> collect_tags_stack popped\"\n    using collect_tags_reborrow_subset assms by simp\n  moreover have \"collect_tags_stack popped \\<subseteq> collect_tags_stack stack\"\n    using notin_pop_tags assms by simp\n  ultimately show ?thesis by auto\nqed\n\nlemma collect_tags_reborrow_subset:\n  \"\\<lbrakk>the_ptr (pointer r) < length (tags s); reborrow k r s = (r', s')\\<rbrakk> \\<Longrightarrow> collect_tags (tags s') \\<subseteq> {new_tag s} \\<union> collect_tags (tags s)\"\n  apply (erule reborrow_elims)\n  apply (simp add: Let_def del: reborrow_comp.simps)\n  using collect_tags_update_subset reborrow_comp_subset collect_tags_spec' nth_mem by blast\n\nlemma collect_tags_reborrow_subset':\n  \"\\<lbrakk>the_ptr (pointer r) < length (tags s)\\<rbrakk>\n  \\<Longrightarrow> collect_tags (tags (snd (reborrow k r s))) \\<subseteq> {new_tag s} \\<union> collect_tags (tags s)\"\n  apply (simp add: Let_def del: reborrow_comp.simps)\n  using collect_tags_update_subset reborrow_comp_subset collect_tags_spec' nth_mem by blast\n\nlemma reborrow_pointer: \"reborrow k r s = (r', s') \\<Longrightarrow> pointer r' = pointer r\"\n  apply (erule reborrow_elims)\n  by (auto simp add: Let_def)\n\nlemma new_tag_collect:\n  assumes\n    \"p < length ts\"\n    \"x \\<in> collect_tags (ts[p := reborrow_comp_stack k t' t (ts ! p)])\"\n      (is \"x \\<in> collect_tags (ts[p := ?stack])\")\n    \"collect_tags ts \\<subseteq> issued\"\n    \"x \\<notin> issued\"\n  shows \"x = t'\"\nproof -\n  have \"x \\<in> collect_tags_stack ?stack \\<union> collect_tags ts\"\n    using assms collect_tags_update by blast\n  then have \"x \\<in> {t'} \\<union> collect_tags_stack (ts ! p) \\<union> collect_tags ts\"\n    using reborrow_comp_subset by blast\n  moreover have \"collect_tags_stack (ts ! p) \\<subseteq> collect_tags ts\"\n    using assms collect_tags_spec' nth_mem by blast\n  ultimately have \"x \\<in> {t'} \\<union> collect_tags ts\" by auto\n  then show ?thesis using assms by auto\nqed\n\nlemma reborrow_update_heap': \"\\<lbrakk>wf_heap s; writable r s\\<rbrakk> \\<Longrightarrow> wf_heap (snd (reborrow k r s))\"\n  apply (auto simp add: Let_def)\n   apply (rule wf_tags_update, auto)\n    apply (rule wf_reborrow_reborrow_comp, auto)\n     apply (simp add: wf_tags_spec)\n  using new_tag_notin_at apply fastforce\n   apply (rule stack_finite_reborrow, auto)\n   apply (rule dropWhile_stack_finite)\n   apply (simp add: wf_tags_spec)\n  using new_tag_collect by auto\n\nlemma reborrow_update_heap: \"\\<lbrakk>wf_heap s; writable r s; reborrow k r s = (r', s')\\<rbrakk> \\<Longrightarrow> wf_heap s'\"\n  using reborrow_update_heap' by (metis snd_conv)\n\nlemma reborrow_writable: \"\\<lbrakk>wf_heap s; writable r s; reborrow k r s = (r', s')\\<rbrakk> \\<Longrightarrow> writable r s'\"\n  apply (erule reborrow_elims)\n  apply (simp add: Let_def del: BorrowStack.reborrow_comp.simps)\n  apply (rule writable_reborrow_comp)\n     apply blast\n    apply blast\n  using wf_tags_spec nth_mem apply blast\n  using new_tag_notin_at by auto\n\nlemma reborrow_writable_derived:\n  assumes\n    \"wf_heap s\"\n    \"writable r s\"\n    \"reborrow k r s = (r', s')\"\n    \"k = Unique \\<or> k = SharedReadWrite\"\n  shows \"writable r' s'\"\n  using assms(3) apply (rule reborrow_elims)\n  using assms apply (simp add: Let_def del: BorrowStack.reborrow_comp.simps)\n  apply (rule writable_reborrow_comp_derived[of \"tag r\" \"tags s ! the_ptr (pointer r)\" k])\n  using wf_tags_spec apply auto[3]\n  using new_tag_notin_at by auto\n\nlemma lemma_for_write_ex1:\n  assumes\n    \"the_ptr (pointer p) < length ts\"\n    \"\\<exists>x \\<in> set (ts ! the_ptr (pointer p)). t \\<in> snd x\"\n  shows \"t \\<in> collect_tags ts\"\n  using assms collect_tags_spec nth_mem by auto\n\nlemma lemma_for_write_ex:\n  assumes\n    \"the_ptr (pointer p) < length ts\"\n    \"collect_tags ts \\<subseteq> set issued\"\n  shows \"\\<forall>x \\<in> set (ts ! the_ptr (pointer p)). tag_val (Suc (max_list (map the_tag issued))) \\<notin> snd x\"\n  using assms lemma_for_write_ex1\n  by (metis Suc_n_not_le_n in_set_conv_nth length_map max_list_ge nth_map subsetD the_tag.simps)\n\nlemma wf_tags_in_same_layer_dropWhile:\n  fixes x y tags\n  assumes\n    \"wf_tags tags\"\n    \"ptr_eq x y\"\n    \"the_ptr (pointer y) < length tags\"\n    \"in_same_layer (tag x) (tag y) (tags ! the_ptr (pointer y))\"\n  shows \"dropWhile (\\<lambda>entry. tag x \\<notin> snd entry) (tags ! the_ptr (pointer y))\n        = dropWhile (\\<lambda>entry. tag y \\<notin> snd entry) (tags ! the_ptr (pointer y))\"\n  using assms in_same_layer_pop_tags wf_tags_spec by fastforce\n\nend\n", "meta": {"author": "pandaman64", "repo": "sabi", "sha": "a5de6b33cb0e5b9e6f0e610de0a3536236d1a694", "save_path": "github-repos/isabelle/pandaman64-sabi", "path": "github-repos/isabelle/pandaman64-sabi/sabi-a5de6b33cb0e5b9e6f0e610de0a3536236d1a694/Rustv/Rustv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3268730889167336}}
{"text": "(* Author:     Giampaolo Bella, Catania University\n*)\n\nsection\\<open>Theory of smartcards\\<close>\n\ntheory Smartcard\nimports EventSC \"../All_Symmetric\"\nbegin\n\ntext\\<open>\nAs smartcards handle long-term (symmetric) keys, this theoy extends and \nsupersedes theory Private.thy\n\nAn agent is bad if she reveals her PIN to the spy, not the shared key that\nis embedded in her card. An agent's being bad implies nothing about her \nsmartcard, which independently may be stolen or cloned.\n\\<close>\n\naxiomatization\n  shrK    :: \"agent => key\" and  (*long-term keys saved in smart cards*)\n  crdK    :: \"card  => key\" and  (*smart cards' symmetric keys*)\n  pin     :: \"agent => key\" and  (*pin to activate the smart cards*)\n\n  (*Mostly for Shoup-Rubin*)\n  Pairkey :: \"agent * agent => nat\" and\n  pairK   :: \"agent * agent => key\"\nwhere\n  inj_shrK: \"inj shrK\" and  \\<comment>\\<open>No two smartcards store the same key\\<close>\n  inj_crdK: \"inj crdK\" and  \\<comment>\\<open>Nor do two cards\\<close>\n  inj_pin : \"inj pin\" and   \\<comment>\\<open>Nor do two agents have the same pin\\<close>\n\n  (*pairK is injective on each component, if we assume encryption to be a PRF\n    or at least collision free *)\n  inj_pairK    [iff]: \"(pairK(A,B) = pairK(A',B')) = (A = A' & B = B')\" and\n  comm_Pairkey [iff]: \"Pairkey(A,B) = Pairkey(B,A)\" and\n\n  (*long-term keys differ from each other*)\n  pairK_disj_crdK [iff]: \"pairK(A,B) \\<noteq> crdK C\" and\n  pairK_disj_shrK [iff]: \"pairK(A,B) \\<noteq> shrK P\" and\n  pairK_disj_pin [iff]:  \"pairK(A,B) \\<noteq> pin P\" and\n  shrK_disj_crdK [iff]:  \"shrK P \\<noteq> crdK C\" and\n  shrK_disj_pin [iff]:  \"shrK P \\<noteq> pin Q\" and\n  crdK_disj_pin [iff]:   \"crdK C \\<noteq> pin P\"\n\ndefinition legalUse :: \"card => bool\" (\"legalUse (_)\") where\n  \"legalUse C == C \\<notin> stolen\"\n\nprimrec illegalUse :: \"card  => bool\" where\n  illegalUse_def: \"illegalUse (Card A) = ( (Card A \\<in> stolen \\<and> A \\<in> bad)  \\<or>  Card A \\<in> cloned )\"\n\n\ntext\\<open>initState must be defined with care\\<close>\n\noverloading\n  initState \\<equiv> initState\nbegin\n\nprimrec initState where\n(*Server knows all long-term keys; adding cards' keys may be redundant but\n  helps prove crdK_in_initState and crdK_in_used to distinguish cards' keys\n  from fresh (session) keys*)\n  initState_Server:  \"initState Server = \n        (Key`(range shrK \\<union> range crdK \\<union> range pin \\<union> range pairK)) \\<union> \n        (Nonce`(range Pairkey))\" |\n\n(*Other agents know only their own*)\n  initState_Friend:  \"initState (Friend i) = {Key (pin (Friend i))}\" |\n\n(*Spy knows bad agents' pins, cloned cards' keys, pairKs, and Pairkeys *)\n  initState_Spy: \"initState Spy  = \n                 (Key`((pin`bad) \\<union> (pin `{A. Card A \\<in> cloned}) \\<union> \n                                      (shrK`{A. Card A \\<in> cloned}) \\<union> \n                        (crdK`cloned) \\<union> \n                        (pairK`{(X,A). Card A \\<in> cloned})))\n           \\<union> (Nonce`(Pairkey`{(A,B). Card A \\<in> cloned & Card B \\<in> cloned}))\"\n\nend\n\ntext\\<open>Still relying on axioms\\<close>\naxiomatization where\n  Key_supply_ax:  \"finite KK \\<Longrightarrow> \\<exists> K. K \\<notin> KK & Key K \\<notin> used evs\" and\n\n  (*Needed because of Spy's knowledge of Pairkeys*)\n  Nonce_supply_ax: \"finite NN \\<Longrightarrow> \\<exists> N. N \\<notin> NN & Nonce N \\<notin> used evs\"\n\n\n\n\n\n\n\nsubsection\\<open>Basic properties of shrK\\<close>\n\n(*Injectiveness: Agents' long-term keys are distinct.*)\ndeclare inj_shrK [THEN inj_eq, iff]\ndeclare inj_crdK [THEN inj_eq, iff]\ndeclare inj_pin  [THEN inj_eq, iff]\n\nlemma invKey_K [simp]: \"invKey K = K\"\napply (insert isSym_keys)\napply (simp add: symKeys_def) \ndone\n\n\nlemma analz_Decrypt' [dest]:\n     \"\\<lbrakk> Crypt K X \\<in> analz H;  Key K  \\<in> analz H \\<rbrakk> \\<Longrightarrow> X \\<in> analz H\"\nby auto\n\ntext\\<open>Now cancel the \\<open>dest\\<close> attribute given to\n \\<open>analz.Decrypt\\<close> in its declaration.\\<close>\ndeclare analz.Decrypt [rule del]\n\ntext\\<open>Rewrites should not refer to  @{term \"initState(Friend i)\"} because\n  that expression is not in normal form.\\<close>\n\ntext\\<open>Added to extend initstate with set of nonces\\<close>\nlemma parts_image_Nonce [simp]: \"parts (Nonce`N) = Nonce`N\"\n  by auto\n\nlemma keysFor_parts_initState [simp]: \"keysFor (parts (initState C)) = {}\"\napply (unfold keysFor_def)\napply (induct_tac \"C\", auto)\ndone\n\n(*Specialized to shared-key model: no @{term invKey}*)\nlemma keysFor_parts_insert:\n     \"\\<lbrakk> K \\<in> keysFor (parts (insert X G));  X \\<in> synth (analz H) \\<rbrakk> \n     \\<Longrightarrow> K \\<in> keysFor (parts (G \\<union> H)) | Key K \\<in> parts H\"\nby (force dest: EventSC.keysFor_parts_insert)  \n\nlemma Crypt_imp_keysFor: \"Crypt K X \\<in> H \\<Longrightarrow> K \\<in> keysFor H\"\nby (drule Crypt_imp_invKey_keysFor, simp)\n\n\nsubsection\\<open>Function \"knows\"\\<close>\n\n(*Spy knows the pins of bad agents!*)\nlemma Spy_knows_bad [intro!]: \"A \\<in> bad \\<Longrightarrow> Key (pin A) \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) add: imageI knows_Cons split: event.split)\ndone\n\n(*Spy knows the long-term keys of cloned cards!*)\nlemma Spy_knows_cloned [intro!]: \n     \"Card A \\<in> cloned \\<Longrightarrow>  Key (crdK (Card A)) \\<in> knows Spy evs &   \n                           Key (shrK A) \\<in> knows Spy evs &  \n                           Key (pin A)  \\<in> knows Spy evs &  \n                          (\\<forall> B. Key (pairK(B,A)) \\<in> knows Spy evs)\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) add: imageI knows_Cons split: event.split)\ndone\n\nlemma Spy_knows_cloned1 [intro!]: \"C \\<in> cloned \\<Longrightarrow> Key (crdK C) \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) add: imageI knows_Cons split: event.split)\ndone\n\nlemma Spy_knows_cloned2 [intro!]: \"\\<lbrakk> Card A \\<in> cloned; Card B \\<in> cloned \\<rbrakk>  \n   \\<Longrightarrow> Nonce (Pairkey(A,B))\\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) add: imageI knows_Cons split: event.split)\ndone\n\n(*Spy only knows pins of bad agents!*)\nlemma Spy_knows_Spy_bad [intro!]: \"A\\<in> bad \\<Longrightarrow> Key (pin A) \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) add: imageI knows_Cons split: event.split)\ndone\n\n\n(*For case analysis on whether or not an agent is compromised*)\nlemma Crypt_Spy_analz_bad: \n  \"\\<lbrakk> Crypt (pin A) X \\<in> analz (knows Spy evs);  A\\<in>bad \\<rbrakk>   \n      \\<Longrightarrow> X \\<in> analz (knows Spy evs)\"\napply (force dest!: analz.Decrypt)\ndone\n\n(** Fresh keys never clash with other keys **)\n\nlemma shrK_in_initState [iff]: \"Key (shrK A) \\<in> initState Server\"\napply (induct_tac \"A\")\napply auto\ndone\n\nlemma shrK_in_used [iff]: \"Key (shrK A) \\<in> used evs\"\napply (rule initState_into_used)\napply blast\ndone\n\nlemma crdK_in_initState [iff]: \"Key (crdK A) \\<in> initState Server\"\napply (induct_tac \"A\")\napply auto\ndone\n\nlemma crdK_in_used [iff]: \"Key (crdK A) \\<in> used evs\"\napply (rule initState_into_used)\napply blast\ndone\n\nlemma pin_in_initState [iff]: \"Key (pin A) \\<in> initState A\"\napply (induct_tac \"A\")\napply auto\ndone\n\nlemma pin_in_used [iff]: \"Key (pin A) \\<in> used evs\"\napply (rule initState_into_used)\napply blast\ndone\n\nlemma pairK_in_initState [iff]: \"Key (pairK X) \\<in> initState Server\"\napply (induct_tac \"X\")\napply auto\ndone\n\nlemma pairK_in_used [iff]: \"Key (pairK X) \\<in> used evs\"\napply (rule initState_into_used)\napply blast\ndone\n\n\n\n(*Used in parts_induct_tac and analz_Fake_tac to distinguish session keys\n  from long-term shared keys*)\nlemma Key_not_used [simp]: \"Key K \\<notin> used evs \\<Longrightarrow> K \\<notin> range shrK\"\nby blast\n\nlemma shrK_neq [simp]: \"Key K \\<notin> used evs \\<Longrightarrow> shrK B \\<noteq> K\"\nby blast\n\nlemma crdK_not_used [simp]: \"Key K \\<notin> used evs \\<Longrightarrow> K \\<notin> range crdK\"\napply clarify\ndone\n\nlemma crdK_neq [simp]: \"Key K \\<notin> used evs \\<Longrightarrow> crdK C \\<noteq> K\"\napply clarify\ndone\n\nlemma pin_not_used [simp]: \"Key K \\<notin> used evs \\<Longrightarrow> K \\<notin> range pin\"\napply clarify\ndone\n\nlemma pin_neq [simp]: \"Key K \\<notin> used evs \\<Longrightarrow> pin A \\<noteq> K\"\napply clarify\ndone\n\nlemma pairK_not_used [simp]: \"Key K \\<notin> used evs \\<Longrightarrow> K \\<notin> range pairK\"\napply clarify\ndone\n\nlemma pairK_neq [simp]: \"Key K \\<notin> used evs \\<Longrightarrow> pairK(A,B) \\<noteq> K\"\napply clarify\ndone\n\ndeclare shrK_neq [THEN not_sym, simp]\ndeclare crdK_neq [THEN not_sym, simp]\ndeclare pin_neq [THEN not_sym, simp]\ndeclare pairK_neq [THEN not_sym, simp]\n\n\nsubsection\\<open>Fresh nonces\\<close>\n\nlemma Nonce_notin_initState [iff]: \"Nonce N \\<notin> parts (initState (Friend i))\"\nby auto\n\n\n(*This lemma no longer holds of smartcard protocols, where the cards can store\n  nonces.\n\nlemma Nonce_notin_used_empty [simp]: \"Nonce N \\<notin> used []\"\napply (simp (no_asm) add: used_Nil)\ndone\n\nSo, we must use old-style supply fresh nonce theorems relying on the appropriate axiom*)\n\n\nsubsection\\<open>Supply fresh nonces for possibility theorems.\\<close>\n\n\nlemma Nonce_supply1: \"\\<exists>N. Nonce N \\<notin> used evs\"\napply (rule finite.emptyI [THEN Nonce_supply_ax, THEN exE], blast)\ndone\n\nlemma Nonce_supply2: \n  \"\\<exists>N N'. Nonce N \\<notin> used evs & Nonce N' \\<notin> used evs' & N \\<noteq> N'\"\napply (cut_tac evs = evs in finite.emptyI [THEN Nonce_supply_ax])\napply (erule exE)\napply (cut_tac evs = evs' in finite.emptyI [THEN finite.insertI, THEN Nonce_supply_ax]) \napply auto\ndone\n\n\nlemma Nonce_supply3: \"\\<exists>N N' N''. Nonce N \\<notin> used evs & Nonce N' \\<notin> used evs' &  \n                    Nonce N'' \\<notin> used evs'' & N \\<noteq> N' & N' \\<noteq> N'' & N \\<noteq> N''\"\napply (cut_tac evs = evs in finite.emptyI [THEN Nonce_supply_ax])\napply (erule exE)\napply (cut_tac evs = evs' and a1 = N in finite.emptyI [THEN finite.insertI, THEN Nonce_supply_ax]) \napply (erule exE)\napply (cut_tac evs = evs'' and a1 = Na and a2 = N in finite.emptyI [THEN finite.insertI, THEN finite.insertI, THEN Nonce_supply_ax]) \napply blast\ndone\n\nlemma Nonce_supply: \"Nonce (@ N. Nonce N \\<notin> used evs) \\<notin> used evs\"\napply (rule finite.emptyI [THEN Nonce_supply_ax, THEN exE])\napply (rule someI, blast)\ndone\n\n\n\ntext\\<open>Unlike the corresponding property of nonces, we cannot prove\n    @{term \"finite KK \\<Longrightarrow> \\<exists>K. K \\<notin> KK & Key K \\<notin> used evs\"}.\n    We have infinitely many agents and there is nothing to stop their\n    long-term keys from exhausting all the natural numbers.  Instead,\n    possibility theorems must assume the existence of a few keys.\\<close>\n\n\nsubsection\\<open>Specialized Rewriting for Theorems About @{term analz} and Image\\<close>\n\nlemma subset_Compl_range_shrK: \"A \\<subseteq> - (range shrK) \\<Longrightarrow> shrK x \\<notin> A\"\nby blast\n\nlemma subset_Compl_range_crdK: \"A \\<subseteq> - (range crdK) \\<Longrightarrow> crdK x \\<notin> A\"\napply blast\ndone\n\nlemma subset_Compl_range_pin: \"A \\<subseteq> - (range pin) \\<Longrightarrow> pin x \\<notin> A\"\napply blast\ndone\n\nlemma subset_Compl_range_pairK: \"A \\<subseteq> - (range pairK) \\<Longrightarrow> pairK x \\<notin> A\"\napply blast\ndone\nlemma insert_Key_singleton: \"insert (Key K) H = Key ` {K} \\<union> H\"\nby blast\n\nlemma insert_Key_image: \"insert (Key K) (Key`KK \\<union> C) = Key`(insert K KK) \\<union> C\"\nby blast\n\n(** Reverse the normal simplification of \"image\" to build up (not break down)\n    the set of keys.  Use analz_insert_eq with (Un_upper2 RS analz_mono) to\n    erase occurrences of forwarded message components (X). **)\n\nlemmas analz_image_freshK_simps =\n       simp_thms mem_simps \\<comment>\\<open>these two allow its use with \\<open>only:\\<close>\\<close>\n       disj_comms \n       image_insert [THEN sym] image_Un [THEN sym] empty_subsetI insert_subset\n       analz_insert_eq Un_upper2 [THEN analz_mono, THEN [2] rev_subsetD]\n       insert_Key_singleton subset_Compl_range_shrK subset_Compl_range_crdK\n       subset_Compl_range_pin subset_Compl_range_pairK\n       Key_not_used insert_Key_image Un_assoc [THEN sym]\n\n(*Lemma for the trivial direction of the if-and-only-if*)\nlemma analz_image_freshK_lemma:\n     \"(Key K \\<in> analz (Key`nE \\<union> H)) \\<longrightarrow> (K \\<in> nE | Key K \\<in> analz H)  \\<Longrightarrow>  \n         (Key K \\<in> analz (Key`nE \\<union> H)) = (K \\<in> nE | Key K \\<in> analz H)\"\nby (blast intro: analz_mono [THEN [2] rev_subsetD])\n\n\nsubsection\\<open>Tactics for possibility theorems\\<close>\n\nML\n\\<open>\nstructure Smartcard =\nstruct\n\n(*Omitting used_Says makes the tactic much faster: it leaves expressions\n    such as  Nonce ?N \\<notin> used evs that match Nonce_supply*)\nfun possibility_tac ctxt =\n   (REPEAT \n    (ALLGOALS (simp_tac (ctxt\n      delsimps @{thms used_Cons_simps}\n      setSolver safe_solver))\n     THEN\n     REPEAT_FIRST (eq_assume_tac ORELSE' \n                   resolve_tac ctxt [refl, conjI, @{thm Nonce_supply}])))\n\n(*For harder protocols (such as Recur) where we have to set up some\n  nonces and keys initially*)\nfun basic_possibility_tac ctxt =\n    REPEAT \n    (ALLGOALS (asm_simp_tac (ctxt setSolver safe_solver))\n     THEN\n     REPEAT_FIRST (resolve_tac ctxt [refl, conjI]))\n\nval analz_image_freshK_ss = \n  simpset_of\n   (@{context} delsimps [image_insert, image_Un]\n               delsimps [@{thm imp_disjL}]    (*reduces blow-up*)\n               addsimps @{thms analz_image_freshK_simps})\nend\n\\<close>\n\n\n(*Lets blast_tac perform this step without needing the simplifier*)\nlemma invKey_shrK_iff [iff]:\n     \"(Key (invKey K) \\<in> X) = (Key K \\<in> X)\"\nby auto\n\n(*Specialized methods*)\n\nmethod_setup analz_freshK = \\<open>\n    Scan.succeed (fn ctxt =>\n     (SIMPLE_METHOD\n      (EVERY [REPEAT_FIRST (resolve_tac ctxt [allI, ballI, impI]),\n          REPEAT_FIRST (resolve_tac ctxt @{thms analz_image_freshK_lemma}),\n          ALLGOALS (asm_simp_tac (put_simpset Smartcard.analz_image_freshK_ss ctxt))])))\\<close>\n    \"for proving the Session Key Compromise theorem\"\n\nmethod_setup possibility = \\<open>\n    Scan.succeed (fn ctxt =>\n        SIMPLE_METHOD (Smartcard.possibility_tac ctxt))\\<close>\n    \"for proving possibility theorems\"\n\nmethod_setup basic_possibility = \\<open>\n    Scan.succeed (fn ctxt =>\n        SIMPLE_METHOD (Smartcard.basic_possibility_tac ctxt))\\<close>\n    \"for proving possibility theorems\"\n\nlemma knows_subset_knows_Cons: \"knows A evs \\<subseteq> knows A (e # evs)\"\nby (induct e) (auto simp: knows_Cons)\n\n(*Needed for actual protocols that will follow*)\ndeclare shrK_disj_crdK[THEN not_sym, iff]\ndeclare shrK_disj_pin[THEN not_sym, iff]\ndeclare pairK_disj_shrK[THEN not_sym, iff]\ndeclare pairK_disj_crdK[THEN not_sym, iff]\ndeclare pairK_disj_pin[THEN not_sym, iff]\ndeclare crdK_disj_pin[THEN not_sym, iff]\n\ndeclare legalUse_def [iff] illegalUse_def [iff]\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/Smartcard/Smartcard.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.32687308068501086}}
{"text": "section \\<open>Transfer Setup\\<close>\ntheory Refine_Transfer\nimports\n  Refine_Basic\n  Refine_While\n  Refine_Det \n  \"Generic/RefineG_Transfer\"\nbegin\n\nsubsection \\<open>Transfer to Deterministic Result Lattice\\<close>\ntext \\<open>\n  TODO: Once lattice and ccpo are connected, also transfer to option monad, that\n  is a ccpo, but no complete lattice!\n\\<close>\nsubsubsection \\<open>Connecting Deterministic and Non-Deterministic Result Lattices\\<close>\ndefinition \"nres_of r \\<equiv> case r of\n  dSUCCEEDi \\<Rightarrow> SUCCEED\n| dFAILi \\<Rightarrow> FAIL\n| dRETURN x \\<Rightarrow> RETURN x\"\n\nlemma nres_of_simps[simp]:\n  \"nres_of dSUCCEED = SUCCEED\"\n  \"nres_of dFAIL = FAIL\"\n  \"nres_of (dRETURN x) = RETURN x\"\n  apply -\n  unfolding nres_of_def bot_dres_def top_dres_def\n  by (auto simp del: dres_internal_simps)\n\nlemma nres_of_mono: \"mono nres_of\"\n  apply (rule)\n  apply (case_tac x, simp_all, case_tac y, simp_all)\n  done\n\nlemma nres_transfer:\n  \"nres_of dSUCCEED = SUCCEED\"\n  \"nres_of dFAIL = FAIL\"\n  \"nres_of a \\<le> nres_of b \\<longleftrightarrow> a\\<le>b\"\n  \"nres_of a < nres_of b \\<longleftrightarrow> a<b\"\n  \"is_chain A \\<Longrightarrow> nres_of (Sup A) = Sup (nres_of`A)\"\n  \"is_chain A \\<Longrightarrow> nres_of (Inf A) = Inf (nres_of`A)\"\n  apply simp_all\n  apply (case_tac a, simp_all, case_tac [!] b, simp_all) [1]\n\n  apply (simp add: less_le)\n  apply (case_tac a, simp_all, case_tac [!] b, simp_all) [1]\n\n  apply (erule dres_Sup_chain_cases)\n    apply (cases \"A={}\")\n    apply auto []\n    apply (subgoal_tac \"A={dSUCCEED}\", auto) []\n\n    apply (case_tac \"A={dRETURN r}\")\n    apply auto []\n    apply (subgoal_tac \"A={dSUCCEED,dRETURN r}\", auto) []\n\n    apply (drule imageI[where f=nres_of])\n    apply auto []\n\n  apply (erule dres_Inf_chain_cases)\n    apply (cases \"A={}\")\n    apply auto []\n    apply (subgoal_tac \"A={dFAIL}\", auto) []\n\n    apply (case_tac \"A={dRETURN r}\")\n    apply auto []\n    apply (subgoal_tac \"A={dFAIL,dRETURN r}\", auto) []\n\n    apply (drule imageI[where f=nres_of])\n    apply (auto intro: bot_Inf [symmetric]) []\n  done\n\nlemma nres_correctD:\n  assumes \"nres_of S \\<le> SPEC \\<Phi>\"\n  shows \n  \"S=dRETURN x \\<Longrightarrow> \\<Phi> x\"\n  \"S\\<noteq>dFAIL\"\n  using assms apply -\n  apply (cases S, simp_all)+\n  done\n\nsubsubsection \\<open>Transfer Theorems Setup\\<close>\ninterpretation dres: dist_transfer nres_of \n  apply unfold_locales\n  apply (simp add: nres_transfer)\n  done\n\nlemma nres_of_transfer[refine_transfer]: \"nres_of x \\<le> nres_of x\" by simp\n\nlemma det_FAIL[refine_transfer]: \"nres_of (dFAIL) \\<le> FAIL\" by auto\nlemma det_SUCCEED[refine_transfer]: \"nres_of (dSUCCEED) \\<le> SUCCEED\" by auto\nlemma det_SPEC: \"\\<Phi> x \\<Longrightarrow> nres_of (dRETURN x) \\<le> SPEC \\<Phi>\" by simp\nlemma det_RETURN[refine_transfer]: \n  \"nres_of (dRETURN x) \\<le> RETURN x\" by simp\nlemma det_bind[refine_transfer]:\n  assumes \"nres_of m \\<le> M\"\n  assumes \"\\<And>x. nres_of (f x) \\<le> F x\"\n  shows \"nres_of (dbind m f) \\<le> bind M F\"\n  using assms \n  apply (cases m) \n  apply (auto simp: pw_le_iff refine_pw_simps)\n  done\n\ninterpretation det_assert: transfer_generic_Assert_remove \n  bind RETURN ASSERT ASSUME\n  nres_of\n  by unfold_locales\n\ninterpretation det_while: transfer_WHILE\n  dbind dRETURN dWHILEIT dWHILEI dWHILET dWHILE \n  bind RETURN WHILEIT WHILEI WHILET WHILE nres_of\n  apply unfold_locales\n  apply (auto intro: det_bind)\n  done\n\n(*\ninterpretation det_foreach: \n  transfer_FOREACH nres_of dRETURN dbind \"case_dres True True\"\n  apply unfold_locales\n  apply (blast intro: det_bind)\n  apply simp\n  apply (case_tac m)\n  apply simp_all\n  done\n*)\n\n(* Done generally in RefineG_Transfer\nlemma det_rec_list[refine_transfer]:\n  assumes FN: \"\\<And>s. RETURN (fn s) \\<le> (fn' s)\"\n  assumes FC: \"\\<And>x l rec rec' s. \\<lbrakk> \\<And>s. RETURN (rec s) \\<le> (rec' s) \\<rbrakk> \n    \\<Longrightarrow> RETURN (fc x l rec s) \\<le> fc' x l rec' s\"\n  shows \"RETURN (rec_list fn fc l s) \\<le> rec_list fn' fc' l s\"\n  apply (induct l arbitrary: s)\n  apply (simp add: FN)\n  apply (simp add: FC)\n  done\n\nlemma det_rec_nat[refine_transfer]:\n  assumes FN: \"\\<And>s. RETURN (fn s) \\<le> (fn' s)\"\n  assumes FC: \"\\<And>n rec rec' s. \\<lbrakk> \\<And>s. RETURN (rec s) \\<le> (rec' s) \\<rbrakk> \n    \\<Longrightarrow> RETURN (fc x l rec s) \\<le> fc' x l rec' s\"\n  shows \"RETURN (rec_list fn fc l s) \\<le> rec_list fn' fc' l s\"\n  apply (induct l arbitrary: s)\n  apply (simp add: FN)\n  apply (simp add: FC)\n  done\n*)\n\nsubsection \\<open>Transfer to Plain Function\\<close>\n\ninterpretation plain: transfer RETURN .\n\nlemma plain_RETURN[refine_transfer]: \"RETURN a \\<le> RETURN a\" by simp\nlemma plain_bind[refine_transfer]: \n  \"\\<lbrakk>RETURN x \\<le> M; \\<And>x. RETURN (f x) \\<le> F x\\<rbrakk> \\<Longrightarrow> RETURN (Let x f) \\<le> bind M F\"\n  apply (erule order_trans[rotated,OF bind_mono(1)])\n  apply assumption\n  apply simp\n  done\n\ninterpretation plain_assert: transfer_generic_Assert_remove \n  bind RETURN ASSERT ASSUME\n  RETURN\n  by unfold_locales\n\n(*\ninterpretation plain: transfer_FOREACH RETURN \"(\\<lambda>x. x)\" Let \"(\\<lambda>x. x)\"\n  apply (unfold_locales)\n  apply (erule plain_bind, assumption)\n  apply simp\n  apply simp\n  done\n*)\n\nsubsection \\<open>Total correctness in deterministic monad\\<close>\ntext \\<open>\n  Sometimes one cannot extract total correct programs to executable plain \n  Isabelle functions, for example, if the total correctness only holds for\n  certain preconditions. In those cases, one can still show\n  \\<open>RETURN (the_res S) \\<le> S'\\<close>. Here, \\<open>the_res\\<close> extracts\n  the result from a deterministic monad. As \\<open>the_res\\<close> is executable,\n  the above shows that \\<open>(the_res S)\\<close> is always a correct result.\n\\<close>\n\nfun the_res where \"the_res (dRETURN x) = x\"\n\ntext \\<open>The following lemma converts a proof-obligation\n  with result extraction to a transfer proof obligation,\n  and a proof obligation that the program yields not bottom.\n\n  Note that this rule has to be applied manually, as, otherwise,\n  it would interfere with the default setup, that tries to generate a\n  plain function.\n\\<close>\nlemma the_resI:\n  assumes \"nres_of S \\<le> S'\"\n  assumes \"S \\<noteq> dSUCCEED\"\n  shows \"RETURN (the_res S) \\<le> S'\"\n  using assms\n  by (cases S, simp_all)\n\n\ntext \\<open>The following rule sets up a refinement goal, a transfer goal, and a \n  final optimization goal.\\<close>\ndefinition \"detTAG x \\<equiv> x\"\nlemma detTAGI: \"x = detTAG x\" unfolding detTAG_def by simp\nlemma autoref_detI:\n  assumes \"(b,a)\\<in>\\<langle>R\\<rangle>nres_rel\"\n  assumes \"RETURN c \\<le> b\"\n  assumes \"c = detTAG d\"\n  shows \"(RETURN d, a)\\<in>\\<langle>R\\<rangle>nres_rel\"\n  using assms\n  unfolding nres_rel_def detTAG_def\n  by simp\n\n\nsubsection \\<open>Relator-Based Transfer\\<close>\n\ndefinition dres_nres_rel_internal_def: \n  \"dres_nres_rel R \\<equiv> {(c,a). nres_of c \\<le> \\<Down> R a}\"\n\nlemma dres_nres_rel_def: \"\\<langle>R\\<rangle>dres_nres_rel \\<equiv> {(c,a). nres_of c \\<le> \\<Down> R a}\"\n  by (simp add: dres_nres_rel_internal_def relAPP_def)\n\nlemma dres_nres_relI[intro?]: \"nres_of c \\<le> \\<Down> R a \\<Longrightarrow> (c,a)\\<in>\\<langle>R\\<rangle>dres_nres_rel\"\n  by (simp add: dres_nres_rel_def)\n\nlemma dres_nres_relD: \"(c,a)\\<in>\\<langle>R\\<rangle>dres_nres_rel \\<Longrightarrow> nres_of c \\<le> \\<Down> R a\"\n  by (simp add: dres_nres_rel_def)\n\nlemma dres_nres_rel_as_br_conv: \n  \"\\<langle>R\\<rangle>dres_nres_rel = br nres_of (\\<lambda>_. True) O \\<langle>R\\<rangle>nres_rel\"\n  unfolding dres_nres_rel_def br_def nres_rel_def by auto\n\n\ndefinition plain_nres_rel_internal_def: \n  \"plain_nres_rel R \\<equiv> {(c,a). RETURN c \\<le> \\<Down> R a}\"\n\nlemma plain_nres_rel_def: \"\\<langle>R\\<rangle>plain_nres_rel \\<equiv> {(c,a). RETURN c \\<le> \\<Down> R a}\"\n  by (simp add: plain_nres_rel_internal_def relAPP_def)\n\nlemma plain_nres_relI[intro?]: \"RETURN c \\<le> \\<Down> R a \\<Longrightarrow> (c,a)\\<in>\\<langle>R\\<rangle>plain_nres_rel\"\n  by (simp add: plain_nres_rel_def)\n\nlemma plain_nres_relD: \"(c,a)\\<in>\\<langle>R\\<rangle>plain_nres_rel \\<Longrightarrow> RETURN c \\<le> \\<Down> R a\"\n  by (simp add: plain_nres_rel_def)\n\nlemma plain_nres_rel_as_br_conv: \n  \"\\<langle>R\\<rangle>plain_nres_rel = br RETURN (\\<lambda>_. True) O \\<langle>R\\<rangle>nres_rel\"\n  unfolding plain_nres_rel_def br_def nres_rel_def by auto\n\n(* TODO: Refine_Transfer could be expressed also just as a \n    parametricity based transfer, and based on the same infrastructure\n    as autoref *)\n\nsubsection \\<open>Post-Simplification Setup\\<close>\nlemma dres_unit_simps[refine_transfer_post_simp]:\n  \"dbind (dRETURN (u::unit)) f = f ()\"\n  by auto\n\nlemma Let_dRETURN_simp[refine_transfer_post_simp]:\n  \"Let m dRETURN = dRETURN m\" by auto\n\nlemmas [refine_transfer_post_simp] = dres_monad_laws\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Monadic/Refine_Transfer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3268730806850108}}
{"text": "theory Setup_AutoCorres\nimports\n  Case_Labeling.Case_Labeling\n  \"HOL-Eisbach.Eisbach\"\n  AutoCorres_Misc\nbegin\n\nsection \\<open>AutoCorres setup for VCG labelling\\<close>\n\ntext \\<open>Theorem collections for the VCG\\<close>\n\nML_file \\<open>../../Case_Labeling/util.ML\\<close>\n\nML \\<open>\n  fun vcg_tac nt_rules nt_comb ctxt =\n    let\n      val rules = Named_Theorems.get ctxt nt_rules\n      val comb = Named_Theorems.get ctxt nt_comb\n    in REPEAT_ALL_NEW_FWD ( resolve_tac ctxt rules ORELSE' (resolve_tac ctxt comb THEN' resolve_tac ctxt rules)) end\n\\<close>\n\nnamed_theorems vcg_l\nnamed_theorems vcg_l_comb\nnamed_theorems vcg_elim\nnamed_theorems vcg_simp\n\nmethod_setup vcg_l = \\<open>\n  Scan.succeed (fn ctxt => SIMPLE_METHOD (FIRSTGOAL (vcg_tac @{named_theorems \"vcg_l\"} @{named_theorems \"vcg_l_comb\"} ctxt)))\n\\<close>\n\nmethod vcg_l' = (vcg_l; (elim vcg_elim)?; (unfold vcg_simp)?)\n\nmethod vcg_casify = (rule Initial_Label, vcg_l', casify)\n\nsubsection \\<open>Labeled VCG theorems for branching\\<close>\n\ndefinition \"BRANCH P \\<equiv> P\"\n\nnamed_theorems branch_l\nnamed_theorems branch_l_comb\n\ncontext begin\n  interpretation Labeling_Syntax .\n\n  lemma DC_if[branch_l]:\n    fixes ct defines \"ct' \\<equiv> \\<lambda>pos name. (name, pos,[]) # ct\"\n    assumes \"a \\<Longrightarrow> C\\<langle>Suc inp,ct' inp ''then'', outp': b\\<rangle>\"\n    assumes \"\\<not>a \\<Longrightarrow> C\\<langle>Suc outp',ct' outp' ''else'', outp: c\\<rangle>\"\n    shows \"C\\<langle>inp,ct,outp: BRANCH (if a then b else c)\\<rangle>\"\n    using assms(2-) unfolding LABEL_simps BRANCH_def by auto\n\n  \n\nend\n\nmethod_setup branch_l = \\<open>\n  Scan.succeed (fn ctxt => SIMPLE_METHOD (FIRSTGOAL (vcg_tac @{named_theorems branch_l} @{named_theorems branch_l_comb} ctxt)))\n\\<close>\n\nmethod branch_casify = ((rule Initial_Label, branch_l; (rule DC_final)?), casify)\n\n\nsubsection \\<open>Labelled VCG theorems for the option monad\\<close>\n\ndefinition\n  lpred_conj :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool)\" (infixr \"land\" 35)\nwhere\n  \"lpred_conj P Q \\<equiv> \\<lambda>x. P x \\<and> Q x\"\n\ncontext begin\n  interpretation Labeling_Syntax .\n\n  lemma ovalidNF_obind_K_bind [vcg_l]:\n    assumes \"CTXT (Suc OC1) CT OC (ovalidNF R g Q)\"\n      and \"CTXT IC CT OC1 (ovalidNF P f (\\<lambda>_. R))\"\n    shows \"CTXT IC CT OC (ovalidNF P (f |>> K_bind g) Q)\"\n    using assms unfolding LABEL_simps by wp\n\n  lemma L_ovalidNF_obind_oreturn[vcg_l]:\n    assumes \"CTXT IC CT OC (ovalidNF P (g x) Q)\"\n    shows \"CTXT IC CT OC (ovalidNF P (oreturn x |>> g) Q)\"\n    using assms by (simp add: LABEL_simps)\n\n  lemma L_ovalidNF_obind[vcg_l]:\n    assumes \"\\<And>r. CTXT (Suc OC1) ((''bind'', Suc OC1, [VAR r]) # CT) OC\n        (ovalidNF (R r) (g r) Q)\"\n      and \"CTXT IC CT OC1 (ovalidNF P f R)\"\n    shows \"CTXT IC CT OC (ovalidNF P (f |>> (\\<lambda>r. g r)) Q)\"\n    using assms unfolding LABEL_simps by wp\n\n  lemma ovalidNF_K_bind[vcg_l]:\n    assumes \"CTXT IC CT OC (ovalidNF P f Q)\"\n    shows \"CTXT IC CT OC (ovalidNF P (K_bind f x) Q)\"\n    using assms by simp\n\n  lemma L_ovalidNF_prod_case[vcg_l]:\n    assumes \"\\<And>x y. SPLIT v (x,y) \\<Longrightarrow> CTXT IC CT OC (ovalidNF (P x y) (B x y) Q)\"\n    shows \"CTXT IC CT OC (ovalidNF (case v of (x, y) \\<Rightarrow> P x y) (case v of (x, y) \\<Rightarrow> B x y) Q)\"\n    using assms unfolding LABEL_simps by (auto simp: ovalidNF_def)\n\n  lemma L_ovalidNF_oreturn_NF[vcg_l]:\n    shows \"CTXT IC CT IC (ovalidNF (P x) (oreturn x) P)\"\n    unfolding LABEL_simps by wp\n\n  lemma L_ovalidNF_owhile_inv[vcg_l]:\n    fixes CT IC\n    defines \"CT' \\<equiv> \\<lambda>r. (''while'', IC, [VAR r]) # CT\"\n    assumes \"\\<And>r s. CTXT IC ((''invariant'', IC, [VAR s]) # CT' r) OC\n        (ovalidNF\n          (BIND ''loop_inv'' IC (I r) land\n            BIND ''loop_cond'' IC (C r) land\n            BIND ''loop_var'' IC (\\<lambda>s'. s' = s))\n          (B r)\n          (\\<lambda>r'. BIND ''inv'' IC (I r') land BIND ''var'' IC (\\<lambda>_. (r', r) \\<in> R)))\"\n      and \"\\<And>r. VC (''wf'', OC, []) (CT' r) (wf R)\"\n      and \"\\<And>r s. I r s \\<Longrightarrow> \\<not> C r s \\<Longrightarrow>\n        VC (''postcondition'', Suc OC, [VAR s]) (CT' r) (Q r s)\"\n    shows \"CTXT IC CT (Suc OC) (ovalidNF (I r) (owhile_inv C B r I R) Q)\"\n    using assms unfolding LABEL_simps lpred_conj_def by wp auto\n\n  lemma L_ovalidNF_wp_comb2[vcg_l_comb]:\n    assumes \"CTXT IC CT OC (ovalidNF P f Q)\"\n      and \"\\<And>s. P' s \\<Longrightarrow> VC (''weaken'', IC, [VAR s]) CT (P s)\"\n    shows \"CTXT IC CT OC (ovalidNF P' f Q)\"\n    using assms unfolding LABEL_simps by (rule ovalidNF_wp_comb2)\n\n  lemma L_condition_NF_wp[vcg_l]:\n    fixes CT IC\n    defines \"CT' \\<equiv> (''if'', IC, []) # CT\"\n    assumes \"CTXT IC ((''then'', IC, []) # CT') OC1 (ovalidNF L l Q)\"\n      and \"CTXT (Suc OC1) ((''else'', Suc OC1, []) # CT') OC (ovalidNF R r Q)\"\n    shows \"CTXT IC CT OC (ovalidNF (\\<lambda>s. BRANCH (if C s then L s else R s)) (ocondition C l r) Q)\"\n    using assms unfolding LABEL_simps BRANCH_def by wp\n\n  lemma L_ogets_NF_wp[vcg_l]: \"CTXT IC CT IC (ovalidNF (\\<lambda>s. P (f s) s) (ogets f) P)\"\n    unfolding LABEL_simps by wp\n\n  lemma elim_land[vcg_elim]:\n    assumes \"(P land Q) s\" obtains \"P s\" \"Q s\"\n    using assms by (auto simp: lpred_conj_def)\n\n  lemma simp_bind[vcg_simp]: \"BIND ct n P s \\<longleftrightarrow> BIND ct n (P s)\"\n    by (auto simp: LABEL_simps)\n\n  lemma simp_land[vcg_simp]: \"(P land Q) s \\<longleftrightarrow> P s \\<and> Q s\"\n    by (auto simp: lpred_conj_def)\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Planarity_Certificates/Verification/Setup_AutoCorres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3268730806850108}}
{"text": "theory v1_isar_T\n  imports Main \"../../QML\"\nbegin\n\nconsts makeTable ::  \"\\<mu> \\<Rightarrow> \\<mu> \\<Rightarrow> \\<sigma>\"  (\"T\") (* (T x y) \\<equiv> x made from y *)\n\n(* abbreviation refl :: \"bool\"\n  where \"refl \\<equiv> (\\<forall>x. x r x)\"\n *)\n\naxiomatization where refl :\"(\\<forall>x. x r x)\"\n\nlemma \n  (* assumes refl : \"(\\<forall>x. x r x)\" *)\n  assumes compossibilty1: \"\\<lfloor>(\\<^bold>\\<forall>x. \\<^bold>\\<forall>y. \\<^bold>\\<forall>z. ((T x y) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z) \\<^bold>\\<and> \\<^bold>\\<diamond>(\\<^bold>\\<exists>t. T t z)) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (\\<^bold>\\<exists>x'. (T x' z))))\\<rfloor>\" \n  assumes origin_uniqueness: \"\\<lfloor>(\\<^bold>\\<forall>x. \\<^bold>\\<forall>y. \\<^bold>\\<forall>z. \\<^bold>\\<not>(\\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (T x z) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z))))\\<rfloor>\" \n  assumes sufficiency1: \"\\<lfloor>(\\<^bold>\\<forall>y. \\<^bold>\\<forall>x'. \\<^bold>\\<diamond>(T x' y) \\<^bold>\\<rightarrow> \\<^bold>\\<box>(\\<^bold>\\<forall>x. (T x y) \\<^bold>\\<rightarrow> (x\\<^bold>=\\<^sup>Lx')))\\<rfloor>\"  \n  shows origin_essentialism1: \"\\<lfloor>(\\<^bold>\\<forall>x. \\<^bold>\\<forall>y. \\<^bold>\\<forall>z. (((\\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)) \\<^bold>\\<and> (T x y))) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(\\<^bold>\\<diamond>(T x z)))\\<rfloor>\" \nproof (rule allI)\n  fix w (* for the outer \\<lfloor> \\<rfloor> *)\n  show \"(\\<^bold>\\<forall>x. \\<^bold>\\<forall>y. \\<^bold>\\<forall>z. ((\\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)) \\<^bold>\\<and> (T x y)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(\\<^bold>\\<diamond>(T x z))) w\"\n  proof (rule allI)\n    fix x (* for table x *)\n    show \"(\\<^bold>\\<forall>y. \\<^bold>\\<forall>z. ((\\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)) \\<^bold>\\<and> (T x y)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(\\<^bold>\\<diamond>(T x z))) w\"\n    proof (rule allI)\n      fix y (* for material y *)\n      show \"(\\<^bold>\\<forall>z. ((\\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)) \\<^bold>\\<and> (T x y)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(\\<^bold>\\<diamond>(T x z))) w\"\n      proof (rule allI)\n        fix z (* for material z *)\n        show \"(((\\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)) \\<^bold>\\<and> (T x y)) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(\\<^bold>\\<diamond>(T x z))) w\"\n        proof (rule impI)\n          assume antecedent: \"(((\\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)) \\<^bold>\\<and> (T x y))) w\"\n          show \"(\\<^bold>\\<not>(\\<^bold>\\<diamond>(T x z))) w\"\n          proof(rule notI)\n            assume table_x_from_z: \"(\\<^bold>\\<diamond>(T x z)) w\"\n              from antecedent have \"(((\\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)) \\<^bold>\\<and> (T x y))) w\" by simp\n              then have non_overlapping: \"(\\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)) w\" by (rule conjE)\n              have table_x_from_y: \"T x y w\" \n                using `((\\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)) \\<^bold>\\<and> (T x y)) w` by (rule conjE)\n\n              have compossibilty1_ante: \"((T x y) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z) \\<^bold>\\<and> \\<^bold>\\<diamond>(\\<^bold>\\<exists>t. T t z)) w\" \n                using antecedent and table_x_from_z by auto\n\n              from compossibilty1 have \"(\\<^bold>\\<forall>x. \\<^bold>\\<forall>y. \\<^bold>\\<forall>z. ((T x y) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z) \\<^bold>\\<and> \\<^bold>\\<diamond>(\\<^bold>\\<exists>t. T t z)) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (\\<^bold>\\<exists>x'. (T x' z)))) w\"..\n              then have \"(\\<^bold>\\<forall>y. \\<^bold>\\<forall>z. ((T x y) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z) \\<^bold>\\<and> \\<^bold>\\<diamond>(\\<^bold>\\<exists>t. T t z)) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (\\<^bold>\\<exists>x'. (T x' z)))) w\" \n                by (rule allE)\n              then have \"(\\<^bold>\\<forall>z. ((T x y) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z) \\<^bold>\\<and> \\<^bold>\\<diamond>(\\<^bold>\\<exists>t. T t z)) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (\\<^bold>\\<exists>x'. (T x' z)))) w\" \n                by (rule allE)\n              then have \"(((T x y) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z) \\<^bold>\\<and> \\<^bold>\\<diamond>(\\<^bold>\\<exists>t. T t z)) \\<^bold>\\<rightarrow> \\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (\\<^bold>\\<exists>x'. (T x' z)))) w\" \n                by (rule allE)\n              then have \"(\\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (\\<^bold>\\<exists>x'. (T x' z)))) w\" \n                using compossibilty1_ante by (rule mp)\n              then obtain u where u:  \"(w r u) \\<and> (((T x y) \\<^bold>\\<and> (\\<^bold>\\<exists>x'. (T x' z))) u)\" \n                by (rule exE)\n              then have \"((T x y) \\<^bold>\\<and> (\\<^bold>\\<exists>x'. (T x' z))) u\" by simp\n              then have \"(\\<exists>t. T t z u)\" by (rule conjE)\n              then obtain x' where x': \"T x' z u\" by (rule exE)\n              then have  \"T x' z u\" by simp\n\n(* Relation between u, v and w, prove \"w r u\" *)\n              have \"w r u\" \n                using `(w r u) \\<and> (((T x y) \\<^bold>\\<and> (\\<^bold>\\<exists>x'. (T x' z))) u)` by (rule conjE)\n\n              from sufficiency1 have \"(\\<^bold>\\<forall>y. \\<^bold>\\<forall>x'. \\<^bold>\\<diamond>(T x' y) \\<^bold>\\<rightarrow> \\<^bold>\\<box>(\\<^bold>\\<forall>x. (T x y) \\<^bold>\\<rightarrow> (x\\<^bold>=\\<^sup>Lx'))) w\"..\n              then have \"(\\<^bold>\\<forall>x'. \\<^bold>\\<diamond>(T x' z) \\<^bold>\\<rightarrow> \\<^bold>\\<box>(\\<^bold>\\<forall>x. (T x z) \\<^bold>\\<rightarrow> (x\\<^bold>=\\<^sup>Lx'))) w\" \n                by (rule allE)\n              then have \"(\\<^bold>\\<diamond>(T x z) \\<^bold>\\<rightarrow> \\<^bold>\\<box>(\\<^bold>\\<forall>t. (T t z) \\<^bold>\\<rightarrow> (t\\<^bold>=\\<^sup>Lx))) w\" \n                by (rule allE)\n              then have  \"(\\<^bold>\\<box>(\\<^bold>\\<forall>t. (T t z) \\<^bold>\\<rightarrow> (t\\<^bold>=\\<^sup>Lx))) w\"\n                using `(\\<^bold>\\<diamond>(T x z)) w` by (rule mp)\n              then have \"(\\<^bold>\\<forall>t. (T t z) \\<^bold>\\<rightarrow> (t\\<^bold>=\\<^sup>Lx)) u\" \n                using `w r u` by (simp add: `(\\<^bold>\\<box>(\\<^bold>\\<forall>t. (T t z) \\<^bold>\\<rightarrow> (t\\<^bold>=\\<^sup>Lx))) w`)\n\n              then have \"((T x' z) \\<^bold>\\<rightarrow> (x'\\<^bold>=\\<^sup>Lx)) u\" by (rule allE)\n              then have \"(x' \\<^bold>=\\<^sup>L x) u\" \n                using `T x' z u` by (rule mp)\n              then have \"(T x z) u\" \n                using `(T x' z) u` by auto\n              have \"(T x y) u\" using u by blast\n              then have \"(T x y) u \\<and> (T x z) u\" \n                using `(T x z) u` by (rule conjI)\n              then have impossible_arg: \"(T x y \\<^bold>\\<and> T x z \\<^bold>\\<and> (\\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z))) u\" \n                using non_overlapping by auto\n \n              from origin_uniqueness have \"(\\<^bold>\\<forall>x. \\<^bold>\\<forall>y. \\<^bold>\\<forall>z. \\<^bold>\\<not>(\\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (T x z) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)))) u\".. \n              then have \"(\\<^bold>\\<forall>y. \\<^bold>\\<forall>z. \\<^bold>\\<not>(\\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (T x z) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)))) u\" \n                by (rule allE)\n              then have \"(\\<^bold>\\<forall>z. \\<^bold>\\<not>(\\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (T x z) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)))) u\" \n                by (rule allE)\n              then have \"(\\<^bold>\\<not>(\\<^bold>\\<diamond>((T x y) \\<^bold>\\<and> (T x z) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z)))) u\" \n                by (rule allE)\n              then have \"\\<^bold>\\<box>(\\<^bold>\\<not>((T x y) \\<^bold>\\<and> (T x z) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z))) u\" \n                by auto \n              then have \"(\\<^bold>\\<not>((T x y) \\<^bold>\\<and> (T x z) \\<^bold>\\<and> \\<^bold>\\<not>(y \\<^bold>=\\<^sup>L z))) u\" \n                using refl by blast\n              then show \"False\" using impossible_arg by (rule notE)\n            qed\n          qed\n        qed                      \n      qed\n        qed\n      qed      \nend\n", "meta": {"author": "hotessy", "repo": "origin_essen_public", "sha": "c91f54abfade669c30db34d2bbfcccbe1b97d23a", "save_path": "github-repos/isabelle/hotessy-origin_essen_public", "path": "github-repos/isabelle/hotessy-origin_essen_public/origin_essen_public-c91f54abfade669c30db34d2bbfcccbe1b97d23a/experiments/salmon_T/v1_isar_T.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7090191337850932, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.3268697175284117}}
{"text": "(*  Title:      Imperative_HOL_Time/Array_Time.thy\n    Author:     Maximilian P. L. Haslbeck & Bohua Zhan, TU Muenchen\n*)\nsection \\<open>Monadic arrays\\<close>\n\ntext \\<open>This theory is an adaptation of \\<open>HOL/Imperative_HOL/Array.thy\\<close>,\n adding time bookkeeping.\\<close>\n\ntheory Array_Time\nimports Heap_Time_Monad\nbegin       \n\nsubsection \\<open>Primitives\\<close>\n\ndefinition present :: \"heap \\<Rightarrow> 'a::heap array \\<Rightarrow> bool\" where\n  \"present h a \\<longleftrightarrow> addr_of_array a < lim h\"\n\ndefinition get :: \"heap \\<Rightarrow> 'a::heap array \\<Rightarrow> 'a list\" where\n  \"get h a = map from_nat (arrays h (TYPEREP('a)) (addr_of_array a))\"\n\ndefinition set :: \"'a::heap array \\<Rightarrow> 'a list \\<Rightarrow> heap \\<Rightarrow> heap\" where\n  \"set a x = arrays_update (\\<lambda>h. h(TYPEREP('a) := ((h(TYPEREP('a))) (addr_of_array a:=map to_nat x))))\"\n\ndefinition alloc :: \"'a list \\<Rightarrow> heap \\<Rightarrow> 'a::heap array \\<times> heap\" where\n  \"alloc xs h = (let\n     l = lim h;\n     r = Array l;\n     h'' = set r xs (h\\<lparr>lim := l + 1\\<rparr>)\n   in (r, h''))\"\n\ndefinition length :: \"heap \\<Rightarrow> 'a::heap array \\<Rightarrow> nat\" where\n  \"length h a = List.length (get h a)\"\n  \ndefinition update :: \"'a::heap array \\<Rightarrow> nat \\<Rightarrow> 'a \\<Rightarrow> heap \\<Rightarrow> heap\" where\n  \"update a i x h = set a ((get h a)[i:=x]) h\"\n\ndefinition noteq :: \"'a::heap array \\<Rightarrow> 'b::heap array \\<Rightarrow> bool\" (infix \"=!!=\" 70) where\n  \"r =!!= s \\<longleftrightarrow> TYPEREP('a) \\<noteq> TYPEREP('b) \\<or> addr_of_array r \\<noteq> addr_of_array s\"\n\n\nsubsection \\<open>Monad operations\\<close>\n\ndefinition new :: \"nat \\<Rightarrow> 'a::heap \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"new n x = Heap_Time_Monad.heap (%h. let (r,h') = alloc (replicate n x) h in (r,h',n+1))\"\n\ndefinition of_list :: \"'a::heap list \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"of_list xs = Heap_Time_Monad.heap (%h. let (r,h') = alloc xs h in (r,h',1+List.length xs))\"\n\ndefinition make :: \"nat \\<Rightarrow> (nat \\<Rightarrow> 'a::heap) \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"make n f = Heap_Time_Monad.heap (%h. let (r,h') = alloc (map f [0 ..< n]) h in (r,h',n+1))\"\n\ndefinition len :: \"'a::heap array \\<Rightarrow> nat Heap\" where\n  [code del]: \"len a = Heap_Time_Monad.tap (\\<lambda>h. length h a)\"\n\ndefinition nth :: \"'a::heap array \\<Rightarrow> nat \\<Rightarrow> 'a Heap\" where\n  [code del]: \"nth a i = Heap_Time_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (get h a ! i, h, 1))\"\n\ndefinition upd :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a::heap array \\<Rightarrow> 'a::heap array Heap\" where\n  [code del]: \"upd i x a = Heap_Time_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (a, update a i x h, 1))\"\n\ndefinition map_entry :: \"nat \\<Rightarrow> ('a::heap \\<Rightarrow> 'a) \\<Rightarrow> 'a array \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"map_entry i f a = Heap_Time_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (a, update a i (f (get h a ! i)) h, 2))\"\n\ndefinition swap :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a::heap array \\<Rightarrow> 'a Heap\" where\n  [code del]: \"swap i x a = Heap_Time_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (get h a ! i, update a i x h, 2 ))\"  (* questionable *)\n\ndefinition freeze :: \"'a::heap array \\<Rightarrow> 'a list Heap\" where\n  [code del]: \"freeze a = Heap_Time_Monad.heap (\\<lambda>h. (get h a, h, 1+length h a)) \"\n\n\nsubsection \\<open>Properties\\<close>\n\ntext \\<open>FIXME: Does there exist a \"canonical\" array axiomatisation in\nthe literature?\\<close>\n\ntext \\<open>Primitives\\<close>\n\nlemma noteq_sym: \"a =!!= b \\<Longrightarrow> b =!!= a\"\n  and unequal [simp]: \"a \\<noteq> a' \\<longleftrightarrow> a =!!= a'\"\n  unfolding noteq_def by auto\n\nlemma noteq_irrefl: \"r =!!= r \\<Longrightarrow> False\"\n  unfolding noteq_def by auto\n\nlemma present_alloc_noteq: \"present h a \\<Longrightarrow> a =!!= fst (alloc xs h)\"\n  by (simp add: present_def noteq_def alloc_def Let_def)\n\nlemma get_set_eq [simp]: \"get (set r x h) r = x\"\n  by (simp add: get_def set_def o_def)\n\nlemma get_set_neq [simp]: \"r =!!= s \\<Longrightarrow> get (set s x h) r = get h r\"\n  by (simp add: noteq_def get_def set_def)\n\nlemma set_same [simp]:\n  \"set r x (set r y h) = set r x h\"\n  by (simp add: set_def)\n\nlemma set_set_swap:\n  \"r =!!= r' \\<Longrightarrow> set r x (set r' x' h) = set r' x' (set r x h)\"\n  by (simp add: Let_def fun_eq_iff noteq_def set_def)\n\nlemma get_update_eq [simp]:\n  \"get (update a i v h) a = (get h a) [i := v]\"\n  by (simp add: update_def)\n\nlemma nth_update_neq [simp]:\n  \"a =!!= b \\<Longrightarrow> get (update b j v h) a ! i = get h a ! i\"\n  by (simp add: update_def noteq_def)\n\nlemma get_update_elem_neqIndex [simp]:\n  \"i \\<noteq> j \\<Longrightarrow> get (update a j v h) a ! i = get h a ! i\"\n  by simp\n\nlemma length_update [simp]: \n  \"length (update b i v h) = length h\"\n  by (simp add: update_def length_def set_def get_def fun_eq_iff)\n\nlemma update_swap_neq:\n  \"a =!!= a' \\<Longrightarrow> \n  update a i v (update a' i' v' h) \n  = update a' i' v' (update a i v h)\"\napply (unfold update_def)\napply simp\napply (subst set_set_swap, assumption)\napply (subst get_set_neq)\napply (erule noteq_sym)\napply simp\ndone\n\nlemma update_swap_neqIndex:\n  \"\\<lbrakk> i \\<noteq> i' \\<rbrakk> \\<Longrightarrow> update a i v (update a i' v' h) = update a i' v' (update a i v h)\"\n  by (auto simp add: update_def set_set_swap list_update_swap)\n\nlemma get_alloc:\n  \"get (snd (alloc xs h)) (fst (alloc ys h)) = xs\"\n  by (simp add: Let_def split_def alloc_def)\n\nlemma length_alloc:\n  \"length (snd (alloc (xs :: 'a::heap list) h)) (fst (alloc (ys :: 'a list) h)) = List.length xs\"\n  by (simp add: Array_Time.length_def get_alloc)\n\nlemma set:\n  \"set (fst (alloc ls h))\n     new_ls (snd (alloc ls h))\n       = snd (alloc new_ls h)\"\n  by (simp add: Let_def split_def alloc_def)\n\nlemma present_update [simp]: \n  \"present (update b i v h) = present h\"\n  by (simp add: update_def present_def set_def get_def fun_eq_iff)\n\nlemma present_alloc [simp]:\n  \"present (snd (alloc xs h)) (fst (alloc xs h))\"\n  by (simp add: present_def alloc_def set_def Let_def)\n\nlemma not_present_alloc [simp]:\n  \"\\<not> present h (fst (alloc xs h))\"\n  by (simp add: present_def alloc_def Let_def)\n\n\ntext \\<open>Monad operations\\<close>\n\nlemma execute_new [execute_simps]:\n  \"execute (new n x) h = Some (let (r,h') = alloc (replicate n x) h in (r,h',n+1))\"\n  by (simp add: new_def execute_simps)\n\nlemma success_newI [success_intros]:\n  \"success (new n x) h\"\n  by (auto intro: success_intros simp add: new_def)\n\nlemma effect_newI [effect_intros]:\n  assumes \"(a, h') = alloc (replicate n x) h\"\n  shows \"effect (new n x) h h' a (n+1)\"\n  apply (rule effectI) apply (simp add: assms execute_simps)  by (metis assms case_prod_conv) \n    \nlemma effect_newE [effect_elims]:\n  assumes \"effect (new n x) h h' r n'\"\n  obtains \"r = fst (alloc (replicate n x) h)\" \"h' = snd (alloc (replicate n x) h)\" \n    \"get h' r = replicate n x\" \"present h' r\" \"\\<not> present h r\" \"n+1=n'\"\n  using assms apply (rule effectE) using  case_prod_beta get_alloc execute_new\n  by (metis (mono_tags, lifting) fst_conv not_present_alloc option.sel present_alloc sndI) \n  \n  (* apply (si mp add: case_prod_beta get_alloc execute_simps) refactor proof *) \n\nlemma execute_of_list [execute_simps]:\n  \"execute (of_list xs) h = Some (let (r,h') = alloc xs h in (r,h',1 + List.length xs))\"\n  by (simp add: of_list_def execute_simps)\n\nlemma success_of_listI [success_intros]:\n  \"success (of_list xs) h\"\n  by (auto intro: success_intros simp add: of_list_def)\n\nlemma effect_of_listI [effect_intros]:\n  assumes \"(a, h') = alloc xs h\"\n  shows \"effect (of_list xs) h h' a (1 + List.length xs)\"\n  by (rule effectI, simp add: assms execute_simps, metis assms case_prod_conv) \n    \n    \nlemma effect_of_listE [effect_elims]:\n  assumes \"effect (of_list xs) h h' r n'\"\n  obtains \"r = fst (alloc xs h)\" \"h' = snd (alloc xs h)\" \n    \"get h' r = xs\" \"present h' r\" \"\\<not> present h r\" \"n' = 1 + List.length xs\"\n  using assms apply (rule effectE) apply (simp add: get_alloc  execute_of_list) by (simp add: case_prod_unfold)\n\nlemma execute_make [execute_simps]:\n  \"execute (make n f) h = Some (let (r,h') = alloc (map f [0 ..< n]) h in (r,h',n+1))\"\n  by (simp add: make_def execute_simps)\n\nlemma success_makeI [success_intros]:\n  \"success (make n f) h\"\n  by (auto intro: success_intros simp add: make_def)\n\nlemma effect_makeI [effect_intros]:\n  assumes \"(a, h') = alloc (map f [0 ..< n]) h\"\n  shows \"effect (make n f) h h' a (n+1)\"\n  by (rule effectI) (simp add: assms execute_simps, metis assms case_prod_conv) \n\nlemma effect_makeE [effect_elims]:\n  assumes \"effect (make n f) h h' r n'\"\n  obtains \"r = fst (alloc (map f [0 ..< n]) h)\" \"h' = snd (alloc (map f [0 ..< n]) h)\" \n    \"get h' r = map f [0 ..< n]\" \"present h' r\" \"\\<not> present h r\" \"n+1=n'\"\n  using assms apply (rule effectE) using get_alloc  \n  by (metis (mono_tags, opaque_lifting) effectE effect_makeI not_present_alloc present_alloc prod.collapse)\n  \n  (* apply (si mp add: get_alloc execute_make) by (s imp add: case_prod_unfold) *)\n\nlemma execute_len [execute_simps]:\n  \"execute (len a) h = Some (length h a, h, 1)\"\n  by (simp add: len_def execute_simps)\n\nlemma success_lenI [success_intros]:\n  \"success (len a) h\"\n  by (auto intro: success_intros simp add: len_def)\n\nlemma effect_lengthI [effect_intros]:\n  assumes \"h' = h\" \"r = length h a\" \"n=1\"\n  shows \"effect (len a) h h' r n\"\n  by (rule effectI) (simp add: assms execute_simps)\n\nlemma effect_lengthE [effect_elims]:\n  assumes \"effect (len a) h h' r n\"\n  obtains \"r = length h' a\" \"h' = h\" \"n=1\" \n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_nth [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n    execute (nth a i) h = Some (get h a ! i, h,1)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (nth a i) h = None\"\n  by (simp_all add: nth_def execute_simps)\n\nlemma success_nthI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (nth a i) h\"\n  by (auto intro: success_intros simp add: nth_def)\n\nlemma effect_nthI [effect_intros]:\n  assumes \"i < length h a\" \"h' = h\" \"r = get h a ! i\" \"n=1\"\n  shows \"effect (nth a i) h h' r n\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_nthE [effect_elims]:\n  assumes \"effect (nth a i) h h' r n\"\n  obtains \"i < length h a\" \"r = get h a ! i\" \"h' = h\" \"n=1\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_upd [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n    execute (upd i x a) h = Some (a, update a i x h, 1)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (upd i x a) h = None\"\n  by (simp_all add: upd_def execute_simps)\n\nlemma success_updI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (upd i x a) h\"\n  by (auto intro: success_intros simp add: upd_def)\n\nlemma effect_updI [effect_intros]:\n  assumes \"i < length h a\" \"h' = update a i v h\" \"n=1\"\n  shows \"effect (upd i v a) h h' a n\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_updE [effect_elims]:\n  assumes \"effect (upd i v a) h h' r n\"\n  obtains \"r = a\" \"h' = update a i v h\" \"i < length h a\" \"n=1\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_map_entry [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n   execute (map_entry i f a) h =\n      Some (a, update a i (f (get h a ! i)) h, 2)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (map_entry i f a) h = None\"\n  by (simp_all add: map_entry_def execute_simps)\n\nlemma success_map_entryI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (map_entry i f a) h\"\n  by (auto intro: success_intros simp add: map_entry_def)\n\nlemma effect_map_entryI [effect_intros]:\n  assumes \"i < length h a\" \"h' = update a i (f (get h a ! i)) h\" \"r = a\" \"n=2\"\n  shows \"effect (map_entry i f a) h h' r n\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_map_entryE [effect_elims]:\n  assumes \"effect (map_entry i f a) h h' r n\"\n  obtains \"r = a\" \"h' = update a i (f (get h a ! i)) h\" \"i < length h a\" \"n=2\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_swap [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n   execute (swap i x a) h =\n      Some (get h a ! i, update a i x h, 2)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (swap i x a) h = None\"\n  by (simp_all add: swap_def execute_simps)\n\nlemma success_swapI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (swap i x a) h\"\n  by (auto intro: success_intros simp add: swap_def)\n\nlemma effect_swapI [effect_intros]:\n  assumes \"i < length h a\" \"h' = update a i x h\" \"r = get h a ! i\" \"n=2\"\n  shows \"effect (swap i x a) h h' r n\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_swapE [effect_elims]:\n  assumes \"effect (swap i x a) h h' r n\"\n  obtains \"r = get h a ! i\" \"h' = update a i x h\" \"i < length h a\" \"n=2\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_freeze [execute_simps]:\n  \"execute (freeze a) h = Some (get h a, h, 1+length h a)\"\n  by (simp add: freeze_def execute_simps)\n\nlemma success_freezeI [success_intros]:\n  \"success (freeze a) h\"\n  by (auto intro: success_intros simp add: freeze_def)\n\nlemma effect_freezeI [effect_intros]:\n  assumes \"h' = h\" \"r = get h a\" \"n=length h a\"\n  shows \"effect (freeze a) h h' r (n+1)\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_freezeE [effect_elims]:\n  assumes \"effect (freeze a) h h' r n\"\n  obtains \"h' = h\" \"r = get h a\" \"n=length h a+1\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma upd_ureturn:\n  \"upd i x a \\<then> ureturn a =   upd i x a \"\n  by (rule Heap_eqI) (simp add: bind_def guard_def upd_def execute_simps)\n\nlemma array_make:\n  \"new n x = make n (\\<lambda>_. x)\"\n  by (rule Heap_eqI) (simp add: map_replicate_trivial execute_simps)\n\nlemma array_of_list_make [code]:\n  \"of_list xs = make (List.length xs) (\\<lambda>n. xs ! n)\"\n  by (rule Heap_eqI) (simp add: map_nth execute_simps)\n\nhide_const (open) present get set alloc length update noteq new of_list make len nth upd map_entry swap freeze\n\n\nsubsection \\<open>Code generator setup\\<close>\n\nsubsubsection \\<open>Logical intermediate layer\\<close>\n\ndefinition new' where\n  [code del]: \"new' = Array_Time.new o nat_of_integer\"\n\n\n\ndefinition make' where\n  [code del]: \"make' i f = Array_Time.make (nat_of_integer i) (f o of_nat)\"\n\nlemma [code]:\n  \"Array_Time.make n f = make' (of_nat n) (f o nat_of_integer)\"\n  by (simp add: make'_def o_def)\n\ndefinition len' where\n  [code del]: \"len' a = Array_Time.len a \\<bind> (\\<lambda>n. ureturn (of_nat n))\"\n\nlemma [code]:\n  \"Array_Time.len a = len' a \\<bind> (\\<lambda>i. ureturn (nat_of_integer i))\"\n  by (simp add: len'_def execute_simps)    \n\ndefinition nth' where\n  [code del]: \"nth' a = Array_Time.nth a o nat_of_integer\"\n\nlemma [code]:\n  \"Array_Time.nth a n = nth' a (of_nat n)\"\n  by (simp add: nth'_def)\n\ndefinition upd' where\n  [code del]: \"upd' a i x = Array_Time.upd (nat_of_integer i) x a \\<then> ureturn ()\"\n\nlemma [code]:\n  \"Array_Time.upd i x a = upd' a (of_nat i) x \\<then> ureturn a\"\n  by (simp add: upd'_def upd_ureturn execute_simps)  \n\nlemma [code]:\n  \"Array_Time.map_entry i f a = do {\n     x \\<leftarrow> Array_Time.nth a i;\n     Array_Time.upd i (f x) a\n   }\"                                                                \n  by (rule Heap_eqI) (simp add: bind_def guard_def map_entry_def execute_simps)\n\nlemma [code]:\n  \"Array_Time.swap i x a = do {\n     y \\<leftarrow> Array_Time.nth a i;\n     Array_Time.upd i x a;\n     ureturn y\n   }\"\n  by (rule Heap_eqI) (simp add: bind_def guard_def swap_def execute_simps)\n(*\nlemma [code]:\n  \"Array_Time.freeze a = do {\n     n \\<leftarrow> Array_Time.len a;\n     Heap_Monad.fold_map (\\<lambda>i. Array_Time.nth a i) [0..<n]\n   }\"\nproof (rule Heap_eqI)\n  fix h\n  have *: \"List.map\n     (\\<lambda>x. fst (the (if x < Array_Time.length h a\n                    then Some (Array_Time.get h a ! x, h) else None)))\n     [0..<Array_Time.length h a] =\n       List.map (List.nth (Array_Time.get h a)) [0..<Array_Time.length h a]\"\n    by simp\n  have \"execute (Heap_Monad.fold_map (Array_Time.nth a) [0..<Array_Time.length h a]) h =\n    Some (Array_Time.get h a, h)\"\n    apply (subst execute_fold_map_unchanged_heap)\n    apply (simp_all add: nth_def guard_def * )\n    apply (simp add: length_def map_nth)\n    done\n  then have \"execute (do {\n      n \\<leftarrow> Array_Time.len a;\n      Heap_Monad.fold_map (Array_Time.nth a) [0..<n]\n    }) h = Some (Array_Time.get h a, h)\"\n    by (auto intro: execute_bind_eq_SomeI simp add: execute_simps)\n  then show \"execute (Array_Time.freeze a) h = execute (do {\n      n \\<leftarrow> Array_Time.len a;\n      Heap_Monad.fold_map (Array_Time.nth a) [0..<n]\n    }) h\" by (simp add: execute_simps)\nqed\n*)\nhide_const (open) new' make' len' nth' upd'\n\n\ntext \\<open>SML\\<close>\n\ncode_printing type_constructor array \\<rightharpoonup> (SML) \"_/ array\"\ncode_printing constant Array \\<rightharpoonup> (SML) \"raise/ (Fail/ \\\"bare Array\\\")\"\ncode_printing constant Array_Time.new' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.array/ ((_),/ (_)))\"\ncode_printing constant Array_Time.of_list \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.fromList/ _)\"\ncode_printing constant Array_Time.make' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.tabulate/ ((_),/ (_)))\"\ncode_printing constant Array_Time.len' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.length/ _)\"\ncode_printing constant Array_Time.nth' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.sub/ ((_),/ (_)))\"\ncode_printing constant Array_Time.upd' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.update/ ((_),/ (_),/ (_)))\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (SML) infixl 6 \"=\"\n\ncode_reserved SML Array\n\n\ntext \\<open>OCaml\\<close>\n\ncode_printing type_constructor array \\<rightharpoonup> (OCaml) \"_/ array\"\ncode_printing constant Array \\<rightharpoonup> (OCaml) \"failwith/ \\\"bare Array\\\"\"\ncode_printing constant Array_Time.new' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.make/ (Big'_int.int'_of'_big'_int/ _)/ _)\"\ncode_printing constant Array_Time.of_list \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.of'_list/ _)\"\ncode_printing constant Array_Time.make' \\<rightharpoonup> (OCaml)\n  \"(fun/ ()/ ->/ Array.init/ (Big'_int.int'_of'_big'_int/ _)/ (fun k'_ ->/ _/ (Big'_int.big'_int'_of'_int/ k'_)))\"\ncode_printing constant Array_Time.len' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Big'_int.big'_int'_of'_int/ (Array.length/ _))\"\ncode_printing constant Array_Time.nth' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.get/ _/ (Big'_int.int'_of'_big'_int/ _))\"\ncode_printing constant Array_Time.upd' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.set/ _/ (Big'_int.int'_of'_big'_int/ _)/ _)\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (OCaml) infixl 4 \"=\"\n\ncode_reserved OCaml Array\n\n\ntext \\<open>Haskell\\<close>\n\ncode_printing type_constructor array \\<rightharpoonup> (Haskell) \"Heap.STArray/ Heap.RealWorld/ _\"\ncode_printing constant Array \\<rightharpoonup> (Haskell) \"error/ \\\"bare Array\\\"\"\ncode_printing constant Array_Time.new' \\<rightharpoonup> (Haskell) \"Heap.newArray\"\ncode_printing constant Array_Time.of_list \\<rightharpoonup> (Haskell) \"Heap.newListArray\"\ncode_printing constant Array_Time.make' \\<rightharpoonup> (Haskell) \"Heap.newFunArray\"\ncode_printing constant Array_Time.len' \\<rightharpoonup> (Haskell) \"Heap.lengthArray\"\ncode_printing constant Array_Time.nth' \\<rightharpoonup> (Haskell) \"Heap.readArray\"\ncode_printing constant Array_Time.upd' \\<rightharpoonup> (Haskell) \"Heap.writeArray\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (Haskell) infix 4 \"==\"\ncode_printing class_instance array :: HOL.equal \\<rightharpoonup> (Haskell) -\n\n\ntext \\<open>Scala\\<close>\n\ncode_printing type_constructor array \\<rightharpoonup> (Scala) \"!Array.T[_]\"\ncode_printing constant Array \\<rightharpoonup> (Scala) \"!sys.error(\\\"bare Array\\\")\"\ncode_printing constant Array_Time.new' \\<rightharpoonup> (Scala) \"('_: Unit)/ => / Array.alloc((_))((_))\"\ncode_printing constant Array_Time.make' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.make((_))((_))\"\ncode_printing constant Array_Time.len' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.len((_))\"\ncode_printing constant Array_Time.nth' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.nth((_), (_))\"\ncode_printing constant Array_Time.upd' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.upd((_), (_), (_))\"\ncode_printing constant Array_Time.freeze \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.freeze((_))\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (Scala) infixl 5 \"==\"\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Van_Emde_Boas_Trees/Imperative_HOL_Time/Array_Time.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813031051514762, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.326794945608106}}
{"text": "(*\n  File: RBTree_Impl.thy\n  Author: Bohua Zhan\n*)\n\nsection \\<open>Implementation of red-black tree\\<close>\n\ntheory RBTree_Impl\n  imports SepAuto \"../Functional/RBTree\"\nbegin\n\ntext \\<open>\n  Verification of imperative red-black trees.\n\\<close>\n\nsubsection \\<open>Tree nodes\\<close>\n\ndatatype ('a, 'b) rbt_node =\n  Node (lsub: \"('a, 'b) rbt_node ref option\") (cl: color) (key: 'a) (val: 'b) (rsub: \"('a, 'b) rbt_node ref option\")\nsetup \\<open>fold add_rewrite_rule @{thms rbt_node.sel}\\<close>\n\nfun color_encode :: \"color \\<Rightarrow> nat\" where\n  \"color_encode B = 0\"\n| \"color_encode R = 1\"\n\ninstance color :: heap\n  apply (rule heap_class.intro)\n  apply (rule countable_classI [of \"color_encode\"])\n  apply (metis color_encode.simps(1) color_encode.simps(2) not_B zero_neq_one)\n  ..\n\nfun rbt_node_encode :: \"('a::heap, 'b::heap) rbt_node \\<Rightarrow> nat\" where\n  \"rbt_node_encode (Node l c k v r) = to_nat (l, c, k, v, r)\"\n\ninstance rbt_node :: (heap, heap) heap\n  apply (rule heap_class.intro)\n  apply (rule countable_classI [of \"rbt_node_encode\"])\n  apply (case_tac x, simp_all, case_tac y, simp_all)\n  ..\n\nfun btree :: \"('a::heap, 'b::heap) rbt \\<Rightarrow> ('a, 'b) rbt_node ref option \\<Rightarrow> assn\" where\n  \"btree Leaf p = \\<up>(p = None)\"\n| \"btree (rbt.Node lt c k v rt) (Some p) = (\\<exists>\\<^sub>Alp rp. p \\<mapsto>\\<^sub>r Node lp c k v rp * btree lt lp * btree rt rp)\"\n| \"btree (rbt.Node lt c k v rt) None = false\"\nsetup \\<open>fold add_rewrite_ent_rule @{thms btree.simps}\\<close>\n\nlemma btree_Leaf [forward_ent]: \"btree Leaf p \\<Longrightarrow>\\<^sub>A \\<up>(p = None)\" by auto2\n\nlemma btree_Node [forward_ent]:\n  \"btree (rbt.Node lt c k v rt) p \\<Longrightarrow>\\<^sub>A (\\<exists>\\<^sub>Alp rp. the p \\<mapsto>\\<^sub>r Node lp c k v rp * btree lt lp * btree rt rp * \\<up>(p \\<noteq> None))\"\n@proof @case \"p = None\" @qed\n\nlemma btree_none: \"emp \\<Longrightarrow>\\<^sub>A btree Leaf None\" by auto2\n\nlemma btree_constr_ent:\n  \"p \\<mapsto>\\<^sub>r Node lp c k v rp * btree lt lp * btree rt rp \\<Longrightarrow>\\<^sub>A btree (rbt.Node lt c k v rt) (Some p)\" by auto2\n\nsetup \\<open>fold add_entail_matcher [@{thm btree_none}, @{thm btree_constr_ent}]\\<close>\nsetup \\<open>fold del_prfstep_thm @{thms btree.simps}\\<close>\n\ntype_synonym ('a, 'b) btree = \"('a, 'b) rbt_node ref option\"\n\nsubsection \\<open>Operations\\<close>\n\nsubsubsection \\<open>Basic operations\\<close>\n\ndefinition tree_empty :: \"('a, 'b) btree Heap\" where\n  \"tree_empty = return None\"\n\nlemma tree_empty_rule [hoare_triple]:\n  \"<emp> tree_empty <btree Leaf>\" by auto2\n\ndefinition tree_is_empty :: \"('a, 'b) btree \\<Rightarrow> bool Heap\" where\n  \"tree_is_empty b = return (b = None)\"\n\n\n\ndefinition btree_constr ::\n  \"('a::heap, 'b::heap) btree \\<Rightarrow> color \\<Rightarrow> 'a \\<Rightarrow> 'b \\<Rightarrow> ('a, 'b) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"btree_constr lp c k v rp = do { p \\<leftarrow> ref (Node lp c k v rp); return (Some p) }\"\n\nlemma btree_constr_rule [hoare_triple]:\n  \"<btree lt lp * btree rt rp>\n   btree_constr lp c k v rp\n   <btree (rbt.Node lt c k v rt)>\" by auto2\n\ndefinition set_color :: \"color \\<Rightarrow> ('a::heap, 'b::heap) btree \\<Rightarrow> unit Heap\" where\n  \"set_color c p = (case p of\n    None \\<Rightarrow> raise STR ''set_color''\n  | Some pp \\<Rightarrow> do {\n      t \\<leftarrow> !pp;\n      pp := Node (lsub t) c (key t) (val t) (rsub t)\n    })\"\n\nlemma set_color_rule [hoare_triple]:\n  \"<btree (rbt.Node a c x v b) p>\n   set_color c' p\n   <\\<lambda>_. btree (rbt.Node a c' x v b) p>\" by auto2\n\ndefinition get_color :: \"('a::heap, 'b::heap) btree \\<Rightarrow> color Heap\" where\n  \"get_color p = (case p of\n     None \\<Rightarrow> return B\n   | Some pp \\<Rightarrow> do {\n       t \\<leftarrow> !pp;\n       return (cl t)\n     })\"\n\n\n\ndefinition paint :: \"color \\<Rightarrow> ('a::heap, 'b::heap) btree \\<Rightarrow> unit Heap\" where\n  \"paint c p = (case p of\n    None \\<Rightarrow> return ()\n  | Some pp \\<Rightarrow> do {\n     t \\<leftarrow> !pp;\n     pp := Node (lsub t) c (key t) (val t) (rsub t)\n   })\"\n  \nlemma paint_rule [hoare_triple]:\n  \"<btree t p>\n   paint c p\n   <\\<lambda>_. btree (RBTree.paint c t) p>\"\n@proof @case \"t = Leaf\" @qed\n\nsubsubsection \\<open>Rotation\\<close>\n\ndefinition btree_rotate_l :: \"('a::heap, 'b::heap) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"btree_rotate_l p = (case p of\n    None \\<Rightarrow> raise STR ''Empty btree''\n  | Some pp \\<Rightarrow> do {\n     t \\<leftarrow> !pp;\n     (case rsub t of\n        None \\<Rightarrow> raise STR ''Empty rsub''\n      | Some rp \\<Rightarrow> do {\n          rt \\<leftarrow> !rp;\n          pp := Node (lsub t) (cl t) (key t) (val t) (lsub rt);\n          rp := Node p (cl rt) (key rt) (val rt) (rsub rt);\n          return (rsub t) })})\"\n\nlemma btree_rotate_l_rule [hoare_triple]:\n  \"<btree (rbt.Node a c1 x v (rbt.Node b c2 y w c)) p>\n   btree_rotate_l p\n   <btree (rbt.Node (rbt.Node a c1 x v b) c2 y w c)>\" by auto2\n\ndefinition btree_rotate_r :: \"('a::heap, 'b::heap) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"btree_rotate_r p = (case p of\n    None \\<Rightarrow> raise STR ''Empty btree''\n  | Some pp \\<Rightarrow> do {\n     t \\<leftarrow> !pp;\n     (case lsub t of\n        None \\<Rightarrow> raise STR ''Empty lsub''\n      | Some lp \\<Rightarrow> do {\n          lt \\<leftarrow> !lp;\n          pp := Node (rsub lt) (cl t) (key t) (val t) (rsub t);\n          lp := Node (lsub lt) (cl lt) (key lt) (val lt) p;\n          return (lsub t) })})\"\n\nlemma btree_rotate_r_rule [hoare_triple]:\n  \"<btree (rbt.Node (rbt.Node a c1 x v b) c2 y w c) p>\n   btree_rotate_r p\n   <btree (rbt.Node a c1 x v (rbt.Node b c2 y w c))>\" by auto2\n\nsubsubsection \\<open>Balance\\<close>\n\ndefinition btree_balanceR :: \"('a::heap, 'b::heap) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"btree_balanceR p = (case p of None \\<Rightarrow> return None | Some pp \\<Rightarrow> do {\n     t \\<leftarrow> !pp;\n     cl_r \\<leftarrow> get_color (rsub t);\n     if cl_r = R then do {\n       rt \\<leftarrow> !(the (rsub t));\n       cl_lr \\<leftarrow> get_color (lsub rt);\n       cl_rr \\<leftarrow> get_color (rsub rt);\n       if cl_lr = R then do {\n         rp' \\<leftarrow> btree_rotate_r (rsub t);\n         pp := Node (lsub t) (cl t) (key t) (val t) rp';\n         p' \\<leftarrow> btree_rotate_l p;\n         t' \\<leftarrow> !(the p');\n         set_color B (rsub t');\n         return p'\n       } else if cl_rr = R then do {\n         p' \\<leftarrow> btree_rotate_l p;\n         t' \\<leftarrow> !(the p');\n         set_color B (rsub t');\n         return p'\n        } else return p }\n     else return p})\"\n\nlemma balanceR_to_fun [hoare_triple]:\n  \"<btree (rbt.Node l B k v r) p>\n   btree_balanceR p\n   <btree (balanceR l k v r)>\"\n@proof @unfold \"balanceR l k v r\" @qed\n\ndefinition btree_balance :: \"('a::heap, 'b::heap) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"btree_balance p = (case p of None \\<Rightarrow> return None | Some pp \\<Rightarrow> do {\n     t \\<leftarrow> !pp;\n     cl_l \\<leftarrow> get_color (lsub t);\n     if cl_l = R then do {\n       lt \\<leftarrow> !(the (lsub t));\n       cl_rl \\<leftarrow> get_color (rsub lt);\n       cl_ll \\<leftarrow> get_color (lsub lt);\n       if cl_ll = R then do {\n         p' \\<leftarrow> btree_rotate_r p;\n         t' \\<leftarrow> !(the p');\n         set_color B (lsub t');\n         return p' }\n       else if cl_rl = R then do {\n         lp' \\<leftarrow> btree_rotate_l (lsub t);\n         pp := Node lp' (cl t) (key t) (val t) (rsub t);\n         p' \\<leftarrow> btree_rotate_r p;\n         t' \\<leftarrow> !(the p');\n         set_color B (lsub t');\n         return p'\n       } else btree_balanceR p }\n     else do {\n       p' \\<leftarrow> btree_balanceR p;\n       return p'}})\"\n\n\n\nsubsubsection \\<open>Insertion\\<close>\n\npartial_function (heap) rbt_ins ::\n  \"'a::{heap,ord} \\<Rightarrow> 'b::heap \\<Rightarrow> ('a, 'b) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"rbt_ins k v p = (case p of\n     None \\<Rightarrow> btree_constr None R k v None\n   | Some pp \\<Rightarrow> do {\n      t \\<leftarrow> !pp;\n      (if cl t = B then\n        (if k = key t then do {\n           pp := Node (lsub t) (cl t) k v (rsub t);\n           return (Some pp) }\n         else if k < key t then do {\n           q \\<leftarrow> rbt_ins k v (lsub t);\n           pp := Node q (cl t) (key t) (val t) (rsub t);\n           btree_balance p }\n         else do {\n           q \\<leftarrow> rbt_ins k v (rsub t);\n           pp := Node (lsub t) (cl t) (key t) (val t) q;\n           btree_balance p })\n       else\n        (if k = key t then do {\n           pp := Node (lsub t) (cl t) k v (rsub t);\n           return (Some pp) }\n         else if k < key t then do {\n           q \\<leftarrow> rbt_ins k v (lsub t);\n           pp := Node q (cl t) (key t) (val t) (rsub t);\n           return (Some pp) }\n         else do {\n           q \\<leftarrow> rbt_ins k v (rsub t);\n           pp := Node (lsub t) (cl t) (key t) (val t) q;\n           return (Some pp) }))})\"\n\nlemma rbt_ins_to_fun [hoare_triple]:\n  \"<btree t p>\n   rbt_ins k v p\n   <btree (ins k v t)>\"\n@proof @induct t arbitrary p @qed\n\ndefinition rbt_insert ::\n  \"'a::{heap,ord} \\<Rightarrow> 'b::heap \\<Rightarrow> ('a, 'b) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"rbt_insert k v p = do {\n    p' \\<leftarrow> rbt_ins k v p;\n    paint B p';\n    return p' }\"\n  \nlemma rbt_insert_to_fun [hoare_triple]:\n  \"<btree t p>\n   rbt_insert k v p\n   <btree (RBTree.rbt_insert k v t)>\" by auto2\n\nsubsubsection \\<open>Search\\<close>\n\npartial_function (heap) rbt_search ::\n  \"'a::{heap,linorder} \\<Rightarrow> ('a, 'b::heap) btree \\<Rightarrow> 'b option Heap\" where\n  \"rbt_search x b = (case b of\n     None \\<Rightarrow> return None\n   | Some p \\<Rightarrow> do {\n      t \\<leftarrow> !p;\n      (if x = key t then return (Some (val t))\n       else if x < key t then rbt_search x (lsub t)\n       else rbt_search x (rsub t)) })\"\n\nlemma btree_search_correct [hoare_triple]:\n  \"<btree t b * \\<up>(rbt_sorted t)>\n   rbt_search x b\n   <\\<lambda>r. btree t b * \\<up>(r = RBTree.rbt_search t x)>\"\n@proof @induct t arbitrary b @qed\n  \nsubsubsection \\<open>Delete\\<close>\n  \ndefinition btree_balL :: \"('a::heap, 'b::heap) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"btree_balL p = (case p of\n     None \\<Rightarrow> return None\n   | Some pp \\<Rightarrow> do {\n      t \\<leftarrow> !pp;\n      cl_l \\<leftarrow> get_color (lsub t);\n      if cl_l = R then do {\n        set_color B (lsub t);  \\<comment> \\<open>Case 1\\<close>\n        return p}\n      else case rsub t of\n        None \\<Rightarrow> return p  \\<comment> \\<open>Case 2\\<close>\n      | Some rp \\<Rightarrow> do {  \n         rt \\<leftarrow> !rp;\n         if cl rt = B then do {\n           set_color R (rsub t);  \\<comment> \\<open>Case 3\\<close>\n           set_color B p;\n           btree_balance p}\n         else case lsub rt of\n           None \\<Rightarrow> return p  \\<comment> \\<open>Case 4\\<close>\n         | Some lrp \\<Rightarrow> do {\n            lrt \\<leftarrow> !lrp;\n            if cl lrt = B then do {\n              set_color R (lsub rt);  \\<comment> \\<open>Case 5\\<close>\n              paint R (rsub rt);\n              set_color B (rsub t); \n              rp' \\<leftarrow> btree_rotate_r (rsub t);\n              pp := Node (lsub t) (cl t) (key t) (val t) rp';\n              p' \\<leftarrow> btree_rotate_l p;\n              t' \\<leftarrow> !(the p');\n              set_color B (lsub t');\n              rp'' \\<leftarrow> btree_balance (rsub t');\n              the p' := Node (lsub t') (cl t') (key t') (val t') rp'';\n              return p'}\n            else return p}}})\"\n\nlemma balL_to_fun [hoare_triple]:\n  \"<btree (rbt.Node l R k v r) p>\n   btree_balL p\n   <btree (balL l k v r)>\"\n@proof @unfold \"balL l k v r\" @qed\n\ndefinition btree_balR :: \"('a::heap, 'b::heap) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"btree_balR p = (case p of\n     None \\<Rightarrow> return None\n   | Some pp \\<Rightarrow> do {\n      t \\<leftarrow> !pp;\n      cl_r \\<leftarrow> get_color (rsub t);\n      if cl_r = R then do {\n        set_color B (rsub t);  \\<comment> \\<open>Case 1\\<close>\n        return p}\n      else case lsub t of\n        None \\<Rightarrow> return p  \\<comment> \\<open>Case 2\\<close>\n      | Some lp \\<Rightarrow> do {  \n         lt \\<leftarrow> !lp;\n         if cl lt = B then do {\n           set_color R (lsub t);  \\<comment> \\<open>Case 3\\<close>\n           set_color B p;\n           btree_balance p}\n         else case rsub lt of\n           None \\<Rightarrow> return p  \\<comment> \\<open>Case 4\\<close>\n         | Some rlp \\<Rightarrow> do {\n            rlt \\<leftarrow> !rlp;\n            if cl rlt = B then do {\n              set_color R (rsub lt);  \\<comment> \\<open>Case 5\\<close>\n              paint R (lsub lt);\n              set_color B (lsub t); \n              lp' \\<leftarrow> btree_rotate_l (lsub t);\n              pp := Node lp' (cl t) (key t) (val t) (rsub t);\n              p' \\<leftarrow> btree_rotate_r p;\n              t' \\<leftarrow> !(the p');\n              set_color B (rsub t');\n              lp'' \\<leftarrow> btree_balance (lsub t');\n              the p' := Node lp'' (cl t') (key t') (val t') (rsub t');\n              return p'}\n            else return p}}})\"\n\nlemma balR_to_fun [hoare_triple]:\n  \"<btree (rbt.Node l R k v r) p>\n   btree_balR p\n   <btree (balR l k v r)>\"\n@proof @unfold \"balR l k v r\" @qed\n\npartial_function (heap) btree_combine ::\n  \"('a::heap, 'b::heap) btree \\<Rightarrow> ('a, 'b) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"btree_combine lp rp =\n   (if lp = None then return rp\n    else if rp = None then return lp\n    else do {\n      lt \\<leftarrow> !(the lp);\n      rt \\<leftarrow> !(the rp);\n      if cl lt = R then\n        if cl rt = R then do {\n          tmp \\<leftarrow> btree_combine (rsub lt) (lsub rt);\n          cl_tm \\<leftarrow> get_color tmp;\n          if cl_tm = R then do {\n            tmt \\<leftarrow> !(the tmp);\n            the lp := Node (lsub lt) R (key lt) (val lt) (lsub tmt);\n            the rp := Node (rsub tmt) R (key rt) (val rt) (rsub rt);\n            the tmp := Node lp R (key tmt) (val tmt) rp;\n            return tmp}\n          else do {\n            the rp := Node tmp R (key rt) (val rt) (rsub rt);\n            the lp := Node (lsub lt) R (key lt) (val lt) rp;\n            return lp}}\n        else do {\n          tmp \\<leftarrow> btree_combine (rsub lt) rp;\n          the lp := Node (lsub lt) R (key lt) (val lt) tmp;\n          return lp}\n      else if cl rt = B then do {\n        tmp \\<leftarrow> btree_combine (rsub lt) (lsub rt);\n        cl_tm \\<leftarrow> get_color tmp;\n        if cl_tm = R then do {\n          tmt \\<leftarrow> !(the tmp);\n          the lp := Node (lsub lt) B (key lt) (val lt) (lsub tmt);\n          the rp := Node (rsub tmt) B (key rt) (val rt) (rsub rt);\n          the tmp := Node lp R (key tmt) (val tmt) rp;\n          return tmp}\n        else do {\n          the rp := Node tmp B (key rt) (val rt) (rsub rt);\n          the lp := Node (lsub lt) R (key lt) (val lt) rp;\n          btree_balL lp}}\n      else do {\n        tmp \\<leftarrow> btree_combine lp (lsub rt);\n        the rp := Node tmp R (key rt) (val rt) (rsub rt);\n        return rp}})\"\n\nlemma combine_to_fun [hoare_triple]:\n  \"<btree lt lp * btree rt rp>\n   btree_combine lp rp\n   <btree (combine lt rt)>\"\n@proof @fun_induct \"combine lt rt\" arbitrary lp rp @with\n  @subgoal \"(lt = rbt.Node l1 c1 k1 v1 r1, rt = rbt.Node l2 c2 k2 v2 r2)\"\n    @unfold \"combine (rbt.Node l1 c1 k1 v1 r1) (rbt.Node l2 c2 k2 v2 r2)\"\n  @endgoal @end\n@qed\n\npartial_function (heap) rbt_del ::\n  \"'a::{heap,linorder} \\<Rightarrow> ('a, 'b::heap) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"rbt_del x p = (case p of\n     None \\<Rightarrow> return None\n   | Some pp \\<Rightarrow> do {\n      t \\<leftarrow> !pp;\n      (if x = key t then btree_combine (lsub t) (rsub t)\n       else if x < key t then case lsub t of\n         None \\<Rightarrow> do {\n           set_color R p;\n           return p}\n       | Some lp \\<Rightarrow> do {\n           lt \\<leftarrow> !lp;\n           if cl lt = B then do {\n             q \\<leftarrow> rbt_del x (lsub t);\n             pp := Node q R (key t) (val t) (rsub t);\n             btree_balL p }\n           else do {\n             q \\<leftarrow> rbt_del x (lsub t);\n             pp := Node q R (key t) (val t) (rsub t);\n             return p }}\n       else case rsub t of\n         None \\<Rightarrow> do {\n           set_color R p;\n           return p}\n       | Some rp \\<Rightarrow> do {\n           rt \\<leftarrow> !rp;\n           if cl rt = B then do {\n             q \\<leftarrow> rbt_del x (rsub t);\n             pp := Node (lsub t) R (key t) (val t) q;\n             btree_balR p }\n           else do {\n             q \\<leftarrow> rbt_del x (rsub t);\n             pp := Node (lsub t) R (key t) (val t) q;\n             return p }})})\"\n\nlemma rbt_del_to_fun [hoare_triple]:\n  \"<btree t p>\n   rbt_del x p\n   <btree (del x t)>\\<^sub>t\"\n@proof @induct t arbitrary p @with\n  @subgoal \"t = rbt.Node l c k v r\"\n    @unfold \"del x (rbt.Node l c k v r)\"\n  @endgoal @end\n@qed\n\ndefinition rbt_delete ::\n  \"'a::{heap,linorder} \\<Rightarrow> ('a, 'b::heap) btree \\<Rightarrow> ('a, 'b) btree Heap\" where\n  \"rbt_delete k p = do {\n    p' \\<leftarrow> rbt_del k p;\n    paint B p';\n    return p'}\"\n  \nlemma rbt_delete_to_fun [hoare_triple]:\n  \"<btree t p>\n   rbt_delete k p\n   <btree (RBTree.delete k t)>\\<^sub>t\" by auto2\n\nsubsection \\<open>Outer interface\\<close>\n\ntext \\<open>Express Hoare triples for operations on red-black tree in terms of\n  the mapping represented by the tree.\\<close>\ndefinition rbt_map_assn :: \"('a, 'b) map \\<Rightarrow> ('a::{heap,linorder}, 'b::heap) rbt_node ref option \\<Rightarrow> assn\" where\n  \"rbt_map_assn M p = (\\<exists>\\<^sub>At. btree t p * \\<up>(is_rbt t) * \\<up>(rbt_sorted t) * \\<up>(M = rbt_map t))\"\nsetup \\<open>add_rewrite_ent_rule @{thm rbt_map_assn_def}\\<close>\n\n\n\ntheorem rbt_insert_rule [hoare_triple]:\n  \"<rbt_map_assn M b> rbt_insert k v b <rbt_map_assn (M {k \\<rightarrow> v})>\" by auto2\n\ntheorem rbt_search [hoare_triple]:\n  \"<rbt_map_assn M b> rbt_search x b <\\<lambda>r. rbt_map_assn M b * \\<up>(r = M\\<langle>x\\<rangle>)>\" by auto2\n\ntheorem rbt_delete_rule [hoare_triple]:\n  \"<rbt_map_assn M b> rbt_delete k b <rbt_map_assn (delete_map k M)>\\<^sub>t\" by auto2\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Auto2_Imperative_HOL/Imperative/RBTree_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5813030906443134, "lm_q1q2_score": 0.32679493745252003}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Peter Lammich <peter dot lammich at uni-muenster.de>\n    Maintainer:  Peter Lammich <peter dot lammich at uni-muenster.de>\n*)\nheader {* \\isaheader{Specification of Maps} *}\ntheory MapSpec\nimports ICF_Spec_Base\nbegin\ntext_raw{*\\label{thy:MapSpec}*}\n\n(*@intf Map\n  @abstype 'k\\<rightharpoonup>'v\n  This interface specifies maps from keys to values.\n*)\n\ntext {*\n  This theory specifies map operations by means of mapping to\n  HOL's map type, i.e. @{typ \"'k \\<rightharpoonup> 'v\"}.\n*}\n\ntype_synonym ('k,'v,'s) map_\\<alpha> = \"'s \\<Rightarrow> 'k \\<rightharpoonup> 'v\"\ntype_synonym ('k,'v,'s) map_invar = \"'s \\<Rightarrow> bool\"\nlocale map = \n  fixes \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"                 -- \"Abstraction to map datatype\"\n  fixes invar :: \"'s \\<Rightarrow> bool\"                 -- \"Invariant\"\n\nlocale map_no_invar = map +\n  assumes invar[simp, intro!]: \"\\<And>s. invar s\"\n\nsubsection \"Basic Map Functions\"\n\nsubsubsection \"Empty Map\"\ntype_synonym ('k,'v,'s) map_empty = \"unit \\<Rightarrow> 's\"\nlocale map_empty = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes empty :: \"unit \\<Rightarrow> 's\"\n  assumes empty_correct:\n    \"\\<alpha> (empty ()) = Map.empty\"\n    \"invar (empty ())\"\n\nsubsubsection \"Lookup\"\ntype_synonym ('k,'v,'s) map_lookup = \"'k \\<Rightarrow> 's \\<Rightarrow> 'v option\"\nlocale map_lookup = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes lookup :: \"'u \\<Rightarrow> 's \\<Rightarrow> 'v option\"\n  assumes lookup_correct:\n    \"invar m \\<Longrightarrow> lookup k m = \\<alpha> m k\"\n\nsubsubsection \"Update\"\ntype_synonym ('k,'v,'s) map_update = \"'k \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_update = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes update :: \"'u \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes update_correct:\n    \"invar m \\<Longrightarrow> \\<alpha> (update k v m) = (\\<alpha> m)(k \\<mapsto> v)\"\n    \"invar m \\<Longrightarrow> invar (update k v m)\"\n\nsubsubsection \"Disjoint Update\"\ntype_synonym ('k,'v,'s) map_update_dj = \"'k \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_update_dj = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes update_dj :: \"'u \\<Rightarrow> 'v \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes update_dj_correct: \n    \"\\<lbrakk>invar m; k\\<notin>dom (\\<alpha> m)\\<rbrakk> \\<Longrightarrow> \\<alpha> (update_dj k v m) = (\\<alpha> m)(k \\<mapsto> v)\"\n    \"\\<lbrakk>invar m; k\\<notin>dom (\\<alpha> m)\\<rbrakk> \\<Longrightarrow> invar (update_dj k v m)\"\n\n \nsubsubsection \"Delete\"\ntype_synonym ('k,'v,'s) map_delete = \"'k \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_delete = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes delete :: \"'u \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes delete_correct: \n    \"invar m \\<Longrightarrow> \\<alpha> (delete k m) = (\\<alpha> m) |` (-{k})\"\n    \"invar m \\<Longrightarrow> invar (delete k m)\"\n\nsubsubsection \"Add\"\ntype_synonym ('k,'v,'s) map_add = \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_add = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes add :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes add_correct:\n    \"invar m1 \\<Longrightarrow> invar m2 \\<Longrightarrow> \\<alpha> (add m1 m2) = \\<alpha> m1 ++ \\<alpha> m2\"\n    \"invar m1 \\<Longrightarrow> invar m2 \\<Longrightarrow> invar (add m1 m2)\"\n\ntype_synonym ('k,'v,'s) map_add_dj = \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\nlocale map_add_dj = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes add_dj :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's\"\n  assumes add_dj_correct:\n    \"\\<lbrakk>invar m1; invar m2; dom (\\<alpha> m1) \\<inter> dom (\\<alpha> m2) = {}\\<rbrakk> \\<Longrightarrow> \\<alpha> (add_dj m1 m2) = \\<alpha> m1 ++ \\<alpha> m2\"\n    \"\\<lbrakk>invar m1; invar m2; dom (\\<alpha> m1) \\<inter> dom (\\<alpha> m2) = {} \\<rbrakk> \\<Longrightarrow> invar (add_dj m1 m2)\"\n\nsubsubsection \"Emptiness Check\"\ntype_synonym ('k,'v,'s) map_isEmpty = \"'s \\<Rightarrow> bool\"\nlocale map_isEmpty = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes isEmpty :: \"'s \\<Rightarrow> bool\"\n  assumes isEmpty_correct : \"invar m \\<Longrightarrow> isEmpty m \\<longleftrightarrow> \\<alpha> m = Map.empty\"\n\nsubsubsection \"Singleton Maps\"\ntype_synonym ('k,'v,'s) map_sng = \"'k \\<Rightarrow> 'v \\<Rightarrow> 's\"\nlocale map_sng = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes sng :: \"'u \\<Rightarrow> 'v \\<Rightarrow> 's\"\n  assumes sng_correct : \n    \"\\<alpha> (sng k v) = [k \\<mapsto> v]\"\n    \"invar (sng k v)\"\n\ntype_synonym ('k,'v,'s) map_isSng = \"'s \\<Rightarrow> bool\"\nlocale map_isSng = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'k \\<rightharpoonup> 'v\"\n  fixes isSng :: \"'s \\<Rightarrow> bool\"\n  assumes isSng_correct:\n    \"invar s \\<Longrightarrow> isSng s \\<longleftrightarrow> (\\<exists>k v. \\<alpha> s = [k \\<mapsto> v])\"\nbegin\n  lemma isSng_correct_exists1 :\n    \"invar s \\<Longrightarrow> (isSng s \\<longleftrightarrow> (\\<exists>!k. \\<exists>v. (\\<alpha> s k = Some v)))\"\n    apply (auto simp add: isSng_correct split: split_if_asm)\n    apply (rule_tac x=k in exI)\n    apply (rule_tac x=v in exI)\n    apply (rule ext)\n    apply (case_tac \"\\<alpha> s x\")\n    apply auto\n    apply force\n    done\n\n  lemma isSng_correct_card :\n    \"invar s \\<Longrightarrow> (isSng s \\<longleftrightarrow> (card (dom (\\<alpha> s)) = 1))\"\n    by (auto simp add: isSng_correct card_Suc_eq dom_eq_singleton_conv)\n\nend\n\nsubsubsection \"Finite Maps\"\nlocale finite_map = map +\n  assumes finite[simp, intro!]: \"invar m \\<Longrightarrow> finite (dom (\\<alpha> m))\"\n\nsubsubsection \"Size\"\ntype_synonym ('k,'v,'s) map_size = \"'s \\<Rightarrow> nat\"\nlocale map_size = finite_map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes size :: \"'s \\<Rightarrow> nat\"\n  assumes size_correct: \"invar s \\<Longrightarrow> size s = card (dom (\\<alpha> s))\"\n  \ntype_synonym ('k,'v,'s) map_size_abort = \"nat \\<Rightarrow> 's \\<Rightarrow> nat\"\nlocale map_size_abort = finite_map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes size_abort :: \"nat \\<Rightarrow> 's \\<Rightarrow> nat\"\n  assumes size_abort_correct: \"invar s \\<Longrightarrow> size_abort m s = min m (card (dom (\\<alpha> s)))\"\n\nsubsubsection \"Iterators\"\ntext {*\n  An iteration combinator over a map applies a function to a state for each \n  map entry, in arbitrary order.\n  Proving of properties is done by invariant reasoning.\n  An iterator can also contain a continuation condition. Iteration is\n  interrupted if the condition becomes false.\n*}\n\n(* Deprecated *)\n(*locale map_iteratei = finite_map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes iteratei :: \"'s \\<Rightarrow> ('u \\<times> 'v,'\\<sigma>) set_iterator\"\n\n  assumes iteratei_rule: \"invar m \\<Longrightarrow> map_iterator (iteratei m) (\\<alpha> m)\"\nbegin\n  lemma iteratei_rule_P:\n    assumes \"invar m\"\n        and I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n        and IP: \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                    \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n        and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n        and II: \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> {}; \\<not> c \\<sigma>; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using map_iterator_rule_P [OF iteratei_rule, of m I \\<sigma>0 c f P]\n    by (simp_all add: assms)\n\n  lemma iteratei_rule_insert_P:\n    assumes  \n      \"invar m\" \n      \"I {} \\<sigma>0\"\n      \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n          \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>)\"\n      \"!!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> dom (\\<alpha> m); \n               \\<not> (c \\<sigma>); \n               I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using map_iterator_rule_insert_P [OF iteratei_rule, of m I \\<sigma>0 c f P]\n    by (simp_all add: assms)\n\n  lemma iterate_rule_P:\n    \"\\<lbrakk>\n      invar m;\n      I (dom (\\<alpha> m)) \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iteratei m (\\<lambda>_. True) f \\<sigma>0)\"\n    using iteratei_rule_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by fast\n\n  lemma iterate_rule_insert_P:\n    \"\\<lbrakk>\n      invar m;\n      I {} \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iteratei m (\\<lambda>_. True) f \\<sigma>0)\"\n    using iteratei_rule_insert_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by fast\nend\n\nlemma map_iteratei_I :\n  assumes \"\\<And>m. invar m \\<Longrightarrow> map_iterator (iti m) (\\<alpha> m)\"\n  shows \"map_iteratei \\<alpha> invar iti\"\nproof\n  fix m \n  assume invar_m: \"invar m\"\n  from assms(1)[OF invar_m] show it_OK: \"map_iterator (iti m) (\\<alpha> m)\" .\n  \n  from set_iterator_genord.finite_S0 [OF it_OK[unfolded set_iterator_def]]\n  show \"finite (dom (\\<alpha> m))\" by (simp add: finite_map_to_set) \nqed\n*)\n\ntype_synonym ('k,'v,'s) map_list_it\n  = \"'s \\<Rightarrow> ('k\\<times>'v,('k\\<times>'v) list) set_iterator\"\nlocale poly_map_iteratei_defs =\n  fixes list_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\"\nbegin\n  definition iteratei :: \"'s \\<Rightarrow> ('u\\<times>'v,'\\<sigma>) set_iterator\"\n    where \"iteratei S \\<equiv> it_to_it (list_it S)\"\n\n  abbreviation \"iterate m \\<equiv> iteratei m (\\<lambda>_. True)\"\nend\n\nlocale poly_map_iteratei =\n  finite_map + poly_map_iteratei_defs list_it\n  for list_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\" +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  assumes list_it_correct: \"invar m \\<Longrightarrow> map_iterator (list_it m) (\\<alpha> m)\"\nbegin\n  lemma iteratei_correct: \"invar S \\<Longrightarrow> map_iterator (iteratei S) (\\<alpha> S)\"\n    unfolding iteratei_def\n    apply (rule it_to_it_correct)\n    by (rule list_it_correct)\n\n  lemma pi_iteratei[icf_proper_iteratorI]: \n    \"proper_it (iteratei S) (iteratei S)\"\n    unfolding iteratei_def \n    by (intro icf_proper_iteratorI)\n\n  lemma iteratei_rule_P:\n    assumes \"invar m\"\n    and I0: \"I (map_to_set (\\<alpha> m)) \\<sigma>0\"\n    and IP: \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; (k,v) \\<in> it; it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (it - {(k,v)}) (f (k, v) \\<sigma>)\"\n    and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and II: \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> map_to_set (\\<alpha> m); it \\<noteq> {}; \\<not> c \\<sigma>; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    apply (rule set_iterator_rule_P[OF iteratei_correct])\n    apply fact\n    apply fact\n    apply (case_tac x, simp add: IP)\n    apply fact\n    apply fact\n    done\n\n  lemma iteratei_rule_insert_P:\n    assumes \"invar m\" \n    and \"I {} \\<sigma>0\"\n    and \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; (k,v) \\<in> (map_to_set (\\<alpha> m) - it); \n                       it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (insert (k,v) it) (f (k, v) \\<sigma>)\"\n    and \"!!\\<sigma>. I (map_to_set (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> map_to_set (\\<alpha> m); it \\<noteq> map_to_set (\\<alpha> m); \n                  \\<not> (c \\<sigma>); \n                  I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    apply (rule set_iterator_rule_insert_P[OF iteratei_correct])\n    apply fact\n    apply fact\n    apply (case_tac x, simp add: assms)\n    apply fact\n    apply fact\n    done\n\n  lemma iterate_rule_P:\n    assumes \"invar m\"\n    and I0: \"I (map_to_set (\\<alpha> m)) \\<sigma>0\"\n    and IP: \"!!k v it \\<sigma>. \\<lbrakk> (k,v) \\<in> it; it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (it - {(k,v)}) (f (k, v) \\<sigma>)\"\n    and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterate m f \\<sigma>0)\"\n    apply (rule iteratei_rule_P)\n    apply fact\n    apply (rule I0)\n    apply (rule IP, assumption+) []\n    apply (rule IF, assumption)\n    apply simp\n    done\n\n  lemma iterate_rule_insert_P:\n    assumes \"invar m\" \n    and I0: \"I {} \\<sigma>0\"\n    and \"!!k v it \\<sigma>. \\<lbrakk> (k,v) \\<in> (map_to_set (\\<alpha> m) - it); \n                       it \\<subseteq> map_to_set (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (insert (k,v) it) (f (k, v) \\<sigma>)\"\n    and \"!!\\<sigma>. I (map_to_set (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterate m f \\<sigma>0)\"\n    apply (rule iteratei_rule_insert_P)\n    apply fact\n    apply (rule I0)\n    apply (rule assms, assumption+) []\n    apply (rule assms, assumption)\n    apply simp\n    done\n    \n  lemma old_iteratei_rule_P:\n    assumes \"invar m\"\n    and I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    and IP: \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    and IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and II: \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> {}; \\<not> c \\<sigma>; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using assms\n    by (rule map_iterator_rule_P[OF iteratei_correct])\n\n  lemma old_iteratei_rule_insert_P:\n    assumes \"invar m\" \n    and \"I {} \\<sigma>0\"\n    and \"!!k v it \\<sigma>. \\<lbrakk> c \\<sigma>; k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; \n                       it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n      \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>)\"\n    and \"!!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    and \"!!\\<sigma> it. \\<lbrakk> it \\<subseteq> dom (\\<alpha> m); it \\<noteq> dom (\\<alpha> m); \n                  \\<not> (c \\<sigma>); \n                  I it \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iteratei m c f \\<sigma>0)\"\n    using assms by (rule map_iterator_rule_insert_P[OF iteratei_correct])\n\n  lemma old_iterate_rule_P:\n    \"\\<lbrakk>\n      invar m;\n      I (dom (\\<alpha> m)) \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> it; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iterate m f \\<sigma>0)\"\n    using old_iteratei_rule_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\n  lemma old_iterate_rule_insert_P:\n    \"\\<lbrakk>\n      invar m;\n      I {} \\<sigma>0;\n      !!k v it \\<sigma>. \\<lbrakk> k \\<in> (dom (\\<alpha> m) - it); \\<alpha> m k = Some v; \n                    it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (insert k it) (f (k, v) \\<sigma>);\n      !!\\<sigma>. I (dom (\\<alpha> m)) \\<sigma> \\<Longrightarrow> P \\<sigma>\n    \\<rbrakk> \\<Longrightarrow> P (iteratei m (\\<lambda>_. True) f \\<sigma>0)\"\n    using old_iteratei_rule_insert_P [of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\n  end\n\n\nsubsubsection \"Bounded Quantification\"\ntype_synonym ('k,'v,'s) map_ball = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\nlocale map_ball = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes ball :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  assumes ball_correct: \"invar m \\<Longrightarrow> ball m P \\<longleftrightarrow> (\\<forall>u v. \\<alpha> m u = Some v \\<longrightarrow> P (u, v))\"\n\ntype_synonym ('k,'v,'s) map_bex = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\nlocale map_bex = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes bex :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  assumes bex_correct: \n    \"invar m \\<Longrightarrow> bex m P \\<longleftrightarrow> (\\<exists>u v. \\<alpha> m u = Some v \\<and> P (u, v))\"\n\n\nsubsubsection \"Selection of Entry\"\ntype_synonym ('k,'v,'s,'r) map_sel = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> 'r option) \\<Rightarrow> 'r option\"\nlocale map_sel = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes sel :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> 'r option) \\<Rightarrow> 'r option\"\n  assumes selE: \n  \"\\<lbrakk> invar m; \\<alpha> m u = Some v; f (u, v) = Some r; \n     !!u v r. \\<lbrakk> sel m f = Some r; \\<alpha> m u = Some v; f (u, v) = Some r \\<rbrakk> \\<Longrightarrow> Q \n   \\<rbrakk> \\<Longrightarrow> Q\"\n  assumes selI: \n    \"\\<lbrakk> invar m; \\<forall>u v. \\<alpha> m u = Some v \\<longrightarrow> f (u, v) = None \\<rbrakk> \\<Longrightarrow> sel m f = None\"\n\nbegin\n  lemma sel_someE: \n    \"\\<lbrakk> invar m; sel m f = Some r; \n       !!u v. \\<lbrakk> \\<alpha> m u = Some v; f (u, v) = Some r \\<rbrakk> \\<Longrightarrow> P\n     \\<rbrakk> \\<Longrightarrow> P\"\n    apply (cases \"\\<exists>u v r. \\<alpha> m u = Some v \\<and> f (u, v) = Some r\")\n    apply safe\n    apply (erule_tac u=u and v=v and r=ra in selE)\n    apply assumption\n    apply assumption\n    apply simp\n    apply (auto)\n    apply (drule (1) selI)\n    apply simp\n    done\n\n  lemma sel_noneD: \"\\<lbrakk>invar m; sel m f = None; \\<alpha> m u = Some v\\<rbrakk> \\<Longrightarrow> f (u, v) = None\"\n    apply (rule ccontr)\n    apply simp\n    apply (erule exE)\n    apply (erule_tac f=f and u=u and v=v and r=y in selE)\n    apply auto\n    done\n\nend\n\n  -- \"Equivalent description of sel-map properties\"\nlemma map_sel_altI:\n  assumes S1: \n    \"!!s f r P. \\<lbrakk> invar s; sel s f = Some r; \n                  !!u v. \\<lbrakk>\\<alpha> s u = Some v; f (u, v) = Some r\\<rbrakk> \\<Longrightarrow> P\n                \\<rbrakk> \\<Longrightarrow> P\"\n  assumes S2: \n    \"!!s f u v. \\<lbrakk>invar s; sel s f = None; \\<alpha> s u = Some v\\<rbrakk> \\<Longrightarrow> f (u, v) = None\"\n  shows \"map_sel \\<alpha> invar sel\"\nproof -\n  show ?thesis\n    apply (unfold_locales)\n    apply (case_tac \"sel m f\")\n    apply (force dest: S2)\n    apply (force elim: S1)\n    apply (case_tac \"sel m f\")\n    apply assumption\n    apply (force elim: S1)\n    done\nqed\n\n\nsubsubsection \"Selection of Entry (without mapping)\"\ntype_synonym ('k,'v,'s) map_sel' = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k\\<times>'v) option\"\nlocale map_sel' = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes sel' :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('u\\<times>'v) option\"\n  assumes sel'E: \n  \"\\<lbrakk> invar m; \\<alpha> m u = Some v; P (u, v); \n     !!u v. \\<lbrakk> sel' m P = Some (u,v); \\<alpha> m u = Some v; P (u, v)\\<rbrakk> \\<Longrightarrow> Q \n   \\<rbrakk> \\<Longrightarrow> Q\"\n  assumes sel'I: \n    \"\\<lbrakk> invar m; \\<forall>u v. \\<alpha> m u = Some v \\<longrightarrow> \\<not> P (u, v) \\<rbrakk> \\<Longrightarrow> sel' m P = None\"\n\nbegin\n  lemma sel'_someE: \n    \"\\<lbrakk> invar m; sel' m P = Some (u,v); \n       !!u v. \\<lbrakk> \\<alpha> m u = Some v; P (u, v) \\<rbrakk> \\<Longrightarrow> thesis\n     \\<rbrakk> \\<Longrightarrow> thesis\"\n    apply (cases \"\\<exists>u v. \\<alpha> m u = Some v \\<and> P (u, v)\")\n    apply safe\n    apply (erule_tac u=ua and v=va in sel'E)\n    apply assumption\n    apply assumption\n    apply simp\n    apply (auto)\n    apply (drule (1) sel'I)\n    apply simp\n    done\n\n  lemma sel'_noneD: \"\\<lbrakk>invar m; sel' m P = None; \\<alpha> m u = Some v\\<rbrakk> \\<Longrightarrow> \\<not> P (u, v)\"\n    apply (rule ccontr)\n    apply simp\n    apply (erule (2) sel'E[where P=P])\n    apply auto\n    done\n\n  lemma sel'_SomeD:\n    \"\\<lbrakk> sel' m P = Some (u, v); invar m \\<rbrakk> \\<Longrightarrow> \\<alpha> m u = Some v \\<and> P (u, v)\"\n    apply(cases \"\\<exists>u' v'. \\<alpha> m u' = Some v' \\<and> P (u', v')\")\n     apply clarsimp\n     apply(erule (2) sel'E[where P=P])\n     apply simp\n    apply(clarsimp)\n    apply(drule (1) sel'I)\n    apply simp\n    done\nend\n\nsubsubsection \"Map to List Conversion\"\ntype_synonym ('k,'v,'s) map_to_list = \"'s \\<Rightarrow> ('k\\<times>'v) list\"\nlocale map_to_list = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes to_list :: \"'s \\<Rightarrow> ('u\\<times>'v) list\"\n  assumes to_list_correct: \n    \"invar m \\<Longrightarrow> map_of (to_list m) = \\<alpha> m\"\n    \"invar m \\<Longrightarrow> distinct (map fst (to_list m))\"\n\n\nsubsubsection \"List to Map Conversion\"\ntype_synonym ('k,'v,'s) list_to_map = \"('k\\<times>'v) list \\<Rightarrow> 's\"\nlocale list_to_map = map +\n  constrains \\<alpha> :: \"'s \\<Rightarrow> 'u \\<rightharpoonup> 'v\"\n  fixes to_map :: \"('u\\<times>'v) list \\<Rightarrow> 's\"\n  assumes to_map_correct:\n    \"\\<alpha> (to_map l) = map_of l\"\n    \"invar (to_map l)\"\n\nsubsubsection \"Image of a Map\"\n\ntext {* This locale allows to apply a function to both the keys and\n the values of a map while at the same time filtering entries. *}\n\ndefinition transforms_to_unique_keys ::\n  \"('u1 \\<rightharpoonup> 'v1) \\<Rightarrow> ('u1 \\<times> 'v1 \\<rightharpoonup> ('u2 \\<times> 'v2)) \\<Rightarrow> bool\"\n  where\n  \"transforms_to_unique_keys m f \\<equiv> (\\<forall>k1 k2 v1 v2 k' v1' v2'. ( \n         m k1 = Some v1 \\<and>\n         m k2 = Some v2 \\<and>\n         f (k1, v1) = Some (k', v1') \\<and>\n         f (k2, v2) = Some (k', v2')) -->\n       (k1 = k2))\"\n\ntype_synonym ('k1,'v1,'m1,'k2,'v2,'m2) map_image_filter  \n  = \"('k1 \\<times> 'v1 \\<Rightarrow> ('k2 \\<times> 'v2) option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n\nlocale map_image_filter = m1!: map \\<alpha>1 invar1 + m2!: map \\<alpha>2 invar2\n  for \\<alpha>1 :: \"'m1 \\<Rightarrow> 'u1 \\<rightharpoonup> 'v1\" and invar1\n  and \\<alpha>2 :: \"'m2 \\<Rightarrow> 'u2 \\<rightharpoonup> 'v2\" and invar2\n  +\n  fixes map_image_filter :: \"('u1 \\<times> 'v1 \\<Rightarrow> ('u2 \\<times> 'v2) option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n  assumes map_image_filter_correct_aux1:\n    \"\\<And>k' v'. \n     \\<lbrakk>invar1 m; transforms_to_unique_keys (\\<alpha>1 m) f\\<rbrakk> \\<Longrightarrow> \n     (invar2 (map_image_filter f m) \\<and>\n      ((\\<alpha>2 (map_image_filter f m) k' = Some v') \\<longleftrightarrow>\n       (\\<exists>k v. (\\<alpha>1 m k = Some v) \\<and> f (k, v) = Some (k', v'))))\"\nbegin\n\n  (*Let's use a definition for the precondition *)\n\n  lemma map_image_filter_correct_aux2 :\n    assumes \"invar1 m\" \n      and \"transforms_to_unique_keys (\\<alpha>1 m) f\"\n    shows \"(\\<alpha>2 (map_image_filter f m) k' = None) \\<longleftrightarrow>\n      (\\<forall>k v v'. \\<alpha>1 m k = Some v \\<longrightarrow> f (k, v) \\<noteq> Some (k', v'))\"\n  proof -\n    note map_image_filter_correct_aux1 [OF assms]\n    have Some_eq: \"\\<And>v'. (\\<alpha>2 (map_image_filter f m) k' = Some v') =\n          (\\<exists>k v. \\<alpha>1 m k = Some v \\<and> f (k, v) = Some (k', v'))\"\n      by (simp add: map_image_filter_correct_aux1 [OF assms])\n    \n    have intro_some: \"(\\<alpha>2 (map_image_filter f m) k' = None) \\<longleftrightarrow>\n                      (\\<forall>v'. \\<alpha>2 (map_image_filter f m) k' \\<noteq> Some v')\" by auto\n    \n    from intro_some Some_eq show ?thesis by auto\n  qed\n\n  lemmas map_image_filter_correct = \n     conjunct1 [OF map_image_filter_correct_aux1] \n     conjunct2 [OF map_image_filter_correct_aux1] \n     map_image_filter_correct_aux2\nend\n    \n\ntext {* Most of the time the mapping function is only applied to values. Then,\n  the precondition disapears.*}\ntype_synonym ('k,'v1,'m1,'k2,'v2,'m2) map_value_image_filter  \n  = \"('k \\<Rightarrow> 'v1 \\<Rightarrow> 'v2 option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n\nlocale map_value_image_filter = m1!: map \\<alpha>1 invar1 + m2!: map \\<alpha>2 invar2\n  for \\<alpha>1 :: \"'m1 \\<Rightarrow> 'u \\<rightharpoonup> 'v1\" and invar1\n  and \\<alpha>2 :: \"'m2 \\<Rightarrow> 'u \\<rightharpoonup> 'v2\" and invar2\n  +\n  fixes map_value_image_filter :: \"('u \\<Rightarrow> 'v1 \\<Rightarrow> 'v2 option) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n  assumes map_value_image_filter_correct_aux:\n    \"invar1 m \\<Longrightarrow> \n     invar2 (map_value_image_filter f m) \\<and>\n     (\\<alpha>2 (map_value_image_filter f m) = \n      (\\<lambda>k. Option.bind (\\<alpha>1 m k) (f k)))\"\nbegin\n\n  lemmas map_value_image_filter_correct =\n    conjunct1[OF map_value_image_filter_correct_aux]\n    conjunct2[OF map_value_image_filter_correct_aux]\n\n\n  lemma map_value_image_filter_correct_alt :\n    \"invar1 m \\<Longrightarrow> \n     invar2 (map_value_image_filter f m)\"\n    \"invar1 m \\<Longrightarrow>\n     (\\<alpha>2 (map_value_image_filter f m) k = Some v') \\<longleftrightarrow>\n     (\\<exists>v. (\\<alpha>1 m k = Some v) \\<and> f k v = Some v')\"\n    \"invar1 m \\<Longrightarrow>\n     (\\<alpha>2 (map_value_image_filter f m) k = None) \\<longleftrightarrow>\n     (\\<forall>v. (\\<alpha>1 m k = Some v) --> f k v = None)\"\n  proof -\n    assume invar_m : \"invar1 m\"\n    note aux = map_value_image_filter_correct_aux [OF invar_m]\n\n    from aux show \"invar2 (map_value_image_filter f m)\" by simp\n    from aux show \"(\\<alpha>2 (map_value_image_filter f m) k = Some v') \\<longleftrightarrow>\n     (\\<exists>v. (\\<alpha>1 m k = Some v) \\<and> f k v = Some v')\" \n      by (cases \"\\<alpha>1 m k\", simp_all)\n    from aux show \"(\\<alpha>2 (map_value_image_filter f m) k = None) \\<longleftrightarrow>\n     (\\<forall>v. (\\<alpha>1 m k = Some v) --> f k v = None)\" \n      by (cases \"\\<alpha>1 m k\", simp_all)\n  qed\nend\n\ntype_synonym ('k,'v,'m1,'m2) map_restrict = \"('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\nlocale map_restrict = m1!: map \\<alpha>1 invar1 + m2!: map \\<alpha>2 invar2 \n  for \\<alpha>1 :: \"'m1 \\<Rightarrow> 'u \\<rightharpoonup> 'v\" and invar1\n  and \\<alpha>2 :: \"'m2 \\<Rightarrow> 'u \\<rightharpoonup> 'v\" and invar2\n  +\n  fixes restrict :: \"('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> 'm1 \\<Rightarrow> 'm2\"\n  assumes restrict_correct_aux1 :\n    \"invar1 m \\<Longrightarrow> \\<alpha>2 (restrict P m) = \\<alpha>1 m |` {k. \\<exists>v. \\<alpha>1 m k = Some v \\<and> P (k, v)}\"\n    \"invar1 m \\<Longrightarrow> invar2 (restrict P m)\"\nbegin\n  lemma restrict_correct_aux2 :\n    \"invar1 m \\<Longrightarrow> \\<alpha>2 (restrict (\\<lambda>(k,_). P k) m) = \\<alpha>1 m |` {k. P k}\"\n  proof -\n    assume invar_m : \"invar1 m\"\n    have \"\\<alpha>1 m |` {k. (\\<exists>v. \\<alpha>1 m k = Some v) \\<and> P k} = \\<alpha>1 m |` {k. P k}\"\n      (is \"\\<alpha>1 m |` ?A1 = \\<alpha>1 m |` ?A2\")\n    proof\n      fix k\n      show \"(\\<alpha>1 m |` ?A1) k = (\\<alpha>1 m |` ?A2) k\"\n      proof (cases \"k \\<in> ?A2\")\n        case False thus ?thesis by simp\n      next\n        case True\n        hence P_k : \"P k\" by simp\n\n        show ?thesis\n          by (cases \"\\<alpha>1 m k\", simp_all add: P_k)\n      qed\n    qed\n    with invar_m show \"\\<alpha>2 (restrict (\\<lambda>(k, _). P k) m) = \\<alpha>1 m |` {k. P k}\"\n      by (simp add: restrict_correct_aux1)\n  qed\n\n  lemmas restrict_correct = \n     restrict_correct_aux1\n     restrict_correct_aux2\nend\n\n\nsubsection \"Ordered Maps\"\n  locale ordered_map = map \\<alpha> invar \n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n\n  locale ordered_finite_map = finite_map \\<alpha> invar + ordered_map \\<alpha> invar\n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n\nsubsubsection {* Ordered Iteration *}\n  (* Deprecated *)\n(*\n  locale map_iterateoi = ordered_finite_map \\<alpha> invar\n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n    +\n    fixes iterateoi :: \"'s \\<Rightarrow> ('u \\<times> 'v,'\\<sigma>) set_iterator\"\n    assumes iterateoi_rule: \"\n      invar m \\<Longrightarrow> map_iterator_linord (iterateoi m) (\\<alpha> m)\"\n  begin\n    lemma iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n        c \\<sigma>; \n        k \\<in> it; \n        \\<forall>j\\<in>it. k\\<le>j; \n        \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<le>k; \n        \\<alpha> m k = Some v; \n        it \\<subseteq> dom (\\<alpha> m); \n        I it \\<sigma> \n      \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      assumes II: \"!!\\<sigma> it. \\<lbrakk> \n        it \\<subseteq> dom (\\<alpha> m); \n        it \\<noteq> {}; \n        \\<not> c \\<sigma>; \n        I it \\<sigma>; \n        \\<forall>k\\<in>it. \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<le>k \n      \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (iterateoi m c f \\<sigma>0)\"\n    using map_iterator_linord_rule_P [OF iterateoi_rule, of m I \\<sigma>0 c f P] assms\n    by simp\n\n    lemma iterateo_rule_P[case_names minv inv0 inv_pres i_complete]: \n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> k \\<in> it; \\<forall>j\\<in>it. k\\<le>j; \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<le>k; \\<alpha> m k = Some v; it \\<subseteq> dom (\\<alpha> m); I it \\<sigma> \\<rbrakk> \n                  \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (iterateoi m (\\<lambda>_. True) f \\<sigma>0)\"\n    using map_iterator_linord_rule_P [OF iterateoi_rule, of m I \\<sigma>0 \"\\<lambda>_. True\" f P] assms\n    by simp\n  end\n\n  lemma map_iterateoi_I :\n  assumes \"\\<And>m. invar m \\<Longrightarrow> map_iterator_linord (itoi m) (\\<alpha> m)\"\n  shows \"map_iterateoi \\<alpha> invar itoi\"\n  proof\n    fix m \n    assume invar_m: \"invar m\"\n    from assms(1)[OF invar_m] show it_OK: \"map_iterator_linord (itoi m) (\\<alpha> m)\" .\n  \n    from set_iterator_genord.finite_S0 [OF it_OK[unfolded set_iterator_map_linord_def]]\n    show \"finite (dom (\\<alpha> m))\" by (simp add: finite_map_to_set) \n  qed\n\n  locale map_reverse_iterateoi = ordered_finite_map \\<alpha> invar \n    for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" and invar\n    +\n    fixes reverse_iterateoi :: \"'s \\<Rightarrow> ('u \\<times> 'v,'\\<sigma>) set_iterator\"\n    assumes reverse_iterateoi_rule: \"\n      invar m \\<Longrightarrow> map_iterator_rev_linord (reverse_iterateoi m) (\\<alpha> m)\"\n  begin\n    lemma reverse_iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n        c \\<sigma>; \n        k \\<in> it; \n        \\<forall>j\\<in>it. k\\<ge>j; \n        \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<ge>k; \n        \\<alpha> m k = Some v; \n        it \\<subseteq> dom (\\<alpha> m); \n        I it \\<sigma> \n      \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      assumes II: \"!!\\<sigma> it. \\<lbrakk> \n        it \\<subseteq> dom (\\<alpha> m); \n        it \\<noteq> {}; \n        \\<not> c \\<sigma>; \n        I it \\<sigma>; \n        \\<forall>k\\<in>it. \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<ge>k \n      \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (reverse_iterateoi m c f \\<sigma>0)\"\n    using map_iterator_rev_linord_rule_P [OF reverse_iterateoi_rule, of m I \\<sigma>0 c f P] assms\n    by simp\n\n    lemma reverse_iterateo_rule_P[case_names minv inv0 inv_pres i_complete]:\n      assumes MINV: \"invar m\"\n      assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n      assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n        k \\<in> it; \n        \\<forall>j\\<in>it. k\\<ge>j; \n        \\<forall>j\\<in>dom (\\<alpha> m) - it. j\\<ge>k; \n        \\<alpha> m k = Some v; \n        it \\<subseteq> dom (\\<alpha> m); \n        I it \\<sigma> \n      \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n      assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n      shows \"P (reverse_iterateoi m (\\<lambda>_. True) f \\<sigma>0)\"\n    using map_iterator_rev_linord_rule_P[OF reverse_iterateoi_rule, of m I \\<sigma>0 \"\\<lambda>_. True\" f P] assms\n    by simp\n  end\n\n  lemma map_reverse_iterateoi_I :\n  assumes \"\\<And>m. invar m \\<Longrightarrow> map_iterator_rev_linord (ritoi m) (\\<alpha> m)\"\n  shows \"map_reverse_iterateoi \\<alpha> invar ritoi\"\n  proof\n    fix m \n    assume invar_m: \"invar m\"\n    from assms(1)[OF invar_m] show it_OK: \"map_iterator_rev_linord (ritoi m) (\\<alpha> m)\" .\n  \n    from set_iterator_genord.finite_S0 [OF it_OK[unfolded set_iterator_map_rev_linord_def]]\n    show \"finite (dom (\\<alpha> m))\" by (simp add: finite_map_to_set) \n  qed\n*)\n\nlocale poly_map_iterateoi_defs =\n  fixes olist_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\"\nbegin\n  definition iterateoi :: \"'s \\<Rightarrow> ('u\\<times>'v,'\\<sigma>) set_iterator\"\n    where \"iterateoi S \\<equiv> it_to_it (olist_it S)\"\n\n  abbreviation \"iterateo m \\<equiv> iterateoi m (\\<lambda>_. True)\"\nend\n\nlocale poly_map_iterateoi =\n  finite_map \\<alpha> invar + poly_map_iterateoi_defs list_ordered_it\n  for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" \n  and invar \n  and list_ordered_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\" +\n  assumes list_ordered_it_correct: \"invar m \n    \\<Longrightarrow> map_iterator_linord (list_ordered_it m) (\\<alpha> m)\"\nbegin\n  lemma iterateoi_correct: \"invar S \\<Longrightarrow> map_iterator_linord (iterateoi S) (\\<alpha> S)\"\n    unfolding iterateoi_def\n    apply (rule it_to_it_map_linord_correct)\n    by (rule list_ordered_it_correct)\n\n  lemma pi_iterateoi[icf_proper_iteratorI]: \n    \"proper_it (iterateoi S) (iterateoi S)\"\n    unfolding iterateoi_def \n    by (intro icf_proper_iteratorI)\n\n\n  lemma iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      c \\<sigma>; \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<le>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<le>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    assumes II: \"!!\\<sigma> it. \\<lbrakk> \n      it \\<subseteq> dom (\\<alpha> m); \n      it \\<noteq> {}; \n      \\<not> c \\<sigma>; \n      I it \\<sigma>; \n      \\<And>k j. \\<lbrakk>k\\<in>it; j\\<in>dom (\\<alpha> m) - it\\<rbrakk> \\<Longrightarrow> j\\<le>k \n    \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterateoi m c f \\<sigma>0)\"\n    using assms by (rule map_iterator_linord_rule_P[OF iterateoi_correct])\n\n  lemma iterateo_rule_P[case_names minv inv0 inv_pres i_complete]: \n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<le>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<le>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (iterateo m f \\<sigma>0)\"\n    using assms \n      map_iterator_linord_rule_P[OF iterateoi_correct, of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\nend\n  \ntype_synonym ('k,'v,'s) map_list_rev_it\n  = \"'s \\<Rightarrow> ('k\\<times>'v,('k\\<times>'v) list) set_iterator\"\n\nlocale poly_map_rev_iterateoi_defs =\n  fixes list_rev_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\"\nbegin\n  definition rev_iterateoi :: \"'s \\<Rightarrow> ('u\\<times>'v,'\\<sigma>) set_iterator\"\n    where \"rev_iterateoi S \\<equiv> it_to_it (list_rev_it S)\"\n\n  abbreviation \"rev_iterateo m \\<equiv> rev_iterateoi m (\\<lambda>_. True)\"\n  abbreviation \"reverse_iterateoi \\<equiv> rev_iterateoi\"\n  abbreviation \"reverse_iterateo \\<equiv> rev_iterateo\"\nend\n\nlocale poly_map_rev_iterateoi =\n  finite_map \\<alpha> invar + poly_map_rev_iterateoi_defs list_rev_it\n  for \\<alpha> :: \"'s \\<Rightarrow> ('u::linorder) \\<rightharpoonup> 'v\" \n  and invar\n  and list_rev_it :: \"'s \\<Rightarrow> ('u\\<times>'v,('u\\<times>'v) list) set_iterator\" +\n  assumes list_rev_it_correct: \n    \"invar m \\<Longrightarrow> map_iterator_rev_linord (list_rev_it m) (\\<alpha> m)\"\nbegin\n  lemma rev_iterateoi_correct: \n    \"invar S \\<Longrightarrow> map_iterator_rev_linord (rev_iterateoi S) (\\<alpha> S)\"\n    unfolding rev_iterateoi_def\n    apply (rule it_to_it_map_rev_linord_correct)\n    by (rule list_rev_it_correct)\n\n  lemma pi_rev_iterateoi[icf_proper_iteratorI]: \n    \"proper_it (rev_iterateoi S) (rev_iterateoi S)\"\n    unfolding rev_iterateoi_def \n    by (intro icf_proper_iteratorI)\n\n\n  lemma rev_iterateoi_rule_P[case_names minv inv0 inv_pres i_complete i_inter]:\n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      c \\<sigma>; \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<ge>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<ge>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    assumes II: \"!!\\<sigma> it. \\<lbrakk> \n      it \\<subseteq> dom (\\<alpha> m); \n      it \\<noteq> {}; \n      \\<not> c \\<sigma>; \n      I it \\<sigma>; \n      \\<And>k j. \\<lbrakk>k\\<in>it; j\\<in>dom (\\<alpha> m) - it\\<rbrakk> \\<Longrightarrow> j\\<ge>k \n    \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (rev_iterateoi m c f \\<sigma>0)\"\n    using assms by (rule map_iterator_rev_linord_rule_P[OF rev_iterateoi_correct])\n\n  lemma rev_iterateo_rule_P[case_names minv inv0 inv_pres i_complete]: \n    assumes MINV: \"invar m\"\n    assumes I0: \"I (dom (\\<alpha> m)) \\<sigma>0\"\n    assumes IP: \"!!k v it \\<sigma>. \\<lbrakk> \n      k \\<in> it; \n      \\<alpha> m k = Some v; \n      it \\<subseteq> dom (\\<alpha> m); \n      I it \\<sigma>;\n      \\<And>j. j\\<in>it \\<Longrightarrow> k\\<ge>j; \n      \\<And>j. j\\<in>dom (\\<alpha> m) - it \\<Longrightarrow> j\\<ge>k\n    \\<rbrakk> \\<Longrightarrow> I (it - {k}) (f (k, v) \\<sigma>)\"\n    assumes IF: \"!!\\<sigma>. I {} \\<sigma> \\<Longrightarrow> P \\<sigma>\"\n    shows \"P (rev_iterateo m f \\<sigma>0)\"\n    using assms \n      map_iterator_rev_linord_rule_P[OF rev_iterateoi_correct, \n        of m I \\<sigma>0 \"\\<lambda>_. True\" f P]\n    by blast\n\nend\n\nsubsubsection {* Minimal and Maximal Elements *}\n\n  type_synonym ('k,'v,'s) map_min \n    = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n  locale map_min = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes min :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('u \\<times> 'v) option\"\n    assumes min_correct:\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P \\<noteq> {} \\<rbrakk> \\<Longrightarrow> min s P \\<in> Some ` rel_of (\\<alpha> s) P\"\n      \"\\<lbrakk> invar s; (k,v) \\<in> rel_of (\\<alpha> s) P \\<rbrakk> \\<Longrightarrow> fst (the (min s P)) \\<le> k\"\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P = {} \\<rbrakk> \\<Longrightarrow> min s P = None\"\n  begin\n   lemma minE: \n     assumes A: \"invar s\" \"rel_of (\\<alpha> s) P \\<noteq> {}\"\n     obtains k v where\n     \"min s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\" \"\\<forall>(k',v')\\<in>rel_of (\\<alpha> s) P. k \\<le> k'\"\n   proof -\n     from min_correct(1)[OF A] have MIS: \"min s P \\<in> Some ` rel_of (\\<alpha> s) P\" .\n     then obtain k v where KV: \"min s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\"\n       by auto\n     show thesis \n       apply (rule that[OF KV])\n       apply (clarify)\n       apply (drule min_correct(2)[OF `invar s`])\n       apply (simp add: KV(1))\n       done\n   qed\n\n   lemmas minI = min_correct(3)\n\n   lemma min_Some:\n     \"\\<lbrakk> invar s; min s P = Some (k,v) \\<rbrakk> \\<Longrightarrow> (k,v)\\<in>rel_of (\\<alpha> s) P\"\n     \"\\<lbrakk> invar s; min s P = Some (k,v); (k',v')\\<in>rel_of (\\<alpha> s) P \\<rbrakk> \\<Longrightarrow> k\\<le>k'\"\n     apply -\n     apply (cases \"rel_of (\\<alpha> s) P = {}\")\n     apply (drule (1) min_correct(3))\n     apply simp\n     apply (erule (1) minE)\n     apply auto [1]\n     apply (drule (1) min_correct(2))\n     apply auto\n     done\n     \n   lemma min_None:\n     \"\\<lbrakk> invar s; min s P = None \\<rbrakk> \\<Longrightarrow> rel_of (\\<alpha> s) P = {}\"\n     apply (cases \"rel_of (\\<alpha> s) P = {}\")\n     apply simp\n     apply (drule (1) min_correct(1))\n     apply auto\n     done\n\n  end\n\n  type_synonym ('k,'v,'s) map_max\n    = \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n  locale map_max = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes max :: \"'s \\<Rightarrow> ('u \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('u \\<times> 'v) option\"\n    assumes max_correct:\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P \\<noteq> {} \\<rbrakk> \\<Longrightarrow> max s P \\<in> Some ` rel_of (\\<alpha> s) P\"\n      \"\\<lbrakk> invar s; (k,v) \\<in> rel_of (\\<alpha> s) P \\<rbrakk> \\<Longrightarrow> fst (the (max s P)) \\<ge> k\"\n      \"\\<lbrakk> invar s; rel_of (\\<alpha> s) P = {} \\<rbrakk> \\<Longrightarrow> max s P = None\"\n  begin\n   lemma maxE: \n     assumes A: \"invar s\" \"rel_of (\\<alpha> s) P \\<noteq> {}\"\n     obtains k v where\n     \"max s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\" \"\\<forall>(k',v')\\<in>rel_of (\\<alpha> s) P. k \\<ge> k'\"\n   proof -\n     from max_correct(1)[OF A] have MIS: \"max s P \\<in> Some ` rel_of (\\<alpha> s) P\" .\n     then obtain k v where KV: \"max s P = Some (k,v)\" \"(k,v)\\<in>rel_of (\\<alpha> s) P\"\n       by auto\n     show thesis \n       apply (rule that[OF KV])\n       apply (clarify)\n       apply (drule max_correct(2)[OF `invar s`])\n       apply (simp add: KV(1))\n       done\n   qed\n\n   lemmas maxI = max_correct(3)\n\n   \n\n  end\n\n\nsubsubsection \"Conversion to List\"\n  type_synonym ('k,'v,'s) map_to_sorted_list \n    = \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n  locale map_to_sorted_list = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes to_sorted_list :: \"'s \\<Rightarrow> ('u\\<times>'v) list\"\n    assumes to_sorted_list_correct: \n    \"invar m \\<Longrightarrow> map_of (to_sorted_list m) = \\<alpha> m\"\n    \"invar m \\<Longrightarrow> distinct (map fst (to_sorted_list m))\"\n    \"invar m \\<Longrightarrow> sorted (map fst (to_sorted_list m))\"\n\n  type_synonym ('k,'v,'s) map_to_rev_list \n    = \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n  locale map_to_rev_list = ordered_map +\n    constrains \\<alpha> :: \"'s \\<Rightarrow> 'u::linorder \\<rightharpoonup> 'v\"\n    fixes to_rev_list :: \"'s \\<Rightarrow> ('u\\<times>'v) list\"\n    assumes to_rev_list_correct: \n    \"invar m \\<Longrightarrow> map_of (to_rev_list m) = \\<alpha> m\"\n    \"invar m \\<Longrightarrow> distinct (map fst (to_rev_list m))\"\n    \"invar m \\<Longrightarrow> sorted (rev (map fst (to_rev_list m)))\"\n\nsubsection \"Record Based Interface\"\n\n  record ('k,'v,'s) map_ops = \n    map_op_\\<alpha> :: \"('k,'v,'s) map_\\<alpha>\"\n    map_op_invar :: \"('k,'v,'s) map_invar\"\n    map_op_empty :: \"('k,'v,'s) map_empty\"\n    map_op_lookup :: \"('k,'v,'s) map_lookup\"\n    map_op_update :: \"('k,'v,'s) map_update\"\n    map_op_update_dj :: \"('k,'v,'s) map_update_dj\"\n    map_op_delete :: \"('k,'v,'s) map_delete\"\n    map_op_list_it :: \"('k,'v,'s) map_list_it\"\n    map_op_sng :: \"('k,'v,'s) map_sng\"\n    map_op_restrict :: \"('k,'v,'s,'s) map_restrict\"\n    map_op_add :: \"('k,'v,'s) map_add\"\n    map_op_add_dj :: \"('k,'v,'s) map_add_dj\"\n    map_op_isEmpty :: \"('k,'v,'s) map_isEmpty\"\n    map_op_isSng :: \"('k,'v,'s) map_isSng\"\n    map_op_ball :: \"('k,'v,'s) map_ball\"\n    map_op_bex :: \"('k,'v,'s) map_bex\"\n    map_op_size :: \"('k,'v,'s) map_size\"\n    map_op_size_abort :: \"('k,'v,'s) map_size_abort\"\n    map_op_sel :: \"('k,'v,'s) map_sel'\"\n    map_op_to_list :: \"('k,'v,'s) map_to_list\"\n    map_op_to_map :: \"('k,'v,'s) list_to_map\"\n\n  locale StdMapDefs = poly_map_iteratei_defs \"map_op_list_it ops\" \n    for ops :: \"('k,'v,'s,'more) map_ops_scheme\"\n  begin\n    abbreviation \\<alpha> where \"\\<alpha> == map_op_\\<alpha> ops\" \n    abbreviation invar where \"invar == map_op_invar ops\" \n    abbreviation empty where \"empty == map_op_empty ops\" \n    abbreviation lookup where \"lookup == map_op_lookup ops\" \n    abbreviation update where \"update == map_op_update ops\" \n    abbreviation update_dj where \"update_dj == map_op_update_dj ops\" \n    abbreviation delete where \"delete == map_op_delete ops\" \n    abbreviation list_it where \"list_it == map_op_list_it ops\" \n    abbreviation sng where \"sng == map_op_sng ops\" \n    abbreviation restrict where \"restrict == map_op_restrict ops\" \n    abbreviation add where \"add == map_op_add ops\" \n    abbreviation add_dj where \"add_dj == map_op_add_dj ops\" \n    abbreviation isEmpty where \"isEmpty == map_op_isEmpty ops\" \n    abbreviation isSng where \"isSng == map_op_isSng ops\" \n    abbreviation ball where \"ball == map_op_ball ops\" \n    abbreviation bex where \"bex == map_op_bex ops\" \n    abbreviation size where \"size == map_op_size ops\" \n    abbreviation size_abort where \"size_abort == map_op_size_abort ops\" \n    abbreviation sel where \"sel == map_op_sel ops\" \n    abbreviation to_list where \"to_list == map_op_to_list ops\" \n    abbreviation to_map where \"to_map == map_op_to_map ops\"\n  end\n\n  locale StdMap = StdMapDefs ops +\n    map \\<alpha> invar +\n    map_empty \\<alpha> invar empty +\n    map_lookup \\<alpha> invar lookup  +\n    map_update \\<alpha> invar update  +\n    map_update_dj \\<alpha> invar update_dj +\n    map_delete \\<alpha> invar delete  +\n    poly_map_iteratei \\<alpha> invar list_it +\n    map_sng \\<alpha> invar sng  +\n    map_restrict \\<alpha> invar \\<alpha> invar restrict +\n    map_add \\<alpha> invar add  +\n    map_add_dj \\<alpha> invar add_dj +\n    map_isEmpty \\<alpha> invar isEmpty  +\n    map_isSng \\<alpha> invar isSng  +\n    map_ball \\<alpha> invar ball  +\n    map_bex \\<alpha> invar bex  +\n    map_size \\<alpha> invar size +\n    map_size_abort \\<alpha> invar size_abort +\n    map_sel' \\<alpha> invar sel  +\n    map_to_list \\<alpha> invar to_list  +\n    list_to_map \\<alpha> invar to_map \n    for ops :: \"('k,'v,'s,'more) map_ops_scheme\"\n  begin\n    lemmas correct =\n      empty_correct\n      sng_correct\n      lookup_correct\n      update_correct\n      update_dj_correct\n      delete_correct\n      restrict_correct\n      add_correct\n      add_dj_correct\n      isEmpty_correct\n      isSng_correct\n      ball_correct\n      bex_correct\n      size_correct\n      size_abort_correct\n      to_list_correct\n      to_map_correct\n  end\n\n  lemmas StdMap_intro = StdMap.intro[rem_dup_prems]\n\n  locale StdMap_no_invar = StdMap + map_no_invar \\<alpha> invar\n\n  record ('k,'v,'s) omap_ops = \"('k,'v,'s) map_ops\" + \n    map_op_ordered_list_it :: \"'s \\<Rightarrow> ('k,'v,('k\\<times>'v) list) map_iterator\"\n    map_op_rev_list_it :: \"'s \\<Rightarrow> ('k,'v,('k\\<times>'v) list) map_iterator\"\n    map_op_min :: \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n    map_op_max :: \"'s \\<Rightarrow> ('k \\<times> 'v \\<Rightarrow> bool) \\<Rightarrow> ('k \\<times> 'v) option\"\n    map_op_to_sorted_list :: \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n    map_op_to_rev_list :: \"'s \\<Rightarrow> ('k \\<times> 'v) list\"\n\n  locale StdOMapDefs = StdMapDefs ops\n    + poly_map_iterateoi_defs \"map_op_ordered_list_it ops\"\n    + poly_map_rev_iterateoi_defs \"map_op_rev_list_it ops\"\n    for ops :: \"('k::linorder,'v,'s,'more) omap_ops_scheme\"\n  begin\n    abbreviation ordered_list_it where \"ordered_list_it \n      \\<equiv> map_op_ordered_list_it ops\"\n    abbreviation rev_list_it where \"rev_list_it \n      \\<equiv> map_op_rev_list_it ops\"\n    abbreviation min where \"min == map_op_min ops\"\n    abbreviation max where \"max == map_op_max ops\"\n    abbreviation to_sorted_list where \n      \"to_sorted_list \\<equiv> map_op_to_sorted_list ops\"\n    abbreviation to_rev_list where \"to_rev_list \\<equiv> map_op_to_rev_list ops\"\n  end\n\n  locale StdOMap = \n    StdOMapDefs ops +\n    StdMap ops +\n    poly_map_iterateoi \\<alpha> invar ordered_list_it +\n    poly_map_rev_iterateoi \\<alpha> invar rev_list_it +\n    map_min \\<alpha> invar min +\n    map_max \\<alpha> invar max +\n    map_to_sorted_list \\<alpha> invar to_sorted_list +\n    map_to_rev_list \\<alpha> invar to_rev_list\n    for ops :: \"('k::linorder,'v,'s,'more) omap_ops_scheme\"\n  begin\n  end\n\n  lemmas StdOMap_intro = \n    StdOMap.intro[OF StdMap_intro, rem_dup_prems]\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/ICF/spec/MapSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.32679493745252}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\nsection \"Solving Word Equalities\"\n\ntheory Word_EqI\n  imports\n    More_Word\n    \"HOL-Eisbach.Eisbach_Tools\"\nbegin\n\ntext \\<open>\n  Some word equalities can be solved by considering the problem bitwise for all\n  @{prop \"n < LENGTH('a::len)\"}, which is different to running @{text word_bitwise}\n  and expanding into an explicit list of bits.\n\\<close>\n\nnamed_theorems word_eqI_simps\n\nlemmas [word_eqI_simps] =\n  word_ops_nth_size\n  bit_mask_iff\n  word_size\n  word_or_zero\n  neg_mask_test_bit\n  nth_ucast\n  nth_w2p bit_push_bit_iff\n  bit_drop_bit_eq\n  less_2p_is_upper_bits_unset\n  le_mask_high_bits\n  bang_eq\n  neg_test_bit\n  is_up\n  is_down\n\nlemmas word_eqI_rule = word_eqI [rule_format]\n\nlemma test_bit_lenD:\n  \"bit x n \\<Longrightarrow> n < LENGTH('a) \\<and> bit x n\" for x :: \"'a :: len word\"\n  by (fastforce dest: test_bit_size simp: word_size)\n\nmethod word_eqI uses simp simp_del split split_del cong flip =\n  ((* reduce conclusion to test_bit: *)\n   rule word_eqI_rule,\n   (* make sure we're in clarsimp normal form: *)\n   (clarsimp simp: simp simp del: simp_del simp flip: flip split: split split del: split_del cong: cong)?,\n   (* turn x < 2^n assumptions into mask equations: *)\n   ((drule less_mask_eq)+)?,\n   (* expand and distribute test_bit everywhere: *)\n   (clarsimp simp: word_eqI_simps simp simp del: simp_del simp flip: flip\n             split: split split del: split_del cong: cong)?,\n   (* add any additional word size constraints to new indices: *)\n   ((drule test_bit_lenD)+)?,\n   (* try to make progress (can't use +, would loop): *)\n   (clarsimp simp: word_eqI_simps simp simp del: simp_del simp flip: flip\n             split: split split del: split_del cong: cong)?,\n   (* helps sometimes, rarely: *)\n   (simp add: simp test_bit_conj_lt del: simp_del flip: flip split: split split del: split_del cong: cong)?)\n\nmethod word_eqI_solve uses simp simp_del split split_del cong flip =\n  solves \\<open>word_eqI simp: simp simp_del: simp_del split: split split_del: split_del\n                   cong: cong simp flip: flip;\n          (fastforce dest: test_bit_size simp: word_eqI_simps simp flip: flip\n                     simp: simp simp del: simp_del split: split split del: split_del cong: cong)?\\<close>\n\nend\n", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/Word_Lib/Word_EqI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.32679493745252}}
{"text": "section \\<open>Shallow Embedding of LLVM Semantics\\<close>\ntheory LLVM_Shallow\nimports Main  \n  \"LLVM_Memory\"\n  \"../../cost/Abstract_Cost\"\nbegin\n\n  text \\<open>We define a type synonym for the LLVM monad\\<close>\n  type_synonym 'a llM = \"('a,unit,cost,llvm_memory,err) M\"\n  translations\n    (type) \"'a llM\" \\<leftharpoondown> (type) \"('a, unit, (char list, nat) acost, llvm_memory, err) M\"\n  \n  subsection \\<open>Shallow Embedding of Values\\<close>  \n\n  text \\<open>We use a type class to characterize types that can be injected into the value type.\n    We will instantiate this type class to obtain injections from types of shape \n    \\<open>T = T\\<times>T | _ word | _ ptr\\<close>\n  \n    Although, this type class can be instantiated by other types, those will not be accepted \n    by the code generator.\n    \n    We also define a class \\<open>llvm_repv\\<close>, which additionally contains \\<open>unit\\<close>. \n    This is required for void functions, and if-the-else statements that produce no result.\n    \n    Again, while this class might be instantiated for other types, those will be rejected\n    by the code generator.\n  \\<close>\n  \n  class llvm_repv  \n    \n  class llvm_rep = llvm_repv +\n    fixes to_val :: \"'a \\<Rightarrow> llvm_val\"\n      and from_val :: \"llvm_val \\<Rightarrow> 'a\"\n      and struct_of :: \"'a itself \\<Rightarrow> llvm_vstruct\"\n      and init :: 'a\n    assumes from_to_id[simp]: \"from_val o to_val = id\"\n    assumes to_from_id[simp]: \"llvm_vstruct v = struct_of TYPE('a) \\<Longrightarrow> to_val (from_val v) = v\"\n    assumes struct_of_matches[simp]: \"llvm_vstruct (to_val x) = (struct_of TYPE('a))\"\n    assumes init_zero: \"to_val init = llvm_zero_initializer (struct_of TYPE('a))\"\n    \n  begin\n  \n    lemma from_to_id'[simp]: \"from_val (to_val x) = x\" \n      using pointfree_idE[OF from_to_id] .\n  \n    lemma \"to_val x = to_val y \\<longleftrightarrow> x=y\"  \n      by (metis from_to_id')\n      \n  end\n  \n  text \\<open>We use a phantom type to attach the type of the pointed to value to a pointer.\\<close>\n  datatype 'a::llvm_rep ptr = PTR (the_raw_ptr: llvm_ptr)\n  definition null :: \"'a::llvm_rep ptr\" where \"null = PTR llvm_null\"\n  \n\n  text \\<open>We instantiate the type classes for the supported types, \n    i.e., unit, word, ptr, and prod.\\<close>\n  \n  instance unit :: llvm_repv by standard\n  \n  instantiation word :: (len) llvm_rep begin\n    definition \"to_val w \\<equiv> llvm_int (lconst (len_of TYPE('a)) (uint w))\"\n    definition \"from_val v \\<equiv> word_of_int (lint_to_uint (llvm_the_int v))\"\n    definition [simp]: \"struct_of_word (_::'a word itself) \\<equiv> llvm_s_int (len_of TYPE('a))\"\n    definition [simp]: \"init_word \\<equiv> 0::'a word\"\n    \n    \n    lemma int_inv_aux: \"width i = LENGTH('a) \\<Longrightarrow> lconst LENGTH('a) (uint (word_of_int (lint_to_uint i) :: 'a word)) = i\"\n      by (metis uint_const uint_eq uint_lower_bound uint_upper_bound width_lconst word_of_int_inverse word_ubin.norm_Rep)\n    \n    instance\n      apply standard\n      apply (rule ext)\n      apply (auto simp: from_val_word_def to_val_word_def)\n      apply (auto simp: llvm_s_int_def llvm_zero_initializer_def llvm_int_def)\n      subgoal for v apply (cases v) \n        apply (auto simp: llvm_int_def llvm_the_int_def llvm_s_ptr_def llvm_s_pair_def)\n        apply (simp add: llvm_vstruct_def int_inv_aux)\n      done\n      done\n      \n  end\n  \n  instantiation ptr :: (llvm_rep) llvm_rep begin\n    definition \"to_val \\<equiv> llvm_ptr o ptr.the_raw_ptr\"\n    definition \"from_val v \\<equiv> PTR (llvm_the_ptr v)\"\n    definition [simp]: \"struct_of_ptr (_::'a ptr itself) \\<equiv> llvm_s_ptr\"\n    definition [simp]: \"init_ptr::'a ptr \\<equiv> null\"\n  \n    instance\n      apply standard\n      apply (rule ext)\n      apply (auto simp: from_val_ptr_def to_val_ptr_def)\n      apply (auto simp: llvm_zero_initializer_def llvm_ptr_def llvm_s_ptr_def null_def llvm_null_def)\n      subgoal for v apply (cases v)\n        by (auto simp: llvm_s_int_def llvm_s_pair_def llvm_ptr_def llvm_the_ptr_def)\n      done\n      \n  end\n  \n  instantiation prod :: (llvm_rep, llvm_rep) llvm_rep begin\n    definition \"to_val_prod \\<equiv> \\<lambda>(a,b). llvm_pair (to_val a) (to_val b)\"\n    definition \"from_val_prod p \\<equiv> case llvm_the_pair p of (a,b) \\<Rightarrow> (from_val a, from_val b)\"\n    definition [simp]: \"struct_of_prod (_::('a\\<times>'b) itself) \\<equiv> llvm_s_pair (struct_of TYPE('a)) (struct_of TYPE('b))\"\n    definition [simp]: \"init_prod ::'a\\<times>'b \\<equiv> (init,init)\"\n    \n    instance\n      apply standard\n      apply (rule ext)\n      apply (auto simp: from_val_prod_def to_val_prod_def)\n      apply (auto simp: llvm_pair_def llvm_s_pair_def init_zero llvm_zero_initializer_def)\n      subgoal for v\n        apply (cases v)\n        apply (auto simp: llvm_s_int_def llvm_s_ptr_def llvm_pair_def llvm_the_pair_def \n          llvm_val.the_val_def llvm_vstruct_def split: prod.splits llvm_val.splits val.split)\n        done\n      done\n      \n  end\n\n  lemma to_val_prod_conv[simp]: \"to_val (a,b) = llvm_pair (to_val a) (to_val b)\"\n    unfolding to_val_prod_def by auto\n  \n  \n  text \\<open>Checked conversion from value\\<close>  \n  definition checked_from_val :: \"llvm_val \\<Rightarrow> 'a::llvm_rep llM\" where\n    \"checked_from_val v \\<equiv> doM {\n      fcheck (STATIC_ERROR ''Type mismatch'') (llvm_vstruct v = struct_of TYPE('a));\n      return (from_val v)\n    }\" \n\n      \n  subsection \\<open>Instructions\\<close>  \n  \n  text \\<open>The instructions are arranged in the order as they are described in the \n    LLVM Language Reference Manual \\<^url>\\<open>https://llvm.org/docs/LangRef.html\\<close>.\\<close>\n    \n  \n  subsubsection \\<open>Binary Operations\\<close>  \n  text \\<open>We define a generic lifter for binary arithmetic operations.\n    It is parameterized by an error condition.\n  \\<close> (* TODO: Use precondition instead of negated precondition! *)\n\n  definition op_lift_arith2 :: \"_ \\<Rightarrow> _ \\<Rightarrow> _ \\<Rightarrow> 'a::len word \\<Rightarrow> 'a word \\<Rightarrow> 'a word llM\"\n    where \"op_lift_arith2 n ovf f a b \\<equiv> doM {\n    consume (cost n 1);\n    let a = word_to_lint a;\n    let b = word_to_lint b;\n    fcheck (OVERFLOW_ERROR) (\\<not>ovf a b);\n    return (lint_to_word (f a b))\n  }\"\n        \n  definition \"op_lift_arith2' n \\<equiv> op_lift_arith2 n (\\<lambda>_ _. False)\"\n\n  definition udivrem_is_undef :: \"lint \\<Rightarrow> lint \\<Rightarrow> bool\" \n    where \"udivrem_is_undef a b \\<equiv> lint_to_uint b=0\"\n  definition sdivrem_is_undef :: \"lint \\<Rightarrow> lint \\<Rightarrow> bool\" \n    where \"sdivrem_is_undef a b \\<equiv> lint_to_sint b=0 \\<or> sdivrem_ovf a b\"\n  \n  definition \"ll_add \\<equiv> op_lift_arith2' ''add'' (+)\"\n  definition \"ll_sub \\<equiv> op_lift_arith2' ''sub'' (-)\"\n  definition \"ll_mul \\<equiv> op_lift_arith2' ''mul'' (*)\"\n  definition \"ll_udiv \\<equiv> op_lift_arith2 ''udiv'' udivrem_is_undef (div)\"\n  definition \"ll_urem \\<equiv> op_lift_arith2 ''urem'' udivrem_is_undef (mod)\"\n  definition \"ll_sdiv \\<equiv> op_lift_arith2 ''sdiv'' sdivrem_is_undef (sdiv)\"\n  definition \"ll_srem \\<equiv> op_lift_arith2 ''srem'' sdivrem_is_undef (smod)\"\n  \n  \n  subsubsection \\<open>Compare Operations\\<close>\n  definition op_lift_cmp :: \"_ \\<Rightarrow> _ \\<Rightarrow> 'a::len word \\<Rightarrow> 'a word \\<Rightarrow> 1 word llM\"\n    where \"op_lift_cmp n f a b \\<equiv> doM {\n    consume (cost n 1);\n    let a = word_to_lint a;\n    let b = word_to_lint b;\n    return (lint_to_word (bool_to_lint (f a b)))\n  }\"\n    \n  definition op_lift_ptr_cmp :: \"_ \\<Rightarrow> _ \\<Rightarrow> 'a::llvm_rep ptr \\<Rightarrow> 'a ptr \\<Rightarrow> 1 word llM\"\n    where \"op_lift_ptr_cmp n f a b \\<equiv> doM {\n    consume (cost n 1);\n    return (lint_to_word (bool_to_lint (f a b)))\n  }\"\n  \n  definition \"ll_icmp_eq \\<equiv>  op_lift_cmp ''icmp_eq'' (=)\"\n  definition \"ll_icmp_ne \\<equiv>  op_lift_cmp ''icmp_ne'' (\\<noteq>)\"\n  definition \"ll_icmp_sle \\<equiv> op_lift_cmp ''icmp_sle'' (\\<le>\\<^sub>s)\"\n  definition \"ll_icmp_slt \\<equiv> op_lift_cmp ''icmp_slt'' (<\\<^sub>s)\"\n  definition \"ll_icmp_ule \\<equiv> op_lift_cmp ''icmp_ule'' (\\<le>)\"\n  definition \"ll_icmp_ult \\<equiv> op_lift_cmp ''icmp_ult'' (<)\"\n\n  \n  (* For presentation in paper *)\n  lemma \"ll_add a b = doM {\n      consume (cost ''add'' 1);\n      return (a+b)\n    }\"\n    unfolding ll_add_def op_lift_arith2'_def op_lift_arith2_def\n    apply simp\n    by (metis lint_word_inv word_to_lint_plus)\n    \n  \n  text \\<open>Note: There are no pointer compare instructions in LLVM. \n    To compare pointers in LLVM, they have to be casted to integers first.\n    However, our abstract memory model cannot assign a bit-width to pointers.\n    \n    Thus, we model pointer comparison instructions in our semantics, and let the \n    code generator translate them to integer comparisons. \n    \n    Up to now, we only model pointer equality. \n    For less-than, suitable preconditions are required, which are consistent with the \n    actual memory layout of LLVM. We could, e.g., adopt the rules from the C standard here.\n  \\<close>\n  definition \"ll_ptrcmp_eq \\<equiv> op_lift_ptr_cmp ''ptrcmp_eq'' (=)\"\n  definition \"ll_ptrcmp_ne \\<equiv> op_lift_ptr_cmp ''ptrcmp_ne'' (\\<noteq>)\"\n  \n\n  \n  subsubsection \\<open>Bitwise Binary Operations\\<close>  \n  definition \"shift_ovf a n \\<equiv> nat (lint_to_uint n) \\<ge> width a\"\n  definition \"bitSHL' a n \\<equiv> bitSHL a (nat (lint_to_uint n))\"\n  definition \"bitASHR' a n \\<equiv> bitASHR a (nat (lint_to_uint n))\"\n  definition \"bitLSHR' a n \\<equiv> bitLSHR a (nat (lint_to_uint n))\"\n  \n  definition \"ll_shl \\<equiv> op_lift_arith2 ''shl'' shift_ovf bitSHL'\"  \n  definition \"ll_lshr \\<equiv> op_lift_arith2 ''lshr'' shift_ovf bitLSHR'\"  \n  definition \"ll_ashr \\<equiv> op_lift_arith2 ''ashr'' shift_ovf bitASHR'\"\n  \n  definition \"ll_and \\<equiv> op_lift_arith2' ''and'' (AND)\"\n  definition \"ll_or \\<equiv> op_lift_arith2' ''or'' (OR)\"\n  definition \"ll_xor \\<equiv> op_lift_arith2' ''xor'' (XOR)\"\n    \n\n  subsubsection \\<open>Aggregate Operations\\<close>\n  text \\<open>In LLVM, there is an \\<open>extractvalue\\<close> and \\<open>insertvalue\\<close> operation.\n    In our shallow embedding, these get instantiated for \\<open>fst\\<close> and \\<open>snd\\<close>.\\<close>\n    \n  \n  definition \"checked_split_pair v \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Expected pair'') (llvm_is_pair v);\n    return (llvm_the_pair v)\n  }\"\n\n  (* TODO: reinsert costs for products and push it to the abstract level. *)\n  definition ll_extract_fst :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>1::llvm_rep llM\" where \"ll_extract_fst p = doM { \\<^cancel>\\<open>consume (cost ''extract_fst'' 1);\\<close> (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val a }\"\n  definition ll_extract_snd :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>2::llvm_rep llM\" where \"ll_extract_snd p = doM { \\<^cancel>\\<open>consume (cost ''extract_snd'' 1);\\<close> (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val b }\"\n  definition ll_insert_fst :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>1::llvm_rep \\<Rightarrow> 't llM\" where \"ll_insert_fst p x = doM { \\<^cancel>\\<open>consume (cost ''insert_fst'' 1);\\<close> (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val (llvm_pair (to_val x) b) }\" \n  definition ll_insert_snd :: \"'t::llvm_rep \\<Rightarrow> 't\\<^sub>2::llvm_rep \\<Rightarrow> 't llM\" where \"ll_insert_snd p x = doM { \\<^cancel>\\<open>consume (cost ''insert_snd'' 1);\\<close> (a,b) \\<leftarrow> checked_split_pair (to_val p); checked_from_val (llvm_pair a (to_val x)) }\" \n    \n  (*  \n  definition ll_extract_fst :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'a llM\" where \"ll_extract_fst ab \\<equiv> return (fst ab)\"\n  definition ll_extract_snd :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'b llM\" where \"ll_extract_snd ab \\<equiv> return (snd ab)\"\n  definition ll_insert_fst :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'a \\<Rightarrow> ('a\\<times>'b) llM\" where \"ll_insert_fst ab a \\<equiv> return (a,snd ab)\"\n  definition ll_insert_snd :: \"('a::llvm_rep \\<times> 'b::llvm_rep) \\<Rightarrow> 'b \\<Rightarrow> ('a\\<times>'b) llM\" where \"ll_insert_snd ab b \\<equiv> return (fst ab,b)\"\n  *)\n    \n  subsubsection \\<open>Memory Access and Addressing Operations\\<close>\n    \n  definition ll_load :: \"'a::llvm_rep ptr \\<Rightarrow> 'a llM\" where\n    \"ll_load p \\<equiv> doM {\n      consume (cost ''load'' 1);\n      r \\<leftarrow> llvm_load (the_raw_ptr p);\n      checked_from_val r\n    }\"\n    \n  definition ll_store :: \"'a::llvm_rep \\<Rightarrow> 'a ptr \\<Rightarrow> unit llM\" where\n    \"ll_store v p \\<equiv> doM {\n      consume (cost ''store'' 1);\n      llvm_store (to_val v) (the_raw_ptr p)\n    }\"\n\n  text \\<open>Note that LLVM itself does not have malloc and free instructions.\n    However, these are primitive instructions in our abstract memory model, \n    such that we have to model them in our semantics.\n    \n    The code generator will map them to the C standard library \n    functions \\<open>calloc\\<close> and \\<open>free\\<close>.\n  \\<close>\n    \n  definition ll_malloc :: \"'a::llvm_rep itself \\<Rightarrow> _::len word \\<Rightarrow> 'a ptr llM\" where\n    \"ll_malloc TYPE('a) n = doM {\n      consume (cost ''malloc'' (unat n)); \\<comment> \\<open>DESIGN CHOICE: malloc consumes n\\<close>\n      fcheck MEM_ERROR (unat n > 0); \\<comment> \\<open>Disallow empty malloc\\<close>\n      r \\<leftarrow> llvm_allocn (to_val (init::'a)) (unat n);\n      return (PTR r)\n    }\"\n        \n  definition ll_free :: \"'a::llvm_rep ptr \\<Rightarrow> unit llM\" \n    where \"ll_free p \\<equiv> doM {\n            consume (cost ''free'' 1); \\<comment> \\<open>DESIGN CHOICE: consume 1 \\<close>\n            llvm_free (the_raw_ptr p)\n          }\"\n\n\n  text \\<open>As for the aggregate operations, the \\<open>getelementptr\\<close> instruction is instantiated \n    for pointer indexing, fst, and snd. \\<close>\n\n  \\<comment> \\<open>pointer arithmetic, cost 1 each\\<close>\n\n  definition ll_ofs_ptr :: \"'a::llvm_rep ptr \\<Rightarrow> _::len word \\<Rightarrow> 'a ptr llM\" where \"ll_ofs_ptr p ofs = doM {\n    consume (cost ''ofs_ptr'' 1);\n    r \\<leftarrow> llvm_checked_idx_ptr (the_raw_ptr p) (sint ofs);\n    return (PTR r)\n  }\"  \n\n  definition ll_gep_fst :: \"'p::llvm_rep ptr \\<Rightarrow> 'a::llvm_rep ptr llM\" where \"ll_gep_fst p = doM {\n    consume (cost ''gep_fst'' 1);\n    fcheck (STATIC_ERROR ''gep_fst: Expected pair type'') (llvm_is_s_pair (struct_of TYPE('p)));\n    r \\<leftarrow> llvm_checked_gep (the_raw_ptr p) PFST;\n    return (PTR r)\n  }\"\n\n  definition ll_gep_snd :: \"'p::llvm_rep ptr \\<Rightarrow> 'b::llvm_rep ptr llM\" where \"ll_gep_snd p = doM {\n    consume (cost ''gep_snd'' 1);\n    fcheck (STATIC_ERROR ''gep_snd: Expected pair type'') (llvm_is_s_pair (struct_of TYPE('p)));\n    r \\<leftarrow> llvm_checked_gep (the_raw_ptr p) PSND;\n    return (PTR r)\n  }\"\n\n  subsubsection \\<open>Conversion Operations\\<close>\n  definition \"llb_trunc i w \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Trunc must go to smaller type'') (width i > w);\n    return (trunc w i)\n  }\"\n  \n  definition \"llb_sext i w \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Sext must go to greater type'') (width i < w);\n    return (sext w i)\n  }\"\n  \n  definition \"llb_zext i w \\<equiv> doM {\n    fcheck (STATIC_ERROR ''Zext must go to greater type'') (width i < w);\n    return (zext w i)\n  }\"\n  \n  definition op_lift_iconv :: \"_ \\<Rightarrow> _ \\<Rightarrow> 'a::len word \\<Rightarrow> 'b::len word itself  \\<Rightarrow> 'b word llM\"\n    where \"op_lift_iconv n f a _ \\<equiv> doM {\n    consume (cost n 1);\n    let a = word_to_lint a;\n    let w = LENGTH('b);\n    r \\<leftarrow> f a w;\n    return (lint_to_word r)\n  }\"\n  \n  definition \"ll_trunc \\<equiv> op_lift_iconv ''trunc'' llb_trunc\"\n  definition \"ll_sext \\<equiv> op_lift_iconv ''sext'' llb_sext\"\n  definition \"ll_zext \\<equiv> op_lift_iconv ''zext'' llb_zext\"\n  \n    \n        \n        \n  subsection \\<open>Control Flow\\<close>  \n\n  text \\<open>Our shallow embedding uses a structured control flow, which allows\n    only sequential composition, if-then-else, and function calls.\n    \n    The code generator then maps sequential composition to basic blocks, \n    and if-then-else to a control flow graph with conditional branching.\n    Function calls are mapped to LLVM function calls.  \n   \\<close>\n  \n  text \\<open>We use the to Boolean conversion from word-lib. We re-state its semantics here.\\<close>\n    \n  lemma to_bool_as_lint_to_bool:\n    \"to_bool (w::1 word) = lint_to_bool (word_to_lint w)\"\n    unfolding to_bool_def word_to_lint_def\n    apply (clarsimp simp: ltrue_def lfalse_def lint_to_bool_def)\n    apply transfer\n    apply auto\n    by (metis bin_rest_BIT bin_rest_x2)\n  \n  lemma to_bool_eq[simp]: \"to_bool (w::1 word) \\<longleftrightarrow> w\\<noteq>0\"\n    by (rule to_bool_neq_0)\n  \n  definition llc_if :: \"1 word \\<Rightarrow> 'a::llvm_repv llM \\<Rightarrow> 'a llM \\<Rightarrow> 'a llM\" where\n    \"llc_if b t e \\<equiv> doM {\n      consume (cost ''if'' 1);\n      if to_bool b then t else e\n    }\"\n  \n  lemma llc_if_mono[partial_function_mono]:      \n    \"\\<lbrakk>M_mono F; M_mono G\\<rbrakk> \\<Longrightarrow> M_mono (\\<lambda>f. llc_if b (F f) (G f))\"\n    unfolding llc_if_def \n    by pf_mono_prover  \n\n  subsubsection \\<open>Function Call\\<close>\n\n  definition ll_call :: \"'a llM \\<Rightarrow> 'a llM\" where \n    \"ll_call f \\<equiv> doM { consume (cost ''call'' 1) ; f  }\"\n\n  lemma ll_call_mono[partial_function_mono]: \"M_mono f \\<Longrightarrow> M_mono (\\<lambda>x. ll_call (f x))\"\n    unfolding ll_call_def\n    by pf_mono_prover\n  \n  subsubsection \\<open>Recursion with Time for Call\\<close>  \n    \n  definition \"REC' F x = REC (\\<lambda>D x. F (\\<lambda>x. ll_call (D x)) x) x\"\n  \n  lemma REC'_unfold:\n    assumes DEF: \"f \\<equiv> REC' F\"\n    assumes MONO: \"\\<And>x. M.mono_body (\\<lambda>fa. F (\\<lambda>x. ll_call (fa x)) x)\"\n    shows \"f = F (\\<lambda>x. ll_call (f x))\" \n    unfolding DEF REC'_def\n    apply (rewrite REC_unfold[OF reflexive MONO])\n    by rule\n    \n  lemma REC'_mono[partial_function_mono]:\n    assumes MONO: \"\\<And>D x. M.mono_body (\\<lambda>E. B D (\\<lambda>x. ll_call (E x)) x)\"\n    assumes 1: \"\\<And>E x. M_mono (\\<lambda>D. B D (\\<lambda>x. ll_call (E x)) x)\"\n    shows \"M_mono (\\<lambda>D. REC' (B D) x)\"\n    unfolding REC'_def\n    using assms\n    by pf_mono_prover\n    \n    \n  \n  notepad  (* TODO: cleanup *)\n  begin\n    \\<^cancel>\\<open>\n  \n    assume MONO: \"\\<And>x. M.mono_body (\\<lambda>fa. F (\\<lambda>x. ll_call (fa x)) x)\"\n    \n      and DEF: \"f \\<equiv> REC' F\"\n      and F: \" F  \\<equiv> \\<lambda>D x. (if x>0 then D (x-1) else return 0 )\"\n    have \"P (ll_call (f x))\"\n      apply(rewrite REC'_unfold[OF DEF MONO])\n      apply(rewrite REC'_unfold[OF DEF MONO])\n      apply(rewrite REC'_unfold[OF DEF MONO])\n      apply(rewrite REC'_unfold[OF DEF MONO])\n      unfolding F ll_call_def sorry\n  \\<close>\n  end\n\n  subsubsection \\<open>While-Combinator\\<close>\n  text \\<open>\n    Note that we also include the while combinator at this point, as we direct translation \n    of while to a control flow graph is the default translation mode of the code generator. \n    \n    As an optional feature, while can be translated to \n    a tail recursive function call, which the preprocessor can do automatically.\n  \\<close>\n    \n  definition llc_while :: \"('a::llvm_repv \\<Rightarrow> 1 word llM) \\<Rightarrow> ('a \\<Rightarrow> 'a llM) \\<Rightarrow> 'a \\<Rightarrow> 'a llM\" where\n    \"llc_while b f s\\<^sub>0 \\<equiv> ll_call (REC' (\\<lambda>mwhile \\<sigma>. doM {\n              ctd \\<leftarrow> b \\<sigma>;\n              llc_if ctd (f \\<sigma> \\<bind> mwhile) (return \\<sigma>)\n            }) s\\<^sub>0)\" \n\n  (*          \n  lemma gen_code_thm_llc_while:\n    assumes \"f \\<equiv> llc_while b body\"\n    shows \"f s = ll_call (doM { ctd \\<leftarrow> b s; llc_if ctd (doM { s\\<leftarrow>body s; f s}) (return s)})\"\n    unfolding assms\n    unfolding llc_while_def llc_if_def\n    apply (rewrite REC'_unfold[OF reflexive])\n    apply pf_mono_prover\n    by simp\n  *)\n\n  (* 'Definition' of llc_while for presentation in paper: *)  \n  lemma \"\\<And>c. llc_while b c s \\<equiv> ll_call (doM {\n     x \\<leftarrow> b s;\n     llc_if x (doM {s\\<leftarrow>c s; llc_while b c s}) (return s)\n   })\"\n    unfolding llc_while_def llc_if_def\n    apply (rewrite REC'_unfold[OF reflexive])\n    apply pf_mono_prover\n    by simp\n    \n   \n  lemma llc_while_mono[partial_function_mono]:      \n    assumes \"\\<And>x. M_mono (\\<lambda>f. b f x)\"\n    assumes \"\\<And>x. M_mono (\\<lambda>f. c f x)\"\n    shows \"M_mono (\\<lambda>D. llc_while (b D) (c D) \\<sigma>)\"\n    using assms unfolding llc_while_def by pf_mono_prover\n      \n    \n       \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm_time", "sha": "42dd7f59998d76047bb4b6bce76d8f67b53a08b6", "save_path": "github-repos/isabelle/lammich-isabelle_llvm_time", "path": "github-repos/isabelle/lammich-isabelle_llvm_time/isabelle_llvm_time-42dd7f59998d76047bb4b6bce76d8f67b53a08b6/thys/basic/kernel/LLVM_Shallow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.32679493745252}}
{"text": "theory Normalized_Zone_Semantics_Certification2\n  imports TA_Impl.Normalized_Zone_Semantics_Impl_Semantic_Refinement Labeled_Graphs\nbegin\n\ntext \\<open>Notes:\n\\<^item> We already have two variants of this theory\n  \\<^theory>\\<open>TA_Impl.Normalized_Zone_Semantics_Impl_Semantic_Refinement\\<close>,\n  and \\<open>Certification.Normalized_Zone_Semantics_Impl_Semantic_Refinement\\<close>\n\\<^item> They gradually refine the same techniques and theorems because we need to implement finer steps\n\\<^item> The latter could definitely be derived from this theory by proving theorems for coupled steps\n\\<^item> The first adds normalization in the last step. Could this be another coupling step?\n\\<^item> \\<open>E_combined_op\\<close> is what is \\<open>E_precise_op\\<close> in\n  \\<open>Certification.Normalized_Zone_Semantics_Impl_Semantic_Refinement\\<close>\n\\<close>\n\nno_notation TA_Start_Defs.step_impl' (\"\\<langle>_, _\\<rangle> \\<leadsto>\\<^bsub>_\\<^esub> \\<langle>_, _\\<rangle>\" [61,61,61] 61)\n\ncontext TA_Start_Defs\nbegin\n\ndefinition\n  \"E_del_op l M \\<equiv>\n    FW' (abstr_upd (inv_of A l) (up_canonical_upd M n)) n\"\n\ndefinition\n  \"E_del_op' l M \\<equiv>\n    abstr_repair (inv_of A l) (up_canonical_upd M n)\"\n\ndefinition\n  \"E_act_op l r g l' M \\<equiv>\n    FW' (abstr_upd (inv_of A l') (reset'_upd (FW' (abstr_upd g M) n) n r 0)) n\"\n\ndefinition\n  \"E_act_op' l r g l' M \\<equiv>\n    let\n      M1 = filter_diag (\\<lambda> M. abstr_repair g M) M;\n      M2 = filter_diag (\\<lambda> M. abstr_repair (inv_of A l') (reset'_upd M n r 0)) M1\n    in M2\"\n\ndefinition\n  \"E_combined_op l r g l' M \\<equiv>\n    let\n      M' = FW' (abstr_upd (inv_of A l) (up_canonical_upd M n)) n;\n      M'' = FW' (abstr_upd (inv_of A l') (reset'_upd (FW' (abstr_upd g M') n) n r 0)) n\n    in M''\"\n\nlemma E_combined_op_decomp:\n  \"E_combined_op l r g l' M \\<equiv>\n    let\n      M' = E_del_op l M;\n      M'' = E_act_op l r g l' M'\n    in M''\"\n  unfolding E_combined_op_def E_del_op_def E_act_op_def .\n\ndefinition\n  \"E_combined_op' l r g l' M \\<equiv>\n    let\n      M1 = abstr_repair (inv_of A l) (up_canonical_upd M n);\n      M2 = filter_diag (\\<lambda> M. abstr_repair g M) M1;\n      M3 = filter_diag (\\<lambda> M. abstr_repair (inv_of A l') (reset'_upd M n r 0)) M2\n    in M3\"\n\nlemma E_combined_op'_alt_def:\n  \"E_combined_op' l r g l' M \\<equiv>\n    let\n      M' = abstr_repair (inv_of A l) (up_canonical_upd M n);\n      f1 = \\<lambda> M. abstr_repair g M;\n      f2 = \\<lambda> M. abstr_repair (inv_of A l') (reset'_upd M n r 0)\n    in filter_diag (filter_diag f2 o f1) M'\"\n  unfolding E_combined_op'_def filter_diag_def\n  by (rule HOL.eq_reflection) (auto simp: Let_def check_diag_marker)\n\nlemma E_combined_op'_decomp:\n  \"E_combined_op' l r g l' M \\<equiv>\n    let\n      M' = E_del_op' l M;\n      M'' = E_act_op' l r g l' M'\n    in M''\"\n  unfolding E_combined_op'_def E_del_op'_def E_act_op'_def unfolding Let_def .\n\nno_notation step_impl' (\"\\<langle>_, _\\<rangle> \\<leadsto>\\<^bsub>_\\<^esub> \\<langle>_, _\\<rangle>\" [61,61,61] 61)\n\nabbreviation step_impl_precise' (\"\\<langle>_, _\\<rangle> \\<leadsto>\\<^bsub>_\\<^esub> \\<langle>_, _\\<rangle>\" [61,61,61] 61)\nwhere\n  \"\\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>a\\<^esub> \\<langle>l'', Z''\\<rangle> \\<equiv> \\<exists> l' Z'.\n    A \\<turnstile>\\<^sub>I \\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>n,\\<tau>\\<^esub> \\<langle>l', Z'\\<rangle> \\<and> A \\<turnstile>\\<^sub>I \\<langle>l', Z'\\<rangle> \\<leadsto>\\<^bsub>n,\\<upharpoonleft>a\\<^esub> \\<langle>l'', Z''\\<rangle>\"\n\n(* sublocale Graph_Defs \"\\<lambda> (l, u) (l', u'). conv_A A \\<turnstile>' \\<langle>l, u\\<rangle> \\<rightarrow> \\<langle>l', u'\\<rangle>\" . *)\n\ndefinition \"E_combined \\<equiv> (\\<lambda>(l, Z) (l'', Z''). \\<exists>a. \\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>a\\<^esub> \\<langle>l'', Z''\\<rangle>)\"\n\ndefinition \"E_precise \\<equiv> (\\<lambda>(l, Z) a (l', Z'). A \\<turnstile>\\<^sub>I \\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>n,a\\<^esub> \\<langle>l', Z'\\<rangle>)\"\n\nend\n\nlemma (in TA_Start) E_precise_equiv:\n  \"\\<exists> b'. E_precise b action b' \\<and> a' \\<sim> b'\"\n  if \"E_precise a action a'\" \"a \\<sim> b\" \"wf_state a\" \"wf_state b\"\n  using that\n  unfolding wf_state_def E_precise_def\n  apply safe\n  apply (frule step_impl_equiv, assumption, assumption, rule state_equiv_D, assumption)\n  by (safe, drule step_impl_equiv, auto intro: step_impl_wf_dbm simp: state_equiv_def)\n\n\nlocale E_From_Op_Defs = TA_Start_Defs _ l\\<^sub>0 for l\\<^sub>0 :: \"'s\" +\n  fixes del :: \"'s \\<Rightarrow> (nat \\<times> nat \\<Rightarrow> int DBMEntry) \\<Rightarrow> nat \\<times> nat \\<Rightarrow> int DBMEntry\"\n  fixes act :: \"'s\n   \\<Rightarrow> nat list\n      \\<Rightarrow> (nat, int) acconstraint list\n         \\<Rightarrow> 's\n            \\<Rightarrow> (nat \\<times> nat \\<Rightarrow> int DBMEntry)\n               \\<Rightarrow> nat \\<times> nat \\<Rightarrow> int DBMEntry\"\nbegin\n\ndefinition \"E_from_op = (\\<lambda> (l, M) a (l', M'). case a of\n  \\<tau> \\<Rightarrow> l' = l \\<and> M' = del l M\n  | \\<upharpoonleft>a \\<Rightarrow> \\<exists> g r. A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l' \\<and> M' = act l r g l' M)\"\n\nend\n\n\nlocale E_From_Op = TA_Start + E_From_Op_Defs\n\nlocale E_Precise_Bisim = E_From_Op +\n  assumes del_bisim:\n    \"wf_dbm M \\<Longrightarrow> del l M \\<simeq> E_del_op l M\"\n    and act_bisim:\n    \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l' \\<Longrightarrow> wf_dbm M \\<Longrightarrow> act l r g l' M \\<simeq> E_act_op l r g l' M\"\n    and del_wf:\n    \"wf_dbm M \\<Longrightarrow> wf_dbm (del l M)\"\n    and act_wf:\n    \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l' \\<Longrightarrow> wf_dbm M \\<Longrightarrow> wf_dbm (act l r g l' M)\"\nbegin\n\nlemma step_impl_E_del_op:\n  \"A \\<turnstile>\\<^sub>I \\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>n,\\<tau>\\<^esub> \\<langle>l', Z'\\<rangle> \\<longleftrightarrow> l' = l \\<and> Z' = E_del_op l Z\"\n  unfolding E_del_op_def by (auto elim!: step_impl.cases)\n\nlemma step_impl_E_act_op:\n  \"A \\<turnstile>\\<^sub>I \\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>n,\\<upharpoonleft>a\\<^esub> \\<langle>l', Z'\\<rangle> \\<longleftrightarrow> (\\<exists>g r. A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l' \\<and> Z' = E_act_op l r g l' Z)\"\n  unfolding E_act_op_def by (auto elim!: step_impl.cases)\n\nterm \"valid_dbm (curry (conv_M D))\" term \"dbm_int M n\"\nterm E_From_Op_Defs.E_from_op\nthm E_From_Op_Defs.E_from_op_def\n\\<^cancel>\\<open>definition\n  \"E_precise_op = E_From_Op_Defs.E_from_op A E_del_op E_act_op\"\\<close>\n\nlemma E_precise_alt_def:\n  \"E_precise = E_From_Op_Defs.E_from_op A E_del_op E_act_op\"\n  unfolding E_precise_def E_From_Op_Defs.E_from_op_def\n  by (intro ext)\n     (auto split: prod.splits action.split simp: simp: step_impl_E_del_op step_impl_E_act_op)\n\n\\<^cancel>\\<open>lemma E_precise_E_op:\n  \"E_precise = (\\<lambda>(l, M) a (l', M'''). \\<exists>g a r. A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l' \\<and> M''' = E_from_op l r g l' M)\"\n  unfolding E_precise_op_def E_precise_def by (intro ext) (auto elim!: step_impl.cases)\n\\<close>\n\\<^cancel>\\<open>lemma E_precise_E_op:\n  \"E_precise = (\\<lambda>(l, M) (l', M'''). \\<exists>g a r. A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l' \\<and> M''' = E_precise_op l r g l' M)\"\n  unfolding E_precise_op_def E_precise_def by (intro ext) (auto elim!: step_impl.cases)\\<close>\n\nlemma E_E_from_op_step:\n  \"\\<exists>c. E_from_op a action c \\<and> b \\<sim> c\" if \"E_precise a action b\" \"wf_state a\"\n  using that unfolding E_precise_alt_def E_From_Op_Defs.E_from_op_def wf_state_def state_equiv_def\n  by (cases action) (auto 4 4 intro!: del_bisim[THEN dbm_equiv_sym] act_bisim[THEN dbm_equiv_sym])\n\nlemma E_from_op_E_step:\n  \"\\<exists>c. E_precise a action c \\<and> b \\<sim> c\" if \"E_from_op a action b\" \"wf_state a\"\n  using that unfolding E_precise_alt_def E_From_Op_Defs.E_from_op_def wf_state_def state_equiv_def\n  by (cases action) (auto 4 4 intro!: del_bisim act_bisim)\n\nlemma E_from_op_wf_state:\n  \"wf_state b\" if \"wf_state a\" \"E_from_op a action b\"\n  using that unfolding E_E_op E_from_op_def wf_state_def state_equiv_def\n  by (cases action) (auto 4 4 intro: del_wf act_wf)\n\nlemma E_precise_wf_dbm[intro]:\n  \"wf_dbm D'\" if \"E_precise (l, D) action (l', D')\" \"wf_dbm D\"\n  using that unfolding wf_state_def E_def E_precise_def by (auto intro: step_impl_wf_dbm)\n\nlemma E_precise_wf_state:\n  \"wf_state a \\<Longrightarrow> E_precise a action b \\<Longrightarrow> wf_state b\"\n  unfolding wf_state_def by auto\n\nlemma E_from_op_bisim:\n  \"Bisimulation_Invariant E_precise E_from_op (\\<sim>) wf_state wf_state\"\n  apply standard\n  subgoal for action a b a'\n    by (drule E_precise_equiv, assumption+) (auto dest!: E_E_from_op_step)\n  subgoal\n    by (drule (1) E_from_op_E_step, safe, drule E_precise_equiv) (auto 4 4 intro: state_equiv_sym)\n   apply (rule E_precise_wf_state; assumption)\n  apply (rule E_from_op_wf_state; assumption)\n  done\n\n(* lemma E_E_from_op_steps_empty:\n  \"(\\<exists>l' M'. E_precise\\<^sup>*\\<^sup>* a\\<^sub>0 (l', M') \\<and> [curry (conv_M M')]\\<^bsub>v,n\\<^esub> = {}) \\<longleftrightarrow>\n   (\\<exists>l' M'. E_from_op\\<^sup>*\\<^sup>* a\\<^sub>0 (l', M') \\<and> [curry (conv_M M')]\\<^bsub>v,n\\<^esub> = {})\"\n  by (rule E_E\\<^sub>1_steps_empty[OF E_E_from_op_step E_from_op_E_step E_from_op_wf_state]) *)\n\n\\<^cancel>\\<open>theorem E_from_op_reachability_check:\n  \"(\\<exists> l' D'. E_precise\\<^sup>*\\<^sup>* a\\<^sub>0 (l', D') \\<and> F_rel (l', D'))\n  \\<longleftrightarrow> (\\<exists> l' D'. E_from_op\\<^sup>*\\<^sup>* a\\<^sub>0 (l', D') \\<and> F_rel (l', D'))\"\n  oops\\<close>\n(*   apply (rule E_E\\<^sub>1_steps_equiv[OF E_E_from_op_step E_from_op_E_step E_from_op_wf_state])\n  by\n    (auto\n      simp: F_rel_def state_equiv_def wf_state_def dbm_equiv_def\n      dest!:\n        check_diag_empty_spec[OF check_diag_conv_M]\n        canonical_check_diag_empty_iff[OF wf_dbm_altD(1)]\n    ) *)\n\n\\<^cancel>\\<open>lemma E_from_op_mono:\n  assumes \"E_from_op (l,D) (l',D')\"\n    and   \"wf_dbm D\" \"wf_dbm M\"\n    and \"[curry (conv_M D)]\\<^bsub>v,n\\<^esub> \\<subseteq> [curry (conv_M M)]\\<^bsub>v,n\\<^esub>\"\n  shows \"\\<exists> M'. E_from_op (l,M) (l',M') \\<and> [curry (conv_M D')]\\<^bsub>v,n\\<^esub> \\<subseteq> [curry (conv_M M')]\\<^bsub>v,n\\<^esub>\"\n  (* using assms by - (rule E\\<^sub>1_mono[OF E_E_from_op_step E_from_op_E_step E_from_op_wf_state]; blast) *)\n  oops\n\nlemma E_from_op_mono':\n  assumes \"E_from_op (l,D) (l',D')\"\n    and   \"wf_dbm D\" \"wf_dbm M\"\n    and \"dbm_subset n D M\"\n  shows \"\\<exists> M'. E_from_op (l,M) (l',M') \\<and> dbm_subset n D' M'\"\n  (* using assms by - (rule E\\<^sub>1_mono'[OF E_E_from_op_step E_from_op_E_step E_from_op_wf_state]; blast) *)\n  oops\n\n  thm E_E_from_op_step E_from_op_E_step E_from_op_wf_state\n\nlemma E_equiv:\n  \"\\<exists> b'. E_precise b b' \\<and> a' \\<sim> b'\" if \"E_precise a a'\" \"a \\<sim> b\" \"wf_state a\" \"wf_state b\"\n  using that\n  unfolding wf_state_def E_precise_def\n  apply safe\n  apply (frule step_impl_equiv, assumption, assumption, rule state_equiv_D, assumption)\n  by (safe, drule step_impl_equiv, auto intro: step_impl_wf_dbm simp: state_equiv_def)\n\nlemma E_from_op_bisim:\n  \"Bisimulation_Invariant E_precise E_from_op (\\<sim>) wf_state wf_state\"\n  apply standard\n  subgoal\n    by (drule E_equiv, assumption+) (auto dest!: E_E_from_op_step)\n  subgoal\n    by (drule (1) E_from_op_E_step, safe, drule E_equiv) (auto 4 4 intro: state_equiv_sym)\n   apply (rule E_precise_wf_state; assumption)\n  apply (rule E_from_op_wf_state; assumption)\n  done\\<close>\n\nlemma E_from_op_bisim_empty:\n  \"Bisimulation_Invariant\n    (\\<lambda>(l, M) action (l', M'). E_precise (l, M) action (l', M') \\<and> \\<not> check_diag n M')\n    (\\<lambda>(l, M) action (l', M'). E_from_op (l, M) action (l', M') \\<and> \\<not> check_diag n M')\n    (\\<sim>) wf_state wf_state\"\n  using E_from_op_bisim\n  apply (rule Bisimulation_Invariant_filter[\n        where FA = \"\\<lambda>(l, M). \\<not> check_diag n M\" and FB = \"\\<lambda>(l, M). \\<not> check_diag n M\"\n        ])\n  subgoal\n    unfolding wf_state_def state_equiv_def\n    apply clarsimp\n    apply (subst canonical_check_diag_empty_iff[symmetric], erule wf_dbm_altD(1))\n    apply (subst canonical_check_diag_empty_iff[symmetric], erule wf_dbm_altD(1))\n    apply (simp add: dbm_equiv_def)\n    done\n   apply (auto; fail)+\n  done\n\nend (* End of context for bisimilarity *)\n\n\ncontext TA_Start\nbegin\n\nlemma\n  assumes \"A \\<turnstile> l \\<longrightarrow>\\<^bsup>g,a,r\\<^esup> l'\" \"wf_dbm M\"\n  shows E_act_op'_bisim: \"E_act_op' l r g l' M \\<simeq> E_act_op l r g l' M\" (is ?bisim)\n  and E_act_op'_wf: \"wf_dbm (E_act_op' l r g l' M)\" (is ?wf)\nproof -\n  note intros =\n    dbm_equiv_refl dbm_equiv_trans[OF filter_diag_equiv, rotated]\n    wf_dbm_abstr_repair_equiv_FW[rotated] reset'_upd_equiv\n  have\n    \"\\<forall>c\\<in>constraint_clk ` set (inv_of A l'). 0 < c \\<and> c \\<le> n\"\n    \"\\<forall>c\\<in>constraint_clk ` set (inv_of A l'). 0 < c\"\n    using clock_range collect_clks_inv_clk_set[of A l'] unfolding collect_clks_def by blast+\n  moreover have \"\\<forall>c\\<in>constraint_clk ` set g. 0 < c \\<and> c \\<le> n\" \"\\<forall>c\\<in>constraint_clk ` set g. 0 < c\"\n    using clock_range collect_clocks_clk_set[OF assms(1)] unfolding collect_clks_def by blast+\n  moreover have \"\\<forall>i\\<in>set r. 0 < i \\<and> i \\<le> n\" \"\\<forall>i\\<in>set r. 0 < i\"\n    using clock_range reset_clk_set[OF assms(1)] unfolding collect_clks_def by blast+\n  moreover note side_conds = calculation assms(2)\n  note wf_intros =\n    wf_dbm_abstr_repair wf_dbm_reset'_upd filter_diag_wf_dbm wf_dbm_FW'_abstr_upd\n  note check_diag_intros =\n    reset'_upd_check_diag_preservation abstr_repair_check_diag_preservation\n  show ?bisim unfolding E_act_op'_def E_act_op_def\n    by simp (intro intros check_diag_intros side_conds wf_intros order.refl)\n  show ?wf\n    unfolding E_act_op'_def by simp (intro wf_intros side_conds order.refl)\nqed\n\nlemma\n  assumes \"wf_dbm M\"\n  shows E_del_op'_bisim: \"E_del_op' l M \\<simeq> E_del_op l M\" (is ?bisim)\n    and E_del_op'_wf: \"wf_dbm (E_del_op' l M)\" (is ?wf)\nproof -\n  note intros =\n    dbm_equiv_refl wf_dbm_abstr_repair_equiv_FW[rotated]\n  note wf_intros =\n    wf_dbm_abstr_repair wf_dbm_up_canonical_upd filter_diag_wf_dbm\n  note check_diag_intros =\n    abstr_repair_check_diag_preservation\n  have side_conds: \"\\<forall>c\\<in>constraint_clk ` set (inv_of A l). 0 < c \\<and> c \\<le> n\"\n    using clock_range collect_clks_inv_clk_set[of A l] unfolding collect_clks_def by blast\n  show ?bisim and ?wf unfolding E_del_op'_def E_del_op_def\n    by (intro intros check_diag_intros side_conds wf_intros order.refl assms)+\nqed\n\nlemma step_z_step_z_dbm_equiv:\n  \"Bisimulation_Invariant\n     (\\<lambda> (l, D) a (l', D'). step_z (conv_A A) l D a l' D')\n     (\\<lambda> (l, D) a (l', D'). step_z_dbm (conv_A A) l D v n a l' D')\n     (\\<lambda>(l, Z) (l', M). l = l' \\<and> [M]\\<^bsub>v,n\\<^esub> = Z)\n     (\\<lambda>(l, Z). True)\n     (\\<lambda>(l, y). True)\"\n  by (standard; fastforce elim: step_z_dbm_DBM intro: step_z_dbm_sound)\n\nlemma step_z_dbm_step_impl_precise_equiv:\n  \"Bisimulation_Invariant\n     (\\<lambda> (l, D) a (l', D'). step_z_dbm (conv_A A) l D v n a l' D')\n     E_precise\n     (\\<lambda>(l, M) (l', D). l = l' \\<and> [curry (conv_M D)]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>)\n     (\\<lambda>(l, y). valid_dbm y)\n     wf_state\"\n  unfolding E_precise_def\nproof (standard, goal_cases)\n  case prems: (1 a b a')\n  then show ?case\n    using step_impl_complete''_improved by (auto dest: step_z_dbm_equiv' simp: wf_state_def)\nnext\n  case prems: (2 a a' b')\n  then show ?case\n    by clarsimp\n       (drule step_impl_sound', auto 4 3 dest: step_z_dbm_equiv' simp add: wf_state_def wf_dbm_def)\nnext\n  case (3 a b)\n  then show ?case\n    using step_z_norm_valid_dbm'_spec step_z_valid_dbm' by auto\nnext\n  case (4 a b)\n  then show ?case\n    by (clarsimp simp: norm_step_wf_dbm step_impl_wf_dbm wf_state_def)\nqed\n\nsublocale E_precise_op': E_Precise_Bisim _ _ _ _ E_del_op' E_act_op'\n  by standard\n     (rule E_del_op'_bisim E_act_op'_bisim E_del_op'_wf E_act_op'_wf; assumption)+\n\nlemma step_z_dbm_final_bisim:\n  \"Bisimulation_Invariant\n     (\\<lambda> (l, D) a (l', D'). step_z_dbm (conv_A A) l D v n a l' D')\n     E_precise_op'.E_from_op\n     (\\<lambda> (l, M) (l', D'). l' = l \\<and> [curry (conv_M D')]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>)\n     (\\<lambda>(l, y). valid_dbm y) wf_state\"\n  by (rule Bisimulation_Invariant_sim_replace,\n      rule Bisimulation_Invariant_composition[\n        OF step_z_dbm_step_impl_precise_equiv[folded E_precise_def] E_precise_op'.E_from_op_bisim\n      ]) (auto simp add: state_equiv_def dbm_equiv_def)\n\nend (* TA Start *)\n\ncontext E_Precise_Bisim\nbegin\n\ninterpretation\n  Bisimulation_Invariant\n  \"(\\<lambda> (l, D) a (l', D'). conv_A A \\<turnstile> \\<langle>l, D\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', D'\\<rangle>)\"\n  E_from_op\n  \"\\<lambda> (l, M) (l', D'). l' = l \\<and> [curry (conv_M D')]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>\"\n  \"\\<lambda>(l, y). valid_dbm y\"\n  wf_state\n  by (rule Bisimulation_Invariant_sim_replace,\n      rule Bisimulation_Invariant_composition[\n        OF step_z_dbm_step_impl_precise_equiv[folded E_precise_def] E_from_op_bisim\n      ]) (auto simp add: state_equiv_def dbm_equiv_def)\n\nlemmas step_z_dbm'_E_from_op_bisim = Bisimulation_Invariant_axioms\n\ndefinition\n  \"E_from_op_empty \\<equiv> \\<lambda>(l, D) a (l', D'). E_from_op (l, D) a (l', D') \\<and> \\<not> check_diag n D'\"\n\ninterpretation bisim_empty:\n  Bisimulation_Invariant\n  \"\\<lambda>(l, M) a (l', M'). conv_A A \\<turnstile> \\<langle>l, M\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', M'\\<rangle> \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n  \"\\<lambda>(l, D) a (l', D'). E_from_op (l, D) a (l', D') \\<and> \\<not> check_diag n D'\"\n  \"\\<lambda>(l, M) (l', D'). l' = l \\<and> [curry (conv_M D')]\\<^bsub>v,n\\<^esub> = [M]\\<^bsub>v,n\\<^esub>\"\n  \"\\<lambda>(l, y). valid_dbm y\"\n  wf_state\n  using step_z_dbm'_E_from_op_bisim apply (rule Bisimulation_Invariant_filter[\n        where FA = \"\\<lambda>(l', M'). [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\" and FB = \"\\<lambda>(l', D'). \\<not> check_diag n D'\"\n        ])\n  using canonical_check_diag_empty_iff canonical_empty_check_diag' by (auto simp: wf_state_def)\n\nlemmas step_z_dbm_E_from_op_bisim_empty =\n  bisim_empty.Bisimulation_Invariant_axioms[folded E_from_op_empty_def]\n\nlemma E_from_op_mono:\n  assumes \"E_from_op (l,D) a (l',D')\"\n    and   \"wf_dbm D\" \"wf_dbm M\"\n    and \"[curry (conv_M D)]\\<^bsub>v,n\\<^esub> \\<subseteq> [curry (conv_M M)]\\<^bsub>v,n\\<^esub>\"\n  shows \"\\<exists> M'. E_from_op (l,M) a (l',M') \\<and> [curry (conv_M D')]\\<^bsub>v,n\\<^esub> \\<subseteq> [curry (conv_M M')]\\<^bsub>v,n\\<^esub>\"\nproof -\n  from B_A_step[OF assms(1), of \"(l, curry (conv_M D))\"] assms(2) obtain D1 where D1:\n    \"conv_A A \\<turnstile> \\<langle>l, curry (conv_M D)\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', D1\\<rangle>\" \"[D1]\\<^bsub>v,n\\<^esub> = [curry (conv_M D')]\\<^bsub>v,n\\<^esub>\"\n    unfolding wf_state_def by (auto dest!: wf_dbm_D)\n  from step_z_dbm_mono[OF this(1) assms(4)] obtain M1 where M1:\n    \"conv_A A \\<turnstile> \\<langle>l, curry (conv_M M)\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', M1\\<rangle>\"\n    \"[D1]\\<^bsub>v,n\\<^esub> \\<subseteq> [M1]\\<^bsub>v,n\\<^esub>\"\n    by atomize_elim\n  with A_B_step[of \"(l, curry (conv_M M))\" a \"(l', M1)\" \"(l, M)\"] assms(3) obtain M2 where\n    \"E_from_op (l, M) a (l', M2)\" \"[curry (conv_M M2)]\\<^bsub>v,n\\<^esub> = [M1]\\<^bsub>v,n\\<^esub>\"\n    unfolding wf_state_def by (force dest: wf_dbm_D)\n  with assms(3) M1(2) D1(2) show ?thesis\n    by auto\nqed\n\n(* XXX Duplication (E_mono') *)\nlemma E_from_op_mono':\n  assumes \"E_from_op (l,D) a (l',D')\"\n    and   \"wf_dbm D\" \"wf_dbm M\"\n    and \"dbm_subset n D M\"\n  shows \"\\<exists> M'. E_from_op (l,M) a (l',M') \\<and> dbm_subset n D' M'\"\n  using assms\n  apply -\n  apply (frule E_from_op_mono[where M = M], assumption+)\n   apply (subst dbm_subset_correct'', assumption+)\n   apply (rule dbm_subset_conv, assumption)\n  apply safe\n  apply (subst (asm) dbm_subset_correct'')\n  subgoal\n    using B_invariant[unfolded wf_state_def] by auto\n  subgoal\n    using B_invariant[unfolded wf_state_def] by auto\n  apply (blast intro: dbm_subset_conv_rev)\n  done\n\nlemma E_from_op_empty_mono':\n  assumes \"E_from_op_empty (l,D) a (l',D')\"\n    and   \"wf_dbm D\" \"wf_dbm M\"\n    and \"dbm_subset n D M\"\n  shows \"\\<exists> M'. E_from_op_empty (l,M) a (l',M') \\<and> dbm_subset n D' M'\"\n  using assms unfolding E_from_op_empty_def using check_diag_subset E_from_op_mono' by fast\n\ninterpretation B:\n    Bisimulation\n    \"\\<lambda> (l, Z) a (l', Z'). conv_A A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>a\\<^esub> \\<langle>l', Z'\\<rangle> \\<and> Z' \\<noteq> {}\"\n    \"\\<lambda> (l, M) a (l', M'). conv_A A \\<turnstile> \\<langle>l, M\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', M'\\<rangle> \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n    \"\\<lambda> (l, Z) (l', M). l' = l \\<and> Z = [M]\\<^bsub>v,n\\<^esub>\"\n    by (standard; force elim!: step_z_dbm_DBM step_z_dbm_sound)\n\ninterpretation B1:\n    Bisimulation_Invariant\n    \"\\<lambda> (l, Z) a (l', Z'). conv_A A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>a\\<^esub> \\<langle>l', Z'\\<rangle> \\<and> Z' \\<noteq> {}\"\n    \"\\<lambda> (l, M) a (l', M'). conv_A A \\<turnstile> \\<langle>l, M\\<rangle> \\<leadsto>\\<^bsub>v,n,a\\<^esub> \\<langle>l', M'\\<rangle> \\<and> [M']\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n    \"\\<lambda> (l, Z) (l', M). l' = l \\<and> Z = [M]\\<^bsub>v,n\\<^esub>\"\n    \"\\<lambda>_. True\"\n    \"\\<lambda>(l, M). valid_dbm M\"\n  by standard (auto 4 3 elim: step_z_dbm_DBM step_z_dbm_sound dest: step_z_valid_dbm')\n\ninterpretation bisim_empty_zone:\n  Bisimulation_Invariant\n  \"\\<lambda>(l, Z) a (l', Z'). conv_A A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^bsub>a\\<^esub> \\<langle>l', Z'\\<rangle> \\<and> Z' \\<noteq> {}\"\n  E_from_op_empty\n  \"\\<lambda>(l, Z) (l', D). l' = l \\<and> [curry (conv_M D)]\\<^bsub>v,n\\<^esub> = Z\"\n  \"\\<lambda>_. True\"\n  wf_state\n  apply (rule Bisimulation_Invariant_sim_replace)\n   apply (rule Bisimulation_Invariant_composition[rotated])\n    apply (rule step_z_dbm_E_from_op_bisim_empty)\n   apply (rule B1.Bisimulation_Invariant_axioms)\n  apply (auto simp: wf_state_def dest!: wf_dbm_D(3))\n  done\n\nlemmas step_z_E_from_op_bisim_empty =\n  bisim_empty_zone.Bisimulation_Invariant_axioms[folded E_from_op_empty_def]\n\nend (* E Precise Bisim *)\n\nend", "meta": {"author": "wimmers", "repo": "munta-games", "sha": "12da82b74f595c33278aeac82b58cbfbfd2fd6a3", "save_path": "github-repos/isabelle/wimmers-munta-games", "path": "github-repos/isabelle/wimmers-munta-games/munta-games-12da82b74f595c33278aeac82b58cbfbfd2fd6a3/Normalized_Zone_Semantics_Certification2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621764862150634, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.32679492892437656}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Peter Lammich <peter dot lammich at uni-muenster.de>\n    Maintainer:  Peter Lammich <peter dot lammich at uni-muenster.de>\n*)\n(*\n  Changes since submission on 2009-11-26:\n\n  2009-12-10: OrderedMap, algorithms for iterators, min, max, to_sorted_list\n\n*)\n\nsection \\<open>\\isaheader{Generic Algorithms for Maps}\\<close>\ntheory MapGA\nimports SetIteratorCollectionsGA\nbegin\n\ntext_raw \\<open>\\label{thy:MapGA}\\<close>\n\nrecord ('k,'v,'s) map_basic_ops =\n  bmap_op_\\<alpha> :: \"('k,'v,'s) map_\\<alpha>\"\n  bmap_op_invar :: \"('k,'v,'s) map_invar\"\n  bmap_op_empty :: \"('k,'v,'s) map_empty\"\n  bmap_op_lookup :: \"('k,'v,'s) map_lookup\"\n  bmap_op_update :: \"('k,'v,'s) map_update\"\n  bmap_op_update_dj :: \"('k,'v,'s) map_update_dj\"\n  bmap_op_delete :: \"('k,'v,'s) map_delete\"\n  bmap_op_list_it :: \"('k,'v,'s) map_list_it\"\n  \nrecord ('k,'v,'s) omap_basic_ops = \"('k,'v,'s) map_basic_ops\" +\n  bmap_op_ordered_list_it :: \"'s \\<Rightarrow> ('k,'v,('k\\<times>'v) list) map_iterator\"\n  bmap_op_rev_list_it :: \"'s \\<Rightarrow> ('k,'v,('k\\<times>'v) list) map_iterator\"\n\nlocale StdBasicMapDefs = \n  poly_map_iteratei_defs \"bmap_op_list_it ops\" \n  for ops :: \"('k,'v,'s,'more) map_basic_ops_scheme\"\nbegin\n  abbreviation \\<alpha> where \"\\<alpha> == bmap_op_\\<alpha> ops\" \n  abbreviation invar where \"invar == bmap_op_invar ops\" \n  abbreviation empty where \"empty == bmap_op_empty ops\" \n  abbreviation lookup where \"lookup == bmap_op_lookup ops\" \n  abbreviation update where \"update == bmap_op_update ops\" \n  abbreviation update_dj where \"update_dj == bmap_op_update_dj ops\" \n  abbreviation delete where \"delete == bmap_op_delete ops\" \n  abbreviation list_it where \"list_it == bmap_op_list_it ops\" \nend\n\nlocale StdBasicOMapDefs = StdBasicMapDefs ops\n  + poly_map_iterateoi_defs \"bmap_op_ordered_list_it ops\"\n  + poly_map_rev_iterateoi_defs \"bmap_op_rev_list_it ops\"\n  for ops :: \"('k::linorder,'v,'s,'more) omap_basic_ops_scheme\"\nbegin\n  abbreviation ordered_list_it where \"ordered_list_it \n    \\<equiv> bmap_op_ordered_list_it ops\"\n  abbreviation rev_list_it where \"rev_list_it \n    \\<equiv> bmap_op_rev_list_it ops\"\nend\n\nlocale StdBasicMap = StdBasicMapDefs ops +\n  map \\<alpha> invar +\n  map_empty \\<alpha> invar empty +\n  map_lookup \\<alpha> invar lookup  +\n  map_update \\<alpha> invar update  +\n  map_update_dj \\<alpha> invar update_dj +\n  map_delete \\<alpha> invar delete  +\n  poly_map_iteratei \\<alpha> invar list_it\n  for ops :: \"('k,'v,'s,'more) map_basic_ops_scheme\"\nbegin\n  lemmas correct[simp] = empty_correct lookup_correct update_correct \n    update_dj_correct delete_correct\nend\n\n\nlocale StdBasicOMap = \n  StdBasicOMapDefs ops +\n  StdBasicMap ops +\n  poly_map_iterateoi \\<alpha> invar ordered_list_it +\n  poly_map_rev_iterateoi \\<alpha> invar rev_list_it\n  for ops :: \"('k::linorder,'v,'s,'more) omap_basic_ops_scheme\"\nbegin\nend\n\ncontext StdBasicMapDefs begin\n  definition \"g_sng k v \\<equiv> update k v (empty ())\"\n  definition \"g_add m1 m2 \\<equiv> iterate m2 (\\<lambda>(k,v) \\<sigma>. update k v \\<sigma>) m1\"\n\n  definition \n    \"g_sel m P \\<equiv> \n      iteratei m (\\<lambda>\\<sigma>. \\<sigma> = None) (\\<lambda>x \\<sigma>. if P x then Some x else None) None\"\n\n  definition \"g_bex m P \\<equiv> iteratei m (\\<lambda>x. \\<not>x) (\\<lambda>kv \\<sigma>. P kv) False\"\n  definition \"g_ball m P \\<equiv> iteratei m id (\\<lambda>kv \\<sigma>. P kv) True\"\n\n  definition \"g_size m \\<equiv> iterate m (\\<lambda>_. Suc) (0::nat)\"\n  definition \"g_size_abort b m \\<equiv> iteratei m (\\<lambda>s. s<b) (\\<lambda>_. Suc) (0::nat)\"\n\n  definition \"g_isEmpty m \\<equiv> g_size_abort 1 m = 0\"\n  definition \"g_isSng m \\<equiv> g_size_abort 2 m = 1\"\n\n  definition \"g_to_list m \\<equiv> iterate m (#) []\"\n\n  definition \"g_list_to_map l \\<equiv> foldl (\\<lambda>m (k,v). update k v m) (empty ()) \n    (rev l)\"\n\n  definition \"g_add_dj m1 m2 \\<equiv> iterate m2 (\\<lambda>(k,v) \\<sigma>. update_dj k v \\<sigma>) m1\"\n\n  definition \"g_restrict P m \\<equiv> iterate m \n    (\\<lambda>(k,v) \\<sigma>. if P (k,v) then update_dj k v \\<sigma> else \\<sigma>) (empty ())\"\n\n  definition dflt_ops :: \"('k,'v,'s) map_ops\" \n    where [icf_rec_def]:\n    \"dflt_ops \\<equiv> \n      \\<lparr> \n        map_op_\\<alpha> = \\<alpha>,\n        map_op_invar = invar,\n        map_op_empty = empty,\n        map_op_lookup = lookup,\n        map_op_update = update,\n        map_op_update_dj = update_dj,\n        map_op_delete = delete,\n        map_op_list_it = list_it,\n        map_op_sng = g_sng,\n        map_op_restrict = g_restrict, \n        map_op_add = g_add, \n        map_op_add_dj = g_add_dj, \n        map_op_isEmpty = g_isEmpty, \n        map_op_isSng = g_isSng, \n        map_op_ball = g_ball, \n        map_op_bex = g_bex, \n        map_op_size = g_size, \n        map_op_size_abort = g_size_abort, \n        map_op_sel = g_sel, \n        map_op_to_list = g_to_list, \n        map_op_to_map = g_list_to_map\n      \\<rparr>\"\n\n  local_setup \\<open>Locale_Code.lc_decl_del @{term dflt_ops}\\<close>\n\nend\n\nlemma update_dj_by_update: \n  assumes \"map_update \\<alpha> invar update\"\n  shows \"map_update_dj \\<alpha> invar update\"\nproof -\n  interpret map_update \\<alpha> invar update by fact\n  show ?thesis \n    apply (unfold_locales)\n    apply (auto simp add: update_correct)\n    done\nqed\n\nlemma map_iterator_linord_is_it: \n  \"map_iterator_linord m it \\<Longrightarrow> map_iterator m it\"\n  unfolding set_iterator_def set_iterator_map_linord_def\n  apply (erule set_iterator_genord.set_iterator_weaken_R)\n  ..\n\n\n\ncontext StdBasicMap \nbegin\n  \n\n  lemma g_add_impl: \"map_add \\<alpha> invar g_add\"\n  proof\n    fix m1 m2\n    assume \"invar m1\" \"invar m2\"\n\n    have A: \"g_add m1 m2 = iterate_add_to_map m1 update (iteratei m2)\"\n      unfolding g_add_def iterate_add_to_map_def by simp\n    have \"\\<alpha> (g_add m1 m2) = \\<alpha> m1 ++ \\<alpha> m2 \\<and> invar (g_add m1 m2)\"\n      unfolding A\n      apply (rule \n        iterate_add_to_map_correct[of \\<alpha> invar update m1 \"iteratei m2\" \"\\<alpha> m2\"])\n      apply unfold_locales []\n      apply fact\n      apply (rule iteratei_correct, fact)\n      done\n    thus \"\\<alpha> (g_add m1 m2) = \\<alpha> m1 ++ \\<alpha> m2\" \"invar (g_add m1 m2)\" by auto\n  qed\n\n  lemma g_sel_impl: \"map_sel' \\<alpha> invar g_sel\"\n  proof -\n    have A: \"\\<And>m P. g_sel m P = iterate_sel_no_map (iteratei m) P\"\n      unfolding g_sel_def iterate_sel_no_map_def iterate_sel_def by simp\n\n    { fix m P\n      assume I: \"invar m\"\n      note iterate_sel_no_map_correct[OF iteratei_correct[OF I], of P]\n    }\n    thus ?thesis\n      apply unfold_locales\n      unfolding A\n      apply (simp add: Bex_def Ball_def image_iff map_to_set_def)\n      apply clarify\n      apply (metis option.exhaust prod.exhaust)\n      apply (simp add: Bex_def Ball_def image_iff map_to_set_def)\n      done\n  qed\n  \n  lemma g_bex_impl: \"map_bex \\<alpha> invar g_bex\"\n    apply unfold_locales\n    unfolding g_bex_def\n    apply (rule_tac I=\"\\<lambda>it \\<sigma>. \\<sigma> \\<longleftrightarrow> (\\<exists>kv\\<in>it. P kv)\" \n      in iteratei_rule_insert_P)\n    by (auto simp: map_to_set_def)\n\n  \n\n  lemma g_size_impl: \"map_size \\<alpha> invar g_size\"\n  proof \n    fix m\n    assume I: \"invar m\"\n    have A: \"g_size m \\<equiv> iterate_size (iteratei m)\"\n      unfolding g_size_def iterate_size_def by simp\n  \n    from iterate_size_correct [OF iteratei_correct[OF I]]\n    show \"g_size m = card (dom (\\<alpha> m))\"\n      unfolding A\n      by (simp_all add: card_map_to_set) \n  qed \n\n  lemma g_size_abort_impl: \"map_size_abort \\<alpha> invar g_size_abort\"\n  proof \n    fix s m\n    assume I: \"invar m\"\n    have A: \"g_size_abort s m \\<equiv> iterate_size_abort (iteratei m) s\"\n      unfolding g_size_abort_def iterate_size_abort_def by simp\n  \n    from iterate_size_abort_correct [OF iteratei_correct[OF I]]\n    show \"g_size_abort s m = min s (card (dom (\\<alpha> m)))\"\n      unfolding A\n      by (simp_all add: card_map_to_set) \n  qed \n\n  lemma g_isEmpty_impl: \"map_isEmpty \\<alpha> invar g_isEmpty\"\n  proof \n    fix m\n    assume I: \"invar m\"\n    interpret map_size_abort \\<alpha> invar g_size_abort by (rule g_size_abort_impl)\n    from size_abort_correct[OF I] have \n      \"g_size_abort 1 m = min 1 (card (dom (\\<alpha> m)))\" .\n    thus \"g_isEmpty m = (\\<alpha> m = Map.empty)\" unfolding g_isEmpty_def\n      by (auto simp: min_def card_0_eq[OF finite] I)\n  qed\n\n  lemma g_isSng_impl: \"map_isSng \\<alpha> invar g_isSng\"\n  proof \n    fix m\n    assume I: \"invar m\"\n    interpret map_size_abort \\<alpha> invar g_size_abort by (rule g_size_abort_impl)\n    from size_abort_correct[OF I] have \n      \"g_size_abort 2 m = min 2 (card (dom (\\<alpha> m)))\" .\n    thus \"g_isSng m = (\\<exists>k v. \\<alpha> m = [k \\<mapsto> v])\" unfolding g_isSng_def\n      by (auto simp: min_def I card_Suc_eq dom_eq_singleton_conv)\n  qed\n  \n  lemma g_to_list_impl: \"map_to_list \\<alpha> invar g_to_list\"\n  proof \n    fix m \n    assume I: \"invar m\"\n\n    have A: \"g_to_list m = iterate_to_list (iteratei m)\"\n      unfolding g_to_list_def iterate_to_list_def by simp\n\n    from iterate_to_list_correct [OF iteratei_correct[OF I]]\n    have set_l_eq: \"set (g_to_list m) = map_to_set (\\<alpha> m)\" and \n      dist_l: \"distinct (g_to_list m)\" unfolding A by simp_all\n\n    from dist_l show dist_fst_l: \"distinct (map fst (g_to_list m))\"\n      by (simp add: distinct_map set_l_eq map_to_set_def inj_on_def)\n    \n    from map_of_map_to_set[of \"(g_to_list m)\" \"\\<alpha> m\", OF dist_fst_l] set_l_eq\n    show \"map_of (g_to_list m) = \\<alpha> m\" by simp\n  qed\n\n  lemma g_list_to_map_impl: \"list_to_map \\<alpha> invar g_list_to_map\"\n  proof -\n    {\n      fix m0 l\n      assume \"invar m0\"\n      hence \"invar (foldl (\\<lambda>s (k,v). update k v s) m0 l) \\<and> \n        \\<alpha> (foldl (\\<lambda>s (k,v). update k v s) m0 l) = \\<alpha> m0 ++ map_of (rev l)\"\n      proof (induction l arbitrary: m0)\n        case Nil thus ?case by simp\n      next\n        case (Cons kv l)\n        obtain k v where [simp]: \"kv=(k,v)\" by (cases kv) auto\n        have \"invar (foldl (\\<lambda>s (k, v). update k v s) m0 (kv # l))\"\n          apply simp\n          apply (rule conjunct1[OF Cons.IH])\n          apply (simp add: update_correct Cons.prems)\n          done\n        moreover have \"\\<alpha> (foldl (\\<lambda>s (k, v). update k v s) m0 (kv # l)) =\n          \\<alpha> m0 ++ map_of (rev (kv # l))\"\n          apply simp\n          apply (rule trans[OF conjunct2[OF Cons.IH]])\n          apply (auto \n            simp: update_correct Cons.prems Map.map_add_def[abs_def]\n            split: option.split\n          )\n          done\n        ultimately show ?case\n          by simp\n      qed\n    } thus ?thesis\n      apply unfold_locales\n      unfolding g_list_to_map_def\n      apply (auto simp: empty_correct)\n      done\n  qed\n\n  lemma g_add_dj_impl: \"map_add_dj \\<alpha> invar g_add_dj\"\n  proof\n    fix m1 m2\n    assume \"invar m1\" \"invar m2\" and DJ: \"dom (\\<alpha> m1) \\<inter> dom (\\<alpha> m2) = {}\"\n\n    have A: \"g_add_dj m1 m2 = iterate_add_to_map m1 update_dj (iteratei m2)\"\n      unfolding g_add_dj_def iterate_add_to_map_def by simp\n    have \"\\<alpha> (g_add_dj m1 m2) = \\<alpha> m1 ++ \\<alpha> m2 \\<and> invar (g_add_dj m1 m2)\"\n      unfolding A\n      apply (rule \n        iterate_add_to_map_dj_correct[\n        of \\<alpha> invar update_dj m1 \"iteratei m2\" \"\\<alpha> m2\"])\n      apply unfold_locales []\n      apply fact\n      apply (rule iteratei_correct, fact)\n      using DJ apply (simp add: Int_ac)\n      done\n    thus \"\\<alpha> (g_add_dj m1 m2) = \\<alpha> m1 ++ \\<alpha> m2\" \"invar (g_add_dj m1 m2)\" by auto\n  qed\n  \n  lemma g_restrict_impl: \"map_restrict \\<alpha> invar \\<alpha> invar g_restrict\"\n  proof \n    fix m P\n    assume I: \"invar m\"\n\n    have AUX: \"\\<And>k v it \\<sigma>.\n       \\<lbrakk>it \\<subseteq> {(k, v). \\<alpha> m k = Some v}; \\<alpha> m k = Some v; (k, v) \\<notin> it;\n        {(k, v). \\<alpha> \\<sigma> k = Some v} = it \\<inter> Collect P\\<rbrakk>\n       \\<Longrightarrow> k \\<notin> dom (\\<alpha> \\<sigma>)\"\n    proof (rule ccontr, simp)\n      fix k v it \\<sigma>\n      assume \"k\\<in>dom (\\<alpha> \\<sigma>)\" \n      then obtain v' where \"\\<alpha> \\<sigma> k = Some v'\" by auto\n      moreover assume \"{(k, v). \\<alpha> \\<sigma> k = Some v} = it \\<inter> Collect P\"\n      ultimately have MEM: \"(k,v')\\<in>it\" by auto\n      moreover assume \"it \\<subseteq> {(k, v). \\<alpha> m k = Some v}\" and \"\\<alpha> m k = Some v\"\n      ultimately have \"v'=v\" by auto\n      moreover assume \"(k,v)\\<notin>it\"\n      moreover note MEM \n      ultimately show False by simp\n    qed\n\n    have \"\\<alpha> (g_restrict P m) = \\<alpha> m |` {k. \\<exists>v. \\<alpha> m k = Some v \\<and> P (k, v)} \\<and>\n      invar (g_restrict P m)\"\n      unfolding g_restrict_def\n      apply (rule_tac I=\"\\<lambda>it \\<sigma>. invar \\<sigma> \n        \\<and> map_to_set (\\<alpha> \\<sigma>) = it \\<inter> Collect P\"\n        in iterate_rule_insert_P)\n      apply (auto simp: I empty_correct update_dj_correct map_to_set_def AUX)\n      apply (auto split: if_split_asm)\n      apply (rule ext)\n      apply (auto simp: Map.restrict_map_def)\n      apply force\n      apply (rule ccontr)\n      apply force\n      done\n    thus \"\\<alpha> (g_restrict P m) = \\<alpha> m |` {k. \\<exists>v. \\<alpha> m k = Some v \\<and> P (k, v)}\"\n      \"invar (g_restrict P m)\" by auto\n  qed\n\n  \n\n\ncontext StdBasicOMapDefs \nbegin\n  definition \n    \"g_min m P \\<equiv> \n      iterateoi m (\\<lambda>\\<sigma>. \\<sigma> = None) (\\<lambda>x \\<sigma>. if P x then Some x else None) None\"\n\n  definition \n    \"g_max m P \\<equiv> \n      rev_iterateoi m (\\<lambda>\\<sigma>. \\<sigma> = None) (\\<lambda>x \\<sigma>. if P x then Some x else None) None\"\n\n  definition \"g_to_sorted_list m \\<equiv> rev_iterateo m (#) []\"\n  definition \"g_to_rev_list m \\<equiv> iterateo m (#) []\"\n\n  definition dflt_oops :: \"('k,'v,'s) omap_ops\" \n    where [icf_rec_def]:\n    \"dflt_oops \\<equiv> map_ops.extend dflt_ops\n      \\<lparr> \n        map_op_ordered_list_it = ordered_list_it,\n        map_op_rev_list_it = rev_list_it,\n        map_op_min = g_min,\n        map_op_max = g_max,\n        map_op_to_sorted_list = g_to_sorted_list,\n        map_op_to_rev_list = g_to_rev_list\n      \\<rparr>\"\n  local_setup \\<open>Locale_Code.lc_decl_del @{term dflt_oops}\\<close>\n\nend\n\ncontext StdBasicOMap \nbegin\n  lemma g_min_impl: \"map_min \\<alpha> invar g_min\"\n  proof \n    fix m P\n\n    assume I: \"invar m\"\n  \n    from iterateoi_correct[OF I]\n    have iti': \"map_iterator_linord (iterateoi m) (\\<alpha> m)\" by simp\n    note sel_correct = iterate_sel_no_map_map_linord_correct[OF iti', of P]\n\n    have A: \"g_min m P = iterate_sel_no_map (iterateoi m) P\"\n      unfolding g_min_def iterate_sel_no_map_def iterate_sel_def by simp\n  \n    { assume \"rel_of (\\<alpha> m) P \\<noteq> {}\"\n      with sel_correct \n      show \"g_min m P \\<in> Some ` rel_of (\\<alpha> m) P\"\n        unfolding A\n        by (auto simp add: image_iff rel_of_def)\n    }\n\n    { assume \"rel_of (\\<alpha> m) P = {}\"        \n       with sel_correct show \"g_min m P = None\"\n        unfolding A\n        by (auto simp add: image_iff rel_of_def)\n    }\n\n    { fix k v\n      assume \"(k, v) \\<in> rel_of (\\<alpha> m) P\"\n      with sel_correct show \"fst (the (g_min m P)) \\<le> k\"\n        unfolding A\n        by (auto simp add: image_iff rel_of_def)\n    }\n  qed\n\n  lemma g_max_impl: \"map_max \\<alpha> invar g_max\"\n  proof \n    fix m P\n\n    assume I: \"invar m\"\n  \n    from rev_iterateoi_correct[OF I]\n    have iti': \"map_iterator_rev_linord (rev_iterateoi m) (\\<alpha> m)\" by simp\n    note sel_correct = iterate_sel_no_map_map_rev_linord_correct[OF iti', of P]\n\n    have A: \"g_max m P = iterate_sel_no_map (rev_iterateoi m) P\"\n      unfolding g_max_def iterate_sel_no_map_def iterate_sel_def by simp\n  \n    { assume \"rel_of (\\<alpha> m) P \\<noteq> {}\"\n      with sel_correct \n      show \"g_max m P \\<in> Some ` rel_of (\\<alpha> m) P\"\n        unfolding A\n        by (auto simp add: image_iff rel_of_def)\n    }\n\n    { assume \"rel_of (\\<alpha> m) P = {}\"        \n       with sel_correct show \"g_max m P = None\"\n        unfolding A\n        by (auto simp add: image_iff rel_of_def)\n    }\n\n    { fix k v\n      assume \"(k, v) \\<in> rel_of (\\<alpha> m) P\"\n      with sel_correct show \"fst (the (g_max m P)) \\<ge> k\"\n        unfolding A\n        by (auto simp add: image_iff rel_of_def)\n    }\n  qed\n\n  lemma g_to_sorted_list_impl: \"map_to_sorted_list \\<alpha> invar g_to_sorted_list\"\n  proof \n    fix m\n    assume I: \"invar m\"\n    note iti = rev_iterateoi_correct[OF I]\n    from iterate_to_list_map_rev_linord_correct[OF iti]\n    show \"sorted (map fst (g_to_sorted_list m))\" \n         \"distinct (map fst (g_to_sorted_list m))\"\n         \"map_of (g_to_sorted_list m) = \\<alpha> m\" \n      unfolding g_to_sorted_list_def iterate_to_list_def by simp_all\n  qed\n\n  lemma g_to_rev_list_impl: \"map_to_rev_list \\<alpha> invar g_to_rev_list\"\n  proof \n    fix m\n    assume I: \"invar m\"\n    note iti = iterateoi_correct[OF I]\n    from iterate_to_list_map_linord_correct[OF iti]\n    show \"sorted (rev (map fst (g_to_rev_list m)))\" \n         \"distinct (map fst (g_to_rev_list m))\"\n         \"map_of (g_to_rev_list m) = \\<alpha> m\" \n      unfolding g_to_rev_list_def iterate_to_list_def \n      by (simp_all add: rev_map)\n  qed\n  \n  lemma dflt_oops_impl: \"StdOMap dflt_oops\"\n  proof -\n    interpret aux: StdMap dflt_ops by (rule dflt_ops_impl)\n\n    show ?thesis\n      apply (rule StdOMap_intro)\n      apply icf_locales\n      apply (simp_all add: icf_rec_unf)\n      apply (rule g_min_impl)\n      apply (rule g_max_impl)\n      apply (rule g_to_sorted_list_impl)\n      apply (rule g_to_rev_list_impl)\n      done\n  qed\n\nend\n\nlocale g_image_filter_defs_loc = \n  m1: StdMapDefs ops1 + \n  m2: StdMapDefs ops2\n  for ops1 :: \"('k1,'v1,'s1,'m1) map_ops_scheme\"\n  and ops2 :: \"('k2,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n  definition \"g_image_filter f m1 \\<equiv> m1.iterate m1 (\\<lambda>kv \\<sigma>. case f kv of \n      None => \\<sigma>\n    | Some (k',v') => m2.update_dj k' v' \\<sigma>\n    ) (m2.empty ())\"\nend\n\nlocale g_image_filter_loc = g_image_filter_defs_loc ops1 ops2 + \n  m1: StdMap ops1 + \n  m2: StdMap ops2\n  for ops1 :: \"('k1,'v1,'s1,'m1) map_ops_scheme\"\n  and ops2 :: \"('k2,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n  lemma g_image_filter_impl: \n    \"map_image_filter m1.\\<alpha> m1.invar m2.\\<alpha> m2.invar g_image_filter\"\n  proof \n    fix m k' v' and f :: \"('k1 \\<times> 'v1) \\<Rightarrow> ('k2 \\<times> 'v2) option\"\n    assume invar_m: \"m1.invar m\" and\n           unique_f: \"transforms_to_unique_keys (m1.\\<alpha> m) f\"\n    \n    have A: \"g_image_filter f m = \n      iterate_to_map m2.empty m2.update_dj (\n        set_iterator_image_filter f (m1.iteratei m))\" \n      unfolding g_image_filter_def iterate_to_map_alt_def \n        set_iterator_image_filter_def case_prod_beta\n      by simp\n  \n    from m1.iteratei_correct[OF invar_m] \n    have iti_m: \"map_iterator (m1.iteratei m) (m1.\\<alpha> m)\" by simp\n\n    from unique_f have inj_on_f: \"inj_on f (map_to_set (m1.\\<alpha> m) \\<inter> dom f)\"\n      unfolding transforms_to_unique_keys_def inj_on_def Ball_def map_to_set_def\n      by auto (metis option.inject)\n\n    define vP where \"vP k v \\<longleftrightarrow> (\\<exists>k' v'. m1.\\<alpha> m k' = Some v' \\<and> f (k', v') = Some (k, v))\" for k v\n    have vP_intro: \"\\<And>k v. (\\<exists>k' v'. m1.\\<alpha> m k' = Some v' \n        \\<and> f (k', v') = Some (k, v)) \\<longleftrightarrow> vP k v\"\n      unfolding vP_def by simp\n    { fix k v\n      have \"Eps_Opt (vP k) = Some v \\<longleftrightarrow> vP k v\"\n        using unique_f unfolding vP_def transforms_to_unique_keys_def \n        apply (rule_tac Eps_Opt_eq_Some)\n        apply (metis prod.inject option.inject)\n      done\n    } note Eps_vP_elim[simp] = this\n    have map_intro: \"{y. \\<exists>x. x \\<in> map_to_set (m1.\\<alpha> m) \\<and> f x = Some y} \n      = map_to_set (\\<lambda>k. Eps_Opt (vP k))\"\n      by (simp add: map_to_set_def vP_intro set_eq_iff split: prod.splits)\n\n    from set_iterator_image_filter_correct [OF iti_m, OF inj_on_f, \n      unfolded map_intro] \n    have iti_filter: \"map_iterator (set_iterator_image_filter f (m1.iteratei m))\n          (\\<lambda>k. Eps_Opt (vP k))\" by auto\n\n    have upd: \"map_update_dj m2.\\<alpha> m2.invar m2.update_dj\" by unfold_locales\n    have emp: \"map_empty m2.\\<alpha> m2.invar m2.empty\" by unfold_locales\n  \n    from iterate_to_map_correct[OF upd emp iti_filter] show\n      \"map_op_invar ops2 (g_image_filter f m) \\<and>\n          (map_op_\\<alpha> ops2 (g_image_filter f m) k' = Some v') =\n          (\\<exists>k v. map_op_\\<alpha> ops1 m k = Some v \\<and> f (k, v) = Some (k', v'))\"\n      unfolding A vP_def[symmetric]\n      by (simp add: vP_intro)\n  \n  qed\nend\n\nsublocale g_image_filter_loc \n  < map_image_filter m1.\\<alpha> m1.invar m2.\\<alpha> m2.invar g_image_filter\n  by (rule g_image_filter_impl)\n\n\nlocale g_value_image_filter_defs_loc = \n  m1: StdMapDefs ops1 + \n  m2: StdMapDefs ops2\n  for ops1 :: \"('k,'v1,'s1,'m1) map_ops_scheme\"\n  and ops2 :: \"('k,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n  definition \"g_value_image_filter f m1 \\<equiv> m1.iterate m1 (\\<lambda>(k,v) \\<sigma>. \n    case f k v of \n      None => \\<sigma>\n    | Some v' => m2.update_dj k v' \\<sigma>\n    ) (m2.empty ())\"\n  \nend\n\n(* TODO: Move to Misc *)\nlemma restrict_map_dom_subset: \"\\<lbrakk> dom m \\<subseteq> R\\<rbrakk> \\<Longrightarrow> m|`R = m\"\n  apply (rule ext)\n  apply (auto simp: restrict_map_def)\n  apply (case_tac \"m x\")\n  apply auto\n  done\n\n\nlocale g_value_image_filter_loc = g_value_image_filter_defs_loc ops1 ops2 + \n  m1: StdMap ops1 + \n  m2: StdMap ops2\n  for ops1 :: \"('k,'v1,'s1,'m1) map_ops_scheme\"\n  and ops2 :: \"('k,'v2,'s2,'m2) map_ops_scheme\"\nbegin\n  lemma g_value_image_filter_impl: \n    \"map_value_image_filter m1.\\<alpha> m1.invar m2.\\<alpha> m2.invar g_value_image_filter\"\n    apply unfold_locales\n    unfolding g_value_image_filter_def\n    apply (rule_tac I=\"\\<lambda>it \\<sigma>. m2.invar \\<sigma> \n      \\<and> m2.\\<alpha> \\<sigma> = (\\<lambda>k. Option.bind (map_op_\\<alpha> ops1 m k) (f k)) |` it\"\n      in m1.old_iterate_rule_insert_P)\n\n    apply auto []\n    apply (auto simp: m2.empty_correct) []\n    defer\n    apply simp []\n    apply (rule restrict_map_dom_subset)\n    apply (auto) []\n    apply (case_tac \"m1.\\<alpha> m x\")\n    apply (auto) [2]\n\n    apply (auto split: option.split simp: m2.update_dj_correct intro!: ext)\n    apply (auto simp: restrict_map_def)\n    done\nend\n\nsublocale g_value_image_filter_loc \n  < map_value_image_filter m1.\\<alpha> m1.invar m2.\\<alpha> m2.invar g_value_image_filter\n  by (rule g_value_image_filter_impl)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/ICF/gen_algo/MapGA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3267404417947565}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\n(*\n  Structures supporting CTypes.\n  Primarily sets up types, defines pointers and the raw heap view.\n*)\n\ntheory CTypesBase\nimports\n  \"./$L4V_ARCH/Addr_Type\"\n  \"~~/src/HOL/Library/Prefix_Order\"\n  \"../../../lib/Word_Lib/Signed_Words\"\nbegin\n\nsection \"Type setup\"\n\ntype_synonym byte = \"8 word\"\n\nclass unit_class =\n  assumes there_is_only_one: \"x = y\"\n\ninstantiation unit :: unit_class\nbegin\ninstance by (intro_classes, simp)\nend\n\nsubsection \"Pointers\"\n\ndatatype 'a ptr = Ptr addr\n\nabbreviation\n  NULL :: \"'a ptr\" where\n  \"NULL \\<equiv> Ptr 0\"\n\nprimrec\n  ptr_val :: \"'a ptr \\<Rightarrow> addr\"\nwhere\n  ptr_val_def: \"ptr_val (Ptr a) = a\"\n\nprimrec\n  ptr_coerce :: \"'a ptr \\<Rightarrow> 'b ptr\" where\n  \"ptr_coerce (Ptr a) = Ptr a\"\n\ndefinition\n  (* no ctype/memtype-class constraints on these so as to allow comparison of\n     void * pointers, which are represented as Isabelle type unit ptr *)\n  ptr_less :: \"'a ptr \\<Rightarrow> 'a ptr \\<Rightarrow> bool\" (infixl \"<\\<^sub>p\" 50) where\n  \"p <\\<^sub>p q \\<equiv> ptr_val p < ptr_val q\"\n\ndefinition\n  ptr_le :: \"'a ptr \\<Rightarrow> 'a ptr \\<Rightarrow> bool\" (infixl \"\\<le>\\<^sub>p\" 50) where\n  \"p \\<le>\\<^sub>p q \\<equiv> ptr_val p \\<le> ptr_val q\"\n\ninstantiation ptr :: (type) ord\nbegin\n\ndefinition\n  ptr_less_def': \"p < q \\<equiv> p <\\<^sub>p q\"\ndefinition\n  ptr_le_def': \"p \\<le> q \\<equiv> p \\<le>\\<^sub>p q\"\n\ninstance ..\n\nend\n\nlemma ptr_val_case: \"ptr_val p = (case p of Ptr v \\<Rightarrow> v)\"\n  by (cases p) simp\n\ninstantiation ptr :: (type) linorder\nbegin\ninstance\n  by (intro_classes)\n     (unfold ptr_le_def' ptr_le_def ptr_less_def' ptr_less_def ptr_val_case,\n      auto split: ptr.splits)\nend\n\nsubsection \"Raw heap\"\n\ntext {* A raw map from addresses to bytes *}\n\ntype_synonym heap_mem = \"addr \\<Rightarrow> byte\"\n\ntext {* For heap h, pointer p and nat n, (heap_list h n p) returns the list\n        of bytes in the heap taken from addresses {p..+n} *}\n\nprimrec\n  heap_list :: \"heap_mem \\<Rightarrow> nat \\<Rightarrow> addr \\<Rightarrow> byte list\"\nwhere\n  heap_list_base: \"heap_list h 0 p = []\"\n| heap_list_rec:  \"heap_list h (Suc n) p = h p # heap_list h n (p + 1)\"\n\n\nsection \"Intervals\"\n\ntext {*\n  For word a and nat b, {a..+b} is the set of words x,\n  with unat (x - a) < b. *}\n\ndefinition\n  intvl :: \"'a::len word \\<times> nat \\<Rightarrow> 'a::len word set\" where\n  \"intvl x \\<equiv> {z. \\<exists>k. z = fst x + of_nat k \\<and> k < snd x}\"\n\nabbreviation\n  \"intvl_abbr\" :: \"'a::len word \\<Rightarrow> nat \\<Rightarrow> 'a word set\" (\"{_..+_}\") where\n  \"{a..+b} \\<equiv> intvl (a,b)\"\n\n\nsection \"dt_pair: a reimplementation of 2 item tuples\"\n\ndatatype (plugins del: size)\n    ('a,'b) dt_pair = DTPair 'a 'b\n\nprimrec\n  dt_fst :: \"('a,'b) dt_pair \\<Rightarrow> 'a\"\nwhere\n  \"dt_fst (DTPair a b) = a\"\n\nprimrec\n  dt_snd :: \"('a,'b) dt_pair \\<Rightarrow> 'b\"\nwhere\n  \"dt_snd (DTPair a b) = b\"\n\ntype_synonym normalisor = \"byte list \\<Rightarrow> byte list\"\n\n\nsection \"Properties of pointers\"\n\nlemma Ptr_ptr_val [simp]:\n  \"Ptr (ptr_val p) = p\"\n  by (case_tac p) simp\n\nlemma ptr_val_ptr_coerce [simp]:\n  \"ptr_val (ptr_coerce p) = ptr_val p\"\n  by (case_tac p) simp\n\nlemma Ptr_ptr_coerce [simp]:\n  \"Ptr (ptr_val p) = ptr_coerce p\"\n  by (case_tac p) simp\n\nlemma ptr_coerce_id [simp]:\n  \"ptr_coerce p = p\"\n  by (case_tac p) simp\n\nlemma ptr_coerce_idem [simp]:\n  \"ptr_coerce (ptr_coerce p) = ptr_coerce p\"\n  by (case_tac p) simp\n\nlemma ptr_val_inj [simp]:\n  \"(ptr_val p = ptr_val q) = (p = q)\"\n  by (case_tac p, case_tac q) auto\n\nlemma ptr_coerce_NULL [simp]:\n  \"(ptr_coerce p = NULL) = (p = NULL)\"\n  by (case_tac p) simp\n\nlemma NULL_ptr_val:\n  \"(p = NULL) = (ptr_val p = 0)\"\n  by (case_tac p) simp\n\ninstantiation ptr :: (type) finite\nbegin\ninstance\n  by (intro_classes)\n     (auto intro!: finite_code finite_imageD [where f=ptr_val] injI)\nend\n\nsection \"Properties of the raw heap\"\n\nlemma heap_list_length [simp]:\n  \"length (heap_list h n p) = n\"\n  by (induct n arbitrary: p) auto\n\nlemma heap_list_split:\n  shows \"k \\<le> n \\<Longrightarrow> heap_list h n x = heap_list h k x @ heap_list h (n - k) (x + of_nat k)\"\nproof (induct n arbitrary: k x)\n  case 0 thus ?case by simp\nnext\n  case (Suc n) thus ?case\n    by (cases k, auto simp: ac_simps)\nqed\n\nlemma heap_list_split2:\n  \"heap_list h (x + y) p = heap_list h x p @ heap_list h y (p + of_nat x)\"\n  by (subst heap_list_split [where k=x], auto)\n\n\nsection \"Properties of intervals\"\n\nlemma intvlI:\n  \"x < n \\<Longrightarrow> p + of_nat x \\<in> {p..+n}\"\n  by (force simp: intvl_def)\n\nlemma intvlD:\n  \"q \\<in> {p..+n} \\<Longrightarrow> \\<exists>k. q = p + of_nat k \\<and> k < n\"\n  by (force simp: intvl_def)\n\nlemma intvl_empty [simp]:\n  \"{p..+0} = {}\"\n  by (fast dest: intvlD)\n\nlemma intvl_Suc:\n  \"q \\<in> {p..+Suc 0} \\<Longrightarrow> p = q\"\n  by (force dest: intvlD)\n\nlemma intvl_self:\n  \"0 < n \\<Longrightarrow> x \\<in> {x..+n}\"\n  by (force simp: intvl_def)\n\nlemma intvl_start_inter:\n  \"\\<lbrakk> 0 < m; 0 < n \\<rbrakk> \\<Longrightarrow> {p..+m} \\<inter> {p..+n} \\<noteq> {}\"\n  by (force simp: disjoint_iff_not_equal dest: intvl_self)\n\nlemma intvl_overflow:\n  assumes \"2^len_of TYPE('a) \\<le> n\"\n  shows \"{(p::'a::len word)..+n} = UNIV\"\nproof -\n  have witness:\n    \"\\<And>x. x = p + of_nat (unat (x - p)) \\<and> unat (x - p) < n\"\n    using assms by simp unat_arith \n  show ?thesis unfolding intvl_def by (auto intro!: witness)\nqed\n\ndeclare of_nat_diff [simp]\n\nlemma intvl_self_offset:\n  fixes p::\"'a::len word\"\n  assumes a: \"2^len_of TYPE('a) - n < x\" and b: \"x < 2^len_of TYPE('a)\" and\n      c: \"(p::'a::len word) \\<notin> {p + of_nat x..+n}\"\n  shows False\nproof -\n  let ?j = \"2^len_of TYPE('a) - x\"\n  from b have b': \"of_nat x + of_nat ?j  = (0::'a::len word)\" using of_nat_2p by auto\n  moreover from a b have \"?j < n\" by arith\n  with b b' c show  ?thesis by (force simp: intvl_def)\nqed\n\nlemma intvl_mem_offset:\n  \"\\<lbrakk> q \\<in> {p..+unat x}; q \\<notin> {p..+unat y}; unat y \\<le> unat x \\<rbrakk> \\<Longrightarrow>\n      q \\<in> {p + y..+unat x - unat y}\"\n  by (clarsimp simp: intvl_def) (rule_tac x=\"k - unat y\" in exI, auto)\n\nlemma intvl_plus_sub_offset:\n  \"x \\<in> {p + y..+q - unat y} \\<Longrightarrow> x \\<in> {p..+q}\"\n  by (clarsimp simp: intvl_def) (rule_tac x=\"k + unat y\" in exI, auto)\n\nlemma intvl_plus_sub_Suc:\n  \"x \\<in> {p + 1..+q - Suc 0} \\<Longrightarrow> x \\<in> {p..+q}\"\n  by (rule intvl_plus_sub_offset [where y=1], simp)\n\nlemma intvl_neq_start:\n  \"\\<lbrakk> (q::'a::len word) \\<in> {p..+n}; p \\<noteq> q \\<rbrakk> \\<Longrightarrow> q \\<in> {p + 1..+n - Suc 0}\"\n  by (clarsimp simp: intvl_def)\n     (metis (no_types) Suc_diff_1 add.commute add_Suc_right diff_diff_left neq0_conv\n                       of_nat_Suc semiring_1_class.of_nat_0 zero_less_diff)\n\nlemmas unat_simps' =\n  word_arith_nat_defs word_unat.eq_norm len_of_addr_card mod_less\n\nlemma intvl_offset_nmem:\n  \"\\<lbrakk> q \\<in> {(p::'a::len word)..+unat x}; y \\<le>  2^len_of TYPE('a) - unat x \\<rbrakk> \\<Longrightarrow>\n      q \\<notin> {p + x..+y}\"\n  apply (clarsimp simp: intvl_def)\n  apply (simp only: unat_simps')\n  apply (subst (asm) word_unat.Abs_inject)\n    apply (auto simp: unats_def)\n  done\n\nlemma intvl_Suc_nmem' [simp]:\n  \"n < 2^len_of TYPE('a) \\<Longrightarrow> (p::'a::len word) \\<notin> {p + 1..+n - Suc 0}\"\n  by (clarsimp simp: intvl_def)\n     (unat_arith, simp only: unat_simps')\n\nlemma intvl_start_le:\n  \"x \\<le> y \\<Longrightarrow> {p..+x} \\<subseteq> {p..+y}\"\n  by (force simp: intvl_def)\n\nlemma intvl_sub_eq:\n  assumes \"x \\<le> y\"\n  shows \"{p + x..+unat (y - x)} = {p..+unat y} - {p..+unat x}\"\nproof -\n  have \"unat y - unat x \\<le> 2 ^ len_of TYPE('a) - unat x\"\n    by (insert unat_lt2p [of y], arith)\n  moreover have \"x \\<le> y\" by fact\n  moreover hence \"unat (y - x) = unat y - unat x\"\n    by (simp add: word_le_nat_alt, unat_arith)\n  ultimately show ?thesis\n    by (force dest: intvl_offset_nmem intvl_mem_offset elim: intvl_plus_sub_offset\n              simp: word_le_nat_alt)\n\nqed\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/c-parser/umm_heap/CTypesBase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878414043816, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3267404268022379}}
{"text": "(*<*)\n(*\n * Knowledge-based programs.\n * (C)opyright 2011, Peter Gammie, peteg42 at gmail.com.\n * License: BSD\n *)\n\ntheory SPRViewSingle\nimports\n  KBPsAlg\n  SPRView\n  List_local\n  ODList\n  Trie2\n  \"HOL-Library.Mapping\"\nbegin\n(*>*)\n\nsubsection\\<open>Perfect Recall for a Single Agent\\<close>\n\ntext\\<open>\n\n\\label{sec:kbps-spr-single-agent}\n\nWe capture our expectations of a single-agent scenario in the\nfollowing locale:\n\n\\<close>\n\nlocale FiniteSingleAgentEnvironment =\n  FiniteEnvironment jkbp envInit envAction envTrans envVal envObs\n    for jkbp :: \"('a, 'p, 'aAct) JKBP\"\n    and envInit :: \"('s :: {finite, linorder}) list\"\n    and envAction :: \"'s \\<Rightarrow> 'eAct list\"\n    and envTrans :: \"'eAct \\<Rightarrow> ('a \\<Rightarrow> 'aAct) \\<Rightarrow> 's \\<Rightarrow> 's\"\n    and envVal :: \"'s \\<Rightarrow> 'p \\<Rightarrow> bool\"\n    and envObs :: \"'a \\<Rightarrow> 's \\<Rightarrow> 'obs\"\n+ fixes agent :: \"'a\"\n  assumes envSingleAgent: \"a = agent\"\n\ntext\\<open>\n\nAs per the clock semantics of \\S\\ref{sec:kbps-theory-clock-view}, we\nassume that the set of states is finite and linearly ordered. We give\nthe sole agent the name \\<open>agent\\<close>.\n\nOur simulation is quite similar to the one for the clock semantics of\n\\S\\ref{sec:kbps-theory-clock-view}: it records the set of worlds that\nthe agent considers possible relative to a trace and the SPR view. The\nkey difference is that it is path-sensitive:\n\n\\<close>\n\ncontext FiniteSingleAgentEnvironment\nbegin\n\ndefinition spr_abs :: \"'s Trace \\<Rightarrow> 's set\" where\n  \"spr_abs t \\<equiv>\n    tLast ` { t' \\<in> SPR.jkbpC . spr_jview agent t' = spr_jview agent t }\"\n\ntype_synonym (in -) 's spr_simWorlds = \"'s set \\<times> 's\"\n\ndefinition spr_sim :: \"'s Trace \\<Rightarrow> 's spr_simWorlds\" where\n  \"spr_sim \\<equiv> \\<lambda>t. (spr_abs t, tLast t)\"\n(*<*)\n\nlemma spr_absI[elim]:\n  \"\\<lbrakk> t' \\<in> SPR.jkbpC; spr_jview a t' = spr_jview a t; v = tLast t' \\<rbrakk>\n    \\<Longrightarrow> v \\<in> spr_abs t\"\n  unfolding spr_abs_def\n  using envSingleAgent[where a=a] by blast\n\nlemma spr_abs_tLastD[simp]:\n  \"v \\<in> spr_abs t \\<Longrightarrow> envObs a v = envObs a (tLast t)\"\n  unfolding spr_abs_def\n  using envSingleAgent[where a=a] by auto\n\nlemma spr_abs_conv:\n  \"v \\<in> spr_abs t\n    \\<longleftrightarrow> (\\<exists>t'. t' \\<in> SPR.jkbpC \\<and> spr_jview a t' = spr_jview a t \\<and> v = tLast t')\"\n  unfolding spr_abs_def\n  using envSingleAgent[where a=a] by blast\n\nlemma spr_abs_eq[dest]:\n  \"spr_jview a t = spr_jview a t' \\<Longrightarrow> spr_abs t = spr_abs t'\"\n  unfolding spr_abs_def\n  using envSingleAgent[where a=a] by auto\n\nlemma spr_abs_refl[intro, simp]:\n  \"t \\<in> SPR.jkbpC \\<Longrightarrow> tLast t \\<in> spr_abs t\"\n  unfolding spr_abs_def\n  using envSingleAgent[where a=a] by auto\n\nlemma spr_sim_simps[simp]:\n  \"fst (spr_sim t) = spr_abs t\"\n  unfolding spr_sim_def by simp\n\n(*>*)\ntext\\<open>\n\nThe Kripke structure for this simulation relates worlds for @{term\n\"agent\"} if the sets of states it considers possible coincide, and the\nobservation of the final states of the trace is the same. Propositions\nare evaluated at the final state.\n\n\\<close>\n\ndefinition spr_simRels :: \"'a \\<Rightarrow> 's spr_simWorlds Relation\" where\n  \"spr_simRels \\<equiv> \\<lambda>a. { ((U, u), (V, v)) |U u V v.\n                         U = V \\<and> {u, v} \\<subseteq> U \\<and> envObs a u = envObs a v }\"\n\ndefinition spr_simVal :: \"'s spr_simWorlds \\<Rightarrow> 'p \\<Rightarrow> bool\" where\n  \"spr_simVal \\<equiv> envVal \\<circ> snd\"\n\nabbreviation spr_simMC :: \"('a, 'p, 's spr_simWorlds) KripkeStructure\" where\n  \"spr_simMC \\<equiv> mkKripke (spr_sim ` SPR.jkbpC) spr_simRels spr_simVal\"\n(*<*)\n\nlemma spr_simVal[iff]:\n  \"spr_simVal (spr_sim t) = envVal (tLast t)\"\n  unfolding spr_sim_def spr_simVal_def by simp\n\nlemma spr_sim_r:\n  \"sim_r SPR.MC spr_simMC spr_sim\"\nproof\n  fix a t v'\n  assume t: \"t \\<in> worlds SPR.MC\"\n     and tv': \"(spr_sim t, v') \\<in> relations spr_simMC a\"\n  from tv' obtain s\n    where vv': \"v' = (spr_abs t, s)\"\n      and st: \"s \\<in> spr_abs t\"\n    unfolding spr_simRels_def spr_sim_def mkKripke_def SPR.mkM_def\n    by auto\n  from st obtain v\n    where \"v \\<in> SPR.jkbpC\"\n      and \"spr_jview a v = spr_jview a t\"\n      and \"tLast v = s\"\n    by (auto(*<*)iff: spr_abs_conv(*>*))\n  with t vv'\n  have \"(t, v) \\<in> relations SPR.MC a\"\n   and \"spr_sim v = v'\"\n    unfolding spr_simRels_def spr_sim_def mkKripke_def SPR.mkM_def\n    by auto\n  thus \"\\<exists>v. (t, v) \\<in> relations SPR.MC a \\<and> spr_sim v = v'\" by blast\nqed\n\n(*>*)\ntext\\<open>\n\nDemonstrating that this is a simulation\n(\\S\\ref{sec:kripke-theory-simulations}) is straightforward.\n\n\\<close>\n\nlemma spr_sim: \"sim SPR.MC spr_simMC spr_sim\"\n(*<*)\nproof\n  show \"sim_f SPR.MC spr_simMC spr_sim\"\n    unfolding spr_simRels_def spr_sim_def mkKripke_def SPR.mkM_def\n    by (rule) auto\nnext\n  show \"sim_r SPR.MC spr_simMC spr_sim\"\n    by (rule spr_sim_r)\nqed auto\n\n(*>*)\ntext\\<open>\\<close>\nend (* context FiniteSingleAgentEnvironment *)\n\nsublocale FiniteSingleAgentEnvironment\n        < SPRsingle: SimIncrEnvironment jkbp envInit envAction envTrans envVal\n                                       spr_jview envObs spr_jviewInit spr_jviewIncr\n                                       spr_sim spr_simRels spr_simVal\n(*<*)\n  by standard (rule spr_sim)\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\<open>Representations\\<close>\n\ntext\\<open>\n\n\\label{sec:kbps-theory-spr-single-rep}\n\nAs in \\S\\ref{sec:kbps-theory-clock-view-algops}, we quotient @{typ \"'s\nspr_simWorlds\"} by @{term \"spr_simRels\"}. Because there is only a\nsingle agent, an element of this quotient corresponding to a cononical\ntrace @{term \"t\"} is isomorphic to the set of states that are possible\ngiven the sequence of observations made by @{term \"agent\"} on @{term\n\"t\"}. Therefore we have a very simple representation:\n\n\\<close>\n\ncontext FiniteSingleAgentEnvironment\nbegin\n\ntype_synonym (in -) 's spr_simWorldsRep = \"'s odlist\"\n\ntext\\<open>\n\nIt is very easy to map these representations back to simulated\nequivalence classes:\n\n\\<close>\n\ndefinition\n  spr_simAbs :: \"'s spr_simWorldsRep \\<Rightarrow> 's spr_simWorlds set\"\nwhere\n  \"spr_simAbs \\<equiv> \\<lambda>ss. { (toSet ss, s) |s. s \\<in> toSet ss }\"\n\ntext\\<open>\n\nThis time our representation is unconditionally canonical:\n\n\\<close>\n\nlemma spr_simAbs_inj: \"inj spr_simAbs\"\n(*<*)\n  apply (rule injI)\n  unfolding spr_simAbs_def\n  apply (subgoal_tac \"toSet x = toSet y\")\n  apply auto\n  using toSet_inj\n  apply (erule injD)\n  done\n\nlemma spr_sim_rep_abs[simp]:\n  assumes ec: \"spr_simAbs ec = SPRsingle.sim_equiv_class a t\"\n  shows \"toSet ec = spr_abs t\"\nproof\n  show \"toSet ec \\<subseteq> spr_abs t\"\n  proof\n    fix x assume x: \"x \\<in> toSet ec\"\n    hence \"(toSet ec, x) \\<in> spr_simAbs ec\"\n      unfolding spr_simAbs_def by simp\n    with ec have \"(toSet ec, x) \\<in> SPRsingle.sim_equiv_class a t\"\n      by simp\n    with x envSingleAgent[where a=a] show \"x \\<in> spr_abs t\"\n      unfolding spr_sim_def spr_abs_def by auto\n  qed\nnext\n  show \"spr_abs t \\<subseteq> toSet ec\"\n  proof\n    fix x assume x: \"x \\<in> spr_abs t\"\n    with ec envSingleAgent[where a=a] show \"x \\<in> toSet ec\"\n      unfolding spr_simAbs_def spr_sim_def spr_abs_def by auto\n  qed\nqed\n\nlemma spr_sim_rep_abs_syn[simp]:\n  assumes ec: \"spr_simAbs ec = SPRsingle.sim_equiv_class agent t\"\n  shows \"set (toList ec) = spr_abs t\"\n  using spr_sim_rep_abs[OF ec] unfolding toSet_def by simp\n\nlemma spr_simAbs_list:\n  \"spr_simAbs ` fromList ` X = (\\<lambda>ss. { (ss, s) |s. s \\<in> ss }) ` set ` X\"\n  unfolding spr_simAbs_def Set.image_def by auto\n\n(*>*)\ntext\\<open>\n\nWe again make use of the following Kripke structure, where the worlds\nare the final states of the subset of the temporal slice that @{term\n\"agent\"} believes possible:\n\n\\<close>\n\ndefinition spr_repRels :: \"'a \\<Rightarrow> ('s \\<times> 's) set\" where\n  \"spr_repRels \\<equiv> \\<lambda>a. { (s, s'). envObs a s' = envObs a s }\"\n\nabbreviation spr_repMC :: \"'s set \\<Rightarrow> ('a, 'p, 's) KripkeStructure\" where\n  \"spr_repMC \\<equiv> \\<lambda>X. mkKripke X spr_repRels envVal\"\n\ntext\\<open>\n\nSimilarly we show that this Kripke structure is adequate by\nintroducing an intermediate structure and connecting them all with a\ntower of simulations:\n\n\\<close>\n\nabbreviation spr_jkbpCSt :: \"'s Trace \\<Rightarrow> 's spr_simWorlds set\" where\n  \"spr_jkbpCSt t \\<equiv> SPRsingle.sim_equiv_class agent t\"\n\nabbreviation\n  spr_simMCt :: \"'s Trace \\<Rightarrow> ('a, 'p, 's spr_simWorlds) KripkeStructure\"\nwhere\n  \"spr_simMCt t \\<equiv> mkKripke (spr_jkbpCSt t) spr_simRels spr_simVal\"\n\ndefinition spr_repSim :: \"'s spr_simWorlds \\<Rightarrow> 's\" where\n  \"spr_repSim \\<equiv> snd\"\n(*<*)\n\nlemma spr_repMC_kripke[intro, simp]: \"kripke (spr_repMC X)\"\n  by (rule kripkeI) simp\n\nlemma spr_repMC_S5n[intro, simp]: \"S5n (spr_repMC X)\"\n  unfolding spr_repRels_def\n  by (intro S5nI equivI refl_onI symI transI) auto\n\nlemma jkbpCSt_jkbpCS_subset:\n  \"SPRsingle.sim_equiv_class agent t \\<subseteq> spr_sim ` SPR.jkbpC\"\n  by auto\n\nlemma spr_simRep_sim_simps[simp]:\n  \"spr_repSim ` spr_sim ` T = tLast ` T\"\n  \"spr_repSim (spr_sim t) = tLast t\"\n  unfolding spr_repSim_def spr_sim_def Set.image_def by auto\n\n(*>*)\ntext\\<open>\\<close>\n\nlemma spr_repSim:\n  assumes tC: \"t \\<in> SPR.jkbpC\"\n  shows \"sim (spr_simMCt t)\n             ((spr_repMC \\<circ> fst) (spr_sim t))\n             spr_repSim\"\n(*<*) (is \"sim ?M ?M' ?f\")\nproof\n  show \"sim_range ?M ?M' ?f\"\n  proof\n    show \"worlds ?M' = ?f ` worlds ?M\"\n      unfolding spr_sim_def spr_repSim_def spr_abs_def Set.image_def\n      by auto\n  next\n    fix a\n    show \"relations ?M' a \\<subseteq> worlds ?M' \\<times> worlds ?M'\"\n      unfolding spr_sim_def spr_repSim_def by simp\n  qed\nnext\n  show \"sim_val ?M ?M' ?f\"\n    unfolding spr_sim_def spr_simVal_def spr_repSim_def by auto\nnext\n  from tC\n  show \"sim_f ?M ?M' ?f\"\n    unfolding spr_sim_def spr_simVal_def spr_repSim_def\n    apply -\n    apply rule\n    apply (cut_tac a=a in envSingleAgent)\n    apply (auto iff: spr_sim_def spr_repRels_def)\n    apply (rule spr_tLast)\n    apply auto\n    done\nnext\n  show \"sim_r ?M ?M' ?f\"\n    unfolding spr_sim_def spr_simVal_def spr_repSim_def\n    apply -\n    apply rule\n    apply (cut_tac a=a in envSingleAgent)\n    unfolding spr_abs_def spr_sim_def spr_repRels_def spr_simRels_def Set.image_def\n    apply auto\n    done\nqed\n\n(*>*)\ntext\\<open>\n\nAs before, the following sections discharge the requirements of the\n\\<open>Algorithm\\<close> locale of Figure~\\ref{fig:kbps-alg-alg-locale}.\n\n\\<close>\n\n(* **************************************** *)\n\nsubsubsection\\<open>Initial states\\<close>\n\ntext\\<open>\n\nThe initial states of the automaton for @{term \"agent\"} is simply the\npartition of @{term \"envInit\"} under @{term \"agent\"}'s observation.\n\n\\<close>\n\ndefinition (in -)\n  spr_simInit :: \"('s :: linorder) list \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> 'obs)\n                     \\<Rightarrow> 'a \\<Rightarrow> 'obs \\<Rightarrow> 's spr_simWorldsRep\"\nwhere\n  \"spr_simInit envInit envObs \\<equiv> \\<lambda>a iobs.\n    ODList.fromList [ s. s \\<leftarrow> envInit, envObs a s = iobs ]\"\n(*<*)\n\nabbreviation\n  spr_simInit :: \"'a \\<Rightarrow> 'obs \\<Rightarrow> 's spr_simWorldsRep\"\nwhere\n  \"spr_simInit \\<equiv> SPRViewSingle.spr_simInit envInit envObs\"\n\n(*>*)\ntext\\<open>\\<close>\n\nlemma spr_simInit:\n  assumes \"iobs \\<in> envObs a ` set envInit\"\n  shows \"spr_simAbs (spr_simInit a iobs)\n       = spr_sim ` { t' \\<in> SPR.jkbpC. spr_jview a t' = spr_jviewInit a iobs }\"\n(*<*)\n  using assms\n  unfolding spr_simInit_def\n  using envSingleAgent[where a=a]\n  unfolding spr_simAbs_def spr_sim_def [abs_def] spr_abs_def\n  apply (auto iff: spr_jview_def SPR.jviewInit)\n   apply (rule_tac x=\"tInit s\" in image_eqI)\n    apply (auto iff: spr_jview_def)[1]\n    apply (rule_tac x=\"tInit xa\" in image_eqI)\n    apply auto[1]\n   apply simp\n   apply simp\n  apply (rule_tac x=\"tInit xb\" in image_eqI)\n  apply auto\n  done\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\<open>Simulated observations\\<close>\n\ntext\\<open>\n\nAs the agent makes the same observation on the entire equivalence\nclass, we arbitrarily choose the first element of the representation:\n\n\\<close>\n\ndefinition (in -)\n  spr_simObs :: \"('a \\<Rightarrow> 's \\<Rightarrow> 'obs)\n               \\<Rightarrow> 'a \\<Rightarrow> ('s :: linorder) spr_simWorldsRep \\<Rightarrow> 'obs\"\nwhere\n  \"spr_simObs envObs \\<equiv> \\<lambda>a. envObs a \\<circ> ODList.hd\"\n(*<*)\n\nabbreviation\n  spr_simObs :: \"'a \\<Rightarrow> 's spr_simWorldsRep \\<Rightarrow> 'obs\"\nwhere\n  \"spr_simObs \\<equiv> SPRViewSingle.spr_simObs envObs\"\n\n(*>*)\ntext\\<open>\\<close>\n\nlemma spr_simObs:\n  assumes tC: \"t \\<in> SPR.jkbpC\"\n  assumes ec: \"spr_simAbs ec = SPRsingle.sim_equiv_class a t\"\n  shows \"spr_simObs a ec = envObs a (tLast t)\"\n(*<*)\nproof -\n  have A: \"\\<forall>s \\<in> set (toList ec). envObs a s = envObs a (tLast t)\"\n    using spr_sim_rep_abs[OF ec] by (simp add: toSet_def)\n  from tC ec have B: \"tLast t \\<in> set (toList ec)\"\n    using envSingleAgent[where a=a] by simp\n  show ?thesis\n    unfolding spr_simObs_def\n    by (simp add: list_choose_hd[OF A B] ODList.hd_def)\nqed\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\<open>Evaluation\\<close>\n\ntext\\<open>\n\n\\label{sec:kbps-spr-single-agent-eval}\n\nAs the single-agent case is much simpler than the multi-agent ones, we\ndefine an evaluation function specialised to its representation.\n\nIntuitively @{term \"eval\"} yields the subset of @{term \"X\"} where the\nformula holds, where @{term \"X\"} is taken to be a representation of a\ncanonical equivalence class for @{term \"agent\"}.\n\n\\<close>\n\nfun (in -)\n  eval :: \"(('s :: linorder) \\<Rightarrow> 'p \\<Rightarrow> bool)\n        \\<Rightarrow> 's odlist \\<Rightarrow> ('a, 'p) Kform \\<Rightarrow> 's odlist\"\nwhere\n  \"eval val X (Kprop p)      = ODList.filter (\\<lambda>s. val s p) X\"\n| \"eval val X (Knot \\<phi>)       = ODList.difference X (eval val X \\<phi>)\"\n| \"eval val X (Kand \\<phi> \\<psi>)     = ODList.intersect (eval val X \\<phi>) (eval val X \\<psi>)\"\n| \"eval val X (Kknows a \\<phi>)   = (if eval val X \\<phi> = X then X else ODList.empty)\"\n| \"eval val X (Kcknows as \\<phi>) =\n                     (if as = [] \\<or> eval val X \\<phi> = X then X else ODList.empty)\"\n\ntext\\<open>\n\nIn general this is less efficient than the tableau approach of\n\\citet[Proposition~3.2.1]{FHMV:1995}, which labels all states with all\nformulas. However it is often the case that the set of relevant worlds\nis much smaller than the set of all system states.\n\nShowing that this corresponds with the standard models relation is\nroutine.\n\n\\<close>\n(*<*)\n\nlemma eval_ec_subseteq:\n  shows \"toSet (eval envVal ec \\<phi>) \\<subseteq> toSet ec\"\n  by (induct \\<phi>) auto\n\nlemma eval_models_aux:\n  assumes ec: \"spr_simAbs ec = SPRsingle.sim_equiv_class agent t\"\n  assumes s: \"s \\<in> toSet ec\"\n  shows \"s \\<in> toSet (eval envVal ec \\<phi>) \\<longleftrightarrow> spr_repMC (toSet ec), s \\<Turnstile> \\<phi>\"\nusing s\nproof(induct \\<phi> arbitrary: s)\n  case (Kknows a \\<phi> s) with ec envSingleAgent[where a=a] show ?case\n    unfolding spr_repRels_def\n    by (auto simp: inj_eq[OF toSet_inj, symmetric] dest: subsetD[OF eval_ec_subseteq])\nnext\n  case (Kcknows as \\<phi> s)\n  from ec show ?case\n  proof(cases as)\n    case Nil with Kcknows show ?thesis by clarsimp\n  next\n    case (Cons x xs)\n    hence \"set as = {agent}\"\n      by (induct as) (auto simp: envSingleAgent)\n    moreover\n    have \"(spr_repRels agent \\<inter> toSet ec \\<times> toSet ec)\\<^sup>+ = (spr_repRels agent \\<inter> toSet ec \\<times> toSet ec)\"\n      by (rule trancl_id) (simp add: spr_repRels_def trans_def)\n    moreover note Kcknows ec\n    ultimately show ?thesis\n      unfolding spr_repRels_def\n      by (auto simp: inj_eq[OF toSet_inj, symmetric] dest: subsetD[OF eval_ec_subseteq])\n  qed\nqed simp_all\n\nlemma eval_all_or_nothing:\n  assumes subj_phi: \"subjective agent \\<phi>\"\n  shows \"toSet (eval envVal ec \\<phi>) = {} \\<or> toSet (eval envVal ec \\<phi>) = toSet ec\"\n  using subj_phi by (induct \\<phi> rule: subjective.induct) auto\n(*>*)\n\nlemma eval_models:\n  assumes ec: \"spr_simAbs ec = SPRsingle.sim_equiv_class agent t\"\n  assumes subj: \"subjective agent \\<phi>\"\n  assumes s: \"s \\<in> toSet ec\"\n  shows \"toSet (eval envVal ec \\<phi>) \\<noteq> {} \\<longleftrightarrow> spr_repMC (toSet ec), s \\<Turnstile> \\<phi>\"\n(*<*)\n  using eval_models_aux[OF ec s, symmetric] eval_all_or_nothing[OF subj] s\n  by auto\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\<open>Simulated actions\\<close>\n\ntext\\<open>\n\nThe actions enabled on a canonical equivalence class are those for\nwhich @{term \"eval\"} yields a non-empty set of states:\n\n\\<close>\n\ndefinition (in -)\n  spr_simAction :: \"('a, 'p, 'aAct) KBP \\<Rightarrow> (('s :: linorder) \\<Rightarrow> 'p \\<Rightarrow> bool)\n                     \\<Rightarrow> 'a \\<Rightarrow> 's spr_simWorldsRep \\<Rightarrow> 'aAct list\"\nwhere\n  \"spr_simAction kbp envVal \\<equiv> \\<lambda>a X.\n    [ action gc. gc \\<leftarrow> kbp, eval envVal X (guard gc) \\<noteq> ODList.empty ]\"\n(*<*)\n\nabbreviation\n  spr_simAction :: \"'a \\<Rightarrow> 's spr_simWorldsRep \\<Rightarrow> 'aAct list\"\nwhere\n  \"spr_simAction \\<equiv> SPRViewSingle.spr_simAction (jkbp agent) envVal\"\n\n(*>*)\ntext\\<open>\n\nThe key lemma relates the agent's behaviour on an equivalence class to\nthat on its representation:\n\n\\<close>\n\nlemma spr_simAction_jAction:\n  assumes tC: \"t \\<in> SPR.jkbpC\"\n  assumes ec: \"spr_simAbs ec = SPRsingle.sim_equiv_class agent t\"\n  shows \"set (spr_simAction agent ec)\n       = set (jAction (spr_repMC (toSet ec)) (tLast t) agent)\"\n(*<*)\nproof -\n  have \"\\<And>P. (set (jkbp agent) \\<inter> {gc. P gc})\n      = { gc \\<in> set (jkbp agent). P gc }\"\n    by blast\n  then\n  show ?thesis\n    unfolding spr_simAction_def jAction_def\n    apply clarsimp\n    apply (rule SUP_cong)\n     apply simp_all\n     apply (rule Collect_cong)\n     apply rule\n      apply clarsimp\n      apply (subst eval_models[OF ec, symmetric])\n        apply (simp_all add: toSet_eq_iff)\n       using subj tC ec\n       apply (fastforce+)[2]\n    apply clarsimp\n    apply (subst (asm) eval_models[OF ec, symmetric])\n    using subj tC ec\n    apply fastforce+\n    done (* FIXME improve *)\nqed\n\nlemma spr_submodel_aux:\n  assumes tC: \"t \\<in> SPR.jkbpC\"\n      and s: \"s \\<in> worlds (spr_simMCt t)\"\n  shows \"gen_model SPRsingle.MCS s = gen_model (spr_simMCt t) s\"\nproof(rule gen_model_subset[where T=\"SPRsingle.sim_equiv_class agent t\"])\n  fix a\n  let ?X = \"SPRsingle.sim_equiv_class agent t\"\n  show \"relations SPRsingle.MCS a \\<inter> ?X \\<times> ?X\n      = relations (spr_simMCt t) a \\<inter> ?X \\<times> ?X\"\n    by (simp add: Int_ac Int_absorb1\n                  relation_mono[OF jkbpCSt_jkbpCS_subset jkbpCSt_jkbpCS_subset])\nnext\n  let ?X = \"SPRsingle.sim_equiv_class agent t\"\n  from s show \"(\\<Union>a. relations (spr_simMCt t) a)\\<^sup>* `` {s} \\<subseteq> ?X\"\n    apply (clarsimp simp del: mkKripke_simps)\n    apply (erule kripke_rels_trc_worlds)\n    apply auto\n    done\nnext\n  let ?Y = \"{ t' \\<in> SPR.jkbpC . spr_jview agent t' = spr_jview agent t }\"\n  let ?X = \"spr_sim ` ?Y\"\n  from s obtain t'\n    where st': \"s = spr_sim t'\"\n      and t'C: \"t' \\<in> SPR.jkbpC\"\n      and t'O: \"spr_jview agent t = spr_jview agent t'\"\n    by fastforce\n  { fix t''\n    assume tt': \"(t', t'') \\<in> (\\<Union>a. relations SPR.MC a)\\<^sup>*\"\n    from t'C tt' have t''C: \"t'' \\<in> SPR.jkbpC\"\n      by - (erule kripke_rels_trc_worlds, simp_all)\n    from tt' t'O have t''O: \"spr_jview agent t = spr_jview agent t''\"\n      apply induct\n      unfolding SPR.mkM_def\n      apply auto\n      apply (cut_tac a=x in envSingleAgent)\n      apply simp\n      done\n    from t''C t''O have \"t'' \\<in> ?Y\" by simp }\n  hence \"(\\<Union>a. relations SPR.MC a)\\<^sup>* `` {t'} \\<subseteq> ?Y\"\n    by clarsimp\n  hence \"spr_sim ` ((\\<Union>a. relations SPR.MC a)\\<^sup>* `` {t'}) \\<subseteq> ?X\"\n    by (rule image_mono)\n  with st' t'C\n  show \"(\\<Union>a. relations SPRsingle.MCS a)\\<^sup>* `` {s} \\<subseteq> ?X\"\n    using sim_trc_commute[OF SPR.mkM_kripke spr_sim, where t=t'] by simp\nqed (insert s, auto)\n\n(*>*)\ntext\\<open>\n\nThe \\<open>Algorithm\\<close> locale requires the following lemma, which is\na straightforward chaining of the above simulations.\n\n\\<close>\n\nlemma spr_simAction:\n  assumes tC: \"t \\<in> SPR.jkbpC\"\n      and ec: \"spr_simAbs ec = SPRsingle.sim_equiv_class a t\"\n  shows \"set (spr_simAction a ec) = set (jAction SPR.MC t a)\"\n(*<*)\nproof -\n  from ec\n  have ec': \"spr_simAbs ec = SPRsingle.sim_equiv_class agent t\"\n    by (simp only: envSingleAgent[where a=a])\n  have \"set (spr_simAction a ec) = set (spr_simAction agent ec)\"\n    by (simp only: envSingleAgent[where a=a])\n  also from tC ec' have \"... = set (jAction (spr_repMC (toSet ec)) (tLast t) agent)\"\n    by (rule spr_simAction_jAction)\n  also from tC ec' have \"... = set (jAction (spr_simMCt t) (spr_sim t) agent)\"\n    by (simp add: simulation_jAction_eq[OF _ spr_repSim])\n  also from tC have \"... = set (jAction SPRsingle.MCS (spr_sim t) agent)\"\n    using gen_model_jAction_eq[OF spr_submodel_aux[OF tC, where s=\"spr_sim t\"], where w'=\"spr_sim t\"]\n          gen_model_world_refl[where w=\"spr_sim t\" and M=\"spr_simMCt t\"]\n    by simp\n  also from tC have \"... = set (jAction SPR.MC t agent)\"\n    by (simp add: simulation_jAction_eq[OF _ spr_sim])\n  finally show ?thesis by (simp only: envSingleAgent[where a=a])\nqed\n(*>*)\n\n(* **************************************** *)\n\nsubsubsection\\<open>Simulated transitions\\<close>\n\ntext\\<open>\n\nIt is straightforward to determine the possible successor states of a\ngiven canonical equivalence class @{term \"X\"}:\n\n\\<close>\n\ndefinition (in -)\n  spr_trans :: \"('a, 'p, 'aAct) KBP\n              \\<Rightarrow> ('s \\<Rightarrow> 'eAct list)\n              \\<Rightarrow> ('eAct \\<Rightarrow> ('a \\<Rightarrow> 'aAct) \\<Rightarrow> 's \\<Rightarrow> 's)\n              \\<Rightarrow> ('s \\<Rightarrow> 'p \\<Rightarrow> bool)\n              \\<Rightarrow> 'a \\<Rightarrow> ('s :: linorder) spr_simWorldsRep \\<Rightarrow> 's list\"\nwhere\n  \"spr_trans kbp envAction envTrans val \\<equiv> \\<lambda>a X.\n    [ envTrans eact (\\<lambda>a'. aact) s .\n       s \\<leftarrow> toList X, eact \\<leftarrow> envAction s, aact \\<leftarrow> spr_simAction kbp val a X ]\"\n(*<*)\n\nabbreviation\n  spr_trans :: \"'a \\<Rightarrow> 's spr_simWorldsRep \\<Rightarrow> 's list\"\nwhere\n  \"spr_trans \\<equiv> SPRViewSingle.spr_trans (jkbp agent) envAction envTrans envVal\"\n\n(*>*)\ntext\\<open>\n\nUsing this function we can determine the set of possible successor\nequivalence classes from @{term \"X\"}:\n\n\\<close>\n\nabbreviation (in -) envObs_rel :: \"('s \\<Rightarrow> 'obs) \\<Rightarrow> 's \\<times> 's \\<Rightarrow> bool\" where\n  \"envObs_rel envObs \\<equiv> \\<lambda>(s, s'). envObs s' = envObs s\"\n\ndefinition (in -)\n  spr_simTrans :: \"('a, 'p, 'aAct) KBP\n                 \\<Rightarrow> (('s::linorder) \\<Rightarrow> 'eAct list)\n                 \\<Rightarrow> ('eAct \\<Rightarrow> ('a \\<Rightarrow> 'aAct) \\<Rightarrow> 's \\<Rightarrow> 's)\n                 \\<Rightarrow> ('s \\<Rightarrow> 'p \\<Rightarrow> bool)\n                 \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> 'obs)\n                 \\<Rightarrow> 'a \\<Rightarrow> 's spr_simWorldsRep \\<Rightarrow> 's spr_simWorldsRep list\"\nwhere\n  \"spr_simTrans kbp envAction envTrans val envObs \\<equiv> \\<lambda>a X.\n    map ODList.fromList (partition (envObs_rel (envObs a))\n                                   (spr_trans kbp envAction envTrans val a X))\"\n(*<*)\n\nabbreviation\n  spr_simTrans :: \"'a \\<Rightarrow> 's spr_simWorldsRep \\<Rightarrow> 's spr_simWorldsRep list\"\nwhere\n  \"spr_simTrans \\<equiv> SPRViewSingle.spr_simTrans (jkbp agent) envAction envTrans envVal envObs\"\n\nlemma envObs_rel_equiv:\n  \"equiv UNIV (rel_ext (envObs_rel (envObs agent)))\"\n  by (intro equivI refl_onI symI transI) auto\n\nlemma spr_trans:\n  assumes tC: \"t \\<in> SPR.jkbpC\"\n  assumes ec: \"spr_simAbs ec = SPRsingle.sim_equiv_class agent t\"\n  shows \"set (spr_trans agent ec)\n       = { s |t' s. t' \\<leadsto> s \\<in> SPR.jkbpC \\<and> spr_jview agent t' = spr_jview agent t }\" (is \"?lhs = ?rhs\")\nproof\n  show \"?lhs \\<subseteq> ?rhs\"\n  proof\n    fix x assume x: \"x \\<in> ?lhs\"\n    with assms show \"x \\<in> ?rhs\"\n      unfolding spr_trans_def\n      apply (clarsimp simp del: split_paired_Ex split_paired_All)\n      apply (frule spr_sim_rep_abs)\n      unfolding toSet_def\n      apply clarsimp\n\n      apply (simp only: spr_abs_conv[where a=agent])\n      apply clarify\n\n      apply (rule_tac x=\"t'\" in exI)\n      apply simp\n      apply (rule_tac n=\"Suc (tLength t')\" in SPR.jkbpCn_jkbpC_inc)\n      apply (auto iff: Let_def simp del: split_paired_Ex split_paired_All)\n\n      apply (rule_tac x=xa in exI)\n      apply (rule_tac x=\"\\<lambda>a'. aact\" in exI)\n      apply auto\n      apply (subst envSingleAgent)\n      apply (simp add: spr_simAction[where a=agent])\n      apply (subst SPR.jkbpC_jkbpCn_jAction_eq[symmetric])\n      apply auto\n      apply (subst S5n_jAction_eq[where w'=t])\n      apply simp_all\n      unfolding SPR.mkM_def\n      apply simp\n      done\n  qed\nnext\n  show \"?rhs \\<subseteq> ?lhs\"\n  proof\n    fix s assume s: \"s \\<in> ?rhs\"\n    then obtain t'\n      where t'sC: \"t' \\<leadsto> s \\<in> SPR.jkbpC\"\n        and tt': \"spr_jview agent t' = spr_jview agent t\"\n      by blast\n    from t'sC have t'Cn: \"t' \\<in> SPR.jkbpCn (tLength t')\" by blast\n    from t'sC obtain eact aact\n      where eact: \"eact \\<in> set (envAction (tLast t'))\"\n        and aact: \"\\<forall>a. aact a \\<in> set (jAction (SPR.mkM (SPR.jkbpCn (tLength t'))) t' a)\"\n        and s: \"s = envTrans eact aact (tLast t')\"\n      using SPR.jkbpC_tLength_inv[where t=\"t' \\<leadsto> s\" and n=\"Suc (tLength t')\"]\n      by (auto iff: Let_def)\n    from tC ec s eact aact tt' t'sC\n    show \"s \\<in> ?lhs\"\n      unfolding spr_trans_def\n      apply (clarsimp)\n      apply (rule bexI[where x=\"tLast t'\"])\n      apply (rule bexI[where x=eact])\n      apply simp_all\n       prefer 2\n       apply (blast intro: spr_absI)\n      apply (simp add: spr_simAction[where a=agent])\n      apply (rule image_eqI[where x=\"aact agent\"])\n       apply (subgoal_tac \"(\\<lambda>a'. aact agent) = aact\")\n        apply simp\n       apply (rule ext)\n       apply (cut_tac a=a' in envSingleAgent)\n       apply simp\n      apply (erule allE[where x=agent])\n      apply (subst SPR.jkbpC_jkbpCn_jAction_eq)\n      apply auto\n      apply (subst S5n_jAction_eq[where w=t and w'=t'])\n        apply simp\n       apply (unfold SPR.mkM_def)[1]\n       apply simp\n       apply (blast dest: SPR.sync[rule_format])\n      apply (auto dest: SPR.sync[rule_format])\n      done\n  qed\nqed\n\n(*>*)\ntext\\<open>\n\nThe \\<open>partition\\<close> function splits a list into equivalence\nclasses under the given equivalence relation.\n\nThe property asked for by the \\<open>Algorithm\\<close> locale follows from\nthe properties of \\<open>partition\\<close> and \\<open>spr_trans\\<close>:\n\n\\<close>\n\nlemma spr_simTrans:\n  assumes tC: \"t \\<in> SPR.jkbpC\"\n  assumes ec: \"spr_simAbs ec = SPRsingle.sim_equiv_class a t\"\n  shows \"spr_simAbs ` set (spr_simTrans a ec)\n      = { SPRsingle.sim_equiv_class a (t' \\<leadsto> s)\n          |t' s. t' \\<leadsto> s \\<in> SPR.jkbpC \\<and> spr_jview a t' = spr_jview a t}\"\n(*<*) (is \"?lhs a = ?rhs a\")\nproof -\n  from ec have ec': \"spr_simAbs ec = SPRsingle.sim_equiv_class agent t\"\n    by (simp only: envSingleAgent[where a=a])\n  from ec' have \"?lhs agent = ?rhs agent\"\n    unfolding spr_simTrans_def\n    apply clarsimp\n    apply (simp only: spr_simAbs_list partition[OF envObs_rel_equiv subset_UNIV] spr_trans[OF tC ec'])\n    apply clarsimp\n    apply rule\n\n     (* left to right *)\n\n     apply clarsimp\n     apply (erule quotientE)\n     apply clarsimp\n     apply (rule_tac x=t' in exI)\n     apply (rule_tac x=x in exI)\n     apply clarsimp\n     apply rule\n      apply clarsimp\n      apply (rule_tac x=\"t'a \\<leadsto> s\" in image_eqI)\n       apply (unfold spr_sim_def [abs_def] spr_abs_def)[1]\n       apply clarsimp\n       apply (auto iff: spr_jview_def)[1]\n        apply (rule_tac x=\"t'c \\<leadsto> xa\" in image_eqI)\n         apply simp\n        apply simp\n       apply (simp add: spr_jview_def)\n     apply clarsimp\n     apply (frule spr_jview_tStep_eq_inv)\n     apply clarsimp\n     apply (rule_tac x=s' in exI)\n     apply (unfold spr_sim_def [abs_def] spr_abs_def)[1]\n     apply clarsimp\n     apply (auto iff: spr_jview_def)[1]\n      apply (rule_tac x=\"t'b \\<leadsto> xa\" in image_eqI)\n       apply simp\n       apply simp\n\n     (* right to left *)\n\n     apply clarsimp\n     apply (rule_tac x=\"spr_abs (t' \\<leadsto> s)\" in image_eqI)\n      apply rule\n       apply clarsimp\n       apply (frule spr_jview_tStep_eq_inv)\n       apply clarsimp\n       apply (unfold spr_sim_def [abs_def])[1]\n       apply clarsimp\n       apply rule\n        apply (erule spr_abs_eq)\n       apply (erule spr_absI[where a=agent]) back\n        apply simp\n       apply simp\n      apply clarsimp\n      apply (simp only: spr_abs_conv[where a=agent])\n      apply clarsimp\n      apply (frule spr_jview_tStep_eq_inv)\n      apply clarsimp\n      apply (rule_tac x=\"t'' \\<leadsto> s'\" in image_eqI)\n       apply (unfold spr_sim_def [abs_def])[1]\n       apply clarsimp\n       apply blast\n      apply blast\n     apply (rule_tac x=s in quotientI2)\n      apply auto[1]\n     apply rule\n      apply clarsimp\n      apply rule\n       apply blast\n      apply (cut_tac v=x and t=\"t' \\<leadsto> s\" in spr_abs_conv[where a=agent])\n      apply clarsimp\n      apply (frule spr_jview_tStep_eq_inv)\n      apply clarsimp\n      apply (rule_tac x=t'' in exI)\n      apply (simp add: Let_def spr_jview_def)\n     apply clarsimp\n     apply (erule spr_absI[where a=agent]) back back\n     apply (auto iff: spr_jview_def)\n     done\n   thus \"?lhs a = ?rhs a\" by (simp only: envSingleAgent[where a=a])\nqed\n\n(*>*)\ntext\\<open>\\<close>\n\nend (* context FiniteSingleAgentEnvironment *)\n\n(* **************************************** *)\n\nsubsubsection\\<open>Maps\\<close>\n\ntext\\<open>\n\n\\label{sec:kbps-theory-spr-single-maps}\n\nAs in \\S\\ref{sec:kbps-theory-clock-view-maps}, we use a pair of tries\nand an association list to handle the automata representation. Recall\nthat the keys of these tries are lists of system states.\n\n\\<close>\n\ntype_synonym ('s, 'obs) spr_trans_trie = \"('s, ('obs, 's odlist) mapping) trie\"\ntype_synonym ('s, 'aAct) spr_acts_trie = \"('s, ('s, 'aAct) trie) trie\"\n(*<*)\n\ndefinition\n  trans_MapOps_lookup :: \"('s::linorder, 'obs) spr_trans_trie\n                        \\<Rightarrow> 's odlist \\<times> 'obs \\<rightharpoonup> 's odlist\"\nwhere\n  \"trans_MapOps_lookup \\<equiv> \\<lambda>m k.\n     Option.bind (trie_odlist_lookup m (fst k)) (\\<lambda>m'. Mapping.lookup m' (snd k))\"\n\ndefinition\n  trans_MapOps_update :: \"'s odlist \\<times> 'obs \\<Rightarrow> ('s :: linorder) odlist\n                        \\<Rightarrow> ('s, ('obs, 's odlist) mapping) trie\n                        \\<Rightarrow> ('s, ('obs, 's odlist) mapping) trie\"\nwhere\n  \"trans_MapOps_update \\<equiv> \\<lambda>k v m.\n     trie_odlist_update_with (fst k) m Mapping.empty\n      (\\<lambda>m. Mapping.update (snd k) v m)\"\n\ndefinition\n  trans_MapOps :: \"(('s :: linorder, ('obs, 's odlist) mapping) trie, 's odlist \\<times> 'obs, 's odlist) MapOps\"\nwhere\n  \"trans_MapOps \\<equiv>\n     \\<lparr> MapOps.empty = empty_trie,\n       lookup = trans_MapOps_lookup,\n       update = trans_MapOps_update \\<rparr>\"\n\nlemma (in FiniteSingleAgentEnvironment) trans_MapOps[intro, simp]:\n  \"MapOps (\\<lambda>k. (spr_simAbs (fst k), snd k)) (SPRsingle.jkbpSEC \\<times> UNIV) trans_MapOps\"\nproof\n  fix k show \"MapOps.lookup trans_MapOps (MapOps.empty trans_MapOps) k = None\"\n    unfolding trans_MapOps_def trans_MapOps_lookup_def trie_odlist_lookup_def\n    by (auto split: prod.split)\nnext\n  fix e k k' M\n  assume k: \"(spr_simAbs (fst k), snd k) \\<in> SPRsingle.jkbpSEC \\<times> (UNIV :: 'z set)\"\n     and k': \"(spr_simAbs (fst k'), snd k') \\<in> SPRsingle.jkbpSEC \\<times> (UNIV :: 'z set)\"\n  show \"MapOps.lookup trans_MapOps (MapOps.update trans_MapOps k e M) k'\n         = (if (spr_simAbs (fst k'), snd k') = (spr_simAbs (fst k), snd k)\n             then Some e else MapOps.lookup trans_MapOps M k')\"\n  proof(cases \"(spr_simAbs (fst k'), snd k') = (spr_simAbs (fst k), snd k)\")\n    case True hence \"k = k'\"\n      using injD[OF spr_simAbs_inj] k k' by (auto iff: prod_eqI)\n    thus ?thesis\n      unfolding trans_MapOps_def trans_MapOps_lookup_def trans_MapOps_update_def trie_odlist_lookup_def trie_odlist_update_with_def\n      by (simp add: lookup_trie_update_with lookup_update split: option.split prod.split)\n  next\n    case False thus ?thesis\n      unfolding trans_MapOps_def trans_MapOps_lookup_def trans_MapOps_update_def trie_odlist_lookup_def trie_odlist_update_with_def\n      by (auto simp: lookup_empty lookup_update_neq lookup_trie_update_with split: option.split prod.split)\n  qed\nqed\n\n(*>*)\n\nsubsubsection\\<open>Locale instantiation\\<close>\n\ntext\\<open>\n\nThe above is sufficient to instantiate the @{term \"Algorithm\"} locale.\n\n\\<close>\n\nsublocale FiniteSingleAgentEnvironment\n        < SPRsingle: Algorithm\n            jkbp envInit envAction envTrans envVal\n            spr_jview envObs spr_jviewInit spr_jviewIncr\n            spr_sim spr_simRels spr_simVal\n            spr_simAbs spr_simObs spr_simInit spr_simTrans spr_simAction\n            trie_odlist_MapOps trans_MapOps\n(*<*)\n  apply (unfold_locales)\n\n  using spr_simInit\n  apply auto[1]\n\n  using spr_simObs\n  apply auto[1]\n\n  using spr_simAction\n  apply blast\n\n  using spr_simTrans\n  apply blast\n\n  apply (rule trie_odlist_MapOps[OF subset_inj_on[OF spr_simAbs_inj subset_UNIV]])\n  apply (rule trans_MapOps)\n\n  done\n\ndefinition\n  mkSPRSingleAuto :: \"('a, 'p, 'aAct) KBP\n                    \\<Rightarrow> ('s :: linorder) list\n                    \\<Rightarrow> ('s \\<Rightarrow> 'eAct list)\n                    \\<Rightarrow> ('eAct \\<Rightarrow> ('a \\<Rightarrow> 'aAct) \\<Rightarrow> 's \\<Rightarrow> 's)\n                    \\<Rightarrow> ('s \\<Rightarrow> 'p \\<Rightarrow> bool)\n                    \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> 'obs)\n                    \\<Rightarrow> 'a \\<Rightarrow> ('obs, 'aAct, 's odlist) Protocol\"\nwhere\n  \"mkSPRSingleAuto \\<equiv> \\<lambda>kbp envInit envAction envTrans envVal envObs.\n    mkAlgAuto trie_odlist_MapOps\n              trans_MapOps\n              (spr_simObs envObs)\n              (spr_simInit envInit envObs)\n              (spr_simTrans kbp envAction envTrans envVal envObs)\n              (spr_simAction kbp envVal)\n              (\\<lambda>a. map (spr_simInit envInit envObs a \\<circ> envObs a) envInit)\"\n\nlemma (in FiniteSingleAgentEnvironment) mkSPRSingleAuto_implements:\n  \"SPR.implements (mkSPRSingleAuto (jkbp agent) envInit envAction envTrans envVal envObs)\"\n  using SPRsingle.k_mkAlgAuto_implements\n  unfolding mkSPRSingleAuto_def mkAlgAuto_def alg_dfs_def SPRsingle.KBP.k_ins_def SPRsingle.KBP.k_empt_def SPRsingle.k_frontier_def SPRsingle.KBP.k_memb_def SPRsingle.KBP.transUpdate_def SPRsingle.KBP.actsUpdate_def\n  apply simp\n  done\n\n(*\n\nWe actually run this unfolding of the algorithm. The lemma is keeping\nus honest.\n\n*)\n\ntype_synonym (in -)\n  ('aAct, 'obs, 's) SPRSingleAutoDFS = \"(('s, 'aAct list) trie, (('s, ('obs, 's odlist) mapping) trie)) AlgState\"\n\ndefinition\n  SPRSingleAutoDFS :: \"('a, 'p, 'aAct) KBP\n                     \\<Rightarrow> ('s :: linorder) list\n                     \\<Rightarrow> ('s \\<Rightarrow> 'eAct list)\n                     \\<Rightarrow> ('eAct \\<Rightarrow> ('a \\<Rightarrow> 'aAct) \\<Rightarrow> 's \\<Rightarrow> 's)\n                     \\<Rightarrow> ('s \\<Rightarrow> 'p \\<Rightarrow> bool)\n                     \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> 'obs)\n                     \\<Rightarrow> 'a \\<Rightarrow> ('aAct, 'obs, 's) SPRSingleAutoDFS\"\nwhere\n  \"SPRSingleAutoDFS \\<equiv> \\<lambda>kbp envInit envAction envTrans envVal envObs. \\<lambda>a.\n    alg_dfs trie_odlist_MapOps\n            trans_MapOps\n            (spr_simObs envObs a)\n            (spr_simTrans kbp envAction envTrans envVal envObs a)\n            (spr_simAction kbp envVal a)\n            (map (spr_simInit envInit envObs a \\<circ> envObs a) envInit)\"\n\nlemma (in FiniteSingleAgentEnvironment)\n  \"mkSPRSingleAuto kbp envInit envAction envTrans envVal envObs\n = (\\<lambda>a. alg_mk_auto trie_odlist_MapOps trans_MapOps (spr_simInit a) (SPRSingleAutoDFS kbp envInit envAction envTrans envVal envObs a))\"\n  unfolding mkSPRSingleAuto_def SPRSingleAutoDFS_def mkAlgAuto_def alg_mk_auto_def by (simp add: Let_def)\n\n(*>*)\ntext\\<open>\n\nWe use this theory to synthesise a solution to the robot of\n\\S\\ref{sec:kbps-robot-intro} in \\S\\ref{sec:kbps-theory-robot}.\n\n\\<close>\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/KBPs/SPRViewSingle.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011686727232, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.3266777768871565}}
{"text": "section {* Set Based Leakage Model (sketch)*}\n\ntheory Wasm_Leakage imports Wasm_Secret begin\n\ndatatype arith_leakage =\n  Unop_i32_leakage unop_i\n| Unop_i64_leakage unop_i\n| Unop_f32_leakage unop_f f32\n| Unop_f64_leakage unop_f f64\n| Binop_i32_Some_safe_leakage binop_i\n| Binop_i32_None_safe_leakage binop_i\n| Binop_i64_Some_safe_leakage binop_i\n| Binop_i64_None_safe_leakage binop_i\n| Binop_i32_Some_leakage binop_i i32 i32\n| Binop_i32_None_leakage binop_i i32 i32\n| Binop_i64_Some_leakage binop_i i64 i64\n| Binop_i64_None_leakage binop_i i64 i64\n| Binop_f32_Some_leakage binop_f f32 f32\n| Binop_f32_None_leakage binop_f f32 f32\n| Binop_f64_Some_leakage binop_f f64 f64\n| Binop_f64_None_leakage binop_f f64 f64\n| Testop_i32_leakage testop\n| Testop_i64_leakage testop\n| Relop_i32_leakage relop_i\n| Relop_i64_leakage relop_i\n| Relop_f32_leakage relop_f f32 f32\n| Relop_f64_leakage relop_f f64 f64\n\ndatatype host_leakage =\n  Callcl_host_Some_leakage \"mem list\"\n| Callcl_host_None_leakage \"mem list\"\n\ndatatype leakage =\n  Arith_leakage arith_leakage\n| Host_leakage host_leakage\n| Empty_leakage\n| Convert_Some_int_leakage t t\n| Convert_None_int_leakage t t\n| Convert_Some_leakage t t v\n| Convert_None_leakage t t v\n| Select_leakage \"i32 option\"\n| If_false_leakage i32\n| If_true_leakage i32\n| Br_if_false_leakage i32\n| Br_if_true_leakage i32\n| Br_table_leakage i32\n| Br_table_length_leakage i32\n| Call_indirect_Some_leakage i32\n| Call_indirect_None_leakage i32\n| Callcl_native_leakage nat\n| Load_Some_leakage t nat a off\n| Load_None_leakage t nat a off\n| Load_packed_Some_leakage tp sx nat a off\n| Load_packed_None_leakage tp sx nat a off\n| Store_Some_leakage t nat a off\n| Store_None_leakage t nat a off\n| Store_packed_Some_leakage t tp nat a off\n| Store_packed_None_leakage t tp nat a off\n| Current_memory_leakage nat\n| Grow_memory_Some_leakage nat nat\n| Grow_memory_None_leakage nat nat\n\ndefinition action_leakage :: \"action \\<Rightarrow> leakage\" where\n\"action_leakage a =\n  (case a of\n  Unop_i32_action op' \\<Rightarrow> Arith_leakage (Unop_i32_leakage op')\n| Unop_i64_action op' \\<Rightarrow> Arith_leakage (Unop_i64_leakage op')\n| Unop_f32_action op' c \\<Rightarrow> Arith_leakage (Unop_f32_leakage op' c)\n| Unop_f64_action op' c \\<Rightarrow> Arith_leakage (Unop_f64_leakage op' c)\n| Binop_i32_Some_action op' c1 c2 \\<Rightarrow> Arith_leakage (if (safe_binop_i op')\n                                                     then Binop_i32_Some_safe_leakage op'\n                                                     else Binop_i32_Some_leakage op' c1 c2)\n| Binop_i32_None_action op' c1 c2 \\<Rightarrow> Arith_leakage (if (safe_binop_i op')\n                                                     then Binop_i32_None_safe_leakage op'\n                                                     else Binop_i32_None_leakage op' c1 c2)\n| Binop_i64_Some_action op' c1 c2 \\<Rightarrow> Arith_leakage (if (safe_binop_i op')\n                                                     then Binop_i64_Some_safe_leakage op'\n                                                     else Binop_i64_Some_leakage op' c1 c2)\n| Binop_i64_None_action op' c1 c2 \\<Rightarrow>Arith_leakage (if (safe_binop_i op')\n                                                    then Binop_i64_None_safe_leakage op'\n                                                    else Binop_i64_None_leakage op' c1 c2)\n| Binop_f32_Some_action op' c1 c2 \\<Rightarrow> Arith_leakage (Binop_f32_Some_leakage op' c1 c2)\n| Binop_f32_None_action op' c1 c2 \\<Rightarrow> Arith_leakage (Binop_f32_None_leakage op' c1 c2)\n| Binop_f64_Some_action op' c1 c2 \\<Rightarrow> Arith_leakage (Binop_f64_Some_leakage op' c1 c2)\n| Binop_f64_None_action op' c1 c2 \\<Rightarrow> Arith_leakage (Binop_f64_None_leakage op' c1 c2)\n| Testop_i32_action op' \\<Rightarrow> Arith_leakage (Testop_i32_leakage op')\n| Testop_i64_action op' \\<Rightarrow> Arith_leakage (Testop_i64_leakage op')\n| Relop_i32_action op' \\<Rightarrow> Arith_leakage (Relop_i32_leakage op')\n| Relop_i64_action op' \\<Rightarrow> Arith_leakage (Relop_i64_leakage op')\n| Relop_f32_action  op' c1 c2 \\<Rightarrow> Arith_leakage (Relop_f32_leakage  op' c1 c2)\n| Relop_f64_action  op' c1 c2 \\<Rightarrow> Arith_leakage (Relop_f64_leakage  op' c1 c2)\n| Convert_Some_action t1 t2 c \\<Rightarrow> (if is_int_t t1 \\<and> is_int_t t2\n                                   then Convert_Some_int_leakage t1 t2\n                                   else Convert_Some_leakage t1 t2 c)\n| Convert_None_action t1 t2 c \\<Rightarrow> (if is_int_t t1 \\<and> is_int_t t2\n                                   then Convert_None_int_leakage t1 t2\n                                   else Convert_None_leakage t1 t2 c)\n| Reinterpret_action \\<Rightarrow> Empty_leakage\n| Classify_action \\<Rightarrow> Empty_leakage\n| Declassify_action \\<Rightarrow> Empty_leakage\n| Unreachable_action \\<Rightarrow> Empty_leakage\n| Nop_action \\<Rightarrow> Empty_leakage\n| Drop_action  \\<Rightarrow> Empty_leakage\n| Select_action sec c \\<Rightarrow> if (sec = Secret) then Select_leakage None else Select_leakage (Some c)\n| Block_action  \\<Rightarrow> Empty_leakage\n| Loop_action \\<Rightarrow> Empty_leakage\n| If_false_action c \\<Rightarrow> If_false_leakage c\n| If_true_action c \\<Rightarrow> If_true_leakage c\n| Label_const_action \\<Rightarrow> Empty_leakage\n| Label_trap_action \\<Rightarrow> Empty_leakage\n| Br_action \\<Rightarrow> Empty_leakage\n| Br_if_false_action c \\<Rightarrow> Br_if_false_leakage c\n| Br_if_true_action c \\<Rightarrow> Br_if_true_leakage c\n| Br_table_action c \\<Rightarrow> Br_table_leakage c\n| Br_table_length_action c \\<Rightarrow> Br_table_length_leakage c\n| Local_const_action \\<Rightarrow> Empty_leakage\n| Local_trap_action \\<Rightarrow> Empty_leakage\n| Return_action \\<Rightarrow> Empty_leakage\n| Tee_local_action \\<Rightarrow> Empty_leakage\n| Trap_action \\<Rightarrow> Empty_leakage\n| Call_action \\<Rightarrow> Empty_leakage\n| Call_indirect_Some_action c \\<Rightarrow> Call_indirect_Some_leakage c\n| Call_indirect_None_action c \\<Rightarrow> Call_indirect_None_leakage c\n| Callcl_native_action n \\<Rightarrow> Callcl_native_leakage n\n| Callcl_host_Some_action s args s' out tr tf host hs \\<Rightarrow> Host_leakage (Callcl_host_Some_leakage (map fst (filter (\\<lambda>(m,sec). sec = Public) (mem s))))\n| Callcl_host_None_action s args tr tf host hs \\<Rightarrow> Host_leakage (Callcl_host_Some_leakage (map fst (filter (\\<lambda>(m,sec). sec = Public) (mem s))))\n| Get_local_action \\<Rightarrow> Empty_leakage\n| Set_local_action \\<Rightarrow> Empty_leakage\n| Get_global_action \\<Rightarrow> Empty_leakage\n| Set_global_action \\<Rightarrow> Empty_leakage\n| Load_Some_action t n a off \\<Rightarrow> Load_Some_leakage t n a off\n| Load_None_action t n a off \\<Rightarrow> Load_None_leakage t n a off\n| Load_packed_Some_action tp sx n a off \\<Rightarrow> Load_packed_Some_leakage tp sx n a off\n| Load_packed_None_action tp sx n a off \\<Rightarrow> Load_packed_None_leakage tp sx n a off\n| Store_Some_action t n a off \\<Rightarrow> Store_Some_leakage t n a off\n| Store_None_action t n a off \\<Rightarrow> Store_None_leakage t n a off\n| Store_packed_Some_action t tp n a off \\<Rightarrow> Store_packed_Some_leakage t tp n a off\n| Store_packed_None_action t tp n a off \\<Rightarrow> Store_packed_None_leakage t tp n a off\n| Current_memory_action l \\<Rightarrow> Current_memory_leakage l\n| Grow_memory_Some_action l c \\<Rightarrow> Grow_memory_Some_leakage l c\n| Grow_memory_None_action l c \\<Rightarrow> Grow_memory_None_leakage l c\n| Label_action \\<Rightarrow> Empty_leakage\n| Local_action \\<Rightarrow> Empty_leakage)\"\n\nlemma memory_agree_filter:\n  assumes \"memory_public_agree m m'\"\n  shows \"(\\<lambda>(m,sec). sec = Public) m = (\\<lambda>(m,sec). sec = Public) m'\"\n  using assms\n  unfolding memory_public_agree_def\n  by (cases m; cases m') auto\n\nlemma memories_agree_filter:\n  assumes \"memories_public_agree ms ms'\"\n  shows \"filter (\\<lambda>(m,sec). sec = Public) ms = filter (\\<lambda>(m,sec). sec = Public) ms'\"\n  using assms\nproof (induction ms arbitrary: ms')\n  case Nil\n  thus ?case\n    by simp\nnext\n  case (Cons a ms)\n  obtain a' ms'' where \"ms' = a'#ms''\"\n                       \"memory_public_agree a a'\"\n                       \"memories_public_agree ms ms''\"\n    using Cons(2)\n    by (metis list_all2_Cons1)\n  thus ?case\n    using Cons(1) memory_agree_filter\n    by (fastforce simp add: memory_public_agree_def)\nqed\n\nlemma action_indistinguishable_imp_action_leakage_eq:\n  assumes \"a \\<sim>_a a'\"\n          \"action_leakage a = obs\"\n  shows \"action_leakage a' = obs\"\n  using assms\nproof (induction rule: action_indistinguishable.induct)\n  case (host_Some s s' vcs vcs' s_o s'_o vcs_o vcs'_o tf f hs hs')\n  have \"filter (\\<lambda>(m,sec). sec = Public) (mem s) = filter (\\<lambda>(m,sec). sec = Public) (mem s')\"\n    using host_Some(1) store_public_agree_def memories_agree_filter\n    by simp\n  thus ?case\n    using host_Some(5)\n    by (auto simp add: action_leakage_def)\nnext\n  case (host_None s s' vcs vcs' tf f hs hs')\n  have \"filter (\\<lambda>(m,sec). sec = Public) (mem s) = filter (\\<lambda>(m,sec). sec = Public) (mem s')\"\n    using host_None(1) store_public_agree_def memories_agree_filter\n    by simp\n  thus ?case\n    using host_None(3)\n    by (auto simp add: action_leakage_def)\nqed (auto simp add: action_leakage_def)\n\nend", "meta": {"author": "PLSysSec", "repo": "ct-wasm-proofs", "sha": "3fa5c38ecda3d05c351096ba5e6d7ba1df793c21", "save_path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs", "path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs/ct-wasm-proofs-3fa5c38ecda3d05c351096ba5e6d7ba1df793c21/CT-WASM_model/Wasm_Leakage.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6334102775181399, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3265989539119953}}
{"text": "chapter\\<open>Output\\<close>\ntext\\<open>This chapter provides two different output formats for EFSMs.\\<close> \n\nsection\\<open>Graphical Output\\<close>\ntext\\<open>It is often more intuitive and aesthetically pleasing to view EFSMs graphically. DOT is a graph\nlayout engine which converts textual representations of graphs to more useful formats, such as SVG\nor PNG representations. This theory defines functions to convert arbitrary EFSMs to DOT for easier\nviewing. Here, transitions use the syntactic sugar presented in \\cite{foster2018} such that they\ntake the form $\\textit{label}:\\textit{arity}[g_1, \\ldots, g_g]/f_1, \\ldots, f_f[u_1, \\ldots, u_u]$.\\<close>\n\ntheory EFSM_Dot\nimports Inference\nbegin\n\nfun string_of_digit :: \"nat \\<Rightarrow> String.literal\" where\n  \"string_of_digit n = (\n         if n = 0 then (STR ''0'')\n    else if n = 1 then (STR ''1'')\n    else if n = 2 then (STR ''2'')\n    else if n = 3 then (STR ''3'')\n    else if n = 4 then (STR ''4'')\n    else if n = 5 then (STR ''5'')\n    else if n = 6 then (STR ''6'')\n    else if n = 7 then (STR ''7'')\n    else if n = 8 then (STR ''8'')\n    else (STR ''9''))\"\n\nabbreviation newline :: String.literal where\n  \"newline \\<equiv> STR ''\\010''\"\n\nabbreviation quote :: String.literal where\n  \"quote \\<equiv> STR ''\\\"''\"\n\ndefinition shows_string :: \"String.literal \\<Rightarrow> String.literal \\<Rightarrow> String.literal\"\nwhere\n  \"shows_string = (+)\"\n\nfun showsp_nat :: \"String.literal \\<Rightarrow> nat \\<Rightarrow> String.literal \\<Rightarrow> String.literal\"\nwhere\n  \"showsp_nat p n =\n    (if n < 10 then shows_string (string_of_digit n)\n    else showsp_nat p (n div 10) o shows_string (string_of_digit (n mod 10)))\"\ndeclare showsp_nat.simps [simp del]\n\ndefinition showsp_int :: \"String.literal \\<Rightarrow> int \\<Rightarrow> String.literal \\<Rightarrow> String.literal\"\nwhere\n  \"showsp_int p i =\n    (if i < 0 then shows_string STR ''-'' o showsp_nat p (nat (- i)) else showsp_nat p (nat i))\"\n\ndefinition \"show_int n  \\<equiv> showsp_int ((STR '''')) n ((STR ''''))\"\ndefinition \"show_nat n  \\<equiv> showsp_nat ((STR '''')) n ((STR ''''))\"\n\ndefinition replace_backslash :: \"String.literal \\<Rightarrow> String.literal\" where\n  \"replace_backslash s = String.implode (fold (@) (map (\\<lambda>x. if x = CHR 0x5c then [CHR 0x5c,CHR 0x5c] else [x]) (String.explode s)) '''')\"\n\ncode_printing\n  constant replace_backslash \\<rightharpoonup> (Scala) \"_.replace(\\\"\\\\\\\\\\\", \\\"\\\\\\\\\\\\\\\\\\\")\"\n\nfun value2dot :: \"value \\<Rightarrow> String.literal\" where\n  \"value2dot (value.Str s) = quote + replace_backslash s + quote\" |\n  \"value2dot (Num n) = show_int n\"\n\nfun vname2dot :: \"vname \\<Rightarrow> String.literal\" where\n  \"vname2dot (vname.I n) = STR ''i<sub>''+(show_nat (n))+STR ''</sub>''\" |\n  \"vname2dot (R n) = STR ''r<sub>''+(show_nat n)+STR ''</sub>''\"\n\nfun aexp2dot :: \"vname aexp \\<Rightarrow> String.literal\" where\n  \"aexp2dot (L v) = value2dot v\" |\n  \"aexp2dot (V v) = vname2dot v\" |\n  \"aexp2dot (Plus a1 a2) = (aexp2dot a1)+STR '' + ''+(aexp2dot a2)\" |\n  \"aexp2dot (Minus a1 a2) = (aexp2dot a1)+STR '' - ''+(aexp2dot a2)\" |\n  \"aexp2dot (Times a1 a2) = (aexp2dot a1)+STR '' &times; ''+(aexp2dot a2)\"\n\nfun join :: \"String.literal list \\<Rightarrow> String.literal \\<Rightarrow> String.literal\" where\n  \"join [] _ = (STR '''')\" |\n  \"join [a] _ = a\" |\n  \"join (h#t) s = h+s+(join t s)\"\n\ndefinition show_nats :: \"nat list \\<Rightarrow> String.literal\" where\n  \"show_nats l = join (map show_nat l) STR '', ''\"\n\nfun gexp2dot :: \"vname gexp \\<Rightarrow> String.literal\" where\n  \"gexp2dot (GExp.Bc True) = (STR ''True'')\" |\n  \"gexp2dot (GExp.Bc False) = (STR ''False'')\" |\n  \"gexp2dot (GExp.Eq a1 a2) = (aexp2dot a1)+STR '' = ''+(aexp2dot a2)\" |\n  \"gexp2dot (GExp.Gt a1 a2) = (aexp2dot a1)+STR '' &gt; ''+(aexp2dot a2)\" |\n  \"gexp2dot (GExp.In v l) = (vname2dot v)+STR ''&isin;{''+(join (map value2dot l) STR '', '')+STR ''}''\" |\n  \"gexp2dot (Nor g1 g2) = STR ''!(''+(gexp2dot g1)+STR ''&or;''+(gexp2dot g2)+STR '')''\"\n\nprimrec guards2dot_aux :: \"vname gexp list \\<Rightarrow> String.literal list\" where\n  \"guards2dot_aux [] = []\" |\n  \"guards2dot_aux (h#t) = (gexp2dot h)#(guards2dot_aux t)\"\n\nlemma gexp2dot_aux_code [code]: \"guards2dot_aux l = map gexp2dot l\"\n  by (induct l, simp_all)\n\nprimrec updates2dot_aux :: \"update_function list \\<Rightarrow> String.literal list\" where\n  \"updates2dot_aux [] = []\" |\n  \"updates2dot_aux (h#t) = ((vname2dot (R (fst h)))+STR '' := ''+(aexp2dot (snd h)))#(updates2dot_aux t)\"\n\nlemma updates2dot_aux_code [code]:\n  \"updates2dot_aux l = map (\\<lambda>(r, u). (vname2dot (R r))+STR '' := ''+(aexp2dot u)) l\"\n  by (induct l, auto)\n\nprimrec outputs2dot :: \"output_function list \\<Rightarrow> nat \\<Rightarrow> String.literal list\" where\n  \"outputs2dot [] _ = []\" |\n  \"outputs2dot (h#t) n = ((STR ''o<sub>''+(show_nat n))+STR ''</sub> := ''+(aexp2dot h))#(outputs2dot t (n+1))\"\n\nfun updates2dot :: \"update_function list \\<Rightarrow> String.literal\" where\n  \"updates2dot [] = (STR '''')\" |\n  \"updates2dot a = STR ''&#91;''+(join (updates2dot_aux a) STR '', '')+STR ''&#93;''\"\n\nfun guards2dot :: \"vname gexp list \\<Rightarrow> String.literal\" where\n  \"guards2dot [] = (STR '''')\" |\n  \"guards2dot a = STR ''&#91;''+(join (guards2dot_aux a) STR '', '')+STR ''&#93;''\"\n\ndefinition latter2dot :: \"transition \\<Rightarrow> String.literal\" where\n  \"latter2dot t = (let l = (join (outputs2dot (Outputs t) 1) STR '', '')+(updates2dot (Updates t)) in (if l = (STR '''') then (STR '''') else STR ''/''+l))\"\n\ndefinition transition2dot :: \"transition \\<Rightarrow> String.literal\" where\n  \"transition2dot t = (Label t)+STR '':''+(show_nat (Arity t))+(guards2dot (Guards t))+(latter2dot t)\"\n\ndefinition efsm2dot :: \"transition_matrix \\<Rightarrow> String.literal\" where\n  \"efsm2dot e = STR ''digraph EFSM{''+newline+\n                STR ''  graph [rankdir=''+quote+(STR ''LR'')+quote+STR '', fontname=''+quote+STR ''Latin Modern Math''+quote+STR ''];''+newline+\n                STR ''  node [color=''+quote+(STR ''black'')+quote+STR '', fillcolor=''+quote+(STR ''white'')+quote+STR '', shape=''+quote+(STR ''circle'')+quote+STR '', style=''+quote+(STR ''filled'')+quote+STR '', fontname=''+quote+STR ''Latin Modern Math''+quote+STR ''];''+newline+\n                STR ''  edge [fontname=''+quote+STR ''Latin Modern Math''+quote+STR ''];''+newline+newline+\n                  STR ''  s0[fillcolor=''+quote+STR ''gray''+quote+STR '', label=<s<sub>0</sub>>];''+newline+\n                  (join (map (\\<lambda>s. STR ''  s''+show_nat s+STR ''[label=<s<sub>'' +show_nat s+ STR ''</sub>>];'') (sorted_list_of_fset (EFSM.S e - {|0|}))) (newline))+newline+newline+\n                  (join ((map (\\<lambda>((from, to), t). STR ''  s''+(show_nat from)+STR ''->s''+(show_nat to)+STR ''[label=<<i>''+(transition2dot t)+STR ''</i>>];'') (sorted_list_of_fset e))) newline)+newline+\n                STR ''}''\"\n\ndefinition iefsm2dot :: \"iEFSM \\<Rightarrow> String.literal\" where\n  \"iefsm2dot e = STR ''digraph EFSM{''+newline+\n                 STR ''  graph [rankdir=''+quote+(STR ''LR'')+quote+STR '', fontname=''+quote+STR ''Latin Modern Math''+quote+STR ''];''+newline+\n                 STR ''  node [color=''+quote+(STR ''black'')+quote+STR '', fillcolor=''+quote+(STR ''white'')+quote+STR '', shape=''+quote+(STR ''circle'')+quote+STR '', style=''+quote+(STR ''filled'')+quote+STR '', fontname=''+quote+STR ''Latin Modern Math''+quote+STR ''];''+newline+\n                 STR ''  edge [fontname=''+quote+STR ''Latin Modern Math''+quote+STR ''];''+newline+newline+\n                  STR ''  s0[fillcolor=''+quote+STR ''gray''+quote+STR '', label=<s<sub>0</sub>>];''+newline+\n                  (join (map (\\<lambda>s. STR ''  s''+show_nat s+STR ''[label=<s<sub>'' +show_nat s+ STR ''</sub>>];'') (sorted_list_of_fset (S e - {|0|}))) (newline))+newline+newline+\n                  (join ((map (\\<lambda>(uid, (from, to), t). STR ''  s''+(show_nat from)+STR ''->s''+(show_nat to)+STR ''[label=<<i> [''+show_nats (sort uid)+STR '']''+(transition2dot t)+STR ''</i>>];'') (sorted_list_of_fset e))) newline)+newline+\n                STR ''}''\"\n\nabbreviation newline_str :: string where\n  \"newline_str \\<equiv> ''\\010''\"\n\nabbreviation quote_str :: string where\n  \"quote_str \\<equiv> ''0x22''\"\nend\n", "meta": {"author": "logicalhacking", "repo": "Extended_Finite_State_Machine_Inference", "sha": "d5c6f8533a2c43c00bcea5c2cc18ad6abf150a37", "save_path": "github-repos/isabelle/logicalhacking-Extended_Finite_State_Machine_Inference", "path": "github-repos/isabelle/logicalhacking-Extended_Finite_State_Machine_Inference/Extended_Finite_State_Machine_Inference-d5c6f8533a2c43c00bcea5c2cc18ad6abf150a37/Extended_Finite_State_Machine_Inference/EFSM_Dot.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.6334102775181399, "lm_q1q2_score": 0.3265989539119952}}
{"text": "(*\n * Copyright 2018, Data61, CSIRO\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(DATA61_BSD)\n *)\n\ntheory Trace_Schematic_Insts_Test\nimports\n  Lib.Trace_Schematic_Insts\nbegin\n\ntext \\<open>\n  Trace the schematic variables and types that a method instantiates.\n  This only works for the variables already in the proof goal; new\n  variables introduced by the traced method are not tracked.\n\\<close>\n\nexperiment begin\nsection \\<open>Examples\\<close>\n\ntext \\<open>Schematic variables\\<close>\nlemma \"\\<lbrakk> \\<forall>x. P x \\<rbrakk> \\<Longrightarrow> P x\"\n  apply (drule spec) \\<comment> \\<open>introduces schematic var \"?x\"\\<close>\n  apply (trace_schematic_insts \\<open>assumption\\<close>)\n  done\n\ndefinition foo :: \"'a \\<Rightarrow> bool\"\n  where \"foo x = True\"\n\nlemma fooI1:\n  \"foo 0 \\<Longrightarrow> foo x\"\n  by (simp add: foo_def)\n\nlemma fooI2:\n  \"foo x \\<Longrightarrow> foo 0\"\n  by (simp add: foo_def)\n\nlemma fooI2':\n  \"foo x \\<Longrightarrow> foo (0 :: nat)\"\n  by (erule fooI2)\n\ntext \\<open>Schematic type variables\\<close>\nlemma \"foo x \\<Longrightarrow> foo y\"\n  apply (rule fooI1) \\<comment> \\<open>introduces schematic type \"0 :: ?'a\"\\<close>\n  apply (trace_schematic_insts \\<open>erule fooI2'\\<close>)\n  done\n\ntext \\<open>When backtracking, every recursive invocation is traced\\<close>\nlemma \"\\<lbrakk> \\<forall>x. Q x \\<longrightarrow> R x; \\<forall>x. P x \\<longrightarrow> Q x; P x; P y \\<longrightarrow> R x \\<rbrakk> \\<Longrightarrow> R x\"\n  apply (drule spec)\n  apply (drule spec)\n  text \\<open>For more clarity, methods can be named\\<close>\n  apply (trace_schematic_insts impE1 \\<open>erule impE\\<close>,\n         trace_schematic_insts impE2 \\<open>erule impE\\<close>,\n         (trace_schematic_insts \"try assumption\" \\<open>assumption\\<close>)+; fail)\n  done\n\n\nsection \\<open>Tests\\<close>\n\nML \\<open>\nfun trace_schematic_assert ctxt test_name tac expected_vars expected_tvars =\n  let\n    fun skip_dummy_state tac = fn st =>\n        case Thm.prop_of st of\n            Const (@{const_name Pure.prop}, _) $\n              (Const (@{const_name Pure.term}, _) $ Const (@{const_name Pure.dummy_pattern}, _)) =>\n              Seq.succeed st\n          | _ => tac st\n\n    fun check var_insts tvar_insts =\n      if expected_vars = var_insts andalso expected_tvars = tvar_insts then () else\n        error (\"Trace_Schematic_Insts failed test: \" ^ test_name)\n\n  in Method.NO_CONTEXT_TACTIC ctxt\n        (Trace_Schematic_Insts.trace_schematic_insts (SIMPLE_METHOD tac) check [])\n     |> skip_dummy_state\n  end\n\\<close>\n\ntext \\<open>Schematic variables\\<close>\nlemma \"\\<lbrakk> \\<forall>x. P x \\<rbrakk> \\<Longrightarrow> P x\"\n  apply (drule spec)\n  apply (tactic \\<open>let\n      val alpha = TFree (\"'a\", @{sort type})\n      val expected_vars = [(Var ((\"x\", 0), alpha), Free (\"x\", alpha))]\n      val expected_tvars = []\n      in trace_schematic_assert @{context}\n            \"basic Var test\" (assume_tac @{context} 1)\n            expected_vars expected_tvars\n      end\\<close>)\n  done\n\ntext \\<open>Schematic type variables\\<close>\nlemma \"foo x \\<Longrightarrow> foo y\"\n  apply (rule fooI1)\n  apply (tactic \\<open>let\n      val expected_vars = []\n      val expected_tvars = [(TVar ((\"'a\", 0), @{sort zero}), @{typ nat})]\n      in trace_schematic_assert\n            @{context}\n            \"basic TVar test\"\n            (eresolve_tac @{context} @{thms fooI2'} 1)\n            expected_vars expected_tvars\n      end\\<close>)\n  done\n\nend\n\nend", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/lib/Trace_Schematic_Insts_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.6334102636778401, "lm_q1q2_score": 0.32659894677566104}}
{"text": "section {* Generation of Verification Conditions *}\n\ntheory OG_Tactics\nimports OG_Hoare\nbegin\n\nlemmas ann_hoare_intros=AnnBasic AnnSeq AnnCond1 AnnCond2 AnnWhile AnnAwait AnnConseq\nlemmas oghoare_intros=Parallel Basic Seq Cond While Conseq\n\nlemma ParallelConseqRule: \n \"\\<lbrakk> p \\<subseteq> (\\<Inter>i\\<in>{i. i<length Ts}. pre(the(com(Ts ! i))));  \n  \\<parallel>- (\\<Inter>i\\<in>{i. i<length Ts}. pre(the(com(Ts ! i)))) \n      (Parallel Ts) \n     (\\<Inter>i\\<in>{i. i<length Ts}. post(Ts ! i));  \n  (\\<Inter>i\\<in>{i. i<length Ts}. post(Ts ! i)) \\<subseteq> q \\<rbrakk>  \n  \\<Longrightarrow> \\<parallel>- p (Parallel Ts) q\"\napply (rule Conseq)\nprefer 2 \n apply fast\napply assumption+\ndone\n\nlemma SkipRule: \"p \\<subseteq> q \\<Longrightarrow> \\<parallel>- p (Basic id) q\"\napply(rule oghoare_intros)\n  prefer 2 apply(rule Basic)\n prefer 2 apply(rule subset_refl)\napply(simp add:Id_def)\ndone\n\nlemma BasicRule: \"p \\<subseteq> {s. (f s)\\<in>q} \\<Longrightarrow> \\<parallel>- p (Basic f) q\"\napply(rule oghoare_intros)\n  prefer 2 apply(rule oghoare_intros)\n prefer 2 apply(rule subset_refl)\napply assumption\ndone\n\nlemma SeqRule: \"\\<lbrakk> \\<parallel>- p c1 r; \\<parallel>- r c2 q \\<rbrakk> \\<Longrightarrow> \\<parallel>- p (Seq c1 c2) q\"\napply(rule Seq)\napply fast+\ndone\n\nlemma CondRule: \n \"\\<lbrakk> p \\<subseteq> {s. (s\\<in>b \\<longrightarrow> s\\<in>w) \\<and> (s\\<notin>b \\<longrightarrow> s\\<in>w')}; \\<parallel>- w c1 q; \\<parallel>- w' c2 q \\<rbrakk> \n  \\<Longrightarrow> \\<parallel>- p (Cond b c1 c2) q\"\napply(rule Cond)\n apply(rule Conseq)\n prefer 4 apply(rule Conseq)\napply simp_all\napply force+\ndone\n\nlemma WhileRule: \"\\<lbrakk> p \\<subseteq> i; \\<parallel>- (i \\<inter> b) c i ; (i \\<inter> (-b)) \\<subseteq> q \\<rbrakk>  \n        \\<Longrightarrow> \\<parallel>- p (While b i c) q\"\napply(rule Conseq)\n prefer 2 apply(rule While)\napply assumption+\ndone\n\ntext {* Three new proof rules for special instances of the @{text\nAnnBasic} and the @{text AnnAwait} commands when the transformation\nperformed on the state is the identity, and for an @{text AnnAwait}\ncommand where the boolean condition is @{text \"{s. True}\"}: *}\n\nlemma AnnatomRule:\n  \"\\<lbrakk> atom_com(c); \\<parallel>- r c q \\<rbrakk>  \\<Longrightarrow> \\<turnstile> (AnnAwait r {s. True} c) q\"\napply(rule AnnAwait)\napply simp_all\ndone\n\nlemma AnnskipRule:\n  \"r \\<subseteq> q \\<Longrightarrow> \\<turnstile> (AnnBasic r id) q\"\napply(rule AnnBasic)\napply simp\ndone\n\nlemma AnnwaitRule:\n  \"\\<lbrakk> (r \\<inter> b) \\<subseteq> q \\<rbrakk> \\<Longrightarrow> \\<turnstile> (AnnAwait r b (Basic id)) q\"\napply(rule AnnAwait)\n apply simp\napply(rule BasicRule)\napply simp\ndone\n\ntext {* Lemmata to avoid using the definition of @{text\nmap_ann_hoare}, @{text interfree_aux}, @{text interfree_swap} and\n@{text interfree} by splitting it into different cases: *}\n\nlemma interfree_aux_rule1: \"interfree_aux(co, q, None)\"\nby(simp add:interfree_aux_def)\n\nlemma interfree_aux_rule2: \n  \"\\<forall>(R,r)\\<in>(atomics a). \\<parallel>- (q \\<inter> R) r q \\<Longrightarrow> interfree_aux(None, q, Some a)\"\napply(simp add:interfree_aux_def)\napply(force elim:oghoare_sound)\ndone\n\nlemma interfree_aux_rule3: \n  \"(\\<forall>(R, r)\\<in>(atomics a). \\<parallel>- (q \\<inter> R) r q \\<and> (\\<forall>p\\<in>(assertions c). \\<parallel>- (p \\<inter> R) r p))\n  \\<Longrightarrow> interfree_aux(Some c, q, Some a)\"\napply(simp add:interfree_aux_def)\napply(force elim:oghoare_sound)\ndone\n\nlemma AnnBasic_assertions: \n  \"\\<lbrakk>interfree_aux(None, r, Some a); interfree_aux(None, q, Some a)\\<rbrakk> \\<Longrightarrow> \n    interfree_aux(Some (AnnBasic r f), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnSeq_assertions: \n  \"\\<lbrakk> interfree_aux(Some c1, q, Some a); interfree_aux(Some c2, q, Some a)\\<rbrakk>\\<Longrightarrow> \n   interfree_aux(Some (AnnSeq c1 c2), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnCond1_assertions: \n  \"\\<lbrakk> interfree_aux(None, r, Some a); interfree_aux(Some c1, q, Some a); \n  interfree_aux(Some c2, q, Some a)\\<rbrakk>\\<Longrightarrow> \n  interfree_aux(Some(AnnCond1 r b c1 c2), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnCond2_assertions: \n  \"\\<lbrakk> interfree_aux(None, r, Some a); interfree_aux(Some c, q, Some a)\\<rbrakk>\\<Longrightarrow> \n  interfree_aux(Some (AnnCond2 r b c), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnWhile_assertions: \n  \"\\<lbrakk> interfree_aux(None, r, Some a); interfree_aux(None, i, Some a); \n  interfree_aux(Some c, q, Some a)\\<rbrakk>\\<Longrightarrow> \n  interfree_aux(Some (AnnWhile r b i c), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n \nlemma AnnAwait_assertions: \n  \"\\<lbrakk> interfree_aux(None, r, Some a); interfree_aux(None, q, Some a)\\<rbrakk>\\<Longrightarrow> \n  interfree_aux(Some (AnnAwait r b c), q, Some a)\"\napply(simp add: interfree_aux_def)\nby force\n \nlemma AnnBasic_atomics: \n  \"\\<parallel>- (q \\<inter> r) (Basic f) q \\<Longrightarrow> interfree_aux(None, q, Some (AnnBasic r f))\"\nby(simp add: interfree_aux_def oghoare_sound)\n\nlemma AnnSeq_atomics: \n  \"\\<lbrakk> interfree_aux(Any, q, Some a1); interfree_aux(Any, q, Some a2)\\<rbrakk>\\<Longrightarrow> \n  interfree_aux(Any, q, Some (AnnSeq a1 a2))\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnCond1_atomics:\n  \"\\<lbrakk> interfree_aux(Any, q, Some a1); interfree_aux(Any, q, Some a2)\\<rbrakk>\\<Longrightarrow> \n   interfree_aux(Any, q, Some (AnnCond1 r b a1 a2))\"\napply(simp add: interfree_aux_def)\nby force\n\nlemma AnnCond2_atomics: \n  \"interfree_aux (Any, q, Some a)\\<Longrightarrow> interfree_aux(Any, q, Some (AnnCond2 r b a))\"\nby(simp add: interfree_aux_def)\n\nlemma AnnWhile_atomics: \"interfree_aux (Any, q, Some a) \n     \\<Longrightarrow> interfree_aux(Any, q, Some (AnnWhile r b i a))\"\nby(simp add: interfree_aux_def)\n\nlemma Annatom_atomics: \n  \"\\<parallel>- (q \\<inter> r) a q \\<Longrightarrow> interfree_aux (None, q, Some (AnnAwait r {x. True} a))\"\nby(simp add: interfree_aux_def oghoare_sound) \n\nlemma AnnAwait_atomics: \n  \"\\<parallel>- (q \\<inter> (r \\<inter> b)) a q \\<Longrightarrow> interfree_aux (None, q, Some (AnnAwait r b a))\"\nby(simp add: interfree_aux_def oghoare_sound)\n\ndefinition interfree_swap :: \"('a ann_triple_op * ('a ann_triple_op) list) \\<Rightarrow> bool\" where\n  \"interfree_swap == \\<lambda>(x, xs). \\<forall>y\\<in>set xs. interfree_aux (com x, post x, com y)\n  \\<and> interfree_aux(com y, post y, com x)\"\n\nlemma interfree_swap_Empty: \"interfree_swap (x, [])\"\nby(simp add:interfree_swap_def)\n\nlemma interfree_swap_List:  \n  \"\\<lbrakk> interfree_aux (com x, post x, com y); \n  interfree_aux (com y, post y ,com x); interfree_swap (x, xs) \\<rbrakk> \n  \\<Longrightarrow> interfree_swap (x, y#xs)\"\nby(simp add:interfree_swap_def)\n\nlemma interfree_swap_Map: \"\\<forall>k. i\\<le>k \\<and> k<j \\<longrightarrow> interfree_aux (com x, post x, c k) \n \\<and> interfree_aux (c k, Q k, com x)   \n \\<Longrightarrow> interfree_swap (x, map (\\<lambda>k. (c k, Q k)) [i..<j])\"\nby(force simp add: interfree_swap_def less_diff_conv)\n\nlemma interfree_Empty: \"interfree []\"\nby(simp add:interfree_def)\n\nlemma interfree_List: \n  \"\\<lbrakk> interfree_swap(x, xs); interfree xs \\<rbrakk> \\<Longrightarrow> interfree (x#xs)\"\napply(simp add:interfree_def interfree_swap_def)\napply clarify\napply(case_tac i)\n apply(case_tac j)\n  apply simp_all\napply(case_tac j,simp+)\ndone\n\nlemma interfree_Map: \n  \"(\\<forall>i j. a\\<le>i \\<and> i<b \\<and> a\\<le>j \\<and> j<b  \\<and> i\\<noteq>j \\<longrightarrow> interfree_aux (c i, Q i, c j))  \n  \\<Longrightarrow> interfree (map (\\<lambda>k. (c k, Q k)) [a..<b])\"\nby(force simp add: interfree_def less_diff_conv)\n\ndefinition map_ann_hoare :: \"(('a ann_com_op * 'a assn) list) \\<Rightarrow> bool \" (\"[\\<turnstile>] _\" [0] 45) where\n  \"[\\<turnstile>] Ts == (\\<forall>i<length Ts. \\<exists>c q. Ts!i=(Some c, q) \\<and> \\<turnstile> c q)\"\n\nlemma MapAnnEmpty: \"[\\<turnstile>] []\"\nby(simp add:map_ann_hoare_def)\n\nlemma MapAnnList: \"\\<lbrakk> \\<turnstile> c q ; [\\<turnstile>] xs \\<rbrakk> \\<Longrightarrow> [\\<turnstile>] (Some c,q)#xs\"\napply(simp add:map_ann_hoare_def)\napply clarify\napply(case_tac i,simp+)\ndone\n\nlemma MapAnnMap: \n  \"\\<forall>k. i\\<le>k \\<and> k<j \\<longrightarrow> \\<turnstile> (c k) (Q k) \\<Longrightarrow> [\\<turnstile>] map (\\<lambda>k. (Some (c k), Q k)) [i..<j]\"\napply(simp add: map_ann_hoare_def less_diff_conv)\ndone\n\nlemma ParallelRule:\"\\<lbrakk> [\\<turnstile>] Ts ; interfree Ts \\<rbrakk>\n  \\<Longrightarrow> \\<parallel>- (\\<Inter>i\\<in>{i. i<length Ts}. pre(the(com(Ts!i)))) \n          Parallel Ts \n        (\\<Inter>i\\<in>{i. i<length Ts}. post(Ts!i))\"\napply(rule Parallel)\n apply(simp add:map_ann_hoare_def)\napply simp\ndone\n(*\nlemma ParamParallelRule:\n \"\\<lbrakk> \\<forall>k<n. \\<turnstile> (c k) (Q k); \n   \\<forall>k l. k<n \\<and> l<n  \\<and> k\\<noteq>l \\<longrightarrow> interfree_aux (Some(c k), Q k, Some(c l)) \\<rbrakk>\n  \\<Longrightarrow> \\<parallel>- (\\<Inter>i\\<in>{i. i<n} . pre(c i)) COBEGIN SCHEME [0\\<le>i<n] (c i) (Q i) COEND  (\\<Inter>i\\<in>{i. i<n} . Q i )\"\napply(rule ParallelConseqRule)\n  apply simp\n  apply clarify\n  apply force\n apply(rule ParallelRule)\n  apply(rule MapAnnMap)\n  apply simp\n apply(rule interfree_Map)\n apply simp\napply simp\napply clarify\napply force\ndone\n*)\n\ntext {* The following are some useful lemmas and simplification\ntactics to control which theorems are used to simplify at each moment,\nso that the original input does not suffer any unexpected\ntransformation. *}\n\nlemma Compl_Collect: \"-(Collect b) = {x. \\<not>(b x)}\"\n  by fast\n\nlemma list_length: \"length []=0\" \"length (x#xs) = Suc(length xs)\"\n  by simp_all\nlemma list_lemmas: \"length []=0\" \"length (x#xs) = Suc(length xs)\"\n    \"(x#xs) ! 0 = x\" \"(x#xs) ! Suc n = xs ! n\"\n  by simp_all\nlemma le_Suc_eq_insert: \"{i. i <Suc n} = insert n {i. i< n}\"\n  by auto\nlemmas primrecdef_list = \"pre.simps\" \"assertions.simps\" \"atomics.simps\" \"atom_com.simps\"\nlemmas my_simp_list = list_lemmas fst_conv snd_conv\nnot_less0 refl le_Suc_eq_insert Suc_not_Zero Zero_not_Suc nat.inject\nCollect_mem_eq ball_simps option.simps primrecdef_list\nlemmas ParallelConseq_list = INTER_eq Collect_conj_eq length_map length_upt length_append\n\nML {*\nfun before_interfree_simp_tac ctxt =\n  simp_tac (put_simpset HOL_basic_ss ctxt addsimps [@{thm com.simps}, @{thm post.simps}])\n\nfun interfree_simp_tac ctxt =\n  asm_simp_tac (put_simpset HOL_ss ctxt\n    addsimps [@{thm split}, @{thm ball_Un}, @{thm ball_empty}] @ @{thms my_simp_list})\n\nfun ParallelConseq ctxt =\n  simp_tac (put_simpset HOL_basic_ss ctxt\n    addsimps @{thms ParallelConseq_list} @ @{thms my_simp_list})\n*}\n\ntext {* The following tactic applies @{text tac} to each conjunct in a\nsubgoal of the form @{text \"A \\<Longrightarrow> a1 \\<and> a2 \\<and> .. \\<and> an\"}  returning\n@{text n} subgoals, one for each conjunct: *}\n\nML {*\nfun conjI_Tac tac i st = st |>\n       ( (EVERY [rtac conjI i,\n          conjI_Tac tac (i+1),\n          tac i]) ORELSE (tac i) )\n*}\n\n\nsubsubsection {* Tactic for the generation of the verification conditions *} \n\ntext {* The tactic basically uses two subtactics:\n\n\\begin{description}\n\n\\item[HoareRuleTac] is called at the level of parallel programs, it        \n uses the ParallelTac to solve parallel composition of programs.         \n This verification has two parts, namely, (1) all component programs are \n correct and (2) they are interference free.  @{text HoareRuleTac} is\n also called at the level of atomic regions, i.e.  @{text \"\\<langle> \\<rangle>\"} and\n @{text \"AWAIT b THEN _ END\"}, and at each interference freedom test.\n\n\\item[AnnHoareRuleTac] is for component programs which  \n are annotated programs and so, there are not unknown assertions         \n (no need to use the parameter precond, see NOTE).\n\n NOTE: precond(::bool) informs if the subgoal has the form @{text \"\\<parallel>- ?p c q\"},\n in this case we have precond=False and the generated  verification     \n condition would have the form @{text \"?p \\<subseteq> \\<dots>\"} which can be solved by        \n @{text \"rtac subset_refl\"}, if True we proceed to simplify it using\n the simplification tactics above.\n\n\\end{description}\n*}\n\nML {*\n\nfun WlpTac ctxt i = (rtac (@{thm SeqRule}) i) THEN (HoareRuleTac ctxt false (i+1))\nand HoareRuleTac ctxt precond i st = st |>  \n    ( (WlpTac ctxt i THEN HoareRuleTac ctxt precond i)\n      ORELSE\n      (FIRST[rtac (@{thm SkipRule}) i,\n             rtac (@{thm BasicRule}) i,\n             EVERY[rtac (@{thm ParallelConseqRule}) i,\n                   ParallelConseq ctxt (i+2),\n                   ParallelTac ctxt (i+1),\n                   ParallelConseq ctxt i], \n             EVERY[rtac (@{thm CondRule}) i,\n                   HoareRuleTac ctxt false (i+2),\n                   HoareRuleTac ctxt false (i+1)],\n             EVERY[rtac (@{thm WhileRule}) i,\n                   HoareRuleTac ctxt true (i+1)],\n             K all_tac i ]\n       THEN (if precond then (K all_tac i) else (rtac (@{thm subset_refl}) i))))\n\nand AnnWlpTac ctxt i = (rtac (@{thm AnnSeq}) i) THEN (AnnHoareRuleTac ctxt (i+1))\nand AnnHoareRuleTac ctxt i st = st |>  \n    ( (AnnWlpTac ctxt i THEN AnnHoareRuleTac ctxt i )\n     ORELSE\n      (FIRST[(rtac (@{thm AnnskipRule}) i),\n             EVERY[rtac (@{thm AnnatomRule}) i,\n                   HoareRuleTac ctxt true (i+1)],\n             (rtac (@{thm AnnwaitRule}) i),\n             rtac (@{thm AnnBasic}) i,\n             EVERY[rtac (@{thm AnnCond1}) i,\n                   AnnHoareRuleTac ctxt (i+3),\n                   AnnHoareRuleTac ctxt (i+1)],\n             EVERY[rtac (@{thm AnnCond2}) i,\n                   AnnHoareRuleTac ctxt (i+1)],\n             EVERY[rtac (@{thm AnnWhile}) i,\n                   AnnHoareRuleTac ctxt (i+2)],\n             EVERY[rtac (@{thm AnnAwait}) i,\n                   HoareRuleTac ctxt true (i+1)],\n             K all_tac i]))\n\nand ParallelTac ctxt i = EVERY[rtac (@{thm ParallelRule}) i,\n                          interfree_Tac ctxt (i+1),\n                           MapAnn_Tac ctxt i]\n\nand MapAnn_Tac ctxt i st = st |>\n    (FIRST[rtac (@{thm MapAnnEmpty}) i,\n           EVERY[rtac (@{thm MapAnnList}) i,\n                 MapAnn_Tac ctxt (i+1),\n                 AnnHoareRuleTac ctxt i],\n           EVERY[rtac (@{thm MapAnnMap}) i,\n                 rtac (@{thm allI}) i, rtac (@{thm impI}) i,\n                 AnnHoareRuleTac ctxt i]])\n\nand interfree_swap_Tac ctxt i st = st |>\n    (FIRST[rtac (@{thm interfree_swap_Empty}) i,\n           EVERY[rtac (@{thm interfree_swap_List}) i,\n                 interfree_swap_Tac ctxt (i+2),\n                 interfree_aux_Tac ctxt (i+1),\n                 interfree_aux_Tac ctxt i ],\n           EVERY[rtac (@{thm interfree_swap_Map}) i,\n                 rtac (@{thm allI}) i,rtac (@{thm impI}) i,\n                 conjI_Tac (interfree_aux_Tac ctxt) i]])\n\nand interfree_Tac ctxt i st = st |> \n   (FIRST[rtac (@{thm interfree_Empty}) i,\n          EVERY[rtac (@{thm interfree_List}) i,\n                interfree_Tac ctxt (i+1),\n                interfree_swap_Tac ctxt i],\n          EVERY[rtac (@{thm interfree_Map}) i,\n                rtac (@{thm allI}) i,rtac (@{thm allI}) i,rtac (@{thm impI}) i,\n                interfree_aux_Tac ctxt i ]])\n\nand interfree_aux_Tac ctxt i = (before_interfree_simp_tac ctxt i ) THEN \n        (FIRST[rtac (@{thm interfree_aux_rule1}) i,\n               dest_assertions_Tac ctxt i])\n\nand dest_assertions_Tac ctxt i st = st |>\n    (FIRST[EVERY[rtac (@{thm AnnBasic_assertions}) i,\n                 dest_atomics_Tac ctxt (i+1),\n                 dest_atomics_Tac ctxt i],\n           EVERY[rtac (@{thm AnnSeq_assertions}) i,\n                 dest_assertions_Tac ctxt (i+1),\n                 dest_assertions_Tac ctxt i],\n           EVERY[rtac (@{thm AnnCond1_assertions}) i,\n                 dest_assertions_Tac ctxt (i+2),\n                 dest_assertions_Tac ctxt (i+1),\n                 dest_atomics_Tac ctxt i],\n           EVERY[rtac (@{thm AnnCond2_assertions}) i,\n                 dest_assertions_Tac ctxt (i+1),\n                 dest_atomics_Tac ctxt i],\n           EVERY[rtac (@{thm AnnWhile_assertions}) i,\n                 dest_assertions_Tac ctxt (i+2),\n                 dest_atomics_Tac ctxt (i+1),\n                 dest_atomics_Tac ctxt i],\n           EVERY[rtac (@{thm AnnAwait_assertions}) i,\n                 dest_atomics_Tac ctxt (i+1),\n                 dest_atomics_Tac ctxt i],\n           dest_atomics_Tac ctxt i])\n\nand dest_atomics_Tac ctxt i st = st |>\n    (FIRST[EVERY[rtac (@{thm AnnBasic_atomics}) i,\n                 HoareRuleTac ctxt true i],\n           EVERY[rtac (@{thm AnnSeq_atomics}) i,\n                 dest_atomics_Tac ctxt (i+1),\n                 dest_atomics_Tac ctxt i],\n           EVERY[rtac (@{thm AnnCond1_atomics}) i,\n                 dest_atomics_Tac ctxt (i+1),\n                 dest_atomics_Tac ctxt i],\n           EVERY[rtac (@{thm AnnCond2_atomics}) i,\n                 dest_atomics_Tac ctxt i],\n           EVERY[rtac (@{thm AnnWhile_atomics}) i,\n                 dest_atomics_Tac ctxt i],\n           EVERY[rtac (@{thm Annatom_atomics}) i,\n                 HoareRuleTac ctxt true i],\n           EVERY[rtac (@{thm AnnAwait_atomics}) i,\n                 HoareRuleTac ctxt true i],\n                 K all_tac i])\n*}\n\n\ntext {* The final tactic is given the name @{text oghoare}: *}\n\nML {* \nfun oghoare_tac ctxt = SUBGOAL (fn (_, i) => HoareRuleTac ctxt true i)\n*}\n\ntext {* Notice that the tactic for parallel programs @{text\n\"oghoare_tac\"} is initially invoked with the value @{text true} for\nthe parameter @{text precond}.\n\nParts of the tactic can be also individually used to generate the\nverification conditions for annotated sequential programs and to\ngenerate verification conditions out of interference freedom tests: *}\n\nML {*\nfun annhoare_tac ctxt = SUBGOAL (fn (_, i) => AnnHoareRuleTac ctxt i)\n\nfun interfree_aux_tac ctxt = SUBGOAL (fn (_, i) => interfree_aux_Tac ctxt i)\n*}\n\ntext {* The so defined ML tactics are then ``exported'' to be used in\nIsabelle proofs. *}\n\nmethod_setup oghoare = {*\n  Scan.succeed (SIMPLE_METHOD' o oghoare_tac) *}\n  \"verification condition generator for the oghoare logic\"\n\nmethod_setup annhoare = {*\n  Scan.succeed (SIMPLE_METHOD' o annhoare_tac) *}\n  \"verification condition generator for the ann_hoare logic\"\n\nmethod_setup interfree_aux = {*\n  Scan.succeed (SIMPLE_METHOD' o interfree_aux_tac) *}\n  \"verification condition generator for interference freedom tests\"\n\ntext {* Tactics useful for dealing with the generated verification conditions: *}\n\nmethod_setup conjI_tac = {*\n  Scan.succeed (K (SIMPLE_METHOD' (conjI_Tac (K all_tac)))) *}\n  \"verification condition generator for interference freedom tests\"\n\nML {*\nfun disjE_Tac tac i st = st |>\n       ( (EVERY [etac disjE i,\n          disjE_Tac tac (i+1),\n          tac i]) ORELSE (tac i) )\n*}\n\nmethod_setup disjE_tac = {*\n  Scan.succeed (K (SIMPLE_METHOD' (disjE_Tac (K all_tac)))) *}\n  \"verification condition generator for interference freedom tests\"\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Hoare_Parallel/OG_Tactics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6334102498375401, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.3265989396393267}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Andreas Lochbihler <andreas dot lochbihler at kit.edu>\n    Maintainer:  Andreas Lochbihler <andreas dot lochbihler at kit.edu>\n*)\nheader {* \\isaheader{Set implementation via tries} *}\ntheory TrieSetImpl imports\n  TrieMapImpl\n  \"../gen_algo/SetByMap\"\n  \"../gen_algo/SetGA\"\nbegin\n\n(*@impl Set\n  @type ('a) ts\n  @abbrv ts,t\n  Sets of elements of type @{typ \"'a list\"} implemented by tries.\n*)\n\nsubsection \"Definitions\"\n\ntype_synonym\n  'a ts = \"('a, unit) trie\"\n\nsetup Locale_Code.open_block\ninterpretation ts_sbm!: SetByMap tm_basic_ops by unfold_locales\nsetup Locale_Code.close_block\n\ndefinition ts_ops :: \"('a list,'a ts) set_ops\"\n  where [icf_rec_def]:\n  \"ts_ops \\<equiv> ts_sbm.basic.dflt_ops\"\n\nsetup Locale_Code.open_block\ninterpretation ts!: StdSet ts_ops\n  unfolding ts_ops_def by (rule ts_sbm.basic.dflt_ops_impl)\ninterpretation ts!: StdSet_no_invar ts_ops\n  by unfold_locales (simp add: icf_rec_unf SetByMapDefs.invar_def)\nsetup Locale_Code.close_block\n\nsetup {* ICF_Tools.revert_abbrevs \"ts\"*}\n\nlemmas ts_it_to_it_map_code_unfold[code_unfold] = \n  it_to_it_map_fold'[OF pi_trie]\n\nlemma pi_ts[proper_it]: \"proper_it' ts.iteratei ts.iteratei\"\n  unfolding ts.iteratei_def[abs_def]\n  by (rule proper_it'I icf_proper_iteratorI)+\n\ninterpretation pi_ts: proper_it_loc ts.iteratei ts.iteratei\n  by unfold_locales (rule pi_ts)\n\ndefinition test_codegen where \"test_codegen \\<equiv> (\n  ts.empty,\n  ts.memb,\n  ts.ins,\n  ts.delete,\n  ts.list_it,\n  ts.sng,\n  ts.isEmpty,\n  ts.isSng,\n  ts.ball,\n  ts.bex,\n  ts.size,\n  ts.size_abort,\n  ts.union,\n  ts.union_dj,\n  ts.diff,\n  ts.filter,\n  ts.inter,\n  ts.subset,\n  ts.equal,\n  ts.disjoint,\n  ts.disjoint_witness,\n  ts.sel,\n  ts.to_list,\n  ts.from_list\n)\"\n\nexport_code test_codegen in SML\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/ICF/impl/TrieSetImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.32652163014698166}}
{"text": "(*  Title:      HOL/Auth/n_mutualEx_base.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n \n\ntheory n_mutualEx_base2 imports paraTheory\nbegin\n\nsection{*Main definitions*}\n\nsubsection{* Definitions of Constants*}\ndefinition I::\"scalrValueType\" where [simp]: \"I\\<equiv> enum ''control'' ''I''\"\ndefinition T::\"scalrValueType\" where [simp]: \"T\\<equiv> enum ''control'' ''T''\"\ndefinition C::\"scalrValueType\" where [simp]: \"C\\<equiv> enum ''control'' ''C''\"\ndefinition E::\"scalrValueType\" where [simp]: \"E\\<equiv> enum ''control'' ''E''\"\ndefinition true::\"scalrValueType\" where [simp]: \"true\\<equiv> boolV True\"\ndefinition false::\"scalrValueType\" where [simp]: \"false\\<equiv> boolV False\"\n\n\n\nsubsection{*  Definitions of Parameterized Rules *}\n\ndefinition  NC::\"nat \" where [simp]: \"NC==1\"\n\n definition n_Try::\"nat \\<Rightarrow> rule\" where [simp]:\n\"n_Try  i\\<equiv>\nlet g = (eqn (IVar (Para (Ident ''n'') i)) (Const I)) in\nlet s = (parallelList [(assign ((Para (Ident ''n'') i), (Const T)))]) in\nguard g s\"\n\ndefinition n_Crit::\"nat \\<Rightarrow> rule\" where [simp]:\n\"n_Crit  i\\<equiv>\nlet g = (andForm (eqn (IVar (Para (Ident ''n'') i)) (Const T)) (eqn (IVar (Ident ''x'')) (Const true))) in\nlet s = (parallelList [(assign ((Para (Ident ''n'') i), (Const C))), (assign ((Ident ''x''), (Const false)))]) in\nguard g s\"\n\ndefinition n_Exit::\"nat \\<Rightarrow> rule\" where [simp]:\n\"n_Exit  i\\<equiv>\nlet g = (eqn (IVar (Para (Ident ''n'') i)) (Const C)) in\nlet s = (parallelList [(assign ((Para (Ident ''n'') i), (Const E)))]) in\nguard g s\"\n\ndefinition n_Idle::\"nat \\<Rightarrow> rule\" where [simp]:\n\"n_Idle  i\\<equiv>\nlet g = (eqn (IVar (Para (Ident ''n'') i)) (Const E)) in\nlet s = (parallelList [(assign ((Para (Ident ''n'') i), (Const I))), (assign ((Ident ''x''), (Const true)))]) in\nguard g s\"\n\ndefinition n_Crit_i_3::\"rule\" where [simp]:\n\"n_Crit_i_3  \\<equiv>\nlet g = (eqn (IVar (Ident ''x'')) (Const true)) in\nlet s = (parallelList [(assign ((Ident ''x''), (Const false)))]) in\nguard g s\"\n\ndefinition n_Idle_i_3::\"nat \\<Rightarrow> rule\" where [simp]:\n\"n_Idle_i_3 N \\<equiv>\nlet g = (andForm (andForm (eqn (IVar (Ident ''x'')) (Const false)) (forallForm (down N) (\\<lambda>j. (neg (eqn (IVar (Para (Ident ''n'') j)) (Const E)))))) (forallForm (down N) (\\<lambda>j. (neg (eqn (IVar (Para (Ident ''n'') j)) (Const C)))))) in\nlet s = (parallelList [(assign ((Ident ''x''), (Const true)))]) in\nguard g s\"\n\nsubsection{*The set of All actual Rules w.r.t. a Protocol Instance with Size $N$*}\ndefinition rules::\"nat \\<Rightarrow> rule set\" where [simp]:\n\"rules N \\<equiv> {r.\n(\\<exists> i. i\\<le>N\\<and>r=n_Try  i) \\<or>\n(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i) \\<or>\n(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i) \\<or>\n(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i) \\<or>\n(r=n_Crit_i_3  ) \\<or>\n(r=n_Idle_i_3 N )\\<or> r=skipRule\n}\"\n\n\n\nsubsection{*Definitions of a Formally Parameterized Invariant Formulas*}\n\ndefinition inv_27::\"nat \\<Rightarrow> formula\" where [simp]:\n\"inv_27 i \\<equiv>\n(implyForm (eqn (IVar (Para (Ident ''n'') i)) (Const E)) (eqn (IVar (Ident ''x'')) (Const false)))\"\n\ndefinition inv_7::\"nat \\<Rightarrow> nat \\<Rightarrow> formula\" where [simp]:\n\"inv_7  i j \\<equiv>\n(implyForm (eqn (IVar (Para (Ident ''n'') i)) (Const E)) (neg (eqn (IVar (Para (Ident ''n'') j)) (Const E))))\"\n\ndefinition inv_5::\"nat \\<Rightarrow> nat \\<Rightarrow> formula\" where [simp]:\n\"inv_5 i j \\<equiv>\n(implyForm (eqn (IVar (Para (Ident ''n'') i)) (Const E)) (neg (eqn (IVar (Para (Ident ''n'') j)) (Const C))))\"\n\nsubsection{*Definitions of  the Set of Invariant Formula Instances in a $N$-protocol Instance*}\ndefinition invariants::\"nat \\<Rightarrow> formula set\" where [simp]:\n\"invariants N \\<equiv> {f.\n(\\<exists> i. i\\<le>N\\<and>f=inv_27  i) \\<or>\n(\\<exists> j i. j\\<le>N\\<and>i\\<le>N\\<and>j~=i\\<and>f=inv_7  j i) \\<or>\n(\\<exists> j i. j\\<le>N\\<and>i\\<le>N\\<and>j~=i\\<and>f=inv_5  j i)\n}\" \n\nsubsection{*Definitions of  the Set of Abs Invariant Formula Instances *}\ndefinition invariantsAbs  ::\"  formula list\" where [simp]:\n\"invariantsAbs   \\<equiv> [\ninv_27 0 ,\ninv_7 0 1 ,\ninv_7 1 0 ,\ninv_5 0 1 ,\ninv_5 1 0\n]\"\n\ndefinition initSpec0::\"nat \\<Rightarrow> formula\" where [simp]:\n\"initSpec0 N \\<equiv> (forallForm (down N) (% i . (eqn (IVar (Para (Ident ''n'') i)) (Const I))))\"\n\ndefinition initSpec1::\"formula\" where [simp]:\n\"initSpec1  \\<equiv> (eqn (IVar (Ident ''x'')) (Const true))\"\n\ndefinition allInitSpecs::\"nat \\<Rightarrow> formula list\" where [simp]:\n\"allInitSpecs N \\<equiv> [\n(initSpec0 N),\n(initSpec1 )\n]\"\naxiomatization  where axiomOnf2 [simp,intro]:\n   \"s ∈ reachableSet (set (allInitSpecs N )) (rules N) ⟹  1 < N ⟹ 1 < i ⟹ j<2 ⟹  formEval (f 0 1) s ⟹ formEval (f i j) s\"\n\naxiomatization  where axiomOnf1 [simp,intro]:\n   \"s ∈ reachableSet (set (allInitSpecs N )) (rules N) ⟹ 1 < N ⟹ 1 < i ⟹formEval (f 0 ) s ⟹ formEval (f i) s\"\n\n\n\n\nsubsection{*Definitions of initial states*}\n\nlemma lemmaOnn_TryGt_i:\n  assumes a1:\"i>NC\" and a2:\"s ∈ reachableSet (set (allInitSpecs N)) (rules N)\"  and  \n  a4:\"∀f.  f ∈(set invariantsAbs) ⟶  formEval f s\" \nshows \"trans_sim_on1 (n_Try i  ) skipRule (set invariantsAbs) s\" (is \"trans_sim_on1 ?r ?r' ?F s\")\nproof(unfold trans_sim_on1_def,(rule allI)+,(rule impI)+,rule disjI2)\n  fix s2 \n  assume b0:\"state_sim_on1 s s2 (set invariantsAbs)\"\n  show \"state_sim_on1 (trans (act (n_Try i)) s) s2 (set invariantsAbs)\"\n  proof(cut_tac a1,unfold state_sim_on1_def,\n    (rule allI)+,(rule impI)+)\n    fix f v\n    assume b1:\" f ∈(set invariantsAbs)\" and b2:\"v ∈ varOfForm f\"  \n\n    have b30: \"(varOfFormList  invariantsAbs) = {v. ∃f. f ∈ set  invariantsAbs∧ v ∈ varOfForm f}\"\n      using setOfList by blast\n      \n     \n    from b1 and b2 and b30 have b4:\"v ∈ (varOfFormList  invariantsAbs)\" by blast\n     \n    from b4 have b5:\"trans (act (n_Try  i)) s v = s v\" \n      by (cut_tac a1  b4  ,auto) \n\n    from b0   have b6:\"s v =s2 v \"\n      using b1 b2 state_sim_on1_def by blast  \n    show \"trans (act (n_Try i)) s v= s2 v\"\n      using b5 b6 by auto \n  qed\nqed\nlemma lemmaOnn_TryLeNc_:\n  assumes a1:\"i\\<le>NC\" \n  shows \"trans_sim_on1 (n_Try i) (n_Try i) (set invariantsAbs) s\" (is \"trans_sim_on1 ?r ?r ?F s\")\nproof(rule ruleSimId)\n  show  \"∀v. v∈varOfForm (pre ?r) ⟶  v ∈(varOfFormList invariantsAbs) \"\n    by(cut_tac a1, auto) \n    \nnext\n  show  b1: \"∀v a. a ∈ set (statement2Assigns (act ?r)) ⟶ v∈varOfExp ( substExpByStatement (IVar (fst a))  (act ?r))⟶v ∈varOfFormList invariantsAbs \"\n   proof(cut_tac a1,(rule allI)+,(rule impI)+,auto) qed\n    \n qed\nlemma lemmaOnn_Try: \n  assumes   a2:\"s ∈ reachableSet (set (allInitSpecs N)) (rules N)\"  and  \n  a4:\"∀f.  f ∈(set invariantsAbs) ⟶  formEval f s\" and a5:\"\\<exists> i. i\\<le>N\\<and>r=n_Try  i\"\n  shows \"∃ r'. r' ∈ rules NC∧ trans_sim_on1 r r' (set invariantsAbs) s\" (is \"∃r'.?P1 r' ∧ ?P2 r'\")\nproof -\n  from a5 obtain i where d0:\"i\\<le>N\\<and>r=n_Try  i\"  by blast\n  have \"i>NC|i\\<le> NC\" by auto\n  moreover{\n       assume a1:\"i>NC\" \n        have \"∃r'. ?P1 r' ∧ ?P2 r'\"\n        proof(rule_tac x=\"(skipRule)\" in exI,rule conjI)\n          show  \"?P1 (skipRule) \" \n           by(cut_tac a1, auto) \n          next\n          show  \"?P2 (skipRule) \"\n           using lemmaOnn_TryGt_i local.a1 a2 a4 d0 by blast \n        qed\n       }\nmoreover{\n       assume a1:\"i\\<le> NC\" \n        have \"∃r'. ?P1 r' ∧ ?P2 r'\"\n        proof(rule_tac x=\"(n_Try i)\" in exI,rule conjI)\n          show  \"?P1 (n_Try i) \" \n           by(cut_tac a1, auto) \n          next\n          show  \"?P2 (n_Try i) \"\n           using lemmaOnn_TryLeNc_ local.a1 a2 a4 d0 by blast \n        qed\n       }\n  ultimately show \"∃r'.?P1 r' ∧ ?P2 r'\" \n    by satx\nqed\n\nlemma lemmaOnn_CritGt_i:\n  assumes a1:\"i>NC\" and \n  a2:\"s ∈ reachableSet (set (allInitSpecs N)) (rules N)\"  and a3:\"NC<N\" and  \n  a4:\"∀f.  f ∈(set invariantsAbs) ⟶  formEval f s\" \n  shows \"trans_sim_on1 (n_Crit i)  (n_Crit_i_3  ) (set invariantsAbs) s\" (is \"trans_sim_on1 ?r ?r' (set ?F) s\")\n  proof(rule ruleSimCond1)\n    show \" formEval (pre ?r) s ⟶formEval (pre ?r') s\" (is \"?A ⟶?B\")\n    proof(rule impI)+\n      assume b0:\"?A\"\n  \n      from b0  show \"formEval (pre ?r') s\" \n       by auto\n     qed\n   next \n\tshow \"(∀  v. v ∈  varOfSent (act  ?r') ⟶  v ∈ varOfFormList ?F ⟶ formEval (pre ?r) s ⟶ \n    expEval (substExpByStatement (IVar v)  (act ?r')) s = expEval (substExpByStatement (IVar v)  (act ?r)) s)\"\n   proof(rule allI,(rule impI)+)\n      fix  v\n     assume b1:\"v∈ (varOfFormList invariantsAbs)\"  and b2:\"formEval (pre ?r) s\" and b3:\"v ∈varOfSent (act ?r')\"\n  \n  show \"expEval (substExpByStatement (IVar v)  (act ?r')) s = expEval (substExpByStatement (IVar v)  (act ?r)) s\"  \n       apply (cut_tac  a1 b1 b2 ,auto) done\n   qed\n next\n   show \"∀  v. v ∈  varOfSent (act ?r) ⟶  v ∈ varOfFormList ?F ⟶ v ∈  varOfSent (act ?r')\" by(cut_tac a1, auto)\n\n  \n next \n   show \"∀ v va. v ∈ varOfSent (act ?r') ⟶va∈varOfExp ( substExpByStatement (IVar v)  (act ?r'))⟶ va ∈ (varOfFormList ?F)\"\n     by auto  \n next\n   show \"∀v. v ∈ varOfForm (pre (?r')) ⟶ v ∈ varOfFormList ?F\" by auto\nqed\nlemma lemmaOnn_CritLeNc_:\n  assumes a1:\"i\\<le>NC\" \n  shows \"trans_sim_on1 (n_Crit i) (n_Crit i) (set invariantsAbs) s\" (is \"trans_sim_on1 ?r ?r ?F s\")\nproof(rule ruleSimId)\n  show  \"∀v. v∈varOfForm (pre ?r) ⟶  v ∈(varOfFormList invariantsAbs) \"\n    by(cut_tac a1, auto) \n    \nnext\n  show  b1: \"∀v a. a ∈ set (statement2Assigns (act ?r)) ⟶ v∈varOfExp ( substExpByStatement (IVar (fst a))  (act ?r))⟶v ∈varOfFormList invariantsAbs \"\n   proof(cut_tac a1,(rule allI)+,(rule impI)+,auto) qed\n    \n qed\nlemma lemmaOnn_Crit: \n  assumes   a2:\"s ∈ reachableSet (set (allInitSpecs N)) (rules N)\"  and  \n  a4:\"∀f.  f ∈(set invariantsAbs) ⟶  formEval f s\" and a5:\"\\<exists> i. i\\<le>N\\<and>r=n_Crit  i\"\n  shows \"∃ r'. r' ∈ rules NC∧ trans_sim_on1 r r' (set invariantsAbs) s\" (is \"∃r'.?P1 r' ∧ ?P2 r'\")\nproof -\n  from a5 obtain i where d0:\"i\\<le>N\\<and>r=n_Crit  i\"  by blast\n  have \"i>NC|i\\<le> NC\" by auto\n  moreover{\n       assume a1:\"i>NC\" \n        have \"∃r'. ?P1 r' ∧ ?P2 r'\"\n        proof(rule_tac x=\"(n_Crit  NC)\" in exI,rule conjI)\n          show  \"?P1 (n_Crit  NC) \" \n           by(cut_tac a1, auto) \n          next\n          show  \"?P2 (n_Crit  NC) \"\n           using lemmaOnn_CritGt_i local.a1 a2 a4 d0 by blast \n        qed\n       }\nmoreover{\n       assume a1:\"i\\<le> NC\" \n        have \"∃r'. ?P1 r' ∧ ?P2 r'\"\n        proof(rule_tac x=\"(n_Crit i)\" in exI,rule conjI)\n          show  \"?P1 (n_Crit i) \" \n           by(cut_tac a1, auto) \n          next\n          show  \"?P2 (n_Crit i) \"\n           using lemmaOnn_CritLeNc_ local.a1 a2 a4 d0 by blast \n        qed\n       }\n  ultimately show \"∃r'.?P1 r' ∧ ?P2 r'\" \n    by satx\nqed\n\nlemma lemmaOnn_ExitGt_i:\n  assumes a1:\"i>NC\" and a2:\"s ∈ reachableSet (set (allInitSpecs N)) (rules N)\"  and  \n  a4:\"∀f.  f ∈(set invariantsAbs) ⟶  formEval f s\" \nshows \"trans_sim_on1 (n_Exit i  ) skipRule (set invariantsAbs) s\" (is \"trans_sim_on1 ?r ?r' ?F s\")\nproof(unfold trans_sim_on1_def,(rule allI)+,(rule impI)+,rule disjI2)\n  fix s2 \n  assume b0:\"state_sim_on1 s s2 (set invariantsAbs)\"\n  show \"state_sim_on1 (trans (act (n_Try i)) s) s2 (set invariantsAbs)\"\n  proof(cut_tac a1,unfold state_sim_on1_def,\n    (rule allI)+,(rule impI)+)\n    fix f v\n    assume b1:\" f ∈(set invariantsAbs)\" and b2:\"v ∈ varOfForm f\"  \n\n    have b30: \"(varOfFormList  invariantsAbs) = {v. ∃f. f ∈ set  invariantsAbs∧ v ∈ varOfForm f}\"\n      using setOfList by blast\n      \n     \n    from b1 and b2 and b30 have b4:\"v ∈ (varOfFormList  invariantsAbs)\" by blast\n     \n    from b4 have b5:\"trans (act (n_Try  i)) s v = s v\" \n      by (cut_tac a1  b4  ,auto) \n\n    from b0   have b6:\"s v =s2 v \"\n      using b1 b2 state_sim_on1_def by blast  \n    show \"trans (act (n_Try i)) s v= s2 v\"\n      using b5 b6 by auto \n  qed\nqed\nlemma lemmaOnn_ExitLeNc_:\n  assumes a1:\"i\\<le>NC\" \n  shows \"trans_sim_on1 (n_Exit i) (n_Exit i) (set invariantsAbs) s\" (is \"trans_sim_on1 ?r ?r ?F s\")\nproof(rule ruleSimId)\n  show  \"∀v. v∈varOfForm (pre ?r) ⟶  v ∈(varOfFormList invariantsAbs) \"\n    by(cut_tac a1, auto) \n    \nnext\n  show  b1: \"∀v a. a ∈ set (statement2Assigns (act ?r)) ⟶ v∈varOfExp ( substExpByStatement (IVar (fst a))  (act ?r))⟶v ∈varOfFormList invariantsAbs \"\n   proof(cut_tac a1,(rule allI)+,(rule impI)+,auto) qed\n    \n qed\nlemma lemmaOnn_Exit: \n  assumes   a2:\"s ∈ reachableSet (set (allInitSpecs N)) (rules N)\"  and  \n  a4:\"∀f.  f ∈(set invariantsAbs) ⟶  formEval f s\" and a5:\"\\<exists> i. i\\<le>N\\<and>r=n_Exit  i\"\n  shows \"∃ r'. r' ∈ rules NC∧ trans_sim_on1 r r' (set invariantsAbs) s\" (is \"∃r'.?P1 r' ∧ ?P2 r'\")\nproof -\n  from a5 obtain i where d0:\"i\\<le>N\\<and>r=n_Exit  i\"  by blast\n  have \"i>NC|i\\<le> NC\" by auto\n  moreover{\n       assume a1:\"i>NC\" \n        have \"∃r'. ?P1 r' ∧ ?P2 r'\"\n        proof(rule_tac x=\"(skipRule)\" in exI,rule conjI)\n          show  \"?P1 (skipRule) \" \n           by(cut_tac a1, auto) \n          next\n          show  \"?P2 (skipRule) \"\n           using lemmaOnn_ExitGt_i local.a1 a2 a4 d0 by blast \n        qed\n       }\nmoreover{\n       assume a1:\"i\\<le> NC\" \n        have \"∃r'. ?P1 r' ∧ ?P2 r'\"\n        proof(rule_tac x=\"(n_Exit i)\" in exI,rule conjI)\n          show  \"?P1 (n_Exit i) \" \n           by(cut_tac a1, auto) \n          next\n          show  \"?P2 (n_Exit i) \"\n           using lemmaOnn_ExitLeNc_ local.a1 a2 a4 d0 by blast \n        qed\n       }\n  ultimately show \"∃r'.?P1 r' ∧ ?P2 r'\" \n    by satx\nqed\n\nlemma lemmaOnn_IdleGt_i:\n  assumes a1:\"i>NC\" and \n  a2:\"s ∈ reachableSet (set (allInitSpecs N)) (rules N)\"  and a3:\"NC<N\" and  \n  a4:\"∀f.  f ∈(set invariantsAbs) ⟶  formEval f s\" \n  shows \"trans_sim_on1 (n_Idle i)  (n_Idle_i_3  NC) (set invariantsAbs) s\" (is \"trans_sim_on1 ?r ?r' (set ?F) s\")\n  proof(rule ruleSimCond1)\n    show \" formEval (pre ?r) s ⟶formEval (pre ?r') s\" (is \"?A ⟶?B\")\n    proof(rule impI)+\n      assume b0:\"?A\"\n  from a4  have tmp:\"formEval (inv_27 0)  s\"   \n            by (force simp del:inv_27_def) \n        have tmp1:\"formEval (inv_27 i  ) s\" \n        proof(cut_tac a1 a2 a3 tmp,rule axiomOnf1,force+)qed\n        with b0  have c0:\"formEval  (conclude (inv_27 i)) s\" by auto\nfrom a4  have tmp:\"formEval (inv_7 0 1)  s\"   \n            by (force simp del:inv_7_def) \n        have tmp1:\"formEval (inv_7 i 0  ) s\" \n        proof(cut_tac a1 a2 a3 tmp,rule axiomOnf2,force+)qed\n        with a1 b0  have c1:\"formEval  (conclude (inv_7 i 0)) s\"\n          by auto\nfrom a4  have tmp:\"formEval (inv_7 0 1)  s\"   \n            by (force simp del:inv_7_def) \n        have tmp1:\"formEval (inv_7 i 1  ) s\" \n        proof(cut_tac a1 a2 a3 tmp,rule axiomOnf2,force+)qed\n        with b0  have c2:\"formEval  (conclude (inv_7 i 1)) s\" by auto\nfrom a4  have tmp:\"formEval (inv_5 0 1)  s\"   \n            by (force simp del:inv_5_def) \n        have tmp1:\"formEval (inv_5 i 0  ) s\" \n        proof(cut_tac a1 a2 a3 tmp,rule axiomOnf2,force+)qed\n        with b0  have c3:\"formEval  (conclude (inv_5 i 0)) s\" by auto\nfrom a4  have tmp:\"formEval (inv_5 0 1)  s\"   \n            by (force simp del:inv_5_def) \n        have tmp1:\"formEval (inv_5 i 1  ) s\" \n        proof(cut_tac a1 a2 a3 tmp,rule axiomOnf2,force+)qed\n        with b0  have c4:\"formEval  (conclude (inv_5 i 1)) s\" by auto\n\n      from b0 c0 c1 c2 c3 c4 show \"formEval (pre ?r') s\" \n       by auto\n     qed\n   next \n\tshow \"(∀  v. v ∈  varOfSent (act  ?r') ⟶  v ∈ varOfFormList ?F ⟶ formEval (pre ?r) s ⟶ \n    expEval (substExpByStatement (IVar v)  (act ?r')) s = expEval (substExpByStatement (IVar v)  (act ?r)) s)\"\n   proof(rule allI,(rule impI)+)\n      fix  v\n     assume b1:\"v∈ (varOfFormList invariantsAbs)\"  and b2:\"formEval (pre ?r) s\" and b3:\"v ∈varOfSent (act ?r')\"\n  \n  show \"expEval (substExpByStatement (IVar v)  (act ?r')) s = expEval (substExpByStatement (IVar v)  (act ?r)) s\"  \n       apply (cut_tac  a1 b1 b2 ,auto) done\n   qed\n next\n   show \"∀  v. v ∈  varOfSent (act ?r) ⟶  v ∈ varOfFormList ?F ⟶ v ∈  varOfSent (act ?r')\" by(cut_tac a1, auto)\n\n  \n next \n   show \"∀ v va. v ∈ varOfSent (act ?r') ⟶va∈varOfExp ( substExpByStatement (IVar v)  (act ?r'))⟶ va ∈ (varOfFormList ?F)\"\n     by auto  \n next\n   show \"∀v. v ∈ varOfForm (pre (?r')) ⟶ v ∈ varOfFormList ?F\" by auto\nqed\nlemma lemmaOnn_IdleLeNc_:\n  assumes a1:\"i\\<le>NC\" \n  shows \"trans_sim_on1 (n_Idle i) (n_Idle i) (set invariantsAbs) s\" (is \"trans_sim_on1 ?r ?r ?F s\")\nproof(rule ruleSimId)\n  show  \"∀v. v∈varOfForm (pre ?r) ⟶  v ∈(varOfFormList invariantsAbs) \"\n    by(cut_tac a1, auto) \n    \nnext\n  show  b1: \"∀v a. a ∈ set (statement2Assigns (act ?r)) ⟶ v∈varOfExp ( substExpByStatement (IVar (fst a))  (act ?r))⟶v ∈varOfFormList invariantsAbs \"\n   proof(cut_tac a1,(rule allI)+,(rule impI)+,auto) qed\n    \n qed\nlemma lemmaOnn_Idle: \n  assumes   a2:\"s ∈ reachableSet (set (allInitSpecs N)) (rules N)\"  and  \n  a4:\"∀f.  f ∈(set invariantsAbs) ⟶  formEval f s\" and a5:\"\\<exists> i. i\\<le>N\\<and>r=n_Idle  i\"\n  shows \"∃ r'. r' ∈ rules NC∧ trans_sim_on1 r r' (set invariantsAbs) s\" (is \"∃r'.?P1 r' ∧ ?P2 r'\")\nproof -\n  from a5 obtain i where d0:\"i\\<le>N\\<and>r=n_Idle  i\"  by blast\n  have \"i>NC|i\\<le> NC\" by auto\n  moreover{\n       assume a1:\"i>NC\" \n        have \"∃r'. ?P1 r' ∧ ?P2 r'\"\n        proof(rule_tac x=\"(n_Idle  NC)\" in exI,rule conjI)\n          show  \"?P1 (n_Idle  NC) \" \n           by(cut_tac a1, auto) \n          next\n          show  \"?P2 (n_Idle  NC) \"\n           using lemmaOnn_IdleGt_i local.a1 a2 a4 d0 by blast \n        qed\n       }\nmoreover{\n       assume a1:\"i\\<le> NC\" \n        have \"∃r'. ?P1 r' ∧ ?P2 r'\"\n        proof(rule_tac x=\"(n_Idle i)\" in exI,rule conjI)\n          show  \"?P1 (n_Idle i) \" \n           by(cut_tac a1, auto) \n          next\n          show  \"?P2 (n_Idle i) \"\n           using lemmaOnn_IdleLeNc_ local.a1 a2 a4 d0 by blast \n        qed\n       }\n  ultimately show \"∃r'.?P1 r' ∧ ?P2 r'\" \n    by satx\nqed\n\n\nend", "meta": {"author": "lyj238Gmail", "repo": "cmpFoundation", "sha": "d14146f4ae725b2c7d49ec75f14e4176b88e2922", "save_path": "github-repos/isabelle/lyj238Gmail-cmpFoundation", "path": "github-repos/isabelle/lyj238Gmail-cmpFoundation/cmpFoundation-d14146f4ae725b2c7d49ec75f14e4176b88e2922/n_mutualEx_base2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5888891163376236, "lm_q2_score": 0.5544704649604274, "lm_q1q2_score": 0.3265216221458574}}
{"text": "theory flash30Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv30:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_FAck ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma NI_InvVsInv30:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Inv  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_InvAck_1VsInv30:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_InvAck_1_HomeVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_InvAck_2VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_GetXVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak1VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak2VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak3VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX1VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX2VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX3VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX4VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX5VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX6VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX7VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX8VsInv30:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Local_GetX_PutX8_homeVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX9VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX10VsInv30:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Local_GetX_PutX10_homeVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX11VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_GetVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak1VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak2VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak3VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put1VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put2VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put3VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_PutVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Local_PutXAcksDoneVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Local_PutXAcksDone ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_NakVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Nak  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Nak_ClearVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Nak_Clear ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Nak_HomeVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Nak_Home ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Remote_GetX_NakVsInv30:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Remote_GetX_Nak_HomeVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Remote_GetX_PutXVsInv30:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv30:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Remote_Get_Nak2VsInv30:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Remote_Get_Put1VsInv30:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv30:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_Get ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule2) )  ( Const CACHE_E ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutVsInv30:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Remote_Put  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                     have allCases:\"formEval  ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true ))  s  \\<or>formEval   (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true )) )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true ))  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n\n    moreover\n                       {assume c1:\"formEval  (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true )) )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately have \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutXVsInv30:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_PutX ))    ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') )  ( Const SHWB_ShWb ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_ReplaceVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_ReplaceHomeVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_ReplaceHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_ReplaceHomeShrVldVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_ReplaceHomeShrVld ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_ReplaceShrVldVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_ShWbVsInv30:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_ShWb N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma NI_WbVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (NI_Wb ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_GetX1VsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Local_GetX_GetX1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_GetX2VsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Local_GetX_GetX2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX1VsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX2VsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX3VsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Local_GetX_PutX3 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX4VsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Local_GetX_PutX4 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_Get_GetVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Local_Get_Get ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_Get_PutVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Local_Get_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_PutXVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Local_PutX ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_ReplaceVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Local_Replace ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Remote_GetVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Remote_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma PI_Remote_GetXVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Remote_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma PI_Remote_PutXVsInv30:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_ReplaceVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (PI_Remote_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma StoreVsInv30:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (Store  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma StoreHomeVsInv30:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv30  iInv1 ) (StoreHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash30Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6477982043529716, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.32642951243112067}}
{"text": "section \\<open>Automation\\<close>\ntheory Automation\nimports Hoare_Triple (*\"../Lib/Refine_Util\"*)\nbegin\n\ntext \\<open>\n  In this theory, we provide a set of tactics and a simplifier setup for easy\n  reasoning with our separation logic.\n\\<close>\n\nsubsection \\<open>Normalization of Assertions\\<close>\ntext \\<open>\n  In this section, we provide a set of lemmas and a simplifier\n  setup to bring assertions to a normal form. We provide a simproc that\n  detects pure parts of assertions and duplicate pointers. Moreover,\n  we provide ac-rules for assertions. See Section~\\ref{sec:auto:overview}\n  for a short overview of the available proof methods.\n\\<close>\n\nlemmas assn_aci =   \n  inf_aci[where 'a=assn] \n  sup_aci[where 'a=assn] \n  mult.left_ac[where 'a=assn] \n\nlemmas star_assoc = mult.assoc[where 'a=assn] \nlemmas assn_assoc = \n  mult.left_assoc inf_assoc[where 'a=assn] sup_assoc[where 'a=assn] \n\nlemma merge_true_star_ctx: \"true * (true * P) = true * P\"\n  by (simp add: mult.left_ac)\n  \nlemmas star_aci = \n  mult.assoc[where 'a=assn] mult.commute[where 'a=assn] mult.left_commute[where 'a=assn]\n  assn_one_left mult_1_right[where 'a=assn]\n  merge_true_star merge_true_star_ctx\n\ntext \\<open>Move existential quantifiers to the front of assertions\\<close>\nlemma ex_assn_move_out[simp]:\n  \"\\<And>Q R. (\\<exists>\\<^sub>Ax. Q x) * R = (\\<exists>\\<^sub>Ax. (Q x * R))\"\n  \"\\<And>Q R. R * (\\<exists>\\<^sub>Ax. Q x) = (\\<exists>\\<^sub>Ax. (R * Q x))\"\n\n  \"\\<And>P Q. (\\<exists>\\<^sub>Ax. Q x) \\<and>\\<^sub>A P = (\\<exists>\\<^sub>Ax. (Q x \\<and>\\<^sub>A P)) \"\n  \"\\<And>P Q. Q \\<and>\\<^sub>A (\\<exists>\\<^sub>Ax. P x) = (\\<exists>\\<^sub>Ax. (Q \\<and>\\<^sub>A P x))\"\n\n  \"\\<And>P Q. (\\<exists>\\<^sub>Ax. Q x) \\<or>\\<^sub>A P = (\\<exists>\\<^sub>Ax. (Q x \\<or>\\<^sub>A P))\"\n  \"\\<And>P Q. Q \\<or>\\<^sub>A (\\<exists>\\<^sub>Ax. P x) = (\\<exists>\\<^sub>Ax. (Q \\<or>\\<^sub>A P x))\"\n  apply -\n  apply (simp add: ex_distrib_star)\n  apply (subst mult.commute)\n  apply (subst (2) mult.commute)\n  apply (simp add: ex_distrib_star)\n\n  apply (simp add: ex_distrib_and)\n  apply (subst inf_commute)\n  apply (subst (2) inf_commute)\n  apply (simp add: ex_distrib_and)\n\n  apply (simp add: ex_distrib_or)\n  apply (subst sup_commute)\n  apply (subst (2) sup_commute)\n  apply (simp add: ex_distrib_or)\n  done\n\ntext \\<open>Extract pure assertions from and-clauses\\<close>\nlemma and_extract_pure_left_iff[simp]: \"\\<up>b \\<and>\\<^sub>A Q = (emp\\<and>\\<^sub>AQ)*\\<up>b\"\n  by (cases b) auto\n\nlemma and_extract_pure_left_ctx_iff[simp]: \"P*\\<up>b \\<and>\\<^sub>A Q = (P\\<and>\\<^sub>AQ)*\\<up>b\"\n  by (cases b) auto\n\nlemma and_extract_pure_right_iff[simp]: \"P \\<and>\\<^sub>A \\<up>b = (emp\\<and>\\<^sub>AP)*\\<up>b\"\n  by (cases b) (auto simp: assn_aci)\n\nlemma and_extract_pure_right_ctx_iff[simp]: \"P \\<and>\\<^sub>A Q*\\<up>b = (P\\<and>\\<^sub>AQ)*\\<up>b\"\n  by (cases b) auto\n\nlemmas and_extract_pure_iff = \n  and_extract_pure_left_iff and_extract_pure_left_ctx_iff\n  and_extract_pure_right_iff and_extract_pure_right_ctx_iff\n\nlemmas norm_assertion_simps =\n  (* Neutral elements *)\n  mult_1[where 'a=assn] mult_1_right[where 'a=assn]\n  inf_top_left[where 'a=assn] inf_top_right[where 'a=assn]\n  sup_bot_left[where 'a=assn] sup_bot_right[where 'a=assn]\n\n  (* Zero elements *)\n  star_false_left star_false_right\n  inf_bot_left[where 'a=assn] inf_bot_right[where 'a=assn]\n  sup_top_left[where 'a=assn] sup_top_right[where 'a=assn]\n\n  (* Associativity *)\n  mult.left_assoc[where 'a=assn]\n  inf_assoc[where 'a=assn]\n  sup_assoc[where 'a=assn]\n\n  (* Existential Quantifiers *)\n  ex_assn_move_out ex_assn_const\n\n  (* Extract pure assertions from conjunctions *)\n  and_extract_pure_iff\n\n  (* Merging *)\n  merge_pure_star merge_pure_and merge_pure_or\n  merge_true_star \n  inf_idem[where 'a=assn] sup_idem[where 'a=assn]\n\n  (* Duplicated References *)\n  sngr_same_false snga_same_false\n\n\nsubsubsection \\<open>Simplifier Setup Fine-Tuning\\<close>\ntext \\<open>Imperative HOL likes to simplify pointer inequations to this strange\n  operator. We do some additional simplifier setup here\\<close>\nlemma not_same_noteqr[simp]: \"\\<not> a=!=a\"\n  by (metis Ref.unequal)\ndeclare Ref.noteq_irrefl[dest!]\n\nlemma not_same_noteqa[simp]: \"\\<not> a=!!=a\"\n  by (metis Array.unequal)\ndeclare Array.noteq_irrefl[dest!]\n\ntext \\<open>However, it is safest to disable this rewriting, as there is\n  a working standard simplifier setup for \\<open>(\\<noteq>)\\<close>\n\\<close>\ndeclare Ref.unequal[simp del]\ndeclare Array.unequal[simp del]\n\n\nsubsection \\<open>Normalization of Entailments\\<close>\n\ntext \\<open>Used by existential quantifier extraction tactic\\<close>\nlemma enorm_exI': (* Incomplete, as chosen x may depend on heap! *)\n  \"(\\<And>x. Z x \\<longrightarrow> (P \\<Longrightarrow>\\<^sub>A Q x)) \\<Longrightarrow> (\\<exists>x. Z x) \\<longrightarrow> (P \\<Longrightarrow>\\<^sub>A (\\<exists>\\<^sub>Ax. Q x))\"\n  by (metis ent_ex_postI)\n  \ntext \\<open>Example of how to build an extraction lemma.\\<close>\nthm enorm_exI'[OF enorm_exI'[OF imp_refl]]\n\nlemmas ent_triv = ent_true ent_false\n\ntext \\<open>Dummy rule to detect Hoare triple goal\\<close>\nlemma is_hoare_triple: \"<P> c <Q> \\<Longrightarrow> <P> c <Q>\" .\ntext \\<open>Dummy rule to detect entailment goal\\<close>\nlemma is_entails: \"P\\<Longrightarrow>\\<^sub>AQ \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>AQ\" .\n\nsubsection \\<open>Frame Matcher\\<close>\ntext \\<open>Given star-lists P,Q and a frame F, this method tries to match \n  all elements of Q with corresponding elements of P. The result is a \n  partial match, that contains matching pairs and the unmatched content.\\<close>\n\ntext \\<open>The frame-matcher internally uses syntactic lists separated by\n  star, and delimited by the special symbol \\<open>SLN\\<close>, which is defined\n  to be \\<open>emp\\<close>.\\<close>\ndefinition [simp]: \"SLN \\<equiv> emp\"\nlemma SLN_left: \"SLN * P = P\" by simp\nlemma SLN_right: \"P * SLN = P\" by simp\n\nlemmas SLN_normalize = SLN_right mult.left_assoc[where 'a=assn]\nlemmas SLN_strip = SLN_right SLN_left mult.left_assoc[where 'a=assn]\n\ntext \\<open>A query to the frame matcher. Contains the assertions\n  P and Q that shall be matched, as well as a frame F, that is not \n  touched.\\<close>\n\ndefinition [simp]: \"FI_QUERY P Q F \\<equiv> P \\<Longrightarrow>\\<^sub>A Q*F\"\n\nabbreviation \"fi_m_fst M \\<equiv> foldr (*) (map fst M) emp\"\nabbreviation \"fi_m_snd M \\<equiv> foldr (*) (map snd M) emp\"\nabbreviation \"fi_m_match M \\<equiv> (\\<forall>(p,q)\\<in>set M. p \\<Longrightarrow>\\<^sub>A q)\"\n\ntext \\<open>A result of the frame matcher. Contains a list of matching pairs,\n  as well as the unmatched parts of P and Q, and the frame F.\n\\<close>\ndefinition [simp]: \"FI_RESULT M UP UQ F \\<equiv> \n  fi_m_match M \\<longrightarrow> (fi_m_fst M * UP \\<Longrightarrow>\\<^sub>A fi_m_snd M * UQ * F)\"\n\ntext \\<open>Internal structure used by the frame matcher: \n  m contains the matched pairs; p,q the assertions that still needs to be \n  matched; up,uq the assertions that could not be matched; and f the frame.\n  p and q are SLN-delimited syntactic lists. \n\\<close>\n\ndefinition [simp]: \"FI m p q up uq f \\<equiv> \n  fi_m_match m \\<longrightarrow> (fi_m_fst m * p * up \\<Longrightarrow>\\<^sub>A fi_m_snd m * q * uq * f)\"\n\ntext \\<open>Initialize processing of query\\<close>\nlemma FI_init: \n  assumes \"FI [] (SLN*P) (SLN*Q) SLN SLN F\"\n  shows \"FI_QUERY P Q F\"\n  using assms by simp\n\ntext \\<open>Construct result from internal representation\\<close>\nlemma FI_finalize:\n  assumes \"FI_RESULT m (p*up) (q*uq) f\"\n  shows \"FI m p q up uq f\"\n  using assms by (simp add: assn_aci)\n\ntext \\<open>Auxiliary lemma to show that all matching pairs together form\n  an entailment. This is required for most applications.\\<close>\nlemma fi_match_entails:\n  assumes \"fi_m_match m\"\n  shows \"fi_m_fst m \\<Longrightarrow>\\<^sub>A fi_m_snd m\"\n  using assms apply (induct m)\n  apply (simp_all split: prod.split_asm add: ent_star_mono)\n  done\n\ntext \\<open>Internally, the frame matcher tries to match the first assertion\n  of q with the first assertion of p. If no match is found, the first\n  assertion of p is discarded. If no match for any assertion in p can be\n  found, the first assertion of q is discarded.\\<close>\n\ntext \\<open>Match\\<close>\nlemma FI_match:\n  assumes \"p \\<Longrightarrow>\\<^sub>A q\"\n  assumes \"FI ((p,q)#m) (ps*up) (qs*uq) SLN SLN f\"\n  shows \"FI m (ps*p) (qs*q) up uq f\"\n  using assms unfolding FI_def\n  by (simp add: assn_aci)\n\ntext \\<open>No match\\<close>\nlemma FI_p_nomatch:\n  assumes \"FI m ps (qs*q) (p*up) uq f\"\n  shows \"FI m (ps*p) (qs*q) up uq f\"\n  using assms unfolding FI_def\n  by (simp add: assn_aci)\n  \ntext \\<open>Head of q could not be matched\\<close>\nlemma FI_q_nomatch:\n  assumes \"FI m (SLN*up) qs SLN (q*uq) f\"\n  shows \"FI m SLN (qs*q) up uq f\"\n  using assms unfolding FI_def\n  by (simp add: assn_aci) \n\nsubsection \\<open>Frame Inference\\<close>\nlemma frame_inference_init:\n  assumes \"FI_QUERY P Q F\"\n  shows \"P \\<Longrightarrow>\\<^sub>A Q * F\"\n  using assms by simp\n\nlemma frame_inference_finalize:\n  shows \"FI_RESULT M F emp F\"\n  apply simp\n  apply rule\n  apply (drule fi_match_entails)\n  apply (rule ent_star_mono[OF _ ent_refl])\n  apply assumption\n  done\n\nsubsection \\<open>Entailment Solver\\<close>\nlemma entails_solve_init:\n  \"FI_QUERY P Q true \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>A Q * true\"\n  \"FI_QUERY P Q emp \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>A Q\"\n  by (simp_all add: assn_aci)\n\nlemma entails_solve_finalize:\n  \"FI_RESULT M P emp true\"\n  \"FI_RESULT M emp emp emp\"\n  by (auto simp add: fi_match_entails intro: ent_star_mono)\n\nlemmas solve_ent_preprocess_simps = \n  ent_pure_post_iff ent_pure_post_iff_sng ent_pure_pre_iff ent_pure_pre_iff_sng\n  \nsubsection \\<open>Verification Condition Generator\\<close>\n\nlemmas normalize_rules = norm_pre_ex_rule norm_pre_pure_rule\n\n(* Originally we introduced backwards-reasoning here, via\n  cons_pre_rule[OF _ return_wp_rule] (old name: complete_return_cons). \n  This only works, if the postcondition is not schematic! However, for \n  forward reasoning, one usually assumes a schematic postcondition!\n  *)\ntext \\<open>May be useful in simple, manual proofs, where the postcondition\n  is no schematic variable.\\<close>\nlemmas return_cons_rule = cons_pre_rule[OF _ return_wp_rule]\n\ntext \\<open>Useful frame-rule variant for manual proof:\\<close>\nlemma frame_rule_left:\n  \"<P> c <Q> \\<Longrightarrow> <R * P> c <\\<lambda>x. R * Q x>\"\n  using frame_rule by (simp add: assn_aci)\n\nlemmas deconstruct_rules = \n  bind_rule if_rule false_rule return_sp_rule let_rule \n  case_prod_rule case_list_rule case_option_rule case_sum_rule\n\nlemmas heap_rules = \n  ref_rule\n  lookup_rule\n  update_rule\n  new_rule\n  make_rule\n  of_list_rule\n  length_rule\n  nth_rule\n  upd_rule\n  freeze_rule\n\nlemma fi_rule:\n  assumes CMD: \"<P> c <Q>\"\n  assumes FRAME: \"Ps \\<Longrightarrow>\\<^sub>A P * F\"\n  shows \"<Ps> c <\\<lambda>x. Q x * F>\"\n  apply (rule cons_pre_rule[rotated])\n  apply (rule frame_rule)\n  apply (rule CMD)\n  apply (rule FRAME)\n  done\n\n\nsubsection \\<open>ML-setup\\<close>\n\nnamed_theorems sep_dflt_simps \"Seplogic: Default simplification rules for automated solvers\"\nnamed_theorems sep_eintros \"Seplogic: Intro rules for entailment solver\"\nnamed_theorems sep_heap_rules \"Seplogic: VCG heap rules\"\nnamed_theorems sep_decon_rules \"Seplogic: VCG deconstruct rules\"\n\nML \\<open>\ninfix 1 THEN_IGNORE_NEWGOALS\n\nstructure Seplogic_Auto =\nstruct\n\n  (***********************************)\n  (*             Tools               *)\n  (***********************************)\n\n  (* Repeat tac on subgoal. Determinize each step. \n     Stop if tac fails or subgoal is solved. *)\n  fun REPEAT_DETERM' tac i st = let\n    val n = Thm.nprems_of st \n  in\n    REPEAT_DETERM (COND (has_fewer_prems n) no_tac (tac i)) st\n  end\n\n\n  (***********************************)\n  (*             Debugging           *)\n  (***********************************)\n  fun tr_term t = Pretty.string_of (Syntax.pretty_term @{context} t);\n\n\n  (***********************************)\n  (*        Custom Tacticals         *)\n  (***********************************)\n\n  (* Apply tac1, and then tac2 with an offset such that anything left \n     over by tac1 is skipped.\n\n     The typical usage of this tactic is, if a theorem is instantiated\n     with another theorem that produces additional goals that should \n     be ignored first. Here, it is used in the vcg to ensure that \n     frame inference is done before additional premises (that may \n     depend on the frame) are discharged.\n  *)\n  fun (tac1 THEN_IGNORE_NEWGOALS tac2) i st = let\n    val np = Thm.nprems_of st\n  in\n    (tac1 i THEN (fn st' => let val np' = Thm.nprems_of st' in\n      if np'<np then tac2 i st'\n      else tac2 (i+(np'-np)+1) st'\n    end)) st\n  end;\n\n\n  (***********************************)\n  (*     Assertion Normalization     *)\n  (***********************************)\n  (* Find two terms in a list whose key is equal *)\n  fun find_similar (key_of:term -> term) (ts:term list) = let\n    fun frec _ [] = NONE\n    | frec tab (t::ts) = let val k=key_of t in\n      if Termtab.defined tab k then\n        SOME (the (Termtab.lookup tab k),t)\n      else frec (Termtab.update (k,t) tab) ts\n    end\n  in\n    frec Termtab.empty ts\n  end;\n\n  (* Perform DFS over term with binary operator opN, threading through\n    a state. Atomic terms are transformed by tr. Supports omission of\n    terms from the result structure by transforming them to NONE. *)\n  fun dfs_opr opN (tr:'state -> term -> ('state*term option)) \n    d (t as ((op_t as Const (fN,_))$t1$t2)) =\n    if fN = opN then let\n        val (d1,t1') = dfs_opr opN tr d t1;\n        val (d2,t2') = dfs_opr opN tr d1 t2;\n      in\n        case (t1',t2') of\n          (NONE,NONE) => (d2,NONE)\n        | (SOME t1',NONE) => (d2,SOME t1')\n        | (NONE,SOME t2') => (d2,SOME t2')\n        | (SOME t1',SOME t2') => (d2,SOME (op_t$t1'$t2'))\n      end\n    else tr d t\n  | dfs_opr _ tr d t = tr d t;\n    \n  (* Replace single occurrence of (atomic) ot in t by nt. \n    Returns new term or NONE if nothing was removed. *)\n  fun dfs_replace_atomic opN ot nt t = let\n    fun tr d t = if not d andalso t=ot then (true,SOME nt) else (d,SOME t);\n    val (success,SOME t') = dfs_opr opN tr false t; \n  in\n    if success then SOME t' else NONE\n  end;\n\n  fun assn_simproc_fun ctxt credex = let\n    val ([redex],ctxt') = Variable.import_terms true [Thm.term_of credex] ctxt;\n    (*val _ = tracing (tr_term redex);*)\n    val export = singleton (Variable.export ctxt' ctxt)\n\n    fun mk_star t1 t2 = @{term \"(*)::assn \\<Rightarrow> _ \\<Rightarrow> _\"}$t2$t1;\n\n    fun mk_star' NONE NONE = NONE\n    | mk_star' (SOME t1) NONE  = SOME t1\n    | mk_star' NONE (SOME t2) = SOME t2\n    | mk_star' (SOME t1) (SOME t2) = SOME (mk_star t1 t2);\n\n    fun ptrs_key (_$k$_) = k;\n\n    fun remove_term pt t = case\n      dfs_replace_atomic @{const_name \"Groups.times_class.times\"} pt \n        @{term emp} t \n    of\n      SOME t' => t';  \n\n    fun normalize t = let\n\n      fun ep_tr (has_true,ps,ptrs) t = case t of \n        Const (@{const_name \"Assertions.pure_assn\"},_)$_ \n        => ((has_true,t::ps,ptrs),NONE)\n      | Const (@{const_name \"Assertions.sngr_assn\"},_)$_$_ \n        => ((has_true,ps,t::ptrs),SOME t)\n      | Const (@{const_name \"Assertions.snga_assn\"},_)$_$_\n        => ((has_true,ps,t::ptrs),SOME t)\n      | Const (@{const_name \"Orderings.top_class.top\"},_)\n        => ((true,ps,ptrs),NONE)\n      | (inf_op as Const (@{const_name \"Lattices.inf_class.inf\"},_))$t1$t2\n        => ((has_true,ps,ptrs),SOME (inf_op$normalize t1$normalize t2))\n      | _ => ((has_true,ps,ptrs),SOME t);\n\n      fun normalizer t = case dfs_opr @{const_name \"Groups.times_class.times\"}\n        ep_tr (false,[],[]) t \n      of \n        ((has_true,ps,ptrs),rt) => ((has_true,rev ps,ptrs),rt);\n\n      fun normalize_core t = let \n        val ((has_true,pures,ptrs),rt) = normalizer t;\n        val similar = find_similar ptrs_key ptrs;\n        val true_t = if has_true then SOME @{term \"Assertions.top_assn\"} \n          else NONE;\n        val pures' = case pures of \n            [] => NONE\n          | p::ps => SOME (fold mk_star ps p);\n      in\n        case similar of NONE => the (mk_star' pures' (mk_star' true_t rt))\n        | SOME (t1,t2) => let\n            val t_stripped = remove_term t1 (remove_term t2 t);\n          in mk_star t_stripped (mk_star t1 t2) end\n      end;\n\n      fun skip_ex ((exq as Const (@{const_name \"ex_assn\"},_))$(Abs (n,ty,t))) =\n        exq$Abs (n,ty,skip_ex t)\n      | skip_ex t = normalize_core t;\n\n      val (bs,t') = strip_abs t;\n      val ty = fastype_of1 (map #2 bs,t');\n    in\n      if ty = @{typ assn} then\n        Logic.rlist_abs (bs,skip_ex t')\n      else t\n    end;\n\n    (*val _ = tracing (tr_term redex);*)\n    val (f,terms) = strip_comb redex;\n    val nterms = map (fn t => let\n        (*val _ = tracing (tr_term t); *)\n        val t'=normalize t; \n        (*val _ = tracing (tr_term t');*)\n      in t' end) terms;\n    val new_form = list_comb (f,nterms);\n\n    val res_ss = (put_simpset HOL_basic_ss ctxt addsimps @{thms star_aci});\n    val result = Option.map (export o mk_meta_eq) (Arith_Data.prove_conv_nohyps\n      [simp_tac res_ss 1] ctxt' (redex,new_form)\n    );\n\n  in \n    result\n  end handle exc =>\n    if Exn.is_interrupt exc then Exn.reraise exc\n    else\n      (tracing (\"assn_simproc failed with exception\\n:\" ^ Runtime.exn_message exc);\n        NONE) (* Fail silently *);\n  \n  val assn_simproc =\n    Simplifier.make_simproc @{context} \"assn_simproc\"\n     {lhss =\n      [@{term \"h \\<Turnstile> P\"},\n       @{term \"P \\<Longrightarrow>\\<^sub>A Q\"},\n       @{term \"P \\<Longrightarrow>\\<^sub>t Q\"},\n       @{term \"Hoare_Triple.hoare_triple P c Q\"},\n       @{term \"(P::assn) = Q\"}],\n      proc = K assn_simproc_fun};\n\n\n\n  (***********************************)\n  (*     Default Simplifications     *)\n  (***********************************)\n\n  (* Default simplification. MUST contain assertion normalization!\n    Tactic must not fail! *)\n  fun dflt_tac ctxt = asm_full_simp_tac\n    (put_simpset HOL_ss ctxt\n      addsimprocs [assn_simproc] \n      addsimps @{thms norm_assertion_simps}\n      addsimps (Named_Theorems.get ctxt @{named_theorems sep_dflt_simps})\n      |> fold Splitter.del_split @{thms if_split}\n    );\n\n  (***********************************)\n  (*         Frame Matcher           *)\n  (***********************************)\n\n  (* Do frame matching\n    imp_solve_tac - tactic used to discharge first assumption of match-rule\n      cf. lemma FI_match.\n  *)\n  fun match_frame_tac imp_solve_tac ctxt = let\n    (* Normalize star-lists *)\n    val norm_tac = simp_tac (\n      put_simpset HOL_basic_ss ctxt addsimps @{thms SLN_normalize});\n\n    (* Strip star-lists *)\n    val strip_tac = \n      simp_tac (put_simpset HOL_basic_ss ctxt addsimps @{thms SLN_strip}) THEN'\n      simp_tac (put_simpset HOL_basic_ss ctxt addsimps @{thms SLN_def});\n\n    (* Do a match step *)\n    val match_tac = resolve_tac ctxt @{thms FI_match} (* Separate p,q*)\n      THEN' SOLVED' imp_solve_tac (* Solve implication *)\n      THEN' norm_tac;\n\n    (* Do a no-match step *)\n    val nomatch_tac = resolve_tac ctxt @{thms FI_p_nomatch} ORELSE' \n      (resolve_tac ctxt @{thms FI_q_nomatch} THEN' norm_tac);\n  in\n    resolve_tac ctxt @{thms FI_init} THEN' norm_tac \n    THEN' REPEAT_DETERM' (FIRST' [\n      CHANGED o dflt_tac ctxt,\n      (match_tac ORELSE' nomatch_tac)])\n    THEN' resolve_tac ctxt @{thms FI_finalize} THEN' strip_tac\n  end;\n\n\n  (***********************************)\n  (*         Frame Inference         *)\n  (***********************************)\n\n  fun frame_inference_tac ctxt =\n    resolve_tac ctxt @{thms frame_inference_init} \n    THEN' match_frame_tac (resolve_tac ctxt @{thms ent_refl}) ctxt\n    THEN' resolve_tac ctxt @{thms frame_inference_finalize};\n\n\n  (***********************************)\n  (*       Entailment Solver         *)\n  (***********************************)\n\n  (* Extract existential quantifiers from entailment goal *)\n  fun extract_ex_tac ctxt i st = let\n    fun count_ex (Const (@{const_name Assertions.entails},_)$_$c) = \n      count_ex c RS @{thm HOL.mp}\n    | count_ex (Const (@{const_name Assertions.ex_assn},_)$Abs (_,_,t))\n      = count_ex t RS @{thm enorm_exI'}\n    | count_ex _ = @{thm imp_refl};\n\n    val concl = Logic.concl_of_goal (Thm.prop_of st) i |> HOLogic.dest_Trueprop;\n    val thm = count_ex concl;\n  in\n    (TRY o REPEAT_ALL_NEW (match_tac ctxt @{thms ent_ex_preI}) THEN'\n     resolve_tac ctxt [thm]) i st\n  end;\n\n\n  (* Solve Entailment *)\n  fun solve_entails_tac ctxt = let\n    val preprocess_entails_tac = \n      dflt_tac ctxt \n      THEN' extract_ex_tac ctxt\n      THEN' simp_tac \n        (put_simpset HOL_ss ctxt addsimps @{thms solve_ent_preprocess_simps});\n\n    val match_entails_tac =\n      resolve_tac ctxt @{thms entails_solve_init} \n      THEN' match_frame_tac (resolve_tac ctxt @{thms ent_refl}) ctxt\n      THEN' resolve_tac ctxt @{thms entails_solve_finalize};\n  in\n    preprocess_entails_tac\n    THEN' (TRY o\n      REPEAT_ALL_NEW (match_tac ctxt (rev (Named_Theorems.get ctxt @{named_theorems sep_eintros}))))\n    THEN_ALL_NEW (dflt_tac ctxt THEN' \n      TRY o (match_tac ctxt @{thms ent_triv} \n        ORELSE' resolve_tac ctxt @{thms ent_refl}\n        ORELSE' match_entails_tac))\n  end;\n\n\n  (***********************************)\n  (* Verification Condition Generator*)\n  (***********************************)\n\n  fun heap_rule_tac ctxt h_thms = \n    resolve_tac ctxt h_thms ORELSE' (\n    resolve_tac ctxt @{thms fi_rule} THEN' (resolve_tac ctxt h_thms THEN_IGNORE_NEWGOALS\n    frame_inference_tac ctxt));\n\n  fun vcg_step_tac ctxt = let\n    val h_thms = rev (Named_Theorems.get ctxt @{named_theorems sep_heap_rules});\n    val d_thms = rev (Named_Theorems.get ctxt @{named_theorems sep_decon_rules});\n    val heap_rule_tac = heap_rule_tac ctxt h_thms\n\n    (* Apply consequence rule if postcondition is not a schematic var *)\n    fun app_post_cons_tac i st = \n      case Logic.concl_of_goal (Thm.prop_of st) i |> HOLogic.dest_Trueprop of\n        Const (@{const_name Hoare_Triple.hoare_triple},_)$_$_$qt =>\n          if is_Var (head_of qt) then no_tac st\n          else resolve_tac ctxt @{thms cons_post_rule} i st\n      | _ => no_tac st;\n\n  in\n    CSUBGOAL (snd #> (FIRST' [\n      CHANGED o dflt_tac ctxt,\n      REPEAT_ALL_NEW (resolve_tac ctxt @{thms normalize_rules}),\n      CHANGED o (FIRST' [resolve_tac ctxt d_thms, heap_rule_tac]\n        ORELSE' (app_post_cons_tac THEN' \n          FIRST' [resolve_tac ctxt d_thms, heap_rule_tac])) \n    ]))\n  end;\n\n  fun vcg_tac ctxt = REPEAT_DETERM' (vcg_step_tac ctxt)\n\n  (***********************************)\n  (*        Automatic Solver         *)\n  (***********************************)\n\n  fun sep_autosolve_tac do_pre do_post ctxt = let\n    val pre_tacs = [\n      CHANGED o clarsimp_tac ctxt,\n      CHANGED o REPEAT_ALL_NEW (match_tac ctxt @{thms ballI allI impI conjI})\n    ];\n    val main_tacs = [\n      match_tac ctxt @{thms is_hoare_triple} THEN' CHANGED o vcg_tac ctxt,\n      match_tac ctxt @{thms is_entails} THEN' CHANGED o solve_entails_tac ctxt\n    ];\n    val post_tacs = [SELECT_GOAL (auto_tac ctxt)];\n    val tacs = (if do_pre then pre_tacs else [])\n      @ main_tacs \n      @ (if do_post then post_tacs else []);\n  in\n    REPEAT_DETERM' (CHANGED o FIRST' tacs)\n  end;\n\n\n  (***********************************)\n  (*          Method Setup           *)\n  (***********************************)\n\n  val dflt_simps_modifiers = [\n    Args.$$$ \"dflt_simps\" -- Scan.option Args.add -- Args.colon \n      >> K (Method.modifier (Named_Theorems.add @{named_theorems sep_dflt_simps}) \\<^here>),\n    Args.$$$ \"dflt_simps\" -- Scan.option Args.del -- Args.colon \n      >> K (Method.modifier (Named_Theorems.del @{named_theorems sep_dflt_simps}) \\<^here>)\n  ];\n  val heap_modifiers = [\n    Args.$$$ \"heap\" -- Scan.option Args.add -- Args.colon \n      >> K (Method.modifier (Named_Theorems.add @{named_theorems sep_heap_rules}) \\<^here>),\n    Args.$$$ \"heap\" -- Scan.option Args.del -- Args.colon \n      >> K (Method.modifier (Named_Theorems.del @{named_theorems sep_heap_rules}) \\<^here>)\n  ];\n  val decon_modifiers = [\n    Args.$$$ \"decon\" -- Scan.option Args.add -- Args.colon \n      >> K (Method.modifier (Named_Theorems.add @{named_theorems sep_decon_rules}) \\<^here>),\n    Args.$$$ \"decon\" -- Scan.option Args.del -- Args.colon \n      >> K (Method.modifier (Named_Theorems.del @{named_theorems sep_decon_rules}) \\<^here>)\n  ];\n\n  val eintros_modifiers = [\n    Args.$$$ \"eintros\" -- Scan.option Args.add -- Args.colon \n      >> K (Method.modifier (Named_Theorems.add @{named_theorems sep_eintros}) \\<^here>),\n    Args.$$$ \"eintros\" -- Scan.option Args.del -- Args.colon \n      >> K (Method.modifier (Named_Theorems.del @{named_theorems sep_eintros}) \\<^here>)\n  ];\n\n\n  val solve_entails_modifiers = dflt_simps_modifiers @ eintros_modifiers;\n\n  val vcg_modifiers = \n    heap_modifiers @ decon_modifiers @ dflt_simps_modifiers;\n\n  val sep_auto_modifiers = \n    clasimp_modifiers @ vcg_modifiers @ eintros_modifiers;\n\nend;\n\\<close>\n\nsimproc_setup assn_simproc \n  (\"h\\<Turnstile>P\" | \"P\\<Longrightarrow>\\<^sub>AQ\" | \"P\\<Longrightarrow>\\<^sub>tQ\" | \"<P> c <R>\" | \"(P::assn) = Q\") \n  = \\<open>K Seplogic_Auto.assn_simproc_fun\\<close>\n\nmethod_setup assn_simp =\\<open>Scan.succeed (fn ctxt => (SIMPLE_METHOD' (\n  CHANGED o Seplogic_Auto.dflt_tac ctxt\n)))\\<close> \"Seplogic: Simplification of assertions\"\n\nmethod_setup frame_inference = \\<open>Scan.succeed (fn ctxt => (SIMPLE_METHOD' (\n  CHANGED o Seplogic_Auto.frame_inference_tac ctxt\n)))\\<close> \"Seplogic: Frame inference\"\n\nmethod_setup solve_entails = \\<open>\n  Method.sections Seplogic_Auto.solve_entails_modifiers >>\n  (fn _ => fn ctxt => SIMPLE_METHOD' (\n  CHANGED o Seplogic_Auto.solve_entails_tac ctxt\n))\\<close> \"Seplogic: Entailment Solver\"\n\nmethod_setup heap_rule = \\<open>\n  Attrib.thms >>\n  (fn thms => fn ctxt => SIMPLE_METHOD' ( \n    let\n      val thms = case thms of [] => rev (Named_Theorems.get ctxt @{named_theorems sep_heap_rules})\n        | _ => thms\n    in\n      CHANGED o Seplogic_Auto.heap_rule_tac ctxt thms\n    end\n))\\<close> \"Seplogic: Apply rule with frame inference\"\n\n\nmethod_setup vcg = \\<open>\n  Scan.lift (Args.mode \"ss\") --\n  Method.sections Seplogic_Auto.vcg_modifiers >>\n  (fn (ss,_) => fn ctxt => SIMPLE_METHOD' (\n  CHANGED o (\n    if ss then Seplogic_Auto.vcg_step_tac ctxt \n    else Seplogic_Auto.vcg_tac ctxt\n  )\n))\\<close> \"Seplogic: Verification Condition Generator\"\n\nmethod_setup sep_auto = \n  \\<open>Scan.lift (Args.mode \"nopre\" -- Args.mode \"nopost\" -- Args.mode \"plain\") \n      --| Method.sections Seplogic_Auto.sep_auto_modifiers >>\n  (fn ((nopre,nopost),plain) => fn ctxt => SIMPLE_METHOD' (\n    CHANGED o Seplogic_Auto.sep_autosolve_tac \n      ((not nopre) andalso (not plain)) \n      ((not nopost) andalso (not plain)) ctxt\n  ))\\<close> \"Seplogic: Automatic solver\"\n\nlemmas [sep_dflt_simps] = split\n\ndeclare deconstruct_rules[sep_decon_rules]\ndeclare heap_rules[sep_heap_rules]\n\nlemmas [sep_eintros] = impI conjI exI\n\nsubsection \\<open>Semi-Automatic Reasoning\\<close>\ntext \\<open>In this section, we provide some lemmas for semi-automatic reasoning\\<close>\n\ntext \\<open>Forward reasoning with frame. Use \\<open>frame_inference\\<close>-method \n  to discharge second assumption.\\<close>\nlemma ent_frame_fwd:\n  assumes R: \"P \\<Longrightarrow>\\<^sub>A R\"\n  assumes F: \"Ps \\<Longrightarrow>\\<^sub>A P*F\"\n  assumes I: \"R*F \\<Longrightarrow>\\<^sub>A Q\"\n  shows \"Ps \\<Longrightarrow>\\<^sub>A Q\"\n  using assms\n  by (metis ent_refl ent_star_mono ent_trans)\n\nlemma mod_frame_fwd:\n  assumes M: \"h\\<Turnstile>Ps\"\n  assumes R: \"P\\<Longrightarrow>\\<^sub>AR\"\n  assumes F: \"Ps \\<Longrightarrow>\\<^sub>A P*F\"\n  shows \"h\\<Turnstile>R*F\"\n  using assms\n  by (metis ent_star_mono entails_def)\n\n\ntext \\<open>Apply precision rule with frame inference.\\<close>\nlemma prec_frame:\n  assumes PREC: \"precise P\"\n  assumes M1: \"h\\<Turnstile>(R1 \\<and>\\<^sub>A R2)\"\n  assumes F1: \"R1 \\<Longrightarrow>\\<^sub>A P x p * F1\"\n  assumes F2: \"R2 \\<Longrightarrow>\\<^sub>A P y p * F2\"\n  shows \"x=y\"\n  using preciseD[OF PREC] M1 F1 F2\n  by (metis entailsD mod_and_dist)\n\nlemma prec_frame_expl:\n  assumes PREC: \"\\<forall>x y. (h\\<Turnstile>(P x * F1) \\<and>\\<^sub>A (P y * F2)) \\<longrightarrow> x=y\"\n  assumes M1: \"h\\<Turnstile>(R1 \\<and>\\<^sub>A R2)\"\n  assumes F1: \"R1 \\<Longrightarrow>\\<^sub>A P x * F1\"\n  assumes F2: \"R2 \\<Longrightarrow>\\<^sub>A P y * F2\"\n  shows \"x=y\"\n  using assms\n  by (metis entailsD mod_and_dist)\n\n\ntext \\<open>Variant that is useful within induction proofs, where induction\n  goes over \\<open>x\\<close> or \\<open>y\\<close>\\<close>\nlemma prec_frame':\n  assumes PREC: \"(h\\<Turnstile>(P x * F1) \\<and>\\<^sub>A (P y * F2)) \\<longrightarrow> x=y\"\n  assumes M1: \"h\\<Turnstile>(R1 \\<and>\\<^sub>A R2)\"\n  assumes F1: \"R1 \\<Longrightarrow>\\<^sub>A P x * F1\"\n  assumes F2: \"R2 \\<Longrightarrow>\\<^sub>A P y * F2\"\n  shows \"x=y\"\n  using assms\n  by (metis entailsD mod_and_dist)\n\n\nlemma ent_wand_frameI:\n  assumes \"(Q -* R) * F \\<Longrightarrow>\\<^sub>A S\"\n  assumes \"P \\<Longrightarrow>\\<^sub>A F * X\"\n  assumes \"Q*X \\<Longrightarrow>\\<^sub>A R\"\n  shows \"P \\<Longrightarrow>\\<^sub>A S\"\n  using assms\n  by (metis ent_frame_fwd ent_wandI mult.commute)\n\nsubsubsection \\<open>Manual Frame Inference\\<close>\n\nlemma ent_true_drop: \n  \"P\\<Longrightarrow>\\<^sub>AQ*true \\<Longrightarrow> P*R\\<Longrightarrow>\\<^sub>AQ*true\"\n  \"P\\<Longrightarrow>\\<^sub>AQ \\<Longrightarrow> P\\<Longrightarrow>\\<^sub>AQ*true\"\n  apply (metis assn_times_comm ent_star_mono ent_true merge_true_star_ctx)\n  apply (metis assn_one_left ent_star_mono ent_true star_aci(2))\n  done\n\nlemma fr_refl: \"A\\<Longrightarrow>\\<^sub>AB \\<Longrightarrow> A*C \\<Longrightarrow>\\<^sub>AB*C\"\n  by (blast intro: ent_star_mono ent_refl)\n\nlemma fr_rot: \"(A*B \\<Longrightarrow>\\<^sub>A C) \\<Longrightarrow> (B*A \\<Longrightarrow>\\<^sub>A C)\" \n  by (simp add: assn_aci)\n\nlemma fr_rot_rhs: \"(A \\<Longrightarrow>\\<^sub>A B*C) \\<Longrightarrow> (A \\<Longrightarrow>\\<^sub>A C*B)\" \n  by (simp add: assn_aci)\n\nlemma ent_star_mono_true: \n  assumes \"A \\<Longrightarrow>\\<^sub>A A' * true\"\n  assumes \"B \\<Longrightarrow>\\<^sub>A B' * true\"\n  shows \"A*B*true \\<Longrightarrow>\\<^sub>A A'*B'*true\"\n  using ent_star_mono[OF assms] apply simp\n  using ent_true_drop(1) by blast\n\nlemma ent_refl_true: \"A \\<Longrightarrow>\\<^sub>A A * true\"\n  by (simp add: ent_true_drop(2)) \n    \nlemma entt_fr_refl: \"F\\<Longrightarrow>\\<^sub>tF' \\<Longrightarrow> F*A \\<Longrightarrow>\\<^sub>t F'*A\" by (rule entt_star_mono) auto\nlemma entt_fr_drop: \"F\\<Longrightarrow>\\<^sub>tF' \\<Longrightarrow> F*A \\<Longrightarrow>\\<^sub>t F'\"\n  using ent_true_drop(1) enttD enttI by blast \n    \n    \nmethod_setup fr_rot = \\<open>\n  let\n    fun rot_tac ctxt = \n      resolve_tac ctxt @{thms fr_rot} THEN'\n      simp_tac (put_simpset HOL_basic_ss ctxt \n        addsimps @{thms star_assoc[symmetric]})\n\n  in\n    Scan.lift Parse.nat >> \n      (fn n => fn ctxt => SIMPLE_METHOD' (\n        fn i => REPEAT_DETERM_N n (rot_tac ctxt i)))\n\n  end\n\\<close>\n\nmethod_setup fr_rot_rhs = \\<open>\n  let\n    fun rot_tac ctxt = \n      resolve_tac ctxt @{thms fr_rot_rhs} THEN'\n      simp_tac (put_simpset HOL_basic_ss ctxt \n        addsimps @{thms star_assoc[symmetric]})\n\n  in\n    Scan.lift Parse.nat >> \n      (fn n => fn ctxt => SIMPLE_METHOD' (\n        fn i => REPEAT_DETERM_N n (rot_tac ctxt i)))\n\n  end\n\\<close>\n\n\n\n(*<*)\nsubsection \\<open>Test Cases\\<close>\n\nlemma \"\\<And>x. A x * true * Q x \\<Longrightarrow>\\<^sub>A true * A x * Q x\"\n  apply simp\n  done\n\nlemma \"A * (true * B) \\<Longrightarrow>\\<^sub>A true * A * B\"\n  apply (simp)\n  done\n  \nlemma \"h\\<Turnstile>true*P*true \\<longleftrightarrow> h\\<Turnstile>P*true\"\n  by simp\n\nlemma \"A * true * \\<up>(b \\<and> c) * true * B \\<Longrightarrow>\\<^sub>A \\<up>b * \\<up>c * true *A * B\"\n  by simp\n\nlemma \"\\<exists>y c. \\<exists>\\<^sub>Ax. P x * (R x * Q y) * \\<up> (b \\<and> c) \\<Longrightarrow>\\<^sub>A (\\<exists>\\<^sub>Ax. \\<up>b * (P x * (R x * Q y) * \\<up>c))\"\n  apply simp\n  done\n\nlemma \"A * B * (\\<up>c * B * C * D * \\<up>a * true * \\<up>d) * (\\<exists>\\<^sub>Ax. E x * F * \\<up>b) * true \\<Longrightarrow>\\<^sub>A (\\<exists>\\<^sub>Ax. \\<up> (c \\<and> a \\<and> d \\<and> b) *\n          true * A * B * (true * B * C * D) * (E x * F))\"\n  apply simp\n  done\n\nlemma \"<P> c <\\<lambda>r. Q r * true * \\<up>(b r) * true * \\<up>a> \n  \\<longleftrightarrow> <P> c <\\<lambda>r. Q r * true * \\<up>(b r \\<and> a)>\"\n  apply simp\n  done\n\n\nlemma \"(h\\<Turnstile>((A*B*\\<up>b*true*\\<up>c*true) \\<and>\\<^sub>A (\\<up>(p=q)*P*Q)))\n  \\<longleftrightarrow> h \\<Turnstile> A * B * true \\<and>\\<^sub>A P * Q \\<and> b \\<and> c \\<and> p = q\"\n  apply simp\n  done\n\nlemma assumes \"FI_RESULT [(B, B), (A, A)] C D F\" \n  shows \"FI_QUERY (A*B*C) (D*B*A) F\"\n  apply (tactic \\<open>Seplogic_Auto.match_frame_tac \n    (resolve_tac @{context} @{thms ent_refl}) @{context} 1\\<close>)\n  by (rule assms)\n\nlemma \n  assumes \"FI_RESULT [(B,B), (A,A)] C emp F\"\n  shows \"FI_QUERY (A*B*C) (B*A) F\"\n  apply (tactic \\<open>Seplogic_Auto.match_frame_tac \n    (resolve_tac @{context} @{thms ent_refl}) @{context} 1\\<close>)\n  by (rule assms)\n\nlemma \n  assumes \"FI_RESULT [(B, B), (A, A)] emp emp F\"\n  shows \"FI_QUERY (A*B) (B*A) F\"\n  apply (tactic \\<open>Seplogic_Auto.match_frame_tac \n    (resolve_tac @{context} @{thms ent_refl}) @{context} 1\\<close>)\n  by (rule assms)\n\nlemma \n  assumes \"FI_RESULT [(A, A)] emp emp F\"\n  shows \"FI_QUERY (A) (A) F\"\n  apply (tactic \\<open>Seplogic_Auto.match_frame_tac \n    (resolve_tac @{context} @{thms ent_refl}) @{context} 1\\<close>)\n  by (rule assms)\n\nlemma \n  assumes \"FI_RESULT [(A, A)] (B * C * D) emp F\"\n  shows \"FI_QUERY (B*C*D*A) (A) F\"\n  apply (tactic \\<open>Seplogic_Auto.match_frame_tac \n    (resolve_tac @{context} @{thms ent_refl}) @{context} 1\\<close>)\n  by (rule assms)\n\n\nschematic_goal \n  \"P1 * P2 * P3 * P4 \\<Longrightarrow>\\<^sub>A P3 * ?R1\"\n  \"P1 * (P2 * (P3 * P4)) \\<Longrightarrow>\\<^sub>A P1 * ?R2\"\n  \"P4 * (P2 * (P1 * P3)) \\<Longrightarrow>\\<^sub>A P1 * ?R2'\"\n  \"P1 * P2 * P3 * P4 \\<Longrightarrow>\\<^sub>A P4 * ?R3\"\n  \"P1 * P2 \\<Longrightarrow>\\<^sub>A P1 * ?R4\"\n  \"P1 * P2 \\<Longrightarrow>\\<^sub>A P2 * ?R5\"\n  \"P1 \\<Longrightarrow>\\<^sub>A P1 * ?R6\"\n  \"P1 * P2 \\<Longrightarrow>\\<^sub>A emp * ?R7\"\n  by frame_inference+\n\n\nlemma \"\\<lbrakk>A; B; C; b 17\\<rbrakk> \\<Longrightarrow> \n  Q 1 5 3 \\<Longrightarrow>\\<^sub>A (\\<exists>\\<^sub>Ax y z. \\<exists>\\<^sub>Aa. Q x y z * \\<up>(b a) * \\<up>(y=5))\"\n  by solve_entails\n\nthm nth_rule\nlemma \"<P * x\\<mapsto>\\<^sub>a[1,2,3]> \n  do { v\\<leftarrow>Array.nth x 1; return v } \n  <\\<lambda>r. P * x\\<mapsto>\\<^sub>a[1,2,3] * \\<up>(r=2)>\"\n  apply sep_auto\n  done\n\n(*>*)\n\nsubsection \\<open>Quick Overview of Proof Methods\\<close> \n  text_raw \\<open>\\label{sec:auto:overview}\\<close>\ntext \\<open>\n  In this section, we give a quick overview of the available proof methods \n  and options. The most versatile proof method that we provide is\n  \\<open>sep_auto\\<close>. It tries to solve the first subgoal, invoking appropriate\n  proof methods as required. If it cannot solve the subgoal completely, it\n  stops at the intermediate state that it could not handle any more. \n\n  \\<open>sep_auto\\<close> can be configured by \n  section-arguments for the simplifier, the classical reasoner, and all\n  section-arguments for the verification condition generator and \n  entailment solver. Moreover, it takes an optional mode argument (mode), where\n  valid modes are:\n  \\begin{description}\n    \\item[(nopre)] No preprocessing of goal. The preprocessor tries to clarify\n      and simplify the goal before the main method is invoked.\n    \\item[(nopost)] No postprocessing of goal. The postprocessor tries to \n      solve or simplify goals left over by verification condition generation or\n      entailment solving.\n    \\item[(plain)] Neither pre- nor postprocessing. Just applies vcg and \n      entailment solver.  \n  \\end{description}\n\n  \\paragraph{Entailment Solver.} The entailment solver processes goals of the\n  form \\<open>P \\<Longrightarrow>\\<^sub>A Q\\<close>. It is invoked by the method \\<open>solve_entails\\<close>.\n  It first tries to pull out pure parts of\n  \\<open>P\\<close> and \\<open>Q\\<close>. This may introduce quantifiers, conjunction,\n  and implication into the goal, that are eliminated by resolving with rules\n  declared as \\<open>sep_eintros\\<close> (method argument: eintros[add/del]:).\n  Moreover, it simplifies with rules declared as \\<open>sep_dflt_simps\\<close> \n  (section argument: \\<open>dflt_simps[add/del]:\\<close>).\n\n  Now, \\<open>P\\<close> and \\<open>Q\\<close> should have the form \\<open>X\\<^sub>1*\\<dots>*X\\<^sub>n\\<close>.\n  Then, the frame-matcher is used to match all items of \\<open>P\\<close> with items\n  of \\<open>Q\\<close>, and thus solve the implication. Matching is currently done \n  syntactically, but can instantiate schematic variables.\n\n  Note that, by default, existential introduction is declared as \n  \\<open>sep_eintros\\<close>-rule. This introduces schematic variables, that can\n  later be matched against. However, in some cases, the matching may instantiate\n  the schematic variables in an undesired way. In this case, the argument \n  \\<open>eintros del: exI\\<close> should be passed to the entailment solver, and\n  the existential quantifier should be instantiated manually.\n\n  \\paragraph{Frame Inference}\n  The method \\<open>frame_inference\\<close> tries to solve a goal of the \n  form \\<open>P\\<Longrightarrow>Q*?F\\<close>, by matching \\<open>Q\\<close> against the parts of \n  \\<open>P\\<close>, and instantiating \\<open>?F\\<close> accordingly. \n  Matching is done syntactically, possibly \n  instantiating schematic variables. \\<open>P\\<close> and \\<open>Q\\<close> should be \n  assertions separated by \\<open>*\\<close>. Note that frame inference does no \n  simplification or other kinds of normalization.\n\n  The method \\<open>heap_rule\\<close> applies the specified heap rules, using\n  frame inference if necessary. If no rules are specified, the default \n  heap rules are used.\n\n  \\paragraph{Verification Condition Generator}\n  The verification condition generator processes goals of the form \n  \\<open><P>c<Q>\\<close>. It is invoked by the method \\<open>vcg\\<close>.\n  First, it tries to pull out pure parts and simplifies with\n  the default simplification rules. Then, it tries to resolve the goal with\n  deconstruct rules (attribute: \\<open>sep_decon_rules\\<close>, \n  section argument: \\<open>decon[add/del]:\\<close>), and if this does not succeed, \n  it tries\n  to resolve the goal with heap rules (attribute: \\<open>sep_heap_rules\\<close>, \n  section argument: \\<open>heap[add/del]:\\<close>), using the frame rule and \n  frame inference.\n  If resolving is not possible, it also tries to apply the consequence rule to\n  make the postcondition a schematic variable.\n\\<close>\n\n\n(*<*)\nsubsection \\<open>Hiding of internal stuff\\<close>\nhide_const (open) FI SLN\n(*>*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Separation_Logic_Imperative_HOL/Automation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.3263265952414386}}
{"text": "theory Sepref_Misc\nimports \n  Refine_Monadic.Refine_Monadic\n  PO_Normalizer\n  \"List-Index.List_Index\"\n  Separation_Logic_Imperative_HOL.Sep_Main\n  Named_Theorems_Rev\n  \"HOL-Eisbach.Eisbach\"\n  Separation_Logic_Imperative_HOL.Array_Blit\nbegin\n\n  hide_const (open) CONSTRAINT\n\n  (* Additions for List_Index *)  \n  lemma index_of_last_distinct[simp]: \n    \"distinct l \\<Longrightarrow> index l (last l) = length l - 1\"  \n    apply (cases l rule: rev_cases)\n    apply (auto simp: index_append)\n    done\n\n  lemma index_eqlen_conv[simp]: \"index l x = length l \\<longleftrightarrow> x\\<notin>set l\"\n    by (auto simp: index_size_conv)\n\n\n  subsection \\<open>Iterated Curry and Uncurry\\<close>    \n\n\n  text \\<open>Uncurry0\\<close>  \n  definition \"uncurry0 c \\<equiv> \\<lambda>_::unit. c\"\n  definition curry0 :: \"(unit \\<Rightarrow> 'a) \\<Rightarrow> 'a\" where \"curry0 f = f ()\"\n  lemma uncurry0_apply[simp]: \"uncurry0 c x = c\" by (simp add: uncurry0_def)\n\n  lemma curry_uncurry0_id[simp]: \"curry0 (uncurry0 f) = f\" by (simp add: curry0_def)\n  lemma uncurry_curry0_id[simp]: \"uncurry0 (curry0 g) = g\" by (auto simp: curry0_def)\n  lemma param_uncurry0[param]: \"(uncurry0,uncurry0) \\<in> A \\<rightarrow> (unit_rel\\<rightarrow>A)\" by auto\n    \n  text \\<open>Abbreviations for higher-order uncurries\\<close>    \n  abbreviation \"uncurry2 f \\<equiv> uncurry (uncurry f)\"\n  abbreviation \"curry2 f \\<equiv> curry (curry f)\"\n  abbreviation \"uncurry3 f \\<equiv> uncurry (uncurry2 f)\"\n  abbreviation \"curry3 f \\<equiv> curry (curry2 f)\"\n  abbreviation \"uncurry4 f \\<equiv> uncurry (uncurry3 f)\"\n  abbreviation \"curry4 f \\<equiv> curry (curry3 f)\"\n  abbreviation \"uncurry5 f \\<equiv> uncurry (uncurry4 f)\"\n  abbreviation \"curry5 f \\<equiv> curry (curry4 f)\"\n  abbreviation \"uncurry6 f \\<equiv> uncurry (uncurry5 f)\"\n  abbreviation \"curry6 f \\<equiv> curry (curry5 f)\"\n  abbreviation \"uncurry7 f \\<equiv> uncurry (uncurry6 f)\"\n  abbreviation \"curry7 f \\<equiv> curry (curry6 f)\"\n  abbreviation \"uncurry8 f \\<equiv> uncurry (uncurry7 f)\"\n  abbreviation \"curry8 f \\<equiv> curry (curry7 f)\"\n  abbreviation \"uncurry9 f \\<equiv> uncurry (uncurry8 f)\"\n  abbreviation \"curry9 f \\<equiv> curry (curry8 f)\"\n\n    \n    \n  lemma fold_partial_uncurry: \"uncurry (\\<lambda>(ps, cf). f ps cf) = uncurry2 f\" by auto\n\n  lemma curry_shl: \n    \"\\<And>g f. (g \\<equiv> curry f) \\<equiv> (uncurry g \\<equiv> f)\"\n    \"\\<And>g f. (g \\<equiv> curry0 f) \\<equiv> (uncurry0 g \\<equiv> f)\"\n    by (atomize (full); auto)+\n  \n  lemma curry_shr: \n    \"\\<And>f g. (curry f \\<equiv> g) \\<equiv> (f \\<equiv> uncurry g)\"\n    \"\\<And>f g. (curry0 f \\<equiv> g) \\<equiv> (f \\<equiv> uncurry0 g)\"\n    by (atomize (full); auto)+\n  \n  lemmas uncurry_shl = curry_shr[symmetric]  \n  lemmas uncurry_shr = curry_shl[symmetric]  \n  \nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/Lib/Sepref_Misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352403, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.32632659524143853}}
{"text": "theory rg_cond_post\nimports mem_spec invariant (*\"../picore-lib/picore_lemma\"*)\nbegin\n\nsection \\<open>Rely-guarantee condition of events\\<close>\n\nsubsection \\<open>defs of rely-guarantee conditions\\<close>\ndefinition lvars_nochange_lemma :: \"Thread \\<Rightarrow> State \\<Rightarrow> State \\<Rightarrow> bool\"\nwhere \"lvars_nochange_lemma t r s \\<equiv> \n    posting_msg r t = posting_msg s t (*  \\<and> statPend r t = statPend s t  *)   (*IF not, OSMboxPost succeed, else Pend succeed) statpend and tmout  *)\n    \\<and> ret r t = ret s t \\<and> endt r t = endt s t (* \\<and> tmout r t = tmout s t *)\n    \\<and> th r t = th s t \\<and> need_resched r t = need_resched s t \"\n\n\ndefinition lvars_nochange_lemma_rel :: \"Thread \\<Rightarrow> (State \\<times> State) set\"\nwhere \"lvars_nochange_lemma_rel t \\<equiv> {(s,r). lvars_nochange_lemma t s r}\"\n\ndefinition lvars_nochange_lemma_4all :: \"(State \\<times> State) set\"\n  where \"lvars_nochange_lemma_4all \\<equiv> {(s,r). \\<forall>t. lvars_nochange_lemma t s r}\"\n\n\n\ndefinition lvars_nochange :: \"Thread \\<Rightarrow> State \\<Rightarrow> State \\<Rightarrow> bool\"\nwhere \"lvars_nochange t r s \\<equiv> \n    posting_msg r t = posting_msg s t  \\<and> statPend r t = statPend s t     (*IF not, OSMboxPost succeed, else Pend succeed) statpend and tmout  *)\n    \\<and> ret r t = ret s t \\<and> endt r t = endt s t  \\<and> tmout r t = tmout s t\n    \\<and> th r t = th s t \\<and> need_resched r t = need_resched s t \"\n\n\ndefinition lvars_nochange_rel :: \"Thread \\<Rightarrow> (State \\<times> State) set\"\nwhere \"lvars_nochange_rel t \\<equiv> {(s,r). lvars_nochange t s r}\"\n\ndefinition lvars_nochange_4all :: \"(State \\<times> State) set\"\nwhere \"lvars_nochange_4all \\<equiv> {(s,r). \\<forall>t. lvars_nochange t s r}\"\n\n\n\n\nlemma lvars_nochange_lemma_trans:\n\"lvars_nochange_lemma t x y \\<Longrightarrow> lvars_nochange_lemma t y z \\<Longrightarrow> lvars_nochange_lemma t x z\"\napply(simp add:lvars_nochange_lemma_def)\ndone\n\nlemma lvars_nochange_lemma_sym:\n\"lvars_nochange_lemma t x y \\<Longrightarrow> lvars_nochange_lemma t y x\"\napply(simp add:lvars_nochange_lemma_def)\ndone\n\nlemma lvars_nochange_lemma_refl:\n\"lvars_nochange_lemma t x x\"\napply(simp add:lvars_nochange_lemma_def)\ndone\n\n\nlemma lv_noch_all1: \"(s,r)\\<in>lvars_nochange_lemma_4all \n      \\<Longrightarrow> (s,r)\\<in>lvars_nochange_lemma_rel t \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> (s,r)\\<in>lvars_nochange_lemma_rel t')\"\n  unfolding lvars_nochange_lemma_4all_def lvars_nochange_lemma_rel_def by auto\n\nlemma lv_noch_all2: \"(s,r)\\<in>lvars_nochange_lemma_rel t \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> lvars_nochange_lemma t' s r) \n        \\<Longrightarrow> (s,r)\\<in>lvars_nochange_lemma_4all\"\n  unfolding lvars_nochange_lemma_4all_def lvars_nochange_lemma_rel_def by auto\n\n\ndefinition gvars_nochange :: \"State \\<Rightarrow> State \\<Rightarrow> bool\"\nwhere \"gvars_nochange s r \\<equiv> cur r = cur s \\<and> tick r = tick s \\<and> thd_state r = thd_state s \n                          \\<and> OSMailBoxs r = OSMailBoxs s \\<and> OSMailbox_info r = OSMailbox_info s\"\n\ndefinition gvars_nochange_rel :: \"(State \\<times> State) set\"\nwhere \"gvars_nochange_rel \\<equiv> {(s,r). gvars_nochange s r}\"\n\n\ntext\\<open> the static configurations of struct Mail_Box unchange('buf' is the only static member of Mail_box) \\<close>\n\ndefinition gvars_conf :: \"State \\<Rightarrow> State \\<Rightarrow> bool\"\nwhere \"gvars_conf s r \\<equiv> \n  OSMailBoxs r = OSMailBoxs s \n    \\<and> (\\<forall>p. buf (OSMailbox_info s p) = buf (OSMailbox_info r p))\"\n\n\ndefinition gvars_conf_stable :: \"(State \\<times> State) set\"\nwhere \"gvars_conf_stable \\<equiv> {(s,r). gvars_conf s r}\"\n\ndefinition inv_sta_rely :: \"(State \\<times> State) set\"\nwhere \"inv_sta_rely \\<equiv> {(s,r). inv s \\<longrightarrow> inv r}\"\n\ndefinition inv_sta_guar :: \"(State \\<times> State) set\"\nwhere \"inv_sta_guar \\<equiv> {(s,r). inv s \\<longrightarrow> inv r}\"\n\n\nlemma glnochange_inv0:\n  \"(a, b) \\<in> lvars_nochange_lemma_4all \\<Longrightarrow> cur a = cur b \\<Longrightarrow>\n     thd_state a = thd_state b \\<Longrightarrow> OSMailBoxs a = OSMailBoxs b \\<Longrightarrow>\n     OSMailbox_info a = OSMailbox_info b \\<Longrightarrow> inv a \\<Longrightarrow> inv b\"\n  apply(simp add:lvars_nochange_lemma_4all_def lvars_nochange_lemma_def inv_def)\n  apply(rule conjI) apply(simp add:inv_cur_def)\n   apply(simp add:inv_thd_waitq_def) apply auto[1]\ndone\n\n\nlemma glnochange_inv: \n  \"inv a \\<Longrightarrow> \\<forall>t'. t' \\<noteq> t1 \\<longrightarrow> lvars_nochange_lemma t' a b \n      \\<Longrightarrow> gvars_nochange a b \\<Longrightarrow> lvars_nochange_lemma t1 a b \\<Longrightarrow> inv b\" \n  apply(subgoal_tac \"(a, b) \\<in> lvars_nochange_lemma_4all\")\n    apply(simp add: gvars_nochange_def)\n    using glnochange_inv0 apply auto\n  using lv_noch_all2[of a b t1] apply auto[1] \n  by(simp add: lvars_nochange_lemma_rel_def)\n\n\ndefinition Schedule_rely :: \"(State \\<times> State) set\"\nwhere \"Schedule_rely \\<equiv> {(s,r). inv s \\<longrightarrow> inv r} \\<union> Id\"\n\n\ndefinition Schedule_guar :: \"(State \\<times> State) set\"\nwhere \"Schedule_guar \\<equiv> \n  ((*\\<lbrace>(\\<ordmasculine>cur \\<noteq> Some t \\<longrightarrow> \n          (\\<ordmasculine>cur \\<noteq> None \\<longrightarrow> \\<ordfeminine>thd_state = (\\<ordmasculine>thd_state (the (\\<ordmasculine>cur) := READY))(t := RUNNING) \\<and> \\<ordfeminine>cur = Some t)\n        \\<and> (\\<ordmasculine>cur = None \\<longrightarrow> \\<ordfeminine>thd_state = \\<ordmasculine>thd_state (t := RUNNING)) \\<and> \\<ordfeminine>cur = Some t)\n    \\<and> (\\<ordmasculine>cur = Some t \\<longrightarrow> \\<ordfeminine>thd_state = \\<ordmasculine>thd_state \\<and> \\<ordmasculine>cur = \\<ordfeminine>cur) \\<rbrace>*)\n   {(s,r). inv s \\<longrightarrow> inv r}\n   \\<inter> \\<lbrace>\\<ordmasculine>tick = \\<ordfeminine>tick \\<and> \\<ordmasculine>OSMailBoxs = \\<ordfeminine>OSMailBoxs \\<and> \\<ordmasculine>OSMailbox_info = \\<ordfeminine>OSMailbox_info\\<rbrace> \n   \\<inter> (\\<Inter>t. lvars_nochange_rel t)) \\<union> Id\"\n\n\ndefinition Schedule_RGCond :: \"Thread \\<Rightarrow> (State) PiCore_Hoare.rgformula\"\n  where \"Schedule_RGCond t \\<equiv> \n          RG[{s. inv s},\n          Schedule_rely,  Schedule_guar,\n          {s. inv s}]\"\n\ndefinition Tick_rely :: \"(State \\<times> State) set\"\nwhere \"Tick_rely \\<equiv> \\<lbrace>\\<ordmasculine>tick = \\<ordfeminine>tick\\<rbrace> \\<union> Id\"\n\ndefinition Tick_guar :: \"(State \\<times> State) set\"\nwhere \"Tick_guar \\<equiv> (\\<lbrace>\\<ordfeminine>tick = \\<ordmasculine>tick + 1 \\<and> \\<ordmasculine>cur = \\<ordfeminine>cur \\<and> \\<ordmasculine>thd_state = \\<ordfeminine>thd_state\n                      \\<and> \\<ordmasculine>OSMailBoxs = \\<ordfeminine>OSMailBoxs \\<and> \\<ordmasculine>OSMailbox_info = \\<ordfeminine>OSMailbox_info\\<rbrace>\n                      \\<inter> (\\<Inter>t. lvars_nochange_rel t)) \\<union> Id\"\n\ndefinition Tick_RGCond :: \"(State) PiCore_Hoare.rgformula\"\n  where \"Tick_RGCond \\<equiv> \n          RG[\\<lbrace>True\\<rbrace>, Tick_rely, Tick_guar, \\<lbrace>True\\<rbrace>]\"\n\n\ndefinition OSMboxPost_pre :: \"Thread \\<Rightarrow> State set\"\nwhere \"OSMboxPost_pre t \\<equiv> {s. inv s}\"\n\ndefinition OSMboxPost_rely_lemma :: \"Thread \\<Rightarrow> (State \\<times> State) set\"\nwhere \"OSMboxPost_rely_lemma t \\<equiv> \n   ((lvars_nochange_lemma_rel t \\<inter> gvars_conf_stable\n    \\<inter> {(s,r). inv s \\<longrightarrow> inv r}\n    \\<inter> {(s,r).(cur s = Some t \\<longrightarrow> OSMailbox_info s = OSMailbox_info r\n                  \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> lvars_nochange_lemma t' s r))}) \\<union> Id)\"     \\<comment> \\<open>The rely condition of Mem_alloc is the same as one of Mem_free \\<close>\n\ndefinition OSMboxPost_guar :: \"Thread \\<Rightarrow> (State \\<times> State) set\"  \nwhere \"OSMboxPost_guar t \\<equiv> \n        ((gvars_conf_stable \\<inter> \n          {(s,r). (cur s \\<noteq> Some t \\<longrightarrow> gvars_nochange s r \\<and> lvars_nochange_lemma t s r)\n                  \\<and> (cur s = Some t \\<longrightarrow> inv s \\<longrightarrow> inv r) \n                  \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> lvars_nochange_lemma t' s r) }\n          \\<inter> \\<lbrace>\\<ordmasculine>tick = \\<ordfeminine>tick\\<rbrace>) \\<union> Id)\"\n\n\ndefinition OSMboxPost_post :: \"Thread \\<Rightarrow> State set\"\nwhere \"OSMboxPost_post t \\<equiv> {s. inv s}\"\n\ndefinition OSMboxPost_RGCond_lemma :: \"Thread \\<Rightarrow>  (State) PiCore_Hoare.rgformula\"\n  where \"OSMboxPost_RGCond_lemma t  \\<equiv> \n          RG[OSMboxPost_pre t,\n             OSMboxPost_rely_lemma t,\n              OSMboxPost_guar t,\n              OSMboxPost_post t]\"\n\n\ndefinition OSMboxPost_rely :: \"Thread \\<Rightarrow> (State \\<times> State) set\"\nwhere \"OSMboxPost_rely t \\<equiv> \n   ((lvars_nochange_rel t \\<inter> gvars_conf_stable\n    \\<inter> {(s,r). inv s \\<longrightarrow> inv r}\n    \\<inter> {(s,r).(cur s = Some t \\<longrightarrow> OSMailbox_info s = OSMailbox_info r\n                  \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> lvars_nochange t' s r))}) \\<union> Id)\"     \\<comment> \\<open>The rely condition of Mem_alloc is the same as one of Mem_free \\<close>\n\n\ndefinition OSMboxPost_RGCond :: \"Thread \\<Rightarrow>  (State) PiCore_Hoare.rgformula\"\n  where \"OSMboxPost_RGCond t  \\<equiv> \n          RG[OSMboxPost_pre t,\n             OSMboxPost_rely t,\n              OSMboxPost_guar t,\n              OSMboxPost_post t]\"\n\n\ndefinition OSMboxAccept_pre :: \"Thread \\<Rightarrow> State set\"\n  where \"OSMboxAccept_pre t \\<equiv> {s. inv s}\"\n\ndefinition OSMboxAccept_rely :: \"Thread \\<Rightarrow> (State \\<times> State) set\"\n\nwhere \"OSMboxAccept_rely t \\<equiv> \n   ((lvars_nochange_rel t \\<inter> gvars_conf_stable\n    \\<inter> {(s,r). inv s \\<longrightarrow> inv r}\n    \\<inter> {(s,r).(cur s = Some t \\<longrightarrow> OSMailbox_info s = OSMailbox_info r\n                  \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> lvars_nochange t' s r))}) \\<union> Id)\"     \\<comment> \\<open>The rely condition of Mem_alloc is the same as one of Mem_free \\<close>\n\ndefinition OSMboxAccept_guar :: \"Thread \\<Rightarrow> (State \\<times> State) set\"  \nwhere \"OSMboxAccept_guar t \\<equiv> \n        ((gvars_conf_stable \\<inter> \n          {(s,r). (cur s \\<noteq> Some t \\<longrightarrow> gvars_nochange s r \\<and> lvars_nochange t s r)\n                  \\<and> (cur s = Some t \\<longrightarrow> inv s \\<longrightarrow> inv r) \n                  \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> lvars_nochange t' s r) }\n          \\<inter> \\<lbrace>\\<ordmasculine>tick = \\<ordfeminine>tick\\<rbrace>) \\<union> Id)\"\n\n\ndefinition OSMboxAccept_post :: \"Thread \\<Rightarrow> State set\"\nwhere \"OSMboxAccept_post t \\<equiv> {s. inv s}\"\n\n\ndefinition OSMboxAccept_RGCond :: \"Thread \\<Rightarrow>  (State) PiCore_Hoare.rgformula\"\n  where \"OSMboxAccept_RGCond t  \\<equiv> \n          RG[OSMboxAccept_pre t,\n             OSMboxAccept_rely t,\n              OSMboxAccept_guar t,\n              OSMboxAccept_post t]\"\n\n\n\n\ndefinition OSMboxPend_pre :: \"Thread \\<Rightarrow> State set\"\nwhere \"OSMboxPend_pre t \\<equiv> {s. inv s }\"\n\ndefinition OSMboxPend_rely :: \"Thread \\<Rightarrow> (State \\<times> State) set\"\nwhere \"OSMboxPend_rely t \\<equiv> \n   ((lvars_nochange_rel t \\<inter> gvars_conf_stable\n    \\<inter> {(s,r). inv s \\<longrightarrow> inv r}\n    \\<inter> {(s,r).(cur s = Some t \\<longrightarrow> OSMailbox_info s = OSMailbox_info r\n                  \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> lvars_nochange t' s r))}) \\<union> Id)\"\n\n\ndefinition OSMboxPend_guar :: \"Thread \\<Rightarrow> (State \\<times> State) set\"\nwhere \"OSMboxPend_guar t \\<equiv> \n        ((gvars_conf_stable \\<inter> \n          {(s,r). (cur s \\<noteq> Some t \\<longrightarrow> gvars_nochange s r \\<and> lvars_nochange t s r)\n                  \\<and> (cur s = Some t \\<longrightarrow> inv s \\<longrightarrow> inv r) \n                  \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> lvars_nochange t' s r) }\n          \\<inter> \\<lbrace>\\<ordmasculine>tick = \\<ordfeminine>tick\\<rbrace>) \\<union> Id)\"\n\ndefinition OSMboxPend_post :: \"Thread \\<Rightarrow> State set\"\nwhere \"OSMboxPend_post t \\<equiv> {s. inv s }\"\n\n\n\ndefinition OSMboxPend_RGCond :: \"Thread \\<Rightarrow>  (State) PiCore_Hoare.rgformula\"\n  where \"OSMboxPend_RGCond t  \\<equiv> \n          RG[OSMboxPend_pre t,\n             OSMboxPend_rely t,\n              OSMboxPend_guar t,\n              OSMboxPend_post t]\"\n\n\n\nsubsection \\<open>stablility, subset relations of rely-guarantee conditions\\<close>\n\n\nlemma stable_inv_Post_rely:\n  \"(s,r) \\<in> OSMboxPost_rely t \\<Longrightarrow> inv s \\<Longrightarrow> inv r\"\n  using OSMboxPost_rely_def by blast\n\nlemma stable_inv_Post_rely1: \"stable \\<lbrace> \\<acute>inv \\<rbrace> (OSMboxPost_rely t)\"\n  using stable_inv_Post_rely unfolding stable_def by auto\n\nlemma stable_inv_Accept_rely:\n  \"(s,r) \\<in> OSMboxAccept_rely t \\<Longrightarrow> inv s \\<Longrightarrow> inv r\"\n  using OSMboxAccept_rely_def by blast\n\nlemma stable_inv_Accept_rely1: \"stable \\<lbrace> \\<acute>inv \\<rbrace> (OSMboxAccept_rely t)\"\n  by (simp add: stable_def stable_inv_Accept_rely)\n\n\n\nlemma stable_inv_sched_rely:\n  \"(s,r)\\<in>Schedule_rely \\<Longrightarrow> inv s \\<Longrightarrow> inv r\"\n  apply (simp add:Schedule_rely_def) by auto\n\nlemma stable_inv_sched_rely1: \"stable \\<lbrace>\\<acute>inv\\<rbrace> Schedule_rely\"\n  using stable_inv_sched_rely unfolding stable_def by auto\n\nlemma sched_guar_stb_inv: \n  \"(s,r)\\<in>Schedule_guar \\<Longrightarrow> inv s \\<Longrightarrow> inv r\"\n  apply(simp add:Schedule_guar_def) \n  apply(erule disjE) by auto\n\n\nlemma tick_guar_stb_inv:\n\"stable (Collect invariant.inv) Tick_guar\"\n\nlemma OSMboxPost_guar_stb_inv: \"stable \\<lbrace>\\<acute>inv \\<rbrace> (OSMboxPost_guar t)\"  (* _lemma *)\nproof-\n  { \n    fix x\n    assume a0: \"inv x\"\n    {\n      fix y \n      assume b0: \"(x,y) \\<in> OSMboxPost_guar t\"\n      hence \"(x,y) \\<in> {(s,r). (cur s \\<noteq> Some t \\<longrightarrow> gvars_nochange s r \\<and> lvars_nochange t s r)\n             \\<and> (cur s = Some t \\<longrightarrow> inv s \\<longrightarrow> inv r)\n             \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> lvars_nochange t' s r)}\"\n        using OSMboxPost_guar_def gvars_nochange_def lvars_nochange_def by auto\n      hence \"(cur x \\<noteq> Some t \\<longrightarrow> gvars_nochange x y \\<and> lvars_nochange t x y)\n              \\<and> (cur x = Some t \\<longrightarrow> inv x \\<longrightarrow>inv y)\n              \\<and> (\\<forall>t' . t' \\<noteq> t \\<longrightarrow> lvars_nochange t' x y)\" by simp\n      hence \"inv y\"\n        apply(case_tac \"cur x \\<noteq> Some t\")\n         apply (simp add: gvars_nochange_def lvars_nochange_def) using a0 apply clarify\n         apply(simp add:inv_def)\n         apply (rule conjI) apply(simp add:inv_cur_def)\n        using a0 by auto\n    }\n  }\n  then show ?thesis by (simp add:stable_def)\nqed\n\nlemma Post_guar_eq_Accept_guar:\"OSMboxAccept_guar t \\<subseteq> OSMboxPost_guar t\"\n  apply (simp add: OSMboxAccept_guar_def OSMboxPost_guar_def)\n  apply auto\n                 apply(simp add: lvars_nochange_def lvars_nochange_lemma_def gvars_conf_stable_def gvars_conf_def)\n                apply(simp add: lvars_nochange_def lvars_nochange_lemma_def gvars_conf_stable_def gvars_conf_def)\n               apply(simp add: lvars_nochange_def lvars_nochange_lemma_def gvars_conf_stable_def gvars_conf_def)\n              apply(simp add: lvars_nochange_def lvars_nochange_lemma_def gvars_conf_stable_def gvars_conf_def)\n             apply(simp add: lvars_nochange_def lvars_nochange_lemma_def gvars_conf_stable_def gvars_conf_def)\n            apply(simp add: lvars_nochange_def lvars_nochange_lemma_def gvars_conf_stable_def gvars_conf_def)\n           apply(simp add: lvars_nochange_def lvars_nochange_lemma_def gvars_conf_stable_def gvars_conf_def)\n  apply(simp add: lvars_nochange_def lvars_nochange_lemma_def gvars_conf_stable_def gvars_conf_def)\n  done        \n\n\n\nlemma OSMboxAccept_guar_stb_inv: \"stable \\<lbrace> \\<acute>inv \\<rbrace> (OSMboxAccept_guar t)\"\nproof-\n  { \n    fix x\n    assume a0: \"inv x\"\n    {\n      fix y \n      assume b0: \"(x,y) \\<in> OSMboxPost_guar t\"\n      hence \"(x,y) \\<in> {(s,r). (cur s \\<noteq> Some t \\<longrightarrow> gvars_nochange s r \\<and> lvars_nochange t s r)\n             \\<and> (cur s = Some t \\<longrightarrow> inv s \\<longrightarrow> inv r)\n             \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> lvars_nochange t' s r)}\"\n        using OSMboxPost_guar_def gvars_nochange_def lvars_nochange_def by auto\n      hence \"(cur x \\<noteq> Some t \\<longrightarrow> gvars_nochange x y \\<and> lvars_nochange t x y)\n              \\<and> (cur x = Some t \\<longrightarrow> inv x \\<longrightarrow>inv y)\n              \\<and> (\\<forall>t' . t' \\<noteq> t \\<longrightarrow> lvars_nochange t' x y)\" by simp\n      hence \"inv y\"\n        apply(case_tac \"cur x \\<noteq> Some t\")\n         apply (simp add: gvars_nochange_def lvars_nochange_def) using a0 apply clarify\n         apply(simp add:inv_def)\n         apply (rule conjI) apply(simp add:inv_cur_def)\n        using a0 by auto\n    }\n  }\n  then show ?thesis by (simp add:stable_def)\nqed\n\n\nlemma OSMboxPend_guar_stb_inv:\"stable \\<lbrace>\\<acute>inv \\<rbrace> (OSMboxPend_guar t) \"\n  apply(subgoal_tac \" OSMboxPend_guar t = OSMboxAccept_guar t \")\n  apply(simp add:OSMboxAccept_guar_stb_inv)\n  by (simp add: OSMboxAccept_guar_def OSMboxPend_guar_def) \n\n\n\nlemma OSMboxAccept_pre_stb: \"stable (OSMboxAccept_pre t) (OSMboxAccept_rely t)\"\n  by (simp add: OSMboxAccept_pre_def stable_inv_Accept_rely1)\n                                              \nlemma OSMboxAccept_post_stb: \"stable (OSMboxPost_post t) (OSMboxPost_rely t)\"\n  by (simp add: OSMboxPost_post_def stable_inv_Post_rely1)\n\nlemma OSMboxPost_pre_stb: \"stable (OSMboxPost_pre t) (OSMboxPost_rely t)\"\n  by (simp add: OSMboxPost_pre_def stable_inv_Post_rely1)\n\nlemma OSMboxPost_post_stb: \"stable (OSMboxPost_pre t) (OSMboxPost_rely t)\"\n  by (simp add: OSMboxPost_pre_stb)\n\n\n\n\n\n\n\n\n\nend", "meta": {"author": "zerrymore", "repo": "Verified-Mailbox", "sha": "778ac0f3b87f342e02dd4a6ad86abeb32be82d42", "save_path": "github-repos/isabelle/zerrymore-Verified-Mailbox", "path": "github-repos/isabelle/zerrymore-Verified-Mailbox/Verified-Mailbox-778ac0f3b87f342e02dd4a6ad86abeb32be82d42/PiCore-SIMP-mailbox/rg_cond_post.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3259792352434987}}
{"text": "section \\<open>Recursive DFS Implementation\\<close>\ntheory Rec_Impl\nimports General_DFS_Structure\nbegin\n\nlocale rec_impl_defs =\n  graph_defs G + gen_dfs_defs gds V0\n  for G :: \"('v, 'more) graph_rec_scheme\"\n  and gds :: \"('v,'s)gen_dfs_struct\"\n  +\n  fixes pending :: \"'s \\<Rightarrow> 'v rel\"\n  fixes stack :: \"'s \\<Rightarrow> 'v list\"\n  fixes choose_pending :: \"'v \\<Rightarrow> 'v option \\<Rightarrow> 's \\<Rightarrow> 's nres\"\nbegin\n\n  definition \"gen_step' s \\<equiv> do { ASSERT (gen_rwof s);\n    if gds_is_empty_stack gds s then do {\n      v0 \\<leftarrow> SPEC (\\<lambda>v0. v0 \\<in> V0 \\<and> \\<not> gds_is_discovered gds v0 s);\n      gds_new_root gds v0 s\n    } else do {\n      let u = hd (stack s);\n      Vs \\<leftarrow> SELECT (\\<lambda>v. (u,v)\\<in>pending s);\n      s \\<leftarrow> choose_pending u Vs s;\n      case Vs of \n        None \\<Rightarrow> gds_finish gds u s\n      | Some v \\<Rightarrow>\n         if gds_is_discovered gds v s\n         then if gds_is_finished gds v s then gds_cross_edge gds u v s\n              else gds_back_edge gds u v s\n         else gds_discover gds u v s\n    }}\"  \n\n  definition \"gen_dfs' \\<equiv> gds_init gds \\<bind> WHILE gen_cond gen_step'\"\n  abbreviation \"gen_rwof' \\<equiv> rwof (gds_init gds) gen_cond gen_step'\"\n\n  definition rec_impl where [DFS_code_unfold]:\n  \"rec_impl \\<equiv> do {\n    s \\<leftarrow> gds_init gds;\n\n    FOREACHci \n      (\\<lambda>it s. \n          gen_rwof' s \n        \\<and> (\\<not>gds_is_break gds s \\<longrightarrow> gds_is_empty_stack gds s\n            \\<and> V0-it \\<subseteq> gen_discovered s))\n      V0\n      (Not o gds_is_break gds) \n      (\\<lambda>v0 s. do {\n        let s0 = GHOST s;\n        if gds_is_discovered gds v0 s then\n          RETURN s\n        else do {\n          s \\<leftarrow> gds_new_root gds v0 s;\n          if gds_is_break gds s then\n            RETURN s\n          else do {\n            REC_annot\n            (\\<lambda>(u,s). gen_rwof' s \\<and> \\<not>gds_is_break gds s \n                \\<and> (\\<exists>stk. stack s = u#stk) \n                \\<and> E \\<inter> {u}\\<times>UNIV \\<subseteq> pending s)\n            (\\<lambda>(u,s) s'. \n                  gen_rwof' s' \n                \\<and> (\\<not>gds_is_break gds s' \\<longrightarrow> \n                    stack s' = tl (stack s) \n                  \\<and> pending s' = pending s - {u} \\<times> UNIV\n                  \\<and> gen_discovered s' \\<supseteq> gen_discovered s\n                  ))\n            (\\<lambda>D (u,s). do {\n              s \\<leftarrow> FOREACHci \n                (\\<lambda>it s'. gen_rwof' s'\n                \\<and> (\\<not>gds_is_break gds s' \\<longrightarrow>\n                    stack s' = stack s \n                  \\<and> pending s' = (pending s - {u}\\<times>(E``{u} - it))\n                  \\<and> gen_discovered s' \\<supseteq> gen_discovered s \\<union> (E``{u} - it)\n                  )) \n                (E``{u}) (\\<lambda>s. \\<not>gds_is_break gds s) \n                (\\<lambda>v s. do {\n                  s \\<leftarrow> choose_pending u (Some v) s;\n                  if gds_is_discovered gds v s then do {\n                    if gds_is_finished gds v s then\n                      gds_cross_edge gds u v s\n                    else\n                      gds_back_edge gds u v s\n                  } else do {\n                    s \\<leftarrow> gds_discover gds u v s;\n                    if gds_is_break gds s then RETURN s else D (v,s) \n                  }\n                }) \n                s;\n              if gds_is_break gds s then \n                RETURN s\n              else do {\n                s \\<leftarrow> choose_pending u (None) s;\n                s \\<leftarrow> gds_finish gds u s;\n                RETURN s\n              } \n            }) (v0,s)\n          }\n        }\n      }) s\n    }\"\n\n  definition rec_impl_for_paper where \"rec_impl_for_paper \\<equiv> do {\n    s \\<leftarrow> gds_init gds;\n    FOREACHc V0 (Not o gds_is_break gds) (\\<lambda>v0 s. do {\n      if gds_is_discovered gds v0 s then RETURN s\n      else do {\n        s \\<leftarrow> gds_new_root gds v0 s;\n        if gds_is_break gds s then RETURN s\n        else do {\n          REC (\\<lambda>D (u,s). do {\n            s \\<leftarrow> FOREACHc (E``{u}) (\\<lambda>s. \\<not>gds_is_break gds s) (\\<lambda>v s. do {\n                s \\<leftarrow> choose_pending u (Some v) s;\n                if gds_is_discovered gds v s then do {\n                  if gds_is_finished gds v s then gds_cross_edge gds u v s\n                  else gds_back_edge gds u v s\n                } else do {\n                  s \\<leftarrow> gds_discover gds u v s;\n                  if gds_is_break gds s then RETURN s else D (v,s) \n                }\n              }) \n              s;\n            if gds_is_break gds s then RETURN s\n            else do {\n              s \\<leftarrow> choose_pending u (None) s;\n              gds_finish gds u s\n            } \n          }) (v0,s)\n        }\n      }\n    }) s\n  }\"\n\nend\n\n(* Recursive implementation of general DFS *)\nlocale rec_impl =\n  fb_graph G + gen_dfs gds V0 + rec_impl_defs G gds pending stack choose_pending\n  for G :: \"('v, 'more) graph_rec_scheme\"\n  and gds :: \"('v,'s)gen_dfs_struct\"\n  and pending :: \"'s \\<Rightarrow> 'v rel\"\n  and stack :: \"'s \\<Rightarrow> 'v list\"\n  and choose_pending :: \"'v \\<Rightarrow> 'v option \\<Rightarrow> 's \\<Rightarrow> 's nres\"\n  +\n  assumes [simp]: \"gds_is_empty_stack gds s \\<longleftrightarrow> stack s = []\"\n  assumes init_spec: \n    \"gds_init gds \\<le>\\<^sub>n SPEC (\\<lambda>s. stack s = [] \\<and> pending s = {})\"\n  assumes new_root_spec: \n    \"\\<lbrakk>pre_new_root v0 s\\<rbrakk> \n      \\<Longrightarrow> gds_new_root gds v0 s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n        stack s' = [v0] \\<and> pending s' = {v0}\\<times>E``{v0} \\<and>\n        gen_discovered s' = insert v0 (gen_discovered s))\"\n\n  assumes get_pending_fmt: \"\\<lbrakk> pre_get_pending s \\<rbrakk> \\<Longrightarrow> \n    do {\n      let u = hd (stack s);\n      vo \\<leftarrow> SELECT (\\<lambda>v. (u,v)\\<in>pending s);\n      s \\<leftarrow> choose_pending u vo s;\n      RETURN (u,vo,s)\n    } \n  \\<le> gds_get_pending gds s\" (* TODO: \\<le>\\<^sub>n should be enough here! *)\n\n  assumes choose_pending_spec: \"\\<lbrakk>pre_get_pending s; u = hd (stack s); \n    case vo of \n      None \\<Rightarrow> pending s `` {u} = {}\n    | Some v \\<Rightarrow> v\\<in>pending s `` {u}\n  \\<rbrakk> \\<Longrightarrow>\n    choose_pending u vo s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n      (case vo of\n        None \\<Rightarrow> pending s' = pending s\n      | Some v \\<Rightarrow> pending s' = pending s - {(u,v)}) \\<and>\n      stack s' = stack s \\<and>\n      (\\<forall>x. gds_is_discovered gds x s' = gds_is_discovered gds x s) \n      \\<^cancel>\\<open>\\<and> gds_is_break gds s' = gds_is_break gds s\\<close>\n    )\"\n  assumes finish_spec: \"\\<lbrakk>pre_finish u s0 s\\<rbrakk> \n    \\<Longrightarrow> gds_finish gds u s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n      pending s' = pending s \\<and>\n      stack s' = tl (stack s) \\<and>\n      (\\<forall>x. gds_is_discovered gds x s' = gds_is_discovered gds x s))\"\n  assumes cross_edge_spec: \"pre_cross_edge u v s0 s \n    \\<Longrightarrow> gds_cross_edge gds u v s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n      pending s' = pending s \\<and> stack s' = stack s \\<and>\n      (\\<forall>x. gds_is_discovered gds x s' = gds_is_discovered gds x s))\"\n  assumes back_edge_spec: \"pre_back_edge u v s0 s \n    \\<Longrightarrow> gds_back_edge gds u v s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n      pending s' = pending s \\<and> stack s' = stack s \\<and>\n      (\\<forall>x. gds_is_discovered gds x s' = gds_is_discovered gds x s))\"\n  assumes discover_spec: \"pre_discover u v s0 s \n    \\<Longrightarrow> gds_discover gds u v s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n      pending s' = pending s \\<union> ({v} \\<times> E``{v}) \\<and> stack s' = v#stack s \\<and>\n      gen_discovered s' = insert v (gen_discovered s))\"\n\n\n\nbegin\n\n    \n  lemma gen_step'_refine: \n    \"\\<lbrakk>gen_rwof s; gen_cond s\\<rbrakk> \\<Longrightarrow> gen_step' s \\<le> gen_step s\"\n    apply (simp only: gen_step'_def gen_step_def)\n    apply (clarsimp)\n    apply (rule order_trans[OF _ bind_mono(1)[OF get_pending_fmt order_refl]])\n    apply (simp add: pw_le_iff refine_pw_simps\n      split: option.splits if_split)\n    apply (simp add: pre_defs gen_cond_def)\n    done\n\n\n  lemma gen_dfs'_refine: \"gen_dfs' \\<le> gen_dfs\"\n    unfolding gen_dfs'_def gen_dfs_def WHILE_eq_I_rwof[where f=gen_step]\n    apply (rule refine_IdD)    \n    apply (refine_rcg)\n    by (simp_all add: gen_step'_refine)\n\n  lemma gen_rwof'_imp_rwof:\n    assumes NF: \"nofail gen_dfs\"\n    assumes A: \"gen_rwof' s\"\n    shows \"gen_rwof s\"\n    apply (rule rwof_step_refine)\n      apply (rule NF[unfolded gen_dfs_def])\n\n      apply fact\n\n      apply (rule leof_lift[OF gen_step'_refine], assumption+) []\n    done\n\n\n  lemma reachable_invar: \n    \"gen_rwof' s \\<Longrightarrow> set (stack s) \\<subseteq> reachable \\<and> pending s \\<subseteq> E \n      \\<and> set (stack s) \\<subseteq> gen_discovered s \\<and> distinct (stack s)\n      \\<and> pending s \\<subseteq> set (stack s) \\<times> UNIV\"\n    apply (erule establish_rwof_invar[rotated -1])    \n    apply (rule leof_trans[OF init_spec], auto) []\n    apply (subst gen_step'_def)\n    apply (refine_rcg refine_vcg\n      leof_trans[OF new_root_spec]\n      SELECT_rule[THEN leof_lift]\n      leof_trans[OF choose_pending_spec[THEN leof_strengthen_SPEC]]\n      leof_trans[OF finish_spec]\n      leof_trans[OF cross_edge_spec]\n      leof_trans[OF back_edge_spec]\n      leof_trans[OF discover_spec]\n      )\n    \n\n    apply simp_all\n    subgoal by (simp add: pre_defs, simp add: gen_cond_def)\n    subgoal by auto    \n    subgoal by auto    \n    subgoal by auto    \n    subgoal by (simp add: pre_defs, simp add: gen_cond_def)\n        \n        \n    apply ((unfold pre_defs, intro conjI); assumption?) []\n      subgoal by (clarsimp simp: gen_cond_def)\n      subgoal by (clarsimp simp: gen_cond_def)\n      subgoal    \n        apply (rule pwD2[OF get_pending_fmt])\n          subgoal by (simp add: pre_defs gen_cond_def)\n          subgoal by (clarsimp simp: refine_pw_simps; blast)\n        done      \n      subgoal by (force simp: neq_Nil_conv) []\n          \n          \n    subgoal by (clarsimp simp: neq_Nil_conv gen_cond_def, blast) [] \n    subgoal by (clarsimp simp: neq_Nil_conv gen_cond_def; auto)\n\n    apply (unfold pre_defs, intro conjI, assumption) []\n      subgoal by (clarsimp_all simp: gen_cond_def)\n      subgoal by (clarsimp_all simp: gen_cond_def)\n      apply (rule pwD2[OF get_pending_fmt])\n        apply (simp add: pre_defs gen_cond_def; fail)\n        apply (clarsimp simp: refine_pw_simps select_def, blast; fail)\n        apply (simp; fail)\n        apply (simp; fail)\n\n    subgoal by auto\n    subgoal by fast\n\n    apply (unfold pre_defs, intro conjI, assumption) []\n      apply (clarsimp simp: gen_cond_def; fail)\n      apply (clarsimp simp: gen_cond_def; fail)\n      apply (rule pwD2[OF get_pending_fmt])\n        apply (simp add: pre_defs gen_cond_def; fail)\n        apply (clarsimp simp: refine_pw_simps select_def, blast; fail)\n        apply (simp; fail)\n\n    subgoal  \n      apply clarsimp  \n      by (meson ImageI SigmaD1 rtrancl_image_unfold_right subset_eq)  \n\n    subgoal  \n      apply clarsimp  \n      by blast  \n        \n    apply force\n    apply force\n    apply fast\n    apply (auto simp: pre_defs gen_cond_def; fail)\n    apply fast\n\n    apply ((unfold pre_defs, intro conjI); assumption?)\n      apply (clarsimp simp: gen_cond_def; fail)\n      apply (clarsimp simp: gen_cond_def; fail)\n      apply (rule pwD2[OF get_pending_fmt])\n        apply (simp add: pre_defs gen_cond_def; fail)\n        apply (clarsimp simp: refine_pw_simps; fail)\n\n    apply (auto simp: neq_Nil_conv; fail)\n    apply (auto simp: neq_Nil_conv; fail)\n    apply (clarsimp simp: neq_Nil_conv; blast) \n    done\n\n  lemma mk_spec_aux: \n    \"\\<lbrakk>m \\<le>\\<^sub>n SPEC \\<Phi>; m\\<le>SPEC gen_rwof' \\<rbrakk> \\<Longrightarrow> m \\<le> SPEC (\\<lambda>s. gen_rwof' s \\<and> \\<Phi> s)\"  \n    by (rule SPEC_rule_conj_leofI1)\n\n\n  definition \"post_choose_pending u vo s0 s \\<equiv> \n    gen_rwof' s0 \n  \\<and> gen_cond s0\n  \\<and> stack s0 \\<noteq> []\n  \\<and> u=hd (stack s0)  \n  \\<and> inres (choose_pending u vo s0) s \n  \\<and> stack s = stack s0\n  \\<and> (\\<forall>x. gds_is_discovered gds x s = gds_is_discovered gds x s0)\n  \\<^cancel>\\<open>\\<and> gds_is_break gds s = gds_is_break gds s0\\<close>\n  \\<and> (case vo of\n      None \\<Rightarrow> pending s0``{u}={} \\<and> pending s = pending s0\n    | Some v \\<Rightarrow> v \\<in> pending s0``{u} \\<and> pending s = pending s0 - {(u,v)})\"\n\n  context\n    assumes nofail: \n      \"nofail (gds_init gds \\<bind> WHILE gen_cond gen_step')\"\n    assumes nofail2: \n      \"nofail (gen_dfs)\"\n  begin\n    lemma pcp_imp_pgp: \n      \"post_choose_pending u vo s0 s \\<Longrightarrow> post_get_pending u vo s0 s\"\n      unfolding post_choose_pending_def pre_defs\n      apply (intro conjI)\n      apply (simp add: gen_rwof'_imp_rwof[OF nofail2])\n      apply simp\n      apply (simp add: gen_cond_def)\n      apply (rule pwD2[OF get_pending_fmt])\n      apply (simp add: pre_defs gen_cond_def \n          gen_rwof'_imp_rwof[OF nofail2])\n      apply (auto simp add: refine_pw_simps select_def split: option.splits) []\n      done\n\n    schematic_goal gds_init_refine: \"?prop\"\n      apply (rule mk_spec_aux[OF init_spec])\n      apply (rule rwof_init[OF nofail])\n      done      \n\n    schematic_goal gds_new_root_refine: \n      \"\\<lbrakk>pre_new_root v0 s; gen_rwof' s\\<rbrakk> \\<Longrightarrow> gds_new_root gds v0 s \\<le> SPEC ?\\<Phi>\"\n      apply (rule mk_spec_aux[OF new_root_spec], assumption)\n      apply (rule order_trans[OF _ rwof_step[OF nofail, where s=s]])\n      unfolding gen_step'_def pre_new_root_def gen_cond_def\n      apply (auto simp: pw_le_iff refine_pw_simps)\n      done      \n\n    schematic_goal gds_choose_pending_refine: \n      assumes 1: \"pre_get_pending s\"\n      assumes 2: \"gen_rwof' s\"\n      assumes [simp]: \"u=hd (stack s)\"\n      assumes 3: \"case vo of \n          None \\<Rightarrow> pending s `` {u} = {}\n        | Some v \\<Rightarrow> v \\<in> pending s `` {u}\"\n      shows \"choose_pending u vo s \\<le> SPEC (post_choose_pending u vo s)\"\n    proof -\n      from WHILE_nofail_imp_rwof_nofail[OF nofail 2] 1 3 have \n        \"nofail (choose_pending u vo s)\"\n        unfolding pre_defs gen_step'_def gen_cond_def\n        by (auto simp: refine_pw_simps select_def \n          split: option.splits if_split_asm)\n      also have \"choose_pending u vo s \\<le>\\<^sub>n SPEC (post_choose_pending u vo s)\"\n        apply (rule leof_trans[OF choose_pending_spec[OF 1 _ 3, THEN leof_strengthen_SPEC]])\n        apply simp\n        apply (rule leof_RES_rule)\n        using 1\n        apply (simp add: post_choose_pending_def 2 pre_defs gen_cond_def split: option.splits)\n        using 3\n        apply auto\n        done\n      finally (leofD) show ?thesis .\n    qed\n\n    schematic_goal gds_finish_refine: \n      \"\\<lbrakk>pre_finish u s0 s; post_choose_pending u None s0 s\\<rbrakk> \\<Longrightarrow> gds_finish gds u s \\<le> SPEC ?\\<Phi>\"\n      apply (rule mk_spec_aux[OF finish_spec], assumption)\n      apply (rule order_trans[OF _ rwof_step[OF nofail, where s=s0]])\n      unfolding gen_step'_def pre_defs gen_cond_def post_choose_pending_def\n      apply (auto simp: pw_le_iff refine_pw_simps split: option.split)  \n      done      \n\n    schematic_goal gds_cross_edge_refine: \n      \"\\<lbrakk>pre_cross_edge u v s0 s; post_choose_pending u (Some v) s0 s\\<rbrakk> \\<Longrightarrow> gds_cross_edge gds u v s \\<le> SPEC ?\\<Phi>\"\n      apply (rule mk_spec_aux[OF cross_edge_spec], assumption)\n      apply (rule order_trans[OF _ rwof_step[OF nofail, where s=s0]])\n      unfolding gen_step'_def pre_defs gen_cond_def post_choose_pending_def\n      apply (simp add: pw_le_iff refine_pw_simps select_def split: option.split, blast) \n      apply simp\n      apply blast\n      done      \n\n    schematic_goal gds_back_edge_refine: \n      \"\\<lbrakk>pre_back_edge u v s0 s; post_choose_pending u (Some v) s0 s\\<rbrakk> \\<Longrightarrow> gds_back_edge gds u v s \\<le> SPEC ?\\<Phi>\"\n      apply (rule mk_spec_aux[OF back_edge_spec], assumption)\n      apply (rule order_trans[OF _ rwof_step[OF nofail, where s=s0]])\n      unfolding gen_step'_def pre_defs gen_cond_def post_choose_pending_def\n      apply (simp add: pw_le_iff refine_pw_simps select_def split: option.split, blast) \n      apply simp\n      apply blast\n      done      \n\n    schematic_goal gds_discover_refine: \n      \"\\<lbrakk>pre_discover u v s0 s; post_choose_pending u (Some v) s0 s\\<rbrakk> \\<Longrightarrow> gds_discover gds u v s \\<le> SPEC ?\\<Phi>\"\n      apply (rule mk_spec_aux[OF discover_spec], assumption)\n      apply (rule order_trans[OF _ rwof_step[OF nofail, where s=s0]])\n      unfolding gen_step'_def pre_defs gen_cond_def post_choose_pending_def\n      apply (simp add: pw_le_iff refine_pw_simps select_def split: option.split, blast) \n      apply simp\n      apply blast\n      done      \n  end\n\n  \n  lemma rec_impl_aux: \"\\<lbrakk> xd\\<notin>Domain P \\<rbrakk> \\<Longrightarrow> P - {y} \\<times> (succ y - ita) - {(y, xd)} - {xd} \\<times> UNIV =\n           P - insert (y, xd) ({y} \\<times> (succ y - ita))\"\n    apply auto\n    done\n           \n\n  lemma rec_impl: \"rec_impl \\<le> gen_dfs\"\n    apply (rule le_nofailI)\n    apply (rule order_trans[OF _ gen_dfs'_refine])\n    unfolding gen_dfs'_def\n    apply (rule WHILE_refine_rwof)\n    unfolding rec_impl_def\n    apply (refine_rcg refine_vcg\n      order_trans[OF gds_init_refine]\n      order_trans[OF gds_choose_pending_refine]\n      order_trans[OF gds_new_root_refine]\n      order_trans[OF gds_finish_refine]\n      order_trans[OF gds_back_edge_refine]\n      order_trans[OF gds_cross_edge_refine]\n      order_trans[OF gds_discover_refine]\n    )\n    apply (simp_all split: if_split_asm)\n\n    using [[goals_limit = 1]]\n\n    apply (auto simp add: pre_defs; fail)\n    apply (auto simp add: pre_defs gen_rwof'_imp_rwof; fail)\n    apply (auto; fail)\n    apply (auto dest: reachable_invar; fail)\n    apply (auto simp add: pre_defs gen_rwof'_imp_rwof; fail)\n    apply (auto; fail)\n    apply (auto; fail)\n\n    apply ((drule pcp_imp_pgp, auto simp add: pre_defs gen_rwof'_imp_rwof); fail)\n\n    apply (auto simp: post_choose_pending_def; fail)\n    apply (auto simp: post_choose_pending_def; fail)\n    apply (auto simp: post_choose_pending_def; fail)\n\n    apply ((drule pcp_imp_pgp, auto simp add: pre_defs gen_rwof'_imp_rwof); fail)\n\n    apply (auto simp: post_choose_pending_def; fail)\n    apply (auto simp: post_choose_pending_def; fail)\n    apply (auto simp: post_choose_pending_def; fail)\n\n    apply ((drule pcp_imp_pgp, auto simp add: pre_defs gen_rwof'_imp_rwof); fail)\n\n    apply (rule order_trans)\n    apply rprems\n    apply (auto; fail) []\n    subgoal \n      apply (rule SPEC_rule)\n      apply (simp add: post_choose_pending_def gen_rwof'_imp_rwof\n        split: if_split_asm)\n      apply (clarsimp \n        simp: gen_rwof'_imp_rwof Un_Diff\n        split: if_split_asm) []\n      apply (clarsimp simp: it_step_insert_iff neq_Nil_conv)\n      apply (rule conjI)\n      subgoal\n        apply (rule rec_impl_aux)\n        apply (drule reachable_invar)+\n        apply (metis Domain.cases SigmaD1 mem_Collect_eq rev_subsetD)\n      done\n      subgoal\n        apply (rule conjI)\n        apply auto []\n        apply (metis order_trans)\n      done\n    done\n\n    apply (auto simp add: pre_defs gen_rwof'_imp_rwof; fail)\n    apply (auto; fail)\n    apply (auto dest: reachable_invar; fail)\n\n    apply ((drule pcp_imp_pgp, auto simp add: pre_defs gen_rwof'_imp_rwof); fail)\n\n    apply (auto simp: post_choose_pending_def; fail)\n    apply (auto simp: post_choose_pending_def; fail)\n    apply (auto simp: post_choose_pending_def; fail)\n\n    apply (auto; fail)\n\n    apply (auto simp: gen_cond_def; fail)\n\n    apply (auto simp: gen_cond_def; fail)\n    done\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/DFS_Framework/Impl/Structural/Rec_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3259792352434987}}
{"text": "(*\n\nCopyright (c) 2017, ETH Zurich\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\n   list of conditions and the following disclaimer.\n2. Redistributions in binary form must reproduce the above copyright notice,\n   this list of conditions and the following disclaimer in the documentation\n   and/or other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND\nON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\n\n(*<*)\ntheory AbstractOps\n  imports Equivalence Resolution\nbegin\n(*>*)\n\nsubsection \"Equivalence-Preserving Transformations\"\n\nsubsubsection \"Splitting Nodes\"\ntext_raw {* \\label{sec:isasplit} *}\n    \ntext {* The acceptor accepts all addresses accepted by the original node, but translates none. *}\ndefinition acceptor_node :: \"node \\<Rightarrow> node\"\n  where \"acceptor_node node = node \\<lparr> translate := \\<lambda>_. {} \\<rparr>\"\n\ntext {* Forward all addresses to the acceptor node, maintaining existing translations. *}\ndefinition redirector_node :: \"nodeid \\<Rightarrow> node \\<Rightarrow> node\"\n  where \"redirector_node nd' node = \\<lparr> accept = {},\n          translate = (\\<lambda>a. if a \\<in> accept node then insert (nd',a) (translate node a) else translate node a) \\<rparr>\"\n\ntext {* Split a node into an acceptor, that accepts all addresses accepted by the original node, and\n  a redirector, which forwards all addresses that it would have accepted to the acceptor. *}\ndefinition split_node :: \"nodeid \\<Rightarrow> nodeid \\<Rightarrow> net \\<Rightarrow> net\"\n  where \"split_node nd nd' net =\n    net(nd := redirector_node nd' (net nd), nd' := acceptor_node (net nd))\"\n\ntext {* We can represent the effect of node splitting by its action on the set of accepted names,\n  and on the decoding relation.  Recall from \\autoref{sec:isares} that this is sufficient to\n  fully define the result of resolution. *}\n\ntext {* Splitting only adds the new decode edges: *}\nlemma split_decode:\n  \"nd \\<noteq> nd' \\<Longrightarrow> (\\<And>a. translate (net nd') a = {}) \\<Longrightarrow>\n   decodes_to (split_node nd nd' net) =\n   decodes_to net \\<union> (\\<lambda>a. (Pair nd' a, Pair nd a)) ` accept (net nd)\"\n(*<*)\n  by(auto simp:decodes_to_def decode_step_def split_node_def acceptor_node_def redirector_node_def)\n(*>*)\n\ntext {* Splitting only touches the named nodes: *}\nlemma fresh_split_node:\n  assumes fresh: \"fresh_node net x\"\n      and neq: \"x \\<noteq> nd\" \"x \\<noteq> nd'\"\n    shows \"fresh_node (split_node nd nd' net) x\"\n(*<*)\n  unfolding fresh_node_def\nproof(intro conjI allI impI)\n  from neq fresh_node_acceptD[OF fresh]\n  show \"accept (split_node nd nd' net x) = {}\"\n    by(simp add:split_node_def)\nnext\n  fix a\n  from neq fresh_node_translateD[OF fresh]\n  show \"translate (split_node nd nd' net x) a = {}\"\n    by(simp add:split_node_def)\nnext\n  fix a b\n  thm fresh_node_reachableD\n  assume step: \"(a, b) \\<in> decodes_to (split_node nd nd' net)\"\n  show \"fst a \\<noteq> x\"\n  proof(cases)\n    assume \"fst b = nd'\"\n    with step show ?thesis\n      by(simp add:split_node_def decodes_to_def decode_step_def acceptor_node_def)\n  next\n    assume bne: \"fst b \\<noteq> nd'\"\n    show ?thesis\n    proof (cases)\n      assume beq: \"fst b = nd\"\n      show ?thesis\n      proof(cases)\n        assume \"snd b \\<in> accept (net nd)\"\n        with step bne neq beq\n        show ?thesis\n        proof(simp add:split_node_def decodes_to_def decode_step_def redirector_node_def)\n          assume \"a = (nd', snd b) \\<or> a \\<in> translate (net nd) (snd b)\"\n          thus \"fst a \\<noteq> x\"\n          proof\n            assume \"a = (nd', snd b)\" with neq show ?thesis by(auto)\n          next\n            assume \"a \\<in> translate (net nd) (snd b)\"\n            hence \"(a, (nd, snd b)) \\<in> decodes_to net\"\n              by(simp add:decodes_to_def decode_step_def)\n            with fresh show ?thesis by(blast dest:fresh_node_reachableD)\n          qed\n        qed\n      next\n        assume \"snd b \\<notin> accept (net nd)\"\n        with step bne neq beq show ?thesis\n        proof(simp add:split_node_def decodes_to_def decode_step_def redirector_node_def)\n          assume \"a \\<in> translate (net nd) (snd b)\"\n          hence \"(a, (nd, snd b)) \\<in> decodes_to net\"\n            by(simp add:decodes_to_def decode_step_def)\n          with fresh show ?thesis by(blast dest:fresh_node_reachableD)\n        qed\n      qed\n    next\n      assume \"fst b \\<noteq> nd\"\n      with step bne neq show ?thesis\n      proof(simp add:split_node_def decodes_to_def decode_step_def)\n        assume \"a \\<in> translate (net (fst b)) (snd b)\"\n        hence \"(a, b) \\<in> decodes_to net\"\n          by(simp add:decodes_to_def decode_step_def)\n        with fresh show ?thesis by(blast dest:fresh_node_reachableD)\n      qed\n    qed\n  qed\nqed\n(*>*)\ntext {* Splitting neither adds nor removes accepted names, it simply renames those accepted by the\n  original node: *}\nlemma split_accepted:\n  assumes empty: \"accept (net nd') = {}\"\n    shows \"accepted_names (split_node nd nd' net) = rename (id(nd := nd')) ` accepted_names net\"\n(*<*)\n          (is \"?X = ?Y\")\nproof(intro antisym subsetI)\n  fix x\n  assume xin: \"x \\<in> ?X\"\n  show \"x \\<in> ?Y\"\n  proof(cases)\n    assume xeq: \"fst x = nd'\"\n    with xin\n    have \"snd x \\<in> accept (acceptor_node (net nd))\"\n      by(cases x, simp add:accepted_names_def split_node_def)\n    hence \"(nd,snd x) \\<in> accepted_names net\"\n      by(simp add:accepted_names_def acceptor_node_def)\n    moreover from xeq have \"x = rename (id(nd := nd')) (nd,snd x)\"\n      by(cases x, simp add:rename_def)\n    ultimately show \"x \\<in> ?Y\" by(blast)\n  next\n    assume xne': \"fst x \\<noteq> nd'\"\n      \n    have xne: \"fst x \\<noteq> nd\"\n    proof(rule ccontr, simp)\n      assume \"fst x = nd\"\n      with xne' xin show False\n        by(cases x, simp add:accepted_names_def split_node_def redirector_node_def)\n    qed\n      \n    from xne xne' xin have \"x \\<in> accepted_names net\"\n      by(cases x, simp add:accepted_names_def split_node_def)\n    moreover from xne have \"x = rename (id(nd := nd')) x\" by(simp add:rename_def)\n    ultimately show ?thesis by(blast)\n  qed\nnext\n  fix x\n  assume xin: \"x \\<in> ?Y\"\n  then obtain y where yin: \"y \\<in> accepted_names net\" and xy: \"x = rename (id(nd := nd')) y\" by(blast)\n\n  show \"x \\<in> ?X\"\n  proof(cases)\n    assume yeq: \"fst y = nd\"\n    with xy have xeq: \"x = (nd',snd y)\" by(simp add:rename_def)\n        \n    from yin yeq xeq\n    have \"snd x \\<in> accept (net nd)\"\n      by(cases y, simp add:accepted_names_def)\n    with xeq show ?thesis\n      by(cases x, simp add:accepted_names_def split_node_def acceptor_node_def)\n  next\n    assume yne: \"fst y \\<noteq> nd\"\n    with xy have xeq: \"x = y\" by(simp add:rename_def)  \n    with yin have xin': \"x \\<in> accepted_names net\" by(simp)\n        \n    from yin empty have yne': \"fst y \\<noteq> nd'\"\n      by(cases y, simp add:accepted_names_def, auto)\n        \n    from xin' yne yne' show ?thesis\n      by(cases x, simp add:accepted_names_def split_node_def xeq)\n  qed\nqed\n(*>*)\ntext {* Splitting a node has no effect on the termination of @{term resolve}: *}\nlemma split_node_domeq:\n  fixes S :: \"nodeid set\" and nd nd' :: nodeid and net :: net and n::name\n  assumes neq: \"nd \\<noteq> nd'\"\n      and wf_net: \"wf_net net\"\n      and fresh: \"fresh_node net nd'\"\n    shows \"resolve_dom (net,n) = resolve_dom (split_node nd nd' net,n)\"\n(*<*)\nproof(cases n, simp, intro iffI)\n  fix nd3 a\n  assume dom: \"resolve_dom (net, nd3, a)\"\n\n  from wf_net dom mkrank obtain f where wf: \"wf_rank f (nd3,a) net\" by(blast dest:wf_net_decodeD)\n\n  let ?g = \"\\<lambda>n. if fst n = nd' then 0 else Suc (f n)\"\n\n  have \"wf_rank ?g (nd3,a) (split_node nd nd' net)\"\n  proof(intro wf_rankI)\n    fix x y\n    assume reach: \"(x, nd3, a) \\<in> (decodes_to (split_node nd nd' net))\\<^sup>*\"\n       and step: \"(y, x) \\<in> decodes_to (split_node nd nd' net)\"\n       \n    have ne_nd': \"fst x \\<noteq> nd'\"\n    proof(rule ccontr, simp)\n      assume \"fst x = nd'\"\n      with step have \"(y, (nd',snd x)) \\<in> decodes_to (split_node nd nd' net)\" by(auto)\n      with neq have \"y \\<in> translate (net nd') (snd x)\"\n        by(simp add:split_node_def decodes_to_def decode_step_def redirector_node_def\n                    acceptor_node_def)\n      with fresh show False by(blast dest:fresh_node_translateD)\n    qed\n       \n    show \"?g y < ?g x\"\n    proof(cases \"fst y = nd'\", simp_all add:ne_nd')\n      assume \"fst y \\<noteq> nd'\"\n      with step neq fresh_node_translateD[OF fresh] split_decode\n      have yx: \"(y,x) \\<in> decodes_to net\" by(auto)\n          \n      from reach have xn: \"(x,nd3,a) \\<in> (decodes_to net)\\<^sup>*\"\n      proof(induct, simp)\n        fix y z\n        assume xy: \"(x, y) \\<in> (decodes_to net)\\<^sup>*\"\n           and yz: \"(y, z) \\<in> decodes_to (split_node nd nd' net)\"\n        show \"(x, z) \\<in> (decodes_to net)\\<^sup>*\"\n        proof(cases)\n          assume \"x = y\"\n          with yz have \"(x,z) \\<in> decodes_to (split_node nd nd' net)\" by(simp)\n          with ne_nd' neq fresh_node_translateD[OF fresh] split_decode\n          show \"(x,z) \\<in> (decodes_to net)\\<^sup>*\" by(auto)\n        next\n          assume \"x \\<noteq> y\"\n          with xy have \"(x,y) \\<in> (decodes_to net)\\<^sup>+\"\n            by(auto dest:rtranclD)\n          then obtain w where \"(w,y) \\<in> decodes_to net\"\n            by(auto dest:tranclD2)\n          with fresh have \"fst y \\<noteq> nd'\"\n            unfolding decodes_to_def decode_step_def by(auto dest:fresh_node_translateD)\n          with yz neq fresh_node_translateD[OF fresh] split_decode\n          have \"(y,z) \\<in> decodes_to net\" by(auto)\n          with xy show ?thesis by(auto)\n        qed\n      qed\n      with yx wf show \"f y < f x\"\n        unfolding wf_rank_def by(blast)\n    qed\n  qed\n  thus \"resolve_dom (split_node nd nd' net, nd3, a)\" by(blast intro:wf_resolve_dom)\nnext\n  fix nd3 a\n    \n  assume dom: \"resolve_dom (split_node nd nd' net, nd3, a)\"\n\n  let ?R = \"\\<lambda>a b. resolve_rel (split_node nd nd' net, a) (split_node nd nd' net, b)\"\n  let ?S = \"\\<lambda>a b. resolve_rel (net,a) (net,b)\"\n\n  {\n    fix n\n    have \"resolve_dom (split_node nd nd' net, n) \\<Longrightarrow>\n          fst (split_node nd nd' net, n) = split_node nd nd' net \\<Longrightarrow>\n          Wellfounded.accp ?R (snd (split_node nd nd' net, n))\"\n    proof(induct rule:accp.induct, rule accp.intros)\n      fix x y\n      assume \"resolve_rel (split_node nd nd' net, y) (split_node nd nd' net, snd x)\"\n         and \"fst x = split_node nd nd' net\"\n      hence \"resolve_rel (split_node nd nd' net, y) x\" by(cases x, simp)\n      moreover assume \"\\<And>y. resolve_rel y x \\<Longrightarrow>\n                           fst y = split_node nd nd' net \\<Longrightarrow>\n        Wellfounded.accp (\\<lambda>a b. resolve_rel (split_node nd nd' net, a) (split_node nd nd' net, b))\n                         (snd y)\"\n      ultimately\n      show \"Wellfounded.accp (\\<lambda>a b. resolve_rel (split_node nd nd' net, a)\n                                                (split_node nd nd' net, b)) y\"\n        by(cases y, auto)\n    qed\n    hence \"resolve_dom (split_node nd nd' net, n) \\<Longrightarrow>\n          Wellfounded.accp ?R (snd (split_node nd nd' net, n))\"\n      by(simp)\n  }\n  with dom have accpR: \"Wellfounded.accp ?R (nd3,a)\" by(simp)\n\n  from neq fresh\n  have \"decodes_to (split_node nd nd' net) = \n        decodes_to net \\<union> (\\<lambda>a. (Pair nd' a, Pair nd a)) ` accept (net nd)\"\n    by(blast dest:fresh_node_translateD intro!:split_decode)  \n  hence SR: \"?S \\<le> ?R\"\n    by(intro le_funI le_boolI, simp add:resolve_rel_decodes_to)\n\n  show \"resolve_dom (net, nd3, a)\"\n  proof(rule resolve_domI)\n    fix x\n    assume \"(x, nd3, a) \\<in> decodes_to net\"\n    hence \"?S x (nd3,a)\" by(simp add:resolve_rel_decodes_to)\n    with SR have \"?R x (nd3,a)\" by(auto)\n    with accpR have accpRx: \"Wellfounded.accp ?R x\" by(rule accp_downward)\n    with accp_subset[OF SR] have \"Wellfounded.accp ?S x\" by(blast)\n    thus \"resolve_dom (net,x)\"\n    proof(induct x)\n      fix z\n      assume IH: \"\\<And>y. resolve_rel (net, y) (net, z) \\<Longrightarrow> resolve_dom (net, y)\"\n      show \"resolve_dom (net, z)\"\n      proof(rule resolve_domI)\n        fix y\n        assume \"(y,z) \\<in> decodes_to net\"\n        hence \"resolve_rel (net,y) (net,z)\" by(simp add:resolve_rel_decodes_to)\n        thus \"resolve_dom (net,y)\" by(rule IH)\n      qed\n    qed\n  qed\nqed\n(*>*)\n\ntext {* The effect of splitting a node is just to rename anything that was accepted by the split\n  node. *}\nlemma split_node_resolveeq:\n  fixes S :: \"nodeid set\" and nd nd' :: nodeid and net :: net and n::name\n  assumes neq: \"nd \\<noteq> nd'\"\n      and wf_net: \"wf_net net\"\n      and fresh: \"fresh_node net nd'\"\n      and dom: \"resolve_dom (net,n)\"\n    shows \"fst n \\<noteq> nd' \\<Longrightarrow>\n           rename (id(nd := nd')) ` resolve net n =\n           rename id ` resolve (split_node nd nd' net) n\"\n(*<*)\nproof(induct rule:resolve_induct[OF dom])\n  fix n\n  assume dom: \"resolve_dom (net,n)\"\n     and notnd': \"fst n \\<noteq> nd'\"\n\n  assume \"\\<And>x. (x, n) \\<in> decodes_to net \\<Longrightarrow>\n              fst x \\<noteq> nd' \\<Longrightarrow>\n              rename (id(nd := nd')) ` resolve net x =\n              rename id ` resolve (split_node nd nd' net) x\"\n  hence IH: \"\\<And>x. (x, n) \\<in> decodes_to net \\<Longrightarrow>\n                 rename (id(nd := nd')) ` resolve net x =\n                 rename id ` resolve (split_node nd nd' net) x\"\n    by(blast dest:fresh_node_reachableD[OF fresh])\n\n  from neq fresh wf_net dom\n  have dom': \"resolve_dom (split_node nd nd' net, n)\"\n    by(simp add:split_node_domeq)\n\n  (* This is a tedious rewriting grind, and could & should be rewritten! *)\n  have \"rename (id(nd := nd')) ` resolve net n =\n        rename (id(nd := nd')) ` ({n} \\<inter> accepted_names net \\<union>\n                                  (\\<Union>n'\\<in>(decodes_to net)\\<inverse> `` {n}. resolve net n'))\"\n    by(simp add:resolve_simp[OF dom])\n  also have \"... =\n    rename (id(nd := nd')) ` ({n} \\<inter> accepted_names net) \\<union>\n    (\\<Union>n'\\<in>(decodes_to net)\\<inverse> `` {n}. rename (id(nd := nd')) ` resolve net n')\"\n    by(simp add:image_Un image_UN)\n  also have \"... =\n    (rename (id(nd := nd')) ` ({n} \\<inter> accepted_names net)) \\<union>\n    (\\<Union>n'\\<in>(decodes_to net)\\<inverse> `` {n}. resolve (split_node nd nd' net) n')\"\n    by(simp add:IH rename_id)\n  also {\n    have \"(rename (id(nd := nd')) ` ({n} \\<inter> accepted_names net)) =\n          (({n} \\<inter> rename (id(nd := nd')) ` accepted_names net) \\<union>\n           {n'. n' = (nd',snd n) \\<and> snd n \\<in> accept (net nd) \\<and> fst n = nd})\"\n    proof(intro antisym subsetI)\n      fix x\n      assume \"x \\<in> rename (id(nd := nd')) ` ({n} \\<inter> accepted_names net)\"\n      hence nin: \"n \\<in> accepted_names net\" and xn: \"x = rename (id(nd := nd')) n\"\n        by(auto)\n      show \"x \\<in> {n} \\<inter> rename (id(nd := nd')) ` accepted_names net \\<union>\n            {n'. n' = (nd',snd n) \\<and> snd n \\<in> accept (net nd) \\<and> fst n = nd}\"\n      proof(cases)\n        assume n_nd: \"fst n = nd\"\n        with xn have xeq: \"fst x = nd'\" \"snd x = snd n\"\n          by(cases x, cases n, auto simp:rename_def)\n        with nin n_nd have \"x \\<in> {n'. n' = (nd',snd n) \\<and> snd n \\<in> accept (net nd) \\<and> fst n = nd}\"\n          unfolding accepted_names_def\n          by(cases x, cases n, simp)\n        thus ?thesis by(blast)\n      next\n        assume neq: \"fst n \\<noteq> nd\"\n        with xn have xeq: \"x = n\" by(simp add:rename_def)\n        hence \"x \\<in> {n}\" by(simp)\n        moreover {\n          from xeq nin have \"x \\<in> accepted_names net\" by(simp)\n          moreover from neq xeq have \"x = rename (id(nd := nd')) x\"\n            by(simp add:rename_def)\n          ultimately have \"x \\<in> rename (id(nd := nd')) ` accepted_names net\" by(blast)\n        }\n        ultimately show ?thesis by(blast)\n      qed\n    next\n      fix x\n      assume lhs: \"x \\<in> {n} \\<inter> rename (id(nd := nd')) ` accepted_names net \\<union>\n                   {n'. n' = (nd',snd n) \\<and> snd n \\<in> accept (net nd) \\<and> fst n = nd}\"\n                  (is \"x \\<in> ?A \\<union> ?B\")\n      show \"x \\<in> rename (id(nd := nd')) ` ({n} \\<inter> accepted_names net)\" (is \"x \\<in> ?C\")\n      proof(rule UnE[OF lhs])\n        assume \"x \\<in> ?A\"\n        hence xeq: \"x = n\" and img: \"x \\<in> rename (id(nd := nd')) ` accepted_names net\" by(auto)\n            \n        from img obtain y where yin: \"y \\<in> accepted_names net\"\n                            and xy: \"x = rename (id(nd := nd')) y\"\n          by(auto)\n            \n        from xy neq have x_ne_nd: \"fst x \\<noteq> nd\" by(auto simp:rename_def)\n    \n        from notnd' xeq have \"fst x \\<noteq> nd'\" by(simp)\n        with xy have y_eq_x: \"y = x\" by(auto simp:rename_def)\n        with yin xeq have \"x \\<in> {n} \\<inter> accepted_names net\" by(simp)\n        moreover from y_eq_x xy have \"x = rename (id(nd := nd')) x\" by(simp)\n        ultimately show \"x \\<in> rename (id(nd := nd')) ` ({n} \\<inter> accepted_names net)\" by(blast)\n      next\n        assume \"x \\<in> ?B\"\n        hence \"n \\<in> {n} \\<inter> accepted_names net\" \"x = rename (id(nd := nd')) n\"\n          by(auto simp:accepted_names_def rename_def)\n        thus \"x \\<in> rename (id(nd := nd')) ` ({n} \\<inter> accepted_names net)\" by(blast)\n      qed\n    qed\n    hence \"(rename (id(nd := nd')) ` ({n} \\<inter> accepted_names net)) \\<union>\n           (\\<Union>n'\\<in>(decodes_to net)\\<inverse> `` {n}. resolve (split_node nd nd' net) n') =\n           (({n} \\<inter> rename (id(nd := nd')) ` accepted_names net) \\<union>\n            {n'. n' = (nd',snd n) \\<and> snd n \\<in> accept (net nd) \\<and> fst n = nd}) \\<union>\n           (\\<Union>n'\\<in>(decodes_to net)\\<inverse> `` {n}. resolve (split_node nd nd' net) n')\"\n      by(simp)\n  }\n  also\n  have \"(({n} \\<inter> rename (id(nd := nd')) ` accepted_names net) \\<union>\n         {n'. n' = (nd',snd n) \\<and> snd n \\<in> accept (net nd) \\<and> fst n = nd}) \\<union>\n        (\\<Union>n'\\<in>(decodes_to net)\\<inverse> `` {n}. resolve (split_node nd nd' net) n') =\n        ({n} \\<inter> rename (id(nd := nd')) ` accepted_names net \\<union>\n      ((\\<Union>n'\\<in>(decodes_to net)\\<inverse> `` {n}. resolve (split_node nd nd' net) n') \\<union> \n       {n'. n' = (nd',snd n) \\<and> snd n \\<in> accept (net nd) \\<and> fst n = nd}))\"\n    by(simp add:ac_simps)\n  also {\n  have \"(\\<Union>n \\<in> ((\\<lambda>a. (Pair nd' a, Pair nd a)) ` accept (net nd))\\<inverse> `` {n}. resolve (split_node nd nd' net) n) =\n        {n'. n' = (nd',snd n) \\<and> snd n \\<in> accept (net nd) \\<and> fst n = nd}\"\n    (is \"?A = ?B\")\n  proof(intro antisym subsetI)\n    fix x\n    assume \"x \\<in> ?A\"\n    then obtain n' where n'n: \"(n', n) \\<in> {((nd', a), nd, a) |a. a \\<in> accept (net nd)}\"\n                     and xin: \"x \\<in> resolve (split_node nd nd' net) n'\" by(blast)\n    from n'n obtain a where n'eq: \"n' = (nd',a)\" and nsplit: \"n = (nd,a)\"\n                        and ain: \"a \\<in> accept (net nd)\" by(blast)\n\n    from fresh n'eq have dom_n': \"resolve_dom (split_node nd nd' net,n')\"\n      by(auto intro: resolve.domintros\n              simp:split_node_def decodes_to_def decode_step_def acceptor_node_def)\n      \n    from n'eq have \"(decodes_to (split_node nd nd' net))\\<inverse> `` {n'} = {}\"\n      using fresh_node_translateD[OF fresh] fresh_node_acceptD[OF fresh]\n      by(subst split_decode,\n         auto simp:decodes_to_def decode_step_def neq n'eq Un_Image converse_Un split_decode)\n    hence \"resolve (split_node nd nd' net) n' = {n'} \\<inter> accepted_names (split_node nd nd' net)\"\n      by(simp add:resolve_simp[OF dom_n'])\n    with xin have xeq: \"x = n'\" by(auto)\n    with n'n neq show \"x \\<in> {n'. n' = (nd',snd n) \\<and> snd n \\<in> accept (net nd) \\<and> fst n = nd}\" by(auto)\n  next\n    fix x::name\n    assume xin: \"x \\<in> ?B\"\n    hence \"(x, n) \\<in> {((nd', a), nd, a) |a. a \\<in> accept (net nd)}\"\n      by(force)\n      \n      \n    moreover {\n      from fresh have dom_x: \"resolve_dom (split_node nd nd' net, (nd',snd n))\"\n        by(auto intro: resolve.domintros\n                simp:split_node_def decodes_to_def decode_step_def acceptor_node_def)\n      \n      from xin have xeq: \"x = (nd',snd n)\" and snd_n: \"snd n \\<in> accept (net nd)\"\n                and fst_n: \"fst n = nd\" by(auto)\n      from fst_n snd_n have \"n \\<in> accepted_names net\"\n        by(cases n, simp add:accepted_names_def)\n      with xeq fst_n have \"x \\<in> rename (id(nd := nd')) ` accepted_names net\"\n        by(auto simp:rename_def)\n      with xeq have \"x \\<in> accepted_names (split_node nd nd' net)\"\n        by(simp add:split_accepted[where net=net and nd'=nd', OF fresh_node_acceptD[OF fresh]])\n      with xeq\n      have \"x \\<in> resolve (split_node nd nd' net) x\"\n        by(simp, subst resolve_simp[OF dom_x], blast)\n    }\n    ultimately show \"x \\<in> ?A\" by(blast)\n  qed\n  hence\n    \"({n} \\<inter> rename (id(nd := nd')) ` accepted_names net \\<union>\n      ((\\<Union>n'\\<in>(decodes_to net)\\<inverse> `` {n}. resolve (split_node nd nd' net) n') \\<union> \n       {n'. n' = (nd',snd n) \\<and> snd n \\<in> accept (net nd) \\<and> fst n = nd})) =\n     ({n} \\<inter> rename (id(nd := nd')) ` accepted_names net \\<union>\n      ((\\<Union>n'\\<in>(decodes_to net)\\<inverse> `` {n}. resolve (split_node nd nd' net) n') \\<union> \n       (\\<Union>n \\<in> ((\\<lambda>a. (Pair nd' a, Pair nd a)) ` accept (net nd))\\<inverse> `` {n}. resolve (split_node nd nd' net) n)))\"\n    by(simp)\n  }\n  also have\n    \"({n} \\<inter> rename (id(nd := nd')) ` accepted_names net \\<union>\n      ((\\<Union>n'\\<in>(decodes_to net)\\<inverse> `` {n}. resolve (split_node nd nd' net) n') \\<union> \n       (\\<Union>n \\<in> ((\\<lambda>a. (Pair nd' a, Pair nd a)) ` accept (net nd))\\<inverse> `` {n}. resolve (split_node nd nd' net) n))) =\n     ({n} \\<inter> rename (id(nd := nd')) ` accepted_names net \\<union>\n     (\\<Union>n'\\<in>((decodes_to net)\\<inverse> `` {n} \\<union> ((\\<lambda>a. (Pair nd' a, Pair nd a)) ` accept (net nd))\\<inverse> `` {n}).\n        resolve (split_node nd nd' net) n'))\"\n    by(simp)\n  also have \"... = rename id ` resolve (split_node nd nd' net) n\"\n    by(simp add:resolve_simp[OF dom'] split_accepted split_decode Un_Image converse_Un rename_id\n                fresh_node_acceptD[OF fresh] fresh_node_translateD[OF fresh] neq)\n  finally show \"rename (id(nd := nd')) ` resolve net n = rename id ` resolve (split_node nd nd' net) n\" .\nqed\n(*>*)\n\ntext {* From these two lemmas, we have view-equivalence under splitting. *}\nlemma split_node_eq:\n  fixes S :: \"nodeid set\" and nd nd' :: nodeid and net :: net\n  assumes neq: \"nd \\<noteq> nd'\"\n      and wf_net: \"wf_net net\"\n      and fresh: \"fresh_node net nd'\"\n      and notin: \"nd' \\<notin> S\"\n    shows \"view_eq_on S (id(nd := nd'), net) (id, split_node nd nd' net)\"\n(*<*)\n  unfolding view_eq_on_def view_eq_def\nproof(simp, intro ballI conjI allI impI)\n  fix nd3 a\n  assume nd3in: \"nd3 \\<in> S\"\n  with notin have notnd': \"nd3 \\<noteq> nd'\" by(blast)\n \n  from neq notnd' fresh wf_net\n  show \"resolve_dom (net, nd3, a) =\n        resolve_dom (split_node nd nd' net, nd3, a)\"\n    by(simp add:split_node_domeq)\n\n  assume \"resolve_dom (net, nd3, a)\"\n  with assms notnd'\n  show \"rename (id(nd := nd')) ` view_from nd3 net a =\n        rename id ` view_from nd3 (split_node nd nd' net) a\"\n    unfolding view_from_def by(intro split_node_resolveeq, auto)\nqed\n(*>*)\n\n(*<*)\ntext {* Splitting preserves well-formedness. *}  \nlemma wf_split_node:\n  assumes wf: \"wf_net net\"\n      and neq: \"nd \\<noteq> nd'\"\n      and fresh: \"fresh_node net nd'\"\n  shows \"wf_net (split_node nd nd' net)\"\nproof(rule wf_netI)\n  fix nd2\n  from wf\n  show \"finite (accept (split_node nd nd' net nd2))\"\n    by(auto dest:wf_net_acceptD simp:split_node_def acceptor_node_def redirector_node_def)\nnext\n  fix n\n  assume \"resolve_dom (split_node nd nd' net, n)\"\n  with wf neq fresh\n  have dom: \"resolve_dom (net,n)\" by(simp add:split_node_domeq)\n    \n  show \"finite ((decodes_to (split_node nd nd' net))\\<inverse> `` {n})\"\n  proof(cases)\n    assume \"fst n = nd'\"\n    thus ?thesis\n      by(simp add:split_node_def Image_def decodes_to_def decode_step_def acceptor_node_def)\n  next\n    assume neq: \"fst n \\<noteq> nd'\"\n    show ?thesis\n    proof(cases)\n      assume eq: \"fst n = nd\"\n        \n      from dom wf have \"finite ((decodes_to net)\\<inverse> `` {n})\"\n        by(auto dest:wf_net_decodeD)\n      with eq neq show ?thesis\n        by(simp add:split_node_def Image_def decodes_to_def decode_step_def redirector_node_def)\n    next\n      assume neq': \"fst n \\<noteq> nd\"\n      from dom wf have \"finite ((decodes_to net)\\<inverse> `` {n})\"\n        by(auto dest:wf_net_decodeD)\n      with neq neq' show ?thesis\n        by(simp add:split_node_def Image_def decodes_to_def decode_step_def redirector_node_def)\n    qed\n  qed\nqed\n(*>*)\ntext {* Since a single split preserves equivalence, so does splitting a finite list of nodes\n  (\\autoref{eq:spliteq}): *}\nprimrec split_all :: \"nodeid list \\<Rightarrow> (nodeid \\<Rightarrow> nodeid) \\<Rightarrow> net \\<Rightarrow> net\"\n  where \"split_all [] _ net = net\" |\n        \"split_all (nd#nds) f net = split_node nd (f nd) (split_all nds f net)\"\n\n(*<*)\nlemma split_all_upd_comm:\n  \"nd \\<notin> set nds \\<Longrightarrow> (\\<And>nd'. f nd' \\<noteq> nd) \\<Longrightarrow>\n   split_all nds f (net(nd := x)) = (split_all nds f net)(nd := x)\"\n  by(induct nds, auto simp:split_node_def)\n\nlemma fresh_split_all:\n  assumes fresh: \"fresh_node net x\"\n      and notin: \"x \\<notin> set nds\"\n      and noclash: \"\\<And>nd. nd \\<in> set nds \\<Longrightarrow> f nd \\<noteq> x\"\n    shows \"fresh_node (split_all nds f net) x\"\n  using notin noclash by(induct nds, auto intro:fresh fresh_split_node)\n\nlemma wf_split_all:\n  \"wf_net net \\<Longrightarrow>\n   distinct nds \\<Longrightarrow>\n   (\\<And>nd. nd \\<in> set nds \\<Longrightarrow> fresh_node net (f nd)) \\<Longrightarrow>\n   (\\<And>nd. nd \\<in> set nds \\<Longrightarrow> f nd \\<notin> set nds) \\<Longrightarrow>\n   inj_on f (set nds) \\<Longrightarrow>\n   wf_net (split_all nds f net)\"\nproof(induct nds, simp_all)\n  fix nd nds\n  assume wf: \"wf_net (split_all nds f net)\"\n     and distinct: \"nd \\<notin> set nds \\<and> distinct nds\"\n     and IH_fresh: \"(\\<And>nd'. nd' = nd \\<or> nd' \\<in> set nds \\<Longrightarrow> fresh_node net (f nd'))\"\n     and IH_new: \"(\\<And>nd'. nd' = nd \\<or> nd' \\<in> set nds \\<Longrightarrow> f nd' \\<noteq> nd \\<and> f nd' \\<notin> set nds)\"\n     and inj: \"inj_on f (set nds) \\<and> f nd \\<notin> f ` (set nds)\"\n\n  have \"nd \\<noteq> f nd\"\n  proof(rule ccontr)\n    from IH_new have \"f nd \\<noteq> nd\" by(auto)\n    moreover assume \"\\<not> nd \\<noteq> f nd\"\n    ultimately show False by(simp)\n  qed\n  moreover have \"fresh_node (split_all nds f net) (f nd)\"\n  proof(rule fresh_split_all)\n    from IH_fresh show \"fresh_node net (f nd)\" by(auto)\n    from IH_new show \"f nd \\<notin> set nds\" by(auto)\n    fix nd'\n    assume nd'in: \"nd' \\<in> set nds\"\n    from nd'in distinct have \"nd \\<noteq> nd'\" by(auto)\n    with nd'in have \"f nd' \\<in> f ` set nds\" by(auto)\n    with inj show \"f nd' \\<noteq> f nd\" by(auto)\n  qed\n  ultimately\n  show \"wf_net (split_node nd (f nd) (split_all nds f net))\"\n    by(blast intro:wf_split_node wf)\nqed\n(*>*)\n\nlemma view_eq_split_all:\n  assumes distinct: \"distinct nds\"\n      and nonds: \"\\<And>nd. f nd \\<notin> set nds\"\n      and fresh: \"\\<And>nd. fresh_node net (f nd)\"\n      and inj: \"inj_on f (set nds)\"\n      and wf: \"wf_net net\"\n      and noS: \"\\<And>nd. f nd \\<notin> S\"\n  shows \"view_eq_on S (rename_list f nds , net) (id, split_all nds f net)\"\n(*<*)\n    (is \"view_eq_on S (rename_list f nds, net) (?B nds)\")\n  using distinct nonds inj\nproof(induct nds, simp add:equivp_reflp[OF equivp_view_eq_on])\n  fix nd::nodeid and nds\n  assume distinct: \"distinct (nd # nds)\"\n     and nonds: \"\\<And>nd'. f nd' \\<notin> set (nd # nds)\"\n     and inj: \"inj_on f (set (nd # nds))\"\n     and \"distinct nds \\<Longrightarrow> (\\<And>nd. f nd \\<notin> set nds) \\<Longrightarrow> inj_on f (set nds) \\<Longrightarrow>\n          view_eq_on S (rename_list f nds, net) (id, split_all nds f net)\"\n  hence IH: \"view_eq_on S (rename_list f nds, net) (id, split_all nds f net)\" by(auto)\n      \n  from IH have \"view_eq_on S ((\\<lambda>x. if x = nd then f nd else x) o rename_list f nds, net)\n                             ((\\<lambda>x. if x = nd then f nd else x) o id, split_all nds f net)\"\n    by(rule view_eq_on_comp)\n  hence \"view_eq_on S (rename_list f (nd#nds), net)\n                      (id(nd := f nd), split_all nds f net)\"\n    by(simp add:o_def fun_upd_def id_def)\n  also have \"view_eq_on S (id(nd := f nd), split_all nds f net)\n                          (id, split_all (nd#nds) f net)\"\n  proof(simp, rule split_node_eq)\n    from nonds show \"nd \\<noteq> f nd\"\n    proof(rule contrapos_nn)\n      assume \"nd = f nd\"\n      thus \"f nd \\<in> set (nd # nds)\" by(auto)\n    qed\n    from wf distinct fresh nonds inj\n    show \"wf_net (split_all nds f net)\" by(intro wf_split_all, auto)\n    show \"fresh_node (split_all nds f net) (f nd)\"\n    proof(rule fresh_split_all)\n      show \"fresh_node net (f nd)\" by(rule fresh)\n      from nonds show \"f nd \\<notin> set nds\" by(auto)\n    next\n      fix nd'\n      assume \"nd' \\<in> set nds\"\n      with distinct have \"nd' \\<in> set (nd # nds)\" \"nd \\<noteq> nd'\" by(auto)\n      moreover have \"nd \\<in> set (nd # nds)\" by(auto)\n      moreover note inj\n      ultimately show \"f nd' \\<noteq> f nd\" by(blast dest:inj_onD)\n    qed\n    show \"f nd \\<notin> S\" by(rule noS)\n  qed\n  finally show \"view_eq_on S (rename_list f (nd # nds), net) (id, split_all (nd # nds) f net)\" .\nqed\n(*>*)\n\n(*<*)\nsubsubsection \"Flattening\"\ntext_raw {* \\label{sec:isaflatten} *}\n\ndefinition absorb :: \"net \\<Rightarrow> net\"\n  where \"absorb net =\n    (\\<lambda>nd'. (net nd')\\<lparr> translate := \n      (\\<lambda>a. translate (net nd') a \\<union> (\\<Union>n\\<in>translate (net nd') a. translate (net (fst n)) (snd n))) \\<rparr>)\"\n\nlemma decode_absorb:\n  \"decodes_to (absorb net) = (decodes_to net O decodes_to net) \\<union> decodes_to net\"\nproof(intro set_eqI)\n  fix x::\"name \\<times> name\"\n  obtain n n' where \"x = (n,n')\" by(cases x, auto)\n  thus \"(x \\<in> decodes_to (absorb net)) = (x \\<in> decodes_to net O decodes_to net \\<union> decodes_to net)\"\n  proof(simp, intro iffI)\n    assume \"(n,n') \\<in> decodes_to (absorb net)\"\n    hence \"n \\<in> translate (net (fst n')) (snd n') \\<or>\n           (\\<exists>x\\<in>translate (net (fst n')) (snd n'). n \\<in> translate (net (fst x)) (snd x))\"\n      by(simp add:absorb_def decodes_to_def decode_step_def)\n    thus \"(n, n') \\<in> decodes_to net O decodes_to net \\<or> (n, n') \\<in> decodes_to net\"\n    proof\n      assume \"n \\<in> translate (net (fst n')) (snd n')\"\n      thus ?thesis by(simp add:decodes_to_def decode_step_def)\n    next\n      assume \"\\<exists>x\\<in>translate (net (fst n')) (snd n'). n \\<in> translate (net (fst x)) (snd x)\"\n      then obtain x where \"x \\<in> translate (net (fst n')) (snd n')\"\n                      and \"n \\<in> translate (net (fst x)) (snd x)\" by(blast)\n      hence \"(n,x) \\<in> decodes_to net\" \"(x,n') \\<in> decodes_to net\"\n        by(simp_all add:decodes_to_def decode_step_def)\n      thus ?thesis by(auto)\n    qed\n  next\n    assume \"(n, n') \\<in> decodes_to net O decodes_to net \\<or> (n, n') \\<in> decodes_to net\"\n    thus \"(n, n') \\<in> decodes_to (absorb net)\"\n    proof\n      assume \"(n, n') \\<in> decodes_to net O decodes_to net\"\n      then obtain x where \"(n,x) \\<in> decodes_to net\" \"(x,n') \\<in> decodes_to net\" by(auto)\n      thus ?thesis by(auto simp:decodes_to_def decode_step_def absorb_def)\n    next\n      assume \"(n, n') \\<in> decodes_to net\"\n      thus ?thesis by(simp add:decodes_to_def decode_step_def absorb_def)\n    qed\n  qed\nqed\n\nlemma decode_absorb_pow:\n  \"decodes_to ((absorb ^^ n) net) = (\\<Union>i\\<in>{1..2^n}. decodes_to net ^^ i)\"\nproof(induct n, simp)\n  fix n\n  assume IH: \"decodes_to ((absorb ^^ n) net) = (\\<Union>i\\<in>{1..2^n}. decodes_to net ^^ i)\"\n  have \"decodes_to ((absorb ^^ Suc n) net) =\n        decodes_to ((absorb ^^ n) net) O decodes_to ((absorb ^^ n) net) \\<union>\n        decodes_to ((absorb ^^ n) net)\"\n    by(simp add:decode_absorb)\n  also have \"... = (\\<Union>i\\<in>{1..2^n}. decodes_to net ^^ i) O (\\<Union>i\\<in>{1..2^n}. decodes_to net ^^ i) \\<union>\n                   (\\<Union>i\\<in>{1..2^n}. decodes_to net ^^ i)\" by(simp add:IH)\n  also have \"... = (\\<Union>i\\<in>{1..2^Suc n}. decodes_to net ^^ i)\"\n  proof(intro set_eqI iffI)\n    fix x\n    assume \"x \\<in> (\\<Union>i\\<in>{1..2^n}. decodes_to net ^^ i) O\n                (\\<Union>i\\<in>{1..2^n}. decodes_to net ^^ i) \\<union>\n                (\\<Union>i\\<in>{1..2^n}. decodes_to net ^^ i)\"\n    thus \"x \\<in> (\\<Union>i\\<in>{1..2^Suc n}. decodes_to net ^^ i)\"\n    proof\n      assume \"x \\<in> (\\<Union>i\\<in>{1..2 ^ n}. decodes_to net ^^ i) O (\\<Union>i\\<in>{1..2 ^ n}. decodes_to net ^^ i)\"\n      thus ?thesis\n      proof\n        fix a b c\n        assume xeq: \"x = (a,c)\"\n            and ab: \"(a,b) \\<in> (\\<Union>i\\<in>{1..2 ^ n}. decodes_to net ^^ i)\"\n            and bc: \"(b,c) \\<in> (\\<Union>i\\<in>{1..2 ^ n}. decodes_to net ^^ i)\"\n            \n        from ab obtain i where ab': \"(a,b) \\<in> decodes_to net ^^ i\" and iin: \"i\\<in>{1..2^n}\" by(auto)\n        from bc obtain j where bc': \"(b,c) \\<in> decodes_to net ^^ j\" and jin: \"j\\<in>{1..2^n}\"  by(auto)\n            \n        from iin jin have \"i + j \\<in> {1..2^Suc n}\" by(auto)\n        moreover from ab' bc' xeq have \"x \\<in> decodes_to net ^^ (i+j)\" by(auto simp:relpow_add)\n        ultimately show ?thesis by(blast)\n      qed\n    next\n      assume \"x \\<in> (\\<Union>i\\<in>{1..2 ^ n}. decodes_to net ^^ i)\"\n      thus ?thesis by(auto)\n    qed\n  next\n    fix x\n    assume \"x \\<in> (\\<Union>i\\<in>{1..2 ^ Suc n}. decodes_to net ^^ i)\"\n    then obtain i where iin: \"i \\<in> {1..2 ^ Suc n}\" and xdec: \"x \\<in> decodes_to net ^^ i\" by(blast)\n    show \"x \\<in> (\\<Union>i\\<in>{1..2 ^ n}. decodes_to net ^^ i) O (\\<Union>i\\<in>{1..2 ^ n}. decodes_to net ^^ i) \\<union>\n          (\\<Union>i\\<in>{1..2 ^ n}. decodes_to net ^^ i)\"\n    proof(cases)\n      assume \"i \\<le> 2 ^ n\"\n      with iin have \"i \\<in> {1..2 ^ n}\" by(auto)\n      with xdec show ?thesis by(auto)\n    next\n      assume gt: \"\\<not> i \\<le> 2 ^ n\"\n      hence \"1 \\<le> i - 2 ^ n\" by(auto)\n      with iin have diff_in: \"i - 2 ^ n \\<in> {1..2 ^ n}\" by(auto)\n          \n      from gt have \"2 ^ n + (i - 2 ^ n) = i\" by(auto)\n      with xdec have \"x \\<in> decodes_to net ^^ (2 ^ n + (i - 2 ^ n))\" by(simp)\n      hence \"x \\<in> decodes_to net ^^ (2 ^ n) O decodes_to net ^^ (i - 2 ^ n)\"\n        by(simp add:relpow_add)\n      thus ?thesis\n      proof\n        fix a b c\n        assume xeq: \"x = (a,c)\"\n           and ab: \"(a,b) \\<in> decodes_to net ^^ 2 ^ n\"\n           and bc: \"(b,c) \\<in> decodes_to net ^^ (i - 2 ^ n)\"\n           \n        from ab have \"(a,b) \\<in> (\\<Union>i\\<in>{1..2 ^ n}. decodes_to net ^^ i)\" by(auto)\n        moreover from bc diff_in have \"(b,c) \\<in> (\\<Union>i\\<in>{1..2 ^ n}. decodes_to net ^^ i)\" by(blast)\n        ultimately show ?thesis by(auto simp:xeq)\n      qed\n    qed\n  qed\n  finally show \"decodes_to ((absorb ^^ Suc n) net) = (\\<Union>i\\<in>{1..2 ^ Suc n}. decodes_to net ^^ i)\" .\nqed\n\nlemma accept_absorb:\n  \"accept (absorb net nd') = accept (net nd')\"\n  by(simp add:absorb_def)\n\nlemma accepted_names_absorb:\n  \"accepted_names (absorb net) = accepted_names net\"\n  by(simp add:accepted_names_def accept_absorb)\n\nlemma decode_absorb_trancl:\n  \"decodes_to (absorb net) \\<subseteq> (decodes_to net)\\<^sup>+\"\n  by(auto simp:decode_absorb)\n\nlemma decode_absorb_rtrancl:\n  \"(decodes_to (absorb net))\\<^sup>* = (decodes_to net)\\<^sup>*\"\nproof(intro antisym)\n  from decode_absorb_trancl\n  have \"(decodes_to (absorb net))\\<^sup>* \\<subseteq> ((decodes_to net)\\<^sup>+)\\<^sup>*\" by(rule rtrancl_mono)\n  thus \"(decodes_to (absorb net))\\<^sup>* \\<subseteq> (decodes_to net)\\<^sup>*\" by(simp)\n  \n  have \"(decodes_to net)\\<^sup>* \\<subseteq> (decodes_to net O decodes_to net)\\<^sup>* \\<union> (decodes_to net)\\<^sup>*\" by(blast)\n  also have \"... \\<subseteq> (decodes_to (absorb net))\\<^sup>*\"\n    unfolding decode_absorb by(rule rtrancl_Un_subset)\n  finally  show \"(decodes_to net)\\<^sup>* \\<subseteq> (decodes_to (absorb net))\\<^sup>*\" .\nqed\n\nlemma absorb_domeq:\n  assumes wf: \"wf_net net\"\n  shows \"resolve_dom (absorb net, a) = resolve_dom (net, a)\"\nproof(intro iffI)\n  assume \"resolve_dom (absorb net, a)\"\n  hence \"a \\<in> Wellfounded.acc (decodes_to (absorb net))\"\n    by(simp add:resolve_dom_decode_acc)\n  also have \"... \\<subseteq> Wellfounded.acc (decodes_to net)\"\n    by(rule acc_subset, simp add:decode_absorb)\n  finally show \"resolve_dom (net, a)\"\n    by(simp add:resolve_dom_decode_acc)\nnext\n  assume \"resolve_dom (net, a)\"\n  with wf have \"\\<exists>f. wf_rank f a net\"\n    by(blast intro:mkrank dest:wf_net_decodeD)\n  then obtain f where rank: \"wf_rank f a net\" by(blast)\n      \n  have \"wf_rank f a (absorb net)\"\n  proof(rule wf_rankI)\n    fix x y\n    assume \"(x, a) \\<in> (decodes_to (absorb net))\\<^sup>*\"\n    also from decode_absorb_trancl have \"... \\<subseteq> ((decodes_to net)\\<^sup>+)\\<^sup>*\"\n      by(rule rtrancl_mono)\n    also have \"... = (decodes_to net)\\<^sup>*\" by(simp)\n    finally have \"(x, a) \\<in> (decodes_to net)\\<^sup>*\" .\n    with rank have rank': \"wf_rank f x net\" by(rule wf_reachable)\n        \n    assume \"(y, x) \\<in> decodes_to (absorb net)\"\n    with decode_absorb_trancl have \"(y,x) \\<in> (decodes_to net)\\<^sup>+\" by(auto)\n    with rank' show \"f y < f x\" by(blast dest:wf_rank_tranclD)\n  qed\n  thus \"resolve_dom (absorb net, a)\" by(rule wf_resolve_dom)\nqed\n  \nlemma wf_absorb:\n  assumes wf: \"wf_net net\"\n  shows \"wf_net (absorb net)\"\nproof(rule wf_netI)\n  fix nd\n  from wf show \"finite (accept (absorb net nd))\"\n    by(simp add:accept_absorb wf_net_acceptD)\nnext\n  fix n\n  assume \"resolve_dom (absorb net, n)\"\n  with wf have dom: \"resolve_dom (net, n)\" by(simp add:absorb_domeq)\n  with wf have fin: \"finite ((decodes_to net)\\<inverse> `` {n})\" by(blast dest:wf_net_decodeD)\n  show \"finite ((decodes_to (absorb net))\\<inverse> `` {n})\"\n  proof(simp add:decode_absorb Image_def, intro conjI)\n    from fin show fin': \"finite {y. (y, n) \\<in> decodes_to net}\" by(simp add:Image_def)\n        \n    have \"{y. (y, n) \\<in> decodes_to net O decodes_to net} =\n          UNION {x. (x, n) \\<in> decodes_to net} (\\<lambda>x. {y. (y, x) \\<in> decodes_to net})\"\n      by(auto)\n    moreover {\n      fix x\n      assume \"(x, n) \\<in> decodes_to net\"\n      with dom have \"resolve_dom (net, x)\" by(blast intro: resolve_dom_downward)\n      with wf have \"finite ((decodes_to net)\\<inverse> `` {x})\" by(blast dest:wf_net_decodeD)\n      hence \"finite {y. (y, x) \\<in> decodes_to net}\" by(simp add:Image_def)\n    }\n    moreover note fin'\n    ultimately show \"finite {y. (y, n) \\<in> decodes_to net O decodes_to net}\" by(simp)\n  qed\nqed\n\nlemma absorb_eq:\n  fixes S :: \"nodeid set\" and nd nd' :: nodeid and net :: net\n  assumes neq: \"nd \\<noteq> nd'\"\n      and wf_net: \"wf_net net\"\n      and fresh: \"fresh_node net nd'\"\n      and notin: \"nd' \\<notin> S\"\n    shows \"view_eq_on S (id, net) (id, absorb net)\"\nproof(intro view_eq_onI view_eqI, simp_all add:rename_id view_from_def)\n  thm absorb_domeq\n  fix nd a\n  assume ndS: \"nd \\<in> S\"\n  from wf_net show domeq: \"resolve_dom (net, nd, a) = resolve_dom (absorb net, nd, a)\"\n    by(simp add:absorb_domeq)\n\n  assume dom: \"resolve_dom (net, nd, a)\"\n  with domeq have dom': \"resolve_dom (absorb net, nd, a)\" by(simp)\n\n  from dom have \"resolve net (nd, a) = accepted_names net \\<inter> ((decodes_to net)\\<inverse>)\\<^sup>* `` {(nd,a)}\"\n    by(simp add:resolve_eval)\n  also have \"... = accepted_names net \\<inter> ((decodes_to (absorb net))\\<inverse>)\\<^sup>* `` {(nd,a)}\"\n    by(simp add:rtrancl_converse decode_absorb_rtrancl)\n  also from dom' have \"... = resolve (absorb net) (nd, a)\"\n    by(simp add:resolve_eval accepted_names_absorb)\n  finally show \"resolve net (nd, a) = resolve (absorb net) (nd, a)\" .\nqed\n\ndefinition detach :: \"nodeid \\<Rightarrow> net \\<Rightarrow> net\"\n  where \"detach nd net =\n    net(nd := (net nd)\\<lparr> translate := (\\<lambda>a. translate (net nd) a \\<inter> accepted_names net) \\<rparr>)\"\n\ndefinition flatten :: \"nodeid \\<Rightarrow> net \\<Rightarrow> net\"\n  where \"flatten nd net =\n    net(nd := (net nd)\\<lparr> translate :=\n      (\\<lambda>a. resolve net (nd,a) - {(nd,a)}) \\<rparr>)\"\n\nlemma accept_flatten:\n  \"accept (flatten nd net nd') = accept (net nd')\"\n  by(simp add:flatten_def)\n\nlemma flatten_decode:\n  assumes step: \"(x,y) \\<in> decodes_to (flatten nd net)\"\n      and dom: \"resolve_dom (net,y)\"\n    shows \"(x,y) \\<in> (decodes_to net)\\<^sup>*\"\nproof(cases)\n  assume \"fst y = nd\"\n  with step show ?thesis\n    by(intro resolve_reachable[OF dom], cases y,\n       simp add:decodes_to_def decode_step_def flatten_def)\nnext\n  assume \"fst y \\<noteq> nd\"\n  with step show ?thesis\n    by(auto simp:decodes_to_def decode_step_def flatten_def)\nqed\n\nlemma flatten_decode_path:\n  assumes path: \"(x,y) \\<in> (decodes_to (flatten nd net))\\<^sup>*\"\n      and dom: \"resolve_dom (net,y)\"\n    shows \"(x,y) \\<in> (decodes_to net)\\<^sup>*\"\n  using dom\nproof(induct rule:rtrancl.induct[OF path], simp)\n  fix a b c\n  assume domc: \"resolve_dom (net, c)\"\n     and bc: \"(b, c) \\<in> decodes_to (flatten nd net)\"\n  hence bc': \"(b, c) \\<in> (decodes_to net)\\<^sup>*\" by(blast intro: flatten_decode)\n  with domc have domb: \"resolve_dom (net,b)\" by(blast intro:resolve_dom_reachable)\n  moreover assume \"resolve_dom (net, b) \\<Longrightarrow> (a, b) \\<in> (decodes_to net)\\<^sup>*\"\n  ultimately have \"(a, b) \\<in> (decodes_to net)\\<^sup>*\" by(blast)\n  with bc' show \"(a, c) \\<in> (decodes_to net)\\<^sup>*\" by(auto)\nqed\n\nlemma flatten_domle:\n  assumes wf:  \"wf_net net\"\n      and dom: \"resolve_dom (net, n)\"\n    shows \"resolve_dom (flatten nd net, n)\"\nproof -\n  from wf dom have \"\\<exists>f. wf_rank f n net\"\n    by(blast dest:wf_net_decodeD intro:mkrank)\n  then obtain f where rank: \"wf_rank f n net\" by(blast)\n\n  have \"wf_rank f n (flatten nd net)\"\n  proof(rule wf_rankI)\n    fix x y\n    assume step: \"(y, x) \\<in> decodes_to (flatten nd net)\"\n       and path: \"(x, n) \\<in> (decodes_to (flatten nd net))\\<^sup>*\"\n       \n    from path dom have path': \"(x,n) \\<in> (decodes_to net)\\<^sup>*\" by(rule flatten_decode_path)\n    with dom have dom': \"resolve_dom (net, x)\" by(blast intro:resolve_dom_reachable)\n    with step have step': \"(y,x) \\<in> (decodes_to net)\\<^sup>*\" by(rule flatten_decode)\n        \n    from path' step' have yx: \"(y, x) \\<in> (decodes_to net)\\<^sup>*\" by(auto)\n\n    from step have \"y \\<noteq> x\"\n    proof(cases)\n      assume \"fst x = nd\"\n      with step show ?thesis by(auto simp:decodes_to_def decode_step_def flatten_def)\n    next\n      assume \"fst x \\<noteq> nd\"\n      with step have \"(y,x) \\<in> decodes_to net\"\n        by(simp add:decodes_to_def decode_step_def flatten_def)\n      with path' rank have \"f y < f x\" by(blast dest:wf_rankD)\n      thus \"y \\<noteq> x\" by(auto)\n    qed\n    with yx have \"(y, x) \\<in> (decodes_to net)\\<^sup>+\" by(auto dest:rtranclD)\n    moreover from rank path' have \"wf_rank f x net\" by(blast dest:wf_reachable)\n    ultimately show \"f y < f x\" by(blast dest:wf_rank_tranclD)\n  qed\n  thus ?thesis by(rule wf_resolve_dom)\nqed\n\nend\n(*>*)", "meta": {"author": "BarrelfishOS", "repo": "Isabelle-hardware-models", "sha": "a638383df9dd8db15805c59efb65724bc919df0a", "save_path": "github-repos/isabelle/BarrelfishOS-Isabelle-hardware-models", "path": "github-repos/isabelle/BarrelfishOS-Isabelle-hardware-models/Isabelle-hardware-models-a638383df9dd8db15805c59efb65724bc919df0a/theories/model/AbstractOps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.3259792352434986}}
{"text": "(*  Title:      MultiASP.thy\n    Author:     Ludovic Henrio and Florian Kammuller\n                2014\n\n    Note:       This is a second version of Serialization.thy to illustrate\n                how the finite map typedef can be integrated. It is based\n                on an old version of\n                \"Multi-active object formalisation\"\n                The change is that is uses a different type Store from\n                StoreDefintion_typedef that integrate the finite map typedef.\n                It only is adapted at the beginning for illustration on the\n                effects of changes and is on an old version of Serialization.\n                DOES NOT RUN THROUGH \n*)\ntheory Serialization_typedef imports StoreDefinition_typedef Main AuxiliaryFunctions begin\naxiomatization where \n(*finite_map: \"finite (dom (\\<sigma>::Store))\"\nand *)\nfinite_obj: \"V=Obj(f,C) \\<Longrightarrow>finite (dom f)\"\n\n(* there is  a lemma now *)\nthm finite_dom_Store\n(* finite dom\\<^sub>f ?\\<sigma>\\<Colon>nat \\<rightharpoonup>\\<^sub>f Storable *)\n\nlemma ran_and_dom: \"ran f = the`f`dom f  \"\napply (auto simp: ran_def dom_def)\napply (subgoal_tac \"x=the (f a) \")\napply blast\napply force\ndone\n\nlemma finite_ran_obj:\n\"V=Obj(f,C) \\<Longrightarrow>finite (ran f)\"\napply (drule finite_obj)\napply (auto simp: ran_and_dom)\ndone\n\n\nsubsection {* serialization and location renaming *}\n\ninductive serialize :: \"Value \\<Rightarrow> Store \\<Rightarrow> Store \\<Rightarrow> bool\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n     \"\\<lbrakk>((\\<sigma>'$ l) = (\\<sigma>$ l)) \\<and> ((\\<sigma>$ l) = Some(Obj obj)) \\<and> (\\<forall> v\\<in> ran(fst(obj)). (\\<exists>\\<sigma>''. (serialize v \\<sigma> \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>f \\<sigma>')))\n     \\<rbrakk> \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" \n     |\n    \"\\<lbrakk>((\\<sigma>'$ l) = (\\<sigma>$ l)) \\<and> ((\\<sigma>$ l) = Some (StoredVal v)) \\<and> (serialize v \\<sigma> \\<sigma>') \\<rbrakk>\n     \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" \n     |\n     \"serialize (null) \\<sigma> \\<sigma>'\" \n     (*|\n         \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (FutRef f)  \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n     \"(serialize (ActRef f) \\<sigma> \\<sigma>')\" |\n     \"serialize (ASPInt n) \\<sigma> \\<sigma>'\" | \n     \"serialize (ASPBool b) \\<sigma> \\<sigma>'\"\n*)\n\n definition Referenced_locations_Value:: \"Value \\<Rightarrow> Location set\"\nwhere  \"Referenced_locations_Value v \\<equiv> (case v of ObjRef l \\<Rightarrow>{l} | _ \\<Rightarrow> {})\"\n\ndefinition Referenced_locations_Location:: \"Store \\<Rightarrow>Location \\<Rightarrow> Location set\"\nwhere  \"Referenced_locations_Location \\<sigma> l \\<equiv> \ncase (\\<sigma>)\\<^sub>f l of \nNone \\<Rightarrow>{} |\nSome (Obj obj) \\<Rightarrow> \\<Union>(Referenced_locations_Value`ran(fst(obj))) |\nSome (StoredVal (ObjRef l')) \\<Rightarrow> {l'} |\n_\\<Rightarrow>{}\n\"\n\nlemma Referenced_locations_Value_obj[simp]: \"Referenced_locations_Value (ObjRef l) = {l}\"\napply (auto simp: Referenced_locations_Value_def)\ndone\nfunction (sequential) serialization_filter :: \"Location \\<Rightarrow> Store \\<Rightarrow> Location set \\<Rightarrow> Location set\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n    \"\n    (serialization_filter l \\<sigma> L) = (if l\\<in>L then {} else\n      (case (\\<sigma>)\\<^sub>f(l) of\n      None \\<Rightarrow>{} |\n      Some (Obj obj) \\<Rightarrow> {l}\\<union>\\<Union>( (\\<lambda>x.(serialization_filter x \\<sigma> (L\\<union>{l}))) \n                `( (\\<Union>(Referenced_locations_Value`ran(fst(obj)))))) |\n      Some (StoredVal (ObjRef l')) \\<Rightarrow>{l}\\<union> (serialization_filter l' \\<sigma> (L\\<union>{l}))|\n      _ \\<Rightarrow> {l}))\" \nby auto\ntermination \napply (relation \"measure (\\<lambda>(l,\\<sigma>,L). card (dom (\\<sigma>)\\<^sub>f - L))\") \n  apply auto\n apply (subgoal_tac \"dom (\\<sigma>)\\<^sub>f - insert l L = (dom (\\<sigma>)\\<^sub>f - L) - {l}\") \n  apply (subgoal_tac \"finite ((dom (\\<sigma>)\\<^sub>f-L))\")\n(*4*)\n   apply (drule_tac x=l in Finite_Set.card.remove)+\n    apply (insert finite_dom_Store)\nsorry\n    (*    \n    apply auto\n(*1*)\napply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \n apply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\n  apply (drule_tac x=l in Finite_Set.card.remove)+\n   apply (insert finite_map)\n   apply auto\ndone\n*)\n\n\nabbreviation serialize2:: \"Location \\<Rightarrow> Store \\<Rightarrow> Store\" \nwhere\n\"serialize2 l \\<sigma> \\<equiv>  Abs_fmap((\\<sigma>)\\<^sub>f |` serialization_filter l \\<sigma> {})\" \n\n(*lemma set_sorted_list_of_set: \"set (sorted_list_of_set S) = S\"\napply (rule Finite_Set.finite.induct)\n*)\nlemma SFI1SG1: \"(\\<And>a b. l \\<notin> L \\<Longrightarrow>\n               \\<sigma>$ l = Some (Obj (a, b)) \\<Longrightarrow>\n               \\<forall>x\\<in>\\<Union>(Referenced_locations_Value ` ran a). P (serialization_filter x \\<sigma> (L \\<union> {l})) x \\<sigma> (L \\<union> {l}) \\<Longrightarrow>\n               P ({l} \\<union> \\<Union>((\\<lambda>x. serialization_filter x \\<sigma> (L \\<union> {l})) ` \\<Union>(Referenced_locations_Value ` ran a))) l \\<sigma> L) \\<Longrightarrow>\n       P {} l \\<sigma> L \\<Longrightarrow>\n        (\\<And>x2 prod x.\n           l \\<notin> L \\<Longrightarrow>\n           \\<sigma>$ l = Some x2 \\<Longrightarrow>\n           x2 = Obj prod \\<Longrightarrow>\n           x \\<in> \\<Union>(Referenced_locations_Value ` ran (fst prod)) \\<Longrightarrow> P (serialization_filter x \\<sigma> (L \\<union> {l})) x \\<sigma> (L \\<union> {l})) \\<Longrightarrow>\n        \\<sigma>$ l = Some a \\<Longrightarrow> a = Obj prod \\<Longrightarrow> P (serialization_filter l \\<sigma> L) l \\<sigma> L\"\napply (case_tac prod)\napply clarsimp\napply blast\ndone\n\nlemma  SFI1SG2:\"(\\<And>x2 Value nat.\n           l \\<notin> L \\<Longrightarrow>\n           \\<sigma>$ l = Some x2 \\<Longrightarrow>\n           x2 = StoredVal Value \\<Longrightarrow> Value = ObjRef nat \\<Longrightarrow> P (serialization_filter nat \\<sigma> (L \\<union> {l})) nat \\<sigma> (L \\<union> {l})) \\<Longrightarrow>\n     (\\<And>l'. l \\<notin> L \\<Longrightarrow>\n              \\<sigma>$ l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>\n              P (serialization_filter l' \\<sigma> (L \\<union> {l})) l' \\<sigma> (L \\<union> {l}) \\<Longrightarrow> P ({l} \\<union> serialization_filter l' \\<sigma> (L \\<union> {l})) l \\<sigma> L) \\<Longrightarrow>\n  \\<sigma>$ l = Some a \\<Longrightarrow>  P {} l \\<sigma> L\\<Longrightarrow>a = StoredVal (ObjRef l') \\<Longrightarrow> P (serialization_filter l \\<sigma> L) l \\<sigma> L\n  \"\napply clarsimp\ndone\n\nabbreviation isnotObjRef where \"isnotObjRef V \\<equiv>\\<forall>l'. V\\<noteq>ObjRef l'\"\n\nlemma serialization_filter_induct_1: \"   \n(\\<And>l \\<sigma> L. P {} l \\<sigma> L) \\<Longrightarrow> \n(\\<And>l \\<sigma> L V. l\\<notin>L \\<Longrightarrow>  \\<sigma>$ l = Some (StoredVal V) \\<Longrightarrow>isnotObjRef V \\<Longrightarrow>P {l} l \\<sigma> L) \\<Longrightarrow> \n(\\<And>l \\<sigma> L a b.\n        l \\<notin> L \\<Longrightarrow> \\<sigma>$ l = Some (Obj (a,b)) \\<Longrightarrow> \n           (\\<forall> x\\<in>\\<Union>(Referenced_locations_Value`(ran a)). \n                          P (serialization_filter x \\<sigma> (L\\<union>{l})) x \\<sigma> (L\\<union>{l})) \\<Longrightarrow>\n            P ({l}\\<union>(\\<Union> ((\\<lambda> x. serialization_filter x \\<sigma> (L \\<union> {l}))` \\<Union>(Referenced_locations_Value`ran(a))))) l \\<sigma> L)  \\<Longrightarrow>\n(\\<And>l \\<sigma> L l'.\n        l \\<notin> L \\<Longrightarrow> \\<sigma>$ l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> \n           (P (serialization_filter l' \\<sigma> (L\\<union>{l})) l' \\<sigma>  (L\\<union>{l}))\\<Longrightarrow>\n           (P ({l}\\<union>(serialization_filter l' \\<sigma> (L\\<union>{l}))) l \\<sigma> L))         \\<Longrightarrow>   \n   P (serialization_filter l' \\<sigma>' L') l' \\<sigma>' L'\"\napply (rule serialization_filter.induct)\napply (rotate_tac 1,drule_tac x=l in meta_spec)+\napply (rotate_tac -1,drule_tac x=\\<sigma> in meta_spec)+\napply (rotate_tac -1,drule_tac x=L in meta_spec)+\napply (case_tac \"\\<sigma>$ l\")\n(*2*)\n apply force\napply (case_tac a)\n apply (erule SFI1SG1,simp,simp,simp,simp)\napply (case_tac Value)\n apply force\napply (erule SFI1SG2,simp+)\ndone\n\nlemma serialization_filter_induct_2: \"   (\\<And>l \\<sigma> L. P {} ) \\<Longrightarrow>\n(\\<And>l \\<sigma> L V.  l\\<notin>L \\<Longrightarrow> \\<sigma> l = Some (StoredVal V) \\<Longrightarrow>isnotObjRef V \\<Longrightarrow>P {l} ) \\<Longrightarrow> \n(\\<And>l \\<sigma> L a b.\n        l \\<notin> L \\<Longrightarrow> \\<sigma>$ l = Some (Obj (a,b)) \\<Longrightarrow> \n           (\\<forall> x\\<in>\\<Union>(Referenced_locations_Value`(ran a)). P (serialization_filter x \\<sigma> (L\\<union>{l})) ) \\<Longrightarrow>\n           P ({l}\\<union>(\\<Union> ((\\<lambda> x. serialization_filter x \\<sigma> (L \\<union> {l}))` \\<Union>(Referenced_locations_Value`ran(a))))) )   \\<Longrightarrow> \n(\\<And>l \\<sigma> L l'.\n        l \\<notin> L \\<Longrightarrow> \\<sigma>$ l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> \n           (P (serialization_filter l' \\<sigma> (L\\<union>{l})) )\\<Longrightarrow>\n           (P ({l}\\<union>(serialization_filter l' \\<sigma> (L\\<union>{l}))))) \n  \\<Longrightarrow>   \n  \n   P (serialization_filter l \\<sigma> L) \"\napply (insert  serialization_filter_induct_1 [of \"(\\<lambda> S l \\<sigma> L. (P S))\" ])\napply auto\ndone\n\nlemma serialization_filter_subset: \"serialization_filter l \\<sigma> L \\<subseteq> dom\\<^sub>f \\<sigma>\"\napply (rule_tac P= \"\\<lambda> S l \\<sigma> L. (S \\<subseteq> dom\\<^sub>f \\<sigma>)\" in   serialization_filter_induct_1)\n   apply auto\napply (drule_tac x=xb in bspec)\n apply auto\napply (drule_tac x=xa in bspec)\n apply (auto split: option.splits )\ndone\n\nlemma serialize_subset: \"dom\\<^sub>f (serialize2 l \\<sigma>) \\<subseteq> dom\\<^sub>f \\<sigma>\"\napply (insert serialization_filter_subset)\napply (unfold dom_f_def)\n\napply (subgoal_tac \"dom (serialize2 l \\<sigma>)\\<^sub>f \\<subseteq> serialization_filter l \\<sigma> {} \")\napply (drule_tac x = l in meta_spec)\napply (drule_tac x = \\<sigma> in meta_spec)\napply (drule_tac x = \"{}\" in meta_spec)\napply simp\napply (fold dom_f_def)\napply simp\napply (rule subsetI)\napply (case_tac \"\\<sigma>$ l\")\napply auto\n(* up to here checked *)\ndone\n\nlemma serialize_value: \"(serialize2 l \\<sigma>) l' = Some x \\<Longrightarrow> \\<sigma> l' = Some x\"\napply (subgoal_tac \"l'\\<in>(serialization_filter l \\<sigma> {})\")\n apply (drule_tac m=\\<sigma> in Map.restrict_in)\n apply force\napply (rule Map_restrict_Some,blast)\ndone\n\ndefinition Well_Formed_Store where\n\"Well_Formed_Store \\<sigma> \\<equiv> \\<forall> l\\<in> dom \\<sigma>. Referenced_locations_Location \\<sigma> l\\<subseteq>dom \\<sigma>\"\n\n\nlemma Referenced_locations_LocationI_Obj[intro]:\n\"\\<sigma> l = Some (Obj (a, b)) \\<Longrightarrow>\n            a x = Some (ObjRef l') \\<Longrightarrow> l'\\<in> Referenced_locations_Location \\<sigma> l\"\napply (auto simp: Referenced_locations_Location_def Referenced_locations_Value_def)\napply (rule_tac x=\"ObjRef l'\" in bexI)\n apply auto\napply (rule ranI,blast)\ndone\n\n\nlemma Referenced_locations_LocationI_ref[intro]:\n\"\\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>  l'\\<in> Referenced_locations_Location \\<sigma> l\"\napply (auto simp: Referenced_locations_Location_def Referenced_locations_Value_def)\ndone\nlemma Well_Formed_StoreD_obj: \n\"\\<sigma> la = Some (Obj (f, C)) \\<Longrightarrow>  Well_Formed_Store \\<sigma> \\<Longrightarrow> f x = Some (ObjRef l) \\<Longrightarrow>   l \\<in> dom \\<sigma>\"\napply (auto simp: Well_Formed_Store_def )\ndone\nlemma Well_Formed_StoreD_ref: \n\"\\<sigma> la = Some (StoredVal (ObjRef l)) \\<Longrightarrow>  Well_Formed_Store \\<sigma> \\<Longrightarrow> l \\<in> dom \\<sigma>\"\napply (auto simp: Well_Formed_Store_def )\ndone\n\nlemma serialization_filter_WF_1step_obj[rule_format]: \n  \"l\\<in>serialization_filter l'' \\<sigma> L \\<longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<longrightarrow>  a x = Some (ObjRef l') \n        \\<longrightarrow>Well_Formed_Store \\<sigma>\\<longrightarrow>  l'\\<in>L\\<or>l'\\<in>serialization_filter l'' \\<sigma> L \"\napply (rule_tac P= \n\"\\<lambda> S l'' \\<sigma> L. l\\<in>S \\<longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<longrightarrow>  a x = Some ( ObjRef l')   \\<longrightarrow>Well_Formed_Store \\<sigma>\n\\<longrightarrow>   l'\\<in>L\\<or>l'\\<in>S\" in   serialization_filter_induct_1)\n(*4*)\n   apply force\n  apply clarsimp\n apply (case_tac \"l'=la\")\n  apply simp\n apply (case_tac \"l=la\")\n  apply clarsimp\n  apply (drule_tac x=\"( ObjRef l')\" in bspec)\n   apply (rule ranI)\n   apply blast\n  apply (drule_tac x=l' in bspec,simp,simp)\n  apply (auto split: split_if_asm )\n(*2*)\n apply (drule_tac x=l' in bspec,simp)\n  apply (rule_tac x=\"( ObjRef l')\" in bexI)\n  apply simp\n  apply (rule ranI,simp)\n apply (clarsimp split: option.splits Storable.splits simp: Well_Formed_Store_def)\n  apply (drule_tac x=l in bspec,blast)\n  apply (drule Referenced_locations_LocationI_Obj, simp+)\n  apply force\n(*2*)\n apply (simp split: Value.splits)\napply (drule_tac x=l' in bspec,simp)\n apply (rule_tac x=\"( ObjRef l')\" in bexI)\n  apply simp\n apply (rule ranI,simp)\napply auto\ndone\n\nlemma serialization_filter_WF_1step_ref[rule_format]: \n  \"l\\<in>serialization_filter l'' \\<sigma> L \\<longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \n        \\<longrightarrow>Well_Formed_Store \\<sigma>\\<longrightarrow>  l'\\<in>L\\<or>l'\\<in>serialization_filter l'' \\<sigma> L \"\napply (rule_tac P= \"\\<lambda> S l'' \\<sigma> L. l\\<in>S \\<longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \n        \\<longrightarrow>Well_Formed_Store \\<sigma>\\<longrightarrow>  l'\\<in>L\\<or>l'\\<in>S\" in   serialization_filter_induct_1)\n   apply force\n  apply clarsimp\n(*2*)\n apply (case_tac \"l'=la\")\n  apply simp\n apply (case_tac \"l=la\")\n  apply clarsimp\n apply clarsimp\n apply (auto split: split_if_asm )\napply (clarsimp split: option.splits Storable.splits simp: Well_Formed_Store_def)\n(*2*)\n apply (drule_tac x=l in bspec,blast)\n apply (drule Referenced_locations_LocationI_ref)\n apply force\napply (simp split: Value.splits)\ndone\n(*\nlemma SE_contradict: \"La\\<subseteq>L\\<Longrightarrow> x \\<in> (case \\<sigma> xa of None \\<Rightarrow> {} | Some (Obj obj) \\<Rightarrow> {xa} \\<union> \\<Union>((\\<lambda>x. serialization_filter x \\<sigma> (insert l L \\<union> {xa})) ` \\<Union>(Referenced_locations_Value ` ran (fst obj)))\n             | Some (StoredVal null) \\<Rightarrow> {xa} | Some (StoredVal (ObjRef l')) \\<Rightarrow> {xa} \\<union> serialization_filter l' \\<sigma> (insert l L \\<union> {xa})) \\<Longrightarrow>\n       x \\<notin> (case \\<sigma> xa of None \\<Rightarrow> {} | Some (Obj obj) \\<Rightarrow> {xa} \\<union> \\<Union>((\\<lambda>x. serialization_filter x \\<sigma> (insert l La \\<union> {xa})) ` \\<Union>(Referenced_locations_Value ` ran (fst obj)))\n             | Some (StoredVal null) \\<Rightarrow> {xa} | Some (StoredVal (ObjRef l')) \\<Rightarrow> {xa} \\<union> serialization_filter l' \\<sigma> (insert l La \\<union> {xa})) \\<Longrightarrow>\n             False\"\napply (erule contrapos_np)\napply (simp split:   option.splits )\napply (simp split: Storable.splits )\napply (clarsimp)\napply (subgoal_tac \"xaa \\<in> Referenced_locations_Value xaaa\")\napply (drule_tac x=xaa in bspec)\n\n(* STRANGE isabelle behaviour\napply (clarsimp,rename_tac F C l'' f)\napply (drule_tac x=l'' in bspec)\n*)\napply force \napply (case_tac \"\\<sigma> l''\")\napply simp+\napply (case_tac a)\napply auto\n*)\nlemma Serialization_excluded_set: \"\\<forall> L . L\\<subseteq>L' \\<longrightarrow> serialization_filter l \\<sigma> L' \\<subseteq> serialization_filter l \\<sigma> L\"\napply (rule_tac P= \"\\<lambda> S l \\<sigma> L'. (\\<forall>L. L\\<subseteq>L' \\<longrightarrow> S \\<subseteq> serialization_filter l \\<sigma> L)\" in   serialization_filter_induct_1)\napply clarsimp\napply (clarsimp split: Value.splits)\napply blast\napply clarsimp\napply rule\napply blast\napply clarsimp\napply (drule_tac x=xa in bspec,blast) \napply (subgoal_tac \"\n    x \\<in> (case \\<sigma> xa of None \\<Rightarrow> {} | Some (Obj obj) \\<Rightarrow> {xa} \\<union> \\<Union>((\\<lambda>x. serialization_filter x \\<sigma> (insert l L \\<union> {xa})) ` \\<Union>(Referenced_locations_Value ` ran (fst obj)))\n             | Some (StoredVal null) \\<Rightarrow> {xa} | Some (StoredVal (ObjRef l')) \\<Rightarrow> {xa} \\<union> serialization_filter l' \\<sigma> (insert l L \\<union> {xa})) \\<Longrightarrow>\n       x \\<notin> (case \\<sigma> xa of None \\<Rightarrow> {} | Some (Obj obj) \\<Rightarrow> {xa} \\<union> \\<Union>((\\<lambda>x. serialization_filter x \\<sigma> (insert l La \\<union> {xa})) ` \\<Union>(Referenced_locations_Value ` ran (fst obj)))\n             | Some (StoredVal null) \\<Rightarrow> {xa} | Some (StoredVal (ObjRef l')) \\<Rightarrow> {xa} \\<union> serialization_filter l' \\<sigma> (insert l La \\<union> {xa})) \\<Longrightarrow>\n             False\")\napply blast\napply (thin_tac ?P)\napply (thin_tac ?P)\napply (thin_tac ?P)\napply (thin_tac ?P)\napply (thin_tac ?P)\napply blast\n\napply (case_tac \"\\<sigma> xa\")\napply simp\napply simp\napply (clarsimp split: Storable.splits )\n apply \n\napply\nlemma Serialization_WF: \"Well_Formed_Store \\<sigma> \\<Longrightarrow> Well_Formed_Store (serialize2 l \\<sigma>)\"\napply (unfold Well_Formed_Store_def)\napply (intro ballI)\napply (fold Well_Formed_Store_def)\napply (subgoal_tac \" la \\<in> dom \\<sigma>\")\n apply (case_tac \"\\<sigma> la\")\n  apply blast\n apply rule\n apply (unfold Referenced_locations_Location_def)\n(*2*)\n apply (case_tac  \"serialize2 l \\<sigma> la\")\n  apply blast\n apply (drule serialize_value)\n apply (subgoal_tac \"a=aa\")\n  apply clarify\n  apply (case_tac aa,case_tac prod)\n   apply (frule serialize_value)\n   apply  clarsimp\n   apply (subgoal_tac \"serialize2 l \\<sigma> la = Some (Obj (ab, ba))\")\n(*5*)\n    apply clarsimp\n    apply (simp add: ran_def Referenced_locations_Value_def,clarify)\n    apply (subgoal_tac \"la\\<in>serialization_filter l \\<sigma> {}\")\n     apply (drule serialization_filter_WF_1step_obj,simp, force split: Value.splits)\n       apply (simp split: Value.splits,simp)\n     apply (simp split: Value.splits)\n     apply (drule Well_Formed_StoreD_obj,simp,simp)\n     apply blast\n    apply (rule Map_restrict_Some,force)\n   apply simp\n  apply (frule serialize_value)\n  apply simp\n(*3*)\n  apply (subgoal_tac \"la\\<in>serialization_filter l \\<sigma> {}\")\n   apply (drule serialization_filter_WF_1step_ref,simp, simp split: Value.splits,simp,simp)\n   apply (simp split: Value.splits)\n   apply (drule Well_Formed_StoreD_ref,simp)\n   apply blast\n(*3*)\n  apply (rule Map_restrict_Some,force)\n apply force\napply (insert serialize_subset[of \\<sigma> l])\napply blast\ndone\n(*\ndefinition myfold where \"myfold L l' \\<sigma>  l refs F = (foldr (\\<lambda>l' S. S\\<union>(F l' \\<sigma> S)) \n                (sorted_list_of_set (refs)) (L\\<union>{l}))\"*)\n(*function (sequential) serialization_filter_2 :: \"Location \\<Rightarrow> Store \\<Rightarrow> Location set \\<Rightarrow> Location set\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n    \"\n    (serialization_filter_2 l \\<sigma> L) = (if l\\<in>L then {} else\n      (case \\<sigma>(l) of\n      Some (Obj obj) \\<Rightarrow> (fold (\\<lambda>l' S. (if (L\\<union>{l}\\<subseteq>S) then (S\\<union>(serialization_filter_2 l' \\<sigma> S)) else {})) \n                (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fst(obj))))) (L\\<union>{l}))  |\n      _ \\<Rightarrow> {}))\" \nby auto\ntermination serialization_filter_2\napply (relation \"measure (\\<lambda>(l,\\<sigma>,L). card (dom \\<sigma> - L))\") \napply auto\napply (subgoal_tac  \"card (dom \\<sigma> - xa) \\<le>card (dom \\<sigma> - insert l L)\")\napply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \napply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\napply (drule_tac x=l in Finite_Set.card.remove)+\napply (insert finite_map)\napply auto\napply (subgoal_tac \"dom \\<sigma> - xa \\<subseteq>(dom \\<sigma> - insert l L)\")\napply (subgoal_tac \"dom \\<sigma> - xa =(dom \\<sigma> - insert l L)\\<or>dom \\<sigma> - xa \\<subset>(dom \\<sigma> - insert l L)\")\napply (elim disjE)\napply force\napply (subgoal_tac \"finite ((dom \\<sigma>- insert l L))\")\napply (drule_tac A=\"dom \\<sigma>-xa\" in Finite_Set.psubset_card_mono)\napply auto\ndone*)\nfunction (sequential) serialization_filter_2 :: \"Location \\<Rightarrow> Store \\<Rightarrow> Location set \\<Rightarrow> Location set\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n    \"\n    (serialization_filter_2 l \\<sigma> L) = (if l\\<in>L then {} else\n      (case \\<sigma>(l) of\n      None => {} |\n      Some (Obj obj) \\<Rightarrow> (fold (\\<lambda>l' S.  (S\\<union>(serialization_filter_2 l' \\<sigma> (L\\<union>{l}\\<union>S))) ) \n                (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fst(obj))))) ({l}))  |\n      Some (StoredVal (ObjRef l')) \\<Rightarrow>{l}\\<union> (serialization_filter_2 l' \\<sigma> (L\\<union>{l}))|\n      _ \\<Rightarrow> {l}))\" \nby auto\ntermination\napply (relation \"measure (\\<lambda>(l,\\<sigma>,L). card (dom \\<sigma> - L))\") \n  apply auto\n apply (subgoal_tac  \"card (dom \\<sigma> -  insert l (L \\<union> xa)) \\<le>card (dom \\<sigma> - insert l L)\")\n  apply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \n   apply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\n(*5*)\n    apply (drule_tac x=l in Finite_Set.card.remove)+\n     apply (insert finite_map)\n     apply auto\n apply (subgoal_tac \"dom \\<sigma> - insert l (L \\<union> xa) \\<subseteq>(dom \\<sigma> - insert l L)\")\n  apply (subgoal_tac \"dom \\<sigma> - insert l (L \\<union> xa) =(dom \\<sigma> - insert l L)\\<or>dom \\<sigma> -insert l (L \\<union> xa) \\<subset>(dom \\<sigma> - insert l L)\")\n   apply (elim disjE)\n    apply force\n(*4*)\n   apply (subgoal_tac \"finite ((dom \\<sigma>- insert l L))\")\n    apply (drule_tac A=\"dom \\<sigma>-insert l (L \\<union> xa)\" in Finite_Set.psubset_card_mono)\n     apply auto\n(*1*)\napply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \n apply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\n  apply (drule_tac x=l in Finite_Set.card.remove)+\n   apply (insert finite_map)\n   apply auto\ndone\n\nlemma  finite_ran_obj_Referenced_locations_Value: \"V=Obj(f,C) \\<Longrightarrow>finite (\\<Union>l'\\<in>ran f. Referenced_locations_Value l')\"\napply (drule finite_ran_obj)\napply (auto simp: Referenced_locations_Value_def split: Value.splits)\ndone\n\nabbreviation serialize_RMI:: \"Location \\<Rightarrow> Store \\<Rightarrow> Store\" \nwhere\n\"serialize_RMI l \\<sigma> \\<equiv>  \\<sigma> |` serialization_filter_2 l \\<sigma> {}\" \n\nlemma SF_fold_to_Union[rule_format]: \"\\<forall>LS . ((distinct fieldlist)\\<longrightarrow>(\\<exists> F .\n (fold (\\<lambda>x S.  (S\\<union>(SF x \\<sigma> (L\\<union>{l}\\<union>S))) ) fieldlist (LS) \n      = LS\\<union> \\<Union>((\\<lambda> x . SF x \\<sigma> (L\\<union>{l}\\<union>F x)) `(set fieldlist)))))\"\napply (induct_tac fieldlist)\napply auto\napply (drule_tac x= \"(LS \\<union> SF a \\<sigma> (insert l (L \\<union> LS)))\" in spec,clarsimp)\napply (rule_tac x=\"F(a:= LS)\" in exI)\napply (auto split: split_if_asm)\ndone\n \nlemma SFI2SG1: \"\n   (\\<And>a b S. l \\<notin> L \\<Longrightarrow>\n                 \\<sigma> l = Some (Obj (a, b)) \\<Longrightarrow>\n                 \\<forall>x\\<in>\\<Union>(Referenced_locations_Value ` ran a).\n                    P (serialization_filter_2 x \\<sigma> (L \\<union> {l} \\<union> S x)) x \\<sigma> (L \\<union> {l} \\<union> S x) \\<Longrightarrow>\n                 P ({l} \\<union>\n                    \\<Union>((\\<lambda>x. serialization_filter_2 x \\<sigma> (L \\<union> {l} \\<union> S x)) `\n                       \\<Union>(Referenced_locations_Value ` ran a)))\n                  l \\<sigma> L) \\<Longrightarrow>\n       P {} l \\<sigma> L \\<Longrightarrow>\n      (\\<And>x2 prod x xa.\n           l \\<notin> L \\<Longrightarrow>\n           \\<sigma> l = Some x2 \\<Longrightarrow>\n           x2 = Obj prod \\<Longrightarrow>\n           x \\<in> set (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (fst prod)))) \\<Longrightarrow>\n           P (serialization_filter_2 x \\<sigma> (L \\<union> {l} \\<union> xa)) x \\<sigma> (L \\<union> {l} \\<union> xa)) \\<Longrightarrow>\n        \\<sigma> l = Some a \\<Longrightarrow> a = Obj prod \\<Longrightarrow> P (serialization_filter_2 l \\<sigma> L) l \\<sigma> L\"\napply (case_tac prod)\napply clarsimp\napply (subgoal_tac \n  \"set (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (a)))) = \n    \\<Union>(Referenced_locations_Value ` ran (a))\")\n apply clarsimp\n(*2*)\n apply (drule_tac x=a in meta_spec)\n apply (rotate_tac -1, drule_tac x=b in meta_spec)\n apply simp\n apply (subgoal_tac \"distinct (sorted_list_of_set\n                                              (\\<Union>(Referenced_locations_Value ` (ran (a)))))\")\n  apply (drule_tac SF=serialization_filter_2 and \\<sigma> = \\<sigma> and LS =\"{l}\" and l=l and L=L in SF_fold_to_Union,simp)\n  apply clarsimp\n(*3*)\n  apply (drule_tac x=F in meta_spec)\n  apply (drule_tac x=\"Obj (a,b)\" in meta_spec)\n  apply (drule_tac x=a in meta_spec)\n  apply (drule_tac x=b in meta_spec)\n  apply simp\n  apply blast\n(*3*)\n apply (subgoal_tac \"finite (\\<Union>l'\\<in>ran a. Referenced_locations_Value l')\")\n  apply force\n apply (rule finite_ran_obj_Referenced_locations_Value)\n apply force\napply (subgoal_tac \"finite (\\<Union>l'\\<in>ran (a). Referenced_locations_Value l')\")\n apply force\napply (rule finite_ran_obj_Referenced_locations_Value)\napply force\ndone\n\nlemma  SFI2SG2:\"(\\<And>x2 Value nat.\n           l \\<notin> L \\<Longrightarrow>\n           \\<sigma> l = Some x2 \\<Longrightarrow>\n           x2 = StoredVal Value \\<Longrightarrow> Value = ObjRef nat \\<Longrightarrow> \n           P (serialization_filter_2 nat \\<sigma> (L \\<union> {l})) nat \\<sigma> (L \\<union> {l})) \\<Longrightarrow>\n     (\\<And>l'. l \\<notin> L \\<Longrightarrow>\n              \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>\n              P (serialization_filter_2 l' \\<sigma> (L \\<union> {l})) l' \\<sigma> (L \\<union> {l}) \\<Longrightarrow>\n              P ({l} \\<union> serialization_filter_2 l' \\<sigma> (L \\<union> {l})) l \\<sigma> L) \\<Longrightarrow>\n  \\<sigma> l = Some a \\<Longrightarrow>  P {} l \\<sigma> L\\<Longrightarrow>a = StoredVal (ObjRef l') \\<Longrightarrow> P (serialization_filter_2 l \\<sigma> L) l \\<sigma> L\n  \"\napply clarsimp\ndone\n\nlemma serialization_filter_2_induct_1: \"   \n(\\<And>l \\<sigma> L. P {} l \\<sigma> L) \\<Longrightarrow> \n(\\<And>l \\<sigma> L V.  l\\<notin>L \\<Longrightarrow> \\<sigma> l = Some (StoredVal V) \\<Longrightarrow>isnotObjRef V \\<Longrightarrow>P {l} l \\<sigma> L) \\<Longrightarrow> \n(\\<And>l \\<sigma> L a b S.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<Longrightarrow> \n           (\\<forall> x\\<in>\\<Union>(Referenced_locations_Value`(ran a)). \n                          P (serialization_filter_2 x \\<sigma> (L\\<union>{l}\\<union>(S x))) x \\<sigma> (L\\<union>{l}\\<union>(S x))) \\<Longrightarrow>\n            P ({l}\\<union>(\\<Union> ((\\<lambda> x. serialization_filter_2 x \\<sigma> (L \\<union> {l}\\<union>S x))` \n                                             \\<Union>(Referenced_locations_Value`ran(a))))) l \\<sigma> L)  \\<Longrightarrow>\n(\\<And>l \\<sigma> L l'.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> \n           (P (serialization_filter_2 l' \\<sigma> (L\\<union>{l})) l' \\<sigma>  (L\\<union>{l}))\\<Longrightarrow>\n           (P ({l}\\<union>(serialization_filter_2 l' \\<sigma> (L\\<union>{l}))) l \\<sigma> L))         \\<Longrightarrow>   \n   P (serialization_filter_2 l' \\<sigma>' L') l' \\<sigma>' L'\"\napply (rule serialization_filter_2.induct)\napply (rotate_tac 1,drule_tac x=l in meta_spec)+\napply (rotate_tac -1,drule_tac x=\\<sigma> in meta_spec)+\napply (rotate_tac -1,drule_tac x=L in meta_spec)+\napply (case_tac \"\\<sigma> l\")\n apply simp\n(*1*)\napply (case_tac a)\n apply (erule SFI2SG1,simp,simp,simp,simp)\napply (case_tac Value)\n apply force\n\napply (erule SFI2SG2,simp+)\ndone\n\nlemma equivalence_filters_1:\n\"\\<forall> L'. ((serialization_filter l \\<sigma> L)  \\<subseteq> (serialization_filter_2 l \\<sigma> L') \\<union> L \\<union> L')\"\napply (rule_tac P= \n\"\\<lambda> S l'' \\<sigma> L. \\<forall> L'. (S  \\<subseteq> (serialization_filter_2 l'' \\<sigma> L') \\<union> L \\<union> L')\" in   serialization_filter_induct_1)\napply blast\napply (clarsimp split: Value.splits)\napply (clarsimp)\napply (case_tac \"l\\<in>L'\")\napply (clarsimp)\napply (case_tac aa)\napply simp\napply (drule_tac x=xb in bspec)\napply blast\napply clarsimp\napply (elim disjE,clarsimp)\nprimrec subst_Value :: \" Value \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Value\"\nwhere\n  \"subst_Value (ObjRef l) \\<psi> = ObjRef (\\<psi>(l))\" |\n  \"subst_Value (ActRef a) \\<psi> = ActRef a\" |\n  \"subst_Value (null) \\<psi> = null\" |\n  \"subst_Value (ASPInt i) \\<psi> = ASPInt i\" |\n  \"subst_Value (ASPBool b) \\<psi> = ASPBool b\"\n\ndefinition check_subst :: \"Store \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Store \\<Rightarrow> bool\"\nwhere\n  \"check_subst  \\<sigma> \\<psi> \\<sigma>' \\<equiv>\n    ( inj \\<psi> \\<and> dom \\<sigma>' =  \\<psi> ` (dom(\\<sigma>)) \n    \\<and> (\\<forall> obj l . (\\<sigma>(l) = Some (Obj obj)  \n      \\<longrightarrow> (\\<exists> obj'. (\\<sigma>'(\\<psi>(l)) = Some (Obj obj') \\<and> (\\<forall> x  v. (obj.[x]) = Some v \\<longrightarrow> (obj'.[x])=Some (subst_Value v \\<psi>)))))\n    \\<and>   (\\<forall> f l . (\\<sigma>(l) = Some (FutRef f) \\<longrightarrow> \\<sigma>'(\\<psi>(l)) =Some (FutRef f)))\n    \\<and>   (\\<forall> v l . (\\<sigma>(l) = Some (StoredVal v) \\<longrightarrow> \n      \\<sigma>'(\\<psi>(l)) = Some (StoredVal (subst_Value v \\<psi>))))))\"\n\ndefinition rename_value_store :: \" Store \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> bool\"\n where \"rename_value_store \\<sigma>\\<^sub>0 v \\<sigma> v' \\<sigma>'  \\<equiv> (\\<exists>\\<psi> . check_subst \\<sigma> \\<psi> \\<sigma>'\\<and>v'=subst_Value v \\<psi>)\\<and>\n                                            dom \\<sigma>\\<^sub>0 \\<inter> dom \\<sigma>' = {}\"\n\ndefinition serialize_and_rename_list :: \" Store \\<Rightarrow> Value list \\<Rightarrow> Store \\<Rightarrow> Value list \\<Rightarrow> Store \\<Rightarrow> bool\"\n where \"serialize_and_rename_list \\<sigma>\\<^sub>0 vl \\<sigma> vl' \\<sigma>'  \\<equiv> \n              length vl=length vl' \\<and>\n              (\\<exists>\\<psi> \\<sigma>''. (\\<forall> i<length vl. serialize  (vl!i) \\<sigma> \\<sigma>''\\<and>vl'!i=subst_Value (vl!i) \\<psi>) \\<and>check_subst \\<sigma>'' \\<psi> \\<sigma>') \\<and>\n              dom \\<sigma>\\<^sub>0 \\<inter> dom \\<sigma>' = {}\"\n\n(*locale Generic_Functions = *)\n\n(*consts \n  Bind:: \"Program\\<Rightarrow>Location\\<Rightarrow>ClassName\\<Rightarrow>MethodName\\<Rightarrow>Value list\\<Rightarrow> EContext \"*)\n(* consts\n  params:: \"Program\\<Rightarrow>ClassName \\<Rightarrow>VarName list\"\n *)\n(*consts fetch:: \"Class list\\<Rightarrow>ClassName\\<Rightarrow>MethodName\\<Rightarrow>\n            ((VarName list) *(VarName list) * (Statement list)) option\" *)\n\n            subsection {* serialization and location renaming *}\n\ninductive serialize :: \"Value \\<Rightarrow> Store \\<Rightarrow> Store \\<Rightarrow> bool\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (Obj obj) \\<and> (\\<forall> v\\<in> ran(fst(obj)). \\<exists>\\<sigma>''. (serialize v \\<sigma> \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>'))\n     \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (FutRef f)  \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (StoredVal v)  \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n     \"(serialize (ActRef f) \\<sigma> \\<sigma>')\" |\n     \"serialize (null) \\<sigma> \\<sigma>' \" | \n     \"serialize (ASPInt n) \\<sigma> \\<sigma>'\" | \n     \"serialize (ASPBool b) \\<sigma> \\<sigma>'\"\n\n definition Referenced_locations_Value:: \"Value \\<Rightarrow> Location set\"\nwhere  \"Referenced_locations_Value v \\<equiv> (case v of ObjRef l \\<Rightarrow>{l} | _ \\<Rightarrow> {})\"\n\naxiomatization where finite_map: \"finite (dom (\\<sigma>::Store))\"\nfunction (sequential) serialization_filter :: \"Location \\<Rightarrow> Store \\<Rightarrow> Location set \\<Rightarrow> Location set\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n    \"\n    (serialization_filter l \\<sigma> L) = (if l\\<in>L then {} else\n      (case \\<sigma>(l) of\n      Some (Obj obj) \\<Rightarrow> listunionMap (\\<lambda>x.(serialization_filter x \\<sigma> (L\\<union>{l}))) \n                (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fst(obj))))) |\n      _ \\<Rightarrow> {}))\" \nby auto\ntermination \napply (relation \"measure (\\<lambda>(l,\\<sigma>,L). card (dom \\<sigma> - L))\") \napply auto\napply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \napply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\napply (drule_tac x=l in Finite_Set.card.remove)+\napply (insert finite_map)\napply auto\ndone\n\n\nlemma \"serialization_filter l \\<sigma> L \\<subseteq> dom \\<sigma>\"\napply (induct l \\<sigma> L rule: serialization_filter.induct)\napply (auto split: option.splits Storable.splits simp: listunionMap_def)\napply (drule AuxiliaryFunctions.foldr_Un_mapD)\napply (auto split: split_if_asm option.splits Storable.splits)\napply (drule_tac x=\"(Obj(a,b))\" in meta_spec,drule_tac x=a in meta_spec,drule_tac x=b in meta_spec,\n  drule_tac x=y in meta_spec,simp)\napply (case_tac ya, case_tac prod)\napply (drule_tac x=ya in spec, clarsimp)\napply (erule disjE,force)\napply clarsimp\napply (drule subsetD,simp)\napply auto\ndone     \n     \nprimrec subst_Value :: \" Value \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Value\"\nwhere\n  \"subst_Value (ObjRef l) \\<psi> = ObjRef (\\<psi>(l))\" |\n  \"subst_Value (ActRef a) \\<psi> = ActRef a\" |\n  \"subst_Value (null) \\<psi> = null\" |\n  \"subst_Value (ASPInt i) \\<psi> = ASPInt i\" |\n  \"subst_Value (ASPBool b) \\<psi> = ASPBool b\"\n\ndefinition check_subst :: \"Store \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Store \\<Rightarrow> bool\"\nwhere\n  \"check_subst  \\<sigma> \\<psi> \\<sigma>' \\<equiv>\n    ( inj \\<psi> \\<and> dom \\<sigma>' =  \\<psi> ` (dom(\\<sigma>)) \n    \\<and> (\\<forall> obj l . (\\<sigma>(l) = Some (Obj obj)  \n      \\<longrightarrow> (\\<exists> obj'. (\\<sigma>'(\\<psi>(l)) = Some (Obj obj') \\<and> (\\<forall> x  v. (obj.[x]) = Some v \\<longrightarrow> (obj'.[x])=Some (subst_Value v \\<psi>)))))\n    \\<and>   (\\<forall> f l . (\\<sigma>(l) = Some (FutRef f) \\<longrightarrow> \\<sigma>'(\\<psi>(l)) =Some (FutRef f)))\n    \\<and>   (\\<forall> v l . (\\<sigma>(l) = Some (StoredVal v) \\<longrightarrow> \n      \\<sigma>'(\\<psi>(l)) = Some (StoredVal (subst_Value v \\<psi>))))))\"\n\ndefinition rename_value_store :: \" Store \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> bool\"\n where \"rename_value_store \\<sigma>\\<^sub>0 v \\<sigma> v' \\<sigma>'  \\<equiv> (\\<exists>\\<psi> . check_subst \\<sigma> \\<psi> \\<sigma>'\\<and>v'=subst_Value v \\<psi>)\\<and>\n                                            dom \\<sigma>\\<^sub>0 \\<inter> dom \\<sigma>' = {}\"\n\ndefinition serialize_and_rename_list :: \" Store \\<Rightarrow> Value list \\<Rightarrow> Store \\<Rightarrow> Value list \\<Rightarrow> Store \\<Rightarrow> bool\"\n where \"serialize_and_rename_list \\<sigma>\\<^sub>0 vl \\<sigma> vl' \\<sigma>'  \\<equiv> \n              length vl=length vl' \\<and>\n              (\\<exists>\\<psi> \\<sigma>''. (\\<forall> i<length vl. serialize  (vl!i) \\<sigma> \\<sigma>''\\<and>vl'!i=subst_Value (vl!i) \\<psi>) \\<and>check_subst \\<sigma>'' \\<psi> \\<sigma>') \\<and>\n              dom \\<sigma>\\<^sub>0 \\<inter> dom \\<sigma>' = {}\"\n\n(*locale Generic_Functions = *)\n\n(*consts \n  Bind:: \"Program\\<Rightarrow>Location\\<Rightarrow>ClassName\\<Rightarrow>MethodName\\<Rightarrow>Value list\\<Rightarrow> EContext \"*)\n(* consts\n  params:: \"Program\\<Rightarrow>ClassName \\<Rightarrow>VarName list\"\n *)\n(*consts fetch:: \"Class list\\<Rightarrow>ClassName\\<Rightarrow>MethodName\\<Rightarrow>\n            ((VarName list) *(VarName list) * (Statement list)) option\" *)\n\n", "meta": {"author": "lhenrio", "repo": "MultiASP-Isabelle", "sha": "2cc5a5ef4cb6499311e429d98e18991fcb9f88d0", "save_path": "github-repos/isabelle/lhenrio-MultiASP-Isabelle", "path": "github-repos/isabelle/lhenrio-MultiASP-Isabelle/MultiASP-Isabelle-2cc5a5ef4cb6499311e429d98e18991fcb9f88d0/Serialisation/Serialization_typedef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.689305616785446, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.3258233753961364}}
{"text": "(*<*)\ntheory Restrict_Frees\nimports\n  Restrict_Bounds\n  \"HOL-Library.Product_Lexorder\"\n  \"HOL-Library.List_Lexorder\"\n  \"HOL-Library.Multiset_Order\"\nbegin\n\nhide_const (open) SetIndex.index\n(*>*)\n\nsection \\<open>Restricting Free Variables\\<close>\n\ndefinition fixfree :: \"(('a, 'b) fmla \\<times> nat rel) set \\<Rightarrow> (('a, 'b) fmla \\<times> nat rel) set\" where\n  \"fixfree \\<Q>fin = {(Qfix, Qeq) \\<in> \\<Q>fin. nongens Qfix \\<noteq> {}}\"\n\ndefinition \"disjointvars Q Qeq = (\\<Union>V \\<in> classes Qeq. if V \\<inter> fv Q = {} then V else {})\"\n\nfun Conjs where\n  \"Conjs Q [] = Q\"\n| \"Conjs Q ((x, y) # xys) = Conjs (Conj Q (x \\<approx> y)) xys\"\n\nfunction (sequential) Conjs_disjoint where\n  \"Conjs_disjoint Q xys = (case find (\\<lambda>(x,y). {x, y} \\<inter> fv Q \\<noteq> {}) xys of\n     None \\<Rightarrow> Conjs Q xys\n   | Some (x, y) \\<Rightarrow> Conjs_disjoint (Conj Q (x \\<approx> y)) (remove1 (x, y) xys))\"\n  by pat_completeness auto\ntermination\n  by (relation \"measure (\\<lambda>(Q, xys). length xys)\")\n    (auto split: if_splits simp: length_remove1 neq_Nil_conv dest!: find_SomeD dest: length_pos_if_in_set)\n\ndeclare Conjs_disjoint.simps[simp del]\n\ndefinition CONJ where\n  \"CONJ = (\\<lambda>(Q, Qeq). Conjs Q (sorted_list_of_set Qeq))\"\n\ndefinition CONJ_disjoint where\n  \"CONJ_disjoint = (\\<lambda>(Q, Qeq). Conjs_disjoint Q (sorted_list_of_set Qeq))\"\n\ndefinition inf where\n  \"inf \\<Q>fin Q = {(Q', Qeq) \\<in> \\<Q>fin. disjointvars Q' Qeq \\<noteq> {} \\<or> fv Q' \\<union> Field Qeq \\<noteq> fv Q}\"\n\ndefinition FV where\n  \"FV Q Qfin Qinf \\<equiv> (fv Qfin = fv Q \\<or> Qfin = Bool False) \\<and> fv Qinf = {}\"\n\ndefinition EVAL where\n  \"EVAL Q Qfin Qinf \\<equiv> (\\<forall>I. finite (adom I) \\<longrightarrow> (if eval Qinf I = {} then\n     eval Qfin I = eval Q I else infinite (eval Q I)))\"\n\ndefinition EVAL' where\n  \"EVAL' Q Qfin Qinf \\<equiv> (\\<forall>I. finite (adom I) \\<longrightarrow> (if eval Qinf I = {} then\n     eval_on (fv Q) Qfin I = eval Q I else infinite (eval Q I)))\"\n\ndefinition (in simplification) split_spec :: \"('a :: {infinite, linorder}, 'b :: linorder) fmla \\<Rightarrow> (('a, 'b) fmla \\<times> ('a, 'b) fmla) nres\" where\n  \"split_spec Q = SPEC (\\<lambda>(Qfin, Qinf). sr Qfin \\<and> sr Qinf \\<and> FV Q Qfin Qinf \\<and> EVAL Q Qfin Qinf \\<and>\n     simplified Qfin \\<and> simplified Qinf)\"\n\ndefinition (in simplification) \"assemble = (\\<lambda>(\\<Q>fin, \\<Q>inf). (simp (DISJ (CONJ_disjoint ` \\<Q>fin)), simp (DISJ (close ` \\<Q>inf))))\"\n\nfun leftfresh where\n  \"leftfresh Q [] = True\"\n| \"leftfresh Q ((x, y) # xys) = (x \\<notin> fv Q \\<and> leftfresh (Conj Q (x \\<approx> y)) xys)\"\n\ndefinition (in simplification) \"wf_state Q P =\n   (\\<lambda>(\\<Q>fin, \\<Q>inf). finite \\<Q>fin \\<and> finite \\<Q>inf \\<and>\n     (\\<forall>(Qfix, Qeq) \\<in> \\<Q>fin. P Qfix \\<and> simplified Qfix \\<and> (\\<exists>xs. leftfresh Qfix xs \\<and> distinct xs \\<and> set xs = Qeq) \\<and> fv Qfix \\<union> Field Qeq \\<subseteq> fv Q \\<and> irrefl Qeq))\"\n\ndefinition (in simplification) \"split_INV1 Q = (\\<lambda>\\<Q>pair. wf_state Q rrb \\<Q>pair \\<and> (let (Qfin, Qinf) = assemble \\<Q>pair in EVAL' Q Qfin Qinf))\"\ndefinition (in simplification) \"split_INV2 Q = (\\<lambda>\\<Q>pair. wf_state Q sr \\<Q>pair \\<and> (let (Qfin, Qinf) = assemble \\<Q>pair in EVAL' Q Qfin Qinf))\"\n\ndefinition (in simplification) split :: \"('a :: {infinite, linorder}, 'b :: linorder) fmla \\<Rightarrow> (('a, 'b) fmla \\<times> ('a, 'b) fmla) nres\" where\n  \"split Q = do {\n     Q' \\<leftarrow> rb Q;\n     \\<Q>pair \\<leftarrow> WHILE\\<^sub>T\\<^bsup>split_INV1 Q\\<^esup>\n        (\\<lambda>(\\<Q>fin, _). fixfree \\<Q>fin \\<noteq> {}) (\\<lambda>(\\<Q>fin, \\<Q>inf). do {\n          (Qfix, Qeq) \\<leftarrow> RES (fixfree \\<Q>fin);\n          x \\<leftarrow> RES (nongens Qfix);\n          G \\<leftarrow> SPEC (cov x Qfix);\n          let \\<Q>fin = \\<Q>fin - {(Qfix, Qeq)} \\<union>\n            {(simp (Conj Qfix (DISJ (qps G))), Qeq)} \\<union>\n            (\\<Union>y \\<in> eqs x G. {(cp (Qfix[x \\<^bold>\\<rightarrow> y]), Qeq \\<union> {(x,y)})});\n          let \\<Q>inf = \\<Q>inf \\<union> {cp (Qfix \\<^bold>\\<bottom> x)};\n          RETURN (\\<Q>fin, \\<Q>inf)})\n        ({(Q', {})}, {});\n     \\<Q>pair \\<leftarrow> WHILE\\<^sub>T\\<^bsup>split_INV2 Q\\<^esup>\n        (\\<lambda>(\\<Q>fin, _). inf \\<Q>fin Q \\<noteq> {}) (\\<lambda>(\\<Q>fin, \\<Q>inf). do {\n          Qpair \\<leftarrow> RES (inf \\<Q>fin Q);\n          let \\<Q>fin = \\<Q>fin - {Qpair};\n          let \\<Q>inf = \\<Q>inf \\<union> {CONJ Qpair};\n          RETURN (\\<Q>fin, \\<Q>inf)})\n        \\<Q>pair;\n     let (Qfin, Qinf) = assemble \\<Q>pair;\n     Qinf \\<leftarrow> rb Qinf;\n     RETURN (Qfin, Qinf)}\"\n\nlemma finite_fixfree[simp]: \"finite \\<Q> \\<Longrightarrow> finite (fixfree \\<Q>)\"\n  unfolding fixfree_def by (auto elim!: finite_subset[rotated])\n\nlemma (in simplification) split_step_in_mult:\n  assumes \"(Qfin, Qeq) \\<in> \\<Q>fin\" \"finite \\<Q>fin\" \"x \\<in> nongens Qfin\" \"cov x Qfin G\" \"fv Qfin \\<subseteq> F\"\n  shows \"((nongens \\<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\\<Q>fin - {(Qfin, Qeq)} \\<union> (\\<lambda>y. (cp (Qfin[x \\<^bold>\\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)),\n          (nongens \\<circ> fst) `# mset_set \\<Q>fin) \\<in> mult {(X, Y). X \\<subset> Y \\<and> Y \\<subseteq> F}\"\n    (is \"(?f (insert ?Q (?A \\<union> ?B)), ?C) \\<in> mult ?R\")\nproof (subst preorder.mult\\<^sub>D\\<^sub>M[where less_eq = \"(in_rel ?R)\\<^sup>=\\<^sup>=\"])\n  define X where \"X = {(Qfin, Qeq)}\"\n  define Y where \"Y = insert ?Q ?B - (?A \\<inter> insert ?Q ?B)\"\n  have \"?f X \\<noteq> {#}\"\n    unfolding X_def by auto\n  moreover from assms(1,2) have \"?f X \\<subseteq># ?C\"\n    unfolding X_def by (auto intro!: image_eqI[where x = \"(Qfin, Qeq)\"])\n  moreover from assms(1,2,4) have XY:\n    \"insert ?Q (?A \\<union> ?B) = \\<Q>fin - X \\<union> Y\" \"X \\<subseteq> \\<Q>fin\" \"(\\<Q>fin - X) \\<inter> Y = {}\" \"finite X\" \"finite Y\"\n    unfolding X_def Y_def by auto\n  with assms(2) have \"?f (insert ?Q (?A \\<union> ?B)) = ?C - ?f X + ?f Y\"\n    by (force simp: mset_set_Union mset_set_Diff multiset.map_comp o_def\n        dest: subset_imp_msubset_mset_set elim: subset_mset.trans\n        intro!: subset_imp_msubset_mset_set image_mset_subseteq_mono subset_mset.diff_add_assoc2\n        trans[OF image_mset_Diff])\n  moreover\n  { fix A\n    assume \"A \\<in> Y\"\n    then have \"A \\<in> insert ?Q ?B\"\n      unfolding Y_def by blast\n    with assms(3,4) have \"nongens (fst A) \\<subseteq> nongens Qfin - {x}\"\n      using Gen_cp_subst[of _ Qfin x] Gen_simp[OF cov_Gen_qps[OF assms(4)]]\n        gen_Gen_simp[OF gen.intros(7)[OF disjI1], of _ Qfin _ \"DISJ (qps G)\"]\n      by (fastforce simp: nongens_def fv_subst simp del: cp.simps\n          intro!: gen.intros(7) dest!: fv_cp[THEN set_mp] fv_simp[THEN set_mp] fv_DISJ[THEN set_mp, rotated 1]\n          elim: cov_fv[OF assms(4) _ qps_in, THEN conjunct2, THEN set_mp]\n          cov_fv[OF assms(4) _ eqs_in, THEN conjunct2, THEN set_mp])\n    with assms(3) have \"nongens (fst A) \\<subset> nongens Qfin\"\n      by auto\n    with assms(5) have \"\\<exists>B \\<in> X. nongens (fst A) \\<subset> nongens (fst B) \\<and> nongens (fst B) \\<subseteq> F\"\n      by (auto simp: X_def nongens_def)\n  }\n  with XY have \"\\<And>A. A \\<in># ?f Y \\<Longrightarrow> \\<exists>B. B \\<in># ?f X \\<and> A \\<subset> B \\<and> B \\<subseteq> F\"\n    by auto\n  ultimately\n  show \"\\<exists>X Y. X \\<noteq> {#} \\<and> X \\<subseteq># ?C \\<and> ?f (insert ?Q (?A \\<union> ?B)) = ?C - X + Y \\<and> (\\<forall>k. k \\<in># Y \\<longrightarrow> (\\<exists>a. a \\<in># X \\<and> k \\<subset> a \\<and> a \\<subseteq> F))\"\n    by blast\nqed (unfold_locales, auto)\n\nlemma EVAL_cong:\n  \"Qinf \\<triangleq> Qinf' \\<Longrightarrow> fv Qinf = fv Qinf' \\<Longrightarrow> EVAL Q Qfin Qinf = EVAL Q Qfin Qinf'\"\n  using equiv_eval_eqI[of _ Qinf Qinf']\n  by (auto simp: EVAL_def)\n\nlemma EVAL'_cong:\n  \"Qinf \\<triangleq> Qinf' \\<Longrightarrow> fv Qinf = fv Qinf' \\<Longrightarrow> EVAL' Q Qfin Qinf = EVAL' Q Qfin Qinf'\"\n  using equiv_eval_eqI[of _ Qinf Qinf']\n  by (auto simp: EVAL'_def)\n\nlemma fv_Conjs[simp]: \"fv (Conjs Q xys) = fv Q \\<union> Field (set xys)\"\n  by (induct Q xys rule: Conjs.induct) auto\n\nlemma fv_Conjs_disjoint[simp]: \"distinct xys \\<Longrightarrow> fv (Conjs_disjoint Q xys) = fv Q \\<union> Field (set xys)\"\nproof (induct Q xys rule: Conjs_disjoint.induct)\n  case (1 Q xys)\n  then show ?case\n    by (subst Conjs_disjoint.simps)\n      (auto split: option.splits simp: Field_def subset_eq dest: find_SomeD(2))\nqed\n\nlemma fv_CONJ[simp]: \"finite Qeq \\<Longrightarrow> fv (CONJ (Q, Qeq)) = fv Q \\<union> Field Qeq\"\n  unfolding CONJ_def by (auto dest!: fv_cp[THEN set_mp])\n\nlemma fv_CONJ_disjoint[simp]: \"finite Qeq \\<Longrightarrow> fv (CONJ_disjoint (Q, Qeq)) = fv Q \\<union> Field Qeq\"\n  unfolding CONJ_disjoint_def by auto\n\nlemma rrb_Conjs: \"rrb Q \\<Longrightarrow> rrb (Conjs Q xys)\"\n  by (induct Q xys rule: Conjs.induct) auto\n\nlemma CONJ_empty[simp]: \"CONJ (Q, {}) = Q\"\n  by (auto simp: CONJ_def)\n\nlemma CONJ_disjoint_empty[simp]: \"CONJ_disjoint (Q, {}) = Q\"\n  by (auto simp: CONJ_disjoint_def Conjs_disjoint.simps)\n\nlemma Conjs_eq_False_iff[simp]: \"irrefl (set xys) \\<Longrightarrow> Conjs Q xys = Bool False \\<longleftrightarrow> Q = Bool False \\<and> xys = []\"\n  by (induct Q xys rule: Conjs.induct) (auto simp: Let_def is_Bool_def irrefl_def)\n\nlemma CONJ_eq_False_iff[simp]: \"finite Qeq \\<Longrightarrow> irrefl Qeq \\<Longrightarrow> CONJ (Q, Qeq) = Bool False \\<longleftrightarrow> Q = Bool False \\<and> Qeq = {}\"\n  by (auto simp: CONJ_def)\n\nlemma Conjs_disjoint_eq_False_iff[simp]: \"irrefl (set xys) \\<Longrightarrow> Conjs_disjoint Q xys = Bool False \\<longleftrightarrow> Q = Bool False \\<and> xys = []\"\nproof (induct Q xys rule: Conjs_disjoint.induct)\n  case (1 Q xys)\n  then show ?case\n    by (subst Conjs_disjoint.simps)\n      (auto simp: Let_def is_Bool_def irrefl_def split: option.splits)\nqed\n\nlemma CONJ_disjoint_eq_False_iff[simp]: \"finite Qeq \\<Longrightarrow> irrefl Qeq \\<Longrightarrow> CONJ_disjoint (Q, Qeq) = Bool False \\<longleftrightarrow> Q = Bool False \\<and> Qeq = {}\"\n  by (auto simp: CONJ_disjoint_def)\n\nlemma sr_Conjs_disjoint:\n  \"distinct xys \\<Longrightarrow> (\\<forall>V\\<in>classes (set xys). V \\<inter> fv Q \\<noteq> {}) \\<Longrightarrow> sr Q \\<Longrightarrow> sr (Conjs_disjoint Q xys)\"\nproof (induct Q xys rule: Conjs_disjoint.induct)\n  case (1 Q xys)\n  show ?case\n  proof (cases \"find (\\<lambda>(x, y). {x, y} \\<inter> fv Q \\<noteq> {}) xys\")\n    case None\n    with 1(2-) show ?thesis\n      using classes_intersect_find_not_None[of xys \"fv Q\"]\n      by (cases xys) (simp_all add: Conjs_disjoint.simps)\n  next\n    case (Some xy)\n    then obtain x y where xy: \"xy = (x, y)\" and xy_in: \"(x, y) \\<in> set xys\"\n      by (cases xy) (auto dest!: find_SomeD)\n    with Some 1(4) have \"sr (Conj Q (x \\<approx> y))\"\n      by (auto dest: find_SomeD simp: sr_Conj_eq)\n    moreover from 1(2,3) have \"\\<forall>V\\<in>classes (set (remove1 (x, y) xys)). V \\<inter> fv (Conj Q (x \\<approx> y)) \\<noteq> {}\"\n      by (subst (asm) insert_remove_id[OF xy_in], unfold classes_insert)\n        (auto simp: class_None_eq class_Some_eq split: option.splits if_splits)\n    ultimately show ?thesis\n      using 1(2-) Some xy 1(1)[OF Some xy[symmetric]]\n      by (simp add: Conjs_disjoint.simps)\n  qed\nqed\n\nlemma sr_CONJ_disjoint:\n  \"inf \\<Q>fin Q = {} \\<Longrightarrow> (Qfin, Qeq) \\<in> \\<Q>fin \\<Longrightarrow> finite Qeq \\<Longrightarrow> sr Qfin \\<Longrightarrow> sr (CONJ_disjoint (Qfin, Qeq))\"\n  unfolding inf_def disjointvars_def CONJ_disjoint_def prod.case\n  by (drule arg_cong[of _ _ \"\\<lambda>A. (Qfin, Qeq) \\<in> A\"], intro sr_cp sr_Conjs_disjoint)\n    (auto simp only: mem_Collect_eq prod.case simp_thms distinct_sorted_list_of_set\n       set_sorted_list_of_set SUP_bot_conv classes_nonempty split: if_splits)\n\nlemma equiv_Conjs_cong: \"Q \\<triangleq> Q' \\<Longrightarrow> Conjs Q xys \\<triangleq> Conjs Q' xys\"\n  by (induct Q xys arbitrary: Q' rule: Conjs.induct) auto\n\nlemma Conjs_pull_out: \"Conjs Q (xys @ (x, y) # xys') \\<triangleq> Conjs (Conj Q (x \\<approx> y)) (xys @ xys')\"\n  by (induct Q xys rule: Conjs.induct)\n    (auto elim!: equiv_trans intro!: equiv_Conjs_cong intro: equiv_def[THEN iffD2])\n\nlemma Conjs_reorder: \"distinct xys \\<Longrightarrow> distinct xys' \\<Longrightarrow> set xys = set xys' \\<Longrightarrow> Conjs Q xys \\<triangleq> Conjs Q xys'\"\nproof (induct Q xys arbitrary: xys' rule: Conjs.induct)\n  case (2 Q x y xys)\n  from 2(4) obtain i where i: \"i < length xys'\" \"xys' ! i = (x, y)\"\n    by (auto simp: set_eq_iff in_set_conv_nth)\n  with 2(2-4) have *: \"set xys = set (take i xys') \\<union> set (drop (Suc i) xys')\"\n    by (subst (asm) (1 2) id_take_nth_drop[of i xys'])\n      (auto simp: set_eq_iff dest: in_set_takeD in_set_dropD)\n  from i 2(2,3) show ?case\n    by (subst id_take_nth_drop[OF i(1)], subst (asm) (3) id_take_nth_drop[OF i(1)])\n      (auto simp: * intro!: equiv_trans[OF _ Conjs_pull_out[THEN equiv_sym]] 2(1))\nqed simp\n\nlemma ex_Conjs_disjoint_eq_Conjs:\n  \"distinct xys \\<Longrightarrow> \\<exists>xys'. distinct xys' \\<and> set xys = set xys' \\<and> Conjs_disjoint Q xys = Conjs Q xys'\"\nproof (induct Q xys rule: Conjs_disjoint.induct)\n  case (1 Q xys)\n  show ?case\n  proof (cases \"find (\\<lambda>(x, y). {x, y} \\<inter> fv Q \\<noteq> {}) xys\")\n    case None\n    with 1(2) show ?thesis\n      by (subst Conjs_disjoint.simps) (auto intro!: exI[of _ xys])\n  next\n    case (Some xy)\n    with 1(1)[of xy \"fst xy\" \"snd xy\"] 1(2)\n    obtain xys' where \"distinct xys'\"\n      \"set xys - {xy} = set xys'\"\n      \"Conjs_disjoint (Conj Q (fst xy \\<approx> snd xy)) (remove1 xy xys) =\n       Conjs (Conj Q (fst xy \\<approx> snd xy)) xys'\"\n      by auto\n    with Some show ?thesis\n      by (subst Conjs_disjoint.simps, intro exI[of _ \"xy # xys'\"])\n        (auto simp: set_eq_iff dest: find_SomeD)\n  qed\nqed\n\nlemma Conjs_disjoint_equiv_Conjs:\n  assumes \"distinct xys\"\n  shows \"Conjs_disjoint Q xys \\<triangleq> Conjs Q xys\"\nproof -\n  from assms obtain xys' where xys': \"distinct xys'\" \"set xys = set xys'\" and \"Conjs_disjoint Q xys = Conjs Q xys'\"\n    using ex_Conjs_disjoint_eq_Conjs by blast\n  note this(3)\n  also have \"\\<dots> \\<triangleq> Conjs Q xys\"\n    by (intro Conjs_reorder xys' sym assms)\n  finally show ?thesis\n    by blast\nqed\n\nlemma infinite_eval_Conjs: \"infinite (eval Q I) \\<Longrightarrow> leftfresh Q xys \\<Longrightarrow> infinite (eval (Conjs Q xys) I)\"\nproof (induct Q xys rule: Conjs.induct)\n  case (2 Q x y xys)\n  then show ?case\n    unfolding Conjs.simps\n    by (intro 2(1) infinite_eval_Conj) auto\nqed simp\n\nlemma leftfresh_fv_subset: \"leftfresh Q xys \\<Longrightarrow> fv Q' \\<subseteq> fv Q \\<Longrightarrow> leftfresh Q' xys\"\n  by (induct Q xys arbitrary: Q' rule: leftfresh.induct) (auto simp: subset_eq)\n\nlemma fun_upds_map: \"(\\<forall>x. x \\<notin> set ys \\<longrightarrow> \\<sigma> x = \\<tau> x) \\<Longrightarrow> \\<sigma>[ys :=\\<^sup>* map \\<tau> ys] = \\<tau>\"\n  by (induct ys arbitrary: \\<sigma>) auto\n\nlemma map_fun_upds: \"length xs = length ys \\<Longrightarrow> distinct xs \\<Longrightarrow> map (\\<sigma>[xs :=\\<^sup>* ys]) xs = ys\"\n  by (induct xs ys arbitrary: \\<sigma> rule: list_induct2) auto\n\nlemma zip_map: \"zip xs (map f xs) = map (\\<lambda>x. (x, f x)) xs\"\n  by (induct xs) auto\n\nlemma filter_sorted_list_of_set:\n  \"finite B \\<Longrightarrow> A \\<subseteq> B \\<Longrightarrow> filter (\\<lambda>x. x \\<in> A) (sorted_list_of_set B) = sorted_list_of_set A\"\nproof (induct B arbitrary: A rule: finite_induct)\n  case (insert x B)\n  then have \"finite A\" by (auto simp: finite_subset)\n  moreover\n  from insert(1,2) have \"filter (\\<lambda>y. y \\<in> A - {x}) (sorted_list_of_set B) =\n             filter (\\<lambda>x. x \\<in> A) (sorted_list_of_set B)\"\n    by (intro filter_cong) auto\n  ultimately  show ?case\n    using insert(1,2,4) insert(3)[of \"A - {x}\"] sorted_list_of_set_insert_remove[of A x]\n    by (cases \"x \\<in> A\") (auto  simp: filter_insort filter_insort_triv subset_insert_iff insert_absorb)\nqed simp\n\nlemma infinite_eval_eval_on[rotated 2]:\n  assumes \"fv Q \\<subseteq> X\" \"finite X\"\n  shows \"infinite (eval Q I) \\<Longrightarrow> infinite (eval_on X Q I)\"\nproof (erule infinite_surj[of _ \"\\<lambda>xs. map snd (filter (\\<lambda>(x,_). x \\<in> fv Q) (zip (sorted_list_of_set X) xs))\"],\n  unfold eval_deep_def Let_def, safe)\n  fix xs \\<sigma>\n  assume len: \"length (sorted_list_of_set (fv Q)) = length xs\" and\n    \"sat Q I (\\<sigma>[sorted_list_of_set (fv Q) :=\\<^sup>* xs])\" (is \"sat Q I ?\\<tau>\")\n  moreover from assms len have \"\\<sigma>[sorted_list_of_set X :=\\<^sup>* map ?\\<tau> (sorted_list_of_set X)] = ?\\<tau>\"\n    by (intro fun_upds_map) force\n  ultimately show \"xs \\<in> (\\<lambda>xs. map snd (filter (\\<lambda>(x, _). x \\<in> fv Q) (zip (sorted_list_of_set X) xs))) `\n    eval_on X Q I\" using assms\n    by (auto simp: eval_on_def image_iff zip_map filter_map o_def filter_sorted_list_of_set map_fun_upds\n      intro!: exI[of _ \"map (\\<sigma>[sorted_list_of_set (fv Q) :=\\<^sup>* xs]) (sorted_list_of_set X)\"] exI[of _ \\<sigma>])\nqed\n\nlemma infinite_eval_CONJ_disjoint:\n  assumes \"infinite (eval Q I)\" \"finite (adom I)\" \"fv Q \\<subseteq> X\" \"Field Qeq \\<subseteq> X\" \"finite X\" \"\\<exists>xys. distinct xys \\<and> leftfresh Q xys \\<and> set xys = Qeq\"\n  shows \"infinite (eval_on X (CONJ_disjoint (Q, Qeq)) I)\"\nproof -\n  from assms(6) obtain xys where \"distinct xys\" \"leftfresh Q xys\" \"set xys = Qeq\"\n    by blast\n  with assms(1-5) show ?thesis\n    using infinite_eval_eval_on[OF infinite_eval_Conjs[of Q I xys], of X] equiv_eval_on_eqI[of I  \"Conjs_disjoint Q (sorted_list_of_set Qeq)\" \"Conjs Q xys\" X]\n      equiv_trans[OF Conjs_disjoint_equiv_Conjs[of \"sorted_list_of_set Qeq\" Q] Conjs_reorder[of _ xys]]\n      fv_Conjs[of Q xys]\n    by (force simp: CONJ_disjoint_def subset_eq equiv_eval_on_eqI[OF _ equiv_cp])\nqed\n\nlemma sat_Conjs: \"sat (Conjs Q xys) I \\<sigma> \\<longleftrightarrow> sat Q I \\<sigma> \\<and> (\\<forall>(x, y) \\<in> set xys. sat (x \\<approx> y) I \\<sigma>)\"\n  by (induct Q xys rule: Conjs.induct) auto\n\nlemma sat_Conjs_disjoint: \"sat (Conjs_disjoint Q xys) I \\<sigma> \\<longleftrightarrow> sat Q I \\<sigma> \\<and> (\\<forall>(x, y) \\<in> set xys. sat (x \\<approx> y) I \\<sigma>)\"\nproof (induct Q xys rule: Conjs_disjoint.induct)\n  case (1 Q xys)\n  then show ?case\n    by (subst Conjs_disjoint.simps)\n      (auto simp: sat_Conjs dest: find_SomeD(2) set_remove1_subset[THEN set_mp] in_set_remove_cases[rotated] split: option.splits)\nqed\n\nlemma sat_CONJ: \"finite Qeq \\<Longrightarrow> sat (CONJ (Q, Qeq)) I \\<sigma> \\<longleftrightarrow> sat Q I \\<sigma> \\<and> (\\<forall>(x, y) \\<in> Qeq. sat (x \\<approx> y) I \\<sigma>)\"\n  unfolding CONJ_def by (auto simp: sat_Conjs)\n\nlemma sat_CONJ_disjoint: \"finite Qeq \\<Longrightarrow> sat (CONJ_disjoint (Q, Qeq)) I \\<sigma> \\<longleftrightarrow> sat Q I \\<sigma> \\<and> (\\<forall>(x, y) \\<in> Qeq. sat (x \\<approx> y) I \\<sigma>)\"\n  unfolding CONJ_disjoint_def by (auto simp: sat_Conjs_disjoint)\n\nlemma Conjs_inject: \"Conjs Q xys = Conjs Q' xys \\<longleftrightarrow> Q = Q'\"\n  by (induct Q xys arbitrary: Q' rule: Conjs.induct) auto\n\nlemma nonempty_disjointvars_infinite:\n  assumes \"disjointvars (Qfin :: ('a :: infinite, 'b) fmla) Qeq \\<noteq> {}\"\n    \"finite Qeq\" \"fv Qfin \\<union> Field Qeq \\<subseteq> X\" \"finite X\" \"sat Qfin I \\<sigma>\" \"\\<forall>(x, y)\\<in>Qeq. \\<sigma> x = \\<sigma> y\"\n  shows \"infinite (eval_on X (CONJ_disjoint (Qfin, Qeq)) I)\"\nproof -\n  from assms(1) obtain x V where xV: \"V \\<in> classes Qeq\" \"x \\<in> V\" \"V \\<inter> fv Qfin = {}\"\n    by (auto simp: disjointvars_def)\n  show ?thesis\n  proof (rule infinite_surj[OF infinite_UNIV, of \"\\<lambda>ds. ds ! index (sorted_list_of_set X) x\"], safe)\n    fix z\n    let ?ds = \"map (\\<lambda>v. if v \\<in> V then z else \\<sigma> v) (sorted_list_of_set X)\"\n    from xV have \"x \\<in> Field Qeq\"\n      by (metis UnionI classes_cover)\n    { fix a b\n      assume *: \"(a, b) \\<in> Qeq\"\n      from this edge_same_class[OF xV(1) this] assms(3,6) have \"a \\<in> X\" \"b \\<in> X\" \"a \\<in> V \\<longleftrightarrow> b \\<in> V\" \"\\<sigma> a = \\<sigma> b\"\n        by (auto dest: FieldI1 FieldI2)\n      with xV(1) assms(3,4) have \"(\\<sigma>[sorted_list_of_set X :=\\<^sup>* ?ds]) a = (\\<sigma>[sorted_list_of_set X :=\\<^sup>* ?ds]) b\"\n        by (subst (1 2) fun_upds_in) auto\n    }\n    with assms(2-) xV  \\<open>x \\<in> Field Qeq\\<close>\n    show \"z \\<in> (\\<lambda>ds. ds ! index (sorted_list_of_set X) x) ` eval_on X (CONJ_disjoint (Qfin, Qeq)) I\"\n      by (auto simp: eval_on_def CONJ_disjoint_def sat_Conjs_disjoint Let_def image_iff fun_upds_in subset_eq\n         intro!: exI[of _ \"map (\\<lambda>v. if v \\<in> V then z else \\<sigma> v) (sorted_list_of_set X)\"] exI[of _ \\<sigma>]\n         elim!: sat_fv_cong[THEN iffD1, rotated -1])\n  qed\nqed\n\nlemma EVAL'_EVAL: \"EVAL' Q Qfin Qinf \\<Longrightarrow> FV Q Qfin Qinf \\<Longrightarrow> EVAL Q Qfin Qinf\"\n  unfolding EVAL_def EVAL'_def FV_def\n  by (subst (2) eval_def) auto\n\nlemma cpropagated_Conjs_disjoint:\n  \"distinct xys \\<Longrightarrow> irrefl (set xys) \\<Longrightarrow> \\<forall>V\\<in>classes (set xys). V \\<inter> fv Q \\<noteq> {} \\<Longrightarrow> cpropagated Q \\<Longrightarrow> cpropagated (Conjs_disjoint Q xys)\"\nproof (induct Q xys rule: Conjs_disjoint.induct)\n  case (1 Q xys)\n  show ?case\n  proof (cases \"find (\\<lambda>(x, y). {x, y} \\<inter> fv Q \\<noteq> {}) xys\")\n    case None\n    with 1(2-) show ?thesis\n      using classes_intersect_find_not_None[of xys \"fv Q\"]\n      by (cases xys) (simp_all add: Conjs_disjoint.simps)\n  next\n    case (Some xy)\n    then obtain x y where xy: \"xy = (x, y)\" and xy_in: \"(x, y) \\<in> set xys\"\n      by (cases xy) (auto dest!: find_SomeD)\n    with Some 1(3,5) have \"cpropagated (Conj Q (x \\<approx> y))\"\n      by (auto dest: find_SomeD simp: cpropagated_def irrefl_def is_Bool_def)\n    moreover from 1(2,4) have \"\\<forall>V\\<in>classes (set (remove1 (x, y) xys)). V \\<inter> fv (Conj Q (x \\<approx> y)) \\<noteq> {}\"\n      by (subst (asm) insert_remove_id[OF xy_in], unfold classes_insert)\n        (auto simp: class_None_eq class_Some_eq split: option.splits if_splits)\n    moreover from 1(3) have \"irrefl (set xys - {(x, y)})\"\n      by (auto simp: irrefl_def)\n    ultimately show ?thesis\n      using 1(2-) Some xy 1(1)[OF Some xy[symmetric]]\n      by (simp add: Conjs_disjoint.simps)\n  qed\nqed\n\nlemma (in simplification) simplified_Conjs_disjoint:\n  \"distinct xys \\<Longrightarrow> irrefl (set xys) \\<Longrightarrow> \\<forall>V\\<in>classes (set xys). V \\<inter> fv Q \\<noteq> {} \\<Longrightarrow> simplified Q \\<Longrightarrow> simplified (Conjs_disjoint Q xys)\"\nproof (induct Q xys rule: Conjs_disjoint.induct)\n  case (1 Q xys)\n  show ?case\n  proof (cases \"find (\\<lambda>(x, y). {x, y} \\<inter> fv Q \\<noteq> {}) xys\")\n    case None\n    with 1(2-) show ?thesis\n      using classes_intersect_find_not_None[of xys \"fv Q\"]\n      by (cases xys) (simp_all add: Conjs_disjoint.simps)\n  next\n    case (Some xy)\n    then obtain x y where xy: \"xy = (x, y)\" and xy_in: \"(x, y) \\<in> set xys\"\n      by (cases xy) (auto dest!: find_SomeD)\n    with Some 1(3,5) have \"simplified (Conj Q (x \\<approx> y))\"\n      by (auto dest: find_SomeD simp: irrefl_def intro!: simplified_Conj_eq)\n    moreover from 1(2,4) have \"\\<forall>V\\<in>classes (set (remove1 (x, y) xys)). V \\<inter> fv (Conj Q (x \\<approx> y)) \\<noteq> {}\"\n      by (subst (asm) insert_remove_id[OF xy_in], unfold classes_insert)\n        (auto simp: class_None_eq class_Some_eq split: option.splits if_splits)\n    moreover from 1(3) have \"irrefl (set xys - {(x, y)})\"\n      by (auto simp: irrefl_def)\n    ultimately show ?thesis\n      using 1(2-) Some xy 1(1)[OF Some xy[symmetric]]\n      by (simp add: Conjs_disjoint.simps)\n  qed\nqed\n\nlemma disjointvars_empty_iff: \"disjointvars Q Qeq = {} \\<longleftrightarrow> (\\<forall>V\\<in>classes Qeq. V \\<inter> fv Q \\<noteq> {})\"\n  unfolding disjointvars_def UNION_empty_conv\n  using classes_nonempty by auto\n\nlemma cpropagated_CONJ_disjoint:\n  \"finite Qeq \\<Longrightarrow> irrefl Qeq \\<Longrightarrow> disjointvars Q Qeq = {} \\<Longrightarrow> cpropagated Q \\<Longrightarrow> cpropagated (CONJ_disjoint (Q, Qeq))\"\n  unfolding CONJ_disjoint_def prod.case disjointvars_empty_iff\n  by (rule cpropagated_Conjs_disjoint) auto\n\nlemma (in simplification) simplified_CONJ_disjoint:\n  \"finite Qeq \\<Longrightarrow> irrefl Qeq \\<Longrightarrow> disjointvars Q Qeq = {} \\<Longrightarrow> simplified Q \\<Longrightarrow> simplified (CONJ_disjoint (Q, Qeq))\"\n  unfolding CONJ_disjoint_def prod.case disjointvars_empty_iff\n  by (rule simplified_Conjs_disjoint) auto\n\nlemma (in simplification) split_INV1_init:\n  \"rrb Q' \\<Longrightarrow> simplified Q' \\<Longrightarrow> Q \\<triangleq> Q' \\<Longrightarrow> fv Q' \\<subseteq> fv Q \\<Longrightarrow> split_INV1 Q ({(Q', {})}, {})\"\n  by (auto simp add: split_INV1_def wf_state_def assemble_def FV_def EVAL'_def eval_def[symmetric] eval_simp_False irrefl_def\n    sat_simp equiv_def intro!: equiv_eval_on_eval_eqI del: equalityI dest: fv_simp[THEN set_mp] split: prod.splits)\n\nlemma (in simplification) split_INV1_I:\n  \"wf_state Q rrb (\\<Q>fin, \\<Q>inf) \\<Longrightarrow> EVAL' Q (simp (DISJ (CONJ_disjoint ` \\<Q>fin))) (simp (DISJ (close ` \\<Q>inf))) \\<Longrightarrow>\n    split_INV1 Q (\\<Q>fin, \\<Q>inf)\"\n  unfolding split_INV1_def assemble_def by auto\n\nlemma EVAL'_I: \n  \"(\\<And>I. finite (adom I) \\<Longrightarrow> eval Qinf I = {} \\<Longrightarrow> eval_on (fv Q) Qfin I = eval Q I) \\<Longrightarrow>\n   (\\<And>I. finite (adom I) \\<Longrightarrow> eval Qinf I \\<noteq> {} \\<Longrightarrow> infinite (eval Q I)) \\<Longrightarrow> EVAL' Q Qfin Qinf\"\n  unfolding EVAL'_def by auto\n\nlemma (in simplification) wf_state_Un:\n  \"wf_state Q P (\\<Q>fin, \\<Q>inf) \\<Longrightarrow> wf_state Q P (insert Qpair \\<Q>new, {Q'}) \\<Longrightarrow>\n   wf_state Q P (insert Qpair (\\<Q>fin \\<union> \\<Q>new), insert Q' \\<Q>inf)\"\n  by (auto simp: wf_state_def)\n\nlemma (in simplification) wf_state_Diff:\n  \"wf_state Q P (\\<Q>fin, \\<Q>inf) \\<Longrightarrow> wf_state Q P (\\<Q>fin - \\<Q>new, \\<Q>inf)\"\n  by (auto simp: wf_state_def)\n\nlemma (in simplification) split_INV1_step:\n  assumes \"split_INV1 Q (\\<Q>fin, \\<Q>inf)\" \"(Qfin, Qeq) \\<in> fixfree \\<Q>fin\" \"x \\<in> nongens Qfin\" \"cov x Qfin G\"\n  shows \"split_INV1 Q\n    (insert (simp (Conj Qfin (DISJ (qps G))), Qeq)\n      (\\<Q>fin - {(Qfin, Qeq)} \\<union> (\\<lambda>y. (cp (Qfin[x \\<^bold>\\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G),\n    insert (cp (Qfin \\<^bold>\\<bottom> x)) \\<Q>inf)\"\n    (is \"split_INV1 Q (?Qfin, ?Qinf)\")\nproof (intro split_INV1_I EVAL'_I, goal_cases wf fin inf)\n  case wf\n  from assms(1) have wf: \"wf_state Q rrb (\\<Q>fin, \\<Q>inf)\"\n    by (auto simp: split_INV1_def)\n  with assms(2,3) obtain xys where *:\n    \"x \\<in> fv Qfin\" \"(Qfin, Qeq) \\<in> \\<Q>fin\" \"finite \\<Q>fin\" \"finite Qeq\" \"finite \\<Q>inf\" \"fv Qfin \\<subseteq> fv Q\" \"Field Qeq \\<subseteq> fv Q\"\n    \"distinct xys\" \"leftfresh Qfin xys\" \"set xys = Qeq\" \"rrb Qfin\" \"irrefl Qeq\"\n    by (auto simp: fixfree_def nongens_def wf_state_def)\n  moreover from * have \"\\<exists>xs. leftfresh (simp (Conj Qfin (DISJ (qps G)))) xs \\<and> distinct xs \\<and> set xs = set xys\"\n    using cov_fv[OF assms(4) _ qps_in] assms(4)\n    by (intro exI[of _ xys])\n      (force elim!: leftfresh_fv_subset dest!: fv_simp[THEN set_mp] fv_DISJ[THEN set_mp, rotated 1])\n  moreover from * have \"\\<exists>xs. leftfresh (cp (Qfin[x \\<^bold>\\<rightarrow> z])) xs \\<and> distinct xs \\<and> set xs = insert (x, z) (set xys)\"\n    if \"z \\<in> eqs x G\" for z\n    using cov_fv[OF assms(4) _ eqs_in, of z x] assms(4) that\n    by (intro exI[of _ \"if (x, z) \\<in> set xys then xys else (x, z) # xys\"])\n      (auto simp: fv_subst dest!: fv_cp[THEN set_mp] elim!: leftfresh_fv_subset)\n  ultimately show ?case\n    using cov_fv[OF assms(4) _ qps_in] cov_fv[OF assms(4) _ eqs_in] assms(4)\n    by (intro wf_state_Un wf_state_Diff wf)\n      (auto simp: wf_state_def rrb_simp simplified_simp simplified_cp rrb_cp_subst fv_subst\n      subset_eq irrefl_def\n      dest!: fv_cp[THEN set_mp] fv_simp[THEN set_mp] fv_DISJ[THEN set_mp, rotated 1])\nnext\n  case (fin I)\n  note eq = trans[OF sat_simp sat_DISJ, symmetric]\n  from assms have *:\n    \"x \\<in> fv Qfin\" \"(Qfin, Qeq) \\<in> \\<Q>fin\" \"fv Qfin \\<subseteq> fv Q\" \"Field Qeq \\<subseteq> fv Q\" and\n    finite[simp]: \"finite \\<Q>fin\" \"finite Qeq\" \"finite \\<Q>inf\"\n    by (auto simp: split_INV1_def fixfree_def nongens_def wf_state_def)\n  with fin have unsat: \"\\<forall>\\<sigma>. \\<not> sat (Qfin \\<^bold>\\<bottom> x) I \\<sigma>\" and \"\\<forall>x\\<in>\\<Q>inf. \\<forall>\\<sigma>. \\<not> sat x I \\<sigma>\"\n    by (auto simp: eval_empty_close eval_simp_DISJ_closed)\n  with fin(1) assms(1) * have \"eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \\<Q>fin))) I = eval Q I\"\n    unfolding split_INV1_def Let_def assemble_def prod.case EVAL'_def\n    by (auto simp: eval_empty_close eval_simp_DISJ_closed)\n  with assms(4) show ?case\n  proof (elim trans[rotated], intro eval_on_cong box_equals[OF _ eq eq])\n    fix \\<sigma>\n    from * have \"(\\<exists>Q\\<in>\\<Q>fin. sat (CONJ_disjoint Q) I \\<sigma>) \\<longleftrightarrow>\n        sat (CONJ_disjoint (Qfin, Qeq)) I \\<sigma> \\<or> (\\<exists>Q\\<in>\\<Q>fin - {(Qfin, Qeq)}. sat (CONJ_disjoint Q) I \\<sigma>)\"\n      using assms(4) by (auto simp: fixfree_def)\n    also have \"sat (CONJ_disjoint (Qfin, Qeq)) I \\<sigma> \\<longleftrightarrow>\n        sat (CONJ_disjoint (simp (Conj Qfin (DISJ (qps G))), Qeq)) I \\<sigma> \\<or>\n        (\\<exists>Q\\<in>(\\<lambda>y. (cp (Qfin[x \\<^bold>\\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G. sat (CONJ_disjoint Q) I \\<sigma>)\"\n      using cov_sat_fin[of x Qfin G I \\<sigma>] assms(3,4) fin(1) unsat\n      by (auto simp: eval_empty_close sat_CONJ_disjoint nongens_def)\n    finally show \"(\\<exists>Q\\<in>CONJ_disjoint ` ?Qfin. sat Q I \\<sigma>) \\<longleftrightarrow> (\\<exists>Q\\<in>CONJ_disjoint ` \\<Q>fin. sat Q I \\<sigma>)\"\n      by auto\n  qed simp_all\nnext\n  case (inf I)\n  from assms have *:\n    \"x \\<in> fv Qfin\" \"(Qfin, Qeq) \\<in> \\<Q>fin\" \"finite \\<Q>fin\" \"finite Qeq\" \"finite \\<Q>inf\" \"fv Qfin \\<subseteq> fv Q\" \"Field Qeq \\<subseteq> fv Q\"\n    \"\\<exists>xys. distinct xys \\<and> leftfresh Qfin xys \\<and> set xys = Qeq\"\n    by (auto simp: split_INV1_def fixfree_def nongens_def wf_state_def)\n  with inf obtain \\<sigma> where \"sat (Qfin \\<^bold>\\<bottom> x) I \\<sigma> \\<or> (\\<exists>Q \\<in> \\<Q>inf. sat Q I \\<sigma>)\"\n    by (subst (asm) eval_simp_DISJ_closed) (auto simp: eval_empty_close sat_CONJ simp del: fv_CONJ)\n  then show ?case\n  proof (elim disjE)\n    assume \"sat (Qfin \\<^bold>\\<bottom> x) I \\<sigma>\"\n    then have \"infinite (eval Qfin I)\"\n      by (rule cov_eval_inf[OF assms(4) *(1) inf(1)])\n    then have \"infinite (eval_on (fv Q) (CONJ_disjoint (Qfin, Qeq)) I)\"\n      by (rule infinite_eval_CONJ_disjoint[OF _ inf(1) *(6,7) _ *(8)]) simp\n    with * have \"infinite (eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \\<Q>fin))) I)\"\n      by (elim infinite_Implies_mono_on[rotated 3]) (auto simp: sat_simp)\n    with inf assms(1) show ?case\n      by (auto simp: split_INV1_def assemble_def EVAL'_def split: if_splits)\n  next\n    assume \"\\<exists>Q\\<in>\\<Q>inf. sat Q I \\<sigma>\"\n    with inf(1) assms(1) * show ?case\n      by (auto simp: split_INV1_def assemble_def EVAL'_def eval_simp_DISJ_closed eval_empty_close\n          split: if_splits)\n  qed\nqed\n\nlemma (in simplification) split_INV1_decreases:\n  assumes \"split_INV1 Q (\\<Q>fin, \\<Q>inf)\" \"(Qfin, Qeq) \\<in> fixfree \\<Q>fin\" \"x \\<in> nongens Qfin\" \"cov x Qfin G\"\n  shows \"((nongens \\<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\\<Q>fin - {(Qfin, Qeq)} \\<union> (\\<lambda>y. (cp (Qfin[x \\<^bold>\\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)),\n          (nongens \\<circ> fst) `# mset_set \\<Q>fin) \\<in> mult {(X, Y). X \\<subset> Y \\<and> Y \\<subseteq> fv Q}\"\n  using assms by (intro split_step_in_mult) (auto simp: fixfree_def split_INV1_def wf_state_def)\n\nlemma (in simplification) split_INV2_init:\n  \"split_INV1 Q (\\<Q>fin, \\<Q>inf) \\<Longrightarrow> fixfree \\<Q>fin = {} \\<Longrightarrow> split_INV2 Q (\\<Q>fin, \\<Q>inf)\"\n  by (auto simp: split_INV1_def split_INV2_def wf_state_def sr_def fixfree_def)\n\nlemma (in simplification) split_INV2_I:\n  \"wf_state Q sr (\\<Q>fin, \\<Q>inf) \\<Longrightarrow> EVAL' Q (simp (DISJ (CONJ_disjoint ` \\<Q>fin))) (simp (DISJ (close ` \\<Q>inf))) \\<Longrightarrow>\n    split_INV2 Q (\\<Q>fin, \\<Q>inf)\"\n  unfolding split_INV2_def assemble_def by auto\n\nlemma (in simplification) split_INV2_step:\n  assumes \"split_INV2 Q (\\<Q>fin, \\<Q>inf)\" \"(Qfin, Qeq) \\<in> inf \\<Q>fin Q\"\n  shows \"split_INV2 Q (\\<Q>fin - {(Qfin, Qeq)}, insert (CONJ (Qfin, Qeq)) \\<Q>inf)\"\nproof (intro split_INV2_I EVAL'_I, goal_cases wf fin inf)\n  case wf\n  with assms(1) show ?case \n    by (auto simp: split_INV2_def wf_state_def)\nnext\n  case (fin I)\n  with assms have finite[simp]: \"finite \\<Q>fin\" \"finite Qeq\" and\n    unsat: \"\\<And>\\<sigma>. \\<not> sat (CONJ (Qfin, Qeq)) I \\<sigma>\" and\n    eval: \"eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \\<Q>fin))) I = eval Q I\"\n    by (auto simp: split_INV2_def inf_def wf_state_def assemble_def EVAL'_def eval_simp_DISJ_closed eval_empty_close)\n  from eval show ?case\n  proof (elim trans[rotated], unfold eval_on_simp, intro eval_DISJ_prune_unsat ballI allI; (elim DiffE imageE; hypsubst_thin)?)\n    fix Qpair \\<sigma>\n    assume \"Qpair \\<in> \\<Q>fin\" \"CONJ_disjoint Qpair \\<notin> CONJ_disjoint ` (\\<Q>fin - {(Qfin, Qeq)})\"\n    with unsat[of \\<sigma>] show \"\\<not> sat (CONJ_disjoint Qpair) I \\<sigma>\"\n      by (cases \"Qeq = snd Qpair\"; cases Qpair) (auto simp: sat_CONJ_disjoint sat_CONJ)\n  qed auto\nnext\n  case (inf I)\n  from assms have *:\n    \"(Qfin, Qeq) \\<in> \\<Q>fin\" \"finite \\<Q>fin\" \"finite Qeq\" \"finite \\<Q>inf\" \"fv Qfin \\<subseteq> fv Q\" \"Field Qeq \\<subseteq> fv Q\"\n    by (auto simp: split_INV2_def inf_def wf_state_def)\n  with inf obtain \\<sigma> where \"sat Qfin I \\<sigma> \\<and> (\\<forall>(x, y) \\<in> Qeq. \\<sigma> x = \\<sigma> y) \\<or> (\\<exists>Q \\<in> \\<Q>inf. sat Q I \\<sigma>)\"\n    by (subst (asm) eval_simp_DISJ_closed) (auto simp: eval_empty_close sat_CONJ simp del: fv_CONJ)\n  then show ?case\n  proof (elim disjE conjE)\n    assume \"sat Qfin I \\<sigma>\" \"\\<forall>(x, y) \\<in> Qeq. \\<sigma> x = \\<sigma> y\"\n    with assms * have \"infinite (eval_on (fv Q) (CONJ_disjoint (Qfin, Qeq)) I)\"\n      using nonempty_disjointvars_infinite[of Qfin Qeq \"fv Q\" I \\<sigma>]\n        infinite_eval_on_extra_variables[of \"fv Q\" \"CONJ_disjoint (Qfin, Qeq)\" I, OF _ _ exI, of \\<sigma>]\n      by (cases \"fv (CONJ_disjoint (Qfin, Qeq)) \\<subset> fv Q\") (auto simp: inf_def sat_CONJ sat_CONJ_disjoint)\n    with * have \"infinite (eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \\<Q>fin))) I)\"\n      by (elim infinite_Implies_mono_on[rotated 3]) (auto simp: sat_simp)\n    with inf assms(1) show ?case\n      by (auto simp: split_INV2_def assemble_def EVAL'_def split: if_splits)\n  next\n    assume \"\\<exists>Q \\<in> \\<Q>inf. sat Q I \\<sigma>\"\n    with inf(1) assms(1) * show \"infinite (eval Q I)\"\n      by (auto simp: split_INV2_def assemble_def EVAL'_def eval_simp_DISJ_closed eval_empty_close\n        split: if_splits)\n  qed\nqed\n\nlemma (in simplification) split_INV2_decreases:\n  \"split_INV2 Q (\\<Q>fin, \\<Q>inf) \\<Longrightarrow> (Qfin, Qeq) \\<in> Restrict_Frees.inf \\<Q>fin Q \\<Longrightarrow> card (\\<Q>fin - {(Qfin, Qeq)}) < card \\<Q>fin\"\n  by (rule psubset_card_mono) (auto simp: inf_def split_INV2_def wf_state_def)\n\nlemma (in simplification) split_INV2_stop_fin_sr:\n  \"inf \\<Q>fin Q = {} \\<Longrightarrow> split_INV2 Q (\\<Q>fin, \\<Q>inf) \\<Longrightarrow> assemble (\\<Q>fin, \\<Q>inf) = (Qfin, Qinf) \\<Longrightarrow> sr Qfin\"\n  by (auto 0 4 simp: split_INV2_def assemble_def wf_state_def inf_def\n    intro!: sr_simp sr_DISJ[of _ \"fv Q\"] sr_CONJ_disjoint[of \\<Q>fin Q])\n\nlemma (in simplification) split_INV2_stop_inf_sr:\n  \"split_INV2 Q (\\<Q>fin, \\<Q>inf) \\<Longrightarrow> assemble (\\<Q>fin, \\<Q>inf) = (Qfin, Qinf) \\<Longrightarrow> fv Q' \\<subseteq> fv Qinf \\<Longrightarrow> rrb Q' \\<Longrightarrow> sr Q'\"\n  using fv_DISJ_close[of \\<Q>inf] fv_simp[of \"DISJ (close ` \\<Q>inf)\"]\n  by (auto simp: split_INV2_def assemble_def wf_state_def sr_def nongens_def)\n\nlemma (in simplification) split_INV2_stop_FV:\n  assumes \"fv Q' \\<subseteq> fv Qinf\" \"inf \\<Q>fin Q = {}\" \"split_INV2 Q (\\<Q>fin, \\<Q>inf)\" \"assemble (\\<Q>fin, \\<Q>inf) = (Qfin, Qinf)\"\n  shows \"FV Q Qfin Q'\"\nproof -\n  have \"simplified Q'\" \"fv Q' = fv Q\" if \"Q' \\<in> CONJ_disjoint ` \\<Q>fin\" for Q'\n    using that assms(2,3)\n    by (auto simp: split_INV2_def wf_state_def inf_def simplified_CONJ_disjoint)\n  with assms(1,3,4) show ?thesis\n    using fv_simp_DISJ_eq[of \"CONJ_disjoint ` \\<Q>fin\" \"fv Q\"] fv_DISJ_close[of \\<Q>inf] fv_simp[of \"DISJ (close ` \\<Q>inf)\"]\n    by (auto simp: split_INV2_def assemble_def wf_state_def FV_def)\nqed\n\nlemma (in simplification) split_INV2_stop_EVAL:\n  assumes \"fv Q' \\<subseteq> fv Qinf\" \"inf \\<Q>fin Q = {}\" \"split_INV2 Q (\\<Q>fin, \\<Q>inf)\" \"assemble (\\<Q>fin, \\<Q>inf) = (Qfin, Qinf)\" \"Qinf \\<triangleq> Q'\"\n  shows \"EVAL Q Qfin Q'\"\nproof -\n  have \"simplified Q'\" \"fv Q' = fv Q\" if \"Q' \\<in> CONJ_disjoint ` \\<Q>fin\" for Q'\n    using that assms(2,3)\n    by (auto simp: split_INV2_def wf_state_def inf_def simplified_CONJ_disjoint)\n  with assms(1,3,4,5) show ?thesis\n    using fv_simp_DISJ_eq[of \"CONJ_disjoint ` \\<Q>fin\" \"fv Q\"] fv_DISJ_close[of \\<Q>inf] fv_simp[of \"DISJ (close ` \\<Q>inf)\"]\n    by (auto simp: split_INV2_def assemble_def wf_state_def sr_def EVAL'_cong FV_def elim!: EVAL'_EVAL)\nqed\n\nlemma (in simplification) simplified_assemble:\n  \"assemble (\\<Q>fin, \\<Q>inf) = (Qfin, Qinf) \\<Longrightarrow> simplified Qfin\"\n  by (auto simp: assemble_def simplified_simp)\n\nlemma (in simplification) split_correct:\n  notes cp.simps[simp del]\n  shows \"split Q \\<le> split_spec Q\"\n  unfolding split_def split_spec_def Let_def\n  by (refine_vcg rb_correct[THEN order_trans, unfolded rb_spec_def]\n      WHILEIT_rule[where I=\"split_INV1 Q\" and R=\"inv_image (mult {(X, Y). X \\<subset> Y \\<and> Y \\<subseteq> fv Q}) (image_mset (nongens o fst) o mset_set o fst)\"]\n      WHILEIT_rule[where I=\"split_INV2 Q\" and R=\"measure (\\<lambda>(\\<Q>fin, _). card \\<Q>fin)\"])\n    (auto simp: wf_mult finite_subset_wf split_step_in_mult\n      conj_disj_distribR ex_disj_distrib card_gt_0_iff image_image image_Un\n      insert_commute ac_simps UNION_singleton_eq_range simplified_assemble\n      split_INV1_init split_INV1_step split_INV1_decreases\n      split_INV2_init split_INV2_step split_INV2_decreases\n      split_INV2_stop_fin_sr split_INV2_stop_inf_sr split_INV2_stop_FV split_INV2_stop_EVAL)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Safe_Range_RC/Restrict_Frees.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.32582022322991394}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Guess_ExI\nimports\n  Eisbach_Methods\n  Apply_Debug\nbegin\n\n(*\nThis file contains the experimental methods guess_exI and guess_spec. Each, as the name suggests,\nattempts to guess an instantiation for their respective rules. It does so by looking\nfor a matching premise for the quantifying binder, checking that\nthis could be the only match for safety.\n*)\n\nmethod abs_used for P = (match (P) in \"\\<lambda>s. ?P\" \\<Rightarrow> \\<open>fail\\<close> \\<bar> _ \\<Rightarrow> \\<open>-\\<close>)\n\nmethod in_conj for P Q = (\n      match (Q) in \"P\" \\<Rightarrow> \\<open>-\\<close>\n    | match (Q) in \"\\<lambda>y. A y \\<and> B y\"  for A B  \\<Rightarrow>\n            \\<open> match (A) in \"(Q' :: 'b)\" for Q' \\<Rightarrow> \\<open>match (B) in \"(Q'' :: 'b)\"  for Q'' \\<Rightarrow>\n             \\<open> in_conj P Q' | in_conj P Q''\\<close>\\<close>\\<close>\n    )\n\nmethod guess_exI =\n    (require_determ \\<open>(match conclusion in \"\\<exists>x. Q x\" for Q \\<Rightarrow>\n                            \\<open>match premises in \"P y\" for P y \\<Rightarrow>\n                             \\<open>abs_used P, in_conj P Q, rule exI[where x=y]\\<close>\\<close>)\\<close>)\n\nlemma fun_uncurry:\n  \"(P \\<longrightarrow> Q \\<longrightarrow> R) \\<longleftrightarrow> (P \\<and> Q) \\<longrightarrow> R\"\n  by auto\n\nmethod guess_spec_inner for P uses I =\n    ((match I in \"\\<forall>x. C x \\<longrightarrow> _ x\" for C \\<Rightarrow> \\<open>in_conj P C\\<close> ))\n\nmethod guess_spec =\n    (require_determ \\<open>(match premises in I:\"\\<forall>x. _ x \\<longrightarrow> _ x\" \\<Rightarrow>\n                            \\<open>match premises in \"P y\" for P y \\<Rightarrow>\n                            \\<open>abs_used P, guess_spec_inner P I:I[simplified fun_uncurry],\n                                         insert I, drule spec[where x=y]\\<close>\\<close>)\\<close>)\n\ntext \\<open>Tests and examples\\<close>\nexperiment begin\n\n lemma\n    assumes Q: \"Q x\"\n    shows  \"P x \\<Longrightarrow> \\<forall>x. Q x \\<longrightarrow> P x \\<longrightarrow> R  \\<Longrightarrow> R\"\n    by (guess_spec, blast intro: Q)\n\n  (* Conflicting premises are checked *)\n  lemma\n    assumes Q: \"Q x\"\n    shows \"\\<lbrakk> P x; P y \\<rbrakk> \\<Longrightarrow>  \\<forall>x. Q x \\<longrightarrow> P x \\<longrightarrow> R \\<Longrightarrow> R\"\n    apply (fails \\<open>guess_spec\\<close>)\n    by (blast intro: Q)\n\n  (* Conflicts between different conjuncts are checked *)\n  lemma\n    assumes Q: \"Q x\"\n    shows \"\\<lbrakk> P x; Q y \\<rbrakk> \\<Longrightarrow> \\<forall>x. Q x \\<longrightarrow> P x \\<longrightarrow> R \\<Longrightarrow> R\"\n    apply (fails \\<open>guess_spec\\<close>)\n    by (blast intro: Q)\nend\n\ntext \\<open>Tests and examples\\<close>\nexperiment begin\n  lemma \"P x \\<Longrightarrow> \\<exists>x. P x\"\n    by guess_exI\n\n  lemma\n    assumes Q: \"Q x\"\n    shows \"P x \\<Longrightarrow> \\<exists>x. Q x \\<and> P x\"\n    apply guess_exI\n    by (blast intro: Q)\n\n  (* Conflicting premises are checked *)\n  lemma\n    assumes Q: \"Q x\"\n    shows \"\\<lbrakk> P x; P y \\<rbrakk> \\<Longrightarrow> \\<exists>x. Q x \\<and> P x\"\n    apply (fails \\<open>guess_exI\\<close>)\n    by (blast intro: Q)\n\n  (* Conflicts between different conjuncts are checked *)\n  lemma\n    assumes Q: \"Q x\"\n    shows \"\\<lbrakk> P x; Q y \\<rbrakk> \\<Longrightarrow> \\<exists>x. Q x \\<and> P x\"\n    apply (fails \\<open>guess_exI\\<close>)\n    by (blast intro: Q)\nend\n\nend", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/Guess_ExI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.6001883592602049, "lm_q1q2_score": 0.3258202232299139}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoarePartialDef.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Hoare Logic for Partial Correctness *}\ntheory HoarePartialDef imports Semantic begin\n\ntype_synonym ('s,'p) quadruple = \"('s assn \\<times> 'p \\<times> 's assn \\<times> 's assn)\"\n\nsubsection {* Validity of Hoare Tuples: @{text \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\ndefinition\n  valid :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n                (\"_\\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \\<forall>s t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> s \\<in> Normal ` P \\<longrightarrow> t \\<notin> Fault ` F  \n                      \\<longrightarrow>  t \\<in>  Normal ` Q \\<union> Abrupt ` A\"\n\ndefinition\n  cvalid::\n  \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n      's assn,('s,'p,'f) com,'s assn,'s assn] =>bool\"\n                (\"_,_\\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> (\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\<longrightarrow> \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\ndefinition\n  nvalid :: \"[('s,'p,'f) body,nat,'f set, \n                's assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n                (\"_\\<Turnstile>_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \\<forall>s t. \\<Gamma>\\<turnstile>\\<langle>c,s \\<rangle> =n\\<Rightarrow> t \\<longrightarrow> s \\<in> Normal ` P \\<longrightarrow> t \\<notin> Fault ` F \n                        \\<longrightarrow> t \\<in>  Normal ` Q \\<union> Abrupt ` A\"\n\n\ndefinition\n  cnvalid::\n  \"[('s,'p,'f) body,('s,'p) quadruple set,nat,'f set, \n     's assn,('s,'p,'f) com,'s assn,'s assn] \\<Rightarrow> bool\"\n                (\"_,_\\<Turnstile>_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> (\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\<longrightarrow> \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\nnotation (ascii)\n  valid  (\"_|='/_/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60) and\n  cvalid  (\"_,_|='/_/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60) and\n  nvalid  (\"_|=_:'/_/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60) and\n  cnvalid  (\"_,_|=_:'/_/ _ _ _,_\"  [61,60,60,60,1000, 20, 1000,1000] 60)\n\n\nsubsection {*Properties of Validity *}\n\nlemma valid_iff_nvalid: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A = (\\<forall>n. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A)\"\n  apply (simp only: valid_def nvalid_def exec_iff_execn )\n  apply (blast dest: exec_final_notin_to_execn)\n  done\n \nlemma cnvalid_to_cvalid: \"(\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A) \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (unfold cvalid_def cnvalid_def valid_iff_nvalid [THEN eq_reflection])\n  apply fast\n  done\n\nlemma nvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P; t\\<notin> Fault ` F\\<rbrakk> \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: nvalid_def)\n\nlemma validI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t;s \\<in> P; t\\<notin>Fault ` F\\<rbrakk> \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: valid_def)\n\nlemma cvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n          \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: cvalid_def valid_def)\n\nlemma cvalidD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A;\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n  \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  by (auto simp add: cvalid_def valid_def)\n\nlemma cnvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n   \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n          \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: cnvalid_def nvalid_def)\n\n\nlemma cnvalidD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A;\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n   \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P;\n   t\\<notin>Fault ` F\\<rbrakk> \n  \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  by (auto simp add: cnvalid_def nvalid_def)\n\nlemma nvalid_augment_Faults:\n  assumes validn:\"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F \\<subseteq> F'\"\n  shows \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F'\"\n  with F' have \"t \\<notin> Fault ` F\"\n    by blast\n  with exec P validn\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (auto simp add: nvalid_def)\nqed\n\nlemma valid_augment_Faults:\n  assumes validn:\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F \\<subseteq> F'\"\n  shows \"\\<Gamma>\\<Turnstile>\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F'\"\n  with F' have \"t \\<notin> Fault ` F\"\n    by blast\n  with exec P validn\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (auto simp add: valid_def)\nqed\n\nlemma nvalid_to_nvalid_strip:\n  assumes validn:\"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec_strip: \"strip F' \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F\"\n  from exec_strip obtain t' where\n    exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t'\" and\n    t': \"t' \\<in> Fault ` (-F') \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: execn_strip_to_execn)\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"t' \\<in> Fault ` F\")\n    case True\n    with t' F F' have False\n      by blast\n    thus ?thesis ..\n  next\n    case False\n    with exec P validn\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: nvalid_def)\n    moreover\n    from this t' have \"t'=t\"\n      by auto\n    ultimately show ?thesis\n      by simp\n  qed\nqed\n\n\nlemma valid_to_valid_strip:\n  assumes valid:\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec_strip: \"strip F' \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F\"\n  from exec_strip obtain t' where\n    exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t'\" and\n    t': \"t' \\<in> Fault ` (-F') \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: exec_strip_to_exec)\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"t' \\<in> Fault ` F\")\n    case True\n    with t' F F' have False\n      by blast\n    thus ?thesis ..\n  next\n    case False\n    with exec P valid\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: valid_def)\n    moreover\n    from this t' have \"t'=t\"\n      by auto\n    ultimately show ?thesis\n      by simp\n  qed\nqed\n\n\nsubsection {* The Hoare Rules: @{text \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\nlemma mono_WeakenContext: \"A \\<subseteq> B \\<Longrightarrow>\n        (\\<lambda>(P, c, Q, A'). (\\<Gamma>, \\<Theta>, F, P, c, Q, A') \\<in> A) x \\<longrightarrow>\n        (\\<lambda>(P, c, Q, A'). (\\<Gamma>, \\<Theta>, F, P, c, Q, A') \\<in> B) x\"\napply blast\ndone\n\n\ninductive \"hoarep\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n    's assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n    (\"(3_,_/\\<turnstile>\\<^bsub>'/_ \\<^esub>(_/ (_)/ _,/_))\" [60,60,60,1000,20,1000,1000]60)\n  for \\<Gamma>::\"('s,'p,'f) body\"\nwhere\n  Skip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. f s \\<in> Q} (Basic f) Q,A\"\n\n| Spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. (\\<forall>t. (s,t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s,t) \\<in> r)} (Spec r) Q,A\"\n\n| Seq: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Seq c\\<^sub>1 c\\<^sub>2) Q,A\"\n  \n| Cond: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c\\<^sub>1 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> - b) c\\<^sub>2 Q,A\\<rbrakk>\n         \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (While b c) (P \\<inter> - b),A\"\n\n| Guard: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) (Guard f g c) Q,A\"\n\n| Guarantee: \"\\<lbrakk>f \\<in> F; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec:\n  \"\\<lbrakk>(P,p,Q,A) \\<in> Specs;  \n    \\<forall>(P,p,Q,A) \\<in> Specs. p \\<in> dom \\<Gamma> \\<and> \\<Gamma>,\\<Theta>\\<union>Specs\\<turnstile>\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A \\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| DynCom:\n      \"\\<forall>s \\<in> P. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (c s) Q,A \n      \\<Longrightarrow> \n      \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n| Throw: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk> \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\<forall>s \\<in> P. \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A \n           \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"\\<lbrakk>(P,p,Q,A) \\<in> \\<Theta>\\<rbrakk>\n         \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| ExFalso: \"\\<lbrakk>\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A; \\<not> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  -- {* This is a hack rule that enables us to derive completeness for\n        an arbitrary context @{text \"\\<Theta>\"}, from completeness for an empty context.*}  \n\n\n\ntext {* Does not work, because of rule ExFalso, the context @{text \"\\<Theta>\"} is to blame.\n A weaker version with empty context can be derived from soundness \n and completeness later on. *}\nlemma hoare_strip_\\<Gamma>: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"strip (-F) \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv \nproof induct\n  case Skip thus ?case by (iprover intro: hoarep.Skip)\nnext\n  case Basic thus ?case by (iprover intro: hoarep.Basic)\nnext\n  case Spec thus ?case by (iprover intro: hoarep.Spec)\nnext\n  case Seq thus ?case by (iprover intro: hoarep.Seq)\nnext\n  case Cond thus ?case by (iprover intro: hoarep.Cond)\nnext\n  case While thus ?case by (iprover intro: hoarep.While)\nnext\n  case Guard thus ?case by (iprover intro: hoarep.Guard)\n(*next\n  case CallSpec thus ?case by (iprover intro: hoarep.CallSpec)\nnext\n  case (CallRec A Abr Abr' Init P Post Pre Procs Q R Result Return Z \\<Gamma> \\<Theta> init p\n         result return )\n  from CallRec.hyps\n  have \"\\<forall>p\\<in>Procs. \\<forall>Z. (strip \\<Gamma>),\\<Theta> \\<union>\n             (\\<Union>\\<^bsub>p\\<in>Procs\\<^esub>\n                 \\<Union>\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n                      Post p Z, Abr p Z)})\\<turnstile>\n            (Pre p Z) (the (\\<Gamma> p)) (R p Z),(Abr' p Z)\" by blast\n  hence \"\\<forall>p\\<in>Procs. \\<forall>Z. (strip \\<Gamma>),\\<Theta> \\<union>\n             (\\<Union>\\<^bsub>p\\<in>Procs\\<^esub>\n                 \\<Union>\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n                      Post p Z, Abr p Z)})\\<turnstile>\n            (Pre p Z) (the ((strip \\<Gamma>) p)) (R p Z),(Abr' p Z)\"\n    by (auto intro: hoarep.StripI)\n  then show ?case\n    apply - \n    apply (rule hoarep.CallRec)\n    apply (assumption | simp only:dom_strip)+\n    done*)\nnext\n  case DynCom \n  thus ?case\n    by - (rule hoarep.DynCom,best  elim!: ballE exE)\nnext\n  case Throw thus ?case by (iprover intro: hoarep.Throw)\nnext\n  case Catch thus ?case by (iprover intro: hoarep.Catch)\n(*next \n  case CONSEQ thus ?case apply (auto intro: hoarep.CONSEQ)*)\nnext\n  case Asm thus ?case by (iprover intro: hoarep.Asm)\nnext\n  case ExFalso\n  thus ?case\n    oops\n\nlemma hoare_augment_context: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"\\<And>\\<Theta>'. \\<Theta> \\<subseteq> \\<Theta>' \\<Longrightarrow> \\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n  case CallRec\n  case (CallRec P p Q A Specs \\<Theta> F \\<Theta>')\n  from CallRec.prems\n  have \"\\<Theta>\\<union>Specs\n       \\<subseteq> \\<Theta>'\\<union>Specs\"\n    by blast\n  with CallRec.hyps (2) \n  have \"\\<forall>(P,p,Q,A)\\<in>Specs.  p \\<in> dom \\<Gamma> \\<and> \\<Gamma>,\\<Theta>'\\<union>Specs \\<turnstile>\\<^bsub>/F\\<^esub> P  (the (\\<Gamma> p)) Q,A\"\n    by fastforce\n\n  with CallRec show ?case by - (rule hoarep.CallRec)\nnext\n  case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n  case (Conseq P \\<Theta> F c Q A \\<Theta>')\n  from Conseq\n  have \"\\<forall>s \\<in> P. \n         (\\<exists>P' Q' A'. \\<Gamma>,\\<Theta>' \\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A)\"\n    by blast\n  with Conseq show ?case by - (rule hoarep.Conseq)\nnext\n  case (ExFalso \\<Theta> F P c Q A \\<Theta>')\n  have valid_ctxt: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\" \"\\<Theta> \\<subseteq> \\<Theta>'\" by fact+\n  hence \"\\<forall>n. \\<Gamma>,\\<Theta>'\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n    by (simp add: cnvalid_def) blast\n  moreover have invalid: \"\\<not> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"  by fact\n  ultimately show ?case\n    by (rule hoarep.ExFalso)\nqed (blast intro: hoarep.intros)+\n\n\nsubsection {* Some Derived Rules *}\n\nlemma  Conseq': \"\\<forall>s. s \\<in> P \\<longrightarrow> \n            (\\<exists>P' Q' A'. \n              (\\<forall> Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\<and>\n                    (\\<exists>Z. s \\<in> P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A)))\n           \\<Longrightarrow>\n           \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\<lbrakk>\\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n              \\<forall>s. s \\<in> P \\<longrightarrow> (\\<exists> Z. s\\<in>P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A))\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule Conseq) blast\n\ntheorem conseqPrePost [trans]: \n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow>  Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq [where ?P'=\"\\<lambda>Z. P'\" and ?Q'=\"\\<lambda>Z. Q'\"]) auto\n\nlemma conseqPre [trans]: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q,A \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost [trans]: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q',A' \\<Longrightarrow> Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \n \\<Longrightarrow>   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq) auto\n\n\nlemma CallRec': \n  \"\\<lbrakk>p\\<in>Procs; Procs \\<subseteq> dom \\<Gamma>;\n   \\<forall>p\\<in>Procs. \n    \\<forall>Z. \\<Gamma>,\\<Theta> \\<union> (\\<Union>p\\<in>Procs. \\<Union>Z. {((P p Z),p,Q p Z,A p Z)})\n        \\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\\<rbrakk>\n   \\<Longrightarrow>\n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\<Union>p\\<in>Procs. \\<Union>Z. {((P p Z),p,Q p Z,A p Z)}\"])\napply  blast\napply blast\ndone\n\nend ", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Simpl/HoarePartialDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018545, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.32580788033634556}}
{"text": "(*\n    Author:      David Sanan\n    Maintainer:  David Sanan, sanan at ntu edu sg\n    License:     LGPL \n*)\n\n(*  Title:      LocalRG_HoareDef.thy\n    Author:     David Sanan, NTU\n\nCopyright (C) 2015-2016 David Sanan \nSome rights reserved, NTU\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\ntheory LocalRG_HoareDef           \nimports \"ParComputation\" \"EmbSimpl.HoarePartialProps\" \"HOL-Library.Countable\"\nbegin\nsection \\<open>Validity  of Correctness Formulas\\<close>\n\nsubsection \\<open>Aux\\<close>\n\nlemmas step_ce_induct = step_ce.induct [split_format (complete), case_names\nc_step e_step, induct set]\n\nlemmas step_ce_induct1 = step_ce.induct [ case_names\nc_step e_step, induct set]\n\nthm step_ce_induct step_ce_induct1\n\nlemma eq_toParState:\"toParState i s = toParState i t \\<Longrightarrow>\n       s = t\"\n  apply (auto simp add: toParState_def Let_def split_beta)\n  using add.left_commute add_left_imp_eq append_eq_append_conv append_take_drop_id length_Cons \n           length_append length_drop list.inject plus_1_eq_Suc prod_eq_iff\n  by smt\n\nlemma eq_toSeqState:\"i<length sls \\<Longrightarrow> i<length tls \\<Longrightarrow> \n       toSeqState i (sg,sls) = toSeqState i (tg,tls) \\<Longrightarrow> (sg, sls) = (tg,tls)\"\n  apply (auto simp add: toSeqState_def Let_def split_beta)\n  by (metis append_eq_append_conv id_take_nth_drop length_take less_Suc_eq less_Suc_eq_le min.absorb2)\n\n\nlemma eq_toSeq:\n  \"i<length (snd a) \\<and> i<length (snd b) \\<Longrightarrow>\n   toSeqState i a = toSeqState i b \\<Longrightarrow>\n   a = b\"\n  by (cases a; cases b; fastforce dest: eq_toSeqState) \n\n\nlemma eq_toPar:\n    \"toParState m a = toParState m b \\<Longrightarrow>\n       a = b\" \n  by (auto simp add:  eq_toParState)\n\ndefinition related_set::\"nat \\<Rightarrow>  (('g,'l)c_state set \\<times> ('g,'l)par_state set) set\"\n  where \"related_set i \\<equiv> {(S,P). (\\<forall>s\\<in>S. (\\<exists>p\\<in>P. (s,p)\\<in> par_seq_rel i)) \\<and> \n                              (\\<forall>p\\<in>P. (\\<exists>s\\<in>S. (s,p)\\<in> par_seq_rel i)) }\"\n\nlemma seq_pred_in_rel:\"\\<forall>e \\<in> P. i<length (snd e) \\<Longrightarrow> \n       (Seq_pred i P,  P)\\<in>related_set i\"\n  unfolding Seq_pred_def related_set_def Image_def apply auto\n  using toSeqState_in_rel by blast+\n\nlemma par_pred_in_rel:\"\\<forall>e \\<in> P. i\\<le>length (snd e) \\<Longrightarrow> \n       (P,  Par_pred i P)\\<in>related_set i\"\n  unfolding Par_pred_def related_set_def Image_def apply auto\n  using toParState_in_rel by blast+\n\nlemma Seq_related_set:\"(S,P)\\<in>related_set i \\<Longrightarrow>\n       S= Seq_pred i P\"\n  unfolding related_set_def Seq_pred_def Image_def image_def apply auto\n  using par_seq_rel_seq apply blast\n  using par_seq_rel_seq by blast\n\nlemma Par_related_set:\"(S,P)\\<in>related_set i \\<Longrightarrow>\n       P= Par_pred i S\"\n  unfolding related_set_def Par_pred_def Image_def image_def apply auto\n  using par_seq_rel_par by blast+\n\n\ndefinition product_related::\"nat \\<Rightarrow> ((('g,'l)c_state) tran \\<times> (('g,'l)par_state) tran) set\"\n  where \"product_related i \\<equiv> {(x,y). ((fst x),(fst y))\\<in>par_state_rel i  \\<and> \n                                   ((snd x),(snd y)) \\<in> par_state_rel i}\"\n\nlemma  Seq_xstate_product_rel:\"(t1,t2) \\<in> product_related i \\<Longrightarrow>\n         t1 = (toSeqState i (fst t2), toSeqState i (snd t2))\" \n  unfolding product_related_def\nproof -\n  assume \"(t1, t2) \\<in> {(x, y). (fst x, fst y) \\<in> par_state_rel i \\<and> (snd x, snd y) \\<in> par_state_rel i}\"\n  then have \"(fst t1, fst t2) \\<in> par_state_rel i \\<and> (snd t1, snd t2) \\<in> par_state_rel i\"\n    by force\n  then show ?thesis\n    by (metis (no_types) par_xstate_rel_seq prod.exhaust_sel)\nqed\n\nlemma  Par_xstate_product_rel:\n   \"(t1,t2) \\<in> product_related i \\<Longrightarrow>\n     t2 = (toParState i (fst t1), toParState i (snd t1))\" \n  unfolding product_related_def\nproof -\n  assume \"(t1, t2) \\<in> {(x, y). (fst x, fst y) \\<in> par_state_rel i \\<and> (snd x, snd y) \\<in> par_state_rel i}\"\n  then have \"(fst t1, fst t2) \\<in> par_state_rel i \\<and> (snd t1, snd t2) \\<in> par_state_rel i\"\n    by force\n  then show ?thesis\n    by (metis par_xstate_rel_par prod.exhaust_sel)\n\nqed\n\nlemma seq_tran_in_product_rel:\n  \" i<length (snd x) \\<and>  i<length (snd y)  \\<Longrightarrow> \n       (((toSeqState i x),(toSeqState i y)), (x,y))\\<in>product_related i\"\n  unfolding product_related_def par_state_rel_def    \n  by (auto simp add: toSeqState_in_rel)\n                            \nlemma par_tran_in_product_rel:\n  \"i\\<le>length (snd x) \\<and> i\\<le>length (snd y)  \\<Longrightarrow> \n       ((x,y), ((toParState i x),(toParState i y)))\\<in>product_related i\"\n  unfolding product_related_def \n  by (auto simp add: toPar_state_in_rel)\n\n\ndefinition tran_related::\"nat \\<Rightarrow> ((('g,'l)c_state) tran set \\<times> (('g,'l)par_state) tran set) set\"\n  where \"tran_related i \\<equiv> {(RS,RP). (\\<forall>ps\\<in>RS. \\<exists>pp\\<in>RP. (ps,pp)\\<in>  (product_related i)) \\<and> \n                                     (\\<forall>pp\\<in>RP. \\<exists>ps\\<in>RS. (ps,pp)\\<in>  (product_related i))}\"\n\nlemma seq_tran_rel:\n  \"\\<forall>(x,y) \\<in> Rp. i<length (snd x) \\<and>  i<length (snd y)  \\<Longrightarrow> \n       (Seq_rel i Rp, Rp)\\<in>tran_related i\"\n  unfolding tran_related_def Seq_rel_def Image_def split_beta apply auto\n  apply (metis fst_conv prod.exhaust_sel seq_tran_in_product_rel swap_simp)\n  by (metis prod.exhaust_sel seq_tran_in_product_rel)\n\nlemma par_tran_rel:\n  \"\\<forall>(x,y) \\<in> Rp. i\\<le>length (snd x) \\<and> i\\<le>length (snd y) \\<Longrightarrow> \n       (Rp, Par_rel i Rp)\\<in>tran_related i\"\n  unfolding tran_related_def Par_rel_def Image_def split_beta apply auto\n  apply (metis eq_snd_iff fst_conv par_tran_in_product_rel)\n  by (metis par_tran_in_product_rel prod.exhaust_sel snd_conv swap_simp)\n\nlemma Seq_xstate_tran_rel:\"(Rs,Rp)\\<in>tran_related i \\<Longrightarrow>\n       Rs = Seq_rel i Rp\"\n  unfolding tran_related_def Seq_rel_def split_beta image_def apply auto  \n  using Seq_xstate_product_rel by fastforce+\n\nlemma Par_xstate_tran_rel:\"(Rs,Rp)\\<in>tran_related i \\<Longrightarrow>\n       Rp = Par_rel i Rs\"\n  unfolding tran_related_def Par_rel_def split_beta image_def apply auto  \n  using Par_xstate_product_rel by fastforce+        \n\nlemma cptn_length_locs_lesseq_i:\n  assumes a0:\"(\\<Gamma>,ls)\\<in>cptn\" and\n       a1:\"i\\<le> length (snd (snd(ls!0)))\"\n     shows\"\\<forall>j<length ls. i\\<le>length (snd (snd (ls!j)))\"\n  using ComputationConGlob.cptn_length_locs_less_i\nproof-\n  {\n    fix j \n    assume a00:\"j<length ls\"     \n    obtain p g l lss  where ls0:\"ls!0 = (p, ((g,l), lss))\"\n      by (metis (no_types) eq_snd_iff) \n    then have cptni:\"(i,\\<Gamma>, toParCptn i ls) \\<in> cptni\" using cptn_cptni[OF a0 _ a1]\n      by auto\n    moreover have \"length ls>0\" using a0\n      using cptn.simps by blast\n    moreover have  eq:\"\\<forall>j<length ls. snd (toParCptn i ls ! j) = toParState i (snd (ls!j))\" \n      unfolding toParCptn_def by auto  \n    ultimately have \n      \" i < length (snd (snd (toParCptn i ls ! 0)))\"\n      using  a1 unfolding toParCptn_def apply (auto; cases \"snd (ls!0)\", auto)\n      by(metis Suc_eq_plus1 le_imp_less_Suc len_toParState snd_conv)+\n    then have \"\\<forall>j<length (toParCptn i ls). i< length (snd (snd ((toParCptn i ls)!j)))\"\n      by (metis cptni gr_implies_not_zero length_0_conv \n              length_greater_0_conv length_locs_less_i prod.exhaust_sel)      \n    then have  \"i\\<le> length (snd  (snd(ls!j)))\" using eq\n      using a0 a00 a1 cptn_length_locs_less_i ls0 by fastforce\n  } then show ?thesis by auto\nqed\n\nlemma eq_xstate_related_list:       \n  assumes a0:\"\\<forall>j<length ls. i\\<le>length (snd ( snd (ls!j)))\" and\n          a1:\"(b, toParCptn i ls) \\<in> par_state_list_rel i\" \n  shows \"b = ls\"\nproof-\n  have  \"length b = length ls\" \n    using a1 unfolding par_state_list_rel_def\n    by (simp add: list_all2_conv_all_nth toParCptn_def)\n  moreover have \"\\<forall>i<length b. b ! i = ls ! i\"\n  proof-\n    {fix j \n      assume a00:\"j<length b\"\n      then have \"fst (b!j) = fst ((toParCptn i ls)!j) \\<and> \n                (snd (b!j), snd ((toParCptn i ls)!j))\\<in>par_state_rel i\"\n        using a1 unfolding par_state_list_rel_def \n        by (simp add: list_all2_conv_all_nth) \n      then have \"b!j = ls!j\"\n        by (metis Par2Seq0f a0 a00 calculation fstI par_xstate_rel_seq \n                   prod.collapse sndI toParCptn_j)       \n    } then show ?thesis by auto\n  qed\n  ultimately show ?thesis using list_eq[of b ls] by auto\nqed\n\nlemma etran_ctran_False: \"\\<Gamma>\\<turnstile>\\<^sub>c (c,toSeq s)  \\<rightarrow> (c',toSeq s') \\<Longrightarrow>\n             \\<Gamma>\\<turnstile>\\<^sub>c (c,s1)  \\<rightarrow>\\<^sub>e (c', s') \\<Longrightarrow>\n            False\"\nproof -\n   assume a0: \"\\<Gamma>\\<turnstile>\\<^sub>c (c,toSeq s)  \\<rightarrow> (c',toSeq s')\" and\n          a1: \"\\<Gamma>\\<turnstile>\\<^sub>c (c,s1)  \\<rightarrow>\\<^sub>e (c', s')\"   \n   thus ?thesis using a0 a1 mod_env_not_component\n     using env_c_c' by metis\n qed\n\nlemma etran_ctran_eq_p_normal_s: \"\\<Gamma>\\<turnstile>\\<^sub>c (c,toSeq s)  \\<rightarrow> (c',toSeq s') \\<Longrightarrow>\n             \\<Gamma>\\<turnstile>\\<^sub>c (c,s1)  \\<rightarrow>\\<^sub>e (c', s') \\<Longrightarrow>\n            c = c' \\<and> s = s' \"\n  using etran_ctran_False by blast\n\n\nlemma \"list_all2 P b l \\<Longrightarrow>\n       length b = length l \\<and> (\\<forall>i<length l. P (b!i) (l!i))\"\n  by (simp add: list_all2_conv_all_nth) \n\ndefinition final_glob_p:: \"('g,'l,'p,'f,'e) gconf \\<Rightarrow> bool\" where\n  \"final_glob_p cfg \\<equiv>  fst cfg=Skip \\<or> (fst cfg=Throw) \\<or> fst cfg = Stuck \\<or> (\\<exists>f. fst cfg =Fault f )\"\n\nlemma final_eq:\"final_glob_p cfg = final_glob (fst cfg, toSeqState i (snd cfg))\"\n  unfolding final_glob_p_def final_glob_def\n  by auto\n\nlemma par_state_list_rel_eq:\n      assumes a01:\"(b1,l)\\<in> par_state_list_rel i\" and\n              a02:\"(b2,l)\\<in> par_state_list_rel i\"\n            shows \"b1 = b2\"  \nproof-\n  have \"length b1 = length b2\" using a01 a02 unfolding par_state_list_rel_def\n    by (simp add: list_all2_conv_all_nth) \n  moreover have \"\\<forall>j<length b1. b1!j = b2!j\"\n  proof-\n    have \"\\<forall>j<length l. fst (b1!j) = fst (l!j) \\<and> (snd (b1!j), snd (l!j)) \\<in> par_state_rel i \\<and>\n                       fst (b2!j) = fst (l!j) \\<and> (snd (b2!j), snd (l!j)) \\<in> par_state_rel i\"\n      using  a01 a02  unfolding par_state_list_rel_def by (auto simp add: list_all2_conv_all_nth)\n    thus ?thesis using a01 unfolding par_state_list_rel_def\n      by (metis (no_types, lifting) Product_Type.Collect_case_prodD fst_conv list_all2_lengthD \n                par_xstate_rel_seq prod.expand snd_conv)\n  qed\n  ultimately show ?thesis\n    using nth_equalityI by blast\nqed\n\n\nlemma par_xstate_list_rel_dest1:\n   \"(l',l)\\<in>par_state_list_rel i' \\<Longrightarrow>\n    length l' = length l\"\n  unfolding par_state_list_rel_def apply auto\n  using list_all2_conv_all_nth by blast\n\nlemma par_xstate_list_rel_dest2:\n   \"(l',l)\\<in>par_state_list_rel i' \\<Longrightarrow>\n    \\<forall>i<length l'. (snd (l'!i),snd(l!i))\\<in>par_state_rel i'\"\n  unfolding par_state_list_rel_def apply auto\n  by (simp add: list_all2_conv_all_nth)\n\nlemma par_xstate_list_rel_dest3:\n\"(l',l)\\<in>par_state_list_rel i' \\<Longrightarrow>\n    \\<forall>i<length l'. fst (l'!i) = fst(l!i)\"\n  unfolding par_state_list_rel_def apply auto\n  by (simp add: list_all2_conv_all_nth)\n\nlemma par_xstate_rel_dest1:\n  assumes a0:\"(s,p) \\<in> par_state_rel i\"\n  shows \"i< length (snd p)\"\n  using a0 unfolding par_state_rel_def apply auto\n  using par_seq_rel_i_length by fastforce+\n\nlemma par_xstate_list_rel_step_e_s:\n   \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n Suc j<length s \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<^sub>c(fst(p!j), (toSeqState i (snd (p!j))))  \\<rightarrow>\\<^sub>e \n       (fst(p!(Suc j)),  (toSeqState i (snd (p!(Suc j))))) \\<Longrightarrow>\n    \\<Gamma>\\<turnstile>\\<^sub>c(fst(s!j),  ((snd (s!j))))  \\<rightarrow>\\<^sub>e \n       (fst(s!(Suc j)),  (snd (s!(Suc j))))\"\n  by (metis Suc_lessD par_xstate_list_rel_dest1 par_xstate_list_rel_dest2 par_xstate_list_rel_dest3 \n          par_xstate_rel_seq)\n  \n\nlemma par_xstate_list_rel_step_e_p:\n   \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\nSuc j<length s \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<^sub>c(fst(s!j),  ((snd (s!j))))  \\<rightarrow>\\<^sub>e \n       (fst(s!(Suc j)),  (snd (s!(Suc j)))) \\<Longrightarrow>\n  \\<Gamma>\\<turnstile>\\<^sub>c(fst(p!j), (toSeqState i (snd (p!j))))  \\<rightarrow>\\<^sub>e \n       (fst(p!(Suc j)),  (toSeqState i (snd (p!(Suc j)))))\"\n  by (metis Suc_lessD par_xstate_list_rel_dest1 par_xstate_list_rel_dest2\n     par_xstate_list_rel_dest3 par_xstate_rel_seq)\n\nlemma par_xstate_list_rel_step_c_s:\n  \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n   Suc j<length s \\<Longrightarrow>\n    \\<Gamma>\\<turnstile>\\<^sub>c(fst(p!j), toSeq (toSeqState i (snd (p!j))))  \\<rightarrow> \n       (fst(p!(Suc j)), toSeq (toSeqState i (snd (p!(Suc j))))) \\<Longrightarrow>\n    \\<Gamma>\\<turnstile>\\<^sub>c(fst(s!j), toSeq ((snd (s!j))))  \\<rightarrow> \n       (fst(s!(Suc j)), toSeq (snd (s!(Suc j))))\"\n  by (metis Suc_lessD par_xstate_list_rel_dest1 par_xstate_list_rel_dest2 \n    par_xstate_list_rel_dest3 par_xstate_rel_seq)\n  \n\nlemma par_xstate_list_rel_step_c_p:\n  \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n   Suc j<length s \\<Longrightarrow>\n   \\<Gamma>\\<turnstile>\\<^sub>c(fst(s!j), toSeq ((snd (s!j))))  \\<rightarrow> \n       (fst(s!(Suc j)), toSeq (snd (s!(Suc j)))) \\<Longrightarrow>\n    \\<Gamma>\\<turnstile>\\<^sub>c(fst(p!j), toSeq (toSeqState i (snd (p!j))))  \\<rightarrow> \n       (fst(p!(Suc j)), toSeq (toSeqState i (snd (p!(Suc j)))))\"\n  by (metis Suc_lessD par_xstate_list_rel_dest1 par_xstate_list_rel_dest2 \n    par_xstate_list_rel_dest3 par_xstate_rel_seq)\n\nlemma par_xstate_list_Fault_i_s:\n  \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n   j<length s \\<Longrightarrow>\n   fst (p!j) \\<noteq> Fault F \\<Longrightarrow>\n   fst (s!j) \\<noteq> Fault F \"\n  by (simp add: par_xstate_list_rel_dest3)\n\n\nlemma par_xstate_list_Fault_i_p:\n  \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n   j<length s \\<Longrightarrow>\n   fst (s!j) \\<noteq> Fault F \\<Longrightarrow>\n   fst (p!j) \\<noteq> Fault F \"\nby (simp add: par_xstate_list_rel_dest3)\n\n\nlemma par_xstate_list_Fault_s:\n  \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n   s\\<noteq>[] \\<Longrightarrow>\n   fst (last p) \\<noteq> Fault F \\<Longrightarrow>\n   fst (last s) \\<noteq> Fault F \"\nproof -\n  assume a1: \"s \\<noteq> []\"\n  assume a2: \"(s, p) \\<in> par_state_list_rel i\"\n  assume a3: \"fst (last p) \\<noteq> com.Fault F\"\n  have \"0 < length s\"\n    using a1 by blast\n  then show ?thesis\n    using a3 a2 a1 by (simp add: last_conv_nth par_xstate_list_rel_dest1 par_xstate_list_rel_dest3)\nqed\n  \n\nlemma par_xstate_list_Fault_p:\n  \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n   s\\<noteq>[] \\<Longrightarrow>  \n   fst (last s) \\<noteq> Fault F \\<Longrightarrow> \n    fst (last p) \\<noteq> Fault F\"\n  using par_xstate_list_Fault_i_p\n  by (metis diff_less last_conv_nth length_greater_0_conv \n     less_numeral_extra(1) par_xstate_list_rel_dest1)\n\nlemma par_xstate_list_Fault_set_s:\n  \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n   s\\<noteq>[] \\<Longrightarrow>\n   fst (last p) \\<notin> Fault ` F \\<Longrightarrow>\n   fst (last s) \\<notin> Fault ` F \"\n  by (simp add: image_iff par_xstate_list_Fault_s)\n\nlemma par_xstate_list_Fault_set_p:\n  \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n   s\\<noteq>[] \\<Longrightarrow>  \n   fst (last s) \\<notin> Fault ` F \\<Longrightarrow> \n    fst (last p) \\<notin> Fault ` F\"\n  by (simp add: image_iff par_xstate_list_Fault_p)\n\nlemma par_xstate_list_final_s:\n  \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n   s\\<noteq>[] \\<Longrightarrow> final_glob_p (last p) \\<Longrightarrow>\n   final_glob (last s)\"\nproof-\n  assume a0:\"(s,p) \\<in> par_state_list_rel i\" and\n         a1:\"s\\<noteq>[]\" and\n         a2:\"final_glob_p (last p)\"\n  then  have \"length s = length p\"\n      using  par_xstate_list_rel_dest1 by blast\n            \n  then show ?thesis\n    using  a1 a2 unfolding final_glob_def final_glob_p_def apply auto\n       apply (metis a0 diff_less last_conv_nth length_greater_0_conv par_xstate_list_rel_dest3 \n                  zero_less_one)\n       apply (metis \\<open>length s = length p\\<close> a0 diff_less last_conv_nth length_greater_0_conv \n                   par_xstate_list_rel_dest3 zero_less_one)\n      apply (metis \\<open>length s = length p\\<close> a0 diff_less last_conv_nth \n                   length_greater_0_conv par_xstate_list_rel_dest3 zero_less_one)\n    by (metis \\<open>length s = length p\\<close> a0 diff_less last_conv_nth \n                  length_greater_0_conv par_xstate_list_rel_dest3 zero_less_one)    \nqed\n\nlemma par_xstate_list_final_p:\n  \"(s,p) \\<in> par_state_list_rel i \\<Longrightarrow>\n   s\\<noteq>[] \\<Longrightarrow> final_glob (last s) \\<Longrightarrow>\n   final_glob_p (last p)\"\nproof-\n  assume a0:\"(s,p) \\<in> par_state_list_rel i\" and\n         a1:\"s\\<noteq>[]\" and\n         a2:\"final_glob (last s)\"\n  then  have \"length s = length p\"\n      using  par_xstate_list_rel_dest1 by blast\n  then have  \"(snd (last s), snd(last p)) \\<in>par_state_rel i\"\n    by (metis (no_types) a0 a1 diff_less last_conv_nth \n             length_greater_0_conv less_numeral_extra(1) par_xstate_list_rel_dest2)            \n  then show ?thesis\n    using  a1 a2 unfolding final_glob_def final_glob_p_def apply auto\n       apply (metis \\<open>length s = length p\\<close> a0 diff_less last_conv_nth length_greater_0_conv \n                   par_xstate_list_rel_dest3 zero_less_one)\n      apply (metis \\<open>length s = length p\\<close> a0 diff_less last_conv_nth \n                   length_greater_0_conv par_xstate_list_rel_dest3 zero_less_one)\n     apply (metis \\<open>length s = length p\\<close> a0 diff_less last_conv_nth \n                  length_greater_0_conv par_xstate_list_rel_dest3 zero_less_one)    \n    by (metis \\<open>length s = length p\\<close> a0 diff_less last_conv_nth \n          length_greater_0_conv par_xstate_list_rel_dest3 zero_less_one) \n \nqed\n\nlemma par_xstate_list_rel_program:  \n  assumes \n  a0:\"(s,p) \\<in> par_state_list_rel i\" and\n  a1:\"j<length s\"\nshows  \"fst (p!j) = fst (s!j)\"\nproof-\n  show ?thesis using a0 a1\n    using par_xstate_list_rel_dest1 par_xstate_list_rel_dest3 by fastforce\nqed                        \n\nlemma par_xstate_list_rel_in_post_p:  assumes \n  a0:\"(s,p) \\<in> par_state_list_rel i\" and\n  a1:\"s\\<noteq>[]\" and\n  a2:\"snd (last s) \\<in> Seq_pred i q\" and\n  a3:\"\\<forall>e\\<in>q. i<length (snd e)\"\nshows \"snd (last p) \\<in> q\"\nproof-\n  have \"length s = length p\"\n      using  a0 par_xstate_list_rel_dest1 by blast  \n  then have  rel:\"(snd (last s), snd(last p)) \\<in>par_state_rel i\"\n    by (metis (no_types) a0 a1 diff_less last_conv_nth \n             length_greater_0_conv less_numeral_extra(1) par_xstate_list_rel_dest2)     \n  then show ?thesis\n    using a2 a3  rel unfolding Seq_pred_def    \n  by (metis Par_Seq_pred_ID Par_pred_def Seq_pred_def imageI par_xstate_rel_par)\n                                                           \nqed\n\nlemma par_xstate_list_rel_in_post_s:  \n  assumes \n  a0:\"(s,p) \\<in> par_state_list_rel i\" and\n  a1:\"s\\<noteq>[]\" and\n  a2:\"snd (last p) \\<in> q\" \nshows \"snd (last s) \\<in> Seq_pred i q\"\nproof-\n have \"length s = length p\"\n      using  a0 par_xstate_list_rel_dest1 by blast  \n then have  rel:\"(snd (last s), snd(last p)) \\<in>par_state_rel i\"\n    by (metis (no_types) a0 a1 diff_less last_conv_nth \n             length_greater_0_conv less_numeral_extra(1) par_xstate_list_rel_dest2)\n  thus ?thesis using a2 \n    using Seq_pred_def par_xstate_rel_seq\n    by (metis image_eqI )\nqed\n\nlemma par_xstate_list_rel_in_post_p_eq_state:  assumes \n  a0:\"(s,p) \\<in> par_state_list_rel i\" and\n  a1:\"s\\<noteq>[]\" and\n  a2:\"snd (last s) = (toSeqState i ns) \\<and> (toSeqState i ns) \\<in> Seq_pred i q\" and\n  a3:\"\\<forall>e\\<in>q. i<length (snd e)\" and a4:\"i<length (snd ns)\"\nshows \"snd (last p) \\<in> q\" \nproof-\n  have \"length s = length p\"\n      using  a0 par_xstate_list_rel_dest1 by blast  \n  then have  rel:\"(snd (last s), snd(last p)) \\<in>par_state_rel i\"\n    by (metis (no_types) a0 a1 diff_less last_conv_nth \n             length_greater_0_conv less_numeral_extra(1) par_xstate_list_rel_dest2)     \n  then show ?thesis\n    using a2 a3 a4 rel unfolding Seq_pred_def\n    by (metis (no_types, lifting)  a0 a1 a2 par_xstate_list_rel_in_post_p) \n                                                           \nqed\n\n\nlemma par_xstate_list_rel_in_post_s_state:  \n  assumes \n  a0:\"(s,p) \\<in> par_state_list_rel i\" and\n  a1:\"s\\<noteq>[]\" and\n  a2:\"snd (last p)\\<in> q\" \nshows \"snd (last s) =  (toSeqState i (snd (last p))) \\<and> toSeqState i  (snd (last p)) \\<in> Seq_pred i q\"\nproof-\n have \"length s = length p\"\n      using  a0 par_xstate_list_rel_dest1 by blast  \n then have  rel:\"(snd (last s), snd(last p)) \\<in>par_state_rel i\"\n    by (metis (no_types) a0 a1 diff_less last_conv_nth \n             length_greater_0_conv less_numeral_extra(1) par_xstate_list_rel_dest2)\n  thus ?thesis using a2 par_xstate_rel_seq[OF rel]\n    unfolding Seq_pred_def by auto\nqed\n\nlemma par_xstate_list_rel_in_g_s: \nassumes \n  a0:\"(s,p) \\<in> par_state_list_rel i\" and \n  a2:\"Suc j < length s\" and\n  a3:\"(snd (p!j), snd(p!(Suc j))) \\<in> G\" \nshows \"(snd (s!j), snd(s!(Suc j))) \\<in> Seq_rel i G\"\nproof-\n  have  rel_j:\"(snd (s!j), snd(p!j)) \\<in>par_state_rel i\" and\n        rel_sj:\"(snd (s!(Suc j)), snd(p!(Suc j))) \\<in>par_state_rel i\" \n     by (metis (no_types) Suc_lessD a0 a2 par_xstate_list_rel_dest1 par_xstate_list_rel_dest2)+   \n   thus ?thesis using a2 a3 unfolding Seq_rel_def split_beta image_def \n     apply auto\n     by (metis fst_conv par_xstate_rel_seq snd_conv)\n qed\n\nlemma par_xstate_list_rel_in_g_p: \nassumes \n  a0:\"(s,p) \\<in> par_state_list_rel i\" and  \n  a2:\"Suc j < length s\" and\n  a3:\"(snd (s!j), snd(s!(Suc j))) \\<in> Seq_rel i G\"  and\n  a4:\"\\<forall>(x,y)\\<in>G. ( i<length (snd x)) \\<and> ( i<length (snd y)) \"\nshows \"(snd (p!j), snd(p!(Suc j))) \\<in> G\"\nproof-\n  have  rel_j:\"(snd (s!j), snd(p!j)) \\<in>par_state_rel i\" and\n        rel_sj:\"(snd (s!(Suc j)), snd(p!(Suc j))) \\<in>par_state_rel i\" \n     by (metis (no_types) Suc_lessD a0 a2 par_xstate_list_rel_dest1 par_xstate_list_rel_dest2)+   \n   thus ?thesis using a2 a3 a4 unfolding Seq_rel_def split_beta image_def \n     apply auto\n     by (metis Seq2Par fst_conv par_xstate_rel_par snd_conv)\nqed\n\nabbreviation (input)\n  set_fun :: \"'a set \\<Rightarrow> 'a \\<Rightarrow> bool\"  (\"_\\<^sub>f\") where\n  \"set_fun s \\<equiv> \\<lambda>v. v\\<in>s\"\n\nabbreviation (input)\n  fun_set :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a set\"  (\"_\\<^sub>s\") where\n  \"fun_set f \\<equiv> {\\<sigma>. f \\<sigma>}\"\n\n\nlemma tl_pair:\"Suc (Suc j) < length l \\<Longrightarrow>     \n       l1 = tl l \\<Longrightarrow>\n       P (l!(Suc j)) (l!(Suc (Suc j)))=\n       P  (l1!j) (l1!(Suc j))\"\nby (simp add: tl_zero_eq)\n\nlemma for_all_k_sublist:\nassumes a0:\"Suc (Suc j)<length l\" and\n      a1:\"(\\<forall>k < j. P ((tl l)!k) ((tl l)!(Suc k)))\" and\n      a2:\"P (l!0) (l!(Suc 0))\" \nshows \"(\\<forall>k < Suc j.  P (l!k) (l!(Suc k)))\"\nproof -\n  {fix k\n   assume aa0:\"k < Suc j\"\n   have \"P (l!k) (l!(Suc k))\"\n   proof (cases k)\n     case 0 thus ?thesis using a2 by auto\n   next\n     case (Suc k1) thus ?thesis using aa0 a0 a1 a2\n       by (metis SmallStepCon.nth_tl Suc_less_SucD dual_order.strict_trans length_greater_0_conv nth_Cons_Suc zero_less_Suc)\n   qed\n  } thus ?thesis by auto\nqed\n\n\nsubsection \\<open>Validity for Component Programs.\\<close>\n\n\ntype_synonym ('g,'l,'p,'f,'e) p_rgformula =  \n   \"(('g \\<times> 'l,'p,'f,'e)com \\<times>      \n    (('g,'l)par_state set) \\<times>         \n    ((('g,'l)par_state) tran) set \\<times>\n    ((('g,'l)par_state) tran) set \\<times>\n    (('g,'l)par_state set) \\<times> \n    (('g,'l)par_state set))\" (* A *)\n    \ntype_synonym ('g,'l,'p) p_sextuple =  \n   \"('p \\<times>     \n    (('g,'l)par_state set) \\<times>         \n    ((('g,'l)par_state) tran) set \\<times> \n    ((('g,'l)par_state) tran) set \\<times> \n    (('g,'l)par_state set) \\<times>\n    (('g,'l)par_state set))\" (* A *) \n\ntype_synonym ('g,'l,'p,'f,'e) c_rgformula =  \n   \"(('g \\<times> 'l,'p,'f,'e)com \\<times>      \n     ('g,'l) c_state  set \\<times>         \n    ((('g,'l) c_state) tran) set \\<times>\n    ( (('g,'l) c_state) tran) set \\<times>\n    ('g,'l) c_state set \\<times> \n    ('g,'l) c_state  set)\" (* A *)\n\ntype_synonym ('g,'l,'p) c_sextuple =  \n   \"('p \\<times>     \n     ('g,'l) c_state set \\<times>         \n    ((('g,'l) c_state)tran) set \\<times>\n    ((('g,'l) c_state) tran) set \\<times>\n    ('g,'l) c_state  set \\<times> \n    ('g,'l) c_state  set)\" (* A *)    \n\ndefinition Sta :: \"'s set \\<Rightarrow> ('s tran) set \\<Rightarrow> bool\" where\n  \"Sta \\<equiv> \\<lambda>f g. (\\<forall>x y.  x \\<in> f \\<longrightarrow>  (x,y)\\<in> g \\<longrightarrow> y \\<in> f)\"\n\nlemma Sta_intro:\"Sta a R \\<Longrightarrow> Sta b R \\<Longrightarrow> Sta (a \\<inter> b) R\"\nunfolding Sta_def by fastforce\n\nlemma Sta_assoc:\"Sta (a \\<inter> (b \\<inter> c)) R = Sta ((a\\<inter>b)\\<inter>c) R\"\nunfolding Sta_def by blast\n\nlemma Sta_comm:\"Sta (a \\<inter> b) R = Sta (b \\<inter> a) R\" \nunfolding Sta_def by blast\n\nlemma Sta_add:\"Sta (a \\<inter> b) R \\<Longrightarrow> Sta (a \\<inter> c) R \\<Longrightarrow>\n       Sta (a \\<inter> b \\<inter> c) R\"\nunfolding Sta_def by blast\n\nlemma Sta_tran:\"Sta a R \\<Longrightarrow> a = b \\<Longrightarrow> Sta b R\"\nby auto\n\n(* definition Norm:: \"(('s) tran) set \\<Rightarrow> bool\" where\n  \"Norm \\<equiv> \\<lambda>g. (\\<forall>x y. (x, y) \\<in> g \\<longrightarrow> (\\<exists>x' y'. x=Normal x' \\<and> y=Normal y'))\" *)\n\ndefinition env_tran::\n    \"('p \\<Rightarrow> ('g\\<times>'l, 'p, 'f,'e) LanguageCon.com option)\n     \\<Rightarrow> (('g,'l) c_state set)\n        \\<Rightarrow> (('g\\<times>'l, 'p, 'f,'e) LanguageCon.com \\<times> (('g,'l) c_state)) list\n           \\<Rightarrow> (('g,'l) c_state) tran set \\<Rightarrow> bool\"\nwhere\n\"env_tran \\<Gamma> q l rely \\<equiv> snd(l!0) \\<in>  q \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n                 \\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                  \n                   (snd(l!i), snd(l!(Suc i))) \\<in> rely)\n\"\n\ndefinition env_tran_right::\n    \"('p \\<Rightarrow> ('g\\<times>'l, 'p, 'f,'e) LanguageCon.com option)     \n        \\<Rightarrow> (('g\\<times>'l, 'p, 'f,'e) LanguageCon.com \\<times> ('g,'l) c_state) list\n           \\<Rightarrow> (('g,'l) c_state) tran set \\<Rightarrow> bool\"\nwhere\n\"env_tran_right \\<Gamma> l rely \\<equiv> \n   (\\<forall>i. Suc i<length l \\<longrightarrow> \n        \\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                  \n        (snd(l!i), snd(l!(Suc i))) \\<in> rely)\n\"\n\nlemma env_tran_tail:\"env_tran_right \\<Gamma> (x#l) R \\<Longrightarrow> env_tran_right \\<Gamma> l R\"\nunfolding env_tran_right_def\nby fastforce\n\nlemma env_tran_subr:\nassumes a0:\"env_tran_right \\<Gamma> (l1@l2) R\"\nshows \"env_tran_right \\<Gamma> l1 R\"\nunfolding env_tran_right_def\nproof -\n  { fix i\n    assume a1:\"Suc i< length l1\"\n    assume a2:\"\\<Gamma>\\<turnstile>\\<^sub>c (l1 ! i) \\<rightarrow>\\<^sub>e (l1 ! Suc i)\"\n    then have \"Suc i < length (l1@l2)\" using a1 by fastforce\n    also then have \"\\<Gamma>\\<turnstile>\\<^sub>c ((l1@l2) ! i) \\<rightarrow>\\<^sub>e ((l1@l2) ! Suc i)\" \n      by (simp add: Suc_lessD a1 a2 nth_append)    \n    ultimately have f1:\"(snd ((l1@l2)! i), snd ((l1@l2) ! Suc i)) \\<in> R\"\n      using a0 unfolding env_tran_right_def by auto\n    then have \"(snd (l1! i), snd (l1 ! Suc i)) \\<in>  R\"\n      using a1 by (simp add: nth_append)\n  } then show \n   \"\\<forall>i. Suc i < length l1 \\<longrightarrow>\n        \\<Gamma>\\<turnstile>\\<^sub>c (l1 ! i) \\<rightarrow>\\<^sub>e (l1 ! Suc i) \\<longrightarrow>\n        (snd (l1 ! i), snd (l1 ! Suc i)) \\<in> R\"\n   by blast\nqed\n\ndefinition Satis where \"Satis \\<equiv> True\"\n\n\nlemma env_tran_subl:\"env_tran_right \\<Gamma> (l1@l2) R \\<Longrightarrow> env_tran_right \\<Gamma> l2 R\"\nproof (induct \"l1\")\n  case Nil thus ?case by auto\nnext\n  case (Cons a l1) thus ?case by (fastforce intro:append_Cons env_tran_tail )\nqed\n\nlemma env_tran_R_R':\"env_tran_right \\<Gamma> l R \\<Longrightarrow>  \n                     (R  \\<subseteq> R') \\<Longrightarrow>\n                     env_tran_right \\<Gamma> l R'\"\nunfolding env_tran_right_def Satis_def \napply clarify\napply (erule allE)\napply auto\ndone\n\n\nlemma env_tran_normal:\nassumes a0:\"env_tran_right \\<Gamma> l rely \\<and> Sta q rely \\<and>  snd(l!i) \\<in>q\" and\n        a1:\"Suc i < length l \\<and>  \\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i))\"\nshows \"snd(l!(Suc i)) \\<in>q\"\nusing a0 a1 unfolding env_tran_right_def Sta_def by blast\n\n \ndefinition assum :: \n  \"(('g,'l) c_state set \\<times> (('g,'l) c_state) tran set) \\<Rightarrow> (('g,'l,'p,'f,'e) confs) set\" where\n  \"assum \\<equiv> \\<lambda>(pre, rely). \n             {c. snd((snd c)!0) \\<in>  pre \\<and> \n                 (\\<forall>i. Suc i<length (snd c) \\<longrightarrow> \n                 (fst c)\\<turnstile>\\<^sub>c((snd c)!i)  \\<rightarrow>\\<^sub>e ((snd c)!(Suc i)) \\<longrightarrow>                  \n                   (snd((snd c)!i), snd((snd c)!(Suc i))) \\<in>  rely)}\"\n\ndefinition assum1 :: \n  \"(('g,'l) c_state set \\<times> (('g,'l) c_state) tran set) \\<Rightarrow>\n   'f set \\<Rightarrow>\n     (('g,'l,'p,'f,'e) confs) set\" where\n  \"assum1 \\<equiv> \\<lambda>(pre, rely) F. \n             {(\\<Gamma>,comp). snd(comp!0) \\<in>  pre \\<and> \n                 (\\<forall>i. Suc i<length comp \\<longrightarrow> \n                  \\<Gamma>\\<turnstile>\\<^sub>c(comp!i)  \\<rightarrow>\\<^sub>e (comp!(Suc i)) \\<longrightarrow>                  \n                   (snd(comp!i), snd(comp!(Suc i))) \\<in>  rely)}\"\n\n\ndefinition assum_p :: \n  \"nat \\<Rightarrow> (('g,'l) par_state set \\<times> (('g,'l) par_state) tran set) \\<Rightarrow> \n             (('g,'l,'p,'f,'e) gconfs) set\" where\n  \"assum_p i \\<equiv> \\<lambda>(pre, rely).                     \n     {(s,p). fst s = fst p \\<and> (snd s, snd p)\\<in>par_state_list_rel i}  `` \n           (assum (Seq_pred i pre, Seq_rel i rely))\"\n\ndefinition assum_p1 :: \n  \"nat \\<Rightarrow> (('g,'l) par_state set \\<times> (('g,'l) par_state) tran set) \\<Rightarrow> \n              (('g,'l,'p,'f,'e) gconfs) set\" where\n  \"assum_p1 m \\<equiv> \\<lambda>(pre, rely). \n             {c. snd((snd c)!0) \\<in>  pre \\<and> \n                 (\\<forall>i. Suc i<length (snd c) \\<longrightarrow> \n                 (fst c)\\<turnstile>\\<^sub>c(fst((snd c)!i), toSeqState m (snd((snd c)!i)))  \\<rightarrow>\\<^sub>e \n                          (fst((snd c)!(Suc i)), toSeqState m (snd((snd c)!(Suc i))))  \\<longrightarrow>                  \n                   (snd((snd c)!i), snd((snd c)!(Suc i))) \\<in>  rely)}\"\n\nlemma p1:\"\\<forall>e\\<in>P::('b\\<times>'c list) set. i< length (snd e) \\<Longrightarrow>\n         \\<forall>t\\<in>R:: (('b \\<times> 'c list)  \\<times> ('b \\<times> 'c list) ) set. \n                i<length (snd  (fst t)) \\<and> i<length (snd (snd t) ) \\<Longrightarrow> lp\\<noteq>[] \\<Longrightarrow> \n          (\\<Gamma>,lp) \\<in> assum_p i (P,R) \\<Longrightarrow> (\\<Gamma>,lp) \\<in> assum_p1 i (P,R)\"\n  unfolding assum_p_def assum_p1_def assum_def Let_def split_beta Seq_pred_def   \nproof auto\n  fix ls  pg pls\n  assume a0:\"\\<forall>e\\<in>P. i< length (snd e)\" and \n         a1:\"(ls, lp) \\<in> par_state_list_rel i\" and \n          a2:\"snd (ls ! 0) =  (toSeqState i (pg, pls))\" and  a4:\"(pg, pls) \\<in> P\" and\n          a5: \"lp\\<noteq>[]\"   \n  have rel:\"(snd (ls ! 0), snd (lp ! 0))\\<in>par_state_rel i\" using a1 a5\n    by (metis (no_types, lifting) Product_Type.Collect_case_prodD fst_conv length_greater_0_conv \n              list_all2_conv_all_nth par_state_list_rel_def snd_conv)   \n  have \"snd (lp ! 0) =   (toParState i (toSeqState i (pg, pls)))\" \n    using a2 par_xstate_rel_par rel by fastforce        \n  moreover  have len_i:\"i< length (pls)\" using a0 a4 by auto\n  ultimately show \"snd (lp ! 0) \\<in> P\" \n    by (simp add: Seq2Par a4)\nnext\n  fix  ls  j\n  assume a0:\"\\<forall>e\\<in>P. i< length (snd e)\" and  \n        a1:\"(ls, lp) \\<in> par_state_list_rel i\" and\n        a2:\"\\<forall>ia. Suc ia < length ls \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (ls ! ia) \\<rightarrow>\\<^sub>e (ls ! Suc ia) \\<longrightarrow> \n             (snd (ls ! ia), snd (ls ! Suc ia)) \\<in> Seq_rel i R\" and        \n        a6:\"Suc j < length lp\" and\n        a7:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (lp ! j), toSeqState i (snd (lp ! j))) \\<rightarrow>\\<^sub>e \n                (fst (lp ! Suc j), toSeqState i (snd (lp ! Suc j)))\" and \n        a8:\"\\<forall>t\\<in>R. i < length (snd (fst t)) \\<and> i < length (snd (snd t))\"\n  then have rel:\"(snd (ls ! j), snd (lp ! j))\\<in>par_state_rel i\" and  \"fst (ls!j) = fst(lp!j)\" and\n            relsuc:   \"(snd (ls ! Suc j), snd (lp ! Suc j))\\<in>par_state_rel i\" and \"fst (ls!Suc j) = fst(lp!Suc j)\"\n    unfolding par_state_list_rel_def\n    by (auto simp add: a0 a2 a6 Suc_lessD list_all2_conv_all_nth)   \n  moreover have  \"snd (ls ! j) = toSeqState i (snd (lp ! j))\" and                  \n              \"snd (ls ! (Suc j)) = toSeqState i (snd (lp ! (Suc j)))\" \n    using calculation par_xstate_rel_seq  par_xstate_rel_par\n    by blast+\n  ultimately have \"(snd (ls ! j), snd (ls ! Suc j)) \\<in> Seq_rel i R\" using a2 a7 a1 a6\n    unfolding par_state_list_rel_def\n    by (metis (no_types, lifting) Product_Type.Collect_case_prodD \n              fst_conv list_all2_lengthD prod.collapse snd_conv)      \n  then show \"(snd (lp ! j), snd (lp ! Suc j)) \\<in> R\"\n    unfolding Seq_rel_def apply auto using  rel relsuc  par_xstate_rel_par a8\n    by (metis Seq2Par fst_conv snd_conv)\nqed\n\n  \n\nlemma p2:\"\\<forall>j<length lp. i<length (snd (snd (lp!j))) \\<Longrightarrow> lp\\<noteq>[] \\<Longrightarrow> \n          (\\<Gamma>,lp) \\<in> assum_p1 i (P,R) \\<Longrightarrow> (\\<Gamma>,lp) \\<in> assum_p i (P,R)\"\nproof (auto simp add:  Let_def split_beta Seq_pred_def image_def  assum_p_def assum_p1_def assum_def ) \n  assume a00:\"\\<forall>j<length lp. i < length (snd (snd (lp ! j)))\" and          \n         a03:\"lp \\<noteq> []\" and\n         a04:\"\\<forall>ia. Suc ia < length lp \\<longrightarrow>\n          \\<Gamma>\\<turnstile>\\<^sub>c (fst (lp ! ia), toSeqState i (snd (lp ! ia))) \\<rightarrow>\\<^sub>e\n                (fst (lp ! Suc ia), toSeqState i (snd (lp ! Suc ia))) \\<longrightarrow>\n          (snd (lp ! ia), snd (lp ! Suc ia)) \\<in> R\" and\n         a05: \"snd (lp ! 0) \\<in> P\" \n  then have xstate_rel:\"(toSeqCptn i lp, lp)\\<in> (par_state_list_rel i)\"\n     by (simp add: toSeqCptn_in_rel)\n  then have \"(toSeqCptn i lp)!0 = (fst (lp!0),toSeqState i (snd (lp!0)))\"\n    by (simp add: a03 toSeqCptn_j)  \n  moreover obtain gs ls lss where \"snd ((toSeqCptn i lp)!0) = ((gs,ls),lss)\"\n    using a00 a03   by (auto simp add: toSeqState_def Let_def split_beta toSeqCptn_j a03) \n  ultimately have \"snd (lp ! 0) \\<in>P \\<and> ((gs,ls),lss) =  toSeqState i (snd (lp ! 0)) \\<and> \n                   snd ((toSeqCptn i lp)!0) =((gs,ls),lss)\"\n    using a05  by auto\n  moreover have \"(\\<forall>ia. Suc ia < length (toSeqCptn i lp) \\<longrightarrow>\n                   \\<Gamma>\\<turnstile>\\<^sub>c ((toSeqCptn i lp) ! ia) \\<rightarrow>\\<^sub>e ((toSeqCptn i lp) ! Suc ia) \\<longrightarrow> \n                   (snd ((toSeqCptn i lp) ! ia), snd ((toSeqCptn i lp) ! Suc ia)) \\<in> Seq_rel i R)\"\n    by (metis Suc_lessD a04 par_xstate_list_rel_dest1 \n                 par_xstate_list_rel_in_g_s toSeqCptn_j xstate_rel)  \n  ultimately show \"\\<exists>b. (\\<exists>x\\<in>P. snd (b ! 0) = toSeqState i x) \\<and>\n                      (\\<forall>ia. Suc ia < length b \\<longrightarrow>\n                          \\<Gamma>\\<turnstile>\\<^sub>c (b ! ia) \\<rightarrow>\\<^sub>e (b ! Suc ia) \\<longrightarrow> \n                        (snd (b ! ia), snd (b ! Suc ia)) \\<in> Seq_rel i R) \\<and>\n                        (b, lp) \\<in> par_state_list_rel i\"\n    using xstate_rel by fastforce\n  qed\n\nlemma assum_R_R': \n  \"(\\<Gamma>, l) \\<in> assum(p, R) \\<Longrightarrow>\n    snd(l!0) \\<in>  p' \\<Longrightarrow>\n    R \\<subseteq> R'  \\<Longrightarrow> \n   (\\<Gamma>, l) \\<in> assum(p', R')\"\nproof -\nassume a0:\"(\\<Gamma>, l) \\<in> assum(p, R)\" and\n       a1:\"snd(l!0) \\<in> p'\" and\n       a2: \" R \\<subseteq> R'\"\n  then have \"env_tran_right \\<Gamma> l R\" \n    unfolding assum_def using env_tran_right_def\n    by force\n  then have \"env_tran_right \\<Gamma> l R'\" \n    using  a2 env_tran_R_R' by blast\n  thus ?thesis using a1 unfolding assum_def unfolding env_tran_right_def\n    by fastforce\nqed\n\n\nlemma same_prog_p:\n  \"(\\<Gamma>,(P,s)#(P,t)#l)\\<in>cptn \\<Longrightarrow>\n   (\\<Gamma>,(P,s)#(P,t)#l) \\<in> assum (p,R) \\<Longrightarrow>\n   Sta p R  \\<Longrightarrow>\n   t \\<in> p\n  \" \nproof -\nassume a0: \"(\\<Gamma>,(P,s)#(P,t)#l)\\<in>cptn\" and\n         a1: \"(\\<Gamma>,(P,s)#(P,t)#l) \\<in> assum (p,R)\" and\n         a2: \"Sta p R\"\n  then have \"Suc 0 < length ((P,s)#(P,t)#l)\" \n    by fastforce\n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (P,s)  \\<rightarrow>\\<^sub>c\\<^sub>e (P,t)\" \n    using a0 cptn_stepc_rtran by fastforce \n  then have step_ce:\"\\<Gamma>\\<turnstile>\\<^sub>c(((P,s)#(P,t)#l)!0)  \\<rightarrow>\\<^sub>e (((P,s)#(P,t)#l)!(Suc 0)) \\<or>\n             \\<Gamma>\\<turnstile>\\<^sub>c (P, toSeq s)  \\<rightarrow> (P,toSeq t)\"\n    using  step_ce_dest by fastforce  \n  then have s:\"s \\<in> p\" \n    using a1 unfolding assum_def by fastforce\n  have \"t \\<in> p \"\n  using step_ce\n  proof\n    {assume step_e:\"\\<Gamma>\\<turnstile>\\<^sub>c ((P, s) # (P, t) # l) ! 0 \\<rightarrow>\\<^sub>e\n          ((P, s) # (P, t) # l) ! Suc 0\"\n     have ?thesis \n     using a2 a1 s unfolding Sta_def assum_def \n     proof -\n       have \"(Suc 0 < length ((P, s) # (P, t) # l))\"\n         by fastforce\n       then have assm:\"(s, t) \\<in> R\"\n         using s a1 step_e\n         unfolding assum_def  by fastforce       \n       then have R:\"(s,t)\\<in>R\" \n         using assm  unfolding Satis_def by fastforce\n       thus ?thesis \n         using a2 s  R unfolding Sta_def by blast       \n     qed thus ?thesis by auto\n    } \n    next\n    { \n      assume step:\"\\<Gamma>\\<turnstile>\\<^sub>c (P, toSeq s) \\<rightarrow> (P, toSeq t)\"\n      then show ?thesis\n        by (simp add: mod_env_not_component) \n    } \n  qed\n  thus  ?thesis by auto\nqed \n\nlemma tl_of_assum_in_assum:\n  \"(\\<Gamma>,(P,s)#(P,t)#l)\\<in>cptn \\<Longrightarrow>\n   (\\<Gamma>,(P,s)#(P,t)#l) \\<in> assum (p,R) \\<Longrightarrow>\n   Sta p R  \\<Longrightarrow>\n   (\\<Gamma>,(P,t)#l) \\<in> assum (p,R)\n  \" \nproof -\n  assume a0: \"(\\<Gamma>,(P,s)#(P,t)#l)\\<in>cptn\" and\n         a1: \"(\\<Gamma>,(P,s)#(P,t)#l) \\<in> assum (p,R)\" and\n         a2: \"Sta p R \"\n  \n  then have t1:\"t \\<in>p\" \n   using same_prog_p by blast\n  then have \"env_tran_right \\<Gamma> ((P,s)#(P,t)#l) R\"\n    using env_tran_right_def a1 unfolding assum_def\n    by force\n  then have \"env_tran_right \\<Gamma> ((P,t)#l) R\"\n    using env_tran_tail\n    by blast\n  thus ?thesis using t1 unfolding assum_def env_tran_right_def by auto\nqed\n \nlemma tl_of_assum_in_assum1:\n  \"(\\<Gamma>,(P,s)#(Q,t)#l)\\<in>cptn \\<Longrightarrow>\n   (\\<Gamma>,(P,s)#(Q,t)#l) \\<in> assum (p,R) \\<Longrightarrow>\n   t \\<in> q \\<Longrightarrow>\n   (\\<Gamma>,(Q,t)#l) \\<in> assum (q,R) \n  \" \nproof -\n  assume a0: \"(\\<Gamma>,(P,s)#(Q,t)#l)\\<in>cptn\" and\n         a1: \"(\\<Gamma>,(P,s)#(Q,t)#l) \\<in> assum (p,R)\" and\n         a2: \"t \\<in> q\"  \n  then have \"env_tran_right \\<Gamma> ((P,s)#(Q,t)#l) R\"\n    using env_tran_right_def a1 unfolding assum_def\n    by force\n  then have \"env_tran_right \\<Gamma> ((Q,t)#l) R\"\n    using env_tran_tail by blast\n  thus ?thesis using a2 unfolding assum_def env_tran_right_def by auto\nqed\n            \nlemma sub_assum:\n  assumes a0: \"(\\<Gamma>,(x#l0)@l1) \\<in> assum (p,R)\"\n  shows \"(\\<Gamma>,x#l0) \\<in> assum (p,R)\"    \nproof -\n  {have p0:\"snd x \\<in>  p\" \n    using a0 unfolding assum_def by force\n  then have \"env_tran_right \\<Gamma> ((x#l0)@l1) R\"\n    using a0 unfolding assum_def \n    by (auto simp add: env_tran_right_def)\n  then have env:\"env_tran_right \\<Gamma> (x#l0) R\" \n    using env_tran_subr by blast \n  also have \"snd ((x#l0)!0)  \\<in>  p\" \n    using p0 by fastforce\n  ultimately have \"snd ((x#l0)!0)  \\<in> p \\<and> \n                  (\\<forall>i. Suc i<length (x#l0) \\<longrightarrow> \n                       \\<Gamma>\\<turnstile>\\<^sub>c((x#l0)!i)  \\<rightarrow>\\<^sub>e ((x#l0)!(Suc i)) \\<longrightarrow>                  \n                       (snd((x#l0)!i), snd((x#l0)!(Suc i))) \\<in> R)\"\n   unfolding env_tran_right_def by auto\n  }    \n  then show ?thesis  unfolding assum_def by auto\nqed      \n\nlemma sub_assum_r:\n  assumes a0: \"(\\<Gamma>,l0@x1#l1) \\<in> assum (p,R)\" and\n          a1: \"(snd x1) \\<in> q\"\n  shows \"(\\<Gamma>,x1#l1) \\<in> assum (q,R)\"\nproof -\n  have \"env_tran_right  \\<Gamma> (l0@x1#l1) R\"\n    using a0 unfolding assum_def env_tran_right_def\n    by fastforce\n  then have \"env_tran_right \\<Gamma> (x1#l1) R\"\n    using env_tran_subl by auto\n  thus ?thesis using a1 unfolding assum_def env_tran_right_def by fastforce\nqed\n\ndefinition Pred_wf::\"nat \\<Rightarrow> (('g,'l) par_state set) \\<Rightarrow> bool\"\n  where \"Pred_wf i p \\<equiv> \\<forall>e\\<in>p. i<length (snd e)\"\n\ndefinition Rel_wf::\"nat \\<Rightarrow> (('g,'l)par_state) tran set \\<Rightarrow> bool\"\n  where \"Rel_wf i R \\<equiv> \\<forall>(x,y)\\<in>R. i<length (snd x) \\<and> i<length (snd y)\"\n\n\ndefinition comm :: \n  \"((('g,'l) c_state) tran) set \\<times> \n   (('g,'l) c_state set \\<times> ('g,'l) c_state set) \\<Rightarrow>\n   'f set \\<Rightarrow> \n     (('g,'l,'p,'f,'e) confs) set\" where\n  \"comm \\<equiv> \\<lambda>(guar, (q,a)) F. \n            {c. \n                (\\<forall>i. Suc i<length (snd c) \\<longrightarrow> \n                 (fst c)\\<turnstile>\\<^sub>c(fst ((snd c)!i),toSeq (snd ((snd c)!i)))  \\<rightarrow> \n                           (fst ((snd c)!Suc i),toSeq (snd ((snd c)!Suc i))) \\<longrightarrow> \n                   ((snd ((snd c)!i)), (snd ((snd c)!Suc i))) \\<in> guar) \\<and> \n                 (final_glob (last (snd c))  \\<longrightarrow>   fst (last (snd c)) \\<notin> Fault ` F  \\<longrightarrow>                 \n                    ((fst (last (snd c)) = Skip \\<and> \n                      snd (last (snd c)) \\<in> q)) \\<or>\n                    (fst (last (snd c)) = Throw \\<and> \n                      snd (last (snd c)) \\<in> a))}\"\n\ndefinition comm_p :: \n  \"nat \\<Rightarrow> ((('g,'l) par_state) tran) set \\<times> \n   (('g,'l) par_state set \\<times> ('g,'l) par_state set) \\<Rightarrow>\n   'f set \\<Rightarrow> \n     (('g,'l,'p,'f,'e) gconfs) set\" where\n  \"comm_p i \\<equiv> \\<lambda>(guar, (q,a)) F. \n            {(s,p). fst s = fst p \\<and> (snd s, snd p)\\<in>par_state_list_rel i}  `` \n           (comm (Seq_rel i guar, (Seq_pred i q,Seq_pred i a)) F)\"\n\nlemma comm_p_dest1: \"(\\<Gamma>,lsp)\\<in>(comm_p i (G,(q,a)) F) \\<Longrightarrow> \n                    \\<exists>lsc. (lsc, lsp)\\<in>par_state_list_rel i \\<and> \n                   (\\<Gamma>,lsc)\\<in>comm (Seq_rel i G, (Seq_pred i q,Seq_pred i a)) F\"\n  unfolding comm_p_def Image_def by auto\n\nlemma comm_dest:\n\"(\\<Gamma>, l)\\<in> comm (G,(q,a)) F \\<Longrightarrow> \n (\\<forall>i. Suc i<length l \\<longrightarrow>\n   \\<Gamma>\\<turnstile>\\<^sub>c(fst (l!i), toSeq(snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq(snd (l!(Suc i)))) \\<longrightarrow> \n    (snd(l!i), snd(l!(Suc i))) \\<in>  G)\"\nunfolding comm_def\n  apply clarify\n  by auto\n\nlemma comm_dest1:\n\"(\\<Gamma>, l)\\<in> comm (G,(q,a)) F \\<Longrightarrow>\n Suc i<length l \\<Longrightarrow>\n \\<Gamma>\\<turnstile>\\<^sub>c(fst (l!i), toSeq(snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq(snd (l!(Suc i)))) \\<Longrightarrow>\n(snd(l!i), snd(l!(Suc i))) \\<in> G\"\nunfolding comm_def\n  apply clarify\n  by auto\n\nlemma comm_dest2:\n  assumes a0: \"(\\<Gamma>, l)\\<in> comm (G,(q,a)) F\" and\n          a1: \"final_glob (last l)\" and\n          a2: \"fst (last l) \\<notin> Fault ` F\" \n  shows  \" ((fst (last l) = Skip \\<and> \n            snd (last l) \\<in> q)) \\<or>\n            (fst (last l) = Throw \\<and> snd (last l) \\<in>  a)\"\nproof -\n  show ?thesis using a0 a1 a2 unfolding comm_def by auto\nqed\n\nlemma comm_des3:\n  assumes a0: \"(\\<Gamma>, l)\\<in> comm (G,(q,a)) F\" and\n          a1: \"fst (last l) \\<notin> Fault ` F\"\n shows \"final_glob (last l) \\<longrightarrow> ((fst (last l) = Skip \\<and> \n            snd (last l) \\<in>  q)) \\<or>\n            (fst (last l) = Throw \\<and> \n            snd (last l) \\<in>  a)\"\nusing a0 a1 unfolding comm_def by auto\n\n\n\nlemma comm_pdest1:\n  assumes a0:\"(\\<Gamma>, l)\\<in> comm_p i' (G,(q,a)) F\" and  \n a2:\"Suc i<length l\" and\n a3:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), fst (toSeqState i' (snd (l ! i)))) \\<rightarrow>\n     (fst (l ! Suc i), fst (toSeqState i' (snd (l ! Suc i))))\" and a4:\"Rel_wf i' G\"\nshows \"(snd(l!i), snd(l!(Suc i))) \\<in> G\"\nproof-\n  obtain seq_l where  \n    seq_l_l:\"(seq_l,l)\\<in>par_state_list_rel i'\" and \n    seq_l_comm:\"(\\<Gamma>,seq_l)\\<in> comm ((Seq_rel i' G ), (Seq_pred i' q), (Seq_pred i' a)) F\" \n    using a0 unfolding comm_p_def by auto\n  moreover have \"Suc i< length seq_l\" using calculation\n    by (metis (no_types, lifting) Product_Type.Collect_case_prodD a2 \n        fst_conv list_all2_conv_all_nth par_state_list_rel_def snd_conv)   \n  moreover have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq ((snd (seq_l ! i)))) \\<rightarrow>\n                     (fst (l ! Suc i), toSeq ((snd (seq_l ! Suc i))))\"\n    using par_xstate_list_rel_step_c_s[OF seq_l_l] a3 calculation(3) \n       par_xstate_list_rel_dest3 seq_l_l by fastforce\n  ultimately have  \"(snd(seq_l!i), snd(seq_l!(Suc i))) \\<in> (Seq_rel i' G )\"\n    using comm_dest1\n    by (metis (mono_tags, lifting) Suc_lessD par_xstate_list_rel_dest3) \n  then show ?thesis \n    using a2 a4 par_xstate_list_rel_in_g_p seq_l_l \\<open>Suc i < length seq_l\\<close>\n    unfolding Rel_wf_def by fastforce        \nqed\n\nlemma comm_pdest2:\n  assumes a0: \"(\\<Gamma>, l)\\<in> comm_p i' (G,(q,a)) F\" and a1:\"l\\<noteq>[]\" and\n          a3: \"final_glob_p (last l)\" and \n          a4: \"fst (last l) \\<notin> Fault ` F\" and \n          a5:\"\\<forall>e\\<in>q. i'<length (snd e)\" and a6:\"\\<forall>e\\<in>a. i'<length (snd e)\"\n  shows  \" ((fst (last l) = Skip \\<and> \n            snd (last l) \\<in> q)) \\<or>\n            (fst (last l) = Throw \\<and> \n            snd (last l) \\<in>  a)\"\nproof-\n   obtain seq_l where  \n    seq_l_l:\"(seq_l,l)\\<in>par_state_list_rel i'\" and \n    seq_l_comm:\"(\\<Gamma>,seq_l)\\<in> comm ((Seq_rel i' G ), (Seq_pred i' q), (Seq_pred i' a)) F\" and\n    len:\"seq_l \\<noteq>[]\"\n     using a0 par_xstate_list_rel_in_post_p par_xstate_list_rel_dest1 a1\n     unfolding comm_p_def by fastforce\n  moreover have  \"fst (last seq_l) \\<notin> Fault ` F\"\n    using a4 a1 par_xstate_list_Fault_s[OF seq_l_l]\n    using par_xstate_list_rel_dest1 seq_l_l by fastforce\n  moreover have \"final_glob (last seq_l)\"\n    using a1 a3 par_xstate_list_final_s[OF seq_l_l] par_xstate_list_rel_dest1 seq_l_l by fastforce\n  ultimately have  \"(fst (last seq_l) = Skip \\<and> snd (last seq_l) \\<in> (Seq_pred i' q)) \\<or>\n                     (fst (last seq_l) = Throw \\<and> snd (last seq_l) \\<in> (Seq_pred i' a))\"\n    using comm_dest2[of \\<Gamma> seq_l \"Seq_rel i' G\" \"Seq_pred i' q\" \"Seq_pred i' a\" F]\n    by fastforce\n  moreover have \"last l =  l!(length l -1) \\<and> last seq_l = seq_l ! (length l - 1)\"\n    by (metis a1 last_conv_nth len par_xstate_list_rel_dest1 seq_l_l)\n  ultimately show ?thesis using par_xstate_list_rel_in_post_p[OF seq_l_l len _ a5] \n   par_xstate_list_rel_in_post_p[OF seq_l_l len _ a6] par_xstate_list_rel_program[OF seq_l_l]\n    using a1 par_xstate_list_rel_dest1 seq_l_l by force\nqed\n\nlemma comm_pdest3:\n  assumes a0: \"(\\<Gamma>, l)\\<in> comm_p i' (G,(q,a)) F\" and a1:\"l\\<noteq>[]\" and           \n          a5:\"\\<forall>e\\<in>q. i'<length (snd e)\" and a6:\"\\<forall>e\\<in>a. i'<length (snd e)\"\n  shows  \" final_glob_p (last l) \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>((fst (last l) = Skip \\<and> \n            snd (last l) \\<in>  q)) \\<or>\n            (fst (last l) = Throw \\<and> \n            snd (last l) \\<in> a)\"\nusing comm_pdest2[OF a0 a1 _ _  a5 a6] by blast\n\n\ndefinition comm_p1::\n  \"nat \\<Rightarrow> ((('g,'l) par_state) tran) set \\<times> \n   (('g,'l) par_state set \\<times> ('g,'l) par_state set) \\<Rightarrow>\n   'f set \\<Rightarrow> \n     (('g,'l,'p,'f,'e) gconfs) set\" where\n\"comm_p1 i \\<equiv> \n  \\<lambda>(guar, (q,a)) F. \n  {(\\<Gamma>,comp). \n      (\\<forall>j. Suc j<length comp \\<longrightarrow> \n       \\<Gamma>\\<turnstile>\\<^sub>c(fst(comp!j), toSeq (toSeqState i (snd (comp!j))))  \\<rightarrow> \n          (fst(comp!(Suc j)), toSeq (toSeqState i (snd (comp!(Suc j))))) \\<longrightarrow>  \n         (snd(comp!j), snd(comp!(Suc j))) \\<in> guar) \\<and> \n       (final_glob (fst (last comp),toSeqState i(snd (last comp)))  \\<longrightarrow>  \n          fst (last comp) \\<notin> Fault ` F  \\<longrightarrow>                  \n          ((fst (last comp) = Skip \\<and> snd (last comp) \\<in> q)) \\<or>\n          (fst (last comp) = Throw \\<and> snd (last comp) \\<in>  a))}\"\n\nlemma c1:\"\\<forall>e\\<in>q. i< length (snd e) \\<Longrightarrow> \\<forall>e\\<in>a. i< length (snd e) \\<Longrightarrow> Rel_wf i G \\<Longrightarrow> lp\\<noteq>[] \\<Longrightarrow> \n          (\\<Gamma>,lp) \\<in> comm_p i (G,(q,a)) F \\<Longrightarrow> (\\<Gamma>,lp) \\<in> comm_p1 i (G,(q,a)) F\"\n  unfolding comm_p1_def  Let_def split_beta  Seq_rel_def Seq_pred_def \n  apply (auto simp add: comm_pdest1)   \n  using LocalRG_HoareDef.final_eq comm_pdest2 by blast+\n\nlemma c2:\"\\<forall>e\\<in>q. i< length (snd e) \\<Longrightarrow> \\<forall>e\\<in>a. i< length (snd e) \\<Longrightarrow> lp\\<noteq>[] \\<Longrightarrow>\n         \\<forall>j<length lp.  i<length (snd ( snd (lp!j))) \\<Longrightarrow>           \n          (\\<Gamma>,lp) \\<in> comm_p1 i (G,(q,a)) F \\<Longrightarrow> (\\<Gamma>,lp) \\<in> comm_p i (G,(q,a)) F\"\nproof (auto simp add: comm_p_def  Let_def split_beta Image_def   comm_def)\n  assume a0:\"\\<forall>e\\<in>q. i < length (snd e)\" and a1:\"\\<forall>e\\<in>a. i < length (snd e)\" and           \n         a2:\"lp \\<noteq> []\" and a3:\"(\\<Gamma>, lp) \\<in> comm_p1 i (G, q, a) F\" and\n         a5:\"\\<forall>j<length lp. i < length (snd (snd (lp ! j))) \"        \n  then have xstate_rel:\"(toSeqCptn i lp, lp)\\<in> (par_state_list_rel i)\"\n    by (simp add: toSeqCptn_in_rel)  \n  moreover { let ?b = \"toSeqCptn i lp\"   \n    { fix j \n      assume a01:\"Suc j < length ?b\" and\n            a02:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (?b ! j), toSeq (snd (?b ! j))) \\<rightarrow> (fst (?b ! Suc j), toSeq (snd (?b ! Suc j)))\"\n      then have a01':\"Suc j < length lp\" and \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (lp ! j), toSeq (toSeqState i (snd (lp ! j)))) \\<rightarrow> \n                      (fst (lp ! Suc j), toSeq (toSeqState i (snd (lp ! Suc j))))\"\n        using  xstate_rel apply (simp add: par_xstate_list_rel_dest1) \n        using par_xstate_list_rel_step_c_p xstate_rel a01 a02 by blast\n      then have \"(snd (lp ! j),  snd (lp ! Suc j)) \\<in> G\" \n        using a3 unfolding comm_p1_def split_beta  by auto\n      then have\"(snd (?b ! j), snd (?b ! Suc j)) \\<in> Seq_rel i G\"\n        using par_xstate_list_rel_in_g_s[OF xstate_rel a01] by auto\n    } note c1 = this\n    moreover { \n      assume a01:\"ComputationConGlob.final_glob (last ?b)\"              \n      assume a00:\"fst (last ?b) \\<notin> Fault ` F\"                    \n      then have a00':\"fst (last lp) \\<notin> Fault ` F\"\n        using par_xstate_list_Fault_set_p[OF xstate_rel _ a00]\n            a2 par_xstate_list_rel_dest1 xstate_rel by force\n      then have \"final_glob_p (last lp)\"\n        using par_xstate_list_final_p[OF xstate_rel _ a01] a2\n        using par_xstate_list_rel_dest1 xstate_rel by fastforce \n      then have \"final_glob (fst (last lp), toSeqState i (snd (last lp)))\"\n        using LocalRG_HoareDef.final_eq \\<open>final_glob_p (last lp)\\<close> by blast\n      then have \"fst (last  lp) = LanguageCon.com.Skip \\<and> snd (last lp) \\<in> q  \\<or>\n          fst (last lp) = LanguageCon.com.Throw \\<and> snd (last lp) \\<in> a \"\n        using a3 unfolding comm_p1_def split_beta using a01 a00\n        using LocalRG_HoareDef.final_eq a00' by auto         \n       then have \"fst (last ?b) = LanguageCon.com.Skip \\<and> snd (last ?b) \\<in>  Seq_pred i q  \\<or>\n          fst (last ?b) = LanguageCon.com.Throw \\<and> snd (last ?b) \\<in>  Seq_pred i a \"\n         using par_xstate_list_rel_in_post_s[OF xstate_rel _] a2 \n         by (auto simp add: last_conv_nth toSeqCptn_def)\n    }         \n    ultimately have \"\n         (\\<forall>ia. Suc ia < length ?b \\<longrightarrow>\n               \\<Gamma>\\<turnstile>\\<^sub>c (fst (?b ! ia), toSeq (snd (?b ! ia))) \\<rightarrow> (fst (?b ! Suc ia), toSeq (snd (?b ! Suc ia))) \\<longrightarrow>\n               (snd (?b ! ia), snd (?b ! Suc ia)) \\<in>  Seq_rel i G) \\<and>\n         (ComputationConGlob.final_glob (last ?b) \\<longrightarrow> fst (last ?b) \\<notin> Fault ` F \\<longrightarrow>\n          fst (last ?b) = LanguageCon.com.Skip \\<and> snd (last ?b) \\<in> Seq_pred i q  \\<or>\n          fst (last ?b) = LanguageCon.com.Throw \\<and>  snd (last ?b) \\<in>  Seq_pred i a)\" \n      by auto\n  } ultimately show \"\\<exists>b. \n         (\\<forall>ia. Suc ia < length b \\<longrightarrow>\n               \\<Gamma>\\<turnstile>\\<^sub>c (fst (b ! ia), fst (snd (b ! ia))) \\<rightarrow> (fst (b ! Suc ia), fst (snd (b ! Suc ia))) \\<longrightarrow>\n               (snd (b ! ia), snd (b ! Suc ia)) \\<in> Seq_rel i G) \\<and>\n         (ComputationConGlob.final_glob (last b) \\<longrightarrow> (fst (last b) \\<notin> Fault ` F \\<longrightarrow>\n          fst (last b) = LanguageCon.com.Skip \\<and> snd (last b) \\<in> Seq_pred i q \\<or>\n          fst (last b) = LanguageCon.com.Throw \\<and> snd (last b) \\<in>  Seq_pred i a)) \\<and>\n        (b, lp) \\<in> par_state_list_rel i\"\n    by fastforce\n  \nqed\n\ndefinition comm1 :: \n  \"((('g,'l) c_state) tran) set \\<times> \n   (('g,'l) c_state set \\<times> ('g,'l) c_state set) \\<Rightarrow>\n   'f set \\<Rightarrow> \n     (('g,'l,'p,'f,'e) confs) set\" where\n  \"comm1 \\<equiv> \\<lambda>(guar, (q,a)) F. \n            {(\\<Gamma>,comp).\n                (\\<forall>i. Suc i<length comp \\<longrightarrow> \n                 \\<Gamma>\\<turnstile>\\<^sub>c(fst(comp!i), toSeq (snd (comp!i)))  \\<rightarrow> \n                    (fst(comp!(Suc i)), toSeq (snd (comp!(Suc i)))) \\<longrightarrow>  \n                   (snd(comp!i), snd(comp!(Suc i))) \\<in> guar) \\<and> \n                 (final_glob (last comp)  \\<longrightarrow>  fst (last comp) \\<notin> Fault ` F  \\<longrightarrow>                   \n                    ((fst (last comp) = Skip \\<and> snd (last comp) \\<in>  q)) \\<or>\n                    (fst (last comp) = Throw \\<and> snd (last comp) \\<in>  a))}\"\n\n\nlemma commI:\n  assumes a0:\"\n             (\\<forall>i. \n                 Suc i<length l \\<longrightarrow> \n                 \\<Gamma>\\<turnstile>\\<^sub>c(fst (l!i), toSeq(snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq(snd (l!(Suc i)))) \\<longrightarrow>                                               \n                   (snd(l!i), snd(l!(Suc i))) \\<in> G) \\<and> \n                 (final_glob (last l)  \\<longrightarrow>  fst (last l) \\<notin> Fault ` F \\<longrightarrow>                 \n                    ((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  a))\"\nshows \"(\\<Gamma>,l)\\<in>comm (G, (q,a)) F\"\nusing a0  unfolding comm_def\napply clarify\nby simp\n\nlemma comm_conseq:\n  \"(\\<Gamma>,l) \\<in> comm(G', (q',a')) F \\<Longrightarrow>\n       G' \\<subseteq> G \\<and>\n       q' \\<subseteq> q \\<and>\n       a' \\<subseteq> a \\<Longrightarrow>\n      (\\<Gamma>,l) \\<in> comm (G,(q,a)) F\"\nproof -\n  assume a0:\"(\\<Gamma>,l) \\<in> comm(G', (q',a')) F\" and\n         a1:\" G' \\<subseteq> G  \\<and>\n        q' \\<subseteq> q \\<and>\n        a' \\<subseteq> a\"\n  {    \n    have l:\"(\\<forall>i. \n           Suc i<length l \\<longrightarrow> \n           \\<Gamma>\\<turnstile>\\<^sub>c(fst (l!i), toSeq(snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq(snd (l!(Suc i)))) \\<longrightarrow>                                          \n             (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n    proof -\n      {fix i ns ns'\n      assume a00:\"Suc i<length l\" and\n             a11:\"\\<Gamma>\\<turnstile>\\<^sub>c(fst (l!i), toSeq(snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq(snd (l!(Suc i))))\"             \n      have \"(snd(l!i), snd(l!(Suc i))) \\<in>  G\" \n      proof -\n        have \"(snd(l!i), snd(l!(Suc i))) \\<in>  G'\"\n        using comm_dest1 [OF a0  a00 a11]  by auto\n        thus ?thesis using a1 unfolding Satis_def by fastforce\n      qed\n      } thus ?thesis by auto\n    qed  \n    have \"(final_glob (last l)  \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>\n                    ((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  a))\"\n    proof -\n      {assume a33:\"final_glob (last l)\" and a32: \"fst (last l) \\<notin> Fault ` F\"\n      then have \"((fst (last l) = Skip \\<and> snd (last l) \\<in> q')) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  a')\"\n      using comm_dest2[OF a0 a33 a32 ] by auto\n      then have \"((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> a)\"\n      using a1 by fastforce\n     } thus ?thesis by auto\n    qed\n    note res1 = conjI[OF l this] \n  } thus ?thesis unfolding comm_def by simp\nqed   \n\nlemma  no_comp_tran_no_final_comm:\n  assumes a0:\"\\<forall>i<length l. \\<not> final_glob (l!i)\" and\n          a1:\"\\<forall>i<length l. fst (l!i) = C\" and a2:\"length l>0\"\n        shows \"(\\<Gamma>,l)\\<in>comm(G, (q,a)) F\"\nproof-\n  have n_comp:\"\\<forall>i. Suc i < length l \\<longrightarrow> \n                  \\<not> (\\<Gamma>\\<turnstile>\\<^sub>c(fst (l!i), toSeq(snd (l!i)))  \\<rightarrow> \n                         (fst (l!(Suc i)), toSeq(snd (l!(Suc i)))))\" \n    using a1 by (metis Suc_lessD mod_env_not_component)\n  {\n    {fix i\n      assume \"Suc i< length(l)\" and \n             \"\\<Gamma>\\<turnstile>\\<^sub>c(fst (l!i), toSeq(snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq(snd (l!(Suc i))))\"  \n      then have False using n_comp by auto\n    }\n    moreover {\n      assume \"final_glob (last l)\" and \"fst (last l) \\<notin> Fault ` F\" \n      then have False using a0 a2\n        using last_conv_nth by force\n      }\n      ultimately have ?thesis unfolding comm_def by auto\n  } thus ?thesis unfolding comm_def by auto   \nqed\n  \ndefinition com_validity :: \n  \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow>  'f set \\<Rightarrow> ('g\\<times>'l,'p,'f,'e) com \\<Rightarrow> \n    ('g,'l) c_state set \\<Rightarrow> ((('g,'l) c_state) tran) set \\<Rightarrow>  ((('g,'l) c_state) tran) set \\<Rightarrow>  \n    ('g,'l) c_state set \\<Rightarrow>  ('g,'l) c_state set \\<Rightarrow>  bool\" \n    (\"_ \\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,61,0,0,0,0,0,0] 25) where\n  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\<equiv> \n   \\<forall>s. cp \\<Gamma> Pr s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n\ndefinition com_cvalidity::\n \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow>\n    ('g,'l,'p) c_sextuple set \\<Rightarrow>\n    'f set \\<Rightarrow>\n    ('g\\<times>'l,'p,'f,'e) com \\<Rightarrow> \n    ('g,'l) c_state set \\<Rightarrow>          \n    ((('g,'l) c_state) tran) set \\<Rightarrow> \n    ((('g,'l) c_state) tran) set \\<Rightarrow>  \n    ('g,'l) c_state set \\<Rightarrow> \n    ('g,'l) c_state set \\<Rightarrow>\n      bool\" \n    (\"_,_ \\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,61,0,0,0,0,0,0] 10) where\n  \"\\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\<equiv> \n   (\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]) \\<longrightarrow> \n     \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a]\"\n\ndefinition com_validityn :: \n  \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow> nat \\<Rightarrow> 'f set  \\<Rightarrow> ('g\\<times>'l,'p,'f,'e) com \\<Rightarrow> \n    ('g,'l) c_state set \\<Rightarrow> ((('g,'l) c_state) tran) set \\<Rightarrow>  ((('g,'l) c_state) tran) set \\<Rightarrow>  \n    ('g,'l) c_state set \\<Rightarrow>  ('g,'l) c_state set \\<Rightarrow>  bool\" \n    (\"_ \\<Turnstile>_\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,0,60,0,0,0,0,0,0] 45) where\n  \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\<equiv> \n   \\<forall>s. cpn n \\<Gamma> Pr s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n\ndefinition com_cvalidityn::\n \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow>\n    ('g,'l,'p) c_sextuple set \\<Rightarrow> nat \\<Rightarrow>\n    'f set \\<Rightarrow>\n    ('g\\<times>'l,'p,'f,'e) com \\<Rightarrow> \n    ('g,'l) c_state set \\<Rightarrow>          \n    ((('g,'l) c_state) tran) set \\<Rightarrow> \n    ((('g,'l) c_state) tran) set \\<Rightarrow>  \n    ('g,'l) c_state set \\<Rightarrow> \n    ('g,'l) c_state set \\<Rightarrow>\n      bool\" \n    (\"_,_ \\<Turnstile>_\\<^bsub>'/_\\<^esub>/ _ sat [_,_, _, _,_]\" [61,60,0,0,0,0,0,0,0] 45) where\n  \"\\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a] \\<equiv> \n   (\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]) \\<longrightarrow> \n     \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a]\"\n\n(* definition comp_validity :: \n  \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow> 'f set \\<Rightarrow> ('g\\<times>'l,'p,'f,'e) com \\<Rightarrow>  nat \\<Rightarrow> \n    ('g,'l) par_state set \\<Rightarrow> ((('g,'l) par_state) tran) set \\<Rightarrow>  ((('g,'l) par_state) tran) set \\<Rightarrow>  \n    ('g,'l) par_state set \\<Rightarrow>  ('g,'l) par_state set \\<Rightarrow>  bool\" \n    (\"_ \\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ sat _ [_,_, _, _,_]\" [61,60,0,0,0,0,0,0] 45) where\n  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a] \\<equiv> \n   \\<forall>s. {(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` (cp \\<Gamma> Pr s) \\<inter> \n       assum_p i (p, R) \\<subseteq> comm_p i (G, (q,a)) F\" *)\n\ndefinition comp_validity :: \n  \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow> 'f set \\<Rightarrow> ('g\\<times>'l,'p,'f,'e) com \\<Rightarrow>  nat \\<Rightarrow> \n    ('g,'l) par_state set \\<Rightarrow> ((('g,'l) par_state) tran) set \\<Rightarrow>  ((('g,'l) par_state) tran) set \\<Rightarrow>  \n    ('g,'l) par_state set \\<Rightarrow>  ('g,'l) par_state set \\<Rightarrow>  bool\" \n    (\"_ \\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ sat _ [_,_, _, _,_]\" [61,60,60,60,60,60,60,60] 25) where\n  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a] \\<equiv> \n   \\<forall>s. {(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` ((cp \\<Gamma> Pr s) \\<inter> \n       assum (Seq_pred i p, Seq_rel i R)) \\<subseteq> comm_p i (G, (q,a)) F\"\n\n\ndefinition comp_cvalidity::\n \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow>\n    ('g,'l,'p) p_sextuple set \\<Rightarrow> \n    'f set \\<Rightarrow>\n    ('g\\<times>'l,'p,'f,'e) com \\<Rightarrow> nat \\<Rightarrow>\n    ('g,'l) par_state set \\<Rightarrow> ((('g,'l) par_state) tran) set \\<Rightarrow>  \n    ((('g,'l) par_state) tran) set \\<Rightarrow>  \n    ('g,'l) par_state set \\<Rightarrow>  ('g,'l) par_state set \\<Rightarrow>  bool\" \n    (\"_,_ \\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ sat _ [_,_, _, _,_]\" [61,61,0,0,0,0,0,0] 10) where\n  \"\\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a] \\<equiv> \n   (\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow> \n     (\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a])) \\<longrightarrow> \n     \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a]\"\n\n\n\ndefinition seq_proc_spec::\"nat \\<Rightarrow> ('g,'l,'p) p_sextuple set \\<Rightarrow> ('g,'l,'p) c_sextuple set\"\n(\"\\<^sub>_\\<^sub>s_\" [80,98]) \nwhere \"seq_proc_spec i \\<Theta> \\<equiv> \n  (\\<lambda>(c,p,R,G,q,a).\n                  (c, Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q, Seq_pred i a)) ` \n                  {(c,p,R,G,q,a). Pred_wf i p \\<and> Rel_wf i R \\<and> Rel_wf i G \\<and> Pred_wf i q \\<and> Pred_wf i a \\<and> \n                                  (c,p,R,G,q,a)\\<in>\\<Theta>}\" \n\ndefinition comp_validityn :: \n  \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow> nat \\<Rightarrow> 'f set  \\<Rightarrow> ('g\\<times>'l,'p,'f,'e) com \\<Rightarrow> nat\\<Rightarrow>\n   ('g,'l) par_state set \\<Rightarrow> ((('g,'l) par_state) tran) set \\<Rightarrow>  ((('g,'l) par_state) tran) set \\<Rightarrow>  \n    ('g,'l) par_state set \\<Rightarrow>  ('g,'l) par_state set \\<Rightarrow>  bool\" \n    (\"_ \\<Turnstile>_\\<^bsub>'/_\\<^esub>/ _ sat _ [_,_, _, _,_]\" [61,0,60,0,0,0,0,0,0] 45) where\n  \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a] \\<equiv> \n   \\<forall>s. {(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` (cpn n \\<Gamma> Pr s) \\<inter> assum_p i (p, R) \\<subseteq> comm_p i (G, (q,a)) F\"\n                                                                            \ndefinition comp_cvalidityn::\n \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow>\n    ('g,'l,'p) p_sextuple set \\<Rightarrow> nat \\<Rightarrow>\n    'f set \\<Rightarrow>\n    ('g\\<times>'l,'p,'f,'e) com \\<Rightarrow> nat \\<Rightarrow>\n    ('g,'l) par_state set \\<Rightarrow> ((('g,'l) par_state) tran) set \\<Rightarrow>  \n    ((('g,'l) par_state) tran) set \\<Rightarrow>  \n    ('g,'l) par_state set \\<Rightarrow>  ('g,'l) par_state set \\<Rightarrow>  bool\" \n    (\"_,_ \\<Turnstile>_\\<^bsub>'/_\\<^esub>/ _ sat _ [_,_, _, _,_]\" [61,60,0,0,0,0,0,0,0] 45) where\n  \"\\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a] \\<equiv> \n   (\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a]) \\<longrightarrow> \n     \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a]\"\n\nlemma com_valid_iff_nvalid:\"(\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a]) = (\\<forall>n. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a])\"\n  apply (simp only: com_validity_def com_validityn_def cp_def cpn_def cptn_eq_cptn_mod_nest)\n  by fast\n\nlemma com_cnvalid_to_cvalid: \n    \"\\<forall>n. (\\<Gamma>,\\<Theta>\\<Turnstile>n\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a]) \\<Longrightarrow> \n         (\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [p, R, G, q,a])\"\n  apply (unfold com_cvalidityn_def com_cvalidity_def com_valid_iff_nvalid [THEN eq_reflection])\n  by fast\n\n\nlemma validityp_to_validity:\n      \"\\<forall>e\\<in>p. i< length (snd e) \\<Longrightarrow> \n       \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a] \\<Longrightarrow> \n       \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q, Seq_pred i a]\"\n  unfolding com_validity_def \nproof-\n  assume a00:\"\\<forall>e\\<in>p. i< length (snd e)\" and\n         a01:\"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a]\"\n  then have a00s:\"\\<forall>e\\<in> Seq_pred i p. i\\<le> length (snd e)\"\n    unfolding Seq_pred_def apply auto\n    by (metis Suc_less_eq diff_Suc_1 diff_le_mono len_toSeqState less_Suc_eq_le)\n  {fix s ls\n    assume a000:\"(\\<Gamma>,ls) \\<in>  cp \\<Gamma> Pr s \\<and> (\\<Gamma>,ls)\\<in>assum (Seq_pred i p, Seq_rel i R)\"\n    then have  \"(\\<Gamma>,ls)\\<in>cptn \\<and> ls!0 = (Pr, s) \\<and> \n                           (s  \\<in> Seq_pred i p \\<and> i\\<le> length (snd s))\"\n      unfolding cp_def assum_def Let_def split_beta using a00s by auto\n    then have  all:\"\\<forall>j<length ls. i\\<le>length (snd (snd (ls!j)))\"       \n      using a00 unfolding cp_def\n      using cptn_length_locs_lesseq_i by fastforce    \n    have \"(\\<Gamma>, toParCptn i ls)\\<in> {(s, p). fst p = fst s \\<and>  \n       (snd s, snd p)\\<in>par_state_list_rel i} `` ((cp \\<Gamma> Pr s) \\<inter> \n       assum (Seq_pred i p, Seq_rel i R))\"\n      unfolding Image_def  using toParCptn_in_rel[OF all] a000 apply auto\n      by (metis Int_iff fst_conv snd_conv)   \n    then have  \"(\\<Gamma>, toParCptn i ls)\\<in> comm_p i (G, (q,a)) F\"\n      using a01 unfolding comp_validity_def by fastforce\n    then have \"(\\<Gamma>,ls)\\<in>  comm (Seq_rel i G, Seq_pred i q, Seq_pred i a) F \"\n      unfolding comm_p_def Let_def split_beta Image_def apply auto \n      using eq_xstate_related_list all by blast\n  } \n  then show \"\\<forall>s. cp \\<Gamma> Pr s \\<inter> assum (Seq_pred i p, Seq_rel i R) \\<subseteq> \n                 comm (Seq_rel i G, Seq_pred i q, Seq_pred i a) F\"    \n    by (auto simp add: cp_def)\nqed\n\nlemma validity_to_validityp:\n     \" \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q, Seq_pred i a] \\<Longrightarrow>\n       \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a]\"\n  unfolding comp_validity_def Image_def comm_p_def\nproof(auto)\n  fix s \\<Gamma>1 ls lsp\n  assume  a01:\"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [Seq_pred i p,Seq_rel i R, Seq_rel i G, Seq_pred i q,Seq_pred i a]\" and\n         a02:\"(\\<Gamma>1, ls) \\<in> cp \\<Gamma> Pr s\" and \n         a03:\"(\\<Gamma>1, ls) \\<in> assum (Seq_pred i p, Seq_rel i R)\" and\n         a04:\"(ls, lsp) \\<in> par_state_list_rel i\"\n  moreover have  \"(\\<Gamma>1, ls) \\<in> comm (Seq_rel i G, Seq_pred i q, Seq_pred i a) F\" \n    using  calculation unfolding com_validity_def\n    by blast\n  ultimately show \"\\<exists>x\\<in>comm (Seq_rel i G, Seq_pred i q, Seq_pred i a) F. \n                    fst x = \\<Gamma>1 \\<and> (snd x, lsp) \\<in> par_state_list_rel i\"\n    by force \nqed\n\nlemma validity_eq_validityp:\n     \"\\<forall>e\\<in>p. i< length (snd e) \\<Longrightarrow> \n       (\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q, Seq_pred i a]) =\n       (\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a])\"\n  using validity_to_validityp validityp_to_validity com_cvalidity_def by auto\n\n\nlemma sextuple_validity_to_validity_pair:\n  assumes \n      a1:\"\\<forall>(c, p, R, G, q, a)\\<in>(seq_proc_spec i \\<Theta>). \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat [p,R, G, q,a]\"\n    shows\"\\<forall>(c, p, R, G, q, a)\\<in> \\<Theta>. Pred_wf i p \\<and> Rel_wf i R \\<and> \n                 Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow> \n             \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat i [p,R, G, q,a]\"\nproof-\n  { fix c p R G q a\n    assume a00:\"(c, p, R, G, q, a)\\<in> \\<Theta>\" and \n          a01:\" Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a\"\n    then have  \"Pred_wf i p \\<and> Rel_wf i R \\<and> Rel_wf i G \\<and> Pred_wf i q \\<and> Pred_wf i a \\<and>\n                (c, Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q, Seq_pred i a)\\<in>\n                (seq_proc_spec i \\<Theta>)\" unfolding seq_proc_spec_def\n      using image_iff unfolding image_def apply auto by fastforce \n    then have  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat [Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q,Seq_pred i a]\"\n      using a1 a01 by auto\n    then have \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat i [p,R, G, q,a]\"\n      using validity_eq_validityp a01 a00 unfolding Pred_wf_def by fastforce\n  } thus ?thesis by auto\nqed\n\nlemma sextuple_validityp_to_validity:\n  assumes \n    a1:\"\\<forall>(c, p, R, G, q, a)\\<in> \\<Theta>. Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> \n                                Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow>  \n                \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat i [p,R, G, q,a]\"\n    shows\"\\<forall>(c, p, R, G, q, a)\\<in>(seq_proc_spec i \\<Theta>). \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat [p,R, G, q,a]\"\n  unfolding seq_proc_spec_def image_def split_beta\nproof auto\n  {fix c p R G q a\n    assume a00':\"Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a\" and\n                \"(c, p, R, G, q, a)\\<in>\\<Theta>\"\n    then have  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat i [p, R,  G,  q,  a]\"\n      using a1  by auto\n    then have \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat  \n           [Seq_pred i p,Seq_rel i R, Seq_rel i G, Seq_pred i q,Seq_pred i a]\"\n      using validity_eq_validityp a00'\n      by (simp add: validity_eq_validityp Pred_wf_def)     \n  }\n  then show \"\\<And>ae af ag ah ai ba.\n       \\<lbrakk>Pred_wf i af; Rel_wf i ag; Rel_wf i ah; Pred_wf i ai; Pred_wf i ba; (ae, af, ag, ah, ai, ba) \\<in> \\<Theta>\\<rbrakk>\n       \\<Longrightarrow> \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub>\n           LanguageCon.com.Call ae sat [Seq_pred i af,Seq_rel i ag, Seq_rel i ah, Seq_pred i ai,Seq_pred i ba]\"\n    by auto\nqed\n\nlemma cvalidityp_to_cvalidity: \"\\<forall>e\\<in>p. i< length (snd e) \\<Longrightarrow>\n       (\\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a]) \\<Longrightarrow>\n       (\\<Gamma>,(seq_proc_spec i \\<Theta>) \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q, Seq_pred i a])\" \n  unfolding com_cvalidity_def   \nproof(clarify)\n  assume a1:\"\\<forall>e\\<in>p. i< length (snd e)\" and\n         a2:\"\\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p,R, G, q,a]\" and\n         \"\\<forall>(c, p, R, G, q, a)\\<in>(seq_proc_spec i \\<Theta>). \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat [p,R, G, q,a]\"  \n  then have \"\\<forall>(c, p, R, G, q, a)\\<in> \\<Theta>.  Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow>\n         \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat i [p,R, G, q,a]\" \n    using sextuple_validity_to_validity_pair by fastforce\n  then have  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a]\" using a2 unfolding comp_cvalidity_def by auto\n  then show \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [Seq_pred i p,Seq_rel i R, Seq_rel i G, Seq_pred i q,Seq_pred i a]\"\n    using  validity_eq_validityp[OF a1] by fastforce      \nqed\n\nlemma cvalidity_to_cvalidityp: \n      \"\\<forall>e\\<in>p. i< length (snd e) \\<Longrightarrow>       \n       (\\<Gamma>,(seq_proc_spec i \\<Theta>) \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q, Seq_pred i a])  \\<Longrightarrow>\n       (\\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a])\" \n  unfolding comp_cvalidity_def   \nproof(clarify)\n  assume a0:\"\\<forall>e\\<in>p. i < length (snd e)\" and \n         a2:\"(\\<Gamma>,(seq_proc_spec i \\<Theta>) \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q, Seq_pred i a]) \" and\n         a3:\"\\<forall>(c, p, R, G, q, a)\\<in>\\<Theta>. Pred_wf i p \\<and> Rel_wf i R \\<and> Rel_wf i G \\<and> Pred_wf i q \\<and> Pred_wf i a \\<longrightarrow> \n                 \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat i [p,R, G, q,a]\"           \n  then have \"\\<forall>(c, p, R, G, q, a)\\<in>(seq_proc_spec i \\<Theta>). \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat [p,R, G, q,a]\" \n    using sextuple_validityp_to_validity[OF a3] by fastforce\n  then have  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat [Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q, Seq_pred i a]\" \n    using a2 unfolding com_cvalidity_def by fastforce\n  then show \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p,R, G, q,a]\"\n    using a0 validity_eq_validityp by fastforce      \nqed\n\nlemma cvalidity_eq_cvalidityp:\n \"\\<forall>e\\<in>p. i< length (snd e) \\<Longrightarrow>       \n  (\\<Gamma>,(seq_proc_spec i \\<Theta>) \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat \n       [Seq_pred i p, Seq_rel i R, Seq_rel i G, Seq_pred i q, Seq_pred i a]) =\n  (\\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> Pr sat i [p, R, G, q,a])\" \n  using cvalidity_to_cvalidityp cvalidityp_to_cvalidity by auto\n\n\nlemma not_fault_ref:\"(par_state_list_rel i)\\<inverse> `` {x. x\\<noteq>[] \\<longrightarrow> fst (last x) \\<notin> Fault ` F} \\<subseteq> \n                      {x. x\\<noteq>[] \\<longrightarrow> fst (last x) \\<notin> Fault ` F}\" \n  unfolding par_state_list_rel_def   \n    apply auto\n    by (metis (mono_tags, lifting) diff_less image_eqI last_conv_nth length_greater_0_conv \n         list_all2_conv_all_nth  zero_less_one)\n\n\nlemma not_all_fault_ref:\" par_state_list_rel m `` {x. \\<forall>i<length x. fst (x ! i) \\<notin> Fault ` F}\n    \\<subseteq> {x. \\<forall>i<length x. fst (x ! i) \\<notin> Fault ` F}\"\n  unfolding par_state_list_rel_def\n   apply auto\n   by (metis (mono_tags, lifting)  list_all2_conv_all_nth rev_image_eqI)\n\nlemma assum_p_in_assum:\n      \"\\<forall>s\\<in> (Par_pred m P). m < length (snd s) \\<Longrightarrow>\n       (par_state_list_rel m)\\<inverse> `` \n            {cps. cps\\<noteq>[] \\<longrightarrow> (\\<Gamma>,cps) \\<in>(assum_p1 m ((Par_pred m P),((Par_rel m (R)))))} \\<subseteq>  \n                                      {cps. cps\\<noteq>[] \\<longrightarrow> (\\<Gamma>,cps)\\<in>(assum (P,R))}\"\n  unfolding par_state_list_rel_def \nproof(auto)\n  fix x xa\n  assume \n    P_less_m:\"\\<forall>s\\<in> (Par_pred m P). m < length (snd s)\" and\n    list_all:\"list_all2 (\\<lambda>s p. fst s = fst p \\<and> (snd s, snd p) \\<in> par_state_rel m) x xa\" and \n         a0:\"(\\<Gamma>, xa) \\<in> assum_p1 m (Par_pred m P, Par_rel m R)\" and a1:\" x \\<noteq> []\"\n  then show \"(\\<Gamma>, x) \\<in> assum (P, R)\"\n    unfolding assum_def assum_p1_def split_beta\n  proof(auto)    \n    assume a01:\"snd (xa ! 0) \\<in> Par_pred m P\"\n    then have \"(snd (x ! 0), snd (xa ! 0)) \\<in> par_state_rel m\"\n      using list_all unfolding par_state_list_rel_def  \n      by (auto dest: list_all2_nthD[of _ _ _ 0] simp add: a1)     \n    moreover have len:\"m<length (snd (snd (xa ! 0)))\" \n      using calculation a01 \n      unfolding par_state_list_rel_def par_state_rel_def\n      using par_seq_rel_i_length par_seq_rel_length\n      using P_less_m a01 by auto\n    ultimately have\"snd(x!0) =  (toSeqState m (snd (xa ! 0)))\" \n      using a01   unfolding par_state_rel_def       \n      by (fastforce intro: par_seq_rel_seq)\n    moreover have \"toSeqState m (snd (xa ! 0)) \\<in> P\" using a01 len unfolding Par_pred_def apply auto\n      by (metis Seq2Par eq_toPar prod.exhaust_sel)     \n    ultimately show \"snd (x ! 0) \\<in>  P\" using a01  a1 \n      unfolding  par_seq_rel_def Par_pred_def toParState_def toSeqState_def split_beta\n      by auto    \n  next \n    fix  i \n    assume a00:\"\\<forall>i. Suc i < length xa \\<longrightarrow>\n                \\<Gamma>\\<turnstile>\\<^sub>c (fst (xa ! i), toSeqState m (snd (xa ! i))) \\<rightarrow>\\<^sub>e\n                  (fst (xa ! Suc i), toSeqState m (snd (xa ! Suc i))) \\<longrightarrow>\n            (snd (xa ! i), snd (xa ! Suc i)) \\<in> Par_rel m R\" and           \n           a01:\"snd (xa ! 0) \\<in> Par_pred m P\" and \n           a02:\"Suc i < length x\" and \n           a03:\"\\<Gamma>\\<turnstile>\\<^sub>c (x ! i) \\<rightarrow>\\<^sub>e (x ! Suc i)\"\n     then have rel_i:\"(snd (x ! i), snd (xa ! i)) \\<in> par_state_rel m\" and \"fst (x!i) = fst (xa!i)\"\n       using list_all unfolding par_state_list_rel_def  \n       by (auto dest: list_all2_nthD[of _ _ _ i])\n     moreover have rel_suci:\"(snd (x ! (Suc i)), snd (xa ! (Suc i))) \\<in> par_state_rel m\"  and \n                            \"fst (x!Suc i) = fst (xa!Suc i)\"\n       using list_all unfolding par_state_list_rel_def  \n       by (auto dest: list_all2_nthD[of _ _ _  \"Suc i\"] simp add: a02)     \n     then have x_toseq:\"snd (x ! i) = toSeqState m  (snd (xa ! i))\" and \n               x_toseq_Suc:\"snd (x !(Suc i)) = toSeqState m (snd (xa!Suc i))\" and \n               x_toPar:\"snd (xa ! i) = toParState m  (snd (x ! i))\" and \n               x_toPar_Suc: \"snd (xa !(Suc i)) = toParState m (snd (x!Suc i))\" \n       using par_xstate_rel_seq par_xstate_rel_par rel_i by blast+    \n    then have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (xa ! i), toSeqState m (snd (xa ! i))) \\<rightarrow>\\<^sub>e\n                  (fst (xa ! Suc i), toSeqState m (snd (xa ! Suc i)))\" \n       using a03 x_toseq x_toseq_Suc\n       by (metis \\<open>fst (x ! Suc i) = fst (xa ! Suc i)\\<close> \\<open>fst (x ! i) = fst (xa ! i)\\<close> prod.exhaust_sel)    \n     then have  \"(snd (xa ! i), snd (xa ! Suc i)) \\<in> Par_rel m R\" using a00 a03\n       using list_all list_all2_lengthD\n       using a02 by fastforce\n     then show \"(snd (x ! i), snd (x ! Suc i)) \\<in> R\" \n       using x_toPar x_toPar_Suc \n       unfolding Par_rel_def\n       apply auto\n       by (metis eq_toPar)\n  qed    \nqed\n  \n\n\nlemma \"(\\<lambda>x. \\<forall>i<length (x). snd (x ! i) \\<notin> Fault ` F) x = (\\<forall>i<length (x). snd (x ! i) \\<notin> Fault ` F)\"\n  by auto\n\ndefinition Pre :: \" ('g,'l,'p,'f,'e)c_rgformula \\<Rightarrow> (('g,'l) c_state set)\" where\n  \"Pre x \\<equiv> fst(snd x)\"\n\ndefinition Post :: \" ('g,'l,'p,'f,'e)c_rgformula \\<Rightarrow> (('g,'l) c_state set)\" where\n  \"Post x \\<equiv>  fst(snd(snd(snd(snd x))))\"\n\ndefinition Abr ::  \" ('g,'l,'p,'f,'e)c_rgformula \\<Rightarrow> (('g,'l) c_state set)\" where\n  \"Abr x \\<equiv> snd(snd(snd(snd(snd x))))\"\n\ndefinition Rely :: \"('g,'l,'p,'f,'e) c_rgformula \\<Rightarrow> ((('g,'l) c_state) tran) set\" where\n  \"Rely x \\<equiv> fst(snd(snd x))\"\n\ndefinition Guar ::  \"('g,'l,'p,'f,'e) c_rgformula \\<Rightarrow> ((('g,'l) c_state) tran) set\" where\n  \"Guar x \\<equiv> fst(snd(snd(snd x)))\"\n\n\ndefinition Par_Pre :: \" ('g,'l,'p,'f,'e)p_rgformula \\<Rightarrow> (('g,'l) par_state set)\" where\n  \"Par_Pre x \\<equiv> fst(snd x)\"\n\ndefinition Par_Post :: \" ('g,'l,'p,'f,'e)p_rgformula \\<Rightarrow> (('g,'l) par_state set)\" where\n  \"Par_Post x \\<equiv>  fst(snd(snd(snd(snd x))))\"\n\ndefinition Par_Abr ::  \" ('g,'l,'p,'f,'e)p_rgformula \\<Rightarrow> (('g,'l) par_state set)\" where\n  \"Par_Abr x \\<equiv> snd(snd(snd(snd(snd x))))\"\n\ndefinition Par_Rely :: \"('g,'l,'p,'f,'e) p_rgformula \\<Rightarrow> ((('g,'l) par_state) tran) set\" where\n  \"Par_Rely x \\<equiv> fst(snd(snd x))\"\n\ndefinition Par_Guar ::  \"('g,'l,'p,'f,'e) p_rgformula \\<Rightarrow> ((('g,'l) par_state) tran) set\" where\n  \"Par_Guar x \\<equiv> fst(snd(snd(snd x)))\"\n\nlemma etran_in_comm:\n  \"(\\<Gamma>,(P, t) # xs) \\<in> comm(G, (q,a)) F  \\<Longrightarrow> \n    \\<not> (\\<Gamma>\\<turnstile>\\<^sub>c((P,toSeq s))  \\<rightarrow> ((P,toSeq t))) \\<Longrightarrow>\n    (\\<Gamma>,(P, s) # (P, t) # xs) \\<in> cptn \\<Longrightarrow>    \n   (\\<Gamma>,(P, s) # (P, t) # xs) \\<in> comm(G, (q,a)) F\" \nproof -\n  assume a1:\"(\\<Gamma>,(P, t) # xs) \\<in> comm(G, (q,a)) F\" and\n         a2:\"\\<not> \\<Gamma>\\<turnstile>\\<^sub>c((P,toSeq s))  \\<rightarrow> ((P,toSeq t))\" and\n         a3:\"(\\<Gamma>,(P, s) # (P, t) # xs) \\<in> cptn\"\n  show ?thesis using comm_def a1 a2 a3\n  proof -\n     {\n     let ?l1 = \"(P, t) # xs\"\n     let ?l = \"(P, s) # ?l1\"     \n     have concl:\"(\\<forall>i ns ns'. Suc i<length ?l \\<longrightarrow> \n               \\<Gamma>\\<turnstile>\\<^sub>c(fst (?l!i), toSeq (snd(?l!i)))  \\<rightarrow> \n                     (fst (?l!Suc i), toSeq (snd(?l!Suc i))) \\<longrightarrow>                          \n                 (snd(?l!i), snd(?l!(Suc i))) \\<in>  G)\"\n     proof -\n       {fix i ns ns'\n        assume a11:\"Suc i < length  ?l\" and\n               a12:\"\\<Gamma>\\<turnstile>\\<^sub>c(fst (?l!i), toSeq (snd(?l!i)))  \\<rightarrow> \n                     (fst (?l!Suc i), toSeq (snd(?l!Suc i)))\"  \n        have \"snd (last ?l)  = snd (last ?l1) \" by auto\n        then have p1:\"(\\<forall>i. Suc i<length ?l1 \\<longrightarrow> \n               \\<Gamma>\\<turnstile>\\<^sub>c(fst (?l1!i), toSeq (snd(?l1!i)))  \\<rightarrow> \n                     (fst (?l1!Suc i), toSeq (snd(?l1!Suc i))) \\<longrightarrow>                             \n               (snd(?l1!i), snd(?l1!(Suc i))) \\<in>  G)\"\n          using a1 a3  unfolding comm_def by auto\n          \n        have \"(snd (?l ! i), snd (?l ! Suc i)) \\<in>  G\"         \n        proof (cases i)\n          case 0 \n          have  \"\\<Gamma>\\<turnstile>\\<^sub>c (P, toSeq s) \\<rightarrow> (P, toSeq t)\" using a12 0 by auto\n          thus ?thesis using a2 by auto             \n        next\n          case (Suc n) thus ?thesis\n          proof -\n            have f1: \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (?l1 ! n), toSeq(snd (?l1 ! n))) \\<rightarrow> \n                          (fst (?l1 ! (Suc n)), toSeq(snd (?l1 ! (Suc n))))\"\n              using Suc a12 by fastforce\n            have f2: \"Suc n < length ((P, t) # xs)\"\n              using Suc a11 by fastforce                                  \n            hence \"(snd (((P, t) # xs) ! n), snd (((P, t) # xs) ! Suc n)) \\<in> G\"\n              using f2 f1 a1 comm_dest1  by blast            \n            thus ?thesis\n              by (simp add: Suc)\n          qed  \n        qed\n       } thus ?thesis by auto\n     qed\n     have concr:\"(final_glob (last ?l)  \\<longrightarrow> fst (last ?l) \\<notin> Fault ` F \\<longrightarrow>\n                    ((fst (last ?l) = Skip \\<and> snd (last ?l) \\<in>  q)) \\<or>\n                    (fst (last ?l) = Throw \\<and> snd (last ?l) \\<in>  a))\"\n     using a1  unfolding comm_def by auto\n     note res1=conjI[OF concl concr] }   \n     thus ?thesis unfolding comm_def by auto qed\nqed\n\nlemma ctran_in_comm:   \n  \" (s, s) \\<in> G  \\<Longrightarrow>\n   (\\<Gamma>,(Q,  s) # xs) \\<in> comm(G, (q,a)) F  \\<Longrightarrow>        \n   (\\<Gamma>,(P,  s) # (Q,  s) # xs) \\<in> comm(G, (q,a)) F\"\nproof -\n  assume a1:\"( s, s) \\<in> G\" and\n         a2:\"(\\<Gamma>,(Q,  s) # xs) \\<in> comm(G, (q,a)) F\"          \n  show ?thesis using comm_def a1 a2\n  proof -\n     {\n     let ?l1 = \"(Q,  s) # xs\"\n     let ?l = \"(P,  s) # ?l1\"     \n     have concl:\"(\\<forall>i. Suc i<length ?l \\<longrightarrow> \n              \\<Gamma>\\<turnstile>\\<^sub>c (fst (?l ! i), toSeq(snd (?l ! i))) \\<rightarrow> \n                  (fst (?l ! (Suc i)), toSeq(snd (?l ! (Suc i)))) \\<longrightarrow>                                              \n                 (snd(?l!i), snd(?l!(Suc i))) \\<in>  G)\"\n     proof -\n       {fix i ns ns'\n        assume a11:\"Suc i < length  ?l\" and\n               a12:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (?l ! i), toSeq(snd (?l ! i))) \\<rightarrow> \n                  (fst (?l ! (Suc i)), toSeq(snd (?l ! (Suc i))))\" \n        have p1:\"(\\<forall>i. Suc i<length ?l1 \\<longrightarrow> \n               \\<Gamma>\\<turnstile>\\<^sub>c (fst (?l1 ! i), toSeq(snd (?l1 ! i))) \\<rightarrow> \n                  (fst (?l1 ! (Suc i)), toSeq(snd (?l1 ! (Suc i)))) \\<longrightarrow>                              \n               (snd(?l1!i), snd(?l1!(Suc i))) \\<in>  G)\"\n        using a2  unfolding comm_def by auto\n        have \"(snd (?l ! i), snd (?l ! Suc i)) \\<in> G\"   \n        proof (cases i)\n          case 0     \n          then have \"snd (((P,  s) # (Q,  s) # xs) ! i) =  s \\<and> \n                     snd (((P,  s) # (Q,  s) # xs) ! (Suc i)) =  s\"                \n            by fastforce\n          also have \"( s,  s) \\<in> G\"\n             using Satis_def a1 by blast\n          ultimately show  ?thesis using a1 Satis_def by auto            \n        next\n          case (Suc n) thus ?thesis using p1 a2  a11 a12 \n          proof -\n            have f1: \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (?l1 ! n), toSeq(snd (?l1 ! n))) \\<rightarrow> \n                  (fst (?l1 ! (Suc n)), toSeq(snd (?l1 ! (Suc n))))\"\n              using Suc a12 by fastforce\n            have f2: \"Suc n < length ((Q,  s) # xs)\"\n              using Suc a11 by fastforce\n            thus ?thesis using Suc f1 nth_Cons_Suc p1 by auto \n          qed  \n        qed\n       } thus ?thesis by auto\n     qed\n     have concr:\"(final_glob (last ?l)  \\<longrightarrow> \n                  fst (last ?l) \\<notin> Fault ` F  \\<longrightarrow> fst (last ?l) \\<notin> Fault ` F \\<longrightarrow>\n                    ((fst (last ?l) = Skip \\<and> \n                      snd (last ?l) \\<in>  q)) \\<or>\n                    (fst (last ?l) = Throw \\<and> \n                      snd (last ?l) \\<in>  a))\"\n     using a2 unfolding comm_def by auto\n     note res=conjI[OF concl concr]}\n     thus ?thesis unfolding comm_def by auto qed\nqed\n\nlemma last_not_F:\nassumes \n  a0:\"(\\<Gamma>,xs)\\<in>cptn\"  \nshows \"fst (last xs) \\<notin> Fault ` F \\<Longrightarrow> \\<forall>i < length xs. fst (xs!i) \\<notin> Fault ` F\"\nusing a0\nproof(induct) print_cases\n  case (CptnOne \\<Gamma> p s) thus ?case by auto\nnext\n  case (Cptn  \\<Gamma> P s Q t xs) \n  have \"fst (last ((Q, t) # xs)) \\<notin> com.Fault ` F\"\n    using Cptn.prems by auto\n  then have \"\\<forall>i<length ((Q, t) # xs). fst (((Q, t) # xs) ! i) \\<notin> com.Fault ` F\" \n    using Cptn.hyps by auto\n  moreover have \"P\\<notin> com.Fault ` F \" \n    using Cptn(1) fault_no_tran image_iff not_eq_not_env step_ce_dest\n    by (metis (mono_tags, lifting) calculation fst_conv length_Cons nth_Cons_0 zero_less_Suc)    \n  ultimately show ?case\n    using less_Suc_eq_0_disj by auto \nqed\n\n\nlemma last_F:\nassumes \n  a0:\"(\\<Gamma>,xs)\\<in>cptn\" and a1:\"final_glob (xs!i)\" and \n a2:\"j<length xs\" and a3:\"i\\<le>j\"\nshows \"fst (xs!j) = fst(xs!i)\"\nusing a1 a3\nproof(induct \"j-i\" arbitrary:i)\n  case 0\n  then show ?case by auto\nnext\n  case (Suc x)\n  then have i:\"i<j\" by auto  \n  moreover have \"fst (xs!(i+1)) = fst (xs!i)\"\n  proof-\n    obtain a as where \"xs = a# as\" using a0 a2 i  cptn.simps by blast\n    then have \"\\<Gamma>\\<turnstile>\\<^sub>c (xs!i) \\<rightarrow>\\<^sub>c\\<^sub>e (xs!(i+1))\"\n      using Suc a0 a2 cptn_stepc_rtran \n      by (metis (no_types, lifting) Suc_eq_plus1 i less_trans_Suc )\n    then have step:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst(xs!i), snd(xs!i)) \\<rightarrow>\\<^sub>c\\<^sub>e (fst(xs!(i+1)),snd(xs!(i+1)))\" by auto\n    show ?thesis using step_ce_dest[OF step] \n      ComputationConGlob.final_eq SmallStepCon.no_step_final' Suc.prems(1) env_c_c' \n      by metis\n  qed\n  ultimately show ?case using Suc(1)   \n    by (metis (no_types, lifting) Suc.hyps(2) Suc.prems(1)  Suc_diff_Suc Suc_eq_plus1 \n         Suc_leI add_left_cancel final_glob_def  plus_1_eq_Suc)\n\nqed \n\nlemma not_final_in_comm:\n \"(\\<Gamma>,(Q,  s) # xs) \\<in> comm(G, (q,a)) F \\<Longrightarrow>\n  \\<not> final_glob (last ((Q,  s) # xs)) \\<Longrightarrow>\n  (\\<Gamma>,(Q,  s) # xs) \\<in> comm(G, (q',a')) F\"\n  unfolding comm_def by force\n\nlemma step_guard_concat:\n  assumes a0:\"\\<forall>i. Suc i< length xs \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (fst (xs ! i), toSeq (snd (xs ! i))) \\<rightarrow>\n                                  (fst (xs ! Suc i), toSeq (snd (xs ! Suc i))) \\<longrightarrow>\n                  (snd (xs ! i), snd (xs ! (Suc i)))\\<in>G\" and\n      a1:\"\\<forall>i. Suc i< length ys \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (fst (ys ! i), toSeq (snd (ys ! i))) \\<rightarrow>\n                                  (fst (ys ! Suc i), toSeq (snd (ys ! Suc i))) \\<longrightarrow>\n                  (snd (ys ! i), snd (ys ! (Suc i)))\\<in>G\" and\n      a2:\"(snd (last xs),snd (ys!0))\\<in>G\"\n    shows \"\\<forall>i. Suc i< length (xs@ys) \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (fst ((xs@ys) ! i), toSeq (snd ((xs@ys) ! i))) \\<rightarrow>\n                                  (fst ((xs@ys) ! Suc i), toSeq (snd ((xs@ys) ! Suc i))) \\<longrightarrow>\n                  (snd ((xs@ys) ! i), snd ((xs@ys) ! (Suc i)))\\<in>G\" \nproof-\n  { fix i\n    assume a00:\"Suc i< length (xs@ys)\" and \n           a01:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst ((xs@ys) ! i), toSeq (snd ((xs@ys) ! i))) \\<rightarrow>\n              (fst ((xs@ys) ! Suc i), toSeq (snd ((xs@ys) ! Suc i)))\"\n    have all_ys:\"\\<forall>i\\<ge>length xs. (xs@ys)!i = ys!(i-(length xs))\"\n          by (simp add: nth_append)   \n    have all_xs:\"\\<forall>i<length xs. (xs@ys)!i = xs!i\"\n            by (simp add: nth_append)\n    { assume a000:\"Suc i<length xs\" \n      then have \"(snd ((xs@ys) ! i), snd ((xs@ys) ! (Suc i)))\\<in>G\"\n        using a01 a0\n        by (simp add: a00 Suc_lessD nth_append)\n    }\n    moreover{\n      assume a000:\"Suc i> length xs\"\n      then have \"Suc (i - (length xs)) < length ys\"\n        using a00 by auto\n      moreover have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (ys ! (i-(length xs))), toSeq (snd (ys ! (i-(length xs))))) \\<rightarrow> \n                          (fst (ys ! ((Suc i)-(length xs))), toSeq (snd (ys ! ((Suc i)-(length xs)))))\" \n        using a01 all_ys a000 by fastforce       \n      ultimately have \"(snd ((xs@ys) ! i), snd ((xs@ys) ! (Suc i)))\\<in>G\"\n        using Suc_diff_le a000 a1 all_ys by auto        \n    }\n    moreover {\n      assume a000:\"Suc i = length xs\"\n      then have \"(snd ((xs@ys) ! i), snd ((xs@ys) ! (Suc i)))\\<in>G\"\n        by (metis One_nat_def a2 all_xs all_ys cancel_comm_monoid_add_class.diff_cancel \n                   diff_Suc_Suc diff_zero last_conv_nth \n                 length_greater_0_conv lessI order_refl zero_less_Suc)\n    }\n    ultimately have \"(snd ((xs@ys) ! i), snd ((xs@ys) ! (Suc i)))\\<in>G\"\n      using linorder_neqE_nat by blast\n  } thus ?thesis by auto\nqed\n\nlemma comm_union:\n assumes \n   a0: \"(\\<Gamma>,xs) \\<in> comm(G, (q,a)) F\" and\n   a1: \"(\\<Gamma>,ys) \\<in> comm(G, (q',a')) F\" and\n   a2: \"xs\\<noteq>[] \\<and> ys\\<noteq>[]\" and\n   a3: \"( snd (last xs),snd (ys!0)) \\<in> G\" and\n   a4: \"(\\<Gamma>,xs@ys) \\<in> cptn\"\n shows \"(\\<Gamma>,xs@ys) \\<in> comm(G, (q',a')) F\" \nproof -\n{\n  let ?l=\"xs@ys\"   \n  have last_ys:\"last (xs@ys) = last ys\" using a2 by fastforce\n  have concl:\"(\\<forall>i. Suc i<length ?l \\<longrightarrow> \n             \\<Gamma>\\<turnstile>\\<^sub>c (fst (?l ! i), toSeq(snd (?l ! i))) \\<rightarrow> \n                  (fst (?l ! (Suc i)), toSeq(snd (?l ! (Suc i)))) \\<longrightarrow>                                            \n               (snd(?l!i), snd(?l!(Suc i))) \\<in> G)\"\n    using step_guard_concat comm_dest[OF a0] comm_dest[OF a1] a3 by blast\n   have concr:\"(final_glob (last ?l)  \\<longrightarrow> fst (last ?l) \\<notin> Fault ` F  \\<longrightarrow>            \n                  ((fst (last ?l) = Skip \\<and> \n                    snd (last ?l) \\<in> q')) \\<or>\n                  (fst (last ?l) = Throw \\<and> \n                    snd (last ?l) \\<in> a'))\"\n   using a1 last_ys  a2 comm_des3 by fastforce\n   note res=conjI[OF concl concr]}\n   thus ?thesis unfolding comm_def by auto \nqed\n\n\n\nlemma cpn_rule1:\"(\\<forall>s. cpn n \\<Gamma> P s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F) \\<Longrightarrow>\n      (\\<forall>s l. (\\<Gamma>,l)\\<in>cpn n \\<Gamma> P s \\<and> (\\<Gamma>,l)\\<in> assum (p, R) \\<longrightarrow> (\\<Gamma>,l) \\<in> comm(G, (q,a)) F)\"\nproof-\n  assume a0:\"\\<forall>s. cpn n \\<Gamma> P s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n  {fix s l    \n    assume a00:\"(\\<Gamma>,l)\\<in>cpn n \\<Gamma> P s \\<and> (\\<Gamma>,l)\\<in> assum (p, R)\"    \n    then have \"cpn n \\<Gamma> P s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\" using a0\n      by (simp add: a0)    \n    then have \"(\\<Gamma>,l) \\<in> comm(G, (q,a)) F\" using a00 unfolding cpn_def assum_def comm_def\n      by blast\n    } then show ?thesis by auto\n  qed\n\nlemma cpn_rule2:\"(\\<forall>s l. (\\<Gamma>,l)\\<in>cpn n \\<Gamma> P s \\<and> (\\<Gamma>,l)\\<in> assum (p, R) \\<longrightarrow> (\\<Gamma>,l) \\<in> comm(G, (q,a)) F) \\<Longrightarrow>\n                (\\<forall>s. cpn n \\<Gamma> P s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F)\"\nproof-\n  assume a0:\"\\<forall>s l. (\\<Gamma>,l)\\<in>cpn n \\<Gamma> P s \\<and> (\\<Gamma>,l)\\<in> assum (p, R) \\<longrightarrow> (\\<Gamma>,l) \\<in> comm(G, (q,a)) F\"\n  {fix s l\n     assume a00:\"(\\<Gamma>,l)\\<in> cpn n \\<Gamma> P s \\<and> (\\<Gamma>,l)\\<in>assum(p, R)\"        \n    then have \"(\\<Gamma>,l) \\<in> comm(G, (q,a)) F\" using a0 unfolding cpn_def assum_def comm_def\n      by blast\n   } then show ?thesis  unfolding cpn_def by fastforce\n qed\n\nlemma cpn_rule:\"(\\<forall>s l. (\\<Gamma>,l)\\<in>cpn n \\<Gamma> P s \\<and> (\\<Gamma>,l)\\<in> assum (p, R) \\<longrightarrow> (\\<Gamma>,l) \\<in> comm(G, (q,a)) F) =\n                (\\<forall>s. cpn n \\<Gamma> P s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F)\"\n  using cpn_rule1 cpn_rule2\n  by metis\n\nlemma split_list_i:\"i<length l \\<Longrightarrow>\n                    \\<exists>l1 l2. l = l1@(l!i#l2)\"\nproof(induct l arbitrary: i)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons a l)\n  then show ?case\n    using id_take_nth_drop by blast\nqed\n\nlemma sub_assum1:\n  assumes a0: \"(\\<Gamma>,l0@l1) \\<in> assum (p,R)\" and a1:\"l0\\<noteq>[]\"\n  shows \"(\\<Gamma>,l0) \\<in> assum (p,R)\"\n  by (metis a0 a1 append_self_conv2 id_take_nth_drop length_greater_0_conv sub_assum take_0)   \n \n\n\n(* text{* \n@{text rel_safe} specifies that the relation leaves unmodifed any fragment out of the \nstate\n*}\ndefinition rel_safe:: \"(('l::sep_algebra,'g::sep_algebra) transition \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n\"rel_safe R \\<equiv> \\<forall>h h1 h2 t. R (h1,t) \\<and> ((h1 \\<uplus>\\<^sub>p h2) h) \\<longrightarrow> R (h, t \\<uplus> h2)\"\n\ndefinition mem_safe::\n\"(('l::sep_algebra,'g::sep_algebra) state,'p,'f) body \\<Rightarrow> \n (('l,'g) state,'p,'f) com \\<Rightarrow> \n (('l,'g) transition \\<Rightarrow> bool) \\<Rightarrow> \n   bool\"\nwhere\n \"mem_safe \\<Gamma> f R \\<equiv> \\<forall>h h1 h2 t1. \n      ((\\<forall>c\\<in> cp \\<Gamma> f (Normal h1). \n        final_valid(last (snd c)) \\<and> (Normal t1 =  snd (last (snd c))) \\<and>\n        (\\<forall>i. Suc i<length (snd c) \\<longrightarrow> \n                 (fst c)\\<turnstile>\\<^sub>c((snd c)!i)  \\<rightarrow>\\<^sub>e ((snd c)!(Suc i)) \\<longrightarrow>                  \n                   (snd((snd c)!i), snd((snd c)!(Suc i))) \\<in> \n                     (case_prod (\\<lambda>x y. (Normal x, Normal y))) ` (R))) \\<and>      \n        (h1 \\<uplus>\\<^sub>p h2) h \\<longrightarrow>\n        (\\<forall>c\\<in> cp \\<Gamma> f (Normal h). \n          final_valid(last (snd c)) \\<and>\n          (\\<forall>i. Suc i<length (snd c) \\<longrightarrow> \n              (fst c)\\<turnstile>\\<^sub>c((snd c)!i)  \\<rightarrow>\\<^sub>e ((snd c)!(Suc i)) \\<longrightarrow>                  \n              (snd((snd c)!i), snd((snd c)!(Suc i))) \\<in> \n                (case_prod (\\<lambda>x y. (Normal x, Normal y))) ` (R)) \\<longrightarrow>\n              (Normal (t1 \\<uplus> h2) =  snd (last (snd c)))))     \n      \"                         \n *)\n\n     \nsubsection \\<open>Validity for Parallel Programs.\\<close>\n\ndefinition All_End :: \"('g,'l,'p,'f,'e) par_config \\<Rightarrow> bool\" where\n  \"All_End xs \\<equiv> fst xs \\<noteq>[] \\<and> (\\<forall>i<length (fst xs). final1 ((fst xs)!i) (snd xs))\"\n\ndefinition par_assum :: \n  \"(('g,'l)par_state set \\<times>  \n   ((('g,'l)par_state) tran) set) \\<Rightarrow>\n   (('g,'l,'p,'f,'e) par_confs) set\" where\n  \"par_assum \\<equiv> \n     \\<lambda>(pre, rely). {c. \n       snd((snd c)!0) \\<in>  pre \\<and> (\\<forall>i. Suc i<length (snd c) \\<longrightarrow> \n       (fst c)\\<turnstile>\\<^sub>p((snd c)!i)  \\<rightarrow>\\<^sub>e ((snd c)!(Suc i)) \\<longrightarrow>        \n         (snd((snd c)!i), snd((snd c)!(Suc i))) \\<in> rely)}\"\n\ndefinition not_fault::\"('s, 'p, 'f, 'e) LanguageCon.com list \\<Rightarrow> 'f set \\<Rightarrow> bool\"\n  where \"not_fault P F \\<equiv> \\<forall>i<length P. P!i \\<notin> Fault ` F\"\n\ndefinition throw_program::\"('s, 'p, 'f, 'e) com list \\<Rightarrow> bool\"\n  where \"throw_program P \\<equiv> (\\<forall>i<length P. P!i =Skip \\<or> P!i = Throw) \\<and> (\\<exists>i<length P. P!i =Throw)\"\n\ndefinition skip_program::\"('s, 'p, 'f, 'e) com list \\<Rightarrow> bool\"\n  where \"skip_program P \\<equiv> \\<forall>i<length P. P!i =Skip\"\n\ndefinition par_comm :: \n  \"(((('g,'l)par_state) tran) set  \\<times> \n     (('g,'l)par_state set \\<times> ('g,'l)par_state set))  \\<Rightarrow> \n    'f set \\<Rightarrow>\n   (('g,'l,'p,'f,'e) par_confs) set\" where\n  \"par_comm \\<equiv> \n     \\<lambda>(guar, (q,a)) F. \n     {c.  \n         (\\<forall>i. \n            Suc i<length (snd c) \\<longrightarrow> \n            (fst c)\\<turnstile>\\<^sub>p((snd c)!i)  \\<rightarrow> ((snd c)!(Suc i)) \\<longrightarrow>                        \n              (snd((snd c)!i), snd((snd c)!(Suc i))) \\<in> guar) \\<and> \n                (All_End (last (snd c)) \\<longrightarrow> not_fault (fst (last (snd c)))  F \\<longrightarrow>\n                   throw_program (fst (last (snd c))) \\<and> snd (last (snd c)) \\<in> a \\<or>\n                   skip_program (fst (last (snd c))) \\<and> snd (last (snd c)) \\<in> q)}\"\n\ndefinition par_com_validity :: \n  \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow> \n   'f set \\<Rightarrow>\n   ('g,'l,'p,'f,'e) par_com \\<Rightarrow>  \n   (('g,'l)par_state set) \\<Rightarrow>         \n   (((('g,'l)par_state) tran) set) \\<Rightarrow> \n   (((('g,'l)par_state) tran) set) \\<Rightarrow> \n   (('g,'l)par_state set) \\<Rightarrow>\n   (('g,'l)par_state set) \\<Rightarrow> \n     bool\"  \n(\"_ \\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ SAT [_, _, _, _,_]\" [61,60,0,0,0,0,0,0] 45) where\n  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Ps SAT [pre, R, G, q,a] \\<equiv> \n   \\<forall>s. par_cp  \\<Gamma> Ps s \\<inter> par_assum(pre, R)  \\<subseteq> par_comm(G, (q,a)) F\"\n   \ndefinition par_com_cvalidity :: \n  \"('g\\<times>'l,'p,'f,'e) body \\<Rightarrow>\n    ('g,'l,'p) p_sextuple set \\<Rightarrow>\n   'f set \\<Rightarrow>\n  ('g,'l,'p,'f,'e) par_com \\<Rightarrow>   \n   (('g,'l)par_state set) \\<Rightarrow> \n   (((('g,'l)par_state) tran) set) \\<Rightarrow> \n   (((('g,'l)par_state) tran) set) \\<Rightarrow> \n   (('g,'l)par_state set) \\<Rightarrow>\n   (('g,'l)par_state set) \\<Rightarrow> \n     bool\"  \n(\"_,_ \\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ SAT [_, _, _, _,_]\" [61,60,0,0,0,0,0,0] 45) where\n  \"\\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> Ps SAT [p,  R, G, q,a] \\<equiv> \n  (\\<forall>i<length Ps. \\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> \n                                     Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow>\n                     (\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a])) \\<longrightarrow>\n   \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> Ps SAT [p, R, G, q,a]\"\n   \ndeclare Un_subset_iff [simp del] sup.bounded_iff [simp del]\n\ndefinition N::\"('g,'l) c_state set \\<Rightarrow> nat set\" \n  where \"N P \\<equiv> {n. (\\<exists>x \\<in> P. length(snd x) = n)}\" \n\ninductive\nlrghoare :: \"[('g\\<times>'l,'p,'f,'e) body,\n             ('g,'l,'p) c_sextuple set,\n              'f set,\n              ('g\\<times>'l,'p,'f,'e) com,  \n              (('g,'l) c_state set),  \n              ((('g,'l) c_state) tran) set, ((('g,'l) c_state) tran) set,\n              ('g,'l) c_state set,\n               ('g,'l) c_state set] \\<Rightarrow> bool\"\n    (\"_,_ \\<turnstile>\\<^bsub>'/_\\<^esub> _ sat [_, _, _, _,_]\" [61,61,60,60,0,0,0,0] 45)\nwhere\n Skip: \"\\<lbrakk> Sta q R; (\\<forall>s. length (snd s) \\<in> N q \\<longrightarrow> ( s,  s) \\<in> G) \\<rbrakk> \\<Longrightarrow>\n         \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> Skip sat [q, R, G, q,a] \"\n\n|Spec: \"\\<lbrakk>Sta p R;Sta q R;\n        (\\<forall>s t. s\\<in>p \\<and> (fst s,fst t)\\<in>r \\<and> (snd s) = (snd t) \\<longrightarrow> ( s, t) \\<in> G);\n         p \\<subseteq> {s. (\\<forall>t. (fst s,t)\\<in>r \\<longrightarrow> (t,snd s)\\<in> q) \\<and> (\\<exists>t. (fst s,t) \\<in> r)} \\<rbrakk> \\<Longrightarrow> \n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Spec r e) sat [p, R, G, q,a]\"\n\n| Basic: \"\\<lbrakk> Sta p R;Sta q R;\n           (\\<forall>s t. s\\<in>p \\<and> ((fst t)=f (fst s)) \\<and> (snd s =  snd t) \\<longrightarrow> ( s, t) \\<in> G);\n            p \\<subseteq> {s. (f (fst s),snd s) \\<in> q} \\<rbrakk> \\<Longrightarrow>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Basic f e) sat [p, R, G, q,a]\"\n\n| If: \"\\<lbrakk>Sta p R;  (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G); \n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> b}, R, G, q,a]; \n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c2 sat [p \\<inter> {c. (fst c) \\<in> (-b)}, R, G, q,a]\\<rbrakk> \\<Longrightarrow>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Cond b c1 c2) sat [p,  R, G, q,a]\"\n\n| While: \"\\<lbrakk> Sta p R; Sta (p \\<inter> {c. (fst c) \\<in> (-b)}) R; Sta a R; \n           (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G);\n            \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. (fst c) \\<in> b}, R, G, p,a]\\<rbrakk> \\<Longrightarrow>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (While b c) sat [p, R, G, p \\<inter> {c. (fst c) \\<in> (-b)},a]\"\n\n| Seq: \"\\<lbrakk>Sta a R; Sta p R; (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G); \n         \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]; \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]\\<rbrakk> \\<Longrightarrow>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Seq c1 c2) sat [p, R, G, r,a]\"\n\n| Await: \"\\<lbrakk> Sta p R; Sta q R; Sta a R; \\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G; \n            p \\<subseteq> {s. \\<Gamma>\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                  (b \\<inter> {c. c = fst s}) c \n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> q},\n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> a}} \\<rbrakk> \\<Longrightarrow>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Await b c e) sat [p, R, G, q,a]\"\n\n| Guard: \"\\<lbrakk>Sta (p \\<inter> {c. (fst c) \\<in> g}) R;  (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G); \n           \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a]\\<rbrakk> \\<Longrightarrow>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Guard f g c) sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a]\"\n\n| Guarantee:  \"\\<lbrakk> Sta p R;  (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G); f\\<in>F;\n                 \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a] \\<rbrakk> \\<Longrightarrow>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Guard f g c) sat [p, R, G, q,a]\"\n\n| CallRec: \"\\<lbrakk>(c,p,R,G,q,a) \\<in> Specs; \n             \\<forall>(c,p,R,G,q,a)\\<in> Specs. c \\<in> dom \\<Gamma> \\<and> \n              Sta p R \\<and>   (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G) \\<and>\n             \\<Gamma>,\\<Theta> \\<union> Specs \\<turnstile>\\<^bsub>/F\\<^esub> (the (\\<Gamma> c)) sat [p,  R, G, q,a];\n            Sta p R; (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G)\\<rbrakk> \\<Longrightarrow>\n            \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n\n| Asm: \"\\<lbrakk>(c,p,R,G,q,a) \\<in> \\<Theta>\\<rbrakk> \\<Longrightarrow>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n\n| Call: \"\\<lbrakk>\n         Sta p R;  (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G);c \\<in> dom \\<Gamma>; \n         \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (the (\\<Gamma> c)) sat [p, R, G, q,a]\\<rbrakk>  \\<Longrightarrow>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" \n\n| DynCom: \"\\<lbrakk>(Sta p R) \\<and> (Sta q R) \\<and> (Sta a R) \\<and>\n             (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G);\n            (\\<forall>s \\<in> fst ` p. (\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (c s) sat [p, R, G, q,a]))\\<rbrakk> \\<Longrightarrow>\n            \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (DynCom c) sat [p, R, G, q,a]\"\n\n| Throw: \"\\<lbrakk>Sta a R;  (\\<forall>s. length (snd s) \\<in> N a \\<longrightarrow> ( s,  s) \\<in> G) \\<rbrakk> \\<Longrightarrow>\n         \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> Throw sat [a,  R, G, q,a] \"\n\n| Catch: \"\\<lbrakk>Sta q R;  (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G); \n           \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a];\n           \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r] \n           \\<rbrakk> \\<Longrightarrow>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Catch c1 c2) sat [p, R, G, q,a]\"\n\n| Conseq: \"\\<forall>s \\<in> p. \n             (\\<exists>p' R' G' q' a' \\<Theta>'.  \n             (s\\<in> p') \\<and>\n              R \\<subseteq> R' \\<and>            \n             G' \\<subseteq> G \\<and>             \n             q' \\<subseteq> q \\<and>\n             a' \\<subseteq> a \\<and> \\<Theta>' \\<subseteq> \\<Theta> \\<and>                       \n            (\\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']) ) \n            \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\n\n| Conj_post: \" \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a] \\<Longrightarrow>\n                \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q',a'] \n            \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q \\<inter> q',a \\<inter> a']\"\n  \n| Conj_Inter: \"sa\\<noteq>({}::nat set) \\<Longrightarrow> \n               \\<forall>i\\<in>sa. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q i,a] \\<Longrightarrow>                \n               \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G,\\<Inter>i\\<in>sa. q i,a]\" \n| Stuck: \"p = {} \\<Longrightarrow> \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> Stuck sat [p, R, G, q,a]\"\n| Fault:  \"p = {} \\<Longrightarrow> \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (Fault f) sat [p, R, G, q,a]\"\n\n  \ninductive_cases hoare_elim_cases [cases set]:\n \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a]\"\n\nthm hoare_elim_cases\n(*\nlemma \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a] \\<Longrightarrow> \n        \\<forall>s \\<in> p. \n          (\\<exists>p' R' G' q' a'.  \n           (s\\<in> p') \\<and>\n            R \\<subseteq> R' \\<and>            \n            G' \\<subseteq> G \\<and>             \n            q' \\<subseteq> q \\<and>\n            a' \\<subseteq> a \\<and>                        \n           (\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']) \\<and> p'=q' \\<and> Sta q' R' \\<and> Norm R' \\<and> (\\<forall>s. (Normal s, Normal s) \\<in> G'))\"\nproof -\n  assume a0:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a]\"  \n  {\n   fix s\n   assume a01:\"s\\<in>p\"\n   have \"(\\<exists>p' R' G' q' a'.  \n           (s\\<in> p') \\<and>\n            R \\<subseteq> R' \\<and>            \n            G' \\<subseteq> G \\<and>             \n            q' \\<subseteq> q \\<and>\n            a' \\<subseteq> a \\<and>                        \n           (\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']) \\<and> p'=q' \\<and> Sta q' R' \\<and> Norm R' \\<and> (\\<forall>s. (Normal s, Normal s) \\<in> G'))\"\n   proof (cases \"p=q\")\n    case True thus ?thesis using hoare_elim_cases   sorry\n   next\n    case False thus ?thesis sorry\n   qed\n  } thus ?thesis by fastforce\nqed*)\n\n(* lemma \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c sat [p, R, G, q,r] \\<Longrightarrow>\n       c\\<noteq>Throw \\<Longrightarrow>\n       Sta p R\"\nsorry *)\n(*\n| Env:  \"\\<lbrakk>noawaits c; \\<Gamma>\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> (p ) (sequential c) q,(a)\\<rbrakk> \\<Longrightarrow>\n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> c sat [p, sep_empty, Emp, Emp, q,a]\"\n        \n| Hide: \"\\<lbrakk>\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c sat [p, (I \\<and>* I'), (R \\<and>* R'), (G \\<and>* G'), q,a]; \n         (I  \\<triangleright> R); \n         (I  \\<triangleright> G)\n          \\<rbrakk> \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> c sat [p, I, R, G, q,a]\" \n\n|Frame: \"\\<lbrakk>\n        \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c sat [p, I, R, G , q,a]; \n        I'  \\<triangleright> R'; I'  \\<triangleright> G';\n        Sta r (R'\\<and>*tran_Id);\n        (\\<forall>s t. (r imp (I'\\<and>*sep_true))(s,t));\n        (rel_safe R); (rel_safe (G\\<and>*tran_True)) \\<rbrakk>  \\<Longrightarrow>\n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> c sat [p\\<and>*r, I \\<and>* I', R \\<and>* R', G \\<and>* G', q\\<and>*r,a\\<and>*r]\"\n*)\n\n\n\ndefinition Com :: \"('g,'l,'p,'f,'e) c_rgformula \\<Rightarrow> ('g\\<times>'l,'p,'f,'e) com\" where\n  \"Com x \\<equiv> fst  x\"\n\ndefinition Par_Com :: \"('g,'l,'p,'f,'e) p_rgformula \\<Rightarrow> ('g\\<times>'l,'p,'f,'e) com\" where\n  \"Par_Com x \\<equiv> fst  x\"\n\ndefinition Rel_wf_st::\"nat \\<Rightarrow> (('g,'l)par_state) tran set \\<Rightarrow> bool\"\n  where \"Rel_wf_st i R \\<equiv> \\<forall>(x,y)\\<in>R.  i \\<le> length (snd x) \\<and> length (snd x) = length (snd y)\"\ninductive\n  par_rghoare ::  \"[('g\\<times>'l,'p,'f,'e) body,\n              ('g,'l,'p) p_sextuple set,\n              'f set,                  \n              ( ('g,'l,'p,'f,'e) p_rgformula) list,  \n              ('g,'l)par_state set,              \n              ((('g,'l)par_state) tran) set, ((('g,'l)par_state) tran) set,\n              ('g,'l)par_state set,\n               ('g,'l)par_state set] \\<Rightarrow> bool\"\n    (\"_,_ \\<turnstile>\\<^bsub>'/_\\<^esub> _ SAT [_, _, _, _,_]\" [61,60,60,0,0,0,0] 45)\nwhere\n  Parallel:\n  \"\\<lbrakk> xs \\<noteq>[]; \n     \\<forall>i<length xs. \\<forall>x\\<in> (Par_Post (xs!i)). length (snd x)  = length xs;\n     \\<forall>i<length xs. \\<forall>x\\<in> (Par_Abr (xs!i)). length (snd x)  = length xs;\n     \\<forall>i<length xs. \\<forall>x\\<in> (Par_Pre(xs!i)). length (snd x)  = length xs;\n     \\<forall>i<length xs. R \\<union> (\\<Union>j\\<in>{j. j<length xs \\<and> j\\<noteq>i}. (Par_Guar  (xs!j))) \\<subseteq> (Par_Rely (xs!i));\n    (\\<Union>j<length xs. (Par_Guar  (xs!j))) \\<subseteq> G;\n     p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs!i)));\n    (\\<Inter>i<length xs. (Par_Post (xs!i))) \\<subseteq> q;\n    (\\<Union>i<length xs. (Par_Abr (xs!i))) \\<subseteq> a; \\<forall>i<length xs. Rel_wf_st (length xs) (Par_Guar  (xs!i));            \n    \\<forall>i<length xs. \\<Gamma>,(seq_proc_spec i \\<Theta>) \\<turnstile>\\<^bsub>/F\\<^esub> Par_Com (xs!i) sat [Seq_pred i (Par_Pre (xs!i)),Seq_rel i (Par_Rely (xs!i)),\n                                           Seq_rel i (Par_Guar (xs!i)),Seq_pred i (Par_Post (xs!i)),\n                                           Seq_pred i (Par_Abr (xs!i))] \\<rbrakk>\n   \\<Longrightarrow>  \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> xs SAT [p, R, G, q,a]\" \n \nsection {* Soundness *}\n\nlemma skip_suc_i:\n  assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and> fst (l!i) = Skip\"   \n  assumes a2:\"i+1 < length l\"\n  shows \"fst (l!(i+1)) = Skip\"\nproof -\n  from a2 a1 obtain l1 ls where \"l=l1#ls\" \n    by (metis list.exhaust list.size(3) not_less0) \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc i))\" using cptn_stepc_rtran a1 a2\n    by fastforce \n  thus ?thesis using a1 a2 stepc_elim_cases(1) not_eq_not_env step_ce_dest\n    by (metis Suc_eq_plus1 prod.exhaust_sel )  \nqed \n\nlemma throw_suc_i:\n  assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and> (fst(l!i) = Throw \\<and> snd(l!i) =  s1)\"   \n  assumes a2:\"Suc i < length l\"\n  assumes a3:\"env_tran_right \\<Gamma> l rely \\<and> Sta q rely \\<and> s1 \\<in> q\"\n  shows \"fst (l!(Suc i)) =  Throw \\<and> (\\<exists>s2. snd(l!(Suc i)) =  s2 \\<and> s2 \\<in>q)\"\nproof -\n  have fin:\"final_glob (l!i)\" using a1 unfolding final_glob_def by auto \n  from a2 a1 obtain l1 ls where \"l=l1#ls\" \n    by (metis list.exhaust list.size(3) not_less0) \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc i))\" using cptn_stepc_rtran a1 a2\n    by fastforce   \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))) \\<or> \n             \\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>e (l!(Suc i))\"\n    using step_ce_dest by (metis prod.collapse)\n  thus ?thesis proof                                          \n    assume \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq (snd (l!(Suc i))))\" \n    thus ?thesis using fin no_step_final'\n      using ComputationConGlob.final_eq by blast\n  next\n    assume \"\\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>e (l!(Suc i))\" thus ?thesis \n      using a1 a3 a2 env_tran_normal by (metis (no_types, lifting)  env_c_c' prod.collapse) \n  qed \nqed \n\nlemma final_suc_i:\n  assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and>  final_glob (l!i)\"   \n  assumes a2:\"Suc i < length l\"\n  assumes a3:\"env_tran_right \\<Gamma> l rely \\<and> Sta q rely \\<and> snd (l!i) \\<in> q\"\n  shows \"fst (l!(Suc i)) =  fst(l!i) \\<and> (snd (l!(Suc i)) \\<in>q)\"\nproof -\n  have fin:\"final_glob (l!i)\" using a1 unfolding final_glob_def by auto \n  from a2 a1 obtain l1 ls where \"l=l1#ls\" \n    by (metis list.exhaust list.size(3) not_less0) \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc i))\" using cptn_stepc_rtran a1 a2\n    by fastforce   \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))) \\<or> \n             \\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>e (l!(Suc i))\"\n    using step_ce_dest by (metis prod.collapse)\n  thus ?thesis proof                                          \n    assume \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq (snd (l!(Suc i))))\" \n    thus ?thesis using fin no_step_final'\n      using ComputationConGlob.final_eq by blast\n  next\n    assume \"\\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>e (l!(Suc i))\" thus ?thesis \n      using a1 a3 a2 env_tran_normal by (metis (no_types, lifting)  env_c_c' prod.collapse) \n  qed \nqed \n\nlemma stuck_suc_i:\n  assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and> fst(l!i) = Stuck \"   \n  assumes a2:\"Suc i < length l\"  \n  shows \"fst (l!(Suc i)) =  Stuck\"\nproof -\n  have fin:\"final_glob (l!i)\" using a1 unfolding final_glob_def by auto \n  from a2 a1 obtain l1 ls where \"l=l1#ls\" \n    by (metis list.exhaust list.size(3) not_less0) \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc i))\" using cptn_stepc_rtran a1 a2\n    by fastforce   \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))) \\<or> \n             \\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>e (l!(Suc i))\"\n    using step_ce_dest by (metis prod.collapse)\n  thus ?thesis proof                                          \n    assume \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq (snd (l!(Suc i))))\" \n    thus ?thesis using fin no_step_final'\n      using ComputationConGlob.final_eq by blast\n  next\n    assume \"\\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>e (l!(Suc i))\" thus ?thesis \n      using a1  a2 \n      by (metis (no_types, lifting)  env_c_c' prod.collapse) \n  qed \nqed \n\nlemma fault_suc_i:\n  assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and> fst(l!i) = Fault f \"   \n  assumes a2:\"Suc i < length l\"\n  shows \"fst (l!(Suc i)) =  Fault f\"\nproof -\n  have fin:\"final_glob (l!i)\" using a1 unfolding final_glob_def by auto \n  from a2 a1 obtain l1 ls where \"l=l1#ls\" \n    by (metis list.exhaust list.size(3) not_less0) \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc i))\" using cptn_stepc_rtran a1 a2\n    by fastforce   \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))) \\<or> \n             \\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>e (l!(Suc i))\"\n    using step_ce_dest by (metis prod.collapse)\n  thus ?thesis proof                                          \n    assume \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> (fst (l!(Suc i)), toSeq (snd (l!(Suc i))))\" \n    thus ?thesis using fin no_step_final'\n      using ComputationConGlob.final_eq by blast\n  next\n    assume \"\\<Gamma>\\<turnstile>\\<^sub>c (l!i) \\<rightarrow>\\<^sub>e (l!(Suc i))\" thus ?thesis \n      using a1  a2 \n      by (metis (no_types, lifting)  env_c_c' prod.collapse) \n  qed \nqed \n\nlemma i_skip_all_skip:assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and> fst (l!i) = Skip\"\n      assumes a2: \"i\\<le>j \\<and> j < (length l)\"      \n      (* assumes a4:\"env_tran_right \\<Gamma> l rely\" *)\n      shows \"fst (l!j) = Skip\"\nusing a1 a2 \nproof (induct \"j-i\" arbitrary: i j)\n  case 0\n  then have \"Suc i = Suc j\" by simp  \n  thus ?case using \"0.prems\" skip_suc_i by fastforce\nnext\n  case (Suc n)    \n  then have \"length l > Suc i\" by auto \n  then have \"i<j\" using Suc by fastforce\n  moreover then have \"j-1< length l\" using Suc by fastforce\n  moreover then have \"j  - i = Suc n\" using Suc by fastforce\n  ultimately have \"fst (l ! (j)) = LanguageCon.com.Skip\" using Suc  skip_suc_i\n    by (metis (no_types, lifting) Suc_diff_Suc Suc_eq_plus1 Suc_leI `Suc i < length l` diff_Suc_1)        \n  also have \"j=j\" using Cons using Suc.prems(2) by linarith  \n  ultimately show ?case using Suc by (metis (no_types))\nqed\n\nlemma i_throw_all_throw:assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and> (fst (l!i) = Throw \\<and> snd (l!i) =  s1)\"\n      assumes a2: \"i\\<le>j \\<and> j < (length l)\"      \n      assumes a4:\"env_tran_right \\<Gamma> l rely \\<and> Sta q rely \\<and> s1\\<in>q\" \n      shows \"fst (l!j) = Throw \\<and> (\\<exists>s2. snd(l!j) =  s2  \\<and> s2\\<in>q)\"\nusing a1 a2 a4\nproof (induct \"j-i\" arbitrary: i j s1)\n  case 0\n  then have \"Suc i = Suc j\" by simp  \n  thus ?case using \"0.prems\"  by fastforce\nnext\n  case (Suc n)    \n  then have l_suc:\"length l > Suc i\" by linarith \n  then have \"i<j\" using Suc.prems(3)\n    using Suc.hyps(2) by linarith \n  moreover then have \"j-1< length l\" by (simp add: Suc.prems(2) less_imp_diff_less)   \n  moreover have \"n = j - 1 - i\"\n    using Suc.hyps(2) by auto\n  ultimately obtain s2 where \"fst (l ! (j-1)) = LanguageCon.com.Throw \\<and> snd (l ! (j-1)) =  s2 \\<and> s2\\<in>q\"\n    using Suc(1)[of \"j-1\" i s1] Suc(2) Suc(5)\n    by (metis One_nat_def Suc.prems(1) diff_diff_cancel diff_is_0_eq' less_or_eq_imp_le nat_le_linear) \n  also have \"Suc (j - 1) < length l\" using Suc by arith\n  ultimately have \"fst (l ! (j)) = LanguageCon.com.Throw \\<and> (\\<exists>s2. snd(l!j) =  s2 \\<and> s2\\<in>q)\" \n    using Suc(2-5) throw_suc_i[of \\<Gamma> l \"j-1\" s2 rely q] a4\n    by fastforce\n  also have \"j=j\" using Cons using Suc.prems(2) by linarith  \n  ultimately show ?case using Suc by (metis (no_types))\nqed  \n\n\nlemma i_final_all_stable:assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and a1:\"final_glob (l!i)\"\n      assumes a2: \"i\\<le>j\" and a3:\"j < (length l)\"      \n      assumes a4:\"env_tran_right \\<Gamma> l rely\" and a5: \"Sta q rely\" and a6:\"(snd (l!i))\\<in>q\" \n      shows \"fst (l!j) = fst (l!i) \\<and> (snd(l!j) \\<in> q)\"\nusing a1 a2 a3 a6\nproof (induct \"j-i\" arbitrary: i j)\n  case 0\n  then have \"Suc i = Suc j\" by simp  \n  thus ?case using \"0.prems\"  by fastforce\nnext\n  case (Suc n)  \n  then have l_suc:\"length l > Suc i\" by linarith \n  then have \"i<j\" using Suc.prems(3)\n    using Suc.hyps(2) by linarith \n  moreover then have \"j-1< length l\" by (simp add: Suc.prems(2,3) less_imp_diff_less)   \n  moreover have \"n = j - 1 - i\"\n    using Suc.hyps(2) by auto\n  ultimately have \"fst (l ! (j-1)) = fst (l!i) \\<and> snd (l ! (j-1)) \\<in> q\"\n    using Suc(1)[of \"j-1\" i] Suc(2) Suc(5)\n    using Suc.prems(1) Suc.prems(4) by linarith \n  also have \"Suc (j - 1) < length l\" using Suc by arith\n  ultimately have \"fst (l ! (j)) =fst (l !i) \\<and> (snd(l!j) \\<in> q)\" \n    using a0 Suc(2,3) final_suc_i[of \\<Gamma> l \"j-1\"  rely q] a4 a5 unfolding final_glob_def\n    by auto\n  also have \"j=j\" using Cons using Suc.prems(2) by linarith  \n  ultimately show ?case using Suc by (metis (no_types))\nqed  \n\n\n\nlemma i_stuck_all_stuck:\n  assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and> (fst (l!i) = Stuck )\"\n      assumes a2: \"i\\<le>j \\<and> j < (length l)\"  \n      shows \"fst (l!j) = Stuck \"\nusing a1 a2 \nproof (induct \"j-i\" arbitrary: i j )\n  case 0\n  then have \"Suc i = Suc j\" by simp  \n  thus ?case using \"0.prems\"  by fastforce\nnext\n  case (Suc n)    \n  then have l_suc:\"length l > Suc i\" by linarith \n  then have \"i<j\" \n    using Suc.hyps(2) by linarith \n  moreover then have \"j-1< length l\" by (simp add: Suc.prems(2) less_imp_diff_less)   \n  moreover have \"n = j - 1 - i\"\n    using Suc.hyps(2) by auto\n  ultimately have \"fst (l ! (j-1)) = Stuck\"\n    using Suc(1)[of \"j-1\" i ] Suc(2) \n    by (metis One_nat_def Suc.prems(1) diff_diff_cancel diff_is_0_eq' less_or_eq_imp_le nat_le_linear) \n  also have \"Suc (j - 1) < length l\" using Suc by arith\n  ultimately have \"fst (l ! (j)) = Stuck\" \n    using Suc(2-4) stuck_suc_i[of \\<Gamma> l \"j-1\"  ] \n    by fastforce\n  also have \"j=j\" using Cons using Suc.prems(2) by linarith  \n  ultimately show ?case using Suc by (metis (no_types))\nqed  \n\nlemma i_fault_all_fault:\n  assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and> fst (l!i) = Fault f\"\n      assumes a2: \"i\\<le>j \\<and> j < (length l)\"  \n      shows \"fst (l!j) = Fault f \"\nusing a1 a2 \nproof (induct \"j-i\" arbitrary: i j )\n  case 0\n  then have \"Suc i = Suc j\" by simp  \n  thus ?case using \"0.prems\"  by fastforce\nnext\n  case (Suc n)    \n  then have l_suc:\"length l > Suc i\" by linarith \n  then have \"i<j\" \n    using Suc.hyps(2) by linarith \n  moreover then have \"j-1< length l\" by (simp add: Suc.prems(2) less_imp_diff_less)   \n  moreover have \"n = j - 1 - i\"\n    using Suc.hyps(2) by auto\n  ultimately have \"fst (l ! (j-1)) = Fault f\"\n    using Suc(1)[of \"j-1\" i ] Suc(2) \n    by (metis One_nat_def Suc.prems(1) diff_diff_cancel diff_is_0_eq' less_or_eq_imp_le nat_le_linear) \n  also have \"Suc (j - 1) < length l\" using Suc by arith\n  ultimately have \"fst (l ! (j)) = Fault f\" \n    using Suc(2-4) fault_suc_i[of \\<Gamma> l \"j-1\"  ] \n    by fastforce\n  also have \"j=j\" using Cons using Suc.prems(2) by linarith  \n  ultimately show ?case using Suc by (metis (no_types))\nqed  \n\n\nlemma only_one_component_tran_j:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!i) = Skip  \\<or> fst (l!i) = Throw \\<or> fst (l!i) = Stuck \\<or> (\\<exists>f. fst (l!i) = Fault f)\" and \n         a2: \"i\\<le>j \\<and> Suc j < length l\" and\n         a3: \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> (fst (l!(Suc j)), toSeq (snd (l!(Suc j))))\"    \n   shows \"P\"\nproof -   \n   have \"fst (l!j) = Skip  \\<or> (fst (l!i) = Throw ) \\<or> fst (l!i) = Stuck \\<or> (\\<exists>f. fst (l!i) = Fault f)\" \n     using a0 a1  a2 a3  i_skip_all_skip by fastforce  \n   moreover { \n     assume \"fst (l!j) = Skip\"\n     then have ?thesis using a3\n       using stepc_elim_cases(1) by fastforce\n   }\n   moreover { \n     assume a00:\"fst (l!i) = Throw \"\n     then have a2:\"i\\<le>j \\<and> j<length l\" using a2 by auto\n     then have \"fst (l!j) = Throw \"\n       using a0 a00  \n       by (metis final_glob_def last_F) \n     then have ?thesis using a3\n       using stepc_elim_cases(11) by fastforce\n   }    \n   moreover { \n     assume a00:\"fst (l!i) = Stuck \"\n     then have a2:\"i\\<le>j \\<and> j<length l\" using a2 by auto\n     then have \"fst (l!j) = Stuck \"\n       using a0 a00  i_stuck_all_stuck by blast \n     then have ?thesis using a3\n       using stepc_elim_cases(14) by fastforce\n   }  \n   moreover { \n     assume a00:\"\\<exists>f. fst (l!i) = Fault f \"\n     then have a2:\"i\\<le>j \\<and> j<length l\" using a2 by auto\n     then obtain f where \"fst (l!j) = Fault f\"\n       using a0 a00  i_fault_all_fault by fastforce \n     then have ?thesis using a3       \n       using stepc_elim_cases(13) by fastforce\n   }  \n   ultimately show ?thesis by auto  \nqed     \n\nlemma only_one_component_tran_all_j:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!i) = Skip  \\<or> (fst (l!i) = Throw )\" and \n         a1': \"snd (l!i) \\<in> q\" and\n         a2: \"Suc i<length l\" and\n         a3: \"\\<forall>j. i\\<le>j \\<and> Suc j < length l \\<longrightarrow> \n               (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                   (fst (l!(Suc j)), toSeq (snd (l!(Suc j)))))\"  and\n         a4: \"env_tran_right \\<Gamma> l rely \\<and> Sta q rely\"              \n   shows \"P\" \nusing a0 a1 a2 a3 a4 a1' only_one_component_tran_j \nby (metis lessI less_Suc_eq_le) \n\n\nlemma zero_skip_all_skip: \n      assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and> fst (l!0) = Skip \\<and>  i < length l\"\n      shows \"fst (l!i) = Skip\"\nusing a1 i_skip_all_skip by blast\n\nlemma all_skip:\n   assumes\n      a0:\"(\\<Gamma>,x)\\<in>cptn\" and\n      a1:\"x!0 = (Skip,s)\"\nshows \"(\\<forall>i<length x. fst(x!i) = Skip)\"\nusing a0 a1 zero_skip_all_skip by fastforce\n\nlemma zero_throw_all_throw:\n      assumes a1:\"(\\<Gamma>, l) \\<in> cptn \\<and> fst (l!0) = Throw \\<and> \n                    i < length l \\<and> snd(l!0)\\<in>q\"\n      assumes a2: \"env_tran_right \\<Gamma> l rely \\<and> Sta q rely\" \n      shows \"fst (l!i) = Throw \"\nusing a1 a2 i_throw_all_throw by (metis le0) \n\nlemma only_one_component_tran_0:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"(fst (l!0) = Skip) \\<or> (fst (l!0) = Throw) \\<or>  \n             (fst (l!0) = Stuck) \\<or> (\\<exists>f. fst (l!0) = Fault f)\" and                           \n         a2: \"Suc j < length l\" and\n         a3: \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> (fst (l!(Suc j)), toSeq (snd (l!(Suc j))))\"              \n   shows \"P\"      \n  proof-\n   have a2':\"0\\<le>j \\<and> Suc j<length l\" using a2 by arith\n   show ?thesis \n   using only_one_component_tran_j[OF a0 a1  a2' a3 ] by auto\nqed\n\nlemma not_step_comp_step_env:\n assumes a0:  \"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"(Suc j<length l)\" and \n         a2: \"(\\<forall>k < j. \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                         (fst (l!(Suc k)), toSeq (snd (l!(Suc k))))))\"\n  shows \"(\\<forall>k < j. ((\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))))\"\nproof -\n  {fix k\n   assume asm: \"k<j\"\n   also then have \"Suc k<length l\" using a1 a2 by auto\n   ultimately have step:\"(\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc k)))\" \n     using a0 cptn_stepc_rtran \n     apply auto apply (erule cptn.cases, auto)\n     using  a0  by fastforce\n   also have \"\\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                         (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\" using a2 asm by auto   \n   ultimately have \"((\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"      \n     using step_ce_dest\n     by (metis prod.exhaust_sel)\n  } thus ?thesis by auto\nqed\n\nlemma cptn_i_env_same_prog:\nassumes a0: \"(\\<Gamma>, l) \\<in> cptn\" and\n        a1:  \"\\<forall>k < j. k\\<ge>i \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))\" and\n        a2: \"i\\<le>j \\<and> j < length l\"\nshows \"fst (l!j) =  fst (l!i)\"\nusing a0 a1 a2\nproof (induct \"j-i\" arbitrary: l j i)\n  case 0 thus ?case by auto    \nnext\n  case (Suc n)     \n    then have lenl:\"length l>Suc 0\" by fastforce    \n    have \"j>0\" using Suc by linarith\n    then obtain j1 where prev:\"j=Suc j1\" \n      using not0_implies_Suc by blast     \n    then obtain a0 a1 l1 where l:\"l=a0#l1@[a1]\" \n    using Suc lenl by (metis add.commute add.left_neutral length_Cons list.exhaust list.size(3) not_add_less1 rev_exhaust)     \n    then have al1_cptn:\"(\\<Gamma>,a0#l1)\\<in> cptn\"\n      using Suc.prems(1) Suc.prems(3) tl_in_cptn cptn_dest_2\n      by blast\n    have i_j:\"i\\<le>j1\" using Suc prev by auto\n    have \"\\<forall>k < j1. k\\<ge>i \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c((a0#l1)!k)  \\<rightarrow>\\<^sub>e ((a0#l1)!(Suc k)))\"\n    proof -\n       {fix k\n        assume a0:\"k<j1 \\<and> k\\<ge>i\"\n        then have \"(\\<Gamma>\\<turnstile>\\<^sub>c((a0#l1)!k)  \\<rightarrow>\\<^sub>e ((a0#l1)!(Suc k)))\" \n        using  l Suc(4) prev lenl Suc(5)\n        proof -   \n          have suc_k_j:\"Suc k < j\" using a0 prev by blast\n          have j1_l_l1:\"j1 < Suc (length l1)\" \n            using Suc.prems(3) l prev by auto\n          have \"k < Suc j1\"\n            using `k < j1 \\<and> i \\<le> k` less_Suc_eq by blast\n          hence f3: \"k < j\"\n            using prev by blast\n          hence ksuc:\"k < Suc (Suc j1)\"\n            using less_Suc_eq prev by blast\n          hence f4: \"k < Suc (length l1)\"\n            using  prev Suc.prems(3) l a0 j1_l_l1 less_trans \n            by blast            \n          have f6: \"\\<Gamma>\\<turnstile>\\<^sub>c l ! k \\<rightarrow>\\<^sub>e (l ! Suc k)\"\n            using f3 Suc(4) a0 by blast\n          have k_l1:\"k < length l1\"\n            using f3 Suc.prems(3) i_j l suc_k_j  by auto                            \n          thus ?thesis\n          proof (cases k)\n            case 0 thus ?thesis using f6 l  k_l1\n                by (simp add: nth_append)\n          next  \n            case (Suc k1) thus ?thesis \n              using f6  f4 l k_l1 \n              by (simp add: nth_append)\n          qed\n        qed\n       }thus ?thesis by auto\n    qed\n    then have fst:\"fst ((a0#l1)!i)=fst ((a0#l1)!j1)\"\n      using Suc(1)[of j1 i \"a0#l1\"] \n            Suc(2) Suc(3) Suc(4) Suc(5) prev al1_cptn i_j\n      by (metis (mono_tags, lifting) Suc_diff_le Suc_less_eq diff_Suc_1 l length_Cons length_append_singleton)\n    have len_l:\"length l = Suc (length (a0#l1))\" using l by auto\n    then have f1:\"i<length (a0#l1)\" using Suc.prems(3) i_j prev by linarith\n    then have f2:\"j1<length (a0#l1)\" using Suc.prems(3) len_l prev by auto\n    have i_l:\"fst (l!i) = fst ((a0#l1)!i)\" \n      using l prev f1 f2 fst \n      by (metis (no_types) append_Cons nth_append)\n    also have j1_l:\"fst (l!j1) = fst ((a0#l1)!j1)\"\n    using l prev f1 f2 fst \n      by (metis (no_types) append_Cons nth_append)\n    then have \"fst (l!i) = fst (l!j1)\" using\n      i_l j1_l fst by auto      \n    thus ?case using Suc prev by (metis env_c_c' i_j lessI prod.collapse)          \nqed  \n  \n\nlemma cptn_tran_ce_i: \n   assumes a1:\"(\\<Gamma>, l) \\<in> cptn  \\<and>  i + 1 < length l\"\n   shows \"\\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc i))\"\nproof -\n  from a1\n  obtain a1 l1 where \"l=a1#l1\" using cptn.simps by blast\n  thus  ?thesis using a1 cptn_stepc_rtran by fastforce\nqed\n\nlemma zero_final_always_env_0: \n      assumes a1:\"(\\<Gamma>, l) \\<in> cptn\" and\n              a2: \"fst (l!0) = Skip \\<or> fst (l!0) = Throw \\<or> \n                  fst (l!0) = Stuck \\<or> (\\<exists>f. fst(l!0) = Fault f)\" and\n              a2': \"snd(l!0) \\<in>q\" and\n              a3: \"Suc i < length l\" and\n              a4: \"env_tran_right \\<Gamma> l rely \\<and> Sta q rely\"\n      shows \"\\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i))\"\nproof -\n   have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc i))\" using a1 a2 a3 cptn_tran_ce_i by auto   \n   also have \"\\<not> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                   (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))))\" using a1 a2 a3 a4 a2'\n     using only_one_component_tran_0 by metis           \n   ultimately show ?thesis\n     using step_ce_dest\n     by (metis prod.exhaust_sel) \nqed\n\nlemma final_always_env_i: \n      assumes a1:\"(\\<Gamma>, l) \\<in> cptn\" and\n              a2: \"fst (l!0) = Skip \\<or> fst (l!0) = Throw \\<or> \n                  fst (l!0) = Stuck \\<or> (\\<exists>f. fst(l!0) = Fault f)\" and\n              a2': \"snd(l!0) \\<in>q\" and\n              a3: \"j\\<ge>i \\<and> Suc j<length l\" and\n              a4: \"env_tran_right \\<Gamma> l rely \\<and> Sta q rely\"\n      shows \"\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j))\"\nproof -\n   have ce_tran:\"\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc j))\" using a1 a2 a3 a4 cptn_tran_ce_i by auto   \n   then have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)) \\<or> \n              \\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                   (fst (l!(Suc j)), toSeq (snd (l!(Suc j))))\"      \n     using a1 a2 a2' a3 a4 zero_final_always_env_0 by blast\n   thus ?thesis\n   proof\n     assume \"\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j))\" then show ?thesis by auto\n   next\n     assume a01:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                   (fst (l!(Suc j)), toSeq (snd (l!(Suc j))))\"\n      then  have \"\\<not> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                   (fst (l!(Suc j)), toSeq (snd (l!(Suc j)))))\"   \n        using a1 a2 a3 a4 a2' only_one_component_tran_j [OF a1]  \n        by blast\n      then show ?thesis using a01 ce_tran by (simp add: step_ce.simps) \n   qed\nqed\n\n\nsubsection {*Skip Sound*}\n\nlemma stable_q_r_q: \n  assumes a0:\"Sta q R\"  and       \n          a1: \"snd(l!i) \\<in>  q\" and\n          a2:\"(snd(l!i), snd(l!(Suc i))) \\<in> R\"\n  shows \"snd(l!(Suc i)) \\<in>  q\"\nusing a0  a1  a2 \nunfolding Sta_def  by fastforce \n\nlemma stability:\nassumes   a0:\"Sta q R\"  and                 \n          a1: \"snd(l!j) \\<in>  q\" and\n          a2: \"j\\<le>k \\<and> k < (length l)\" and\n          a3: \"n=k-j\" and\n          a4: \"\\<forall>i. j\\<le>i \\<and> i < k \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i))\" and\n          a5:\"env_tran_right \\<Gamma> l R \"\n      shows \"snd (l!k) \\<in> q \\<and> fst (l!j) = fst (l!k)\"\nusing a0 a1 a2 a3 a4 a5 \nproof (induct n arbitrary: j k)\n  case 0\n    thus ?case by auto\nnext\n  case (Suc n) \n    then have \"length l > j + 1\" by arith     \n    moreover then have \"k-1< length l\" using Suc by fastforce    \n    moreover then have \"(k - 1) - j = n\" using Suc by fastforce\n    moreover then have  \"j\\<le>k-1\" using Suc by arith \n    moreover have \"\\<forall>i. j \\<le> i \\<and> i < k-1 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (l ! i) \\<rightarrow>\\<^sub>e (l ! Suc i)\"\n      using Suc by fastforce    \n    ultimately have induct:\"snd (l! (k-1)) \\<in> q \\<and> fst (l!j) = fst (l!(k-1))\" using Suc\n      by blast      \n    also have j_1:\"k-1+1=k\" using Cons Suc.prems(4) by auto \n    have f1:\"\\<forall>i. j\\<le>i \\<and> i < k \\<longrightarrow> (snd((snd (\\<Gamma>,l))!i), snd((snd (\\<Gamma>,l))!(Suc i))) \\<in>  R\"\n    using Suc unfolding env_tran_right_def by fastforce\n    have  k1:\"k - 1 < k\"\n      by (metis (no_types) Suc_eq_plus1 j_1 lessI)    \n    then have \"(snd((snd (\\<Gamma>,l))!(k-1)), snd((snd (\\<Gamma>,l))!(Suc (k-1)))) \\<in>  R\"    \n    using `j \\<le> k - 1` f1 by blast                           \n    ultimately have \"snd (l!k) \\<in>  q\" using stable_q_r_q Suc(2)  Suc(5)  by fastforce\n    also have \"fst (l!j) = fst (l!k)\"\n    proof -\n      have \"\\<Gamma>\\<turnstile>\\<^sub>c (l ! (k-1)) \\<rightarrow>\\<^sub>e (l ! k)\" using Suc(6) k1 `j\\<le>k-1` by fastforce\n      thus ?thesis using k1 prod.collapse env_c_c' induct by metis\n    qed\n    ultimately show ?case by meson\nqed\n\nlemma stable_only_env_i_j: \n  assumes a0:\"Sta q R\"  and                 \n          a1: \"snd(l!i) \\<in> q\" and\n          a2: \"i<j \\<and> j < (length l)\" and\n          a3: \"n=j-i-1\" and\n          a4: \"\\<forall>k\\<ge>i. k < j \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))\" and\n          a5: \"env_tran_right \\<Gamma> l R\"\n      shows \"snd (l!j) \\<in>  q\"\nusing a0 a1 a2 a3 a4 a5  by (meson less_imp_le_nat  stability)\n\n  \nlemma stable_only_env_1: \n  assumes a0:\"Sta q R\"  and                 \n          a1: \"snd(l!i) \\<in>  q\" and\n          a2: \"i<j \\<and> j < (length l)\" and\n          a3: \"n=j-i-1\" and\n          a4: \"\\<forall>i. Suc i < length l \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i))\" and\n          a5: \"env_tran_right \\<Gamma> l R\"\n      shows \"snd (l!j) \\<in>  q\"\nusing a0 a1 a2 a3 a4 a5 \nby (meson stable_only_env_i_j less_trans_Suc)\n\n\nlemma stable_only_env_q: \n  assumes a0:\"Sta q R\"  and                 \n          a1: \"\\<forall>i. Suc i < length l \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i))\" and\n          a2: \"env_tran \\<Gamma> q l R\"\n      shows \"\\<forall>i. i < length l \\<longrightarrow> snd (l!i) \\<in>  q\"\nproof (cases \"0 < length l\")\n  case False thus ?thesis using a2 unfolding env_tran_def by fastforce \nnext\n  case True \n  thus ?thesis \n  proof - {\n    fix i\n    assume aa1:\"i < length l\"\n    have post_0:\"snd (l ! 0) \\<in>  q \" \n      using a2 unfolding env_tran_def by auto\n    then have \"snd (l ! i) \\<in>  q\"     \n    proof (cases i) \n      case 0 thus ?thesis using post_0 by auto\n    next\n      case (Suc n) \n      \n      have \"env_tran_right \\<Gamma> l R\" \n        using a2 env_tran_right_def unfolding env_tran_def by auto\n      also have \"0<i\" using Suc by auto\n      ultimately show ?thesis \n        using post_0 stable_only_env_1  a0 a1 a2 aa1  by blast\n    qed\n  } then show ?thesis by auto qed\nqed\n\n\n\nlemma Skip_sound1: \n  assumes a0:\"Sta q R\" and   \n   a10:\"c \\<in> cp \\<Gamma> Skip s\" and\n   a11:\"c \\<in> assum(q, R)\" \n   shows \"c \\<in> comm (G, (q,a)) F\"\nproof -  \n  obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce  \n  {     \n    have cp:\"l!0=(Skip,s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10 cp_def c_prod by fastforce   \n    have assum:\"snd(l!0) \\<in> q \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow>\n             (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n               (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n      using a11 c_prod unfolding assum_def by simp\n    have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n                    \\<Gamma>1\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                      (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))) \\<longrightarrow>                             \n             (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n    proof -\n    { fix i\n      assume asuc:\"Suc i<length l\"        \n      then have \"\\<not> (\\<Gamma>1\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                      (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))))\"\n        by (metis Suc_lessD cp  prod.sel(1) stepc_elim_cases(1) zero_skip_all_skip)\n    } thus ?thesis by auto qed\n    have concr:\"(final_glob (last l)  \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>\n               ((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                (fst (last l) = Throw \\<and> snd (last l) \\<in> (a)))\"\n    proof-\n    { \n      assume valid:\"final_glob (last l)\" and a00:\"fst (last l) \\<notin> Fault ` F\"\n      have len_l:\"length l > 0\" using cp using cptn.simps by blast \n      then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n      have last_l:\"last l = l!(length l-1)\"\n        using last_length [of a l1] l by fastforce\n      then have fst_last_skip:\"fst (last l) = Skip\"             \n        by (metis `0 < length l` cp diff_less fst_conv zero_less_one zero_skip_all_skip)                           \n      have last_q: \"snd (last l) \\<in> q\"    \n      proof -\n        have env: \"env_tran \\<Gamma> q l R\" using env_tran_def assum cp by blast\n        have env_right:\"env_tran_right \\<Gamma> l R \" using  a0 env_tran_right_def assum cp by metis\n        also have \"snd(l!0) \\<in>q\" \n          using assum by auto\n        ultimately have all_tran_env: \n          \"\\<forall>i. Suc i < length l \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i))\"\n          using final_always_env_i cp zero_final_always_env_0 a0\n          using all_skip len_l by blast\n        then have \"\\<forall>i. i < length l \\<longrightarrow> snd (l!i) \\<in> q\"\n          using stable_only_env_q  a0  env  by fastforce\n        thus ?thesis using last_l using len_l by fastforce    \n      qed\n      note res = conjI [OF fst_last_skip last_q]\n    } thus ?thesis by auto \n    qed\n    note res = conjI [OF concl concr]               \n  } thus ?thesis using c_prod unfolding comm_def by auto \nqed\n\n\nlemma Skip_sound: \n  \"Sta q R \\<Longrightarrow>          \n   \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> Skip sat [q,R, G, q,a]\" \nproof-\n  assume\n  a0:\"Sta q R\"      \n  {\n    fix s\n    have ass:\"cpn n \\<Gamma> Skip s \\<inter> assum(q, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof-      \n    { fix c\n      assume a10:\"c \\<in> cpn n \\<Gamma> Skip s\" and a11:\"c \\<in> assum(q, R)\"\n      then have a10:\"c\\<in>cp \\<Gamma> Skip s\"\n        using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n      have \"c\\<in>comm(G, (q,a)) F\" using Skip_sound1[OF a0  a10 a11] by auto      \n    } thus ?thesis by auto\n    qed \n  } \n  thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\nlemma Throw_sound1: \n  assumes a1:\"Sta a R\" and  \n   a10:\"c \\<in> cp \\<Gamma> Throw s\" and\n   a11:\"c \\<in> assum(a, R)\"\nshows \"c \\<in> comm (G, (q,a)) F\"\nproof -  \n  obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce     \n  {    \n    have cp:\"l!0=(Throw,s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10 cp_def c_prod by fastforce\n    have assum:\"snd(l!0) \\<in>  a \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n             (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n               (snd(l!i), snd(l!(Suc i))) \\<in> (R))\" \n      using a11 c_prod unfolding assum_def by simp\n    then have env_tran:\"env_tran_right \\<Gamma> l R\" using cp env_tran_right_def by auto\n    have a_normal:\"snd(l!0)  \\<in> a\"\n      using assum by auto\n    have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n           \\<Gamma>1\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                      (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))) \\<longrightarrow>                                           \n             (snd(l!i), snd(l!(Suc i))) \\<in>  (G))\"\n    proof -\n    { fix i\n      assume asuc:\"Suc i<length l\"\n      then have asuci:\"i<length l\" by fastforce\n      then have \"fst (l ! 0) = LanguageCon.com.Throw\" using cp by auto     \n      then have \"fst (l ! i) = Throw \"      \n        using cp a1 assum a_normal env_tran asuci zero_throw_all_throw\n        by fastforce\n      then have \"\\<not> (\\<Gamma>1\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                      (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))))\"        \n        using stepc_elim_cases(11) by fastforce            \n    } thus ?thesis by auto qed\n    have concr:\"(final_glob (last l)  \\<longrightarrow>fst (last l) \\<notin> Fault ` F \\<longrightarrow> \n               ((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                (fst (last l) = Throw \\<and> snd (last l) \\<in> a))\"\n    proof-\n    { \n      assume valid:\"final_glob (last l)\" and a00: \"fst (last l) \\<notin> Fault ` F\"\n      have len_l:\"length l > 0\" using cp using cptn.simps by blast \n      then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n      have last_l:\"last l = l!(length l-1)\"\n        using last_length [of a1 l1] l by fastforce\n      then have fst_last_skip:\"fst (last l) = Throw\"\n        by (metis a1 a_normal cp diff_less env_tran fst_conv len_l zero_less_one zero_throw_all_throw)                        \n      have last_q: \"snd (last l) \\<in> a\"    \n      proof -\n        have env: \"env_tran \\<Gamma> a l R\" using env_tran_def assum cp by blast\n        have env_right:\"env_tran_right \\<Gamma> l R\" using env_tran_right_def assum cp by metis\n        then have all_tran_env: \"\\<forall>i. Suc i < length l \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i))\"\n        using final_always_env_i a1 assum cp zero_final_always_env_0 by fastforce            \n        then have \"\\<forall>i. i < length l \\<longrightarrow> snd (l!i) \\<in> a\"\n        using stable_only_env_q  a1  env by fastforce\n        thus ?thesis using last_l using len_l by fastforce    \n      qed                \n      note res = conjI [OF fst_last_skip last_q]\n    } thus ?thesis by auto qed\n    note res = conjI [OF concl concr]               \n   }              \n   thus ?thesis using c_prod unfolding comm_def by auto \nqed          \n\nlemma Throw_sound: \n  \"Sta a R  \\<Longrightarrow>   \n   \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> Throw sat [a, R, G, q,a]\"\nproof -  \n  assume a1:\"Sta a R\" \n  {\n    fix s\n    have ass:\"cpn n \\<Gamma> Throw s \\<inter> assum(a, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof-      \n    { fix c\n      assume a10:\"c \\<in> cpn n \\<Gamma> Throw s\" and a11:\"c \\<in> assum(a, R)\"\n      then have a10:\"c\\<in>cp \\<Gamma> Throw s\"\n        using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n      have \"c\\<in>comm(G, (q,a)) F\" using Throw_sound1[OF a1  a10 a11] by auto      \n    } thus ?thesis by auto\n    qed \n  } \n  thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\nlemma no_comp_tran_before_i_0_g:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!0) = c \" and         \n         a2: \"Suc i<length l \\<and> \n               (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n               (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))))\" and\n         a3: \"j < i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                            (fst (l!(Suc j)), toSeq (snd (l!(Suc j)))))\" and\n         a4: \"\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))\" and\n         a5: \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(c, s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> \n                         c1=Skip \\<or> c1 = Throw \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\"\n   shows \"P\"\n  proof -\n   have \"Suc j < length l\" using a0 a1 a2 a3 a4 by fastforce\n   then have \"fst (l!j) = c\" \n     using a0 a1 a2 a3 a4 cptn_env_same_prog[of \\<Gamma> l j] by fastforce\n   then obtain s s1 c1 where l_0: \"l!j = (c, s) \\<and> l!(Suc j) = (c1,s1)\"  \n     by (metis (no_types) prod.collapse)    \n  \n   then have suc_0_skip: \"fst (l!Suc j) = Skip \\<or> fst (l!Suc j) = Throw \\<or> \n                          fst (l!Suc j) = Stuck \\<or> (\\<exists>f. fst (l!Suc j) = Fault f)\" \n      using a5  a3  \\<open>fst (l ! j) = c\\<close> a3 a5 by blast \n   thus ?thesis using only_one_component_tran_j\n    proof -\n      have \"\\<forall>n na. \\<not> n < na \\<or> Suc n \\<le> na\"\n        using Suc_leI by satx  \n      thus ?thesis using only_one_component_tran_j[OF a0] suc_0_skip  a0 a2 a3\n        using imageE by blast          \n    qed\nqed\n\nlemma no_comp_tran_before_i:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = c\" and        \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> \n              (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                   (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))))\" and\n         a3: \"k\\<le>j \\<and> j < i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                            (fst (l!(Suc j)), toSeq (snd (l!(Suc j)))))\" and\n         a4: \"\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))\" and\n          a5: \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(c, s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> \n                        c1=Skip \\<or> c1=Throw \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)  \"\n   shows \"P\"\nusing a0 a1 a2 a3 a4 a5 \nproof (induct k arbitrary: l i j)\n  case 0 thus ?thesis using no_comp_tran_before_i_0_g by blast\nnext\n  case (Suc n) \n  then obtain a1 l1 where l: \"l=a1#l1\"\n    by (metis less_nat_zero_code list.exhaust list.size(3))\n  then have l1notempty:\"l1\\<noteq>[]\" using Suc by force    \n  then obtain i' where i': \"i=Suc i'\" using Suc \n    using less_imp_Suc_add by blast\n  then obtain j' where j': \"j=Suc j'\" using Suc\n    using Suc_le_D by blast      \n  have \"(\\<Gamma>,l1)\\<in>cptn\" using Suc l\n    using tl_in_cptn l1notempty by blast\n  moreover have \"fst (l1 ! n) = c\"\n    using Suc l l1notempty by force  \n  moreover have \"Suc i' < length l1 \\<and> n \\<le> i' \\<and> \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1!i'), toSeq (snd (l1!i')))  \\<rightarrow> \n               (fst (l1!(Suc i')), toSeq (snd (l1!(Suc i'))))\"\n    using Suc l l1notempty i' by auto\n  moreover have \"n \\<le> j' \\<and> j' < i' \\<and> \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1!j'), toSeq (snd (l1!j')))  \\<rightarrow> \n               (fst (l1!(Suc j')), toSeq (snd (l1!(Suc j'))))\"\n    using Suc l l1notempty i' j' by auto\n  moreover have \"\\<forall>k<j'. \\<Gamma>\\<turnstile>\\<^sub>c l1 ! k \\<rightarrow>\\<^sub>e (l1 ! Suc k)\"\n    using Suc l l1notempty j' by auto    \n  ultimately show ?case using Suc(1)[of l1 i' j' ]  Suc(7)   j' l by auto\nqed\n\nlemma exists_first_occ: \"P (n::nat) \\<Longrightarrow> \\<exists>m. P m \\<and> (\\<forall>i<m. \\<not> P i)\"\nproof (induct n)\n  case 0 thus ?case by auto\nnext\n  case (Suc n) thus ?case\n  by (metis ex_least_nat_le not_less0) \nqed\n\nlemma exist_first_comp_tran':\nassumes a1: \"Suc i<length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                                     (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))))\"      \nshows \"\\<exists>j. (Suc j<length l \\<and>  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                                   (fst (l!(Suc j)), toSeq (snd (l!(Suc j)))))) \\<and> \n           (\\<forall>k < j. \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                          (fst (l!(Suc k)), toSeq (snd (l!(Suc k))))))\"\nproof -\n  let ?P =  \"(\\<lambda>n. Suc n<length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!n), toSeq (snd (l!n)))  \\<rightarrow> \n                                     (fst (l!(Suc n)), toSeq (snd (l!(Suc n))))))\"\n  show ?thesis using exists_first_occ[of ?P i] a1 by auto  \nqed\n\nlemma exist_first_comp_tran:\nassumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n        a1: \"Suc i<length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                                   (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))))\"      \nshows \"\\<exists>j. j\\<le>i \\<and>  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                    (fst (l!(Suc j)), toSeq (snd (l!(Suc j))))) \\<and> \n           (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\nproof -\n  obtain j where  pj:\"(Suc j<length l \\<and>  \n                       (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                           (fst (l!(Suc j)), toSeq (snd (l!(Suc j)))))) \\<and> \n                      (\\<forall>k < j. \\<not>(Suc k<length l \\<and>  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                  (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))))\"\n    using a1 exist_first_comp_tran' by fast\n  then have \"j\\<le>i\" using a1 pj by (cases \"j\\<le>i\", auto)\n  moreover have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                     (fst (l!(Suc j)), toSeq (snd (l!(Suc j))))\" using pj by auto\n  moreover have \"(\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\" \n  proof -\n    {fix k\n    assume kj:\"k<j\"\n    then have \"Suc k \\<ge> length l \\<or>  \n                 \\<not> (Suc k<length l \\<and>  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                 (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))) \" \n      using pj by auto\n    then have \"(\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))\"\n    proof\n      {assume \"length l \\<le> Suc k\" \n       thus ?thesis using kj pj by auto\n      }\n      {assume \"\\<not> (Suc k<length l \\<and>  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                 (fst (l!(Suc k)), toSeq (snd (l!(Suc k))))))\"\n       also have \"k + 1 < length l\" using kj pj by auto\n       ultimately show ?thesis\n         using a0 cptn_tran_ce_i step_ce_dest\n         by (metis Suc_eq_plus1 prod.exhaust_sel)\n      }\n    qed\n    } thus ?thesis by auto\n  qed\n  ultimately show ?thesis by auto\nqed\n\n\nlemma skip_com_all_skip:\nassumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n        a1:\"fst (l!i) = Skip\" and\n        a2:\"i<length l\" \n   shows \"\\<forall>j. j\\<ge>i \\<and> j <length l \\<longrightarrow> fst (l!j) = Skip\"\nusing a0 a1 a2\nproof (induct \"length l - (i + 1)\" arbitrary: i)\n  case 0  thus ?case by (metis Suc_eq_plus1 Suc_leI diff_is_0_eq nat_less_le zero_less_diff) \nnext \n  case (Suc n)\n  then have l:\"Suc i < length l\" by arith\n  have n:\"n = (length l) - (Suc i + 1)\" using Suc by arith\n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), snd(l!i)) \\<rightarrow>\\<^sub>c\\<^sub>e (fst (l ! Suc i), snd(l ! Suc i))\" \n     using cptn_tran_ce_i Suc\n     by (metis Suc_eq_plus1 l prod.collapse)\n  note x=step_ce_dest[OF this]   \n  then have or:\"fst(l!Suc i) = Skip\" \n  proof\n    {assume \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), snd (l ! i)) \\<rightarrow>\\<^sub>e (fst (l ! Suc i), snd (l ! Suc i))\" \n     thus ?thesis using Suc(4) by (metis env_c_c')\n    }\n  next\n    {assume step:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                      (fst (l ! Suc i), toSeq (snd (l ! Suc i)))\" \n     {assume \"fst(l!i) = Skip\" \n      then have ?thesis using step\n        using final_glob_def no_step_final'\n        using stepc_elim_cases(1) by fastforce\n     }note left = this\n     {assume \"fst(l!i) = Throw\"\n      then have ?thesis using step stepc_elim_cases\n      proof -\n        have \"\\<exists>x. l ! Suc i = (LanguageCon.com.Skip, x)\"\n          using Suc.prems(2) \\<open>fst (l ! i) = LanguageCon.com.Throw\\<close> by auto\n        then show ?thesis\n          by fastforce\n      qed      \n     } then show ?thesis using Suc(4) left by auto\n    }\n  qed\n  show ?case using Suc(1)[OF n a0 or l] Suc(4) Suc(5) by (metis le_less_Suc_eq not_le) \nqed\n\nlemma terminal_com_all_term:\nassumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n        a1:\"fst (l!i) = Skip \\<or> fst (l!i) = Throw  \\<or> \n                 fst (l! i) = Stuck \\<or> (\\<exists>f. fst (l! i) = Fault f)\" and\n        a2:\"i<length l\" \n   shows \"\\<forall>j. j\\<ge>i \\<and> j <length l \\<longrightarrow> fst (l!j) = Skip \\<or> fst (l!j) = Throw  \\<or> \n                 fst (l! j) = Stuck \\<or> (\\<exists>f. fst (l! j) = Fault f)\"\nusing a0 a1 a2\nproof (induct \"length l - (i + 1)\" arbitrary: i)\n  case 0  thus ?case by (metis Suc_eq_plus1 Suc_leI diff_is_0_eq nat_less_le zero_less_diff) \nnext \n  case (Suc n)\n  then have l:\"Suc i < length l\" by arith\n  have n:\"n = (length l) - (Suc i + 1)\" using Suc by arith\n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), snd (l ! i)) \\<rightarrow>\\<^sub>c\\<^sub>e (fst (l ! Suc i), snd (l ! Suc i))\" \n    using cptn_tran_ce_i Suc\n    by (metis Suc_eq_plus1 l prod.collapse)\n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> (fst (l ! Suc i), toSeq (snd (l ! Suc i))) \\<or> \n             \\<Gamma>\\<turnstile>\\<^sub>c (l ! i) \\<rightarrow>\\<^sub>e (l ! Suc i)\" \n    using step_ce_dest by fastforce  \n  then have or:\"fst(l!Suc i) = Skip \\<or> fst(l!Suc i) = Throw  \\<or> \n                 fst (l!Suc i) = Stuck \\<or> (\\<exists>f. fst (l!Suc i) = Fault f)\" \n  proof\n    {assume \"\\<Gamma>\\<turnstile>\\<^sub>c (l ! i) \\<rightarrow>\\<^sub>e (l ! Suc i)\" \n     thus ?thesis using Suc(4) by (metis env_c_c' prod.collapse)\n    }\n  next\n    {assume step:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                      (fst (l ! Suc i), toSeq (snd (l ! Suc i)))\" \n      show ?thesis using step stepc_elim_cases\n      proof -\n        obtain dd :: 'd where\n          \"fst (l ! i) = LanguageCon.com.Throw \\<or> fst (l ! i) = com.Stuck \\<or> fst (l ! i) = com.Fault dd\"\n          by (metis (no_types) Suc.prems(2) local.step stepc_elim_cases(1))\n        then show ?thesis\n          by (metis (full_types) local.step stepc_elim_cases(11) stepc_elim_cases(13) stepc_elim_cases(14))\n      qed \n    } \n  qed\n  show ?case using Suc(1)[OF n a0 or l] Suc(4) Suc(5) \n    by (metis le_less_Suc_eq not_le) \nqed\n\nlemma only_one_c_comp_tran:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!0) = c\" and         \n         a2: \"Suc i<length l \\<and> \n             (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                  (fst (l ! Suc i), toSeq (snd (l ! Suc i))))\" and\n         a3: \"i < j \\<and> Suc j < length l \\<and> \n             \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                 (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> fst (l!j) = c\" and\n         a4: \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(c, s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> \n                        ((c1=Skip) \\<or> (c1=Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)) \" and\n         a5: \"(\\<forall>k < i. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n   shows \"P\"\nproof - \n  have fst:\"fst (l!i) = c\" using a0 a1 a5\n    by (simp add: a2 cptn_env_same_prog)\n  then have suci:\"fst (l!Suc i) = Skip \\<or> fst (l!Suc i) = Throw \\<or> \n                 fst (l!Suc i) = Stuck \\<or> (\\<exists>f. fst (l!Suc i) = Fault f)\" \n    using a4 a2 by metis \n  then have \"fst (l!j) = Skip \\<or> fst (l!j) = Throw \\<or> \n                 fst (l! j) = Stuck \\<or> (\\<exists>f. fst (l! j) = Fault f)\" \n  proof -\n    have \"Suc i \\<le> j\"\n      using Suc_leI a3 by presburger\n    then show ?thesis\n      using Suc_lessD  terminal_com_all_term[OF a0 suci] a2 a3\n      by blast\n  qed \n  moreover {\n    assume \"fst (l ! j) = Skip\"\n    then have ?thesis using a3 \n      using stepc_elim_cases(1) by fastforce\n  }\n  moreover\n    {assume asm:\"fst (l ! j) = Throw\"\n     then have ?thesis\n       using a3 stepc_elim_cases(11) by fastforce              \n   } \n  moreover\n    {assume asm:\"fst (l ! j) = Stuck\"\n     then have ?thesis\n       using a3 stepc_elim_cases(14) by fastforce              \n   } \n  moreover\n    {assume asm:\"\\<exists>f. fst (l ! j) = Fault f\"\n     then have ?thesis\n       using a3 stepc_elim_cases(13) by fastforce              \n    } ultimately show ?thesis by fastforce\n  qed\n\n\nlemma only_one_component_tran1:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!0) = c\" and         \n         a2:\"Suc i<length l \\<and> \n             (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                  (fst (l ! Suc i), toSeq (snd (l ! Suc i))))\" and\n         a3: \"j \\<noteq> i \\<and> Suc j < length l \\<and> \n                  \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                 (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> fst (l!j) = c\" and\n         a4: \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(c, s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> \n                        ((c1=Skip) \\<or> (c1=Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)) \"\n   shows \"P\"\nproof (cases \"j=i\")\n  case True thus ?thesis using a3 by auto\nnext\n  case False note j_neq_i=this \n  thus ?thesis\n  proof (cases \"j<i\")\n    case True \n    thus ?thesis \n      using a0 a2 a3 a4   True only_one_component_tran_j Suc_leI \n      by blast\n  next\n    case False \n    obtain j1 \n    where all_ev:\"j1\\<le>i \\<and>  \n                 \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j1), toSeq (snd (l ! j1))) \\<rightarrow> \n                 (fst (l ! Suc j1), toSeq (snd (l ! Suc j1))) \\<and> \n                 (\\<forall>k < j1. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n      using a0 a2 a3 exist_first_comp_tran by blast\n    then have fst:\"fst (l!j1) = c\" \n      using a0 a1 a2 cptn_env_same_prog le_imp_less_Suc less_trans_Suc by blast\n    have suc:\"Suc j1 < length l \\<and> \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j1), toSeq (snd (l ! j1))) \\<rightarrow> \n                 (fst (l ! Suc j1), toSeq (snd (l ! Suc j1)))\" using all_ev a2\n       using Suc_lessD le_eq_less_or_eq less_trans_Suc by linarith\n    have evs:\"(\\<forall>k < j1. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\" using all_ev by auto\n    have j:\"j1 < j \\<and> Suc j < length l \\<and> \n              \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n              (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> fst (l ! j) = c\"\n      using a3 all_ev False by auto\n    then show ?thesis \n      using only_one_c_comp_tran[OF a0 a1 suc j a4 evs] by auto   \n  qed\nqed  \n \nlemma only_one_component_tran_i:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = c\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                  (fst (l ! Suc i), toSeq (snd (l ! Suc i))))\" and\n         a3: \"k\\<le>j \\<and> j \\<noteq> i \\<and> Suc j < length l \\<and> \n                 \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                 (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> fst (l!j) = c\" and\n         a4: \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(c, s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> \n                        ((c1=Skip) \\<or> (c1=Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)) \"\n   shows \"P\"\nusing a0 a1 a2 a3 a4 \nproof (induct k arbitrary: l i j )\n  case 0 show ?thesis using only_one_component_tran1[OF 0(1) 0(2) ]  0 by blast\nnext\n  case (Suc n) \n   then obtain a1 l1 where l: \"l=a1#l1\"\n    by (metis less_nat_zero_code list.exhaust list.size(3))\n  then have l1notempty:\"l1\\<noteq>[]\" using Suc by force    \n  then obtain i' where i': \"i=Suc i'\" using Suc \n    using less_imp_Suc_add using Suc_le_D by meson \n  then obtain j' where j': \"j=Suc j'\" using Suc\n    using Suc_le_D by meson      \n  have a0:\"(\\<Gamma>,l1)\\<in>cptn\" using Suc l\n    using tl_in_cptn l1notempty by meson\n  moreover have a1:\"fst (l1 ! n) = c\"\n    using Suc l l1notempty by force  \n  moreover have a2:\"Suc i' < length l1 \\<and> n \\<le> i' \\<and> \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1!i'), toSeq (snd (l1!i')))  \\<rightarrow> \n               (fst (l1!(Suc i')), toSeq (snd (l1!(Suc i'))))\"\n    using Suc l l1notempty i' by auto\n  moreover have a3:\"n \\<le> j' \\<and> j' \\<noteq> i' \\<and> Suc j' < length l1 \\<and> \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1!j'), toSeq (snd (l1!j')))  \\<rightarrow> \n               (fst (l1!(Suc j')), toSeq (snd (l1!(Suc j')))) \\<and> fst (l1!j') = c\"\n    using Suc l l1notempty i' j' by auto\n  show ?case using Suc(1)[OF a0 a1 a2 a3  a4] by auto\nqed\n\nlemma only_one_component_tran:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = c\" and         \n         a2: \"k\\<le>i \\<and>  i \\<noteq> j \\<and> Suc i<length l \\<and> \n                  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                  (fst (l ! Suc i), toSeq (snd (l ! Suc i)))) \\<and>   fst (l!i) = c\" and\n         a3: \"k\\<le>j \\<and> Suc j < length l\" and\n         a4: \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(c,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> \n                        ((c1=Skip) \\<or> (c1=Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f))\" \n   shows \"(\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\nusing a0 a1 a2 a3 a4  only_one_component_tran_i\nproof -\n  {assume \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                (fst (l ! Suc j), toSeq (snd (l ! Suc j)))\" \n     then have j:\"Suc j<length l \\<and> k\\<le>j \\<and> \n                 (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                (fst (l ! Suc j), toSeq (snd (l ! Suc j))))\" using a3 by auto\n     have ?thesis using only_one_component_tran_i[OF a0 a1 j a2 a4 ] \n       by blast \n   }\n\n   moreover \n   { assume \"\\<not>\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                (fst (l ! Suc j), toSeq (snd (l ! Suc j)))\"\n     then have ?thesis\n       by (metis Suc_eq_plus1 a0 a3 cptn_tran_ce_i prod.collapse step_ce_dest)\n   }\n   ultimately show ?thesis by auto\nqed\n  \nlemma only_one_component_tran_all_env:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = c\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> \n                (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                 (fst (l!(Suc i)), toSeq (snd (l!(Suc i))))) \\<and> fst (l!i) = c\" and\n         a3: \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(c,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> \n                        ((c1=Skip) \\<or> (c1=Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f))\"\n   shows \"\\<forall>j. k\\<le>j \\<and> j\\<noteq>i \\<and> Suc j < (length l) \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\nproof -\n  {fix j\n  assume ass:\"k\\<le>j \\<and> j\\<noteq>i \\<and> Suc j < (length l)\"\n  then have a2:\"k \\<le> i \\<and> i \\<noteq> j \\<and> Suc i < length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n               (fst (l!(Suc i)), toSeq (snd (l!(Suc i))))) \\<and> fst (l ! i) = c\"\n    using a2 by auto\n  then have \"(\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\" \n    using only_one_component_tran[OF a0 a1 ] a2 a3 ass  by blast\n  } thus ?thesis by auto\nqed\n\nlemma only_one_component_tran_all_not_comp:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = c\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> ((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n               (fst (l!(Suc i)), toSeq (snd (l!(Suc i)))))) \\<and> fst (l!i) = c\" and\n         a3: \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(c, s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> \n                        ((c1=Skip) \\<or> (c1=Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f))\"\n       shows \"\\<forall>j. k\\<le>j \\<and> j\\<noteq>i \\<and> Suc j < (length l) \\<longrightarrow> \n                   \\<not>((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                      (fst (l!(Suc j)), toSeq (snd (l!(Suc j))))))\"\nproof -\n  {fix j\n  assume ass:\"k\\<le>j \\<and> j\\<noteq>i \\<and> Suc j < (length l)\"\n  then have \"\\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                      (fst (l!(Suc j)), toSeq (snd (l!(Suc j)))))\"    \n      using a0 a1 a2 a3  only_one_component_tran_i ass by blast   \n  } thus ?thesis by auto             \nqed\n\nlemma final_exist_component_tran1:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n          a1: \"fst (l!i) = c\" and        \n          a3: \"i\\<le>j \\<and> j < length l \\<and> final_glob (l!j)\" and          \n          a5: \"c\\<noteq>Skip \\<and> c\\<noteq>Throw \\<and> c\\<noteq>Stuck \\<and> (\\<forall>f. c\\<noteq>Fault f)\"\n  shows \"\\<exists>k. k\\<ge>i \\<and> k<j \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                      (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\nproof -\n  {assume a00:\"\\<forall>k. k\\<ge>i \\<and>  k<j \\<longrightarrow> \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                      (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\" \n    then have \"\\<forall>k. k\\<ge>i \\<and>  k<j \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))\"\n      by (metis (no_types) Suc_eq_plus1 a0 a3 cptn_tran_ce_i less_trans_Suc \n              prod.exhaust_sel step_ce_dest)\n   then have \"fst (l!j) =  fst (l!i)\" using cptn_i_env_same_prog a0 a3 by blast \n   then have False using a3 a1 a5 unfolding final_glob_def by auto\n  }  \n  thus ?thesis by auto\nqed  \n\nlemma final_exist_component_tran:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n          a1: \"fst (l!i) = c\" and                         \n          a2: \"i\\<le>j \\<and> j < length l \\<and> final_glob (l!j)\" and          \n          a3: \"c\\<noteq>Skip \\<and> c\\<noteq>Throw \\<and> c\\<noteq>Stuck \\<and> (\\<forall>f. c\\<noteq>Fault f)\"\n  shows \"\\<exists>k. k\\<ge>i \\<and> k<j \\<and> \\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                         (fst (l!(Suc k)), toSeq (snd (l!(Suc k))))\"\nproof -\n  {assume \"\\<forall>k. k\\<ge>i \\<and>  k<j \\<longrightarrow> \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                 (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\" \n    then have \"\\<forall>k. k\\<ge>i \\<and>  k<j \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))\"\n       by (metis (no_types) Suc_eq_plus1 a0 a2 cptn_tran_ce_i less_trans_Suc \n              prod.exhaust_sel step_ce_dest)\n   then have \"fst (l!j) =  fst (l!i)\" using cptn_i_env_same_prog a0 a2 by blast \n   then have False using a2 a1 a3 unfolding final_glob_def by auto\n  }  \n  thus ?thesis by auto\nqed\n\nlemma suc_not_final_final_c_tran:\n assumes a0: \"(\\<Gamma>, l) \\<in> cptn \" and \n         a1: \"Suc j< length l \\<and> \\<not>final_glob (l!j) \\<and> final_glob (l!Suc j)\"\n shows \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n          (fst (l!(Suc j)), toSeq (snd (l!(Suc j))))\"\nproof -\n   obtain x xs where l:\"l = x#xs\" using a0 cptn.simps by blast\n   obtain c1 s1 c2 s2 where l1:\"l!j = (c1,s1) \\<and> l!(Suc j) = (c2,s2)\" using a1\n     using prod.exhaust_sel by blast \n   have \"\\<not> \\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j))\" \n   proof -\n      { assume a:\"\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j))\"\n        then have eq_fst:\"fst (l!j) = fst (l!Suc j)\" by (metis env_c_c' prod.collapse)\n        { assume \"fst (l!Suc j) = Skip\"\n          then have \"False\" using a1 eq_fst unfolding final_glob_def by fastforce\n        }note p1=this\n        { assume \"fst (l!Suc j) = Throw \" \n          then have \"False\" using a1 eq_fst unfolding final_glob_def\n          by (metis local.l1)\n        }\n        then have False using a1 p1 eq_fst unfolding final_glob_def\n          by (auto simp add: eq_fst)\n      } thus ?thesis by auto\n   qed\n   also have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc j))\" using l cptn_stepc_rtran a0 a1 by fastforce  \n   ultimately show ?thesis using step_ce_not_step_e_step_c local.l1 by fastforce \nqed\n \nlemma final_exist_component_tran_final:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and                                  \n          a2: \"i\\<le>j \\<and> j < length l \\<and> final_glob (l!j)\" and                             \n          a3: \"\\<not>final_glob(l!i)\" \n  shows \"\\<exists>k. k\\<ge>i \\<and> k<j \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                           (fst (l!(Suc k)), toSeq (snd (l!(Suc k))))) \\<and> final_glob(l!(Suc k))\"\nproof -\n  let ?P = \"\\<lambda>j. i\\<le>j \\<and> j < length l \\<and> final_glob (l!j)\"\n  obtain k where k:\"?P k \\<and> (\\<forall>i<k. \\<not> ?P i)\" using a2 exists_first_occ[of ?P j] by auto\n  then have i_k_not_final:\"\\<forall>i'<k. i'\\<ge>i \\<longrightarrow> \\<not>final_glob (l!i')\" using a2 by fastforce\n  have i_eq_j:\"i<j\" using a2 a3 using le_imp_less_or_eq by auto \n  then obtain pre_k  where pre_k:\"Suc pre_k = k\" using a2 k\n    by (metis a3 eq_iff le0 lessE neq0_conv) \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!pre_k), toSeq (snd (l!pre_k)))  \\<rightarrow> \n                    (fst (l!k), toSeq (snd (l!k)))\"\n  proof -\n    have \"pre_k \\<ge>i\" using pre_k i_eq_j using a3 k le_Suc_eq by blast  \n    then have \"\\<not>(final_glob (l!pre_k))\" using i_k_not_final pre_k by auto \n    thus ?thesis using suc_not_final_final_c_tran a0 a2 pre_k k by fastforce\n  qed\n  thus ?thesis using pre_k by (metis a2 a3 i_k_not_final k le_Suc_eq not_less_eq)\nqed \n\n\nsubsection {* Basic Sound *}\n\nlemma basic_skip:\n   \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Basic f e, s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> c1=Skip\"\nproof -\n  {fix s1 s2 c1\n   assume \"\\<Gamma>\\<turnstile>\\<^sub>c(Basic f e,s1)  \\<rightarrow> ((c1,s2))\"     \n   then have \"c1=Skip\" using stepc_elim_cases(3)\n     by fastforce    \n  } thus ?thesis by auto \nqed  \n\nlemma no_comp_tran_before_i_basic:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Basic f e\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                          (fst (l ! Suc i), toSeq (snd (l ! Suc i))))\" and\n         a3: \"k\\<le>j \\<and> j < i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                                  (fst (l ! Suc j), toSeq (snd (l ! Suc j))) )\" and\n         a4: \"\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))\"        \n   shows \"P\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Basic f e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip)\" \n    using  basic_skip by fastforce                  \n  thus ?thesis using  a0 a1 a2 a3 a4  no_comp_tran_before_i by blast\nqed\n\nlemma only_one_component_tran_i_basic:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Basic f e\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                          (fst (l ! Suc i), toSeq (snd (l ! Suc i))))\" and\n         a3: \"k\\<le>j \\<and> j \\<noteq> i \\<and> Suc j < length l \\<and> \n                        (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                             (fst (l ! Suc j), toSeq (snd (l ! Suc j))) ) \\<and> \n              fst (l!j) =  Basic f e\"      \n   shows \"P\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Basic f e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip)\" \n    using  basic_skip by fastforce\n  thus ?thesis using  a0 a1 a2 a3  only_one_component_tran_i[OF a0 a1 a2 ] by blast\nqed   \n\nlemma only_one_component_tran_basic:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Basic f e\" and         \n         a2: \" k\\<le>i \\<and> i \\<noteq> j \\<and>  Suc i<length l \\<and> \n                (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                (fst (l ! Suc i), toSeq (snd (l ! Suc i)))) \\<and> fst (l!i) = Basic f e\" and\n         a3: \"k\\<le>j  \\<and> Suc j < length l\" and\n         a4: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!k) \\<in>  p \\<and> \n                                       Sta q rely \\<and> snd (l!Suc i) \\<in>  q\"       \n   shows \"(\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Basic f e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip)\" \n    using  basic_skip by fastforce\n  thus ?thesis using  a0 a1 a2 a3 a4 only_one_component_tran by blast\nqed   \n\nlemma only_one_component_tran_all_env_basic:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Basic f e\" and         \n         a2: \"k\\<le>i \\<and> Suc i<length l \\<and> ((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                      (fst (l ! Suc i), toSeq (snd (l ! Suc i))))) \\<and> \n             fst (l!i) = Basic f e\" and        \n         a3: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!k) \\<in>  p \\<and> \n                                       Sta q rely \\<and> snd (l!Suc i) \\<in>  q\"\n   shows \"\\<forall>j. k\\<le>j \\<and> j\\<noteq>i \\<and> Suc j < (length l) \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\nproof -\n  have b: \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Basic f e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip)\" \n    using  basic_skip by fastforce\n  show ?thesis \n    by (metis (no_types) a0 a1 a2 a3 only_one_component_tran_basic) \nqed   \n\nlemma only_one_component_tran_all_not_comp_basic:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Basic f e\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> ((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                          (fst (l ! Suc i), toSeq (snd (l ! Suc i)))))  \\<and> fst (l!i) = Basic f e\"           \n       shows \"\\<forall>j. k\\<le>j \\<and> j\\<noteq>i \\<and> Suc j < (length l) \\<longrightarrow> \n                 \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                 (fst (l ! Suc j), toSeq (snd (l ! Suc j))))\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Basic f e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip)\" \n    using  basic_skip by fastforce\n  thus ?thesis using  a0 a1 a2  only_one_component_tran_all_not_comp by blast\nqed   \n\nlemma l1:\"\\<Gamma>\\<turnstile>\\<^sub>c (c, toSeq s)  \\<rightarrow> (c', toSeq s')  \\<Longrightarrow> \n       \\<Gamma>\\<turnstile>\\<^sub>c (c,  s)  \\<rightarrow>\\<^sub>c\\<^sub>e (c',  s') \\<Longrightarrow>\n toSeq s = ns \\<Longrightarrow>\n toSeq s' =ns' \\<Longrightarrow> \n \\<exists>gl.  s =  (ns, gl) \\<and> s' =  (ns',gl)\"\n  by (metis (mono_tags, lifting) eq_fst_iff sndI step_dest1 toSeq.simps(1) )\n\nlemma one_component_tran_basic_f_q:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!0) = Basic f e\" and         \n         a2: \"Suc j<length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                                   (fst (l!(Suc j)), toSeq (snd (l!(Suc j)))))\" and\n         a3: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!0) \\<in> p \\<and> \n                                        Sta q rely\" and\n         a4:\"p \\<subseteq> {s. (f (fst s),snd s) \\<in> q}\"          \n       shows \"fst (l!j) = Basic f e \\<and> fst (l!Suc j) = Skip \\<and> \n                     (\\<exists>na ng. snd (l!j) = (na,ng) \\<and> (na,ng) \\<in> p \\<and> \n                              snd (l!Suc j) = (f na, ng) \\<and> (f na, ng) \\<in> q) \\<and> \n             (\\<forall>k. 0\\<le>k \\<and> j\\<noteq>k \\<and> Suc k < (length l) \\<longrightarrow> \n                    \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                          (fst (l!(Suc k)), toSeq (snd (l!(Suc k))))))\"\nproof-\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Basic f e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip)\" \n    using  basic_skip by fastforce\n  also obtain i where first:\"Suc i<length l \\<and>  \n                            (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                                 (fst (l!(Suc i)), toSeq (snd (l!(Suc i))))) \\<and> \n                            (\\<forall>k < i. \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                        (fst (l!(Suc k)), toSeq (snd (l!(Suc k))))))\"\n    by (metis (no_types) a2 exist_first_comp_tran')\n  moreover then have prg_j:\"fst (l!i) = Basic f e\"  using a1 a0\n   by (metis cptn_env_same_prog not_step_comp_step_env)\n  moreover have sta_j:\"snd (l!i) \\<in>  p\"\n  proof -\n    have a0':\"0\\<le>i \\<and> i<(length l)\" using first by auto\n    have a1':\"(\\<forall>k. 0\\<le>k \\<and> k < i \\<longrightarrow> ((\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))))\" \n      using first not_step_comp_step_env a0 by fastforce   \n    thus ?thesis using stability first a3 a1'  a0' by blast \n  qed \n  moreover obtain gl sl where lj:\"snd (l!i) =  (gl, sl)\"\n    using sta_j by moura  \n  then have \"(snd (l!Suc i) \\<in>  q) \\<and> \n             (snd (l!Suc i) =   (f gl, sl))\"     \n  proof -\n    have \"snd (l!i) \\<in> p\" using sta_j by fastforce\n    moreover then have \"fst(l!Suc i) = Skip \\<and> toSeq(snd(l!Suc i)) =  (f (fst (snd (l!i))))\" \n      using first\n      by (metis Pair_inject prg_j stepc_elim_cases(3) toSeq.simps)\n    moreover have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!i) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc i))\"\n      using a0 cptn_tran_ce_i first by auto     \n    then have  \"snd (l!Suc i) =   (f (fst (snd (l!i))), snd (snd (l!i)))\" \n      using calculation first \n           l1[of \\<Gamma> \"fst (l ! i)\" \"snd (l ! i)\" \"fst (l ! (Suc i))\" \"snd (l ! (Suc i))\"]\n      by (metis prod.collapse sndI toSeq.simps(1))      \n    ultimately show ?thesis using a4 lj by auto\n  qed\n  moreover have \"\\<forall>k. 0\\<le>k \\<and> k\\<noteq>i \\<and> Suc k < (length l) \\<longrightarrow> \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c(fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                                       (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\n    using only_one_component_tran_all_not_comp_basic[OF a0 a1] first a3 \n          a0 a1 only_one_component_tran1 prg_j calculation by blast \n  moreover then have \"i=j\" using a2 by fastforce\n  ultimately show ?thesis using lj by metis\nqed\n\nlemma one_component_tran_basic:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!0) = Basic f e\" and         \n         a2: \"Suc k<length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                   (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\" and\n         a3: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!0) \\<in> p \\<and> \n                                        Sta q rely\" and\n         a4:\"p \\<subseteq> {s. (f (fst s),snd s) \\<in> q}\"           \n  shows \"\\<forall>j. 0\\<le>j \\<and> j\\<noteq>k \\<and> Suc j < (length l) \\<longrightarrow> \n                    \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                          (fst (l!(Suc j)), toSeq (snd (l!(Suc j)))))\"\n  using one_component_tran_basic_f_q[OF a0 a1 a2 a3 a4] by auto\n\nlemma one_component_tran_basic_env:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!0) = Basic f e\" and         \n         a2: \"Suc k<length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\" and\n         a3: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!0) \\<in> p \\<and> \n                                        Sta q rely\" and\n         a4:\"p \\<subseteq> {s. (f (fst s),snd s) \\<in> q}\"           \n  shows \"fst (l!k) = Basic f e \\<and> fst (l!Suc k) = Skip \\<and> \n                     (\\<exists>na ng. snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and> \n                              snd (l!Suc k) =  (f na, ng) \\<and> (f na, ng) \\<in> q) \\<and> \n          (\\<forall>j. 0\\<le>j \\<and> j\\<noteq>k \\<and> Suc j < (length l) \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\nproof - \n  show ?thesis using  a0 one_component_tran_basic_f_q[OF a0 a1 a2 a3 a4]\n    by (metis Suc_eq_plus1 cptn_tran_ce_i prod.exhaust_sel step_ce_dest)\nqed\n\nlemma final_exist_component_tran_basic:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n          a1: \"fst (l!i) = Basic f e\" and                         \n          a3: \"i\\<le>j \\<and> j < length l \\<and> final_glob (l!j)\" \n  shows \"\\<exists>k. k\\<ge>i \\<and> k<j \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                               (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\nproof - \n  show ?thesis using  a0 a1  a3 final_exist_component_tran by blast\nqed \n  \n\n(*lemma assumes a0:\"\\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  c sat [p, R, G, q,a]\"\n      shows \"\\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub>  c sat [p, R, G, q,a]\"\nproof-\n  {     \n    assume a01:\"\\<forall>(b,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call b) sat [p, R, G, q,a]\"\n    have \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p, R, G, q,a]\"\n    proof-\n      {fix s l\n        assume a02:\"(\\<Gamma>,l)\\<in>cpn n \\<Gamma> c s\" and\n               a03:\"(\\<Gamma>,l)\\<in>assum(p, R)\"\n        have \"(\\<Gamma>,l)\\<in>comm(G, (q,a)) F\"  \n        proof-\n          have cpn_cp:\"(\\<Gamma>,l)\\<in>cp \\<Gamma> c s\" using a02\n            using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by fastforce\n        qed\n      } then show ?thesis unfolding  com_validityn_def cpn_def by auto\n    qed\n  } then show ?thesis unfolding com_cvalidityn_def by auto\nqed *)\n\nlemma l2:\n  assumes a0:\"\\<Gamma>\\<turnstile>\\<^sub>c (c, toSeq s)  \\<rightarrow> (c', toSeq s')\" and      \na1:\"(\\<Gamma>, l) \\<in> cptn\" and a2:\"l!i = (c,s)\" and a3:\"l!(Suc i) = (c', s')\" and a4:\"Suc i < length l\" and\na5:\"toSeq s =  ns\" and\na6:\"toSeq s' =  ns'\"\nshows\"\\<exists>gl.  s =  (ns, gl) \\<and> s' =  (ns',gl)\"\nproof-\n  have \" \\<Gamma>\\<turnstile>\\<^sub>c (c,  s)  \\<rightarrow>\\<^sub>c\\<^sub>e (c',  s')\" using a1 a2 a3 a4\n    by (metis Suc_eq_plus1 cptn_tran_ce_i)\n  thus ?thesis using l1[OF a0 _ a5 a6] by auto\nqed\n\nlemma Basic_sound1: \n  assumes a0:\"p \\<subseteq> {s. (f (fst s), snd s) \\<in> q}\" and\n      a1:\"\\<forall>s t. s\\<in>p \\<and> ((fst t)=f (fst s)) \\<and> (snd s =  snd t) \\<longrightarrow> ( s, t) \\<in> G\" and\n      a2:\"Sta p R\" and\n      a3:\"Sta q R\" and\n      a10:\"c \\<in> cp \\<Gamma> (Basic f e) s\" and a11:\"c \\<in> assum(p, R)\"\n    shows \"c\\<in>comm(G, (q,a)) F\"\nproof -   \n  obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n   have cp:\"l!0=(Basic f e,s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10 cp_def c_prod by fastforce\n   have assum:\"snd(l!0) \\<in> (p) \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n             (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n               (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n   using a11 c_prod unfolding assum_def by simp\n   have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n           \\<Gamma>1\\<turnstile>\\<^sub>c(fst (l!i), toSeq(snd (l!i)))  \\<rightarrow> (fst (l!Suc i), toSeq(snd (l!Suc i))) \\<longrightarrow>                             \n           (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n   proof -\n   { fix k\n     assume a00:\"Suc k<length l\" and\n            a11:\"\\<Gamma>1\\<turnstile>\\<^sub>c(fst (l!k), toSeq(snd (l!k)))  \\<rightarrow> (fst (l!Suc k), toSeq(snd (l!Suc k)))\"  \n     have len_l:\"length l > 0\" using cp using cptn.simps by blast \n     then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n     have last_l:\"last l = l!(length l-1)\"\n       using last_length [of a l1] l by fastforce\n     have env_tran:\"env_tran \\<Gamma> p l R\" using assum env_tran_def cp by blast\n     then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n       using env_tran env_tran_right_def a2 unfolding env_tran_def by auto\n     then obtain na ng where \n       all_event:\"fst (l!k) = Basic f e \\<and> fst (l!Suc k) = Skip \\<and> \n                  snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and> \n                  snd (l!Suc k) =  (f na, ng) \\<and> (f na, ng) \\<in> q \\<and>\n                  (\\<forall>j. 0\\<le>j \\<and> k \\<noteq> j \\<and> Suc j < length l \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j))))\"\n       using one_component_tran_basic_env[of \\<Gamma> l f e k R p q] a0 a00 a11 a2 a3 assum cp \n             env_tran_right fst_conv by auto \n     then have \"(snd(l!k), snd(l!(Suc k))) \\<in>  G\"\n        by (simp add: a1)    \n   } thus ?thesis by auto qed\n   have concr:\"(final_glob (last l)  \\<longrightarrow> \n               fst (last l) \\<notin> Fault ` F  \\<longrightarrow>\n               ((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                (fst (last l) = Throw \\<and>  snd (last l) \\<in>  (a)))\"\n   proof-\n   { \n     assume valid:\"final_glob (last l)\"\n     have len_l:\"length l > 0\" using cp using cptn.simps by blast \n     then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n     have last_l:\"last l = l!(length l-1)\"\n       using last_length [of a l1] l by fastforce\n     have env_tran:\"env_tran \\<Gamma> p l R\" using assum env_tran_def cp by blast\n     then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n       using env_tran env_tran_right_def a2 unfolding env_tran_def by auto\n     have \"\\<exists>k. k\\<ge>0 \\<and> k<((length l) - 1) \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                                (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\n     proof -             \n       have \"0\\<le> (length l-1)\" using len_l last_l by auto\n       moreover have \"(length l-1) < length l\" using len_l by auto\n       moreover have \"final_glob (l!(length l-1))\" using valid last_l by auto\n       moreover have \"fst (l!0) = Basic f e\" using cp by auto\n       ultimately show ?thesis \n         using cp final_exist_component_tran_basic env_tran a2 by blast \n     qed\n     then obtain k where k_comp_tran: \"k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n                                       (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                             (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\n       by auto\n     moreover then have \"Suc k < length l\" by auto\n     ultimately obtain na ng where all_event:\"fst (l!k) = Basic f e \\<and> fst (l!Suc k) = Skip \\<and> \n                          snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and> \n                              snd (l!Suc k) =  (f na, ng) \\<and> (f na, ng) \\<in> q \\<and> \n            (\\<forall>j. 0\\<le>j \\<and> j \\<noteq> k \\<and> Suc j < length l \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j))))\"\n        using one_component_tran_basic_env[of \\<Gamma> l f e k R p q] a0  a11 a2 a3 assum cp \n             env_tran_right fst_conv by auto           \n     then have before_k_all_evn:\"\\<forall>j. 0\\<le>j \\<and> j < k  \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\n           using k_comp_tran by fastforce     \n     have after_k_all_evn:\"\\<forall>j. (Suc k)\\<le>j \\<and> Suc j < (length l)  \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\n           using all_event k_comp_tran by fastforce                            \n     then have fst_last_skip:\"fst (last l) = Skip \\<and> snd ((last l)) \\<in>  q\"\n     using  a2 last_l len_l cp env_tran_right a3 all_event assum k_comp_tran \n            stability [of q R l \"Suc k\" \"((length l) - 1)\" _ \\<Gamma>] \n       by fastforce                 \n   } thus ?thesis by auto qed\n   note res = conjI [OF concl concr]                               \n   thus ?thesis using c_prod unfolding comm_def by auto \n qed\n\n\nlemma Basic_sound: \n       \"p \\<subseteq> {s. (f (fst s), snd s) \\<in> q} \\<Longrightarrow>\n       \\<forall>s t. s\\<in>p \\<and> ((fst t)=f (fst s)) \\<and> (snd s =  snd t) \\<longrightarrow> ( s, t) \\<in> G \\<Longrightarrow>       \n       Sta p R \\<Longrightarrow>\n       Sta q R \\<Longrightarrow>       \n       \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub>  (Basic f e) sat [p, R, G, q,a]\"\nproof -  \n assume\n    a0:\"p \\<subseteq> {s. (f (fst s), snd s) \\<in> q}\" and\n    a1:\"\\<forall>s t. s\\<in>p \\<and> ((fst t)=f (fst s)) \\<and> (snd s =  snd t) \\<longrightarrow> ( s, t) \\<in> G\" and\n    a2:\"Sta p R \" and\n    a3:\"Sta q R\" \n{\n    fix s\n    have \"cpn n \\<Gamma> (Basic f e) s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof -\n    {   \n      fix c     \n      assume a10:\"c \\<in> cpn n \\<Gamma> (Basic f e) s\" and a11:\"c \\<in> assum(p, R)\"\n      then have a10:\"c\\<in>cp \\<Gamma> (Basic f e) s\"\n        using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n      have \"c\\<in>comm(G, (q,a)) F\" using Basic_sound1[OF a0 a1 a2 a3 a10 a11] by auto      \n    } thus ?thesis by auto\n    qed \n  } \n  thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\nsubsection {* Spec Sound *}\n\nlemma spec_skip:\n   \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Spec r e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> c1=Skip \\<or> c1 = Stuck\"\nproof -\n  {fix s1 s2 c1\n   assume \"\\<Gamma>\\<turnstile>\\<^sub>c(Spec r e,s1)  \\<rightarrow> ((c1,s2))\"     \n   then have \"c1=Skip \\<or> c1=Stuck\" using stepc_elim_cases(4)\n     by fastforce    \n  } thus ?thesis by auto \nqed  \n\n\nlemma no_comp_tran_before_i_spec:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Spec r e\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                          (fst (l ! Suc i), toSeq (snd (l ! Suc i))))\" and\n         a3: \"k\\<le>j \\<and> j < i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                                  (fst (l ! Suc j), toSeq (snd (l ! Suc j))) )\" and\n         a4: \"\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))\" and  \n         a5: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!0) \\<in>  p \\<and> \n                                        Sta q rely \\<and> snd (l!Suc j) \\<in>  q\" \n   shows \"P\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Spec r e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip) \\<or> c1 =  Stuck\" \n    using  spec_skip by fastforce\n  thus ?thesis using  a0 a1 a2 a3 a4 a5 no_comp_tran_before_i by blast\nqed\n\nlemma only_one_component_tran_i_spec:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Spec r e\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                          (fst (l ! Suc i), toSeq (snd (l ! Suc i))))\" and\n         a3: \"k\\<le>j \\<and> j \\<noteq> i \\<and> Suc j < length l \\<and> \n                             ((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                             (fst (l ! Suc j), toSeq (snd (l ! Suc j))) )) \\<and> \n              fst (l!j) =  Spec r e\" and\n         a4: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!k) \\<in>  p \\<and> \n                                        Sta q rely \\<and> snd (l!Suc j) \\<in> q\"     \n   shows \"P\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Spec r e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip \\<or> c1 = Stuck)\" \n    using  spec_skip by fastforce\n  thus ?thesis using  a0 a1 a2 a3 a4 only_one_component_tran_i[OF a0 a1 a2 ] by blast\nqed   \n\nlemma only_one_component_tran_spec:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Spec r e\" and         \n         a2: \"k\\<le>i  \\<and> i \\<noteq> j \\<and> Suc i<length l \\<and> \n             (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                  (fst (l ! Suc i), toSeq (snd (l ! Suc i)))) \\<and> fst (l!i) =  Spec r e\" and\n         a3: \"k\\<le>j  \\<and> Suc j < length l\"        \n   shows \"(\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Spec r e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip \\<or> c1 = Stuck)\"    \n    by (simp add: spec_skip)\n  thus ?thesis using  a0 a1 a2 a3  only_one_component_tran by blast\nqed   \n\nlemma only_one_component_tran_all_env_spec:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Spec r e\" and         \n         a2: \"k\\<le>i \\<and> Suc i<length l \\<and>((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                      (fst (l ! Suc i), toSeq (snd (l ! Suc i)))))  \\<and> fst (l!i) =  Spec r e\"      \n   shows \"\\<forall>j. k\\<le>j \\<and> j\\<noteq>i \\<and> Suc j < (length l) \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Spec r e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip \\<or> c1 = Stuck)\" \n    by (simp add: spec_skip)\n  thus ?thesis by (metis (no_types) a0 a1 a2 only_one_component_tran_spec) \nqed   \n\nlemma only_one_component_tran_all_not_comp_spec:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Spec r e\" and         \n         a2: \"k\\<le>i \\<and> Suc i<length l \\<and> ((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                          (fst (l ! Suc i), toSeq (snd (l ! Suc i)))))  \\<and> fst (l!i) =  Spec r e\" \n       shows \"\\<forall>j. k\\<le>j \\<and> j\\<noteq>i \\<and> Suc j < (length l) \\<longrightarrow> \n                  \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                        (fst (l ! Suc j), toSeq (snd (l ! Suc j))))\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Spec r e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip \\<or> c1 = Stuck)\" \n     by (simp add: spec_skip)\n  thus ?thesis using  a0 a1 a2  only_one_component_tran_all_not_comp by blast\nqed   \n\nlemma one_component_tran_spec:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!0) = Spec r e\" and         \n         a2: \"Suc j<length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!j), toSeq (snd (l!j)))  \\<rightarrow> \n                                    (fst (l!(Suc j)), toSeq (snd (l!(Suc j)))))\" and\n         a3: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!0) \\<in>  p \\<and> \n                                        Sta q rely\" and\n         a4:\"p \\<subseteq> {s. (\\<forall>t. (fst s, t)\\<in>r \\<longrightarrow> ( t, snd s) \\<in> q) \\<and> (\\<exists>t. (fst s,t) \\<in> r)}\"\n           \n     shows \"fst (l!j) = Spec r e \\<and> fst (l!Suc j) = Skip \\<and> \n            (\\<exists>na ng nb. snd (l!j) = (na,ng) \\<and> (na,ng) \\<in> p \\<and> \n                      snd (l!Suc j) =  (nb, ng) \\<and> (na,nb)\\<in>r \\<and> (nb, ng) \\<in> q) \\<and>\n                (\\<forall>k. 0\\<le>k \\<and> j\\<noteq>k \\<and> Suc k < (length l) \\<longrightarrow> \n                    \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                          (fst (l!(Suc k)), toSeq (snd (l!(Suc k))))))\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Spec r e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip\\<or> c1 = Stuck)\" \n     by (simp add: spec_skip)\n  also obtain i where first:\"Suc i<length l \\<and>  \n                            (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                                 (fst (l!(Suc i)), toSeq (snd (l!(Suc i))))) \\<and> \n                            (\\<forall>k < i. \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                        (fst (l!(Suc k)), toSeq (snd (l!(Suc k))))))\"\n    by (metis (no_types) a2 exist_first_comp_tran')\n  moreover then have prg_j:\"fst (l!i) = Spec r e\" using a1 a0\n   by (metis cptn_env_same_prog not_step_comp_step_env)\n  moreover have sta_j:\"snd (l!i) \\<in> p\"\n  proof -\n    have a0':\"0\\<le>i \\<and> i<(length l)\" using first by auto\n    have a1':\"(\\<forall>k. 0\\<le>k \\<and> k < i \\<longrightarrow> ((\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))))\" \n      using first not_step_comp_step_env a0 by fastforce   \n    thus ?thesis using stability first a3 a1'  a0' by blast \n  qed \n  moreover obtain gl sl where lj:\"snd (l!i) =  (gl, sl)\"\n    using sta_j by moura \n  then  obtain gl' where \"(snd (l!Suc i) \\<in>  q) \\<and> \n                         (snd (l!Suc i) =   (gl', sl)) \\<and> (gl, gl')\\<in>r\"  \n  proof -\n    { \n      have gl:\"toSeq (snd(l!i)) =  gl\" using lj by auto\n      then obtain t where \"(gl, t)\\<in>r\" using a4 sta_j lj by fastforce\n      then obtain gl' where \"toSeq(snd (l!Suc i)) =  gl' \\<and> (gl, gl')\\<in> r\"\n        using stepc_elim_cases(4) by (metis gl first prg_j snd_conv) \n      moreover  have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!i) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(Suc i))\"\n        using a0 cptn_tran_ce_i first by auto \n      then have \"snd (l!Suc i) =  (gl', sl)\" \n        using calculation lj first \n             l1[of \\<Gamma> \"fst (l!i)\" \"snd (l!i)\" \"fst (l!(Suc i))\" \"snd (l!(Suc i))\"]\n        by (metis gl prod.exhaust_sel snd_conv )        \n      moreover have \"(gl', sl) \\<in>  q\" using a4 lj calculation sta_j \n        by fastforce\n      then have  \"snd (l!Suc i) \\<in> q\" using calculation by auto         \n      ultimately have \"\\<exists>gl'. (snd (l!Suc i) \\<in>  q) \\<and> \n                         (snd (l!Suc i) =   (gl', sl)) \\<and> (gl, gl')\\<in>r\" by auto\n  } then show \"(\\<And>gl'. (snd (l!Suc i) \\<in>  q) \\<and> \n               (snd (l!Suc i) =   (gl', sl)) \\<and> (gl, gl')\\<in>r \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\"\n    ..\n  qed    \n  moreover have \"\\<forall>k. 0\\<le>k \\<and> k\\<noteq>i \\<and> Suc k < (length l) \\<longrightarrow> \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c(fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                                       (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\n    using only_one_component_tran_all_not_comp_spec[OF a0 a1] first a3 \n          a0 a1 calculation(1) only_one_component_tran1 prg_j calculation by blast\n  moreover then have \"i=j\" using a2 by fastforce\n  ultimately show ?thesis using lj\n    by (metis fst_conv step_spec_skip_stuck toSeq.simps)\nqed   \n\nlemma one_component_tran_spec_env:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!0) = Spec r e\" and         \n         a2: \"Suc k<length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                    (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\" and\n         a3: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!0) \\<in> p \\<and> \n                                        Sta q rely\" and\n         a4:\"p \\<subseteq> {s. (\\<forall>t. (fst s, t)\\<in>r \\<longrightarrow> ( t, snd s) \\<in> q) \\<and> (\\<exists>t. (fst s,t) \\<in> r)}\"           \n  shows \"fst (l!k) = Spec r e \\<and> fst (l!Suc k) = Skip \\<and> \n            (\\<exists>na ng nb. snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and> \n                      snd (l!Suc k) =  (nb, ng) \\<and> (na,nb)\\<in>r \\<and> (nb, ng) \\<in> q) \\<and> \n         (\\<forall>j. 0\\<le>j \\<and> j\\<noteq>k \\<and> Suc j < (length l) \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\nproof - \n\n  show ?thesis using one_component_tran_spec[OF a0 a1 a2 a3 a4]  a0\n       by (metis Suc_eq_plus1 cptn_tran_ce_i prod.exhaust_sel step_ce_dest)\nqed\n\nlemma final_exist_component_tran_spec:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n          a1: \"fst (l!i) = Spec r e\" and                        \n          a3: \"i\\<le>j \\<and> j < length l \\<and> final_glob (l!j)\" \n  shows \"\\<exists>k. k\\<ge>i \\<and> k<j \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                               (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Spec r e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> (c1=Skip \\<or> c1 = Stuck)\" \n     by (simp add: spec_skip)\n  thus ?thesis using  a0 a1  a3 final_exist_component_tran by blast\nqed   \n\nlemma Spec_sound1: \n       \"p \\<subseteq> {s. (\\<forall>t. (fst s, t)\\<in>r \\<longrightarrow> ( t, snd s) \\<in> q) \\<and> (\\<exists>t. (fst s,t) \\<in> r)} \\<Longrightarrow>\n       (\\<forall>s t. s\\<in>p \\<and> (fst s,fst t)\\<in>r \\<and> (snd s) = (snd t) \\<longrightarrow> ( s, t) \\<in> G) \\<Longrightarrow>       \n       Sta p R \\<Longrightarrow>\n       Sta q R \\<Longrightarrow> \n       c \\<in> cp \\<Gamma> (Spec r e) s \\<Longrightarrow>\n       c \\<in> assum(p, R) \\<Longrightarrow>\n       c \\<in> comm (G, (q,a)) F\"   \nproof -  \n assume\n  a0:\"p \\<subseteq> {s. (\\<forall>t. (fst s, t)\\<in>r \\<longrightarrow> ( t, snd s) \\<in> q) \\<and> (\\<exists>t. (fst s,t) \\<in> r)}\" and\n  a1:\"(\\<forall>s t. s\\<in>p \\<and> (fst s,fst t)\\<in>r \\<and> (snd s) = (snd t) \\<longrightarrow> ( s, t) \\<in> G)\" and\n  a2:\"Sta p R\" and\n  a3:\"Sta q R\" and \n  a10:\"c \\<in> cp \\<Gamma> (Spec r e) s\" and\n  a11:\"c \\<in> assum(p, R)\"\n\n  obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n  have cp:\"l!0=(Spec r e,s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10 cp_def c_prod by fastforce\n   have assum:\"snd(l!0) \\<in>  (p) \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n             (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n               (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n   using a11 c_prod unfolding assum_def by simp\n   have concl:\"(\\<forall>i ns ns'. Suc i<length l \\<longrightarrow> \n           \\<Gamma>1\\<turnstile>\\<^sub>c(fst (l!i), toSeq(snd (l!i)))  \\<rightarrow> (fst (l!Suc i), toSeq(snd (l!Suc i))) \\<longrightarrow>                                       \n             (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n   proof -\n   { fix k\n     assume a00:\"Suc k<length l\" and\n            a11:\"\\<Gamma>1\\<turnstile>\\<^sub>c(fst (l!k), toSeq(snd (l!k)))  \\<rightarrow> (fst (l!Suc k), toSeq(snd (l!Suc k)))\"                \n     obtain ck sk csk ssk where tran_pair:\n       \"\\<Gamma>1\\<turnstile>\\<^sub>c (ck,sk)  \\<rightarrow> (csk, ssk) \\<and> (ck = fst (l!k)) \\<and> \n        (sk = toSeq(snd (l!k))) \\<and> (csk = fst (l!(Suc k))) \\<and> (ssk = toSeq(snd (l!(Suc k))))\" \n       using a11 by fastforce\n     have len_l:\"length l > 0\" using cp using cptn.simps by blast \n     then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n     have last_l:\"last l = l!(length l-1)\"\n       using last_length [of a l1] l by fastforce\n     have env_tran:\"env_tran \\<Gamma> p l R\" using assum env_tran_def cp by blast\n     then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n       using env_tran env_tran_right_def unfolding env_tran_def by auto\n     then obtain na nb ng where k_spec:\n       \"fst (l!k) = Spec r e \\<and> fst (l!Suc k) = Skip \\<and> \n            (snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and> \n                      snd (l!Suc k) =  (nb, ng) \\<and> (na,nb)\\<in>r \\<and> (nb, ng) \\<in> q)\"\n        and all_event:\"(\\<forall>j. 0\\<le>j \\<and> k \\<noteq> j \\<and> Suc j < length l \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j))))\"\n       using a00 a11   one_component_tran_spec_env[of \\<Gamma> l r e k R p q] \n             env_tran_right fst_conv a0 a2 a3 cp len_l assum\n       by fastforce\n     then have before_k_all_evn:\"\\<forall>j. 0\\<le>j \\<and> j < k  \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\n           using a00 a11  by fastforce                                                                             \n     then have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n       using k_spec a1 tran_pair\n       by (simp add: a1) \n   } thus ?thesis by auto qed\n  have concr:\"(final_glob (last l)  \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>\n      ((fst (last l) = Skip \\<and> snd (last l) \\<in> q)) \\<or>\n       (fst (last l) = Throw \\<and> snd (last l) \\<in> (a)))\"\n   proof-\n   { \n     assume valid:\"final_glob (last l)\" \n     have len_l:\"length l > 0\" using cp using cptn.simps by blast \n     then obtain a l1 where l:\"l=a#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n     have last_l:\"last l = l!(length l-1)\"\n       using last_length [of a l1] l by fastforce\n     have env_tran:\"env_tran \\<Gamma> p l R\" using assum env_tran_def cp by blast\n     then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n       using env_tran env_tran_right_def unfolding env_tran_def by auto\n     have \"\\<exists>k. k\\<ge>0 \\<and> k<((length l) - 1) \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                                (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\n     proof -             \n       have \"0\\<le> (length l-1)\" using len_l last_l by auto\n       moreover have \"(length l-1) < length l\" using len_l by auto\n       moreover have \"final_glob (l!(length l-1))\" using valid last_l by auto\n       moreover have \"fst (l!0) = Spec r e\" using cp by auto\n       ultimately show ?thesis \n         using cp final_exist_component_tran_spec env_tran  by blast \n     qed\n     then obtain k  where k_comp_tran: \"k\\<ge>0 \\<and> k<((length l) - 1) \\<and>  \n                                         (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                                            (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\n       by auto\n     then obtain ck sk csk ssk where tran_pair:\n       \"\\<Gamma>1\\<turnstile>\\<^sub>c (ck,sk)  \\<rightarrow> (csk, ssk) \\<and> (ck = fst (l!k)) \\<and> \n         (sk = toSeq(snd (l!k))) \\<and> (csk = fst (l!(Suc k))) \\<and> (ssk = toSeq(snd (l!(Suc k))))\" \n       using cp by fastforce\n     moreover then have \"Suc k < length l\" using k_comp_tran by auto\n     ultimately obtain na nb ng where k_spec:\n       \"fst (l!k) = Spec r e \\<and> fst (l!Suc k) = Skip \\<and> \n            (snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and> \n                      snd (l!Suc k) =  (nb, ng) \\<and> (na,nb)\\<in>r \\<and> (nb, ng) \\<in> q)\"\n        and all_event:\"(\\<forall>j. 0\\<le>j \\<and> k \\<noteq> j \\<and> Suc j < length l \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j))))\"\n       using one_component_tran_spec_env[of \\<Gamma> l r e k R p q] \n             env_tran_right  a0 a2 a3 cp assum\n       by fastforce                                       \n     then have fst_last_skip:\"fst (last l) = Skip \\<and> \n                         snd ((last l)) \\<in>  q\"\n       using  k_spec a2 last_l len_l cp env_tran_right a3 all_event assum k_comp_tran \n            stability [of q R l \"Suc k\" \"((length l) - 1)\" _ \\<Gamma>] by fastforce       \n   } thus ?thesis by auto qed\n   note res = conjI [OF concl concr]                           \n   thus ?thesis using c_prod unfolding comm_def by auto \n qed\n \nlemma Spec_sound: \n       \"p \\<subseteq> {s. (\\<forall>t. (fst s, t)\\<in>r \\<longrightarrow> ( t, snd s) \\<in> q) \\<and> (\\<exists>t. (fst s,t) \\<in> r)} \\<Longrightarrow>\n       (\\<forall>s t. s\\<in>p \\<and> (fst s,fst t)\\<in>r \\<and> (snd s) = (snd t) \\<longrightarrow> ( s, t) \\<in> G) \\<Longrightarrow>     \n       Sta p R \\<Longrightarrow>\n       Sta q R \\<Longrightarrow>    \n       \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub>  (Spec r e) sat [p, R, G, q,a]\"\nproof -  \n assume\n    a0:\"p \\<subseteq> {s. (\\<forall>t. (fst s, t)\\<in>r \\<longrightarrow> ( t, snd s) \\<in> q) \\<and> (\\<exists>t. (fst s,t) \\<in> r)}\" and\n    a1:\"(\\<forall>s t. s\\<in>p \\<and> (fst s,fst t)\\<in>r \\<and> (snd s) = (snd t) \\<longrightarrow> ( s, t) \\<in> G)\" and\n    a2:\"Sta p R\" and\n    a3:\"Sta q R\" \n{\n    fix s\n    have \"cpn n \\<Gamma> (Spec r e) s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof -\n    {   \n      fix c     \n      assume a10:\"c \\<in> cpn n \\<Gamma> (Spec r e) s\" and a11:\"c \\<in> assum(p, R)\"\n      then have a10:\"c\\<in>cp \\<Gamma> (Spec r e) s\"\n        using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n      have \"c\\<in>comm(G, (q,a)) F\" using Spec_sound1[OF a0 a1 a2 a3 a10 a11] by auto      \n    } thus ?thesis by auto\n    qed \n  } \n  thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\nsubsection {* Await Sound *}\n\nlemma await_skip:\n   \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Await b c e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> \n            c1=Skip \\<or> c1 = Throw \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\"\nproof -\n  {fix s1 s2 c1\n   assume \"\\<Gamma>\\<turnstile>\\<^sub>c(Await b c e,s1)  \\<rightarrow> ((c1,s2))\"     \n   then have \"c1=Skip \\<or>  (c1 = Throw ) \\<or>  c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\" \n     by  (auto elim: stepc_elim_cases(8) )     \n  } thus ?thesis by auto \nqed  \n\nlemma no_comp_tran_before_i_await:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Await b c e\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and>  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                          (fst (l ! Suc i), toSeq (snd (l ! Suc i))))\" and\n         a3: \"k\\<le>j \\<and> j < i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                                  (fst (l ! Suc j), toSeq (snd (l ! Suc j))) )\" and\n         a4: \"\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))\" \n   shows \"P\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Await b c e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow>  \n          c1=Skip \\<or> (c1 = Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\" \n    by (simp add: await_skip)\n  thus ?thesis using  a0 a1 a2 a3 a4  no_comp_tran_before_i by blast\nqed\n\nlemma only_one_component_tran_i_await:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Await b c e\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                  (fst (l ! Suc i), toSeq (snd (l ! Suc i))) )\" and\n         a3: \"k\\<le>j \\<and> j \\<noteq> i \\<and> Suc j < length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                                  (fst (l ! Suc j), toSeq (snd (l ! Suc j))) ) \\<and> fst (l!j) = Await b c e\"          \n   shows \"P\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Await b c e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow>  \n          c1=Skip \\<or> (c1 = Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\" \n    by (simp add: await_skip)\n  thus ?thesis using  a0 a1 a2 a3  only_one_component_tran_i by blast\nqed   \n\nlemma only_one_component_tran_await:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Await b c e\" and         \n         a2: \" k\\<le>i \\<and> i \\<noteq> j \\<and>  Suc i<length l \\<and> \n                                (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                  (fst (l ! Suc i), toSeq (snd (l ! Suc i))) ) \\<and> \n               fst (l!i) = Await b c e\" and\n         a3: \"k\\<le>j  \\<and> Suc j < length l\"  \n   shows \"(\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Await b c e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow>  \n          c1=Skip \\<or> (c1 = Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\" \n    by (simp add: await_skip)\n  thus ?thesis using  a0 a1 a2 a3  only_one_component_tran by blast\nqed   \n\nlemma only_one_component_tran_all_env_await:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Await b c e\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                                  (fst (l ! Suc i), toSeq (snd (l ! Suc i))) )  \\<and> \n              fst (l!i) = Await b c e\"      \n   shows \"\\<forall>j. k\\<le>j \\<and> j\\<noteq>i \\<and> Suc j < (length l) \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\nproof -\n have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Await b c e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow>  \n          c1=Skip \\<or> (c1 = Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\" \n    by (simp add: await_skip)\n  thus ?thesis by (metis (no_types) a0 a1 a2  only_one_component_tran_await)\nqed\n   \n\nlemma only_one_component_tran_all_not_comp_await:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!k) = Await b c e\" and         \n         a2: \"Suc i<length l \\<and> k\\<le>i \\<and> \n              (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                  (fst (l ! Suc i), toSeq (snd (l ! Suc i))) )  \\<and> fst (l!i) = Await b c e\"          \n       shows \"\\<forall>j. k\\<le>j \\<and> j\\<noteq>i \\<and> Suc j < (length l) \\<longrightarrow> \n                   \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                    (fst (l ! Suc j), toSeq (snd (l ! Suc j))) )\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Await b c e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow>  \n          c1=Skip \\<or> (c1 = Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\" \n    by (simp add: await_skip)\n  thus ?thesis using  a0 a1 a2 only_one_component_tran_all_not_comp by blast\nqed   \n\nlemma one_component_tran_await:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!0) = Await b c e\" and         \n         a2: \"Suc k<length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                                  (fst (l ! Suc k), toSeq (snd (l ! Suc k)))) \" and\n         a3: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!0) \\<in>  p \\<and> \n                                        Sta q rely \\<and>\n                                        Sta a rely\" and\n         a4:\"p \\<subseteq> {s. \\<Gamma>\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                  (b \\<inter> {c. c = fst s}) c \n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> q},\n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> a}}\"          \n           \n         shows \"(\\<forall>j. 0\\<le>j \\<and> j\\<noteq>k \\<and> Suc j < (length l) \\<longrightarrow> \n                     \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                      (fst (l ! Suc j), toSeq (snd (l ! Suc j))) )) \\<and>\n         (\\<exists>na na' ng. fst (l!k) = Await b c e  \\<and> \n                      snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and>\n             snd (l!Suc k) =  (na', ng) \\<and> \n            (na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l!Suc k) = Skip \\<or> \n             na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G \\<and> (s',ng)\\<in>a}\\<and> fst (l!Suc k) = Throw \\<or> \n             (na' = na \\<and> fst (l!Suc k) \\<in> Fault ` F)))\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Await b c e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow>  \n          c1=Skip \\<or> (c1 = Throw) \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\" \n    by (simp add: await_skip)\n  also obtain j where first:\"(Suc j<length l \\<and> \n                              (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                              (fst (l ! Suc j), toSeq (snd (l ! Suc j))) )) \\<and> \n                 (\\<forall>k < j. \\<not> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                                  (fst (l ! Suc k), toSeq (snd (l ! Suc k))) ))\"\n    by (metis (no_types) a2 exist_first_comp_tran')\n  moreover then have prg_j:\"fst (l!j) = Await b c e\" using a1 a0\n   by (metis cptn_env_same_prog not_step_comp_step_env)\n  moreover have sta_j:\"snd (l!j) \\<in>  p\"\n  proof -\n    have a0':\"0\\<le>j \\<and> j<(length l)\" using first by auto\n    have a1':\"(\\<forall>k. 0\\<le>k \\<and> k < j \\<longrightarrow> ((\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k)))))\" \n      using first not_step_comp_step_env a0 by fastforce   \n    thus ?thesis using stability first a3 a1'  a0' by blast \n  qed \n  from sta_j obtain na ng where \n      k_basic:\"fst (l!j) = Await b c e \\<and> snd (l!j) =  (na, ng) \\<and>  (na,ng) \\<in> p \\<and> snd(l!j) \\<in>  p\" \n      using sta_j prg_j\n      by (metis prod.exhaust_sel)\n  obtain na' where conc:\n    \"snd (l!Suc j) =  (na', ng) \\<and> \n     (na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l!Suc j) = Skip \\<or> \n      na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G  \\<and> (s',ng)\\<in>a} \\<and> fst (l!Suc j) = Throw \\<or>  \n      (na = na' \\<and> fst(l!Suc j) \\<in> Fault ` F))\" \n  proof -    \n    { have \"\\<Gamma>\\<^sub>\\<not>\\<^sub>a,{}\\<Turnstile>\\<^bsub>/F\\<^esub> \n            (b \\<inter> {c. c = na}) c \n             {s'. ( (na,ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in> q},\n             {s'. ( (na,ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in> a}\"\n        using  a4 hoare_sound k_basic by fastforce\n      then have e_auto:\"\\<Gamma>\\<^sub>\\<not>\\<^sub>a\\<Turnstile>\\<^bsub>/F\\<^esub> \n                (b \\<inter> {c. c = na}) c \n                 {s'. ( (na,ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in> q},\n                 {s'. ( (na,ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in> a}\" \n      unfolding cvalid_def by auto    \n      have f': \"\\<Gamma>\\<turnstile>\\<^sub>c(fst (l!j), toSeq(snd(l!j)))  \\<rightarrow> (fst(l!(Suc j)), toSeq(snd(l!(Suc j))))\"      \n        using first by auto\n      have step_await:\"Suc j<length l \\<and> \\<Gamma>\\<turnstile>\\<^sub>c (Await b c e,toSeq(snd(l!j)))  \\<rightarrow> (fst(l!(Suc j)), toSeq(snd(l!(Suc j))))\"\n        using f' k_basic first by fastforce           \n      then have s'_in_bp:\"na\\<in> b \\<and> (na,ng) \\<in> p\"  using k_basic stepc_elim_cases(8)\n        by force\n      then have na:\"na \\<in> ((fst ` p)  \\<inter> b)\"\n        by force\n      moreover have test:\n        \"\\<exists>t. \\<Gamma>\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>c, Normal na\\<rangle> \\<Rightarrow> t \\<and> \n          ((\\<exists>t'. t =Abrupt t' \\<and> toSeq(snd(l!Suc j)) =  t' \\<and> fst(l!Suc j) = Throw) \\<or>\n           (\\<exists>t'. t =Normal t' \\<and> toSeq(snd(l!Suc j)) =  t' \\<and> fst(l!Suc j) = Skip) \\<or>\n           (\\<exists>f. t = xstate.Fault f \\<and> toSeq(snd(l!Suc j)) =  na \\<and> fst(l!Suc j) = Fault f ) \\<or> \n           ( t = xstate.Stuck \\<and> toSeq(snd(l!Suc j)) =  na \\<and> fst(l!Suc j) = Stuck ))\"\n      proof -\n        fix t \n        { assume a00:\"fst(l!Suc j) = Skip\"\n          have ?thesis\n            by (metis a00 fst_conv k_basic step_await stepc_elim_cases_Await_Skip toSeq.simps)          \n        } \n        moreover { assume a00:\"fst(l!Suc j)= Throw \"\n          have ?thesis\n            by (metis a00 first fst_conv k_basic stepc_elim_cases_Await_Throw toSeq.simps)\n        }\n        moreover { assume a00:\"fst(l!Suc j)= Stuck\"\n          have ?thesis\n            by (metis a00 f' fst_conv k_basic stepc_elim_cases_Await_Stuck toSeq.simps)\n        }\n        moreover { assume a00:\"\\<exists>f. fst(l!Suc j)= Fault f\"\n          have ?thesis\n            by (metis a00 f' fst_conv k_basic stepc_elim_cases_Await_Fault toSeq.simps)\n        }\n        ultimately show ?thesis\n          using await_skip step_await by fastforce\n      qed\n      then obtain nna' where e_step:\"\\<Gamma>\\<^sub>\\<not>\\<^sub>a\\<turnstile> \\<langle>c,Normal na\\<rangle> \\<Rightarrow> nna' \\<and> \n               ((\\<exists>t'. nna' =Abrupt t' \\<and> toSeq(snd(l!Suc j)) =  t' \\<and> fst (l ! Suc j) = Throw) \\<or>\n               (\\<exists>t'. nna' =Normal t' \\<and> toSeq(snd(l!Suc j)) =  t' \\<and> fst(l!Suc j) = Skip) \\<or>\n              (\\<exists>f. nna' = xstate.Fault f \\<and> toSeq(snd(l!Suc j)) =  na \\<and> fst(l!Suc j) = Fault f ) \\<or> \n               ( nna' = xstate.Stuck \\<and> toSeq(snd(l!Suc j)) =  na \\<and> fst(l!Suc j) = Stuck )) \" \n        by fastforce\n     \n      { assume \"nna' \\<notin> xstate.Fault ` F\"    \n        then have t_q_a:\n                 \"nna' \\<in> Normal ` {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<union> \n                         Abrupt `  {s'. ( (na, ng),  (s',ng)) \\<in> G  \\<and> (s',ng)\\<in>a}\"\n          using na e_step e_auto unfolding valid_def by auto        \n        then obtain na' where  na':\"toSeq(snd(l!Suc j)) =  na'\" and \n                              \"(na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l ! Suc j) = Skip \\<or> \n                              na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G  \\<and> (s',ng)\\<in>a} \\<and> fst (l ! Suc j) = Throw)\"\n          using e_step  by blast     \n        moreover have \"snd (l!Suc j) =  (na', ng)\" \n          using  na' step_await s'_in_bp k_basic a0 l2[OF conjunct2[OF step_await] a0]            \n          by (auto, metis prod.exhaust_sel)\n        ultimately have \"\\<exists>na'. snd (l!Suc j) =  (na', ng) \\<and> \n                 (na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l ! Suc j) = Skip \\<or> \n                  na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G  \\<and> (s',ng)\\<in>a} \\<and> fst (l ! Suc j) = Throw)\"\n          by auto\n      }\n      moreover { assume \"nna' \\<in> xstate.Fault ` F\" \n        then have \"\\<exists>na'. snd (l!Suc j) =  (na', ng) \\<and> na = na' \\<and> fst(l!Suc j) \\<in> Fault ` F\"\n          using e_step  step_await k_basic l1 cptn_tran_ce_i a0 apply auto\n         by (smt Suc_eq_plus1 cptn_tran_ce_i prod.exhaust_sel step_ce_Normal_eq_l)\n      }\n      ultimately have \n        \"\\<exists>na'. snd (l!Suc j) =  (na', ng) \\<and> \n               (na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l ! Suc j) = Skip \\<or> \n                na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G  \\<and> (s',ng)\\<in>a} \\<and> fst (l ! Suc j) = Throw \\<or>\n                (na = na' \\<and> fst(l!Suc j) \\<in> Fault ` F))\" by auto\n    } then show \"(\\<And>na'. snd (l ! Suc j) =  (na', ng) \\<and>\n            (na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l ! Suc j) = Skip \\<or> \n             na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G  \\<and> (s',ng)\\<in>a} \\<and> fst (l ! Suc j) = Throw \\<or> \n             (na = na' \\<and> fst(l!Suc j) \\<in> Fault ` F)) \\<Longrightarrow>\n            thesis) \\<Longrightarrow> thesis \" .. \n  qed         \n  have \"\\<forall>i. 0\\<le>i \\<and> i\\<noteq>j \\<and> Suc i < (length l) \\<longrightarrow> \n                        \\<not>((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                           (fst (l ! Suc i), toSeq (snd (l ! Suc i))) ))\"\n    using only_one_component_tran_all_not_comp_await[OF a0 a1] first a3 \n          a0 a1 calculation(1) only_one_component_tran1 prg_j by blast\n  moreover then have k:\"k=j\" using a2  by fastforce\n  ultimately have \"(\\<forall>j. 0\\<le>j \\<and> j\\<noteq>k \\<and> Suc j < (length l) \\<longrightarrow> \n                          \\<not>((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                              (fst (l ! Suc j), toSeq (snd (l ! Suc j))))))\" by auto \n  also from conc k k_basic have \n     \" (\\<exists>na na' ng. fst (l!k) = Await b c e \\<and> \n                      snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and>\n             snd (l!Suc k) =  (na', ng) \\<and> \n            (na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l!Suc k) = Skip \\<or> \n             na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G \\<and> (s',ng)\\<in>a}\\<and> fst (l!Suc k) = Throw \\<or>\n            (na = na' \\<and> fst(l!Suc k) \\<in> Fault ` F)))\"\n     by fastforce\n  ultimately show ?thesis by auto\nqed \n\nlemma one_component_tran_await_env:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n         a1: \"fst (l!0) = Await b c e\" and         \n         a2: \"Suc k<length l \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                                (fst (l ! Suc k), toSeq (snd (l ! Suc k))))\" and\n         a3: \"env_tran_right \\<Gamma> l rely \\<and> Sta p rely \\<and> snd (l!0) \\<in>  p \\<and> \n                                        Sta q rely \\<and>\n                                        Sta a rely\" and\n         a4:\"p \\<subseteq> {s. \\<Gamma>\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                  (b \\<inter> {c. c = fst s}) c \n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> q},\n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> a}}\"           \n  shows \"(\\<forall>j. 0\\<le>j \\<and> j\\<noteq>k \\<and> Suc j < (length l) \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))) \\<and> \n         (\\<exists>na na' ng. fst (l!k) = Await b c e  \\<and> \n                    snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and>\n           snd (l!Suc k) =  (na', ng) \\<and> \n          (na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l!Suc k) = Skip \\<or> \n           na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G \\<and> (s',ng)\\<in>a}\\<and> fst (l!Suc k) = Throw \\<or>\n           (na = na' \\<and> fst(l!Suc k) \\<in> Fault ` F)))\"  \nproof - \n  \n  have  \"(\\<forall>j. 0 \\<le> j \\<and> j \\<noteq> k \\<and> Suc j < (length l) \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (l ! j) \\<rightarrow>\\<^sub>e (l ! Suc j))\"\n    using conjunct1[OF  one_component_tran_await[OF a0 a1 a2 a3 a4 ]] \n          a0 Suc_eq_plus1 cptn_tran_ce_i prod.exhaust_sel step_ce_dest by metis    \n  then show ?thesis using one_component_tran_await[OF a0 a1 a2 a3 a4 ] by auto  \nqed\n\nlemma final_exist_component_tran_await:\n  assumes a0:\"(\\<Gamma>, l) \\<in> cptn\" and\n          a1: \"fst (l!i) = Await b c e\" and               \n          a2: \"env_tran \\<Gamma> q l R \" and\n          a3: \"i\\<le>j \\<and> j < length l \\<and> final_glob (l!j)\" \n  shows \"\\<exists>k. k\\<ge>i \\<and> k<j \\<and> (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                               (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\nproof -\n  have  \"\\<forall>s1 s2 c1. \\<Gamma>\\<turnstile>\\<^sub>c(Await b c e,s1)  \\<rightarrow> ((c1,s2)) \\<longrightarrow> \n                (c1=Skip)\\<or> c1 = Throw \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\" \n    by (simp add: await_skip)\n  thus ?thesis using  a0 a1 a2 a3 final_exist_component_tran by blast\nqed   \n\ninductive_cases stepc_elim_cases_Await_Fault:\n\"\\<Gamma>\\<turnstile>\\<^sub>c (Await b c e,  s) \\<rightarrow> (Fault f, s')\"\n\nlemma Await_sound1: \n \"p \\<subseteq> {s. \\<Gamma>\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                  (b \\<inter> {c. c = fst s}) e \n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> q},\n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> a}} \\<Longrightarrow>     \n Sta p R \\<Longrightarrow> Sta q R \\<Longrightarrow> Sta a R \\<Longrightarrow>  (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G) \\<Longrightarrow> \n c \\<in> cp \\<Gamma> (Await b e e1) s \\<Longrightarrow>\n c \\<in> assum(p, R) \\<Longrightarrow>\n c \\<in> comm (G, (q,a)) F\"\nproof -  \n assume\n  a0: \"p \\<subseteq> {s. \\<Gamma>\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                  (b \\<inter> {c. c = fst s}) e \n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> q},\n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> a}}\" and\n  a2:\"Sta p R\" and\n  a3:\"Sta q R\" and\n  a4:\"Sta a R\" and \n  a10:\"c \\<in> cp \\<Gamma> (Await b e e1) s\" and\n  a11:\"c \\<in> assum(p, R)\" and a12:\"(\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G)\"\n\n  obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n  {\n   have cp:\"l!0=(Await b e e1,s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10 cp_def c_prod by fastforce\n   have assum:\"snd(l!0) \\<in> (p) \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n             (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n               (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n   using a11 c_prod unfolding assum_def by simp\n   have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n           (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!i), toSeq (snd (l!i)))  \\<rightarrow> \n                (fst (l!(Suc i)), toSeq (snd (l!(Suc i))))) \\<longrightarrow>                              \n             (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n   proof -\n   { fix k ns ns'\n     assume a00:\"Suc k<length l\" and\n            a11:\"(\\<Gamma>1\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"                \n     have len_l:\"length l > 0\" using cp using cptn.simps by blast \n     then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n     have env_tran:\"env_tran \\<Gamma> p l R\" using assum env_tran_def cp by blast\n     then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n       using env_tran env_tran_right_def unfolding env_tran_def by auto     \n     then have all_event:\n          \"(\\<exists>na na' ng. fst (l!k) = Await b e e1  \\<and> \n                    snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and>\n           snd (l!Suc k) =  (na', ng) \\<and> \n          (na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l!Suc k) = Skip \\<or> \n           na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G \\<and> (s',ng)\\<in>a}\\<and> fst (l!Suc k) = Throw \\<or>\n           (na = na' \\<and> fst(l!Suc k) \\<in> Fault ` F)))\"\n         using a00 a11  one_component_tran_await_env[of \\<Gamma> l b e e1 k R p q a F G] env_tran_right cp len_l\n         using a0 a2 a3 a4 assum fst_conv  by auto                                                                          \n     then obtain na na' ng where ss:\n         \"fst (l!k) = Await b e e1  \\<and> \n                    snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and>\n           snd (l!Suc k) =  (na', ng) \\<and> \n          (na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l!Suc k) = Skip \\<or> \n           na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G \\<and> (s',ng)\\<in>a}\\<and> fst (l!Suc k) = Throw \\<or>\n           (na = na' \\<and> fst(l!Suc k) \\<in> Fault ` F))\"\n       by fastforce \n     then have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n         using a2 a12 unfolding N_def by fastforce\n   } thus ?thesis using cp by blast qed     \n   have concr:\"(final_glob (last l)  \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>\n               ((fst (last l) = Skip \\<and> snd (last l) \\<in> q)) \\<or>\n                (fst (last l) = Throw \\<and> snd (last l) \\<in>  (a)))\"\n   proof-\n   { \n     assume valid:\"final_glob (last l)\" and fault:\"fst (last l) \\<notin> Fault ` F\"       \n     have len_l:\"length l > 0\" using cp using cptn.simps by blast \n     then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n     have last_l:\"last l = l!(length l-1)\"\n       using last_length [of a1 l1] l by fastforce\n     have env_tran:\"env_tran \\<Gamma> p l R\" using assum env_tran_def cp by blast\n     then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n       using env_tran env_tran_right_def unfolding env_tran_def by auto\n     have \"\\<exists>k. k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n                (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\n     proof -             \n       have \"0\\<le> (length l-1)\" using len_l last_l by auto\n       moreover have \"(length l-1) < length l\" using len_l by auto\n       moreover have \"final_glob (l!(length l-1))\" using valid last_l by auto\n       moreover have \"fst (l!0) = Await b e e1\" using cp by auto\n       ultimately show ?thesis \n         using  cp final_exist_component_tran_await env_tran by blast \n     qed\n     then obtain k  where k_comp_tran: \"k\\<ge>0 \\<and> Suc k < length l \\<and> \n                (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l!k), toSeq (snd (l!k)))  \\<rightarrow> \n                (fst (l!(Suc k)), toSeq (snd (l!(Suc k)))))\"\n       by fastforce            \n     obtain na na' ng where all_event:\n          \"(\\<forall>j. 0\\<le>j \\<and> j\\<noteq>k \\<and> Suc j < (length l) \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))) \\<and> \n         (fst (l!k) = Await b e e1  \\<and> \n           snd (l!k) = (na,ng) \\<and> (na,ng) \\<in> p \\<and>\n           snd (l!Suc k) =  (na', ng) \\<and> \n          (na' \\<in> {s'. ( (na, ng),  (s', ng)) \\<in> G \\<and> (s',ng)\\<in>q} \\<and> fst (l!Suc k) = Skip \\<or> \n           na' \\<in> {s'. ( (na, ng),  (s',ng)) \\<in> G \\<and> (s',ng)\\<in>a}\\<and> fst (l!Suc k) = Throw \\<or>\n           na = na' \\<and> fst (l!Suc k) \\<in> Fault ` F))\"\n       using  one_component_tran_await_env[of \\<Gamma> l b e e1 k R p q a F G] a0 a11 a2 a3 a4 assum cp \n              env_tran_right  len_l  fst_conv  k_comp_tran  by fastforce\n     then have before_k_all_evn:\"\\<forall>j. 0\\<le>j \\<and> j < k  \\<longrightarrow> (\\<Gamma>\\<turnstile>\\<^sub>c(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)))\"\n           using k_comp_tran by fastforce\n     then have \n          k_basic:\" (na, ng) \\<in>  (p)\" using all_event by blast           \n     have after_k_all_evn:\"\\<forall>i. Suc k \\<le> i \\<and> i < length l - 1 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c l ! i \\<rightarrow>\\<^sub>e l ! Suc i\"\n       using all_event k_comp_tran by fastforce   \n     then have stat:\"((na',ng)\\<in>q \\<and> fst (l!Suc k) = Skip) \\<or> ((na',ng)\\<in>a \\<and> fst (l!Suc k) = Throw) \\<or>\n                      fst (l!Suc k) \\<in> Fault ` F\"\n       using all_event\n       by blast\n     have k:\"Suc k \\<le> length l - 1 \\<and> length l - 1 < length l\"\n       using k_comp_tran by linarith   \n     have \"fst (last l) = Skip \\<and> \n                snd ((last l)) \\<in> q \\<or>\n                (fst (last l) = Throw \\<and> snd (last l) \\<in> (a))\"\n     proof-\n       { assume a00:\"((na',ng)\\<in>q \\<and> fst (l!Suc k) = Skip)\"\n         then have q:\"snd (l ! Suc k) \\<in>  q\"\n           using all_event  by fastforce               \n         have ?thesis \n           using stability [OF a3 q k _  after_k_all_evn env_tran_right] using a00\n           by (simp add: last_l)\n       }\n       moreover {\n         assume a00:\"((na',ng)\\<in>a \\<and> fst (l!Suc k) = Throw)\"\n         then have q:\"snd (l ! Suc k) \\<in> a\"\n           using all_event  by fastforce\n         have ?thesis \n           using stability [OF a4 q k _  after_k_all_evn env_tran_right] using a00\n           by (simp add: last_l)\n       }\n       moreover {\n         assume \"fst (l!Suc k) \\<in> Fault ` F\"\n         then have ?thesis using fault\n           using cp k_comp_tran last_not_F by blast\n       }\n       ultimately show ?thesis using stat by auto\n     qed     \n   } thus ?thesis by auto qed\n   note res = conjI [OF concl concr]               \n  }              \n  thus ?thesis using c_prod a10 unfolding comm_def split_beta cp_def by auto \nqed \n\nlemma Await_sound: \n \"p \\<subseteq> {s. \\<Gamma>\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                  (b \\<inter> {c. c = fst s}) e \n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> q},\n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> a}} \\<Longrightarrow>     \n Sta p R \\<Longrightarrow> Sta q R \\<Longrightarrow> Sta a R \\<Longrightarrow> (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G) \\<Longrightarrow> \n \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub>  (Await b e e1) sat [p, R, G, q,a]\"\nproof -  \n assume\n  a0: \"p \\<subseteq> {s. \\<Gamma>\\<^sub>\\<not>\\<^sub>a,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                  (b \\<inter> {c. c = fst s}) e \n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> q},\n                   {s'. ( s,  (s', snd s)) \\<in> G \\<and> (s',snd s)\\<in> a}}\" and\n  a2:\"Sta p R\" and\n  a3:\"Sta q R\" and\n  a4:\"Sta a R\"  and a5:\"(\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G)\"\n{\n    fix s\n    have \"cpn n \\<Gamma> (Await b e e1) s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof -\n    {   \n      fix c     \n      assume a10:\"c \\<in> cpn n \\<Gamma> (Await b e e1) s\" and a11:\"c \\<in> assum(p, R)\"\n      then have a10:\"c\\<in>cp \\<Gamma> (Await b e e1) s\"\n        using cp_def cpn_def cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n      have \"c\\<in>comm(G, (q,a)) F\" using Await_sound1[OF a0 a2 a3 a4 a5 a10 a11] by auto      \n    } thus ?thesis by auto\n    qed \n  } \n  thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\nsubsection {* If sound *}\n\n\nlemma cptn_assum_induct:\nassumes\n  a0: \"(\\<Gamma>,l) \\<in> (cp \\<Gamma> c s) \\<and> ((\\<Gamma>,l) \\<in> assum(p, R))\" and\n  a1: \"k < length l \\<and> l!k=(c1, s') \\<and> s' \\<in> p1\"\nshows \"(\\<Gamma>,drop k l)\\<in> ((cp \\<Gamma> c1 ( s')) \\<inter> assum(p1, R) )\"\nproof -\n  have drop_k_s:\"(drop k l)!0 = (c1, s')\" using a1 by fastforce\n  have p1:\"s' \\<in> p1\" using a1 by auto\n  have k_l:\"k < length l\" using a1 by auto\n  show ?thesis\n  proof\n    show \"(\\<Gamma>, drop k l) \\<in> cp \\<Gamma> c1 ( s')\" \n    unfolding cp_def \n    using  a0 a1 drop_k_s \n    by (simp add: cp_def dropcptn_is_cptn)     \n  next\n    let ?c= \"(\\<Gamma>,drop k l)\"\n    have l:\"snd((snd ?c!0)) \\<in>  p1\"\n     using p1 drop_k_s by auto\n    {fix i\n     assume a00:\"Suc i<length (snd ?c)\" \n     assume a11:\"(fst ?c)\\<turnstile>\\<^sub>c((snd ?c)!i)  \\<rightarrow>\\<^sub>e ((snd ?c)!(Suc i))\"\n     have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\<in> R \"\n     using a0 unfolding assum_def using a00 a11 by auto\n    } thus \"(\\<Gamma>, drop k l) \\<in> assum (p1, R)\" \n      using l unfolding assum_def by fastforce  \n  qed  \nqed\n\nlemma cptn_comm_induct:\nassumes\n  a0: \"(\\<Gamma>,l) \\<in> (cp \\<Gamma> c s)\" and\n  a1: \"l1 = drop j l \\<and> (\\<Gamma>, l1)\\<in> comm(G, (q,a)) F\" and\n  a2: \"k \\<ge> j \\<and> j < length l\" \nshows \" ((Suc k < length l \\<longrightarrow>\n       (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n        (fst (l ! Suc k), toSeq (snd (l ! Suc k))) ) \\<longrightarrow>        \n       (snd(l!k), snd(l!(Suc k))) \\<in> G) \n      \\<and> (final_glob (last (l))  \\<longrightarrow>  fst (last (l)) \\<notin> Fault ` F  \\<longrightarrow>         \n            ((fst (last (l)) = Skip \\<and> snd (last (l)) \\<in>  q)) \\<or>\n            (fst (last (l)) = Throw \\<and> snd (last (l)) \\<in>  (a))))\"\nproof -  \n  have pair_\\<Gamma>l:\"fst (\\<Gamma>,l1) = \\<Gamma> \\<and> snd (\\<Gamma>,l1) = l1\" by fastforce  \n  have a03:\"(\\<forall>i.                 \n               Suc i<length (snd (\\<Gamma>, l1)) \\<longrightarrow> \n               (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n                    (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i))) ) \\<longrightarrow>                                             \n                 (snd((snd (\\<Gamma>, l1))!i), snd((snd (\\<Gamma>, l1))!(Suc i))) \\<in> G) \\<and> \n               (final_glob (last (snd (\\<Gamma>, l1)))  \\<longrightarrow> fst (last (l1)) \\<notin> Fault ` F  \\<longrightarrow>                 \n                  ((fst (last (snd (\\<Gamma>, l1))) = Skip \\<and> snd (last (snd (\\<Gamma>, l1))) \\<in>  q)) \\<or>\n                  (fst (last (snd (\\<Gamma>, l1))) = Throw \\<and> snd (last (snd (\\<Gamma>, l1))) \\<in>  (a)))\"\n  using a1 unfolding comm_def by fastforce\n  have last_l:\"last l1 = last l\" using a1 a2 by fastforce\n  show ?thesis  \n  proof -\n    {       \n      { assume \"Suc k < length l\"\n      then have a2: \"k \\<ge> j \\<and> Suc k < length l\" using a2 by auto\n      have \"k \\<le> length l\" using a2 by fastforce\n      then have l1_l:\"(l!k = l1! (k - j) ) \\<and> (l!Suc k = l1!Suc (k - j))\"\n        using a1 a2 by fastforce    \n      have a00:\"Suc (k - j) < length l1\" using a1 a2 by fastforce\n      have \"\\<Gamma>\\<turnstile>\\<^sub>c(fst(l1!(k-j)),toSeq(snd (l1!(k-j))))  \\<rightarrow> \n               (fst(l1!(Suc (k-j))),toSeq(snd (l1!(Suc (k-j))))) \\<longrightarrow>         \n        (snd((snd (\\<Gamma>, l1))!(k-j)), snd((snd (\\<Gamma>, l1))!(Suc (k-j)))) \\<in> G\"\n      using  pair_\\<Gamma>l a00  a03 by presburger\n      then have \" (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                   (fst (l ! Suc k), toSeq (snd (l ! Suc k))) ) \\<longrightarrow> \n        (snd (l ! k), snd (l ! Suc k)) \\<in> G \" \n        using l1_l last_l by auto\n    } \n    then have l_side:\n       \"Suc k < length l \\<longrightarrow>\n        (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n        (fst (l ! Suc k), toSeq (snd (l ! Suc k))) ) \\<longrightarrow>   \n         (snd (l ! k), snd (l ! Suc k)) \\<in> G\" \n      by auto \n    { \n      assume a10:\"final_glob (last (l))\" and  fault:\" fst (last l) \\<notin> Fault ` F\" \n      then have l1_f:\"fst (last l1) \\<notin> Fault ` F\" \n        using a03 a1 a2 by force                 \n      then have final_eq: \"final_glob (last (l1))\"\n        using a10 a1 a2 by fastforce\n      also have \"fst (last (l1)) \\<notin> Fault ` F\"\n        using last_l l1_f by fastforce\n      ultimately have \"((fst (last (snd (\\<Gamma>, l1))) = Skip \\<and> snd (last (snd (\\<Gamma>, l1))) \\<in>  q)) \\<or>\n                      (fst (last (snd (\\<Gamma>, l1))) = Throw \\<and> snd (last (snd (\\<Gamma>, l1))) \\<in>  (a))\"\n        using pair_\\<Gamma>l a03 by presburger\n      then have \"((fst (last (snd (\\<Gamma>, l))) = Skip \\<and> snd (last (snd (\\<Gamma>, l))) \\<in>  q)) \\<or>\n              (fst (last (snd (\\<Gamma>, l))) = Throw \\<and> snd (last (snd (\\<Gamma>, l))) \\<in>  (a))\"\n        using final_eq a1 a2 by auto \n     } then have \n      r_side: \n      \"final_glob (last l) \\<longrightarrow>   fst (last l) \\<notin> Fault ` F \\<longrightarrow>   \n      fst (last l) = LanguageCon.com.Skip \\<and> snd (last l) \\<in>  q \\<or>\n       fst (last l) = LanguageCon.com.Throw \\<and> snd (last l) \\<in> a\"\n       by fastforce\n     note res=conjI[OF l_side r_side] \n   } thus ?thesis by auto\n   qed\nqed\n\nlemma cpn_assum_induct:\nassumes\n  a0: \"(\\<Gamma>,l) \\<in> (cpn n \\<Gamma> c s) \\<and> ((\\<Gamma>,l) \\<in> assum(p, R))\" and\n  a1: \"k < length l \\<and> l!k=(c1, s') \\<and> s' \\<in> p1\"\nshows \"(\\<Gamma>,drop k l)\\<in> ((cpn n \\<Gamma> c1 ( s')) \\<inter> assum(p1, R) )\"\nproof -\n  have drop_k_s:\"(drop k l)!0 = (c1, s')\" using a1 by fastforce\n  have p1:\"s' \\<in> p1\" using a1 by auto\n  have k_l:\"k < length l\" using a1 by auto\n  show ?thesis\n  proof\n    show \"(\\<Gamma>, drop k l) \\<in> cpn n \\<Gamma> c1 ( s')\" \n    unfolding cp_def \n    using  a0 a1  \n    by (simp add: cpn_def dropcptn_is_cptn1) \n  next\n    let ?c= \"(\\<Gamma>,drop k l)\"\n    have l:\"snd((snd ?c!0)) \\<in>  p1\"\n     using p1 drop_k_s by auto\n    {fix i\n     assume a00:\"Suc i<length (snd ?c)\" \n     assume a11:\"(fst ?c)\\<turnstile>\\<^sub>c((snd ?c)!i)  \\<rightarrow>\\<^sub>e ((snd ?c)!(Suc i))\"\n     have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\<in> R \"\n     using a0 unfolding assum_def using a00 a11 by auto\n    } thus \"(\\<Gamma>, drop k l) \\<in> assum (p1, R)\" \n      using l unfolding assum_def by fastforce  \n  qed  \nqed\n\nlemma cpn_comm_induct:\n  assumes\n  a1: \"l1 = drop j l \\<and> (\\<Gamma>, l1)\\<in> comm(G, (q,a)) F\" and\n  a2: \"k \\<ge> j \\<and> j < length l\" \nshows \" ((Suc k < length l \\<longrightarrow>\n       (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n        (fst (l ! Suc k), toSeq (snd (l ! Suc k))) ) \\<longrightarrow>        \n       (snd(l!k), snd(l!(Suc k))) \\<in> G) \n      \\<and> (final_glob (last (l))  \\<longrightarrow>  fst (last (l)) \\<notin> Fault ` F  \\<longrightarrow>         \n            ((fst (last (l)) = Skip \\<and> snd (last (l)) \\<in>  q)) \\<or>\n            (fst (last (l)) = Throw \\<and> snd (last (l)) \\<in> (a))))\"\nproof -  \n  have pair_\\<Gamma>l:\"fst (\\<Gamma>,l1) = \\<Gamma> \\<and> snd (\\<Gamma>,l1) = l1\" by fastforce  \n  have a03:\"(\\<forall>i. Suc i<length (snd (\\<Gamma>, l1)) \\<longrightarrow> \n               (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n                    (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i))) ) \\<longrightarrow>                                             \n                 (snd((snd (\\<Gamma>, l1))!i), snd((snd (\\<Gamma>, l1))!(Suc i))) \\<in> G) \\<and> \n               (final_glob (last (snd (\\<Gamma>, l1)))  \\<longrightarrow>  fst (last (l1)) \\<notin> Fault ` F  \\<longrightarrow>               \n                  ((fst (last (snd (\\<Gamma>, l1))) = Skip \\<and> snd (last (snd (\\<Gamma>, l1))) \\<in> q)) \\<or>\n                  (fst (last (snd (\\<Gamma>, l1))) = Throw \\<and>snd (last (snd (\\<Gamma>, l1))) \\<in> (a)))\"\n  using a1 unfolding comm_def by fastforce\n  have last_l:\"last l1 = last l\" using a1 a2 by fastforce\n  { assume \"Suc k < length l\"\n      then have a2: \"k \\<ge> j \\<and> Suc k < length l\" using a2 by auto\n      have \"k \\<le> length l\" using a2 by fastforce\n      then have l1_l:\"(l!k = l1! (k - j) ) \\<and> (l!Suc k = l1!Suc (k - j))\"\n        using a1 a2 by fastforce    \n      have a00:\"Suc (k - j) < length l1\" using a1 a2 by fastforce\n      have \"\\<Gamma>\\<turnstile>\\<^sub>c(fst(l1!(k-j)),toSeq(snd (l1!(k-j))))  \\<rightarrow> \n               (fst(l1!(Suc (k-j))),toSeq(snd (l1!(Suc (k-j))))) \\<longrightarrow>         \n        (snd((snd (\\<Gamma>, l1))!(k-j)), snd((snd (\\<Gamma>, l1))!(Suc (k-j)))) \\<in> G\"\n      using  pair_\\<Gamma>l a00  a03 by presburger\n      then have \"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                   (fst (l ! Suc k), toSeq (snd (l ! Suc k))) ) \\<longrightarrow> \n        (snd (l ! k), snd (l ! Suc k)) \\<in> G \" \n        using l1_l last_l by auto\n   } then have l_side:\"Suc k < length l \\<longrightarrow>\n    (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n         (fst (l ! Suc k), toSeq (snd (l ! Suc k))) ) \\<longrightarrow>   \n    (snd (l ! k), snd (l ! Suc k)) \\<in> G\" by auto \n   { \n     assume a10:\"final_glob (last (l))\"  and l1_f:\"fst (last (l)) \\<notin> Fault ` F \"         \n     then have final_eq: \"final_glob (last (l1))\"\n       using a10 a1 a2 by fastforce\n     also have \"fst (last (l1)) \\<notin> Fault ` F\"\n       using last_l l1_f by fastforce\n     ultimately have \"((fst (last (snd (\\<Gamma>, l1))) = Skip \\<and> \n                      snd (last (snd (\\<Gamma>, l1))) \\<in>  q)) \\<or>\n                    (fst (last (snd (\\<Gamma>, l1))) = Throw \\<and> \n                      snd (last (snd (\\<Gamma>, l1))) \\<in>  (a))\"\n       using pair_\\<Gamma>l a03 by presburger\n     then have \"((fst (last (snd (\\<Gamma>, l))) = Skip \\<and> \n            snd (last (snd (\\<Gamma>, l))) \\<in>  q)) \\<or>\n            (fst (last (snd (\\<Gamma>, l))) = Throw \\<and> \n           snd (last (snd (\\<Gamma>, l))) \\<in> (a))\"\n       using final_eq a1 a2 by auto \n   } \n   then have \n    r_side: \n    \"final_glob (last l) \\<longrightarrow>  fst (last (l)) \\<notin> Fault ` F \\<longrightarrow>\n    fst (last l) = LanguageCon.com.Skip \\<and> snd (last l) \\<in> q \\<or>\n     fst (last l) = LanguageCon.com.Throw \\<and> snd (last l) \\<in> a\"\n     by fastforce     \n   note res=conjI[OF l_side r_side]    \n   then show ?thesis by auto\n qed\n\n\n\n\nlemma If_sound: \n      \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> b},  R, G, q,a] \\<Longrightarrow>\n       (\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> b},  R, G, q,a]) \\<Longrightarrow>\n       \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c2 sat [p \\<inter> {c. (fst c) \\<in> (-b)},  R, G, q,a] \\<Longrightarrow>\n       (\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c2 sat [p \\<inter> {c. (fst c) \\<in> (-b)},  R, G, q,a]) \\<Longrightarrow>      \n       Sta p R \\<Longrightarrow> (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G)  \\<Longrightarrow> \n       \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Cond b c1 c2) sat [p, R, G, q,a]\"\nproof -  \n assume\n    a0:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> b},  R, G, q,a]\" and\n    a1:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c2 sat [p \\<inter> {c. (fst c) \\<in> (-b)}, R, G, q,a]\" and    \n    a2: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> b}, R, G, q,a]\" and\n    a3: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c2 sat [p \\<inter> {c. (fst c) \\<in> (-b)}, R, G, q,a]\" and\n    a4: \"Sta p R\" and\n    a5: \"(\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G)\"\n  { \n    fix s\n    assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n    then have a3:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c2 sat [p \\<inter> {c. (fst c) \\<in> (-b)}, R, G, q,a]\" \n      using a3 com_cvalidityn_def  by fastforce \n    have a2:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> b}, R, G, q,a]\"\n      using a2 all_call com_cvalidityn_def  by fastforce \n    have \"cpn n \\<Gamma> (Cond b c1 c2)  s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof -\n    {   \n      fix c     \n      assume a10:\"c \\<in> cpn n \\<Gamma> (Cond b c1 c2) s\" and a11:\"c \\<in> assum(p, R)\"\n      then have a10':\"c \\<in> cp \\<Gamma> (Cond b c1 c2) s\" unfolding cp_def cpn_def\n        using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n      obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n      have \"c \\<in> comm(G, (q,a)) F\"      \n      proof -         \n      {have cp:\"l!0=((Cond b c1 c2),s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10' cp_def c_prod by fastforce\n       have \\<Gamma>1:\"(\\<Gamma>, l) = c\" using c_prod cp by blast\n       have assum:\"snd(l!0) \\<in>  (p) \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n                 (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n                   (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n       using a11 c_prod unfolding assum_def by simp\n       then have env_tran:\"env_tran \\<Gamma> p l R\" using env_tran_def cp by blast\n       then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n         using env_tran env_tran_right_def unfolding env_tran_def by auto\n       have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n               (\\<Gamma>1\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                     (fst (l ! Suc i), toSeq (snd (l ! Suc i))) ) \\<longrightarrow>               \n                 (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n       proof -\n       { fix k ns ns'\n         assume a00:\"Suc k<length l\" and\n                a21:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                          (fst (l ! Suc k), toSeq (snd (l ! Suc k))) )\"                                                                           \n         obtain j where before_k_all_evnt:\n           \"j\\<le>k \\<and>  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                         (fst (l ! Suc j), toSeq (snd (l ! Suc j))) ) \\<and> \n            (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n           using a00 a21 exist_first_comp_tran cp by blast\n         then obtain cj sj csj ssj where pair_j:\n              \"(\\<Gamma>\\<turnstile>\\<^sub>c(cj,sj)  \\<rightarrow> (csj,ssj)) \\<and> \n                cj = fst (l!j) \\<and> sj = toSeq(snd (l!j)) \\<and> csj = fst (l!(Suc j)) \\<and> \n                 ssj = toSeq(snd(l!(Suc j)))\"\n           by fast  \n         then have  pair_j1:\"(\\<Gamma>\\<turnstile>\\<^sub>c(fst (l!j),toSeq(snd (l!j)))  \\<rightarrow> (fst (l!(Suc j)),toSeq(snd(l!(Suc j)))))\"\n           by auto\n         have k_basic1:\"cj = (Cond b c1 c2) \\<and> snd (l!j) \\<in> (p)\" \n           using pair_j before_k_all_evnt cp env_tran_right a4 assum a00 stability[of p R l 0 j j \\<Gamma>]\n         by force\n         have k_basic:\"cj = (Cond b c1 c2) \\<and> sj \\<in> (fst` p)\" \n           using pair_j before_k_all_evnt cp env_tran_right a4 assum a00 stability[of p R l 0 j j \\<Gamma>]\n         by force\n         then obtain s' where ss:\"sj = s' \\<and> s'\\<in> (fst ` p)\" by fastforce \n         moreover have ssj_normal_s:\"ssj =  s'\" \n           using before_k_all_evnt k_basic pair_j calculation\n           by (metis snd_conv stepc_elim_cases(6)) \n         ultimately obtain sl where \n           lj:\"snd (l!j) =  (s', sl) \\<and> snd (l!(Suc j)) =  (s', sl)\"\n           using  cp  l2[of \\<Gamma> \"fst (l!j)\" \"snd (l!j)\" \"fst (l!(Suc j))\" \"snd (l!(Suc j))\" ] a00\n           using before_k_all_evnt pair_j  cptn_tran_ce_i l1 by fastforce           \n         have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n           using ss a2 unfolding Satis_def         \n         proof (cases \"k=j\")   \n           case True          \n             have \"( (s', sl),  (s', sl)) \\<in> G\" \n               using a5 k_basic1 lj unfolding N_def  by fastforce\n             thus \"(snd (l ! k), snd (l ! Suc k)) \\<in> G\"\n               using pair_j k_basic True ss ssj_normal_s lj by auto\n         next\n           case False\n           have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n           have l_suc:\"l!(Suc j) = (csj,  (s',sl))\" \n             using before_k_all_evnt pair_j lj ssj_normal_s\n             by (metis prod.exhaust_sel)\n           have l_k:\"j<k\" using  before_k_all_evnt False by fastforce\n           have \"s'\\<in>b \\<or> s'\\<notin>b\" by auto                         \n           thus \"(snd (l ! k), snd (l ! Suc k)) \\<in> G\"\n           proof\n             assume a000:\"s'\\<in>b\"\n             then have cj:\"csj=c1\" using k_basic pair_j ss \n               by (metis (no_types) fst_conv stepc_elim_cases(6))\n             moreover have p1:\"(s',sl) \\<in> (p \\<inter> {c. (fst c) \\<in> b})\" \n               using a000 ss k_basic1 lj by auto              \n             moreover  have \"cpn n \\<Gamma> csj ( (s',sl)) \\<inter> assum((p \\<inter> {c. (fst c) \\<in> b}), R) \\<subseteq> comm(G, (q,a)) F\"\n               using calculation a2 com_validityn_def cj by blast             \n             ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n               using l_suc j_length a10 a11 \\<Gamma>1  ssj_normal_s\n                     cpn_assum_induct[of \\<Gamma> l n \"(LanguageCon.com.Cond b c1 c2)\" s p R  \"Suc j\" c1 \"(s',sl)\" \"(p \\<inter> {c. (fst c) \\<in> b})\"]\n               by blast                         \n             show ?thesis \n               using l_k drop_comm a00 a21  a10 \\<Gamma>1   \n               cpn_comm_induct\n               by fastforce                       \n           next\n             assume a000:\"s'\\<notin>b\"\n             then have cj:\"csj=c2\" using k_basic pair_j ss \n               by (metis (no_types) fst_conv stepc_elim_cases(6))\n             moreover have p1:\"(s',sl) \\<in> (p \\<inter> {c. (fst c) \\<in> (-b)})\"  \n                  using a000 ss ss l_suc k_basic1 lj by auto     \n             moreover then have \"cpn n \\<Gamma> csj ( (s',sl)) \\<inter> assum((p \\<inter> {c. (fst c) \\<in> (-b)}), R)  \\<subseteq> comm(G, (q,a)) F\"\n               using a3 com_validityn_def cj by blast             \n             ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n               using l_suc j_length a10 a11 \\<Gamma>1  ssj_normal_s\n                     cpn_assum_induct[of \\<Gamma> l n \"(LanguageCon.com.Cond b c1 c2)\" s p R  \"Suc j\" c2 \"(s',sl)\" \"(p \\<inter> {c. (fst c) \\<in> (-b)})\"]\n               by fastforce             \n             show ?thesis \n               using l_k drop_comm a00 a21 a10 \\<Gamma>1 cpn_comm_induct\n               unfolding Satis_def by fastforce\n           qed\n         qed \n       } thus ?thesis by (simp add: c_prod cp) qed\n       have concr:\"(final_glob (last l)  \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>\n                   ((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> (a)))\"\n       proof-\n       { \n         assume valid:\"final_glob (last l)\" \n         assume not_fault:  \"fst (last l) \\<notin> Fault ` F\"                 \n         have \"\\<exists>k. k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n                          \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                          (fst (l ! Suc k), toSeq (snd (l ! Suc k))) \\<and> \n                 final_glob (l!(Suc k))\"\n         proof -             \n           have len_l:\"length l > 0\" using cp using cptn.simps by blast \n           then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n           have last_l:\"last l = l!(length l-1)\"\n             using last_length [of a1 l1] l by fastforce\n           have final_0:\"\\<not>final_glob(l!0)\" using cp unfolding final_glob_def by auto\n           have \"0\\<le> (length l-1)\" using len_l last_l by auto\n           moreover have \"(length l-1) < length l\" using len_l by auto\n           moreover have \"final_glob (l!(length l-1))\" using valid last_l by auto\n           moreover have \"fst (l!0) = LanguageCon.com.Cond b c1 c2\" using cp by auto\n           ultimately show ?thesis \n             using cp final_exist_component_tran_final env_tran_right final_0  \n             by blast \n         qed\n         then obtain k where a21: \"k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n              \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                (fst (l ! Suc k), toSeq (snd (l ! Suc k))) \\<and> final_glob (l!(Suc k))\"\n           by auto\n        then have a00:\"Suc k<length l\" by fastforce\n        then obtain j where before_k_all_evnt:\n          \"j\\<le>k \\<and>  \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                       (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n           using a00 a21 exist_first_comp_tran cp by blast\n         then obtain cj sj csj ssj where \n             pair_j:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                          (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> \n                      cj = fst (l!j) \\<and> sj = toSeq(snd (l!j)) \\<and>  \n                      csj = fst (l!(Suc j)) \\<and> ssj = toSeq(snd(l!(Suc j)))\"\n         by fastforce\n       have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce                                 \n       then have k_basic1:\"cj = (Cond b c1 c2) \\<and> snd (l!j) \\<in>(p)\" \n         using  pair_j before_k_all_evnt cp env_tran_right a4 assum a00 stability[of p R l 0 j j \\<Gamma>]\n         by fastforce\n       have k_basic:\"cj = (Cond b c1 c2) \\<and> sj \\<in>  (fst` p)\" \n           using pair_j before_k_all_evnt cp env_tran_right a4 assum a00 stability[of p R l 0 j j \\<Gamma>]\n         by force\n       then obtain s' where ss:\"sj =  s' \\<and> s'\\<in> (fst ` p)\"\n         by blast \n       moreover have ssj_normal_s:\"ssj =  s'\" using before_k_all_evnt k_basic pair_j\n          using before_k_all_evnt k_basic pair_j calculation\n           by (metis snd_conv stepc_elim_cases(6)) \n       ultimately obtain sl where \n           lj:\"snd (l!j) =  (s', sl) \\<and> snd (l!(Suc j)) =  (s', sl)\"\n           using  cp  l2[of \\<Gamma> \"fst (l!j)\" \"snd (l!j)\" \"fst (l!(Suc j))\" \"snd (l!(Suc j))\"] a00\n           using before_k_all_evnt pair_j by fastforce\n       have l_suc:\"l!(Suc j) = (csj,  (s',sl))\" \n             using before_k_all_evnt pair_j lj ssj_normal_s\n             by (metis prod.exhaust_sel)\n       have \"s'\\<in>b \\<or> s'\\<notin>b\" by auto \n       then have \"((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  (a))\"\n       proof\n         assume a000:\"s'\\<in>b\"\n         then have cj:\"csj=c1\" using k_basic pair_j ss \n                  by (metis (no_types) fst_conv stepc_elim_cases(6))\n         moreover have p1:\"(s',sl) \\<in> (p \\<inter> {c. (fst c) \\<in> b})\" using a000 ss  k_basic1 lj by auto \n         moreover then have \"cpn n \\<Gamma> csj ( (s', sl)) \\<inter> assum((p \\<inter> {c. (fst c) \\<in> b}), R)  \\<subseteq> comm(G, (q,a)) F\"\n           using a2 com_validityn_def cj by blast         \n         ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n           using  j_length a10 a11 \\<Gamma>1  ssj_normal_s l_suc\n                 cpn_assum_induct[of \\<Gamma> l n \"(LanguageCon.com.Cond b c1 c2)\" s p R  \"Suc j\" c1 \"(s',sl)\" \"(p \\<inter> {c. (fst c) \\<in> b})\"]           \n           by blast                   \n         thus ?thesis       \n           using j_length drop_comm   a10 \\<Gamma>1  cpn_comm_induct valid not_fault \n           by blast\n       next\n         assume a000:\"s'\\<notin>b\"\n         then have cj:\"csj=c2\" using k_basic pair_j ss \n                  by (metis (no_types) fst_conv stepc_elim_cases(6))\n         moreover have p1:\"(s',sl) \\<in>{c. (fst c) \\<in> (-b)}\" using a000 ss k_basic1 lj by auto \n         moreover then have \"cpn n \\<Gamma> csj ( (s',sl)) \\<inter> assum((p \\<inter> {c. (fst c) \\<in> (-b)}), R)  \\<subseteq> comm(G, (q,a)) F\"\n           using a3 com_validityn_def cj by blast         \n         ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n           using j_length a10 a11 \\<Gamma>1  l_suc k_basic1 lj \n                 cpn_assum_induct[of \\<Gamma> l n \"(LanguageCon.com.Cond b c1 c2)\" s p R  \"Suc j\" c2 \"(s',sl)\" \"(p \\<inter> {c. (fst c) \\<in> (-b)})\"]\n           by auto                   \n         thus ?thesis       \n           using j_length drop_comm a10 \\<Gamma>1  cpn_comm_induct valid not_fault \n           by blast\n       qed\n       } thus ?thesis  by fastforce qed\n       note res = conjI [OF concl concr]              \n      }             \n      thus ?thesis using c_prod  unfolding comm_def by auto  qed      \n    } thus ?thesis by auto qed \n} thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\n\nlemma Asm_sound:\n   \"(c, p, R, G, q, a) \\<in> \\<Theta> \\<Longrightarrow>    \n    \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\n   \"\nproof -\n  assume\n   a0:\"(c, p, R, G, q, a) \\<in> \\<Theta>\"    \n   { fix s\n     assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p,  R, G, q,a]\"\n     then have \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\" using a0 by auto\n   } thus ?thesis unfolding com_cvalidityn_def by auto\nqed\n\nlemma events_p:\n  assumes  a0:\"(\\<Gamma>,cfg#l)\\<in>cptn\" and\n   a1:\"(\\<Gamma>,cfg#l) \\<in> assum (p,R)\" and\n   a2:\"i<length (cfg#l)\" and\n   a3:\"\\<forall>k\\<le>i. fst ((cfg#l)!k) = fst cfg\" and\n   a4:\"Sta p R \" \n shows \"\\<exists>t1. snd((cfg#l)!i)= t1 \\<and> t1 \\<in> p\" \n  using a2 a3\nproof(induct i)\n  case 0\n  then show ?case using a1 a2 unfolding assum_def by auto\nnext\n  case (Suc n)\n  then have \"\\<exists>t1. snd ((cfg # l) ! n) =  t1 \\<and> t1 \\<in> p\" by auto \n  moreover have \"\\<Gamma>\\<turnstile>\\<^sub>c ((cfg#l)!n) \\<rightarrow>\\<^sub>e ((cfg#l)!(Suc n))\" using Suc a0 \n    using calculation\n    by (metis Suc_eq_plus1 cptn_tran_ce_i le_eq_less_or_eq lessI mod_env_not_component prod.exhaust_sel step_ce_dest)\n  then have  \"(snd ((cfg#l)!n),snd ((cfg#l)!(Suc n)))\\<in>R\" using a1 Suc(2) \n    unfolding assum_def by auto\n  ultimately show ?case using a4 unfolding Sta_def by blast\nqed\n\n\nlemma not_val_zero:\"c \\<in> dom \\<Gamma> \\<Longrightarrow> Sta p R \\<Longrightarrow> \\<Gamma> \\<Turnstile>0\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\nproof-\n  assume a0:\" c \\<in> dom \\<Gamma>\"\n  assume a1:\"Sta p R\"\n  {fix l s\n    assume a01:\"(\\<Gamma>,l) \\<in> cpn 0 \\<Gamma> (Call c) s \\<and> (\\<Gamma>,l)\\<in> assum(p, R)\"    \n    then have \"length l \\<ge> 1\" unfolding cpn_def using CptnEmpty\n      by (metis (no_types, lifting) One_nat_def Product_Type.Collect_case_prodD Suc_leI length_greater_0_conv snd_conv)\n    moreover {assume a02:\"length l = 1\"\n      then have \"l = [(Call c,s)]\" \n      proof -\n        have \"l ! 0 = (LanguageCon.com.Call c, s)\" using a01 unfolding cpn_def\n          by fastforce\n        then show ?thesis using a02\n          by (metis One_nat_def Suc_leI impossible_Cons length_greater_0_conv list.size(3) neq_Nil_conv nth_Cons_0 zero_neq_one) \n      qed \n      then have \"(\\<Gamma>,l) \\<in> comm(G, (q,a)) F\" unfolding comm_def final_glob_def by auto\n    }\n    moreover {assume a02:\"length l > 1\"\n      then obtain a1 ls where l:\"l =(Call c, s)#a1#ls\" using a01 unfolding cpn_def\n        apply auto\n        by (metis (no_types, hide_lams) One_nat_def Suc_eq_plus1 less_not_refl list.exhaust list.size(3) list.size(4) not_less_zero nth_Cons_0 prod.collapse)   \n      have l_cptn:\"(\\<Gamma>,l)\\<in>cptn\" using a01 unfolding cpn_def\n        using cptn_eq_cptn_mod_nest by blast\n      then obtain m where min_call:\"min_call m \\<Gamma> l\"\n          using cptn_eq_cptn_mod_set cptn_mod_cptn_mod_nest minimum_nest_call by blast\n      { assume a03:\"\\<forall>i<length l. fst (l!i) = Call c\"        \n        then have \"(\\<Gamma>,l) \\<in> comm(G, (q,a)) F\" \n          using no_comp_tran_no_final_comm[OF _ a03] a02 unfolding final_glob_def\n          by fastforce \n      }\n      moreover { assume a03:\"\\<not> (\\<forall>i<length l. fst (l!i) = Call c)\"\n        then obtain i where i:\"(i<length l \\<and> fst (l!i) \\<noteq> Call c)\"\n          by auto\n        then obtain j where cfg_j:\"fst (l!j) \\<noteq> Call c \\<and> (\\<forall>k<j. fst (l!k) = Call c)\"                     \n          by (fast dest: exists_first_occ[of \"\\<lambda>i. fst (l!i) \\<noteq> Call c\" i])\n        moreover have j:\"j>0 \\<and> j<length l\" using l i calculation\n          by (metis (no_types, lifting) Suc_lessD fst_conv less_trans_Suc linorder_neqE_nat nth_non_equal_first_eq)\n        ultimately have step:\" (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! (j-1)), toSeq (snd (l ! (j-1)))) \\<rightarrow> \n                    (fst (l! j), toSeq (snd (l ! j))) )\"\n          using l l_cptn cptn_stepc_rtran not_eq_not_env  step_ce_dest\n          by (metis (no_types, lifting) One_nat_def Suc_diff_Suc diff_less diff_zero prod.exhaust_sel zero_less_one)\n        moreover obtain s' where j_1_cfg:\"snd (l!(j-1)) =  s' \\<and> s' \\<in> p\"\n          using cfg_j l a01[simplified l] j[simplified l] i a1 events_p[OF l_cptn[simplified l] _ _ _ a1, of \"j-1\"]\n          by fastforce\n        then have j_cfg:\"(fst (l! j), toSeq (snd (l ! j)))  = (the (\\<Gamma> c),  (fst s'))\"\n          using cfg_j a0 l l_cptn \n           stepc_elim_cases(9)[of \\<Gamma> \"c\" \"fst s'\" \"(fst (l! j),toSeq (snd (l!j)))\"] \n           calculation j \n          by (metis (no_types, lifting) diff_less domIff option.sel toSeq.simps(1) zero_less_one)        \n        then have j_cfg_1:\"l!j = (the (\\<Gamma> c), s')\" using l2[OF step l_cptn _ _ ]\n          by (metis Suc_diff_1 eq_snd_iff fst_conv j j_1_cfg toSeq.simps(1))\n        ultimately have False\n        proof-\n          have cptn_drop:\"(0,\\<Gamma>, drop (j-1) l) \\<in> cptn_mod_nest_call\" \n            using a01 unfolding cpn_def \n            by (simp add: dropcptn_is_cptn1 j less_imp_diff_less)      \n          then show ?thesis \n            using  j j_cfg j_1_cfg cfg_j  a0 j_cfg_1 elim_cptn_mod_nest_call_0_False\n            by (metis (no_types, lifting) Cons_nth_drop_Suc One_nat_def Suc_diff_Suc Suc_lessD \n                 diff_less diff_zero domIff option.collapse prod.exhaust_sel zero_less_one)               \n        qed          \n      }\n      ultimately have \"(\\<Gamma>,l) \\<in> comm(G, (q,a)) F\" by auto\n    }\n    ultimately have \"(\\<Gamma>,l)\\<in>comm(G, (q,a)) F\" by fastforce\n  } then show ?thesis unfolding com_validityn_def cpn_def by auto    \nqed\n\nlemma Call_sound: \n      \"f \\<in> dom \\<Gamma> \\<Longrightarrow>      \n       \\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (the (\\<Gamma> f)) sat [p, R, G, q,a] \\<Longrightarrow>         \n       Sta p R \\<Longrightarrow> (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G)  \\<Longrightarrow>\n       \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call f) sat [p, R, G, q,a]\"\nproof -  \n  assume\n    a0:\"f \\<in> dom \\<Gamma>\" and\n    a2:\"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (the (\\<Gamma> f)) sat [p, R, G, q,a]\" and        \n    a3: \"Sta p R\" and\n    a4: \"(\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G)\"         \n  obtain bdy where a0:\"\\<Gamma> f = Some bdy\" using a0 by auto\n  { \n    fix s\n    assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p,  R, G, q,a]\"  \n    then have a2:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> bdy sat [p, R, G, q,a]\" \n      using a0 a2 com_cvalidityn_def by fastforce\n    have \"cpn n \\<Gamma> (Call f)  s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof -\n    {   \n      fix c     \n      assume a10:\"c \\<in> cpn n \\<Gamma> (Call f) s\" and a11:\"c \\<in> assum(p, R)\"\n      then have a10':\"c \\<in> cp \\<Gamma> (Call f) s\" \n        unfolding cpn_def cp_def using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n      obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n      have \"c \\<in> comm(G, (q,a)) F\"      \n      proof - \n      {       \n        have cp:\"l!0=((Call f),s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10' cp_def c_prod by fastforce\n        have \\<Gamma>1:\"(\\<Gamma>, l) = c\" using c_prod cp by blast\n        have assum:\"snd(l!0) \\<in>  (p) \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n                 (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n                   (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n       using a11 c_prod unfolding assum_def by simp\n       then have env_tran:\"env_tran \\<Gamma> p l R\" using env_tran_def cp by blast\n       then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n         using env_tran env_tran_right_def unfolding env_tran_def by auto\n       have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n                (\\<Gamma>1\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                    (fst (l ! Suc i), toSeq (snd (l ! Suc i))) ) \\<longrightarrow>                              \n                 (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n       proof -\n       { fix k\n         assume a00:\"Suc k<length l\" and\n                a21:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                    (fst (l ! Suc k), toSeq (snd (l ! Suc k))) )\"                                                      \n         obtain j where before_k_all_evnt:\"j\\<le>k \\<and>  \n                  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                    (fst (l ! Suc j), toSeq (snd (l ! Suc j))) ) \\<and> \n                 (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n           using a00 a21 exist_first_comp_tran cp by blast\n         then obtain cj sj csj ssj where pair_j:\n           \"(\\<Gamma>\\<turnstile>\\<^sub>c(cj,sj)  \\<rightarrow> (csj,ssj)) \\<and> cj = fst (l!j) \\<and> sj = toSeq(snd (l!j)) \\<and> \n             csj = fst (l!(Suc j)) \\<and> ssj = toSeq(snd(l!(Suc j)))\"\n           by fast              \n         have k_basic1:\"cj = (Call f) \\<and> snd (l!j)  \\<in> ( p)\" \n           using  pair_j before_k_all_evnt cp env_tran_right a3 assum a00 stability[of p R l 0 j j \\<Gamma>]\n           by force\n         then have k_basic:\"cj = (Call f) \\<and> sj \\<in>  (fst ` p)\" \n           using  pair_j toSeq.simps(1) \n           by (metis (no_types, lifting) imageI toSeq.simps(1))\n         then obtain s' where ss:\"sj =  s' \\<and> s'\\<in> (fst ` p)\" by blast \n         moreover have ssj_normal_s:\"ssj =  s'\" \n           using before_k_all_evnt k_basic pair_j a0 calculation\n           by (metis not_None_eq snd_conv stepc_elim_cases(9))  \n         ultimately obtain sl where \n           lj:\"snd (l!j) =  (s', sl) \\<and> snd (l!(Suc j)) =  (s', sl)\"\n           using  cp  l2[of \\<Gamma> \"fst (l!j)\" \"snd(l!j)\" \"fst(l!(Suc j))\" \"snd(l!(Suc j))\"] a00\n           using before_k_all_evnt pair_j by fastforce \n         have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n           using ss a2 \n         proof (cases \"k=j\")   \n           case True                                  \n           have \"( (s',sl),  (s',sl)) \\<in> G\" \n             using a4 lj k_basic1  unfolding N_def by fastforce\n           thus \"(snd (l ! k), snd (l ! Suc k)) \\<in> G\"\n             using pair_j k_basic True ss ssj_normal_s lj by auto\n         next\n           case False   \n           have j_k:\"j<k\" using  before_k_all_evnt False by fastforce                      \n           thus \"(snd (l ! k), snd (l ! Suc k)) \\<in>  G\"\n           proof -\n             have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n             have cj:\"csj=bdy\" using k_basic pair_j ss a0\n               by (metis fst_conv option.distinct(1) option.sel stepc_elim_cases(9))                \n             moreover have p1:\"(s',sl)\\<in>p\" using lj k_basic1\n               by auto \n             moreover then have \"cpn n \\<Gamma> csj ( (s',sl)) \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n               using a2 com_validityn_def cj by blast\n             moreover then have \"l!(Suc j) = (csj,  (s',sl))\" \n               using  pair_j  lj\n               by (metis prod.exhaust_sel)\n             ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n               using  j_length a10 a11 \\<Gamma>1  ssj_normal_s                     \n               by (meson contra_subsetD cpn_assum_induct)                                \n             then show ?thesis \n             using a00 a21  \\<Gamma>1  j_k j_length \n             cptn_comm_induct[of \\<Gamma> l \"Call f\" s _ \"Suc j\" G q a F k ]             \n             Suc_leI a10' by blast                 \n          qed            \n       qed \n       } thus ?thesis by (simp add: c_prod cp) qed\n       have concr:\"(final_glob (last l)  \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>\n                   ((fst (last l) = Skip \\<and>  snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  (a)))\"\n       proof-\n       { \n         assume valid:\"final_glob (last l)\"   and  l_f:\"fst (last l) \\<notin> Fault ` F\"                    \n         have \"\\<exists>k. k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n                \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                    (fst (l ! Suc k), toSeq (snd (l ! Suc k))) \\<and> final_glob (l!(Suc k))\"\n         proof -             \n           have len_l:\"length l > 0\" using cp using cptn.simps by blast \n           then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n           have last_l:\"last l = l!(length l-1)\"\n            using last_length [of a1 l1] l by fastforce         \n           have final_0:\"\\<not>final_glob(l!0)\" using cp unfolding final_glob_def by auto\n           have \"0\\<le> (length l-1)\" using len_l last_l by auto\n           moreover have \"(length l-1) < length l\" using len_l by auto\n           moreover have \"final_glob (l!(length l-1))\" using valid last_l by auto\n           moreover have \"fst (l!0) = Call f\" using cp by auto\n           ultimately show ?thesis \n             using  cp final_exist_component_tran_final env_tran_right final_0 \n             by blast \n          qed\n          then obtain k where a21: \"k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n              \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                (fst (l ! Suc k), toSeq (snd (l ! Suc k))) \\<and> final_glob (l!(Suc k))\"\n           by auto\n          then have a00:\"Suc k<length l\" by fastforce\n                  then obtain j where before_k_all_evnt:\n          \"j\\<le>k \\<and>  \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                       (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n           using a00 a21 exist_first_comp_tran cp by blast\n         then obtain cj sj csj ssj where \n             pair_j:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                          (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> \n                      cj = fst (l!j) \\<and> sj = toSeq(snd (l!j)) \\<and>  \n                      csj = fst (l!(Suc j)) \\<and> ssj = toSeq(snd(l!(Suc j)))\"\n         by fastforce\n       have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce         \n          have \"((fst (last l) = Skip \\<and> \n                    snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> \n                    snd (last l) \\<in>  (a))\"\n          proof -\n            have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce                                 \n            then have k_basic:\"cj = (Call f) \\<and> sj \\<in>  (fst ` p) \\<and> snd (l!j) \\<in> (p)\" \n              using  pair_j before_k_all_evnt cp env_tran_right a3 assum a00 stability[of p R l 0 j j \\<Gamma>]\n              by force\n            then obtain s' where ss:\"sj =  s' \\<and> s'\\<in> (fst  `p)\" by blast \n            moreover have ssj_normal_s:\"ssj =  s'\" \n              using before_k_all_evnt k_basic pair_j a0 calculation\n              by (metis not_None_eq snd_conv stepc_elim_cases(9))\n            ultimately obtain sl where \n              lj:\"snd (l!j) =  (s', sl) \\<and> snd (l!(Suc j)) =  (s', sl)\"\n              using  cp  l2[of \\<Gamma> \"fst (l!j)\" \"snd(l!j)\" \"fst(l!(Suc j))\" \"snd(l!(Suc j))\"] a00\n              using before_k_all_evnt pair_j by fastforce\n            have cj:\"csj=bdy\" using k_basic pair_j ss a0\n              by (metis fst_conv option.distinct(1) option.sel stepc_elim_cases(9))                \n            moreover have p1:\"s'\\<in>(fst ` p)\" using ss by blast \n            moreover then have \"cpn n \\<Gamma> csj ( (s', sl)) \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n              using a2 com_validityn_def cj by blast\n            moreover then have \"l!(Suc j) = (csj,  (s', sl))\" \n              using before_k_all_evnt pair_j lj ssj_normal_s\n              by (metis prod.exhaust_sel)\n            ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n              using  j_length   ssj_normal_s   lj   k_basic \\<Gamma>1  a10 a11 cpn_assum_induct \n              by fastforce                            \n            thus ?thesis       \n              using j_length l_f drop_comm a10' \\<Gamma>1 cptn_comm_induct[of \\<Gamma> l \"Call f\" s _ \"Suc j\" G q a F \"Suc j\"] valid  \n              by blast\n           qed\n         } thus ?thesis by auto \n         qed\n       note res = conjI [OF concl concr]}               \n       thus ?thesis using  c_prod unfolding comm_def by force qed      \n    } thus ?thesis by auto qed \n  } thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n           \nlemma CallRec_sound:\n    \"(c, p, R, G, q, a) \\<in> Specs \\<Longrightarrow>\n     \\<forall>(c, p, R, G, q, a)\\<in>Specs.\n       c \\<in> dom \\<Gamma> \\<and>\n       Sta p R \\<and>  (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G) \\<and>      \n       \\<Gamma>,\\<Theta> \\<union> Specs \\<turnstile>\\<^bsub>/F\\<^esub> the (\\<Gamma> c) sat [p, R, G, q,a] \\<and> \n       (\\<forall>x. \\<Gamma>,\\<Theta> \\<union> Specs \\<Turnstile>x \\<^bsub>/F\\<^esub> the (\\<Gamma> c) sat [p,R, G, q,a]) \\<Longrightarrow>\n    Sta p R \\<Longrightarrow> (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G) \\<Longrightarrow>\n     \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\nproof -\n  assume a0: \"(c, p, R, G, q, a) \\<in> Specs\" and\n     a1: \n    \"\\<forall>(c, p, R, G, q, a)\\<in>Specs.\n       c \\<in> dom \\<Gamma> \\<and> Sta p R \\<and> (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G) \\<and>  \n       \\<Gamma>,\\<Theta> \\<union> Specs \\<turnstile>\\<^bsub>/F\\<^esub> the (\\<Gamma> c) sat [p, R, G, q,a] \\<and> \n       (\\<forall>x. \\<Gamma>,\\<Theta> \\<union> Specs \\<Turnstile>x \\<^bsub>/F\\<^esub> the (\\<Gamma> c) sat [p,R, G, q,a])\"\n  then have a1': \"c \\<in> dom \\<Gamma>\"  and       \n       a1'': \"\\<Gamma>,\\<Theta> \\<union> Specs \\<Turnstile>n \\<^bsub>/F\\<^esub> the (\\<Gamma> c) sat [p,R, G, q,a]\" using a0 by auto \n    from a1 have \n      valid_body:\n      \"\\<forall>(c, p, R, G, q, a)\\<in>Specs.\n       c \\<in> dom \\<Gamma> \\<and>  Sta p R \\<and>   (\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G) \\<and>    \n       (\\<forall>x. \\<Gamma>,\\<Theta> \\<union> Specs \\<Turnstile>x \\<^bsub>/F\\<^esub> the (\\<Gamma> c) sat [p,R, G, q,a])\" by fastforce\n  assume a5: \"Sta p R\" and\n         a6: \"(\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G)\" \n  obtain bdy where \\<Gamma>bdy:\"\\<Gamma> c = Some bdy\" using a1' by auto\n  have theta_specs: \n         \"\\<forall>(c, p, R, G, q, a)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a] \\<Longrightarrow>\n          \\<forall>(c, p, R, G, q, a)\\<in>Specs. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n  proof(induct n)\n    case 0    \n    show \"\\<forall>(c, p, R, G, a, d)\\<in>Specs. \\<Gamma> \\<Turnstile>0\\<^bsub>/F\\<^esub> LanguageCon.com.Call c sat [p,R, G, a,d]\"\n    proof-\n      {fix c p R G a d\n        assume a00:\"(c, p, R, G, a, d) \\<in> Specs\"\n        then have \"c\\<in>dom \\<Gamma> \\<and> Sta p R\" using a1 by auto\n        then have \" \\<Gamma> \\<Turnstile>0\\<^bsub>/F\\<^esub> (LanguageCon.com.Call c) sat [p,R, G, a,d]\"\n          using not_val_zero  by fastforce\n      } then show ?thesis by auto \n    qed       \n  next\n    case (Suc n)\n    have hyp:\"\\<forall>(c, p, R, G, q, a)\\<in>\\<Theta>.  \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a] \\<Longrightarrow>\n             \\<forall>(c, p, R, G, q, a)\\<in>Specs. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\" by fact\n    have body:\"\\<forall>(c, p, R, G, q, a)\\<in>\\<Theta>.  \\<Gamma> \\<Turnstile>Suc n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\" by fact\n    then show ?case\n    proof-\n      { fix c p R G q a\n        assume a000:\"(c, p, R, G, q, a) \\<in> Specs\"\n        have ctxt_m:\"\\<forall>(c, p, R, G, q, a)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n          using body  cptn_mod_nest_mono  unfolding com_validityn_def cpn_def\n          by (fastforce simp add: cpn_rule)\n        then have valid_Proc:\"\\<forall>(c, p, R, G, q, a)\\<in>Specs. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n          using hyp by auto\n        have Sta:\"Sta p R\" using a1 a000 by auto\n        have c_dom:\" c \\<in> dom \\<Gamma>\" using a1 a000 by auto\n        have guar:\"(\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G)\" using a1 a000 by auto\n        let ?\\<Theta>'= \"\\<Theta> \\<union> Specs\"\n        from valid_Proc ctxt_m\n        have \"\\<forall>(c, p, R, G, q, a)\\<in>?\\<Theta>'. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n          by fastforce\n        with valid_body\n        have valid_body_m: \n          \"\\<forall>(c, p, R, G, q, a)\\<in>Specs. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (the (\\<Gamma> c)) sat [p,R, G, q,a]\"\n          by (fastforce  simp:com_cvalidityn_def)    \n        then have valid_body:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (the (\\<Gamma> c)) sat [p,R, G, q,a]\" using a000 by auto\n        then have \"\\<Gamma> \\<Turnstile>Suc n\\<^bsub>/F\\<^esub> Call c sat [p,R, G, q,a]\"\n        proof-\n        { fix l s \n          assume a01:\"(\\<Gamma>,l)\\<in>cpn (Suc n) \\<Gamma> (Call c) s \\<and> (\\<Gamma>,l)\\<in> assum(p, R)\"\n          then have \"length l \\<ge> 1\" unfolding cpn_def using CptnEmpty\n            by (metis (no_types, lifting) One_nat_def Product_Type.Collect_case_prodD Suc_leI length_greater_0_conv snd_conv)\n          moreover {\n            assume a02:\"length l = 1\"\n            then have \"l = [(Call c,s)]\" \n            proof -\n              have \"l ! 0 = (LanguageCon.com.Call c, s)\" using a01 unfolding cpn_def\n                by fastforce\n              then show ?thesis using a02\n                by (metis One_nat_def Suc_leI impossible_Cons \n                     length_greater_0_conv list.size(3) neq_Nil_conv nth_Cons_0 zero_neq_one) \n            qed \n            then have \"(\\<Gamma>,l) \\<in> comm(G, (q,a)) F\" unfolding comm_def final_glob_def by auto\n          }\n          moreover {assume a02:\"length l > 1\"\n            then obtain a1 ls where l:\"l =(Call c, s)#a1#ls\" using a01 unfolding cpn_def\n              apply auto\n              by (metis (no_types, hide_lams) One_nat_def Suc_eq_plus1 less_not_refl list.exhaust list.size(3) list.size(4) not_less_zero nth_Cons_0 prod.collapse)   \n            have l_cptn:\"(\\<Gamma>,l)\\<in>cptn\" using a01 unfolding cpn_def\n              using cptn_eq_cptn_mod_nest by blast\n            then obtain m where min_call:\"min_call m \\<Gamma> l\"\n              using cptn_eq_cptn_mod_set cptn_mod_cptn_mod_nest minimum_nest_call by blast\n            { assume a03:\"\\<forall>i<length l. fst (l!i) = Call c\"     \n              then have \"(\\<Gamma>,l) \\<in> comm(G, (q,a)) F\" \n                using no_comp_tran_no_final_comm[OF _ a03] a02 unfolding final_glob_def\n                by fastforce \n            }                                     \n            moreover{\n              assume a03:\"\\<not>(\\<forall>i<length l. fst (l!i) = Call c)\"\n              then obtain i where i:\"(i<length l \\<and> fst (l!i) \\<noteq> Call c)\"\n                by auto\n              then obtain j where cfg_j:\"fst (l!j) \\<noteq> Call c \\<and> (\\<forall>k<j. fst (l!k) = Call c)\"                     \n                by (fast dest: exists_first_occ[of \"\\<lambda>i. fst (l!i) \\<noteq> Call c\" i])\n              moreover have j:\"j>0 \\<and> j<length l\" using l i calculation\n                by (metis (no_types) cfg_j fst_conv i l le_less_trans neq0_conv not_le_imp_less nth_Cons_0)\n              ultimately have step:\" (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! (j-1)), toSeq (snd (l ! (j-1)))) \\<rightarrow> \n                    (fst (l! j), toSeq (snd (l ! j))) )\"\n                using l l_cptn cptn_stepc_rtran not_eq_not_env  step_ce_dest\n                by (metis (no_types, lifting) One_nat_def Suc_diff_Suc diff_less diff_zero prod.exhaust_sel zero_less_one)\n              moreover obtain s' where j_1_cfg:\"snd (l!(j-1)) =  s' \\<and> s' \\<in> p\"\n                using cfg_j l a01[simplified l] j[simplified l] i Sta events_p[OF l_cptn[simplified l] _ _ _ Sta, of \"j-1\"]\n                by fastforce\n              then have j_cfg:\"(fst (l! j), toSeq (snd (l ! j)))  = (the (\\<Gamma> c),  (fst s'))\"\n                using cfg_j a0 l l_cptn \n                 stepc_elim_cases(9)[of \\<Gamma> \"c\" \"fst s'\" \"(fst (l! j),toSeq (snd (l!j)))\"] \n                 calculation j\n                by (metis c_dom diff_less domIff option.sel toSeq.simps(1) zero_less_one)  \n              then have j_cfg_1:\"l!j = (the (\\<Gamma> c), s')\" using l2[OF step l_cptn _ _ ]\n                by (metis Suc_diff_1 eq_snd_iff fst_conv j j_1_cfg toSeq.simps(1))\n              then have suc_n_call:\"(Suc n,\\<Gamma>, drop (j-1) l) \\<in> cptn_mod_nest_call\" \n                using a01 unfolding cpn_def\n                by (simp add: dropcptn_is_cptn1 j less_imp_diff_less)\n              have \"(n,\\<Gamma>, drop j l) \\<in> cptn_mod_nest_call\" \n              proof-\n                have \"\\<not> (\\<Gamma>\\<turnstile>\\<^sub>c (l!(j-1)) \\<rightarrow>\\<^sub>e (l!j))\" using step\n                  by (metis cfg_j diff_less env_c_c' j prod.exhaust_sel zero_less_one)\n                then have \"(Suc n,\\<Gamma>, (Call c,  s')#(the (\\<Gamma> c), s')#(drop (j+1) l)) \\<in> cptn_mod_nest_call\"\n                  using a01 j step cfg_j j_cfg j_1_cfg  suc_n_call j_cfg_1                 \n                  by (metis (no_types, lifting) Cons_nth_drop_Suc One_nat_def Suc_eq_plus1 \n                    Suc_less_eq Suc_pred diff_less less_SucI prod.collapse zero_less_one)                  \n                then have \"(n,\\<Gamma>, (the (\\<Gamma> c), s')#(drop (j+1) l)) \\<in> cptn_mod_nest_call\"\n                  using cfg_j j_cfg  elim_cptn_mod_nest_call_n_dec[of \"Suc n\" \\<Gamma> c s'] c_dom by fastforce\n                then show ?thesis\n                  by (metis Cons_nth_drop_Suc Suc_eq_plus1 j j_cfg_1)\n              qed\n              moreover have \"(\\<Gamma>, drop j l) \\<in> assum(p,R)\" \n              proof-   \n                have \"(\\<Gamma>, take j l @ l ! j # drop (Suc j) l) \\<in> assum (p, R)\"\n                  using conjunct2[OF a01] id_take_nth_drop[OF conjunct2[OF j]] by auto                             \n                then show ?thesis \n                  using sub_assum_r[of \\<Gamma> \"take j l\" \"l!j\"]  j_1_cfg l  j j_cfg_1 \n                  by (metis Int_iff a01 cpn_assum_induct)                  \n              qed                              \n              ultimately have comm_drop:\"(\\<Gamma>, drop j l)\\<in> comm(G, (q,a)) F\"\n                using valid_body j_cfg_1 j unfolding com_validityn_def cpn_def \n                by fastforce\n              have \"(\\<Gamma>,l) \\<in> comm(G, (q,a)) F\" \n              proof-\n                have h:\"\\<forall>j<length (take j l). fst ((take j l)!j) = (Call c)\" using j cfg_j by fastforce\n                then have comm_take:\"(\\<Gamma>,take j l) \\<in> comm(G, (q,a)) F\"\n                  using no_comp_tran_no_final_comm[of \"take j l\" \"Call c\"] j_1_cfg l j_cfg j cfg_j \n                  unfolding final_glob_def by auto                \n                moreover have \"(snd (last (take j l)), snd (drop j l ! 0)) \\<in> G\"\n                proof-\n                  have \"length (take j l) = j\"using l j_1_cfg j j_cfg by auto\n                  moreover have \"(take j l)!(j-1) = l!(j-1)\"\n                    using l j_1_cfg j j_cfg by auto\n                  ultimately have \"last (take j l) = l!(j-1)\"\n                    using  j by (metis last_conv_nth less_numeral_extra(3) list.size(3))\n                  moreover have \"(s',s')\\<in>G\" using l j_1_cfg j j_cfg_1 guar unfolding N_def\n                    by blast\n                  ultimately  show ?thesis using l j_1_cfg j j_cfg_1 \n                    by simp\n                qed                                 \n                ultimately show ?thesis using  j_1_cfg j_cfg j cfg_j j l_cptn\n                  comm_union[OF comm_take comm_drop] by fastforce\n              qed                 \n             } ultimately have \"(\\<Gamma>,l)\\<in>comm(G, (q,a)) F\" by auto\n           }ultimately  have \"(\\<Gamma>,l)\\<in>comm(G, (q,a)) F\" by fastforce         \n         } thus ?thesis unfolding com_validityn_def using cpn_rule2 by blast \n       qed\n      } thus ?case by fastforce\n    qed\n  qed \n  then show ?thesis using a0 unfolding com_cvalidityn_def by auto     \nqed\n\nlemma Seq_env_P:assumes a0:\"\\<Gamma>\\<turnstile>\\<^sub>c(Seq P Q,s) \\<rightarrow>\\<^sub>e (Seq P Q,t)\"\n      shows \"\\<Gamma>\\<turnstile>\\<^sub>c(P,s) \\<rightarrow>\\<^sub>e (P,t)\"\nusing a0 \n  by (metis env_intro_diff_p)\n\nlemma map_eq_state:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Seq c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \" and\n  a2:\"l1=map (lift c2) l2\"\nshows\n  \"\\<forall>i<length l1. snd (l1!i) = snd (l2!i)\"\nusing a0 a1 a2 unfolding cp_def\nby (simp add: snd_lift) \n\nlemma map_eq_seq_c:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Seq c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \" and\n  a2:\"l1=map (lift c2) l2\"\nshows\n  \"\\<forall>i<length l1. fst (l1!i) = Seq (fst (l2!i)) c2\"\nproof -\n  {fix i\n  assume a3:\"i<length l1\"\n  have \"fst (l1!i) = Seq (fst (l2!i)) c2\"\n  using a0 a1 a2 a3 unfolding lift_def\n    by (simp add: case_prod_unfold) \n  }thus ?thesis by auto\nqed \n\n\nlemma same_env_seq_c:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Seq c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \" and\n  a2:\"l1=map (lift c2) l2\"\nshows\n\"\\<forall>i. Suc i<length l2 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l2!i)  \\<rightarrow>\\<^sub>e (l2!(Suc i)) = \n            \\<Gamma>\\<turnstile>\\<^sub>c(l1!i)  \\<rightarrow>\\<^sub>e (l1!(Suc i))\" \nproof -\n  have a0a:\"(\\<Gamma>,l1) \\<in>cptn \\<and> l1!0 = ((Seq c1 c2),s)\" \n    using a0 unfolding cp_def by blast\n  have a1a: \"(\\<Gamma>,l2) \\<in>cptn \\<and> l2!0 = (c1,s)\"\n    using a1 unfolding cp_def by blast\n  {\n    fix i\n    assume a3:\"Suc i< length l2\"\n    have \"\\<Gamma>\\<turnstile>\\<^sub>c(l2!i)  \\<rightarrow>\\<^sub>e (l2!(Suc i)) = \n            \\<Gamma>\\<turnstile>\\<^sub>c(l1!i)  \\<rightarrow>\\<^sub>e (l1!(Suc i))\"\n    proof\n    {\n      assume a4:\"\\<Gamma>\\<turnstile>\\<^sub>c l2 ! i \\<rightarrow>\\<^sub>e l2 ! Suc i\"\n      obtain c1i s1i c1si s1si where l1prod:\"(l1 ! i)=(c1i,s1i) \\<and> (l1!Suc i) = (c1si,s1si)\"        \n        by (meson prod.exhaust_sel)\n      obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\<and> l2!Suc i = (c2si,s2si)\"\n        by (meson prod.exhaust_sel)\n      then have \"c1i = (Seq c2i c2) \\<and> c1si = (Seq c2si c2)\"\n        using  a0 a1 a2 a3 a4  map_eq_seq_c l1prod\n        by (metis Suc_lessD  fst_conv length_map)\n      also have \"s2i=s1i \\<and> s2si=s1si\"\n        using  a0 a1 a4  a2 a3 l2prod  l1prod\n        by (metis Suc_lessD  nth_map snd_conv snd_lift)        \n      ultimately show \"\\<Gamma>\\<turnstile>\\<^sub>c l1 ! i \\<rightarrow>\\<^sub>e (l1 ! Suc i)\" \n        using a4 l1prod l2prod env_c_c'\n        by (metis env_intro_diff_p)\n    } \n    { thm prod.exhaust_sel\n      assume a4:\"\\<Gamma>\\<turnstile>\\<^sub>c l1 ! i \\<rightarrow>\\<^sub>e l1 ! Suc i\"\n      obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\<and> l1!Suc i = (c1si,s1si)\"\n         by (meson prod.exhaust_sel)\n      obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\<and> l2!Suc i = (c2si,s2si)\"\n         by (meson prod.exhaust_sel)\n      then have \"c1i = (Seq c2i c2) \\<and> c1si = (Seq c2si c2)\"\n        using  a0 a1 a2 a3 a4  map_eq_seq_c l1prod\n        by (metis Suc_lessD  fst_conv length_map)\n      also have \"s2i=s1i \\<and> s2si=s1si\"\n        using  a0 a1 a4  a2 a3 l2prod l1prod\n        by (metis Suc_lessD  nth_map snd_conv snd_lift)        \n      ultimately show \"\\<Gamma>\\<turnstile>\\<^sub>c l2 ! i \\<rightarrow>\\<^sub>e (l2 ! Suc i)\" \n        using a4 l1prod l2prod env_c_c'\n        by (metis LanguageCon.com.inject(3) env_intro_diff_p)           \n    }\n    qed\n   } \n  thus ?thesis by auto\nqed\n\n\n\nlemma same_comp_seq_c:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Seq c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \" and\n  a2:\"l1=map (lift c2) l2\"\nshows\n\"\\<forall>i. Suc i<length l2 \\<longrightarrow> \n        \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n            (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i)))  = \n      \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n            (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i)))\" \nproof -\n  have a0a:\"(\\<Gamma>,l1) \\<in>cptn \\<and> l1!0 = ((Seq c1 c2),s)\" \n    using a0 unfolding cp_def by blast\n  have a1a: \"(\\<Gamma>,l2) \\<in>cptn \\<and> l2!0 = (c1,s)\"\n    using a1 unfolding cp_def by blast\n  {\n    fix i\n    assume a3:\"Suc i< length l2\"\n    have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n            (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i))) =\n       \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n            (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i)))\"\n    proof\n    {\n      assume a4:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i)))\"\n      obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\<and> l1!Suc i = (c1si,s1si)\"\n        by (meson prod.exhaust_sel)\n      obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\<and> l2!Suc i = (c2si,s2si)\"\n        by (meson prod.exhaust_sel)\n      then have \"c1i = (Seq c2i c2) \\<and> c1si = (Seq c2si c2)\"\n        using  a0 a1 a2 a3 a4  map_eq_seq_c l1prod\n        by (metis Suc_lessD  fst_conv length_map)\n      also have \"s2i=s1i \\<and> s2si=s1si\"\n        using  a0 a1 a4  a2 a3 l2prod  l1prod\n        by (metis Suc_lessD  nth_map snd_conv snd_lift)        \n      ultimately show \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n            (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i)))\" \n        using a4 l1prod l2prod\n        by (simp add: Seqc)        \n    } \n    {\n      assume a4:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n            (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i)))\"\n      obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\<and> l1!Suc i = (c1si,s1si)\"\n         by (meson prod.exhaust_sel)\n      obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\<and> l2!Suc i = (c2si,s2si)\"\n         by (meson prod.exhaust_sel)\n      then have \"c1i = (Seq c2i c2) \\<and> c1si = (Seq c2si c2)\"\n        using  a0 a1 a2 a3 a4  map_eq_seq_c l1prod\n        by (metis Suc_lessD  fst_conv length_map)\n      also have \"s2i=s1i \\<and> s2si=s1si\"\n        using  a0 a1 a4  a2 a3 l2prod  l1prod\n        by (metis Suc_lessD  nth_map snd_conv snd_lift)        \n      ultimately show \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i)))\"\n        using a4 l1prod l2prod stepc_elim_cases_Seq_Seq\n      by auto           \n    }\n    qed\n   } \n  thus ?thesis by auto\nqed\n\nlemma assum_map:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Seq c1 c2) s) \\<and> ((\\<Gamma>,l1) \\<in> assum(p, R))\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \" and\n  a2:\"l1=map (lift c2) l2\"  \nshows\n  \"((\\<Gamma>,l2) \\<in> assum(p, R))\"\nproof -\n  have a3: \"\\<forall>i. Suc i<length l2 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l2!i)  \\<rightarrow>\\<^sub>e (l2!(Suc i)) = \n            \\<Gamma>\\<turnstile>\\<^sub>c(l1!i)  \\<rightarrow>\\<^sub>e (l1!(Suc i))\" \n    using a0 a1 a2 same_env_seq_c by fastforce\n  have pair_\\<Gamma>l1:\"fst (\\<Gamma>,l1) = \\<Gamma> \\<and> snd (\\<Gamma>,l1) = l1\" by fastforce\n  have pair_\\<Gamma>l2:\"fst (\\<Gamma>,l2) = \\<Gamma> \\<and> snd (\\<Gamma>,l2) = l2\" by fastforce\n  have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n  have eq_length:\"length l1 = length l2\" using a2 by auto  \n  then have p1:\"s\\<in>p\" using a0 unfolding cp_def assum_def by fastforce  \n  show ?thesis \n  proof -    \n    let ?c= \"(\\<Gamma>,l2)\"\n    have l:\"snd((snd ?c!0)) \\<in> (p)\"\n     using p1 drop_k_s a1  unfolding cp_def by auto\n    {fix i\n     assume a00:\"Suc i<length (snd ?c)\" \n     assume a11:\"(fst ?c)\\<turnstile>\\<^sub>c((snd ?c)!i)  \\<rightarrow>\\<^sub>e ((snd ?c)!(Suc i))\"\n     have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\<in> R\"\n     using a0 a1 a2 a3 map_eq_state[OF conjunct1[OF a0]] unfolding assum_def \n     using a00 a11 eq_length by fastforce\n    } thus \"(\\<Gamma>, l2) \\<in> assum (p, R)\" \n      using l unfolding assum_def by fastforce  \n  qed  \nqed\n\nlemma comm_map':\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Seq c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \\<and> (\\<Gamma>, l2)\\<in> comm(G, (q,a)) F\" and\n  a2:\"l1=map (lift c2) l2\" \nshows\n  \"(Suc k < length l1 \\<longrightarrow>\n       \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! k), toSeq (snd (l1 ! k))) \\<rightarrow> \n                (fst (l1 ! Suc k), toSeq (snd (l1 ! Suc k))) \\<longrightarrow> \n       (snd(l1!k), snd(l1!(Suc k))) \\<in>  G) \\<and> \n   (fst (last l1) = (Seq c c2) \\<and> final_glob (c, snd (last l1)) \\<longrightarrow>  \n       c \\<notin> Fault ` F  \\<longrightarrow>   \n      (fst (last l1) = (Seq Skip c2) \\<and> (snd (last  l1) \\<in> q) \\<or>\n      (fst (last l1) = (Seq Throw c2) \\<and> snd (last l1) \\<in>  (a))))\n     \"\nproof -\n  have a3:\"\\<forall>i. Suc i<length l2 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i))) = \n            \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n                (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i)))\" \n    using a0 a1 a2 same_comp_seq_c\n    by fastforce\n  have pair_\\<Gamma>l1:\"fst (\\<Gamma>,l1) = \\<Gamma> \\<and> snd (\\<Gamma>,l1) = l1\" by fastforce\n  have pair_\\<Gamma>l2:\"fst (\\<Gamma>,l2) = \\<Gamma> \\<and> snd (\\<Gamma>,l2) = l2\" by fastforce\n  have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n  have eq_length:\"length l1 = length l2\" using a2 by auto \n  then have len0:\"length l1>0\" using a0 unfolding cp_def \n    using Collect_case_prodD drop_k_s eq_length by auto\n  then have l1_not_empty:\"l1\\<noteq>[]\" by auto\n  then have l2_not_empty:\"l2 \\<noteq> []\" using a2 by blast       \n   have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n        using last_conv_nth l1_not_empty by auto\n  have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n       using last_conv_nth l2_not_empty by auto \n  have a03:\"(\\<forall>i ns ns'.                 \n               Suc i<length (snd (\\<Gamma>, l2)) \\<longrightarrow> \n               \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i))) \\<longrightarrow>                               \n                 (snd((snd (\\<Gamma>, l2))!i), snd((snd (\\<Gamma>, l2))!(Suc i))) \\<in> G) \\<and> \n               (final_glob (last (snd (\\<Gamma>, l2)))  \\<longrightarrow>   fst (last l2) \\<notin> Fault ` F  \\<longrightarrow>              \n                  ((fst (last (snd (\\<Gamma>, l2))) = Skip \\<and> snd (last (snd (\\<Gamma>, l2))) \\<in> q)) \\<or>\n                  (fst (last (snd (\\<Gamma>, l2))) = Throw \\<and> snd (last (snd (\\<Gamma>, l2))) \\<in>  (a)))\"\n  using a1 unfolding comm_def by fastforce\n  show ?thesis unfolding comm_def \n  proof -\n  { fix k ns ns'    \n    assume a00:\"Suc k < length l1\"    \n    then have \"k \\<le> length l1\" using a2 by fastforce    \n    have a00:\"Suc k < length l2\" using eq_length a00 by fastforce\n    \n    then have \" \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! k), toSeq (snd (l1 ! k))) \\<rightarrow> \n                (fst (l1 ! Suc k), toSeq (snd (l1 ! Suc k))) \\<longrightarrow>       \n      (snd((snd (\\<Gamma>, l1))!k), snd((snd (\\<Gamma>, l1))!(Suc k))) \\<in>  G\"\n    using  pair_\\<Gamma>l1 pair_\\<Gamma>l2 a00  a03 a3  eq_length \n     by (metis Suc_lessD a0 a1 a2 map_eq_state)\n  } note l=this\n  {\n    assume a00: \"fst (last l1) = (Seq c c2) \\<and> final_glob (c, snd (last l1))\" and\n           a01:\"c \\<notin> Fault ` F \"\n    then have c:\"c=Skip \\<or> c = Throw \\<or> c = Stuck \\<or> (\\<exists>f. c = Fault f)\"\n     unfolding final_glob_def by auto    \n    then have fst_last_l2:\"fst (last l2) = c\"                               \n      using  last_lenl1 a00 l1_not_empty eq_length len0 a2 last_conv_nth last_lift \n      by fastforce      \n    also have last_eq:\"snd (last l2) = snd (last l1)\"      \n      using l2_not_empty a2 last_conv_nth last_lenl1 last_snd \n      by fastforce\n    ultimately have \"final_glob (fst (last l2),snd (last l2))\" \n     using a00 by auto\n    then have \"final_glob (last l2)\" by auto\n    also have \"fst (last (l2)) \\<notin> Fault ` F\"\n       using  last_eq a01\n       using fst_last_l2 by blast\n    ultimately have \"(fst (last  l2)) = Skip \\<and> snd (last  l2) \\<in>  q \\<or>\n                  (fst (last l2) = Throw \\<and> snd (last l2) \\<in>  (a))\"\n    using a03 by auto\n    then have \"(fst (last l1) = (Seq Skip c2) \\<and> snd (last  l1) \\<in>  q) \\<or>\n                  (fst (last l1) = (Seq Throw c2) \\<and> \n                    snd (last l1) \\<in> (a))\"\n    using last_eq fst_last_l2 a00 by force\n  }\n  thus ?thesis using l by auto qed\nqed\n\nlemma comm_map'':\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Seq c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \\<and> (\\<Gamma>, l2)\\<in> comm(G, (q,a)) F\" and\n  a2:\"l1=map (lift c2) l2\" \nshows\n  \"((Suc k < length l1 \\<longrightarrow>\n       \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! k), toSeq (snd (l1 ! k))) \\<rightarrow> \n            (fst (l1 ! Suc k), toSeq (snd (l1 ! Suc k))) \\<longrightarrow>        \n       (snd(l1!k), snd(l1!(Suc k))) \\<in> G) \\<and> \n   (final_glob (last l1) \\<longrightarrow>  fst (last l1)  \\<notin> Fault ` F \\<longrightarrow>  \n      (fst (last l1) = Skip \\<and> (snd (last  l1) \\<in>  r) \\<or>\n      (fst (last l1) = Throw \\<and>  snd (last l1) \\<in>  (a)))))\n     \"\nproof -\n  have a3:\"\\<forall>i. Suc i<length l2 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i))) = \n            \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n                (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i)))\" \n    using a0 a1 a2 same_comp_seq_c\n    by fastforce\n  have pair_\\<Gamma>l1:\"fst (\\<Gamma>,l1) = \\<Gamma> \\<and> snd (\\<Gamma>,l1) = l1\" by fastforce\n  have pair_\\<Gamma>l2:\"fst (\\<Gamma>,l2) = \\<Gamma> \\<and> snd (\\<Gamma>,l2) = l2\" by fastforce\n  have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n  have eq_length:\"length l1 = length l2\" using a2 by auto \n  then have len0:\"length l1>0\" using a0 unfolding cp_def \n    using Collect_case_prodD drop_k_s eq_length by auto\n  then have l1_not_empty:\"l1\\<noteq>[]\" by auto\n  then have l2_not_empty:\"l2 \\<noteq> []\" using a2 by blast       \n  have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n        using last_conv_nth l1_not_empty by auto\n  have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n       using last_conv_nth l2_not_empty by auto \n  have a03:\"(\\<forall>i ns ns'.                 \n               Suc i<length (snd (\\<Gamma>, l2)) \\<longrightarrow> \n               \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i))) \\<longrightarrow>                               \n                 (snd((snd (\\<Gamma>, l2))!i), snd((snd (\\<Gamma>, l2))!(Suc i))) \\<in> G) \\<and> \n               (final_glob (last (snd (\\<Gamma>, l2)))  \\<longrightarrow>  fst (last l2) \\<notin> Fault ` F  \\<longrightarrow>               \n                  ((fst (last (snd (\\<Gamma>, l2))) = Skip \\<and> snd (last (snd (\\<Gamma>, l2))) \\<in>  q)) \\<or>\n                  (fst (last (snd (\\<Gamma>, l2))) = Throw \\<and> snd (last (snd (\\<Gamma>, l2))) \\<in>  (a)))\"\n  using a1 unfolding comm_def by fastforce\n  show ?thesis unfolding comm_def \n  proof -\n  { fix k ns ns'    \n    assume a00:\"Suc k < length l1\"    \n    then have \"k \\<le> length l1\" using a2 by fastforce    \n    have a00:\"Suc k < length l2\" using eq_length a00 by fastforce   \n    then have \" \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! k), toSeq (snd (l1 ! k))) \\<rightarrow> \n                (fst (l1 ! Suc k), toSeq (snd (l1 ! Suc k))) \\<longrightarrow>         \n        (snd((snd (\\<Gamma>, l1))!k), snd((snd (\\<Gamma>, l1))!(Suc k))) \\<in> G\"\n       using  pair_\\<Gamma>l1 pair_\\<Gamma>l2 a00  a03 a3  eq_length \n      by (metis (no_types,lifting) a2 Suc_lessD nth_map snd_lift)\n    } note l= this\n    {\n     assume a00: \"final_glob (last l1)\"           \n     then have c:\"fst (last l1)=Skip \\<or> fst (last l1) = Throw \\<or> \n                  fst (last l1) = Stuck \\<or> (\\<exists>f. fst (last l1) =Fault f)\"\n       unfolding final_glob_def by auto \n     moreover have \"fst (last l1) = Seq (fst (last l2)) c2\" \n       using a2 last_lenl1 eq_length\n      proof -\n        have \"last l2 = l2 ! (length l2 - 1)\"\n          using l2_not_empty last_conv_nth by blast\n        then show ?thesis\n          by (metis One_nat_def a2 l2_not_empty last_lenl1 last_lift)\n      qed\n      ultimately have False by simp  \n    } thus ?thesis using l  by auto qed\nqed\n\nlemma comm_map:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Seq c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \\<and> (\\<Gamma>, l2)\\<in> comm(G, (q,a)) F\" and\n  a2:\"l1=map (lift c2) l2\" \nshows\n  \"(\\<Gamma>, l1)\\<in> comm(G, (r,a)) F\"\nproof - \n  {fix i \n    have \"(Suc i < length (l1) \\<longrightarrow>\n         \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n             (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i))) \\<longrightarrow>       \n        (snd (l1 ! i), snd (l1 ! Suc i)) \\<in> G) \\<and>\n        (final_glob (last l1) \\<longrightarrow>  fst (last l1) \\<notin> Fault ` F  \\<longrightarrow>                \n                   fst (last l1) = LanguageCon.com.Skip \\<and>\n                   snd (last l1) \\<in>  r \\<or>\n                   fst (last l1) = LanguageCon.com.Throw \\<and>\n                   snd (last l1) \\<in>  a) \"\n      using comm_map''[of \\<Gamma> l1 c1 c2 s l2 G q a ] a0 a1 a2 \n      by fastforce\n   }  then show ?thesis using comm_def unfolding comm_def by fastforce       \nqed\n(* declare[[show_types]]\nlemma \"(SOME e. e\\<in>{1::nat,2,3}) = 1 \\<or> (SOME e. e\\<in>{1::nat,2,3}) = 2 \\<or> (SOME e. e\\<in>{1::nat,2,3}) = 3\"\n  apply auto\n  by (metis (mono_tags, lifting) someI)*)\n\n\nlemma Seq_sound1:\nassumes\n  a0:\"(n,\\<Gamma>,x)\\<in>cptn_mod_nest_call\" and\n  a1:\"x!0 = ((Seq P Q),s)\" and\n  a2:\"\\<forall>i<length x. fst (x!i)\\<noteq> Q\" and\n  a3:\"\\<not> final_glob (last x)\" and\n  a4:\"env_tran_right \\<Gamma> x rely\" and\n  a5:\"snd (x!0)\\<in>  p \\<and> Sta p rely \\<and> Sta a rely \" and \n  a6: \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p, rely, G, q,a]\" \nshows\n  \"\\<exists>xs. (\\<Gamma>,xs) \\<in> cpn n \\<Gamma> P s \\<and> x = map (lift Q) xs\"\nusing a0 a1 a2 a3 a4  a5 a6\nproof (induct arbitrary: P s p) \n  case (CptnModNestOne n \\<Gamma> C s1)\n  then have \"(\\<Gamma>, [(P,s)]) \\<in> cpn n \\<Gamma> P s \\<and> [(C, s1)] = map (lift Q) [(P,s)]\"\n    unfolding cpn_def lift_def\n    by (simp add: cptn_mod_nest_call.CptnModNestOne) \n  thus ?case by fastforce\nnext\n  case (CptnModNestEnv \\<Gamma> C s1 t1 n xsa)\n  then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n  have \"\\<exists>xs. (\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t1 \\<and> (C, t1) # xsa = map (lift Q) xs\"\n  proof -\n     have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n     moreover have \"\\<forall>i<length ((C, t1) # xsa). fst (((C, t1) # xsa) ! i) \\<noteq> Q\"\n       using CptnModNestEnv(5) by fastforce\n     moreover have \"\\<not> final_glob (last ((C, t1) # xsa))\" using CptnModNestEnv(6) \n       by fastforce\n     moreover have \"snd (((C, t1) # xsa) ! 0) \\<in> p\" \n       using CptnModNestEnv(8) CptnModNestEnv(1) CptnModNestEnv(7)\n       unfolding env_tran_right_def Sta_def\n       by (metis Suc_less_eq length_Cons nth_Cons_0 nth_Cons_Suc zero_less_Suc) \n     ultimately show ?thesis\n       using CptnModNestEnv(3) CptnModNestEnv(7) CptnModNestEnv(8)  CptnModNestEnv(9) env_tran_tail by blast\n  qed \n  then obtain xs where hi:\"(\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t1 \\<and> (C, t1) # xsa = map (lift Q) xs\"\n    by fastforce\n  have s1_s:\"s1=s\" using  CptnModNestEnv unfolding cpn_def by auto\n  obtain xsa' where xs:\"xs=((P,t1)#xsa') \\<and> (n, \\<Gamma>,((P,t1)#xsa'))\\<in>cptn_mod_nest_call \\<and> (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')\" \n    using hi  unfolding cpn_def by fastforce  \n  have env_tran:\"\\<Gamma>\\<turnstile>\\<^sub>c(P,s1) \\<rightarrow>\\<^sub>e (P,t1)\" using CptnModNestEnv Seq_env_P by (metis fst_conv nth_Cons_0)  \n  then have \"(n, \\<Gamma>,(P,s1)#(P,t1)#xsa')\\<in>cptn_mod_nest_call\" \n    using xs env_tran cptn_mod_nest_call.CptnModNestEnv by fastforce  \n  then have \"(\\<Gamma>,(P,s1)#(P,t1)#xsa') \\<in> cpn n \\<Gamma> P s\" \n    using cpn_def s1_s by fastforce\n  moreover have \"(C,s1)#(C, t1) # xsa = map (lift Q) ((P,s1)#(P,t1)#xsa')\"\n    using xs C unfolding lift_def by fastforce\n  ultimately show ?case by auto\nnext\n  case (CptnModNestSkip)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestThrow)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestStuck)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext \n  case (CptnModNestFault)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestSeq1 n \\<Gamma> P0 sa xsa zs P1)\n  then have a1:\"LanguageCon.com.Seq P Q = LanguageCon.com.Seq P0 P1\"\n    by fastforce  \n  have f1: \"sa = s\"\n    using CptnModNestSeq1.prems(1) by force\n  have f2: \"P = P0 \\<and> Q = P1\" using a1 by auto  \n  hence \"(\\<Gamma>, (P0, sa) # xsa) \\<in> cpn n \\<Gamma> P s\"\n    using f2 f1 CptnModNestSeq1.hyps(1) by (simp add: cpn_def)\n  thus ?case\n    using Cons_lift CptnModNestSeq1.hyps(3) a1 by fastforce   \nnext\n  case (CptnModNestSeq2 n \\<Gamma> P0 sa xsa P1 ys zs) \n  then have \"P0 = P \\<and> P1 = Q\" by auto\n  then obtain i where zs:\"fst (zs!i) = Q \\<and> (i< (length zs))\" using CptnModNestSeq2\n    by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff)    \n  then have \"Suc i< length ((Seq P0 P1,sa)#zs)\" by fastforce\n  then have \"fst (((Seq P0 P1, sa) # zs)!Suc i) = Q\" using zs by fastforce    \n  thus ?case using CptnModNestSeq2(8) zs by auto\nnext\n  case (CptnModNestSeq3 n \\<Gamma> P1 sa xsa c f s' ys zs Q1 )          \n  have \"final_glob (last ((c,  s')# ys))\"\n  proof -\n    have cptn_mod:\"(n, \\<Gamma>, (c,  s') # ys) \\<in> cptn_mod_nest_call\" \n      using CptnModNestSeq3(5)\n      using CptnModNestSeq3.hyps(6) by blast\n    then have cptn:\"(\\<Gamma>, (c,  s') # ys) \\<in> cptn\"\n      using cptn_eq_cptn_mod_nest by auto\n    moreover have throw_0:\"((c,  s') # ys)!0 = (c,  s') \\<and> 0 < length((c,  s') # ys)\"\n      by force         \n    moreover have last:\"last ((c,  s') # ys) = ((c,  s') # ys)!((length ((c,  s') # ys)) - 1)\"\n      using last_conv_nth by auto\n    moreover have env_tran:\"env_tran_right \\<Gamma> ((c,  s') # ys) rely\" \n      using  CptnModNestSeq3(12)  CptnModNestSeq3(8) env_tran_subl env_tran_tail  by blast           \n    ultimately obtain st' where \"fst (last ((c,  s') # ys)) = c \\<and>        \n                     snd (last ((c,  s') # ys)) =  st'\"               \n      using term_all_skip[OF cptn _ ]  CptnModNestSeq3.hyps(4) by fastforce      \n    thus ?thesis  unfolding final_glob_def using CptnModNestSeq3.hyps(4) by blast\n  qed\n  thus ?case \n    using CptnModNestSeq3.hyps(8) CptnModNestSeq3.prems(3) by fastforce\nqed (auto)\n\nlemma Seq_sound2: \nassumes\n  a0:\"(\\<Gamma>,x)\\<in>cptn_mod\" and\n  a1:\"x!0 = ((Seq P Q),s)\" and\n  a2:\"\\<forall>i<length x. fst (x!i)\\<noteq> Q\" and\n  a3:\"fst (last x) = c \\<and> (c =  Throw \\<or> c = Stuck \\<or> (\\<exists>f. c = Fault f) )\" and\n  a4:\"env_tran_right \\<Gamma> x rely\"\nshows\n  \"\\<exists>xs s' ys. (\\<Gamma>,xs) \\<in> cp \\<Gamma> P s \\<and> x = ((map (lift Q) xs)@((c, s')#ys))\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s )\n  case (CptnModOne \\<Gamma> C s1)\n  thus ?case\n    by auto\nnext\n  case (CptnModEnv \\<Gamma> C s1 t1 xsa)\n  then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n  have \"\\<exists>xs s' ys. (\\<Gamma>, xs) \\<in> cp \\<Gamma> P t1 \\<and> (C, t1) # xsa = map (lift Q) xs@((c,  s')#ys)\"\n  proof -\n     have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n     moreover have \"\\<forall>i<length ((C, t1) # xsa). fst (((C, t1) # xsa) ! i) \\<noteq> Q\"\n       using CptnModEnv(5) by fastforce\n     moreover have \"fst (last ((C, t1) # xsa)) = c \" using CptnModEnv(6) \n       by fastforce\n     ultimately show ?thesis\n       using CptnModEnv(3) CptnModEnv(7) env_tran_tail\n       by (simp add: env_tran_tail CptnModEnv.prems(3))     \n  qed \n  then obtain xs s'' ys where hi:\"(\\<Gamma>, xs) \\<in> cp \\<Gamma> P t1 \\<and> (C, t1) # xsa = map (lift Q) xs@((c,  s'')#ys)\"\n    by fastforce\n  have s1_s:\"s1=s\" using  CptnModEnv unfolding cp_def by auto\n  have \"\\<exists>xsa' s'' ys. xs=((P,t1)#xsa') \\<and> (\\<Gamma>,((P,t1)#xsa'))\\<in>cptn \\<and> (C, t1) # xsa = \n             map (lift Q) ((P,t1)#xsa')@((c,  s'')#ys)\" \n    using hi  unfolding cp_def\n  proof -\n      have \"(\\<Gamma>,xs)\\<in>cptn \\<and> xs!0 = (P,t1)\" using hi unfolding cp_def by fastforce\n      moreover then have \"xs\\<noteq>[]\" using cptn.simps by fastforce  \n      ultimately obtain xsa' where \"xs=((P,t1)#xsa')\" using SmallStepCon.nth_tl by fastforce \n      thus ?thesis\n        using hi using \\<open>(\\<Gamma>, xs) \\<in> cptn \\<and> xs ! 0 = (P, t1)\\<close>\n        by blast \n  qed\n  then obtain xsa' s'' ys where \n    xs:\"xs=((P,t1)#xsa') \\<and> (\\<Gamma>,((P,t1)#xsa'))\\<in>cptn \\<and> (C, t1) # xsa =  \n         map (lift Q) ((P,t1)#xsa')@((c,  s'')#ys)\"\n    by fastforce\n  have env_tran:\"\\<Gamma>\\<turnstile>\\<^sub>c(P,s1) \\<rightarrow>\\<^sub>e (P,t1)\" using CptnModEnv Seq_env_P by (metis fst_conv nth_Cons_0)  \n  then have \"(\\<Gamma>,(P,s1)#(P,t1)#xsa')\\<in>cptn\" using xs env_tran\n    using cptn_eq_cptn_mod_set cptn_mod.CptnModEnv by blast  \n  then have \"(\\<Gamma>,(P,s1)#(P,t1)#xsa') \\<in> cp \\<Gamma> P s\" \n    using cp_def s1_s by fastforce\n  moreover have \"(C,s1)#(C, t1) # xsa = map (lift Q) ((P,s1)#(P,t1)#xsa')@((c,  s'')#ys)\"\n    using xs C unfolding lift_def by fastforce\n  ultimately show ?case by blast\nnext\n  case (CptnModSkip)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModThrow)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModStuck)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModFault)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModSeq1 \\<Gamma> P0 sa xsa zs P1)  \n  thus ?case    \n  proof -\n    have a1:\"\\<forall>c p. fst (case p of (ca::('s, 'a, 'd,'e) LanguageCon.com, x::('s, 'd) xstate) \\<Rightarrow> \n                (LanguageCon.com.Seq ca c, x)) = LanguageCon.com.Seq (fst p) c\"\n      by simp\n    then have \"[] = xsa\"     \n    proof -\n     have \"[] \\<noteq> zs\"\n       using CptnModSeq1 by force\n     then show ?thesis\n       by (metis CptnModSeq1.hyps(3) CptnModSeq1.prems(3) LanguageCon.com.simps(91) \n                 LanguageCon.com.simps(97) LanguageCon.com.simps(99) One_nat_def \n                 last_ConsR last_conv_nth last_lift)\n    qed   \n    then have \"\\<forall>c. Throw = c \\<or> [] = zs\"\n      using CptnModSeq1(3) by fastforce\n    then show ?thesis\n      using CptnModSeq1.prems(3) by force\n  qed   \nnext\n  case (CptnModSeq2 \\<Gamma> P0 sa xsa P1 ys zs) \n  then have \"P0 = P \\<and> P1 = Q\" by auto\n  then obtain i where zs:\"fst (zs!i) = Q \\<and> (i< (length zs))\" using CptnModSeq2\n    by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff)    \n  then have \"Suc i< length ((Seq P0 P1,sa)#zs)\" by fastforce\n  then have \"fst (((Seq P0 P1, sa) # zs)!Suc i) = Q\" using zs by fastforce    \n  thus ?case using CptnModSeq2(8) zs by auto\nnext \n  case (CptnModSeq3 \\<Gamma> P0 sa xsa c1 t s'' ys zs P1)  \n  then have P:\"P0 = P \\<and> P1 = Q \\<and> s= sa\" by auto  \n  moreover then have cp:\"(\\<Gamma>, (P0,  sa) # xsa)\\<in> cp \\<Gamma> P s\" \n    using CptnModSeq3(1)\n    by (simp add: cp_def cptn_eq_cptn_mod_set)            \n  ultimately show ?case  \n  proof -\n    have f1: \"(\\<Gamma>, (c1, s'') # ys) \\<in> cptn_mod\"\n      using CptnModSeq3.hyps(6) cptn_mod_nest_cptn_mod by blast\n    have f2: \"0 \\<le> length ys\"\n      by fastforce\n    have f3: \"c = fst (((c1, s'') # ys) ! length ys)\"\n      by (metis (no_types) CptnModSeq3.hyps(8) CptnModSeq3.prems(3) \n           append_is_Nil_conv last_ConsR last_appendR last_length list.simps(3))\n    have \"final_glob (c1, s'')\"\n      by (metis (no_types) CptnModSeq3.hyps(4) final_glob_def fst_conv)\n    then have \"final_glob (((c1, s'') # ys) ! 0)\"\n      by simp\n    then show ?thesis\n      using f3 f2 f1 by (metis (no_types) Cons_lift_append CptnModSeq3.hyps(8) cp P \n            cptn_if_cptn_mod fst_conv last_F length_Cons lessI nth_Cons_0)\n  qed        \nqed (force, auto)\n\n\nlemma Seq_sound2': \nassumes\n  a0:\"(n,\\<Gamma>,x)\\<in>cptn_mod_nest_call\" and\n  a1:\"x!0 = ((Seq P Q),s)\" and\n  a2:\"\\<forall>i<length x. fst (x!i)\\<noteq> Q\" and\n  a3:\"fst (last x) = c \\<and> (c = Throw \\<or> c = Stuck \\<or> (\\<exists>f. c = Fault f)) \" and\n  a4:\"env_tran_right \\<Gamma> x rely\"\nshows\n  \"\\<exists>xs s' ys. (\\<Gamma>,xs) \\<in> cpn n \\<Gamma> P s \\<and> x = ((map (lift Q) xs)@((c,  s')#ys))\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s )\n  case (CptnModNestOne n \\<Gamma> C s1)\n  thus ?case by fastforce\nnext\n  case (CptnModNestEnv \\<Gamma> C s1 t1 n xsa)\n  then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n  have \"\\<exists>xs s' ys. (\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t1 \\<and> (C, t1) # xsa = map (lift Q) xs@((c,  s')#ys)\"\n  proof -\n     have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n     moreover have \"\\<forall>i<length ((C, t1) # xsa). fst (((C, t1) # xsa) ! i) \\<noteq> Q\"\n       using CptnModNestEnv(5) by fastforce\n     moreover have \"fst (last ((C, t1) # xsa)) = c\" \n       using CptnModNestEnv(6) \n       by fastforce\n     ultimately show ?thesis\n       using CptnModNestEnv(3) CptnModNestEnv(7) \n       by (auto simp add: env_tran_tail CptnModNestEnv.prems(3))     \n  qed \n  then obtain xs s'' ys where \n    hi:\"(\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t1 \\<and> \n      (C, t1) # xsa = map (lift Q) xs@((c,  s'')#ys)\"\n    by fastforce\n  have s1_s:\"s1=s\" using  CptnModNestEnv unfolding cp_def by auto\n  have \"\\<exists>xsa' s'' ys. xs=((P,t1)#xsa') \\<and> (n, \\<Gamma>,((P,t1)#xsa'))\\<in>cptn_mod_nest_call \\<and> \n          (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')@((c,  s'')#ys)\" \n    using hi  unfolding cp_def\n  proof -\n      have \"(n, \\<Gamma>,xs)\\<in>cptn_mod_nest_call \\<and> xs!0 = (P,t1)\" using hi unfolding cpn_def by fastforce\n      moreover then have \"xs\\<noteq>[]\" using cptn_mod_nest_call.simps by fastforce  \n      ultimately obtain xsa' where \"xs=((P,t1)#xsa')\" using SmallStepCon.nth_tl by fastforce \n      thus ?thesis\n        using hi using \\<open>(n, \\<Gamma>, xs) \\<in> cptn_mod_nest_call \\<and> xs ! 0 = (P, t1)\\<close> by blast \n  qed\n  then obtain xsa' s'' ys where xs:\"xs=((P,t1)#xsa') \\<and> (n, \\<Gamma>,((P,t1)#xsa'))\\<in>cptn_mod_nest_call \\<and> \n                (C, t1) # xsa = map (lift Q) ((P,t1)#xsa')@((c,  s'')#ys)\"\n    by fastforce\n  have env_tran:\"\\<Gamma>\\<turnstile>\\<^sub>c(P,s1) \\<rightarrow>\\<^sub>e (P,t1)\" using CptnModNestEnv Seq_env_P by (metis fst_conv nth_Cons_0)  \n  then have \"(n, \\<Gamma>,(P,s1)#(P,t1)#xsa')\\<in>cptn_mod_nest_call\" using xs env_tran cptn_mod_nest_call.CptnModNestEnv by blast    \n  then have \"(\\<Gamma>,(P,s1)#(P,t1)#xsa') \\<in> cpn n \\<Gamma> P s\" \n    using cpn_def s1_s by fastforce\n  moreover have \"(C,s1)#(C, t1) # xsa = map (lift Q) ((P,s1)#(P,t1)#xsa')@((c,  s'')#ys)\"\n    using xs C unfolding lift_def by fastforce\n  ultimately show ?case by blast\nnext\n  case (CptnModNestSkip)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestThrow)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n case (CptnModNestStuck)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestFault)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestSeq1 n \\<Gamma> P0 sa xsa zs P1)  \n  thus ?case    \n  proof -\n    have a1:\"\\<forall>c p. fst (case p of (ca::('s, 'a, 'd,'e) LanguageCon.com, x::('s, 'd) xstate) \\<Rightarrow> \n                (LanguageCon.com.Seq ca c, x)) = LanguageCon.com.Seq (fst p) c\"\n      by simp\n    then have \"[] = xsa\"     \n    proof -\n     have \"[] \\<noteq> zs\"\n       using CptnModNestSeq1 by force\n     then show ?thesis\n       by (metis CptnModNestSeq1.hyps(3) CptnModNestSeq1.prems(3) \n                LanguageCon.com.simps(91) LanguageCon.com.simps(97) \n                LanguageCon.com.simps(99) One_nat_def last_ConsR last_conv_nth last_lift) \n    qed   \n    then have \"\\<forall>c. Throw = c \\<or> [] = zs\"\n      using CptnModNestSeq1(3) by fastforce\n    then show ?thesis\n      using CptnModNestSeq1.prems(3) by force\n  qed   \nnext\n  case (CptnModNestSeq2 n \\<Gamma> P0 sa xsa P1 ys zs) \n  then have \"P0 = P \\<and> P1 = Q\" by auto\n  then obtain i where zs:\"fst (zs!i) = Q \\<and> (i< (length zs))\" using CptnModNestSeq2\n    by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff)    \n  then have \"Suc i< length ((Seq P0 P1,sa)#zs)\" by fastforce\n  then have \"fst (((Seq P0 P1, sa) # zs)!Suc i) = Q\" using zs by fastforce    \n  thus ?case using CptnModNestSeq2(8) zs by auto\nnext \n  case (CptnModNestSeq3 n \\<Gamma> P0 sa xsa c1 f  s'' ys zs P1)  \n  then have P0:\"P0 = P \\<and> P1 = Q \\<and> s= sa\" by auto  \n  moreover then have cpn:\"(\\<Gamma>, (P0,  sa) # xsa)\\<in> cpn n \\<Gamma> P s\" \n    using CptnModNestSeq3(1)\n    by (simp add: cpn_def)  \n  ultimately show ?case\n  proof -\n    have f1: \"(\\<Gamma>, (c1, s'') # ys) \\<in> cptn_mod\"\n      using CptnModNestSeq3.hyps(6) cptn_mod_nest_cptn_mod by blast\n    have f2: \"0 \\<le> length ys\"\n      by fastforce\n    have f3: \"c = fst (((c1, s'') # ys) ! length ys)\"\n      by (metis (no_types) CptnModNestSeq3.hyps(8) CptnModNestSeq3.prems(3) \n           append_is_Nil_conv last_ConsR last_appendR last_length list.simps(3))\n    have \"final_glob (c1, s'')\"\n      by (metis (no_types) CptnModNestSeq3.hyps(4) final_glob_def fst_conv)\n    then have \"final_glob (((c1, s'') # ys) ! 0)\"\n      by simp\n    then show ?thesis\n      using f3 f2 f1 by (metis (no_types) Cons_lift_append CptnModNestSeq3.hyps(8) cpn P0 \n            cptn_if_cptn_mod fst_conv last_F length_Cons lessI nth_Cons_0)\n  qed      \nqed (auto)\n\n\n\nlemma Last_Skip_Exist_Final: \nassumes\n  a0:\"(\\<Gamma>,x)\\<in>cptn\" and\n  a1:\"x!0 = ((Seq P Q),s)\" and\n  a2:\"\\<forall>i<length x. fst (x!i)\\<noteq> Q\" and\n  a3:\"fst(last x) = Skip\"  \nshows \n  \"\\<exists>c s' i. i<length x \\<and> x!i = (Seq c Q,s') \\<and> final_glob (c,s')\"\nusing a0 a1 a2 a3 \nproof (induct arbitrary: P s)\n  case (CptnOne \\<Gamma> c s1) thus ?case by fastforce \nnext\n  case (Cptn \\<Gamma> C st C' st' xsa) \n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (C, st) \\<rightarrow>\\<^sub>c\\<^sub>e (C', st')\" by auto\n  then have \"\\<Gamma>\\<turnstile>\\<^sub>c (C, st) \\<rightarrow>\\<^sub>e (C', st') \\<or> \\<Gamma>\\<turnstile>\\<^sub>c (C, toSeq st) \\<rightarrow> (C', toSeq st')\"\n    using step_ce_dest by blast\n  moreover {assume \"\\<Gamma>\\<turnstile>\\<^sub>c (C, st) \\<rightarrow>\\<^sub>e (C', st')\"\n   moreover have \"LanguageCon.com.Seq P Q = C\"\n     using Cptn.prems(1) by auto\n   moreover have  \"C' = C\" using env_c_c' calculation Cptn by blast\n   ultimately have ?case using Cptn\n     by (metis Suc_less_eq last_length length_Cons nth_Cons_0 nth_Cons_Suc)  \n  }\n  moreover {\n    assume  a00:\"\\<Gamma>\\<turnstile>\\<^sub>c (C, toSeq st) \\<rightarrow> (C', toSeq st')\"\n    then have c_seq:\"C = (Seq P Q) \\<and> st = s\" using Cptn by force\n    from a00 c_seq have ?case \n    proof(cases)\n      case (Seqc P1 P1' P2) \n      then have \"\\<exists>c s' i. i < length ((C', st') # xsa) \\<and> \n                        ((C', st') # xsa) ! i = (LanguageCon.com.Seq c Q, s') \\<and> \n                        final_glob (c, s')\"\n        using Cptn last.simps\n        by (metis LanguageCon.com.inject(3) Suc_less_eq c_seq \n                 length_Cons list.simps(3) nth_Cons_0 nth_Cons_Suc) \n      thus ?thesis by fastforce \n    next\n      case (SeqThrowc C2) \n      thus ?thesis \n      proof -\n        have \"LanguageCon.com.Seq LanguageCon.com.Throw Q = C\"\n          using \\<open>C = LanguageCon.com.Seq LanguageCon.com.Throw C2\\<close> c_seq by blast\n        then show ?thesis\n          using Cptn unfolding final_glob_def\n          by (metis c_seq fst_conv length_Cons local.SeqThrowc(2) zero_less_Suc)\n      qed\n    next\n      case (SeqSkipc ) thus ?thesis\n        using Cptn.prems(2) c_seq by auto \n    next case (SeqFaultc f C2) thus ?thesis using Cptn.prems(2) c_seq\n        by (metis Cptn.prems(1) LanguageCon.com.inject(3) \n              final_glob_def fst_conv length_Cons zero_less_Suc) \n    next case (SeqStuckc C2) thus ?thesis using Cptn.prems(2) c_seq\n        by (metis Cptn.prems(1) LanguageCon.com.inject(3) \n              final_glob_def fst_conv length_Cons zero_less_Suc) \n           \n    qed (fastforce, auto)\n  } ultimately show ?case by auto\nqed\n\nlemma Seq_sound3:                                                       \nassumes\n  a0:\"(n,\\<Gamma>,x)\\<in>cptn_mod_nest_call\" and\n  a1:\"x!0 = ((Seq P Q),s)\" and\n  a2:\"\\<forall>i<length x. fst (x!i)\\<noteq> Q\" and\n  a3:\"fst(last x) = Skip\" and\n  a4:\"env_tran_right \\<Gamma> x rely \" and\n  a5:\"snd (x!0)\\<in>  p \\<and> Sta p rely \\<and> Sta a rely\" and\n  a6: \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p, rely, G, q,a]\"\nshows\n  \"False\"\nusing a0 a1 a2 a3 a4 a5 a6\nproof (induct arbitrary: P s p) (* p) *)\n  case (CptnModNestOne n \\<Gamma> C s1)  \n    thus ?case by fastforce\nnext\n  case (CptnModNestEnv \\<Gamma> C s1 t1 n xsa)\n  then have C:\"C=Seq P Q\" unfolding lift_def by fastforce\n  thus ?case\n  proof -\n     have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Seq P Q, t1)\" using C by auto\n     moreover have \"\\<forall>i<length ((C, t1) # xsa). fst (((C, t1) # xsa) ! i) \\<noteq> Q\"\n       using CptnModNestEnv(5) by fastforce\n     moreover have \"fst (last ((C, t1) # xsa)) = LanguageCon.com.Skip\" using CptnModNestEnv(6)\n       by (simp add: SmallStepCon.final_def)        \n     moreover have \"snd (((C, t1) # xsa) ! 0) \\<in>  p\" \n       using CptnModNestEnv(8) CptnModNestEnv(1) CptnModNestEnv(7)\n       unfolding env_tran_right_def Sta_def\n       by (metis Suc_less_eq length_Cons nth_Cons_0 nth_Cons_Suc zero_less_Suc) \n     ultimately show ?thesis\n       using CptnModNestEnv(3) CptnModNestEnv(7) CptnModNestEnv(8)  CptnModNestEnv(9) env_tran_tail\n       by blast\n  qed  \nnext\n  case (CptnModNestSkip)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestThrow)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext \n  case  (CptnModNestStuck)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext \n  case  (CptnModNestFault)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestSeq1 n \\<Gamma> P0 sa xsa zs P1)\n  obtain cl where \"fst (last ((LanguageCon.com.Seq P0 P1, sa) # zs)) = Seq cl P1\"\n    using CptnModNestSeq1(3)\n    by (metis Cons_lift last_length length_Cons lessI map_lift_all_seq)\n  thus ?case using CptnModNestSeq1(6) by auto\nnext\n case (CptnModNestSeq2 n \\<Gamma> P0 sa xsa P1 ys zs) \n  then have \"P0 = P \\<and> P1 = Q\" by auto\n  then obtain i where zs:\"fst (zs!i) = Q \\<and> (i< (length zs))\" using CptnModNestSeq2\n    by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff)        \n  thus ?case using CptnModNestSeq2(8) zs by auto \nnext\n   case (CptnModNestSeq3 n \\<Gamma> P1 sa xsa c f s' ys zs Q1 )  \n  \n  have c:\"fst (last ((c,  s') # ys)) = c\"\n    by (metis CptnModNestSeq3.hyps(4) CptnModNestSeq3.hyps(6) \n    cptn_eq_cptn_mod_nest last_length length_Cons lessI term_all_skip)\n  thus ?case using CptnModNestSeq3.hyps(4) apply auto  \n    using   CptnModNestSeq3.hyps(8) CptnModNestSeq3.prems(3) by auto\nqed(auto)\n\nlemma map_xs_ys:\n  assumes\n  a0:\"(\\<Gamma>, (P0, sa) # xsa) \\<in> cptn_mod\" and    \n  a1:\"fst (last ((P0, sa) # xsa)) = C\" and\n  a2:\"(\\<Gamma>, (P1, snd (last ((P0, sa) # xsa))) # ys) \\<in> cptn_mod\" and\n  a3:\"zs = map (lift P1) xsa @ (P1, snd (last ((P0, sa) # xsa))) # ys\" and\n  a4:\"((LanguageCon.com.Seq P0 P1, sa) # zs) ! 0 = (LanguageCon.com.Seq P Q, s)\" and\n  a5:\"i < length ((LanguageCon.com.Seq P0 P1, sa) # zs) \\<and> ((LanguageCon.com.Seq P0 P1, sa) # zs) ! i = (Q, sj)\" and\n  a6:\"\\<forall>j<i. fst (((LanguageCon.com.Seq P0 P1, sa) # zs) ! j) \\<noteq> Q\"\nshows \n  \"\\<exists>xs ys. (\\<Gamma>, xs) \\<in> cp \\<Gamma> P s \\<and>\n            (\\<Gamma>, ys) \\<in> cp \\<Gamma> Q (snd (xs ! (i - 1))) \\<and> (LanguageCon.com.Seq P0 P1, sa) # zs = map (lift Q) xs @ ys\"\nproof -\n  let ?P0 = \"(P0, sa) # xsa\"\n  have P_Q:\"P=P0 \\<and> s=sa \\<and> Q = P1\" using a4 by force\n  have i:\"i=(length ((P0, sa) # xsa))\"   \n  proof (cases \"i=(length ((P0, sa) # xsa))\")\n    case True thus ?thesis by auto\n  next\n    case False     \n    then have i:\"i<(length ((P0, sa) # xsa)) \\<or> i > (length ((P0, sa) # xsa))\" by auto\n    {\n      assume i:\"i<(length ((P0, sa) # xsa))\"\n      then have eq_map:\"((LanguageCon.com.Seq P0 P1, sa) # zs) ! i = map (lift P1) ((P0, sa) # xsa) ! i\" \n        using a3 Cons_lift_append by (metis (no_types, lifting) length_map nth_append) \n      then have  \"\\<exists>ci si. map (lift P1) ((P0, sa) # xsa) ! i = (Seq ci P1,si)\" \n        using i unfolding lift_def\n        proof -\n          have \"map (\\<lambda>(c, y). (LanguageCon.com.Seq c P1, y)) ((P0, sa) # xsa) ! i = (case ((P0, sa) # xsa) ! i of (c, x) \\<Rightarrow> (LanguageCon.com.Seq c P1, x))\"\n            by (meson \\<open>i < length ((P0, sa) # xsa)\\<close> nth_map)\n          then show \"\\<exists>c x. map (\\<lambda>(c, x). (LanguageCon.com.Seq c P1, x)) ((P0, sa) # xsa) ! i = (LanguageCon.com.Seq c P1, x)\"\n            by (simp add: case_prod_beta)\n        qed \n      then have  \"((LanguageCon.com.Seq P0 P1, sa) # zs) ! i \\<noteq> (Q, sj)\" \n        using P_Q eq_map by fastforce\n      then have ?thesis using a5 by auto\n    }note l=this\n    {\n      assume i:\"i>(length ((P0, sa) # xsa))\"\n      have \"fst (((LanguageCon.com.Seq P0 P1, sa) # zs) ! (length ?P0)) = Q\"\n        using a3 P_Q Cons_lift_append by (metis fstI length_map nth_append_length) \n      then have ?thesis using a6 i by auto\n    }\n    thus ?thesis using l i by auto\n   qed\n   then have  \"(\\<Gamma>, (P0, sa) # xsa) \\<in> cp \\<Gamma> P s\" \n    using a0  cptn_eq_cptn_mod P_Q unfolding cp_def by fastforce\n  also have \"(\\<Gamma>, (P1, snd (last ((P0, sa) # xsa))) # ys) \\<in> cp \\<Gamma> Q (snd (?P0 ! ((length ?P0) -1)))\" \n    using a3 cptn_eq_cptn_mod P_Q unfolding cp_def\n  proof -\n    have \"(\\<Gamma>, (Q, snd (last ((P0, sa) # xsa))) # ys) \\<in> cptn_mod\"\n      using a2 P_Q by blast\n    then have \"(\\<Gamma>, (Q, snd (last ((P0, sa) # xsa))) # ys) \\<in> {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (Suc (length xsa) - 1))) \\<and> (\\<Gamma>, ps) \\<in> cptn \\<and> f = \\<Gamma>}\"\n      by (simp add: cptn_eq_cptn_mod last_length)\n    then show \"(\\<Gamma>, (P1, snd (last ((P0, sa) # xsa))) # ys) \\<in> {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (length ((P0, sa) # xsa) - 1))) \\<and> (\\<Gamma>, ps) \\<in> cptn \\<and> f = \\<Gamma>}\"\n      using P_Q by force\n  qed \n  ultimately show ?thesis using a3 P_Q i using Cons_lift_append by blast\nqed\n\nlemma map_xs_ys':\n  assumes\n  a0:\"(n, \\<Gamma>, (P0, sa) # xsa) \\<in> cptn_mod_nest_call\" and    \n  a1:\"fst (last ((P0, sa) # xsa)) = C\" and\n  a2:\"(n,\\<Gamma>, (P1, snd (last ((P0, sa) # xsa))) # ys) \\<in> cptn_mod_nest_call\" and\n  a3:\"zs = map (lift P1) xsa @ (P1, snd (last ((P0, sa) # xsa))) # ys\" and\n  a4:\"((LanguageCon.com.Seq P0 P1, sa) # zs) ! 0 = (LanguageCon.com.Seq P Q, s)\" and\n  a5:\"i < length ((LanguageCon.com.Seq P0 P1, sa) # zs) \\<and> ((LanguageCon.com.Seq P0 P1, sa) # zs) ! i = (Q, sj)\" and\n  a6:\"\\<forall>j<i. fst (((LanguageCon.com.Seq P0 P1, sa) # zs) ! j) \\<noteq> Q\"\nshows \n  \"\\<exists>xs ys. (\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P s \\<and>\n            (\\<Gamma>, ys) \\<in> cpn n \\<Gamma> Q (snd (xs ! (i - 1))) \\<and> (LanguageCon.com.Seq P0 P1, sa) # zs = map (lift Q) xs @ ys\"\nproof -\n  let ?P0 = \"(P0, sa) # xsa\"\n  have P_Q:\"P=P0 \\<and> s=sa \\<and> Q = P1\" using a4 by force\n  have i:\"i=(length ((P0, sa) # xsa))\"   \n  proof (cases \"i=(length ((P0, sa) # xsa))\")\n    case True thus ?thesis by auto\n  next\n    case False     \n    then have i:\"i<(length ((P0, sa) # xsa)) \\<or> i > (length ((P0, sa) # xsa))\" by auto\n    {\n      assume i:\"i<(length ((P0, sa) # xsa))\"\n      then have eq_map:\"((LanguageCon.com.Seq P0 P1, sa) # zs) ! i = map (lift P1) ((P0, sa) # xsa) ! i\" \n        using a3 Cons_lift_append by (metis (no_types, lifting) length_map nth_append) \n      then have  \"\\<exists>ci si. map (lift P1) ((P0, sa) # xsa) ! i = (Seq ci P1,si)\" \n        using i unfolding lift_def\n        proof -\n          have \"map (\\<lambda>(c, y). (LanguageCon.com.Seq c P1, y)) ((P0, sa) # xsa) ! i = (case ((P0, sa) # xsa) ! i of (c, x) \\<Rightarrow> (LanguageCon.com.Seq c P1, x))\"\n            by (meson \\<open>i < length ((P0, sa) # xsa)\\<close> nth_map)\n          then show \"\\<exists>c x. map (\\<lambda>(c, x). (LanguageCon.com.Seq c P1, x)) ((P0, sa) # xsa) ! i = (LanguageCon.com.Seq c P1, x)\"\n            by (simp add: case_prod_beta)\n        qed \n      then have  \"((LanguageCon.com.Seq P0 P1, sa) # zs) ! i \\<noteq> (Q, sj)\" \n        using P_Q eq_map by fastforce\n      then have ?thesis using a5 by auto\n    }note l=this\n    {\n      assume i:\"i>(length ((P0, sa) # xsa))\"\n      have \"fst (((LanguageCon.com.Seq P0 P1, sa) # zs) ! (length ?P0)) = Q\"\n        using a3 P_Q Cons_lift_append by (metis fstI length_map nth_append_length) \n      then have ?thesis using a6 i by auto\n    }\n    thus ?thesis using l i by auto\n   qed\n   then have  \"(\\<Gamma>, (P0, sa) # xsa) \\<in> cpn n \\<Gamma> P s\" \n    using a0  P_Q unfolding cpn_def by fastforce\n  also have \"(\\<Gamma>, (P1, snd (last ((P0, sa) # xsa))) # ys) \\<in> cpn n \\<Gamma> Q (snd (?P0 ! ((length ?P0) -1)))\" \n    using a3 cptn_eq_cptn_mod P_Q unfolding cpn_def\n  proof -\n    have \"(n, \\<Gamma>, (Q, snd (last ((P0, sa) # xsa))) # ys) \\<in> cptn_mod_nest_call\"\n      using a2 P_Q by blast\n    then have \"(\\<Gamma>, (Q, snd (last ((P0, sa) # xsa))) # ys) \\<in> {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (Suc (length xsa) - 1))) \\<and> \n              (n, \\<Gamma>, ps) \\<in> cptn_mod_nest_call \\<and> f = \\<Gamma>}\"\n      by (simp add: cptn_eq_cptn_mod last_length)\n    then show \"(\\<Gamma>, (P1, snd (last ((P0, sa) # xsa))) # ys) \\<in> {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (length ((P0, sa) # xsa) - 1))) \\<and> (n,\\<Gamma>, ps) \\<in> cptn_mod_nest_call \\<and> f = \\<Gamma>}\"\n      using P_Q by force\n  qed \n  ultimately show ?thesis using a3 P_Q i using Cons_lift_append by blast\nqed\n\n\n\nlemma Seq_sound4: \nassumes\n  a0:\"(n,\\<Gamma>,x)\\<in>cptn_mod_nest_call\" and\n  a1:\"x!0 = ((Seq P Q),s)\" and\n  a2:\"i<length x \\<and> x!i=(Q,sj)\" and\n  a3:\"\\<forall>j<i. fst(x!j)\\<noteq>Q\" and \n  a4:\"env_tran_right \\<Gamma> x rely\" and\n  a5:\"snd (x!0)\\<in>  p \\<and> Sta p rely \\<and> Sta a rely\" and\n  a6: \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p, rely, G, q,a]\"\nshows\n  \"\\<exists>xs ys. (\\<Gamma>,xs) \\<in> (cpn n \\<Gamma> P s) \\<and> (\\<Gamma>,ys) \\<in> (cpn n \\<Gamma> Q (snd (xs!(i-1)))) \\<and> x = (map (lift Q) xs)@ys\"\nusing a0 a1 a2 a3 a4 a5 a6\nproof (induct arbitrary: i sj P s p) \n   case (CptnModNestOne \\<Gamma> C s1)  \n    thus ?case by fastforce\nnext\n  case (CptnModNestEnv \\<Gamma> C st t n xsa)    \n  have a1:\"Seq P Q \\<noteq> Q\" by simp    \n  then have C_seq:\"C=(Seq P Q)\" using CptnModNestEnv by fastforce\n  then have \"fst(((C, st) # (C, t) # xsa)!0) \\<noteq>Q\" using  a1 by auto\n  moreover have  n_q:\"fst(((C, st) # (C, t) # xsa)!1) \\<noteq>Q\" using CptnModNestEnv a1 by auto\n  moreover have \"fst(((C, st) # (C, t) # xsa)!i) =Q\" using CptnModNestEnv by auto\n  ultimately have i_suc: \"i> (Suc 0)\" \n    by (metis Suc_eq_plus1 Suc_lessI add.left_neutral neq0_conv) \n  then obtain i' where i':\"i=Suc i'\" by (meson lessE) \n  then have i_minus:\"i'=i-1\" by auto\n  have c_init:\"((C, t) # xsa) ! 0 = ((Seq P Q), t)\"\n    using CptnModNestEnv by auto \n  moreover have \"i'< length ((C,t)#xsa) \\<and> ((C,t)#xsa)!i' = (Q,sj)\"\n    using i' CptnModNestEnv(5) by force\n  moreover have \"\\<forall>j<i'. fst (((C, t) # xsa) ! j) \\<noteq> Q\"\n    using i' CptnModNestEnv(6) by force\n  moreover have \"snd (((C, t) # xsa) ! 0) \\<in> p\" \n       using CptnModNestEnv(8) CptnModNestEnv(1) CptnModNestEnv(7)\n       unfolding env_tran_right_def Sta_def\n       by (metis Suc_mono length_Cons nth_Cons_0 nth_Cons_Suc zero_less_Suc)  \n  ultimately have hyp:\"\\<exists>xs ys.\n     (\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t \\<and>\n     (\\<Gamma>, ys) \\<in> cpn n \\<Gamma> Q (snd (xs ! (i'-1))) \\<and> (C, t) # xsa = map (lift Q) xs @ ys\"\n    using CptnModNestEnv(3) env_tran_tail  CptnModNestEnv(8) CptnModNestEnv(9) \n         CptnModNestEnv.prems(4) by blast  \n  then obtain xs ys where xs_cp:\"(\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t \\<and>\n     (\\<Gamma>, ys) \\<in> cpn n \\<Gamma> Q (snd (xs ! (i'-1))) \\<and> (C, t) # xsa = map (lift Q) xs @ ys\"\n    by fast\n  have \"(\\<Gamma>, (P,s)#xs) \\<in> cpn n \\<Gamma> P s\"\n  proof -\n    have \"xs!0 = (P,t)\" \n      using xs_cp unfolding cpn_def by blast\n    moreover have \"xs\\<noteq>[]\"\n      using xs_cp  n_q c_init unfolding cpn_def by auto \n    ultimately obtain xs' where xs':\"(n, \\<Gamma>, (P,t)#xs') \\<in> cptn_mod_nest_call \\<and> xs=(P,t)#xs'\" \n      using SmallStepCon.nth_tl xs_cp unfolding cpn_def by force\n    thus ?thesis \n    proof -\n      have \"(LanguageCon.com.Seq P Q, s) = (C, st)\"\n        using CptnModNestEnv.prems(1) by auto\n      then have \"\\<Gamma>\\<turnstile>\\<^sub>c (P, s) \\<rightarrow>\\<^sub>e (P, t)\"\n        using Seq_env_P CptnModNestEnv(1) by blast\n      then show ?thesis\n        by (simp add:xs' cpn_def cptn_mod_nest_call.CptnModNestEnv)\n    qed\n  qed\n  thus  ?case \n    using i_suc Cons_lift_append CptnModNestEnv.prems(1) i' i_minus xs_cp\n    by (metis (no_types, lifting) One_nat_def nth_Cons_0 nth_Cons_pos zero_less_diff)\n      \nnext\n  case (CptnModNestSkip)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestThrow)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestFault)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestStuck)\n  thus ?case by (metis SmallStepCon.redex_not_Seq fst_conv nth_Cons_0)\nnext\n  case (CptnModNestSeq1 n \\<Gamma> P0 sa xsa zs P1)  \n  then have P1_Q:\"P1 = Q\" by auto\n  let ?x = \"(LanguageCon.com.Seq P0 P1, sa) # zs\"\n  have \"\\<forall>j<length ?x. \\<exists>c s. ?x!j = (Seq c P1,s)\" using CptnModNestSeq1(3)\n  proof (induct xsa arbitrary: zs P0 P1 sa)\n    case Nil thus ?case by auto\n  next\n    case (Cons a xsa) \n    then obtain ac as where \"a=(ac,as)\"\n      by (meson prod.exhaust_sel)\n    then have zs:\"zs = (Seq ac P1,as)#(map (lift P1)  xsa)\" \n      using Cons(2) \n      unfolding lift_def  by auto\n    have zs_eq:\"(map (lift P1)  xsa)=(map (lift P1)  xsa)\" by auto\n    note hyp=Cons(1)[OF zs_eq] \n    note hyp[of ac as]\n    thus ?case using zs Cons(2) by (metis One_nat_def diff_Suc_Suc diff_zero length_Cons less_Suc_eq_0_disj nth_Cons') \n  qed  \n  thus ?case using P1_Q CptnModNestSeq1(5) using fstI seq_not_eq2 by auto\nnext\n  case (CptnModNestSeq2 n \\<Gamma> P0 sa xsa P1 ys zs) \n  then show ?case using map_xs_ys'[OF CptnModNestSeq2(1) CptnModNestSeq2(3) CptnModNestSeq2(4) CptnModNestSeq2(6)\n                              CptnModNestSeq2(7) CptnModNestSeq2(8) CptnModNestSeq2(9)] by blast\nnext \n  case (CptnModNestSeq3 n \\<Gamma> P1 sa xsa c f s' ys zs Q1 ) \n  then have P_Q:\"P=P1 \\<and> Q = Q1\" by force  \n  thus ?case\n  proof (cases \"Q1 = Throw \\<or> Q1 = Stuck \\<or> (\\<exists>f. Q1 = Fault f)\")\n    case True      \n    then have cptnmod:\" (n,\\<Gamma>,((Seq P1 Q1),  s)#zs) \\<in> cptn_mod_nest_call\"\n      using cptn_mod.CptnModSeq3 P_Q\n      by (smt CptnModNestSeq3.hyps(1) CptnModNestSeq3.hyps(3) CptnModNestSeq3.hyps(4) \n               CptnModNestSeq3.hyps(5) CptnModNestSeq3.hyps(6) CptnModNestSeq3.hyps(8) \n             CptnModNestSeq3.prems(1) cptn_mod_nest_call.CptnModNestSeq3 nth_Cons_0)\n    then have c_Q1:\"c = Q1\" using CptnModNestSeq3 P_Q True\n    proof -      \n       have f4: \"(\\<Gamma>, (c, s') # ys) \\<in> cptn\"\n        using  CptnModNestSeq3(6)\n        using cptn_eq_cptn_mod_nest by blast\n      have f3:\"((LanguageCon.com.Seq P1 Q1, sa) # zs) ! i = (Q1, sj)\"\n        using P_Q CptnModNestSeq3(10) by fastforce\n      then have f5: \"final_glob (Q, sj)\"\n        by (metis P_Q True final_glob_def fst_conv)\n      have \"final_glob (c, s')\"\n        using CptnModNestSeq3.hyps(4) final_glob_def prod.collapse by blast\n      then show ?thesis\n        using f5 f4\n        by (metis (no_types, lifting) CptnModNestSeq3.hyps(8) CptnModNestSeq3.prems(1) \n            CptnModNestSeq3.prems(2) f3 append_is_Nil_conv cptn_if_cptn_mod cptn_mod_nest_cptn_mod \n              cptnmod fst_conv last.simps last_F last_appendR last_length length_Cons \n            lessI less_Suc_eq_le list.simps(3) nth_Cons_0 zero_less_Suc)           \n    qed       \n    then show ?thesis  \n      using CptnModNestSeq3  P_Q map_xs_ys'[of n \\<Gamma> P1 \"sa\" xsa Q1 Q1 ys zs P1 Q1 sa i sj]\n      by auto        \n  next \n    case False note q_not_throw=this\n    have \"\\<forall>x. x< length ((LanguageCon.com.Seq P1 Q1,  sa) # zs) \\<longrightarrow>\n              ((LanguageCon.com.Seq P1 Q1,  sa) # zs) ! x \\<noteq> (Q, sj)\"\n    proof -\n    {\n      fix x\n      assume x_less:\"x< length ((LanguageCon.com.Seq P1 Q1,  sa) # zs)\"\n      have \"((LanguageCon.com.Seq P1 Q1,  sa) # zs) ! x \\<noteq> (Q, sj)\"\n      proof (cases \"x < length ((LanguageCon.com.Seq P1 Q1,  sa)#map (lift Q1) xsa)\")\n        case True \n        then have eq_map:\"((LanguageCon.com.Seq P1 Q1,  sa) # zs) ! x = \n                           map (lift Q1) ((P1,  sa) # xsa) ! x\"\n          by (metis (no_types, lifting) Cons_lift Cons_lift_append CptnModNestSeq3.hyps(8) nth_append)\n        then have  \"\\<exists>ci si. map (lift Q1) ((P1,  sa) # xsa) ! x = (Seq ci Q1,si)\" \n          using True unfolding lift_def\n        proof -\n          have \"x < length ((P1,  sa) # xsa)\"\n            using True by auto\n          then have \"map (\\<lambda>(c, y). (LanguageCon.com.Seq c Q1, y)) ((P1,  sa) # xsa) ! x = \n                      (case ((P1, sa) # xsa) ! x of (c, x) \\<Rightarrow> (LanguageCon.com.Seq c Q1, x))\"\n            using nth_map by blast\n          then show \"\\<exists>c x1. map (\\<lambda>(c, x1). (LanguageCon.com.Seq c Q1, x1)) ((P1, sa) # xsa) ! x = \n                       (LanguageCon.com.Seq c Q1, x1)\"\n            by (simp add: case_prod_beta')\n        qed            \n        then have  \"((LanguageCon.com.Seq P1 Q1,  sa) # zs) ! x \\<noteq> (Q, sj)\" \n          using P_Q eq_map by fastforce     \n        thus ?thesis using CptnModNestSeq3(10) by auto        \n      next\n        case False        \n        have all_throw:\"\\<forall>i<length ((c,  s')# ys). \n              fst (((c,  s')# ys)!i) = c\"\n          using CptnModNestSeq3.hyps(4) CptnModNestSeq3.hyps(6) \n            cptn_if_cptn_mod cptn_mod_nest_cptn_mod term_all_skip by blast      \n        then have \n          \"\\<forall>x\\<ge> length ((LanguageCon.com.Seq P1 Q1,  sa) # map (lift Q1) xsa). \n           x<length (((LanguageCon.com.Seq P1 Q1,  sa) # zs)) \\<longrightarrow>\n              fst (((LanguageCon.com.Seq P1 Q1,  sa) # zs) ! x) = c\"  \n        proof-\n        {\n          fix x \n          assume a1:\"x\\<ge> length ((LanguageCon.com.Seq P1 Q1,  sa) # map (lift Q1) xsa)\" and\n                 a2:\"x<length (((LanguageCon.com.Seq P1 Q1,  sa) # zs))\"\n          then have \"((Seq P1 Q1,  sa) # zs) ! x = \n                     ((c,  s')# ys) !(x - (length ((Seq P1 Q1,  sa) # map (lift Q1) xsa)))\"\n          using CptnModNestSeq3(8) by (metis Cons_lift Cons_lift_append not_le nth_append)\n          then have\"fst (((LanguageCon.com.Seq P1 Q1,  sa) # zs) ! x) = c\" \n            using all_throw a1 a2 CptnModNestSeq3.hyps(8)  by auto \n        } thus ?thesis by auto\n        qed       \n        thus ?thesis using False CptnModNestSeq3(8) q_not_throw P_Q x_less\n          by (metis CptnModNestSeq3.hyps(4) fst_conv not_le_imp_less)\n      qed\n    } thus ?thesis by auto\n    qed\n    thus ?thesis using CptnModNestSeq3(10) by fastforce    \n  qed\nqed(auto)\n\n\n\ninductive_cases stepc_elim_cases_Seq_throw:\n\"\\<Gamma>\\<turnstile>\\<^sub>c(Seq c1 c2,s) \\<rightarrow> (Throw,  s1)\" \n\"\\<Gamma>\\<turnstile>\\<^sub>c(Seq c1 c2,s) \\<rightarrow> (Stuck,  s1)\" \n\"\\<Gamma>\\<turnstile>\\<^sub>c(Seq c1 c2,s) \\<rightarrow> (Fault f,  s1)\"\n\ninductive_cases stepc_elim_cases_Seq_skip_c2:\n\"\\<Gamma>\\<turnstile>\\<^sub>c(Seq c1 c2,s) \\<rightarrow> (c2,s)\"\n\n\nlemma seq_skip_throw:\n \"\\<Gamma>\\<turnstile>\\<^sub>c(Seq c1 c2,s) \\<rightarrow> (c2,s)  \\<Longrightarrow> c1= Skip \\<or> c1=Throw \\<or> c1 = Stuck \\<or> (\\<exists>f. c1 = Fault f)\"\napply (rule stepc_elim_cases_Seq_skip_c2)\napply fastforce\n  by auto\n\n\nlemma step_ce_eq:   \n  assumes step_m: \"\\<Gamma>\\<turnstile>\\<^sub>c (c, s) \\<rightarrow>\\<^sub>c\\<^sub>e (c', s')\" and\n          step_ce:\"\\<Gamma>\\<turnstile>\\<^sub>c (c, toSeq s) \\<rightarrow> (c', toSeq s')\" and\n          eq:\"toSeq s = toSeq s'\"\n   shows \"s = s'\"\n  by (metis  eq l1 step_ce step_m)\n\n\nlemma Seq_sound: \n      \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a] \\<Longrightarrow>\n       \\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a] \\<Longrightarrow>\n       \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a] \\<Longrightarrow>\n       \\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a] \\<Longrightarrow>        \n       Sta a R \\<and> Sta p R \\<Longrightarrow>  \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow>\n       \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Seq c1 c2) sat [p, R, G, r,a]\"\nproof -  \n  assume\n    a0:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]\" and\n    a1:\"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]\" and\n    a2:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]\" and    \n    a3: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]\" and     \n    a4: \"Sta a R \\<and> Sta p R\" and\n    a5: \"\\<forall>s. length (snd s) \\<in> N p \\<longrightarrow> ( s,  s) \\<in> G\"\n  { \n    fix s\n    assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n    then have a1:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,a]\" \n      using a1 com_cvalidityn_def by fastforce  \n    then have a3: \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c2 sat [q, R, G, r,a]\"\n      using a3 com_cvalidityn_def all_call by fastforce \n    have \"cpn n \\<Gamma> (Seq c1 c2)  s \\<inter> assum(p, R) \\<subseteq> comm(G, (r,a)) F\"\n    proof -\n    {   \n      fix c     \n      assume a10:\"c \\<in> cpn n \\<Gamma> (Seq c1 c2) s\" and a11:\"c \\<in> assum(p, R)\"\n      then have a10':\"c \\<in> cp \\<Gamma> (Seq c1 c2) s\" unfolding cpn_def cp_def\n        using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n      obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n      have cp:\"l!0=((Seq c1 c2),s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10' cp_def c_prod by fastforce\n      have cptn_nest:\"l!0=((Seq c1 c2),s) \\<and> (n,\\<Gamma>,l) \\<in> cptn_mod_nest_call \\<and> \\<Gamma>=\\<Gamma>1\" using a10 cpn_def c_prod by fastforce\n      have \\<Gamma>1:\"(\\<Gamma>, l) = c\" using c_prod cp by blast\n      have \"c \\<in> comm(G, (r,a)) F\"         \n      proof - \n      {      \n       have assum:\"snd(l!0) \\<in> (p) \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n                 (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n                 (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n       using a11 c_prod unfolding assum_def by simp\n       then have env_tran:\"env_tran \\<Gamma> p l R\" using env_tran_def cp by blast\n       then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n         using env_tran env_tran_right_def unfolding env_tran_def by auto       \n       have \"(\\<forall>i. Suc i<length l \\<longrightarrow> \n               (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                    (fst (l ! Suc i), toSeq (snd (l ! Suc i)))) \\<longrightarrow>                                             \n                 (snd(l!i), snd(l!(Suc i))) \\<in> G)\\<and>\n             (final_glob (last l)  \\<longrightarrow>   fst (last l) \\<notin> Fault ` F \\<longrightarrow>                       \n                   ((fst (last l) = Skip \\<and> snd (last l) \\<in>  r)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> a))\"\n       proof (cases \"\\<forall>i<length l. fst (l!i)\\<noteq> c2\")\n         case True \n         then have no_c2:\"\\<forall>i<length l. fst (l!i)\\<noteq> c2\" by assumption          \n         show ?thesis\n         proof (cases \"final_glob (last l)\")\n           case True\n           then have \"fst (last l) = Skip \\<or> (fst (last l) = Throw \\<or> \n                                 fst (last l) = Stuck \\<or> (\\<exists>f. fst (last l) = Fault f))\"  \n             using final_glob_def by fast           \n           thus ?thesis\n           proof\n             assume \"fst (last l) = LanguageCon.com.Skip\" \n             then have \"False\" \n               using  no_c2 env_tran_right cptn_nest cptn_eq_cptn_mod_set Seq_sound3 a4 a1 assum\n               by blast\n             thus ?thesis by auto\n           next             \n             assume asm0:\"(fst (last l) = Throw \\<or> fst (last l) = Stuck \\<or> (\\<exists>f. fst (last l) = Fault f))\"\n             then obtain lc1 s1' ys where cpn_lc1:\n             \"(\\<Gamma>,lc1) \\<in> cpn n \\<Gamma> c1 s \\<and> l = ((map (lift c2) lc1)@((fst (last l),  s1')#ys))\"\n               using Seq_sound2'[of n \\<Gamma> l c1 c2 s]  \n                     cptn_nest cptn_eq_cptn_mod_set env_tran_right no_c2 by blast\n             then have cp_lc1:\"(\\<Gamma>,lc1) \\<in> cp \\<Gamma> c1 s\"\n               using  cptn_if_cptn_mod cptn_mod_nest_cptn_mod split_conv \n               unfolding cp_def cpn_def by blast\n             let ?m_lc1 = \"map (lift c2) lc1\"\n             let ?lm_lc1 = \"(length ?m_lc1)\"\n             let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\"             \n             have lc1_not_empty:\"lc1 \\<noteq> []\"\n               using \\<Gamma>1 a10  cpn_lc1 cp True unfolding final_glob_def by auto \n             then have map_cpn:\"(\\<Gamma>,?m_lc1) \\<in> cpn n \\<Gamma> (Seq c1 c2) s\"                  \n             proof -\n               have f1: \"lc1 ! 0 = (c1, s) \\<and> (n,\\<Gamma>, lc1) \\<in> cptn_mod_nest_call \\<and> \\<Gamma> = \\<Gamma>\"\n                 using cpn_lc1 cpn_def by blast\n               then have f2: \"(n, \\<Gamma>, ?m_lc1) \\<in> cptn_mod_nest_call\" \n               by (metis (no_types) Cons_lift cptn_mod_nest_call.CptnModNestSeq1 f1 lc1_not_empty list.exhaust nth_Cons_0)                               \n               then show ?thesis\n                 using f2 f1 lc1_not_empty by (simp add: cpn_def lift_def)\n             qed\n             then have map_cp:\"(\\<Gamma>,?m_lc1) \\<in> cp \\<Gamma> (Seq c1 c2) s\"\n               by (metis (no_types, lifting) cp_def cp_lc1 cpn_def lift_is_cptn mem_Collect_eq split_conv) \n             also have map_assum:\"(\\<Gamma>,?m_lc1) \\<in> assum (p,R)\"\n               using sub_assum a10 a11 \\<Gamma>1 cpn_lc1 lc1_not_empty \n               by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n             ultimately have \"((\\<Gamma>,lc1) \\<in> assum(p, R))\"  \n               using \\<Gamma>1 assum_map cp_lc1 by blast                          \n             then have lc1_comm:\"(\\<Gamma>,lc1) \\<in> comm(G, (q,a)) F\"  \n               using a1  cpn_lc1 unfolding com_validityn_def by blast\n             then have m_lc1_comm:\"(\\<Gamma>,?m_lc1) \\<in> comm(G, (q,a)) F\"\n               using map_cp map_assum comm_map cp_lc1 by fastforce\n             then have last_m_lc1:\"last (?m_lc1) = (Seq (fst (last lc1)) c2,snd (last lc1))\"\n             proof -\n               have a000:\"\\<forall>p c. (LanguageCon.com.Seq (fst p) c, snd p) = lift c p\"\n                 using Cons_lift by force\n               then show ?thesis\n                 by (simp add: last_map a000 lc1_not_empty)\n             qed\n             then have last_length:\"last (?m_lc1) = ?last_m_lc1\"  \n               using lc1_not_empty last_conv_nth list.map_disc_iff by blast \n             then have l_map:\"l!(?lm_lc1-1)= ?last_m_lc1\" \n               using cpn_lc1\n               by (metis (no_types) cpn_lc1 diff_less lc1_not_empty length_greater_0_conv length_map nth_append zero_less_one)                                          \n             then have lm_lc1:\"l!(?lm_lc1) = (fst (last l),  s1')\"\n               using cpn_lc1\n               by (metis nth_append_length) \n             have step_ce:\"\\<Gamma>\\<turnstile>\\<^sub>c(l!(?lm_lc1-1)) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(?lm_lc1))\"\n             proof -\n               have f1: \"\\<forall>n na. \\<not> n < na \\<or> Suc (na - Suc n) = na - n\"\n                 by (meson Suc_diff_Suc)\n               have \"map (lift c2) lc1 \\<noteq> []\"\n                 by (metis lc1_not_empty map_is_Nil_conv)\n               then have f2: \"0 < length (map (lift c2) lc1)\"\n                 by (meson length_greater_0_conv)\n               then have \"length (map (lift c2) lc1) - 1 + 1 < \n                            length (map (lift c2) lc1 @ (fst (last l), s1') # ys)\"\n                 by simp\n               then show ?thesis\n                 using f2 f1\n                 by (metis Suc_pred' cp cpn_lc1 cptn_tran_ce_i)\n             qed\n             then have step:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! (?lm_lc1-1)), toSeq (snd (l ! (?lm_lc1-1)))) \\<rightarrow> \n                             (fst (l ! ?lm_lc1), toSeq (snd (l ! (?lm_lc1)))))\"\n               using l_map last_m_lc1 lm_lc1 local.last_length not_eq_not_env True\n                      step_ce_not_step_e_step_c unfolding final_glob_def\n               by (metis LanguageCon.com.distinct(5) LanguageCon.com.distinct(79) \n                    LanguageCon.com.distinct(85) LanguageCon.com.distinct(87) fstI sndI) \n             have eq_to_seq:\"toSeq (snd (l ! (length (map (lift c2) lc1) - 1))) = \n                               toSeq (snd (l ! (length (map (lift c2) lc1))))\"\n               using l_map last_m_lc1 lm_lc1 local.last_length local.step \n               apply auto\n               by (metis (no_types) stepc_elim_cases_Seq_throw asm0)                             \n             then have step':\"\\<Gamma>\\<turnstile>\\<^sub>c (LanguageCon.com.Seq (fst (last lc1)) c2,  (fst s1')) \\<rightarrow>\n                             (fst (last lc1),  (fst s1')) \"\n               using lm_lc1 asm0 apply auto\n               by (smt One_nat_def append_is_Nil_conv cpn_lc1 diff_Suc_less fst_conv l_map \n                           last_conv_nth last_m_lc1 length_greater_0_conv \n                           length_map last_length local.step no_c2 stepc_elim_cases_Seq_throw(1,2,3) \n                            toSeq.simps)+               \n             then have snd_l_len:\"snd (l ! (length (map (lift c2) lc1) - 1)) =snd (l ! (length (map (lift c2) lc1)))\"              \n             proof -\n               have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! (length (map (lift c2) lc1) - 1)), snd (l ! (length (map (lift c2) lc1) - 1))) \\<rightarrow>\\<^sub>c\\<^sub>e (fst (l ! length (map (lift c2) lc1)), snd (l ! length (map (lift c2) lc1)))\"\n                 using step_ce by auto\n               then show ?thesis\n                 using eq_to_seq local.step step_ce_eq by blast\n             qed                             \n             then have last_lc1_suc:\"snd (l!(?lm_lc1-1)) = \n                        snd (l!?lm_lc1) \\<and> fst (l!(?lm_lc1-1)) = Seq (fst (last l)) c2\"\n               using  stepc_elim_cases_Seq_throw  asm0 cpn_lc1 l_map last_m_lc1 local.last_length no_c2\n               by (smt fst_conv lm_lc1 local.step step' stepc_elim_cases(1) stepc_elim_cases_Seq_skip(1))                                          \n             have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n                       (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                        (fst (l ! Suc i), toSeq (snd (l ! Suc i)))) \\<longrightarrow>                                           \n                 (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n             proof-\n             { fix k \n               assume a00:\"Suc k<length l\" and\n                a21:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                      (fst (l ! Suc k), toSeq (snd (l ! Suc k))))\"   \n                then have i_m_l:\"\\<forall>i <?lm_lc1  . l!i = ?m_lc1!i\" \n                  using cp_lc1\n                proof -\n                  have \"map (lift c2) lc1 \\<noteq> []\"\n                    by (meson lc1_not_empty list.map_disc_iff)\n                  then show ?thesis\n                    by (metis (no_types) cpn_lc1  nth_append)\n                qed \n                have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n                proof (cases \"Suc k< ?lm_lc1\")\n                  case True \n                  then have a11': \"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (?m_lc1 ! k), toSeq (snd (?m_lc1!k))) \\<rightarrow> \n                                        (fst (?m_lc1!(Suc k)), toSeq (snd (?m_lc1!(Suc k)))))\" \n                    using a11 i_m_l True\n                  proof -\n                    have \"\\<forall>n na. \\<not> 0 < n - Suc na \\<or> na < n \"\n                      using diff_Suc_eq_diff_pred zero_less_diff by presburger\n                    then show ?thesis\n                      by (metis (no_types)  True a21 i_m_l  zero_less_diff)\n                  qed                  \n                  then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\<in> G\"\n                  using a11' m_lc1_comm True comm_dest1  last_not_F by fastforce\n                  thus ?thesis using i_m_l using  True by fastforce\n                next\n                  case False \n                  then have \"(Suc k=?lm_lc1) \\<or> (Suc k>?lm_lc1)\" by auto\n                  thus ?thesis \n                  proof\n                  { assume suck:\"(Suc k=?lm_lc1)\"\n                    then have k:\"k=?lm_lc1-1\" by auto      \n                    then have \"length (snd (snd ((l ! k)))) \\<in> N p\"\n                      using cptn_all_len_eq_0 unfolding N_def\n                      using a00 assum cp by fastforce \n                    then have G_s1':\"( s1',  s1')\\<in>G\" using a5\n                      using k lm_lc1 snd_l_len by fastforce\n                    then show \"(snd (l!k), snd (l!Suc k)) \\<in> G\"               \n                      proof -\n                        have \"snd (l!Suc k) =  s1'\" \n                          using lm_lc1 suck by fastforce                                \n                        then show ?thesis using suck k G_s1'\n                          using snd_l_len by auto \n                           \n                      qed\n                    }\n                  next\n                  { \n                    assume a001:\"Suc k>?lm_lc1\"\n                    have \"\\<forall>i. i\\<ge>(length lc1) \\<and> (Suc i < length l) \\<longrightarrow> \n                            \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                              (fst (l ! Suc i), toSeq (snd (l ! Suc i))))\"\n                    using lm_lc1 lc1_not_empty\n                    proof -\n                      have \"env_tran_right \\<Gamma> l R\"\n                        by (metis  env_tran_right)\n                      then show ?thesis\n                        by (metis a00 a001 a21 asm0 cp fst_conv less_Suc_eq_le lm_lc1 \n                              only_one_component_tran_j)\n                    qed\n                    then have \"\\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                                (fst (l ! Suc k), toSeq (snd (l ! Suc k))))\"\n                      using a00 a001  by auto                    \n                    then show ?thesis using a21 by fastforce                    \n                  }\n                  qed \n                qed\n              } thus ?thesis by auto \n             qed \n             have concr:\"(final_glob (last l)  \\<longrightarrow>  fst (last l) \\<notin> Fault ` F \\<longrightarrow>                       \n                   ((fst (last l) = Skip \\<and> snd (last l) \\<in>  r)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  a))\" \n             proof -\n             { assume a00:\"final_glob (last l)\" and a01:\"fst (last l) \\<notin> Fault ` F\"\n               have \"?lm_lc1 \\<le> length l -1\" using cpn_lc1\n                 by (metis (no_types, lifting) One_nat_def Suc_diff_Suc add_diff_cancel_left' \n                   append_is_Nil_conv diff_zero length_append length_greater_0_conv less_Suc_eq_le\n                   list.simps(3) zero_less_diff) \n                have last_lc1:\"snd (last lc1) =  s1'\" \n                 using last_length l_map lm_lc1 last_m_lc1 last_lc1_suc asm0\n                 by (metis snd_conv)  \n               have \"final_glob (last lc1)\" \n                 using l_map last_lc1 asm0 last_lc1_suc last_m_lc1 local.last_length\n                 unfolding final_glob_def                 \n                 by auto                 \n               moreover have \"fst (last lc1) \\<notin> Fault ` F\" \n                  using last_lc1\n                  using a01 l_map last_lc1_suc last_m_lc1 local.last_length by auto\n               ultimately have h:\"fst (last lc1) = Skip \\<and> snd (last lc1) \\<in> q \\<or>\n                                 fst (last lc1) = Throw \\<and> snd (last lc1) \\<in> a\" \n                 using lc1_comm  unfolding comm_def by force\n               { assume \"fst (last l) = com.Stuck \\<or> (\\<exists>f. fst (last l) = com.Fault f)\"\n                 then have ?thesis using h\n                   using l_map last_lc1_suc last_m_lc1 local.last_length by auto                   \n               }\n               moreover { \n                 assume a00:\"fst (last l) = Throw\"               \n                 have \"?lm_lc1 \\<le> length l -1\" using cpn_lc1\n                   by (metis (no_types, lifting) One_nat_def Suc_diff_Suc add_diff_cancel_left' \n                   append_is_Nil_conv diff_zero length_append length_greater_0_conv less_Suc_eq_le\n                   list.simps(3) zero_less_diff) \n                 have a_normal:\"snd (l!?lm_lc1) \\<in> a\" using h\n                   using a00 l_map last_lc1_suc last_m_lc1 local.last_length by auto                 \n                 then have \"snd (l ! (length l - 1)) \\<in>  a\"\n                   using  cp  a4  fst_conv  lm_lc1 snd_conv \n                         env_tran_right a00    cp a_normal a4  fst_conv  lm_lc1 snd_conv \n                         env_tran_right i_throw_all_throw[of  \\<Gamma> l ?lm_lc1 s1' \"(length l -1)\" R a ]\n                   using cpn_lc1 by auto                               \n                 then have ?thesis\n                   by (metis a00 append_is_Nil_conv cpn_lc1 last_conv_nth list.distinct(1))\n               }\n               ultimately have ?thesis using asm0 by auto \n             } thus ?thesis by auto\n             qed\n             note res = conjI [OF concl concr]\n             then show ?thesis using  \\<Gamma>1 c_prod unfolding comm_def by auto\n           qed                  \n         next\n           case False\n           then obtain lc1 where cpn_lc1:\"(\\<Gamma>,lc1) \\<in> cpn n \\<Gamma> c1 s \\<and> l = map (lift c2) lc1\" \n             using Seq_sound1 assum False no_c2 env_tran_right cptn_nest cptn_eq_cptn_mod_set a4 a1 \n             by blast          \n           then have cp_lc1:\"(\\<Gamma>,lc1) \\<in> cp \\<Gamma> c1 s \"\n             using  cptn_if_cptn_mod cptn_mod_nest_cptn_mod cptn_eq_cptn_mod_nest\n             unfolding cp_def cpn_def  by blast                          \n           then have \"((\\<Gamma>,lc1) \\<in> assum(p, R))\"  \n              using \\<Gamma>1  cpn_lc1 a10' a11 assum_map by blast\n           then have \"(\\<Gamma>, lc1)\\<in> comm(G, (q,a)) F\" using cpn_lc1 a1\n             by (meson IntI com_validityn_def contra_subsetD)\n           then have \"(\\<Gamma>, l)\\<in> comm(G, (r,a)) F\"\n             using comm_map a10' \\<Gamma>1 cp_lc1 cpn_lc1 by blast\n           then show ?thesis  \n             unfolding comm_def by auto\n         qed\n       next         \n         case False \n         then obtain k where k_len:\"k<length l \\<and> fst (l ! k) = c2\"\n           by blast         \n         then have \"\\<exists>m. (m < length l \\<and> fst (l ! m) = c2) \\<and>\n                   (\\<forall>i<m. \\<not> (i < length l \\<and> fst (l ! i) = c2))\"   \n           using a0 exists_first_occ[of \"(\\<lambda>i. i<length l  \\<and> fst (l ! i) = c2)\" k] \n           by blast\n         then obtain i where a0:\"i<length l \\<and> fst (l !i) = c2 \\<and>\n                                (\\<forall>j<i. (fst (l ! j) \\<noteq> c2))\"\n           by fastforce        \n         then obtain s2 where li:\"l!i =(c2,s2)\" by (meson eq_fst_iff)\n         then obtain lc1 lc2 where cp_lc1:\"(\\<Gamma>,lc1) \\<in> (cpn n \\<Gamma> c1 s) \\<and> \n                                 (\\<Gamma>,lc2) \\<in> (cpn n \\<Gamma> c2 (snd (lc1!(i-1)))) \\<and> \n                                 l = (map (lift c2) lc1)@lc2\"\n           using Seq_sound4[of n \\<Gamma> l c1 c2 s] a0 env_tran_right a4 a1 cptn_nest assum by blast  \n         then have cp_lc1':\"(\\<Gamma>,lc1) \\<in> (cp  \\<Gamma> c1 s) \\<and> \n                    (\\<Gamma>,lc2) \\<in> (cp  \\<Gamma> c2 (snd (lc1!(i-1))))\"\n           unfolding cp_def cpn_def cptn_eq_cptn_mod_nest by fastforce\n         (* have \"\\<forall>i < length l. fst (l!i) \\<notin> Fault ` F\"\n           using cp  last_not_F[of \\<Gamma> l F] sorry by auto  \n         then have i_not_fault:\"fst (l!i) \\<notin> Fault ` F\" using a0 by blast *)\n         have length_c1_map:\"length lc1 = length (map (lift c2) lc1)\" \n           by fastforce      \n         then have i_map:\"i=length lc1\" \n           using cp_lc1 li a0 unfolding lift_def\n         proof -\n           assume a1: \"(\\<Gamma>, lc1) \\<in> cpn n \\<Gamma> c1 s \\<and> (\\<Gamma>, lc2) \\<in> cpn n \\<Gamma> c2 (snd (lc1 ! (i - 1))) \\<and> \n                        l = map (\\<lambda>(P, s). (LanguageCon.com.Seq P c2, s)) lc1 @ lc2\"\n            have f2: \"i < length l \\<and> fst (l ! i) = c2 \\<and> (\\<forall>n. \\<not> n < i \\<or> fst (l ! n) \\<noteq> c2)\"\n              using a0 by blast\n            have f3: \"(LanguageCon.com.Seq (fst (lc1 ! i)) c2, snd (lc1 ! i)) = lift c2 (lc1 ! i)\"\n              by (simp add: case_prod_unfold lift_def)            \n            then have \"fst (l ! length lc1) = c2\"\n              using a1 by (simp add: cpn_def nth_append)\n            thus ?thesis\n              using f3 f2 by (metis (no_types) nth_append cp_lc1 \n                 fst_conv length_map lift_nth linorder_neqE_nat seq_and_if_not_eq(4))\n         qed                  \n         have lc2_l:\"\\<forall>j<length lc2. lc2!j=l!(i+j)\"\n           using cp_lc1 length_c1_map i_map a0\n           by (metis nth_append_length_plus)                                                             \n         have lc1_not_empty:\"lc1 \\<noteq> []\"\n           using cp cp_lc1 unfolding cpn_def by fastforce      \n         have lc2_not_empty:\"lc2 \\<noteq> []\"\n           using a0 cp_lc1 i_map by auto                      \n         have l_is:\"s2= snd (last lc1)\"\n         using cp_lc1 li a0 lc1_not_empty i_map unfolding cpn_def\n         by (auto simp add: last_conv_nth lc2_l)       \n         let ?m_lc1 = \"map (lift c2) lc1\"\n         (* let ?lm_lc1 = \"(length ?m_lc1)\"\n         let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\" *)                         \n         have last_m_lc1:\"l!(i-1) = (Seq (fst (last lc1)) c2,s2)\"\n         proof -\n           have a000:\"\\<forall>p c. (LanguageCon.com.Seq (fst p) c, snd p) = lift c p\"\n             using Cons_lift by force\n           have \"length (map (lift c2) lc1) = i\"\n               using i_map by fastforce\n           then show ?thesis\n             by (metis (no_types) One_nat_def l_is a000 cp_lc1 diff_less last_conv_nth last_map \n            lc1_not_empty length_c1_map length_greater_0_conv less_Suc0 nth_append)                       \n         qed  \n         (* have last_mcl1_not_F:\"fst (last ?m_lc1) \\<notin> Fault ` F\"                 \n         proof -\n          have \"map (lift c2) lc1 \\<noteq> []\"\n            by (metis lc1_not_empty list.map_disc_iff)\n          then show ?thesis sorry\n            by (metis (full_types) One_nat_def  l_is last_conv_nth last_snd lc1_not_empty li snd_conv)\n         qed *)        \n         have map_cp:\"(\\<Gamma>,?m_lc1) \\<in> cpn n \\<Gamma> (Seq c1 c2) s\"               \n         proof -\n           have f1: \"lc1 ! 0 = (c1, s) \\<and> (n,\\<Gamma>, lc1) \\<in> cptn_mod_nest_call \\<and> \\<Gamma> = \\<Gamma>\"\n             using cp_lc1 cpn_def by blast\n           then have f2: \"(n,\\<Gamma>, ?m_lc1) \\<in> cptn_mod_nest_call\" using lc1_not_empty\n             by (metis Cons_lift SmallStepCon.nth_tl cptn_mod_nest_call.CptnModNestSeq1)\n           then show ?thesis\n             using f2 f1 lc1_not_empty by (simp add: cpn_def lift_def)\n         qed\n         then have map_cp':\"(\\<Gamma>,?m_lc1) \\<in> cp \\<Gamma> (Seq c1 c2) s\"\n           unfolding cpn_def cp_def\n           using cptn_eq_cptn_mod_nest by fastforce\n         also have map_assum:\"(\\<Gamma>,?m_lc1) \\<in> assum (p,R)\" \n           using sub_assum a10 a11 \\<Gamma>1 cp_lc1 lc1_not_empty \n           by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n         ultimately have \"((\\<Gamma>,lc1) \\<in> assum(p, R))\"  \n           using \\<Gamma>1 assum_map using assum_map cp_lc1' by blast                          \n         then have lc1_comm:\"(\\<Gamma>,lc1) \\<in> comm(G, (q,a)) F\"  \n           using a1 cp_lc1 by (meson IntI com_validityn_def contra_subsetD)\n         then have m_lc1_comm:\"(\\<Gamma>,?m_lc1) \\<in> comm(G, (q,a)) F\"\n           using map_cp' map_assum comm_map cp_lc1' by fastforce         \n         then have i_step:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! (i-1)), toSeq (snd (l ! (i-1)))) \\<rightarrow> \n                           (fst (l ! i), toSeq (snd (l ! i))))\"\n         proof -\n           have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!(i-1)) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(i))\"\n           proof -\n             have f1: \"\\<forall>n na. \\<not> n < na \\<or> Suc (na - Suc n) = na - n\"\n               by (meson Suc_diff_Suc)\n             have \"map (lift c2) lc1 \\<noteq> []\"\n               by (metis lc1_not_empty map_is_Nil_conv)\n             then have f2: \"0 < length (map (lift c2) lc1)\"\n               by (meson length_greater_0_conv)             \n             then have \"length (map (lift c2) lc1) - 1 + 1 < length (map (lift c2) lc1 @ lc2)\"\n               using f2 lc2_not_empty by simp\n             then show ?thesis\n             using f2 f1\n              proof -\n                have \"0 < i\"\n                  using f2 i_map by blast\n                then show ?thesis\n                  by (metis (no_types) One_nat_def Suc_diff_1 a0 add.right_neutral add_Suc_right cp cptn_tran_ce_i)\n              qed \n           qed \n           moreover have \"\\<not>\\<Gamma>\\<turnstile>\\<^sub>c(l!(i-1)) \\<rightarrow>\\<^sub>e (l!i)\"           \n             using li last_m_lc1\n             by (metis (no_types, lifting) env_c_c' seq_and_if_not_eq(4))\n           ultimately show ?thesis using step_ce_dest\n             by (metis prod.exhaust_sel)\n         qed         \n         then have step:\"\\<Gamma>\\<turnstile>\\<^sub>c(Seq (fst (last lc1)) c2,toSeq s2) \\<rightarrow> (c2, toSeq s2)\"\n           using last_m_lc1  li by fastforce\n         then have\n           last_lc1:\"fst (last lc1) = Skip \\<or> \n            fst (last lc1) = Throw \\<or> fst (last lc1) = Stuck \\<or> (\\<exists>f. fst(last lc1) = Fault f)\" \n           using seq_skip_throw \n           by (simp add: seq_skip_throw)    \n         have final:\"final_glob (last lc1)\" \n           using last_lc1 l_is unfolding final_glob_def by fastforce\n         have Gs2':\"(s2, s2)\\<in>G\" using a5 unfolding N_def\n           by (metis (mono_tags, lifting) a0 assum cp cptn_all_len_eq_0 li mem_Collect_eq snd_conv)                     \n         have concl:\n           \"(\\<forall>i. Suc i<length l \\<longrightarrow> \n             (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                  (fst (l ! Suc i), toSeq (snd (l ! Suc i)))) \\<longrightarrow>                                    \n             (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n         proof-\n         { fix k \n           assume a00:\"Suc k<length l\" and\n            a21:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                    (fst (l ! Suc k), toSeq (snd (l ! Suc k)))\" \n            have i_m_l:\"\\<forall>j <i . l!j = ?m_lc1!j\"             \n            proof -\n              have \"map (lift c2) lc1 \\<noteq> []\"\n                by (meson lc1_not_empty list.map_disc_iff)\n              then show ?thesis \n                using cp_lc1 i_map length_c1_map by (fastforce simp:nth_append)              \n            qed \n            have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n            proof (cases \"Suc k< i\")\n              case True \n              then have a11': \"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (?m_lc1 ! k), toSeq (snd (?m_lc1 ! k))) \\<rightarrow> \n                                    (fst (?m_lc1 ! Suc k), toSeq (snd (?m_lc1 ! Suc k))))\" \n                using a11 i_m_l True\n              proof -\n                have \"\\<forall>n na. \\<not> 0 < n - Suc na \\<or> na < n \"\n                  using diff_Suc_eq_diff_pred zero_less_diff by presburger\n                then show ?thesis using True a21 i_m_l by force                  \n              qed                                                             \n              have \"Suc k < length ?m_lc1\" using True i_map length_c1_map by metis\n              then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\<in> G\"              \n                using a11' comm_dest1 m_lc1_comm by blast                \n              thus ?thesis using i_m_l using True by fastforce \n            next\n              case False                                            \n              have \"(Suc k=i) \\<or> (Suc k>i)\" using False by auto\n              thus ?thesis \n              proof\n              { assume suck:\"(Suc k=i)\" \n                then have k:\"k=i-1\" by auto                                                            \n                then show \"(snd (l!k), snd (l!Suc k)) \\<in> G\"\n                  using Gs2' last_m_lc1 li suck by auto\n              }\n              next\n              { \n                assume a001:\"Suc k>i\"\n                then have k:\"k\\<ge>i\" by fastforce\n                then obtain k' where k':\"k=i+k'\" \n                  using add.commute le_Suc_ex by blast               \n                {assume throw:\"c2=Throw \\<or> c2 = Stuck \\<or> (\\<exists>f. c2 = Fault f)\"\n                                 \n                  have \"\\<forall>k. k\\<ge>i \\<and> (Suc k < length l) \\<longrightarrow> \n                            \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                                  (fst (l ! Suc k), toSeq (snd (l ! Suc k))))\"\n                    using li  a21 a001 a00 a4\n                        a0 throw  only_one_component_tran_j snd_conv\n                    using cp by blast                           \n                  then have ?thesis using a21 a001 k a00 by blast                                  \n                }  note left=this\n                {assume \"\\<not>(c2=Throw \\<or> c2 = Stuck \\<or> (\\<exists>f. c2 = Fault f))\"\n                 then have skip:\"fst (last lc1) = Skip\"\n                   using last_m_lc1 last_lc1 step a0 l_is li\n                   by (meson stepc_elim_cases_Seq_skip_c2)       \n                 then have s2_normal:\"s2 \\<in>  q\" \n                   using l_is li final comm_dest2 lc1_comm by fastforce\n                 have length_lc2:\"length l=i+length lc2\" \n                       using i_map cp_lc1 by fastforce\n                 have \"(\\<Gamma>,lc2) \\<in>  assum (q,R)\" \n                 proof -\n                   have left:\"snd (lc2!0) \\<in>  q\" \n                     using li lc2_l s2_normal lc2_not_empty by fastforce \n                   {\n                     fix j\n                     assume j_len:\"Suc j<length lc2\" and\n                            j_step:\"\\<Gamma>\\<turnstile>\\<^sub>c(lc2!j)  \\<rightarrow>\\<^sub>e (lc2!(Suc j))\"\n                     \n                     then have suc_len:\"Suc (i + j)<length l\" using j_len length_lc2\n                       by fastforce\n                     also then have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!(i+j))  \\<rightarrow>\\<^sub>e (l! (Suc (i+ j)))\"\n                        using lc2_l j_step j_len by fastforce\n                     ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\<in> R\"\n                        using assum suc_len lc2_l j_len cp by fastforce \n                   }\n                   then show ?thesis using left \n                     unfolding assum_def by fastforce\n                 qed\n                 also have \"(\\<Gamma>,lc2) \\<in> cpn n \\<Gamma> c2 s2\"\n                   using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce                 \n                 ultimately have comm_lc2:\"(\\<Gamma>,lc2) \\<in>  comm (G, (r,a)) F\"\n                   using a3 unfolding com_validityn_def by blast\n                 (* have lc2_last_f:\"fst (last lc2)\\<notin> Fault ` F\" \n                   using lc2_l lc2_not_empty l_f cp_lc1 by fastforce *)\n                 have suck':\"Suc k' < length lc2\" \n                   using k' a00 length_lc2 by arith\n                 moreover then have \"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (lc2 ! k'), toSeq (snd (lc2 ! k'))) \\<rightarrow> \n                                          (fst (lc2 ! Suc k'), toSeq (snd (lc2 ! Suc k'))))\"   \n                   using k' lc2_l a21 by fastforce\n                 ultimately have \"(snd (lc2! k'), snd (lc2 ! Suc k')) \\<in> G\"\n                   using comm_lc2  comm_dest1[of \\<Gamma> lc2 G r a F k'] \n                   by blast\n                 then have ?thesis using suck' lc2_l k' by fastforce\n                }                    \n                then show ?thesis using left by auto                 \n              }\n              qed \n            qed\n          } thus ?thesis by auto \n         qed note left=this\n         have right:\"final_glob (last l)  \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>\n                    (fst (last l) = Skip \\<and> snd (last l) \\<in> r) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> a)\"\n         proof -\n         { assume final_l:\"final_glob (last l)\" and a002:\"fst (last l) \\<notin> Fault ` F\"\n           have eq_last_lc2_l:\"last l=last lc2\" by (simp add: cp_lc1 lc2_not_empty)\n           then have final_lc2:\"final_glob (last lc2)\" using final_l by auto\n           {\n             assume lst_lc1_throw:\"fst (last lc1) = Throw\"                        \n             then have c2_throw:\"c2 = Throw\" \n               using lst_lc1_throw step  stepc_elim_cases_Seq_skip_c2\n               by fastforce                                                                  \n             have s2_a:\"s2 \\<in> (a)\" using lst_lc1_throw lc1_comm unfolding comm_def split_beta\n               using final l_is by auto\n             have all_ev:\"\\<forall>k<length l - 1. k\\<ge>i \\<and> (Suc k < length l) \\<longrightarrow> \n                            \\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))\"\n             proof -\n                have \"\\<forall>k. k\\<ge>i \\<and> (Suc k < length l) \\<longrightarrow> \n                            \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                                  (fst (l ! Suc k), toSeq (snd (l ! Suc k))))\"\n                 using s2_a li   a4 a0 c2_throw  only_one_component_tran_j  \n                 by (metis  cp)  \n               thus ?thesis using Suc_eq_plus1 cp cptn_tran_ce_i step_ce_dest\n                 by (metis prod.exhaust_sel)      \n             qed    \n             then have Throw:\"fst (l!(length l - 1)) = Throw\"\n             using cp c2_throw a0 cptn_i_env_same_prog[of \\<Gamma> l \"((length l)-1)\" i] \n               by fastforce                            \n             then have \"snd (l!(length l - 1)) \\<in> a \\<and> fst (l!(length l - 1)) = Throw\"\n               using  all_ev a0 s2_a li a4 env_tran_right stability[of a R l i \"(length l) -1\" _ \\<Gamma>] Throw\n               using c2_throw by fastforce                            \n             then have \"((fst (last l) = Skip \\<and> snd (last l) \\<in> r)) \\<or> \n                       (fst (last l) = Throw \\<and> snd (last l) \\<in> a)\" \n              using a0 by (metis last_conv_nth list.size(3) not_less0)                           \n           } \n           moreover {  \n             assume \"fst (last lc1) = Skip\"                 \n             then have s2_normal:\"s2 \\<in>  q\"  \n               using lc1_comm unfolding comm_def split_beta\n               using final l_is by auto\n             have length_lc2:\"length l=i+length lc2\" \n               using i_map cp_lc1 by fastforce\n             have \"(\\<Gamma>,lc2) \\<in>  assum (q,R)\" \n             proof -\n               have left:\"snd (lc2!0) \\<in>  q\" \n                  using li lc2_l s2_normal lc2_not_empty by fastforce               \n               {\n                 fix j\n                 assume j_len:\"Suc j<length lc2\" and\n                      j_step:\"\\<Gamma>\\<turnstile>\\<^sub>c(lc2!j)  \\<rightarrow>\\<^sub>e (lc2!(Suc j))\"                 \n                 then have suc_len:\"Suc (i + j)<length l\" using j_len length_lc2\n                   by fastforce\n                 also then have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!(i+j))  \\<rightarrow>\\<^sub>e (l! (Suc (i+ j)))\"\n                   using lc2_l j_step j_len by fastforce\n                 ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\<in> R\"\n                   using assum suc_len lc2_l j_len cp by fastforce \n               }\n               then show ?thesis using left \n                 unfolding assum_def by fastforce\n            qed\n            also have \"(\\<Gamma>,lc2) \\<in> cpn n \\<Gamma> c2 s2\"\n              using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce\n            ultimately have comm_lc2:\"(\\<Gamma>,lc2) \\<in>  comm (G, (r,a)) F\"\n              using a3 unfolding com_validityn_def split_beta by blast              \n            have lc2_last_f:\"fst (last lc2)\\<notin> Fault ` F\" \n              using lc2_l lc2_not_empty cp_lc1\n              using a002 by auto             \n            then have \"((fst (last lc2) = Skip \\<and> snd (last lc2) \\<in>  r)) \\<or>\n                    (fst (last lc2) = Throw \\<and> snd (last lc2) \\<in> a)\" \n              using final_lc2 comm_lc2 unfolding comm_def by auto\n            then have \"((fst (last l) = Skip \\<and> snd (last l) \\<in> r)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> a)\" \n              using eq_last_lc2_l by auto\n           }\n           moreover{\n             assume \"fst (last lc1) = Stuck\"             \n             then have  \"((fst (last l) = Skip \\<and> snd (last l) \\<in> r)) \\<or>\n                       (fst (last l) = Throw \\<and> snd (last l) \\<in>  a)\"\n               by (metis (no_types) com.distinct(13) com.distinct(145) \n                   com.distinct(147) comm_des3 final image_iff lc1_comm)            \n           }\n           moreover { \n             assume \"(\\<exists>f. fst (last lc1) = Fault f)\"\n             then have  \"((fst (last l) = Skip \\<and> snd (last l) \\<in> r)) \\<or>\n                       (fst (last l) = Throw \\<and> snd (last l) \\<in>  a)\"\n               by (metis LanguageCon.com.distinct(171) LanguageCon.com.distinct(19) a002 \n                    comm_dest2 cp final k_len last_not_F lc1_comm step stepc_elim_cases_Seq_skip_c2)              \n           }\n           ultimately have \"((fst (last l) = Skip \\<and> snd (last l) \\<in> r)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  a)\" \n             using last_lc1 by blast\n         } \n         thus ?thesis by auto qed              \n      thus ?thesis using left  \\<Gamma>1 unfolding comm_def by force\n      qed\n    } thus ?thesis using \\<Gamma>1 unfolding comm_def by auto qed\n  } thus ?thesis by auto qed \n} thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\nlemma Catch_env_P:assumes \n  a0:\"\\<Gamma>\\<turnstile>\\<^sub>c(Catch P Q,s) \\<rightarrow>\\<^sub>e (Catch P Q,t)\"\n      shows \"\\<Gamma>\\<turnstile>\\<^sub>c(P,s) \\<rightarrow>\\<^sub>e (P,t)\"\n  using a0 \n  by (metis env_intro_diff_p) \n\nlemma map_catch_eq_state:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Catch c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \" and\n  a2:\"l1=map (lift_catch c2) l2\"\nshows\n  \"\\<forall>i<length l1. snd (l1!i) = snd (l2!i)\"\nusing a0 a1 a2 unfolding cp_def\nby (simp add: snd_lift_catch) \n\nlemma map_eq_catch_c:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Catch c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \" and\n  a2:\"l1=map (lift_catch c2) l2\"\nshows\n  \"\\<forall>i<length l1. fst (l1!i) = Catch (fst (l2!i)) c2\"\nproof -\n  {fix i\n  assume a3:\"i<length l1\"\n  have \"fst (l1!i) = Catch (fst (l2!i)) c2\"\n  using a0 a1 a2 a3 unfolding lift_catch_def\n    by (simp add: case_prod_unfold) \n  }thus ?thesis by auto\nqed \n\nlemma same_env_catch_c:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Catch c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \" and\n  a2:\"l1=map (lift_catch c2) l2\"\nshows\n\"\\<forall>i. Suc i<length l2 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l2!i)  \\<rightarrow>\\<^sub>e (l2!(Suc i)) = \n            \\<Gamma>\\<turnstile>\\<^sub>c(l1!i)  \\<rightarrow>\\<^sub>e (l1!(Suc i))\" \nproof -\n  have a0a:\"(\\<Gamma>,l1) \\<in>cptn \\<and> l1!0 = ((Catch c1 c2),s)\" \n    using a0 unfolding cp_def by blast\n  have a1a: \"(\\<Gamma>,l2) \\<in>cptn \\<and> l2!0 = (c1,s)\"\n    using a1 unfolding cp_def by blast\n  {\n    fix i\n    assume a3:\"Suc i< length l2\"\n    have \"\\<Gamma>\\<turnstile>\\<^sub>c(l2!i)  \\<rightarrow>\\<^sub>e (l2!(Suc i)) = \n            \\<Gamma>\\<turnstile>\\<^sub>c(l1!i)  \\<rightarrow>\\<^sub>e (l1!(Suc i))\"\n    proof\n    {\n      assume a4:\"\\<Gamma>\\<turnstile>\\<^sub>c l2 ! i \\<rightarrow>\\<^sub>e l2 ! Suc i\"\n      obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\<and> l1!Suc i = (c1si,s1si)\"\n        using prod.exhaust_sel by blast\n      obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\<and> l2!Suc i = (c2si,s2si)\"\n        by (meson prod.exhaust_sel)\n      then have \"c1i = (Catch c2i c2) \\<and> c1si = (Catch c2si c2)\"\n        using  a0 a1 a2 a3 a4  l1prod \n        by (simp add: lift_catch_def)         \n      also have \"s2i=s1i \\<and> s2si=s1si\"\n        using  a0 a1 a4  a2 a3 l2prod  l1prod\n        by (simp add: lift_catch_def)         \n      ultimately show \"\\<Gamma>\\<turnstile>\\<^sub>c l1 ! i \\<rightarrow>\\<^sub>e (l1 ! Suc i)\" \n        using a4 l1prod l2prod\n        by (metis env_c_c' env_intro_diff_p)\n    } \n    {\n      assume a4:\"\\<Gamma>\\<turnstile>\\<^sub>c l1 ! i \\<rightarrow>\\<^sub>e l1 ! Suc i\"\n      obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\<and> l1!Suc i = (c1si,s1si)\"\n        using prod.exhaust_sel by blast\n      obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\<and> l2!Suc i = (c2si,s2si)\"\n        by (meson prod.exhaust_sel)\n      then have \"c1i = (Catch c2i c2) \\<and> c1si = (Catch c2si c2)\"\n        using  a0 a1 a2 a3 a4  l1prod\n        by (simp add: lift_catch_def)\n      also have \"s2i=s1i \\<and> s2si=s1si\"\n        using  a0 a1 a4  a2 a3 l2prod l1prod\n        by (simp add: lift_catch_def)      \n      ultimately show \"\\<Gamma>\\<turnstile>\\<^sub>c l2 ! i \\<rightarrow>\\<^sub>e (l2 ! Suc i)\" \n        using a4 l1prod l2prod   env_intro\n        by (metis LanguageCon.com.inject(10) env_c_c' env_intro_diff_p)\n    }\n    qed\n   } \n  thus ?thesis by auto\nqed\n\n\nlemma same_comp_catch_c:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Catch c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \" and\n  a2:\"l1=map (lift_catch c2) l2\"\nshows\n\"\\<forall>i. Suc i<length l2 \\<longrightarrow> \n        \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n            (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i)))  = \n      \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n            (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i)))\" \nproof -\n  have a0a:\"(\\<Gamma>,l1) \\<in>cptn \\<and> l1!0 = ((Catch c1 c2),s)\" \n    using a0 unfolding cp_def by blast\n  have a1a: \"(\\<Gamma>,l2) \\<in>cptn \\<and> l2!0 = (c1,s)\"\n    using a1 unfolding cp_def by blast\n  {\n    fix i\n    assume a3:\"Suc i< length l2\"\n    have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n            (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i))) =\n       \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n            (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i)))\"\n    proof\n    {\n      assume a4:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i)))\"\n      obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\<and> l1!Suc i = (c1si,s1si)\"\n        by (meson prod.exhaust_sel)\n      obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\<and> l2!Suc i = (c2si,s2si)\"\n        using prod.exhaust_sel by blast\n      then have \"c1i = (Catch c2i c2) \\<and> c1si = (Catch c2si c2)\"\n        using  a0 a1 a2 a3 a4  map_eq_catch_c l1prod\n        by (simp add: lift_catch_def)\n      also have \"s2i=s1i \\<and> s2si=s1si\"\n        using  a0 a1 a4  a2 a3 l2prod map_eq_state l1prod\n        by (simp add: lift_catch_def)          \n      ultimately show \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n            (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i)))\"\n        using a4 l1prod l2prod\n        by (simp add: Catchc)        \n    } \n    {\n      assume a4:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n            (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i)))\"\n      obtain c1i s1i c1si s1si where l1prod:\"l1 ! i=(c1i,s1i) \\<and> l1!Suc i = (c1si,s1si)\"\n        using prod.exhaust_sel by blast\n      obtain c2i s2i c2si s2si where l2prod:\"l2 ! i=(c2i,s2i) \\<and> l2!Suc i = (c2si,s2si)\"\n        by (meson prod.exhaust_sel)\n      then have \"c1i = (Catch c2i c2) \\<and> c1si = (Catch c2si c2)\"\n        using  a0 a1 a2 a3 a4  l1prod\n       by (simp add: lift_catch_def)          \n      also have \"s2i=s1i \\<and> s2si=s1si\"\n        using  a0 a1 a4  a2 a3 l2prod  l1prod\n        by (simp add: lift_catch_def)          \n      ultimately show \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i)))\"\n        using a4 l1prod l2prod stepc_elim_cases_Catch_Catch \n        by auto\n    }\n    qed\n   } \n  thus ?thesis by auto\nqed\n\nlemma assum_map_catch:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Catch c1 c2) s) \\<and> ((\\<Gamma>,l1) \\<in> assum(p, R))\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \" and\n  a2:\"l1=map (lift_catch c2) l2\"  \nshows\n  \"((\\<Gamma>,l2) \\<in> assum(p, R))\"\nproof -\n  have a3: \"\\<forall>i. Suc i<length l2 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c(l2!i)  \\<rightarrow>\\<^sub>e (l2!(Suc i)) = \n            \\<Gamma>\\<turnstile>\\<^sub>c(l1!i)  \\<rightarrow>\\<^sub>e (l1!(Suc i))\" \n    using a0 a1 a2 same_env_catch_c by fastforce\n  have pair_\\<Gamma>l1:\"fst (\\<Gamma>,l1) = \\<Gamma> \\<and> snd (\\<Gamma>,l1) = l1\" by fastforce\n  have pair_\\<Gamma>l2:\"fst (\\<Gamma>,l2) = \\<Gamma> \\<and> snd (\\<Gamma>,l2) = l2\" by fastforce\n  have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n  have eq_length:\"length l1 = length l2\" using a2 by auto\n  then have p1:\"s\\<in>p\" using a0 unfolding cp_def assum_def by fastforce  \n  show ?thesis \n  proof -    \n    let ?c= \"(\\<Gamma>,l2)\"\n    have l:\"snd((snd ?c!0)) \\<in> p\"     \n      using p1 drop_k_s a1  unfolding cp_def by auto\n    { fix i\n      assume a00:\"Suc i<length (snd ?c)\" \n      assume a11:\"(fst ?c)\\<turnstile>\\<^sub>c((snd ?c)!i)  \\<rightarrow>\\<^sub>e ((snd ?c)!(Suc i))\"\n      have \"(snd((snd ?c)!i), snd((snd ?c)!(Suc i))) \\<in> R\"\n        using a0 a1 a2 a3 map_catch_eq_state unfolding assum_def split_beta\n        using a00 a11 eq_length\n        by (auto simp add: snd_lift_catch)\n    } thus \"(\\<Gamma>, l2) \\<in> assum (p, R)\" \n      using l unfolding assum_def by fastforce  \n  qed  \nqed\n\nlemma comm_map'_catch:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Catch c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \\<and> (\\<Gamma>, l2)\\<in> comm(G, (q,a)) F\" and\n  a2:\"l1=map (lift_catch c2) l2\" \nshows\n  \"(Suc k < length l1 \\<longrightarrow>\n        \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! k), toSeq (snd (l1 ! k))) \\<rightarrow> \n                (fst (l1 ! Suc k), toSeq (snd (l1 ! Suc k))) \\<longrightarrow>        \n       (snd(l1!k), snd(l1!(Suc k))) \\<in> G) \\<and> \n   (fst (last l1) = (Catch c c2) \\<and> final_glob (c, snd (last l1)) \\<longrightarrow> c \\<notin> Fault ` F  \\<longrightarrow>   \n      (fst (last l1) = (Catch Skip c2) \\<and> \n        (snd (last  l1) \\<in>  q) \\<or>\n      (fst (last l1) = (Catch Throw c2) \\<and> \n        snd (last l1) \\<in> a)))\n     \"\nproof -\n  have a3:\"\\<forall>i. Suc i<length l2 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i))) = \n            \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n                (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i)))\" \n    using a0 a1 a2 same_comp_catch_c\n    by fastforce\n  have pair_\\<Gamma>l1:\"fst (\\<Gamma>,l1) = \\<Gamma> \\<and> snd (\\<Gamma>,l1) = l1\" by fastforce\n  have pair_\\<Gamma>l2:\"fst (\\<Gamma>,l2) = \\<Gamma> \\<and> snd (\\<Gamma>,l2) = l2\" by fastforce\n  have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n  have eq_length:\"length l1 = length l2\" using a2 by auto\n  have len0:\"length l2>0\" using a1 unfolding cp_def \n      using cptn.simps  by fastforce   \n  then have len0:\"length l1>0\" using eq_length by auto\n  then have l1_not_empty:\"l1\\<noteq>[]\" by auto\n  then have l2_not_empty:\"l2 \\<noteq> []\" using a2 by blast       \n   have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n        using last_conv_nth l1_not_empty by auto\n  have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n       using last_conv_nth l2_not_empty by auto \n  have a03:\"(\\<forall>i ns ns'.                 \n               Suc i<length (snd (\\<Gamma>, l2)) \\<longrightarrow> \n               \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i))) \\<longrightarrow>                               \n                 (snd((snd (\\<Gamma>, l2))!i), snd((snd (\\<Gamma>, l2))!(Suc i))) \\<in> G) \\<and> \n               (final_glob (last (snd (\\<Gamma>, l2)))  \\<longrightarrow> fst (last l2) \\<notin> Fault ` F  \\<longrightarrow>               \n                  ((fst (last (snd (\\<Gamma>, l2))) = Skip \\<and> \n                    snd (last (snd (\\<Gamma>, l2))) \\<in> q)) \\<or>\n                  (fst (last (snd (\\<Gamma>, l2))) = Throw \\<and> \n                    snd (last (snd (\\<Gamma>, l2))) \\<in> a ))\"\n  using a1 unfolding comm_def by fastforce\n  show ?thesis unfolding comm_def \n  proof -\n  { fix k ns ns'    \n    assume a00:\"Suc k < length l1\"    \n    then have \"k \\<le> length l1\" using a2 by fastforce    \n    have a00:\"Suc k < length l2\" using eq_length a00 by fastforce\n    then have \"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! k), toSeq (snd (l1 ! k))) \\<rightarrow> \n                (fst (l1 ! Suc k), toSeq (snd (l1 ! Suc k))) \\<longrightarrow>       \n      (snd((snd (\\<Gamma>, l1))!k), snd((snd (\\<Gamma>, l1))!(Suc k))) \\<in> G\"\n    using  pair_\\<Gamma>l1 pair_\\<Gamma>l2 a00  a03 a3  eq_length \n     by (metis Suc_lessD a0 a1 a2 map_catch_eq_state)\n  } note l=this\n  {\n    assume a00: \"fst (last l1) = (Catch c c2) \\<and> final_glob (c, snd (last l1))\" and\n           a01:\"c \\<notin> Fault ` F\"    \n    then have c:\"c=Skip \\<or> c = Throw \\<or> c = Stuck \\<or> (\\<exists>f. c = Fault f)\"\n      unfolding final_glob_def by auto    \n    then have fst_last_l2:\"fst (last l2) = c\"                               \n      using  last_lenl1 a00 l1_not_empty eq_length len0 a2 last_conv_nth last_lift_catch \n      by fastforce      \n    also have last_eq:\"snd (last l2) = snd (last l1)\"      \n      using l2_not_empty a2 last_conv_nth last_lenl1 last_snd_catch\n      by fastforce\n    ultimately have \"final_glob (fst (last l2),snd (last l2))\" \n     using a00 by auto\n    then have \"final_glob (last l2)\" by auto\n    also have \"fst (last (l2)) \\<notin> Fault ` F\"\n       using  last_eq a01 a00 a01 c  \n       by (auto simp add: fst_last_l2) \n    ultimately have \"(fst (last  l2)) = Skip \\<and> \n                    snd (last  l2) \\<in>  q \\<or>\n                  (fst (last l2) = Throw \\<and> \n                    snd (last l2) \\<in> a)\"\n    using a03 by auto\n    then have \"(fst (last l1) = (Catch Skip c2) \\<and> snd (last  l1) \\<in> q) \\<or>\n                  (fst (last l1) = (Catch Throw c2) \\<and>  snd (last l1) \\<in> a)\"\n    using last_eq fst_last_l2 a00 by force\n  }\n  thus ?thesis using l by auto qed\nqed\n\nlemma comm_map''_catch:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Catch c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \\<and> (\\<Gamma>, l2)\\<in> comm(G, (q,a)) F\" and\n  a2:\"l1=map (lift_catch c2) l2\" \nshows\n  \" ((Suc k < length l1 \\<longrightarrow>\n       \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! k), toSeq (snd (l1 ! k))) \\<rightarrow> \n            (fst (l1 ! Suc k), toSeq (snd (l1 ! Suc k))) \\<longrightarrow>        \n       (snd(l1!k), snd(l1!(Suc k))) \\<in> G) \\<and> \n   (final_glob (last l1) \\<longrightarrow> fst (last l1) \\<notin> Fault ` F \\<longrightarrow>  \n      fst (last l1) = Skip \\<and> snd (last  l1) \\<in>  r \\<or>\n      fst (last l1) = Throw \\<and> snd (last l1) \\<in>  (a)))\"\nproof -\n  have a3:\"\\<forall>i. Suc i<length l2 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i))) = \n            \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n                (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i)))\" \n    using a0 a1 a2 same_comp_catch_c\n    by fastforce\n  have pair_\\<Gamma>l1:\"fst (\\<Gamma>,l1) = \\<Gamma> \\<and> snd (\\<Gamma>,l1) = l1\" by fastforce\n  have pair_\\<Gamma>l2:\"fst (\\<Gamma>,l2) = \\<Gamma> \\<and> snd (\\<Gamma>,l2) = l2\" by fastforce\n  have drop_k_s:\"l2!0 = (c1,s)\" using a1 cp_def by blast\n   have eq_length:\"length l1 = length l2\" using a2 by auto\n  have len0:\"length l2>0\" using a1 unfolding cp_def \n      using cptn.simps  by fastforce   \n  then have len0:\"length l1>0\" using eq_length by auto\n  then have l1_not_empty:\"l1\\<noteq>[]\" by auto\n  then have l2_not_empty:\"l2 \\<noteq> []\" using a2 by blast       \n  have last_lenl1:\"last l1 = l1!((length l1) -1)\" \n        using last_conv_nth l1_not_empty by auto\n  have last_lenl2:\"last l2 = l2!((length l2) -1)\" \n       using last_conv_nth l2_not_empty by auto \n  have a03:\"(\\<forall>i ns ns'.                 \n               Suc i<length (snd (\\<Gamma>, l2)) \\<longrightarrow> \n               \\<Gamma>\\<turnstile>\\<^sub>c (fst (l2 ! i), toSeq (snd (l2 ! i))) \\<rightarrow> \n                (fst (l2 ! Suc i), toSeq (snd (l2 ! Suc i))) \\<longrightarrow>                               \n                 (snd((snd (\\<Gamma>, l2))!i), snd((snd (\\<Gamma>, l2))!(Suc i))) \\<in> G) \\<and> \n               (final_glob (last (snd (\\<Gamma>, l2)))  \\<longrightarrow>  fst (last l2) \\<notin> Fault ` F  \\<longrightarrow>              \n                  ((fst (last (snd (\\<Gamma>, l2))) = Skip \\<and> snd (last (snd (\\<Gamma>, l2))) \\<in>  q)) \\<or>\n                  (fst (last (snd (\\<Gamma>, l2))) = Throw \\<and> snd (last (snd (\\<Gamma>, l2))) \\<in>  (a)))\"\n  using a1 unfolding comm_def by fastforce\n  show ?thesis unfolding comm_def \n  proof -\n  { fix k ns ns'   \n    assume a00:\"Suc k < length l1\"    \n    then have \"k \\<le> length l1\" using a2 by fastforce    \n    have a00:\"Suc k < length l2\" using eq_length a00 by fastforce      \n    then have \" \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! k), toSeq (snd (l1 ! k))) \\<rightarrow> \n                (fst (l1 ! Suc k), toSeq (snd (l1 ! Suc k))) \\<longrightarrow>         \n        (snd((snd (\\<Gamma>, l1))!k), snd((snd (\\<Gamma>, l1))!(Suc k))) \\<in> G\"\n      using  pair_\\<Gamma>l1 pair_\\<Gamma>l2 a00  a03 a3  eq_length        \n      by (metis (no_types,lifting) a2 Suc_lessD nth_map snd_lift_catch)\n    } note l= this\n    {\n     assume a00: \"final_glob (last l1)\" and  a00a:\"fst (last l1) \\<notin> Fault ` F\"           \n     then have c:\"fst (last l1)=Skip \\<or> fst (last l1) = Throw \\<or> \n                  fst (last l1) = Stuck \\<or> (\\<exists>f. fst (last l1) = Fault f)\"\n       unfolding final_glob_def by auto \n     moreover have \"fst (last l1) = Catch (fst (last l2)) c2\" \n       using a2 last_lenl1 eq_length\n      proof -\n        have \"last l2 = l2 ! (length l2 - 1)\"\n          using l2_not_empty last_conv_nth by blast\n        then show ?thesis\n          by (metis One_nat_def a2 l2_not_empty last_lenl1 last_lift_catch)\n      qed\n      ultimately have False by simp  \n    } thus ?thesis using l  by auto qed\nqed\n\nlemma comm_map_catch:\nassumes \n  a0:\"(\\<Gamma>,l1) \\<in> (cp \\<Gamma> (Catch c1 c2) s)\" and\n  a1:\"(\\<Gamma>,l2) \\<in> (cp \\<Gamma> c1 s) \\<and> (\\<Gamma>, l2)\\<in> comm(G, (q,a)) F\" and\n  a2:\"l1=map (lift_catch c2) l2\" \nshows\n  \"(\\<Gamma>, l1)\\<in> comm(G, (r,a)) F\"\nproof - \n  {fix i ns ns'\n   have \"(Suc i < length (l1) \\<longrightarrow>\n         \\<Gamma>\\<turnstile>\\<^sub>c (fst (l1 ! i), toSeq (snd (l1 ! i))) \\<rightarrow> \n             (fst (l1 ! Suc i), toSeq (snd (l1 ! Suc i))) \\<longrightarrow>       \n        (snd (l1 ! i), snd (l1 ! Suc i)) \\<in> G) \\<and>\n        (final_glob (last l1) \\<longrightarrow> fst (last l1) \\<notin> Fault ` F  \\<longrightarrow>                 \n                   fst (last l1) = LanguageCon.com.Skip \\<and> snd (last l1) \\<in> r \\<or>\n                   fst (last l1) = LanguageCon.com.Throw \\<and> snd (last l1) \\<in>  a) \"\n      using comm_map''_catch[of \\<Gamma> l1 c1 c2 s l2 G q a F i r] a0 a1 a2 \n      by fastforce\n   }  then show ?thesis using comm_def unfolding comm_def by force       \nqed\n\nlemma Catch_sound1: \nassumes\n  a0:\"(n,\\<Gamma>,x)\\<in>cptn_mod_nest_call\" and\n  a1:\"x!0 = ((Catch P Q),s)\" and\n  a2:\"\\<forall>i<length x. fst (x!i)\\<noteq> Q\" and\n  a3:\"\\<not> final_glob (last x)\" and\n  a4:\"env_tran_right \\<Gamma> x rely\"\nshows\n  \"\\<exists>xs. (\\<Gamma>,xs) \\<in> cpn n \\<Gamma> P s \\<and> x = map (lift_catch Q) xs\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s)\n  case (CptnModNestOne n \\<Gamma> C s1)\n  then have \"(\\<Gamma>, [(P,s)]) \\<in> cpn n \\<Gamma> P s \\<and> [(C, s1)] = map (lift_catch Q) [(P,s)]\"\n    unfolding cpn_def lift_catch_def\n    by (simp add: cptn_mod_nest_call.CptnModNestOne) \n  thus ?case by fastforce\nnext\n  case (CptnModNestEnv \\<Gamma> C s1 t1 n xsa)\n  then have C:\"C=Catch P Q\" unfolding lift_catch_def by fastforce\n  have \"\\<exists>xs. (\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t1 \\<and> (C, t1) # xsa = map (lift_catch Q) xs\"\n  proof -\n     have \"((C, t1) # xsa) ! 0 = (Catch P Q, t1)\" using C by auto\n     moreover have \"\\<forall>i<length ((C, t1) # xsa). fst (((C, t1) # xsa) ! i) \\<noteq> Q\"\n       using CptnModNestEnv(5) by fastforce\n     moreover have \"\\<not> final_glob (last ((C, t1) # xsa))\" using CptnModNestEnv(6) \n       by fastforce\n     ultimately show ?thesis\n       using CptnModNestEnv(3) CptnModNestEnv(7) env_tran_tail by blast     \n  qed \n  then obtain xs where hi:\"(\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t1 \\<and> (C, t1) # xsa = map (lift_catch Q) xs\"\n    by fastforce\n  have s1_s:\"s1=s\" using  CptnModNestEnv unfolding cpn_def by auto\n  obtain xsa' where xs:\"xs=((P,t1)#xsa') \\<and> (n,\\<Gamma>,((P,t1)#xsa'))\\<in>cptn_mod_nest_call \\<and> \n                  (C, t1) # xsa = map (lift_catch Q) ((P,t1)#xsa')\" \n    using hi  unfolding cpn_def by fastforce\n  \n  have env_tran:\"\\<Gamma>\\<turnstile>\\<^sub>c(P,s1) \\<rightarrow>\\<^sub>e (P,t1)\" using CptnModNestEnv Catch_env_P by (metis fst_conv nth_Cons_0)  \n  then have \"(n,\\<Gamma>,(P,s1)#(P,t1)#xsa')\\<in>cptn_mod_nest_call\" using xs env_tran \n    using cptn_mod_nest_call.CptnModNestEnv by blast \n  then have \"(\\<Gamma>,(P,s1)#(P,t1)#xsa') \\<in> cpn n \\<Gamma> P s\" \n    using cpn_def s1_s by fastforce\n  moreover have \"(C,s1)#(C, t1) # xsa = map (lift_catch Q) ((P,s1)#(P,t1)#xsa')\"\n    using xs C unfolding lift_catch_def by fastforce\n  ultimately show ?case by auto\nnext\n  case (CptnModNestSkip)\n  thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n  case (CptnModNestStuck)\n  thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n  case (CptnModNestFault)\n  thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n  case (CptnModNestThrow)\n  thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n  case (CptnModNestCatch1 n \\<Gamma> P0 sa xsa zs P1)\n  then have a1:\"LanguageCon.com.Catch P Q = LanguageCon.com.Catch P0 P1\"\n    by fastforce  \n  have f1: \"sa = s\"\n    using CptnModNestCatch1.prems(1) by force\n  have f2: \"P = P0 \\<and> Q = P1\" using a1 by auto\n  have \"(n,\\<Gamma>, (P0, sa) # xsa) \\<in> cptn_mod_nest_call\"\n    by (metis CptnModNestCatch1.hyps(1))\n  hence \"(\\<Gamma>, (P0, sa) # xsa) \\<in> cpn n \\<Gamma> P s\"\n    using f2 f1 by (simp add: cpn_def)\n  thus ?case\n    using Cons_lift_catch CptnModNestCatch1.hyps(3) a1 by blast   \nnext\n case (CptnModNestCatch2 n \\<Gamma> P1 sa xsa c f  ys zs Q1)\n  have \"final_glob (last ((c, sa)# ys))\" \n    using CptnModNestCatch2(4) unfolding final_glob_def apply auto\n    by (metis (no_types, lifting) CptnModNestCatch2.hyps(5)\n         cptn_if_cptn_mod cptn_mod_nest_cptn_mod  last_ConsR last_length \n       length_Cons lessI term_all_skip)+\n  thus ?case\n    by (metis (no_types, hide_lams) CptnModNestCatch2.hyps(7) CptnModNestCatch2.prems(3) \n           append_is_Nil_conv final_glob_def fst_conv last.simps \n          last_appendR list.distinct(1))\nnext\n  case (CptnModNestCatch3 n \\<Gamma> P0 sa xsa sa' P1 ys zs)\n  then have \"P0 = P \\<and> P1 = Q\" by auto\n  then obtain i where zs:\"fst (zs!i) = Q \\<and> (i< (length zs))\" \n    using CptnModNestCatch3\n    by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons length_append nth_append_length zero_less_Suc zero_less_diff)    \n  then have \"Suc i< length ((Catch P0 P1, sa)#zs)\" by fastforce\n  then have \"fst (((Catch P0 P1,  sa) # zs)!Suc i) = Q\" using zs by fastforce    \n  thus ?case using CptnModNestCatch3(9) zs by auto\nqed (auto)\n\nlemma Catch_sound2: \nassumes\n  a0:\"(n,\\<Gamma>,x)\\<in>cptn_mod_nest_call\" and\n  a1:\"x!0 = ((Catch P Q),s)\" and\n  a2:\"\\<forall>i<length x. fst (x!i)\\<noteq> Q\" and\n  a3:\"fst (last x) = c \\<and> (c = Skip \\<or> c = Stuck \\<or> c = Fault f)\" and\n  a4:\"env_tran_right \\<Gamma> x rely\"\nshows\n  \"\\<exists>xs ys. (\\<Gamma>,xs) \\<in> cpn n \\<Gamma> P s \\<and> x = ((map (lift_catch Q) xs)@((c,snd(last xs))#ys))\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: P s)\n  case (CptnModNestOne n \\<Gamma> C s1)  \n  thus ?case by fastforce\nnext\n  case (CptnModNestEnv \\<Gamma> C s1 t1 n xsa)\n  then have C:\"C=Catch P Q\" unfolding lift_catch_def by fastforce\n  have \"\\<exists>xs ys. (\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t1 \\<and> (C, t1) # xsa = \n                map (lift_catch Q) xs@((c, snd(last xs))#ys)\"\n  proof -\n     have \"((C, t1) # xsa) ! 0 = (LanguageCon.com.Catch P Q, t1)\" using C by auto\n     moreover have \"\\<forall>i<length ((C, t1) # xsa). fst (((C, t1) # xsa) ! i) \\<noteq> Q\"\n       using CptnModNestEnv(5) by fastforce\n     moreover have h:\"fst (last ((C, t1) # xsa)) = c\" using CptnModNestEnv(6) \n       by fastforce\n     ultimately show ?thesis    \n       using CptnModNestEnv(3) CptnModNestEnv(7) \n       by (auto simp add: env_tran_tail CptnModNestEnv.prems(3))\n  qed \n  then obtain xs ys where hi:\n    \"(\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t1 \\<and> (C, t1) # xsa = map (lift_catch Q) xs@\n            ((c,snd(last ((P, t1)#xs)))#ys)\"\n    by fastforce\n  have s1_s:\"s1=s\" using  CptnModNestEnv unfolding cp_def by auto\n  have \"\\<exists>xsa' ys. xs=((P,t1)#xsa') \\<and> (n,\\<Gamma>,((P,t1)#xsa'))\\<in>cptn_mod_nest_call \\<and> \n         (C, t1) # xsa = map (lift_catch Q) ((P,t1)#xsa')@((c, snd(last xs))#ys)\" \n    using hi  unfolding cp_def\n  proof -\n    have \"(n,\\<Gamma>,xs)\\<in>cptn_mod_nest_call \\<and> xs!0 = (P,t1)\" \n      using hi unfolding cpn_def by fastforce\n    moreover then have \"xs\\<noteq>[]\" using CptnEmpty calculation by blast      \n    moreover  obtain xsa' where \"xs=((P,t1)#xsa')\" using SmallStepCon.nth_tl calculation by fastforce \n    ultimately show ?thesis\n      using hi by auto\n  qed\n  then obtain xsa' ys where xs:\"xs=((P,t1)#xsa') \\<and> (n,\\<Gamma>,((P,t1)#xsa'))\\<in>cptn_mod_nest_call \\<and> (C, t1) # xsa = \n                                    map (lift_catch Q) ((P,t1)#xsa')@((c,snd(last ((P,s1)#(P,t1)#xsa')))#ys)\"\n    by fastforce\n  have env_tran:\"\\<Gamma>\\<turnstile>\\<^sub>c(P,s1) \\<rightarrow>\\<^sub>e (P,t1)\" \n    using CptnModNestEnv Catch_env_P by (metis fst_conv nth_Cons_0)  \n  then have \"(n,\\<Gamma>,(P,s1)#(P,t1)#xsa')\\<in>cptn_mod_nest_call\" using xs env_tran     \n    by (simp add: cptn_mod_nest_call.CptnModNestEnv)   \n  then have \"(\\<Gamma>,(P,s1)#(P,t1)#xsa') \\<in> cpn n \\<Gamma> P s\" \n    using cpn_def s1_s by fastforce\n  moreover have \"(C,s1)#(C, t1) # xsa = map (lift_catch Q) ((P,s1)#(P,t1)#xsa')@\n                                         ((c,snd(last ((P,s1)#(P,t1)#xsa')))#ys)\"\n    using xs C unfolding lift_catch_def\n    by auto\n  ultimately show ?case by fastforce \nnext\n  case (CptnModNestSkip)\n  thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n  case (CptnModNestThrow)\n  thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n  case (CptnModNestStuck)\n  thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n  case (CptnModNestFault)\n  thus ?case by (metis SmallStepCon.redex_not_Catch fst_conv nth_Cons_0)\nnext\n  case (CptnModNestCatch1 n \\<Gamma> P0 sa xsa zs P1)  \n  thus ?case\n  proof -\n    have \"\\<forall>c x. (LanguageCon.com.Catch c P1, x) # zs = map (lift_catch P1) ((c, x) # xsa)\"\n      using Cons_lift_catch CptnModNestCatch1.hyps(3) by blast\n    then have \"(P0, sa) # xsa = []\"\n      by (metis CptnModNestCatch1.prems(3) LanguageCon.com.distinct(149) \n           LanguageCon.com.distinct(173) LanguageCon.com.distinct(23) \n         last_length length_Cons lessI map_lift_catch_all_catch)     \n    then show ?thesis\n      by force\n  qed \nnext\n  case (CptnModNestCatch2 n \\<Gamma> P1 sa xsa c1 f  ys zs Q1) \n  then have P0:\"P1 = P \\<and> Q1 = Q \\<and> sa = s\" by auto  \n  moreover then have cpn:\"(\\<Gamma>, (P1,sa) # xsa)\\<in> cpn n \\<Gamma> P s\" \n    using CptnModNestCatch2(1)\n    by (simp add: cpn_def cptn_eq_cptn_mod_set)  \n  ultimately show ?case\n  proof -\n    have f1: \"(\\<Gamma>, (c1, snd(last ((P1, sa)#xsa))) # ys) \\<in> cptn_mod\"\n      using  cptn_mod_nest_cptn_mod CptnModNestCatch2.hyps(5) by blast\n    have f2: \"0 \\<le> length ys\"\n      by fastforce\n    have f3: \"c = fst (((c1, snd(last ((P1, sa)#xsa))) # ys) ! length ys)\"\n      by (metis (no_types) CptnModNestCatch2.hyps(7) CptnModNestCatch2.prems(3) \n           append_is_Nil_conv last_ConsR last_appendR last_length list.simps(3))\n    have \"final_glob (c1, snd(last ((P1, sa)#xsa)))\"\n      by (metis (no_types) CptnModNestCatch2.hyps(4) final_glob_def fst_conv)\n    then have \"final_glob (((c1,snd(last ((P1, sa)#xsa))) # ys) ! 0)\"\n      by simp\n    then show ?thesis  using f1 f2 f3\n      by (metis (no_types, lifting) Cons_lift_catch_append CptnModNestCatch2.hyps(7) P0 cpn \n       cptn_eq_cptn_mod_set fst_conv last_F length_Cons lessI nth_Cons_0)\n  qed     \nnext \n  case (CptnModNestCatch3 n \\<Gamma> P0 sa xsa sa' P1 ys zs)   \n  then have \"P0 = P \\<and> P1 = Q \\<and> s= sa\" by auto\n  then obtain i where zs:\"fst (zs!i) = Q \\<and> (i< (length zs))\" \n    using CptnModNestCatch3    \n    by (metis (no_types, lifting) add_diff_cancel_left' fst_conv length_Cons \n        length_append nth_append_length zero_less_Suc zero_less_diff)    \n  then have si:\"Suc i< length ((Catch P0 P1, sa)#zs)\" by fastforce\n  then have \"fst (((Seq P0 P1,  sa) # zs)!Suc i) = Q\" using zs by fastforce    \n  thus ?case using CptnModNestCatch3(9) zs\n     by (metis si nth_Cons_Suc)\nqed (auto)\n\nlemma Catch_sound3: \nassumes\n  a0:\"(\\<Gamma>,x)\\<in>cptn\" and\n  a1:\"x!0 = ((Catch P Q),s)\" and\n  a2:\"\\<forall>i<length x. fst (x!i)\\<noteq> Q\" and\n  a3:\"fst(last x) = Throw\" and\n  a4:\"env_tran_right \\<Gamma> x rely \"\nshows\n  \"False\"\n  using a0 a1 a2 a3 a4\n  proof (induct arbitrary: P s)\n    case (CptnOne \\<Gamma> C s1) thus ?case by auto\n  next\n    case (Cptn \\<Gamma> C st C' st' xsa)\n    then have \"\\<Gamma>\\<turnstile>\\<^sub>c (C, st) \\<rightarrow>\\<^sub>c\\<^sub>e (C', st')\" by auto\n    then have \"\\<Gamma>\\<turnstile>\\<^sub>c (C, st) \\<rightarrow>\\<^sub>e (C', st') \\<or> \\<Gamma>\\<turnstile>\\<^sub>c (C, toSeq st) \\<rightarrow> (C', toSeq st')\"\n      using step_ce_dest by blast\n    moreover {assume \"\\<Gamma>\\<turnstile>\\<^sub>c (C, st) \\<rightarrow>\\<^sub>e (C', st')\"\n    moreover have \"LanguageCon.com.Catch P Q = C\"\n      using Cptn.prems(1) by auto\n    moreover have  \"C' = C\" using env_c_c' calculation Cptn by blast\n    ultimately have ?case using Cptn\n      by (metis Suc_less_eq env_tran_tail last_length length_Cons nth_Cons_0 nth_Cons_Suc)\n  }\n  moreover {\n    assume a00:\"\\<Gamma>\\<turnstile>\\<^sub>c (C, toSeq st) \\<rightarrow> (C', toSeq st')\"\n    then have c_catch:\"C = (Catch P Q) \\<and> st = s\" using Cptn by force\n    from a00 c_catch have ?case\n    proof(cases)\n      case (Catchc P1 P1' P2) thus ?thesis\n      proof -\n        have f1: \"env_tran_right \\<Gamma> ((C', st') # xsa) rely\"\n          using Cptn env_tran_tail by blast\n        have \"Q = P2\"\n          using c_catch Catchc(1)  by blast\n        then show ?thesis\n          using f1 Cptn Catchc(2) by moura\n      qed\n    next\n      case  (CatchSkipc) thus ?thesis\n      proof -\n        have \"fst (((C', st') # xsa) ! 0) = LanguageCon.com.Skip\"\n          by (simp add: local.CatchSkipc(2))\n        then show ?thesis\n          by (metis (no_types) Cptn.hyps(2) Cptn.prems(3) LanguageCon.com.distinct(21) last.simps \n              last_length length_Cons lessI list.distinct(1) zero_skip_all_skip)\n      qed    \n    next\n      case (CatchThrowc)\n      thus ?thesis using Cptn by auto   \n    next\n      case (CatchStuckc C2) thus ?thesis\n        by (metis LanguageCon.com.simps(159) last_ConsR last_length length_Cons lessI \n              list.distinct(1) local.Cptn(2) local.Cptn(6) term_all_skip) \n    next\n      case (CatchFaultc C2) thus ?thesis\n        by (metis LanguageCon.com.distinct(171) last_ConsR last_length length_Cons lessI \n             list.simps(3) local.Cptn(2) local.Cptn(6) term_all_skip) \n    qed (fastforce,auto)     \n  } ultimately show ?case by auto\nqed\n\nlemma catch_map_xs_ys':\n  assumes\n  a0:\"(n, \\<Gamma>, (P0, sa) # xsa) \\<in> cptn_mod_nest_call\" and    \n  a1:\"fst (last ((P0, sa) # xsa)) = C\" and\n  a2:\"(n,\\<Gamma>, (P1, snd (last ((P0, sa) # xsa))) # ys) \\<in> cptn_mod_nest_call\" and\n  a3:\"zs = map (lift_catch P1) xsa @ (P1, snd (last ((P0, sa) # xsa))) # ys\" and\n  a4:\"((LanguageCon.com.Catch P0 P1, sa) # zs) ! 0 = (LanguageCon.com.Catch P Q, s)\" and\n  a5:\"i < length ((LanguageCon.com.Catch P0 P1, sa) # zs) \\<and> ((LanguageCon.com.Catch P0 P1, sa) # zs) ! i = (Q, sj)\" and\n  a6:\"\\<forall>j<i. fst (((LanguageCon.com.Catch P0 P1, sa) # zs) ! j) \\<noteq> Q\"\nshows \n  \"\\<exists>xs ys. (\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P s \\<and>\n            (\\<Gamma>, ys) \\<in> cpn n \\<Gamma> Q (snd (xs ! (i - 1))) \\<and> (LanguageCon.com.Catch P0 P1, sa) # zs = map (lift_catch Q) xs @ ys\"\nproof -\n  let ?P0 = \"(P0, sa) # xsa\"\n  have P_Q:\"P=P0 \\<and> s=sa \\<and> Q = P1\" using a4 by force\n  have i:\"i=(length ((P0, sa) # xsa))\"   \n  proof (cases \"i=(length ((P0, sa) # xsa))\")\n    case True thus ?thesis by auto\n  next\n    case False     \n    then have i:\"i<(length ((P0, sa) # xsa)) \\<or> i > (length ((P0, sa) # xsa))\" by auto\n    {\n      assume i:\"i<(length ((P0, sa) # xsa))\"\n      then have eq_map:\"((LanguageCon.com.Catch P0 P1, sa) # zs) ! i = map (lift_catch P1) ((P0, sa) # xsa) ! i\" \n        using a3 Cons_lift_catch_append\n        by (metis (no_types, lifting) length_map nth_append) \n      then have  \"\\<exists>ci si. map (lift_catch P1) ((P0, sa) # xsa) ! i = (Catch ci P1,si)\" \n        using i unfolding lift_catch_def\n        by (metis a5 eq_map fst_conv length_map map_lift_catch_all_catch)\n      then have  \"((LanguageCon.com.Catch P0 P1, sa) # zs) ! i \\<noteq> (Q, sj)\" \n        using P_Q eq_map by fastforce\n      then have ?thesis using a5 by auto\n    }note l=this\n    {\n      assume i:\"i>(length ((P0, sa) # xsa))\"\n      have \"fst (((LanguageCon.com.Catch P0 P1, sa) # zs) ! (length ?P0)) = Q\"\n        using a3 P_Q Cons_lift_catch_append by (metis fstI length_map nth_append_length) \n      then have ?thesis using a6 i by auto\n    }\n    thus ?thesis using l i by auto\n   qed\n   then have  \"(\\<Gamma>, (P0, sa) # xsa) \\<in> cpn n \\<Gamma> P s\" \n    using a0  P_Q unfolding cpn_def by fastforce\n  also have \"(\\<Gamma>, (P1, snd (last ((P0, sa) # xsa))) # ys) \\<in> cpn n \\<Gamma> Q (snd (?P0 ! ((length ?P0) -1)))\" \n    using a3 cptn_eq_cptn_mod P_Q unfolding cpn_def\n  proof -\n    have \"(n, \\<Gamma>, (Q, snd (last ((P0, sa) # xsa))) # ys) \\<in> cptn_mod_nest_call\"\n      using a2 P_Q by blast\n    then have \"(\\<Gamma>, (Q, snd (last ((P0, sa) # xsa))) # ys) \\<in> {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (Suc (length xsa) - 1))) \\<and> \n              (n, \\<Gamma>, ps) \\<in> cptn_mod_nest_call \\<and> f = \\<Gamma>}\"\n      by (simp add: cptn_eq_cptn_mod last_length)\n    then show \"(\\<Gamma>, (P1, snd (last ((P0, sa) # xsa))) # ys) \\<in> {(f, ps). ps ! 0 = (Q, snd (((P0, sa) # xsa) ! (length ((P0, sa) # xsa) - 1))) \\<and> (n,\\<Gamma>, ps) \\<in> cptn_mod_nest_call \\<and> f = \\<Gamma>}\"\n      using P_Q by force\n  qed \n  ultimately show ?thesis using a3 P_Q i using Cons_lift_catch_append by blast\nqed\n\n\nlemma Catch_sound4: \nassumes\n  a0:\"(n,\\<Gamma>,x)\\<in>cptn_mod_nest_call\" and\n  a1:\"x!0 = ((Catch P Q),s)\" and\n  a2:\"i<length x \\<and> x!i=(Q,sj)\" and\n  a3:\"\\<forall>j<i. fst(x!j)\\<noteq>Q\" and \n  a4:\"env_tran_right \\<Gamma> x rely \"\nshows\n  \"\\<exists>xs ys. (\\<Gamma>,xs) \\<in> (cpn n \\<Gamma> P s) \\<and> (\\<Gamma>,ys) \\<in> (cpn n \\<Gamma> Q (snd (xs!(i-1)))) \\<and> x = (map (lift_catch Q) xs)@ys\"\nusing a0 a1 a2 a3 a4\nproof (induct arbitrary: i sj P s)\n  case (CptnModNestEnv \\<Gamma> C st t n xsa)  \n  have a1:\"Catch P Q \\<noteq> Q\" by simp    \n  then have C_catch:\"C=(Catch P Q)\" using CptnModNestEnv by fastforce\n  then have \"fst(((C, st) # (C, t) # xsa)!0) \\<noteq>Q\" using Cptn a1 by auto\n  moreover have  \"fst(((C, st) # (C, t) # xsa)!1) \\<noteq>Q\" using CptnModNestEnv a1 by auto\n  moreover have \"fst(((C, st) # (C, t) # xsa)!i) =Q\" using CptnModNestEnv by auto\n  ultimately have i_suc: \"i> (Suc 0)\" using CptnModNestEnv \n    by (metis Suc_eq_plus1 Suc_lessI add.left_neutral neq0_conv) \n  then obtain i' where i':\"i=Suc i'\" by (meson lessE) \n  then have i_minus:\"i'=i-1\" by auto  \n  have \"((C, t) # xsa) ! 0 = ((Catch P Q), t)\"\n    using CptnModNestEnv by auto \n  moreover have \"i'< length ((C,t)#xsa) \\<and> ((C,t)#xsa)!i' = (Q,sj)\"\n    using i' CptnModNestEnv(5) by force\n  moreover have \"\\<forall>j<i'. fst (((C, t) # xsa) ! j) \\<noteq> Q\"\n    using i' CptnModNestEnv(6) by force\n  ultimately have hyp:\"\\<exists>xs ys.\n     (\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t \\<and>\n     (\\<Gamma>, ys) \\<in> cpn n \\<Gamma> Q (snd (xs ! (i'-1))) \\<and> (C, t) # xsa = map (lift_catch Q) xs @ ys\"\n    using CptnModNestEnv(3) env_tran_tail CptnModNestEnv.prems(4)  by blast \n  then obtain xs ys where xs_cp:\"(\\<Gamma>, xs) \\<in> cpn n \\<Gamma> P t \\<and>\n     (\\<Gamma>, ys) \\<in> cpn n \\<Gamma> Q (snd (xs ! (i'-1))) \\<and> (C, t) # xsa = map (lift_catch Q) xs @ ys\"\n    by fast\n  have \"(\\<Gamma>, (P, s)#xs) \\<in> cpn n \\<Gamma> P s\"\n  proof -\n    have \"xs!0 = (P,t)\" \n      using xs_cp unfolding cpn_def by blast\n    moreover have \"xs\\<noteq>[]\"\n      using cpn_def CptnEmpty xs_cp by blast \n    ultimately obtain xs' where xs':\"(n,\\<Gamma>, (P,t)#xs') \\<in> cptn_mod_nest_call \\<and> xs=(P,t)#xs'\" \n      using SmallStepCon.nth_tl xs_cp unfolding cpn_def by force\n    thus ?thesis using cpn_def  \n    proof -\n      have \"(Catch P Q, s) = (C, st)\"\n        using CptnModNestEnv.prems(1) by auto\n      then have \"\\<Gamma>\\<turnstile>\\<^sub>c (P, s) \\<rightarrow>\\<^sub>e (P, t)\"\n        using Catch_env_P CptnModNestEnv(1) by blast\n      then show ?thesis\n        by (simp add: cpn_def cptn_mod_nest_call.CptnModNestEnv xs')\n    qed\n  qed\n  thus  ?case \n    using i_suc Cons_lift_catch_append CptnModNestEnv.prems(1) i' i_minus xs_cp\n    by (metis (no_types, lifting) Suc_less_SucD nth_Cons_0 nth_Cons_pos)    \nnext\n  case (CptnModNestSkip \\<Gamma> P s t n xs)\n  then show ?case\n    by (metis (no_types) fst_conv nth_Cons_0 redex_not_Catch)\nnext\n  case (CptnModNestThrow \\<Gamma> P s t n xs)\n  then show ?case  \n    by (metis (no_types)  fst_conv nth_Cons_0 redex_not_Catch)\nnext\ncase (CptnModNestStuck \\<Gamma> P s t n xs)\n  then show ?case  \n    by (metis (no_types) fst_conv nth_Cons_0 redex_not_Catch)\nnext\ncase (CptnModNestFault \\<Gamma> P s t n xs)\n  then show ?case  \n    by (metis (no_types)  fst_conv nth_Cons_0 redex_not_Catch)\nnext\n  case (CptnModNestCatch1 n \\<Gamma> P0 s xs zs P1)\n  then show ?case\n    by (metis Catch_not_c Cons_lift_catch LanguageCon.com.inject(10) fst_conv \n          map_lift_catch_all_catch nth_Cons_0)\nnext\n  case (CptnModNestCatch2 n \\<Gamma> P1 sa xsa c1 f ys zs Q1) \n  then have P_Q:\"P=P1 \\<and> Q = Q1\" by force\n  thus ?case\n  proof (cases \"Q1 = Skip \\<or> Q1 = Stuck \\<or> (\\<exists>f. Q1 = Fault f)\")\n    case True \n    then have cptnmod:\" (n,\\<Gamma>,((Catch P1 Q1),  s)#zs) \\<in> cptn_mod_nest_call \"\n      using  cptn_mod.CptnModSeq3 P_Q apply auto\n      by (smt CptnModNestCatch2.hyps(1) CptnModNestCatch2.hyps(3) CptnModNestCatch2.hyps(4) \n                CptnModNestCatch2.hyps(5) CptnModNestCatch2.hyps(7) CptnModNestCatch2.prems(1) \n              cptn_mod_nest_call.CptnModNestCatch2 nth_Cons_0)+\n    then have \"c1 = Q1\" \n    proof -      \n     have f4: \"(\\<Gamma>, (c1, snd (last ((P1, sa) # xsa))) # ys) \\<in> cptn\"\n      using  CptnModNestCatch2(5)\n      using cptn_eq_cptn_mod_nest by blast\n    have f3:\"((Catch P1 Q1, sa) # zs) ! i = (Q1, sj)\"\n      using P_Q CptnModNestCatch2(9) by fastforce\n    then have f5: \"final_glob (Q, sj)\"\n      by (metis P_Q True final_glob_def fst_conv)\n    have \"final_glob (c1, snd (last ((P1, sa) # xsa)))\"\n      using CptnModNestCatch2.hyps(4) final_glob_def prod.collapse by blast\n    then show ?thesis\n      using f5 f4\n      by (smt CptnModNestCatch2.hyps(7) CptnModNestCatch2.prems(1) CptnModNestCatch2.prems(2)\n             append_is_Nil_conv cptn_if_cptn_mod cptn_mod_nest_cptn_mod cptnmod f3 fst_conv \n         last.simps last_F last_appendR last_length length_Cons lessI less_Suc_eq_le list.distinct(1)\n             nth_Cons_0 zero_less_Suc)            \n    qed \n    thus ?thesis using P_Q catch_map_xs_ys'[of n \\<Gamma> P1 \"sa\" xsa Q1 Q1 ys zs P1 Q1 sa i sj]\n      CptnModNestCatch2 by auto\n  next \n    case asm0:False note q_not_throw=this\n    have \"\\<forall>x. x< length ((LanguageCon.com.Catch P1 Q1, sa) # zs) \\<longrightarrow>\n              ((LanguageCon.com.Catch P1 Q1,  sa) # zs) ! x \\<noteq> (Q, sj)\" using CptnModNestCatch2\n    proof -\n    {\n      fix x\n      assume x_less:\"x< length ((LanguageCon.com.Catch P1 Q1,  sa) # zs)\"\n      have \"((LanguageCon.com.Catch P1 Q1,  sa) # zs) ! x \\<noteq> (Q, sj)\"\n      proof (cases \"x < length ((LanguageCon.com.Catch P1 Q1, sa)#map (lift_catch Q1) xsa)\")\n        case True \n        then have eq_map:\"((LanguageCon.com.Catch P1 Q1, sa) # zs) ! x = \n                     map (lift_catch Q1) ((P1, sa) # xsa) ! x\"\n          by (metis (no_types, lifting) Cons_lift_catch Cons_lift_catch_append \n               CptnModNestCatch2.hyps(7) nth_append)           \n        then have  \"\\<exists>ci si. map (lift_catch Q1) ((P1, sa) # xsa) ! x = (Catch ci Q1,si)\" \n          using True unfolding lift_catch_def\n          by (metis Cons_lift_catch True eq_map map_lift_catch_all_catch surjective_pairing)\n        then have  \"((LanguageCon.com.Catch P1 Q1, sa) # zs) ! x \\<noteq> (Q, sj)\" \n          using P_Q eq_map by fastforce     \n        thus ?thesis using CptnModNestCatch2(10) by auto        \n      next\n        case False \n        let ?s' = \"snd (last ((P1, sa) # xsa))\"        \n        have all_throw:\"\\<forall>i<length ((c1, ?s')# ys). \n              fst (((c1, ?s')# ys)!i) = c1\" using CptnModNestCatch2  term_all_skip\n          by (metis cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod)         \n        then have \n          \"\\<forall>x\\<ge> length ((LanguageCon.com.Catch P1 Q1,  sa) # map (lift_catch Q1) xsa). \n           x<length (((LanguageCon.com.Catch P1 Q1, sa) # zs)) \\<longrightarrow>\n              fst (((LanguageCon.com.Catch P1 Q1, sa) # zs) ! x) = c1\"            \n        proof-\n        {\n          fix x \n          assume a1:\"x\\<ge> length ((Catch P1 Q1, sa) # map (lift_catch Q1) xsa)\" and\n                 a2:\"x<length (((Catch P1 Q1, sa) # zs))\"\n          then have \"((Catch P1 Q1, sa) # zs) ! x = \n                     ((c1, ?s')# ys) !(x - (length ((Catch P1 Q1, sa) # map (lift_catch Q1) xsa)))\"\n          using CptnModNestCatch2(6) \n          by (metis (no_types, lifting) Cons_lift_catch Cons_lift_catch_append CptnModNestCatch2.hyps(7) \n                    diff_is_0_eq' less_numeral_extra(3) nth_append zero_less_diff)\n          then have\"fst (((Catch P1 Q1, sa) # zs) ! x) = c1\" \n            using all_throw a1 a2 CptnModNestCatch2.hyps(6) \n            by (simp add: CptnModNestCatch2.hyps(7)) \n         } thus ?thesis by auto\n         qed       \n         thus ?thesis using False    P_Q x_less asm0  CptnModNestCatch2(3,4)\n           by (metis fst_conv not_le_imp_less)\n    qed\n    } thus ?thesis by auto\n    qed\n    thus ?thesis using CptnModNestCatch2.prems(2) by blast \n  qed     \nnext\n  case (CptnModNestCatch3 n \\<Gamma> P1 sa xsa  ys zs Q1)\n  then show ?case using catch_map_xs_ys'[OF CptnModNestCatch3(1) CptnModNestCatch3(3) CptnModNestCatch3(5)\n                                            CptnModNestCatch3(7) CptnModNestCatch3(8) CptnModNestCatch3(9)] \n     by blast\nqed(auto) \n\ninductive_cases stepc_elim_cases_Catch_throw:\n\"\\<Gamma>\\<turnstile>\\<^sub>c(Catch c1 c2,s) \\<rightarrow> (Throw, s1)\" \n\ninductive_cases stepc_elim_cases_Catch_skip_c2:\n\"\\<Gamma>\\<turnstile>\\<^sub>c(Catch c1 c2,s) \\<rightarrow> (c2,s)\"\n\ninductive_cases stepc_elim_cases_Catch_skip_2:\n\"\\<Gamma>\\<turnstile>\\<^sub>c(Catch c1 c2,s) \\<rightarrow> (Skip,  s1)\"\n\"\\<Gamma>\\<turnstile>\\<^sub>c(Catch c1 c2,s) \\<rightarrow> (Throw,  s1)\"\n\"\\<Gamma>\\<turnstile>\\<^sub>c(Catch c1 c2,s) \\<rightarrow> (Stuck,  s1)\" \n\"\\<Gamma>\\<turnstile>\\<^sub>c(Catch c1 c2,s) \\<rightarrow> (Fault f,  s1)\"\n\n\nlemma catch_skip_throw:\n \"\\<Gamma>\\<turnstile>\\<^sub>c(Catch c1 c2,s) \\<rightarrow> (c2,s)  \\<Longrightarrow> (c1= Skip \\<and> c2= Skip) \\<or> (c1=Throw ) \\<or> \n                                    (c1 = Stuck \\<and> c2=Stuck) \\<or> (\\<exists>f. c1 = Fault f \\<and> c2=Fault f)\"\napply (rule stepc_elim_cases_Catch_skip_c2)\napply fastforce\napply (auto)+\ndone\n\nthm stepc_elim_cases_Catch_skip_2\nlemma catch_skip_throw1:\n \"\\<Gamma>\\<turnstile>\\<^sub>c(Catch c1 c2,s) \\<rightarrow> (Skip,s)  \\<Longrightarrow> (c1=Skip) \\<or> (c1=Throw \\<and> c2 = Skip)\"\napply (rule stepc_elim_cases_Catch_skip_2)\nusing redex_not_Catch by auto\n\n\nlemma Catch_sound: \n      \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p,  R, G, q,r] \\<Longrightarrow>\n       \\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p,  R, G, q,r] \\<Longrightarrow>\n       \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c2 sat [r,  R, G, q,a] \\<Longrightarrow>\n       \\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c2 sat [r,  R, G, q,a] \\<Longrightarrow>        \n       Sta q R  \\<Longrightarrow>  \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow> \n       \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Catch c1 c2) sat [p, R, G, q,a]\"\nproof -  \n  assume\n    a0:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]\" and\n    a1:\"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]\" and\n    a2:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]\" and    \n    a3: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]\" and     \n    a4: \"Sta q R \" and\n    a5: \"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\"       \n  { \n    fix s\n    assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n    then have a1:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p, R, G, q,r]\" \n      using a1 com_cvalidityn_def by fastforce  \n    then have a3: \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c2 sat [r, R, G, q,a]\"\n      using a3 com_cvalidityn_def all_call by fastforce \n    have \"cpn n \\<Gamma> (Catch c1 c2)  s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof -\n    {   \n      fix c     \n      assume a10:\"c \\<in> cpn n \\<Gamma> (Catch c1 c2) s\" and a11:\"c \\<in> assum(p, R)\"\n      then have a10':\"c \\<in> cp \\<Gamma> (Catch c1 c2) s\"\n        unfolding cpn_def cp_def\n        using cptn_if_cptn_mod cptn_mod_nest_cptn_mod by blast\n      obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n      have cp:\"l!0=((Catch c1 c2),s) \\<and> (n,\\<Gamma>,l) \\<in> cptn_mod_nest_call \\<and> \\<Gamma>=\\<Gamma>1\" \n        using a10 cpn_def c_prod by fastforce\n      then have cp':\"l!0=((Catch c1 c2),s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\"\n        using cptn_eq_cptn_mod_nest by auto         \n      have \\<Gamma>1:\"(\\<Gamma>, l) = c\" using c_prod cp by blast\n      have \"c \\<in> comm(G, (q,a)) F\"         \n      proof - \n      {       \n       have assum:\"snd(l!0) \\<in> p \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n                 (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n                 (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n       using a11 c_prod unfolding assum_def by simp\n       then have env_tran:\"env_tran \\<Gamma> p l R\" using env_tran_def cp by blast\n       then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n         using env_tran env_tran_right_def unfolding env_tran_def by auto       \n       have \"(\\<forall>i. Suc i<length l \\<longrightarrow> \n               (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                    (fst (l ! Suc i), toSeq (snd (l ! Suc i)))) \\<longrightarrow>                                             \n                 (snd(l!i), snd(l!(Suc i))) \\<in> G)\\<and>\n             (final_glob (last l)  \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>                   \n                   ((fst (last l) = Skip \\<and> snd (last l) \\<in> q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  a))\"\n       proof (cases \"\\<forall>i<length l. fst (l!i)\\<noteq> c2\")\n         case True \n         then have no_c2:\"\\<forall>i<length l. fst (l!i)\\<noteq> c2\" by assumption\n         show ?thesis\n         proof (cases \"final_glob (last l)\")\n           case True\n           then have  \"fst (last l) = Throw \\<or> fst (last l) = Skip \\<or> fst (last l) = Stuck \\<or> (\\<exists>f. fst (last l) = Fault f)  \"  \n             using final_glob_def by fast           \n           thus ?thesis\n           proof\n             assume \"fst (last l)= LanguageCon.com.Throw\" \n             then have \"False\" using  no_c2 env_tran_right cp' cptn_eq_cptn_mod_set Catch_sound3\n               by blast\n             thus ?thesis by auto\n           next             \n             assume asm0:\"fst (last l) = Skip \\<or> fst (last l) = Stuck \\<or> (\\<exists>f. fst (last l) = Fault f) \"             \n             then obtain lc1 ys where \n               cp_lc1:\"(\\<Gamma>,lc1) \\<in> cpn n \\<Gamma> c1 s \\<and> l = \n                       ((map (lift_catch c2) lc1)@((fst (last l),snd(last lc1))#ys))\"\n               using Catch_sound2[of n \\<Gamma> l c1 c2 s _ _ R] \n                     cp cptn_eq_cptn_mod_set env_tran_right no_c2\n               by force\n             then have cp_lc1':\"(\\<Gamma>,lc1) \\<in> cp \\<Gamma> c1 s\"\n               unfolding cpn_def cp_def\n               using cptn_if_cptn_mod cptn_mod_nest_cptn_mod by fastforce \n             let ?m_lc1 = \"map (lift_catch c2) lc1\"\n             let ?lm_lc1 = \"(length ?m_lc1)\"\n             let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\"              \n             have lc1_not_empty:\"lc1 \\<noteq> []\"\n               using \\<Gamma>1 a10' cpn_def cp_lc1 cp asm0 by force                 \n             then have map_cp:\"(\\<Gamma>,?m_lc1) \\<in> cpn n \\<Gamma> (Catch c1 c2) s\"               \n             proof -\n               have f1: \"lc1 ! 0 = (c1, s) \\<and> (n, \\<Gamma>, lc1) \\<in> cptn_mod_nest_call \\<and> \\<Gamma> = \\<Gamma>\"\n                 using cp_lc1 unfolding cpn_def by blast\n               then have f2: \"(n,\\<Gamma>, ?m_lc1) \\<in> cptn_mod_nest_call\" using lc1_not_empty\n                 by (metis Cons_lift_catch SmallStepCon.nth_tl cptn_mod_nest_call.CptnModNestCatch1)\n               then show ?thesis\n                 using f2 f1 lc1_not_empty by (simp add: cpn_def lift_catch_def)\n             qed\n             then have map_cp':\"(\\<Gamma>,?m_lc1) \\<in> cp \\<Gamma> (Catch c1 c2) s\" \n               unfolding cp_def cpn_def\n               using cp_lc1' lift_catch_is_cptn asm0 unfolding cp_def\n               by auto\n             also have map_assum:\"(\\<Gamma>,?m_lc1) \\<in> assum (p,R)\"\n               using sub_assum a10 a11 \\<Gamma>1 cp_lc1 lc1_not_empty \n               by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n             ultimately have \"((\\<Gamma>,lc1) \\<in> assum(p, R))\"  \n               using \\<Gamma>1 assum_map_catch cp_lc1' by blast                          \n             then have lc1_comm:\"(\\<Gamma>,lc1) \\<in> comm(G, (q,r)) F\"  \n               using a1 cp_lc1 by (meson IntI com_validityn_def contra_subsetD)\n             then have m_lc1_comm:\"(\\<Gamma>,?m_lc1) \\<in> comm(G, (q,r)) F\"\n               using map_cp map_assum comm_map_catch cp_lc1' map_cp' by blast\n             then have last_m_lc1:\"last (?m_lc1) = (Catch (fst (last lc1)) c2,snd (last lc1))\"\n             proof -\n               have a000:\"\\<forall>p c. (LanguageCon.com.Catch (fst p) c, snd p) = lift_catch c p\"\n                 using Cons_lift_catch by force\n               then show ?thesis\n                 by (simp add: last_map a000 lc1_not_empty)\n             qed\n             then have last_length:\"last (?m_lc1) = ?last_m_lc1\"  \n               using lc1_not_empty last_conv_nth list.map_disc_iff by blast \n             then have l_map:\"l!(?lm_lc1-1)= ?last_m_lc1\" \n               using cp_lc1 \n               by (metis (no_types, lifting) diff_less lc1_not_empty length_greater_0_conv \n                   map_is_Nil_conv nth_append zero_less_one)               \n             then have lm_lc1:\"l!(?lm_lc1) = (fst(last l), snd (last lc1))\"\n               using cp_lc1\n               by (metis nth_append_length) \n             have step_ce:\"\\<Gamma>\\<turnstile>\\<^sub>c(l!(?lm_lc1-1)) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(?lm_lc1))\"\n             proof -\n               have f1: \"0 \\<le> length ys\"\n                 by blast\n               moreover have  \"Suc (length (map (lift_catch c2) lc1) + length ys) = \n                    length (map (lift_catch c2) lc1 @ (fst(last l), snd (last lc1)) # ys)\"\n                 by force\n               ultimately show ?thesis\n                 by (metis (no_types) Suc_diff_1 Suc_eq_plus1 cp' cp_lc1 cptn_tran_ce_i \n                            lc1_not_empty le_add_same_cancel1 length_greater_0_conv \n                  less_Suc_eq_le list.map_disc_iff)\n             qed \n             then have step:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! (?lm_lc1-1)), toSeq (snd (l ! (?lm_lc1-1)))) \\<rightarrow> \n                             (fst (l ! ?lm_lc1), toSeq (snd (l ! (?lm_lc1)))))\"\n               using l_map last_m_lc1 lm_lc1 local.last_length \n                     not_eq_not_env step_ce_dest asm0 \n               by (metis LanguageCon.com.distinct(149) LanguageCon.com.distinct(173)\n                         LanguageCon.com.distinct(23)  fstI sndI)\n             have last_lc1_suc:\"snd (l!(?lm_lc1-1)) = snd (l!?lm_lc1)\"\n               using l_map  last_m_lc1 lm_lc1 local.last_length by force\n             then have eq_to_seq:\"toSeq (snd (l ! (length (map (lift_catch c2) lc1) - 1))) = \n                                  toSeq (snd (l ! (length (map (lift_catch c2) lc1))))\"\n               by simp\n             then have step':\"\\<Gamma>\\<turnstile>\\<^sub>c (LanguageCon.com.Catch (fst (last lc1)) c2, toSeq (snd (l ! (?lm_lc1-1)))) \\<rightarrow>\n                             (fst (last l), toSeq (snd (l ! (?lm_lc1)))) \"\n               using lm_lc1 step\n               using l_map last_m_lc1 local.last_length by auto\n             then have eq_l:\"snd (l ! (length (map (lift c2) lc1) - 1)) =snd (l ! (length (map (lift c2) lc1)))\"\n               using step_ce_Normal_eq_l step_ce step' step_ce_eq  eq_to_seq \n                     l_map last_m_lc1 lm_lc1 local.last_length by fastforce                \n             then have step_catch:\"\\<Gamma>\\<turnstile>\\<^sub>c(Catch (fst (last lc1)) c2,toSeq (snd (last lc1))) \\<rightarrow> (fst (last l), toSeq(snd (last lc1)))\"               \n               using l_map last_m_lc1 lm_lc1 local.last_length local.step'\n               by auto \n             then have \n               last_lc1:\"(fst (last lc1) = Skip \\<and> fst (last l) = Skip) \\<or>                          \n                         (fst (last lc1) = Stuck \\<and> fst (last l) = Stuck) \\<or> \n                          (\\<exists>f. fst (last lc1) = Fault f \\<and> fst (last l) = Fault f)\"\n               using asm0 \n               apply (cases \"fst (last l)\", auto) \n               using stepc_elim_cases_Catch_skip_2(1) no_c2\n                 apply (metis One_nat_def append_is_Nil_conv cp_lc1 diff_Suc_less \n                        last_conv_nth length_greater_0_conv list.distinct(1)) \n                using stepc_elim_cases_Catch_skip_2(3) no_c2\n                 apply (metis One_nat_def append_is_Nil_conv cp_lc1 diff_Suc_less last_conv_nth \n                        length_greater_0_conv list.distinct(1)) \n                using stepc_elim_cases_Catch_skip_2(4) no_c2 \n                by (metis One_nat_def append_is_Nil_conv cp_lc1 diff_Suc_less last_conv_nth \n                        length_greater_0_conv list.distinct(1))                 \n             have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n               (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n               (fst (l ! Suc i), toSeq (snd (l ! Suc i)))) \\<longrightarrow>              \n                 (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n             proof-\n             { fix k ns ns'\n               assume a00:\"Suc k<length l\" and\n                a21:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l !k), toSeq (snd (l ! k))) \\<rightarrow> \n                        (fst (l ! Suc k), toSeq (snd (l ! Suc k))))\"   \n                then have i_m_l:\"\\<forall>i <?lm_lc1  . l!i = ?m_lc1!i\" \n                  using cp_lc1\n                proof -\n                  have \"map (lift c2) lc1 \\<noteq> []\"\n                    by (meson lc1_not_empty list.map_disc_iff)\n                  then show ?thesis\n                    by (metis (no_types) cp_lc1  nth_append)\n                qed                                                         \n                have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n                proof (cases \"Suc k< ?lm_lc1\")\n                  case True \n                  then have a11': \"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (?m_lc1!k), toSeq (snd (?m_lc1!k))) \\<rightarrow> \n                                    (fst (?m_lc1!(Suc k)), toSeq (snd (?m_lc1!(Suc k)))))\" \n                    using a11 i_m_l True\n                  proof -\n                    have \"\\<forall>n na. \\<not> 0 < n - Suc na \\<or> na < n \"\n                      using diff_Suc_eq_diff_pred zero_less_diff by presburger\n                    then show ?thesis\n                      by (metis (no_types) True a21 i_m_l zero_less_diff)\n                  qed                 \n                  then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\<in> G\"\n                  using a11' m_lc1_comm True comm_dest1  last_not_F by fastforce\n                  thus ?thesis using i_m_l True by auto  \n                next\n                  case False \n                  then have \"(Suc k=?lm_lc1) \\<or> (Suc k>?lm_lc1)\" by auto\n                  thus ?thesis \n                  proof\n                    {assume suck:\"(Suc k=?lm_lc1)\"\n                     then have k:\"k=?lm_lc1-1\" by auto\n                     (* then obtain s1' where s1'_normal:\"snd(l!?lm_lc1) = Normal s1'\"\n                       using q_normal by fastforce\n                     have G_s1':\"(Normal s1', Normal s1')\\<in> G\" using a5 by blast *)\n                     then show \"(snd (l!k), snd (l!Suc k)) \\<in> G\" using a5 k last_lc1_suc \n                       unfolding N_def\n                       by (metis (mono_tags, lifting) a00 assum cp' \n                           cptn_all_len_eq_0 mem_Collect_eq suck)                        \n                    }\n                  next\n                  { \n                    assume a001:\"Suc k>?lm_lc1\"\n                    have \"\\<forall>i. i\\<ge>(length lc1) \\<and> (Suc i < length l) \\<longrightarrow> \n                            \\<not>((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                              (fst (l ! Suc i), toSeq (snd (l ! Suc i)))))\"\n                    using lm_lc1 lc1_not_empty\n                    proof -\n                      have \"env_tran_right \\<Gamma>1 l R\"\n                        by (metis cp env_tran_right)\n                      then show ?thesis \n                        using  cp' fst_conv length_map lm_lc1 a001 a21 a00 a4\n                        by (metis asm0 cp' fst_conv length_map lm_lc1 only_one_component_tran_j) \n\n                    qed\n                    then have \"\\<not>((\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                              (fst (l ! Suc k), toSeq (snd (l ! Suc k)))))\"\n                      using a00 a001 by auto                    \n                    then show ?thesis using a21 by fastforce                    \n                  }\n                  qed \n                qed\n              } thus ?thesis by auto \n             qed \n             have concr:\"(final_glob (last l)  \\<longrightarrow>    fst (last l) \\<notin> Fault ` F \\<longrightarrow>                  \n                   ((fst (last l) = Skip \\<and> snd (last l) \\<in> q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> a))\" \n             proof -\n               { assume a00:\"final_glob (last l)\" and a01:\"fst (last l)\\<notin> Fault ` F\" \n               (* have l_t:\"fst (last l) = Skip\" \n                 using lm_lc1 by (simp add: asm0) *)\n                 have lm_lc1_len:\"?lm_lc1 \\<le> length l -1\" using cp_lc1\n                   by (metis (no_types, hide_lams) Ex_list_of_length Suc_pred' add_diff_cancel_left' append_is_Nil_conv \n                         diff_is_0_eq' leI length_Cons length_append length_greater_0_conv \n                    less_Suc_eq_le less_irrefl)  \n                 have f_lc1:\"final_glob (last lc1)\"\n                   using final_glob_def last_lc1 by blast\n                 moreover have \"fst (last lc1) \\<notin> Fault ` F\"\n                   using a01 last_lc1 by auto \n                 moreover have eq:\"(l ! length (map (lift_catch c2) lc1)) = last lc1\"\n                   using last_lc1 lm_lc1 \n                   by (metis lm_lc1 prod.exhaust_sel)\n                 ultimately have h:\"fst (last lc1) = Skip \\<and> snd (last lc1) \\<in> q \\<or>\n                                 fst (last lc1) = Throw \\<and> snd (last lc1) \\<in> a\" \n                   using lc1_comm  unfolding comm_def\n                   using last_lc1 by auto\n                 { assume \"fst (last l) = com.Stuck \\<or> (\\<exists>f. fst (last l) = com.Fault f)\"\n                   then have False\n                     using h last_lc1 by auto\n                   then have \"(fst (last l) = Skip \\<and> snd (last l) \\<in> q) \\<or>\n                            (fst (last l) = Throw \\<and> snd (last l) \\<in> a)\"\n                     by blast                   \n                 }\n                 moreover { assume \"fst (last l) = Skip\"\n                   then have a_normal:\"snd (l!?lm_lc1) \\<in> q\" using h\n                     using a00 l_map last_lc1_suc last_lc1 last_m_lc1 local.last_length\n                     by auto \n                   then have \"snd (l ! (length l - 1)) \\<in>  q\" using   a4     \n                           f_lc1[simplified eq[THEN sym]] lm_lc1_len    cp'  \n                           i_final_all_stable[OF _ _ lm_lc1_len _ env_tran_right a4 a_normal]\n                     by force                                 \n                   then have \"(fst (last l) = Skip \\<and> snd (last l) \\<in> q) \\<or>\n                            (fst (last l) = Throw \\<and> snd (last l) \\<in> a)\"\n                     using h lm_lc1_len last_m_lc1\n                   proof -\n                     have \"snd (last l) \\<in> q\"\n                       by (metis \\<open>snd (l ! (length l - 1)) \\<in> q\\<close> append_is_Nil_conv cp_lc1 last_conv_nth list.simps(3))\n                     then show ?thesis\n                       using \\<open>fst (last l) = LanguageCon.com.Skip\\<close> by presburger\n                   qed\n                 }                             \n                 ultimately have \"(fst (last l) = Skip \\<and> snd (last l) \\<in> q) \\<or>\n                            (fst (last l) = Throw \\<and> snd (last l) \\<in> a)\" \n                   using asm0 by auto\n             } thus ?thesis by auto\n             qed\n             note res = conjI [OF concl concr]\n             then show ?thesis using  \\<Gamma>1 c_prod unfolding comm_def by auto\n           qed                  \n         next\n           case False\n           then obtain lc1 where cp_lc1:\"(\\<Gamma>,lc1) \\<in> cpn n \\<Gamma> c1 s \\<and> l = map (lift_catch c2) lc1\" \n             using Catch_sound1 False no_c2 env_tran_right cp cptn_eq_cptn_mod_set \n             by blast \n           then have cp_lc1':\"(\\<Gamma>,lc1) \\<in> cp \\<Gamma> c1 s\" \n             unfolding cpn_def cp_def\n             using cptn_eq_cptn_mod_nest by fastforce\n           then have \"((\\<Gamma>,lc1) \\<in> assum(p, R))\"  \n              using \\<Gamma>1  a10' a11 assum_map_catch cp_lc1\n              by blast\n           then have \"(\\<Gamma>, lc1)\\<in> comm(G, (q,r)) F\" using cp_lc1 a1\n             by (meson IntI com_validityn_def contra_subsetD)\n           then have \"(\\<Gamma>, l)\\<in> comm(G, (q,r)) F\"\n             using comm_map_catch a10' \\<Gamma>1 cp_lc1 cp_lc1' by fastforce\n           then show ?thesis using  False\n             unfolding comm_def by force\n         qed\n       next         \n         case False \n         then obtain k where k_len:\"k<length l \\<and> fst (l ! k) = c2\"\n           by blast         \n         then have \"\\<exists>m. (m < length l \\<and> fst (l ! m) = c2) \\<and>\n                   (\\<forall>i<m. \\<not> (i < length l \\<and> fst (l ! i) = c2))\"   \n           using a0 exists_first_occ[of \"(\\<lambda>i. i<length l  \\<and> fst (l ! i) = c2)\" k] \n           by blast\n         then obtain i where a0:\"i<length l \\<and> fst (l !i) = c2 \\<and>\n                                (\\<forall>j<i. (fst (l ! j) \\<noteq> c2))\"\n           by fastforce        \n         then obtain s2 where li:\"l!i =(c2,s2)\" by (meson eq_fst_iff)\n         then obtain lc1 lc2 where cp_lc1:\"(\\<Gamma>,lc1) \\<in> (cpn n \\<Gamma> c1 s) \\<and> \n                                 (\\<Gamma>,lc2) \\<in> (cpn n \\<Gamma> c2 (snd (lc1!(i-1)))) \\<and> \n                                 l = (map (lift_catch c2) lc1)@lc2\"\n           using Catch_sound4 a0 cp env_tran_right by blast       \n         then have cp_lc1':\"(\\<Gamma>,lc1) \\<in> (cp \\<Gamma> c1 s) \\<and> \n                            (\\<Gamma>,lc2) \\<in> (cp \\<Gamma> c2 (snd (lc1!(i-1))))\"\n           unfolding cp_def cpn_def  using cptn_eq_cptn_mod_nest by fastforce         \n         have length_c1_map:\"length lc1 = length (map (lift_catch c2) lc1)\" \n           by fastforce      \n         then have i_map:\"i=length lc1\" \n           using cp_lc1 li a0 unfolding lift_catch_def \n         proof -\n           assume a1: \"(\\<Gamma>, lc1) \\<in> cpn n \\<Gamma> c1 s \\<and> (\\<Gamma>, lc2) \\<in> cpn n \\<Gamma> c2 (snd (lc1 ! (i - 1))) \\<and> \n                      l = map (\\<lambda>(P, s). (Catch P c2, s)) lc1 @ lc2\"\n            have f2: \"i < length l \\<and> fst (l ! i) = c2 \\<and> (\\<forall>n. \\<not> n < i \\<or> fst (l ! n) \\<noteq> c2)\"\n              using a0 by blast\n            have f3: \"(Catch (fst (lc1 ! i)) c2, snd (lc1 ! i)) = lift_catch c2 (lc1 ! i)\"\n              by (simp add: case_prod_unfold lift_catch_def)            \n            then have \"fst (l ! length lc1) = c2\"\n              using a1 by (simp add: cpn_def nth_append)\n            thus ?thesis\n              using f3 f2\n              by (metis (no_types, lifting) Pair_inject a0 cp_lc1 f3 \n                   length_c1_map li linorder_neqE_nat nth_append nth_map seq_and_if_not_eq(12))\n         qed                  \n         have lc2_l:\"\\<forall>j<length lc2. lc2!j=l!(i+j)\"\n           using cp_lc1 length_c1_map i_map a0\n           by (metis nth_append_length_plus)                                                             \n         have lc1_not_empty:\"lc1 \\<noteq> []\"\n           using cp cp_lc1 unfolding cpn_def by fastforce      \n         have lc2_not_empty:\"lc2 \\<noteq> []\"\n           using cpn_def cp_lc1 a0 i_map by force              \n         have l_is:\"s2= snd (last lc1)\"\n         using cp_lc1 li a0 lc1_not_empty unfolding cpn_def\n         by (auto simp add: i_map last_conv_nth lc2_l)\n         let ?m_lc1 = \"map (lift_catch c2) lc1\"\n         (* let ?lm_lc1 = \"(length ?m_lc1)\"\n         let ?last_m_lc1 = \"?m_lc1!(?lm_lc1-1)\" *)                         \n         have last_m_lc1:\"l!(i-1) = (Catch (fst (last lc1)) c2,s2)\"\n           using i_map  cp_lc1 l_is last_lift_catch last_snd_catch lc1_not_empty length_c1_map           \n           by (metis (no_types, lifting) One_nat_def diff_Suc_less last_conv_nth \n                  length_greater_0_conv nth_append prod.collapse)\n         (* have last_mcl1_not_F:\"snd (last ?m_lc1) \\<notin> Fault ` F\"\n           by (metis One_nat_def i_not_fault l_is last_conv_nth last_snd_catch li list.map_disc_iff snd_conv) *)\n         have map_cp:\"(\\<Gamma>,?m_lc1) \\<in> cpn n \\<Gamma> (Catch c1 c2) s\"               \n         proof -\n           have f1: \"lc1 ! 0 = (c1, s) \\<and> (n,\\<Gamma>, lc1) \\<in> cptn_mod_nest_call \\<and> \\<Gamma> = \\<Gamma>\"\n             using cp_lc1 cpn_def by blast\n           then have f2: \"(n, \\<Gamma>, ?m_lc1) \\<in> cptn_mod_nest_call\" using lc1_not_empty\n             by (metis Cons_lift_catch SmallStepCon.nth_tl cptn_mod_nest_call.CptnModNestCatch1)                           \n           then show ?thesis\n             using f2 f1 lc1_not_empty by (simp add: cpn_def lift_catch_def)\n         qed\n         then have map_cp':\"(\\<Gamma>,?m_lc1) \\<in> cp \\<Gamma> (Catch c1 c2) s\"\n           unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by fastforce\n         also have map_assum:\"(\\<Gamma>,?m_lc1) \\<in> assum (p,R)\"\n           using sub_assum a10 a11 \\<Gamma>1 cp_lc1 lc1_not_empty \n           by (metis SmallStepCon.nth_tl map_is_Nil_conv)\n         ultimately have \"((\\<Gamma>,lc1) \\<in> assum(p, R))\"  \n           using \\<Gamma>1 assum_map_catch using assum_map cp_lc1 cp_lc1' by blast                          \n         then have lc1_comm:\"(\\<Gamma>,lc1) \\<in> comm(G, (q,r)) F\"  \n           using a1 cp_lc1 by (meson IntI com_validityn_def contra_subsetD)\n         then have m_lc1_comm:\"(\\<Gamma>,?m_lc1) \\<in> comm(G, (q,r)) F\"\n           using map_cp' map_assum comm_map_catch cp_lc1 cp_lc1'  by blast         \n         then have i_step:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! (i-1)), toSeq (snd (l ! (i-1)))) \\<rightarrow> \n                         (fst (l ! i), toSeq (snd (l ! i))))\"\n         proof -\n           have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!(i-1)) \\<rightarrow>\\<^sub>c\\<^sub>e (l!(i))\"\n             by (metis Suc_eq_plus1 Suc_pred' a0 cp' cptn_tran_ce_i i_map \n                  lc1_not_empty length_greater_0_conv)\n           moreover have \"\\<not>\\<Gamma>\\<turnstile>\\<^sub>c(l!(i-1)) \\<rightarrow>\\<^sub>e (l!i)\"           \n             using li last_m_lc1\n             by (metis (no_types, lifting) env_c_c' seq_and_if_not_eq(12))\n           ultimately show ?thesis using step_ce_dest\n             by (metis prod.exhaust_sel)\n         qed         \n         then have step:\"\\<Gamma>\\<turnstile>\\<^sub>c(Catch (fst (last lc1)) c2,toSeq s2) \\<rightarrow> (c2, toSeq s2)\"\n           using last_m_lc1  li by fastforce\n         then have\n           last_lc1:\"fst (last lc1) = Skip \\<or> \n            fst (last lc1) = Throw \\<or> fst (last lc1) = Stuck \\<or> (\\<exists>f. fst(last lc1) = Fault f)\"            \n           by (meson catch_skip_throw)   \n         have final:\"final_glob (last lc1)\" \n           using last_lc1 l_is unfolding final_glob_def by fastforce        \n         have Gs2':\" (s2, s2)\\<in>G\" using a5 unfolding N_def\n           by (metis (mono_tags, lifting) a0 assum cp' cptn_all_len_eq_0 li mem_Collect_eq snd_conv)               \n         have concl:\n           \"(\\<forall>i. Suc i<length l \\<longrightarrow> \n           (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                 (fst (l ! (Suc i)), toSeq (snd (l ! (Suc i))))) \\<longrightarrow>                              \n             (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n         proof-\n         { fix k ns ns'\n           assume a00:\"Suc k<length l\" and\n            a21:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                      (fst (l !(Suc k)), toSeq (snd (l ! (Suc k)))))\"   \n            have i_m_l:\"\\<forall>j <i . l!j = ?m_lc1!j\"             \n            proof -\n              have \"map (lift c2) lc1 \\<noteq> []\"\n                by (meson lc1_not_empty list.map_disc_iff)\n              then show ?thesis \n                using cp_lc1 i_map length_c1_map by (fastforce simp:nth_append)              \n            qed \n            have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n            proof (cases \"Suc k< i\")\n              case True \n              then have a11': \"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (?m_lc1 ! k), toSeq (snd (?m_lc1 ! k))) \\<rightarrow> \n                                    (fst (?m_lc1 ! Suc k), toSeq (snd (?m_lc1 ! Suc k))))\" \n                using a11 i_m_l True\n              proof -\n                have \"\\<forall>n na. \\<not> 0 < n - Suc na \\<or> na < n \"\n                  using diff_Suc_eq_diff_pred zero_less_diff by presburger\n                then show ?thesis using True a21 i_m_l by force                  \n              qed                                                             \n              have \"Suc k < length ?m_lc1\" using True i_map length_c1_map by metis\n              then have \"(snd(?m_lc1!k), snd(?m_lc1!(Suc k))) \\<in> G\"\n              using a11'  m_lc1_comm True i_map length_c1_map comm_dest1[of \\<Gamma>] \n                by blast\n              thus ?thesis using i_m_l True by auto  \n            next\n              case False                                            \n              have \"(Suc k=i) \\<or> (Suc k>i)\" using False by auto\n              thus ?thesis \n              proof\n              { assume suck:\"(Suc k=i)\" \n                then have k:\"k=i-1\" by auto                                                            \n                then show \"(snd (l!k), snd (l!Suc k)) \\<in> G\"\n                  using Gs2'  last_m_lc1 li suck by auto               \n              }\n              next\n              { \n                assume a001:\"Suc k>i\"\n                then have k:\"k\\<ge>i\" by fastforce\n                then obtain k' where k':\"k=i+k'\" \n                  using add.commute le_Suc_ex by blast\n                {assume skip:\"c2=Skip  \\<or> c2 = Stuck \\<or> (\\<exists>f. c2 = Fault f)\"\n                 then have \"\\<forall>k. k\\<ge>i \\<and> (Suc k < length l) \\<longrightarrow> \n                            \\<not>(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                                  (fst (l ! Suc k), toSeq (snd (l ! Suc k))))\"\n                  using  li  a21 a001 a00 a4\n                        a0 skip env_tran_right cp'\n                  using only_one_component_tran_j by blast                                      \n                 then have ?thesis using a21 a001 k a00 by blast\n                }  note left=this\n                {assume \"\\<not>(c2=Skip  \\<or> c2 = Stuck \\<or> (\\<exists>f. c2 = Fault f))\"\n                 then have \"fst (last lc1) = Throw\"\n                   using last_m_lc1 last_lc1\n                   by (meson catch_skip_throw local.step)                                     \n                 then have s2_normal:\"s2 \\<in>  r\" \n                   using l_is li final comm_dest2 lc1_comm by fastforce                                      \n                 have length_lc2:\"length l=i+length lc2\" \n                       using i_map cp_lc1 by fastforce\n                 have \"(\\<Gamma>,lc2) \\<in>  assum (r,R)\" \n                 proof -\n                   have left:\"snd (lc2!0) \\<in>  r\" \n                     using li lc2_l s2_normal lc2_not_empty by fastforce \n                   {\n                     fix j\n                     assume j_len:\"Suc j<length lc2\" and\n                            j_step:\"\\<Gamma>\\<turnstile>\\<^sub>c(lc2!j)  \\<rightarrow>\\<^sub>e (lc2!(Suc j))\"                     \n                     then have suc_len:\"Suc (i + j)<length l\" using j_len length_lc2\n                       by fastforce\n                     also then have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!(i+j))  \\<rightarrow>\\<^sub>e (l! (Suc (i+ j)))\"\n                        using lc2_l j_step j_len by fastforce\n                     ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\<in> R\"\n                        using assum suc_len lc2_l j_len cp by fastforce \n                   }\n                   then show ?thesis using left \n                     unfolding assum_def by fastforce\n                 qed\n                 also have \"(\\<Gamma>,lc2) \\<in> cpn n \\<Gamma> c2 s2\"\n                   using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce                 \n                 ultimately have comm_lc2:\"(\\<Gamma>,lc2) \\<in>  comm (G, (q,a)) F\"\n                   using a3 unfolding com_validityn_def by blast\n                 (* have lc2_last_f:\"snd (last lc2)\\<notin> Fault ` F\" \n                   using lc2_l lc2_not_empty l_f cp_lc1 by fastforce *)\n                 have suck':\"Suc k' < length lc2\" \n                   using k' a00 length_lc2 by arith\n                 moreover then have \"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (lc2 ! k'), toSeq (snd (lc2 ! k'))) \\<rightarrow> \n                                          (fst (lc2 ! Suc k'), toSeq (snd (lc2 ! Suc k'))))\"  \n                   using k' lc2_l a21 by fastforce                 \n                 ultimately have \"(snd (lc2! k'), snd (lc2 ! Suc k')) \\<in> G\"\n                   using comm_lc2  comm_dest1[of \\<Gamma> lc2 G q a F k'] \n                   by blast\n                 then have ?thesis using suck' lc2_l k' by fastforce\n                }                    \n                then show ?thesis using left by auto                 \n              }\n              qed \n            qed\n          } thus ?thesis by auto \n         qed note left=this\n         have right:\"(final_glob (last l)  \\<longrightarrow>    fst (last l) \\<notin> Fault ` F \\<longrightarrow>              \n                   ((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> (a)))\"\n         proof -\n         { assume final_l:\"final_glob (last l)\" and a002:\"fst (last l) \\<notin> Fault ` F \"\n           have eq_last_lc2_l:\"last l=last lc2\" by (simp add: cp_lc1 lc2_not_empty)\n           then have final_lc2:\"final_glob (last lc2)\" using final_l by auto\n           {\n             assume lst_lc1_skip:\"fst (last lc1) = Skip\"                        \n             then have c2_skip:\"c2 = Skip\" \n               using  step  LanguageCon.com.distinct(17) last_lc1\n               using catch_skip_throw by force \n                                          \n             have Skip:\"fst (l!(length l - 1)) = Skip\"\n             using li   env_tran_right cp' c2_skip a0\n                     i_skip_all_skip[of \\<Gamma> l i \"(length l) - 1\"] \n                by fastforce                       \n             have s2_a:\"s2 \\<in>  q\"\n               using comm_des3 final l_is lc1_comm lst_lc1_skip by fastforce\n             then have \"\\<forall>ia. i \\<le> ia \\<and> ia < length l - 1 \\<longrightarrow> \\<Gamma>\\<turnstile>\\<^sub>c (l ! ia) \\<rightarrow>\\<^sub>e (l ! Suc ia)\"\n               using c2_skip li  a0 cp' env_tran_right  \n                     cptn_tran_ce_i i_skip_all_skip  step_ce_dest \n               unfolding final_glob_def\n               by (metis (no_types, lifting) Suc_eq_plus1 Suc_lessD \n                    less_diff_conv prod.exhaust_sel stepc_elim_cases(1))                                       \n             then have \"snd (l!(length l - 1)) \\<in>  q \\<and> fst (l!(length l - 1)) = Skip\"               \n               using a0 s2_a li a4 env_tran_right stability[of q R l i \"(length l) -1\" _ \\<Gamma>] Skip\n               using c2_skip by fastforce\n             then have \"((fst (last l) = Skip \\<and> snd (last l) \\<in> q)) \\<or>\n                    (fst (last l) = Throw \\<and>  snd (last l) \\<in>  a)\" \n              using a0 by (metis last_conv_nth list.size(3) not_less0)                           \n          } \n          moreover {  assume \"fst (last lc1) = Throw\"                 \n             then have s2_normal:\"s2 \\<in>  r\"\n               using comm_dest2 final l_is lc1_comm by fastforce\n             have length_lc2:\"length l=i+length lc2\" \n                   using i_map cp_lc1 by fastforce\n             have \"(\\<Gamma>,lc2) \\<in>  assum (r,R)\" \n             proof -\n               have left:\"snd (lc2!0) \\<in> r\" \n                 using li lc2_l s2_normal lc2_not_empty by fastforce \n               {\n                 fix j\n                 assume j_len:\"Suc j<length lc2\" and\n                        j_step:\"\\<Gamma>\\<turnstile>\\<^sub>c(lc2!j)  \\<rightarrow>\\<^sub>e (lc2!(Suc j))\"\n                 \n                 then have suc_len:\"Suc (i + j)<length l\" using j_len length_lc2\n                   by fastforce\n                 also then have \"\\<Gamma>\\<turnstile>\\<^sub>c(l!(i+j))  \\<rightarrow>\\<^sub>e (l! (Suc (i+ j)))\"\n                    using lc2_l j_step j_len by fastforce\n                 ultimately have \"(snd(lc2!j), snd(lc2!(Suc j))) \\<in> R\"\n                    using assum suc_len lc2_l j_len cp by fastforce \n               }\n               then show ?thesis using left \n                 unfolding assum_def by fastforce\n             qed\n             also have \"(\\<Gamma>,lc2) \\<in> cpn n \\<Gamma> c2 s2\"\n               using cp_lc1 i_map l_is last_conv_nth lc1_not_empty by fastforce\n             ultimately have comm_lc2:\"(\\<Gamma>,lc2) \\<in>  comm (G, (q,a)) F\"\n               using a3 unfolding com_validityn_def\n               by blast\n             have lc2_last_f:\"fst (last lc2)\\<notin> Fault ` F\"                \n               using a002 eq_last_lc2_l by force             \n             then have \"((fst (last lc2) = Skip \\<and> snd (last lc2) \\<in> q)) \\<or>\n                    (fst (last lc2) = Throw \\<and> snd (last lc2) \\<in> a)\" \n             using final_lc2 comm_lc2 unfolding comm_def by auto\n             then have \"((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> a)\" \n             using eq_last_lc2_l by auto\n          }\n          moreover{\n             assume \"fst (last lc1) = Stuck\"             \n             then have  \"((fst (last l) = Skip \\<and> snd (last l) \\<in> q)) \\<or>\n                       (fst (last l) = Throw \\<and> snd (last l) \\<in>  a)\"\n               by (metis (no_types) com.distinct(13) com.distinct(145) \n                   com.distinct(147) comm_des3 final image_iff lc1_comm)            \n           }\n           moreover { \n             assume \"(\\<exists>f. fst (last lc1) = Fault f)\"\n             then have  \"((fst (last l) = Skip \\<and> snd (last l) \\<in> q)) \\<or>\n                       (fst (last l) = Throw \\<and> snd (last l) \\<in>  a)\"\n               by (metis LanguageCon.com.distinct(171) LanguageCon.com.simps(31) \n                     LocalRG_HoareDef.stepc_elim_cases_Catch_skip_c2 a0 a002 comm_dest2 cp' \n                   final last_not_F lc1_comm local.step)\n           }\n           ultimately have \"((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> a)\" \n           using last_lc1 by blast\n        } thus ?thesis by auto qed         \n     thus ?thesis using left  \\<Gamma>1 unfolding comm_def by force       \n       qed             \n     } thus ?thesis using \\<Gamma>1 unfolding comm_def by auto qed\n   } thus ?thesis by auto qed \n } thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\n\n\nlemma DynCom_sound: \n      \"(\\<forall>s \\<in> fst ` p. ((\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]) \\<and> \n                 (\\<forall>n. (\\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (c1 s) sat [p,R, G, q,a])))) \\<Longrightarrow>\n       \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow>\n       (Sta p R) \\<and> (Sta q R) \\<and> (Sta a R) \\<Longrightarrow>        \n        \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (DynCom c1) sat [p,  R, G, q,a]\"\nproof -  \n  assume\n    a0:\"(\\<forall>s \\<in> fst ` p. ((\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]) \\<and> \n                 (\\<forall>n. (\\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]))))\" and    \n    a1:\"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\" and  \n    a2: \"(Sta p R) \\<and> (Sta q R) \\<and> (Sta a R)\"               \n  { \n    fix s\n    assume all_DynCom:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"     \n    then have a0:\"(\\<forall>s \\<in> fst ` p. (\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (c1 s) sat [p, R, G, q,a]))\"\n      using a0 unfolding com_cvalidityn_def by fastforce     \n    have \"cpn n \\<Gamma>(DynCom c1) s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof -\n    {   \n      fix c     \n      assume a10:\"c \\<in> cpn n \\<Gamma> (DynCom c1) s\" and a11:\"c \\<in> assum(p, R)\"\n      then have a10':\"c \\<in> cp \\<Gamma> (DynCom c1) s\"\n        unfolding cp_def cpn_def\n        using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n      obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n      have \"c \\<in> comm(G, (q,a)) F\"      \n      proof - \n        {       \n        have cp:\"l!0=(DynCom c1,s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" \n          using a10' cp_def c_prod by fastforce\n        have \\<Gamma>1:\"(\\<Gamma>, l) = c\" using c_prod cp by blast\n        have assum:\"snd(l!0) \\<in>  (p) \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n                 (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n                   (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n       using a11 c_prod unfolding assum_def by simp\n       then have env_tran:\"env_tran \\<Gamma> p l R\" using env_tran_def cp by blast\n       then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n         using env_tran env_tran_right_def unfolding env_tran_def by auto\n       have s_normal:\"s \\<in> p\" \n         using cp assum by fastforce       \n       have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n               (\\<Gamma>1\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                  (fst (l ! Suc i), toSeq (snd (l ! Suc i)))) \\<longrightarrow>             \n                 (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n       proof -\n       { fix k \n         assume a00:\"Suc k<length l\" and\n                a21:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                    (fst (l ! Suc k), toSeq (snd (l ! Suc k)))\"                                     \n         obtain j where before_k_all_evnt:\"j\\<le>k \\<and>  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                                                        (fst (l ! Suc j), toSeq (snd (l ! Suc j)))) \\<and> \n                                            (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n           using a00 a21 exist_first_comp_tran cp by blast\n         then obtain cj sj csj ssj where \n            pair_j:\"(\\<Gamma>\\<turnstile>\\<^sub>c(cj,sj)  \\<rightarrow> (csj,ssj)) \\<and> \n                     cj = fst (l!j) \\<and> sj = toSeq (snd (l!j)) \\<and> \n                     csj = fst (l!(Suc j)) \\<and> ssj = toSeq(snd(l!(Suc j)))\"\n           by fast      \n         have k_basic1:\"cj = (DynCom c1) \\<and> snd(l!j) \\<in> (p)\" \n           using  pair_j before_k_all_evnt a2 cp env_tran_right  assum a00 stability[of p R l 0 j j \\<Gamma>]\n           by force\n         have k_basic:\"cj = (DynCom c1) \\<and> sj \\<in> (fst ` p)\" \n           using  pair_j before_k_all_evnt a2 cp env_tran_right  assum a00 stability[of p R l 0 j j \\<Gamma>]\n           by force\n         then have ss:\"sj \\<in> (fst ` p)\" by auto \n         moreover have ssj_normal_s:\"ssj = sj\" \n           using before_k_all_evnt k_basic pair_j a0 calculation\n           by (metis snd_conv stepc_elim_cases(10))      \n         ultimately obtain sl where \n           lj:\"snd (l!j) =  (sj, sl) \\<and> snd (l!(Suc j)) =  (sj, sl)\"\n           using  cp  l2[of \\<Gamma> \"fst (l ! j)\" \"snd (l ! j)\" \"fst (l ! Suc j)\" \"snd (l ! Suc j)\"] a00\n           using before_k_all_evnt pair_j  by fastforce           \n         have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n           using ss a2 unfolding Satis_def\n         proof (cases \"k=j\")   \n           case True                                  \n           have \"((sj,sl),  (sj,sl))\\<in>G\" using a1 unfolding N_def\n             using k_basic1 lj by fastforce\n           thus \"(snd (l ! k), snd (l ! Suc k)) \\<in>  G\"\n             using pair_j k_basic True ss ssj_normal_s lj  True         \n             by fastforce           \n         next\n           case False   \n           have j_k:\"j<k\" using  before_k_all_evnt False by fastforce                      \n           thus \"(snd (l ! k), snd (l ! Suc k)) \\<in> G\"\n           proof -\n             have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n             have p1:\"sj\\<in>fst ` p \\<and> ssj= sj\" using ss ssj_normal_s by fastforce\n             then have c1_valid:\"(\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (c1 sj) sat [p, R, G, q,a])\"\n               using a0 by fastforce\n             have cj:\"csj= (c1 sj)\" using k_basic pair_j ss a0 s_normal\n             proof -\n               have \"\\<Gamma>\\<turnstile>\\<^sub>c (LanguageCon.com.DynCom c1, sj) \\<rightarrow> (csj, ssj)\"\n                 using k_basic pair_j ss by force\n               then have \"(csj, ssj) = (c1 sj, sj)\"\n                 by (meson stepc_elim_cases(10))\n               then show ?thesis\n                 by blast\n             qed                                                       \n             moreover then have \"cpn n \\<Gamma> csj ((sj, sl)) \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n               using a2 com_validityn_def cj p1 c1_valid by blast             \n             moreover then have \"l!(Suc j) = (csj,  (sj,sl))\" \n               using before_k_all_evnt pair_j cj ssj_normal_s lj\n               by (metis prod.exhaust_sel)                \n             ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n               using  p1 j_length  a11 \\<Gamma>1  ssj_normal_s a10 k_basic1 lj\n               cpn_assum_induct[of \\<Gamma> l n \"LanguageCon.com.DynCom c1\" s p R \"Suc j\" \"c1 sj\" \"(sj,sl)\" p]\n                by auto                           \n             then show ?thesis \n             using a00 a21  a10' \\<Gamma>1  j_k j_length  \n             cptn_comm_induct[of \\<Gamma> l \"DynCom c1\" s _ \"Suc j\" G q a F k ]\n             unfolding Satis_def by fastforce                         \n          qed            \n       qed \n       } thus ?thesis by (simp add: c_prod cp) qed\n       have concr:\"(final_glob (last l)  \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>                   \n                   ((fst (last l) = Skip \\<and> snd (last l) \\<in> q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  (a)))\"\n       proof-\n       { \n         assume valid:\"final_glob (last l)\"  and final_fault: \"fst (last l) \\<notin> Fault ` F\"                     \n         have \"\\<exists>k. k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n                      \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                          (fst (l ! Suc k), toSeq (snd (l ! Suc k))) \\<and> \n                   final_glob (l!(Suc k))\"\n         proof -             \n           have len_l:\"length l > 0\" using cp using cptn.simps by blast \n           then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n           have last_l:\"last l = l!(length l-1)\"\n            using last_length [of a1 l1] l by fastforce         \n           have final_0:\"\\<not>final_glob(l!0)\" using cp unfolding final_glob_def by auto\n           have \"0\\<le> (length l-1)\" using len_l last_l by auto\n           moreover have \"(length l-1) < length l\" using len_l by auto\n           moreover have \"final_glob (l!(length l-1))\" using valid last_l by auto\n           moreover have \"fst (l!0) = DynCom c1\" using cp by auto\n           ultimately show ?thesis \n             using a2 cp final_exist_component_tran_final env_tran_right final_0 \n             by blast \n          qed\n          then obtain k where \n                a21: \"k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n                      \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                          (fst (l ! Suc k), toSeq (snd (l ! Suc k))) \\<and> \n                      final_glob (l!(Suc k))\"\n            by auto\n          then have a00:\"Suc k<length l\" by fastforce\n          then obtain j where \n             before_k_all_evnt:\"j\\<le>k \\<and>  \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                                           (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> \n                                (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n            using a00 a21 exist_first_comp_tran cp by blast\n          then obtain cj sj csj ssj where \n            pair_j:\"(\\<Gamma>\\<turnstile>\\<^sub>c(cj,sj)  \\<rightarrow> (csj,ssj)) \\<and> \n                     cj = fst (l!j) \\<and> sj = toSeq (snd (l!j)) \\<and> \n                     csj = fst (l!(Suc j)) \\<and> ssj = toSeq(snd(l!(Suc j)))\"\n            by fast         \n          have \"((fst (last l) = Skip \\<and> snd (last l) \\<in> q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> (a))\"\n          proof -\n            have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce \n            then have k_basic1:\"cj = (DynCom c1) \\<and> snd(l!j) \\<in>  p\" \n              using a2 pair_j before_k_all_evnt cp env_tran_right assum stability[of p R l 0 j j \\<Gamma>]\n              by force\n            then have k_basic:\"cj = (DynCom c1) \\<and> sj \\<in>  (fst ` p)\" \n              using a2 pair_j before_k_all_evnt cp env_tran_right assum stability[of p R l 0 j j \\<Gamma>]\n              by force\n            then have ss:\"sj \\<in> (fst ` p)\" by auto \n            moreover  have ssj_normal_s:\"ssj = sj\" \n              using before_k_all_evnt k_basic pair_j a0 calculation\n              by (metis snd_conv stepc_elim_cases(10))\n            ultimately obtain sl where\n              lj: \"snd (l!j) =(sj, sl) \\<and> snd (l!(Suc j)) = (sj, sl)\"\n              using  cp  l2[of \\<Gamma> \"fst (l ! j)\" \"snd (l ! j)\" \"fst (l ! (Suc j))\" \"snd (l ! (Suc j))\"] a00\n              using before_k_all_evnt pair_j by fastforce\n            have cj:\"csj=c1 sj\" using k_basic pair_j ss a0\n              by (metis fst_conv stepc_elim_cases(10))                \n            moreover have p1:\"(sj,sl)\\<in>p\" using  k_basic1 cj lj by auto \n            moreover then have \"cpn n \\<Gamma> csj ((sj, sl)) \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n              using a0 com_validityn_def cj lj k_basic1 ss by blast\n            moreover then have \"l!(Suc j) = (csj, (sj, sl))\" \n              using before_k_all_evnt pair_j cj ssj_normal_s cj\n              by (metis lj prod.exhaust_sel)              \n            ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n              using  j_length a10 a11 \\<Gamma>1  ssj_normal_s lj k_basic1        \n              by (meson contra_subsetD cpn_assum_induct)               \n            thus ?thesis       \n              using j_length drop_comm a10' \\<Gamma>1 \n                cptn_comm_induct[of \\<Gamma> l \"DynCom c1\" s _ \"Suc j\" G q a F \"Suc j\"] valid  final_fault \n              by blast\n           qed\n         } thus ?thesis by auto \n         qed\n       note res = conjI [OF concl concr]}               \n       thus ?thesis using  c_prod unfolding comm_def by force qed      \n    } thus ?thesis by auto qed \n  } thus ?thesis by (auto simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\nlemma Guard_sound:\n  \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a] \\<Longrightarrow>\n   (\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a]) \\<Longrightarrow>   \n   Sta (p \\<inter> {c. (fst c) \\<in> g}) R \\<Longrightarrow> \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow>\n    \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Guard f g c1) sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a]\"\nproof -  \n  assume\n    a0:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [(p \\<inter> {c. (fst c) \\<in> g}) , R, G, q,a]\" and\n    a1:\"(\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a])\" and        \n    a2: \"Sta (p \\<inter> {c. (fst c) \\<in> g}) R\" and\n    a3: \"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\"\n  { \n    fix s\n    assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"  \n    then have a1:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a]\" \n      using a1 com_cvalidityn_def by fastforce\n    have \"cpn n \\<Gamma> (Guard f g c1)  s \\<inter> assum(p \\<inter> {c. (fst c) \\<in> g}, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof -\n    {   \n      fix c     \n      assume a10:\"c \\<in> cpn n \\<Gamma> (Guard f g c1) s\" and a11:\"c \\<in> assum(p \\<inter> {c. (fst c) \\<in> g}, R)\"\n      then have a10':\"c \\<in> cp \\<Gamma> (Guard f g c1) s\" \n        unfolding cpn_def cp_def using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n      obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n      have \"c \\<in> comm(G, (q,a)) F\"      \n      proof - \n        {      \n        have cp:\"l!0=((Guard f g c1),s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10' cp_def c_prod by fastforce\n        have \\<Gamma>1:\"(\\<Gamma>, l) = c\" using c_prod cp by blast\n        have assum:\"snd(l!0) \\<in> (p \\<inter> {c. (fst c) \\<in> g}) \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n                 (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n                   (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n       using a11 c_prod unfolding assum_def by simp\n       then have env_tran:\"env_tran \\<Gamma> (p \\<inter> {c. (fst c) \\<in> g}) l R\" using env_tran_def cp by blast\n       then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n         using env_tran env_tran_right_def unfolding env_tran_def by auto\n       have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n               (\\<Gamma>1\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                     (fst (l ! Suc i), toSeq (snd (l ! Suc i))) ) \\<longrightarrow>                                            \n                 (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n       proof -\n       { fix k ns ns'\n         assume a00:\"Suc k<length l\" and\n                a21:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                          (fst (l ! Suc k), toSeq (snd (l ! Suc k))) )\"                                                        \n         obtain j where before_k_all_evnt:\n           \"j\\<le>k \\<and>  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                         (fst (l ! Suc j), toSeq (snd (l ! Suc j))) ) \\<and> \n            (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n           using a00 a21 exist_first_comp_tran cp by blast\n         then obtain cj sj csj ssj where pair_j:\n              \"(\\<Gamma>\\<turnstile>\\<^sub>c(cj,sj)  \\<rightarrow> (csj,ssj)) \\<and> \n                cj = fst (l!j) \\<and> sj = toSeq(snd (l!j)) \\<and> csj = fst (l!(Suc j)) \\<and> \n                 ssj = toSeq(snd(l!(Suc j)))\"\n           by fast     \n         then have  pair_j1:\"(\\<Gamma>\\<turnstile>\\<^sub>c(fst (l!j),toSeq(snd (l!j)))  \\<rightarrow> (fst (l!(Suc j)),toSeq(snd(l!(Suc j)))))\"\n           by auto\n         have k_basic1:\"cj =(Guard f g c1) \\<and> snd (l!j) \\<in>  (p \\<inter>  {c. (fst c) \\<in> g})\" \n           using  pair_j before_k_all_evnt cp env_tran_right a2 assum a00 \n                  stability[of \"p \\<inter> {c. (fst c) \\<in> g}\" R l 0 j j \\<Gamma>]\n           by force\n         have k_basic:\"cj =(Guard f g c1) \\<and> sj \\<in> ((fst ` p) \\<inter> g)\" \n           using  pair_j before_k_all_evnt cp env_tran_right a2 assum a00 \n                 stability[of \"p \\<inter> {c. (fst c) \\<in> g}\" R l 0 j j \\<Gamma>]\n           by force\n         then have ss:\"sj \\<in> ((fst`p)\\<inter> g)\" by auto \n         moreover have ssj_normal_s:\"ssj = sj\" \n           using before_k_all_evnt k_basic pair_j a0 stepc_elim_cases(2) calculation\n           by (metis (no_types, lifting)  IntD2 prod.inject)\n         ultimately obtain sl where \n           lj:\"snd (l!j) = (sj, sl) \\<and> snd (l!(Suc j)) = (sj, sl)\"\n           using  cp l2[of \\<Gamma> \"fst (l ! j)\" \"snd (l ! j)\" \"fst (l ! (Suc j))\" \"snd (l ! (Suc j))\"] \n                 a00 before_k_all_evnt pair_j by fastforce \n         have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n           using ss a2 unfolding Satis_def\n         proof (cases \"k=j\")   \n           case True                                  \n           have \" ( (sj, sl),  (sj, sl))\\<in>G\" using a3 unfolding N_def using k_basic1 lj by fastforce \n           thus \"(snd (l ! k), snd (l ! Suc k)) \\<in>  G\"\n             using pair_j k_basic True ss ssj_normal_s lj by fastforce\n         next\n           case False   \n           have j_k:\"j<k\" using  before_k_all_evnt False by fastforce                      \n           thus \"(snd (l ! k), snd (l ! Suc k)) \\<in>  G\"\n           proof -\n             have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n             have cj:\"csj=c1\" using k_basic pair_j ss a0\n               by (metis (no_types, lifting) IntD2 fst_conv stepc_elim_cases(2))                             \n             moreover have p1:\"sj \\<in> (fst ` p \\<inter> g)\" using ss by blast \n             moreover then have \n               \"cpn n \\<Gamma> csj ((sj,sl)) \\<inter> assum(p \\<inter> {c. (fst c) \\<in> g}, R) \\<subseteq> comm(G, (q,a)) F\"\n               using a1 com_validityn_def cj lj by blast\n             moreover then have \"l!(Suc j) = (csj, (sj,sl))\" \n               using before_k_all_evnt pair_j cj ssj_normal_s lj\n               by (metis prod.exhaust_sel)\n             ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n               using  j_length a10 a11 \\<Gamma>1  ssj_normal_s  k_basic1 \n                     cpn_assum_induct[of \\<Gamma> l n \"Guard f g c1\" s \"p \\<inter> {c. (fst c) \\<in> g}\" R \n                               \"Suc j\" c1 \"(sj,sl)\" \"p \\<inter> {c. (fst c) \\<in> g}\" ] lj\n               by auto               \n             then show ?thesis \n             using a00 a21  a10' \\<Gamma>1  j_k j_length \n             cptn_comm_induct[of \\<Gamma> l \"(Guard f g c1)\" s _ \"Suc j\" G q a F k ]\n             unfolding Satis_def by fastforce                         \n          qed            \n       qed \n       } thus ?thesis by (simp add: c_prod cp) qed\n       have concr:\"(final_glob (last l)  \\<longrightarrow>   fst (last l) \\<notin> Fault ` F \\<longrightarrow>                  \n                   ((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  (a)))\"\n       proof-\n       { \n         assume valid:\"final_glob (last l)\" and final_fault:\" fst (last l) \\<notin> Fault ` F\"             \n         have \"\\<exists>k. k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n                      \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                          (fst (l ! Suc k), toSeq (snd (l ! Suc k))) \\<and> final_glob (l!(Suc k))\"\n         proof -             \n           have len_l:\"length l > 0\" using cp using cptn.simps by blast \n           then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n           have last_l:\"last l = l!(length l-1)\"\n            using last_length [of a1 l1] l by fastforce         \n           have final_0:\"\\<not>final_glob(l!0)\" using cp unfolding final_glob_def by auto\n           have \"0\\<le> (length l-1)\" using len_l last_l by auto\n           moreover have \"(length l-1) < length l\" using len_l by auto\n           moreover have \"final_glob (l!(length l-1))\" using valid last_l by auto\n           moreover have \"fst (l!0) = (Guard f g c1)\" using cp by auto\n           ultimately show ?thesis \n             using  cp final_exist_component_tran_final env_tran_right final_0 \n             by blast \n          qed\n          then obtain k where a21: \"k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n            \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                (fst (l ! Suc k), toSeq (snd (l ! Suc k))) \\<and> final_glob (l!(Suc k))\"\n            by auto\n          then have a00:\"Suc k<length l\" by fastforce\n          then obtain j where before_k_all_evnt:\"j\\<le>k \\<and>  \n               \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                   (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n            using a00 a21 exist_first_comp_tran cp by blast\n          then obtain cj sj csj ssj where \n             pair_j:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                          (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> \n                      cj = fst (l!j) \\<and> sj = toSeq(snd (l!j)) \\<and>  \n                      csj = fst (l!(Suc j)) \\<and> ssj = toSeq(snd(l!(Suc j)))\"\n          by fastforce        \n          have \"((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  (a))\"\n          proof -\n            have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce    \n            then have k_basic1:\"cj = (Guard f g c1) \\<and> snd (l!j) \\<in> (p \\<inter> {c. fst c \\<in> g})\" \n              using  pair_j before_k_all_evnt cp\n                    env_tran_right a2 assum a00 stability[of \"p \\<inter> {c. fst c \\<in> g}\" R l 0 j j \\<Gamma>]\n              by force\n            then have k_basic:\"cj = (Guard f g c1) \\<and> sj \\<in> ((fst`p) \\<inter> g)\" \n              using  pair_j before_k_all_evnt cp env_tran_right a2 assum a00 \n                     stability[of \"p \\<inter> {c. fst c \\<in> g}\" R l 0 j j \\<Gamma>]\n              by force\n            then have ss:\"sj \\<in> ((fst`p) \\<inter> g)\" by auto \n            moreover have ssj_normal_s:\"ssj = sj\" \n              using before_k_all_evnt k_basic pair_j a1 calculation\n              by (metis (no_types, lifting) IntD2 Pair_inject stepc_elim_cases(2))\n            ultimately obtain sl where \n              lj:\"snd (l!j) = (sj, sl) \\<and> snd (l!(Suc j)) = (sj, sl)\"\n              using  cp  l2[of \\<Gamma> \"fst (l ! j)\" \"snd (l ! j)\" \"fst (l ! (Suc j))\" \"snd (l ! (Suc j))\" ] a00\n              using before_k_all_evnt pair_j by fastforce\n            have cj:\"csj=c1\" using k_basic pair_j ss a0\n              by (metis (no_types, lifting) fst_conv IntD2 stepc_elim_cases(2))                              \n            moreover have p1:\"sj \\<in> ((fst`p) \\<inter> g)\" using ss by blast \n            moreover then have \n              \"cpn n \\<Gamma> csj ((sj,sl)) \\<inter> assum((p \\<inter> {c. fst c \\<in> g}), R) \\<subseteq> comm(G, (q,a)) F\"\n              using a1 com_validityn_def cj by blast\n            moreover then have \"l!(Suc j) = (csj, (sj,sl))\" \n              using before_k_all_evnt pair_j cj ssj_normal_s k_basic1 lj\n              by (metis prod.exhaust_sel)\n            ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n              using  j_length a10 a11 \\<Gamma>1  ssj_normal_s \n                      cpn_assum_induct[of \\<Gamma> l n \"(LanguageCon.com.Guard f g c1)\" s \"p \\<inter> {c. fst c \\<in> g}\" R] k_basic1 lj\n              by fastforce    \n            thus ?thesis       \n              using j_length  drop_comm a10' \\<Gamma>1 \n                    cptn_comm_induct[of \\<Gamma> l \"(Guard f g c1)\" s _ \"Suc j\" G q a F \"Suc j\"] valid final_fault\n              by blast\n           qed\n         } thus ?thesis by auto \n         qed\n       note res = conjI [OF concl concr]}               \n       thus ?thesis using  c_prod unfolding comm_def by force qed      \n    } thus ?thesis by auto qed \n  } thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\n\nlemma Guarantee_sound:\n  \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [(p \\<inter> {c. (fst c) \\<in> g}),  R, G, q,a] \\<Longrightarrow>\n   \\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a] \\<Longrightarrow>  \n   Sta p R \\<Longrightarrow> \n   f\\<in>F \\<Longrightarrow>\n   \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow> \n   \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Guard f g c1) sat [p, R, G, q,a]\"\nproof -  \n  assume\n    a0:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a]\" and\n    a1:\"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a]\" and      \n    a2: \"Sta p R\" and\n    a3: \"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\" and\n    a4: \"f\\<in>F\"    \n  { \n    fix s\n    assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"  \n    then have a1:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. (fst c) \\<in> g}, R, G, q,a]\" \n      using a1 com_cvalidityn_def by fastforce\n    have \"cpn n \\<Gamma> (Guard f g c1)  s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof -\n    {   \n      fix c     \n      assume a10:\"c \\<in> cpn n \\<Gamma> (Guard f g c1) s\" and a11:\"c \\<in> assum(p, R)\"\n      then have a10':\"c \\<in> cp \\<Gamma> (Guard f g c1) s\"\n        unfolding cp_def cpn_def using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fast\n      obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n      have \"c \\<in> comm(G, (q,a)) F\"      \n      proof - \n        {       \n        have cp:\"l!0=((Guard f g c1),s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10' cp_def c_prod by fastforce\n        have \\<Gamma>1:\"(\\<Gamma>, l) = c\" using c_prod cp by blast\n        have assum:\"snd(l!0) \\<in>  (p) \\<and> (\\<forall>i. Suc i<length l \\<longrightarrow> \n                 (\\<Gamma>1)\\<turnstile>\\<^sub>c(l!i)  \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<longrightarrow>                 \n                   (snd(l!i), snd(l!(Suc i))) \\<in> R)\" \n       using a11 c_prod unfolding assum_def by simp\n       then have env_tran:\"env_tran \\<Gamma> p l R\" using env_tran_def cp by blast\n       then have env_tran_right: \"env_tran_right \\<Gamma> l R\" \n         using env_tran env_tran_right_def unfolding env_tran_def by auto                     \n       have concl:\"(\\<forall>i. Suc i<length l \\<longrightarrow> \n               (\\<Gamma>1\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (snd (l ! i))) \\<rightarrow> \n                     (fst (l ! Suc i), toSeq (snd (l ! Suc i))) ) \\<longrightarrow>                                            \n                 (snd(l!i), snd(l!(Suc i))) \\<in> G)\"\n       proof -\n       { fix k ns ns'\n         fix k ns ns'\n         assume a00:\"Suc k<length l\" and\n                a21:\"(\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                          (fst (l ! Suc k), toSeq (snd (l ! Suc k))) )\"                                          \n         obtain j where before_k_all_evnt:\n           \"j\\<le>k \\<and>  (\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                         (fst (l ! Suc j), toSeq (snd (l ! Suc j))) ) \\<and> \n            (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n           using a00 a21 exist_first_comp_tran cp by blast\n         then obtain cj sj csj ssj where pair_j:\n              \"(\\<Gamma>\\<turnstile>\\<^sub>c(cj,sj)  \\<rightarrow> (csj,ssj)) \\<and> \n                cj = fst (l!j) \\<and> sj = toSeq(snd (l!j)) \\<and> csj = fst (l!(Suc j)) \\<and> \n                 ssj = toSeq(snd(l!(Suc j)))\"\n           by fast   \n         then have  pair_j1:\"(\\<Gamma>\\<turnstile>\\<^sub>c(fst (l!j),toSeq(snd (l!j)))  \\<rightarrow> (fst (l!(Suc j)),toSeq(snd(l!(Suc j)))))\"\n           by auto\n         have k_basic1:\"cj =(Guard f g c1) \\<and> snd(l!j) \\<in> (p)\" \n           using  pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of p R l 0 j j \\<Gamma>]\n           by force\n         have k_basic:\"cj =(Guard f g c1) \\<and> sj \\<in>  (fst`p)\" \n           using  pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of p R l 0 j j \\<Gamma>]\n           by force\n         then have ss:\"sj \\<in> (fst`p)\" by auto                 \n         have or:\"sj\\<in> (g \\<union> (-g))\" by fastforce\n         {assume a000:\"sj \\<in> g\"\n          then have k_basic:\"cj =(Guard f g c1) \\<and> sj \\<in>  (fst`p \\<inter> g)\" \n            using ss k_basic by fastforce\n          have k_basic1:\"cj =(Guard f g c1) \\<and> snd(l!j) \\<in> (p \\<inter> {c. fst c \\<in>g})\" \n            using a000 k_basic1\n            using pair_j ss by auto\n          then have ss: \"sj \\<in>  (fst`p \\<inter> g)\"\n            using ss k_basic by fastforce\n          moreover have ssj_normal_s:\"ssj = sj\" \n            using ss before_k_all_evnt k_basic pair_j a0 stepc_elim_cases(2) calculation\n            by (metis a000 snd_conv)   \n          ultimately obtain sl where \n           lj:\"snd (l!j) = (sj, sl) \\<and> snd (l!(Suc j)) = (sj, sl)\" \n           using  cp  l2[of \\<Gamma> \"fst (l ! j)\" \"snd (l ! j)\" \"fst (l ! (Suc j))\" \"snd (l ! (Suc j))\"] a00\n           using before_k_all_evnt pair_j by fastforce \n          have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n            using ss a2 unfolding Satis_def\n           proof (cases \"k=j\")   \n             case True                                               \n             thus \"(snd (l ! k), snd (l ! Suc k)) \\<in>  G\"\n               using pair_j k_basic True ss ssj_normal_s lj a3 unfolding N_def\n               using k_basic1 by fastforce\n           next\n             case False   \n             have j_k:\"j<k\" using  before_k_all_evnt False by fastforce                      \n             thus \"(snd (l ! k), snd (l ! Suc k)) \\<in>  G\"\n             proof -\n               have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce\n               have cj:\"csj=c1\" using k_basic pair_j ss a0\n                 by (metis (no_types, lifting) fst_conv IntD2 stepc_elim_cases(2))                             \n               moreover have p1:\"sj \\<in> (fst`p \\<inter> g)\" using ss by blast \n               moreover then have \"cpn n \\<Gamma> csj ((sj,sl)) \\<inter> assum((p \\<inter> {c. fst c \\<in>g}), R) \\<subseteq> comm(G, (q,a)) F\"\n                 using a1 com_validityn_def cj by blast\n               moreover then have \"l!(Suc j) = (csj,  (sj,sl))\" \n                 using before_k_all_evnt pair_j cj ssj_normal_s lj k_basic1\n                 by (metis prod.exhaust_sel)\n               ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n                 using  j_length a10 a11 \\<Gamma>1  ssj_normal_s k_basic1 \n                     cpn_assum_induct[of \\<Gamma> l n \"Guard f g c1\" s p R \"Suc j\" c1 \"(sj,sl)\" \"p \\<inter> {c. (fst c) \\<in> g}\"] lj imageE subset_eq\n                 by force                     \n                then show ?thesis \n                using a3 a00 a21  a10' \\<Gamma>1  j_k j_length \n                 cptn_comm_induct[of \\<Gamma> l \"(Guard f g c1)\" s _ \"Suc j\" G q a F k]\n                unfolding Satis_def by fastforce                         \n              qed            \n          qed\n         } note p1=this\n         {(* assume \"s' \\<in> (Collect (not (set_fun g)))\"\n          then have \"s'\\<notin>g\" by fastforce *)\n          assume \"sj\\<notin>g\"\n          then have csj_skip:\"csj= Fault f \\<and> ssj=sj\" using k_basic ss pair_j \n            by (meson Pair_inject stepc_elim_cases(2))\n          moreover have \"j+1<(length l )\"\n            using a00 before_k_all_evnt  by linarith\n          ultimately have \"fst (last l) = Fault f\" \n            using pair_j i_fault_all_fault[of \\<Gamma> l \"j+1\" f \"(length l)-1\"]\n            by (metis Suc_eq_plus1 Suc_leI cp diff_less last_conv_nth length_greater_0_conv \n                 less_diff_conv list.size(3) not_less0 zero_less_one)      \n          then have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"          \n            using ss a2 unfolding Satis_def\n           proof (cases \"k=j\")   \n             case True                                               \n             thus \"(snd (l ! k), snd (l ! Suc k)) \\<in>  G\"\n               using pair_j k_basic True ss   a3 unfolding N_def\n               by (metis (mono_tags, lifting) \\<open>j + 1 < length l\\<close> cp cptn_tran_ce_i csj_skip \n                     k_basic1 mem_Collect_eq prod.exhaust_sel step_ce_eq)               \n           next\n             case False   \n             have j_k:\"j<k\" using  before_k_all_evnt False by fastforce                      \n             thus \"(snd (l ! k), snd (l ! Suc k)) \\<in>  G\"               \n               by (metis Suc_leI a00 a21 cp csj_skip only_one_component_tran_j pair_j)                         \n          qed         \n         }\n         then have \"(snd(l!k), snd(l!(Suc k))) \\<in> G\"\n           using p1 or by fastforce         \n       } thus ?thesis by (simp add: c_prod cp) qed\n       have concr:\"(final_glob (last l)  \\<longrightarrow> fst (last l) \\<notin> Fault ` F \\<longrightarrow>                  \n                   ((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in>  (a)))\"\n       proof-\n       { \n         assume valid:\"final_glob (last l)\"  and final_fault:\"fst (last l) \\<notin> Fault ` F\"                   \n         have \"\\<exists>k. k\\<ge>0 \\<and> k<((length l) - 1) \\<and>  \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                          (fst (l ! Suc k), toSeq (snd (l ! Suc k))) \\<and> final_glob (l!(Suc k))\"\n         proof -             \n           have len_l:\"length l > 0\" using cp using cptn.simps by blast \n           then obtain a1 l1 where l:\"l=a1#l1\" by (metis SmallStepCon.nth_tl length_greater_0_conv)\n           have last_l:\"last l = l!(length l-1)\"\n            using last_length [of a1 l1] l by fastforce         \n           have final_0:\"\\<not>final_glob(l!0)\" using cp unfolding final_glob_def by auto\n           have \"0\\<le> (length l-1)\" using len_l last_l by auto\n           moreover have \"(length l-1) < length l\" using len_l by auto\n           moreover have \"final_glob (l!(length l-1))\" using valid last_l by auto\n           moreover have \"fst (l!0) = (Guard f g c1)\" using cp by auto\n           ultimately show ?thesis \n             using  cp final_exist_component_tran_final env_tran_right final_0 \n             by blast \n          qed\n          then obtain k where a21: \"k\\<ge>0 \\<and> k<((length l) - 1) \\<and> \n            \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! k), toSeq (snd (l ! k))) \\<rightarrow> \n                (fst (l ! Suc k), toSeq (snd (l ! Suc k))) \\<and> final_glob (l!(Suc k))\"\n            by auto\n          then have a00:\"Suc k<length l\" by fastforce\n          then obtain j where before_k_all_evnt:\"j\\<le>k \\<and>  \n               \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                   (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> (\\<forall>k < j. (\\<Gamma>\\<turnstile>\\<^sub>c(l!k)  \\<rightarrow>\\<^sub>e (l!(Suc k))))\"\n            using a00 a21 exist_first_comp_tran cp by blast\n          then obtain cj sj csj ssj where \n             pair_j:\"\\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! j), toSeq (snd (l ! j))) \\<rightarrow> \n                          (fst (l ! Suc j), toSeq (snd (l ! Suc j))) \\<and> \n                      cj = fst (l!j) \\<and> sj = toSeq(snd (l!j)) \\<and>  \n                      csj = fst (l!(Suc j)) \\<and> ssj = toSeq(snd(l!(Suc j)))\"\n          by fastforce         \n          have \"((fst (last l) = Skip \\<and> snd (last l) \\<in>  q)) \\<or>\n                    (fst (last l) = Throw \\<and> snd (last l) \\<in> (a))\"\n          proof -\n            have j_length:\"Suc j < length l\" using a00 before_k_all_evnt by fastforce    \n            have k_basic1:\"cj =(Guard f g c1) \\<and> snd (l!j) \\<in>  (p)\" \n              using  pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of p R l 0 j j \\<Gamma>]\n              by force\n            have k_basic:\"cj =(Guard f g c1) \\<and> sj \\<in> (fst`p)\" \n             using  pair_j before_k_all_evnt cp env_tran_right a2 assum a00 stability[of p R l 0 j j \\<Gamma>]\n             by force\n            then have ss:\"sj \\<in> (fst`p)\" by auto \n            have or:\"sj\\<in> (g \\<union> (-g))\" by fastforce\n            { assume a000:\"sj \\<in> g\"\n              then have k_basic:\"cj =(Guard f g c1) \\<and> sj \\<in> (fst`p \\<inter> g)\" \n                using ss k_basic by fastforce\n              have k_basic1:\"cj =(Guard f g c1) \\<and> snd(l!j) \\<in> (p \\<inter> {c. fst c \\<in>g})\" \n                using a000 k_basic1\n                using pair_j ss by auto\n              then have k_basic:\"cj =(Guard f g c1) \\<and> sj \\<in> (fst`p \\<inter> g)\" \n                using ss k_basic by fastforce\n              then have ss: \"sj \\<in> (fst`p \\<inter> g)\"\n                using ss by fastforce\n              moreover have ssj_normal_s:\"ssj = sj\" \n                using before_k_all_evnt k_basic pair_j a1 calculation\n                by (metis (no_types, lifting) Pair_inject IntD2 stepc_elim_cases(2))               \n              ultimately obtain sl where \n                lj:\"snd (l!j) = (sj, sl) \\<and> snd (l!(Suc j)) = (sj, sl)\"\n                using  cp  \n                   l2[of \\<Gamma> \"fst (l ! j)\" \"snd (l ! j)\" \"fst (l ! (Suc j))\" \"snd (l ! (Suc j))\"] a00\n                using before_k_all_evnt pair_j by fastforce\n              have cj:\"csj=c1\" using k_basic pair_j ss a0\n                by (metis (no_types, lifting) fst_conv IntD2 stepc_elim_cases(2))                              \n              moreover have p1:\"sj\\<in>(fst`p \\<inter> g)\" using ss by blast \n              moreover then have \"cpn n \\<Gamma> csj ( (sj,sl)) \\<inter> assum((p \\<inter> {c. fst c\\<in>g}), R)  \\<subseteq> comm(G, (q,a)) F\"\n                using a1 com_validityn_def cj by blast\n             moreover then have \"l!(Suc j) = (csj,  (sj,sl))\" \n               using before_k_all_evnt pair_j cj ssj_normal_s k_basic1 lj\n              by (metis prod.exhaust_sel)\n             ultimately have drop_comm:\"((\\<Gamma>, drop (Suc j) l))\\<in> comm(G, (q,a)) F\"\n              using  j_length a10 a11 \\<Gamma>1  ssj_normal_s cpn_assum_induct[of \\<Gamma> l n \"Guard f g c1\" s] k_basic1 lj\n              by fastforce                \n            then have ?thesis       \n              using j_length  drop_comm a10' \\<Gamma>1 \n                     cptn_comm_induct[of \\<Gamma> l \"(Guard f g c1)\" s _ \"Suc j\" G q a F \"Suc j\"]\n                    valid final_fault  \n              by blast\n           }note left=this        \n           {\n            (* assume \"s' \\<in> (Collect (not (set_fun g)))\"\n            then have \"s'\\<notin>g\" by fastforce *)\n             assume \"sj\\<notin>g\"\n             then have \"csj= Fault f \\<and> ssj=sj\" using k_basic ss pair_j\n               by (metis prod.inject stepc_elim_cases(2))\n             then have \"fst (last l) = Fault f\" using pair_j a4 cp imageI j_length last_not_F\n               by (metis final_fault)                 \n             then have False using a4 final_fault by auto           \n           }\n           thus ?thesis using or left by auto qed\n         } thus ?thesis by auto \n         qed\n       note res = conjI [OF concl concr]}               \n       thus ?thesis using  c_prod unfolding comm_def by force qed      \n    } thus ?thesis by auto qed \n  } thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def) \nqed\n\nlemma WhileNone:   \n   \"\\<Gamma>\\<turnstile>\\<^sub>c (While b c1, toSeq s1) \\<rightarrow> (LanguageCon.com.Skip, toSeq t1) \\<Longrightarrow>   \n    snd s1 = snd t1 \\<Longrightarrow>\n    (n,\\<Gamma>, (Skip, t1) # xsa) \\<in> cptn_mod_nest_call \\<Longrightarrow>  \n    \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. fst c \\<in> b},R, G, p,a] \\<Longrightarrow>\n    Sta p R \\<Longrightarrow>\n    Sta (p \\<inter> ({c. fst c \\<in> -b})) R \\<Longrightarrow>\n    Sta a R \\<Longrightarrow>\n    \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow>            \n    (\\<Gamma>, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa) \\<in> assum (p, R) \\<Longrightarrow>    \n    (\\<Gamma>, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa) \\<in> comm (G,(p \\<inter> {c. fst c \\<in> -b}),a) F\"\nproof -\n  assume a0:\"\\<Gamma>\\<turnstile>\\<^sub>c (While b c1, toSeq s1) \\<rightarrow> (LanguageCon.com.Skip, toSeq t1)\" and \n         a0':\"snd s1 = snd t1\" and\n         a1:\"(n,\\<Gamma>, (Skip, t1) # xsa) \\<in> cptn_mod_nest_call\" and\n         a2:\" \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. fst c \\<in> b},R, G, p,a]\" and\n         a3:\"Sta p R\" and\n         a4:\"Sta (p \\<inter> ({c. fst c \\<in> -b})) R\" and\n         a5:\"Sta a R\" and\n         a6:\"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\" and\n         a7:\"(\\<Gamma>, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa) \\<in> assum (p, R)\"         \n  have ps1N:\"s1 \\<in> p\" using a7 unfolding assum_def by fastforce\n  then have \"toSeq s1 \\<in> fst ` p\"\n    by simp    \n  then have s1_t1:\"toSeq s1 \\<notin> b \\<and> toSeq t1=toSeq s1\" using a0\n    using LanguageCon.com.distinct(5) prod.inject\n    by (metis stepc_elim_cases(7))    \n  have eq_t1_s1:\"s1\\<notin> {c. fst c \\<in> b} \\<and> t1 = s1\" using a0'\n    by (metis s1_t1 mem_Collect_eq prod_eqI  toSeq.simps(1) ) \n  then have st1_Normal_post:\"t1\\<in>  (p \\<inter> {c. fst c \\<in> -b})\"\n    by (simp add: ps1N)\n  also have \"(\\<Gamma>, (While b c1, s1) # (LanguageCon.com.Skip, t1) # xsa)\\<in>cptn\"\n    using a1 a0 cptn.simps             \n    using cptn_eq_cptn_mod_set  a0' cptn_onlyif_cptn_mod_aux[OF _ _ a0 a0' cptn_mod_nest_cptn_mod[OF a1]]\n    by fastforce\n  ultimately have assum_skip:\n    \"(\\<Gamma>,(LanguageCon.com.Skip, t1) # xsa) \\<in> assum (( p \\<inter> {c. fst c \\<in> -b}), R)\"\n    using a1 a7 tl_of_assum_in_assum1 st1_Normal_post by fastforce\n  have skip_comm:\"(\\<Gamma>,(LanguageCon.com.Skip, t1) # xsa) \\<in> \n               comm (G,(( p \\<inter> {c. fst c \\<in> -b}),a)) F\" \n  proof- \n    obtain \\<Theta> where  \"(\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p , R, G, q,a])\" by auto\n    moreover have \"\\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> Skip sat [( p \\<inter> {c. fst c \\<in> -b}), R, G, ( p \\<inter> {c. fst c \\<in> -b}),a]\"\n      using Skip_sound[of \"(p \\<inter> {c. fst c \\<in> -b})\"]  a4 a6   by blast\n    ultimately have \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> LanguageCon.com.Skip sat [p \\<inter> {c. fst c \\<in> - b},R, G, p \\<inter> {c. fst c \\<in> - b},a]\"\n      unfolding com_cvalidityn_def by fastforce\n    then show ?thesis\n      using assum_skip  a1  unfolding  com_validityn_def  cpn_def \n      by fastforce\n  qed    \n  have G_ref:\"( s1,  s1)\\<in>G\" using a6 unfolding N_def\n    using ps1N by blast\n  thus ?thesis using skip_comm ctran_in_comm[of s1]  \n    using eq_t1_s1 ps1N by blast\nqed \n\nlemma while1:\n   \"(n,\\<Gamma>, ((c,  s1) # xs1)) \\<in> cptn_mod_nest_call \\<Longrightarrow>        \n    s1 \\<in> {c. fst c \\<in> b} \\<Longrightarrow>\n    xsa = map (lift (While b c)) xs1 \\<Longrightarrow>\n    \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter>{c. fst c \\<in> b},R, G, p,a] \\<Longrightarrow>    \n    (\\<Gamma>, (While b c,  s1) #\n        (Seq c (LanguageCon.com.While b c),  s1) # xsa)\n       \\<in> assum (p, R)  \\<Longrightarrow>               \n    \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow> \n     (\\<Gamma>, (LanguageCon.com.While b c,  s1) #\n         (LanguageCon.com.Seq c (LanguageCon.com.While b c),  s1) # xsa)\n    \\<in> comm (G, p\\<inter>{c. fst c \\<in> -b}, a) F\"\nproof -\nassume   \n  a0:\"(n,\\<Gamma>, ((c,  s1) # xs1)) \\<in> cptn_mod_nest_call\" and  \n  a1:\"s1 \\<in>{c. fst c \\<in> b}\" and\n  a2:\"xsa = map (lift (While b c)) xs1\" and\n  a3:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. fst c \\<in> b},R, G, p,a]\" and\n  a4:\"(\\<Gamma>, (While b c,  s1) #\n        (Seq c (While b c),  s1) # xsa)\n       \\<in> assum (p, R) \" and  \n  a5:\"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\" \n  have seq_map:\"(Seq c (While b c),  s1) # xsa=\n           map (lift (While b c)) ((c, s1)#xs1)\"\n  using a2 unfolding lift_def by fastforce\n  have step:\"\\<Gamma>\\<turnstile>\\<^sub>c(While b c,toSeq ( s1)) \\<rightarrow> (Seq c (While b c),toSeq( s1))\" using a1\n    WhileTruec by force\n  have s1_normal:\"s1 \\<in> p \\<and> s1 \\<in> {c. fst c \\<in> b} \" using a4 a1 unfolding assum_def by fastforce\n  then have G_ref:\"( s1,  s1) \\<in> G\"  using a5 unfolding N_def by fastforce \n  have s1_collect_p: \" s1\\<in>  (p \\<inter> {c. fst c \\<in> b})\" using s1_normal by fastforce\n  have \"(\\<Gamma>, map (lift (While b c)) ((c, s1)#xs1))\\<in>cptn\" \n    using a2 cptn_eq_cptn_mod_nest lift_is_cptn a0  by blast \n  then have cptn_seq:\"(\\<Gamma>,(Seq c (While b c),  s1) # xsa) \\<in>cptn\" \n    using seq_map by auto\n  moreover have \"fst s1 \\<in> b\" using a1 by force\n  ultimately have \"(\\<Gamma>, (While b c,  s1) # (Seq c (While b c),  s1) # xsa) \\<in> cptn\"\n    by (metis (no_types) a0 a2 cptn_eq_cptn_mod_set cptn_mod.CptnModWhile1 cptn_mod_nest_cptn_mod)\n  then have assum_seq:\"(\\<Gamma>,(Seq c (While b c),  s1) # xsa)\\<in>assum (p, R)\"\n    using a4 tl_of_assum_in_assum1 s1_collect_p by fast\n  have cp_c:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> (cpn n \\<Gamma> c ( s1))\"\n    using a0 unfolding cpn_def by fastforce\n  then have cp_c':\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> (cp \\<Gamma> c ( s1))\"\n    unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by fastforce    \n  also have cp_seq:\"(\\<Gamma>, (Seq c (While b c),  s1) # xsa) \\<in> (cp \\<Gamma> (Seq c (While b c)) ( s1))\"\n    using cptn_seq unfolding cp_def by fastforce\n  ultimately have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> assum(p,R)\"  \n    using assum_map assum_seq seq_map by fastforce  \n  then have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> assum((p \\<inter> {c. fst c \\<in> b}),R)\"\n    unfolding assum_def using s1_collect_p by fastforce\n  then have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> comm(G,(p,a)) F\"\n    using a3 cp_c unfolding com_validityn_def by fastforce\n  then have \"(\\<Gamma>, (Seq c (While b c),  s1) # xsa) \\<in> comm(G,(p,a)) F\"\n    using cp_seq cp_c' comm_map seq_map by fastforce\n  then have \"(\\<Gamma>, (While b c,  s1) # (Seq c (While b c),  s1) # xsa) \\<in> comm(G,(p,a)) F\"\n    using G_ref ctran_in_comm\n    by (simp add: ctran_in_comm)\n  also have \"\\<not> final_glob (last ((While b c,  s1) # (Seq c (While b c),  s1) # xsa))\"\n    using seq_map unfolding final_glob_def lift_def  by (simp add: case_prod_beta' last_map)  \n  ultimately show ?thesis using not_final_in_comm[of \\<Gamma>] by blast\nqed\n\nlemma while2:\n   \" (n,\\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) # xsa) \\<in>cptn_mod_nest_call \\<Longrightarrow>\n    (n, \\<Gamma>, (c,  s1) # xs1) \\<in> cptn_mod_nest_call \\<Longrightarrow>\n    fst (last ((c,  s1) # xs1)) = LanguageCon.com.Skip \\<Longrightarrow>\n    s1 \\<in> {c. fst c \\<in> b} \\<Longrightarrow>\n    xsa = map (lift (While b c)) xs1 @\n    (While b c, snd (last ((c,  s1) # xs1))) # ys \\<Longrightarrow>\n    (n, \\<Gamma>, (While b c, snd (last ((c,  s1) # xs1))) # ys)\n      \\<in> cptn_mod_nest_call \\<Longrightarrow>\n     (\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a] \\<Longrightarrow>    \n       (\\<Gamma>, (While b c, snd (last ((c,  s1) # xs1))) # ys)\n         \\<in> assum (p, R) \\<Longrightarrow>\n       (\\<Gamma>, (While b c, snd (last ((c,  s1) # xs1))) # ys)\n          \\<in> comm (G, p \\<inter> {c. fst c \\<in> -b}, a) F) \\<Longrightarrow>\n    \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [ p \\<inter> {c. fst c \\<in> b}, R, G, p,a] \\<Longrightarrow>\n    (\\<Gamma>, (While b c,  s1) #\n      (Seq c (While b c),  s1) # xsa)\n      \\<in> assum (p, R)  \\<Longrightarrow>\n     \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G  \\<Longrightarrow>     \n    (\\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) # xsa)\n      \\<in> comm (G,( p \\<inter> {c. fst c \\<in> -b}, a)) F\"\nproof -\nassume a00:\"(n, \\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) # xsa) \\<in>cptn_mod_nest_call\" and\n       a0:\"(n,\\<Gamma>, (c,  s1) # xs1) \\<in> cptn_mod_nest_call\" and\n       a1:\" fst (last ((c,  s1) # xs1)) = LanguageCon.com.Skip\" and\n       a2:\"s1 \\<in> {c. fst c \\<in> b}\" and\n       a3:\"xsa = map (lift (While b c)) xs1 @\n            (While b c, snd (last ((c,  s1) # xs1))) # ys\" and\n       a4:\"(n,\\<Gamma>, (While b c, snd (last ((c,  s1) # xs1))) # ys)\n            \\<in> cptn_mod_nest_call\" and\n       a5:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a]\" and       \n       a6:\"(\\<Gamma>, (While b c,  s1) #\n               (Seq c (While b c),  s1) # xsa)\n             \\<in> assum (p, R)\" and\n       a7:\"(\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a] \\<Longrightarrow>    \n           (\\<Gamma>, (While b c, snd (last ((c,  s1) # xs1))) # ys)\n             \\<in> assum (p, R) \\<Longrightarrow>\n           (\\<Gamma>, (While b c, snd (last ((c,  s1) # xs1))) # ys)\n             \\<in> comm (G,p \\<inter> {c. fst c \\<in> -b}, a) F)\" and\n       a8:\"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\" \n  let ?l= \"(While b c,  s1) #\n           (Seq c (While b c),  s1) # xsa\"\n  let ?sub_l=\"((While b c,  s1) # \n                 (Seq c (While b c),  s1) # \n                 map (lift (While b c)) xs1)\"  \n  have a0':\"(\\<Gamma>, (c,  s1) # xs1) \\<in> cptn\"\n    using cptn_eq_cptn_mod_nest using a0 by auto\n  have a4:\"(\\<Gamma>, (While b c, snd (last ((c,  s1) # xs1))) # ys) \\<in> cptn\" \n    using cptn_eq_cptn_mod_nest using a4 by blast\n  have seq_map:\"(Seq c (While b c),  s1) # map (lift (While b c)) xs1=\n           map (lift (While b c)) ((c, s1)#xs1)\"\n  using a2 unfolding lift_def by fastforce\n  have step:\"\\<Gamma>\\<turnstile>\\<^sub>c(While b c,toSeq ( s1)) \\<rightarrow> (Seq c (While b c),toSeq ( s1))\" using a2\n    WhileTruec by fastforce\n  have s1_normal:\"s1\\<in>p \\<and> s1 \\<in> {c. fst c \\<in> b} \" using a6 a2 unfolding assum_def by fastforce\n  then have G_ref:\"( s1,  s1)\\<in>G\" using a8  unfolding N_def by blast\n  have s1_collect_p: \" s1\\<in>  (p \\<inter> {c. fst c \\<in> b})\" using s1_normal by fastforce\n  have \"(\\<Gamma>, map (lift (While b c)) ((c, s1)#xs1))\\<in>cptn\" \n    using a2 cptn_eq_cptn_mod lift_is_cptn a0' by fastforce\n  then have cptn_seq:\"(\\<Gamma>,(Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in>cptn\" \n    using seq_map by auto\n  then have \"(\\<Gamma>, (While b c,  s1) # \n                 (Seq c (While b c),  s1) # \n                  map (lift (While b c)) xs1) \\<in> cptn\"\n    using step\n    by (metis (no_types) LanguageCon.com.distinct(5) a0' cptn_eq_cptn_mod_set cptn_mod.CptnModWhile1 \n             local.step prod.inject stepc_elim_cases(7) toSeq.simps(1)) \n  also have \"(\\<Gamma>, (While b c,  s1) #\n                 (Seq c (While b c),  s1) #\n                  map (lift (While b c)) xs1)\n          \\<in> assum (p, R)\"\n    using a6 a3 sub_assum\n    by (metis append_Cons) \n  ultimately have assum_seq:\"(\\<Gamma>,(Seq c (While b c),  s1)  # \n                       map (lift (While b c)) xs1) \\<in> assum (p, R)\"\n    using a6 tl_of_assum_in_assum1 s1_collect_p \n          tl_of_assum_in_assum   by fast\n  have cpn_c:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> (cpn n \\<Gamma> c ( s1))\"\n    using a0 unfolding cpn_def by fastforce\n  have cp_c:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> (cp \\<Gamma> c ( s1))\"\n    using a0' unfolding cp_def by fastforce  \n  also have cp_seq:\"(\\<Gamma>, (Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in> \n                      (cp \\<Gamma> (Seq c (While b c)) ( s1))\"\n    using cptn_seq unfolding cp_def by fastforce\n  ultimately have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> assum(p,R) \"  \n    using assum_map assum_seq seq_map  by fastforce  \n  then have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> assum((p \\<inter> {c. fst c \\<in> b}),R) \"\n    unfolding assum_def using s1_collect_p by fastforce\n  then have c_comm:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> comm(G,(p,a)) F\"\n    using a5 cpn_c unfolding com_validityn_def by fastforce\n  then have \"(\\<Gamma>, (Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in> comm(G,(p,a)) F\"\n    using cp_seq cp_c comm_map seq_map by fastforce\n  then have comm_while:\"(\\<Gamma>, (While b c,  s1) # \n                            (Seq c (While b c),  s1) # \n                            map (lift (While b c)) xs1) \\<in> comm(G,(p,a)) F\"\n    using G_ref \n    by (simp add: ctran_in_comm)\n  have final_last_c:\"final_glob (last ((c, s1)#xs1))\"\n    using a1 a3 unfolding final_glob_def by fastforce\n  have last_while1:\"snd (last (map (lift (While b c)) ((c, s1)#xs1))) = snd (last ((c,  s1) # xs1))\"\n    unfolding lift_def by (simp add: case_prod_beta' last_map)\n  have last_while2:\"(last (map (lift (While b c)) ((c, s1)#xs1))) =\n           last ((While b c,  s1) # (Seq c (While b c),  s1) # map (lift (While b c)) xs1)\"\n    using seq_map by fastforce \n  then have last_c_normal:\"snd (last ( (c, s1)#xs1)) \\<in>  p\"\n    using c_comm a1 unfolding comm_def final_glob_def by fastforce    \n  then obtain sl where sl:\"snd (last ( (c, s1)#xs1)) =  sl\" by fastforce\n  have while_comm:\"(\\<Gamma>, (While b c, snd (last ((c, s1) # xs1))) # ys) \\<in> comm(G,(p\\<inter>({c. fst c \\<in> -b}),a)) F\"\n  proof -\n    have assum_while: \"(\\<Gamma>, (While b c, snd (last ((c,  s1) # xs1))) # ys)\n             \\<in> assum (p, R)\"\n      using last_c_normal a3 a6 sub_assum_r[of \\<Gamma> ?sub_l \"(While b c, snd (last ((c,  s1) # xs1)))\"  ys p R p] \n      by fastforce\n    thus ?thesis using a5 a7 by fastforce\n  qed      \n  have \"sl\\<in>p\" using last_c_normal sl by fastforce\n  then have G1_ref:\"( sl,  sl)\\<in>G\" using a8 unfolding N_def by blast\n  also have \"snd (last ?sub_l) =  sl\"\n    using last_while1 last_while2 sl by fastforce\n  ultimately show ?thesis \n    using  cptn_eq_cptn_mod_nest a00 a3 sl while_comm comm_union[OF comm_while]  \n    by fastforce     \nqed\n\nlemma while3:\n   \"(n, \\<Gamma>, (c,  s1) # xs1) \\<in> cptn_mod_nest_call \\<Longrightarrow>    \n    fst (last ((c,  s1) # xs1)) = Throw \\<Longrightarrow>\n    s1 \\<in> {c. fst c \\<in> b} \\<Longrightarrow>\n    snd (last ((c,  s1) # xs1)) =  sl \\<Longrightarrow>\n    (n,\\<Gamma>, (Throw, sl) # ys) \\<in> cptn_mod_nest_call   \\<Longrightarrow>\n    \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. fst c \\<in> b},R, G, p,a] \\<Longrightarrow>    \n    (\\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) #  \n         (map (lift (While b c)) xs1 @\n           (Throw,  sl) # ys))\n       \\<in> assum (p, R)  \\<Longrightarrow>        \n     Sta p R \\<Longrightarrow>\n     Sta a R \\<Longrightarrow> \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow> \n    (\\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) #          \n         ((map (lift (While b c)) xs1 @\n           (Throw,  sl) # ys))) \\<in> comm (G, p\\<inter> ({c. fst c \\<in> -b}), a) F\n\"\nproof -\nassume a0:\"(n,\\<Gamma>, (c,  s1) # xs1) \\<in> cptn_mod_nest_call\" and\n       a1:\"fst (last ((c,  s1) # xs1)) = Throw\" and\n       a2:\"s1 \\<in> {c. fst c \\<in> b}\" and\n       a3:\"snd (last ((c,  s1) # xs1)) = sl\" and\n       a4:\"(n,\\<Gamma>, (Throw,  sl) # ys) \\<in> cptn_mod_nest_call\" and\n       a5:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a]\" and\n       a6:\"(\\<Gamma>, (While b c,  s1) #\n           (Seq c (While b c),  s1) #  \n           (map (lift (While b c)) xs1 @\n             (Throw,  sl) # ys)) \\<in> assum (p, R)\" and      \n       a7: \"Sta p R\" and\n       a8: \"Sta a R\" and       \n       a10:\"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\"  \n  have seq_map:\"(Seq c (While b c),  s1) # map (lift (While b c)) xs1=\n           map (lift (While b c)) ((c, s1)#xs1)\"\n  using a2 unfolding lift_def by fastforce\n  have step:\"\\<Gamma>\\<turnstile>\\<^sub>c(While b c,toSeq( s1)) \\<rightarrow> (Seq c (While b c),toSeq( s1))\" \n    using a2 WhileTruec by fastforce\n  have s1_normal:\"s1\\<in>p \\<and> s1 \\<in> {c. fst c \\<in> b} \" using a6 a2 unfolding assum_def by fastforce\n  then have G_ref:\"( s1,  s1)\\<in>G\" using a10 unfolding N_def by blast\n  have s1_collect_p: \" s1\\<in>  (p \\<inter>{c. fst c \\<in> b})\" using s1_normal by fastforce\n  have \"(n, \\<Gamma>, map (lift (While b c)) ((c, s1)#xs1))\\<in>cptn_mod_nest_call\" \n    using a2  a0\n    by (metis cptn_mod_nest_call.CptnModNestSeq1 seq_map) \n  then have cptn_seq:\"(n,\\<Gamma>,(Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in>cptn_mod_nest_call\" \n    using seq_map by auto\n  then have cptn:\"(n,\\<Gamma>, (While b c,  s1) # (Seq c (While b c),  s1) # \n                    map (lift (While b c)) xs1) \\<in> cptn_mod_nest_call\"\n    using a0 a2 cptn_mod_nest_call.CptnModNestWhile1\n    by blast \n  also have \"(\\<Gamma>, (LanguageCon.com.While b c,  s1) #\n         (LanguageCon.com.Seq c (LanguageCon.com.While b c),  s1) #\n         map (lift (LanguageCon.com.While b c)) xs1)\n          \\<in> assum (p, R) \"\n    using a6 sub_assum\n    by (metis append_Cons) \n  ultimately have assum_seq:\"(\\<Gamma>,(Seq c (While b c),  s1)  # \n                       map (lift (While b c)) xs1) \\<in> assum (p, R)\"\n    using a6 tl_of_assum_in_assum1 s1_collect_p \n          tl_of_assum_in_assum cptn_eq_cptn_mod_nest  by fast\n  have cpn_c:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> (cpn n \\<Gamma> c ( s1))\"\n    using a0 unfolding cpn_def by fastforce\n  then have cp_c:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> (cp \\<Gamma> c ( s1))\"\n    unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by auto\n  moreover have cp_seq:\"(\\<Gamma>, (Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in> \n           (cpn n \\<Gamma> (Seq c (While b c)) ( s1))\"\n    using cptn_seq unfolding cpn_def by fastforce\n  then have cp_seq':\"(\\<Gamma>, (Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in> \n            (cp \\<Gamma> (Seq c (While b c)) ( s1))\"\n    unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by auto\n  ultimately have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> assum(p,R)\"  \n    using assum_map assum_seq seq_map  by fastforce\n  then have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> assum((p \\<inter> {c. fst c \\<in> b}),R)\"\n    unfolding assum_def using s1_collect_p by fastforce\n  then have c_comm:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> comm(G,(p,a)) F\"\n    using a5 cpn_c unfolding com_validityn_def by fastforce\n  then have \"(\\<Gamma>, (Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in> comm(G,(p,a)) F\"\n    using cp_seq' cp_c comm_map seq_map by fastforce\n  then have comm_while:\"(\\<Gamma>, (While b c,  s1) # (Seq c (While b c),  s1) # \n         map (lift (While b c)) xs1) \\<in> comm(G,(p,a)) F\"\n    using G_ref ctran_in_comm by blast\n  have final_last_c:\"final_glob (last ((c, s1)#xs1))\"\n    using a1 a3 unfolding final_glob_def by fastforce\n  have not_fault_final_last_c:\n    \"fst (last ( (c, s1)#xs1)) \\<notin> Fault ` F\"\n    using a3 a1 by auto\n  then have sl_a:\" sl \\<in>  (a)\"  \n    using final_last_c a1 c_comm unfolding comm_def\n    using  a3 comm_dest2   \n    by auto\n  have last_while1:\"snd (last (map (lift (While b c)) ((c, s1)#xs1))) = snd (last ((c,  s1) # xs1))\"\n    unfolding lift_def by (simp add: case_prod_beta' last_map)\n  have last_while2:\"(last (map (lift (While b c)) ((c, s1)#xs1))) =\n           last ((While b c,  s1) # (Seq c (While b c),  s1) # map (lift (While b c)) xs1)\"\n    using seq_map by fastforce\n  have throw_comm:\"(\\<Gamma>, (Throw,  sl) # ys) \\<in> comm(G,(p\\<inter>({c. fst c \\<in> -b}),a)) F\"\n  proof -\n    have assum_throw: \"(\\<Gamma>, (Throw,  sl) # ys) \\<in> assum (a,R)\"\n      using sl_a a6 sub_assum_r[of _ \"(LanguageCon.com.While b c,  s1) #\n         (LanguageCon.com.Seq c (LanguageCon.com.While b c),  s1) #\n         map (lift (LanguageCon.com.While b c)) xs1\" \"(Throw,  sl)\" ] \n      by fastforce\n    also have \"(\\<Gamma>,(Throw,  sl) # ys) \\<in> cpn n \\<Gamma> Throw ( sl)\" \n      unfolding cpn_def using a4 by fastforce\n    ultimately show ?thesis using Throw_sound[of a R ]  a8   \n      unfolding com_cvalidityn_def com_validityn_def by fast\n  qed  \n  have p1:\"(LanguageCon.com.While b c,  s1) #\n    (LanguageCon.com.Seq c (LanguageCon.com.While b c),  s1) #\n    map (lift (LanguageCon.com.While b c)) xs1 \\<noteq> [] \\<and>\n    (LanguageCon.com.Throw,  sl) # ys \\<noteq> []\" by auto  \n  have \"sl \\<in> a\" using sl_a by fastforce\n  then have G1_ref:\"( sl,  sl) \\<in> G\" \n    using a0 a10 a3 cp_c s1_normal cptn_all_len_eq_0  cptn_if_cptn_mod cptn_mod_nest_cptn_mod\n    unfolding N_def cp_def\n    by (smt last_length length_Cons lessI mem_Collect_eq nth_Cons_0 snd_conv)\n  moreover have \"snd (last ((While b c,  s1) # \n                  (Seq c (While b c),  s1) # \n                  map (lift (While b c)) xs1)) =  sl\"\n    using last_while1 last_while2 a3 by fastforce\n  moreover have \"snd (((LanguageCon.com.Throw,  sl) # ys) ! 0) =  sl\"\n    by (metis nth_Cons_0 snd_conv)\n  ultimately have G:\"(snd (last ((While b c,  s1) # \n                  (Seq c (While b c),  s1) # \n                  map (lift (While b c)) xs1)),\n                  snd (((LanguageCon.com.Throw,  sl) # ys) ! 0)) \\<in> G\" by auto\n  have cptn:\"(\\<Gamma>, ((LanguageCon.com.While b c,  s1) #\n          (LanguageCon.com.Seq c (LanguageCon.com.While b c),  s1) #\n          map (lift (LanguageCon.com.While b c)) xs1) @\n         (LanguageCon.com.Throw,  sl) # ys)\n    \\<in> cptn\" using cptn a4  a0 a1 a3 a4 cptn_eq_cptn_mod_set cptn_mod.CptnModWhile3 s1_normal \n             cptn_eq_cptn_mod_nest\n    by (metis append_Cons mem_Collect_eq) \n  show ?thesis using a0  comm_union[OF comm_while throw_comm p1 G cptn] by auto       \nqed\n\n\nlemma while4:\n   \"(n, \\<Gamma>, (c,  s1) # xs1) \\<in> cptn_mod_nest_call \\<Longrightarrow>    \n    fst (last ((c,  s1) # xs1)) = Stuck \\<Longrightarrow>\n    s1 \\<in> {c. fst c \\<in> b} \\<Longrightarrow>\n    snd (last ((c,  s1) # xs1)) =  sl \\<Longrightarrow>\n    (n,\\<Gamma>, (Stuck, sl) # ys) \\<in> cptn_mod_nest_call   \\<Longrightarrow>\n    \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. fst c \\<in> b},R, G, p,a] \\<Longrightarrow>    \n    (\\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) #  \n         (map (lift (While b c)) xs1 @\n           (Stuck,  sl) # ys))\n       \\<in> assum (p, R)  \\<Longrightarrow>        \n     Sta p R \\<Longrightarrow>\n     Sta a R \\<Longrightarrow> \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow> \n    (\\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) #          \n         ((map (lift (While b c)) xs1 @\n           (Stuck,  sl) # ys))) \\<in> comm (G, p\\<inter> ({c. fst c \\<in> -b}), a) F\n\"\nproof -\nassume a0:\"(n,\\<Gamma>, (c,  s1) # xs1) \\<in> cptn_mod_nest_call\" and\n       a1:\"fst (last ((c,  s1) # xs1)) = Stuck\" and\n       a2:\"s1 \\<in> {c. fst c \\<in> b}\" and\n       a3:\"snd (last ((c,  s1) # xs1)) = sl\" and\n       a4:\"(n,\\<Gamma>, (Stuck,  sl) # ys) \\<in> cptn_mod_nest_call\" and\n       a5:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a]\" and\n       a6:\"(\\<Gamma>, (While b c,  s1) #\n           (Seq c (While b c),  s1) #  \n           (map (lift (While b c)) xs1 @\n             (Stuck,  sl) # ys)) \\<in> assum (p, R)\" and      \n       a7: \"Sta p R\" and\n       a8: \"Sta a R\" and       \n       a10:\"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\"  \n  have seq_map:\"(Seq c (While b c),  s1) # map (lift (While b c)) xs1=\n           map (lift (While b c)) ((c, s1)#xs1)\"\n  using a2 unfolding lift_def by fastforce\n  have step:\"\\<Gamma>\\<turnstile>\\<^sub>c(While b c,toSeq( s1)) \\<rightarrow> (Seq c (While b c),toSeq( s1))\" \n    using a2 WhileTruec by fastforce\n  have s1_normal:\"s1\\<in>p \\<and> s1 \\<in> {c. fst c \\<in> b} \" using a6 a2 unfolding assum_def by fastforce\n  then have G_ref:\"( s1,  s1)\\<in>G\" using a10 unfolding N_def by blast\n  have s1_collect_p: \" s1\\<in>  (p \\<inter>{c. fst c \\<in> b})\" using s1_normal by fastforce\n  have \"(n, \\<Gamma>, map (lift (While b c)) ((c, s1)#xs1))\\<in>cptn_mod_nest_call\" \n    using a2  a0\n    by (metis cptn_mod_nest_call.CptnModNestSeq1 seq_map) \n  then have cptn_seq:\"(n,\\<Gamma>,(Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in>cptn_mod_nest_call\" \n    using seq_map by auto\n  then have cptn:\"(n,\\<Gamma>, (While b c,  s1) # (Seq c (While b c),  s1) # \n                    map (lift (While b c)) xs1) \\<in> cptn_mod_nest_call\"\n    using a0 a2 cptn_mod_nest_call.CptnModNestWhile1\n    by blast \n  also have \"(\\<Gamma>, (LanguageCon.com.While b c,  s1) #\n         (LanguageCon.com.Seq c (LanguageCon.com.While b c),  s1) #\n         map (lift (LanguageCon.com.While b c)) xs1)\n          \\<in> assum (p, R) \"\n    using a6 sub_assum\n    by (metis append_Cons) \n  ultimately have assum_seq:\"(\\<Gamma>,(Seq c (While b c),  s1)  # \n                       map (lift (While b c)) xs1) \\<in> assum (p, R)\"\n    using a6 tl_of_assum_in_assum1 s1_collect_p \n          tl_of_assum_in_assum cptn_eq_cptn_mod_nest  by fast\n  have cpn_c:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> (cpn n \\<Gamma> c ( s1))\"\n    using a0 unfolding cpn_def by fastforce\n  then have cp_c:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> (cp \\<Gamma> c ( s1))\"\n    unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by auto\n  moreover have cp_seq:\"(\\<Gamma>, (Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in> \n           (cpn n \\<Gamma> (Seq c (While b c)) ( s1))\"\n    using cptn_seq unfolding cpn_def by fastforce\n  then have cp_seq':\"(\\<Gamma>, (Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in> \n            (cp \\<Gamma> (Seq c (While b c)) ( s1))\"\n    unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by auto\n  ultimately have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> assum(p,R)\"  \n    using assum_map assum_seq seq_map  by fastforce\n  then have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> assum((p \\<inter> {c. fst c \\<in> b}),R)\"\n    unfolding assum_def using s1_collect_p by fastforce\n  then have c_comm:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> comm(G,(p,a)) F\"  \n    using a5 cpn_c unfolding com_validityn_def by fastforce\n  then have False unfolding comm_def split_beta  final_glob_def using a1 by auto\n  thus ?thesis by auto       \nqed\n\nlemma while5:\n   \"(n, \\<Gamma>, (c,  s1) # xs1) \\<in> cptn_mod_nest_call \\<Longrightarrow>    \n    fst (last ((c,  s1) # xs1)) = Fault f \\<Longrightarrow>\n    s1 \\<in> {c. fst c \\<in> b} \\<Longrightarrow>\n    snd (last ((c,  s1) # xs1)) =  sl \\<Longrightarrow>\n    (n,\\<Gamma>, (Fault f, sl) # ys) \\<in> cptn_mod_nest_call   \\<Longrightarrow>\n    \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. fst c \\<in> b},R, G, p,a] \\<Longrightarrow>    \n    (\\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) #  \n         (map (lift (While b c)) xs1 @\n           (Fault f,  sl) # ys))\n       \\<in> assum (p, R)  \\<Longrightarrow>        \n     Sta p R \\<Longrightarrow>\n     Sta a R \\<Longrightarrow> \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow> \n    (\\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) #          \n         ((map (lift (While b c)) xs1 @\n           (Fault f,  sl) # ys))) \\<in> comm (G, p\\<inter> ({c. fst c \\<in> -b}), a) F\n\"\nproof -\nassume a0:\"(n,\\<Gamma>, (c,  s1) # xs1) \\<in> cptn_mod_nest_call\" and\n       a1:\"fst (last ((c,  s1) # xs1)) = Fault f\" and\n       a2:\"s1 \\<in> {c. fst c \\<in> b}\" and\n       a3:\"snd (last ((c,  s1) # xs1)) = sl\" and\n       a4:\"(n,\\<Gamma>, (Fault f,  sl) # ys) \\<in> cptn_mod_nest_call\" and\n       a5:\"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a]\" and\n       a6:\"(\\<Gamma>, (While b c,  s1) #\n           (Seq c (While b c),  s1) #  \n           (map (lift (While b c)) xs1 @\n             (Fault f,  sl) # ys)) \\<in> assum (p, R)\" and      \n       a7: \"Sta p R\" and\n       a8: \"Sta a R\" and       \n       a10:\"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\"  \n  let ?c = \"(While b c,  s1) # (Seq c (While b c),  s1) # map (lift (While b c)) xs1 \"  \n  let ?c' =\"(com.Fault f, sl) # ys\"\n  let ?c'' = \"?c @ ?c'\"\n  have seq_map:\"(Seq c (While b c),  s1) # map (lift (While b c)) xs1=\n           map (lift (While b c)) ((c, s1)#xs1)\"\n  using a2 unfolding lift_def by fastforce\n  have step:\"\\<Gamma>\\<turnstile>\\<^sub>c(While b c,toSeq( s1)) \\<rightarrow> (Seq c (While b c),toSeq( s1))\" \n    using a2 WhileTruec by fastforce\n  have s1_normal:\"s1\\<in>p \\<and> s1 \\<in> {c. fst c \\<in> b} \" using a6 a2 unfolding assum_def by fastforce\n  then have G_ref:\"( s1,  s1)\\<in>G\" using a10 unfolding N_def by blast\n  have s1_collect_p: \" s1\\<in>  (p \\<inter>{c. fst c \\<in> b})\" using s1_normal by fastforce\n  have \"(n, \\<Gamma>, map (lift (While b c)) ((c, s1)#xs1))\\<in>cptn_mod_nest_call\" \n    using a2  a0\n    by (metis cptn_mod_nest_call.CptnModNestSeq1 seq_map) \n  then have cptn_seq:\"(n,\\<Gamma>,(Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in>cptn_mod_nest_call\" \n    using seq_map by auto\n  then have cptn:\"(n,\\<Gamma>, ?c) \\<in> cptn_mod_nest_call\"\n    using a0 a2 cptn_mod_nest_call.CptnModNestWhile1\n    by blast \n  also have \"(\\<Gamma>, ?c) \\<in> assum (p, R) \"\n    using a6 sub_assum\n    by (metis append_Cons) \n  ultimately have assum_seq:\"(\\<Gamma>,(Seq c (While b c),  s1)  # \n                       map (lift (While b c)) xs1) \\<in> assum (p, R)\"\n    using a6 tl_of_assum_in_assum1 s1_collect_p \n          tl_of_assum_in_assum cptn_eq_cptn_mod_nest  by fast  \n  have cpn_c:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> (cpn n \\<Gamma> c ( s1))\"\n    using a0 unfolding cpn_def by fastforce\n  then have cp_c:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> (cp \\<Gamma> c ( s1))\"\n    unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by auto\n  moreover have cp_seq:\"(\\<Gamma>, (Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in> \n           (cpn n \\<Gamma> (Seq c (While b c)) ( s1))\"\n    using cptn_seq unfolding cpn_def by fastforce\n  then have cp_seq':\"(\\<Gamma>, (Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in> \n            (cp \\<Gamma> (Seq c (While b c)) ( s1))\"\n    unfolding cp_def cpn_def using cptn_eq_cptn_mod_nest by auto\n  ultimately have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> assum(p,R)\"  \n    using assum_map assum_seq seq_map  by fastforce\n  then have \"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> assum((p \\<inter> {c. fst c \\<in> b}),R)\"\n    unfolding assum_def using s1_collect_p by fastforce\n  then have c_comm:\"(\\<Gamma>, ((c,  s1) # xs1)) \\<in> comm(G,(p,a)) F\"  \n    using a5 cpn_c unfolding com_validityn_def by fastforce\n  then have \"(\\<Gamma>, (Seq c (While b c),  s1) # map (lift (While b c)) xs1) \\<in> comm(G,(p,a)) F\"\n    using cp_seq' cp_c comm_map seq_map by fastforce\n  then have comm_while:\"(\\<Gamma>, ?c) \\<in> comm(G,(p,a)) F\"\n    using G_ref ctran_in_comm by blast   \n  then have \"\\<forall>i. Suc i < length ?c \\<longrightarrow> \n                     \\<Gamma>\\<turnstile>\\<^sub>c (fst (?c ! i), toSeq (snd (?c ! i))) \\<rightarrow>\n                         (fst (?c ! Suc i), toSeq (snd (?c ! Suc i))) \\<longrightarrow>\n                    (snd (?c !i), snd(?c !(Suc i))) \\<in> G\"\n    using comm_dest by fastforce\n  moreover have \"\\<forall>i. Suc i < length ?c' \\<longrightarrow> \\<not> \\<Gamma>\\<turnstile>\\<^sub>c (fst (?c' ! i), toSeq (snd (?c' ! i))) \\<rightarrow>\n                                    (fst (?c' ! Suc i), toSeq (snd (?c' ! Suc i)))\"\n    by (metis (no_types) a4 cptn_if_cptn_mod cptn_mod_nest_cptn_mod \n              fst_conv nth_Cons_0 only_one_component_tran_0)\n  then have \"\\<forall>i. Suc i < length ?c' \\<longrightarrow> \n                     \\<Gamma>\\<turnstile>\\<^sub>c (fst (?c' ! i), toSeq (snd (?c' ! i))) \\<rightarrow>\n                         (fst (?c' ! Suc i), toSeq (snd (?c' ! Suc i))) \\<longrightarrow>\n                    (snd (?c' !i), snd(?c' !(Suc i))) \\<in> G\"\n    by auto\n  moreover have \"(snd (last ?c), snd (?c' ! 0))\\<in>G\" using a10 a1 a3 unfolding N_def\n    by (smt a0 cptn_all_len_eq_0 cptn_if_cptn_mod cptn_mod_nest_cptn_mod last.simps last_length \n            last_map length_Cons length_map \n            lessI list.simps(3) list.size(3) mem_Collect_eq nth_Cons_0 s1_normal snd_conv snd_lift)   \n  ultimately have \n   \"\\<forall>i. Suc i < length ?c'' \\<longrightarrow> \n          \\<Gamma>\\<turnstile>\\<^sub>c (fst (?c'' ! i), toSeq (snd (?c'' ! i))) \\<rightarrow>\n              (fst (?c'' ! Suc i), toSeq (snd (?c'' ! Suc i))) \\<longrightarrow> \n        (snd (?c'' !i), snd(?c'' !(Suc i))) \\<in> G\"\n    using step_guard_concat by blast  \n  moreover have \" (final_glob (last ?c'')  \\<longrightarrow>   \n                 fst (last ?c'') \\<notin> Fault ` F  \\<longrightarrow>                 \n                    ((fst (last ?c'') = Skip \\<and> snd (last ?c'') \\<in> p\\<inter> ({c. fst c \\<in> -b}))) \\<or>\n                    (fst (last ?c'') = Throw \\<and> snd (last ?c'') \\<in> a))\"\n    apply (cases \"f\\<in>F\")    \n     apply (metis (no_types, lifting) LanguageCon.com.distinct(171)\n           LanguageCon.com.distinct(19) a1 a3 a4 c_comm \n           comm_dest2 cptn_if_cptn_mod cptn_mod_nest_cptn_mod \n           final_glob_def last_appendR last_not_F length_Cons list.simps(3) nth_Cons_0 \n           prod.collapse zero_less_Suc)     \n    by (metis (no_types, lifting)  a1 a3 a4 LanguageCon.com.distinct(171) LanguageCon.com.distinct(19)\n            c_comm comm_dest2 cptn_if_cptn_mod cptn_mod_nest_cptn_mod final_glob_def last_appendR \n             last_not_F length_Cons list.simps(3) nth_Cons_0 prod.collapse zero_less_Suc)    \n  ultimately show ?thesis\n    by (simp add: commI) \nqed\n\n\ninductive_cases stepc_elim_cases_while_throw [cases set]:\n \"\\<Gamma>\\<turnstile>\\<^sub>c(While b c, s) \\<rightarrow> (Throw, t)\"\n\ninductive_cases stepc_elim_cases_while_Stuck [cases set]:\n \"\\<Gamma>\\<turnstile>\\<^sub>c(While b c, s) \\<rightarrow> (Stuck, t)\"\n\ninductive_cases stepc_elim_cases_while_Fault [cases set]:\n \"\\<Gamma>\\<turnstile>\\<^sub>c(While b c, s) \\<rightarrow> (Fault f, t)\"\n\n\nlemma WhileSound_aux:\n \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a] \\<Longrightarrow>\n  Sta p R \\<Longrightarrow>\n  Sta  (p \\<inter> ({c. fst c \\<in> -b})) R \\<Longrightarrow> \n  Sta a R \\<Longrightarrow>    \n  (n, \\<Gamma>,x)\\<in> cptn_mod_nest_call \\<Longrightarrow> \n  \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G \\<Longrightarrow>\n  \\<forall>s xs. x = ((While b c1),s)#xs \\<longrightarrow> \n     (\\<Gamma>,x)\\<in>assum(p,R) \\<longrightarrow> \n     (\\<Gamma>,x) \\<in> comm (G,(( p \\<inter> ({c. fst c \\<in> -b})),a)) F\"\nproof -\n  assume a0: \"\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a] \" and\n         a1: \"Sta p R\" and\n         a2: \"Sta  (p \\<inter> ({c. fst c \\<in> -b})) R\" and\n         a3: \"Sta a R\" and\n         a4: \"(n,\\<Gamma>,x)\\<in> cptn_mod_nest_call\" and\n         a5: \"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\" \n   {fix xs s \n   assume while_xs:\"x=((While b c1),s)#xs\" and\n          x_assum:\"(\\<Gamma>,x)\\<in>assum(p,R)\"\n   have \"(\\<Gamma>,x) \\<in> comm (G,(( p \\<inter> {c. fst c \\<in> -b}),a)) F\"\n   using a4 a0  while_xs x_assum\n   proof (induct arbitrary: xs s c1 rule:cptn_mod_nest_call.induct)\n     case (CptnModNestOne  \\<Gamma> C s1) thus ?case \n       using CptnModOne unfolding comm_def final_glob_def\n       by auto\n   next\n     case (CptnModNestEnv  \\<Gamma> C s1 t1 n xsa) \n     then have c_while:\"C = While b c1\" by fastforce\n     have \"(\\<Gamma>, (C, t1) # xsa) \\<in> assum (p, R) \\<longrightarrow>\n                (\\<Gamma>, (C, t1) # xsa) \\<in> comm (G, p \\<inter> {c. fst c \\<in> -b}, a) F\"  \n     using CptnModNestEnv by fastforce  \n     moreover have\"(n,\\<Gamma>,(C, s1)#(C, t1) # xsa) \\<in> cptn_mod_nest_call\"\n       using CptnModNestEnv(1,2) CptnModNestEnv.hyps(1) CptnModNestEnv.hyps(2)\n       using cptn_mod_nest_call.CptnModNestEnv by blast\n     then have  cptn_mod:\"(\\<Gamma>,(C, s1)#(C, t1) # xsa) \\<in> cptn\"    \n       using cptn_eq_cptn_mod_nest by blast  \n     then have \"(\\<Gamma>, (C, t1) # xsa) \\<in> assum (p, R)\"   \n       using tl_of_assum_in_assum CptnModNestEnv(6) a1 a2 a3 a4 a5\n       by blast\n     ultimately have \"(\\<Gamma>, (C, t1) # xsa) \\<in> comm (G, p \\<inter> {c. fst c \\<in> -b}, a) F\"\n       by auto\n     also have \" \\<not> (\\<Gamma>\\<turnstile>\\<^sub>c((C,toSeq s1))  \\<rightarrow> ((C,toSeq t1)))\"\n       by (simp add: mod_env_not_component)      \n     ultimately show ?case \n       using cptn_mod etran_in_comm by blast\n   next \n     case (CptnModNestSkip \\<Gamma> C s1 t1 n xsa) \n     then have \"C=While b c1\" by auto\n     also have \"(n,\\<Gamma>, (LanguageCon.com.Skip, t1) # xsa) \\<in> cptn_mod_nest_call\"\n       using cptn_eq_cptn_mod_set CptnModNestSkip(4)\n       using CptnModNestSkip.hyps(5) by blast\n     thus ?case using WhileNone CptnModNestSkip a1 a2 a3 a4 a5  by blast\n   next\n     case (CptnModNestThrow  \\<Gamma> C s1 t1 n xsa) \n     then have \"C = While b c1\" by auto \n       thus ?case using stepc_elim_cases_while_throw CptnModNestThrow(1) \n         by fastforce\n   next\n     case (CptnModNestStuck  \\<Gamma> C s1 t1 n xsa) \n     then have \"C = While b c1\" by auto \n       thus ?case using stepc_elim_cases_while_Stuck CptnModNestStuck(1) \n         by fastforce\n   next\n     case (CptnModNestFault  \\<Gamma> C s1 t1 n xsa) \n     then have \"C = While b c1\" by auto \n       thus ?case using stepc_elim_cases_while_Fault CptnModNestFault(1) \n         by fastforce\n   next \n     case (CptnModNestWhile1  n \\<Gamma> c s1 xs1 b1 xsa zs) \n     then have \"b=b1 \\<and> c=c1 \\<and> s= s1\" by auto      \n     thus ?case\n     using a4 a5 CptnModNestWhile1 while1[of n \\<Gamma>] by blast\n   next \n     case (CptnModNestWhile2 n \\<Gamma> c s1 xs1 b1 xsa ys zs)\n     then have a00: \"(n,\\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) # xsa)\\<in>cptn_mod_nest_call\" \n       using cptn_mod_nest_call.CptnModNestWhile2 by fast   \n     then have eqs:\"b=b1 \\<and> c=c1 \\<and> s= s1\"using CptnModNestWhile2 by auto\n     thus ?case using  a00 a4 a5 CptnModNestWhile2 while2[of n \\<Gamma> b c s1 xsa xs1 ys F p R G a] \n       by blast        \n   next\n     case (CptnModNestWhile3 n \\<Gamma> c s1 xs1 t f b1 sl ys zs)  \n     then have eqs:\"b=b1 \\<and> c=c1 \\<and> s= s1\" by auto \n     then have \"(\\<Gamma>, (While b c,  s1) #\n         (Seq c (While b c),  s1) #          \n         ((map (lift (While b c)) xs1 @\n           (t,  sl) # ys))) \\<in> comm (G, p\\<inter>{c. fst c \\<in> -b}, a) F\"        \n     proof(cases t)      \n       case Stuck\n       then show ?thesis using a1 a3 a4 a5 CptnModNestWhile3 while4[of n \\<Gamma> c s1 xs1 b sl ys F p R G a] \n         by fastforce    \n     next\n       case (Fault x11)\n       then show ?thesis  \n         using a1 a3 a4 a5 CptnModNestWhile3 while5[of n \\<Gamma> c s1 xs1 x11 b sl ys F p R G a] \n         by fastforce\n     next\n       case Throw\n       then show ?thesis \n         using a1 a3 a4 a5 CptnModNestWhile3 while3[of n \\<Gamma> c s1 xs1 b sl ys F p R G a] \n         by fastforce\n     qed(insert CptnModNestWhile3(4), auto)\n     thus ?case using eqs CptnModNestWhile3 by auto\n   qed (auto)\n  }\n  then show ?thesis by auto    \nqed\n\n\nlemma While_sound: \n      \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a] \\<Longrightarrow>\n       (\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a]) \\<Longrightarrow>       \n       Sta p R \\<Longrightarrow>     \n       Sta (p \\<inter> {c. fst c \\<in> -b}) R \\<Longrightarrow> Sta a R \\<Longrightarrow> \\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G  \\<Longrightarrow>\n       \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> (While b c1) sat [p, R, G, p \\<inter> {c. fst c \\<in> -b},a]\"\nproof -  \n  assume\n    a0:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a]\" and\n    a1:\"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n \\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a]\" and    \n    a2: \"Sta p R\" and\n    a3: \"Sta (p \\<inter> {c. fst c \\<in> -b}) R\" and\n    a4: \"Sta a R\" and\n    a5: \"\\<forall>s. length (snd s) \\<in> N p  \\<longrightarrow> ( s,  s) \\<in> G\" \n  { \n    fix s\n    assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"  \n    then have a1:\"(\\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> c1 sat [p \\<inter> {c. fst c \\<in> b}, R, G, p,a])\" \n      using a1 com_cvalidityn_def by fastforce\n    have \"cpn n \\<Gamma> (While b c1)  s \\<inter> assum(p, R) \\<subseteq> comm(G, (p \\<inter> {c. fst c \\<in> -b},a)) F\"\n    proof-\n      {fix c     \n        assume a10:\"c \\<in> cpn n \\<Gamma> (While b c1) s\" and a11:\"c \\<in> assum(p, R)\"\n        then have a10': \"c \\<in> cp  \\<Gamma> (While b c1) s\"\n          unfolding cp_def cpn_def using cptn_eq_cptn_mod_set cptn_mod_nest_cptn_mod by fastforce\n      obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n      have cp:\"l!0=((While b c1),s) \\<and> (\\<Gamma>,l) \\<in> cptn \\<and> \\<Gamma>=\\<Gamma>1\" using a10' cp_def c_prod by fastforce      \n      have \\<Gamma>1:\"(\\<Gamma>, l) = c\" using c_prod cp by blast\n      obtain xs where \"l=((While b c1),s)#xs\" using cp\n      proof -\n        assume a1: \"\\<And>xs. l = (LanguageCon.com.While b c1, s) # xs \\<Longrightarrow> thesis\"\n        have \"[] \\<noteq> l\"\n          using cp cptn.simps\n          by blast\n        then show ?thesis\n          using a1 by (metis (full_types) SmallStepCon.nth_tl cp)\n      qed \n      moreover have \"(n,\\<Gamma>,l)\\<in>cptn_mod_nest_call\" using a10\n        using \\<Gamma>1 cpn_def by fastforce  \n      ultimately have \"c \\<in> comm(G, (p \\<inter> {c. fst c \\<in> -b},a)) F\"\n      using a1 a2 a3 a4   WhileSound_aux a11 \\<Gamma>1 a5 \n        by blast\n      } thus ?thesis by auto qed\n  }\n  thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def)  \nqed\n\n\nlemma Conseq_sound:\n  \"(\\<forall>s\\<in> p.\n       \\<exists>p' R' G' q' a' I' \\<Theta>'.\n          s \\<in> p' \\<and>\n          R \\<subseteq> R' \\<and>            \n          G' \\<subseteq> G \\<and>             \n          q' \\<subseteq> q \\<and>\n          a' \\<subseteq> a \\<and> \\<Theta>' \\<subseteq> \\<Theta> \\<and>\n          \\<Gamma>,\\<Theta>' \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a'] \\<and> \n          (\\<forall>n. \\<Gamma>,\\<Theta>' \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a'])) \\<Longrightarrow>\n  \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p,R, G, q,a]\" \nproof -\n  assume \n  a0: \"(\\<forall>s\\<in> p.\n       \\<exists>p' R' G' q' a' I' \\<Theta>'.\n          s \\<in> p' \\<and>\n          R \\<subseteq> R' \\<and>            \n          G' \\<subseteq> G \\<and>             \n          q' \\<subseteq> q \\<and>\n          a' \\<subseteq> a \\<and> \\<Theta>' \\<subseteq> \\<Theta> \\<and>\n          \\<Gamma>,\\<Theta>' \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a'] \\<and> \n          (\\<forall>n. \\<Gamma>,\\<Theta>' \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']))\"\n  {\n    fix s\n    assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n    have \"cpn n \\<Gamma> P  s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n    proof -\n    {\n      fix c\n      assume a10:\"c \\<in> cpn n \\<Gamma> P s\" and a11:\"c \\<in> assum(p, R)\"\n      then have a10':\"c\\<in>cp \\<Gamma> P s\" unfolding cp_def cpn_def cptn_eq_cptn_mod_nest by auto\n      obtain \\<Gamma>1 l where c_prod:\"c=(\\<Gamma>1,l)\" by fastforce\n      have cp:\"l!0=(P,s) \\<and> (n,\\<Gamma>,l) \\<in> cptn_mod_nest_call \\<and> \\<Gamma>=\\<Gamma>1\" using a10 cpn_def c_prod by fastforce\n      have \\<Gamma>1:\"(\\<Gamma>, l) = c\" using c_prod cp by blast \n      obtain xs where \"l=(P,s)#xs\" using cp\n      proof -\n        assume a1: \"\\<And>xs. l = (P, s) # xs \\<Longrightarrow> thesis\"\n        have \"[] \\<noteq> l\"\n          using cp cptn.simps\n          using CptnEmpty by force\n        then show ?thesis\n          using a1 by (metis (full_types) SmallStepCon.nth_tl cp)\n      qed      \n      then have \"s \\<in> p\" using a10 a11 unfolding assum_def cpn_def by fastforce\n      then have ns:\"s\\<in>p\" by auto\n      then have\n      \"\\<forall>s. s \\<in> p \\<longrightarrow> (\\<exists>p' R' G' q' a' \\<Theta>'. (s\\<in>p') \\<and>\n        R \\<subseteq> R' \\<and>            \n        G' \\<subseteq> G \\<and>             \n        q' \\<subseteq> q \\<and>\n        a' \\<subseteq> a \\<and> \\<Theta>' \\<subseteq> \\<Theta> \\<and>\n        (\\<Gamma>,\\<Theta>' \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a']) \\<and> \n        (\\<forall>n. \\<Gamma>,\\<Theta>' \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']))\" using a0 by auto\n      then have \n       \"s \\<in> p \\<longrightarrow> (\\<exists>p' R' G' q' a' \\<Theta>'. (s \\<in> p' ) \\<and>\n        R \\<subseteq> R' \\<and>            \n        G' \\<subseteq> G \\<and>             \n        q' \\<subseteq> q \\<and>\n        a' \\<subseteq> a \\<and> \\<Theta>' \\<subseteq> \\<Theta> \\<and>\n        (\\<Gamma>,\\<Theta>' \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p',R', G', q',a']) \\<and> \n        (\\<forall>n. \\<Gamma>,\\<Theta>' \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a']))\" apply (rule allE) by auto     \n     then obtain p' R' G' q' a' \\<Theta>'   where\n     rels:\n       \"s \\<in> p' \\<and>\n        R \\<subseteq> R' \\<and>            \n        G' \\<subseteq> G \\<and>             \n        q' \\<subseteq> q \\<and>\n        a' \\<subseteq> a \\<and> \\<Theta>' \\<subseteq> \\<Theta> \\<and>       \n        (\\<forall>n. \\<Gamma>,\\<Theta>' \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a'])\" using ns by auto\n      then have \"s \\<in> p'\"  by fastforce\n      then have \"(\\<Gamma>,l) \\<in> assum(p', R')\"\n        using a11 rels cp a11 c_prod assum_R_R'[of \\<Gamma> l p R p' R'] \n        by fastforce\n      then have \"(\\<Gamma>,l) \\<in> comm(G',(q',a')) F\" \n        using rels all_call a10 c_prod cp unfolding com_cvalidityn_def com_validityn_def \n        by blast\n      then have \"(\\<Gamma>,l) \\<in> comm(G, (q,a)) F\" \n        using c_prod cp comm_conseq[of \\<Gamma> l G' q' a' F G q a] rels by fastforce\n      then have \"c \\<in> comm(G, (q,a)) F\" using c_prod cp by fastforce\n    }                 \n    thus ?thesis unfolding comm_def by force qed      \n  } thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def)  \nqed   \n\nlemma Conj_post_sound:\n  \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p,R, G, q,a] \\<and> \n   (\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]) \\<Longrightarrow> \n   \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p,R, G, q',a'] \\<and> \n   (\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n \\<^bsub>/F\\<^esub> P sat [p, R, G, q',a']) \\<Longrightarrow>\n  \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p,R, G, q \\<inter> q' ,a \\<inter> a']\" \nproof -\nassume a0: \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p,R, G, q,a] \\<and> \n   (\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a])\" and\n       a1: \" \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p,R, G, q',a'] \\<and> \n   (\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n \\<^bsub>/F\\<^esub> P sat [p, R, G, q',a'])\"\n{\n    fix s\n    assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n    with a0 have a0:\"cpn n \\<Gamma> P  s \\<inter> assum(p, R) \\<subseteq> comm(G, (q,a)) F\"\n      unfolding com_cvalidityn_def com_validityn_def by blast\n    with a1 all_call have a1:\"cpn n \\<Gamma> P  s \\<inter> assum(p, R) \\<subseteq> comm(G, (q',a')) F\"\n      unfolding com_cvalidityn_def com_validityn_def by blast\n    have \"cpn n \\<Gamma> P  s \\<inter> assum(p, R) \\<subseteq> comm(G, (q\\<inter>q',a\\<inter>a')) F\"\n    proof -\n    {\n      fix c\n      assume a10:\"c \\<in> cpn n \\<Gamma> P s\" and a11:\"c \\<in> assum(p, R)\"\n      then have \"c \\<in> comm(G,(q,a)) F \\<and> c \\<in> comm(G,(q',a')) F\"\n        using a0 a1 by auto\n      then have  \"c\\<in>comm(G, (q\\<inter>q',a\\<inter>a')) F\"\n        unfolding comm_def by force\n    }               \n    thus ?thesis unfolding comm_def by force qed      \n  } thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def)  \nqed  \n  \nlemma x91:\"sa\\<noteq>{} \\<Longrightarrow> c\\<in>comm(G, (\\<Inter>i\\<in>sa. q i,a)) F  = (\\<forall>i\\<in>sa. c\\<in>comm(G, q i,a) F)\"    \n  unfolding comm_def by (auto simp add: Ball_def) \n\n    \nlemma conj_inter_sound:\n\"sa \\<noteq> {} \\<Longrightarrow> \n \\<forall>i\\<in>sa. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q i,a] \\<and> (\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p,R, G, q i,a]) \\<Longrightarrow> \n \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p,R, G, \\<Inter>i\\<in>sa. q i,a]\"\nproof -\n  assume a0':\"sa\\<noteq>{}\" and \n         a0: \"\\<forall>i\\<in>sa. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q i,a] \\<and> \n              (\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n\\<^bsub>/F\\<^esub> P sat [p,R, G, q i,a])\" \n{\n    fix s\n    assume all_call:\"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \\<Gamma> \\<Turnstile>n\\<^bsub>/F\\<^esub> (Call c) sat [p, R, G, q,a]\"\n    with a0 have a0:\"\\<forall>i\\<in>sa. cpn n \\<Gamma> P  s \\<inter> assum(p, R) \\<subseteq> comm(G, (q i,a)) F\"\n      unfolding com_cvalidityn_def com_validityn_def by fast    \n    have \"cpn n \\<Gamma> P  s \\<inter> assum(p, R) \\<subseteq> comm(G, (\\<Inter>i\\<in>sa. q i,a)) F\"\n    proof -\n    {\n      fix c\n      assume a10:\"c \\<in> cpn n \\<Gamma> P s\" and a11:\"c \\<in> assum(p, R)\"        \n      then have  \"(\\<forall>i\\<in>sa. c\\<in>comm(G, q i,a) F)\"        \n        using a0 by fastforce\n      then have \"c\\<in>comm(G, (\\<Inter>i\\<in>sa. q i,a)) F\" using x91[OF a0'] by blast\n    }               \n    thus ?thesis unfolding comm_def by force qed      \n  } thus ?thesis by (simp add: com_validityn_def[of \\<Gamma>] com_cvalidityn_def)  \nqed     \n\nlemma empty_p_valid:\"\\<Gamma>,\\<Theta> \\<Turnstile>n \\<^bsub>/F\\<^esub> c sat [{}, R, G, q,a]\"\n  unfolding com_cvalidityn_def com_validityn_def assum_def  by auto\n\nlemma localRG_sound: \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> c sat [p, R, G, q,a] \\<Longrightarrow> (\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n \\<^bsub>/F\\<^esub> c sat [p, R, G, q,a])\"\nproof (induct rule:lrghoare.induct)\n  case Skip \n    thus ?case  by (simp add: Skip_sound)\nnext\n  case Spec\n    thus ?case  by (simp add: Spec_sound)\nnext\n  case Basic\n    thus ?case by (simp add: Basic_sound)\nnext\n  case Await\n    thus ?case by (simp add: Await_sound)\nnext\n  case Throw thus ?case by (simp add: Throw_sound)\nnext \n  case If thus ?case using If_sound by (simp add: If_sound)\nnext\n  case Asm thus ?case by (simp add: Asm_sound)\nnext \n  case CallRec thus ?case  by (simp add: CallRec_sound)\nnext\n  case Call thus ?case using Call_sound  by (simp add: Call_sound)\nnext\n  case Seq thus ?case by (simp add: Seq_sound)\nnext\n  case Catch thus ?case by (simp add: Catch_sound)\nnext\n  case DynCom thus ?case by (simp add: DynCom_sound)\nnext\n  case Guard thus ?case by (simp add: Guard_sound)\nnext\n  case Guarantee thus ?case by (simp add: Guarantee_sound)\nnext\n  case (While p R b a G \\<Gamma> \\<Theta> F c)\n  thus ?case using While_sound[of \\<Gamma>] by simp\nnext\n  case (Conseq p R G q a \\<Gamma> \\<Theta> F P) thus ?case \n    using Conseq_sound by simp\nnext \n  case (Conj_post \\<Gamma> \\<Theta> F P p' R' G' q a q' a') thus ?case\n    using Conj_post_sound[of \\<Gamma> \\<Theta>] by simp\nnext\n  case (Conj_Inter sa \\<Gamma> \\<Theta> F P p' R' G' q a ) \n  thus ?case using conj_inter_sound[of sa \\<Gamma> \\<Theta>] by simp \nnext \n  case (Stuck p) thus ?case using empty_p_valid by auto\nnext \n  case (Fault) thus ?case using empty_p_valid by auto\nqed   \n\n\ndefinition ParallelCom :: \"('g,'l,'p,'f,'e) p_rgformula list \\<Rightarrow> ('g,'l,'p,'f,'e) par_com\"\nwhere\n\"ParallelCom Ps \\<equiv> map fst Ps\"\n\nlemma ParallelCom_Com:\"i<length xs \\<Longrightarrow> (ParallelCom xs)!i = Par_Com (xs!i)\"\n  unfolding ParallelCom_def Par_Com_def by fastforce\n\nlemma step_e_step_c_eq:\"\\<lbrakk> \n  (\\<Gamma>,l) \\<propto> clist;\n  Suc m < length l;\n  i < length clist; \n  (fst (clist!i))\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!m),  toSeqState i (snd((snd (clist!i))!m))) \\<rightarrow>\\<^sub>e  \n                   (fst ((snd (clist!i))!(Suc m)), toSeqState  i (snd((snd (clist!i))!(Suc m))));         \n  (fst (clist!i))\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!m),  toSeq (toSeqState i (snd((snd (clist!i))!m)))) \\<rightarrow>  \n                   (fst ((snd (clist!i))!(Suc m)), toSeq (toSeqState  i (snd((snd (clist!i))!(Suc m)))));\n  (\\<forall>l<length clist. \n     l\\<noteq>i \\<longrightarrow>  (fst (clist!l))\\<turnstile>\\<^sub>c(fst ((snd (clist!l))!m),  toSeqState l (snd((snd (clist!l))!m))) \\<rightarrow>\\<^sub>e  \n                   (fst ((snd (clist!l))!(Suc m)), toSeqState  l (snd((snd (clist!l))!(Suc m)))))\n  \\<rbrakk> \\<Longrightarrow> \n  l!m = l!(Suc m)\"\n  using etran_ctran_False by blast\n\n\nlemma takecptni_is_cptni [rule_format, elim!]:\n  \"\\<forall>j. (i',\\<Gamma>,c) \\<in> cptni \\<longrightarrow> (i',\\<Gamma>, take (Suc j) c) \\<in> cptni\"\napply(induct \"c\")\n apply(force elim: cptn.cases)\napply clarify\napply(case_tac j)\n apply simp\n  apply (simp add: cptni.CptnOnei)\napply simp\napply(force intro:cptni.intros elim:cptni.cases)\ndone\n\n\n\nlemma dropcptni_is_cptni [rule_format,elim!]:\n  \"\\<forall>j<length c. (i',\\<Gamma>,c) \\<in> cptni \\<longrightarrow> (i',\\<Gamma>, drop j c) \\<in> cptni\"\napply(induct \"c\")\n apply(force elim: cptni.cases)\napply clarify\napply(case_tac j,simp+)\napply(erule cptni.cases)\n  apply simp\n apply force\n  done\n\nlemma  wf_local_vars:\"(\\<Gamma>,l) \\<propto> clist \\<Longrightarrow> \n        i<length clist \\<Longrightarrow> \n        j<length (snd (clist!i)) \\<Longrightarrow> (\\<Gamma>,l) \\<in> par_cp  \\<Gamma> (ParallelCom xs) s \\<Longrightarrow>\n        i<length (snd (snd(snd (clist!i)!j)))\"\nproof-\n  assume a0:\"(\\<Gamma>,l) \\<propto> clist\" and\n        a1:\"i<length clist\" and\n        a2:\"j<length (snd (clist!i))\" and \n        a3:\"(\\<Gamma>,l) \\<in> par_cp  \\<Gamma> (ParallelCom xs) s\"\n  then have len0:\" length (fst (l!0))\\<le> length (snd (snd(l!0)))\"\n    using a0 unfolding conjoin_def same_length_state_program_def same_length_def\n    by auto  \n  {\n    have j_len:\"j<length l\" using a2 a0  conjoin_same_length unfolding conjoin_def same_length_def\n      by (simp add: a1)\n    moreover have j_v:\"snd (l!j) = snd(snd (clist!i)!j) \" using  a0 unfolding par_cp_def\n      using a1 conjoin_def j_len same_state_def calculation by fastforce\n    ultimately have \"i<length (snd (snd(snd (clist!i)!j)))\" using len0 a0 a3 all_same_length_state_program[OF _ _ j_len ] \n      unfolding par_cp_def conjoin_def\n      using a0 a1 conjoin_same_length\n      by fastforce \n  } thus ?thesis by auto  \nqed\n\nlemma cpi_par_state_image_cp:\n  assumes a0:\"(\\<Gamma>1,l) \\<in> cpi i \\<Gamma> C s\" and \n          a1:\"i< length (snd s)\"\n      shows \"(\\<Gamma>1,l) \\<in>({(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` \n                (cp \\<Gamma> C ((toSeqState i s))))\"\n  using a0  unfolding cp_def cpi_def Image_def\nproof(auto)\n  assume a01:\"l!0=(C,s)\" and\n         a02:\"(i, \\<Gamma>, l) \\<in> cptni\"    \n  then obtain g ls where  s:\"s = (g, ls)\" by fastforce\n  then have  \"(\\<Gamma>, toSeqCptn i l) \\<in> cptn\"\n    using cptni_cptn[OF a02] a1 s a01 by auto\n  moreover have \"length (toSeqCptn i l)>0\" \n     using cptn.cases calculation  unfolding toSeqCptn_def by blast\n  then have  \" toSeqCptn i l  ! 0 = (C, toSeqState i s)\"\n     using a01 unfolding toSeqCptn_def  by auto\n   moreover have  \"(toSeqCptn i l , l) \\<in> par_state_list_rel i\"\n     using toSeqCptn_in_rel a1 s a02  a01 length_locs_less_i\n     by (metis neq0_conv not_less0 snd_conv)\n   ultimately show \"\\<exists>b. b ! 0 = (C, toSeqState i s) \\<and> (\\<Gamma>, b) \\<in> cptn \\<and> (b, l) \\<in> par_state_list_rel i\"\n     by auto    \nqed\n\n\nlemma assum_cpi_in_rel_image:\n  assumes \n  a0:\"(\\<Gamma>, l) \\<in> assum_p i (P, R)\" and\n  a1:\"(\\<Gamma>, l) \\<in> cpi i \\<Gamma> C s\" and\n  a2:\"i< length (snd s)\"\nshows \"(\\<Gamma>, l)\\<in> ({(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` ((cp \\<Gamma> C (toSeqState i s)) \\<inter> \n                  assum (Seq_pred i P, Seq_rel i R)))\"\nproof-\n  have  \"cpi i \\<Gamma> C s \\<subseteq> ({(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` \n         (cp \\<Gamma> C ((toSeqState i s))))\"    \n  proof-\n    {fix l1 \\<Gamma>1\n      assume a01:\"(\\<Gamma>1,l1)\\<in>cpi i \\<Gamma> C s\"\n      have \"(\\<Gamma>1,l1)\\<in> {(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` \n         (cp \\<Gamma> C ((toSeqState i s)))\"\n        using cpi_par_state_image_cp[OF a01 a2] by auto\n    } thus ?thesis by auto\n  qed        \n  then have \"(\\<Gamma>, l) \\<in> ({(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` \n         (cp \\<Gamma> C ((toSeqState i s))))\" using a1 by fastforce\n  moreover have  \"assum_p i (P, R) = {(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` \n                                    assum (Seq_pred i P, Seq_rel i R)\"\n    unfolding assum_p_def Let_def split_beta  by force\n  then have \"(\\<Gamma>, l) \\<in>{(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` \n                                    assum (Seq_pred i P, Seq_rel i R)\" using a0 by fastforce\n  ultimately show ?thesis unfolding Image_def apply auto\n    by (metis IntI fst_conv par_state_list_rel_eq snd_conv)\nqed\n\nlemma assum_p_cpi_in_com_p:\n  assumes a0: \"(\\<Gamma>, l) \\<in> assum_p i (P, R)\" and\n    a1:\"(\\<Gamma>, l) \\<in> cpi i \\<Gamma> C s\" and \n    a1':\"i< length (snd s)\" and\n    a2:\"\\<forall>(c, p, R, G, q, a)\\<in>\\<Theta>.\n          Pred_wf i p \\<and> Rel_wf i R \\<and> Rel_wf i G \\<and> Pred_wf i q \\<and> Pred_wf i a \\<longrightarrow> \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub>\n          LanguageCon.com.Call c sat i [p,R, G, q,a]\" and\n    a3:\"\\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> C sat i [P,R, G, Q,A]\" \nshows \" (\\<Gamma>, l) \\<in> comm_p i (G, Q, A) F\"\nproof-\n  have \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> C sat i [P,R, G, Q,A]\"\n    using a2 a3 unfolding comp_cvalidity_def by auto\n  moreover have \"(\\<Gamma>, l)\\<in> ({(s, p). fst p = fst s \\<and>  (snd s, snd p)\\<in>par_state_list_rel i} `` \n                   ((cp \\<Gamma> C (toSeqState i s)) \\<inter> \n                  assum (Seq_pred i P, Seq_rel i R)))\"\n    using assum_cpi_in_rel_image[OF a0 a1 a1'] by fastforce\n  ultimately show ?thesis unfolding comp_validity_def by fastforce\nqed\n\n\n\nlemma cptni_wf:\n  assumes a0:\"(i,\\<Gamma>,cpt)\\<in>cptni\" and\n   a1:\"snd (cpt ! 0) \\<in>  P\" and\n   a2:\"Pred_wf i P\" \n  shows \"\\<forall>j<length cpt. i<length (snd (snd(cpt!j)))\"\nproof-\n  have \"snd(cpt!0)  \\<in> P\"\n    using a1 by auto\n  then have \"i<length (snd (snd(cpt!0)))\" \n    using a2 unfolding Pred_wf_def by auto\n  then show ?thesis using a0\n    by (metis length_greater_0_conv length_locs_less_i list.size(3) not_less0 prod.exhaust_sel)\nqed\n\n\nlemma two': \n  \"\\<lbrakk> \\<forall>i<length xs. R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n       \\<subseteq> (Par_Rely (xs ! i));\n   p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i)));\n   \\<forall>i<length xs.\n    \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i [Par_Pre (xs!i), Par_Rely (xs ! i), \n                                 Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)];\n   length xs=length clist; (\\<Gamma>,l) \\<in> par_cp \\<Gamma> (ParallelCom xs) s; (\\<Gamma>,l)\\<in>par_assum (p, R) ;\n  \\<forall>i<length clist. clist!i\\<in>cpi  i \\<Gamma> (Par_Com(xs!i)) s; (\\<Gamma>,l) \\<propto> clist;\n  (\\<forall>i<length xs.\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>.  Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow> \n    \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a]); \\<forall>i<length xs. Rel_wf i (Par_Guar(xs!i));  \n   \\<forall>i<length xs. Pred_wf i p\\<rbrakk>\n  \\<Longrightarrow> \\<forall>i j. i<length clist \\<and> Suc j<length l \\<longrightarrow> \n      \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeqState i (snd((snd (clist!i))!j))) \\<rightarrow>\\<^sub>e  \n         (fst ((snd (clist!i))!(Suc j)), toSeqState  i (snd((snd (clist!i))!(Suc j)))) \\<longrightarrow> \n      (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> Par_Rely(xs!i)\"\nproof -\n  assume a0:\"\\<forall>i<length xs. R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n       \\<subseteq> (Par_Rely (xs ! i))\" and\n         a1:\" p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i)))\" and\n         a2:\"\\<forall>i<length xs. \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i [Par_Pre (xs!i), Par_Rely (xs ! i), \n                                 Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)]\" and\n         a3: \"length xs=length clist\" and\n         a4: \"(\\<Gamma>,l) \\<in> par_cp  \\<Gamma> (ParallelCom xs) s\" and\n         a5: \"(\\<Gamma>,l)\\<in>par_assum (p, R)\" and\n         a6: \" \\<forall>i<length clist. clist!i\\<in>cpi  i \\<Gamma> (Par_Com(xs!i)) s\" and\n         a7: \"(\\<Gamma>,l) \\<propto> clist\" and\n         a8: \"\\<forall>i<length xs.(\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>.  Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> \n                     Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow>\n                   \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a])\" and \n         a9':\"\\<forall>i<length xs. Rel_wf i (Par_Guar(xs!i))\" and\n         a9'':\"\\<forall>i<length xs. Pred_wf i p\" \n{\n  assume a10:\"\\<exists>i j. \n              i<length clist \\<and> Suc j<length l \\<and> \n              \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeqState i (snd((snd (clist!i))!j))) \\<rightarrow>\\<^sub>e  \n                   (fst ((snd (clist!i))!(Suc j)), toSeqState  i (snd((snd (clist!i))!(Suc j)))) \\<and> \n              \\<not>(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> Par_Rely(xs!i)\"\n  then obtain j where \n    a10:\"\\<exists>i ns ns'. \n       i<length clist \\<and> Suc j<length l \\<and> \n       \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeqState i (snd((snd (clist!i))!j))) \\<rightarrow>\\<^sub>e  \n              (fst ((snd (clist!i))!(Suc j)), toSeqState  i (snd((snd (clist!i))!(Suc j)))) \\<and>\n       \\<not>(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> Par_Rely(xs!i)\" by fastforce\n   let ?P = \"\\<lambda>j. \\<exists>i. i<length clist \\<and> Suc j<length l \\<and>\n      \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeqState i (snd((snd (clist!i))!j))) \\<rightarrow>\\<^sub>e  \n              (fst ((snd (clist!i))!(Suc j)), toSeqState  i (snd((snd (clist!i))!(Suc j)))) \\<and>       \n      (\\<not> (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> Par_Rely(xs!i))\"        \n   obtain m where fist_occ:\"(?P m) \\<and> (\\<forall>i<m. \\<not> ?P i)\" using exists_first_occ[of ?P j] a10 by blast\n     then have \"?P m\" by fastforce\n     then obtain i where\n      fst_occ:\"i<length clist \\<and> Suc m<length l \\<and>\n               \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!m),  toSeqState i (snd((snd (clist!i))!m))) \\<rightarrow>\\<^sub>e  \n                 (fst ((snd (clist!i))!(Suc m)), toSeqState  i (snd((snd (clist!i))!(Suc m)))) \\<and>       \n      (\\<not> (snd((snd (clist!i))!m), snd((snd (clist!i))!Suc m)) \\<in> Par_Rely(xs!i))\"\n     by fastforce\n    have notP:\"(\\<forall>i<m. \\<not> ?P i)\" using fist_occ by blast     \n    have fst_clist_\\<Gamma>:\"\\<forall>i<length clist. fst(clist!i) = \\<Gamma>\" \n      using a7 unfolding conjoin_def same_functions_def by fastforce\n    have compat:\"(\\<Gamma>\\<turnstile>\\<^sub>p(l!m)  \\<rightarrow> (l!(Suc m))) \\<and> \n            (\\<exists>i<length clist. \n               ((fst (clist!i))\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!m),  toSeq (toSeqState i (snd((snd (clist!i))!m)))) \\<rightarrow>  \n                   (fst ((snd (clist!i))!(Suc m)), toSeq (toSeqState  i (snd((snd (clist!i))!(Suc m))))))  \\<and> \n            (\\<forall>l<length clist. \n               l\\<noteq>i \\<longrightarrow>  (fst (clist!l))\\<turnstile>\\<^sub>c (fst ((snd (clist!l))!m),  toSeqState l (snd((snd (clist!l))!m))) \\<rightarrow>\\<^sub>e  \n                         (fst ((snd (clist!l))!(Suc m)), toSeqState  l (snd((snd (clist!l))!(Suc m)))))) \\<or> \n         (\\<Gamma>\\<turnstile>\\<^sub>p(l!m)  \\<rightarrow>\\<^sub>e (l!(Suc m)) \\<and> \n          (\\<forall>i<length clist. (fst (clist!i))\\<turnstile>\\<^sub>c (fst ((snd (clist!i))!m),  toSeqState i (snd((snd (clist!i))!m))) \\<rightarrow>\\<^sub>e  \n                                               (fst ((snd (clist!i))!(Suc m)), toSeqState  i (snd((snd (clist!i))!(Suc m))))))\"\n     using a7 fst_occ unfolding conjoin_def compat_label_def by simp\n     {\n       assume a20: \"(\\<Gamma>\\<turnstile>\\<^sub>p(l!m)  \\<rightarrow>\\<^sub>e (l!(Suc m)) \\<and> \n          (\\<forall>i<length clist.  (fst (clist!i))\\<turnstile>\\<^sub>c (fst ((snd (clist!i))!m),  toSeqState i (snd((snd (clist!i))!m))) \\<rightarrow>\\<^sub>e  \n                             (fst ((snd (clist!i))!(Suc m)), toSeqState  i (snd((snd (clist!i))!(Suc m))))))\"\n       then have \"(snd (l!m),snd (l!(Suc m))) \\<in> R\"       \n       using fst_occ a5  unfolding par_assum_def by fastforce\n       then have \"(snd(l!m), snd(l!(Suc m))) \\<in>  Par_Rely(xs!i)\"\n       using fst_occ a3 a0 by fastforce\n       then have \"(snd ((snd (clist!i))!m), snd ((snd (clist!i))!(Suc m)) ) \\<in>  Par_Rely(xs!i)\" \n       using a7 fst_occ unfolding conjoin_def same_state_def by fastforce        \n       then have False using fst_occ by auto\n     }note l = this\n     {\n      assume a20:\"(\\<Gamma>\\<turnstile>\\<^sub>p(l!m)  \\<rightarrow> (l!(Suc m))) \\<and> \n            (\\<exists>i<length clist. \n               ((fst (clist!i))\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!m),  toSeq (toSeqState i (snd((snd (clist!i))!m)))) \\<rightarrow>  \n                   (fst ((snd (clist!i))!(Suc m)), toSeq (toSeqState  i (snd((snd (clist!i))!(Suc m)))))) \\<and> \n            (\\<forall>l<length clist. \n               l\\<noteq>i \\<longrightarrow>  (fst (clist!l))\\<turnstile>\\<^sub>c (fst ((snd (clist!l))!m),  toSeqState l (snd((snd (clist!l))!m))) \\<rightarrow>\\<^sub>e  \n                         (fst ((snd (clist!l))!(Suc m)), toSeqState  l (snd((snd (clist!l))!(Suc m))))))\"\n      then obtain i'  \n      where i':\"i'<length clist \\<and> \n               ((fst (clist!i'))\\<turnstile>\\<^sub>c(fst ((snd (clist!i'))!m),  toSeq (toSeqState i' (snd((snd (clist!i'))!m)))) \\<rightarrow>  \n                   (fst ((snd (clist!i'))!(Suc m)), toSeq (toSeqState  i' (snd((snd (clist!i'))!(Suc m)))))) \\<and> \n               (\\<forall>l<length clist. \n                 l\\<noteq>i' \\<longrightarrow>  (fst (clist!l))\\<turnstile>\\<^sub>c (fst ((snd (clist!l))!m),  toSeqState l (snd((snd (clist!l))!m))) \\<rightarrow>\\<^sub>e  \n                         (fst ((snd (clist!l))!(Suc m)), toSeqState  l (snd((snd (clist!l))!(Suc m)))))\"\n      by fast\n      then have eq_\\<Gamma>:\"\\<Gamma> = fst (clist!i')\" using a7 unfolding conjoin_def same_functions_def by fastforce\n      obtain fp fs sp ss \n      where prod_step: \" \n               \\<Gamma>\\<turnstile>\\<^sub>c (fp, fs) \\<rightarrow> (sp,ss) \\<and> \n              fp = fst (((snd (clist!i'))!m)) \\<and> fs = toSeq (toSeqState i' (snd((snd (clist!i'))!m))) \\<and> \n              sp = fst ((snd (clist!i'))!(Suc m)) \\<and> ss =toSeq (toSeqState  i' (snd((snd (clist!i'))!(Suc m)))) \\<and>\n              \\<Gamma> = fst (clist!i') \"\n      using eq_\\<Gamma> a7 i' unfolding conjoin_def same_functions_def by fast            \n      then have False\n      proof (cases \"i = i'\")\n        case True       \n        then have \"l!m = l!(Suc m) \"\n          using step_e_step_c_eq[OF a7] i' fst_occ eq_\\<Gamma> by blast\n        then have \"\\<Gamma>\\<turnstile>\\<^sub>p(l!m)  \\<rightarrow>\\<^sub>e (l!(Suc m))\" \n          using step_pe.ParEnv\n          by (metis prod_cases3)           \n        then have \"(snd (l ! m), snd (l ! Suc m)) \\<in> R \"\n          using fst_occ  a5 unfolding par_assum_def by fastforce\n        then have \"(snd (l ! m), snd (l ! Suc m)) \\<in> Par_Rely (xs ! i)\"\n          using a0 a3 fst_occ by fastforce\n        then show ?thesis using fst_occ a7\n          unfolding conjoin_def same_state_def  \n          by fastforce         \n      next\n        case False  note not_eq = this       \n        thus ?thesis \n        proof (cases \"fp = sp\")\n          case True \n          thus ?thesis using prod_step  prod_step\n            using step_change_p_or_eq_s by fastforce                               \n        next\n          case False                    \n          let ?l1 = \"take (Suc (Suc m)) (snd(clist!i'))\"\n          have clist_cptni:\"(i', \\<Gamma>,snd(clist!i')) \\<in> cptni\" \n            using a6 i' unfolding cpi_def by fastforce\n          moreover have i'_inlist:\"i' < length (snd (snd (snd (clist ! i') ! 0)))\"  \n          proof-\n            have \"i' < length (snd (snd (l!0)))\"\n              using a9'' a5 unfolding par_assum_def  Pred_wf_def split_beta \n              apply auto\n              using a3 i' by fastforce\n            moreover have \"snd(snd (clist !i')!0) = snd (l!0)\" using a7 unfolding conjoin_def same_state_def\n              using a10 i' by fastforce \n            ultimately show ?thesis by auto\n          qed                                    \n          ultimately have clist_cptn:\"( \\<Gamma>,toSeqCptn i' (snd(clist!i'))) \\<in> cptn\" using cptni_cptn\n            by (metis prod.exhaust_sel)\n          have sucm_len:\"Suc m < length (snd (clist!i'))\" \n            using i' fst_occ a7 unfolding conjoin_def same_length_def by fastforce          \n          then have summ_lentake:\"Suc m < length ?l1\" by fastforce\n          have len_l: \"0<length l\" using fst_occ by fastforce\n          also then have cpt_not_empty:\"snd (clist!i')\\<noteq>[]\" \n            using i' a7 unfolding conjoin_def same_length_def by fastforce\n          ultimately have \"fst (last (snd (clist ! i'))) = (fst (last l))!i'\"\n            using a7 i' conjoin_same_program_i[OF a7]\n            by (simp add: conjoin_def last_conv_nth same_length_def)          \n          have  i'_lt_len:\"\\<forall>j<length (snd (clist ! i')). i'< length (snd (snd ((snd (clist ! i'))!j)))\"   \n            using i'_inlist a6 unfolding cpi_def\n            using clist_cptni\n            by (meson a4 a7 i' wf_local_vars)                               \n          have not_env_step:\"\\<not> \\<Gamma>\\<turnstile>\\<^sub>c (fst (snd (clist ! i') ! m), toSeqState i' (snd (snd (clist ! i') ! m))) \\<rightarrow>\\<^sub>e \n                                   (fst (snd (clist ! i') ! (Suc m)), toSeqState i' (snd (snd (clist ! i') ! (Suc m))))\"\n            using False etran_ctran_eq_p_normal_s i' prod_step by blast           \n          then have \"snd ((snd(clist!i'))!0)\\<in> p\" \n            using len_l a7 i' a5 unfolding conjoin_def same_state_def par_assum_def by fastforce\n          then have \"snd ((snd(clist!i'))!0)\\<in> Par_Pre (xs ! i')\"\n            using a1 i' a3 by fastforce\n          then have clist_0_in_pre:\"snd ((take (Suc (Suc m)) (snd(clist!i')))!0)\\<in> (Par_Pre (xs ! i'))\" \n            by fastforce       \n          moreover have \n          \"\\<forall>j. Suc j < Suc (Suc m) \\<longrightarrow>\n                \\<Gamma>\\<turnstile>\\<^sub>c (fst (snd (clist ! i') ! j), toSeqState i' (snd (snd (clist ! i') ! j))) \\<rightarrow>\\<^sub>e \n                    (fst (snd (clist ! i') ! (Suc j)), toSeqState i' (snd (snd (clist ! i') ! (Suc j)))) \\<longrightarrow>\n                (snd (snd (clist ! i') ! j), snd (snd (clist ! i') ! Suc j)) \\<in> Par_Rely (xs ! i')\" \n            using not_env_step fst_occ Suc_less_eq fist_occ i' less_SucE less_trans_Suc by auto\n          then have \"\\<forall>j. Suc j < length (take (Suc (Suc m)) (snd(clist!i'))) \\<longrightarrow>\n                \\<Gamma>\\<turnstile>\\<^sub>c (fst (snd (clist ! i') ! j), toSeqState i' (snd (snd (clist ! i') ! j))) \\<rightarrow>\\<^sub>e \n                    (fst (snd (clist ! i') ! (Suc j)), toSeqState i' (snd (snd (clist ! i') ! (Suc j)))) \\<longrightarrow>\n                (snd (snd (clist ! i') ! j), snd (snd (clist ! i') ! Suc j)) \\<in> Par_Rely (xs ! i')\"\n            by fastforce \n          ultimately have assum_p1:\"(\\<Gamma>, (take (Suc (Suc m)) (snd(clist!i')))) \\<in> \n                             assum_p1 i' (Par_Pre (xs ! i'),Par_Rely (xs!i'))\"\n            unfolding assum_p1_def by fastforce\n          have clist_comm:\"(\\<Gamma>,take (Suc (Suc m)) (snd(clist!i'))) \\<in> \n                              comm_p i' (Par_Guar (xs ! i'), \n                                       (Par_Post (xs ! i'),Par_Abr (xs ! i'))) F \"            \n          proof-\n            have \"(\\<Gamma>, (take (Suc (Suc m)) (snd(clist!i')))) \\<in> \n                             assum_p i' ((Par_Pre (xs ! i')),Par_Rely (xs ! i'))\"\n              using assum_p1 p2[of \"take (Suc (Suc m)) (snd (clist ! i'))\" i' \\<Gamma> \"Par_Pre (xs ! i')\" \"Par_Rely (xs ! i')\"] \n                   i'_lt_len cpt_not_empty by auto         \n            moreover have \"(i', \\<Gamma>,snd(clist!i')) \\<in> cptni\" using a6 i' unfolding cpi_def by fastforce\n            then have \"(i',\\<Gamma>,take (Suc (Suc m)) (snd(clist!i'))) \\<in> cptni\"\n              by (simp add: takecptni_is_cptni)              \n            then have \"(\\<Gamma>,take (Suc (Suc m)) (snd(clist!i'))) \\<in> cpi  i' \\<Gamma> (Par_Com(xs!i')) s\"\n              using i' a3 a6 unfolding cpi_def by fastforce   \n            moreover have \"\\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i') sat i' [Par_Pre (xs!i'), Par_Rely (xs ! i'), \n                                 Par_Guar (xs ! i'), Par_Post (xs ! i'),Par_Abr (xs ! i')]\"\n              by (simp add: a2 a3 i')\n            moreover have \"\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>.  Pred_wf i' p \\<and> Rel_wf i' R \\<and>  Rel_wf i' G \\<and> \n                                  Pred_wf i' q \\<and>  Pred_wf i' a \\<longrightarrow> \n                \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i' [p, R, G, q,a]\" \n              using a8  a3 i'\n              by simp\n            moreover have  \"i' < length (snd s)\"\n            proof-\n              have  \"s=snd (take (Suc (Suc m)) (snd(clist!i'))!0)\" \n                using calculation unfolding cpi_def by auto\n              moreover  have \"s  \\<in> Par_Pre(xs!i')\"              \n                using clist_0_in_pre calculation \n                by blast \n              ultimately show ?thesis\n                by (simp add: i'_inlist)\n            qed\n            ultimately show ?thesis by (auto intro:  assum_p_cpi_in_com_p)\n          qed\n          have \"(snd(take (Suc (Suc m)) (snd(clist!i'))!m), \n                        snd(take (Suc (Suc m)) (snd(clist!i'))!(Suc m))) \\<in> Par_Guar (xs ! i')\"\n            using comm_pdest1[OF clist_comm ]  summ_lentake eq_\\<Gamma>  i' clist_comm  \n                  a9' a3 summ_lentake by force\n          then have \"(snd( (snd(clist!i'))!m), \n                        snd((snd(clist!i'))!(Suc m))) \\<in> Par_Guar (xs ! i')\"\n          by fastforce\n          then have \"(snd( (snd(clist!i))!m), \n                      snd((snd(clist!i))!(Suc m))) \\<in> Par_Guar (xs ! i')\"\n           using a7 fst_occ unfolding conjoin_def same_state_def by (metis Suc_lessD i' snd_conv) \n          then have \"(snd( (snd(clist!i))!m), \n                      snd((snd(clist!i))!(Suc m))) \\<in> Par_Rely (xs ! i)\"\n          using not_eq a0 i' a3 fst_occ by auto          \n          then have \"False\" using fst_occ by auto\n          then show ?thesis by auto\n        qed\n      qed\n     }  \n  then have False using compat l by auto\n} thus ?thesis by auto\nqed\n\nlemma ppp:\"\\<forall>i<length l. P (l!i) \\<Longrightarrow>\n       n>0 \\<Longrightarrow>\n       \\<forall>i<length (take n l). P ((take n l)!i)\"\n  by simp\n\nlemma comm_pdest:\n   \"(\\<Gamma>, l)\\<in> comm_p i' (G,(q,a)) F \\<Longrightarrow> \n              Rel_wf i' G \\<Longrightarrow>\n        \\<forall>i. Suc i<length l \\<longrightarrow>\n       \\<Gamma>\\<turnstile>\\<^sub>c (fst (l ! i), toSeq (toSeqState i' (snd (l ! i)))) \\<rightarrow>\n        (fst (l ! Suc i), toSeq (toSeqState i' (snd (l ! Suc i)))) \\<longrightarrow> \n       (snd(l!i), snd(l!(Suc i))) \\<in> G\"\n  using comm_pdest1 by auto\n\nlemma par_cp_not_empty:\"\\<not> (length xs\\<le>length (snd s) ) \\<Longrightarrow>\n     par_cp  \\<Gamma> xs s = {}\"\n  unfolding par_cp_def wf_state_def by auto\n\nlemma par_cp_dest:\n   \"par_cp  \\<Gamma> xs s\\<noteq>{} \\<Longrightarrow> \n    length xs \\<le>length (snd s) \"\n  unfolding par_cp_def wf_state_def by auto\n\nlemma two: \n  \"\\<lbrakk> \\<forall>i<length xs. R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n       \\<subseteq> (Par_Rely (xs ! i));\n   p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i)));\n   \\<forall>i<length xs.\n    \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i [Par_Pre (xs!i), Par_Rely (xs ! i), \n                                        Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)];\n   length xs=length clist; (\\<Gamma>,l) \\<in> par_cp \\<Gamma> (ParallelCom xs) s; (\\<Gamma>,l)\\<in>par_assum (p, R);\n  \\<forall>i<length clist. clist!i\\<in>cpi  i \\<Gamma> (Par_Com (xs!i)) s; (\\<Gamma>,l) \\<propto> clist;\n  (\\<forall>i<length xs.\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>.  Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow> \n    \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a]); \\<forall>i<length xs. Rel_wf i (Par_Guar(xs!i)); \n   \\<forall>i<length xs. Pred_wf i p\\<rbrakk>\n  \\<Longrightarrow> \\<forall>j i. i<length clist \\<and> Suc j<length l \\<longrightarrow> \n       \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeq(toSeqState i (snd((snd (clist!i))!j)))) \\<rightarrow>  \n         (fst ((snd (clist!i))!(Suc j)), toSeq(toSeqState  i (snd((snd (clist!i))!(Suc j))))) \\<longrightarrow>       \n        (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> Par_Guar(xs!i) \"\nproof -\n  assume a0:\"\\<forall>i<length xs. R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n       \\<subseteq> (Par_Rely (xs ! i))\" and\n         a1:\" p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i)))\" and\n         a2:\"\\<forall>i<length xs. \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i [Par_Pre (xs!i), Par_Rely (xs ! i), \n                                 Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)]\" and\n         a3: \"length xs=length clist\" and\n         a4: \"(\\<Gamma>,l) \\<in> par_cp \\<Gamma> (ParallelCom xs) s\" and\n         a5: \"(\\<Gamma>,l)\\<in>par_assum (p, R)\" and\n         a6: \" \\<forall>i<length clist. clist!i\\<in>cpi  i \\<Gamma> (Par_Com(xs!i)) s\" and\n         a7: \"(\\<Gamma>,l) \\<propto> clist\" and\n         a8: \"\\<forall>i<length xs.(\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>.  Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> \n                     Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow>\n                   \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a])\" and \n         a9':\"\\<forall>i<length xs. Rel_wf i (Par_Guar(xs!i))\" and \n         a9'':\"\\<forall>i<length xs. Pred_wf i p\" \n  {\n     assume a10:\"(\\<exists>i j. i<length clist \\<and> Suc j<length l \\<and>  \n      \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeq(toSeqState i (snd((snd (clist!i))!j)))) \\<rightarrow>  \n         (fst ((snd (clist!i))!(Suc j)), toSeq(toSeqState  i (snd((snd (clist!i))!(Suc j))))) \\<and> \n       \\<not> (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> Par_Guar(xs!i)) \"\n     then obtain j where a10: \"\\<exists>i. i<length clist \\<and> Suc j<length l \\<and>\n      \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeq(toSeqState i (snd((snd (clist!i))!j)))) \\<rightarrow>  \n         (fst ((snd (clist!i))!(Suc j)), toSeq(toSeqState  i (snd((snd (clist!i))!(Suc j))))) \\<and>        \n      \\<not> (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> Par_Guar(xs!i)\"\n     by fastforce\n     let ?P = \"\\<lambda>j. \\<exists>i. i<length clist \\<and> Suc j<length l \\<and>\n      \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeq(toSeqState i (snd((snd (clist!i))!j)))) \\<rightarrow>  \n         (fst ((snd (clist!i))!(Suc j)), toSeq(toSeqState  i (snd((snd (clist!i))!(Suc j))))) \\<and>       \n      \\<not> (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> Par_Guar(xs!i)\"     \n     obtain m where fist_occ:\"?P m \\<and> (\\<forall>i<m. \\<not> ?P i)\" using exists_first_occ[of ?P j] a10 by blast\n     then have P:\"?P m\" by fastforce\n     then have notP:\"(\\<forall>i<m. \\<not> ?P i)\" using fist_occ by blast\n     obtain i ns ns' where fst_occ:\"i<length clist \\<and> Suc m<length l \\<and> \n      \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!m),  toSeq(toSeqState i (snd((snd (clist!i))!m)))) \\<rightarrow>  \n         (fst ((snd (clist!i))!(Suc m)), toSeq(toSeqState  i (snd((snd (clist!i))!(Suc m))))) \\<and>      \n      (\\<not> (snd((snd (clist!i))!m), snd((snd (clist!i))!Suc m)) \\<in>  Par_Guar(xs!i))\"\n       using P by fastforce\n     have fst_clist_i: \"fst (clist!i) = \\<Gamma>\" \n         using a7 fst_occ unfolding conjoin_def same_functions_def \n         by fastforce\n     have \"clist!i\\<in>cpi i \\<Gamma> (Par_Com(xs!i)) s\" using a6 fst_occ by fastforce\n     then have clistcp:\"(\\<Gamma>, snd (clist!i))\\<in>cpi  i \\<Gamma> (Par_Com(xs!i)) s\" \n       using  fst_occ a7 unfolding conjoin_def same_functions_def by fastforce   \n     moreover have i'_inlist:\"i < length (snd (snd (snd (clist ! i) ! 0) ))\"  \n     proof-\n       have \"i < length (snd (snd (l!0)))\"\n         using a3 fst_occ a9'' a5 unfolding par_assum_def  Pred_wf_def split_beta \n         by fastforce\n       moreover have \"snd(snd (clist !i)!0) = snd (l!0)\" using a7 unfolding conjoin_def same_state_def\n         using a10 fst_occ by fastforce \n       ultimately show ?thesis by auto\n     qed   \n     ultimately have clisti_wf:\"\\<forall>j<length (snd (clist !i)).  i < length (snd (snd (snd (clist ! i) ! j)))\"\n       unfolding cpi_def using a4 a7 fst_occ wf_local_vars by blast     \n     let ?li=\"take (Suc (Suc m)) (snd (clist!i))\"     \n     have \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i [Par_Pre (xs!i), Par_Rely (xs ! i), \n                Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)]\"\n       using a8 a2 a3 fst_occ unfolding comp_cvalidity_def by fastforce\n     have clist_take_wf: \"\\<forall>j<length ?li.  i < length (snd (snd (?li ! j)))\" \n       using clisti_wf by auto\n     moreover have take_in_ass:\"(\\<Gamma>, take (Suc (Suc m)) (snd (clist!i))) \\<in> assum_p i (Par_Pre(xs!i), Par_Rely(xs!i))\"      \n     proof -\n       have length_take_length_l:\"length (take (Suc (Suc m)) (snd (clist!i))) \\<le> length l\"\n         using a7 fst_occ unfolding conjoin_def same_length_def by auto\n       have \"snd((?li!0)) \\<in> Par_Pre(xs!i)\" \n       proof -\n         have \"(take (Suc (Suc m)) (snd (clist!i)))!0 = (snd (clist!i))!0\" by fastforce\n         moreover have \"snd (snd(clist!i)!0) = snd (l!0)\" \n           using a7 fst_occ unfolding conjoin_def same_state_def by fastforce\n         moreover have \"snd (l!0) \\<in>  p\" \n           using a5 unfolding par_assum_def by fastforce\n         ultimately show ?thesis using a1 a3 fst_occ by fastforce \n       qed note left=this\n       then have p1:\"(\\<Gamma>, take (Suc (Suc m)) (snd (clist!i))) \\<in> assum_p1 i (Par_Pre(xs!i), Par_Rely(xs!i))\"   \n         using two'[OF a0 a1 a2 a3 a4 a5 a6 a7 a8 a9' a9'' ] fst_occ \n         unfolding assum_p1_def split_beta Image_def assum_def image_def by auto                          \n       then have \"(\\<Gamma>, take (Suc (Suc m)) (snd (clist!i))) \\<in> assum_p i (Par_Pre(xs!i), Par_Rely(xs!i))\" \n         using  p2[OF clist_take_wf _ p1]\n         by (metis a7 conjoin_def fst_occ list.size(3) nat.distinct(1) \n                   not_less0 same_length_def snd_conv take_eq_Nil)                                   \n       then show ?thesis by auto\n     qed     \n     moreover have take_cpi:\"(\\<Gamma>,take (Suc (Suc m)) (snd (clist!i))) \\<in> cpi  i \\<Gamma> (Par_Com(xs!i)) s\"\n       using  clistcp unfolding cpi_def by fastforce      \n     ultimately have comm:\"(\\<Gamma>, take (Suc (Suc m)) (snd (clist!i)))\\<in>\n                               comm_p i (Par_Guar(xs!i),(Par_Post (xs ! i),Par_Abr (xs ! i))) F\"       \n       using assum_p_cpi_in_com_p[OF take_in_ass take_cpi,of \\<Theta> F \"Par_Guar(xs!i)\" \n                                        \"Par_Post(xs!i)\" \"Par_Abr(xs!i)\"] a2 a8 unfolding cpi_def       \n       using a3 fst_occ i'_inlist by auto     \n     (* also have not_fault:\"fst (last (take (Suc (Suc m)) (snd (clist!i))))  \\<notin> Fault ` F\"\n     proof -      \n       have last_fault:\"fst (last (snd (clist!i))) \\<notin> Fault ` F\" \n         using a9 unfolding not_fault_def\n         by (smt a7 conjoin_def conjoin_same_length conjoin_same_program_i \n              diff_Suc_1 fst_occ last_conv_nth \n               lessI less_imp_Suc_add list.size(3) not_less0 same_length_def snd_conv)         \n       have sucm:\"Suc m < length (snd (clist!i))\" \n         using fst_occ a7 unfolding conjoin_def same_length_def by fastforce      \n       then have sucm_not_fault:\"fst ((snd (clist!i))!(Suc m)) \\<notin> Fault ` F\"\n         using a3 a9' comm comm_pdest1 fst_occ by fastforce\n       have \"length (take (Suc (Suc m)) (snd (clist!i))) = Suc (Suc m)\" \n         using sucm by fastforce\n       then have \"last (take (Suc (Suc m)) (snd (clist!i))) =  (take (Suc (Suc m)) (snd (clist!i)))!(Suc m)\" \n         by (metis Suc_diff_1 Suc_inject last_conv_nth list.size(3) old.nat.distinct(2) zero_less_Suc)\n       moreover have \"(take (Suc (Suc m)) (snd (clist!i)))!(Suc m) = (snd (clist!i))!(Suc m)\" \n         by fastforce      \n       ultimately show ?thesis using sucm_not_fault by fastforce\n     qed *)\n     then have \" Suc m < length (snd (clist ! i))  \\<longrightarrow>\n                 \\<Gamma>\\<turnstile>\\<^sub>c (fst ((snd (clist!i))!m),  toSeq(toSeqState i (snd((snd (clist!i))!m)))) \\<rightarrow>\n                     (fst ((snd (clist!i))!(Suc m)),  toSeq(toSeqState i (snd((snd (clist!i))!(Suc m))))) \\<longrightarrow>                      \n                    (snd ((snd (clist ! i)) ! m), snd ((snd (clist ! i)) ! Suc m)) \\<in> Par_Guar(xs!i)\"\n       using comm_pdest [OF comm ]\n       using a3 a9' fst_occ by auto     \n     then have \"False\" using fst_occ using a7 unfolding conjoin_def same_length_def by fastforce\n  } thus ?thesis by fastforce\nqed\n\nlemma par_cptn_env_comp:\n  \"(\\<Gamma>,l) \\<in> par_cptn \\<and> Suc i<length l \\<Longrightarrow> \n   \\<Gamma>\\<turnstile>\\<^sub>p l!i \\<rightarrow>\\<^sub>e (l!(Suc i)) \\<or> \\<Gamma> \\<turnstile>\\<^sub>p l!i \\<rightarrow> (l!(Suc i))\"\nproof -\n  assume a0:\"(\\<Gamma>,l) \\<in> par_cptn \\<and> Suc i<length l\"         \n  then obtain c1 s1 c2 s2 where li:\"l!i=(c1,s1) \\<and> l!(Suc i) = (c2,s2)\"\n    using prod.exhaust_sel by blast \n  obtain xs ys where l:\"l= xs@((l!i)#(l!(Suc i))#ys)\" using a0\n    by (metis Cons_nth_drop_Suc Suc_less_SucD id_take_nth_drop less_SucI)\n  moreover then have \"(drop (length xs) l) = ((l!i)#(l!(Suc i))#ys)\"\n    by (metis append_eq_conv_conj) \n  moreover then have \"length xs < length l\" using leI by fastforce \n  ultimately have \"(\\<Gamma>,((l!i)#(l!(Suc i))#ys))\\<in>par_cptn\" \n    using a0 droppar_cptn_is_par_cptn by fastforce\n  also then have \"(\\<Gamma>,(l!(Suc i))#ys)\\<in>par_cptn\" using par_cptn_dest li by fastforce\n  ultimately show ?thesis using li par_cptn_elim_cases(2)\n    by metis\nqed\n\n\nlemma three:\n  \"\\<lbrakk>xs\\<noteq>[]; \n   \\<forall>i<length xs. R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n       \\<subseteq> (Par_Rely (xs ! i));\n   p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i)));\n   \\<forall>i<length xs.\n    \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i [Par_Pre (xs!i), Par_Rely (xs ! i), \n                                        Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)];\n   length xs=length clist; (\\<Gamma>,l) \\<in> par_cp \\<Gamma> (ParallelCom xs) s; (\\<Gamma>,l)\\<in>par_assum (p, R);\n     \\<forall>i<length clist. clist!i\\<in>cpi i \\<Gamma> (Par_Com (xs!i)) s; (\\<Gamma>,l) \\<propto> clist;\n    \\<forall>i<length xs.\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>.  Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow> \n    \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a]; \\<forall>i<length xs. Rel_wf i (Par_Guar(xs!i)); \n   \\<forall>i<length xs. Pred_wf i p\\<rbrakk>\n  \\<Longrightarrow>  \\<forall>i j. i<length clist \\<and> Suc j<length l \\<longrightarrow> \n      \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeqState i (snd((snd (clist!i))!j))) \\<rightarrow>\\<^sub>e  \n         (fst ((snd (clist!i))!(Suc j)), toSeqState  i (snd((snd (clist!i))!(Suc j)))) \\<longrightarrow> \n      (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j))  \\<in>          \n             (R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j))))\"\nproof -\n assume a0:\"xs\\<noteq>[]\" and\n        a1:\"\\<forall>i<length xs. R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n              \\<subseteq> (Par_Rely (xs ! i))\" and\n        a2: \"p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i)))\" and\n        a3: \"\\<forall>i<length xs. \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i [Par_Pre (xs!i), Par_Rely (xs ! i), \n                                        Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)]\" and\n        a4: \"length xs=length clist\" and\n        a5: \"(\\<Gamma>,l) \\<in> par_cp \\<Gamma> (ParallelCom xs) s\" and\n        a6: \"(\\<Gamma>,l) \\<in> par_assum(p, R)\" and\n        a7: \"\\<forall>i<length clist. clist!i\\<in>cpi i \\<Gamma> (Par_Com (xs!i)) s\" and\n        a8: \"(\\<Gamma>,l) \\<propto> clist\" and\n        a9: \"\\<forall>i<length xs.\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>.  \n                   Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow> \n                       \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a]\" and        \n        a10':\"\\<forall>i<length xs. Rel_wf i (Par_Guar(xs!i))\" and \n        a12:\"\\<forall>i<length xs. Pred_wf i p\"\n  {\n  fix j i ns ns'\n  assume a00:\"i<length clist \\<and> Suc j<length l\" and\n         a11: \" \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeqState i (snd((snd (clist!i))!j))) \\<rightarrow>\\<^sub>e  \n                   (fst ((snd (clist!i))!(Suc j)), toSeqState  i (snd((snd (clist!i))!(Suc j))))\"         \n  then have two:\"\\<forall>j i. i<length clist \\<and> Suc j<length l \\<longrightarrow> \n       \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeq(toSeqState i (snd((snd (clist!i))!j)))) \\<rightarrow>  \n         (fst ((snd (clist!i))!(Suc j)), toSeq(toSeqState  i (snd((snd (clist!i))!(Suc j))))) \\<longrightarrow>       \n        (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> Par_Guar(xs!i) \"\n     using two[OF a1 a2 a3 a4 a5 a6 a7 a8 a9 a10' a12]  by auto\n  then have j_lenl:\"Suc j<length l\" using a00 by fastforce\n  have i_lj:\"i<length (fst (l!j)) \\<and> i<length (fst (l!(Suc j)))\" \n            using conjoin_same_length a00 a8 by fastforce \n  have fst_clist_\\<Gamma>:\"\\<forall>i<length clist. fst(clist!i) = \\<Gamma>\" using a8 unfolding conjoin_def same_functions_def by fastforce\n  have \"\\<Gamma>\\<turnstile>\\<^sub>p(l!j)  \\<rightarrow> (l!(Suc j)) \\<and> \n            (\\<exists>i<length clist. \n               (fst (clist!i))\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeq (toSeqState i (snd((snd (clist!i))!j)))) \\<rightarrow>  \n                   (fst ((snd (clist!i))!(Suc j)), toSeq (toSeqState  i (snd((snd (clist!i))!(Suc j))))) \\<and> \n            (\\<forall>l<length clist.                                           \n               l\\<noteq>i \\<longrightarrow>  (fst (clist!l))\\<turnstile>\\<^sub>c(fst ((snd (clist!l))!j),  toSeqState l (snd((snd (clist!l))!j))) \\<rightarrow>\\<^sub>e  \n                        (fst ((snd (clist!l))!(Suc j)), toSeqState  l (snd((snd (clist!l))!(Suc j))))  )) \\<or> \n         (\\<Gamma>\\<turnstile>\\<^sub>p(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)) \\<and> \n          (\\<forall>i<length clist. (fst (clist!i))\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeqState i (snd((snd (clist!i))!j))) \\<rightarrow>\\<^sub>e  \n                            (fst ((snd (clist!i))!(Suc j)), toSeqState  i (snd((snd (clist!i))!(Suc j))))))\"      \n  using a8 a00 unfolding conjoin_def compat_label_def split_beta by simp\n  then have compat_label:\"\\<Gamma>\\<turnstile>\\<^sub>p(l!j)  \\<rightarrow> (l!(Suc j)) \\<and> \n            (\\<exists>i<length clist. \n               \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeq (toSeqState i (snd((snd (clist!i))!j)))) \\<rightarrow>  \n                   (fst ((snd (clist!i))!(Suc j)), toSeq (toSeqState  i (snd((snd (clist!i))!(Suc j))))) \\<and> \n            (\\<forall>l<length clist.                                           \n               l\\<noteq>i \\<longrightarrow>  \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!l))!j),  toSeqState l (snd((snd (clist!l))!j))) \\<rightarrow>\\<^sub>e  \n                        (fst ((snd (clist!l))!(Suc j)), toSeqState  l (snd((snd (clist!l))!(Suc j))))  )) \\<or> \n         (\\<Gamma>\\<turnstile>\\<^sub>p(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)) \\<and> \n          (\\<forall>i<length clist. \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeqState i (snd((snd (clist!i))!j))) \\<rightarrow>\\<^sub>e  \n                            (fst ((snd (clist!i))!(Suc j)), toSeqState  i (snd((snd (clist!i))!(Suc j))))))\"\n  using fst_clist_\\<Gamma> by blast\n  then have \"(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in>            \n               (R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. Par_Guar (xs ! j)))\" \n  proof        \n    assume a10:\"\\<Gamma>\\<turnstile>\\<^sub>p(l!j)  \\<rightarrow> (l!(Suc j)) \\<and> \n            (\\<exists>i<length clist. \n               \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeq (toSeqState i (snd((snd (clist!i))!j)))) \\<rightarrow>  \n                   (fst ((snd (clist!i))!(Suc j)), toSeq (toSeqState  i (snd((snd (clist!i))!(Suc j))))) \\<and> \n            (\\<forall>l<length clist.                                           \n               l\\<noteq>i \\<longrightarrow>  \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!l))!j),  toSeqState l (snd((snd (clist!l))!j))) \\<rightarrow>\\<^sub>e  \n                        (fst ((snd (clist!l))!(Suc j)), toSeqState  l (snd((snd (clist!l))!(Suc j))))))\" \n    then obtain i' where \n            a20:\"\\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i'))!j),  toSeq (toSeqState i' (snd((snd (clist!i'))!j)))) \\<rightarrow>  \n                   (fst ((snd (clist!i'))!(Suc j)), toSeq (toSeqState  i' (snd((snd (clist!i'))!(Suc j))))) \\<and> \n            (\\<forall>l<length clist.                                           \n               l\\<noteq>i' \\<longrightarrow>  \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!l))!j),  toSeqState l (snd((snd (clist!l))!j))) \\<rightarrow>\\<^sub>e  \n                        (fst ((snd (clist!l))!(Suc j)), toSeqState  l (snd((snd (clist!l))!(Suc j)))))\" \n      by blast    \n    thus ?thesis \n    proof (cases \"i'=i\")\n      case True note eq_i = this      \n      then obtain P S1 S2 where P:\"(snd (clist!i'))!j=(P,S1) \\<and> ((snd (clist!i'))!(Suc j)) = (P,S2)\"   \n        using a11\n        using a20 etran_ctran_False by blast\n      then have allP:\"\\<forall>l< length clist. fst ((snd (clist!l))!j) = fst ((snd (clist!l))!(Suc j))\"\n        using a20  by (simp add: P mod_env_not_component) \n      thus ?thesis \n      proof (cases \"S1 = S2\")\n        case True \n        have snd_lj:\"(snd (l!j)) = snd ((snd (clist!i'))!j)\"\n            using eq_i a8 a20 a00 unfolding conjoin_def same_state_def\n            by auto\n        have all_e:\"\\<forall>l<length clist. \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!l))!j),  toSeqState l (snd((snd (clist!l))!j))) \\<rightarrow>\\<^sub>e  \n                        (fst ((snd (clist!l))!(Suc j)), toSeqState  l (snd((snd (clist!l))!(Suc j))))\"\n          using a11 a20 eq_i by fastforce\n        then have \"fst (l!j) = (fst (l!(Suc j)))\"\n          using allP a8 conjoin_same_program_i_j [of \"(\\<Gamma>,l)\"] a00 by fastforce\n        also have \"snd (l!j) = snd (l!(Suc j))\"\n        proof -              \n          have \"(snd (l!Suc j)) = snd ((snd (clist!i'))!(Suc j))\"\n            using a8 a20 a00\n            using a11 eq_i etran_ctran_False by blast \n          then show ?thesis using snd_lj P True by auto\n        qed \n        ultimately have \"l!j = l!(Suc j)\" by (simp add: prod_eq_iff) \n                           \n        then have \"\\<Gamma>\\<turnstile>\\<^sub>p(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j))\" \n          using P step_pe.ParEnv snd_lj by (metis prod.collapse)          \n        then have \"(snd (l ! j), snd (l ! Suc j)) \\<in> R \"\n          using a00 a6 unfolding par_assum_def by fastforce\n        then show ?thesis using a8 a00 \n          unfolding conjoin_def same_state_def  \n         by fastforce\n      next\n        case False thus ?thesis \n          using a20 P a11 step_change_p_or_eq_s by force\n      qed\n    next\n      case False \n      have i'_clist:\"i' < length clist\" using a20\n        using a10 etran_ctran_False by blast \n      then have clist_i'_Guardxs:\"(snd((snd (clist!i'))!j), snd((snd (clist!i'))!Suc j)) \\<in> Par_Guar(xs!i')\"\n        using two a00 False a8 unfolding conjoin_def same_state_def\n        by (metis a20)\n      have \"snd((snd (clist!i))!j) = snd (l!j) \\<and> snd((snd (clist!i))!Suc j) = snd (l!Suc j)\" \n        using a00 a20 a8 unfolding conjoin_def same_state_def by fastforce\n      also have \"snd((snd (clist!i'))!j) = snd (l!j) \\<and> snd((snd (clist!i'))!Suc j) = snd (l!Suc j)\"\n        using i'_clist j_lenl a20 a8 unfolding conjoin_def same_state_def\n        by auto\n      ultimately have \"snd((snd (clist!i))!j) = snd((snd (clist!i'))!j) \\<and> \n                    snd((snd (clist!i))!Suc j) = snd((snd (clist!i'))!Suc j)\" \n        by fastforce\n      then have clist_i_Guardxs:\n        \"(snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> \n            Par_Guar(xs!i')\"  \n        using  clist_i'_Guardxs by fastforce     \n      then show ?thesis  \n        using False a4 i'_clist by fastforce        \n    qed\n  next\n    assume a10:\"\\<Gamma>\\<turnstile>\\<^sub>p(l!j)  \\<rightarrow>\\<^sub>e (l!(Suc j)) \\<and> \n          (\\<forall>i<length clist. \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeqState i (snd((snd (clist!i))!j))) \\<rightarrow>\\<^sub>e  \n                            (fst ((snd (clist!i))!(Suc j)), toSeqState  i (snd((snd (clist!i))!(Suc j)))))\"      \n    then have \"(snd (l ! j), snd (l ! Suc j)) \\<in> R\"\n      using a00 a10 a6 unfolding par_assum_def by fastforce\n    then show ?thesis using a8 a00 \n      unfolding conjoin_def same_state_def\n      by fastforce\n  qed\n  }  thus ?thesis by blast\nqed\n\ndefinition tran_True where \"tran_True \\<equiv> True\"\n\ndefinition after where \"after \\<equiv> True\"\n\nlemma four:\n  \"\\<lbrakk>xs\\<noteq>[]; \\<forall>i<length xs. R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n       \\<subseteq> (Par_Rely (xs ! i));\n   (\\<Union>j<length xs.  (Par_Guar (xs ! j))) \\<subseteq> (G);\n   p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i)));\n   \\<forall>i<length xs.\n    \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i [Par_Pre (xs!i), Par_Rely (xs ! i), \n                                        Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)];\n    (\\<Gamma>,l) \\<in> par_cp \\<Gamma> (ParallelCom xs) s; (\\<Gamma>,l) \\<in> par_assum(p, R); Suc i < length l;\n   \\<Gamma>\\<turnstile>\\<^sub>p (l!i) \\<rightarrow> (l!(Suc i));\n   \\<forall>i<length xs.\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>.  Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow> \n    \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a]; \\<forall>i<length xs. Rel_wf i (Par_Guar(xs!i));  \n    \\<forall>i<length xs. Pred_wf i p\\<rbrakk>\n  \\<Longrightarrow> (snd (l ! i), snd (l ! Suc i)) \\<in> G\"\nproof -\n  assume a0:\"xs\\<noteq>[]\" and\n         a1:\"\\<forall>i<length xs. R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j))) \\<subseteq> \n               (Par_Rely (xs ! i))\" and\n         a2:\"(\\<Union>j<length xs.  (Par_Guar (xs ! j))) \\<subseteq> (G)\" and\n         a3:\"p \\<subseteq> (\\<Inter>i<length xs.  (Par_Pre (xs ! i)))\" and\n         a4:\"\\<forall>i<length xs. \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i [Par_Pre (xs!i), Par_Rely (xs ! i), \n                                        Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)]\" and\n         a5:\"(\\<Gamma>,l) \\<in> par_cp  \\<Gamma> (ParallelCom xs) s\" and\n         a6:\"(\\<Gamma>,l) \\<in> par_assum(p, R)\" and\n         a7: \"Suc i < length l\" and\n         a8:\"\\<Gamma>\\<turnstile>\\<^sub>p (l!i) \\<rightarrow> (l!(Suc i))\" and         \n         a10:\"\\<forall>i<length xs.\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>.  \n                Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow> \n                \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a]\" and\n          a12:\"\\<forall>i<length xs. Rel_wf i (Par_Guar(xs!i))\" \n           and a13:\" \\<forall>i<length xs. Pred_wf i p\"\n   have i_len:\"i<length l\" using a7 by auto\n   have length_par_xs:\"length (ParallelCom xs) = length xs\" unfolding ParallelCom_def  by fastforce   \n   then have par:\"(ParallelCom xs)\\<noteq>[]\" using a0 by fastforce \n   \n   then have \"(\\<Gamma>,l) \\<in>{(\\<Gamma>1,c). \\<exists>clist. (length clist)=(length (ParallelCom xs)) \\<and> \n               (\\<forall>i<length clist. (clist!i) \\<in> cpi  i \\<Gamma> ((ParallelCom xs)!i) s) \\<and> (\\<Gamma>,c) \\<propto> clist \\<and> \\<Gamma>1=\\<Gamma>}\"\n     using one[OF par] a5 length_par_xs by auto\n   then obtain clist where cpi:\"(length clist)=(length xs) \\<and> \n               (\\<forall>i<length clist. (clist!i) \\<in> cpi  i \\<Gamma> ((ParallelCom xs)!i) s) \\<and> (\\<Gamma>,l) \\<propto> clist\"\n     using length_par_xs by auto\n   then have conjoin:\"(length clist)=(length xs) \\<and> \n               (\\<forall>i<length clist. (clist!i) \\<in> cpi i \\<Gamma> (Par_Com (xs ! i)) s) \\<and> (\\<Gamma>,l) \\<propto> clist\"\n     using ParallelCom_Com by fastforce\n   then have length_xs_clist:\"length xs = length clist\" by auto \n   have clist_cp:\"\\<forall>i<length clist. (clist!i) \\<in> cpi i \\<Gamma>  (Par_Com (xs ! i)) s\" \n     using conjoin by auto\n   have conjoin:\"(\\<Gamma>,l) \\<propto> clist\" using conjoin by auto     \n   have l_not_empty:\"l\\<noteq>[]\" using a5 par_cptn.simps unfolding par_cp_def by fastforce\n   then have l_g0:\"0<length l\" by fastforce  \n   then have last_l:\"last l = l!((length l) - 1)\" by (simp add: last_conv_nth)    \n   have \"\\<forall>i< length l. fst (l!i) = map (\\<lambda>x. fst ((snd x)!i)) clist\"\n     using conjoin unfolding conjoin_def same_program_def by fastforce\n   obtain Ps si Ps' ssi where li:\"l!i = (Ps,si) \\<and> l!(Suc i) = (Ps', ssi)\"\n     using prod.exhaust_sel by blast \n   then obtain j r s' where  \n        step_c:\"l ! i = (Ps, si) \\<and> l ! Suc i = (Ps[j := r], toPar j s' si) \\<and> j < length Ps \\<and>\n         \\<Gamma>\\<turnstile>\\<^sub>c (Ps ! j, toSeqPar j si) \\<rightarrow> (r, s')\"\n     using par_ctranE[OF a8]   by fastforce            \n   have length_Ps_clist:\n     \"length Ps = length clist \\<and> length Ps = length Ps'\" \n     using conjoin a7 conjoin_same_length li step_c  by fastforce\n   then have j_len:\"j<length clist\" and j_xs:\" j<length xs\"\n     using step_c length_xs_clist length_Ps_clist by auto\n   have from_step:\"(snd (clist!j))!i = ((Ps!j),si) \\<and> (snd (clist!j))!(Suc i) = (Ps'!j,ssi)\"  \n   proof -     \n     have f2: \"Ps = fst (snd (\\<Gamma>, l) ! i)\" and f2':\"Ps' = fst (snd (\\<Gamma>, l) ! (Suc i))\"\n       using li by auto\n     have f3:\"si = snd (snd (\\<Gamma>, l) ! i) \\<and> ssi = snd (snd (\\<Gamma>, l) ! (Suc i))\"\n       by (simp add: li)\n     then have \"(snd (clist!j))!i = ((Ps!j),si)\"\n       using f2 conjoin  step_c unfolding conjoin_def same_program_def same_state_def\n       using  conjoin_same_program_i[OF conjoin _ j_len] i_len\n       by (metis j_len prod.collapse snd_conv)            \n     moreover have \"(snd (clist!j))!(Suc i) = (Ps'!j,ssi)\"\n       using f2' f3 conjoin a7 step_c length_Ps_clist \n      unfolding conjoin_def same_program_def same_state_def\n      using  conjoin_same_program_i[OF conjoin _ j_len] i_len\n      by (metis eq_snd_iff fst_conv)     \n     ultimately show ?thesis by auto\n   qed                      \n   then have step_clist:\" \\<Gamma>\\<turnstile>\\<^sub>c (fst (snd (clist ! j) ! i), toSeq(toSeqState j (snd((snd (clist!j))!i)))) \\<rightarrow> \n                           (fst (snd (clist ! j) ! (Suc i)), toSeq(toSeqState j (snd((snd (clist!j))!(Suc i)))))\"\n   proof-\n     have len_clist_0:\"length xs \\<le> length (snd (snd ((snd (clist!j))!0) ))\"\n       using conjoin conjoin_def conjoin_same_length j_len l_not_empty \n            length_xs_clist unfolding same_length_state_program_def same_state_def by fastforce       \n     then have len_clist_j:\"length xs \\<le> length (snd (snd ((snd (clist!j))!i)))\"\n     proof-\n       have cptni:\"(j, \\<Gamma>, snd (clist ! j)) \\<in> cptni\" using cpi j_len\n         unfolding cpi_def by auto\n       show ?thesis \n         using  i_len cptni len_clist_0 cptni_i_normal_len j_len conjoin a7 l_g0 \n         unfolding same_length_def conjoin_def apply auto         \n         by (smt One_nat_def cptni_i_normal_len i_len l_g0 less_Suc_eq_le less_trans_Suc \n            prod.collapse zero_less_Suc) \n     qed   \n     have len_si:\"length Ps \\<le> length (snd si)\"\n       using from_step  length_Ps_clist length_xs_clist len_clist_j by auto \n     then show ?thesis using step_p_elim_toseqpar[OF a8[simplified from_step li]  ] \n       by (metis from_step fst_conv li nth_list_update sndI step_c \n                 step_change_p_or_eq_Ns toSeqPar_eq_toSeq)\n   qed\n   have \n     \"\\<forall>j i. i<length clist \\<and> Suc j<length l \\<longrightarrow> \n       \\<Gamma>\\<turnstile>\\<^sub>c(fst ((snd (clist!i))!j),  toSeq(toSeqState i (snd((snd (clist!i))!j)))) \\<rightarrow>  \n         (fst ((snd (clist!i))!(Suc j)), toSeq(toSeqState  i (snd((snd (clist!i))!(Suc j))))) \\<longrightarrow>       \n        (snd((snd (clist!i))!j), snd((snd (clist!i))!Suc j)) \\<in> Par_Guar(xs!i) \"\n    using two[OF a1 a3 a4 length_xs_clist a5 a6 clist_cp conjoin a10 a12 a13] by auto\n   then have \"(snd (snd (clist ! j) ! i), snd (snd (clist ! j) ! Suc i)) \\<in> Par_Guar (xs ! j)\"\n     using a7 step_c length_Ps_clist step_clist by metis     \n   then have \"(snd (l!i), snd (l!(Suc i)))\\<in> Par_Guar (xs ! j)\"\n      using from_step a2 length_xs_clist step_c li by fastforce\n   then show ?thesis using a2 j_xs\n     unfolding  tran_True_def after_def Satis_def by fastforce\nqed\n\n\nlemma same_program_last:\"l\\<noteq>[] \\<Longrightarrow> (\\<Gamma>,l) \\<propto> clist  \\<Longrightarrow> i<length clist \\<Longrightarrow>fst (last (snd (clist!i))) = fst (last l) ! i\" \nproof -\n   assume l_not_empty:\"l\\<noteq>[]\" and\n          conjoin: \"(\\<Gamma>,l) \\<propto> clist\" and\n          i_clist: \"i<length clist\"\n   have last_clist_eq_l:\"\\<forall>i<length clist. last (snd (clist!i)) = (snd (clist!i))!((length l) - 1)\"\n          using conjoin  last_conv_nth l_not_empty \n          unfolding conjoin_def same_length_def\n          by (metis length_0_conv snd_eqD) \n   then have last_l:\"last l = l!((length l)-1)\" using l_not_empty by (simp add: last_conv_nth)\n   have \"fst (last l) = map (\\<lambda>x. fst (snd x ! ((length l)-1))) clist\"\n     using l_not_empty last_l conjoin unfolding conjoin_def same_program_def  by auto\n   also have \"(map (\\<lambda>x. fst (snd x ! ((length l)-1))) clist)!i = \n            fst ((snd (clist!i))! ((length l)-1))\" using i_clist by fastforce\n   also have  \"fst ((snd (clist!i))! ((length l)-1)) = \n             fst ((snd (clist!i))! ((length (snd (clist!i)))-1))\" \n     using conjoin i_clist unfolding conjoin_def same_length_def by fastforce\n   also then have \"fst ((snd (clist!i))! ((length (snd (clist!i)))-1)) = fst (last (snd (clist!i)))\"\n     using i_clist l_not_empty conjoin last_clist_eq_l last_conv_nth unfolding conjoin_def same_length_def\n     by presburger\n   finally show ?thesis by auto\nqed\n\n\n\nlemma five:\n  \"\\<lbrakk>xs\\<noteq>[];  \\<forall>i<length xs.  R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n       \\<subseteq> (Par_Rely (xs ! i));\n   p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i)));\n   (\\<Inter>i<length xs. (Par_Post (xs ! i))) \\<subseteq> q;\n   (\\<Union>i<length xs. (Par_Abr (xs ! i))) \\<subseteq> a ;\n   \\<forall>i < length xs.\n    \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i [Par_Pre (xs!i), Par_Rely (xs ! i), Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)];\n    (\\<Gamma>,l) \\<in> par_cp \\<Gamma> (ParallelCom xs) s; (\\<Gamma>,l) \\<in> par_assum(p, R);\n   All_End (last l); not_fault (fst (last l)) F;\n   \\<forall>i<length xs.\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>.  Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow> \n    \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a]; \\<forall>i<length xs. Rel_wf i (Par_Guar(xs!i));  \n    \\<forall>i<length xs. Pred_wf i p;\n    \\<forall>i<length xs. Pred_wf i (Par_Post (xs ! i));\n    \\<forall>i<length xs.  Pred_wf i (Par_Abr (xs ! i))\\<rbrakk> \\<Longrightarrow> \n                   (throw_program (fst (last l)) \\<and> \n                        snd (last l) \\<in> (a)) \\<or>\n                   (skip_program (fst (last l)) \\<and>\n                        snd (last l) \\<in>  q)\"\nproof-\n  assume a0:\"xs\\<noteq>[]\" and \n         a1:\"\\<forall>i<length xs.  R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n                            \\<subseteq> (Par_Rely (xs ! i))\" and\n         a2:\"p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i)))\" and\n         a3:\"(\\<Inter>i<length xs. (Par_Post (xs ! i))) \\<subseteq> q\" and\n         a4:\" (\\<Union>i<length xs. (Par_Abr (xs ! i))) \\<subseteq> a \" and\n         a5:\" \\<forall>i < length xs.  \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>  Par_Com (xs ! i) sat i \n                                       [Par_Pre (xs!i), Par_Rely (xs ! i), Par_Guar (xs ! i), \n                                        Par_Post (xs ! i),Par_Abr (xs ! i)]\" and\n         a6:\"(\\<Gamma>,l) \\<in> par_cp  \\<Gamma> (ParallelCom xs) s\" and\n         a7:\"(\\<Gamma>,l) \\<in> par_assum(p, R)\"and\n         a8:\"All_End (last l)\" and\n         a9:\"not_fault (fst (last l)) F\" and\n         a10:\"\\<forall>i<length xs.\\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. \n                 Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow> \n                   \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a]\" and\n        a11:\"\\<forall>i<length xs. Rel_wf i (Par_Guar(xs!i))\" and \n        a12:\" \\<forall>i<length xs. Pred_wf i p\" and \n        a13:\"\\<forall>i<length xs.  Pred_wf i (Par_Post (xs ! i))\" and\n        a14:\"\\<forall>i<length xs.  Pred_wf i (Par_Abr (xs ! i))\"\n   have length_par_xs:\"length (ParallelCom xs) = length xs\" unfolding ParallelCom_def  by fastforce   \n   moreover have \"(ParallelCom xs)\\<noteq>[]\" using a0 calculation by fastforce\n   ultimately have \"(\\<Gamma>,l) \\<in>{(\\<Gamma>1,c). \\<exists>clist. (length clist)=(length (ParallelCom xs)) \\<and> \n             (\\<forall>i<length clist. (clist!i) \\<in> cpi  i \\<Gamma> ((ParallelCom xs)!i) s) \\<and> \n             (\\<Gamma>,c) \\<propto> clist \\<and> \\<Gamma>1=\\<Gamma>}\"\n     using one a6  by blast \n   then obtain clist where \"(length clist)=(length xs) \\<and> \n               (\\<forall>i<length clist. (clist!i) \\<in> cpi  i \n                                                  \\<Gamma> ((ParallelCom xs)!i) s) \\<and> (\\<Gamma>,l) \\<propto> clist\"\n     using length_par_xs ParallelCom_Com by auto\n   then have conjoin:\"(length clist)=(length xs) \\<and> \n               (\\<forall>i<length clist. (clist!i) \\<in> cpi i  \\<Gamma> (Par_Com (xs ! i)) s) \\<and> \n                                 (\\<Gamma>,l) \\<propto> clist\"\n     using ParallelCom_Com by fastforce\n   then have length_xs_clist:\"length xs = length clist\" by auto   \n   have clist_cp:\"\\<forall>i<length clist. (clist!i) \\<in> cpi i \\<Gamma> (Par_Com (xs ! i)) s\" \n     using conjoin\n     by (simp add: length_par_xs)\n   have clist_cp_unfold:\"\\<forall>i<length clist. (\\<Gamma>, snd (clist!i)) \\<in> cpi  i \\<Gamma> (Par_Com (xs ! i)) s\"\n     using conjoin length_par_xs unfolding conjoin_def same_functions_def by auto     \n   have conjoin:\"(\\<Gamma>,l) \\<propto> clist\" using conjoin by auto\n   have l_not_empty:\"l\\<noteq>[]\" using a6 par_cptn.simps unfolding par_cp_def by fastforce\n   then have l_g0:\"0<length l\" by fastforce  \n   then have last_l:\"last l = l!((length l) - 1)\" by (simp add: last_conv_nth) \n   have \"\\<forall>i<length clist. (clist!i) \\<in> assum_p i (Par_Pre (xs!i),Par_Rely (xs!i))\"     \n   proof -\n   { fix i\n     assume i_length:\"i<length clist\"\n     obtain \\<Gamma>1 li where clist:\"clist!i=(\\<Gamma>1,li)\" by fastforce    \n     then have \\<Gamma>eq:\"\\<Gamma>1=\\<Gamma>\" \n       using conjoin i_length unfolding conjoin_def same_functions_def by fastforce\n     have \"(\\<Gamma>1,li) \\<in> assum_p i (Par_Pre (xs!i),Par_Rely (xs!i))\"\n     proof-\n       have l:\"snd (li!0) \\<in>  ( (Par_Pre (xs!i)))\"\n       proof -  \n         have snd_l:\"snd (\\<Gamma>,l) = l\" by fastforce       \n         have \"snd (l!0) \\<in> (p)\" \n         using a7 unfolding par_assum_def by fastforce         \n         also have \"snd (l!0) = snd (li!0)\"           \n           using i_length conjoin l_g0 clist \n           unfolding conjoin_def same_state_def by fastforce\n         finally show ?thesis using a2 i_length length_xs_clist\n            by auto \n       qed              \n       have r:\"(\\<forall>j. Suc j < length li \\<longrightarrow> \n                    \\<Gamma>\\<turnstile>\\<^sub>c(fst (li!j), toSeqState i (snd (li!j)))  \\<rightarrow>\\<^sub>e \n                       (fst (li!(Suc j)), toSeqState i (snd (li!(Suc j)))) \\<longrightarrow>                 \n                    (snd(li!j), snd(li!(Suc j))) \\<in> Par_Rely (xs!i))\"        \n         using three[OF a0 a1 a2 a5 length_xs_clist a6 a7 clist_cp conjoin a10 a11 a12 ]  \n                i_length conjoin a1 length_xs_clist clist                     \n         unfolding assum_def conjoin_def same_length_def  by fastforce \n       then have  a_p1:\"(\\<Gamma>1,li) \\<in>assum_p1 i (Par_Pre (xs!i),Par_Rely (xs!i))\"\n         using l r \\<Gamma>eq unfolding assum_p1_def by fastforce\n       moreover have all_wf:\"\\<forall>j < length (snd (clist ! i)).\n                               i < length (snd (snd (snd (clist ! i) ! j)))\"\n         using  wf_local_vars[OF conjoin i_length _ a6 ] by auto\n       moreover have clist_i_ne:\"snd (clist ! i)\\<noteq>[]\"\n         using conjoin conjoin_def i_length l_not_empty same_length_def by fastforce\n       ultimately show ?thesis using p2\n         by (simp add: clist)\n     qed \n     then have \"clist!i \\<in>  assum_p i (Par_Pre (xs ! i), Par_Rely (xs ! i))\" using clist by auto            \n   } thus ?thesis by auto\n qed\n  then have clist_assum:\"\\<forall>i<length clist. (\\<Gamma>, snd (clist!i)) \\<in> assum_p i (Par_Pre (xs!i),Par_Rely (xs!i))\"\n    using conjoin unfolding conjoin_def same_functions_def by auto\n  have \"\\<forall>i<length clist. i< length (snd  s)\"\n    using wf_local_vars[OF conjoin _ _ a6 ] a1 clist_cp length_xs_clist unfolding cpi_def  wf_state_def\n    by fastforce    \n  then have clist_com:\"\\<forall>i<length clist.(\\<Gamma>, snd (clist!i)) \\<in> \n                         comm_p i (Par_Guar (xs!i),(Par_Post(xs!i),Par_Abr (xs!i))) F\"\n    apply auto \n    apply (rule assum_p_cpi_in_com_p[where ?s = s and ?\\<Theta> = \\<Theta>])\n    using length_xs_clist a5 a10 clist_cp_unfold clist_assum by auto                    \n   have last_clist_eq_l:\"\\<forall>i<length clist. last (snd (clist!i)) = (snd (clist!i))!((length l) - 1)\"\n     using conjoin  last_conv_nth l_not_empty \n     unfolding conjoin_def same_length_def\n     by (metis length_0_conv snd_eqD) \n   then have last_clist_l:\"\\<forall>i<length clist. snd (last (snd (clist!i))) = snd (last l)\"\n     using last_l conjoin l_not_empty unfolding conjoin_def same_state_def same_length_def \n     by simp\n   show ?thesis\n   proof(cases \"skip_program (fst (last l))\")\n     assume \"skip_program (fst (last l))\"\n     then have ac1:\"\\<forall>i<length (fst (last l)). fst (last l)!i = Skip\"\n       unfolding skip_program_def by auto\n     have \"(\\<forall>j<length (fst (last l)). fst (last l) ! j = LanguageCon.com.Skip) \\<and> snd (last l) \\<in>  q\"\n     proof -\n       {fix j\n        assume aj:\"j<length (fst (last l))\"         \n        have \"\\<forall>i<length clist. snd (last (snd (clist!i))) \\<in> Par_Post(xs!i)\"\n        proof-\n          {fix i \n           assume a20:\"i<length clist\"\n           then have snd_last:\"snd (last (snd (clist!i))) = snd (last l)\" \n             using last_clist_l by fastforce\n           have last_clist_not_F:\"fst (last (snd (clist!i)))\\<notin> Fault ` F\"\n              using a9 last_clist_l a20 unfolding not_fault_def\n              by (metis conjoin conjoin_same_length diff_less l_g0 l_not_empty \n                   last_l same_program_last snd_conv zero_less_one) \n           have \"fst (last l) ! i = Skip\" \n             using a20 ac1 conjoin_same_length[OF conjoin]\n             by (simp add: l_not_empty last_l )                       \n           also have \"fst (last l) ! i=fst (last (snd (clist!i)))\"\n             using same_program_last[OF l_not_empty conjoin a20]  by auto\n           finally have skip:\"fst (last (snd (clist!i))) = Skip\" .\n           moreover have  comm_pi:\"(\\<Gamma>, snd (clist!i)) \\<in> comm_p i (Par_Guar (xs!i),(Par_Post(xs!i),Par_Abr (xs!i))) F\"\n             using a20 clist_com by auto\n           moreover have \"snd (clist ! i) \\<noteq> []\"\n             by (metis (no_types) a20 conjoin conjoin_def l_g0 list.size(3) \n                       not_less0 same_length_def snd_conv)\n           moreover have \" final_glob_p (last (snd (clist ! i)))\"\n             using skip unfolding final_glob_p_def by auto  \n           moreover have \" \\<forall>e\\<in>Par_Post(xs!i). i < length (snd e)\" \n             using a13 unfolding Pred_wf_def\n             by (simp add: a20 length_xs_clist)\n           moreover have \" \\<forall>e\\<in>Par_Abr(xs!i). i < length (snd e)\" \n             using a14 unfolding Pred_wf_def\n             by (simp add: a20 length_xs_clist) \n           ultimately have \"snd (last (snd (clist!i))) \\<in>  Par_Post(xs!i)\" \n             using comm_pdest2[OF _ _ _ last_clist_not_F ] by auto \n          }  thus ?thesis by auto \n        qed             \n        then have \"\\<forall>i<length xs. snd (last l) \\<in> Par_Post(xs!i)\" \n          using last_clist_l length_xs_clist by fastforce        \n        moreover have \"\\<forall>t. (\\<forall>i<length xs. t\\<in> Par_Post (xs ! i))\\<longrightarrow> t\\<in> q\" using a3\n          by fastforce        \n        ultimately have \"(\\<exists>x\\<in> q. snd (last l) =  x)\" using a0 by blast\n        then have \"snd (last l) \\<in>  q\" by fastforce          \n        then have \"fst (last l) ! j = LanguageCon.com.Skip \\<and> snd (last l) \\<in> q\"\n          using aj ac1 by fastforce\n        } thus ?thesis\n          using All_End_def a8 by blast\n     qed      \n     thus ?thesis unfolding skip_program_def  by fastforce\n   next\n     assume a00:\"\\<not> skip_program (fst (last l))\"    \n     have skip_throw:\n       \"\\<forall>i<length (fst (last l)). fst (last l)!i = Skip \\<or> fst (last l)!i = Throw\"\n     proof-\n     { fix i \n       assume a00:\"i<length (fst (last l))\"\n       have \"length (fst (last l)) =  length clist\" \n         using conjoin_same_length[OF conjoin] l_not_empty last_l\n         by simp\n       then have i_length:\"i<length clist\" using a00 by fastforce\n       then have snd_last:\"snd (last (snd (clist!i))) = snd (last l)\" \n         using last_clist_l by fastforce\n       have last_clist_not_F:\"fst (last (snd (clist!i)))\\<notin> Fault ` F\"\n         using a9 last_clist_l i_length\n         by (metis \\<open>length (fst (last l)) = length clist\\<close> conjoin \n           l_not_empty not_fault_def same_program_last)\n       then have \"fst (last (snd (clist!i))) = fst (last l) ! i\" \n         using i_length same_program_last [OF l_not_empty conjoin] by fastforce\n       moreover have  comm_pi:\"(\\<Gamma>, snd (clist!i)) \\<in> comm_p i (Par_Guar (xs!i),(Par_Post(xs!i),Par_Abr (xs!i))) F\"\n         using i_length clist_com by auto\n       moreover have \"snd (clist ! i) \\<noteq> []\"\n         by (metis (no_types) i_length conjoin conjoin_def l_g0 list.size(3) \n                       not_less0 same_length_def snd_conv)\n       moreover have \" final_glob_p (last (snd (clist ! i)))\"\n         using a8 a00 snd_last Throw  unfolding All_End_def final1_def unfolding final_glob_p_def\n         using calculation(1) by auto  \n       moreover have \" \\<forall>e\\<in>Par_Post(xs!i). i < length (snd e)\" \n         using a13 unfolding Pred_wf_def\n         by (simp add: i_length length_xs_clist)\n       moreover have \" \\<forall>e\\<in>Par_Abr(xs!i). i < length (snd e)\" \n         using a14 unfolding Pred_wf_def\n         by (simp add: i_length length_xs_clist)\n       ultimately have \"fst (last l) ! i = LanguageCon.com.Skip \\<and> snd (last l) \\<in> Par_Post(xs!i) \\<or> \n                        fst (last l) ! i = LanguageCon.com.Throw \\<and> snd (last l) \\<in> Par_Abr(xs!i)\" \n          using comm_pdest2[OF _ _ _ last_clist_not_F ]\n          using snd_last by auto          \n     } then show ?thesis by auto\n     qed     \n     obtain i where a20:\"i< length (fst (last l)) \\<and>  fst (last l)!i \\<noteq> Skip\" \n       using a00 unfolding skip_program_def\n       by fastforce\n     then have last_i_throw:\"fst (last l)!i = Throw\" \n       using skip_throw by fastforce     \n     have \"length (fst (last l)) =  length clist\" \n       using conjoin_same_length[OF conjoin] l_not_empty last_l\n       by simp\n     then have i_length:\"i<length clist\" using a20 by fastforce\n     then have snd_last:\"snd (last (snd (clist!i))) = snd (last l)\" \n       using last_clist_l by fastforce\n     have last_clist_not_F:\"fst (last (snd (clist!i)))\\<notin> Fault ` F\"\n       using a9 last_clist_l i_length\n       by (metis \\<open>length (fst (last l)) = length clist\\<close> conjoin \n           l_not_empty not_fault_def same_program_last)\n     then have \"fst (last (snd (clist!i))) = fst (last l) ! i\" \n       using i_length same_program_last [OF l_not_empty conjoin] by fastforce          \n     then have Throw:\"fst (last (snd (clist!i))) = Throw \\<or> fst (last (snd (clist!i))) = Stuck \\<or>\n                     (\\<exists>f. fst (last (snd (clist!i))) = Fault f)\"\n       using last_i_throw by fastforce\n     moreover have  comm_pi:\"(\\<Gamma>, snd (clist!i)) \\<in> comm_p i (Par_Guar (xs!i),(Par_Post(xs!i),Par_Abr (xs!i))) F\"\n       using i_length clist_com by auto\n     moreover have \"snd (clist ! i) \\<noteq> []\"\n             by (metis (no_types) i_length conjoin conjoin_def l_g0 list.size(3) \n                       not_less0 same_length_def snd_conv)\n     moreover have \" final_glob_p (last (snd (clist ! i)))\"\n       using last_i_throw snd_last Throw unfolding final_glob_p_def\n       by auto \n     moreover have \" \\<forall>e\\<in>Par_Post(xs!i). i < length (snd e)\" \n       using a13 unfolding Pred_wf_def\n       by (simp add: i_length length_xs_clist)\n     moreover have \" \\<forall>e\\<in>Par_Abr(xs!i). i < length (snd e)\" \n       using a14 unfolding Pred_wf_def\n       by (simp add: i_length length_xs_clist) \n     ultimately have \"snd (last (snd (clist!i))) \\<in> Par_Abr(xs!i)\" \n        using comm_pdest2[OF _ _ _ last_clist_not_F ]\n        using \\<open>fst (last (snd (clist ! i))) = fst (last l) ! i\\<close> a20 by auto \n     then have \"snd (last l)\\<in>  Par_Abr(xs!i)\" using last_clist_l i_length\n       by fastforce\n     then have \"snd (last l)\\<in>  (a)\" using a4 a0 i_length length_xs_clist by fastforce\n     then have \"\\<exists>j<length (fst (last l)).\n        fst (last l) ! j = LanguageCon.com.Throw \\<and> snd (last l) \\<in> a\"\n     using last_i_throw a20 by auto\n     thus ?thesis using skip_throw unfolding throw_program_def by auto\n   qed \nqed\n\n\nlemma ParallelEmpty [rule_format]:\n  \"\\<forall>i s. (\\<Gamma>,l) \\<in> par_cp  \\<Gamma> (ParallelCom []) s \\<longrightarrow>\n  Suc i < length l \\<longrightarrow> \\<not> (\\<Gamma> \\<turnstile>\\<^sub>p (l!i) \\<rightarrow> (l!Suc i))\"\napply(induct_tac l)\n apply simp\napply clarify\napply(case_tac list,simp,simp)\napply(case_tac i)\n apply(simp add:par_cp_def ParallelCom_def) \n apply(erule par_ctranE,simp)\napply(simp add:par_cp_def ParallelCom_def)\napply clarify\napply(erule par_cptn.cases,simp)\n apply simp  \nby (metis list.inject list.size(3) not_less0 step_p_pair_elim_cases)\n\nlemma ParallelEmpty2:\n  assumes a0:\"(\\<Gamma>,l) \\<in> par_cp  \\<Gamma> (ParallelCom []) s\" and\n         a1: \"i < length l\" \n  shows \"fst (l!i) = []\"\nproof -\n  have paremp:\"ParallelCom [] = []\" unfolding ParallelCom_def by auto\n  then have l0:\"l!0 =([],s)\" using a0 unfolding par_cp_def by auto\n  then have \"(\\<Gamma>,l) \\<in> par_cptn\" using a0 unfolding par_cp_def by fastforce\n  thus ?thesis using l0 a1\n  proof (induct arbitrary: i s) \n    case ParCptnOne thus ?case by auto\n  next\n    case (ParCptnEnv \\<Gamma> P s1 t xs i s)\n    thus ?case\n    proof -\n      have f1: \"i < Suc (Suc (length xs))\"\n        using ParCptnEnv.prems(2) by auto\n      have \"(P, s1) = ([], s)\"\n        using ParCptnEnv.prems(1) by auto\n      then show ?thesis\n        using f1 by (metis (no_types) ParCptnEnv.hyps(3) diff_Suc_1 fst_conv length_Cons less_Suc_eq_0_disj nth_Cons')\n    qed    \n  next\n    case (ParCptnComp \\<Gamma> P s1 Q t xs)   \n    have \"(\\<Gamma>, (P,s1)#(Q, t) # xs) \\<in> par_cp  \\<Gamma> (ParallelCom []) s1\" \n        using ParCptnComp(4) ParCptnComp(1) step_p_elim_cases by fastforce\n      then have \"\\<not> \\<Gamma>\\<turnstile>\\<^sub>p (P, s1) \\<rightarrow> (Q, t)\" using ParallelEmpty ParCptnComp by fastforce\n    thus ?case using ParCptnComp by auto\n  qed\nqed  \n\n\n\nlemma Rel_wf_st:assumes a0:\"\\<forall>i<length xs. Rel_wf_st (length xs) (Par_Guar (xs ! i))\"\n  shows\" \\<forall>i<length xs. Rel_wf i (Par_Guar (xs ! i))\"  \nproof-                      \n  {fix i x y\n    assume a00:\"i<length xs\" and\n          a01:\"(x,y)\\<in>Par_Guar (xs!i)\"\n    then have len:\"length xs \\<le> length (snd x) \\<and> length (snd x) = length (snd y)\"\n      using a0 unfolding Rel_wf_st_def split_beta by fastforce\n    then have \"( i < length (snd x)) \\<and> i < length (snd y)\" using a00 len by auto\n  }  thus ?thesis unfolding Rel_wf_def by auto\nqed\n\nlemma parallel_sound: \n  \"\\<forall>i<length xs.\n       R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n       \\<subseteq> (Par_Rely (xs ! i)) \\<Longrightarrow>\n    (\\<Union>j<length xs. (Par_Guar (xs ! j))) \\<subseteq> G \\<Longrightarrow>\n    p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i))) \\<Longrightarrow>\n    (\\<Inter>i<length xs. (Par_Post (xs ! i))) \\<subseteq> q \\<Longrightarrow>\n    (\\<Union>i<length xs. (Par_Abr (xs ! i))) \\<subseteq> a \\<Longrightarrow> \n    \\<forall>x\\<in>p. length xs = length (snd x) \\<Longrightarrow>\n     \\<forall>i<length xs. \\<forall>x\\<in> (Par_Post (xs!i)). length (snd x) = length xs \\<Longrightarrow>\n     \\<forall>i<length xs. \\<forall>x\\<in> (Par_Abr (xs!i)). length (snd x) = length xs \\<Longrightarrow>\n \\<forall>i<length xs. Rel_wf_st (length xs) (Par_Guar (xs ! i)) \\<Longrightarrow>\n    \\<forall>i<length xs.\n       \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> Par_Com (xs !i) sat i [Par_Pre (xs !i), Par_Rely (xs ! i), Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)] \\<Longrightarrow>\n  \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> ParallelCom xs SAT [p, R, G, q,a]\n  \"\nproof -\n  assume \n  a0:\"\\<forall>i<length xs.\n       R \\<union> (\\<Union>j\\<in>{j. j < length xs \\<and> j \\<noteq> i}. (Par_Guar (xs ! j)))\n       \\<subseteq> (Par_Rely (xs ! i))\" and\n   a1:\"(\\<Union>j<length xs. (Par_Guar (xs ! j))) \\<subseteq> G\" and\n   a2:\"p \\<subseteq> (\\<Inter>i<length xs. (Par_Pre (xs ! i)))\" and\n   a3:\"(\\<Inter>i<length xs. (Par_Post (xs ! i))) \\<subseteq> q\" and\n   a4:\" (\\<Union>i<length xs. Par_Abr (xs ! i)) \\<subseteq> a\" and\n   a5:\"\\<forall>i<length xs. \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub>\n      Par_Com\n       (xs ! i) sat i [Par_Pre (xs ! i),Par_Rely (xs ! i), Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)]\" and\n   a6:\"\\<forall>x\\<in>p. length xs = length (snd x)\" and\n     a7:\"\\<forall>i<length xs. \\<forall>x\\<in>Par_Post (xs ! i). length (snd x) = length xs\" and\n     a8:\" \\<forall>i<length xs. \\<forall>x\\<in>Par_Abr (xs ! i). length (snd x) = length xs\" and \n     a9:\" \\<forall>i<length xs. Rel_wf_st (length xs) (Par_Guar (xs ! i))\" \n  { \n    assume a00:\"\\<forall>i<length (ParallelCom xs). \n                    \\<forall>(c,p,R,G,q,a)\\<in> \\<Theta>. Pred_wf i p \\<and> Rel_wf i R \\<and>  Rel_wf i G \\<and> \n                                       Pred_wf i q \\<and>  Pred_wf i a \\<longrightarrow>\n                     (\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (Call c) sat i [p, R, G, q,a])\"    \n    have p_wf:\"\\<forall>i<length xs. Pred_wf i p\" using a6 unfolding Pred_wf_def by auto\n    have q_wf:\"\\<forall>i<length xs. Pred_wf i (Par_Post (xs!i))\" using a7 unfolding Pred_wf_def \n      by auto\n    have a_wf:\"\\<forall>i<length xs. Pred_wf i (Par_Abr (xs!i))\" using a8 unfolding Pred_wf_def \n      by auto\n    have a9:\" \\<forall>i<length xs. Rel_wf i (Par_Guar (xs ! i))\"\n      using a9 Rel_wf_st by auto\n     { fix s l \n       assume a10: \"(\\<Gamma>,l) \\<in> par_cp  \\<Gamma> (ParallelCom xs) s \\<and> (\\<Gamma>,l) \\<in> par_assum(p, R)\"       \n       then have c_par_cp:\"(\\<Gamma>,l) \\<in> par_cp  \\<Gamma> (ParallelCom xs) s\" by auto\n       have c_par_assum: \"(\\<Gamma>,l) \\<in> par_assum(p, R)\" using a10 by auto\n       have lengthxscom:\"(length (ParallelCom xs)) = length xs\"\n         unfolding ParallelCom_def by auto\n       { fix i         \n         {\n            assume a30:\"Suc i<length l\"  and\n                   a31: \"\\<Gamma>\\<turnstile>\\<^sub>p(l!i)  \\<rightarrow> (l!(Suc i))\"                   \n            have xs_not_empty:\"xs\\<noteq>[]\" \n            proof -\n            {\n              assume \"xs = []\"\n              then have \"\\<not> (\\<Gamma> \\<turnstile>\\<^sub>p (l!i) \\<rightarrow> (l!Suc i))\" \n                using a30 a10 ParallelEmpty by fastforce\n              then have False using a31 by auto\n            } thus ?thesis by auto\n            qed            \n            then have \"(snd(l!i), snd(l!(Suc i))) \\<in>  G\"\n            using four[OF xs_not_empty a0 a1 a2 a5 c_par_cp c_par_assum a30 a31 a00[simplified lengthxscom] a9 p_wf ] by blast\n            \n         } then have \"Suc i<length l \\<longrightarrow> \n                     \\<Gamma>\\<turnstile>\\<^sub>p(l!i)  \\<rightarrow> (l!(Suc i)) \\<longrightarrow>                      \n                     (snd(l!i), snd(l!(Suc i))) \\<in> G \" by auto \n            note l = this\n         { assume a30:\"All_End (last l)\" and not_fault:\"not_fault (fst (last l)) F\"\n           then have xs_not_empty:\"xs\\<noteq>[]\" \n           proof - \n           { assume xs_emp:\"xs=[]\"\n             have lenl:\"0<length l\" using a10 unfolding par_cp_def using par_cptn.simps by fastforce\n             then have \"(length l) - 1 < length l\" by fastforce\n             then have \"fst(l!((length l) - 1)) = []\" using ParallelEmpty2 a10 xs_emp by fastforce\n             then have False using a30 lenl unfolding All_End_def\n               by (simp add: last_conv_nth )              \n           } thus ?thesis by auto\n           qed\n           then have \"throw_program (fst (last l)) \\<and> snd (last l) \\<in> a \\<or>\n                      skip_program (fst (last l)) \\<and> snd (last l) \\<in> q\"\n             using five[OF xs_not_empty a0 a2 a3 a4 a5 c_par_cp c_par_assum \n               a30 not_fault a00[simplified lengthxscom] a9 p_wf q_wf a_wf] by blast\n         } then have \"All_End (last l) \\<longrightarrow> not_fault (fst (last l)) F \\<longrightarrow>\n                      throw_program (fst (last l)) \\<and> snd (last l) \\<in> a \\<or>\n                      skip_program (fst (last l)) \\<and> snd (last l) \\<in> q\" by auto \n           note res1 = conjI[OF l this] \n       }\n       then have  \"(\\<Gamma>,l) \\<in> par_comm(G, (q,a)) F\" unfolding par_comm_def by auto       \n     } \n     then have \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> (ParallelCom xs) SAT [p, R, G, q,a]\" \n       unfolding par_com_validity_def par_cp_def by fastforce\n  } thus ?thesis using par_com_cvalidity_def by fastforce\nqed\n\ntheorem  \n par_rgsound:\"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> Ps SAT [p, R, G, q,a] \\<Longrightarrow>\n  \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> (ParallelCom Ps) SAT [p, R, G, q,a]\"\nproof (induction rule:par_rghoare.induct)\n  case (Parallel  xs R G  p q a \\<Gamma> \\<Theta> F)\n  then have \"\\<forall>i<length xs. \\<Gamma>,(seq_proc_spec i \\<Theta>) \\<Turnstile>\\<^bsub>/F\\<^esub> Par_Com (xs ! i) sat [Seq_pred i (Par_Pre (xs ! i)), \n                                                        Seq_rel i (Par_Rely (xs ! i)), \n                                                        Seq_rel i (Par_Guar (xs ! i)), \n                                                        Seq_pred i (Par_Post (xs ! i)),\n                                                        Seq_pred i (Par_Abr (xs ! i))]\"\n    using localRG_sound com_cnvalid_to_cvalid by fast\n  moreover have  \"\\<forall>i<length xs. \\<forall>x\\<in> (Par_Pre(xs!i)). i < length (snd x)\" using Parallel(4) by auto\n  ultimately have \"\\<forall>i<length xs.\n       \\<Gamma>,\\<Theta> \\<Turnstile>\\<^bsub>/F\\<^esub> Par_Com (xs !i) sat i [Par_Pre (xs !i), Par_Rely (xs ! i), Par_Guar (xs ! i), Par_Post (xs ! i),Par_Abr (xs ! i)]\"    \n    using cvalidity_eq_cvalidityp by fastforce\n  moreover have  \"\\<forall>x\\<in>p. length xs = length (snd x)\" using Parallel(4,7,1) by fastforce    \n  ultimately show ?case using Parallel parallel_sound[of xs R G p q a \\<Gamma> \\<Theta> F] \n      by fast\n  qed\n\nlemma Conseq':\"\\<forall>s. s\\<in>p \\<longrightarrow>\n              (\\<exists>p' q' a' R' G'. \n                (\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [(p' Z), (R' Z), (G' Z), (q' Z),(a' Z)]) \\<and>\n                   (\\<exists> Z. s\\<in>p' Z \\<and> (q' Z \\<subseteq> q) \\<and> (a' Z \\<subseteq> a) \\<and> (G' Z \\<subseteq> G) \\<and> (R \\<subseteq> R' Z)))\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\n  apply (rule Conseq)\n  by (meson order_refl)\n\nlemma conseq:\"\\<lbrakk>\\<forall>Z. \\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P sat [(p' Z), (R' Z), (G' Z), (q' Z),(a' Z)]; \\<Theta>' \\<subseteq> \\<Theta> ;\n              \\<forall>s. s \\<in> p \\<longrightarrow> (\\<exists> Z. s\\<in>p' Z \\<and> (q' Z \\<subseteq> q) \\<and> (a' Z \\<subseteq> a) \\<and> (G' Z \\<subseteq> G) \\<and> (R \\<subseteq> R' Z))\\<rbrakk>\n              \\<Longrightarrow>\n               \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\nby (rule Conseq) (meson order_refl)\n\nlemma conseqPrePost[trans]:\n \"\\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p', R', G', q',a'] \\<Longrightarrow> \\<Theta>' \\<subseteq> \\<Theta> \\<Longrightarrow>\n  p\\<subseteq>p' \\<Longrightarrow> q' \\<subseteq> q \\<Longrightarrow> a' \\<subseteq> a \\<Longrightarrow> G' \\<subseteq> G \\<Longrightarrow> R \\<subseteq> R' \\<Longrightarrow> \n  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"  \nby (rule conseq) auto\n\nlemma conseqPre[trans]:\n \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p', R, G, q,a] \\<Longrightarrow>\n  p\\<subseteq>p' \\<Longrightarrow>\n  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\nby (rule conseq) auto\n\nlemma conseqPost[trans]:\n \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q',a'] \\<Longrightarrow>\n  q'\\<subseteq>q \\<Longrightarrow>  a'\\<subseteq>a \\<Longrightarrow>\n  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q,a]\"\n  by (rule conseq) auto\n  \nlemma shows x:\"\\<exists>(sa'::nat set). (\\<forall>x. (x\\<in> sa) = ((to_nat x) \\<in> sa'))\"\n  by (metis (mono_tags, hide_lams) from_nat_to_nat imageE image_eqI)\n\n\nlemma not_empty_set_countable: \n  assumes a0:\"sa\\<noteq>({}::('a::countable) set)\" \n  shows \"{i. ((\\<lambda>i. i\\<in> sa) o from_nat) i}\\<noteq>{}\"\n  by (metis (full_types) Collect_empty_eq_bot assms comp_apply empty_def equals0I from_nat_to_nat)\n\nlemma eq_set_countable:\"(\\<Inter>i\\<in>{i. ((\\<lambda>i. i\\<in> sa) o from_nat) i}. (q o from_nat) i) = ((\\<Inter>i\\<in>sa. q i))\"     \n  apply auto\n  by (metis (no_types) from_nat_to_nat)\n  \nlemma conj_inter_countable[trans]: \n  assumes a0:\"sa\\<noteq>({}::('a::countable) set)\" and\n          a1:\"\\<forall>i\\<in>sa. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G, q i,a]\"\n  shows\"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G,(\\<Inter>i\\<in>sa. q i),a]\"  \nproof-\n  have \"\\<forall>i\\<in>{i. ((\\<lambda>i. i\\<in> sa) o from_nat) i}. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G,(q o from_nat) i,a]\"    \n    using a1 by auto\n  then have \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P sat [p, R, G,\\<Inter>i\\<in>{i. ((\\<lambda>i. i\\<in> sa) o from_nat) i}. (q o from_nat) i,a]\"\n    using Conj_Inter[OF not_empty_set_countable[OF a0]]   by auto    \n  thus ?thesis  using eq_set_countable\n    by metis    \nqed\n  \nlemma all_Post[trans]:\n  assumes a0:\"\\<forall>p_n::('a::countable). \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [P, R, G, Q p_n, Qa]\" \n  shows\"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [P, R, G,{s. \\<forall>p_n. s\\<in>Q p_n},Qa]\"      \nproof-  \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [P, R, G,(\\<Inter>p_n. Q  p_n),Qa]\"\n     using a0 conj_inter_countable[of UNIV]  by auto \n  moreover have s1:\"\\<forall>P. {s. \\<forall>p_n. s\\<in>P p_n} = (\\<Inter>p_n. P p_n)\"\n    by auto   \n  ultimately show ?thesis\n   by (simp add: s1)\nqed    \n  \nlemma all_Pre[trans]:\n  assumes a0:\"\\<forall>p_n. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [P p_n, R, G, Q, Qa]\" \n  shows\"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [{s. \\<forall>p_n. s\\<in>P p_n}, R, G,Q,Qa]\"\nproof-\n   {fix p_n     \n    have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [{s. \\<forall>p_n. s\\<in>P p_n}, R, G,Q,Qa]\" \n    proof-\n      have \"{v. \\<forall>n. v \\<in> P n} \\<subseteq> P p_n\" by force\n      then show ?thesis by (meson a0 LocalRG_HoareDef.conseqPrePost subset_eq)\n    qed\n  } thus ?thesis by auto \nqed\n    \nlemma Pre_Post_all:\n  assumes a0:\"\\<forall>p_n::('a::countable). \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [P p_n, R, G, Q p_n, Qa]\" \n  shows\"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [{s. \\<forall>p_n. s\\<in>P p_n}, R, G,{s. \\<forall>p_n. s\\<in>Q p_n},Qa]\"    \nproof-\n  {fix p_n\n     \n    have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [{s. \\<forall>p_n. s\\<in>P p_n}, R, G,Q p_n,Qa]\" \n    proof-\n      have \"{v. \\<forall>n. v \\<in> P n} \\<subseteq> P p_n\" by force\n      then show ?thesis by (meson a0 LocalRG_HoareDef.conseqPrePost subset_eq)\n    qed\n  }\n  then have f3:\"\\<forall>p_n. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [{s. \\<forall>p_n. s\\<in>P p_n}, R, G,Q p_n,Qa]\"\n    by auto\n  then have \"\\<forall>p_n. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> C sat [{s. \\<forall>p_n. s\\<in>P p_n}, R, G,{s. \\<forall>p_n. s\\<in>Q p_n},Qa]\"    \n    using all_Post by auto\n  moreover have s1:\"\\<forall>P. {s. \\<forall>p_n. s\\<in>P p_n} = (\\<Inter>p_n. P p_n)\"\n    by auto   \n  ultimately show ?thesis\n   by (simp add: s1)\nqed  \n  \n  \ninductive_cases hoare_elim_skip_cases [cases set]:\n\"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> Skip sat [p, R, G, q,a]\"\n\n\n\n(* abbreviation \n \"stepc_rtrancl\" :: \"[('s,'p,'f,'e) body,('s,'p,'f) config,('s,'p,'f) config] \\<Rightarrow> bool\"\n                                (\"_\\<turnstile>\\<^sub>c (_ \\<rightarrow>\\<^sup>*/ _)\" [81,81,81] 100)\n where                                \n  \"\\<Gamma>\\<turnstile>\\<^sub>c cf0 \\<rightarrow>\\<^sup>* cf1 \\<equiv> ((CONST stepc \\<Gamma>))\\<^sup>*\\<^sup>* cf0 cf1\" *)\n\n\nend\n\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/LocalRG_HoareDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.6224593312018545, "lm_q1q2_score": 0.32580788033634556}}
{"text": "theory SergotTheorems\n\nimports Main Sergot\n\nbegin\n\nlemma Superadditivity: \"G \\<subseteq> H \\<longrightarrow> \\<lfloor>(\\<^bold>[G\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> (\\<^bold>[H\\<^bold>]\\<phi>)\\<rfloor>\" by auto\n(*To add: s5 stuff*)\n\nlemma IntEmptyBox: \"(\\<not> (\\<exists>x. (x \\<in> G \\<inter> H))) \\<longrightarrow> \\<lfloor>(\\<^bold>[G\\<^bold>]\\<^bold>[H\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> \\<^bold>\\<box>\\<phi>\\<rfloor>\"\n  oops (*nitpick finds counterexample*)\n\nlemma helper1: \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub>H \\<phi>) \\<longrightarrow> H \\<subseteq> G \\<longrightarrow> \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub>H \\<phi>)\" by blast\n\nlemma helper2: \"(\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<longrightarrow> (\\<exists>H\\<subseteq>G. (\\<not> (\\<exists>K\\<subset>H. (\\<^bold>[K\\<^bold>]\\<phi>) \\<tau>)))\" by blast\n\n\nlemma NessCompHelper: \"(Ness\\<^sup>m\\<^sup>a\\<^sup>x\\<^sub>G \\<phi>) \\<tau> \\<longrightarrow> x \\<in> G \\<longrightarrow> (\\<exists>H. (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub>H \\<phi> \\<tau>) \\<and> x \\<in> H)\"\nproof - \n  {fix \"G\" \"\\<phi>\" \"\\<tau>\" \"x\"\n    {assume 1: \"(Ness\\<^sup>m\\<^sup>a\\<^sup>x\\<^sub> G \\<phi>) \\<tau>\" and 2: \"x \\<in> G\"\n      hence \"G = {x. (\\<exists>H. ((Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi> \\<tau>) \\<and> x \\<in> H))}\" by simp\n      hence \"(\\<exists>H. ((Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi> \\<tau>) \\<and> x \\<in> H))\" using 2 by blast}\n    hence \"(Ness\\<^sup>m\\<^sup>a\\<^sup>x\\<^sub> G \\<phi>) \\<tau> \\<longrightarrow> x \\<in> G \\<longrightarrow> (\\<exists>H. (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi> \\<tau>) \\<and> x \\<in> H)\" by blast}\n  thus ?thesis by auto\nqed\n\nlemma Nesses: \"(Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>) = (Ness\\<^sub> G \\<phi>) \\<^bold>\\<and> (\\<^bold>\\<not> \\<^bold>\\<Or> {x.\\<exists>H. H \\<subset> G \\<and> x = (Ness\\<^sub> H \\<phi>)})\"\nproof - \n  {fix \"G\" \"\\<phi>\"\n  {fix \"\\<tau>\"\n  {assume \"\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>)\"\n    hence \"\\<tau> \\<^bold>\\<Turnstile> ((Ness\\<^sub> G \\<phi>) \\<^bold>\\<and> (\\<^bold>\\<not> \\<^bold>\\<Or> {x.\\<exists>H.  H \\<subset> G \\<and> x = (Ness\\<^sub> H \\<phi>)}))\" using mem_Collect_eq by blast}\n  hence l: \"\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>) \\<longrightarrow> \\<tau> \\<^bold>\\<Turnstile> ((Ness\\<^sub> G \\<phi>) \\<^bold>\\<and> (\\<^bold>\\<not> \\<^bold>\\<Or> {x.\\<exists>H.  H \\<subset> G \\<and> x = (Ness\\<^sub> H \\<phi>)}))\" by blast\n  {assume asm2: \"\\<tau> \\<^bold>\\<Turnstile> ((Ness\\<^sub> G \\<phi>) \\<^bold>\\<and> (\\<^bold>\\<not> \\<^bold>\\<Or> {x.\\<exists>H.  H \\<subset> G \\<and> x = (Ness\\<^sub> H \\<phi>)}))\"\n    {assume \"((\\<exists> H. (H \\<subset> G) \\<and> (Ness\\<^sub> H \\<phi> \\<tau>)))\"\n    then obtain K where \" (K \\<subset> G) \\<and> (Ness\\<^sub> K \\<phi> \\<tau>)\" by auto\n    hence \"\\<tau> \\<^bold>\\<Turnstile> \\<^bold>\\<Or> {x.\\<exists>H.  H \\<subset> G \\<and> x = (Ness\\<^sub> H \\<phi>)}\" by auto\n    hence False using asm2 by simp}\n  hence \"\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>)\" using asm2 by argo}\n  hence \"\\<tau> \\<^bold>\\<Turnstile> ((Ness\\<^sub> G \\<phi>) \\<^bold>\\<and> (\\<^bold>\\<not> \\<^bold>\\<Or> {x.\\<exists>H.  H \\<subset> G \\<and> x = (Ness\\<^sub> H \\<phi>)})) \\<longrightarrow> \\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>)\" by blast\n  hence \"\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>) \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> ((Ness\\<^sub> G \\<phi>) \\<^bold>\\<and> (\\<^bold>\\<not> \\<^bold>\\<Or> {x.\\<exists>H. H \\<subset> G \\<and> x = (Ness\\<^sub> H \\<phi>)}))\" using l by argo}\n  hence \"(Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>) = (Ness\\<^sub> G \\<phi>) \\<^bold>\\<and> (\\<^bold>\\<not> \\<^bold>\\<Or> {x.\\<exists>H. H \\<subset> G \\<and> x = (Ness\\<^sub> H \\<phi>)})\" by simp}\n  thus ?thesis by simp\nqed\n\nabbreviation dumbFunction :: \"\\<mu> set \\<Rightarrow> (\\<mu> set \\<Rightarrow> bool) \\<Rightarrow> nat\"\n  where \"dumbFunction G Rel \\<equiv> Min {n. \\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H}\"\n\nlemma RelFinite: \"(Rel::\\<mu> set \\<Rightarrow> bool) G \\<longrightarrow> finite {n. \\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H}\"\nproof -\n{fix Rel G\n    {assume \"(Rel::\\<mu> set \\<Rightarrow> bool) G\"\n      let ?m = \"card Ag\"\n      have \"\\<forall>a. a \\<in> {n. \\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H} \\<longrightarrow> a \\<le> ?m\" using card_mono finiteActors by blast\n      hence a: \"finite {n. \\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H}\" by (meson finite_nat_set_iff_bounded_le)}\n    hence \"(Rel::\\<mu> set \\<Rightarrow> bool) G \\<longrightarrow> finite  {n. \\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H}\" by blast}\n  thus ?thesis by simp\nqed\n\n\nlemma \"Rel G \\<longrightarrow> dumbFunction G Rel \\<le> card G\"\nproof -\n  {fix Rel G\n    {assume \"(Rel::\\<mu> set \\<Rightarrow> bool) G\"\n      let ?m = \"card Ag\"\n      have a: \"finite {n. \\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H}\" using RelFinite \\<open>Rel G\\<close> by presburger\n      have \"G \\<subseteq> G \\<and> card G = card G \\<and> Rel G\" using \\<open>Rel G\\<close> by blast\n      hence \"card G \\<in> {n. \\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H}\" by auto\n      hence \"{} \\<noteq> {n. \\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H}\" by blast\n      hence \"dumbFunction G Rel \\<le> ?m\" using a by (metis (no_types, lifting) Min_le_iff \\<open>card G \\<in> {n. \\<exists>H\\<subseteq>G. n = card H \\<and> Rel H}\\<close> card_mono finiteActors top_greatest)\n      hence \"card G \\<ge> dumbFunction G Rel\" using Min_le \\<open>Rel G\\<close> a by blast}\n    hence \"Rel G \\<longrightarrow> dumbFunction G Rel \\<le> card G\" by simp}\n  thus ?thesis by simp\nqed\n\nlemma minimalexists: \"(Rel::\\<mu> set \\<Rightarrow> bool) G \\<longrightarrow> (\\<exists>H\\<subseteq>G. Rel H \\<and> (\\<not> (\\<exists>K \\<subset> H. (Rel K))))\" \nproof - \n  {fix Rel G\n    {assume \"(Rel::\\<mu> set \\<Rightarrow> bool) G\"\n      hence \"\\<exists>n. (n = dumbFunction G Rel)\" by simp\n      then obtain n where obtn: \"n = dumbFunction G Rel\" by auto\n      have \"finite {n. \\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H}\" using RelFinite \\<open>Rel G\\<close> by presburger\n      hence \"\\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H\" using Min_in obtn \\<open>Rel G\\<close> by auto\n      then obtain H where obtH: \"H \\<subseteq> G \\<and> n = card H \\<and> Rel H\" by auto\n      {assume red: \"\\<exists>K \\<subset> H. (Rel K)\"\n        then obtain K where obtK: \"K \\<subset> H \\<and> (Rel K)\" by auto\n        hence \"K \\<subseteq> G \\<and> Rel K\" using obtH by blast\n        hence c: \"card K \\<in> {n. \\<exists>H. H \\<subseteq> G \\<and> n = card H \\<and> Rel H}\" by auto\n        have \"card K < n\" using obtK by (metis finiteActors finite_subset obtH psubset_card_mono top_greatest)\n        hence False using Min_le \\<open>finite {n. \\<exists>H\\<subseteq>G. n = card H \\<and> Rel H}\\<close> c not_less obtn by blast}\n      hence \"\\<not> (\\<exists>K \\<subset> H. (Rel K))\" by blast\n      hence \"(\\<exists>H\\<subseteq>G. Rel H \\<and> (\\<not> (\\<exists>K \\<subset> H. (Rel K))))\" using obtH by auto}\n    hence \"(Rel::\\<mu> set \\<Rightarrow> bool) G \\<longrightarrow> (\\<exists>H\\<subseteq>G. Rel H \\<and> (\\<not> (\\<exists>K \\<subset> H. (Rel K))))\" by simp}\n  thus ?thesis by simp\nqed\n\nlemma Proposition1: \"(\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sub> G \\<phi>) \\<longleftrightarrow> (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[Ag\\<^bold>]\\<phi>)) \\<and> \\<not>(\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[Ag - G\\<^bold>]\\<phi>)))\" by blast\n\nlemma \"(G \\<subseteq> H) \\<longrightarrow> \\<lfloor>(\\<^bold>\\<not>(\\<^bold>[Ag -H\\<^bold>]\\<phi>)) \\<^bold>\\<rightarrow> (\\<^bold>\\<not>(\\<^bold>[Ag-H\\<^bold>]\\<phi>))\\<rfloor>\" by auto\n\nlemma Proposition2a: \"(Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi> \\<tau>) \\<longrightarrow> x \\<in> (Core \\<phi> \\<tau>)\"\nproof- \n  {fix x \\<phi> \\<tau>\n    assume asm: \"(Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x::\\<mu>} \\<phi> (\\<tau>::i))\"\n      {assume red: \"x \\<notin> (Core \\<phi> \\<tau>)\"\n        from asm have \"(Ness\\<^sub> {x} \\<phi> \\<tau>) \\<and> ((\\<forall>H \\<subset> {x}. \\<not> (Ness\\<^sub> H \\<phi> \\<tau>)))\" by blast\n        hence \"(Ness\\<^sub> {x} \\<phi> \\<tau>) \\<and> \\<not> (Ness\\<^sub> {} \\<phi> \\<tau>)\" by blast\n        hence a: \"(Ness\\<^sub> {x} \\<phi> \\<tau>)\" by simp\n        from Proposition1 have p1: \"(\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sub> {x} \\<phi>) \\<longleftrightarrow> (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[Ag\\<^bold>]\\<phi>)) \\<and> \\<not>(\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[Ag - {x}\\<^bold>]\\<phi>)))\" by presburger\n        hence \"\\<not> (\\<^bold>[Ag -{x}\\<^bold>]\\<phi>) \\<tau>\" using a by simp\n        have ag: \"(\\<^bold>[Ag\\<^bold>]\\<phi>) \\<tau>\" using p1 a by simp\n        let ?Rel = \"\\<lambda>K. (\\<^bold>[K\\<^bold>]\\<phi>) \\<tau>\"\n        from minimalexists have \"\\<forall> Rel G.(Rel::\\<mu> set \\<Rightarrow> bool) G \\<longrightarrow> (\\<exists>H\\<subseteq>G. Rel H \\<and> (\\<not> (\\<exists>K \\<subset> H. (Rel K))))\" by simp\n        hence \"\\<forall> Rel.(Rel::\\<mu> set \\<Rightarrow> bool) Ag \\<longrightarrow> (\\<exists>H\\<subseteq>Ag. Rel H \\<and> (\\<not> (\\<exists>K \\<subset> H. (Rel K))))\" by blast\n        hence \"(?Rel::\\<mu> set \\<Rightarrow> bool) Ag \\<longrightarrow> (\\<exists>H\\<subseteq>Ag. ?Rel H \\<and> (\\<not> (\\<exists>K \\<subset> H. (?Rel K))))\" by (rule allE)\n        hence \"(\\<exists>H\\<subseteq>Ag. ?Rel H \\<and> (\\<not> (\\<exists>K \\<subset> H. (?Rel K))))\" using ag by simp\n        then obtain H where obtH: \"H \\<subseteq> Ag \\<and> ((\\<^bold>[H\\<^bold>]\\<phi>) \\<tau>) \\<and> (\\<not> (\\<exists>K \\<subset> H. ((\\<^bold>[K\\<^bold>]\\<phi>) \\<tau>)))\" by auto\n        hence ex: \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>)\" by simp\n        hence ex2: \"x \\<in> H\" by (metis DiffI UNIV_I \\<open>\\<not> \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> (Ag - {x}) \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>\\<close> singletonD)\n        from red have \"x \\<notin> \\<^bold>\\<inter> {H. ((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>)(\\<tau>::i))}\" by simp\n        hence  \"x \\<notin> {x. (\\<exists>M \\<in> {H. ((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>)(\\<tau>::i))}. (x \\<in> M)) \\<and> (\\<forall> M \\<in> {H. ((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>)(\\<tau>::i))}. x \\<in> M)}\" by simp\n        hence \"\\<exists>K. (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> K \\<phi>)(\\<tau>::i) \\<and> x \\<notin> K\" using ex ex2 by blast\n        then obtain K where obtK: \"(\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> K \\<phi>)(\\<tau>::i) \\<and> x \\<notin> K\" by auto\n          hence \"(\\<^bold>[Ag -{x}\\<^bold>]\\<phi>) \\<tau>\" by auto\n          hence False using \\<open>((\\<exists>K. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> K \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>) \\<and> (\\<forall>H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> H \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<longrightarrow> \\<not> \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> (H - {x}) \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>)) \\<and> (\\<forall>H\\<subset>{x}. \\<not> ((\\<exists>K. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> K \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>) \\<and> (\\<forall>Ha. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> Ha \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<longrightarrow> \\<not> \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> (Ha - H) \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>)))\\<close> p1 by blast}\n        hence \"x \\<in> Core \\<phi> \\<tau>\" by blast}\n      thus ?thesis by presburger\nqed\n\nlemma Proposition2b: \"(x \\<in> (Core \\<phi> \\<tau>)) \\<longrightarrow> (\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>))\"\nproof -\n    {assume \"x \\<in> (Core \\<phi> \\<tau>)\"\n      {assume \"\\<not> (\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>))\"\n        hence a: \"(\\<not> Ness\\<^sub> {x} \\<phi> \\<tau>) \\<or> ((\\<exists> H. (H \\<subset> {x}) \\<and> (Ness\\<^sub> H \\<phi> \\<tau>)))\" by blast\n        have \"(\\<exists> H. (H \\<subset> {x}) \\<and> (Ness\\<^sub> H \\<phi> \\<tau>)) \\<longleftrightarrow> (Ness\\<^sub> {} \\<phi> \\<tau>)\" by fast\n        hence \"(\\<not> (Ness\\<^sub> {x} \\<phi> \\<tau>)) \\<or> (Ness\\<^sub> {} \\<phi> \\<tau>)\" using a by auto\n        {assume \"(Ness\\<^sub> {} \\<phi> \\<tau>)\"\n          hence False by auto}\n        {assume \"(\\<not> (Ness\\<^sub> {x} \\<phi> \\<tau>))\"\n          hence \"(\\<not> (\\<exists>(K::\\<mu> set). (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[K\\<^bold>]\\<phi>)))) \\<or> (\\<exists>H. (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[H\\<^bold>]\\<phi>)) \\<and> (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[H - {x}\\<^bold>]\\<phi>)))\" by blast\n          {assume \"\\<not> (\\<exists>(K::\\<mu> set). (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[K\\<^bold>]\\<phi>)))\"\n            hence False using \\<open>x \\<in> \\<^bold>\\<inter> {H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> H \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<and> \\<not> (\\<exists>Ha\\<subset>H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> Ha \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>)}\\<close> by auto}\n          {assume \"\\<exists>H. (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[H\\<^bold>]\\<phi>)) \\<and> (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[H - {x}\\<^bold>]\\<phi>))\"\n            then obtain H where obtH: \"(\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[H\\<^bold>]\\<phi>)) \\<and> (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[H - {x}\\<^bold>]\\<phi>))\" by auto\n            let ?Rel = \"\\<lambda>K. (\\<^bold>[K\\<^bold>]\\<phi>) \\<tau>\" \n            from minimalexists have \"\\<forall> Rel G.(Rel::\\<mu> set \\<Rightarrow> bool) G \\<longrightarrow> (\\<exists>L\\<subseteq>G. Rel L \\<and> (\\<not> (\\<exists>K \\<subset> L. (Rel K))))\" by simp\n            hence \"\\<forall> Rel.(Rel::\\<mu> set \\<Rightarrow> bool) (H - {x}) \\<longrightarrow> (\\<exists>L\\<subseteq>(H - {x}). Rel L \\<and> (\\<not> (\\<exists>K \\<subset> L. (Rel K))))\" by simp\n            hence \"(?Rel::\\<mu> set \\<Rightarrow> bool) (H - {x}) \\<longrightarrow> (\\<exists>L\\<subseteq>(H - {x}). ?Rel L \\<and> (\\<not> (\\<exists>K \\<subset> L. (?Rel K))))\" by (rule allE)\n            hence \" (\\<exists>L\\<subseteq>(H - {x}). ?Rel L \\<and> (\\<not> (\\<exists>K \\<subset> L. (?Rel K))))\" using obtH by fastforce\n            hence \"\\<exists>K. (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> K \\<phi>)(\\<tau>::i) \\<and> x \\<notin> K\" by (metis subset_Diff_insert)\n            hence \"x \\<notin> Core \\<phi> \\<tau>\" by simp\n            hence False using \\<open>x \\<in> \\<^bold>\\<inter> {H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> H \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<and> \\<not> (\\<exists>Ha\\<subset>H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> Ha \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>)}\\<close> by blast}\n          hence False using \\<open>\\<nexists>K. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> K \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<Longrightarrow> False\\<close> \\<open>\\<not> ((\\<exists>K. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> K \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>) \\<and> (\\<forall>H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> H \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<longrightarrow> \\<not> \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> (H - {x}) \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>))\\<close> by blast}\n        hence False using \\<open>(\\<exists>K. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> K \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>) \\<and> (\\<forall>H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> H \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<longrightarrow> \\<not> \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> (H - {}) \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>) \\<Longrightarrow> False\\<close> \\<open>\\<not> ((\\<exists>K. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> K \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>) \\<and> (\\<forall>H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> H \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<longrightarrow> \\<not> \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> (H - {x}) \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>)) \\<or> (\\<exists>K. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> K \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>) \\<and> (\\<forall>H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> H \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<longrightarrow> \\<not> \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> (H - {}) \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>)\\<close> by fastforce}\n      hence \"(\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x::\\<mu>} \\<phi>))\" by blast}\n    thus \"(x \\<in> (Core \\<phi> \\<tau>)) \\<longrightarrow> (\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x::\\<mu>} \\<phi>))\" by blast\n  qed\n\nlemma Proposition2: \"(Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi> \\<tau>) \\<longleftrightarrow> x \\<in> (Core \\<phi> \\<tau>)\"\nproof - \n  {assume \"\\<not> ((Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x::\\<mu>} \\<phi> (\\<tau>::i)) \\<longleftrightarrow> x \\<in> (Core \\<phi> \\<tau>))\"\n    hence or: \" (\\<not> ((Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x::\\<mu>} \\<phi> (\\<tau>::i)) \\<longrightarrow> x \\<in> (Core \\<phi> \\<tau>))) \\<or> \\<not> ((x \\<in> (Core \\<phi> \\<tau>)) \\<longrightarrow> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x::\\<mu>} \\<phi> (\\<tau>::i)))\" by blast\n    from Proposition2b have \"((x \\<in> (Core \\<phi> \\<tau>)) \\<longrightarrow> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi> \\<tau>))\" by -\n    hence or2: \"(\\<not> ((Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x::\\<mu>} \\<phi> (\\<tau>::i)) \\<longrightarrow> x \\<in> (Core \\<phi> \\<tau>)))\" using or by blast\n    from Proposition2a have \"((Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x::\\<mu>} \\<phi> (\\<tau>::i)) \\<longrightarrow> x \\<in> (Core \\<phi> \\<tau>))\" by -\n    hence False using or2 by blast}\n  thus ?thesis by argo\nqed\n\n\nlemma minDeltaExists: \"(\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<longrightarrow> (\\<exists>H \\<subseteq> G. (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>)))\"\nproof - \n  let ?Rel = \"\\<lambda>K. (\\<^bold>[K\\<^bold>]\\<phi>) \\<tau>\"\n  from minimalexists have\"\\<forall>Rel. (Rel::\\<mu> set \\<Rightarrow> bool) G \\<longrightarrow> (\\<exists>H\\<subseteq>G. Rel H \\<and> (\\<not> (\\<exists>K \\<subset> H. (Rel K))))\" by simp\n  hence \"(?Rel::\\<mu> set \\<Rightarrow> bool) G \\<longrightarrow> (\\<exists>H\\<subseteq>G. ?Rel H \\<and> (\\<not> (\\<exists>K \\<subset> H. (?Rel K))))\" by (rule allE)\n  thus \"(\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<longrightarrow> (\\<exists>H\\<subseteq>G. (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>)))\" by auto\nqed\n\nlemma Corollary1a: \"(G \\<noteq> {}) \\<longrightarrow> (((\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<and> (G = Core \\<phi> \\<tau>)) \\<longrightarrow> \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>))\"\nproof - \n  {assume asm1: \"G \\<noteq> {}\"\n    and asm2: \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)\" \n    and asm3: \"G = Core \\<phi> \\<tau>\"\n    {assume red:\"(\\<exists> H. (H \\<subset> G) \\<and> ((\\<^bold>[H\\<^bold>]\\<phi>) \\<tau>))\"\n      then obtain H where obtH: \"(H \\<subset> G) \\<and> ((\\<^bold>[H\\<^bold>]\\<phi>) \\<tau>)\" by auto\n      {assume \"H = {}\"\n        hence \"Core \\<phi> \\<tau> = {}\" using obtH by auto\n        hence False using asm3 obtH asm1 by fastforce}\n      hence ne: \"H \\<noteq> {}\" by blast\n      hence \"\\<exists>x\\<in>G. x \\<notin> H\" using obtH by blast\n      then obtain x where obtx: \"x \\<in> G \\<and> x \\<notin> H\" by auto\n      have \"Core \\<phi> \\<tau> \\<noteq> {}\" using asm1 asm3 by simp\n      hence fa: \"\\<forall>y. ((y \\<in> Core \\<phi> \\<tau>) \\<longrightarrow> (\\<forall>K. (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> K \\<phi>)) \\<longrightarrow> y \\<in> K))\" by simp\n      from minDeltaExists obtH have \"\\<exists>K\\<subseteq>H. (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> K \\<phi>))\" by simp\n      then obtain K where obtK: \"K\\<subseteq>H \\<and> (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> K \\<phi>))\" by auto\n      hence \"x \\<notin> K\" using obtx by auto\n      hence \"\\<exists>K. (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> K \\<phi>)) \\<and> x \\<notin> K\" using obtK by auto\n      hence \"x \\<notin> Core \\<phi> \\<tau>\" using fa by force\n      hence False using obtx asm3 by blast}\n    hence \"\\<not> (\\<exists> H. (H \\<subset> G) \\<and> ((\\<^bold>[H\\<^bold>]\\<phi>) \\<tau>))\" by blast\n    hence one: \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>)\" using asm2 by simp\n    {assume red2: \"\\<not> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>a\\<^sup>x\\<^sub> G \\<phi>) \\<tau>\" \n      from one have \"\\<exists>M. (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>a\\<^sup>x\\<^sub> M \\<phi>) \\<tau>\" by presburger\n      then obtain M where obtmax: \"(\\<^bold>\\<Delta>\\<^sup>m\\<^sup>a\\<^sup>x\\<^sub> M \\<phi>) \\<tau>\" by auto\n      {assume \"G \\<noteq> M\"\n        hence a: \"M \\<supset> G \" using obtmax Collect_mono_iff asm3 mem_Collect_eq psubsetI by auto\n        hence \"\\<exists>x\\<in>M. x\\<notin>G\" by auto\n        then obtain x where obtx: \"x \\<in> M \\<and> x \\<notin> G\" by auto\n        hence \"x \\<in> {x. (\\<exists>K. (((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> K \\<phi>) \\<tau>) \\<and> x \\<in> K))}\" using obtmax by simp\n        hence \"\\<exists>H. ((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>) \\<tau>) \\<and> x \\<in> H\" by simp\n        then obtain H where obtH: \"(\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>) \\<tau> \\<and> x \\<in> H\" by auto\n        {assume \"\\<exists>y \\<in> G. y \\<notin> H\"\n          then obtain y where obty: \"y \\<in> G \\<and> y \\<notin> H\" by auto\n          hence \"y \\<notin> Core \\<phi> \\<tau>\" using obtH by auto\n          hence False using asm3 obty by argo}\n        hence \"H \\<supseteq> G\" by auto\n        hence \"H \\<supset> G\" using obtx obtH by auto\n        hence False using obtH asm2 by blast}\n      hence \"G = M\" by blast\n      hence \"(\\<^bold>\\<Delta>\\<^sup>m\\<^sup>a\\<^sup>x\\<^sub> G \\<phi>) \\<tau>\" using obtmax by auto\n      hence False using red2 by blast}\n    hence \"(\\<^bold>\\<Delta>\\<^sup>m\\<^sup>a\\<^sup>x\\<^sub> G \\<phi>) \\<tau>\" by blast\n    hence \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>)\" using one by blast}\n  thus ?thesis by argo\nqed\n\nlemma Corollary1b: \"(G \\<noteq> {}) \\<longrightarrow> (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>) \\<longrightarrow> ((\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<and> (G = Core \\<phi> \\<tau>)))\"\nproof -\n    {assume asm: \"G \\<noteq> {}\" and asm2: \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>)\"\n      hence 1: \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)\" by blast\n      have 2: \"\\<not>(\\<exists> H. (H \\<subset> G) \\<and> (\\<^bold>[H\\<^bold>]\\<phi>) \\<tau>)\" using asm2 by argo\n      have \"Core \\<phi> \\<tau> \\<subseteq> G\" using asm2 by blast\n      have \"G \\<subseteq> Core \\<phi> \\<tau>\" \n      proof -\n      {assume red: \"\\<exists>x. x \\<in> G \\<and> x \\<notin> Core \\<phi> \\<tau>\"\n        then obtain x where obtx: \"x \\<in> G \\<and> x \\<notin> Core \\<phi> \\<tau>\" by presburger\n        hence nm: \"\\<not> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi> \\<tau>)\" using Proposition2 by simp\n        have \"\\<not> \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[{}\\<^bold>]\\<phi>)\" using 1 2 asm by blast\n        hence \"\\<not>(\\<exists> H. (H \\<subset> {x}) \\<and> (Ness\\<^sub> H \\<phi> \\<tau>))\" by (metis Diff_empty Diff_insert_absorb bot.extremum_strict less_imp_le psubset_insert_iff singleton_insert_inj_eq)\n        hence nn: \"\\<not> Ness\\<^sub> {x} \\<phi> \\<tau>\" using nm by blast\n        from 1 have \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[Ag\\<^bold>]\\<phi>)\" by simp\n        hence \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[Ag - {x}\\<^bold>]\\<phi>)\" using Proposition1 nn by blast \n        have ff: \"\\<forall>H. \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>) \\<longrightarrow> x \\<in> H\"\n        proof -\n          {fix H\n            assume asmH: \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>)\"\n              hence \"H \\<subseteq> G\" using asm2 by blast\n              hence \"H = G\" using asmH \\<open>H \\<subseteq> G\\<close> using asm2 by (meson order.not_eq_order_implies_strict)\n              hence \"x \\<in> H\" by (simp add: obtx)}\n            thus \"\\<forall>H. \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> H \\<phi>) \\<longrightarrow> x \\<in> H\" by simp\n          qed\n          have \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> (G::\\<mu> set) \\<phi>)\" using 1 2 by simp\n          hence \"x \\<in> Core \\<phi> \\<tau>\" using ff by auto\n          hence False using obtx by fastforce}\n        thus ?thesis by blast\n      qed\n      hence \"G = Core \\<phi> \\<tau>\" using \\<open>\\<^bold>\\<inter> {H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> H \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<and> \\<not> (\\<exists>Ha\\<subset>H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> Ha \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>)} \\<subseteq> G\\<close> by blast}\n    thus \"(G \\<noteq> {}) \\<longrightarrow> (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>) \\<longrightarrow> ((\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<and> (G = Core \\<phi> \\<tau>)))\" by argo\nqed\n\nlemma Corollary1: \"G \\<noteq> {} \\<longrightarrow>(((\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<and> (G = Core \\<phi> \\<tau>)) \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>))\"\nproof -\n  {assume asm: \"G \\<noteq> {}\"\n    have \"G \\<noteq> {} \\<longrightarrow> (((\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<and> (G = Core \\<phi> \\<tau>)) \\<longrightarrow> \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>))\" using Corollary1a by -\n    hence lr: \"(((\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<and> (G = Core \\<phi> \\<tau>)) \\<longrightarrow> \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>))\" using asm by (rule mp)\n    have \"(G \\<noteq> {}) \\<longrightarrow> (\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>) \\<longrightarrow> ((\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<and> (G = Core \\<phi> \\<tau>)))\" using Corollary1b by -\n    hence \"(\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>) \\<longrightarrow> ((\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<and> (G = Core \\<phi> \\<tau>)))\" using asm by (rule mp)\n    hence \"(((\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>[G\\<^bold>]\\<phi>)) \\<and> (G = Core \\<phi> \\<tau>)) \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>s\\<^sup>o\\<^sup>l\\<^sup>e\\<^sub> G \\<phi>))\" using lr by argo}\n  thus ?thesis by blast (*this whole proof is pointless, but my hardware cant prove it on its own*)\nqed\n\nlemma Proposition3: \"G \\<noteq> {} \\<longrightarrow>((\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>)) \\<longleftrightarrow> (G \\<subseteq> H) \\<and> (\\<tau> \\<^bold>\\<Turnstile>((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub>H \\<phi>) \\<^bold>\\<and> \\<^bold>\\<not>\\<^bold>[H - G\\<^bold>]\\<phi>)) \\<and> (\\<not> (\\<exists>K. K \\<subset> H \\<and> (\\<tau> \\<^bold>\\<Turnstile>((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub>K \\<phi>) \\<^bold>\\<and> \\<^bold>\\<not>\\<^bold>[K - G\\<^bold>]\\<phi>)))))\" \n  oops\n(*Nitpick finds a counterexample here too*)\n\nlemma Proposition3a: \"G \\<noteq> {} \\<longrightarrow>((\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub>G \\<phi>)) \\<longrightarrow> (G \\<subseteq> H) \\<and> (\\<tau> \\<^bold>\\<Turnstile>((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub>H \\<phi>) \\<^bold>\\<and> \\<^bold>\\<not>\\<^bold>[H - G\\<^bold>]\\<phi>)) \\<and> (\\<not> (\\<exists>K. K \\<subset> H \\<and> (\\<tau> \\<^bold>\\<Turnstile>((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub>K \\<phi>) \\<^bold>\\<and> \\<^bold>\\<not>\\<^bold>[K - G\\<^bold>]\\<phi>)))))\" nitpick[user_axioms]\n  oops\n(*Nitpick finds a counterexample here too*)\nlemma Proposition3b: \"G \\<noteq> {} \\<longrightarrow> ((G \\<subseteq> H) \\<and> (\\<tau> \\<^bold>\\<Turnstile>((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub>H \\<phi>) \\<^bold>\\<and> \\<^bold>\\<not>\\<^bold>[H - G\\<^bold>]\\<phi>)) \\<and> (\\<not> (\\<exists>K. K \\<subset> H \\<and> (\\<tau> \\<^bold>\\<Turnstile>((\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> K \\<phi>) \\<^bold>\\<and> \\<^bold>\\<not>\\<^bold>[K - G\\<^bold>]\\<phi>)))) \\<longrightarrow> ((\\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>))))\" nitpick[user_axioms]\n  oops\n(*Nitpick finds a counterexample here too*)\n\n\nlemma Proposition5: \"G \\<noteq> {} \\<longrightarrow> \\<lfloor>(\\<^bold>[Ag\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> ((Could\\<^sub> G (\\<^bold>\\<not>\\<phi>)) \\<^bold>\\<rightarrow> (Ness\\<^sub> G \\<phi>))\\<rfloor>\" by (meson DiffD2 DiffI iso_tuple_UNIV_I tildexeq xsub)\n\nlemma eqcompr: \"(\\<forall>\\<tau>. \\<tau> \\<^bold>\\<Turnstile> \\<phi> \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> \\<psi>) \\<longleftrightarrow> \\<phi> = \\<psi>\"\nproof- \n  have rl: \"\\<phi> = \\<psi> \\<longrightarrow> (\\<forall>\\<tau>. \\<tau> \\<^bold>\\<Turnstile> \\<phi> \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> \\<psi>)\" by simp\n  have \"(\\<forall>\\<tau>. \\<tau> \\<^bold>\\<Turnstile> \\<phi> \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> \\<psi>) \\<longrightarrow> \\<phi> = \\<psi>\" by auto\n  thus ?thesis using rl by blast\nqed\n\nlemma NessEq: \"Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi> = Ness\\<^sub> {x} \\<phi>\"\nproof -\n  {fix \\<tau>\n    {assume \"\\<tau> \\<^bold>\\<Turnstile> Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>\"\n      hence \"\\<tau> \\<^bold>\\<Turnstile>Ness\\<^sub> {x} \\<phi>\" by simp}\n    {assume \"\\<tau> \\<^bold>\\<Turnstile>Ness\\<^sub> {x} \\<phi>\" \n      hence \"\\<not> \\<tau> \\<^bold>\\<Turnstile>(\\<^bold>[{}\\<^bold>]\\<phi>)\" by (meson equals0D)\n      hence \" \\<not>(\\<exists> H. (H \\<subset> {x}) \\<and> (Ness\\<^sub> H \\<phi> \\<tau>))\" by (metis Diff_empty Diff_insert_absorb bot.extremum_strict less_imp_le psubset_insert_iff singleton_insert_inj_eq)\n      hence \"\\<tau> \\<^bold>\\<Turnstile> Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>\" using \\<open>(\\<exists>K. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> K \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>) \\<and> (\\<forall>H. \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> H \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor> \\<longrightarrow> \\<not> \\<lfloor>(\\<lambda>v. v \\<^bold>\\<Turnstile> tildeG \\<tau> (H - {x}) \\<longrightarrow> v \\<^bold>\\<Turnstile> \\<phi>)\\<rfloor>)\\<close> by blast}\n    hence \"\\<tau> \\<^bold>\\<Turnstile> Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi> \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> Ness\\<^sub> {x} \\<phi>\" by blast}\n  hence a: \"\\<forall>\\<tau>. (\\<tau> \\<^bold>\\<Turnstile> Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi> \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> Ness\\<^sub> {x} \\<phi>)\" by simp\n  from eqcompr have \"\\<forall>z y. ((\\<forall>\\<tau>. \\<tau> \\<^bold>\\<Turnstile> z \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> y) \\<longleftrightarrow> z = y)\" by simp\n  hence \"\\<forall>y. ((\\<forall>\\<tau>. \\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>) \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> y) \\<longleftrightarrow> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>) = y)\" by (rule allE)\n  hence \"((\\<forall>\\<tau>. \\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>) \\<longleftrightarrow> \\<tau> \\<^bold>\\<Turnstile> (Ness\\<^sub> {x} \\<phi>)) \\<longleftrightarrow> (Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>) = (Ness\\<^sub> {x} \\<phi>))\" by (rule allE)\n  hence\"(Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>) = (Ness\\<^sub> {x} \\<phi>)\" using a by simp\n  thus ?thesis by simp\nqed\n\nlemma Corollary2: \"\\<lfloor>(\\<^bold>[Ag\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> ((Could\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} (\\<^bold>\\<not>\\<phi>)) \\<^bold>\\<rightarrow> Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>)\\<rfloor>\"\nproof - \n  from Proposition5 have \"\\<forall>G. G \\<noteq> {} \\<longrightarrow> \\<lfloor>(\\<^bold>[Ag\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> ((Could\\<^sub> G (\\<^bold>\\<not>\\<phi>)) \\<^bold>\\<rightarrow> (Ness\\<^sub> G \\<phi>))\\<rfloor>\" by simp\n  hence a: \"\\<forall>G. G \\<noteq> {} \\<longrightarrow> \\<lfloor>(\\<^bold>[Ag\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> ((Could\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G (\\<^bold>\\<not>\\<phi>)) \\<^bold>\\<rightarrow> (Ness\\<^sub> G \\<phi>))\\<rfloor>\" by simp\n  have \"{x} \\<noteq> {}\" by simp\n  hence b: \"\\<lfloor>(\\<^bold>[Ag\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> ((Could\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} (\\<^bold>\\<not>\\<phi>)) \\<^bold>\\<rightarrow> (Ness\\<^sub> {x} \\<phi>))\\<rfloor>\" using a by presburger\n  from NessEq have eq: \"(Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>) = (Ness\\<^sub> {x} \\<phi>)\" by -\n  let ?d = \"(Ness\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} \\<phi>)\"\n  let ?c = \"(Ness\\<^sub> {x} \\<phi>)\"\n  have \"\\<forall>c d a b. \\<lfloor>a \\<^bold>\\<rightarrow> (b \\<^bold>\\<rightarrow> c)\\<rfloor> \\<longrightarrow> d = c \\<longrightarrow> \\<lfloor>a \\<^bold>\\<rightarrow> (b \\<^bold>\\<rightarrow> d)\\<rfloor>\" by simp\n  hence \"\\<forall> d a b. \\<lfloor>a \\<^bold>\\<rightarrow> (b \\<^bold>\\<rightarrow> ?c)\\<rfloor> \\<longrightarrow> d = ?c \\<longrightarrow> \\<lfloor>a \\<^bold>\\<rightarrow> (b \\<^bold>\\<rightarrow> d)\\<rfloor>\" by (rule allE)\n  hence \"\\<forall>a b. \\<lfloor>a \\<^bold>\\<rightarrow> (b \\<^bold>\\<rightarrow> ?c)\\<rfloor> \\<longrightarrow> ?d = ?c \\<longrightarrow> \\<lfloor>a \\<^bold>\\<rightarrow> (b \\<^bold>\\<rightarrow> ?d)\\<rfloor>\" by (rule allE)\n  hence \"\\<forall>a b. \\<lfloor>a \\<^bold>\\<rightarrow> (b \\<^bold>\\<rightarrow> ?c)\\<rfloor> \\<longrightarrow> \\<lfloor>a \\<^bold>\\<rightarrow> (b \\<^bold>\\<rightarrow> ?d)\\<rfloor>\" using eq by simp\n  hence \"\\<forall>b. \\<lfloor>(\\<^bold>[Ag\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> (b \\<^bold>\\<rightarrow> ?c)\\<rfloor> \\<longrightarrow> \\<lfloor>(\\<^bold>[Ag\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> (b \\<^bold>\\<rightarrow> ?d)\\<rfloor>\" by (rule allE)\n  hence \"\\<lfloor>(\\<^bold>[Ag\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> ((Could\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} (\\<^bold>\\<not>\\<phi>)) \\<^bold>\\<rightarrow> ?c)\\<rfloor> \\<longrightarrow> \\<lfloor>(\\<^bold>[Ag\\<^bold>]\\<phi>) \\<^bold>\\<rightarrow> ((Could\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {x} (\\<^bold>\\<not>\\<phi>)) \\<^bold>\\<rightarrow> ?d)\\<rfloor>\" by (rule allE)\n  thus ?thesis using b by auto\nqed \n\n\nlemma Coresubs: \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> G \\<phi>) \\<longrightarrow> (Core \\<phi> \\<tau>) \\<subseteq> G\" by auto\n\nlemma emptneq: \"a \\<noteq> b \\<longrightarrow> \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {a} \\<phi>) \\<longrightarrow> \\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {b} \\<phi>) \\<longrightarrow> (Core \\<phi> \\<tau>) = {}\"\nproof -\n  {assume asm1: \"a \\<noteq> b\"\n    and asm2: \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {a} \\<phi>)\"\n    and asm3: \"\\<tau> \\<^bold>\\<Turnstile> (\\<^bold>\\<Delta>\\<^sup>m\\<^sup>i\\<^sup>n\\<^sub> {b} \\<phi>)\"\n    hence \"(Core \\<phi> \\<tau>) \\<subseteq> {a} \\<and> (Core \\<phi> \\<tau>) \\<subseteq> {b}\" using Coresubs asm2 asm3 by simp\n    hence \"(Core \\<phi> \\<tau>) = {}\" using asm1 by blast}\n  thus ?thesis by simp\nqed\n\nlemma memin: \"(\\<tau> ~ (G::\\<mu> set) \\<tau>b) \\<longrightarrow> x \\<in> G \\<longrightarrow> \\<tau>b \\<in> (alt\\<^sub> x \\<tau>)\" by blast\n\nlemma inmem: \"(\\<forall>x \\<in> G. \\<tau>b \\<in> (alt\\<^sub> x \\<tau>)) \\<longrightarrow> (\\<tau> ~ (G::\\<mu> set) \\<tau>b)\" using tildeeqU by auto\n\n\nlemma singletonacc: \"(\\<tau> ~ {x} \\<tau>b) \\<longleftrightarrow> ((\\<tau>\\<^bold>~(x::\\<mu>)\\<tau>b))\" \n  using xsub by auto\n\nlemma eqclassalt: \"y \\<in> alt\\<^sub> x (\\<tau>) \\<longrightarrow> ((y::i)\\<^bold>~(x::\\<mu>)(z::i)) \\<longrightarrow> z \\<in> (alt\\<^sub> x (\\<tau>))\"\n  by (metis mem_Collect_eq tildexeq)\n\nlemma eqclassalt2: \"cla \\<in> (\\<^bold>A\\<^sub> x) \\<longrightarrow> y \\<in> cla \\<longrightarrow> ((y::i)\\<^bold>~(x::\\<mu>)(z::i)) \\<longrightarrow> z \\<in> cla\" \n  using eqclassalt by blast\n\nlemma eqclassalt3: \"cla \\<in> (\\<^bold>A\\<^sub> x) \\<longrightarrow> y \\<in> cla \\<longrightarrow> z \\<in> cla \\<longrightarrow> ((y::i)\\<^bold>~(x::\\<mu>)(z::i))\" using mem_Collect_eq tildexeq \n  by (smt (verit, del_insts))\n\nlemma ac: \"action \\<in> (\\<^bold>A\\<^sub> x) \\<longrightarrow> z \\<in> action \\<longrightarrow> y \\<in> action \\<longrightarrow> (z \\<^bold>~x y)\" \n  using eqclassalt3 by blast\nlemma rac: \"action \\<in> (\\<^bold>A\\<^sub> x) \\<longrightarrow> z \\<in> action \\<longrightarrow> (z \\<^bold>~x y) \\<longrightarrow> y \\<in> action\"\n  using eqclassalt by blast\n\nend", "meta": {"author": "lngaisubmission", "repo": "submission", "sha": "bd7cf9be9cd979ba185d8cf575656644805377ab", "save_path": "github-repos/isabelle/lngaisubmission-submission", "path": "github-repos/isabelle/lngaisubmission-submission/submission-bd7cf9be9cd979ba185d8cf575656644805377ab/SergotTheorems.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6224593171945416, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.325807873004633}}
{"text": "theory flash46Bra  imports flash46Rev\n \n  begin\nlemma onInv46:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv46  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv46  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv46 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash46Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.32579058625555624}}
{"text": "theory tp89\nimports Main \"~~/src/HOL/Library/Code_Target_Nat\"\nbegin\n\n(* \nquickcheck_params [size=6,tester=narrowing,timeout=120]\nnitpick_params [timeout=120]\n*)\n\ntype_synonym transid= \"nat*nat*nat\" (*c,m,i*)\n\ndatatype message= \n  Pay transid nat  \n| Ack transid nat\n| Cancel transid\n\ntype_synonym transaction= \"transid * nat\" (* ((c,m,i),am) *)\n\n\n\n(*********MY TYPES OF VARS**********)\n\n(*  messageList\n  list of messages still to be processed.\n*)\ntype_synonym messageList = \"message list\"\n\n(*  vals\n  contain an amount or None\n*)\ntype_synonym vals= \"nat option\"\n\n(*  transidvals\n  contain the transid, the current amount expected to be paid by the client, and the current amount expected to be sold by the marchant, and if the transaction is still possible or not\ntransid * pay_amount * sell_amount * is the transaction not closed nor validated\n*)\ntype_synonym transidvals = \"transid * vals * vals * bool\" (* ((c,m,i),amc,amm,isAvailable) *)\n\n\n(*  transBdd\n  list of transidvals that are still happening and transactions validated\ntransidvals list * transaction validés list\n*)\ntype_synonym transBdd = \"transidvals list * transaction list\" (* ((c,m,i),amc,amm,isAvailable)list * ((c,m,i),am)list *)\n\n\n\n\n\n\n\n(*****************UPDATE TRANSIDVAL LIST******************)\n\n(* updateValsPay\nRETREIVE: vals to update AND nat to affect to it\nRETURN:   vals update if it's allowed\n*)\nfun updateValsPay :: \"vals \\<Rightarrow> nat \\<Rightarrow> vals\"\nwhere\n\"updateValsPay None n = (Some n)\"|\n\"updateValsPay (Some v) n = (if v \\<ge> n then (Some v) else (Some n))\"\n\n\n(* updateValsAck\nRETREIVE: vals to update AND nat to affect to it\nRETURN:   vals update if it's allowed\n*)\nfun updateValsAck :: \"vals \\<Rightarrow> nat \\<Rightarrow> vals\"\nwhere\n\"updateValsAck None n = (Some n)\"|\n\"updateValsAck (Some v) n = (if v \\<le> n then (Some v) else (Some n))\"\n\n\n(* updateTransidvalsPay\nRETREIVE: transidvals to update AND nat to affect to the pay_amount\nRETURN:   transidvals updated with the pay_amount\n*)\nfun updateTransidvalsPay :: \"transidvals \\<Rightarrow> nat \\<Rightarrow> transidvals\"\nwhere\n\"updateTransidvalsPay (transid, pay , ack, test) n = (if test then (transid, (updateValsPay pay n), ack, test) \n                                                              else (transid, pay , ack, test))\"\n\n(* updateTransidvalsAck\nRETREIVE: transidvals to update AND nat to affect to the sell_amount\nRETURN:   transidvals updated with the pay_amount\n*)\nfun updateTransidvalsAck :: \"transidvals \\<Rightarrow> nat \\<Rightarrow> transidvals\"\nwhere\n\"updateTransidvalsAck (transid, pay , ack, test) n = (if test then (transid, pay, (updateValsAck ack n), test) \n                                                              else (transid, pay , ack, test))\"\n\n\n(* updateTransidvalsCancel\nRETREIVE: transidvals to update\nRETURN:   transidvals updated to be cancelled\n*)\nfun updateTransidvalsCancel :: \"transidvals  \\<Rightarrow> transidvals\"\nwhere\n\"updateTransidvalsCancel (transid, pay , ack, test) = (transid, pay, ack, False)\"\n\n\n\n(* updateTransidvalsListPay\nRETREIVE: transid to modify AND nat to affect to the pay_amount AND in transidvals list to update\nRETURN:   transidvlas list updated with the pay_amount\n*)\nfun updateTransidvalsListPay :: \" transidvals list \\<Rightarrow> transid \\<Rightarrow> nat \\<Rightarrow> transidvals list\"\nwhere\n\"updateTransidvalsListPay [] transid n = (transid, (Some n), None, True)#[]\"|\n\"updateTransidvalsListPay ((htransid , hamc, hamm, hisAvailable)#t) transid n =\n        (if htransid = transid\n          then (updateTransidvalsPay (htransid , hamc, hamm, hisAvailable) n)#t\n          else (htransid , hamc, hamm, hisAvailable)#(updateTransidvalsListPay t transid n)\n        )\"\n\n\n(* updateTransidvalsListAck\nRETREIVE: transid to modify AND nat to affect to the sell_amount AND in transidvals list to update\nRETURN:   transivals list updated with the pay_amount\n*)\nfun updateTransidvalsListAck :: \" transidvals list \\<Rightarrow> transid \\<Rightarrow> nat \\<Rightarrow> transidvals list\"\nwhere\n\"updateTransidvalsListAck [] transid n =  (transid, None, (Some n), True)#[]\"|\n\"updateTransidvalsListAck ((htransid , hamc, hamm, hisAvailable)#t) transid n =\n        (if htransid = transid\n          then (updateTransidvalsAck (htransid , hamc, hamm, hisAvailable) n)#t\n          else (htransid , hamc, hamm, hisAvailable)#(updateTransidvalsListAck t transid n)\n        )\"\n\n(* updateTransidvalsListCancel\nRETREIVE: transid to block AND in transBdd to update\nRETURN:   transBdd updated with the pay_amount\n*)\nfun updateTransidvalsListCancel :: \" transidvals list \\<Rightarrow> transid \\<Rightarrow> transidvals list\"\nwhere\n\"updateTransidvalsListCancel [] transid = (transid, None, None, False)#[]\"|\n\"updateTransidvalsListCancel ((htransid , hamc, hamm, hisAvailable)#t) transid =\n        (if htransid = transid\n          then (updateTransidvalsCancel (htransid , hamc, hamm, hisAvailable))#t\n          else (htransid , hamc, hamm, hisAvailable)#(updateTransidvalsListCancel t transid)\n        )\"\n\n\n\n(***********************MAINTAIN TRANSACTION LIST*****************************)\n\n\n\n(*isNotInTransaction\nRETRIEVE:  transid to test AND transaction to search in\nRETURN: bool True if transid not in transaction\n*)\nfun isNotInTransaction :: \"transid \\<Rightarrow> transaction list \\<Rightarrow> bool\"\nwhere\n\"isNotInTransaction transid [] = True\"|\n\"isNotInTransaction transid ((htransid, hn)#ttr) = (if (htransid = transid)\n                                                    then False\n                                                    else (isNotInTransaction transid ttr))\"\n\n(*validable\nRETRIEVE:  transidvals to test if need to be validate\nRETURN: bool\n*)\nfun validable :: \"transidvals \\<Rightarrow> transaction list \\<Rightarrow> bool\"\nwhere\n\"validable (transid, (Some amc), (Some amm), isAvailable) transaction = (isAvailable \\<and> (amc \\<ge> amm) \\<and> (amc\\<noteq>0) \\<and> (isNotInTransaction transid transaction))\"|\n\"validable _ _ = False\"\n\n(*validate\nRETRIEVE:  transidvals to validate AND transaction\nRETURN: transaction updated\n*)\nfun validate :: \"transidvals \\<Rightarrow> transaction list \\<Rightarrow> transaction list\"\nwhere\n\"validate (transid, (Some amc), (Some amm), isAvailable) transaction = (transid, amc)#transaction\"|\n\"validate _ transaction = transaction\"\n\n(*keepheader\nRETRIEVE:  transidvals to keep AND transBdd\nRETURN: transBdd\n*)\nfun keepHeader :: \"transidvals \\<Rightarrow> transBdd \\<Rightarrow> transBdd\"\nwhere\n\"keepHeader keeptrans (transidval, transaction) = ((keeptrans#transidval),transaction)\"\n\n(*keepheaderSnd\nRETRIEVE:  transaction to keep AND transBdd\nRETURN: transBdd\n*)\nfun keepHeaderSnd :: \"transaction \\<Rightarrow> transBdd \\<Rightarrow> transBdd\"\nwhere\n\"keepHeaderSnd keeptrans (transidval, transaction) = (transidval,(keeptrans#transaction))\"\n\n\n(*updateTransaction\nRETRIEVE: current transidvals List AND transactions list to update\nRETURN: proper transBdd\n*)\nfun updateTransaction :: \"transidvals list \\<Rightarrow> transaction list \\<Rightarrow> transBdd\"\nwhere\n\"updateTransaction [] transaction = ([], transaction)\"|\n\"updateTransaction (htransidvals#ttransidvals) transaction = (if (validable htransidvals transaction)\n                                                                 then (updateTransaction ttransidvals (validate htransidvals transaction))\n                                                                 else (keepHeader htransidvals (updateTransaction ttransidvals transaction))\n                                                                )\n\"\n\n(*updateTransactionCancel\nRETRIEVE: transid AND transactions list to update\nRETURN: proper transBdd\n*)\nfun updateTransactionCancel :: \"transid \\<Rightarrow> transidvals list \\<Rightarrow> transaction list \\<Rightarrow> transBdd\"\nwhere\n\"updateTransactionCancel transid transidvals [] = (transidvals, [])\"|\n\"updateTransactionCancel transid transidvals ((htransid,hn)#ttransaction) = (if (htransid = transid)\n                                                                        then (transidvals, ttransaction)\n                                                                        else (keepHeaderSnd (htransid,hn) (updateTransactionCancel transid transidvals ttransaction)))\n\"\n\n\n\n(*updateTransactionBdd\nRETRIEVE: transBdd to update\nRETURN: proper transBdd\n*)\nfun updateTransactionBdd :: \"transBdd \\<Rightarrow> transBdd\"\nwhere\n\"updateTransactionBdd (transidvals, transaction) = (updateTransaction transidvals transaction)\"\n\n(*updateTransactionBddCancel\nRETRIEVE: transBdd to update\nRETURN: proper transBdd\n*)\nfun updateTransactionBddCancel :: \"transid \\<Rightarrow> transBdd \\<Rightarrow> transBdd\"\nwhere\n\"updateTransactionBddCancel transid (transidvals, transaction) = (updateTransactionCancel transid transidvals transaction)\"\n\n\n(*tidValidated\nRETRIEVE: a transid and current validated transaction\nRETURN: if the transid already have been validated\n*)\nfun tidValidated :: \"transid \\<Rightarrow> transaction list \\<Rightarrow> bool\"\nwhere\n\"tidValidated _ [] = False\"|\n\"tidValidated transid ((htransid,hvalue)#ttrans) = (if (transid = htransid) then True else (tidValidated transid ttrans))\"\n\n(**********************FINAL FONCTIONS***************************)\n\n(* traiterMessage\nRETREIVE: message to process AND transBdd\nRETURN:   updated transBdd\n*)\nfun traiterMessage :: \"message \\<Rightarrow> transBdd \\<Rightarrow> transBdd\"\nwhere\n\"traiterMessage (Pay tid n) (transidvalsList, transaction) =(if \\<not>(tidValidated tid transaction) then (updateTransactionBdd ((updateTransidvalsListPay transidvalsList tid n ), transaction) ) else (transidvalsList, transaction))\"|\n\"traiterMessage (Ack tid n) (transidvalsList, transaction) =(if \\<not>(tidValidated tid transaction) then (updateTransactionBdd ((updateTransidvalsListAck transidvalsList tid n ), transaction) ) else (transidvalsList, transaction))\"|\n\"traiterMessage (Cancel tid) (transidvalsList, transaction) =(updateTransactionBddCancel tid ((updateTransidvalsListCancel transidvalsList tid), transaction))\"\n\n\n(* traiterMessageList\nRETREIVE: message list to process AND transBdd\nRETURN:   updated transBdd\n*)\nfun traiterMessageList :: \"message list \\<Rightarrow> transBdd \\<Rightarrow> transBdd\"\nwhere\n\"traiterMessageList [] tBdd = tBdd\"|\n\"traiterMessageList (hmessage#tmessage) tBdd = (traiterMessageList tmessage (traiterMessage hmessage tBdd))\"\n\n(* export\nRETREIVE: transBdd\nRETURN:  transaction list\n*)\nfun export :: \"transBdd \\<Rightarrow> transaction list\"\nwhere\n\"export (tIdV, tr) = tr\"\n\n(****************************TESTING*****************************************)\n\n\n(* ----- Exportation en Scala (Isabelle 2014) -------*)\n\n(* Directive d'exportation *)\nexport_code export traiterMessage in Scala\n\n\n(****************************PROPERTIES**************************************)\n\n(*Lemme 1: member of transaction > 0           *)\nlemma lem1:\"(List.member (export (traiterMessageList messages ([],[]))) (transid, a)) \\<longrightarrow> \\<not>(a\\<le>0)\"\nnitpick [timeout=2000]\nquickcheck [narrowing, timeout=2000, size=9]\nsorry\n\n(*Lemme 2: only one occurence of transid in transaction*)\n\n\n(*lemme 3: even validated transaction can be discard*)\nlemma lem3:\"\\<not>((List.member (export (traiterMessage (Cancel transid) (traiterMessageList messages ([],[])))) (transid,n)))\"\nnitpick [timeout=2000]\nquickcheck [narrowing, timeout=2000, size=9]\nsorry\n\n(*lemme 4: every canceled transaction cannot be validated*)\nlemma lem4:\" (messages = (head@(Cancel transid)#tail)) \\<longrightarrow> \\<not>(List.member (export (traiterMessageList messages ([],[]))) (transid,n))\"\nnitpick [timeout=2000]\nquickcheck [narrowing, timeout=2000, size=9]\nsorry\n\n(*lemme 5: Validation of a transaction mean there was a Pay and Ack message with amc\\<ge>amm and not canceled*)\nlemma lem5:\" ((List.member messages (Pay transid amc))\\<and>(List.member messages (Ack transid amm))\\<and>\\<not>(List.member messages (Cancel transid))\\<and>(amc \\<ge> amm)\\<and>(amc>0))\n               \\<longrightarrow> (List.member (export (traiterMessageList messages ([],[]))) (transid,a)) \\<longrightarrow> (a\\<ge>amm)\"\nnitpick [timeout=2000]\nquickcheck [narrowing, timeout=2000, size=9]\nsorry\n\n(*lemme 6: every validated transaction must be a result of a Pay and Ack message where amc\\<ge>amm*)\nfun getMinAmm :: \"message list \\<Rightarrow> transid  \\<Rightarrow> nat  \\<Rightarrow> nat\"\nwhere\n\"getMinAmm [] transid  n = n\"|\n\"getMinAmm ((Ack tid amm)#tmessage) transid n =(if (transid = tid) \n                                                  then \n                                                     (if amm<n \n                                                       then (getMinAmm tmessage transid amm) \n                                                       else (getMinAmm tmessage transid n)) \n                                                  else (getMinAmm tmessage transid n))\"|\n\"getMinAmm (hmessage#tmessage) transid n = (getMinAmm tmessage transid n)\"\n\nfun getMaxAmc :: \"message list \\<Rightarrow> transid  \\<Rightarrow> nat  \\<Rightarrow> nat\"\nwhere\n\"getMaxAmc [] transid  n = n\"|\n\"getMaxAmc ((Pay tid amm)#tmessage) transid n =(if (transid = tid) \n                                                  then \n                                                     (if amm>n \n                                                       then (getMaxAmc tmessage transid amm) \n                                                       else (getMaxAmc tmessage transid n)) \n                                                  else (getMaxAmc tmessage transid n))\"|\n\"getMaxAmc (hmessage#tmessage) transid n = (getMaxAmc tmessage transid n)\"\n\nfun getMinAmmInit :: \"message list \\<Rightarrow> transid \\<Rightarrow> nat option\"\nwhere\n\"getMinAmmInit [] _ = None\"|\n\"getMinAmmInit ((Ack tid amm)#tmessage) transid =(if (transid = tid) then (Some (getMinAmm tmessage tid amm)) else (getMinAmmInit tmessage transid))\"|\n\"getMinAmmInit (hmessage#tmessage) transid = (getMinAmmInit tmessage transid)\"\n\nfun getMaxAmcInit :: \"message list \\<Rightarrow> transid \\<Rightarrow> nat option\"\nwhere\n\"getMaxAmcInit [] _ = None\"|\n\"getMaxAmcInit ((Pay tid amc)#tmessage) transid =(if (transid = tid) then (Some (getMaxAmc tmessage tid amc)) else (getMaxAmcInit tmessage transid))\"|\n\"getMaxAmcInit (hmessage#tmessage) transid = (getMaxAmcInit tmessage transid)\"\n\n\nlemma lem6:\"( (ammOpt = (getMinAmmInit messages transid)) \\<and> (ammOpt = (Some ammn)) \\<and> (amm = ammn )) \\<longrightarrow>\n              (List.member (export (traiterMessageList messages ([],[]))) (transid,amc)) \n              \\<longrightarrow>((List.member messages (Pay transid amc)) \\<and> (List.member messages (Ack transid amm))) \\<longrightarrow> (amc\\<ge>amm)\"\nnitpick [timeout=2000]\nquickcheck [narrowing, timeout=2000, size=9]\nsorry\n\n(*lemme 7: every new propositions that doesn't fit bargaining logic are forgot: client expectation have to go up and seller goes down*)\n\n(*Client side*)\nlemma lem71:\"((messages = (head@(Pay transid n)#tail)) \\<and> (amcOpt = (getMaxAmcInit messages transid)) \\<and> (amcOpt = (Some amcn)) \\<and> (amc = amcn)  \\<and> (a\\<le>amc) \\<and> (tBdd = (traiterMessageList messages ([],[])) )) \n               \\<longrightarrow> (tBdd = (traiterMessage (Pay transid a) tBdd))\"\nnitpick [timeout=2000]\nquickcheck [narrowing, timeout=2000, size=9]\nsorry\n\n(*Marchant side*)\nlemma lem72:\"((messages = (head@(Ack transid n)#tail)) \\<and> (ammOpt = (getMinAmmInit messages transid)) \\<and> (ammOpt = (Some ammn)) \\<and> (amm = ammn) \\<and> (a\\<ge>amm) \\<and> (tBdd = (traiterMessageList messages ([],[])) )) \n               \\<longrightarrow> (tBdd = (traiterMessage (Ack transid a) tBdd))\"\nnitpick [timeout=2000]\nquickcheck [narrowing, timeout=2000, size=9]\nsorry\n\n(*lemme 8: every validated transaction cannot be renegociated. The price am doesn't change*)\nlemma lem8:\"(List.member (export (traiterMessageList messages ([],[]))) (transid,n))\n            \\<longrightarrow> (\\<not>(List.member addMess (Cancel transid))) \\<longrightarrow> (List.member (export (traiterMessageList (messages@addMess) ([],[]))) (transid,n)) \"\nnitpick [timeout=2000]\nquickcheck [narrowing, timeout=2000, size=9]\nsorry\n\n(*lemme 9: the amount in validated transaction is equal to the price proposed by the client*)\nlemma lem9:\"(List.member (export (traiterMessageList messages ([],[]))) (transid,n)) \\<longrightarrow> ((Some n) = (getMaxAmcInit messages transid))\"\nnitpick [timeout=2000]\nquickcheck [narrowing, timeout=2000, size=9]\nsorry\n\nend\n\n", "meta": {"author": "PosnicAntoine", "repo": "ACF_Master1_S1", "sha": "9f37344aab4cf1c4383ba59b0aca6e3bc04219c8", "save_path": "github-repos/isabelle/PosnicAntoine-ACF_Master1_S1", "path": "github-repos/isabelle/PosnicAntoine-ACF_Master1_S1/ACF_Master1_S1-9f37344aab4cf1c4383ba59b0aca6e3bc04219c8/TP/TP89/tp89.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499941, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.32579058625555624}}
{"text": "theory TeslDenotationalArchiWrong\n\nimports TeslDenotationalArchi\n\nbegin\n\n(*\n  FIXME:  no link between timep and index in clocks\n          so no way to prove that (index c) < rank r\\<^sub>1 implies\n          that the time of c is in the first component of the time structure.\n*)\nlemma clock_proj\\<^sub>1:\n  assumes \"ticks c (hamlet (r\\<^sub>1 \\<times>\\<^sub>r\\<^sub>u\\<^sub>n r\\<^sub>2) n)\"\n  and     \"(index c) < rank r\\<^sub>1\"\n  shows   \"\\<exists>c\\<^sub>0. c = shift\\<^sub>1 c\\<^sub>0 r\\<^sub>1\"\nproof -\n  from assms have \"\\<exists>f. c = (f \\<circ> fst, index c)\" sorry\n  from this obtain f where \"c = (f \\<circ> fst, index c)\" by blast\n  hence \"c = shift\\<^sub>1 (f, index c) r\\<^sub>1\" unfolding shift\\<^sub>1_def by auto\n  thus ?thesis by blast\nqed\n\nlemma clock_proj\\<^sub>2:\n  assumes \"ticks c (hamlet (r\\<^sub>1 \\<times>\\<^sub>r\\<^sub>u\\<^sub>n r\\<^sub>2) n)\"\n  and     \"(index c) \\<ge> rank r\\<^sub>1\"\n  shows   \"\\<exists>c\\<^sub>0. c = shift\\<^sub>2 c\\<^sub>0 r\\<^sub>1\"\nproof -\n  from assms(2) have \"\\<exists>i\\<^sub>0. (index c) = i\\<^sub>0 + rank r\\<^sub>1\" by presburger\n  from this obtain i\\<^sub>0 where i0prop:\"(index c) = i\\<^sub>0 + rank r\\<^sub>1\" by blast\n  from assms have \"\\<exists>f. c = (f \\<circ> snd, index c)\" sorry\n  from this obtain f where \"c = (f \\<circ> snd, index c)\" by blast\n  with i0prop have \"c = shift\\<^sub>2 (f, i\\<^sub>0) r\\<^sub>1\" unfolding shift\\<^sub>2_def by auto\n  thus ?thesis by blast\nqed\n\nlemma \n  assumes \"ticks (c::('a::orderedrank \\<times> 'b::orderedrank, 'c)\\<H>) (hamlet ((r\\<^sub>1::'a run) \\<times>\\<^sub>r\\<^sub>u\\<^sub>n (r\\<^sub>2::'b run)) n)\"\n  and     \"index c < rank r\\<^sub>1\"\n  shows   \"\\<exists>sc. c = shift\\<^sub>1 sc r\\<^sub>1 \\<and> ticks sc (hamlet r\\<^sub>1 n)\"\nproof -\n  from assms have \"(hamlet (r\\<^sub>1 \\<times>\\<^sub>r\\<^sub>u\\<^sub>n r\\<^sub>2) n)!(index c)\" unfolding ticks_def by metis\n  hence \"((hamlet r\\<^sub>1 n)@(hamlet r\\<^sub>2 n))!(index c)\" by (simp add: hamlet_prod_hamlet)\n  with assms(2) have *:\"(hamlet r\\<^sub>1 n)!(index c)\" by (simp add: nth_append rank_any_hamlet)\n  from clock_proj\\<^sub>1[OF assms] obtain sc where scprop:\"c = shift\\<^sub>1 sc r\\<^sub>1\" by blast\n  with * have \"(hamlet r\\<^sub>1 n)!(index sc)\" unfolding shift\\<^sub>1_def by simp\n  moreover from assms(2) have \"index sc < rank r\\<^sub>1\" by (simp add: scprop shift\\<^sub>1_def)\n  ultimately have \"ticks sc (hamlet r\\<^sub>1 n)\" unfolding ticks_def by (simp add: rank_any_hamlet)\n  with scprop show ?thesis by blast\nqed\n\nlemma \n  assumes \"ticks (c::('a::orderedrank \\<times> 'b::orderedrank, 'c)\\<H>) (hamlet ((r\\<^sub>1::'a run) \\<times>\\<^sub>r\\<^sub>u\\<^sub>n (r\\<^sub>2::'b run)) n)\"\n  and     \"index c \\<ge> rank r\\<^sub>1\"\n  shows   \"\\<exists>sc. c = shift\\<^sub>2 sc r\\<^sub>1 \\<and> ticks sc (hamlet r\\<^sub>2 n)\"\nproof -\n  from assms have \"index c < length (hamlet (r\\<^sub>1 \\<times>\\<^sub>r\\<^sub>u\\<^sub>n r\\<^sub>2) n) \\<and> (hamlet (r\\<^sub>1 \\<times>\\<^sub>r\\<^sub>u\\<^sub>n r\\<^sub>2) n)!(index c)\"\n    unfolding ticks_def by metis\n  hence \"index c < rank r\\<^sub>1 + rank r\\<^sub>2 \\<and> ((hamlet r\\<^sub>1 n)@(hamlet r\\<^sub>2 n))!(index c)\"\n    by (simp add: hamlet_prod_hamlet rank_any_hamlet)\n  with assms(2) have *:\"(index c - rank r\\<^sub>1) < rank r\\<^sub>2 \\<and> (hamlet r\\<^sub>2 n)!(index c - rank r\\<^sub>1)\"\n    by (auto simp add: nth_append rank_any_hamlet)\n  from clock_proj\\<^sub>2[OF assms] obtain sc where scprop:\"c = shift\\<^sub>2 sc r\\<^sub>1\" by blast\n  with * have \"index sc < rank r\\<^sub>2 \\<and> (hamlet r\\<^sub>2 n)!(index sc)\" unfolding shift\\<^sub>2_def by simp\n  hence \"ticks sc (hamlet r\\<^sub>2 n)\" unfolding ticks_def by (simp add: rank_any_hamlet)\n  with scprop show ?thesis by blast\nqed\n\nend\n", "meta": {"author": "Frederic-Boulanger-UPS", "repo": "TESL_Denotational5", "sha": "050f44752b5354c4ec0e946df7bde910174be80c", "save_path": "github-repos/isabelle/Frederic-Boulanger-UPS-TESL_Denotational5", "path": "github-repos/isabelle/Frederic-Boulanger-UPS-TESL_Denotational5/TESL_Denotational5-050f44752b5354c4ec0e946df7bde910174be80c/src/Failures/TeslDenotationalArchiWrong.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.4921881357207955, "lm_q1q2_score": 0.32579058625555624}}
{"text": "theory Semantics\nimports Main Firewall_Common \"Common/List_Misc\" \"~~/src/HOL/Library/LaTeXsugar\"\nbegin\n\nsection\\<open>Big Step Semantics\\<close>\n\n\ntext\\<open>\nThe assumption we apply in general is that the firewall does not alter any packets.\n\\<close>\n\ntext\\<open>A firewall ruleset is a map of chain names\n  (e.g., INPUT, OUTPUT, FORWARD, arbitrary-user-defined-chain) to a list of rules.\n  The list of rules is processed sequentially.\\<close>\ntype_synonym 'a ruleset = \"string \\<rightharpoonup> 'a rule list\"\n\ntext\\<open>A matcher (parameterized by the type of primitive @{typ 'a} and packet @{typ 'p})\n     is a function which just tells whether a given primitive and packet matches.\\<close>\ntype_synonym ('a, 'p) matcher = \"'a \\<Rightarrow> 'p \\<Rightarrow> bool\"\n\ntext\\<open>Example: Assume a network packet only has a destination street number\n    (for simplicity, of type @{typ \"nat\"}) and we only support the following match expression:\n    Is the packet's street number within a certain range?\n    The type for the primitive could then be @{typ \"nat \\<times> nat\"} and a possible implementation\n    for @{typ \"(nat \\<times> nat, nat) matcher\"} could be\n    @{term \"match_street_number (a,b) p \\<longleftrightarrow> p \\<in> {a .. b}\"}.\n    Usually, the primitives are a datatype which supports interfaces, IP addresses, protocols,\n    ports, payload, ...\\<close>\n\n\ntext\\<open>Given an @{typ \"('a, 'p) matcher\"} and a match expression, does a packet of type @{typ 'p}\n     match the match expression?\\<close>\nfun matches :: \"('a, 'p) matcher \\<Rightarrow> 'a match_expr \\<Rightarrow> 'p \\<Rightarrow> bool\" where\n\"matches \\<gamma> (MatchAnd e1 e2) p \\<longleftrightarrow> matches \\<gamma> e1 p \\<and> matches \\<gamma> e2 p\" |\n\"matches \\<gamma> (MatchNot me) p \\<longleftrightarrow> \\<not> matches \\<gamma> me p\" |\n\"matches \\<gamma> (Match e) p \\<longleftrightarrow> \\<gamma> e p\" |\n\"matches _ MatchAny _ \\<longleftrightarrow> True\"\n\n\n(*Note: \"matches \\<gamma> (MatchNot me) p \\<longleftrightarrow> \\<not> matches \\<gamma> me p\" does not work for ternary logic.\n  Here, we have Boolean logic and everything is fine.*)\n\n\ninductive iptables_bigstep :: \"'a ruleset \\<Rightarrow> ('a, 'p) matcher \\<Rightarrow> 'p \\<Rightarrow> 'a rule list \\<Rightarrow> state \\<Rightarrow> state \\<Rightarrow> bool\"\n  (\"_,_,_\\<turnstile> \\<langle>_, _\\<rangle> \\<Rightarrow> _\"  [60,60,60,20,98,98] 89)\n  for \\<Gamma> and \\<gamma> and p where\nskip:    \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[], t\\<rangle> \\<Rightarrow> t\" |\naccept:  \"matches \\<gamma> m p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Accept], Undecided\\<rangle> \\<Rightarrow> Decision FinalAllow\" |\ndrop:    \"matches \\<gamma> m p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Drop], Undecided\\<rangle> \\<Rightarrow> Decision FinalDeny\" |\nreject:  \"matches \\<gamma> m p \\<Longrightarrow>  \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Reject], Undecided\\<rangle> \\<Rightarrow> Decision FinalDeny\" |\nlog:     \"matches \\<gamma> m p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Log], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\n(*empty does not do anything to the packet. It could update the internal firewall state, e.g. marking a packet for later-on rate limiting*)\nempty:   \"matches \\<gamma> m p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Empty], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\nnomatch: \"\\<not> matches \\<gamma> m p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\ndecision: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Decision X\\<rangle> \\<Rightarrow> Decision X\" |\nseq:      \"\\<lbrakk>\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> t; \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, t\\<rangle> \\<Rightarrow> t'\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1@rs\\<^sub>2, Undecided\\<rangle> \\<Rightarrow> t'\" |\ncall_return:  \"\\<lbrakk> matches \\<gamma> m p; \\<Gamma> chain = Some (rs\\<^sub>1@[Rule m' Return]@rs\\<^sub>2);\n                 matches \\<gamma> m' p; \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> Undecided \\<rbrakk> \\<Longrightarrow>\n               \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call chain)], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\ncall_result:  \"\\<lbrakk> matches \\<gamma> m p; \\<Gamma> chain = Some rs; \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Undecided\\<rangle> \\<Rightarrow> t \\<rbrakk> \\<Longrightarrow>\n               \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call chain)], Undecided\\<rangle> \\<Rightarrow> t\"\n\ntext\\<open>\nThe semantic rules again in pretty format:\n\\begin{center}\n@{thm[mode=Axiom] skip [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] accept [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] drop [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] reject [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] log [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] empty [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] nomatch [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] decision [no_vars]}\\\\[1ex]\n@{thm[mode=Rule] seq [no_vars]} \\\\[1ex]\n@{thm[mode=Rule] call_return [no_vars]}\\\\[1ex] \n@{thm[mode=Rule] call_result [no_vars]}\n\\end{center}\n\\<close>\n\n\n(*future work:\n  Add abstraction function for unknown actions. At the moment, only the explicitly listed actions are supported.\n  This would also require a @{text \"Decision FinalUnknown\"} state\n  Problem: An unknown action may modify a packet.\n  Assume that we have a firewall which accepts the packets A->B and rewrites the header to A->C.\n  After that firewall, there is another firewall which only accepts packets for A->C.\n  A can send through both firewalls.\n  \n  If our model says that the firewall accepts packets A->B but does not consider packet modification,\n  A might not be able to pass the second firewall with this model.\n  \n  Luckily, our model is correct for the filtering behaviour and explicitly does not support any actions with packet modification.\n  Thus, the described scenario is not a counterexample that our model is wrong but a hint for future features\n  we may want to support. Luckily, we introduced the @{term \"Decision state\"}, which should make adding packet modification states easy.\n*)\n\nlemma deny:\n  \"matches \\<gamma> m p \\<Longrightarrow> a = Drop \\<or> a = Reject \\<Longrightarrow> iptables_bigstep \\<Gamma> \\<gamma> p [Rule m a] Undecided (Decision FinalDeny)\"\nby (auto intro: drop reject)\n\nlemma seq_cons:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r],Undecided\\<rangle> \\<Rightarrow> t\" and \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,t\\<rangle> \\<Rightarrow> t'\"\n  shows \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs, Undecided\\<rangle> \\<Rightarrow> t'\"\nproof -\n  from assms have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r] @ rs, Undecided\\<rangle> \\<Rightarrow> t'\" by (rule seq)\n  thus ?thesis by simp\nqed\n\nlemma iptables_bigstep_induct\n  [case_names Skip Allow Deny Log Nomatch Decision Seq Call_return Call_result,\n   induct pred: iptables_bigstep]:\n  \"\\<lbrakk> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,s\\<rangle> \\<Rightarrow> t;\n     \\<And>t. P [] t t;\n     \\<And>m a. matches \\<gamma> m p \\<Longrightarrow> a = Accept \\<Longrightarrow> P [Rule m a] Undecided (Decision FinalAllow);\n     \\<And>m a. matches \\<gamma> m p \\<Longrightarrow> a = Drop \\<or> a = Reject \\<Longrightarrow> P [Rule m a] Undecided (Decision FinalDeny);\n     \\<And>m a. matches \\<gamma> m p \\<Longrightarrow> a = Log \\<or> a = Empty \\<Longrightarrow> P [Rule m a] Undecided Undecided;\n     \\<And>m a. \\<not> matches \\<gamma> m p \\<Longrightarrow> P [Rule m a] Undecided Undecided;\n     \\<And>rs X. P rs (Decision X) (Decision X);\n     \\<And>rs rs\\<^sub>1 rs\\<^sub>2 t t'. rs = rs\\<^sub>1 @ rs\\<^sub>2 \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> P rs\\<^sub>1 Undecided t \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t\\<rangle> \\<Rightarrow> t' \\<Longrightarrow> P rs\\<^sub>2 t t' \\<Longrightarrow> P rs Undecided t';\n     \\<And>m a chain rs\\<^sub>1 m' rs\\<^sub>2. matches \\<gamma> m p \\<Longrightarrow> a = Call chain \\<Longrightarrow> \\<Gamma> chain = Some (rs\\<^sub>1 @ [Rule m' Return] @ rs\\<^sub>2) \\<Longrightarrow> matches \\<gamma> m' p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,Undecided\\<rangle> \\<Rightarrow> Undecided \\<Longrightarrow> P rs\\<^sub>1 Undecided Undecided \\<Longrightarrow> P [Rule m a] Undecided Undecided;\n     \\<And>m a chain rs t. matches \\<gamma> m p \\<Longrightarrow> a = Call chain \\<Longrightarrow> \\<Gamma> chain = Some rs \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> P rs Undecided t \\<Longrightarrow> P [Rule m a] Undecided t \\<rbrakk> \\<Longrightarrow>\n   P rs s t\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma skipD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [] \\<Longrightarrow> s = t\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma decisionD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> s = Decision X \\<Longrightarrow> t = Decision X\"\nby (induction rule: iptables_bigstep_induct) auto\n\ncontext\n  notes skipD[dest] list_app_singletonE[elim]\nbegin\n\nlemma acceptD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [Rule m Accept] \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> s = Undecided \\<Longrightarrow> t = Decision FinalAllow\"\nby (induction rule: iptables_bigstep.induct) auto\n\n\n\nlemma rejectD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [Rule m Reject] \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> s = Undecided \\<Longrightarrow> t = Decision FinalDeny\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma logD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [Rule m Log] \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> s = Undecided \\<Longrightarrow> t = Undecided\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma emptyD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [Rule m Empty] \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> s = Undecided \\<Longrightarrow> t = Undecided\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma nomatchD: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = [Rule m a] \\<Longrightarrow> s = Undecided \\<Longrightarrow> \\<not> matches \\<gamma> m p \\<Longrightarrow> t = Undecided\"\nby (induction rule: iptables_bigstep.induct) auto\n\nlemma callD:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r, s\\<rangle> \\<Rightarrow> t\" \"r = [Rule m (Call chain)]\" \"s = Undecided\" \"matches \\<gamma> m p\" \"\\<Gamma> chain = Some rs\"\n  obtains \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,s\\<rangle> \\<Rightarrow> t\"\n        | rs\\<^sub>1 rs\\<^sub>2 m' where \"rs = rs\\<^sub>1 @ Rule m' Return # rs\\<^sub>2\" \"matches \\<gamma> m' p\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,s\\<rangle> \\<Rightarrow> Undecided\" \"t = Undecided\"\n  using assms\n  proof (induction r s t arbitrary: rs rule: iptables_bigstep.induct)\n    case (seq rs\\<^sub>1)\n    thus ?case by (cases rs\\<^sub>1) auto\n  qed auto\n\nend\n\nlemmas iptables_bigstepD = skipD acceptD dropD rejectD logD emptyD nomatchD decisionD callD\n\nlemma seq':\n  assumes \"rs = rs\\<^sub>1 @ rs\\<^sub>2\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,s\\<rangle> \\<Rightarrow> t\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t\\<rangle> \\<Rightarrow> t'\"\n  shows \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,s\\<rangle> \\<Rightarrow> t'\"\nusing assms by (cases s) (auto intro: seq decision dest: decisionD)\n\nlemma seq'_cons: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r],s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,t\\<rangle> \\<Rightarrow> t' \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs, s\\<rangle> \\<Rightarrow> t'\"\nby (metis decision decisionD state.exhaust seq_cons)\n\nlemma seq_split:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\" \"rs = rs\\<^sub>1@rs\\<^sub>2\"\n  obtains t' where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,s\\<rangle> \\<Rightarrow> t'\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t'\\<rangle> \\<Rightarrow> t\"\n  using assms\n  proof (induction rs s t arbitrary: rs\\<^sub>1 rs\\<^sub>2 thesis rule: iptables_bigstep_induct)\n    case Allow thus ?case by (cases rs\\<^sub>1) (auto intro: iptables_bigstep.intros)\n  next\n    case Deny thus ?case by (cases rs\\<^sub>1) (auto intro: iptables_bigstep.intros)\n  next\n    case Log thus ?case by (cases rs\\<^sub>1) (auto intro: iptables_bigstep.intros)\n  next\n    case Nomatch thus ?case by (cases rs\\<^sub>1) (auto intro: iptables_bigstep.intros)\n  next\n    case (Seq rs rsa rsb t t')\n    hence rs: \"rsa @ rsb = rs\\<^sub>1 @ rs\\<^sub>2\" by simp\n    note List.append_eq_append_conv_if[simp]\n    from rs show ?case\n      proof (cases rule: list_app_eq_cases)\n        case longer\n        with Seq have t1: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>take (length rsa) rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> t\"\n          by simp\n        from Seq longer obtain t2\n          where t2a: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>drop (length rsa) rs\\<^sub>1,t\\<rangle> \\<Rightarrow> t2\"\n            and rs2_t2: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t2\\<rangle> \\<Rightarrow> t'\"\n          by blast\n        with t1 rs2_t2 have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>take (length rsa) rs\\<^sub>1 @ drop (length rsa) rs\\<^sub>1,Undecided\\<rangle> \\<Rightarrow> t2\"\n          by (blast intro: iptables_bigstep.seq)\n        with Seq rs2_t2 show ?thesis\n          by simp\n      next\n        case shorter\n        with rs have rsa': \"rsa = rs\\<^sub>1 @ take (length rsa - length rs\\<^sub>1) rs\\<^sub>2\"\n          by (metis append_eq_conv_conj length_drop)\n        from shorter rs have rsb': \"rsb = drop (length rsa - length rs\\<^sub>1) rs\\<^sub>2\"\n          by (metis append_eq_conv_conj length_drop)\n        from Seq rsa' obtain t1\n          where t1a: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,Undecided\\<rangle> \\<Rightarrow> t1\"\n            and t1b: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>take (length rsa - length rs\\<^sub>1) rs\\<^sub>2,t1\\<rangle> \\<Rightarrow> t\"\n          by blast\n        from rsb' Seq.hyps have t2: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>drop (length rsa - length rs\\<^sub>1) rs\\<^sub>2,t\\<rangle> \\<Rightarrow> t'\"\n          by blast\n        with seq' t1b have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t1\\<rangle> \\<Rightarrow> t'\"\n          by fastforce\n        with Seq t1a show ?thesis\n          by fast\n      qed\n  next\n    case Call_return\n    hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> Undecided\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, Undecided\\<rangle> \\<Rightarrow> Undecided\"\n      by (case_tac [!] rs\\<^sub>1) (auto intro: iptables_bigstep.skip iptables_bigstep.call_return)\n    thus ?case by fact\n  next\n    case (Call_result _ _ _ _ t)\n    show ?case\n      proof (cases rs\\<^sub>1)\n        case Nil\n        with Call_result have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> Undecided\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, Undecided\\<rangle> \\<Rightarrow> t\"\n          by (auto intro: iptables_bigstep.intros)\n        thus ?thesis by fact\n      next\n        case Cons\n        with Call_result have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> t\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, t\\<rangle> \\<Rightarrow> t\"\n          by (auto intro: iptables_bigstep.intros)\n        thus ?thesis by fact\n      qed\n  qed (auto intro: iptables_bigstep.intros)\n\nlemma seqE:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1@rs\\<^sub>2, s\\<rangle> \\<Rightarrow> t\"\n  obtains ti where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1,s\\<rangle> \\<Rightarrow> ti\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,ti\\<rangle> \\<Rightarrow> t\"\n  using assms by (force elim: seq_split)\n\nlemma seqE_cons:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs, s\\<rangle> \\<Rightarrow> t\"\n  obtains ti where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r],s\\<rangle> \\<Rightarrow> ti\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs,ti\\<rangle> \\<Rightarrow> t\"\n  using assms by (metis append_Cons append_Nil seqE)\n\nlemma nomatch':\n  assumes \"\\<And>r. r \\<in> set rs \\<Longrightarrow> \\<not> matches \\<gamma> (get_match r) p\"\n  shows \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> s\"\n  proof(cases s)\n    case Undecided\n    have \"\\<forall>r\\<in>set rs. \\<not> matches \\<gamma> (get_match r) p \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Undecided\\<rangle> \\<Rightarrow> Undecided\"\n      proof(induction rs)\n        case Nil\n        thus ?case by (fast intro: skip)\n      next\n        case (Cons r rs)\n        hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r], Undecided\\<rangle> \\<Rightarrow> Undecided\"\n          by (cases r) (auto intro: nomatch)\n        with Cons show ?case\n          by (fastforce intro: seq_cons)\n      qed\n    with assms Undecided show ?thesis by simp\n  qed (blast intro: decision)\n\n\ntext\\<open>there are only two cases when there can be a Return on top-level:\n\n  \\<^item> the firewall is in a Decision state\n  \\<^item> the return does not match\n\nIn both cases, it is not applied!\n\\<close>\nlemma no_free_return: assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Return], Undecided\\<rangle> \\<Rightarrow> t\" and \"matches \\<gamma> m p\" shows \"False\"\n  proof -\n  { fix a s\n    have no_free_return_hlp: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>a,s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow>  s = Undecided \\<Longrightarrow> a = [Rule m Return] \\<Longrightarrow> False\"\n    proof (induction rule: iptables_bigstep.induct)\n      case (seq rs\\<^sub>1)\n      thus ?case\n        by (cases rs\\<^sub>1) (auto dest: skipD)\n    qed simp_all\n  } with assms show ?thesis by blast\n  qed\n\n\n(* seq_split is elim, seq_progress is dest *)\nlemma seq_progress: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t \\<Longrightarrow> rs = rs\\<^sub>1@rs\\<^sub>2 \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, s\\<rangle> \\<Rightarrow> t' \\<Longrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, t'\\<rangle> \\<Rightarrow> t\"\n  proof(induction arbitrary: rs\\<^sub>1 rs\\<^sub>2 t' rule: iptables_bigstep_induct)\n    case Allow\n    thus ?case\n      by (cases \"rs\\<^sub>1\") (auto intro: iptables_bigstep.intros dest: iptables_bigstepD)\n  next\n    case Deny\n    thus ?case\n      by (cases \"rs\\<^sub>1\") (auto intro: iptables_bigstep.intros dest: iptables_bigstepD)\n  next\n    case Log\n    thus ?case\n      by (cases \"rs\\<^sub>1\") (auto intro: iptables_bigstep.intros dest: iptables_bigstepD)\n  next\n    case Nomatch\n    thus ?case\n      by (cases \"rs\\<^sub>1\") (auto intro: iptables_bigstep.intros dest: iptables_bigstepD)\n  next\n    case Decision\n    thus ?case\n      by (cases \"rs\\<^sub>1\") (auto intro: iptables_bigstep.intros dest: iptables_bigstepD)\n  next\n    case(Seq rs rsa rsb t t' rs\\<^sub>1 rs\\<^sub>2 t'')\n    hence rs: \"rsa @ rsb = rs\\<^sub>1 @ rs\\<^sub>2\" by simp\n    note List.append_eq_append_conv_if[simp]\n    (* TODO larsrh custom case distinction rule *)\n\n    from rs show \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2,t''\\<rangle> \\<Rightarrow> t'\"\n      proof(cases rule: list_app_eq_cases)\n        case longer\n        have \"rs\\<^sub>1 = take (length rsa) rs\\<^sub>1 @ drop (length rsa) rs\\<^sub>1\"\n          by auto\n        with Seq longer show ?thesis\n          by (metis append_Nil2 skipD seq_split)\n      next\n        case shorter\n        with Seq(7) Seq.hyps(3) Seq.IH(1) rs show ?thesis\n          by (metis seq' append_eq_conv_conj)\n      qed\n  next\n    case(Call_return m a chain rsa m' rsb)\n    have xx: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call chain)], Undecided\\<rangle> \\<Rightarrow> t' \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow>\n          \\<Gamma> chain = Some (rsa @ Rule m' Return # rsb) \\<Longrightarrow>\n          matches \\<gamma> m' p \\<Longrightarrow>\n          \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rsa, Undecided\\<rangle> \\<Rightarrow> Undecided \\<Longrightarrow>\n          t' = Undecided\"\n      apply(erule callD)\n           apply(simp_all)\n      apply(erule seqE)\n      apply(erule seqE_cons)\n      by (metis Call_return.IH no_free_return self_append_conv skipD)\n\n    show ?case\n      proof (cases rs\\<^sub>1)\n        case (Cons r rs)\n        thus ?thesis\n          using Call_return\n          apply(case_tac \"[Rule m a] = rs\\<^sub>2\")\n           apply(simp)\n          apply(simp)\n          using xx by blast\n      next\n        case Nil\n        moreover hence \"t' = Undecided\"\n          by (metis Call_return.hyps(1) Call_return.prems(2) append.simps(1) decision no_free_return seq state.exhaust)\n        moreover have \"\\<And>m. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Undecided\"\n          by (metis (no_types) Call_return(2) Call_return.hyps(3) Call_return.hyps(4) Call_return.hyps(5) call_return nomatch)\n        ultimately show ?thesis\n          using Call_return.prems(1) by auto\n      qed\n  next\n    case(Call_result m a chain rs t)\n    thus ?case\n      proof (cases rs\\<^sub>1)\n        case Cons\n        thus ?thesis\n          using Call_result\n          apply(auto simp add: iptables_bigstep.skip iptables_bigstep.call_result dest: skipD)\n          apply(drule callD, simp_all)\n           apply blast\n          by (metis Cons_eq_appendI append_self_conv2 no_free_return seq_split)\n      qed (fastforce intro: iptables_bigstep.intros dest: skipD)\n  qed (auto dest: iptables_bigstepD)\n\n\ntheorem iptables_bigstep_deterministic: assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\" and \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t'\" shows \"t = t'\"\nproof -\n  { fix r1 r2 m t\n    assume a1: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r1 @ Rule m Return # r2, Undecided\\<rangle> \\<Rightarrow> t\" and a2: \"matches \\<gamma> m p\" and a3: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r1,Undecided\\<rangle> \\<Rightarrow> Undecided\"\n    have False\n    proof -\n      from a1 a3 have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m Return # r2, Undecided\\<rangle> \\<Rightarrow> t\"\n        by (blast intro: seq_progress)\n      hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Return] @ r2, Undecided\\<rangle> \\<Rightarrow> t\"\n        by simp\n      from seqE[OF this] obtain ti where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Return], Undecided\\<rangle> \\<Rightarrow> ti\" by blast\n      with no_free_return a2 show False by fast (*by (blast intro: no_free_return elim: seq_split)*)\n    qed\n  } note no_free_return_seq=this\n  \n  from assms show ?thesis\n  proof (induction arbitrary: t' rule: iptables_bigstep_induct)\n    case Seq\n    thus ?case\n      by (metis seq_progress)\n  next\n    case Call_result\n    thus ?case\n      by (metis no_free_return_seq callD)\n  next\n    case Call_return\n    thus ?case\n      by (metis append_Cons callD no_free_return_seq)\n  qed (auto dest: iptables_bigstepD)\nqed\n\nlemma iptables_bigstep_to_undecided: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> Undecided \\<Longrightarrow> s = Undecided\"\n  by (metis decisionD state.exhaust)\n\nlemma iptables_bigstep_to_decision: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Decision Y\\<rangle> \\<Rightarrow> Decision X \\<Longrightarrow> Y = X\"\n  by (metis decisionD state.inject)\n\nlemma Rule_UndecidedE:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Undecided\"\n  obtains (nomatch) \"\\<not> matches \\<gamma> m p\"\n        | (log) \"a = Log \\<or> a = Empty\"\n        | (call) c where \"a = Call c\" \"matches \\<gamma> m p\"\n  using assms\n  proof (induction \"[Rule m a]\" Undecided Undecided rule: iptables_bigstep_induct)\n    case Seq\n    thus ?case\n      by (metis append_eq_Cons_conv append_is_Nil_conv iptables_bigstep_to_undecided)\n  qed simp_all\n\nlemma Rule_DecisionE:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Decision X\"\n  obtains (call) chain where \"matches \\<gamma> m p\" \"a = Call chain\"\n        | (accept_reject) \"matches \\<gamma> m p\" \"X = FinalAllow \\<Longrightarrow> a = Accept\" \"X = FinalDeny \\<Longrightarrow> a = Drop \\<or> a = Reject\"\n  using assms\n  proof (induction \"[Rule m a]\" Undecided \"Decision X\" rule: iptables_bigstep_induct)\n    case (Seq rs\\<^sub>1)\n    thus ?case\n      by (cases rs\\<^sub>1) (auto dest: skipD)\n  qed simp_all\n\n\nlemma log_remove:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1 @ [Rule m Log] @ rs\\<^sub>2, s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1 @ rs\\<^sub>2, s\\<rangle> \\<Rightarrow> t\"\n  proof -\n    from assms obtain t' where t': \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, s\\<rangle> \\<Rightarrow> t'\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Log] @ rs\\<^sub>2, t'\\<rangle> \\<Rightarrow> t\"\n      by (blast elim: seqE)\n    hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m Log # rs\\<^sub>2, t'\\<rangle> \\<Rightarrow> t\"\n      by simp\n    then obtain t'' where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Log], t'\\<rangle> \\<Rightarrow> t''\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, t''\\<rangle> \\<Rightarrow> t\"\n      by (blast elim: seqE_cons)\n    with t' show ?thesis\n      by (metis state.exhaust iptables_bigstep_deterministic decision log nomatch seq)\n  qed\nlemma empty_empty:\n  assumes \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1 @ [Rule m Empty] @ rs\\<^sub>2, s\\<rangle> \\<Rightarrow> t\"\n  shows \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1 @ rs\\<^sub>2, s\\<rangle> \\<Rightarrow> t\"\n  proof -\n    from assms obtain t' where t': \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>1, s\\<rangle> \\<Rightarrow> t'\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Empty] @ rs\\<^sub>2, t'\\<rangle> \\<Rightarrow> t\"\n      by (blast elim: seqE)\n    hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m Empty # rs\\<^sub>2, t'\\<rangle> \\<Rightarrow> t\"\n      by simp\n    then obtain t'' where \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Empty], t'\\<rangle> \\<Rightarrow> t''\" \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs\\<^sub>2, t''\\<rangle> \\<Rightarrow> t\"\n      by (blast elim: seqE_cons)\n    with t' show ?thesis\n      by (metis state.exhaust iptables_bigstep_deterministic decision empty nomatch seq)\n  qed\n\n\n\nlemma Unknown_actions_False: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r # rs, Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = Rule m a \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> a = Unknown \\<or> (\\<exists>chain. a = Goto chain) \\<Longrightarrow> False\"\nproof -\n  have 1: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Unknown], Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> False\"\n  by (induction \"[Rule m Unknown]\" Undecided t rule: iptables_bigstep.induct)\n     (auto elim: list_app_singletonE dest: skipD)\n  \n  { fix chain\n    have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Goto chain)], Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> False\"\n    by (induction \"[Rule m (Goto chain)]\" Undecided t rule: iptables_bigstep.induct)\n       (auto elim: list_app_singletonE dest: skipD)\n  }note 2=this\n  show \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r # rs, Undecided\\<rangle> \\<Rightarrow> t \\<Longrightarrow> r = Rule m a \\<Longrightarrow> matches \\<gamma> m p \\<Longrightarrow> a = Unknown \\<or> (\\<exists>chain. a = Goto chain) \\<Longrightarrow> False\"\n  apply(erule seqE_cons)\n  apply(case_tac ti)\n   apply(simp_all)\n   using Rule_UndecidedE apply fastforce\n  by (metis \"1\" \"2\" decision iptables_bigstep_deterministic)\nqed\n\ntext\\<open>\nThe notation we prefer in the paper. The semantics are defined for fixed @{text \\<Gamma>} and @{text \\<gamma>}\n\\<close>\nlocale iptables_bigstep_fixedbackground =\n  fixes \\<Gamma>::\"'a ruleset\"\n  and \\<gamma>::\"('a, 'p) matcher\"\n  begin\n\n  inductive iptables_bigstep' :: \"'p \\<Rightarrow> 'a rule list \\<Rightarrow> state \\<Rightarrow> state \\<Rightarrow> bool\"\n    (\"_\\<turnstile>' \\<langle>_, _\\<rangle> \\<Rightarrow> _\"  [60,20,98,98] 89)\n    for p where\n  skip:    \"p\\<turnstile>' \\<langle>[], t\\<rangle> \\<Rightarrow> t\" |\n  accept:  \"matches \\<gamma> m p \\<Longrightarrow> p\\<turnstile>' \\<langle>[Rule m Accept], Undecided\\<rangle> \\<Rightarrow> Decision FinalAllow\" |\n  drop:    \"matches \\<gamma> m p \\<Longrightarrow> p\\<turnstile>' \\<langle>[Rule m Drop], Undecided\\<rangle> \\<Rightarrow> Decision FinalDeny\" |\n  reject:  \"matches \\<gamma> m p \\<Longrightarrow>  p\\<turnstile>' \\<langle>[Rule m Reject], Undecided\\<rangle> \\<Rightarrow> Decision FinalDeny\" |\n  log:     \"matches \\<gamma> m p \\<Longrightarrow> p\\<turnstile>' \\<langle>[Rule m Log], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\n  empty:   \"matches \\<gamma> m p \\<Longrightarrow> p\\<turnstile>' \\<langle>[Rule m Empty], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\n  nomatch: \"\\<not> matches \\<gamma> m p \\<Longrightarrow> p\\<turnstile>' \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\n  decision: \"p\\<turnstile>' \\<langle>rs, Decision X\\<rangle> \\<Rightarrow> Decision X\" |\n  seq:      \"\\<lbrakk>p\\<turnstile>' \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> t; p\\<turnstile>' \\<langle>rs\\<^sub>2, t\\<rangle> \\<Rightarrow> t'\\<rbrakk> \\<Longrightarrow> p\\<turnstile>' \\<langle>rs\\<^sub>1@rs\\<^sub>2, Undecided\\<rangle> \\<Rightarrow> t'\" |\n  call_return:  \"\\<lbrakk> matches \\<gamma> m p; \\<Gamma> chain = Some (rs\\<^sub>1@[Rule m' Return]@rs\\<^sub>2);\n                   matches \\<gamma> m' p; p\\<turnstile>' \\<langle>rs\\<^sub>1, Undecided\\<rangle> \\<Rightarrow> Undecided \\<rbrakk> \\<Longrightarrow>\n                 p\\<turnstile>' \\<langle>[Rule m (Call chain)], Undecided\\<rangle> \\<Rightarrow> Undecided\" |\n  call_result:  \"\\<lbrakk> matches \\<gamma> m p; p\\<turnstile>' \\<langle>the (\\<Gamma> chain), Undecided\\<rangle> \\<Rightarrow> t \\<rbrakk> \\<Longrightarrow>\n                 p\\<turnstile>' \\<langle>[Rule m (Call chain)], Undecided\\<rangle> \\<Rightarrow> t\"\n\n  definition wf_\\<Gamma>:: \"'a rule list \\<Rightarrow> bool\" where\n    \"wf_\\<Gamma> rs \\<equiv> \\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. (\\<forall>r \\<in> set rsg. \\<forall> chain. get_action r = Call chain \\<longrightarrow> \\<Gamma> chain \\<noteq> None)\"\n\n  lemma wf_\\<Gamma>_append: \"wf_\\<Gamma> (rs1@rs2) \\<longleftrightarrow> wf_\\<Gamma> rs1 \\<and> wf_\\<Gamma> rs2\"\n    by(simp add: wf_\\<Gamma>_def, blast)\n  lemma wf_\\<Gamma>_tail: \"wf_\\<Gamma> (r # rs) \\<Longrightarrow> wf_\\<Gamma> rs\" by(simp add: wf_\\<Gamma>_def)\n  lemma wf_\\<Gamma>_Call: \"wf_\\<Gamma> [Rule m (Call chain)] \\<Longrightarrow> wf_\\<Gamma> (the (\\<Gamma> chain)) \\<and> (\\<exists>rs. \\<Gamma> chain = Some rs)\"\n    apply(simp add: wf_\\<Gamma>_def)\n    by (metis option.collapse ranI)\n  \n  lemma \"wf_\\<Gamma> rs \\<Longrightarrow> p\\<turnstile>' \\<langle>rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\n    apply(rule iffI)\n     apply(rotate_tac 1)\n     apply(induction rs s t rule: iptables_bigstep'.induct)\n               apply(auto intro: iptables_bigstep.intros simp: wf_\\<Gamma>_append dest!: wf_\\<Gamma>_Call)[11]\n    apply(rotate_tac 1)\n    apply(induction rs s t rule: iptables_bigstep.induct)\n              apply(auto intro: iptables_bigstep'.intros simp: wf_\\<Gamma>_append dest!: wf_\\<Gamma>_Call)[11]\n    done\n    \n  end\n\n\n\n\ntext\\<open>Showing that semantics are defined.\n  For rulesets which can be loaded by the Linux kernel. The kernel does not allow loops.\\<close>\n\n\n\n\ntext\\<open>\n  We call a ruleset well-formed (wf) iff all @{const Call}s are into actually existing chains.\n\\<close>\ndefinition wf_chain :: \"'a ruleset \\<Rightarrow> 'a rule list \\<Rightarrow> bool\" where\n  \"wf_chain \\<Gamma> rs \\<equiv> (\\<forall>r \\<in> set rs. \\<forall> chain. get_action r = Call chain \\<longrightarrow> \\<Gamma> chain \\<noteq> None)\"\nlemma wf_chain_append: \"wf_chain \\<Gamma> (rs1@rs2) \\<longleftrightarrow> wf_chain \\<Gamma> rs1 \\<and> wf_chain \\<Gamma> rs2\"\n  by(simp add: wf_chain_def, blast)\n\nlemma wf_chain_fst: \"wf_chain \\<Gamma> (r # rs) \\<Longrightarrow>  wf_chain \\<Gamma> (rs)\"\n  by(simp add: wf_chain_def)\n\n\ntext\\<open>This is what our tool will check at runtime\\<close>\ndefinition sanity_wf_ruleset :: \"(string \\<times> 'a rule list) list \\<Rightarrow> bool\" where\n  \"sanity_wf_ruleset \\<Gamma> \\<equiv> distinct (map fst \\<Gamma>) \\<and>\n          (\\<forall> rs \\<in> ran (map_of \\<Gamma>). (\\<forall>r \\<in> set rs. case get_action r of Accept \\<Rightarrow> True\n                                                                    | Drop \\<Rightarrow> True\n                                                                    | Reject \\<Rightarrow> True\n                                                                    | Log \\<Rightarrow> True\n                                                                    | Empty \\<Rightarrow> True\n                                                                    | Call chain \\<Rightarrow> chain \\<in> dom (map_of \\<Gamma>)\n                                                                    | Goto chain \\<Rightarrow> chain \\<in> dom (map_of \\<Gamma>)\n                                                                    | Return \\<Rightarrow> True\n                                                                    | _ \\<Rightarrow> False))\"\n\nlemma sanity_wf_ruleset_wf_chain: \"sanity_wf_ruleset \\<Gamma> \\<Longrightarrow> rs \\<in> ran (map_of \\<Gamma>) \\<Longrightarrow> wf_chain (map_of \\<Gamma>) rs\"\n  apply(simp add: sanity_wf_ruleset_def wf_chain_def)\n  by fastforce\n\nlemma sanity_wf_ruleset_start: \"sanity_wf_ruleset \\<Gamma> \\<Longrightarrow> chain_name \\<in> dom (map_of \\<Gamma>) \\<Longrightarrow>\n  default_action = Accept \\<or> default_action = Drop \\<Longrightarrow> \n  wf_chain (map_of \\<Gamma>) [Rule MatchAny (Call chain_name), Rule MatchAny default_action]\"\n apply(simp add: sanity_wf_ruleset_def wf_chain_def)\n apply(safe)\n  apply(simp_all)\n  apply blast+\n done\n\n\n\n\n\n\n\nlemma semantics_bigstep_defined1: assumes \"\\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. wf_chain \\<Gamma> rsg\"\n  and \"\\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. \\<forall> r \\<in> set rsg. (\\<forall>chain. get_action r \\<noteq> Goto chain) \\<and> get_action r \\<noteq> Unknown\"\n  and \"\\<forall> r \\<in> set rs. get_action r \\<noteq> Return\" (*no toplevel return*)\n  and \"(\\<forall>name \\<in> dom \\<Gamma>. \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>the (\\<Gamma> name), Undecided\\<rangle> \\<Rightarrow> t)\" (*defined for all chains in the background ruleset*)\n  shows \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\nusing assms proof(induction rs)\ncase Nil thus ?case\n apply(rule_tac x=s in exI)\n by(simp add: skip)\nnext\ncase (Cons r rs)\n  from Cons.prems Cons.IH obtain t' where t': \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t'\"\n    apply simp\n    apply(elim conjE)\n    apply(simp add: wf_chain_fst)\n    by blast\n\n  obtain m a where r: \"r = Rule m a\" by(cases r) blast\n\n  show ?case\n  proof(cases \"matches \\<gamma> m p\")\n  case False\n    hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r], s\\<rangle> \\<Rightarrow> s\"\n      apply(cases s)\n       apply(simp add: nomatch r)\n      by(simp add: decision)\n    thus ?thesis\n      apply(rule_tac x=t' in exI)\n      apply(rule_tac t=s in seq'_cons)\n       apply assumption\n      using t' by(simp)\n  next\n  case True\n    show ?thesis\n    proof(cases s)\n    case (Decision X) thus ?thesis\n      apply(rule_tac x=\"Decision X\" in exI)\n      by(simp add: decision)\n    next\n    case Undecided\n      have \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m a # rs, Undecided\\<rangle> \\<Rightarrow> t\"\n      proof(cases a)\n        case Accept with True show ?thesis\n          apply(rule_tac x=\"Decision FinalAllow\" in exI)\n          apply(rule_tac t=\"Decision FinalAllow\" in seq'_cons)\n           by(auto intro: iptables_bigstep.intros)\n        next\n        case Drop with True show ?thesis\n          apply(rule_tac x=\"Decision FinalDeny\" in exI)\n          apply(rule_tac t=\"Decision FinalDeny\" in seq'_cons)\n           by(auto intro: iptables_bigstep.intros)\n        next\n        case Log with True t' Undecided show ?thesis\n          apply(rule_tac x=t' in exI)\n          apply(rule_tac t=Undecided in seq'_cons)\n           by(auto intro: iptables_bigstep.intros)\n        next\n        case Reject with True show ?thesis\n          apply(rule_tac x=\"Decision FinalDeny\" in exI)\n          apply(rule_tac t=\"Decision FinalDeny\" in seq'_cons)\n           by(auto intro: iptables_bigstep.intros)[2]\n        next\n        case Return with Cons.prems(3)[simplified r] show ?thesis by simp\n        next\n        case Goto with Cons.prems(2)[simplified r] show ?thesis by auto\n        next\n        case (Call chain_name)\n          from Call Cons.prems(1) obtain rs' where 1: \"\\<Gamma> chain_name = Some rs'\" by(simp add: r wf_chain_def) blast\n          with Cons.prems(4) obtain t'' where 2: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>the (\\<Gamma> chain_name), Undecided\\<rangle> \\<Rightarrow> t''\" by blast\n          from 1 2 True have \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call chain_name)], Undecided\\<rangle> \\<Rightarrow> t''\" by(auto dest: call_result)\n          with Call t' Undecided show ?thesis\n          apply(simp add: r)\n          apply(cases t'')\n           apply simp\n           apply(rule_tac x=t' in exI)\n           apply(rule_tac t=Undecided in seq'_cons)\n            apply(auto intro: iptables_bigstep.intros)[2]\n          apply(simp)\n          apply(rule_tac x=t'' in exI)\n          apply(rule_tac t=t'' in seq'_cons)\n           apply(auto intro: iptables_bigstep.intros)\n         done\n        next\n        case Empty  with True t' Undecided show ?thesis\n         apply(rule_tac x=t' in exI)\n         apply(rule_tac t=Undecided in seq'_cons)\n          by(auto intro: iptables_bigstep.intros)\n        next\n        case Unknown with Cons.prems(2)[simplified r] show ?thesis by(simp)\n      qed\n      thus ?thesis\n      unfolding r Undecided by simp\n    qed\n  qed\nqed\n\ntext\\<open>Showing the main theorem\\<close>\n\ncontext\nbegin\n  private lemma iptables_bigstep_defined_if_singleton_rules:\n  \"\\<forall> r \\<in> set rs. (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r], s\\<rangle> \\<Rightarrow> t) \\<Longrightarrow> \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\n  proof(induction rs arbitrary: s)\n  case Nil hence \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[], s\\<rangle> \\<Rightarrow> s\" by(simp add: skip)\n     thus ?case by blast\n  next\n  case(Cons r rs s)\n    from Cons.prems obtain t where t: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r], s\\<rangle> \\<Rightarrow> t\" by simp blast\n    with Cons show ?case\n    proof(cases t)\n      case Decision with t show ?thesis by (meson decision seq'_cons)\n      next\n      case Undecided\n      from Cons obtain t' where t': \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t'\" by simp blast\n      with Undecided t show ?thesis\n      apply(rule_tac x=t' in exI)\n      apply(rule seq'_cons)\n       apply(simp)\n      using iptables_bigstep_to_undecided by fastforce\n    qed\n  qed\n  \n  \n  \n  \n  \n  \n  \n  text\\<open>well founded relation.\\<close>\n  definition calls_chain :: \"'a ruleset \\<Rightarrow> (string \\<times> string) set\" where\n    \"calls_chain \\<Gamma> = {(r, s). case \\<Gamma> r of Some rs \\<Rightarrow> \\<exists>m. Rule m (Call s) \\<in> set rs | None \\<Rightarrow> False}\"  \n  \n  lemma calls_chain_def2: \"calls_chain \\<Gamma> = {(caller, callee). \\<exists>rs m. \\<Gamma> caller = Some rs \\<and> Rule m (Call callee) \\<in> set rs}\"\n    unfolding calls_chain_def\n    apply(safe)\n     apply(simp split: option.split_asm)\n    apply(simp)\n    by blast\n  \n  text\\<open>example\\<close>\n  private lemma \"calls_chain [\n      ''FORWARD'' \\<mapsto> [(Rule m1 Log), (Rule m2 (Call ''foo'')), (Rule m3 Accept), (Rule m' (Call ''baz''))],\n      ''foo'' \\<mapsto> [(Rule m4 Log), (Rule m5 Return), (Rule m6 (Call ''bar''))], \n      ''bar'' \\<mapsto> [],\n      ''baz'' \\<mapsto> []] =\n      {(''FORWARD'', ''foo''), (''FORWARD'', ''baz''), (''foo'', ''bar'')}\"\n    unfolding calls_chain_def by(auto split: option.split_asm if_split_asm)\n  \n  private lemma \"wf (calls_chain [\n      ''FORWARD'' \\<mapsto> [(Rule m1 Log), (Rule m2 (Call ''foo'')), (Rule m3 Accept), (Rule m' (Call ''baz''))],\n      ''foo'' \\<mapsto> [(Rule m4 Log), (Rule m5 Return), (Rule m6 (Call ''bar''))], \n      ''bar'' \\<mapsto> [],\n      ''baz'' \\<mapsto> []])\"\n  proof -\n    have g: \"calls_chain [''FORWARD'' \\<mapsto> [(Rule m1 Log), (Rule m2 (Call ''foo'')), (Rule m3 Accept), (Rule m' (Call ''baz''))],\n            ''foo'' \\<mapsto> [(Rule m4 Log), (Rule m5 Return), (Rule m6 (Call ''bar''))], \n            ''bar'' \\<mapsto> [],\n            ''baz'' \\<mapsto> []] = {(''FORWARD'', ''foo''), (''FORWARD'', ''baz''), (''foo'', ''bar'')}\"\n    by(auto simp add: calls_chain_def split: option.split_asm if_split_asm)\n    show ?thesis\n      unfolding g\n      apply(simp)\n      apply safe\n       apply(erule rtranclE, simp_all)\n      apply(erule rtranclE, simp_all)\n      done\n  qed    \n      \n  \n  text\\<open>In our proof, we will need the reverse.\\<close>\n  private definition called_by_chain :: \"'a ruleset \\<Rightarrow> (string \\<times> string) set\" where\n    \"called_by_chain \\<Gamma> = {(callee, caller). case \\<Gamma> caller of Some rs \\<Rightarrow> \\<exists>m. Rule m (Call callee) \\<in> set rs | None \\<Rightarrow> False}\"\n  private lemma called_by_chain_converse: \"calls_chain \\<Gamma> = converse (called_by_chain \\<Gamma>)\"\n    apply(simp add: calls_chain_def called_by_chain_def)\n    by blast\n  private lemma wf_called_by_chain: \"finite (calls_chain \\<Gamma>) \\<Longrightarrow> wf (calls_chain \\<Gamma>) \\<Longrightarrow> wf (called_by_chain \\<Gamma>)\"\n    apply(frule Wellfounded.wf_acyclic)\n    apply(drule(1) Wellfounded.finite_acyclic_wf_converse)\n    apply(simp add: called_by_chain_converse)\n    done\n  \n  \n  private lemma helper_cases_call_subchain_defined_or_return:\n        \"(\\<forall>x\\<in>ran \\<Gamma>. wf_chain \\<Gamma> x) \\<Longrightarrow>\n         \\<forall>rsg\\<in>ran \\<Gamma>. \\<forall>r\\<in>set rsg. (\\<forall>chain. get_action r \\<noteq> Goto chain) \\<and> get_action r \\<noteq> Unknown \\<Longrightarrow>\n         \\<forall>y m. \\<forall>r\\<in>set rs_called. r = Rule m (Call y) \\<longrightarrow> (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call y)], Undecided\\<rangle> \\<Rightarrow> t) \\<Longrightarrow>\n         wf_chain \\<Gamma> rs_called \\<Longrightarrow> \n         \\<forall>r\\<in>set rs_called. (\\<forall>chain. get_action r \\<noteq> Goto chain) \\<and> get_action r \\<noteq> Unknown \\<Longrightarrow>\n         (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called, Undecided\\<rangle> \\<Rightarrow> t) \\<or>\n         (\\<exists>rs_called1 rs_called2 m'.\n             rs_called = (rs_called1 @ [Rule m' Return] @ rs_called2) \\<and>\n             matches \\<gamma> m' p \\<and> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided)\"\n  proof(induction rs_called arbitrary:)\n  case Nil hence \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[], Undecided\\<rangle> \\<Rightarrow> t\"\n     apply(rule_tac x=Undecided in exI)\n     by(simp add: skip)\n   thus ?case by simp\n  next\n  case (Cons r rs)\n    from Cons.prems have \"wf_chain \\<Gamma> [r]\" by(simp add: wf_chain_def)\n    from Cons.prems have IH:\"(\\<exists>t'. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Undecided\\<rangle> \\<Rightarrow> t') \\<or>\n      (\\<exists>rs_called1 rs_called2 m'.\n          rs = (rs_called1 @ [Rule m' Return] @ rs_called2) \\<and>\n          matches \\<gamma> m' p \\<and> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided)\"\n      apply -\n      apply(rule Cons.IH)\n          apply(auto dest: wf_chain_fst)\n      done\n  \n    from Cons.prems have case_call: \"r = Rule m (Call y) \\<Longrightarrow> (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call y)], Undecided\\<rangle> \\<Rightarrow> t)\" for y m\n      by(simp)\n  \n    obtain m a where r: \"r = Rule m a\" by(cases r) simp\n  \n    from Cons.prems have a_not: \"(\\<forall>chain. a \\<noteq> Goto chain) \\<and> a \\<noteq> Unknown\" by(simp add: r)\n  \n    have ex_neq_ret: \"a \\<noteq> Return \\<Longrightarrow> \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> t\"\n    proof(cases \"matches \\<gamma> m p\")\n    case False thus ?thesis by(rule_tac x=Undecided in exI)(simp add: nomatch; fail)\n    next\n    case True\n      assume \"a \\<noteq> Return\"\n      show ?thesis\n      proof(cases a)\n      case Accept with True show ?thesis\n        by(rule_tac x=\"Decision FinalAllow\" in exI) (simp add: accept; fail)\n      next\n      case Drop with True show ?thesis\n        by(rule_tac x=\"Decision FinalDeny\" in exI) (simp add: drop; fail)\n      next\n      case Log with True show ?thesis\n        by(rule_tac x=\"Undecided\" in exI)(simp add: log; fail)\n      next\n      case Reject with True show ?thesis\n        by(rule_tac x=\"Decision FinalDeny\" in exI) (simp add: reject; fail)\n      next\n      case Call with True show ?thesis\n        apply(simp)\n        apply(rule case_call)\n        apply(simp add: r; fail)\n        done\n      next\n      case Empty with True show ?thesis by(rule_tac x=\"Undecided\" in exI) (simp add: empty; fail)\n      next\n      case Return with \\<open>a \\<noteq> Return\\<close> show ?thesis by simp\n      qed(simp_all add: a_not)\n    qed\n  \n    have *: \"?case\"\n      if pre: \"rs = rs_called1 @ Rule m' Return # rs_called2 \\<and> matches \\<gamma> m' p \\<and> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided\"\n      for rs_called1 m' rs_called2\n    proof(cases \"matches \\<gamma> m p\")\n    case False thus ?thesis\n      apply -\n      apply(rule disjI2)\n      apply(rule_tac x=\"r#rs_called1\" in exI)\n      apply(rule_tac x=rs_called2 in exI)\n      apply(rule_tac x=m' in exI)\n      apply(simp add: r pre)\n      apply(rule_tac t=Undecided in seq_cons)\n       apply(simp add: r nomatch; fail)\n      apply(simp add: pre; fail)\n      done\n    next\n    case True\n      from pre have rule_case_dijs1: \"\\<exists>X. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Decision X \\<Longrightarrow> ?thesis\"\n        apply -\n        apply(rule disjI1)\n        apply(elim exE conjE, rename_tac X)\n        apply(simp)\n        apply(rule_tac x=\"Decision X\" in exI)\n        apply(rule_tac t=\"Decision X\" in seq_cons)\n         apply(simp add: r; fail)\n        apply(simp add: decision; fail)\n        done\n\n      from pre have rule_case_dijs2: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> Undecided \\<Longrightarrow> ?thesis\"\n        apply -\n        apply(rule disjI2)\n        apply(rule_tac x=\"r#rs_called1\" in exI)\n        apply(rule_tac x=rs_called2 in exI)\n        apply(rule_tac x=m' in exI)\n        apply(simp add: r)\n        apply(rule_tac t=Undecided in seq_cons)\n         apply(simp; fail)\n        apply(simp;fail)\n        done\n\n      show ?thesis\n      proof(cases a)\n      case Accept show ?thesis\n        apply(rule rule_case_dijs1)\n        apply(rule_tac x=\"FinalAllow\" in exI)\n        using True pre Accept by(simp add: accept)\n      next\n      case Drop show ?thesis\n        apply(rule rule_case_dijs1)\n        apply(rule_tac x=\"FinalDeny\" in exI)\n        using True Drop by(simp add: deny)\n      next\n      case Log show ?thesis\n        apply(rule rule_case_dijs2)\n        using Log True by(simp add: log)\n      next\n      case Reject show ?thesis\n        apply(rule rule_case_dijs1)\n        apply(rule_tac x=\"FinalDeny\" in exI)\n        using Reject True by(simp add: reject)\n      next\n      case (Call x5)\n        have \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call x5)], Undecided\\<rangle> \\<Rightarrow> t\" by(rule case_call) (simp add: r Call)\n        with Call pre True show ?thesis\n        apply(simp)\n        apply(elim exE, rename_tac t_called)\n        apply(case_tac t_called)\n         apply(simp)\n         apply(rule disjI2)\n         apply(rule_tac x=\"r#rs_called1\" in exI)\n         apply(rule_tac x=rs_called2 in exI)\n         apply(rule_tac x=m' in exI)\n         apply(simp add: r)\n         apply(rule_tac t=Undecided in seq_cons)\n          apply(simp add: r; fail)\n         apply(simp; fail)\n        apply(rule disjI1)\n        apply(rule_tac x=t_called in exI)\n        apply(rule_tac t=t_called in seq_cons)\n         apply(simp add: r; fail)\n        apply(simp add: decision; fail)\n        done\n      next\n      case Empty show ?thesis\n        apply(rule rule_case_dijs2)\n        using Empty True by(simp add: pre empty)\n      next\n      case Return show ?thesis\n       apply(rule disjI2)\n       apply(rule_tac x=\"[]\" in exI)\n       apply(rule_tac x=\"rs_called1 @ Rule m' Return # rs_called2\" in exI)\n       apply(rule_tac x=m in exI)\n       using Return True pre by(simp add: skip r)\n      qed(simp_all add: a_not)\n    qed\n     \n    from IH have **: \"a \\<noteq> Return \\<longrightarrow> (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> t) \\<Longrightarrow> ?case\"\n    proof(elim disjE, goal_cases)\n    case 2\n      from this obtain rs_called1 m' rs_called2 where \n        a1: \"rs = rs_called1 @ [Rule m' Return] @ rs_called2\" and\n        a2: \"matches \\<gamma> m' p\" and a3: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided\" by blast\n      show ?case\n        apply(rule *)\n        using a1 a2 a3 by simp\n    next\n    case 1 thus ?case \n      proof(cases \"a \\<noteq> Return\")\n      case True\n        with 1 obtain t1 t2 where t1: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> t1\"\n                              and t2: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, Undecided\\<rangle> \\<Rightarrow> t2\" by blast\n        from t1 t2 show ?thesis\n        apply -\n        apply(rule disjI1)\n        apply(simp add: r)\n        apply(cases t1)\n         apply(simp_all)\n         apply(rule_tac x=t2 in exI)\n         apply(rule_tac seq'_cons)\n          apply(simp_all)\n        apply (meson decision seq_cons)\n        done\n      next\n      case False show ?thesis\n        proof(cases \"matches \\<gamma> m p\")\n          assume \"\\<not> matches \\<gamma> m p\" with 1 show ?thesis\n            apply -\n            apply(rule disjI1)\n            apply(elim exE)\n            apply(rename_tac t')\n            apply(rule_tac x=t' in exI)\n            apply(rule_tac t=Undecided in seq_cons)\n             apply(simp add: r nomatch; fail)\n            by(simp)\n        next\n          assume \"matches \\<gamma> m p\" with False show ?thesis\n            apply -\n            apply(rule disjI2)\n            apply(rule_tac x=\"[]\" in exI)\n            apply(rule_tac x=rs in exI)\n            apply(rule_tac x=m in exI)\n            apply(simp add: r skip; fail)\n            done\n        qed\n      qed\n    qed\n    thus ?case using ex_neq_ret by blast\n  qed\n  \n  \n  lemma helper_defined_single: \n    assumes \"wf (called_by_chain \\<Gamma>)\" \n    and \"\\<forall>rsg \\<in> ran \\<Gamma> \\<union> {[Rule m a]}. wf_chain \\<Gamma> rsg\"\n    and \"\\<forall>rsg \\<in> ran \\<Gamma> \\<union> {[Rule m a]}. \\<forall> r \\<in> set rsg. (\\<not>(\\<exists>chain. get_action r = Goto chain)) \\<and> get_action r \\<noteq> Unknown\"\n    and \"a \\<noteq> Return\" (*no toplevel Return*)\n    shows \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], s\\<rangle> \\<Rightarrow> t\"\n  proof(cases s)\n  case (Decision decision) thus ?thesis\n    apply(rule_tac x=\"Decision decision\" in exI)\n    apply(simp)\n    using iptables_bigstep.decision by fast\n  next\n  case Undecided\n    have \"\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m a], Undecided\\<rangle> \\<Rightarrow> t\"\n    proof(cases \"matches \\<gamma> m p\")\n    case False with assms show ?thesis\n      apply(rule_tac x=Undecided in exI)\n      apply(rule_tac t=Undecided in seq'_cons)\n       apply (metis empty_iff empty_set insert_iff list.simps(15) nomatch' rule.sel(1)) \n      apply(simp add: skip; fail)\n      done\n    next\n    case True\n    show ?thesis\n      proof(cases a)\n      case Unknown with assms(3) show ?thesis by simp\n      next\n      case Goto with assms(3) show ?thesis by auto\n      next\n      case Accept with True show ?thesis by(auto intro: iptables_bigstep.intros)\n      next\n      case Drop with True show ?thesis by(auto intro: iptables_bigstep.intros)\n      next\n      case Reject with True show ?thesis by(auto intro: iptables_bigstep.intros)\n      next\n      case Log with True show ?thesis by(auto intro: iptables_bigstep.intros)\n      next\n      case Empty with True show ?thesis by(auto intro: iptables_bigstep.intros)\n      next\n      case Return with assms show ?thesis by simp\n      next\n      case (Call chain_name)\n        thm wf_induct_rule[where r=\"(calls_chain \\<Gamma>)\" and P=\"\\<lambda>x. \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call x)], Undecided\\<rangle> \\<Rightarrow> t\"]\n        --\\<open>Only the assumptions we will need\\<close>\n        from assms have \"wf (called_by_chain \\<Gamma>)\"\n            \"\\<forall>rsg\\<in>ran \\<Gamma>. wf_chain \\<Gamma> rsg\"\n            \"\\<forall>rsg\\<in>ran \\<Gamma>. \\<forall>r\\<in>set rsg. (\\<forall>chain. get_action r \\<noteq> Goto chain) \\<and> get_action r \\<noteq> Unknown\" by auto\n        --\\<open>strengthening the IH to do a well-founded induction\\<close>\n        hence \"matches \\<gamma> m p \\<Longrightarrow> wf_chain \\<Gamma> [Rule m (Call chain_name)] \\<Longrightarrow> (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call chain_name)], Undecided\\<rangle> \\<Rightarrow> t)\"\n        proof(induction arbitrary: m rule: wf_induct_rule[where r=\"called_by_chain \\<Gamma>\"])\n        case (less chain_name_neu)\n          thm less.prems\n          from less.prems have \"\\<Gamma> chain_name_neu \\<noteq> None\" by(simp add: wf_chain_def)\n          from this obtain rs_called where rs_called: \"\\<Gamma> chain_name_neu = Some rs_called\" by blast\n  \n          from less rs_called have \"wf_chain \\<Gamma> rs_called\" by (simp add: ranI)\n          from less rs_called have \"rs_called \\<in> ran \\<Gamma>\" by (simp add: ranI)\n  \n          (*get good IH*)\n          from less.prems rs_called have\n            \"\\<forall>y m. \\<forall>r \\<in> set rs_called. r = Rule m (Call y) \\<longrightarrow> (y, chain_name_neu) \\<in> called_by_chain \\<Gamma> \\<and> wf_chain \\<Gamma> [Rule m (Call y)]\"\n             apply(simp)\n             apply(intro impI allI conjI)\n              apply(simp add: called_by_chain_def)\n              apply blast\n             apply(simp add: wf_chain_def)\n             apply (meson ranI rule.sel(2))\n             done\n          with less have \"\\<forall>y m. \\<forall>r\\<in>set rs_called. r = Rule m (Call y) \\<longrightarrow> (\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m (Call y)], Undecided\\<rangle> \\<Rightarrow> t)\"\n             apply(intro allI, rename_tac y my)\n             apply(case_tac \"matches \\<gamma> my p\")\n              apply blast\n             apply(intro ballI impI)\n             apply(rule_tac x=Undecided in exI)\n             apply(simp add: nomatch; fail)\n             done\n          from less.prems(4) rs_called \\<open>rs_called \\<in> ran \\<Gamma>\\<close>\n            helper_cases_call_subchain_defined_or_return[OF less.prems(3) less.prems(4) this \\<open>wf_chain \\<Gamma> rs_called\\<close>] have\n            \"(\\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called, Undecided\\<rangle> \\<Rightarrow> t) \\<or>\n             (\\<exists>rs_called1 rs_called2 m'.\n                  \\<Gamma> chain_name_neu = Some (rs_called1@[Rule m' Return]@rs_called2) \\<and>\n                  matches \\<gamma> m' p \\<and> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided)\" by simp\n          thus ?case\n          proof(elim disjE exE conjE)\n            fix t\n            assume a: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called, Undecided\\<rangle> \\<Rightarrow> t\" show ?case\n            using call_result[OF less.prems(1) rs_called a] by(blast)\n          next\n            fix m' rs_called1 rs_called2\n            assume a1: \"\\<Gamma> chain_name_neu = Some (rs_called1 @ [Rule m' Return] @ rs_called2)\"\n            and a2: \"matches \\<gamma> m' p\" and a3: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs_called1, Undecided\\<rangle> \\<Rightarrow> Undecided\"\n            show ?case using call_return[OF less.prems(1) a1 a2 a3 ] by(blast)\n          qed\n        qed\n        with True assms Call show ?thesis by simp\n      qed\n    qed\n  with Undecided show ?thesis by simp\n  qed\n  \n  \n  private lemma helper_defined_ruleset_calledby: \"wf (called_by_chain \\<Gamma>) \\<Longrightarrow> \n    \\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. wf_chain \\<Gamma> rsg \\<Longrightarrow>\n    \\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. \\<forall> r \\<in> set rsg. (\\<not>(\\<exists>chain. get_action r = Goto chain)) \\<and> get_action r \\<noteq> Unknown \\<Longrightarrow>\n    \\<forall> r \\<in> set rs. get_action r \\<noteq> Return \\<Longrightarrow>\n    \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\n  apply(rule iptables_bigstep_defined_if_singleton_rules)\n  apply(intro ballI, rename_tac r, case_tac r, rename_tac m a, simp)\n  apply(rule helper_defined_single)\n     apply(simp; fail)\n    apply(simp add: wf_chain_def; fail)\n   apply fastforce\n  apply fastforce\n  done\n  \n  corollary semantics_bigstep_defined: \"finite (calls_chain \\<Gamma>) \\<Longrightarrow> wf (calls_chain \\<Gamma>) \\<Longrightarrow> (*call relation finite and terminating*)\n    \\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. wf_chain \\<Gamma> rsg \\<Longrightarrow> (*All calls to defined chains*)\n    \\<forall>rsg \\<in> ran \\<Gamma> \\<union> {rs}. \\<forall> r \\<in> set rsg. (\\<forall>x. get_action r \\<noteq> Goto x) \\<and> get_action r \\<noteq> Unknown \\<Longrightarrow> (*no bad actions*)\n    \\<forall> r \\<in> set rs. get_action r \\<noteq> Return (*no toplevel return*) \\<Longrightarrow>\n    \\<exists>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\n  apply(drule(1) wf_called_by_chain)\n  apply(thin_tac \"wf (calls_chain \\<Gamma>)\")\n  apply(rule helper_defined_ruleset_calledby)\n     apply(simp_all)\n  done\nend\n\n\n\n\n\n\n\n\n\ntext\\<open>Common Algorithms\\<close>\n\nlemma iptables_bigstep_rm_LogEmpty: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rm_LogEmpty rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\nproof(induction rs arbitrary: s)\ncase Nil thus ?case by(simp)\nnext\ncase (Cons r rs)\n  have step_IH: \"(\\<And>s. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs1, s\\<rangle> \\<Rightarrow> t = \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs2, s\\<rangle> \\<Rightarrow> t) \\<Longrightarrow>\n         \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs1, s\\<rangle> \\<Rightarrow> t = \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs2, s\\<rangle> \\<Rightarrow> t\" for rs1 rs2 r\n  by (meson seq'_cons seqE_cons)\n  have case_log: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m Log # rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\" for m\n    apply(rule iffI)\n     apply(erule seqE_cons)\n     apply (metis append_Nil log_remove seq')\n    apply(rule_tac t=s in seq'_cons)\n     apply(cases s)\n      apply(cases \"matches \\<gamma> m p\")\n       apply(simp add: log; fail)\n      apply(simp add: nomatch; fail)\n     apply(simp add: decision; fail)\n    apply simp\n   done\n  have case_empty: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>Rule m Empty # rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\" for m\n    apply(rule iffI)\n     apply(erule seqE_cons)\n     apply (metis append_Nil empty_empty seq')\n    apply(rule_tac t=s in seq'_cons)\n     apply(cases s)\n      apply(cases \"matches \\<gamma> m p\")\n       apply(simp add: empty; fail)\n      apply(simp add: nomatch; fail)\n     apply(simp add: decision; fail)\n    apply simp\n   done\n\n  from Cons show ?case  \n  apply(cases r, rename_tac m a)\n  apply(case_tac a)\n          apply(simp_all)\n          apply(simp_all cong: step_IH)\n   apply(simp_all add: case_log case_empty)\n  done\nqed\n\nlemma iptables_bigstep_rw_Reject: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rw_Reject rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs, s\\<rangle> \\<Rightarrow> t\"\nproof(induction rs arbitrary: s)\ncase Nil thus ?case by(simp)\nnext\ncase (Cons r rs)\n  have step_IH: \"(\\<And>s. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs1, s\\<rangle> \\<Rightarrow> t = \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>rs2, s\\<rangle> \\<Rightarrow> t) \\<Longrightarrow>\n         \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs1, s\\<rangle> \\<Rightarrow> t = \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r#rs2, s\\<rangle> \\<Rightarrow> t\" for rs1 rs2 r\n  by (meson seq'_cons seqE_cons)\n  have fst_rule: \"(\\<And>t. \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r1], s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[r2], s\\<rangle> \\<Rightarrow> t) \\<Longrightarrow> \n    \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r1 # rs, s\\<rangle> \\<Rightarrow> t \\<longleftrightarrow> \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>r2 # rs, s\\<rangle> \\<Rightarrow> t\" for r1 r2 rs s t\n  by (meson seq'_cons seqE_cons)\n  have dropreject: \"\\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Drop], s\\<rangle> \\<Rightarrow> t = \\<Gamma>,\\<gamma>,p\\<turnstile> \\<langle>[Rule m Reject], s\\<rangle> \\<Rightarrow> t\" for m t\n    apply(cases s)\n     apply(cases \"matches \\<gamma> m p\")\n      using drop reject dropD rejectD apply fast\n     using nomatch nomatchD apply fast\n    using decision decisionD apply fast\n    done\n\n  from Cons show ?case\n  apply(cases r, rename_tac m a)\n  apply simp\n  apply(case_tac a)\n          apply(simp_all)\n          apply(simp_all cong: step_IH)\n   apply(rule fst_rule)\n   apply(simp add: dropreject)\n  done\nqed\n\n\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Iptables_Semantics/Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702642896702, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.32575135771430147}}
{"text": "theory flash100Bra  imports flash100Rev\n \n  begin\nlemma onInv100:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv100 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv100 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv100 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash100Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7185943925708562, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.32571142235016015}}
{"text": "section \"Totality\"\n\ntheory Big_Step_Total\nimports Semantic_Extras\nbegin\n\ncontext begin\n\nprivate lemma evaluate_list_total0:\n  fixes s :: \"'a state\"\n  assumes \"\\<And>e env s'::'a state. e \\<in> set es \\<Longrightarrow> clock s' \\<le> clock s \\<Longrightarrow> \\<exists>s'' r. evaluate True env s' e (s'', r)\"\n  shows \"\\<exists>s' r. evaluate_list True env s es (s', r)\"\nusing assms proof (induction es arbitrary: env s)\n  case Nil\n  show ?case by (metis evaluate_match_evaluate_list_evaluate.empty)\nnext\n  case (Cons e es)\n  then obtain s' r where e: \"evaluate True env s e (s', r)\"\n    by fastforce\n  then have clock: \"clock s' \\<le> clock s\"\n    by (metis evaluate_clock_mono)\n\n  show ?case\n    proof (cases r)\n      case (Rval v)\n\n      have \"\\<exists>s'' r. evaluate_list True env s' es (s'', r)\"\n        using Cons clock by auto\n      then obtain s'' r where \"evaluate_list True env s' es (s'', r)\"\n        by auto\n\n      with e Rval show ?thesis\n        by (cases r)\n           (metis evaluate_match_evaluate_list_evaluate.cons1 evaluate_match_evaluate_list_evaluate.cons3)+\n    next\n      case Rerr\n      with e show ?thesis by (metis evaluate_match_evaluate_list_evaluate.cons2)\n    qed\nqed\n\nprivate lemma evaluate_match_total0:\n  fixes s :: \"'a state\"\n  assumes \"\\<And>p e env s'::'a state. (p, e) \\<in> set pes \\<Longrightarrow> clock s' \\<le> clock s \\<Longrightarrow> \\<exists>s'' r. evaluate True env s' e (s'', r)\"\n  shows \"\\<exists>s' r. evaluate_match True env s v pes v' (s', r)\"\nusing assms proof (induction pes arbitrary: env s)\n  case Nil\n  show ?case by (metis mat_empty)\nnext\n  case (Cons pe pes)\n  then obtain p e where \"pe = (p, e)\" by force\n\n  show ?case\n    proof (cases \"allDistinct (pat_bindings p [])\")\n      case distinct: True\n      show ?thesis\n        proof (cases \"pmatch (c env) (refs s) p v []\")\n          case No_match\n\n          have \"\\<exists>s' r. evaluate_match True env s v pes v' (s', r)\"\n            apply (rule Cons)\n            apply (rule Cons)\n            by auto\n          then obtain s' r where \"evaluate_match True env s v pes v' (s', r)\"\n            by auto\n\n          show ?thesis\n            unfolding \\<open>pe = _\\<close>\n            apply (intro exI)\n            apply (rule mat_cons2)\n            apply safe\n            by fact+\n        next\n          case Match_type_error\n          then show ?thesis\n            unfolding \\<open>pe = _\\<close> by (metis mat_cons3)\n        next\n          case (Match env')\n\n          have \"\\<exists>s' r. evaluate True (env \\<lparr> sem_env.v := (nsAppend (alist_to_ns env') (sem_env.v env)) \\<rparr>) s e (s', r)\"\n            apply (rule Cons)\n            unfolding \\<open>pe = _\\<close> by auto\n          then obtain s' r where \"evaluate True (env \\<lparr> sem_env.v := (nsAppend (alist_to_ns env') (sem_env.v env)) \\<rparr>) s e (s', r)\"\n            by auto\n\n          show ?thesis\n            unfolding \\<open>pe = _\\<close>\n            apply (intro exI)\n            apply (rule mat_cons1)\n            apply safe\n            apply fact+\n            done\n        qed\n    next\n      case False\n      then show ?thesis\n        unfolding \\<open>pe = _\\<close> by (metis mat_cons4)\n    qed\nqed\n\nlemma evaluate_total: \"\\<exists>s' r. evaluate True env s e (s', r)\"\nproof -\n  have \"wf (less_than <*lex*> measure (size::exp \\<Rightarrow> nat))\"\n    by auto\n  then show ?thesis\n    proof (induction \"(clock s, e)\" arbitrary: env s e)\n      case less\n      show ?case\n        proof (cases e)\n          case (Raise e')\n          then have \"\\<exists>s' r. evaluate True env s e' (s', r)\"\n            using less by auto\n          then obtain s' r where \"evaluate True env s e' (s', r)\"\n            by auto\n          then show ?thesis\n            unfolding Raise by (cases r) (metis raise1 raise2)+\n        next\n          case (Con cn es)\n          show ?thesis\n            proof (cases \"do_con_check (c env) cn (length es)\")\n              case True\n              have \"\\<exists>s' vs. evaluate_list True env s (rev es) (s', vs)\"\n                apply (rule evaluate_list_total0)\n                apply (rule less)\n                unfolding Con\n                apply auto\n                using Con apply (auto simp: less_eq_Suc_le)\n                apply (rule size_list_estimation')\n                apply assumption\n                by simp\n              then obtain r s' where es: \"evaluate_list True env s (rev es) (s', r)\"\n                by auto\n\n              show ?thesis\n                proof (cases r)\n                  case (Rval vs)\n                  moreover obtain v where \"build_conv (c env) cn (rev vs) = Some v\"\n                    using True\n                    by (cases cn) (auto split: option.splits)\n                  ultimately show ?thesis\n                    using True es unfolding Con by (metis con1)\n                next\n                  case Rerr\n                  with True es show ?thesis unfolding Con by (metis con3)\n                qed\n            next\n              case False\n              with Con show ?thesis by (metis con2)\n            qed\n        next\n          case (Var n)\n          then show ?thesis\n            by (cases \"nsLookup (sem_env.v env) n\") (metis var1 var2)+\n        next\n          case (App op es)\n          have \"\\<exists>s' vs. evaluate_list True env s (rev es) (s', vs)\"\n            apply (rule evaluate_list_total0)\n            apply (rule less)\n            unfolding App apply (auto simp: less_eq_Suc_le)\n            apply (rule size_list_estimation')\n            apply assumption\n            by simp\n          then obtain r s2 where es: \"evaluate_list True env s (rev es) (s2, r)\"\n            by auto\n          then have clock: \"clock s2 \\<le> clock s\"\n            by (metis evaluate_clock_mono)\n\n          show ?thesis\n            proof (cases r)\n              case (Rval vs)\n              show ?thesis\n                proof (cases \"op = Opapp\")\n                  case opapp: True\n                  show ?thesis\n                    proof (cases \"do_opapp (rev vs)\")\n                      case None\n                      with App opapp Rval es show ?thesis by (metis app3)\n                    next\n                      case (Some r)\n                      obtain env' e' where \"r = (env', e')\"\n                        by (metis surj_pair)\n\n                      show ?thesis\n                        proof (cases \"clock s2 = 0\")\n                          case True\n                          show ?thesis\n                            unfolding \\<open>op = _\\<close> App\n                            apply (intro exI)\n                            apply (rule app2)\n                            apply (intro conjI)\n                            using es unfolding Rval apply assumption\n                            using Some unfolding \\<open>r = _\\<close> apply assumption\n                            apply fact ..\n                        next\n                          case False\n\n                          have \"\\<exists>s' r. evaluate True env' (s2 \\<lparr> clock := clock s2 - Suc 0 \\<rparr>) e' (s', r)\"\n                            apply (rule less)\n                            using False clock by (auto simp: datatype_record_update split: state.splits)\n                          then obtain s' r' where \"evaluate True env' (s2 \\<lparr> clock := clock s2 - Suc 0 \\<rparr>) e' (s', r')\"\n                            by auto\n\n                          show ?thesis\n                            unfolding \\<open>op = _\\<close> App\n                            apply (intro exI)\n                            apply (rule app1)\n                            apply (intro conjI)\n                            using es unfolding Rval apply assumption\n                            using Some unfolding \\<open>r = _\\<close> apply assumption\n                            using False apply metis\n                            apply simp\n                            apply fact\n                            done\n                        qed\n                    qed\n                next\n                  case False\n                  show ?thesis\n                    proof (cases \"do_app ((refs   s2),(ffi   s2)) op (rev vs)\")\n                      case None\n                      show ?thesis\n                        unfolding App\n                        apply (intro exI)\n                        apply (rule app5)\n                        apply (intro conjI)\n                        using es unfolding Rval apply assumption\n                        by fact+\n                    next\n                      case (Some r)\n                      obtain refs' ffi' res where \"r = ((refs', ffi'), res)\"\n                        by (metis surj_pair)\n\n                      show ?thesis\n                        unfolding App\n                        apply (intro exI)\n                        apply (rule app4)\n                        apply (intro conjI)\n                        using es unfolding Rval apply assumption\n                        using Some unfolding \\<open>r = _\\<close> apply assumption\n                        by fact\n                    qed\n                qed\n            next\n              case Rerr\n              with es App show ?thesis by (metis app6)\n            qed\n        next\n          case (Log op e1 e2)\n          with less have \"\\<exists>s' r. evaluate True env s e1 (s', r)\" by simp\n          then obtain s' r where e1: \"evaluate True env s e1 (s', r)\"\n            by blast\n          then have clock: \"clock s' \\<le> clock s\"\n            by (metis evaluate_clock_mono)\n\n          show ?thesis\n            proof (cases r)\n              case (Rval v)\n              with e1 Log show ?thesis\n                proof (cases op v e2 rule: do_log_cases)\n                  case none\n                  then show ?thesis\n                    unfolding Log\n                    using e1 Rval by (metis log3)\n                next\n                  case val\n                  then show ?thesis\n                    unfolding Log\n                    using e1 Rval by (metis log2)\n                next\n                  case exp\n                  have \"\\<exists>s'' r. evaluate True env s' e2 (s'', r)\"\n                    apply (rule less)\n                    using clock Log by auto\n                  then obtain s'' r where \"evaluate True env s' e2 (s'', r)\"\n                    by auto\n                  show ?thesis\n                    unfolding Log\n                    apply (intro exI)\n                    apply (rule log1)\n                    apply (intro conjI)\n                    using Rval e1 apply force\n                    by fact+\n                qed\n            next\n              case Rerr\n              with e1 show ?thesis\n                unfolding Log by (metis log4)\n            qed\n        next\n          case (If e1 e2 e3)\n          with less have \"\\<exists>s' r. evaluate True env s e1 (s', r)\" by simp\n          then obtain s' r where e1: \"evaluate True env s e1 (s', r)\" by auto\n          then have clock: \"clock s' \\<le> clock s\"\n            by (metis evaluate_clock_mono)\n\n          show ?thesis\n            proof (cases r)\n              case (Rval v1)\n              show ?thesis\n                proof (cases v1 e2 e3 rule: do_if_cases)\n                  case none\n                  show ?thesis\n                    unfolding If\n                    apply (intro exI)\n                    apply (rule if2)\n                    apply (intro conjI)\n                    using Rval e1 apply force\n                    by fact\n                next\n                  case true\n                  have \"\\<exists>s'' r. evaluate True env s' e2 (s'', r)\"\n                    apply (rule less)\n                    using clock If by auto\n                  then obtain s'' r where \"evaluate True env s' e2 (s'', r)\"\n                    by auto\n                  show ?thesis\n                    unfolding If\n                    apply (intro exI)\n                    apply (rule if1)\n                    apply (intro conjI)\n                    using Rval e1 apply force\n                    by fact+\n                next\n                  case false\n                  have \"\\<exists>s'' r. evaluate True env s' e3 (s'', r)\"\n                    apply (rule less)\n                    using clock If by auto\n                  then obtain s'' r where \"evaluate True env s' e3 (s'', r)\"\n                    by auto\n                  show ?thesis\n                    unfolding If\n                    apply (intro exI)\n                    apply (rule if1)\n                    apply (intro conjI)\n                    using Rval e1 apply force\n                    by fact+\n                qed\n            next\n              case Rerr\n              with e1 show ?thesis unfolding If by (metis if3)\n            qed\n        next\n          case (Handle e' pes)\n          with less have \"\\<exists>s' r. evaluate True env s e' (s', r)\" by simp\n          then obtain s' r where e': \"evaluate True env s e' (s', r)\" by auto\n          then have clock: \"clock s' \\<le> clock s\"\n            by (metis evaluate_clock_mono)\n\n          show ?thesis\n            proof (cases r)\n              case Rval\n              with e' show ?thesis\n                unfolding Handle by (metis handle1)\n            next\n              case (Rerr err)\n              show ?thesis\n                proof (cases err)\n                  case (Rraise exn)\n\n                  have \"\\<exists>s'' r. evaluate_match True env s' exn pes exn (s'', r)\"\n                    apply (rule evaluate_match_total0)\n                    apply (rule less)\n                    using Handle clock apply (auto simp: less_eq_Suc_le)\n                    apply (rule trans_le_add1)\n                    apply (rule size_list_estimation')\n                    apply assumption\n                    by auto\n                  then obtain s'' r where \"evaluate_match True env s' exn pes exn (s'', r)\"\n                    by auto\n\n                  show ?thesis\n                    unfolding Handle\n                    apply (intro exI)\n                    apply (rule handle2)\n                    apply safe\n                    using e' unfolding Rerr Rraise apply assumption\n                    by fact\n                next\n                  case (Rabort x2)\n                  with e' Rerr show ?thesis\n                    unfolding Handle\n                    by (metis handle3)\n                qed\n            qed\n        next\n          case (Mat e' pes)\n          with less have \"\\<exists>s' r. evaluate True env s e' (s', r)\" by simp\n          then obtain s' r where e': \"evaluate True env s e' (s', r)\" by auto\n          then have clock: \"clock s' \\<le> clock s\"\n            by (metis evaluate_clock_mono)\n\n          show ?thesis\n            proof (cases r)\n              case (Rval v)\n\n              have \"\\<exists>s'' r. evaluate_match True env s' v pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s'', r)\"\n                apply (rule evaluate_match_total0)\n                apply (rule less)\n                unfolding Mat using clock apply (auto simp: less_eq_Suc_le)\n                apply (rule trans_le_add1)\n                apply (rule size_list_estimation')\n                apply assumption\n                by auto\n              then obtain s'' r where \"evaluate_match True env s' v pes (Conv (Some (''Bind'', TypeExn (Short ''Bind''))) []) (s'', r)\"\n                by auto\n\n              show ?thesis\n                unfolding Mat\n                apply (intro exI)\n                apply (rule mat1)\n                apply safe\n                using e' unfolding Rval\n                apply assumption\n                apply fact\n                done\n            next\n              case Rerr\n              with e' show ?thesis\n                unfolding Mat\n                by (metis mat2)\n            qed\n        next\n          case (Let n e1 e2)\n          then have \"\\<exists>s' r. evaluate True env s e1 (s', r)\"\n            using less by auto\n          then obtain s' r where e1: \"evaluate True env s e1 (s', r)\"\n            by auto\n          then have clock: \"clock s' \\<le> clock s\"\n            by (metis evaluate_clock_mono)\n          show ?thesis\n            proof (cases r)\n              case (Rval v)\n              have \"\\<exists>s'' r. evaluate True (env \\<lparr> sem_env.v := nsOptBind n v (sem_env.v env) \\<rparr>) s' e2 (s'', r)\"\n                apply (rule less)\n                using Let clock by auto\n              then show ?thesis\n                unfolding Let\n                using e1 Rval by (metis let1)\n            next\n              case Rerr\n              with e1 show ?thesis\n                unfolding Let\n                by (metis let2)\n            qed\n        next\n          case (Letrec funs e')\n          then have \"\\<exists>s' r. evaluate True (env \\<lparr> sem_env.v := build_rec_env funs env (sem_env.v env) \\<rparr>) s e' (s', r)\"\n            using less by auto\n          then show ?thesis\n            unfolding Letrec\n            by (cases \"allDistinct (map (\\<lambda>x. case x of (x, y, z) \\<Rightarrow> x) funs)\")\n               (metis letrec1 letrec2)+\n        next\n          case (Tannot e')\n          with less have \"\\<exists>s' r. evaluate True env s e' (s', r)\" by simp\n          then show ?thesis\n            unfolding \\<open>e = _\\<close>\n            by (fastforce intro: evaluate_match_evaluate_list_evaluate.intros)\n        next\n          case (Lannot e')\n          with less have \"\\<exists>s' r. evaluate True env s e' (s', r)\" by simp\n          then show ?thesis\n            unfolding \\<open>e = _\\<close>\n            by (fastforce intro: evaluate_match_evaluate_list_evaluate.intros)\n        qed (fastforce intro: evaluate_match_evaluate_list_evaluate.intros)+\n    qed\nqed\n\nend\n\ntext \\<open>\n  The following are pretty much the same proofs as above, but without additional assumptions;\n  instead using @{thm [source=true] evaluate_total} directly.\n\\<close>\n\n\n\n      with e Rval show ?thesis\n        by (cases r)\n           (metis evaluate_match_evaluate_list_evaluate.cons1 evaluate_match_evaluate_list_evaluate.cons3)+\n    next\n      case Rerr\n      with e show ?thesis\n        by (metis evaluate_match_evaluate_list_evaluate.cons2)\n    qed\nqed\n\nlemma evaluate_match_total: \"\\<exists>s' r. evaluate_match True env s v pes v' (s', r)\"\nproof (induction pes arbitrary: env s)\n  case Nil\n  show ?case by (metis mat_empty)\nnext\n  case (Cons pe pes)\n  then obtain p e where \"pe = (p, e)\" by force\n\n  show ?case\n    proof (cases \"allDistinct (pat_bindings p [])\")\n      case distinct: True\n      show ?thesis\n        proof (cases \"pmatch (c env) (refs s) p v []\")\n          case No_match\n\n          have \"\\<exists>s' r. evaluate_match True env s v pes v' (s', r)\"\n            by (rule Cons)\n          then obtain s' r where \"evaluate_match True env s v pes v' (s', r)\"\n            by auto\n\n          show ?thesis\n            unfolding \\<open>pe = _\\<close>\n            apply (intro exI)\n            apply (rule mat_cons2)\n            apply safe\n            by fact+\n        next\n          case Match_type_error\n          then show ?thesis\n            unfolding \\<open>pe = _\\<close> by (metis mat_cons3)\n        next\n          case (Match env')\n\n          have \"\\<exists>s' r. evaluate True (env \\<lparr> sem_env.v := (nsAppend (alist_to_ns env') (sem_env.v env)) \\<rparr>) s e (s', r)\"\n            by (metis evaluate_total)\n          then obtain s' r where \"evaluate True (env \\<lparr> sem_env.v := (nsAppend (alist_to_ns env') (sem_env.v env)) \\<rparr>) s e (s', r)\"\n            by auto\n\n          show ?thesis\n            unfolding \\<open>pe = _\\<close>\n            apply (intro exI)\n            apply (rule mat_cons1)\n            apply safe\n            apply fact+\n            done\n        qed\n    next\n      case False\n      then show ?thesis\n        unfolding \\<open>pe = _\\<close> by (metis mat_cons4)\n    qed\nqed\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CakeML/Big_Step_Total.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7185943925708562, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.32571142235016015}}
{"text": "theory flash110Bra  imports flash110Rev\n \n  begin\nlemma onInv110:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv110 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv110 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv110 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash110Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7310585786300048, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.3257081886237169}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Noninterference_Base\nimports \"Lib.Simulation\"\nbegin\n\ntext \\<open>\n  Toby's extended noninterference definitions to handle dynamic assignment,\n  that depends on the current state, of\n  the domain that each action is assigned to. This is the gory details\n  reported in the the CPP 2012 paper\n  \\emph{Noninterference for Operating System Kernels}.\n\\<close>\n\nsection \\<open>Generic systems\\<close>\n\nlemma un_eq:\n  \"\\<lbrakk> S = S'; T = T' \\<rbrakk> \\<Longrightarrow> S \\<union> T = S' \\<union> T'\"\n  by auto\n\nlemma Un_eq:\n  \"\\<lbrakk> \\<And>x y. \\<lbrakk> x \\<in> xs; y \\<in> ys \\<rbrakk> \\<Longrightarrow> P x = Q y; \\<exists>x. x \\<in> xs; \\<exists>y. y \\<in> ys \\<rbrakk>\n     \\<Longrightarrow> (\\<Union>x \\<in> xs. P x) = (\\<Union>y \\<in> ys. Q y)\"\n  by auto\n\nlemma Int_eq:\n  \"\\<lbrakk> \\<And>x y. \\<lbrakk> x \\<in> xs; y \\<in> ys \\<rbrakk> \\<Longrightarrow> P x = Q y; \\<exists>x. x \\<in> xs; \\<exists>y. y \\<in> ys \\<rbrakk>\n     \\<Longrightarrow> (\\<Inter>x \\<in> xs. P x) = (\\<Inter>y \\<in> ys. Q y)\"\n  by auto\n\nlemma Un_eq_Int:\n  assumes ex: \"\\<exists>x. x \\<in> xs\"\n  assumes ey: \"\\<exists>y. y \\<in> ys\"\n  assumes a: \"\\<And>x y. \\<lbrakk> x \\<in> xs; y \\<in> ys \\<rbrakk> \\<Longrightarrow> S x = S' y\"\n  shows \"(\\<Union>x \\<in> xs. S x) = (\\<Inter>x \\<in> ys. S' x)\"\n  apply (rule equalityI)\n   apply (clarsimp)\n   apply (drule a, assumption, simp)\n  apply clarsimp\n  apply (insert ex ey)\n  apply clarsimp\n  apply (frule a, assumption)\n  apply fastforce\n  done\n\n\nsubsection\\<open>Run function\\<close>\n\nprimrec Run :: \"('e \\<Rightarrow> ('s \\<times> 's) set) \\<Rightarrow> 'e list \\<Rightarrow> ('s \\<times> 's) set\" where\n  \"Run Stepf []     = Id\"\n| \"Run Stepf (a#as) = Stepf a O Run Stepf as\"\n\n\nlemma Run_mid[rule_format]:\n  \"(s,u) \\<in> Run Stepf (as @ bs) \\<longrightarrow> (\\<exists>t. (s,t) \\<in> Run Stepf as \\<and> (t,u) \\<in> Run Stepf bs)\"\nproof (induct as arbitrary: s u bs)\n  case Nil show ?case\n    by (clarsimp)\nnext\n  case (Cons a as) show ?case\n    apply (clarsimp simp: relcomp_def)\n    apply (drule \"Cons.hyps\"[rule_format])\n    apply fastforce\n    done\nqed\n\nlemma Run_trans:\n  \"\\<lbrakk> (s,t) \\<in> Run Stepf as; (t,u) \\<in> Run Stepf bs \\<rbrakk>\n     \\<Longrightarrow> (s,u) \\<in> Run Stepf (as @ bs)\"\n  by (induct as arbitrary: bs s t u) auto\n\nlemma Run_app:\n  \"Run Stepf (as @ bs) = (Run Stepf as) O (Run Stepf bs)\"\n  apply (rule equalityI)\n   apply (fastforce dest: Run_mid)\n  apply (fastforce intro: Run_trans)\n  done\n\n\nsubsection \\<open>Base system locale\\<close>\n\ntext \\<open>An ADT with an initial state.\\<close>\nlocale system =\n  fixes A :: \"('a,'s,'e) data_type\"\n  and s0 :: \"'s\"  (* an initial state *)\nbegin\n\n(* State 's' is reachable from the initial state 's0'. *)\ndefinition reachable where\n  \"reachable s \\<equiv> \\<exists>js. s \\<in> execution A s0 js\"\n\ndefinition Step where\n  \"Step a \\<equiv> {(s,s') . s' \\<in> execution A s [a]}\"\n\n(* The system is \"observationally deterministic\": that is, the\n * observable part of the system is always deterministic. *)\ndefinition obs_det where\n  \"obs_det \\<equiv> \\<forall>s js. (\\<exists>s'. execution A s js = {s'})\"\n\nlemmas obs_detD = obs_det_def[THEN meta_eq_to_obj_eq, THEN iffD1, rule_format]\n\n(* The abstraction/concretisation functions \"Init\"/\"Fin\"\n * don't abstract away information. *)\ndefinition no_abs where\n  \"no_abs \\<equiv> \\<forall>x s as . reachable s\n                       \\<longrightarrow> x \\<in> steps (Simulation.Step A) (Init A s) as\n                       \\<longrightarrow> Init A (Fin A x) = {x}\"\n\nlemmas no_absD = no_abs_def[THEN meta_eq_to_obj_eq, THEN iffD1, rule_format]\n\nend\n\n\nsubsection \\<open>Enabled system\\<close>\n\ntext\\<open>\n  A system that is always enabled.\n\n  In particular, the system will never be in deadlock, and there\n  is always an enabled transition from every reachable state.\\<close>\n\nlocale enabled_system = system +\n  assumes enabled: \"(\\<exists>js. s \\<in> execution A s0 js) \\<Longrightarrow> \\<exists>s'. s' \\<in> execution A s js\"\nbegin\n\nlemma reachable_enabled:\n  \"reachable s \\<Longrightarrow> \\<exists>s'. s' \\<in> execution A s js\"\n  apply (simp add: reachable_def)\n  apply (erule enabled)\n  done\n\nlemma enabled_Step:\n  \"reachable s \\<Longrightarrow> \\<exists>s'. (s,s') \\<in> Step a\"\n  by (simp add: Step_def, blast intro: reachable_enabled)\n\nend\n\n\nsubsection \\<open>Step system\\<close>\n\ntext \\<open>A Step system is a system for which a running\n   a sequence of events is equivalent to performing a sequence of individual\n   steps: one for each event in the sequence in turn. In other words\n   running [a,b,c,...] is the same than running [a] then running [b] then ...\n   This correspond to projecting to the observable state and deducing the real\n   state from that observable state on each event.\n\n   We define the unwinding conditions on this kind of system\\<close>\nlocale Step_system = system A s0\n  for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\"  +\n  assumes reachable_s0: \"reachable s0\"\n  assumes execution_Run: \"reachable s \\<Longrightarrow> execution A s as = {s'. (s,s') \\<in> Run Step as}\"\nbegin\n\nlemma execution_Run':\n  \"s \\<in> execution A s0 js \\<Longrightarrow> execution A s as = {s'. (s,s') \\<in> Run Step as}\"\n  apply (rule execution_Run)\n  apply (fastforce simp: reachable_def)\n  done\n\nlemma reachable_Run:\n  \"reachable s \\<Longrightarrow> \\<exists>as. (s0,s) \\<in> Run Step as\"\n  apply (clarsimp simp add: reachable_def)\n  apply (cut_tac as=js in execution_Run[OF reachable_s0])\n  apply blast\n  done\n\nlemma Run_reachable:\n  \"\\<exists>as. (s0,s) \\<in> Run Step as \\<Longrightarrow> reachable s\"\n  apply (clarsimp simp add: reachable_def)\n  apply (cut_tac as=as in execution_Run[OF reachable_s0])\n  apply blast\n  done\n\nlemma reachable_execution:\n  \"\\<lbrakk> reachable s; s' \\<in> execution A s js \\<rbrakk> \\<Longrightarrow> reachable s'\"\n  apply (clarsimp simp: reachable_def)\n  apply (rule_tac x=\"jsa @ js\" in exI)\n  apply (frule execution_Run'[where s=s and as=js])\n  apply (simp add: execution_Run[where s=s0, simplified reachable_s0])\n  apply (fastforce simp: Run_app)\n  done\n\nlemma reachable_Step:\n  \"\\<lbrakk> reachable s; (s,s') \\<in> Step a \\<rbrakk> \\<Longrightarrow> reachable s'\"\n  apply (erule reachable_execution)\n  apply (simp add: Step_def)\n  done\n\nlemma reachable_induct_helper:\n  assumes a: \"\\<And>s s' a. \\<lbrakk> reachable s; P s; (s, s') \\<in> Step a \\<rbrakk> \\<Longrightarrow> P s'\"\n  shows \"\\<lbrakk> (s0, s1) \\<in> Run Step as; P s0 \\<rbrakk> \\<Longrightarrow> P s1\"\n  apply (induct as arbitrary: s1 rule: rev_induct)\n   apply simp\n  apply (fastforce dest: Run_mid intro: a Run_reachable)\n  done\n\nlemma reachable_induct:\n  \"\\<lbrakk> \\<And>s s' a. reachable s \\<Longrightarrow> (s,s') \\<in> (Step a) \\<Longrightarrow> P s \\<Longrightarrow> P s'; reachable s1; P s0 \\<rbrakk>\n     \\<Longrightarrow> P s1\"\n  apply (drule reachable_Run)\n  apply (elim exE)\n  apply (rule reachable_induct_helper)\n    apply simp+\n  done\n\nend\n\n\nsubsection \\<open>Init Fin system\\<close>\n\ntext \\<open>An Init Fin system a stronger kind of Step system where know directly\n   that Fin and Init behave nicely as nearly \"inverse\" of each other which imply\n   that projecting to observable state then deducing the original state behave\n   as expected in Step system.\n\\<close>\n\nlocale Init_Fin_system = system A s0\n  for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\"  +\n  assumes reachable_s0: \"reachable s0\"\n  assumes Fin_Init: \"reachable s \\<Longrightarrow> Fin A ` Init A s = {s}\"\n  assumes Init_Fin: \"\\<lbrakk> reachable s; x \\<in> steps (Simulation.Step A) (Init A s) as \\<rbrakk>\n                       \\<Longrightarrow> x \\<in> Init A (Fin A x)\"\n  assumes obs_det_or_no_abs: \"obs_det \\<or> no_abs\"\nbegin\n\nlemma execution_subset_Run:\n  \"reachable s \\<Longrightarrow> execution A s as \\<subseteq> {s'. (s,s') \\<in> Run Step as}\"\n  apply (induct as arbitrary: s rule: rev_induct)\n   apply (simp add: execution_def steps_def Fin_Init)\n  apply (simp add: execution_def steps_def)\n  apply (rule subsetI)\n  apply clarsimp\n  apply (rule Run_trans)\n   apply blast\n  apply (cut_tac x=xc and s=s and as=xs in Init_Fin, (simp add: steps_def)+)\n  apply (clarsimp simp: Step_def execution_def steps_def)\n  apply blast\n  done\n\nlemma Run_subset_execution:\n  \"\\<lbrakk> no_abs; reachable s \\<rbrakk> \\<Longrightarrow> {s'. (s,s') \\<in> Run Step as} \\<subseteq> execution A s as\"\n  apply (induct as arbitrary: s rule: rev_induct)\n   apply (simp add: execution_def steps_def Fin_Init)\n  apply (simp add: execution_def steps_def)\n  apply (rule subsetI)\n  apply clarsimp\n  apply (drule Run_mid)\n  apply clarsimp\n  apply (drule_tac x=s in meta_spec)\n  apply clarsimp\n  apply (drule_tac subsetD)\n   apply blast\n  apply (clarsimp simp: Image_def image_def Step_def execution_def steps_def)\n  apply (rule_tac x=xc in exI)\n  apply clarsimp\n  apply (rule_tac x=xd in bexI)\n   apply assumption\n  apply (drule_tac x=xb in no_absD)\n    apply (simp add: steps_def Image_def)+\n  done\n\nlemma Run_det:\n  \"obs_det \\<Longrightarrow> \\<exists>s'. {s'. (s,s') \\<in> Run Step as} = {s'}\"\n  apply (induct as arbitrary: s rule: rev_induct)\n   apply simp\n  apply (simp add: Run_app relcomp_def)\n  apply (drule_tac x=s in meta_spec)\n  apply clarsimp\n  apply (drule_tac s=s' and js=\"[x]\" in obs_detD)\n  apply (clarsimp simp: Step_def)\n  apply (rule_tac x=\"s'a\" in exI)\n  apply (auto dest: equalityD1)\n  done\n\nlemma eq:\n  \"\\<lbrakk> S \\<subseteq> T; \\<exists>x. S = {x}; \\<exists>y. T = {y} \\<rbrakk> \\<Longrightarrow> S = T\"\n  by blast\n\nlemma execution_Run:\n  \"reachable s \\<Longrightarrow> execution A s as = {s'. (s,s') \\<in> Run Step as}\"\n  apply (rule disjE[OF obs_det_or_no_abs])\n   apply (rule eq)\n     apply (erule execution_subset_Run)\n    apply (erule obs_detD)\n   apply (erule Run_det)\n  apply (rule equalityI)\n   apply (erule execution_subset_Run)\n  apply (erule (1) Run_subset_execution)\n  done\n\nend\n\n\nlemma Init_Fin_system_Step_system:\n  \"Init_Fin_system A s0 \\<Longrightarrow> Step_system A s0\"\n  apply (unfold_locales)\n   apply (erule Init_Fin_system.reachable_s0)\n  apply (erule (1) Init_Fin_system.execution_Run)\n  done\n\nsublocale Init_Fin_system \\<subseteq> Step_system\n  apply (rule Init_Fin_system_Step_system)\n  apply (unfold_locales)\n  done\n\n\nsubsection \\<open>Init inv Fin system\\<close>\n\ntext \\<open>Here we go one step further than the Init_Fin_system:\n  In this local Init and Fin are actually inverse of each other\n  Fin is injective\n  if s : range Fin A then Init A s = {s'} and Fin A s' = s else Init A s = {}.\n\n  The internal state space is thus just a restriction of the observable state space.\n\\<close>\n\n(* when Init is the inverse image of Fin, the above assumptions are met by a system\n   for which Fin is injective, or one that appears deterministic to an observer *)\nlocale Init_inv_Fin_system = system A s0\n  for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\" +\n  assumes Fin_Init_s0: \"s0 \\<in> Fin A ` Init A s0\"\n  assumes Init_inv_Fin: \"reachable s \\<Longrightarrow> Init A s = {s'. Fin A s' = s}\"\n  assumes Fin_inj: \"inj (Fin A)\"\nbegin\n\nlemma inv_and_inj: \"reachable s \\<Longrightarrow> Fin A i = s \\<Longrightarrow> Init A s = {i}\"\n  using Fin_inj Init_inv_Fin by (blast dest: injD)\n\nlemma s0_reachable:\n  \"reachable s0\"\n  apply (simp add: reachable_def)\n  apply (rule_tac x=\"[]\" in exI)\n  apply (simp add: execution_def steps_def)\n  using Fin_Init_s0 .\n\nlemma foldl_foldl_Step:\n  \"\\<lbrakk> x \\<in> foldl (\\<lambda>S j. data_type.Step A j `` S) M as;\n     M \\<subseteq> foldl (\\<lambda>S j. data_type.Step A j `` S) B js \\<rbrakk>\n     \\<Longrightarrow> x \\<in> foldl (\\<lambda>S j. data_type.Step A j `` S) (foldl (\\<lambda>S j. data_type.Step A j `` S) B js) as\"\n  apply (induct as arbitrary: x M js B rule: rev_induct)\n   apply fastforce\n  apply simp\n  apply (erule ImageE)\n  apply (drule_tac x=xb in meta_spec)\n  apply (drule_tac x=M in meta_spec)\n  apply simp\n  apply (drule_tac x=js in meta_spec)\n  apply (drule_tac x=B in meta_spec, simp)\n  apply (blast)\n  done\n\nlemma reachable_Fin:\n  \"\\<lbrakk> reachable s; x \\<in> steps (Simulation.Step A) (Init A s) as \\<rbrakk>\n     \\<Longrightarrow> reachable (Fin A x)\"\n  apply (cut_tac s=s in Init_inv_Fin, assumption)\n  apply (clarsimp simp: reachable_def execution_def steps_def)\n  apply (rule_tac x=\"js@as\" in exI)\n  apply (rule imageI)\n  apply (subgoal_tac \"{s'. Fin A s' = Fin A xa} = {xa}\")\n   apply simp\n   apply (erule foldl_foldl_Step)\n   apply blast\n  apply (blast dest: injD[OF Fin_inj])\n  done\n\nend\n\n\nlemma Init_inv_Fin_system_Init_Fin_system:\n  \"Init_inv_Fin_system A s0 \\<Longrightarrow> Init_Fin_system A s0\"\n  apply (unfold_locales)\n     apply (erule Init_inv_Fin_system.s0_reachable)\n    apply (simp add: Init_inv_Fin_system.Init_inv_Fin)\n    apply (simp add: image_def)\n    apply (fastforce simp: system.reachable_def execution_def)\n   apply (cut_tac s=\"Fin A x\" in Init_inv_Fin_system.Init_inv_Fin)\n     apply assumption\n    apply (blast intro: Init_inv_Fin_system.reachable_Fin)\n   apply simp\n  apply (rule disjI2)\n  apply (clarsimp simp: system.no_abs_def)\n  apply (frule Init_inv_Fin_system.Fin_inj)\n  apply (cut_tac s=\"Fin A x\" in Init_inv_Fin_system.Init_inv_Fin)\n    apply assumption\n   apply (blast intro: Init_inv_Fin_system.reachable_Fin)\n  apply simp\n  apply (fastforce dest: injD)\n  done\n\nsublocale Init_inv_Fin_system \\<subseteq> Init_Fin_system\n  apply (rule Init_inv_Fin_system_Init_Fin_system)\n  apply (unfold_locales)\n  done\n\n\nsection \\<open>Non interference\\<close>\n\nsubsection \\<open>Policy\\<close>\n\ntext\\<open>This local represent an whole infoflow policy with the all the field needed\n       for defining non leakage, non interference and non influence\\<close>\n\nlocale noninterference_policy =\n  fixes dom :: \"'e \\<Rightarrow> 's \\<Rightarrow> 'd\"        (* dynamic dom assignment *)\n  fixes uwr :: \"'d \\<Rightarrow> ('s \\<times> 's) set\"  (* unwinding relation *)\n  fixes policy :: \"('d \\<times> 'd) set\"     (* who can send info to whom *)\n  fixes out :: \"'d \\<Rightarrow> 's \\<Rightarrow> 'p\"        (* observable parts of d in state s *)\n  fixes schedDomain :: \"'d\"\n  assumes uwr_equiv_rel: \"equiv UNIV (uwr u)\"\n  assumes schedIncludesCurrentDom:\n    \"(s,t) \\<in> uwr schedDomain \\<Longrightarrow> dom e s = dom e t\"\n  assumes schedFlowsToAll:\n    \"(schedDomain,d) \\<in> policy\"\n  assumes schedNotGlobalChannel:\n    \"(x,schedDomain) \\<in> policy \\<Longrightarrow> x = schedDomain\"\nbegin\n\nabbreviation uwr2 :: \"'s \\<Rightarrow> 'd \\<Rightarrow> 's \\<Rightarrow> bool\" (\"(_/ \\<sim>_\\<sim>/ _)\" [50,100,50] 1000) where\n  \"s \\<sim>u\\<sim> t \\<equiv> (s,t) \\<in> uwr u\"\n\nabbreviation policy2 :: \"'d \\<Rightarrow> 'd \\<Rightarrow> bool\" (infix \"\\<leadsto>\" 50) where\n  \"u \\<leadsto> v \\<equiv> (u,v) \\<in> policy\"\n\nlemma uwr_refl:\n  \"s \\<sim>(u::'d)\\<sim> s\"\n  apply (cut_tac u=u in uwr_equiv_rel)\n  apply (clarsimp simp: equiv_def)\n  apply (blast dest: refl_onD)\n  done\n\nlemma uwr_sym:\n  \"x \\<sim>(u::'d)\\<sim> y \\<Longrightarrow> y \\<sim>u\\<sim> x\"\n  apply (cut_tac u=u in uwr_equiv_rel)\n  apply (clarsimp simp: equiv_def)\n  apply (blast dest: symD)\n  done\n\nlemma uwr_trans:\n  \"\\<lbrakk> x \\<sim>(u::'d)\\<sim> y; y \\<sim>u\\<sim> z \\<rbrakk> \\<Longrightarrow> x \\<sim>u\\<sim> z\"\n  apply (cut_tac u=u in uwr_equiv_rel)\n  apply (clarsimp simp: equiv_def)\n  apply (blast dest: transD)\n  done\n\ndefinition sameFor_dom :: \"'s \\<Rightarrow> 'd set \\<Rightarrow> 's \\<Rightarrow> bool\"  (\"(_/ \\<approx>_\\<approx>/ _)\" [50,100,50] 1000) where\n  \"s \\<approx>us\\<approx> t \\<equiv> \\<forall>u\\<in>us. (s,t) \\<in> uwr u\"\n\nlemma sameFor_subset_dom: \"\\<lbrakk>s \\<approx>(x::'d set)\\<approx> t; y \\<subseteq> x\\<rbrakk> \\<Longrightarrow> s \\<approx>y\\<approx> t\"\n  by (fastforce simp: sameFor_dom_def)\n\nlemma sameFor_inter_domI: \"s \\<approx>(S::'d set)\\<approx> t \\<Longrightarrow> s \\<approx>(S \\<inter> B)\\<approx> t\"\n  by (auto simp: sameFor_dom_def)\n\nlemma sameFor_sym_dom:\n  \"s \\<approx>(S::'d set)\\<approx> t \\<Longrightarrow> t \\<approx>S\\<approx> s\"\n  by (auto simp: sameFor_dom_def uwr_sym)\n\nend\n\n\nsubsection \\<open>Non interference system\\<close>\n\nlocale noninterference_system =\n  enabled_system A s0 + noninterference_policy dom uwr policy out schedDomain\n  for A :: \"('a,'s,'e) data_type\"\n  and s0 :: \"'s\"\n  and dom :: \"'e \\<Rightarrow> 's \\<Rightarrow> 'd\"\n  and uwr :: \"'d \\<Rightarrow> ('s \\<times> 's) set\"\n  and policy :: \"('d \\<times> 'd) set\"\n  and out :: \"'d \\<Rightarrow> 's \\<Rightarrow> 'p\"\n  and schedDomain :: \"'d\"\nbegin\n\n(* The set of domains (which carry out actions in the list \"as\") which\n * may influence \"u\", assuming we start in state \"s\". *)\nprimrec sources :: \"'e list \\<Rightarrow> 's \\<Rightarrow> 'd \\<Rightarrow> 'd set\" where\n  sources_Nil: \"sources [] s u = {u}\"\n| sources_Cons: \"sources (a#as) s u =\n    (\\<Union>{sources as s' u| s'. (s,s') \\<in> Step a}) \\<union>\n    {w. w = dom a s \\<and> (\\<exists>v s'. dom a s \\<leadsto> v \\<and> (s,s') \\<in> Step a \\<and> v \\<in> sources as s' u)}\"\n\ndeclare sources_Nil [simp del]\ndeclare sources_Cons [simp del]\n\ndefinition obs_equiv :: \"'s \\<Rightarrow> 'e list \\<Rightarrow> 's \\<Rightarrow> 'e list \\<Rightarrow> 'd \\<Rightarrow> bool\" where\n  \"obs_equiv s as t bs d \\<equiv>\n     \\<forall>s' t'. s' \\<in> execution A s as \\<and> t' \\<in> execution A t bs \\<longrightarrow> out d s' = out d t'\"\n\ndefinition uwr_equiv :: \"'s \\<Rightarrow> 'e list \\<Rightarrow> 's \\<Rightarrow> 'e list \\<Rightarrow> 'd \\<Rightarrow> bool\" where\n  \"uwr_equiv s as t bs d \\<equiv>\n     \\<forall>s' t'. s' \\<in> execution A s as \\<and> t' \\<in> execution A t bs \\<longrightarrow> s' \\<sim>d\\<sim> t'\"\n\n\ntext \\<open>Nonleakage\\<close>\ndefinition Nonleakage :: \"bool\" where\n  \"Nonleakage \\<equiv> \\<forall>as s u t. reachable s \\<and> reachable t\n                            \\<longrightarrow> s \\<sim>schedDomain\\<sim> t\n                            \\<longrightarrow> s \\<approx>(sources as s u)\\<approx> t\n                            \\<longrightarrow> obs_equiv s as t as u\"\n\n\ntext \\<open>A generalisation of Nonleakage.\\<close>\ndefinition Nonleakage_gen :: \"bool\" where\n  \"Nonleakage_gen \\<equiv>\n     \\<forall>as s u t. reachable s \\<and> reachable t\n                \\<longrightarrow> s \\<sim>schedDomain\\<sim> t\n                \\<longrightarrow> s \\<approx>(sources as s u)\\<approx> t\n                \\<longrightarrow> uwr_equiv s as t as u\"\n\n\nlemma uwr_equiv_sym:\n  \"uwr_equiv s as t bs u \\<Longrightarrow> uwr_equiv t bs s as u\"\n  by (fastforce simp: uwr_equiv_def uwr_sym)\n\nlemma uwr_equiv_trans:\n  \"\\<lbrakk> reachable t; uwr_equiv s as t bs x; uwr_equiv t bs u cs x \\<rbrakk>\n     \\<Longrightarrow> uwr_equiv s as u cs x\"\n  apply (clarsimp simp: uwr_equiv_def)\n  apply (cut_tac s=t and js=bs in reachable_enabled)\n   apply assumption\n  apply (blast intro: uwr_trans)\n  done\n\nprimrec gen_purge :: \"('e list \\<Rightarrow> 's \\<Rightarrow> 'd \\<Rightarrow> 'd set) \\<Rightarrow> 'd \\<Rightarrow> 'e list \\<Rightarrow> 's set \\<Rightarrow> 'e list\" where\n  Nil: \"gen_purge source_func u [] ss = []\"\n| Cons: \"gen_purge source_func u (a#as) ss =\n           (if \\<exists>s\\<in>ss. dom a s \\<in> source_func (a#as) s u\n            then a # gen_purge source_func u as (\\<Union>s\\<in>ss. {s'. (s,s') \\<in> Step a})\n            else gen_purge source_func u as ss)\"\n\ndefinition ipurge where\n  \"ipurge \\<equiv> gen_purge sources\"\n\nlemma ipurge_Nil:\n  \"ipurge u [] ss = []\"\n  by (auto simp: ipurge_def)\n\nlemma ipurge_Cons:\n  \"ipurge u (a#as) ss = (if (\\<exists>s\\<in>ss. dom a s \\<in> sources (a#as) s u)\n                         then a#ipurge u as (\\<Union>s\\<in>ss. {s'. (s,s') \\<in> Step a})\n                         else ipurge u as ss)\"\n  by (auto simp: ipurge_def)\n\nlemma gen_purge_shortens:\n  \"length (gen_purge sf u as ss) \\<le> length as\"\n  apply (induct as arbitrary: ss; clarsimp)\n  apply (rule le_trans)\n   apply assumption\n  apply simp\n  done\n\nlemma INT_cong':\n  assumes a: \"\\<And>x. Q x \\<Longrightarrow> P x = P' x\"\n  shows \"\\<Inter>{P x|x. Q x} = \\<Inter>{P' x|x. Q x}\"\n  by (auto simp: a)\n\n\ntext \\<open>Standard Noninterference\\<close>\ndefinition Noninterference :: bool where\n \"Noninterference \\<equiv> \\<forall>u as s. reachable s \\<longrightarrow> (obs_equiv s as s (ipurge u as {s}) u)\"\n\n\ntext \\<open>Strong Noninterference\\<close>\ndefinition Noninterference_strong :: bool where\n  \"Noninterference_strong \\<equiv> \\<forall>u as bs s. reachable s\n                                         \\<longrightarrow> ipurge u as {s} = ipurge u bs {s}\n                                         \\<longrightarrow> obs_equiv s as s bs u\"\n\n\nlemma obs_equiv_sym:\n  \"obs_equiv s as t bs u \\<Longrightarrow> obs_equiv t bs s as u\"\n  by (clarsimp simp: obs_equiv_def)\n\nlemma obs_equiv_trans:\n  \"\\<lbrakk> reachable t; obs_equiv s as t bs u; obs_equiv t bs x cs u \\<rbrakk>\n     \\<Longrightarrow> obs_equiv s as x cs u\"\n  apply (clarsimp simp: obs_equiv_def)\n  apply (cut_tac s=t and js=bs in reachable_enabled, assumption, blast)\n  done\n\nlemma Noninterference_Noninterference_strong:\n  \"Noninterference \\<Longrightarrow> Noninterference_strong\"\n  apply (clarsimp simp: Noninterference_def Noninterference_strong_def)\n  apply (drule_tac x=u in spec)\n  apply (frule_tac x=as in spec, drule_tac x=s in spec)\n  apply (drule_tac x=bs in spec, drule_tac x=s in spec)\n  apply clarsimp\n  apply (rule obs_equiv_trans)\n    apply assumption\n   apply assumption\n  apply (erule obs_equiv_sym)\n  done\n\n\ntext \\<open>\n  Noninfluence -- the combination of Noninterference and Nonleakage.\n  We add the assumption about equivalence wrt the scheduler's domain, as\n  is common in e.g. GVW.\n\\<close>\ndefinition Noninfluence :: bool where\n \"Noninfluence \\<equiv>\n    \\<forall>u as s t. reachable s \\<and> reachable t\n               \\<longrightarrow> s \\<approx>(sources as s u)\\<approx> t\n               \\<longrightarrow> s \\<sim>schedDomain\\<sim> t\n               \\<longrightarrow> obs_equiv s as t (ipurge u as {t}) u\"\n\ndefinition Noninfluence_strong  :: \"bool\"\nwhere\n \"Noninfluence_strong \\<equiv> \\<forall>u as bs s t. reachable s \\<and> reachable t\n                                      \\<longrightarrow> s \\<approx>(sources as s u)\\<approx> t\n                                      \\<longrightarrow> s \\<sim>schedDomain\\<sim> t\n                                      \\<longrightarrow> ipurge u as {s} = ipurge u bs {s}\n                                      \\<longrightarrow> obs_equiv s as t bs u\"\n\n\nlemma notin_policyI:\n  \"\\<lbrakk> dom a s \\<notin> sources (a # list) s u; \\<exists>s'. (s,s') \\<in> Step a \\<and> ua \\<in> sources list s' u \\<rbrakk>\n     \\<Longrightarrow> (dom a s,ua) \\<notin> policy\"\n  by (clarsimp simp: sources_Cons)\n\nlemma Noninfluence_strong_Noninterference_strong:\n  \"Noninfluence_strong \\<Longrightarrow> Noninterference_strong\"\n  apply (clarsimp simp: Noninfluence_strong_def Noninterference_strong_def)\n  apply (drule_tac x=u in spec, drule_tac x=as in spec, drule_tac x=bs in spec)\n  apply (fastforce simp: sameFor_dom_def uwr_refl)\n  done\n\nlemma Noninfluence_strong_Nonleakage:\n  \"Noninfluence_strong \\<Longrightarrow> Nonleakage\"\n  by (clarsimp simp: Noninfluence_strong_def Nonleakage_def)\n\n\ntext \\<open>This stronger condition is needed\n   to make the induction proof work for Noninterference. It can be viewed\n   as a generalisation of Noninfluence; hence its name here.\n\\<close>\ndefinition Noninfluence_gen :: bool where\n  \"Noninfluence_gen \\<equiv> \\<forall>u as s ts. reachable s \\<and> (\\<forall>t \\<in> ts. reachable t)\n                                   \\<longrightarrow> (\\<forall>t \\<in> ts. s \\<approx>(sources as s u)\\<approx> t)\n                                   \\<longrightarrow> (\\<forall>t \\<in> ts. s \\<sim>schedDomain\\<sim> t)\n                                   \\<longrightarrow> (\\<forall>t \\<in> ts. uwr_equiv s as t (ipurge u as ts) u)\"\n\ndefinition Noninfluence_uwr  :: bool where\n  \"Noninfluence_uwr \\<equiv> \\<forall>u as s t. reachable s \\<and> reachable t\n                                  \\<longrightarrow> s \\<approx>(sources as s u)\\<approx> t\n                                  \\<longrightarrow> s \\<sim>schedDomain\\<sim> t\n                                  \\<longrightarrow> uwr_equiv s as t (ipurge u as {t}) u\"\n\ndefinition Noninfluence_strong_uwr :: bool where\n  \"Noninfluence_strong_uwr \\<equiv> \\<forall>u as bs s t. reachable s \\<and> reachable t\n                                            \\<longrightarrow> s \\<approx>(sources as s u)\\<approx> t\n                                            \\<longrightarrow> s \\<sim>schedDomain\\<sim> t\n                                            \\<longrightarrow> ipurge u as {s} = ipurge u bs {s}\n                                            \\<longrightarrow> uwr_equiv s as t bs u\"\n\ndefinition output_consistent :: bool where\n  \"output_consistent \\<equiv> \\<forall>u s s'. s \\<sim>u\\<sim> s'  \\<longrightarrow> (out u s = out u s')\"\n\ndefinition confidentiality_u :: bool where\n  \"confidentiality_u \\<equiv> \\<forall>a u s t. reachable s \\<and> reachable t\n                                  \\<longrightarrow> s \\<sim>schedDomain\\<sim> t\n                                  \\<longrightarrow> ((dom a s \\<leadsto> u) \\<longrightarrow> s \\<sim>dom a s\\<sim> t)\n                                  \\<longrightarrow> s \\<sim>u\\<sim> t\n                                  \\<longrightarrow> (\\<forall>s' t'. (s,s') \\<in> Step a \\<and> (t,t') \\<in> Step a \\<longrightarrow> s' \\<sim>u\\<sim> t')\"\n\nlemma no_domain_visible_nondeterminism:\n  \"\\<lbrakk> confidentiality_u; reachable s; (s,s') \\<in> Step a; (s,s'') \\<in> Step a \\<rbrakk>\n     \\<Longrightarrow> s' \\<sim>d\\<sim> s''\"\n  apply (clarsimp simp: confidentiality_u_def)\n  apply (fastforce intro: uwr_refl)\n  done\n\ndefinition integrity_u :: bool where\n  \"integrity_u \\<equiv>\n     \\<forall>a u s. reachable s \\<longrightarrow> (dom a s,u) \\<notin> policy \\<longrightarrow> (\\<forall>s'. (s,s') \\<in> Step a \\<longrightarrow> s \\<sim>u\\<sim> s')\"\n\n(*<*)\n(* integrity_u actually guarantees this (seemingly) stronger condition *)\ndefinition integrity_u_more :: bool where\n  \"integrity_u_more \\<equiv> \\<forall>a u s. reachable s\n                               \\<longrightarrow> (dom a s,u) \\<notin> policy\n                               \\<longrightarrow> (\\<forall>s' t. s \\<sim>u\\<sim> t \\<and> (s,s') \\<in> Step a \\<longrightarrow> s' \\<sim>u\\<sim> t)\"\n\nlemma integrity_u_more:\n  \"integrity_u \\<Longrightarrow> integrity_u_more\"\n  apply (clarsimp simp: integrity_u_more_def integrity_u_def)\n  apply (blast dest: uwr_sym uwr_trans)\n  done\n(*>*)\n\nlemma integrity_uD:\n  \"\\<lbrakk> integrity_u; reachable s; (dom a s,u) \\<notin> policy; s \\<sim>u\\<sim> t; (s,s') \\<in> Step a \\<rbrakk>\n     \\<Longrightarrow> s' \\<sim>u\\<sim> t\"\n  apply (drule integrity_u_more)\n  apply (simp add: integrity_u_more_def)\n  done\n\ntext \\<open>\n  A weaker version of @{prop confidentiality_u} that, with\n  @{prop integrity_u}, implies it.\n\\<close>\ndefinition confidentiality_u_weak where\n  \"confidentiality_u_weak \\<equiv> \\<forall>a u s t. reachable s \\<and> reachable t\n                                       \\<longrightarrow> s \\<sim>schedDomain\\<sim> t\n                                       \\<longrightarrow> dom a s \\<leadsto> u\n                                       \\<longrightarrow> s \\<sim>(dom a s)\\<sim> t\n                                       \\<longrightarrow> s \\<sim>u\\<sim> t\n                                       \\<longrightarrow> (\\<forall>s' t'. (s,s') \\<in> Step a \\<and> (t,t') \\<in> Step a\n                                                    \\<longrightarrow> s' \\<sim>u\\<sim> t')\"\n\nlemma confidentiality_u_confidentiality_u_weak:\n  \"confidentiality_u \\<Longrightarrow> confidentiality_u_weak\"\n  apply (simp add: confidentiality_u_def confidentiality_u_weak_def)\n  apply blast\n  done\n\nlemma impCE':\n  \"\\<lbrakk> P \\<longrightarrow> Q; \\<lbrakk>P; Q\\<rbrakk> \\<Longrightarrow> R; \\<not> P \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n  by auto\n\nlemma confidentiality_u_weak:\n  \"\\<lbrakk> confidentiality_u_weak; integrity_u \\<rbrakk>\n     \\<Longrightarrow> confidentiality_u\"\n  apply (clarsimp simp: confidentiality_u_def)\n  apply (erule impCE')\n   apply (subst (asm) confidentiality_u_weak_def, blast)\n  apply (frule integrity_uD, simp+)\n  apply (drule_tac s=t and t=\"s'\" in integrity_uD)\n      apply assumption\n     apply (drule_tac e=a in schedIncludesCurrentDom)\n     apply simp\n    apply (blast intro: uwr_sym)\n   apply assumption\n  apply (erule uwr_sym)\n  done\n\nlemma obs_equivI:\n  \"\\<lbrakk> output_consistent; uwr_equiv s as t bs ob \\<rbrakk> \\<Longrightarrow> obs_equiv s as t bs ob\"\n  apply (clarsimp simp: obs_equiv_def)\n  apply (auto simp: uwr_equiv_def output_consistent_def)\n  done\n\nlemma Noninfluence_uwr_Noninfluence:\n  \"\\<lbrakk> output_consistent; Noninfluence_uwr \\<rbrakk> \\<Longrightarrow> Noninfluence\"\n  apply (clarsimp simp: Noninfluence_def)\n  apply (erule obs_equivI)\n  apply (auto simp: Noninfluence_uwr_def)\n  done\n\nlemma Noninfluence_strong_uwr_Noninfluence_strong:\n  \"\\<lbrakk> output_consistent; Noninfluence_strong_uwr \\<rbrakk> \\<Longrightarrow> Noninfluence_strong\"\n  apply (clarsimp simp: Noninfluence_strong_def)\n  apply (erule obs_equivI)\n  apply (auto simp: Noninfluence_strong_uwr_def)\n  done\n\nlemma sched_equiv_preserved:\n  \"\\<lbrakk> confidentiality_u; reachable s; reachable t;\n     s \\<sim>schedDomain\\<sim> t; (s,s') \\<in> Step a; (t,t') \\<in> Step a \\<rbrakk>\n     \\<Longrightarrow> s' \\<sim>schedDomain\\<sim> t'\"\n  apply (case_tac \"dom a s = schedDomain\")\n   apply (subst (asm) confidentiality_u_def)\n   apply (drule_tac x=a in spec)\n   apply (drule_tac x=schedDomain in spec)\n   apply (drule_tac x=s in spec)\n   apply (drule_tac x=t in spec)\n   apply simp\n  apply (subst (asm) confidentiality_u_def)\n  apply (blast intro: schedNotGlobalChannel)\n  done\n\nlemma sched_equiv_preserved_left:\n  \"\\<lbrakk> integrity_u; s \\<sim>schedDomain\\<sim> t;\n     dom a s \\<noteq> schedDomain; (s,s') \\<in> Step a; reachable s \\<rbrakk>\n     \\<Longrightarrow> s' \\<sim>schedDomain\\<sim> t\"\n  by (blast intro: integrity_uD schedNotGlobalChannel)\n\nlemma Noninfluence_gen_Noninterference:\n  \"\\<lbrakk> output_consistent; Noninfluence_gen \\<rbrakk> \\<Longrightarrow> Noninterference\"\n  apply (clarsimp simp: Noninterference_def Noninfluence_gen_def)\n  apply (erule_tac x=u in allE)\n  apply (erule_tac x=as in allE)\n  apply (erule_tac x=s in allE)\n  apply (erule_tac x=\"{s}\" in allE)\n  apply (clarsimp simp: sameFor_dom_def uwr_refl)\n  apply (blast intro: obs_equivI)\n  done\n\nlemma Noninfluence_gen_Noninfluence:\n  \"\\<lbrakk> output_consistent; Noninfluence_gen \\<rbrakk> \\<Longrightarrow> Noninfluence\"\n  apply (clarsimp simp: Noninfluence_def Noninfluence_gen_def)\n  apply (erule_tac x=u in allE)\n  apply (erule_tac x=as in allE)\n  apply (erule_tac x=s in allE)\n  apply (erule_tac x=\"{t}\" in allE)\n  apply (blast intro: obs_equivI)\n  done\n\nlemma Noninfluence_gen_Noninfluence_uwr:\n  \"Noninfluence_gen \\<Longrightarrow> Noninfluence_uwr\"\n  by (clarsimp simp: Noninfluence_uwr_def Noninfluence_gen_def)\n\nlemma Noninfluence_gen_Noninterference_strong:\n  \"\\<lbrakk> output_consistent; Noninfluence_gen \\<rbrakk> \\<Longrightarrow> Noninterference_strong\"\n  apply (rule Noninterference_Noninterference_strong)\n  apply (blast intro: Noninfluence_gen_Noninterference)\n  done\n\nend\n\n\nsubsection \\<open>Noninterference on enabled Step system : unwinding system\\<close>\n\nlocale enabled_Step_system = enabled_system A s0 + Step_system A s0\n  for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\"\n\n(* we define the unwinding conditions for any system *)\nlocale unwinding_system =\n  enabled_Step_system A s0 + noninterference_policy dom uwr policy out schedDomain\n  for A :: \"('a,'s,'e) data_type\"\n  and s0 :: \"'s\"\n  and dom :: \"'e \\<Rightarrow> 's \\<Rightarrow> 'd\"\n  and uwr :: \"'d \\<Rightarrow> ('s \\<times> 's) set\"\n  and policy :: \"('d \\<times> 'd) set\"\n  and out :: \"'d \\<Rightarrow> 's \\<Rightarrow> 'p\"\n  and schedDomain :: \"'d\"\n\nsublocale unwinding_system \\<subseteq> noninterference_system by unfold_locales\n\ncontext unwinding_system begin\n\nlemma sources_refl:\n  \"reachable s \\<Longrightarrow> u \\<in> sources as s u\"\n  apply (induct as arbitrary: s)\n   apply (simp add: sources_Nil)\n  apply (simp add: sources_Cons)\n  apply (frule_tac a=a in enabled_Step)\n  apply (auto simp: reachable_Step)\n  done\n\nlemma schedDomain_in_sources_Cons:\n  \"\\<lbrakk> reachable s; dom a s = schedDomain \\<rbrakk>\n     \\<Longrightarrow> dom a s \\<in> sources (a#as) s u\"\n  apply (unfold sources_Cons)\n  apply (erule ssubst)\n  apply (rule UnI2)\n  apply (clarsimp)\n  apply (rule_tac x=u in exI)\n  apply (safe)\n   apply (rule schedFlowsToAll)\n  apply (frule_tac a=a in enabled_Step)\n  apply (fastforce dest: sources_refl reachable_Step)\n  done\n\nlemma sources_eq':\n  \"confidentiality_u \\<and> s \\<sim>schedDomain\\<sim> t \\<and> reachable s \\<and> reachable t\n   \\<longrightarrow> sources as s u = sources as t u\"\nproof (induct as arbitrary: s t)\n  case Nil show ?case\n    by (simp add: sources_Nil)\nnext\n  case (Cons a as) show ?case\n    apply (clarsimp simp: sources_Cons)\n    apply (rule un_eq)\n     apply (simp only: Union_eq, simp only: UNION_eq[symmetric])\n     apply (rule Un_eq, clarsimp)\n       apply (metis \"Cons.hyps\"[rule_format] sched_equiv_preserved reachable_Step)\n      apply (fastforce intro: enabled_Step)\n     apply (fastforce intro: enabled_Step)\n    apply (clarsimp simp: schedIncludesCurrentDom)\n    apply (rule Collect_cong)\n    apply (rule conj_cong, rule refl)\n    apply (rule iff_exI)\n    apply (metis \"Cons.hyps\"[rule_format] sched_equiv_preserved reachable_Step enabled_Step)\n    done\nqed\n\nlemma sources_eq:\n  \"\\<lbrakk> confidentiality_u; s \\<sim>schedDomain\\<sim> t; reachable s; reachable t \\<rbrakk>\n     \\<Longrightarrow> sources as s u = sources as t u\"\n  by (rule sources_eq'[rule_format], simp)\n\nlemma sameFor_sources_dom:\n  \"\\<lbrakk> s \\<approx>(sources (a#as) s u)\\<approx> t; dom a s \\<leadsto> x; x \\<in> sources as s' u; (s,s') \\<in> Step a \\<rbrakk>\n     \\<Longrightarrow> s \\<sim>(dom a s)\\<sim> t\"\n  apply (simp add: sameFor_dom_def)\n  apply (erule bspec)\n  apply (subst sources_Cons)\n  apply (rule UnI2)\n  apply blast\n  done\n\nlemma sources_unwinding_step:\n  \"\\<lbrakk> s \\<approx>(sources (a#as) s u)\\<approx> t; s \\<sim>schedDomain\\<sim> t; confidentiality_u;\n     (s,s') \\<in> Step a; (t,t') \\<in> Step a; reachable s; reachable t \\<rbrakk>\n     \\<Longrightarrow> s' \\<approx>(sources as s' u)\\<approx> t'\"\n  apply (clarsimp simp: sameFor_dom_def sources_Cons)\n  apply (subst (asm) confidentiality_u_def)\n  apply (drule_tac x=a in spec)\n  apply (drule_tac x=ua in spec)\n  apply (drule_tac x=s in spec)\n  apply (drule_tac x=t in spec)\n  apply (fastforce intro: sameFor_sources_dom)\n  done\n\nlemma ipurge_eq'_helper:\n  \"\\<lbrakk> s \\<in> ss; dom a s \\<in> sources (a # as) s u; \\<forall>s\\<in>ts. dom a s \\<notin> sources (a # as) s u;\n     (\\<forall>s t. s \\<in> ss \\<and> t \\<in> ts \\<longrightarrow> s \\<sim>schedDomain\\<sim> t \\<and> reachable s \\<and> reachable t);\n     t \\<in> ts; confidentiality_u \\<rbrakk>\n     \\<Longrightarrow> False\"\n  apply (cut_tac s=s and t=t and as=as and u=u in sources_eq, simp+)\n  apply (clarsimp  simp: sources_Cons | safe)+\n   apply (rename_tac s')\n   apply (drule_tac x=t in bspec, simp)\n   apply clarsimp\n   apply (cut_tac s=t in enabled_Step, simp)\n   apply (erule exE, rename_tac t')\n   apply (drule_tac x=\"sources as t' u\" in spec)\n   apply (cut_tac s=s' and t=t' and u=u in sources_eq, simp+)\n      apply (fastforce elim: sched_equiv_preserved)\n     apply (fastforce intro: reachable_Step)\n    apply (fastforce intro: reachable_Step)\n   apply (fastforce simp: schedIncludesCurrentDom)\n  apply (drule_tac x=t in bspec, simp)\n  apply clarsimp\n  apply (rename_tac v s')\n  apply (drule_tac x=v in spec, erule impE, fastforce simp: schedIncludesCurrentDom)\n  apply (cut_tac s=t in enabled_Step[where a=a], simp, clarsimp, rename_tac t')\n  apply (cut_tac s=s' and t=t' and u=u in sources_eq, simp+)\n     apply (fastforce elim: sched_equiv_preserved)\n    apply (fastforce intro: reachable_Step)\n   apply (fastforce intro: reachable_Step)\n  apply (fastforce simp: schedIncludesCurrentDom)\n  done\n\nlemma ipurge_eq':\n  \"(\\<forall>s t. s\\<in>ss \\<and> t\\<in>ts \\<longrightarrow> s \\<sim>schedDomain\\<sim> t \\<and> reachable s \\<and> reachable t) \\<and>\n   (\\<exists>s. s \\<in> ss) \\<and> (\\<exists>t. t \\<in> ts) \\<and> confidentiality_u\n   \\<longrightarrow> ipurge u as ss = ipurge u as ts\"\nproof (induct as arbitrary: ss ts)\n  case Nil show ?case\n    apply (simp add: ipurge_def)\n    done\nnext\n  case (Cons a as) show ?case\n    apply (clarsimp simp: ipurge_Cons schedIncludesCurrentDom)\n    apply (intro conjI impI)\n       apply (rule \"Cons.hyps\"[rule_format])\n       apply clarsimp\n       apply (metis sched_equiv_preserved reachable_Step enabled_Step)\n      apply clarsimp\n      apply (drule ipurge_eq'_helper, simp+)[1]\n     apply clarsimp\n     apply (drule ipurge_eq'_helper, (simp add: uwr_sym)+)[1]\n    apply (rule \"Cons.hyps\"[rule_format], auto)\n    done\nqed\n\nlemma ipurge_eq:\n  \"\\<lbrakk> s \\<sim>schedDomain\\<sim> t; reachable s; reachable t; confidentiality_u \\<rbrakk>\n     \\<Longrightarrow> ipurge u as {s} = ipurge u as {t}\"\n  by (rule ipurge_eq'[rule_format], simp)\n\nlemma Noninfluence_uwr_Noninfluence_strong_uwr:\n  \"\\<lbrakk> confidentiality_u; Noninfluence_uwr \\<rbrakk> \\<Longrightarrow> Noninfluence_strong_uwr\"\n  apply (clarsimp simp: Noninfluence_uwr_def Noninfluence_strong_uwr_def)\n  apply (frule_tac s=s and t=t and as=as and u=u in ipurge_eq)\n     apply assumption+\n  apply (frule_tac s=s and t=t and as=bs and u=u in ipurge_eq)\n     apply assumption+\n  apply clarsimp\n  apply (drule_tac x=u in spec)\n  apply (frule_tac x=as in spec)\n  apply (drule_tac x=s in spec, drule_tac x=t in spec)\n  apply (drule_tac x=bs in spec)\n  apply (drule_tac x=t in spec, drule_tac x=t in spec)\n  apply clarsimp\n  apply (rule_tac t=t in uwr_equiv_trans)\n    apply assumption\n   apply assumption\n  apply (rule uwr_equiv_sym)\n  apply (clarsimp simp: sameFor_dom_def uwr_refl)\n  done\n\nlemma Noninfluence_Noninfluence_strong:\n  \"\\<lbrakk> confidentiality_u; Noninfluence \\<rbrakk> \\<Longrightarrow> Noninfluence_strong\"\n  apply (clarsimp simp: Noninfluence_def Noninfluence_strong_def)\n  apply (frule_tac s=s and t=t and as=as and u=u in ipurge_eq)\n     apply assumption+\n  apply (frule_tac s=s and t=t and as=bs and u=u in ipurge_eq)\n     apply assumption+\n  apply clarsimp\n  apply (drule_tac x=u in spec)\n  apply (frule_tac x=as in spec)\n  apply (drule_tac x=s in spec, drule_tac x=t in spec)\n  apply (drule_tac x=bs in spec)\n  apply (drule_tac x=t in spec, drule_tac x=t in spec)\n  apply clarsimp\n  apply (rule_tac t=t in obs_equiv_trans)\n    apply assumption\n   apply assumption\n  apply (rule obs_equiv_sym)\n  apply (clarsimp simp: sameFor_dom_def uwr_refl)\n  done\n\nlemma dom_in_sources_Cons:\n  \"\\<lbrakk> confidentiality_u; reachable s; reachable t; s \\<approx>(sources (a#as) s u)\\<approx> t;\n     s \\<sim>schedDomain\\<sim> t; (dom a s \\<in> sources (a#as) s u) \\<rbrakk>\n     \\<Longrightarrow> (dom a t \\<in> sources (a#as) t u)\"\n  apply (subgoal_tac \"dom a s = dom a t\")\n   apply (fastforce dest: sources_eq)\n  apply (blast intro: schedIncludesCurrentDom)\n  done\n\nlemma uwr_equiv_Cons_bothI:\n  \"\\<lbrakk> reachable s; reachable t;\n      \\<forall>s' t'. (s,s') \\<in> Step a \\<and> (t,t') \\<in> Step b \\<longrightarrow> uwr_equiv s' as t' bs u \\<rbrakk>\n     \\<Longrightarrow> uwr_equiv s (a # as) t (b # bs) u\"\n  by (fastforce simp: uwr_equiv_def execution_Run reachable_Step)\n\nlemma uwr_equiv_Cons_leftI:\n  \"\\<lbrakk> reachable s; \\<forall>s'. (s,s') \\<in> Step a \\<longrightarrow> uwr_equiv s' as t bs u \\<rbrakk>\n     \\<Longrightarrow> uwr_equiv s (a # as) t bs u\"\n  by (fastforce simp: uwr_equiv_def execution_Run reachable_Step)\n\nlemma notin_policyI':\n  \"\\<lbrakk> reachable s; dom a s \\<notin> sources (a # list) s u; (s,s') \\<in> Step a; ua \\<in> sources list s' u \\<rbrakk>\n     \\<Longrightarrow> (dom a s,ua) \\<notin> policy\"\n  apply (rule notin_policyI)\n   apply auto\n  done\n\nlemma sources_eq_Step:\n  \"\\<lbrakk> integrity_u; confidentiality_u; reachable s; (s,s') \\<in> Step a; dom a s \\<noteq> schedDomain \\<rbrakk>\n     \\<Longrightarrow> (sources as s' u) = (sources as s u)\"\n  apply (rule sources_eq, simp+)\n    apply (rule_tac t=s and s=s and a=a in sched_equiv_preserved_left)\n        apply (auto simp add: uwr_refl reachable_Step)\n  done\n\nlemma sources_equiv_preserved_left:\n  \"\\<lbrakk> integrity_u; confidentiality_u; reachable s; reachable t; s \\<sim>schedDomain\\<sim> t;\n     dom a s \\<notin> sources (a#as) s u; s \\<approx>sources (a#as) s u\\<approx> t; (s,s') \\<in> Step a;\n     dom a s \\<noteq> schedDomain \\<rbrakk>\n     \\<Longrightarrow> s' \\<approx>sources as s' u\\<approx> t\"\n  apply (clarsimp simp: sameFor_dom_def)\n  apply (rename_tac v)\n  apply (case_tac \"(dom a s, v) \\<in> policy\")\n   apply (fastforce simp: sources_Cons)\n  apply (fastforce dest: integrity_uD simp: sources_Cons)\n  done\n\nlemma Noninfluence_gen:\n  \"\\<lbrakk> confidentiality_u; integrity_u \\<rbrakk> \\<Longrightarrow> Noninfluence_gen\"\n  apply (subst Noninfluence_gen_def)\n  apply (intro allI)\nproof -\n  assume conf: \"confidentiality_u\"\n  assume integ: \"integrity_u\"\n  fix u as s ts\n  show \"reachable s \\<and> Ball ts reachable\n        \\<longrightarrow> Ball ts (sameFor_dom s (sources as s u))\n        \\<longrightarrow> (\\<forall>t\\<in>ts. s \\<sim>schedDomain\\<sim> t)\n        \\<longrightarrow> (\\<forall>t\\<in>ts. uwr_equiv s as t (ipurge u as ts) u)\"\n  proof(induct as arbitrary: s ts)\n    case Nil\n    show ?case\n      apply (clarsimp simp: sameFor_dom_def ipurge_Nil sources_Nil uwr_equiv_def)\n      apply (clarsimp simp: execution_Run)\n      done\n  next\n    case (Cons a as)\n    show ?case\n      apply (clarsimp simp: ipurge_Cons | safe)+\n       apply (rule uwr_equiv_Cons_bothI)\n         apply assumption\n        apply blast\n       apply (clarify)\n       apply (rename_tac ta tb s' tb')\n       apply (rule Cons.hyps[rule_format])\n          apply (blast intro: reachable_Step)\n         apply (clarsimp)\n         apply (rename_tac tc' tc)\n      using conf apply (rule_tac s=s and t=tc and a=a in sources_unwinding_step, simp+)[1]\n        apply (clarsimp, rename_tac tc' tc)\n        apply (rule sched_equiv_preserved[OF conf], (auto simp: sources_refl))[1]\n       apply blast\n      apply (rename_tac ta)\n      apply (rule uwr_equiv_Cons_leftI, blast)\n      apply (clarsimp, rename_tac s')\n      apply (case_tac \"dom a s = schedDomain\")\n       apply (cut_tac s=s and a=a and as=as and u=u in schedDomain_in_sources_Cons, assumption+)\n       apply (metis schedIncludesCurrentDom sources_eq[OF conf])\n      apply (rule Cons.hyps[rule_format])\n         apply (blast intro: reachable_Step)\n        apply (rename_tac tb)\n        apply (rule_tac a=a in sources_equiv_preserved_left[OF integ conf], simp+)\n           apply (fastforce simp: schedIncludesCurrentDom sources_eq[OF conf])\n          apply blast\n         apply assumption\n        apply assumption\n       apply (rule_tac s=s and a=a in sched_equiv_preserved_left[OF integ], simp+)\n      done\n  qed\nqed\n\nlemma Nonleakage_gen:\n  \"confidentiality_u \\<Longrightarrow> Nonleakage_gen\"\n  apply (subst Nonleakage_gen_def)\n  apply (rule allI)\n  apply (induct_tac as)\n   apply (simp add: sources_Nil uwr_equiv_def execution_Run sameFor_dom_def)\n  apply (clarsimp)\n  apply (rule uwr_equiv_Cons_bothI)\n    apply assumption\n   apply assumption\n  apply clarsimp\n  apply (drule_tac x=s' in spec, drule_tac x=u in spec, drule_tac x=t' in spec)\n  apply (clarsimp simp: reachable_Step)\n  apply (erule impE)\n   apply (blast intro: sched_equiv_preserved)\n  apply (erule mp)\n  apply (blast intro: sources_unwinding_step)\n  done\n\nlemma Noninterference:\n  \"\\<lbrakk> confidentiality_u_weak; output_consistent; integrity_u \\<rbrakk>\n     \\<Longrightarrow> Noninterference\"\n  apply (rule Noninfluence_gen_Noninterference)\n   apply assumption\n  apply (blast intro: Noninfluence_gen confidentiality_u_weak)\n  done\n\nlemma Noninterference_strong:\n  \"\\<lbrakk> confidentiality_u_weak; output_consistent; integrity_u \\<rbrakk>\n     \\<Longrightarrow> Noninterference_strong\"\n  apply (rule Noninfluence_gen_Noninterference_strong)\n   apply assumption\n  apply (blast intro: Noninfluence_gen confidentiality_u_weak)\n  done\n\nlemma Noninfluence:\n  \"\\<lbrakk> confidentiality_u_weak; output_consistent; integrity_u \\<rbrakk>\n     \\<Longrightarrow> Noninfluence\"\n  apply (rule Noninfluence_gen_Noninfluence)\n   apply assumption\n  apply (blast intro: Noninfluence_gen confidentiality_u_weak)\n  done\n\nlemma Noninfluence_strong:\n  \"\\<lbrakk> confidentiality_u_weak; output_consistent; integrity_u \\<rbrakk>\n     \\<Longrightarrow> Noninfluence_strong\"\n  apply (rule Noninfluence_Noninfluence_strong)\n   apply (blast intro: confidentiality_u_weak)\n  apply (blast intro: Noninfluence)\n  done\n\n\nlemma Noninfluence_uwr:\n  \"\\<lbrakk> confidentiality_u_weak; integrity_u \\<rbrakk>\n     \\<Longrightarrow> Noninfluence_uwr\"\n  apply (rule Noninfluence_gen_Noninfluence_uwr)\n  apply (blast intro: Noninfluence_gen confidentiality_u_weak)\n  done\n\nlemma Noninfluence_strong_uwr:\n  \"\\<lbrakk> confidentiality_u_weak; integrity_u \\<rbrakk>\n     \\<Longrightarrow> Noninfluence_strong_uwr\"\n  apply (rule Noninfluence_uwr_Noninfluence_strong_uwr)\n   apply (blast intro: confidentiality_u_weak)\n  apply (blast intro: Noninfluence_uwr)\n  done\n\nlemma sources_Step:\n  \"\\<lbrakk> reachable s; (dom a s, u) \\<notin> policy \\<rbrakk>\n     \\<Longrightarrow> sources [a] s u = {u}\"\n  by (auto simp: sources_Cons sources_Nil enabled_Step dest: enabled_Step)\n\nlemma sources_Step_2:\n  \"\\<lbrakk> reachable s; (dom a s, u) \\<in> policy \\<rbrakk>\n     \\<Longrightarrow> sources [a] s u = {dom a s,u}\"\n  by (auto simp: sources_Cons sources_Nil enabled_Step dest: enabled_Step)\n\nlemma execution_Nil:\n  \"reachable s \\<Longrightarrow> execution A s [] = {s}\"\n  by (simp add: execution_Run)\n\nlemma Noninfluence_gen_confidentiality_u_weak:\n  \"Noninfluence_gen \\<Longrightarrow> confidentiality_u_weak\"\n  apply (clarsimp simp: Noninfluence_gen_def confidentiality_u_weak_def)\n  apply (drule_tac x=u in spec, drule_tac x=\"[a]\" in spec)\n  apply (drule_tac x=s in spec, drule_tac x=\"{t}\" in spec)\n  apply (simp add: sources_Step_2 sameFor_dom_def uwr_equiv_def Step_def\n                   ipurge_Cons ipurge_Nil schedIncludesCurrentDom\n            split: if_splits)\n  done\n\nlemma Noninfluence_strong_uwr_confidentiality_u_weak:\n  \"Noninfluence_strong_uwr \\<Longrightarrow> confidentiality_u_weak\"\n  apply (clarsimp simp: Noninfluence_strong_uwr_def confidentiality_u_weak_def)\n  apply (drule_tac x=u in spec, drule_tac x=\"[a]\" in spec, drule_tac x=\"[a]\" in spec)\n  apply (drule_tac x=s in spec, drule_tac x=t in spec)\n  apply (simp add: sources_Step_2 sameFor_dom_def uwr_equiv_def Step_def)\n  done\n\nlemma Nonleakage_gen_confidentiality_u:\n  \"Nonleakage_gen \\<Longrightarrow> confidentiality_u\"\n  apply (clarsimp simp: Nonleakage_gen_def confidentiality_u_def)\n  apply (drule_tac x=\"[a]\" in spec, drule_tac x=s in spec)\n  apply (drule_tac x=u in spec, drule_tac x=t in spec)\n  apply (case_tac \"dom a s \\<leadsto> u\")\n   apply (simp add: sources_Step_2 uwr_equiv_def sameFor_dom_def Step_def)\n  apply (simp add: sources_Step uwr_equiv_def sameFor_dom_def Step_def)\n  done\n\nlemma Nonleakage_gen_equiv_confidentiality_u:\n  \"Nonleakage_gen = confidentiality_u\"\n  by (blast intro: Nonleakage_gen_confidentiality_u Nonleakage_gen)\n\nlemma non_sched_doms_cannot_schedule:\n  \"\\<lbrakk> integrity_u; reachable s; dom a s \\<noteq> schedDomain; (s,s') \\<in> Step a \\<rbrakk>\n     \\<Longrightarrow> s \\<sim>schedDomain\\<sim> s'\"\n  apply (drule_tac u=schedDomain in integrity_uD)\n      apply assumption\n     apply (erule contrapos_nn)\n     apply (erule schedNotGlobalChannel)\n    apply (rule uwr_refl)\n   apply assumption\n  apply (erule uwr_sym)\n  done\n\n\ntext \\<open>\n   In systems with just a single event, @{prop integrity_u} is a very strong\n   condition. It implies that once the scheduler is not\n   running, it can never run again.\n\n   This is one explanation for why seL4 (whose automaton has only a single\n   event) doesn't satisfy @{prop integrity_u}.\n\\<close>\nlemma integrity_u_and_single_event_systems:\n  \"\\<lbrakk> integrity_u; reachable s; dom a s \\<noteq> schedDomain; s' \\<in> execution A s as; \\<forall>y. y = a \\<rbrakk>\n     \\<Longrightarrow> dom e s' \\<noteq> schedDomain\"\n  apply (frule_tac x=e in spec)\n  apply (erule ssubst)\n  apply (rule_tac P=\"\\<lambda>x. x \\<noteq> schedDomain\" in subst[rotated])\n   apply assumption\n  apply (induct as arbitrary: s s' a rule: rev_induct)\n   apply (simp add: execution_Run)\n  apply (simp add: execution_Run)\n  apply (drule Run_mid)\n  apply (erule exE, rename_tac t)\n  apply (drule_tac x=s in meta_spec)\n  apply (drule_tac x=t in meta_spec)\n  apply (drule_tac x=a in meta_spec)\n  apply simp\n  apply (rule schedIncludesCurrentDom)\n  apply (rule non_sched_doms_cannot_schedule)\n     apply assumption\n    apply (rule reachable_execution)\n     apply assumption\n    apply (fastforce simp: execution_Run)\n   apply assumption\n  apply (drule_tac x=x in spec)\n  apply blast\n  done\n\nend\n\n\nsubsection \\<open>Complete unwinding system\\<close>\n\ntext \\<open>The unwinding conditions are not only sound but also complete when policy is reflexive\\<close>\nlocale complete_unwinding_system = unwinding_system +\n  assumes policy_refl: \"(u,u) \\<in> policy\"\nbegin\n\nlemma Noninfluence_gen_integrity_u:\n  \"Noninfluence_gen \\<Longrightarrow> integrity_u\"\n  apply (clarsimp simp: Noninfluence_gen_def integrity_u_def)\n  apply (drule_tac x=u in spec, drule_tac x=\"[a]\" in spec)\n  apply (drule_tac x=s in spec, drule_tac x=\"{s}\" in spec)\n  apply (simp add: sources_Step sameFor_dom_def uwr_equiv_def Step_def ipurge_Cons ipurge_Nil\n                   uwr_refl policy_refl execution_Nil uwr_sym\n            split: if_splits )\n  done\n\nlemma Noninfluence_strong_uwr_integrity_u:\n  \"Noninfluence_strong_uwr \\<Longrightarrow> integrity_u\"\n  apply (clarsimp simp: Noninfluence_strong_uwr_def integrity_u_def)\n  apply (drule_tac x=u in spec, drule_tac x=\"[a]\" in spec, drule_tac x=\"[]\" in spec)\n  apply (drule_tac x=s in spec, drule_tac x=s in spec)\n  apply (simp add: sources_Step sameFor_dom_def uwr_refl\n                   uwr_equiv_def Step_def ipurge_Cons ipurge_Nil\n            split: if_splits)\n   apply (simp add: policy_refl)\n  apply (simp add: execution_Nil)\n  apply (blast intro: uwr_sym)\n  done\n\ntext \\<open>\n   @{prop Noninfluence_gen} actually turns out to be equivalent to @{prop Noninfluence_strong_uwr},\n   when the policy is reflexive. So the two unwinding conditions for integrity\n   and confidentiality actually turn out to be sound and sufficient for the\n   condition we were using them to prove in the first place.\n\\<close>\nlemma Noninfluence_gen_equiv_Noninfluence_strong_uwr:\n  \"Noninfluence_gen = Noninfluence_strong_uwr\"\n  apply (rule iffI)\n   apply (rule Noninfluence_strong_uwr)\n    apply (erule Noninfluence_gen_confidentiality_u_weak)\n   apply (erule Noninfluence_gen_integrity_u)\n  apply (rule Noninfluence_gen)\n   apply (rule confidentiality_u_weak)\n    apply (erule Noninfluence_strong_uwr_confidentiality_u_weak)\n   apply (erule Noninfluence_strong_uwr_integrity_u)+\n  done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/infoflow/Noninterference_Base.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3256774323330271}}
{"text": "theory System_scheduler1\n  imports System_scheduler\nbegin\n\n\n\n\nfun tdsch2' :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> real \\<Rightarrow> real \\<Rightarrow>state \\<Rightarrow> estate \\<Rightarrow> state \\<Rightarrow> real \\<Rightarrow> real \\<Rightarrow> state \\<Rightarrow> estate \\<Rightarrow> state \\<Rightarrow> estate \\<Rightarrow> state \\<Rightarrow> estate tassn\" where\n  \"tdsch2' k2 k1 0 pd2 pc2 dis_s2 (Task st2 ent2 t2) task_s2 pd1 pc1 dis_s1 (Task st1 ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow> (emp\\<^sub>t tr)\"\n\n| \"tdsch2' 0 (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task st2 ent2 t2) task_s2 pd1 pc1 dis_s1 (Task WAIT ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow> pd1 - dis_s1 CHR ''t'' = 0 \\<and>\n   tdsch2' 0 k1' (Suc kk') pd2 pc2 dis_s2 (Task st2 ent2 t2) task_s2 pd1 pc1 (dis_s1(CHR ''t'' := 0)) (Task READY 0 t1) (task_s1(CHR ''t'' := 0)) (Sch p rn rp) s tr\"\n\n| \"tdsch2' 0 (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task st2 ent2 t2) task_s2 pd1 pc1 dis_s1 (Task READY ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow> (if rn \\<noteq> - 1 then False else\n  tdsch2' 0 k1' kk' pd2 pc2 dis_s2 (Task st2 ent2 t2) task_s2 pd1 pc1 dis_s1 (Task RUNNING (Suc 0) t1) (task_s1(CHR ''c'' := up_ent_c ent1 (task_s1 CHR ''c''))) (Sch p 1 2) (s(CHR ''p'' := 2)) tr)\"\n\n| \"tdsch2' 0 (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task st2 ent2 t2) task_s2 pd1 pc1 dis_s1 (Task RUNNING ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow> (if length p > 0 then False else\n  tdsch2' 0 k1' kk' pd2 pc2 dis_s2 (Task st2 ent2 t2) task_s2 pd1 pc1 dis_s1 (Task WAIT ent1 t1) task_s1 (Sch [] (- 1) (- 1)) s tr)\"\n\n| \"tdsch2' (Suc k2') 0 (Suc kk') pd2 pc2 dis_s2 (Task WAIT ent2 t2) task_s2 pd1 pc1 dis_s1 (Task st1 ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow> (pd2 - dis_s2 CHR ''t'' = 0 \\<and>\n  tdsch2' k2' 0 (Suc kk') pd2 pc2 (dis_s2(CHR ''t'' := 0)) (Task READY 0 t2) (task_s2(CHR ''t'' := 0)) pd1 pc1 dis_s1 (Task st1 ent1 t1) task_s1 (Sch p rn rp) s tr)\"\n\n| \"tdsch2' (Suc k2') 0 (Suc kk') pd2 pc2 dis_s2 (Task READY ent2 t2) task_s2 pd1 pc1 dis_s1 (Task st1 ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow>\n  (\\<up>(rn = -1 \\<and> 1 > rp) \\<and>\\<^sub>t\n  tdsch2' k2' 0 kk' pd2 pc2 dis_s2 (Task RUNNING (Suc 0) t2) (task_s2(CHR ''c'' := up_ent_c ent2 (task_s2 CHR ''c''))) pd1 pc1 dis_s1 (Task st1 ent1 t1) task_s1 (Sch p 2 1) (s(CHR ''p'' := 1))) tr \\<or>\n  (\\<up>(rp \\<ge> 1 \\<and> kk'> 0 \\<and> pd2 - task_s2 CHR ''t'' = 0) \\<and>\\<^sub>t\n  tdsch2' k2' 0 (kk'-1) pd2 pc2 (dis_s2(CHR ''t'' := pd2)) (Task WAIT ent2 1) (task_s2(CHR ''t'' := pd2)) pd1 pc1 dis_s1 (Task st1 ent1 t1) task_s1 (Sch (del_proc (p @ [(1, 2)]) 2) rn rp)  (s(CHR ''p'' := 1))) tr\"\n\n| \"tdsch2' (Suc k2') 0 (Suc kk') pd2 pc2 dis_s2 (Task RUNNING ent2 t2) task_s2 pd1 pc1 dis_s1 (Task st1 ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow>\n  (\\<up>(p = []) \\<and>\\<^sub>t  tdsch2' k2' 0  kk' pd2 pc2 dis_s2 (Task WAIT ent2 t2) task_s2 pd1 pc1 dis_s1 (Task st1 ent1 t1) task_s1 (Sch [] (- 1) (- 1)) s) tr\"\n\n| \"tdsch2' (Suc k2') (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task WAIT ent2 t2) task_s2 pd1 pc1 dis_s1 (Task WAIT ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow> \n  (wait_orig_assn (pd1 - dis_s1 CHR ''t'')\n     (\\<lambda>t. ParState (ParState (EState (Task WAIT ent2 t2, task_s2)) (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\n           (ParState (ParState (EState (Task WAIT ent1 t1, task_s1)) (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + t))))\n             (EState (Sch p rn rp, s))))\n     ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1, dispatch_ch 2}) \n      (tdsch2' (Suc k2') (k1') (Suc kk') pd2 pc2 (dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t''))) (Task WAIT ent2 t2) task_s2 pd1 pc1 (dis_s1(CHR ''t'' := 0)) (Task READY 0 t1) (task_s1(CHR ''t'' := 0)) (Sch p rn rp) s)) tr\n\\<or> (wait_orig_assn (pd2 - dis_s2 CHR ''t'')\n     (\\<lambda>t. ParState (ParState (EState (Task WAIT ent2 t2, task_s2)) (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\n           (ParState (ParState (EState (Task WAIT ent1 t1, task_s1)) (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + t))))\n             (EState (Sch p rn rp, s))))\n     ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1, dispatch_ch 2}) \n      (tdsch2' (k2') (Suc k1') (Suc kk') pd2 pc2 (dis_s2(CHR ''t'' := 0)) (Task READY 0 t2) (task_s2(CHR ''t'' := 0)) pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) (Task WAIT ent1 t1) task_s1 (Sch p rn rp) s)) tr\n\\<or> (wait_orig_assn (pd2 - dis_s2 CHR ''t'')\n     (\\<lambda>t. ParState (ParState (EState (Task WAIT ent2 t2, task_s2)) (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\n           (ParState (ParState (EState (Task WAIT ent1 t1, task_s1)) (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + t))))\n             (EState (Sch p rn rp, s))))\n     ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1, dispatch_ch 2}) \n      (tdsch2' (k2') (k1') (Suc kk') pd2 pc2 (dis_s2(CHR ''t'' := 0)) (Task READY 0 t2) (task_s2(CHR ''t'' := 0)) pd1 pc1 (dis_s1(CHR ''t'' := 0)) (Task READY 0 t1) (task_s1(CHR ''t'' := 0)) (Sch p rn rp) s)) tr\"\n\n|\"tdsch2' (Suc k2') (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task WAIT ent2 t2) task_s2 pd1 pc1 dis_s1 (Task READY ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow> \n  (\\<up>(pd2 = dis_s2 CHR ''t'') \\<and>\\<^sub>t \n  tdsch2' (k2') (Suc k1') (Suc kk') pd2 pc2 (dis_s2(CHR ''t'' := 0)) (Task READY 0 t2) (task_s2(CHR ''t'' := 0)) pd1 pc1 dis_s1 (Task READY ent1 t1) task_s1 (Sch p rn rp) s) tr\n\\<or> (\\<up>(pd2 > dis_s2 CHR ''t'' \\<and> rn = -1) \\<and>\\<^sub>t \n  tdsch2' (Suc k2') k1' kk' pd2 pc2 dis_s2 (Task WAIT ent2 t2) task_s2 pd1 pc1 dis_s1 (Task RUNNING (Suc 0) 2) (task_s1(CHR ''c'' := up_ent_c ent1 (task_s1 CHR ''c''))) (Sch p 1 2) (s(CHR ''p'' := 2))) tr\"\n\n|\"tdsch2' (Suc k2') (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task WAIT ent2 t2) task_s2 pd1 pc1 dis_s1 (Task RUNNING ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow>\n  (\\<up>(min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') < pd2 - dis_s2 CHR ''t'' ) \\<and>\\<^sub>t \n   wait_orig_assn (min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))\n     (\\<lambda>t. ParState (ParState (EState (Task WAIT ent2 t2, task_s2)) (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\n           (ParState\n             (ParState (EState (Task RUNNING ent1 t1, task_s1(CHR ''t'' := task_s1 CHR ''t'' + t, CHR ''c'' := task_s1 CHR ''c'' + t)))\n               (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + t))))\n             (EState (Sch p rn rp, s))))\n     ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 2, preempt_ch 1})\n     (tdsch2' (Suc k2') k1' kk' pd2 pc2 (dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))) (Task WAIT ent2 t2) task_s2 \n                                pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))) (Task WAIT ent1 t1)\n         (task_s1\n          (CHR ''t'' := task_s1 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''),\n           CHR ''c'' := task_s1 CHR ''c'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')))\n         (Sch [] (- 1) (- 1)) s)) tr \\<or>\n  (\\<up>(min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') \\<ge> pd2 - dis_s2 CHR ''t'' ) \\<and>\\<^sub>t \n   wait_orig_assn (pd2 - dis_s2 CHR ''t'')\n     (\\<lambda>t. ParState (ParState (EState (Task WAIT ent2 t2, task_s2)) (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\n           (ParState\n             (ParState (EState (Task RUNNING ent1 t1, task_s1(CHR ''t'' := task_s1 CHR ''t'' + t, CHR ''c'' := task_s1 CHR ''c'' + t)))\n               (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + t))))\n             (EState (Sch p rn rp, s))))\n     ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 2, preempt_ch 1}) \n     (tdsch2' k2' (Suc k1') (Suc kk') pd2 pc2 (dis_s2(CHR ''t'' := 0)) (Task READY 0 t2) (task_s2(CHR ''t'' := 0)) \n                                      pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) (Task RUNNING ent1 t1) (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''))) \n          (Sch p rn rp) s )) tr  \"\n\n|\"tdsch2' (Suc k2') (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task READY ent2 t2) task_s2 pd1 pc1 dis_s1 (Task WAIT ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow> \n  (\\<up>(pd1 = dis_s1 CHR ''t'') \\<and>\\<^sub>t \n  tdsch2' (Suc k2') k1' (Suc kk') pd2 pc2 dis_s2 (Task READY ent2 t2) task_s2 pd1 pc1 (dis_s1(CHR ''t'' := 0)) (Task READY 0 t1) (task_s1(CHR ''t'' := 0)) (Sch p rn rp) s ) tr \\<or>\n  (\\<up>(pd1 > dis_s1 CHR ''t'') \\<and>\\<^sub>t \n  tdsch2' k2' (Suc k1') kk' pd2 pc2 dis_s2 (Task RUNNING (Suc 0) t2) (task_s2(CHR ''c'' := up_ent_c ent2 (task_s2 CHR ''c''))) pd1 pc1 dis_s1 (Task WAIT ent1 t1) task_s1 (Sch p 2 1) (s(CHR ''p'' := 1))) tr\"\n\n|\"tdsch2' (Suc k2') (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task READY ent2 t2) task_s2 pd1 pc1 dis_s1 (Task READY ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow> \n  tdsch2' (Suc k2') k1' kk' pd2 pc2 dis_s2 (Task READY ent2 t2) task_s2 pd1 pc1 dis_s1 (Task RUNNING (Suc 0) t1) (task_s1(CHR ''c'' := up_ent_c ent1 (task_s1 CHR ''c''))) (Sch p 1 2) (s(CHR ''p'' := 2)) tr \\<or>\n  tdsch2' k2' (Suc k1') kk' pd2 pc2 dis_s2 (Task RUNNING (Suc 0) t2) (task_s2(CHR ''c'' := up_ent_c ent2 (task_s2 CHR ''c''))) pd1 pc1 dis_s1 (Task READY ent1 t1) task_s1 (Sch p 2 1) (s(CHR ''p'' := 1)) tr\"\n\n|\"tdsch2' (Suc k2') (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task READY ent2 t2) task_s2 pd1 pc1 dis_s1 (Task RUNNING ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow> \n  (\\<up>(kk' > 0 \\<and> min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') \\<le> pd2 - task_s2 CHR ''t'') \\<and>\\<^sub>t \n  wait_orig_assn (min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))\n     (\\<lambda>t. ParState\n           (ParState (EState (Task READY ent2 t2, task_s2(CHR ''t'' := task_s2 CHR ''t'' + t)))\n             (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\n           (ParState\n             (ParState (EState (Task RUNNING ent1 t1, task_s1(CHR ''t'' := task_s1 CHR ''t'' + t, CHR ''c'' := task_s1 CHR ''c'' + t)))\n               (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + t))))\n             (EState (Sch (p @ [(1, 2)]) 1 2, s(CHR ''p'' := 1)))))\n     ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, run_ch 2, preempt_ch 1}) \n  (tdsch2' k2' k1' (kk'-1) pd2 pc2 (dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')))\n       (Task RUNNING (Suc 0) t2)\n       (task_s2(CHR ''t'' := task_s2 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''), CHR ''c'' := up_ent_c ent2 (task_s2 CHR ''c'')))\n       pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))) (Task WAIT ent1 t1)\n       (task_s1\n        (CHR ''t'' := task_s1 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''),\n         CHR ''c'' := task_s1 CHR ''c'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')))\n       (Sch p 2 1) (s(CHR ''p'' := 1)))) tr \\<or>\n  (\\<up>(min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') = 0 ) \\<and>\\<^sub>t \n   tdsch2' (Suc k2') k1' kk' pd2 pc2 dis_s2 (Task READY ent2 t2) task_s2 pd1 pc1 dis_s1 (Task WAIT ent1 t1) task_s1 (Sch [] (- 1) (- 1)) s) tr \\<or>\n  (\\<up>(kk' > 0 \\<and> min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') \\<ge> pd2 - task_s2 CHR ''t'') \\<and>\\<^sub>t \n  wait_orig_assn (pd2 - task_s2 CHR ''t'')\n     (\\<lambda>t. ParState\n           (ParState (EState (Task READY ent2 1, task_s2(CHR ''t'' := task_s2 CHR ''t'' + t)))\n             (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\n           (ParState\n             (ParState (EState (Task RUNNING ent1 2, task_s1(CHR ''t'' := task_s1 CHR ''t'' + t, CHR ''c'' := task_s1 CHR ''c'' + t)))\n               (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + t))))\n             (EState (Sch (p @ [(1, 2)]) 1 2, s(CHR ''p'' := 1)))))\n     ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, run_ch 2, preempt_ch 1}) \n  (tdsch2' k2' (Suc k1') (kk'-1) pd2 pc2 (dis_s2(CHR ''t'' := pd2)) (Task WAIT ent2 t2) (task_s2(CHR ''t'' := pd2)) \n                                 pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - task_s2 CHR ''t''))) (Task RUNNING ent1 t1)\n       (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - task_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - task_s2 CHR ''t'')))\n       (Sch [] 1 2) (s(CHR ''p'' := 1)) )) tr\"\n\n|\"tdsch2' (Suc k2') (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task RUNNING ent2 t2) task_s2 pd1 pc1 dis_s1 (Task WAIT ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow>\n  (\\<up>(min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'') \\<ge> pd1 - dis_s1 CHR ''t'') \\<and>\\<^sub>t \n  wait_orig_assn (pd1 - dis_s1 CHR ''t'')\n     (\\<lambda>t. ParState\n           (ParState (EState (Task RUNNING ent2 t2, task_s2(CHR ''t'' := task_s2 CHR ''t'' + t, CHR ''c'' := task_s2 CHR ''c'' + t)))\n             (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\n           (ParState (ParState (EState (Task WAIT ent1 t1, task_s1)) (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + t))))\n             (EState (Sch p rn rp, s))))\n     ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1, preempt_ch 2})\n  (tdsch2' (Suc k2') k1' (Suc kk') pd2 pc2 (dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t''))) (Task RUNNING ent2 t2) (task_s2\n                  (CHR ''t'' := task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t''),\n                   CHR ''c'' := task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t'')))   \n                pd1 pc1 (dis_s1(CHR ''t'' := 0)) (Task READY 0 t1) (task_s1(CHR ''t'' := 0)) (Sch p rn rp) s)) tr \\<or>\n  (\\<up>(min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'') < pd1 - dis_s1 CHR ''t'') \\<and>\\<^sub>t \n  wait_orig_assn (min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c''))\n     (\\<lambda>t. ParState\n           (ParState (EState (Task RUNNING (Suc 0) 1, task_s2(CHR ''t'' := task_s2 CHR ''t'' + t, CHR ''c'' := task_s2 CHR ''c'' + t)))\n             (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\n           (ParState (ParState (EState (Task WAIT ent1 t1, task_s1)) (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + t))))\n             (EState (Sch p rn rp, s))))\n     ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 1, preempt_ch 2})  \n  (tdsch2' k2' (Suc k1') kk' pd2 pc2 (dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'')))\n         (Task WAIT (Suc 0) t2)\n         (task_s2\n          (CHR ''t'' := task_s2 CHR ''t'' + min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c''),\n           CHR ''c'' := task_s2 CHR ''c'' + min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'')))\n           pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'')))\n         (Task WAIT ent1 t1) task_s1 (Sch [] (- 1) (- 1)) s))tr\"\n\n|\"tdsch2' (Suc k2') (Suc k1') (Suc kk') pd2 pc2 dis_s2 (Task RUNNING ent2 t2) task_s2 pd1 pc1 dis_s1 (Task READY ent1 t1) task_s1 (Sch p rn rp) s tr \\<longleftrightarrow>\n  (\\<up>(0 < min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'')) \\<and>\\<^sub>t \n  tdsch2' k2' k1' kk' pd2 pc2 (dis_s2(CHR ''t'' := dis_s2 CHR ''t'')) (Task READY (Suc 0) t2)\n       (task_s2(CHR ''t'' := task_s2 CHR ''t'', CHR ''c'' := task_s2 CHR ''c'')) \n      pd1 pc1 dis_s1 (Task RUNNING (Suc 0) t1) (task_s1(CHR ''c'' := up_ent_c ent1 (task_s1 CHR ''c''))) \n       (Sch p 1 2) (s(CHR ''p'' := 2))) tr \\<or>\n  (\\<up>(0 = min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'')) \\<and>\\<^sub>t \n  tdsch2' k2' (Suc k1') kk' pd2 pc2 dis_s2 (Task WAIT (Suc 0) t2) task_s2\n      pd1 pc1 dis_s1 (Task READY ent1 t1) task_s1 \n       (Sch [] (- 1) (- 1)) s) tr\"\n\nlemma conj_join_pure_true [simp]:\n  \"(\\<up>True \\<and>\\<^sub>t P) = P\"\n  by (auto simp add: pure_assn_def conj_assn_def join_assn_def)\n\n\n\nlemma combine_wait_orig_emp1:\n\"combine_assn chs (wait_orig_assn d p rdy P) emp\\<^sub>t \\<Longrightarrow>\\<^sub>t \\<up>(d=0) \\<and>\\<^sub>t (combine_assn chs P emp\\<^sub>t)\"\n  apply(auto simp add:entails_tassn_def combine_assn_def emp_assn_def)\n  subgoal for tr tr1\n    apply(cases rule: wait_orig_assn.cases[of d p rdy P tr1])\n    unfolding conj_assn_def pure_assn_def\n      apply auto\n     by (auto elim!: sync_elims)\n  done\n\nlemma combine_emp_wait_orig1:\n\"combine_assn chs emp\\<^sub>t (wait_orig_assn d p rdy P) \\<Longrightarrow>\\<^sub>t \\<up>(d=0) \\<and>\\<^sub>t (combine_assn chs emp\\<^sub>t P)\"\n  apply(auto simp add:entails_tassn_def combine_assn_def emp_assn_def)\n  subgoal for tr tr1\n    apply(cases rule: wait_orig_assn.cases[of d p rdy P tr1])\n    unfolding conj_assn_def pure_assn_def\n      apply auto\n     by (auto elim!: sync_elims)\n  done\n\nlemma combine_emp_in_0orig_vassm'1:\n  assumes \"ch \\<in> chs\"\n  shows \"combine_assn chs emp\\<^sub>t (in_0orig_vassm'_assn ch V P) \\<Longrightarrow>\\<^sub>t Q\"\n  unfolding combine_assn_def entails_tassn_def \n  apply auto\n  subgoal for tr tr1 tr2\n    apply(auto simp add: emp_assn_def)\n    apply(cases rule: in_0orig_vassm'_assn.cases[of ch V P tr2])\n      apply simp\n    subgoal for v tr2'\n      apply auto\n      using assms\n      by (auto elim!: sync_elims)\n    subgoal for v tr2'\n      apply auto\n      using assms\n      by (auto elim!: sync_elims)\n    done\n  done\n\nlemma combine_emp_waitin_tguar'_vassm'1:\n  assumes \"ch \\<in> chs\"\n  shows \"combine_assn chs emp\\<^sub>t (waitin_tguar'_vassm'_assn S p rdy ch V P) \\<Longrightarrow>\\<^sub>t Q\"\n  unfolding combine_assn_def entails_tassn_def \n  apply auto\n  subgoal for tr tr1 tr2\n    apply(auto simp add: emp_assn_def)\n    apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S p rdy ch V P tr2])\n      apply simp\n    subgoal \n      apply auto\n      using assms\n      by (auto elim!: sync_elims)\n    subgoal\n      apply auto\n      using assms\n      by (auto elim!: sync_elims)\n    subgoal\n      apply auto\n      using assms\n      by (auto elim!: sync_elims)\n    subgoal\n      apply auto\n      using assms\n      by (auto elim!: sync_elims)\n    done\n  done\n\n\nlemma combine_wait_orig_in_0orig_vassm'1:\n  assumes \"ch\\<in>chs\"\n  shows \"combine_assn chs (wait_orig_assn d p rdy P) (in_0orig_vassm'_assn ch V Q) \\<Longrightarrow>\\<^sub>t \\<up>(d=0) \\<and>\\<^sub>t combine_assn chs (P) (in_0orig_vassm'_assn ch V Q)\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d p rdy P tr1])\n      apply simp\n    subgoal\n      by (auto simp add:pure_assn_def conj_assn_def)\n    subgoal for tr1'\n      apply(cases rule:in_0orig_vassm'_assn.cases[of ch V Q tr2])\n        apply auto\n      subgoal\n        using assms\n        by (auto elim!: sync_elims)\n      subgoal\n        using assms\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\n\n\nlemma combine_out_0assm_in_0orig_vassm'1:\n\"ch \\<in> chs \\<and> v \\<in> V\\<Longrightarrow> combine_assn chs (out_0assm_assn ch v P)(in_0orig_vassm'_assn ch V Q) \\<Longrightarrow>\\<^sub>t combine_assn chs P (Q v)\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule:out_0assm_assn.cases[of ch v P tr1])\n      apply simp\n    subgoal \n      apply(cases rule:in_0orig_vassm'_assn.cases[of ch V Q tr2])\n        apply auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      done\n    subgoal \n      apply(cases rule:in_0orig_vassm'_assn.cases[of ch V Q tr2])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\n\nlemma combine_out_0assm_in_0orig_vassm'2:\n\"ch1 \\<in> chs \\<and> ch2 \\<in> chs \\<and> ch1\\<noteq>ch2 \\<Longrightarrow> combine_assn chs (out_0assm_assn ch1 v P)(in_0orig_vassm'_assn ch2 V Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule:out_0assm_assn.cases[of ch1 v P tr1])\n      apply simp\n    subgoal \n      apply(cases rule:in_0orig_vassm'_assn.cases[of ch2 V Q tr2])\n        apply auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      done\n    subgoal \n      apply(cases rule:in_0orig_vassm'_assn.cases[of ch2 V Q tr2])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\n\n\nlemma combine_out_0assm_srdy_in_0orig_vassm'1:\n\"ch \\<in> chs \\<and> v \\<in> V\\<Longrightarrow> combine_assn chs (out_0assm_srdy_assn ch v rdy P)(in_0orig_vassm'_assn ch V Q) \\<Longrightarrow>\\<^sub>t combine_assn chs P (Q v)\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule:out_0assm_srdy_assn.cases[of ch v rdy P tr1])\n      apply simp\n    subgoal \n      apply(cases rule:in_0orig_vassm'_assn.cases[of ch V Q tr2])\n        apply auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      done\n    subgoal \n      apply(cases rule:in_0orig_vassm'_assn.cases[of ch V Q tr2])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\nlemma combine_out_0assm_srdy_in_0orig_vassm'2:\n\"ch1 \\<in> chs \\<and> ch2 \\<in> chs \\<and> ch1\\<noteq>ch2 \\<Longrightarrow> combine_assn chs (out_0assm_srdy_assn ch1 v rdy P)(in_0orig_vassm'_assn ch2 V Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule:out_0assm_srdy_assn.cases[of ch1 v rdy P tr1])\n      apply simp\n    subgoal \n      apply(cases rule:in_0orig_vassm'_assn.cases[of ch2 V Q tr2])\n        apply auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      done\n    subgoal \n      apply(cases rule:in_0orig_vassm'_assn.cases[of ch2 V Q tr2])\n        apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\nlemma combine_waitin_tguar'_vassm'_in_0orig_vassm'1:\n\"ch1\\<in>chs \\<and> ch2\\<in>chs \\<Longrightarrow> combine_assn chs (waitin_tguar'_vassm'_assn S p rdy ch1 V P)(in_0orig_vassm'_assn ch2 W Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule:in_0orig_vassm'_assn.cases[of ch2 W Q tr2])\n      apply auto\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch1 V P tr1])\n          apply auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch1 V P tr1])\n          apply auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\nlemma combine_waitin_tguar'_vassm'_out_0assm1:\n\"ch \\<in> chs \\<and> v \\<in> V \\<and> ch \\<in> snd rdy \\<Longrightarrow> combine_assn chs (waitin_tguar'_vassm'_assn S p rdy ch V P)(out_0assm_assn ch v Q) \\<Longrightarrow>\\<^sub>t combine_assn chs (P v 0) Q\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_assn.cases[of ch v Q tr2])\n      apply simp\n     apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S p rdy ch V P tr1])\n         apply auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      by (auto elim!: sync_elims)\n    apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S p rdy ch V P tr1])\n        apply auto \n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      apply(elim combine_blocks_waitE1)\n      apply(cases rdy)\n      by auto\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      apply(elim combine_blocks_waitE1)\n      apply(cases rdy)\n      by auto\n    done\n  done\nlemma combine_waitin_tguar'_vassm'_out_0assm1':\n\"ch\\<in>chs \\<and> v\\<in>V \\<and> ch \\<in> snd rdy \\<Longrightarrow> combine_assn chs (waitin_tguar'_vassm'_assn S p rdy ch V Q) (out_0assm_assn ch v P) \\<Longrightarrow>\\<^sub>t \\<up>(0\\<in>S) \\<and>\\<^sub>t combine_assn chs (Q v 0) P\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_assn.cases[of ch v P tr2])\n      apply simp\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch V Q tr1])\n          apply simp\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      done\n    subgoal for d rdya pa tra\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch V Q tr1])\n          apply simp\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        apply(cases rdya)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        apply(cases rdya)\n        by auto\n      done\n    done\n  done\n\nlemma combine_out_0assm_rdy_emp1:\n\"ch\\<in>chs \\<Longrightarrow> combine_assn chs (out_0assm_rdy_assn ch v rdy P) emp\\<^sub>t \\<Longrightarrow>\\<^sub>t Q\"\n  apply(auto simp add:entails_tassn_def combine_assn_def emp_assn_def)\n  subgoal for tr tr1 \n    apply(cases rule:out_0assm_rdy_assn.cases[of ch v rdy P])\n      apply auto\n    by (auto elim!: sync_elims)\n  done\n\nlemma combine_in_0assm_rdy_emp1:\n\"ch\\<in>chs \\<Longrightarrow> combine_assn chs (in_0assm_rdy_assn ch v rdy P) emp\\<^sub>t \\<Longrightarrow>\\<^sub>t Q\"\n  apply(auto simp add:entails_tassn_def combine_assn_def emp_assn_def)\n  subgoal for tr tr1 \n    apply(cases rule:in_0assm_rdy_assn.cases[of ch v rdy P])\n      apply auto\n    by (auto elim!: sync_elims)\n  done\n\nlemma combine_out_0assm_rdy_in_0orig_vassm'1:\n\"ch \\<in> chs \\<and> v \\<in> V\\<Longrightarrow> combine_assn chs (out_0assm_rdy_assn ch v rdy P) (in_0orig_vassm'_assn ch V Q) \\<Longrightarrow>\\<^sub>t combine_assn chs P (Q v)\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_rdy_assn.cases[of ch v rdy P tr1])\n      apply simp\n     apply(cases rule: in_0orig_vassm'_assn.cases[of ch V Q tr2])\n       apply auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    apply(cases rule: in_0orig_vassm'_assn.cases[of ch V Q tr2])\n       apply auto\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      by (auto elim!: sync_elims)\n    done\n  done\n\n\nlemma combine_out_0assm_rdy_in_0orig_vassm'2:\n\"ch1\\<in>chs\\<and>ch2\\<in>chs\\<and>ch1\\<noteq>ch2 \\<Longrightarrow> combine_assn chs (out_0assm_rdy_assn ch1 v rdy P) (in_0orig_vassm'_assn ch2 V Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_rdy_assn.cases[of ch1 v rdy P tr1])\n      apply simp\n     apply(cases rule: in_0orig_vassm'_assn.cases[of ch2 V Q tr2])\n       apply auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    apply(cases rule: in_0orig_vassm'_assn.cases[of ch2 V Q tr2])\n       apply auto\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      by (auto elim!: sync_elims)\n    done\n  done\n\n\nlemma combine_in_0assm_rdy_in_0orig_vassm'2:\n\"ch1\\<in>chs\\<and>ch2\\<in>chs\\<and>ch1\\<noteq>ch2 \\<Longrightarrow> combine_assn chs (in_0assm_rdy_assn ch1 v rdy P) (in_0orig_vassm'_assn ch2 V Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: in_0assm_rdy_assn.cases[of ch1 v rdy P tr1])\n      apply simp\n     apply(cases rule: in_0orig_vassm'_assn.cases[of ch2 V Q tr2])\n       apply auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    apply(cases rule: in_0orig_vassm'_assn.cases[of ch2 V Q tr2])\n       apply auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    apply(cases rule: in_0orig_vassm'_assn.cases[of ch2 V Q tr2])\n       apply auto\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      by (auto elim!: sync_elims)\n    done\n  done\n\nlemma combine_in_0assm_rdy_out_0assm1:\n\"ch\\<in>chs \\<and> v\\<in>V \\<Longrightarrow> combine_assn chs (in_0assm_rdy_assn ch V rdy P) (out_0assm_assn ch v Q) \\<Longrightarrow>\\<^sub>t combine_assn chs P Q\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_assn.cases [of ch v Q tr2])\n      apply auto\n     apply(cases rule: in_0assm_rdy_assn.cases [of ch V rdy P tr1])\n        apply auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      by (auto elim!: sync_elims)\n    apply(cases rule: in_0assm_rdy_assn.cases [of ch V rdy P tr1])\n      apply auto\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      apply(elim combine_blocks_waitE1)\n      apply(cases rdy)\n      by auto\n    done\n  done\n\n\nlemma combine_wait_orig_wait_orig2:\n\"compat_rdy rdy1 rdy2 \\<and> d1 = d2 \\<Longrightarrow> combine_assn chs (wait_orig_assn d1 p1 rdy1 P1) (wait_orig_assn d2 p2 rdy2 P2) \\<Longrightarrow>\\<^sub>t \n  wait_orig_assn d1 (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) (combine_assn chs P1 P2)\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d2 p2 rdy2 P2 tr2])\n      apply auto\n    subgoal\n      apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n        apply auto\n      apply(rule wait_orig_assn.intros(1))\n      by auto\n    subgoal \n      apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n        apply auto\n      apply(elim combine_blocks_waitE2)\n       apply auto\n      apply(rule wait_orig_assn.intros(2))\n      apply auto\n      done\n    done\n  done\n\n\nlemma combine_wait_orig_wait_orig3:\n\"compat_rdy rdy1 rdy2 \\<and> d1 < d2 \\<Longrightarrow> combine_assn chs (wait_orig_assn d1 p1 rdy1 P1) (wait_orig_assn d2 p2 rdy2 P2) \\<Longrightarrow>\\<^sub>t \n  wait_orig_assn d1 (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) (combine_assn chs P1 (wait_orig_assn (d2-d1) (\\<lambda> t. p2(t+d1)) rdy2 P2))\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d2 p2 rdy2 P2 tr2])\n      apply auto\n    subgoal\n      apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n      by auto\n    subgoal for tr2'\n      apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n        apply auto\n      subgoal\n        apply(rule wait_orig_assn.intros(1))\n        by auto\n      subgoal for tr1'\n        apply(elim combine_blocks_waitE3)\n           apply auto\n        apply(rule wait_orig_assn.intros(2))\n         apply auto\n        apply(rule exI[where x =\"tr1'\"])\n        apply auto\n        apply(rule exI[where x=\"(WaitBlk (d2 - d1) (\\<lambda>t. p2 (t + d1)) rdy2 # tr2')\"])\n        apply auto\n        apply(rule wait_orig_assn.intros(2))\n        by auto\n      done\n    done\n  done\n\n\nlemma combine_wait_orig_wait_orig4:\n\"compat_rdy rdy1 rdy2 \\<and> d1 > d2 \\<Longrightarrow> combine_assn chs (wait_orig_assn d1 p1 rdy1 P1) (wait_orig_assn d2 p2 rdy2 P2) \\<Longrightarrow>\\<^sub>t \n  wait_orig_assn d2 (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) (combine_assn chs (wait_orig_assn (d1-d2) (\\<lambda> t. p1(t+d2)) rdy1 P1) P2)\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n      apply auto\n    subgoal\n      apply(cases rule: wait_orig_assn.cases[of d2 p2 rdy2 P2 tr2])\n      by auto\n    subgoal for tr1'\n      apply(cases rule: wait_orig_assn.cases[of d2 p2 rdy2 P2 tr2])\n        apply auto\n      subgoal\n        apply(rule wait_orig_assn.intros(1))\n        by auto\n      subgoal for tr2'\n        apply(elim combine_blocks_waitE4)\n           apply auto\n        apply(rule wait_orig_assn.intros(2))\n         apply auto\n        apply(rule exI[where x =\"(WaitBlk (d1 - d2) (\\<lambda>t. p1 (t + d2)) rdy1 # tr1')\"])\n        apply auto\n        apply(rule wait_orig_assn.intros(2))\n        by auto\n      done\n    done\n  done\n\nlemma combine_wait_orig_wait_orig5:\n\"compat_rdy rdy1 rdy2 \\<and> d1 \\<le> d2 \\<Longrightarrow> combine_assn chs (wait_orig_assn d1 p1 rdy1 P1) (wait_orig_assn d2 p2 rdy2 P2) \\<Longrightarrow>\\<^sub>t \n  wait_orig_assn d1 (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) (combine_assn chs P1 (wait_orig_assn (d2-d1) (\\<lambda> t. p2(t+d1)) rdy2 P2))\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d2 p2 rdy2 P2 tr2])\n      apply auto\n    subgoal\n      apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n        apply auto\n      apply(rule wait_orig_assn.intros(1))\n      by auto\n    subgoal for tr2'\n      apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n        apply auto\n      subgoal\n        apply(rule wait_orig_assn.intros(1))\n        by auto\n      subgoal for tr1'\n        apply(cases \"d2>d1\")\n        subgoal\n        apply(elim combine_blocks_waitE3)\n           apply auto\n        apply(rule wait_orig_assn.intros(2))\n         apply auto\n        apply(rule exI[where x =\"tr1'\"])\n        apply auto\n        apply(rule exI[where x=\"(WaitBlk (d2 - d1) (\\<lambda>t. p2 (t + d1)) rdy2 # tr2')\"])\n        apply auto\n        apply(rule wait_orig_assn.intros(2))\n          by auto\n        apply simp\n        apply(elim combine_blocks_waitE2)\n         apply auto\n        apply(rule wait_orig_assn.intros(2))\n         apply auto\n        apply(rule exI[where x =\"tr1'\"])\n        apply auto\n        apply(rule exI[where x =\"tr2'\"])\n        apply auto\n        apply(rule wait_orig_assn.intros(1))\n        by auto\n      done\n    done\n  done\n\nlemma combine_wait_orig_wait_orig6:\n\"compat_rdy rdy1 rdy2 \\<and> d1 \\<ge> d2 \\<Longrightarrow> combine_assn chs (wait_orig_assn d1 p1 rdy1 P1) (wait_orig_assn d2 p2 rdy2 P2) \\<Longrightarrow>\\<^sub>t \n  wait_orig_assn d2 (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) (combine_assn chs (wait_orig_assn (d1-d2) (\\<lambda> t. p1(t+d2)) rdy1 P1) P2)\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n      apply auto\n    subgoal\n      apply(cases rule: wait_orig_assn.cases[of d2 p2 rdy2 P2 tr2])\n        apply auto\n      apply(rule wait_orig_assn.intros(1))\n      by auto\n    subgoal for tr1'\n      apply(cases rule: wait_orig_assn.cases[of d2 p2 rdy2 P2 tr2])\n        apply auto\n      subgoal\n        apply(rule wait_orig_assn.intros(1))\n        by auto\n      subgoal for tr2'\n        apply(cases \"d2<d1\")\n        subgoal\n        apply(elim combine_blocks_waitE4)\n           apply auto\n        apply(rule wait_orig_assn.intros(2))\n         apply auto\n        apply(rule exI[where x =\"(WaitBlk (d1 - d2) (\\<lambda>t. p1 (t + d2)) rdy1 # tr1')\"])\n        apply auto\n        apply(rule wait_orig_assn.intros(2))\n          by auto\n        apply simp\n        apply(elim combine_blocks_waitE2)\n         apply auto\n        apply(rule wait_orig_assn.intros(2))\n         apply auto\n        apply(rule exI[where x =\"tr1'\"])\n        apply auto\n        apply(rule wait_orig_assn.intros(1))\n        by auto\n      done\n    done\n  done\n\n\nlemma combine_wait_orig_waitin_tguar'_vassm'1:\n\"compat_rdy rdy1 rdy2 \\<and> d1 \\<ge> d2 \\<and> ch\\<in>chs \\<Longrightarrow> combine_assn chs (wait_orig_assn d1 p1 rdy1 P1) (waitin_tguar'_vassm'_assn ({..<d2}) p2 rdy2 ch V P2) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n      apply auto\n    subgoal \n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of \"{..<d2}\" p2 rdy2 ch V P2 tr2])\n      by auto\n    subgoal for tr1'\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of \"{..<d2}\" p2 rdy2 ch V P2 tr2])\n          apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        apply(elim combine_blocks_waitE4)\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        apply(elim combine_blocks_waitE4)\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\n\nlemma combine_wait_orig_waitin_tguar'_vassm'2:\n\"compat_rdy rdy1 rdy2 \\<and> d1 < d2 \\<and> ch\\<in>chs \\<Longrightarrow> combine_assn chs (wait_orig_assn d1 p1 rdy1 P1) (waitin_tguar'_vassm'_assn ({..<d2}) p2 rdy2 ch V P2) \\<Longrightarrow>\\<^sub>t \n    wait_orig_assn d1 (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) (combine_assn chs P1 (waitin_tguar'_vassm'_assn ({..<d2-d1}) (\\<lambda> t. p2(t+d1)) rdy2 ch V (\\<lambda> v d. P2 v (d+d1))))\"\n  unfolding combine_assn_def entails_tassn_def\nunfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n      apply auto\n    subgoal \n      apply(rule wait_orig_assn.intros(1))\n      by auto\n    subgoal for tr1'\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of \"{..<d2}\" p2 rdy2 ch V P2 tr2])\n          apply simp\n      subgoal for v tr2'\n        by (auto elim!: sync_elims)\n      subgoal for d v tr2'\n        apply(cases \"d< d1\")\n        subgoal\n          apply simp\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply(cases \"d> d1\")\n        subgoal\n          apply simp\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n          apply(rule exI[where x =\"tr1'\"])\n          apply auto\n          apply(rule exI[where x=\"(WaitBlk (d - d1) (\\<lambda>t. p2 (t + d1)) rdy2 # InBlock ch v # tr2')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(2))\n          by auto\n        apply simp\n          apply(elim combine_blocks_waitE2)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n          apply(rule exI[where x =\"tr1'\"])\n          apply auto\n          apply(rule exI[where x=\"(InBlock ch v # tr2')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(1))\n        by auto\n      subgoal for v tr2'\n        by (auto elim!: sync_elims)\n      subgoal for d v tr2'\n        apply(cases \"d< d1\")\n        subgoal\n          apply simp\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply(cases \"d> d1\")\n        subgoal\n          apply simp\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n          apply(rule exI[where x =\"tr1'\"])\n          apply auto\n          apply(rule exI[where x=\"(WaitBlk (d - d1) (\\<lambda>t. p2 (t + d1)) rdy2 # InBlock ch v # tr2')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(4))\n          by auto\n        apply simp\n          apply(elim combine_blocks_waitE2)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n          apply(rule exI[where x =\"tr1'\"])\n          apply auto\n          apply(rule exI[where x=\"(InBlock ch v # tr2')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(3))\n        by auto\n      done\n    done\n  done\n\nlemma combine_wait_orig_waitin_tguar'_vassm'2':\n\"compat_rdy rdy1 rdy2 \\<and> ch\\<in>chs \\<Longrightarrow> combine_assn chs (wait_orig_assn d1 p1 rdy1 P1) (waitin_tguar'_vassm'_assn ({..<d2}) p2 rdy2 ch V P2) \\<Longrightarrow>\\<^sub>t \n   \\<up>(d1<d2) \\<and>\\<^sub>t wait_orig_assn d1 (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) (combine_assn chs P1 (waitin_tguar'_vassm'_assn ({..<d2-d1}) (\\<lambda> t. p2(t+d1)) rdy2 ch V (\\<lambda> v d. P2 v (d+d1))))\"\n  apply(cases \"d1\\<ge>d2\")\n  subgoal\n    apply(rule combine_wait_orig_waitin_tguar'_vassm'1) by auto\n  apply simp\n  apply(rule combine_wait_orig_waitin_tguar'_vassm'2) by auto\n\nlemma combine_wait_orig_waitin_tguar'_vassm'3:\n\"compat_rdy rdy1 rdy2 \\<and> d1 > d2 \\<and> ch\\<in>chs \\<Longrightarrow> combine_assn chs (wait_orig_assn d1 p1 rdy1 P1) (waitin_tguar'_vassm'_assn ({..d2}) p2 rdy2 ch V P2) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n      apply auto\n    subgoal \n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of \"{..d2}\" p2 rdy2 ch V P2 tr2])\n      by auto\n    subgoal for tr1'\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of \"{..d2}\" p2 rdy2 ch V P2 tr2])\n          apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        apply(elim combine_blocks_waitE4)\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        apply(elim combine_blocks_waitE4)\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\n\nlemma combine_wait_orig_waitin_tguar'_vassm'4:\n\"compat_rdy rdy1 rdy2 \\<and> d1 \\<le> d2 \\<and> ch\\<in>chs \\<Longrightarrow> combine_assn chs (wait_orig_assn d1 p1 rdy1 P1) (waitin_tguar'_vassm'_assn ({..d2}) p2 rdy2 ch V P2) \\<Longrightarrow>\\<^sub>t \n    wait_orig_assn d1 (\\<lambda>t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2) (combine_assn chs P1 (waitin_tguar'_vassm'_assn ({..d2-d1}) (\\<lambda> t. p2(t+d1)) rdy2 ch V (\\<lambda> v d. P2 v (d+d1))))\"\n  unfolding combine_assn_def entails_tassn_def\nunfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d1 p1 rdy1 P1 tr1])\n      apply auto\n    subgoal \n      apply(rule wait_orig_assn.intros(1))\n      by auto\n    subgoal for tr1'\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of \"{..d2}\" p2 rdy2 ch V P2 tr2])\n          apply simp\n      subgoal for v tr2'\n        by (auto elim!: sync_elims)\n      subgoal for d v tr2'\n        apply(cases \"d< d1\")\n        subgoal\n          apply simp\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply(cases \"d> d1\")\n        subgoal\n          apply simp\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n          apply(rule exI[where x =\"tr1'\"])\n          apply auto\n          apply(rule exI[where x=\"(WaitBlk (d - d1) (\\<lambda>t. p2 (t + d1)) rdy2 # InBlock ch v # tr2')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(2))\n          by auto\n        apply simp\n          apply(elim combine_blocks_waitE2)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n          apply(rule exI[where x =\"tr1'\"])\n          apply auto\n          apply(rule exI[where x=\"(InBlock ch v # tr2')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(1))\n        by auto\n      subgoal for v tr2'\n        by (auto elim!: sync_elims)\n      subgoal for d v tr2'\n        apply(cases \"d< d1\")\n        subgoal\n          apply simp\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply(cases \"d> d1\")\n        subgoal\n          apply simp\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n          apply(rule exI[where x =\"tr1'\"])\n          apply auto\n          apply(rule exI[where x=\"(WaitBlk (d - d1) (\\<lambda>t. p2 (t + d1)) rdy2 # InBlock ch v # tr2')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(4))\n          by auto\n        apply simp\n          apply(elim combine_blocks_waitE2)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n          apply(rule exI[where x =\"tr1'\"])\n          apply auto\n          apply(rule exI[where x=\"(InBlock ch v # tr2')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(3))\n        by auto\n      done\n    done\n  done\n\n\nlemma combine_out_0assm_wait_orig1:\n  assumes \"ch\\<in>chs \\<and> ch \\<in> snd rdy\"\n    shows \"combine_assn chs (out_0assm_assn ch v Q) (wait_orig_assn d p rdy P) \\<Longrightarrow>\\<^sub>t\n          \\<up>(d=0) \\<and>\\<^sub>t combine_assn chs (out_0assm_assn ch v Q) P\"\n  unfolding entails_tassn_def combine_assn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule:wait_orig_assn.cases[of d p rdy P tr2])\n      apply auto\n    unfolding conj_assn_def pure_assn_def\n    apply auto\n    subgoal for tr2'\n      apply(cases rule:out_0assm_assn.cases[of ch v Q tr1])\n        apply auto\n      subgoal for tr1'\n        using assms\n         by (auto elim!: sync_elims)\n       subgoal for d' a b p' tr1'\n         apply(cases rdy)\n         using assms\n         by (auto elim!: sync_elims)\n       done\n     done\n  done\n\n\nlemma combine_out_0assm_srdy_wait_orig1:\n  assumes \"ch\\<in>chs \\<and> ch \\<in> snd rdy \\<and> ch \\<in> fst rdy'\"\n    shows \"combine_assn chs (out_0assm_srdy_assn ch v rdy' Q) (wait_orig_assn d p rdy P) \\<Longrightarrow>\\<^sub>t\n          \\<up>(d=0) \\<and>\\<^sub>t combine_assn chs (out_0assm_srdy_assn ch v rdy' Q) P\"\n  unfolding entails_tassn_def combine_assn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule:wait_orig_assn.cases[of d p rdy P tr2])\n      apply auto\n    unfolding conj_assn_def pure_assn_def\n    apply auto\n    subgoal for tr2'\n      apply(cases rule:out_0assm_srdy_assn.cases[of ch v rdy'  Q tr1])\n        apply auto\n      subgoal for tr1'\n        using assms\n         by (auto elim!: sync_elims)\n       subgoal for d' a b p' tr1'\n         apply(cases rdy)\n         apply(cases rdy')\n         using assms\n         apply auto\n         apply(elim combine_blocks_waitE1)\n         by auto\n       done\n     done\n  done\n\nlemma combine_out_0assm_waitin_tguar'_vassm'1:\n\"ch\\<in>chs \\<and> v\\<in>V \\<and> ch \\<in> snd rdy \\<Longrightarrow> combine_assn chs (out_0assm_assn ch v P) (waitin_tguar'_vassm'_assn S p rdy ch V Q) \\<Longrightarrow>\\<^sub>t \\<up>(0\\<in>S) \\<and>\\<^sub>t combine_assn chs P (Q v 0)\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_assn.cases[of ch v P tr1])\n      apply simp\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch V Q tr2])\n          apply simp\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      done\n    subgoal for d rdya pa tra\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch V Q tr2])\n          apply simp\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        apply(cases rdya)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        apply(cases rdya)\n        by auto\n      done\n    done\n  done\n\nlemma combine_out_0assm_waitin_tguar'_vassm'2:\n\"ch1\\<in>chs \\<and> ch2\\<in>chs \\<and> ch1 \\<in> snd rdy \\<and> ch1 \\<noteq> ch2 \\<Longrightarrow> combine_assn chs (out_0assm_assn ch1 v P) (waitin_tguar'_vassm'_assn S p rdy ch2 V Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_assn.cases[of ch1 v P tr1])\n      apply simp\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch2 V Q tr2])\n          apply simp\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      done\n    subgoal for d rdya pa tra\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch2 V Q tr2])\n          apply simp\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        apply(cases rdya)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        apply(cases rdya)\n        by auto\n      done\n    done\n  done\n\nlemma combine_out_0assm_srdy_waitin_tguar'_vassm'1:\n\"ch\\<in>chs \\<and> v\\<in>V \\<and> ch \\<in> snd rdy \\<and> ch \\<in> fst rdy'\\<Longrightarrow> combine_assn chs (out_0assm_srdy_assn ch v rdy' P) (waitin_tguar'_vassm'_assn S p rdy ch V Q) \\<Longrightarrow>\\<^sub>t \\<up>(0\\<in>S) \\<and>\\<^sub>t combine_assn chs P (Q v 0)\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_srdy_assn.cases[of ch v rdy' P tr1])\n      apply simp\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch V Q tr2])\n          apply simp\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      done\n    subgoal for d rdya pa tra\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch V Q tr2])\n          apply simp\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        apply(cases rdya)\n        apply(cases rdy')\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        apply(cases rdya)\n        by auto\n      done\n    done\n  done\n\n\nlemma combine_out_0assm_srdy_waitin_tguar'_vassm'2:\n\"ch1\\<in>chs \\<and> ch2\\<in>chs \\<and> ch1 \\<in> snd rdy \\<and> ch1 \\<in> fst rdy' \\<and> ch1 \\<noteq> ch2 \\<Longrightarrow> combine_assn chs (out_0assm_srdy_assn ch1 v rdy' P) (waitin_tguar'_vassm'_assn S p rdy ch2 V Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_srdy_assn.cases[of ch1 v rdy' P tr1])\n      apply simp\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch2 V Q tr2])\n          apply simp\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      done\n    subgoal for d rdya pa tra\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy ch2 V Q tr2])\n          apply simp\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        apply(cases rdya)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_waitE1)\n        apply(cases rdy)\n        apply(cases rdya)\n        by auto\n      done\n    done\n  done\n\n\nlemma combine_waitin_tguar'_vassm'_waitin_tguar'_vassm'1:\n\"ch1 \\<in> chs \\<and> ch2 \\<in> chs \\<Longrightarrow> combine_assn chs (waitin_tguar'_vassm'_assn S1 p1 rdy1 ch1 V1 P1) (waitin_tguar'_vassm'_assn S2 p2 rdy2 ch2 V2 P2) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S1 p1 rdy1 ch1 V1 P1 tr1])\n        apply simp\n    subgoal\n      apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S2 p2 rdy2 ch2 V2 P2 tr2])\n          apply simp\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      done\n    subgoal for d1\n      apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S2 p2 rdy2 ch2 V2 P2 tr2])\n          apply simp\n      subgoal\n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal for d2\n        apply auto\n        apply(cases \"compat_rdy rdy1 rdy2\")\n        subgoal\n          apply(cases \"d1<d2\")\n          subgoal\n            apply(elim combine_blocks_waitE3)\n               apply auto\n            by (auto elim!: sync_elims) \n          apply(cases \"d1>d2\")\n          subgoal\n            apply(elim combine_blocks_waitE4)\n               apply auto\n            by (auto elim!: sync_elims)\n          apply auto\n          apply(elim combine_blocks_waitE2)\n           apply auto\n          apply(elim combine_blocks_pairE)\n          by auto\n        apply(elim combine_blocks_waitE1)\n        by auto\n      subgoal\n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal for d2\n        apply auto\n        apply(cases \"compat_rdy rdy1 rdy2\")\n        subgoal\n          apply(cases \"d1<d2\")\n          subgoal\n            apply(elim combine_blocks_waitE3)\n               apply auto\n            by (auto elim!: sync_elims) \n          apply(cases \"d1>d2\")\n          subgoal\n            apply(elim combine_blocks_waitE4)\n               apply auto\n            by (auto elim!: sync_elims)\n          apply auto\n          apply(elim combine_blocks_waitE2)\n           apply auto\n          apply(elim combine_blocks_pairE)\n          by auto\n        apply(elim combine_blocks_waitE1)\n        by auto\n      done\nsubgoal\n      apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S2 p2 rdy2 ch2 V2 P2 tr2])\n          apply simp\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal\n        apply auto\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal \n        apply auto\n        by (auto elim!: sync_elims)\n      done\n    subgoal for d1\n      apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S2 p2 rdy2 ch2 V2 P2 tr2])\n          apply simp\n      subgoal\n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal for d2\n        apply auto\n        apply(cases \"compat_rdy rdy1 rdy2\")\n        subgoal\n          apply(cases \"d1<d2\")\n          subgoal\n            apply(elim combine_blocks_waitE3)\n               apply auto\n            by (auto elim!: sync_elims) \n          apply(cases \"d1>d2\")\n          subgoal\n            apply(elim combine_blocks_waitE4)\n               apply auto\n            by (auto elim!: sync_elims)\n          apply auto\n          apply(elim combine_blocks_waitE2)\n           apply auto\n          apply(elim combine_blocks_pairE)\n          by auto\n        apply(elim combine_blocks_waitE1)\n        by auto\n      subgoal\n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal for d2\n        apply auto\n        apply(cases \"compat_rdy rdy1 rdy2\")\n        subgoal\n          apply(cases \"d1<d2\")\n          subgoal\n            apply(elim combine_blocks_waitE3)\n               apply auto\n            by (auto elim!: sync_elims) \n          apply(cases \"d1>d2\")\n          subgoal\n            apply(elim combine_blocks_waitE4)\n               apply auto\n            by (auto elim!: sync_elims)\n          apply auto\n          apply(elim combine_blocks_waitE2)\n           apply auto\n          apply(elim combine_blocks_pairE)\n          by auto\n        apply(elim combine_blocks_waitE1)\n        by auto\n      done\n    done\n  done\n\n\nlemma combine_waitin_tguar'_vassm'_wait_orig2:\n\"ch\\<in>chs \\<and> compat_rdy rdy1 rdy2 \\<Longrightarrow> combine_assn chs (waitin_tguar'_vassm'_assn {0 ..< d1} p1 rdy1 ch V P1)(wait_orig_assn d2 p2 rdy2 P2) \\<Longrightarrow>\\<^sub>t\n  \\<up>(d2<d1) \\<and>\\<^sub>t wait_orig_assn d2 (\\<lambda> t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)    \n(combine_assn chs (waitin_tguar'_vassm'_assn {..< d1-d2} (\\<lambda> t. p1(t+d2)) rdy1 ch V (\\<lambda> v d. P1 v (d+d2))) (P2))\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d2 p2 rdy2 P2 tr2])\n      apply simp\n    subgoal\n     apply(cases rule: waitin_tguar'_vassm'_assn.cases[of \"{0..<d1}\" p1 rdy1 ch V P1 tr1])\n          apply simp\n      subgoal \n        apply auto\n        apply(rule wait_orig_assn.intros(1))\n         apply auto\n        apply(rule exI[where x=tr1])\n        apply auto\n        apply(rule waitin_tguar'_vassm'_assn.intros(1))\n        by auto\n      subgoal \n        apply auto\n        apply(rule wait_orig_assn.intros(1))\n        apply(rule exI[where x=tr1])\n        apply auto\n        apply(rule waitin_tguar'_vassm'_assn.intros(2))\n        by auto\n      subgoal \n        apply auto\n        apply(rule wait_orig_assn.intros(1))\n         apply auto\n        apply(rule exI[where x=tr1])\n        apply auto\n        apply(rule waitin_tguar'_vassm'_assn.intros(3))\n        by auto\n      subgoal \n        apply auto\n        apply(rule wait_orig_assn.intros(1))\n        apply(rule exI[where x=tr1])\n        apply auto\n        apply(rule waitin_tguar'_vassm'_assn.intros(4))\n        by auto\n      done\n subgoal for tr2'\n     apply(cases rule: waitin_tguar'_vassm'_assn.cases[of \"{0..<d1}\" p1 rdy1 ch V P1 tr1])\n          apply simp\n      subgoal\n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal for d1' v tr1'\n        apply auto\n        apply(cases \"d2\\<ge>d1\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply auto\n        apply(cases \"d2>d1'\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply(cases \"d2<d1'\")\n        subgoal\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n           apply auto\n          apply(rule exI[where x=\"(WaitBlk (d1' - d2) (\\<lambda>t. p1 (t + d2)) rdy1 # InBlock ch v # tr1')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(2))\n          by auto\n        apply simp\n        apply(elim combine_blocks_waitE2)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n         apply auto\n        apply(rule exI[where x=\"(InBlock ch v # tr1')\"])\n        apply auto\n        apply(rule waitin_tguar'_vassm'_assn.intros(1))\n        by auto\n      subgoal\n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal for d1' v tr1'\n        apply auto\n        apply(cases \"d2\\<ge>d1\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply auto\n        apply(cases \"d2>d1'\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply(cases \"d2<d1'\")\n        subgoal\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n           apply auto\n          apply(rule exI[where x=\"(WaitBlk (d1' - d2) (\\<lambda>t. p1 (t + d2)) rdy1 # InBlock ch v # tr1')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(4))\n          by auto\n        apply simp\n        apply(elim combine_blocks_waitE2)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n         apply auto\n        apply(rule exI[where x=\"(InBlock ch v # tr1')\"])\n        apply auto\n        apply(rule waitin_tguar'_vassm'_assn.intros(3))\n        by auto\n      done\n    done\n  done\n\n\nlemma combine_waitin_tguar'_vassm'_wait_orig2':\n\"ch\\<in>chs \\<and> compat_rdy rdy1 rdy2 \\<Longrightarrow> combine_assn chs (waitin_tguar'_vassm'_assn {0 ..< d1} p1 rdy1 ch V P1)(wait_orig_assn d2 p2 rdy2 P2) \\<Longrightarrow>\\<^sub>t\n  \\<up>(d2<d1) \\<and>\\<^sub>t wait_orig_assn d2 (\\<lambda> t. ParState (p1 t) (p2 t)) (merge_rdy rdy1 rdy2)    \n(combine_assn chs (waitin_tguar'_vassm'_assn {0..< d1-d2} (\\<lambda> t. p1(t+d2)) rdy1 ch V (\\<lambda> v d. P1 v (d+d2))) (P2))\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d2 p2 rdy2 P2 tr2])\n      apply simp\n    subgoal\n     apply(cases rule: waitin_tguar'_vassm'_assn.cases[of \"{0..<d1}\" p1 rdy1 ch V P1 tr1])\n          apply simp\n      subgoal \n        apply auto\n        apply(rule wait_orig_assn.intros(1))\n         apply auto\n        done\n      subgoal \n        apply auto\n        apply(rule wait_orig_assn.intros(1))\n        apply(rule exI[where x=tr1])\n        apply auto\n        done\n      subgoal \n        apply auto\n        apply(rule wait_orig_assn.intros(1))\n        apply auto\n        done\n      subgoal \n        apply auto\n        apply(rule wait_orig_assn.intros(1))\n        by auto\n        done\n      subgoal for tr2'\n     apply(cases rule: waitin_tguar'_vassm'_assn.cases[of \"{0..<d1}\" p1 rdy1 ch V P1 tr1])\n          apply simp\n      subgoal\n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal for d1' v tr1'\n        apply auto\n        apply(cases \"d2\\<ge>d1\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply auto\n        apply(cases \"d2>d1'\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply(cases \"d2<d1'\")\n        subgoal\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n           apply auto\n          apply(rule exI[where x=\"(WaitBlk (d1' - d2) (\\<lambda>t. p1 (t + d2)) rdy1 # InBlock ch v # tr1')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(2))\n          by auto\n        apply simp\n        apply(elim combine_blocks_waitE2)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n         apply auto\n        apply(rule exI[where x=\"(InBlock ch v # tr1')\"])\n        apply auto\n        apply(rule waitin_tguar'_vassm'_assn.intros(1))\n        by auto\n      subgoal\n        apply auto\n        by (auto elim!: sync_elims)\n      subgoal for d1' v tr1'\n        apply auto\n        apply(cases \"d2\\<ge>d1\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply auto\n        apply(cases \"d2>d1'\")\n        subgoal\n          apply(elim combine_blocks_waitE3)\n             apply auto\n          by (auto elim!: sync_elims)\n        apply(cases \"d2<d1'\")\n        subgoal\n          apply(elim combine_blocks_waitE4)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n           apply auto\n          apply(rule exI[where x=\"(WaitBlk (d1' - d2) (\\<lambda>t. p1 (t + d2)) rdy1 # InBlock ch v # tr1')\"])\n          apply auto\n          apply(rule waitin_tguar'_vassm'_assn.intros(4))\n          by auto\n        apply simp\n        apply(elim combine_blocks_waitE2)\n             apply auto\n          apply(rule wait_orig_assn.intros(2))\n         apply auto\n        apply(rule exI[where x=\"(InBlock ch v # tr1')\"])\n        apply auto\n        apply(rule waitin_tguar'_vassm'_assn.intros(3))\n        by auto\n      done\n    done\n  done\n\nlemma combine_out_0assm_rdy_waitin_tguar'_vassm'1:\n\"ch \\<in> chs \\<and> v\\<in>V \\<and> \\<not> compat_rdy rdy1 rdy2 \\<Longrightarrow> combine_assn chs (out_0assm_rdy_assn ch v rdy1 P) (waitin_tguar'_vassm'_assn S p rdy2 ch V Q) \\<Longrightarrow>\\<^sub>t \\<up>(0\\<in>S) \\<and>\\<^sub>t combine_assn chs P (Q v 0)\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_rdy_assn.cases[of ch v rdy1 P])\n      apply simp\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy2 ch V Q])\n          apply auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy2 ch V Q])\n          apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\nlemma combine_out_0assm_rdy_waitin_tguar'_vassm'2:\n\"ch1 \\<in> chs \\<and> ch2 \\<in> chs \\<and> ch1 \\<noteq> ch2 \\<and> \\<not> compat_rdy rdy1 rdy2 \\<Longrightarrow> combine_assn chs (out_0assm_rdy_assn ch1 v rdy1 P) (waitin_tguar'_vassm'_assn S p rdy2 ch2 V Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding combine_assn_def entails_tassn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_rdy_assn.cases[of ch1 v rdy1 P])\n      apply simp\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy2 ch2 V Q])\n          apply auto\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        apply(elim combine_blocks_pairE)\n        by auto\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    subgoal\n      apply(cases rule:waitin_tguar'_vassm'_assn.cases[of S p rdy2 ch2 V Q])\n          apply auto\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      subgoal\n        by (auto elim!: sync_elims)\n      done\n    done\n  done\n\nlemma combine_in_0assm_rdy_waitin_tguar'_vassm'1:\n\"ch1 \\<in> chs \\<and> ch2 \\<in> chs \\<and> \\<not> compat_rdy rdy1 rdy2 \\<Longrightarrow> combine_assn chs (in_0assm_rdy_assn ch1 V1 rdy1 P1) (waitin_tguar'_vassm'_assn S p2 rdy2 ch2 V2 P2) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding entails_tassn_def combine_assn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule:in_0assm_rdy_assn.cases[of ch1 V1 rdy1 P1 tr1])\n       apply auto\n    subgoal\n      apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S p2 rdy2 ch2 V2 P2 tr2])\n          apply auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      by (auto elim!: sync_elims)\n    done\n  subgoal\n      apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S p2 rdy2 ch2 V2 P2 tr2])\n          apply auto\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      apply(elim combine_blocks_pairE)\n      by auto\n    subgoal\n      by (auto elim!: sync_elims)\n    done\n  subgoal\n      apply(cases rule: waitin_tguar'_vassm'_assn.cases[of S p2 rdy2 ch2 V2 P2 tr2])\n          apply auto\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      by (auto elim!: sync_elims)\n    subgoal\n      by (auto elim!: sync_elims)\n    done\n  done\n  done\n\n\nlemma combine_out_0assm_rdy_wait_orig3:\n  assumes \"d>0 \\<and> ch\\<in>chs \\<and> \\<not> compat_rdy rdy' rdy\"\n      shows \"combine_assn chs (out_0assm_rdy_assn ch v rdy' Q) (wait_orig_assn d p rdy P) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding entails_tassn_def combine_assn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule:wait_orig_assn.cases[of d p rdy P tr2])\n    using assms apply auto\n    subgoal for tr2'\n      apply(cases rule:out_0assm_rdy_assn.cases[of ch v rdy' Q tr1])\n        apply auto\n      subgoal for tr1'\n        by (auto elim!: sync_elims)\n      by (auto elim!: sync_elims)\n    done\n      done\n\nlemma combine_wait_orig_out_0assm3:\n  assumes \"d>0 \\<and> ch\\<in>chs \\<and> ch\\<in>snd rdy\"\n    shows \"combine_assn chs (wait_orig_assn d p rdy P)(out_0assm_assn ch v Q) \\<Longrightarrow>\\<^sub>t R\"\n  unfolding entails_tassn_def combine_assn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule:wait_orig_assn.cases[of d p rdy P tr1])\n    using assms apply auto\n    subgoal for tr1'\n      apply(cases rule:out_0assm_assn.cases[of ch v Q tr2])\n        apply auto\n      subgoal for tr2'\n        by (auto elim!: sync_elims)\n      apply(cases rdy)\n      by (auto elim!: sync_elims)\n    done\n  done\n\n\nlemma combine_in_0assm_rdy_wait_orig2:\n\"ch \\<in> chs \\<and> \\<not>compat_rdy rdy rdy' \\<and> d>0 \\<Longrightarrow> combine_assn chs (in_0assm_rdy_assn ch V rdy P) (wait_orig_assn d p rdy' Q) \\<Longrightarrow>\\<^sub>t R\"\nunfolding entails_tassn_def combine_assn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: wait_orig_assn.cases[of d p rdy' Q tr2])\n      apply auto\n    apply(cases rule:in_0assm_rdy_assn.cases[of ch V rdy P tr1])\n       apply auto\n    by (auto elim!: sync_elims)\n  done\n    \nlemma combine_out_0assm_srdy_out_0assm1:\n\"ch1\\<in>chs \\<and> ch2 \\<in> chs \\<and> ch2 \\<in> snd srdy\\<Longrightarrow> combine_assn chs (out_0assm_srdy_assn ch1 v1 srdy P1) (out_0assm_assn ch2 v2 P2) \\<Longrightarrow>\\<^sub>t R\"\nunfolding entails_tassn_def combine_assn_def\n  apply auto\n  subgoal for tr tr1 tr2\n    apply(cases rule: out_0assm_srdy_assn.cases[of ch1 v1 srdy P1 tr1])\n      apply auto\n    subgoal\n     apply(cases rule: out_0assm_assn.cases[of ch2 v2 P2 tr2])\n       apply auto\n    subgoal\n      apply(elim combine_blocks_pairE) \n      by auto\n    subgoal\n      by (auto elim!: sync_elims)\n    done\n  subgoal\n     apply(cases rule: out_0assm_assn.cases[of ch2 v2 P2 tr2])\n      apply auto\n    subgoal\n      by (auto elim!: sync_elims)\n    apply(elim combine_blocks_waitE1)\n    apply(cases srdy)\n    by auto\n  done\n  done\n\n\n\n\nfun properl1 :: \"(real \\<times> tid) list \\<Rightarrow> bool\" where\n  \"properl1 [] = True\"\n| \"properl1 ((rp,rn) # v) = (properl1 v \\<and> properp rn rp \\<and> rn > 0 \\<and> rn \\<noteq> 1 \\<and> rn \\<noteq> 2)\"\n\nlemma properl1_p1:\n\"properl1 (p @ [(a, b)]) = (properl1 p \\<and> properp b a \\<and> b > 0 \\<and> b \\<noteq> 1 \\<and> b \\<noteq> 2)\"\nproof(induction p arbitrary: a b)\n  case Nil\n  then show ?case \n    by auto\nnext\n  case (Cons c p)\n  show ?case\n    apply(cases c)\n    subgoal for ca cb\n      apply simp\n      using Cons[of a b]\n      by auto\ndone\nqed\n\nlemma properl1_p2:\n\"properl1 p \\<Longrightarrow> properp rn rp \\<Longrightarrow> properp (snd(get_max_default (rp,rn) p)) (fst(get_max_default (rp,rn) p))\"\nproof(induction p arbitrary: rn rp)\n  case Nil\n  then show ?case \n    by auto\nnext\n  case (Cons c p)\n  then show ?case \n    apply(cases c)\n    subgoal for a b\n      by auto\n    done\nqed\n\n\nlemma properl1_p3:\n\"properl1 p \\<Longrightarrow> properp (snd (get_max p)) (fst (get_max p)) \"\nproof(induction p)\n  case Nil\n  then show ?case \n    apply auto\n    unfolding properp_def\n    by auto\nnext\n  case (Cons c p)\n  then show ?case \n    apply(cases c)\n    subgoal for a b\n      apply auto\n      apply(rule properl1_p2)\n      by auto\n    done\nqed\n\n\nlemma properl1_p4:\n\"properl1 p \\<Longrightarrow> properl1 (del_proc p t)\"\nproof(induction p)\n  case Nil\n  then show ?case \n    by auto\nnext\n  case (Cons c p)\n  then show ?case \n    apply(cases c)\n    subgoal for a b\n     by auto\n    done\nqed\n\n\n\nlemma properl1_getmax2:\n\"properl1 p \\<Longrightarrow> snd (get_max p) \\<noteq> 1 \\<and> (gb \\<noteq> 1 \\<longrightarrow> snd (get_max_default (ga, gb) p) \\<noteq> 1)\"\nproof(induction p arbitrary: ga gb)\n  case Nil\n  then show ?case \n    by auto\nnext\n  case (Cons h p)\n  then show ?case \n    apply (cases h)\n    subgoal for ha hb\n      by auto\n    done\nqed\n\nlemma properl1_getmax21:\n\"properl1 p \\<Longrightarrow> snd (get_max p) \\<noteq> 2 \\<and> (gb \\<noteq> 2 \\<longrightarrow> snd (get_max_default (ga, gb) p) \\<noteq> 2)\"\nproof(induction p arbitrary: ga gb)\n  case Nil\n  then show ?case \n    by auto\nnext\n  case (Cons h p)\n  then show ?case \n    apply (cases h)\n    subgoal for ha hb\n      by auto\n    done\nqed\n\nlemma properl1_p5':\n  \"properl1 ((a,b)#p) \\<Longrightarrow> snd(get_max_default (a,b) p) > 0\"\nproof(induction p arbitrary: a b)\n  case Nil\n  then show ?case \n    by auto\nnext\n  case (Cons g p)\n  then show ?case \n    apply(cases g)\n    by auto\nqed\n\nlemma properl1_p5:\n\"length p > 0 \\<Longrightarrow> properl1 p \\<Longrightarrow> properp (snd (get_max p)) (fst (get_max p)) \\<and> (snd (get_max p)) > 0 \\<and> (snd (get_max p)) \\<noteq> 1 \\<and> (snd (get_max p)) \\<noteq> 2\"\nproof(induction p)\n  case Nil\n  then show ?case \n    by auto\nnext\n  case (Cons c p)\n  then show ?case \n    apply(cases c)\n    subgoal for a b\n      apply auto\n      subgoal\n      apply(rule properl1_p2)\n         apply auto\n        done\n       prefer 2\n      subgoal\n        using properl1_getmax2 properl1_getmax21 apply auto\n        done\n      using properl1_p5'[of 1 2 p] \n      apply auto\n      unfolding properp_def\n      by auto\n    done\nqed\n\nlemma properl1_p6:\n\"properl1 p \\<Longrightarrow> properl1 (del_proc (p@[(1,2)]) 2)\"\nproof(induction p)\n  case Nil\n  then show ?case \n    by auto\nnext\n  case (Cons c p)\n  then show ?case \n    apply(cases c)\n    subgoal for a b\n     by auto\n    done\nqed\n\nlemma properl1_p7:\n\"properl1 p \\<Longrightarrow> p = []\"\n  apply(cases p)\n   apply auto\n  unfolding properp_def by auto\n\ndefinition proper1 :: \"estate \\<Rightarrow> bool \" where\n\"proper1 schs = ((properp (run_now schs) (run_prior schs)) \\<and> properl1 (pool schs))\"\n\n\n\ndefinition propc1 :: \"nat \\<Rightarrow> estate \\<Rightarrow> nat \\<Rightarrow> estate \\<Rightarrow> estate \\<Rightarrow> bool\" where\n\"propc1 k1 task_es1 k2 task_es2 schs = ((k1>0 \\<longrightarrow>(status task_es1 = RUNNING \\<longleftrightarrow> run_now schs = 1)) \\<and> (k2>0 \\<longrightarrow>(status task_es2 = RUNNING \\<longleftrightarrow> run_now schs = 2)))\"\n\n\nlemma combine_taskdis_sch1':\n  \"task_dis_assn' 2 k2 pd2 pc2 dis_s2 task_es2 task_s2 tr1 \\<Longrightarrow>\n   tdsch1' k1 kk pd1 pc1 dis_s1 task_es1 task_s1 schs s tr2 \\<Longrightarrow>\n   task_prior task_es1 = 2 \\<Longrightarrow>\n   task_prior task_es2 = 1 \\<Longrightarrow>\n   propc1 k1 task_es1 k2 task_es2 schs \\<Longrightarrow> \n   proper1 schs \\<Longrightarrow>\n   combine_blocks {req_ch 2, preempt_ch 2, run_ch 2, free_ch 2, exit_ch 2} tr1 tr2 tr \\<Longrightarrow>\n   tdsch2' k2 k1 kk pd2 pc2 dis_s2 task_es2 task_s2 pd1 pc1 dis_s1 task_es1 task_s1 schs s tr\"\n   proof(induction \" k2+k1+kk\"  arbitrary: k2 k1 kk dis_s2 task_es2 task_s2 dis_s1 task_es1 task_s1 schs s tr1 tr2 tr rule: less_induct)\n      case less\n      then show ?case \n        apply(cases k2)\n        subgoal \n          apply(cases kk)\n          subgoal \n            apply(cases k1)\n            subgoal\n              apply(cases task_es1)\n                apply auto\n              apply(cases task_es2)\n                apply auto\n              apply(cases schs)\n              apply (auto simp add: emp_assn_def)\n              by(auto elim: sync_elims)\n            subgoal for k1'\n              apply(cases task_es1)\n                apply auto\n              subgoal for st1 ent1 \n                apply(cases task_es2)\n                  apply auto\n                subgoal for st2 ent2\n              apply(cases schs)\n                    apply auto\n                  apply (cases st1)\n                  subgoal\n                    apply simp\n                    apply(cases k1')\n                    subgoal apply auto\n                      apply (auto simp add: emp_assn_def)\n                      by(auto elim: sync_elims)\n                  subgoal by auto\n                  done\n                apply auto\n                done\n              done\n            done\n          done\n          subgoal for kk'\n            apply auto\n            apply(cases k1)\n            subgoal\n              apply(cases task_es1)\n                apply auto\n              subgoal for st1 ent1 \n              apply(cases task_es2)\n                  apply auto\n                subgoal for st2 ent2\n              apply(cases schs)\n                apply auto\n                  subgoal premises pre for p rn rp\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                       apply(rule pre(2))\n                      apply(rule pre(12))\n                     apply(rule pre(5))\n                    apply(rule combine_emp_in_0orig_vassm'1)\n                    by auto\n                  subgoal premises pre for p rn rp\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                       apply(rule pre(2))\n                      apply(rule pre(12))\n                     apply(rule pre(5))\n                    apply(rule combine_emp_in_0orig_vassm'1)\n                    by auto\n                  subgoal premises pre for p rn rp\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                       apply(rule pre(2))\n                      apply(rule pre(12))\n                     apply(rule pre(5))\n                    apply(rule combine_emp_in_0orig_vassm'1)\n                    by auto\n                  done\n                done\n              done\n            subgoal for k1'\n              apply(cases task_es1)\n                apply auto\n              subgoal for st1 ent1 \n              apply(cases task_es2)\n                  apply auto\n                subgoal for st2 ent2\n              apply(cases schs)\n                    apply auto\n                  subgoal for p rn rp\n                    apply(cases st1)\n                      apply simp\n                    subgoal \n                      apply(erule disjE)\n                      subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_emp_wait_orig1)\n                      apply auto\n                      unfolding combine_assn_def entails_tassn_def \n                      apply auto\n                      subgoal for tr tr1 tr2\n                      using pre(1)[of 0 k1' \"(Suc kk')\" dis_s2 \"(Task st2 ent2 1)\" task_s2 tr1 \"(dis_s1(CHR ''t'' := 0))\" \"(Task READY 0 2)\" \"(task_s1(CHR ''t'' := 0))\" \"(Sch p rn rp)\" s tr2 tr]\n                      apply auto\n                      using pre unfolding propc1_def proper_def\n                      by auto\n                    done\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule combine_emp_waitin_tguar'_vassm'1)\n                      by auto\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule combine_emp_waitin_tguar'_vassm'1)\n                      by auto\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule combine_emp_waitin_tguar'_vassm'1)\n                      by auto\n                    done\n                  subgoal \n                    apply (simp only:tdsch1'.simps)\n                    apply(erule disjE)\n                    subgoal\n                      apply(cases \"rn\\<noteq>-1\")\n                       apply simp\n                      subgoal\n                        apply(subgoal_tac\"rn = 2\")\n                         prefer 2\n                        subgoal unfolding proper1_def properp_def propc1_def by auto\n                        apply simp\n                        subgoal premises pre\n                          apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                           apply(rule pre(5))\n                          apply(rule combine_emp_out_0assm1)\n                          by auto\n                        done\n                      apply simp\n                      subgoal premises pre\n                        apply(rule pre(1)[of 0 k1' kk'  dis_s2 \"(Task st2 ent2 1)\" task_s2 tr1 dis_s1 \"(Task RUNNING (Suc 0) 2)\" \"(task_s1(CHR ''c'' := up_ent_c ent1 (task_s1 CHR ''c'')))\"\n                            \"(Sch p 1 2)\" \"(s(CHR ''p'' := 2))\" tr2 tr])\n                        apply auto\n                        using pre apply auto\n                        unfolding propc1_def proper1_def properp_def by auto\n                      done\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule combine_emp_in_0orig_vassm'1)\n                      by auto\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule combine_emp_in_0orig_vassm'1)\n                      by auto\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule combine_emp_in_0orig_vassm'1)\n                      by auto\n                    done\n                  subgoal \n                    apply (simp only:tdsch1'.simps)\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule combine_emp_waitin_tguar'_vassm'1)\n                      by auto\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule combine_emp_waitin_tguar'_vassm'1)\n                      by auto\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule combine_emp_waitin_tguar'_vassm'1)\n                      by auto\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(2))\n                        apply(rule pre(13))\n                       apply(rule pre(5))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_emp_wait_orig1)\n                      apply auto\n                      subgoal \n                        apply(cases \"(get_max p)\")\n                        subgoal for a b\n                          apply auto\n                        apply(subgoal_tac \"b = 2\")\n                         prefer 2\n                        subgoal\n                          using pre(4) properl1_p5[of p] unfolding proper1_def properp_def by auto\n                        apply (rule combine_emp_out_0assm1)\n                        by auto\n                      done\n                      unfolding combine_assn_def entails_tassn_def \n                      apply auto\n                      subgoal for tr tr1 tr2\n                        apply(rule pre(1)[of 0 k1' kk' dis_s2 \"(Task st2 ent2 1)\" task_s2 tr1 dis_s1 \"(Task WAIT ent1 2)\" task_s1 \"(Sch [] (- 1) (- 1))\" s tr2 tr])\n                        apply auto using pre unfolding propc1_def proper1_def properp_def by auto\n                      done\n                    done\n                  done\n                done\n              done\n            done\n          done\n        done\n      subgoal for k2'\n        apply(cases task_es2)\n          apply auto \n        subgoal for st2 ent2\n        apply(cases kk)\n        subgoal\n          apply(cases k1)\n          subgoal\n            apply auto\n            apply(cases task_es1)\n              apply auto\n            subgoal for st1 ent1\n              apply(cases schs)\n                apply auto\n              subgoal for p rn rp\n                apply(cases st2)\n                apply simp\n                subgoal premises pre\n                  thm pre\n                  apply(rule combine_blocks_assn)\n                  apply(rule pre(2))\n                  apply(rule pre(3))\n                   apply(rule pre(6))\n                  apply(rule entails_tassn_trans)\n                   apply(rule combine_wait_orig_emp1)\n                  apply (simp del:fun_upd_apply)\n                  apply clarify\n                  apply(cases k2')\n                   apply auto\n                  subgoal\n                    unfolding combine_assn_def entails_tassn_def\n                    apply auto\n                    subgoal premises pre'\n                      thm pre'\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre'(3))\n                        apply(rule pre'(4))\n                       apply(rule pre'(5))\n                      by auto\n                    done\n                  subgoal for k2''\n                    unfolding combine_assn_def entails_tassn_def\n                    apply auto\n                    subgoal premises pre'\n                      thm pre'\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre'(5))\n                        apply(rule pre'(3))\n                       apply(rule pre'(4))\n                      apply(rule combine_out_0assm_emp1)\n                      by auto\n                    subgoal premises pre'\n                      thm pre'\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre'(5))\n                        apply(rule pre'(3))\n                       apply(rule pre'(4))\n                      apply(rule combine_out_0assm_emp1)\n                      by auto\n                    subgoal premises pre'\n                      thm pre'\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre'(5))\n                        apply(rule pre'(3))\n                       apply(rule pre'(4))\n                      apply(rule combine_out_0assm_emp1)\n                      by auto\n                    done\n                  done\n                subgoal apply auto\n                  subgoal premises pre\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                       apply(rule pre(13))\n                      apply(rule pre(2))\n                     apply(rule pre(5))\n                    apply(rule combine_out_0assm_emp1)  \n                    by auto\n                  subgoal premises pre\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                       apply(rule pre(13))\n                      apply(rule pre(2))\n                     apply(rule pre(5))\n                    apply(rule combine_out_0assm_emp1)  \n                    by auto\n                  subgoal premises pre\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                       apply(rule pre(13))\n                      apply(rule pre(2))\n                     apply(rule pre(5))\n                    apply(rule combine_out_0assm_emp1)  \n                    by auto\n                  done\n                subgoal apply auto\n                  apply(cases \"ent2 = Suc 0\")\n                  subgoal \n                    apply auto\n                    subgoal premises pre\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                       apply(rule pre(14))\n                      apply(rule pre(2))\n                     apply(rule pre(5))\n                    apply(rule combine_waitin_tguar'_vassm'_emp1)\n                    by auto\n                    subgoal premises pre\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                       apply(rule pre(14))\n                      apply(rule pre(2))\n                     apply(rule pre(5))\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_wait_orig_emp1)\n                    apply auto\n                    apply(rule combine_out_0assm_srdy_emp1)\n                    by auto\n                  done\n                by auto\n              done\n            done\n          done\n        subgoal for k1'\n          apply auto\n            apply(cases task_es1)\n              apply auto\n            subgoal for st1 ent1\n              apply(cases schs)\n                apply auto\n              subgoal for p rn rp\n                apply(cases st2)\n                  apply simp\n                subgoal \n                  apply(cases st1)\n                    apply auto\n                  subgoal \n                    apply(cases k1')\n                    subgoal\n                      apply simp\n                      subgoal premises pre\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                       apply(rule pre(2))\n                      apply(rule pre(3))\n                     apply(rule pre(6))\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_wait_orig_emp1)\n                    apply(cases k2')\n                     apply auto\n                    unfolding combine_assn_def entails_tassn_def\n                    apply auto\n                    subgoal premises pre'\n                      thm pre'\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre'(5))\n                        apply(rule pre'(3))\n                       apply(rule pre'(4))\n                      apply(rule combine_out_0assm_emp1)\n                      by auto\n                    subgoal premises pre'\n                      thm pre'\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre'(5))\n                        apply(rule pre'(3))\n                       apply(rule pre'(4))\n                      apply(rule combine_out_0assm_emp1)\n                      by auto\n                    subgoal premises pre'\n                      thm pre'\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre'(5))\n                        apply(rule pre'(3))\n                       apply(rule pre'(4))\n                      apply(rule combine_out_0assm_emp1)\n                      by auto\n                    done\n                  done\n                subgoal by simp\n                done\n              done\n            subgoal apply(cases st1)\n                apply(cases k1')\n                apply auto\n              subgoal premises pre\n                thm pre\n                apply(rule combine_blocks_assn)\n                apply(rule pre(15))\n                apply(rule pre(2))\n                apply(rule pre(5))\n                apply(rule combine_out_0assm_emp1)\n                by auto  \n              subgoal premises pre\n                thm pre\n                apply(rule combine_blocks_assn)\n                apply(rule pre(15))\n                apply(rule pre(2))\n                apply(rule pre(5))\n                apply(rule combine_out_0assm_emp1)\n                by auto  \n              subgoal premises pre\n                thm pre\n                apply(rule combine_blocks_assn)\n                apply(rule pre(15))\n                apply(rule pre(2))\n                apply(rule pre(5))\n                apply(rule combine_out_0assm_emp1)\n                by auto\n              done\n            subgoal apply(cases st1)\n                apply(cases k1')\n                 apply auto\n              apply(cases \"ent2 = Suc 0\")\n              subgoal\n                apply auto\n                subgoal premises pre\n                thm pre\n                apply(rule combine_blocks_assn)\n                apply(rule pre(16))\n                apply(rule pre(2))\n                apply(rule pre(5))\n                apply(rule combine_waitin_tguar'_vassm'_emp1)\n                by auto\n              subgoal premises pre\n                thm pre\n                apply(rule combine_blocks_assn)\n                apply(rule pre(16))\n                apply(rule pre(2))\n                 apply(rule pre(5))\n                apply(rule entails_tassn_trans)\n                 apply(rule combine_wait_orig_emp1)\n                apply auto\n                apply(rule combine_out_0assm_srdy_emp1)\n                by auto\n              done\n            by auto\n          done\n        done\n      done\n    done\n  subgoal for kk'\n    apply(cases k1)\n          subgoal\n            apply auto\n            apply(cases st2)\n              apply simp\n            subgoal\n            apply(cases schs)\n                apply auto\n              subgoal for p rn rp\n                apply(cases task_es1)\n                apply (simp del: tdsch2'.simps)\n                subgoal for st1 ent1 tp1\n                  apply (simp del: tdsch2'.simps)\n                  apply(erule disjE)\n                subgoal premises pre\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                    apply(rule pre(2))\n                      apply(rule pre(14))\n                     apply(rule pre(6))\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_wait_orig_in_0orig_vassm'1)\n                     apply (simp del: fun_upd_apply)+\n                    apply clarify\n                    unfolding combine_assn_def entails_tassn_def\n                    apply clarify\n                    subgoal premises pre' for tr tr1 tr2\n                    proof-\n                      have a:\"dis_s2 CHR ''t'' = pd2\" using pre' by auto\n                        thm pre'\n                        then show ?thesis\n                          apply(subst a)\n                      apply(rule pre(1)[of k2' 0 \"(Suc kk')\" \"(dis_s2(CHR ''t'' := 0))\" \"(Task READY 0 1)\" \"(task_s2(CHR ''t'' := 0))\" tr1 dis_s1 \"(Task st1 ent1 2)\" task_s1 \"(Sch p rn rp)\" s tr2 tr])\n                      using pre' pre unfolding propc1_def\n                      by auto\n                  qed\n                    done\n                  apply(erule disjE)\n                  subgoal premises pre\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                    apply(rule pre(2))\n                      apply(rule pre(14))\n                     apply(rule pre(6))\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_wait_orig_in_0orig_vassm'1)\n                     apply (simp del: fun_upd_apply)\n                    apply(simp only:pure_assn_entails)\n                    apply clarify\n                    unfolding combine_assn_def entails_tassn_def\n                    apply clarify\n                    apply(simp only:tdsch2'.simps)\n                    apply simp\n                    subgoal premises pre' for tr tr1 tr2\n                    proof-\n                      have a:\"dis_s2 CHR ''t'' = pd2\" using pre' by auto\n                        thm pre'\n                        then show ?thesis\n                          apply(subst a)\n                      thm pre'\n                      apply(rule pre(1)[of k2' 0 \"(Suc kk')\" \"(dis_s2(CHR ''t'' := 0))\" \"(Task READY 0 1)\" \"(task_s2(CHR ''t'' := 0))\" tr1 dis_s1 \"(Task st1 ent1 2)\" task_s1 \"(Sch p rn rp)\" s tr2 tr])\n                      using pre' pre unfolding propc1_def\n                      by auto\n                  qed\n                    done\n                  subgoal premises pre\n                    thm pre\n                    apply(rule combine_blocks_assn)\n                    apply(rule pre(2))\n                      apply(rule pre(14))\n                     apply(rule pre(6))\n                    apply(rule entails_tassn_trans)\n                     apply(rule combine_wait_orig_in_0orig_vassm'1)\n                     apply (simp del: fun_upd_apply)+\n                    apply clarify\n                    unfolding combine_assn_def entails_tassn_def\n                    apply clarify\n                    subgoal premises pre' for tr tr1 tr2\n                    proof-\n                      have a:\"dis_s2 CHR ''t'' = pd2\" using pre' by auto\n                        thm pre'\n                        then show ?thesis\n                          apply(subst a)\n                      thm pre'\n                      apply(rule pre(1)[of k2' 0 \"(Suc kk')\" \"(dis_s2(CHR ''t'' := 0))\" \"(Task READY 0 1)\" \"(task_s2(CHR ''t'' := 0))\" tr1 dis_s1 \"(Task st1 ent1 2)\" task_s1 \"(Sch p rn rp)\" s tr2 tr])\n                      using pre' pre unfolding propc1_def\n                      by auto\n                  qed\n                    done\n                  done\n                subgoal by auto\n                done\n              subgoal apply(cases task_es1)\n                by auto\n              subgoal apply(cases task_es1)\n                by auto\n              done\n            subgoal\n              apply (simp del: tdsch2'.simps)\n              apply(erule disjE)\n              subgoal\n              apply(cases schs)\n                subgoal for p rn rp\n                apply(cases task_es1)\n                apply (simp del: tdsch2'.simps)\n                subgoal for st1 ent1 tp1\n                  apply (simp del: tdsch2'.simps)\n                apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(11))\n                        apply(rule pre(14))\n                       apply(rule pre(5))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_out_0assm_in_0orig_vassm'1)\n                       apply simp\n                      apply(cases \"1 \\<le> rp\")\n                      subgoal \n                        apply (simp add: pre del: fun_upd_apply tdsch2'.simps)\n                        apply(cases kk')\n                        subgoal\n                          apply (simp del: fun_upd_apply)\n                          apply(rule combine_waitin_tguar'_vassm'_emp1)\n                          by auto\n                        subgoal for kk''\n                          apply (simp del: fun_upd_apply tdsch2'.simps)\n                          unfolding combine_assn_def entails_tassn_def\n                          apply clarify\n                          apply (erule disjE)\n                          subgoal premises pre'\n                            thm pre'\n                            apply(rule combine_blocks_assn)\n                               apply(rule pre'(3))\n                              apply(rule pre'(5))\n                             apply(rule pre'(4))\n                            apply(rule combine_waitin_tguar'_vassm'_in_0orig_vassm'1)\n                            by auto\n                          apply (erule disjE)\n                          subgoal premises pre'\n                            thm pre'\n                            apply(rule combine_blocks_assn)\n                               apply(rule pre'(3))\n                              apply(rule pre'(5))\n                             apply(rule pre'(4))\n                            apply(rule combine_waitin_tguar'_vassm'_in_0orig_vassm'1)\n                            by auto\n                          subgoal premises pre'\n                            thm pre'\n                            apply(rule combine_blocks_assn)\n                               apply(rule pre'(3))\n                              apply(rule pre'(5))\n                             apply(rule pre'(4))\n                            apply(rule combine_waitin_tguar'_vassm'_in_0orig_vassm'1)\n                            by auto\n                          done\n                        done\n                      apply(cases \"rn \\<noteq> - 1\")\n                      subgoal\n                        apply (simp del: fun_upd_apply tdsch2'.simps)\n                        unfolding combine_assn_def entails_tassn_def pure_assn_def conj_assn_def\n                        apply auto\n                        using pre(4,3) unfolding propc1_def proper1_def properp_def by auto\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_waitin_tguar'_vassm'_out_0assm1)\n                      subgoal by auto\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      unfolding combine_assn_def entails_tassn_def\n                      apply clarify\n                      apply simp\n                      apply(rule disjI1)\n                      subgoal for tr tr1 tr2\n                        apply(rule pre(1)[of k2' 0 kk' dis_s2 \"(Task RUNNING (Suc 0) 1)\" \"(task_s2(CHR ''c'' := up_ent_c ent2 (task_s2 CHR ''c'')))\" tr1 dis_s1 \"(Task st1 ent1 2)\" task_s1\n                            \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr])\n                        using pre\n                               apply auto\n                        unfolding propc1_def proper1_def properp_def\n                        by auto\n                      done\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(11))\n                        apply(rule pre(14))\n                       apply(rule pre(5))\n                      apply(rule combine_out_0assm_in_0orig_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(11))\n                        apply(rule pre(14))\n                       apply(rule pre(5))\n                      apply(rule combine_out_0assm_in_0orig_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    done\n                  subgoal by auto\n                  done\n                subgoal\n                 apply(cases task_es1)by auto\n                subgoal\n                  apply(cases task_es1)by auto\n                done\n              apply(erule disjE)\n              subgoal\n              apply(cases schs)\n                subgoal for p rn rp\n                apply(cases task_es1)\n                apply (simp del: tdsch2'.simps)\n                subgoal for st1 ent1 tp1\n                  apply (simp del: tdsch2'.simps)\n                apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(11))\n                        apply(rule pre(14))\n                       apply(rule pre(5))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_out_0assm_in_0orig_vassm'1)\n                       apply simp\n                      apply(cases \"1 \\<le> rp\")\n                      subgoal \n                        apply (simp add: pre del: fun_upd_apply tdsch2'.simps)\n                        apply(cases kk')\n                        subgoal\n                          apply (simp del: fun_upd_apply tdsch2'.simps)\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_wait_orig_emp1)\n                          apply (simp del: fun_upd_apply tdsch2'.simps)\n                          apply clarify\n                          apply(rule combine_out_0assm_rdy_emp1)\n                          by auto\n                        subgoal for kk''\n                          apply (simp del: fun_upd_apply tdsch2'.simps)\n                          unfolding combine_assn_def entails_tassn_def\n                          apply clarify\n                          apply (erule disjE)\n                          subgoal premises pre'\n                            thm pre'\n                            apply(rule combine_blocks_assn)\n                               apply(rule pre'(3))\n                              apply(rule pre'(5))\n                             apply(rule pre'(4))\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_wait_orig_in_0orig_vassm'1)\n                             apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply clarify\n                            apply(rule combine_out_0assm_rdy_in_0orig_vassm'2)\n                            by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                          apply (erule disjE)\n                          subgoal premises pre'\n                            thm pre'\n                            apply(rule combine_blocks_assn)\n                               apply(rule pre'(3))\n                              apply(rule pre'(5))\n                             apply(rule pre'(4))\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_wait_orig_in_0orig_vassm'1)\n                             apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply clarify\n                            apply(rule combine_out_0assm_rdy_in_0orig_vassm'2)\n                            by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                          apply(simp only: tdsch2'.simps)\n                          apply(rule disjI2)\n                          subgoal premises pre'\n                            thm pre'\n                            apply(rule combine_blocks_assn)\n                               apply(rule pre'(3))\n                              apply(rule pre'(5))\n                             apply(rule pre'(4))\n                            apply(rule entails_tassn_trans)\n                            apply(rule combine_wait_orig_in_0orig_vassm'1)\n                             apply simp\n                            apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply clarify\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_out_0assm_rdy_in_0orig_vassm'1)\n                            subgoal by auto\n                            unfolding combine_assn_def entails_tassn_def\n                            apply auto\n                            subgoal premises pre'' for tr tr1 tr2\n                            proof-\n                              have a:\"task_s2 CHR ''t'' = pd2\" using pre'' by auto\n                              thm pre'\n                              then show ?thesis\n                                apply(subst a)\n                              apply(rule pre(1)[of k2' 0 kk'' \"(dis_s2(CHR ''t'' := task_s2 CHR ''t''))\" \"(Task WAIT ent2 1)\" \"(task_s2)\" tr1 dis_s1 \"(Task st1 ent1 2)\" task_s1\n                                    \"(Sch (del_proc (p @ [(1, 2)]) 2) rn rp)\" \"(s(CHR ''p'' := 1))\" tr2 tr])\n                                using pre' pre pre'' properl1_p6[of \"p\"] properl1_p1[of p 1 2]  apply auto unfolding propc1_def proper1_def properp_def by auto\n                            qed\n                            done\n                          done\n                        done\n                      apply(cases \"rn \\<noteq> - 1\")\n                      subgoal\n                        apply (simp del: fun_upd_apply tdsch2'.simps)\n                        unfolding combine_assn_def entails_tassn_def pure_assn_def conj_assn_def\n                        apply auto\n                        using pre(4,3) unfolding propc1_def proper1_def properp_def by auto\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_out_0assm1)\n                       apply simp\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      apply clarify\n                      apply(rule combine_out_0assm_rdy_out_0assm)\n                      by auto\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(11))\n                        apply(rule pre(14))\n                       apply(rule pre(5))\n                      apply(rule combine_out_0assm_in_0orig_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(11))\n                        apply(rule pre(14))\n                       apply(rule pre(5))\n                      apply(rule combine_out_0assm_in_0orig_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    done\n                  by auto\n                subgoal apply(cases task_es1) by auto\n                subgoal apply(cases task_es1) by auto\n                done\n              subgoal\n              apply(cases schs)\n                subgoal for p rn rp\n                apply(cases task_es1)\n                apply (simp del: tdsch2'.simps)\n                subgoal for st1 ent1 tp1\n                  apply (simp del: tdsch2'.simps)\n                  apply(erule disjE)\n                  subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(11))\n                        apply(rule pre(14))\n                       apply(rule pre(5))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_out_0assm_in_0orig_vassm'1)\n                       apply simp\n                      apply(cases \"1 \\<le> rp\")\n                      subgoal \n                        apply (simp add: pre del: fun_upd_apply tdsch2'.simps)\n                        apply(cases kk')\n                        subgoal\n                          apply (simp del: fun_upd_apply tdsch2'.simps)\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_wait_orig_emp1)\n                          apply (simp del: fun_upd_apply tdsch2'.simps)\n                          apply clarify\n                          apply(rule combine_in_0assm_rdy_emp1)\n                          by auto\n                        subgoal for kk''\n                          apply (simp del: fun_upd_apply tdsch2'.simps)\n                          unfolding combine_assn_def entails_tassn_def\n                          apply clarify\n                          apply (erule disjE)\n                          subgoal premises pre'\n                            thm pre'\n                            apply(rule combine_blocks_assn)\n                               apply(rule pre'(3))\n                              apply(rule pre'(5))\n                             apply(rule pre'(4))\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_wait_orig_in_0orig_vassm'1)\n                             apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply clarify\n                            apply(rule combine_in_0assm_rdy_in_0orig_vassm'2)\n                            by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                          apply (erule disjE)\n                          subgoal premises pre'\n                            thm pre'\n                            apply(rule combine_blocks_assn)\n                               apply(rule pre'(3))\n                              apply(rule pre'(5))\n                             apply(rule pre'(4))\n                            apply(rule entails_tassn_trans)\n                             apply(rule combine_wait_orig_in_0orig_vassm'1)\n                             apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply clarify\n                            apply(rule combine_in_0assm_rdy_in_0orig_vassm'2)\n                            by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                          apply(simp only: tdsch2'.simps)\n                          apply(rule disjI2)\n                          subgoal premises pre'\n                            thm pre'\n                            apply(rule combine_blocks_assn)\n                               apply(rule pre'(3))\n                              apply(rule pre'(5))\n                             apply(rule pre'(4))\n                            apply(rule entails_tassn_trans)\n                            apply(rule combine_wait_orig_in_0orig_vassm'1)\n                             apply simp\n                            apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply clarify\n                            apply(rule combine_in_0assm_rdy_in_0orig_vassm'2)\n                            subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                            done\n                          done\n                        done\n                      apply(cases \"rn \\<noteq> - 1\")\n                      subgoal\n                        apply (simp del: fun_upd_apply tdsch2'.simps)\n                        unfolding combine_assn_def entails_tassn_def pure_assn_def conj_assn_def\n                        apply auto\n                        using pre(4,3) unfolding propc1_def proper1_def properp_def by auto\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_out_0assm1)\n                       apply simp\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      apply clarify\n                      apply(rule entails_tassn_trans)\n                      apply(rule combine_in_0assm_rdy_out_0assm1)\n                      subgoal by auto\n                      unfolding combine_assn_def entails_tassn_def\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      apply clarify                      \n                      subgoal premises pre' for tr tr1 tr2\n                        thm pre'\n                      proof-\n                        have a:\"task_s2 CHR ''t'' = pd2\" using pre' by auto\n                        then show ?thesis\n                          using pre'\n                        apply simp\n                          apply(rule disjI1)\n                          apply(subst a)\n                        apply(rule pre(1)[of k2' 0 kk' dis_s2 \"(Task RUNNING (Suc 0) 1)\" \"(task_s2(CHR ''c'' := up_ent_c ent2 (task_s2 CHR ''c'')))\" tr1 dis_s1 \"(Task st1 ent1 2)\" task_s1\n                            \"(Sch p 2 1)\" \"(s(CHR ''p'' := 1))\" tr2 tr])\n                        apply auto\n                        apply(subgoal_tac \"(dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + pd2 - task_s2 CHR ''t'')) = dis_s2\")\n                            apply(subgoal_tac \"(task_s2(CHR ''t'' := pd2, CHR ''c'' := up_ent_c ent2 (task_s2 CHR ''c''))) = (task_s2(CHR ''c'' := up_ent_c ent2 (task_s2 CHR ''c'')))\")\n                             apply auto\n                          using pre unfolding propc1_def proper1_def properp_def by auto\n                      qed\n                      done\n                    apply(erule disjE)\n                  subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(11))\n                        apply(rule pre(14))\n                       apply(rule pre(5))\n                      apply(rule combine_out_0assm_in_0orig_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(11))\n                        apply(rule pre(14))\n                       apply(rule pre(5))\n                      apply(rule combine_out_0assm_in_0orig_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    done\n                  by auto\n                subgoal apply(cases task_es1) by auto\n                subgoal apply(cases task_es1) by auto\n                done\n              done\n            subgoal\n              apply (simp del: tdsch2'.simps)\n              apply(cases \"ent2 = Suc 0\")\n              subgoal\n                apply (simp del: tdsch2'.simps)\n                apply(erule disjE)\n                subgoal\n                  apply(cases schs)\n                  subgoal for p rn rp\n                    apply(cases task_es1)\n                      apply (simp del: tdsch2'.simps)\n                    subgoal for st1 ent1 tp1\n                      apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(12))\n                        apply(rule pre(15))\n                       apply(rule pre(5))\n                      apply(rule combine_waitin_tguar'_vassm'_in_0orig_vassm'1)\n                      by auto\n                    apply(erule disjE)\n                      subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(12))\n                        apply(rule pre(15))\n                       apply(rule pre(5))\n                      apply(rule combine_waitin_tguar'_vassm'_in_0orig_vassm'1)\n                      by auto\n                      subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(12))\n                        apply(rule pre(15))\n                       apply(rule pre(5))\n                      apply(rule combine_waitin_tguar'_vassm'_in_0orig_vassm'1)\n                      by auto\n                    done\n                  by auto\n                subgoal\n                  apply(cases task_es1) by auto\n                subgoal\n                  apply(cases task_es1) by auto\n                done\n              subgoal\n                  apply(cases schs)\n                  subgoal for p rn rp\n                    apply(cases task_es1)\n                      apply (simp del: tdsch2'.simps)\n                    subgoal for st1 ent1 tp1\n                      apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(12))\n                        apply(rule pre(15))\n                       apply(rule pre(5))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_in_0orig_vassm'1)\n                      apply simp\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      apply clarify\n                      apply(rule combine_out_0assm_srdy_in_0orig_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    apply(erule disjE)\n                      subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(12))\n                        apply(rule pre(15))\n                       apply(rule pre(5))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_in_0orig_vassm'1)\n                      apply simp\n                      apply (simp only:pure_assn_entails)\n                      apply clarify\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_out_0assm_srdy_in_0orig_vassm'1)\n                       apply simp\n                      apply(cases \"p \\<noteq> []\")\n                      subgoal apply simp\n                        apply(cases \"get_max p\")\n                        subgoal for a b\n                          apply (simp del: fun_upd_apply tdsch2'.simps)\n                          using pre(4) properl1_p5[of p] unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply auto\n                      unfolding combine_assn_def entails_tassn_def\n                      apply auto\n                      subgoal for tr tr1 tr2\n                        apply(rule pre(1)[of k2' 0 kk' dis_s2 \"(Task WAIT (Suc 0) 1)\" task_s2 tr1 dis_s1 \"(Task st1 ent1 2)\" task_s1 \"(Sch [] (- 1) (- 1))\" s tr2 tr])\n                        using pre unfolding propc1_def proper1_def properp_def by auto\n                      done\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                         apply(rule pre(12))\n                        apply(rule pre(15))\n                       apply(rule pre(5))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_in_0orig_vassm'1)\n                       apply simp\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      apply clarify\n                      apply(rule combine_out_0assm_srdy_in_0orig_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    done\n                  by auto\n                subgoal apply(cases task_es1) by auto\n                subgoal apply(cases task_es1) by auto\n                done\n              done\n            by auto\n          done\n        subgoal for k1'\n          apply auto\n            apply(cases st2)\n              apply simp\n            subgoal\n            apply(cases schs)\n                apply auto\n              subgoal for p rn rp\n                apply(cases task_es1)\n                apply (simp del: tdsch2'.simps)\n                subgoal for st1 ent1 tp1\n                  apply (simp del: tdsch2'.simps)\n                  apply(cases st1)\n                  subgoal\n                    apply (simp del: tdsch2'.simps)\n                    apply(cases \"(pd2 - dis_s2 CHR ''t'') > (pd1 - dis_s1 CHR ''t'')\")\n                    subgoal\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(16))\n                         apply(rule pre(6))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_wait_orig_wait_orig4)\n                        subgoal using pre by auto \n                        apply (simp del:fun_upd_apply)\n                        apply(rule wait_orig_assn_tran)\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                          subgoal by auto\n                          subgoal apply simp\n                            apply(subgoal_tac \"(pd2 - dis_s2 CHR ''t'' - (pd1 - dis_s1 CHR ''t'')) = (pd2 - (dis_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'')))\")\n                            apply(subgoal_tac \"(\\<lambda>t. ParState (EState (Task WAIT ent2 1, task_s2))\n           (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (t + (pd1 - dis_s1 CHR ''t'')))))) =\n                                               (\\<lambda>t. ParState (EState (Task WAIT ent2 1, task_s2)) (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') + t))))\")\n                              apply auto\n                            apply(rule ext)\n                            by auto\n                               apply auto\n                          using pre \n                          unfolding propc1_def proper1_def by auto\n                        done\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(16))\n                         apply(rule pre(6))\n                        apply(rule combine_wait_orig_waitin_tguar'_vassm'1)\n                        using pre by auto\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(16))\n                         apply(rule pre(6))\n                        apply(rule combine_wait_orig_waitin_tguar'_vassm'1)\n                        using pre by auto\n                      subgoal premises pre\n                        apply simp\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(16))\n                         apply(rule pre(6))\n                        apply(rule combine_wait_orig_waitin_tguar'_vassm'1)\n                        using pre by auto\n                      done\n                    apply(cases \"(pd2 - dis_s2 CHR ''t'') < (pd1 - dis_s1 CHR ''t'')\")\n                    subgoal\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(17))\n                         apply(rule pre(6))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_wait_orig_wait_orig3)\n                        subgoal using pre by auto\n                        apply (simp del:fun_upd_apply)\n                        apply(rule wait_orig_assn_tran)\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                          subgoal by auto\n                          subgoal by auto\n                          subgoal apply simp\n                            apply(rule disjI1)\n                            apply(subgoal_tac \"(pd1 - dis_s1 CHR ''t'' - (pd2 - dis_s2 CHR ''t'')) = (pd1 - (dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'')))\")\n                            apply(subgoal_tac \"(\\<lambda>t. ParState\n           (ParState (EState (Task WAIT ent1 2, task_s1))\n             (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t''))))))\n           (EState (Sch p rn rp, s)))       = (\\<lambda>t. ParState\n           (ParState (EState (Task WAIT ent1 2, task_s1))\n             (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'') + t))))\n           (EState (Sch p rn rp, s)))\")\n                              apply auto\n                            apply(rule ext)\n                            by auto\n                              apply auto\n                          using pre \n                          unfolding propc1_def proper1_def by auto\n                        done\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(17))\n                         apply(rule pre(6))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_wait_orig_waitin_tguar'_vassm'2)\n                        subgoal using pre by auto\n                        apply (simp del:fun_upd_apply)\n                        apply(rule wait_orig_assn_tran)\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                          subgoal by auto\n                          subgoal by auto\n                          subgoal apply simp\n                            apply(rule disjI2)\n                            apply(rule disjI1)\n                            apply(subgoal_tac \"(pd1 - dis_s1 CHR ''t'' - (pd2 - dis_s2 CHR ''t'')) = (pd1 - (dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'')))\")\n                            apply(subgoal_tac \"(\\<lambda>t. ParState\n                                                 (ParState (EState (Task WAIT ent1 2, task_s1))\n                                                   (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t''))))))\n                                                 (EState (Sch p rn rp, s)))       = (\\<lambda>t. ParState\n                                                 (ParState (EState (Task WAIT ent1 2, task_s1))\n                                                   (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'') + t))))\n                                                 (EState (Sch p rn rp, s)))\")\n                              apply auto\n                            apply(subgoal_tac \"(\\<lambda>v d. if v \\<le> rp\n            then tdsch1' (Suc k1') kk' pd1 pc1\n                  (dis_s1\n                   (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n                    CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d))\n                  (Task WAIT ent1 2) task_s1 (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))\n            else if rn \\<noteq> - 1\n                 then out_0assm_assn (preempt_ch rn) 0\n                       (out_0assm_assn (run_ch 2) 0\n                         (tdsch1' (Suc k1') kk' pd1 pc1\n                           (dis_s1\n                            (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n                             CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d))\n                           (Task WAIT ent1 2) task_s1 (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))))\n                 else out_0assm_assn (run_ch 2) 0\n                       (tdsch1' (Suc k1') kk' pd1 pc1\n                         (dis_s1\n                          (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n                           CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d))\n                         (Task WAIT ent1 2) task_s1 (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v)))) =\n                        (\\<lambda>v d. if v \\<le> rp\n            then tdsch1' (Suc k1') kk' pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')))) (Task WAIT ent1 2) task_s1\n                  (sched_push 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))\n            else if rn \\<noteq> - 1\n                 then out_0assm_assn (preempt_ch rn) 0\n                       (out_0assm_assn (run_ch 2) 0\n                         (tdsch1' (Suc k1') kk' pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')))) (Task WAIT ent1 2)\n                           task_s1 (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))))\n                 else out_0assm_assn (run_ch 2) 0\n                       (tdsch1' (Suc k1') kk' pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')))) (Task WAIT ent1 2)\n                         task_s1 (sched_assign 2 (Sch p rn rp) (s(CHR ''p'' := v))) (s(CHR ''p'' := v))))\")\n                            subgoal by auto\n                            subgoal \n                              apply(rule ext)\n                              apply(rule ext)\n                              subgoal for v d\n                                apply(subgoal_tac\"(dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')))) = (dis_s1\n                   (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n                    CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d))\")\n                                by auto\n                              done\n                            apply(rule ext)\n                            apply auto\n                            done\n                          using pre \n                          unfolding propc1_def proper1_def by auto\n                        done\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(17))\n                         apply(rule pre(6))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_wait_orig_waitin_tguar'_vassm'2)\n                        subgoal using pre by auto\n                        apply (simp del:fun_upd_apply)\n                        apply(rule wait_orig_assn_tran)\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                          subgoal by auto\n                          subgoal by auto\n                          subgoal apply simp\n                            apply(rule disjI2)\n                            apply(rule disjI2)\n                            apply(rule disjI1)\n                            apply(subgoal_tac \"pd1 - dis_s1 CHR ''t'' - (pd2 - dis_s2 CHR ''t'') = pd1 - (dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))\")\n                            apply auto\n                             apply(subgoal_tac \"(\\<lambda>t. ParState\n                                         (ParState (EState (Task WAIT ent1 2, task_s1))\n                                           (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t''))))))\n                                         (EState (Sch p rn rp, s)))       = (\\<lambda>t. ParState\n                                         (ParState (EState (Task WAIT ent1 2, task_s1))\n                                           (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'') + t))))\n                                         (EState (Sch p rn rp, s)))\")\n                             apply auto\n                            subgoal premises pre'\n                            proof-\n                              have a: \"(dis_s1\n              (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n               CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d)) = (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t''))))\" for d\n                                by auto\n                              have b:\"(\\<lambda>v d. if p \\<noteq> []\n            then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n                  (tdsch1' (Suc k1') kk' pd1 pc1\n                    (dis_s1\n                     (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n                      CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d))\n                    (Task WAIT ent1 2) task_s1 (sched_get_max (Sch p rn rp) s) s)\n            else tdsch1' (Suc k1') kk' pd1 pc1\n                  (dis_s1\n                   (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n                    CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d))\n                  (Task WAIT ent1 2) task_s1 (sched_get_max (Sch p rn rp) s) s) =\n                          (\\<lambda>v d. if p \\<noteq> []\n            then out_0assm_assn (run_ch (run_now (sched_get_max (Sch p rn rp) s))) 0\n                  (tdsch1' (Suc k1') kk' pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')))) (Task WAIT ent1 2) task_s1\n                    (sched_get_max (Sch p rn rp) s) s)\n            else tdsch1' (Suc k1') kk' pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')))) (Task WAIT ent1 2) task_s1\n                  (sched_get_max (Sch p rn rp) s) s)\"\n                            apply(rule ext)\n                              apply(rule ext)\n                              subgoal for v d\n                                apply(subst a)+\n                                by auto\n                              done\n                            show ?thesis\n                              using pre'(2)\n                              apply(subst b)+\n                            apply auto\n                              done\n                          qed\n                          apply(rule ext)\n                          by auto\n                          using pre \n                          unfolding propc1_def proper1_def by auto\n                        done\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(17))\n                         apply(rule pre(6))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_wait_orig_waitin_tguar'_vassm'2)\n                        subgoal using pre by auto\n                        apply (simp del:fun_upd_apply)\n                        apply(rule wait_orig_assn_tran)\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                          subgoal by auto\n                          subgoal by auto\n                          subgoal apply simp\n                            apply(rule disjI2)\n                            apply(rule disjI2)\n                            apply(rule disjI2)\n                            subgoal premises pre'\n                            proof-\n                              have a:\"pd1 - (dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'')) = pd1 - dis_s1 CHR ''t'' - (pd2 - dis_s2 CHR ''t'') \"\n                                by auto\n                              have b:\"(\\<lambda>t. ParState\n           (ParState (EState (Task WAIT ent1 2, task_s1))\n             (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'') + t))))\n           (EState (Sch p rn rp, s))) = (\\<lambda>t. ParState\n           (ParState (EState (Task WAIT ent1 2, task_s1))\n             (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t''))))))\n           (EState (Sch p rn rp, s)))\"\n                                apply(rule ext)\n                                by auto\n                              have c:\"dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'') + d) = dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')))\" for d\n                                by auto\n                              have d:\"(\\<lambda>v d. tdsch1' (Suc k1') kk' pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'') + d)) (Task WAIT ent1 2) task_s1\n             (Sch (del_proc p 2) rn rp) s) = (\\<lambda>v d. tdsch1' (Suc k1') kk' pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')))) (Task WAIT ent1 2) task_s1\n             (Sch (del_proc p 2) rn rp) s)\"\n                                apply(rule ext)+\n                                apply(subst c)\n                                by auto\n                                show ?thesis\n                                using pre'(2)\n                                apply(subst a)\n                                apply(subst b)\n                                apply(subst d)\n                                by auto\n                            qed\n                            done\n                          using pre \n                          unfolding propc1_def proper1_def by auto\n                        done\n                      done\n                    apply(cases \"(pd2 - dis_s2 CHR ''t'') = (pd1 - dis_s1 CHR ''t'')\")\n                    subgoal\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        apply(rule disjI2)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(18))\n                         apply(rule pre(6))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_wait_orig_wait_orig2)\n                        subgoal using pre by auto\n                        apply (simp del:fun_upd_apply)\n                        apply(rule wait_orig_assn_tran)\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                          using pre \n                          unfolding propc1_def proper1_def by auto\n                        done\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(18))\n                         apply(rule pre(6))\n                        apply(rule combine_wait_orig_waitin_tguar'_vassm'1)\n                        using pre by auto\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(18))\n                         apply(rule pre(6))\n                        apply(rule combine_wait_orig_waitin_tguar'_vassm'1)\n                        using pre by auto\n                      subgoal premises pre\n                        apply simp\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                        apply(rule pre(2))\n                          apply(rule pre(18))\n                         apply(rule pre(6))\n                        apply(rule combine_wait_orig_waitin_tguar'_vassm'1)\n                        using pre by auto\n                      done\n                    by auto\n                  subgoal\n                    apply(cases \"(pd2 - dis_s2 CHR ''t'') = 0\")\n                    subgoal \n                      apply(simp del:tdsch1'.simps tdsch2'.simps)\n                      apply(cases rule:wait_orig_assn.cases[of 0 \"(\\<lambda>t. ParState (EState (Task WAIT ent2 1, task_s2)) (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\"\n     \"({}, {dispatch_ch 2})\" \"(task_dis_assn' 2 k2' (dis_s2 CHR ''t'') pc2 (dis_s2(CHR ''t'' := 0)) (Task READY 0 1) (task_s2(CHR ''t'' := 0)))\" tr1 ])\n                        apply(simp del:tdsch1'.simps tdsch2'.simps)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI1)\n                        apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                        using pre \n                        unfolding propc1_def proper1_def by auto\n                      by auto\n                    apply(cases \"(pd2 - dis_s2 CHR ''t'') > 0\")\n                    subgoal\n                     apply(simp del:tdsch2'.simps)\n                     apply(subgoal_tac\"rn = -1\")\n                       prefer 2\n                      subgoal\n                      unfolding propc1_def proper1_def properp_def by auto\n                    apply(simp del:tdsch2'.simps)\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply simp\n                      apply(rule disjI2)\n                      apply (simp add: pre)\n                      apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                      using pre\n                      unfolding propc1_def proper1_def properp_def by auto\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(17))\n                       apply(rule pre(6))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_in_0orig_vassm'1)\n                      subgoal by auto\n                      using pre by auto\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(17))\n                       apply(rule pre(6))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_in_0orig_vassm'1)\n                      subgoal by auto\n                      using pre by auto\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(17))\n                       apply(rule pre(6))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_in_0orig_vassm'1)\n                      subgoal by auto\n                      using pre by auto\n                    done\n                  apply(cases rule:wait_orig_assn.cases[of \"(pd2 - dis_s2 CHR ''t'')\"\n     \"(\\<lambda>t. ParState (EState (Task WAIT ent2 1, task_s2)) (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + t))))\" \"({}, {dispatch_ch 2})\"\n     \"(task_dis_assn' 2 k2' pd2 pc2 (dis_s2(CHR ''t'' := 0)) (Task READY 0 1) (task_s2(CHR ''t'' := 0)))\" tr1])\n                  by auto\n                subgoal \n                  apply(simp del:tdsch2'.simps)\n                  apply(cases \"(pd2 - dis_s2 CHR ''t'') > min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                  subgoal\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(16))\n                       apply(rule pre(6))\n                      apply(rule combine_wait_orig_waitin_tguar'_vassm'3)\n                      using pre \n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(16))\n                       apply(rule pre(6))\n                      apply(rule combine_wait_orig_waitin_tguar'_vassm'3)\n                      using pre \n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(16))\n                       apply(rule pre(6))\n                      apply(rule combine_wait_orig_waitin_tguar'_vassm'3)\n                      using pre \n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    apply(subgoal_tac \"p = []\")\n                     prefer 2\n                    subgoal using properl1_p7 unfolding proper1_def by auto\n                    apply(simp del:tdsch2'.simps)\n                    subgoal premises pre\n                      apply(simp add: pre)\n                      apply(rule disjI1)\n                      thm pre\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(16))\n                       apply(rule pre(6))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_wait_orig4)\n                      subgoal using pre \n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply (auto simp del:fun_upd_apply)\n                      apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, dispatch_ch 2})\")\n                      prefer 2 subgoal by auto\n                      apply (auto simp del:fun_upd_apply)\n                       apply(rule wait_orig_assn_tran)\n                      unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply auto\n                          subgoal premises pre'\n                          proof-\n                            have a: \"(pd2 - (dis_s2 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))) = (pd2 - dis_s2 CHR ''t'' - min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))\"\n                            by auto\n                           have b:\"(\\<lambda>t. ParState (EState (Task WAIT ent2 1, task_s2))\n           (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') + t)))) =\n                                            (\\<lambda>t. ParState (EState (Task WAIT ent2 1, task_s2))\n           (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (t + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))))))\"\n                             apply (rule ext)\n                             by auto\n                           show ?thesis\n                             apply(subst a)\n                             apply(subst b)\n                             using pre'\n                             by auto\n                         qed\n                         using pre \n                         unfolding propc1_def proper1_def properp_def by auto\n                       done\n                     done\n                   apply(cases \"(pd2 - dis_s2 CHR ''t'') \\<le> min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                  subgoal\n                    apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply (simp only:tdsch2'.simps)\n                      apply(rule disjI2)\n                      using pre(16)\n                      apply(auto)\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(17))\n                       apply(rule pre(6))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_waitin_tguar'_vassm'4)\n                      subgoal using pre \n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(simp del:tdsch2'.simps fun_upd_apply)\n                      apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, dispatch_ch 2})\")\n                      prefer 2 subgoal by auto\n                      apply (auto simp del:fun_upd_apply)\n                      apply(rule wait_orig_assn_tran)\n                      unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                                apply simp\n                          subgoal apply(simp only:tdsch1'.simps)\n                            apply (rule disjI1)\n                            subgoal premises pre'\n                            proof-\n                              have a:\"min (pd1 -\n             (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n              CHR ''t'')(pc1 - (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''))) CHR ''c'') \n                  = min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') - (pd2 - dis_s2 CHR ''t'')\"\n                                by auto\n                              have b:\"(\\<lambda>t. ParState\n           (ParState\n             (EState\n               (Task RUNNING ent1 2, task_s1\n                (CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''),\n                 CHR ''t'' :=\n                   (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                    CHR ''t'' +\n                   t,\n                 CHR ''c'' :=\n                   (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                    CHR ''c'' +\n                   t)))\n             (EState\n               (estate.None, dis_s1\n                (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n                 CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + t))))\n           (EState (Sch p rn rp, s))) = (\\<lambda>t. ParState\n           (ParState\n             (EState\n               (Task RUNNING ent1 2, task_s1\n                (CHR ''t'' := task_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t'')), CHR ''c'' := task_s1 CHR ''c'' + (t + (pd2 - dis_s2 CHR ''t'')))))\n             (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t''))))))\n           (EState (Sch p rn rp, s)))\"\n                                apply (rule ext)\n                                by auto\n                              have c:\"(dis_s1\n             (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n              CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d)) = (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t''))))\" for d\n                                by auto\n                              have d:\"(task_s1\n              (CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''),\n               CHR ''t'' :=\n                 (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                  CHR ''t'' +\n                 d,\n               CHR ''c'' :=\n                 (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                  CHR ''c'' +\n                 d)) = (task_s1\n              (CHR ''t'' := task_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')), CHR ''c'' := task_s1 CHR ''c'' + (d + (pd2 - dis_s2 CHR ''t''))))\" for d\n                                by auto\n                              have e:\"(\\<lambda>v d. tdsch1' (Suc k1') kk' pd1 pc1\n             (dis_s1\n              (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n               CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d))\n             (Task RUNNING ent1 2)\n             (task_s1\n              (CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''),\n               CHR ''t'' :=\n                 (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                  CHR ''t'' +\n                 d,\n               CHR ''c'' :=\n                 (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                  CHR ''c'' +\n                 d))\n             (Sch (p @ [(1, 2)]) 1 2) (s(CHR ''p'' := 1))) = (\\<lambda>v d. tdsch1' (Suc k1') kk' pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')))) (Task RUNNING ent1 2)\n             (task_s1\n              (CHR ''t'' := task_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')), CHR ''c'' := task_s1 CHR ''c'' + (d + (pd2 - dis_s2 CHR ''t''))))\n             (Sch (p @ [(1, 2)]) 1 2) (s(CHR ''p'' := 1)))\"\n                                apply(rule ext)\n                                apply(rule ext)\n                                apply(subst c)\n                                apply(subst d)\n                                by auto\n                              show ?thesis\n                                apply(subst a)\n                                apply(subst b)\n                                apply(subst e)\n                                using pre' by auto\n                            qed\n                            done\n                          using pre \n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply (simp only:tdsch2'.simps)\n                      apply(rule disjI2)\n                      using pre(16)\n                      apply(auto)\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(17))\n                       apply(rule pre(6))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_waitin_tguar'_vassm'4)\n                      subgoal using pre \n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(simp del:tdsch2'.simps fun_upd_apply)\n                      apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, dispatch_ch 2})\")\n                      prefer 2 subgoal by auto\n                      apply (auto simp del:fun_upd_apply)\n                      apply(rule wait_orig_assn_tran)\n                      unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                                apply simp\n                          subgoal apply(simp only:tdsch1'.simps)\n                            apply (rule disjI2)\n                            apply (rule disjI1)\n                            subgoal premises pre'\n                            proof-\n                              have a:\"min (pd1 -\n             (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n              CHR ''t'')(pc1 - (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''))) CHR ''c'') \n                  = min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') - (pd2 - dis_s2 CHR ''t'')\"\n                                by auto\n                              have b:\"(\\<lambda>t. ParState\n           (ParState\n             (EState\n               (Task RUNNING ent1 2, task_s1\n                (CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''),\n                 CHR ''t'' :=\n                   (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                    CHR ''t'' +\n                   t,\n                 CHR ''c'' :=\n                   (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                    CHR ''c'' +\n                   t)))\n             (EState\n               (estate.None, dis_s1\n                (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n                 CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + t))))\n           (EState (Sch p rn rp, s))) = (\\<lambda>t. ParState\n           (ParState\n             (EState\n               (Task RUNNING ent1 2, task_s1\n                (CHR ''t'' := task_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t'')), CHR ''c'' := task_s1 CHR ''c'' + (t + (pd2 - dis_s2 CHR ''t'')))))\n             (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t''))))))\n           (EState (Sch p rn rp, s)))\"\n                                apply (rule ext)\n                                by auto\n                              have c:\"(dis_s1\n             (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n              CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d)) = (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t''))))\" for d\n                                by auto\n                              have d:\"(task_s1\n              (CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''),\n               CHR ''t'' :=\n                 (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                  CHR ''t'' +\n                 d,\n               CHR ''c'' :=\n                 (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                  CHR ''c'' +\n                 d)) = (task_s1\n              (CHR ''t'' := task_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')), CHR ''c'' := task_s1 CHR ''c'' + (d + (pd2 - dis_s2 CHR ''t''))))\" for d\n                                by auto\n                              show ?thesis\n                                apply(subst a)\n                                apply(subst b)\n                                using pre' by auto\n                            qed\n                            done\n                          using pre \n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply(erule disjE)\n                    subgoal premises pre\n                      thm pre\n                      apply (simp only:tdsch2'.simps)\n                      apply(rule disjI2)\n                      using pre(16)\n                      apply(auto)\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(17))\n                       apply(rule pre(6))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_waitin_tguar'_vassm'4)\n                      subgoal using pre \n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(simp del:tdsch2'.simps fun_upd_apply)\n                      apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, dispatch_ch 2})\")\n                      prefer 2 subgoal by auto\n                      apply (auto simp del:fun_upd_apply)\n                      apply(rule wait_orig_assn_tran)\n                      unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                                apply simp\n                          subgoal apply(simp only:tdsch1'.simps)\n                            apply (rule disjI2)\n                            apply (rule disjI2)\n                            apply (rule disjI1)\n                            subgoal premises pre'\n                            proof-\n                              have a:\"min (pd1 -\n             (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n              CHR ''t'')(pc1 - (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''))) CHR ''c'') \n                  = min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') - (pd2 - dis_s2 CHR ''t'')\"\n                                by auto\n                              have b:\"(\\<lambda>t. ParState\n           (ParState\n             (EState\n               (Task RUNNING ent1 2, task_s1\n                (CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''),\n                 CHR ''t'' :=\n                   (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                    CHR ''t'' +\n                   t,\n                 CHR ''c'' :=\n                   (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                    CHR ''c'' +\n                   t)))\n             (EState\n               (estate.None, dis_s1\n                (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n                 CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + t))))\n           (EState (Sch p rn rp, s))) = (\\<lambda>t. ParState\n           (ParState\n             (EState\n               (Task RUNNING ent1 2, task_s1\n                (CHR ''t'' := task_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t'')), CHR ''c'' := task_s1 CHR ''c'' + (t + (pd2 - dis_s2 CHR ''t'')))))\n             (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t''))))))\n           (EState (Sch p rn rp, s)))\"\n                                apply (rule ext)\n                                by auto\n                              have c:\"(dis_s1\n             (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n              CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d)) = (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t''))))\" for d\n                                by auto\n                              have d:\"(task_s1\n              (CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''),\n               CHR ''t'' :=\n                 (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                  CHR ''t'' +\n                 d,\n               CHR ''c'' :=\n                 (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                  CHR ''c'' +\n                 d)) = (task_s1\n              (CHR ''t'' := task_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')), CHR ''c'' := task_s1 CHR ''c'' + (d + (pd2 - dis_s2 CHR ''t''))))\" for d\n                                by auto\n                              have e:\"(\\<lambda>v d. tdsch1' (Suc k1') kk' pd1 pc1\n             (dis_s1\n              (CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''),\n               CHR ''t'' := (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) CHR ''t'' + d))\n             (Task RUNNING ent1 2)\n             (task_s1\n              (CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''),\n               CHR ''t'' :=\n                 (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                  CHR ''t'' +\n                 d,\n               CHR ''c'' :=\n                 (task_s1(CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''), CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))\n                  CHR ''c'' +\n                 d))\n             (Sch (del_proc p 2) rn rp) s) = (\\<lambda>v d. tdsch1' (Suc k1') kk' pd1 pc1 (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')))) (Task RUNNING ent1 2)\n             (task_s1\n              (CHR ''t'' := task_s1 CHR ''t'' + (d + (pd2 - dis_s2 CHR ''t'')), CHR ''c'' := task_s1 CHR ''c'' + (d + (pd2 - dis_s2 CHR ''t''))))\n             (Sch (del_proc p 2) rn rp) s)\"\n                                apply(subst c)\n                                apply(subst d)\n                                by auto\n                              show ?thesis\n                                apply(subst a)\n                                apply(subst b)\n                                apply(subst e)\n                                using pre' by auto\n                            qed\n                            done\n                          using pre \n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply(subgoal_tac \"p=[]\")\n                       prefer 2\n                      subgoal using properl1_p7 unfolding proper1_def by auto\n                      apply(simp del:tdsch2'.simps)\n                      subgoal premises pre\n                      thm pre\n                      apply (simp only:tdsch2'.simps)\n                      apply(rule disjI2)\n                      using pre(15)\n                      apply(auto)\n                      apply(rule combine_blocks_assn)\n                      apply(rule pre(2))\n                      apply(rule pre(16))\n                       apply(rule pre(6))\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_wait_orig5)\n                      subgoal using pre \n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(simp del:tdsch2'.simps fun_upd_apply)\n                      apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, dispatch_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, dispatch_ch 2})\")\n                      prefer 2 subgoal by auto\n                      apply (auto simp del:fun_upd_apply)\n                      apply(rule wait_orig_assn_tran)\n                      unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          thm pre(1)\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                                apply simp\n                          subgoal apply(simp only:tdsch1'.simps)\n                            apply (rule disjI2)\n                            apply (rule disjI2)\n                            apply (rule disjI2)\n                            apply simp\n                            subgoal premises pre'\n                            proof-\n                              have a:\"(min (pd1 - (task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) (pc1 - (task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'')))) = \n                                     (min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') - (pd2 - dis_s2 CHR ''t''))\"\n                                by auto\n                              have b:\"(\\<lambda>t. ParState\n           (ParState\n             (EState\n               (Task RUNNING ent1 2, task_s1\n                (CHR ''t'' := task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'') + t, CHR ''c'' := task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'') + t)))\n             (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'') + t))))\n           (EState (Sch [] rn rp, s))) = (\\<lambda>t. ParState\n           (ParState\n             (EState\n               (Task RUNNING ent1 2, task_s1\n                (CHR ''t'' := task_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t'')), CHR ''c'' := task_s1 CHR ''c'' + (t + (pd2 - dis_s2 CHR ''t'')))))\n             (EState (estate.None, dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + (t + (pd2 - dis_s2 CHR ''t''))))))\n           (EState (Sch [] rn rp, s)))\"\n                                apply (rule ext)\n                                by auto\n                              have c:\"(dis_s1\n        (CHR ''t'' :=\n           dis_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'') +\n           min (pd1 - (task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) (pc1 - (task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''))))) = (dis_s1(CHR ''t'' := dis_s1 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))) \" \n                                using pre'(1,2)\n                                by fastforce\n                              have d:\"(task_s1\n        (CHR ''t'' :=\n           task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t'') +\n           min (pd1 - (task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) (pc1 - (task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''))),\n         CHR ''c'' :=\n           task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t'') +\n           min (pd1 - (task_s1 CHR ''t'' + (pd2 - dis_s2 CHR ''t''))) (pc1 - (task_s1 CHR ''c'' + (pd2 - dis_s2 CHR ''t''))))) = (task_s1\n        (CHR ''t'' := task_s1 CHR ''t'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''),\n         CHR ''c'' := task_s1 CHR ''c'' + min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')))\" \n                                using pre'(1,2)\n                                by fastforce\n                              show ?thesis\n                                apply(subst a)\n                                apply(subst b)\n                                apply(subst c)\n                                apply(subst d)\n                                using pre' by auto\n                            qed\n                            done\n                          using pre \n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      done\n                    by auto\n                  done\n                by auto\n              subgoal\n                apply(cases task_es1) by auto\n              subgoal\n                apply(cases task_es1) by auto\n              done\n            subgoal\n            apply(cases schs)\n                apply simp\n              subgoal for p rn rp\n                apply(cases task_es1)\n                apply (simp del: tdsch2'.simps)\n                subgoal for st1 ent1 tp1\n                  apply (simp del: tdsch2'.simps)\n                  apply(cases st1)\n                  subgoal\n                    apply(erule disjE)\n                    subgoal\n                      apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_out_0assm_wait_orig1)\n                        subgoal by auto\n                        apply(simp only: pure_assn_entails)\n                        apply clarify\n                        apply simp\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal premises pre' for tr tr1 tr2\n                          thm pre'\n                          apply(subst pre'(1)[symmetric])\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                          using pre' pre\n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply(erule disjE)\n                       apply(subgoal_tac\"rn = -1 \\<and> rp = -1\")\n                        prefer 2\n                      subgoal unfolding proper1_def properp_def propc1_def by auto\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_out_0assm_waitin_tguar'_vassm'1)\n                        subgoal by auto\n                        apply(simp add: pre del: fun_upd_apply)\n                        apply clarify\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_waitin_tguar'_vassm'_out_0assm1)\n                        subgoal by auto\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal premises pre' for tr tr1 tr2\n                          thm pre'\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                          using pre' pre\n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      done\n                    apply(erule disjE)\n                    subgoal\n                      apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_out_0assm_wait_orig1)\n                        subgoal by auto\n                        apply(simp only: pure_assn_entails)\n                        apply clarify\n                        apply simp\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal premises pre' for tr tr1 tr2\n                          thm pre'\n                          apply(subst pre'(1)[symmetric])\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                          using pre' pre\n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply(erule disjE)\n                       apply(subgoal_tac\"rn = -1 \\<and> rp = -1\")\n                        prefer 2\n                      subgoal unfolding proper1_def properp_def propc1_def by auto\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_out_0assm_waitin_tguar'_vassm'1)\n                        subgoal by auto\n                        apply(simp add: pre del: fun_upd_apply)\n                        apply clarify\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_wait_orig_out_0assm1)\n                        subgoal by auto\n                        apply auto\n                        apply(rule combine_out_0assm_rdy_out_0assm)\n                        by auto\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      done\n                    subgoal\n                      apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_out_0assm_wait_orig1)\n                        subgoal by auto\n                        apply(simp only: pure_assn_entails)\n                        apply clarify\n                        apply simp\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal premises pre' for tr tr1 tr2\n                          thm pre'\n                          apply(subst pre'(1)[symmetric])\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                          using pre' pre\n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply(erule disjE)\n                       apply(subgoal_tac\"rn = -1 \\<and> rp = -1\")\n                        prefer 2\n                      subgoal unfolding proper1_def properp_def propc1_def by auto\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_out_0assm_waitin_tguar'_vassm'1)\n                        subgoal by auto\n                        apply(simp add: pre del: fun_upd_apply)\n                        apply clarify\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_wait_orig_out_0assm1)\n                        subgoal by auto\n                        apply auto\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_in_0assm_rdy_out_0assm)\n                        subgoal by auto\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal premises pre' for tr tr1 tr2\n                          thm pre'\n                          apply(subst pre'(2)[symmetric])\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                          using pre' pre\n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                           apply(rule pre(14))\n                        apply(rule pre(15))\n                         apply(rule pre(5))\n                        apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      done\n                    done\n                  subgoal\n                    apply(erule disjE)\n                    subgoal\n                      apply(subgoal_tac\"rn =-1 \\<and> rp = -1\\<and>p=[]\")\n                       prefer 2\n                      subgoal \n                        unfolding propc1_def proper1_def properp_def using properl1_p7 by auto\n                      apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                          using pre\n                          unfolding propc1_def proper1_def properp_def by auto\n                      apply(erule disjE)\n                        subgoal premises pre\n                          thm pre\n                          apply simp\n                          apply(rule disjI2)\n                          apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(16))\n                           apply(rule pre(5))\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_out_0assm_in_0orig_vassm'1)\n                          subgoal by auto\n                          apply (simp del:fun_upd_apply)\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_waitin_tguar'_vassm'_out_0assm1)\n                          subgoal by auto\n                          apply (simp del: fun_upd_apply)\n                          unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal premises pre' for tr tr1 tr2\n                          thm pre'\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                          using pre' pre\n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply(erule disjE)\n                      subgoal premises pre\n                          thm pre\n                          apply simp\n                          apply(rule disjI2)\n                          apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(16))\n                           apply(rule pre(5))               \n                          apply(rule combine_out_0assm_in_0orig_vassm'2)\n                          by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                        subgoal premises pre\n                          thm pre\n                          apply simp\n                          apply(rule disjI2)\n                          apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(16))\n                           apply(rule pre(5))               \n                          apply(rule combine_out_0assm_in_0orig_vassm'2)\n                          by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                        done\n                    apply(erule disjE)\n                    subgoal\n                      apply(subgoal_tac\"rn =-1 \\<and> rp = -1\\<and>p=[]\")\n                       prefer 2\n                      subgoal \n                        unfolding propc1_def proper1_def properp_def using properl1_p7 by auto\n                      apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                          using pre\n                          unfolding propc1_def proper1_def properp_def by auto\n                      apply(erule disjE)\n                        subgoal premises pre\n                          thm pre\n                          apply simp\n                          apply(rule disjI2)\n                          apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(16))\n                           apply(rule pre(5))\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_out_0assm_in_0orig_vassm'1)\n                          subgoal by auto\n                          apply (simp del: fun_upd_apply)\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_wait_orig_out_0assm1)\n                          subgoal by auto\n                          apply auto\n                          apply(rule combine_out_0assm_rdy_out_0assm)\n                          by auto\n                        apply(erule disjE)\n                      subgoal premises pre\n                          thm pre\n                          apply simp\n                          apply(rule disjI2)\n                          apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(16))\n                           apply(rule pre(5))               \n                          apply(rule combine_out_0assm_in_0orig_vassm'2)\n                          by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                        subgoal premises pre\n                          thm pre\n                          apply simp\n                          apply(rule disjI2)\n                          apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(16))\n                           apply(rule pre(5))               \n                          apply(rule combine_out_0assm_in_0orig_vassm'2)\n                          by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                        done\n                      subgoal\n                      apply(subgoal_tac\"rn =-1 \\<and> rp = -1\\<and>p=[]\")\n                       prefer 2\n                      subgoal \n                        unfolding propc1_def proper1_def properp_def using properl1_p7 by auto\n                      apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                          using pre\n                          unfolding propc1_def proper1_def properp_def by auto\n                      apply(erule disjE)\n                        subgoal premises pre\n                          thm pre\n                          apply simp\n                          apply(rule disjI2)\n                          apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(16))\n                           apply(rule pre(5))\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_out_0assm_in_0orig_vassm'1)\n                          subgoal by auto\n                          apply (simp del: fun_upd_apply)\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_wait_orig_out_0assm1)\n                          subgoal by auto\n                          apply (simp del: fun_upd_apply)\n                          apply clarify\n                          apply(rule entails_tassn_trans)\n                           apply(rule combine_in_0assm_rdy_out_0assm1)\n                          subgoal by auto\n                          unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal premises pre' for tr tr1 tr2\n                          thm pre'\n                          apply(subst pre'(1)[symmetric])\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                          using pre' pre\n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      apply(erule disjE)\n                      subgoal premises pre\n                          thm pre\n                          apply simp\n                          apply(rule disjI2)\n                          apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(16))\n                           apply(rule pre(5))               \n                          apply(rule combine_out_0assm_in_0orig_vassm'2)\n                          by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                        subgoal premises pre\n                          thm pre\n                          apply simp\n                          apply(rule disjI2)\n                          apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(16))\n                           apply(rule pre(5))               \n                          apply(rule combine_out_0assm_in_0orig_vassm'2)\n                          by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                        done\n                      done\n                    subgoal\n                    apply(erule disjE)\n                    subgoal\n                      apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                         apply(rule pre(5))  \n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_out_0assm_waitin_tguar'_vassm'1)\n                        subgoal by auto\n                        apply (simp del: fun_upd_apply)\n                        apply clarify\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          apply(cases kk')\n                          subgoal\n                            by(simp only:tdsch1'.simps)\n                          subgoal for kk''\n                            apply(simp only:tdsch1'.simps)\n                            apply (simp del: fun_upd_apply)\n                            apply(erule disjE)\n                            subgoal premises pre'\n                              thm pre'\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(rule combine_waitin_tguar'_vassm'_waitin_tguar'_vassm'1)\n                              by auto\n                            apply(erule disjE)\n                            subgoal premises pre'\n                              thm pre'\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(rule combine_waitin_tguar'_vassm'_waitin_tguar'_vassm'1)\n                              by auto\n                            apply(erule disjE)\n                            subgoal premises pre'\n                              thm pre'\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(rule combine_waitin_tguar'_vassm'_waitin_tguar'_vassm'1)\n                              by auto\n                            apply(subgoal_tac \"p=[]\")\n                             prefer 2\n                            subgoal using pre properl1_p7 unfolding proper1_def by auto\n                            apply (simp del: fun_upd_apply)\n                            subgoal premises pre'\n                              thm pre'\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(rule entails_tassn_trans)\n                               apply(rule combine_waitin_tguar'_vassm'_wait_orig2)\n                              subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              apply (simp del: fun_upd_apply)\n                              apply clarify\n                              apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, run_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, run_ch 2})\")\n                               prefer 2 subgoal by auto\n                              apply (auto simp del:fun_upd_apply)\n                              apply(rule wait_orig_assn_tran)\n                              apply(rule entails_tassn_trans)\n                               apply(rule combine_waitin_tguar'_vassm'_out_0assm1)\n                              subgoal by auto\n                              apply (simp del: fun_upd_apply)\n                              unfolding combine_assn_def entails_tassn_def\n                              apply clarify\n                              subgoal premises pre'' for tr tr1 tr2\n                                thm pre''\n                                apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                 apply simp\n                                using pre' pre pre''\n                                unfolding propc1_def proper1_def properp_def by auto\n                              done\n                            done\n                          done\n                        done\n                      apply(erule disjE)\n                      subgoal premises pre\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                         apply(rule pre(5))  \n                        apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(erule disjE)\n                      subgoal premises pre\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                         apply(rule pre(5))  \n                        apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(subgoal_tac \"p=[]\")\n                      prefer 2\n                      subgoal using properl1_p7 unfolding proper1_def by auto\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      subgoal premises pre\n                        apply simp\n                        apply(rule disjI2)\n                        apply(rule disjI1)\n                        thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                         apply(rule pre(5))  \n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_out_0assm_wait_orig1)\n                        subgoal by auto\n                        apply (simp del: fun_upd_apply tdsch2'.simps)\n                        apply clarify\n                        unfolding combine_assn_def entails_tassn_def\n                          apply clarify\n                          subgoal premises pre' for tr tr1 tr2\n                          thm pre'\n                          apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                          apply simp\n                          using pre pre'\n                          unfolding propc1_def proper1_def properp_def by auto\n                        done\n                      done\n                    apply(erule disjE)\n                    subgoal\n                      apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                         apply(rule pre(5))  \n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_out_0assm_waitin_tguar'_vassm'1)\n                        subgoal by auto\n                        apply (simp del: fun_upd_apply tdsch2'.simps)\n                        apply clarify\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          apply(cases kk')\n                          subgoal\n                            by(simp only:tdsch1'.simps)\n                          subgoal for kk''\n                            apply(simp only:tdsch1'.simps)\n                            apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply(erule disjE)\n                            subgoal premises pre'\n                              apply simp\n                              apply(rule disjI2)\n                              apply(rule disjI2)\n                              thm pre'\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(cases \"pd2 - task_s2 CHR ''t'' > min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule combine_wait_orig_waitin_tguar'_vassm'3)\n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              apply(cases \"pd2 - task_s2 CHR ''t'' \\<le> min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule entails_tassn_trans)\n                                 apply(rule combine_wait_orig_waitin_tguar'_vassm'4)\n                                subgoal\n                                  by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                                apply (simp del: fun_upd_apply)\n                                apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, run_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, run_ch 2})\")\n                               prefer 2 subgoal by auto\n                              apply (auto simp del:fun_upd_apply)\n                                apply(rule wait_orig_assn_tran)\n                                apply(rule combine_out_0assm_rdy_waitin_tguar'_vassm'2)\n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              by auto\n                            apply(erule disjE)\n                            subgoal premises pre'\n                              apply simp\n                              apply(rule disjI2)\n                              apply(rule disjI2)\n                              thm pre'\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(cases \"pd2 - task_s2 CHR ''t'' > min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule combine_wait_orig_waitin_tguar'_vassm'3)\n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              apply(cases \"pd2 - task_s2 CHR ''t'' \\<le> min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule entails_tassn_trans)\n                                 apply(rule combine_wait_orig_waitin_tguar'_vassm'4)\n                                subgoal\n                                  by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                                apply (simp del: fun_upd_apply)\n                                apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, run_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, run_ch 2})\")\n                               prefer 2 subgoal by auto\n                              apply (auto simp del:fun_upd_apply)\n                                apply(rule wait_orig_assn_tran)\n                                apply(rule combine_out_0assm_rdy_waitin_tguar'_vassm'2)\n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              by auto\n                            apply(erule disjE)\n                            subgoal premises pre'\n                              apply simp\n                              apply(rule disjI2)\n                              apply(rule disjI2)\n                              thm pre'\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(cases \"pd2 - task_s2 CHR ''t'' > min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule combine_wait_orig_waitin_tguar'_vassm'3)\n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              apply(cases \"pd2 - task_s2 CHR ''t'' \\<le> min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule entails_tassn_trans)\n                                 apply(rule combine_wait_orig_waitin_tguar'_vassm'4)\n                                subgoal\n                                  by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                                apply (simp del: fun_upd_apply)\n                                apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, run_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, run_ch 2})\")\n                               prefer 2 subgoal by auto\n                              apply (auto simp del:fun_upd_apply)\n                                apply(rule wait_orig_assn_tran)\n                                apply(rule entails_tassn_trans)\n                                 apply(rule combine_out_0assm_rdy_waitin_tguar'_vassm'1)\n                                subgoal\n                                  by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                                apply (simp del: fun_upd_apply)\n                                apply(subgoal_tac \"p=[]\")\n                                 prefer 2\n                                subgoal using properl1_p7 pre pre' unfolding proper1_def by auto\n                                apply (simp del: fun_upd_apply tdsch2'.simps)\n                                unfolding combine_assn_def entails_tassn_def\n                                apply clarify\n                                subgoal premises pre'' for tr tr1 tr2\n                                  thm pre'\n                                  apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                         apply simp\n                                  using pre pre' pre''\n                                  unfolding propc1_def proper1_def properp_def by auto\n                                done\n                              by auto\n                            apply(subgoal_tac \"p=[]\")\n                                 prefer 2\n                                subgoal using properl1_p7 pre unfolding proper1_def by auto\n                                apply (simp del: fun_upd_apply tdsch2'.simps)\n                            subgoal premises pre'\n                              thm pre\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                 apply(rule pre'(6))\n                                 apply(rule pre'(4))  \n                                apply(cases \"(pd2 - task_s2 CHR ''t'') < (min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))\")\n                            subgoal\n                              apply(rule entails_tassn_trans)\n                               apply(rule combine_wait_orig_wait_orig3)\n                              subgoal \n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              apply (simp del: fun_upd_apply tdsch2'.simps)\n                              apply(rule entails_tassn_trans)\n                               apply(rule wait_orig_assn_tran)\n                               apply(rule combine_out_0assm_rdy_wait_orig3[where R = \"false\\<^sub>A\"])\n                              subgoal \n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              unfolding entails_tassn_def false_assn_def\n                              by(auto simp add: wait_orig_assn.simps)\n                            apply(cases \"(pd2 - task_s2 CHR ''t'') > (min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))\")\n                            subgoal\n                              apply(rule entails_tassn_trans)\n                               apply(rule combine_wait_orig_wait_orig4)\n                              subgoal \n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              apply (simp del: fun_upd_apply tdsch2'.simps)\n                              apply(rule entails_tassn_trans)\n                               apply(rule wait_orig_assn_tran)\n                               apply(rule combine_wait_orig_out_0assm3[where R = \"false\\<^sub>A\"])\n                              subgoal \n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              unfolding entails_tassn_def false_assn_def\n                              by(auto simp add: wait_orig_assn.simps)\n                            apply(cases \"(pd2 - task_s2 CHR ''t'') = (min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c''))\")\n                            subgoal\n                              apply(rule entails_tassn_trans)\n                               apply(rule combine_wait_orig_wait_orig2)\n                              subgoal \n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              apply (simp del: fun_upd_apply tdsch2'.simps)\n                              apply(rule entails_tassn_trans)\n                               apply(rule wait_orig_assn_tran)\n                               apply(rule combine_out_0assm_rdy_out_0assm[where R = \"false\\<^sub>A\"])\n                              subgoal \n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              unfolding entails_tassn_def false_assn_def\n                              by(auto simp add: wait_orig_assn.simps)\n                            by auto\n                          done\n                        done\n                      done\n                    apply(erule disjE)\n                    subgoal premises pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                         apply(rule pre(5))  \n                      apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    apply(erule disjE)\n                    subgoal premises pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                         apply(rule pre(5))  \n                      apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    apply(subgoal_tac \"p=[]\")\n                    prefer 2\n                    subgoal using properl1_p7 unfolding proper1_def by auto\n                    apply (simp del: fun_upd_apply tdsch2'.simps)\n                    subgoal premises pre\n                      apply simp\n                      apply(rule disjI2)\n                      apply(rule disjI1)\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                       apply(rule pre(5))  \n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_out_0assm_wait_orig1)\n                      subgoal by auto\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      apply clarify\n                      unfolding combine_assn_def entails_tassn_def\n                      apply clarify\n                      subgoal premises pre' for tr tr1 tr2\n                      thm pre'\n                      apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                      apply simp\n                      using pre pre' \n                      unfolding propc1_def proper1_def properp_def by auto\n                      done\n                    done\n                  apply (simp del: tdsch2'.simps)\n                      apply(erule disjE)\n                      subgoal premises pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                         apply(rule pre(5))  \n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_out_0assm_waitin_tguar'_vassm'1)\n                        subgoal by auto\n                        apply (simp del: fun_upd_apply tdsch2'.simps)\n                        apply clarify\n                        unfolding combine_assn_def entails_tassn_def\n                        apply clarify\n                        subgoal for tr tr1 tr2\n                          apply(cases kk')\n                          subgoal\n                            by(simp only:tdsch1'.simps)\n                          subgoal for kk''\n                            apply(simp only:tdsch1'.simps)\n                            apply (simp del: fun_upd_apply tdsch2'.simps)\n                            apply(erule disjE)\n                            subgoal premises pre'\n                              apply simp\n                              apply(rule disjI2)\n                              apply(rule disjI2)\n                              thm pre'\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(cases \"pd2 - task_s2 CHR ''t'' > min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule combine_wait_orig_waitin_tguar'_vassm'3)\n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              apply(cases \"pd2 - task_s2 CHR ''t'' \\<le> min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule entails_tassn_trans)\n                                 apply(rule combine_wait_orig_waitin_tguar'_vassm'4)\n                                subgoal\n                                  by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                                apply (simp del: fun_upd_apply)\n                                apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, run_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, run_ch 2})\")\n                               prefer 2 subgoal by auto\n                              apply (auto simp del:fun_upd_apply)\n                                apply(rule wait_orig_assn_tran)\n                                apply(rule combine_in_0assm_rdy_waitin_tguar'_vassm'1)\n                                by auto\n                              by auto\n                            apply(erule disjE)\n                            subgoal premises pre'\n                              apply simp\n                              apply(rule disjI2)\n                              apply(rule disjI2)\n                              thm pre'\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(cases \"pd2 - task_s2 CHR ''t'' > min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule combine_wait_orig_waitin_tguar'_vassm'3)\n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              apply(cases \"pd2 - task_s2 CHR ''t'' \\<le> min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule entails_tassn_trans)\n                                 apply(rule combine_wait_orig_waitin_tguar'_vassm'4)\n                                subgoal\n                                  by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                                apply (simp del: fun_upd_apply)\n                                apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, run_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, run_ch 2})\")\n                               prefer 2 subgoal by auto\n                              apply (auto simp del:fun_upd_apply)\n                                apply(rule wait_orig_assn_tran)\n                                apply(rule combine_in_0assm_rdy_waitin_tguar'_vassm'1)\n                                by auto\n                              by auto\n                            apply(erule disjE)\n                            subgoal premises pre'\n                              apply simp\n                              apply(rule disjI2)\n                              apply(rule disjI2)\n                              thm pre'\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(cases \"pd2 - task_s2 CHR ''t'' > min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule combine_wait_orig_waitin_tguar'_vassm'3)\n                                by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                              apply(cases \"pd2 - task_s2 CHR ''t'' \\<le> min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule entails_tassn_trans)\n                                 apply(rule combine_wait_orig_waitin_tguar'_vassm'4)\n                                subgoal\n                                  by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                                apply (simp del: fun_upd_apply)\n                                apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, run_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, run_ch 2})\")\n                               prefer 2 subgoal by auto\n                              apply (auto simp del:fun_upd_apply)\n                                apply(rule wait_orig_assn_tran)\n                                apply(rule combine_in_0assm_rdy_waitin_tguar'_vassm'1)\n                                by auto\n                              by auto\n                            apply(subgoal_tac \"p=[]\")\n                             prefer 2\n                            subgoal using properl1_p7 pre unfolding proper1_def by auto\n                            apply (simp del: fun_upd_apply tdsch2'.simps)\n                            subgoal premises pre'\n                              apply simp\n                              apply (rule disjI1)\n                              apply(rule combine_blocks_assn)\n                                 apply(rule pre'(3))\n                                apply(rule pre'(6))\n                               apply(rule pre'(4))\n                              apply(cases \"pd2 - task_s2 CHR ''t'' > min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule entails_tassn_trans)\n                                 apply(rule combine_wait_orig_wait_orig4)\n                                subgoal\n                                  by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                                apply (simp del: fun_upd_apply tdsch2'.simps)\n                                apply(rule entails_tassn_trans)\n                                 apply(rule wait_orig_assn_tran)\n                                 apply(rule combine_wait_orig_out_0assm1)\n                                subgoal by auto\n                                apply (simp del: fun_upd_apply tdsch2'.simps)\n                                by(auto simp add: pure_assn_def conj_assn_def wait_orig_assn.simps entails_tassn_def)\n                              apply(cases \"pd2 - task_s2 CHR ''t'' < min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'')\")\n                              subgoal\n                                apply(rule entails_tassn_trans)\n                                 apply(rule combine_wait_orig_wait_orig3)\n                                subgoal\n                                  by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                                apply (simp del: fun_upd_apply tdsch2'.simps)\n                                apply(rule entails_tassn_trans)\n                                 apply(rule wait_orig_assn_tran)\n                                apply(rule combine_in_0assm_rdy_wait_orig2[where R = \"false\\<^sub>A\"])\n                                subgoal by auto                  \n                                by(auto simp add: false_assn_def wait_orig_assn.simps entails_tassn_def)\n                              apply(cases \"min (pd1 - task_s1 CHR ''t'') (pc1 - task_s1 CHR ''c'') = pd2 - task_s2 CHR ''t''\")\n                              subgoal\n                                apply(rule entails_tassn_trans)\n                                 apply(rule combine_wait_orig_wait_orig2)\n                                subgoal\n                                  by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                                apply (simp del: fun_upd_apply tdsch2'.simps)\n                                apply(rule entails_tassn_trans)\n                                 apply(rule wait_orig_assn_tran)\n                                 apply(rule combine_in_0assm_rdy_out_0assm)\n                                subgoal by auto\n                                apply(subgoal_tac\"({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, run_ch 2, preempt_ch 1}) = ({}, {req_ch 1, req_ch 2, free_ch 1, free_ch 2, exit_ch 1, exit_ch 2, preempt_ch 1, run_ch 2})\")\n                               prefer 2 subgoal by auto\n                              apply (auto simp del:fun_upd_apply)\n                                apply (rule wait_orig_assn_tran)\n                                unfolding combine_assn_def entails_tassn_def\n                                apply clarify\n                                subgoal premises pre'' for tr tr1 tr2\n                                  thm pre'\n                                  apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                                         apply simp\n                                  using pre pre' pre''\n                                  unfolding propc1_def proper1_def properp_def apply auto\n                                  apply(subgoal_tac\"(dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (pd2 - task_s2 CHR ''t''))) = (dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + pd2 - task_s2 CHR ''t''))\")\n                                  by auto\n                                done\n                              by auto\n                            done\n                          done\n                        done\n                      apply(erule disjE)\n                      subgoal premises pre\n                      apply simp\n                      apply(rule disjI2)\n                      apply(rule disjI1)\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                       apply(rule pre(5))  \n                        apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(erule disjE)\n                      subgoal premises pre\n                      apply simp\n                      apply(rule disjI2)\n                      apply(rule disjI1)\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                       apply(rule pre(5))  \n                        apply(rule combine_out_0assm_waitin_tguar'_vassm'2)\n                        by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(subgoal_tac \"p=[]\")\n                    prefer 2\n                    subgoal using properl1_p7 unfolding proper1_def by auto\n                    apply (simp del: fun_upd_apply tdsch2'.simps)\n                      subgoal premises pre\n                      apply simp\n                      apply(rule disjI2)\n                      apply(rule disjI1)\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(14))\n                          apply(rule pre(15))\n                       apply(rule pre(5))  \n                        apply(rule entails_tassn_trans)\n                       apply(rule combine_out_0assm_wait_orig1)\n                      subgoal by auto\n                      apply (simp del: fun_upd_apply tdsch2'.simps)\n                      apply clarify\n                      unfolding combine_assn_def entails_tassn_def\n                      apply clarify\n                      subgoal premises pre' for tr tr1 tr2\n                      thm pre'\n                      apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                      apply simp\n                      using pre pre' \n                      unfolding propc1_def proper1_def properp_def by auto\n                      done\n                    done\n                  done\n                by auto\n              subgoal apply(cases task_es1) by auto\n              subgoal apply(cases task_es1) by auto\n              done\n            apply(cases schs)\n            subgoal for p rn rp\n              apply(cases task_es1)\n              subgoal by auto\n              subgoal for st1 ent1 t1\n                apply(cases st1)\n                subgoal\n                  apply(simp del:tdsch2'.simps)\n                  apply(cases \"ent2 = Suc 0\")\n                  prefer 2 subgoal by auto\n                   apply(simp del:tdsch2'.simps)\n                   apply(erule disjE)\n                  subgoal\n                    apply(erule disjE)\n                    subgoal premises pre\n                      apply simp\n                      apply(rule disjI1)\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                         apply(rule pre(5))  \n                        apply(rule entails_tassn_trans)\n                       apply(rule combine_waitin_tguar'_vassm'_wait_orig2')\n                      subgoal\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    apply(simp del:fun_upd_apply tdsch2'.simps)\n                    apply clarify\n                    apply(rule wait_orig_assn_tran)\n                    unfolding combine_assn_def entails_tassn_def\n                      apply clarify\n                      subgoal premises pre' for tr tr1 tr2\n                      thm pre'\n                      apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                             apply simp\n                      subgoal \n                      proof-\n                        have a:\"min (pd2 - (task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t''))) (pc2 - (task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t''))) = min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'') - (pd1 - dis_s1 CHR ''t'') \" \n                          by auto\n                        have b:\" (\\<lambda>t. ParState\n           (EState\n             (Task RUNNING (Suc 0) 1, task_s2\n              (CHR ''t'' := task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') + t, CHR ''c'' := task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t'') + t)))\n           (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') + t)))) =\n                                 (\\<lambda>t. ParState\n           (EState\n             (Task RUNNING (Suc 0) 1, task_s2\n              (CHR ''t'' := task_s2 CHR ''t'' + (t + (pd1 - dis_s1 CHR ''t'')), CHR ''c'' := task_s2 CHR ''c'' + (t + (pd1 - dis_s1 CHR ''t'')))))\n           (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (t + (pd1 - dis_s1 CHR ''t''))))))\"\n                          apply(rule ext)+\n                          by auto\n                        have c:\"(dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') + d)) = (dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (d + (pd1 - dis_s1 CHR ''t''))))\" for d\n                          by auto\n                        have d:\"(task_s2(CHR ''t'' := task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') + d, CHR ''c'' := task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t'') + d)) = (task_s2(CHR ''t'' := task_s2 CHR ''t'' + (d + (pd1 - dis_s1 CHR ''t'')), CHR ''c'' := task_s2 CHR ''c'' + (d + (pd1 - dis_s1 CHR ''t''))))\" for d\n                          by auto\n                        have e:\"(\\<lambda>v d. task_dis_assn' 2 k2' pd2 pc2 (dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') + d)) (Task READY (Suc 0) 1)\n             (task_s2(CHR ''t'' := task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') + d, CHR ''c'' := task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t'') + d))) =\n                                (\\<lambda>v d. task_dis_assn' 2 k2' pd2 pc2 (dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (d + (pd1 - dis_s1 CHR ''t'')))) (Task READY (Suc 0) 1)\n             (task_s2\n              (CHR ''t'' := task_s2 CHR ''t'' + (d + (pd1 - dis_s1 CHR ''t'')), CHR ''c'' := task_s2 CHR ''c'' + (d + (pd1 - dis_s1 CHR ''t'')))))\"\n                          apply(rule ext)+\n                          apply (subst c)\n                          apply (subst d)\n                          by auto\n                        show ?thesis\n                          apply simp\n                          apply(rule disjI1)\n                          using pre'(3)\n                          apply(subst a)\n                          apply(subst b) \n                          apply(subst e)\n                          by auto\n                      qed\n                      using pre pre' \n                      unfolding propc1_def proper1_def properp_def by auto\n                    done\n                  apply(erule disjE)\n                  subgoal premises pre\n                      apply simp\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                         apply(rule pre(5))  \n                      apply(rule combine_waitin_tguar'_vassm'_waitin_tguar'_vassm'1)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    apply(erule disjE)\n                  subgoal premises pre\n                      apply simp\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                         apply(rule pre(5))  \n                      apply(rule combine_waitin_tguar'_vassm'_waitin_tguar'_vassm'1)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                  subgoal premises pre\n                      apply simp\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                         apply(rule pre(5))  \n                      apply(rule combine_waitin_tguar'_vassm'_waitin_tguar'_vassm'1)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    done\n                  subgoal\n                    apply(erule disjE)\n                    subgoal premises pre\n                      apply simp\n                      apply(rule disjI1)\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                       apply(rule pre(5))  \n                      apply(cases \"min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'') < pd1 - dis_s1 CHR ''t''\")\n                      subgoal\n                        apply(rule entails_tassn_trans)\n                         apply(rule combine_wait_orig_wait_orig3)\n                        subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                        apply(simp del:fun_upd_apply tdsch2'.simps)\n                        apply(rule entails_tassn_trans)\n                         apply(rule wait_orig_assn_tran)\n                         apply(rule combine_out_0assm_srdy_wait_orig1)\n                        subgoal by auto\n                        by(auto simp add: pure_assn_def conj_assn_def entails_tassn_def wait_orig_assn.simps)\n                      apply(cases \"min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'') \\<ge> pd1 - dis_s1 CHR ''t''\")\n                        apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_wait_orig6)\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                       apply(auto simp del:fun_upd_apply tdsch2'.simps)\n                      apply(rule wait_orig_assn_tran)\n                      unfolding combine_assn_def entails_tassn_def\n                      apply clarify\n                      subgoal premises pre' for tr tr1 tr2\n                      thm pre'\n                      apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                             apply simp\n                      subgoal \n                      proof-\n                        have a:\"(min (pd2 - (task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t''))) (pc2 - (task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t'')))) = (min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'') - (pd1 - dis_s1 CHR ''t''))\"\n                          by auto\n                        have b:\"(\\<lambda>t. ParState\n           (EState\n             (Task RUNNING (Suc 0) 1, task_s2\n              (CHR ''t'' := task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') + t, CHR ''c'' := task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t'') + t)))\n           (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') + t)))) = \n(\\<lambda>t. ParState\n           (EState\n             (Task RUNNING (Suc 0) 1, task_s2\n              (CHR ''t'' := task_s2 CHR ''t'' + (t + (pd1 - dis_s1 CHR ''t'')), CHR ''c'' := task_s2 CHR ''c'' + (t + (pd1 - dis_s1 CHR ''t'')))))\n           (EState (estate.None, dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + (t + (pd1 - dis_s1 CHR ''t''))))))\"\n                          apply(rule ext)\n                          by auto\n                          have c:\"(dis_s2\n          (CHR ''t'' :=\n             dis_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') +\n             min (pd2 - (task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t''))) (pc2 - (task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t''))))) = \n(dis_s2(CHR ''t'' := dis_s2 CHR ''t'' + min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'')))\"\n                            apply (subst a)\n                            by auto\n                          have d:\"(task_s2\n          (CHR ''t'' :=\n             task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t'') +\n             min (pd2 - (task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t''))) (pc2 - (task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t''))),\n           CHR ''c'' :=\n             task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t'') +\n             min (pd2 - (task_s2 CHR ''t'' + (pd1 - dis_s1 CHR ''t''))) (pc2 - (task_s2 CHR ''c'' + (pd1 - dis_s1 CHR ''t'')))))=\n(task_s2\n          (CHR ''t'' := task_s2 CHR ''t'' + min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c''),\n           CHR ''c'' := task_s2 CHR ''c'' + min (pd2 - task_s2 CHR ''t'') (pc2 - task_s2 CHR ''c'')))\"\n                            apply(subst a)+\n                            by auto\n                        show ?thesis\n                          apply simp\n                          apply(rule disjI2)\n                          using pre'(3)\n                          apply(subst a)\n                          apply(subst b)  \n                          apply(subst c)\n                          apply(subst d)\n                          by auto\n                      qed\n                      using pre pre' \n                      unfolding propc1_def proper1_def properp_def by auto\n                    done\n                  subgoal\n                    apply(erule disjE)\n                    subgoal\n                      subgoal premises pre\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                       apply(rule pre(5)) \n                       apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_waitin_tguar'_vassm'2')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(auto simp del:fun_upd_apply tdsch2'.simps)\n                      apply(rule entails_tassn_trans)\n                       apply(rule wait_orig_assn_tran)\n                      apply(rule combine_out_0assm_srdy_waitin_tguar'_vassm'2[where R = \"false\\<^sub>A\"])\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      by(auto simp add: false_assn_def entails_tassn_def wait_orig_assn.simps)\n                    done\n                  apply(erule disjE)\n                  subgoal premises pre\n                    apply simp\n                    apply(rule disjI2)\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                       apply(rule pre(5)) \n                       apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_waitin_tguar'_vassm'2')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(auto simp del:fun_upd_apply tdsch2'.simps)\n                      apply(rule wait_orig_assn_tran)\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_out_0assm_srdy_waitin_tguar'_vassm'1)\n                      subgoal by auto\n                       apply(subgoal_tac \"p=[]\")\n                        prefer 2\n                      subgoal using properl1_p7 pre unfolding proper1_def by auto\n                      apply (auto simp del: fun_upd_apply tdsch2'.simps)\n                      unfolding combine_assn_def entails_tassn_def\n                      apply clarify\n                      subgoal premises pre' for tr tr1 tr2\n                      thm pre'\n                      apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                             apply simp\n                      using pre pre' \n                      unfolding propc1_def proper1_def properp_def by auto\n                    done\n                  subgoal premises pre\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                       apply(rule pre(5)) \n                       apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_waitin_tguar'_vassm'2')\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      apply(auto simp del:fun_upd_apply tdsch2'.simps)\n                      apply(rule entails_tassn_trans)\n                       apply(rule wait_orig_assn_tran)\n                      apply(rule combine_out_0assm_srdy_waitin_tguar'_vassm'2[where R = \"false\\<^sub>A\"])\n                      subgoal by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                      by(auto simp add: false_assn_def entails_tassn_def wait_orig_assn.simps)\n                    done\n                  done\n                done\n              subgoal\n                apply(simp del:tdsch2'.simps)\n                apply(cases \"ent2 = Suc 0\")\n                 prefer 2 subgoal by auto\n                apply(simp del:tdsch2'.simps)\n                   apply(erule disjE)\n                  subgoal\n                    apply(erule disjE)\n                     apply(subgoal_tac \"rn = 2\")\n                      prefer 2 subgoal unfolding propc1_def by auto\n                     apply(simp del:tdsch2'.simps)\n                    subgoal premises pre\n                      apply simp\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                         apply(rule pre(5))  \n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_waitin_tguar'_vassm'_out_0assm1')\n                      subgoal by auto\n                      apply(simp del:tdsch2'.simps fun_upd_apply)\n                      unfolding combine_assn_def entails_tassn_def\n                      apply clarify\n                      subgoal premises pre' for tr tr1 tr2\n                      thm pre'\n                      apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                             apply simp\n                      using pre pre' \n                      unfolding propc1_def proper1_def properp_def by auto\n                    done\n                  apply(erule disjE)\n                  subgoal premises pre\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                         apply(rule pre(5))  \n                      apply(rule combine_waitin_tguar'_vassm'_in_0orig_vassm'1)\n                      by auto   \n                    apply(erule disjE)\n                  subgoal premises pre\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                         apply(rule pre(5))  \n                      apply(rule combine_waitin_tguar'_vassm'_in_0orig_vassm'1)\n                      by auto\n                  subgoal premises pre\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(16))\n                         apply(rule pre(5))  \n                      apply(rule combine_waitin_tguar'_vassm'_in_0orig_vassm'1)\n                      by auto\n                    done\n                  apply(subgoal_tac\"rn =2 \\<and> p=[]\")\n                   prefer 2 subgoal using properl1_p7 unfolding proper1_def propc1_def  by auto\n                  apply(simp del:tdsch2'.simps fun_upd_apply)\n                  apply(erule disjE)\n                  subgoal premises pre\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(17))\n                       apply(rule pre(5)) \n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_out_0assm1)\n                      subgoal by auto\n                      apply(simp del:tdsch2'.simps fun_upd_apply)\n                      apply clarify\n                      apply(rule combine_out_0assm_srdy_out_0assm1)\n                      by auto\n                    apply(erule disjE)\n                  subgoal premises pre\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(17))\n                       apply(rule pre(5)) \n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_in_0orig_vassm'1)\n                      subgoal by auto\n                      apply(simp del:tdsch2'.simps fun_upd_apply add:pre)\n                      apply clarify\n                      apply(rule combine_out_0assm_srdy_in_0orig_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    apply(erule disjE)\n                    subgoal premises pre\n                      apply simp\n                      apply(rule disjI2)\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(17))\n                       apply(rule pre(5)) \n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_in_0orig_vassm'1)\n                      subgoal by auto\n                      apply(simp del:tdsch2'.simps fun_upd_apply)\n                      apply clarify\n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_out_0assm_srdy_in_0orig_vassm'1)\n                      subgoal by auto\n                      unfolding combine_assn_def entails_tassn_def\n                      apply clarify\n                      subgoal premises pre' for tr tr1 tr2\n                      thm pre'\n                      apply(rule pre(1)[where ?tr1.0 = tr1 and ?tr2.0 = tr2])\n                             apply simp\n                      using pre pre' \n                      unfolding propc1_def proper1_def properp_def by auto\n                    done\n                    subgoal premises pre\n                      thm pre\n                        apply(rule combine_blocks_assn)\n                          apply(rule pre(15))\n                          apply(rule pre(17))\n                       apply(rule pre(5)) \n                      apply(rule entails_tassn_trans)\n                       apply(rule combine_wait_orig_in_0orig_vassm'1)\n                      subgoal by auto\n                      apply(simp del:tdsch2'.simps fun_upd_apply add:pre)\n                      apply clarify\n                      apply(rule combine_out_0assm_srdy_in_0orig_vassm'2)\n                      by(auto simp add: req_ch_def preempt_ch_def run_ch_def free_ch_def exit_ch_def dispatch_ch_def)\n                    done\n                  subgoal\n                    unfolding propc1_def by auto\n                  done\n                by auto\n              subgoal apply(cases task_es1) by auto\n              subgoal apply(cases task_es1) by auto\n              done\n            done\n          done\n        done\n      done\n  qed\n\n\nend\n", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/lunarlander_sl/ext1/System_scheduler1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.712232184238947, "lm_q2_score": 0.45713671682749474, "lm_q1q2_score": 0.32558748232186757}}
{"text": "(*******************************************************************************\n\n  Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n  Module:  AuthenticationI.thy (Isabelle/HOL 2016-1)\n  ID:      $Id: AuthenticationI.thy 132844 2016-12-19 15:21:54Z csprenge $\n  Author:  Joseph Lallemand, INRIA Nancy <joseph.lallemand@loria.fr>\n           Christoph Sprenger, ETH Zurich <sprenger@inf.ethz.ch>\n  \n  Simple abstract model of injective agreement based on a multiset of signals. \n  Two events: running and commit. Refines model for non-injective agreement.\n\n  Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n  Licence: LGPL\n\n*******************************************************************************)\n\nsection \\<open>Injective Agreement (L0)\\<close>\n\ntheory AuthenticationI\nimports AuthenticationN\nbegin\n\n(**************************************************************************************************)\nsubsection \\<open>State and events\\<close>\n(**************************************************************************************************)\n\ntype_synonym\n  a0i_state = a0n_state\n\ntype_synonym\n  a0i_obs = a0n_obs\n\nabbreviation\n  a0i_init :: \"a0n_state set\"\nwhere\n  \"a0i_init \\<equiv> a0n_init\"\n\nabbreviation\n  a0i_running :: \"agent \\<Rightarrow> agent \\<Rightarrow> msg \\<Rightarrow> (a0i_state \\<times> a0i_state) set\"\nwhere\n  \"a0i_running \\<equiv> a0n_running\"\n\nlemmas a0i_running_def = a0n_running_def\n\ndefinition \n  a0i_commit :: \"agent \\<Rightarrow> agent \\<Rightarrow> msg \\<Rightarrow> (a0i_state \\<times> a0i_state) set\"\nwhere \n  \"a0i_commit A B M \\<equiv> {(s, s').\n   \\<comment> \\<open>guard\\<close>\n     signals s (Commit A B M) < signals s (Running A B M) \\<and>\n   \\<comment> \\<open>actions:\\<close>\n     s' = s\\<lparr>signals := addSignal (signals s) (Commit A B M)\\<rparr>\n  }\"\n\n\ndefinition \n  a0i_trans :: \"(a0i_state \\<times> a0i_state) set\" where\n  \"a0i_trans \\<equiv> (\\<Union> A B M. a0i_running A B M) \\<union> (\\<Union> A B M. a0i_commit A B M) \\<union> Id\"\n\n\ndefinition \n  a0i :: \"(a0i_state,a0i_obs) spec\" where\n  \"a0i \\<equiv> \\<lparr>\n    init = a0i_init,\n    trans = a0i_trans, \n    obs = id\n  \\<rparr>\"\n\nlemmas a0i_defs = a0n_defs a0i_def a0i_trans_def a0i_commit_def\n\nlemma a0i_obs [simp]: \"obs a0i = id\"\nby (simp add: a0i_def)\n\nlemma a0i_anyP_observable [iff]: \"observable (obs a0i) P\"\nby (auto)  \n\n\n(**************************************************************************************************)\nsubsection \\<open>Injective agreement invariant\\<close>\n(**************************************************************************************************)\n\ndefinition \n  a0i_agreement :: \"a0i_state set\" \nwhere\n  \"a0i_agreement \\<equiv> {s. \\<forall>A B M.\n    signals s (Commit A B M) \\<le> signals s (Running A B M)\n  }\"\n\nlemmas a0i_agreementI = \n  a0i_agreement_def [THEN setc_def_to_intro, rule_format]\nlemmas a0i_agreementE [elim] = \n  a0i_agreement_def [THEN setc_def_to_elim, rule_format]\nlemmas a0i_agreementD = \n  a0i_agreement_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\nlemma PO_a0i_agreement_init [iff]:\n  \"init a0i \\<subseteq> a0i_agreement\"\nby (auto simp add: a0i_defs intro!: a0i_agreementI)\n\nlemma PO_a0i_agreement_trans [iff]:\n  \"{a0i_agreement} trans a0i {> a0i_agreement}\"\napply (auto simp add: PO_hoare_defs a0i_defs intro!: a0i_agreementI)\napply (auto dest: a0i_agreementD intro: le_SucI)\ndone\n\nlemma PO_a0i_agreement [iff]: \"reach a0i \\<subseteq> a0i_agreement\"\nby (rule inv_rule_basic) (auto)\n\n\nlemma PO_a0i_obs_agreement [iff]: \"oreach a0i \\<subseteq> a0i_agreement\"\napply (rule external_from_internal_invariant, fast) \napply (subst a0i_def, auto)\ndone\n\n\n(**************************************************************************************************)\nsubsection \\<open>Refinement\\<close>\n(**************************************************************************************************)\n\ndefinition\n  med0n0i :: \"a0i_obs \\<Rightarrow> a0i_obs\"\nwhere\n  \"med0n0i \\<equiv> id\"\n\ndefinition\n  R0n0i :: \"(a0n_state \\<times> a0i_state) set\"\nwhere\n  \"R0n0i \\<equiv> Id\"\n\nlemma PO_a0i_running_refines_a0n_running:\n  \"{R0n0i} a0n_running A B M, a0i_running A B M {> R0n0i}\"\nby (unfold R0n0i_def) (rule relhoare_refl)\n\nlemma PO_a0i_commit_refines_a0n_commit:\n  \"{R0n0i} a0n_commit A B M, a0i_commit A B M {> R0n0i}\"\nby (auto simp add: PO_rhoare_defs R0n0i_def a0i_defs)\n\n\nlemmas PO_a0i_trans_refines_a0n_trans = \n  PO_a0i_running_refines_a0n_running\n  PO_a0i_commit_refines_a0n_commit\n\n\nlemma PO_a0i_refines_init_a0n [iff]:\n  \"init a0i \\<subseteq> R0n0i``(init a0n)\"\nby (auto simp add: R0n0i_def a0i_defs)\n\nlemma PO_a0i_refines_trans_a0n [iff]:\n  \"{R0n0i} trans a0n, trans a0i {> R0n0i}\"\nby (auto simp add: a0n_def a0n_trans_def a0i_def a0i_trans_def\n         intro!: PO_a0i_trans_refines_a0n_trans relhoare_abstract_UN)\n\nlemma PO_obs_consistent [iff]:\n  \"obs_consistent R0n0i med0n0i a0n a0i\"\nby (auto simp add: obs_consistent_def R0n0i_def med0n0i_def a0i_def a0n_def)\n\nlemma PO_a0i_refines_a0n:\n  \"refines R0n0i med0n0i a0n a0i\"\nby (rule Refinement_basic) (auto)\n\n\n(**************************************************************************************************)\nsubsection \\<open>Derived invariant\\<close>\n(**************************************************************************************************)\n\nlemma iagreement_implies_niagreement [iff]: \"a0i_agreement \\<subseteq> a0n_agreement\"\napply (auto intro!: a0n_agreementI)\napply (drule a0i_agreementD, drule order.strict_trans2, auto)\ndone\n\n\nlemma PO_a0i_a0n_agreement [iff]: \"reach a0i \\<subseteq> a0n_agreement\"\nby (rule subset_trans, rule, rule)\n\nlemma PO_a0i_obs_a0n_agreement [iff]: \"oreach a0i \\<subseteq> a0n_agreement\"\nby (rule subset_trans, rule, rule)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/AuthenticationI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.325509124817436}}
{"text": "(*  Author:     Giampaolo Bella, Catania University\n*)\n\nsection{*Bella's modification of the Shoup-Rubin protocol*}\n\ntheory ShoupRubinBella imports Smartcard begin\n\ntext{*The modifications are that message 7 now mentions A, while message 10\nnow mentions Nb and B. The lack of explicitness of the original version was\ndiscovered by investigating adherence to the principle of Goal\nAvailability. Only the updated version makes the goals of confidentiality,\nauthentication and key distribution available to both peers.*}\n\naxiomatization sesK :: \"nat*key => key\"\nwhere\n   (*sesK is injective on each component*) \n   inj_sesK [iff]: \"(sesK(m,k) = sesK(m',k')) = (m = m' \\<and> k = k')\" and\n\n   (*all long-term keys differ from sesK*)\n   shrK_disj_sesK [iff]: \"shrK A \\<noteq> sesK(m,pk)\" and\n   crdK_disj_sesK [iff]: \"crdK C \\<noteq> sesK(m,pk)\" and\n   pin_disj_sesK  [iff]: \"pin P \\<noteq> sesK(m,pk)\" and\n   pairK_disj_sesK[iff]: \"pairK(A,B) \\<noteq> sesK(m,pk)\" and\n\n   (*needed for base case in analz_image_freshK*)\n   Atomic_distrib [iff]: \"Atomic`(KEY`K \\<union> NONCE`N) =\n                   Atomic`(KEY`K) \\<union> Atomic`(NONCE`N)\" and\n\n  (*this protocol makes the assumption of secure means\n    between each agent and his smartcard*)\n   shouprubin_assumes_securemeans [iff]: \"evs \\<in> srb \\<Longrightarrow> secureM\"\n\ndefinition Unique :: \"[event, event list] => bool\" (\"Unique _ on _\") where\n   \"Unique ev on evs == \n      ev \\<notin> set (tl (dropWhile (% z. z \\<noteq> ev) evs))\"\n\n\ninductive_set srb :: \"event list set\"\n  where\n\n    Nil:  \"[]\\<in> srb\"\n\n\n\n  | Fake: \"\\<lbrakk> evsF \\<in> srb;  X \\<in> synth (analz (knows Spy evsF)); \n             illegalUse(Card B) \\<rbrakk>\n          \\<Longrightarrow> Says Spy A X # \n              Inputs Spy (Card B) X # evsF \\<in> srb\"\n\n(*In general this rule causes the assumption Card B \\<notin> cloned\n  in most guarantees for B - starting with confidentiality -\n  otherwise pairK_confidential could not apply*)\n  | Forge:\n         \"\\<lbrakk> evsFo \\<in> srb; Nonce Nb \\<in> analz (knows Spy evsFo);\n             Key (pairK(A,B)) \\<in> knows Spy evsFo \\<rbrakk>\n          \\<Longrightarrow> Notes Spy (Key (sesK(Nb,pairK(A,B)))) # evsFo \\<in> srb\"\n\n\n\n  | Reception: \"\\<lbrakk> evsrb\\<in> srb; Says A B X \\<in> set evsrb \\<rbrakk>\n              \\<Longrightarrow> Gets B X # evsrb \\<in> srb\"\n\n\n\n(*A AND THE SERVER*)\n  | SR_U1:  \"\\<lbrakk> evs1 \\<in> srb; A \\<noteq> Server \\<rbrakk>\n          \\<Longrightarrow> Says A Server \\<lbrace>Agent A, Agent B\\<rbrace> \n                # evs1 \\<in> srb\"\n\n  | SR_U2:  \"\\<lbrakk> evs2 \\<in> srb; \n             Gets Server \\<lbrace>Agent A, Agent B\\<rbrace> \\<in> set evs2 \\<rbrakk>\n          \\<Longrightarrow> Says Server A \\<lbrace>Nonce (Pairkey(A,B)), \n                           Crypt (shrK A) \\<lbrace>Nonce (Pairkey(A,B)), Agent B\\<rbrace>\n                  \\<rbrace>\n                # evs2 \\<in> srb\"\n\n\n\n\n(*A AND HER CARD*)\n(*A cannot decrypt the verifier for she dosn't know shrK A,\n  but the pairkey is recognisable*)\n  | SR_U3:  \"\\<lbrakk> evs3 \\<in> srb; legalUse(Card A);\n             Says A Server \\<lbrace>Agent A, Agent B\\<rbrace> \\<in> set evs3;\n             Gets A \\<lbrace>Nonce Pk, Certificate\\<rbrace> \\<in> set evs3 \\<rbrakk>\n          \\<Longrightarrow> Inputs A (Card A) (Agent A)\n                # evs3 \\<in> srb\"   (*however A only queries her card \nif she has previously contacted the server to initiate with some B. \nOtherwise she would do so even if the Server had not been active. \nStill, this doesn't and can't mean that the pairkey originated with \nthe server*)\n \n(*The card outputs the nonce Na to A*)               \n  | SR_U4:  \"\\<lbrakk> evs4 \\<in> srb; \n             Nonce Na \\<notin> used evs4; legalUse(Card A); A \\<noteq> Server;\n             Inputs A (Card A) (Agent A) \\<in> set evs4 \\<rbrakk> \n       \\<Longrightarrow> Outpts (Card A) A \\<lbrace>Nonce Na, Crypt (crdK (Card A)) (Nonce Na)\\<rbrace>\n              # evs4 \\<in> srb\"\n\n(*The card can be exploited by the spy*)\n(*because of the assumptions on the card, A is certainly not server nor spy*)\n  | SR_U4Fake: \"\\<lbrakk> evs4F \\<in> srb; Nonce Na \\<notin> used evs4F; \n             illegalUse(Card A);\n             Inputs Spy (Card A) (Agent A) \\<in> set evs4F \\<rbrakk> \n      \\<Longrightarrow> Outpts (Card A) Spy \\<lbrace>Nonce Na, Crypt (crdK (Card A)) (Nonce Na)\\<rbrace>\n            # evs4F \\<in> srb\"\n\n\n\n\n(*A TOWARDS B*)\n  | SR_U5:  \"\\<lbrakk> evs5 \\<in> srb; \n             Outpts (Card A) A \\<lbrace>Nonce Na, Certificate\\<rbrace> \\<in> set evs5;\n             \\<forall> p q. Certificate \\<noteq> \\<lbrace>p, q\\<rbrace> \\<rbrakk>\n          \\<Longrightarrow> Says A B \\<lbrace>Agent A, Nonce Na\\<rbrace> # evs5 \\<in> srb\"\n(*A must check that the verifier is not a compound message, \n  otherwise this would also fire after SR_U7 *)\n\n\n\n\n(*B AND HIS CARD*)\n  | SR_U6:  \"\\<lbrakk> evs6 \\<in> srb; legalUse(Card B);\n             Gets B \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs6 \\<rbrakk>\n          \\<Longrightarrow> Inputs B (Card B) \\<lbrace>Agent A, Nonce Na\\<rbrace> \n                # evs6 \\<in> srb\"\n(*B gets back from the card the session key and various verifiers*)\n  | SR_U7:  \"\\<lbrakk> evs7 \\<in> srb; \n             Nonce Nb \\<notin> used evs7; legalUse(Card B); B \\<noteq> Server;\n             K = sesK(Nb,pairK(A,B));\n             Key K \\<notin> used evs7;\n             Inputs B (Card B) \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs7\\<rbrakk>\n    \\<Longrightarrow> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K,\n                            Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, \n                            Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace> \n                # evs7 \\<in> srb\"\n(*The card can be exploited by the spy*)\n(*because of the assumptions on the card, A is certainly not server nor spy*)\n  | SR_U7Fake:  \"\\<lbrakk> evs7F \\<in> srb; Nonce Nb \\<notin> used evs7F; \n             illegalUse(Card B);\n             K = sesK(Nb,pairK(A,B));\n             Key K \\<notin> used evs7F;\n             Inputs Spy (Card B) \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs7F \\<rbrakk>\n          \\<Longrightarrow> Outpts (Card B) Spy \\<lbrace>Nonce Nb, Agent A, Key K,\n                            Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, \n                            Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace> \n                # evs7F \\<in> srb\"\n\n\n\n\n(*B TOWARDS A*)\n(*having sent an input that mentions A is the only memory B relies on,\n  since the output doesn't mention A - lack of explicitness*) \n  | SR_U8:  \"\\<lbrakk> evs8 \\<in> srb;  \n             Inputs B (Card B) \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs8;\n             Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K, \n                                 Cert1, Cert2\\<rbrace> \\<in> set evs8 \\<rbrakk>\n          \\<Longrightarrow> Says B A \\<lbrace>Nonce Nb, Cert1\\<rbrace> # evs8 \\<in> srb\"\n  \n\n\n\n(*A AND HER CARD*)\n(*A cannot check the form of the verifiers - although I can prove the form of\n  Cert2 - and just feeds her card with what she's got*)\n  | SR_U9:  \"\\<lbrakk> evs9 \\<in> srb; legalUse(Card A);\n             Gets A \\<lbrace>Nonce Pk, Cert1\\<rbrace> \\<in> set evs9;\n             Outpts (Card A) A \\<lbrace>Nonce Na, Cert2\\<rbrace> \\<in> set evs9; \n             Gets A \\<lbrace>Nonce Nb, Cert3\\<rbrace> \\<in> set evs9;\n             \\<forall> p q. Cert2 \\<noteq> \\<lbrace>p, q\\<rbrace> \\<rbrakk>\n          \\<Longrightarrow> Inputs A (Card A) \n                 \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce Pk,\n                  Cert1, Cert3, Cert2\\<rbrace> \n                # evs9 \\<in> srb\"\n(*But the card will only give outputs to the inputs of the correct form*)\n  | SR_U10: \"\\<lbrakk> evs10 \\<in> srb; legalUse(Card A); A \\<noteq> Server;\n             K = sesK(Nb,pairK(A,B));\n             Inputs A (Card A) \\<lbrace>Agent B, Nonce Na, Nonce Nb, \n                                 Nonce (Pairkey(A,B)),\n                                 Crypt (shrK A) \\<lbrace>Nonce (Pairkey(A,B)), \n                                                   Agent B\\<rbrace>,\n                                 Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, \n                                 Crypt (crdK (Card A)) (Nonce Na)\\<rbrace>\n               \\<in> set evs10 \\<rbrakk>\n          \\<Longrightarrow> Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, \n                                 Key K, Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace>\n                 # evs10 \\<in> srb\"\n(*The card can be exploited by the spy*)\n(*because of the assumptions on the card, A is certainly not server nor spy*)\n  | SR_U10Fake: \"\\<lbrakk> evs10F \\<in> srb; \n             illegalUse(Card A);\n             K = sesK(Nb,pairK(A,B));\n             Inputs Spy (Card A) \\<lbrace>Agent B, Nonce Na, Nonce Nb, \n                                   Nonce (Pairkey(A,B)),\n                                   Crypt (shrK A) \\<lbrace>Nonce (Pairkey(A,B)), \n                                                    Agent B\\<rbrace>,\n                                   Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, \n                                   Crypt (crdK (Card A)) (Nonce Na)\\<rbrace>\n               \\<in> set evs10F \\<rbrakk>\n          \\<Longrightarrow> Outpts (Card A) Spy \\<lbrace>Agent B, Nonce Nb, \n                                   Key K, Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace>\n                 # evs10F \\<in> srb\"\n\n\n\n\n(*A TOWARDS B*)\n(*having initiated with B is the only memory A relies on,\n  since the output doesn't mention B - lack of explicitness*) \n  | SR_U11: \"\\<lbrakk> evs11 \\<in> srb;\n             Says A Server \\<lbrace>Agent A, Agent B\\<rbrace> \\<in> set evs11;\n             Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, Key K, Certificate\\<rbrace> \n               \\<in> set evs11 \\<rbrakk>\n          \\<Longrightarrow> Says A B (Certificate) \n                 # evs11 \\<in> srb\"\n\n\n\n(*Both peers may leak by accident the session keys obtained from their\n  cards*)\n  | Oops1:\n     \"\\<lbrakk> evsO1 \\<in> srb;\n         Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K, Cert1, Cert2\\<rbrace> \n           \\<in> set evsO1 \\<rbrakk>\n     \\<Longrightarrow> Notes Spy \\<lbrace>Key K, Nonce Nb, Agent A, Agent B\\<rbrace> # evsO1 \\<in> srb\"\n\n  | Oops2:\n     \"\\<lbrakk> evsO2 \\<in> srb;\n         Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, Key K, Certificate\\<rbrace> \n           \\<in> set evsO2 \\<rbrakk>\n    \\<Longrightarrow> Notes Spy \\<lbrace>Key K, Nonce Nb, Agent A, Agent B\\<rbrace> # evsO2 \\<in> srb\"\n\n\n\n\n\n\n(*To solve Fake case when it doesn't involve analz - used to be condensed\n  into Fake_parts_insert_tac*)\ndeclare Fake_parts_insert_in_Un  [dest]\ndeclare analz_into_parts [dest]\n(*declare parts_insertI [intro]*)\n\n\n\n(*General facts about message reception*)\nlemma Gets_imp_Says: \n       \"\\<lbrakk> Gets B X \\<in> set evs; evs \\<in> srb \\<rbrakk> \\<Longrightarrow> \\<exists> A. Says A B X \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\nlemma Gets_imp_knows_Spy: \n     \"\\<lbrakk> Gets B X \\<in> set evs; evs \\<in> srb \\<rbrakk>  \\<Longrightarrow> X \\<in> knows Spy evs\"\napply (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\ndone\n\nlemma Gets_imp_knows_Spy_parts_Snd: \n     \"\\<lbrakk> Gets B \\<lbrace>X, Y\\<rbrace> \\<in> set evs; evs \\<in> srb \\<rbrakk>  \\<Longrightarrow> Y \\<in> parts (knows Spy evs)\"\napply (blast dest!: Gets_imp_Says Says_imp_knows_Spy parts.Inj parts.Snd)\ndone\n\nlemma Gets_imp_knows_Spy_analz_Snd: \n     \"\\<lbrakk> Gets B \\<lbrace>X, Y\\<rbrace> \\<in> set evs; evs \\<in> srb \\<rbrakk>  \\<Longrightarrow> Y \\<in> analz (knows Spy evs)\"\napply (blast dest!: Gets_imp_Says Says_imp_knows_Spy analz.Inj analz.Snd)\ndone\n\n(*end general facts*)\n\n\n\n(*Begin lemmas on secure means, from Event.thy, proved for shouprubin. They help\n  the simplifier, especially in analz_image_freshK*)\n\n\nlemma Inputs_imp_knows_Spy_secureM_srb: \n      \"\\<lbrakk> Inputs Spy C X \\<in> set evs; evs \\<in> srb \\<rbrakk> \\<Longrightarrow> X \\<in> knows Spy evs\"\napply (simp (no_asm_simp) add: Inputs_imp_knows_Spy_secureM)\ndone\n\nlemma knows_Spy_Inputs_secureM_srb_Spy: \n      \"evs \\<in>srb \\<Longrightarrow> knows Spy (Inputs Spy C X # evs) = insert X (knows Spy evs)\"\napply (simp (no_asm_simp))\ndone\n\nlemma knows_Spy_Inputs_secureM_srb: \n    \"\\<lbrakk> A \\<noteq> Spy; evs \\<in>srb \\<rbrakk> \\<Longrightarrow> knows Spy (Inputs A C X # evs) =  knows Spy evs\"\napply (simp (no_asm_simp))\ndone\n\nlemma knows_Spy_Outpts_secureM_srb_Spy: \n      \"evs \\<in>srb \\<Longrightarrow> knows Spy (Outpts C Spy X # evs) = insert X (knows Spy evs)\"\napply (simp (no_asm_simp))\ndone\n\nlemma knows_Spy_Outpts_secureM_srb: \n     \"\\<lbrakk> A \\<noteq> Spy; evs \\<in>srb \\<rbrakk> \\<Longrightarrow> knows Spy (Outpts C A X # evs) =  knows Spy evs\"\napply (simp (no_asm_simp))\ndone\n\n(*End lemmas on secure means for shouprubin*)\n\n\n\n\n(*BEGIN technical lemmas - evolution of forwarding lemmas*)\n\n(*If an honest agent uses a smart card, then the card is his/her own, is\n  not stolen, and the agent has received suitable data to feed the card. \n  In other words, these are guarantees that an honest agent can only use \n  his/her own card, and must use it correctly.\n  On the contrary, the spy can \"Inputs\" any cloned cards also by the Fake rule.\n\n  Instead of Auto_tac, proofs here used to asm-simplify and then force-tac.\n*)\nlemma Inputs_A_Card_3: \n    \"\\<lbrakk> Inputs A C (Agent A) \\<in> set evs; A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> legalUse(C) \\<and> C = (Card A) \\<and>  \n      (\\<exists> Pk Certificate. Gets A \\<lbrace>Pk, Certificate\\<rbrace> \\<in> set evs)\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\nlemma Inputs_B_Card_6: \n     \"\\<lbrakk> Inputs B C \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs; B \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> legalUse(C) \\<and> C = (Card B) \\<and> Gets B \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\nlemma Inputs_A_Card_9: \n     \"\\<lbrakk> Inputs A C \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce Pk,   \n                                           Cert1, Cert2, Cert3\\<rbrace> \\<in> set evs; \n         A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n  \\<Longrightarrow> legalUse(C) \\<and> C = (Card A) \\<and>  \n      Gets A \\<lbrace>Nonce Pk, Cert1\\<rbrace> \\<in> set evs     \\<and>  \n      Outpts (Card A) A \\<lbrace>Nonce Na, Cert3\\<rbrace> \\<in> set evs        \\<and>   \n      Gets A \\<lbrace>Nonce Nb, Cert2\\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\n\n(*The two occurrences of A in the Outpts event don't match SR_U4Fake, where\n  A cannot be the Spy. Hence the card is legally usable by rule SR_U4*)\nlemma Outpts_A_Card_4: \n     \"\\<lbrakk> Outpts C A \\<lbrace>Nonce Na, (Crypt (crdK (Card A)) (Nonce Na))\\<rbrace> \\<in> set evs;  \n         evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> legalUse(C) \\<and> C = (Card A) \\<and>  \n         Inputs A (Card A) (Agent A) \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\n\n(*First certificate is made explicit so that a comment similar to the previous\n  applies. This also provides Na to the Inputs event in the conclusion*)\nlemma Outpts_B_Card_7: \n      \"\\<lbrakk> Outpts C B \\<lbrace>Nonce Nb, Agent A, Key K,  \n                      Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>,  \n                      Cert2\\<rbrace> \\<in> set evs;  \n         evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> legalUse(C) \\<and> C = (Card B) \\<and>  \n         Inputs B (Card B) \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\nlemma Outpts_A_Card_10: \n     \"\\<lbrakk> Outpts C A \\<lbrace>Agent B, Nonce Nb, \n                    Key K, (Crypt (pairK(A,B)) (Nonce Nb))\\<rbrace> \\<in> set evs; \n         evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> legalUse(C) \\<and> C = (Card A) \\<and>  \n         (\\<exists> Na Ver1 Ver2 Ver3.  \n       Inputs A (Card A) \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce (Pairkey(A,B)),  \n                              Ver1, Ver2, Ver3\\<rbrace> \\<in> set evs)\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\n\n\n(*\nContrarily to original version, A doesn't need to check the form of the \ncertificate to learn that her peer is B. The goal is available to A.\n*)\nlemma Outpts_A_Card_10_imp_Inputs: \n     \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, Key K, Certificate\\<rbrace> \n          \\<in> set evs; evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> (\\<exists> Na Ver1 Ver2 Ver3.  \n       Inputs A (Card A) \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce (Pairkey(A,B)),  \n                              Ver1, Ver2, Ver3\\<rbrace> \\<in> set evs)\"\napply (erule rev_mp, erule srb.induct)\napply simp_all\napply blast+\ndone\n\n\n\n\n(*Weaker version: if the agent can't check the forms of the verifiers, then\n  the agent must not be the spy so as to solve SR_U4Fake. The verifier must be\n  recognised as some cyphertex in order to distinguish from case SR_U7, \n  concerning B's output, which also begins with a nonce.\n*)\nlemma Outpts_honest_A_Card_4: \n     \"\\<lbrakk> Outpts C A \\<lbrace>Nonce Na, Crypt K X\\<rbrace> \\<in>set evs; \n         A \\<noteq> Spy;  evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> legalUse(C) \\<and> C = (Card A) \\<and>  \n         Inputs A (Card A) (Agent A) \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\n(*alternative formulation of same theorem\nGoal \"\\<lbrakk> Outpts C A \\<lbrace>Nonce Na, Certificate\\<rbrace> \\<in> set evs;  \n         \\<forall> p q. Certificate \\<noteq> \\<lbrace>p, q\\<rbrace>;    \n         A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> legalUse(C) \\<and> C = (Card A) \\<and>  \n         Inputs A (Card A) (Agent A) \\<in> set evs\"\nsame proof\n*)\n\n\nlemma Outpts_honest_B_Card_7: \n    \"\\<lbrakk> Outpts C B \\<lbrace>Nonce Nb, Agent A, Key K, Cert1, Cert2\\<rbrace> \\<in> set evs;  \n       B \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n   \\<Longrightarrow> legalUse(C) \\<and> C = (Card B) \\<and>  \n       (\\<exists> Na. Inputs B (Card B) \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs)\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\nlemma Outpts_honest_A_Card_10: \n     \"\\<lbrakk> Outpts C A \\<lbrace>Agent B, Nonce Nb, Key K, Certificate\\<rbrace> \\<in> set evs;  \n         A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> legalUse (C) \\<and> C = (Card A) \\<and>  \n         (\\<exists> Na Pk Ver1 Ver2 Ver3.  \n          Inputs A (Card A) \\<lbrace>Agent B, Nonce Na, Nonce Nb, Pk,  \n                              Ver1, Ver2, Ver3\\<rbrace> \\<in> set evs)\"\napply (erule rev_mp, erule srb.induct)\napply simp_all\napply blast+\ndone\n(*-END-*)\n\n\n(*Even weaker versions: if the agent can't check the forms of the verifiers\n  and the agent may be the spy, then we must know what card the agent\n  is getting the output from. \n*)\nlemma Outpts_which_Card_4: \n    \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Nonce Na, Crypt K X\\<rbrace> \\<in> set evs; evs \\<in> srb \\<rbrakk>  \n    \\<Longrightarrow> Inputs A (Card A) (Agent A) \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply (simp_all (no_asm_simp))\napply clarify\ndone\n\nlemma Outpts_which_Card_7: \n  \"\\<lbrakk> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K, Cert1, Cert2\\<rbrace> \n       \\<in> set evs;  evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> \\<exists> Na. Inputs B (Card B) \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\n(*This goal is now available - in the sense of Goal Availability*)\nlemma Outpts_which_Card_10: \n    \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, Key K, Certificate \\<rbrace> \\<in> set evs;\n       evs \\<in> srb \\<rbrakk>  \n    \\<Longrightarrow> \\<exists> Na. Inputs A (Card A) \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce (Pairkey(A,B)), \n                            Crypt (shrK A) \\<lbrace>Nonce (Pairkey(A,B)), Agent B\\<rbrace>,  \n                            Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>,  \n                            Crypt (crdK (Card A)) (Nonce Na) \\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\n\n(*Lemmas on the form of outputs*)\n\n\n(*A needs to check that the verifier is a cipher for it to come from SR_U4\n  otherwise it could come from SR_U7 *)\nlemma Outpts_A_Card_form_4: \n  \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Nonce Na, Certificate\\<rbrace> \\<in> set evs;  \n         \\<forall> p q. Certificate \\<noteq> \\<lbrace>p, q\\<rbrace>; evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> Certificate = (Crypt (crdK (Card A)) (Nonce Na))\"\napply (erule rev_mp, erule srb.induct)\napply (simp_all (no_asm_simp))\ndone\n\nlemma Outpts_B_Card_form_7: \n   \"\\<lbrakk> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K, Cert1, Cert2\\<rbrace> \n        \\<in> set evs; evs \\<in> srb \\<rbrakk>          \n      \\<Longrightarrow> \\<exists> Na.    \n          K = sesK(Nb,pairK(A,B)) \\<and>                       \n          Cert1 = (Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>) \\<and>  \n          Cert2 = (Crypt (pairK(A,B)) (Nonce Nb))\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\nlemma Outpts_A_Card_form_10: \n   \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, Key K, Certificate\\<rbrace> \n        \\<in> set evs; evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> K = sesK(Nb,pairK(A,B)) \\<and>  \n          Certificate = (Crypt (pairK(A,B)) (Nonce Nb))\"\napply (erule rev_mp, erule srb.induct)\napply (simp_all (no_asm_simp))\ndone\n\nlemma Outpts_A_Card_form_bis: \n  \"\\<lbrakk> Outpts (Card A') A' \\<lbrace>Agent B', Nonce Nb', Key (sesK(Nb,pairK(A,B))), \n     Certificate\\<rbrace> \\<in> set evs; \n         evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> A' = A \\<and> B' = B \\<and> Nb = Nb' \\<and>  \n          Certificate = (Crypt (pairK(A,B)) (Nonce Nb))\"\napply (erule rev_mp, erule srb.induct)\napply (simp_all (no_asm_simp))\ndone\n\n(*\\<dots> and Inputs *)\n\nlemma Inputs_A_Card_form_9: \n\n     \"\\<lbrakk> Inputs A (Card A) \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce Pk,   \n                             Cert1, Cert2, Cert3\\<rbrace> \\<in> set evs; \n         evs \\<in> srb \\<rbrakk>  \n  \\<Longrightarrow>    Cert3 = Crypt (crdK (Card A)) (Nonce Na)\"\napply (erule rev_mp)\napply (erule srb.induct)\napply (simp_all (no_asm_simp))\n(*Fake*)\napply force\n(*SR_U9*)\napply (blast dest!: Outpts_A_Card_form_4)\ndone\n(* Pk, Cert1, Cert2 cannot be made explicit because they traversed the network in the clear *)\n\n\n\n(*General guarantees on Inputs and Outpts*)\n\n(*for any agents*)\n\n\nlemma Inputs_Card_legalUse: \n  \"\\<lbrakk> Inputs A (Card A) X \\<in> set evs; evs \\<in> srb \\<rbrakk> \\<Longrightarrow> legalUse(Card A)\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\nlemma Outpts_Card_legalUse: \n  \"\\<lbrakk> Outpts (Card A) A X \\<in> set evs; evs \\<in> srb \\<rbrakk> \\<Longrightarrow> legalUse(Card A)\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\n(*for honest agents*)\n\nlemma Inputs_Card: \"\\<lbrakk> Inputs A C X \\<in> set evs; A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> C = (Card A) \\<and> legalUse(C)\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\nlemma Outpts_Card: \"\\<lbrakk> Outpts C A X \\<in> set evs; A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> C = (Card A) \\<and> legalUse(C)\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\nlemma Inputs_Outpts_Card: \n     \"\\<lbrakk> Inputs A C X \\<in> set evs \\<or> Outpts C A Y \\<in> set evs;  \n         A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> C = (Card A) \\<and> legalUse(Card A)\"\napply (blast dest: Inputs_Card Outpts_Card)\ndone\n\n\n(*for the spy - they stress that the model behaves as it is meant to*) \n\n(*The or version can be also proved directly.\n  It stresses that the spy may use either her own legally usable card or\n  all the illegally usable cards.\n*)\nlemma Inputs_Card_Spy: \n  \"\\<lbrakk> Inputs Spy C X \\<in> set evs \\<or> Outpts C Spy X \\<in> set evs; evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> C = (Card Spy) \\<and> legalUse(Card Spy) \\<or>  \n          (\\<exists> A. C = (Card A) \\<and> illegalUse(Card A))\"\napply (erule rev_mp, erule srb.induct)\napply auto\ndone\n\n\n(*END technical lemmas*)\n\n\n\n\n\n\n(*BEGIN unicity theorems: certain items uniquely identify a smart card's\n                          output*)\n\n(*A's card's first output: the nonce uniquely identifies the rest*)\nlemma Outpts_A_Card_unique_nonce:\n     \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Nonce Na, Crypt (crdK (Card A)) (Nonce Na)\\<rbrace>  \n           \\<in> set evs;   \n         Outpts (Card A') A' \\<lbrace>Nonce Na, Crypt (crdK (Card A')) (Nonce Na)\\<rbrace> \n           \\<in> set evs;   \n         evs \\<in> srb \\<rbrakk> \\<Longrightarrow> A=A'\"\napply (erule rev_mp, erule rev_mp, erule srb.induct, simp_all)\napply (fastforce dest: Outpts_parts_used)\napply blast\ndone\n\n(*B's card's output: the NONCE uniquely identifies the rest*)\nlemma Outpts_B_Card_unique_nonce: \n     \"\\<lbrakk> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key SK, Cert1, Cert2\\<rbrace> \\<in> set evs;   \n      Outpts (Card B') B' \\<lbrace>Nonce Nb, Agent A', Key SK', Cert1', Cert2'\\<rbrace> \\<in> set evs;\n       evs \\<in> srb \\<rbrakk> \\<Longrightarrow> B=B' \\<and> A=A' \\<and> SK=SK' \\<and> Cert1=Cert1' \\<and> Cert2=Cert2'\"\napply (erule rev_mp, erule rev_mp, erule srb.induct, simp_all)\napply (fastforce dest: Outpts_parts_used)\napply blast\ndone\n\n\n(*B's card's output: the SESKEY uniquely identifies the rest*)\nlemma Outpts_B_Card_unique_key: \n     \"\\<lbrakk> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key SK, Cert1, Cert2\\<rbrace> \\<in> set evs;   \n      Outpts (Card B') B' \\<lbrace>Nonce Nb', Agent A', Key SK, Cert1', Cert2'\\<rbrace> \\<in> set evs; \n       evs \\<in> srb \\<rbrakk> \\<Longrightarrow> B=B' \\<and> A=A' \\<and> Nb=Nb' \\<and> Cert1=Cert1' \\<and> Cert2=Cert2'\"\napply (erule rev_mp, erule rev_mp, erule srb.induct, simp_all)\napply (fastforce dest: Outpts_parts_used)\napply blast\ndone\n\nlemma Outpts_A_Card_unique_key: \n   \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, Key K, V\\<rbrace> \\<in> set evs;   \n      Outpts (Card A') A' \\<lbrace>Agent B', Nonce Nb', Key K, V'\\<rbrace> \\<in> set evs;   \n         evs \\<in> srb \\<rbrakk> \\<Longrightarrow> A=A' \\<and> B=B' \\<and> Nb=Nb' \\<and> V=V'\"\napply (erule rev_mp, erule rev_mp, erule srb.induct, simp_all)\napply (blast dest: Outpts_A_Card_form_bis)\napply blast\ndone\n\n\n(*Revised unicity theorem - applies to both steps 4 and 7*)\nlemma Outpts_A_Card_Unique: \n  \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Nonce Na, rest\\<rbrace> \\<in> set evs; evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> Unique (Outpts (Card A) A \\<lbrace>Nonce Na, rest\\<rbrace>) on evs\"\napply (erule rev_mp, erule srb.induct, simp_all add: Unique_def)\napply (fastforce dest: Outpts_parts_used)\napply blast\napply (fastforce dest: Outpts_parts_used)\napply blast\ndone\n\n(*can't prove the same on evs10 for it doesn't have a freshness assumption!*)\n\n\n(*END unicity theorems*)\n\n\n(*BEGIN counterguarantees about spy's knowledge*)\n\n(*on nonces*)\n\nlemma Spy_knows_Na: \n      \"\\<lbrakk> Says A B \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs; evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> Nonce Na \\<in> analz (knows Spy evs)\"\napply (blast dest!: Says_imp_knows_Spy [THEN analz.Inj, THEN analz.Snd])\ndone\n\nlemma Spy_knows_Nb: \n      \"\\<lbrakk> Says B A \\<lbrace>Nonce Nb, Certificate\\<rbrace> \\<in> set evs; evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> Nonce Nb \\<in> analz (knows Spy evs)\"\napply (blast dest!: Says_imp_knows_Spy [THEN analz.Inj, THEN analz.Fst])\ndone\n\n\n(*on Pairkey*)\n\nlemma Pairkey_Gets_analz_knows_Spy: \n      \"\\<lbrakk> Gets A \\<lbrace>Nonce (Pairkey(A,B)), Certificate\\<rbrace> \\<in> set evs; evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> Nonce (Pairkey(A,B)) \\<in> analz (knows Spy evs)\"\napply (blast dest!: Gets_imp_knows_Spy [THEN analz.Inj])\ndone\n\nlemma Pairkey_Inputs_imp_Gets: \n     \"\\<lbrakk> Inputs A (Card A)             \n           \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce (Pairkey(A,B)),     \n             Cert1, Cert3, Cert2\\<rbrace> \\<in> set evs;           \n         A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>     \n      \\<Longrightarrow> Gets A \\<lbrace>Nonce (Pairkey(A,B)), Cert1\\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply (simp_all (no_asm_simp))\napply force\ndone\n\nlemma Pairkey_Inputs_analz_knows_Spy: \n     \"\\<lbrakk> Inputs A (Card A)             \n           \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce (Pairkey(A,B)),     \n             Cert1, Cert3, Cert2\\<rbrace> \\<in> set evs;           \n         evs \\<in> srb \\<rbrakk>     \n     \\<Longrightarrow> Nonce (Pairkey(A,B)) \\<in> analz (knows Spy evs)\"\napply (case_tac \"A = Spy\")\napply (fastforce dest!: Inputs_imp_knows_Spy_secureM [THEN analz.Inj])\napply (blast dest!: Pairkey_Inputs_imp_Gets [THEN Pairkey_Gets_analz_knows_Spy])\ndone\n\n(* This fails on base case because of XOR properties.\nlemma Pairkey_authentic:\n  \"\\<lbrakk> Nonce (Pairkey(A,B)) \\<in> parts (knows Spy evs);\n     Card A \\<notin> cloned; evs \\<in> sr \\<rbrakk>\n \\<Longrightarrow> \\<exists> cert. Says Server A \\<lbrace>Nonce (Pairkey(A,B)), Cert\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule sr.induct, simp_all)\napply clarify\noops\n\n 1. \\<And>x a b.\n       \\<lbrakk>Card A \\<notin> cloned; Pairkey (A, B) = Pairkey (a, b); Card a \\<in> cloned;\n        Card b \\<in> cloned\\<rbrakk>\n       \\<Longrightarrow> False\n*)\n\n\n(*END counterguarantees on spy's knowledge*)\n\n\n(*BEGIN rewrite rules for parts operator*)\n\ndeclare shrK_disj_sesK [THEN not_sym, iff] \ndeclare pin_disj_sesK [THEN not_sym, iff]\ndeclare crdK_disj_sesK [THEN not_sym, iff]\ndeclare pairK_disj_sesK [THEN not_sym, iff]\n\n\nML\n{*\nstructure ShoupRubinBella =\nstruct\n\nfun prepare_tac ctxt = \n (*SR_U8*)   forward_tac [@{thm Outpts_B_Card_form_7}] 14 THEN\n (*SR_U8*)   clarify_tac ctxt 15 THEN\n (*SR_U9*)   forward_tac [@{thm Outpts_A_Card_form_4}] 16 THEN \n (*SR_U11*)  forward_tac [@{thm Outpts_A_Card_form_10}] 21 \n\nfun parts_prepare_tac ctxt = \n           prepare_tac ctxt THEN\n (*SR_U9*)   dresolve_tac [@{thm Gets_imp_knows_Spy_parts_Snd}] 18 THEN \n (*SR_U9*)   dresolve_tac [@{thm Gets_imp_knows_Spy_parts_Snd}] 19 THEN \n (*Oops1*) dresolve_tac [@{thm Outpts_B_Card_form_7}] 25    THEN               \n (*Oops2*) dresolve_tac [@{thm Outpts_A_Card_form_10}] 27 THEN                \n (*Base*)  (force_tac ctxt) 1\n\nfun analz_prepare_tac ctxt = \n         prepare_tac ctxt THEN\n         dtac (@{thm Gets_imp_knows_Spy_analz_Snd}) 18 THEN \n (*SR_U9*) dtac (@{thm Gets_imp_knows_Spy_analz_Snd}) 19 THEN \n         REPEAT_FIRST (eresolve_tac [asm_rl, conjE] ORELSE' hyp_subst_tac ctxt)\n\nend\n*}\n\nmethod_setup prepare = {*\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (ShoupRubinBella.prepare_tac ctxt)) *}\n  \"to launch a few simple facts that will help the simplifier\"\n\nmethod_setup parts_prepare = {*\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (ShoupRubinBella.parts_prepare_tac ctxt)) *}\n  \"additional facts to reason about parts\"\n\nmethod_setup analz_prepare = {*\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (ShoupRubinBella.analz_prepare_tac ctxt)) *}\n  \"additional facts to reason about analz\"\n\n\n\nlemma Spy_parts_keys [simp]: \"evs \\<in> srb \\<Longrightarrow>  \n  (Key (shrK P) \\<in> parts (knows Spy evs)) = (Card P \\<in> cloned) \\<and>  \n  (Key (pin P) \\<in> parts (knows Spy evs)) = (P \\<in> bad \\<or> Card P \\<in> cloned) \\<and>  \n  (Key (crdK C) \\<in> parts (knows Spy evs)) = (C \\<in> cloned) \\<and>  \n  (Key (pairK(A,B)) \\<in> parts (knows Spy evs)) = (Card B \\<in> cloned)\"\napply (erule srb.induct)\napply parts_prepare\napply simp_all\napply (blast intro: parts_insertI)\ndone\n\n(*END rewrite rules for parts operator*)\n\n(*BEGIN rewrite rules for analz operator*)\n\n\nlemma Spy_analz_shrK[simp]: \"evs \\<in> srb \\<Longrightarrow>  \n  (Key (shrK P) \\<in> analz (knows Spy evs)) = (Card P \\<in> cloned)\"\napply (auto dest!: Spy_knows_cloned)\ndone\n\nlemma Spy_analz_crdK[simp]: \"evs \\<in> srb \\<Longrightarrow>  \n  (Key (crdK C) \\<in> analz (knows Spy evs)) = (C \\<in> cloned)\"\napply (auto dest!: Spy_knows_cloned)\ndone\n\nlemma Spy_analz_pairK[simp]: \"evs \\<in> srb \\<Longrightarrow>  \n  (Key (pairK(A,B)) \\<in> analz (knows Spy evs)) = (Card B \\<in> cloned)\"\napply (auto dest!: Spy_knows_cloned)\ndone\n\n\n\n\n(*Because initState contains a set of nonces, this is needed for base case of\n  analz_image_freshK*)\nlemma analz_image_Key_Un_Nonce: \"analz (Key`K \\<union> Nonce`N) = Key`K \\<union> Nonce`N\"\napply auto\ndone\n\nmethod_setup sc_analz_freshK = {*\n    Scan.succeed (fn ctxt =>\n     (SIMPLE_METHOD\n      (EVERY [REPEAT_FIRST (resolve_tac [allI, ballI, impI]),\n          REPEAT_FIRST (rtac @{thm analz_image_freshK_lemma}),\n          ALLGOALS (asm_simp_tac (put_simpset Smartcard.analz_image_freshK_ss ctxt\n              addsimps [@{thm knows_Spy_Inputs_secureM_srb_Spy},\n                  @{thm knows_Spy_Outpts_secureM_srb_Spy},\n                  @{thm shouprubin_assumes_securemeans},\n                  @{thm analz_image_Key_Un_Nonce}]))]))) *}\n    \"for proving the Session Key Compromise theorem for smartcard protocols\"\n\n\nlemma analz_image_freshK [rule_format]: \n     \"evs \\<in> srb \\<Longrightarrow>      \\<forall> K KK.  \n          (Key K \\<in> analz (Key`KK \\<union> (knows Spy evs))) =  \n          (K \\<in> KK \\<or> Key K \\<in> analz (knows Spy evs))\"\napply (erule srb.induct)\napply analz_prepare\napply sc_analz_freshK\napply spy_analz\ndone\n\n\nlemma analz_insert_freshK: \"evs \\<in> srb \\<Longrightarrow>   \n         Key K \\<in> analz (insert (Key K') (knows Spy evs)) =  \n         (K = K' \\<or> Key K \\<in> analz (knows Spy evs))\"\napply (simp only: analz_image_freshK_simps analz_image_freshK)\ndone\n\n(*END rewrite rules for analz operator*)\n\n(*BEGIN authenticity theorems*)\n\n\n\n\nlemma Na_Nb_certificate_authentic: \n     \"\\<lbrakk> Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace> \\<in> parts (knows Spy evs);  \n         \\<not>illegalUse(Card B); \n         evs \\<in> srb \\<rbrakk>           \n     \\<Longrightarrow> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key (sesK(Nb,pairK(A,B))),   \n                Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, \n                Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply parts_prepare\napply simp_all\n(*Fake*)\napply spy_analz\n(*SR_U7F*)\napply clarify\n(*SR_U8*)\napply clarify\ndone\n\nlemma Nb_certificate_authentic:\n      \"\\<lbrakk> Crypt (pairK(A,B)) (Nonce Nb) \\<in> parts (knows Spy evs);  \n         B \\<noteq> Spy; \\<not>illegalUse(Card A); \\<not>illegalUse(Card B); \n         evs \\<in> srb \\<rbrakk>    \n     \\<Longrightarrow> Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, Key (sesK(Nb,pairK(A,B))),  \n                             Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply parts_prepare\napply (case_tac [17] \"Aa = Spy\")\napply simp_all\n(*Fake*)\napply spy_analz\n(*SR_U7F, SR_U10F*)\napply clarify+\ndone\n\n\n\n(*Discovering the very origin of the Nb certificate...*)\nlemma Outpts_A_Card_imp_pairK_parts: \n     \"\\<lbrakk> Outpts (Card A) A  \\<lbrace>Agent B, Nonce Nb, \n                    Key K, Certificate\\<rbrace> \\<in> set evs;  \n        evs \\<in> srb \\<rbrakk>   \n    \\<Longrightarrow> \\<exists> Na. Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace> \\<in> parts (knows Spy evs)\"\napply (erule rev_mp, erule srb.induct)\napply parts_prepare\napply simp_all\n(*Fake*)\napply (blast dest: parts_insertI)\n(*SR_U7*)\napply force\n(*SR_U7F*)\napply force\n(*SR_U8*)\napply blast\n(*SR_U10*)\napply (blast dest: Inputs_imp_knows_Spy_secureM_srb parts.Inj Inputs_A_Card_9 Gets_imp_knows_Spy elim: knows_Spy_partsEs)\n(*SR_U10F*)\napply (blast dest: Inputs_imp_knows_Spy_secureM_srb [THEN parts.Inj] \n                   Inputs_A_Card_9 Gets_imp_knows_Spy \n             elim: knows_Spy_partsEs)\ndone\n\n               \nlemma Nb_certificate_authentic_bis: \n     \"\\<lbrakk> Crypt (pairK(A,B)) (Nonce Nb) \\<in> parts (knows Spy evs);  \n         B \\<noteq> Spy; \\<not>illegalUse(Card B); \n         evs \\<in> srb \\<rbrakk>    \n \\<Longrightarrow> \\<exists> Na. Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key (sesK(Nb,pairK(A,B))),   \n                   Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, \n                   Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace> \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply parts_prepare\napply (simp_all (no_asm_simp))\n(*Fake*)\napply spy_analz\n(*SR_U7*)\napply blast\n(*SR_U7F*)\napply blast\n(*SR_U8*)\napply force\n(*SR_U10*)\napply (blast dest: Na_Nb_certificate_authentic Inputs_imp_knows_Spy_secureM_srb [THEN parts.Inj] elim: knows_Spy_partsEs)\n(*SR_U10F*)\napply (blast dest: Na_Nb_certificate_authentic Inputs_imp_knows_Spy_secureM_srb [THEN parts.Inj] elim: knows_Spy_partsEs)\n(*SR_U11*)\napply (blast dest: Na_Nb_certificate_authentic Outpts_A_Card_imp_pairK_parts)\ndone\n\n\nlemma Pairkey_certificate_authentic: \n    \"\\<lbrakk> Crypt (shrK A) \\<lbrace>Nonce Pk, Agent B\\<rbrace> \\<in> parts (knows Spy evs);    \n         Card A \\<notin> cloned; evs \\<in> srb \\<rbrakk>        \n     \\<Longrightarrow> Pk = Pairkey(A,B) \\<and>              \n         Says Server A \\<lbrace>Nonce Pk,  \n                        Crypt (shrK A) \\<lbrace>Nonce Pk, Agent B\\<rbrace>\\<rbrace> \n           \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply parts_prepare\napply (simp_all (no_asm_simp))\n(*Fake*)\napply spy_analz\n(*SR_U8*)\napply force\ndone\n\n\nlemma sesK_authentic: \n     \"\\<lbrakk> Key (sesK(Nb,pairK(A,B))) \\<in> parts (knows Spy evs);  \n         A \\<noteq> Spy; B \\<noteq> Spy; \\<not>illegalUse(Card A); \\<not>illegalUse(Card B); \n         evs \\<in> srb \\<rbrakk>           \n      \\<Longrightarrow> Notes Spy \\<lbrace>Key (sesK(Nb,pairK(A,B))), Nonce Nb, Agent A, Agent B\\<rbrace>  \n           \\<in> set evs\"\napply (erule rev_mp, erule srb.induct)\napply parts_prepare\napply (simp_all)\n(*fake*)\napply spy_analz\n(*forge*)\napply (fastforce dest: analz.Inj)\n(*SR_U7: used B\\<noteq>Spy*)\n(*SR_U7F*)\napply clarify\n(*SR_U10: used A\\<noteq>Spy*)\n(*SR_U10F*)\napply clarify\ndone\n\n\n(*END authenticity theorems*)\n\n\n(*BEGIN confidentiality theorems*)\n\n\nlemma Confidentiality: \n     \"\\<lbrakk> Notes Spy \\<lbrace>Key (sesK(Nb,pairK(A,B))), Nonce Nb, Agent A, Agent B\\<rbrace>  \n           \\<notin> set evs; \n        A \\<noteq> Spy; B \\<noteq> Spy; \\<not>illegalUse(Card A); \\<not>illegalUse(Card B); \n        evs \\<in> srb \\<rbrakk>           \n      \\<Longrightarrow> Key (sesK(Nb,pairK(A,B))) \\<notin> analz (knows Spy evs)\"\napply (blast intro: sesK_authentic)\ndone\n\nlemma Confidentiality_B: \n     \"\\<lbrakk> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K, Cert1, Cert2\\<rbrace> \n          \\<in> set evs;  \n        Notes Spy \\<lbrace>Key K, Nonce Nb, Agent A, Agent B\\<rbrace> \\<notin> set evs;  \n        A \\<noteq> Spy; B \\<noteq> Spy; \\<not>illegalUse(Card A); Card B \\<notin> cloned; \n        evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\napply (erule rev_mp, erule rev_mp, erule srb.induct)\napply analz_prepare\napply (simp_all add: analz_insert_eq analz_insert_freshK pushes split_ifs)\n(*Fake*)\napply spy_analz\n(*Forge*)\napply (rotate_tac 7)\napply (drule parts.Inj)\napply (fastforce dest: Outpts_B_Card_form_7)\n(*SR_U7*)\napply (blast dest!: Outpts_B_Card_form_7)\n(*SR_U7F*)\napply clarify\napply (drule Outpts_parts_used)\napply simp\n(*faster than\n  apply (fastforce dest: Outpts_parts_used)\n*)\n(*SR_U10*)\napply (fastforce dest: Outpts_B_Card_form_7)\n(*SR_U10F - uses assumption Card A not cloned*)\napply clarify\napply (drule Outpts_B_Card_form_7, assumption)\napply simp\n(*Oops1*)\napply (blast dest!: Outpts_B_Card_form_7)\n(*Oops2*)\napply (blast dest!: Outpts_B_Card_form_7 Outpts_A_Card_form_10)\ndone\n\n\n(*END confidentiality theorems*)\n\n\n(*BEGIN authentication theorems*)\n\nlemma A_authenticates_B: \n     \"\\<lbrakk> Outpts (Card A) A  \\<lbrace>Agent B, Nonce Nb, Key K, Certificate\\<rbrace> \\<in> set evs;\n        \\<not>illegalUse(Card B); \n        evs \\<in> srb \\<rbrakk>           \n \\<Longrightarrow> \\<exists> Na. Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K,   \n                Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, \n                Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace> \\<in> set evs\"\napply (blast dest: Na_Nb_certificate_authentic Outpts_A_Card_form_10 Outpts_A_Card_imp_pairK_parts)\ndone\n\nlemma A_authenticates_B_Gets: \n     \"\\<lbrakk> Gets A \\<lbrace>Nonce Nb, Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>\\<rbrace>  \n           \\<in> set evs;  \n         \\<not>illegalUse(Card B); \n         evs \\<in> srb \\<rbrakk>           \n    \\<Longrightarrow> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key (sesK(Nb, pairK (A, B))),   \n                             Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, \n                             Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace> \\<in> set evs\"\napply (blast dest: Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Snd, THEN Na_Nb_certificate_authentic])\ndone\n\n\nlemma A_authenticates_B_bis: \n     \"\\<lbrakk> Outpts (Card A) A  \\<lbrace>Agent B, Nonce Nb, Key K, Cert2\\<rbrace> \\<in> set evs;  \n        \\<not>illegalUse(Card B); \n        evs \\<in> srb \\<rbrakk>           \n \\<Longrightarrow> \\<exists> Cert1. Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K, Cert1, Cert2\\<rbrace> \n                \\<in> set evs\"\napply (blast dest: Na_Nb_certificate_authentic Outpts_A_Card_form_10 Outpts_A_Card_imp_pairK_parts)\ndone\n\n\n\n\n\n\nlemma B_authenticates_A: \n     \"\\<lbrakk> Gets B (Crypt (pairK(A,B)) (Nonce Nb)) \\<in> set evs;  \n         B \\<noteq> Spy; \\<not>illegalUse(Card A); \\<not>illegalUse(Card B); \n         evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> Outpts (Card A) A  \\<lbrace>Agent B, Nonce Nb, \n         Key (sesK(Nb,pairK(A,B))), Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule srb.induct)\napply (simp_all (no_asm_simp))\napply (blast dest: Says_imp_knows_Spy [THEN parts.Inj] Nb_certificate_authentic)\ndone\n\n\nlemma B_authenticates_A_bis: \n     \"\\<lbrakk> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K, Cert1, Cert2\\<rbrace> \\<in> set evs;\n        Gets B (Cert2) \\<in> set evs;  \n         B \\<noteq> Spy; \\<not>illegalUse(Card A); \\<not>illegalUse(Card B); \n         evs \\<in> srb \\<rbrakk>  \n      \\<Longrightarrow> Outpts (Card A) A  \\<lbrace>Agent B, Nonce Nb, Key K, Cert2\\<rbrace> \\<in> set evs\"\napply (blast dest: Outpts_B_Card_form_7 B_authenticates_A)\ndone\n\n\n(*END authentication theorems*)\n\n\nlemma Confidentiality_A: \n      \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, \n                       Key K, Certificate\\<rbrace> \\<in> set evs;  \n         Notes Spy \\<lbrace>Key K, Nonce Nb, Agent A, Agent B\\<rbrace> \\<notin> set evs;  \n         A \\<noteq> Spy; B \\<noteq> Spy; \\<not>illegalUse(Card A); \\<not>illegalUse(Card B); \n         evs \\<in> srb \\<rbrakk>           \n     \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\napply (drule A_authenticates_B)\nprefer 3\napply (erule exE)\napply (drule Confidentiality_B)\napply auto\ndone\n\n\nlemma Outpts_imp_knows_agents_secureM_srb: \n   \"\\<lbrakk> Outpts (Card A) A X \\<in> set evs; evs \\<in> srb \\<rbrakk> \\<Longrightarrow> X \\<in> knows A evs\"\napply (simp (no_asm_simp) add: Outpts_imp_knows_agents_secureM)\ndone\n\n\n(*BEGIN key distribution theorems*)\nlemma A_keydist_to_B: \n   \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, Key K, Certificate\\<rbrace> \\<in> set evs;  \n         \\<not>illegalUse(Card B); \n         evs \\<in> srb \\<rbrakk>           \n     \\<Longrightarrow> Key K \\<in> analz (knows B evs)\"\napply (drule A_authenticates_B)\nprefer 3\napply (erule exE)\napply (rule Outpts_imp_knows_agents_secureM_srb [THEN analz.Inj, THEN analz.Snd, THEN analz.Snd, THEN analz.Fst])\napply assumption+\ndone\n\n\nlemma B_keydist_to_A: \n\"\\<lbrakk> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K, Cert1, Cert2\\<rbrace> \\<in> set evs;  \n   Gets B (Cert2) \\<in> set evs;  \n   B \\<noteq> Spy; \\<not>illegalUse(Card A); \\<not>illegalUse(Card B); \n   evs \\<in> srb \\<rbrakk>  \n \\<Longrightarrow> Key K \\<in> analz (knows A evs)\"\napply (frule Outpts_B_Card_form_7)\napply assumption apply simp\napply (frule B_authenticates_A)\napply (rule_tac [5] Outpts_imp_knows_agents_secureM_srb [THEN analz.Inj, THEN analz.Snd, THEN analz.Snd, THEN analz.Fst])\napply simp+\ndone\n\n(*END key distribution theorems*)\n\n\n\n\n(*BEGIN further theorems about authenticity of verifiers - useful to cards,\n  and somewhat to agents *)\n\n(*MSG11\nIf B receives the verifier of msg11, then the verifier originated with msg7.\nThis is clearly not available to B: B can't check the form of the verifier because he doesn't know pairK(A,B)\n*)\nlemma Nb_certificate_authentic_B: \n     \"\\<lbrakk> Gets B (Crypt (pairK(A,B)) (Nonce Nb)) \\<in> set evs;  \n        B \\<noteq> Spy; \\<not>illegalUse(Card B); \n        evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> \\<exists> Na. \n            Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key (sesK(Nb,pairK(A,B))),   \n                Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, \n                Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace> \\<in> set evs\"\napply (blast dest: Gets_imp_knows_Spy [THEN parts.Inj, THEN Nb_certificate_authentic_bis])\ndone\n\n(*MSG10\nIf A obtains the verifier of msg10, then the verifier originated with msg7:\nA_authenticates_B. It is useful to A, who can check the form of the \nverifier by application of Outpts_A_Card_form_10.\n*)\n\n(*MSG9\nThe first verifier verifies the Pairkey to the card: since it's encrypted\nunder Ka, it must come from the server (if A's card is not cloned).\nThe second verifier verifies both nonces, since it's encrypted under the\npairK, it must originate with B's card  (if A and B's cards not cloned).\nThe third verifier verifies Na: since it's encrytped under the card's key,\nit originated with the card; so the card does not need to save Na\nin the first place and do a comparison now: it just verifies Na through the\nverifier. Three theorems related to these three statements.\n\nRecall that a card can check the form of the verifiers (can decrypt them),\nwhile an agent in general cannot, if not provided with a suitable theorem.\n*)\n\n(*Card A can't reckon the pairkey - we need to guarantee its integrity!*)\nlemma Pairkey_certificate_authentic_A_Card: \n     \"\\<lbrakk> Inputs A (Card A)   \n             \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce Pk, \n               Crypt (shrK A) \\<lbrace>Nonce Pk, Agent B\\<rbrace>,  \n               Cert2, Cert3\\<rbrace> \\<in> set evs; \n         A \\<noteq> Spy; Card A \\<notin> cloned; evs \\<in> srb \\<rbrakk>   \n     \\<Longrightarrow> Pk = Pairkey(A,B) \\<and>  \n         Says Server A \\<lbrace>Nonce (Pairkey(A,B)),  \n                  Crypt (shrK A) \\<lbrace>Nonce (Pairkey(A,B)), Agent B\\<rbrace>\\<rbrace>   \n           \\<in> set evs \"\napply (blast dest: Inputs_A_Card_9 Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Snd] Pairkey_certificate_authentic)\ndone\n(*the second conjunct of the thesis might be regarded as a form of integrity \n  in the sense of Neuman-Ts'o*)\n\nlemma Na_Nb_certificate_authentic_A_Card: \n      \"\\<lbrakk> Inputs A (Card A)   \n             \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce Pk, \n          Cert1, Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, Cert3\\<rbrace> \\<in> set evs; \n      A \\<noteq> Spy; \\<not>illegalUse(Card B); evs \\<in> srb \\<rbrakk> \n   \\<Longrightarrow> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key (sesK(Nb, pairK (A, B))),    \n                             Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>,  \n                             Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace>  \n           \\<in> set evs \"\napply (frule Inputs_A_Card_9)\napply assumption+\napply (blast dest: Inputs_A_Card_9 Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Snd, THEN Na_Nb_certificate_authentic])\ndone\n\nlemma Na_authentic_A_Card: \n     \"\\<lbrakk> Inputs A (Card A)   \n             \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce Pk, \n                Cert1, Cert2, Cert3\\<rbrace> \\<in> set evs; \n         A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>   \n     \\<Longrightarrow> Outpts (Card A) A \\<lbrace>Nonce Na, Cert3\\<rbrace>  \n           \\<in> set evs\"\napply (blast dest: Inputs_A_Card_9)\ndone\n\n(* These three theorems for Card A can be put together trivially.\nThey are separated to highlight the different requirements on agents\nand their cards.*)\n\n\nlemma Inputs_A_Card_9_authentic: \n  \"\\<lbrakk> Inputs A (Card A)   \n             \\<lbrace>Agent B, Nonce Na, Nonce Nb, Nonce Pk, \n               Crypt (shrK A) \\<lbrace>Nonce Pk, Agent B\\<rbrace>,  \n               Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>, Cert3\\<rbrace> \\<in> set evs; \n    A \\<noteq> Spy; Card A \\<notin> cloned; \\<not>illegalUse(Card B); evs \\<in> srb \\<rbrakk>   \n    \\<Longrightarrow>  Says Server A \\<lbrace>Nonce Pk, Crypt (shrK A) \\<lbrace>Nonce Pk, Agent B\\<rbrace>\\<rbrace>   \n           \\<in> set evs  \\<and> \n       Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A,  Key (sesK(Nb, pairK (A, B))),    \n                             Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>,  \n                             Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace>  \n           \\<in> set evs  \\<and> \n         Outpts (Card A) A \\<lbrace>Nonce Na, Cert3\\<rbrace>  \n           \\<in> set evs\"\napply (blast dest: Inputs_A_Card_9 Na_Nb_certificate_authentic Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Snd] Pairkey_certificate_authentic)\ndone\n\n\n(*MSG8\nNothing to prove because the message is a cleartext that comes from the \nnetwork*)\n\n(*Other messages: nothing to prove because the verifiers involved are new*)\n\n(*END further theorems about authenticity of verifiers*)\n\n\n\n(* BEGIN trivial guarantees on outputs for agents *)\n\n(*MSG4*)\nlemma SR_U4_imp: \n     \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Nonce Na, Crypt (crdK (Card A)) (Nonce Na)\\<rbrace> \n           \\<in> set evs;  \n         A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>                 \n     \\<Longrightarrow> \\<exists> Pk V. Gets A \\<lbrace>Pk, V\\<rbrace> \\<in> set evs\"\napply (blast dest: Outpts_A_Card_4 Inputs_A_Card_3)\ndone\n(*weak: could strengthen the model adding verifier for the Pairkey to msg3*)\n\n\n(*MSG7*)\nlemma SR_U7_imp: \n     \"\\<lbrakk> Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K,  \n                      Crypt (pairK(A,B)) \\<lbrace>Nonce Na, Nonce Nb\\<rbrace>,  \n                      Cert2\\<rbrace> \\<in> set evs;  \n         B \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> Gets B \\<lbrace>Agent A, Nonce Na\\<rbrace> \\<in> set evs\"\napply (blast dest: Outpts_B_Card_7 Inputs_B_Card_6)\ndone\n\n(*MSG10*)\nlemma SR_U10_imp: \n     \"\\<lbrakk> Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, \n                           Key K, Crypt (pairK(A,B)) (Nonce Nb)\\<rbrace>  \n         \\<in> set evs;  \n        A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> \\<exists> Cert1 Cert2.  \n                   Gets A \\<lbrace>Nonce (Pairkey (A, B)), Cert1\\<rbrace> \\<in> set evs \\<and>  \n                   Gets A \\<lbrace>Nonce Nb, Cert2\\<rbrace> \\<in> set evs\"\napply (blast dest: Outpts_A_Card_10 Inputs_A_Card_9)\ndone\n\n\n(*END trivial guarantees on outputs for agents*)\n\n\n\n(*INTEGRITY*)\nlemma Outpts_Server_not_evs: \n      \"evs \\<in> srb \\<Longrightarrow> Outpts (Card Server) P X \\<notin> set evs\"\napply (erule srb.induct)\napply auto\ndone\n\ntext{*@{term step2_integrity} also is a reliability theorem*}\nlemma Says_Server_message_form: \n     \"\\<lbrakk> Says Server A \\<lbrace>Pk, Certificate\\<rbrace> \\<in> set evs;  \n         evs \\<in> srb \\<rbrakk>                   \n     \\<Longrightarrow> \\<exists> B. Pk = Nonce (Pairkey(A,B)) \\<and>  \n         Certificate = Crypt (shrK A) \\<lbrace>Nonce (Pairkey(A,B)), Agent B\\<rbrace>\"\napply (erule rev_mp)\napply (erule srb.induct)\napply auto\napply (blast dest!: Outpts_Server_not_evs)+\ndone\n(*cannot be made useful to A in form of a Gets event*)\n\ntext{*\n  step4integrity is @{term Outpts_A_Card_form_4}\n\n  step7integrity is @{term Outpts_B_Card_form_7}\n*}\n\nlemma step8_integrity: \n     \"\\<lbrakk> Says B A \\<lbrace>Nonce Nb, Certificate\\<rbrace> \\<in> set evs;  \n         B \\<noteq> Server; B \\<noteq> Spy; evs \\<in> srb \\<rbrakk>                   \n     \\<Longrightarrow> \\<exists> Cert2 K.   \n    Outpts (Card B) B \\<lbrace>Nonce Nb, Agent A, Key K, Certificate, Cert2\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule srb.induct)\nprefer 18 apply (fastforce dest: Outpts_A_Card_form_10)\napply auto\ndone\n\n\ntext{*  step9integrity is @{term Inputs_A_Card_form_9}\n        step10integrity is @{term Outpts_A_Card_form_10}.\n*}\n\n\nlemma step11_integrity: \n     \"\\<lbrakk> Says A B (Certificate) \\<in> set evs; \n         \\<forall> p q. Certificate \\<noteq> \\<lbrace>p, q\\<rbrace>;  \n         A \\<noteq> Spy; evs \\<in> srb \\<rbrakk>  \n     \\<Longrightarrow> \\<exists> K Nb.  \n      Outpts (Card A) A \\<lbrace>Agent B, Nonce Nb, Key K, Certificate\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule srb.induct)\napply auto\ndone\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/Smartcard/ShoupRubinBella.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850278370112, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.32537874042027215}}
{"text": "theory BiStateTransformers\n  imports \"../Algebra/PartialQuantales\" \"../Algebra/BBI\"\nbegin\n\nno_notation plus (infixl \"+\" 65)\nno_notation pmult (infixl \"*\" 80)\nno_notation pmult_one (\"1\")\nnotation pmult (infixl \"\\<oplus>\" 80)\nnotation times (infixl \"*\" 70)\nnotation sup (infixl \"+\" 65)\nnotation inf (infixl \"\\<sqinter>\" 70)\nnotation one_class.one (\"1\")\n\ntext {*\n  We extend the state transformers to two dimensions (to accommodate store and heap)\n*}\n\ndeclare [[coercion_enabled]]\ntypedef ('a, 'b, 'c) bifun = \"{f :: ('a \\<times> 'b \\<Rightarrow> 'c). True}\" by auto\ndeclare [[coercion Rep_bifun]]\nsetup_lifting type_definition_bifun\n\ninstantiation bifun :: (type, type, complete_lattice) bounded_lattice\nbegin\nlift_definition bot_bifun :: \"('a, 'b, 'c) bifun\" is bot ..\nlift_definition sup_bifun :: \"('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun\" is sup ..\nlift_definition top_bifun :: \"('a, 'b, 'c) bifun\" is top ..\nlift_definition inf_bifun :: \"('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun\" is inf ..\nlift_definition less_eq_bifun :: \"('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun \\<Rightarrow> bool\" is less_eq .\nlift_definition less_bifun :: \"('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun \\<Rightarrow> bool\" is less .\ninstance \n  by default (transfer, auto)+\nend\n\ninstantiation bifun :: (type, type, complete_lattice) complete_lattice\nbegin\nlift_definition Inf_bifun :: \"('a, 'b, 'c) bifun set \\<Rightarrow> ('a, 'b, 'c) bifun\" is Inf ..\nlift_definition Sup_bifun :: \"('a, 'b, 'c) bifun set \\<Rightarrow> ('a, 'b, 'c) bifun\" is Sup ..\ninstance \n  by default (transfer, auto intro: Sup_least Sup_upper Inf_greatest Inf_lower)+\nend\n\ninstance bifun :: (type, type, complete_distrib_lattice) complete_distrib_lattice\napply default\napply (unfold INF_def)\napply transfer\napply auto\napply (metis sup_Inf)\napply (unfold SUP_def)\napply transfer\napply auto\nby (metis inf_Sup)\n\n\ninstantiation bifun :: (type, partial_semigroup, quantale) quantale\nbegin\n\nlift_definition times_bifun :: \"('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun\"\n  is \"\\<lambda>f g (x, y). \\<Squnion> {f (x, y1) * g (x, y2) | y1 y2. y = y1 \\<oplus> y2 \\<and> y1 ## y2}\" ..\n\nlemma ext_bifun [intro]: \"(\\<And>x y. Rep_bifun f (x, y) = Rep_bifun g (x, y)) \\<Longrightarrow> (f :: ('a, 'b, 'c) bifun) = g\"\n  apply transfer\n  by auto\n\nlemma le_bifunI [intro]: \"(\\<And>x y. Rep_bifun f (x, y) \\<le> Rep_bifun g (x, y)) \\<Longrightarrow> f \\<le> g\"\n  apply transfer\n  by (metis PairE le_funI)\n\nlemma qmult_bifun_apply [simp, code]:\n  \"((f :: ('a, 'b, 'c) bifun) * g) (x, y) = \\<Squnion> {f (x, y1) * g (x, y2) | y1 y2. y = y1 \\<oplus> y2 \\<and> y1 ## y2}\"\n  by transfer auto\n\nlemma sup_distrib_left_bifun: \"((f :: ('a, 'b, 'c) bifun) * (g + h)) (x, y) = (f * g + f * h) (x, y)\"\n  apply transfer\n  apply auto\n  apply (subst Sup.qdistl)\n  by simp\n\nlemma sup_distrib_right_bifun: \"(((f :: ('a, 'b, 'c) bifun) + g) * h) x = (f * h + g * h) x\"\n  apply transfer\n  apply auto\n  apply (subst Sup.qdistr)\n  by simp\n\nlemma qSup_distl_bifun: \"((f :: ('a, 'b, 'c) bifun) * \\<Squnion>G) x = (\\<Squnion>(op * f ` G)) x\"\n  apply transfer\n  apply (auto simp add: qSUP_distl intro!: antisym Sup_least SUP_mono)\n  apply (rule_tac x=xa in bexI)\n  apply (rule Sup_upper)\n  apply auto\n  apply (rule SUP_least)\n  apply (rule Sup_mono)\n  apply auto\n  by (metis (mono_tags) SUP_upper)\n\nlemma qSup_distr_bifun: \"(\\<Squnion>G * (f :: ('a, 'b, 'c) bifun)) x = (\\<Squnion>((\\<lambda>g. g * f) ` G)) x\"\n  apply transfer\n  apply (auto simp add: qSUP_distr intro!: antisym Sup_least SUP_mono)\n  apply (rule_tac x=xa in bexI)\n  apply (rule Sup_upper)\n  apply auto\n  apply (rule SUP_least)\n  apply (rule Sup_mono)\n  apply auto\n  by (metis (mono_tags) SUP_upper)\n\nlemma Sup_distl_assoc_bifun: \"(f :: ('a, 'b, 'c) bifun) (x, y1) * \\<Squnion>{g (x, y2) * h (x, y3) |y2 y3. y = y2 \\<oplus> y3 \\<and> y2 ## y3} = \\<Squnion>{f (x, y1) * (g (x, y2) * h (x, y3)) |y2 y3. y = y2 \\<oplus> y3 \\<and> y2 ## y3}\"\n  by (auto simp only: Sup.Join_distl intro: Sup.Join_eqI2)\n\nlemma qSup_distr_assoc_bifun: \"\\<Squnion>{((f :: ('a, 'b, 'c) bifun) (x, y1) * g (x, y2)) | y1 y2. y = (y1 \\<oplus> y2) \\<and> y1 ## y2} * h (x, y3) = \\<Squnion>{(f (x, y1) * g (x, y2)) * h (x, y3) | y1 y2. y = (y1 \\<oplus> y2) \\<and> y1 ## y2}\"\n  by (auto simp only: qSup_distr intro: Sup.Join_eqI2)\n\nlemma qmult_assoc_bifun: \"((f :: ('a, 'b, 'c) bifun) * (g * h)) (x, y) = ((f * g) * h) (x, y)\"\nproof simp\n  have \"\\<Squnion>{f (x, y1) * \\<Squnion>{g (x, y1) * h (x, y2a) |y1 y2a. y2 = y1 \\<oplus> y2a \\<and> y1 ## y2a} |y1 y2. y = y1 \\<oplus> y2 \\<and> y1 ## y2} =\n    \\<Squnion>{\\<Squnion>{f (x, y1) * (g (x, y1a) * h (x, y2a)) |y1a y2a. y2 = y1a \\<oplus> y2a \\<and> y1a ## y2a} |y1 y2. y = y1 \\<oplus> y2 \\<and> y1 ## y2}\"\n    by (unfold Sup_distl_assoc_bifun) simp\n  also have \"... = \\<Squnion>{\\<Squnion>{(f (x, y1) * g (x, y1a)) * h (x, y2a) |y1a y2a. y2 = y1a \\<oplus> y2a \\<and> y1a ## y2a} |y1 y2. y = y1 \\<oplus> y2 \\<and> y1 ## y2}\"\n    by (subst mult.assoc) simp\n  also have \"... = \\<Squnion>{(f (x, y1) * g (x, y1a)) * h (x, y2a) |y1a y2a y1 y2. y2 = y1a \\<oplus> y2a \\<and> y1a ## y2a \\<and> y = y1 \\<oplus> y2 \\<and> y1 ## y2}\"\n    apply (rule antisym)\n    apply (rule Sup_least)\n    apply safe\n    apply (rule Sup_mono)\n    apply auto\n    apply (rule Sup_least)\n    apply auto\n    apply transfer\n    apply auto\n    proof -\n      fix y1a :: 'b and y2a :: 'b and y1 :: 'b and fa :: \"'a \\<times> 'b \\<Rightarrow> 'c\" and xa :: 'a and ga :: \"'a \\<times> 'b \\<Rightarrow> 'c\" and ha :: \"'a \\<times> 'b \\<Rightarrow> 'c\"\n      assume a1: \"y1a ## y2a\"\n      assume a2: \"y1 ## y1a \\<oplus> y2a\"\n      obtain sk\\<^sub>8\\<^sub>2 :: \"'b \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'b\" and sk\\<^sub>8\\<^sub>1 :: \"'b \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'b\" where \"\\<exists>y1aa y2aa. fa (xa, y1) * ga (xa, y1a) * ha (xa, y2a) = fa (xa, y1) * ga (xa, y1aa) * ha (xa, y2aa) \\<and> y1a \\<oplus> y2a = y1aa \\<oplus> y2aa \\<and> y1aa ## y2aa\" using a1 by blast\n      hence \"fa (xa, y1) * ga (xa, y1a) * ha (xa, y2a) \\<le> \\<Squnion>{fa (xa, y1) * ga (xa, y1aa) * ha (xa, y2aa) |y1aa y2aa. y1a \\<oplus> y2a = y1aa \\<oplus> y2aa \\<and> y1aa ## y2aa}\" by (simp add: Sup.Join_Collect_upper)\n      then obtain sk\\<^sub>7 :: \"'c \\<Rightarrow> 'b\" and sk\\<^sub>6 :: \"'c \\<Rightarrow> 'b\" where \"\\<exists>x\\<^sub>0\\<ge>fa (xa, y1) * ga (xa, y1a) * ha (xa, y2a). x\\<^sub>0 \\<in> {\\<Squnion>{fa (xa, y1b) * ga (xa, y1a) * ha (xa, y2a) |y1a y2a. y2 = y1a \\<oplus> y2a \\<and> y1a ## y2a} | y1b y2. y1 \\<oplus> (y1a \\<oplus> y2a) = y1b \\<oplus> y2 \\<and> y1b ## y2}\" using a2 by blast\n      thus \"fa (xa, y1) * ga (xa, y1a) * ha (xa, y2a) \\<le> \\<Squnion>{\\<Squnion>{fa (xa, y1b) * ga (xa, y1a) * ha (xa, y2a) |y1a y2a. y2 = y1a \\<oplus> y2a \\<and> y1a ## y2a} | y1b y2. y1 \\<oplus> (y1a \\<oplus> y2a) = y1b \\<oplus> y2 \\<and> y1b ## y2}\" by (smt Sup_upper2) (* > 2 s, timed out *)\n    qed\n  also have \"... = \\<Squnion>{(f (x, y1) * g (x, y1a)) * h (x, y2a) |y1a y2a y1. y1a ## y2a \\<and> y = y1 \\<oplus> (y1a \\<oplus> y2a) \\<and> y1 ## (y1a \\<oplus> y2a)}\"\n    by (auto intro: Sup.Join_eqI2)\n  also have \"... = \\<Squnion>{(f (x, y1) * g (x, y1a)) * h (x, y2a) |y1a y2a y1. y1 ## y1a \\<and> y = (y1 \\<oplus> y1a) \\<oplus> y2a \\<and> (y1 \\<oplus> y1a) ## y2a}\"\n    by (metis (erased, lifting) partial_semigroup_class.pmult_assoc partial_semigroup_class.pmult_def)\n  also have \"... = \\<Squnion>{(f (x, y1) * g (x, y1a)) * h (x, y2) |y1a y2a y1 y2. y1 ## y1a \\<and> y2a = y1 \\<oplus> y1a \\<and> y = y2a \\<oplus> y2 \\<and> y2a ## y2}\"\n    by (auto intro: Sup.Join_eqI2)\n  also have \"... = \\<Squnion>{\\<Squnion>{f (x, y1) * g (x, y1a) |y1 y1a. y2a = y1 \\<oplus> y1a \\<and> y1 ## y1a} * h (x, y2) |y2a y2. y = y2a \\<oplus> y2 \\<and> y2a ## y2}\"\n    apply (rule antisym)\n    apply (rule Sup_least)\n    apply auto\n    defer\n    apply (rule Sup_least)\n    apply auto\n    apply (subst qSup_distr_assoc_bifun)\n    apply (rule Sup_mono)\n    apply auto\n    apply (subgoal_tac \"\\<exists>y2a y2b. y1 \\<oplus> y1a \\<oplus> y2 = y2a \\<oplus> y2b \\<and> y2a ## y2b \\<and> f (x, y1) * g (x, y1a) * h (x, y2) \\<le> \\<Squnion>{f (x, y1) * g (x, y1a) |y1 y1a. y2a = y1 \\<oplus> y1a \\<and> y1 ## y1a} * h (x, y2b) \")\n    apply (smt Sup_upper2 mem_Collect_eq)\n    apply (subst qSup_distr_assoc_bifun)\n    by (smt Sup_le_iff dual_order.refl mem_Collect_eq)\n  finally show \"\\<Squnion>{f (x, y1) * \\<Squnion>{g (x, y1) * h (x, y2a) |y1 y2a. y2 = y1 \\<oplus> y2a \\<and> y1 ## y2a} |y1 y2. y = y1 \\<oplus> y2 \\<and> y1 ## y2} =\n                 \\<Squnion>{\\<Squnion>{f (x, y1a) * g (x, y2) |y1a y2. y1 = y1a \\<oplus> y2 \\<and> y1a ## y2} * h (x, y2) |y1 y2. y = y1 \\<oplus> y2 \\<and> y1 ## y2}\"\n   by auto\nqed\n\ninstance\n  apply default\n  apply (rule ext_bifun,rule qmult_assoc_bifun[symmetric])\n  apply (rule ext_bifun, rule qSup_distr_bifun)\n  by (metis (lifting, mono_tags) qSup_distl_bifun eq_iff le_bifunI)+\n\nend\n\ntext {* Unit is also lifted *}\n\ninstantiation bifun :: (type, partial_monoid, quantale_unital) quantale_unital\nbegin\n\nlift_definition one_bifun :: \"('a, 'b, 'c) bifun\" is \"\\<lambda>(x, y). if y = 1' then 1 else \\<bottom>\" ..\n\nlemma qunitl_bifun[simp]: \"Rep_bifun (1 * f) (x, y) = Rep_bifun f (x, y)\"\n  apply transfer\n  by (auto simp: pmult_onel one_bifun_def intro!: Sup_eqI)\n\nlemma qunitr_bifun[simp]: \"Rep_bifun (f * 1) (x, y) = Rep_bifun f (x, y)\"\n  apply transfer\n  by (auto simp: pmult_oner one_bifun_def intro!: Sup_eqI)\n\ninstance\n  by default (auto intro: qunitr_bifun qunitl_bifun)\n\nend\n\ntext {* Commutativity is also lifted *}\n\ninstance bifun :: (type, partial_ab_semigroup, comm_quantale) comm_quantale\napply default\napply (rule ext_bifun)\napply transfer\nby (auto simp: mult.commute intro: pmult_comm pmult_comm_def Sup.Join_eqI2)\n\ninstance bifun :: (type, partial_comm_monoid, comm_quantale_unital) comm_quantale_unital \n  by default auto\n\ntext {* Distributivity is also lifted *}\n\ninstance bifun :: (type, partial_semigroup, distrib_quantale) distrib_quantale ..\n\ninstance bifun :: (type, partial_comm_monoid, distrib_comm_quantale_unital) distrib_comm_quantale_unital ..\n\ninstantiation bifun :: (type, partial_comm_monoid, bbi) bbi\nbegin\n\nlift_definition minus_bifun :: \"('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun\"\n  is \"\\<lambda>f g (x, y). f (x, y) - g (x, y)\" ..\nlift_definition uminus_bifun :: \"('a, 'b, 'c) bifun \\<Rightarrow> ('a, 'b, 'c) bifun\" is \"\\<lambda>f (x, y). - f(x, y)\" ..\n\ninstance\n  apply default\n  apply transfer\n  apply (rule ext)\n  apply auto\n  apply (metis inf_compl_bot)\n  apply transfer\n  apply (rule ext)\n  apply auto\n  apply (metis sup_compl_top)\n  apply transfer\n  apply (rule ext)\n  apply auto\n  by (metis diff_eq)\nend\n\nend\n", "meta": {"author": "victorgomes", "repo": "veritas", "sha": "d0b50770f9146f18713a690b87dc8fafa6a87580", "save_path": "github-repos/isabelle/victorgomes-veritas", "path": "github-repos/isabelle/victorgomes-veritas/veritas-d0b50770f9146f18713a690b87dc8fafa6a87580/Transformers/BiStateTransformers.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850278370112, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.32537874042027215}}
{"text": "section {*FUNCTION\\_\\_PARSER\\_TC\\_\\_PARSER\\_TYPE\\_CONVERSION*}\ntheory\n  FUNCTION__PARSER_TC__PARSER_TYPE_CONVERSION\n\nimports\n  PRJ_12_03_02__ENTRY\n\nbegin\n\ntheorem F_PARSER_TC__preserves_parser_no_top_rules: \"\n  valid_parser G\n  \\<Longrightarrow> parser_no_top_rules G\n  \\<Longrightarrow> parser_no_top_rules (F_PARSER_TC G)\"\n  apply(simp add: parser_no_top_rules_def F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TC__rule_def)\n  done\n\ntheorem F_PARSER_TC__preserves_parser_not_observes_input_terminator: \"\n  valid_parser G\n  \\<Longrightarrow> parser_not_observes_input_terminator G\n  \\<Longrightarrow> parser_not_observes_input_terminator (F_PARSER_TC G)\"\n  apply(simp add: parser_not_observes_input_terminator_def F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TC__rule_def)\n  done\n\ndefinition F_PARSER_TC__ruleRev :: \"\n  ('stackB DT_symbol \\<Rightarrow> 'stackA)\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parser_step_label\n  \\<Rightarrow> ('stackA, 'event) parser_step_label\"\n  where\n    \"F_PARSER_TC__ruleRev fq e \\<equiv>\n  \\<lparr>rule_lpop = map fq (rule_lpop e),\n  rule_rpop = rule_rpop e,\n  rule_lpush = map fq (rule_lpush e),\n  rule_rpush = rule_rpush e\\<rparr>\"\n\ndefinition F_PARSER_TCRRev :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parser_step_label\n  \\<Rightarrow> ('stackA, 'event) parser_step_label\"\n  where\n    \"F_PARSER_TCRRev G e \\<equiv>\n  F_PARSER_TC__ruleRev\n    (inv_into (parser_nonterms G) (SOME f. inj_on f (parser_nonterms G)))\n    e\"\n\nlemma rule_reversal: \"\n  valid_parser G\n  \\<Longrightarrow> x \\<in> parser_rules G\n  \\<Longrightarrow> F_PARSER_TC__ruleRev (inv_into (parser_nonterms G) (SOME f. inj_on f (parser_nonterms G))) (F_PARSER_TC__rule (SOME f. inj_on f (parser_nonterms G)) x) = x\"\n  apply(simp add: F_PARSER_TC__ruleRev_def)\n  apply(rule_tac\n      t=\"\\<lparr>rule_lpop = map (inv_into (parser_nonterms G) (SOME f. inj_on f (parser_nonterms G))) (rule_lpop (F_PARSER_TC__rule (SOME f. inj_on f (parser_nonterms G)) x)), rule_rpop = rule_rpop (F_PARSER_TC__rule (SOME f. inj_on f (parser_nonterms G)) x), rule_lpush = map (inv_into (parser_nonterms G) (SOME f. inj_on f (parser_nonterms G))) (rule_lpush (F_PARSER_TC__rule (SOME f. inj_on f (parser_nonterms G)) x)), rule_rpush = rule_rpush (F_PARSER_TC__rule (SOME f. inj_on f (parser_nonterms G)) x)\\<rparr>\"\n      and s=\"x\"\n      in ssubst)\n   prefer 2\n   apply(force)\n  apply(subgoal_tac \"valid_parser_step_label G x\")\n   prefer 2\n   apply(simp add: valid_parser_def)\n  apply(simp add: valid_parser_step_label_def)\n  apply(case_tac x)\n  apply(rename_tac rule_lpopa rule_rpopa rule_lpusha rule_rpusha)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac rule_lpopa rule_lpusha rule_rpusha k w xb)(*strict*)\n  apply(simp add: F_PARSER_TC__rule_def)\n  apply(rename_tac rule_lpop rule_lpush rule_rpush k w xb)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac rule_lpop rule_lpush rule_rpush k w xb)(*strict*)\n   apply(rule inv_into_f_eq_map2)\n    apply(rename_tac rule_lpop rule_lpush rule_rpush k w xb)(*strict*)\n    apply (metis valid_parser_def SOME_injective_is_injective)\n   apply(rename_tac rule_lpop rule_lpush rule_rpush k w xb)(*strict*)\n   apply(force)\n  apply(rename_tac rule_lpop rule_lpush rule_rpush k w xb)(*strict*)\n  apply(rule inv_into_f_eq_map2)\n   apply(rename_tac rule_lpop rule_lpush rule_rpush k w xb)(*strict*)\n   apply (metis valid_parser_def SOME_injective_is_injective)\n  apply(rename_tac rule_lpop rule_lpush rule_rpush k w xb)(*strict*)\n  apply(force)\n  done\n\nlemma F_PARSER_TCRRev_preserves_edges: \"\n  valid_parser G\n  \\<Longrightarrow> e \\<in> parser_rules (F_PARSER_TC G)\n  \\<Longrightarrow> F_PARSER_TCRRev G e \\<in> parser_rules G\"\n  apply(simp add: F_PARSER_TCRRev_def)\n  apply(simp add: F_PARSER_TC_def F_PARSER_TC__parser_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(rule_tac\n      t=\"F_PARSER_TC__ruleRev (inv_into (parser_nonterms G) (SOME f. inj_on f (parser_nonterms G))) (F_PARSER_TC__rule (SOME f. inj_on f (parser_nonterms G)) x)\"\n      and s=\"x\"\n      in ssubst)\n   apply(rename_tac x)(*strict*)\n   apply(rule rule_reversal)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(force)\n  done\n\ndefinition F_PARSER_TC__parserC :: \"\n  ('stackA \\<Rightarrow> 'stackB DT_symbol)\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\"\n  where\n    \"F_PARSER_TC__parserC fq c \\<equiv>\n  \\<lparr>parserHFS_conf_fixed = parserHFS_conf_fixed c,\n  parserHFS_conf_history = parserHFS_conf_history c,\n  parserHFS_conf_stack = map fq (parserHFS_conf_stack c),\n  parserHFS_conf_scheduler = parserHFS_conf_scheduler c\\<rparr>\"\n\ndefinition F_PARSER_TCC :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\"\n  where\n    \"F_PARSER_TCC G c \\<equiv>\n  F_PARSER_TC__parserC (SOME f. inj_on f (parser_nonterms G)) c\"\n\ndefinition F_PARSER_TC__parserCRev :: \"\n  ('stackB DT_symbol \\<Rightarrow> 'stackA)\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\"\n  where\n    \"F_PARSER_TC__parserCRev fq c \\<equiv>\n  \\<lparr>parserHFS_conf_fixed = parserHFS_conf_fixed c,\n  parserHFS_conf_history = parserHFS_conf_history c,\n  parserHFS_conf_stack = map fq (parserHFS_conf_stack c),\n  parserHFS_conf_scheduler = parserHFS_conf_scheduler c\\<rparr>\"\n\ndefinition F_PARSER_TCCRev :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\"\n  where\n    \"F_PARSER_TCCRev G c \\<equiv>\n  F_PARSER_TC__parserCRev\n    (inv_into (parser_nonterms G) (SOME f. inj_on f (parser_nonterms G)))\n    c\"\n\nlemma PARSERToSymbolE_preserves_valid_parser_step_label: \"\n  valid_parser G\n  \\<Longrightarrow> e \\<in> parser_rules G\n  \\<Longrightarrow> valid_parser_step_label G e\n  \\<Longrightarrow> G' = F_PARSER_TC__parser G fq\n  \\<Longrightarrow> inj_on fq (parser_nonterms G)\n  \\<Longrightarrow> e' = F_PARSER_TC__rule fq e\n  \\<Longrightarrow> valid_parser_step_label G' e'\"\n  apply(simp add: F_PARSER_TC__parser_def Let_def)\n  apply(subgoal_tac \"\\<exists>f. inj_on f (parser_nonterms G) \\<and> f = (SOME f::'a\\<Rightarrow>'d DT_symbol. inj_on f (parser_nonterms G))\")\n   prefer 2\n   apply(rule exists_SOME_injective_is_injective)\n   apply(simp add: valid_parser_def)\n  apply(erule exE)+\n  apply(rename_tac f)(*strict*)\n  apply(rule_tac\n      t=\"(SOME f::'a \\<Rightarrow> 'd DT_symbol. inj_on f (parser_nonterms G))\"\n      and s=\"f\"\n      in ssubst)\n   apply(rename_tac f)(*strict*)\n   apply(force)\n  apply(rename_tac f)(*strict*)\n  apply(erule conjE)\n  apply(thin_tac \"f = (SOME f. inj_on f (parser_nonterms G))\")\n  apply(simp add: valid_parser_def valid_parser_step_label_def F_PARSER_TC__rule_def)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"e\"\n      in ballE)\n   apply(rename_tac f)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac f)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f k w xa)(*strict*)\n  apply(force)\n  done\n\nlemma F_PARSER_TC__parser_preserves_PDA: \"\n  valid_parser G\n  \\<Longrightarrow> inj_on fq (parser_nonterms G)\n  \\<Longrightarrow> valid_parser (F_PARSER_TC__parser G fq)\"\n  apply(simp add: valid_parser_def F_PARSER_TC__parser_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(rule_tac\n      G=\"G\"\n      in PARSERToSymbolE_preserves_valid_parser_step_label)\n       apply(rename_tac x)(*strict*)\n       apply(simp add: valid_parser_def)\n      apply(rename_tac x)(*strict*)\n      apply(force)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(simp add: F_PARSER_TC__parser_def)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(force)\n  done\n\ntheorem F_PARSER_TC__preserves_PARSER: \"\n  valid_parser G\n  \\<Longrightarrow> valid_parser (F_PARSER_TC G)\"\n  apply(simp add: F_PARSER_TC_def)\n  apply(rule F_PARSER_TC__parser_preserves_PDA)\n   apply(force)\n  apply(rule SOME_injective_is_injective)\n  apply(simp add: valid_parser_def valid_parser_def)\n  done\n\ntheorem F_PARSER_TC__preserves_PARSERk: \"\n  valid_bounded_parser G k\n  \\<Longrightarrow> valid_bounded_parser (F_PARSER_TC G) k\"\n  apply(simp add: valid_bounded_parser_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rule F_PARSER_TC__preserves_PARSER)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac e)(*strict*)\n  apply(simp add: F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TC__rule_def)\n  apply(clarsimp)\n  apply(simp add: F_PARSER_TC__rule_def)\n  done\n\nlemma F_PARSER_TC__parserC_preserves_configurations: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHFS_configurations G\n  \\<Longrightarrow> inj_on fq (parser_nonterms G)\n  \\<Longrightarrow> F_PARSER_TC__parserC fq c \\<in> parserHFS_configurations (F_PARSER_TC__parser G fq)\"\n  apply(simp add: parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac f h l w)(*strict*)\n  apply(simp add: F_PARSER_TC__parserC_def)\n  apply(rule conjI)\n   apply(rename_tac f h l w)(*strict*)\n   apply(simp add: F_PARSER_TC__parser_def Let_def)\n   apply(force)\n  apply(rename_tac f h l w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac f h l w)(*strict*)\n   apply(simp add: F_PARSER_TC__parser_def Let_def)\n  apply(rename_tac f h l w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac f h l w)(*strict*)\n   apply(simp add: F_PARSER_TC__parser_def Let_def)\n  apply(rename_tac f h l w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac f h l w)(*strict*)\n   apply(simp add: F_PARSER_TC__parser_def Let_def)\n  apply(rename_tac f h l w)(*strict*)\n  apply(simp add: F_PARSER_TC__parser_def Let_def)\n  done\n\nlemma F_PARSER_TC__parserC_preserves_initial_configurations: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHFS_initial_configurations G\n  \\<Longrightarrow> inj_on fq (parser_nonterms G)\n  \\<Longrightarrow> F_PARSER_TC__parserC fq c \\<in> parserHFS_initial_configurations (F_PARSER_TC__parser G fq)\"\n  apply(simp add: parserHFS_initial_configurations_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(simp add: F_PARSER_TC__parserC_def)\n  apply(rule conjI)\n   apply(simp add: F_PARSER_TC__parserC_def)\n  apply(rule conjI)\n   apply(simp add: F_PARSER_TC__parserC_def)\n   apply(simp add: F_PARSER_TC__parser_def Let_def)\n  apply(rule F_PARSER_TC__parserC_preserves_configurations)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_PARSER_TC__parserC_preserves_marking_configurations: \"\n  valid_parser G\n  \\<Longrightarrow> c \\<in> parserHFS_marking_configurations G\n  \\<Longrightarrow> inj_on fq (parser_nonterms G)\n  \\<Longrightarrow> F_PARSER_TC__parserC fq c \\<in> parserHFS_marking_configurations (F_PARSER_TC__parser G fq)\"\n  apply(simp add: parserHFS_marking_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac f w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac f w)(*strict*)\n   apply(simp add: F_PARSER_TC__parserC_def)\n   apply(simp add: F_PARSER_TC__parser_def Let_def)\n  apply(rename_tac f w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac f w)(*strict*)\n   apply(simp add: F_PARSER_TC__parserC_def)\n   apply(simp add: F_PARSER_TC__parser_def Let_def)\n  apply(rename_tac f w)(*strict*)\n  apply(rule F_PARSER_TC__parserC_preserves_configurations)\n    apply(rename_tac f w)(*strict*)\n    apply(force)\n   apply(rename_tac f w)(*strict*)\n   apply(force)\n  apply(rename_tac f w)(*strict*)\n  apply(force)\n  done\n\ndefinition F_PARSER_TC__relation_TSstructureLR :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_TSstructureLR G1 G2 \\<equiv>\n  valid_parser G1\n  \\<and> G2 = F_PARSER_TC G1\"\n\ndefinition F_PARSER_TC__relation_configurationLR :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_configurationLR G1 G2 c1 c2 \\<equiv>\n  F_PARSER_TC__relation_TSstructureLR G1 G2\n  \\<and> c1 \\<in> parserHFS_configurations G1\n  \\<and> c2 = F_PARSER_TCC G1 c1\"\n\ndefinition F_PARSER_TC__relation_initial_configurationLR :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_initial_configurationLR G1 G2 c1 c2 \\<equiv>\n  F_PARSER_TC__relation_TSstructureLR G1 G2\n  \\<and> c1 \\<in> parserHFS_initial_configurations G1\n  \\<and> c2 = F_PARSER_TCC G1 c1\"\n\ndefinition F_PARSER_TC__relation_effectLR :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_effectLR G1 G2 w1 w2 \\<equiv>\n  F_PARSER_TC__relation_TSstructureLR G1 G2\n  \\<and> w1 = w2\"\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n  (\\<forall>G1. Ex (F_PARSER_TC__relation_TSstructureLR G1) \\<longrightarrow> valid_parser G1)\"\n  apply(clarsimp)\n  apply(rename_tac G1 x)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> valid_parser G2)\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n  apply(rule F_PARSER_TC__preserves_PARSER)\n  apply(force)\n  done\n\ndefinition F_PARSER_TCR :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackA, 'event) parser_step_label\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parser_step_label\"\n  where\n    \"F_PARSER_TCR G e \\<equiv>\n  F_PARSER_TC__rule\n    (SOME f. inj_on f (parser_nonterms G))\n    e\"\n\ndefinition F_PARSER_TC__relation_step_simulation :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackA, 'event) parser_step_label\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> (('stackB DT_symbol, 'event) parser_step_label, ('stackB DT_symbol, 'event) parserHFS_conf) derivation\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_step_simulation G1 G2 c1 e c1' c2 d \\<equiv>\n  d = der2 (F_PARSER_TCC G1 c1) (F_PARSER_TCR G1 e) (F_PARSER_TCC G1 c1')\"\n\ndefinition F_PARSER_TC__relation_initial_simulation :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> (('stackB DT_symbol, 'event) parser_step_label, ('stackB DT_symbol, 'event) parserHFS_conf) derivation\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_initial_simulation G1 G2 c1 d \\<equiv>\n  d = der1 (F_PARSER_TCC G1 c1)\"\n\nlemma F_PARSER_TC__C_preserves_configurations: \"\n  F_PARSER_TC__relation_TSstructureLR G1 G2\n  \\<Longrightarrow> c1 \\<in> parserHFS_configurations G1\n  \\<Longrightarrow> F_PARSER_TCC G1 c1 \\<in> parserHFS_configurations G2\"\n  apply(simp add: F_PARSER_TCC_def F_PARSER_TC__relation_TSstructureLR_def)\n  apply(clarsimp)\n  apply(simp add: F_PARSER_TC_def)\n  apply(rule F_PARSER_TC__parserC_preserves_configurations)\n    apply(force)\n   apply(force)\n  apply(rule SOME_injective_is_injective)\n  apply(simp add: valid_parser_def)\n  done\n\nlemma F_PARSER_TC__C_preserves_initial_configurations: \"\n  F_PARSER_TC__relation_TSstructureLR G1 G2\n  \\<Longrightarrow> c1 \\<in> parserHFS_initial_configurations G1\n  \\<Longrightarrow> F_PARSER_TCC G1 c1 \\<in> parserHFS_initial_configurations G2\"\n  apply(simp add: F_PARSER_TCC_def F_PARSER_TC__relation_TSstructureLR_def)\n  apply(clarsimp)\n  apply(simp add: F_PARSER_TC_def)\n  apply(rule F_PARSER_TC__parserC_preserves_initial_configurations)\n    apply(force)\n   apply(force)\n  apply(rule SOME_injective_is_injective)\n  apply(simp add: valid_parser_def valid_parser_def)\n  done\n\nlemma F_PARSER_TC__C_preserves_marking_configurations: \"\n  F_PARSER_TC__relation_TSstructureLR G1 G2\n  \\<Longrightarrow> c1 \\<in> parserHFS_marking_configurations G1\n  \\<Longrightarrow> F_PARSER_TCC G1 c1 \\<in> parserHFS_marking_configurations G2\"\n  apply(simp add: F_PARSER_TCC_def F_PARSER_TC__relation_TSstructureLR_def)\n  apply(clarsimp)\n  apply(simp add: F_PARSER_TC_def)\n  apply(rule F_PARSER_TC__parserC_preserves_marking_configurations)\n    apply(force)\n   apply(force)\n  apply(rule SOME_injective_is_injective)\n  apply(simp add: valid_parser_def valid_parser_def)\n  done\n\nlemma F_PARSER_TC__initial_simulation_preserves_derivation: \"\n  F_PARSER_TC__relation_TSstructureLR G1 G2\n  \\<Longrightarrow> c1 \\<in> parserHFS_initial_configurations G1\n  \\<Longrightarrow> parserHFS.derivation_initial G2 (der1 (F_PARSER_TCC G1 c1))\"\n  apply(rule parserHFS.derivation_initialI)\n   apply(rule parserHFS.der1_is_derivation)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: get_configuration_def der1_def)\n  apply(clarsimp)\n  apply(rule F_PARSER_TC__C_preserves_initial_configurations)\n   apply(force)\n  apply(force)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_initial_simulation: \"\n  \\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> parserHFS_initial_configurations G1 \\<longrightarrow> (\\<exists>d2. parserHFS.derivation_initial G2 d2 \\<and> F_PARSER_TC__relation_initial_configurationLR G1 G2 c1 (the (get_configuration (d2 0))) \\<and> F_PARSER_TC__relation_initial_simulation G1 G2 c1 d2 \\<and> (\\<exists>n. maximum_of_domain d2 n \\<and> F_PARSER_TC__relation_configurationLR G1 G2 c1 (the (get_configuration (d2 n))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_initial_simulation_def)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(rule F_PARSER_TC__initial_simulation_preserves_derivation)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_initial_configurationLR_def)\n   apply(simp add: get_configuration_def der1_def)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(rule_tac\n      x=\"0\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(rule der1_maximum_of_domain)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(simp add: get_configuration_def der1_def)\n  apply(simp add: F_PARSER_TC__relation_configurationLR_def)\n  apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 c1)(*strict*)\n  apply(rename_tac G1 c1)\n  apply (metis parserHFS_inst_AX_initial_configuration_belongs subset_eq)(*strict*)\n  done\n\nlemma F_PARSER_TC__preserves_step_relation: \"\n  parserHFS_step_relation G1 c1 e1 c1'\n  \\<Longrightarrow> parserHFS_step_relation (F_PARSER_TC G1) (F_PARSER_TCC G1 c1) (F_PARSER_TCR G1 e1) (F_PARSER_TCC G1 c1')\"\n  apply(simp add: parserHFS_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x xa y)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x xa y)(*strict*)\n   apply(simp add: F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TCR_def)\n  apply(rename_tac x xa y)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x xa y)(*strict*)\n   apply(simp add: F_PARSER_TCC_def F_PARSER_TCR_def F_PARSER_TC__parserC_def F_PARSER_TC__rule_def)\n  apply(rename_tac x xa y)(*strict*)\n  apply(rule_tac\n      x=\"xa\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac x xa y)(*strict*)\n   apply(simp add: F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TCC_def F_PARSER_TCR_def F_PARSER_TC__parserC_def F_PARSER_TC__rule_def)\n  apply(rename_tac x xa y)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x xa y)(*strict*)\n   apply(simp add: F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TCC_def F_PARSER_TCR_def F_PARSER_TC__parserC_def F_PARSER_TC__rule_def)\n  apply(rename_tac x xa y)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x xa y)(*strict*)\n   apply(simp add: F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TCC_def F_PARSER_TCR_def F_PARSER_TC__parserC_def F_PARSER_TC__rule_def)\n   apply(rule_tac\n      x=\"y\"\n      in exI)\n   apply(force)\n  apply(rename_tac x xa y)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x xa y)(*strict*)\n   apply(simp add: F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TCC_def F_PARSER_TCR_def F_PARSER_TC__parserC_def F_PARSER_TC__rule_def)\n  apply(rename_tac x xa y)(*strict*)\n  apply(simp add: F_PARSER_TCC_def F_PARSER_TCR_def F_PARSER_TC__parserC_def F_PARSER_TC__rule_def)\n  done\n\nlemma F_PARSER_TC__relation_step_simulation_maps_to_derivation: \"\n  F_PARSER_TC__relation_step_simulation G1 G2 c1 e1 c1' c2 d2\n  \\<Longrightarrow> F_PARSER_TC__relation_configurationLR G1 G2 c1 c2\n  \\<Longrightarrow> parserHFS_step_relation G1 c1 e1 c1'\n  \\<Longrightarrow> parserHFS.derivation G2 d2\"\n  apply(simp add: F_PARSER_TC__relation_step_simulation_def)\n  apply(subgoal_tac \"c1 \\<in> parserHFS_configurations G1\")\n   prefer 2\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def)\n  apply(clarsimp)\n  apply(simp add: F_PARSER_TC__relation_configurationLR_def)\n  apply(clarsimp)\n  apply(rule parserHFS.der2_is_derivation)\n  apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n  apply(clarsimp)\n  apply(rule F_PARSER_TC__preserves_step_relation)\n  apply(force)\n  done\n\nlemma F_PARSER_TC__relation_step_simulation_maps_to_derivation_belongs: \"\n  F_PARSER_TC__relation_step_simulation G1 G2 c1 e1 c1' c2 d2\n  \\<Longrightarrow> F_PARSER_TC__relation_configurationLR G1 G2 c1 c2\n  \\<Longrightarrow> parserHFS_step_relation G1 c1 e1 c1'\n  \\<Longrightarrow> parserHFS.belongs G2 d2\"\n  apply(simp add: F_PARSER_TC__relation_step_simulation_def)\n  apply(rule parserHFS.der2_belongs_prime)\n    prefer 3\n    apply(rule F_PARSER_TC__relation_step_simulation_maps_to_derivation)\n      apply(simp add: F_PARSER_TC__relation_step_simulation_def)\n     apply(force)\n    apply(force)\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def F_PARSER_TC__relation_TSstructureLR_def)\n   apply(clarsimp)\n   apply(rule F_PARSER_TC__preserves_PARSER)\n   apply(force)\n  apply(simp add: F_PARSER_TC__relation_configurationLR_def)\n  apply(clarsimp)\n  apply(rule F_PARSER_TC__C_preserves_configurations)\n   apply(force)\n  apply (metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs parserHFS.get_accessible_configurations_are_configurations subsetD)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_step_simulation: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__relation_configurationLR G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> parser_step_labels G1 \\<longrightarrow> (\\<forall>c1'. parserHFS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<exists>d2. parserHFS.derivation G2 d2 \\<and> parserHFS.belongs G2 d2 \\<and> the (get_configuration (d2 0)) = c2 \\<and> F_PARSER_TC__relation_step_simulation G1 G2 c1 e1 c1' c2 d2 \\<and> (\\<exists>n. maximum_of_domain d2 n \\<and> F_PARSER_TC__relation_configurationLR G1 G2 c1' (the (get_configuration (d2 n)))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(simp add: F_PARSER_TC__relation_step_simulation_def)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(rule F_PARSER_TC__relation_step_simulation_maps_to_derivation)\n     apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n     apply(simp add: F_PARSER_TC__relation_step_simulation_def)\n    apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(rule F_PARSER_TC__relation_step_simulation_maps_to_derivation_belongs)\n     apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n     apply(simp add: F_PARSER_TC__relation_step_simulation_def)\n    apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(simp add: der2_def get_configuration_def F_PARSER_TC__relation_configurationLR_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule_tac\n      x=\"Suc 0\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(rule der2_maximum_of_domain)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(simp add: der2_def get_configuration_def F_PARSER_TC__relation_configurationLR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n  apply (metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs parserHFS.AX_step_relation_preserves_belongsC)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n  ATS_Simulation_Configuration_Weak_axioms valid_parser parserHFS_initial_configurations parser_step_labels parserHFS_step_relation valid_parser parserHFS_configurations parserHFS_initial_configurations parser_step_labels parserHFS_step_relation F_PARSER_TC__relation_configurationLR F_PARSER_TC__relation_initial_configurationLR F_PARSER_TC__relation_TSstructureLR F_PARSER_TC__relation_initial_simulation F_PARSER_TC__relation_step_simulation\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def)\n  apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_initial_simulation parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_step_simulation parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs)\n  done\n\ninterpretation \"parserHFS_parserHFS_F_PARSER_TC__StateSimLR\" : ATS_Simulation_Configuration_Weak\n  (* TSstructure1 *)\n  \"valid_parser\"\n  (* configurations1 *)\n  \"parserHFS_configurations\"\n  (* initial_configurations1 *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels1 *)\n  \"parser_step_labels\"\n  (* step_relation1 *)\n  \"parserHFS_step_relation\"\n  (* effects1 *)\n  \"parser_markers\"\n  (* marking_condition1 *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect1 *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect1 *)\n  \"parserHFS_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_parser\"\n  (* configurations2 *)\n  \"parserHFS_configurations\"\n  (* initial_configurations2 *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels2 *)\n  \"parser_step_labels\"\n  (* step_relation2 *)\n  \"parserHFS_step_relation\"\n  (* effects2 *)\n  \"parser_markers\"\n  (* marking_condition2 *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect2 *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect2 *)\n  \"parserHFS_unmarked_effect\"\n  (* relation_configuration *)\n  \"F_PARSER_TC__relation_configurationLR\"\n  (* relation_initial_configuration *)\n  \"F_PARSER_TC__relation_initial_configurationLR\"\n  (* relation_effect *)\n  \"F_PARSER_TC__relation_effectLR\"\n  (* relation_TSstructure *)\n  \"F_PARSER_TC__relation_TSstructureLR\"\n  (* relation_initial_simulation *)\n  \"F_PARSER_TC__relation_initial_simulation\"\n  (* relation_step_simulation *)\n  \"F_PARSER_TC__relation_step_simulation\"\n  apply(simp add: LOCALE_DEFS parser_interpretations)\n  apply(simp add:  parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_step_simulation_preserves_marking_condition: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__relation_configurationLR G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> parser_step_labels G1 \\<longrightarrow> (\\<forall>c1'. parserHFS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_step_simulation G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationLR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> parserHFS_marking_condition G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n) \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationLR F_PARSER_TC__relation_initial_simulation F_PARSER_TC__relation_step_simulation G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> parserHFS_marking_condition G2 (derivation_append deri2 d2 deri2n)))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: parserHFS_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in parserHFS.some_position_has_details_at_0)\n   apply (metis parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(rename_tac cX)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(thin_tac \"derivation_append deri1 (der2 c1 e1 c1') deri1n i = Some (pair e c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX option b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n   apply(simp add: derivation_append_def get_configuration_def)\n   apply(rule F_PARSER_TC__C_preserves_marking_configurations)\n    apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n   apply(subgoal_tac \"c=c1'\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_def)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"Suc deri1n\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX y)(*strict*)\n   apply(rule_tac\n      x=\"deri2n+n\"\n      in exI)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def derivation_append_def get_configuration_def)\n   apply(rule F_PARSER_TC__C_preserves_marking_configurations)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i>Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der2_def)\n  apply(case_tac \"i-deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX nat)(*strict*)\n  apply(clarsimp)\n  apply(case_tac nat)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i c cX)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX nat nata)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_initial_simulation_preserves_marking_condition: \"\n  \\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> parserHFS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_initial_simulation G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationLR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> parserHFS_marking_condition G1 (derivation_append deri1 (der1 c1) deri1n) \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationLR F_PARSER_TC__relation_initial_simulation F_PARSER_TC__relation_step_simulation G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> parserHFS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: parserHFS_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in parserHFS.some_position_has_details_at_0)\n   apply (metis parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(rename_tac cX)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX y)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def)\n   apply(clarsimp)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def get_configuration_def)\n   apply(rule F_PARSER_TC__C_preserves_marking_configurations)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(subgoal_tac \"i=deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der1_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms: \"\n  ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms parserHFS_initial_configurations parser_step_labels parserHFS_step_relation parserHFS_marking_condition parserHFS_initial_configurations parserHFS_step_relation parserHFS_marking_condition F_PARSER_TC__relation_configurationLR F_PARSER_TC__relation_initial_configurationLR F_PARSER_TC__relation_TSstructureLR F_PARSER_TC__relation_initial_simulation F_PARSER_TC__relation_step_simulation\"\n  apply(simp add: ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_step_simulation_preserves_marking_condition)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_initial_simulation_preserves_marking_condition)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_step_simulation_preserves_marked_effect: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__relation_configurationLR G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> parser_step_labels G1 \\<longrightarrow> (\\<forall>c1'. parserHFS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_step_simulation G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationLR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationLR F_PARSER_TC__relation_initial_simulation F_PARSER_TC__relation_step_simulation G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_PARSER_TC__relation_effectLR G1 G2) (parserHFS_marked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (parserHFS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(rule_tac\n      x=\"a\"\n      in bexI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_effectLR_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: parserHFS_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in parserHFS.some_position_has_details_at_0)\n   apply (metis parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(rename_tac cX)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(thin_tac \"derivation_append deri1 (der2 c1 e1 c1') deri1n i = Some (pair e c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX option b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n   apply(simp add: derivation_append_def get_configuration_def)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n    apply(simp add: F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n   apply(rule F_PARSER_TC__C_preserves_marking_configurations)\n    apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n   apply(subgoal_tac \"c=c1'\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_def)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"Suc deri1n\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX y)(*strict*)\n   apply(rule_tac\n      x=\"deri2n+n\"\n      in exI)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def derivation_append_def get_configuration_def)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n    apply(simp add: F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n   apply(rule F_PARSER_TC__C_preserves_marking_configurations)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i>Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der2_def)\n  apply(case_tac \"i-deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX nat)(*strict*)\n  apply(clarsimp)\n  apply(case_tac nat)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i c cX)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX nat nata)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_initial_simulation_preserves_marked_effect: \"\n  \\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> parserHFS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_initial_simulation G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationLR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationLR F_PARSER_TC__relation_initial_simulation F_PARSER_TC__relation_step_simulation G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_PARSER_TC__relation_effectLR G1 G2) (parserHFS_marked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (parserHFS_marked_effect G2 (derivation_append deri2 d2 deri2n)))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(rule_tac\n      x=\"a\"\n      in bexI)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_effectLR_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: parserHFS_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in parserHFS.some_position_has_details_at_0)\n   apply (metis parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(rename_tac cX)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX option b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n   apply(simp add: derivation_append_def get_configuration_def)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n    apply(simp add: F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n   apply(rule F_PARSER_TC__C_preserves_marking_configurations)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca cX e)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_def)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"Suc deri1n\"\n      in allE)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"deri2n+n\"\n      in exI)\n   apply(simp add: derivation_append_def get_configuration_def)\n   apply(simp add: F_PARSER_TC__relation_initial_simulation_def)\n   apply(subgoal_tac \"n=0\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f e c cX)(*strict*)\n    apply(simp add: derivation_append_fit_def)\n    apply(simp add: der1_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n   apply(case_tac n)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f e c cX nat)(*strict*)\n   apply(simp add: der1_def maximum_of_domain_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i>Suc deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der2_def)\n  apply(case_tac \"i-deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX nat)(*strict*)\n  apply(clarsimp)\n  apply(simp add: der1_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_Marked_Effect_axioms: \"\n  ATS_Simulation_Configuration_Weak_Marked_Effect_axioms parserHFS_initial_configurations parser_step_labels parserHFS_step_relation parserHFS_marked_effect parserHFS_initial_configurations parserHFS_step_relation parserHFS_marked_effect F_PARSER_TC__relation_configurationLR F_PARSER_TC__relation_initial_configurationLR F_PARSER_TC__relation_effectLR F_PARSER_TC__relation_TSstructureLR F_PARSER_TC__relation_initial_simulation F_PARSER_TC__relation_step_simulation\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_Marked_Effect_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_step_simulation_preserves_marked_effect)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_initial_simulation_preserves_marked_effect)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_step_simulation_preserves_unmarked_effect: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__relation_configurationLR G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> parser_step_labels G1 \\<longrightarrow> (\\<forall>c1'. parserHFS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_step_simulation G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationLR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationLR F_PARSER_TC__relation_initial_simulation F_PARSER_TC__relation_step_simulation G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_PARSER_TC__relation_effectLR G1 G2) (parserHFS_unmarked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (parserHFS_unmarked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: parserHFS_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_effectLR_def)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in parserHFS.some_position_has_details_at_0)\n   apply (metis parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca caa e c)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca caa e)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_initial_configurationLR_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e)(*strict*)\n   apply(subgoal_tac \"\\<exists>c. deri1 0 = Some (pair None c)\")\n    apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"G1\"\n      in parserHFS.some_position_has_details_at_0)\n    apply (metis parserHFS.derivation_initial_is_derivation)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"F_PARSER_TCC G1 ca\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   prefer 2\n   apply(case_tac \"i>Suc deri1n\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def der2_def)\n   apply(case_tac \"i-deri1n\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca nat)(*strict*)\n   apply(clarsimp)\n   apply(case_tac nat)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ca)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca nat nata)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c ca)(*strict*)\n  apply(rule_tac\n      x=\"Suc deri2n\"\n      in exI)\n  apply(simp add: derivation_append_def)\n  apply(simp add: derivation_append_fit_def)\n  apply(simp add: der2_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_step_simulation_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n  apply(simp add: der2_def)\n  apply(simp add: F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_initial_simulation_preserves_unmarked_effect: \"\n  \\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> parserHFS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_initial_simulation G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationLR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationLR F_PARSER_TC__relation_initial_simulation F_PARSER_TC__relation_step_simulation G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_PARSER_TC__relation_effectLR G1 G2) (parserHFS_unmarked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (parserHFS_unmarked_effect G2 (derivation_append deri2 d2 deri2n)))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: parserHFS_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_effectLR_def)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in parserHFS.some_position_has_details_at_0)\n   apply (metis parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca caa e c)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca caa e)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_initial_configurationLR_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e)(*strict*)\n   apply(subgoal_tac \"\\<exists>c. deri1 0 = Some (pair None c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"G1\"\n      in parserHFS.some_position_has_details_at_0)\n    apply (metis parserHFS.derivation_initial_is_derivation)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(simp add: derivation_append_def der1_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms: \"\n  ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms parserHFS_initial_configurations parser_step_labels parserHFS_step_relation parserHFS_unmarked_effect parserHFS_initial_configurations parserHFS_step_relation parserHFS_unmarked_effect F_PARSER_TC__relation_configurationLR F_PARSER_TC__relation_initial_configurationLR F_PARSER_TC__relation_effectLR F_PARSER_TC__relation_TSstructureLR F_PARSER_TC__relation_initial_simulation F_PARSER_TC__relation_step_simulation\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_step_simulation_preserves_unmarked_effect)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_relation_initial_simulation_preserves_unmarked_effect)\n  done\n\ninterpretation \"parserHFS_parserHFS_F_PARSER_TC__StateSimLR\" : ATS_Simulation_Configuration_WeakLR_FULL\n  (* TSstructure1 *)\n  \"valid_parser\"\n  (* configurations1 *)\n  \"parserHFS_configurations\"\n  (* initial_configurations1 *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels1 *)\n  \"parser_step_labels\"\n  (* step_relation1 *)\n  \"parserHFS_step_relation\"\n  (* effects1 *)\n  \"parser_markers\"\n  (* marking_condition1 *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect1 *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect1 *)\n  \"parserHFS_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_parser\"\n  (* configurations2 *)\n  \"parserHFS_configurations\"\n  (* initial_configurations2 *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels2 *)\n  \"parser_step_labels\"\n  (* step_relation2 *)\n  \"parserHFS_step_relation\"\n  (* effects2 *)\n  \"parser_markers\"\n  (* marking_condition2 *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect2 *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect2 *)\n  \"parserHFS_unmarked_effect\"\n  (* relation_configuration *)\n  \"F_PARSER_TC__relation_configurationLR\"\n  (* relation_initial_configuration *)\n  \"F_PARSER_TC__relation_initial_configurationLR\"\n  (* relation_effect *)\n  \"F_PARSER_TC__relation_effectLR\"\n  (* relation_TSstructure *)\n  \"F_PARSER_TC__relation_TSstructureLR\"\n  (* relation_initial_simulation *)\n  \"F_PARSER_TC__relation_initial_simulation\"\n  (* relation_step_simulation *)\n  \"F_PARSER_TC__relation_step_simulation\"\n  apply(simp add: LOCALE_DEFS parser_interpretations)\n  apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_Marked_Effect_axioms parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms )\n  done\n\nlemma F_PARSER_TC__preserves_lang1: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.marked_language G \\<subseteq> parserHFS.marked_language (F_PARSER_TC G)\"\n  apply(rule_tac\n      t=\"parserHFS.marked_language G\"\n      and s=\"parserHFS.finite_marked_language G\"\n      in ssubst)\n   apply (metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_PARSER_TC__relation_TSstructureLR_def Suc_n_not_n parserHFS.AX_marked_language_finite)\n  apply(rule_tac\n      t=\"parserHFS.marked_language (F_PARSER_TC G)\"\n      and s=\"parserHFS.finite_marked_language (F_PARSER_TC G)\"\n      in ssubst)\n   apply(rule sym)\n   apply(rule parserHFS.AX_marked_language_finite)\n   apply(rule F_PARSER_TC__preserves_PARSER)\n   apply(force)\n  apply(subgoal_tac \"left_total_on (F_PARSER_TC__relation_effectLR SSG1 SSG2) (parserHFS.finite_marked_language SSG1) (parserHFS.finite_marked_language SSG2)\" for SSG1 SSG2)\n   prefer 2\n   apply(rule_tac\n      ?G1.0=\"G\"\n      in parserHFS_parserHFS_F_PARSER_TC__StateSimLR.ATS_Simulation_Configuration_Weak_Marked_Effect_sound)\n   apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in ballE)\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x b)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_effectLR_def)\n  apply(clarsimp)\n  apply(rename_tac b)(*strict*)\n  apply(force)\n  done\n\nlemma F_PARSER_TC__preserves_unmarked_language1: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.unmarked_language G \\<subseteq> parserHFS.unmarked_language (F_PARSER_TC G)\"\n  apply(rule_tac\n      t=\"parserHFS.unmarked_language G\"\n      and s=\"parserHFS.finite_unmarked_language G\"\n      in ssubst)\n   apply (metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_PARSER_TC__relation_TSstructureLR_def Suc_n_not_n parserHFS.AX_unmarked_language_finite)\n  apply(rule_tac\n      t=\"parserHFS.unmarked_language (F_PARSER_TC G)\"\n      and s=\"parserHFS.finite_unmarked_language (F_PARSER_TC G)\"\n      in ssubst)\n   apply(rule sym)\n   apply(rule parserHFS.AX_unmarked_language_finite)\n   apply(rule F_PARSER_TC__preserves_PARSER)\n   apply(force)\n  apply(subgoal_tac \"left_total_on (F_PARSER_TC__relation_effectLR SSG1 SSG2) (parserHFS.finite_unmarked_language SSG1) (parserHFS.finite_unmarked_language SSG2)\" for SSG1 SSG2)\n   prefer 2\n   apply(rule_tac\n      ?G1.0=\"G\"\n      in parserHFS_parserHFS_F_PARSER_TC__StateSimLR.ATS_Simulation_Configuration_Weak_Unmarked_Effect_sound)\n   apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in ballE)\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x b)(*strict*)\n   prefer 2\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x b)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_effectLR_def)\n  apply(force)\n  done\n\ndefinition F_PARSER_TC__relation_TSstructureRL :: \"\n  ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_TSstructureRL G2 G1 \\<equiv>\n  valid_parser G1\n  \\<and> G2 = F_PARSER_TC G1\"\n\ndefinition F_PARSER_TC__relation_configurationRL :: \"\n  ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_configurationRL G2 G1 c2 c1 \\<equiv>\n  F_PARSER_TC__relation_TSstructureRL G2 G1\n  \\<and> c1 \\<in> parserHFS_configurations G1\n  \\<and> c2 = F_PARSER_TCC G1 c1\"\n\ndefinition F_PARSER_TC__relation_initial_configurationRL :: \"\n  ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_initial_configurationRL G2 G1 c2 c1 \\<equiv>\n  F_PARSER_TC__relation_TSstructureRL G2 G1\n  \\<and> c1 \\<in> parserHFS_initial_configurations G1\n  \\<and> c2 = F_PARSER_TCC G1 c1\"\n\ndefinition F_PARSER_TC__relation_effectRL :: \"\n  ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_effectRL G1 G2 w1 w2 \\<equiv>\n  F_PARSER_TC__relation_TSstructureRL G1 G2\n  \\<and> w1 = w2\"\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n  (\\<forall>G1. Ex (F_PARSER_TC__relation_TSstructureRL G1) \\<longrightarrow> valid_parser G1)\"\n  apply(clarsimp)\n  apply(rename_tac G1 x)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n  apply(clarsimp)\n  apply(rename_tac G2)(*strict*)\n  apply(subgoal_tac \"valid_parser (F_PARSER_TC G2)\")\n   apply(rename_tac G2)(*strict*)\n   apply(simp add: valid_parser_def)\n  apply(rename_tac G2)(*strict*)\n  apply(rule F_PARSER_TC__preserves_PARSER)\n  apply(force)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureRL G1 G2 \\<longrightarrow> valid_parser G2)\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n  done\n\ndefinition F_PARSER_TC__relation_step_simulationRL :: \"\n  ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parser_step_label\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> (('stackA, 'event) parser_step_label, ('stackA, 'event) parserHFS_conf) derivation\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_step_simulationRL G2 G1 c1 e c1' c2 d \\<equiv>\n  d = der2 (F_PARSER_TCCRev G1 c1) (F_PARSER_TCRRev G1 e) (F_PARSER_TCCRev G1 c1')\"\n\ndefinition F_PARSER_TC__relation_initial_simulationRL :: \"\n  ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> (('stackA, 'event) parser_step_label, ('stackA, 'event) parserHFS_conf) derivation\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__relation_initial_simulationRL G1 G2 c1 d \\<equiv>\n  d = der1 (F_PARSER_TCCRev G2 c1)\"\n\nlemma F_PARSER_TC__C_rev_preserves_configurations: \"\n  F_PARSER_TC__relation_TSstructureRL G1 G2\n  \\<Longrightarrow> c1 \\<in> parserHFS_configurations G1\n  \\<Longrightarrow> F_PARSER_TCCRev G2 c1 \\<in> parserHFS_configurations G2\"\n  apply(simp add: parserHFS_configurations_def)\n  apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n  apply(clarsimp)\n  apply(rename_tac f h l w)(*strict*)\n  apply(simp add: F_PARSER_TC_def F_PARSER_TCCRev_def F_PARSER_TC__parserCRev_def F_PARSER_TC__parser_def)\n  apply(clarsimp)\n  apply(rename_tac f h l w xa)(*strict*)\n  apply(subgoal_tac \"\\<exists>w1 w2. l=w1@[xa]@w2\")\n   apply(rename_tac f h l w xa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h w w1 w2 x)(*strict*)\n   apply(rule_tac\n      t=\"inv_into (parser_nonterms G2) (SOME f. inj_on f (parser_nonterms G2)) ((SOME f. inj_on f (parser_nonterms G2)) x)\"\n      and s=\"x\"\n      in ssubst)\n    apply(rename_tac f h w w1 w2 x)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac f h w w1 w2 x)(*strict*)\n   apply(rule inv_into_f_eq)\n     apply(rename_tac f h w w1 w2 x)(*strict*)\n     apply(rule SOME_injective_is_injective)\n     apply(simp add: valid_parser_def valid_parser_def)\n    apply(rename_tac f h w w1 w2 x)(*strict*)\n    apply(force)\n   apply(rename_tac f h w w1 w2 x)(*strict*)\n   apply(force)\n  apply(rename_tac f h l w xa)(*strict*)\n  apply (metis ConsApp in_set_conv_decomp_first insert_Nil)\n  done\n\nlemma F_PARSER_TC__C_rev_preserves_initial_configurations: \"\n  F_PARSER_TC__relation_TSstructureRL G1 G2\n  \\<Longrightarrow> c1 \\<in> parserHFS_initial_configurations G1\n  \\<Longrightarrow> F_PARSER_TCCRev G2 c1 \\<in> parserHFS_initial_configurations G2\"\n  apply(subgoal_tac \"valid_parser (F_PARSER_TC G1)\")\n   prefer 2\n   apply(rule F_PARSER_TC__preserves_PARSER)\n   apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n   apply(rule F_PARSER_TC__preserves_PARSER)\n   apply(force)\n  apply(simp add: parserHFS_initial_configurations_def)\n  apply(clarsimp)\n  apply(rule propSym)\n  apply(rule conjI)\n   apply(rule propSym)\n   apply(rule conjI)\n    apply(rule propSym)\n    apply(rule conjI)\n     apply(rule F_PARSER_TC__C_rev_preserves_configurations)\n      apply(force)\n     apply(force)\n    apply(simp add: F_PARSER_TCCRev_def valid_parser_def F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TC__relation_TSstructureRL_def)\n    apply(case_tac c1)\n    apply(simp add: F_PARSER_TC__parserCRev_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def inv_into_def)\n    apply(clarsimp)\n    apply(rule some_equality)\n     apply(rule context_conjI)\n      apply(force)\n     apply(force)\n    apply(rule_tac f=\"(SOME f. inj_on f (parser_nonterms G2))\" in inj_onD)\n       apply(rule SOME_injective_is_injective)\n       apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_EPDA_TC__relation_epda__LR_def valid_epda_def SOME_injective_is_injective)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(simp add: F_PARSER_TCCRev_def valid_parser_def F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TC__relation_TSstructureRL_def)\n   apply(simp add: F_PARSER_TC__parserCRev_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def inv_into_def)\n  apply(simp add: F_PARSER_TCCRev_def valid_parser_def F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TC__relation_TSstructureRL_def)\n  apply(simp add: F_PARSER_TC__parserCRev_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def inv_into_def)\n  done\n\nlemma F_PARSER_TCC_reverse: \"\n  valid_parser G2\n  \\<Longrightarrow> c1 \\<in> parserHFS_configurations (F_PARSER_TC G2)\n  \\<Longrightarrow> c1 = F_PARSER_TCC G2 (F_PARSER_TCCRev G2 c1)\"\n  apply(simp add: F_PARSER_TCC_def F_PARSER_TCCRev_def F_PARSER_TC__parserC_def F_PARSER_TC__parserCRev_def F_PARSER_TC_def F_PARSER_TC__parser_def parserHFS_initial_configurations_def parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac f h l w)(*strict*)\n  apply(rule listEqI)\n   apply(rename_tac f h l w)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac f h l w i)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>w1 w2. l=w1@[l!i]@w2\")\n   apply(rename_tac f h l w i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f h l w i w1 w2)(*strict*)\n   apply(subgoal_tac \"l!i \\<in> (SOME f. inj_on f (parser_nonterms G2)) ` parser_nonterms G2\")\n    apply(rename_tac f h l w i w1 w2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac f h w i w1 w2 x)(*strict*)\n    apply (metis f_inv_into_f imageI)\n   apply(rename_tac f h l w i w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac f h l w i)(*strict*)\n  apply (metis ConsApp nth_take_drop_split)\n  done\n\nlemma F_PARSER_TCC_reverse2: \"\n  valid_parser G2\n  \\<Longrightarrow> c1 \\<in> parserHFS_configurations G2\n  \\<Longrightarrow> c1 = F_PARSER_TCCRev G2 (F_PARSER_TCC G2 c1)\"\n  apply(simp add: F_PARSER_TCC_def F_PARSER_TCCRev_def F_PARSER_TC__parserC_def F_PARSER_TC__parserCRev_def F_PARSER_TC_def F_PARSER_TC__parser_def parserHFS_initial_configurations_def parserHFS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac f h l w)(*strict*)\n  apply(rule listEqI)\n   apply(rename_tac f h l w)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac f h l w i)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>w1 w2. l=w1@[l!i]@w2\")\n   apply(rename_tac f h l w i)(*strict*)\n   prefer 2\n   apply (metis ConsApp nth_take_drop_split)\n  apply(rename_tac f h l w i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f h l w i w1 w2)(*strict*)\n  apply(subgoal_tac \"l!i \\<in> parser_nonterms G2\")\n   apply(rename_tac f h l w i w1 w2)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac f h l w i w1 w2)(*strict*)\n  apply(rule sym)\n  apply(rule inv_into_f_eq)\n    apply(rename_tac f h l w i w1 w2)(*strict*)\n    apply(rule SOME_injective_is_injective)\n    apply(simp add: valid_parser_def valid_parser_def)\n   apply(rename_tac f h l w i w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac f h l w i w1 w2)(*strict*)\n  apply(force)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_initial_simulation: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureRL G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> parserHFS_initial_configurations G1 \\<longrightarrow> (\\<exists>d2. parserHFS.derivation_initial G2 d2 \\<and> F_PARSER_TC__relation_initial_configurationRL G1 G2 c1 (the (get_configuration (d2 0))) \\<and> F_PARSER_TC__relation_initial_simulationRL G1 G2 c1 d2 \\<and> (\\<exists>n. maximum_of_domain d2 n \\<and> F_PARSER_TC__relation_configurationRL G1 G2 c1 (the (get_configuration (d2 n)))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_initial_simulationRL_def)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(rule parserHFS.derivation_initialI)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(rule parserHFS.der1_is_derivation)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(simp add: get_configuration_def der1_def)\n   apply(rule F_PARSER_TC__C_rev_preserves_initial_configurations)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(simp add: get_configuration_def der1_def)\n   apply(simp add: F_PARSER_TC__relation_initial_configurationRL_def)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(rule F_PARSER_TC__C_rev_preserves_initial_configurations)\n     apply(rename_tac G1 G2 c1)(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n   apply(clarsimp)\n   apply(rename_tac G2 c1)(*strict*)\n   apply(rule F_PARSER_TCC_reverse)\n    apply(rename_tac G2 c1)(*strict*)\n    apply(force)\n   apply(rename_tac G2 c1)(*strict*)\n   apply (metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs F_PARSER_TC__relation_TSstructureLR_def parserHFS_inst_AX_initial_configuration_belongs subsetD)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(rule_tac\n      x=\"0\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(rule der1_maximum_of_domain)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(simp add: get_configuration_def der1_def)\n  apply(simp add: F_PARSER_TC__relation_configurationRL_def)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(rule F_PARSER_TC__C_rev_preserves_configurations)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply (metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs F_PARSER_TC__relation_TSstructureLR_def F_PARSER_TC__relation_TSstructureRL_def parserHFS.AX_initial_configuration_belongs nset_mp)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(rule F_PARSER_TCC_reverse)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n  apply (metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs F_PARSER_TC__relation_TSstructureLR_def F_PARSER_TC__relation_TSstructureRL_def parserHFS.AX_initial_configuration_belongs nset_mp)\n  done\n\nlemma F_PARSER_TCRev_preserves_step_relation: \"\n  F_PARSER_TC__relation_TSstructureRL G1 G2\n  \\<Longrightarrow> parserHFS_step_relation G1 c1 e1 c1'\n  \\<Longrightarrow> parserHFS_step_relation G2 (F_PARSER_TCCRev G2 c1) (F_PARSER_TCRRev G2 e1) (F_PARSER_TCCRev G2 c1')\"\n  apply(simp add: parserHFS_step_relation_def F_PARSER_TCCRev_def F_PARSER_TC__relation_TSstructureRL_def F_PARSER_TC__parserCRev_def)\n  apply(subgoal_tac \"F_PARSER_TCRRev G2 e1 \\<in> parser_rules G2\")\n   prefer 2\n   apply(rule F_PARSER_TCRRev_preserves_edges)\n    apply(simp add: valid_parser_def)\n   apply(force)\n  apply(subgoal_tac \"valid_parser (F_PARSER_TC G2)\")\n   prefer 2\n   apply(rule F_PARSER_TC__preserves_PARSER)\n   apply(simp add: valid_parser_def)\n  apply(subgoal_tac \"valid_parser_step_label (F_PARSER_TC G2) e1\")\n   prefer 2\n   apply(simp add: valid_parser_def valid_parser_def)\n   apply(force)\n  apply(rule conjI)\n   apply(simp add: valid_parser_step_label_def F_PARSER_TC_def F_PARSER_TC__parser_def)\n  apply(rule conjI)\n   prefer 2\n   apply(clarsimp)\n   apply(rename_tac x xa y)(*strict*)\n   apply(rule_tac\n      x=\"xa\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac x xa y)(*strict*)\n    apply(simp add: F_PARSER_TCRRev_def F_PARSER_TC__ruleRev_def)\n   apply(rename_tac x xa y)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac x xa y)(*strict*)\n    apply(simp add: F_PARSER_TCRRev_def F_PARSER_TC__ruleRev_def)\n   apply(rename_tac x xa y)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac x xa y)(*strict*)\n    apply(simp add: F_PARSER_TCRRev_def F_PARSER_TC__ruleRev_def)\n    apply(rule_tac\n      x=\"y\"\n      in exI)\n    apply(simp add: valid_parser_step_label_def F_PARSER_TC_def F_PARSER_TC__parser_def)\n   apply(rename_tac x xa y)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac x xa y)(*strict*)\n    apply(simp add: valid_parser_step_label_def F_PARSER_TC_def F_PARSER_TC__parser_def)\n    apply(simp add: F_PARSER_TCRRev_def F_PARSER_TC__ruleRev_def)\n   apply(rename_tac x xa y)(*strict*)\n   apply(simp add: valid_parser_step_label_def F_PARSER_TC_def F_PARSER_TC__parser_def)\n   apply(simp add: F_PARSER_TCRRev_def F_PARSER_TC__ruleRev_def)\n  apply(clarsimp)\n  apply(rename_tac x xa y)(*strict*)\n  apply(rule_tac\n      x=\"map (inv_into (parser_nonterms G2) (SOME f. inj_on f (parser_nonterms G2))) x\"\n      in exI)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac x xa y)(*strict*)\n   apply(simp add: valid_parser_step_label_def F_PARSER_TC_def F_PARSER_TC__parser_def)\n   apply(simp add: F_PARSER_TCRRev_def F_PARSER_TC__ruleRev_def)\n  apply(rename_tac x xa y)(*strict*)\n  apply(simp add: valid_parser_step_label_def F_PARSER_TC_def F_PARSER_TC__parser_def)\n  apply(simp add: F_PARSER_TCRRev_def F_PARSER_TC__ruleRev_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_step_relation_step_simulation: \"\n  \\<forall>G1 G2. F_PARSER_TC__relation_TSstructureRL G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__relation_configurationRL G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> parser_step_labels G1 \\<longrightarrow> (\\<forall>c1'. parserHFS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<exists>d2. parserHFS.derivation G2 d2 \\<and> parserHFS.belongs G2 d2 \\<and> the (get_configuration (d2 0)) = c2 \\<and> F_PARSER_TC__relation_step_simulationRL G1 G2 c1 e1 c1' c2 d2 \\<and> (\\<exists>n. maximum_of_domain d2 n \\<and> F_PARSER_TC__relation_configurationRL G1 G2 c1' (the (get_configuration (d2 n))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(simp add: F_PARSER_TC__relation_step_simulationRL_def)\n  apply(rule context_conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(rule parserHFS.der2_is_derivation)\n   apply(rule F_PARSER_TCRev_preserves_step_relation)\n    apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(rule parserHFS.derivation_belongs)\n      apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n      apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n     apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n     apply(simp add: der2_def)\n    apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n    apply(rule F_PARSER_TC__C_rev_preserves_configurations)\n     apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n    apply(simp add: F_PARSER_TC__relation_configurationRL_def)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c2 e1 c1')(*strict*)\n    apply(rule F_PARSER_TC__C_preserves_configurations)\n     apply(rename_tac G1 G2 c2 e1 c1')(*strict*)\n     apply(simp add: F_PARSER_TC__relation_TSstructureLR_def F_PARSER_TC__relation_TSstructureRL_def)\n    apply(rename_tac G1 G2 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(simp add: get_configuration_def der2_def F_PARSER_TC__relation_configurationRL_def F_PARSER_TC__relation_TSstructureRL_def)\n   apply(clarsimp)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(rule sym)\n   apply(rule F_PARSER_TCC_reverse2)\n    apply(rename_tac G2 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule_tac\n      x=\"Suc 0\"\n      in exI)\n  apply(simp add: maximum_of_domain_def der2_def)\n  apply(simp add: get_configuration_def F_PARSER_TC__relation_configurationRL_def F_PARSER_TC__relation_TSstructureRL_def)\n  apply(clarsimp)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(subgoal_tac \"valid_parser (F_PARSER_TC G2)\")\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   prefer 2\n   apply(rule F_PARSER_TC__preserves_PARSER)\n   apply(force)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(rule F_PARSER_TC__C_rev_preserves_configurations)\n    apply(rename_tac G2 c2 e1 c1')(*strict*)\n    apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(rule parserHFS.AX_step_relation_preserves_belongsC)\n     apply(rename_tac G2 c2 e1 c1')(*strict*)\n     apply(force)\n    apply(rename_tac G2 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(rule F_PARSER_TC__C_preserves_configurations)\n    apply(rename_tac G2 c2 e1 c1')(*strict*)\n    apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(rule F_PARSER_TCC_reverse)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(rule parserHFS.AX_step_relation_preserves_belongsC)\n    apply(rename_tac G2 c2 e1 c1')(*strict*)\n    apply(simp add: valid_parser_def)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(rule F_PARSER_TC__C_preserves_configurations)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(force)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n  ATS_Simulation_Configuration_Weak_axioms valid_parser parserHFS_initial_configurations parser_step_labels parserHFS_step_relation valid_parser parserHFS_configurations parserHFS_initial_configurations parser_step_labels parserHFS_step_relation F_PARSER_TC__relation_configurationRL F_PARSER_TC__relation_initial_configurationRL F_PARSER_TC__relation_TSstructureRL F_PARSER_TC__relation_initial_simulationRL F_PARSER_TC__relation_step_simulationRL\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_initial_simulation parserHFS_parserHFS_F_PARSER_TC__StateSimRL_step_relation_step_simulation parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs)\n  done\n\ninterpretation \"parserHFS_parserHFS_F_PARSER_TC__StateSimRL\" : ATS_Simulation_Configuration_Weak\n  (* TSstructure1 *)\n  \"valid_parser\"\n  (* configurations1 *)\n  \"parserHFS_configurations\"\n  (* initial_configurations1 *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels1 *)\n  \"parser_step_labels\"\n  (* step_relation1 *)\n  \"parserHFS_step_relation\"\n  (* effects1 *)\n  \"parser_markers\"\n  (* marking_condition1 *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect1 *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect1 *)\n  \"parserHFS_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_parser\"\n  (* configurations2 *)\n  \"parserHFS_configurations\"\n  (* initial_configurations2 *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels2 *)\n  \"parser_step_labels\"\n  (* step_relation2 *)\n  \"parserHFS_step_relation\"\n  (* effects2 *)\n  \"parser_markers\"\n  (* marking_condition2 *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect2 *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect2 *)\n  \"parserHFS_unmarked_effect\"\n  (* relation_configuration *)\n  \"F_PARSER_TC__relation_configurationRL\"\n  (* relation_initial_configuration *)\n  \"F_PARSER_TC__relation_initial_configurationRL\"\n  (* relation_effect *)\n  \"F_PARSER_TC__relation_effectRL\"\n  (* relation_TSstructure *)\n  \"F_PARSER_TC__relation_TSstructureRL\"\n  (* relation_initial_simulation *)\n  \"F_PARSER_TC__relation_initial_simulationRL\"\n  (* relation_step_simulation *)\n  \"F_PARSER_TC__relation_step_simulationRL\"\n  apply(simp add: LOCALE_DEFS parser_interpretations)\n  apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms)\n  done\n\nlemma F_PARSER_TC__C_rev_preserves_marking_configurations: \"\n  F_PARSER_TC__relation_TSstructureRL G1 G2\n  \\<Longrightarrow> c1 \\<in> parserHFS_marking_configurations G1\n  \\<Longrightarrow> F_PARSER_TCCRev G2 c1 \\<in> parserHFS_marking_configurations G2\"\n  apply(simp add: parserHFS_marking_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac f w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac f w)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_TSstructureRL_def F_PARSER_TC_def F_PARSER_TCCRev_def F_PARSER_TC__parserCRev_def F_PARSER_TC__parser_def)\n   apply(clarsimp)\n   apply(rename_tac w x)(*strict*)\n   apply(rule_tac\n      t=\"inv_into (parser_nonterms G2) (SOME f. inj_on f (parser_nonterms G2)) ((SOME f. inj_on f (parser_nonterms G2)) x)\"\n      and s=\"x\"\n      in ssubst)\n    apply(rename_tac w x)(*strict*)\n    apply(rule inv_into_f_eq)\n      apply(rename_tac w x)(*strict*)\n      apply(rule SOME_injective_is_injective)\n      apply(simp add: valid_parser_def valid_parser_def)\n     apply(rename_tac w x)(*strict*)\n     apply(simp add: valid_parser_def valid_parser_def)\n     apply(force)\n    apply(rename_tac w x)(*strict*)\n    apply(force)\n   apply(rename_tac w x)(*strict*)\n   apply(force)\n  apply(rename_tac f w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac f w)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_TSstructureRL_def F_PARSER_TC_def F_PARSER_TCCRev_def F_PARSER_TC__parserCRev_def F_PARSER_TC__parser_def parserHFS_configurations_def)\n  apply(rename_tac f w)(*strict*)\n  apply(rule F_PARSER_TC__C_rev_preserves_configurations)\n   apply(rename_tac f w)(*strict*)\n   apply(force)\n  apply(rename_tac f w)(*strict*)\n  apply(force)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_step_simulation_preserves_marking_condition: \"\n  \\<forall>G1 G2. F_PARSER_TC__relation_TSstructureRL G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__relation_configurationRL G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> parser_step_labels G1 \\<longrightarrow> (\\<forall>c1'. parserHFS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_step_simulationRL G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationRL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> parserHFS_marking_condition G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n) \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationRL F_PARSER_TC__relation_initial_simulationRL F_PARSER_TC__relation_step_simulationRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> parserHFS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: parserHFS_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(thin_tac \"derivation_append deri1 (der2 c1 e1 c1') deri1n i = Some (pair e c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_configurationRL_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"c\"\n      and s=\"F_PARSER_TCCRev G2 ca\"\n      in ssubst)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(simp add: derivation_append_def get_configuration_def)\n    apply(rule F_PARSER_TCC_reverse2)\n     apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n     apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule F_PARSER_TC__C_rev_preserves_marking_configurations)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n   apply(subgoal_tac \"c=c1'\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e)(*strict*)\n    apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_def)\n    apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_DEF_def)\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"Suc deri1n\"\n      in allE)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y)(*strict*)\n    apply(rule_tac\n      x=\"deri2n+n\"\n      in exI)\n    apply(case_tac y)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e option b)(*strict*)\n    apply(rename_tac e c)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n    apply(rule_tac\n      t=\"c\"\n      and s=\"F_PARSER_TCCRev G2 c1'\"\n      in ssubst)\n     apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n     apply(simp add: F_PARSER_TC__relation_configurationRL_def derivation_append_def get_configuration_def)\n     apply(rule F_PARSER_TCC_reverse2)\n      apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n      apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n     apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n    apply(rule F_PARSER_TC__C_rev_preserves_marking_configurations)\n     apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_configurationRL_def derivation_append_def get_configuration_def F_PARSER_TC__relation_initial_configurationRL_def der2_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i>Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der2_def)\n  apply(case_tac \"i-deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n  apply(clarsimp)\n  apply(case_tac nat)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat nata)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_initial_simulation_preserves_marking_condition: \"\n  \\<forall>G1 G2. F_PARSER_TC__relation_TSstructureRL G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> parserHFS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_initial_simulationRL G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationRL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> parserHFS_marking_condition G1 (derivation_append deri1 (der1 c1) deri1n) \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationRL F_PARSER_TC__relation_initial_simulationRL F_PARSER_TC__relation_step_simulationRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> parserHFS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: parserHFS_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_configurationRL_def)\n   apply(clarsimp)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"c\"\n      and s=\"F_PARSER_TCCRev G2 ca\"\n      in ssubst)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(simp add: derivation_append_def get_configuration_def)\n    apply(rule F_PARSER_TCC_reverse2)\n     apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n     apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule F_PARSER_TC__C_rev_preserves_marking_configurations)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"i=deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der1_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_COND_axioms: \"\n  ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms parserHFS_initial_configurations parser_step_labels parserHFS_step_relation parserHFS_marking_condition parserHFS_initial_configurations parserHFS_step_relation parserHFS_marking_condition F_PARSER_TC__relation_configurationRL F_PARSER_TC__relation_initial_configurationRL F_PARSER_TC__relation_TSstructureRL F_PARSER_TC__relation_initial_simulationRL F_PARSER_TC__relation_step_simulationRL\"\n  apply(simp add: ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_step_simulation_preserves_marking_condition)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_initial_simulation_preserves_marking_condition)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_step_simulation_preserves_marked_effect: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureRL G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__relation_configurationRL G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> parser_step_labels G1 \\<longrightarrow> (\\<forall>c1'. parserHFS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_step_simulationRL G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationRL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationRL F_PARSER_TC__relation_initial_simulationRL F_PARSER_TC__relation_step_simulationRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_PARSER_TC__relation_effectRL G1 G2) (parserHFS_marked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (parserHFS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(rule_tac\n      x=\"a\"\n      in bexI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_effectRL_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: parserHFS_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in parserHFS.some_position_has_details_at_0)\n   apply (metis parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(rename_tac cX)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(thin_tac \"derivation_append deri1 (der2 c1 e1 c1') deri1n i = Some (pair e c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX option b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(simp add: F_PARSER_TC__relation_configurationRL_def)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n   apply(simp add: derivation_append_def get_configuration_def)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n    apply(simp add: F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n   apply(rule_tac\n      t=\"c\"\n      and s=\"F_PARSER_TCCRev G2 (F_PARSER_TCC G2 c)\"\n      in ssubst)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n    prefer 2\n    apply(rule F_PARSER_TC__C_rev_preserves_marking_configurations)\n     apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n   apply(rule F_PARSER_TCC_reverse2)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n    apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n   apply(subgoal_tac \"c=c1'\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_def)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"Suc deri1n\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX y)(*strict*)\n   apply(rule_tac\n      x=\"deri2n+n\"\n      in exI)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e cX option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_configurationLR_def derivation_append_def get_configuration_def)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n    apply(simp add: F_PARSER_TC__relation_configurationRL_def F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n   apply(rule_tac\n      t=\"c\"\n      and s=\"F_PARSER_TCCRev G2 (F_PARSER_TCC G2 c)\"\n      in ssubst)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n    prefer 2\n    apply(rule F_PARSER_TC__C_rev_preserves_marking_configurations)\n     apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n    apply(simp add: F_PARSER_TC__relation_configurationRL_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n   apply(rule F_PARSER_TCC_reverse2)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n    apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea cX e c)(*strict*)\n   apply (metis F_PARSER_TC__relation_configurationRL_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i>Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der2_def)\n  apply(case_tac \"i-deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX nat)(*strict*)\n  apply(clarsimp)\n  apply(case_tac nat)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i c cX)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c cX nat nata)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_initial_simulation_preserves_marked_effect: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureRL G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> parserHFS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_initial_simulationRL G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationRL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationRL F_PARSER_TC__relation_initial_simulationRL F_PARSER_TC__relation_step_simulationRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_PARSER_TC__relation_effectRL G1 G2) (parserHFS_marked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (parserHFS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(rule_tac\n      x=\"a\"\n      in bexI)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_effectRL_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: parserHFS_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in parserHFS.some_position_has_details_at_0)\n   apply (metis parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(rename_tac cX)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX option b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(simp add: F_PARSER_TC__relation_configurationRL_def)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca cX e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n   apply(simp add: derivation_append_def get_configuration_def)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n    apply(simp add: F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n   apply(rule_tac\n      t=\"c\"\n      and s=\"F_PARSER_TCCRev G2 (F_PARSER_TCC G2 c)\"\n      in ssubst)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n    prefer 2\n    apply(rule F_PARSER_TC__C_rev_preserves_marking_configurations)\n     apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n   apply(rule F_PARSER_TCC_reverse2)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n    apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea cX e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_def)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"Suc deri1n\"\n      in allE)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"deri2n+n\"\n      in exI)\n   apply(simp add: derivation_append_def get_configuration_def)\n   apply(simp add: F_PARSER_TC__relation_initial_simulationRL_def)\n   apply(subgoal_tac \"n=0\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 deri1 deri1n deri2 f e c cX)(*strict*)\n    apply(simp add: derivation_append_fit_def)\n    apply(simp add: der1_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n   apply(case_tac n)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f e c cX)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f e c cX nat)(*strict*)\n   apply(simp add: der1_def maximum_of_domain_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(case_tac \"i>Suc deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der2_def)\n  apply(case_tac \"i-deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c cX nat)(*strict*)\n  apply(clarsimp)\n  apply(simp add: der1_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ACCEPT_axioms: \"\n  ATS_Simulation_Configuration_Weak_Marked_Effect_axioms parserHFS_initial_configurations parser_step_labels parserHFS_step_relation parserHFS_marked_effect parserHFS_initial_configurations parserHFS_step_relation parserHFS_marked_effect F_PARSER_TC__relation_configurationRL F_PARSER_TC__relation_initial_configurationRL F_PARSER_TC__relation_effectRL F_PARSER_TC__relation_TSstructureRL F_PARSER_TC__relation_initial_simulationRL F_PARSER_TC__relation_step_simulationRL\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_Marked_Effect_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_step_simulation_preserves_marked_effect)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_initial_simulation_preserves_marked_effect)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_step_simulation_preserves_unmarked_effect: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureRL G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__relation_configurationRL G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> parser_step_labels G1 \\<longrightarrow> (\\<forall>c1'. parserHFS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_step_simulationRL G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationRL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationRL F_PARSER_TC__relation_initial_simulationRL F_PARSER_TC__relation_step_simulationRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_PARSER_TC__relation_effectRL G1 G2) (parserHFS_unmarked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (parserHFS_unmarked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: parserHFS_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_effectRL_def)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in parserHFS.some_position_has_details_at_0)\n   apply (metis parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(simp add: F_PARSER_TC__relation_configurationRL_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca caa e c)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea caa e c)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_initial_configurationRL_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>c. deri1 0 = Some (pair None c)\")\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea caa e c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"G1\"\n      in parserHFS.some_position_has_details_at_0)\n    apply (metis parserHFS.derivation_initial_is_derivation)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea caa e c)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   prefer 2\n   apply(case_tac \"i>Suc deri1n\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def der2_def)\n   apply(case_tac \"i-deri1n\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca nat)(*strict*)\n   apply(clarsimp)\n   apply(case_tac nat)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ca)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca nat nata)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c ca)(*strict*)\n  apply(rule_tac\n      x=\"Suc deri2n\"\n      in exI)\n  apply(simp add: derivation_append_def)\n  apply(simp add: derivation_append_fit_def)\n  apply(simp add: der2_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_step_simulationRL_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n  apply(simp add: der2_def)\n  apply(simp add: F_PARSER_TCCRev_def F_PARSER_TC__parserCRev_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_initial_simulation_preserves_unmarked_effect: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureRL G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> parserHFS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_PARSER_TC__relation_initial_simulationRL G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. parserHFS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. parserHFS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_PARSER_TC__relation_initial_configurationRL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_PARSER_TC__relation_configurationRL F_PARSER_TC__relation_initial_simulationRL F_PARSER_TC__relation_step_simulationRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_PARSER_TC__relation_effectRL G1 G2) (parserHFS_unmarked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (parserHFS_unmarked_effect G2 (derivation_append deri2 d2 deri2n))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: parserHFS_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_effectRL_def)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in parserHFS.some_position_has_details_at_0)\n   apply (metis parserHFS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: parserHFS_parserHFS_F_PARSER_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(simp add: F_PARSER_TC__relation_configurationRL_def)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca caa e c)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea caa e c)(*strict*)\n   apply(simp add: F_PARSER_TC__relation_initial_configurationRL_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>c. deri1 0 = Some (pair None c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea caa e c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"G1\"\n      in parserHFS.some_position_has_details_at_0)\n    apply (metis parserHFS.derivation_initial_is_derivation)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea caa e c)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: F_PARSER_TCC_def F_PARSER_TC__parserC_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c ca)(*strict*)\n  apply(simp add: derivation_append_def der1_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ANY_axioms: \"\n  ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms parserHFS_initial_configurations parser_step_labels parserHFS_step_relation parserHFS_unmarked_effect parserHFS_initial_configurations parserHFS_step_relation parserHFS_unmarked_effect F_PARSER_TC__relation_configurationRL F_PARSER_TC__relation_initial_configurationRL F_PARSER_TC__relation_effectRL F_PARSER_TC__relation_TSstructureRL F_PARSER_TC__relation_initial_simulationRL F_PARSER_TC__relation_step_simulationRL\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_step_simulation_preserves_unmarked_effect)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"parserHFS_parserHFS_F_PARSER_TC__StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_relation_initial_simulation_preserves_unmarked_effect)\n  done\n\ninterpretation \"parserHFS_parserHFS_F_PARSER_TC__StateSimRL\" : ATS_Simulation_Configuration_WeakLR_FULL\n  (* TSstructure1 *)\n  \"valid_parser\"\n  (* configurations1 *)\n  \"parserHFS_configurations\"\n  (* initial_configurations1 *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels1 *)\n  \"parser_step_labels\"\n  (* step_relation1 *)\n  \"parserHFS_step_relation\"\n  (* effects1 *)\n  \"parser_markers\"\n  (* marking_condition1 *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect1 *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect1 *)\n  \"parserHFS_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_parser\"\n  (* configurations2 *)\n  \"parserHFS_configurations\"\n  (* initial_configurations2 *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels2 *)\n  \"parser_step_labels\"\n  (* step_relation2 *)\n  \"parserHFS_step_relation\"\n  (* effects2 *)\n  \"parser_markers\"\n  (* marking_condition2 *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect2 *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect2 *)\n  \"parserHFS_unmarked_effect\"\n  (* relation_configuration *)\n  \"F_PARSER_TC__relation_configurationRL\"\n  (* relation_initial_configuration *)\n  \"F_PARSER_TC__relation_initial_configurationRL\"\n  (* relation_effect *)\n  \"F_PARSER_TC__relation_effectRL\"\n  (* relation_TSstructure *)\n  \"F_PARSER_TC__relation_TSstructureRL\"\n  (* relation_initial_simulation *)\n  \"F_PARSER_TC__relation_initial_simulationRL\"\n  (* relation_step_simulation *)\n  \"F_PARSER_TC__relation_step_simulationRL\"\n  apply(simp add: LOCALE_DEFS parser_interpretations)\n  apply(simp add:  parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ANY_axioms parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_COND_axioms parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ACCEPT_axioms  parserHFS_parserHFS_F_PARSER_TC__StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms)\n  done\n\nlemma F_PARSER_TC__preserves_lang2: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.marked_language G \\<supseteq> parserHFS.marked_language (F_PARSER_TC G)\"\n  apply(rule_tac\n      t=\"parserHFS.marked_language G\"\n      and s=\"parserHFS.finite_marked_language G\"\n      in ssubst)\n   apply (metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_PARSER_TC__relation_TSstructureLR_def parserHFS_inst_lang_finite)\n  apply(rule_tac\n      t=\"parserHFS.marked_language (F_PARSER_TC G)\"\n      and s=\"parserHFS.finite_marked_language (F_PARSER_TC G)\"\n      in ssubst)\n   apply(rule sym)\n   apply(rule parserHFS.AX_marked_language_finite)\n   apply(rule F_PARSER_TC__preserves_PARSER)\n   apply(force)\n  apply(subgoal_tac \"left_total_on (F_PARSER_TC__relation_effectRL SSG1 SSG2) (parserHFS.finite_marked_language SSG1) (parserHFS.finite_marked_language SSG2)\" for SSG1 SSG2)\n   prefer 2\n   apply(rule_tac\n      ?G2.0=\"G\"\n      in parserHFS_parserHFS_F_PARSER_TC__StateSimRL.ATS_Simulation_Configuration_Weak_Marked_Effect_sound)\n   apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in ballE)\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x b)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_effectRL_def)\n  done\n\nlemma F_PARSER_TC__preserves_unmarked_language2: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.unmarked_language G \\<supseteq> parserHFS.unmarked_language (F_PARSER_TC G)\"\n  apply(rule_tac\n      t=\"parserHFS.unmarked_language G\"\n      and s=\"parserHFS.finite_unmarked_language G\"\n      in ssubst)\n   apply (metis parserHFS_parserHFS_F_PARSER_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_PARSER_TC__relation_TSstructureLR_def parserHFS_inst_AX_unmarked_language_finite n_not_Suc_n)\n  apply(rule_tac\n      t=\"parserHFS.unmarked_language (F_PARSER_TC G)\"\n      and s=\"parserHFS.finite_unmarked_language (F_PARSER_TC G)\"\n      in ssubst)\n   apply(rule sym)\n   apply(rule parserHFS.AX_unmarked_language_finite)\n   apply(rule F_PARSER_TC__preserves_PARSER)\n   apply(force)\n  apply(subgoal_tac \"left_total_on (F_PARSER_TC__relation_effectRL SSG1 SSG2) (parserHFS.finite_unmarked_language SSG1) (parserHFS.finite_unmarked_language SSG2)\" for SSG1 SSG2)\n   prefer 2\n   apply(rule_tac\n      ?G2.0=\"G\"\n      in parserHFS_parserHFS_F_PARSER_TC__StateSimRL.ATS_Simulation_Configuration_Weak_Unmarked_Effect_sound)\n   apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in ballE)\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x b)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_effectRL_def)\n  done\n\ntheorem F_PARSER_TC__preserves_lang: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.marked_language G = parserHFS.marked_language (F_PARSER_TC G)\"\n  apply(rule order_antisym)\n   apply (metis F_PARSER_TC__preserves_lang1)\n  apply (metis F_PARSER_TC__preserves_lang2)\n  done\n\ntheorem F_PARSER_TC__preserves_unmarked_language: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.unmarked_language G = parserHFS.unmarked_language (F_PARSER_TC G)\"\n  apply(rule order_antisym)\n   apply (metis F_PARSER_TC__preserves_unmarked_language1)\n  apply (metis F_PARSER_TC__preserves_unmarked_language2)\n  done\n\nlemma F_PARSER_TC__preserves_parser_no_empty_steps_from_marking_states: \"\n  valid_parser M\n  \\<Longrightarrow> parser_no_empty_steps_from_marking_states M\n  \\<Longrightarrow> R = F_PARSER_TC M\n  \\<Longrightarrow> parser_no_empty_steps_from_marking_states R\"\n  apply(simp add: parser_no_empty_steps_from_marking_states_def F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TC__rule_def)\n  apply(clarsimp)\n  apply(simp add: F_PARSER_TC__rule_def)\n  apply(rename_tac x xa)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in allE)\n  apply(clarsimp)\n  apply(rule_tac\n      xs=\"rule_lpop x\"\n      in rev_cases)\n   apply(rename_tac x xa)(*strict*)\n   apply(clarsimp)\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"x\"\n      in ballE)\n    apply(rename_tac x xa)(*strict*)\n    apply(simp add: valid_parser_step_label_def)\n   apply(rename_tac x xa)(*strict*)\n   apply(force)\n  apply(rename_tac x xa ys y)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"y=xa\")\n   apply(rename_tac x xa ys y)(*strict*)\n   apply(force)\n  apply(rename_tac x xa ys y)(*strict*)\n  apply(subgoal_tac \"\\<exists>f. inj_on f (parser_nonterms M) \\<and> f = (SOME f::'a\\<Rightarrow>'d DT_symbol. inj_on f (parser_nonterms M))\")\n   apply(rename_tac x xa ys y)(*strict*)\n   prefer 2\n   apply(rule exists_SOME_injective_is_injective)\n   apply(simp add: valid_parser_def)\n  apply(rename_tac x xa ys y)(*strict*)\n  apply(rule Fun.inj_onD)\n     apply(rename_tac x xa ys y)(*strict*)\n     apply(force)\n    apply(rename_tac x xa ys y)(*strict*)\n    apply(force)\n   apply(rename_tac x xa ys y)(*strict*)\n   apply(simp add: valid_parser_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"x\"\n      in ballE)\n    apply(rename_tac x xa ys y)(*strict*)\n    apply(simp add: valid_parser_step_label_def)\n   apply(rename_tac x xa ys y)(*strict*)\n   apply(force)\n  apply(rename_tac x xa ys y)(*strict*)\n  apply(clarsimp)\n  apply(simp add: valid_parser_def)\n  apply(force)\n  done\n\ndefinition F_PARSER_TC__ISOM_relation_label :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event) parser_step_label\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parser_step_label\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__ISOM_relation_label G1 G2 p1 p2 \\<equiv>\n  p1 \\<in> parser_rules G1\n  \\<and> p2 \\<in> parser_rules G2\n  \\<and> F_PARSER_TC__rule\n      (SOME f. inj_on f (parser_nonterms G1))\n      p1\n    = p2\"\n\ndefinition F_PARSER_TC__ISOM_relation_conf :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__ISOM_relation_conf G1 G2 c1 c2 \\<equiv>\n  c1 \\<in> parserHFS_configurations G1\n  \\<and> c2 \\<in> parserHFS_configurations G2\n  \\<and> c2 = F_PARSER_TCC G1 c1\"\n\ndefinition F_PARSER_TC__ISOM_relation_initial_conf :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB DT_symbol, 'event, nat option) parser\n  \\<Rightarrow> ('stackA, 'event) parserHFS_conf\n  \\<Rightarrow> ('stackB DT_symbol, 'event) parserHFS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__ISOM_relation_initial_conf G1 G2 c1 c2 \\<equiv>\n  c1 \\<in> parserHFS_initial_configurations G1\n  \\<and> c2 \\<in> parserHFS_initial_configurations G2\n  \\<and> c2 = F_PARSER_TCC G1 c1\"\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_TSstructure_closed1: \"\n  (\\<forall>G1. Ex (F_PARSER_TC__relation_TSstructureLR G1) \\<longrightarrow> valid_parser G1)\"\n  apply(clarsimp)\n  apply(rename_tac G1 x)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_TSstructure_closed2: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> valid_parser G2)\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n  apply(clarsimp)\n  apply(rename_tac G1)(*strict*)\n  apply (metis F_PARSER_TC__preserves_PARSER)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_closed1: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1. Ex (F_PARSER_TC__ISOM_relation_conf G1 G2 c1) \\<longrightarrow> c1 \\<in> parserHFS_configurations G1))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 x)(*strict*)\n  apply(simp add: F_PARSER_TC__ISOM_relation_conf_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_closed2: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__ISOM_relation_conf G1 G2 c1 c2 \\<longrightarrow> c2 \\<in> parserHFS_configurations G2))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2)(*strict*)\n  apply(simp add: F_PARSER_TC__ISOM_relation_conf_def)\n  apply(clarsimp)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_for_initial_closed1: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__ISOM_relation_conf G1 G2 c1 c2 \\<longrightarrow> c1 \\<in> parserHFS_initial_configurations G1 \\<longrightarrow> c2 \\<in> parserHFS_initial_configurations G2))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2)(*strict*)\n  apply(simp add: F_PARSER_TC__ISOM_relation_conf_def F_PARSER_TC__relation_TSstructureLR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 c1)(*strict*)\n  apply(metis F_PARSER_TC__C_preserves_initial_configurations F_PARSER_TC__relation_TSstructureLR_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_for_initial_closed2: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__ISOM_relation_conf G1 G2 c1 c2 \\<longrightarrow> c2 \\<in> parserHFS_initial_configurations G2 \\<longrightarrow> c1 \\<in> parserHFS_initial_configurations G1))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2)(*strict*)\n  apply(simp add: F_PARSER_TC__ISOM_relation_conf_def F_PARSER_TC__relation_TSstructureLR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 c1)(*strict*)\n  apply (metis (poly_guards_query) F_PARSER_TCC_reverse2 F_PARSER_TC__C_rev_preserves_initial_configurations F_PARSER_TC__relation_TSstructureRL_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_label_closed1: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>e1. Ex (F_PARSER_TC__ISOM_relation_label G1 G2 e1) \\<longrightarrow> e1 \\<in> parser_step_labels G1))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 e1 x)(*strict*)\n  apply(simp add: F_PARSER_TC__ISOM_relation_label_def parser_step_labels_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_label_closed2: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>e1 e2. F_PARSER_TC__ISOM_relation_label G1 G2 e1 e2 \\<longrightarrow> e2 \\<in> parser_step_labels G2))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 e1 e2)(*strict*)\n  apply(simp add: F_PARSER_TC__ISOM_relation_label_def parser_step_labels_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_bijection_on: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> bijection_on (F_PARSER_TC__ISOM_relation_conf G1 G2) (parserHFS_configurations G1) (parserHFS_configurations G2) )\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(rule bijection_on_intro)\n     apply(rename_tac G1 G2)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac G1 G2 a)(*strict*)\n     apply(simp add: F_PARSER_TC__ISOM_relation_conf_def F_PARSER_TC__relation_TSstructureLR_def)\n     apply(clarsimp)\n     apply(rename_tac G1 a)(*strict*)\n     apply (metis (mono_tags, hide_lams) F_PARSER_TC__C_preserves_configurations F_PARSER_TC__relation_TSstructureLR_def)\n    apply(rename_tac G1 G2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 b)(*strict*)\n    apply(simp add: F_PARSER_TC__relation_TSstructureLR_def F_PARSER_TC__ISOM_relation_conf_def)\n    apply(clarsimp)\n    apply(rename_tac G1 b)(*strict*)\n    apply(rule_tac\n      x=\"F_PARSER_TCCRev G1 b\"\n      in bexI)\n     apply(rename_tac G1 b)(*strict*)\n     apply (metis F_PARSER_TCC_reverse)\n    apply(rename_tac G1 b)(*strict*)\n    apply (metis F_PARSER_TC__C_rev_preserves_configurations F_PARSER_TC__relation_TSstructureRL_def)\n   apply(rename_tac G1 G2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 a b1 b2)(*strict*)\n   apply(simp add: F_PARSER_TC__ISOM_relation_conf_def)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 b a1 a2)(*strict*)\n  apply(simp add: F_PARSER_TC__ISOM_relation_conf_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 a1 a2)(*strict*)\n  apply (metis F_PARSER_TCC_reverse2 F_PARSER_TC__relation_TSstructureLR_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_label_bijection_on: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> bijection_on (F_PARSER_TC__ISOM_relation_label G1 G2) (parser_step_labels G1) (parser_step_labels G2) )\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(rule bijection_on_intro)\n     apply(rename_tac G1 G2)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac G1 G2 a)(*strict*)\n     apply(simp add: F_PARSER_TC__ISOM_relation_label_def F_PARSER_TC__relation_TSstructureLR_def parser_step_labels_def F_PARSER_TC_def F_PARSER_TC__parser_def)\n    apply(rename_tac G1 G2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 b)(*strict*)\n    apply(simp add: F_PARSER_TC__ISOM_relation_label_def F_PARSER_TC__relation_TSstructureLR_def parser_step_labels_def)\n    apply(clarsimp)\n    apply(rename_tac G1 b)(*strict*)\n    apply(rule_tac\n      x=\"F_PARSER_TC__ruleRev ((inv_into (parser_nonterms G1) (SOME f. inj_on f (parser_nonterms G1)))) b\"\n      in bexI)\n     apply(rename_tac G1 b)(*strict*)\n     prefer 2\n     apply (metis F_PARSER_TCRRev_def F_PARSER_TCRRev_preserves_edges)\n    apply(rename_tac G1 b)(*strict*)\n    apply(simp add: F_PARSER_TC_def F_PARSER_TC__parser_def)\n    apply(clarsimp)\n    apply(rename_tac G1 x)(*strict*)\n    apply(rule_tac\n      t=\"F_PARSER_TC__ruleRev (inv_into (parser_nonterms G1) (SOME f. inj_on f (parser_nonterms G1))) (F_PARSER_TC__rule (SOME f. inj_on f (parser_nonterms G1)) x)\"\n      and s=\"x\"\n      in ssubst)\n     apply(rename_tac G1 x)(*strict*)\n     apply(rule rule_reversal)\n      apply(rename_tac G1 x)(*strict*)\n      apply(simp add: valid_pda_def)\n     apply(rename_tac G1 x)(*strict*)\n     apply(force)\n    apply(rename_tac G1 x)(*strict*)\n    apply(simp add: F_PARSER_TC__rule_def)\n   apply(rename_tac G1 G2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 a b1 b2)(*strict*)\n   apply(simp add: F_PARSER_TC__ISOM_relation_label_def)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(simp add: F_PARSER_TC__ISOM_relation_label_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 a1 a2)(*strict*)\n  apply (metis F_PARSER_TC__relation_TSstructureLR_def rule_reversal)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_marking_configuration1_equivalent: \"\n  (\\<forall>G1. valid_parser G1 \\<longrightarrow> (\\<forall>d1. parserHFS.derivation_initial G1 d1 \\<longrightarrow> parserHFS_marking_condition G1 d1 = (\\<exists>i c1. get_configuration (d1 i) = Some c1 \\<and> c1 \\<in> parserHFS_marking_configurations G1)))\"\n  apply(clarsimp)\n  apply(rename_tac G1 d1)(*strict*)\n  apply(simp add: parserHFS_marking_condition_def)\n  apply(rule antisym)\n   apply(rename_tac G1 d1)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 d1 i e c)(*strict*)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac G1 d1)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 d1 i c1)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(simp add: get_configuration_def)\n  apply(case_tac \"d1 i\")\n   apply(rename_tac G1 d1 i c1)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G1 d1 i c1 a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac G1 d1 i c1 a option conf)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_preserves_marking_configuration: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__ISOM_relation_conf G1 G2 c1 c2 \\<longrightarrow> (c1 \\<in> parserHFS_marking_configurations G1) = (c2 \\<in> parserHFS_marking_configurations G2)))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2)(*strict*)\n  apply(rule antisym)\n   apply(rename_tac G1 G2 c1 c2)(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_PARSER_TC__ISOM_relation_conf_def)\n   apply (metis F_PARSER_TC__C_preserves_marking_configurations)\n  apply(rename_tac G1 G2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(simp add: F_PARSER_TC__ISOM_relation_conf_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply (metis F_PARSER_TCC_reverse2 F_PARSER_TC__C_rev_preserves_marking_configurations F_PARSER_TC__relation_TSstructureLR_def F_PARSER_TC__relation_TSstructureRL_def)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_step_preservation1: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__ISOM_relation_conf G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1 c1'. parserHFS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>e2. F_PARSER_TC__ISOM_relation_label G1 G2 e1 e2 \\<longrightarrow> (\\<forall>c2'. F_PARSER_TC__ISOM_relation_conf G1 G2 c1' c2' \\<longrightarrow> parserHFS_step_relation G2 c2 e2 c2')))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' e2 c2')(*strict*)\n  apply(simp add: F_PARSER_TC__ISOM_relation_label_def F_PARSER_TC__ISOM_relation_conf_def F_PARSER_TC__relation_TSstructureLR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply (metis F_PARSER_TCR_def F_PARSER_TC__preserves_step_relation)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_step_preservation2: \"\n  (\\<forall>G1 G2. F_PARSER_TC__relation_TSstructureLR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_PARSER_TC__ISOM_relation_conf G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e2 c2'. parserHFS_step_relation G2 c2 e2 c2' \\<longrightarrow> (\\<forall>e1. F_PARSER_TC__ISOM_relation_label G1 G2 e1 e2 \\<longrightarrow> (\\<forall>c1'. F_PARSER_TC__ISOM_relation_conf G1 G2 c1' c2' \\<longrightarrow> parserHFS_step_relation G1 c1 e1 c1')))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e2 c2' e1 c1')(*strict*)\n  apply(simp add: F_PARSER_TC__ISOM_relation_label_def F_PARSER_TC__ISOM_relation_conf_def F_PARSER_TC__relation_TSstructureLR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   prefer 2\n   apply(rule F_PARSER_TCRev_preserves_step_relation)\n    apply(rename_tac G1 c1 e1 c1')(*strict*)\n    apply(simp add: F_PARSER_TC__relation_TSstructureRL_def)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(rule_tac\n      t=\"c1\"\n      and s=\"(F_PARSER_TCCRev G1 (F_PARSER_TCC G1 c1))\"\n      in ssubst)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   apply (simp add: F_PARSER_TCC_reverse2)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(rule_tac\n      t=\"c1'\"\n      and s=\"(F_PARSER_TCCRev G1 (F_PARSER_TCC G1 c1'))\"\n      in ssubst)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   apply (simp add: F_PARSER_TCC_reverse2)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(rule_tac\n      t=\"e1\"\n      and s=\" (F_PARSER_TCRRev G1 (F_PARSER_TC__rule (SOME f. inj_on f (parser_nonterms G1)) e1))\"\n      in ssubst)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   apply(simp add: F_PARSER_TC__ISOM_relation_label_def F_PARSER_TC__relation_TSstructureLR_def parser_step_labels_def F_PARSER_TC_def F_PARSER_TC__parser_def F_PARSER_TCRRev_def)\n   apply(rule sym)\n   apply(rule rule_reversal)\n    apply(rename_tac G1 c1 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(force)\n  done\n\nlemma parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_ATS_Isomorphism_axioms: \"\n  ATS_Isomorphism_axioms valid_parser parserHFS_configurations parserHFS_initial_configurations parser_step_labels parserHFS_step_relation parserHFS_marking_condition valid_parser parserHFS_configurations parserHFS_initial_configurations parser_step_labels parserHFS_step_relation parserHFS_marking_condition (\\<lambda>G c. c \\<in> parserHFS_marking_configurations G) (\\<lambda>G c. c \\<in> parserHFS_marking_configurations G) F_PARSER_TC__relation_TSstructureLR F_PARSER_TC__ISOM_relation_conf F_PARSER_TC__ISOM_relation_label\"\n  apply(simp add: ATS_Isomorphism_axioms_def)\n  apply(simp add: parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_TSstructure_closed1 parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_TSstructure_closed2 parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_closed1 parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_closed2 parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_for_initial_closed1 parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_for_initial_closed2 parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_label_closed1 parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_label_closed2 parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_bijection_on parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_label_bijection_on parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_marking_configuration1_equivalent parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_relation_configuration_preserves_marking_configuration parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_step_preservation1 parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_AX_step_preservation2 )\n  done\n\ninterpretation \"parserHFS_parserHFS_F_PARSER_TC__ISOM\" : ATS_Isomorphism\n  (* TSstructure1 *)\n  \"valid_parser\"\n  (* configurations1 *)\n  \"parserHFS_configurations\"\n  (* initial_configurations1 *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels1 *)\n  \"parser_step_labels\"\n  (* step_relation1 *)\n  \"parserHFS_step_relation\"\n  (* effects1 *)\n  \"parser_markers\"\n  (* marking_condition1 *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect1 *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect1 *)\n  \"parserHFS_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_parser\"\n  (* configurations2 *)\n  \"parserHFS_configurations\"\n  (* initial_configurations2 *)\n  \"parserHFS_initial_configurations\"\n  (* step_labels2 *)\n  \"parser_step_labels\"\n  (* step_relation2 *)\n  \"parserHFS_step_relation\"\n  (* effects2 *)\n  \"parser_markers\"\n  (* marking_condition2 *)\n  \"parserHFS_marking_condition\"\n  (* marked_effect2 *)\n  \"parserHFS_marked_effect\"\n  (* unmarked_effect2 *)\n  \"parserHFS_unmarked_effect\"\n  (* marking_configuration1 *)\n  \"(\\<lambda>G c. c \\<in> parserHFS_marking_configurations G)\"\n  (* marking_configuration2 *)\n  \"(\\<lambda>G c. c \\<in> parserHFS_marking_configurations G)\"\n  (* relation_TSstructure *)\n  \"F_PARSER_TC__relation_TSstructureLR\"\n  (* relation_configuration *)\n  \"F_PARSER_TC__ISOM_relation_conf\"\n  (* relation_label *)\n  \"F_PARSER_TC__ISOM_relation_label\"\n  apply(simp add: LOCALE_DEFS parser_interpretations)\n  apply(simp add: parserHFS_parserHFS_F_PARSER_TC__ISOM_inst_ATS_Isomorphism_axioms)\n  done\n\ntheorem F_PARSER_TC__preserves_is_forward_edge_deterministic_accessible: \"\n  valid_parser G\n  \\<Longrightarrow> parserHFS.is_forward_edge_deterministic_accessible G\n  \\<Longrightarrow> parserHFS.is_forward_edge_deterministic_accessible (F_PARSER_TC G)\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      ?G1.0=\"G\"\n      and ?G2.0=\"F_PARSER_TC G\"\n      in parserHFS_parserHFS_F_PARSER_TC__ISOM.is_forward_edge_deterministic_accessible_preservation)\n    apply(simp add: F_PARSER_TC__relation_TSstructureLR_def)\n   apply(force)\n  apply(force)\n  done\n\ndefinition F_PARSER_TC__SpecInput :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__SpecInput G \\<equiv>\n  valid_bounded_parser G (Suc 0)\n  \\<and> parserFS.is_forward_edge_deterministic_accessible G\n  \\<and> parser_not_observes_input_terminator G\n  \\<and> nonblockingness_language (parserS.unmarked_language G) (parserS.marked_language G)\n  \\<and> parser_no_top_rules G\n  \\<and> parser_no_empty_steps_from_marking_states G\"\n\ndefinition F_PARSER_TC__SpecOutput :: \"\n  ('stackA, 'event, 'marker) parser\n  \\<Rightarrow> ('stackB, 'event, nat option) parser\n  \\<Rightarrow> bool\"\n  where\n    \"F_PARSER_TC__SpecOutput Gi Go \\<equiv>\n  valid_bounded_parser Go (Suc 0)\n  \\<and> parserFS.is_forward_edge_deterministic_accessible Go\n  \\<and> parser_not_observes_input_terminator Go\n  \\<and> parser_no_top_rules Go\n  \\<and> parserS.marked_language Gi = parserS.marked_language Go\n  \\<and> nonblockingness_language (parserS.unmarked_language Go) (parserS.marked_language Go)\n  \\<and> parser_no_empty_steps_from_marking_states Go\"\n\ntheorem F_PARSER_TC__SOUND: \"\n  F_PARSER_TC__SpecInput G\n  \\<Longrightarrow> F_PARSER_TC__SpecOutput G (F_PARSER_TC G)\"\n  apply(simp add: F_PARSER_TC__SpecInput_def F_PARSER_TC__SpecOutput_def)\n  apply(clarsimp)\n  apply(rule context_conjI)\n   apply(rule F_PARSER_TC__preserves_PARSERk)\n   apply(force)\n  apply(rule context_conjI)\n   apply(rule_tac\n      ?G1.0=\"F_PARSER_TC G\"\n      in parserS_vs_parserFS.preserve_FEdetermR1)\n    apply(simp add: valid_bounded_parser_def)\n   apply(rule_tac\n      ?G1.0=\"F_PARSER_TC G\"\n      in parserS_vs_parserHFS.preserve_FEdetermR2)\n    apply(simp add: valid_bounded_parser_def)\n   apply(rule F_PARSER_TC__preserves_is_forward_edge_deterministic_accessible)\n    apply(simp add: valid_bounded_parser_def)\n   apply(rule_tac\n      ?G2.0=\"G\"\n      in parserS_vs_parserHFS.preserve_FEdetermR1)\n    apply(simp add: valid_bounded_parser_def)\n    apply(force)\n   apply(rule_tac\n      ?G2.0=\"G\"\n      in parserS_vs_parserFS.preserve_FEdetermR2)\n    apply(simp add: valid_bounded_parser_def)\n   apply(force)\n  apply(rule context_conjI)\n   apply(rule_tac\n      G=\"G\"\n      in F_PARSER_TC__preserves_parser_not_observes_input_terminator)\n    apply(simp add: valid_bounded_parser_def)\n   apply(force)\n  apply(rule context_conjI)\n   apply(rule_tac\n      G=\"G\"\n      in F_PARSER_TC__preserves_parser_no_top_rules)\n    apply(simp add: valid_bounded_parser_def)\n   apply(force)\n  apply(subgoal_tac \"(parserHFS.Nonblockingness_linear_DB SSG \\<longleftrightarrow> parserS.Nonblockingness_linear_DB SSG) \\<and> parserHFS.unmarked_language SSG = parserS.unmarked_language SSG \\<and> parserHFS.marked_language SSG = parserS.marked_language SSG\" for SSG)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      in parserS_vs_parserHFS_Nonblockingness_and_lang_transfer)\n   apply(simp add: valid_bounded_parser_def)\n  apply(subgoal_tac \"(parserHFS.Nonblockingness_linear_DB SSG \\<longleftrightarrow> parserS.Nonblockingness_linear_DB SSG) \\<and> parserHFS.unmarked_language SSG = parserS.unmarked_language SSG \\<and> parserHFS.marked_language SSG = parserS.marked_language SSG\" for SSG)\n   prefer 2\n   apply(rule_tac\n      G=\"F_PARSER_TC G\"\n      in parserS_vs_parserHFS_Nonblockingness_and_lang_transfer)\n   apply(simp add: valid_bounded_parser_def)\n   apply(force)\n  apply(rule context_conjI)\n   apply(rule_tac\n      t=\"parserS.marked_language G\"\n      and s=\"parserHFS.marked_language G\"\n      in ssubst)\n    apply(force)\n   apply(rule_tac\n      t=\"parserS.marked_language (F_PARSER_TC G)\"\n      and s=\"parserHFS.marked_language (F_PARSER_TC G)\"\n      in subst)\n    apply(force)\n   apply(rule_tac\n      G=\"G\"\n      in F_PARSER_TC__preserves_lang)\n   apply(simp add: valid_bounded_parser_def)\n  apply(subgoal_tac \"parserS.unmarked_language G = parserS.unmarked_language (F_PARSER_TC G)\")\n   prefer 2\n   apply(rule_tac\n      t=\"parserS.unmarked_language G\"\n      and s=\"parserHFS.unmarked_language G\"\n      in ssubst)\n    apply(force)\n   apply(rule_tac\n      t=\"parserS.unmarked_language (F_PARSER_TC G)\"\n      and s=\"parserHFS.unmarked_language (F_PARSER_TC G)\"\n      in subst)\n    apply(force)\n   apply(rule_tac\n      G=\"G\"\n      in F_PARSER_TC__preserves_unmarked_language)\n   apply(simp add: valid_bounded_parser_def)\n  apply(clarsimp)\n  apply(rule_tac\n      M=\"G\"\n      in F_PARSER_TC__preserves_parser_no_empty_steps_from_marking_states)\n    apply(simp add: valid_bounded_parser_def)\n   apply(force)\n  apply(force)\n  done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_03_02/FUNCTION__PARSER_TC__PARSER_TYPE_CONVERSION.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.32532249473868396}}
{"text": "(* \n    This file is a part of IsarMathLib - \n    a library of formalized mathematics written for Isabelle/Isar.\n\n    Copyright (C) 2013  Daniel de la Concepcion\n\n    This program is free software; Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,\nINCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\nPARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,\nINDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE, DATA, OR PROFITS OR\nBUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\nSTRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE\nUSE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\nsection \\<open>Topological groups 3\\<close>\n\ntheory TopologicalGroup_ZF_3 imports Topology_ZF_10 TopologicalGroup_ZF_2 TopologicalGroup_ZF_1\n  Group_ZF_4\n\nbegin\n\ntext\\<open>This theory deals with topological properties of subgroups, quotient groups\nand relations between group theorical properties and topological properties.\\<close>\n\nsubsection\\<open>Subgroups topologies\\<close>\n\ntext\\<open>The closure of a subgroup is a subgroup.\\<close>\n\ntheorem (in topgroup) closure_subgroup:\n  assumes \"IsAsubgroup(H,f)\"\n  shows \"IsAsubgroup(cl(H),f)\"\nproof-\n  have two:\"two_top_spaces0(ProductTopology(T,T),T,f)\" unfolding two_top_spaces0_def using\n    topSpaceAssum Top_1_4_T1(1,3) topgroup_f_binop by auto\n  from fcon have cont:\"IsContinuous(ProductTopology(T,T),T,f)\" by auto\n  then have closed:\"\\<forall>D. D{is closed in}T \\<longrightarrow> f-``D{is closed in}\\<tau>\" using two_top_spaces0.TopZF_2_1_L1\n    two by auto\n  then have closure:\"\\<forall>A\\<in>Pow(\\<Union>\\<tau>). f``(Closure(A,\\<tau>))\\<subseteq>cl(f``A)\" using two_top_spaces0.Top_ZF_2_1_L2\n    two by force\n  have sub1:\"H\\<subseteq>G\" using group0.group0_3_L2 group0_valid_in_tgroup assms by force\n  then have sub:\"(H)\\<times>(H)\\<subseteq>\\<Union>\\<tau>\" using prod_top_on_G(2) by auto\n  from sub1 have clHG:\"cl(H)\\<subseteq>G\" using Top_3_L11(1) by auto\n  then have clHsub1:\"cl(H)\\<times>cl(H)\\<subseteq>G\\<times>G\" by auto\n  have \"Closure(H\\<times>H,ProductTopology(T,T))=cl(H)\\<times>cl(H)\" using cl_product\n    topSpaceAssum group0.group0_3_L2 group0_valid_in_tgroup assms by auto\n  then have \"f``(Closure(H\\<times>H,ProductTopology(T,T)))=f``(cl(H)\\<times>cl(H))\" by auto\n  with closure sub have clcl:\"f``(cl(H)\\<times>cl(H))\\<subseteq>cl(f``(H\\<times>H))\" by force\n  from assms have fun:\"restrict(f,H\\<times>H):H\\<times>H\\<rightarrow>H\" unfolding IsAsubgroup_def using\n    group0.group_oper_fun unfolding group0_def by auto\n  then have \"restrict(f,H\\<times>H)``(H\\<times>H)=f``(H\\<times>H)\" using restrict_image by auto\n  moreover from fun have \"restrict(f,H\\<times>H)``(H\\<times>H)\\<subseteq>H\" using func1_1_L6(2) by blast\n  ultimately have \"f``(H\\<times>H)\\<subseteq>H\" by auto\n  with sub1 have \"f``(H\\<times>H)\\<subseteq>H\"\"f``(H\\<times>H)\\<subseteq>G\"\"H\\<subseteq>G\" by auto\n  then have \"cl(f``(H\\<times>H))\\<subseteq>cl(H)\" using top_closure_mono by auto\n  with clcl have img:\"f``(cl(H)\\<times>cl(H))\\<subseteq>cl(H)\" by auto\n  {\n    fix x y assume \"x\\<in>cl(H)\"\"y\\<in>cl(H)\"\n    then have \"\\<langle>x,y\\<rangle>\\<in>cl(H)\\<times>cl(H)\" by auto moreover\n    have \"f``(cl(H)\\<times>cl(H))={f`t. t\\<in>cl(H)\\<times>cl(H)}\" using func_imagedef topgroup_f_binop \n      clHsub1 by auto ultimately\n    have \"f`\\<langle>x,y\\<rangle>\\<in>f``(cl(H)\\<times>cl(H))\" by auto\n    with img have \"f`\\<langle>x,y\\<rangle>\\<in>cl(H)\" by auto\n  }\n  then have A1:\"cl(H){is closed under} f\" unfolding IsOpClosed_def by auto\n  have two:\"two_top_spaces0(T,T,GroupInv(G,f))\" unfolding two_top_spaces0_def using\n    topSpaceAssum Ggroup group0_2_T2 by auto\n  from inv_cont have cont:\"IsContinuous(T,T,GroupInv(G,f))\" by auto\n  then have closed:\"\\<forall>D. D{is closed in}T \\<longrightarrow> GroupInv(G,f)-``D{is closed in}T\" using two_top_spaces0.TopZF_2_1_L1\n    two by auto\n  then have closure:\"\\<forall>A\\<in>Pow(\\<Union>T). GroupInv(G,f)``(cl(A))\\<subseteq>cl(GroupInv(G,f)``A)\" using two_top_spaces0.Top_ZF_2_1_L2\n    two by force\n  with sub1 have Inv:\"GroupInv(G,f)``(cl(H))\\<subseteq>cl(GroupInv(G,f)``H)\" by auto moreover\n  have \"GroupInv(H,restrict(f,H\\<times>H)):H\\<rightarrow>H\" using assms unfolding IsAsubgroup_def using group0_2_T2 by auto then\n  have \"GroupInv(H,restrict(f,H\\<times>H))``H\\<subseteq>H\" using func1_1_L6(2) by auto\n  then have \"restrict(GroupInv(G,f),H)``H\\<subseteq>H\" using group0.group0_3_T1 assms group0_valid_in_tgroup by auto\n  then have sss:\"GroupInv(G,f)``H\\<subseteq>H\" using restrict_image by auto\n  then have \"H\\<subseteq>G\" \"GroupInv(G,f)``H\\<subseteq>G\" using sub1 by auto\n  with sub1 sss have \"cl(GroupInv(G,f)``H)\\<subseteq>cl(H)\" using top_closure_mono by auto ultimately\n  have img:\"GroupInv(G,f)``(cl(H))\\<subseteq>cl(H)\" by auto\n  {\n    fix x assume \"x\\<in>cl(H)\" moreover\n    have \"GroupInv(G,f)``(cl(H))={GroupInv(G,f)`t. t\\<in>cl(H)}\" using func_imagedef Ggroup group0_2_T2\n      clHG by force ultimately\n    have \"GroupInv(G,f)`x\\<in>GroupInv(G,f)``(cl(H))\" by auto\n    with img have \"GroupInv(G,f)`x\\<in>cl(H)\" by auto\n  }\n  then have A2:\"\\<forall>x\\<in>cl(H). GroupInv(G,f)`x\\<in>cl(H)\" by auto\n  from assms have \"H\\<noteq>0\" using group0.group0_3_L5 group0_valid_in_tgroup by auto moreover\n  have \"H\\<subseteq>cl(H)\" using cl_contains_set sub1 by auto ultimately\n  have \"cl(H)\\<noteq>0\" by auto\n  with clHG A2 A1 show ?thesis using group0.group0_3_T3 group0_valid_in_tgroup by auto\nqed\n\ntext\\<open>The closure of a normal subgroup is normal.\\<close>\n\ntheorem (in topgroup) normal_subg:\n  assumes \"IsAnormalSubgroup(G,f,H)\"\n  shows \"IsAnormalSubgroup(G,f,cl(H))\"\nproof-\n  have A:\"IsAsubgroup(cl(H),f)\" using closure_subgroup assms unfolding IsAnormalSubgroup_def by auto\n  have sub1:\"H\\<subseteq>G\" using group0.group0_3_L2 group0_valid_in_tgroup assms unfolding IsAnormalSubgroup_def by auto\n  then have sub2:\"cl(H)\\<subseteq>G\" using Top_3_L11(1) by auto\n  {\n    fix g assume g:\"g\\<in>G\"\n    then have cl1:\"cl(g\\<ltr>H)=g\\<ltr>cl(H)\" using trans_closure sub1 by auto\n    have ss:\"g\\<ltr>cl(H)\\<subseteq>G\" unfolding ltrans_def LeftTranslation_def by auto\n    have \"g\\<ltr>H\\<subseteq>G\" unfolding ltrans_def LeftTranslation_def by auto\n    moreover from g have \"(\\<rm>g)\\<in>G\" using neg_in_tgroup by auto\n    ultimately have cl2:\"cl((g\\<ltr>H)\\<rtr>(\\<rm>g))=cl(g\\<ltr>H)\\<rtr>(\\<rm>g)\" using trans_closure2\n      by auto\n    with cl1 have clcon:\"cl((g\\<ltr>H)\\<rtr>(\\<rm>g))=(g\\<ltr>(cl(H)))\\<rtr>(\\<rm>g)\" by auto\n    {\n      fix r assume \"r\\<in>(g\\<ltr>H)\\<rtr>(\\<rm>g)\"\n      then obtain q where q:\"q\\<in>g\\<ltr>H\" \"r=q\\<ra>(\\<rm>g)\" unfolding rtrans_def RightTranslation_def\n        by force\n      from q(1) obtain h where \"h\\<in>H\" \"q=g\\<ra>h\" unfolding ltrans_def LeftTranslation_def by auto\n      with q(2) have \"r=(g\\<ra>h)\\<ra>(\\<rm>g)\" by auto\n      with \\<open>h\\<in>H\\<close> \\<open>g\\<in>G\\<close> \\<open>(\\<rm>g)\\<in>G\\<close> have \"r\\<in>H\" using assms unfolding IsAnormalSubgroup_def\n        grinv_def grop_def by auto\n    }\n    then have \"(g\\<ltr>H)\\<rtr>(\\<rm>g)\\<subseteq>H\" by auto\n    moreover then have \"(g\\<ltr>H)\\<rtr>(\\<rm>g)\\<subseteq>G\"\"H\\<subseteq>G\" using sub1 by auto ultimately\n    have \"cl((g\\<ltr>H)\\<rtr>(\\<rm>g))\\<subseteq>cl(H)\" using top_closure_mono by auto\n    with clcon have \"(g\\<ltr>(cl(H)))\\<rtr>(\\<rm>g)\\<subseteq>cl(H)\" by auto moreover\n    {\n      fix b assume \"b\\<in>{g\\<ra>(d\\<rs>g). d\\<in>cl(H)}\"\n      then obtain d where d:\"d\\<in>cl(H)\" \"b=g\\<ra>(d\\<rs>g)\" by auto moreover\n      then have \"d\\<in>G\" using sub2 by auto \n      then have \"g\\<ra>d\\<in>G\" using group0.group_op_closed[OF group0_valid_in_tgroup \\<open>g\\<in>G\\<close>] by auto\n      from d(2) have b:\"b=(g\\<ra>d)\\<rs>g\" using group0.group_oper_assoc[OF group0_valid_in_tgroup \\<open>g\\<in>G\\<close> \\<open>d\\<in>G\\<close>\\<open>(\\<rm>g)\\<in>G\\<close>] \n        unfolding grsub_def grop_def grinv_def by blast\n      have \"(g\\<ra>d)=LeftTranslation(G,f,g)`d\" using group0.group0_5_L2(2)[OF group0_valid_in_tgroup]\n        \\<open>g\\<in>G\\<close>\\<open>d\\<in>G\\<close> by auto\n      with \\<open>d\\<in>cl(H)\\<close> have \"g\\<ra>d\\<in>g\\<ltr>cl(H)\" unfolding ltrans_def using func_imagedef[OF group0.group0_5_L1(2)[\n        OF group0_valid_in_tgroup \\<open>g\\<in>G\\<close>] sub2] by auto\n      moreover from b have \"b=RightTranslation(G,f,\\<rm>g)`(g\\<ra>d)\" using group0.group0_5_L2(1)[OF group0_valid_in_tgroup]\n        \\<open>(\\<rm>g)\\<in>G\\<close>\\<open>g\\<ra>d\\<in>G\\<close> by auto\n      ultimately have \"b\\<in>(g\\<ltr>cl(H))\\<rtr>(\\<rm>g)\" unfolding rtrans_def using func_imagedef[OF group0.group0_5_L1(1)[\n        OF group0_valid_in_tgroup \\<open>(\\<rm>g)\\<in>G\\<close>] ss] by force\n    }\n    ultimately have \"{g\\<ra>(d\\<rs>g). d\\<in>cl(H)}\\<subseteq>cl(H)\" by force\n  }\n  then show ?thesis using A group0.cont_conj_is_normal[OF group0_valid_in_tgroup, of \"cl(H)\"]\n    unfolding grsub_def grinv_def grop_def by auto\nqed\n\ntext\\<open>Every open subgroup is also closed.\\<close>\n\ntheorem (in topgroup) open_subgroup_closed:\n  assumes \"IsAsubgroup(H,f)\" \"H\\<in>T\"\n  shows \"H{is closed in}T\"\nproof-\n  from assms(1) have sub:\"H\\<subseteq>G\" using group0.group0_3_L2 group0_valid_in_tgroup by force\n  {\n    fix t assume \"t\\<in>G-H\"\n    then have tnH:\"t\\<notin>H\" and tG:\"t\\<in>G\" by auto\n    from assms(1) have sub:\"H\\<subseteq>G\" using group0.group0_3_L2 group0_valid_in_tgroup by force\n    from assms(1) have nSubG:\"\\<zero>\\<in>H\" using group0.group0_3_L5 group0_valid_in_tgroup by auto\n    from assms(2) tG have P:\"t\\<ltr>H\\<in>T\" using open_tr_open(1) by auto\n    from nSubG sub tG have tp:\"t\\<in>t\\<ltr>H\" using group0_valid_in_tgroup group0.neut_trans_elem\n      by auto\n    {\n      fix x assume \"x\\<in>(t\\<ltr>H)\\<inter>H\"\n      then obtain u where \"x=t\\<ra>u\" \"u\\<in>H\" \"x\\<in>H\" unfolding ltrans_def LeftTranslation_def by auto\n      then have \"u\\<in>G\"\"x\\<in>G\"\"t\\<in>G\" using sub tG by auto\n      with \\<open>x=t\\<ra>u\\<close> have \"x\\<ra>(\\<rm>u)=t\" using group0.group0_2_L18(1) group0_valid_in_tgroup\n        unfolding grop_def grinv_def by auto\n      from \\<open>u\\<in>H\\<close> have \"(\\<rm>u)\\<in>H\" unfolding grinv_def using assms(1) group0.group0_3_T3A group0_valid_in_tgroup\n        by auto\n      with \\<open>x\\<in>H\\<close> have \"x\\<ra>(\\<rm>u)\\<in>H\" unfolding grop_def using assms(1) group0.group0_3_L6 group0_valid_in_tgroup\n        by auto\n      with \\<open>x\\<ra>(\\<rm>u)=t\\<close> have \"False\" using tnH by auto\n    }\n    then have \"(t\\<ltr>H)\\<inter>H=0\" by auto moreover\n    have \"t\\<ltr>H\\<subseteq>G\" unfolding ltrans_def LeftTranslation_def by auto ultimately\n    have \"(t\\<ltr>H)\\<subseteq>G-H\" by auto\n    with tp P have \"\\<exists>V\\<in>T. t\\<in>V \\<and> V\\<subseteq>G-H\" unfolding Bex_def by auto\n  }\n  then have \"\\<forall>t\\<in>G-H. \\<exists>V\\<in>T. t\\<in>V \\<and> V\\<subseteq>G-H\" by auto\n  then have \"G-H\\<in>T\" using open_neigh_open by auto\n  then show ?thesis unfolding IsClosed_def using sub by auto\nqed\n\ntext\\<open>Any subgroup with non-empty interior is open.\\<close>\n\ntheorem (in topgroup) clopen_or_emptyInt:\n  assumes \"IsAsubgroup(H,f)\" \"int(H)\\<noteq>0\"\n  shows \"H\\<in>T\"\nproof-\n  from assms(1) have sub:\"H\\<subseteq>G\" using group0.group0_3_L2 group0_valid_in_tgroup by force\n  {\n    fix h assume \"h\\<in>H\"\n    have intsub:\"int(H)\\<subseteq>H\" using Top_2_L1 by auto\n    from assms(2) obtain u where \"u\\<in>int(H)\" by auto\n    with intsub have \"u\\<in>H\" by auto\n    then have \"(\\<rm>u)\\<in>H\" unfolding grinv_def using assms(1) group0.group0_3_T3A group0_valid_in_tgroup\n      by auto\n    with \\<open>h\\<in>H\\<close> have \"h\\<rs>u\\<in>H\" unfolding grop_def using assms(1) group0.group0_3_L6 group0_valid_in_tgroup\n      by auto\n    {\n      fix t assume \"t\\<in>(h\\<rs>u)\\<ltr>(int(H))\"\n      then obtain r where \"r\\<in>int(H)\"\"t=(h\\<rs>u)\\<ra>r\" unfolding grsub_def grinv_def grop_def\n        ltrans_def LeftTranslation_def by auto\n      then have \"r\\<in>H\" using intsub by auto\n      with \\<open>h\\<rs>u\\<in>H\\<close> have \"(h\\<rs>u)\\<ra>r\\<in>H\" unfolding grop_def using assms(1) group0.group0_3_L6 group0_valid_in_tgroup\n        by auto\n      with \\<open>t=(h\\<rs>u)\\<ra>r\\<close> have \"t\\<in>H\" by auto\n    }\n    then have ss:\"(h\\<rs>u)\\<ltr>(int(H))\\<subseteq>H\" by auto\n    have P:\"(h\\<rs>u)\\<ltr>(int(H))\\<in>T\" using open_tr_open(1) \\<open>h\\<rs>u\\<in>H\\<close> Top_2_L2 sub by blast\n    from \\<open>h\\<rs>u\\<in>H\\<close>\\<open>u\\<in>H\\<close>\\<open>h\\<in>H\\<close> sub have \"(h\\<rs>u)\\<in>G\" \"u\\<in>G\"\"h\\<in>G\" by auto\n    have \"int(H)\\<subseteq>G\" using sub intsub by auto moreover\n    have \"LeftTranslation(G,f,(h\\<rs>u))\\<in>G\\<rightarrow>G\" using group0.group0_5_L1(2) group0_valid_in_tgroup \\<open>(h\\<rs>u)\\<in>G\\<close>\n      by auto ultimately\n    have \"LeftTranslation(G,f,(h\\<rs>u))``(int(H))={LeftTranslation(G,f,(h\\<rs>u))`r. r\\<in>int(H)}\" \n      using func_imagedef by auto moreover\n    from \\<open>(h\\<rs>u)\\<in>G\\<close> \\<open>u\\<in>G\\<close> have \"LeftTranslation(G,f,(h\\<rs>u))`u=(h\\<rs>u)\\<ra>u\" using group0.group0_5_L2(2) group0_valid_in_tgroup\n      by auto\n    with \\<open>u\\<in>int(H)\\<close> have \"(h\\<rs>u)\\<ra>u\\<in>{LeftTranslation(G,f,(h\\<rs>u))`r. r\\<in>int(H)}\" by force ultimately\n    have \"(h\\<rs>u)\\<ra>u\\<in>(h\\<rs>u)\\<ltr>(int(H))\" unfolding ltrans_def by auto moreover\n    have \"(h\\<rs>u)\\<ra>u=h\" using group0.inv_cancel_two(1) group0_valid_in_tgroup\n      \\<open>u\\<in>G\\<close>\\<open>h\\<in>G\\<close> by auto ultimately\n    have \"h\\<in>(h\\<rs>u)\\<ltr>(int(H))\" by auto\n    with P ss have \"\\<exists>V\\<in>T. h\\<in>V\\<and> V\\<subseteq>H\" unfolding Bex_def by auto\n  }\n  then show ?thesis using open_neigh_open by auto\nqed\n\ntext\\<open>In conclusion, a subgroup is either open or has empty interior.\\<close>\n\ncorollary(in topgroup) emptyInterior_xor_op:\n  assumes \"IsAsubgroup(H,f)\"\n  shows \"(int(H)=0) Xor (H\\<in>T)\"\n  unfolding Xor_def using clopen_or_emptyInt assms Top_2_L3 \n  group0.group0_3_L5 group0_valid_in_tgroup by force\n\ntext\\<open>Then no connected topological groups has proper subgroups with non-empty interior.\\<close>\n\ncorollary(in topgroup) connected_emptyInterior:\n  assumes \"IsAsubgroup(H,f)\" \"T{is connected}\"\n  shows \"(int(H)=0) Xor (H=G)\"\nproof-\n  have \"(int(H)=0) Xor (H\\<in>T)\" using emptyInterior_xor_op assms(1) by auto moreover\n  {\n    assume \"H\\<in>T\" moreover\n    then have \"H{is closed in}T\" using open_subgroup_closed assms(1) by auto ultimately\n    have \"H=0\\<or>H=G\" using assms(2) unfolding IsConnected_def by auto\n    then have \"H=G\" using group0.group0_3_L5 group0_valid_in_tgroup assms(1) by auto\n  } moreover\n  have \"G\\<in>T\" using topSpaceAssum unfolding IsATopology_def G_def by auto\n  ultimately show ?thesis unfolding Xor_def by auto\nqed\n\ntext\\<open>Every locally-compact subgroup of a $T_0$ group is closed.\\<close>\n\ntheorem (in topgroup) loc_compact_T0_closed:\n  assumes \"IsAsubgroup(H,f)\" \"(T{restricted to}H){is locally-compact}\" \"T{is T\\<^sub>0}\"\n  shows \"H{is closed in}T\"\nproof-\n  from assms(1) have clsub:\"IsAsubgroup(cl(H),f)\" using closure_subgroup by auto\n  then have subcl:\"cl(H)\\<subseteq>G\" using group0.group0_3_L2 group0_valid_in_tgroup by force\n  from assms(1) have sub:\"H\\<subseteq>G\" using group0.group0_3_L2 group0_valid_in_tgroup by force\n  from assms(3) have \"T{is T\\<^sub>2}\" using T1_imp_T2 neu_closed_imp_T1 T0_imp_neu_closed by auto\n  then have \"(T{restricted to}H){is T\\<^sub>2}\" using T2_here sub by auto\n  have tot:\"\\<Union>(T{restricted to}H)=H\" using sub unfolding RestrictedTo_def by auto\n  with assms(2) have \"\\<forall>x\\<in>H. \\<exists>A\\<in>Pow(H). A {is compact in} (T{restricted to}H) \\<and> x \\<in> Interior(A, (T{restricted to}H))\" using \n    topology0.locally_compact_exist_compact_neig[of \"T{restricted to}H\"] Top_1_L4 unfolding topology0_def\n    by auto\n  then obtain K where K:\"K\\<subseteq>H\" \"K{is compact in} (T{restricted to}H)\"\"\\<zero>\\<in>Interior(K,(T{restricted to}H))\"\n    using group0.group0_3_L5 group0_valid_in_tgroup assms(1) unfolding gzero_def by force\n  from K(1,2) have \"K{is compact in} T\" using compact_subspace_imp_compact by auto\n  with \\<open>T{is T\\<^sub>2}\\<close> have Kcl:\"K{is closed in}T\" using in_t2_compact_is_cl by auto\n  have \"Interior(K,(T{restricted to}H))\\<in>(T{restricted to}H)\" using topology0.Top_2_L2 unfolding topology0_def\n    using Top_1_L4 by auto\n  then obtain U where U:\"U\\<in>T\"\"Interior(K,(T{restricted to}H))=H\\<inter>U\" unfolding RestrictedTo_def by auto\n  then have \"H\\<inter>U\\<subseteq>K\" using topology0.Top_2_L1[of \"T{restricted to}H\"] unfolding topology0_def using Top_1_L4 by force\n  moreover have U2:\"U\\<subseteq>U\\<union>K\" by auto\n  have ksub:\"K\\<subseteq>H\" using tot K(2) unfolding IsCompact_def by auto\n  ultimately have int:\"H\\<inter>(U\\<union>K)=K\" by auto\n  from U(2) K(3) have \"\\<zero>\\<in>U\" by auto\n  with U(1) U2 have \"\\<zero>\\<in>int(U \\<union> K)\" using Top_2_L6 by auto\n  then have \"U\\<union>K\\<in>\\<N>\\<^sub>0\" unfolding zerohoods_def using U(1) ksub sub by auto\n  then obtain V where V:\"V\\<subseteq>U\\<union>K\" \"V\\<in>\\<N>\\<^sub>0\" \"V\\<sad>V\\<subseteq>U\\<union>K\"\"(\\<sm> V) = V\" using exists_procls_zerohood[of \"U\\<union>K\"]\n    by auto\n  {\n    fix h assume AS:\"h\\<in>cl(H)\"\n    with clsub have \"(\\<rm>h)\\<in>cl(H)\" using group0.group0_3_T3A group0_valid_in_tgroup by auto moreover\n    then have \"(\\<rm>h)\\<in>G\" using subcl by auto\n    with V(2) have \"(\\<rm>h)\\<in>int((\\<rm>h)\\<ltr>V)\" using elem_in_int_ltrans by auto ultimately\n    have \"(\\<rm>h)\\<in>(cl(H))\\<inter>(int((\\<rm>h)\\<ltr>V))\" by auto moreover\n    have \"int((\\<rm>h)\\<ltr>V)\\<in>T\" using Top_2_L2 by auto moreover\n    note sub ultimately\n    have \"H\\<inter>(int((\\<rm>h)\\<ltr>V))\\<noteq>0\" using cl_inter_neigh by auto moreover\n    from \\<open>(\\<rm>h)\\<in>G\\<close> V(2) have \"int((\\<rm>h)\\<ltr>V)=(\\<rm>h)\\<ltr>int(V)\" unfolding zerohoods_def \n      using ltrans_interior by force\n    ultimately have \"H\\<inter>((\\<rm>h)\\<ltr>int(V))\\<noteq>0\" by auto\n    then obtain y where y:\"y\\<in>H\" \"y\\<in>(\\<rm>h)\\<ltr>int(V)\" by blast\n    then obtain v where v:\"v\\<in>int(V)\" \"y=(\\<rm>h)\\<ra>v\" unfolding ltrans_def LeftTranslation_def by auto\n    with \\<open>(\\<rm>h)\\<in>G\\<close> V(2) y(1) sub have \"v\\<in>G\"\"(\\<rm>h)\\<in>G\"\"y\\<in>G\" using Top_2_L1[of \"V\"] unfolding zerohoods_def by auto\n    with v(2) have \"(\\<rm>(\\<rm>h))\\<ra>y=v\" using group0.group0_2_L18(2) group0_valid_in_tgroup\n      unfolding grop_def grinv_def by auto moreover\n    have \"h\\<in>G\" using AS subcl by auto\n    then have \"(\\<rm>(\\<rm>h))=h\" using group0.group_inv_of_inv group0_valid_in_tgroup by auto ultimately\n    have \"h\\<ra>y=v\" by auto\n    with v(1) have hyV:\"h\\<ra>y\\<in>int(V)\" by auto\n    have \"y\\<in>cl(H)\" using y(1) cl_contains_set sub by auto\n    with AS have hycl:\"h\\<ra> y\\<in>cl(H)\" using clsub group0.group0_3_L6 group0_valid_in_tgroup by auto\n    {\n      fix W assume W:\"W\\<in>T\"\"h\\<ra>y\\<in>W\"\n      with hyV have \"h\\<ra>y\\<in>int(V)\\<inter>W\" by auto moreover\n      from W(1) have \"int(V)\\<inter>W\\<in>T\" using Top_2_L2 topSpaceAssum unfolding IsATopology_def by auto moreover\n      note hycl sub\n      ultimately have \"(int(V)\\<inter>W)\\<inter>H\\<noteq>0\" using cl_inter_neigh[of \"H\"\"int(V)\\<inter>W\"\"h\\<ra>y\"] by auto\n      then have \"V\\<inter>W\\<inter>H\\<noteq>0\" using Top_2_L1 by auto\n      with V(1) have \"(U\\<union>K)\\<inter>W\\<inter>H\\<noteq>0\" by auto\n      then have \"(H\\<inter>(U\\<union>K))\\<inter>W\\<noteq>0\" by auto\n      with int have \"K\\<inter>W\\<noteq>0\" by auto\n    }\n    then have \"\\<forall>W\\<in>T. h\\<ra>y\\<in>W \\<longrightarrow> K\\<inter>W\\<noteq>0\" by auto moreover\n    have \"K\\<subseteq>G\" \"h\\<ra>y\\<in>G\" using ksub sub hycl subcl by auto ultimately\n    have \"h\\<ra>y\\<in>cl(K)\" using inter_neigh_cl[of \"K\"\"h\\<ra>y\"] unfolding G_def by force\n    then have \"h\\<ra>y\\<in>K\" using Kcl Top_3_L8 \\<open>K\\<subseteq>G\\<close> by auto\n    with ksub have \"h\\<ra>y\\<in>H\" by auto\n    moreover from y(1) have \"(\\<rm>y)\\<in>H\" using group0.group0_3_T3A assms(1) group0_valid_in_tgroup\n      by auto\n    ultimately have \"(h\\<ra>y)\\<rs>y\\<in>H\" unfolding grsub_def using group0.group0_3_L6 group0_valid_in_tgroup\n      assms(1) by auto\n    moreover \n    have \"(\\<rm>y)\\<in>G\" using \\<open>(\\<rm>y)\\<in>H\\<close> sub by auto\n    then have \"h\\<ra>(y\\<rs>y)=(h\\<ra>y)\\<rs>y\" using \\<open>y\\<in>G\\<close>\\<open>h\\<in>G\\<close> group0.group_oper_assoc\n      group0_valid_in_tgroup unfolding grsub_def by auto\n    then have \"h\\<ra>\\<zero>=(h\\<ra>y)\\<rs>y\" using group0.group0_2_L6 group0_valid_in_tgroup \\<open>y\\<in>G\\<close>\n      unfolding grsub_def grinv_def grop_def gzero_def by auto\n    then have \"h=(h\\<ra>y)\\<rs>y\" using group0.group0_2_L2 group0_valid_in_tgroup\n      \\<open>h\\<in>G\\<close> unfolding gzero_def by auto\n    ultimately have \"h\\<in>H\" by auto\n  }\n  then have \"cl(H)\\<subseteq>H\" by auto\n  then have \"H=cl(H)\" using cl_contains_set sub by auto\n  then show ?thesis using Top_3_L8 sub by auto\nqed\n\ntext\\<open>We can always consider a factor group which is $T_2$.\\<close>\n\ntheorem(in topgroup) factor_haus:\n  shows \"(T{quotient by}QuotientGroupRel(G,f,cl({\\<zero>}))){is T\\<^sub>2}\"\nproof-\n  let ?r=\"QuotientGroupRel(G,f,cl({\\<zero>}))\"\n  let ?f=\"QuotientGroupOp(G,f,cl({\\<zero>}))\"\n  let ?i=\"GroupInv(G//?r,?f)\"\n  have \"IsAnormalSubgroup(G,f,{\\<zero>})\" using group0.trivial_normal_subgroup Ggroup unfolding group0_def\n    by auto\n  then have normal:\"IsAnormalSubgroup(G,f,cl({\\<zero>}))\" using normal_subg by auto\n  then have eq:\"equiv(\\<Union>T,?r)\" using group0.Group_ZF_2_4_L3[OF group0_valid_in_tgroup]\n    unfolding IsAnormalSubgroup_def by auto\n  then have tot:\"\\<Union>(T{quotient by}?r)=G//?r\" using total_quo_equi by auto\n  have neu:\"?r``{\\<zero>}=TheNeutralElement(G//?r,?f)\" using Group_ZF_2_4_L5B[OF Ggroup normal] by auto\n  then have \"?r``{\\<zero>}\\<in>G//?r\" using group0.group0_2_L2 Group_ZF_2_4_T1[OF Ggroup normal] unfolding group0_def by auto\n  then have sub1:\"{?r``{\\<zero>}}\\<subseteq>G//?r\" by auto\n  then have sub:\"{?r``{\\<zero>}}\\<subseteq>\\<Union>(T{quotient by}?r)\" using tot by auto\n  have zG:\"\\<zero>\\<in>\\<Union>T\" using group0.group0_2_L2[OF group0_valid_in_tgroup] by auto\n  from zG have cla:\"?r``{\\<zero>}\\<in>G//?r\" unfolding quotient_def by auto\n  let ?x=\"G//?r-{?r``{\\<zero>}}\"\n  {\n    fix s assume A:\"s\\<in>\\<Union>(G//?r-{?r``{\\<zero>}})\"\n    then obtain U where \"s\\<in>U\" \"U\\<in>G//?r-{?r``{\\<zero>}}\" by auto\n    then have \"U\\<in>G//?r\" \"U\\<noteq>?r``{\\<zero>}\" \"s\\<in>U\" by auto\n    then have \"U\\<in>G//?r\" \"s\\<in>U\" \"s\\<notin>?r``{\\<zero>}\" using cla quotient_disj[OF eq] by auto\n    then have \"s\\<in>\\<Union>(G//?r)-?r``{\\<zero>}\" by auto\n  }\n  moreover\n  {\n    fix s assume A:\"s\\<in>\\<Union>(G//?r)-?r``{\\<zero>}\"\n    then obtain U where \"s\\<in>U\" \"U\\<in>G//?r\" \"s\\<notin>?r``{\\<zero>}\" by auto\n    then have \"s\\<in>U\" \"U\\<in>G//?r-{?r``{\\<zero>}}\" by auto\n    then have \"s\\<in>\\<Union>(G//?r-{?r``{\\<zero>}})\" by auto\n  }\n  ultimately have \"\\<Union>(G//?r-{?r``{\\<zero>}})=\\<Union>(G//?r)-?r``{\\<zero>}\" by auto\n  then have A:\"\\<Union>(G//?r-{?r``{\\<zero>}})=G-?r``{\\<zero>}\" using Union_quotient eq by auto\n  {\n    fix s assume A:\"s\\<in>?r``{\\<zero>}\"\n    then have \"\\<langle>\\<zero>,s\\<rangle>\\<in>?r\" by auto\n    then have \"\\<langle>s,\\<zero>\\<rangle>\\<in>?r\" using eq unfolding equiv_def sym_def by auto\n    then have \"s\\<in>cl({\\<zero>})\" using group0.Group_ZF_2_4_L5C[OF group0_valid_in_tgroup] unfolding QuotientGroupRel_def by auto\n  }\n  moreover\n  {\n    fix s assume A:\"s\\<in>cl({\\<zero>})\"\n    then have \"s\\<in>G\" using Top_3_L11(1) zG by auto\n    then have \"\\<langle>s,\\<zero>\\<rangle>\\<in>?r\" using group0.Group_ZF_2_4_L5C[OF group0_valid_in_tgroup] A by auto\n    then have \"\\<langle>\\<zero>,s\\<rangle>\\<in>?r\" using eq unfolding equiv_def sym_def by auto\n    then have \"s\\<in>?r``{\\<zero>}\" by auto\n  }\n  ultimately have \"?r``{\\<zero>}=cl({\\<zero>})\" by blast\n  with A have \"\\<Union>(G//?r-{?r``{\\<zero>}})=G-cl({\\<zero>})\" by auto\n  moreover have \"cl({\\<zero>}){is closed in}T\" using cl_is_closed zG by auto\n  ultimately have \"\\<Union>(G//?r-{?r``{\\<zero>}})\\<in>T\" unfolding IsClosed_def by auto\n  then have \"(G//?r-{?r``{\\<zero>}})\\<in>{quotient by}?r\" using quotient_equiv_rel eq by auto\n  then have \"(\\<Union>(T{quotient by}?r)-{?r``{\\<zero>}})\\<in>{quotient by}?r\" using total_quo_equi[OF eq] by auto\n  moreover from sub1 have \"{?r``{\\<zero>}}\\<subseteq>(\\<Union>(T{quotient by}?r))\" using total_quo_equi[OF eq] by auto\n  ultimately have \"{?r``{\\<zero>}}{is closed in}(T{quotient by}?r)\" unfolding IsClosed_def by auto\n  then have \"{TheNeutralElement(G//?r,?f)}{is closed in}(T{quotient by}?r)\" using neu by auto\n  then have \"(T{quotient by}?r){is T\\<^sub>1}\" using topgroup.neu_closed_imp_T1[OF topGroupLocale[OF quotient_top_group[OF normal]]]\n    total_quo_equi[OF eq] by auto\n  then show ?thesis using topgroup.T1_imp_T2[OF topGroupLocale[OF quotient_top_group[OF normal]]] by auto\nqed \n      \n\nend\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/TopologicalGroup_ZF_3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.626124191181315, "lm_q1q2_score": 0.3252848675087017}}
{"text": "section \\<open>Tail-Recursive Implementation\\<close>\ntheory Tailrec_Impl\nimports General_DFS_Structure\nbegin\n\nlocale tailrec_impl_defs =\n  graph_defs G + gen_dfs_defs gds V0\n  for G :: \"('v, 'more) graph_rec_scheme\"\n  and gds :: \"('v,'s)gen_dfs_struct\"\nbegin\n  definition [DFS_code_unfold]: \"tr_impl_while_body \\<equiv> \\<lambda>s. do {\n    (u,Vs,s) \\<leftarrow> gds_get_pending gds s;\n    case Vs of \n      None \\<Rightarrow> gds_finish gds u s \n    | Some v \\<Rightarrow> do {\n      if gds_is_discovered gds v s then do {\n        if gds_is_finished gds v s then\n          gds_cross_edge gds u v s\n        else\n          gds_back_edge gds u v s\n      } else \n        gds_discover gds u v s\n    }\n  }\"\n\n  definition tailrec_implT where [DFS_code_unfold]: \n  \"tailrec_implT \\<equiv> do {\n    s \\<leftarrow> gds_init gds;\n\n    FOREACHci \n      (\\<lambda>it s. \n          gen_rwof s \n        \\<and> (\\<not>gds_is_break gds s \\<longrightarrow> gds_is_empty_stack gds s )\n        \\<and> V0-it \\<subseteq> gen_discovered s) \n      V0\n      (Not o gds_is_break gds) \n      (\\<lambda>v0 s. do {\n        let \\<comment> \\<open>ghost:\\<close> s0 = s;\n        if gds_is_discovered gds v0 s then\n          RETURN s\n        else do {\n          s \\<leftarrow> gds_new_root gds v0 s;\n          WHILEIT\n            (\\<lambda>s. gen_rwof s \\<and> insert v0 (gen_discovered s0) \\<subseteq> gen_discovered s)\n            (\\<lambda>s. \\<not>gds_is_break gds s \\<and> \\<not>gds_is_empty_stack gds s) \n            tr_impl_while_body s\n        }\n      }) s\n    }\"\n\n  definition tailrec_impl where [DFS_code_unfold]: \n  \"tailrec_impl \\<equiv> do {\n    s \\<leftarrow> gds_init gds;\n\n    FOREACHci \n      (\\<lambda>it s. \n          gen_rwof s \n        \\<and> (\\<not>gds_is_break gds s \\<longrightarrow> gds_is_empty_stack gds s )\n        \\<and> V0-it \\<subseteq> gen_discovered s) \n      V0\n      (Not o gds_is_break gds) \n      (\\<lambda>v0 s. do {\n        let \\<comment> \\<open>ghost:\\<close> s0 = s;\n        if gds_is_discovered gds v0 s then\n          RETURN s\n        else do {\n          s \\<leftarrow> gds_new_root gds v0 s;\n          WHILEI\n            (\\<lambda>s. gen_rwof s \\<and> insert v0 (gen_discovered s0) \\<subseteq> gen_discovered s)\n            (\\<lambda>s. \\<not>gds_is_break gds s \\<and> \\<not>gds_is_empty_stack gds s) \n            (\\<lambda>s. do {\n              (u,Vs,s) \\<leftarrow> gds_get_pending gds s;\n              case Vs of \n                None \\<Rightarrow> gds_finish gds u s \n              | Some v \\<Rightarrow> do {\n                if gds_is_discovered gds v s then do {\n                  if gds_is_finished gds v s then\n                    gds_cross_edge gds u v s\n                  else\n                    gds_back_edge gds u v s\n                } else \n                  gds_discover gds u v s\n              }\n            }) s\n        }\n      }) s\n    }\"\n\nend\n\n\ntext \\<open> Implementation of general DFS with outer foreach-loop \\<close>\nlocale tailrec_impl =\n  fb_graph G + gen_dfs gds V0 + tailrec_impl_defs G gds\n  for G :: \"('v, 'more) graph_rec_scheme\"\n  and gds :: \"('v,'s)gen_dfs_struct\"\n  +\n  assumes init_empty_stack: \n    \"gds_init gds \\<le>\\<^sub>n SPEC (gds_is_empty_stack gds)\"\n  assumes new_root_discovered: \n    \"\\<lbrakk>pre_new_root v0 s\\<rbrakk> \n      \\<Longrightarrow> gds_new_root gds v0 s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n        insert v0 (gen_discovered s) \\<subseteq> gen_discovered s')\"\n  assumes get_pending_incr:\n    \"\\<lbrakk>pre_get_pending s\\<rbrakk> \\<Longrightarrow> gds_get_pending gds s \\<le>\\<^sub>n SPEC (\\<lambda>(_,_,s'). \n        gen_discovered s \\<subseteq> gen_discovered s' \n      \\<^cancel>\\<open>\\<and> gds_is_break gds s' = gds_is_break gds s\\<close>)\"\n  assumes finish_incr: \"\\<lbrakk>pre_finish u s0 s\\<rbrakk> \n    \\<Longrightarrow> gds_finish gds u s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n      gen_discovered s \\<subseteq> gen_discovered s')\"\n  assumes cross_edge_incr: \"pre_cross_edge u v s0 s \n    \\<Longrightarrow> gds_cross_edge gds u v s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n      gen_discovered s \\<subseteq> gen_discovered s')\"\n  assumes back_edge_incr: \"pre_back_edge u v s0 s \n    \\<Longrightarrow> gds_back_edge gds u v s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n      gen_discovered s \\<subseteq> gen_discovered s')\"\n  assumes discover_incr: \"pre_discover u v s0 s \n    \\<Longrightarrow> gds_discover gds u v s \\<le>\\<^sub>n SPEC (\\<lambda>s'. \n      gen_discovered s \\<subseteq> gen_discovered s')\"\nbegin\n\n\n  context\n    assumes nofail: \n      \"nofail (gds_init gds \\<bind> WHILE gen_cond gen_step)\"\n  begin\n    lemma gds_init_refine: \"gds_init gds \n      \\<le> SPEC (\\<lambda>s. gen_rwof s \\<and> gds_is_empty_stack gds s)\"\n      apply (rule SPEC_rule_conj_leofI1)\n      apply (rule rwof_init[OF nofail])\n      apply (rule init_empty_stack)\n      done\n\n    lemma gds_new_root_refine:\n      assumes PNR: \"pre_new_root v0 s\"\n      shows \"gds_new_root gds v0 s \n        \\<le> SPEC (\\<lambda>s'. gen_rwof s' \n            \\<and> insert v0 (gen_discovered s) \\<subseteq> gen_discovered s' )\"\n      apply (rule SPEC_rule_conj_leofI1)\n    \n        apply (rule order_trans[OF _ rwof_step[OF nofail]])\n          using PNR apply (unfold gen_step_def gen_cond_def pre_new_root_def) [3] \n          apply (simp add: pw_le_iff refine_pw_simps, blast)\n          apply simp\n          apply blast\n  \n        apply (rule new_root_discovered[OF PNR])\n      done\n\n\n    (* Establish state after get-pending *)\n    lemma get_pending_nofail:\n      assumes A: \"pre_get_pending s\"  \n      shows \"nofail (gds_get_pending gds s)\"\n    proof -\n      (* Get-pending is executed as part of the next step. \n        As the next step does not fail, get_pending cannot fail, too. *)\n      from A[unfolded pre_get_pending_def] have \n        RWOF: \"gen_rwof s\" and\n        C: \"\\<not> gds_is_empty_stack gds s\" \"\\<not> gds_is_break gds s\" \n        by auto\n\n      from C have COND: \"gen_cond s\" unfolding gen_cond_def by auto\n\n      from rwof_step[OF nofail RWOF COND] \n      have \"gen_step s \\<le> SPEC gen_rwof\" .\n      hence \"nofail (gen_step s)\" by (simp add: pw_le_iff)\n\n      with C show ?thesis unfolding gen_step_def by (simp add: refine_pw_simps)\n    qed\n\n    lemma gds_get_pending_refine: \n      assumes PRE: \"pre_get_pending s\"\n      shows \"gds_get_pending gds s \\<le> SPEC (\\<lambda>(u,Vs,s'). \n          post_get_pending u Vs s s' \n        \\<and> gen_discovered s \\<subseteq> gen_discovered s')\"\n    proof -    \n      have \"gds_get_pending gds s \\<le> SPEC (\\<lambda>(u,Vs,s'). post_get_pending u Vs s s')\"\n        unfolding post_get_pending_def\n        apply (simp add: PRE)\n        using get_pending_nofail[OF PRE]\n        apply (simp add: pw_le_iff)\n        done\n      moreover note get_pending_incr[OF PRE]\n      ultimately show ?thesis by (simp add: pw_le_iff pw_leof_iff)\n    qed\n\n    lemma gds_finish_refine:\n      assumes PRE: \"pre_finish u s0 s\"\n      shows \"gds_finish gds u s \\<le> SPEC (\\<lambda>s'. gen_rwof s' \n            \\<and> gen_discovered s \\<subseteq> gen_discovered s')\"\n      apply (rule SPEC_rule_conj_leofI1)\n    \n        apply (rule order_trans[OF _ rwof_step[OF nofail]])\n          using PRE \n          apply (unfold gen_step_def gen_cond_def pre_finish_def \n            post_get_pending_def pre_get_pending_def) [3] \n          apply (simp add: pw_le_iff refine_pw_simps split: option.split, blast) \n          apply simp\n          apply blast\n  \n        apply (rule finish_incr[OF PRE])\n      done\n\n    lemma gds_cross_edge_refine:\n      assumes PRE: \"pre_cross_edge u v s0 s\"\n      shows \"gds_cross_edge gds u v s \\<le> SPEC (\\<lambda>s'. gen_rwof s' \n            \\<and> gen_discovered s \\<subseteq> gen_discovered s')\"\n      apply (rule SPEC_rule_conj_leofI1)\n    \n        apply (rule order_trans[OF _ rwof_step[OF nofail]])\n          using PRE \n          apply (unfold gen_step_def gen_cond_def pre_cross_edge_def \n            post_get_pending_def pre_get_pending_def) [3] \n          apply (simp add: pw_le_iff refine_pw_simps split: option.split, blast) \n          apply simp\n          apply blast\n  \n        apply (rule cross_edge_incr[OF PRE])\n      done\n\n    lemma gds_back_edge_refine:\n      assumes PRE: \"pre_back_edge u v s0 s\"\n      shows \"gds_back_edge gds u v s \\<le> SPEC (\\<lambda>s'. gen_rwof s' \n            \\<and> gen_discovered s \\<subseteq> gen_discovered s')\"\n      apply (rule SPEC_rule_conj_leofI1)\n    \n        apply (rule order_trans[OF _ rwof_step[OF nofail]])\n          using PRE \n          apply (unfold gen_step_def gen_cond_def pre_back_edge_def \n            post_get_pending_def pre_get_pending_def) [3] \n          apply (simp add: pw_le_iff refine_pw_simps split: option.split, blast) \n          apply simp\n          apply blast\n  \n        apply (rule back_edge_incr[OF PRE])\n      done\n\n\n    lemma gds_discover_refine:\n      assumes PRE: \"pre_discover u v s0 s\"\n      shows \"gds_discover gds u v s \\<le> SPEC (\\<lambda>s'. gen_rwof s' \n            \\<and> gen_discovered s \\<subseteq> gen_discovered s')\"\n      apply (rule SPEC_rule_conj_leofI1)\n    \n        apply (rule order_trans[OF _ rwof_step[OF nofail]])\n          using PRE \n          apply (unfold gen_step_def gen_cond_def pre_discover_def \n            post_get_pending_def pre_get_pending_def) [3] \n          apply (simp add: pw_le_iff refine_pw_simps split: option.split, blast) \n          apply simp\n          apply blast\n  \n        apply (rule discover_incr[OF PRE])\n      done\n\n  end\n\n  lemma gen_step_disc_incr:\n    assumes \"nofail gen_dfs\"\n    assumes \"gen_rwof s\" \"insert v0 (gen_discovered s0) \\<subseteq> gen_discovered s\"\n    assumes \"\\<not>gds_is_break gds s\" \"\\<not>gds_is_empty_stack gds s\"\n    shows \"gen_step s \\<le> SPEC (\\<lambda>s. insert v0 (gen_discovered s0) \\<subseteq> gen_discovered s)\"\n    using assms\n    apply (simp only: gen_step_def gen_dfs_def)\n    apply (refine_rcg refine_vcg \n      order_trans[OF gds_init_refine]\n      order_trans[OF gds_new_root_refine]\n      order_trans[OF gds_get_pending_refine]\n      order_trans[OF gds_finish_refine]\n      order_trans[OF gds_cross_edge_refine]\n      order_trans[OF gds_back_edge_refine]\n      order_trans[OF gds_discover_refine]\n      )\n    apply (auto \n      simp: it_step_insert_iff gen_cond_def\n      pre_new_root_def pre_get_pending_def pre_finish_def \n      pre_cross_edge_def pre_back_edge_def pre_discover_def)\n    done\n    \n\n  theorem tailrec_impl: \"tailrec_impl \\<le> gen_dfs\"\n    unfolding gen_dfs_def\n    apply (rule WHILE_refine_rwof)\n    unfolding tailrec_impl_def\n    apply (refine_rcg refine_vcg \n      order_trans[OF gds_init_refine]\n      order_trans[OF gds_new_root_refine]\n      order_trans[OF gds_get_pending_refine]\n      order_trans[OF gds_finish_refine]\n      order_trans[OF gds_cross_edge_refine]\n      order_trans[OF gds_back_edge_refine]\n      order_trans[OF gds_discover_refine]\n      )\n    apply (auto \n      simp: it_step_insert_iff gen_cond_def\n      pre_new_root_def pre_get_pending_def pre_finish_def \n      pre_cross_edge_def pre_back_edge_def pre_discover_def)\n    done\n\n  lemma tr_impl_while_body_gen_step:\n    assumes [simp]: \"\\<not>gds_is_empty_stack gds s\"\n    shows \"tr_impl_while_body s \\<le> gen_step s\"\n    unfolding tr_impl_while_body_def gen_step_def\n    by simp\n\n  lemma tailrecT_impl: \"tailrec_implT \\<le> gen_dfsT\"\n  proof (rule le_nofailI)\n    let ?V = \"rwof_rel (gds_init gds) gen_cond gen_step\"\n    assume NF: \"nofail gen_dfsT\"\n    from nofail_WHILEIT_wf_rel[of \"gds_init gds\" \"\\<lambda>_. True\" gen_cond gen_step]\n      and this[unfolded gen_dfsT_def WHILET_def]\n    have WF: \"wf (?V\\<inverse>)\" by simp\n\n    from NF have NF': \"nofail gen_dfs\" using gen_dfs_le_gen_dfsT\n      by (auto simp: pw_le_iff)\n\n    from rwof_rel_spec[of \"gds_init gds\" gen_cond gen_step] have\n      \"\\<And>s. \\<lbrakk>gen_rwof s; gen_cond s\\<rbrakk> \\<Longrightarrow> gen_step s \\<le>\\<^sub>n SPEC (\\<lambda>s'. (s,s')\\<in>?V)\"\n      .\n    hence \n      aux: \"\\<And>s. \\<lbrakk>gen_rwof s; gen_cond s\\<rbrakk> \\<Longrightarrow> gen_step s \\<le> SPEC (\\<lambda>s'. (s,s')\\<in>?V)\"\n      apply (rule leofD[rotated])\n      apply assumption\n      apply assumption\n      using NF[unfolded gen_dfsT_def]\n      by (drule (1) WHILET_nofail_imp_rwof_nofail)\n\n    show ?thesis\n      apply (rule order_trans[OF _ gen_dfs_le_gen_dfsT])\n      apply (rule order_trans[OF _ tailrec_impl])\n      unfolding tailrec_implT_def tailrec_impl_def\n      unfolding tr_impl_while_body_def[symmetric]\n      apply (rule refine_IdD)\n      apply (refine_rcg bind_refine' inj_on_id)\n      apply refine_dref_type\n      apply simp_all\n      apply (subst WHILEIT_eq_WHILEI_tproof[where V=\"?V\\<inverse>\"])\n        apply (rule WF; fail)\n        subgoal\n          apply clarsimp\n          apply (rule order_trans[OF tr_impl_while_body_gen_step], assumption)\n          apply (rule aux, assumption, (simp add: gen_cond_def; fail))\n        done  \n        apply (simp; fail)\n      done      \n  qed\n\nend  \nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/DFS_Framework/Impl/Structural/Tailrec_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6261241772283035, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3252848602598148}}
{"text": "(*  Title:      HOL/Auth/n_mesi_lemma_inv__3_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mesi Protocol Case Study*} \n\ntheory n_mesi_lemma_inv__3_on_rules imports n_mesi_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__3  p__Inv0 p__Inv2)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t1  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_t2 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_t3 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_t4 N i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t1  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t1Vsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t2 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t2Vsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t3 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t3Vsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_t4 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_t4Vsinv__3) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mesi/n_mesi_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7490872243177518, "lm_q2_score": 0.4339814648038986, "lm_q1q2_score": 0.3250899708753045}}
{"text": "(*\nTitle: WHATandWHERE-Security\nAuthors: Sylvia Grewe, Alexander Lux, Heiko Mantel, Jens Sauer\n*)\ntheory Type_System\nimports Language_Composition\nbegin\n\nlocale Type_System =\n  WWP: WHATWHERE_Secure_Programs \"E\" \"BMap\" \"DA\" \"lH\"\n  for E :: \"('exp, 'id, 'val) Evalfunction\"\n  and BMap :: \"'val \\<Rightarrow> bool\"\n  and DA :: \"('id, 'd::order) DomainAssignment\"\n  and lH :: \"('d, 'exp) lHatches\"\n+ \nfixes\nAssignSideCondition :: \"'id \\<Rightarrow> 'exp \\<Rightarrow> nat \\<Rightarrow> bool\"\nand WhileSideCondition :: \"'exp \\<Rightarrow> bool\"\nand IfSideCondition :: \n  \"'exp \\<Rightarrow> ('exp,'id) MWLsCom \\<Rightarrow> ('exp,'id) MWLsCom \\<Rightarrow> bool\" \nassumes semAssignSC: \"AssignSideCondition x e \\<iota> \\<Longrightarrow> \n  e \\<equiv>\\<^bsub>DA x,(htchLoc \\<iota>)\\<^esub> e \\<and> (\\<forall>m m' d \\<iota>'. (m \\<sim>\\<^bsub>d,(htchLoc \\<iota>')\\<^esub> m' \\<and> \n  \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m) =\\<^bsub>d\\<^esub> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m'))\n  \\<longrightarrow> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m) \\<sim>\\<^bsub>d,(htchLoc \\<iota>')\\<^esub> \\<lbrakk>x :=\\<^bsub>\\<iota>\\<^esub> e\\<rbrakk>(m'))\" \nand semWhileSC: \"WhileSideCondition e \\<Longrightarrow> \\<forall>d. e \\<equiv>\\<^bsub>d\\<^esub> e\"\nand semIfSC: \"IfSideCondition e c1 c2 \\<Longrightarrow> \\<forall>d. e \\<equiv>\\<^bsub>d\\<^esub> e\"\nbegin\n\n-- \"Security typing rules for the language commands\"\ninductive\nComSecTyping :: \"('exp, 'id) MWLsCom \\<Rightarrow> bool\"\n  (\"\\<turnstile>\\<^bsub>\\<C>\\<^esub> _\")\nand ComSecTypingL :: \"('exp,'id) MWLsCom list \\<Rightarrow> bool\"\n   (\"\\<turnstile>\\<^bsub>\\<V>\\<^esub> _\")\nwhere\nSkip: \"\\<turnstile>\\<^bsub>\\<C>\\<^esub> skip\\<^bsub>\\<iota>\\<^esub>\" |\nAssign: \"\\<lbrakk> AssignSideCondition x e \\<iota> \\<rbrakk> \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<C>\\<^esub> x :=\\<^bsub>\\<iota>\\<^esub> e\" |\nSpawn: \"\\<lbrakk> \\<turnstile>\\<^bsub>\\<V>\\<^esub> V \\<rbrakk> \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<C>\\<^esub> spawn\\<^bsub>\\<iota>\\<^esub> V\" |\nSeq: \"\\<lbrakk> \\<turnstile>\\<^bsub>\\<C>\\<^esub> c1; \\<turnstile>\\<^bsub>\\<C>\\<^esub> c2 \\<rbrakk> \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<C>\\<^esub> c1;c2\" |\nWhile: \"\\<lbrakk> \\<turnstile>\\<^bsub>\\<C>\\<^esub> c; WhileSideCondition b \\<rbrakk> \n     \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<C>\\<^esub> while\\<^bsub>\\<iota>\\<^esub> b do c od\" |\nIf: \"\\<lbrakk> \\<turnstile>\\<^bsub>\\<C>\\<^esub> c1; \\<turnstile>\\<^bsub>\\<C>\\<^esub> c2; IfSideCondition b c1 c2 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<C>\\<^esub> if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi\" |\nParallel: \"\\<lbrakk> \\<forall>i < length V. \\<turnstile>\\<^bsub>\\<C>\\<^esub> V!i \\<rbrakk> \\<Longrightarrow> \\<turnstile>\\<^bsub>\\<V>\\<^esub> V\"\n\ninductive_cases parallel_cases:\n\"\\<turnstile>\\<^bsub>\\<V>\\<^esub> V\"\n\ndefinition auxiliary_predicate\nwhere\n\"auxiliary_predicate V \\<equiv> unique_PPV V \\<longrightarrow> WHATWHERE_Secure V\" \n\n--\"soundness proof of abstract type system\"\ntheorem ComSecTyping_single_is_sound:\n\"\\<lbrakk> \\<turnstile>\\<^bsub>\\<C>\\<^esub> c; unique_PPc c \\<rbrakk>\n  \\<Longrightarrow> WHATWHERE_Secure [c]\"\nproof (induct rule: ComSecTyping_ComSecTypingL.inducts(1)\n    [of _ _ \"auxiliary_predicate\"], simp_all add: auxiliary_predicate_def)\n  fix \\<iota>\n  show \"WHATWHERE_Secure [skip\\<^bsub>\\<iota>\\<^esub>]\"\n    by (metis WHATWHERE_Secure_Skip)\nnext\n  fix x e \\<iota>\n  assume \"AssignSideCondition x e \\<iota>\"\n  thus \"WHATWHERE_Secure [x :=\\<^bsub>\\<iota>\\<^esub> e]\"\n    by (metis WHATWHERE_Secure_Assign semAssignSC)\nnext\n  fix V \\<iota>\n  assume IH: \"unique_PPV V \\<longrightarrow> WHATWHERE_Secure V\"\n  assume uniPPspawn: \"unique_PPc (spawn\\<^bsub>\\<iota>\\<^esub> V)\"\n  hence \"unique_PPV V\"\n    by (simp add: unique_PPV_def unique_PPc_def)\n  with IH have \"WHATWHERE_Secure V\"\n    ..\n  with uniPPspawn show \"WHATWHERE_Secure [spawn\\<^bsub>\\<iota>\\<^esub> V]\"\n    by (metis Compositionality_Spawn)\nnext\n  fix c1 c2\n  assume IH1: \"unique_PPc c1 \\<Longrightarrow> WHATWHERE_Secure [c1]\"\n  assume IH2: \"unique_PPc c2 \\<Longrightarrow> WHATWHERE_Secure [c2]\"\n  assume uniPPc1c2: \"unique_PPc (c1;c2)\"\n  from uniPPc1c2 have uniPPc1: \"unique_PPc c1\"\n    by (simp add: unique_PPc_def)\n  with IH1 have IS1: \"WHATWHERE_Secure [c1]\"\n    .\n  from uniPPc1c2 have uniPPc2: \"unique_PPc c2\"\n    by (simp add: unique_PPc_def)\n  with IH2 have IS2: \"WHATWHERE_Secure [c2]\"\n    .\n\n  from IS1 IS2 uniPPc1c2 show \"WHATWHERE_Secure [c1;c2]\"\n    by (metis Compositionality_Seq)\nnext\n  fix c b \\<iota>\n  assume SC: \"WhileSideCondition b\"\n  assume IH: \"unique_PPc c \\<Longrightarrow> WHATWHERE_Secure [c]\"\n  assume uniPPwhile: \"unique_PPc (while\\<^bsub>\\<iota>\\<^esub> b do c od)\"\n  hence \"unique_PPc c\"\n    by (simp add: unique_PPc_def)\n  with IH have \"WHATWHERE_Secure [c]\"\n    .\n  with uniPPwhile SC show \"WHATWHERE_Secure [while\\<^bsub>\\<iota>\\<^esub> b do c od]\"\n    by (metis Compositionality_While semWhileSC)\nnext\n  fix c1 c2 b \\<iota>\n  assume SC: \"IfSideCondition b c1 c2\"  \n  assume IH1: \"unique_PPc c1 \\<Longrightarrow> WHATWHERE_Secure [c1]\"\n  assume IH2: \"unique_PPc c2 \\<Longrightarrow> WHATWHERE_Secure [c2]\"\n  assume uniPPif: \"unique_PPc (if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi)\"\n  from uniPPif have \"unique_PPc c1\"\n    by (simp add: unique_PPc_def)\n  with IH1 have IS1: \"WHATWHERE_Secure [c1]\"\n    .\n  from uniPPif have \"unique_PPc c2\"\n    by (simp add: unique_PPc_def)\n  with IH2 have IS2: \"WHATWHERE_Secure [c2]\"\n    .\n  from IS1 IS2 SC uniPPif show \n    \"WHATWHERE_Secure [if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi]\"\n    by (metis Compositionality_If semIfSC)\nnext\n  fix V\n  assume IH: \"\\<forall>i < length V. \\<turnstile>\\<^bsub>\\<C>\\<^esub> V ! i \\<and>\n    (unique_PPc (V!i) \\<longrightarrow> WHATWHERE_Secure [V!i])\"\n  have \"unique_PPV V \\<longrightarrow> (\\<forall>i < length V. unique_PPc (V!i))\"\n    by (metis uniPPV_uniPPc)\n  with IH have \"unique_PPV V \\<longrightarrow> (\\<forall>i < length V. WHATWHERE_Secure [V!i])\" \n    by auto\n  thus uniPPV: \"unique_PPV V \\<longrightarrow> WHATWHERE_Secure V\"\n    by (metis parallel_composition)\nqed\n\n\ntheorem ComSecTyping_list_is_sound:\n\"\\<lbrakk> \\<turnstile>\\<^bsub>\\<V>\\<^esub> V; unique_PPV V \\<rbrakk> \\<Longrightarrow> WHATWHERE_Secure V\"\nby (metis ComSecTyping_single_is_sound parallel_cases \n  parallel_composition uniPPV_uniPPc)\n  \nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/WHATandWHERE_Security/Type_System.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544335934766, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.325084484967416}}
{"text": "\\<^marker>\\<open>creator \"Kevin Kappelmann\"\\<close>\nsubsubsection \\<open>Order Equivalence\\<close>\ntheory Transport_Functions_Order_Equivalence\n  imports\n    Transport_Functions_Monotone\n    Transport_Functions_Galois_Equivalence\nbegin\n\nparagraph \\<open>Dependent Function Relator\\<close>\n\ncontext transport_Dep_Fun_Rel\nbegin\n\nsubparagraph \\<open>Inflationary\\<close>\n\nlemma rel_unit_self_if_rel_selfI:\n  assumes inflationary_unit1: \"inflationary_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and refl_L1: \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and trans_L1: \"transitive (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and mono_l2: \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x x\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>)\"\n  and mono_r2: \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>)) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and inflationary_unit2: \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow>\n    inflationary_on (in_codom (\\<le>\\<^bsub>L2 x x\\<^esub>)) (\\<le>\\<^bsub>L2 x x\\<^esub>) (\\<eta>\\<^bsub>2 x (l1 x)\\<^esub>)\"\n  and L2_le1: \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and L2_unit_le2: \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and ge_R2_l2_le2: \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_codom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y \\<Longrightarrow>\n    (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y) \\<le> (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y)\"\n  and trans_L2: \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> f\"\n  shows \"f \\<le>\\<^bsub>L\\<^esub> \\<eta> f\"\nproof (intro left_relI)\n  fix x1 x2 assume [iff]: \"x1 \\<le>\\<^bsub>L1\\<^esub> x2\"\n  moreover with inflationary_unit1 have \"x2 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x2\" by blast\n  ultimately have \"x1 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x2\" using trans_L1 by blast\n  with \\<open>f \\<le>\\<^bsub>L\\<^esub> f\\<close> have \"f x1 \\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub> f (\\<eta>\\<^sub>1 x2)\" by blast\n  with L2_unit_le2 have \"f x1 \\<le>\\<^bsub>L2 x1 x2\\<^esub> f (\\<eta>\\<^sub>1 x2)\" by blast\n  moreover have \"... \\<le>\\<^bsub>L2 x1 x2\\<^esub> \\<eta> f x2\"\n  proof -\n    from refl_L1 \\<open>x2 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x2\\<close> have \"\\<eta>\\<^sub>1 x2 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x2\" by blast\n    with \\<open>f \\<le>\\<^bsub>L\\<^esub> f\\<close> have \"f (\\<eta>\\<^sub>1 x2) \\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x2) (\\<eta>\\<^sub>1 x2)\\<^esub> f (\\<eta>\\<^sub>1 x2)\" by blast\n    with L2_le1 have \"f (\\<eta>\\<^sub>1 x2) \\<le>\\<^bsub>L2 x2 (\\<eta>\\<^sub>1 x2)\\<^esub> f (\\<eta>\\<^sub>1 x2)\"\n      using \\<open>x2 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x2\\<close> by blast\n    moreover from refl_L1 \\<open>x1 \\<le>\\<^bsub>L1\\<^esub> x2\\<close> have [iff]: \"x2 \\<le>\\<^bsub>L1\\<^esub> x2\" by blast\n    ultimately have \"f (\\<eta>\\<^sub>1 x2) \\<le>\\<^bsub>L2 x2 x2\\<^esub> f (\\<eta>\\<^sub>1 x2)\" using L2_unit_le2 by blast\n    with inflationary_unit2 have \"f (\\<eta>\\<^sub>1 x2) \\<le>\\<^bsub>L2 x2 x2\\<^esub> \\<eta>\\<^bsub>2 x2 (l1 x2)\\<^esub> (f (\\<eta>\\<^sub>1 x2))\" by blast\n    moreover have \"... \\<le>\\<^bsub>L2 x2 x2\\<^esub> \\<eta> f x2\"\n    proof -\n      from \\<open>f (\\<eta>\\<^sub>1 x2) \\<le>\\<^bsub>L2 x2 x2\\<^esub> f (\\<eta>\\<^sub>1 x2)\\<close> mono_l2\n        have \"l2\\<^bsub>(l1 x2) x2\\<^esub> (f (\\<eta>\\<^sub>1 x2)) \\<le>\\<^bsub>R2 (l1 x2) (l1 x2)\\<^esub> l2\\<^bsub>(l1 x2) x2\\<^esub> (f (\\<eta>\\<^sub>1 x2))\"\n        by blast\n      with ge_R2_l2_le2\n        have \"l2\\<^bsub>(l1 x2) x2\\<^esub> (f (\\<eta>\\<^sub>1 x2)) \\<le>\\<^bsub>R2 (l1 x2) (l1 x2)\\<^esub> l2\\<^bsub>(l1 x2) (\\<eta>\\<^sub>1 x2)\\<^esub> (f (\\<eta>\\<^sub>1 x2))\"\n        using \\<open>f (\\<eta>\\<^sub>1 x2) \\<le>\\<^bsub>L2 x2 (\\<eta>\\<^sub>1 x2)\\<^esub> f (\\<eta>\\<^sub>1 x2)\\<close> by blast\n      with mono_r2 have \"\\<eta>\\<^bsub>2 x2 (l1 x2)\\<^esub> (f (\\<eta>\\<^sub>1 x2)) \\<le>\\<^bsub>L2 x2 (\\<eta>\\<^sub>1 x2)\\<^esub> \\<eta> f x2\"\n        by auto\n      with L2_unit_le2 show ?thesis by blast\n    qed\n    ultimately have \"f (\\<eta>\\<^sub>1 x2) \\<le>\\<^bsub>L2 x2 x2\\<^esub> \\<eta> f x2\" using trans_L2 by blast\n    with L2_le1 show ?thesis by blast\n  qed\n  ultimately show \"f x1 \\<le>\\<^bsub>L2 x1 x2\\<^esub> \\<eta> f x2\" using trans_L2 by blast\nqed\n\nsubparagraph \\<open>Deflationary\\<close>\n\ninterpretation flip_inv :\n  transport_Dep_Fun_Rel \"(\\<ge>\\<^bsub>R1\\<^esub>)\" \"(\\<ge>\\<^bsub>L1\\<^esub>)\" r1 l1 \"flip2 R2\" \"flip2 L2\" r2 l2\n  rewrites \"flip_inv.L \\<equiv> (\\<ge>\\<^bsub>R\\<^esub>)\" and \"flip_inv.R \\<equiv> (\\<ge>\\<^bsub>L\\<^esub>)\"\n  and \"flip_inv.unit \\<equiv> \\<epsilon>\"\n  and \"flip_inv.t1.unit \\<equiv> \\<epsilon>\\<^sub>1\"\n  and \"\\<And>x y. flip_inv.t2_unit x y \\<equiv> \\<epsilon>\\<^bsub>2 y x\\<^esub>\"\n  and \"\\<And>R x y. (flip2 R x y)\\<inverse> \\<equiv> R y x\"\n  and \"\\<And>R. in_codom R\\<inverse> \\<equiv> in_dom R\"\n  and \"\\<And>R x1 x2. in_codom (flip2 R x1 x2) \\<equiv> in_dom (R x2 x1)\"\n  and \"\\<And>x1 x2 x1' x2'. (flip2 R2 x1' x2' \\<Rrightarrow>\\<^sub>m flip2 L2 x1 x2) \\<equiv> ((\\<le>\\<^bsub>R2 x2' x1'\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x2 x1\\<^esub>))\"\n  and \"\\<And>x1 x2 x1' x2'. (flip2 L2 x1 x2 \\<Rrightarrow>\\<^sub>m flip2 R2 x1' x2') \\<equiv> ((\\<le>\\<^bsub>L2 x2 x1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 x2' x1'\\<^esub>))\"\n  and \"\\<And>P. inflationary_on P (\\<ge>\\<^bsub>R1\\<^esub>) \\<equiv> deflationary_on P (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"\\<And>P x. inflationary_on P (flip2 R2 x x) \\<equiv> deflationary_on P (\\<le>\\<^bsub>R2 x x\\<^esub>)\"\n  and \"\\<And>x1 x2 x3 x4. flip2 R2 x1 x2 \\<le> flip2 R2 x3 x4 \\<equiv> (\\<le>\\<^bsub>R2 x2 x1\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x4 x3\\<^esub>)\"\n  and \"\\<And>(R :: 'z \\<Rightarrow> _) (P :: 'z \\<Rightarrow> bool). reflexive_on P R\\<inverse> \\<equiv> reflexive_on P R\"\n  and \"\\<And>R. transitive R\\<inverse> \\<equiv> transitive R\"\n  and \"\\<And>x1' x2'. transitive (flip2 R2 x1' x2') \\<equiv> transitive (\\<le>\\<^bsub>R2 x2' x1'\\<^esub>)\"\n  by (simp_all add: flip_inv_left_eq_ge_right flip_inv_right_eq_ge_left\n    flip_unit_eq_counit t1.flip_unit_eq_counit t2.flip_unit_eq_counit\n    galois_prop.rel_inv_half_galois_prop_right_eq_half_galois_prop_left_rel_inv)\n\nlemma counit_rel_self_if_rel_selfI:\n  assumes \"deflationary_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>) \\<epsilon>\\<^sub>1\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"transitive (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)) (l2\\<^bsub> x' (r1 x')\\<^esub>)\"\n  and \"\\<And>x' x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> ((\\<le>\\<^bsub>R2 x' x'\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>)) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> deflationary_on (in_dom (\\<le>\\<^bsub>R2 x' x'\\<^esub>)) (\\<le>\\<^bsub>R2 x' x'\\<^esub>) (\\<epsilon>\\<^bsub>2 (r1 x') x'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x' y'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> in_dom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y' \\<Longrightarrow>\n    (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y') \\<le> (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y')\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"g \\<le>\\<^bsub>R\\<^esub> g\"\n  shows \"\\<epsilon> g \\<le>\\<^bsub>R\\<^esub> g\"\n  using assms by (intro flip_inv.rel_unit_self_if_rel_selfI[simplified rel_inv_iff_rel])\n\n\nsubparagraph \\<open>Relational Equivalence\\<close>\n\nlemma bi_related_unit_self_if_rel_self_aux:\n  assumes rel_equiv_unit1: \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and mono_r2: \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x x\\<^esub>)) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and rel_equiv_unit2: \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow>\n    rel_equivalence_on (in_field (\\<le>\\<^bsub>L2 x x\\<^esub>)) (\\<le>\\<^bsub>L2 x x\\<^esub>) (\\<eta>\\<^bsub>2 x (l1 x)\\<^esub>)\"\n  and L2_le1: \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and L2_le2: \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 x1\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and [iff]: \"x \\<le>\\<^bsub>L1\\<^esub> x\"\n  shows \"((\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>)) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x) x\\<^esub>)) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and \"deflationary_on (in_dom (\\<le>\\<^bsub>L2 x x\\<^esub>)) (\\<le>\\<^bsub>L2 x x\\<^esub>) \\<eta>\\<^bsub>2 x (l1 x)\\<^esub>\"\n  and \"inflationary_on (in_codom (\\<le>\\<^bsub>L2 x x\\<^esub>)) (\\<le>\\<^bsub>L2 x x\\<^esub>) \\<eta>\\<^bsub>2 x (l1 x)\\<^esub>\"\nproof -\n  from rel_equiv_unit1 have \"x \\<equiv>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x\" by blast\n  with mono_r2 show \"((\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>)) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n    and \"((\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x) x\\<^esub>)) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n    using L2_le1 L2_le2 by blast+\nqed (insert rel_equiv_unit2, blast+)\n\ninterpretation flip : transport_Dep_Fun_Rel R1 L1 r1 l1 R2 L2 r2 l2\n  rewrites \"flip.counit \\<equiv> \\<eta>\" and \"flip.t1.counit \\<equiv> \\<eta>\\<^sub>1\"\n  and \"\\<And>x y. flip.t2_counit x y \\<equiv> \\<eta>\\<^bsub>2 y x\\<^esub>\"\n  by (simp_all add: order_functors.flip_counit_eq_unit)\n\nlemma bi_related_unit_self_if_rel_selfI:\n  assumes rel_equiv_unit1: \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and trans_L1: \"transitive (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x x\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x x\\<^esub>)) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow>\n    rel_equivalence_on (in_field (\\<le>\\<^bsub>L2 x x\\<^esub>)) (\\<le>\\<^bsub>L2 x x\\<^esub>) (\\<eta>\\<^bsub>2 x (l1 x)\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x1) x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 x1\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_dom (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x) x\\<^esub>) y \\<Longrightarrow>\n    (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y) \\<le> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_codom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y \\<Longrightarrow>\n    (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y) \\<le> (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> f\"\n  shows \"f \\<equiv>\\<^bsub>L\\<^esub> \\<eta> f\"\nproof -\n  from rel_equiv_unit1 trans_L1 have \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n    by (intro reflexive_on_in_field_if_transitive_if_rel_equivalence_on)\n  with assms show ?thesis\n    by (intro bi_relatedI rel_unit_self_if_rel_selfI\n      flip.counit_rel_self_if_rel_selfI\n      bi_related_unit_self_if_rel_self_aux)\n    (auto intro: inflationary_on_if_le_pred_if_inflationary_on\n      deflationary_on_if_le_pred_if_deflationary_on\n      reflexive_on_if_le_pred_if_reflexive_on\n      in_field_if_in_dom in_field_if_in_codom)\nqed\n\n\nsubparagraph \\<open>Lemmas for Monotone Function Relator\\<close>\n\nlemma order_equivalence_if_order_equivalence_mono_assms_leftI:\n  assumes order_equiv1: \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and refl_R1: \"reflexive_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and R2_counit_le1: \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and mono_l2: \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | x2 \\<^bsub>L1\\<^esub>\\<lessapprox> x1'] \\<Rrightarrow>\n    [in_field (\\<le>\\<^bsub>L2 x1 (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x1) x2'\\<^esub>)) l2\"\n  and [iff]: \"x1' \\<le>\\<^bsub>R1\\<^esub> x2'\"\n  shows \"([in_dom (\\<le>\\<^bsub>L2 (r1 x1') (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)) (l2\\<^bsub>x1' (r1 x1')\\<^esub>) (l2\\<^bsub>x2' (r1 x1')\\<^esub>)\"\n  and \"([in_codom (\\<le>\\<^bsub>L2 (r1 x1') (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)) (l2\\<^bsub>x2' (r1 x1')\\<^esub>) (l2\\<^bsub>x2' (r1 x2')\\<^esub>)\"\nproof -\n  from refl_R1 have \"x1' \\<le>\\<^bsub>R1\\<^esub> x1'\" \"x2' \\<le>\\<^bsub>R1\\<^esub> x2'\" by auto\n  moreover with order_equiv1\n    have \"r1 x1' \\<le>\\<^bsub>L1\\<^esub> r1 x2'\" \"r1 x1' \\<le>\\<^bsub>L1\\<^esub> r1 x1'\" \"r1 x2' \\<le>\\<^bsub>L1\\<^esub> r1 x2'\" by auto\n  ultimately have \"r1 x1' \\<^bsub>L1\\<^esub>\\<lessapprox> x1'\" \"r1 x2' \\<^bsub>L1\\<^esub>\\<lessapprox> x2'\" by blast+\n  note Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_l2 \\<open>x1' \\<le>\\<^bsub>R1\\<^esub> x2'\\<close>]\n    \\<open>r1 x1' \\<le>\\<^bsub>L1\\<^esub> r1 x1'\\<close>]\n  with \\<open>r1 x1' \\<^bsub>L1\\<^esub>\\<lessapprox> x1'\\<close> R2_counit_le1\n    show \"([in_dom (\\<le>\\<^bsub>L2 (r1 x1') (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)) (l2\\<^bsub>x1' (r1 x1')\\<^esub>) (l2\\<^bsub>x2' (r1 x1')\\<^esub>)\"\n    by (intro Dep_Fun_Rel_predI) (auto dest!: in_field_if_in_dom)\n  note Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_l2 \\<open>x2' \\<le>\\<^bsub>R1\\<^esub> x2'\\<close>]\n    \\<open>r1 x1' \\<le>\\<^bsub>L1\\<^esub> r1 x2'\\<close>]\n  with \\<open>r1 x2' \\<^bsub>L1\\<^esub>\\<lessapprox> x2'\\<close> R2_counit_le1\n    show \"([in_codom (\\<le>\\<^bsub>L2 (r1 x1') (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)) (l2\\<^bsub>x2' (r1 x1')\\<^esub>) (l2\\<^bsub>x2' (r1 x2')\\<^esub>)\"\n    by (intro Dep_Fun_Rel_predI) (auto dest!: in_field_if_in_codom)\nqed\n\nlemma order_equivalence_if_order_equivalence_mono_assms_rightI:\n  assumes order_equiv1: \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and refl_L1: \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and L2_unit_le2: \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and mono_r2: \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | x2 \\<^bsub>L1\\<^esub>\\<lessapprox> x1'] \\<Rrightarrow>\n    [in_field (\\<le>\\<^bsub>R2 (l1 x1) x2'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 (r1 x2')\\<^esub>)) r2\"\n  and [iff]: \"x1 \\<le>\\<^bsub>L1\\<^esub> x2\"\n  shows \"([in_codom (\\<le>\\<^bsub>R2 (l1 x1) (l1 x2)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)) (r2\\<^bsub>x1 (l1 x2)\\<^esub>) (r2\\<^bsub>x2 (l1 x2)\\<^esub>)\"\n  and \"([in_dom (\\<le>\\<^bsub>R2 (l1 x1) (l1 x2)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)) (r2\\<^bsub>x1 (l1 x1)\\<^esub>) (r2\\<^bsub>x1 (l1 x2)\\<^esub>)\"\nproof -\n  from refl_L1 have \"x1 \\<le>\\<^bsub>L1\\<^esub> x1\" \"x2 \\<le>\\<^bsub>L1\\<^esub> x2\" by auto\n  moreover with order_equiv1\n    have \"l1 x1 \\<le>\\<^bsub>R1\\<^esub> l1 x2\" \"l1 x1 \\<le>\\<^bsub>R1\\<^esub> l1 x1\" \"l1 x2 \\<le>\\<^bsub>R1\\<^esub> l1 x2\" by auto\n  ultimately have \"x1 \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x1\" \"x2 \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x2\" using order_equiv1\n    by (auto intro!: t1.Galois_left_if_in_codom_if_inflationary_onI)\n  note Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_r2 \\<open>x1 \\<le>\\<^bsub>L1\\<^esub> x2\\<close>]\n    \\<open>l1 x2 \\<le>\\<^bsub>R1\\<^esub> l1 x2\\<close>]\n  with \\<open>x2 \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x2\\<close> L2_unit_le2\n    show \"([in_codom (\\<le>\\<^bsub>R2 (l1 x1) (l1 x2)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)) (r2\\<^bsub>x1 (l1 x2)\\<^esub>) (r2\\<^bsub>x2 (l1 x2)\\<^esub>)\"\n    by (intro Dep_Fun_Rel_predI) (auto dest!: in_field_if_in_codom)\n  note Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_r2 \\<open>x1 \\<le>\\<^bsub>L1\\<^esub> x1\\<close>]\n    \\<open>l1 x1 \\<le>\\<^bsub>R1\\<^esub> l1 x2\\<close>]\n  with \\<open>x1 \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x1\\<close> L2_unit_le2\n    show \"([in_dom (\\<le>\\<^bsub>R2 (l1 x1) (l1 x2)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)) (r2\\<^bsub>x1 (l1 x1)\\<^esub>) (r2\\<^bsub>x1 (l1 x2)\\<^esub>)\"\n    by (intro Dep_Fun_Rel_predI) (auto dest!: in_field_if_in_dom)\nqed\n\nlemma l2_unit_bi_rel_selfI:\n  assumes pre_equiv1: \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and mono_L2:\n    \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3 x4 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | (x2 \\<le>\\<^bsub>L1\\<^esub> x3 \\<and> x4 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x3)] \\<Rrightarrow> (\\<ge>)) L2\"\n  and mono_R2:\n    \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3' x4' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | (x2' \\<le>\\<^bsub>R1\\<^esub> x3' \\<and> x4' \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 x3')] \\<Rrightarrow> (\\<ge>)) R2\"\n  and mono_l2: \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | x2 \\<^bsub>L1\\<^esub>\\<lessapprox> x1'] \\<Rrightarrow>\n    [in_field (\\<le>\\<^bsub>L2 x1 (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x1) x2'\\<^esub>)) l2\"\n  and \"x \\<le>\\<^bsub>L1\\<^esub> x\"\n  and \"in_field (\\<le>\\<^bsub>L2 x x\\<^esub>) y\"\n  shows \"l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y \\<equiv>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub> l2\\<^bsub>(l1 x) x\\<^esub> y\"\nproof (rule bi_relatedI)\n  from \\<open>x \\<le>\\<^bsub>L1\\<^esub> x\\<close> pre_equiv1 have \"l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\" \"x \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x\" \"\\<eta>\\<^sub>1 x \\<le>\\<^bsub>L1\\<^esub> x\"\n    by fastforce+\n  with pre_equiv1 have \"x \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x\" \"\\<eta>\\<^sub>1 x \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x\" by fastforce+\n  from pre_equiv1 \\<open>x \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x\\<close> have \"x \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 (\\<eta>\\<^sub>1 x)\" by fastforce\n  moreover note \\<open>in_field (\\<le>\\<^bsub>L2 x x\\<^esub>) y\\<close>\n    Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_L2 \\<open>\\<eta>\\<^sub>1 x \\<le>\\<^bsub>L1\\<^esub> x\\<close>] \\<open>\\<eta>\\<^sub>1 x \\<le>\\<^bsub>L1\\<^esub> x\\<close>]\n    Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_L2 \\<open>x \\<le>\\<^bsub>L1\\<^esub> x\\<close>] \\<open>\\<eta>\\<^sub>1 x \\<le>\\<^bsub>L1\\<^esub> x\\<close>]\n  ultimately have \"in_field (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x) (\\<eta>\\<^sub>1 x)\\<^esub>) y\" \"in_field (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y\"\n    using \\<open>x \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x\\<close> by blast+\n  moreover note \\<open>x \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x\\<close>\n    Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_l2 \\<open>l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\\<close>] \\<open>\\<eta>\\<^sub>1 x \\<le>\\<^bsub>L1\\<^esub> x\\<close>]\n  ultimately have \"l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y \\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 (l1 x)) (l1 x)\\<^esub> l2\\<^bsub>(l1 x) x\\<^esub> y\" by auto\n  moreover from pre_equiv1 \\<open>l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\\<close>\n    have \"\\<epsilon>\\<^sub>1 (l1 x) \\<le>\\<^bsub>R1\\<^esub> l1 x\" \"l1 x \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 (l1 x)\" by fastforce+\n  moreover note Dep_Fun_Rel_relD[OF dep_mono_wrt_relD\n    [OF mono_R2 \\<open>l1 x \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 (l1 x)\\<close>] \\<open>l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\\<close>]\n  ultimately show \"l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y \\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub> l2\\<^bsub>(l1 x) x\\<^esub> y\" by blast\n  note \\<open>\\<eta>\\<^sub>1 x \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x\\<close> \\<open>in_field (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y\\<close>\n    Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_l2 \\<open>l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\\<close>] \\<open>x \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x\\<close>]\n  then show \"l2\\<^bsub>(l1 x) x\\<^esub> y \\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub> l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y\" by auto\nqed\n\nlemma r2_counit_bi_rel_selfI:\n  assumes pre_equiv1: \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and mono_L2:\n    \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3 x4 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | (x2 \\<le>\\<^bsub>L1\\<^esub> x3 \\<and> x4 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x3)] \\<Rrightarrow> (\\<ge>)) L2\"\n  and mono_R2:\n    \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3' x4' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | (x2' \\<le>\\<^bsub>R1\\<^esub> x3' \\<and> x4' \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 x3')] \\<Rrightarrow> (\\<ge>)) R2\"\n  and mono_r2: \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | x2 \\<^bsub>L1\\<^esub>\\<lessapprox> x1'] \\<Rrightarrow>\n    [in_field (\\<le>\\<^bsub>R2 (l1 x1) x2'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 (r1 x2')\\<^esub>)) r2\"\n  and \"x' \\<le>\\<^bsub>R1\\<^esub> x'\"\n  and \"in_field (\\<le>\\<^bsub>R2 x' x'\\<^esub>) y'\"\n  shows \"r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y' \\<equiv>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub> r2\\<^bsub>(r1 x') x'\\<^esub> y'\"\nproof (rule bi_relatedI)\n  from \\<open>x' \\<le>\\<^bsub>R1\\<^esub> x'\\<close> pre_equiv1 have \"r1 x' \\<le>\\<^bsub>L1\\<^esub> r1 x'\" \"x' \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 x'\" \"\\<epsilon>\\<^sub>1 x' \\<le>\\<^bsub>R1\\<^esub> x'\"\n    by fastforce+\n  with pre_equiv1 have \"r1 x' \\<^bsub>L1\\<^esub>\\<lessapprox> x'\" \"r1 x' \\<^bsub>L1\\<^esub>\\<lessapprox> \\<epsilon>\\<^sub>1 x'\" by fastforce+\n  from pre_equiv1 \\<open>x' \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 x'\\<close> have \"x' \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 (\\<epsilon>\\<^sub>1 x')\" by fastforce\n  moreover note \\<open>in_field (\\<le>\\<^bsub>R2 x' x'\\<^esub>) y'\\<close>\n    Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_R2 \\<open>\\<epsilon>\\<^sub>1 x' \\<le>\\<^bsub>R1\\<^esub> x'\\<close>] \\<open>\\<epsilon>\\<^sub>1 x' \\<le>\\<^bsub>R1\\<^esub> x'\\<close>]\n    Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_R2 \\<open>\\<epsilon>\\<^sub>1 x' \\<le>\\<^bsub>R1\\<^esub> x'\\<close>] \\<open>x' \\<le>\\<^bsub>R1\\<^esub> x'\\<close>]\n  ultimately have \"in_field (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub>) y'\" \"in_field (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y'\"\n    using \\<open>x' \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 x'\\<close> \\<open>x' \\<le>\\<^bsub>R1\\<^esub> x'\\<close> by blast+\n  moreover note \\<open>r1 x' \\<^bsub>L1\\<^esub>\\<lessapprox> \\<epsilon>\\<^sub>1 x'\\<close>\n    Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_r2 \\<open>r1 x' \\<le>\\<^bsub>L1\\<^esub> r1 x'\\<close>] \\<open>\\<epsilon>\\<^sub>1 x' \\<le>\\<^bsub>R1\\<^esub> x'\\<close>]\n  ultimately show \"r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y' \\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub> r2\\<^bsub>(r1 x') x'\\<^esub> y'\" by auto\n  note \\<open>r1 x' \\<^bsub>L1\\<^esub>\\<lessapprox> x'\\<close> \\<open>in_field (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub>) y'\\<close>\n    Dep_Fun_Rel_relD[OF dep_mono_wrt_relD[OF mono_r2 \\<open>r1 x' \\<le>\\<^bsub>L1\\<^esub> r1 x'\\<close>] \\<open>x' \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 x'\\<close>]\n  then have \"r2\\<^bsub>(r1 x') x'\\<^esub> y' \\<le>\\<^bsub>L2 (r1 x') (\\<eta>\\<^sub>1 (r1 x'))\\<^esub> r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y'\" by auto\n  moreover from pre_equiv1 \\<open>r1 x' \\<le>\\<^bsub>L1\\<^esub> r1 x'\\<close>\n    have \"\\<eta>\\<^sub>1 (r1 x') \\<le>\\<^bsub>L1\\<^esub> r1 x'\" \"r1 x' \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 (r1 x')\" by fastforce+\n  moreover note Dep_Fun_Rel_relD[OF dep_mono_wrt_relD\n    [OF mono_L2 \\<open>r1 x' \\<le>\\<^bsub>L1\\<^esub> r1 x'\\<close>] \\<open>r1 x' \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 (r1 x')\\<close>]\n  ultimately show \"r2\\<^bsub>(r1 x') x'\\<^esub> y' \\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub> r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y'\"\n    using pre_equiv1 by blast\nqed\n\nend\n\n\nparagraph \\<open>Function Relator\\<close>\n\ncontext transport_Fun_Rel\nbegin\n\ncorollary rel_unit_self_if_rel_selfI:\n  assumes \"inflationary_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"transitive (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2\\<^esub>)) l2\"\n  and \"((\\<le>\\<^bsub>R2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2\\<^esub>)) r2\"\n  and \"inflationary_on (in_codom (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and \"transitive (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> f\"\n  shows \"f \\<le>\\<^bsub>L\\<^esub> \\<eta> f\"\n  using assms by (intro tdfr.rel_unit_self_if_rel_selfI) simp_all\n\ncorollary counit_rel_self_if_rel_selfI:\n  assumes \"deflationary_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>) \\<epsilon>\\<^sub>1\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"transitive (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2\\<^esub>)) l2\"\n  and \"((\\<le>\\<^bsub>R2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2\\<^esub>)) r2\"\n  and \"deflationary_on (in_dom (\\<le>\\<^bsub>R2\\<^esub>)) (\\<le>\\<^bsub>R2\\<^esub>) \\<epsilon>\\<^sub>2\"\n  and \"transitive (\\<le>\\<^bsub>R2\\<^esub>)\"\n  and \"g \\<le>\\<^bsub>R\\<^esub> g\"\n  shows \"\\<epsilon> g \\<le>\\<^bsub>R\\<^esub> g\"\n  using assms by (intro tdfr.counit_rel_self_if_rel_selfI) simp_all\n\nlemma bi_related_unit_self_if_rel_selfI:\n  assumes \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and \"transitive (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2\\<^esub>)) l2\"\n  and \"((\\<le>\\<^bsub>R2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2\\<^esub>)) r2\"\n  and \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and \"transitive (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> f\"\n  shows \"f \\<equiv>\\<^bsub>L\\<^esub> \\<eta> f\"\n  using assms by (intro tdfr.bi_related_unit_self_if_rel_selfI) simp_all\n\nend\n\n\nparagraph \\<open>Monotone Dependent Function Relator\\<close>\n\ncontext transport_Mono_Dep_Fun_Rel\nbegin\n\nsubparagraph \\<open>Inflationary\\<close>\n\nlemma inflationary_on_unitI:\n  assumes \"(tdfr.L \\<Rrightarrow>\\<^sub>m tdfr.R) l\" and \"(tdfr.R \\<Rrightarrow>\\<^sub>m tdfr.L) r\"\n  and \"inflationary_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"transitive (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x x\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>)) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> inflationary_on (in_codom (\\<le>\\<^bsub>L2 x x\\<^esub>)) (\\<le>\\<^bsub>L2 x x\\<^esub>) (\\<eta>\\<^bsub>2 x (l1 x)\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_codom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y \\<Longrightarrow>\n    (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y) \\<le> (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  shows \"inflationary_on (in_field (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\n  unfolding left_rel_eq_tdfr_left_Refl_Rel using assms\n  by (intro inflationary_onI Refl_RelI)\n  (auto intro: tdfr.rel_unit_self_if_rel_selfI[simplified unit_eq] elim!: Refl_RelE)\n\n\nsubparagraph \\<open>Deflationary\\<close>\n\nlemma deflationary_on_counitI:\n  assumes \"(tdfr.L \\<Rrightarrow>\\<^sub>m tdfr.R) l\" and \"(tdfr.R \\<Rrightarrow>\\<^sub>m tdfr.L) r\"\n  and \"deflationary_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>) \\<epsilon>\\<^sub>1\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"transitive (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)) (l2\\<^bsub> x' (r1 x')\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow>\n    ((\\<le>\\<^bsub>R2 x' x'\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>)) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> deflationary_on (in_dom (\\<le>\\<^bsub>R2 x' x'\\<^esub>)) (\\<le>\\<^bsub>R2 x' x'\\<^esub>) (\\<epsilon>\\<^bsub>2 (r1 x') x'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x' y'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> in_dom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y' \\<Longrightarrow>\n    (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y') \\<le> (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y')\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  shows \"deflationary_on (in_field (\\<le>\\<^bsub>R\\<^esub>)) (\\<le>\\<^bsub>R\\<^esub>) \\<epsilon>\"\n  unfolding right_rel_eq_tdfr_right_Refl_Rel using assms\n  by (intro deflationary_onI Refl_RelI)\n  (auto intro: tdfr.counit_rel_self_if_rel_selfI[simplified counit_eq]\n    elim!: Refl_RelE)\n\n\nsubparagraph \\<open>Relational Equivalence\\<close>\n\ncontext\nbegin\n\ninterpretation flip : transport_Mono_Dep_Fun_Rel R1 L1 r1 l1 R2 L2 r2 l2\n  rewrites \"flip.counit \\<equiv> \\<eta>\" and \"flip.t1.counit \\<equiv> \\<eta>\\<^sub>1\"\n  and \"\\<And>x y. flip.t2_counit x y \\<equiv> \\<eta>\\<^bsub>2 y x\\<^esub>\"\n  by (simp_all add: order_functors.flip_counit_eq_unit)\n\nlemma rel_equivalence_on_unitI:\n  assumes \"(tdfr.L \\<Rrightarrow>\\<^sub>m tdfr.R) l\" and \"(tdfr.R \\<Rrightarrow>\\<^sub>m tdfr.L) r\"\n  and rel_equiv_unit1: \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and trans_L1: \"transitive (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x x\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x x\\<^esub>)) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> rel_equivalence_on (in_field (\\<le>\\<^bsub>L2 x x\\<^esub>)) (\\<le>\\<^bsub>L2 x x\\<^esub>) (\\<eta>\\<^bsub>2 x (l1 x)\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x1) x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 x1\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_dom (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x) x\\<^esub>) y \\<Longrightarrow>\n    (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y) \\<le> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_codom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y \\<Longrightarrow>\n    (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y) \\<le> (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  shows \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\nproof -\n  from rel_equiv_unit1 trans_L1 have \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n    by (intro reflexive_on_in_field_if_transitive_if_rel_equivalence_on)\n  with assms show ?thesis\n    by (intro rel_equivalence_onI inflationary_on_unitI\n      flip.deflationary_on_counitI)\n    (auto intro!: tdfr.bi_related_unit_self_if_rel_self_aux\n      intro: inflationary_on_if_le_pred_if_inflationary_on\n        deflationary_on_if_le_pred_if_deflationary_on\n        reflexive_on_if_le_pred_if_reflexive_on\n        in_field_if_in_dom in_field_if_in_codom\n      elim!: rel_equivalence_onE\n      simp only:)\nqed\n\nend\n\nsubparagraph \\<open>Order Equivalence\\<close>\n\ninterpretation flip : transport_Mono_Dep_Fun_Rel R1 L1 r1 l1 R2 L2 r2 l2\n  rewrites \"flip.unit \\<equiv> \\<epsilon>\" and \"flip.t1.unit \\<equiv> \\<epsilon>\\<^sub>1\"\n  and \"flip.counit \\<equiv> \\<eta>\" and \"flip.t1.counit \\<equiv> \\<eta>\\<^sub>1\"\n  and \"\\<And>x y. flip.t2_unit x y \\<equiv> \\<epsilon>\\<^bsub>2 y x\\<^esub>\"\n  by (simp_all add: order_functors.flip_counit_eq_unit)\n\nlemma order_equivalenceI:\n  assumes \"(tdfr.L \\<Rrightarrow>\\<^sub>m tdfr.R) l\" and \"(tdfr.R \\<Rrightarrow>\\<^sub>m tdfr.L) r\"\n  and \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and \"rel_equivalence_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>) \\<epsilon>\\<^sub>1\"\n  and \"transitive (\\<le>\\<^bsub>L1\\<^esub>)\" and \"transitive (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x x\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 x' x'\\<^esub>)) (l2\\<^bsub>x' (r1 x')\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> ((\\<le>\\<^bsub>R2 x' x'\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>)) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x x\\<^esub>)) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> rel_equivalence_on (in_field (\\<le>\\<^bsub>L2 x x\\<^esub>)) (\\<le>\\<^bsub>L2 x x\\<^esub>) (\\<eta>\\<^bsub>2 x (l1 x)\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow>\n    rel_equivalence_on (in_field (\\<le>\\<^bsub>R2 x' x'\\<^esub>)) (\\<le>\\<^bsub>R2 x' x'\\<^esub>) (\\<epsilon>\\<^bsub>2 (r1 x') x'\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x1) x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 x1\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x2' x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' (\\<epsilon>\\<^sub>1 x2')\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_dom (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x) x\\<^esub>) y \\<Longrightarrow>\n    (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y) \\<le> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_codom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y \\<Longrightarrow>\n    (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y) \\<le> (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y)\"\n  and \"\\<And>x' y'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> in_dom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y' \\<Longrightarrow>\n    (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y') \\<le> (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y')\"\n  and \"\\<And>x' y'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> in_codom (\\<le>\\<^bsub>R2 x' (\\<epsilon>\\<^sub>1 x')\\<^esub>) y' \\<Longrightarrow>\n    (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y') \\<le> (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y')\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>R1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1 x2\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms\n  by (intro order_equivalenceI rel_equivalence_on_unitI flip.rel_equivalence_on_unitI\n    mono_wrt_rel_leftI flip.mono_wrt_rel_leftI)\n  auto\n\nlemma order_equivalence_if_preorder_equivalenceI:\n  assumes pre_equiv1: \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and order_equiv2: \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow>\n    ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n  and L2_les: \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n    \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x1) x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n    \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 x1\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n    \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and R2_les: \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x2' x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n    \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n    \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n    \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' (\\<epsilon>\\<^sub>1 x2')\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow>\n    ([in_dom (\\<le>\\<^bsub>L2 (r1 x1') (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)) (l2\\<^bsub>x1' (r1 x1')\\<^esub>) (l2\\<^bsub>x2' (r1 x1')\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow>\n    ([in_codom (\\<le>\\<^bsub>L2 (r1 x1') (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)) (l2\\<^bsub>x2' (r1 x1')\\<^esub>) (l2\\<^bsub>x2' (r1 x2')\\<^esub>)\"\n  and l2_bi_rel: \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_field (\\<le>\\<^bsub>L2 x x\\<^esub>) y \\<Longrightarrow>\n    l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y \\<equiv>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub> l2\\<^bsub>(l1 x) x\\<^esub> y\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow>\n    ([in_codom (\\<le>\\<^bsub>R2 (l1 x1) (l1 x2)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)) (r2\\<^bsub>x1 (l1 x2)\\<^esub>) (r2\\<^bsub>x2 (l1 x2)\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow>\n    ([in_dom (\\<le>\\<^bsub>R2 (l1 x1) (l1 x2)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)) (r2\\<^bsub>x1 (l1 x1)\\<^esub>) (r2\\<^bsub>x1 (l1 x2)\\<^esub>)\"\n  and r2_bi_rel: \"\\<And>x' y'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> in_field (\\<le>\\<^bsub>R2 x' x'\\<^esub>) y' \\<Longrightarrow>\n    r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y' \\<equiv>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub> r2\\<^bsub>(r1 x') x'\\<^esub> y'\"\n  and trans_L2: \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and trans_R2: \"\\<And>x1 x2. x1 \\<le>\\<^bsub>R1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1 x2\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R\\<^esub>)) l r\"\nproof -\n  from pre_equiv1 L2_les have L2_unit_eq1: \"(\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x) x\\<^esub>) = (\\<le>\\<^bsub>L2 x x\\<^esub>)\"\n    and L2_unit_eq2: \"(\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) = (\\<le>\\<^bsub>L2 x x\\<^esub>)\"\n    if \"x \\<le>\\<^bsub>L1\\<^esub> x\" for x using \\<open>x \\<le>\\<^bsub>L1\\<^esub> x\\<close>\n    by (auto elim!: t1.preorder_equivalence_order_equivalenceE\n      intro!: tdfr.left_rel2_unit_eqs_left_rel2I bi_related_if_rel_equivalence_on\n      simp del: t1.unit_eq)\n  from pre_equiv1 R2_les have R2_counit_eq1: \"(\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) = (\\<le>\\<^bsub>R2 x' x'\\<^esub>)\"\n    and R2_counit_eq2: \"(\\<le>\\<^bsub>R2 x' (\\<epsilon>\\<^sub>1 x')\\<^esub>) = (\\<le>\\<^bsub>R2 x' x'\\<^esub>)\" (is ?goal2)\n    if \"x' \\<le>\\<^bsub>R1\\<^esub> x'\" for x' using \\<open>x' \\<le>\\<^bsub>R1\\<^esub> x'\\<close>\n    by (auto elim!: t1.preorder_equivalence_order_equivalenceE\n      intro!: flip.tdfr.left_rel2_unit_eqs_left_rel2I bi_related_if_rel_equivalence_on\n      simp del: t1.counit_eq)\n  from order_equiv2 have\n    mono_l2: \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>)\"\n    and mono_r2: \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow> ((\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>)) (r2\\<^bsub>x x'\\<^esub>)\"\n    by auto\n  moreover have \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L2 x x\\<^esub>)) (\\<le>\\<^bsub>L2 x x\\<^esub>) (\\<eta>\\<^bsub>2 x (l1 x)\\<^esub>)\" (is ?goal1)\n    and \"((\\<le>\\<^bsub>L2 x x\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>)\" (is ?goal2)\n    if [iff]: \"x \\<le>\\<^bsub>L1\\<^esub> x\" for x\n  proof -\n    from pre_equiv1 have \"x \\<^bsub>L1\\<^esub>\\<lessapprox> l1 x\"\n      by (auto intro!: t1.GaloisI\n        elim!: t1.preorder_equivalence_order_equivalenceE t1.order_equivalenceE)\n    with order_equiv2 have \"((\\<le>\\<^bsub>L2 x x\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n      by (auto simp flip: L2_unit_eq2)\n    then show ?goal1 ?goal2 by (auto elim: order_functors.order_equivalenceE)\n  qed\n  moreover have\n    \"rel_equivalence_on (in_field (\\<le>\\<^bsub>R2 x' x'\\<^esub>)) (\\<le>\\<^bsub>R2 x' x'\\<^esub>) (\\<epsilon>\\<^bsub>2 (r1 x') x'\\<^esub>)\" (is ?goal1)\n    and \"((\\<le>\\<^bsub>R2 x' x'\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>)) (r2\\<^bsub>(r1 x') x'\\<^esub>)\" (is ?goal2)\n    if [iff]: \"x' \\<le>\\<^bsub>R1\\<^esub> x'\" for x'\n  proof -\n    from pre_equiv1 have \"r1 x' \\<^bsub>L1\\<^esub>\\<lessapprox> x'\" by blast\n    with order_equiv2 have \"((\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R2 x' x'\\<^esub>)) (l2\\<^bsub>x' (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n      by (auto simp flip: R2_counit_eq1)\n    then show ?goal1 ?goal2 by (auto elim: order_functors.order_equivalenceE)\n  qed\n  moreover from mono_l2 tdfr.mono_wrt_rel_left2_if_mono_wrt_rel_left2_if_GaloisI\n    have \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 (r1 x1') (r1 x2')\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)) (l2\\<^bsub>x2' (r1 x1')\\<^esub>)\"\n    using pre_equiv1 R2_les(2) by blast\n  moreover from pre_equiv1 have \"((\\<le>\\<^bsub>L1\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n    by (intro t1.half_galois_prop_right_left_right_if_transitive_if_order_equivalence)\n    (auto elim!: t1.preorder_equivalence_order_equivalenceE)\n  moreover with mono_r2 tdfr.mono_wrt_rel_right2_if_mono_wrt_rel_right2_if_GaloisI\n    have \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> ((\\<le>\\<^bsub>R2 (l1 x1) (l1 x2)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>)) (r2\\<^bsub>x1 (l1 x2)\\<^esub>)\"\n    using pre_equiv1 by blast\n  moreover with L2_les\n    have \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> ((\\<le>\\<^bsub>R2 (l1 x1) (l1 x2)\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)) (r2\\<^bsub>x1 (l1 x2)\\<^esub>)\"\n    by blast\n  moreover have \"in_dom (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x) x\\<^esub>) y \\<Longrightarrow>\n      (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y) \\<le> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y)\"\n      (is \"_ \\<Longrightarrow> ?goal1\")\n    and \"in_codom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y \\<Longrightarrow>\n      (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y) \\<le> (\\<ge>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y)\"\n      (is \"_ \\<Longrightarrow> ?goal2\")\n    if [iff]: \"x \\<le>\\<^bsub>L1\\<^esub> x\" for x y\n  proof -\n    presume \"in_dom (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x) x\\<^esub>) y \\<or> in_codom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y\"\n    then have \"in_field (\\<le>\\<^bsub>L2 x x\\<^esub>) y\" using L2_unit_eq1 L2_unit_eq2 by auto\n    with l2_bi_rel have \"l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y \\<equiv>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub> l2\\<^bsub>(l1 x) x\\<^esub> y\" by blast\n    moreover from pre_equiv1 have \\<open>l1 x \\<le>\\<^bsub>R1\\<^esub> l1 x\\<close> by blast\n    ultimately show ?goal1 ?goal2 using trans_R2 by blast+\n  qed auto\n  moreover have \"in_dom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y' \\<Longrightarrow>\n      (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y') \\<le> (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y')\"\n      (is \"_ \\<Longrightarrow> ?goal1\")\n    and \"in_codom (\\<le>\\<^bsub>R2 x' (\\<epsilon>\\<^sub>1 x')\\<^esub>) y' \\<Longrightarrow>\n      (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y') \\<le> (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y')\"\n      (is \"_ \\<Longrightarrow> ?goal2\")\n    if [iff]: \"x' \\<le>\\<^bsub>R1\\<^esub> x'\" for x' y'\n  proof -\n    presume \"in_dom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y' \\<or> in_codom (\\<le>\\<^bsub>R2 x' (\\<epsilon>\\<^sub>1 x')\\<^esub>) y'\"\n    then have \"in_field (\\<le>\\<^bsub>R2 x' x'\\<^esub>) y'\" using R2_counit_eq1 R2_counit_eq2 by auto\n    with r2_bi_rel have \"r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y' \\<equiv>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub> r2\\<^bsub>(r1 x') x'\\<^esub> y'\"\n      by blast\n    moreover from pre_equiv1 have \\<open>r1 x' \\<le>\\<^bsub>L1\\<^esub> r1 x'\\<close> by blast\n    ultimately show ?goal1 ?goal2 using trans_L2 by blast+\n  qed auto\n  ultimately show ?thesis using assms\n    by (intro order_equivalenceI\n      tdfr.mono_wrt_rel_left_if_transitiveI\n      tdfr.mono_wrt_rel_left2_if_mono_wrt_rel_left2_if_GaloisI\n      tdfr.mono_wrt_rel_right_if_transitiveI\n      tdfr.mono_wrt_rel_right2_if_mono_wrt_rel_right2_if_GaloisI)\n    (auto elim!: t1.preorder_equivalence_order_equivalenceE)\nqed\n\nlemma order_equivalence_if_preorder_equivalenceI':\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 (\\<eta>\\<^sub>1 x1) x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 x1\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x2' x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' (\\<epsilon>\\<^sub>1 x2')\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | x2 \\<^bsub>L1\\<^esub>\\<lessapprox> x1'] \\<Rrightarrow>\n    [in_field (\\<le>\\<^bsub>L2 x1 (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x1) x2'\\<^esub>)) l2\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_field (\\<le>\\<^bsub>L2 x x\\<^esub>) y \\<Longrightarrow>\n    l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y \\<equiv>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub> l2\\<^bsub>(l1 x) x\\<^esub> y\"\n  and \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | x2 \\<^bsub>L1\\<^esub>\\<lessapprox> x1'] \\<Rrightarrow>\n    [in_field (\\<le>\\<^bsub>R2 (l1 x1) x2'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 (r1 x2')\\<^esub>)) r2\"\n  and \"\\<And>x' y'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> in_field (\\<le>\\<^bsub>R2 x' x'\\<^esub>) y' \\<Longrightarrow>\n    r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y' \\<equiv>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub> r2\\<^bsub>(r1 x') x'\\<^esub> y'\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>R1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1 x2\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro order_equivalence_if_preorder_equivalenceI\n    tdfr.order_equivalence_if_order_equivalence_mono_assms_leftI\n    tdfr.order_equivalence_if_order_equivalence_mono_assms_rightI\n    reflexive_on_in_field_if_transitive_if_rel_equivalence_on)\n  (auto elim!: t1.preorder_equivalence_order_equivalenceE)\n\nlemma order_equivalence_if_mono_if_preorder_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n  and \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | \\<eta>\\<^sub>1 x2 \\<le>\\<^bsub>L1\\<^esub> x1] \\<Rrightarrow>\\<^sub>m [x3 x4 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | x2 \\<le>\\<^bsub>L1\\<^esub> x3] \\<Rrightarrow> (\\<le>)) L2\"\n  and \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3 x4 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | (x2 \\<le>\\<^bsub>L1\\<^esub> x3 \\<and> x4 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x3)] \\<Rrightarrow> (\\<ge>)) L2\"\n  and \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | \\<epsilon>\\<^sub>1 x2' \\<le>\\<^bsub>R1\\<^esub> x1'] \\<Rrightarrow>\\<^sub>m [x3' x4' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | x2' \\<le>\\<^bsub>R1\\<^esub> x3'] \\<Rrightarrow> (\\<le>)) R2\"\n  and \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3' x4' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | (x2' \\<le>\\<^bsub>R1\\<^esub> x3' \\<and> x4' \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 x3')] \\<Rrightarrow> (\\<ge>)) R2\"\n  and \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | x2 \\<^bsub>L1\\<^esub>\\<lessapprox> x1'] \\<Rrightarrow>\n    [in_field (\\<le>\\<^bsub>L2 x1 (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x1) x2'\\<^esub>)) l2\"\n  and \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | x2 \\<^bsub>L1\\<^esub>\\<lessapprox> x1'] \\<Rrightarrow>\n    [in_field (\\<le>\\<^bsub>R2 (l1 x1) x2'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 (r1 x2')\\<^esub>)) r2\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>R1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1 x2\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro order_equivalence_if_preorder_equivalenceI'\n    tdfr.l2_unit_bi_rel_selfI tdfr.r2_counit_bi_rel_selfI\n    tdfr.left_rel_right_iff_left_right_rel_if_galois_prop_le_assms_leftI\n    flip.tdfr.left_rel_right_iff_left_right_rel_if_galois_prop_le_assms_leftI\n    tdfr.left_rel_right_iff_left_right_rel_if_galois_prop_le_assms_rightI\n    flip.tdfr.left_rel_right_iff_left_right_rel_if_galois_prop_le_assms_rightI\n    t1.galois_connection_left_right_if_transitive_if_order_equivalence\n    flip.t1.galois_connection_left_right_if_transitive_if_order_equivalence\n    reflexive_on_in_field_if_transitive_if_rel_equivalence_on)\n  (auto elim!: t1.preorder_equivalence_order_equivalenceE)\n\ntheorem order_equivalence_if_mono_if_preorder_equivalenceI':\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n  and \"([x1 x2 \\<Colon> (\\<ge>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3 x4 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | x1 \\<le>\\<^bsub>L1\\<^esub> x3] \\<Rrightarrow> (\\<le>)) L2\"\n  and \"([x1' x2' \\<Colon> (\\<ge>\\<^bsub>R1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3' x4' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | x1' \\<le>\\<^bsub>R1\\<^esub> x3'] \\<Rrightarrow> (\\<le>)) R2\"\n  and \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | x2 \\<^bsub>L1\\<^esub>\\<lessapprox> x1'] \\<Rrightarrow>\n    [in_field (\\<le>\\<^bsub>L2 x1 (r1 x2')\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x1) x2'\\<^esub>)) l2\"\n  and \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | x2 \\<^bsub>L1\\<^esub>\\<lessapprox> x1'] \\<Rrightarrow>\n    [in_field (\\<le>\\<^bsub>R2 (l1 x1) x2'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 x1 (r1 x2')\\<^esub>)) r2\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro order_equivalence_if_mono_if_preorder_equivalenceI\n    tdfr.galois_equivalence_if_mono_if_galois_equivalence_mono_assms_leftI\n    flip.tdfr.galois_equivalence_if_mono_if_galois_equivalence_mono_assms_leftI\n    tdfr.transitive_left2_if_preorder_equivalenceI\n    tdfr.transitive_right2_if_preorder_equivalenceI\n    t1.preorder_on_in_field_left_if_transitive_if_order_equivalence\n    flip.t1.preorder_on_in_field_left_if_transitive_if_order_equivalence\n    t1.galois_equivalence_left_right_if_transitive_if_order_equivalence\n    flip.t1.galois_equivalence_left_right_if_transitive_if_order_equivalence)\n  (auto elim!: t1.preorder_equivalence_order_equivalenceE\n    t2.preorder_equivalence_order_equivalenceE)\n\nend\n\n\nparagraph \\<open>Monotone Function Relator\\<close>\n\ncontext transport_Mono_Fun_Rel\nbegin\n\ninterpretation flip : transport_Mono_Fun_Rel R1 L1 r1 l1 R2 L2 r2 l2 .\n\nlemma inflationary_on_unitI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\"\n  and \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"inflationary_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"transitive (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2\\<^esub>)) l2\"\n  and \"((\\<le>\\<^bsub>R2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2\\<^esub>)) r2\"\n  and \"inflationary_on (in_codom (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and \"transitive (\\<le>\\<^bsub>L2\\<^esub>)\"\n  shows \"inflationary_on (in_field (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\n  using assms by (intro tpdfr.inflationary_on_unitI\n    tfr.mono_wrt_rel_leftI flip.tfr.mono_wrt_rel_leftI)\n  simp_all\n\nlemma deflationary_on_counitI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\"\n  and \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"deflationary_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>) \\<epsilon>\\<^sub>1\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"transitive (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2\\<^esub>)) l2\"\n  and \"((\\<le>\\<^bsub>R2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2\\<^esub>)) r2\"\n  and \"deflationary_on (in_dom (\\<le>\\<^bsub>R2\\<^esub>)) (\\<le>\\<^bsub>R2\\<^esub>) \\<epsilon>\\<^sub>2\"\n  and \"transitive (\\<le>\\<^bsub>R2\\<^esub>)\"\n  shows \"deflationary_on (in_field (\\<le>\\<^bsub>R\\<^esub>)) (\\<le>\\<^bsub>R\\<^esub>) \\<epsilon>\"\n  using assms by (intro tpdfr.deflationary_on_counitI\n    tfr.mono_wrt_rel_leftI flip.tfr.mono_wrt_rel_leftI)\n  simp_all\n\nlemma rel_equivalence_on_unitI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\"\n  and \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>) \\<eta>\\<^sub>1\"\n  and \"transitive (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2\\<^esub>)) l2\"\n  and \"((\\<le>\\<^bsub>R2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2\\<^esub>)) r2\"\n  and \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L2\\<^esub>)) (\\<le>\\<^bsub>L2\\<^esub>) \\<eta>\\<^sub>2\"\n  and \"transitive (\\<le>\\<^bsub>L2\\<^esub>)\"\n  shows \"rel_equivalence_on (in_field (\\<le>\\<^bsub>L\\<^esub>)) (\\<le>\\<^bsub>L\\<^esub>) \\<eta>\"\n  using assms by (intro tpdfr.rel_equivalence_on_unitI\n    tfr.mono_wrt_rel_leftI flip.tfr.mono_wrt_rel_leftI)\n  simp_all\n\nlemma order_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<equiv>\\<^bsub>pre\\<^esub> (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro tpdfr.order_equivalenceI\n    tfr.mono_wrt_rel_leftI flip.tfr.mono_wrt_rel_leftI)\n  (auto elim!: tdfrs.t1.preorder_equivalence_order_equivalenceE\n    tdfrs.t2.preorder_equivalence_order_equivalenceE)\n\nend\n\n\nend", "meta": {"author": "kappelmann", "repo": "transport-isabelle", "sha": "b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff", "save_path": "github-repos/isabelle/kappelmann-transport-isabelle", "path": "github-repos/isabelle/kappelmann-transport-isabelle/transport-isabelle-b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff/Transport/Functions/Transport_Functions_Order_Equivalence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544210587585, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.3250844791400058}}
{"text": "theory SM_Pid\nimports Pid_Scheduler SM_Visible\nbegin\n\n  type_synonym pid_global_config = \"(cmdc,local_state,global_state) pid_global_config\"\n  type_synonym global_action = \"(cmdc,action) global_action\"\n\n  context cprog begin\n    definition pid_init_gc :: \"pid_global_config\" where\n      \"pid_init_gc \\<equiv> \\<lparr>\n        pid_global_config.processes = (map init_pc (program.processes prog)),\n        pid_global_config.state = \\<lparr>\n          global_state.variables = init_valuation (program.global_vars prog)\n        \\<rparr>\n      \\<rparr>\"\n  end\n\n  context visible_prog begin  \n\n    definition pid_interp_gc :: \"pid_global_config \\<Rightarrow> exp set\" where\n      \"pid_interp_gc gc \\<equiv> interp_gs (pid_global_config.state gc)\"\n  \n    sublocale Pid_Gen_Scheduler_linit \n      cfgc la_en' la_ex' \n      \"{init_gc}\" interp_gc\n      pid_init_gc pid_interp_gc\n      apply unfold_locales\n      apply (auto simp: pid_init_gc_def pidgc_\\<alpha>_def init_gc_def\n          interp_gc_def pid_interp_gc_def)\n      done\n\n    lemma \"pid.accept = lv.sa.accept\"  \n      by (rule pid_accept_eq)\n\n    lemma pid_run_sim': \"pid.g.is_run r \\<Longrightarrow> \n      ref_is_run prog (Some o gc_\\<alpha> o pidgc_\\<alpha> o r)\"\n      apply (drule pid_run_sim)\n      using lih'_is_run_sim\n      unfolding lih'.sa.is_run_def\n      unfolding li.sa.is_run_def\n      unfolding lv.sa.is_run_def\n      apply simp\n      using comp_assoc\n      by (metis (no_types, lifting) comp_eq_dest_lhs)\n      \n    lemma ga_accept_eq': \"ga.accept = lv.sa.accept\"\n      unfolding ga_accept_eq ..\n      \n\n    lemma ga_run_sim': \"ga.is_run r \\<Longrightarrow> \n      ref_is_run prog (Some o gc_\\<alpha> o pidgc_\\<alpha> o r)\"\n      using pid_run_sim'\n      unfolding ga_run_eq\n      by simp\n  \n    lemma jsys_lang_eq: \"snth ` jsys.language = Collect (lv.sa.accept)\"\n      by (rule accept_eq_lang)\n\n    lemma pid_finite_reachable: \"finite (pid.g.E\\<^sup>* `` pid.g.V0)\"\n    proof -\n      { fix lcs s\n        have \"{gc. \n          mset (pid_global_config.processes gc) = lcs \n          \\<and> pid_global_config.state gc = s}\n        = ((\\<lambda>a. pid_global_config.make a s))`{a. mset a = lcs}\"\n          apply (auto simp: pid_global_config.make_def)\n          apply (case_tac x, auto)\n          done\n      } note aux=this\n  \n      show ?thesis\n        apply (rule bisim.s1.reachable_finite_sim)\n        using lih'_finite_reachable apply simp\n        apply (clarsimp simp: build_rel_def pidgc_\\<alpha>_def)\n        apply (case_tac b)\n        apply clarsimp\n        apply (subst aux)\n        apply (rule finite_imageI)\n        by simp\n    qed\n  \n    sublocale jsys: transition_system_finite_nodes\n      ga_ex \"\\<lambda> a p. a \\<in> ga_en p\" \"\\<lambda> p. p = pid_init_gc\"\n      apply unfold_locales\n      unfolding reachable_alt\n      unfolding ga_automaton_def\n      apply simp\n      unfolding ga_step_eq[abs_def]\n      using pid_finite_reachable\n      by simp\n\n\n  end\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/Refine/SM_Pid.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544085240401, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.32508447331259555}}
{"text": "(*  Title:      JinjaDCI/BV/LBVJVM.thy\n\n    Author:     Tobias Nipkow, Gerwin Klein, Susannah Mansky\n    Copyright   2000 TUM, 2020 UIUC\n\n    Based on the Jinja theory BV/LBVJVM.thy by Tobias Nipkow and Gerwin Klein\n*)\n\nsection \\<open> LBV for the JVM \\label{sec:JVM} \\<close>\n\ntheory LBVJVM\nimports Jinja.Abstract_BV TF_JVM\nbegin\n\ntype_synonym prog_cert = \"cname \\<Rightarrow> mname \\<Rightarrow> ty\\<^sub>i' err list\"\n\ndefinition check_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> bool\"\nwhere\n  \"check_cert P mxs mxl n cert \\<equiv> check_types P mxs mxl cert \\<and> size cert = n+1 \\<and>\n                                 (\\<forall>i<n. cert!i \\<noteq> Err) \\<and> cert!n = OK None\"\n\ndefinition lbvjvm :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> \n             ty\\<^sub>i' err list \\<Rightarrow> instr list \\<Rightarrow> ty\\<^sub>i' err \\<Rightarrow> ty\\<^sub>i' err\"\nwhere\n  \"lbvjvm P mxs maxr T\\<^sub>r et cert bs \\<equiv>\n  wtl_inst_list bs cert (JVM_SemiType.sup P mxs maxr) (JVM_SemiType.le P mxs maxr) Err (OK None) (exec P mxs T\\<^sub>r et bs) 0\"\n\ndefinition wt_lbv :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> staticb \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n             ex_table \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> instr list \\<Rightarrow> bool\"\nwhere\n  \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 et cert ins \\<equiv>\n   check_cert P mxs ((case b of Static \\<Rightarrow> 0 | NonStatic \\<Rightarrow> 1)+size Ts+mxl\\<^sub>0) (size ins) cert \\<and>\n   0 < size ins \\<and> \n   (let start  = Some ([],(case b of Static \\<Rightarrow> [] | NonStatic \\<Rightarrow> [OK (Class C)])\n                            @((map OK Ts))@(replicate mxl\\<^sub>0 Err));\n        result = lbvjvm P mxs ((case b of Static \\<Rightarrow> 0 | NonStatic \\<Rightarrow> 1)+size Ts+mxl\\<^sub>0) T\\<^sub>r et cert ins (OK start)\n    in result \\<noteq> Err)\"\n\ndefinition wt_jvm_prog_lbv :: \"jvm_prog \\<Rightarrow> prog_cert \\<Rightarrow> bool\"\nwhere\n  \"wt_jvm_prog_lbv P cert \\<equiv>\n  wf_prog (\\<lambda>P C (mn,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)). wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 et (cert C mn) ins) P\"\n\ndefinition mk_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> instr list \n              \\<Rightarrow> ty\\<^sub>m \\<Rightarrow> ty\\<^sub>i' err list\"\nwhere\n  \"mk_cert P mxs T\\<^sub>r et bs phi \\<equiv> make_cert (exec P mxs T\\<^sub>r et bs) (map OK phi) (OK None)\"\n\ndefinition prg_cert :: \"jvm_prog \\<Rightarrow> ty\\<^sub>P \\<Rightarrow> prog_cert\"\nwhere\n  \"prg_cert P phi C mn \\<equiv> let (C,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)) = method P C mn\n                         in  mk_cert P mxs T\\<^sub>r et ins (phi C mn)\"\n   \nlemma check_certD [intro?]:\n  \"check_cert P mxs mxl n cert \\<Longrightarrow> cert_ok cert n Err (OK None) (states P mxs mxl)\"\n  by (unfold cert_ok_def check_cert_def check_types_def) auto\n\n\nlemma (in start_context) wt_lbv_wt_step:\n  assumes lbv: \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"\n  shows \"\\<exists>\\<tau>s \\<in> list (size is) A. wt_step r Err step \\<tau>s \\<and> OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\"\n(*<*)\nproof -\n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover note bounded_step\n  moreover from lbv have \"cert_ok cert (size is) Err (OK None) A\"\n    by (unfold wt_lbv_def) (auto dest: check_certD)\n  moreover note exec_pres_type\n  moreover\n  from lbv \n  have \"wtl_inst_list is cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (cases b; simp add: wt_lbv_def lbvjvm_def step_def_exec [symmetric])\n  moreover note first_in_A\n  moreover from lbv have \"0 < size is\" by (simp add: wt_lbv_def)\n  ultimately show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])\nqed\n(*>*)\n\n\nlemma (in start_context) wt_lbv_wt_method:\n  assumes lbv: \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"  \n  shows \"\\<exists>\\<tau>s. wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n(*<*)\nproof -\n  from lbv have l: \"is \\<noteq> []\" by (simp add: wt_lbv_def)\n  moreover\n  from wf lbv C Ts obtain \\<tau>s where \n    list:  \"\\<tau>s \\<in> list (size is) A\" and\n    step:  \"wt_step r Err step \\<tau>s\" and    \n    start: \"OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\" \n    by (blast dest: wt_lbv_wt_step)\n  from list have [simp]: \"size \\<tau>s = size is\" by simp\n  have \"size (map ok_val \\<tau>s) = size is\" by simp  \n  moreover from l have 0: \"0 < size \\<tau>s\" by simp\n  with step obtain \\<tau>s0 where \"\\<tau>s!0 = OK \\<tau>s0\"\n    by (unfold wt_step_def) blast\n  with start 0 have \"wt_start P C b Ts mxl\\<^sub>0 (map ok_val \\<tau>s)\"\n    by (cases b; simp add: wt_start_def JVM_le_Err_conv lesub_def Err.le_def)    \n  moreover {\n    from list have \"check_types P mxs mxl \\<tau>s\" by (simp add: check_types_def)\n    also from step  have \"\\<forall>x \\<in> set \\<tau>s. x \\<noteq> Err\" \n      by (auto simp add: all_set_conv_all_nth wt_step_def)    \n    hence [symmetric]: \"map OK (map ok_val \\<tau>s) = \\<tau>s\"\n      by (auto intro!: map_idI)\n    finally have \"check_types P mxs mxl (map OK (map ok_val \\<tau>s))\" .\n  }\n  moreover {  \n    note bounded_step\n    moreover from list have \"set \\<tau>s \\<subseteq> A\" by simp\n    moreover from step have \"wt_err_step (sup_state_opt P) step \\<tau>s\"\n      by (simp add: wt_err_step_def JVM_le_Err_conv)\n    ultimately have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\<tau>s)\"\n      by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def states_def)\n  }    \n  ultimately have \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\<tau>s)\"\n    by (simp add: wt_method_def2 check_types_def del: map_map)\n  thus ?thesis ..\nqed\n(*>*)\n\n  \nlemma (in start_context) wt_method_wt_lbv:\n  assumes wt: \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\" \n  defines [simp]: \"cert \\<equiv> mk_cert P mxs T\\<^sub>r xt is \\<tau>s\"\n  \n  shows \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\" \n(*<*)\nproof -\n  let ?\\<tau>s  = \"map OK \\<tau>s\"\n  let ?cert = \"make_cert step ?\\<tau>s (OK None)\"\n\n  from wt obtain \n    0:        \"0 < size is\" and\n    size:     \"size is = size ?\\<tau>s\" and\n    ck_types: \"check_types P mxs mxl ?\\<tau>s\" and\n    wt_start: \"wt_start P C b Ts mxl\\<^sub>0 \\<tau>s\" and\n    app_eff:  \"wt_app_eff (sup_state_opt P) app eff \\<tau>s\"\n    by (force simp add: wt_method_def2 check_types_def) \n  \n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover from wf have \"mono r step (size is) A\" by (rule step_mono)\n  hence \"mono r step (size ?\\<tau>s) A\" by (simp add: size)\n  moreover from exec_pres_type \n  have \"pres_type step (size ?\\<tau>s) A\" by (simp add: size) \n  moreover\n  from ck_types have \\<tau>s_in_A: \"set ?\\<tau>s \\<subseteq> A\" by (simp add: check_types_def)\n  hence \"\\<forall>pc. pc < size ?\\<tau>s \\<longrightarrow> ?\\<tau>s!pc \\<in> A \\<and> ?\\<tau>s!pc \\<noteq> Err\" by auto\n  moreover from bounded_step \n  have \"bounded step (size ?\\<tau>s)\" by (simp add: size)\n  moreover have \"OK None \\<noteq> Err\" by simp\n  moreover from bounded_step size \\<tau>s_in_A app_eff\n  have \"wt_err_step (sup_state_opt P) step ?\\<tau>s\"\n    by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def states_def)    \n  hence \"wt_step r Err step ?\\<tau>s\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  moreover\n  from 0 size have \"0 < size \\<tau>s\" by auto\n  hence \"?\\<tau>s!0 = OK (\\<tau>s!0)\" by simp\n  with wt_start have \"OK first \\<sqsubseteq>\\<^sub>r ?\\<tau>s!0\"\n    by (cases b; clarsimp simp add: wt_start_def lesub_def Err.le_def JVM_le_Err_conv)\n  moreover note first_in_A\n  moreover have \"OK first \\<noteq> Err\" by simp\n  moreover note size \n  ultimately\n  have \"wtl_inst_list is ?cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])\n  moreover from 0 size have \"\\<tau>s \\<noteq> []\" by auto\n  moreover from ck_types have \"check_types P mxs mxl ?cert\"\n    by (fastforce simp: make_cert_def check_types_def JVM_states_unfold\n                  dest!: nth_mem)\n  moreover note 0 size\n  ultimately show ?thesis \n    by (simp add: wt_lbv_def lbvjvm_def mk_cert_def step_def_exec [symmetric]\n                  check_cert_def make_cert_def nth_append)\nqed  \n(*>*)\n\n\ntheorem jvm_lbv_correct:\n  \"wt_jvm_prog_lbv P Cert \\<Longrightarrow> wf_jvm_prog P\"\n(*<*)\nproof -  \n  let ?\\<Phi> = \"\\<lambda>C mn. let (C,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)) = method P C mn in \n              SOME \\<tau>s. wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n  \n  let ?A = \"\\<lambda>P C (mn,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)). wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 et (Cert C mn) ins\"\n  let ?B = \"\\<lambda>P C (M,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). \n                wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (?\\<Phi> C M)\"\n\n  assume wt: \"wt_jvm_prog_lbv P Cert\"\n  then have \"wf_prog ?A P\" by(simp add: wt_jvm_prog_lbv_def)\n  moreover {\n    fix wf_md C M b Ts Ca T m bd\n    assume \"wf_prog wf_md P\" and sees: \"P \\<turnstile> Ca sees M, b :  Ts\\<rightarrow>T = m in Ca\" and\n           \"set Ts \\<subseteq> types P\" and \"bd = (M, b, Ts, T, m)\" and\n           \"?A P Ca bd\"\n    then have \"?B P Ca bd\" using sees_method_is_class[OF sees]\n      by (auto dest!: start_context.wt_lbv_wt_method [OF start_context.intro] \n               intro: someI)\n  }\n  ultimately have \"wf_prog ?B P\" by(rule wf_prog_lift)\n  hence \"wf_jvm_prog\\<^bsub>?\\<Phi>\\<^esub> P\" by (simp add: wf_jvm_prog_phi_def)\n  thus ?thesis by (unfold wf_jvm_prog_def) blast\nqed\n(*>*)\n\ntheorem jvm_lbv_complete:\n  assumes wt: \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\" \n  shows \"wt_jvm_prog_lbv P (prg_cert P \\<Phi>)\"\n(*<*)\nproof -\n  let ?cert = \"prg_cert P \\<Phi>\"\n  let ?A = \"\\<lambda>P C (M,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). \n                wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (\\<Phi> C M)\"\n  let ?B = \"\\<lambda>P C (mn,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)).\n                wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 et (?cert C mn) ins\"\n\n  from wt have \"wf_prog ?A P\" by(clarsimp simp: wf_jvm_prog_def wf_jvm_prog_phi_def)\n  moreover {\n    fix wf_md C M b Ts Ca T m bd\n    assume \"wf_prog wf_md P\" and sees: \"P \\<turnstile> Ca sees M, b :  Ts\\<rightarrow>T = m in Ca\" and\n           \"set Ts \\<subseteq> types P\" and \"bd = (M, b, Ts, T, m)\" and\n           \"?A P Ca bd\"\n    then have \"?B P Ca bd\" using sees_method_is_class[OF sees]\n      by (auto simp add: prg_cert_def \n               intro!: start_context.wt_method_wt_lbv start_context.intro)\n  }\n  ultimately have \"wf_prog ?B P\" by(rule wf_prog_lift)\n  thus \"wt_jvm_prog_lbv P (prg_cert P \\<Phi>)\" by (simp add: wt_jvm_prog_lbv_def)\nqed\n(*>*)\n\nend\n", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/JinjaDCI/BV/LBVJVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6654105720171531, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.32490893337027904}}
{"text": "theory flash69Bra  imports flash69Rev\n \n  begin\nlemma onInv69:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv69  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv69  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv69 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash69Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410572017153, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.324908933370279}}
{"text": "theory flash25Bra  imports flash25Rev\n \n  begin\nlemma onInv25:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv25  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv25  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv25 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash25Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.3249089268905928}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |               November 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2009         |\n            |                   June 2009  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_law_SKIP\nimports CSP_F_law_basic CSP_T.CSP_T_law_SKIP\nbegin\n\n(*****************************************************************\n\n         1. SKIP |[X]| SKIP\n         2. SKIP |[X]| P\n         3. P |[X]| SKIP\n         4. SKIP -- X\n         5. SKIP [[r]]\n         6. SKIP ;; P\n         7. P ;; SKIP\n         8. SKIP |. n\n\n *****************************************************************)\n\n(*********************************************************\n                    SKIP |[X]| SKIP\n *********************************************************)\n\nlemma cspF_Parallel_term:\n   \"SKIP |[X]| SKIP =F[M1,M2] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Parallel_term)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE)\n  apply (simp)\n  apply (fast)\n\n  apply (simp)\n  apply (fast)\ndone\n\n(*********************************************************\n                      SKIP |[X]| P\n *********************************************************)\n\nlemma cspF_Parallel_preterm_l_set1: \n  \"[| Ya - insert Tick (Ev ` X) = Z - insert Tick (Ev ` X) ; Ev ` Y Int Z = {} |]\n   ==> Ev ` (Y - X) Int (Ya Un Z) = {}\"\nby (auto)\n\nlemma cspF_Parallel_preterm_l: \n   \"SKIP |[X]| (? :Y -> Qf) =F[M,M] ? x:(Y-X) -> (SKIP |[X]| Qf x)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Parallel_preterm_l)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (elim disjE conjE exE)\n  apply (simp_all)\n\n  apply (simp add: cspF_Parallel_preterm_l_set1)\n\n  apply (drule_tac x=\"s\" in spec)\n  apply (erule disjE, simp)\n  apply (erule disjE, simp)\n  apply (elim conjE exE, simp)\n  apply (simp add: par_tr_head)\n  apply (fast)\n\n      (* automatized by \"par_tr_nil_Tick\" *)\n\n  apply (drule_tac x=\"s\" in spec)\n  apply (erule disjE, simp)\n  apply (erule disjE, simp)\n  apply (elim conjE exE, simp)\n  apply (simp add: par_tr_head)\n  apply (fast)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE, simp)\n  apply (rule_tac x=\"Xa - {Tick}\" in exI)\n  apply (rule_tac x=\"Xa - (Ev ` X)\" in exI)\n  apply (rule conjI, fast)\n  apply (rule conjI, fast)\n\n  apply (rule conjI)\n  apply (simp add: Evset_def, fast)\n  apply (fast)\n\n (* *)\n  apply (elim disjE conjE exE)\n  apply (simp_all)\n   apply (rule_tac x=\"Ya\" in exI)\n   apply (rule_tac x=\"Z\" in exI, simp)\n   apply (rule_tac x=\"<>\" in exI)\n   apply (rule_tac x=\"<Ev a> ^^^ t\" in exI, simp)\n   apply (simp add: par_tr_head)\n\n   apply (rule_tac x=\"Ya\" in exI)\n   apply (rule_tac x=\"Z\" in exI, simp)\n   apply (rule_tac x=\"<Tick>\" in exI)\n   apply (rule_tac x=\"<Ev a> ^^^ t\" in exI, simp)\n   apply (simp add: par_tr_head)\ndone\n\n(*********************************************************\n                      P |[X]| SKIP\n *********************************************************)\n\nlemma cspF_Parallel_preterm_r: \n   \"(? :Y -> Pf) |[X]| SKIP\n     =F[M,M] ? x:(Y-X) -> (Pf x |[X]| SKIP)\"\napply (rule cspF_trans)\napply (rule cspF_Parallel_commut)\napply (rule cspF_trans)\napply (rule cspF_Parallel_preterm_l)\napply (rule cspF_rm_head, simp)\napply (rule cspF_Parallel_commut)\ndone\n\nlemmas cspF_Parallel_preterm = cspF_Parallel_preterm_l cspF_Parallel_preterm_r\n\n(*********************************************************\n                      SKIP and Parallel\n *********************************************************)\n\n(* p.288 *)\n\nlemma cspF_SKIP_Parallel_Ext_choice_SKIP_l:\n  \"((? :Y -> Pf) [+] SKIP) |[X]| SKIP =F[M,M] \n   (? x:(Y - X) -> (Pf x |[X]| SKIP)) [+] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Parallel_Ext_choice_SKIP_l)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (rule disjI1)\n  apply (blast)\n\n  apply (simp add: par_tr_nil_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp)\n  apply (rule_tac x=\"sb\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n\n  apply (rule, simp add: in_traces)\n\n  apply (simp add: par_tr_Tick_right)\n  apply (elim conjE)\n  apply (simp add: image_iff)\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp)\n  apply (rule_tac x=\"sb\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n\n(* <= *)\n apply (rule, simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (simp add: in_traces)\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (simp)\n\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp add: par_tr_nil_right)\n  apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: par_tr_nil_right)\n  apply (simp add: image_iff)\n  apply (fast)\n\n  apply (rule_tac x=\"Ya\" in exI)\n  apply (rule_tac x=\"Z\" in exI)\n  apply (simp add: par_tr_Tick_right)\n  apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp add: par_tr_Tick_right)\n  apply (simp add: image_iff)\n  apply (fast)\n\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (simp)\n\n  apply (simp add: in_traces)\n\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (rule_tac x=\"Xa\" in exI)\n  apply (simp)\ndone\n\nlemma cspF_SKIP_Parallel_Ext_choice_SKIP_r:\n  \"SKIP |[X]| ((? :Y -> Pf) [+] SKIP)  =F[M,M]\n    (? x:(Y - X) -> (SKIP |[X]| Pf x)) [+] SKIP\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_Parallel_Ext_choice_SKIP_l)\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_commut)\napply (rule cspF_reflex)\napply (rule cspF_reflex)\ndone\n\nlemmas cspF_SKIP_Parallel_Ext_choice_SKIP =\n       cspF_SKIP_Parallel_Ext_choice_SKIP_l\n       cspF_SKIP_Parallel_Ext_choice_SKIP_r\n\n(*********************************************************\n                      SKIP -- X\n *********************************************************)\n\nlemma cspF_SKIP_Hiding_Id: \n   \"SKIP -- X =F[M,M] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Hiding_Id)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp add: Evset_def)\n  apply (fast)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp)\ndone\n\n(*********************************************************\n                      SKIP and Hiding\n *********************************************************)\n\n(* p.288 version\n  \"((? :Y -> Pf) [+] SKIP) -- X =F[M,M]\n       IF (Y Int X = {}) THEN ((? x:Y -> (Pf x -- X)) [+] SKIP)\n                         ELSE (((? x:(Y-X) -> (Pf x -- X)) [+] SKIP)\n                               |~| (! x:(Y Int X) .. (Pf x -- X)))\"\n*)\n\nlemma cspF_SKIP_Hiding_step:\n  \"((? :Y -> Pf) [+] SKIP) -- X =F[M,M]\n   (((? x:(Y-X) -> (Pf x -- X)) [+] SKIP) |~| (! x:(Y Int X) .. (Pf x -- X)))\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Hiding_step)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (simp_all add: in_traces)\n\n  apply (case_tac \"a : X\")\n  apply (simp)\n  apply (blast)\n  apply (force)\n\n(* <= *)\n apply (rule)\n\n  apply (simp add: in_failures)\n  apply (elim conjE exE bexE disjE)\n  apply (simp_all)\n\n   apply (rule_tac x=\"<>\" in exI)\n   apply (simp add: in_traces)\n   apply (simp add: Evset_def)\n   apply (fast)\n\n   apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n   apply (simp)\n\n   apply (rule_tac x=\"<Tick>\" in exI)\n   apply (simp)\n\n   apply (simp add: in_traces)\n\n   apply (rule_tac x=\"<>\" in exI)\n   apply (simp add: Evset_def)\n   apply (fast)\n\n   apply (rule_tac x=\"<Ev a> ^^^ sa\" in exI)\n   apply (simp)\ndone\n\n(*********************************************************\n                      SKIP [[r]]\n *********************************************************)\n\nlemma cspF_SKIP_Renaming_Id: \n   \"SKIP [[r]] =F[M1,M2] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Renaming_Id)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (force)\ndone\n\n(*********************************************************\n                       SKIP ;; P\n *********************************************************)\n\nlemma cspF_Seq_compo_unit_l: \"SKIP ;; P =F[M,M] P\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Seq_compo_unit_l)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (elim conjE disjE)\n apply (simp_all add: Evset_def)\n apply (elim conjE exE)\n apply (simp add: in_traces)\n\n(* <= *)\n apply (rule, simp add: in_failures)\n apply (rule disjI2)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"s\" in exI)\n apply (simp add: in_traces)\ndone\n\n(*********************************************************\n                       P ;; SKIP\n *********************************************************)\n\nlemma cspF_Seq_compo_unit_r: \"P ;; SKIP =F[M,M] P\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Seq_compo_unit_r)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (rule memF_F2, simp, fast)\n apply (rule domF_F2_F4, simp_all)\n apply (fold comp_def, simp)\n apply (rule domF_T3, simp_all)\n apply (fold comp_def, simp)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (insert trace_last_noTick_or_Tick)\n apply (drule_tac x=\"s\" in spec)\n apply (erule disjE)\n  apply (case_tac \"Tick : X\")\n   apply (rule disjI1, simp)\n   apply (subgoal_tac \"insert Tick X = X\", simp, fast)\n   (* Tick ~: X *)\n   apply (case_tac \"s ^^^ <Tick> ~:t [[P]]Tf (fstF o M)\")\n    apply (rule disjI1, simp)\n    apply (rule domF_F3[of \"[[P]]Tf (fstF o M)\" \"failures P M\" _ _ \"{Tick}\", simplified])\n    apply (simp_all add: semTf_def)\n    (* *)\n    apply (rule disjI2)\n    apply (rule_tac x=\"s\" in exI)\n    apply (rule_tac x=\"<>\" in exI, simp)\n    apply (simp add: Evset_def, fast)\n  (* *)\n  apply (elim conjE exE, simp)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (simp)\n  apply (rule domF_T2[of _ \"failures P M\"], simp_all)\ndone\n\nlemmas cspF_Seq_compo_unit = cspF_Seq_compo_unit_l cspF_Seq_compo_unit_r\n\n(*********************************************************\n               SKIP and Sequential composition\n *********************************************************)\n\n(* p.141 *)\n\nlemma cspF_SKIP_Seq_compo_step:\n  \"((? :X -> Pf) [> SKIP) ;; Q =F[M,M] (? x:X -> (Pf x ;; Q)) [> Q\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Seq_compo_step)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (simp add: Evset_def)\n apply (simp add: Evset_def)\n apply (simp add: Evset_def)\n\n apply (rule disjI2)\n apply (rule disjI1)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (drule_tac x=\"sa\" in spec)\n\n apply (elim disjE conjE exE)\n  apply (simp_all)\n  apply (simp add: appt_assoc)\n  apply (rule disjI2)\n  apply (rule disjI1)\n  apply (rule_tac x=\"sc\" in exI)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp)\n\n(* <= *)\n apply (rule, simp add: in_failures in_traces)\n apply (elim conjE exE disjE)\n apply (simp_all)\n\n  apply (rule disjI2)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp)\n\n  apply (rule disjI2)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp)\n\n  apply (rule disjI2)\n  apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp add: appt_assoc)\n\n  apply (rule disjI2)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"s\" in exI)\n  apply (simp)\n\n  apply (rule disjI2)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp)\n  apply (rule proc_F2_F4)\n  apply (simp_all)\ndone\n\n(*********************************************************\n                      SKIP |. n\n *********************************************************)\n\nlemma cspF_SKIP_Depth_rest: \n   \"SKIP |. Suc n =F[M1,M2] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Depth_rest)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE disjE)\n apply (simp)\n apply (simp)\n apply (case_tac \"0 < n\", simp)\n apply (simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (simp)\ndone\n\n(*********************************************************\n                      cspF_SKIP\n *********************************************************)\n\nlemmas cspF_SKIP =\n       cspF_Parallel_term\n       cspF_Parallel_preterm\n       cspF_SKIP_Parallel_Ext_choice_SKIP\n       cspF_SKIP_Hiding_Id\n       cspF_SKIP_Hiding_step\n       cspF_SKIP_Renaming_Id\n       cspF_Seq_compo_unit\n       cspF_SKIP_Seq_compo_step\n       cspF_SKIP_Depth_rest\n\n(*********************************************************\n                       P [+] SKIP\n *********************************************************)\n\n(* p.141 *)\n\nlemma cspF_Ext_choice_SKIP_resolve: \"P [+] SKIP =F[M,M] P [> SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Ext_choice_SKIP_resolve)\napply (rule order_antisym)\n\n(* => *)\n apply (rule, simp add: in_failures)\n apply (force)\n\n(* <= *)\n apply (rule, simp add: in_traces in_failures)\n apply (force)\ndone\n\n(* =================================================== *\n |             addition for CSP-Prover 5               |\n * =================================================== *)\n\n\n(*********************************************************\n                    SKIP ||| P   (--> SKIP)\n *********************************************************)\n\nlemma cspF_Interleave_unit_l: \n  \"SKIP ||| P =F[M,M] P\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Interleave_unit_l)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim disjE conjE exE)\n apply (simp_all)\n  apply (simp add: par_tr_nil_left) \n  apply (subgoal_tac \"Y Un Z = Z\")\n  apply (simp)\n  apply (simp add: Evset_def)\n  apply (force)\n\n  apply (simp add: par_tr_Tick_left)\n  apply (simp add: Tick_in_sett)\n  apply (elim conjE exE)\n  apply (rotate_tac -3)\n  apply (drule sym)\n  apply (simp)\n  apply (rule proc_T2_T3)\n  apply (simp_all)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (rule_tac x=\"X-{Tick}\" in exI)\n apply (rule_tac x=\"X\" in exI)\n apply (simp)\n  apply (rule conjI)\n  apply (force)\n\n apply (case_tac \"noTick s\")\n\n  apply (rule_tac x=\"<>\" in exI)\n  apply (rule_tac x=\"s\" in exI)\n  apply (simp add: par_tr_nil_left) \n  apply (simp add: noTick_def)\n  apply (simp add: Evset_def)\n  apply (force)\n\n  apply (rule_tac x=\"<Tick>\" in exI)\n  apply (rule_tac x=\"s\" in exI)\n  apply (simp)\n  apply (simp add: par_tr_Tick_left)\n  apply (simp add: noTick_def)\ndone\n\n\n(*********************************************************\n                    P ||| SKIP (SKIP)\n *********************************************************)\n\nlemma cspF_Interleave_unit_r: \n  \"P ||| SKIP =F[M,M] P\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (simp add: cspF_Interleave_unit_l)\ndone\n\nlemmas cspF_Interleave_unit =\n       cspF_Interleave_unit_l\n       cspF_Interleave_unit_r\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_law_SKIP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6654105454764747, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.32490892041090647}}
{"text": "(******************************************************************************)\n(* Project: The Isabelle/UTP Proof System                                     *)\n(* File: utp_hoare_ext.thy                                                    *)\n(* Authors: Frank Zeyda and Simon Foster (University of York, UK)             *)\n(* Emails: frank.zeyda@york.ac.uk and simon.foster@york.ac.uk                 *)\n(******************************************************************************)\n\nsection {* Hoare Logic Extensions *}\n\ntheory utp_hoare_ext\nimports utp_hoare\nbegin\n\nsubsection {* Invariant Split Tactic *}\n\ntext {* This tactic is slightly more efficient than @{method hoare_split}. *}\n\nnamed_theorems hoare_split_inv_laws \"splitting laws for Hoare logic\"\n\nlemmas seq_hoare_inv = seq_hoare_invariant\n\nlemma skip_hoare_aux:\n\"\\<lbrace>p \\<and> q\\<rbrace>II\\<lbrace>p\\<rbrace>\\<^sub>u\" by (rel_simp)+\n\nlemma cond_hoare_r':\n\"\\<lbrakk>\\<lbrace>p \\<and> b\\<rbrace>S\\<lbrace>q\\<rbrace>\\<^sub>u ; \\<lbrace>p \\<and> \\<not>b\\<rbrace>T\\<lbrace>q\\<rbrace>\\<^sub>u\\<rbrakk> \\<Longrightarrow> \\<lbrace>p\\<rbrace>S \\<triangleleft> b \\<triangleright>\\<^sub>r T\\<lbrace>q\\<rbrace>\\<^sub>u\"\n  by (rel_auto)\n\ndeclare hoare_r_conj [hoare_split_inv_laws]\ndeclare skip_hoare_r [hoare_split_inv_laws]\ndeclare skip_hoare_aux [hoare_split_inv_laws]\ndeclare assigns_hoare_r [hoare_split_inv_laws]\ndeclare seq_hoare_inv [hoare_split_inv_laws]\ndeclare cond_hoare_r' [hoare_split_inv_laws]\ndeclare while_hoare_r [hoare_split_inv_laws]\ndeclare while_invr_hoare_r [hoare_split_inv_laws]\n\nmethod hoare_split_inv uses add =\n  (rule hoare_split_inv_laws add; (hoare_split_inv add: add))?\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/fmi/utp_hoare_ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947155710234, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3248892273478976}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory WPC\nimports \"WP_Pre\"\nkeywords \"wpc_setup\" :: thy_decl\n\nbegin\n\ndefinition\n  wpc_helper :: \"(('a \\<Rightarrow> bool) \\<times> 'b set)\n                 \\<Rightarrow> (('a \\<Rightarrow> bool) \\<times> 'b set) \\<Rightarrow> bool \\<Rightarrow> bool\" where\n \"wpc_helper \\<equiv> \\<lambda>(P, P') (Q, Q') R. ((\\<forall>s. P s \\<longrightarrow> Q s) \\<and> P' \\<subseteq> Q') \\<longrightarrow> R\"\n\nlemma wpc_conj_process:\n  \"\\<lbrakk> wpc_helper (P, P') (A, A') C; wpc_helper (P, P') (B, B') D \\<rbrakk>\n       \\<Longrightarrow> wpc_helper (P, P') (\\<lambda>s. A s \\<and> B s, A' \\<inter> B') (C \\<and> D)\"\n  by (clarsimp simp add: wpc_helper_def)\n\nlemma wpc_all_process:\n  \"\\<lbrakk> \\<And>x. wpc_helper (P, P') (Q x, Q' x) (R x) \\<rbrakk>\n       \\<Longrightarrow> wpc_helper (P, P') (\\<lambda>s. \\<forall>x. Q x s, {s. \\<forall>x. s \\<in> Q' x}) (\\<forall>x. R x)\"\n  by (clarsimp simp: wpc_helper_def subset_iff)\n\nlemma wpc_all_process_very_weak:\n  \"\\<lbrakk> \\<And>x. wpc_helper (P, P') (Q, Q') (R x) \\<rbrakk> \\<Longrightarrow> wpc_helper (P, P') (Q, Q') (\\<forall>x. R x)\"\n  by (clarsimp simp: wpc_helper_def)\n\nlemma wpc_imp_process:\n  \"\\<lbrakk> Q \\<Longrightarrow> wpc_helper (P, P') (R, R') S \\<rbrakk>\n        \\<Longrightarrow> wpc_helper (P, P') (\\<lambda>s. Q \\<longrightarrow> R s, {s. Q \\<longrightarrow> s \\<in> R'}) (Q \\<longrightarrow> S)\"\n  by (clarsimp simp add: wpc_helper_def subset_iff)\n\nlemma wpc_imp_process_weak:\n  \"\\<lbrakk> wpc_helper (P, P') (R, R') S \\<rbrakk> \\<Longrightarrow> wpc_helper (P, P') (R, R') (Q \\<longrightarrow> S)\"\n  by (clarsimp simp add: wpc_helper_def)\n\nlemmas wpc_processors\n  = wpc_conj_process wpc_all_process wpc_imp_process\nlemmas wpc_weak_processors\n  = wpc_conj_process wpc_all_process wpc_imp_process_weak\nlemmas wpc_vweak_processors\n  = wpc_conj_process wpc_all_process_very_weak wpc_imp_process_weak\n\nlemma wpc_helperI:\n  \"wpc_helper (P, P') (P, P') Q \\<Longrightarrow> Q\"\n  by (simp add: wpc_helper_def)\n\nlemma wpc_foo: \"\\<lbrakk> undefined x; False \\<rbrakk> \\<Longrightarrow> P x\"\n  by simp\n\nlemma foo:\n  assumes foo_elim: \"\\<And>P Q h. \\<lbrakk> foo Q h; \\<And>s. P s \\<Longrightarrow> Q s \\<rbrakk> \\<Longrightarrow> foo P h\"\n  shows\n  \"\\<lbrakk> \\<And>x. foo (Q x) (f x); foo R g \\<rbrakk> \\<Longrightarrow>\n      foo (\\<lambda>s. (\\<forall>x. Q x s) \\<and> (y = None \\<longrightarrow> R s))\n         (case y of Some x \\<Rightarrow> f x | None \\<Rightarrow> g)\"\n  by (auto split: option.split intro: foo_elim)\n\nML \\<open>\n\nsignature WPC = sig\n  exception WPCFailed of string * term list * thm list;\n\n  val foo_thm: thm;\n  val iffd2_thm: thm;\n  val wpc_helperI: thm;\n\n  val instantiate_concl_pred: Proof.context -> cterm -> thm -> thm;\n\n  val detect_term: Proof.context -> thm -> cterm -> (cterm * term) list;\n  val detect_terms: Proof.context -> (term -> cterm -> thm -> tactic) -> tactic;\n\n  val split_term: thm list -> Proof.context -> term -> cterm -> thm -> tactic;\n\n  val wp_cases_tac: thm list -> Proof.context -> tactic;\n  val wp_debug_tac: thm list -> Proof.context -> tactic;\n  val wp_cases_method: thm list -> (Proof.context -> Method.method) context_parser;\n\nend;\n\nstructure WPCPredicateAndFinals = Theory_Data\n(struct\n    type T = (cterm * thm) list\n    val empty = []\n    val extend = I\n    fun merge (xs, ys) =\n        (* Order of predicates is important, so we can't reorder *)\n        let val tms = map (Thm.term_of o fst) xs\n            fun inxs x = exists (fn y => x aconv y) tms\n            val ys' = filter (not o inxs o Thm.term_of o fst) ys\n        in\n            xs @ ys'\n        end\nend);\n\nstructure WeakestPreCases : WPC =\nstruct\n\nexception WPCFailed of string * term list * thm list;\n\nval iffd2_thm = @{thm \"iffD2\"};\nval wpc_helperI = @{thm \"wpc_helperI\"};\nval foo_thm = @{thm \"wpc_foo\"};\n\n(* it looks like cterm_instantiate would do the job better,\n   but this handles the case where ?'a must be instantiated\n   to ?'a \\<times> ?'b *)\nfun instantiate_concl_pred ctxt pred thm =\nlet\n  val get_concl_pred  = (fst o strip_comb o HOLogic.dest_Trueprop o Thm.concl_of);\n  val get_concl_predC = (Thm.cterm_of ctxt o get_concl_pred);\n\n  val get_pred_tvar   = domain_type o Thm.typ_of o Thm.ctyp_of_cterm;\n  val thm_pred        = get_concl_predC thm;\n  val thm_pred_tvar   = Term.dest_TVar (get_pred_tvar thm_pred);\n  val pred_tvar       = Thm.ctyp_of ctxt (get_pred_tvar pred);\n\n  val thm2            = Thm.instantiate ([(thm_pred_tvar, pred_tvar)], []) thm;\n\n  val thm2_pred       = Term.dest_Var (get_concl_pred thm2);\nin\n  Thm.instantiate ([], [(thm2_pred, pred)]) thm2\nend;\n\nfun detect_term ctxt thm tm =\nlet\n  val foo_thm_tm   = instantiate_concl_pred ctxt tm foo_thm;\n  val matches      = resolve_tac ctxt [foo_thm_tm] 1 thm;\n  val outcomes     = Seq.list_of matches;\n  val get_goalterm = (HOLogic.dest_Trueprop o Logic.strip_assums_concl\n                       o Envir.beta_eta_contract o hd o Thm.prems_of);\n  val get_argument = hd o snd o strip_comb;\nin\n  map (pair tm o get_argument o get_goalterm) outcomes\nend;\n\nfun detect_terms ctxt tactic2 thm =\nlet\n  val pfs           = WPCPredicateAndFinals.get (Proof_Context.theory_of ctxt);\n  val detects       = map (fn (tm, rl) => (detect_term ctxt thm tm, rl)) pfs;\n  val detects2      = filter (not o null o fst) detects;\n  val ((pred, arg), fin)   = case detects2 of\n                                [] => raise WPCFailed (\"detect_terms: no match\", [], [thm])\n                               | ((d3, fin) :: _) => (hd d3, fin)\nin\n  tactic2 arg pred fin thm\nend;\n\n(* give each rule in the list one possible resolution outcome *)\nfun resolve_each_once_tac ctxt thms i\n    = fold (curry (APPEND'))\n        (map (DETERM oo resolve_tac ctxt o single) thms)\n        (K no_tac) i\n\nfun resolve_single_tac ctxt rules n thm =\n  case Seq.chop 2 (resolve_each_once_tac ctxt rules n thm)\n  of ([], _) => raise WPCFailed\n                        (\"resolve_single_tac: no rules could apply\",\n                         [], thm :: rules)\n   | (_ :: _ :: _, _) => raise WPCFailed\n                        (\"resolve_single_tac: multiple rules applied\",\n                         [], thm :: rules)\n   | ([x], _) => Seq.single x;\n\nfun split_term processors ctxt target pred fin t =\nlet\n  val hdTarget      = head_of target;\n  val (constNm, _)  = dest_Const hdTarget handle TERM (_, tms)\n                       => raise WPCFailed (\"split_term: couldn't dest_Const\", tms, []);\n  val split = case (Ctr_Sugar.ctr_sugar_of_case ctxt constNm) of\n      SOME sugar => #split sugar\n    | _ => raise WPCFailed (\"split_term: not a case\", [hdTarget], []);\n  val subst         = split RS iffd2_thm;\n  val subst2        = instantiate_concl_pred ctxt pred subst;\nin\n ((resolve_tac ctxt [subst2] 1)\n    THEN\n  (resolve_tac ctxt [wpc_helperI] 1)\n    THEN\n  (REPEAT_ALL_NEW (resolve_tac ctxt processors)\n     THEN_ALL_NEW\n   resolve_single_tac ctxt [fin]) 1\n ) t\nend;\n\n(* n.b. need to concretise the lazy sequence via a list to ensure exceptions\n  have been raised already and catch them *)\nfun wp_cases_tac processors ctxt thm =\n  detect_terms ctxt (split_term processors ctxt) thm\n      |> Seq.list_of |> Seq.of_list\n    handle WPCFailed _ => no_tac thm;\n\nfun wp_debug_tac processors ctxt thm =\n  detect_terms ctxt (split_term processors ctxt) thm\n      |> Seq.list_of |> Seq.of_list\n    handle WPCFailed e => (warning (@{make_string} (WPCFailed e)); no_tac thm);\n\nfun wp_cases_method processors = Scan.succeed (fn ctxt =>\n  Method.SIMPLE_METHOD (wp_cases_tac processors ctxt));\n\nlocal structure P = Parse and K = Keyword in\n\nfun add_wpc tm thm lthy = let\n  val ctxt = Local_Theory.target_of lthy\n  val tm' = (Syntax.read_term ctxt tm) |> Thm.cterm_of ctxt o Logic.varify_global\n  val thm' = Proof_Context.get_thm ctxt thm\nin\n  Local_Theory.background_theory (WPCPredicateAndFinals.map (fn xs => (tm', thm') :: xs)) lthy\nend;\n\nval _ =\n    Outer_Syntax.command\n        @{command_keyword \"wpc_setup\"}\n        \"Add wpc stuff\"\n        (P.term -- P.name >> (fn (tm, thm) => Toplevel.local_theory NONE NONE (add_wpc tm thm)))\n\nend;\nend;\n\n\\<close>\n\nML \\<open>\n\nval wp_cases_tactic_weak = WeakestPreCases.wp_cases_tac @{thms wpc_weak_processors};\nval wp_cases_method_strong = WeakestPreCases.wp_cases_method @{thms wpc_processors};\nval wp_cases_method_weak   = WeakestPreCases.wp_cases_method @{thms wpc_weak_processors};\nval wp_cases_method_vweak  = WeakestPreCases.wp_cases_method @{thms wpc_vweak_processors};\n\n\\<close>\n\nmethod_setup wpc0 = \\<open>wp_cases_method_strong\\<close>\n  \"case splitter for weakest-precondition proofs\"\n\nmethod_setup wpcw0 = \\<open>wp_cases_method_weak\\<close>\n  \"weak-form case splitter for weakest-precondition proofs\"\n\nmethod wpc = (wp_pre, wpc0)\nmethod wpcw = (wp_pre, wpcw0)\n\ndefinition\n  wpc_test :: \"'a set \\<Rightarrow> ('a \\<times> 'b) set \\<Rightarrow> 'b set \\<Rightarrow> bool\"\n  where\n \"wpc_test P R S \\<equiv> (R `` P) \\<subseteq> S\"\n\nlemma wpc_test_weaken:\n  \"\\<lbrakk> wpc_test Q R S; P \\<subseteq> Q \\<rbrakk> \\<Longrightarrow> wpc_test P R S\"\n  by (simp add: wpc_test_def, blast)\n\nlemma wpc_helper_validF:\n  \"wpc_test Q' R S \\<Longrightarrow> wpc_helper (P, P') (Q, Q') (wpc_test P' R S)\"\n  by (simp add: wpc_test_def wpc_helper_def, blast)\n\nsetup \\<open>\nlet\n  val tm  = Thm.cterm_of @{context} (Logic.varify_global @{term \"\\<lambda>R. wpc_test P R S\"});\n  val thm = @{thm wpc_helper_validF};\nin\n  WPCPredicateAndFinals.map (fn xs => (tm, thm) :: xs)\nend\n\\<close>\n\nlemma set_conj_Int_simp:\n  \"{s \\<in> S. P s} = S \\<inter> {s. P s}\"\n  by auto\n\nlemma case_options_weak_wp:\n  \"\\<lbrakk> wpc_test P R S; \\<And>x. wpc_test P' (R' x) S \\<rbrakk>\n    \\<Longrightarrow> wpc_test (P \\<inter> P') (case opt of None \\<Rightarrow> R | Some x \\<Rightarrow> R' x) S\"\n  apply (rule wpc_test_weaken)\n   apply wpcw\n    apply assumption\n   apply assumption\n  apply simp\n  done\n\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/Monad_WP/wp/WPC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3247718349255966}}
{"text": "theory \"Launchbury-Unstack\"\nimports Launchbury LaunchburyStacked LaunchburyMoreFree\nbegin\n\nsubsubsection {* Stacked evaluation implies original evaluation. *}\n\nlemma forget_stack:\n  assumes \"\\<Gamma> : \\<Gamma>' \\<Down> \\<Delta> : \\<Delta>'\"\n  and \"supp S \\<subseteq> supp (tl \\<Gamma>')\"\n  shows \"\\<Gamma> : snd (hd \\<Gamma>') \\<Down>\\<^bsub>S\\<^esub> \\<Delta> : snd (hd \\<Delta>')\"\nusing assms\nproof (nominal_induct avoiding: S rule: LaunchburyStacked.reds.strong_induct)\ncase (Lambda \\<Gamma> x y e \\<Gamma>')\n  show ?case\n    by (auto intro: Launchbury.reds.intros)\nnext\ncase (Application n \\<Gamma> \\<Gamma>' \\<Delta> \\<Delta>' x e y \\<Theta> \\<Theta>' z  e' S)\n  have \"atom z \\<sharp> \\<Gamma>'\" using Application by (simp add: fresh_Pair)\n  hence \"atom z \\<sharp> map fst \\<Gamma>'\"\n    by (induct \\<Gamma>')(auto simp add: fresh_Cons fresh_Nil)\n  moreover\n  have  \"atom z \\<sharp> snd (hd \\<Theta>')\"\n    using Application stack_not_empty[OF Application(24)]\n    by (cases \\<Theta>', auto simp add: fresh_Cons fresh_Pair)\n  ultimately\n  have fresh: \"atom z \\<sharp> (\\<Gamma>, e, y, S, \\<Delta>, \\<Theta>, snd (hd \\<Theta>'))\"\n    using Application\n    by (simp add: fresh_Pair fresh_Cons fresh_at_base)[1]\n\n  have \"supp (y # S) \\<subseteq> supp ( (x, App (Var n) y) # \\<Gamma>')\"\n    using Application.prems(1)\n    by (auto simp add: supp_Cons supp_Pair exp_assn.supp)\n  hence hyp1: \"\\<Gamma> : e \\<Down>\\<^bsub>y # S\\<^esub> \\<Delta> : Lam [z]. e'\" \n    by (rule Application.hyps(23)[simplified])\n  have \"supp S \\<subseteq> supp \\<Delta>'\"\n    using Application.prems(1)\n    using stack_unchanged[OF Application.hyps(22)]\n    by simp\n  hence hyp2: \"\\<Delta> : e'[z::=y] \\<Down>\\<^bsub>S\\<^esub> \\<Theta> : snd (hd \\<Theta>')\"\n    by (rule Application.hyps(25)[simplified])\n   \n  show ?case\n    by (simp, rule Launchbury.Application[OF fresh hyp1 hyp2])\nnext\ncase (Variable y e \\<Gamma> x \\<Gamma>' \\<Delta> z \\<Delta>' S)\n  have \"supp (y # S) \\<subseteq> supp ((x, Var y) # \\<Gamma>')\"\n    using Variable.prems(1)\n    by (auto simp add: supp_Cons supp_Pair exp_assn.supp)\n  hence hyp: \"delete y \\<Gamma> : e \\<Down>\\<^bsub>y # S\\<^esub> \\<Delta> : z\"\n    by (rule Variable.hyps(3)[simplified])\n  show ?case\n    by (simp, rule Launchbury.Variable[OF `_ \\<in> set _` hyp])   \nnext\ncase (Let as \\<Gamma> x  \\<Gamma>' body \\<Delta> \\<Delta>' S)\n  have \"supp S \\<subseteq> supp \\<Gamma>'\"\n    using Let.prems[simplified].\n  hence hyp: \"asToHeap as @ \\<Gamma> : body \\<Down>\\<^bsub>S\\<^esub> \\<Delta> : snd (hd \\<Delta>')\"\n    by (rule Let.hyps(6)[simplified])\n\n  have \"set (bn as) \\<sharp>* S\"\n    using Let(3) using `supp S \\<subseteq> supp \\<Gamma>'`\n    by (auto simp add: fresh_star_def fresh_def)\n\n  hence fresh: \"set (bn as) \\<sharp>* (\\<Gamma>, S)\"\n    using Let by (auto simp add: fresh_star_Pair)\n\n  show ?case\n    by (simp, rule Launchbury.Let[OF fresh Let.hyps(4) hyp])\nqed\n\nlemma forget_stack_nice:\n  assumes \"\\<Gamma> : (x, e) # \\<Gamma>' \\<Down> \\<Delta> : (x, z) # \\<Delta>'\"\n  and \"supp L \\<subseteq> supp \\<Gamma>'\"\n  shows \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : z\"\nusing forget_stack[OF assms(1)] assms(2) by auto\n\nsubsubsection {* Original evaluation implies stacked evaluation. *}\n\nlemma add_stack:\n  assumes \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : z\"\n  assumes \"x \\<in> set L\"\n  assumes \"supp \\<Gamma>' \\<subseteq> supp L\"\n  shows \"\\<Gamma> : (x,e) # \\<Gamma>' \\<Down> \\<Delta> : (x,z) # \\<Gamma>'\"\nusing assms\nproof (nominal_induct avoiding: \\<Gamma>' x rule: reds_with_n_strong_induct)\ncase (Lambda \\<Gamma> xa e L \\<Gamma>')\n  show ?case\n    by (auto intro: LaunchburyStacked.reds.intros)\nnext\ncase (Application y \\<Gamma> e xa L \\<Delta> \\<Theta> z n e' \\<Gamma>' x)\n  have fresh_n: \"atom n \\<sharp> (\\<Gamma>, \\<Gamma>', \\<Delta>, \\<Gamma>', x, e, xa, \\<Theta>, (x, z) # \\<Gamma>', y)\"\n    using Application\n    by (simp add: fresh_Pair fresh_Cons fresh_at_base)\n\n  have fresh_y: \"atom y \\<sharp> (\\<Gamma>, \\<Gamma>', \\<Delta>, \\<Gamma>', x, e, xa, \\<Theta>, (x, z) # \\<Gamma>')\"\n    using Application\n    by (simp add: fresh_Pair fresh_Cons)\n\n  have \"supp ((x, App (Var n) xa) # \\<Gamma>') \\<subseteq> supp (n # xa # L)\"\n     using set_mp[OF supp_set_mem[OF `x \\<in> set L`]] set_mp[OF `supp \\<Gamma>' \\<subseteq> supp L`]\n     by (auto simp add: supp_Pair supp_Cons exp_assn.supp)\n  hence hyp1: \"\\<Gamma> : (n, e) # (x, App (Var n) xa) # \\<Gamma>' \\<Down> \\<Delta> : (n, Lam [y]. e') # (x, App (Var n) xa) # \\<Gamma>'\"\n    apply (rule Application(21)[rotated])\n    apply simp\n    done\n \n  have hyp2: \"\\<Delta> : (x, e'[y::=xa]) # \\<Gamma>' \\<Down> \\<Theta> : (x, z) # \\<Gamma>'\"\n    apply (rule Application(23)[OF Application.prems])\n    done\n\n  show ?case\n    by (rule LaunchburyStacked.reds.Application[OF fresh_n fresh_y hyp1 hyp2])\nnext\ncase (Variable x e \\<Gamma> L \\<Delta> z \\<Gamma>' xa)\n  have \"supp ((xa, Var x) # \\<Gamma>') \\<subseteq> supp (x # L)\"\n     using set_mp[OF supp_set_mem[OF `xa \\<in> set L`]] set_mp[OF `supp \\<Gamma>' \\<subseteq> supp L`]\n     by (auto simp add: supp_Pair supp_Cons exp_assn.supp)\n  hence hyp: \"delete x \\<Gamma> : (x, e) # (xa, Var x) # \\<Gamma>' \\<Down> \\<Delta> : (x, z) # (xa, Var x) # \\<Gamma>'\"\n    apply (rule Variable.hyps(3)[rotated])\n    apply (simp)\n    done\n  show ?case\n    by (rule LaunchburyStacked.reds.Variable[OF `(x,e) \\<in> set _` hyp])\nnext\ncase (Let as \\<Gamma> L body \\<Delta> z \\<Gamma>' x)\n  from `x \\<in> set L` and `_ \\<sharp>* L`\n  have [simp]:\"set (bn as) \\<sharp>* x\"\n    by (metis fresh_star_Cons fresh_star_list(1) in_set_conv_decomp)\n\n  from `supp \\<Gamma>' \\<subseteq> supp L` and `_ \\<sharp>* L`\n  have [simp]:\"set (bn as) \\<sharp>* \\<Gamma>'\"\n    by (auto simp add: fresh_star_def fresh_def)\n\n  have fresh: \"set (bn as) \\<sharp>* (\\<Gamma>, x, \\<Gamma>')\"\n    using Let(1-3)\n    by (simp add: fresh_star_Pair)\n \n  have hyp: \"asToHeap as @ \\<Gamma> : (x, body) # \\<Gamma>' \\<Down> \\<Delta> : (x, z) # \\<Gamma>'\"\n    apply (rule Let.hyps(5)[OF Let.prems])\n    done\n\n  show ?case\n    by (rule LaunchburyStacked.reds.Let[OF fresh `distinctVars (asToHeap as)` hyp])\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Launchbury/Launchbury-Unstack.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3247320443237449}}
{"text": "(*  Title:      JinjaThreads/Framework/LTS.thy\n    Author:     Andreas Lochbihler\n*)\n\nsection \\<open>Labelled transition systems\\<close>\n\ntheory LTS\nimports\n  \"../Basic/Auxiliary\"\n  Coinductive.TLList\nbegin\n\nno_notation floor (\"\\<lfloor>_\\<rfloor>\")\n\nlemma rel_option_mono:\n  \"\\<lbrakk> rel_option R x y; \\<And>x y. R x y \\<Longrightarrow> R' x y \\<rbrakk> \\<Longrightarrow> rel_option R' x y\"\nby(cases x)(case_tac [!] y, auto)\n\nlemma nth_concat_conv:\n  \"n < length (concat xss) \n   \\<Longrightarrow> \\<exists>m n'. concat xss ! n = (xss ! m) ! n' \\<and> n' < length (xss ! m) \\<and> \n             m < length xss \\<and> n = (\\<Sum>i<m. length (xss ! i)) + n'\"\nusing lnth_lconcat_conv[of n \"llist_of (map llist_of xss)\"]\n  sum_comp_morphism[where h = enat and g = \"\\<lambda>i. length (xss ! i)\"]\nby(clarsimp simp add: lconcat_llist_of zero_enat_def[symmetric]) blast\n\n\ndefinition flip :: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'c) \\<Rightarrow> 'b \\<Rightarrow> 'a \\<Rightarrow> 'c\"\nwhere \"flip f = (\\<lambda>b a. f a b)\"\n\ntext \\<open>Create a dynamic list \\<open>flip_simps\\<close> of theorems for flip\\<close>\nML \\<open>\nstructure FlipSimpRules = Named_Thms\n(\n  val name = @{binding flip_simps}\n  val description = \"Simplification rules for flip in bisimulations\"\n)\n\\<close>\nsetup \\<open>FlipSimpRules.setup\\<close>\n\nlemma flip_conv [flip_simps]: \"flip f b a = f a b\"\nby(simp add: flip_def)\n\nlemma flip_flip [flip_simps, simp]: \"flip (flip f) = f\"\nby(simp add: flip_def)\n\nlemma list_all2_flip [flip_simps]: \"list_all2 (flip P) xs ys = list_all2 P ys xs\"\nunfolding flip_def list_all2_conv_all_nth by auto\n\nlemma llist_all2_flip [flip_simps]: \"llist_all2 (flip P) xs ys = llist_all2 P ys xs\"\nunfolding flip_def llist_all2_conv_all_lnth by auto\n\nlemma rtranclp_flipD:\n  assumes \"(flip r)^** x y\"\n  shows \"r^** y x\" \nusing assms\nby(induct rule: rtranclp_induct)(auto intro: rtranclp.rtrancl_into_rtrancl simp add: flip_conv)\n\n\n\nlemma rel_prod_flip [flip_simps]:\n  \"rel_prod (flip R) (flip S) = flip (rel_prod R S)\"\nby(auto intro!: ext simp add: flip_def)\n\nlemma rel_option_flip [flip_simps]:\n  \"rel_option (flip R) = flip (rel_option R)\"\nby(simp add: fun_eq_iff rel_option_iff flip_def)\n\nlemma tllist_all2_flip [flip_simps]:\n  \"tllist_all2 (flip P) (flip Q) xs ys \\<longleftrightarrow> tllist_all2 P Q ys xs\"\nproof\n  assume \"tllist_all2 (flip P) (flip Q) xs ys\"\n  thus \"tllist_all2 P Q ys xs\"\n    by(coinduct rule: tllist_all2_coinduct)(auto dest: tllist_all2_is_TNilD tllist_all2_tfinite2_terminalD tllist_all2_thdD intro: tllist_all2_ttlI simp add: flip_def)\nnext\n  assume \"tllist_all2 P Q ys xs\"\n  thus \"tllist_all2 (flip P) (flip Q) xs ys\"\n    by(coinduct rule: tllist_all2_coinduct)(auto dest: tllist_all2_is_TNilD tllist_all2_tfinite2_terminalD tllist_all2_thdD intro: tllist_all2_ttlI simp add: flip_def)\nqed\n\nsubsection \\<open>Labelled transition systems\\<close>\n\ntype_synonym ('a, 'b) trsys = \"'a \\<Rightarrow> 'b \\<Rightarrow> 'a \\<Rightarrow> bool\"\n\nlocale trsys = \n  fixes trsys :: \"('s, 'tl) trsys\" (\"_/ -_\\<rightarrow>/ _\" [50, 0, 50] 60)\nbegin\n\nabbreviation Trsys :: \"('s, 'tl list) trsys\" (\"_/ -_\\<rightarrow>*/ _\" [50,0,50] 60)\nwhere \"\\<And>tl. s -tl\\<rightarrow>* s' \\<equiv> rtrancl3p trsys s tl s'\"\n\ncoinductive inf_step :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> bool\" (\"_ -_\\<rightarrow>* \\<infinity>\" [50, 0] 80)\nwhere inf_stepI: \"\\<lbrakk> trsys a b a'; a' -bs\\<rightarrow>* \\<infinity> \\<rbrakk> \\<Longrightarrow> a -LCons b bs\\<rightarrow>* \\<infinity>\"\n\ncoinductive inf_step_table :: \"'s \\<Rightarrow> ('s \\<times> 'tl \\<times> 's) llist \\<Rightarrow> bool\" (\"_ -_\\<rightarrow>*t \\<infinity>\" [50, 0] 80)\nwhere \n  inf_step_tableI:\n  \"\\<And>tl. \\<lbrakk> trsys s tl s'; s' -stls\\<rightarrow>*t \\<infinity> \\<rbrakk> \n  \\<Longrightarrow> s -LCons (s, tl, s') stls\\<rightarrow>*t \\<infinity>\"\n\ndefinition inf_step2inf_step_table :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> ('s \\<times> 'tl \\<times> 's) llist\"\nwhere\n  \"inf_step2inf_step_table s tls =\n   unfold_llist\n     (\\<lambda>(s, tls). lnull tls)\n     (\\<lambda>(s, tls). (s, lhd tls, SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>)) \n     (\\<lambda>(s, tls). (SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>, ltl tls))\n     (s, tls)\"\n\ncoinductive Rtrancl3p :: \"'s \\<Rightarrow> ('tl, 's) tllist \\<Rightarrow> bool\"\nwhere \n  Rtrancl3p_stop: \"(\\<And>tl s'. \\<not> s -tl\\<rightarrow> s') \\<Longrightarrow>  Rtrancl3p s (TNil s)\"\n| Rtrancl3p_into_Rtrancl3p: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; Rtrancl3p s' tlss \\<rbrakk> \\<Longrightarrow> Rtrancl3p s (TCons tl tlss)\"\n  \ninductive_simps Rtrancl3p_simps:\n  \"Rtrancl3p s (TNil s')\"\n  \"Rtrancl3p s (TCons tl' tlss)\"\n\ninductive_cases Rtrancl3p_cases:\n  \"Rtrancl3p s (TNil s')\"\n  \"Rtrancl3p s (TCons tl' tlss)\"\n\ncoinductive Runs :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> bool\"\nwhere\n  Stuck: \"(\\<And>tl s'. \\<not> s -tl\\<rightarrow> s') \\<Longrightarrow> Runs s LNil\"\n| Step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; Runs s' tls \\<rbrakk> \\<Longrightarrow> Runs s (LCons tl tls)\"\n\ncoinductive Runs_table :: \"'s \\<Rightarrow> ('s \\<times> 'tl \\<times> 's) llist \\<Rightarrow> bool\"\nwhere\n  Stuck: \"(\\<And>tl s'. \\<not> s -tl\\<rightarrow> s') \\<Longrightarrow> Runs_table s LNil\"\n| Step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; Runs_table s' stlss \\<rbrakk> \\<Longrightarrow> Runs_table s (LCons (s, tl, s') stlss)\"\n\ninductive_simps Runs_table_simps:\n  \"Runs_table s LNil\"\n  \"Runs_table s (LCons stls stlss)\"\n\nlemma inf_step_not_finite_llist:\n  assumes r: \"s -bs\\<rightarrow>* \\<infinity>\"\n  shows \"\\<not> lfinite bs\"\nproof\n  assume \"lfinite bs\" thus False using r\n    by(induct arbitrary: s rule: lfinite.induct)(auto elim: inf_step.cases)\nqed\n\nlemma inf_step2inf_step_table_LNil [simp]: \"inf_step2inf_step_table s LNil = LNil\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma inf_step2inf_step_table_LCons [simp]:\n  fixes tl shows\n  \"inf_step2inf_step_table s (LCons tl tls) =\n   LCons (s, tl, SOME s'. trsys s tl s' \\<and> s' -tls\\<rightarrow>* \\<infinity>) \n         (inf_step2inf_step_table (SOME s'. trsys s tl s' \\<and> s' -tls\\<rightarrow>* \\<infinity>) tls)\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma lnull_inf_step2inf_step_table [simp]: \n  \"lnull (inf_step2inf_step_table s tls) \\<longleftrightarrow> lnull tls\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma inf_step2inf_step_table_eq_LNil: \n  \"inf_step2inf_step_table s tls = LNil \\<longleftrightarrow> tls = LNil\"\nusing lnull_inf_step2inf_step_table unfolding lnull_def .\n\nlemma lhd_inf_step2inf_step_table [simp]:\n  \"\\<not> lnull tls\n  \\<Longrightarrow> lhd (inf_step2inf_step_table s tls) =\n      (s, lhd tls, SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>)\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma ltl_inf_step2inf_step_table [simp]:\n  \"ltl (inf_step2inf_step_table s tls) =\n   inf_step2inf_step_table (SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>) (ltl tls)\"\nby(cases tls) simp_all\n\nlemma lmap_inf_step2inf_step_table: \"lmap (fst \\<circ> snd) (inf_step2inf_step_table s tls) = tls\"\nby(coinduction arbitrary: s tls) auto\n\nlemma inf_step_imp_inf_step_table:\n  assumes \"s -tls\\<rightarrow>* \\<infinity>\"\n  shows \"\\<exists>stls. s -stls\\<rightarrow>*t \\<infinity> \\<and> tls = lmap (fst \\<circ> snd) stls\"\nproof -\n  from assms have \"s -inf_step2inf_step_table s tls\\<rightarrow>*t \\<infinity>\"\n  proof(coinduction arbitrary: s tls)\n    case (inf_step_table s tls)\n    thus ?case\n    proof cases\n      case (inf_stepI tl s' tls')\n      let ?s' = \"SOME s'. trsys s tl s' \\<and> s' -tls'\\<rightarrow>* \\<infinity>\"\n      have \"trsys s tl ?s' \\<and> ?s' -tls'\\<rightarrow>* \\<infinity>\" by(rule someI)(blast intro: inf_stepI)\n      thus ?thesis using \\<open>tls = LCons tl tls'\\<close> by auto\n    qed\n  qed\n  moreover have \"tls = lmap (fst \\<circ> snd) (inf_step2inf_step_table s tls)\"\n    by(simp only: lmap_inf_step2inf_step_table)\n  ultimately show ?thesis by blast\nqed\n\nlemma inf_step_table_imp_inf_step:\n  \"s-stls\\<rightarrow>*t \\<infinity> \\<Longrightarrow>s -lmap (fst \\<circ> snd) stls\\<rightarrow>* \\<infinity>\"\nproof(coinduction arbitrary: s stls rule: inf_step.coinduct)\n  case (inf_step s tls)\n  thus ?case by cases auto\nqed\n\nlemma Runs_table_into_Runs:\n  \"Runs_table s stlss \\<Longrightarrow> Runs s (lmap (\\<lambda>(s, tl, s'). tl) stlss)\"\nproof(coinduction arbitrary: s stlss)\n  case (Runs s tls)\n  thus ?case by (cases)auto\nqed\n\nlemma Runs_into_Runs_table:\n  assumes \"Runs s tls\"\n  obtains stlss\n  where \"tls = lmap (\\<lambda>(s, tl, s'). tl) stlss\"\n  and \"Runs_table s stlss\"\nproof -\n  define stlss where \"stlss s tls = unfold_llist\n    (\\<lambda>(s, tls). lnull tls)\n    (\\<lambda>(s, tls). (s, lhd tls, SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls)))\n    (\\<lambda>(s, tls). (SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls), ltl tls))\n    (s, tls)\"\n    for s tls\n  have [simp]:\n    \"\\<And>s. stlss s LNil = LNil\"\n    \"\\<And>s tl tls. stlss s (LCons tl tls) = LCons (s, tl, SOME s'. s -tl\\<rightarrow> s' \\<and> Runs s' tls) (stlss (SOME s'. s -tl\\<rightarrow> s' \\<and> Runs s' tls) tls)\"\n    \"\\<And>s tls. lnull (stlss s tls) \\<longleftrightarrow> lnull tls\"\n    \"\\<And>s tls. \\<not> lnull tls \\<Longrightarrow> lhd (stlss s tls) = (s, lhd tls, SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls))\"\n    \"\\<And>s tls. \\<not> lnull tls \\<Longrightarrow> ltl (stlss s tls) = stlss (SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls)) (ltl tls)\"\n    by(simp_all add: stlss_def)\n  \n  from assms have \"tls = lmap (\\<lambda>(s, tl, s'). tl) (stlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case Eq_llist\n    thus ?case by cases(auto 4 3 intro: someI2)\n  qed\n  moreover\n  from assms have \"Runs_table s (stlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (Runs_table s stlss')\n    thus ?case\n    proof(cases)\n      case (Step s' tls' tl)\n      let ?P = \"\\<lambda>s'. s -tl\\<rightarrow> s' \\<and> Runs s' tls'\"\n      from \\<open>s -tl\\<rightarrow> s'\\<close> \\<open>Runs s' tls'\\<close> have \"?P s'\" ..\n      hence \"?P (Eps ?P)\" by(rule someI)\n      with Step have ?Step by auto\n      thus ?thesis ..\n    qed simp\n  qed\n  ultimately show ?thesis by(rule that)\nqed\n\nlemma Runs_lappendE:\n  assumes \"Runs \\<sigma> (lappend tls tls')\"\n  and \"lfinite tls\"\n  obtains \\<sigma>' where \"\\<sigma> -list_of tls\\<rightarrow>* \\<sigma>'\"\n  and \"Runs \\<sigma>' tls'\"\nproof(atomize_elim)\n  from \\<open>lfinite tls\\<close> \\<open>Runs \\<sigma> (lappend tls tls')\\<close>\n  show \"\\<exists>\\<sigma>'. \\<sigma> -list_of tls\\<rightarrow>* \\<sigma>' \\<and> Runs \\<sigma>' tls'\"\n  proof(induct arbitrary: \\<sigma>)\n    case lfinite_LNil thus ?case by(auto)\n  next\n    case (lfinite_LConsI tls tl)\n    from \\<open>Runs \\<sigma> (lappend (LCons tl tls) tls')\\<close>\n    show ?case unfolding lappend_code\n    proof(cases)\n      case (Step \\<sigma>')\n      from \\<open>Runs \\<sigma>' (lappend tls tls') \\<Longrightarrow> \\<exists>\\<sigma>''. \\<sigma>' -list_of tls\\<rightarrow>* \\<sigma>'' \\<and> Runs \\<sigma>'' tls'\\<close> \\<open>Runs \\<sigma>' (lappend tls tls')\\<close>\n      obtain \\<sigma>'' where \"\\<sigma>' -list_of tls\\<rightarrow>* \\<sigma>''\" \"Runs \\<sigma>'' tls'\" by blast\n      from \\<open>\\<sigma> -tl\\<rightarrow> \\<sigma>'\\<close> \\<open>\\<sigma>' -list_of tls\\<rightarrow>* \\<sigma>''\\<close>\n      have \"\\<sigma> -tl # list_of tls\\<rightarrow>* \\<sigma>''\" by(rule rtrancl3p_step_converse)\n      with \\<open>lfinite tls\\<close> have \"\\<sigma> -list_of (LCons tl tls)\\<rightarrow>* \\<sigma>''\" by(simp)\n      with \\<open>Runs \\<sigma>'' tls'\\<close> show ?thesis by blast\n    qed\n  qed\nqed\n\nlemma Trsys_into_Runs:\n  assumes \"s -tls\\<rightarrow>* s'\"\n  and \"Runs s' tls'\"\n  shows \"Runs s (lappend (llist_of tls) tls')\"\nusing assms\nby(induct rule: rtrancl3p_converse_induct)(auto intro: Runs.Step)\n\nlemma rtrancl3p_into_Rtrancl3p:\n  \"\\<lbrakk> rtrancl3p trsys a bs a'; \\<And>b a''. \\<not> a' -b\\<rightarrow> a'' \\<rbrakk> \\<Longrightarrow> Rtrancl3p a (tllist_of_llist a' (llist_of bs))\"\n  by(induct rule: rtrancl3p_converse_induct)(auto intro: Rtrancl3p.intros)\n    \nlemma Rtrancl3p_into_Runs:\n  \"Rtrancl3p s tlss \\<Longrightarrow> Runs s (llist_of_tllist tlss)\"\nby(coinduction arbitrary: s tlss rule: Runs.coinduct)(auto elim: Rtrancl3p.cases)\n\nlemma Runs_into_Rtrancl3p:\n  assumes \"Runs s tls\"\n  obtains tlss where \"tls = llist_of_tllist tlss\" \"Rtrancl3p s tlss\"\nproof\n  let ?Q = \"\\<lambda>s tls s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls)\"\n  define tlss where \"tlss = corec_tllist \n    (\\<lambda>(s, tls). lnull tls) (\\<lambda>(s, tls). s)\n    (\\<lambda>(s, tls). lhd tls)\n    (\\<lambda>_. False) undefined (\\<lambda>(s, tls). (SOME s'. ?Q s tls s', ltl tls))\"\n  have [simp]:\n    \"tlss (s, LNil) = TNil s\"\n    \"tlss (s, LCons tl tls) = TCons tl (tlss (SOME s'. ?Q s (LCons tl tls) s', tls))\"\n    for s tl tls by(auto simp add: tlss_def intro: tllist.expand)\n\n  show \"tls = llist_of_tllist (tlss (s, tls))\" using assms\n    by(coinduction arbitrary: s tls)(erule Runs.cases; fastforce intro: someI2)\n      \n  show \"Rtrancl3p s (tlss (s, tls))\" using assms\n    by(coinduction arbitrary: s tls)(erule Runs.cases; simp; iprover intro: someI2[where Q=\"trsys _ _\"] someI2[where Q=\"\\<lambda>s'. Runs s' _\"])\nqed\n\nlemma fixes tl\n  assumes \"Rtrancl3p s tlss\" \"tfinite tlss\"\n  shows Rtrancl3p_into_Trsys: \"Trsys s (list_of (llist_of_tllist tlss)) (terminal tlss)\"\n    and terminal_Rtrancl3p_final: \"\\<not> terminal tlss -tl\\<rightarrow> s'\"\nusing assms(2,1) by(induction arbitrary: s rule: tfinite_induct)(auto simp add: Rtrancl3p_simps intro: rtrancl3p_step_converse)\n\nend\n  \nsubsection \\<open>Labelled transition systems with internal actions\\<close>\n\nlocale \\<tau>trsys = trsys +\n  constrains trsys :: \"('s, 'tl) trsys\"\n  fixes \\<tau>move :: \"('s, 'tl) trsys\"\nbegin\n\ninductive silent_move :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow> _\" [50, 50] 60)\nwhere [intro]: \"!!tl. \\<lbrakk> trsys s tl s'; \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> s'\"\n\ndeclare silent_move.cases [elim]\n\n\n\nabbreviation silent_moves :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow>* _\" [50, 50] 60)\nwhere \"silent_moves == silent_move^**\"\n\nabbreviation silent_movet :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow>+ _\" [50, 50] 60)\nwhere \"silent_movet == silent_move^++\"\n\ncoinductive \\<tau>diverge :: \"'s \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow> \\<infinity>\" [50] 60)\nwhere\n  \\<tau>divergeI: \"\\<lbrakk> s -\\<tau>\\<rightarrow> s'; s' -\\<tau>\\<rightarrow> \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\n\ncoinductive \\<tau>inf_step :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> bool\" (\"_ -\\<tau>-_\\<rightarrow>* \\<infinity>\" [50, 0] 60)\nwhere\n  \\<tau>inf_step_Cons: \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; s'' -\\<tau>-tls\\<rightarrow>* \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>-LCons tl tls\\<rightarrow>* \\<infinity>\"\n| \\<tau>inf_step_Nil: \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> s -\\<tau>-LNil\\<rightarrow>* \\<infinity>\"\n\ncoinductive \\<tau>inf_step_table :: \"'s \\<Rightarrow> ('s \\<times> 's \\<times> 'tl \\<times> 's) llist \\<Rightarrow> bool\" (\"_ -\\<tau>-_\\<rightarrow>*t \\<infinity>\" [50, 0] 80)\nwhere\n  \\<tau>inf_step_table_Cons:\n  \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; s'' -\\<tau>-tls\\<rightarrow>*t \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>-LCons (s, s', tl, s'') tls\\<rightarrow>*t \\<infinity>\"\n\n| \\<tau>inf_step_table_Nil:\n  \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> s -\\<tau>-LNil\\<rightarrow>*t \\<infinity>\"\n\ndefinition \\<tau>inf_step2\\<tau>inf_step_table :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> ('s \\<times> 's \\<times> 'tl \\<times> 's) llist\"\nwhere\n  \"\\<tau>inf_step2\\<tau>inf_step_table s tls =\n   unfold_llist\n     (\\<lambda>(s, tls). lnull tls)\n     (\\<lambda>(s, tls). let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n        in (s, s', lhd tls, s''))\n     (\\<lambda>(s, tls). let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n        in (s'', ltl tls))\n     (s, tls)\"\n\ndefinition silent_move_from :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's \\<Rightarrow> bool\"\nwhere \"silent_move_from s0 s1 s2 \\<longleftrightarrow> silent_moves s0 s1 \\<and> silent_move s1 s2\"\n\ninductive \\<tau>rtrancl3p :: \"'s \\<Rightarrow> 'tl list \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>-_\\<rightarrow>* _\" [50, 0, 50] 60)\nwhere\n  \\<tau>rtrancl3p_refl: \"\\<tau>rtrancl3p s [] s\"\n| \\<tau>rtrancl3p_step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; \\<not> \\<tau>move s tl s'; \\<tau>rtrancl3p s' tls s'' \\<rbrakk> \\<Longrightarrow> \\<tau>rtrancl3p s (tl # tls) s''\"\n| \\<tau>rtrancl3p_\\<tau>step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; \\<tau>move s tl s'; \\<tau>rtrancl3p s' tls s'' \\<rbrakk> \\<Longrightarrow> \\<tau>rtrancl3p s tls s''\"\n\ncoinductive \\<tau>Runs :: \"'s \\<Rightarrow> ('tl, 's option) tllist \\<Rightarrow> bool\" (\"_ \\<Down> _\" [50, 50] 51)\nwhere\n  Terminate: \"\\<lbrakk> s -\\<tau>\\<rightarrow>* s'; \\<And>tl s''. \\<not> s' -tl\\<rightarrow> s'' \\<rbrakk> \\<Longrightarrow> s \\<Down> TNil \\<lfloor>s'\\<rfloor>\" \n| Diverge: \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> s \\<Down> TNil None\"\n| Proceed: \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; s'' \\<Down> tls \\<rbrakk> \\<Longrightarrow> s \\<Down> TCons tl tls\"\n\ninductive_simps \\<tau>Runs_simps:\n  \"s \\<Down> TNil (Some s')\"\n  \"s \\<Down> TNil None\"\n  \"s \\<Down> TCons tl' tls\"\n\ncoinductive \\<tau>Runs_table :: \"'s \\<Rightarrow> ('tl \\<times> 's, 's option) tllist \\<Rightarrow> bool\"\nwhere \n  Terminate: \"\\<lbrakk> s -\\<tau>\\<rightarrow>* s'; \\<And>tl s''. \\<not> s' -tl\\<rightarrow> s'' \\<rbrakk> \\<Longrightarrow> \\<tau>Runs_table s (TNil \\<lfloor>s'\\<rfloor>)\"\n| Diverge: \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> \\<tau>Runs_table s (TNil None)\"\n| Proceed:\n  \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; \\<tau>Runs_table s'' tls \\<rbrakk> \n  \\<Longrightarrow> \\<tau>Runs_table s (TCons (tl, s'') tls)\"\n\ndefinition silent_move2 :: \"'s \\<Rightarrow> 'tl \\<Rightarrow> 's \\<Rightarrow> bool\"\nwhere \"\\<And>tl. silent_move2 s tl s' \\<longleftrightarrow> s -tl\\<rightarrow> s' \\<and> \\<tau>move s tl s'\"\n\nabbreviation silent_moves2 :: \"'s \\<Rightarrow> 'tl list \\<Rightarrow> 's \\<Rightarrow> bool\"\nwhere \"silent_moves2 \\<equiv> rtrancl3p silent_move2\"\n\ncoinductive \\<tau>Runs_table2 :: \"'s \\<Rightarrow> ('tl list \\<times> 's \\<times> 'tl \\<times> 's, ('tl list \\<times> 's) + 'tl llist) tllist \\<Rightarrow> bool\"\nwhere \n  Terminate: \"\\<lbrakk> silent_moves2 s tls s'; \\<And>tl s''. \\<not> s' -tl\\<rightarrow> s'' \\<rbrakk> \\<Longrightarrow> \\<tau>Runs_table2 s (TNil (Inl (tls, s')))\"\n| Diverge: \"trsys.inf_step silent_move2 s tls \\<Longrightarrow> \\<tau>Runs_table2 s (TNil (Inr tls))\"\n| Proceed:\n  \"\\<And>tl. \\<lbrakk> silent_moves2 s tls s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; \\<tau>Runs_table2 s'' tlsstlss \\<rbrakk> \n  \\<Longrightarrow> \\<tau>Runs_table2 s (TCons (tls, s', tl, s'') tlsstlss)\"\n\ninductive_simps \\<tau>Runs_table2_simps:\n  \"\\<tau>Runs_table2 s (TNil tlss)\"\n  \"\\<tau>Runs_table2 s (TCons tlsstls tlsstlss)\"\n\nlemma inf_step_table_all_\\<tau>_into_\\<tau>diverge:\n  \"\\<lbrakk> s -stls\\<rightarrow>*t \\<infinity>; \\<forall>(s, tl, s') \\<in> lset stls. \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof(coinduction arbitrary: s stls)\n  case (\\<tau>diverge s)\n  thus ?case by cases (auto simp add: silent_move_iff, blast)\nqed\n\nlemma inf_step_table_lappend_llist_ofD:\n  \"s -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>\n  \\<Longrightarrow> (s -map (fst \\<circ> snd) stls\\<rightarrow>* x) \\<and> (x -LCons (x, tl', x') xs\\<rightarrow>*t \\<infinity>)\"\nproof(induct stls arbitrary: s)\n  case Nil thus ?case by(auto elim: inf_step_table.cases intro: inf_step_table.intros rtrancl3p_refl)\nnext\n  case (Cons st stls)\n  note IH = \\<open>\\<And>s. s -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity> \\<Longrightarrow>\n                 s -map (fst \\<circ> snd) stls\\<rightarrow>* x \\<and> x -LCons (x, tl', x') xs\\<rightarrow>*t \\<infinity>\\<close>\n  from \\<open>s -lappend (llist_of (st # stls)) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>\\<close>\n  show ?case\n  proof cases\n    case (inf_step_tableI s' stls' tl)\n    hence [simp]: \"st = (s, tl, s')\" \"stls' = lappend (llist_of stls) (LCons (x, tl', x') xs)\"\n      and \"s -tl\\<rightarrow> s'\" \"s' -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>\" by simp_all\n    from IH[OF \\<open>s' -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>\\<close>]\n    have \"s' -map (fst \\<circ> snd) stls\\<rightarrow>* x\" \"x -LCons (x, tl', x') xs\\<rightarrow>*t \\<infinity>\" by auto\n    with \\<open>s -tl\\<rightarrow> s'\\<close> show ?thesis by(auto simp add: o_def intro: rtrancl3p_step_converse)\n  qed\nqed\n\nlemma inf_step_table_lappend_llist_of_\\<tau>_into_\\<tau>moves:\n  assumes \"lfinite stls\"\n  shows \"\\<lbrakk> s -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>; \\<forall>(s, tl, s')\\<in>lset stls. \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow>* x\"\nusing assms\nproof(induct arbitrary: s rule: lfinite.induct)\n  case lfinite_LNil thus ?case by(auto elim: inf_step_table.cases)\nnext\n  case (lfinite_LConsI stls st)\n  note IH = \\<open>\\<And>s. \\<lbrakk>s -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>; \\<forall>(s, tl, s')\\<in>lset stls. \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow>* x\\<close>\n  obtain s1 tl1 s1' where [simp]: \"st = (s1, tl1, s1')\" by(cases st)\n  from \\<open>s -lappend (LCons st stls) (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>\\<close>\n  show ?case\n  proof cases\n    case (inf_step_tableI X' STLS TL)\n    hence [simp]: \"s1 = s\" \"TL = tl1\" \"X' = s1'\" \"STLS = lappend stls (LCons (x, tl' x') xs)\"\n      and \"s -tl1\\<rightarrow> s1'\" and \"s1' -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>\" by simp_all\n    from \\<open>\\<forall>(s, tl, s')\\<in>lset (LCons st stls). \\<tau>move s tl s'\\<close> have \"\\<tau>move s tl1 s1'\" by simp\n    moreover\n    from IH[OF \\<open>s1' -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>\\<close>] \\<open>\\<forall>(s, tl, s')\\<in>lset (LCons st stls). \\<tau>move s tl s'\\<close>\n    have \"s1' -\\<tau>\\<rightarrow>* x\" by simp\n    ultimately show ?thesis using \\<open>s -tl1\\<rightarrow> s1'\\<close> by(auto intro: converse_rtranclp_into_rtranclp)\n  qed\nqed\n\n\nlemma inf_step_table_into_\\<tau>inf_step:\n  \"s -stls\\<rightarrow>*t \\<infinity> \\<Longrightarrow> s -\\<tau>-lmap (fst \\<circ> snd) (lfilter (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') stls)\\<rightarrow>* \\<infinity>\"\nproof(coinduction arbitrary: s stls)\n  case (\\<tau>inf_step s stls)\n  let ?P = \"\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s'\"\n  show ?case\n  proof(cases \"lfilter ?P stls\")\n    case LNil\n    with \\<tau>inf_step have ?\\<tau>inf_step_Nil\n      by(auto intro: inf_step_table_all_\\<tau>_into_\\<tau>diverge simp add: lfilter_eq_LNil)\n    thus ?thesis ..\n  next\n    case (LCons stls' xs)\n    obtain x tl x' where \"stls' = (x, tl, x')\" by(cases stls')\n    with LCons have stls: \"lfilter ?P stls = LCons (x, tl, x') xs\" by simp\n    from lfilter_eq_LConsD[OF this] obtain stls1 stls2\n      where stls1: \"stls = lappend stls1 (LCons (x, tl, x') stls2)\"\n      and \"lfinite stls1\"\n      and \\<tau>s: \"\\<forall>(s, tl, s')\\<in>lset stls1. \\<tau>move s tl s'\"\n      and n\\<tau>: \"\\<not> \\<tau>move x tl x'\" and xs: \"xs = lfilter ?P stls2\" by blast\n    from \\<open>lfinite stls1\\<close> \\<tau>inf_step \\<tau>s have \"s -\\<tau>\\<rightarrow>* x\" unfolding stls1\n      by(rule inf_step_table_lappend_llist_of_\\<tau>_into_\\<tau>moves)\n    moreover from \\<open>lfinite stls1\\<close> have \"llist_of (list_of stls1) = stls1\" by(simp add: llist_of_list_of)\n    with \\<tau>inf_step stls1 have \"s -lappend (llist_of (list_of stls1)) (LCons (x, tl, x') stls2)\\<rightarrow>*t \\<infinity>\" by simp\n    from inf_step_table_lappend_llist_ofD[OF this]\n    have \"x -LCons (x, tl, x') stls2\\<rightarrow>*t \\<infinity>\" ..\n    hence \"x -tl\\<rightarrow> x'\" \"x' -stls2\\<rightarrow>*t \\<infinity>\" by(auto elim: inf_step_table.cases)\n    ultimately have ?\\<tau>inf_step_Cons using xs n\\<tau> by(auto simp add: stls o_def)\n    thus ?thesis ..\n  qed\nqed\n\nlemma inf_step_into_\\<tau>inf_step:\n  assumes \"s -tls\\<rightarrow>* \\<infinity>\"\n  shows \"\\<exists>A. s -\\<tau>-lnths tls A\\<rightarrow>* \\<infinity>\"\nproof -\n  from inf_step_imp_inf_step_table[OF assms]\n  obtain stls where \"s -stls\\<rightarrow>*t \\<infinity>\" and tls: \"tls = lmap (fst \\<circ> snd) stls\" by blast\n  from \\<open>s -stls\\<rightarrow>*t \\<infinity>\\<close> have \"s -\\<tau>-lmap (fst \\<circ> snd) (lfilter (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') stls)\\<rightarrow>* \\<infinity>\"\n    by(rule inf_step_table_into_\\<tau>inf_step)\n  hence \"s -\\<tau>-lnths tls {n. enat n < llength stls \\<and> (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') (lnth stls n)}\\<rightarrow>* \\<infinity>\"\n    unfolding lfilter_conv_lnths tls by simp\n  thus ?thesis by blast\nqed\n\nlemma silent_moves_into_\\<tau>rtrancl3p:\n  \"s -\\<tau>\\<rightarrow>* s' \\<Longrightarrow> s -\\<tau>-[]\\<rightarrow>* s'\"\nby(induct rule: converse_rtranclp_induct)(blast intro: \\<tau>rtrancl3p.intros)+\n\nlemma \\<tau>rtrancl3p_into_silent_moves:\n  \"s -\\<tau>-[]\\<rightarrow>* s' \\<Longrightarrow> s -\\<tau>\\<rightarrow>* s'\"\napply(induct s tls\\<equiv>\"[] :: 'tl list\" s' rule: \\<tau>rtrancl3p.induct)\napply(auto intro: converse_rtranclp_into_rtranclp)\ndone\n\nlemma \\<tau>rtrancl3p_Nil_eq_\\<tau>moves:\n  \"s -\\<tau>-[]\\<rightarrow>* s' \\<longleftrightarrow> s -\\<tau>\\<rightarrow>* s'\"\nby(blast intro: silent_moves_into_\\<tau>rtrancl3p \\<tau>rtrancl3p_into_silent_moves)\n\nlemma \\<tau>rtrancl3p_trans [trans]:\n  \"\\<lbrakk> s -\\<tau>-tls\\<rightarrow>* s'; s' -\\<tau>-tls'\\<rightarrow>* s'' \\<rbrakk> \\<Longrightarrow> s -\\<tau>-tls @ tls'\\<rightarrow>* s''\"\napply(induct rule: \\<tau>rtrancl3p.induct)\napply(auto intro: \\<tau>rtrancl3p.intros)\ndone\n\nlemma \\<tau>rtrancl3p_SingletonE:\n  fixes tl\n  assumes red: \"s -\\<tau>-[tl]\\<rightarrow>* s'''\"\n  obtains s' s'' where \"s -\\<tau>\\<rightarrow>* s'\" \"s' -tl\\<rightarrow> s''\" \"\\<not> \\<tau>move s' tl s''\" \"s'' -\\<tau>\\<rightarrow>* s'''\"\nproof(atomize_elim)\n  from red show \"\\<exists>s' s''. s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>\\<rightarrow>* s'''\"\n  proof(induct s tls\\<equiv>\"[tl]\" s''')\n    case (\\<tau>rtrancl3p_step s s' s'')\n    from \\<open>s -tl\\<rightarrow> s'\\<close> \\<open>\\<not> \\<tau>move s tl s'\\<close> \\<open>s' -\\<tau>-[]\\<rightarrow>* s''\\<close> show ?case\n      by(auto simp add: \\<tau>rtrancl3p_Nil_eq_\\<tau>moves)\n   next\n    case (\\<tau>rtrancl3p_\\<tau>step s s' s'' tl')\n    then obtain t' t'' where \"s' -\\<tau>\\<rightarrow>* t'\" \"t' -tl\\<rightarrow> t''\" \"\\<not> \\<tau>move t' tl t''\" \"t'' -\\<tau>\\<rightarrow>* s''\" by auto\n    moreover\n    from \\<open>s -tl'\\<rightarrow> s'\\<close> \\<open>\\<tau>move s tl' s'\\<close> have \"s -\\<tau>\\<rightarrow>* s'\" by blast\n    ultimately show ?case by(auto intro: rtranclp_trans)\n  qed\nqed\n\nlemma \\<tau>rtrancl3p_snocI:\n  \"\\<And>tl. \\<lbrakk> \\<tau>rtrancl3p s tls s''; s'' -\\<tau>\\<rightarrow>* s'''; s''' -tl\\<rightarrow> s'; \\<not> \\<tau>move s''' tl s' \\<rbrakk>\n  \\<Longrightarrow> \\<tau>rtrancl3p s (tls @ [tl]) s'\"\napply(erule \\<tau>rtrancl3p_trans)\napply(fold \\<tau>rtrancl3p_Nil_eq_\\<tau>moves)\napply(drule \\<tau>rtrancl3p_trans)\n apply(erule (1) \\<tau>rtrancl3p_step)\n apply(rule \\<tau>rtrancl3p_refl)\napply simp\ndone\n\nlemma \\<tau>diverge_rtranclp_silent_move:\n  \"\\<lbrakk> silent_move^** s s'; s' -\\<tau>\\<rightarrow> \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\nby(induct rule: converse_rtranclp_induct)(auto intro: \\<tau>divergeI)\n\nlemma \\<tau>diverge_trancl_coinduct [consumes 1, case_names \\<tau>diverge]:\n  assumes X: \"X s\"\n  and step: \"\\<And>s. X s \\<Longrightarrow> \\<exists>s'. silent_move^++ s s' \\<and> (X s' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>)\"\n  shows \"s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof -\n  from X have \"\\<exists>s'. silent_move^** s s' \\<and> X s'\" by blast\n  thus ?thesis\n  proof(coinduct)\n    case (\\<tau>diverge s)\n    then obtain s' where \"silent_move\\<^sup>*\\<^sup>* s s'\" \"X s'\" by blast\n    from step[OF \\<open>X s'\\<close>] obtain s'''\n      where \"silent_move^++ s' s'''\" \"X s''' \\<or> s''' -\\<tau>\\<rightarrow> \\<infinity>\" by blast\n    from \\<open>silent_move\\<^sup>*\\<^sup>* s s'\\<close> show ?case\n    proof(cases rule: converse_rtranclpE[consumes 1, case_names refl step])\n      case refl\n      moreover from tranclpD[OF \\<open>silent_move^++ s' s'''\\<close>] obtain s''\n        where \"silent_move s' s''\" \"silent_move^** s'' s'''\" by blast\n      ultimately show ?thesis using \\<open>silent_move^** s'' s'''\\<close> \\<open>X s''' \\<or> s''' -\\<tau>\\<rightarrow> \\<infinity>\\<close>\n        by(auto intro: \\<tau>diverge_rtranclp_silent_move)\n    next\n      case (step S)\n      moreover from \\<open>silent_move\\<^sup>*\\<^sup>* S s'\\<close> \\<open>silent_move^++ s' s'''\\<close>\n      have \"silent_move^** S s'''\" by(rule rtranclp_trans[OF _ tranclp_into_rtranclp])\n      ultimately show ?thesis using \\<open>X s''' \\<or> s''' -\\<tau>\\<rightarrow> \\<infinity>\\<close> by(auto intro: \\<tau>diverge_rtranclp_silent_move)\n    qed\n  qed\nqed\n\nlemma \\<tau>diverge_trancl_measure_coinduct [consumes 2, case_names \\<tau>diverge]:\n  assumes major: \"X s t\" \"wfP \\<mu>\"\n  and step: \"\\<And>s t. X s t \\<Longrightarrow> \\<exists>s' t'. (\\<mu> t' t \\<and> s' = s \\<or> silent_move^++ s s') \\<and> (X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>)\"\n  shows \"s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof -\n  { fix s t\n    assume \"X s t\"\n    with \\<open>wfP \\<mu>\\<close> have \"\\<exists>s' t'. silent_move^++ s s' \\<and> (X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>)\"\n    proof(induct arbitrary: s rule: wfP_induct[consumes 1])\n      case (1 t)\n      hence IH: \"\\<And>s' t'. \\<lbrakk> \\<mu> t' t; X s' t' \\<rbrakk> \\<Longrightarrow>\n                 \\<exists>s'' t''. silent_move^++ s' s'' \\<and> (X s'' t'' \\<or> s'' -\\<tau>\\<rightarrow> \\<infinity>)\" by blast\n      from step[OF \\<open>X s t\\<close>] obtain s' t'\n        where \"\\<mu> t' t \\<and> s' = s \\<or> silent_move\\<^sup>+\\<^sup>+ s s'\" \"X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>\" by blast\n      from \\<open>\\<mu> t' t \\<and> s' = s \\<or> silent_move\\<^sup>+\\<^sup>+ s s'\\<close> show ?case\n      proof\n        assume \"\\<mu> t' t \\<and> s' = s\"\n        hence  \"\\<mu> t' t\" and [simp]: \"s' = s\" by simp_all\n        from \\<open>X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>\\<close> show ?thesis\n        proof\n          assume \"X s' t'\"\n          from IH[OF \\<open>\\<mu> t' t\\<close> this] show ?thesis by simp\n        next\n          assume \"s' -\\<tau>\\<rightarrow> \\<infinity>\" thus ?thesis\n            by cases(auto simp add: silent_move_iff)\n        qed\n      next\n        assume \"silent_move\\<^sup>+\\<^sup>+ s s'\"\n        thus ?thesis using \\<open>X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>\\<close> by blast\n      qed\n    qed }\n  note X = this\n  from \\<open>X s t\\<close> have \"\\<exists>t. X s t\" ..\n  thus ?thesis\n  proof(coinduct rule: \\<tau>diverge_trancl_coinduct)\n    case (\\<tau>diverge s)\n    then obtain t where \"X s t\" ..\n    from X[OF this] show ?case by blast\n  qed\nqed\n\nlemma \\<tau>inf_step2\\<tau>inf_step_table_LNil [simp]: \"\\<tau>inf_step2\\<tau>inf_step_table s LNil = LNil\"\nby(simp add: \\<tau>inf_step2\\<tau>inf_step_table_def)\n\nlemma \\<tau>inf_step2\\<tau>inf_step_table_LCons [simp]:\n  fixes s tl ss tls\n  defines \"ss \\<equiv> SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls\\<rightarrow>* \\<infinity>\"\n  shows\n  \"\\<tau>inf_step2\\<tau>inf_step_table s (LCons tl tls) =\n   LCons (s, fst ss, tl, snd ss) (\\<tau>inf_step2\\<tau>inf_step_table (snd ss) tls)\"\nby(simp add: ss_def \\<tau>inf_step2\\<tau>inf_step_table_def split_beta)\n\nlemma lnull_\\<tau>inf_step2\\<tau>inf_step_table [simp]:\n  \"lnull (\\<tau>inf_step2\\<tau>inf_step_table s tls) \\<longleftrightarrow> lnull tls\"\nby(simp add: \\<tau>inf_step2\\<tau>inf_step_table_def)\n\nlemma lhd_\\<tau>inf_step2\\<tau>inf_step_table [simp]:\n  \"\\<not> lnull tls \\<Longrightarrow> lhd (\\<tau>inf_step2\\<tau>inf_step_table s tls) = \n  (let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n  in (s, s', lhd tls, s''))\"\nunfolding \\<tau>inf_step2\\<tau>inf_step_table_def Let_def by simp\n\nlemma ltl_\\<tau>inf_step2\\<tau>inf_step_table [simp]:\n  \"\\<not> lnull tls \\<Longrightarrow> ltl (\\<tau>inf_step2\\<tau>inf_step_table s tls) =\n  (let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n  in \\<tau>inf_step2\\<tau>inf_step_table s'' (ltl tls))\"\nunfolding \\<tau>inf_step2\\<tau>inf_step_table_def Let_def\nby(simp add: split_beta)\n\nlemma lmap_\\<tau>inf_step2\\<tau>inf_step_table: \"lmap (fst \\<circ> snd \\<circ> snd) (\\<tau>inf_step2\\<tau>inf_step_table s tls) = tls\"\nby(coinduction arbitrary: s tls)(auto simp add: split_beta)\n\nlemma \\<tau>inf_step_into_\\<tau>inf_step_table:\n  \"s -\\<tau>-tls\\<rightarrow>* \\<infinity> \\<Longrightarrow> s -\\<tau>-\\<tau>inf_step2\\<tau>inf_step_table s tls\\<rightarrow>*t \\<infinity>\"\nproof(coinduction arbitrary: s tls)\n  case (\\<tau>inf_step_table s tls)\n  thus ?case\n  proof(cases)\n    case (\\<tau>inf_step_Cons s' s'' tls' tl)\n    let ?ss = \"SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>\"\n    from \\<tau>inf_step_Cons have tls: \"tls = LCons tl tls'\" and \"s -\\<tau>\\<rightarrow>* s'\" \"s' -tl\\<rightarrow> s''\"\n      \"\\<not> \\<tau>move s' tl s''\" \"s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>\" by simp_all\n    hence \"(\\<lambda>(s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>) (s', s'')\" by simp\n    hence \"(\\<lambda>(s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>) ?ss\" by(rule someI)\n    with tls have ?\\<tau>inf_step_table_Cons by auto\n    thus ?thesis ..\n  next\n    case \\<tau>inf_step_Nil\n    then have ?\\<tau>inf_step_table_Nil by simp\n    thus ?thesis ..\n  qed\nqed\n\nlemma \\<tau>inf_step_imp_\\<tau>inf_step_table:\n  assumes \"s -\\<tau>-tls\\<rightarrow>* \\<infinity>\"\n  shows \"\\<exists>sstls. s -\\<tau>-sstls\\<rightarrow>*t \\<infinity> \\<and> tls = lmap (fst \\<circ> snd \\<circ> snd) sstls\"\nusing \\<tau>inf_step_into_\\<tau>inf_step_table[OF assms]\nby(auto simp only: lmap_\\<tau>inf_step2\\<tau>inf_step_table)\n\nlemma \\<tau>inf_step_table_into_\\<tau>inf_step:\n  \"s -\\<tau>-sstls\\<rightarrow>*t \\<infinity> \\<Longrightarrow> s -\\<tau>-lmap (fst \\<circ> snd \\<circ> snd) sstls\\<rightarrow>* \\<infinity>\"\nproof(coinduction arbitrary: s sstls)\n  case (\\<tau>inf_step s tls)\n  thus ?case by cases(auto simp add: o_def)\nqed\n\nlemma silent_move_fromI [intro]:\n  \"\\<lbrakk> silent_moves s0 s1; silent_move s1 s2 \\<rbrakk> \\<Longrightarrow> silent_move_from s0 s1 s2\"\nby(simp add: silent_move_from_def)\n\nlemma silent_move_fromE [elim]:\n  assumes \"silent_move_from s0 s1 s2\"\n  obtains \"silent_moves s0 s1\" \"silent_move s1 s2\"\nusing assms by(auto simp add: silent_move_from_def)\n\nlemma rtranclp_silent_move_from_imp_silent_moves:\n  assumes s'x: \"silent_move\\<^sup>*\\<^sup>* s' x\"\n  shows \"(silent_move_from s')^** x z \\<Longrightarrow> silent_moves s' z\"\nby(induct rule: rtranclp_induct)(auto intro: s'x)\n\nlemma \\<tau>diverge_not_wfP_silent_move_from:\n  assumes \"s -\\<tau>\\<rightarrow> \\<infinity>\"\n  shows \"\\<not> wfP (flip (silent_move_from s))\"\nproof\n  assume \"wfP (flip (silent_move_from s))\"\n  moreover define Q where \"Q = {s'. silent_moves s s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>}\"\n  hence \"s \\<in> Q\" using \\<open>s -\\<tau>\\<rightarrow> \\<infinity>\\<close> by(auto)\n  ultimately have \"\\<exists>z\\<in>Q. \\<forall>y. silent_move_from s z y \\<longrightarrow> y \\<notin> Q\"\n    unfolding wfP_eq_minimal flip_simps by blast\n  then obtain z where \"z \\<in> Q\"\n    and min: \"\\<And>y. silent_move_from s z y \\<Longrightarrow> y \\<notin> Q\" by blast\n  from \\<open>z \\<in> Q\\<close> have \"silent_moves s z\" \"z -\\<tau>\\<rightarrow> \\<infinity>\" unfolding Q_def by auto\n  from \\<open>z -\\<tau>\\<rightarrow> \\<infinity>\\<close> obtain y where \"silent_move z y\" \"y -\\<tau>\\<rightarrow> \\<infinity>\" by cases auto\n  from \\<open>silent_moves s z\\<close> \\<open>silent_move z y\\<close> have \"silent_move_from s z y\" ..\n  hence \"y \\<notin> Q\" by(rule min)\n  moreover from \\<open>silent_moves s z\\<close> \\<open>silent_move z y\\<close> \\<open>y -\\<tau>\\<rightarrow> \\<infinity>\\<close>\n  have \"y \\<in> Q\" unfolding Q_def by auto\n  ultimately show False by contradiction\nqed\n\nlemma wfP_silent_move_from_unroll:\n  assumes wfPs': \"\\<And>s'. s -\\<tau>\\<rightarrow> s' \\<Longrightarrow> wfP (flip (silent_move_from s'))\"\n  shows \"wfP (flip (silent_move_from s))\"\n  unfolding wfP_eq_minimal flip_conv\nproof(intro allI impI)\n  fix Q and x :: 's\n  assume \"x \\<in> Q\"\n  show \"\\<exists>z\\<in>Q. \\<forall>y. silent_move_from s z y \\<longrightarrow> y \\<notin> Q\"\n  proof(cases \"\\<exists>s'. s -\\<tau>\\<rightarrow> s' \\<and> (\\<exists>x'. silent_moves s' x' \\<and> x' \\<in> Q)\")\n    case False\n    hence \"\\<forall>y. silent_move_from s x y \\<longrightarrow> \\<not> y \\<in> Q\"\n      by(cases \"x=s\")(auto, blast elim: converse_rtranclpE intro: rtranclp.rtrancl_into_rtrancl)\n    with \\<open>x \\<in> Q\\<close> show ?thesis by blast\n  next\n    case True\n    then obtain s' x' where \"s -\\<tau>\\<rightarrow> s'\" and \"silent_moves s' x'\" and \"x' \\<in> Q\"\n      by auto\n    from \\<open>s -\\<tau>\\<rightarrow> s'\\<close> have \"wfP (flip (silent_move_from s'))\" by(rule wfPs')\n    from this \\<open>x' \\<in> Q\\<close> obtain z where \"z \\<in> Q\" and min: \"\\<And>y. silent_move_from s' z y \\<Longrightarrow> \\<not> y \\<in> Q\"\n      and \"(silent_move_from s')^** x' z\"\n      by (rule wfP_minimalE) (unfold flip_simps, blast)\n    { fix y\n      assume \"silent_move_from s z y\"\n      with \\<open>(silent_move_from s')^** x' z\\<close> \\<open>silent_move^** s' x'\\<close>\n      have \"silent_move_from s' z y\"\n        by(blast intro: rtranclp_silent_move_from_imp_silent_moves)\n      hence \"\\<not> y \\<in> Q\" by(rule min) }\n    with \\<open>z \\<in> Q\\<close> show ?thesis by(auto simp add: intro!: bexI)\n  qed\nqed\n\nlemma not_wfP_silent_move_from_\\<tau>diverge:\n  assumes \"\\<not> wfP (flip (silent_move_from s))\"\n  shows \"s -\\<tau>\\<rightarrow> \\<infinity>\"\nusing assms\nproof(coinduct)\n  case (\\<tau>diverge s)\n  { assume wfPs': \"\\<And>s'. s -\\<tau>\\<rightarrow> s' \\<Longrightarrow> wfP (flip (silent_move_from s'))\"\n    hence \"wfP (flip (silent_move_from s))\" by(rule wfP_silent_move_from_unroll) }\n  with \\<tau>diverge have \"\\<exists>s'. s -\\<tau>\\<rightarrow> s' \\<and> \\<not> wfP (flip (silent_move_from s'))\" by auto\n  thus ?case by blast\nqed\n\nlemma \\<tau>diverge_neq_wfP_silent_move_from:\n  \"s -\\<tau>\\<rightarrow> \\<infinity> \\<noteq> wfP (flip (silent_move_from s))\"\nby(auto intro: not_wfP_silent_move_from_\\<tau>diverge dest: \\<tau>diverge_not_wfP_silent_move_from)\n\nlemma not_\\<tau>diverge_to_no_\\<tau>move:\n  assumes \"\\<not> s -\\<tau>\\<rightarrow> \\<infinity>\"\n  shows \"\\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> (\\<forall>s''. \\<not> s' -\\<tau>\\<rightarrow> s'')\"\nproof -\n  define S where \"S = s\"\n  from \\<open>\\<not> \\<tau>diverge s\\<close> have \"wfP (flip (silent_move_from S))\" unfolding S_def\n    using \\<tau>diverge_neq_wfP_silent_move_from[of s] by simp\n  moreover have \"silent_moves S s\" unfolding S_def ..\n  ultimately show ?thesis\n  proof(induct rule: wfP_induct')\n    case (wfP s)\n    note IH = \\<open>\\<And>y. \\<lbrakk>flip (silent_move_from S) y s; S -\\<tau>\\<rightarrow>* y \\<rbrakk>\n             \\<Longrightarrow> \\<exists>s'. y -\\<tau>\\<rightarrow>* s' \\<and> (\\<forall>s''. \\<not> s' -\\<tau>\\<rightarrow> s'')\\<close>\n    show ?case\n    proof(cases \"\\<exists>s'. silent_move s s'\")\n      case False thus ?thesis by auto\n    next\n      case True\n      then obtain s' where \"s -\\<tau>\\<rightarrow> s'\" ..\n      with \\<open>S -\\<tau>\\<rightarrow>* s\\<close> have \"flip (silent_move_from S) s' s\"\n        unfolding flip_conv by(rule silent_move_fromI)\n      moreover from \\<open>S -\\<tau>\\<rightarrow>* s\\<close> \\<open>s -\\<tau>\\<rightarrow> s'\\<close> have \"S -\\<tau>\\<rightarrow>* s'\" ..\n      ultimately have \"\\<exists>s''. s' -\\<tau>\\<rightarrow>* s'' \\<and> (\\<forall>s'''. \\<not> s'' -\\<tau>\\<rightarrow> s''')\" by(rule IH)\n      then obtain s'' where \"s' -\\<tau>\\<rightarrow>* s''\" \"\\<forall>s'''. \\<not> s'' -\\<tau>\\<rightarrow> s'''\" by blast\n      from \\<open>s -\\<tau>\\<rightarrow> s'\\<close> \\<open>s' -\\<tau>\\<rightarrow>* s''\\<close> have \"s -\\<tau>\\<rightarrow>* s''\" by(rule converse_rtranclp_into_rtranclp)\n      with \\<open>\\<forall>s'''. \\<not> s'' -\\<tau>\\<rightarrow> s'''\\<close> show ?thesis by blast\n    qed\n  qed\nqed\n\nlemma \\<tau>diverge_conv_\\<tau>Runs:\n  \"s -\\<tau>\\<rightarrow> \\<infinity> \\<longleftrightarrow> s \\<Down> TNil None\"\nby(auto intro: \\<tau>Runs.Diverge elim: \\<tau>Runs.cases)\n\nlemma \\<tau>inf_step_into_\\<tau>Runs:\n  \"s -\\<tau>-tls\\<rightarrow>* \\<infinity> \\<Longrightarrow> s \\<Down> tllist_of_llist None tls\"\nproof(coinduction arbitrary: s tls)\n  case (\\<tau>Runs s tls')\n  thus ?case by cases(auto simp add: \\<tau>diverge_conv_\\<tau>Runs)\nqed\n\nlemma \\<tau>_into_\\<tau>Runs:\n  \"\\<lbrakk> s -\\<tau>\\<rightarrow> s'; s' \\<Down> tls \\<rbrakk> \\<Longrightarrow> s \\<Down> tls\"\nby(blast elim: \\<tau>Runs.cases intro: \\<tau>Runs.intros \\<tau>diverge.intros converse_rtranclp_into_rtranclp)\n\nlemma \\<tau>rtrancl3p_into_\\<tau>Runs:\n  assumes \"s -\\<tau>-tls\\<rightarrow>* s'\"\n  and \"s' \\<Down> tls'\"\n  shows \"s \\<Down> lappendt (llist_of tls) tls'\"\nusing assms\nby induct(auto intro: \\<tau>Runs.Proceed \\<tau>_into_\\<tau>Runs)\n\nlemma \\<tau>Runs_table_into_\\<tau>Runs:\n  \"\\<tau>Runs_table s stlsss \\<Longrightarrow> s \\<Down> tmap fst id stlsss\"\nproof(coinduction arbitrary: s stlsss)\n  case (\\<tau>Runs s tls)\n  thus ?case by cases(auto simp add: o_def id_def)\nqed\n\ndefinition \\<tau>Runs2\\<tau>Runs_table :: \"'s \\<Rightarrow> ('tl, 's option) tllist \\<Rightarrow> ('tl \\<times> 's, 's option) tllist\"\nwhere\n  \"\\<tau>Runs2\\<tau>Runs_table s tls = unfold_tllist\n     (\\<lambda>(s, tls). is_TNil tls)\n     (\\<lambda>(s, tls). terminal tls)\n     (\\<lambda>(s, tls). (thd tls, SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls))\n     (\\<lambda>(s, tls). (SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls, ttl tls))\n     (s, tls)\"\n\nlemma is_TNil_\\<tau>Runs2\\<tau>Runs_table [simp]:\n  \"is_TNil (\\<tau>Runs2\\<tau>Runs_table s tls) \\<longleftrightarrow> is_TNil tls\"\n  thm unfold_tllist.disc\nby(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\n\nlemma thd_\\<tau>Runs2\\<tau>Runs_table [simp]:\n  \"\\<not> is_TNil tls \\<Longrightarrow>\n  thd (\\<tau>Runs2\\<tau>Runs_table s tls) =\n  (thd tls, SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls)\"\nby(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\n\n\n\nlemma terminal_\\<tau>Runs2\\<tau>Runs_table [simp]:\n  \"is_TNil tls \\<Longrightarrow> terminal (\\<tau>Runs2\\<tau>Runs_table s tls) = terminal tls\"\nby(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\n\nlemma \\<tau>Runs2\\<tau>Runs_table_simps [simp, nitpick_simp]:\n  \"\\<tau>Runs2\\<tau>Runs_table s (TNil so) = TNil so\"\n  \"\\<And>tl. \n   \\<tau>Runs2\\<tau>Runs_table s (TCons tl tls) =\n   (let s'' = SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' \\<Down> tls\n    in TCons (tl, s'') (\\<tau>Runs2\\<tau>Runs_table s'' tls))\"\n apply(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\napply(rule tllist.expand)\napply(simp_all)\ndone\n\nlemma \\<tau>Runs2\\<tau>Runs_table_inverse:\n  \"tmap fst id (\\<tau>Runs2\\<tau>Runs_table s tls) = tls\"\nby(coinduction arbitrary: s tls) auto\n \nlemma \\<tau>Runs_into_\\<tau>Runs_table:\n  assumes \"s \\<Down> tls\"\n  shows \"\\<exists>stlsss. tls = tmap fst id stlsss \\<and> \\<tau>Runs_table s stlsss\"\nproof(intro exI conjI)\n  from assms show \"\\<tau>Runs_table s (\\<tau>Runs2\\<tau>Runs_table s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (\\<tau>Runs_table s tls)\n    thus ?case\n    proof cases\n      case (Terminate s')\n      hence ?Terminate by simp\n      thus ?thesis ..\n    next\n      case Diverge\n      hence ?Diverge by simp\n      thus ?thesis by simp\n    next\n      case (Proceed s' s'' tls' tl)\n      let ?P = \"\\<lambda>s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' \\<Down> tls'\"\n      from Proceed have \"?P s''\" by auto\n      hence \"?P (Eps ?P)\" by(rule someI)\n      hence ?Proceed using \\<open>tls = TCons tl tls'\\<close>\n        by(auto simp add: split_beta)\n      thus ?thesis by simp\n    qed\n  qed\nqed(simp add: \\<tau>Runs2\\<tau>Runs_table_inverse)\n\nlemma \\<tau>Runs_lappendtE:\n  assumes \"\\<sigma> \\<Down> lappendt tls tls'\"\n  and \"lfinite tls\"\n  obtains \\<sigma>' where \"\\<sigma> -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>'\"\n  and \"\\<sigma>' \\<Down> tls'\"\nproof(atomize_elim)\n  from \\<open>lfinite tls\\<close> \\<open>\\<sigma> \\<Down> lappendt tls tls'\\<close>\n  show \"\\<exists>\\<sigma>'. \\<sigma> -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>' \\<and> \\<sigma>' \\<Down> tls'\"\n  proof(induct arbitrary: \\<sigma>)\n    case lfinite_LNil thus ?case by(auto intro: \\<tau>rtrancl3p_refl)\n  next\n    case (lfinite_LConsI tls tl)\n    from \\<open>\\<sigma> \\<Down> lappendt (LCons tl tls) tls'\\<close>\n    show ?case unfolding lappendt_LCons\n    proof(cases)\n      case (Proceed \\<sigma>' \\<sigma>'')\n      from \\<open>\\<sigma>'' \\<Down> lappendt tls tls' \\<Longrightarrow> \\<exists>\\<sigma>'''. \\<sigma>'' -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>''' \\<and> \\<sigma>''' \\<Down> tls'\\<close> \\<open>\\<sigma>'' \\<Down> lappendt tls tls'\\<close>\n      obtain \\<sigma>''' where \"\\<sigma>'' -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>'''\" \"\\<sigma>''' \\<Down> tls'\" by blast\n      from \\<open>\\<sigma>' -tl\\<rightarrow> \\<sigma>''\\<close> \\<open>\\<not> \\<tau>move \\<sigma>' tl \\<sigma>''\\<close> \\<open>\\<sigma>'' -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>'''\\<close>\n      have \"\\<sigma>' -\\<tau>-tl # list_of tls\\<rightarrow>* \\<sigma>'''\" by(rule \\<tau>rtrancl3p_step)\n      with \\<open>\\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>'\\<close> have \"\\<sigma> -\\<tau>-[] @ (tl # list_of tls)\\<rightarrow>* \\<sigma>'''\"\n        unfolding \\<tau>rtrancl3p_Nil_eq_\\<tau>moves[symmetric] by(rule \\<tau>rtrancl3p_trans)\n      with \\<open>lfinite tls\\<close> have \"\\<sigma> -\\<tau>-list_of (LCons tl tls)\\<rightarrow>* \\<sigma>'''\" by(simp add: list_of_LCons)\n      with \\<open>\\<sigma>''' \\<Down> tls'\\<close> show ?thesis by blast\n    qed\n  qed\nqed\n\nlemma \\<tau>Runs_total:\n  \"\\<exists>tls. \\<sigma> \\<Down> tls\"\nproof\n  let ?\\<tau>halt = \"\\<lambda>\\<sigma> \\<sigma>'. \\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>' \\<and> (\\<forall>tl \\<sigma>''. \\<not> \\<sigma>' -tl\\<rightarrow> \\<sigma>'')\"\n  let ?\\<tau>diverge = \"\\<lambda>\\<sigma>. \\<sigma> -\\<tau>\\<rightarrow> \\<infinity>\"\n  let ?proceed = \"\\<lambda>\\<sigma> (tl, \\<sigma>''). \\<exists>\\<sigma>'. \\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>' \\<and> \\<sigma>' -tl\\<rightarrow> \\<sigma>'' \\<and> \\<not> \\<tau>move \\<sigma>' tl \\<sigma>''\"\n\n  define tls where \"tls = unfold_tllist\n     (\\<lambda>\\<sigma>. (\\<exists>\\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>') \\<or> ?\\<tau>diverge \\<sigma>)\n     (\\<lambda>\\<sigma>. if \\<exists>\\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>' then Some (SOME \\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>') else None)\n     (\\<lambda>\\<sigma>. fst (SOME tl\\<sigma>'. ?proceed \\<sigma> tl\\<sigma>'))\n     (\\<lambda>\\<sigma>. snd (SOME tl\\<sigma>'. ?proceed \\<sigma> tl\\<sigma>')) \\<sigma>\"\n  then show \"\\<sigma> \\<Down> tls\"\n  proof(coinduct \\<sigma> tls rule: \\<tau>Runs.coinduct)\n    case (\\<tau>Runs \\<sigma> tls)\n    show ?case\n    proof(cases \"\\<exists>\\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>'\")\n      case True\n      hence \"?\\<tau>halt \\<sigma> (SOME \\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>')\" by(rule someI_ex)\n      hence ?Terminate using True unfolding \\<tau>Runs by simp\n      thus ?thesis ..\n    next\n      case False\n      note \\<tau>halt = this\n      show ?thesis\n      proof(cases \"?\\<tau>diverge \\<sigma>\")\n        case True\n        hence ?Diverge using False unfolding \\<tau>Runs by simp\n        thus ?thesis by simp\n      next\n        case False\n        from not_\\<tau>diverge_to_no_\\<tau>move[OF this]\n        obtain \\<sigma>' where \\<sigma>_\\<sigma>': \"\\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>'\"\n          and no_\\<tau>: \"\\<And>\\<sigma>''. \\<not> \\<sigma>' -\\<tau>\\<rightarrow> \\<sigma>''\" by blast\n        from \\<sigma>_\\<sigma>' \\<tau>halt obtain tl \\<sigma>'' where \"\\<sigma>' -tl\\<rightarrow> \\<sigma>''\" by auto\n        moreover with no_\\<tau>[of \\<sigma>''] have \"\\<not> \\<tau>move \\<sigma>' tl \\<sigma>''\" by auto\n        ultimately have \"?proceed \\<sigma> (tl, \\<sigma>'')\" using \\<sigma>_\\<sigma>' by auto\n        hence \"?proceed \\<sigma> (SOME tl\\<sigma>. ?proceed \\<sigma> tl\\<sigma>)\" by(rule someI)\n        hence ?Proceed using False \\<tau>halt unfolding \\<tau>Runs\n          by(subst unfold_tllist.code) fastforce\n        thus ?thesis by simp\n      qed\n    qed\n  qed\nqed\n\n\n\n\n\nlemma silent_moves2_into_silent_moves:\n  assumes \"silent_moves2 s tls s'\"\n  shows \"s -\\<tau>\\<rightarrow>* s'\"\nusing assms\nby(induct)(blast intro: silent_move2_into_silent_move rtranclp.rtrancl_into_rtrancl)+\n\nlemma silent_moves_into_silent_moves2:\n  assumes \"s -\\<tau>\\<rightarrow>* s'\"\n  shows \"\\<exists>tls. silent_moves2 s tls s'\"\nusing assms\nby(induct)(blast dest: silent_move_into_silent_move2 intro: rtrancl3p_step)+\n\n\n\nlemma \\<tau>diverge_into_inf_step_silent_move2:\n  assumes \"s -\\<tau>\\<rightarrow> \\<infinity>\"\n  obtains tls where \"trsys.inf_step silent_move2 s tls\"\nproof -\n  define tls where \"tls = unfold_llist\n     (\\<lambda>_. False)\n     (\\<lambda>s. fst (SOME (tl, s'). silent_move2 s tl s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>))\n     (\\<lambda>s. snd (SOME (tl, s'). silent_move2 s tl s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>))\n     s\" (is \"_ = ?tls s\")\n  \n  with assms have \"s -\\<tau>\\<rightarrow> \\<infinity> \\<and> tls = ?tls s\" by simp\n  hence \"trsys.inf_step silent_move2 s tls\"\n  proof(coinduct rule: trsys.inf_step.coinduct[consumes 1, case_names inf_step, case_conclusion inf_step step])\n    case (inf_step s tls)\n    let ?P = \"\\<lambda>(tl, s'). silent_move2 s tl s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>\"\n    from inf_step obtain \"s -\\<tau>\\<rightarrow> \\<infinity>\" and tls: \"tls = ?tls s\" ..\n    from \\<open>s -\\<tau>\\<rightarrow> \\<infinity>\\<close> obtain s' where \"s -\\<tau>\\<rightarrow> s'\" \"s' -\\<tau>\\<rightarrow> \\<infinity>\" by cases\n    from \\<open>s -\\<tau>\\<rightarrow> s'\\<close> obtain tl where \"silent_move2 s tl s'\" \n      by(blast dest: silent_move_into_silent_move2)\n    with \\<open>s' -\\<tau>\\<rightarrow> \\<infinity>\\<close> have \"?P (tl, s')\" by simp\n    hence \"?P (Eps ?P)\" by(rule someI)\n    thus ?case using tls\n      by(subst (asm) unfold_llist.code)(auto)\n  qed\n  thus thesis by(rule that)\nqed\n\nlemma \\<tau>Runs_into_\\<tau>rtrancl3p:\n  assumes runs: \"s \\<Down> tlss\"\n  and fin: \"tfinite tlss\"\n  and terminal: \"terminal tlss = Some s'\"\n  shows \"\\<tau>rtrancl3p s (list_of (llist_of_tllist tlss)) s'\"\nusing fin runs terminal\nproof(induct arbitrary: s rule: tfinite_induct)\n  case TNil thus ?case by cases(auto intro: silent_moves_into_\\<tau>rtrancl3p)\nnext\n  case (TCons tl tlss)\n  from \\<open>s \\<Down> TCons tl tlss\\<close> obtain s'' s'''\n    where step: \"s -\\<tau>\\<rightarrow>* s''\"\n    and step2: \"s'' -tl\\<rightarrow> s'''\" \"\\<not> \\<tau>move s'' tl s'''\" \n    and \"s''' \\<Down> tlss\" by cases\n  from \\<open>terminal (TCons tl tlss) = \\<lfloor>s'\\<rfloor>\\<close> have \"terminal tlss = \\<lfloor>s'\\<rfloor>\" by simp\n  with \\<open>s''' \\<Down> tlss\\<close> have \"s''' -\\<tau>-list_of (llist_of_tllist tlss)\\<rightarrow>* s'\" by(rule TCons)\n  with step2 have \"s'' -\\<tau>-tl # list_of (llist_of_tllist tlss)\\<rightarrow>* s'\" by(rule \\<tau>rtrancl3p_step)\n  with step have \"s -\\<tau>-[] @ tl # list_of (llist_of_tllist tlss)\\<rightarrow>* s'\"\n    by(rule \\<tau>rtrancl3p_trans[OF silent_moves_into_\\<tau>rtrancl3p])\n  thus ?case using \\<open>tfinite tlss\\<close> by simp\nqed\n\nlemma \\<tau>Runs_terminal_stuck:\n  assumes Runs: \"s \\<Down> tlss\"\n  and fin: \"tfinite tlss\"\n  and terminal: \"terminal tlss = Some s'\"\n  and proceed: \"s' -tls\\<rightarrow> s''\"\n  shows False\nusing fin Runs terminal\nproof(induct arbitrary: s rule: tfinite_induct)\n  case TNil thus ?case using proceed by cases auto\nnext\n  case TCons thus ?case by(fastforce elim: \\<tau>Runs.cases)\nqed\n\nlemma Runs_table_silent_diverge:\n  \"\\<lbrakk> Runs_table s stlss; \\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'; \\<not> lfinite stlss \\<rbrakk>\n  \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof(coinduction arbitrary: s stlss)\n  case (\\<tau>diverge s)\n  thus ?case by cases(auto 5 2)\nqed\n\nlemma Runs_table_silent_rtrancl:\n  assumes \"lfinite stlss\"\n  and \"Runs_table s stlss\"\n  and \"\\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'\"\n  shows \"s -\\<tau>\\<rightarrow>* llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\" (is ?thesis1)\n  and \"llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss)) -tl'\\<rightarrow> s'' \\<Longrightarrow> False\" (is \"PROP ?thesis2\")\nproof -\n  from assms have \"?thesis1 \\<and> (llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss)) -tl'\\<rightarrow> s'' \\<longrightarrow> False)\"\n  proof(induct arbitrary: s)\n    case lfinite_LNil thus ?case by(auto elim: Runs_table.cases)\n  next\n    case (lfinite_LConsI stlss stls)\n    from \\<open>Runs_table s (LCons stls stlss)\\<close>\n    obtain tl s' where [simp]: \"stls = (s, tl, s')\"\n      and \"s -tl\\<rightarrow> s'\" and Run': \"Runs_table s' stlss\" by cases\n    from \\<open>\\<forall>(s, tl, s')\\<in>lset (LCons stls stlss). \\<tau>move s tl s'\\<close>\n    have \"\\<tau>move s tl s'\" and silent': \"\\<forall>(s, tl, s')\\<in>lset stlss. \\<tau>move s tl s'\" by simp_all\n    from \\<open>s -tl\\<rightarrow> s'\\<close> \\<open>\\<tau>move s tl s'\\<close> have \"s -\\<tau>\\<rightarrow> s'\" by auto\n    moreover from Run' silent'\n    have \"s' -\\<tau>\\<rightarrow>* llast (LCons s' (lmap (\\<lambda>(s, tl, s'). s') stlss)) \\<and>\n          (llast (LCons s' (lmap (\\<lambda>(s, tl, s'). s') stlss)) -tl'\\<rightarrow> s'' \\<longrightarrow> False)\"\n      by(rule lfinite_LConsI)\n    ultimately show ?case by(auto)\n  qed\n  thus ?thesis1 \"PROP ?thesis2\" by blast+\nqed\n\nlemma Runs_table_silent_lappendD:\n  fixes s stlss\n  defines \"s' \\<equiv> llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\"\n  assumes Runs: \"Runs_table s (lappend stlss stlss')\"\n  and fin: \"lfinite stlss\"\n  and silent: \"\\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'\"\n  shows \"s -\\<tau>\\<rightarrow>* s'\" (is ?thesis1)\n  and \"Runs_table s' stlss'\" (is ?thesis2)\n  and \"stlss' \\<noteq> LNil \\<Longrightarrow> s' = fst (lhd stlss')\" (is \"PROP ?thesis3\")\nproof -\n  from fin Runs silent\n  have \"?thesis1 \\<and> ?thesis2 \\<and> (stlss' \\<noteq> LNil \\<longrightarrow> s' = fst (lhd stlss'))\"\n    unfolding s'_def\n  proof(induct arbitrary: s)\n    case lfinite_LNil thus ?case\n      by(auto simp add: neq_LNil_conv Runs_table_simps)\n  next\n    case lfinite_LConsI thus ?case\n      by(clarsimp simp add: neq_LNil_conv Runs_table_simps)(blast intro: converse_rtranclp_into_rtranclp)\n  qed\n  thus ?thesis1 ?thesis2 \"PROP ?thesis3\" by simp_all\nqed\n\nlemma Runs_table_into_\\<tau>Runs:\n  fixes s stlss\n  defines \"tls \\<equiv> tmap (\\<lambda>(s, tl, s'). tl) id (tfilter None (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') (tllist_of_llist (Some (llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss)))) stlss))\"\n  (is \"_ \\<equiv> ?conv s stlss\")\n  assumes \"Runs_table s stlss\"\n  shows \"\\<tau>Runs s tls\"\nusing assms\nproof(coinduction arbitrary: s tls stlss)\n  case (\\<tau>Runs s tls stlss)\n  note tls = \\<open>tls = ?conv s stlss\\<close>\n    and Run = \\<open>Runs_table s stlss\\<close>\n  show ?case\n  proof(cases tls)\n    case [simp]: (TNil so)\n    from tls\n    have silent: \"\\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'\"\n      by(auto simp add: TNil_eq_tmap_conv tfilter_empty_conv)\n    show ?thesis\n    proof(cases \"lfinite stlss\")\n      case False\n      with Run silent have \"s -\\<tau>\\<rightarrow> \\<infinity>\" by(rule Runs_table_silent_diverge)\n      hence ?Diverge using False tls by(simp add: TNil_eq_tmap_conv tfilter_empty_conv)\n      thus ?thesis by simp\n    next\n      case True\n      with Runs_table_silent_rtrancl[OF this Run silent]\n      have ?Terminate using tls\n        by(auto simp add: TNil_eq_tmap_conv tfilter_empty_conv terminal_tllist_of_llist split_def)\n      thus ?thesis by simp\n    qed\n  next\n    case [simp]: (TCons tl tls')\n    from tls obtain s' s'' stlss' \n      where tl': \"tfilter None (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') (tllist_of_llist \\<lfloor>llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\\<rfloor> stlss) = TCons (s', tl, s'') stlss'\"\n      and tls': \"tls' = tmap (\\<lambda>(s, tl, s'). tl) id stlss'\"\n      by(simp add: TCons_eq_tmap_conv split_def id_def split_paired_Ex) blast\n    from tfilter_eq_TConsD[OF tl']\n    obtain stls\\<tau> rest\n      where stlss_eq: \"tllist_of_llist \\<lfloor>llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\\<rfloor> stlss = lappendt stls\\<tau> (TCons (s', tl, s'') rest)\"\n      and fin: \"lfinite stls\\<tau>\"\n      and silent: \"\\<forall>(s, tl, s')\\<in>lset stls\\<tau>. \\<tau>move s tl s'\"\n      and \"\\<not> \\<tau>move s' tl s''\"\n      and stlss': \"stlss' = tfilter None (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') rest\"\n      by(auto simp add: split_def)\n    from stlss_eq fin obtain rest'\n      where stlss: \"stlss = lappend stls\\<tau> rest'\"\n      and rest': \"tllist_of_llist \\<lfloor>llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\\<rfloor> rest' = TCons (s', tl, s'') rest\"\n      unfolding tllist_of_llist_eq_lappendt_conv by auto\n    hence \"rest' \\<noteq> LNil\" by clarsimp\n    from Run[unfolded stlss] fin silent\n    have \"s -\\<tau>\\<rightarrow>* llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stls\\<tau>))\"\n      and \"Runs_table (llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stls\\<tau>))) rest'\"\n      and \"llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stls\\<tau>)) = fst (lhd rest')\"\n      by(rule Runs_table_silent_lappendD)+(simp add: \\<open>rest' \\<noteq> LNil\\<close>)\n    moreover with rest' \\<open>rest' \\<noteq> LNil\\<close> stlss fin obtain rest''\n      where rest': \"rest' = LCons (s', tl, s'') rest''\"\n      and rest: \"rest = tllist_of_llist \\<lfloor>llast (LCons s'' (lmap (\\<lambda>(s, tl, s'). s') rest''))\\<rfloor> rest''\"\n      by(clarsimp simp add: neq_LNil_conv llast_LCons lmap_lappend_distrib)\n    ultimately have \"s -\\<tau>\\<rightarrow>* s'\" \"s' -tl\\<rightarrow> s''\" \"Runs_table s'' rest''\"\n      by(simp_all add: Runs_table_simps)\n    hence ?Proceed using \\<open>\\<not> \\<tau>move s' tl s''\\<close> tls' stlss' rest\n      by(auto simp add: id_def)\n    thus ?thesis by simp\n  qed\nqed\n\nlemma \\<tau>Runs_table2_into_\\<tau>Runs:\n  \"\\<tau>Runs_table2 s tlsstlss\n  \\<Longrightarrow> s \\<Down> tmap (\\<lambda>(tls, s', tl, s''). tl) (\\<lambda>x. case x of Inl (tls, s') \\<Rightarrow> Some s' | Inr _ \\<Rightarrow> None) tlsstlss\"\nproof(coinduction arbitrary: s tlsstlss)\n  case (\\<tau>Runs s tlsstlss)\n  thus ?case by cases(auto intro: silent_moves2_into_silent_moves inf_step_silent_move2_into_\\<tau>diverge)\nqed\n\nlemma \\<tau>Runs_into_\\<tau>Runs_table2:\n  assumes \"s \\<Down> tls\"\n  obtains tlsstlss\n  where \"\\<tau>Runs_table2 s tlsstlss\"\n  and \"tls = tmap (\\<lambda>(tls, s', tl, s''). tl) (\\<lambda>x. case x of Inl (tls, s') \\<Rightarrow> Some s' | Inr _ \\<Rightarrow> None) tlsstlss\"\nproof -\n  let ?terminal = \"\\<lambda>s tls. case terminal tls of \n          None \\<Rightarrow> Inr (SOME tls'. trsys.inf_step silent_move2 s tls')\n        | Some s' \\<Rightarrow> let tls' = SOME tls'. silent_moves2 s tls' s' in Inl (tls', s')\"\n  let ?P = \"\\<lambda>s tls (tls'', s', s''). silent_moves2 s tls'' s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls\"\n  define tlsstlss where \"tlsstlss s tls = unfold_tllist\n      (\\<lambda>(s, tls). is_TNil tls)\n      (\\<lambda>(s, tls). ?terminal s tls)\n      (\\<lambda>(s, tls). let (tls'', s', s'') = Eps (?P s tls) in (tls'', s', thd tls, s''))\n      (\\<lambda>(s, tls). let (tls'', s', s'') = Eps (?P s tls) in (s'', ttl tls))\n      (s, tls)\"\n    for s tls\n\n  have [simp]:\n    \"\\<And>s tls. is_TNil (tlsstlss s tls) \\<longleftrightarrow> is_TNil tls\"\n    \"\\<And>s tls. is_TNil tls \\<Longrightarrow> terminal (tlsstlss s tls) = ?terminal s tls\"\n    \"\\<And>s tls. \\<not> is_TNil tls \\<Longrightarrow> thd (tlsstlss s tls) = (let (tls'', s', s'') = Eps (?P s tls) in (tls'', s', thd tls, s''))\"\n    \"\\<And>s tls. \\<not> is_TNil tls \\<Longrightarrow> ttl (tlsstlss s tls) = (let (tls'', s', s'') = Eps (?P s tls) in tlsstlss s'' (ttl tls))\"\n    by(simp_all add: tlsstlss_def split_beta)\n\n  have [simp]:\n    \"\\<And>s. tlsstlss s (TNil None) = TNil (Inr (SOME tls'. trsys.inf_step silent_move2 s tls'))\"\n    \"\\<And>s s'. tlsstlss s (TNil (Some s')) = TNil (Inl (SOME tls'. silent_moves2 s tls' s', s'))\"\n    unfolding tlsstlss_def by simp_all\n\n  let ?conv = \"tmap (\\<lambda>(tls, s', tl, s''). tl) (\\<lambda>x. case x of Inl (tls, s') \\<Rightarrow> Some s' | Inr _ \\<Rightarrow> None)\"\n  from assms have \"\\<tau>Runs_table2 s (tlsstlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (\\<tau>Runs_table2 s tls)\n    thus ?case\n    proof(cases)\n      case (Terminate s')\n      let ?P = \"\\<lambda>tls'. silent_moves2 s tls' s'\"\n      from \\<open>s -\\<tau>\\<rightarrow>* s'\\<close> obtain tls' where \"?P tls'\" by(blast dest: silent_moves_into_silent_moves2)\n      hence \"?P (Eps ?P)\" by(rule someI)\n      with Terminate have ?Terminate by auto\n      thus ?thesis by simp\n    next\n      case Diverge\n      let ?P = \"\\<lambda>tls'. trsys.inf_step silent_move2 s tls'\"\n      from \\<open>s -\\<tau>\\<rightarrow> \\<infinity>\\<close> obtain tls' where \"?P tls'\" by(rule \\<tau>diverge_into_inf_step_silent_move2)\n      hence \"?P (Eps ?P)\" by(rule someI)\n      hence ?Diverge using \\<open>tls = TNil None\\<close> by simp\n      thus ?thesis by simp\n    next\n      case (Proceed s' s'' tls' tl)\n      from \\<open>s -\\<tau>\\<rightarrow>* s'\\<close> obtain tls'' where \"silent_moves2 s tls'' s'\"\n        by(blast dest: silent_moves_into_silent_moves2)\n      with Proceed have \"?P s tls (tls'', s', s'')\" by simp\n      hence \"?P s tls (Eps (?P s tls))\" by(rule someI)\n      hence ?Proceed using Proceed unfolding tlsstlss_def\n        by(subst unfold_tllist.code)(auto simp add: split_def)\n      thus ?thesis by simp\n    qed\n  qed\n  moreover\n  from assms have \"tls = ?conv (tlsstlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (Eq_tllist s tls)\n    thus ?case\n    proof(cases)\n      case (Proceed s' s'' tls' tl)\n      from \\<open>s -\\<tau>\\<rightarrow>* s'\\<close> obtain tls'' where \"silent_moves2 s tls'' s'\"\n        by(blast dest: silent_moves_into_silent_moves2)\n      with Proceed have \"?P s tls (tls'', s', s'')\" by simp\n      hence \"?P s tls (Eps (?P s tls))\" by(rule someI)\n      thus ?thesis using \\<open>tls = TCons tl tls'\\<close> by auto\n    qed auto\n  qed\n  ultimately show thesis by(rule that)\nqed\n\nlemma \\<tau>Runs_table2_into_Runs:\n  assumes \"\\<tau>Runs_table2 s tlsstlss\"\n  shows \"Runs s (lconcat (lappend (lmap (\\<lambda>(tls, s, tl, s'). llist_of (tls @ [tl])) (llist_of_tllist tlsstlss)) (LCons (case terminal tlsstlss of Inl (tls, s') \\<Rightarrow> llist_of tls | Inr tls \\<Rightarrow> tls) LNil)))\"\n  (is \"Runs _ (?conv tlsstlss)\")\nusing assms\nproof(coinduction arbitrary: s tlsstlss)\n  case (Runs s tlsstlss)\n  thus ?case\n  proof(cases)\n    case (Terminate tls' s')\n    from \\<open>silent_moves2 s tls' s'\\<close> show ?thesis\n    proof(cases rule: rtrancl3p_converseE)\n      case refl \n      hence ?Stuck using Terminate by simp\n      thus ?thesis ..\n    next\n      case (step tls'' tl s'')\n      from \\<open>silent_moves2 s'' tls'' s'\\<close> \\<open>\\<And>tl s''. \\<not> s' -tl\\<rightarrow> s''\\<close>\n      have \"\\<tau>Runs_table2 s'' (TNil (Inl (tls'', s')))\" ..\n      with \\<open>tls' = tl # tls''\\<close> \\<open>silent_move2 s tl s''\\<close> \\<open>tlsstlss = TNil (Inl (tls', s'))\\<close>\n      have ?Step by(auto simp add: silent_move2_def intro!: exI)\n      thus ?thesis ..\n    qed\n  next\n    case (Diverge tls')\n    from \\<open>trsys.inf_step silent_move2 s tls'\\<close>\n    obtain tl tls'' s' where \"silent_move2 s tl s'\" \n      and \"tls' = LCons tl tls''\" \"trsys.inf_step silent_move2 s' tls''\"\n      by(cases rule: trsys.inf_step.cases[consumes 1]) auto\n    from \\<open>trsys.inf_step silent_move2 s' tls''\\<close>\n    have \"\\<tau>Runs_table2 s' (TNil (Inr tls''))\" ..\n    hence ?Step using \\<open>tlsstlss = TNil (Inr tls')\\<close> \\<open>tls' = LCons tl tls''\\<close> \\<open>silent_move2 s tl s'\\<close>\n      by(auto simp add: silent_move2_def intro!: exI)\n    thus ?thesis ..\n  next\n    case (Proceed tls' s' s'' tlsstlss' tl)\n    from \\<open>silent_moves2 s tls' s'\\<close> have ?Step\n    proof(cases rule: rtrancl3p_converseE)\n      case refl with Proceed show ?thesis by auto\n    next\n      case (step tls'' tl' s''')\n      from \\<open>silent_moves2 s''' tls'' s'\\<close> \\<open>s' -tl\\<rightarrow> s''\\<close> \\<open>\\<not> \\<tau>move s' tl s''\\<close> \\<open>\\<tau>Runs_table2 s'' tlsstlss'\\<close>\n      have \"\\<tau>Runs_table2 s''' (TCons (tls'', s', tl, s'') tlsstlss')\" ..\n      with \\<open>tls' = tl' # tls''\\<close> \\<open>silent_move2 s tl' s'''\\<close> \\<open>tlsstlss = TCons (tls', s', tl, s'') tlsstlss'\\<close>\n      show ?thesis by(auto simp add: silent_move2_def intro!: exI)\n    qed\n    thus ?thesis ..\n  qed\nqed\n\nlemma \\<tau>Runs_table2_silentsD:\n  fixes tl\n  assumes Runs: \"\\<tau>Runs_table2 s tlsstlss\"\n  and tset: \"(tls, s', tl', s'') \\<in> tset tlsstlss\"\n  and set: \"tl \\<in> set tls\"\n  shows \"\\<exists>s''' s''''. silent_move2 s''' tl s''''\"\nusing tset Runs\nproof(induct arbitrary: s rule: tset_induct)\n  case (find tlsstlss')\n  from \\<open>\\<tau>Runs_table2 s (TCons (tls, s', tl', s'') tlsstlss')\\<close>\n  have \"silent_moves2 s tls s'\" by cases\n  thus ?case using set by induct auto\nnext\n  case step thus ?case by(auto simp add: \\<tau>Runs_table2_simps)\nqed\n\nlemma \\<tau>Runs_table2_terminal_silentsD:\n  assumes Runs: \"\\<tau>Runs_table2 s tlsstlss\"\n  and fin: \"lfinite (llist_of_tllist tlsstlss)\"\n  and terminal: \"terminal tlsstlss = Inl (tls, s'')\"\n  shows \"\\<exists>s'. silent_moves2 s' tls s''\"\nusing fin Runs terminal\nproof(induct \"llist_of_tllist tlsstlss\" arbitrary: tlsstlss s)\n  case lfinite_LNil thus ?case \n    by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nnext\n  case (lfinite_LConsI xs tlsstls)\n  thus ?case by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nqed\n\nlemma \\<tau>Runs_table2_terminal_inf_stepD:\n  assumes Runs: \"\\<tau>Runs_table2 s tlsstlss\"\n  and fin: \"lfinite (llist_of_tllist tlsstlss)\"\n  and terminal: \"terminal tlsstlss = Inr tls\"\n  shows \"\\<exists>s'. trsys.inf_step silent_move2 s' tls\"\nusing fin Runs terminal\nproof(induct \"llist_of_tllist tlsstlss\" arbitrary: s tlsstlss)\n  case lfinite_LNil thus ?case\n    by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nnext\n  case (lfinite_LConsI xs tlsstls)\n  thus ?case by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nqed\n\nlemma \\<tau>Runs_table2_lappendtD:\n  assumes Runs: \"\\<tau>Runs_table2 s (lappendt tlsstlss tlsstlss')\"\n  and fin: \"lfinite tlsstlss\"\n  shows \"\\<exists>s'. \\<tau>Runs_table2 s' tlsstlss'\"\nusing fin Runs\nby(induct arbitrary: s)(auto simp add: \\<tau>Runs_table2_simps)\n\nend\n\nlemma \\<tau>moves_False: \"\\<tau>trsys.silent_move r (\\<lambda>s ta s'. False) = (\\<lambda>s s'. False)\"\nby(auto simp add: \\<tau>trsys.silent_move_iff)\n\nlemma \\<tau>rtrancl3p_False_eq_rtrancl3p: \"\\<tau>trsys.\\<tau>rtrancl3p r (\\<lambda>s tl s'. False) = rtrancl3p r\"\nproof(intro ext iffI)\n  fix s tls s'\n  assume \"\\<tau>trsys.\\<tau>rtrancl3p r (\\<lambda>s tl s'. False) s tls s'\"\n  thus \"rtrancl3p r s tls s'\" by(rule \\<tau>trsys.\\<tau>rtrancl3p.induct)(blast intro: rtrancl3p_step_converse)+\nnext\n  fix s tls s'\n  assume \"rtrancl3p r s tls s'\"\n  thus \"\\<tau>trsys.\\<tau>rtrancl3p r (\\<lambda>s tl s'. False) s tls s'\"\n    by(induct rule: rtrancl3p_converse_induct)(auto intro: \\<tau>trsys.\\<tau>rtrancl3p.intros)\nqed\n\nlemma \\<tau>diverge_empty_\\<tau>move:\n  \"\\<tau>trsys.\\<tau>diverge r (\\<lambda>s ta s'. False) = (\\<lambda>s. False)\"\nby(auto intro!: ext elim: \\<tau>trsys.\\<tau>diverge.cases \\<tau>trsys.silent_move.cases)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaThreads/Framework/LTS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526368038302, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3247320359980113}}
{"text": "section\\<open>PTA Generalisation\\<close>\ntext\\<open>The problem with the simplistic heuristics of \\cite{foster2019} is that the performance of the\nInference technique is almost entirely dependent on the quality and applicability of the heuristics\nprovided to it. Producing high quality heuristics often requires some inside knowledge of the system\nunder inference. If the user has this knowledge already, they are unlikely to require automated\ninference. Ideally, we would like something more generally applicable. This theory presents a more\nabstract \\emph{metaheuristic} which can be implemented with genetic programming.\\<close>\n\ntheory PTA_Generalisation\n  imports \"../Inference\" Same_Register Group_By\nbegin\n\nhide_const I\n\ndatatype value_type = N | S\n\ninstantiation value_type :: linorder begin\nfun less_value_type :: \"value_type \\<Rightarrow> value_type \\<Rightarrow> bool\" where\n  \"less_value_type N S = True\" |\n  \"less_value_type _ _ = False\"\n\ndefinition less_eq_value_type :: \"value_type \\<Rightarrow> value_type \\<Rightarrow> bool\" where\n \"less_eq_value_type v1 v2 \\<equiv> (v1 < v2 \\<or> v1 = v2)\"\n\ninstance\n  apply standard\n  using less_eq_value_type_def less_value_type.elims(2) apply blast\n     apply (simp add: less_eq_value_type_def)\n    apply (metis less_eq_value_type_def value_type.exhaust)\n  using less_eq_value_type_def less_value_type.elims(2) apply blast\n  by (metis less_eq_value_type_def less_value_type.elims(3) value_type.simps(2))\n\nend\n\n\\<comment> \\<open>This is a very hacky way of making sure that things with differently typed outputs don't get\n    lumped together.\\<close>\nfun typeSig :: \"output_function \\<Rightarrow> value_type\" where\n  \"typeSig (L (value.Str _)) = S\" |\n  \"typeSig _ = N\"\n\ndefinition same_structure :: \"transition \\<Rightarrow> transition \\<Rightarrow> bool\" where\n  \"same_structure t1 t2 = (\n    Label t1 = Label t2 \\<and>\n    Arity t1 = Arity t2 \\<and>\n    map typeSig (Outputs t1) = map typeSig (Outputs t2)\n  )\"\n\nlemma same_structure_equiv:\n  \"Outputs t1 = [L (Num m)] \\<Longrightarrow> Outputs t2 = [L (Num n)] \\<Longrightarrow>\n   same_structure t1 t2 = Transition.same_structure t1 t2\"\n  by (simp add: same_structure_def Transition.same_structure_def)\n\ntype_synonym transition_group = \"(tids \\<times> transition) list\"\n\nfun observe_all :: \"iEFSM \\<Rightarrow>  cfstate \\<Rightarrow> registers \\<Rightarrow> trace \\<Rightarrow> transition_group\" where\n  \"observe_all _ _ _ [] = []\" |\n  \"observe_all e s r ((l, i, _)#es)  =\n    (case random_member (i_possible_steps e s r l i)  of\n      (Some (ids, s', t)) \\<Rightarrow> (((ids, t)#(observe_all e s' (evaluate_updates t i r) es))) |\n      _ \\<Rightarrow> []\n    )\"\n\ndefinition transition_groups_exec :: \"iEFSM \\<Rightarrow> trace \\<Rightarrow> (nat \\<times> tids \\<times> transition) list list\" where\n  \"transition_groups_exec e t = group_by (\\<lambda>(_, _, t1) (_, _, t2). same_structure t1 t2) (enumerate 0 (observe_all e 0 <> t))\"\n\ntype_synonym struct = \"(label \\<times> arity \\<times> value_type list)\"\n\ntext\\<open>We need to take the list of transition groups and tag them with the last transition that was\ntaken which had a different structure.\\<close>\nfun tag :: \"struct option \\<Rightarrow> (nat \\<times> tids \\<times> transition) list list \\<Rightarrow> (struct option \\<times> struct \\<times> (nat \\<times> tids \\<times> transition) list) list\" where\n  \"tag _ [] = []\" |\n  \"tag t (g#gs) = (\n    let\n      (_, _, head) = hd g;\n      struct = (Label head, Arity head, map typeSig (Outputs head))\n    in\n    (t, struct, g)#(tag (Some struct) gs)\n  )\"\n\ntext\\<open>We need to group transitions not just by their structure but also by their history - i.e. the\nlast transition which was taken which had a different structure. We need to order these groups by\ntheir relative positions within the traces such that output and update functions can be inferred in\nthe correct order.\\<close>\ndefinition transition_groups :: \"iEFSM \\<Rightarrow> log \\<Rightarrow> transition_group list\" where\n  \"transition_groups e l = (\n    let\n      trace_groups = map (transition_groups_exec e) l;\n      tagged = map (tag None) trace_groups;\n      flat =  sort (fold (@) tagged []);\n      group_fun = fold (\\<lambda>(tag, s, gp) f. f((tag, s) $:= gp@(f$(tag, s)))) flat (K$ []);\n      grouped = map (\\<lambda>x. group_fun $ x) (finfun_to_list group_fun);\n      inx_groups = map (\\<lambda>gp. (Min (set (map fst gp)), map snd gp)) grouped\n    in\n      map snd (sort inx_groups)\n  )\"\n\ntext\\<open>For a given trace group, log, and EFSM, we want to build the training set for that group. That\nis, the set of inputs, registers, and expected outputs from those transitions. To do this, we must\nwalk the traces in the EFSM to obtain the register values.\\<close>\nfun trace_group_training_set :: \"transition_group \\<Rightarrow> iEFSM \\<Rightarrow> cfstate \\<Rightarrow> registers \\<Rightarrow> trace \\<Rightarrow> (inputs \\<times> registers \\<times> value list) list \\<Rightarrow> (inputs \\<times> registers \\<times> value list) list\" where\n  \"trace_group_training_set _ _ _ _ [] train = train\" |\n  \"trace_group_training_set gp e s r ((l, i, p)#t) train = (\n    let\n      (id, s', transition) = fthe_elem (i_possible_steps e s r l i)\n    in\n    if \\<exists>(id', _) \\<in> set gp. id' = id then\n      trace_group_training_set gp e s' (evaluate_updates transition i r) t ((i, r, p)#train)\n    else\n      trace_group_training_set gp e s' (evaluate_updates transition i r) t train\n  )\"\n\ndefinition make_training_set :: \"iEFSM \\<Rightarrow> log \\<Rightarrow> transition_group \\<Rightarrow> (inputs \\<times> registers \\<times> value list) list\" where\n  \"make_training_set e l gp = fold (\\<lambda>h a. trace_group_training_set gp e 0 <> h a) l []\"\n\nprimrec replace_groups :: \"transition_group list \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM\" where\n  \"replace_groups [] e = e\" |\n  \"replace_groups (h#t) e = replace_groups t (fold (\\<lambda>(id, t) acc. replace_transition acc id t) h e)\"\n\nlemma replace_groups_fold [code]:\n  \"replace_groups xs e = fold (\\<lambda>h acc'. (fold (\\<lambda>(id, t) acc. replace_transition acc id t) h acc')) xs e\"\n  by (induct xs arbitrary: e,  auto)\n\ndefinition insert_updates :: \"transition \\<Rightarrow> update_function list \\<Rightarrow> transition\" where\n  \"insert_updates t u = (\n    let\n      \\<comment> \\<open>Want to filter out null updates of the form rn := rn. It doesn't affect anything but it  \\<close>\n      \\<comment> \\<open>does make things look cleaner                                                            \\<close>\n      necessary_updates = filter (\\<lambda>(r, u). u \\<noteq> V (R r)) u\n    in\n    t\\<lparr>Updates := (filter (\\<lambda>(r, _). r \\<notin> set (map fst u)) (Updates t))@necessary_updates\\<rparr>\n  )\"\n\nfun add_groupwise_updates_trace :: \"trace  \\<Rightarrow> (tids \\<times> update_function list) list \\<Rightarrow> iEFSM \\<Rightarrow> cfstate \\<Rightarrow> registers \\<Rightarrow> iEFSM\" where\n  \"add_groupwise_updates_trace [] _ e _ _ = e\" |\n  \"add_groupwise_updates_trace ((l, i, _)#trace) funs e s r = (\n    let\n      (id, s', t) = fthe_elem (i_possible_steps e s r l i);\n      updated = evaluate_updates t i r;\n      newUpdates = List.maps snd (filter (\\<lambda>(tids, _). set id \\<subseteq> set tids) funs);\n      t' = insert_updates t newUpdates;\n      updated' = apply_updates (Updates t') (join_ir i r) r;\n      necessaryUpdates = filter (\\<lambda>(r, _). updated $ r \\<noteq> updated' $ r) newUpdates;\n      t'' = insert_updates t necessaryUpdates;\n      e' = replace_transition e id t''\n    in\n    add_groupwise_updates_trace trace funs e' s' updated'\n  )\"\n\nprimrec add_groupwise_updates :: \"log  \\<Rightarrow> (tids \\<times> update_function list) list \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM\" where\n  \"add_groupwise_updates [] _ e = e\" |\n  \"add_groupwise_updates (h#t) funs e = add_groupwise_updates t funs (add_groupwise_updates_trace h funs e 0 <>)\"\n\nlemma fold_add_groupwise_updates [code]:\n  \"add_groupwise_updates log funs e = fold (\\<lambda>trace acc. add_groupwise_updates_trace trace funs acc 0 <>) log e\"\n  by (induct log arbitrary: e, auto)\n\n\\<comment> \\<open>This will be replaced to calls to Z3 in the executable\\<close>\ndefinition get_regs :: \"(vname \\<Rightarrow>f String.literal) \\<Rightarrow> inputs \\<Rightarrow> vname aexp \\<Rightarrow> value \\<Rightarrow> registers\" where\n  \"get_regs types inputs expression output = Eps (\\<lambda>r. aval expression (join_ir inputs r) = Some output)\"\n\ndeclare get_regs_def [code del]\ncode_printing constant get_regs \\<rightharpoonup> (Scala) \"Dirties.getRegs\"\n\ntype_synonym action_info = \"(cfstate \\<times> registers \\<times> registers \\<times> inputs \\<times> tids \\<times> transition)\"\ntype_synonym run_info = \"action_info list\"\ntype_synonym targeted_run_info = \"(registers \\<times> action_info) list\"\n\nfun everything_walk :: \"output_function \\<Rightarrow> nat \\<Rightarrow> (vname \\<Rightarrow>f String.literal) \\<Rightarrow> trace \\<Rightarrow> iEFSM \\<Rightarrow> cfstate \\<Rightarrow> registers \\<Rightarrow> transition_group \\<Rightarrow> run_info\" where\n  \"everything_walk _ _ _ [] _ _ _ _ = []\" |\n  \"everything_walk f fi types ((label, inputs, outputs)#t) oPTA s regs gp  = (\n    let (tid, s', ta) = fthe_elem (i_possible_steps oPTA s regs label inputs) in\n     \\<comment> \\<open>Possible steps with a transition we need to modify\\<close>\n    if \\<exists>(tid', _) \\<in> set gp. tid = tid' then\n      (s, regs, get_regs types inputs f (outputs!fi), inputs, tid, ta)#(everything_walk f fi types t oPTA s' (evaluate_updates ta inputs regs) gp)\n    else\n      let empty = <> in\n      (s, regs, empty, inputs, tid, ta)#(everything_walk f fi types t oPTA s' (evaluate_updates ta inputs regs) gp)\n  )\"\n\ndefinition everything_walk_log :: \"output_function \\<Rightarrow> nat \\<Rightarrow> (vname \\<Rightarrow>f String.literal) \\<Rightarrow> log \\<Rightarrow> iEFSM \\<Rightarrow> transition_group \\<Rightarrow> run_info list\" where\n  \"everything_walk_log f fi types log e gp = map (\\<lambda>t. everything_walk f fi types t e 0 <> gp) log\"\n\nfun target :: \"registers \\<Rightarrow> run_info \\<Rightarrow> targeted_run_info\" where\n  \"target _ [] = []\" |\n  \"target tRegs ((s, oldregs, regs, inputs, tid, ta)#t) = (\n    let newTarget = if finfun_to_list regs = [] then tRegs else regs in\n    (tRegs, s, oldregs, regs, inputs, tid, ta)#target newTarget t\n  )\"\n\nfun target_tail :: \"registers \\<Rightarrow> run_info \\<Rightarrow> targeted_run_info \\<Rightarrow> targeted_run_info\" where\n  \"target_tail _ [] tt = rev tt\" |\n  \"target_tail tRegs ((s, oldregs, regs, inputs, tid, ta)#t) tt = (\n    let newTarget = if finfun_to_list regs = [] then tRegs else regs in\n    target_tail newTarget t ((tRegs, s, oldregs, regs, inputs, tid, ta)#tt)\n  )\"\n\nlemma target_tail: \"(rev bs)@(target tRegs ts) = target_tail tRegs ts bs\"\nproof(induct ts arbitrary: bs tRegs)\n  case (Cons a ts)\n  then show ?case\n    apply (cases a)\n    apply simp\n    apply standard\n    by (metis (no_types, lifting) append_eq_append_conv2 rev.simps(2) rev_append rev_swap self_append_conv2)+\nqed simp\n\ndefinition \"target_fold tRegs ts b = fst (fold (\\<lambda>(s, oldregs, regs, inputs, tid, ta) (acc, tRegs).\nlet newTarget = if finfun_to_list regs = [] then tRegs else regs in\n    (acc@[(tRegs, s, oldregs, regs, inputs, tid, ta)], newTarget)\n) ts (rev b, tRegs))\"\n\nlemma target_tail_fold: \"target_tail tRegs ts b = target_fold tRegs ts b\"\nproof(induct ts arbitrary: tRegs b)\n  case Nil\n  then show ?case\n    by (simp add: target_fold_def)\nnext\n  case (Cons a ts)\n  then show ?case\n    apply (cases a)\n    by (simp add: target_fold_def)\nqed\n\nlemma target_fold [code]: \"target tRegs ts = target_fold tRegs ts []\"\n  by (metis append_self_conv2 rev.simps(1) target_tail_fold target_tail)\n\n\\<comment> \\<open>This will be replaced by symbolic regression in the executable\\<close>\ndefinition get_update :: \"label \\<Rightarrow> nat \\<Rightarrow> value list \\<Rightarrow> (inputs \\<times> registers \\<times> registers) list \\<Rightarrow> vname aexp option\" where\n  \"get_update _ reg values train = (let\n    possible_funs = {a. \\<forall>(i, r, r') \\<in> set train. aval a (join_ir i r) = r' $ reg}\n    in\n    if possible_funs = {} then None else Some (Eps (\\<lambda>x. x \\<in> possible_funs))\n  )\"\n\ndeclare get_update_def [code del]\ncode_printing constant get_update \\<rightharpoonup> (Scala) \"Dirties.getUpdate\"\n\ndefinition get_updates_opt :: \"label \\<Rightarrow> value list \\<Rightarrow> (inputs \\<times> registers \\<times> registers) list \\<Rightarrow> (nat \\<times> vname aexp option) list\" where\n  \"get_updates_opt l values train = (let\n    updated_regs = fold List.union (map (finfun_to_list \\<circ> snd \\<circ> snd) train) [] in\n    map (\\<lambda>r.\n      let targetValues = remdups (map (\\<lambda>(_, _, regs). regs $ r) train) in\n      if  (\\<forall>(_, anteriorRegs, posteriorRegs) \\<in> set train. anteriorRegs $ r = posteriorRegs $ r) then\n        (r, Some (V (R r)))\n      else if length targetValues = 1 \\<and> (\\<forall>(inputs, anteriorRegs, _) \\<in> set train. finfun_to_list anteriorRegs = []) then\n        case hd targetValues of Some v \\<Rightarrow>\n        (r, Some (L v))\n      else\n        (r, get_update l r values train)\n    ) updated_regs\n  )\"\n\ndefinition finfun_add :: \"(('a::linorder) \\<Rightarrow>f 'b) \\<Rightarrow> ('a \\<Rightarrow>f 'b) \\<Rightarrow> ('a \\<Rightarrow>f 'b)\" where\n  \"finfun_add a b = fold (\\<lambda>k f. f(k $:= b $ k)) (finfun_to_list b) a\"\n\ndefinition group_update :: \"value list \\<Rightarrow> targeted_run_info \\<Rightarrow> (tids \\<times> (nat \\<times> vname aexp) list) option\" where\n  \"group_update values l = (\n    let\n      (_, (_, _, _, _, _, t)) = hd l;\n      targeted = filter (\\<lambda>(regs, _). finfun_to_list regs \\<noteq> []) l;\n      maybe_updates = get_updates_opt (Label t) values (map (\\<lambda>(tRegs, s, oldRegs, regs, inputs, tid, ta). (inputs, finfun_add oldRegs regs, tRegs)) targeted)\n    in\n    if \\<exists>(_, f_opt) \\<in> set maybe_updates. f_opt = None then\n      None\n    else\n      Some (fold List.union (map (\\<lambda>(tRegs, s, oldRegs, regs, inputs, tid, ta). tid) l) [], map (\\<lambda>(r, f_o). (r, the f_o)) maybe_updates)\n  )\"\n\nfun groupwise_put_updates :: \"transition_group list \\<Rightarrow> log \\<Rightarrow> value list \\<Rightarrow> run_info list \\<Rightarrow> (nat \\<times> (vname aexp \\<times> vname \\<Rightarrow>f String.literal)) \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM\" where\n  \"groupwise_put_updates [] _ _ _ _  e = e\" |\n  \"groupwise_put_updates (gp#gps) log values walked (o_inx, (op, types)) e = (\n    let\n      targeted = map (\\<lambda>x. filter (\\<lambda>(_, _, _, _, _, id, tran). (id, tran) \\<in> set gp) x) (map (\\<lambda>w. rev (target <> (rev w))) walked);\n      group = fold List.union targeted []\n    in\n    case group_update values group of\n      None \\<Rightarrow> groupwise_put_updates gps log values walked (o_inx, (op, types)) e |\n      Some u \\<Rightarrow> groupwise_put_updates gps log values walked (o_inx, (op, types)) (make_distinct (add_groupwise_updates log [u] e))\n  )\"\n\ndefinition updates_for_output :: \"log \\<Rightarrow> value list \\<Rightarrow> transition_group \\<Rightarrow> nat \\<Rightarrow> vname aexp \\<Rightarrow> vname \\<Rightarrow>f String.literal \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM\" where\n\"updates_for_output log values current o_inx op types e = (\n  if AExp.enumerate_regs op = {} then e\n  else\n    let\n      walked = everything_walk_log op o_inx types log e current;\n      groups = transition_groups e log\n    in\n    groupwise_put_updates groups log values walked (o_inx, (op, types)) e\n  )\"\n\ntype_synonym output_types = \"(vname aexp \\<times> vname \\<Rightarrow>f String.literal)\"\n\nfun put_updates :: \"log \\<Rightarrow> value list \\<Rightarrow> transition_group \\<Rightarrow> (nat \\<times> output_types option) list \\<Rightarrow> iEFSM \\<Rightarrow> iEFSM\" where\n  \"put_updates _ _ _ [] e = e\" |\n  \"put_updates log values gp ((_, None)#ops) e = put_updates log values gp ops e\" |\n  \"put_updates log values gp ((o_inx, Some (op, types))#ops) e = (\n    let\n      gp' = map (\\<lambda>(id, t). (id, t\\<lparr>Outputs := list_update (Outputs t) o_inx op\\<rparr>)) gp;\n      generalised_model = fold (\\<lambda>(id, t) acc. replace_transition acc id t) gp' e;\n      e' = updates_for_output log values gp o_inx op types generalised_model\n    in\n    if accepts_log (set log) (tm e') then\n     put_updates log values gp' ops e'\n    else\n     put_updates log values gp ops e\n  )\"\n\nfun unzip_3 :: \"('a \\<times> 'b \\<times> 'c) list \\<Rightarrow> ('a list \\<times> 'b list \\<times> 'c list)\" where\n  \"unzip_3 [] = ([], [], [])\" |\n  \"unzip_3 ((a, b, c)#l) = (\n    let (as, bs, cs) = unzip_3 l in\n    (a#as, b#bs, c#cs)\n  )\"\n\nlemma unzip_3: \"unzip_3 l = (map fst l, map (fst \\<circ> snd) l, map (snd \\<circ> snd) l)\"\n  by (induct l, auto)\n\nfun unzip_3_tailrec_rev :: \"('a \\<times> 'b \\<times> 'c) list \\<Rightarrow> ('a list \\<times> 'b list \\<times> 'c list) \\<Rightarrow> ('a list \\<times> 'b list \\<times> 'c list)\" where\n  \"unzip_3_tailrec_rev [] (as, bs, cs) = (as, bs, cs)\" |\n  \"unzip_3_tailrec_rev ((a, b, c)#t) (as, bs, cs) = unzip_3_tailrec_rev t (a#as, b#bs, c#cs)\"\n\nlemma unzip_3_tailrec_rev: \"unzip_3_tailrec_rev l (as, bs, cs) = ((map_tailrec_rev fst l as), (map_tailrec_rev (fst \\<circ> snd) l bs), (map_tailrec_rev (snd \\<circ> snd) l cs))\"\n  by (induct l arbitrary: as bs cs, auto)\n\ndefinition \"unzip_3_tailrec l = (let (as, bs, cs) = unzip_3_tailrec_rev l ([],[],[]) in (rev as, rev bs, rev cs))\"\n\nlemma unzip_3_tailrec [code]: \"unzip_3 l = unzip_3_tailrec l\"\n  apply (simp only: unzip_3_tailrec_def unzip_3_tailrec_rev)\n  by (simp add: Let_def map_tailrec_rev unzip_3 map_eq_map_tailrec)\n\ntext\\<open>We want to return an aexp which, when evaluated in the correct context accounts for the literal\ninput-output pairs within the training set. This will be replaced by symbolic regression in the\nexecutable\\<close>\ndefinition get_output :: \"label \\<Rightarrow> nat \\<Rightarrow> value list \\<Rightarrow> (inputs \\<times> registers \\<times> value) list \\<Rightarrow> (vname aexp \\<times> (vname \\<Rightarrow>f String.literal)) option\" where\n  \"get_output _ maxReg values train = (let\n    possible_funs = {a. \\<forall>(i, r, p) \\<in> set train. aval a (join_ir i r) = Some p}\n    in\n    if possible_funs = {} then None else Some (Eps (\\<lambda>x. x \\<in> possible_funs), (K$ STR ''int''))\n  )\"\ndeclare get_output_def [code del]\ncode_printing constant get_output \\<rightharpoonup> (Scala) \"Dirties.getOutput\"\n\ndefinition get_outputs :: \"label \\<Rightarrow> nat \\<Rightarrow> value list \\<Rightarrow> inputs list \\<Rightarrow> registers list \\<Rightarrow> value list list \\<Rightarrow> (vname aexp \\<times> (vname \\<Rightarrow>f String.literal)) option list\" where\n  \"get_outputs l maxReg values I r outputs = map_tailrec (\\<lambda>(maxReg, ps). get_output l maxReg values (zip I (zip r ps))) (enumerate maxReg (transpose outputs))\"\n\ndefinition enumerate_exec_values :: \"trace \\<Rightarrow> value list\" where\n  \"enumerate_exec_values vs = fold (\\<lambda>(_, i, p) I. List.union (List.union i p) I) vs []\"\n\ndefinition enumerate_log_values :: \"log \\<Rightarrow> value list\" where\n  \"enumerate_log_values l = fold (\\<lambda>e I. List.union (enumerate_exec_values e) I) l []\"\n\n(*This is where the types stuff originates*)\ndefinition generalise_and_update :: \"log \\<Rightarrow> iEFSM \\<Rightarrow> transition_group \\<Rightarrow> iEFSM\" where\n  \"generalise_and_update log e gp = (\n    let\n      label = Label (snd (hd gp));\n      values = enumerate_log_values log;\n      new_gp_ts = make_training_set e log gp;\n      (I, R, P) = unzip_3 new_gp_ts;\n      max_reg = max_reg_total e;\n      outputs = get_outputs label max_reg values I R P\n    in\n      put_updates log values gp (enumerate 0 outputs) e\n  )\"\n\ntext \\<open>Splitting structural groups up into subgroups by previous transition can cause different\nsubgroups to get different updates. We ideally want structural groups to have the same output and\nupdate functions, as structural groups are likely to be instances of the same underlying behaviour.\\<close>\ndefinition standardise_group :: \"iEFSM \\<Rightarrow> log \\<Rightarrow> transition_group \\<Rightarrow> (iEFSM \\<Rightarrow> log \\<Rightarrow> transition_group \\<Rightarrow> transition_group) \\<Rightarrow> iEFSM\" where\n  \"standardise_group e l gp s = (\n    let\n      standardised = s e l gp;\n      e' = replace_transitions e standardised\n    in\n      if e' = e then e else\n      if accepts_log (set l) (tm e') then e' else e\n)\"\n\nprimrec find_outputs :: \"output_function list list \\<Rightarrow> iEFSM \\<Rightarrow> log \\<Rightarrow> transition_group \\<Rightarrow> output_function list option\" where\n  \"find_outputs [] _ _ _ = None\" |\n  \"find_outputs (h#t) e l g = (\n    let\n      outputs = fold (\\<lambda>(tids, t) acc. replace_transition acc tids (t\\<lparr>Outputs := h\\<rparr>)) g e\n    in\n      if accepts_log (set l) (tm outputs) then\n        Some h\n      else\n        find_outputs t e l g\n  )\"\n\nprimrec find_updates_outputs :: \"update_function list list \\<Rightarrow> output_function list list \\<Rightarrow> iEFSM \\<Rightarrow> log \\<Rightarrow> transition_group \\<Rightarrow> (output_function list \\<times> update_function list) option\" where\n  \"find_updates_outputs [] _ _ _ _ = None\" |\n  \"find_updates_outputs (h#t) p e l g = (\n    let\n      updates = fold (\\<lambda>(tids, t) acc. replace_transition acc tids (t\\<lparr>Updates := h\\<rparr>)) g e\n    in\n      case find_outputs p updates l (map (\\<lambda>(id, t). (id,t\\<lparr>Updates := h\\<rparr>))  g) of\n        Some pp \\<Rightarrow> Some (pp, h) |\n        None \\<Rightarrow> find_updates_outputs t p e l g\n  )\"\n\ndefinition updates_for :: \"update_function list \\<Rightarrow> update_function list list\" where\n  \"updates_for U = (\n    let uf = fold (\\<lambda>(r, u) f. f(r $:= u#(f $ r))) U (K$ []) in\n    map (\\<lambda>r. map (\\<lambda>u. (r, u)) (uf $ r)) (finfun_to_list uf)\n  )\"\n\ndefinition standardise_group_outputs_updates :: \"iEFSM \\<Rightarrow> log \\<Rightarrow> transition_group \\<Rightarrow> transition_group\" where\n  \"standardise_group_outputs_updates e l g = (\n    let\n      update_groups = product_lists (updates_for (remdups (List.maps (Updates \\<circ> snd) g)));\n      update_groups_subs = fold (List.union \\<circ> subseqs) update_groups [];\n      output_groups = product_lists (transpose (remdups (map (Outputs \\<circ> snd) g)))\n    in\n    case find_updates_outputs update_groups_subs output_groups e l g of\n      None \\<Rightarrow> g |\n      Some (p, u) \\<Rightarrow> map (\\<lambda>(id, t). (id, t\\<lparr>Outputs := p, Updates := u\\<rparr>)) g\n  )\"\n\nfun find_first_use_of_trace :: \"nat \\<Rightarrow> trace \\<Rightarrow> iEFSM \\<Rightarrow> cfstate \\<Rightarrow> registers \\<Rightarrow> tids option\" where\n  \"find_first_use_of_trace _ [] _ _ _ = None\" |\n  \"find_first_use_of_trace rr ((l, i, _)#es) e s r = (\n    let\n      (id, s', t) = fthe_elem (i_possible_steps e s r l i)\n    in\n      if (\\<exists>p \\<in> set (Outputs t). aexp_constrains p (V (R rr))) then\n        Some id\n      else\n        find_first_use_of_trace rr es e s' (evaluate_updates t i r)\n  )\"\n\ndefinition find_first_uses_of :: \"nat \\<Rightarrow> log \\<Rightarrow> iEFSM \\<Rightarrow> tids list\" where\n  \"find_first_uses_of r l e = List.maps (\\<lambda>x. case x of None \\<Rightarrow> [] | Some x \\<Rightarrow> [x]) (map (\\<lambda>t. find_first_use_of_trace r t e 0 <>) l)\"\n\nfun find_initialisation_of_trace :: \"nat \\<Rightarrow> trace \\<Rightarrow> iEFSM \\<Rightarrow> cfstate \\<Rightarrow> registers \\<Rightarrow> (tids \\<times> transition) option\" where\n  \"find_initialisation_of_trace _ [] _ _ _ = None\" |\n  \"find_initialisation_of_trace r' ((l, i, _)#es) e s r = (\n    let\n      (tids, s', t) = fthe_elem (i_possible_steps e s r l i)\n    in\n    if (\\<exists>(rr, u) \\<in> set (Updates t). rr = r' \\<and> is_lit u) then\n      Some (tids, t)\n    else\n      find_initialisation_of_trace r' es e s' (evaluate_updates t i r)\n  )\"\n\nprimrec find_initialisation_of :: \"nat \\<Rightarrow> iEFSM \\<Rightarrow> log \\<Rightarrow> (tids \\<times> transition) option list\" where\n  \"find_initialisation_of _ _ [] = []\" |\n  \"find_initialisation_of r e (h#t) = (\n    case find_initialisation_of_trace r h e 0 <> of\n      None \\<Rightarrow> find_initialisation_of r e t |\n      Some thing \\<Rightarrow> Some thing#(find_initialisation_of r e t)\n  )\"\n\ndefinition delay_initialisation_of :: \"nat \\<Rightarrow> log \\<Rightarrow> iEFSM \\<Rightarrow> tids list \\<Rightarrow> iEFSM\" where\n  \"delay_initialisation_of r l e tids = fold (\\<lambda>x e. case x of\n      None \\<Rightarrow> e |\n    Some (i_tids, t) \\<Rightarrow>\n      let\n        origins = map (\\<lambda>id. origin id e) tids;\n        init_val = snd (hd (filter (\\<lambda>(r', _). r = r') (Updates t)));\n        e' = fimage (\\<lambda>(id, (origin', dest), tr).\n        \\<comment> \\<open>Add the initialisation update to incoming transitions\\<close>\n        if dest \\<in> set origins then\n          (id, (origin', dest), tr\\<lparr>Updates := List.insert (r, init_val) (Updates tr)\\<rparr>)\n        \\<comment> \\<open>Strip the initialisation update from the original initialising transition\\<close>\n        else if id = i_tids then\n          (id, (origin', dest), tr\\<lparr>Updates := filter (\\<lambda>(r', _). r \\<noteq> r') (Updates tr)\\<rparr>)\n        else\n          (id, (origin', dest), tr)\n      ) e\n      in\n      \\<comment> \\<open>We don't want to update a register twice so just leave it\\<close>\n      if accepts_log (set l) (tm e') then\n        e'\n      else\n        e\n  ) (find_initialisation_of r e l) e\"\n\nfun groupwise_generalise_and_update :: \"log \\<Rightarrow> iEFSM \\<Rightarrow> transition_group list \\<Rightarrow> iEFSM\" where\n  \"groupwise_generalise_and_update _ e [] = e\" |\n  \"groupwise_generalise_and_update log e (gp#t) = (\n        let\n          e' = generalise_and_update log e gp;\n          rep = snd (hd (gp));\n          structural_group = fimage (\\<lambda>(i, _, t). (i, t)) (ffilter (\\<lambda>(_, _, t). same_structure rep t) e');\n          delayed = fold (\\<lambda>r acc. delay_initialisation_of r log acc (find_first_uses_of r log acc)) (sorted_list_of_set (all_regs e')) e';\n          standardised = standardise_group delayed log (sorted_list_of_fset structural_group) standardise_group_outputs_updates;\n          structural_group2 = fimage (\\<lambda>(_, _, t). (Outputs t, Updates t)) (ffilter (\\<lambda>(_, _, t).  Label rep = Label t \\<and> Arity rep = Arity t \\<and> length (Outputs rep) = length (Outputs t)) standardised)\n        in\n        \\<comment> \\<open>If we manage to standardise a structural group, we do not need to evolve outputs and\n            updates for the other historical subgroups so can filter them out.\\<close>\n        if fis_singleton structural_group2 then\n          groupwise_generalise_and_update log (merge_regs standardised (accepts_log (set log))) (filter (\\<lambda>g. set g \\<inter> fset structural_group = {}) t)\n        else\n          groupwise_generalise_and_update log (merge_regs standardised (accepts_log (set log))) t\n  )\"\n\ndefinition drop_all_guards :: \"iEFSM \\<Rightarrow> iEFSM \\<Rightarrow> log \\<Rightarrow> update_modifier \\<Rightarrow> (iEFSM \\<Rightarrow> nondeterministic_pair fset) \\<Rightarrow> iEFSM\" where\n\"drop_all_guards e pta log m np = (let\n      derestricted = fimage (\\<lambda>(id, tf, tran). (id, tf, tran\\<lparr>Guards := []\\<rparr>)) e;\n      nondeterministic_pairs = sorted_list_of_fset (np derestricted)\n    in\n    case resolve_nondeterminism {} nondeterministic_pairs pta derestricted m (accepts_log (set log)) np of\n      (None, _) \\<Rightarrow> pta |\n      (Some resolved, _) \\<Rightarrow> resolved\n  )\"\n\ndefinition updated_regs :: \"transition \\<Rightarrow> nat set\" where\n  \"updated_regs t = set (map fst (Updates t))\"\n\ndefinition fewer_updates :: \"transition \\<Rightarrow> transition fset \\<Rightarrow> transition option\" where\n  \"fewer_updates t tt = (\n    let p = ffilter (\\<lambda>t'. same_structure t t' \\<and> Outputs t = Outputs t' \\<and> updated_regs t' \\<subset> updated_regs t) tt in\n    if p = {||} then None else Some (snd (fMin (fimage (\\<lambda>t. (length (Updates t), t)) p))))\"\n\nfun remove_spurious_updates_aux :: \"iEFSM \\<Rightarrow> transition_group \\<Rightarrow> transition fset \\<Rightarrow> log \\<Rightarrow> iEFSM\" where\n  \"remove_spurious_updates_aux e [] _ _ = e\" |\n  \"remove_spurious_updates_aux e ((tid, t)#ts) tt l = (\n    case fewer_updates t tt of\n      None \\<Rightarrow> remove_spurious_updates_aux e ts tt l |\n      Some t' \\<Rightarrow> (\n        let e' = replace_transition e tid t' in\n        if accepts_log (set l) (tm e') then\n          remove_spurious_updates_aux e' ts tt l\n        else\n          remove_spurious_updates_aux e ts tt l\n      )\n  )\"\n\n(* This goes through and tries to remove spurious updates that get introduced during preprocessing *)\ndefinition remove_spurious_updates :: \"iEFSM \\<Rightarrow> log \\<Rightarrow> iEFSM\" where\n  \"remove_spurious_updates e l = (\n    let transitions = fimage (\\<lambda>(tid, _, t). (tid, t)) e in\n      remove_spurious_updates_aux e (sorted_list_of_fset transitions) (fimage snd transitions) l\n  )\"\n\ndefinition derestrict :: \"iEFSM \\<Rightarrow> log \\<Rightarrow> update_modifier \\<Rightarrow> (iEFSM \\<Rightarrow> nondeterministic_pair fset) \\<Rightarrow> iEFSM\" where\n  \"derestrict pta log m np = (\n    let\n      normalised = groupwise_generalise_and_update log pta (transition_groups pta log)\n    in\n      drop_all_guards normalised pta log m np\n  )\"\n\ndefinition \"drop_pta_guards pta log m np = drop_all_guards pta pta log m np\"\n\nend\n", "meta": {"author": "logicalhacking", "repo": "Extended_Finite_State_Machine_Inference", "sha": "d5c6f8533a2c43c00bcea5c2cc18ad6abf150a37", "save_path": "github-repos/isabelle/logicalhacking-Extended_Finite_State_Machine_Inference", "path": "github-repos/isabelle/logicalhacking-Extended_Finite_State_Machine_Inference/Extended_Finite_State_Machine_Inference-d5c6f8533a2c43c00bcea5c2cc18ad6abf150a37/Extended_Finite_State_Machine_Inference/heuristics/PTA_Generalisation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.629774621301746, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.3247243371601003}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(* Instance of bit ops for nat.\n   Lemmas about this instance should also go here. *)\ntheory NatBitwise\nimports\n  Word_Lib.WordSetup\nbegin\n\ninstantiation nat :: lsb\nbegin\n\ndefinition\n  \"lsb x = lsb (int x)\"\n\ninstance\n  by intro_classes (meson even_of_nat lsb_nat_def lsb_odd)\n\nend\n\ninstantiation nat :: msb\nbegin\n\ndefinition\n  \"msb x = msb (int x)\"\n\ninstance ..\n\nend\n\ninstantiation nat :: set_bit\nbegin\n\ndefinition\n  \"set_bit x y z = nat (set_bit (int x) y z)\"\n\ninstance\n  by intro_classes\n     (metis (mono_tags) set_bit_nat_def bin_nth_sc_gen bin_sc_pos\n                        bit_nat_iff exp_eq_0_imp_not_bit int_eq_iff)\nend\n\nlemma nat_2p_eq_shiftl:\n  \"(2::nat)^x = 1 << x\"\n  by simp\n\nlemmas shiftl_nat_alt_def = shiftl_nat_def\n\nlemma nat_int_mul:\n  \"nat (int a * b) = a * nat b\"\n  by (simp add: nat_mult_distrib)\n\nlemma shiftl_nat_def:\n  \"(x::nat) << y = nat (int x << y)\"\n  by (simp add: nat_int_mul push_bit_eq_mult shiftl_def)\n\nlemma int_shiftl_less_cancel:\n  \"n \\<le> m \\<Longrightarrow> ((x :: int) << n < y << m) = (x < y << (m - n))\"\n  apply (drule le_Suc_ex)\n  apply (clarsimp simp: shiftl_int_def power_add)\n  done\n\nlemma nat_shiftl_less_cancel:\n  \"n \\<le> m \\<Longrightarrow> ((x :: nat) << n < y << m) = (x < y << (m - n))\"\n  apply (simp add: nat_int_comparison(2) shiftl_nat_def shiftl_def)\n  by (metis int_shiftl_less_cancel shiftl_def)\n\n\nlemma nat_shiftl_lt_2p_bits:\n  \"(x::nat) < 1 << n \\<Longrightarrow> \\<forall>i \\<ge> n. \\<not> x !! i\"\n  apply (clarsimp simp: shiftl_nat_def zless_nat_eq_int_zless\n                  dest!: le_Suc_ex)\n  by (metis bit_take_bit_iff not_add_less1 take_bit_nat_eq_self_iff)\n\nlemmas nat_eq_test_bit = bit_eq_iff\nlemmas nat_eq_test_bitI = bit_eq_iff[THEN iffD2, rule_format]\n\nlemma int_2p_eq_shiftl:\n  \"(2::int)^x = 1 << x\"\n  by (simp add: shiftl_int_def)\n\nlemma int_shiftl_lt_2p_bits:\n  \"0 \\<le> (x::int) \\<Longrightarrow> x < 1 << n \\<Longrightarrow> \\<forall>i \\<ge> n. \\<not> x !! i\"\n  apply (clarsimp simp: shiftl_int_def)\n  by (metis bit_take_bit_iff not_less take_bit_int_eq_self_iff)\n\\<comment> \\<open>TODO: The converse should be true as well, but seems hard to prove.\\<close>\n\nlemmas int_eq_test_bitI = bin_eq_iff[THEN iffD2, rule_format]\n\nend", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/NatBitwise.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3247243299943589}}
{"text": "theory T_Proofs\n  imports T_Specification \"Punc_Proofs\"\nbegin\n\nlemma q_geq_1[simp]: \"q \\<ge> 1\"\n  unfolding q_def using qG_geq_1 qH_geq_1 by auto\n\nlemma weight_paramsT[simp]: \"weight paramsT = 1\"\n  unfolding paramsT_def by simp\n\nlemma paramsT_nonzero[simp]: \"paramsT \\<noteq> 0\"\n  using weight_paramsT by force\n\nlemma nonempty_msg_spaceT[simp]: \"msg_spaceT G \\<noteq> {}\"\n  unfolding msg_spaceT_def by simp\n\nlemma weight_encT[simp]: \"weight (encT G pk m) = 1\"\n  unfolding encT_def by simp\n\nlemma supp_encT[simp]: \"supp (encT G pk m) = {encrT G pk m}\"\n  unfolding encT_def by simp\n\nlemma force_msg_space_element[simp]: \"force_into (msg_space ()) msg_space_element = msg_space_element\"\n  apply (rule force_into_good) by simp\n\nlemma program1[simplified,simp]: \n  \"map_distr fst (map_distr (\\<lambda>(G::msg\\<Rightarrow>rand, r). (G(mstar2 := r), G, r)) (uniform UNIV)) = uniform UNIV\"\nproof -\n  have reg: \"card ((\\<lambda>x. (fst x)(mstar2 := snd x)) -` {G}) = CARD(rand)\" (is \"card ?S = _\") for G::\"msg\\<Rightarrow>rand\"\n  proof -\n    define f f' where\n      \"f r = (G(mstar2:=r),G mstar2)\" and \"f' Gr = fst Gr mstar2\"   \n    for Gr::\"(msg\\<Rightarrow>rand)*rand\" and r\n    have inj_f': \"inj_on f' ?S\"\n      apply (rule inj_onI)\n      apply (auto simp: f'_def)\n      apply (metis array_rules(5) fun_upd_triv)\n      by (metis array_rules(3))\n    have inj_f: \"inj f\"\n      apply (rule injI)\n      apply (auto simp: f_def)\n      by (metis array_rules(3))\n    show ?thesis\n      using inj_f' _ inj_f apply (rule card_bij_eq[of f' _ _ f])\n      by (auto simp: f_def)\n  qed\n  have surj: \"surj (\\<lambda>x. (fst x::msg\\<Rightarrow>rand)(mstar2 := snd x))\"\n    apply (rule surjI[where f=\"\\<lambda>G. (G,G mstar2)\"]) by auto\n  have \"regular_betw (\\<lambda>x. (fst x::msg\\<Rightarrow>rand)(mstar2 := snd x)) UNIV UNIV\"\n    apply (rule regular_betwI[where n=\"CARD(rand)\"])\n    using surj reg by auto\n  then have \"map_distr (\\<lambda>x. (fst x::msg\\<Rightarrow>rand)(mstar2 := snd x)) (uniform UNIV) = uniform UNIV\"\n    by (rule map_distr_uniform_regular)\n  then show ?thesis\n    by (simp add: case_prod_beta)\nqed\n\nlemma program2[simplified,simp]: \"map_distr snd (map_distr (\\<lambda>(G, r). (G(mstar2 := r), G, r)) (uniform UNIV)) = bind_distr (uniform UNIV) (\\<lambda>z. map_distr (Pair z) (uniform UNIV))\"\n  by (simp add: case_prod_beta)\n\ndefinition \"o2h_distr0 =\n  bind_distr (uniform UNIV) (\\<lambda>z. \n  map_distr (Pair z) (bind_distr (keygen ()) (\\<lambda>za. \n  map_distr (Pair za) (bind_distr (uniform (msg_space ())) (\\<lambda>zb. \n  map_distr (Pair zb) (map_distr (\\<lambda>d. \n  (d, z(zb := d), (fst za, encr () (fst za) zb d), {zb})) (uniform UNIV)))))))\"\n\nlemma weight_bind_distr[simp]: \n  assumes \"(weight \\<mu> = 1 \\<and> (\\<forall>x\\<in>supp \\<mu>. weight (f x) = 1))\"\n  shows \"weight (bind_distr \\<mu> f) = 1\"\nproof (rule local_defE[of \"bind_distr \\<mu> f\"], rename_tac B, insert assms, transfer)\n  fix \\<mu> :: \"'a \\<Rightarrow> real\" and f :: \"'a \\<Rightarrow> 'b \\<Rightarrow> real\"\n  assume \\<mu>: \"is_distribution \\<mu>\"\n  then have \\<mu>pos: \"\\<mu> x \\<ge> 0\" for x by (simp add: is_distribution_def)\n  assume f: \"pred_fun \\<top> is_distribution f\"\n  then have sumf: \"sum (f x) M \\<le> 1\" if \"finite M\" for x M using that apply auto\n    by (meson abs_summable_on_finite is_distribution_def order_trans_rules(23) sum_leq_infsetsum top_greatest)\n  assume 3: \"infsetsum \\<mu> UNIV = 1 \\<and> (\\<forall>x\\<in>{x. 0 < \\<mu> x}. infsetsum (f x) UNIV = 1)\"\n  then have weight\\<mu>: \"infsetsum \\<mu> UNIV = 1\"  by simp\n  from \\<mu> \\<mu>pos have weightfx: \"\\<mu> x \\<noteq> 0 \\<Longrightarrow> infsetsum (f x) UNIV = 1\" for x\n    using 3 less_eq_real_def by auto\n  fix B assume B_def: \"B = (\\<lambda>x. \\<Sum>\\<^sub>ay. \\<mu> y * f y x)\"\n  assume B: \"is_distribution B\"\n    (* assume 4: \"(\\<forall>x. 0 \\<le> (\\<Sum>\\<^sub>ay. \\<mu> y * f y x)) \\<and> (\\<forall>M. finite M \\<longrightarrow> (\\<Sum>x\\<in>M. \\<Sum>\\<^sub>ay. \\<mu> y * f y x) \\<le> 1)\" *)\n  have \\<mu>sum: \"\\<mu> abs_summable_on UNIV\"\n    using not_summable_infsetsum_eq weight\\<mu> by fastforce\n\n  have fleq1: \"f x y \\<le> 1\" for x y\n    using sumf[where M=\"{y}\"] by simp\n\n  have sum1: \"(\\<lambda>x. \\<mu> x * f x y) abs_summable_on UNIV\" for y\n    using \\<mu>sum apply (rule abs_summable_on_comparison_test'[where g=\\<mu>])\n    by (simp add: f[simplified, unfolded is_distribution_def] \\<mu>pos fleq1 mult_left_le)\n  have \"(\\<lambda>y. \\<Sum>\\<^sub>ax. \\<mu> x * f x y) abs_summable_on UNIV\"\n    using B unfolding B_def is_distribution_def by (simp add: distr_abs_summable_on)\n  then have sum2: \"(\\<lambda>y. \\<Sum>\\<^sub>ax. abs (\\<mu> x * f x y)) abs_summable_on UNIV\"\n    using f \\<mu>pos by (auto simp: is_distribution_def)\n  have summable: \"(\\<lambda>(y, x). \\<mu> x * f x y) abs_summable_on UNIV \\<times> UNIV\"\n    apply (rule abs_summable_product')\n    by (simp_all add: sum1 sum2)\n\n  have \"(\\<Sum>\\<^sub>ay. \\<Sum>\\<^sub>ax. \\<mu> x * f x y) = (\\<Sum>\\<^sub>ax. \\<Sum>\\<^sub>ay. \\<mu> x * f x y)\"\n    using summable by (rule infsetsum_swap)\n  also have \"\\<dots> = (\\<Sum>\\<^sub>ax. \\<mu> x * (\\<Sum>\\<^sub>ay. f x y))\"\n    apply (subst infsetsum_cmult_right; simp)\n    using not_summable_infsetsum_eq weightfx by force\n  also have \"\\<dots> = (\\<Sum>\\<^sub>ax. \\<mu> x * 1)\"\n    by (rule infsetsum_cong; auto intro!: weightfx)\n  also have \"\\<dots> = 1\"\n    using weight\\<mu> by simp\n  finally show \"(\\<Sum>\\<^sub>ax. \\<Sum>\\<^sub>ay. \\<mu> y * f y x) = 1\" .\nqed\n\nlemmas o2h_distr0_def_sym = o2h_distr0_def[symmetric, simplified]\n\ndefinition o2h_distr :: \"(msg set \\<times> (msg \\<Rightarrow> rand) \\<times> (msg \\<Rightarrow> rand) \\<times> pk \\<times> ciph) distr\" where\n  \"o2h_distr = map_distr (\\<lambda>(G,(pk,sk),mstar,rstar,H,z,S). (S,G,H,z)) o2h_distr0\"\n\nlemma weight_o2h_distr[simp]: \"weight o2h_distr = 1\"\n  unfolding o2h_distr_def o2h_distr0_def keygen_def by simp\n\nlemmas case_prod_beta_abs_def = case_prod_beta[abs_def]\n\nlemma o2h_distr_oradiff:\n  assumes \"(S, G, H, z) \\<in> supp o2h_distr\"\n  assumes \"x \\<notin> S\"\n  shows \"G x = H x\"\n  using assms unfolding o2h_distr_def o2h_distr0_def\n  by (auto simp add: Let_def)\n\ndefinition game2_distr :: \"((msg=>rand) * (pk * sk) * msg * rand) distr\" where\n  \"game2_distr = product_distr (uniform UNIV) (product_distr (keygen ()) (uniform (msg_space () \\<times> UNIV)))\"\n\nlemmas game2_distr_def_sym = game2_distr_def[symmetric]\n\n(* lemma game2_o2h_right_unsquashed_aux:\n\"(\\<lambda>a. if a = mstar2 then rstar1 else G1 a) \\<noteq> (\\<lambda>a. if a = mstar2 then rstar2 else G2 a) \\<longrightarrow> classA1 = classA2 \\<longrightarrow> pk1 = tmp_pk2 \\<longrightarrow> mstar1 = mstar2 \\<longrightarrow> rstar1 = rstar2 \\<longrightarrow> b1 = b2 \\<longrightarrow> G1 = G2 \\<longrightarrow> \\<lbrakk>quantA1, Gin1, Gout1\\<rbrakk> \\<equiv>\\<qq> \\<lbrakk>quantA2, Gin2, Gout2\\<rbrakk> \\<le> \\<bottom>\"\n  by auto *)\n\ndefinition game2_witness :: \"(\n  ((msg=>rand) * (pk * sk) * msg * rand) *\n  (msg set \\<times> (msg \\<Rightarrow> rand) \\<times> (msg \\<Rightarrow> rand) \\<times> pk \\<times> ciph)\n) distr\" where\n  \"game2_witness = map_distr (\\<lambda>(G, m, r, (pk,sk)).\n\n    let S = {m}; c = encr () pk m r; H = G(m:=r); z = (pk,c) in\n    ((G,(pk,sk),m,r),(S,G,H,z)))\n\n  (product_distr (uniform UNIV)             \\<comment> \\<open>G\\<close>\n  (product_distr (uniform (msg_space ()))   \\<comment> \\<open>m\\<close>\n  (product_distr (uniform UNIV)             \\<comment> \\<open>r\\<close>\n                 (keygen ()))))             \\<comment> \\<open>(pk,sk)\\<close>\n\"\n\nlemma game2_witness_supp: \"supp game2_witness \\<subseteq> {((G1,(pk1,sk1),mstar1,rstar1), (S2,G2,H2,z2)).\n      G1(mstar1:=rstar1) = H2 \\<and> pk1=fst z2 \\<and> encr () pk1 mstar1 rstar1 = snd z2}\" \n  unfolding game2_witness_def\n  by auto\n\nlemma leq_INFv[simp]:\n  fixes V :: \"'a \\<Rightarrow> 'b subspace\"\n  shows \"(A \\<le> (INF x\\<in>M. V x)) = (\\<forall>x\\<in>M. A \\<le> V x)\"\n  by (simp add: le_Inf_iff)\n\nlemma triangle: \"abs(a-b) \\<le> (x::real) \\<Longrightarrow> abs(b-c) \\<le> y \\<Longrightarrow> abs(c-a) \\<le> x+y\"\n  by simp\n\nlemma abs_leq: \"p5 \\<le> x \\<Longrightarrow> abs(p4-p5) \\<le> y \\<Longrightarrow> p4 \\<le> y + x\" for x::real\n  by simp\n\nlemma combine_bounds: (* ds_encT_real = game1, game1=game2, ds_encT_fake=game0 *)\n  assumes \"Q\\<ge>0\"\n  assumes g45: \"abs(game4 - game5) \\<le> abs(indcpa_enc_0 - indcpa_enc_1)\"\n  assumes g5: \"game5 <= R\"\n  assumes g3r: \"abs ( game3 - ds_encT_real ) <= 2 * sqrt( Q * game4 )\"\n  assumes fg3: \"abs(ds_encT_fake - game3) \\<le> abs(ds_enc_real - ds_enc_fake)\"\n  shows \"abs(ds_encT_real - ds_encT_fake) \n   \\<le> abs(ds_enc_real - ds_enc_fake)\n         + 2 * sqrt Q * sqrt( abs(indcpa_enc_0 - indcpa_enc_1) + R )\"\n    (is \"_ \\<le> ?rhs\")\nproof -\n  from g3r fg3 have \"abs(ds_encT_real - ds_encT_fake) \\<le> \n    abs(ds_enc_real - ds_enc_fake) + 2 * sqrt( Q * game4 )\" (is \"_ \\<le> ?rhs'\")\n    by linarith\n  also\n  from g45 g5 have \"game4 \\<le> abs(indcpa_enc_0 - indcpa_enc_1) + R\"\n    by linarith\n  with \\<open>Q\\<ge>0\\<close> have \"?rhs' \\<le> ?rhs\"\n    unfolding real_sqrt_mult\n    by (simp add: ordered_comm_semiring_class.comm_mult_left_mono)\n  finally show ?thesis by assumption\nqed\n\n(* Copied from the result of applying squash left a number of times *)\ndefinition scs_distr0 :: \"((msg\\<Rightarrow>rand) \\<times> (pk \\<times> sk) \\<times> msg \\<times> rand \\<times> (pk \\<times> ciph) \\<times> msg set) distr\" where \"scs_distr0 = \n  product_distr (uniform UNIV) (bind_distr (keygen ()) (\\<lambda>z. map_distr (Pair z) (bind_distr (uniform (msg_space ())) (\\<lambda>za. map_distr (Pair za) (map_distr (\\<lambda>d. (d, (fst z, encr () (fst z) msg_space_element d), {za})) (uniform UNIV))))))\"\n\nlemmas scs_distr0_def_sym = scs_distr0_def[symmetric, simplified]\n\ndefinition \"scs_distr = map_distr (\\<lambda>(G,(tmp_pk,sk),tmp_mstar,rstar,z,S). (S,G,z)) scs_distr0\"\n\ndefinition \"swap guess z = (if guess\\<notin>msg_space() then z else if z=guess then msg_space_element else if z=msg_space_element then guess else z)\"\n  for swap\n\n\n\nlemma [simp]: \"guess1 \\<in> msg_space () \\<longrightarrow> swap guess1 guess1 = msg_space_element\"\n  unfolding swap_def by simp\n\nlemma [simp]: \"{..<q}\\<noteq>{}\"\n  using q_geq_1\n  by (simp add: lessThan_empty_iff)\n\nlemma [simp]: \"weight (keygen ()) = 1\"\n  by (simp add: keygen_def)\n\n(* Tactic for that? *)\nlemma guessing_prob: \n  \"probability (expression \\<lbrakk>m\\<rbrakk> (\\<lambda>m. m = x)) (block [sample \\<lbrakk>m\\<rbrakk> (const_expression (uniform M))]) rho\n  = (if x\\<in>M then 1 / real (card M) else 0)\"\n  apply (subst probability_sample)\n  apply transfer by simp\n\n\nlemma [simp]: \"weight scs_distr0 = 1\"\n  unfolding scs_distr0_def by simp\n\nlemma [simp]: \"weight scs_distr = 1\"\n  unfolding scs_distr_def by simp\n\n    \n\n(* lemma eigenspace_lift[simp]:\n  assumes [simp]: \"distinct_qvars Q\"\n  shows \"eigenspace c (A\\<guillemotright>Q) = (eigenspace c A)\\<guillemotright>Q\"\n  unfolding eigenspace_def\n  apply (rewrite at idOp to \"idOp\\<guillemotright>Q\" lift_idOp[symmetric])\n  by (simp del: lift_idOp) *)\n\n\n\n\nlemma divide_tmp_Gout:\n  assumes [simp]: \"declared_qvars \\<lbrakk>Gin1,Gin2,Gout1,Gout2,quantA1,quantA2,Hin1,Hout1,Hin2,Hout2,tmp_Gout1,tmp_Gout2\\<rbrakk>\"\n  shows \"Span {ket 0}\\<guillemotright>\\<lbrakk>tmp_Gout2\\<rbrakk> \\<sqinter> (\\<lbrakk>quantA1, Hin1, Hout1, Gin1, Gout1\\<rbrakk> \\<equiv>\\<qq> \\<lbrakk>quantA2, Hin2, Hout2, Gin2, Gout2\\<rbrakk> \\<sqinter> Span {ket 0}\\<guillemotright>\\<lbrakk>tmp_Gout1\\<rbrakk>)\n          \\<le> \\<lbrakk>tmp_Gout1, quantA1, Hin1, Hout1, Gin1, Gout1\\<rbrakk> \\<equiv>\\<qq> \\<lbrakk>tmp_Gout2, quantA2, Hin2, Hout2, Gin2, Gout2\\<rbrakk>\"\n    (is \"?lhs \\<le> ?rhs\") \nproof -\n  have \"Span {ket 0}\\<guillemotright>\\<lbrakk>tmp_Gout1\\<rbrakk> \\<sqinter> Span {ket 0}\\<guillemotright>\\<lbrakk>tmp_Gout2\\<rbrakk> = \\<lbrakk>tmp_Gout1\\<rbrakk> \\<equiv>\\<qq> \\<lbrakk>tmp_Gout2\\<rbrakk> \\<sqinter> Span {ket 0}\\<guillemotright>\\<lbrakk>tmp_Gout1\\<rbrakk>\"\n    apply (subst quantum_eq_unique) by auto\n  also have \"\\<dots> \\<le> \\<lbrakk>tmp_Gout1\\<rbrakk> \\<equiv>\\<qq> \\<lbrakk>tmp_Gout2\\<rbrakk>\"\n    using inf.cobounded1 by blast\n  finally have \"?lhs \\<le> \\<lbrakk>tmp_Gout1\\<rbrakk> \\<equiv>\\<qq> \\<lbrakk>tmp_Gout2\\<rbrakk> \\<sqinter> \\<lbrakk>quantA1, Hin1, Hout1, Gin1, Gout1\\<rbrakk> \\<equiv>\\<qq> \\<lbrakk>quantA2, Hin2, Hout2, Gin2, Gout2\\<rbrakk>\"\n    by (smt inf.bounded_iff inf.cobounded1 inf.coboundedI2 inf_commute inf_left_commute)\n  also have \"\\<dots> \\<le> ?rhs\"\n    apply (rule order_trans)\n     apply (rule quantum_equality_merge, simp)\n    by simp\n  finally show ?thesis by -\nqed\n\nlemma weight_keygen[simp]: \"weight (keygen p) = 1\"\n  by simp\n\nlemma weight_keygenT[simp]: \"weight (keygenT p) = 1\"\n  unfolding keygenT_def by simp\n\nlemma [simp]: \"keygen p \\<noteq> 0\"\n  using weight_keygen Prob_0\n  by fastforce \n\nlemma [simp]: \"keygenT p \\<noteq> 0\"\n  unfolding keygenT_def by simp\n\nlemma [simp]: \"q \\<noteq> 0\"\n  using q_geq_1 by auto\n\nend\n", "meta": {"author": "dominique-unruh", "repo": "hksu-verification", "sha": "66b28f0e955bd54113eb316247208e94ec60be6a", "save_path": "github-repos/isabelle/dominique-unruh-hksu-verification", "path": "github-repos/isabelle/dominique-unruh-hksu-verification/hksu-verification-66b28f0e955bd54113eb316247208e94ec60be6a/T_Proofs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3247126201110918}}
{"text": "(*  Title:      HOL/HOLCF/Sfun.thy\n    Author:     Brian Huffman\n*)\n\nsection \\<open>The Strict Function Type\\<close>\n\ntheory Sfun\n  imports Cfun\nbegin\n\npcpodef ('a, 'b) sfun (infixr \"\\<rightarrow>!\" 0) = \"{f :: 'a \\<rightarrow> 'b. f\\<cdot>\\<bottom> = \\<bottom>}\"\n  by simp_all\n\ntype_notation (ASCII)\n  sfun  (infixr \"->!\" 0)\n\ntext \\<open>TODO: Define nice syntax for abstraction, application.\\<close>\n\ndefinition sfun_abs :: \"('a \\<rightarrow> 'b) \\<rightarrow> ('a \\<rightarrow>! 'b)\"\n  where \"sfun_abs = (\\<Lambda> f. Abs_sfun (strictify\\<cdot>f))\"\n\ndefinition sfun_rep :: \"('a \\<rightarrow>! 'b) \\<rightarrow> 'a \\<rightarrow> 'b\"\n  where \"sfun_rep = (\\<Lambda> f. Rep_sfun f)\"\n\nlemma sfun_rep_beta: \"sfun_rep\\<cdot>f = Rep_sfun f\"\n  by (simp add: sfun_rep_def cont_Rep_sfun)\n\nlemma sfun_rep_strict1 [simp]: \"sfun_rep\\<cdot>\\<bottom> = \\<bottom>\"\n  unfolding sfun_rep_beta by (rule Rep_sfun_strict)\n\nlemma sfun_rep_strict2 [simp]: \"sfun_rep\\<cdot>f\\<cdot>\\<bottom> = \\<bottom>\"\n  unfolding sfun_rep_beta by (rule Rep_sfun [simplified])\n\nlemma strictify_cancel: \"f\\<cdot>\\<bottom> = \\<bottom> \\<Longrightarrow> strictify\\<cdot>f = f\"\n  by (simp add: cfun_eq_iff strictify_conv_if)\n\nlemma sfun_abs_sfun_rep [simp]: \"sfun_abs\\<cdot>(sfun_rep\\<cdot>f) = f\"\n  unfolding sfun_abs_def sfun_rep_def\n  apply (simp add: cont_Abs_sfun cont_Rep_sfun)\n  apply (simp add: Rep_sfun_inject [symmetric] Abs_sfun_inverse)\n  apply (simp add: cfun_eq_iff strictify_conv_if)\n  apply (simp add: Rep_sfun [simplified])\n  done\n\nlemma sfun_rep_sfun_abs [simp]: \"sfun_rep\\<cdot>(sfun_abs\\<cdot>f) = strictify\\<cdot>f\"\n  unfolding sfun_abs_def sfun_rep_def\n  apply (simp add: cont_Abs_sfun cont_Rep_sfun)\n  apply (simp add: Abs_sfun_inverse)\n  done\n\nlemma sfun_eq_iff: \"f = g \\<longleftrightarrow> sfun_rep\\<cdot>f = sfun_rep\\<cdot>g\"\n  by (simp add: sfun_rep_def cont_Rep_sfun Rep_sfun_inject)\n\nlemma sfun_below_iff: \"f \\<sqsubseteq> g \\<longleftrightarrow> sfun_rep\\<cdot>f \\<sqsubseteq> sfun_rep\\<cdot>g\"\n  by (simp add: sfun_rep_def cont_Rep_sfun below_sfun_def)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/Sfun.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.32471261185990175}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory SubMonadLib\nimports\n  EmptyFailLib\n  Corres_UL\nbegin\n\nlocale submonad_args =\n  fixes fetch :: \"'a \\<Rightarrow> 'b\"\n  fixes replace :: \"'b \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  fixes guard :: \"'a \\<Rightarrow> bool\"\n\n  assumes args:\n   \"\\<forall>x s. guard s \\<longrightarrow> fetch (replace x s) = x\"\n   \"\\<forall>x y s. replace x (replace y s) = replace x s\"\n   \"\\<forall>s. replace (fetch s) s = s\"\n\n  assumes replace_preserves_guard:\n   \"\\<And>s x. guard (replace x s) = guard s\"\n\ndefinition\n  submonad_fn :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow>\n                  ('b, 'c) nondet_monad \\<Rightarrow> ('a, 'c) nondet_monad\"\nwhere\n \"submonad_fn fetch replace guard m \\<equiv> do\n    stateAssert guard [];\n    substate \\<leftarrow> gets fetch;\n    (rv, substate') \\<leftarrow> select_f (m substate);\n    modify (replace substate');\n    return rv\n  od\"\n\nlocale submonad = submonad_args +\n  fixes fn :: \"('b, 'c) nondet_monad \\<Rightarrow> ('a, 'c) nondet_monad\"\n\n  assumes fn_is_sm: \"fn = submonad_fn fetch replace guard\"\n\nlemma (in submonad_args) argsD1:\n  \"\\<And>x s. guard s \\<Longrightarrow> fetch (replace x s) = x\"\n  by (simp add: args)\n\nlemma (in submonad) guarded_sm:\n  \"\\<And>s. guard s \\<Longrightarrow>\n   fn m s = (do\n     substate \\<leftarrow> gets fetch;\n     (rv, substate') \\<leftarrow> select_f (m substate);\n     modify (replace substate');\n     return rv\n   od) s\"\n  unfolding fn_is_sm submonad_fn_def\n  by (simp add: stateAssert_def get_def assert_def bind_def return_def)\n\nlemma modify_modify:\n  \"modify fn1 >>= (\\<lambda>x. modify fn2) = modify (fn2 \\<circ> fn1)\"\n  by (simp add: bind_def modify_def get_def put_def)\n\nlemma select_f_walk:\n  assumes m1: \"empty_fail m1\"\n  assumes S: \"fst S = {} \\<Longrightarrow> snd S\"\n  shows \"(do a \\<leftarrow> m1; b \\<leftarrow> select_f S; m2 a b od) = (do b \\<leftarrow> select_f S; a \\<leftarrow> m1; m2 a b od)\"\n  apply (rule ext)\n  apply (rule prod.expand)\n  apply (rule conjI)\n   apply (simp add: select_f_def bind_def split_def)\n   apply fastforce\n  apply (simp add: select_f_def bind_def split_def)\n  apply (case_tac \"fst S = {}\")\n   apply clarsimp\n   apply (case_tac \"fst (m1 x) = {}\")\n    apply (simp add: empty_failD [OF m1] S)\n   apply (frule S)\n   apply force\n  apply safe\n     apply clarsimp\n     apply force\n    apply force\n   apply clarsimp\n   apply force\n  apply clarsimp\n  apply (case_tac \"fst (m1 x) = {}\", simp add: empty_failD [OF m1])\n  apply force\n  done\n\nlemma stateAssert_stateAssert:\n  \"(stateAssert g [] >>= (\\<lambda>u. stateAssert g' [])) = stateAssert (g and g') []\"\n  by (simp add: ext stateAssert_def bind_def get_def assert_def fail_def return_def)\n\nlemma modify_stateAssert:\n  \"\\<lbrakk> \\<And>s x. g (r x s) = g s \\<rbrakk> \\<Longrightarrow>\n   (modify (r x) >>= (\\<lambda>u. stateAssert g []))\n            = (stateAssert g [] >>= (\\<lambda>u. modify (r x)))\"\n  by (simp add: ext stateAssert_def bind_def get_def assert_def fail_def\n                return_def modify_def put_def)\n\nlemma gets_stateAssert:\n  \"(gets f >>= (\\<lambda>x. stateAssert g' [] >>= (\\<lambda>u. m x)))\n            = (stateAssert g' [] >>= (\\<lambda>u. gets f >>= (\\<lambda>x. m x)))\"\n  by (simp add: ext stateAssert_def bind_def gets_def get_def\n                assert_def fail_def return_def)\n\nlemma select_f_stateAssert:\n  \"empty_fail m \\<Longrightarrow>\n   (select_f (m a) >>= (\\<lambda>x. stateAssert g [] >>= (\\<lambda>u. n x))) =\n   (stateAssert g [] >>= (\\<lambda>u. select_f (m a) >>= (\\<lambda>x. n x)))\"\n  apply (rule ext)\n  apply (clarsimp simp: stateAssert_def bind_def select_f_def get_def\n                        assert_def return_def fail_def split_def image_image)\n  apply (simp only: image_def)\n  apply (clarsimp simp: stateAssert_def bind_def select_f_def get_def\n                        assert_def return_def fail_def split_def image_image)\n  apply (simp only: image_def mem_simps empty_fail_def simp_thms)\n  apply fastforce\n  done\n\nlemma bind_select_f_bind':\n  shows \"(select_f (m s) >>= (\\<lambda>x. select_f (split n x))) = (select_f ((m >>= n) s))\"\n  apply (rule ext)\n  apply (force simp: select_f_def bind_def split_def)\n  done\n\nlemma bind_select_f_bind:\n  \"(select_f (m1 s) >>= (\\<lambda>x. select_f (m2 (fst x) (snd x)))) = (select_f ((m1 >>= m2) s))\"\n  by (insert bind_select_f_bind' [where m=m1 and n=m2 and s=s],\n      simp add: split_def)\n\nlemma select_from_gets: \"select_f (gets f s) = return (f s, s)\"\n  apply (rule ext)\n  apply (simp add: select_f_def return_def simpler_gets_def)\n  done\n\nlemma select_from_gets':\n  \"(select_f \\<circ> gets f) = (\\<lambda>s. return (f s, s))\"\n  apply (rule ext)\n  apply (simp add: o_def select_from_gets)\n  done\n\nlemma bind_subst_lift:\n  \"(f >>= g) = h \\<Longrightarrow> (do x \\<leftarrow> f; y \\<leftarrow> g x; j y od) = (h >>= j)\"\n  by (simp add: bind_assoc[symmetric])\n\nlemma modify_gets:\n  \"\\<lbrakk> \\<And>x s. g (r x s) = g s; \\<And>x s. g s \\<longrightarrow> f (r x s) = x \\<rbrakk>\n   \\<Longrightarrow> (modify (r x) >>= (\\<lambda>u. stateAssert g [] >>= (\\<lambda>u'. gets f)))\n            = (stateAssert g [] >>= (\\<lambda>u'. modify (r x) >>= (\\<lambda>u. return x)))\"\n  by (simp add: ext stateAssert_def assert_def modify_def bind_def get_def\n                put_def gets_def return_def fail_def)\n\nlemma (in submonad_args) gets_modify:\n  \"\\<And>s. guard s \\<Longrightarrow>\n   (do x \\<leftarrow> gets fetch; u \\<leftarrow> modify (replace x); f x od) s = ((gets fetch) >>= f) s\"\n  by (clarsimp simp: modify_def gets_def return_def bind_def\n                     put_def args get_def\n              split: option.split)\n\nlemma submonad_bind:\n  \"\\<lbrakk> submonad f r g m; submonad f r g m'; submonad f r g m'';\n     empty_fail a; \\<And>x. empty_fail (b x) \\<rbrakk> \\<Longrightarrow>\n   m (a >>= b) = (m' a) >>= (\\<lambda>rv. m'' (b rv))\"\n  apply (subst submonad.fn_is_sm, assumption)+\n  apply (clarsimp simp: submonad_def bind_assoc split_def submonad_fn_def)\n  apply (subst bind_subst_lift [OF modify_gets, unfolded bind_assoc])\n    apply (simp add: submonad_args.args submonad_args.replace_preserves_guard)+\n  apply (subst select_f_stateAssert, assumption)\n  apply (subst gets_stateAssert)\n  apply (subst bind_subst_lift [OF stateAssert_stateAssert])\n  apply (clarsimp simp: pred_conj_def)\n  apply (clarsimp simp: bind_assoc split_def select_f_walk\n                empty_fail_stateAssert empty_failD\n                bind_subst_lift[OF modify_modify] submonad_args.args o_def\n                bind_subst_lift[OF bind_select_f_bind])\n  done\n\nlemma (in submonad) guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> (rv, s') \\<in> fst (fn m s) \\<rbrakk> \\<Longrightarrow> guard s'\"\n  unfolding fn_is_sm submonad_fn_def\n  by (clarsimp simp: stateAssert_def gets_def get_def bind_def modify_def put_def\n                     return_def select_f_def replace_preserves_guard in_monad)\n\nlemma fst_stateAssertD:\n  \"\\<And>s s' v. (v, s') \\<in> fst (stateAssert g [] s) \\<Longrightarrow> s' = s \\<and> g s\"\n  by (clarsimp simp: stateAssert_def in_monad)\n\nlemma(in submonad) guarded_gets:\n  \"\\<And>s. guard s \\<Longrightarrow> fn (gets f) s = gets (f \\<circ> fetch) s\"\n  apply (simp add: guarded_sm select_from_gets gets_modify)\n  apply (simp add: gets_def)\n  done\n\nlemma (in submonad) guarded_return:\n  \"\\<And>s. guard s \\<Longrightarrow> fn (return x) s = return x s\"\n  using args guarded_gets\n  by (fastforce simp: gets_def bind_def get_def)\n\nlemma (in submonad_args) submonad_fn_gets:\n  \"submonad_fn fetch replace guard (gets f) =\n   (stateAssert guard [] >>= (\\<lambda>u. gets (f \\<circ> fetch)))\"\n  apply (simp add: ext select_from_gets submonad_fn_def)\n  apply (rule bind_cong [OF refl])\n  apply (clarsimp simp: gets_modify dest!: fst_stateAssertD)\n  apply (simp add: gets_def)\n  done\n\nlemma(in submonad) gets:\n  \"fn (gets f) = (stateAssert guard [] >>= (\\<lambda>u. gets (f \\<circ> fetch)))\"\n  unfolding fn_is_sm submonad_fn_gets\n  by (rule refl)\n\nlemma (in submonad) return:\n  \"fn (return x) = (stateAssert guard [] >>= (\\<lambda>u. return x))\"\n  using args gets\n  by (fastforce simp: gets_def bind_def get_def)\n\nlemma (in submonad) mapM_guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> guard s; \\<exists>rv. (rv, s') \\<in> fst (mapM (fn \\<circ> m) xs s)\\<rbrakk> \\<Longrightarrow> guard s'\"\nproof (induct xs)\n  case Nil\n  thus ?case\n    by (simp add: mapM_def sequence_def return_def)\n  next\n  case (Cons x xs)\n  thus ?case\n    apply (clarsimp simp: o_def mapM_Cons return_def bind_def)\n    apply (drule guard_preserved)\n    apply fastforce\n    done\nqed\n\nlemma (in submonad) mapM_x_guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> guard s; \\<exists>rv. (rv, s') \\<in> fst (mapM_x (fn \\<circ> m) xs s)\\<rbrakk> \\<Longrightarrow> guard s'\"\nproof (induct xs)\n  case Nil\n  thus ?case\n    by (simp add: mapM_x_def sequence_x_def return_def)\n  next\n  case (Cons x xs)\n  thus ?case\n    apply (clarsimp simp: o_def mapM_x_Cons return_def bind_def)\n    apply (drule guard_preserved)\n    apply fastforce\n    done\nqed\n\nlemma (in submonad) stateAssert_fn:\n  \"stateAssert guard [] >>= (\\<lambda>u. fn m) = fn m\"\n  by (simp add: fn_is_sm submonad_fn_def pred_conj_def\n                bind_subst_lift [OF stateAssert_stateAssert])\n\nlemma (in submonad) fn_stateAssert:\n  \"fn m >>= (\\<lambda>x. stateAssert guard [] >>= (\\<lambda>u. n x)) = (fn m >>= n)\"\n  apply (simp add: fn_is_sm submonad_fn_def bind_assoc split_def)\n  apply (rule ext)\n  apply (rule bind_apply_cong [OF refl])+\n  apply (clarsimp simp: stateAssert_def bind_assoc in_monad select_f_def)\n  apply (drule iffD2 [OF replace_preserves_guard])\n  apply (fastforce simp: bind_def assert_def get_def return_def)\n  done\n\nlemma submonad_mapM:\n  assumes sm: \"submonad f r g sm\" and sm': \"submonad f r g sm'\"\n  assumes efm: \"\\<And>x. empty_fail (m x)\"\n  shows\n  \"(sm (mapM m l)) = (stateAssert g [] >>= (\\<lambda>u. mapM (sm' \\<circ> m) l))\"\nproof (induct l)\n  case Nil\n  thus ?case\n    by (simp add: mapM_def sequence_def bind_def submonad.return [OF sm])\n  next\n  case (Cons x xs)\n  thus ?case\n    using sm sm' efm\n    apply (simp add: mapM_Cons)\n    apply (simp add: bind_subst_lift [OF submonad.stateAssert_fn])\n    apply (simp add: bind_assoc submonad_bind submonad.return)\n    apply (subst submonad.fn_stateAssert [OF sm'])\n    apply (intro ext bind_apply_cong [OF refl])\n    apply (subgoal_tac \"g sta\")\n     apply (clarsimp simp: stateAssert_def bind_def get_def assert_def return_def)\n    apply (frule(1) submonad.guard_preserved)\n    apply (erule(1) submonad.mapM_guard_preserved, fastforce simp: o_def)\n    done\nqed\n\nlemma submonad_mapM_x:\n  assumes sm: \"submonad f r g sm\" and sm': \"submonad f r g sm'\"\n  assumes efm: \"\\<And>x. empty_fail (m x)\"\n  shows\n  \"(sm (mapM_x m l)) = (stateAssert g [] >>= (\\<lambda>u. mapM_x (sm' \\<circ> m) l))\"\nproof (induct l)\n  case Nil\n  thus ?case\n    by (simp add: mapM_x_def sequence_x_def bind_def submonad.return [OF sm])\n  next\n  case (Cons x xs)\n  thus ?case\n    using sm sm' efm\n    apply (simp add: mapM_x_Cons)\n    apply (simp add: bind_subst_lift [OF submonad.stateAssert_fn])\n    apply (simp add: bind_assoc submonad_bind submonad.return)\n    apply (subst submonad.fn_stateAssert [OF sm'])\n    apply (intro ext bind_apply_cong [OF refl])\n    apply (subgoal_tac \"g st\")\n     apply (clarsimp simp: stateAssert_def bind_def get_def assert_def return_def)\n    apply (frule(1) submonad.guard_preserved, simp)\n    done\nqed\n\nlemma corres_select:\n  \"(\\<forall>s' \\<in> S'. \\<exists>s \\<in> S. rvr s s') \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select S) (select S')\"\n  by (clarsimp simp: select_def corres_underlying_def)\n\nlemma corres_select_f:\n  \"\\<lbrakk> \\<forall>s' \\<in> fst S'. \\<exists>s \\<in> fst S. rvr s s'; nf' \\<Longrightarrow> \\<not> snd S' \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select_f S) (select_f S')\"\n  by (clarsimp simp: select_f_def corres_underlying_def)\n\nlemma corres_modify':\n  \"\\<lbrakk> (\\<forall>s s'. (s, s') \\<in> sr \\<longrightarrow> (f s, f' s') \\<in> sr); r () () \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' r \\<top> \\<top> (modify f) (modify f')\"\n  by (clarsimp simp: modify_def corres_underlying_def bind_def get_def put_def)\n\n(* FIXME: this should only be used for the lemma below *)\nlemma corres_select_f_stronger:\n  \"\\<lbrakk> \\<forall>s' \\<in> fst S'. \\<exists>s \\<in> fst S. rvr s s'; nf' \\<Longrightarrow> \\<not> snd S' \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select_f S) (select_f S')\"\n  by (clarsimp simp: select_f_def corres_underlying_def)\n\nlemma stateAssert_sp:\n  \"\\<lbrace>P\\<rbrace> stateAssert Q l \\<lbrace>\\<lambda>_. P and Q\\<rbrace>\"\n  by (clarsimp simp: valid_def stateAssert_def in_monad)\n\nlemma corres_submonad:\n  \"\\<lbrakk> submonad f r g fn; submonad f' r' g' fn';\n     \\<forall>s s'. (s, s') \\<in> sr \\<and> g s \\<and> g' s' \\<longrightarrow> (f s, f' s') \\<in> ssr;\n     \\<forall>s s' ss ss'. ((s, s') \\<in> sr \\<and> (ss, ss') \\<in> ssr) \\<longrightarrow> (r ss s, r' ss' s') \\<in> sr;\n     corres_underlying ssr False nf' rvr \\<top> \\<top> x x'\\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr False nf' rvr g g' (fn x) (fn' x')\"\n  apply (subst submonad.fn_is_sm, assumption)+\n  apply (clarsimp simp: submonad_fn_def)\n  apply (rule corres_split' [OF _ _ stateAssert_sp stateAssert_sp])\n   apply (fastforce simp: corres_underlying_def stateAssert_def get_def\n                         assert_def return_def bind_def)\n  apply (rule corres_split' [where r'=\"\\<lambda>x y. (x, y) \\<in> ssr\",\n                             OF _ _ hoare_post_taut hoare_post_taut])\n   apply clarsimp\n  apply (rule corres_split' [where r'=\"\\<lambda>(x, x') (y, y'). rvr x y \\<and> (x', y') \\<in> ssr\",\n                             OF _ _ hoare_post_taut hoare_post_taut])\n   defer\n   apply clarsimp\n   apply (rule corres_split' [where r'=dc, OF _ _ hoare_post_taut hoare_post_taut])\n    apply (simp add: corres_modify')\n   apply clarsimp\n  apply (rule corres_select_f_stronger)\n   apply (clarsimp simp: corres_underlying_def)\n   apply (drule (1) bspec, clarsimp)\n   apply (drule (1) bspec, simp)\n   apply blast\n  apply (clarsimp simp: corres_underlying_def)\n  apply (drule (1) bspec, clarsimp)\n  done\n\nlemma stateAssert_top [simp]:\n  \"stateAssert \\<top> l >>= f = f ()\"\n  by (clarsimp simp add: stateAssert_def get_def bind_def return_def)\n\nlemma stateAssert_A_top [simp]:\n  \"stateAssert \\<top> l = return ()\"\n  by (simp add: stateAssert_def get_def bind_def return_def)\n\ntext \\<open>Use of the submonad concept to demonstrate commutativity.\\<close>\n\nlemma gets_modify_comm:\n  \"\\<And> s. \\<lbrakk> g (f s) = g s \\<rbrakk> \\<Longrightarrow>\n   (do x \\<leftarrow> modify f; y \\<leftarrow> gets g; m x y od) s =\n   (do y \\<leftarrow> gets g; x \\<leftarrow> modify f; m x y od) s\"\n  by (simp add: modify_def gets_def get_def bind_def put_def return_def)\n\nlemma bind_subst_lhs_inv:\n  \"\\<And>s. \\<lbrakk> \\<And>x s'. P s' \\<Longrightarrow> (f x >>= g x) s' = h x s'; \\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>_. P\\<rbrace>; P s \\<rbrakk> \\<Longrightarrow>\n   (do x \\<leftarrow> a; y \\<leftarrow> f x; g x y od) s = (a >>= h) s\"\n  apply (rule bind_apply_cong [OF refl])\n  apply (drule(2) use_valid)\n  apply simp\n  done\n\nlemma gets_comm:\n  \"do x \\<leftarrow> gets f; y \\<leftarrow> gets g; m x y od = do y \\<leftarrow> gets g; x \\<leftarrow> gets f; m x y od\"\n  by (simp add: gets_def get_def return_def bind_def)\n\nlemma submonad_comm:\n  assumes x1: \"submonad_args f r g\" and x2: \"submonad_args f' r' g'\"\n  assumes y: \"m = submonad_fn f r g im\" \"m' = submonad_fn f' r' g' im'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"(do x \\<leftarrow> m; y \\<leftarrow> m'; n x y od) = (do y \\<leftarrow> m'; x \\<leftarrow> m; n x y od)\"\nproof -\n  have P: \"\\<And>x s. g s \\<Longrightarrow> f (r' x s) = f s\"\n    apply (subgoal_tac \"f (r' x (r (f s) s)) = f s\")\n     apply (simp add: submonad_args.args[OF x1])\n    apply (simp add: z[symmetric])\n    apply (subst(asm) gp [symmetric])\n    apply (fastforce dest: submonad_args.argsD1[OF x1])\n    done\n  have Q: \"\\<And>x s. g' s \\<Longrightarrow> f' (r x s) = f' s\"\n    apply (subgoal_tac \"f' (r x (r' (f' s) s)) = f' s\")\n     apply (simp add: submonad_args.args[OF x2])\n    apply (simp add: z)\n    apply (subst(asm) gp' [symmetric])\n    apply (fastforce dest: submonad_args.argsD1[OF x2])\n    done\n  note empty_failD [OF efim, simp]\n  note empty_failD [OF efim', simp]\n  show ?thesis\n    apply (clarsimp simp: submonad_fn_def y bind_assoc split_def)\n    apply (subst bind_subst_lift [OF modify_stateAssert], rule gp gp')+\n    apply (simp add: bind_assoc)\n    apply (subst select_f_stateAssert, rule efim efim')+\n    apply (subst gets_stateAssert bind_subst_lift [OF stateAssert_stateAssert])+\n    apply (rule bind_cong)\n     apply (simp add: pred_conj_def conj_comms)\n    apply (simp add: bind_assoc select_f_walk[symmetric])\n    apply (clarsimp dest!: fst_stateAssertD)\n    apply (subst bind_assoc[symmetric],\n           subst bind_subst_lhs_inv [OF gets_modify_comm],\n           erule P Q, wp, simp, simp)+\n    apply (simp add: bind_assoc)\n    apply (simp add: select_f_walk[symmetric])\n    apply (subst gets_comm)\n    apply (rule bind_apply_cong [OF refl])+\n    apply (subst select_f_walk, simp, simp,\n           subst select_f_walk, simp, simp,\n           rule bind_apply_cong [OF refl])\n    apply (subst select_f_walk, simp, simp, rule bind_apply_cong [OF refl])\n    apply (clarsimp simp: simpler_gets_def select_f_def)\n    apply (simp add: bind_def get_def put_def modify_def z)\n    done\nqed\n\nlemma submonad_comm2:\n  assumes x1: \"submonad_args f r g\" and x2: \"m = submonad_fn f r g im\"\n  assumes y: \"submonad f' r' g' m'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"do x \\<leftarrow> m; y \\<leftarrow> m' im'; n x y od = do y \\<leftarrow> m' im'; x \\<leftarrow> m; n x y od\"\n  apply (rule submonad_comm[where f'=f' and r'=r', OF x1 _ x2 _ z])\n       apply (insert y)\n       apply (fastforce simp add: submonad_def)\n      apply (fastforce dest: submonad.fn_is_sm)\n     apply (simp add: efim efim' gp gp')+\n  done\n\nlemma submonad_bind_alt:\n  assumes x: \"submonad_args f r g\"\n  assumes y: \"a = submonad_fn f r g a'\" \"\\<And>rv. b rv = submonad_fn f r g (b' rv)\"\n  assumes efa: \"empty_fail a'\" and efb: \"\\<And>x. empty_fail (b' x)\"\n  shows      \"(a >>= b) = submonad_fn f r g (a' >>= b')\"\nproof -\n  have P: \"submonad f r g (submonad_fn f r g)\"\n    by (simp add: x submonad_def submonad_axioms_def)\n  have Q: \"b = (\\<lambda>rv. submonad_fn f r g (b' rv))\"\n    by (rule ext) fact+\n  show ?thesis\n    by (simp add: y Q submonad_bind [OF P P P efa efb])\nqed\n\nlemma submonad_singleton:\n  \"submonad_fn fetch replace \\<top> (\\<lambda>s. ({(rv s, s' s)}, False))\n     = (\\<lambda>s. ({(rv (fetch s), replace (s' (fetch s)) s)}, False))\"\n  apply (rule ext)\n  apply (simp add: submonad_fn_def bind_def gets_def\n                put_def get_def modify_def return_def\n                select_f_def UNION_eq)\n  done\n\nlemma gets_submonad:\n  \"\\<lbrakk> submonad_args fetch replace \\<top>; \\<And>s. f s = f' (fetch s); m = gets f' \\<rbrakk>\n   \\<Longrightarrow> gets f = submonad_fn fetch replace \\<top> m\"\n  apply (drule submonad_args.args(3))\n  apply (clarsimp simp add: simpler_gets_def submonad_singleton)\n  done\n\nlemma modify_submonad:\n  \"\\<lbrakk> \\<And>s. f s = replace (K_record (f' (fetch s))) s; m = modify f' \\<rbrakk>\n     \\<Longrightarrow> modify f = submonad_fn fetch (replace o K_record) \\<top> m\"\n  by (simp add: simpler_modify_def submonad_singleton)\n\nlemma fail_submonad:\n  \"fail = submonad_fn fetch replace \\<top> fail\"\n  by (simp add: submonad_fn_def simpler_gets_def return_def\n                simpler_modify_def select_f_def bind_def fail_def)\n\nlemma return_submonad:\n  \"submonad_args fetch replace guard \\<Longrightarrow>\n   return v = submonad_fn fetch replace \\<top> (return v)\"\n  by (simp add: return_def submonad_singleton submonad_args.args)\n\nlemma assert_opt_submonad:\n  \"submonad_args fetch replace \\<top> \\<Longrightarrow>\n   assert_opt v = submonad_fn fetch replace \\<top> (assert_opt v)\"\n  apply (case_tac v, simp_all add: assert_opt_def)\n   apply (rule fail_submonad)\n  apply (rule return_submonad)\n  apply assumption\n  done\n\nlemma is_stateAssert_gets:\n  \"\\<lbrakk> \\<forall>s. \\<lbrace>(=) s\\<rbrace> f \\<lbrace>\\<lambda>_. (=) s\\<rbrace>; \\<lbrace>\\<top>\\<rbrace> f \\<lbrace>\\<lambda>_. guard\\<rbrace>;\n     empty_fail f; no_fail guard f; \\<lbrace>guard\\<rbrace> f \\<lbrace>\\<lambda>rv s. fetch s = rv\\<rbrace> \\<rbrakk>\n    \\<Longrightarrow> f = do stateAssert guard []; gets fetch od\"\n  apply (rule ext)\n  apply (clarsimp simp: bind_def empty_fail_def valid_def no_fail_def\n                        stateAssert_def assert_def gets_def get_def\n                        return_def fail_def image_def split_def)\n  apply (case_tac \"f x\")\n  apply (intro conjI impI)\n   apply (drule_tac x=x in spec)+\n   apply (subgoal_tac \"\\<forall>xa\\<in>fst (f x). fst xa = fetch x \\<and> snd xa = x\")\n    apply fastforce\n   apply clarsimp\n  apply (drule_tac x=x in spec)+\n  apply fastforce\n  done\n\nlemma is_modify:\n  \"\\<And>s. \\<lbrakk> \\<lbrace>(=) s\\<rbrace> f \\<lbrace>\\<lambda>_. (=) (replace s)\\<rbrace>; empty_fail f;\n          no_fail guard f; guard s \\<rbrakk>\n    \\<Longrightarrow> f s = modify replace s\"\n  apply (clarsimp simp: bind_def empty_fail_def valid_def no_fail_def\n                        stateAssert_def assert_def modify_def get_def put_def\n                        return_def fail_def image_def split_def)\n  apply (case_tac \"f s\")\n  apply force\n  done\n\nlemma submonad_comm':\n  assumes sm1: \"submonad f r g m\" and sm2: \"submonad f' r' g' m'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"(do x \\<leftarrow> m im; y \\<leftarrow> m' im'; n x y od) =\n              (do y \\<leftarrow> m' im'; x \\<leftarrow> m im; n x y od)\"\n  apply (rule submonad_comm [where f'=f' and r'=r', OF _ _ _ _ z])\n         apply (insert sm1 sm2)\n         apply (fastforce dest: submonad.fn_is_sm simp: submonad_def)+\n     apply (simp add: efim efim' gp gp')+\n  done\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/SubMonadLib.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.32471261185990175}}
{"text": "theory FlatLemma\n  imports DropEnv FlatCutEnv\nbegin\n    \n  \n  \n\ndefinition infl_use_env where\n  \"infl_use_env r_s r_x = (\\<lambda> x. if r_s x = OwnPerm \\<and> r_x x = NoPerm then OwnPerm else NoPerm)\"    \n  \nlemma infl_disj_use_env: \"\\<lbrakk> leq_use_env r_ex r_x \\<rbrakk> \\<Longrightarrow> disj_use_env r_ex (infl_use_env r_s r_x)\"  \n  apply (simp add: leq_use_env_def)\n  apply (simp add: disj_use_env_def)\n  apply (simp add: infl_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  done\n    \n    \n  \nlemma self_infl_leq_use_env: \"leq_use_env (infl_use_env r_s r_x) r_s\"       \n  apply (simp add: leq_use_env_def)\n  apply (simp add: infl_use_env_def)\n  done\n    \nlemma infl_leq_use_env: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_ex); leq_use_env r_ex r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (cut_use_env r_ex) (infl_use_env r_s r_x)\"   \n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: infl_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: cut_use_env_def)\n  apply (auto)\n   apply (case_tac \"r_ex x\")\n     apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done \n    \nlemma dist_infl_leq_use_env: \"\\<lbrakk> leq_use_env r_sb r_sa; leq_use_env r_xb r_xa \\<rbrakk> \\<Longrightarrow> leq_use_env (infl_use_env r_sb r_xa) (infl_use_env r_sa r_xb)\"       \n  apply (simp add: leq_use_env_def)\n  apply (simp add: infl_use_env_def)\n  apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (erule_tac x=\"x\" in allE)\n   apply (case_tac \"r_sa x\")\n     apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_xb x\")\n    apply (auto)\n  done\n    \n  \nlemma lhs_diff_leq_use_env: \"\\<lbrakk> leq_use_env (diff_use_env r_x r_ex) r_s; leq_use_env (cut_use_env r_ex) r_s \\<rbrakk> \\<Longrightarrow> leq_use_env r_x r_s\"    \n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: cut_use_env_def)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n   apply (case_tac \"r_ex x\")\n     apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)   \n  done\n\nlemma diff_infl_leq_use_env: \"leq_use_env (diff_use_env (infl_use_env r_s r_x) (infl_use_env r_s r_x)) r_c\"\n  apply (simp add: leq_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: infl_use_env_def)\n  done    \n\n \n\nlemma infl_lift_use_env: \"lift_use_env (infl_use_env r_s r_x) r = infl_use_env r_s r_x\"    \n  apply (case_tac \"\\<forall> x. lift_use_env (infl_use_env r_s r_x) r x = infl_use_env r_s r_x x\")\n   apply (auto)\n  apply (case_tac r)\n    apply (auto)\n  apply (simp add: infl_use_env_def)\n  apply (auto)\n  done    \n    \n\ndefinition refl_use_env where\n  \"refl_use_env r_s r_x r = (\\<lambda> x. if r_s x = OwnPerm \\<and> r_x x = NoPerm then r else NoPerm)\"\n\nlemma refl_leq_use_env: \"leq_use_env (refl_use_env r_s r_x r) r_s\"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: refl_use_env_def)\n  done  \n\nlemma dist_refl_leq_use_env: \"\\<lbrakk> leq_use_env r_sb r_sa; leq_use_env r_xb r_xa \\<rbrakk> \\<Longrightarrow> leq_use_env (refl_use_env r_sb r_xa r) (refl_use_env r_sa r_xb r)\"         \n  apply (simp add: leq_use_env_def)\n  apply (simp add: refl_use_env_def)\n  apply (auto)\n    apply (case_tac r)\n      apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (erule_tac x=\"x\" in allE)\n   apply (auto)\n   apply (case_tac \"r_sa x\")\n     apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_xb x\")\n    apply (auto)\n  done\n\nlemma dist_refl_leq_use_env_perm: \"\\<lbrakk> leq_perm q r \\<rbrakk> \\<Longrightarrow> leq_use_env (refl_use_env r_s r_x q) (refl_use_env r_s r_x r)\"     \n  apply (simp add: leq_use_env_def)\n  apply (simp add: refl_use_env_def)\n  done\n\nlemma dist_refl_leq_use_env_gen: \"\\<lbrakk> leq_use_env r_sb r_sa; leq_use_env r_xb r_xa; leq_perm q r \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (refl_use_env r_sb r_xa q) (refl_use_env r_sa r_xb r)\"         \n  apply (rule_tac r_sb=\"refl_use_env r_sa r_xb q\" in trans_leq_use_env)\n   apply (rule_tac dist_refl_leq_use_env_perm)\n   apply (simp)\n  apply (rule_tac dist_refl_leq_use_env)\n   apply (auto)\n  done\n\n(*\nlemma cut_refl_leq_use_env: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_ex); leq_use_env r_ex r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (cut_use_env r_ex) (refl_use_env r_s r_x r)\"   \n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: refl_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: cut_use_env_def)\n  apply (auto)\n   apply (case_tac \"r_ex x\")\n     apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done   *)  \n \nlemma refl_lift_use_env: \"\\<lbrakk> leq_perm r q \\<rbrakk> \\<Longrightarrow> lift_use_env (refl_use_env r_s r_x q) r = refl_use_env r_s r_x q\"    \n  apply (case_tac \"\\<forall> x. lift_use_env (refl_use_env r_s r_x q) r x = refl_use_env r_s r_x q x\")\n   apply (auto)\n  apply (case_tac r)\n    apply (auto)\n  apply (simp add: refl_use_env_def)\n  apply (case_tac q)\n    apply (auto)\n  done          \n    \nlemma refl_diff_comp_leq_use_env: \"\\<lbrakk> safe_use_lift rxa ra; leq_perm ra r;\n  leq_use_env (diff_use_env (lift_use_env rxa ra) (infl_use_env r_s1 r_s2)) rx \\<rbrakk> \\<Longrightarrow> \n  leq_use_env (lift_use_env rxa ra) (comp_use_env rx (refl_use_env r_s1 r_s2 r))\"    \n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: infl_use_env_def)\n  apply (simp add: refl_use_env_def)\n  apply (auto)\n    apply (case_tac ra)\n      apply (auto)\n     apply (case_tac \"rxa x\")\n       apply (auto)\n     apply (case_tac r)\n       apply (auto)\n      apply (case_tac \"rx x\")\n        apply (auto)\n     apply (case_tac \"rx x\")\n       apply (auto)\n    apply (case_tac r)\n      apply (auto)\n    apply (case_tac \"rx x\")\n      apply (auto)\n   apply (case_tac \"\\<not> minus_ep (lift_use_env rxa ra x) NoEP = lift_use_env rxa ra x\")\n    apply (case_tac \"lift_use_env rxa ra x\")\n      apply (auto)\n   apply (case_tac \"rx x\")\n     apply (auto)\n  apply (case_tac \"\\<not> minus_ep (lift_use_env rxa ra x) NoEP = lift_use_env rxa ra x\")\n   apply (case_tac \"lift_use_env rxa ra x\")\n     apply (auto)\n  apply (case_tac \"rx x\")\n    apply (auto)\n  done\n \nlemma refl_diff_comp_leq_use_env_x: \"\\<lbrakk> safe_use_lift rxa ra; leq_perm ra r;\n  leq_use_env (diff_use_env rxa (infl_use_env r_s1 r_s2)) rx \\<rbrakk> \\<Longrightarrow> \n  leq_use_env rxa (comp_use_env rx (refl_use_env r_s1 r_s2 r))\"\n  apply (case_tac ra)\n    apply (auto)\n    apply (rule_tac r_sb=\"lift_use_env rxa ra\" in trans_leq_use_env)\n     apply (rule_tac refl_diff_comp_leq_use_env)\n       apply (auto)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac r_sb=\"lift_use_env rxa ra\" in trans_leq_use_env)\n    apply (rule_tac refl_diff_comp_leq_use_env)\n      apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (simp add: infl_use_env_def)\n  apply (simp add: refl_use_env_def)\n  apply (case_tac r)\n    apply (auto)\n  apply (rule_tac st_diff_comp_leq_use_env)\n  apply (simp)\n  done\n  \nlemma refl_disj_use_env: \"\\<lbrakk> leq_use_env r_ex r_x \\<rbrakk> \\<Longrightarrow> disj_use_env r_ex (refl_use_env r_s r_x r)\"  \n  apply (simp add: leq_use_env_def)\n  apply (simp add: disj_use_env_def)\n  apply (simp add: refl_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  done  \n  \nlemma safe_lift_refl_use_env: \"\\<lbrakk> safe_use_lift r_ex r \\<rbrakk> \\<Longrightarrow> safe_use_lift (refl_use_env r_s r_x r) r\"    \n  apply (case_tac r)\n    apply (auto)\n   apply (simp add: refl_use_env_def)\n  apply (simp add: refl_use_env_def)\n  apply (case_tac \"r_s x = OwnPerm \\<and> r_x x = NoPerm\")\n   apply (auto)\n  done\n  \nlemma trans_leq_perm: \"\\<lbrakk> leq_perm p q; leq_perm q r \\<rbrakk> \\<Longrightarrow> leq_perm p r\"  \n  apply (case_tac q)\n    apply (auto)\n    apply (case_tac p)\n      apply (auto)\n   apply (case_tac r)\n     apply (auto)\n  apply (case_tac r)\n    apply (auto)\n  done\n  \nlemma rswp_gen_leq_use_env: \"\\<lbrakk> leq_use_env r_ex r_s1; leq_use_env r_s2 (diff_use_env r_s1 r_ex);\n  leq_use_env (diff_use_env r_x r_ex) rx; (\\<forall> x. leq_perm (r_x x) r) \\<rbrakk> \\<Longrightarrow>\n  leq_use_env r_x (comp_use_env rx (refl_use_env r_s1 r_s2 r))\"\n  apply (case_tac \"(\\<forall> x. leq_perm (r_x x) (comp_use_env rx (refl_use_env r_s1 r_s2 r) x))\")\n   apply (simp add: leq_use_env_def)\n    apply (auto)\n    (* in all cases, if EX \\<noteq> Own, the case is trivial *)\n  apply (case_tac \"r_ex x \\<noteq> OwnPerm\")\n   apply (cut_tac r_x=\"diff_use_env r_x r_ex\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" and x=\"x\" in spec_leq_perm)\n    apply (rule_tac comp_leq_use_env1)\n    apply (simp)\n   apply (cut_tac r_s=\"r_x\" and r_x=\"r_ex\" and x=\"x\" in diff_use_eq)\n    apply (auto)\n    (* otherwise, split on r_s1 x1a = Own *)\n  apply (case_tac \"r_s1 x \\<noteq> OwnPerm\")\n   apply (cut_tac r_x=\"r_ex\" and r_s=\"r_s1\" and x=\"x\" in leq_use_own)\n     apply (auto)\n    (* - if r_s1 x1a = Own, and EX = Own, r_s2 x1a = None, meaning the reflective case is guaranteed to have a value. *)\n  apply (cut_tac r_x=\"r_s2\" and r_s=\"diff_use_env r_s1 r_ex\" and x=\"x\" in leq_use_none)\n    apply (simp)\n   apply (rule_tac diff_use_none_ex)\n   apply (auto)\n  apply (cut_tac r_x=\"r_x\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" and x=\"x\" in spec_leq_perm)\n   apply (cut_tac p=\"r_x x\" and q=\"refl_use_env r_s1 r_s2 r x\" and r=\"comp_use_env rx (refl_use_env r_s1 r_s2 r) x\" in trans_leq_perm)\n     apply (simp add: refl_use_env_def)\n    apply (rule_tac r_x=\"refl_use_env r_s1 r_s2 r\" in spec_leq_perm)\n    apply (rule_tac self_comp_leq_use_env2)\n   apply (auto)\n  done  \n\nlemma rswp_var_leq_use_env: \"\\<lbrakk> leq_use_env (ereq_use_env x1a tau) r_s1; leq_use_env r_ex r_s1; var_val_type rf tau_r tau;\n  leq_use_env r_s2 (diff_use_env r_s1 (comp_use_env (ereq_use_env x1a tau) r_ex)); safe_type_x tau r; rf \\<noteq> NoRef;\n  leq_use_env (diff_use_env (ereq_use_env x1a tau) (comp_use_env (ereq_use_env x1a tau) r_ex)) rx \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (ereq_use_env x1a tau) (comp_use_env rx (refl_use_env r_s1 r_s2 r))\"\n  apply (rule_tac r_x=\"ereq_use_env x1a tau\" and r_ex=\"comp_use_env (ereq_use_env x1a tau) r_ex\" in rswp_gen_leq_use_env)    \n     apply (rule_tac dist_comp_leq_use_env)\n      apply (auto)\n  apply (simp add: ereq_use_env_def)\n  apply (simp add: one_use_env_def)\n  apply (auto)\n  apply (simp add: end_req_perm_def)\n  apply (cut_tac tau_x=\"tau\" in var_value_unlim)\n    apply (auto)\n  apply (case_tac r)\n    apply (auto)\n  done\n\n    \nlemma safe_lift_drop_use_env: \"safe_use_lift (drop_use_env_dep r_s r) r\" \n  apply (case_tac r)\n    apply (auto)\n   apply (simp add: empty_use_env_def)\n  apply (simp add: drop_use_env_def)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n    \nlemma self_drop_dep_leq_use_env: \"leq_use_env (drop_use_env_dep r_s r) r_s\"    \n  apply (case_tac r)\n    apply (auto)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac self_drop_leq_use_env)\n  apply (rule_tac id_leq_use_env)\n  done\n    \nlemma drop_dep_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (drop_use_env_dep r_x r) r_s\"   \n  apply (rule_tac r_sb=\"r_x\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac self_drop_dep_leq_use_env)\n  done\n    \nlemma dist_drop_dep_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (drop_use_env_dep r_x r) (drop_use_env_dep r_s r)\"    \n  apply (case_tac r)\n    apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac dist_drop_leq_use_env)\n  apply (simp)\n  done\n  (*\nfun as_aff where\n  \"as_aff OwnPerm = Aff\"\n| \"as_aff UsePerm = Ref\"    \n| \"as_aff NoPerm = Prim\"  *)\n  \n  \n  (*\n    ### if we're going to re-prove this, we need to re-think the approach.\n    intuitively this lemma is true because rx + [r_s1 - r_s2] should contain the full set of requirements.\n\n    the hard part is - say that we had a pair. now it may have originally been typed with rx1 / rx2 that do\n    not fit within [r_s1 - r_s2].r. additionally, if we have a primitive pair, rx has no requirements over it.\n\n    \n  *)\n  \nlemma rswp_coerce: \"\\<lbrakk> \\<lbrakk>well_typed env r_s1 e1 tau r_s2 rx; is_sexp e1; safe_type_x tau r\\<rbrakk>\n           \\<Longrightarrow> well_typed env (comp_use_env rx (refl_use_env r_s1 r_s2 r)) e1 tau (comp_use_env rx (refl_use_env r_s1 r_s2 r))\n                (comp_use_env rx (refl_use_env r_s1 r_s2 r)); well_typed env r_s1 e1 tau r_s2 rx; is_sexp e1; safe_type_x tau r \\<rbrakk> \\<Longrightarrow>\n  well_typed env (comp_use_env rx (refl_use_env r_s1 r_s2 r)) e1 tau (comp_use_env rx (refl_use_env r_s1 r_s2 r))\n                (comp_use_env rx (refl_use_env r_s1 r_s2 r))\"\n  apply (auto)\n  done\n(*\nlemma refl_sexp_wp_ih: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e; safe_type_x tau r \\<rbrakk> \\<Longrightarrow>\n  well_typed env (comp_use_env rx (refl_use_env r_s1 r_s2 r)) e tau\n  (comp_use_env rx (refl_use_env r_s1 r_s2 r)) (comp_use_env rx (refl_use_env r_s1 r_s2 r))\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx r)\n        apply (auto)\n    (* const + op case *)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n    (* var case p1. *)\n      apply (rule_tac r_ex=\"r_ex\" in rswp_var_leq_use_env)\n            apply (auto)\n      apply (cut_tac v=\"x2a\" and tau=\"tau\" in var_value_prim1)\n        apply (auto)\n      apply (cut_tac v=\"x2a\" and tau_x=\"tau_x\" in var_value_unlim)\n        apply (auto)\n      apply (case_tac r)\n        apply (auto)\n      apply (simp add: unlim_def)\n    (* var case p2. *)\n     apply (cut_tac v=\"x2a\" and tau=\"tau\" in var_value_prim1)\n       apply (auto)\n     apply (cut_tac v=\"x2a\" and tau_x=\"tau_x\" in var_value_unlim)\n       apply (auto)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (rule_tac dist_weak_comp_use_env)\n          apply (rule_tac weak_ereq_use_env)\n          apply (simp add: unlim_def)\n         apply (simp add: weak_use_env_def)\n         apply (simp add: empty_use_env_def)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac r_ex=\"r_ex\" in rswp_var_leq_use_env)\n           apply (auto)\n     apply (cut_tac v=\"x2a\" and tau_x=\"tau_x\" in var_value_unlim)\n       apply (auto)\n     apply (case_tac r)\n       apply (auto)\n     apply (simp add: unlim_def)\n    (* pair case. *)\n    (* - prelim: ra \\<le> r *)(*\n    apply (case_tac \"\\<not> leq_perm ra r\")\n     apply (case_tac r)\n       apply (auto)\n      apply (case_tac ra)\n        apply (auto)\n    \n     apply (simp add: unlim_def)\n     apply (case_tac ra)\n       apply (auto)*)\n    (* - prelim: req t1 \\<le> ra *)\n    apply (case_tac \"\\<not> leq_perm (as_perm (req_type t1)) ra\")\n     apply (case_tac ra)\n       apply (auto)\n     apply (case_tac \"req_type t1\")\n       apply (auto)\n    (* - prelim: req t2 \\<le> ra *)\n    apply (case_tac \"\\<not> leq_perm (as_perm (req_type t2)) ra\")\n     apply (case_tac ra)\n       apply (auto)\n     apply (case_tac \"req_type t2\")\n       apply (auto)\n     apply (case_tac \"req_type t1\")\n       apply (auto)\n    (* - prelim: r_s3 \\<le> r_s1 *)\n    apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* - prelim: rx1 + EX \\<le> rx + EX *)\n    apply (cut_tac r_xa=\"lift_use_env (drop_use_env_dep rx1 (as_perm (req_type t1))) (as_perm (req_type t1))\" and\n      r_xb=\"refl_use_env r_s1 r_s2a (as_perm (req_type t1))\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in dist_comp_leq_use_env)\n      apply (rule_tac refl_diff_comp_leq_use_env)\n        apply (rule_tac safe_lift_drop_use_env)\n       apply (case_tac r)\n         apply (auto)\n       apply (case_tac ra)\n         apply (auto)\n    (* - primitive case *)\n      apply (case_tac \"req_type (PairTy t1 t2 ra) = Prim\")\n       apply (simp add: pair_req_def)\n       apply (case_tac \"ra = OwnPerm\")\n        apply (auto)\n       apply (case_tac \"req_type t1\")\n         apply (auto)\n        apply (case_tac \"req_type t2\")\n          apply (auto)\n       apply (rule_tac diff_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n    (* - non-primitive case *)\n      apply (simp add: pair_req_def)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 ra) (lift_use_env rx2 ra)) r_ex\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac comp_leq_use_env1)\n       apply (rule_tac r_sb=\"lift_use_env rx1 (as_perm (req_type t1))\" in trans_leq_use_env)\n        apply (rule_tac dist_lift_leq_use_env_gen)\n        apply (simp)\n       apply (rule_tac dist_lift_leq_use_env)\n       apply (rule_tac self_drop_dep_leq_use_env)\n      apply (rule_tac infl_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (auto)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac dist_refl_leq_use_env_gen)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n       apply (rule_tac diff_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (case_tac r)\n       apply (auto)\n     apply (case_tac ra)\n       apply (auto)\n    (* - prelim: rx2 + EX \\<le> rx + EX *)\n    apply (cut_tac r_xa=\"lift_use_env (drop_use_env_dep rx2 (as_perm (req_type t2))) (as_perm (req_type t2))\" and\n      r_xb=\"refl_use_env r_s2a r_s3 (as_perm (req_type t2))\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in dist_comp_leq_use_env)\n      apply (rule_tac refl_diff_comp_leq_use_env)\n        apply (rule_tac safe_lift_drop_use_env)\n       apply (case_tac r)\n         apply (auto)\n       apply (case_tac ra)\n         apply (auto)\n    (* - primitive case *)\n      apply (case_tac \"req_type (PairTy t1 t2 ra) = Prim\")\n       apply (simp add: pair_req_def)\n       apply (case_tac \"ra = OwnPerm\")\n        apply (auto)\n       apply (case_tac \"req_type t2\")\n         apply (auto)\n         apply (case_tac \"req_type t1\")\n           apply (auto)\n        apply (case_tac \"req_type t1\")\n          apply (auto)\n       apply (rule_tac diff_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n    (* - non-primitive case *)\n    apply (simp add: pair_req_def)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 ra) (lift_use_env rx2 ra)) r_ex\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac comp_leq_use_env2)\n       apply (rule_tac r_sb=\"lift_use_env rx2 (as_perm (req_type t2))\" in trans_leq_use_env)\n        apply (rule_tac dist_lift_leq_use_env_gen)\n        apply (simp)\n       apply (rule_tac dist_lift_leq_use_env)\n       apply (rule_tac self_drop_dep_leq_use_env)\n      apply (rule_tac infl_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (auto)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac dist_refl_leq_use_env_gen)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n      apply (auto)\n     apply (case_tac r)\n       apply (auto)\n     apply (case_tac ra)\n       apply (auto)\n      (* e1 well-typedness. *)    \n    apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n    apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n    apply (rule_tac x=\"comp_use_env (drop_use_env_dep rx1 ra) (refl_use_env r_s1 r_s2a ra)\" in exI)\n    apply (auto)\n     apply (rule_tac rx=\"comp_use_env (drop_use_env_dep rx1 (as_perm (req_type t1))) (refl_use_env r_s1 r_s2a (as_perm (req_type t1)))\" in well_typed_incr_req)\n       apply (rule_tac r_s=\"comp_use_env (drop_use_env_dep rx1 (as_perm (req_type t1))) (refl_use_env r_s1 r_s2a (as_perm (req_type t1)))\" in well_typed_incr_simul_perm)\n        apply (rule_tac r_sb=\"comp_use_env (lift_use_env (drop_use_env_dep rx1 (as_perm (req_type t1))) (as_perm (req_type t1)))\n        (refl_use_env r_s1 r_s2a (as_perm (req_type t1)))\" in trans_leq_use_env)\n         apply (simp)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (rule_tac comp_leq_use_env1)\n         apply (rule_tac self_lift_leq_use_env)\n        apply (rule_tac self_comp_leq_use_env2)\n       apply (rule_tac rswp_coerce)\n          apply (auto)\n    \n  \n  (* the goal of this is to come up with flat permissions that are still \"safe.\" *)\nlemma refl_sexp_wp_ih: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; safe_use_lift r_s1 r; is_sexp e; safe_type tau r \\<rbrakk> \\<Longrightarrow>\n  well_typed env (comp_use_env rx (refl_use_env r_s1 r_s2 r)) e tau\n  (comp_use_env rx (refl_use_env r_s1 r_s2 r)) (comp_use_env rx (refl_use_env r_s1 r_s2 r))\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx r)\n        apply (auto)\n    (* const + op case *)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n    (* var case p1. *)\n      apply (rule_tac r_ex=\"r_ex\" in rswp_var_leq_use_env)\n            apply (auto)\n      apply (cut_tac v=\"x2a\" and tau_x=\"tau_x\" in var_value_unlim)\n        apply (auto)\n      apply (case_tac r)\n        apply (auto)\n      apply (simp add: unlim_def)\n    (* var case p2. *)\n     apply (cut_tac v=\"x2a\" and tau_x=\"tau_x\" in var_value_unlim)\n       apply (auto)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (rule_tac dist_weak_comp_use_env)\n          apply (rule_tac weak_ereq_use_env)\n          apply (simp add: unlim_def)\n         apply (simp add: weak_use_env_def)\n         apply (simp add: empty_use_env_def)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac r_ex=\"r_ex\" in rswp_var_leq_use_env)\n           apply (auto)\n     apply (cut_tac v=\"x2a\" and tau_x=\"tau_x\" in var_value_unlim)\n       apply (auto)\n     apply (case_tac r)\n       apply (auto)\n     apply (simp add: unlim_def)\n    (* pair case. *)\n    (* - prelim: ra \\<le> r *)\n    apply (case_tac \"\\<not> leq_perm ra r\")\n     apply (case_tac r)\n       apply (auto)\n     apply (simp add: unlim_def)\n     apply (case_tac ra)\n       apply (auto)\n    (* - prelim: req t1 \\<le> ra *)\n    apply (case_tac \"\\<not> leq_perm (as_perm (req_type t1)) ra\")\n     apply (case_tac ra)\n       apply (auto)\n     apply (case_tac \"req_type t1\")\n       apply (auto)\n    (* - prelim: req t2 \\<le> ra *)\n    apply (case_tac \"\\<not> leq_perm (as_perm (req_type t2)) ra\")\n     apply (case_tac ra)\n       apply (auto)\n     apply (case_tac \"req_type t2\")\n       apply (auto)\n     apply (case_tac \"req_type t1\")\n       apply (auto)\n    (* - prelim: r_s3 \\<le> r_s1 *)\n    apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* - prelim: rx1 + EX \\<le> rx + EX *)\n    apply (cut_tac r_xa=\"lift_use_env (drop_use_env_dep rx1 (as_perm (req_type t1))) (as_perm (req_type t1))\" and\n      r_xb=\"refl_use_env r_s1 r_s2a (as_perm (req_type t1))\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in dist_comp_leq_use_env)\n      apply (rule_tac refl_diff_comp_leq_use_env)\n        apply (rule_tac safe_lift_drop_use_env)\n       apply (case_tac r)\n         apply (auto)\n       apply (case_tac ra)\n         apply (auto)\n    (* - primitive case *)\n      apply (case_tac \"req_type (PairTy t1 t2 ra) = Prim\")\n       apply (simp add: pair_req_def)\n       apply (case_tac \"ra = OwnPerm\")\n        apply (auto)\n       apply (case_tac \"req_type t1\")\n         apply (auto)\n        apply (case_tac \"req_type t2\")\n          apply (auto)\n       apply (rule_tac diff_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n    (* - non-primitive case *)\n      apply (simp add: pair_req_def)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 ra) (lift_use_env rx2 ra)) r_ex\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac comp_leq_use_env1)\n       apply (rule_tac r_sb=\"lift_use_env rx1 (as_perm (req_type t1))\" in trans_leq_use_env)\n        apply (rule_tac dist_lift_leq_use_env_gen)\n        apply (simp)\n       apply (rule_tac dist_lift_leq_use_env)\n       apply (rule_tac self_drop_dep_leq_use_env)\n      apply (rule_tac infl_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (auto)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac dist_refl_leq_use_env_gen)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n       apply (rule_tac diff_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (case_tac r)\n       apply (auto)\n     apply (case_tac ra)\n       apply (auto)\n    (* - prelim: rx2 + EX \\<le> rx + EX *)\n    apply (cut_tac r_xa=\"lift_use_env (drop_use_env_dep rx2 (as_perm (req_type t2))) (as_perm (req_type t2))\" and\n      r_xb=\"refl_use_env r_s2a r_s3 (as_perm (req_type t2))\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in dist_comp_leq_use_env)\n      apply (rule_tac refl_diff_comp_leq_use_env)\n        apply (rule_tac safe_lift_drop_use_env)\n       apply (case_tac r)\n         apply (auto)\n       apply (case_tac ra)\n         apply (auto)\n    (* - primitive case *)\n      apply (case_tac \"req_type (PairTy t1 t2 ra) = Prim\")\n       apply (simp add: pair_req_def)\n       apply (case_tac \"ra = OwnPerm\")\n        apply (auto)\n       apply (case_tac \"req_type t2\")\n         apply (auto)\n         apply (case_tac \"req_type t1\")\n           apply (auto)\n        apply (case_tac \"req_type t1\")\n          apply (auto)\n       apply (rule_tac diff_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n    (* - non-primitive case *)\n    apply (simp add: pair_req_def)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 ra) (lift_use_env rx2 ra)) r_ex\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac comp_leq_use_env2)\n       apply (rule_tac r_sb=\"lift_use_env rx2 (as_perm (req_type t2))\" in trans_leq_use_env)\n        apply (rule_tac dist_lift_leq_use_env_gen)\n        apply (simp)\n       apply (rule_tac dist_lift_leq_use_env)\n       apply (rule_tac self_drop_dep_leq_use_env)\n      apply (rule_tac infl_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (auto)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac dist_refl_leq_use_env_gen)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n      apply (auto)\n     apply (case_tac r)\n       apply (auto)\n     apply (case_tac ra)\n       apply (auto)\n      (* e1 well-typedness. *)    \n    apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n    apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n    apply (rule_tac x=\"comp_use_env (drop_use_env_dep rx1 ra) (refl_use_env r_s1 r_s2a ra)\" in exI)\n    apply (auto)\n     apply (rule_tac rx=\"comp_use_env (drop_use_env_dep rx1 (as_perm (req_type t1))) (refl_use_env r_s1 r_s2a (as_perm (req_type t1)))\" in well_typed_incr_req)\n       apply (rule_tac r_s=\"comp_use_env (drop_use_env_dep rx1 (as_perm (req_type t1))) (refl_use_env r_s1 r_s2a (as_perm (req_type t1)))\" in well_typed_incr_simul_perm)\n        apply (rule_tac r_sb=\"comp_use_env (lift_use_env (drop_use_env_dep rx1 (as_perm (req_type t1))) (as_perm (req_type t1)))\n        (refl_use_env r_s1 r_s2a (as_perm (req_type t1)))\" in trans_leq_use_env)\n         apply (simp)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (rule_tac comp_leq_use_env1)\n         apply (rule_tac self_lift_leq_use_env)\n        apply (rule_tac self_comp_leq_use_env2)\n       apply (case_tac \"\\<not> safe_use_lift r_s1 (as_perm (req_type t1))\")\n    \n    \n    \n    \n    (* pair case. *)\n    (* - prelim: ra \\<le> r *)\n    apply (case_tac \"\\<not> leq_perm ra r\")\n     apply (case_tac r)\n       apply (auto)\n     apply (simp add: unlim_def)\n     apply (case_tac ra)\n       apply (auto)\n    (* - split by primitivity *)\n    apply (case_tac \"req_type (PairTy t1 t2 ra) = Prim\")\n     apply (case_tac ra)\n       apply (auto)\n     apply (case_tac \"\\<not> (req_type t1 = Prim \\<and> req_type t2 = Prim)\")\n      apply (case_tac \"req_type t1\")\n        apply (auto)\n       apply (case_tac \"req_type t2\")\n         apply (auto)\n      apply (case_tac \"req_type t2\")\n        apply (auto)\n     apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n     apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n      apply (cut_tac e=\"e1\" in value_is_sexp)\n       apply (auto)\n      apply (rule_tac rx=\"comp_use_env empty_use_env (refl_use_env r_s1 r_s2a r)\" in wt_sexp_no_req)\n        apply (rule_tac r_s=\"comp_use_env empty_use_env (refl_use_env r_s1 r_s2a r)\" in well_typed_incr_simul_perm)\n         apply (cut_tac r_xa=\"empty_use_env\" and r_xb=\"refl_use_env r_s1 r_s2a r\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in dist_comp_leq_use_env)\n           apply (rule_tac leq_empty_use_env)\n          apply (rule_tac comp_leq_use_env2)\n          apply (rule_tac dist_refl_leq_use_env)\n           apply (rule_tac id_leq_use_env)\n          apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n           apply (rule_tac diff_leq_use_env)\n           apply (rule_tac well_typed_perm_leq)\n           apply (auto)\n      apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e1\" and ?r_s2.0=\"r_s2a\" and rx=\"rx1\" in wt_sexp_no_req)\n         apply (auto)\n      apply (case_tac \"\\<not> safe_type t1 r\")\n       apply (auto)\n      apply (case_tac r)\n        apply (auto)\n      apply (simp add: unlim_def)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n         apply (cut_tac e=\"e2\" in value_is_sexp)\n          apply (auto)\n         apply (rule_tac rx=\"comp_use_env empty_use_env (refl_use_env r_s2a r_s3 r)\" in wt_sexp_no_req)\n           apply (rule_tac r_s=\"comp_use_env empty_use_env (refl_use_env r_s2a r_s3 r)\" in well_typed_incr_simul_perm)\n            apply (cut_tac r_xa=\"empty_use_env\" and r_xb=\"refl_use_env r_s2a r_s3 r\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in dist_comp_leq_use_env)\n              apply (rule_tac leq_empty_use_env)\n             apply (rule_tac comp_leq_use_env2)\n             apply (rule_tac dist_refl_leq_use_env)\n              apply (rule_tac well_typed_perm_leq)\n              apply (auto)\n          apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n           apply (rule_tac self_diff_leq_use_env)\n          apply (auto)\n         apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s3\" and tau=\"t2\" and rx=\"rx2\" in wt_sexp_no_req)\n            apply (auto)\n         apply (case_tac \"\\<not> safe_type t2 r\")\n          apply (auto)\n         apply (case_tac r)\n           apply (auto)\n         apply (simp add: unlim_def)\n        apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in safe_lift_leq_use_env)\n         apply (rule_tac well_typed_perm_leq)\n         apply (auto)\n        apply (rule_tac leq_empty_use_env)\n      apply (rule_tac disj_empty_use_env2)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (simp add: weak_use_env_def)\n         apply (simp add: empty_use_env_def)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac leq_empty_use_env)\n     apply (simp add: pair_req_def)\n     apply (rule_tac leq_empty_use_env)\n    (* pair case. normal case *)\n    apply (simp add: pair_req_def)\n    (* - prelim: r_s3 \\<le> r_s1 *)\n    apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* - prelim: rx1 + EX \\<le> rx + EX *)\n    apply (cut_tac r_xa=\"lift_use_env rx1 ra\" and r_xb=\"refl_use_env r_s1 r_s2a ra\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in dist_comp_leq_use_env)\n      apply (rule_tac refl_diff_comp_leq_use_env)\n        apply (simp_all)\n       apply (cut_tac r_x=\"rx1\" and r_s=\"r_s1\" in safe_lift_leq_use_env_gen)\n        apply (rule_tac r_sb=\"lift_use_env rx1 ra\" in trans_leq_use_env)\n         apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n          apply (simp_all)\n        apply (rule_tac self_lift_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 ra) (lift_use_env rx2 ra)) r_ex\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac self_comp_leq_use_env1)\n      apply (rule_tac infl_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (auto)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac dist_refl_leq_use_env_gen)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n       apply (rule_tac diff_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n    (* - prelim: rx2 + EX \\<le> rx + EX *)\n    apply (cut_tac r_xa=\"lift_use_env rx2 ra\" and r_xb=\"refl_use_env r_s2a r_s3 ra\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in dist_comp_leq_use_env)\n      apply (rule_tac refl_diff_comp_leq_use_env)\n        apply (simp_all)\n       apply (cut_tac r_x=\"rx2\" and r_s=\"r_s1\" in leq_weak_use_env)\n         apply (simp)\n        apply (rule_tac r_sb=\"lift_use_env rx2 ra\" in trans_leq_use_env)\n         apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n          apply (simp_all)\n        apply (rule_tac self_lift_leq_use_env)\n       apply (case_tac ra)\n         apply (auto)\n       apply (simp add: weak_use_env_def)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 ra) (lift_use_env rx2 ra)) r_ex\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac self_comp_leq_use_env2)\n      apply (rule_tac infl_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (auto)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac dist_refl_leq_use_env_gen)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (auto)\n    (* well-typedness *)\n    apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n    apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n    apply (rule_tac x=\"comp_use_env rx1 (refl_use_env r_s1 r_s2a ra)\" in exI)\n    apply (auto)\n     apply (rule_tac r_s=\"comp_use_env rx1 (refl_use_env r_s1 r_s2a ra)\" in well_typed_incr_simul_perm)\n      apply (rule_tac r_sb=\"comp_use_env (lift_use_env rx1 ra) (refl_use_env r_s1 r_s2a ra)\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac comp_leq_use_env1)\n       apply (rule_tac self_lift_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env2)\n     apply (cut_tac e=\"e1\" in value_is_sexp)\n      apply (auto)\n     apply (case_tac \"\\<not> safe_type t1 ra\")\n      apply (case_tac ra)\n        apply (auto)\n     apply (case_tac r)\n       apply (auto)\n      apply (simp add: unlim_def)\n     apply (simp add: unlim_def)\n    \n    \n      apply (case_tac \"ra = OwnPerm\")\n       apply (auto)\n    apply (case_tac \"\\<not> leq_perm ra ra\")\n     apply (case_tac ra)\n        apply (auto)\n    apply (rule_tac x=\"comp_use_env rx2 (refl_use_env r_s2a r_s3 ra)\" in exI)\n    apply (auto)\n          apply (rule_tac r_s=\"comp_use_env rx2 (refl_use_env r_s2a r_s3 ra)\" in well_typed_incr_simul_perm)\n           apply (rule_tac r_sb=\"comp_use_env (lift_use_env rx2 ra) (refl_use_env r_s2a r_s3 ra)\" in trans_leq_use_env)\n            apply (simp)\n           apply (rule_tac dist_comp_leq_use_env)\n            apply (rule_tac comp_leq_use_env1)\n            apply (rule_tac self_lift_leq_use_env)\n           apply (rule_tac self_comp_leq_use_env2)\n          apply (cut_tac e=\"e2\" in value_is_sexp)\n           apply (auto)\n         apply (simp add: lift_comp_use_env)\n         apply (simp add: refl_lift_use_env)\n        apply (simp add: lift_comp_use_env)\n        apply (simp add: refl_lift_use_env)\n       apply (rule_tac safe_lift_comp_use_env)\n        apply (simp)\n       apply (rule_tac safe_lift_refl_use_env)\n       apply (simp)\n      apply (rule_tac safe_lift_comp_use_env)\n       apply (simp)\n      apply (rule_tac safe_lift_refl_use_env)\n      apply (simp)\n     apply (simp add: lift_comp_use_env)\n     apply (simp add: refl_lift_use_env)\n     apply (rule_tac disj_comp_use_env1)\n      apply (rule_tac disj_comp_use_env2)\n       apply (simp)\n      apply (rule_tac refl_disj_use_env)\n      apply (simp)\n     apply (rule_tac disj_comp_use_env2)\n      apply (rule_tac comm_disj_use_env)\n      apply (rule_tac refl_disj_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (rule_tac comm_disj_use_env)\n     apply (rule_tac refl_disj_use_env)\n     apply (rule_tac refl_leq_use_env)\n    (* - existentials *)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n       apply (rule_tac rhs_weak_leq_use_env)\n        apply (simp add: weak_use_env_def)\n        apply (simp add: empty_use_env_def)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (simp add: lift_comp_use_env)\n     apply (simp add: refl_lift_use_env)\n    apply (simp add: lift_comp_use_env)\n    apply (simp add: refl_lift_use_env)\n    (* lam case. prelim: this inequality is used twice *)\n   apply (cut_tac r_x=\"rxa\" and r_ex=\"r_ex\" and ?r_s1.0=\"r_s1\" and ?r_s2.0=\"r_s2\" and r=\"r\" in rswp_gen_leq_use_env)\n       apply (auto)\n    apply (case_tac r)\n      apply (auto)\n    apply (simp add: unlim_def)\n    apply (simp add: aff_use_env_def)\n    apply (case_tac a)\n      apply (auto)\n     apply (simp add: weak_use_env_def)\n     apply (case_tac \"rxa x\")\n       apply (auto)\n    apply (simp add: null_use_env_def)(*\n   apply (cut_tac r_x=\"rxa\" and r_s=\"rx\" and r_ex=\"infl_use_env r_s1 r_s2\" in st_diff_comp_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env rxa r_ex\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env_cut)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac infl_leq_use_env)\n     apply (simp_all)*)\n    (* - existentials *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n      apply (rule_tac rhs_weak_leq_use_env)\n       apply (simp add: weak_use_env_def)\n       apply (simp add: empty_use_env_def)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac diff_leq_use_env)\n   apply (simp)\n    (* app case.*)\n  apply (case_tac e1)\n       apply (auto)\n    (* - proof for e1 *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"ra\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n  apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n    (* proof for e2. *)\n    (* - prelim: empty env is weak *)\n  apply (case_tac \"\\<not> weak_use_env empty_use_env\")\n   apply (simp add: weak_use_env_def)\n   apply (simp add: empty_use_env_def)\n    (* - split by primitivity *)\n  apply (case_tac \"req_type tau = Prim\")\n   apply (case_tac x1)\n               apply (auto)\n        apply (simp_all add: pure_fun_def)\n   apply (case_tac e2)\n         apply (auto)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n   apply (auto)\n    apply (rule_tac x=\"rxa\" in exI)\n    apply (auto)\n     apply (simp add: leq_use_env_def)\n     apply (simp add: aff_use_env_def)\n     apply (simp add: null_use_env_def)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n      apply (rule_tac disj_diff_leq_use_env)\n       apply (rule_tac disj_empty_use_env2)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (simp add: leq_use_env_def)\n    apply (simp add: aff_use_env_def)\n    apply (simp add: null_use_env_def)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n         apply (rule_tac rhs_weak_leq_use_env)\n          apply (rule_tac dist_weak_comp_use_env)\n           apply (rule_tac dist_weak_comp_use_env)\n            apply (auto)\n         apply (rule_tac id_leq_use_env)\n        apply (simp add: empty_use_env_def)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac leq_empty_use_env)\n       apply (rule_tac leq_empty_use_env)\n      apply (rule_tac disj_empty_use_env2)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (simp add: app_req_def)\n   apply (rule_tac leq_empty_use_env)\n    (* app case for non-primitive cases. *)\n  apply (simp add: app_req_def)\n    (* - prelim: ra = Use *)\n  apply (case_tac \"ra \\<noteq> UsePerm\")\n   apply (case_tac x1)\n               apply (auto)\n        apply (simp_all add: pure_fun_def)\n    (* - prelim: corollary, ra \\<le> r. *)\n  apply (case_tac \"\\<not> leq_perm UsePerm r\")\n   apply (case_tac r)\n     apply (auto)\n    (* - prelim: r_s3 \\<le> r_s1 *)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (simp)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n    (* - prelim: proves the req is contained in the end perms *)\n  apply (case_tac \"\\<not> leq_use_env (comp_use_env rx2 (refl_use_env r_s2a r_s3 UsePerm)) (comp_use_env rx (refl_use_env r_s1 r_s2 r))\")\n   apply (cut_tac r_xa=\"rx2\" and r_xb=\"refl_use_env r_s2a r_s3 UsePerm\" and r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in dist_comp_leq_use_env)\n     apply (rule_tac ra=\"UsePerm\" in refl_diff_comp_leq_use_env_x)\n       apply (auto)\n    apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 UsePerm)) r_ex)\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env_cut)\n     apply (rule_tac self_comp_leq_use_env2)\n    apply (rule_tac infl_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 UsePerm)) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (auto)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n   apply (rule_tac comp_leq_use_env2)\n   apply (rule_tac dist_refl_leq_use_env_gen)\n     apply (auto)\n   apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 UsePerm)) r_ex)\" in trans_leq_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (auto)\n    (* typing of e2 *)\n  apply (rule_tac x=\"comp_use_env rx2 (refl_use_env r_s2a r_s3 UsePerm)\" in exI)\n  apply (rule_tac x=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in exI)\n  apply (auto)\n   apply (rule_tac r_s=\"comp_use_env rx2 (refl_use_env r_s2a r_s3 UsePerm)\" in  well_typed_incr_simul_perm)\n    apply (simp)\n   apply (case_tac \"\\<not> is_sexp e2\")\n    apply (case_tac \"\\<not> is_value e2\")\n     apply (case_tac x1)\n                 apply (auto)\n    apply (case_tac e2)\n          apply (auto)\n   apply (cut_tac e=\"e2\" in value_is_sexp)\n    apply (auto)\n    (* - prelim: rx2 + refl_use_env r_s1 r_s2 ra is weak *)\n  apply (case_tac \"\\<not> weak_use_env (comp_use_env rx2 (refl_use_env r_s2a r_s3 UsePerm))\")\n   apply (cut_tac r_sa=\"rx2\" and r_sb=\"refl_use_env r_s2a r_s3 UsePerm\" in dist_weak_comp_use_env)\n     apply (simp add: weak_use_env_def)\n    apply (simp add: weak_use_env_def)\n    apply (simp add: refl_use_env_def)\n   apply (simp)\n    (* existentials *)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n    (* - end permissions bound *)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (rule_tac dist_weak_comp_use_env)\n          apply (rule_tac dist_weak_comp_use_env)\n           apply (simp_all)\n        apply (rule_tac id_leq_use_env)\n    (* - affinity *)\n       apply (simp add: weak_use_env_def)\n    (* - requirements containment *)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n      apply (simp)\n    (* - disjointness *)\n    apply (rule_tac disj_empty_use_env2)\n    (* - in-between bound *)\n    apply (rule_tac id_leq_use_env)\n    (* - subtracter containment *)\n   apply (rule_tac leq_empty_use_env)\n    (* - requirements bound *)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp)\n  done\n\nlemma refl_full_sexp_wp: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e; safe_type tau r \\<rbrakk> \\<Longrightarrow>\n  well_typed env r_s1 e tau r_s1 (comp_use_env rx (refl_use_env r_s1 r_s2 r))\" \n  apply (rule_tac r_s=\"comp_use_env rx (refl_use_env r_s1 r_s2 r)\" in well_typed_incr_simul_perm)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (rule_tac well_typed_perm_leqx)\n    apply (auto)\n   apply (rule_tac refl_leq_use_env)\n  apply (rule_tac refl_sexp_wp)\n    apply (auto)\n  done      *)\n\n    (*\nlemma drop_infl_use_env: \"drop_use_env (infl_use_env r_s r_x) = refl_use_env r_s r_x UsePerm\"    \n  apply (case_tac \"\\<forall> x. drop_use_env (infl_use_env r_s r_x) x = refl_use_env r_s r_x UsePerm x\")\n   apply (auto)\n  apply (simp add: drop_use_env_def)\n  apply (simp add: infl_use_env_def)\n  apply (simp add: refl_use_env_def)\n  apply (case_tac \"r_s x = OwnPerm \\<and> r_x x = NoPerm\")\n   apply (auto)\n   apply (simp add: infl_use_env_def)\n  apply (simp add: infl_use_env_def)\n  done\n*)\nlemma refl_infl_use_env: \"infl_use_env r_s r_x = refl_use_env r_s r_x OwnPerm\"    \n  apply (case_tac \"\\<forall> x. infl_use_env r_s r_x x = refl_use_env r_s r_x OwnPerm x\")\n   apply (auto) \n  apply (simp add: infl_use_env_def)\n  apply (simp add: refl_use_env_def)\n  done    \n    \n  \n  (** ## THE MOST GENERAL VERSION OF THIS LEMMA **)\n    \n  \nlemma infl_sexp_wp: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e \\<rbrakk> \\<Longrightarrow> well_typed env (comp_use_env rx (infl_use_env r_s1 r_s2)) e tau\n  (comp_use_env rx (infl_use_env r_s1 r_s2)) (comp_use_env rx (infl_use_env r_s1 r_s2))\"\n  apply (induct e arbitrary: r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const + op cases *)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n    (* var cases p1. *)\n      apply (rule_tac st_diff_comp_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env (ereq_use_env x1a tau_x) (comp_use_env (ereq_use_env x1a tau_x) r_ex)\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac infl_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (simp_all)\n    (* var cases p2. *)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (rule_tac dist_weak_comp_use_env)\n          apply (rule_tac weak_ereq_use_env)\n          apply (cut_tac tau_x=\"tau_x\" in var_value_unlim)\n            apply (auto)\n          apply (simp add: unlim_def)\n         apply (simp add: weak_use_env_def)\n         apply (simp add: empty_use_env_def)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac r_ex=\"r_ex\" in lhs_diff_leq_use_env)\n      apply (rule_tac comp_leq_use_env1)\n      apply (rule_tac lhs_fold_dcl_use_env)\n      apply (rule_tac lhs_flip_use_env)\n      apply (rule_tac lhs_unroll_dcl_use_env)\n      apply (rule_tac lhs_unroll_dcl_use_env)\n      apply (rule_tac diff_leq_use_env)\n      apply (rule_tac lhs_fold_dcl_use_env)\n      apply (rule_tac lhs_flip_use_env)\n      apply (simp)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac infl_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env x1a tau_x) r_ex)\" in trans_leq_use_env)\n       apply (rule_tac dist_diff_leq_use_env_gen)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac self_comp_leq_use_env2)\n      apply (simp_all)\n    (* pair case. prim case *)\n    apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n     apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n     apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n      apply (rule_tac r_s=\"empty_use_env\" in well_typed_incr_simul_perm)\n       apply (rule_tac leq_empty_use_env)\n      apply (rule_tac wt_sexp_no_all)\n        apply (auto)\n       apply (case_tac r)\n        apply (auto)\n       apply (case_tac \"req_type t1\")\n         apply (auto)\n       apply (case_tac \"req_type t2\")\n         apply (auto)\n      apply (rule_tac value_is_sexp)\n      apply (simp)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n        apply (rule_tac r_s=\"empty_use_env\" in well_typed_incr_simul_perm)\n         apply (rule_tac leq_empty_use_env)\n        apply (rule_tac wt_sexp_no_all)\n          apply (auto)\n         apply (case_tac \"r\")\n          apply (auto)\n         apply (case_tac \"req_type t1\")\n           apply (auto)\n          apply (case_tac \"req_type t2\")\n            apply (auto)\n         apply (case_tac \"req_type t2\")\n           apply (auto)\n        apply (cut_tac e=\"e2\" in value_is_sexp)\n         apply (auto)\n       apply (simp add: lift_empty_use_env)\n       apply (rule_tac leq_empty_use_env)\n      apply (simp add: lift_empty_use_env)\n      apply (rule_tac disj_empty_use_env2)\n     apply (simp add: lift_empty_use_env)\n     apply (case_tac \"\\<not> weak_use_env empty_use_env\")\n      apply (simp add: weak_use_env_def)\n      apply (simp add: empty_use_env_def)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (simp)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac leq_empty_use_env)\n     apply (simp add: pair_req_def)\n     apply (rule_tac leq_empty_use_env)\n    (* pair case. non-primitve case *)\n    apply (simp add: pair_req_def)\n    (* - prelim: r_s3 \\<le> r_s1 *)\n    apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* - prelim: rx1 + EX \\<le> rx + EX *)\n    apply (cut_tac r_xa=\"lift_use_env rx1 r\" and r_xb=\"infl_use_env r_s1 r_s2a\" and r_s=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in dist_comp_leq_use_env)\n      apply (rule_tac st_diff_comp_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac self_comp_leq_use_env1)\n      apply (rule_tac infl_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (simp_all)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac dist_infl_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac diff_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    (* - prelim: rx2 + EX \\<le> rx + EX *)\n    apply (cut_tac r_xa=\"lift_use_env rx2 r\" and r_xb=\"infl_use_env r_s2a r_s3\" and r_s=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in dist_comp_leq_use_env)\n      apply (rule_tac st_diff_comp_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac self_comp_leq_use_env2)\n      apply (rule_tac infl_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (simp_all)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac dist_infl_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (auto)\n    (* - well-typedness for e1 *)\n    apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n    apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n    apply (rule_tac x=\"comp_use_env rx1 (infl_use_env r_s1 r_s2a)\" in exI)\n    apply (auto)\n     apply (rule_tac r_s=\"comp_use_env rx1 (infl_use_env r_s1 r_s2a)\" in well_typed_incr_simul_perm)\n      apply (rule_tac r_sb=\"comp_use_env (lift_use_env rx1 r) (infl_use_env r_s1 r_s2a)\" in trans_leq_use_env)\n       apply (auto)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac comp_leq_use_env1)\n       apply (rule_tac self_lift_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env2)\n     apply (cut_tac e=\"e1\" in value_is_sexp)\n      apply (auto)\n    (* - well-typedness for e2 *)\n    apply (rule_tac x=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in exI)\n    apply (auto)\n        apply (rule_tac r_s=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_simul_perm)\n         apply (rule_tac r_sb=\"comp_use_env (lift_use_env rx2 r) (infl_use_env r_s2a r_s3)\" in trans_leq_use_env)\n          apply (auto)\n         apply (rule_tac dist_comp_leq_use_env)\n          apply (rule_tac comp_leq_use_env1)\n          apply (rule_tac self_lift_leq_use_env)\n         apply (rule_tac self_comp_leq_use_env2)\n        apply (cut_tac e=\"e2\" in value_is_sexp)\n         apply (auto)\n    (* - first boundaries *)\n       apply (simp add: lift_comp_use_env)\n       apply (simp add: infl_lift_use_env)\n      apply (simp add: lift_comp_use_env)\n      apply (simp add: infl_lift_use_env)\n     apply (simp add: lift_comp_use_env)\n     apply (simp add: infl_lift_use_env)\n     apply (rule_tac disj_comp_use_env1)\n      apply (rule_tac disj_comp_use_env2)\n       apply (simp)\n      apply (rule_tac infl_disj_use_env)\n      apply (simp)\n     apply (rule_tac disj_comp_use_env2)\n      apply (rule_tac comm_disj_use_env)\n      apply (rule_tac infl_disj_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (rule_tac comm_disj_use_env)\n     apply (rule_tac infl_disj_use_env)\n     apply (rule_tac self_infl_leq_use_env)\n    (* - secondary boundaries *)\n    apply (case_tac \"\\<not> weak_use_env empty_use_env\")\n     apply (simp add: weak_use_env_def)\n     apply (simp add: empty_use_env_def)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n       apply (rule_tac rhs_weak_leq_use_env)\n        apply (simp)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (simp add: lift_comp_use_env)\n    apply (simp add: infl_lift_use_env)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (auto)\n    (* lam case  *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n    apply (rule_tac st_diff_comp_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env rxa r_ex\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env_cut)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac infl_leq_use_env)\n     apply (simp_all)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n      apply (rule_tac rhs_weak_leq_use_env)\n       apply (simp add: weak_use_env_def)\n       apply (simp add: empty_use_env_def)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac diff_leq_use_env)\n   apply (rule_tac st_diff_comp_leq_use_env)\n   apply (rule_tac r_sb=\"diff_use_env rxa r_ex\" in trans_leq_use_env)\n    apply (simp)\n   apply (rule_tac dist_diff_leq_use_env_cut)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac infl_leq_use_env)\n    apply (simp_all)\n    (* app case. primitive case *)\n  apply (case_tac \"req_type tau = Prim\")\n   apply (rule_tac x=\"t1\" in exI)\n   apply (rule_tac x=\"r\" in exI)\n   apply (rule_tac x=\"a\" in exI)\n   apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n    apply (case_tac e1)\n          apply (auto)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n   apply (auto)\n    apply (rule_tac r_s=\"empty_use_env\" in well_typed_incr_simul_perm)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac wt_sexp_no_all)\n      apply (auto)\n     apply (case_tac e1)\n           apply (auto)\n     apply (case_tac x1)\n                 apply (auto)\n          apply (simp_all add: pure_fun_def)\n    apply (case_tac \"\\<not> is_value e2\")\n     apply (case_tac e1)\n           apply (auto)\n     apply (case_tac x1)\n                 apply (auto)\n     apply (case_tac e2)\n           apply (auto)\n    apply (rule_tac value_is_sexp)\n    apply (simp)\n   apply (case_tac \"\\<not> weak_use_env empty_use_env\")\n    apply (simp add: weak_use_env_def)\n    apply (simp add: empty_use_env_def)\n   apply (simp add: lift_empty_use_env)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (rule_tac dist_weak_comp_use_env)\n          apply (rule_tac dist_weak_comp_use_env)\n           apply (simp_all)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac leq_empty_use_env)\n       apply (rule_tac leq_empty_use_env)\n      apply (rule_tac disj_empty_use_env2)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (simp add: app_req_def)\n   apply (rule_tac leq_empty_use_env)\n    (* app case. non-primitive case *)\n  apply (simp add: app_req_def)\n    (* - prelim: r_s3 \\<le> r_s1 *)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n    (* - prelim: rx1 + EX \\<le> rx + EX *)(*\n  apply (cut_tac r_xa=\"rx1\" and r_xb=\"infl_use_env r_s1 r_s2a\" and r_s=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in dist_comp_leq_use_env)\n    apply (rule_tac st_diff_comp_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env_cut)\n     apply (rule_tac self_comp_leq_use_env1)\n    apply (rule_tac infl_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (simp_all)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n   apply (rule_tac comp_leq_use_env2)\n   apply (rule_tac dist_infl_leq_use_env)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)*)\n    (* - prelim: rx2 + EX \\<le> rx + EX *)\n  apply (cut_tac r_xa=\"rx2\" and r_xb=\"infl_use_env r_s2a r_s3\" and r_s=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in dist_comp_leq_use_env)\n    apply (rule_tac st_diff_comp_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env_cut)\n     apply (rule_tac self_comp_leq_use_env2)\n    apply (rule_tac infl_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (simp_all)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n   apply (rule_tac comp_leq_use_env2)\n   apply (rule_tac dist_infl_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (auto)    \n    (* - well-typedness for e1. *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n   apply (case_tac e1)\n         apply (auto)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n    (* - e2 is an sexp *)\n   apply (case_tac \"\\<not> is_sexp e2\")\n    apply (case_tac \"\\<not> is_value e2\")\n     apply (case_tac e1)\n           apply (auto)\n    apply (case_tac x1)\n                apply (auto)\n    apply (case_tac e2)\n          apply (auto)\n   apply (cut_tac e=\"e2\" in value_is_sexp)\n    apply (auto)\n    (* - r \\<noteq> Own *)\n  apply (case_tac \"is_own r\")\n   apply (simp add: is_own_def)\n   apply (case_tac e1)\n         apply (auto)\n   apply (case_tac x1)\n               apply (auto)\n       apply (simp_all add: pure_fun_def)\n    (* - well-typedness for e2. *)\n  apply (rule_tac x=\"drop_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3))\" in exI)\n  apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n  apply (auto)\n   apply (rule_tac wt_sexp_drop_req)\n     apply (rule_tac r_s=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_simul_perm)\n      apply (auto)\n   apply (case_tac e1)\n         apply (auto)\n   apply (case_tac x1)\n               apply (auto)\n       apply (simp_all add: pure_fun_def)\n   apply (simp add: unlim_def)\n    (* - boundaries *)\n  apply (case_tac \"\\<not> weak_use_env empty_use_env\")\n   apply (simp add: weak_use_env_def)\n   apply (simp add: empty_use_env_def)\n  apply (rule_tac t=\"lift_use_env (drop_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3))) r\" and\n          s=\"drop_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3))\" in subst)\n   apply (simp add: is_own_def)\n   apply (case_tac r)\n     apply (auto)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n       apply (rule_tac rhs_weak_leq_use_env)\n        apply (rule_tac dist_weak_comp_use_env)\n         apply (rule_tac dist_weak_comp_use_env)\n          apply (simp_all)\n        apply (rule_tac drop_weak_use_env)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n      apply (rule_tac drop_leq_use_env)\n      apply (simp)\n     apply (rule_tac disj_empty_use_env2)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac drop_leq_use_env)\n  apply (simp)\n  done\n    \n    \n    \n  (*\nlemma infl_sexp_wp: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e \\<rbrakk> \\<Longrightarrow> well_typed env (comp_use_env rx (infl_use_env r_s1 r_s2)) e tau\n  (comp_use_env rx (infl_use_env r_s1 r_s2)) (comp_use_env rx (infl_use_env r_s1 r_s2))\"\n  apply (simp add: refl_infl_use_env)\n  apply (rule_tac refl_sexp_wp)\n    apply (auto)\n  done*)\n\n    (*\nlemma infl_sexp_wp: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e \\<rbrakk> \\<Longrightarrow> well_typed env (comp_use_env rx (infl_use_env r_s1 r_s2)) e tau\n  (comp_use_env rx (infl_use_env r_s1 r_s2)) (comp_use_env rx (infl_use_env r_s1 r_s2))\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const + op case *)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n    (* var case p1. *)\n      apply (rule_tac st_diff_comp_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env (ereq_use_env x1a tau) (comp_use_env (ereq_use_env x1a tau) r_ex)\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac infl_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (auto)\n    (* var case p2. *)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (rule_tac dist_weak_comp_use_env)\n          apply (rule_tac weak_ereq_use_env)\n          apply (simp add: unlim_def)\n          apply (case_tac tau)\n                apply (auto)\n         apply (simp add: weak_use_env_def)\n         apply (simp add: empty_use_env_def)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac r_ex=\"r_ex\" in lhs_diff_leq_use_env)\n      apply (rule_tac comp_leq_use_env1)\n      apply (rule_tac lhs_fold_dcl_use_env)\n      apply (rule_tac lhs_flip_use_env)\n      apply (rule_tac lhs_unroll_dcl_use_env)\n      apply (rule_tac lhs_unroll_dcl_use_env)\n      apply (rule_tac diff_leq_use_env)\n      apply (rule_tac lhs_fold_dcl_use_env)\n      apply (rule_tac lhs_flip_use_env)\n      apply (simp)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac infl_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env x1a tau) r_ex)\" in trans_leq_use_env)\n       apply (rule_tac dist_diff_leq_use_env_gen)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac self_comp_leq_use_env2)\n      apply (simp_all)\n    (* pair case. prim case *)\n    apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n     apply (case_tac r)\n       apply (auto)\n     apply (case_tac \"\\<not> (req_type t1 = Prim \\<and> req_type t2 = Prim)\")\n      apply (case_tac \"req_type t1\")\n        apply (auto)\n       apply (case_tac \"req_type t2\")\n         apply (auto)\n      apply (case_tac \"req_type t2\")\n        apply (auto)\n     apply (simp add: pair_req_def)\n     apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n     apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n      apply (cut_tac e=\"e1\" in value_is_sexp)\n       apply (auto)\n      apply (rule_tac rx=\"comp_use_env empty_use_env (infl_use_env r_s1 r_s2a)\" in wt_sexp_no_req)\n        apply (rule_tac r_s=\"comp_use_env empty_use_env (infl_use_env r_s1 r_s2a)\" in well_typed_incr_simul_perm)\n         apply (cut_tac r_xa=\"empty_use_env\" and r_xb=\"infl_use_env r_s1 r_s2a\" and r_s=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in dist_comp_leq_use_env)\n           apply (rule_tac leq_empty_use_env)\n          apply (rule_tac comp_leq_use_env2)\n          apply (rule_tac dist_infl_leq_use_env)\n           apply (rule_tac id_leq_use_env)\n          apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n           apply (rule_tac diff_leq_use_env)\n           apply (rule_tac well_typed_perm_leq)\n           apply (auto)\n      apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e1\" and ?r_s2.0=\"r_s2a\" and rx=\"rx1\" in wt_sexp_no_req)\n         apply (auto)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n         apply (cut_tac e=\"e2\" in value_is_sexp)\n          apply (auto)\n         apply (rule_tac rx=\"comp_use_env empty_use_env (infl_use_env r_s2a r_s3)\" in wt_sexp_no_req)\n           apply (rule_tac r_s=\"comp_use_env empty_use_env (infl_use_env r_s2a r_s3)\" in well_typed_incr_simul_perm)\n            apply (cut_tac r_xa=\"empty_use_env\" and r_xb=\"infl_use_env r_s2a r_s3\" and r_s=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in dist_comp_leq_use_env)\n              apply (rule_tac leq_empty_use_env)\n             apply (rule_tac comp_leq_use_env2)\n             apply (rule_tac dist_infl_leq_use_env)\n              apply (rule_tac well_typed_perm_leq)\n              apply (auto)\n          apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n           apply (rule_tac self_diff_leq_use_env)\n          apply (auto)\n         apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s3\" and tau=\"t2\" and rx=\"rx2\" in wt_sexp_no_req)\n            apply (auto)\n        apply (rule_tac leq_empty_use_env)\n       apply (simp add: empty_use_env_def)\n      apply (rule_tac disj_empty_use_env2)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n       apply (rule_tac rhs_weak_leq_use_env)\n        apply (simp add: weak_use_env_def)\n        apply (simp add: empty_use_env_def)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac leq_empty_use_env)\n    (* pair case. normal case *)\n    apply (simp add: pair_req_def)\n    (* - prelim: r_s3 \\<le> r_s1 *)\n    apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* - prelim: rx1 + EX \\<le> rx + EX *)\n    apply (cut_tac r_xa=\"lift_use_env rx1 r\" and r_xb=\"infl_use_env r_s1 r_s2a\" and r_s=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in dist_comp_leq_use_env)\n      apply (rule_tac st_diff_comp_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac self_comp_leq_use_env1)\n      apply (rule_tac infl_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (auto)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac dist_infl_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac diff_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    (* - prelim: rx2 + EX \\<le> rx + EX *)\n    apply (cut_tac r_xa=\"lift_use_env rx2 r\" and r_xb=\"infl_use_env r_s2a r_s3\" and r_s=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in dist_comp_leq_use_env)\n      apply (rule_tac st_diff_comp_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env_cut)\n       apply (rule_tac self_comp_leq_use_env2)\n      apply (rule_tac infl_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (auto)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac dist_infl_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (auto)\n    (* well-typedness *)\n    apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n    apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n    apply (rule_tac x=\"comp_use_env rx1 (infl_use_env r_s1 r_s2a)\" in exI)\n    apply (auto)\n     apply (rule_tac r_s=\"comp_use_env rx1 (infl_use_env r_s1 r_s2a)\" in well_typed_incr_simul_perm)\n      apply (rule_tac r_sb=\"comp_use_env (lift_use_env rx1 r) (infl_use_env r_s1 r_s2a)\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac comp_leq_use_env1)\n       apply (rule_tac self_lift_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env2)\n     apply (cut_tac e=\"e1\" in value_is_sexp)\n      apply (auto)\n    apply (rule_tac x=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in exI)\n    apply (auto)\n        apply (rule_tac r_s=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_simul_perm)\n         apply (rule_tac r_sb=\"comp_use_env (lift_use_env rx2 r) (infl_use_env r_s2a r_s3)\" in trans_leq_use_env)\n          apply (simp)\n         apply (rule_tac dist_comp_leq_use_env)\n          apply (rule_tac comp_leq_use_env1)\n          apply (rule_tac self_lift_leq_use_env)\n         apply (rule_tac self_comp_leq_use_env2)\n        apply (cut_tac e=\"e2\" in value_is_sexp)\n         apply (auto)\n       apply (simp add: lift_comp_use_env)\n       apply (simp add: infl_lift_use_env)\n      apply (simp add: lift_comp_use_env)\n        apply (simp add: infl_lift_use_env)\n       apply (rule_tac safe_lift_comp_use_env)\n        apply (simp)\n    \n     apply (simp add: lift_comp_use_env)\n     apply (simp add: infl_lift_use_env)\n     apply (rule_tac disj_comp_use_env1)\n      apply (rule_tac disj_comp_use_env2)\n       apply (simp)\n      apply (rule_tac infl_disj_use_env)\n      apply (simp)\n     apply (rule_tac disj_comp_use_env2)\n      apply (rule_tac comm_disj_use_env)\n      apply (rule_tac infl_disj_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (rule_tac comm_disj_use_env)\n     apply (rule_tac infl_disj_use_env)\n     apply (rule_tac self_infl_leq_use_env)\n    (* - existentials *)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n       apply (rule_tac rhs_weak_leq_use_env)\n        apply (simp add: weak_use_env_def)\n        apply (simp add: empty_use_env_def)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (simp add: lift_comp_use_env)\n     apply (simp add: infl_lift_use_env)\n    apply (simp add: lift_comp_use_env)\n    apply (simp add: infl_lift_use_env)\n    (* lam case. prelim: this inequality is used twice *)\n   apply (cut_tac r_x=\"rxa\" and r_s=\"rx\" and r_ex=\"infl_use_env r_s1 r_s2\" in st_diff_comp_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env rxa r_ex\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env_cut)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac infl_leq_use_env)\n     apply (simp_all)\n    (* - existentials *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n      apply (rule_tac rhs_weak_leq_use_env)\n       apply (simp add: weak_use_env_def)\n       apply (simp add: empty_use_env_def)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac diff_leq_use_env)\n   apply (simp)\n    (* app case.*)\n  apply (case_tac e1)\n       apply (auto)\n  apply (case_tac x1)\n               apply (auto)\n  apply (simp add: pure_fun_def)\n  apply (auto)\n    (* - proof for e1 *)\n  apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n  apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n    (* - proof for e2. we must know that it's a lambda rather than inducting, so we know rx2 is non-affine *)\n  apply (case_tac e2)\n       apply (auto)\n    (* - prelim: this inequality is used several times in the remainder of the proof *)\n  apply (cut_tac r_x=\"rxa\" and r_s=\"rx\" and r_ex=\"infl_use_env r_s1 r_s2\" in st_diff_comp_leq_use_env)\n    (* - we split it based on whether it's primitive or not *)\n   apply (simp add: app_req_def)\n   apply (case_tac \"req_type t = Prim\")\n    apply (auto)\n    apply (rule_tac diff_leq_use_env)\n    apply (rule_tac r_sb=\"empty_use_env\" in trans_leq_use_env)\n     apply (rule_tac leq_empty_use_env)\n    apply (simp add: leq_use_env_def)\n    apply (simp add: aff_use_env_def)\n    apply (simp add: null_use_env_def)\n    (* - non primitive case actually uses an inequality *)\n   apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n    apply (simp)\n   apply (rule_tac r_sb=\"diff_use_env (diff_use_env rxa r_exa) (infl_use_env r_s1 r_s2)\" in trans_leq_use_env)\n    apply (rule_tac dist_diff_leq_use_env_cut)\n     apply (rule_tac comp_leq_use_env2)\n     apply (simp)\n    apply (rule_tac infl_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s2a r_exa\" in trans_leq_use_env)\n       apply (rule_tac diff_leq_use_env)\n       apply (simp_all)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s2a r_exa\" in trans_leq_use_env)\n       apply (rule_tac diff_leq_use_env)\n       apply (simp_all)\n   apply (rule_tac rhs_diff_leq_use_env)\n   apply (rule_tac dist_diff_leq_use_env_cut)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac infl_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env r_s2a r_exa\" in trans_leq_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (simp)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (simp_all)\n   apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n    apply (simp_all)\n    (* - completing the proof for e2 *)\n  apply (rule_tac x=\"rxa\" in exI)\n  apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n  apply (auto)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n      apply (rule_tac rhs_weak_leq_use_env)\n       apply (simp add: weak_use_env_def)\n       apply (simp add: empty_use_env_def)\n      apply (rule_tac id_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac self_diff_leq_use_env)\n    (* - end permissions bound *)\n  apply (case_tac \"\\<not> weak_use_env empty_use_env\")\n   apply (simp add: weak_use_env_def)\n   apply (simp add: empty_use_env_def)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (rule_tac dist_weak_comp_use_env)\n          apply (rule_tac dist_weak_comp_use_env)\n           apply (simp_all)\n         apply (simp add: aff_use_env_def)\n         apply (case_tac \"req_type t\")\n           apply (auto)\n          apply (simp add: unlim_def)\n         apply (simp add: weak_use_env_def)\n         apply (simp add: null_use_env_def)\n        apply (rule_tac id_leq_use_env)\n    (* - affinity *)\n       apply (simp add: aff_use_env_def)\n       apply (simp add: weak_use_env_def)\n       apply (case_tac \"req_type t\")\n         apply (auto)\n         apply (simp add: unlim_def)\n        apply (simp add: weak_use_env_def)\n       apply (simp add: null_use_env_def)\n    (* - requirements containment *)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n      apply (simp)\n    (* - disjointness *)\n    apply (rule_tac disj_empty_use_env2)\n    (* - in-between bound *)\n    apply (rule_tac id_leq_use_env)\n    (* - subtracter containment *)\n   apply (rule_tac leq_empty_use_env)\n    (* - requirements bound *)\n  apply (simp add: app_req_def)\n  apply (case_tac \"req_type t = Prim\")\n   apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac r_sb=\"rxa\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac id_leq_use_env)\n  done  *)\n  \n  \n\n  \n  \n  (*\n    - sample ideal flow of inequalities for infl_use_env\n    leq_use_env (req_use_env x1a tau) (comp_use_env rx (infl_use_env r_s1 r_s2))\n    leq_use_env (diff_use_env (req_use_env x1a tau) (infl_use_env r_s1 r_s2)) rx\n    leq_use_env (diff_use_env (req_use_env x1a tau) (infl_use_env r_s1 r_s2)) (diff_use_env (req_use_env x1a tau) (comp_use_env (req_use_env x1a tau) r_ex))\n      -- fails at this step --\n    leq_use_env (comp_use_env (req_use_env x1a tau) r_ex) (infl_use_env r_s1 r_s2)\n    leq_use_env r_s2 (diff_use_env r_s1 (comp_use_env (req_use_env x1a tau) r_ex))\n  *)\n\n  \nlemma dist_infl_leq_use_envr: \"\\<lbrakk> leq_use_env r_xb r_xa \\<rbrakk> \\<Longrightarrow> leq_use_env (infl_use_env r_s r_xa) (infl_use_env r_s r_xb)\"    \n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: infl_use_env_def)\n  apply (auto)  \n  apply (case_tac \"r_xb x\")\n    apply (auto)\n  done\n(*\nlemma dist_infl_leq_use_env: \"\\<lbrakk> leq_use_env r_sb r_sa; leq_use_env r_xb r_xa \\<rbrakk> \\<Longrightarrow> leq_use_env (infl_use_env r_sb r_xa) (infl_use_env r_sa r_xb)\"     \n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: infl_use_env_def)\n  apply (auto)\n   apply (case_tac \"r_sa x\")\n     apply (auto)\n  apply (case_tac \"r_xb x\")\n    apply (auto)\n  done  *)\n(*\nlemma infl_sexp_wp: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e \\<rbrakk> \\<Longrightarrow> well_typed env (comp_use_env rx (infl_use_env r_s1 r_s2)) e tau\n  (comp_use_env rx (infl_use_env r_s1 r_s2)) (comp_use_env rx (infl_use_env r_s1 r_s2))\"\n  apply (case_tac \"\\<not> infl_use_env r_s1 r_s2 = refl_use_env r_s1 r_s2 OwnPerm\")\n   apply (case_tac \"\\<forall> x. infl_use_env r_s1 r_s2 x = refl_use_env r_s1 r_s2 OwnPerm x\")\n    apply (auto)\n   apply (simp add: infl_use_env_def)\n   apply (simp add: refl_use_env_def)\n  apply (rule_tac refl_sexp_wp)\n    apply (auto)\n  done*)\n    (*\nlemma infl_sexp_wp: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e \\<rbrakk> \\<Longrightarrow> well_typed env (comp_use_env rx (infl_use_env r_s1 r_s2)) e tau\n  (comp_use_env rx (infl_use_env r_s1 r_s2)) (comp_use_env rx (infl_use_env r_s1 r_s2))\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n       apply (auto)\n    (* const + op case *)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n    (* var case p1. *)\n     apply (rule_tac st_diff_comp_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env (ereq_use_env x1a tau) (comp_use_env (ereq_use_env x1a tau) r_ex)\" in trans_leq_use_env)\n      apply (simp)\n     apply (rule_tac dist_diff_leq_use_env_cut)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac infl_leq_use_env)\n      apply (simp)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (auto)\n    (* var case p2. *)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n       apply (rule_tac rhs_weak_leq_use_env)\n        apply (rule_tac dist_weak_comp_use_env)\n         apply (rule_tac weak_ereq_use_env)\n         apply (simp add: unlim_def)\n         apply (case_tac tau)\n               apply (auto)\n        apply (simp add: weak_use_env_def)\n        apply (simp add: empty_use_env_def)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac r_ex=\"r_ex\" in lhs_diff_leq_use_env)\n     apply (rule_tac comp_leq_use_env1)\n     apply (rule_tac lhs_fold_dcl_use_env)\n     apply (rule_tac lhs_flip_use_env)\n     apply (rule_tac lhs_unroll_dcl_use_env)\n     apply (rule_tac lhs_unroll_dcl_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac lhs_fold_dcl_use_env)\n     apply (rule_tac lhs_flip_use_env)\n     apply (simp)\n    apply (rule_tac comp_leq_use_env2)\n    apply (rule_tac infl_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env x1a tau) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env_gen)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env2)\n      apply (simp_all)\n    (* pair case *)(*\n    apply (rule_tac x=\"comp_use_env (comp_use_env r_xa (infl_use_env rx1 r_sa)) (comp_use_env r_xb (infl_use_env rx2 r_sb))\" in exI)\n    apply (rule_tac x=\"comp_use_env r_xa (infl_use_env rx1 r_sa)\" in exI)\n    apply (auto)\n     apply (rule_tac x=\"comp_use_env r_xa (infl_use_env rx1 r_sa)\" in exI)\n     apply (rule_tac x=\"comp_use_env r_xa (infl_use_env rx1 r_sa)\" in exI)\n     apply (cut_tac e=\"e1\" in value_is_sexp)\n      apply (auto)\n    apply (rule_tac x=\"comp_use_env r_xb (infl_use_env rx2 r_sb)\" in exI)\n    apply (auto)\n          apply (rule_tac x=\"comp_use_env r_xb (infl_use_env rx2 r_sb)\" in exI)\n          apply (rule_tac x=\"comp_use_env r_xb (infl_use_env rx2 r_sb)\" in exI)\n          apply (cut_tac e=\"e2\" in value_is_sexp)\n           apply (auto)\n         apply (rule_tac r_s=\"rx\" in aff_leq_use_env)\n    \n    \n    \n    apply (auto)\n     apply (rule_tac comp_leq_use_env2)*)\n    (* lam case. prelim: this inequality is used twice *)\n   apply (cut_tac r_x=\"rxa\" and r_s=\"rx\" and r_ex=\"infl_use_env r_s1 r_s2\" in st_diff_comp_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env rxa r_ex\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env_cut)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac infl_leq_use_env)\n     apply (simp_all)\n    (* - existentials *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n      apply (rule_tac rhs_weak_leq_use_env)\n       apply (simp add: weak_use_env_def)\n       apply (simp add: empty_use_env_def)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac diff_leq_use_env)\n   apply (simp)\n    (* app case.*)\n  apply (case_tac e1)\n       apply (auto)\n  apply (case_tac x1)\n               apply (auto)\n  apply (simp add: pure_fun_def)\n  apply (auto)\n    (* - proof for e1 *)\n  apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n  apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n    (* - proof for e2. we must know that it's a lambda rather than inducting, so we know rx2 is non-affine *)\n  apply (case_tac e2)\n       apply (auto)\n    (* - prelim: this inequality is used several times in the remainder of the proof *)\n  apply (cut_tac r_x=\"rxa\" and r_s=\"rx\" and r_ex=\"infl_use_env r_s1 r_s2\" in st_diff_comp_leq_use_env)\n    (* - we split it based on whether it's primitive or not *)\n   apply (simp add: app_req_def)\n   apply (case_tac \"req_type t = Prim\")\n    apply (auto)\n    apply (rule_tac diff_leq_use_env)\n    apply (rule_tac r_sb=\"empty_use_env\" in trans_leq_use_env)\n     apply (rule_tac leq_empty_use_env)\n    apply (simp add: leq_use_env_def)\n    apply (simp add: aff_use_env_def)\n    apply (simp add: null_use_env_def)\n    (* - non primitive case actually uses an inequality *)\n   apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n    apply (simp)\n   apply (rule_tac r_sb=\"diff_use_env (diff_use_env rxa r_exa) (infl_use_env r_s1 r_s2)\" in trans_leq_use_env)\n    apply (rule_tac dist_diff_leq_use_env_cut)\n     apply (rule_tac comp_leq_use_env2)\n     apply (simp)\n    apply (rule_tac infl_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s2a r_exa\" in trans_leq_use_env)\n       apply (rule_tac diff_leq_use_env)\n       apply (simp_all)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s2a r_exa\" in trans_leq_use_env)\n       apply (rule_tac diff_leq_use_env)\n       apply (simp_all)\n   apply (rule_tac rhs_diff_leq_use_env)\n   apply (rule_tac dist_diff_leq_use_env_cut)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac infl_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env r_s2a r_exa\" in trans_leq_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (simp)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (simp_all)\n   apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n    apply (simp_all)\n    (* - completing the proof for e2 *)\n  apply (rule_tac x=\"rxa\" in exI)\n  apply (rule_tac x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" in exI)\n  apply (auto)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n      apply (rule_tac rhs_weak_leq_use_env)\n       apply (simp add: weak_use_env_def)\n       apply (simp add: empty_use_env_def)\n      apply (rule_tac id_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac self_diff_leq_use_env)\n    (* - end permissions bound *)\n  apply (case_tac \"\\<not> weak_use_env empty_use_env\")\n   apply (simp add: weak_use_env_def)\n   apply (simp add: empty_use_env_def)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (rule_tac dist_weak_comp_use_env)\n          apply (rule_tac dist_weak_comp_use_env)\n           apply (simp_all)\n         apply (simp add: aff_use_env_def)\n         apply (case_tac \"req_type t\")\n           apply (auto)\n          apply (simp add: unlim_def)\n         apply (simp add: weak_use_env_def)\n         apply (simp add: null_use_env_def)\n        apply (rule_tac id_leq_use_env)\n    (* - affinity *)\n       apply (simp add: aff_use_env_def)\n       apply (simp add: weak_use_env_def)\n       apply (case_tac \"req_type t\")\n         apply (auto)\n         apply (simp add: unlim_def)\n        apply (simp add: weak_use_env_def)\n       apply (simp add: null_use_env_def)\n    (* - requirements containment *)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n      apply (simp)\n    (* - disjointness *)\n    apply (rule_tac disj_empty_use_env2)\n    (* - in-between bound *)\n    apply (rule_tac id_leq_use_env)\n    (* - subtracter containment *)\n   apply (rule_tac leq_empty_use_env)\n    (* - requirements bound *)\n  apply (simp add: app_req_def)\n  apply (case_tac \"req_type t = Prim\")\n   apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac r_sb=\"rxa\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac id_leq_use_env)\n  done*)\n    \nlemma lhs_infl_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (infl_use_env r_x r_ex) r_s\"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: infl_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n    \n\nlemma infl_full_sexp_wp: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e \\<rbrakk> \\<Longrightarrow> well_typed env r_s1 e tau r_s1 (comp_use_env rx (infl_use_env r_s1 r_s2))\"    \n  apply (rule_tac t=\"well_typed env r_s1 e tau r_s1 (comp_use_env rx (infl_use_env r_s1 r_s2))\" and\n        s=\"well_typed env (comp_use_env (comp_use_env rx (infl_use_env r_s1 r_s2)) (diff_use_env r_s1 (comp_use_env rx (infl_use_env r_s1 r_s2)))) e tau\n          (comp_use_env (comp_use_env rx (infl_use_env r_s1 r_s2)) (diff_use_env r_s1 (comp_use_env rx (infl_use_env r_s1 r_s2))))\n          (comp_use_env rx (infl_use_env r_s1 r_s2))\" in subst)\n   apply (cut_tac r_x=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" and r_s=\"r_s1\" in msum_diff_comp_use_env)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    apply (rule_tac well_typed_perm_leqx)\n    apply (auto)\n   apply (rule_tac lhs_infl_leq_use_env)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac well_typed_comp_perms_gen)\n   apply (rule_tac infl_sexp_wp)\n    apply (auto)\n  apply (rule_tac mini_disj_diff_use_env)\n  done\n    \n    \n    (*\nlemma pre_sexp_wp: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e \\<rbrakk> \\<Longrightarrow> (\\<exists> rx'. well_typed env r_s1 e tau r_s1 rx' \\<and> leq_use_env rx rx')\"  \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n       apply (auto)\n    (* const + op cases *)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac id_leq_use_env)\n    (* var case *)\n    apply (rule_tac x=\"comp_use_env (req_use_env x1a tau) rx\" in exI)\n    apply (auto)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (rule_tac dist_weak_comp_use_env)\n          apply (simp add: weak_use_env_def)\n          apply (simp add: req_use_env_def)\n          apply (simp add: one_use_env_def)\n          apply (simp add: start_req_perm_def)\n          apply (simp add: aff_fun_ty_def)\n          apply (auto)\n          apply (case_tac tau)\n                apply (auto)\n         apply (simp add: weak_use_env_def)\n         apply (simp add: empty_use_env_def)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (simp)\n       apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (req_use_env x1a tau) r_ex)\" in trans_leq_use_env)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac self_comp_leq_use_env1)\n    apply (rule_tac self_comp_leq_use_env2)\n    (*  *)\n   apply (rule_tac x=\"comp_use_env rxa rx\" in exI)\n   apply (auto)\n    apply (rule_tac x=\"rxa\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n       apply (rule_tac rhs_weak_leq_use_env)\n        apply (simp add: weak_use_env_def)\n        apply (simp add: empty_use_env_def)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (simp)\n      apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (auto)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (rule_tac self_comp_leq_use_env1)\n   apply (rule_tac self_comp_leq_use_env2)\n    (* *)\n  apply (case_tac e2)\n       apply (auto)\n  apply (rule_tac x=\"comp_use_env rxa rx\" in exI)\n  apply (auto)\n   apply (rule_tac x=\"FunTy t1a t2 ra aa\" in exI)\n   apply (rule_tac x=\"r\" in exI)\n   apply (rule_tac x=\"a\" in exI)\n   apply (rule_tac x=\"r_s1\" in exI)\n   apply (rule_tac x=\"empty_use_env\" in exI)  \n   apply (auto)\n    apply (case_tac e1)\n         apply (auto)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (rule_tac x=\"r_s1\" in exI)\n   apply (auto)\n    apply (rule_tac x=\"rxa\" in exI)\n    apply (auto)\n     apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n       apply (rule_tac rhs_weak_leq_use_env)\n        apply (simp add: weak_use_env_def)\n        apply (simp add: empty_use_env_def)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (case_tac \"\\<not> weak_use_env empty_use_env\")\n    apply (simp add: weak_use_env_def)\n    apply (simp add: empty_use_env_def)\n   apply (auto)\n   apply (case_tac e1)\n        apply (auto)\n   apply (case_tac x1)\n                apply (auto)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n         apply (rule_tac rhs_weak_leq_use_env)\n          apply (rule_tac dist_weak_comp_use_env)\n           apply (rule_tac dist_weak_comp_use_env)\n            apply (auto)\n          apply (simp add: pure_fun_def)\n          apply (auto)\n          apply (simp add: aff_use_env_def)\n         apply (rule_tac id_leq_use_env)\n        apply (simp add: pure_fun_def)\n        apply (auto)\n        apply (simp add: aff_use_env_def)\n        apply (simp add: weak_use_env_def)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac leq_empty_use_env)\n       apply (simp add: pure_fun_def)\n       apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n        apply (auto)\n      apply (rule_tac disj_empty_use_env2)\n     apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n      apply (simp)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (auto)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac diff_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s2a r_exa\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (auto)\n     apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n      apply (auto)\n    apply (rule_tac leq_empty_use_env)\n   apply (simp add: app_req_def)\n   apply (auto)\n    apply (rule_tac leq_empty_use_env)\n    apply (rule_tac diff_leq_use_env)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply  (rule_tac self_comp_leq_use_env1)\n  apply (rule_tac self_comp_leq_use_env2)\n  done*)    \n  \nlemma wt_sexp_req_use: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e; x \\<in> non_prim_vars env e; r_s2 x \\<noteq> NoPerm \\<rbrakk> \\<Longrightarrow> rx x \\<noteq> NoPerm\"    \n    (* we utilize the value typing of e1 (x1) *)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" in infl_sexp_wp)\n    apply (auto)\n    (* - rx x has a value, proven by showing that rx + [r_s1 - r_s2a] has a value *)\n  apply (case_tac \"rx x = NoPerm\")\n   apply (cut_tac r_sa=\"rx\" and r_sb=\"infl_use_env r_s1 r_s2\" and x=\"x\" in comp_use_none)\n     apply (simp)\n    apply (simp add: infl_use_env_def)\n   apply (cut_tac env=\"env\" and ?r_s1.0=\"comp_use_env rx (infl_use_env r_s1 r_s2)\" and x=\"x\" in well_typed_no_npv_use)\n     apply (auto)\n  done    \n\n  \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/FlatLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185351961013, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3247126118599017}}
{"text": "theory TopoS_Composition_Theory_impl\nimports TopoS_Interface_impl TopoS_Composition_Theory\nbegin\n\nsection{*Composition Theory -- List Implementation*}\n\ntext{*Several invariants may apply to one policy. *}\n\n\n(*the packed network model record from the list implementation*)\nterm \"X::('v::vertex, 'a, 'b) TopoS_packed\"\n\n\nsubsection{*Generating instantiated (configured) network security invariants*}\n\n  --\"a configured network security invariant in list implementaion\"\n  (*very minimal version, no eval, ...*)\n  record ('v) SecurityInvariant =\n    implc_sinvar::\"('v) list_graph \\<Rightarrow> bool\"\n    implc_offending_flows::\"('v) list_graph \\<Rightarrow> ('v \\<times> 'v) list list\"\n    implc_isIFS::\"bool\"\n\n  text{* Test if this definition is compliant with the formal definition on sets. *}\n  definition SecurityInvariant_complies_formal_def :: \n    \"('v) SecurityInvariant \\<Rightarrow> 'v TopoS_Composition_Theory.SecurityInvariant_configured \\<Rightarrow> bool\" where\n    \"SecurityInvariant_complies_formal_def impl spec \\<equiv> \n      (\\<forall> G. valid_list_graph G \\<longrightarrow> implc_sinvar impl G = c_sinvar spec (list_graph_to_graph G)) \\<and>\n      (\\<forall> G. valid_list_graph G \\<longrightarrow> set`set (implc_offending_flows impl G) = c_offending_flows spec (list_graph_to_graph G)) \\<and>\n      (implc_isIFS impl = c_isIFS spec)\"\n    \n\n  fun new_configured_list_SecurityInvariant :: \n    \"('v::vertex, 'a, 'b) TopoS_packed \\<Rightarrow> ('v::vertex, 'a, 'b) TopoS_Params \\<Rightarrow> \n        ('v SecurityInvariant)\" where \n      \"new_configured_list_SecurityInvariant m C = \n        (let nP = nm_node_props m C in\n         \\<lparr> \n            implc_sinvar = (\\<lambda>G. (nm_sinvar m) G nP),\n            implc_offending_flows = (\\<lambda>G. (nm_offending_flows m) G nP),\n            implc_isIFS = nm_receiver_violation m\n          \\<rparr>)\"\n\n  text{* the @{term TopoS_Composition_Theory.new_configured_SecurityInvariant} must give a result if we have the SecurityInvariant modelLibrary*}\n  lemma TopoS_modelLibrary_yields_new_configured_SecurityInvariant:\n    assumes NetModelLib: \"TopoS_modelLibrary m sinvar_spec verify_gloabls_spec\"\n    and     nPdef:       \"nP = nm_node_props m C\"\n    and formalSpec:      \"Spec = \\<lparr> \n                              c_sinvar = (\\<lambda>G. sinvar_spec G nP),\n                              c_offending_flows = (\\<lambda>G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec G nP),\n                              c_isIFS = nm_receiver_violation m\n                            \\<rparr>\"\n    shows \"new_configured_SecurityInvariant (sinvar_spec, nm_default m, nm_receiver_violation m, nP) = Some Spec\"\n    proof -\n      from NetModelLib have NetModel: \"SecurityInvariant sinvar_spec (nm_default m) (nm_receiver_violation m)\"\n        by(simp add: TopoS_modelLibrary_def TopoS_List_Impl_def)\n\n      have Spec: \"\\<lparr>c_sinvar = \\<lambda>G. sinvar_spec G nP,\n             c_offending_flows = \\<lambda>G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec G nP,\n             c_isIFS = nm_receiver_violation m\\<rparr> = Spec\"\n      by(simp add: formalSpec)\n      show ?thesis\n        unfolding new_configured_SecurityInvariant.simps\n        by(simp add: NetModel Spec)\n    qed\n    thm TopoS_modelLibrary_yields_new_configured_SecurityInvariant[simplified] (*todo fold in Spec*)\n\n\n  (* The new_* functions comply, i.e. we can instance network security models that are executable. *)\n  lemma new_configured_list_SecurityInvariant_complies:\n    assumes NetModelLib: \"TopoS_modelLibrary m sinvar_spec verify_gloabls_spec\"\n    and     nPdef:       \"nP = nm_node_props m C\"\n    and formalSpec:      \"Spec = new_configured_SecurityInvariant (sinvar_spec, nm_default m, nm_receiver_violation m, nP)\"\n    and implSpec:        \"Impl = new_configured_list_SecurityInvariant m C\"\n    shows \"SecurityInvariant_complies_formal_def Impl (the Spec)\"\n    proof -\n      from TopoS_modelLibrary_yields_new_configured_SecurityInvariant[OF NetModelLib nPdef]\n      have SpecUnfolded: \"new_configured_SecurityInvariant (sinvar_spec, nm_default m, nm_receiver_violation m, nP) =\n        Some \\<lparr>c_sinvar = \\<lambda>G. sinvar_spec G nP,\n             c_offending_flows = \\<lambda>G. SecurityInvariant_withOffendingFlows.set_offending_flows sinvar_spec G nP,\n             c_isIFS = nm_receiver_violation m\\<rparr>\" by simp\n      \n      from NetModelLib show ?thesis\n        apply(simp add: SpecUnfolded formalSpec implSpec Let_def)\n        apply(simp add: SecurityInvariant_complies_formal_def_def)\n        apply(simp add: TopoS_modelLibrary_def TopoS_List_Impl_def)\n        apply(simp add: nPdef)\n        done\n    qed\n\n\n  corollary new_configured_list_SecurityInvariant_complies':\n    \"\\<lbrakk> TopoS_modelLibrary m sinvar_spec verify_gloabls_spec \\<rbrakk> \\<Longrightarrow> \n    SecurityInvariant_complies_formal_def (new_configured_list_SecurityInvariant m C) (the (new_configured_SecurityInvariant (sinvar_spec, nm_default m, nm_receiver_violation m,  nm_node_props m C)))\"\n    apply(drule new_configured_list_SecurityInvariant_complies)\n    by(simp_all)\n\n  --\"From\"\n  thm new_configured_SecurityInvariant_sound\n  --\"we get that @{const new_configured_list_SecurityInvariant} has all the necessary properties (modulo @{const SecurityInvariant_complies_formal_def})\"\n\nsubsection{*About security invariants*}\n\n   text{*specification and implementation comply. *}\n   type_synonym 'v security_models_spec_impl=\"('v SecurityInvariant \\<times> 'v TopoS_Composition_Theory.SecurityInvariant_configured) list\"\n   \n   definition get_spec :: \"'v security_models_spec_impl \\<Rightarrow> ('v TopoS_Composition_Theory.SecurityInvariant_configured) list\" where\n    \"get_spec M \\<equiv> [snd m. m \\<leftarrow> M]\"\n   definition get_impl :: \"'v security_models_spec_impl \\<Rightarrow> ('v SecurityInvariant) list\" where\n    \"get_impl M \\<equiv> [fst m. m \\<leftarrow> M]\"\n\nsubsection{*Calculating offending flows*}\n  fun implc_get_offending_flows :: \"('v) SecurityInvariant list \\<Rightarrow> 'v list_graph \\<Rightarrow> (('v \\<times> 'v) list list)\" where\n    \"implc_get_offending_flows [] G = []\"  |\n    \"implc_get_offending_flows (m#Ms) G = (implc_offending_flows m G)@(implc_get_offending_flows Ms G)\"  \n  \n\n  lemma implc_get_offending_flows_fold: \n    \"implc_get_offending_flows M G = fold (\\<lambda>m accu. accu@(implc_offending_flows m G)) M []\"\n    proof- \n    { fix accu\n      have \"accu@(implc_get_offending_flows M G) = fold (\\<lambda>m accu. accu@(implc_offending_flows m G)) M accu\"\n      apply(induction M arbitrary: accu)\n       apply(simp_all)\n      by(metis append_eq_appendI) }\n    from this[where accu2=\"[]\"] show ?thesis by simp\n  qed\n\n  lemma implc_get_offending_flows_Un: \"set`set (implc_get_offending_flows M G) = (\\<Union>m\\<in>set M. set`set (implc_offending_flows m G))\"\n    apply(induction M)\n     apply(simp_all)\n    by (metis image_Un)\n\n\n  lemma implc_get_offending_flows_map_concat: \"(implc_get_offending_flows M G) = concat [implc_offending_flows m G. m \\<leftarrow> M]\"\n    apply(induction M)\n     by(simp_all)\n\n  \n  theorem implc_get_offending_flows_complies:\n    assumes a1: \"\\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec\"\n    and     a2: \"valid_list_graph G\"\n    shows   \"set`set (implc_get_offending_flows (get_impl M) G) = (get_offending_flows (get_spec M) (list_graph_to_graph G))\"\n    proof -\n      from a1 have \"\\<forall> (m_impl, m_spec) \\<in> set M. set ` set (implc_offending_flows m_impl G) = c_offending_flows m_spec (list_graph_to_graph G)\"\n        apply(simp add: SecurityInvariant_complies_formal_def_def)\n        using a2 by blast\n      hence \"\\<forall> m \\<in> set M. set ` set (implc_offending_flows (fst m) G) = c_offending_flows (snd m) (list_graph_to_graph G)\" by fastforce\n      thus ?thesis\n        by(simp add: get_impl_def get_spec_def implc_get_offending_flows_Un get_offending_flows_def)\n   qed\n\n\n\nsubsection{*Accessors*}\n  definition get_IFS :: \"'v SecurityInvariant list \\<Rightarrow> 'v SecurityInvariant list\" where\n    \"get_IFS M \\<equiv> [m \\<leftarrow> M. implc_isIFS m]\"\n  definition get_ACS :: \"'v SecurityInvariant list \\<Rightarrow> 'v SecurityInvariant list\" where\n    \"get_ACS M \\<equiv> [m \\<leftarrow> M. \\<not> implc_isIFS m]\"\n\n  lemma get_IFS_get_ACS_complies:\n  assumes a: \"\\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec\"\n    shows \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M))).\n      SecurityInvariant_complies_formal_def m_impl m_spec\"\n    and \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_ACS (get_impl M)) (TopoS_Composition_Theory.get_ACS (get_spec M))).\n      SecurityInvariant_complies_formal_def m_impl m_spec\"\n    proof -\n      from a have \"\\<forall> (m_impl, m_spec) \\<in> set M. implc_isIFS m_impl = c_isIFS m_spec\"\n        apply(simp add: SecurityInvariant_complies_formal_def_def) by fastforce\n      hence set_zip_IFS: \"set (zip (filter implc_isIFS (get_impl M)) (filter c_isIFS (get_spec M))) \\<subseteq> set M\"\n        apply(simp add: get_impl_def get_spec_def)\n        apply(induction M)\n         apply(simp_all)\n        by force\n      from set_zip_IFS a show \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M))).\n          SecurityInvariant_complies_formal_def m_impl m_spec\"\n        apply(simp add: get_IFS_def get_ACS_def\n          TopoS_Composition_Theory.get_IFS_def TopoS_Composition_Theory.get_ACS_def) by blast\n      next\n      from a have \"\\<forall> (m_impl, m_spec) \\<in> set M. implc_isIFS m_impl = c_isIFS m_spec\"\n        apply(simp add: SecurityInvariant_complies_formal_def_def) by fastforce\n      hence set_zip_ACS: \"set (zip [m\\<leftarrow>get_impl M . \\<not> implc_isIFS m] [m\\<leftarrow>get_spec M . \\<not> c_isIFS m]) \\<subseteq> set M\"\n        apply(simp add: get_impl_def get_spec_def)\n        apply(induction M)\n         apply(simp_all)\n        by force\n      from this a show \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_ACS (get_impl M)) (TopoS_Composition_Theory.get_ACS (get_spec M))).\n        SecurityInvariant_complies_formal_def m_impl m_spec\"\n        apply(simp add: get_IFS_def get_ACS_def\n          TopoS_Composition_Theory.get_IFS_def TopoS_Composition_Theory.get_ACS_def) by fast\n     qed\n\n\n\n   lemma get_IFS_get_ACS_select_simps:\n    assumes a1: \"\\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec\"\n    shows \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M))). SecurityInvariant_complies_formal_def m_impl m_spec\" (is \"\\<forall> (m_impl, m_spec) \\<in> set ?zippedIFS. SecurityInvariant_complies_formal_def m_impl m_spec\")\n    and   \"(get_impl (zip (TopoS_Composition_Theory_impl.get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M)))) = TopoS_Composition_Theory_impl.get_IFS (get_impl M)\"\n    and   \"(get_spec (zip (TopoS_Composition_Theory_impl.get_IFS (get_impl M)) (TopoS_Composition_Theory.get_IFS (get_spec M)))) = TopoS_Composition_Theory.get_IFS (get_spec M)\"\n    and   \"\\<forall> (m_impl, m_spec) \\<in> set (zip (get_ACS (get_impl M)) (TopoS_Composition_Theory.get_ACS (get_spec M))). SecurityInvariant_complies_formal_def m_impl m_spec\" (is \"\\<forall> (m_impl, m_spec) \\<in> set ?zippedACS. SecurityInvariant_complies_formal_def m_impl m_spec\")\n    and   \"(get_impl (zip (TopoS_Composition_Theory_impl.get_ACS (get_impl M)) (TopoS_Composition_Theory.get_ACS (get_spec M)))) = TopoS_Composition_Theory_impl.get_ACS (get_impl M)\"\n    and   \"(get_spec (zip (TopoS_Composition_Theory_impl.get_ACS (get_impl M)) (TopoS_Composition_Theory.get_ACS (get_spec M)))) = TopoS_Composition_Theory.get_ACS (get_spec M)\"\n    proof -\n        from get_IFS_get_ACS_complies(1)[OF a1]\n        show \"\\<forall> (m_impl, m_spec) \\<in> set (?zippedIFS). SecurityInvariant_complies_formal_def m_impl m_spec\" by simp\n      next\n        from a1 show \"(get_impl ?zippedIFS) = TopoS_Composition_Theory_impl.get_IFS (get_impl M)\"\n          apply(simp add: TopoS_Composition_Theory_impl.get_IFS_def get_spec_def get_impl_def TopoS_Composition_Theory.get_IFS_def)\n          apply(induction M)\n           apply(simp)\n          apply(simp)\n          apply(rule conjI)\n           apply(clarify)\n           using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          apply(clarify)\n          using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          done\n      next\n        from a1 show \"(get_spec ?zippedIFS) = TopoS_Composition_Theory.get_IFS (get_spec M)\"\n          apply(simp add: TopoS_Composition_Theory_impl.get_IFS_def get_spec_def get_impl_def TopoS_Composition_Theory.get_IFS_def)\n          apply(induction M)\n           apply(simp)\n          apply(simp)\n          apply(rule conjI)\n           apply(clarify)\n           using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          apply(clarify)\n          using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          done\n      next\n        from get_IFS_get_ACS_complies(2)[OF a1]\n        show \"\\<forall> (m_impl, m_spec) \\<in> set (?zippedACS). SecurityInvariant_complies_formal_def m_impl m_spec\" by simp\n      next\n        from a1 show \"(get_impl ?zippedACS) = TopoS_Composition_Theory_impl.get_ACS (get_impl M)\"\n          apply(simp add: TopoS_Composition_Theory_impl.get_ACS_def get_spec_def get_impl_def TopoS_Composition_Theory.get_ACS_def)\n          apply(induction M)\n           apply(simp)\n          apply(simp)\n          apply(rule conjI)\n           apply(clarify)\n           using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          apply(clarify)\n          using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          done\n      next\n        from a1 show \"(get_spec ?zippedACS) = TopoS_Composition_Theory.get_ACS (get_spec M)\"\n          apply(simp add: TopoS_Composition_Theory_impl.get_ACS_def get_spec_def get_impl_def TopoS_Composition_Theory.get_ACS_def)\n          apply(induction M)\n           apply(simp)\n          apply(simp)\n          apply(rule conjI)\n           apply(clarify)\n           using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          apply(clarify)\n          using SecurityInvariant_complies_formal_def_def apply (auto)[1]\n          done\n      qed \n \n   thm get_IFS_get_ACS_select_simps\n\nsubsection{*All security requirements fulfilled*}\n   definition all_security_requirements_fulfilled :: \"'v SecurityInvariant list \\<Rightarrow> 'v list_graph \\<Rightarrow> bool\" where\n      \"all_security_requirements_fulfilled M G \\<equiv> \\<forall>m \\<in> set M. (implc_sinvar m) G\"\n\n  lemma all_security_requirements_fulfilled_complies:\n    \"\\<lbrakk> \\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec; \n       valid_list_graph (G::('v::vertex) list_graph) \\<rbrakk> \\<Longrightarrow>\n    all_security_requirements_fulfilled (get_impl M) G <-> TopoS_Composition_Theory.all_security_requirements_fulfilled (get_spec M) (list_graph_to_graph G)\"\n    apply(simp add: all_security_requirements_fulfilled_def TopoS_Composition_Theory.all_security_requirements_fulfilled_def)\n    apply(simp add: get_impl_def get_spec_def)\n    using SecurityInvariant_complies_formal_def_def by fastforce\n\nsubsection{*generate valid topology*}\n  value \"concat [[1::int,2,3], [4,6,5]]\"\n\n  fun generate_valid_topology :: \"('v) SecurityInvariant list \\<Rightarrow> 'v list_graph \\<Rightarrow> ('v list_graph)\" where\n    \"generate_valid_topology M G = delete_edges G (concat (implc_get_offending_flows M G))\"\n\n\n  lemma generate_valid_topology_complies:\n    \"\\<lbrakk> \\<forall> (m_impl, m_spec) \\<in> set M. SecurityInvariant_complies_formal_def m_impl m_spec;\n       valid_list_graph (G::('v::vertex) list_graph) \\<rbrakk> \\<Longrightarrow> \n       list_graph_to_graph (generate_valid_topology (get_impl M) G) = \n       TopoS_Composition_Theory.generate_valid_topology (get_spec M) (list_graph_to_graph G)\"\n    apply(subst generate_valid_topology_def_alt)\n    apply(drule(1) implc_get_offending_flows_complies)\n    apply(simp)\n    apply(simp add: delete_edges_correct[symmetric])\n    apply(simp add: list_graph_to_graph_def FiniteGraph.delete_edges_simp2)\n    apply(simp)\n    by blast\n    \nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Network_Security_Policy_Verification/TopoS_Composition_Theory_impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3246904821692033}}
{"text": "theory OS_kernel_inv\n  imports OS_kernel_sys \nbegin\n\nsection \\<open> invariant verification \\<close>\n\ntheorem \"invariant_presv_pares \\<Gamma> inv (paresys_spec Memory_manage_system_Spec) {s0} sys_rely\"\n  apply(rule invariant_theorem[where G=\"sys_guar\" and pst = UNIV])\n  using mem_sys_sat apply fast\n    apply(simp add:sys_rely_def stable_def)\n    apply(simp add:sys_guar_def)\n   apply(rule stable_un_R) \n    apply(rule stable_un_R)\n     apply (simp add: sched_guar_stb_inv stable_def)\n    apply (simp add: Tick_guar_stb_inv stable_def)\n  apply (simp add: OSMemGet_guar_stb_inv OSMem_eq_guar stable_un_S)\n  using s0_inv apply simp\n  done\n                     \nend                      ", "meta": {"author": "SunHuan321", "repo": "uc-OS-verification", "sha": "760e159857c4015d6a9e3ccbe9f8247e4518862a", "save_path": "github-repos/isabelle/SunHuan321-uc-OS-verification", "path": "github-repos/isabelle/SunHuan321-uc-OS-verification/uc-OS-verification-760e159857c4015d6a9e3ccbe9f8247e4518862a/ucOS_mem_mailbox/OS_kernel_inv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757645879592641, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.32469047589425576}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * Tactic for solving monadic equalities, such as:\n *\n * (liftE (return 3) = returnOk 3\n *\n * Theorems of the form:\n *\n *   ((a, s') \\<in> fst (A s)) = P a s s'\n *\n * and\n *\n *   snd (A s) = P s\n *\n * are added to the \"monad_eq\" set.\n *)\ntheory MonadEq\nimports \"Monad_WP/NonDetMonadVCG\"\nbegin\n\n(* Setup \"monad_eq\" attributes. *)\nML {*\nstructure MonadEqThms = Named_Thms (\n    val name = Binding.name \"monad_eq\"\n    val description = \"monad equality-prover theorems\"\n    )\n*}\nattribute_setup monad_eq = {*\n  Attrib.add_del\n    (Thm.declaration_attribute MonadEqThms.add_thm)\n    (Thm.declaration_attribute MonadEqThms.del_thm) *}\n  \"Monad equality-prover theorems\"\n\n(* Setup tactic. *)\n\nML {*\nfun monad_eq_tac ctxt =\nlet\n  (* Set a simpset as being hidden, so warnings are not printed from it. *)\n  val ctxt' = Context_Position.set_visible false ctxt\nin\n  CHANGED (clarsimp_tac (ctxt' addsimps (MonadEqThms.get ctxt')) 1)\nend\n*}\n\nmethod_setup monad_eq = {*\n    Method.sections Clasimp.clasimp_modifiers >> (K (SIMPLE_METHOD o monad_eq_tac)) *}\n  \"prove equality on monads\"\n\nlemma monad_eq_simp_state [monad_eq]:\n  \"((A :: ('s, 'a) nondet_monad) s = B s') =\n      ((\\<forall>r t. (r, t) \\<in> fst (A s) \\<longrightarrow> (r, t) \\<in> fst (B s'))\n         \\<and> (\\<forall>r t. (r, t) \\<in> fst (B s') \\<longrightarrow> (r, t) \\<in> fst (A s))\n         \\<and> (snd (A s) = snd (B s')))\"\n  apply (auto intro!: set_eqI prod_eqI)\n  done\n\nlemma monad_eq_simp [monad_eq]:\n  \"((A :: ('s, 'a) nondet_monad) = B) =\n      ((\\<forall>r t s. (r, t) \\<in> fst (A s) \\<longrightarrow> (r, t) \\<in> fst (B s))\n         \\<and> (\\<forall>r t s. (r, t) \\<in> fst (B s) \\<longrightarrow> (r, t) \\<in> fst (A s))\n         \\<and> (\\<forall>x. snd (A x) = snd (B x)))\"\n  apply (auto intro!: set_eqI prod_eqI)\n  done\n\ndeclare in_monad [monad_eq]\ndeclare in_bindE [monad_eq]\n\n(* Test *)\nlemma \"returnOk 3 = liftE (return 3)\"\n  apply monad_eq\n  oops\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/lib/MonadEq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3246543236779258}}
{"text": "section \\<open>Stack by Array\\<close>\ntheory Impl_Array_Stack\nimports   \n  Automatic_Refinement.Automatic_Refinement\n  \"../../Lib/Diff_Array\"\nbegin\n\ntype_synonym 'a array_stack = \"'a array \\<times> nat\"\n\nterm Diff_Array.array_length\n\ndefinition \"as_raw_\\<alpha> s \\<equiv> take (snd s) (list_of_array (fst s))\"\ndefinition \"as_raw_invar s \\<equiv> snd s \\<le> array_length (fst s)\"\n\ndefinition as_rel_def_internal: \"as_rel R \\<equiv> br as_raw_\\<alpha> as_raw_invar O \\<langle>R\\<rangle>list_rel\"\nlemma as_rel_def: \"\\<langle>R\\<rangle>as_rel \\<equiv> br as_raw_\\<alpha> as_raw_invar O \\<langle>R\\<rangle>list_rel\"\n  unfolding as_rel_def_internal[abs_def] by (simp add: relAPP_def)\n\nlemma [relator_props]: \"single_valued R \\<Longrightarrow> single_valued (\\<langle>R\\<rangle>as_rel)\"\n  unfolding as_rel_def\n  by tagged_solver\n\nlemmas [autoref_rel_intf] = REL_INTFI[of as_rel i_list]\n\n\ndefinition \"as_empty (_::unit) \\<equiv> (array_of_list [],0)\"\n\nlemma as_empty_refine[autoref_rules]: \"(as_empty (),[]) \\<in> \\<langle>R\\<rangle>as_rel\"\n  unfolding as_rel_def as_empty_def br_def\n  unfolding as_raw_\\<alpha>_def as_raw_invar_def\n  by auto\n\n\ndefinition \"as_push s x \\<equiv> let\n    (a,n)=s;\n    a = if n = array_length a then\n        array_grow a (max 4 (2*n)) x\n      else a;\n    a = array_set a n x\n  in\n    (a,n+1)\"\n\nlemma as_push_refine[autoref_rules]: \n  \"(as_push,op_list_append_elem) \\<in> \\<langle>R\\<rangle>as_rel \\<rightarrow> R \\<rightarrow> \\<langle>R\\<rangle>as_rel\"\n  apply (intro fun_relI)\n  apply (simp add: as_push_def op_list_append_elem_def as_rel_def br_def\n    as_raw_\\<alpha>_def as_raw_invar_def)\n  apply clarsimp\n  apply safe\n  apply (rule)\n  apply auto []\n  apply (clarsimp simp: array_length_list) []\n  apply parametricity\n\n  apply rule\n  apply auto []\n  apply (auto simp: take_Suc_conv_app_nth array_length_list list_update_append) []\n  apply parametricity\n  done\n\nterm array_shrink\n\ndefinition \"as_shrink s \\<equiv> let \n    (a,n) = s;\n    a = if 128*n \\<le> array_length a \\<and> n>4 then\n        array_shrink a n\n      else a\n  in\n    (a,n)\"\n\nlemma as_shrink_id_refine: \"(as_shrink,id) \\<in> \\<langle>R\\<rangle>as_rel \\<rightarrow> \\<langle>R\\<rangle>as_rel\"\n  apply (intro fun_relI)\n  apply (simp add: as_shrink_def as_rel_def br_def\n    as_raw_\\<alpha>_def as_raw_invar_def Let_def)\n  apply clarsimp\n  apply safe\n\n  apply (rule)\n  apply (auto simp: array_length_list)\n  done\n\nlemma as_shrinkI:\n  assumes [param]: \"(s,a)\\<in>\\<langle>R\\<rangle>as_rel\"\n  shows \"(as_shrink s,a)\\<in>\\<langle>R\\<rangle>as_rel\"\n  apply (subst id_apply[of a,symmetric])\n  apply (parametricity add: as_shrink_id_refine)\n  done\n\ndefinition \"as_pop s \\<equiv> let (a,n)=s in as_shrink (a,n - 1)\"\n\nlemma as_pop_refine[autoref_rules]: \"(as_pop,butlast) \\<in> \\<langle>R\\<rangle>as_rel \\<rightarrow> \\<langle>R\\<rangle>as_rel\"\n  apply (intro fun_relI)\n  apply (clarsimp simp add: as_pop_def split: prod.split)\n  apply (rule as_shrinkI)\n\n  apply (simp add: as_pop_def as_rel_def br_def\n    as_raw_\\<alpha>_def as_raw_invar_def Let_def)\n  apply clarsimp\n\n  apply rule\n  apply (auto simp: array_length_list) []\n  apply (clarsimp simp: array_length_list take_minus_one_conv_butlast) []\n  apply parametricity\n  done\n  \ndefinition \"as_get s i \\<equiv> let (a,_::nat)=s in array_get a i\"\n\nlemma as_get_refine: \n  assumes 1: \"i'<length l\" \n  assumes 2: \"(a,l)\\<in>\\<langle>R\\<rangle>as_rel\" \n  assumes 3[param]: \"(i,i')\\<in>nat_rel\"\n  shows \"(as_get a i,l!i')\\<in>R\"\n  using 2\n  apply (clarsimp \n    simp add: as_get_def as_rel_def br_def as_raw_\\<alpha>_def as_raw_invar_def\n    split: prod.split)\n  apply (rename_tac aa bb)\n  apply (case_tac aa, simp)\nproof -\n  fix n cl\n  assume TKR[param]: \"(take n cl, l) \\<in> \\<langle>R\\<rangle>list_rel\"\n\n  have \"(take n cl!i, l!i')\\<in>R\"\n    by parametricity (rule 1)\n  also have \"take n cl!i = cl!i\"\n    using 1 3 list_rel_imp_same_length[OF TKR]\n    by simp\n  finally show \"(cl!i,l!i')\\<in>R\" .\nqed\n  \ncontext begin interpretation autoref_syn .\nlemma as_get_autoref[autoref_rules]: \n  assumes \"(l,l')\\<in>\\<langle>R\\<rangle>as_rel\"\n  assumes \"(i,i')\\<in>Id\"\n  assumes \"SIDE_PRECOND (i' < length l')\"\n  shows \"(as_get l i,(OP nth ::: \\<langle>R\\<rangle>as_rel \\<rightarrow> nat_rel \\<rightarrow> R)$l'$i')\\<in>R\"\n  using assms by (simp add: as_get_refine)\n\ndefinition \"as_set s i x \\<equiv> let (a,n::nat)=s in (array_set a i x,n)\"\n\nlemma as_set_refine[autoref_rules]: \n  \"(as_set,list_update)\\<in>\\<langle>R\\<rangle>as_rel \\<rightarrow> nat_rel \\<rightarrow> R \\<rightarrow> \\<langle>R\\<rangle>as_rel\"\n  apply (intro fun_relI)\n  apply (clarsimp \n    simp: as_set_def as_rel_def br_def as_raw_\\<alpha>_def as_raw_invar_def\n    split: prod.split)\n  apply rule\n  apply auto []\n  apply parametricity\n  by simp\n\ndefinition as_length :: \"'a array_stack \\<Rightarrow> nat\" where \n  \"as_length = snd\"\n\nlemma as_length_refine[autoref_rules]: \n  \"(as_length,length) \\<in> \\<langle>R\\<rangle>as_rel \\<rightarrow> nat_rel\"\n  by (auto \n    simp: as_length_def as_rel_def br_def as_raw_\\<alpha>_def as_raw_invar_def\n      array_length_list\n    dest!: list_rel_imp_same_length\n  )\n\ndefinition \"as_top s \\<equiv> as_get s (as_length s - 1)\"\n\nlemma as_top_code[code]: \"as_top s = (let (a,n)=s in array_get a (n - 1))\"\n  unfolding as_top_def as_get_def as_length_def \n  by (auto split: prod.split)\n\nlemma as_top_refine: \"\\<lbrakk>l\\<noteq>[]; (s,l)\\<in>\\<langle>R\\<rangle>as_rel\\<rbrakk> \\<Longrightarrow> (as_top s,last l)\\<in>R\"\n  unfolding as_top_def\n  apply (simp add: last_conv_nth)\n  apply (rule as_get_refine)\n  apply (auto simp: as_length_def as_rel_def br_def as_raw_\\<alpha>_def \n    as_raw_invar_def array_length_list\n    dest!: list_rel_imp_same_length)\n  done\n\nlemma as_top_autoref[autoref_rules]:\n  assumes \"(l,l')\\<in>\\<langle>R\\<rangle>as_rel\"\n  assumes \"SIDE_PRECOND (l' \\<noteq> [])\"\n  shows \"(as_top l,(OP last ::: \\<langle>R\\<rangle>as_rel \\<rightarrow> R)$l')\\<in>R\"\n  using assms by (simp add: as_top_refine)\n\n\ndefinition \"as_is_empty s \\<equiv> as_length s = 0\"\nlemma as_is_empty_code[code]: \"as_is_empty s = (snd s = 0)\"\n  unfolding as_is_empty_def as_length_def by simp\n\nlemma as_is_empty_refine[autoref_rules]: \n  \"(as_is_empty,is_Nil) \\<in> \\<langle>R\\<rangle>as_rel \\<rightarrow> bool_rel\"\nproof\n  fix s l\n  assume [param]: \"(s,l)\\<in>\\<langle>R\\<rangle>as_rel\"\n  have \"(as_is_empty s,length l = 0) \\<in> bool_rel\"\n    unfolding as_is_empty_def\n    by (parametricity add: as_length_refine)\n  also have \"length l = 0 \\<longleftrightarrow> is_Nil l\"\n    by (cases l) auto\n  finally show \"(as_is_empty s, is_Nil l) \\<in> bool_rel\" .\nqed\n\ndefinition \"as_take m s \\<equiv> let (a,n) = s in \n  if m<n then \n    as_shrink (a,m)\n  else (a,n)\"\n\nlemma as_take_refine[autoref_rules]: \n  \"(as_take,take)\\<in>nat_rel \\<rightarrow> \\<langle>R\\<rangle>as_rel \\<rightarrow> \\<langle>R\\<rangle>as_rel\"\n  apply (intro fun_relI)\n  apply (clarsimp simp add: as_take_def, safe)\n\n  apply (rule as_shrinkI)\n  apply (simp add: as_rel_def br_def as_raw_\\<alpha>_def as_raw_invar_def)\n  apply rule\n  apply auto []\n  apply clarsimp\n  apply (subgoal_tac \"take a' (list_of_array a) = take a' (take ba (list_of_array a))\")\n  apply (simp only: )\n  apply (parametricity, rule IdI)\n  apply simp\n\n  apply (simp add: as_rel_def br_def as_raw_\\<alpha>_def as_raw_invar_def)\n  apply rule\n  apply auto []\n  apply clarsimp\n  apply (frule list_rel_imp_same_length)\n  apply simp\n  done\n\ndefinition \"as_singleton x \\<equiv> (array_of_list [x],1)\"\nlemma as_singleton_refine[autoref_rules]: \n  \"(as_singleton,op_list_singleton)\\<in>R \\<rightarrow> \\<langle>R\\<rangle>as_rel\"\n  apply (intro fun_relI)\n  apply (simp add: as_singleton_def as_rel_def br_def as_raw_\\<alpha>_def \n    as_raw_invar_def)\n  apply rule\n  apply (auto simp: array_length_list) []\n  apply simp\n  done\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/GenCF/Impl/Impl_Array_Stack.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5774953651858117, "lm_q1q2_score": 0.32465432367792574}}
{"text": "theory Impl_List_Playground_statefulpolicycompliance\nimports \"../TopoS_Impl\"\n    Impl_List_Playground_ChairNetwork\nbegin\n\n\nthm ChairNetwork_def\nthm ChairSecurityRequirements_def\n\ndefinition \"ChairNetwork_stateful_IFS = \\<lparr> hostsL = nodesL ChairNetwork, flows_fixL = edgesL ChairNetwork, flows_stateL = filter_IFS_no_violations ChairNetwork ChairSecurityRequirements \\<rparr>\"\nvalue \"edgesL ChairNetwork\"\nvalue \"filter_IFS_no_violations ChairNetwork ChairSecurityRequirements\"\nvalue \"ChairNetwork_stateful_IFS\"\nlemma \"set (flows_stateL ChairNetwork_stateful_IFS) \\<subseteq> (set (flows_fixL ChairNetwork_stateful_IFS))\" by eval (*must always hold*)\nvalue \"(set (flows_fixL ChairNetwork_stateful_IFS)) - set (flows_stateL ChairNetwork_stateful_IFS)\"\n(*only problems: printers!!!*)\nvalue \"stateful_list_policy_to_list_graph ChairNetwork_stateful_IFS\"\n\ndefinition \"ChairNetwork_stateful_ACS = \\<lparr> hostsL = nodesL ChairNetwork, flows_fixL = edgesL ChairNetwork, flows_stateL = filter_compliant_stateful_ACS ChairNetwork ChairSecurityRequirements \\<rparr>\"\nvalue \"edgesL ChairNetwork\"\nvalue \"filter_compliant_stateful_ACS ChairNetwork ChairSecurityRequirements\"\nvalue \"ChairNetwork_stateful_ACS\"\nlemma \"set (flows_stateL ChairNetwork_stateful_ACS) \\<subseteq> (set (flows_fixL ChairNetwork_stateful_ACS))\" by eval (*must always hold*)\nvalue \"(set (flows_fixL ChairNetwork_stateful_ACS)) - set (flows_stateL ChairNetwork_stateful_ACS)\"\n\n(*flows that are already allowed in both directions are not marked as stateful*)\nvalue \"((set (flows_fixL ChairNetwork_stateful_ACS)) - set (flows_stateL ChairNetwork_stateful_ACS)) - set (backlinks (flows_fixL ChairNetwork_stateful_ACS))\"\n\n(*the new backflows*)\nvalue \"set (edgesL (stateful_list_policy_to_list_graph ChairNetwork_stateful_ACS)) - (set (edgesL ChairNetwork))\"\n\n(*the resulting ACS graph*)\nvalue \"stateful_list_policy_to_list_graph ChairNetwork_stateful_ACS\"\n\n\nvalue \"generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements\"\nvalue \"generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements\"\nlemma \"set (flows_fixL (generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements)) = set (flows_fixL (generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements))\" by eval\nlemma \"set (flows_stateL (generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements)) = set (flows_stateL (generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements))\" by eval\n\n\ndefinition \"ChairNetwork_stateful = generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements\"\n\n\nML_val{*\nvisualize_edges @{context} @{term \"flows_fixL ChairNetwork_stateful\"} \n  [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL ChairNetwork_stateful\"})]; \n*}\n\n\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Network_Security_Policy_Verification/Examples/Impl_List_Playground_statefulpolicycompliance.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3246290063682356}}
{"text": "(*\n  Theory: PDF_Target_Semantics.thy\n  Authors: Manuel Eberl\n\n  The semantics of the target language.\n*)\n\nsection \\<open>Target Language Syntax and Semantics\\<close>\n\ntheory PDF_Target_Semantics\nimports PDF_Semantics\nbegin\n\ndatatype cexpr =\n    CVar vname\n  | CVal val\n  | CPair cexpr cexpr (\"<_, _>\\<^sub>c\" [0, 0] 1000)\n  | COperator pdf_operator cexpr (infixl \"$$\\<^sub>c\" 999)\n  | CIf cexpr cexpr cexpr (\"IF\\<^sub>c _ THEN _ ELSE _\" [0, 0, 10] 10)\n  | CIntegral cexpr pdf_type (\"\\<integral>\\<^sub>c _ \\<partial>_\" [61] 110)\n\nabbreviation (input) cexpr_fun :: \"(cexpr \\<Rightarrow> cexpr) \\<Rightarrow> cexpr\" (binder \"\\<lambda>\\<^sub>c\" 10) where\n  \"cexpr_fun f \\<equiv> f (CVar 0)\"\nabbreviation cexpr_Add (infixl \"+\\<^sub>c\" 65) where\n  \"cexpr_Add a b \\<equiv> Add $$\\<^sub>c <a, b>\\<^sub>c\"\nabbreviation cexpr_Minus (\"-\\<^sub>c _\" [81] 80) where\n  \"cexpr_Minus a \\<equiv> Minus $$\\<^sub>c a\"\nabbreviation cexpr_Sub (infixl \"-\\<^sub>c\" 65) where\n  \"cexpr_Sub a b \\<equiv> a +\\<^sub>c -\\<^sub>cb\"\nabbreviation cexpr_Mult (infixl \"*\\<^sub>c\" 70) where\n  \"cexpr_Mult a b \\<equiv> Mult $$\\<^sub>c <a, b>\\<^sub>c\"\nabbreviation \"inverse\\<^sub>c e \\<equiv>Inverse $$\\<^sub>c e\"\nabbreviation cexpr_Div (infixl \"'/\\<^sub>c\" 70) where\n  \"cexpr_Div a b \\<equiv> a *\\<^sub>c inverse\\<^sub>c b\"\nabbreviation \"fact\\<^sub>c e \\<equiv> Fact $$\\<^sub>c e\"\nabbreviation \"sqrt\\<^sub>c e \\<equiv> Sqrt $$\\<^sub>c e\"\nabbreviation \"exp\\<^sub>c e \\<equiv> Exp $$\\<^sub>c e\"\nabbreviation \"ln\\<^sub>c e \\<equiv> Ln $$\\<^sub>c e\"\nabbreviation \"fst\\<^sub>c e \\<equiv> Fst $$\\<^sub>c e\"\nabbreviation \"snd\\<^sub>c e \\<equiv> Snd $$\\<^sub>c e\"\nabbreviation cexpr_Pow (infixl \"^\\<^sub>c\" 75) where\n  \"cexpr_Pow a b \\<equiv> Pow $$\\<^sub>c <a, b>\\<^sub>c\"\nabbreviation cexpr_And (infixl \"\\<and>\\<^sub>c\" 35) where\n  \"cexpr_And a b \\<equiv> And $$\\<^sub>c <a, b>\\<^sub>c\"\nabbreviation cexpr_Or (infixl \"\\<or>\\<^sub>c\" 30) where\n  \"cexpr_Or a b \\<equiv> Or $$\\<^sub>c <a, b>\\<^sub>c\"\nabbreviation cexpr_Not (\"\\<not>\\<^sub>c _\" [40] 40) where\n  \"cexpr_Not a \\<equiv> Not $$\\<^sub>c a\"\nabbreviation cexpr_Equals (infixl \"=\\<^sub>c\" 70) where\n  \"cexpr_Equals a b \\<equiv> Equals $$\\<^sub>c <a, b>\\<^sub>c\"\nabbreviation cexpr_Less (infixl \"<\\<^sub>c\" 70) where\n  \"cexpr_Less a b \\<equiv> Less $$\\<^sub>c <a, b>\\<^sub>c\"\nabbreviation cexpr_LessEq (infixl \"\\<le>\\<^sub>c\" 70) where\n  \"cexpr_LessEq a b \\<equiv> a =\\<^sub>c b \\<or>\\<^sub>c a <\\<^sub>c b\"\nabbreviation cexpr_RealCast (\"\\<langle>_\\<rangle>\\<^sub>c\" [0] 90) where\n  \"cexpr_RealCast a \\<equiv> Cast REAL $$\\<^sub>c a\"\nabbreviation CReal where\n  \"CReal x \\<equiv> CVal (RealVal x)\"\nabbreviation CInt where\n  \"CInt x \\<equiv> CVal (IntVal x)\"\nabbreviation \\<pi>\\<^sub>c where\n  \"\\<pi>\\<^sub>c \\<equiv> Pi $$\\<^sub>c (CVal UnitVal)\"\n\ninstantiation cexpr :: expr\nbegin\n\nprimrec free_vars_cexpr :: \"cexpr \\<Rightarrow> vname set\" where\n  \"free_vars_cexpr (CVar x) = {x}\"\n| \"free_vars_cexpr (CVal _) = {}\"\n| \"free_vars_cexpr (oper $$\\<^sub>c e) = free_vars_cexpr e\"\n| \"free_vars_cexpr (<e1, e2>\\<^sub>c) = free_vars_cexpr e1 \\<union> free_vars_cexpr e2\"\n| \"free_vars_cexpr (IF\\<^sub>c b THEN e1 ELSE e2) =\n       free_vars_cexpr b \\<union> free_vars_cexpr e1 \\<union> free_vars_cexpr e2\"\n| \"free_vars_cexpr (\\<integral>\\<^sub>c e \\<partial>t) = Suc -` free_vars_cexpr e\"\n\ninstance ..\nend\n\ninductive cexpr_typing :: \"tyenv \\<Rightarrow> cexpr \\<Rightarrow> pdf_type \\<Rightarrow> bool\" (\"(1_/ \\<turnstile>\\<^sub>c/ (_ :/ _))\" [50,0,50] 50) where\n  cet_val:    \"\\<Gamma> \\<turnstile>\\<^sub>c CVal v: val_type v\"\n| cet_var:    \"\\<Gamma> \\<turnstile>\\<^sub>c CVar x : \\<Gamma> x\"\n| cet_pair:   \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : t1 \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : t2 \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c <e1, e2>\\<^sub>c : PRODUCT t1 t2\"\n| cet_op:     \"\\<Gamma> \\<turnstile>\\<^sub>c e : t \\<Longrightarrow> op_type oper t = Some t' \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c oper $$\\<^sub>c e : t'\"\n| cet_if:     \"\\<Gamma> \\<turnstile>\\<^sub>c b : BOOL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 : t \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : t\n                   \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c IF\\<^sub>c b THEN e1 ELSE e2 : t\"\n| cet_int:    \"t \\<cdot> \\<Gamma> \\<turnstile>\\<^sub>c e : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c \\<integral>\\<^sub>c e \\<partial>t : REAL\"\n\nlemma cet_val': \"t = val_type v \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c CVal v : t\"\n  by (simp add: cet_val)\n\nlemma cet_var': \"t = \\<Gamma> x \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c CVar x : t\"\n  by (simp add: cet_var)\n\nlemma cet_not: \"\\<Gamma> \\<turnstile>\\<^sub>c e : BOOL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c \\<not>\\<^sub>c e : BOOL\"\n  by (intro cet_op[where t = \"BOOL\"] cet_pair, simp, simp)\n\nlemma cet_and: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : BOOL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : BOOL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 \\<and>\\<^sub>c e2 : BOOL\" and\n      cet_or: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : BOOL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : BOOL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 \\<or>\\<^sub>c e2 : BOOL\"\n  by (intro cet_op[where t = \"PRODUCT BOOL BOOL\"] cet_pair, simp, simp, simp)+\n\nlemma cet_minus_real: \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c -\\<^sub>ce : REAL\" and\n      cet_inverse: \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c inverse\\<^sub>c e : REAL\" and\n      cet_sqrt: \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c sqrt\\<^sub>c e : REAL\" and\n      cet_exp: \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c exp\\<^sub>c e : REAL\" and\n      cet_ln: \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c ln\\<^sub>c e : REAL\"\n  by (rule cet_op[where t = \"REAL\"], simp, simp)+\n\nlemma cet_pow_real: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 ^\\<^sub>c e2 : REAL\"\n  by (intro cet_op[where t = \"PRODUCT REAL INTEG\"] cet_pair) simp_all\n\nlemma cet_add_real: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 +\\<^sub>c e2 : REAL\" and\n      cet_mult_real: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 *\\<^sub>c e2 : REAL\" and\n      cet_less_real: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 <\\<^sub>c e2 : BOOL\"\n  by (intro cet_op[where t = \"PRODUCT REAL REAL\"] cet_pair, simp, simp, simp)+\n\n\nlemma cet_eq: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : t \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : t \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 =\\<^sub>c e2 : BOOL\"\n  by (intro cet_op[where t = \"PRODUCT t t\"] cet_pair, simp, simp, simp)+\n\nlemma cet_less_eq_real: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 \\<le>\\<^sub>c e2 : BOOL\"\n  by (intro cet_less_real cet_or cet_eq)\n\nlemma cet_minus_int: \"\\<Gamma> \\<turnstile>\\<^sub>c e : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c -\\<^sub>ce : INTEG\"\n  by (rule cet_op[where t = \"INTEG\"], simp, simp)+\n\nlemma cet_add_int: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 +\\<^sub>c e2 : INTEG\" and\n      cet_mult_int: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 *\\<^sub>c e2 : INTEG\" and\n      cet_less_int: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 <\\<^sub>c e2 : BOOL\"\n  by (intro cet_op[where t = \"PRODUCT INTEG INTEG\"] cet_pair, simp, simp, simp)+\n\nlemma cet_less_eq_int: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 \\<le>\\<^sub>c e2 : BOOL\"\n  by (intro cet_less_int cet_or cet_eq)\n\nlemma cet_sub_int: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 -\\<^sub>c e2 : INTEG\"\n  by (intro cet_minus_int cet_add_int)\n\nlemma cet_fst: \"\\<Gamma> \\<turnstile>\\<^sub>c e : PRODUCT t t' \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c fst\\<^sub>c e : t\" and\n      cet_snd: \"\\<Gamma> \\<turnstile>\\<^sub>c e : PRODUCT t t' \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c snd\\<^sub>c e : t'\"\n  by (erule cet_op, simp)+\n\nlemma cet_cast_real: \"\\<Gamma> \\<turnstile>\\<^sub>c e : BOOL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c \\<langle>e\\<rangle>\\<^sub>c : REAL\"\n  by (intro cet_op[where t = BOOL]) simp_all\n\nlemma cet_cast_real_int: \"\\<Gamma> \\<turnstile>\\<^sub>c e : INTEG \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c \\<langle>e\\<rangle>\\<^sub>c : REAL\"\n  by (intro cet_op[where t = INTEG]) simp_all\n\nlemma cet_sub_real: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e2 : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e1 -\\<^sub>c e2 : REAL\"\n  by (intro cet_minus_real cet_add_real)\n\nlemma cet_pi: \"\\<Gamma> \\<turnstile>\\<^sub>c \\<pi>\\<^sub>c : REAL\"\n  by (rule cet_op, rule cet_val, simp)\n\nlemmas cet_op_intros =\n  cet_minus_real cet_exp cet_sqrt cet_ln cet_inverse cet_pow_real cet_pi\n  cet_cast_real cet_add_real cet_mult_real cet_less_real\n  cet_not cet_and cet_or\n\ninductive_cases cexpr_typing_valE[elim]:  \"\\<Gamma> \\<turnstile>\\<^sub>c CVal v : t\"\ninductive_cases cexpr_typing_varE[elim]:  \"\\<Gamma> \\<turnstile>\\<^sub>c CVar x : t\"\ninductive_cases cexpr_typing_pairE[elim]: \"\\<Gamma> \\<turnstile>\\<^sub>c <e1, e2>\\<^sub>c : t\"\ninductive_cases cexpr_typing_opE[elim]:   \"\\<Gamma> \\<turnstile>\\<^sub>c oper $$\\<^sub>c e : t\"\ninductive_cases cexpr_typing_ifE[elim]:   \"\\<Gamma> \\<turnstile>\\<^sub>c IF\\<^sub>c b THEN e1 ELSE e2 : t\"\ninductive_cases cexpr_typing_intE[elim]:  \"\\<Gamma> \\<turnstile>\\<^sub>c \\<integral>\\<^sub>c e \\<partial>t : t'\"\n\nprimrec cexpr_type :: \"tyenv \\<Rightarrow> cexpr \\<Rightarrow> pdf_type option\" where\n  \"cexpr_type _ (CVal v) = Some (val_type v)\"\n| \"cexpr_type \\<Gamma> (CVar x) = Some (\\<Gamma> x)\"\n| \"cexpr_type \\<Gamma> (<e1, e2>\\<^sub>c) = (case (cexpr_type \\<Gamma> e1, cexpr_type \\<Gamma> e2) of\n                                (Some t1, Some t2) \\<Rightarrow> Some (PRODUCT t1 t2)\n                              | _ \\<Rightarrow> None)\"\n| \"cexpr_type \\<Gamma> (oper $$\\<^sub>c e) = (case cexpr_type \\<Gamma> e of\n                                 Some t \\<Rightarrow> op_type oper t\n                               | _ \\<Rightarrow> None)\"\n| \"cexpr_type \\<Gamma> (IF\\<^sub>c b THEN e1 ELSE e2) =\n                              (if cexpr_type \\<Gamma> b = Some BOOL then\n                                 case (cexpr_type \\<Gamma> e1, cexpr_type \\<Gamma> e2) of\n                                   (Some t, Some t') \\<Rightarrow> if t = t' then Some t else None\n                                 | _ \\<Rightarrow> None\n                               else None)\"\n| \"cexpr_type \\<Gamma> (\\<integral>\\<^sub>c e \\<partial>t) =\n      (if cexpr_type (case_nat t \\<Gamma>) e = Some REAL then Some REAL else None)\"\n\nlemma cexpr_type_Some_iff: \"cexpr_type \\<Gamma> e = Some t \\<longleftrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e : t\"\n  apply rule\n  apply (induction e arbitrary: \\<Gamma> t,\n         auto intro!: cexpr_typing.intros split: option.split_asm if_split_asm) []\n  apply (induction rule: cexpr_typing.induct, auto)\n  done\n\nlemmas cexpr_typing_code[code_unfold] = cexpr_type_Some_iff[symmetric]\n\nlemma cexpr_typing_cong':\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e : t\" \"\\<And>x. x \\<in> free_vars e \\<Longrightarrow> \\<Gamma> x = \\<Gamma>' x\"\n  shows \"\\<Gamma>' \\<turnstile>\\<^sub>c e : t\"\nusing assms\nproof (induction arbitrary: \\<Gamma>' rule: cexpr_typing.induct)\n  case (cet_int t \\<Gamma> e \\<Gamma>')\n  hence \"\\<And>x. x \\<in> free_vars e \\<Longrightarrow> case_nat t \\<Gamma> x = case_nat t \\<Gamma>' x\"\n    by (auto split: nat.split)\n  from cet_int.IH[OF this] show ?case by (auto intro!: cexpr_typing.intros)\nqed (auto intro!: cexpr_typing.intros)\n\nlemma cexpr_typing_cong:\n  assumes \"\\<And>x. x \\<in> free_vars e \\<Longrightarrow> \\<Gamma> x = \\<Gamma>' x\"\n  shows \"\\<Gamma> \\<turnstile>\\<^sub>c e : t \\<longleftrightarrow> \\<Gamma>' \\<turnstile>\\<^sub>c e : t\"\n  by (rule iffI) (erule cexpr_typing_cong', simp add: assms)+\n\n\nprimrec cexpr_sem :: \"state \\<Rightarrow> cexpr \\<Rightarrow> val\" where\n  \"cexpr_sem \\<sigma> (CVal v) = v\"\n| \"cexpr_sem \\<sigma> (CVar x) = \\<sigma> x\"\n| \"cexpr_sem \\<sigma> <e1, e2>\\<^sub>c = <|cexpr_sem \\<sigma> e1, cexpr_sem \\<sigma> e2|>\"\n| \"cexpr_sem \\<sigma> (oper $$\\<^sub>c e) = op_sem oper (cexpr_sem \\<sigma> e)\"\n| \"cexpr_sem \\<sigma> (IF\\<^sub>c b THEN e1 ELSE e2) = (if cexpr_sem \\<sigma> b = TRUE then cexpr_sem \\<sigma> e1 else cexpr_sem \\<sigma> e2)\"\n| \"cexpr_sem \\<sigma> (\\<integral>\\<^sub>c e \\<partial>t) = RealVal (\\<integral>x. extract_real (cexpr_sem (x \\<cdot> \\<sigma>) e) \\<partial>(stock_measure t))\"\n\ndefinition cexpr_equiv :: \"cexpr \\<Rightarrow> cexpr \\<Rightarrow> bool\" where\n  \"cexpr_equiv e1 e2 \\<equiv> \\<forall>\\<sigma>. cexpr_sem \\<sigma> e1 = cexpr_sem \\<sigma> e2\"\n\nlemma cexpr_equiv_commute: \"cexpr_equiv e1 e2 \\<longleftrightarrow> cexpr_equiv e2 e1\"\n  by (auto simp: cexpr_equiv_def)\n\n\nlemma val_type_cexpr_sem[simp]:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e : t\" \"free_vars e \\<subseteq> V\" \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\"\n  shows \"val_type (cexpr_sem \\<sigma> e) = t\"\nusing assms by (induction arbitrary: \\<sigma> V rule: cexpr_typing.induct)\n               (auto intro: state_measure_var_type op_sem_val_type)\n\nlemma cexpr_sem_eq_on_vars:\n  assumes \"\\<And>x. x \\<in> free_vars e \\<Longrightarrow> \\<sigma> x = \\<sigma>' x\"\n  shows \"cexpr_sem \\<sigma> e = cexpr_sem \\<sigma>' e\"\nusing assms\nproof (induction e arbitrary: \\<sigma> \\<sigma>')\n  case (CPair e1 e2 \\<sigma> \\<sigma>')\n  from CPair.prems show ?case by (auto intro!: CPair.IH)\nnext\n  case (COperator oper e \\<sigma> \\<sigma>')\n  from COperator.prems show ?case by (auto simp: COperator.IH[of \\<sigma> \\<sigma>'])\nnext\n  case (CIf b e1 e2 \\<sigma> \\<sigma>')\n  from CIf.prems show ?case by (auto simp: CIf.IH[of \\<sigma> \\<sigma>'])\nnext\n  case (CIntegral e t \\<sigma> \\<sigma>')\n  have \"cexpr_sem \\<sigma> (\\<integral>\\<^sub>c e \\<partial>t) = RealVal (\\<integral>x. extract_real (cexpr_sem (case_nat x \\<sigma>) e) \\<partial>stock_measure t)\"\n    by simp\n  also from CIntegral.prems have A: \"(\\<lambda>v. cexpr_sem (case_nat v \\<sigma>) e) = (\\<lambda>v. cexpr_sem (case_nat v \\<sigma>') e)\"\n    by (intro ext CIntegral.IH) (auto split: nat.split)\n  also have \"RealVal (\\<integral>x. extract_real (cexpr_sem (case_nat x \\<sigma>') e) \\<partial>stock_measure t) = cexpr_sem \\<sigma>' (\\<integral>\\<^sub>c e \\<partial>t)\"\n    by simp\n  finally show ?case .\nqed simp_all\n\n\ndefinition eval_cexpr :: \"cexpr \\<Rightarrow> state \\<Rightarrow> val \\<Rightarrow> real\" where\n  \"eval_cexpr e \\<sigma> v = extract_real (cexpr_sem (case_nat v \\<sigma>) e)\"\n\nlemma measurable_cexpr_sem[measurable]:\n  \"\\<Gamma> \\<turnstile>\\<^sub>c e : t \\<Longrightarrow> free_vars e \\<subseteq> V \\<Longrightarrow>\n      (\\<lambda>\\<sigma>. cexpr_sem \\<sigma> e) \\<in> measurable (state_measure V \\<Gamma>) (stock_measure t)\"\nproof (induction arbitrary: V rule: cexpr_typing.induct)\n  case (cet_op oper t t' \\<Gamma> e)\n      thus ?case using measurable_op_sem by simp\nnext\n  case (cet_int t \\<Gamma> e)\n  interpret sigma_finite_measure \"stock_measure t\" by simp\n  let ?M = \"(\\<Pi>\\<^sub>M x\\<in>V. stock_measure (\\<Gamma> x)) \\<Otimes>\\<^sub>M stock_measure t\"\n  let ?N = \"embed_measure lborel RealVal\"\n  have *[measurable]: \"(\\<lambda>a. cexpr_sem a e) \\<in> measurable (state_measure (shift_var_set V) (case_nat t \\<Gamma>)) REAL\"\n    using cet_int.prems subset_shift_var_set\n    by (intro cet_int.IH) simp\n  show ?case\n    by simp\nqed (simp_all add: state_measure_def inj_PairVal)\n\nlemma measurable_eval_cexpr[measurable]:\n  assumes \"case_nat t \\<Gamma> \\<turnstile>\\<^sub>c e : REAL\"\n  assumes \"free_vars e \\<subseteq> shift_var_set V\"\n  shows \"case_prod (eval_cexpr e) \\<in> borel_measurable (state_measure V \\<Gamma> \\<Otimes>\\<^sub>M stock_measure t)\"\n  unfolding eval_cexpr_def[abs_def] using measurable_cexpr_sem[OF assms] by simp\n\nlemma cexpr_sem_Add:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : REAL\" \"\\<Gamma> \\<turnstile>\\<^sub>c e2 : REAL\"\n  assumes \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\" \"free_vars e1 \\<subseteq> V\" \"free_vars e2 \\<subseteq> V\"\n  shows \"extract_real (cexpr_sem \\<sigma> (e1 +\\<^sub>c e2)) = extract_real (cexpr_sem \\<sigma> e1) + extract_real (cexpr_sem \\<sigma> e2)\"\n  using val_type_cexpr_sem[OF assms(1,4,3)] val_type_cexpr_sem[OF assms(2,5,3)]\n  by (auto simp: lift_RealIntVal2_def extract_real_def split: val.split)\n\nlemma cexpr_sem_Mult:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : REAL\" \"\\<Gamma> \\<turnstile>\\<^sub>c e2 : REAL\"\n  assumes \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\" \"free_vars e1 \\<subseteq> V\" \"free_vars e2 \\<subseteq> V\"\n  shows \"extract_real (cexpr_sem \\<sigma> (e1 *\\<^sub>c e2)) = extract_real (cexpr_sem \\<sigma> e1) * extract_real (cexpr_sem \\<sigma> e2)\"\n  using val_type_cexpr_sem[OF assms(1,4,3)] val_type_cexpr_sem[OF assms(2,5,3)]\n  by (auto simp: lift_RealIntVal2_def extract_real_def split: val.split)\n\n\nsubsection \\<open>General functions on Expressions\\<close>\n\ntext \\<open>\n   Transform variable names in an expression.\n\\<close>\nprimrec map_vars :: \"(vname \\<Rightarrow> vname) \\<Rightarrow> cexpr \\<Rightarrow> cexpr\" where\n  \"map_vars f (CVal v) = CVal v\"\n| \"map_vars f (CVar x) = CVar (f x)\"\n| \"map_vars f (<e1, e2>\\<^sub>c) = <map_vars f e1, map_vars f e2>\\<^sub>c\"\n| \"map_vars f (oper $$\\<^sub>c e) = oper $$\\<^sub>c (map_vars f e)\"\n| \"map_vars f (IF\\<^sub>c b THEN e1 ELSE e2) = (IF\\<^sub>c map_vars f b THEN map_vars f e1 ELSE map_vars f e2)\"\n| \"map_vars f (\\<integral>\\<^sub>c e \\<partial>t) = \\<integral>\\<^sub>c map_vars (case_nat 0 (\\<lambda>x. Suc (f x))) e \\<partial>t\"\n\nlemma free_vars_map_vars[simp]:\n  \"free_vars (map_vars f e) = f ` free_vars e\"\nproof (induction e arbitrary: f)\n  case (CIntegral e t f)\n  {\n    fix x A assume \"Suc x \\<in> A\"\n    hence \"Suc (f x) \\<in> case_nat 0 (\\<lambda>x. Suc (f x)) ` A\"\n      by (subst image_iff, intro bexI[of _ \"Suc x\"]) (simp split: nat.split)\n  }\n  with CIntegral show ?case by (auto split: nat.split_asm)\nqed auto\n\nlemma cexpr_typing_map_vars:\n  \"\\<Gamma> \\<circ> f \\<turnstile>\\<^sub>c e : t \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c map_vars f e : t\"\nproof (induction \"\\<Gamma> \\<circ> f\" e t arbitrary: \\<Gamma> f rule: cexpr_typing.induct)\n  case (cet_int t e \\<Gamma>)\n  have \"case_nat t (\\<Gamma> \\<circ> f) = case_nat t \\<Gamma> \\<circ> (case_nat 0 (\\<lambda>x. Suc (f x)))\"\n    by (intro ext) (auto split: nat.split)\n  from cet_int(2)[OF this] show ?case by (auto intro!: cexpr_typing.intros)\nqed (auto intro!: cexpr_typing.intros)\n\nlemma cexpr_sem_map_vars:\n  \"cexpr_sem \\<sigma> (map_vars f e) = cexpr_sem (\\<sigma> \\<circ> f) e\"\nproof (induction e arbitrary: \\<sigma> f)\n  case (CIntegral e t \\<sigma> f)\n  {\n    fix x\n    have \"cexpr_sem (case_nat x \\<sigma>) (map_vars (case_nat 0 (\\<lambda>x. Suc (f x))) e) =\n                 cexpr_sem (case_nat x \\<sigma> \\<circ> case_nat 0 (\\<lambda>x. Suc (f x))) e\"\n      by (rule CIntegral.IH)\n    also have \"case_nat x \\<sigma> \\<circ> case_nat 0 (\\<lambda>x. Suc (f x)) = case_nat x (\\<lambda>a. \\<sigma> (f a))\"\n      by (intro ext) (auto simp add: o_def split: nat.split)\n    finally have \"cexpr_sem (case_nat x \\<sigma>) (map_vars (case_nat 0 (\\<lambda>x. Suc (f x))) e) =\n                      cexpr_sem (case_nat x (\\<lambda>a. \\<sigma> (f a))) e\" .\n  }\n  thus ?case by simp\nqed simp_all\n\ndefinition insert_var :: \"vname \\<Rightarrow> (vname \\<Rightarrow> 'a) \\<Rightarrow> 'a \\<Rightarrow> vname \\<Rightarrow> 'a\" where\n  \"insert_var v f x w \\<equiv> if w = v then x else if w > v then f (w - 1) else f w\"\n\n\n\ntext \\<open>\n  Substitutes expression e for variable x in e'.\n\\<close>\nprimrec cexpr_subst :: \"vname \\<Rightarrow> cexpr \\<Rightarrow> cexpr \\<Rightarrow> cexpr\" where\n  \"cexpr_subst _ _ (CVal v) = CVal v\"\n| \"cexpr_subst x e (CVar y) = insert_var x CVar e y\"\n| \"cexpr_subst x e <e1, e2>\\<^sub>c = <cexpr_subst x e e1, cexpr_subst x e e2>\\<^sub>c\"\n| \"cexpr_subst x e (oper $$\\<^sub>c e') = oper $$\\<^sub>c (cexpr_subst x e e')\"\n| \"cexpr_subst x e (IF\\<^sub>c b THEN e1 ELSE e2) =\n      (IF\\<^sub>c cexpr_subst x e b THEN cexpr_subst x e e1 ELSE cexpr_subst x e e2)\"\n| \"cexpr_subst x e (\\<integral>\\<^sub>c e' \\<partial>t) = (\\<integral>\\<^sub>c cexpr_subst (Suc x) (map_vars Suc e) e' \\<partial>t)\"\n\nlemma cexpr_sem_cexpr_subst_aux:\n    \"cexpr_sem \\<sigma> (cexpr_subst x e e') = cexpr_sem (insert_var x \\<sigma> (cexpr_sem \\<sigma> e)) e'\"\nproof (induction e' arbitrary: x e \\<sigma>)\n  case (CIntegral e' t x e \\<sigma>)\n    have A: \"\\<And>y. insert_var (Suc x) (case_nat y \\<sigma>) (cexpr_sem \\<sigma> e) =\n                    case_nat y (insert_var x \\<sigma> (cexpr_sem \\<sigma> e))\"\n      by (intro ext) (simp add: insert_var_def split: nat.split)\n  show ?case by (simp add: o_def A cexpr_sem_map_vars CIntegral.IH)\nqed (simp_all add: insert_var_def)\n\ntext \\<open>\n   This corresponds to a Let-binding; the variable with index 0 is substituted\n   with the given expression.\n\\<close>\nlemma cexpr_sem_cexpr_subst:\n    \"cexpr_sem \\<sigma> (cexpr_subst 0 e e') = cexpr_sem (case_nat (cexpr_sem \\<sigma> e) \\<sigma>) e'\"\n  using cexpr_sem_cexpr_subst_aux by simp\n\nlemma cexpr_typing_subst_aux:\n  assumes \"insert_var x \\<Gamma> t \\<turnstile>\\<^sub>c e' : t'\" \"\\<Gamma> \\<turnstile>\\<^sub>c e : t\"\n  shows \"\\<Gamma> \\<turnstile>\\<^sub>c cexpr_subst x e e' : t'\"\nusing assms\nproof (induction e' arbitrary: x \\<Gamma> e t')\n  case CVar\n  thus ?case by (auto intro!: cexpr_typing.intros simp: insert_var_def)\nnext\n  case COperator\n  thus ?case by (auto simp: cexpr_type_Some_iff[symmetric] split: option.split_asm)\nnext\n  case (CIntegral e' t'')\n  have t': \"t' = REAL\" using CIntegral.prems(1) by auto\n  have \"case_nat t'' (insert_var x \\<Gamma> t) \\<turnstile>\\<^sub>c e' : t'\" using CIntegral.prems(1) by auto\n  also have \"case_nat t'' (insert_var x \\<Gamma> t) = insert_var (Suc x) (case_nat t'' \\<Gamma>) t\"\n    by (intro ext) (simp add: insert_var_def split: nat.split)\n  finally have \"insert_var (Suc x) (case_nat t'' \\<Gamma>) t \\<turnstile>\\<^sub>c e' : t'\" .\n  moreover from CIntegral.prems(2) have \"case_nat t'' \\<Gamma> \\<turnstile>\\<^sub>c map_vars Suc e : t\"\n    by (intro cexpr_typing_map_vars) (simp add: o_def)\n  ultimately have \"case_nat t'' \\<Gamma> \\<turnstile>\\<^sub>c cexpr_subst (Suc x) (map_vars Suc e) e' : t'\"\n    by (rule CIntegral.IH)\n  thus ?case by (auto intro: cet_int simp: t')\nqed (auto intro!: cexpr_typing.intros)\n\nlemma cexpr_typing_subst[intro]:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e : t\" \"case_nat t \\<Gamma> \\<turnstile>\\<^sub>c e' : t'\"\n  shows \"\\<Gamma> \\<turnstile>\\<^sub>c cexpr_subst 0 e e' : t'\"\n  using cexpr_typing_subst_aux assms by simp\n\n\nlemma free_vars_cexpr_subst_aux:\n  \"free_vars (cexpr_subst x e e') \\<subseteq> (\\<lambda>y. if y \\<ge> x then y + 1 else y) -` free_vars e' \\<union> free_vars e\"\n    (is \"free_vars _ \\<subseteq> ?f x -` _ \\<union> _\")\nproof (induction e' arbitrary: x e)\n  case (CVar y x e)\n  show ?case by (auto simp: insert_var_def)\nnext\n  case (CPair e'1 e'2 x e)\n  from CPair.IH[of x e] show ?case by auto\nnext\n  case (COperator _ _ x e)\n  from COperator.IH[of x e] show ?case by auto\nnext\n  case (CIf b e'1 e'2 x e)\n  from CIf.IH[of x e] show ?case by auto\nnext\n  case (CIntegral e' t x e)\n  have \"free_vars (cexpr_subst x e (\\<integral>\\<^sub>c e' \\<partial>t)) \\<subseteq>\n          Suc -` (?f (Suc x) -` free_vars e') \\<union>\n          Suc -` (free_vars (map_vars Suc e))\" (is \"_ \\<subseteq> ?A \\<union> ?B\")\n    by (simp only: cexpr_subst.simps free_vars_cexpr.simps\n                   vimage_mono CIntegral.IH vimage_Un[symmetric])\n  also have \"?B = free_vars e\" by (simp add: inj_vimage_image_eq)\n  also have \"?A \\<subseteq> ?f x -` free_vars (\\<integral>\\<^sub>c e' \\<partial>t)\" by auto\n  finally show ?case by blast\nqed simp_all\n\nlemma free_vars_cexpr_subst:\n    \"free_vars (cexpr_subst 0 e e') \\<subseteq> Suc -` free_vars e' \\<union> free_vars e\"\n  by (rule order.trans[OF free_vars_cexpr_subst_aux]) (auto simp: shift_var_set_def)\n\n\n\nprimrec cexpr_comp_aux :: \"vname \\<Rightarrow> cexpr \\<Rightarrow> cexpr \\<Rightarrow> cexpr\" where\n  \"cexpr_comp_aux _ _ (CVal v) = CVal v\"\n| \"cexpr_comp_aux x e (CVar y) = (if x = y then e else CVar y)\"\n| \"cexpr_comp_aux x e <e1, e2>\\<^sub>c = <cexpr_comp_aux x e e1, cexpr_comp_aux x e e2>\\<^sub>c\"\n| \"cexpr_comp_aux x e (oper $$\\<^sub>c e') = oper $$\\<^sub>c (cexpr_comp_aux x e e')\"\n| \"cexpr_comp_aux x e (IF\\<^sub>c b THEN e1 ELSE e2) =\n      (IF\\<^sub>c cexpr_comp_aux x e b THEN cexpr_comp_aux x e e1 ELSE cexpr_comp_aux x e e2)\"\n| \"cexpr_comp_aux x e (\\<integral>\\<^sub>c e' \\<partial>t) = (\\<integral>\\<^sub>c cexpr_comp_aux (Suc x) (map_vars Suc e) e' \\<partial>t)\"\n\nlemma cexpr_sem_cexpr_comp_aux:\n    \"cexpr_sem \\<sigma> (cexpr_comp_aux x e e') = cexpr_sem (\\<sigma>(x := cexpr_sem \\<sigma> e)) e'\"\nproof (induction e' arbitrary: x e \\<sigma>)\n  case (CIntegral e' t x e \\<sigma>)\n  have \"\\<And>y. (case_nat y \\<sigma>)(Suc x := cexpr_sem (case_nat y \\<sigma>) (map_vars Suc e)) =\n                 case_nat y (\\<sigma>(x := cexpr_sem \\<sigma> e))\"\n    by (intro ext) (auto simp: cexpr_sem_map_vars o_def split: nat.split)\n  thus ?case by (auto intro!: integral_cong simp: CIntegral.IH simp del: fun_upd_apply)\nqed (simp_all add: insert_var_def)\n\ndefinition cexpr_comp (infixl \"\\<circ>\\<^sub>c\" 55) where\n  \"cexpr_comp b a \\<equiv> cexpr_comp_aux 0 a b\"\n\nlemma cexpr_typing_cexpr_comp_aux:\n  assumes \"\\<Gamma>(x := t1) \\<turnstile>\\<^sub>c e' : t2\" \"\\<Gamma> \\<turnstile>\\<^sub>c e : t1\"\n  shows \"\\<Gamma> \\<turnstile>\\<^sub>c cexpr_comp_aux x e e' : t2\"\nusing assms\nproof (induction e' arbitrary: \\<Gamma> e x t2)\n  case COperator\n  thus ?case by (elim cexpr_typing_opE) (auto intro!: cexpr_typing.intros) []\nnext\n  case CPair\n  thus ?case by (elim cexpr_typing_pairE) (auto intro!: cexpr_typing.intros) []\nnext\n  case (CIntegral e' t \\<Gamma> e x t2)\n  from CIntegral.prems have [simp]: \"t2 = REAL\" by auto\n  from CIntegral.prems have \"case_nat t (\\<Gamma>(x := t1)) \\<turnstile>\\<^sub>c e' : REAL\" by (elim cexpr_typing_intE)\n  also have \"case_nat t (\\<Gamma>(x := t1)) = (case_nat t \\<Gamma>)(Suc x := t1)\"\n    by (intro ext) (simp split: nat.split)\n  finally have \"... \\<turnstile>\\<^sub>c e' : REAL\" .\n  thus \"\\<Gamma> \\<turnstile>\\<^sub>c cexpr_comp_aux x e (\\<integral>\\<^sub>c e' \\<partial>t) : t2\"\n    by (auto intro!: cexpr_typing.intros CIntegral.IH cexpr_typing_map_vars\n             simp: o_def CIntegral.prems)\nqed (auto intro!: cexpr_typing.intros)\n\nlemma cexpr_typing_cexpr_comp[intro]:\n  assumes \"case_nat t1 \\<Gamma> \\<turnstile>\\<^sub>c g : t2\"\n  assumes \"case_nat t2 \\<Gamma> \\<turnstile>\\<^sub>c f : t3\"\n  shows \"case_nat t1 \\<Gamma> \\<turnstile>\\<^sub>c f \\<circ>\\<^sub>c g : t3\"\nproof (unfold cexpr_comp_def, intro cexpr_typing_cexpr_comp_aux)\n  have \"(case_nat t1 \\<Gamma>)(0 := t2) = case_nat t2 \\<Gamma>\"\n    by (intro ext) (simp split: nat.split)\n  with assms show \"(case_nat t1 \\<Gamma>)(0 := t2) \\<turnstile>\\<^sub>c f : t3\" by simp\nqed (insert assms)\n\n\nlemma free_vars_cexpr_comp_aux:\n  \"free_vars (cexpr_comp_aux x e e') \\<subseteq> (free_vars e' - {x}) \\<union> free_vars e\"\nproof (induction e' arbitrary: x e)\n  case (CIntegral e' t x e)\n  note IH = CIntegral.IH[of \"Suc x\" \"map_vars Suc e\"]\n  have \"free_vars (cexpr_comp_aux x e (\\<integral>\\<^sub>c e' \\<partial>t)) =\n           Suc -` free_vars (cexpr_comp_aux (Suc x) (map_vars Suc e) e')\" by simp\n  also have \"... \\<subseteq> Suc -` (free_vars e' - {Suc x} \\<union> free_vars (map_vars Suc e))\"\n    by (rule vimage_mono, rule CIntegral.IH)\n  also have \"... \\<subseteq> free_vars (\\<integral>\\<^sub>c e' \\<partial>t) - {x} \\<union> free_vars e\"\n    by (auto simp add: vimage_Diff vimage_image_eq)\n  finally show ?case .\nqed (simp, blast?)+\n\nlemma free_vars_cexpr_comp:\n  \"free_vars (cexpr_comp e e') \\<subseteq> (free_vars e - {0}) \\<union> free_vars e'\"\n  by (simp add: free_vars_cexpr_comp_aux cexpr_comp_def)\n\nlemma free_vars_cexpr_comp':\n  \"free_vars (cexpr_comp e e') \\<subseteq> free_vars e \\<union> free_vars e'\"\n  using free_vars_cexpr_comp by blast\n\nlemma cexpr_sem_cexpr_comp:\n    \"cexpr_sem \\<sigma> (f \\<circ>\\<^sub>c g) = cexpr_sem (\\<sigma>(0 := cexpr_sem \\<sigma> g)) f\"\n  unfolding cexpr_comp_def by (simp add: cexpr_sem_cexpr_comp_aux)\n\nlemma eval_cexpr_comp:\n    \"eval_cexpr (f \\<circ>\\<^sub>c g) \\<sigma> x = eval_cexpr f \\<sigma> (cexpr_sem (case_nat x \\<sigma>) g)\"\nproof-\n  have \"(case_nat x \\<sigma>)(0 := cexpr_sem (case_nat x \\<sigma>) g) = case_nat (cexpr_sem (case_nat x \\<sigma>) g) \\<sigma>\"\n    by (intro ext) (auto split: nat.split)\n  thus ?thesis by (simp add: eval_cexpr_def cexpr_sem_cexpr_comp)\nqed\n\nprimrec cexpr_subst_val_aux :: \"nat \\<Rightarrow> cexpr \\<Rightarrow> val \\<Rightarrow> cexpr\" where\n  \"cexpr_subst_val_aux _ (CVal v) _ = CVal v\"\n| \"cexpr_subst_val_aux x (CVar y) v = insert_var x CVar (CVal v) y\"\n| \"cexpr_subst_val_aux x (IF\\<^sub>c b THEN e1 ELSE e2) v =\n    (IF\\<^sub>c cexpr_subst_val_aux x b v THEN cexpr_subst_val_aux x e1 v ELSE cexpr_subst_val_aux x e2 v)\"\n| \"cexpr_subst_val_aux x (oper $$\\<^sub>c e) v = oper $$\\<^sub>c (cexpr_subst_val_aux x e v)\"\n| \"cexpr_subst_val_aux x <e1, e2>\\<^sub>c v = <cexpr_subst_val_aux x e1 v, cexpr_subst_val_aux x e2 v>\\<^sub>c\"\n| \"cexpr_subst_val_aux x (\\<integral>\\<^sub>c e \\<partial>t) v = \\<integral>\\<^sub>c cexpr_subst_val_aux (Suc x) e v \\<partial>t\"\n\nlemma cexpr_subst_val_aux_eq_cexpr_subst:\n    \"cexpr_subst_val_aux x e v = cexpr_subst x (CVal v) e\"\n  by (induction e arbitrary: x) simp_all\n\ndefinition cexpr_subst_val :: \"cexpr \\<Rightarrow> val \\<Rightarrow> cexpr\" where\n  \"cexpr_subst_val e v \\<equiv> cexpr_subst_val_aux 0 e v\"\n\nlemma cexpr_sem_cexpr_subst_val[simp]:\n    \"cexpr_sem \\<sigma> (cexpr_subst_val e v) = cexpr_sem (case_nat v \\<sigma>) e\"\n  by (simp add: cexpr_subst_val_def cexpr_subst_val_aux_eq_cexpr_subst cexpr_sem_cexpr_subst)\n\nlemma cexpr_typing_subst_val[intro]:\n    \"case_nat t \\<Gamma> \\<turnstile>\\<^sub>c e : t' \\<Longrightarrow> val_type v = t \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c cexpr_subst_val e v : t'\"\n  by (auto simp: cexpr_subst_val_def cexpr_subst_val_aux_eq_cexpr_subst intro!: cet_val')\n\nlemma free_vars_cexpr_subst_val_aux:\n    \"free_vars (cexpr_subst_val_aux x e v) = (\\<lambda>y. if y \\<ge> x then Suc y else y) -` free_vars e\"\n  by (induction e arbitrary: x) (auto simp: insert_var_def split: if_split_asm)\n\nlemma free_vars_cexpr_subst_val[simp]:\n    \"free_vars (cexpr_subst_val e v) = Suc -` free_vars e\"\n  by (simp add: cexpr_subst_val_def free_vars_cexpr_subst_val_aux)\n\n\nsubsection \\<open>Nonnegative expressions\\<close>\n\ndefinition \"nonneg_cexpr V \\<Gamma> e \\<equiv>\n    \\<forall>\\<sigma> \\<in> space (state_measure V \\<Gamma>). extract_real (cexpr_sem \\<sigma> e) \\<ge> 0\"\n\nlemma nonneg_cexprI:\n    \"(\\<And>\\<sigma>. \\<sigma> \\<in> space (state_measure V \\<Gamma>) \\<Longrightarrow> extract_real (cexpr_sem \\<sigma> e) \\<ge> 0) \\<Longrightarrow> nonneg_cexpr V \\<Gamma> e\"\n  unfolding nonneg_cexpr_def by simp\n\nlemma nonneg_cexprD:\n    \"nonneg_cexpr V \\<Gamma> e \\<Longrightarrow> \\<sigma> \\<in> space (state_measure V \\<Gamma>) \\<Longrightarrow> extract_real (cexpr_sem \\<sigma> e) \\<ge> 0\"\n  unfolding nonneg_cexpr_def by simp\n\nlemma nonneg_cexpr_map_vars:\n  assumes \"nonneg_cexpr (f -` V) (\\<Gamma> \\<circ> f) e\"\n  shows \"nonneg_cexpr V \\<Gamma> (map_vars f e)\"\n  by (intro nonneg_cexprI, subst cexpr_sem_map_vars, intro nonneg_cexprD[OF assms])\n     (auto simp: state_measure_def space_PiM)\n\nlemma nonneg_cexpr_subset:\n  assumes \"nonneg_cexpr V \\<Gamma> e\" \"V \\<subseteq> V'\" \"free_vars e \\<subseteq> V\"\n  shows \"nonneg_cexpr V' \\<Gamma> e\"\nproof (intro nonneg_cexprI)\n  fix \\<sigma> assume \"\\<sigma> \\<in> space (state_measure V' \\<Gamma>)\"\n  with assms(2) have \"restrict \\<sigma> V \\<in> space (state_measure V \\<Gamma>)\"\n    by (auto simp: state_measure_def space_PiM restrict_def)\n  from nonneg_cexprD[OF assms(1) this] have \"extract_real (cexpr_sem (restrict \\<sigma> V) e) \\<ge> 0\" .\n  also have \"cexpr_sem (restrict \\<sigma> V) e = cexpr_sem \\<sigma> e\" using assms(3)\n    by (intro cexpr_sem_eq_on_vars) auto\n  finally show \"extract_real (cexpr_sem \\<sigma> e) \\<ge> 0\" .\nqed\n\nlemma nonneg_cexpr_Mult:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : REAL\" \"\\<Gamma> \\<turnstile>\\<^sub>c e2 : REAL\"\n  assumes \"free_vars e1 \\<subseteq> V\" \"free_vars e2 \\<subseteq> V\"\n  assumes N1: \"nonneg_cexpr V \\<Gamma> e1\" and N2: \"nonneg_cexpr V \\<Gamma> e2\"\n  shows \"nonneg_cexpr V \\<Gamma> (e1 *\\<^sub>c e2)\"\nproof (rule nonneg_cexprI)\n  fix \\<sigma> assume \\<sigma>: \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\"\n  hence \"extract_real (cexpr_sem \\<sigma> (e1 *\\<^sub>c e2)) = extract_real (cexpr_sem \\<sigma> e1) * extract_real (cexpr_sem \\<sigma> e2)\"\n    using assms by (subst cexpr_sem_Mult[of \\<Gamma> _ _ _ V]) simp_all\n  also have \"... \\<ge> 0\" using \\<sigma> N1 N2 by (intro mult_nonneg_nonneg nonneg_cexprD)\n  finally show \"extract_real (cexpr_sem \\<sigma> (e1 *\\<^sub>c e2)) \\<ge> 0\" .\nqed\n\nlemma nonneg_indicator:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e : BOOL\" \"free_vars e \\<subseteq> V\"\n  shows \"nonneg_cexpr V \\<Gamma> (\\<langle>e\\<rangle>\\<^sub>c)\"\nproof (intro nonneg_cexprI)\n  fix \\<rho> assume \"\\<rho> \\<in> space (state_measure V \\<Gamma>)\"\n  with assms have \"val_type (cexpr_sem \\<rho> e) = BOOL\" by (rule val_type_cexpr_sem)\n  thus \"extract_real (cexpr_sem \\<rho> (\\<langle>e\\<rangle>\\<^sub>c)) \\<ge> 0\"\n    by (auto simp: extract_real_def bool_to_real_def split: val.split)\nqed\n\nlemma nonneg_cexpr_comp_aux:\n  assumes nonneg: \"nonneg_cexpr V (\\<Gamma>(x := t1)) e\"  and x:\"x \\<in> V\"\n  assumes t2: \"\\<Gamma>(x:=t1) \\<turnstile>\\<^sub>c e : t2\" and t1: \"\\<Gamma> \\<turnstile>\\<^sub>c f : t1\" and vars: \"free_vars f \\<subseteq> V\"\n  shows \"nonneg_cexpr V \\<Gamma> (cexpr_comp_aux x f e)\"\nproof (intro nonneg_cexprI)\n  fix \\<sigma> assume \\<sigma>: \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\"\n  have \"extract_real (cexpr_sem \\<sigma> (cexpr_comp_aux x f e)) =\n            extract_real (cexpr_sem (\\<sigma>(x := cexpr_sem \\<sigma> f)) e)\"\n    by (simp add: cexpr_sem_cexpr_comp_aux)\n  also from val_type_cexpr_sem[OF t1 vars \\<sigma>] have \"cexpr_sem \\<sigma> f \\<in> type_universe t1\" by auto\n  with \\<sigma> x have \"\\<sigma>(x := cexpr_sem \\<sigma> f) \\<in> space (state_measure V (\\<Gamma>(x := t1)))\"\n    by (auto simp: state_measure_def space_PiM shift_var_set_def split: if_split_asm)\n  hence \"extract_real (cexpr_sem (\\<sigma>(x := cexpr_sem \\<sigma> f)) e) \\<ge> 0\"\n    by(intro nonneg_cexprD[OF assms(1)])\n  finally show \"extract_real (cexpr_sem \\<sigma> (cexpr_comp_aux x f e)) \\<ge> 0\" .\nqed\n\nlemma nonneg_cexpr_comp:\n  assumes \"nonneg_cexpr (shift_var_set V) (case_nat t2 \\<Gamma>) e\"\n  assumes \"case_nat t1 \\<Gamma> \\<turnstile>\\<^sub>c f : t2\" \"free_vars f \\<subseteq> shift_var_set V\"\n  shows \"nonneg_cexpr (shift_var_set V) (case_nat t1 \\<Gamma>) (e \\<circ>\\<^sub>c f)\"\nproof (intro nonneg_cexprI)\n  fix \\<sigma> assume \\<sigma>: \"\\<sigma> \\<in> space (state_measure (shift_var_set V) (case_nat t1 \\<Gamma>))\"\n  have \"extract_real (cexpr_sem \\<sigma> (e \\<circ>\\<^sub>c f)) = extract_real (cexpr_sem (\\<sigma>(0 := cexpr_sem \\<sigma> f)) e)\"\n    by (simp add: cexpr_sem_cexpr_comp)\n  also from val_type_cexpr_sem[OF assms(2,3) \\<sigma>] have \"cexpr_sem \\<sigma> f \\<in> type_universe t2\" by auto\n  with \\<sigma> have \"\\<sigma>(0 := cexpr_sem \\<sigma> f) \\<in> space (state_measure (shift_var_set V) (case_nat t2 \\<Gamma>))\"\n    by (auto simp: state_measure_def space_PiM shift_var_set_def split: if_split_asm)\n  hence \"extract_real (cexpr_sem (\\<sigma>(0 := cexpr_sem \\<sigma> f)) e) \\<ge> 0\"\n    by(intro nonneg_cexprD[OF assms(1)])\n  finally show \"extract_real (cexpr_sem \\<sigma> (e \\<circ>\\<^sub>c f)) \\<ge> 0\" .\nqed\n\nlemma nonneg_cexpr_subst_val:\n  assumes \"nonneg_cexpr (shift_var_set V) (case_nat t \\<Gamma>) e\" \"val_type v = t\"\n  shows \"nonneg_cexpr V \\<Gamma> (cexpr_subst_val e v)\"\nproof (intro nonneg_cexprI)\n  fix \\<sigma> assume \\<sigma>: \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\"\n  moreover from assms(2) have \"v \\<in> type_universe t\" by auto\n  ultimately show \"extract_real (cexpr_sem \\<sigma> (cexpr_subst_val e v)) \\<ge> 0\"\n    by (auto intro!: nonneg_cexprD[OF assms(1)])\nqed\n\nlemma nonneg_cexpr_int:\n  assumes \"nonneg_cexpr (shift_var_set V) (case_nat t \\<Gamma>) e\"\n  shows \"nonneg_cexpr V \\<Gamma> (\\<integral>\\<^sub>c e \\<partial>t)\"\nproof (intro nonneg_cexprI)\n  fix \\<sigma> assume \\<sigma>: \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\"\n  have \"extract_real (cexpr_sem \\<sigma> (\\<integral>\\<^sub>c e \\<partial>t)) = \\<integral>x. extract_real (cexpr_sem (case_nat x \\<sigma>) e) \\<partial>stock_measure t\"\n    by (simp add: extract_real_def)\n  also from \\<sigma> have \"... \\<ge> 0\"\n    by (intro integral_nonneg_AE AE_I2 nonneg_cexprD[OF assms]) auto\n  finally show \"extract_real (cexpr_sem \\<sigma> (\\<integral>\\<^sub>c e \\<partial>t)) \\<ge> 0\" .\nqed\n\n\ntext \\<open>Subprobability density expressions\\<close>\n\ndefinition \"subprob_cexpr V V' \\<Gamma> e \\<equiv>\n    \\<forall>\\<rho> \\<in> space (state_measure V' \\<Gamma>).\n      (\\<integral>\\<^sup>+\\<sigma>. extract_real (cexpr_sem (merge V V' (\\<sigma>, \\<rho>)) e) \\<partial>state_measure V \\<Gamma>) \\<le> 1\"\n\nlemma subprob_cexprI:\n  assumes \"\\<And>\\<rho>. \\<rho> \\<in> space (state_measure V' \\<Gamma>) \\<Longrightarrow>\n                 (\\<integral>\\<^sup>+\\<sigma>. extract_real (cexpr_sem (merge V V' (\\<sigma>, \\<rho>)) e) \\<partial>state_measure V \\<Gamma>) \\<le> 1\"\n  shows \"subprob_cexpr V V' \\<Gamma> e\"\n  using assms unfolding subprob_cexpr_def by simp\n\nlemma subprob_cexprD:\n  assumes \"subprob_cexpr V V' \\<Gamma> e\"\n  shows \"\\<And>\\<rho>. \\<rho> \\<in> space (state_measure V' \\<Gamma>) \\<Longrightarrow>\n               (\\<integral>\\<^sup>+\\<sigma>. extract_real (cexpr_sem (merge V V' (\\<sigma>, \\<rho>)) e) \\<partial>state_measure V \\<Gamma>) \\<le> 1\"\n  using assms unfolding subprob_cexpr_def by simp\n\nlemma subprob_indicator:\n  assumes subprob: \"subprob_cexpr V V' \\<Gamma> e1\" and nonneg: \"nonneg_cexpr (V \\<union> V') \\<Gamma> e1\"\n  assumes t1: \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : REAL\" and t2: \"\\<Gamma> \\<turnstile>\\<^sub>c e2 : BOOL\"\n  assumes vars1: \"free_vars e1 \\<subseteq> V \\<union> V'\" and vars2: \"free_vars e2 \\<subseteq> V \\<union> V'\"\n  shows \"subprob_cexpr V V' \\<Gamma> (e1 *\\<^sub>c \\<langle>e2\\<rangle>\\<^sub>c)\"\nproof (intro subprob_cexprI)\n  fix \\<rho> assume \\<rho>: \"\\<rho> \\<in> space (state_measure V' \\<Gamma>)\"\n  from t2 have t2': \"\\<Gamma> \\<turnstile>\\<^sub>c \\<langle>e2\\<rangle>\\<^sub>c : REAL\" by (rule cet_op) simp_all\n  from vars2 have vars2': \"free_vars (\\<langle>e2\\<rangle>\\<^sub>c) \\<subseteq> V \\<union> V'\" by simp\n  let ?eval = \"\\<lambda>\\<sigma> e. extract_real (cexpr_sem (merge V V' (\\<sigma>, \\<rho>)) e)\"\n  have \"(\\<integral>\\<^sup>+\\<sigma>. ?eval \\<sigma> (e1 *\\<^sub>c \\<langle>e2\\<rangle>\\<^sub>c) \\<partial>state_measure V \\<Gamma>) =\n            (\\<integral>\\<^sup>+\\<sigma>. ?eval \\<sigma> e1 * ?eval \\<sigma> (\\<langle>e2\\<rangle>\\<^sub>c) \\<partial>state_measure V \\<Gamma>)\"\n    by (intro nn_integral_cong)\n       (simp only: cexpr_sem_Mult[OF t1 t2' merge_in_state_measure[OF _ \\<rho>] vars1 vars2'])\n  also {\n    fix \\<sigma> assume \\<sigma>: \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\"\n    with \\<rho> have \"val_type (cexpr_sem (merge V V' (\\<sigma>,\\<rho>)) e2) = BOOL\"\n      by (intro val_type_cexpr_sem[OF t2 vars2] merge_in_state_measure)\n    hence \"?eval \\<sigma> (\\<langle>e2\\<rangle>\\<^sub>c) \\<in> {0,1}\"\n      by (cases \"cexpr_sem (merge V V' (\\<sigma>,\\<rho>)) e2\") (auto simp: extract_real_def bool_to_real_def)\n    moreover have \"?eval \\<sigma> e1 \\<ge> 0\" using nonneg \\<rho> \\<sigma>\n      by (auto intro!: nonneg_cexprD merge_in_state_measure)\n    ultimately have \"?eval \\<sigma> e1 * ?eval \\<sigma> (\\<langle>e2\\<rangle>\\<^sub>c) \\<le> ?eval \\<sigma> e1\"\n      by (intro mult_right_le_one_le) auto\n  }\n  hence \"(\\<integral>\\<^sup>+\\<sigma>. ?eval \\<sigma> e1 * ?eval \\<sigma> (\\<langle>e2\\<rangle>\\<^sub>c) \\<partial>state_measure V \\<Gamma>) \\<le>\n             (\\<integral>\\<^sup>+\\<sigma>. ?eval \\<sigma> e1 \\<partial>state_measure V \\<Gamma>)\"\n    by (intro nn_integral_mono) (simp add: ennreal_leI)\n  also from subprob and \\<rho> have \"... \\<le> 1\" by (rule subprob_cexprD)\n  finally show \"(\\<integral>\\<^sup>+\\<sigma>. ?eval \\<sigma> (e1 *\\<^sub>c \\<langle>e2\\<rangle>\\<^sub>c) \\<partial>state_measure V \\<Gamma>)  \\<le> 1\" .\nqed\n\nlemma measurable_cexpr_sem':\n  assumes \\<rho>: \"\\<rho> \\<in> space (state_measure V' \\<Gamma>)\"\n  assumes e: \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL\" \"free_vars e \\<subseteq> V \\<union> V'\"\n  shows \"(\\<lambda>\\<sigma>. extract_real (cexpr_sem (merge V V' (\\<sigma>, \\<rho>)) e))\n            \\<in> borel_measurable (state_measure V \\<Gamma>)\"\n  apply (rule measurable_compose[OF _ measurable_extract_real])\n  apply (rule measurable_compose[OF _ measurable_cexpr_sem[OF e]])\n  apply (insert \\<rho>, unfold state_measure_def, rule measurable_compose[OF _ measurable_merge], simp)\n  done\n\nlemma measurable_fun_upd_state_measure[measurable]:\n  assumes \"v \\<notin> V\"\n  shows \"(\\<lambda>(x,y). y(v := x)) \\<in> measurable (stock_measure (\\<Gamma> v) \\<Otimes>\\<^sub>M state_measure V \\<Gamma>)\n                                          (state_measure (insert v V) \\<Gamma>)\"\n  unfolding state_measure_def by simp\n\n\nlemma integrable_cexpr_projection:\n  assumes fin: \"finite V\"\n  assumes disjoint: \"V \\<inter> V' = {}\" \"v \\<notin> V\" \"v \\<notin> V'\"\n  assumes \\<rho>: \"\\<rho> \\<in> space (state_measure V' \\<Gamma>)\"\n  assumes e: \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL\" \"free_vars e \\<subseteq> insert v V \\<union> V'\"\n  assumes int: \"integrable (state_measure (insert v V) \\<Gamma>)\n                    (\\<lambda>\\<sigma>. extract_real (cexpr_sem (merge (insert v V) V' (\\<sigma>, \\<rho>)) e))\"\n                (is \"integrable _ ?f'\")\n  shows \"AE x in stock_measure (\\<Gamma> v).\n           integrable (state_measure V \\<Gamma>)\n               (\\<lambda>\\<sigma>. extract_real (cexpr_sem (merge V (insert v V') (\\<sigma>, \\<rho>(v := x))) e))\"\n    (is \"AE x in ?N. integrable ?M (?f x)\")\nproof (unfold real_integrable_def, intro AE_conjI)\n  show \"AE x in ?N. ?f x \\<in> borel_measurable ?M\" using \\<rho> e disjoint\n    by (intro AE_I2 measurable_cexpr_sem')\n       (auto simp: state_measure_def space_PiM dest: PiE_mem split: if_split_asm)\n\n  let ?f'' = \"\\<lambda>x \\<sigma>. extract_real (cexpr_sem (merge (insert v V) V' (\\<sigma>(v := x), \\<rho>)) e)\"\n  {\n    fix x \\<sigma> assume \"x \\<in> space ?N\" \"\\<sigma> \\<in> space ?M\"\n    hence \"merge (insert v V) V' (\\<sigma>(v := x), \\<rho>) = merge V (insert v V') (\\<sigma>, \\<rho>(v := x))\"\n      using disjoint by (intro ext) (simp add: merge_def split: if_split_asm)\n    hence \"?f'' x \\<sigma> = ?f x \\<sigma>\" by simp\n  } note f''_eq_f = this\n\n  interpret product_sigma_finite \"(\\<lambda>v. stock_measure (\\<Gamma> v))\"\n    by (simp add: product_sigma_finite_def)\n  interpret sigma_finite_measure \"state_measure V \\<Gamma>\"\n    by (rule sigma_finite_state_measure[OF fin])\n\n  from int have \"(\\<integral>\\<^sup>+\\<sigma>. ennreal (?f' \\<sigma>) \\<partial>state_measure (insert v V) \\<Gamma>) \\<noteq> \\<infinity>\"\n    by (simp add: real_integrable_def)\n  also have \"(\\<integral>\\<^sup>+\\<sigma>. ennreal (?f' \\<sigma>) \\<partial>state_measure (insert v V) \\<Gamma>) =\n                 \\<integral>\\<^sup>+x. \\<integral>\\<^sup>+\\<sigma>. ennreal (?f'' x \\<sigma>) \\<partial>?M \\<partial>?N\" (is \"_ = ?I\")\n    using fin disjoint e \\<rho>\n    by (unfold state_measure_def, subst product_nn_integral_insert_rev)\n       (auto intro!: measurable_compose[OF _ measurable_ennreal] measurable_cexpr_sem'[unfolded state_measure_def])\n  finally have \"AE x in ?N. (\\<integral>\\<^sup>+\\<sigma>. ennreal (?f'' x \\<sigma>) \\<partial>?M) \\<noteq> \\<infinity>\" (is ?P) using e disjoint\n    by (intro nn_integral_PInf_AE)\n       (auto simp: measurable_split_conv intro!: borel_measurable_nn_integral measurable_compose[OF _ measurable_ennreal]\n                   measurable_compose[OF _ measurable_cexpr_sem'[OF \\<rho>]])\n  moreover have \"\\<And>x. x \\<in> space ?N \\<Longrightarrow> (\\<integral>\\<^sup>+\\<sigma>. ennreal (?f'' x \\<sigma>) \\<partial>?M) = (\\<integral>\\<^sup>+\\<sigma>. ennreal (?f x \\<sigma>) \\<partial>?M)\"\n    by (intro nn_integral_cong) (simp add: f''_eq_f)\n  hence \"?P \\<longleftrightarrow> (AE x in ?N. (\\<integral>\\<^sup>+\\<sigma>. ennreal (?f x \\<sigma>) \\<partial>?M) \\<noteq> \\<infinity>)\" by (intro AE_cong) simp\n  ultimately show \"AE x in ?N. (\\<integral>\\<^sup>+\\<sigma>. ennreal (?f x \\<sigma>) \\<partial>?M) \\<noteq> \\<infinity>\" by simp\n\n  from int have \"(\\<integral>\\<^sup>+\\<sigma>. ennreal (-?f' \\<sigma>) \\<partial>state_measure (insert v V) \\<Gamma>) \\<noteq> \\<infinity>\"\n    by (simp add: real_integrable_def)\n  also have \"(\\<integral>\\<^sup>+\\<sigma>. ennreal (-?f' \\<sigma>) \\<partial>state_measure (insert v V) \\<Gamma>) =\n                 \\<integral>\\<^sup>+x. \\<integral>\\<^sup>+\\<sigma>. ennreal (-?f'' x \\<sigma>) \\<partial>?M \\<partial>?N\" (is \"_ = ?I\")\n    using fin disjoint e \\<rho>\n    by (unfold state_measure_def, subst product_nn_integral_insert_rev)\n       (auto intro!: measurable_compose[OF _ measurable_ennreal] borel_measurable_uminus\n                     measurable_cexpr_sem'[unfolded state_measure_def])\n  finally have \"AE x in ?N. (\\<integral>\\<^sup>+\\<sigma>. ennreal (-?f'' x \\<sigma>) \\<partial>?M) \\<noteq> \\<infinity>\" (is ?P) using e disjoint\n    by (intro nn_integral_PInf_AE)\n       (auto simp: measurable_split_conv intro!: borel_measurable_nn_integral measurable_compose[OF _ measurable_ennreal]\n                   measurable_compose[OF _ measurable_cexpr_sem'[OF \\<rho>]] borel_measurable_uminus)\n  moreover have \"\\<And>x. x \\<in> space ?N \\<Longrightarrow> (\\<integral>\\<^sup>+\\<sigma>. ennreal (-?f'' x \\<sigma>) \\<partial>?M) = (\\<integral>\\<^sup>+\\<sigma>. ennreal (-?f x \\<sigma>) \\<partial>?M)\"\n    by (intro nn_integral_cong) (simp add: f''_eq_f)\n  hence \"?P \\<longleftrightarrow> (AE x in ?N. (\\<integral>\\<^sup>+\\<sigma>. ennreal (-?f x \\<sigma>) \\<partial>?M) \\<noteq> \\<infinity>)\" by (intro AE_cong) simp\n  ultimately show \"AE x in ?N. (\\<integral>\\<^sup>+\\<sigma>. ennreal (-?f x \\<sigma>) \\<partial>?M) \\<noteq> \\<infinity>\" by simp\nqed\n\n\ndefinition cdens_ctxt_invar :: \"vname list \\<Rightarrow> vname list \\<Rightarrow> tyenv \\<Rightarrow> cexpr \\<Rightarrow> bool\" where\n  \"cdens_ctxt_invar vs vs' \\<Gamma> \\<delta> \\<equiv>\n       distinct (vs @ vs') \\<and>\n       free_vars \\<delta> \\<subseteq> set (vs @ vs') \\<and>\n       \\<Gamma> \\<turnstile>\\<^sub>c \\<delta> : REAL \\<and>\n       nonneg_cexpr (set vs \\<union> set vs') \\<Gamma> \\<delta> \\<and>\n       subprob_cexpr (set vs) (set vs') \\<Gamma> \\<delta>\"\n\nlemma cdens_ctxt_invarI:\n  \"\\<lbrakk>distinct (vs @ vs'); free_vars \\<delta> \\<subseteq> set (vs @ vs'); \\<Gamma> \\<turnstile>\\<^sub>c \\<delta> : REAL;\n    nonneg_cexpr (set vs \\<union> set vs') \\<Gamma> \\<delta>;\n    subprob_cexpr (set vs) (set vs') \\<Gamma> \\<delta> \\<rbrakk> \\<Longrightarrow>\n      cdens_ctxt_invar vs vs' \\<Gamma> \\<delta>\"\n  by (simp add: cdens_ctxt_invar_def)\n\nlemma cdens_ctxt_invarD:\n  assumes \"cdens_ctxt_invar vs vs' \\<Gamma> \\<delta>\"\n  shows \"distinct (vs @ vs')\" \"free_vars \\<delta> \\<subseteq> set (vs @ vs')\" \"\\<Gamma> \\<turnstile>\\<^sub>c \\<delta> : REAL\"\n        \"nonneg_cexpr (set vs \\<union> set vs') \\<Gamma> \\<delta>\" \"subprob_cexpr (set vs) (set vs') \\<Gamma> \\<delta>\"\n  using assms by (simp_all add: cdens_ctxt_invar_def)\n\nlemma cdens_ctxt_invar_empty:\n  assumes \"cdens_ctxt_invar vs vs' \\<Gamma> \\<delta>\"\n  shows \"cdens_ctxt_invar [] (vs @ vs') \\<Gamma> (CReal 1)\"\n  using cdens_ctxt_invarD[OF assms]\n  by (intro cdens_ctxt_invarI)\n     (auto simp: cexpr_type_Some_iff[symmetric] extract_real_def state_measure_def PiM_empty\n           intro!: nonneg_cexprI subprob_cexprI)\n\nlemma cdens_ctxt_invar_imp_integrable:\n  assumes \"cdens_ctxt_invar vs vs' \\<Gamma> \\<delta>\" and \\<rho>: \"\\<rho> \\<in> space (state_measure (set vs') \\<Gamma>)\"\n  shows \"integrable (state_measure (set vs) \\<Gamma>)\n             (\\<lambda>\\<sigma>. extract_real (cexpr_sem (merge (set vs) (set vs') (\\<sigma>, \\<rho>)) \\<delta>))\" (is \"integrable ?M ?f\")\n  unfolding integrable_iff_bounded\nproof (intro conjI)\n  note invar = cdens_ctxt_invarD[OF assms(1)]\n  show \"?f \\<in> borel_measurable ?M\"\n    apply (rule measurable_compose[OF _ measurable_extract_real])\n    apply (rule measurable_compose[OF _ measurable_cexpr_sem[OF invar(3,2)]])\n    apply (simp only: state_measure_def set_append, rule measurable_compose[OF _ measurable_merge])\n    apply (rule measurable_Pair, simp, insert assms(2), simp add: state_measure_def)\n    done\n\n  have nonneg: \"\\<And>\\<sigma>. \\<sigma> \\<in> space ?M \\<Longrightarrow> ?f \\<sigma> \\<ge> 0\"\n    using \\<open>nonneg_cexpr (set vs \\<union> set vs') \\<Gamma> \\<delta>\\<close>\n    by (rule nonneg_cexprD, intro merge_in_state_measure[OF _ \\<rho>])\n  with \\<open>subprob_cexpr (set vs) (set vs') \\<Gamma> \\<delta>\\<close> and \\<rho>\n  show \"(\\<integral>\\<^sup>+\\<sigma>. ennreal (norm (?f \\<sigma>)) \\<partial>?M) < \\<infinity>\" unfolding subprob_cexpr_def\n    by (auto simp: less_top[symmetric] top_unique cong: nn_integral_cong)\nqed\n\n\nsubsection \\<open>Randomfree expressions\\<close>\n\ntext \\<open>\n  Translates an expression with no occurrences of Random or Fail into an\n  equivalent target language expression.\n\\<close>\nprimrec expr_rf_to_cexpr :: \"expr \\<Rightarrow> cexpr\" where\n  \"expr_rf_to_cexpr (Val v) = CVal v\"\n| \"expr_rf_to_cexpr (Var x) = CVar x\"\n| \"expr_rf_to_cexpr <e1, e2> = <expr_rf_to_cexpr e1, expr_rf_to_cexpr e2>\\<^sub>c\"\n| \"expr_rf_to_cexpr (oper $$ e) = oper $$\\<^sub>c (expr_rf_to_cexpr e)\"\n| \"expr_rf_to_cexpr (IF b THEN e1 ELSE e2) =\n      (IF\\<^sub>c expr_rf_to_cexpr b THEN expr_rf_to_cexpr e1 ELSE expr_rf_to_cexpr e2)\"\n| \"expr_rf_to_cexpr (LET e1 IN e2) =\n      cexpr_subst 0 (expr_rf_to_cexpr e1) (expr_rf_to_cexpr e2)\"\n| \"expr_rf_to_cexpr (Random _ _) = undefined\"\n| \"expr_rf_to_cexpr (Fail _) = undefined\"\n\nlemma cexpr_sem_expr_rf_to_cexpr:\n     \"randomfree e \\<Longrightarrow> cexpr_sem \\<sigma> (expr_rf_to_cexpr e) = expr_sem_rf \\<sigma> e\"\n  by (induction e arbitrary: \\<sigma>) (auto simp: cexpr_sem_cexpr_subst)\n\nlemma cexpr_typing_expr_rf_to_cexpr[intro]:\n    assumes \"\\<Gamma> \\<turnstile> e : t\" \"randomfree e\"\n    shows \"\\<Gamma> \\<turnstile>\\<^sub>c expr_rf_to_cexpr e : t\"\n  using assms by (induction rule: expr_typing.induct) (auto intro!: cexpr_typing.intros)\n\nlemma free_vars_expr_rf_to_cexpr:\n  \"randomfree e \\<Longrightarrow> free_vars (expr_rf_to_cexpr e) \\<subseteq> free_vars e\"\nproof (induction e)\n  case (LetVar e1 e2)\n  thus ?case\n    by (simp only: free_vars_cexpr.simps expr_rf_to_cexpr.simps,\n        intro order.trans[OF free_vars_cexpr_subst]) auto\nqed auto\n\nsubsection \\<open>Builtin density expressions\\<close>\n\nprimrec dist_dens_cexpr :: \"pdf_dist \\<Rightarrow> cexpr \\<Rightarrow> cexpr \\<Rightarrow> cexpr\" where\n  \"dist_dens_cexpr Bernoulli p x = (IF\\<^sub>c CReal 0 \\<le>\\<^sub>c p \\<and>\\<^sub>c p \\<le>\\<^sub>c CReal 1 THEN\n                                       IF\\<^sub>c x THEN p ELSE CReal 1 -\\<^sub>c p\n                                    ELSE CReal 0)\"\n| \"dist_dens_cexpr UniformInt p x = (IF\\<^sub>c fst\\<^sub>c p \\<le>\\<^sub>c snd\\<^sub>c p \\<and>\\<^sub>c fst\\<^sub>c p \\<le>\\<^sub>c x \\<and>\\<^sub>c x \\<le>\\<^sub>c snd\\<^sub>c p THEN\n                                         inverse\\<^sub>c (\\<langle>snd\\<^sub>c p -\\<^sub>c fst\\<^sub>c p +\\<^sub>c CInt 1\\<rangle>\\<^sub>c) ELSE CReal 0)\"\n| \"dist_dens_cexpr UniformReal p x = (IF\\<^sub>c fst\\<^sub>c p <\\<^sub>c snd\\<^sub>c p \\<and>\\<^sub>c fst\\<^sub>c p \\<le>\\<^sub>c x \\<and>\\<^sub>c x \\<le>\\<^sub>c snd\\<^sub>c p THEN\n                                         inverse\\<^sub>c (snd\\<^sub>c p -\\<^sub>c fst\\<^sub>c p) ELSE CReal 0)\"\n| \"dist_dens_cexpr Gaussian p x = (IF\\<^sub>c CReal 0 <\\<^sub>c snd\\<^sub>c p THEN\n                                     exp\\<^sub>c (-\\<^sub>c((x -\\<^sub>c fst\\<^sub>c p)^\\<^sub>cCInt 2 /\\<^sub>c (CReal 2 *\\<^sub>c snd\\<^sub>c p^\\<^sub>cCInt 2))) /\\<^sub>c\n                                         sqrt\\<^sub>c (CReal 2 *\\<^sub>c \\<pi>\\<^sub>c *\\<^sub>c snd\\<^sub>c p ^\\<^sub>c CInt 2) ELSE CReal 0)\"\n| \"dist_dens_cexpr Poisson p x = (IF\\<^sub>c CReal 0 <\\<^sub>c p \\<and>\\<^sub>c CInt 0 \\<le>\\<^sub>c x THEN\n                                    p ^\\<^sub>c x /\\<^sub>c \\<langle>fact\\<^sub>c x\\<rangle>\\<^sub>c *\\<^sub>c exp\\<^sub>c (-\\<^sub>c p) ELSE CReal 0)\"\n\nlemma free_vars_dist_dens_cexpr:\n    \"free_vars (dist_dens_cexpr dst e1 e2) \\<subseteq> free_vars e1 \\<union> free_vars e2\"\n  by (subst dist_dens_cexpr_def, cases dst) simp_all\n\nlemma cexpr_typing_dist_dens_cexpr:\n    assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : dist_param_type dst\" \"\\<Gamma> \\<turnstile>\\<^sub>c e2 : dist_result_type dst\"\n    shows \"\\<Gamma> \\<turnstile>\\<^sub>c dist_dens_cexpr dst e1 e2 : REAL\"\n  using assms\n  apply (subst dist_dens_cexpr_def, cases dst)\n  (* Bernoulli *)\n  apply (simp, intro cet_op_intros cet_if cet_val' cet_var' cet_eq, simp_all) []\n  (* Uniform int *)\n  apply (simp, intro cet_if cet_and cet_or cet_less_int cet_eq)\n  apply (erule cet_fst cet_snd | simp)+\n  apply (rule cet_inverse, rule cet_op[where t = INTEG], intro cet_add_int cet_minus_int)\n  apply (simp_all add: cet_val' cet_fst cet_snd) [5]\n  (* Uniform real *)\n  apply (simp, intro cet_if cet_op_intros cet_eq cet_fst cet_snd, simp_all add: cet_val') []\n  (* Poisson *)\n  apply (simp, intro cet_if cet_and, rule cet_less_real, simp add: cet_val', simp)\n  apply (rule cet_less_eq_int, simp add: cet_val', simp)\n  apply (intro cet_mult_real cet_pow_real cet_inverse cet_cast_real_int cet_exp cet_minus_real\n               cet_op[where oper = Fact and t = INTEG] cet_var', simp_all add: cet_val') [2]\n  (* Gaussian *)\n  apply (simp, intro cet_if cet_op_intros cet_val', simp_all add: cet_fst cet_snd)\n  done\n\n\nlemma val_type_eq_BOOL: \"val_type x = BOOL \\<longleftrightarrow> x \\<in> BoolVal`UNIV\"\n  by (cases x) auto\n\nlemma val_type_eq_INTEG: \"val_type x = INTEG \\<longleftrightarrow> x \\<in> IntVal`UNIV\"\n  by (cases x) auto\n\nlemma val_type_eq_PRODUCT: \"val_type x = PRODUCT t1 t2 \\<longleftrightarrow>\n  (\\<exists>a b. val_type a = t1 \\<and> val_type b = t2 \\<and> x = <| a, b |>)\"\n  by (cases x) auto\n\nlemma cexpr_sem_dist_dens_cexpr_nonneg:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : dist_param_type dst\" \"\\<Gamma> \\<turnstile>\\<^sub>c e2 : dist_result_type dst\"\n  assumes \"free_vars e1 \\<subseteq> V\" \"free_vars e2 \\<subseteq> V\"\n  assumes \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\"\n  shows \"ennreal (extract_real (cexpr_sem \\<sigma> (dist_dens_cexpr dst e1 e2))) =\n           dist_dens dst (cexpr_sem \\<sigma> e1) (cexpr_sem \\<sigma> e2) \\<and>\n           0 \\<le> extract_real (cexpr_sem \\<sigma> (dist_dens_cexpr dst e1 e2))\"\nproof-\n  from val_type_cexpr_sem[OF assms(1,3,5)] and val_type_cexpr_sem[OF assms(2,4,5)]\n    have \"cexpr_sem \\<sigma> e1 \\<in> space (stock_measure (dist_param_type dst))\" and\n         \"cexpr_sem \\<sigma> e2 \\<in> space (stock_measure (dist_result_type dst))\"\n    by (auto simp: type_universe_def simp del: type_universe_type)\n  thus ?thesis\n    by (subst dist_dens_cexpr_def, cases dst)\n       (auto simp:\n            lift_Comp_def lift_RealVal_def lift_RealIntVal_def lift_RealIntVal2_def\n            bernoulli_density_def val_type_eq_REAL val_type_eq_BOOL val_type_eq_PRODUCT val_type_eq_INTEG\n            uniform_int_density_def uniform_real_density_def\n            lift_IntVal_def poisson_density'_def one_ennreal_def\n            field_simps gaussian_density_def)\nqed\n\nlemma cexpr_sem_dist_dens_cexpr:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : dist_param_type dst\" \"\\<Gamma> \\<turnstile>\\<^sub>c e2 : dist_result_type dst\"\n  assumes \"free_vars e1 \\<subseteq> V\" \"free_vars e2 \\<subseteq> V\"\n  assumes \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\"\n  shows \"ennreal (extract_real (cexpr_sem \\<sigma> (dist_dens_cexpr dst e1 e2))) =\n           dist_dens dst (cexpr_sem \\<sigma> e1) (cexpr_sem \\<sigma> e2)\"\n  using cexpr_sem_dist_dens_cexpr_nonneg[OF assms] by simp\n\nlemma nonneg_dist_dens_cexpr:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>c e1 : dist_param_type dst\" \"\\<Gamma> \\<turnstile>\\<^sub>c e2 : dist_result_type dst\"\n  assumes \"free_vars e1 \\<subseteq> V\" \"free_vars e2 \\<subseteq> V\"\n  shows \"nonneg_cexpr V \\<Gamma> (dist_dens_cexpr dst e1 e2)\"\nproof (intro nonneg_cexprI)\n  fix \\<sigma> assume \\<rho>: \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\"\n  from cexpr_sem_dist_dens_cexpr_nonneg[OF assms this]\n  show \"0 \\<le> extract_real (cexpr_sem \\<sigma> (dist_dens_cexpr dst e1 e2))\"\n    by simp\nqed\n\nsubsection \\<open>Integral expressions\\<close>\n\ndefinition integrate_var :: \"tyenv \\<Rightarrow> vname \\<Rightarrow> cexpr \\<Rightarrow> cexpr\" where\n  \"integrate_var \\<Gamma> v e = \\<integral>\\<^sub>c map_vars (\\<lambda>w. if v = w then 0 else Suc w) e \\<partial>(\\<Gamma> v)\"\n\ndefinition integrate_vars :: \"tyenv \\<Rightarrow> vname list \\<Rightarrow> cexpr \\<Rightarrow> cexpr\" where\n  \"integrate_vars \\<Gamma> = foldr (integrate_var \\<Gamma>)\"\n\nlemma cexpr_sem_integrate_var:\n  \"cexpr_sem \\<sigma> (integrate_var \\<Gamma> v e) =\n    RealVal (\\<integral>x. extract_real (cexpr_sem (\\<sigma>(v := x)) e) \\<partial>stock_measure (\\<Gamma> v))\"\nproof-\n  let ?f = \"(\\<lambda>w. if v = w then 0 else Suc w)\"\n  have \"cexpr_sem \\<sigma> (integrate_var \\<Gamma> v e) =\n          RealVal (\\<integral>x. extract_real (cexpr_sem (case_nat x \\<sigma> \\<circ> ?f) e) \\<partial>stock_measure (\\<Gamma> v))\"\n    by (simp add: extract_real_def integrate_var_def cexpr_sem_map_vars)\n  also have \"(\\<lambda>x. case_nat x \\<sigma> \\<circ> ?f) = (\\<lambda>x. \\<sigma>(v := x))\"\n    by (intro ext) (simp add: o_def split: if_split)\n  finally show ?thesis .\nqed\n\nlemma cexpr_sem_integrate_var':\n  \"extract_real (cexpr_sem \\<sigma> (integrate_var \\<Gamma> v e)) =\n      (\\<integral>x. extract_real (cexpr_sem (\\<sigma>(v := x)) e) \\<partial>stock_measure (\\<Gamma> v))\"\n  by (subst cexpr_sem_integrate_var, simp add: extract_real_def)\n\nlemma cexpr_typing_integrate_var[simp]:\n    \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c integrate_var \\<Gamma> v e : REAL\"\n  unfolding integrate_var_def\n  by (rule cexpr_typing.intros, rule cexpr_typing_map_vars)\n     (erule cexpr_typing_cong', simp split: nat.split)\n\nlemma cexpr_typing_integrate_vars[simp]:\n    \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c integrate_vars \\<Gamma> vs e : REAL\"\n  by (induction vs arbitrary: e)\n     (simp_all add: integrate_vars_def)\n\nlemma free_vars_integrate_var[simp]:\n    \"free_vars (integrate_var \\<Gamma> v e) = free_vars e - {v}\"\n  by (auto simp: integrate_var_def)\n\nlemma free_vars_integrate_vars[simp]:\n    \"free_vars (integrate_vars \\<Gamma> vs e) = free_vars e - set vs\"\n  by (induction vs arbitrary: e) (auto simp: integrate_vars_def)\n\nlemma (in product_sigma_finite) product_integral_insert':\n  fixes f :: \"_ \\<Rightarrow> real\"\n  assumes \"finite I\" \"i \\<notin> I\" \"integrable (Pi\\<^sub>M (insert i I) M) f\"\n  shows \"integral\\<^sup>L (Pi\\<^sub>M (insert i I) M) f = LINT y|M i. LINT x|Pi\\<^sub>M I M. f (x(i := y))\"\nproof-\n  interpret pair_sigma_finite \"M i\" \"Pi\\<^sub>M I M\"\n    by (simp_all add: sigma_finite assms pair_sigma_finite_def sigma_finite_measures)\n  interpret Mi: sigma_finite_measure \"M i\"\n    by (simp add: assms sigma_finite_measures)\n  from assms(3) have int: \"integrable (M i \\<Otimes>\\<^sub>M Pi\\<^sub>M I M) (\\<lambda>(x, y). f (y(i := x)))\"\n  unfolding real_integrable_def\n    apply (elim conjE)\n    apply (subst (1 2) nn_integral_snd[symmetric])\n    apply ((subst (asm) (1 2) product_nn_integral_insert[OF assms(1,2)],\n           auto intro!: measurable_compose[OF _ measurable_ennreal] borel_measurable_uminus) [])+\n    done\n  from assms have \"integral\\<^sup>L (Pi\\<^sub>M (insert i I) M) f = LINT x|Pi\\<^sub>M I M. LINT y|M i. f (x(i := y))\"\n    by (rule product_integral_insert)\n  also from int have \"... = LINT y|M i. LINT x|Pi\\<^sub>M I M. f (x(i := y))\"\n    by (rule Fubini_integral)\n  finally show ?thesis .\nqed\n\n\nlemma cexpr_sem_integrate_vars:\n  assumes \\<rho>: \"\\<rho> \\<in> space (state_measure V' \\<Gamma>)\"\n  assumes disjoint: \"distinct vs\" \"set vs \\<inter> V' = {}\"\n  assumes \"integrable (state_measure (set vs) \\<Gamma>)\n               (\\<lambda>\\<sigma>. extract_real (cexpr_sem (merge (set vs) V' (\\<sigma>, \\<rho>)) e))\"\n  assumes e: \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL\" \"free_vars e \\<subseteq> set vs \\<union> V'\"\n  shows \"extract_real (cexpr_sem \\<rho> (integrate_vars \\<Gamma> vs e)) =\n           \\<integral>\\<sigma>. extract_real (cexpr_sem (merge (set vs) V' (\\<sigma>, \\<rho>)) e) \\<partial>state_measure (set vs) \\<Gamma>\"\nusing assms\nproof (induction vs arbitrary: \\<rho> V')\n  case Nil\n  hence \"\\<And>v. (if v \\<in> V' then \\<rho> v else undefined) = \\<rho> v\"\n    by (auto simp: state_measure_def space_PiM)\n  thus ?case by (auto simp: integrate_vars_def state_measure_def merge_def PiM_empty)\nnext\n  case (Cons v vs \\<rho> V')\n  interpret product_sigma_finite \"\\<lambda>v. stock_measure (\\<Gamma> v)\"\n    by (simp add: product_sigma_finite_def)\n  interpret sigma_finite_measure \"state_measure (set vs) \\<Gamma>\"\n    by (simp add: sigma_finite_state_measure)\n  have \\<rho>': \"\\<And>x. x \\<in> type_universe (\\<Gamma> v) \\<Longrightarrow> \\<rho>(v := x) \\<in> space (state_measure (insert v V') \\<Gamma>)\"\n    using Cons.prems(1) by (auto simp: state_measure_def space_PiM split: if_split_asm)\n  have \"extract_real (cexpr_sem \\<rho> (integrate_vars \\<Gamma> (v # vs) e)) =\n          \\<integral>x. extract_real (cexpr_sem (\\<rho>(v := x)) (integrate_vars \\<Gamma> vs e)) \\<partial>stock_measure (\\<Gamma> v)\"\n    (is \"_ = ?I\") by (simp add: integrate_vars_def cexpr_sem_integrate_var extract_real_def)\n  also from Cons.prems(4) have int: \"integrable (state_measure (insert v (set vs)) \\<Gamma>)\n      (\\<lambda>\\<sigma>. extract_real (cexpr_sem (merge (insert v (set vs)) V' (\\<sigma>, \\<rho>)) e))\" by simp\n  have \"AE x in stock_measure (\\<Gamma> v).\n                extract_real (cexpr_sem (\\<rho>(v := x)) (integrate_vars \\<Gamma> vs e)) =\n                  \\<integral>\\<sigma>. extract_real (cexpr_sem (merge (set vs) (insert v V') (\\<sigma>, \\<rho>(v := x))) e)\n                      \\<partial>state_measure (set vs) \\<Gamma>\"\n    apply (rule AE_mp[OF _ AE_I2[OF impI]])\n    apply (rule integrable_cexpr_projection[OF _ _ _ _ _ _ _ int])\n    apply (insert Cons.prems, auto) [7]\n    apply (subst Cons.IH, rule \\<rho>', insert Cons.prems, auto)\n    done\n  hence \"?I = \\<integral>x. \\<integral>\\<sigma>. extract_real (cexpr_sem (merge (set vs) (insert v V') (\\<sigma>, \\<rho>(v := x))) e)\n                  \\<partial>state_measure (set vs) \\<Gamma> \\<partial>stock_measure (\\<Gamma> v)\" using Cons.prems\n    apply (intro integral_cong_AE)\n    apply (rule measurable_compose[OF measurable_Pair_compose_split[OF\n                measurable_fun_upd_state_measure[of v V' \\<Gamma>]]])\n    apply (simp, simp, simp, rule measurable_compose[OF _ measurable_extract_real])\n    apply (rule measurable_cexpr_sem, simp, (auto) [])\n    apply (rule borel_measurable_lebesgue_integral)\n    apply (subst measurable_split_conv)\n    apply (rule measurable_compose[OF _ measurable_extract_real])\n    apply (rule measurable_compose[OF _ measurable_cexpr_sem[of \\<Gamma> _ _  \"set vs \\<union> insert v V'\"]])\n    apply (unfold state_measure_def, rule measurable_compose[OF _ measurable_merge])\n    apply simp_all\n    done\n  also have \"(\\<lambda>x \\<sigma>. merge (set vs) (insert v V') (\\<sigma>, \\<rho>(v := x))) =\n                 (\\<lambda>x \\<sigma>. merge (set (v#vs)) V' (\\<sigma>(v := x), \\<rho>))\"\n    using Cons.prems by (intro ext) (auto simp: merge_def split: if_split)\n  also have \"(\\<integral>x. \\<integral>\\<sigma>. extract_real (cexpr_sem (merge (set (v#vs)) V' (\\<sigma>(v := x), \\<rho>)) e)\n                  \\<partial>state_measure (set vs) \\<Gamma> \\<partial>stock_measure (\\<Gamma> v)) =\n               \\<integral>\\<sigma>. extract_real (cexpr_sem (merge (set (v#vs)) V' (\\<sigma>, \\<rho>)) e)\n                  \\<partial>state_measure (set (v#vs)) \\<Gamma>\"\n    using Cons.prems unfolding state_measure_def\n    by (subst (2) set_simps, subst product_integral_insert') simp_all\n  finally show ?case .\nqed\n\nlemma cexpr_sem_integrate_vars':\n  assumes \\<rho>: \"\\<rho> \\<in> space (state_measure V' \\<Gamma>)\"\n  assumes disjoint: \"distinct vs\" \"set vs \\<inter> V' = {}\"\n  assumes nonneg: \"nonneg_cexpr (set vs \\<union> V') \\<Gamma> e\"\n  assumes \"integrable (state_measure (set vs) \\<Gamma>)\n               (\\<lambda>\\<sigma>. extract_real (cexpr_sem (merge (set vs) V' (\\<sigma>, \\<rho>)) e))\"\n  assumes e: \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL\" \"free_vars e \\<subseteq> set vs \\<union> V'\"\n  shows \"ennreal (extract_real (cexpr_sem \\<rho> (integrate_vars \\<Gamma> vs e))) =\n           \\<integral>\\<^sup>+\\<sigma>. extract_real (cexpr_sem (merge (set vs) V' (\\<sigma>, \\<rho>)) e) \\<partial>state_measure (set vs) \\<Gamma>\"\nproof-\n  from assms have \"extract_real (cexpr_sem \\<rho> (integrate_vars \\<Gamma> vs e)) =\n      \\<integral>\\<sigma>. extract_real (cexpr_sem (merge (set vs) V' (\\<sigma>, \\<rho>)) e) \\<partial>state_measure (set vs) \\<Gamma>\"\n    by (intro cexpr_sem_integrate_vars)\n  also have \"ennreal ... =\n      \\<integral>\\<^sup>+\\<sigma>. extract_real (cexpr_sem (merge (set vs) V' (\\<sigma>, \\<rho>)) e) \\<partial>state_measure (set vs) \\<Gamma>\"\n    using assms\n    by (intro nn_integral_eq_integral[symmetric] AE_I2)\n       (auto intro!: nonneg_cexprD merge_in_state_measure)\n  finally show ?thesis .\nqed\n\nlemma nonneg_cexpr_sem_integrate_vars:\n  assumes \\<rho>: \"\\<rho> \\<in> space (state_measure V' \\<Gamma>)\"\n  assumes disjoint: \"distinct vs\" \"set vs \\<inter> V' = {}\"\n  assumes nonneg: \"nonneg_cexpr (set vs \\<union> V') \\<Gamma> e\"\n  assumes e: \"\\<Gamma> \\<turnstile>\\<^sub>c e : REAL\" \"free_vars e \\<subseteq> set vs \\<union> V'\"\n  shows \"extract_real (cexpr_sem \\<rho> (integrate_vars \\<Gamma> vs e)) \\<ge> 0\"\nusing assms\nproof (induction vs arbitrary: \\<rho> V')\n  case Nil\n  hence \"\\<And>v. (if v \\<in> V' then \\<rho> v else undefined) = \\<rho> v\"\n    by (auto simp: state_measure_def space_PiM)\n  with Nil show ?case\n    by (auto simp: integrate_vars_def state_measure_def merge_def PiM_empty nonneg_cexprD)\nnext\n  case (Cons v vs \\<rho> V')\n  have \\<rho>': \"\\<And>x. x \\<in> type_universe (\\<Gamma> v) \\<Longrightarrow> \\<rho>(v := x) \\<in> space (state_measure (insert v V') \\<Gamma>)\"\n    using Cons.prems(1) by (auto simp: state_measure_def space_PiM split: if_split_asm)\n  have \"extract_real (cexpr_sem \\<rho> (integrate_vars \\<Gamma> (v # vs) e)) =\n          \\<integral>x. extract_real (cexpr_sem (\\<rho>(v := x)) (integrate_vars \\<Gamma> vs e)) \\<partial>stock_measure (\\<Gamma> v)\"\n    by (simp add: integrate_vars_def cexpr_sem_integrate_var extract_real_def)\n  also have \"... \\<ge> 0\"\n    by (rule integral_nonneg_AE, rule AE_I2, subst Cons.IH[OF \\<rho>']) (insert Cons.prems, auto)\n  finally show \"extract_real (cexpr_sem \\<rho> (integrate_vars \\<Gamma> (v # vs) e)) \\<ge> 0\" .\nqed\n\nlemma nonneg_cexpr_sem_integrate_vars':\n  \"distinct vs \\<Longrightarrow> set vs \\<inter> V' = {} \\<Longrightarrow> nonneg_cexpr (set vs \\<union> V') \\<Gamma> e \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>c e : REAL \\<Longrightarrow>\n    free_vars e \\<subseteq> set vs \\<union> V' \\<Longrightarrow> nonneg_cexpr V' \\<Gamma> (integrate_vars \\<Gamma> vs e)\"\n  apply (intro nonneg_cexprI allI)\n  apply (rule nonneg_cexpr_sem_integrate_vars[where V'=V'])\n  apply auto\n  done\n\nlemma cexpr_sem_integral_nonneg:\n  assumes finite: \"(\\<integral>\\<^sup>+x. extract_real (cexpr_sem (case_nat x \\<sigma>) e) \\<partial>stock_measure t) < \\<infinity>\"\n  assumes nonneg: \"nonneg_cexpr (shift_var_set V) (case_nat t \\<Gamma>) e\"\n  assumes t: \"case_nat t \\<Gamma> \\<turnstile>\\<^sub>c e : REAL\" and vars: \"free_vars e \\<subseteq> shift_var_set V\"\n  assumes \\<rho>: \"\\<sigma> \\<in> space (state_measure V \\<Gamma>)\"\n  shows \"ennreal (extract_real (cexpr_sem \\<sigma> (\\<integral>\\<^sub>c e \\<partial>t))) =\n             \\<integral>\\<^sup>+x. extract_real (cexpr_sem (case_nat x \\<sigma>) e) \\<partial>stock_measure t\"\nproof-\n  let ?f = \"\\<lambda>x. extract_real (cexpr_sem (case_nat x \\<sigma>) e)\"\n  have meas: \"?f \\<in> borel_measurable (stock_measure t)\"\n    apply (rule measurable_compose[OF _ measurable_extract_real])\n    apply (rule measurable_compose[OF measurable_case_nat' measurable_cexpr_sem])\n    apply (rule measurable_ident_sets[OF refl], rule measurable_const[OF \\<rho>])\n    apply (simp_all add: t vars)\n    done\n  from this and finite and nonneg have int: \"integrable (stock_measure t) ?f\"\n    by (auto intro!: integrableI_nonneg nonneg_cexprD case_nat_in_state_measure[OF _ \\<rho>])\n\n  have \"extract_real (cexpr_sem \\<sigma> (\\<integral>\\<^sub>c e \\<partial>t)) =\n          \\<integral>x. extract_real (cexpr_sem (case_nat x \\<sigma>) e) \\<partial>stock_measure t\"\n    by (simp add: extract_real_def)\n  also have \"ennreal ... = \\<integral>\\<^sup>+x. extract_real (cexpr_sem (case_nat x \\<sigma>) e) \\<partial>stock_measure t\"\n    by (subst nn_integral_eq_integral[OF int AE_I2])\n       (auto intro!: nonneg_cexprD[OF nonneg] case_nat_in_state_measure[OF _ \\<rho>])\n  finally show ?thesis .\nqed\n\nlemma has_parametrized_subprob_density_cexpr_sem_integral:\n  assumes dens: \"has_parametrized_subprob_density (state_measure V' \\<Gamma>) M (stock_measure t)\n                   (\\<lambda>\\<rho> x. \\<integral>\\<^sup>+y. eval_cexpr f (case_nat x \\<rho>) y \\<partial>stock_measure t')\"\n  assumes nonneg: \"nonneg_cexpr (shift_var_set (shift_var_set V')) (case_nat t' (case_nat t \\<Gamma>)) f\"\n  assumes tf: \"case_nat t' (case_nat t \\<Gamma>) \\<turnstile>\\<^sub>c f : REAL\"\n  assumes varsf: \"free_vars f \\<subseteq> shift_var_set (shift_var_set V')\"\n  assumes \\<rho>: \"\\<rho> \\<in> space (state_measure V' \\<Gamma>)\"\n  shows \"AE x in stock_measure t.\n          (\\<integral>\\<^sup>+y. eval_cexpr f (case_nat x \\<rho>) y \\<partial>stock_measure t') = ennreal (eval_cexpr (\\<integral>\\<^sub>c f \\<partial>t') \\<rho> x)\"\nproof (rule AE_mp[OF _ AE_I2[OF impI]])\n  interpret sigma_finite_measure \"stock_measure t'\" by simp\n  let ?f = \"\\<lambda>x. \\<integral>\\<^sup>+y. eval_cexpr f (case_nat x \\<rho>) y \\<partial>stock_measure t'\"\n  from has_parametrized_subprob_density_integral[OF dens \\<rho>]\n    have \"(\\<integral>\\<^sup>+x. ?f x \\<partial>stock_measure t) \\<noteq> \\<infinity>\" by (auto simp: eval_cexpr_def top_unique)\n  thus \"AE x in stock_measure t. ?f x \\<noteq> \\<infinity>\" using \\<rho> tf varsf by (intro nn_integral_PInf_AE) simp_all\n  fix x assume x: \"x \\<in> space (stock_measure t)\" and finite: \"?f x \\<noteq> \\<infinity>\"\n  have nonneg': \"AE y in stock_measure t'. eval_cexpr f (case_nat x \\<rho>) y \\<ge> 0\"\n    unfolding eval_cexpr_def using \\<rho> x\n    by (intro AE_I2 nonneg_cexprD[OF nonneg]) (auto intro!: case_nat_in_state_measure)\n  hence \"integrable (stock_measure t') (\\<lambda>y. eval_cexpr f (case_nat x \\<rho>) y)\"\n    using x \\<rho> tf varsf finite by (intro integrableI_nonneg) (simp_all add: top_unique less_top)\n  thus \"?f x = ennreal (eval_cexpr (\\<integral>\\<^sub>c f \\<partial>t') \\<rho> x)\" using nonneg'\n    by (simp add: extract_real_def nn_integral_eq_integral eval_cexpr_def)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Density_Compiler/PDF_Target_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.3245572073973032}}
{"text": "theory NormEnv\n  imports PermEnvLeq\nbegin\n  \ndefinition norm_use_env where\n  \"norm_use_env r_x r_s = (\\<lambda> x. if r_s x = NoPerm then NoPerm else r_x x)\"  \n  \n    (* - norm ordering lemmas *)\n  \nlemma self_norm_leq_use_env: \"leq_use_env (norm_use_env r_x r_s) r_x\"\n  apply (simp add: norm_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done \n  \nlemma norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_c \\<rbrakk> \\<Longrightarrow> leq_use_env (norm_use_env r_x r_s) r_c\"\n  apply (simp add: norm_use_env_def)\n  apply (simp add: leq_use_env_def)\n  done\n\nlemma dist_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (norm_use_env r_ex r_x) (norm_use_env r_ex r_s)\"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  done    \n    \nlemma diff_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_ex) \\<rbrakk> \\<Longrightarrow> leq_use_env (norm_use_env r_s r_x) (diff_use_env r_s r_ex)\"\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n   apply (case_tac \"r_ex x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  done    \n    \nlemma diff_norm_leq_use_env_ex: \"\\<lbrakk> leq_use_env r_s r_c \\<rbrakk> \\<Longrightarrow> leq_use_env (diff_use_env r_s (norm_use_env r_x r_c)) (diff_use_env r_s r_x)\"\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (auto)  \n  apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done\n    \nlemma diff_norm_leq_use_env_gen: \"\\<lbrakk> leq_use_env r_sa r_c; leq_use_env r_sa r_sb \\<rbrakk> \\<Longrightarrow> leq_use_env (diff_use_env r_sa (norm_use_env r_x r_c)) (diff_use_env r_sb r_x)\"    \n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (auto)  \n  apply (case_tac \"r_sa x\")\n     apply (auto)\n  apply (case_tac \"r_sa x\")\n    apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n    apply (case_tac \"r_sb x\")\n      apply (auto)\n   apply (case_tac \"r_sb x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n   apply (case_tac \"r_sb x\")\n     apply (auto)\n  apply (case_tac \"r_sb x\")\n    apply (auto)    \n  done\n \nlemma spec_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_ex) \\<rbrakk> \\<Longrightarrow> leq_use_env (norm_use_env r_c r_x) (diff_use_env (norm_use_env r_c r_s) r_ex)\"    \n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n    apply (case_tac \"r_c x\")\n      apply (auto)\n   apply (case_tac \"r_c x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done    \n\nlemma rhs_self_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env r_x (norm_use_env r_s r_x)\"\n  apply (simp add: leq_use_env_def)\n  apply (simp add: norm_use_env_def)\n  done\n    \nlemma rhs_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_ex; leq_use_env r_ex r_s \\<rbrakk> \\<Longrightarrow> leq_use_env r_x (norm_use_env r_s r_ex)\"    \n  apply (rule_tac r_sb=\"r_ex\" in trans_leq_use_env)\n   apply (rule_tac rhs_self_norm_leq_use_env)\n   apply (auto)\n  done    \n    \n    (* - norm equality lemmas *)\n    \nlemma sub_norm_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> norm_use_env (norm_use_env r_c r_s) r_x = norm_use_env r_c r_x\"    \n  apply (case_tac \"\\<forall> x. norm_use_env (norm_use_env r_c r_s) r_x x = norm_use_env r_c r_x x\")\n   apply (auto)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done    \n \nlemma dist_norm_comp_use_env: \"comp_use_env (norm_use_env r_s r_c) (norm_use_env r_x r_c) = norm_use_env (comp_use_env r_s r_x) r_c\"    \n  apply (case_tac \"\\<forall> x. comp_use_env (norm_use_env r_s r_c) (norm_use_env r_x r_c) x = norm_use_env (comp_use_env r_s r_x) r_c x\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (auto)\n  done     \n    \n    (* - norm disjointness lemmas *)\n    \nlemma mini_disj_norm_use_env1: \"\\<lbrakk> mini_disj_use_env r_x r_c \\<rbrakk> \\<Longrightarrow> mini_disj_use_env (norm_use_env r_x r_s) r_c\"      \n  apply (simp add: mini_disj_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (simp add: norm_use_env_def)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n\nlemma mini_disj_norm_use_env2: \"\\<lbrakk> mini_disj_use_env r_c r_s \\<rbrakk> \\<Longrightarrow> mini_disj_use_env r_c (norm_use_env r_x r_s)\"       \n  apply (simp add: mini_disj_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (simp add: norm_use_env_def)\n  done    \n \nlemma disj_norm_use_env1: \"\\<lbrakk> mini_disj_use_env r_x r_c; disj_use_env r_s r_c \\<rbrakk> \\<Longrightarrow> disj_use_env (norm_use_env r_x r_s) r_c\"    \n  apply (simp add: disj_use_env_def)\n  apply (auto)\n   apply (rule_tac mini_disj_norm_use_env1)\n    apply (auto)\n  apply (rule_tac mini_disj_norm_use_env2)\n   apply (auto)\n  done\n\nlemma disj_norm_use_env2: \"\\<lbrakk> mini_disj_use_env r_x r_c; disj_use_env r_c r_s \\<rbrakk> \\<Longrightarrow> disj_use_env r_c (norm_use_env r_x r_s)\"    \n  apply (simp add: disj_use_env_def)\n  apply (auto)\n   apply (rule_tac mini_disj_norm_use_env2)\n    apply (auto)\n  apply (rule_tac mini_disj_norm_use_env1)\n   apply (auto)\n  done     \n \n(*\nlemma wtdp_norm_dcl_use_env: \"\\<lbrakk> leq_use_env r_ex r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (norm_use_env r_ex (diff_use_env r_s r_x)) (diff_use_env r_s r_x)\"\n  apply (simp add: leq_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done\n\nlemma wtdp_ndcl_use_env: \"\\<lbrakk> leq_use_env r_ex (diff_use_env r_s r_c) \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (norm_use_env r_ex (diff_use_env r_s r_x)) (diff_use_env (diff_use_env r_s r_x) r_c)\"\n  apply (simp add: leq_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done    \n    *)    \n \n(*\nlemma comm_diff_use_env: \"diff_use_env (diff_use_env r_s r_x) r_ex = diff_use_env (diff_use_env r_s r_ex) r_x\"\n  apply (case_tac \"\\<forall> x. diff_use_env (diff_use_env r_s r_x) r_ex x = diff_use_env (diff_use_env r_s r_ex) r_x x\")\n   apply (auto)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n     apply (case_tac \"r_ex x\")\n       apply (auto)\n    apply (case_tac \"r_ex x\")\n      apply (auto)\n   apply (case_tac \"r_ex x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n    apply (case_tac \"r_ex x\")\n      apply (auto)\n   apply (case_tac \"r_ex x\")\n     apply (auto) \n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  done    \n      \n\n*)    \n   \ndefinition strong_use_env where\n  \"strong_use_env r_s = (\\<forall> x. r_s x \\<noteq> UsePerm)\"    \n    \nlemma ex_norm_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> (\\<exists> r_ex. strong_use_env r_ex \\<and> norm_use_env r_s r_x = diff_use_env r_s r_ex)\"\n  apply (rule_tac x=\"\\<lambda> x. if r_s x \\<noteq> NoPerm \\<and> r_x x = NoPerm then OwnPerm else NoPerm\" in exI)\n  apply (auto)\n   apply (simp add: strong_use_env_def)\n  apply (case_tac \"\\<forall> x. norm_use_env r_s r_x x = diff_use_env r_s (\\<lambda>x. if r_s x \\<noteq> NoPerm \\<and> r_x x = NoPerm then OwnPerm else NoPerm) x\")\n   apply (auto)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n    apply (case_tac \"r_s x\")\n      apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done    \n    \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/NormEnv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.3245572073973032}}
{"text": "subsection \\<open>Heap Memory Implementations\\<close>\n\ntheory Memory_Heap\n  imports State_Heap DP_CRelVH Pair_Memory \"HOL-Eisbach.Eisbach\" \"../Indexing\"\nbegin\n\ntext \\<open>Move\\<close>\nabbreviation \"result_of c h \\<equiv> fst (the (execute c h))\"\nabbreviation \"heap_of   c h \\<equiv> snd (the (execute c h))\"\n\nlemma map_emptyI:\n  \"m \\<subseteq>\\<^sub>m Map.empty\" if \"\\<And> x. m x = None\"\n  using that unfolding map_le_def by auto\n\nlemma result_of_return[simp]:\n  \"result_of (Heap_Monad.return x) h = x\"\n  by (simp add: execute_simps)\n\nlemma get_result_of_lookup:\n  \"result_of (!r) heap = x\" if \"Ref.get heap r = x\"\n  using that by (auto simp: execute_simps)\n\ncontext\n  fixes size :: nat\n    and to_index :: \"('k2 :: heap) \\<Rightarrow> nat\"\nbegin\n\ndefinition\n  \"mem_empty = (Array.new size (None :: ('v :: heap) option))\"\n\nlemma success_empty[intro]:\n  \"success mem_empty heap\"\n  unfolding mem_empty_def by (auto intro: success_intros)\n\nlemma length_mem_empty:\n  \"Array.length\n    (heap_of (mem_empty:: (('b :: heap) option array) Heap) h)\n    (result_of (mem_empty :: ('b option array) Heap) h) = size\"\n  unfolding mem_empty_def by (auto simp: execute_simps Array.length_alloc)\n\nlemma nth_mem_empty:\n  \"result_of\n    (Array.nth (result_of (mem_empty :: ('b option array) Heap) h) i)\n    (heap_of (mem_empty :: (('b :: heap) option array) Heap) h) = None\" if \"i < size\"\n  apply (subst execute_nth(1))\n  apply (simp add: length_mem_empty that)\n  apply (simp add: execute_simps mem_empty_def Array.get_alloc that)\n  done\n\ncontext\n  fixes mem :: \"('v :: heap) option array\"\nbegin\n\ndefinition\n  \"mem_lookup k = (let i = to_index k in\n    if i < size then Array.nth mem i else return None\n  )\"\n\ndefinition\n  \"mem_update k v = (let i = to_index k in\n    if i < size then (Array.upd i (Some v) mem \\<bind> (\\<lambda> _. return ()))\n    else return ()\n  )\n  \"\n\ncontext assumes injective: \"injective size to_index\"\nbegin\n\ninterpretation heap_correct \"\\<lambda>heap. Array.length heap mem = size\" mem_update mem_lookup\n  apply standard\n  subgoal lookup_inv\n    unfolding State_Heap.lift_p_def mem_lookup_def by (simp add: Let_def execute_simps)\n  subgoal update_inv\n    unfolding State_Heap.lift_p_def mem_update_def by (simp add: Let_def execute_simps)\n  subgoal for k heap\n    unfolding heap_mem_defs.map_of_heap_def map_le_def mem_lookup_def\n    by (auto simp: execute_simps Let_def split: if_split_asm)\n  subgoal for heap k\n    unfolding heap_mem_defs.map_of_heap_def map_le_def mem_lookup_def mem_update_def\n    apply (auto simp: execute_simps Let_def length_def split: if_split_asm)\n    apply (subst (asm) nth_list_update_neq)\n    using injective[unfolded injective_def] apply auto\n    done\n  done\n\nlemmas mem_heap_correct = heap_correct_axioms\n\ncontext\n  assumes [simp]: \"mem = result_of mem_empty Heap.empty\"\nbegin\n\ninterpretation heap_correct_empty\n  \"\\<lambda>heap. Array.length heap mem = size\" mem_update mem_lookup\n  \"heap_of (mem_empty :: 'v option array Heap) Heap.empty\"\n  apply standard\n  subgoal\n    apply (rule map_emptyI)\n    unfolding map_of_heap_def mem_lookup_def by (auto simp: Let_def nth_mem_empty)\n  subgoal\n    by (simp add: length_mem_empty)\n  done\n\nlemmas array_heap_emptyI = heap_correct_empty_axioms\n\ncontext\n  fixes dp :: \"'k2 \\<Rightarrow> 'v\"\nbegin\n\ninterpretation dp_consistency_heap_empty\n  \"\\<lambda>heap. Array.length heap mem = size\" mem_update mem_lookup dp\n  \"heap_of (mem_empty :: 'v option array Heap) Heap.empty\"\n  by standard\n\nlemmas array_consistentI = dp_consistency_heap_empty_axioms\n\nend\n\nend (* Empty Memory *)\n\nend (* Injectivity *)\n\nend (* Fixed array *)\n\nlemma execute_bind_success':\n  assumes \"success f h\" \"execute (f \\<bind> g) h = Some (y, h'')\"\n  obtains x h' where \"execute f h = Some (x, h')\" \"execute (g x) h' = Some (y, h'')\"\n  using assms by (auto simp: execute_simps elim: successE)\n\nlemma success_bind_I:\n  assumes \"success f h\"\n    and \"\\<And> x h'. execute f h = Some (x, h') \\<Longrightarrow> success (g x) h'\"\n  shows \"success (f \\<bind> g) h\"\n  by (rule successE[OF assms(1)]) (auto elim: assms(2) intro: success_bind_executeI)\n\ndefinition\n  \"alloc_pair a b \\<equiv> do {\n    r1 \\<leftarrow> ref a;\n    r2 \\<leftarrow> ref b;\n    return (r1, r2)\n  }\"\n\nlemma alloc_pair_alloc:\n  \"Ref.get heap' r1 = a\" \"Ref.get heap' r2 = b\"\n  if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\"\n  using that unfolding alloc_pair_def\n  by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n     (metis Ref.get_alloc fst_conv get_alloc_neq next_present present_alloc_neq snd_conv)+\n\nlemma alloc_pairD1:\n  \"r =!= r1 \\<and> r =!= r2 \\<and> Ref.present heap' r\"\n  if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\" \"Ref.present heap r\"\n  using that unfolding alloc_pair_def\n  by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n     (metis next_fresh noteq_I Ref.present_alloc snd_conv)+\n\nlemma alloc_pairD2:\n  \"r1 =!= r2 \\<and> Ref.present heap' r2 \\<and> Ref.present heap' r1\"\n  if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\"\n  using that unfolding alloc_pair_def\n  by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n     (metis next_fresh next_present noteq_I Ref.present_alloc snd_conv)+\n\nlemma alloc_pairD3:\n  \"Array.present heap' r\"\n  if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\" \"Array.present heap r\"\n  using that unfolding alloc_pair_def\n  by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n     (metis array_present_alloc snd_conv)\n\nlemma alloc_pairD4:\n  \"Ref.get heap' r = x\"\n  if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\"\n     \"Ref.get heap r = x\" \"Ref.present heap r\"\n  using that unfolding alloc_pair_def\n  by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n     (metis Ref.not_present_alloc Ref.present_alloc get_alloc_neq noteq_I snd_conv)\n\nlemma alloc_pair_array_get:\n  \"Array.get heap' r = x\"\n  if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\" \"Array.get heap r = x\"\n  using that unfolding alloc_pair_def\n  by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n (metis array_get_alloc snd_conv)\n\nlemma alloc_pair_array_length:\n  \"Array.length heap' r = Array.length heap r\"\n  if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\"\n  using that unfolding alloc_pair_def\n  by (auto simp: execute_simps elim!: execute_bind_success'[OF success_refI])\n     (metis Ref.length_alloc snd_conv)\n\nlemma alloc_pair_nth:\n  \"result_of (Array.nth r i) heap' = result_of (Array.nth r i) heap\"\n  if \"execute (alloc_pair a b) heap = Some ((r1, r2), heap')\"\n  using alloc_pair_array_get[OF that(1) HOL.refl, of r] alloc_pair_array_length[OF that(1), of r]\n  by (cases \"(\\<lambda>h. i < Array.length h r) heap\"; simp add: execute_simps Array.nth_def)\n\nlemma succes_alloc_pair[intro]:\n  \"success (alloc_pair a b) heap\"\n  unfolding alloc_pair_def by (auto intro: success_intros success_bind_I)\n\ndefinition\n  \"init_state_inner k1 k2 m1 m2 \\<equiv>  do {\n    (k_ref1, k_ref2) \\<leftarrow> alloc_pair k1 k2;\n    (m_ref1, m_ref2) \\<leftarrow> alloc_pair m1 m2;\n    return (k_ref1, k_ref2, m_ref1, m_ref2)\n  }\n  \"\n\nlemma init_state_inner_alloc:\n  assumes\n    \"execute (init_state_inner k1 k2 m1 m2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n  shows\n    \"Ref.get heap' k_ref1 = k1\" \"Ref.get heap' k_ref2 = k2\"\n    \"Ref.get heap' m_ref1 = m1\" \"Ref.get heap' m_ref2 = m2\"\n  using assms unfolding init_state_inner_def\n  by (auto simp: execute_simps elim!: execute_bind_success'[OF succes_alloc_pair])\n     (auto intro: alloc_pair_alloc dest: alloc_pairD2 elim: alloc_pairD4)\n\nlemma init_state_inner_distinct:\n  assumes\n    \"execute (init_state_inner k1 k2 m1 m2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n  shows\n    \"m_ref1 =!= m_ref2 \\<and> m_ref1 =!= k_ref1 \\<and> m_ref1 =!= k_ref2 \\<and> m_ref2 =!= k_ref1\n   \\<and> m_ref2 =!= k_ref2 \\<and> k_ref1 =!= k_ref2\"\n  using assms unfolding init_state_inner_def\n  by (auto simp: execute_simps elim!: execute_bind_success'[OF succes_alloc_pair])\n     (blast dest: alloc_pairD1 alloc_pairD2 intro: noteq_sym)+\n\nlemma init_state_inner_present:\n  assumes\n    \"execute (init_state_inner k1 k2 m1 m2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n  shows\n    \"Ref.present heap' k_ref1\" \"Ref.present heap' k_ref2\"\n    \"Ref.present heap' m_ref1\" \"Ref.present heap' m_ref2\"\n  using assms unfolding init_state_inner_def\n  by (auto simp: execute_simps elim!: execute_bind_success'[OF succes_alloc_pair])\n     (blast dest: alloc_pairD1 alloc_pairD2)+\n\nlemma inite_state_inner_present':\n  assumes\n    \"execute (init_state_inner k1 k2 m1 m2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n    \"Array.present heap a\"\n  shows\n    \"Array.present heap' a\"\n    using assms unfolding init_state_inner_def\n    by (auto simp: execute_simps elim!: execute_bind_success'[OF succes_alloc_pair] alloc_pairD3)\n\nlemma succes_init_state_inner[intro]:\n  \"success (init_state_inner k1 k2 m1 m2) heap\"\n  unfolding init_state_inner_def by (auto 4 3 intro: success_intros success_bind_I)\n\nlemma init_state_inner_nth:\n  \"result_of (Array.nth r i) heap' = result_of (Array.nth r i) heap\"\n  if \"execute (init_state_inner k1 k2 m1 m2) heap = Some ((r1, r2), heap')\"\n  using that unfolding init_state_inner_def\n  by (auto simp: execute_simps alloc_pair_nth elim!: execute_bind_success'[OF succes_alloc_pair])\n\ndefinition\n  \"init_state k1 k2 \\<equiv> do {\n    m1 \\<leftarrow> mem_empty;\n    m2 \\<leftarrow> mem_empty;\n    init_state_inner k1 k2 m1 m2\n  }\"\n\n\n\ndefinition\n  \"inv_distinct k_ref1 k_ref2 m_ref1 m_ref2 \\<equiv>\n     m_ref1 =!= m_ref2 \\<and> m_ref1 =!= k_ref1 \\<and> m_ref1 =!= k_ref2 \\<and> m_ref2 =!= k_ref1\n   \\<and> m_ref2 =!= k_ref2 \\<and> k_ref1 =!= k_ref2\n  \"\n\nlemma init_state_distinct:\n  assumes\n    \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n  shows\n    \"inv_distinct k_ref1 k_ref2 m_ref1 m_ref2\"\n  using assms unfolding init_state_def inv_distinct_def\n  by (elim execute_bind_success'[OF success_empty] init_state_inner_distinct)\n\nlemma init_state_present:\n  assumes\n    \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n  shows\n    \"Ref.present heap' k_ref1\" \"Ref.present heap' k_ref2\"\n    \"Ref.present heap' m_ref1\" \"Ref.present heap' m_ref2\"\n  using assms unfolding init_state_def\n  by (auto\n        simp: execute_simps elim!: execute_bind_success'[OF success_empty]\n        dest: init_state_inner_present\n     )\n\nlemma empty_present:\n  \"Array.present h' x\" if \"execute mem_empty heap = Some (x, h')\"\n  using that unfolding mem_empty_def\n  by (auto simp: execute_simps) (metis Array.present_alloc fst_conv snd_conv)\n\nlemma empty_present':\n  \"Array.present h' a\" if \"execute mem_empty heap = Some (x, h')\" \"Array.present heap a\"\n  using that unfolding mem_empty_def\n  by (auto simp: execute_simps Array.present_def Array.alloc_def Array.set_def Let_def)\n\nlemma init_state_present2:\n  assumes\n    \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n  shows\n    \"Array.present heap' (Ref.get heap' m_ref1)\" \"Array.present heap' (Ref.get heap' m_ref2)\"\n  using assms unfolding init_state_def\n  by (auto 4 3\n        simp: execute_simps init_state_inner_alloc elim!: execute_bind_success'[OF success_empty]\n        dest: inite_state_inner_present' empty_present empty_present'\n     )\n\nlemma init_state_neq:\n  assumes\n    \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n  shows\n    \"Ref.get heap' m_ref1 =!!= Ref.get heap' m_ref2\"\n  using assms unfolding init_state_def\n  by (auto 4 3\n        simp: execute_simps init_state_inner_alloc elim!: execute_bind_success'[OF success_empty]\n        dest: inite_state_inner_present' empty_present empty_present'\n     )\n    (metis empty_present execute_new fst_conv mem_empty_def option.inject present_alloc_noteq)\n\nlemma present_alloc_get:\n  \"Array.get heap' a = Array.get heap a\"\n  if \"Array.alloc xs heap = (a', heap')\" \"Array.present heap a\"\n  using that by (auto simp: Array.alloc_def Array.present_def Array.get_def Let_def Array.set_def)\n\nlemma init_state_length:\n  assumes\n    \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n  shows\n    \"Array.length heap' (Ref.get heap' m_ref1) = size\"\n    \"Array.length heap' (Ref.get heap' m_ref2) = size\"\n  using assms unfolding init_state_def\n  apply (auto\n        simp: execute_simps init_state_inner_alloc elim!: execute_bind_success'[OF success_empty]\n        dest: inite_state_inner_present' empty_present empty_present'\n     )\n   apply (auto\n      simp: execute_simps init_state_inner_def alloc_pair_def mem_empty_def Array.length_def\n      elim!: execute_bind_success'[OF success_refI]\n     )\n  apply (metis\n      Array.alloc_def Array.get_set_eq Array.present_alloc array_get_alloc fst_conv length_replicate\n      present_alloc_get snd_conv\n     )+\n  done\n\ncontext\n  fixes key1 :: \"'k \\<Rightarrow> ('k1 :: heap)\" and key2 :: \"'k \\<Rightarrow> 'k2\"\n    and m_ref1 m_ref2 :: \"('v :: heap) option array ref\"\n    and k_ref1 k_ref2 :: \"('k1 :: heap) ref\"\nbegin\n\ntext \\<open>We assume that look-ups happen on the older row, so this is biased towards the second entry.\\<close>\ndefinition\n  \"lookup_pair k = do {\n    let k' = key1 k;\n    k2 \\<leftarrow> !k_ref2;\n    if k' = k2 then\n      do {\n        m2 \\<leftarrow> !m_ref2;\n        mem_lookup m2 (key2 k)\n      }\n    else\n      do {\n      k1 \\<leftarrow> !k_ref1;\n      if k' = k1 then\n        do {\n          m1 \\<leftarrow> !m_ref1;\n          mem_lookup m1 (key2 k)\n        }\n      else\n        return None\n    }\n  }\n   \"\n\ntext \\<open>We assume that updates happen on the newer row, so this is biased towards the first entry.\\<close>\ndefinition\n  \"update_pair k v = do {\n    let k' = key1 k;\n      k1 \\<leftarrow> !k_ref1;\n      if k' = k1 then do {\n        m \\<leftarrow> !m_ref1;\n        mem_update m (key2 k) v\n      }\n      else do {\n        k2 \\<leftarrow> !k_ref2;\n        if k' = k2 then do {\n          m \\<leftarrow> !m_ref2;\n          mem_update m (key2 k) v\n        }\n        else do {\n          do {\n            k1 \\<leftarrow> !k_ref1;\n            m \\<leftarrow> mem_empty;\n            m1 \\<leftarrow> !m_ref1;\n            k_ref2 := k1;\n            k_ref1 := k';\n            m_ref2 := m1;\n            m_ref1 := m\n          }\n        ;\n        m \\<leftarrow> !m_ref1;\n        mem_update m (key2 k) v\n      }\n    }\n   }\n   \"\n\ndefinition\n  \"inv_pair_weak heap = (\n    let\n      m1 = Ref.get heap m_ref1;\n      m2 = Ref.get heap m_ref2\n    in Array.length heap m1 = size \\<and> Array.length heap m2 = size\n      \\<and> Ref.present heap k_ref1 \\<and> Ref.present heap k_ref2\n      \\<and> Ref.present heap m_ref1 \\<and> Ref.present heap m_ref2\n      \\<and> Array.present heap m1 \\<and> Array.present heap m2\n      \\<and> m1 =!!= m2\n  )\"\n\n(* TODO: Remove? *)\ndefinition\n  \"inv_pair heap \\<equiv> inv_pair_weak heap \\<and> inv_distinct k_ref1 k_ref2 m_ref1 m_ref2\"\n\nlemma init_state_inv:\n  assumes\n    \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\n  shows \"inv_pair_weak heap'\"\n  using assms unfolding inv_pair_weak_def Let_def\n  by (auto intro:\n      init_state_present init_state_present2 init_state_neq init_state_length\n      init_state_distinct\n     )\n\nlemma inv_pair_lengthD1:\n  \"Array.length heap (Ref.get heap m_ref1) = size\" if \"inv_pair_weak heap\"\n  using that unfolding inv_pair_weak_def by (auto simp: Let_def)\n\nlemma inv_pair_lengthD2:\n  \"Array.length heap (Ref.get heap m_ref2) = size\" if \"inv_pair_weak heap\"\n  using that unfolding inv_pair_weak_def by (auto simp: Let_def)\n\nlemma inv_pair_presentD:\n  \"Array.present heap (Ref.get heap m_ref1)\" \"Array.present heap (Ref.get heap m_ref2)\"\n  if \"inv_pair_weak heap\"\n  using that unfolding inv_pair_weak_def by (auto simp: Let_def)\n\nlemma inv_pair_presentD2:\n  \"Ref.present heap m_ref1\" \"Ref.present heap m_ref2\"\n  \"Ref.present heap k_ref1\" \"Ref.present heap k_ref2\"\n  if \"inv_pair_weak heap\"\n  using that unfolding inv_pair_weak_def by (auto simp: Let_def)\n\nlemma inv_pair_not_eqD:\n  \"Ref.get heap m_ref1 =!!= Ref.get heap m_ref2\" if \"inv_pair_weak heap\"\n  using that unfolding inv_pair_weak_def by (auto simp: Let_def)\n\ndefinition \"lookup1 k \\<equiv> state_of (do {m \\<leftarrow> !m_ref1; mem_lookup m k})\"\n\ndefinition \"lookup2 k \\<equiv> state_of (do {m \\<leftarrow> !m_ref2; mem_lookup m k})\"\n\ndefinition \"update1 k v \\<equiv> state_of (do {m \\<leftarrow> !m_ref1; mem_update m k v})\"\n\ndefinition \"update2 k v \\<equiv> state_of (do {m \\<leftarrow> !m_ref2; mem_update m k v})\"\n\ndefinition \"move12 k \\<equiv> state_of (do {\n    k1 \\<leftarrow> !k_ref1;\n    m \\<leftarrow> mem_empty;\n    m1 \\<leftarrow> !m_ref1;\n    k_ref2 := k1;\n    k_ref1 := k;\n    m_ref2 := m1;\n    m_ref1 := m\n  })\n  \"\n\ndefinition \"get_k1 \\<equiv> state_of (!k_ref1)\"\n\ndefinition \"get_k2 \\<equiv> state_of (!k_ref2)\"\n\nlemma run_state_state_of[simp]:\n  \"State_Monad.run_state (state_of p) m = the (execute p m)\"\n  unfolding state_of_def by simp\n\ncontext assumes injective: \"injective size to_index\"\nbegin\n\ncontext\n  assumes inv_distinct: \"inv_distinct k_ref1 k_ref2 m_ref1 m_ref2\"\nbegin\n\nlemma disjoint[simp]:\n  \"m_ref1 =!= m_ref2\" \"m_ref1 =!= k_ref1\" \"m_ref1 =!= k_ref2\"\n  \"m_ref2 =!= k_ref1\" \"m_ref2 =!= k_ref2\"\n  \"k_ref1 =!= k_ref2\"\n  using inv_distinct unfolding inv_distinct_def by auto\n\nlemmas [simp] = disjoint[THEN noteq_sym]\n\n\n\nlemma [simp]:\n  \"Ref.get (snd (Array.alloc xs heap)) r = Ref.get heap r\" if \"Ref.present heap r\"\n  using that unfolding Array.alloc_def Ref.present_def\n  by (simp add: Let_def Ref.get_def Array.set_def)\n\n\n\nlemma alloc_present':\n  \"Ref.present (snd (Array.alloc xs heap)) r\" if \"Ref.present heap r\"\n  using that unfolding Ref.present_def Array.alloc_def by (simp add: Let_def Array.set_def)\n\nlemma length_get_upd[simp]:\n  \"length (Array.get (Array.update a i x heap) r) = length (Array.get heap r)\"\n  unfolding Array.get_def Array.update_def Array.set_def by simp\n\nmethod solve1 =\n  (frule inv_pair_lengthD1, frule inv_pair_lengthD2, frule inv_pair_not_eqD)?,\n  auto split: if_split_asm dest: Array.noteq_sym\n\ninterpretation pair: pair_mem lookup1 lookup2 update1 update2 move12 get_k1 get_k2 inv_pair_weak\n  supply [simp] =\n    mem_empty_def state_mem_defs.map_of_def map_le_def\n    move12_def update1_def update2_def lookup1_def lookup2_def get_k1_def get_k2_def\n    mem_update_def mem_lookup_def\n    execute_bind_success[OF success_newI] execute_simps Let_def Array.get_alloc length_def\n    inv_pair_presentD inv_pair_presentD2\n    Memory_Heap.lookup1_def Memory_Heap.lookup2_def Memory_Heap.mem_lookup_def\n  apply standard\n                      apply (solve1; fail)+\n  subgoal\n    apply (rule lift_pI)\n    unfolding inv_pair_weak_def\n    apply (auto simp:\n        intro: alloc_present alloc_present'\n        elim: present_alloc_noteq[THEN Array.noteq_sym]\n        )\n    done\n                     apply (rule lift_pI, unfold inv_pair_weak_def, auto split: if_split_asm; fail)+\n                 apply (solve1; fail)+\n  subgoal\n    using injective[unfolded injective_def] by - (solve1, subst (asm) nth_list_update_neq, auto)\n  subgoal\n    using injective[unfolded injective_def] by - (solve1, subst (asm) nth_list_update_neq, auto)\n   apply (solve1; fail)+\n  done\n\nlemmas mem_correct_pair = pair.mem_correct_pair\n\ndefinition\n  \"mem_lookup1 k = do {m \\<leftarrow> !m_ref1; mem_lookup m k}\"\n\ndefinition\n  \"mem_lookup2 k = do {m \\<leftarrow> !m_ref2; mem_lookup m k}\"\n\ndefinition \"get_k1' \\<equiv> !k_ref1\"\n\ndefinition \"get_k2' \\<equiv> !k_ref2\"\n\ndefinition \"update1' k v \\<equiv> do {m \\<leftarrow> !m_ref1; mem_update m k v}\"\n\ndefinition \"update2' k v \\<equiv> do {m \\<leftarrow> !m_ref2; mem_update m k v}\"\n\ndefinition \"move12' k \\<equiv> do {\n    k1 \\<leftarrow> !k_ref1;\n    m \\<leftarrow> mem_empty;\n    m1 \\<leftarrow> !m_ref1;\n    k_ref2 := k1;\n    k_ref1 := k;\n    m_ref2 := m1;\n    m_ref1 := m\n  }\"\n\ninterpretation heap_mem_defs inv_pair_weak lookup_pair update_pair .\n\nlemma rel_state_ofI:\n  \"rel_state (=) (state_of m) m\" if\n  \"\\<forall> heap. inv_pair_weak heap \\<longrightarrow> success m heap\"\n  \"lift_p inv_pair_weak m\"\n  using that unfolding rel_state_def\n  by (auto split: option.split intro: lift_p_P'' simp: success_def)\n\nlemma inv_pair_iff:\n  \"inv_pair_weak = inv_pair\"\n  unfolding inv_pair_def using inv_distinct by simp\n\nlemma lift_p_inv_pairI:\n  \"State_Heap.lift_p inv_pair m\" if \"State_Heap.lift_p inv_pair_weak m\"\n  using that unfolding inv_pair_iff by simp\n\nlemma lift_p_success:\n  \"State_Heap.lift_p inv_pair_weak m\"\n  if \"DP_CRelVS.lift_p inv_pair_weak (state_of m)\" \"\\<forall> heap. inv_pair_weak heap \\<longrightarrow> success m heap\"\n  using that\n  unfolding lift_p_def DP_CRelVS.lift_p_def\n  by (auto simp: success_def split: option.split)\n\nlemma rel_state_ofI2:\n  \"rel_state (=) (state_of m) m\" if\n  \"\\<forall> heap. inv_pair_weak heap \\<longrightarrow> success m heap\"\n  \"DP_CRelVS.lift_p inv_pair_weak (state_of m)\"\n  using that by (blast intro: rel_state_ofI lift_p_success)\n\ncontext\n  includes lifting_syntax\nbegin\n\n\n\nlemma [transfer_rule]:\n  \"((=) ===> rel_state (rel_option (=))) lookup1 mem_lookup1\"\n  unfolding lookup1_def mem_lookup1_def\n  apply (intro rel_funI)\n  apply (simp add: option.rel_eq)\n  apply (rule rel_state_ofI2)\n  subgoal\n    by (auto 4 4\n        simp: mem_lookup_def inv_pair_lengthD1 execute_simps Let_def\n        intro: success_bind_executeI success_returnI Array.success_nthI\n       )\n  subgoal\n    using pair.lookup_inv(1) unfolding lookup1_def .\n  done\n\nlemma [transfer_rule]:\n  \"((=) ===> rel_state (rel_option (=))) lookup2 mem_lookup2\"\n  unfolding lookup2_def mem_lookup2_def\n  apply (intro rel_funI)\n  apply (simp add: option.rel_eq)\n  apply (rule rel_state_ofI2)\n  subgoal\n    by (auto 4 3\n        simp: mem_lookup_def inv_pair_lengthD2 execute_simps Let_def\n        intro: success_intros intro!: success_bind_I\n       )\n  subgoal\n    using pair.lookup_inv(2) unfolding lookup2_def .\n  done\n\nlemma [transfer_rule]:\n  \"rel_state (=) get_k1 get_k1'\"\n  unfolding get_k1_def get_k1'_def\n  apply (rule rel_state_ofI2)\n  subgoal\n    by (auto intro: success_lookupI)\n  subgoal\n    unfolding get_k1_def[symmetric] by (auto dest: pair.get_state(1) intro: lift_pI)\n  done\n\nlemma [transfer_rule]:\n  \"rel_state (=) get_k2 get_k2'\"\n  unfolding get_k2_def get_k2'_def\n  apply (rule rel_state_ofI2)\n  subgoal\n    by (auto intro: success_lookupI)\n  subgoal\n    unfolding get_k2_def[symmetric] by (auto dest: pair.get_state(2) intro: lift_pI)\n  done\n\nlemma [transfer_rule]:\n  \"((=) ===> (=) ===> rel_state (=)) update1 update1'\"\n  unfolding update1_def update1'_def\n  apply (intro rel_funI)\n  apply simp\n  apply (rule rel_state_ofI2)\n  subgoal\n    by (auto 4 3\n        simp: mem_update_def inv_pair_lengthD1 execute_simps Let_def\n        intro: success_intros intro!: success_bind_I\n       )\n  subgoal\n    using pair.update_inv(1) unfolding update1_def .\n  done\n\nlemma [transfer_rule]:\n  \"((=) ===> (=) ===> rel_state (=)) update2 update2'\"\n  unfolding update2_def update2'_def\n  apply (intro rel_funI)\n  apply simp\n  apply (rule rel_state_ofI2)\n  subgoal\n    by (auto 4 3\n        simp: mem_update_def inv_pair_lengthD2 execute_simps Let_def\n        intro: success_intros intro!: success_bind_I\n       )\n  subgoal\n    using pair.update_inv(2) unfolding update2_def .\n  done\n\nlemma [transfer_rule]:\n  \"((=) ===> rel_state (rel_option (=))) lookup1 mem_lookup1\"\n  unfolding lookup1_def mem_lookup1_def\n  apply (intro rel_funI)\n  apply (simp add: option.rel_eq)\n  apply (rule rel_state_ofI2)\n  subgoal\n    by (auto 4 3\n        simp: mem_lookup_def inv_pair_lengthD1 execute_simps Let_def\n        intro: success_intros intro!: success_bind_I\n       )\n  subgoal\n    using pair.lookup_inv(1) unfolding lookup1_def .\n  done\n\nlemma rel_state_lookup:\n  \"((=) ===> rel_state (=)) pair.lookup_pair lookup_pair\"\n  unfolding pair.lookup_pair_def lookup_pair_def\n  unfolding\n    mem_lookup1_def[symmetric] mem_lookup2_def[symmetric]\n    get_k2_def[symmetric] get_k2'_def[symmetric]\n    get_k1_def[symmetric] get_k1'_def[symmetric]\n  by transfer_prover\n\nlemma rel_state_update:\n  \"((=) ===> (=) ===> rel_state (=)) pair.update_pair update_pair\"\n  unfolding pair.update_pair_def update_pair_def\n  unfolding move12'_def[symmetric]\n  unfolding\n    update1'_def[symmetric] update2'_def[symmetric]\n    get_k2_def[symmetric] get_k2'_def[symmetric]\n    get_k1_def[symmetric] get_k1'_def[symmetric]\n  by transfer_prover\n\ninterpretation mem: heap_mem_defs pair.inv_pair lookup_pair update_pair .\n\nlemma inv_pairD:\n  \"inv_pair_weak heap\" if \"pair.inv_pair heap\"\n  using that unfolding pair.inv_pair_def by (auto simp: Let_def)\n\nlemma mem_rel_state_ofI:\n  \"mem.rel_state (=) m' m\" if\n  \"rel_state (=) m' m\"\n  \"\\<And> heap. pair.inv_pair heap \\<Longrightarrow>\n    (case State_Monad.run_state m' heap of (_, heap) \\<Rightarrow> inv_pair_weak heap \\<longrightarrow> pair.inv_pair heap)\"\nproof -\n  show ?thesis\n    apply (rule mem.rel_state_intro)\n    subgoal for heap v heap'\n      by (auto elim: rel_state_elim[OF that(1)] dest!: inv_pairD)\n    subgoal premises prems for heap v heap'\n    proof -\n      from prems that(1) have \"inv_pair_weak heap'\"\n        by (fastforce elim: rel_state_elim dest: inv_pairD)\n      with prems show ?thesis\n        by (auto dest: that(2))\n    qed\n    done\nqed\n\nlemma mem_rel_state_ofI':\n  \"mem.rel_state (=) m' m\" if\n  \"rel_state (=) m' m\"\n  \"DP_CRelVS.lift_p pair.inv_pair m'\"\n  using that by (auto elim: DP_CRelVS.lift_p_P intro: mem_rel_state_ofI)\n\ncontext\n  assumes keys: \"\\<forall>k k'. key1 k = key1 k' \\<and> key2 k = key2 k' \\<longrightarrow> k = k'\"\nbegin\n\ninterpretation mem_correct pair.lookup_pair pair.update_pair pair.inv_pair\n  by (rule mem_correct_pair[OF keys])\n\nlemma rel_state_lookup':\n  \"((=) ===> mem.rel_state (=)) pair.lookup_pair lookup_pair\"\n  apply (intro rel_funI)\n  apply simp\n  apply (rule mem_rel_state_ofI')\n  using rel_state_lookup apply (rule rel_funD) apply (rule refl)\n  apply (rule lookup_inv)\n  done\n\nlemma rel_state_update':\n  \"((=) ===> (=) ===> mem.rel_state (=)) pair.update_pair update_pair\"\n  apply (intro rel_funI)\n  apply simp\n  apply (rule mem_rel_state_ofI')\n  subgoal for x y a b\n    using rel_state_update by (blast dest: rel_funD)\n  by (rule update_inv)\n\ninterpretation heap_correct pair.inv_pair update_pair lookup_pair\n  by (rule mem.mem_correct_heap_correct[OF _ rel_state_lookup' rel_state_update']) standard\n\nlemmas heap_correct_pairI = heap_correct_axioms\n\n(* TODO: Generalize *)\nlemma mem_rel_state_resultD:\n  \"result_of m heap = fst (run_state m' heap)\" if \"mem.rel_state (=) m' m\" \"pair.inv_pair heap\"\n  by (metis (mono_tags, lifting) mem.rel_state_elim option.sel that)\n\nlemma map_of_heap_eq:\n  \"mem.map_of_heap heap = pair.pair.map_of heap\" if \"pair.inv_pair heap\"\n  unfolding mem.map_of_heap_def pair.pair.map_of_def\n  using that by (simp add: mem_rel_state_resultD[OF rel_state_lookup'[THEN rel_funD]])\n\ncontext\n  fixes k1 k2 heap heap'\n  assumes init: \"execute (init_state k1 k2) heap = Some ((k_ref1, k_ref2, m_ref1, m_ref2), heap')\"\nbegin\n\nlemma init_state_empty1:\n  \"pair.mem1.map_of heap' k = None\"\n  using init\n  unfolding pair.mem1.map_of_def lookup1_def mem_lookup_def init_state_def\n  by (auto\n        simp: init_state_inner_nth init_state_inner_alloc(3) execute_simps Let_def\n        elim!: execute_bind_success'[OF success_empty])\n     (metis\n        Array.present_alloc Memory_Heap.length_mem_empty execute_new execute_nth(1) fst_conv\n        length_def mem_empty_def nth_mem_empty option.sel present_alloc_get snd_conv\n     )\n\nlemma init_state_empty2:\n  \"pair.mem2.map_of heap' k = None\"\n  using init\n  unfolding pair.mem2.map_of_def lookup2_def mem_lookup_def init_state_def\n  by (auto\n        simp: execute_simps init_state_inner_nth init_state_inner_alloc(4) Let_def\n        elim!: execute_bind_success'[OF success_empty]\n     )\n     (metis fst_conv nth_mem_empty option.sel snd_conv)\n\nlemma\n  shows init_state_k1: \"result_of (!k_ref1) heap' = k1\"\n    and init_state_k2: \"result_of (!k_ref2) heap' = k2\"\n  using init init_state_inner_alloc\n  by (auto simp: execute_simps init_state_def elim!: execute_bind_success'[OF success_empty])\n\ncontext\n  assumes neq: \"k1 \\<noteq> k2\"\nbegin\n\nlemma init_state_inv':\n  \"pair.inv_pair heap'\"\n  unfolding pair.inv_pair_def\n  apply (auto simp: Let_def)\n  subgoal\n    using init_state_empty1 by simp\n  subgoal\n    using init_state_empty2 by simp\n  subgoal\n    using neq init by (simp add: get_k1_def get_k2_def init_state_k1 init_state_k2)\n  subgoal\n    by (rule init_state_inv[OF init])\n  done\n\nlemma init_state_empty:\n  \"pair.pair.map_of heap' \\<subseteq>\\<^sub>m Map.empty\"\n  using neq by (intro pair.emptyI init_state_inv' map_emptyI init_state_empty1 init_state_empty2)\n\ninterpretation heap_correct_empty pair.inv_pair update_pair lookup_pair heap'\n  apply (rule heap_correct_empty.intro)\n   apply (rule heap_correct_pairI)\n  apply standard\n  subgoal\n    by (subst map_of_heap_eq; intro init_state_inv' init_state_empty)\n  subgoal\n    by (rule init_state_inv')\n  done\n\nlemmas heap_correct_empty_pairI = heap_correct_empty_axioms\n\ncontext\n  fixes dp :: \"'k \\<Rightarrow> 'v\"\nbegin\n\ninterpretation dp_consistency_heap_empty\n  pair.inv_pair update_pair lookup_pair dp heap'\n  by standard\n\nlemmas consistent_empty_pairI = dp_consistency_heap_empty_axioms\n\nend (* DP *)\n\nend (* Unequal Keys *)\n\nend (* Init State *)\n\nend (* Keys injective *)\n\nend (* Lifting Syntax *)\n\nend (* Disjoint *)\n\nend (* Injectivity *)\n\nend (* Refs *)\n\nend (* Key functions & Size *)\n\nend (* Theory *)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Monad_Memo_DP/heap_monad/Memory_Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011686727231, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.32442131704285415}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Peter Lammich <peter dot lammich at uni-muenster.de>\n    Maintainer:  Peter Lammich <peter dot lammich at uni-muenster.de>\n*)\nsection \\<open>\\isaheader{Additions to RB-Trees}\\<close>\ntheory RBT_add\nimports \n  \"HOL-Library.RBT_Impl\" \n  \"../Iterator/Iterator\"\nbegin\ntext_raw \\<open>\\label{thy:RBT_add}\\<close>\n\nlemma tlt_trans: \"\\<lbrakk>l |\\<guillemotleft> u; u\\<le>v\\<rbrakk> \\<Longrightarrow> l |\\<guillemotleft> v\"\n  by (induct l) auto\n\nlemma trt_trans: \"\\<lbrakk> u\\<le>v; v\\<guillemotleft>|r \\<rbrakk> \\<Longrightarrow> u\\<guillemotleft>|r\"\n  by (induct r) auto\n\nlemmas tlt_trans' = tlt_trans[OF _ less_imp_le]\nlemmas trt_trans' = trt_trans[OF less_imp_le]\n\nprimrec rm_iterateoi \n  :: \"('k,'v) RBT_Impl.rbt \\<Rightarrow> ('k \\<times> 'v, '\\<sigma>) set_iterator\"\n  where\n  \"rm_iterateoi RBT_Impl.Empty c f \\<sigma> = \\<sigma>\" |\n  \"rm_iterateoi (RBT_Impl.Branch col l k v r) c f \\<sigma> = (\n    if (c \\<sigma>) then\n      let \\<sigma>' = rm_iterateoi l c f \\<sigma> in\n        if (c \\<sigma>') then\n          rm_iterateoi r c f (f (k, v) \\<sigma>')\n        else \\<sigma>'\n    else \n      \\<sigma>\n  )\"\n\nlemma rm_iterateoi_abort :\n  \"\\<not>(c \\<sigma>) \\<Longrightarrow> rm_iterateoi t c f \\<sigma> = \\<sigma>\"\nby (cases t) auto\n\nlemma rm_iterateoi_alt_def :\n  \"rm_iterateoi RBT_Impl.Empty = set_iterator_emp\"\n  \"rm_iterateoi (RBT_Impl.Branch col l k v r) = \n   set_iterator_union (rm_iterateoi l)\n     (set_iterator_union (set_iterator_sng (k, v)) (rm_iterateoi r))\"\nby (simp_all add: fun_eq_iff set_iterator_emp_def rm_iterateoi_abort\n                  set_iterator_union_def set_iterator_sng_def Let_def)\ndeclare rm_iterateoi.simps[simp del]\n\n\nprimrec rm_reverse_iterateoi \n  :: \"('k,'v) RBT_Impl.rbt \\<Rightarrow> ('k \\<times> 'v, '\\<sigma>) set_iterator\"\n  where\n  \"rm_reverse_iterateoi RBT_Impl.Empty c f \\<sigma> = \\<sigma>\" |\n  \"rm_reverse_iterateoi (Branch col l k v r) c f \\<sigma> = (\n    if (c \\<sigma>) then\n      let \\<sigma>' = rm_reverse_iterateoi r c f \\<sigma> in\n        if (c \\<sigma>') then\n          rm_reverse_iterateoi l c f (f (k, v) \\<sigma>')\n        else \\<sigma>'\n    else \n      \\<sigma>\n  )\"\n\nlemma rm_reverse_iterateoi_abort :\n  \"\\<not>(c \\<sigma>) \\<Longrightarrow> rm_reverse_iterateoi t c f \\<sigma> = \\<sigma>\"\nby (cases t) auto\n\nlemma rm_reverse_iterateoi_alt_def :\n  \"rm_reverse_iterateoi RBT_Impl.Empty = set_iterator_emp\"\n  \"rm_reverse_iterateoi (RBT_Impl.Branch col l k v r) = \n   set_iterator_union (rm_reverse_iterateoi r)\n     (set_iterator_union (set_iterator_sng (k, v)) (rm_reverse_iterateoi l))\"\nby (simp_all add: fun_eq_iff set_iterator_emp_def rm_reverse_iterateoi_abort\n                  set_iterator_union_def set_iterator_sng_def Let_def)\ndeclare rm_reverse_iterateoi.simps[simp del]\n\n(*\nlemma finite_dom_lookup [simp, intro!]: \"finite (dom (RBT.lookup t))\"\nby(simp add: RBT.lookup_def)\n\n\ninstantiation rbt :: (\"{equal, linorder}\", equal) equal begin\n\ndefinition \"equal_class.equal (r :: ('a, 'b) rbt) r' == RBT.impl_of r = RBT.impl_of r'\"\n\ninstance\nproof\nqed (simp add: equal_rbt_def RBT.impl_of_inject)\n\nend\n*)\n\nlemma (in linorder) map_to_set_lookup_entries: \n   \"rbt_sorted t \\<Longrightarrow> map_to_set (rbt_lookup t) = set (RBT_Impl.entries t)\"\n  using map_of_entries[symmetric,of t]\n  by (simp add: distinct_entries map_to_set_map_of)\n\nlemma (in linorder) rm_iterateoi_correct:\n  fixes t::\"('a, 'v) RBT_Impl.rbt\"\n  assumes is_sort: \"rbt_sorted t\"\n  defines \"it \\<equiv> \n  RBT_add.rm_iterateoi::(('a, 'v) RBT_Impl.rbt \\<Rightarrow> ('a \\<times> 'v, '\\<sigma>) set_iterator)\"\n  shows \"map_iterator_linord (it t) (rbt_lookup t)\"\n  using is_sort\nproof (induct t)\n  case Empty\n  show ?case unfolding it_def \n    by (simp add: rm_iterateoi_alt_def \n      map_iterator_linord_emp_correct rbt_lookup_Empty)\nnext\n  case (Branch c l k v r)\n  note is_sort_t = Branch(3)\n\n  from Branch(1) is_sort_t have \n    l_it: \"map_iterator_linord (it l) (rbt_lookup l)\" by simp\n  from Branch(2) is_sort_t have \n    r_it: \"map_iterator_linord (it r) (rbt_lookup r)\" by simp\n  note kv_it = map_iterator_linord_sng_correct[of k v]\n\n  have kv_r_it : \"set_iterator_map_linord\n     (set_iterator_union (set_iterator_sng (k, v)) (it r))\n     (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup r))\"\n  proof (rule map_iterator_linord_union_correct [OF kv_it r_it])\n    fix kv kv'\n    assume pre: \"kv \\<in> map_to_set [k \\<mapsto> v]\" \"kv' \\<in> map_to_set (rbt_lookup r)\"\n    obtain k' v' where kv'_eq[simp]: \"kv' = (k', v')\" by (rule prod.exhaust)\n \n    from pre is_sort_t show \"fst kv < fst kv'\" \n      apply (simp add: map_to_set_lookup_entries split: prod.splits)\n      apply (metis entry_in_tree_keys rbt_greater_prop)\n      done\n  qed\n\n  have l_kv_r_it : \"set_iterator_map_linord (it (Branch c l k v r))\n     (map_to_set (rbt_lookup l) \n      \\<union> (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup r)))\"\n    unfolding it_def rm_iterateoi_alt_def\n    unfolding it_def[symmetric]\n  proof (rule map_iterator_linord_union_correct [OF l_it kv_r_it])\n    fix kv1 kv2\n    assume pre: \"kv1 \\<in> map_to_set (rbt_lookup l)\" \n                \"kv2 \\<in> map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup r)\" \n\n    obtain k1 v1 where kv1_eq[simp]: \"kv1 = (k1, v1)\" by (rule prod.exhaust)\n    obtain k2 v2 where kv2_eq[simp]: \"kv2 = (k2, v2)\" by (rule prod.exhaust)\n\n    from pre is_sort_t show \"fst kv1 < fst kv2\" \n      apply (simp add: map_to_set_lookup_entries split: prod.splits)\n      by (metis (lifting) map_of_entries neqE option.simps(3) \n        ord.rbt_lookup_rbt_greater ord.rbt_lookup_rbt_less rbt_greater_trans \n        rbt_less_trans weak_map_of_SomeI)\n  qed\n  \n  from is_sort_t\n  have map_eq: \"map_to_set (rbt_lookup l) \n    \\<union> (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup r)) =\n        map_to_set (rbt_lookup (Branch c l k v r))\" \n    by (simp add: set_eq_iff map_to_set_lookup_entries)\n  \n  from l_kv_r_it[unfolded map_eq]\n  show ?case .\nqed\n\nlemma (in linorder) rm_reverse_iterateoi_correct:\n  fixes t::\"('a, 'v) RBT_Impl.rbt\"\n  assumes is_sort: \"rbt_sorted t\"\n  defines \"it \\<equiv> RBT_add.rm_reverse_iterateoi\n    ::(('a, 'v) RBT_Impl.rbt \\<Rightarrow> ('a \\<times> 'v, '\\<sigma>) set_iterator)\"\n  shows \"map_iterator_rev_linord (it t) (rbt_lookup t)\"\n  using is_sort\nproof (induct t)\n  case Empty\n  show ?case unfolding it_def \n    by (simp add: rm_reverse_iterateoi_alt_def \n      map_iterator_rev_linord_emp_correct rbt_lookup_Empty)\nnext\n  case (Branch c l k v r)\n  note is_sort_t = Branch(3)\n\n  from Branch(1) is_sort_t have \n    l_it: \"map_iterator_rev_linord (it l) (rbt_lookup l)\" by simp\n  from Branch(2) is_sort_t have \n    r_it: \"map_iterator_rev_linord (it r) (rbt_lookup r)\" by simp\n  note kv_it = map_iterator_rev_linord_sng_correct[of k v]\n\n  have kv_l_it : \"set_iterator_map_rev_linord\n     (set_iterator_union (set_iterator_sng (k, v)) (it l))\n     (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup l))\"\n  proof (rule map_iterator_rev_linord_union_correct [OF kv_it l_it])\n    fix kv kv'\n    assume pre: \"kv \\<in> map_to_set [k \\<mapsto> v]\" \"kv' \\<in> map_to_set (rbt_lookup l)\"\n    obtain k' v' where kv'_eq[simp]: \"kv' = (k', v')\" by (rule prod.exhaust)\n \n    from pre is_sort_t show \"fst kv > fst kv'\" \n      apply (simp add: map_to_set_lookup_entries split: prod.splits)\n      apply (metis entry_in_tree_keys rbt_less_prop)\n   done\n  qed\n\n  have r_kv_l_it : \"set_iterator_map_rev_linord (it (Branch c l k v r))\n     (map_to_set (rbt_lookup r) \n      \\<union> (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup l)))\"\n    unfolding it_def rm_reverse_iterateoi_alt_def\n    unfolding it_def[symmetric]\n  proof (rule map_iterator_rev_linord_union_correct [OF r_it kv_l_it])\n    fix kv1 kv2\n    assume pre: \"kv1 \\<in> map_to_set (rbt_lookup r)\" \n                \"kv2 \\<in> map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup l)\" \n\n    obtain k1 v1 where kv1_eq[simp]: \"kv1 = (k1, v1)\" by (rule prod.exhaust)\n    obtain k2 v2 where kv2_eq[simp]: \"kv2 = (k2, v2)\" by (rule prod.exhaust)\n\n    from pre is_sort_t show \"fst kv1 > fst kv2\" \n      apply (simp add: map_to_set_lookup_entries split: prod.splits)\n      by (metis (mono_tags) entry_in_tree_keys neq_iff option.simps(3) \n        ord.rbt_greater_prop ord.rbt_lookup_rbt_less rbt_less_trans \n        rbt_lookup_in_tree)\n  qed\n  \n  from is_sort_t\n  have map_eq: \"map_to_set (rbt_lookup r) \n    \\<union> (map_to_set [k \\<mapsto> v] \\<union> map_to_set (rbt_lookup l)) =\n        map_to_set (rbt_lookup (Branch c l k v r))\" \n    by (auto simp add: set_eq_iff map_to_set_lookup_entries)\n\n  from r_kv_l_it[unfolded map_eq]\n  show ?case .\nqed\n\nlemma pi_rm[icf_proper_iteratorI]: \n  \"proper_it (RBT_add.rm_iterateoi t) (RBT_add.rm_iterateoi t)\"\n  by (induct t) (simp_all add: rm_iterateoi_alt_def icf_proper_iteratorI)\n\nlemma pi_rm_rev[icf_proper_iteratorI]: \n  \"proper_it (RBT_add.rm_reverse_iterateoi t) (RBT_add.rm_reverse_iterateoi t)\"\n  by (induct t) (simp_all add: rm_reverse_iterateoi_alt_def \n    icf_proper_iteratorI)\n\nprimrec bheight_aux :: \"('a,'b) RBT_Impl.rbt \\<Rightarrow> nat \\<Rightarrow> nat\"\nwhere\n  \"\\<And>acc. bheight_aux RBT_Impl.Empty acc = acc\"\n| \"\\<And>acc. bheight_aux (RBT_Impl.Branch c lt k v rt) acc = \n     bheight_aux lt (case c of RBT_Impl.B \\<Rightarrow> Suc acc | RBT_Impl.R \\<Rightarrow> acc)\"\n\nlemma bheight_aux_eq: \"bheight_aux t a = bheight t + a\"\n  by (induct t arbitrary: a) (auto split: RBT_Impl.color.split)\n\ndefinition [code_unfold]: \"rbt_bheight t \\<equiv> bheight_aux t 0\"\nlemma \"rbt_bheight t = bheight t\"\n  unfolding rbt_bheight_def by (simp add: bheight_aux_eq)\n\n(*definition \"black_height t \\<equiv> rbt_bheight (RBT.impl_of t)\"*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/Lib/RBT_add.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.32442130901994826}}
{"text": "theory Chapter10_4\nimports \"HOL-IMP.Live_True\" \"HOL-IMP.Vars\"\nbegin\n\nlemma \"(let b = Less (N 0) (V ''x''); c = ''x'' ::= V ''y'';; ''y'' ::= V ''z''\n  in L (WHILE b DO c) {}) = {''x'', ''y'', ''z''}\"\nby eval\n\ntext \\<open>That there are live variables before the loop is not weird, even though\nthere are no live variables after the loop; the fixpoint adds in the vars including those in\nthe loop that are needed in the computation of the test (vars b) to the set of live variables.\nFor checking termination before the first loop, pre-loop value of x from before is needed,\nfor check inf just after the first loop, pre-loop value of y decides, and after that value of\nz is needed\\<close>\n\n\ntext \\<open>Ex 10.12 WHILE b (relying on e\\<^sub>1) DO e\\<^sub>1 ::= e\\<^sub>2;; e\\<^sub>2 ::= e\\<^sub>3 ...\\<close>\n\ntext\\<open>\n\\exercise\nIn the context of ordinary live variable analysis, elimination of dead variables\n(@{text bury}) is not idempotent (Exercise~\\ref{exe:bury-not-idemp}).\nNow define the textually identical function @{text bury} in the context\nof true liveness analysis (theory @{theory \"HOL-IMP.Live_True\"})\nand prove that it is idempotent.\n\\<close>\n\nfun bury :: \"com \\<Rightarrow> vname set \\<Rightarrow> com\" where\n\"bury SKIP X = SKIP\" |\n\"bury (x ::= a) X = (if x \\<in> X then x ::= a else SKIP)\" |\n\"bury (c\\<^sub>1;; c\\<^sub>2) X = (bury c\\<^sub>1 (L c\\<^sub>2 X);; bury c\\<^sub>2 X)\" |\n\"bury (IF b THEN c\\<^sub>1 ELSE c\\<^sub>2) X = IF b THEN bury c\\<^sub>1 X ELSE bury c\\<^sub>2 X\" |\n\"bury (WHILE b DO c) X = WHILE b DO bury c (L (WHILE b DO c) X)\"\n\ntext\\<open> The following two tweaks improve proof automation: \\<close>\n\ndeclare L.simps(5)[simp]\nlemmas L_mono2 = L_mono[unfolded mono_def]\n\ntext\\<open> To show that @{const bury} is idempotent we need a key lemma: \\<close>\n\nlemma L_bury: \"X \\<subseteq> Y \\<Longrightarrow> L (bury c Y) X = L c X\"\nproof (induct c arbitrary: X Y)\n  case (Seq c1 c2)\n  from Seq(3) have \"(L c2 X) \\<subseteq> (L c2 Y)\" by (simp add: L_mono2)\n  with Seq(1) have \"L (bury c1 (L c2 Y)) (L c2 X) = L c1 (L c2 X)\" by simp\n  moreover from Seq(2, 3) have \"L (bury c2 Y) X = L c2 X\" by simp\n  ultimately have \"L (bury c1 (L c2 Y)) (L (bury c2 Y) X) = L c1 (L c2 X)\" by simp\n  then show ?case by simp\nnext\n  case (While x1 c)\n  let ?x = \"\\<lambda>U. vars x1 \\<union> X \\<union> L c U\" and ?y = \"\\<lambda>V. vars x1 \\<union> Y \\<union> L c V\"\n  let ?xb = \"\\<lambda>U. vars x1 \\<union> X \\<union> L (bury c (lfp ?y)) U\"\n  have \"mono ?x\" and \"mono ?xb\" by (auto intro: mono_union_L)\n  then have fpx: \"?x (lfp ?x) = lfp ?x\" and fpxb: \"?xb (lfp ?xb) = lfp ?xb\" by (auto intro!: lfp_fixpoint)\n  from While(2) have x_s_y: \"lfp ?x \\<subseteq> lfp ?y\" by (auto intro!: lfp_mono)\n  with While(1) have \"L (bury c (lfp ?y)) (lfp ?x) = L c (lfp ?x)\" by simp\n  with fpx have \"?xb (lfp ?x) = lfp ?x\" by simp\n  then have xb_s_x: \"lfp ?xb \\<subseteq> lfp ?x\" by (auto intro!: lfp_lowerbound)\n  with x_s_y have \"lfp ?xb \\<subseteq> lfp ?y\" by simp\n  with While(1) have \"L (bury c (lfp ?y)) (lfp ?xb) = L c (lfp ?xb)\" by simp\n  with fpxb have \"?x (lfp ?xb) = lfp ?xb\" by simp\n  then have x_s_xb: \"lfp ?x \\<subseteq> lfp ?xb\" by (auto intro!: lfp_lowerbound)\n  with xb_s_x show ?case by simp\nqed auto\n\ntext\\<open> The proof is straightforward except for the case\n\\noquotes{@{term[source] \"While b c\"}} where reasoning about @{const lfp}\nis required. Sledgehammer should help with the details.\n\nNow we can prove idempotence of @{const bury}, again by induction on @{text c}:\n\\<close>\n\ntheorem bury_idemp: \"bury (bury c X) X = bury c X\"\nproof (induct c arbitrary: X)\n  case (Seq c1 c2)\n  show ?case\n  proof (simp, intro conjI)\n    from Seq(2) show \"bury (bury c2 X) X = bury c2 X\" .\n    have \"bury (bury c1 (L c2 X)) (L (bury c2 X) X) = bury (bury c1 (L c2 X)) (L c2 X)\" by (simp add: L_bury)\n    also from Seq(1) have \"\\<dots> = bury c1 (L c2 X)\" by simp\n    finally show \"bury (bury c1 (L c2 X)) (L (bury c2 X) X) = bury c1 (L c2 X)\" .\n  qed\nnext\ncase (While x1 c)\n  let ?x = \"\\<lambda>Y. vars x1 \\<union> X \\<union> L c Y\"\n  let ?xb = \"\\<lambda>Y. vars x1 \\<union> X \\<union> L (bury c (lfp ?x)) Y\"\n  have \"mono ?x\" and \"mono ?xb\" by (simp add: mono_union_L)+\n  then have fpx: \"?x (lfp ?x) = lfp ?x\" and fpxb: \"?xb (lfp ?xb) = lfp ?xb\" by (auto intro!: lfp_fixpoint)\n  then have \"?xb (lfp ?x) = lfp ?x\" by (simp add: L_bury)\n  then have xb_s_x: \"lfp ?xb \\<subseteq> lfp ?x\" by (auto intro!: lfp_lowerbound)\n  then have \"L (bury c (lfp ?x)) (lfp ?xb) = L c (lfp ?xb)\" by (simp add: L_bury)\n  then have \"?xb (lfp ?xb) = ?x (lfp ?xb)\" by simp\n  with fpxb have \"?x (lfp ?xb) = lfp ?xb\" by simp\n  then have x_s_xb: \"lfp ?x \\<subseteq> lfp ?xb\" by (auto intro!: lfp_lowerbound)\n  with xb_s_x have \"lfp ?x = lfp ?xb\" by simp\n  moreover from While have \"bury (bury c (lfp ?x)) (lfp ?x) = bury c (lfp ?x)\" by simp\n  ultimately have \"bury (bury c (lfp ?x)) (lfp ?xb) = bury c (lfp ?x)\" by simp\n  then show ?case by simp\nqed auto\n(* your definition/proof here *)\n\ntext\\<open>\nDue to lemma @{thm[source] L_bury}, even the @{text While} case should be easy.\n\\endexercise\n\\<close>\n\nend\n\n", "meta": {"author": "jhanschoo", "repo": "concrete-semantics-solutions-2019", "sha": "a074695cf316eda4775cc8cfef90c85d44af04a1", "save_path": "github-repos/isabelle/jhanschoo-concrete-semantics-solutions-2019", "path": "github-repos/isabelle/jhanschoo-concrete-semantics-solutions-2019/concrete-semantics-solutions-2019-a074695cf316eda4775cc8cfef90c85d44af04a1/Chapter10_4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704502361149, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.32442130040473605}}
{"text": "subsection \\<open>Create Consistent\\label{sec:create_consistent}\\<close>\n\ntheory CreateConsistent\n  imports CreateAlgorithms Consistency\nbegin\n\n\n\nlemma nth_visible_eff:\n  assumes \"nth_visible s n = Inr i\"\n  shows \"extended_to_set i \\<subseteq> I ` set s\"\nproof -\n  have \"i \\<in> set (ext_ids (filter is_visible s))\"\n    apply (cases \"n < length (ext_ids (filter is_visible s))\")\n    using assms by auto\n  thus ?thesis  \n    apply (simp add: ext_ids_def) \n    using extended.inject by auto\nqed\n\nlemma subset_mono:\n  assumes \"N \\<subseteq> M\"\n  shows \"I ` insert_messages N \\<subseteq> I ` insert_messages M\"\nproof -\n  have \"insert_messages N \\<subseteq> insert_messages M\" using assms\n    by (metis (no_types, lifting) Collect_mono_iff insert_messages_def subsetCE)\n  thus ?thesis by (simp add: image_mono)\nqed\n\nlemma deps_insert:\n  assumes \"\\<Union> (deps ` M) \\<subseteq> (I ` insert_messages M)\"\n  assumes \"deps m \\<subseteq> I ` insert_messages M\"\n  shows \"\\<Union> (deps ` (M \\<union> {m})) \\<subseteq> (I ` insert_messages (M \\<union> {m}))\"\nproof -\n  have \"deps m \\<subseteq> I ` insert_messages (M \\<union> {m})\" using assms(2) subset_mono\n    by (metis Un_upper1 order_trans)\n  thus ?thesis using assms(1) apply (simp) \n    by (meson rev_subsetD subsetI subset_insertI subset_mono)\nqed\n\nlemma wf_add:\n  fixes m :: \"('a,'b) insert_message\"\n  assumes \"wfP (depends_on M)\"\n  assumes \"\\<And>n. n \\<in> (M \\<union> {m}) \\<Longrightarrow> I m \\<notin> deps (Insert n)\"\n  assumes \"m \\<notin> M\"\n  shows \"wfP (depends_on (M \\<union> {m}))\" \nproof -\n  have \"\\<And>Q. Q \\<noteq> {} \\<Longrightarrow> (\\<exists>z\\<in>Q. \\<forall>y. (y \\<in> M \\<union> {m}) \\<and> (z \\<in> M \\<union> {m}) \\<and>\n           I y \\<in> deps (Insert z) \\<longrightarrow> y \\<notin> Q)\"\n  proof -\n    fix Q :: \"('a, 'b) insert_message set\"\n    assume b:\"Q \\<noteq> {}\"\n    show \"\\<exists>z\\<in>Q. \\<forall>y. (y \\<in> M \\<union> {m}) \\<and> (z \\<in> M \\<union> {m}) \\<and> I y \\<in> deps (Insert z)\n           \\<longrightarrow> y \\<notin> Q\"\n    proof (cases \"\\<exists>x. x \\<in> Q - {m}\")\n      case True\n      hence \"\\<exists>z\\<in> Q - {m}. \\<forall>y. (y \\<in> M) \\<and> (z \\<in> M) \\<and> I y \\<in> deps (Insert z)\n             \\<longrightarrow> y \\<notin> Q - {m}\"\n        by (metis depends_on.simps assms(1) wfP_eq_minimal)\n      then show ?thesis using assms(2) DiffD2 by auto\n    next\n      case False\n      hence \"Q = {m}\" using b by blast\n      thus ?thesis using assms(2) by blast\n    qed\n  qed\n  thus ?thesis by (simp add:wfP_eq_minimal, blast)\nqed\n\nlemma create_insert_p_s_ordered:\n  assumes \"is_associated_string N s\"\n  assumes \"a_conditions (insert_messages N) a\"\n  assumes \"Inr (Insert m) = create_insert s n \\<sigma> new_id\"\n  shows \"a (P m) < a (S m)\"\nproof -\n  obtain p q where pq_def: \n    \"create_insert s n \\<sigma> new_id = Inr (Insert (InsertMessage p new_id q \\<sigma>))\" \n    by (metis (no_types, lifting) One_nat_def add.right_neutral add_Suc_right \n        create_insert.elims sum.case_eq_if sum.simps(4) assms(3) bind_def)\n  have \"Inr p = nth_visible s n\" using pq_def Error_Monad.bindE by fastforce\n  moreover have \"Inr q = nth_visible s (Suc n)\" \n    using pq_def Error_Monad.bindE by fastforce  \n  ultimately have \"a p < a q\"\n    using assms by (metis is_associated_string_def nth_visible_inc')\n  moreover have \"m = InsertMessage p new_id q \\<sigma>\"\n    using assms(3) pq_def by auto\n  ultimately show ?thesis by (simp add: pq_def)\nqed\n\nlemma create_insert_consistent:\n  assumes \"consistent M\"\n  assumes \"is_associated_string N s\"\n  assumes \"N \\<subseteq> M\"\n  assumes \"Inr m = create_insert s n \\<sigma> new_id\"\n  assumes \"new_id \\<notin> I ` insert_messages M\"\n  shows \"consistent (M \\<union> {m})\"\nproof -\n  obtain p q where pq_def:\n    \"create_insert s n \\<sigma> new_id = Inr (Insert (InsertMessage p new_id q \\<sigma>))\"\n    by (metis (no_types, lifting) One_nat_def add.right_neutral add_Suc_right \n        create_insert.elims assms(4) sum.case_eq_if sum.simps(4) bind_def)\n  define m' where \"m' = InsertMessage p new_id q \\<sigma>\" \n  hence a:\"m = Insert m'\" using pq_def assms(4) by auto\n  hence d: \"create_insert s n \\<sigma> new_id = Inr (Insert m')\"\n    using pq_def assms by simp\n  have b:\"I m' = new_id\" using m'_def by (simp add:I_def)\n  hence \"inj_on I (insert_messages M \\<union> {m'})\" using assms(5) assms(1)\n    using consistent_def by fastforce\n  hence \"inj_on I (insert_messages (M \\<union> {m}))\" using assms(4) pq_def m'_def\n    by (metis Inr_inject insert_insert_message)\n  moreover \n  have p:\"extended_to_set p \\<subseteq> I ` set s\" using pq_def nth_visible_eff by fastforce \n  have q: \"extended_to_set q \\<subseteq> I ` set s\"\n    using pq_def apply (simp add:bind_def del:nth_visible.simps)\n    apply (cases \"nth_visible s n\", simp)\n    by (cases \"nth_visible s (Suc n)\", simp, simp add: nth_visible_eff)  \n  have \"extended_to_set p \\<union> extended_to_set q \\<subseteq> I ` set s\" using p q by simp\n  hence \"extended_to_set p \\<union> extended_to_set q \\<subseteq> I ` insert_messages N\"\n    by (metis assms(2) is_associated_string_def to_woot_character_keeps_i_lifted)\n  hence \"extended_to_set p \\<union> extended_to_set q \\<subseteq> I ` insert_messages M\" \n    using assms(3) subset_mono by blast\n  hence c:\"deps m \\<subseteq> I ` insert_messages M\" using pq_def assms(4) by auto\n  hence \"\\<Union> (deps ` (M \\<union> {m})) \\<subseteq> (I ` insert_messages (M \\<union> {m}))\"\n    by (metis consistent_def assms(1) deps_insert)\n  moreover have w: \n    \"\\<forall>n \\<in> insert_messages M \\<union> {m'}. deps (Insert n) \\<subseteq> I ` insert_messages M\" \n    by (metis a c consistent_def assms(1) Sup_le_iff imageI insert_iff \n        insert_is_Un insert_messages_def mem_Collect_eq sup.commute)\n  hence \"\\<forall>n \\<in> insert_messages M \\<union> {m'}. I m' \\<notin> deps (Insert n)\"\n    using b assms(5) by blast \n  hence \"wfP (depends_on (insert_messages M \\<union> {m'}))\" \n    by (metis Un_insert_right insert_absorb wf_add assms(1)\n        consistent_def sup_bot.right_neutral)\n  moreover obtain a where a_def: \"a_conditions (insert_messages M) a\"\n    using consistent_def  assms(1) by blast\n  define a' where \n    \"a' = (\\<lambda>i. if i = \\<lbrakk> new_id \\<rbrakk> then \\<lbrakk>\\<Psi> (a (P m'), a(S m')) new_id\\<rbrakk> else a i)\"   \n  hence \"a_conditions (insert_messages (M \\<union> {m})) a'\"\n  proof -\n    have \"a' \\<turnstile> < a' \\<stileturn>\" using a'_def a_conditions_def a_def by auto\n    moreover have \n      \"\\<And>m''. m'' \\<in> (insert_messages M \\<union> {m'}) \\<longrightarrow> \n          a'(P m'') < a'(S m'')  \\<and>\n          a' \\<lbrakk>I m''\\<rbrakk> = \\<lbrakk>\\<Psi> (a'(P m''), a'(S m'')) (I m'')\\<rbrakk>\" \n    proof \n      fix m''\n      assume e:\" m'' \\<in> (insert_messages M \\<union> {m'})\"\n      show \"a'(P m'') < a'(S m'') \\<and> a' \\<lbrakk> I m''\\<rbrakk> = \n            \\<lbrakk>\\<Psi> (a'(P m''), a'(S m'')) (I m'')\\<rbrakk>\" \n      proof (cases \"m'' \\<in> insert_messages M\")\n        case True\n        moreover have \"deps (Insert m'') \\<subseteq> I ` insert_messages M\" \n          using e w by blast\n        hence \"P m'' \\<noteq> \\<lbrakk> new_id \\<rbrakk> \\<and> S m'' \\<noteq> \\<lbrakk> new_id \\<rbrakk>\"\n          by (meson assms(5) contra_subsetD pred_is_dep succ_is_dep)\n        moreover have \"I m'' \\<noteq> new_id\" \n          using assms(5) True by blast\n        ultimately show ?thesis using a_def True \n          by (simp add: a_conditions_def a'_def)\n      next\n        case False\n        moreover have \"I m'' = new_id\" using False b e by blast\n        moreover have \"deps (Insert m'') \\<subseteq> I ` insert_messages M\"\n          using False a c e by blast\n        hence \"P m'' \\<noteq> \\<lbrakk> new_id \\<rbrakk> \\<and> S m'' \\<noteq> \\<lbrakk> new_id \\<rbrakk>\" \n          by (meson assms(5) contra_subsetD pred_is_dep succ_is_dep)\n        moreover have \"a_conditions (insert_messages N) a\" \n          using a_def a_subset assms is_associated_string_def by blast\n        hence \"a (P m') < a (S m')\"\n          by (metis assms(2) d create_insert_p_s_ordered)\n        hence \"a' (P m'') < a' (S m'')\" using calculation a'_def False e by auto\n        ultimately show ?thesis using e a'_def by auto\n      qed\n    qed\n    ultimately show \"?thesis\" using a_conditions_def \n      by (metis a insert_insert_message)\n  qed\n  ultimately show \"?thesis\" using consistent_def a by (metis insert_insert_message)\nqed\n\nlemma bind_simp: \"(x \\<bind> (\\<lambda>l. y l) = Inr r) \\<Longrightarrow> (y (projr x) = Inr r)\"\n  using isOK_I by force\n\n\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/WOOT_Strong_Eventual_Consistency/CreateConsistent.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3243459969850503}}
{"text": "theory NP4_Struct_Action_Values\n  imports\n  NP4_Struct_Action_Syntax\n  \"~~/src/HOL/Word/Word\"\n  \"~~/src/HOL/Word/Word_Bitwise\"\n(*  These files contain a minimalistic semantics of P4's action constructs. These files\n    specifically extend the previously implemented simple semantics with more complex\n    datastructures, in this case the struct datastructure. P4 knows structs, headers,\n    enums, header unions and stacks, and tuples. The struct type however is the most\n    general of these. Showing that structs are verifiable thus also shows that headers\n    (and thus header unions and header stacks), enums, and tuples can be verified using\n    Isabelle/HOL. *)\nbegin\n\n(* ============================================================================================================== *)\n(*                                              VALUE MAPPINGS                                                    *)\n(* ============================================================================================================== *)\n\n(* Mapping to concrete value *)\ndatatype val = UINT nat\n  | SINT int\n  | IINT int\n  | VINT nat\n  | BOOL bool\n  | STRING string\n  | ERROR \"identifier list\"\n  | MATCH \"identifier list\"\n  | STRUCT \"(identifier * vname * val option) list\" (* Heterogeneous named struct *)\n\n(* State is a mapping from variable names to values *)\ntype_synonym state = \"vname \\<Rightarrow> val\"\n\n(* ============================================================================================================== *)\n(*                                         BASE CONVERSION FUNCTIONS                                              *)\n(* ============================================================================================================== *)\n\nfun\n  (* Structs have base types in them, so convert the contents of a struct to vals recursively *)\n  structEntryToVal :: \"(identifier * vname * basicType option) \\<Rightarrow> (identifier * vname * val option)\"\nand\n  baseToVal :: \"basicType \\<Rightarrow> val\"\n  where\n    (* Map a single struct entry (containing basic types) to vals *)\n    \"structEntryToVal (tName, vName, None)      = (tName, vName, None)\"\n  | \"structEntryToVal (tName, vName, Some bVal) = (tName, vName, Some (baseToVal bVal))\"\n    (* Map the remaining basic types to vals *)\n  | \"baseToVal (BBOOL b)         = (BOOL b)\"\n  | \"baseToVal (BIINT n)         = (IINT n)\"\n  | \"baseToVal (BUINT n)         = (UINT n)\"\n  | \"baseToVal (BSINT n)         = (SINT n)\"\n  | \"baseToVal (BVINT n)         = (VINT n)\"\n  | \"baseToVal (BERROR e)        = (ERROR e)\"\n  | \"baseToVal (BMATCH m)        = (MATCH m)\"\n  | \"baseToVal (BSTRING s)       = (STRING s)\"\n  | \"baseToVal (DSTRUCT entries) = (STRUCT (map structEntryToVal entries))\" (* Recurse on structs *)\n\nfun\n  (* Helper function to go the other way from above (back to base type from val for struct entries) *)\n  structEntryToBase :: \"(identifier * vname * val option) \\<Rightarrow> (identifier * vname * basicType option)\"\nand\n  valToBase :: \"val \\<Rightarrow> basicType\"\n  where\n    (* Map a single struct entry (containing a val) to basic types *)\n    \"structEntryToBase (tName, vName, None)       = (tName, vName, None)\"\n  | \"structEntryToBase (tName, vName, Some vVal) = (tName, vName, Some (valToBase vVal))\"\n    (* Map the remaining vals to basic types *)\n  | \"valToBase (BOOL b)         = (BBOOL b)\"\n  | \"valToBase (IINT n)         = (BIINT n)\"\n  | \"valToBase (UINT n)         = (BUINT n)\"\n  | \"valToBase (SINT n)         = (BSINT n)\"\n  | \"valToBase (VINT n)         = (BVINT n)\"\n  | \"valToBase (ERROR e)        = (BERROR e)\"\n  | \"valToBase (MATCH m)        = (BMATCH m)\"\n  | \"valToBase (STRING s)       = (BSTRING s)\"\n  | \"valToBase (STRUCT entries) = (DSTRUCT (map structEntryToBase entries))\" (* Recurse on structs *)\n\n(* ============================================================================================================== *)\n(*                                         STRUCT EQUIVALENCE PROOFS                                              *)\n(* ============================================================================================================== *)\n\n(* Converting to val and back to base is the same *)\nlemma equiv1: \"valToBase (baseToVal b) = b\"\nproof (induction b)\n  case (DSTRUCT x)\n  note ih = this(1)\n  then show ?case\n    apply (simp)\n    apply (rule list.map_cong[of _ _ _ id, simplified])\n     apply (rule refl)\n    using ih\n    by (smt comp_def option.set_intros snd_conv snds.intros structEntryToBase.simps(1) structEntryToBase.simps(2) structEntryToVal.elims)\nqed simp+\n\n(* Converting to base and back to val is the same *)\nlemma equiv2: \"baseToVal (valToBase v) = v\"\nproof (induction v)\n  case (STRUCT x)\n  note ih = this(1)\n  then show ?case\n    apply (simp)\n    apply (rule list.map_cong[of _ _ _ id, simplified])\n     apply (rule refl)\n    using ih\n    by (smt comp_apply option.set_intros prod_set_simps(2) singletonI structEntryToBase.cases structEntryToBase.simps(1) structEntryToBase.simps(2) structEntryToVal.simps(1) structEntryToVal.simps(2))\nqed simp+\n\n(* ============================================================================================================== *)\n(*                                       STRUCT MEMBER ACCESS FUNCTIONS                                           *)\n(* ============================================================================================================== *)\n\n(* Update the named member field of a struct. Iterates through fields of enum and stores the already-seen values\n   in the buildup field. When field is found will combine buildup and remainder after updating and return. *)\nfun updateStruct :: \"val \\<Rightarrow> val \\<Rightarrow> ((identifier * vname * (val option)) list) \\<Rightarrow> identifier \\<Rightarrow> val option\" where\n    \"updateStruct (STRUCT struct) newVal buildup valName = (case struct of\n        ([])                    \\<Rightarrow> None\n      | ((tp, nm, vl) # remain) \\<Rightarrow> if (nm = valName) then Some (STRUCT (buildup @ ((tp, nm, Some newVal) # remain))) else (updateStruct (STRUCT remain) newVal ((tp, nm, vl) # buildup) valName))\"\n  | \"updateStruct _ _ _ _ = None\"\n\n(* Will retrieve named member field's value of a struct or enum (all datatypes with named member fields) *)\nfun getStructMem :: \"val \\<Rightarrow> vname \\<Rightarrow> val option\" where\n    \"getStructMem (STRUCT []) vName = None\"\n  | \"getStructMem (STRUCT ((tp, nm, None) # rst)) vName = (getStructMem (STRUCT rst) vName)\"\n  | \"getStructMem (STRUCT ((tp, nm, Some vl) # rst)) vName = (if nm = vName then (Some vl) else (getStructMem (STRUCT rst) vName))\"\n  | \"getStructMem _ vName = None\"\n\nlemma struct_mem_determ: \"getStructMem strct vName = v \\<Longrightarrow> getStructMem strct vName = v' \\<Longrightarrow> v' = v\"\n  by simp\n\n(* ============================================================================================================== *)\n(*                                   CONCRETE VALUE EVALUATION FUNCTIONS                                          *)\n(* ============================================================================================================== *)\n\ninductive eval :: \"expression \\<Rightarrow> state \\<Rightarrow> val \\<Rightarrow> bool\" where\n(* =============== Base types =============== *)\n    RBASE: \"eval (BASE b) s (baseToVal b)\"\n(* =============== Miscellaneous expressions =============== *)\n  | TERNTRUE:  \"eval e1 s (BOOL b) \\<Longrightarrow> b = True \\<Longrightarrow> eval e2 s v \\<Longrightarrow> eval (TernExpr e1 e2 e3) s v\"\n  | TERNFALSE: \"eval e1 s (BOOL b) \\<Longrightarrow> b = False \\<Longrightarrow> eval e3 s v \\<Longrightarrow> eval (TernExpr e1 e2 e3) s v\"\n  | STRUCTMEM: \"eval e1 s (STRUCT entries) \\<Longrightarrow> getStructMem (STRUCT entries) varName = (Some v) \\<Longrightarrow> eval (ExprMem e1 varName) s v\"\n(* =============== Variable mapping  =============== *)\n  | NAMEDVAR: \"eval (NamedVar varName) s (s varName)\"\n(* =============== Operations that yield a single bit (SBIT)  =============== *)\n          (* Empty for now *)\n(* =============== Operations that yield a boolean (BOOL)  =============== *)\n  | ULNEB: \"eval e1 s (BOOL b) \\<Longrightarrow> eval (UNA_LNE e1) s (BOOL (\\<not>b))\"\n    (* Boolean operations *)\n  | BEQUB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (b1 = b2))\"\n(* Very strange but boolean inequality breaks code generation? *)\n(*  | BNEQB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (b1 \\<noteq> b2))\" *)\n  | BFANB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_FAN e1 e2) s (BOOL (b1 \\<and> b2))\"\n  | BFORB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_FOR e1 e2) s (BOOL (b1 \\<or> b2))\"\n    (* Signed integer opreations *)\n  | BEQUS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n  | BLEQS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_LEQ e1 e2) s (BOOL (n1 \\<le> n2))\"\n  | BGEQS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_GEQ e1 e2) s (BOOL (n1 \\<ge> n2))\"\n  | BLESS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_LES e1 e2) s (BOOL (n1 < n2))\"\n  | BGRES: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_GRE e1 e2) s (BOOL (n1 > n2))\"\n    (* Unsigned integer opreations *)\n  | BEQUU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n  | BLEQU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_LEQ e1 e2) s (BOOL (n1 \\<le> n2))\"\n  | BGEQU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_GEQ e1 e2) s (BOOL (n1 \\<ge> n2))\"\n  | BLESU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_LES e1 e2) s (BOOL (n1 < n2))\"\n  | BGREU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_GRE e1 e2) s (BOOL (n1 > n2))\"\n    (* Infinite precision integer opreations *)\n  | BEQUI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n  | BLEQI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_LEQ e1 e2) s (BOOL (n1 \\<le> n2))\"\n  | BGEQI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_GEQ e1 e2) s (BOOL (n1 \\<ge> n2))\"\n  | BLESI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_LES e1 e2) s (BOOL (n1 < n2))\"\n  | BGREI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_GRE e1 e2) s (BOOL (n1 > n2))\"\n    (* Variable size bitstring opreations *)\n  | BEQUV: \"eval e1 s (VINT n1) \\<Longrightarrow> eval e2 s (VINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQV: \"eval e1 s (VINT n1) \\<Longrightarrow> eval e2 s (VINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n(* =============== Operations that yield an unsigned integer (UINT)  =============== *)\n  | UNEGU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval (UNA_NEG e1) s (UINT n1)\" (* Incorrect but w/e for now *)\n  | UPOSU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval (UNA_POS e1) s (UINT n1)\"\n  | UCOMU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval (UNA_COM e1) s (UINT n1)\" (* (nat (NOT (int n1))))\" Incorrect but w/e *)\n  | BADDU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_ADD e1 e2) s (UINT (n1 + n2))\"\n  | BMINU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_MIN e1 e2) s (UINT (n1 - n2))\"\n  | BANDU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_AND e1 e2) s (UINT (nat ((int n1) AND (int n2))))\"\n  | BXORU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_XOR e1 e2) s (UINT (nat ((int n1) XOR (int n2))))\"\n  | BLORU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_LOR e1 e2) s (UINT (nat ((int n1) OR (int n2))))\"\n(* =============== Operations that yield a signed integer (SINT)  =============== *)\n  | UNEGS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval (UNA_NEG e1) s (SINT (-n1))\"\n  | UPOSS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval (UNA_POS e1) s (SINT n1)\"\n  | BADDS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_ADD e1 e2) s (SINT (n1 + n2))\"\n  | BMINS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_MIN e1 e2) s (SINT (n1 - n2))\"\n(* =============== Operations that yield an infinite-precision integer (IINT)  =============== *)\n  | UNEGI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval (UNA_NEG e1) s (IINT (-n1))\"\n  | UPOSI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval (UNA_POS e1) s (IINT n1)\"\n  | BADDI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_ADD e1 e2) s (IINT (n1 + n2))\"\n  | BMINI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_MIN e1 e2) s (IINT (n1 - n2))\"\n  | BMULI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_MUL e1 e2) s (IINT (n1 * n2))\"\n  | BDIVI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_DIV e1 e2) s (IINT (n1 div n2))\"\n  | BMODI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_MOD e1 e2) s (IINT (n1 mod n2))\"\n(* =============== Operations that yield a variable-width integer (VINT)  =============== *)\n      (* Empty for now *)\n\ndeclare eval.intros[simp, intro]\nlemmas eval_induct = eval.induct[split_format(complete)]\n\ninductive_cases [elim!]: \"eval (BASE b) s v\" \"eval (TernExpr e1 e2 e3) s v\" \"eval (NamedVar i) s v\"\n\"eval (UNA_LNE e) s v\" \"eval (UNA_COM e) s v\" \"eval (UNA_NEG e) s v\" \"eval (UNA_POS e) s v\" \"eval (BIN_MUL e1 e2) s v\"\n\"eval (BIN_DIV e1 e2) s v\" \"eval (BIN_MOD e1 e2) s v\" \"eval (BIN_ADD e1 e2) s v\" \"eval (BIN_MIN e1 e2) s v\" \"eval (BIN_AND e1 e2) s v\"\n\"eval (BIN_XOR e1 e2) s v\" \"eval (BIN_LOR e1 e2) s v\" \"eval (BIN_LEQ e1 e2) s v\" \"eval (BIN_GEQ e1 e2) s v\" \"eval (BIN_LES e1 e2) s v\"\n\"eval (BIN_GRE e1 e2) s v\" \"eval (BIN_NEQ e1 e2) s v\" \"eval (BIN_EQU e1 e2) s v\" \"eval (BIN_FAN e1 e2) s v\" \"eval (BIN_FOR e1 e2) s v\"\n\"eval (ExprMem e i) s v\"\n\nlemma eval_deterministic: \"(eval e s v) \\<Longrightarrow> (eval e s v') \\<Longrightarrow> (v' = v)\"\nproof (induction arbitrary: v' rule: eval_induct)\n  case (STRUCTMEM e1 s entries varName v)\n  note th = this(4)\n  then show ?case\n    using STRUCTMEM.IH STRUCTMEM.hyps(2) by auto\nqed blast+\n\nlemma if_mem_exprMem: \"eval expr s strct \\<Longrightarrow> getStructMem strct vName = Some v \\<Longrightarrow> eval (ExprMem expr vName) s v\"\n  by (smt STRUCTMEM getStructMem.elims option.distinct(1))\n\ncode_pred eval .\n\n(* ============================================================================================================== *)\n(*                                                 STATE MAPPING                                                  *)\n(* ============================================================================================================== *)\n\ndefinition null_state (\"<>\") where\n  \"null_state \\<equiv> \\<lambda>x. (UINT 0)\"\nsyntax\n  \"_State\" :: \"updbinds \\<Rightarrow> 'a\" (\"<_>\")\ntranslations\n  \"_State ms\" == \"_Update <> ms\"\n  \"_State (_updbinds b bs)\" <= \"_Update (_State b) bs\"\n\nend\n", "meta": {"author": "Johanmyst", "repo": "Nano-P4", "sha": "fc3720d7115d0bac5d719cfe6c73a024aae7f9c4", "save_path": "github-repos/isabelle/Johanmyst-Nano-P4", "path": "github-repos/isabelle/Johanmyst-Nano-P4/Nano-P4-fc3720d7115d0bac5d719cfe6c73a024aae7f9c4/Theory_Files/Struct_Action_Verification/NP4_Struct_Action_Values.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3243459969850503}}
{"text": "(*\n * Copyright (C) 2014 NICTA\n * All rights reserved.\n *)\n\n(* Author: David Cock - David.Cock@nicta.com.au *)\n\nsection \\<open>Continuity and Induction for Loops\\<close>\n\ntheory LoopInduction imports Healthiness Continuity begin\n\ntext \\<open>Showing continuity for loops requires a stronger induction principle than we have used\nso far, which in turn relies on the continuity of loops (inductively).  Thus, the proofs are\nintertwined, and broken off from the main set of continuity proofs.  This result is also\nessential in showing the sublinearity of loops.\\<close>\n\ntext \\<open>A loop step is monotonic.\\<close>\nlemma wp_loop_step_mono_trans:\n  fixes body::\"'s prog\"\n  assumes sP: \"sound P\"\n      and hb: \"healthy (wp body)\"\n  shows \"mono_trans (\\<lambda>Q s. \\<guillemotleft> G \\<guillemotright> s * wp body Q s + \\<guillemotleft> \\<N> G \\<guillemotright> s * P s)\"\nproof(intro mono_transI le_funI, simp)\n  fix Q R::\"'s expect\" and s::'s\n  assume sQ: \"sound Q\" and sR: \"sound R\" and le: \"Q \\<tturnstile> R\"\n  hence \"wp body Q \\<tturnstile> wp body R\"\n    by(rule mono_transD[OF healthy_monoD, OF hb])\n  thus \"\\<guillemotleft>G\\<guillemotright> s * wp body Q s \\<le> \\<guillemotleft>G\\<guillemotright> s * wp body R s\"\n    by(auto dest:le_funD intro:mult_left_mono)\nqed\n\ntext \\<open>We can therefore apply the standard fixed-point lemmas to unfold it:\\<close>\nlemma lfp_wp_loop_unfold:\n  fixes body::\"'s prog\"\n  assumes hb: \"healthy (wp body)\"\n      and sP: \"sound P\"\n  shows \"lfp_exp (\\<lambda>Q s. \\<guillemotleft>G\\<guillemotright> s * wp body Q s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s) =\n         (\\<lambda>s. \\<guillemotleft>G\\<guillemotright> s * wp body (lfp_exp (\\<lambda>Q s. \\<guillemotleft>G\\<guillemotright> s * wp body Q s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s)) s +\n              \\<guillemotleft>\\<N> G\\<guillemotright> s * P s)\"\nproof(rule lfp_exp_unfold)\n  from assms show \"mono_trans (\\<lambda>Q s. \\<guillemotleft>G\\<guillemotright> s * wp body Q s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s)\"\n    by(blast intro:wp_loop_step_mono_trans)\n  from assms show \"\\<lambda>s. \\<guillemotleft>G\\<guillemotright> s * wp body (\\<lambda>s. bound_of P) s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s \\<tturnstile> \\<lambda>s. bound_of P\"\n    by(blast intro:lfp_loop_fp)\n  from sP show \"sound (\\<lambda>s. bound_of P)\"\n    by(auto)\n  fix Q::\"'s expect\"\n  assume \"sound Q\"\n  with assms show \"sound (\\<lambda>s. \\<guillemotleft>G\\<guillemotright> s * wp body Q s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s)\"\n    by(intro wp_loop_step_sound[unfolded wp_eval, simplified, folded negate_embed], auto)\nqed\n\n\n\n  from uP uwQ have \"wp body Q s \\<le> 1\" \"P s \\<le> 1\" by(auto)\n  hence \"\\<guillemotleft>G\\<guillemotright> s * wp body Q s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s \\<le> \\<guillemotleft>G\\<guillemotright> s * 1 + \\<guillemotleft>\\<N> G\\<guillemotright> s * 1\"\n    by(blast intro:add_mono mult_left_mono)\n  also have \"... = 1\" by(simp add:negate_embed)\n  finally show \"\\<guillemotleft>G\\<guillemotright> s * wp body Q s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s \\<le> 1\" .\nqed\n\nlemma lfp_loop_unitary:\n  fixes body::\"'s prog\"\n  assumes hb: \"healthy (wp body)\"\n      and uP: \"unitary P\"\n  shows \"unitary (lfp_exp (\\<lambda>Q s. \\<guillemotleft>G\\<guillemotright> s * wp body Q s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s))\"\n  using assms by(blast intro:lfp_exp_unitary wp_loop_step_unitary)\n\ntext \\<open>From the lattice structure on transformers, we establish a transfinite induction\n  principle for loops.  We use this to show a number of properties, particularly\n  subdistributivity, for loops.  This proof follows the pattern of lemma lfp\\_ordinal\\_induct\n  in HOL/Inductive.\\<close>\nlemma loop_induct:\n  fixes body::\"'s prog\"\n  assumes hwp:  \"healthy (wp body)\"\n      and hwlp: \"nearly_healthy (wlp body)\"\n      \\<comment> \\<open>The body must be healthy, both in strict and liberal semantics.\\<close>\n      and Limit:   \"\\<And>S. \\<lbrakk> \\<forall>x\\<in>S. P (fst x) (snd x); \\<forall>x\\<in>S. feasible (fst x);\n                          \\<forall>x\\<in>S. \\<forall>Q. unitary Q \\<longrightarrow> unitary (snd x Q) \\<rbrakk> \\<Longrightarrow>\n                    P (Sup_trans (fst ` S)) (Inf_utrans (snd ` S))\"\n      \\<comment> \\<open>The property holds at limit points.\\<close>\n      and IH:   \"\\<And>t u. \\<lbrakk> P t u; feasible t; \\<And>Q. unitary Q \\<Longrightarrow> unitary (u Q)  \\<rbrakk> \\<Longrightarrow>\n                        P (wp  (body ;; Embed t \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip))\n                          (wlp (body ;; Embed u \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip))\"\n      \\<comment> \\<open>The inductive step.  The property is preserved by a single loop iteration.\\<close>\n      and P_equiv: \"\\<And>t t' u u'. \\<lbrakk> P t u; equiv_trans t t'; equiv_utrans u u' \\<rbrakk> \\<Longrightarrow> P t' u'\"\n      \\<comment> \\<open>The property must be preserved by equivalence\\<close>\n  shows \"P (wp (do G \\<longrightarrow> body od)) (wlp (do G \\<longrightarrow> body od))\"\n  \\<comment> \\<open>The property can refer to both interpretations simultaneously.  The unifier will happily\n  apply the rule to just one or the other, however.\\<close>\nproof(simp add:wp_eval)\n  let \"?X t\" = \"wp (body ;; Embed t \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip)\"\n  let \"?Y t\" = \"wlp (body ;; Embed t \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip)\"\n\n  let ?M = \"{x. P (fst x) (snd x) \\<and>\n                feasible (fst x) \\<and>\n                (\\<forall>Q. unitary Q \\<longrightarrow> unitary (snd x Q)) \\<and>\n                le_trans (fst x) (lfp_trans ?X) \\<and>\n                le_utrans (gfp_trans ?Y) (snd x)}\"\n\n  have fSup: \"feasible (Sup_trans (fst ` ?M))\"\n  proof(intro feasibleI bounded_byI2 nnegI2)\n    fix Q::\"'s expect\" and b::real\n    assume nQ: \"nneg Q\" and bQ: \"bounded_by b Q\"\n    show \"Sup_trans (fst ` ?M) Q \\<tturnstile> \\<lambda>s. b\"\n      unfolding Sup_trans_def\n      using nQ bQ by(auto intro!:Sup_exp_least)\n    show \"\\<lambda>s. 0 \\<tturnstile> Sup_trans (fst ` ?M) Q\"\n    proof(cases)\n      assume empty: \"?M = {}\"\n      show ?thesis by(simp add:Sup_trans_def Sup_exp_def empty)\n    next\n      assume ne: \"?M \\<noteq> {}\"\n      then obtain x where xin: \"x \\<in> ?M\" by auto\n      hence ffx: \"feasible (fst x)\" by(simp)\n      with nQ bQ have \"\\<lambda>s. 0 \\<tturnstile> fst x Q\" by(auto)\n      also from xin have \"fst x Q \\<tturnstile> Sup_trans (fst ` ?M) Q\"\n          apply(intro Sup_trans_upper2[OF imageI _ nQ bQ], assumption)\n          apply(clarsimp, blast intro: sound_nneg[OF feasible_sound] feasible_boundedD)\n          done\n      finally show \"\\<lambda>s. 0 \\<tturnstile> Sup_trans (fst ` ?M) Q\" .\n    qed\n  qed\n\n  have uInf: \"\\<And>P. unitary P \\<Longrightarrow> unitary (Inf_utrans (snd ` ?M) P)\"\n  proof(cases \"?M = {}\")\n    fix P\n    assume empty: \"?M = {}\"\n    show \"?thesis P\" by(simp only:empty, simp add:Inf_utrans_def)\n  next\n    fix P::\"'s expect\"\n    assume uP: \"unitary P\"\n       and ne: \"?M \\<noteq> {}\"\n    show \"?thesis P\"\n    proof(intro unitaryI2 nnegI2 bounded_byI2)\n      from ne obtain x where xin: \"x \\<in> ?M\" by auto\n      hence sxin: \"snd x \\<in> snd ` ?M\" by(simp)\n      hence \"le_utrans (Inf_utrans (snd ` ?M)) (snd x)\"\n        by(intro Inf_utrans_lower, auto)\n      with uP\n      have \"Inf_utrans (snd ` ?M) P \\<tturnstile> snd x P\" by(auto)\n      also {\n        from xin uP have \"unitary (snd x P)\" by(simp)\n        hence \"snd x P \\<tturnstile> \\<lambda>s. 1\" by(auto)\n      }\n      finally show \"Inf_utrans (snd ` ?M) P \\<tturnstile> \\<lambda>s. 1\" .\n\n      have \"\\<lambda>s. 0 \\<tturnstile> Inf_trans (snd ` ?M) P\"\n        unfolding Inf_trans_def\n      proof(rule Inf_exp_greatest)\n        from sxin show \"{t P |t. t \\<in> snd ` ?M} \\<noteq> {}\" by(auto)\n        show \"\\<forall>P\\<in>{t P |t. t \\<in> snd ` ?M}. \\<lambda>s. 0 \\<tturnstile> P\"\n        proof(clarsimp)\n          fix t::\"'s trans\"\n          assume \"\\<forall>Q. unitary Q \\<longrightarrow> unitary (t Q)\"\n          with uP have \"unitary (t P)\" by(auto)\n          thus \"\\<lambda>s. 0 \\<tturnstile> t P\" by(auto)\n        qed\n      qed\n      also {\n        from ne have X: \"(snd ` ?M = {}) = False\" by(simp)\n        have \"Inf_trans (snd ` ?M) P = Inf_utrans (snd ` ?M) P\"\n          unfolding Inf_utrans_def by(subst X, simp)\n      }\n      finally show \"\\<lambda>s. 0 \\<tturnstile> Inf_utrans (snd ` ?M) P\" .\n    qed\n  qed\n\n  have wp_loop_mono: \"\\<And>t u. \\<lbrakk> le_trans t u; \\<And>P. sound P \\<Longrightarrow> sound (t P);\n                               \\<And>P. sound P \\<Longrightarrow> sound (u P) \\<rbrakk> \\<Longrightarrow> le_trans (?X t) (?X u)\"\n  proof(intro le_transI le_funI, simp add:wp_eval)\n    fix t u::\"'s trans\" and P::\"'s expect\" and s::'s\n    assume le: \"le_trans t u\"\n       and st: \"\\<And>P. sound P \\<Longrightarrow> sound (t P)\"\n       and su: \"\\<And>P. sound P \\<Longrightarrow> sound (u P)\"\n       and sP: \"sound P\"\n    hence \"sound (t P)\" \"sound (u P)\" by(auto)\n    with healthy_monoD[OF hwp] le sP have \"wp body (t P) \\<tturnstile> wp body (u P)\" by(auto)\n    hence \"wp body (t P) s \\<le> wp body (u P) s\" by(auto)\n    thus \"\\<guillemotleft>G\\<guillemotright> s * wp body (t P) s \\<le> \\<guillemotleft>G\\<guillemotright> s * wp body (u P) s\" by(auto intro:mult_left_mono)\n  qed\n\n  have wlp_loop_mono: \"\\<And>t u. \\<lbrakk> le_utrans t u; \\<And>P. unitary P \\<Longrightarrow> unitary (t P);\n                               \\<And>P. unitary P \\<Longrightarrow> unitary (u P) \\<rbrakk> \\<Longrightarrow> le_utrans (?Y t) (?Y u)\"\n  proof(intro le_utransI le_funI, simp add:wp_eval)\n    fix t u::\"'s trans\" and P::\"'s expect\" and s::'s\n    assume le: \"le_utrans t u\"\n       and ut: \"\\<And>P. unitary P \\<Longrightarrow> unitary (t P)\"\n       and uu: \"\\<And>P. unitary P \\<Longrightarrow> unitary (u P)\"\n       and uP: \"unitary P\"\n    hence \"unitary (t P)\" \"unitary (u P)\" by(auto)\n    with le uP have \"wlp body (t P) \\<tturnstile> wlp body (u P)\"\n      by(auto intro:nearly_healthy_monoD[OF hwlp])\n    hence \"wlp body (t P) s \\<le> wlp body (u P) s\" by(auto)\n    thus \"\\<guillemotleft>G\\<guillemotright> s * wlp body (t P) s \\<le> \\<guillemotleft>G\\<guillemotright> s * wlp body (u P) s\"\n      by(auto intro:mult_left_mono)\n  qed\n\n  from hwp have hX: \"\\<And>t. healthy t \\<Longrightarrow> healthy (?X t)\"\n    by(auto intro:healthy_intros)\n\n  from hwlp have hY: \"\\<And>t. nearly_healthy t \\<Longrightarrow> nearly_healthy (?Y t)\"\n    by(auto intro!:healthy_intros)\n                \n  have PLimit: \"P (Sup_trans (fst ` ?M)) (Inf_utrans (snd ` ?M))\"\n    by(auto intro:Limit)\n\n  have feasible_lfp_loop:\n    \"feasible (lfp_trans ?X)\"\n  proof(intro feasibleI bounded_byI2 nnegI2,\n        simp_all add:wp_Loop1[simplified wp_eval] soundI2 hwp)\n    fix P::\"'s expect\" and b::real\n    assume bP: \"bounded_by b P\" and nP: \"nneg P\"\n    hence sP: \"sound P\" by(auto)\n    show \"lfp_exp (\\<lambda>Q s. \\<guillemotleft> G \\<guillemotright> s * wp body Q s + \\<guillemotleft> \\<N> G \\<guillemotright> s * P s) \\<tturnstile> \\<lambda>s. b\"\n    proof(intro lfp_exp_lowerbound le_funI)\n      fix s::'s\n      from bP nP have nnb: \"0 \\<le> b\" by(auto)\n      hence \"sound (\\<lambda>s. b)\" \"bounded_by b (\\<lambda>s. b)\" by(auto)\n      with hwp have \"bounded_by b (wp body (\\<lambda>s. b))\" by(auto)\n      with bP have \"wp body (\\<lambda>s. b) s \\<le> b\" \"P s \\<le> b\" by(auto)\n      hence \"\\<guillemotleft>G\\<guillemotright> s * wp body (\\<lambda>s. b) s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s \\<le> \\<guillemotleft>G\\<guillemotright> s * b + \\<guillemotleft>\\<N> G\\<guillemotright> s * b\"\n        by(auto intro:add_mono mult_left_mono)\n      thus \"\\<guillemotleft>G\\<guillemotright> s * wp body (\\<lambda>s. b) s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s \\<le> b\"\n        by(simp add:negate_embed algebra_simps)\n      from nnb show \"sound (\\<lambda>s. b)\" by(auto)\n    qed\n    from hwp sP show \"\\<lambda>s. 0 \\<tturnstile> lfp_exp (\\<lambda>Q s. \\<guillemotleft> G \\<guillemotright> s * wp body Q s + \\<guillemotleft> \\<N> G \\<guillemotright> s * P s)\"\n      by(blast intro!:lfp_exp_greatest lfp_loop_fp)\n  qed\n\n  have unitary_gfp:\n    \"\\<And>P. unitary P \\<Longrightarrow> unitary (gfp_trans ?Y P)\"\n  proof(intro unitaryI2 nnegI2 bounded_byI2,\n      simp_all add:wlp_Loop1[simplified wp_eval] hwlp)\n    fix P::\"'s expect\"\n    assume uP: \"unitary P\"\n    show \"\\<lambda>s. 0 \\<tturnstile> gfp_exp (\\<lambda>Q s. \\<guillemotleft> G \\<guillemotright> s * wlp body Q s + \\<guillemotleft> \\<N> G \\<guillemotright> s * P s)\"\n    proof(rule gfp_exp_upperbound[OF le_funI])\n      fix s::\"'s\"\n      from hwlp uP have \"0 \\<le> wlp body (\\<lambda>s. 0) s\" \"0 \\<le> P s\" by(auto dest!:unitary_sound)\n      thus \"0 \\<le> \\<guillemotleft>G\\<guillemotright> s * wlp body (\\<lambda>s. 0) s + \\<guillemotleft>\\<N> G\\<guillemotright> s * P s\"\n        by(auto intro:add_nonneg_nonneg mult_nonneg_nonneg)\n      show \"unitary (\\<lambda>s. 0)\" by(auto)\n    qed\n    show \"gfp_exp (\\<lambda>Q s. \\<guillemotleft> G \\<guillemotright> s * wlp body Q s + \\<guillemotleft> \\<N> G \\<guillemotright> s * P s) \\<tturnstile> \\<lambda>s. 1\"\n      by(auto intro:gfp_exp_least)\n  qed\n\n  have fX:\n    \"\\<And>t. feasible t \\<Longrightarrow> feasible (?X t)\"\n  proof(intro feasibleI nnegI bounded_byI, simp_all add:wp_eval)\n    fix t::\"'s trans\" and Q::\"'s expect\" and b::real and s::'s\n    assume ft: \"feasible t\" and bQ: \"bounded_by b Q\" and nQ: \"nneg Q\"\n    hence \"nneg (t Q)\" \"bounded_by b (t Q)\" by(auto)\n    moreover hence stQ: \"sound (t Q)\" by(auto)\n    ultimately have \"wp body (t Q) s \\<le> b\" using hwp by(auto)\n    moreover from bQ have \"Q s \\<le> b\" by(auto)\n    ultimately have \"\\<guillemotleft>G\\<guillemotright> s * wp body (t Q) s + (1 - \\<guillemotleft>G\\<guillemotright> s) * Q s \\<le>\n                     \\<guillemotleft>G\\<guillemotright> s * b + (1 - \\<guillemotleft> G \\<guillemotright> s) * b\"\n      by(auto intro:add_mono mult_left_mono)\n    thus \"\\<guillemotleft>G\\<guillemotright> s * wp body (t Q) s + (1 - \\<guillemotleft>G\\<guillemotright> s) * Q s \\<le> b\"\n      by(simp add:algebra_simps)\n\n    from nQ stQ hwp have \"0 \\<le> wp body (t Q) s\" \"0 \\<le> Q s\" by(auto)\n    thus \"0 \\<le> \\<guillemotleft>G\\<guillemotright> s * wp body (t Q) s + (1 - \\<guillemotleft>G\\<guillemotright> s) * Q s\"\n      by(auto intro:add_nonneg_nonneg mult_nonneg_nonneg)\n  qed\n\n  have uY:\n    \"\\<And>t P. (\\<And>P. unitary P \\<Longrightarrow> unitary (t P)) \\<Longrightarrow> unitary P \\<Longrightarrow> unitary (?Y t P)\"\n  proof(intro unitaryI2 nnegI bounded_byI, simp_all add:wp_eval)\n    fix t::\"'s trans\" and P::\"'s expect\" and s::'s\n    assume ut: \"\\<And>P. unitary P \\<Longrightarrow> unitary (t P)\"\n       and uP: \"unitary P\"\n    hence utP: \"unitary (t P)\" by(auto)\n    with hwlp have ubtP: \"unitary (wlp body (t P))\" by(auto)\n    with uP have \"0 \\<le> P s\" \"0 \\<le> wlp body (t P) s\" by(auto)\n    thus \"0 \\<le> \\<guillemotleft>G\\<guillemotright> s * wlp body (t P) s + (1-\\<guillemotleft>G\\<guillemotright> s) * P s\"\n      by(auto intro:add_nonneg_nonneg mult_nonneg_nonneg)\n\n    from uP ubtP have \"P s \\<le> 1\" \"wlp body (t P) s \\<le> 1\" by(auto)\n    hence \"\\<guillemotleft>G\\<guillemotright> s * wlp body (t P) s + (1-\\<guillemotleft>G\\<guillemotright> s) * P s \\<le> \\<guillemotleft>G\\<guillemotright> s * 1 + (1-\\<guillemotleft>G\\<guillemotright> s) * 1\"\n      by(blast intro:add_mono mult_left_mono)\n    also have \"... = 1\" by(simp add:algebra_simps)\n    finally show \"\\<guillemotleft>G\\<guillemotright> s * wlp body (t P) s + (1-\\<guillemotleft>G\\<guillemotright> s) * P s \\<le> 1\" .\n  qed\n\n  have fw_lfp: \"le_trans (Sup_trans (fst ` ?M)) (lfp_trans ?X)\"\n    using feasible_nnegD[OF feasible_lfp_loop]\n    by(intro le_transI[OF Sup_trans_least2], blast+)\n  hence \"le_trans (?X (Sup_trans (fst ` ?M))) (?X (lfp_trans ?X))\"\n    by(auto intro:wp_loop_mono feasible_sound[OF fSup]\n                  feasible_sound[OF feasible_lfp_loop])\n  also have \"equiv_trans ... (lfp_trans ?X)\"\n  proof(rule iffD1[OF equiv_trans_comm, OF lfp_trans_unfold], iprover intro:wp_loop_mono)\n    fix t::\"'s trans\" and P::\"'s expect\"\n    assume st: \"\\<And>Q. sound Q \\<Longrightarrow> sound (t Q)\"\n       and sP: \"sound P\"\n    show \"sound (?X t P)\"\n    proof(intro soundI2 bounded_byI nnegI, simp_all add:wp_eval)\n      fix s::'s\n      from sP st hwp have \"0 \\<le> P s\" \"0 \\<le> wp body (t P) s\" by(auto)\n      thus \"0 \\<le> \\<guillemotleft>G\\<guillemotright> s * wp body (t P) s + (1 - \\<guillemotleft>G\\<guillemotright> s) * P s\"\n        by(blast intro:add_nonneg_nonneg mult_nonneg_nonneg)\n      from sP st have \"bounded_by (bound_of (t P)) (t P)\" by(auto)\n      with sP st hwp have \"bounded_by (bound_of (t P)) (wp body (t P))\" by(auto)\n      hence \"wp body (t P) s \\<le> bound_of (t P)\" by(auto)\n      moreover from sP st hwp have \"P s \\<le> bound_of P\" by(auto)\n      moreover have \"\\<guillemotleft>G\\<guillemotright> s \\<le> 1\" \"1 - \\<guillemotleft>G\\<guillemotright> s \\<le> 1\" by(auto)\n      moreover from sP st hwp have \"0 \\<le> wp body (t P) s\" \"0 \\<le> P s\" by(auto)\n      moreover have \"(0::real) \\<le> 1\" by(simp)\n      ultimately show \"\\<guillemotleft>G\\<guillemotright> s * wp body (t P) s + (1 - \\<guillemotleft>G\\<guillemotright> s) * P s \\<le>\n                       1 * bound_of (t P) + 1 * bound_of P\"\n        by(blast intro:add_mono mult_mono)\n      qed\n    next\n    let \"?fp\" = \"\\<lambda>R s. bound_of R\"\n    show \"le_trans (?X ?fp) ?fp\" by(auto intro:healthy_intros hwp)\n    fix P::\"'s expect\" assume \"sound P\"\n    thus \"sound (?fp P)\" by(auto)\n  qed\n  finally have le_lfp: \"le_trans (?X (Sup_trans (fst ` ?M))) (lfp_trans ?X)\" .\n\n  have fw_gfp: \"le_utrans (gfp_trans ?Y) (Inf_utrans (snd ` ?M))\"\n    by(auto intro:Inf_utrans_greatest unitary_gfp)\n\n  have \"equiv_utrans (gfp_trans ?Y) (?Y (gfp_trans ?Y))\"\n    by(auto intro!:gfp_trans_unfold wlp_loop_mono uY)\n  also from fw_gfp have \"le_utrans (?Y (gfp_trans ?Y)) (?Y (Inf_utrans (snd ` ?M)))\"\n    by(auto intro:wlp_loop_mono uInf unitary_gfp)\n  finally have ge_gfp: \"le_utrans (gfp_trans ?Y) (?Y (Inf_utrans (snd ` ?M)))\" .\n  from PLimit fX uY fSup uInf have \"P (?X (Sup_trans (fst ` ?M))) (?Y (Inf_utrans (snd ` ?M)))\"\n    by(iprover intro:IH)\n  moreover from fSup have \"feasible (?X (Sup_trans (fst ` ?M)))\" by(rule fX)\n  moreover have \"\\<And>P. unitary P \\<Longrightarrow> unitary (?Y (Inf_utrans (snd ` ?M)) P)\"\n    by(auto intro:uY uInf)\n  moreover note le_lfp ge_gfp\n  ultimately have pair_in: \"(?X (Sup_trans (fst ` ?M)), ?Y (Inf_utrans (snd ` ?M))) \\<in> ?M\"\n    by(simp)\n\n  have \"?X (Sup_trans (fst ` ?M)) \\<in> fst ` ?M\"\n    by(rule imageI[OF pair_in, of fst, simplified])\n  hence \"le_trans (?X (Sup_trans (fst ` ?M))) (Sup_trans (fst ` ?M))\"\n  proof(rule le_transI[OF Sup_trans_upper2[where t=\"?X (Sup_trans (fst ` ?M))\"\n                                             and S=\"fst ` ?M\"]])\n    fix P::\"'s expect\"\n    assume sP: \"sound P\"\n    thus \"nneg P\" by(auto)\n    from sP show \"bounded_by (bound_of P) P\" by(auto)\n    from sP show \"\\<forall>u\\<in>fst ` ?M. \\<forall>Q. nneg Q \\<and> bounded_by (bound_of P) Q \\<longrightarrow>\n                                   nneg (u Q) \\<and> bounded_by (bound_of P) (u Q)\"\n      by(auto)\n  qed\n  hence \"le_trans (lfp_trans ?X) (Sup_trans (fst ` ?M))\"\n    by(auto intro:lfp_trans_lowerbound feasible_sound[OF fSup])\n  with fw_lfp have eqt: \"equiv_trans (Sup_trans (fst ` ?M)) (lfp_trans ?X)\"\n    by(rule le_trans_antisym)\n\n  have \"?Y (Inf_utrans (snd ` ?M)) \\<in> snd ` ?M\"\n    by(rule imageI[OF pair_in, of snd, simplified])\n  hence \"le_utrans (Inf_utrans (snd ` ?M)) (?Y (Inf_utrans (snd ` ?M)))\"\n    by(intro Inf_utrans_lower, auto)\n  hence \"le_utrans (Inf_utrans (snd ` ?M)) (gfp_trans ?Y)\"\n    by(blast intro:gfp_trans_upperbound uInf)\n  with fw_gfp have equ: \"equiv_utrans (Inf_utrans (snd ` ?M)) (gfp_trans ?Y)\"\n    by(auto intro:le_utrans_antisym)\n  from PLimit eqt equ show \"P (lfp_trans ?X) (gfp_trans ?Y)\" by(rule P_equiv)\nqed\n\nsubsection \\<open>The Limit of Iterates\\<close>\n\ntext \\<open>The iterates of a loop are its sequence of finite unrollings.  We show shortly that this\nconverges on the least fixed point.  This is enormously useful, as we can appeal to various\nproperties of the finite iterates (which will follow by finite induction), which we can then\ntransfer to the limit.\\<close>\ndefinition iterates :: \"'s prog \\<Rightarrow> ('s \\<Rightarrow> bool) \\<Rightarrow> nat \\<Rightarrow> 's trans\"\nwhere \"iterates body G i = ((\\<lambda>x. wp (body ;; Embed x \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip)) ^^ i) (\\<lambda>P s. 0)\"\n\nlemma iterates_0[simp]:\n  \"iterates body G 0 = (\\<lambda>P s. 0)\"\n  by(simp add:iterates_def)\n\nlemma iterates_Suc[simp]:\n  \"iterates body G (Suc i) = wp (body ;; Embed (iterates body G i) \\<^bsub>\\<guillemotleft>G\\<guillemotright>\\<^esub>\\<oplus> Skip)\"\n  by(simp add:iterates_def)\n\ntext \\<open>All iterates are healthy.\\<close>\nlemma iterates_healthy:\n  \"healthy (wp body) \\<Longrightarrow> healthy (iterates body G i)\"\n  by(induct i, auto intro:healthy_intros)\n\ntext \\<open>The iterates are an ascending chain.\\<close>\nlemma iterates_increasing:\n  fixes body::\"'s prog\"\n  assumes hb: \"healthy (wp body)\"\n  shows \"le_trans (iterates body G i) (iterates body G (Suc i))\"\nproof(induct i)\n  show \"le_trans (iterates body G 0) (iterates body G (Suc 0))\"\n  proof(simp add:iterates_def, rule le_transI)\n    fix P::\"'s expect\"\n    assume \"sound P\"\n    with hb have \"sound (wp (body ;; Embed (\\<lambda>P s. 0) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) P)\"\n      by(auto intro!:wp_loop_step_sound)\n    thus \"\\<lambda>s. 0 \\<tturnstile> wp (body ;; Embed (\\<lambda>P s. 0) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) P\"\n      by(auto)\n  qed\n\n  fix i\n  assume IH: \"le_trans (iterates body G i) (iterates body G (Suc i))\"\n  have \"equiv_trans (iterates body G (Suc i))\n                    (wp (body ;; Embed (iterates body G i) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip))\"\n    by(simp)\n  also from iterates_healthy[OF hb]\n  have \"le_trans ... (wp (body ;; Embed (iterates body G (Suc i)) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip))\"\n    by(blast intro:wp_loop_step_mono[OF hb IH])\n  also have \"equiv_trans ... (iterates body G (Suc (Suc i)))\"\n    by(simp)\n  finally show \"le_trans (iterates body G (Suc i)) (iterates body G (Suc (Suc i)))\" .\nqed\n\nlemma wp_loop_step_bounded:\n  fixes t::\"'s trans\" and Q::\"'s expect\"\n  assumes nQ: \"nneg Q\"\n      and bQ: \"bounded_by b Q\"\n      and ht: \"healthy t\"\n      and hb: \"healthy (wp body)\"\n  shows \"bounded_by b (wp (body ;; Embed t \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) Q)\"\nproof(rule bounded_byI, simp add:wp_eval)\n  fix s::'s\n  from nQ bQ have sQ: \"sound Q\" by(auto)\n  with bQ ht have \"sound (t Q)\" \"bounded_by b (t Q)\" by(auto)\n  with hb have \"bounded_by b (wp body (t Q))\" by(auto)\n  with bQ have \"wp body (t Q) s \\<le> b\" \"Q s \\<le> b\" by(auto)\n  hence \"\\<guillemotleft>G\\<guillemotright> s * wp body (t Q) s + (1-\\<guillemotleft>G\\<guillemotright> s) * Q s \\<le>\n         \\<guillemotleft>G\\<guillemotright> s * b + (1-\\<guillemotleft>G\\<guillemotright> s) * b\"\n    by(auto intro:add_mono mult_left_mono)\n  also have \"... = b\" by(simp add:algebra_simps)\n  finally show \"\\<guillemotleft>G\\<guillemotright> s * wp body (t Q) s + (1-\\<guillemotleft>G\\<guillemotright> s) * Q s \\<le> b\" .\nqed\n\ntext \\<open>This is the key result: The loop is equivalent to the supremum of its iterates.  This\nproof follows the pattern of lemma continuous\\_lfp in HOL/Library/Continuity.\\<close>\nlemma lfp_iterates:\n  fixes body::\"'s prog\"\n  assumes hb: \"healthy (wp body)\"\n      and cb: \"bd_cts (wp body)\"\n  shows \"equiv_trans (wp (do G \\<longrightarrow> body od)) (Sup_trans (range (iterates body G)))\"\n        (is \"equiv_trans ?X ?Y\")\nproof(rule le_trans_antisym)\n  let ?F = \"\\<lambda>x. wp (body ;; Embed x \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip)\"\n  let ?bot = \"\\<lambda>(P::'s \\<Rightarrow> real) s::'s. 0::real\"\n\n  have HF: \"\\<And>i. healthy ((?F ^^ i) ?bot)\"\n  proof -\n    fix i from hb show \"(?thesis i)\"\n      by(induct i, simp_all add:healthy_intros)\n  qed\n\n  from iterates_healthy[OF hb]\n  have \"\\<And>i. feasible (iterates body G i)\" by(auto)\n  hence fSup: \"feasible (Sup_trans (range (iterates body G)))\"\n    by(auto intro:feasible_Sup_trans)\n\n  {\n    fix i\n    have \"le_trans ((?F ^^ i) ?bot) ?X\"\n    proof(induct i)\n      show \"le_trans ((?F ^^ 0) ?bot) ?X\"\n      proof(simp, intro le_transI)\n        fix P::\"'s expect\"\n        assume \"sound P\"\n        with hb healthy_wp_loop\n        have \"sound (wp (\\<mu> x. body ;; x \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) P)\"\n          by(auto)\n        thus \"\\<lambda>s. 0 \\<tturnstile> wp (\\<mu> x. body ;; x \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) P\"\n          by(auto)\n      qed\n      fix i\n      assume IH: \"le_trans ((?F ^^ i) ?bot) ?X\"\n      have \"equiv_trans ((?F ^^ (Suc i)) ?bot) (?F ((?F ^^ i) ?bot))\" by(simp)\n      also have \"le_trans ... (?F ?X)\"\n      proof(rule wp_loop_step_mono[OF hb IH])\n        fix P::\"'s expect\"\n        assume sP: \"sound P\"\n        with hb healthy_wp_loop\n        show \"sound (wp (\\<mu> x. body ;; x \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) P)\"\n          by(auto)\n        from sP show \"sound ((?F ^^ i) ?bot P)\"\n          by(rule healthy_sound[OF HF])\n      qed\n      also {\n        from hb have X: \"le_trans (wp (body ;; Embed (\\<lambda>P s. bound_of P) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip))\n                                 (\\<lambda>P s. bound_of P)\"\n          by(intro le_transI, simp add:wp_eval, auto intro: lfp_loop_fp[unfolded negate_embed])\n        have \"equiv_trans (?F ?X) ?X\"\n        apply (simp only: wp_eval)\n        by(intro iffD1[OF equiv_trans_comm, OF lfp_trans_unfold]\n                 wp_loop_step_mono[OF hb] wp_loop_step_sound[OF hb], (blast|rule X)+)\n      }\n      finally show \"le_trans ((?F ^^ (Suc i)) ?bot) ?X\" .\n    qed\n  }\n  hence \"\\<And>i. le_trans (iterates body G i) (wp do G \\<longrightarrow> body od)\"\n    by(simp add:iterates_def)\n  thus \"le_trans ?Y ?X\"\n    by(auto intro!:le_transI[OF Sup_trans_least2] sound_nneg\n                   healthy_sound[OF iterates_healthy, OF hb]\n                   healthy_bounded_byD[OF iterates_healthy, OF hb]\n                   healthy_sound[OF healthy_wp_loop] hb)\n\n  show \"le_trans ?X ?Y\"\n  proof(simp only: wp_eval, rule lfp_trans_lowerbound)\n    from hb cb have \"bd_cts_tr ?F\" by(rule cts_wp_loopstep)\n    with iterates_increasing[OF hb] iterates_healthy[OF hb]\n    have \"equiv_trans (?F ?Y) (Sup_trans (range (?F o (iterates body G))))\"\n      by (auto intro!: healthy_feasibleD bd_cts_trD cong del: image_cong_simp)\n    also have \"le_trans (Sup_trans (range (?F o (iterates body G)))) ?Y\"\n    proof(rule le_transI)\n      fix P::\"'s expect\"\n      assume sP: \"sound P\"\n      show \"(Sup_trans (range (?F o (iterates body G)))) P \\<tturnstile> ?Y P\"\n      proof(rule Sup_trans_least2, clarsimp)\n        show \"\\<forall>u\\<in>range ((\\<lambda>x. wp (body ;; Embed x \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip)) \\<circ> iterates body G).\n              \\<forall>R. nneg R \\<and> bounded_by (bound_of P) R \\<longrightarrow>\n                  nneg (u R) \\<and> bounded_by (bound_of P) (u R)\"\n        proof(clarsimp, intro conjI)\n          fix Q::\"'s expect\" and i\n          assume nQ: \"nneg Q\" and bQ: \"bounded_by (bound_of P) Q\"\n          hence \"sound Q\" by(auto)\n          moreover from iterates_healthy[OF hb]\n          have \"\\<And>P. sound P \\<Longrightarrow> sound (iterates body G i P)\" by(auto)\n          moreover note hb\n          ultimately have \"sound (wp (body ;; Embed (iterates body G i) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) Q)\"\n            by(iprover intro:wp_loop_step_sound)\n          thus \"nneg (wp (body ;; Embed (iterates body G i) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) Q)\"\n            by(auto)\n          from nQ bQ iterates_healthy[OF hb] hb\n          show \"bounded_by (bound_of P) (wp (body ;; Embed (iterates body G i) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) Q)\"\n            by(rule wp_loop_step_bounded)\n        qed\n        from sP show \"nneg P\" \"bounded_by (bound_of P) P\" by(auto)\n      next\n        fix Q::\"'s expect\"\n        assume nQ: \"nneg Q\" and bQ: \"bounded_by (bound_of P) Q\"\n        hence \"sound Q\" by(auto)\n        with fSup have \"sound (Sup_trans (range (iterates body G)) Q)\" by(auto)\n        thus \"nneg (Sup_trans (range (iterates body G)) Q)\" by(auto)\n\n        fix i\n        show \"wp (body ;; Embed (iterates body G i) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) Q \\<tturnstile>\n              Sup_trans (range (iterates body G)) Q\"\n        proof(rule Sup_trans_upper2[OF _ _ nQ bQ])\n          from iterates_healthy[OF hb]\n          show \"\\<forall>u\\<in>range (iterates body G).\n                \\<forall>R. nneg R \\<and> bounded_by (bound_of P) R \\<longrightarrow>\n                     nneg (u R) \\<and> bounded_by (bound_of P) (u R)\"\n            by(auto)\n          have \"wp (body ;; Embed (iterates body G i) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) = iterates body G (Suc i)\"\n            by(simp)\n          also have \"... \\<in> range (iterates body G)\"\n            by(blast)\n          finally show \"wp (body ;; Embed (iterates body G i) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip) \\<in>\n                        range (iterates body G)\" .\n        qed\n      qed\n    qed\n    finally show \"le_trans (?F ?Y) ?Y\" .\n\n    fix P::\"'s expect\"\n    assume \"sound P\"\n    with fSup show \"sound (?Y P)\" by(auto)\n  qed\nqed\n\ntext \\<open>Therefore, evaluated at a given point (state), the sequence of iterates gives a sequence\nof real values that converges on that of the loop itself.\\<close>\ncorollary loop_iterates:\n  fixes body::\"'s prog\"\n  assumes hb: \"healthy (wp body)\"\n      and cb: \"bd_cts (wp body)\"\n      and sP: \"sound P\"\n  shows \"(\\<lambda>i. iterates body G i P s) \\<longlonglongrightarrow> wp (do G \\<longrightarrow> body od) P s\"\nproof -\n  let ?X = \"{f s |f. f \\<in> {t P |t. t \\<in> range (iterates body G)}}\"\n  have closure_Sup: \"Sup ?X \\<in> closure ?X\"\n  proof(rule closure_contains_Sup, simp, clarsimp)\n    fix i\n    from sP have \"bounded_by (bound_of P) P\" by(auto)\n    with iterates_healthy[OF hb] sP have \"\\<And>j. bounded_by (bound_of P) (iterates body G j P)\"\n      by(auto)\n    thus \"iterates body G i P s \\<le> bound_of P\" by(auto)    \n  qed\n\n  have \"(\\<lambda>i. iterates body G i P s) \\<longlonglongrightarrow> Sup {f s |f. f \\<in> {t P |t. t \\<in> range (iterates body G)}}\"\n  proof(rule LIMSEQ_I)\n    fix r::real assume posr: \"0 < r\"\n    with closure_Sup obtain y where yin: \"y \\<in> ?X\" and ey: \"dist y (Sup ?X) < r\"\n      by(simp only:closure_approachable, blast)\n    from yin obtain i where yit: \"y = iterates body G i P s\" by(auto)\n    {\n      fix j\n      have \"i \\<le> j \\<longrightarrow> le_trans (iterates body G i) (iterates body G j)\"\n      proof(induct j, simp, clarify)\n        fix k\n        assume IH: \"i \\<le> k \\<longrightarrow> le_trans (iterates body G i) (iterates body G k)\"\n           and le: \"i \\<le> Suc k\"\n        show \"le_trans (iterates body G i) (iterates body G (Suc k))\"\n        proof(cases \"i = Suc k\", simp)\n          assume \"i \\<noteq> Suc k\"\n          with le have \"i \\<le> k\" by(auto)\n          with IH have \"le_trans (iterates body G i) (iterates body G k)\" by(auto)\n          also note iterates_increasing[OF hb]\n          finally show \"le_trans (iterates body G i) (iterates body G (Suc k))\" .\n        qed\n      qed\n    }\n    with sP have \"\\<forall>j\\<ge>i. iterates body G i P s \\<le> iterates body G j P s\"\n      by(auto)\n    moreover {\n      from sP have \"bounded_by (bound_of P) P\" by(auto)\n      with iterates_healthy[OF hb] sP have \"\\<And>j. bounded_by (bound_of P) (iterates body G j P)\"\n        by(auto)\n      hence \"\\<And>j. iterates body G j P s \\<le> bound_of P\" by(auto)\n      hence \"\\<And>j. iterates body G j P s \\<le> Sup ?X\"\n        by(intro cSup_upper bdd_aboveI, auto)\n    }\n    ultimately have \"\\<And>j. i \\<le> j \\<Longrightarrow>\n                           norm (iterates body G j P s - Sup ?X) \\<le>\n                           norm (iterates body G i P s - Sup ?X)\"\n      by(auto)\n    also from ey yit have \"norm (iterates body G i P s - Sup ?X) < r\"\n      by(simp add:dist_real_def)\n    finally show \"\\<exists>no. \\<forall>n\\<ge>no. norm (iterates body G n P s -\n                                    Sup {f s |f. f \\<in> {t P |t. t \\<in> range (iterates body G)}}) < r\"\n      by(auto)\n  qed\n  moreover\n  from hb cb sP have \"wp do G \\<longrightarrow> body od P s = Sup_trans (range (iterates body G)) P s\"\n    by(simp add:equiv_transD[OF lfp_iterates])\n  moreover have \"... = Sup {f s |f. f \\<in> {t P |t. t \\<in> range (iterates body G)}}\"\n    by(simp add:Sup_trans_def Sup_exp_def)\n  ultimately show ?thesis by(simp)\nqed\n\ntext \\<open>The iterates themselves are all continuous.\\<close>\nlemma cts_iterates:\n  fixes body::\"'s prog\"\n  assumes hb: \"healthy (wp body)\"\n      and cb: \"bd_cts (wp body)\"\n  shows \"bd_cts (iterates body G i)\"\nproof(induct i, simp_all)\n  have \"range (\\<lambda>(n::nat) (s::'s). 0::real) = {\\<lambda>s. 0::real}\"\n    by(auto)\n  thus \"bd_cts (\\<lambda>P (s::'s). 0)\"\n    by(intro bd_ctsI, simp add:o_def Sup_exp_def)\nnext\n  fix i\n  assume IH: \"bd_cts (iterates body G i)\"\n  thus \"bd_cts (wp (body ;; Embed (iterates body G i) \\<^bsub>\\<guillemotleft> G \\<guillemotright>\\<^esub>\\<oplus> Skip))\"\n    by(blast intro:cts_wp_PC cts_wp_Seq cts_wp_Embed cts_wp_Skip\n                   healthy_intros iterates_healthy cb hb)\nqed\n\ntext \\<open>Therefore so is the loop itself.\\<close>\nlemma cts_wp_loop:\n  fixes body::\"'s prog\"\n  assumes hb: \"healthy (wp body)\"\n      and cb: \"bd_cts (wp body)\"\n  shows \"bd_cts (wp do G \\<longrightarrow> body od)\"\nproof(rule bd_ctsI)\n  fix M::\"nat \\<Rightarrow> 's expect\" and b::real\n  assume chain: \"\\<And>i. M i \\<tturnstile> M (Suc i)\"\n     and sM: \"\\<And>i. sound (M i)\"\n     and bM: \"\\<And>i. bounded_by b (M i)\"\n\n  from sM bM iterates_healthy[OF hb]\n  have \"\\<And>j i. bounded_by b (iterates body G i (M j))\" by(blast)\n  hence iB: \"\\<And>j i s. iterates body G i (M j) s \\<le> b\" by(auto)\n\n  from sM bM have sSup: \"sound (Sup_exp (range M))\"\n    by(auto intro:Sup_exp_sound)\n  with lfp_iterates[OF hb cb]\n  have \"wp do G \\<longrightarrow> body od (Sup_exp (range M)) =\n        Sup_trans (range (iterates body G)) (Sup_exp (range M))\"\n    by(simp add:equiv_transD)\n  also {\n    from chain sM bM\n    have \"\\<And>i. iterates body G i (Sup_exp (range M)) = Sup_exp (range (iterates body G i o M))\"\n      by(blast intro:bd_ctsD cts_iterates[OF hb cb])\n    hence \"{t (Sup_exp (range M)) |t. t \\<in> range (iterates body G)} =\n           {Sup_exp (range (t o M)) |t. t \\<in> range (iterates body G)}\"\n      by(auto intro:sym)\n    hence \"Sup_trans (range (iterates body G)) (Sup_exp (range M)) =\n           Sup_exp {Sup_exp (range (t \\<circ> M)) |t. t \\<in> range (iterates body G)}\"\n      by(simp add:Sup_trans_def)\n  }\n  also {\n    have \"\\<And>s. {f s |f. \\<exists>t. f = (\\<lambda>s. Sup {f s |f. f \\<in> range (t \\<circ> M)}) \\<and>\n                           t \\<in> range (iterates body G)} =\n          range (\\<lambda>i. Sup (range (\\<lambda>j. iterates body G i (M j) s)))\"\n      (is \"\\<And>s. ?X s = ?Y s\")\n    proof(intro antisym subsetI)\n      fix s x\n      assume \"x \\<in> ?X s\"\n      then obtain t where rwx: \"x = Sup {f s |f. f \\<in> range (t \\<circ> M)}\"\n                      and \"t \\<in> range (iterates body G)\" by(auto)\n      then obtain i where \"t = iterates body G i\" by(auto)\n      with rwx have \"x = Sup {f s |f. f \\<in> range (\\<lambda>j. iterates body G i (M j))}\"\n        by(simp add:o_def)\n      moreover have \"{f s |f. f \\<in> range (\\<lambda>j. iterates body G i (M j))} =\n                     range (\\<lambda>j. iterates body G i (M j) s)\" by(auto)\n      ultimately have \"x = Sup (range (\\<lambda>j. iterates body G i (M j) s))\"\n        by(simp)\n      thus \"x \\<in> range (\\<lambda>i. Sup (range (\\<lambda>j. iterates body G i (M j) s)))\"\n        by(auto)\n    next\n      fix s x\n      assume \"x \\<in> ?Y s\"\n      then obtain i where A: \"x = Sup (range (\\<lambda>j. iterates body G i (M j) s))\"\n        by(auto)\n\n      have \"\\<And>s. {f s |f. f \\<in> range (\\<lambda>j. iterates body G i (M j))} =\n            range (\\<lambda>j. iterates body G i (M j) s)\" by(auto)\n      hence B: \"(\\<lambda>s. Sup (range (\\<lambda>j. iterates body G i (M j) s))) =\n             (\\<lambda>s. Sup {f s |f. f \\<in> range (iterates body G i o M)})\"\n        by(simp add:o_def)\n\n      have C: \"iterates body G i \\<in> range (iterates body G)\" by(auto)\n\n      have \"\\<exists>f. x = f s \\<and>\n                (\\<exists>t. f = (\\<lambda>s. Sup {f s |f. f \\<in> range (t \\<circ> M)}) \\<and>\n                     t \\<in> range (iterates body G))\"\n        by(iprover intro:A B C)\n      thus \"x \\<in> ?X s\" by(simp)\n    qed\n    hence \"Sup_exp {Sup_exp (range (t \\<circ> M)) |t. t \\<in> range (iterates body G)} = \n           (\\<lambda>s. Sup (range (\\<lambda>i. Sup (range (\\<lambda>j. iterates body G i (M j) s)))))\"\n      by(simp add:Sup_exp_def)\n  }\n  also have \"(\\<lambda>s. Sup (range (\\<lambda>i. Sup (range (\\<lambda>j. iterates body G i (M j) s))))) =\n             (\\<lambda>s. Sup (range (\\<lambda>(i,j). iterates body G i (M j) s)))\"\n    (is \"?X = ?Y\")\n  proof(rule ext, rule antisym)\n    fix s::'s\n    show \"?Y s \\<le> ?X s\"\n    proof(rule cSup_least, blast, clarify)\n      fix i j::nat\n      from iB have \"iterates body G i (M j) s \\<le> Sup (range (\\<lambda>j. iterates body G i (M j) s))\"\n        by(intro cSup_upper bdd_aboveI, auto)\n      also from iB have \"... \\<le> Sup (range (\\<lambda>i. Sup (range (\\<lambda>j. iterates body G i (M j) s))))\"\n        by(intro cSup_upper cSup_least bdd_aboveI, (blast intro:cSup_least)+)\n      finally show \"iterates body G i (M j) s \\<le>\n                    Sup (range (\\<lambda>i. Sup (range (\\<lambda>j. iterates body G i (M j) s))))\" .\n    qed\n    have \"\\<And>i j. iterates body G i (M j) s \\<le>\n                Sup (range (\\<lambda>(i, j). iterates body G i (M j) s))\"\n      by(rule cSup_upper, auto intro:iB)\n    thus \"?X s \\<le> ?Y s\"\n      by(intro cSup_least, blast, clarify, simp, blast intro:cSup_least)\n  qed\n  also have \"... = (\\<lambda>s. Sup (range (\\<lambda>j .Sup (range (\\<lambda>i. iterates body G i (M j) s)))))\"\n    (is \"?X = ?Y\")\n  proof(rule ext, rule antisym)\n    fix s::'s\n    have \"\\<And>i j. iterates body G i (M j) s \\<le>\n                Sup (range (\\<lambda>(i, j). iterates body G i (M j) s))\"\n      by(rule cSup_upper, auto intro:iB)\n    thus \"?Y s \\<le> ?X s\"\n      by(intro cSup_least, blast, clarify, simp, blast intro:cSup_least)\n    show \"?X s \\<le> ?Y s\"\n    proof(rule cSup_least, blast, clarify)\n      fix i j::nat\n      from iB have \"iterates body G i (M j) s \\<le> Sup (range (\\<lambda>i. iterates body G i (M j) s))\"\n        by(intro cSup_upper bdd_aboveI, auto)\n      also from iB have \"... \\<le> Sup (range (\\<lambda>j. Sup (range (\\<lambda>i. iterates body G i (M j) s))))\"\n        by(intro cSup_upper cSup_least bdd_aboveI, blast, blast intro:cSup_least)\n      finally show \"iterates body G i (M j) s \\<le>\n                    Sup (range (\\<lambda>j. Sup (range (\\<lambda>i. iterates body G i (M j) s))))\" .\n    qed\n  qed\n  also {\n    have \"\\<And>s. range (\\<lambda>j. Sup (range (\\<lambda>i. iterates body G i (M j) s))) =\n               {f s |f. f \\<in> range ((\\<lambda>P s. Sup {f s |f. \\<exists>t. f = t P \\<and>\n               t \\<in> range (iterates body G)}) \\<circ> M)}\" (is \"\\<And>s. ?X s = ?Y s\")\n    proof(intro antisym subsetI)\n      fix s x\n      assume \"x \\<in> ?X s\"\n      then obtain j where rwx: \"x = Sup (range (\\<lambda>i. iterates body G i (M j) s))\" by(auto)\n      moreover {\n        have \"\\<And>s. range (\\<lambda>i. iterates body G i (M j) s) =\n                   {f s |f. \\<exists>t. f = t (M j) \\<and> t \\<in> range (iterates body G)}\"\n          by(auto)\n        hence \"(\\<lambda>s. Sup (range (\\<lambda>i. iterates body G i (M j) s))) \\<in>\n              range ((\\<lambda>P s. Sup {f s |f.\n                           \\<exists>t. f = t P \\<and> t \\<in> range (iterates body G)}) \\<circ> M)\"\n          by (simp add: o_def cong del: SUP_cong_simp)\n      }\n      ultimately show \"x \\<in> ?Y s\" by(auto)\n    next\n      fix s x\n      assume \"x \\<in> ?Y s\"\n      then obtain P where rwx: \"x = P s\"\n                      and Pin: \"P \\<in> range ((\\<lambda>P s. Sup {f s |f.\n                            \\<exists>t. f = t P \\<and> t \\<in> range (iterates body G)}) \\<circ> M)\"\n        by(auto)\n      then obtain j where \"P = (\\<lambda>s. Sup {f s |f. \\<exists>t. f = t (M j) \\<and>\n                                                 t \\<in> range (iterates body G)})\"\n        by(auto)\n      also {\n        have \"\\<And>s. {f s |f. \\<exists>t. f = t (M j) \\<and> t \\<in> range (iterates body G)} =\n                  range (\\<lambda>i. iterates body G i (M j) s)\" by(auto)\n        hence \"(\\<lambda>s. Sup {f s |f. \\<exists>t. f = t (M j) \\<and> t \\<in> range (iterates body G)}) =\n               (\\<lambda>s. Sup (range (\\<lambda>i. iterates body G i (M j) s)))\"\n          by(simp)\n      }\n      finally have \"x = Sup (range (\\<lambda>i. iterates body G i (M j) s))\"\n        by(simp add:rwx)\n      thus \"x \\<in> ?X s\" by(simp)\n    qed\n    hence \"(\\<lambda>s. Sup (range (\\<lambda>j .Sup (range (\\<lambda>i. iterates body G i (M j) s))))) =\n          Sup_exp (range (Sup_trans (range (iterates body G)) o M))\"\n      by (simp add: Sup_exp_def Sup_trans_def cong del: SUP_cong_simp)\n  }\n  also have \"Sup_exp (range (Sup_trans (range (iterates body G)) o M)) =\n             Sup_exp (range (wp do G \\<longrightarrow> body od o M))\"\n    by(simp add:o_def equiv_transD[OF lfp_iterates, OF hb cb, OF sM])\n  finally show \"wp do G \\<longrightarrow> body od (Sup_exp (range M)) =\n                Sup_exp (range (wp do G \\<longrightarrow> body od o M))\" .\nqed\n\nlemmas cts_intros =\n  cts_wp_Abort  cts_wp_Skip\n  cts_wp_Seq    cts_wp_PC\n  cts_wp_DC     cts_wp_Embed\n  cts_wp_Apply  cts_wp_SetDC\n  cts_wp_SetPC  cts_wp_Bind\n  cts_wp_repeat\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/pGCL/LoopInduction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277512, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3243459969850502}}
{"text": "(*  Title:      Code_Target_Bits_Int.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nchapter {* Implementation of bit operations on int by target language operations *}\n\ntheory Code_Target_Bits_Int\nimports\n  Bits_Integer\n  \"HOL-Library.Code_Target_Int\"\nbegin\n\ndeclare [[code drop:\n  \"bitAND :: int \\<Rightarrow> _\" \"bitOR :: int \\<Rightarrow> _\" \"bitXOR :: int \\<Rightarrow> _\" \"bitNOT :: int \\<Rightarrow> _\"\n  \"lsb :: int \\<Rightarrow> _\" \"set_bit :: int \\<Rightarrow> _\" \"test_bit :: int \\<Rightarrow> _\"\n  \"shiftl :: int \\<Rightarrow> _\" \"shiftr :: int \\<Rightarrow> _\"\n  bin_last bin_rest bin_nth Bit\n  int_of_integer_symbolic\n  ]]\n\ncontext\nincludes integer.lifting\nbegin\n\nlemma bitAND_int_code [code]:\n  \"int_of_integer i AND int_of_integer j = int_of_integer (i AND j)\"\nby transfer simp\n\nlemma bitOR_int_code [code]:\n  \"int_of_integer i OR int_of_integer j = int_of_integer (i OR j)\"\nby transfer simp\n\nlemma bitXOR_int_code [code]:\n  \"int_of_integer i XOR int_of_integer j = int_of_integer (i XOR j)\"\nby transfer simp\n\nlemma bitNOT_int_code [code]:\n  \"NOT (int_of_integer i) = int_of_integer (NOT i)\"\nby transfer simp\n\ndeclare bin_last_conv_AND [code]\n\nlemma bin_rest_code [code]:\n   \"bin_rest (int_of_integer i) = int_of_integer (bin_rest_integer i)\"\nby transfer simp\n\ndeclare bitval_bin_last [code_unfold]\n\ndeclare bin_nth_conv_AND [code]\n\nlemma Bit_code [code]: \"int_of_integer i BIT b = int_of_integer (Bit_integer i b)\"\nby transfer simp\n\nlemma test_bit_int_code [code]: \"int_of_integer x !! n = x !! n\"\nby transfer simp\n\nlemma lsb_int_code [code]: \"lsb (int_of_integer x) = lsb x\"\nby transfer simp\n\nlemma set_bit_int_code [code]: \"set_bit (int_of_integer x) n b = int_of_integer (set_bit x n b)\"\nby transfer simp\n\nlemma shiftl_int_code [code]: \"int_of_integer x << n = int_of_integer (x << n)\"\nby transfer simp\n\nlemma shiftr_int_code [code]: \"int_of_integer x >> n = int_of_integer (x >> n)\"\nby transfer simp\n\nlemma int_of_integer_symbolic_code [code]:\n  \"int_of_integer_symbolic = int_of_integer\"\nby(simp add: int_of_integer_symbolic_def)\n\nend\n\ncode_identifier code_module Code_Target_Bits_Int \\<rightharpoonup>\n  (SML) Bit_Int and (OCaml) Bit_Int and (Haskell) Bit_Int and (Scala) Bit_Int\n\nend\n", "meta": {"author": "PLSysSec", "repo": "ct-wasm-proofs", "sha": "3fa5c38ecda3d05c351096ba5e6d7ba1df793c21", "save_path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs", "path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs/ct-wasm-proofs-3fa5c38ecda3d05c351096ba5e6d7ba1df793c21/CT-WASM_model/AFP/Native_Word/Code_Target_Bits_Int.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3243459895437257}}
{"text": "(*  Title:      Uint16.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nchapter {* Unsigned words of 16 bits *}\n\ntheory Uint16 imports\n  Word_Misc\n  Bits_Integer\nbegin\n\ntext {*\n  Restriction for ML code generation:\n  This theory assumes that the ML system provides a Word16\n  implementation (mlton does, but PolyML 5.5 does not).\n  Therefore, the code setup lives in the target @{text SML_word}\n  rather than @{text SML}.  This ensures that code generation still\n  works as long as @{text \"uint16\"} is not involved.\n  For the target @{text SML} itself, no special code generation \n  for this type is set up. Nevertheless, it should work by emulation via @{typ \"16 word\"} \n  if the theory @{text Code_Target_Bits_Int} is imported.\n\n  Restriction for OCaml code generation:\n  OCaml does not provide an int16 type, so no special code generation \n  for this type is set up.\n*}\n\ndeclare prod.Quotient[transfer_rule]\n\nsection {* Type definition and primitive operations *}\n\ntypedef uint16 = \"UNIV :: 16 word set\" ..\n\nsetup_lifting type_definition_uint16\n\ntext {* Use an abstract type for code generation to disable pattern matching on @{term Abs_uint16}. *}\ndeclare Rep_uint16_inverse[code abstype]\n\ndeclare Quotient_uint16[transfer_rule]\n\ninstantiation uint16 :: \"{neg_numeral, Divides.div, comm_monoid_mult, comm_ring}\" begin\nlift_definition zero_uint16 :: uint16 is \"0\" .\nlift_definition one_uint16 :: uint16 is \"1\" .\nlift_definition plus_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op +\" .\nlift_definition minus_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op -\" .\nlift_definition uminus_uint16 :: \"uint16 \\<Rightarrow> uint16\" is uminus .\nlift_definition times_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op *\" .\nlift_definition divide_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op div\" .\nlift_definition mod_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op mod\" .\ninstance by standard (transfer, simp add: algebra_simps)+\nend\n\ninstantiation uint16 :: linorder begin\nlift_definition less_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"op <\" .\nlift_definition less_eq_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"op \\<le>\" .\ninstance by standard (transfer, simp add: less_le_not_le linear)+\nend\n\nlemmas [code] = less_uint16.rep_eq less_eq_uint16.rep_eq\n\ninstantiation uint16 :: bitss begin\nlift_definition bitNOT_uint16 :: \"uint16 \\<Rightarrow> uint16\" is bitNOT .\nlift_definition bitAND_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitAND .\nlift_definition bitOR_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitOR .\nlift_definition bitXOR_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitXOR .\nlift_definition test_bit_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> bool\" is test_bit .\nlift_definition set_bit_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> bool \\<Rightarrow> uint16\" is set_bit .\nlift_definition set_bits_uint16 :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> uint16\" is \"set_bits\" .\nlift_definition lsb_uint16 :: \"uint16 \\<Rightarrow> bool\" is lsb .\nlift_definition shiftl_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is shiftl .\nlift_definition shiftr_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is shiftr .\nlift_definition msb_uint16 :: \"uint16 \\<Rightarrow> bool\" is msb .\ninstance ..\nend\n\nlemmas [code] = test_bit_uint16.rep_eq lsb_uint16.rep_eq msb_uint16.rep_eq\n\ninstantiation uint16 :: equal begin\nlift_definition equal_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"equal_class.equal\" .\ninstance by standard (transfer, simp add: equal_eq)\nend\n\nlemmas [code] = equal_uint16.rep_eq\n\ninstantiation uint16 :: size begin\nlift_definition size_uint16 :: \"uint16 \\<Rightarrow> nat\" is \"size\" .\ninstance ..\nend\n\nlemmas [code] = size_uint16.rep_eq\n\nlift_definition sshiftr_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" (infixl \">>>\" 55) is sshiftr .\n\nlift_definition uint16_of_int :: \"int \\<Rightarrow> uint16\" is \"word_of_int\" .\n\ndefinition uint16_of_nat :: \"nat \\<Rightarrow> uint16\"\nwhere \"uint16_of_nat = uint16_of_int \\<circ> int\"\n\nlift_definition int_of_uint16 :: \"uint16 \\<Rightarrow> int\" is \"uint\" .\nlift_definition nat_of_uint16 :: \"uint16 \\<Rightarrow> nat\" is \"unat\" .\n\ndefinition integer_of_uint16 :: \"uint16 \\<Rightarrow> integer\"\nwhere \"integer_of_uint16 = integer_of_int o int_of_uint16\"\n\ntext {* Use pretty numerals from integer for pretty printing *}\n\ncontext includes integer.lifting begin\n\nlift_definition Uint16 :: \"integer \\<Rightarrow> uint16\" is \"word_of_int\" .\n\nlemma Rep_uint16_numeral [simp]: \"Rep_uint16 (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint16_def Abs_uint16_inverse numeral.simps plus_uint16_def)\n\nlemma Rep_uint16_neg_numeral [simp]: \"Rep_uint16 (- numeral n) = - numeral n\"\nby(simp only: uminus_uint16_def)(simp add: Abs_uint16_inverse)\n\nlemma numeral_uint16_transfer [transfer_rule]:\n  \"(rel_fun op = cr_uint16) numeral numeral\"\nby(auto simp add: cr_uint16_def)\n\nlemma numeral_uint16 [code_unfold]: \"numeral n = Uint16 (numeral n)\"\nby transfer simp\n\nlemma neg_numeral_uint16 [code_unfold]: \"- numeral n = Uint16 (- numeral n)\"\nby transfer(simp add: cr_uint16_def)\n\nend\n\nlemma Abs_uint16_numeral [code_post]: \"Abs_uint16 (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint16_def numeral.simps plus_uint16_def Abs_uint16_inverse)\n\nlemma Abs_uint16_0 [code_post]: \"Abs_uint16 0 = 0\"\nby(simp add: zero_uint16_def)\n\nlemma Abs_uint16_1 [code_post]: \"Abs_uint16 1 = 1\"\nby(simp add: one_uint16_def)\n\nsection {* Code setup *}\n\ncode_printing code_module Uint16 \\<rightharpoonup> (SML_word)\n{*(* Test that words can handle numbers between 0 and 15 *)\nval _ = if 4 <= Word.wordSize then () else raise (Fail (\"wordSize less than 4\"));\n\nstructure Uint16 : sig\n  val set_bit : Word16.word -> IntInf.int -> bool -> Word16.word\n  val shiftl : Word16.word -> IntInf.int -> Word16.word\n  val shiftr : Word16.word -> IntInf.int -> Word16.word\n  val shiftr_signed : Word16.word -> IntInf.int -> Word16.word\n  val test_bit : Word16.word -> IntInf.int -> bool\nend = struct\n\nfun set_bit x n b =\n  let val mask = Word16.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))\n  in if b then Word16.orb (x, mask)\n     else Word16.andb (x, Word16.notb mask)\n  end\n\nfun shiftl x n =\n  Word16.<< (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr x n =\n  Word16.>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr_signed x n =\n  Word16.~>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun test_bit x n =\n  Word16.andb (x, Word16.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))) <> Word16.fromInt 0\n\nend; (* struct Uint16 *)*}\ncode_reserved SML_word Uint16\n\ncode_printing code_module Uint16 \\<rightharpoonup> (Haskell)\n{*import qualified Data.Word;\nimport qualified Data.Int;\n\ntype Int16 = Data.Int.Int16;\n\ntype Word16 = Data.Word.Word16;*}\ncode_reserved Haskell Uint16\n\ntext {* Scala provides unsigned 16-bit numbers as Char. *}\n\ncode_printing code_module Uint16 \\<rightharpoonup> (Scala)\n{*object Uint16 {\n\ndef set_bit(x: scala.Char, n: BigInt, b: Boolean) : scala.Char =\n  if (b)\n    (x | (1.toChar << n.intValue)).toChar\n  else\n    (x & (1.toChar << n.intValue).unary_~).toChar\n\ndef shiftl(x: scala.Char, n: BigInt) : scala.Char = (x << n.intValue).toChar\n\ndef shiftr(x: scala.Char, n: BigInt) : scala.Char = (x >>> n.intValue).toChar\n\ndef shiftr_signed(x: scala.Char, n: BigInt) : scala.Char = (x.toShort >> n.intValue).toChar\n\ndef test_bit(x: scala.Char, n: BigInt) : Boolean = (x & (1.toChar << n.intValue)) != 0\n\n} /* object Uint16 */*}\ncode_reserved Scala Uint16\n\ntext {* \n  Avoid @{term Abs_uint16} in generated code, use @{term Rep_uint16'} instead. \n  The symbolic implementations for code\\_simp use @{term Rep_uint16}.\n\n  The new destructor @{term Rep_uint16'} is executable.\n  As the simplifier is given the [code abstract] equations literally, \n  we cannot implement @{term Rep_uint16} directly, because that makes code\\_simp loop.\n\n  If code generation raises Match, some equation probably contains @{term Rep_uint16} \n  ([code abstract] equations for @{typ uint16} may use @{term Rep_uint16} because\n  these instances will be folded away.)\n\n  To convert @{typ \"16 word\"} values into @{typ uint16}, use @{term \"Abs_uint16'\"}.\n*}\n\ndefinition Rep_uint16' where [simp]: \"Rep_uint16' = Rep_uint16\"\n\nlemma Rep_uint16'_transfer [transfer_rule]:\n  \"rel_fun cr_uint16 op = (\\<lambda>x. x) Rep_uint16'\"\nunfolding Rep_uint16'_def by(rule uint16.rep_transfer)\n\n\n\nlift_definition Abs_uint16' :: \"16 word \\<Rightarrow> uint16\" is \"\\<lambda>x :: 16 word. x\" .\n\nlemma Abs_uint16'_code [code]:\n  \"Abs_uint16' x = Uint16 (integer_of_int (uint x))\"\nincluding integer.lifting by transfer simp\n\nlemma [code, code del]: \"term_of_class.term_of = (term_of_class.term_of :: uint16 \\<Rightarrow> _)\" ..\n\nlemma term_of_uint16_code [code]:\n  defines \"TR \\<equiv> typerep.Typerep\" and \"bit0 \\<equiv> STR ''Numeral_Type.bit0''\" shows\n  \"term_of_class.term_of x = \n   Code_Evaluation.App (Code_Evaluation.Const (STR ''Uint16.Abs_uint16'') (TR (STR ''fun'') [TR (STR ''Word.word'') [TR bit0 [TR bit0 [TR bit0 [TR bit0 [TR (STR ''Numeral_Type.num1'') []]]]]], TR (STR ''Uint16.uint16'') []]))\n       (term_of_class.term_of (Rep_uint16' x))\"\nby(simp add: term_of_anything)\n\nlemma Uin16_code [code abstract]: \"Rep_uint16 (Uint16 i) = word_of_int (int_of_integer_symbolic i)\"\nunfolding Uint16_def int_of_integer_symbolic_def by(simp add: Abs_uint16_inverse)\n\ncode_printing\n  type_constructor uint16 \\<rightharpoonup>\n  (SML_word) \"Word16.word\" and\n  (Haskell) \"Uint16.Word16\" and\n  (Scala) \"scala.Char\"\n| constant Uint16 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLargeInt (IntInf.toLarge _)\" and\n  (Haskell) \"(Prelude.fromInteger _ :: Uint16.Word16)\" and\n  (Haskell_Quickcheck) \"(Prelude.fromInteger (Prelude.toInteger _) :: Uint16.Word16)\" and\n  (Scala) \"_.charValue\"\n| constant \"0 :: uint16\" \\<rightharpoonup>\n  (SML_word) \"(Word16.fromInt 0)\" and\n  (Haskell) \"(0 :: Uint16.Word16)\" and\n  (Scala) \"0\"\n| constant \"1 :: uint16\" \\<rightharpoonup>\n  (SML_word) \"(Word16.fromInt 1)\" and\n  (Haskell) \"(1 :: Uint16.Word16)\" and\n  (Scala) \"1\"\n| constant \"plus :: uint16 \\<Rightarrow> _ \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.+ ((_), (_))\" and\n  (Haskell) infixl 6 \"+\" and\n  (Scala) \"(_ +/ _).toChar\"\n| constant \"uminus :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.~\" and\n  (Haskell) \"negate\" and\n  (Scala) \"(- _).toChar\"\n| constant \"minus :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.- ((_), (_))\" and\n  (Haskell) infixl 6 \"-\" and\n  (Scala) \"(_ -/ _).toChar\"\n| constant \"times :: uint16 \\<Rightarrow> _ \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.* ((_), (_))\" and\n  (Haskell) infixl 7 \"*\" and\n  (Scala) \"(_ */ _).toChar\"\n| constant \"HOL.equal :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"!((_ : Word16.word) = _)\" and\n  (Haskell) infix 4 \"==\" and\n  (Scala) infixl 5 \"==\"\n| class_instance uint16 :: equal \\<rightharpoonup> (Haskell) -\n| constant \"less_eq :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"Word16.<= ((_), (_))\" and\n  (Haskell) infix 4 \"<=\" and\n  (Scala) infixl 4 \"<=\"\n| constant \"less :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"Word16.< ((_), (_))\" and\n  (Haskell) infix 4 \"<\" and\n  (Scala) infixl 4 \"<\"\n| constant \"bitNOT :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.notb\" and\n  (Haskell) \"Data'_Bits.complement\" and\n  (Scala) \"_.unary'_~.toChar\"\n| constant \"bitAND :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.andb ((_),/ (_))\" and\n  (Haskell) infixl 7 \"Data_Bits..&.\" and\n  (Scala) \"(_ & _).toChar\"\n| constant \"bitOR :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.orb ((_),/ (_))\" and\n  (Haskell) infixl 5 \"Data_Bits..|.\" and\n  (Scala) \"(_ | _).toChar\"\n| constant \"bitXOR :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.xorb ((_),/ (_))\" and\n  (Haskell) \"Data'_Bits.xor\" and\n  (Scala) \"(_ ^ _).toChar\"\n\ndefinition uint16_div :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" \nwhere \"uint16_div x y = (if y = 0 then undefined (op div :: uint16 \\<Rightarrow> _) x (0 :: uint16) else x div y)\"\n\ndefinition uint16_mod :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" \nwhere \"uint16_mod x y = (if y = 0 then undefined (op mod :: uint16 \\<Rightarrow> _) x (0 :: uint16) else x mod y)\"\n\ncontext includes undefined_transfer begin\n\nlemma div_uint16_code [code]: \"x div y = (if y = 0 then 0 else uint16_div x y)\"\nunfolding uint16_div_def by transfer (simp add: word_div_def)\n\nlemma mod_uint16_code [code]: \"x mod y = (if y = 0 then x else uint16_mod x y)\"\nunfolding uint16_mod_def by transfer (simp add: word_mod_def)\n\nlemma uint16_div_code [code abstract]:\n  \"Rep_uint16 (uint16_div x y) =\n  (if y = 0 then Rep_uint16 (undefined (op div :: uint16 \\<Rightarrow> _) x (0 :: uint16)) else Rep_uint16 x div Rep_uint16 y)\"\nunfolding uint16_div_def by transfer simp\n\nlemma uint16_mod_code [code abstract]:\n  \"Rep_uint16 (uint16_mod x y) =\n  (if y = 0 then Rep_uint16 (undefined (op mod :: uint16 \\<Rightarrow> _) x (0 :: uint16)) else Rep_uint16 x mod Rep_uint16 y)\"\nunfolding uint16_mod_def by transfer simp\n\nend\n\ncode_printing constant uint16_div \\<rightharpoonup>\n  (SML_word) \"Word16.div ((_), (_))\" and\n  (Haskell) \"Prelude.div\" and\n  (Scala) \"(_ '/ _).toChar\"\n| constant uint16_mod \\<rightharpoonup>\n  (SML_word) \"Word16.mod ((_), (_))\" and\n  (Haskell) \"Prelude.mod\" and\n  (Scala) \"(_ % _).toChar\"\n\ndefinition uint16_test_bit :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> bool\"\nwhere [code del]:\n  \"uint16_test_bit x n =\n  (if n < 0 \\<or> 15 < n then undefined (test_bit :: uint16 \\<Rightarrow> _) x n\n   else x !! (nat_of_integer n))\"\n\nlemma test_bit_uint16_code [code]:\n  \"test_bit x n \\<longleftrightarrow> n < 16 \\<and> uint16_test_bit x (integer_of_nat n)\"\nunfolding uint16_test_bit_def including undefined_transfer integer.lifting \nby transfer(auto cong: conj_cong dest: test_bit_size simp add: word_size)\n\nlemma uint16_test_bit_code [code]:\n  \"uint16_test_bit w n =\n  (if n < 0 \\<or> 15 < n then undefined (test_bit :: uint16 \\<Rightarrow> _) w n else Rep_uint16 w !! nat_of_integer n)\"\nunfolding uint16_test_bit_def by(simp add: test_bit_uint16.rep_eq)\n\ncode_printing constant uint16_test_bit \\<rightharpoonup>\n  (SML_word) \"Uint16.test'_bit\" and\n  (Haskell) \"Data'_Bits.testBitBounded\" and\n  (Scala) \"Uint16.test'_bit\"\n\ndefinition uint16_set_bit :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> bool \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_set_bit x n b =\n  (if n < 0 \\<or> 15 < n then undefined (set_bit :: uint16 \\<Rightarrow> _) x n b\n   else set_bit x (nat_of_integer n) b)\"\n\nlemma set_bit_uint16_code [code]:\n  \"set_bit x n b = (if n < 16 then uint16_set_bit x (integer_of_nat n) b else x)\"\nincluding undefined_transfer integer.lifting unfolding uint16_set_bit_def\nby(transfer)(auto cong: conj_cong simp add: not_less set_bit_beyond word_size)\n\nlemma uint16_set_bit_code [code abstract]:\n  \"Rep_uint16 (uint16_set_bit w n b) = \n  (if n < 0 \\<or> 15 < n then Rep_uint16 (undefined (set_bit :: uint16 \\<Rightarrow> _) w n b)\n   else set_bit (Rep_uint16 w) (nat_of_integer n) b)\"\nincluding undefined_transfer unfolding uint16_set_bit_def by transfer simp\n\ncode_printing constant uint16_set_bit \\<rightharpoonup>\n  (SML_word) \"Uint16.set'_bit\" and\n  (Haskell) \"Data'_Bits.setBitBounded\" and\n  (Scala) \"Uint16.set'_bit\"\n\nlift_definition uint16_set_bits :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is set_bits_aux .\n\nlemma uint16_set_bits_code [code]:\n  \"uint16_set_bits f w n =\n  (if n = 0 then w \n   else let n' = n - 1 in uint16_set_bits f ((w << 1) OR (if f n' then 1 else 0)) n')\"\nby(transfer fixing: n)(cases n, simp_all)\n\nlemma set_bits_uint16 [code]:\n  \"(BITS n. f n) = uint16_set_bits f 0 16\"\nby transfer(simp add: set_bits_conv_set_bits_aux)\n\n\nlemma lsb_code [code]: fixes x :: uint16 shows \"lsb x = x !! 0\"\nby transfer(simp add: word_lsb_def word_test_bit_def)\n\n\ndefinition uint16_shiftl :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_shiftl x n = (if n < 0 \\<or> 16 \\<le> n then undefined (shiftl :: uint16 \\<Rightarrow> _) x n else x << (nat_of_integer n))\"\n\nlemma shiftl_uint16_code [code]: \"x << n = (if n < 16 then uint16_shiftl x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_shiftl_def\nby transfer(simp add: not_less shiftl_zero_size word_size)\n\nlemma uint16_shiftl_code [code abstract]:\n  \"Rep_uint16 (uint16_shiftl w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined (shiftl :: uint16 \\<Rightarrow> _) w n)\n   else Rep_uint16 w << nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_shiftl_def by transfer simp\n\ncode_printing constant uint16_shiftl \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftl\" and\n  (Haskell) \"Data'_Bits.shiftlBounded\" and\n  (Scala) \"Uint16.shiftl\"\n\ndefinition uint16_shiftr :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_shiftr x n = (if n < 0 \\<or> 16 \\<le> n then undefined (shiftr :: uint16 \\<Rightarrow> _) x n else x >> (nat_of_integer n))\"\n\nlemma shiftr_uint16_code [code]: \"x >> n = (if n < 16 then uint16_shiftr x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_shiftr_def\nby transfer(simp add: not_less shiftr_zero_size word_size)\n\nlemma uint16_shiftr_code [code abstract]:\n  \"Rep_uint16 (uint16_shiftr w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined (shiftr :: uint16 \\<Rightarrow> _) w n)\n   else Rep_uint16 w >> nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_shiftr_def by transfer simp\n\ncode_printing constant uint16_shiftr \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftr\" and\n  (Haskell) \"Data'_Bits.shiftrBounded\" and\n  (Scala) \"Uint16.shiftr\"\n\ndefinition uint16_sshiftr :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_sshiftr x n =\n  (if n < 0 \\<or> 16 \\<le> n then undefined sshiftr_uint16 x n else sshiftr_uint16 x (nat_of_integer n))\"\n\nlemma sshiftr_beyond: fixes x :: \"'a :: len word\" shows\n  \"size x \\<le> n \\<Longrightarrow> x >>> n = (if x !! (size x - 1) then -1 else 0)\"\nby(rule word_eqI)(simp add: nth_sshiftr word_size)\n\nlemma sshiftr_uint16_code [code]:\n  \"x >>> n = \n  (if n < 16 then uint16_sshiftr x (integer_of_nat n) else if x !! 15 then -1 else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_sshiftr_def\nby transfer (simp add: not_less sshiftr_beyond word_size)\n\nlemma uint16_sshiftr_code [code abstract]:\n  \"Rep_uint16 (uint16_sshiftr w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined sshiftr_uint16 w n)\n   else Rep_uint16 w >>> nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_sshiftr_def by transfer simp\n\ncode_printing constant uint16_sshiftr \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftr'_signed\" and\n  (Haskell) \n    \"(Prelude.fromInteger (Prelude.toInteger (Data'_Bits.shiftrBounded (Prelude.fromInteger (Prelude.toInteger _) :: Uint16.Int16) _)) :: Uint16.Word16)\" and\n  (Scala) \"Uint16.shiftr'_signed\"\n\nlemma uint16_msb_test_bit: \"msb x \\<longleftrightarrow> (x :: uint16) !! 15\"\nby transfer(simp add: msb_nth)\n\nlemma msb_uint16_code [code]: \"msb x \\<longleftrightarrow> uint16_test_bit x 15\"\nby(simp add: uint16_test_bit_def uint16_msb_test_bit)\n\nlemma uint16_of_int_code [code]: \"uint16_of_int i = Uint16 (integer_of_int i)\"\nincluding integer.lifting by transfer simp\n\nlemma int_of_uint16_code [code]:\n  \"int_of_uint16 x = int_of_integer (integer_of_uint16 x)\"\nby(simp add: integer_of_uint16_def)\n\nlemma nat_of_uint16_code [code]:\n  \"nat_of_uint16 x = nat_of_integer (integer_of_uint16 x)\"\nunfolding integer_of_uint16_def including integer.lifting by transfer (simp add: unat_def)\n\nlemma integer_of_uint16_code [code]:\n  \"integer_of_uint16 n = integer_of_int (uint (Rep_uint16' n))\"\nunfolding integer_of_uint16_def by transfer auto\n\ncode_printing\n  constant \"integer_of_uint16\" \\<rightharpoonup>\n  (SML_word) \"Word16.toInt _ : IntInf.int\" and\n  (Haskell) \"Prelude.toInteger\" and\n  (Scala) \"BigInt\"\n\nsection {* Quickcheck setup *}\n\ndefinition uint16_of_natural :: \"natural \\<Rightarrow> uint16\"\nwhere \"uint16_of_natural x \\<equiv> Uint16 (integer_of_natural x)\"\n\ninstantiation uint16 :: \"{random, exhaustive, full_exhaustive}\" begin\ndefinition \"random_uint16 \\<equiv> qc_random_cnv uint16_of_natural\"\ndefinition \"exhaustive_uint16 \\<equiv> qc_exhaustive_cnv uint16_of_natural\"\ndefinition \"full_exhaustive_uint16 \\<equiv> qc_full_exhaustive_cnv uint16_of_natural\"\ninstance ..\nend\n\ninstantiation uint16 :: narrowing begin\n\ninterpretation quickcheck_narrowing_samples\n  \"\\<lambda>i. let x = Uint16 i in (x, 0xFFFF - x)\" \"0\"\n  \"Typerep.Typerep (STR ''Uint16.uint16'') []\" .\n\ndefinition \"narrowing_uint16 d = qc_narrowing_drawn_from (narrowing_samples d) d\"\ndeclare [[code drop: \"partial_term_of :: uint16 itself \\<Rightarrow> _\"]]\nlemmas partial_term_of_uint16 [code] = partial_term_of_code\n\ninstance ..\nend\n\nno_notation sshiftr_uint16 (infixl \">>>\" 55)\n\nend\n", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/Native_Word/Uint16.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3243459895437257}}
{"text": "(*  Title:       Deriving class instances for datatypes\n    Author:      René Thiemann       <rene.thiemann@uibk.ac.at>\n    Maintainer:  René Thiemann\n    License:     LGPL\n*)\n\n(*\nCopyright 2013 René Thiemann\n\nThis file is part of IsaFoR/CeTA.\n\nIsaFoR/CeTA is free software: you can redistribute it and/or modify it under the\nterms of the GNU Lesser General Public License as published by the Free Software\nFoundation, either version 3 of the License, or (at your option) any later\nversion.\n\nIsaFoR/CeTA is distributed in the hope that it will be useful, but WITHOUT ANY\nWARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A\nPARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public License along\nwith IsaFoR/CeTA. If not, see <http://www.gnu.org/licenses/>.\n*)\n\nsection \\<open>Generating linear orders for datatypes\\<close>\n\ntheory Order_Generator\nimports \n  Derive_Aux\nbegin\n\nsubsection Introduction\n\ntext \\<open>\n\nThe order generator registers itself at the derive-manager for the classes @{class ord},\n@{class order}, and @{class linorder}.\nTo be more precise,\nit automatically generates the two functions @{term \"(\\<le>)\"} and @{term \"(<)\"} for some datatype \n\\texttt{dtype} and\nproves the following instantiations.\n\n\\begin{itemize}\n\\item \\texttt{instantiation dtype :: (ord,\\ldots,ord) ord}\n\\item \\texttt{instantiation dtype :: (order,\\ldots,order) order}\n\\item \\texttt{instantiation dtype :: (linorder,\\ldots,linorder) linorder}\n\\end{itemize}\n\nAll the non-recursive types that are used in the datatype must have similar instantiations.\nFor recursive type-dependencies this is automatically generated.\n\nFor example, for the \\texttt{datatype tree = Leaf nat | Node \"tree list\"} we require that\n@{type nat} is already in @{class linorder}, whereas for @{type list} nothing is required, since for the \n\\texttt{tree}\ndatatype the @{type list} is only used recursively.\n\nHowever, if we define \\texttt{datatype tree = Leaf \"nat list\" | Node tree tree} then \n@{type list} must\nprovide the above instantiations.\n\nNote that when calling the generator for @{class linorder}, it will automatically also derive the instantiations \nfor @{class order}, which in turn invokes the generator for @{class ord}. \nA later invokation of @{class linorder}\nafter @{class order} or @{class ord} is not possible.\n\\<close>\n\nsubsection \"Implementation Notes\"\n\ntext \\<open>\nThe generator uses the recursors from the datatype package to define a lexicographic order.\nE.g., for a declaration \n\\texttt{datatype 'a tree = Empty | Node \"'a tree\" 'a \"'a tree\"}\nthis will semantically result in\n\\begin{verbatim}\n(Empty < Node _ _ _) = True\n(Node l1 l2 l3 < Node r1 r2 r3) = \n  (l1 < r1 || l1 = r1 && (l2 < r2 || l2 = r2 && l3 < r3))\n(_ < _) = False\n(l <= r) = (l < r || l = r)\n\\end{verbatim}\n\nThe desired properties (like @{term \"x < y \\<Longrightarrow> y < z \\<Longrightarrow> x < z\"}) \nof the orders are all proven using induction (with the induction theorem from the datatype on @{term x}),\nand afterwards there is a case distinction on the remaining variables, i.e., here @{term y} and @{term z}.\nIf the constructors of @{term x}, @{term y}, and @{term z} are different always some basic tactic is invoked. \nIn the other case (identical constructors) for each property a dedicated tactic was designed.\n\\<close>\n\nsubsection \"Features and Limitations\"\n\ntext \\<open>\nThe order generator has been developed mainly for datatypes without explicit mutual recursion. \nFor mutual recursive datatypes---like\n\\texttt{datatype a = C b and b = D a a}---only\nfor the first mentioned datatype---here \\texttt{a}---the instantiations of the order-classes are\nderived.\n\nIndirect recursion like in \\texttt{datatype tree = Leaf nat | Node \"tree list\"} should work \nwithout problems.\n\\<close>\n\nsubsection \"Installing the generator\"\n\nlemma linear_cases: \"(x :: 'a :: linorder) = y \\<or> x < y \\<or> y < x\" by auto\n\nML_file \\<open>order_generator.ML\\<close> \n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Datatype_Order_Generator/Order_Generator.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.3243459895437257}}
{"text": "(*  Title:       A Fair Ordered Resolution Prover for First-Order Clauses with Weights\n    Author:      Anders Schlichtkrull <andschl at dtu.dk>, 2017\n    Author:      Jasmin Blanchette <j.c.blanchette at vu.nl>, 2017\n    Maintainer:  Anders Schlichtkrull <andschl at dtu.dk>\n*)\n\nsection \\<open>A Fair Ordered Resolution Prover for First-Order Clauses with Weights\\<close>\n\ntext \\<open>\nThe \\<open>weighted_RP\\<close> prover introduced below operates on finite multisets of clauses and\norganizes the multiset of processed clauses as a priority queue to ensure that inferences are\nperformed in a fair manner, to guarantee completeness.\n\\<close>\n\ntheory Weighted_FO_Ordered_Resolution_Prover\n  imports Ordered_Resolution_Prover.FO_Ordered_Resolution_Prover\nbegin\n\n\nsubsection \\<open>Library\\<close>\n\n(* TODO: Move to \"Coinductive\"? *)\nlemma ldrop_Suc_conv_ltl: \"ldrop (enat (Suc k)) xs = ltl (ldrop (enat k) xs)\"\n  by (metis eSuc_enat ldrop_eSuc_conv_ltl)\n\n(* TODO: Move to \"Coinductive\"? *)\nlemma lhd_ldrop':\n  assumes \"enat k < llength xs\"\n  shows \"lhd (ldrop (enat k) xs) = lnth xs k\"\n  using assms by (simp add: lhd_ldrop)\n\n(* TODO: Move to \"Multiset_More.thy\". *)\nlemma filter_mset_empty_if_finite_and_filter_set_empty:\n  assumes\n    \"{x \\<in> X. P x} = {}\" and\n    \"finite X\"\n  shows \"{#x \\<in># mset_set X. P x#} = {#}\"\nproof -\n  have empty_empty: \"\\<And>Y. set_mset Y = {} \\<Longrightarrow> Y = {#}\"\n    by auto\n  from assms have \"set_mset {#x \\<in># mset_set X. P x#} = {}\"\n    by auto\n  then show ?thesis\n    by (rule empty_empty)\nqed\n\n(* TODO: Move to \"Lazy_List_Chain.thy\". *)\nlemma inf_chain_ltl_chain: \"chain R xs \\<Longrightarrow> llength xs = \\<infinity> \\<Longrightarrow> chain R (ltl xs)\"\n  unfolding chain.simps[of R xs] llength_eq_infty_conv_lfinite\n  by (metis lfinite_code(1) lfinite_ltl llist.sel(3))\n\n(* TODO: Move to \"Lazy_List_Chain.thy\". *)\nlemma inf_chain_ldrop_chain:\n  assumes\n    chain: \"chain R xs\" and\n    inf: \"\\<not> lfinite xs\"\n  shows \"chain R (ldrop (enat k) xs)\"\nproof (induction k)\n  case 0\n  then show ?case\n    using zero_enat_def chain by auto\nnext\n  case (Suc k)\n  have \"llength (ldrop (enat k) xs) = \\<infinity>\"\n    using inf by (simp add: not_lfinite_llength)\n  with Suc have \"chain R (ltl (ldrop (enat k) xs))\"\n    using inf_chain_ltl_chain[of R \"(ldrop (enat k) xs)\"] by auto\n  then show ?case\n    using ldrop_Suc_conv_ltl[of k xs] by auto\nqed\n\n\nsubsection \\<open>Prover\\<close>\n\ntype_synonym 'a wclause = \"'a clause \\<times> nat\"\ntype_synonym 'a wstate = \"'a wclause multiset \\<times> 'a wclause multiset \\<times> 'a wclause multiset \\<times> nat\"\n\nfun state_of_wstate :: \"'a wstate \\<Rightarrow> 'a state\" where\n  \"state_of_wstate (N, P, Q, n) =\n   (set_mset (image_mset fst N), set_mset (image_mset fst P), set_mset (image_mset fst Q))\"\n\nlocale weighted_FO_resolution_prover =\n  FO_resolution_prover S subst_atm id_subst comp_subst renamings_apart atm_of_atms mgu less_atm\n  for\n    S :: \"('a :: wellorder) clause \\<Rightarrow> 'a clause\" and\n    subst_atm :: \"'a \\<Rightarrow> 's \\<Rightarrow> 'a\" and\n    id_subst :: \"'s\" and\n    comp_subst :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's\" and\n    renamings_apart :: \"'a clause list \\<Rightarrow> 's list\" and\n    atm_of_atms :: \"'a list \\<Rightarrow> 'a\" and\n    mgu :: \"'a set set \\<Rightarrow> 's option\" and\n    less_atm :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\" +\n  fixes\n    weight :: \"'a clause \\<times> nat \\<Rightarrow> nat\"\n  assumes\n    weight_mono: \"i < j \\<Longrightarrow> weight (C, i) < weight (C, j)\"\nbegin\n\nabbreviation clss_of_wstate :: \"'a wstate \\<Rightarrow> 'a clause set\" where\n  \"clss_of_wstate St \\<equiv> clss_of_state (state_of_wstate St)\"\n\nabbreviation N_of_wstate :: \"'a wstate \\<Rightarrow> 'a clause set\" where\n  \"N_of_wstate St \\<equiv> N_of_state (state_of_wstate St)\"\n\nabbreviation P_of_wstate :: \"'a wstate \\<Rightarrow> 'a clause set\" where\n  \"P_of_wstate St \\<equiv> P_of_state (state_of_wstate St)\"\n\nabbreviation Q_of_wstate :: \"'a wstate \\<Rightarrow> 'a clause set\" where\n  \"Q_of_wstate St \\<equiv> Q_of_state (state_of_wstate St)\"\n\nfun wN_of_wstate :: \"'a wstate \\<Rightarrow> 'a wclause multiset\" where\n  \"wN_of_wstate (N, P, Q, n) = N\"\n\nfun wP_of_wstate :: \"'a wstate \\<Rightarrow> 'a wclause multiset\" where\n  \"wP_of_wstate (N, P, Q, n) = P\"\n\nfun wQ_of_wstate :: \"'a wstate \\<Rightarrow> 'a wclause multiset\" where\n  \"wQ_of_wstate (N, P, Q, n) = Q\"\n\nfun n_of_wstate :: \"'a wstate \\<Rightarrow> nat\" where\n  \"n_of_wstate (N, P, Q, n) = n\"\n\nlemma of_wstate_split[simp]:\n  \"(wN_of_wstate St, wP_of_wstate St, wQ_of_wstate St, n_of_wstate St) = St\"\n  by (cases St) auto\n\nabbreviation grounding_of_wstate :: \"'a wstate \\<Rightarrow> 'a clause set\" where\n  \"grounding_of_wstate St \\<equiv> grounding_of_state (state_of_wstate St)\"\n\nabbreviation Liminf_wstate :: \"'a wstate llist \\<Rightarrow> 'a state\" where\n  \"Liminf_wstate Sts \\<equiv> Liminf_state (lmap state_of_wstate Sts)\"\n\nlemma timestamp_le_weight: \"n \\<le> weight (C, n)\"\n  by (induct n, simp, metis weight_mono[of k \"Suc k\" for k] Suc_le_eq le_less le_trans)\n\ninductive weighted_RP :: \"'a wstate \\<Rightarrow> 'a wstate \\<Rightarrow> bool\" (infix \"\\<leadsto>\\<^sub>w\" 50) where\n  tautology_deletion: \"Neg A \\<in># C \\<Longrightarrow> Pos A \\<in># C \\<Longrightarrow> (N + {#(C, i)#}, P, Q, n) \\<leadsto>\\<^sub>w (N, P, Q, n)\"\n| forward_subsumption: \"D \\<in># image_mset fst (P + Q) \\<Longrightarrow> subsumes D C \\<Longrightarrow>\n    (N + {#(C, i)#}, P, Q, n) \\<leadsto>\\<^sub>w (N, P, Q, n)\"\n| backward_subsumption_P: \"D \\<in># image_mset fst N \\<Longrightarrow> C \\<in># image_mset fst P \\<Longrightarrow>\n    strictly_subsumes D C \\<Longrightarrow> (N, P, Q, n) \\<leadsto>\\<^sub>w (N, {#(E, k) \\<in># P. E \\<noteq> C#}, Q, n)\"\n| backward_subsumption_Q: \"D \\<in># image_mset fst N \\<Longrightarrow> strictly_subsumes D C \\<Longrightarrow>\n    (N, P, Q + {#(C, i)#}, n) \\<leadsto>\\<^sub>w (N, P, Q, n)\"\n| forward_reduction: \"D + {#L'#} \\<in># image_mset fst (P + Q) \\<Longrightarrow> - L = L' \\<cdot>l \\<sigma> \\<Longrightarrow> D \\<cdot> \\<sigma> \\<subseteq># C \\<Longrightarrow>\n    (N + {#(C + {#L#}, i)#}, P, Q, n) \\<leadsto>\\<^sub>w (N + {#(C, i)#}, P, Q, n)\"\n| backward_reduction_P: \"D + {#L'#} \\<in># image_mset fst N \\<Longrightarrow> - L = L' \\<cdot>l \\<sigma> \\<Longrightarrow> D \\<cdot> \\<sigma> \\<subseteq># C \\<Longrightarrow>\n    (\\<forall>j. (C + {#L#}, j) \\<in># P \\<longrightarrow> j \\<le> i) \\<Longrightarrow>\n    (N, P + {#(C + {#L#}, i)#}, Q, n) \\<leadsto>\\<^sub>w (N, P + {#(C, i)#}, Q, n)\"\n| backward_reduction_Q: \"D + {#L'#} \\<in># image_mset fst N \\<Longrightarrow> - L = L' \\<cdot>l \\<sigma> \\<Longrightarrow> D \\<cdot> \\<sigma> \\<subseteq># C \\<Longrightarrow>\n    (N, P, Q + {#(C + {#L#}, i)#}, n) \\<leadsto>\\<^sub>w (N, P + {#(C, i)#}, Q, n)\"\n| clause_processing: \"(N + {#(C, i)#}, P, Q, n) \\<leadsto>\\<^sub>w (N, P + {#(C, i)#}, Q, n)\"\n| inference_computation: \"(\\<forall>(D, j) \\<in># P. weight (C, i) \\<le> weight (D, j)) \\<Longrightarrow>\n    N = mset_set ((\\<lambda>D. (D, n)) ` concls_of\n      (inference_system.inferences_between (ord_FO_\\<Gamma> S) (set_mset (image_mset fst Q)) C)) \\<Longrightarrow>\n    ({#}, P + {#(C, i)#}, Q, n) \\<leadsto>\\<^sub>w (N, {#(D, j) \\<in># P. D \\<noteq> C#}, Q + {#(C, i)#}, Suc n)\"\n\nlemma weighted_RP_imp_RP: \"St \\<leadsto>\\<^sub>w St' \\<Longrightarrow> state_of_wstate St \\<leadsto> state_of_wstate St'\"\nproof (induction rule: weighted_RP.induct)\n  case (backward_subsumption_P D N C P Q n)\n  show ?case\n    by (rule arg_cong2[THEN iffD1, of _ _ _ _ \"(\\<leadsto>)\", OF _ _\n          RP.backward_subsumption_P[of D \"fst ` set_mset N\" C \"fst ` set_mset P - {C}\"\n            \"fst ` set_mset Q\"]])\n      (use backward_subsumption_P in auto)\nnext\n  case (inference_computation P C i N n Q)\n  show ?case\n     by (rule arg_cong2[THEN iffD1, of _ _ _ _ \"(\\<leadsto>)\", OF _ _\n           RP.inference_computation[of \"fst ` set_mset N\" \"fst ` set_mset Q\" C\n             \"fst ` set_mset P - {C}\"]],\n         use inference_computation(2) finite_ord_FO_resolution_inferences_between in\n           \\<open>auto simp: comp_def image_comp inference_system.inferences_between_def\\<close>)\nqed (use RP.intros in simp_all)\n\nlemma final_weighted_RP: \"\\<not> ({#}, {#}, Q, n) \\<leadsto>\\<^sub>w St\"\n  by (auto elim: weighted_RP.cases)\n\ncontext\n  fixes\n    Sts :: \"'a wstate llist\"\n  assumes\n    full_deriv: \"full_chain (\\<leadsto>\\<^sub>w) Sts\" and\n    empty_P0: \"P_of_wstate (lhd Sts) = {}\" and\n    empty_Q0: \"Q_of_wstate (lhd Sts) = {}\"\nbegin\n\nlemma finite_Sts0: \"finite (clss_of_wstate (lhd Sts))\"\n  unfolding clss_of_state_def by (cases \"lhd Sts\") auto\n\nlemmas deriv = full_chain_imp_chain[OF full_deriv]\nlemmas lhd_lmap_Sts = llist.map_sel(1)[OF chain_not_lnull[OF deriv]]\n\nlemma deriv_RP: \"chain (\\<leadsto>) (lmap state_of_wstate Sts)\"\n  using deriv weighted_RP_imp_RP by (metis chain_lmap)\n\nlemma finite_Sts0_RP: \"finite (clss_of_state (lhd (lmap state_of_wstate Sts)))\"\n  using finite_Sts0 chain_length_pos[OF deriv] by auto\n\nlemma empty_P0_RP: \"P_of_state (lhd (lmap state_of_wstate Sts)) = {}\"\n  using empty_P0 chain_length_pos[OF deriv] by auto\n\nlemma empty_Q0_RP: \"Q_of_state (lhd (lmap state_of_wstate Sts)) = {}\"\n  using empty_Q0 chain_length_pos[OF deriv] by auto\n\nlemmas Sts_thms = deriv_RP finite_Sts0_RP empty_P0_RP empty_Q0_RP\n\ntheorem weighted_RP_model:\n  \"St \\<leadsto>\\<^sub>w St' \\<Longrightarrow> I \\<Turnstile>s grounding_of_wstate St' \\<longleftrightarrow> I \\<Turnstile>s grounding_of_wstate St\"\n  using RP_model Sts_thms weighted_RP_imp_RP by (simp only: comp_def)\n\nabbreviation S_gQ :: \"'a clause \\<Rightarrow> 'a clause\" where\n  \"S_gQ \\<equiv> S_Q (lmap state_of_wstate Sts)\"\n\ninterpretation sq: selection S_gQ\n  unfolding S_Q_def[OF deriv_RP empty_Q0_RP]\n  using S_M_selects_subseteq S_M_selects_neg_lits selection_axioms\n  by unfold_locales auto\n\ninterpretation gd: ground_resolution_with_selection S_gQ\n  by unfold_locales\n\ninterpretation src: standard_redundancy_criterion_reductive gd.ord_\\<Gamma>\n  by unfold_locales\n\ninterpretation src: standard_redundancy_criterion_counterex_reducing gd.ord_\\<Gamma>\n  \"ground_resolution_with_selection.INTERP S_gQ\"\n  by unfold_locales\n\nlemmas ord_\\<Gamma>_saturated_upto_def = src.saturated_upto_def\nlemmas ord_\\<Gamma>_saturated_upto_complete = src.saturated_upto_complete\nlemmas ord_\\<Gamma>_contradiction_Rf = src.contradiction_Rf\n\ntheorem weighted_RP_sound:\n  assumes \"{#} \\<in> clss_of_state (Liminf_wstate Sts)\"\n  shows \"\\<not> satisfiable (grounding_of_wstate (lhd Sts))\"\n  by (rule RP_sound[OF deriv_RP empty_Q0_RP assms, unfolded lhd_lmap_Sts])\n\nabbreviation RP_filtered_measure :: \"('a wclause \\<Rightarrow> bool) \\<Rightarrow> 'a wstate \\<Rightarrow> nat \\<times> nat \\<times> nat\" where\n  \"RP_filtered_measure \\<equiv> \\<lambda>p (N, P, Q, n).\n     (sum_mset (image_mset (\\<lambda>(C, i). Suc (size C)) {#Di \\<in># N + P + Q. p Di#}),\n      size {#Di \\<in># N. p Di#}, size {#Di \\<in># P. p Di#})\"\n\nabbreviation RP_combined_measure :: \"nat \\<Rightarrow> 'a wstate \\<Rightarrow> nat \\<times> (nat \\<times> nat \\<times> nat) \\<times> (nat \\<times> nat \\<times> nat)\" where\n  \"RP_combined_measure \\<equiv> \\<lambda>w St.\n     (w + 1 - n_of_wstate St, RP_filtered_measure (\\<lambda>(C, i). i \\<le> w) St,\n      RP_filtered_measure (\\<lambda>Ci. True) St)\"\n\nabbreviation (input) RP_filtered_relation :: \"((nat \\<times> nat \\<times> nat) \\<times> (nat \\<times> nat \\<times> nat)) set\" where\n  \"RP_filtered_relation \\<equiv> natLess <*lex*> natLess <*lex*> natLess\"\n\nabbreviation (input) RP_combined_relation :: \"((nat \\<times> ((nat \\<times> nat \\<times> nat) \\<times> (nat \\<times> nat \\<times> nat))) \\<times>\n    (nat \\<times> ((nat \\<times> nat \\<times> nat) \\<times> (nat \\<times> nat \\<times> nat)))) set\" where\n  \"RP_combined_relation \\<equiv> natLess <*lex*> RP_filtered_relation <*lex*> RP_filtered_relation\"\n\nabbreviation \"(fst3 :: 'b * 'c * 'd \\<Rightarrow> 'b) \\<equiv> fst\"\nabbreviation \"(snd3 :: 'b * 'c * 'd \\<Rightarrow> 'c) \\<equiv> \\<lambda>x. fst (snd x)\"\nabbreviation \"(trd3 :: 'b * 'c * 'd \\<Rightarrow> 'd) \\<equiv> \\<lambda>x. snd (snd x)\"\n\nlemma\n  wf_RP_filtered_relation: \"wf RP_filtered_relation\" and\n  wf_RP_combined_relation: \"wf RP_combined_relation\"\n  unfolding natLess_def using wf_less wf_mult by auto\n\nlemma multiset_sum_of_Suc_f_monotone: \"N \\<subset># M \\<Longrightarrow> (\\<Sum>x \\<in># N. Suc (f x)) < (\\<Sum>x \\<in># M. Suc (f x))\"\nproof (induction N arbitrary: M)\n  case empty\n  then obtain y where \"y \\<in># M\"\n    by force\n  then have \"(\\<Sum>x \\<in># M. 1) = (\\<Sum>x \\<in># M - {#y#} + {#y#}. 1)\"\n    by auto\n  also have \"... = (\\<Sum>x \\<in># M - {#y#}. 1) + (\\<Sum>x \\<in># {#y#}. 1)\"\n    by (metis image_mset_union sum_mset.union)\n  also have \"... > (0 :: nat)\"\n    by auto\n  finally have \"0 < (\\<Sum>x \\<in># M. Suc (f x))\"\n    by (fastforce intro: gr_zeroI)\n  then show ?case\n    using empty by auto\nnext\n  case (add x N)\n  from this(2) have \"(\\<Sum>y \\<in># N. Suc (f y)) < (\\<Sum>y \\<in># M - {#x#}. Suc (f y))\"\n    using add(1)[of \"M - {#x#}\"] by (simp add: insert_union_subset_iff)\n  moreover have \"add_mset x (remove1_mset x M) = M\"\n    by (meson add.prems add_mset_remove_trivial_If mset_subset_insertD)\n  ultimately show ?case\n    by (metis (no_types) add.commute add_less_cancel_right sum_mset.insert)\nqed\n\nlemma multiset_sum_monotone_f':\n  assumes \"CC \\<subset># DD\"\n  shows \"(\\<Sum>(C, i) \\<in># CC. Suc (f C)) < (\\<Sum>(C, i) \\<in># DD. Suc (f C))\"\n  using multiset_sum_of_Suc_f_monotone[OF assms, of \"f \\<circ> fst\"]\n  by (metis (mono_tags) comp_apply image_mset_cong2 split_beta)\n\nlemma filter_mset_strict_subset:\n  assumes \"x \\<in># M\" and \"\\<not> p x\"\n  shows \"{#y \\<in># M. p y#} \\<subset># M\"\nproof -\n  have subseteq: \"{#E \\<in># M. p E#} \\<subseteq># M\"\n    by auto\n  have \"count {#E \\<in># M. p E#} x = 0\"\n    using assms by auto\n  moreover have \"0 < count M x\"\n    using assms by auto\n  ultimately have lt_count: \"count {#y \\<in># M. p y#} x < count M x\"\n    by auto\n  then show ?thesis\n    using subseteq by (metis less_not_refl2 subset_mset.le_neq_trans)\nqed\n\nlemma weighted_RP_measure_decreasing_N:\n  assumes \"St \\<leadsto>\\<^sub>w St'\" and \"(C, l) \\<in># wN_of_wstate St\"\n  shows \"(RP_filtered_measure (\\<lambda>Ci. True) St', RP_filtered_measure (\\<lambda>Ci. True) St)\n    \\<in> RP_filtered_relation\"\nusing assms proof (induction rule: weighted_RP.induct)\n  case (backward_subsumption_P D N C' P Q n)\n  then obtain i' where  \"(C', i') \\<in># P\"\n    by auto\n  then have \"{#(E, k) \\<in># P. E \\<noteq> C'#} \\<subset># P\"\n    using filter_mset_strict_subset[of \"(C', i')\" P \"\\<lambda>X. \\<not>fst X =  C'\"]\n    by (metis (mono_tags, lifting) filter_mset_cong fst_conv prod.case_eq_if)\n  then have \"(\\<Sum>(C, i) \\<in># {#(E, k) \\<in># P. E \\<noteq> C'#}. Suc (size C)) < (\\<Sum>(C, i) \\<in># P. Suc (size C))\"\n    using multiset_sum_monotone_f'[of \"{#(E, k) \\<in># P. E \\<noteq> C'#}\" P size] by metis\n  then show ?case\n    unfolding natLess_def by auto\nqed (auto simp: natLess_def)\n\nlemma weighted_RP_measure_decreasing_P:\n  assumes \"St \\<leadsto>\\<^sub>w St'\" and \"(C, i) \\<in># wP_of_wstate St\"\n  shows \"(RP_combined_measure (weight (C, i)) St', RP_combined_measure (weight (C, i)) St)\n    \\<in> RP_combined_relation\"\nusing assms proof (induction rule: weighted_RP.induct)\n  case (backward_subsumption_P D N C' P Q n)\n\n  define St where \"St = (N, P, Q, n)\"\n  define P' where \"P' = {#(E, k) \\<in># P. E \\<noteq> C'#}\"\n  define St' where \"St' = (N, P', Q, n)\"\n\n  from backward_subsumption_P obtain i' where  \"(C', i') \\<in># P\"\n    by auto\n  then have P'_sub_P: \"P' \\<subset># P\"\n    unfolding P'_def using filter_mset_strict_subset[of \"(C', i')\" P \"\\<lambda>Dj. fst Dj \\<noteq> C'\"]\n    by (metis (no_types, lifting) filter_mset_cong fst_conv prod.case_eq_if)\n\n  have P'_subeq_P_filter:\n    \"{#(Ca, ia) \\<in># P'. ia \\<le> weight (C, i)#} \\<subseteq># {#(Ca, ia) \\<in># P. ia \\<le> weight (C, i)#}\"\n    using P'_sub_P by (auto intro: multiset_filter_mono)\n\n  have \"fst3 (RP_combined_measure (weight (C, i)) St')\n    \\<le> fst3 (RP_combined_measure (weight (C, i)) St)\"\n    unfolding St'_def St_def by auto\n  moreover have \"(\\<Sum>(C, i) \\<in># {#(Ca, ia) \\<in># P'. ia \\<le> weight (C, i)#}. Suc (size C))\n    \\<le> (\\<Sum>x \\<in># {#(Ca, ia) \\<in># P. ia \\<le> weight (C, i)#}. case x of (C, i) \\<Rightarrow> Suc (size C))\"\n    using P'_subeq_P_filter by (rule sum_image_mset_mono)\n  then have \"fst3 (snd3 (RP_combined_measure (weight (C, i)) St'))\n    \\<le> fst3 (snd3 (RP_combined_measure (weight (C, i)) St))\"\n    unfolding St'_def St_def by auto\n  moreover have \"snd3 (snd3 (RP_combined_measure (weight (C, i)) St'))\n    \\<le> snd3 (snd3 (RP_combined_measure (weight (C, i)) St))\"\n    unfolding St'_def St_def by auto\n  moreover from P'_subeq_P_filter have \"size {#(Ca, ia) \\<in># P'. ia \\<le> weight (C, i)#}\n    \\<le> size {#(Ca, ia) \\<in># P. ia \\<le> weight (C, i)#}\"\n    by (simp add: size_mset_mono)\n  then have \"trd3 (snd3 (RP_combined_measure (weight (C, i)) St'))\n    \\<le> trd3 (snd3 (RP_combined_measure (weight (C, i)) St))\"\n    unfolding St'_def St_def unfolding fst_def snd_def by auto\n  moreover from P'_sub_P have \"(\\<Sum>(C, i) \\<in># P'. Suc (size C)) < (\\<Sum>(C, i) \\<in># P. Suc (size C))\"\n    using multiset_sum_monotone_f'[of \"{#(E, k) \\<in># P. E \\<noteq> C'#}\" P size] unfolding P'_def by metis\n  then have \"fst3 (trd3 (RP_combined_measure (weight (C, i)) St'))\n    < fst3 (trd3 (RP_combined_measure (weight (C, i)) St))\"\n    unfolding P'_def St'_def St_def by auto\n  ultimately show ?case\n    unfolding natLess_def P'_def St'_def St_def by auto\nnext\n  case (inference_computation P C' i' N n Q)\n  then show ?case\n  proof (cases \"n \\<le> weight (C, i)\")\n    case True\n    then have \"weight (C, i) + 1 - n > weight (C, i) + 1 - Suc n\"\n      by auto\n    then show ?thesis\n      unfolding natLess_def by auto\n  next\n    case n_nle_w: False\n\n    define St :: \"'a wstate\" where \"St = ({#}, P + {#(C', i')#}, Q, n)\"\n    define St' :: \"'a wstate\" where \"St' =  (N, {#(D, j) \\<in># P. D \\<noteq> C'#}, Q + {#(C', i')#}, Suc n)\"\n    define concls :: \"'a wclause set\" where\n      \"concls = (\\<lambda>D. (D, n)) ` concls_of (inference_system.inferences_between (ord_FO_\\<Gamma> S)\n         (fst ` set_mset Q) C')\"\n\n    have fin: \"finite concls\"\n      unfolding concls_def using finite_ord_FO_resolution_inferences_between by auto\n\n    have \"{(D, ia) \\<in> concls. ia \\<le> weight (C, i)} = {}\"\n      unfolding concls_def using n_nle_w by auto\n    then have \"{#(D, ia) \\<in># mset_set concls. ia \\<le> weight (C, i)#} = {#}\"\n      using fin filter_mset_empty_if_finite_and_filter_set_empty[of concls] by auto\n    then have n_low_weight_empty: \"{#(D, ia) \\<in># N. ia \\<le> weight (C, i)#} = {#}\"\n      unfolding inference_computation unfolding concls_def by auto\n\n    have \"weight (C', i') \\<le> weight (C, i)\"\n      using inference_computation by auto\n    then have i'_le_w_Ci: \"i' \\<le> weight (C, i)\"\n      using timestamp_le_weight[of i' C'] by auto\n\n    have subs: \"{#(D, ia) \\<in># N + {#(D, j) \\<in># P. D \\<noteq> C'#} + (Q + {#(C', i')#}). ia \\<le> weight (C, i)#}\n      \\<subseteq># {#(D, ia) \\<in># {#} + (P + {#(C', i')#}) + Q. ia \\<le> weight (C, i)#}\"\n      using n_low_weight_empty by (auto simp: multiset_filter_mono)\n\n    have \"fst3 (RP_combined_measure (weight (C, i)) St')\n      \\<le> fst3 (RP_combined_measure (weight (C, i)) St)\"\n      unfolding St'_def St_def by auto\n    moreover have \"fst (RP_filtered_measure ((\\<lambda>(D, ia). ia \\<le> weight (C, i))) St') =\n      (\\<Sum>(C, i) \\<in># {#(D, ia) \\<in># N + {#(D, j) \\<in># P. D \\<noteq> C'#} + (Q + {#(C', i')#}).\n         ia \\<le> weight (C, i)#}. Suc (size C))\"\n      unfolding St'_def by auto\n    also have \"... \\<le> (\\<Sum>(C, i) \\<in># {#(D, ia) \\<in># {#} + (P + {#(C', i')#}) + Q. ia \\<le> weight (C, i)#}.\n      Suc (size C))\"\n      using subs sum_image_mset_mono by blast\n    also have \"... = fst (RP_filtered_measure (\\<lambda>(D, ia). ia \\<le> weight (C, i)) St)\"\n      unfolding St_def by auto\n    finally have \"fst3 (snd3 (RP_combined_measure (weight (C, i)) St'))\n      \\<le> fst3 (snd3 (RP_combined_measure (weight (C, i)) St))\"\n      by auto\n    moreover have \"snd3 (snd3 (RP_combined_measure (weight (C, i)) St')) =\n      snd3 (snd3 (RP_combined_measure (weight (C, i)) St))\"\n      unfolding St_def St'_def using n_low_weight_empty by auto\n    moreover have \"trd3 (snd3 (RP_combined_measure (weight (C, i)) St')) <\n      trd3 (snd3 (RP_combined_measure (weight (C, i)) St))\"\n      unfolding St_def St'_def using i'_le_w_Ci\n      by (simp add: le_imp_less_Suc multiset_filter_mono size_mset_mono)\n    ultimately show ?thesis\n      unfolding natLess_def St'_def St_def lex_prod_def by force\n  qed\nqed (auto simp: natLess_def)\n\nlemma preserve_min_or_delete_completely:\n  assumes \"St \\<leadsto>\\<^sub>w St'\" \"(C, i) \\<in># wP_of_wstate St\"\n    \"\\<forall>k. (C, k) \\<in># wP_of_wstate St \\<longrightarrow> i \\<le> k\"\n  shows \"(C, i) \\<in># wP_of_wstate St' \\<or> (\\<forall>j. (C, j) \\<notin># wP_of_wstate St')\"\nusing assms proof (induction rule: weighted_RP.induct)\n  case (backward_reduction_P D L' N L \\<sigma> C' P i' Q n)\n  show ?case\n  proof (cases \"C = C' + {#L#}\")\n    case True_outer: True\n    then have C_i_in: \"(C, i) \\<in># P + {#(C, i')#}\"\n      using backward_reduction_P by auto\n    then have max: \"\\<And>k. (C, k) \\<in># P + {#(C, i')#} \\<Longrightarrow> k \\<le> i'\"\n      using backward_reduction_P unfolding True_outer[symmetric] by auto\n    then have \"count (P + {#(C, i')#}) (C, i') \\<ge> 1\"\n      by auto\n    moreover\n    {\n      assume asm: \"count (P + {#(C, i')#}) (C, i') = 1\"\n      then have nin_P: \"(C, i') \\<notin># P\"\n        using not_in_iff by force\n      have ?thesis\n      proof (cases \"(C, i) = (C, i')\")\n        case True\n        then have \"i = i'\"\n          by auto\n        then have \"\\<forall>j. (C, j) \\<in># P + {#(C, i')#} \\<longrightarrow> j = i'\"\n          using max backward_reduction_P(6) unfolding True_outer[symmetric] by force\n        then show ?thesis\n          using True_outer[symmetric] nin_P by auto\n      next\n        case False\n        then show ?thesis\n          using C_i_in by auto\n      qed\n    }\n    moreover\n    {\n      assume \"count (P + {#(C, i')#}) (C, i') > 1\"\n      then have ?thesis\n        using C_i_in by auto\n    }\n    ultimately show ?thesis\n      by (cases \"count (P + {#(C, i')#}) (C, i') = 1\") auto\n  next\n    case False\n    then show ?thesis\n      using backward_reduction_P by auto\n  qed\nqed auto\n\nlemma preserve_min_P:\n  assumes\n    \"St \\<leadsto>\\<^sub>w St'\" \"(C, j) \\<in># wP_of_wstate St'\" and\n    \"(C, i) \\<in># wP_of_wstate St\" and\n    \"\\<forall>k. (C, k) \\<in># wP_of_wstate St \\<longrightarrow> i \\<le> k\"\n  shows \"(C, i) \\<in># wP_of_wstate St'\"\n  using assms preserve_min_or_delete_completely by blast\n\nlemma preserve_min_P_Sts:\n  assumes\n    \"enat (Suc k) < llength Sts\" and\n    \"(C, i) \\<in># wP_of_wstate (lnth Sts k)\" and\n    \"(C, j) \\<in># wP_of_wstate (lnth Sts (Suc k))\" and\n    \"\\<forall>j. (C, j) \\<in># wP_of_wstate (lnth Sts k) \\<longrightarrow> i \\<le> j\"\n  shows \"(C, i) \\<in># wP_of_wstate (lnth Sts (Suc k))\"\n  using deriv assms chain_lnth_rel preserve_min_P by metis\n\nlemma in_lnth_in_Supremum_ldrop:\n  assumes \"i < llength xs\" and \"x \\<in># (lnth xs i)\"\n  shows \"x \\<in> Sup_llist (lmap set_mset (ldrop (enat i) xs))\"\n  using assms by (metis (no_types) ldrop_eq_LConsD ldropn_0 llist.simps(13) contra_subsetD\n      ldrop_enat ldropn_Suc_conv_ldropn lnth_0 lnth_lmap lnth_subset_Sup_llist)\n\nlemma persistent_wclause_in_P_if_persistent_clause_in_P:\n  assumes \"C \\<in> Liminf_llist (lmap P_of_state (lmap state_of_wstate Sts))\"\n  shows \"\\<exists>i. (C, i) \\<in> Liminf_llist (lmap (set_mset \\<circ> wP_of_wstate) Sts)\"\nproof -\n  obtain t_C where t_C_p:\n    \"enat t_C < llength Sts\"\n    \"\\<And>t. t_C \\<le> t \\<Longrightarrow> t < llength Sts \\<Longrightarrow> C \\<in> P_of_state (state_of_wstate (lnth Sts t))\"\n    using assms unfolding Liminf_llist_def by auto\n  then obtain i where i_p:\n    \"(C, i) \\<in># wP_of_wstate (lnth Sts t_C)\"\n    using t_C_p by (cases \"lnth Sts t_C\") force\n\n  have Ci_in_nth_wP: \"\\<exists>i. (C, i) \\<in># wP_of_wstate (lnth Sts (t_C + t))\" if \"t_C + t < llength Sts\"\n    for t\n    using that t_C_p(2)[of \"t_C + _\"] by (cases \"lnth Sts (t_C + t)\") force\n\n  define in_Sup_wP :: \"nat \\<Rightarrow> bool\" where\n    \"in_Sup_wP = (\\<lambda>i. (C, i) \\<in> Sup_llist (lmap (set_mset \\<circ> wP_of_wstate) (ldrop t_C Sts)))\"\n\n  have \"in_Sup_wP i\"\n    using i_p assms(1) in_lnth_in_Supremum_ldrop[of t_C \"lmap wP_of_wstate Sts\" \"(C, i)\"] t_C_p\n    by (simp add: in_Sup_wP_def llist.map_comp)\n  then obtain j where j_p: \"is_least in_Sup_wP j\"\n    unfolding in_Sup_wP_def[symmetric] using least_exists by metis\n  then have \"\\<forall>i. (C, i) \\<in> Sup_llist (lmap (set_mset \\<circ> wP_of_wstate) (ldrop t_C Sts)) \\<longrightarrow> j \\<le> i\"\n    unfolding is_least_def in_Sup_wP_def using not_less by blast\n  then have j_smallest:\n    \"\\<And>i t. enat (t_C + t) < llength Sts \\<Longrightarrow> (C, i) \\<in># wP_of_wstate (lnth Sts (t_C + t)) \\<Longrightarrow> j \\<le> i\"\n    unfolding comp_def\n    by (smt add.commute ldrop_enat ldrop_eq_LConsD ldrop_ldrop ldropn_Suc_conv_ldropn\n        plus_enat_simps(1)  lnth_ldropn Sup_llist_def UN_I ldrop_lmap llength_lmap lnth_lmap\n        mem_Collect_eq)\n  from j_p have \"\\<exists>t_Cj. t_Cj < llength (ldrop (enat t_C) Sts)\n    \\<and> (C, j) \\<in># wP_of_wstate (lnth (ldrop t_C Sts) t_Cj)\"\n    unfolding in_Sup_wP_def Sup_llist_def is_least_def by simp\n  then obtain t_Cj where j_p:\n    \"(C,j) \\<in># wP_of_wstate (lnth Sts (t_C + t_Cj))\"\n    \"enat (t_C + t_Cj) < llength Sts\"\n    by (smt add.commute ldrop_enat ldrop_eq_LConsD ldrop_ldrop ldropn_Suc_conv_ldropn\n        plus_enat_simps(1) lhd_ldropn)\n  have Ci_stays:\n    \"t_C + t_Cj + t < llength Sts \\<Longrightarrow> (C,j) \\<in># wP_of_wstate (lnth Sts (t_C + t_Cj + t))\" for t\n  proof (induction t)\n    case 0\n    then show ?case\n      using j_p by (simp add: add.commute)\n  next\n    case (Suc t)\n    have any_Ck_in_wP: \"j \\<le> k\" if \"(C, k) \\<in># wP_of_wstate (lnth Sts (t_C + t_Cj + t))\" for k\n      using that j_p j_smallest Suc\n      by (smt Suc_ile_eq add.commute add.left_commute add_Suc less_imp_le plus_enat_simps(1)\n          the_enat.simps)\n    from Suc have Cj_in_wP: \"(C, j) \\<in># wP_of_wstate (lnth Sts (t_C + t_Cj + t))\"\n      by (metis (no_types, hide_lams) Suc_ile_eq add.commute add_Suc_right less_imp_le)\n    moreover have \"C \\<in> P_of_state (state_of_wstate (lnth Sts (Suc (t_C + t_Cj + t))))\"\n      using t_C_p(2) Suc.prems by auto\n    then have \"\\<exists>k. (C, k) \\<in># wP_of_wstate (lnth Sts (Suc (t_C + t_Cj + t)))\"\n      by (smt Suc.prems Ci_in_nth_wP add.commute add.left_commute add_Suc_right enat_ord_code(4))\n    ultimately have \"(C, j) \\<in># wP_of_wstate (lnth Sts (Suc (t_C + t_Cj + t)))\"\n      using preserve_min_P_Sts Cj_in_wP any_Ck_in_wP Suc.prems by force\n    then have \"(C, j) \\<in># lnth (lmap wP_of_wstate Sts) (Suc (t_C + t_Cj + t))\"\n      using Suc.prems by auto\n    then show ?case\n      by (smt Suc.prems add.commute add_Suc_right lnth_lmap)\n  qed\n  then have \"(\\<And>t. t_C + t_Cj \\<le> t \\<Longrightarrow> t < llength (lmap (set_mset \\<circ> wP_of_wstate) Sts) \\<Longrightarrow>\n    (C, j) \\<in># wP_of_wstate (lnth Sts t))\"\n    using Ci_stays[of \"_ - (t_C + t_Cj)\"] by (metis le_add_diff_inverse llength_lmap)\n  then have \"(C, j) \\<in> Liminf_llist (lmap (set_mset \\<circ> wP_of_wstate) Sts)\"\n    unfolding Liminf_llist_def using j_p by auto\n  then show \"\\<exists>i. (C, i) \\<in> Liminf_llist (lmap (set_mset \\<circ> wP_of_wstate) Sts)\"\n    by auto\nqed\n\nlemma lfinite_not_LNil_nth_llast:\n  assumes \"lfinite Sts\" and \"Sts \\<noteq> LNil\"\n  shows \"\\<exists>i < llength Sts. lnth Sts i = llast Sts \\<and> (\\<forall>j < llength Sts. j \\<le> i)\"\nusing assms proof (induction rule: lfinite.induct)\n  case (lfinite_LConsI xs x)\n  then show ?case\n  proof (cases \"xs = LNil\")\n    case True\n    show ?thesis\n      using True zero_enat_def by auto\n  next\n    case False\n    then obtain i where\n      i_p: \"enat i < llength xs \\<and> lnth xs i = llast xs \\<and> (\\<forall>j < llength xs. j \\<le> enat i)\"\n      using lfinite_LConsI by auto\n    then have \"enat (Suc i) < llength (LCons x xs)\"\n      by (simp add: Suc_ile_eq)\n    moreover from i_p have \"lnth (LCons x xs) (Suc i) = llast (LCons x xs)\"\n      by (metis gr_implies_not_zero llast_LCons llength_lnull lnth_Suc_LCons)\n    moreover from i_p have \"\\<forall>j < llength (LCons x xs). j \\<le> enat (Suc i)\"\n      by (metis antisym_conv2 eSuc_enat eSuc_ile_mono ileI1 iless_Suc_eq llength_LCons)\n    ultimately show ?thesis\n      by auto\n  qed\nqed auto\n\nlemma fair_if_finite:\n  assumes fin: \"lfinite Sts\"\n  shows \"fair_state_seq (lmap state_of_wstate Sts)\"\nproof (rule ccontr)\n  assume unfair: \"\\<not> fair_state_seq (lmap state_of_wstate Sts)\"\n\n  have no_inf_from_last: \"\\<forall>y. \\<not> llast Sts \\<leadsto>\\<^sub>w y\"\n    using fin full_chain_iff_chain[of \"(\\<leadsto>\\<^sub>w)\" Sts] full_deriv by auto\n\n  from unfair obtain C where\n    \"C \\<in> Liminf_llist (lmap N_of_state (lmap state_of_wstate Sts))\n       \\<union> Liminf_llist (lmap P_of_state (lmap state_of_wstate Sts))\"\n    unfolding fair_state_seq_def Liminf_state_def by auto\n  then obtain i where i_p:\n    \"enat i < llength Sts\"\n    \"\\<And>j. i \\<le> j \\<Longrightarrow> enat j < llength Sts \\<Longrightarrow>\n     C \\<in> N_of_state (state_of_wstate (lnth Sts j)) \\<union> P_of_state (state_of_wstate (lnth Sts j))\"\n    unfolding Liminf_llist_def by auto\n\n  have C_in_llast:\n    \"C \\<in> N_of_state (state_of_wstate (llast Sts)) \\<union> P_of_state (state_of_wstate (llast Sts))\"\n  proof -\n    obtain l where\n      l_p: \"enat l < llength Sts \\<and> lnth Sts l = llast Sts \\<and> (\\<forall>j < llength Sts. j \\<le> enat l)\"\n      using fin lfinite_not_LNil_nth_llast i_p(1) by fastforce\n    then have\n      \"C \\<in> N_of_state (state_of_wstate (lnth Sts l)) \\<union> P_of_state (state_of_wstate (lnth Sts l))\"\n      using i_p(1) i_p(2)[of l] by auto\n    then show ?thesis\n      using l_p by auto\n  qed\n\n  define N :: \"'a wclause multiset\" where \"N = wN_of_wstate (llast Sts)\"\n  define P :: \"'a wclause multiset\" where \"P = wP_of_wstate (llast Sts)\"\n  define Q :: \"'a wclause multiset\" where \"Q = wQ_of_wstate (llast Sts)\"\n  define n :: nat where \"n = n_of_wstate (llast Sts)\"\n\n  {\n    assume \"N_of_state (state_of_wstate (llast Sts)) \\<noteq> {}\"\n    then obtain D j where \"(D, j) \\<in># N\"\n      unfolding N_def by (cases \"llast Sts\") auto\n    then have \"llast Sts \\<leadsto>\\<^sub>w (N - {#(D, j)#}, P + {#(D, j)#}, Q, n)\"\n      using weighted_RP.clause_processing[of \"N - {#(D, j)#}\" D j P Q n]\n      unfolding N_def P_def Q_def n_def by auto\n    then have \"\\<exists>St'. llast Sts \\<leadsto>\\<^sub>w St'\"\n      by auto\n  }\n  moreover\n  {\n    assume a: \"N_of_state (state_of_wstate (llast Sts)) = {}\"\n    then have b: \"N = {#}\"\n      unfolding N_def by (cases \"llast Sts\") auto\n    from a have \"C \\<in> P_of_state (state_of_wstate (llast Sts))\"\n      using C_in_llast by auto\n    then obtain D j where \"(D, j) \\<in># P\"\n      unfolding P_def by (cases \"llast Sts\") auto\n    then have \"weight (D, j) \\<in> weight ` set_mset P\"\n      by auto\n    then have \"\\<exists>w. is_least (\\<lambda>w. w \\<in> (weight ` set_mset P)) w\"\n      using least_exists by auto\n    then have \"\\<exists>D j. (\\<forall>(D', j') \\<in># P. weight (D, j) \\<le> weight (D', j')) \\<and> (D, j) \\<in># P\"\n      using assms linorder_not_less unfolding is_least_def by (auto 6 0)\n    then obtain D j where\n      min: \"(\\<forall>(D', j') \\<in># P. weight (D, j) \\<le> weight (D', j'))\" and\n      Dj_in_p: \"(D, j) \\<in># P\"\n      by auto\n    from min have min: \"(\\<forall>(D', j') \\<in># P - {#(D, j)#}. weight (D, j) \\<le> weight (D', j'))\"\n      using mset_subset_diff_self[OF Dj_in_p] by auto\n\n    define N' where\n      \"N' = mset_set ((\\<lambda>D'. (D', n)) ` concls_of (inference_system.inferences_between (ord_FO_\\<Gamma> S)\n         (set_mset (image_mset fst Q)) D))\"\n\n    have \"llast Sts \\<leadsto>\\<^sub>w (N', {#(D', j') \\<in># P - {#(D, j)#}. D' \\<noteq> D#}, Q + {#(D,j)#}, Suc n)\"\n      using weighted_RP.inference_computation[of \"P - {#(D, j)#}\" D j N' n Q, OF min N'_def]\n        of_wstate_split[symmetric, of \"llast Sts\"] Dj_in_p\n      unfolding N_def[symmetric] P_def[symmetric] Q_def[symmetric] n_def[symmetric] b by auto\n    then have \"\\<exists>St'. llast Sts \\<leadsto>\\<^sub>w St'\"\n      by auto\n  }\n  ultimately have \"\\<exists>St'. llast Sts \\<leadsto>\\<^sub>w St'\"\n    by auto\n  then show False\n    using no_inf_from_last by metis\nqed\n\nlemma N_of_state_state_of_wstate_wN_of_wstate:\n  assumes \"C \\<in> N_of_state (state_of_wstate St)\"\n  shows \"\\<exists>i. (C, i) \\<in># wN_of_wstate St\"\n  by (smt N_of_state.elims assms eq_fst_iff fstI fst_conv image_iff of_wstate_split set_image_mset\n      state_of_wstate.simps)\n\nlemma in_wN_of_wstate_in_N_of_wstate: \"(C, i) \\<in># wN_of_wstate St \\<Longrightarrow> C \\<in> N_of_wstate St\"\n  by (metis (mono_guards_query_query) N_of_state.simps fst_conv image_eqI of_wstate_split\n      set_image_mset state_of_wstate.simps)\n\nlemma in_wP_of_wstate_in_P_of_wstate: \"(C, i) \\<in># wP_of_wstate St \\<Longrightarrow> C \\<in> P_of_wstate St\"\n  by (metis (mono_guards_query_query) P_of_state.simps fst_conv image_eqI of_wstate_split\n      set_image_mset state_of_wstate.simps)\n\nlemma in_wQ_of_wstate_in_Q_of_wstate: \"(C, i) \\<in># wQ_of_wstate St \\<Longrightarrow> C \\<in> Q_of_wstate St\"\n  by (metis (mono_guards_query_query) Q_of_state.simps fst_conv image_eqI of_wstate_split\n      set_image_mset state_of_wstate.simps)\n\nlemma n_of_wstate_weighted_RP_increasing: \"St \\<leadsto>\\<^sub>w St' \\<Longrightarrow> n_of_wstate St \\<le> n_of_wstate St'\"\n  by (induction rule: weighted_RP.induct) auto\n\nlemma nth_of_wstate_monotonic:\n  assumes \"j < llength Sts\" and \"i \\<le> j\"\n  shows \"n_of_wstate (lnth Sts i) \\<le> n_of_wstate (lnth Sts j)\"\nusing assms proof (induction \"j - i\" arbitrary: i)\n  case (Suc x)\n  then have \"x = j - (i + 1)\"\n    by auto\n  then have \"n_of_wstate (lnth Sts (i + 1)) \\<le> n_of_wstate (lnth Sts j)\"\n    using Suc by auto\n  moreover have \"i < j\"\n    using Suc by auto\n  then have \"Suc i < llength Sts\"\n    using Suc by (metis enat_ord_simps(2) le_less_Suc_eq less_le_trans not_le)\n  then have \"lnth Sts i \\<leadsto>\\<^sub>w lnth Sts (Suc i)\"\n    using deriv chain_lnth_rel[of \"(\\<leadsto>\\<^sub>w)\" Sts i] by auto\n  then have \"n_of_wstate (lnth Sts i) \\<le> n_of_wstate (lnth Sts (i + 1))\"\n    using n_of_wstate_weighted_RP_increasing[of \"lnth Sts i\" \"lnth Sts (i + 1)\"] by auto\n  ultimately show ?case\n    by auto\nqed auto\n\nlemma infinite_chain_relation_measure:\n  assumes\n    measure_decreasing: \"\\<And>St St'. P St \\<Longrightarrow> R St St' \\<Longrightarrow> (m St', m St) \\<in> mR\" and\n    non_infer_chain: \"chain R (ldrop (enat k) Sts)\" and\n    inf: \"llength Sts = \\<infinity>\" and\n    P: \"\\<And>i. P (lnth (ldrop (enat k) Sts) i)\"\n  shows \"chain (\\<lambda>x y. (x, y) \\<in> mR)\\<inverse>\\<inverse> (lmap m (ldrop (enat k) Sts))\"\nproof (rule lnth_rel_chain)\n  show \"\\<not> lnull (lmap m (ldrop (enat k) Sts))\"\n    using assms by auto\nnext\n  from inf have ldrop_inf: \"llength (ldrop (enat k) Sts) = \\<infinity> \\<and> \\<not> lfinite (ldrop (enat k) Sts)\"\n    using inf by (auto simp: llength_eq_infty_conv_lfinite)\n  {\n    fix j :: \"nat\"\n    define St where \"St = lnth (ldrop (enat k) Sts) j\"\n    define St' where \"St' = lnth (ldrop (enat k) Sts) (j + 1)\"\n    have P': \"P St \\<and> P St'\"\n      unfolding St_def St'_def using P by auto\n    from ldrop_inf have \"R St St'\"\n      unfolding St_def St'_def\n      using non_infer_chain infinite_chain_lnth_rel[of \"ldrop (enat k) Sts\" R j] by auto\n    then have \"(m St', m St) \\<in> mR\"\n      using measure_decreasing P' by auto\n    then have \"(lnth (lmap m (ldrop (enat k) Sts)) (j + 1), lnth (lmap m (ldrop (enat k) Sts)) j)\n      \\<in> mR\"\n      unfolding St_def St'_def using lnth_lmap\n      by (smt enat.distinct(1) enat_add_left_cancel enat_ord_simps(4) inf ldrop_lmap llength_lmap\n          lnth_ldrop plus_enat_simps(3))\n  }\n  then show \"\\<forall>j. enat (j + 1) < llength (lmap m (ldrop (enat k) Sts)) \\<longrightarrow>\n    (\\<lambda>x y. (x, y) \\<in> mR)\\<inverse>\\<inverse> (lnth (lmap m (ldrop (enat k) Sts)) j)\n      (lnth (lmap m (ldrop (enat k) Sts)) (j + 1))\"\n    by blast\nqed\n\ntheorem weighted_RP_fair: \"fair_state_seq (lmap state_of_wstate Sts)\"\nproof (rule ccontr)\n  assume asm: \"\\<not> fair_state_seq (lmap state_of_wstate Sts)\"\n  then have inff: \"\\<not> lfinite Sts\" using fair_if_finite\n    by auto\n  then have inf: \"llength Sts = \\<infinity>\"\n    using llength_eq_infty_conv_lfinite by auto\n  from asm obtain C where\n    \"C \\<in> Liminf_llist (lmap N_of_state (lmap state_of_wstate Sts))\n       \\<union> Liminf_llist (lmap P_of_state (lmap state_of_wstate Sts))\"\n    unfolding fair_state_seq_def Liminf_state_def by auto\n  then show False\n  proof\n    assume \"C \\<in> Liminf_llist (lmap N_of_state (lmap state_of_wstate Sts))\"\n    then obtain x where \"enat x < llength Sts\"\n      \"\\<forall>xa. x \\<le> xa \\<and> enat xa < llength Sts \\<longrightarrow> C \\<in> N_of_state (state_of_wstate (lnth Sts xa))\"\n      unfolding Liminf_llist_def by auto\n    then have \"\\<exists>k. \\<forall>j. k \\<le> j \\<longrightarrow> (\\<exists>i. (C, i) \\<in># wN_of_wstate (lnth Sts j))\"\n      unfolding Liminf_llist_def by (force simp add: inf N_of_state_state_of_wstate_wN_of_wstate)\n    then obtain k where k_p:\n      \"\\<And>j. k \\<le> j \\<Longrightarrow> \\<exists>i. (C, i) \\<in># wN_of_wstate (lnth Sts j)\"\n      unfolding Liminf_llist_def\n      by auto\n    have chain_drop_Sts: \"chain (\\<leadsto>\\<^sub>w) (ldrop k Sts)\"\n      using deriv inf inff inf_chain_ldrop_chain by auto\n    have in_N_j: \"\\<And>j. \\<exists>i. (C, i) \\<in># wN_of_wstate (lnth (ldrop k Sts) j)\"\n      using k_p by (simp add: add.commute inf)\n    then have \"chain (\\<lambda>x y. (x, y) \\<in> RP_filtered_relation)\\<inverse>\\<inverse> (lmap (RP_filtered_measure (\\<lambda>Ci. True))\n      (ldrop k Sts))\"\n      using inff inf weighted_RP_measure_decreasing_N chain_drop_Sts\n        infinite_chain_relation_measure[of \"\\<lambda>St. \\<exists>i. (C, i) \\<in># wN_of_wstate St\" \"(\\<leadsto>\\<^sub>w)\"] by blast\n    then show False\n      using wfP_iff_no_infinite_down_chain_llist[of \"\\<lambda>x y. (x, y) \\<in> RP_filtered_relation\"]\n        wf_RP_filtered_relation inff\n      by (metis (no_types, lifting) inf_llist_lnth ldrop_enat_inf_llist lfinite_inf_llist\n        lfinite_lmap wfPUNIVI wf_induct_rule)\n  next\n    assume asm: \"C \\<in> Liminf_llist (lmap P_of_state (lmap state_of_wstate Sts))\"\n    from asm obtain i where i_p:\n      \"enat i < llength Sts\"\n      \"\\<And>j. i \\<le> j \\<and> enat j < llength Sts \\<Longrightarrow> C \\<in> P_of_state (state_of_wstate (lnth Sts j))\"\n      unfolding Liminf_llist_def by auto\n    then obtain i where \"(C, i) \\<in> Liminf_llist (lmap (set_mset \\<circ> wP_of_wstate) Sts)\"\n      using persistent_wclause_in_P_if_persistent_clause_in_P[of C] using asm inf by auto\n    then have \"\\<exists>l. \\<forall>k \\<ge> l. (C, i) \\<in> (set_mset \\<circ> wP_of_wstate) (lnth Sts k)\"\n      unfolding Liminf_llist_def using inff inf by auto\n    then obtain k where k_p:\n      \"(\\<forall>k'\\<ge>k. (C, i) \\<in> (set_mset \\<circ> wP_of_wstate) (lnth Sts k'))\"\n      by blast\n    have Ci_in: \"\\<forall>k'. (C, i) \\<in> (set_mset \\<circ> wP_of_wstate) (lnth (ldrop k Sts) k')\"\n      using k_p lnth_ldrop[of k _ Sts] inf inff by force\n    then have Ci_inn: \"\\<forall>k'. (C, i) \\<in># (wP_of_wstate) (lnth (ldrop k Sts) k')\"\n      by auto\n    have \"chain (\\<leadsto>\\<^sub>w) (ldrop k Sts)\"\n      using deriv inf_chain_ldrop_chain inf inff by auto\n    then have \"chain (\\<lambda>x y. (x, y) \\<in> RP_combined_relation)\\<inverse>\\<inverse>\n      (lmap (RP_combined_measure (weight (C, i))) (ldrop k Sts))\"\n      using inff inf Ci_in weighted_RP_measure_decreasing_P\n        infinite_chain_relation_measure[of \"\\<lambda>St. (C, i) \\<in># wP_of_wstate St\" \"(\\<leadsto>\\<^sub>w)\"\n          \"RP_combined_measure (weight (C, i))\" ]\n      by auto\n    then show False\n      using wfP_iff_no_infinite_down_chain_llist[of \"\\<lambda>x y. (x, y) \\<in> RP_combined_relation\"]\n        wf_RP_combined_relation inff\n      by (smt inf_llist_lnth ldrop_enat_inf_llist lfinite_inf_llist lfinite_lmap wfPUNIVI\n          wf_induct_rule)\n  qed\nqed\n\ncorollary weighted_RP_saturated: \"src.saturated_upto (Liminf_llist (lmap grounding_of_wstate Sts))\"\n  using RP_saturated_if_fair[OF deriv_RP empty_Q0_RP weighted_RP_fair, unfolded llist.map_comp]\n  by simp\n\ncorollary weighted_RP_complete:\n  \"\\<not> satisfiable (grounding_of_wstate (lhd Sts)) \\<Longrightarrow> {#} \\<in> Q_of_state (Liminf_wstate Sts)\"\n  using RP_complete_if_fair[OF deriv_RP empty_Q0_RP weighted_RP_fair, simplified lhd_lmap_Sts]\n  by simp\n\nend\n\nend\n\nlocale weighted_FO_resolution_prover_with_size_timestamp_factors =\n  FO_resolution_prover S subst_atm id_subst comp_subst renamings_apart atm_of_atms mgu less_atm\n  for\n    S :: \"('a :: wellorder) clause \\<Rightarrow> 'a clause\" and\n    subst_atm :: \"'a \\<Rightarrow> 's \\<Rightarrow> 'a\" and\n    id_subst :: \"'s\" and\n    comp_subst :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's\" and\n    renamings_apart :: \"'a literal multiset list \\<Rightarrow> 's list\" and\n    atm_of_atms :: \"'a list \\<Rightarrow> 'a\" and\n    mgu :: \"'a set set \\<Rightarrow> 's option\" and\n    less_atm :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\" +\n  fixes\n    size_atm :: \"'a \\<Rightarrow> nat\" and\n    size_factor :: nat and\n    timestamp_factor :: nat\n  assumes\n    timestamp_factor_pos: \"timestamp_factor > 0\"\nbegin\n\nfun weight :: \"'a wclause \\<Rightarrow> nat\" where\n  \"weight (C, i) = size_factor * size_multiset (size_literal size_atm) C + timestamp_factor * i\"\n\nlemma weight_mono: \"i < j \\<Longrightarrow> weight (C, i) < weight (C, j)\"\n  using timestamp_factor_pos by simp\n\ndeclare weight.simps [simp del]\n\nsublocale wrp: weighted_FO_resolution_prover _ _ _ _ _ _ _ _ weight\n  by unfold_locales (rule weight_mono)\n\nnotation wrp.weighted_RP (infix \"\\<leadsto>\\<^sub>w\" 50)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Functional_Ordered_Resolution_Prover/Weighted_FO_Ordered_Resolution_Prover.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878414043814, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.324345982102401}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Bisim_Pres\n  imports Weak_Late_Bisim_SC Weak_Late_Sim_Pres Strong_Late_Bisim_SC\nbegin\n\nlemma tauPres:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"\\<tau>.(P) \\<approx> \\<tau>.(Q)\"\nproof -\n  let ?X = \"{(\\<tau>.(P), \\<tau>.(Q)) | P Q. P \\<approx> Q}\"\n  from assms have \"(\\<tau>.(P), \\<tau>.(Q)) \\<in> ?X\" by auto\n  thus ?thesis\n    by(coinduct rule: weakBisimCoinduct)\n      (auto simp add: pi.inject intro:  Weak_Late_Sim_Pres.tauPres symmetric)\nqed\n\nlemma inputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   x :: name\n\n  assumes PSimQ: \"\\<forall>y. P[x::=y] \\<approx> Q[x::=y]\"\n  \n  shows \"a<x>.P \\<approx> a<x>.Q\"\nproof -\n  let ?X = \"{(a<x>.P, a<x>.Q) | a x P Q. \\<forall>y. P[x::=y] \\<approx> Q[x::=y]}\"\n  {\n    fix axP axQ p\n    assume \"(axP, axQ) \\<in> ?X\"\n    then obtain a x P Q where A: \"\\<forall>y. P[x::=y] \\<approx> Q[x::=y]\" and B: \"axP = a<x>.P\" and C: \"axQ = a<x>.Q\"\n      by auto\n    have \"\\<And>y. ((p::name prm) \\<bullet> P)[(p \\<bullet> x)::=y] \\<approx> (p \\<bullet> Q)[(p \\<bullet> x)::=y]\"\n    proof -\n      fix y\n      from A have \"P[x::=(rev p \\<bullet> y)] \\<approx> Q[x::=(rev p \\<bullet> y)]\"\n        by blast\n      hence \"(p \\<bullet> (P[x::=(rev p \\<bullet> y)])) \\<approx> p \\<bullet> (Q[x::=(rev p \\<bullet> y)])\"\n        by(rule eqvtI)\n      thus \"(p \\<bullet> P)[(p \\<bullet> x)::=y] \\<approx> (p \\<bullet> Q)[(p \\<bullet> x)::=y]\"\n        by(simp add: eqvts pt_pi_rev[OF pt_name_inst, OF at_name_inst])\n    qed\n    hence \"((p::name prm) \\<bullet> axP, p \\<bullet> axQ) \\<in> ?X\" using B C\n      by auto\n  }\n  hence \"eqvt ?X\" by(simp add: eqvt_def)\n\n  from PSimQ have \"(a<x>.P, a<x>.Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cSim P Q)\n    thus ?case using `eqvt ?X`\n      by(force intro: inputPres)\n  next\n    case(cSym P Q)\n    thus ?case\n      by(blast dest: symmetric)\n  qed\nqed\n\nlemma outputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"a{b}.(P) \\<approx> a{b}.(Q)\"\nproof -\n  let ?X = \"{(a{b}.(P), a{b}.(Q)) | a b P Q. P \\<approx> Q}\"\n  from assms have \"(a{b}.(P), a{b}.(Q)) \\<in> ?X\" by auto\n  thus ?thesis\n    by(coinduct rule: weakBisimCoinduct)\n      (auto simp add: pi.inject intro:  Weak_Late_Sim_Pres.outputPres symmetric)\nqed\n\n\n\n  shows \"<\\<nu>x>P \\<approx> <\\<nu>x>Q\"\nproof -\n  let ?X = \"{x. \\<exists>P Q. P \\<approx> Q \\<and> (\\<exists>a. x = (<\\<nu>a>P, <\\<nu>a>Q))}\"\n  from PBiSimQ have \"(<\\<nu>x>P, <\\<nu>x>Q) \\<in> ?X\" by blast\n  moreover have \"\\<And>P Q a. P \\<leadsto>\\<^sup>^<weakBisim> Q \\<Longrightarrow> <\\<nu>a>P \\<leadsto>\\<^sup>^<(?X \\<union> weakBisim)> <\\<nu>a>Q\"\n  proof -\n    fix P Q a\n    assume PSimQ: \"P \\<leadsto>\\<^sup>^<weakBisim> Q\"\n    moreover have \"\\<And>P Q a. P \\<approx> Q \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> ?X \\<union> weakBisim\" by blast\n    moreover have \"weakBisim \\<subseteq> ?X \\<union> weakBisim\" by blast\n    moreover have \"eqvt weakBisim\" by(rule eqvt)\n    moreover have \"eqvt (?X \\<union> weakBisim)\"\n      by(auto simp add: eqvt_def dest: eqvtI)+\n    ultimately show \"<\\<nu>a>P \\<leadsto>\\<^sup>^<(?X \\<union> weakBisim)> <\\<nu>a>Q\"\n      by(rule Weak_Late_Sim_Pres.resPres)\n  qed\n    \n  ultimately show ?thesis using PBiSimQ\n    by(coinduct rule: weakBisimCoinductAux, blast dest: unfoldE)\nqed\n\n\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"[a\\<frown>b]P \\<approx> [a\\<frown>b]Q\"\nproof -\n  let ?X = \"{([a\\<frown>b]P, [a\\<frown>b]Q) | a b P Q. P \\<approx> Q}\"\n  from assms have \"([a\\<frown>b]P, [a\\<frown>b]Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cSim P Q)\n    {\n      fix P Q a b\n      assume \"P \\<approx> Q\"\n      hence \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(rule unfoldE)\n      moreover {\n        fix P Q a\n        assume \"P \\<approx> Q\"\n        moreover have \"[a\\<frown>a]P \\<approx> P\" by(rule matchId)\n        ultimately have \"[a\\<frown>a]P \\<approx> Q\" by(blast intro: transitive)\n      }\n      moreover have \"weakBisim \\<subseteq> ?X \\<union> weakBisim\" by blast\n      ultimately have \"[a\\<frown>b]P \\<leadsto>\\<^sup>^<(?X \\<union> weakBisim)> [a\\<frown>b]Q\"\n        by(rule matchPres)\n    }\n    with `(P, Q) \\<in> ?X` show ?case by auto\n  next\n    case(cSym P Q)\n    thus ?case by(auto simp add: pi.inject dest: symmetric)\n  qed\nqed\n\nlemma mismatchPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"[a\\<noteq>b]P \\<approx> [a\\<noteq>b]Q\"\nproof -\n  let ?X = \"{([a\\<noteq>b]P, [a\\<noteq>b]Q) | a b P Q. P \\<approx> Q}\"\n  from assms have \"([a\\<noteq>b]P, [a\\<noteq>b]Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cSim P Q)\n    {\n      fix P Q a b\n      assume \"P \\<approx> Q\"\n      hence \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(rule unfoldE)\n      moreover {\n        fix P Q a b\n        assume \"P \\<approx> Q\" and \"(a::name) \\<noteq> b\"\n        note `P \\<approx> Q`\n        moreover from `a \\<noteq> b` have \"[a\\<noteq>b]P \\<approx> P\" by(rule mismatchId)\n        ultimately have \"[a\\<noteq>b]P \\<approx> Q\" by(blast intro: transitive)\n      }\n      moreover have \"weakBisim \\<subseteq> ?X \\<union> weakBisim\" by blast\n      ultimately have \"[a\\<noteq>b]P \\<leadsto>\\<^sup>^<(?X \\<union> weakBisim)> [a\\<noteq>b]Q\"\n        by(rule mismatchPres)\n    }\n    with `(P, Q) \\<in> ?X` show ?case by auto\n  next\n    case(cSym P Q)\n    thus ?case by(auto simp add: pi.inject dest: symmetric)\n  qed\nqed\n\nlemma parPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"P \\<parallel> R \\<approx> Q \\<parallel> R\"\nproof -\n  let ?ParSet = \"{(resChain lst (P \\<parallel> R), resChain lst (Q \\<parallel> R)) | lst P Q R. P \\<approx> Q}\"\n  have BC: \"\\<And>P Q. P \\<parallel> Q = resChain [] (P \\<parallel> Q)\" by auto\n  from assms have \"(P \\<parallel> R, Q \\<parallel> R) \\<in> ?ParSet\" by(blast intro: BC)\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cSim PR QR)\n    {\n      fix P Q R lst\n      assume \"P \\<approx> Q\"\n    \n      from eqvtI have \"eqvt (?ParSet \\<union> weakBisim)\"\n        by(auto simp add: eqvt_def, blast)\n      moreover have \"\\<And>P Q a. (P, Q) \\<in> ?ParSet \\<union> weakBisim \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> ?ParSet \\<union> weakBisim\"\n        by(blast intro: resChain.step[THEN sym] resPres)\n      moreover {\n        from `P \\<approx> Q` have \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(rule unfoldE)\n        moreover note `P \\<approx> Q`\n        moreover {\n          fix P Q R\n          assume \"P \\<approx> Q\"\n          moreover have \"P \\<parallel> R = resChain [] (P \\<parallel> R)\" by simp\n          moreover have \"Q \\<parallel> R = resChain [] (Q \\<parallel> R)\" by simp\n          ultimately have \"(P \\<parallel> R, Q \\<parallel> R) \\<in> ?ParSet \\<union> weakBisim\" by blast\n        }\n        moreover {\n          fix P Q a\n          assume A: \"(P, Q) \\<in> ?ParSet \\<union> weakBisim\"\n          hence \"(<\\<nu>a>P, <\\<nu>a>Q) \\<in> ?ParSet \\<union> weakBisim\" (is \"?goal\")\n            apply(auto intro: resPres)\n            by(rule_tac x=\"a#lst\" in exI) auto\n        }\n        ultimately have \"(P \\<parallel> R) \\<leadsto>\\<^sup>^<(?ParSet \\<union> weakBisim)> (Q \\<parallel> R)\" using eqvt `eqvt(?ParSet \\<union> weakBisim)`\n          by(rule Weak_Late_Sim_Pres.parPres)\n      }\n\n      ultimately have \"resChain lst (P \\<parallel> R) \\<leadsto>\\<^sup>^<(?ParSet \\<union> weakBisim)> resChain lst (Q \\<parallel> R)\"\n        by(rule resChainI)\n    }\n    with `(PR, QR) \\<in> ?ParSet` show ?case by blast\n  next\n    case(cSym PR QR)\n    thus ?case by(auto dest: symmetric)\n  qed\nqed\n\n\n\n  assumes PBisimQ: \"P \\<approx> Q\"\n\n  shows \"!P \\<approx> !Q\"\nproof -\n  let ?X = \"(bangRel weakBisim)\"\n  let ?Y = \"Strong_Late_Bisim.bisim O (bangRel weakBisim) O Strong_Late_Bisim.bisim\"\n\n  from eqvt Strong_Late_Bisim.bisimEqvt have eqvtY: \"eqvt ?Y\" by(blast intro: eqvtBangRel)\n  have XsubY: \"?X \\<subseteq> ?Y\" by(auto intro: Strong_Late_Bisim.reflexive)\n\n  have RelStay: \"\\<And>P Q. (P \\<parallel> !P, Q) \\<in> ?Y \\<Longrightarrow> (!P, Q) \\<in> ?Y\"\n  proof(auto)\n    fix P Q R T\n    assume PBisimQ: \"P \\<parallel> !P \\<sim> Q\" \n       and QBRR: \"(Q, R) \\<in> bangRel weakBisim\"\n       and RBisimT: \"R \\<sim> T\"\n    have \"!P \\<sim> Q\" \n    proof -\n      have \"!P \\<sim> P \\<parallel> !P\" by(rule Strong_Late_Bisim_SC.bangSC)\n      thus ?thesis using PBisimQ by(rule Strong_Late_Bisim.transitive)\n    qed\n    with QBRR RBisimT show \"(!P, T) \\<in> ?Y\" by blast\n  qed\n \n  have ParCompose: \"\\<And>P Q R T. \\<lbrakk>P \\<approx> Q; (R, T) \\<in> ?Y\\<rbrakk> \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> T) \\<in> ?Y\"\n  proof -\n    fix P Q R T\n    assume PBisimQ: \"P \\<approx> Q\"\n       and RYT:     \"(R, T) \\<in> ?Y\"\n    thus \"(P \\<parallel> R, Q \\<parallel> T) \\<in> ?Y\"\n    proof(auto)\n      fix T' R'\n      assume T'BisimT: \"T' \\<sim> T\" and RBisimR': \"R \\<sim> R'\"\n         and R'BRT': \"(R', T') \\<in> bangRel weakBisim\"\n      have \"P \\<parallel> R \\<sim> P \\<parallel> R'\"\n      proof -\n        from RBisimR' have \"R \\<parallel> P \\<sim> R' \\<parallel> P\" by(rule Strong_Late_Bisim_Pres.parPres)\n        moreover have \"P \\<parallel> R \\<sim> R \\<parallel> P\" and \"R' \\<parallel> P \\<sim> P \\<parallel> R'\" by(rule Strong_Late_Bisim_SC.parSym)+\n        ultimately show ?thesis by(blast intro: Strong_Late_Bisim.transitive)\n      qed\n      moreover from PBisimQ R'BRT' have \"(P \\<parallel> R', Q \\<parallel> T') \\<in> bangRel weakBisim\" by(rule BRPar)\n      moreover have \"Q \\<parallel> T' \\<sim> Q \\<parallel> T\"\n      proof -\n        from T'BisimT have \"T' \\<parallel> Q \\<sim> T \\<parallel> Q\" by(rule Strong_Late_Bisim_Pres.parPres)\n        moreover have \"Q \\<parallel> T' \\<sim> T' \\<parallel> Q\" and \"T \\<parallel> Q \\<sim> Q \\<parallel> T\" by(rule Strong_Late_Bisim_SC.parSym)+\n        ultimately show ?thesis by(blast intro: Strong_Late_Bisim.transitive)\n      qed\n      ultimately show ?thesis by blast\n    qed\n  qed\n\n  have ResCong: \"\\<And>P Q x. (P, Q) \\<in> ?Y \\<Longrightarrow> (<\\<nu>x>P, <\\<nu>x>Q) \\<in> ?Y\"\n    by(auto intro: BRRes Strong_Late_Bisim_Pres.resPres transitive)\n\n  from PBisimQ have \"(!P, !Q) \\<in> ?X\" by(rule BRBang)\n  moreover from eqvt have \"eqvt (bangRel weakBisim)\" by(rule eqvtBangRel)\n  ultimately show ?thesis\n  proof(coinduct rule: weakBisimTransitiveCoinduct)\n    case(cSim P Q)\n    from `(P, Q) \\<in> ?X`\n    show \"P \\<leadsto>\\<^sup>^<?Y> Q\"\n    proof(induct)\n      case(BRBang P Q)\n      have \"P \\<approx> Q\" by fact\n      moreover hence \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(blast dest: unfoldE)\n      moreover have \"\\<And>P Q. P \\<approx> Q \\<Longrightarrow> P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(blast dest: unfoldE)\n      moreover from Strong_Late_Bisim.bisimEqvt eqvt have \"eqvt ?Y\" by(blast intro: eqvtBangRel)\n\n      ultimately show \"!P \\<leadsto>\\<^sup>^<?Y> !Q\" using ParCompose ResCong RelStay XsubY\n        by(rule_tac Weak_Late_Sim_Pres.bangPres, simp_all)\n    next\n      case(BRPar P Q R T)\n      have PBiSimQ: \"P \\<approx> Q\" by fact\n      have RBangRelT: \"(R, T) \\<in> ?X\" by fact\n      have RSimT: \"R \\<leadsto>\\<^sup>^<?Y> T\" by fact\n      moreover from PBiSimQ  have \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(blast dest: unfoldE)\n      moreover from RBangRelT have \"(R, T) \\<in> ?Y\" by(blast intro: Strong_Late_Bisim.reflexive)\n      ultimately show \"P \\<parallel> R \\<leadsto>\\<^sup>^<?Y> Q \\<parallel> T\" using ParCompose ResCong eqvt eqvtY `P \\<approx> Q`\n        by(rule_tac Weak_Late_Sim_Pres.parCompose)\n    next\n      case(BRRes P Q x)\n      have \"P \\<leadsto>\\<^sup>^<?Y> Q\" by fact\n      thus \"<\\<nu>x>P \\<leadsto>\\<^sup>^<?Y> <\\<nu>x>Q\" using ResCong eqvtY XsubY\n        by(rule_tac Weak_Late_Sim_Pres.resPres, simp_all)\n    qed\n  next\n    case(cSym P Q)\n    thus ?case by(metis symmetric bangRelSymetric)\n  qed\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Weak_Late_Bisim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.32424669288441366}}
{"text": "(*\n    Author:   Benedikt Seidl\n    License:  BSD\n*)\n\nsection \\<open>Asymmetric Variant of the Master Theorem\\<close>\n\ntheory Asymmetric_Master_Theorem\nimports\n  Advice After\nbegin\n\ntext \\<open>This variant of the Master Theorem fixes only a subset @{term Y}\n      of @{term \\<nu>LTL} subformulas and all conditions depend on the\n      index @{term i}. While this does not lead to a simple DRA construction,\n      but can be used to build NBAs and LDBAs.\\<close>\n\nlemma FG_advice_b1_helper:\n  \"\\<psi> \\<in> subfrmlsn \\<phi> \\<Longrightarrow> suffix i w \\<Turnstile>\\<^sub>n \\<psi> \\<Longrightarrow> suffix i w \\<Turnstile>\\<^sub>n \\<psi>[\\<F>\\<G> \\<phi> w]\\<^sub>\\<mu>\"\nproof -\n  assume \"\\<psi> \\<in> subfrmlsn \\<phi>\"\n\n  then have \"\\<F>\\<G> \\<psi> (suffix i w) \\<subseteq> \\<F>\\<G> \\<phi> w\"\n    using \\<F>\\<G>_suffix subformulas\\<^sub>\\<nu>_subset unfolding \\<F>\\<G>_semantics' by fast\n\n  moreover\n\n  assume \"suffix i w \\<Turnstile>\\<^sub>n \\<psi>\"\n\n  ultimately show \"suffix i w \\<Turnstile>\\<^sub>n \\<psi>[\\<F>\\<G> \\<phi> w]\\<^sub>\\<mu>\"\n    using FG_advice_b1 by blast\nqed\n\nlemma FG_advice_b2_helper:\n  \"S \\<subseteq> \\<G> \\<phi> (suffix i w) \\<Longrightarrow> i \\<le> j \\<Longrightarrow> suffix j w \\<Turnstile>\\<^sub>n \\<psi>[S]\\<^sub>\\<mu> \\<Longrightarrow> suffix j w \\<Turnstile>\\<^sub>n \\<psi>\"\nproof -\n  fix i j\n  assume \"S \\<subseteq> \\<G> \\<phi> (suffix i w)\" and \"i \\<le> j\" and \"suffix j w \\<Turnstile>\\<^sub>n \\<psi>[S]\\<^sub>\\<mu>\"\n\n  then have \"suffix j w \\<Turnstile>\\<^sub>n \\<psi>[S \\<inter> subformulas\\<^sub>\\<nu> \\<psi>]\\<^sub>\\<mu>\"\n    using FG_advice_inter_subformulas by metis\n\n  moreover\n\n  have \"S \\<inter> subformulas\\<^sub>\\<nu> \\<psi> \\<subseteq> \\<G> \\<psi> (suffix i w)\"\n    using `S \\<subseteq> \\<G> \\<phi> (suffix i w)` unfolding \\<G>_semantics' by blast\n  then have \"S \\<inter> subformulas\\<^sub>\\<nu> \\<psi> \\<subseteq> \\<G> \\<psi> (suffix j w)\"\n    using \\<G>_suffix \\<open>i \\<le> j\\<close> inf.absorb_iff2 le_Suc_ex by fastforce\n\n  ultimately show \"suffix j w \\<Turnstile>\\<^sub>n \\<psi>\"\n    using FG_advice_b2 by blast\nqed\n\nlemma Y_\\<G>:\n  assumes\n    Y_\\<nu>: \"Y \\<subseteq> subformulas\\<^sub>\\<nu> \\<phi>\"\n  and\n    Y_G_1: \"\\<forall>\\<psi>\\<^sub>1 \\<psi>\\<^sub>2. \\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2 \\<in> Y \\<longrightarrow> suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)\"\n  and\n    Y_G_2: \"\\<forall>\\<psi>\\<^sub>1 \\<psi>\\<^sub>2. \\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2 \\<in> Y \\<longrightarrow> suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1[Y]\\<^sub>\\<mu> or\\<^sub>n \\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)\"\n  shows\n    \"Y \\<subseteq> \\<G> \\<phi> (suffix i w)\"\nproof -\n  \\<comment> \\<open>Custom induction rule with @{term size} as a partial order\\<close>\n  note induct = finite_ranking_induct[where f = size]\n\n  have \"finite Y\"\n    using Y_\\<nu> finite_subset subformulas\\<^sub>\\<nu>_finite by auto\n\n  then show ?thesis\n    using assms\n  proof (induction Y rule: induct)\n    case (insert \\<psi> S)\n\n    show ?case\n    proof (cases \"\\<psi> \\<notin> S\")\n      assume \"\\<psi> \\<notin> S\"\n\n      note FG_advice_insert = FG_advice_insert[OF `\\<psi> \\<notin> S`]\n\n      {\n        \\<comment> \\<open>Show @{term \"S \\<subseteq> \\<G> \\<phi> (suffix i w)\"}\\<close>\n\n        {\n          fix \\<psi>\\<^sub>1 \\<psi>\\<^sub>2\n          assume \"\\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2 \\<in> S\"\n\n          then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n \\<psi>\\<^sub>2[insert \\<psi> S]\\<^sub>\\<mu>\"\n            using insert(5) by blast\n\n          then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n \\<psi>\\<^sub>2[S]\\<^sub>\\<mu>\"\n            using `\\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2 \\<in> S` FG_advice_insert insert.hyps(2)\n            by fastforce\n        }\n\n        moreover\n\n        {\n          fix \\<psi>\\<^sub>1 \\<psi>\\<^sub>2\n          assume \"\\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2 \\<in> S\"\n\n          then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1[insert \\<psi> S]\\<^sub>\\<mu> or\\<^sub>n \\<psi>\\<^sub>2[insert \\<psi> S]\\<^sub>\\<mu>)\"\n            using insert(6) by blast\n\n          then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1[S]\\<^sub>\\<mu> or\\<^sub>n \\<psi>\\<^sub>2[S]\\<^sub>\\<mu>)\"\n            using `\\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2 \\<in> S` FG_advice_insert insert.hyps(2)\n            by fastforce\n        }\n\n        ultimately\n\n        have \"S \\<subseteq> \\<G> \\<phi> (suffix i w)\"\n          using insert.IH insert.prems(1) by blast\n      }\n\n      moreover\n\n      {\n        \\<comment> \\<open>Show @{term \"\\<psi> \\<in> \\<G> \\<phi> (suffix i w)\"}\\<close>\n\n        have \"\\<psi> \\<in> subformulas\\<^sub>\\<nu> \\<phi>\"\n          using insert.prems(1) by fast\n        then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n \\<psi>\"\n          using subformulas\\<^sub>\\<nu>_semantics\n        proof (cases \\<psi>)\n          case (Release_ltln \\<psi>\\<^sub>1 \\<psi>\\<^sub>2)\n\n          then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n \\<psi>\\<^sub>2[insert \\<psi> S]\\<^sub>\\<mu>\"\n            using insert.prems(2) by blast\n          then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n \\<psi>\\<^sub>2[S]\\<^sub>\\<mu>\"\n            using Release_ltln FG_advice_insert by simp\n          then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n \\<psi>\\<^sub>2\"\n            using FG_advice_b2_helper[OF `S \\<subseteq> \\<G> \\<phi> (suffix i w)`] by auto\n          then show ?thesis\n            using Release_ltln globally_release\n            by blast\n        next\n          case (WeakUntil_ltln \\<psi>\\<^sub>1 \\<psi>\\<^sub>2)\n\n          then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1[insert \\<psi> S]\\<^sub>\\<mu> or\\<^sub>n \\<psi>\\<^sub>2[insert \\<psi> S]\\<^sub>\\<mu>)\"\n            using insert.prems(3) by blast\n          then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1 or\\<^sub>n \\<psi>\\<^sub>2)[S]\\<^sub>\\<mu>\"\n            using WeakUntil_ltln FG_advice_insert by simp\n          then have \"suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1 or\\<^sub>n \\<psi>\\<^sub>2)\"\n            using FG_advice_b2_helper[OF `S \\<subseteq> \\<G> \\<phi> (suffix i w)`, of _ \"\\<psi>\\<^sub>1 or\\<^sub>n \\<psi>\\<^sub>2\"]\n            by force\n          then show ?thesis\n            unfolding WeakUntil_ltln semantics_ltln.simps\n            by (metis order_refl suffix_suffix)\n        qed fast+\n\n        then have \"\\<psi> \\<in> \\<G> \\<phi> (suffix i w)\"\n          unfolding \\<G>_semantics using `\\<psi> \\<in> subformulas\\<^sub>\\<nu> \\<phi>`\n          by simp\n      }\n\n      ultimately show ?thesis\n        by blast\n    next\n      assume \"\\<not> \\<psi> \\<notin> S\"\n      then have \"insert \\<psi> S = S\"\n        by auto\n      then show ?thesis\n        using insert by simp\n    qed\n  qed simp\nqed\n\ntheorem asymmetric_master_theorem_ltr:\n  assumes\n    \"w \\<Turnstile>\\<^sub>n \\<phi>\"\n  obtains Y and i where\n    \"Y \\<subseteq> subformulas\\<^sub>\\<nu> \\<phi>\"\n  and\n    \"suffix i w \\<Turnstile>\\<^sub>n af \\<phi> (prefix i w)[Y]\\<^sub>\\<mu>\"\n  and\n    \"\\<forall>\\<psi>\\<^sub>1 \\<psi>\\<^sub>2. \\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2 \\<in> Y \\<longrightarrow> suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)\"\n  and\n    \"\\<forall>\\<psi>\\<^sub>1 \\<psi>\\<^sub>2. \\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2 \\<in> Y \\<longrightarrow> suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1[Y]\\<^sub>\\<mu> or\\<^sub>n \\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)\"\nproof\n  let ?Y = \"\\<F>\\<G> \\<phi> w\"\n\n  show \"?Y \\<subseteq> subformulas\\<^sub>\\<nu> \\<phi>\"\n    by (rule \\<F>\\<G>_subformulas\\<^sub>\\<nu>)\nnext\n  let ?Y = \"\\<F>\\<G> \\<phi> w\"\n  let ?i = \"SOME i. ?Y = \\<G> \\<phi> (suffix i w)\"\n\n  have \"suffix ?i w \\<Turnstile>\\<^sub>n af \\<phi> (prefix ?i w)\"\n    using af_ltl_continuation \\<open>w \\<Turnstile>\\<^sub>n \\<phi>\\<close> by fastforce\n  then show \"suffix ?i w \\<Turnstile>\\<^sub>n af \\<phi> (prefix ?i w)[?Y]\\<^sub>\\<mu>\"\n    by (metis \\<F>\\<G>_suffix FG_advice_b1 \\<F>\\<G>_af order_refl)\nnext\n  let ?Y = \"\\<F>\\<G> \\<phi> w\"\n  let ?i = \"SOME i. ?Y = \\<G> \\<phi> (suffix i w)\"\n\n  have \"\\<exists>i. ?Y = \\<G> \\<phi> (suffix i w)\"\n    using suffix_\\<nu>_stable \\<F>\\<G>_suffix unfolding \\<nu>_stable_def MOST_nat\n    by fast\n  then have Y_G: \"?Y = \\<G> \\<phi> (suffix ?i w)\"\n    by (metis (mono_tags, lifting) someI_ex)\n\n  show \"\\<forall>\\<psi>\\<^sub>1 \\<psi>\\<^sub>2. \\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2 \\<in> ?Y \\<longrightarrow> suffix ?i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>2[?Y]\\<^sub>\\<mu>)\"\n  proof safe\n    fix \\<psi>\\<^sub>1 \\<psi>\\<^sub>2\n    assume \"\\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2 \\<in> ?Y\"\n\n    then have \"suffix ?i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2)\"\n      using Y_G \\<G>_semantics' by blast\n    then have \"suffix ?i w \\<Turnstile>\\<^sub>n G\\<^sub>n \\<psi>\\<^sub>2\"\n      by force\n\n    moreover\n\n    have \"\\<psi>\\<^sub>2 \\<in> subfrmlsn \\<phi>\"\n      using \\<F>\\<G>_subfrmlsn `\\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2 \\<in> ?Y` subfrmlsn_subset by force\n\n    ultimately show \"suffix ?i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>2 [?Y]\\<^sub>\\<mu>)\"\n      using FG_advice_b1_helper by fastforce\n  qed\nnext\n  let ?Y = \"\\<F>\\<G> \\<phi> w\"\n  let ?i = \"SOME i. ?Y = \\<G> \\<phi> (suffix i w)\"\n\n  have \"\\<exists>i. ?Y = \\<G> \\<phi> (suffix i w)\"\n    using suffix_\\<nu>_stable \\<F>\\<G>_suffix unfolding \\<nu>_stable_def MOST_nat\n    by fast\n  then have Y_G: \"?Y = \\<G> \\<phi> (suffix ?i w)\"\n    by (rule someI_ex)\n\n  show \"\\<forall>\\<psi>\\<^sub>1 \\<psi>\\<^sub>2. \\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2 \\<in> ?Y \\<longrightarrow> suffix ?i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1[?Y]\\<^sub>\\<mu> or\\<^sub>n \\<psi>\\<^sub>2[?Y]\\<^sub>\\<mu>)\"\n  proof safe\n    fix \\<psi>\\<^sub>1 \\<psi>\\<^sub>2\n    assume \"\\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2 \\<in> ?Y\"\n\n    then have \"suffix ?i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2)\"\n      using Y_G \\<G>_semantics' by blast\n    then have \"suffix ?i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1 or\\<^sub>n \\<psi>\\<^sub>2)\"\n      by force\n\n    moreover\n\n    have \"\\<psi>\\<^sub>1 \\<in> subfrmlsn \\<phi>\" and \"\\<psi>\\<^sub>2 \\<in> subfrmlsn \\<phi>\"\n      using \\<F>\\<G>_subfrmlsn `\\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2 \\<in> ?Y` subfrmlsn_subset by force+\n\n    ultimately show \"suffix ?i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1[?Y]\\<^sub>\\<mu> or\\<^sub>n \\<psi>\\<^sub>2[?Y]\\<^sub>\\<mu>)\"\n      using FG_advice_b1_helper by fastforce\n  qed\nqed\n\ntheorem asymmetric_master_theorem_rtl:\n  assumes\n    1: \"Y \\<subseteq> subformulas\\<^sub>\\<nu> \\<phi>\"\n  and\n    2: \"suffix i w \\<Turnstile>\\<^sub>n af \\<phi> (prefix i w)[Y]\\<^sub>\\<mu>\"\n  and\n    3: \"\\<forall>\\<psi>\\<^sub>1 \\<psi>\\<^sub>2. \\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2 \\<in> Y \\<longrightarrow> suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)\"\n  and\n    4: \"\\<forall>\\<psi>\\<^sub>1 \\<psi>\\<^sub>2. \\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2 \\<in> Y \\<longrightarrow> suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1[Y]\\<^sub>\\<mu> or\\<^sub>n \\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)\"\n  shows\n    \"w \\<Turnstile>\\<^sub>n \\<phi>\"\nproof -\n  have \"suffix i w \\<Turnstile>\\<^sub>n af \\<phi> (prefix i w)\"\n    by (metis assms Y_\\<G> FG_advice_b2 \\<G>_af)\n\n  then show \"w \\<Turnstile>\\<^sub>n \\<phi>\"\n    using af_ltl_continuation by force\nqed\n\ntheorem asymmetric_master_theorem:\n  \"w \\<Turnstile>\\<^sub>n \\<phi> \\<longleftrightarrow>\n    (\\<exists>i. \\<exists>Y \\<subseteq> subformulas\\<^sub>\\<nu> \\<phi>.\n      suffix i w \\<Turnstile>\\<^sub>n af \\<phi> (prefix i w)[Y]\\<^sub>\\<mu>\n      \\<and> (\\<forall>\\<psi>\\<^sub>1 \\<psi>\\<^sub>2. \\<psi>\\<^sub>1 R\\<^sub>n \\<psi>\\<^sub>2 \\<in> Y \\<longrightarrow> suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>))\n      \\<and> (\\<forall>\\<psi>\\<^sub>1 \\<psi>\\<^sub>2. \\<psi>\\<^sub>1 W\\<^sub>n \\<psi>\\<^sub>2 \\<in> Y \\<longrightarrow> suffix i w \\<Turnstile>\\<^sub>n G\\<^sub>n (\\<psi>\\<^sub>1[Y]\\<^sub>\\<mu> or\\<^sub>n \\<psi>\\<^sub>2[Y]\\<^sub>\\<mu>)))\"\n  by (metis asymmetric_master_theorem_ltr asymmetric_master_theorem_rtl)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/LTL_Master_Theorem/Logical_Characterization/Asymmetric_Master_Theorem.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352403, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.3242466928844136}}
{"text": "theory LundfallErfurtEx09\nimports QMLS5U Main Temp\nbegin\nsection\\<open>Exercise 2\\<close>\n\n(*S5 is axiom M together with axiom V*)\n\ntheorem M:\n  shows \"\\<lfloor>\\<^bold>\\<box>p\\<^bold>\\<rightarrow>p\\<rfloor>\"\n  by simp\n\ntheorem V:\n  shows \"\\<lfloor>\\<^bold>\\<forall>\\<phi>. \\<^bold>\\<diamond>\\<phi> \\<^bold>\\<rightarrow> \\<^bold>\\<box>\\<^bold>\\<diamond>\\<phi>\\<rfloor>\"\n  by simp\n  \n  (*Positive property*)\n  consts Pp :: \"(\\<mu> \\<Rightarrow> \\<sigma>) \\<Rightarrow> \\<sigma>\"  \n\n  (* A God-like being possesses all positive properties. *)\n  definition God :: \"\\<mu> \\<Rightarrow> \\<sigma>\" where \"God = (\\<lambda>x. \\<^bold>\\<forall>(\\<lambda>\\<Phi>. Pp \\<Phi> \\<^bold>\\<rightarrow> \\<Phi> x))\"   \n\n  (* An essence of an individual is a property possessed by it \n     and necessarily implying any of its properties *)\n  definition ess :: \"(\\<mu> \\<Rightarrow> \\<sigma>) \\<Rightarrow> \\<mu> \\<Rightarrow> \\<sigma>\" (infixr \"ess\" 85) where\n    \"\\<Phi> ess x = \\<Phi> x \\<^bold>\\<and> (\\<^bold>\\<forall>\\<Psi>. \\<Psi> x \\<^bold>\\<rightarrow> \\<^bold>\\<box>(\\<^bold>\\<forall>y. \\<Phi> y \\<^bold>\\<rightarrow> \\<Psi> y))\"\n\n  (* Necessary existence of an individual is the necessary \n     exemplification of all its essences. *)\n  definition NE :: \"\\<mu> \\<Rightarrow> \\<sigma>\" where \"NE = (\\<lambda>x. \\<^bold>\\<forall>\\<Phi>. \\<Phi> ess x \\<^bold>\\<rightarrow> \\<^bold>\\<box>(\\<^bold>\\<exists> \\<Phi>))\"\n\n\n  axiomatization where\n    (* Either a property or its negation is positive, but not both. *)\n    A1a: \"\\<lfloor>\\<^bold>\\<forall>\\<Phi>. Pp(\\<^sup>\\<not>\\<Phi>) \\<^bold>\\<rightarrow> \\<^bold>\\<not>(Pp \\<Phi>)\\<rfloor>\" and\n    A1b: \"\\<lfloor>\\<^bold>\\<forall>\\<Phi>. \\<^bold>\\<not>(Pp \\<Phi>) \\<^bold>\\<rightarrow> Pp (\\<^sup>\\<not>\\<Phi>)\\<rfloor>\" and\n\n    (* A property necessarily implied by a positive property is positive. *)\n    A2:  \"\\<lfloor>\\<^bold>\\<forall>\\<Phi>. \\<^bold>\\<forall>\\<Psi>. (Pp \\<Phi> \\<^bold>\\<and> \\<^bold>\\<box> (\\<^bold>\\<forall>x. \\<Phi> x \\<^bold>\\<rightarrow> \\<Psi> x)) \\<^bold>\\<rightarrow> Pp \\<Psi>\\<rfloor>\"\n  axiomatization where A3:  \"\\<lfloor>Pp God\\<rfloor>\" \n  axiomatization where A4:  \"\\<lfloor>\\<^bold>\\<forall>\\<Phi>. Pp \\<Phi> \\<^bold>\\<rightarrow> \\<^bold>\\<box>(Pp \\<Phi>)\\<rfloor>\" \n  axiomatization where A5:  \"\\<lfloor>Pp NE\\<rfloor>\"\n\ntheorem god:\n  shows \"\\<lfloor>\\<^bold>\\<box>(\\<^bold>\\<exists> God)\\<rfloor>\"\n  by (metis A1a A1b A2 A3 A4 A5 God_def NE_def ess_def) \n\nsubsection\\<open>d\\<close>\ntext \\<open>With this formalization, there is no difference between a proposition being globally valid\nand it being necessarily true. In fact, for any world w, we have \"\\<lfloor>P\\<rfloor> = \\emph{\\box}P(w)\"\\<close>\n\nsection\\<open>Exercise 3\\<close>\nsubsection\\<open>(a)\\<close>\ntheorem \"KforG\":\nassumes \"*\\<lfloor> G (\\<Psi> *\\<rightarrow> \\<Phi>) \\<rfloor>*\"\nshows \"*\\<lfloor> G \\<Psi> *\\<rightarrow> G \\<Phi> \\<rfloor>*\"\n  by (simp add: assms)\n\ntheorem \"KforH\":\nassumes \"*\\<lfloor> H(\\<Psi> *\\<rightarrow> \\<Phi>) \\<rfloor>*\"\nshows \"*\\<lfloor> H \\<Psi> *\\<rightarrow> H \\<Phi> \\<rfloor>*\"\n  by (simp add: assms)\n\ntheorem \"SymI\":\nshows \"*\\<lfloor> \\<Psi> *\\<rightarrow>  G (P \\<Psi>) \\<rfloor>*\"\n  by auto\n\ntheorem \"SymII\":\nshows \"*\\<lfloor> \\<Psi> *\\<rightarrow>  H (F \\<Psi>) \\<rfloor>*\"\n by auto\n\ntheorem TRAN:\n  assumes Kt_sem\n  shows \"*\\<lfloor>G \\<Psi> *\\<rightarrow> G(G \\<Psi>)\\<rfloor>*\"\n  using assms by blast\n\ntheorem NOEND:\n  assumes Kt_sem\n  shows \"*\\<lfloor> G \\<Psi> *\\<rightarrow> F \\<Psi>\\<rfloor>*\"\n  using assms by blast\n\ntheorem NOBEG:\n  assumes Kt_sem\n  shows \"*\\<lfloor> H \\<Psi> *\\<rightarrow> P \\<Psi>\\<rfloor>*\"\n  using assms by blast\n\ntheorem LIN:\n  assumes \"Kt_sem\"\n  shows \"*\\<lfloor> (P (F \\<Psi>) *\\<or> F (P \\<Psi>)) *\\<rightarrow> (P \\<Psi>) *\\<or> \\<Psi> *\\<or> (F \\<Psi>) \\<rfloor>*\"\n  using assms by blast\n\nsubsection\\<open>(c)\\<close>\nconsts dead :: \"\\<mu>\\<mu> \\<Rightarrow> \\<sigma>\\<sigma>\"\ntheorem deadness:\n  assumes \"Kt_sem \\<and> *\\<lfloor> *\\<forall> entity.  (dead(entity) *\\<rightarrow> G dead(entity)) *\\<and> F dead(entity) *\\<and> (F *\\<not> dead(entity) *\\<or> P *\\<not> dead(entity) *\\<or> *\\<not> dead(entity)) \\<rfloor>*\"\n  shows \"*\\<lfloor> *\\<forall> entity. P (H *\\<not> dead(entity)) \\<rfloor>*\"\n  by (metis assms)\n\nend\n", "meta": {"author": "MrChico", "repo": "CompMeta", "sha": "6ea156d26df6feaac10d652a3743252f7112655a", "save_path": "github-repos/isabelle/MrChico-CompMeta", "path": "github-repos/isabelle/MrChico-CompMeta/CompMeta-6ea156d26df6feaac10d652a3743252f7112655a/as09/LundfallErfurtEx09.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3242466849390346}}
{"text": "theory RGToolkit\nimports VDMToolkit \nbegin\n\n(*================================================================*)\n\n(* TODO: \n1. generalise op with a ('a \\<Rightarrow> 'a) list?\n2. generalise it to have I/O? \n3. how to 'inherit' the type 'a so that we can \n   have the fixes across different locales under same type? \n*)\n\nclass VDM = \n  fixes st_inv :: \"'a \\<Rightarrow> \\<bool>\"\n  assumes st_valid: \"st_inv s\"\n\nclass Op = VDM +\n  fixes pre :: \"('a::VDM) \\<Rightarrow> \\<bool>\"\n  and   post:: \"('a::VDM) \\<Rightarrow> 'a \\<Rightarrow> \\<bool>\"\n\nclass Op_VCG = Op +\n assumes t_op_fsb: \"\\<forall> s . pre s \\<longrightarrow> (\\<exists> s' . post s s')\"\n\nclass RG = Op +\nfixes  rely:: \"('a::VDM) \\<Rightarrow> 'a \\<Rightarrow> \\<bool>\"\n  and  guar:: \"('a::VDM) \\<Rightarrow> 'a \\<Rightarrow> \\<bool>\"\nbegin\n\nsubclass VDM ..\nend\n  \nclass RG_closure = RG +\nassumes\n    t_refl_rely : \"\\<forall> s . rely s s\"\nand t_refl_guar : \"\\<forall> s . guar s s\"\nand t_trans_rely: \"\\<forall> s t u. rely s t \\<and> rely t u \\<longrightarrow> rely s u\"\nand t_trans_guar: \"\\<forall> s t u. guar s t \\<and> guar t u \\<longrightarrow> guar s u\"\n\nclass RG_coherence = RG +\nassumes\n     t_coherence: \"\\<forall> s s' . guar s s' \\<longrightarrow> rely s s'\"\n\ninductive spec_comp  :: \"(('a::VDM) \\<Rightarrow> 'a \\<Rightarrow> \\<bool>) \\<Rightarrow> ('a \\<Rightarrow> 'a \\<Rightarrow> \\<bool>) \\<Rightarrow> ('a \\<Rightarrow> 'a \\<Rightarrow> \\<bool>)\"  (infixr \";;\" 75)\n  for P :: \"('a \\<Rightarrow> 'a \\<Rightarrow> \\<bool>)\" \n  and Q :: \"('a \\<Rightarrow> 'a \\<Rightarrow> \\<bool>)\"\nwhere relcompI [intro]: \"P s s0 \\<Longrightarrow> Q s0 s' \\<Longrightarrow> (P ;; Q) s s'\"\n\ninductive_cases spec_compE: \"(P ;; Q) s s'\"  \n\ndefinition\n  spec_comp2:: \"('a \\<Rightarrow> 'a \\<Rightarrow> \\<bool>) \\<Rightarrow> ('a \\<Rightarrow> 'a \\<Rightarrow> \\<bool>) \\<Rightarrow> ('a \\<Rightarrow> 'a \\<Rightarrow> \\<bool>)\" (infixl \";:\" 55)\nwhere\n  \"(P ;: Q) \\<equiv> \\<lambda> s s' . (\\<exists> s0 . (P s s0) \\<and> (Q s0 s'))\"    \n\nlemma l_spec_comp_eq: \"(P ;; Q) = (P ;: Q)\"\napply rule+\nunfolding spec_comp2_def\n apply safe\n  apply (erule spec_compE, blast)\n  by (simp add: relcompI)\n     \nclass RG_stability = RG +\nassumes\n     t_pre_rely : \"\\<forall> s s' . pre s \\<and> (rely s s') \\<longrightarrow> pre s'\" \nand  t_rely_post: \"\\<forall> s s' . pre s \\<and> (rely ;; post) s s' \\<longrightarrow> post s s'\"\nand  t_post_rely: \"\\<forall> s s' . (post ;; rely) s s' \\<longrightarrow> post s s'\"     \n\nclass RG_feasibility = RG +\nassumes\n        t_rg_fsb: \"\\<forall> s . pre s \\<longrightarrow> (\\<exists>s' . post s s' \\<and> guar s s')\"\n\nclass RG_VCG = Op_VCG + RG_closure + RG_stability + RG_feasibility (* RG_coherence *)\nbegin\nsubclass VDM ..\n\nlemma False nitpick [show_all] oops  \nend\n\nlocale Silly =\n   assumes \"(x::nat) \\<noteq> x\"\nbegin\nlemma \"False\" nitpick [show_all] oops\nend\n  \nend", "meta": {"author": "leouk", "repo": "VDM_Toolkit", "sha": "791013909961d45949fcd96d937ae18f0174c7ec", "save_path": "github-repos/isabelle/leouk-VDM_Toolkit", "path": "github-repos/isabelle/leouk-VDM_Toolkit/VDM_Toolkit-791013909961d45949fcd96d937ae18f0174c7ec/experiments/vdm/GarbageCollector/isa/RGToolkit.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7341195152660688, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.3242407728246226}}
{"text": "theory Proto_Sepref_Borrow\nimports Sepref\nbegin\n\n  (* Simple-Minded borrowing for sepref.\n  \n    Idea: When we can prove that we have not changed an object abstractly, \n      and its concrete value is still the same, we can reinstantiate it \n      after it has been invalidated.\n      \n  *)\n\n  text \\<open>Operation to reinstantiate dst, by moving source. \n    Implementations will also require a proof that the concrete objects are equal!\n  \\<close>\n  definition \"unborrow src dst \\<equiv> doN {ASSERT (src=dst); RETURN ()}\"\n  sepref_register unborrow\n\n  lemma unborrow_correct[refine_vcg]: \"s=d \\<Longrightarrow> unborrow s d \\<le> SPEC (\\<lambda>r. r=())\"\n    unfolding unborrow_def by auto\n  \n  \n  lemma unborrow_rule[sepref_comb_rules]:\n    assumes FRAME: \"\\<Gamma> \\<turnstile> hn_ctxt R src srci ** hn_invalid R dst dsti ** F\"\n    assumes [simp]: \"vassn_tag \\<Gamma> \\<Longrightarrow> srci = dsti\"\n    shows \"hn_refine \\<Gamma> (return ()) (hn_invalid R src srci ** hn_ctxt R dst dsti ** F) unit_assn (unborrow$src$dst)\"\n    apply (rule hn_refine_vassn_tagI)\n    apply (rule hn_refine_cons_pre[OF FRAME])\n    apply (rule hn_refineI)\n    unfolding unborrow_def\n    apply (simp add: refine_pw_simps)\n    unfolding hn_ctxt_def invalid_assn_def pure_def\n    by vcg'\n  \n  lemma unborrow_nofail[refine_pw_simps]: \"nofail (unborrow a b) \\<longleftrightarrow> a=b\" by (auto simp: unborrow_def refine_pw_simps)  \n  \n  \n  text \\<open>Assertion that adds constraint on concrete value. Used to carry through concrete equalities.\\<close>\n  definition \"cnc_assn \\<phi> A a c \\<equiv> \\<up>(\\<phi> c) ** A a c\"\n    \n  lemma norm_ceq_assn[named_ss sepref_frame_normrel]: \"hn_ctxt (cnc_assn \\<phi> A) a c = (\\<up>(\\<phi> c) ** hn_ctxt A a c)\"\n    unfolding hn_ctxt_def cnc_assn_def by simp\n  \n  lemma cnc_assn_prod_conv[named_ss sepref_frame_normrel]:\n    shows \"\\<And>A B \\<phi>. A \\<times>\\<^sub>a cnc_assn \\<phi> B = cnc_assn (\\<phi> o snd) (A\\<times>\\<^sub>aB)\"\n      and \"\\<And>A B \\<phi>. cnc_assn \\<phi> A \\<times>\\<^sub>a B = cnc_assn (\\<phi> o fst) (A\\<times>\\<^sub>aB)\"\n    unfolding cnc_assn_def\n    by (auto simp: sep_algebra_simps fun_eq_iff)\n    \n    \n  text \\<open>Rule to prove a-posteriori constraint (Only useful for simple programs.\n    TODO: More partial Hoare-triples would make this more useful, e.g., \n      we could assume assertions, preconditions, and even termination!\n  )\\<close>    \n  lemma hnr_ceq_assnI:\n    assumes HNR: \"hn_refine \\<Gamma> c \\<Gamma>' R a\"\n    assumes HT: \"llvm_htriple \\<Gamma> c (\\<lambda>x'. \\<up>(\\<phi> x') ** sep_true)\"\n    shows \"hn_refine \\<Gamma> c \\<Gamma>' (cnc_assn \\<phi> R) a\"\n  proof (rule hn_refine_nofailI)\n    assume NF: \"nofail a\"\n  \n    show ?thesis\n      apply (rule hn_refineI)\n      apply (rule cons_post_rule)\n      apply (rule htriple_conj_pure[OF HNR[THEN hn_refineD[OF _ NF]] HT])\n      apply (auto simp: sep_algebra_simps pred_lift_extract_simps cnc_assn_def)\n      done\n      \n  qed    \n  \n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/sepref/Proto_Sepref_Borrow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.63341027751814, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.3241265565963057}}
{"text": "theory my_theory\nimports Main\nbegin\n\nthm impI\n\nlemma trivial: \"A \\<longrightarrow> A\"\napply (rule_tac impI)\napply assumption\ndone (* of lemma proof *)\n\nthm trivial\n\nlemma trivial2: \"A \\<longrightarrow> A\"\nproof (rule_tac impI)\n  assume H1: \"A\"\n  from H1\n  show \"A\"\n    by (rule_tac H1)\nqed \n\n\nend (* of theory file *)\n", "meta": {"author": "brando90", "repo": "cs477", "sha": "665326c27c24669db79c3e5e070f2b8e00a73d02", "save_path": "github-repos/isabelle/brando90-cs477", "path": "github-repos/isabelle/brando90-cs477/cs477-665326c27c24669db79c3e5e070f2b8e00a73d02/lectures/my_theory.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3241265495139945}}
{"text": "theory Debranching\nimports \n  BranchingAssemblyLanguage \n  \"../Assembly/AssemblyLanguage\" \n  \"../Utilities/Iterate\" \n  \"../Utilities/FiniteMap\"\nbegin\n\nfun branch_instr_convert :: \"code_label\\<^sub>2 set \\<Rightarrow> b_assembly list \\<Rightarrow> code_label\\<^sub>2 \\<Rightarrow> \n    assembly list \\<times> code_label\\<^sub>2 \\<times> (code_label\\<^sub>2 \\<rightharpoonup> assembly list \\<times> code_label\\<^sub>2)\" where\n  \"branch_instr_convert ss [] s = ([], s, empty)\"\n| \"branch_instr_convert ss (ABAssm x # \\<pi>) s = (\n    let (\\<pi>', s', \\<Pi>) = branch_instr_convert ss \\<pi> s\n    in (AAssm x # \\<pi>', s', \\<Pi>))\"\n| \"branch_instr_convert ss (CBAssm dst cmp # \\<pi>) s = (\n    let (\\<pi>', s', \\<Pi>) = branch_instr_convert ss \\<pi> s\n    in (CAssm dst cmp # \\<pi>', s', \\<Pi>))\"\n| \"branch_instr_convert ss (IBAssm jmp \\<pi>\\<^sub>t \\<pi>\\<^sub>f # \\<pi>) s = (\n    let s\\<^sub>e = new_label\\<^sub>2 ss\n    in let (\\<pi>', s', \\<Pi>\\<^sub>1) = branch_instr_convert (ss \\<union> {s\\<^sub>e}) \\<pi> s\n    in let (\\<pi>\\<^sub>t', s\\<^sub>t, \\<Pi>\\<^sub>2) = branch_instr_convert (ss \\<union> dom \\<Pi>\\<^sub>1 \\<union> {s\\<^sub>e}) \\<pi>\\<^sub>t s\\<^sub>e\n    in let (\\<pi>\\<^sub>f', s\\<^sub>f, \\<Pi>\\<^sub>3) = branch_instr_convert (ss \\<union> dom \\<Pi>\\<^sub>1 \\<union> dom \\<Pi>\\<^sub>2 \\<union> {s\\<^sub>e}) \\<pi>\\<^sub>f s\\<^sub>e\n    in (JAssm jmp s\\<^sub>t # \\<pi>\\<^sub>f', s\\<^sub>f, \\<Pi>\\<^sub>1 ++ \\<Pi>\\<^sub>2 ++ \\<Pi>\\<^sub>3 ++ [s\\<^sub>t \\<mapsto> (\\<pi>\\<^sub>t', s\\<^sub>t), s\\<^sub>e \\<mapsto> (\\<pi>', s')]))\"\n| \"branch_instr_convert ss (JBAssm s' # \\<pi>) s = ([], s', empty)\"\n| \"branch_instr_convert ss (PBAssm # \\<pi>) s = (\n    let (\\<pi>', s', \\<Pi>) = branch_instr_convert ss \\<pi> s\n    in (PAssm # \\<pi>', s', \\<Pi>))\"\n\nfun block_convert :: \"code_label\\<^sub>2 set \\<Rightarrow> code_label\\<^sub>2 \\<times> b_assembly list \\<times> code_label\\<^sub>2 \\<Rightarrow> \n    assembly_program \\<Rightarrow> assembly_program\" where\n  \"block_convert ss (s, \\<pi>, s') \\<Pi> = (\n    let (\\<pi>', s'', \\<Pi>') = branch_instr_convert (ss \\<union> dom \\<Pi>) \\<pi> s' \n    in \\<Pi>'(s \\<mapsto> (\\<pi>', s'')))\"\n\ndefinition debranch :: \"b_assembly_program \\<Rightarrow> assembly_program\" where\n  \"debranch \\<Pi> = finite_map_fold (block_convert (dom \\<Pi>)) empty \\<Pi>\"\n\nfunction remove_continuations :: \"assembly list \\<Rightarrow> code_label\\<^sub>2 \\<Rightarrow> assembly_program \\<Rightarrow> \n    (assembly list \\<times> code_label\\<^sub>2)\" where\n  \"\\<not> finite (dom \\<Pi>) \\<Longrightarrow> remove_continuations \\<pi> s \\<Pi> = (\\<pi>, s)\"\n| \"finite (dom \\<Pi>) \\<Longrightarrow> remove_continuations \\<pi> s \\<Pi> = (case \\<Pi> s of \n        Some (\\<pi>', s') \\<Rightarrow> remove_continuations (\\<pi> @ \\<pi>') s' (\\<Pi>(s := None))\n      | None \\<Rightarrow> (\\<pi>, s))\"\n  by atomize_elim auto\ntermination\n  by (relation \"measure (card o dom o snd o snd)\") (auto, meson card_Diff1_less domI)\n\nfun state_convert :: \"code_label\\<^sub>2 set \\<Rightarrow> b_assembly_state \\<Rightarrow> assembly_state\" where\n  \"state_convert ss (\\<mu>, a, d, \\<pi>, s, \\<omega>) = (\n    let (\\<pi>', s', \\<Pi>') = branch_instr_convert ss \\<pi> s\n    in let (\\<pi>'', s'') = remove_continuations \\<pi>' s' \\<Pi>'\n    in (\\<mu>, a, d, \\<pi>'', s'', \\<omega>))\"\n\n(* conversion correctness *)\n\n\n\nlemma finite_block_convert: \"finite (dom \\<Pi>) \\<Longrightarrow> finite ss \\<Longrightarrow> \n    finite (dom (block_convert ss \\<pi> \\<Pi>))\"\n  by (cases \\<pi>) (auto split: prod.splits)\n\nlemma [simp]: \"finite ss \\<Longrightarrow> ss \\<supseteq> dom \\<Pi> \\<Longrightarrow> \n    finite (dom (finite_map_fold (block_convert ss) empty \\<Pi>))\"\n  proof (induction \"block_convert ss\" \"empty :: code_label\\<^sub>2 \\<Rightarrow> (assembly list \\<times> code_label\\<^sub>2) option\" \\<Pi> \n         rule: finite_map_fold.induct)\n  case 1\n    thus ?case by (metis finite_subset)\n  next case 2\n    thus ?case by simp\n  next case (3 \\<Pi>)\n    let ?x = \"SOME x. x \\<in> dom \\<Pi>\"\n    let ?ih = \"finite_map_fold (block_convert ss) empty (\\<Pi>(?x := None))\"\n    from 3 have \"finite (dom ?ih)\" by auto\n    with finite_block_convert 3 have \"finite (dom (block_convert ss (?x, the (\\<Pi> ?x)) ?ih))\" by simp\n    with 3 show ?case by (simp add: Let_def)\n  qed\n\nlemma [simp]: \"finite (dom \\<Pi>) \\<Longrightarrow> finite (dom (debranch \\<Pi>))\"\n  by (simp add: debranch_def)\n\nlemma [simp]: \"remove_continuations \\<pi> s \\<Pi> = (\\<pi>', s') \\<Longrightarrow>\n    remove_continuations (\\<iota> # \\<pi>) s \\<Pi> = (\\<iota> # \\<pi>', s')\"\n  proof (induction \\<pi> s \\<Pi> rule: remove_continuations.induct)\n  case 1\n    thus ?case by simp\n  next case (2 \\<Pi> \\<pi> s)\n    thus ?case\n      proof (cases \"\\<Pi> s\")\n      case (Some ps)\n        with 2 show ?thesis by (cases ps) fastforce\n      next case None\n        with 2 show ?thesis by simp\n      qed\n  qed\n\nlemma [simp]: \"remove_continuations \\<pi> s \\<Pi> = (\\<pi>', s') \\<Longrightarrow>\n    remove_continuations (\\<pi>\\<^sub>2 @ \\<pi>) s \\<Pi> = (\\<pi>\\<^sub>2 @ \\<pi>', s')\"\n  proof (induction \\<pi> s \\<Pi> rule: remove_continuations.induct)\n  case 1\n    thus ?case by simp\n  next case (2 \\<Pi> \\<pi> s)\n    thus ?case\n      proof (cases \"\\<Pi> s\")\n      case (Some ps)\n        with 2 show ?thesis by (cases ps) fastforce\n      next case None\n        with 2 show ?thesis by simp\n      qed\n  qed\n\nlemma [simp]: \"finite ss \\<Longrightarrow> ss \\<supseteq> dom \\<Pi> \\<Longrightarrow> \\<Pi> s = Some (\\<pi>\\<^sub>B, s') \\<Longrightarrow> \n  branch_instr_convert ss \\<pi>\\<^sub>B s' = (\\<pi>\\<^sub>A, s'', \\<Pi>') \\<Longrightarrow> \n    remove_continuations \\<pi>\\<^sub>A s'' \\<Pi>' = (\\<pi>\\<^sub>A', s''') \\<Longrightarrow> \n      finite_map_fold (block_convert ss) empty \\<Pi> s = Some (\\<pi>\\<^sub>A', s''')\"\n  proof (induction \"block_convert ss\" \"empty :: code_label\\<^sub>2 \\<Rightarrow> (assembly list \\<times> code_label\\<^sub>2) option\" \\<Pi> \n         rule: finite_map_fold.induct)\n  case 1\n    thus ?case by (metis finite_subset)\n  next case 2\n    hence False by simp\n    thus ?case by simp\n  next case (3 \\<Pi>)\n    let ?x = \"SOME x. x \\<in> dom \\<Pi>\"\n    let ?ih = \"finite_map_fold (block_convert ss) Map.empty (\\<Pi>(?x := None))\"\n    show ?case\n      proof (cases \"s = ?x\")\n      case True\n        from 3 have \"finite (dom \\<Pi>)\" by simp\n        from 3 have \"card (dom \\<Pi>) \\<noteq> 0\" by simp\n        from 3 have \"\n          finite ss \\<Longrightarrow>\n          dom (\\<Pi>(?x := None)) \\<subseteq> ss \\<Longrightarrow>\n          (\\<Pi>(?x := None)) s = Some (\\<pi>\\<^sub>B, s') \\<Longrightarrow>\n          branch_instr_convert (dom (\\<Pi>(?x := None))) \\<pi>\\<^sub>B s' = (\\<pi>\\<^sub>A, s'', \\<Pi>') \\<Longrightarrow>\n          remove_continuations \\<pi>\\<^sub>A s'' \\<Pi>' = (\\<pi>\\<^sub>A', s''') \\<Longrightarrow> ?ih s = Some (\\<pi>\\<^sub>A', s''')\" by simp\n        from 3 have \"finite ss\" by simp\n        from 3 have \"dom \\<Pi> \\<subseteq> ss\" by simp\n        from 3 have \"\\<Pi> s = Some (\\<pi>\\<^sub>B, s')\" by simp\n        from 3 have \"branch_instr_convert ss \\<pi>\\<^sub>B s' = (\\<pi>\\<^sub>A, s'', \\<Pi>')\" by simp\n        from 3 have \"remove_continuations \\<pi>\\<^sub>A s'' \\<Pi>' = (\\<pi>\\<^sub>A', s''')\" by simp\n    \n    \n    \n        have \"(let (\\<pi>', s'', \\<Pi>') = branch_instr_convert (ss \\<union> dom ?ih) \\<pi>\\<^sub>B s' in \\<Pi>'(s \\<mapsto> (\\<pi>', s''))) s = Some (\\<pi>\\<^sub>A', s''')\" by simp\n        with 3 have \"block_convert ss (s, the (\\<Pi> s)) ?ih s = Some (\\<pi>\\<^sub>A', s''')\" by simp\n        with True have \"block_convert ss (?x, the (\\<Pi> ?x)) ?ih s = Some (\\<pi>\\<^sub>A', s''')\" by simp\n        with 3 show ?thesis by (simp add: Let_def)\n      next case False\n        from 3 have \"finite (dom \\<Pi>)\" by simp\n        from 3 have \"card (dom \\<Pi>) \\<noteq> 0\" by simp\n        from 3 have \"\n          finite ss \\<Longrightarrow>\n          dom (\\<Pi>(?x := None)) \\<subseteq> ss \\<Longrightarrow>\n          (\\<Pi>(?x := None)) s = Some (\\<pi>\\<^sub>B, s') \\<Longrightarrow>\n          branch_instr_convert (dom (\\<Pi>(?x := None))) \\<pi>\\<^sub>B s' = (\\<pi>\\<^sub>A, s'', \\<Pi>') \\<Longrightarrow>\n          remove_continuations \\<pi>\\<^sub>A s'' \\<Pi>' = (\\<pi>\\<^sub>A', s''') \\<Longrightarrow> ?ih s = Some (\\<pi>\\<^sub>A', s''')\" by simp\n        from 3 have \"finite ss\" by simp\n        from 3 have \"dom \\<Pi> \\<subseteq> ss\" by simp\n        from 3 have \"\\<Pi> s = Some (\\<pi>\\<^sub>B, s')\" by simp\n        from 3 have \"branch_instr_convert ss \\<pi>\\<^sub>B s' = (\\<pi>\\<^sub>A, s'', \\<Pi>')\" by simp\n        from 3 have \"remove_continuations \\<pi>\\<^sub>A s'' \\<Pi>' = (\\<pi>\\<^sub>A', s''')\" by simp\n    \n    \n    have \"block_convert ss (s, \\<pi>, s') ?ih = (\n        let (\\<pi>', s'', \\<Pi>') = branch_instr_convert (ss \\<union> dom ?ih) \\<pi> s' \n        in \\<Pi>'(s \\<mapsto> (\\<pi>', s'')))\" by simp\n    \n        have \"block_convert ss (?x, the (\\<Pi> ?x)) ?ih s = Some (\\<pi>\\<^sub>A', s''')\" by simp\n        with 3 show ?thesis by (simp add: Let_def)\n      qed\n  qed\n\nlemma [simp]: \"finite (dom \\<Pi>) \\<Longrightarrow>  \\<Pi> s = Some (\\<pi>\\<^sub>B, s') \\<Longrightarrow> \n  branch_instr_convert (dom \\<Pi>) \\<pi>\\<^sub>B s' = (\\<pi>\\<^sub>A, s'', \\<Pi>') \\<Longrightarrow> \n    remove_continuations \\<pi>\\<^sub>A s'' \\<Pi>' = (\\<pi>\\<^sub>A', s''') \\<Longrightarrow> debranch \\<Pi> s = Some (\\<pi>\\<^sub>A', s''')\"\n  by (simp add: debranch_def)\n\nlemma [simp]: \"assembly_output (state_convert ss \\<Sigma>\\<^sub>B) = b_assembly_output \\<Sigma>\\<^sub>B\"\n  by (induction \\<Sigma>\\<^sub>B rule: b_assembly_output.induct) (simp split: prod.splits)\n\nlemma debranch_step: \"finite (dom \\<Pi>) \\<Longrightarrow> eval_b_assembly \\<Pi> \\<Sigma>\\<^sub>B = Some \\<Sigma>\\<^sub>B' \\<Longrightarrow> \n    eval_assembly (debranch \\<Pi>) (state_convert (dom \\<Pi>) \\<Sigma>\\<^sub>B) = Some (state_convert (dom \\<Pi>) \\<Sigma>\\<^sub>B')\"\n  proof (induction \\<Pi> \\<Sigma>\\<^sub>B rule: eval_b_assembly.induct)\n  case (1 \\<Pi> \\<mu> a d s \\<omega>)\n    then obtain ps where \"\\<Pi> s = Some ps\" by (cases \"\\<Pi> s\") simp_all\n    then obtain \\<pi>\\<^sub>B s' where PS: \"\\<Pi> s = Some (\\<pi>\\<^sub>B, s')\" by (cases ps) simp\n    obtain \\<pi>\\<^sub>A s'' \\<Pi>' where B: \"branch_instr_convert (dom \\<Pi>) \\<pi>\\<^sub>B s' = (\\<pi>\\<^sub>A, s'', \\<Pi>')\" \n      by (cases \"branch_instr_convert (dom \\<Pi>) \\<pi>\\<^sub>B s'\") simp\n    obtain \\<pi>\\<^sub>A' s''' where C: \"remove_continuations \\<pi>\\<^sub>A s'' \\<Pi>' = (\\<pi>\\<^sub>A', s''')\"\n      by (cases \"remove_continuations \\<pi>\\<^sub>A s'' \\<Pi>'\") simp\n    from B C have \"state_convert (dom \\<Pi>) (\\<mu>, None, d, \\<pi>\\<^sub>B, s', \\<omega>) = (\\<mu>, None, d, \\<pi>\\<^sub>A', s''', \\<omega>)\"\n      by simp\n    with 1 PS B C show ?case by simp\n  next case (2 \\<Pi> \\<mu> a d x \\<pi>\\<^sub>B s \\<omega>)\n    obtain \\<pi>\\<^sub>A s' \\<Pi>' where B: \"branch_instr_convert (dom \\<Pi>) \\<pi>\\<^sub>B s = (\\<pi>\\<^sub>A, s', \\<Pi>')\"\n      by (cases \"branch_instr_convert (dom \\<Pi>) \\<pi>\\<^sub>B s\") simp\n    obtain \\<pi>\\<^sub>A' s'' where C: \"remove_continuations \\<pi>\\<^sub>A s' \\<Pi>' = (\\<pi>\\<^sub>A', s'')\"\n      by (cases \"remove_continuations \\<pi>\\<^sub>A s' \\<Pi>'\") simp\n    from B C have A: \"state_convert (dom \\<Pi>) (\\<mu>, a, d, ABAssm x # \\<pi>\\<^sub>B, s, \\<omega>) = \n      (\\<mu>, a, d, AAssm x # \\<pi>\\<^sub>A', s'', \\<omega>)\" by simp\n    from B C have \"state_convert (dom \\<Pi>) (\\<mu>, Some x, d, \\<pi>\\<^sub>B, s, \\<omega>) = (\\<mu>, Some x, d, \\<pi>\\<^sub>A', s'', \\<omega>)\"\n      by simp\n    with 2 A show ?case by simp\n  next case (3 \\<Pi> \\<mu> a d dst cmp \\<pi>\\<^sub>B s \\<omega>)\n    let ?n = \"compute cmp (\\<mu> (nat a)) a d\"\n    let ?m = \"if M \\<in> dst then \\<mu>(nat a := ?n) else \\<mu>\"\n    let ?a = \"Some (if A \\<in> dst then ?n else a)\"\n    let ?d = \"if D \\<in> dst then ?n else d\"\n    obtain \\<pi>\\<^sub>A s' \\<Pi>' where B: \"branch_instr_convert (dom \\<Pi>) \\<pi>\\<^sub>B s = (\\<pi>\\<^sub>A, s', \\<Pi>')\"\n      by (cases \"branch_instr_convert (dom \\<Pi>) \\<pi>\\<^sub>B s\") simp\n    obtain \\<pi>\\<^sub>A' s'' where C: \"remove_continuations \\<pi>\\<^sub>A s' \\<Pi>' = (\\<pi>\\<^sub>A', s'')\" \n      by (cases \"remove_continuations \\<pi>\\<^sub>A s' \\<Pi>'\") simp\n    from B C have S: \"state_convert (dom \\<Pi>) (?m, ?a, ?d, \\<pi>\\<^sub>B, s, \\<omega>) = (?m, ?a, ?d, \\<pi>\\<^sub>A', s'', \\<omega>)\" \n      by simp\n    from B C have \"state_convert (dom \\<Pi>) (\\<mu>, Some a, d, CBAssm dst cmp # \\<pi>\\<^sub>B, s, \\<omega>) = \n      (\\<mu>, Some a, d, CAssm dst cmp # \\<pi>\\<^sub>A', s'', \\<omega>)\" by simp\n    with 3 S show ?case by (simp add: Let_def)\n  next case 4\n    thus ?case by simp\n  next case (5 \\<Pi> \\<mu> a d jmp \\<pi>\\<^sub>B\\<^sub>t \\<pi>\\<^sub>B\\<^sub>f \\<pi>\\<^sub>B s \\<omega>)    \n    let ?s\\<^sub>e = \"new_label\\<^sub>2 (dom \\<Pi>)\"\n    obtain \\<pi>\\<^sub>A s' \\<Pi>\\<^sub>1 where B: \"branch_instr_convert (dom \\<Pi> \\<union> {?s\\<^sub>e}) \\<pi>\\<^sub>B s = (\\<pi>\\<^sub>A, s', \\<Pi>\\<^sub>1)\" \n      by (cases \"branch_instr_convert (dom \\<Pi> \\<union> {?s\\<^sub>e}) \\<pi>\\<^sub>B s\") simp\n    obtain \\<pi>\\<^sub>A\\<^sub>t s\\<^sub>t \\<Pi>\\<^sub>2 where BT: \"branch_instr_convert (dom \\<Pi> \\<union> dom \\<Pi>\\<^sub>1 \\<union> {?s\\<^sub>e}) \\<pi>\\<^sub>B\\<^sub>t ?s\\<^sub>e = (\\<pi>\\<^sub>A\\<^sub>t, s\\<^sub>t, \\<Pi>\\<^sub>2)\"\n      by (cases \"branch_instr_convert (dom \\<Pi> \\<union> dom \\<Pi>\\<^sub>1 \\<union> {?s\\<^sub>e}) \\<pi>\\<^sub>B\\<^sub>t ?s\\<^sub>e\") simp\n    obtain \\<pi>\\<^sub>A\\<^sub>f s\\<^sub>f \\<Pi>\\<^sub>3 where BF: \"branch_instr_convert (dom \\<Pi> \\<union> dom \\<Pi>\\<^sub>1 \\<union> dom \\<Pi>\\<^sub>2 \\<union> {?s\\<^sub>e}) \\<pi>\\<^sub>B\\<^sub>f ?s\\<^sub>e = \n        (\\<pi>\\<^sub>A\\<^sub>f, s\\<^sub>f, \\<Pi>\\<^sub>3)\"\n      by (cases \"branch_instr_convert (dom \\<Pi> \\<union> dom \\<Pi>\\<^sub>1 \\<union> dom \\<Pi>\\<^sub>2 \\<union> {?s\\<^sub>e}) \\<pi>\\<^sub>B\\<^sub>f ?s\\<^sub>e\") simp\n    let ?\\<Pi>' = \"\\<Pi>\\<^sub>1 ++ \\<Pi>\\<^sub>2 ++ \\<Pi>\\<^sub>3 ++ [s\\<^sub>t \\<mapsto> (\\<pi>\\<^sub>A\\<^sub>t, s\\<^sub>t), ?s\\<^sub>e \\<mapsto> (\\<pi>\\<^sub>A, s')]\"\n    obtain \\<pi>\\<^sub>A\\<^sub>f' s\\<^sub>f' where CF: \"remove_continuations \\<pi>\\<^sub>A\\<^sub>f s\\<^sub>f ?\\<Pi>' = (\\<pi>\\<^sub>A\\<^sub>f', s\\<^sub>f')\"\n      by (cases \"remove_continuations \\<pi>\\<^sub>A\\<^sub>f s\\<^sub>f ?\\<Pi>'\") simp\n    from BT BF B have BI: \"branch_instr_convert (dom \\<Pi>) (IBAssm jmp \\<pi>\\<^sub>B\\<^sub>t \\<pi>\\<^sub>B\\<^sub>f # \\<pi>\\<^sub>B) s = \n        (JAssm jmp s\\<^sub>t # \\<pi>\\<^sub>A\\<^sub>f, s\\<^sub>f, ?\\<Pi>')\" by simp\n    with CF have SI: \"state_convert (dom \\<Pi>) (\\<mu>, a, d, IBAssm jmp \\<pi>\\<^sub>B\\<^sub>t \\<pi>\\<^sub>B\\<^sub>f # \\<pi>\\<^sub>B, s, \\<omega>) = \n        (\\<mu>, a, d, JAssm jmp s\\<^sub>t # \\<pi>\\<^sub>A\\<^sub>f', s\\<^sub>f', \\<omega>)\" by simp\n    thus ?case\n      proof (cases \"compare d jmp\")\n      case True\n\n\n\n        have \"(case debranch \\<Pi> s\\<^sub>t of Some (\\<pi>', s'') \\<Rightarrow> Some (\\<mu>, None, d, \\<pi>', s'', \\<omega>) | None \\<Rightarrow> None) = Some (state_convert (dom \\<Pi>) (\\<mu>, None, d, \\<pi>\\<^sub>B\\<^sub>t @ \\<pi>\\<^sub>B, s, \\<omega>))\" by simp\n        with 5 SI True show ?thesis by auto\n      next case False\n\n\nhave \"state_convert (dom \\<Pi>) (\\<mu>, None, d, \\<pi>\\<^sub>B\\<^sub>f @ \\<pi>\\<^sub>B, s, \\<omega>) = (\n    let (\\<pi>', s', \\<Pi>') = branch_instr_convert (dom \\<Pi>) (\\<pi>\\<^sub>B\\<^sub>f @ \\<pi>\\<^sub>B) s\n    in let (\\<pi>\\<^sub>A\\<^sub>f', s\\<^sub>f') = remove_continuations \\<pi>' s' \\<Pi>'\n    in (\\<mu>, None, d, \\<pi>\\<^sub>A\\<^sub>f', s\\<^sub>f', \\<omega>))\" by simp\n\n        have \"(\\<mu>, None, d, \\<pi>\\<^sub>A\\<^sub>f', s\\<^sub>f', \\<omega>) = state_convert (dom \\<Pi>) (\\<mu>, None, d, \\<pi>\\<^sub>B\\<^sub>f @ \\<pi>\\<^sub>B, s, \\<omega>)\" by simp\n        with 5 SI False show ?thesis by auto\n      qed\n  next case (6 \\<Pi> \\<mu> a d s \\<pi> s' \\<omega>)\n    then obtain ps where \"\\<Pi> s = Some ps\" by (cases \"\\<Pi> s\") simp_all\n    then obtain \\<pi>\\<^sub>B s' where PS: \"\\<Pi> s = Some (\\<pi>\\<^sub>B, s')\" by (cases ps) simp\n\n\n\n\nhave \"state_convert (dom \\<Pi>) (\\<mu>, None, d, \\<pi>\\<^sub>B, s', \\<omega>) = (\n    let (\\<pi>', s', \\<Pi>') = branch_instr_convert (dom \\<Pi>) \\<pi>\\<^sub>B s'\n    in let (\\<pi>'', s'') = remove_continuations \\<pi>' s' \\<Pi>'\n    in (\\<mu>, None, d, \\<pi>'', s'', \\<omega>))\" by simp\n\n    have \"eval_assembly (debranch \\<Pi>) (\\<mu>, a, d, [], s, \\<omega>) = Some (state_convert (dom \\<Pi>) (\\<mu>, None, d, \\<pi>\\<^sub>B, s', \\<omega>))\" by simp\n    with 6 PS show ?case by simp\n  next case (7 \\<Pi> \\<mu> a d \\<pi>\\<^sub>B s \\<omega>)\n    obtain \\<pi>\\<^sub>A s' \\<Pi>' where B: \"branch_instr_convert (dom \\<Pi>) \\<pi>\\<^sub>B s = (\\<pi>\\<^sub>A, s', \\<Pi>')\"\n      by (cases \"branch_instr_convert (dom \\<Pi>) \\<pi>\\<^sub>B s\") simp\n    obtain \\<pi>\\<^sub>A' s'' where C: \"remove_continuations \\<pi>\\<^sub>A s' \\<Pi>' = (\\<pi>\\<^sub>A', s'')\"\n      by (cases \"remove_continuations \\<pi>\\<^sub>A s' \\<Pi>'\") simp\n    from B C have A: \"state_convert (dom \\<Pi>) (\\<mu>, a, d, PBAssm # \\<pi>\\<^sub>B, s, \\<omega>) = \n      (\\<mu>, a, d, PAssm # \\<pi>\\<^sub>A', s'', \\<omega>)\" by simp\n    from B C have \"state_convert (dom \\<Pi>) (\\<mu>, a, d, \\<pi>\\<^sub>B, s, d # \\<omega>) = (\\<mu>, a, d, \\<pi>\\<^sub>A', s'', d # \\<omega>)\" \n      by simp\n    with 7 A show ?case by simp\n  qed \n\ntheorem debranching_correct [simp]: \"iterate (eval_b_assembly \\<Pi>) \\<Sigma>\\<^sub>B \\<Sigma>\\<^sub>B' \\<Longrightarrow> finite (dom \\<Pi>) \\<Longrightarrow> \n    iterate (eval_assembly (debranch \\<Pi>)) (state_convert (dom \\<Pi>) \\<Sigma>\\<^sub>B) (state_convert (dom \\<Pi>) \\<Sigma>\\<^sub>B')\"\n  proof (induction \"eval_b_assembly \\<Pi>\" \\<Sigma>\\<^sub>B \\<Sigma>\\<^sub>B' rule: iterate.induct)\n  case iter_refl\n    thus ?case by auto\n  next case iter_step\n    with debranch_step show ?case by auto\n  qed\n\nend", "meta": {"author": "xtreme-james-cooper", "repo": "Elements", "sha": "695d842d865d1524a9e638f778b0bad97485b969", "save_path": "github-repos/isabelle/xtreme-james-cooper-Elements", "path": "github-repos/isabelle/xtreme-james-cooper-Elements/Elements-695d842d865d1524a9e638f778b0bad97485b969/BranchingAssembly/Debranching.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3241265495139945}}
{"text": "theory flash19Bra  imports flash19Rev\n \n  begin\nlemma onInv19:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv19  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv19  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv19 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash19Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.32406528212740066}}
{"text": "theory flash18Bra  imports flash18Rev\n \n  begin\nlemma onInv18:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv18  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv18  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv18 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash18Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417500561683, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.32406528212740066}}
{"text": "section \\<open>Modelling distributed systems\\<close>\n\ntext \\<open>We assume familiarity with Chandy and Lamport's\npaper \\emph{Distributed Snapshots: Determining Global States of\nDistributed Systems}~\\cite{chandy}.\\<close>\n\ntheory Distributed_System\n\nimports Main\n\nbegin\n\ntype_synonym 'a fifo = \"'a list\"\ntype_synonym channel_id = nat\n\ndatatype 'm message =\n    Marker\n  | Msg 'm\n\ndatatype recording_state =\n    NotStarted\n  | Recording\n  | Done\n\ntext \\<open>We characterize distributed systems by three underlying type variables:\nType variable 'p captures the processes of the underlying system.\nType variable 's describes the possible states of the processes.\nFinally, type variable 'm describes all possible messages in said system.\n\nEach process is in exactly one state at any point in time of the system.\nProcesses are interconnected by directed channels, which hold messages in-flight\nbetween connected processes. There can be an arbitrary number of channels between\ndifferent processes. The entire state of the system including the (potentially unfinished)\nsnapshot state is called \\emph{configuration}.\\<close>\n\nrecord ('p, 's, 'm) configuration =\n  states :: \"'p \\<Rightarrow> 's\"\n  msgs :: \"channel_id \\<Rightarrow> 'm message fifo\"\n\n  process_snapshot :: \"'p \\<Rightarrow> 's option\"\n  channel_snapshot :: \"channel_id \\<Rightarrow> 'm fifo * recording_state\"\n\ntext \\<open>An event in Chandy and Lamport's formalization describes a\nprocess' state transition, optionally producing or consuming\n(but not both) a message on a channel. Additionally, a process may either initiate\na snapshot spontaneously, or is forced to do so by receiving a snapshot \\emph{marker}\non one of it's incoming channels.\\<close>\n\ndatatype ('p, 's, 'm) event =\n    isTrans: Trans (occurs_on: 'p) 's 's\n  | isSend:  Send  (getId: channel_id)\n                   (occurs_on: 'p)\n                   (partner: 'p)\n                   's 's (getMsg: 'm)\n  | isRecv:  Recv  (getId: channel_id)\n                   (occurs_on: 'p)\n                   (partner: 'p)\n                   's 's (getMsg: 'm)\n\n  | isSnapshot:   Snapshot   (occurs_on: 'p)\n  | isRecvMarker: RecvMarker (getId: channel_id)\n                             (occurs_on: 'p)\n                             (partner: 'p)\n\ntext \\<open>We introduce abbreviations and type synoyms for commonly used terms.\\<close>\n\ntype_synonym ('p, 's, 'm) trace = \"('p, 's, 'm) event list\"\n\nabbreviation ps where \"ps \\<equiv> process_snapshot\"\nabbreviation cs where \"cs \\<equiv> channel_snapshot\"\n\nabbreviation no_snapshot_change where\n  \"no_snapshot_change c c' \\<equiv> ((\\<forall>p'. ps c p' = ps c' p') \\<and> (\\<forall>i'. cs c i' = cs c' i'))\"\n\nabbreviation has_snapshotted where\n  \"has_snapshotted c p \\<equiv> process_snapshot c p \\<noteq> None\"\n\ntext \\<open>A regular event is an event as described in Chandy and Lamport's\noriginal paper: A state transition accompanied by the emission\nor receiving of a message. Nonregular events are related to\nsnapshotting and receiving markers along communication channels.\\<close>\n\ndefinition regular_event[simp]:\n  \"regular_event ev \\<equiv> (isTrans ev \\<or> isSend ev \\<or> isRecv ev)\"\n\nlemma nonregular_event:\n  \"~ regular_event ev = (isSnapshot ev \\<or> isRecvMarker ev)\" \n  by (meson event.distinct_disc event.exhaust_disc regular_event)\n\nlemma event_occurs_on_unique:\n  assumes\n    \"p \\<noteq> q\"\n    \"occurs_on ev = p\"\n  shows\n    \"occurs_on ev \\<noteq> q\"\n  using assms by (cases ev, auto)\n\nsubsection \\<open>The distributed system locale\\<close>\n\ntext \\<open>In order to capture Chandy and Lamport's computation system\nwe introduce two locales. The distributed system locale describes\nglobal truths, such as the mapping from channel IDs to sender and\nreceiver processes, the transition relations for the underlying\ncomputation system and the core assumption that no process has\na channel to itself. While not explicitly mentioned in Chandy's\nand Lamport's work, it makes sense to assume that a channel need\nnot communicate to itself via messages, since it shares memory with\nitself.\\<close>\n\nlocale distributed_system =\n  fixes\n    channel :: \"channel_id \\<Rightarrow> ('p * 'p) option\" and\n    trans :: \"'p \\<Rightarrow> 's \\<Rightarrow> 's \\<Rightarrow> bool\" and\n    send :: \"channel_id \\<Rightarrow> 'p \\<Rightarrow> 'p \\<Rightarrow> 's \\<Rightarrow> 's \\<Rightarrow> 'm \\<Rightarrow> bool\" and\n    recv :: \"channel_id \\<Rightarrow> 'p \\<Rightarrow> 'p \\<Rightarrow> 's \\<Rightarrow> 's \\<Rightarrow> 'm \\<Rightarrow> bool\"\n  assumes\n    no_self_channel:\n      \"\\<forall>i. \\<nexists>p. channel i = Some (p, p)\"\nbegin\n\nsubsubsection \\<open>State transitions\\<close>\n\ndefinition can_occur :: \"('p, 's, 'm) event \\<Rightarrow> ('p, 's, 'm) configuration \\<Rightarrow> bool\" where\n\"can_occur ev c \\<equiv> (case ev of\n    Trans p s s'        \\<Rightarrow> states c p = s\n                        \\<and> trans p s s'\n  | Send i p q s s' msg \\<Rightarrow> states c p = s\n                        \\<and> channel i = Some (p, q)\n                        \\<and> send i p q s s' msg\n  | Recv i p q s s' msg \\<Rightarrow> states c p = s\n                        \\<and> channel i = Some (q, p)\n                        \\<and> length (msgs c i) > 0\n                        \\<and> hd (msgs c i) = Msg msg\n                        \\<and> recv i p q s s' msg\n  | Snapshot p          \\<Rightarrow> \\<not> has_snapshotted c p\n  | RecvMarker i p q    \\<Rightarrow> channel i = Some (q, p)\n                        \\<and> length (msgs c i) > 0\n                        \\<and> hd (msgs c i) = Marker)\"\n\ndefinition src where\n  \"src i p \\<equiv> (\\<exists>q. channel i = Some (p, q))\"\n\ndefinition dest where\n  \"dest i q \\<equiv> (\\<exists>p. channel i = Some (p, q))\"\n\nlemma can_occur_Recv:\n  assumes\n    \"can_occur (Recv i p q s s' m) c\"\n  shows\n    \"states c p = s \\<and> channel i = Some (q, p) \\<and> (\\<exists>xs. msgs c i = Msg m # xs) \\<and> recv i p q s s' m\"\nproof -\n  have \"\\<exists>xs. msgs c i = Msg m # xs\" \n    using assms can_occur_def \n    by (metis (mono_tags, lifting) event.case(3) hd_Cons_tl length_greater_0_conv)\n  then show ?thesis using assms can_occur_def by auto\nqed\n\nabbreviation check_snapshot_occur where\n  \"check_snapshot_occur c c' p \\<equiv>\n    (can_occur (Snapshot p) c \\<and>\n    (ps c' p = Some (states c p))\n  \\<and> (\\<forall>p'. states c p' = states c' p')\n  \\<and> (\\<forall>p'. (p' \\<noteq> p) \\<longrightarrow> ps c' p' = ps c p')\n  \\<and> (\\<forall>i. (\\<exists>q. channel i = Some (p, q)) \\<longrightarrow> msgs c' i = msgs c i @ [Marker])\n  \\<and> (\\<forall>i. (\\<exists>q. channel i = Some (q, p)) \\<longrightarrow> channel_snapshot c' i = (fst (channel_snapshot c i), Recording))\n  \\<and> (\\<forall>i. (\\<nexists>q. channel i = Some (p, q)) \\<longrightarrow> msgs c' i = msgs c i)\n  \\<and> (\\<forall>i. (\\<nexists>q. channel i = Some (q, p)) \\<longrightarrow> channel_snapshot c' i = channel_snapshot c i))\"\n\nabbreviation check_recv_marker_occur where\n  \"check_recv_marker_occur c c' i p q \\<equiv>\n    (can_occur (RecvMarker i p q) c\n  \\<and> (\\<forall>r. states c r = states c' r)\n  \\<and> (\\<forall>r. (r \\<noteq> p) \\<longrightarrow> process_snapshot c r = process_snapshot c' r)\n  \\<and> (Marker # msgs c' i = msgs c i)\n  \\<and> (channel_snapshot c' i = (fst (channel_snapshot c i), Done))\n  \\<and> (if has_snapshotted c p\n        then (process_snapshot c p = process_snapshot c' p)\n           \\<and> (\\<forall>i'. (i' \\<noteq> i) \\<longrightarrow> msgs c' i' = msgs c i')\n           \\<and> (\\<forall>i'. (i' \\<noteq> i) \\<longrightarrow> channel_snapshot c i' = channel_snapshot c' i')\n        else (process_snapshot c' p = Some (states c p))\n           \\<and> (\\<forall>i'. i' \\<noteq> i \\<and> (\\<exists>r. channel i' = Some (p, r))\n             \\<longrightarrow> msgs c' i' = msgs c i' @ [Marker])\n           \\<and> (\\<forall>i'. i' \\<noteq> i \\<and> (\\<exists>r. channel i' = Some (r, p))\n             \\<longrightarrow> channel_snapshot c' i' = (fst (channel_snapshot c i'), Recording))\n           \\<and> (\\<forall>i'. i' \\<noteq> i \\<and> (\\<nexists>r. channel i' = Some (p, r))\n             \\<longrightarrow> msgs c' i' = msgs c i')\n           \\<and> (\\<forall>i'. i' \\<noteq> i \\<and> (\\<nexists>r. channel i' = Some (r, p))\n             \\<longrightarrow> channel_snapshot c' i' = channel_snapshot c i')))\"\n\nabbreviation check_trans_occur where\n  \"check_trans_occur c c' p s s'\\<equiv>\n    (can_occur (Trans p s s') c\n  \\<and> (states c' p = s')\n  \\<and> (\\<forall>r. (r \\<noteq> p) \\<longrightarrow> states c' r = states c r)\n  \\<and> (\\<forall>i. msgs c' i = msgs c i)\n  \\<and> (no_snapshot_change c c'))\"\n\nabbreviation check_send_occur where \n  \"check_send_occur c c' i p q s s' msg \\<equiv>\n    (can_occur (Send i p q s s' msg) c\n  \\<and> (states c' p = s')\n  \\<and> (\\<forall>r. (r \\<noteq> p) \\<longrightarrow> states c' r = states c r)\n  \\<and> (msgs c' i = msgs c i @ [Msg msg])\n  \\<and> (\\<forall>i'. i \\<noteq> i' \\<longrightarrow> msgs c' i' = msgs c i')\n  \\<and> (no_snapshot_change c c'))\"\n\nabbreviation check_recv_occur where\n  \"check_recv_occur c c' i p q s s' msg \\<equiv>\n    (can_occur (Recv i p q s s' msg) c\n  \\<and> (states c p = s \\<and> states c' p = s')\n  \\<and> (\\<forall>r. (r \\<noteq> p) \\<longrightarrow> states c' r = states c r)\n  \\<and> (msgs c i = Msg msg # msgs c' i)\n  \\<and> (\\<forall>i'. i \\<noteq> i' \\<longrightarrow> msgs c' i' = msgs c i')\n  \\<and> (\\<forall>r. process_snapshot c r = process_snapshot c' r)\n  \\<and> (\\<forall>i'. i' \\<noteq> i \\<longrightarrow> channel_snapshot c i' = channel_snapshot c' i')\n  \\<and> (if snd (channel_snapshot c i) = Recording\n     then channel_snapshot c' i = (fst (channel_snapshot c i) @ [msg], Recording)\n     else channel_snapshot c i = channel_snapshot c' i))\"\n\ntext \\<open>The \\emph{next} predicate lets us express configuration transitions\nusing events. The predicate $next(s_1, e, s_2)$ denotes the transition\nof the configuration $s_1$ to $s_2$ via the event $e$. It ensures that\n$e$ can occur in state $s_1$ and the state $s_2$ is correctly constructed\nfrom $s_1$.\\<close>\n\nprimrec \"next\" ::\n  \"('p, 's, 'm) configuration\n  \\<Rightarrow> ('p, 's, 'm) event\n  \\<Rightarrow> ('p, 's, 'm) configuration\n  \\<Rightarrow> bool\"\n  (\"_ \\<turnstile> _ \\<mapsto> _\" [70, 70, 70]) where\n    next_snapshot: \"c \\<turnstile> Snapshot p \\<mapsto> c' =\n      check_snapshot_occur c c' p\"\n  | next_recv_marker: \"c \\<turnstile> RecvMarker i p q \\<mapsto> c' =\n      check_recv_marker_occur c c' i p q\"\n  | next_trans: \"c \\<turnstile> Trans p s s' \\<mapsto> c' =\n      check_trans_occur c c' p s s'\"\n  | next_send: \"c \\<turnstile> Send i p q s s' msg \\<mapsto> c' =\n      check_send_occur c c' i p q s s' msg\"\n  | next_recv: \"c \\<turnstile> Recv i p q s s' msg \\<mapsto> c' =\n      check_recv_occur c c' i p q s s' msg\"\n\ntext \\<open>Useful lemmas about state transitions\\<close>\n\nlemma state_and_event_determine_next:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"c \\<turnstile> ev \\<mapsto> c''\"\n  shows\n    \"c' = c''\"\nproof (cases ev)\n  case (Snapshot p)\n  then have \"states c' = states c''\" using assms by auto\n  moreover have \"msgs c' = msgs c''\"\n  proof (rule ext)\n    fix i\n    show \"msgs c' i = msgs c'' i\"\n    proof (cases \"channel i = None\")\n      case True\n      then show ?thesis using Snapshot assms by auto\n    next\n      case False\n      then obtain r s where \"channel i = Some (r, s)\" by auto\n      with assms Snapshot show ?thesis by (cases \"r = p\", simp_all)\n    qed\n  qed\n  moreover have \"process_snapshot c' = process_snapshot c''\" by (metis Snapshot assms next_snapshot ext)\n  moreover have \"channel_snapshot c' = channel_snapshot c''\"\n  proof (rule ext)\n    fix i\n    show \"channel_snapshot c' i = channel_snapshot c'' i\"\n    proof (cases \"channel i = None\")\n      case True\n      then show ?thesis using assms Snapshot by simp\n    next\n      case False\n      then obtain r s where \"channel i = Some (r, s)\" by auto\n      with assms Snapshot show ?thesis by (cases \"s = p\", simp_all)\n    qed\n  qed\n  ultimately show \"c' = c''\" by simp\nnext\n  case (RecvMarker i p)\n  then have \"states c' = states c''\" using assms by auto\n  moreover have \"msgs c' = msgs c''\"\n  proof (rule ext)\n    fix i'\n    show \"msgs c' i' = msgs c'' i'\"\n    proof (cases \"i' = i\")\n      case True\n      then have \"Marker # msgs c' i' = msgs c i'\" using assms RecvMarker by simp\n      also have \"... = Marker # msgs c'' i'\" using assms RecvMarker `i' = i` by simp\n      finally show ?thesis by simp\n    next\n      case False\n      then show ?thesis\n      proof (cases \"has_snapshotted c p\")\n        case True\n        then show ?thesis using assms RecvMarker `i' \\<noteq> i` by simp\n      next\n        case no_snap: False\n        then show ?thesis\n        proof (cases \"channel i' = None\")\n          case True\n          then show ?thesis using assms RecvMarker `i' \\<noteq> i` no_snap by simp\n        next\n          case False\n          then obtain r s where \"channel i' = Some (r, s)\" by auto\n          with assms RecvMarker no_snap `i' \\<noteq> i` show ?thesis by (cases \"r = p\"; simp_all)\n        qed\n      qed\n    qed\n  qed\n  moreover have \"process_snapshot c' = process_snapshot c''\"\n  proof (rule ext)\n    fix r\n    show \"ps c' r = ps c'' r\"\n    proof (cases \"r \\<noteq> p\")\n      case True\n      then show ?thesis using assms RecvMarker by simp\n    next\n      case False\n      with assms RecvMarker `~ r \\<noteq> p` show ?thesis by (cases \"has_snapshotted c r\", auto)\n    qed\n  qed\n  moreover have \"channel_snapshot c' = channel_snapshot c''\"\n  proof (rule ext)\n    fix i'\n    show \"cs c' i' = cs c'' i'\"\n    proof (cases \"i' = i\")\n      case True\n      then show ?thesis using assms RecvMarker by simp\n    next\n      case False\n      then show ?thesis\n      proof (cases \"has_snapshotted c p\")\n        case True\n        then show ?thesis using assms RecvMarker `i' \\<noteq> i` by simp\n      next\n        case no_snap: False\n        then show ?thesis\n        proof (cases \"channel i' = None\")\n          case True\n          then show ?thesis using assms RecvMarker `i' \\<noteq> i` no_snap by simp\n        next\n          case False\n          then obtain r s where \"channel i' = Some (r, s)\" by auto\n          with assms RecvMarker no_snap `i' \\<noteq> i` show ?thesis by (cases \"s = p\"; simp_all)\n        qed\n      qed\n    qed\n  qed\n  ultimately show \"c' = c''\" by simp\nnext\n  case (Trans p s s')\n  then have \"states c' = states c''\" by (metis (no_types, lifting) assms next_trans ext)\n  moreover have \"msgs c' = msgs c''\" using assms Trans by auto\n  moreover have \"process_snapshot c' = process_snapshot c''\" using assms Trans by auto\n  moreover have \"channel_snapshot c' = channel_snapshot c''\" using assms Trans by auto\n  ultimately show \"c' = c''\" by simp\nnext\n  case (Send i p s s' m)\n  then have \"states c' = states c''\" by (metis (no_types, lifting) assms next_send ext)\n  moreover have \"msgs c' = msgs c''\"\n  proof (rule ext)\n    fix i'\n    from assms Send show \"msgs c' i' = msgs c'' i'\" by (cases \"i' = i\", simp_all)\n  qed\n  moreover have \"process_snapshot c' = process_snapshot c''\" using assms Send by auto\n  moreover have \"channel_snapshot c' = channel_snapshot c''\" using assms Send by auto\n  ultimately show \"c' = c''\" by simp\nnext\n  case (Recv i p s s' m)\n  then have \"states c' = states c''\" by (metis (no_types, lifting) assms next_recv ext)\n  moreover have \"msgs c' = msgs c''\"\n  proof (rule ext)\n    fix i'\n    from assms Recv show \"msgs c' i' = msgs c'' i'\" by (cases \"i' = i\", simp_all)\n  qed\n  moreover have \"process_snapshot c' = process_snapshot c''\" using assms Recv by auto\n  moreover have \"channel_snapshot c' = channel_snapshot c''\"\n  proof (rule ext)\n    fix i'\n    show \"cs c' i' = cs c'' i'\"\n    proof (cases \"i' \\<noteq> i\")\n      case True\n      then show ?thesis using assms Recv by simp\n    next\n      case False\n      with assms Recv show ?thesis by (cases \"snd (cs c i') = Recording\", auto)\n    qed\n  qed\n  ultimately show \"c' = c''\" by simp\nqed\n\nlemma exists_next_if_can_occur:\n  assumes\n    \"can_occur ev c\"\n  shows\n    \"\\<exists>c'. c \\<turnstile> ev \\<mapsto> c'\"\nproof (cases ev)\n  case (Snapshot p)\n  let ?c = \"\\<lparr> states = states c,\n              msgs = %i. if (\\<exists>q. channel i = Some (p, q)) then msgs c i @ [Marker] else msgs c i,\n              process_snapshot = %r. if r = p then Some (states c p) else ps c r,\n              channel_snapshot = %i. if (\\<exists>q. channel i = Some (q, p)) then (fst (cs c i), Recording) else cs c i \\<rparr>\"\n  have \"c \\<turnstile> ev \\<mapsto> ?c\" using Snapshot assms by auto\n  then show ?thesis by blast\nnext\n  case (RecvMarker i p q)\n  show ?thesis\n  proof (cases \"has_snapshotted c p\")\n    case True\n    let ?c = \"\\<lparr> states = states c,\n                msgs = %i'. if i = i' then tl (msgs c i') else msgs c i',\n                process_snapshot = ps c,\n                channel_snapshot = %i'. if i = i' then (fst (cs c i'), Done) else cs c i' \\<rparr>\"\n    have \"msgs c i = Marker # msgs ?c i\"\n      using assms can_occur_def RecvMarker hd_Cons_tl by fastforce\n    then have \"c \\<turnstile> ev \\<mapsto> ?c\" using True RecvMarker assms by auto\n    then show ?thesis by blast\n  next\n    case False\n    let ?c = \"\\<lparr> states = states c,\n                msgs = %i'. if i' = i\n                                  then tl (msgs c i')\n                                  else if (\\<exists>r. channel i' = Some (p, r))\n                                         then msgs c i' @ [Marker]\n                                         else msgs c i',\n                process_snapshot = %r. if r = p then Some (states c r) else ps c r,\n                channel_snapshot = %i'. if i = i' then (fst (cs c i'), Done)\n                                              else if (\\<exists>r. channel i' = Some (r, p))\n                                                     then (fst (cs c i'), Recording)\n                                                     else cs c i' \\<rparr>\"\n    have \"msgs c i = Marker # msgs ?c i\"\n      using assms can_occur_def RecvMarker hd_Cons_tl by fastforce\n    moreover have \"ps ?c p = Some (states c p)\" by simp\n    ultimately have \"c \\<turnstile> ev \\<mapsto> ?c\" using RecvMarker assms False by auto\n    then show ?thesis by blast\n  qed\nnext\n  case (Trans p s s')\n  let ?c = \"\\<lparr> states = %r. if r = p then s' else states c r,\n              msgs = msgs c,\n              process_snapshot = ps c,\n              channel_snapshot = cs c \\<rparr>\"\n  have \"c \\<turnstile> ev \\<mapsto> ?c\" \n    using Trans assms by auto\n  then show ?thesis by blast\nnext\n  case (Send i p q s s' msg)\n    let ?c = \"\\<lparr> states = %r. if r = p then s' else states c r,\n              msgs = %i'. if i = i' then msgs c i' @ [Msg msg] else msgs c i',\n              process_snapshot = ps c,\n              channel_snapshot = cs c \\<rparr>\"\n  have \"c \\<turnstile> ev \\<mapsto> ?c\" \n    using Send assms by auto\n  then show ?thesis by blast\nnext\n  case (Recv i p q s s' msg)\n  then show ?thesis\n  proof (cases \"snd (cs c i)\")\n    case Recording\n    let ?c = \"\\<lparr> states = %r. if r = p then s' else states c r,\n                msgs = %i'. if i = i' then tl (msgs c i') else msgs c i',\n                process_snapshot = ps c,\n                channel_snapshot = %i'. if i = i'\n                                              then (fst (cs c i') @ [msg], Recording)\n                                              else cs c i'\\<rparr>\"\n    have \"c \\<turnstile> ev \\<mapsto> ?c\" \n      using Recv Recording assms can_occur_Recv by fastforce\n    then show ?thesis by blast\n  next\n    case Done\n    let ?c = \"\\<lparr> states = %r. if r = p then s' else states c r,\n                msgs = %i'. if i = i' then tl (msgs c i') else msgs c i',\n                process_snapshot = ps c,\n                channel_snapshot = cs c \\<rparr>\"\n    have \"c \\<turnstile> ev \\<mapsto> ?c\"\n      using Done Recv assms can_occur_Recv by fastforce\n    then show ?thesis by blast\n  next\n    case NotStarted\n    let ?c = \"\\<lparr> states = %r. if r = p then s' else states c r,\n                msgs = %i'. if i = i' then tl (msgs c i') else msgs c i',\n                process_snapshot = ps c,\n                channel_snapshot = cs c \\<rparr>\"\n    have \"c \\<turnstile> ev \\<mapsto> ?c\"\n      using NotStarted Recv assms can_occur_Recv by fastforce\n    then show ?thesis by blast\n  qed\nqed\n\nlemma exists_exactly_one_following_state:\n  \"can_occur ev c \\<Longrightarrow> \\<exists>!c'. c \\<turnstile> ev \\<mapsto> c'\"\n  using exists_next_if_can_occur state_and_event_determine_next by blast\n\nlemma no_state_change_if_no_event:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"occurs_on ev \\<noteq> p\"\n  shows\n    \"states c p = states c' p \\<and> process_snapshot c p = process_snapshot c' p\"\n  using assms by (cases ev, auto)\n\n\n\nlemma no_cs_change_if_no_channel:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"channel i = None\"\n  shows\n    \"cs c i = cs c' i\"\nusing assms proof (cases ev)\n  case (RecvMarker cid p)\n  then have \"cid \\<noteq> i\" using assms RecvMarker can_occur_def by fastforce\n  with assms RecvMarker show ?thesis by (cases \"has_snapshotted c p\", auto)\nnext\n  case (Send cid p s s' m)\n  then have \"cid \\<noteq> i\" using assms Send can_occur_def by fastforce\n  then show ?thesis using assms Send by auto\nnext\n  case (Recv cid p s s' m)\n  then have \"cid \\<noteq> i\" using assms Recv can_occur_def by fastforce\n  then show ?thesis using assms Recv by simp\nqed simp_all\n\nlemma no_msg_change_if_no_event:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"isSend ev \\<longrightarrow> getId ev \\<noteq> i\" and\n    \"isRecv ev \\<longrightarrow> getId ev \\<noteq> i\" and\n    \"regular_event ev\"\n  shows\n    \"msgs c i = msgs c' i\"\nproof (cases \"channel i = None\")\n  case True\n  then show ?thesis using assms no_msgs_change_if_no_channel by simp\nnext\n  have \"isTrans ev \\<or> isSend ev \\<or> isRecv ev\" using assms by simp\n  then show ?thesis\n  proof (elim disjE)\n    assume \"isTrans ev\"\n    then show ?thesis \n      by (metis assms(1) event.collapse(1) next_trans)\n  next\n    assume \"isSend ev\"\n    then obtain i' r s u u' m where Send: \"ev = Send i' r s u u' m\" by (meson isSend_def)\n    then show ?thesis using Send assms by auto\n  next\n    assume \"isRecv ev\"\n    then obtain i' r s u u' m where \"ev = Recv i' r s u u' m\" by (meson isRecv_def)\n    then show ?thesis using assms by auto\n  qed\nqed\n\nlemma no_cs_change_if_no_event:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"isRecv ev \\<longrightarrow> getId ev \\<noteq> i\" and\n    \"regular_event ev\"\n  shows\n    \"cs c i = cs c' i\"\nproof -\n  have \"isTrans ev \\<or> isSend ev \\<or> isRecv ev\" using assms by simp\n  then show ?thesis\n  proof (elim disjE)\n    assume \"isTrans ev\"\n    then show ?thesis \n      by (metis assms(1) event.collapse(1) next_trans)\n  next\n    assume \"isSend ev\"\n    then obtain i' r s u u' m where \"ev = Send i' r s u u' m\" by (meson isSend_def)\n    then show ?thesis using assms by auto\n  next\n    assume \"isRecv ev\"\n    then obtain i r s u u' m where \"ev = Recv i r s u u' m\" by (meson isRecv_def)\n    then show ?thesis using assms by auto\n  qed\nqed\n\nlemma happen_implies_can_occur:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\"\n  shows\n    \"can_occur ev c\"\nproof -\n  show ?thesis using assms by (cases ev, auto)\nqed\n\nlemma snapshot_increases_message_length:\n  assumes\n    \"ev = Snapshot p\" and\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"channel i = Some (q, r)\"\n  shows\n    \"length (msgs c i) \\<le> length (msgs c' i)\"\n  using assms by (cases \"p = q\", auto)\n\nlemma recv_marker_changes_head_only_at_i:\n  assumes\n    \"ev = RecvMarker i p q\" and\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"i' \\<noteq> i\"\n  shows\n    \"msgs c i' = [] \\<or> hd (msgs c i') = hd (msgs c' i')\"\nproof (cases \"channel i' = None\")\n  case True\n  then show ?thesis using assms no_msgs_change_if_no_channel by presburger\nnext\n  case False\n  then show ?thesis\n  proof (cases \"msgs c i'\")\n    case Nil\n    then show ?thesis by simp\n  next\n    case (Cons m xs)\n    then obtain r s where \"channel i' = Some (r, s)\" using False by auto\n    then show ?thesis\n    proof (cases \"has_snapshotted c p\")\n      case True\n      then show ?thesis using assms by auto\n    next\n      case False\n      with assms show ?thesis by (cases \"r = p\", auto)\n    qed\n  qed\nqed\n\nlemma recv_marker_other_channels_not_shrinking:\n  assumes\n    \"ev = RecvMarker i p q\" and\n    \"c \\<turnstile> ev \\<mapsto> c'\"\n  shows\n    \"length (msgs c i') \\<le> length (msgs c' i') \\<longleftrightarrow> i \\<noteq> i'\"\nproof (rule iffI)\n  show \"length (msgs c i') \\<le> length (msgs c' i') \\<Longrightarrow> i \\<noteq> i'\"\n  proof (rule ccontr)\n    assume asm: \"~ i \\<noteq> i'\" \"length (msgs c i') \\<le> length (msgs c' i')\"\n    then have \"msgs c i = Marker # msgs c' i\" using assms by auto\n    then have \"length (msgs c i) > length (msgs c' i)\" by simp\n    then have \"length (msgs c i') > length (msgs c' i')\" using asm by simp\n    then show False using asm by simp\n  qed\nnext\n  show \"i \\<noteq> i' \\<Longrightarrow> length (msgs c i') \\<le> length (msgs c' i')\"\n  proof -\n    assume \"i \\<noteq> i'\"\n    then show ?thesis\n    proof (cases \"channel i' = None\")\n      case True\n      then show ?thesis using assms no_msgs_change_if_no_channel by presburger\n    next\n      case False\n      then obtain r s where chan: \"channel i' = Some (r, s)\" by auto\n      then show ?thesis\n      proof (cases \"has_snapshotted c p\")\n        case True\n        with assms `i \\<noteq> i'` show ?thesis by auto\n      next\n        case no_snap: False\n        then show ?thesis\n        proof (cases \"p = r\")\n          case True\n          then have \"msgs c' i' = msgs c i' @ [Marker]\" using `i \\<noteq> i'` assms no_snap chan by auto\n          then show ?thesis by auto\n        next\n          case False\n          then show ?thesis using assms `i \\<noteq> i'` chan no_snap by auto\n        qed\n      qed\n    qed\n  qed\nqed\n\nlemma regular_event_cannot_induce_snapshot:\n  assumes\n    \"~ has_snapshotted c p\" and\n    \"c \\<turnstile> ev \\<mapsto> c'\"\n  shows\n    \"regular_event ev \\<longrightarrow> ~ has_snapshotted c' p\"\nproof (cases ev)\n  case (Trans q s s')\n  then show ?thesis using assms(1) assms(2) by auto\nnext\n  case (Send q r s s' m)\n  then show ?thesis using assms by auto\nnext\n  case (Recv q r s s' m) \n  then show ?thesis using assms by auto\nqed simp_all\n\nlemma regular_event_preserves_process_snapshots:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\"\n  shows\n    \"regular_event ev \\<Longrightarrow> ps c r = ps c' r\"\nproof (cases ev)\n  case (Trans p s s')\n  then show ?thesis \n    using assms by auto\nnext\n  case (Send p q s s' m)\n  then show ?thesis \n    using assms by auto\nnext\n  case (Recv p q s s' m)\n  then show ?thesis \n    using assms by auto\nqed simp_all\n\nlemma no_state_change_if_nonregular_event:\n  assumes\n    \"~ regular_event ev\" and\n    \"c \\<turnstile> ev \\<mapsto> c'\"\n  shows\n    \"states c p = states c' p\"\nproof -\n  have \"isSnapshot ev \\<or> isRecvMarker ev\" using nonregular_event assms by auto\n  then show ?thesis\n  proof (elim disjE, goal_cases)\n    case 1\n    then obtain q where \"ev = Snapshot q\" \n      by (meson isSnapshot_def)\n    then show ?thesis \n      using assms(2) by auto\n  next\n    case 2\n    then obtain i q r where \"ev = RecvMarker i q r\"\n      by (meson isRecvMarker_def)\n    then show ?thesis using assms(2) by auto\n  qed\nqed\n\nlemma nonregular_event_induces_snapshot:\n  assumes\n    \"~ has_snapshotted c p\" and\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"occurs_on ev = p\" and\n    \"~ regular_event ev\"\n  shows\n    \"~ regular_event ev \\<longrightarrow> has_snapshotted c' p\"\nproof (cases ev)\n  case (Snapshot q)\n  then have \"q = p\" using assms by auto\n  then show ?thesis using Snapshot assms(2) by auto\nnext\n  case (RecvMarker i q r)\n  then have \"q = p\" using assms by auto\n  then show ?thesis using RecvMarker assms by auto\nqed (simp_all add: assms)\n\nlemma snapshot_state_unchanged:\n  assumes\n    step: \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"has_snapshotted c p\"\n  shows\n    \"ps c p = ps c' p\"\nproof (cases \"occurs_on ev = p\")\n  case False\n  then show ?thesis \n    using local.step no_state_change_if_no_event by auto\nnext\n  case True\n  then show ?thesis\n  proof (cases \"regular_event ev\")\n    case True\n    then show ?thesis \n      using local.step regular_event_preserves_process_snapshots by auto\n  next\n    case False\n    have \"isRecvMarker ev\"\n    proof (rule ccontr)\n      have \"isSnapshot ev \\<or> isRecvMarker ev\" \n        using False nonregular_event by blast\n      moreover assume \"~ isRecvMarker ev\"\n      ultimately have \"isSnapshot ev\" by simp\n      then have \"ev = Snapshot p\" by (metis True event.collapse(4))\n      then have \"can_occur ev c\" \n        using happen_implies_can_occur local.step by blast\n      then have \"~ has_snapshotted c p\" unfolding can_occur_def \n        by (simp add: \\<open>ev = Snapshot p\\<close>)\n      then show False using assms by auto\n    qed\n    then show ?thesis (* z3 sledgehammer fails for Isabelle2019 *)\n    proof -\n      have \"\\<exists>n pa. c \\<turnstile> RecvMarker n p pa \\<mapsto> c'\"\n        by (metis True \\<open>isRecvMarker ev\\<close> event.collapse(5) local.step)\n      then show ?thesis\n        using assms(2) by force\n    qed\n  qed\nqed\n\nlemma message_must_be_delivered:\n  assumes\n    valid: \"c \\<turnstile> ev \\<mapsto> c'\" and\n    delivered: \"(msgs c i \\<noteq> [] \\<and> hd (msgs c i) = m) \\<and> (msgs c' i = [] \\<or> hd (msgs c' i) \\<noteq> m)\"\n  shows\n    \"(\\<exists>p q.         ev = RecvMarker i p q   \\<and> m = Marker)\n   \\<or> (\\<exists>p q s s' m'. ev = Recv i p q s s' m' \\<and> m = Msg m')\"\nproof (cases ev)\n  case (Snapshot p)\n  then show ?thesis\n  proof (cases \"msgs c i\")\n    case Nil\n    then show ?thesis using delivered by simp\n  next\n    case (Cons m xs)\n    with assms Snapshot show ?thesis\n    proof (cases \"channel i = None\")\n      case True\n      then show ?thesis using assms Snapshot by auto\n    next\n      case False\n      then obtain r s where chan: \"channel i = Some (r, s)\" by auto\n      then show ?thesis\n      proof (cases \"r = p\")\n        case True\n        then have \"msgs c' i = msgs c i @ [Marker]\" using assms(1) Snapshot chan by auto\n        then show ?thesis using delivered by auto\n      next\n        case False\n        then have \"msgs c' i = msgs c i\" using assms Snapshot chan by simp\n        then show ?thesis using delivered Cons by simp\n      qed\n    qed\n  qed\nnext\n  case (RecvMarker i' p q)\n  then have \"i' = i\" \n    by (metis assms(1) delivered le_0_eq length_greater_0_conv list.size(3) recv_marker_changes_head_only_at_i recv_marker_other_channels_not_shrinking)\n  moreover have \"Marker = m\"\n    using `i' = i` RecvMarker assms(1) can_occur_def delivered by auto\n  moreover have \"channel i = Some (q, p)\" \n    using RecvMarker assms(1) calculation(1) can_occur_def by auto\n  ultimately show ?thesis using RecvMarker by simp\nnext\n  case (Trans p' s s')\n  then show ?thesis\n    using valid delivered by auto\nnext\n  case (Send p' q' s s' m')\n  then show ?thesis\n    by (metis (no_types, lifting) delivered distributed_system.next.simps(4) distributed_system_axioms hd_append2 snoc_eq_iff_butlast valid)\nnext\n  case (Recv i' p q s s' m')\n  then have \"i = i'\" \n    using assms(1) delivered by auto\n  also have \"m = Msg m'\" \n    by (metis (no_types, lifting) Recv delivered list.sel(1) next_recv valid)\n  ultimately show ?thesis using Recv by auto\nqed\n\nlemma message_must_be_delivered_2:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\"\n    \"m : set (msgs c i)\"\n    \"m \\<notin> set (msgs c' i)\"\n  shows\n    \"(\\<exists>p q. ev = RecvMarker i p q \\<and> m = Marker) \\<or> (\\<exists>p q s s' m'. ev = Recv i p q s s' m' \\<and> m = Msg m')\"\nproof -\n  have uneq_sets: \"set (msgs c i) \\<noteq> set (msgs c' i)\" \n    using assms(2) assms(3) by blast\n  then obtain p q where chan: \"channel i = Some (p, q)\"\n    using assms no_msgs_change_if_no_channel by fastforce\n  then show ?thesis\n  proof (cases ev)\n    case (Snapshot p')\n    with Snapshot assms chan have \"set (msgs c' i) = set (msgs c i)\" by (cases \"p' = p\", auto)\n    then show ?thesis using uneq_sets by simp\n  next\n    case (Trans p' s s')\n    then show ?thesis using uneq_sets assms by simp\n  next\n    case (Send i' p' q' s s' m)\n    then show ?thesis\n      by (metis (no_types, lifting) UnCI assms(1) assms(2) assms(3) local.next.simps(4) set_append)\n  next\n    case (RecvMarker i' p' q')\n    have \"i' = i\"\n    proof (rule ccontr)\n      assume \"~ i' = i\"\n      show False using assms chan RecvMarker\n      proof (cases \"has_snapshotted c p'\")\n        case True\n        then show False using assms chan RecvMarker `~ i' = i` by simp\n      next\n        case False\n        then show False using assms chan RecvMarker `~ i' = i` by (cases \"p' = p\", simp_all)\n      qed\n    qed\n    moreover have \"m = Marker\"\n    proof -\n      have \"msgs c i' = Marker # msgs c' i'\" using assms chan RecvMarker by auto\n      then show ?thesis using assms `i' = i` by simp\n    qed\n    ultimately show ?thesis using RecvMarker by simp\n  next\n    case (Recv i' p' q' s s' m')\n    have \"i' = i\"\n    proof (rule ccontr)\n      assume \"~ i' = i\"\n      then show False \n        using Recv assms(1) uneq_sets by auto\n    qed\n    then have \"i' = i \\<and> m = Msg m'\" \n      using Recv assms by auto\n    then show ?thesis using Recv by simp\n  qed\nqed\n\nlemma recv_marker_means_snapshotted_1:\n  assumes\n    \"ev = RecvMarker i p q\" and\n    \"c \\<turnstile> ev \\<mapsto> c'\"\n  shows\n    \"has_snapshotted c' p\"\n  using assms snapshot_state_unchanged by (cases \"has_snapshotted c p\", auto)\n\nlemma recv_marker_means_snapshotted_2:\n  fixes\n    c c' :: \"('p, 's, 'm) configuration\" and\n    ev :: \"('p, 's, 'm) event\" and\n    i :: channel_id\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"Marker : set (msgs c i)\" and\n    \"Marker \\<notin> set (msgs c' i)\" and\n    \"channel i = Some (q, p)\"\n  shows\n    \"has_snapshotted c' p\"\nproof -\n  have \"\\<exists>p q. ev = RecvMarker i p q\"\n    using assms message_must_be_delivered_2 by blast\n  then obtain r s where RecvMarker: \"ev = RecvMarker i r s\"\n    by blast\n  then have \"r = p\"\n    using assms(1) assms(4) can_occur_def by auto\n  then show ?thesis\n    using recv_marker_means_snapshotted_1 assms RecvMarker by blast\nqed\n\nlemma event_stays_valid_if_no_occurrence:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"occurs_on ev \\<noteq> occurs_on ev'\" and\n    \"can_occur ev' c\"\n  shows\n    \"can_occur ev' c'\"\nproof (cases ev')\n  case (Trans p s s')\n  have \"states c p = states c' p\"\n    using Trans assms(1) assms(2) no_state_change_if_no_event by auto\n  moreover have \"states c p = s\" using can_occur_def assms Trans by simp\n  ultimately have \"states c' p = s\" by simp\n  moreover have \"trans p s s'\" \n    using Trans assms(3) can_occur_def by auto\n  ultimately show ?thesis \n    by (simp add: Trans can_occur_def)\nnext\n  case (Recv i p q s s' m)\n  then have \"hd (msgs c i) = Msg m\"\n  proof -\n    from Recv have \"length (msgs c i) > 0\" using assms(3) can_occur_def by auto\n    then obtain m' xs where mcqp: \"msgs c i = m' # xs\"\n      by (metis list.size(3) nat_less_le neq_Nil_conv)\n    then have \"Msg m = m'\"\n    proof (cases m', auto)\n      case Marker\n      then have \"msgs c i = Marker # xs\" by (simp add:mcqp)\n      then have \"~ can_occur ev' c\" using Recv can_occur_def by simp\n      then show False using assms(3) by simp\n    next\n      case (Msg msg)\n      then have \"msgs c i = Msg msg # xs\" by (simp add: mcqp)\n      then show \"m = msg\" using Recv can_occur_def assms(3) by simp\n    qed\n    then show ?thesis by (simp add: mcqp)\n  qed\n  show ?thesis\n  proof (rule ccontr)\n    assume asm: \"~ can_occur ev' c'\"\n    then have \"msgs c' i = [] \\<or> hd (msgs c' i) \\<noteq> Msg m\"\n      using Recv assms can_occur_def no_state_change_if_no_event distributed_system_axioms list.case_eq_if by fastforce\n    then obtain i' p' q' s'' s''' m' where RMoR: \"ev = RecvMarker i' p' q' \\<or> ev = Recv i p' q' s'' s''' m'\"\n      by (metis Recv \\<open>hd (msgs c i) = Msg m\\<close> assms(1) assms(3) can_occur_Recv list.discI message_must_be_delivered)\n    then have \"occurs_on ev = p\" \n    proof -\n      have f1: \"states c p = s \\<and> channel i = Some (q, p) \\<and> recv i p q s s' m \\<and> 0 < length (msgs c i) \\<and> hd (msgs c i) = Msg m\"\n        using Recv assms(3) can_occur_def by force\n      have f2: \"RecvMarker i' p' q' = ev \\<or> states c p' = s'' \\<and> channel i = Some (q', p') \\<and> recv i p' q' s'' s''' m' \\<and> 0 < length (msgs c i) \\<and> hd (msgs c i) = Msg m'\"\n        using RMoR assms(1) can_occur_def by force\n      have \"\\<forall>e n c. \\<exists>p pa s sa m. \\<forall>ca cb. (\\<not> c \\<turnstile> e \\<mapsto> ca \\<or> msgs ca n \\<noteq> [] \\<or> hd (msgs c n) = Marker \\<or> msgs c n = [] \\<or> Recv n p pa s sa m = e) \\<and> (\\<not> c \\<turnstile> e \\<mapsto> cb \\<or> hd (msgs c n) = Marker \\<or> hd (msgs cb n) = hd (msgs c n) \\<or> msgs c n = [] \\<or> Recv n p pa s sa m = e)\"\n        by (metis (no_types) message_must_be_delivered)\n      then show ?thesis\n        using f2 f1 by (metis RMoR \\<open>msgs c' i = [] \\<or> hd (msgs c' i) \\<noteq> Msg m\\<close> assms(1) event.disc(13,15) event.sel(3,5) length_greater_0_conv message.distinct(1) option.inject prod.inject)\n    qed\n    then show False using assms Recv by simp\n  qed\nnext\n  case (Send i p q s s' m)\n  then have \"states c p = states c' p\" using assms no_state_change_if_no_event by auto\n  then show \"can_occur ev' c'\" using assms assms(3) can_occur_def Send by auto\nnext\n  case (RecvMarker i p q)\n  then have msgs_ci: \"hd (msgs c i) = Marker \\<and> length (msgs c i) > 0\"\n  proof -\n    from RecvMarker have \"length (msgs c i) > 0\" using assms(3) can_occur_def by auto\n    then obtain m' xs where mci: \"msgs c i = m' # xs\"\n      by (metis list.size(3) nat_less_le neq_Nil_conv)\n    then have m_mark: \"Marker = m'\"\n    proof (cases m', auto)\n      case (Msg msg)\n      then have \"msgs c i = Msg msg # xs\" by (simp add:mci)\n      then have \"~ can_occur ev' c\" using RecvMarker can_occur_def by simp\n      then show False using assms(3) by simp\n    qed\n    then show ?thesis by (simp add: mci)\n  qed\n  show ?thesis\n  proof (rule ccontr)\n    assume asm: \"~ can_occur ev' c'\"\n    then have \"msgs c' i = [] \\<or> hd (msgs c' i) \\<noteq> Marker\"\n      using RecvMarker assms(3) can_occur_def list.case_eq_if by fastforce\n    then have \"\\<exists>p q. ev = RecvMarker i p q \\<and> Marker = Marker\" using message_must_be_delivered msgs_ci assms by blast\n    then obtain r s where RecvMarker_ev: \"ev = RecvMarker i r s\" by blast\n    then have \"p = r \\<and> q = s\" \n      using RecvMarker assms(1) assms(3) can_occur_def by auto\n    then have \"occurs_on ev = p\" using assms RecvMarker_ev by auto\n    then show False using assms using RecvMarker by auto\n  qed\nnext\n  case (Snapshot p)\n  then have \"~ has_snapshotted c p\" using assms assms(3) can_occur_def by simp\n  show ?thesis\n  proof (rule ccontr)\n    assume asm: \"~ can_occur ev' c'\"\n    then have \"has_snapshotted c' p\" using can_occur_def Snapshot by simp\n    then have \"occurs_on ev = p\"\n      using \\<open>\\<not> has_snapshotted c p\\<close> assms(1) no_state_change_if_no_event by fastforce\n    then show False using assms(2) Snapshot by auto\n  qed\nqed\n\nlemma msgs_unchanged_for_other_is:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"regular_event ev\" and\n    \"getId ev = i\" and\n    \"i' \\<noteq> i\"\n  shows\n    \"msgs c i' = msgs c' i'\"\nproof -\n  have \"isTrans ev \\<or> isSend ev \\<or> isRecv ev\" using assms by simp\n  then show ?thesis\n  proof (elim disjE, goal_cases)\n    case 1\n    then obtain p s s' where \"ev = Trans p s s'\" by (meson isTrans_def)\n    then show ?thesis using assms by simp\n  next\n    case 2\n    then obtain i' p q s s' m where \"ev = Send i' p q s s' m\" by (meson isSend_def)\n    then show ?thesis using assms by simp\n  next\n    case 3\n    then obtain i' p q s s' m where \"ev = Recv i' p q s s' m\" by (meson isRecv_def)\n    with assms show ?thesis by auto\n  qed\nqed\n\nlemma msgs_unchanged_if_snapshotted_RecvMarker_for_other_is:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"ev = RecvMarker i p q\" and\n    \"has_snapshotted c p\" and\n    \"i' \\<noteq> i\"\n  shows\n    \"msgs c i' = msgs c' i'\"\n  using assms by auto\n\nlemma event_can_go_back_if_no_sender:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"occurs_on ev \\<noteq> occurs_on ev'\" and\n    \"can_occur ev' c'\" and\n    \"~ isRecvMarker ev'\" and\n    \"~ isSend ev\"\n  shows\n    \"can_occur ev' c\"\nproof (cases ev')\n  case (Snapshot p)\n  then have \"~ has_snapshotted c' p\" using assms(3) can_occur_def by simp\n  then have \"~ has_snapshotted c p\" using assms(1) snapshot_state_unchanged by force\n  then show ?thesis using can_occur_def Snapshot by simp\nnext\n  case (RecvMarker i p q)\n  then show ?thesis using assms(4) by auto\nnext\n  case (Trans p s s')\n  then show ?thesis\n    using assms(1) assms(2) can_occur_def no_state_change_if_no_event assms(3) by auto\nnext\n  case (Send p q s s' m)\n  then show ?thesis\n    using assms(1) assms(2) can_occur_def no_state_change_if_no_event assms(3) by auto\nnext\n  case (Recv i p q s s' m)\n  have \"msgs c' i \\<noteq> Nil\" using Recv can_occur_def assms by auto\n  moreover have \"hd (msgs c' i) = Msg m \\<and> length (msgs c' i) > 0\"\n  proof -\n    from Recv have \"length (msgs c' i) > 0\" using assms(3) can_occur_def by auto\n    then obtain m' xs where mcqp: \"msgs c' i = m' # xs\"\n      by (metis list.size(3) nat_less_le neq_Nil_conv)\n    then have \"Msg m = m'\"\n    proof (cases m', auto)\n      case Marker\n      then have \"msgs c' i = Marker # xs\" by (simp add:mcqp)\n      then have \"~ can_occur ev' c'\" using Recv can_occur_def by simp\n      then show False using assms(3) by simp\n    next\n      case (Msg msg)\n      then have \"msgs c' i = Msg msg # xs\" by (simp add: mcqp)\n      then show \"m = msg\" using Recv can_occur_def assms(3) by simp\n    qed\n    then show ?thesis by (simp add: mcqp)\n  qed\n  moreover have \"msgs c i \\<noteq> Nil \\<and> hd (msgs c' i) = hd (msgs c i)\"\n  proof (cases ev)\n    case (Snapshot p')\n    then have \"p' \\<noteq> p\" using assms Recv by simp\n    have chan: \"channel i = Some (q, p)\" \n      by (metis Recv assms(3) distributed_system.can_occur_Recv distributed_system_axioms)\n    with Snapshot assms have \"length (msgs c i) > 0 \\<and> hd (msgs c i) = hd (msgs c' i)\"\n    proof (cases \"q = p'\")\n      case True\n      then have \"msgs c' i = msgs c i @ [Marker]\" using Snapshot chan assms by simp\n      then show ?thesis \n        by (metis append_self_conv2 calculation(2) hd_append2 length_greater_0_conv list.sel(1) message.simps(3))\n    next\n      case False\n      then have \"msgs c' i = msgs c i\" using Snapshot chan assms by simp\n      then show ?thesis using calculation by simp\n    qed\n    then show ?thesis by simp\n  next\n    case (RecvMarker i' p' q')\n    then have \"i' \\<noteq> i\" \n      using Recv assms(1) assms(2) assms(3) can_occur_def by force\n    then show ?thesis\n    proof (cases \"has_snapshotted c p'\")\n      case True\n      then have \"msgs c i = msgs c' i\" using `i' \\<noteq> i` RecvMarker assms by simp\n      then show ?thesis using calculation by simp\n    next\n      case no_snap: False\n      then have chan: \"channel i = Some (q, p)\" \n        by (metis Recv assms(3) distributed_system.can_occur_Recv distributed_system_axioms)\n      then show ?thesis\n      proof (cases \"q = p'\")\n        case True\n        then have \"msgs c' i = msgs c i @ [Marker]\" \n          using no_snap RecvMarker \\<open>i' \\<noteq> i\\<close> assms(1) chan by auto\n        then show ?thesis \n          by (metis append_self_conv2 calculation(2) hd_append2 list.sel(1) message.simps(3))\n      next\n        case False\n        then have \"msgs c' i = msgs c i\" using RecvMarker no_snap False chan assms `i' \\<noteq> i` by simp\n        then show ?thesis using calculation by simp\n      qed\n    qed\n  next\n    case (Trans p' s'' s''')\n    then show ?thesis using assms(1) `msgs c' i \\<noteq> Nil` by auto\n  next\n    case (Send i' p' q' s'' s''' m'')\n    have \"p' \\<noteq> p\"\n      using Recv Send assms(2) by auto\n    then show ?thesis \n      using Recv Send assms(1) assms(5) calculation(1) by auto\n  next\n    case (Recv i' p' q' s'' s''' m'')\n    then have \"i' \\<noteq> i\" using assms `ev' = Recv i p q s s' m` \n      by (metis distributed_system.can_occur_Recv distributed_system_axioms event.sel(3) next_recv option.inject prod.inject)\n    have \"msgs c i = msgs c' i\" using msgs_unchanged_for_other_is Recv \\<open>i' \\<noteq> i\\<close> assms(1) by auto\n    then show ?thesis using `msgs c' i \\<noteq> Nil` by simp\n  qed\n  moreover have \"states c p = states c' p\" using no_state_change_if_no_event assms Recv by simp\n  ultimately show ?thesis\n    using Recv assms(3) can_occur_def list.case_eq_if by fastforce\nqed\n\nlemma nonregular_event_can_go_back_if_in_distinct_processes:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"regular_event ev\" and\n    \"~ regular_event ev'\" and\n    \"can_occur ev' c'\" and\n    \"occurs_on ev \\<noteq> occurs_on ev'\"\n  shows\n    \"can_occur ev' c\"\nproof -\n  let ?p = \"occurs_on ev\"\n  let ?q = \"occurs_on ev'\"\n  have \"isTrans ev \\<or> isSend ev \\<or> isRecv ev\" using assms by simp\n  moreover have \"isSnapshot ev' \\<or> isRecvMarker ev'\" using assms nonregular_event by auto\n  ultimately show ?thesis\n  proof (elim disjE, goal_cases)\n    case 1\n    then show ?case \n      using assms(1) assms(4) assms(5) event_can_go_back_if_no_sender by blast\n  next\n    case 2\n    then obtain s s' where Trans: \"ev = Trans ?p s s'\"\n      by (metis event.collapse(1))\n    obtain i r where RecvMarker: \"ev' = RecvMarker i ?q r\"\n      using 2 by (metis event.collapse(5))\n    have \"msgs c i = msgs c' i\" \n      using \"2\"(1) assms(1) assms(2) no_msg_change_if_no_event by blast\n    moreover have \"can_occur ev' c'\" using assms by simp\n    ultimately show ?thesis using can_occur_def RecvMarker \n      by (metis (mono_tags, lifting) \"2\"(2) event.case_eq_if event.distinct_disc(13) event.distinct_disc(17) event.distinct_disc(19) event.distinct_disc(7) event.sel(10))\n  next\n    case 3\n    then have \"ev' = Snapshot ?q\"\n      by (metis event.collapse(4))\n    have \"~ has_snapshotted c' ?q\" \n      by (metis (mono_tags, lifting) \"3\"(1) assms(4) can_occur_def event.case_eq_if event.distinct_disc(11) event.distinct_disc(16) event.distinct_disc(6))\n    then have \"~ has_snapshotted c ?q\" \n      using assms(1) assms(2) regular_event_preserves_process_snapshots by auto\n    then show ?case unfolding can_occur_def using `ev' = Snapshot ?q` \n      by (metis (mono_tags, lifting) event.simps(29))\n  next\n    case 4\n    then have \"ev' = Snapshot ?q\"\n      by (metis event.collapse(4))\n    have \"~ has_snapshotted c' ?q\"\n      by (metis (mono_tags, lifting) \\<open>ev' = Snapshot (occurs_on ev')\\<close> assms(4) can_occur_def event.simps(29))\n    then have \"~ has_snapshotted c ?q\"\n      using assms(1) assms(2) regular_event_preserves_process_snapshots by auto\n    then show ?case unfolding can_occur_def \n      by (metis (mono_tags, lifting) \\<open>ev' = Snapshot (occurs_on ev')\\<close> event.simps(29))\n  next\n    case 5\n    then obtain i s u u' m where \"ev = Send i ?p s u u' m\"\n      by (metis event.collapse(2))\n    from 5 obtain i' r where \"ev' = RecvMarker i' ?q r\"\n      by (metis event.collapse(5))\n    then have pre: \"hd (msgs c' i') = Marker \\<and> length (msgs c' i') > 0\" \n      by (metis (mono_tags, lifting) assms(4) can_occur_def event.simps(30))\n    have \"hd (msgs c i') = Marker \\<and> length (msgs c i') > 0\"\n    proof (cases \"i' = i\")\n      case False\n      then have \"msgs c i' = msgs c' i'\" \n        by (metis \\<open>ev = Send i (occurs_on ev) s u u' m\\<close> assms(1) assms(2) event.sel(8) msgs_unchanged_for_other_is)\n      then show ?thesis using pre by auto\n    next\n      case True\n      then have \"msgs c' i' = msgs c i' @ [Msg m]\" \n        by (metis \\<open>ev = Send i (occurs_on ev) s u u' m\\<close> assms(1) next_send)\n      then have \"length (msgs c' i') > 1\" \n        using pre by fastforce\n      then have \"length (msgs c i') > 0\" \n        by (simp add: \\<open>msgs c' i' = msgs c i' @ [Msg m]\\<close>)\n      then show ?thesis \n        using \\<open>msgs c' i' = msgs c i' @ [Msg m]\\<close> pre by auto\n    qed\n    then show ?case unfolding can_occur_def using `ev' = RecvMarker i' ?q r` \n      by (metis (mono_tags, lifting) assms(4) can_occur_def event.simps(30))\n  next\n    case 6\n    then obtain i s u u' m where \"ev = Recv i ?p s u u' m\"\n      by (metis event.collapse(3))\n    from 6 obtain i' r where \"ev' = RecvMarker i' ?q r\"\n      by (metis event.collapse(5))\n    then have \"i' \\<noteq> i\"\n    proof -\n      have \"?p \\<noteq> ?q\" using assms by simp\n      moreover have \"channel i = Some (s, ?p)\" \n        by (metis \\<open>ev = Recv i (occurs_on ev) s u u' m\\<close> assms(1) distributed_system.can_occur_Recv distributed_system_axioms happen_implies_can_occur)\n      moreover have \"channel i' = Some (r, ?q)\"\n        by (metis (mono_tags, lifting) \\<open>ev' = RecvMarker i' (occurs_on ev') r\\<close> assms(4) can_occur_def event.case_eq_if event.disc(5,10,15,20) event.sel(5,10,13))\n      ultimately show ?thesis by auto\n    qed\n    then show ?case\n      by (metis (mono_tags, lifting) \"6\"(1) \\<open>ev = Recv i (occurs_on ev) s u u' m\\<close> \\<open>ev' = RecvMarker i' (occurs_on ev') r\\<close> assms(1) assms(4) can_occur_def event.case_eq_if event.distinct_disc(13) event.distinct_disc(17) event.distinct_disc(7) event.sel(10) next_recv)\n  qed\nqed\n\nlemma same_state_implies_same_result_state:\n  assumes\n    \"states c p = states d p\"\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"d \\<turnstile> ev \\<mapsto> d'\"\n  shows\n    \"states d' p = states c' p\"\nproof (cases \"occurs_on ev = p\")\n  case False\n  then show ?thesis \n    by (metis assms(1-3) distributed_system.no_state_change_if_no_event distributed_system_axioms)\nnext\n  case True\n  then show ?thesis\n    using assms by (cases ev, auto)\nqed\n\nlemma same_snapshot_state_implies_same_result_snapshot_state:\n  assumes\n    \"ps c p = ps d p\" and\n    \"states c p = states d p\" and\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"d \\<turnstile> ev \\<mapsto> d'\"\n  shows\n    \"ps d' p = ps c' p\"\nproof (cases \"occurs_on ev = p\")\n  case False\n  then show ?thesis\n    using assms no_state_change_if_no_event by auto\nnext\n  case True\n  then show ?thesis\n  proof (cases ev)\n    case (Snapshot q)\n    then have \"p = q\" using True by auto\n    then show ?thesis \n      using Snapshot assms(2) assms(3) assms(4) by auto\n  next\n    case (RecvMarker i q r)\n    then have \"p = q\" using True by auto\n    then show ?thesis \n    proof -\n      have f1: \"\\<And>c ca. \\<not> c \\<turnstile> ev \\<mapsto> ca \\<or> ps c p = None \\<or> ps c p = ps ca p\"\n        using RecvMarker \\<open>p = q\\<close> by force\n      have \"\\<And>c ca. ps c p \\<noteq> None \\<or> \\<not> c \\<turnstile> ev \\<mapsto> ca \\<or> ps ca p = Some (states c p)\"\n        using RecvMarker \\<open>p = q\\<close> by force\n      then show ?thesis\n        using f1 by (metis (no_types) assms(1) assms(2) assms(3) assms(4))\n    qed\n  next\n    case (Trans q s s')\n    then have \"p = q\" \n      using True by auto\n    then show ?thesis \n      using Trans assms(1) assms(3) assms(4) by auto\n  next\n    case (Send i q r u u' m)\n    then have \"p = q\" using True by auto\n    then show ?thesis \n      using Send assms(1) assms(3) assms(4) by auto\n  next\n    case (Recv i q r u u' m)\n    then have \"p = q\" using True by auto\n    then show ?thesis \n      using Recv assms(1) assms(3) assms(4) by auto\n  qed\nqed\n\nlemma same_messages_imply_same_resulting_messages:\n  assumes\n    \"msgs c i = msgs d i\"\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"d \\<turnstile> ev \\<mapsto> d'\" and\n    \"regular_event ev\"\n  shows\n    \"msgs c' i = msgs d' i\"\nproof -\n  have \"isTrans ev \\<or> isSend ev \\<or> isRecv ev\" using assms \n    by simp\n  then show ?thesis\n  proof (elim disjE)\n    assume \"isTrans ev\"\n    then show ?thesis \n      by (metis assms(1) assms(2) assms(3) isTrans_def next_trans)\n  next\n    assume \"isSend ev\"\n    then obtain i' r s u u' m where \"ev = Send i' r s u u' m\"\n      by (metis event.collapse(2))\n    with assms show ?thesis by (cases \"i = i'\", auto)\n  next\n    assume \"isRecv ev\"\n    then obtain i' r s u u' m where Recv: \"ev = Recv i' r s u u' m\"\n      by (metis event.collapse(3))\n    with assms show ?thesis by (cases \"i = i'\", auto)\n  qed\nqed\n\nlemma Trans_msg:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"isTrans ev\"\n  shows\n    \"msgs c i = msgs c' i\"\n  using assms(1) assms(2) no_msg_change_if_no_event regular_event by blast\n\nlemma new_msg_in_set_implies_occurrence:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"m \\<notin> set (msgs c i)\" and\n    \"m \\<in> set (msgs c' i)\" and\n    \"channel i = Some (p, q)\"\n  shows\n    \"occurs_on ev = p\" (is ?P)\nproof (rule ccontr)\n  assume \"~ ?P\"\n  have \"set (msgs c' i) \\<subseteq> set (msgs c i)\" \n  proof (cases ev)\n    case (Snapshot r)\n    then have \"msgs c' i = msgs c i\" using `~ ?P` assms by simp\n    then show ?thesis by auto\n  next\n    case (RecvMarker i' r s)\n    then show ?thesis\n    proof (cases \"has_snapshotted c r\")\n      case True\n      then show ?thesis\n      proof (cases \"i' = i\")\n        case True\n        then have \"Marker # msgs c' i = msgs c i\" using RecvMarker True assms by simp\n        then show ?thesis \n          by (metis set_subset_Cons)\n      next\n        case False\n        then show ?thesis using RecvMarker True assms by simp\n      qed\n    next\n      case no_snap: False\n      have chan: \"channel i' = Some (s, r)\" \n        using RecvMarker assms(1) can_occur_def by auto\n      then show ?thesis\n      proof (cases \"i' = i\")\n        case True\n        then have \"Marker # msgs c' i = msgs c i\" using RecvMarker assms by simp\n        then show ?thesis by (metis set_subset_Cons)\n      next\n        case False\n        then have \"msgs c' i = msgs c i\" using `~ ?P` RecvMarker assms no_snap by simp\n        then show ?thesis by simp\n      qed\n    qed\n  next\n    case (Trans r u u')\n    then show ?thesis using assms `~ ?P` by simp\n  next\n    case (Send i' r s u u' m')\n    then have \"i' \\<noteq> i\" using `~ ?P` can_occur_def assms by auto\n    then have \"msgs c i = msgs c' i\" using `~ ?P` assms Send by simp\n    then show ?thesis by simp\n  next\n    case (Recv i' r s u u' m')\n    then show ?thesis \n      by (metis (no_types, lifting) assms(1) eq_iff local.next.simps(5) set_subset_Cons)\n  qed\n  moreover have \"~ set (msgs c' i) \\<subseteq> set (msgs c i)\" using assms by blast\n  ultimately show False by simp\nqed\n\nlemma new_Marker_in_set_implies_nonregular_occurence:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"Marker \\<notin> set (msgs c i)\" and\n    \"Marker \\<in> set (msgs c' i)\" and\n    \"channel i = Some (p, q)\"\n  shows\n    \"~ regular_event ev\" (is ?P)\nproof (rule ccontr)\n  have \"occurs_on ev = p\" \n    using assms new_msg_in_set_implies_occurrence by blast\n  assume \"~ ?P\"\n  then have \"isTrans ev \\<or> isSend ev \\<or> isRecv ev\" by simp\n  then have \"Marker \\<notin> set (msgs c' i)\"\n  proof (elim disjE, goal_cases)\n    case 1\n    then obtain r u u' where \"ev = Trans r u u'\"\n      by (metis event.collapse(1))\n    then show ?thesis \n      using assms(1) assms(2) by auto\n  next\n    case 2\n    then obtain i' r q u u' m where \"ev = Send i' r q u u' m\"\n      by (metis event.collapse(2))\n    then show ?thesis \n      by (metis (no_types, lifting) Un_iff assms(1) assms(2) empty_iff empty_set insert_iff list.set(2) message.distinct(1) next_send set_append)\n  next\n    case 3\n    then obtain i' r q u u' m where \"ev = Recv i' r q u u' m\"\n      by (metis event.collapse(3))\n    then show ?thesis \n      by (metis assms(1) assms(2) list.set_intros(2) next_recv)\n  qed\n  then show False using assms by simp\nqed\n\nlemma RecvMarker_implies_Marker_in_set:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"ev = RecvMarker cid p q\"\n  shows\n    \"Marker \\<in> set (msgs c cid)\"\n  by (metis (mono_tags, lifting) assms(1) assms(2) can_occur_def distributed_system.happen_implies_can_occur distributed_system_axioms event.simps(30) list.set_sel(1) list.size(3) nat_less_le)\n\nlemma RecvMarker_given_channel:\n  assumes\n    \"isRecvMarker ev\" and\n    \"getId ev = cid\" and\n    \"channel cid = Some (p, q)\" and\n    \"can_occur ev c\"\n  shows\n    \"ev = RecvMarker cid q p\"\n  by (metis (mono_tags, lifting) assms(1) assms(2) assms(3) assms(4) can_occur_def event.case_eq_if event.collapse(5) event.distinct_disc(8,14,18,20) option.inject prod.inject)\n\nlemma Recv_given_channel:\n  assumes\n    \"isRecv ev\" and\n    \"getId ev = cid\" and\n    \"channel cid = Some (p, q)\" and\n    \"can_occur ev c\"\n  shows\n    \"\\<exists>s s' m. ev = Recv cid q p s s' m\"\n  by (metis assms(1) assms(2) assms(3) assms(4) distributed_system.can_occur_Recv distributed_system_axioms event.collapse(3) option.inject prod.inject)\n\nlemma same_cs_if_not_recv:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"~ isRecv ev\"\n  shows\n     \"fst (cs c cid) = fst (cs c' cid)\"\nproof (cases \"channel cid = None\")\n  case True\n  then show ?thesis \n    using assms(1) no_cs_change_if_no_channel by auto\nnext\n  case False\n  then obtain p q where chan: \"channel cid = Some (p, q)\" by auto\n  then show ?thesis\n  proof (cases ev)\n    case (Snapshot r)\n    with Snapshot assms chan show ?thesis by (cases \"r = q\", auto)\n  next\n    case (RecvMarker cid' r s)\n    then show ?thesis\n    proof (cases \"has_snapshotted c r\")\n      case True\n      with assms RecvMarker chan show ?thesis by (cases \"cid' = cid\", auto)\n    next\n      case no_snap: False\n      then show ?thesis\n      proof (cases \"cid' = cid\")\n        case True\n        then show ?thesis using RecvMarker assms chan by auto\n      next\n        case False\n        with assms RecvMarker chan no_snap show ?thesis by (cases \"r = q\", auto)\n      qed\n    qed\n  next\n    case (Trans r u u')\n    then show ?thesis using assms by auto\n  next\n    case (Send r s u u')\n    then show ?thesis using assms by auto\n  qed (metis assms(2) isRecv_def)\nqed\n\nlemma done_only_from_recv_marker:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"channel cid = Some (p, q)\" and\n    \"snd (cs c cid) \\<noteq> Done\" and\n    \"snd (cs c' cid) = Done\"\n  shows\n    \"ev = RecvMarker cid q p\"\nproof (rule ccontr)\n  assume \"~ ev = RecvMarker cid q p\"\n  then show False\n  proof (cases \"isRecvMarker ev\")\n    case True\n    then obtain cid' s r where RecvMarker: \"ev = RecvMarker cid' s r\" by (meson isRecvMarker_def)\n    have \"cid \\<noteq> cid'\"\n    proof (rule ccontr)\n      assume \"~ cid \\<noteq> cid'\"\n      then show False\n        using \\<open>ev = RecvMarker cid' s r\\<close> \\<open>ev \\<noteq> RecvMarker cid q p\\<close> assms(1) assms(2) can_occur_def by auto\n    qed\n    then have \"snd (cs c' cid) \\<noteq> Done\"\n    proof (cases \"has_snapshotted c s\")\n      case True\n      then show ?thesis using RecvMarker assms `cid \\<noteq> cid'` by simp\n    next\n      case False\n      with RecvMarker assms `cid \\<noteq> cid'` show ?thesis by (cases \"s = q\", auto)\n    qed\n    then show False using assms by auto\n  next\n    case False\n    then have \"isSnapshot ev \\<or> isTrans ev \\<or> isSend ev \\<or> isRecv ev\"\n    using event.exhaust_disc by blast\n    then have \"snd (cs c' cid) \\<noteq> Done\"\n    proof (elim disjE, goal_cases)\n      case 1\n      then obtain r where Snapshot: \"ev = Snapshot r\"\n        by (meson isSnapshot_def)\n      with assms show ?thesis by (cases \"q = r\", auto)\n    next\n      case 2\n      then obtain r u u' where \"ev = Trans r u u'\"\n        by (meson isTrans_def)\n      then show ?case using assms by auto\n    next\n      case 3\n      then obtain cid' r s u u' m where \"ev = Send cid' r s u u' m\"\n        by (meson isSend_def)\n      then show ?thesis using assms by auto\n    next\n      case 4\n      then obtain cid' r s u u' m where Recv: \"ev = Recv cid' r s u u' m\"\n        by (meson isRecv_def)\n      show ?thesis\n      using Recv assms proof (cases \"cid = cid'\")\n        case True\n        then have \"snd (cs c cid) = NotStarted \\<or> snd (cs c cid) = Recording\"\n          using assms(3) recording_state.exhaust by blast\n        then show ?thesis\n        proof (elim disjE, goal_cases)\n          case 1\n          then have \"snd (cs c' cid') = NotStarted\" \n            using True Recv assms(1) by auto\n          then show ?case using True by auto\n        next\n          case 2\n          then have \"snd (cs c' cid') = Recording\"\n            using True Recv assms(1) by auto\n          then show ?case using True by auto\n        qed\n      qed auto\n    qed\n    then show False using assms by auto\n  qed\nqed\n\nlemma cs_not_not_started_stable:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"snd (cs c cid) \\<noteq> NotStarted\" and\n    \"channel cid = Some (p, q)\"\n  shows\n    \"snd (cs c' cid) \\<noteq> NotStarted\"\nusing assms proof (cases ev)\n  case (Snapshot r)\n  then show ?thesis \n    by (metis assms(1) assms(2) next_snapshot recording_state.simps(2) sndI)\nnext\n  case (RecvMarker cid' r s)\n  then show ?thesis\n  proof (cases \"has_snapshotted c r\")\n    case True\n    with RecvMarker assms show ?thesis by (cases \"cid = cid'\", auto)\n  next\n    case no_snap: False\n    then show ?thesis\n    proof (cases \"cid = cid'\")\n      case True\n      then show ?thesis using RecvMarker assms by auto\n    next\n      case False\n      with RecvMarker assms no_snap show ?thesis by (cases \"s = p\", auto)\n    qed\n  qed\nnext\n  case (Recv cid' r s u u' m)\n  then have \"snd (cs c cid) = Recording \\<or> snd (cs c cid) = Done\" \n    using assms(2) recording_state.exhaust by blast\n  then show ?thesis\n  proof (elim disjE, goal_cases)\n    case 1\n    then show ?thesis \n      by (metis (no_types, lifting) Recv assms(1) eq_snd_iff next_recv recording_state.distinct(1))\n  next\n    case 2\n    with Recv assms show ?thesis by (cases \"cid = cid'\", auto)\n  qed\nqed auto\n\nlemma fst_cs_changed_by_recv_recording:\n  assumes\n    step: \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"fst (cs c cid) \\<noteq> fst (cs c' cid)\" and\n    \"channel cid = Some (p, q)\"\n  shows\n    \"snd (cs c cid) = Recording \\<and> (\\<exists>p q u u' m. ev = Recv cid q p u u' m)\"\nproof -\n  have oc_on: \"occurs_on ev = q\" \n  proof -\n    obtain nn :: \"('p, 's, 'm) event \\<Rightarrow> nat\" and aa :: \"('p, 's, 'm) event \\<Rightarrow> 'p\" and aaa :: \"('p, 's, 'm) event \\<Rightarrow> 'p\" and bb :: \"('p, 's, 'm) event \\<Rightarrow> 's\" and bba :: \"('p, 's, 'm) event \\<Rightarrow> 's\" and cc :: \"('p, 's, 'm) event \\<Rightarrow> 'm\" where\n      f1: \"\\<forall>e. (\\<not> isRecv e \\<or> e = Recv (nn e) (aa e) (aaa e) (bb e) (bba e) (cc e)) \\<and> (isRecv e \\<or> (\\<forall>n a aa b ba c. e \\<noteq> Recv n a aa b ba c))\"\n      using isRecv_def by moura\n    then have f2: \"c \\<turnstile> Recv (nn ev) (aa ev) (aaa ev) (bb ev) (bba ev) (cc ev) \\<mapsto> c'\"\n      by (metis (no_types) assms(2) local.step same_cs_if_not_recv)\n    have f3: \"\\<forall>x0 x1 x7 x8. (x0 \\<noteq> x7 \\<longrightarrow> cs (x8::('p, 's, 'm) configuration) x0 = cs (x1::('p, 's, _) configuration) x0) = (x0 = x7 \\<or> cs x8 x0 = cs x1 x0)\"\n      by auto\n    have f4: \"\\<forall>x0 x1 x7 x8. (x7 \\<noteq> x0 \\<longrightarrow> msgs (x1::('p, 's, 'm) configuration) x0 = msgs (x8::('p, 's, _) configuration) x0) = (x7 = x0 \\<or> msgs x1 x0 = msgs x8 x0)\"\n      by auto\n    have \"\\<forall>x0 x1 x6 x8. (x0 \\<noteq> x6 \\<longrightarrow> states (x1::('p, 's, 'm) configuration) x0 = states (x8::(_, _, 'm) configuration) x0) = (x0 = x6 \\<or> states x1 x0 = states x8 x0)\"\n      by fastforce\n    then have \"can_occur (Recv (nn ev) (aa ev) (aaa ev) (bb ev) (bba ev) (cc ev)) c \\<and> states c (aa ev) = bb ev \\<and> states c' (aa ev) = bba ev \\<and> (\\<forall>a. a = aa ev \\<or> states c' a = states c a) \\<and> msgs c (nn ev) = Msg (cc ev) # msgs c' (nn ev) \\<and> (\\<forall>n. nn ev = n \\<or> msgs c' n = msgs c n) \\<and> (\\<forall>a. ps c a = ps c' a) \\<and> (\\<forall>n. n = nn ev \\<or> cs c n = cs c' n) \\<and> (if snd (cs c (nn ev)) = Recording then cs c' (nn ev) = (fst (cs c (nn ev)) @ [cc ev], Recording) else cs c (nn ev) = cs c' (nn ev))\"\n    using f4 f3 f2 by force\n  then show ?thesis\n    using f1 by (metis (no_types) Pair_inject assms(2) assms(3) can_occur_Recv event.sel(3) local.step option.sel same_cs_if_not_recv)\nqed\n  have \"isRecv ev\" (is ?P)\n  proof (rule ccontr)\n    assume \"~ ?P\"\n    then have \"fst (cs c cid) = fst (cs c' cid)\" by (metis local.step same_cs_if_not_recv)\n    then show False using assms by simp\n  qed\n  then obtain cid' r s u u' m where Recv: \"ev = Recv cid' r s u u' m\" by (meson isRecv_def)\n  have \"cid = cid'\"\n  proof (rule ccontr)\n    assume \"~ cid = cid'\"\n    then have \"fst (cs c cid) = fst (cs c' cid)\" using Recv step by auto\n    then show False using assms by simp\n  qed\n  moreover have \"snd (cs c cid) = Recording\"\n  proof (rule ccontr)\n    assume \"~ snd (cs c cid) = Recording\"\n    then have \"fst (cs c cid) = fst (cs c' cid)\" using Recv step `cid = cid'` by auto\n    then show False using assms by simp\n  qed\n  ultimately show ?thesis using Recv by simp\nqed\n\nlemma no_marker_and_snapshotted_implies_no_more_markers:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"has_snapshotted c p\" and\n    \"Marker \\<notin> set (msgs c cid)\" and\n    \"channel cid = Some (p, q)\"\n  shows\n    \"Marker \\<notin> set (msgs c' cid)\"\nproof (cases ev)\n  case (Snapshot r)\n  then have \"r \\<noteq> p\" \n    using assms(1) assms(2) can_occur_def by auto\n  then have \"msgs c cid = msgs c' cid\" using assms Snapshot by simp\n  then show ?thesis using assms by simp\nnext\n  case (RecvMarker cid' r s)\n  have \"cid \\<noteq> cid'\"\n  proof (rule ccontr)\n    assume \"~ cid \\<noteq> cid'\"\n    moreover have \"can_occur ev c\" using happen_implies_can_occur assms by blast\n    ultimately have \"Marker : set (msgs c cid)\" using can_occur_def RecvMarker \n      by (metis (mono_tags, lifting) assms(1) event.simps(30) hd_in_set list.size(3) recv_marker_other_channels_not_shrinking zero_order(1))\n    then show False using assms by simp\n  qed\n  then have \"msgs c cid = msgs c' cid\"\n  proof (cases \"r = p\")\n    case True\n    then show ?thesis \n      using RecvMarker \\<open>cid \\<noteq> cid'\\<close> assms(1) assms(2) msgs_unchanged_if_snapshotted_RecvMarker_for_other_is by blast\n  next\n    case False\n    with RecvMarker `cid \\<noteq> cid'` step assms show ?thesis by (cases \"has_snapshotted c r\", auto)\n  qed\n  then show ?thesis using assms by simp\nnext\n  case (Trans r u u')\n  then show ?thesis using assms by auto\nnext\n  case (Send cid' r s u u' m)\n  with assms Send show ?thesis by (cases \"cid = cid'\", auto)\nnext\n  case (Recv cid' r s u u' m)\n  with assms Recv show ?thesis by (cases \"cid = cid'\", auto)\nqed\n\nlemma same_messages_if_no_occurrence:\n  assumes\n    \"c \\<turnstile> ev \\<mapsto> c'\" and\n    \"~ occurs_on ev = p\" and\n    \"~ occurs_on ev = q\" and\n    \"channel cid = Some (p, q)\"\n  shows\n    \"msgs c cid = msgs c' cid \\<and> cs c cid = cs c' cid\"\nproof (cases ev)\n  case (Snapshot r)\n  then show ?thesis using assms by auto\nnext\n  case (RecvMarker cid' r s)\n  have \"cid \\<noteq> cid'\"\n    by (metis RecvMarker_given_channel assms(1) assms(3) assms(4) RecvMarker event.sel(5,10) happen_implies_can_occur isRecvMarker_def)\n  have \"\\<nexists>a. channel cid = Some (r, q)\" \n    using assms(2) assms(4) RecvMarker by auto\n  with RecvMarker assms `cid \\<noteq> cid'` show ?thesis by (cases \"has_snapshotted c r\", auto)\nnext\n  case (Trans r u u')\n  then show ?thesis using assms by auto\nnext\n  case (Send cid' r s u u' m)\n  then have \"cid \\<noteq> cid'\" \n    by (metis (mono_tags, lifting) Pair_inject assms(1) assms(2) assms(4) can_occur_def event.sel(2) event.simps(27) happen_implies_can_occur option.inject)\n  then show ?thesis using assms Send by simp\nnext\n  case (Recv cid' r s u u' m)\n  then have \"cid \\<noteq> cid'\" \n    by (metis assms(1) assms(3) assms(4) distributed_system.can_occur_Recv distributed_system.happen_implies_can_occur distributed_system_axioms event.sel(3) option.inject prod.inject)\n  then show ?thesis using assms Recv by simp\nqed\n\nend (* locale distributed_system *)\n\nend (* theory Distributed_System *)\n", "meta": {"author": "ThreeFx", "repo": "chandy-lamport-formalization", "sha": "a2ad5daf2fd37ee70c9f086b73e156cc068d2134", "save_path": "github-repos/isabelle/ThreeFx-chandy-lamport-formalization", "path": "github-repos/isabelle/ThreeFx-chandy-lamport-formalization/chandy-lamport-formalization-a2ad5daf2fd37ee70c9f086b73e156cc068d2134/Distributed_System.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417487156366, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3240652755294627}}
{"text": "(*  Title:      HOL/MicroJava/BV/JVM.thy\n    Author:     Tobias Nipkow, Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nsection \\<open>Kildall for the JVM \\label{sec:JVM}\\<close>\n\ntheory JVM\nimports Typing_Framework_JVM\nbegin\n\ndefinition kiljvm :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> exception_table \\<Rightarrow> \n             instr list \\<Rightarrow> JVMType.state list \\<Rightarrow> JVMType.state list\" where\n  \"kiljvm G maxs maxr rT et bs ==\n  kildall (JVMType.le G maxs maxr) (JVMType.sup G maxs maxr) (exec G maxs rT et bs)\"\n\ndefinition wt_kil :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n             exception_table \\<Rightarrow> instr list \\<Rightarrow> bool\" where\n  \"wt_kil G C pTs rT mxs mxl et ins ==\n   check_bounded ins et \\<and> 0 < size ins \\<and> \n   (let first  = Some ([],(OK (Class C))#((map OK pTs))@(replicate mxl Err));\n        start  = OK first#(replicate (size ins - 1) (OK None));\n        result = kiljvm G mxs (1+size pTs+mxl) rT et ins start\n    in \\<forall>n < size ins. result!n \\<noteq> Err)\"\n\ndefinition wt_jvm_prog_kildall :: \"jvm_prog \\<Rightarrow> bool\" where\n  \"wt_jvm_prog_kildall G ==\n  wf_prog (\\<lambda>G C (sig,rT,(maxs,maxl,b,et)). wt_kil G C (snd sig) rT maxs maxl et b) G\"\n\ntheorem is_bcv_kiljvm:\n  \"\\<lbrakk> wf_prog wf_mb G; bounded (exec G maxs rT et bs) (size bs) \\<rbrakk> \\<Longrightarrow>\n      is_bcv (JVMType.le G maxs maxr) Err (exec G maxs rT et bs)\n             (size bs) (states G maxs maxr) (kiljvm G maxs maxr rT et bs)\"\n  apply (unfold kiljvm_def sl_triple_conv)\n  apply (rule is_bcv_kildall)\n       apply (simp (no_asm) add: sl_triple_conv [symmetric]) \n       apply (force intro!: semilat_JVM_slI dest: wf_acyclic \n         simp add: symmetric sl_triple_conv)\n      apply (simp (no_asm) add: JVM_le_unfold)\n      apply (blast intro!: order_widen wf_converse_subcls1_impl_acc_subtype\n                   dest: wf_subcls1 wf_acyclic wf_prog_ws_prog)\n     apply (simp add: JVM_le_unfold)\n    apply (erule exec_pres_type)\n   apply assumption\n  apply (drule wf_prog_ws_prog, erule exec_mono, assumption)  \n  done\n\nlemma subset_replicate: \"set (replicate n x) \\<subseteq> {x}\"\n  by (induct n) auto\n\nlemma in_set_replicate:\n  \"x \\<in> set (replicate n y) \\<Longrightarrow> x = y\"\nproof -\n  assume \"x \\<in> set (replicate n y)\"\n  also have \"set (replicate n y) \\<subseteq> {y}\" by (rule subset_replicate)\n  finally have \"x \\<in> {y}\" .\n  thus ?thesis by simp\nqed\n\ntheorem wt_kil_correct:\n  assumes wf:  \"wf_prog wf_mb G\"\n  assumes C:   \"is_class G C\"\n  assumes pTs: \"set pTs \\<subseteq> types G\"\n  \n  assumes wtk: \"wt_kil G C pTs rT maxs mxl et bs\"\n  \n  shows \"\\<exists>phi. wt_method G C pTs rT maxs mxl bs et phi\"\nproof -\n  let ?start = \"OK (Some ([],(OK (Class C))#((map OK pTs))@(replicate mxl Err)))\n                #(replicate (size bs - 1) (OK None))\"\n\n  from wtk obtain maxr r where    \n    bounded: \"check_bounded bs et\" and\n    result:  \"r = kiljvm G maxs maxr rT et bs ?start\" and\n    success: \"\\<forall>n < size bs. r!n \\<noteq> Err\" and\n    instrs:  \"0 < size bs\" and\n    maxr:    \"maxr = Suc (length pTs + mxl)\" \n    by (unfold wt_kil_def) simp\n\n  from bounded have \"bounded (exec G maxs rT et bs) (size bs)\"\n    by (unfold exec_def) (intro bounded_lift check_bounded_is_bounded)\n  with wf have bcv:\n    \"is_bcv (JVMType.le G maxs maxr) Err (exec G maxs rT et bs) \n    (size bs) (states G maxs maxr) (kiljvm G maxs maxr rT et bs)\"\n    by (rule is_bcv_kiljvm)\n    \n  from C pTs instrs maxr\n  have \"?start \\<in> list (length bs) (states G maxs maxr)\"\n    apply (unfold JVM_states_unfold)\n    apply (rule listI)\n    apply (auto intro: list_appendI dest!: in_set_replicate)\n    apply force\n    done    \n\n  with bcv success result have \n    \"\\<exists>ts\\<in>list (length bs) (states G maxs maxr).\n         ?start <=[JVMType.le G maxs maxr] ts \\<and>\n         wt_step (JVMType.le G maxs maxr) Err (exec G maxs rT et bs) ts\"\n    by (unfold is_bcv_def) auto\n  then obtain phi' where\n    phi': \"phi' \\<in> list (length bs) (states G maxs maxr)\" and\n    s: \"?start <=[JVMType.le G maxs maxr] phi'\" and\n    w: \"wt_step (JVMType.le G maxs maxr) Err (exec G maxs rT et bs) phi'\"\n    by blast\n  hence wt_err_step:\n    \"wt_err_step (sup_state_opt G) (exec G maxs rT et bs) phi'\"\n    by (simp add: wt_err_step_def exec_def JVM_le_Err_conv)\n\n  from s have le: \"JVMType.le G maxs maxr (?start ! 0) (phi'!0)\"\n    by (drule_tac p=0 in le_listD) (simp add: lesub_def)+\n\n  from phi' have l: \"size phi' = size bs\" by simp  \n  with instrs w have \"phi' ! 0 \\<noteq> Err\" by (unfold wt_step_def) simp\n  with instrs l have phi0: \"OK (map ok_val phi' ! 0) = phi' ! 0\"\n    by auto\n\n  from phi' have \"check_types G maxs maxr phi'\" by(simp add: check_types_def)\n  also from w have \"phi' = map OK (map ok_val phi')\" \n    by (auto simp add: wt_step_def intro!: nth_equalityI)\n  finally \n  have check_types:\n    \"check_types G maxs maxr (map OK (map ok_val phi'))\" .\n\n  from l bounded \n  have \"bounded (\\<lambda>pc. eff (bs!pc) G pc et) (length phi')\"\n    by (simp add: exec_def check_bounded_is_bounded)  \n  hence bounded': \"bounded (exec G maxs rT et bs) (length bs)\"\n    by (auto intro: bounded_lift simp add: exec_def l)\n  with wt_err_step\n  have \"wt_app_eff (sup_state_opt G) (\\<lambda>pc. app (bs!pc) G maxs rT pc et) \n                   (\\<lambda>pc. eff (bs!pc) G pc et) (map ok_val phi')\"\n    by (auto intro: wt_err_imp_wt_app_eff simp add: l exec_def)\n  with instrs l le bounded bounded' check_types maxr\n  have \"wt_method G C pTs rT maxs mxl bs et (map ok_val phi')\"\n    apply (unfold wt_method_def wt_app_eff_def)\n    apply simp\n    apply (rule conjI)\n     apply (unfold wt_start_def)\n     apply (rule JVM_le_convert [THEN iffD1])\n     apply (simp (no_asm) add: phi0)\n    apply clarify\n    apply (erule allE, erule impE, assumption)\n    apply (elim conjE)\n    apply (clarsimp simp add: lesub_def wt_instr_def)\n    apply (simp add: exec_def)\n    apply (drule bounded_err_stepD, assumption+)\n    apply blast\n    done\n\n  thus ?thesis by blast\nqed\n\n\ntheorem wt_kil_complete:\n  assumes wf:  \"wf_prog wf_mb G\"  \n  assumes C:   \"is_class G C\"\n  assumes pTs: \"set pTs \\<subseteq> types G\"\n\n  assumes wtm: \"wt_method G C pTs rT maxs mxl bs et phi\"\n\n  shows \"wt_kil G C pTs rT maxs mxl et bs\"\nproof -\n  let ?mxr = \"1+size pTs+mxl\"\n  \n  from wtm obtain\n    instrs:   \"0 < length bs\" and\n    len:      \"length phi = length bs\" and\n    bounded:  \"check_bounded bs et\" and\n    ck_types: \"check_types G maxs ?mxr (map OK phi)\" and\n    wt_start: \"wt_start G C pTs mxl phi\" and\n    wt_ins:   \"\\<forall>pc. pc < length bs \\<longrightarrow> \n                    wt_instr (bs ! pc) G rT phi maxs (length bs) et pc\"\n    by (unfold wt_method_def) simp\n\n  from ck_types len\n  have istype_phi: \n    \"map OK phi \\<in> list (length bs) (states G maxs (1+size pTs+mxl))\"\n    by (auto simp add: check_types_def intro!: listI)\n\n  let ?eff  = \"\\<lambda>pc. eff (bs!pc) G pc et\"\n  let ?app   = \"\\<lambda>pc. app (bs!pc) G maxs rT pc et\"\n\n  from bounded\n  have bounded_exec: \"bounded (exec G maxs rT et bs) (size bs)\"\n    by (unfold exec_def) (intro bounded_lift check_bounded_is_bounded)\n \n  from wt_ins\n  have \"wt_app_eff (sup_state_opt G) ?app ?eff phi\"\n    apply (unfold wt_app_eff_def wt_instr_def lesub_def)\n    apply (simp (no_asm) only: len)\n    apply blast\n    done\n  with bounded_exec\n  have \"wt_err_step (sup_state_opt G) (err_step (size phi) ?app ?eff) (map OK phi)\"\n    by - (erule wt_app_eff_imp_wt_err,simp add: exec_def len)\n  hence wt_err:\n    \"wt_err_step (sup_state_opt G) (exec G maxs rT et bs) (map OK phi)\"\n    by (unfold exec_def) (simp add: len)\n \n  from wf bounded_exec\n  have is_bcv: \n    \"is_bcv (JVMType.le G maxs ?mxr) Err (exec G maxs rT et bs) \n            (size bs) (states G maxs ?mxr) (kiljvm G maxs ?mxr rT et bs)\"\n    by (rule is_bcv_kiljvm)\n\n  let ?start = \"OK (Some ([],(OK (Class C))#((map OK pTs))@(replicate mxl Err)))\n                #(replicate (size bs - 1) (OK None))\"\n\n  from C pTs instrs\n  have start: \"?start \\<in> list (length bs) (states G maxs ?mxr)\"\n    apply (unfold JVM_states_unfold)\n    apply (rule listI)\n    apply (auto intro!: list_appendI dest!: in_set_replicate)\n    apply force\n    done    \n\n  let ?phi = \"map OK phi\"  \n  have less_phi: \"?start <=[JVMType.le G maxs ?mxr] ?phi\"\n  proof -\n    from len instrs\n    have \"length ?start = length (map OK phi)\" by simp\n    moreover\n    { fix n\n      from wt_start\n      have \"G \\<turnstile> ok_val (?start!0) <=' phi!0\"\n        by (simp add: wt_start_def)\n      moreover\n      from instrs len\n      have \"0 < length phi\" by simp\n      ultimately\n      have \"JVMType.le G maxs ?mxr (?start!0) (?phi!0)\"\n        by (simp add: JVM_le_Err_conv Err.le_def lesub_def)\n      moreover\n      { fix n'\n        have \"JVMType.le G maxs ?mxr (OK None) (?phi!n)\"\n          by (auto simp add: JVM_le_Err_conv Err.le_def lesub_def \n            split: err.splits)        \n        hence \"\\<lbrakk> n = Suc n'; n < length ?start \\<rbrakk> \n          \\<Longrightarrow> JVMType.le G maxs ?mxr (?start!n) (?phi!n)\"\n          by simp\n      }\n      ultimately\n      have \"n < length ?start \\<Longrightarrow> (?start!n) <=_(JVMType.le G maxs ?mxr) (?phi!n)\"\n        by (unfold lesub_def) (cases n, blast+)\n    } \n    ultimately show ?thesis by (rule le_listI)\n  qed         \n\n  from wt_err\n  have \"wt_step (JVMType.le G maxs ?mxr) Err (exec G maxs rT et bs) ?phi\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)  \n  with start istype_phi less_phi is_bcv\n  have \"\\<forall>p. p < length bs \\<longrightarrow> kiljvm G maxs ?mxr rT et bs ?start ! p \\<noteq> Err\"\n    by (unfold is_bcv_def) auto\n  with bounded instrs\n  show \"wt_kil G C pTs rT maxs mxl et bs\" by (unfold wt_kil_def) simp\nqed\n\n\ntheorem jvm_kildall_sound_complete:\n  \"wt_jvm_prog_kildall G = (\\<exists>Phi. wt_jvm_prog G Phi)\"\nproof \n  let ?Phi = \"\\<lambda>C sig. let (C,rT,(maxs,maxl,ins,et)) = the (method (G,C) sig) in \n              SOME phi. wt_method G C (snd sig) rT maxs maxl ins et phi\"\n  \n  assume \"wt_jvm_prog_kildall G\"\n  hence \"wt_jvm_prog G ?Phi\"\n    apply (unfold wt_jvm_prog_def wt_jvm_prog_kildall_def)\n    apply (erule jvm_prog_lift)\n    apply (auto dest!: wt_kil_correct intro: someI)\n    done\n  thus \"\\<exists>Phi. wt_jvm_prog G Phi\" by fast\nnext\n  assume \"\\<exists>Phi. wt_jvm_prog G Phi\"\n  thus \"wt_jvm_prog_kildall G\"\n    apply (clarify)\n    apply (unfold wt_jvm_prog_def wt_jvm_prog_kildall_def)\n    apply (erule jvm_prog_lift)\n    apply (auto intro: wt_kil_complete)\n    done\nqed\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/MicroJava/BV/JVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417487156366, "lm_q2_score": 0.4921881357207955, "lm_q1q2_score": 0.3240652755294626}}
{"text": "section\\<open>Reactive processes\\<close>\n\ntheory Reactive_Processes\nimports Designs \"HOL-Library.Sublist\"\n(* isabelle2012 \"HOL-Library.List_Prefix\" *)\nbegin\n\n\ntext \\<open>Following the way of UTP to describe reactive processes, more observational\nvariables are needed to record the interaction with the environment. Three observational \nvariables are defined for this subset of relations: $wait$, $tr$ and $ref$.\nThe boolean variable $wait$ records if the process is waiting for an interaction\nor has terminated. $tr$ records the list (trace) of interactions the process has\nperformed so far. The variable $ref$ contains the set of interactions (events) the\nprocess may refuse to perform.\\<close>\n\ntext \\<open>In this section, we introduce first some preliminary notions, useful for \n trace manipulations. The definitions of reactive process alphabets and healthiness \nconditions are also given. Finally, proved lemmas and theorems are listed.\\<close>\n\nsubsection \\<open>Preliminaries\\<close>\n\ntype_synonym '\\<alpha> trace = \"'\\<alpha> list\"\n\nfun list_diff::\"'\\<alpha> list \\<Rightarrow> '\\<alpha> list \\<Rightarrow> '\\<alpha> list option\" where\n   \"list_diff l [] = Some l\"\n  | \"list_diff [] l = None\"\n  | \"list_diff (x#xs) (y#ys) = (if (x = y) then (list_diff xs ys) else None)\"\n\ninstantiation  list :: (type) minus\nbegin\ndefinition list_minus : \"l1 - l2 \\<equiv> the (list_diff l1 l2)\"\ninstance ..\nend\n\nlemma list_diff_empty [simp]: \"the (list_diff l []) = l\"\nby (cases l) auto\n\nlemma prefix_diff_empty [simp]: \"l  - [] = l\"\nby (induct l) (auto simp: list_minus)\n\nlemma prefix_diff_eq [simp]: \"l - l = []\"\nby (induct l) (auto simp: list_minus)\n\nlemma prefix_diff [simp]: \"(l @ t) - l = t\"\nby (induct l) (auto simp: list_minus)\n\nlemma prefix_subst [simp]: \"l @ t = m \\<Longrightarrow> m - l = t\"\nby (auto)\n\nlemma prefix_subst1 [simp]: \"m = l @ t \\<Longrightarrow> m - l = t\"\nby (auto)\n\nlemma prefix_diff1 [simp]: \"((l @ m) @ t) - (l @ m) = t\"\nby (rule prefix_diff)\n\nlemma prefix_diff2 [simp]: \"(l @ (m @ t)) - (l @ m) = t\"\napply (simp only: append_assoc [symmetric])\napply (rule prefix_diff1)\ndone\n\nlemma prefix_diff3 [simp]: \"(l @ m) - (l @ t) = (m - t)\"\nby (induct l, auto simp: list_minus)\n\nlemma prefix_diff4 [simp]: \"(a # m) - (a # t) = (m - t)\"\nby (auto simp: list_minus)\n\n\nclass ev_eq = \n  fixes ev_eq :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  assumes refl: \"ev_eq a a\"\n  assumes comm: \"ev_eq a b = ev_eq b a\"\n\ndefinition \"filter_chan_set a cs = (\\<not> (\\<exists> e\\<in>cs. ev_eq a e))\"\n\nlemma in_imp_not_fcs:\n\"x\\<in>S \\<Longrightarrow> \\<not> filter_chan_set x S\"\napply (auto simp: filter_chan_set_def)\napply (rule_tac bexI, auto simp: refl)\ndone\n\nfun tr_filter::\"'a::ev_eq list \\<Rightarrow> 'a set \\<Rightarrow> 'a list\" where\n    \"tr_filter [] cs = []\"\n  | \"tr_filter (x#xs) cs = (if (filter_chan_set x cs) then (x#(tr_filter xs cs))\n                                                                  else (tr_filter xs cs))\"\n\n\nlemma tr_filter_conc: \"(tr_filter (a@b) cs) = ((tr_filter a cs) @ (tr_filter b cs))\"\nby (induct a, auto)\n\nlemma filter_chan_set_hd_tr_filter:\n\"tr_filter l cs \\<noteq> [] --> filter_chan_set (hd (tr_filter l cs)) cs\"\nby (induct l, auto)\n\nlemma tr_filter_conc_eq1: \n\"(a@b = (tr_filter (a@c) cs)) \\<longrightarrow> (b = (tr_filter c cs))\"\napply (induct a, auto)\napply (case_tac \"tr_filter (a2 @ c) cs = []\", simp_all)\napply (drule filter_chan_set_hd_tr_filter[rule_format])\napply (case_tac \"tr_filter (a2 @ c) cs\", simp_all)\ndone\n\nlemma tr_filter_conc_eq2: \n\"(a@b = (tr_filter (a@c) cs)) \\<longrightarrow> (a = (tr_filter a cs))\"\napply (induct a, auto)\napply (case_tac \"tr_filter (a2 @ c) cs = []\", simp_all)\napply (drule filter_chan_set_hd_tr_filter[rule_format])\napply (case_tac \"tr_filter (a2 @ c) cs\", simp_all)\napply (case_tac \"tr_filter (a2 @ c) cs = []\", simp_all)\napply (drule filter_chan_set_hd_tr_filter[rule_format])\napply (case_tac \"tr_filter (a2 @ c) cs\", simp_all)\ndone\n\nlemma tr_filter_conc_eq:\n\"(a@b = (tr_filter (a@c) cs)) = (b = (tr_filter c cs) & a = (tr_filter a cs))\"\napply (rule, rule)\napply (rule tr_filter_conc_eq1[rule_format, of a], clarsimp)\napply (rule tr_filter_conc_eq2[rule_format, of a b c], clarsimp)\napply (clarsimp simp: tr_filter_conc)\ndone\n\nlemma tr_filter_conc_eq3:\n\"(b = (tr_filter (a@c) cs)) = (\\<exists> b1 b2. b=b1@b2 & b2 = (tr_filter c cs) & b1 = (tr_filter a cs))\"\nby (rule, auto simp: tr_filter_conc)\n\nlemma tr_filter_un:\n\"tr_filter l (s1 \\<union> s2) = tr_filter (tr_filter l s1) s2\"\nby (induct l, auto simp: filter_chan_set_def)\n\n\ninstantiation list :: (ev_eq) ev_eq\nbegin\nfun ev_eq_list where\n    \"ev_eq_list [] [] = True\"\n  | \"ev_eq_list l [] = False\"\n  | \"ev_eq_list [] l = False\"\n  | \"ev_eq_list (x#xs) (y#ys) = (if (ev_eq x y) then (ev_eq_list xs ys) else False)\"\ninstance \n  proof\n  fix a::\"'a::ev_eq list\" show \"ev_eq a a\"\n  by (induct a, auto simp: ev_eq_class.refl)\n  next\n  fix a b::\"'a::ev_eq list\" show \"ev_eq a b = ev_eq b a\"\n  apply (cases a)\n  apply (cases b, simp_all add: ev_eq_class.comm)\n  apply (hypsubst_thin)\n  apply (induct b, simp_all add: ev_eq_class.comm)\n  apply (case_tac \"ev_eq aa a\", simp_all add: ev_eq_class.comm)\n  apply (case_tac \"list = []\", simp_all)\n  apply (case_tac \"b\", simp_all)\n  apply (atomize)\n  apply (erule_tac x=\"hd list\" in allE)\n  apply (erule_tac x=\"tl list\" in allE)\n  apply (subst (asm) hd_Cons_tl, simp_all)\ndone\nqed\nend\n\nsubsection \\<open>Definitions\\<close>\n\n(* isabelle 2013 *)\n\nabbreviation subl::\"'a list \\<Rightarrow> 'a list \\<Rightarrow> bool\" (\"_ \\<le> _\") \nwhere \"l1 \\<le> l2 == Sublist.prefix l1 l2\"\n\nlemma list_diff_empty_eq: \"l1 - l2 = [] \\<Longrightarrow> l2 \\<le> l1 \\<Longrightarrow> l1 = l2\"\nby (auto simp: prefix_def)\n\n\n(* end isabelle 2013 *)\n\ntext \\<open>The definitions of reactive process alphabets and healthiness conditions are given\nin the following. The healthiness conditions of reactive processes are defined by \n$R1$, $R2$, $R3$ and their composition $R$.\\<close>\n\ntype_synonym '\\<theta> refusal = \"'\\<theta> set\"\n  \nrecord '\\<theta> alpha_rp  = alpha_d + \n                         wait:: bool\n                         tr  :: \"'\\<theta> trace\"\n                         ref :: \"'\\<theta> refusal\"\n\ntext\\<open>Note that we define here the class of UTP alphabets that contain\n$wait$, $tr$ and $ref$, or, in other words, we define here the class of reactive process\nalphabets.\\<close>\n\ntype_synonym ('\\<theta>,'\\<sigma>) alphabet_rp  = \"('\\<theta>,'\\<sigma>) alpha_rp_scheme alphabet\"\ntype_synonym ('\\<theta>,'\\<sigma>) relation_rp  = \"('\\<theta>,'\\<sigma>) alphabet_rp relation\"\n\ndefinition \"diff_tr s1 s2 = ((tr s1) - (tr s2))\"\n\ndefinition spec :: \"[bool, bool, ('\\<theta>,'\\<sigma>) relation_rp] \\<Rightarrow> ('\\<theta>,'\\<sigma>) relation_rp\"\nwhere \"spec b b' P \\<equiv> \\<lambda> (A, A'). P (A\\<lparr>wait := b'\\<rparr>, A'\\<lparr>ok := b\\<rparr>)\"\n\nabbreviation Speciftt (\"_\\<^sup>t\\<^sub>t\") where \"(P)\\<^sup>t\\<^sub>t \\<equiv> spec True True P\"\n\nabbreviation Specifff (\"_\\<^sup>f\\<^sub>f\") where \"(P)\\<^sup>f\\<^sub>f \\<equiv> spec False False P\"\n\nabbreviation Speciftf (\"_\\<^sup>t\\<^sub>f\") where \"(P)\\<^sup>t\\<^sub>f \\<equiv> spec True False P\"\n\nabbreviation Specifft (\"_\\<^sup>f\\<^sub>t\") where \"(P)\\<^sup>f\\<^sub>t \\<equiv> spec False True P\"\n\ndefinition R1::\"(('\\<theta>,'\\<sigma>) alphabet_rp) Healthiness_condition\"\nwhere \"R1 (P)  \\<equiv>  \\<lambda>(A, A'). (P (A, A')) \\<and> (tr A \\<le> tr A')\"\n\ndefinition R2::\"(('\\<theta>,'\\<sigma>) alphabet_rp) Healthiness_condition\"\nwhere \"R2 (P)  \\<equiv> \\<lambda>(A, A'). (P (A\\<lparr>tr:=[]\\<rparr>,A'\\<lparr>tr:= tr A' - tr A\\<rparr>) \\<and> tr A \\<le> tr A')\"\n\ndefinition \\<Pi>rea   \nwhere \"\\<Pi>rea  \\<equiv> \\<lambda>(A, A'). (\\<not>ok A \\<and> tr A \\<le> tr A') \\<or> (ok A' \\<and> tr A = tr A' \n                            \\<and> (wait A = wait A') \\<and> ref A = ref A' \\<and> more A = more A')\"\n\ndefinition R3::\"(('\\<theta>,'\\<sigma>) alphabet_rp) Healthiness_condition\"\nwhere \"R3 (P)  \\<equiv> (\\<Pi>rea \\<triangleleft> wait o fst \\<triangleright> P)\"\n\ndefinition R::\"(('\\<theta>,'\\<sigma>) alphabet_rp) Healthiness_condition\" \nwhere \"R  \\<equiv> R3 o R2 o R1\"\n\nlemmas rp_defs = R1_def R2_def \\<Pi>rea_def R3_def R_def spec_def\n\nsubsection \\<open>Proofs\\<close>\n\nlemma tr_filter_empty [simp]: \"tr_filter l {} = l\"\nby (induct l) (auto simp: filter_chan_set_def)\n\nlemma trf_imp_filtercs: \"\\<lbrakk>xs = tr_filter ys cs; xs \\<noteq> []\\<rbrakk> \\<Longrightarrow> filter_chan_set (hd xs) cs\"\napply (induct xs, auto)\napply (induct ys, auto)\napply (case_tac \"filter_chan_set a cs\", auto)\ndone\n\nlemma filtercs_imp_trf: \n\"\\<lbrakk>filter_chan_set x cs; xs = tr_filter ys cs\\<rbrakk> \\<Longrightarrow> x#xs = tr_filter (x#ys) cs\"\nby (induct xs) auto\n\nlemma alpha_d_more_eqI:\n  assumes \"tr r = tr r'\" \"wait r = wait r'\" \"ref r = ref r'\" \"more r = more r'\"\n  shows \"alpha_d.more r = alpha_d.more r'\"\n  using assms by (cases r, cases r') auto\n\nlemma alpha_d_more_eqE:\n  assumes \"alpha_d.more r = alpha_d.more r'\"\n  obtains \"tr r = tr r'\" \"wait r = wait r'\" \"ref r = ref r'\" \"more r = more r'\"\n  using assms by (cases r, cases r') auto\n\nlemma alpha_rp_eqE:\n  assumes \"r = r'\"\n  obtains \"ok r = ok r'\" \"tr r = tr r'\" \"wait r = wait r'\" \"ref r = ref r'\" \"more r = more r'\"\n  using assms by (cases r, cases r') auto\n\nlemma R_idem: \"R o R = R\"\nby (auto simp: rp_defs design_defs fun_eq_iff split: cond_splits)\n\nlemma R_idem2: \"R (R P) = R P\"\nby (auto simp: rp_defs design_defs fun_eq_iff split: cond_splits)\n\nlemma R1_idem: \"R1 o R1 = R1\"\nby (auto simp: rp_defs design_defs)\n\nlemma R1_idem2: \"R1 (R1 x) = R1 x\"\nby (auto simp: rp_defs design_defs)\n\nlemma R2_idem: \"R2 o R2 = R2\"\nby (auto simp: rp_defs design_defs fun_eq_iff prefix_def)\n\nlemma R2_idem2: \"R2 (R2 x) = R2 x\"\nby (auto simp: rp_defs design_defs fun_eq_iff prefix_def)\n\nlemma R3_idem: \"R3 o R3 = R3\"\nby (auto simp: rp_defs design_defs fun_eq_iff split: cond_splits)\n\nlemma R3_idem2: \"R3 (R3 x) = R3 x\"\nby (auto simp: R3_idem[simplified Fun.comp_def fun_eq_iff] fun_eq_iff)\n\nlemma R1_R2_commute: \"(R1 o R2) = (R2 o R1)\"\nby (auto simp: rp_defs design_defs fun_eq_iff prefix_def)\n\nlemma R1_R3_commute: \"(R1 o R3) = (R3 o R1)\"\nby (auto simp: rp_defs design_defs fun_eq_iff split: cond_splits)\n\nlemma R2_R3_commute: \"R2 o R3 = R3 o R2\"\nby (auto simp: rp_defs design_defs fun_eq_iff prefix_def split: cond_splits)\n\nlemma R_abs_R1: \"R o R1 = R\"\napply (auto simp: R_def)\napply (subst (3) R1_idem[symmetric])\napply (auto)\ndone\n\nlemma R_abs_R2: \"R o R2 = R\"\nby (auto simp: rp_defs design_defs fun_eq_iff)\n\nlemma R_abs_R3: \"R o R3 = R\"\nby (auto simp: rp_defs design_defs fun_eq_iff split: cond_splits)\n\nlemma R_is_R1:\n  assumes A: \"P is R healthy\"\n  shows  \"P is R1 healthy\"\nproof -\n  have \"R P = P\"\n    using assms by (simp_all only: Healthy_def)\n  moreover\n  have \"(R P) is R1 healthy\"\n    by (auto simp add: design_defs rp_defs fun_eq_iff split: cond_splits)\n  ultimately show ?thesis by simp\nqed\n\nlemma R_is_R2:\n  assumes A: \"P is R healthy\"\n  shows  \"P is R2 healthy\"\nproof -\n  have \"R P = P\"\n    using assms by (simp_all only: Healthy_def)\n  moreover\n  have \"(R P) is R2 healthy\"\n    by (auto simp add: design_defs rp_defs fun_eq_iff prefix_def split: cond_splits)\n  ultimately show ?thesis by simp\nqed\n\nlemma R_is_R3:\n  assumes A: \"P is R healthy\"\n  shows  \"P is R3 healthy\"\nproof -\n  have \"R P = P\"\n    using assms by (simp_all only: Healthy_def)\n  moreover\n  have \"(R P) is R3 healthy\"\n    by (auto simp add: design_defs rp_defs fun_eq_iff split: cond_splits)\n  ultimately show ?thesis by simp\nqed\n\nlemma R_disj:\n  assumes A: \"P is R healthy\"\n  assumes B: \"Q is R healthy\"\n  shows  \"(P \\<or> Q) is R healthy\"\nproof -\n  have \"R P = P\" and \"R Q = Q\"\n    using assms by (simp_all only: Healthy_def)\n  moreover\n  have \"((R P) \\<or> (R Q)) is R healthy\"\n    by (auto simp add: design_defs rp_defs fun_eq_iff split: cond_splits)\n  ultimately show ?thesis by simp\nqed\n\nlemma R_disj2:  \"R (P \\<or> Q) = (R P \\<or> R Q)\"\napply (subst R_disj[simplified Healthy_def, where P=\"R P\"])\napply (simp_all add: R_idem2)\napply (auto simp: fun_eq_iff rp_defs split: cond_splits)\ndone\n\nlemma R1_comp:\n  assumes \"P is R1 healthy\"\n    and \"Q is R1 healthy\"\n  shows \"(P;;Q) is R1 healthy\"\nproof -\n  have \"R1 P = P\" and \"R1 Q = Q\"\n    using assms by (simp_all only: Healthy_def)\n  moreover\n  have \"((R1 P) ;; (R1 Q)) is R1 healthy\"\n    by (auto simp add: design_defs rp_defs fun_eq_iff split: cond_splits)\n  ultimately show ?thesis by simp\nqed\n\nlemma R1_comp2:\n  assumes A: \"P is R1 healthy\"\n  assumes B: \"Q is R1 healthy\"\n  shows  \"R1 (P;;Q) = ((R1 P);;Q)\"\nusing A B\napply (subst R1_comp[simplified Healthy_def, symmetric])\napply (auto simp: fun_eq_iff rp_defs design_defs)\ndone\n\nlemma J_is_R1: \"J is R1 healthy\"\n  by (auto simp: rp_defs design_defs fun_eq_iff elim: alpha_d_more_eqE)\n\nlemma J_is_R2: \"J is R2 healthy\"\n  by (auto simp: rp_defs design_defs fun_eq_iff prefix_def\n    elim!: alpha_d_more_eqE intro!: alpha_d_more_eqI)\n\nlemma R1_H2_commute2: \"R1 (H2 P) = H2 (R1 P)\"\n  by (auto simp add: H2_def R1_def J_def fun_eq_iff\n    elim!: alpha_d_more_eqE intro!: alpha_d_more_eqI)\n\nlemma R1_H2_commute: \"R1 o H2 = H2 o R1\"\nby (auto simp: R1_H2_commute2)\n\nlemma R2_H2_commute2: \"R2 (H2 P) = H2 (R2 P)\"\napply (auto simp add: fun_eq_iff rp_defs design_defs strict_prefix_def)\napply (rule_tac b=\"ba\\<lparr>tr := tr a @ tr ba\\<rparr>\" in comp_intro)\napply (auto simp: fun_eq_iff prefix_def\n  elim!: alpha_d_more_eqE alpha_rp_eqE intro!: alpha_d_more_eqI alpha_rp.equality)\napply (rule_tac b=\"ba\\<lparr>tr := tr a @ tr ba\\<rparr>\" in comp_intro,\n  auto simp: elim: alpha_d_more_eqE alpha_rp_eqE intro: alpha_d_more_eqI alpha_rp.equality)\napply (rule_tac b=\"ba\\<lparr>tr := tr a @ tr ba\\<rparr>\" in comp_intro,\n  auto simp: elim: alpha_d_more_eqE alpha_rp_eqE intro: alpha_d_more_eqI alpha_rp.equality)\napply (rule_tac x=zs in exI, auto)+\n\ndone\n\nlemma R2_H2_commute: \"R2 o H2 = H2 o R2\"\nby (auto simp: R2_H2_commute2)\n\nlemma R3_H2_commute2: \"R3 (H2 P) = H2 (R3 P)\"\napply (auto simp: fun_eq_iff rp_defs design_defs strict_prefix_def \n            elim: alpha_d_more_eqE split: cond_splits)\ndone\n\nlemma R3_H2_commute: \"R3 o H2 = H2 o R3\"\nby (auto simp: R3_H2_commute2)\n\nlemma R_join: \n  assumes \"x is R healthy\"\n  and \"y is R healthy\"\n  shows \"(x \\<sqinter> y) is R healthy\"\nproof -\n  have \"R x = x\" and \"R y = y\"\n    using assms by (simp_all only: Healthy_def)\n  moreover\n  have \"((R x) \\<sqinter> (R y)) is R healthy\"\n    by (auto simp add: design_defs rp_defs fun_eq_iff split: cond_splits)\n  ultimately show ?thesis by simp\nqed\n\nlemma R_meet:\n  assumes A: \"x is R healthy\"\n  and B:\"y is R healthy\"\n  shows \"(x \\<squnion> y) is R healthy\"\nproof -\n  have \"R x = x\" and \"R y = y\"\n    using assms by (simp_all only: Healthy_def)\n  moreover\n  have \"((R x) \\<squnion> (R y)) is R healthy\"\n    by (auto simp add: design_defs rp_defs fun_eq_iff split: cond_splits)\n  ultimately show ?thesis by simp\nqed\n\n\nlemma R_H2_commute: \"R o H2 = H2 o R\"\napply (auto simp add: rp_defs design_defs fun_eq_iff split: cond_splits \n                     elim: alpha_d_more_eqE)\napply (rule_tac b=\"ba\\<lparr>tr := tr b\\<rparr>\" in comp_intro, auto split: cond_splits\n  elim!: alpha_d_more_eqE alpha_rp_eqE intro!: alpha_d_more_eqI alpha_rp.equality)\napply (rule_tac s=ba in subst, auto intro!: alpha_d_more_eqI alpha_rp.equality)\napply (rule_tac s=ba in subst, auto intro!: alpha_d_more_eqI alpha_rp.equality)\napply (rule_tac b=\"ba\\<lparr>tr := tr b\\<rparr>\" in comp_intro, auto split: cond_splits)\napply (rule_tac s=ba in subst,\n  auto elim: alpha_d_more_eqE alpha_rp_eqE intro: alpha_d_more_eqI alpha_rp.equality)\napply (rule_tac b=\"ba\\<lparr>tr := tr b\\<rparr>\" in comp_intro,\n  auto elim: alpha_d_more_eqE alpha_rp_eqE intro: alpha_d_more_eqI alpha_rp.equality split: cond_splits)\napply (rule_tac s=ba in subst,\n  auto elim: alpha_d_more_eqE alpha_rp_eqE intro: alpha_d_more_eqI alpha_rp.equality)\ndone\n\nlemma R_H2_commute2: \"R (H2 P) = H2 (R P)\"\nby (auto simp: fun_eq_iff R_H2_commute[simplified fun_eq_iff Fun.comp_def])\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Circus/Reactive_Processes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3240334416018925}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory longlong\nimports \"CParser.CTranslation\"\nbegin\n\nexternal_file \"longlong.c\"\ninstall_C_file \"longlong.c\"\n\nML \\<open>NameGeneration.return_var_name (Absyn.Signed Absyn.LongLong)\\<close>\n\n\ncontext longlong\nbegin\n\nthm f_body_def\nthm shifts1_body_def\nthm shifts2_body_def\n\nlemma \"(ucast :: 16 word \\<Rightarrow> 8 word) 32768 = 0\"\napply simp\ndone\n\nlemma \"(scast :: 16 word \\<Rightarrow> 8 word) 32768 = 0\"\nby simp\n\nlemma \"(scast :: 16 word \\<Rightarrow> 8 word) 65535 = 255\"\nby simp\n\nlemma \"(ucast :: 16 word \\<Rightarrow> 8 word) 65535 = 255\"\nby simp\n\nlemma \"(ucast :: 16 word \\<Rightarrow> 8 word) 32767 = 255\" by simp\nlemma \"(scast :: 16 word \\<Rightarrow> 8 word) 32767 = 255\" by simp\n\nlemma \"(scast :: 8 word \\<Rightarrow> 16 word) 255 = 65535\" by simp\nlemma \"(ucast :: 8 word \\<Rightarrow> 16 word) 255 = 255\" by simp\n\nlemma g_result:\n  \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== CALL callg() \\<lbrace> \\<acute>ret__int = 0 \\<rbrace>\"\napply vcg\napply (simp add: max_word_def)\ndone\n\nthm literals_body_def\n\nlemma literals_result:\n  \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== CALL literals() \\<lbrace> \\<acute>ret__int = 31 \\<rbrace>\"\napply vcg\napply simp\ndone\n\nend (* context *)\n\nend (* theory *)\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/CParser/tools/c-parser/testfiles/longlong.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.3240334416018925}}
{"text": "(* Title: IND_CCA2_sym.thy\n  Author: Andreas Lochbihler, ETH Zurich \n  Author: S. Reza Sefidgar, ETH Zurich *)\n\nsubsection \\<open>The IND-CCA2 security for symmetric encryption schemes\\<close>\n\ntheory IND_CCA2_sym imports\n  CryptHOL.Computational_Model\nbegin\n\nlocale ind_cca =\n  fixes key_gen :: \"'key spmf\"\n  and encrypt :: \"'key \\<Rightarrow> 'message \\<Rightarrow> 'cipher spmf\"\n  and decrypt :: \"'key \\<Rightarrow> 'cipher \\<Rightarrow> 'message option\"\n  and msg_predicate :: \"'message \\<Rightarrow> bool\"\nbegin\n\ntype_synonym ('message', 'cipher') adversary = \n  \"(bool, 'message' \\<times> 'message' + 'cipher', 'cipher' option + 'message' option) gpv\"\n\ndefinition oracle_encrypt :: \"'key \\<Rightarrow> bool \\<Rightarrow> ('message \\<times> 'message, 'cipher option, 'cipher set) callee\"\nwhere\n  \"oracle_encrypt k b L = (\\<lambda>(msg1, msg0).\n     (case msg_predicate msg1 \\<and> msg_predicate msg0 of\n        True \\<Rightarrow> do {\n         c \\<leftarrow> encrypt k (if b then msg1 else msg0);\n         return_spmf (Some c, {c} \\<union> L)\n        }\n     | False \\<Rightarrow> return_spmf (None, L)))\"\n\nlemma lossless_oracle_encrypt [simp]:\n  assumes \"lossless_spmf (encrypt k m1)\" and \"lossless_spmf (encrypt k m0)\"\n  shows \"lossless_spmf (oracle_encrypt k b L (m1, m0))\"\nusing assms by (simp add: oracle_encrypt_def split: bool.split)\n\ndefinition oracle_decrypt :: \"'key \\<Rightarrow> ('cipher, 'message option, 'cipher set) callee\"\nwhere \"oracle_decrypt k L c = return_spmf (if c \\<in> L then None else decrypt k c, L)\"\n\nlemma lossless_oracle_decrypt [simp]: \"lossless_spmf (oracle_decrypt k L c)\"\nby(simp add: oracle_decrypt_def)\n\ndefinition game :: \"('message, 'cipher) adversary \\<Rightarrow> bool spmf\"\nwhere\n  \"game \\<A> = do {\n    key \\<leftarrow> key_gen;\n    b \\<leftarrow> coin_spmf;\n    (b', L') \\<leftarrow> exec_gpv (oracle_encrypt key b \\<oplus>\\<^sub>O oracle_decrypt key) \\<A> {};\n    return_spmf (b = b')\n  }\"\n\ndefinition advantage :: \"('message, 'cipher) adversary \\<Rightarrow> real\"\nwhere \"advantage \\<A> = \\<bar>spmf (game \\<A>) True - 1 / 2\\<bar>\"\n\nlemma advantage_nonneg: \"0 \\<le> advantage \\<A>\" by(simp add: advantage_def)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Game_Based_Crypto/IND_CCA2_sym.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.3239922768897204}}
{"text": "(*  Title:      HOL/Auth/OtwayRees.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n*)\n\nsection{*The Original Otway-Rees Protocol*}\n\ntheory OtwayRees imports Public begin\n\ntext{* From page 244 of\n  Burrows, Abadi and Needham (1989).  A Logic of Authentication.\n  Proc. Royal Soc. 426\n\nThis is the original version, which encrypts Nonce NB.*}\n\ninductive_set otway :: \"event list set\"\n  where\n         (*Initial trace is empty*)\n   Nil:  \"[] \\<in> otway\"\n\n         (*The spy MAY say anything he CAN say.  We do not expect him to\n           invent new nonces here, but he can also use NS1.  Common to\n           all similar protocols.*)\n | Fake: \"[| evsf \\<in> otway;  X \\<in> synth (analz (knows Spy evsf)) |]\n          ==> Says Spy B X  # evsf \\<in> otway\"\n\n         (*A message that has been sent can be received by the\n           intended recipient.*)\n | Reception: \"[| evsr \\<in> otway;  Says A B X \\<in>set evsr |]\n               ==> Gets B X # evsr \\<in> otway\"\n\n         (*Alice initiates a protocol run*)\n | OR1:  \"[| evs1 \\<in> otway;  Nonce NA \\<notin> used evs1 |]\n          ==> Says A B {|Nonce NA, Agent A, Agent B,\n                         Crypt (shrK A) {|Nonce NA, Agent A, Agent B|} |}\n                 # evs1 : otway\"\n\n         (*Bob's response to Alice's message.  Note that NB is encrypted.*)\n | OR2:  \"[| evs2 \\<in> otway;  Nonce NB \\<notin> used evs2;\n             Gets B {|Nonce NA, Agent A, Agent B, X|} : set evs2 |]\n          ==> Says B Server\n                  {|Nonce NA, Agent A, Agent B, X,\n                    Crypt (shrK B)\n                      {|Nonce NA, Nonce NB, Agent A, Agent B|}|}\n                 # evs2 : otway\"\n\n         (*The Server receives Bob's message and checks that the three NAs\n           match.  Then he sends a new session key to Bob with a packet for\n           forwarding to Alice.*)\n | OR3:  \"[| evs3 \\<in> otway;  Key KAB \\<notin> used evs3;\n             Gets Server\n                  {|Nonce NA, Agent A, Agent B,\n                    Crypt (shrK A) {|Nonce NA, Agent A, Agent B|},\n                    Crypt (shrK B) {|Nonce NA, Nonce NB, Agent A, Agent B|}|}\n               : set evs3 |]\n          ==> Says Server B\n                  {|Nonce NA,\n                    Crypt (shrK A) {|Nonce NA, Key KAB|},\n                    Crypt (shrK B) {|Nonce NB, Key KAB|}|}\n                 # evs3 : otway\"\n\n         (*Bob receives the Server's (?) message and compares the Nonces with\n           those in the message he previously sent the Server.\n           Need B \\<noteq> Server because we allow messages to self.*)\n | OR4:  \"[| evs4 \\<in> otway;  B \\<noteq> Server;\n             Says B Server {|Nonce NA, Agent A, Agent B, X',\n                             Crypt (shrK B)\n                                   {|Nonce NA, Nonce NB, Agent A, Agent B|}|}\n               : set evs4;\n             Gets B {|Nonce NA, X, Crypt (shrK B) {|Nonce NB, Key K|}|}\n               : set evs4 |]\n          ==> Says B A {|Nonce NA, X|} # evs4 : otway\"\n\n         (*This message models possible leaks of session keys.  The nonces\n           identify the protocol run.*)\n | Oops: \"[| evso \\<in> otway;\n             Says Server B {|Nonce NA, X, Crypt (shrK B) {|Nonce NB, Key K|}|}\n               : set evso |]\n          ==> Notes Spy {|Nonce NA, Nonce NB, Key K|} # evso : otway\"\n\n\ndeclare Says_imp_analz_Spy [dest]\ndeclare parts.Body  [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\n\n\ntext{*A \"possibility property\": there are traces that reach the end*}\nlemma \"[| B \\<noteq> Server; Key K \\<notin> used [] |]\n      ==> \\<exists>evs \\<in> otway.\n             Says B A {|Nonce NA, Crypt (shrK A) {|Nonce NA, Key K|}|}\n               \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] otway.Nil\n                    [THEN otway.OR1, THEN otway.Reception,\n                     THEN otway.OR2, THEN otway.Reception,\n                     THEN otway.OR3, THEN otway.Reception, THEN otway.OR4]) \napply (possibility, simp add: used_Cons) \ndone\n\nlemma Gets_imp_Says [dest!]:\n     \"[| Gets B X \\<in> set evs; evs \\<in> otway |] ==> \\<exists>A. Says A B X \\<in> set evs\"\napply (erule rev_mp)\napply (erule otway.induct, auto)\ndone\n\n\n(** For reasoning about the encrypted portion of messages **)\n\nlemma OR2_analz_knows_Spy:\n     \"[| Gets B {|N, Agent A, Agent B, X|} \\<in> set evs;  evs \\<in> otway |]\n      ==> X \\<in> analz (knows Spy evs)\"\nby blast\n\nlemma OR4_analz_knows_Spy:\n     \"[| Gets B {|N, X, Crypt (shrK B) X'|} \\<in> set evs;  evs \\<in> otway |]\n      ==> X \\<in> analz (knows Spy evs)\"\nby blast\n\n(*These lemmas assist simplification by removing forwarded X-variables.\n  We can replace them by rewriting with parts_insert2 and proving using\n  dest: parts_cut, but the proofs become more difficult.*)\nlemmas OR2_parts_knows_Spy =\n    OR2_analz_knows_Spy [THEN analz_into_parts]\n\n(*There could be OR4_parts_knows_Spy and Oops_parts_knows_Spy, but for\n  some reason proofs work without them!*)\n\n\ntext{*Theorems of the form @{term \"X \\<notin> parts (spies evs)\"} imply that\nNOBODY sends messages containing X! *}\n\ntext{*Spy never sees a good agent's shared key!*}\nlemma Spy_see_shrK [simp]:\n     \"evs \\<in> otway ==> (Key (shrK A) \\<in> parts (knows Spy evs)) = (A \\<in> bad)\"\nby (erule otway.induct, force,\n    drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\n\n\nlemma Spy_analz_shrK [simp]:\n     \"evs \\<in> otway ==> (Key (shrK A) \\<in> analz (knows Spy evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"[|Key (shrK A) \\<in> parts (knows Spy evs);  evs \\<in> otway|] ==> A \\<in> bad\"\nby (blast dest: Spy_see_shrK)\n\n\nsubsection{*Towards Secrecy: Proofs Involving @{term analz}*}\n\n(*Describes the form of K and NA when the Server sends this message.  Also\n  for Oops case.*)\nlemma Says_Server_message_form:\n     \"[| Says Server B {|NA, X, Crypt (shrK B) {|NB, Key K|}|} \\<in> set evs;\n         evs \\<in> otway |]\n      ==> K \\<notin> range shrK & (\\<exists>i. NA = Nonce i) & (\\<exists>j. NB = Nonce j)\"\nby (erule rev_mp, erule otway.induct, simp_all)\n\n\n(****\n The following is to prove theorems of the form\n\n  Key K \\<in> analz (insert (Key KAB) (knows Spy evs)) ==>\n  Key K \\<in> analz (knows Spy evs)\n\n A more general formula must be proved inductively.\n****)\n\n\ntext{*Session keys are not used to encrypt other session keys*}\n\ntext{*The equality makes the induction hypothesis easier to apply*}\nlemma analz_image_freshK [rule_format]:\n \"evs \\<in> otway ==>\n   \\<forall>K KK. KK <= -(range shrK) -->\n          (Key K \\<in> analz (Key`KK Un (knows Spy evs))) =\n          (K \\<in> KK | Key K \\<in> analz (knows Spy evs))\"\napply (erule otway.induct)\napply (frule_tac [8] Says_Server_message_form)\napply (drule_tac [7] OR4_analz_knows_Spy)\napply (drule_tac [5] OR2_analz_knows_Spy, analz_freshK, spy_analz, auto) \ndone\n\nlemma analz_insert_freshK:\n  \"[| evs \\<in> otway;  KAB \\<notin> range shrK |] ==>\n      (Key K \\<in> analz (insert (Key KAB) (knows Spy evs))) =\n      (K = KAB | Key K \\<in> analz (knows Spy evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\n\ntext{*The Key K uniquely identifies the Server's  message. *}\nlemma unique_session_keys:\n     \"[| Says Server B {|NA, X, Crypt (shrK B) {|NB, K|}|}   \\<in> set evs;\n         Says Server B' {|NA',X',Crypt (shrK B') {|NB',K|}|} \\<in> set evs;\n         evs \\<in> otway |] ==> X=X' & B=B' & NA=NA' & NB=NB'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule otway.induct, simp_all)\napply blast+  --{*OR3 and OR4*}\ndone\n\n\nsubsection{*Authenticity properties relating to NA*}\n\ntext{*Only OR1 can have caused such a part of a message to appear.*}\nlemma Crypt_imp_OR1 [rule_format]:\n \"[| A \\<notin> bad;  evs \\<in> otway |]\n  ==> Crypt (shrK A) {|NA, Agent A, Agent B|} \\<in> parts (knows Spy evs) -->\n      Says A B {|NA, Agent A, Agent B,\n                 Crypt (shrK A) {|NA, Agent A, Agent B|}|}\n        \\<in> set evs\"\nby (erule otway.induct, force,\n    drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\n\nlemma Crypt_imp_OR1_Gets:\n     \"[| Gets B {|NA, Agent A, Agent B,\n                  Crypt (shrK A) {|NA, Agent A, Agent B|}|} \\<in> set evs;\n         A \\<notin> bad; evs \\<in> otway |]\n       ==> Says A B {|NA, Agent A, Agent B,\n                      Crypt (shrK A) {|NA, Agent A, Agent B|}|}\n             \\<in> set evs\"\nby (blast dest: Crypt_imp_OR1)\n\n\ntext{*The Nonce NA uniquely identifies A's message*}\nlemma unique_NA:\n     \"[| Crypt (shrK A) {|NA, Agent A, Agent B|} \\<in> parts (knows Spy evs);\n         Crypt (shrK A) {|NA, Agent A, Agent C|} \\<in> parts (knows Spy evs);\n         evs \\<in> otway;  A \\<notin> bad |]\n      ==> B = C\"\napply (erule rev_mp, erule rev_mp)\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\ndone\n\n\ntext{*It is impossible to re-use a nonce in both OR1 and OR2.  This holds because\n  OR2 encrypts Nonce NB.  It prevents the attack that can occur in the\n  over-simplified version of this protocol: see @{text OtwayRees_Bad}.*}\nlemma no_nonce_OR1_OR2:\n   \"[| Crypt (shrK A) {|NA, Agent A, Agent B|} \\<in> parts (knows Spy evs);\n       A \\<notin> bad;  evs \\<in> otway |]\n    ==> Crypt (shrK A) {|NA', NA, Agent A', Agent A|} \\<notin> parts (knows Spy evs)\"\napply (erule rev_mp)\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\ndone\n\ntext{*Crucial property: If the encrypted message appears, and A has used NA\n  to start a run, then it originated with the Server!*}\nlemma NA_Crypt_imp_Server_msg [rule_format]:\n     \"[| A \\<notin> bad;  evs \\<in> otway |]\n      ==> Says A B {|NA, Agent A, Agent B,\n                     Crypt (shrK A) {|NA, Agent A, Agent B|}|} \\<in> set evs -->\n          Crypt (shrK A) {|NA, Key K|} \\<in> parts (knows Spy evs)\n          --> (\\<exists>NB. Says Server B\n                         {|NA,\n                           Crypt (shrK A) {|NA, Key K|},\n                           Crypt (shrK B) {|NB, Key K|}|} \\<in> set evs)\"\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all, blast)\napply blast  --{*OR1: by freshness*}\napply (blast dest!: no_nonce_OR1_OR2 intro: unique_NA)  --{*OR3*}\napply (blast intro!: Crypt_imp_OR1)  --{*OR4*}\ndone\n\n\ntext{*Corollary: if A receives B's OR4 message and the nonce NA agrees\n  then the key really did come from the Server!  CANNOT prove this of the\n  bad form of this protocol, even though we can prove\n  @{text Spy_not_see_encrypted_key} *}\nlemma A_trusts_OR4:\n     \"[| Says A  B {|NA, Agent A, Agent B,\n                     Crypt (shrK A) {|NA, Agent A, Agent B|}|} \\<in> set evs;\n         Says B' A {|NA, Crypt (shrK A) {|NA, Key K|}|} \\<in> set evs;\n     A \\<notin> bad;  evs \\<in> otway |]\n  ==> \\<exists>NB. Says Server B\n               {|NA,\n                 Crypt (shrK A) {|NA, Key K|},\n                 Crypt (shrK B) {|NB, Key K|}|}\n                 \\<in> set evs\"\nby (blast intro!: NA_Crypt_imp_Server_msg)\n\n\ntext{*Crucial secrecy property: Spy does not see the keys sent in msg OR3\n    Does not in itself guarantee security: an attack could violate\n    the premises, e.g. by having @{term \"A=Spy\"}*}\nlemma secrecy_lemma:\n \"[| A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway |]\n  ==> Says Server B\n        {|NA, Crypt (shrK A) {|NA, Key K|},\n          Crypt (shrK B) {|NB, Key K|}|} \\<in> set evs -->\n      Notes Spy {|NA, NB, Key K|} \\<notin> set evs -->\n      Key K \\<notin> analz (knows Spy evs)\"\napply (erule otway.induct, force)\napply (frule_tac [7] Says_Server_message_form)\napply (drule_tac [6] OR4_analz_knows_Spy)\napply (drule_tac [4] OR2_analz_knows_Spy)\napply (simp_all add: analz_insert_eq analz_insert_freshK pushes)\napply spy_analz  --{*Fake*}\napply (blast dest: unique_session_keys)+  --{*OR3, OR4, Oops*}\ndone\n\ntheorem Spy_not_see_encrypted_key:\n     \"[| Says Server B\n          {|NA, Crypt (shrK A) {|NA, Key K|},\n                Crypt (shrK B) {|NB, Key K|}|} \\<in> set evs;\n         Notes Spy {|NA, NB, Key K|} \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway |]\n      ==> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest: Says_Server_message_form secrecy_lemma)\n\ntext{*This form is an immediate consequence of the previous result.  It is \nsimilar to the assertions established by other methods.  It is equivalent\nto the previous result in that the Spy already has @{term analz} and\n@{term synth} at his disposal.  However, the conclusion \n@{term \"Key K \\<notin> knows Spy evs\"} appears not to be inductive: all the cases\nother than Fake are trivial, while Fake requires \n@{term \"Key K \\<notin> analz (knows Spy evs)\"}. *}\nlemma Spy_not_know_encrypted_key:\n     \"[| Says Server B\n          {|NA, Crypt (shrK A) {|NA, Key K|},\n                Crypt (shrK B) {|NB, Key K|}|} \\<in> set evs;\n         Notes Spy {|NA, NB, Key K|} \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway |]\n      ==> Key K \\<notin> knows Spy evs\"\nby (blast dest: Spy_not_see_encrypted_key)\n\n\ntext{*A's guarantee.  The Oops premise quantifies over NB because A cannot know\n  what it is.*}\nlemma A_gets_good_key:\n     \"[| Says A  B {|NA, Agent A, Agent B,\n                     Crypt (shrK A) {|NA, Agent A, Agent B|}|} \\<in> set evs;\n         Says B' A {|NA, Crypt (shrK A) {|NA, Key K|}|} \\<in> set evs;\n         \\<forall>NB. Notes Spy {|NA, NB, Key K|} \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway |]\n      ==> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest!: A_trusts_OR4 Spy_not_see_encrypted_key)\n\n\nsubsection{*Authenticity properties relating to NB*}\n\ntext{*Only OR2 can have caused such a part of a message to appear.  We do not\n  know anything about X: it does NOT have to have the right form.*}\nlemma Crypt_imp_OR2:\n     \"[| Crypt (shrK B) {|NA, NB, Agent A, Agent B|} \\<in> parts (knows Spy evs);\n         B \\<notin> bad;  evs \\<in> otway |]\n      ==> \\<exists>X. Says B Server\n                 {|NA, Agent A, Agent B, X,\n                   Crypt (shrK B) {|NA, NB, Agent A, Agent B|}|}\n                 \\<in> set evs\"\napply (erule rev_mp)\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\ndone\n\n\ntext{*The Nonce NB uniquely identifies B's  message*}\nlemma unique_NB:\n     \"[| Crypt (shrK B) {|NA, NB, Agent A, Agent B|} \\<in> parts(knows Spy evs);\n         Crypt (shrK B) {|NC, NB, Agent C, Agent B|} \\<in> parts(knows Spy evs);\n           evs \\<in> otway;  B \\<notin> bad |]\n         ==> NC = NA & C = A\"\napply (erule rev_mp, erule rev_mp)\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all)\napply blast+  --{*Fake, OR2*}\ndone\n\ntext{*If the encrypted message appears, and B has used Nonce NB,\n  then it originated with the Server!  Quite messy proof.*}\nlemma NB_Crypt_imp_Server_msg [rule_format]:\n \"[| B \\<notin> bad;  evs \\<in> otway |]\n  ==> Crypt (shrK B) {|NB, Key K|} \\<in> parts (knows Spy evs)\n      --> (\\<forall>X'. Says B Server\n                     {|NA, Agent A, Agent B, X',\n                       Crypt (shrK B) {|NA, NB, Agent A, Agent B|}|}\n           \\<in> set evs\n           --> Says Server B\n                {|NA, Crypt (shrK A) {|NA, Key K|},\n                      Crypt (shrK B) {|NB, Key K|}|}\n                    \\<in> set evs)\"\napply simp\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all)\napply blast  --{*Fake*}\napply blast  --{*OR2*}\napply (blast dest: unique_NB dest!: no_nonce_OR1_OR2)  --{*OR3*}\napply (blast dest!: Crypt_imp_OR2)  --{*OR4*}\ndone\n\n\ntext{*Guarantee for B: if it gets a message with matching NB then the Server\n  has sent the correct message.*}\ntheorem B_trusts_OR3:\n     \"[| Says B Server {|NA, Agent A, Agent B, X',\n                         Crypt (shrK B) {|NA, NB, Agent A, Agent B|} |}\n           \\<in> set evs;\n         Gets B {|NA, X, Crypt (shrK B) {|NB, Key K|}|} \\<in> set evs;\n         B \\<notin> bad;  evs \\<in> otway |]\n      ==> Says Server B\n               {|NA,\n                 Crypt (shrK A) {|NA, Key K|},\n                 Crypt (shrK B) {|NB, Key K|}|}\n                 \\<in> set evs\"\nby (blast intro!: NB_Crypt_imp_Server_msg)\n\n\ntext{*The obvious combination of @{text B_trusts_OR3} with \n      @{text Spy_not_see_encrypted_key}*}\nlemma B_gets_good_key:\n     \"[| Says B Server {|NA, Agent A, Agent B, X',\n                         Crypt (shrK B) {|NA, NB, Agent A, Agent B|} |}\n           \\<in> set evs;\n         Gets B {|NA, X, Crypt (shrK B) {|NB, Key K|}|} \\<in> set evs;\n         Notes Spy {|NA, NB, Key K|} \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway |]\n      ==> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest!: B_trusts_OR3 Spy_not_see_encrypted_key)\n\n\nlemma OR3_imp_OR2:\n     \"[| Says Server B\n              {|NA, Crypt (shrK A) {|NA, Key K|},\n                Crypt (shrK B) {|NB, Key K|}|} \\<in> set evs;\n         B \\<notin> bad;  evs \\<in> otway |]\n  ==> \\<exists>X. Says B Server {|NA, Agent A, Agent B, X,\n                            Crypt (shrK B) {|NA, NB, Agent A, Agent B|} |}\n              \\<in> set evs\"\napply (erule rev_mp)\napply (erule otway.induct, simp_all)\napply (blast dest!: Crypt_imp_OR2)+\ndone\n\n\ntext{*After getting and checking OR4, agent A can trust that B has been active.\n  We could probably prove that X has the expected form, but that is not\n  strictly necessary for authentication.*}\ntheorem A_auths_B:\n     \"[| Says B' A {|NA, Crypt (shrK A) {|NA, Key K|}|} \\<in> set evs;\n         Says A  B {|NA, Agent A, Agent B,\n                     Crypt (shrK A) {|NA, Agent A, Agent B|}|} \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway |]\n  ==> \\<exists>NB X. Says B Server {|NA, Agent A, Agent B, X,\n                               Crypt (shrK B)  {|NA, NB, Agent A, Agent B|} |}\n                 \\<in> set evs\"\nby (blast dest!: A_trusts_OR4 OR3_imp_OR2)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/OtwayRees.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.668880247169804, "lm_q2_score": 0.4843800842769843, "lm_q1q2_score": 0.32399227049531976}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoarePartialDef.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Hoare Logic for Partial Correctness *}\ntheory HoarePartialDef imports Semantic begin\n\ntype_synonym ('s,'p) quadruple = \"('s assn \\<times> 'p \\<times> 's assn \\<times> 's assn)\"\n\nsubsection {* Validity of Hoare Tuples: @{text \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\ndefinition\n  valid :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n                (\"_\\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \n    \\<forall>s t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> s \\<in> Normal ` P \\<longrightarrow> \n            t \\<notin> Fault ` F  \\<longrightarrow>  \n          t \\<in>  Normal ` Q \\<union> Abrupt ` A\"\n\ndefinition\n  cvalid::\n  \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n      's assn,('s,'p,'f) com,'s assn,'s assn] =>bool\"\n                (\"_,_\\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \n   (\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\<longrightarrow> \n     \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\ndefinition\n  nvalid :: \"[('s,'p,'f) body,nat,'f set, \n                's assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n                (\"_\\<Turnstile>_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \\<forall>s t. \\<Gamma>\\<turnstile>\\<langle>c,s \\<rangle> =n\\<Rightarrow> t \\<longrightarrow> s \\<in> Normal ` P \\<longrightarrow> t \\<notin> Fault ` F \n                        \\<longrightarrow> t \\<in>  Normal ` Q \\<union> Abrupt ` A\"\n\n\ndefinition\n  cnvalid::\n  \"[('s,'p,'f) body,('s,'p) quadruple set,nat,'f set, \n     's assn,('s,'p,'f) com,'s assn,'s assn] \\<Rightarrow> bool\"\n                (\"_,_\\<Turnstile>_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> (\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\<longrightarrow> \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\nnotation (ASCII)\n  valid  (\"_|='/_/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60) and\n  cvalid  (\"_,_|='/_/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60) and\n  nvalid  (\"_|=_:'/_/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60) and\n  cnvalid  (\"_,_|=_:'/_/ _ _ _,_\"  [61,60,60,60,1000, 20, 1000,1000] 60)\n\n\nsubsection {*Properties of Validity *}\n\nlemma valid_iff_nvalid: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A = (\\<forall>n. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A)\"\n  apply (simp only: valid_def nvalid_def exec_iff_execn )\n  apply (blast dest: exec_final_notin_to_execn)\n  done\n \nlemma cnvalid_to_cvalid: \"(\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A) \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (unfold cvalid_def cnvalid_def valid_iff_nvalid [THEN eq_reflection])\n  apply fast\n  done\n\nlemma nvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P; t\\<notin> Fault ` F\\<rbrakk> \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: nvalid_def)\n\nlemma validI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t;s \\<in> P; t\\<notin>Fault ` F\\<rbrakk> \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: valid_def)\n\nlemma cvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n          \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: cvalid_def valid_def)\n\nlemma cvalidD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A;\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n  \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  by (auto simp add: cvalid_def valid_def)\n\nlemma cnvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n   \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n          \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: cnvalid_def nvalid_def)\n\n\nlemma cnvalidD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A;\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n   \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P;\n   t\\<notin>Fault ` F\\<rbrakk> \n  \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  by (auto simp add: cnvalid_def nvalid_def)\n\nlemma nvalid_augment_Faults:\n  assumes validn:\"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F \\<subseteq> F'\"\n  shows \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F'\"\n  with F' have \"t \\<notin> Fault ` F\"\n    by blast\n  with exec P validn\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (auto simp add: nvalid_def)\nqed\n\nlemma valid_augment_Faults:\n  assumes validn:\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F \\<subseteq> F'\"\n  shows \"\\<Gamma>\\<Turnstile>\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F'\"\n  with F' have \"t \\<notin> Fault ` F\"\n    by blast\n  with exec P validn\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (auto simp add: valid_def)\nqed\n\nlemma nvalid_to_nvalid_strip:\n  assumes validn:\"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec_strip: \"strip F' \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F\"\n  from exec_strip obtain t' where\n    exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t'\" and\n    t': \"t' \\<in> Fault ` (-F') \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: execn_strip_to_execn)\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"t' \\<in> Fault ` F\")\n    case True\n    with t' F F' have False\n      by blast\n    thus ?thesis ..\n  next\n    case False\n    with exec P validn\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: nvalid_def)\n    moreover\n    from this t' have \"t'=t\"\n      by auto\n    ultimately show ?thesis\n      by simp\n  qed\nqed\n\n\nlemma valid_to_valid_strip:\n  assumes valid:\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec_strip: \"strip F' \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F\"\n  from exec_strip obtain t' where\n    exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t'\" and\n    t': \"t' \\<in> Fault ` (-F') \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: exec_strip_to_exec)\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"t' \\<in> Fault ` F\")\n    case True\n    with t' F F' have False\n      by blast\n    thus ?thesis ..\n  next\n    case False\n    with exec P valid\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: valid_def)\n    moreover\n    from this t' have \"t'=t\"\n      by auto\n    ultimately show ?thesis\n      by simp\n  qed\nqed\n\n\nsubsection {* The Hoare Rules: @{text \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\nlemma mono_WeakenContext: \"A \\<subseteq> B \\<Longrightarrow>\n        (\\<lambda>(P, c, Q, A'). (\\<Gamma>, \\<Theta>, F, P, c, Q, A') \\<in> A) x \\<longrightarrow>\n        (\\<lambda>(P, c, Q, A'). (\\<Gamma>, \\<Theta>, F, P, c, Q, A') \\<in> B) x\"\napply blast\ndone\n\n\ninductive \"hoarep\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n    's assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n    (\"(3_,_/\\<turnstile>\\<^bsub>'/_ \\<^esub>(_/ (_)/ _,/_))\" [60,60,60,1000,20,1000,1000]60)\n  for \\<Gamma>::\"('s,'p,'f) body\"\nwhere\n  Skip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. f s \\<in> Q} (Basic f) Q,A\"\n\n| Spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. (\\<forall>t. (s,t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s,t) \\<in> r)} (Spec r) Q,A\"\n\n| Seq: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Seq c\\<^sub>1 c\\<^sub>2) Q,A\"\n  \n| Cond: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c\\<^sub>1 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> - b) c\\<^sub>2 Q,A\\<rbrakk>\n         \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (While b c) (P \\<inter> - b),A\"\n\n| Guard: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) (Guard f g c) Q,A\"\n\n| Guarantee: \"\\<lbrakk>f \\<in> F; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec:\n  \"\\<lbrakk>(P,p,Q,A) \\<in> Specs;  \n    \\<forall>(P,p,Q,A) \\<in> Specs. p \\<in> dom \\<Gamma> \\<and> \\<Gamma>,\\<Theta>\\<union>Specs\\<turnstile>\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A \\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| DynCom:\n      \"\\<forall>s \\<in> P. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (c s) Q,A \n      \\<Longrightarrow> \n      \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n| Throw: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk> \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\<forall>s \\<in> P. \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A \n           \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"\\<lbrakk>(P,p,Q,A) \\<in> \\<Theta>\\<rbrakk>\n         \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| ExFalso: \"\\<lbrakk>\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A; \\<not> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n \\<comment>  \\<open> This is a hack rule that enables us to derive completeness for\n        an arbitrary context @{text \"\\<Theta>\"}, from completeness for an empty context.\\<close>  \n\n\n\ntext {* Does not work, because of rule ExFalso, the context @{text \"\\<Theta>\"} is to blame.\n A weaker version with empty context can be derived from soundness \n and completeness later on. *}\nlemma hoare_strip_\\<Gamma>: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"strip (-F) \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv \nproof induct\n  case Skip thus ?case by (iprover intro: hoarep.Skip)\nnext\n  case Basic thus ?case by (iprover intro: hoarep.Basic)\nnext\n  case Spec thus ?case by (iprover intro: hoarep.Spec)\nnext\n  case Seq thus ?case by (iprover intro: hoarep.Seq)\nnext\n  case Cond thus ?case by (iprover intro: hoarep.Cond)\nnext\n  case While thus ?case by (iprover intro: hoarep.While)\nnext\n  case Guard thus ?case by (iprover intro: hoarep.Guard)\n(*next\n  case CallSpec thus ?case by (iprover intro: hoarep.CallSpec)\nnext\n  case (CallRec A Abr Abr' Init P Post Pre Procs Q R Result Return Z \\<Gamma> \\<Theta> init p\n         result return )\n  from CallRec.hyps\n  have \"\\<forall>p\\<in>Procs. \\<forall>Z. (strip \\<Gamma>),\\<Theta> \\<union>\n             (\\<Union>\\<^bsub>p\\<in>Procs\\<^esub>\n                 \\<Union>\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n                      Post p Z, Abr p Z)})\\<turnstile>\n            (Pre p Z) (the (\\<Gamma> p)) (R p Z),(Abr' p Z)\" by blast\n  hence \"\\<forall>p\\<in>Procs. \\<forall>Z. (strip \\<Gamma>),\\<Theta> \\<union>\n             (\\<Union>\\<^bsub>p\\<in>Procs\\<^esub>\n                 \\<Union>\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n                      Post p Z, Abr p Z)})\\<turnstile>\n            (Pre p Z) (the ((strip \\<Gamma>) p)) (R p Z),(Abr' p Z)\"\n    by (auto intro: hoarep.StripI)\n  then show ?case\n    apply - \n    apply (rule hoarep.CallRec)\n    apply (assumption | simp only:dom_strip)+\n    done*)\nnext\n  case DynCom \n  thus ?case\n    by - (rule hoarep.DynCom,best  elim!: ballE exE)\nnext\n  case Throw thus ?case by (iprover intro: hoarep.Throw)\nnext\n  case Catch thus ?case by (iprover intro: hoarep.Catch)\n(*next \n  case CONSEQ thus ?case apply (auto intro: hoarep.CONSEQ)*)\nnext\n  case Asm thus ?case by (iprover intro: hoarep.Asm)\nnext\n  case ExFalso\n  thus ?case\n    oops\n\nlemma hoare_augment_context: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"\\<And>\\<Theta>'. \\<Theta> \\<subseteq> \\<Theta>' \\<Longrightarrow> \\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n  case CallRec\n  case (CallRec P p Q A Specs \\<Theta> F \\<Theta>')\n  from CallRec.prems\n  have \"\\<Theta>\\<union>Specs\n       \\<subseteq> \\<Theta>'\\<union>Specs\"\n    by blast\n  with CallRec.hyps (2) \n  have \"\\<forall>(P,p,Q,A)\\<in>Specs.  p \\<in> dom \\<Gamma> \\<and> \\<Gamma>,\\<Theta>'\\<union>Specs \\<turnstile>\\<^bsub>/F\\<^esub> P  (the (\\<Gamma> p)) Q,A\"\n    by fastforce\n\n  with CallRec show ?case by - (rule hoarep.CallRec)\nnext\n  case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n  case (Conseq P \\<Theta> F c Q A \\<Theta>')\n  from Conseq\n  have \"\\<forall>s \\<in> P. \n         (\\<exists>P' Q' A'. \\<Gamma>,\\<Theta>' \\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A)\"\n    by blast\n  with Conseq show ?case by - (rule hoarep.Conseq)\nnext\n  case (ExFalso \\<Theta> F P c Q A \\<Theta>')\n  have valid_ctxt: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\" \"\\<Theta> \\<subseteq> \\<Theta>'\" by fact+\n  hence \"\\<forall>n. \\<Gamma>,\\<Theta>'\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n    by (simp add: cnvalid_def) blast\n  moreover have invalid: \"\\<not> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"  by fact\n  ultimately show ?case\n    by (rule hoarep.ExFalso)\nqed (blast intro: hoarep.intros)+\n\n\nsubsection {* Some Derived Rules *}\n\nlemma  Conseq': \"\\<forall>s. s \\<in> P \\<longrightarrow> \n            (\\<exists>P' Q' A'. \n              (\\<forall> Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\<and>\n                    (\\<exists>Z. s \\<in> P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A)))\n           \\<Longrightarrow>\n           \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\<lbrakk>\\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n              \\<forall>s. s \\<in> P \\<longrightarrow> (\\<exists> Z. s\\<in>P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A))\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule Conseq) blast\n\ntheorem conseqPrePost [trans]: \n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow>  Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq [where ?P'=\"\\<lambda>Z. P'\" and ?Q'=\"\\<lambda>Z. Q'\"]) auto\n\nlemma conseqPre [trans]: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q,A \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost [trans]: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q',A' \\<Longrightarrow> Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \n \\<Longrightarrow>   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq) auto\n\n\nlemma CallRec': \n  \"\\<lbrakk>p\\<in>Procs; Procs \\<subseteq> dom \\<Gamma>;\n   \\<forall>p\\<in>Procs. \n    \\<forall>Z. \\<Gamma>,\\<Theta> \\<union> (\\<Union>p\\<in>Procs. \\<Union>Z. {((P p Z),p,Q p Z,A p Z)})\n        \\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\\<rbrakk>\n   \\<Longrightarrow>\n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\<Union>p\\<in>Procs. \\<Union>Z. {((P p Z),p,Q p Z,A p Z)}\"])\napply  blast\napply blast\ndone\n\nend ", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/EmbSimpl/HoarePartialDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982315512488, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3238991157756244}}
{"text": "theory Extra6\n  imports ExtraInv VCTheoryLemmas\nbegin\n\nabbreviation s where \"s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value \\<equiv>\n (toEnv\n   (setVarBool (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value)\n     direction'\n     (getVarBool (setVarAny s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value)\n       directionSwitch')))\"\n\ntheorem extra6: \"VC6 extraInv env s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\"\n  apply(simp only: VC6_def extraInv_def)\n  apply(rule impI)\n  apply(rule conjI)\n   apply simp\n  subgoal\n    apply((drule conjE[of _ _ ?thesis])+)\n                        defer\n                        apply assumption+\n    subgoal premises prems\n      apply(rule conjI)\n      using  prems(7) apply -[1]\n       apply(rule allI)\n      subgoal for s1\n        apply(cases \"s1 = s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\")\n         apply(rule impI)\n         apply(drule allE[of _ s0])\n          prefer 2\n          apply assumption\n         apply(drule impE)\n           prefer 3\n           apply assumption\n        using prems(1-6) substate_refl apply simp\n         apply(drule disjE)\n           prefer 3\n           apply assumption\n          apply(rule disjI1)\n          apply(drule exE)\n           prefer 2\n           apply assumption\n          apply(drule exE)\n           prefer 2\n           apply assumption\n        subgoal for s2 s3\n          apply(rule exI[of _ s2])\n          apply(rule exI[of _ s3])\n          apply(((rule conjI),(auto)[1])+)\n          using prems(1-6) apply -\n          apply((rule allI)+)\n          subgoal for s4 s5\n            apply(cases \"s5 = s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\")\n             apply simp\n            using substate_toEnvNum_id apply blast\n            apply simp\n            by blast\n          done\n         apply(rule disjI2)\n        using prems(1-6) apply -[1]\n         apply((rule allI)+)\n        subgoal for s4 s5\n          apply(cases \"s5 = s s0 userAtTop_value userAtBottom_value directionSwitch_value alarmButton_value stuck_value\")\n           apply simp\n          using substate_toEnvNum_id apply blast\n          apply simp\n          by blast\n        by auto\n      apply(rule conjI)\n      using prems(1-6) prems(8) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(9) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(10) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(11) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(12) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(13) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(14) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(15) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(16) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(17) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(18) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(19) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(20) substate_refl  apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(21) apply simp\n      apply(rule conjI)\n      using prems(1-6) prems(22) apply simp\n      using prems(1-6) prems(23) by simp\n    done\n  done\n\nend", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/escalator/Extra6.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.5, "lm_q1q2_score": 0.32389910217648576}}
{"text": "theory Concrete_Reachability_Analysis_C1\nimports\n  Concrete_Reachability_Analysis\n  Abstract_Reachability_Analysis_C1\nbegin\n\ndefinition \"op_card_vec TYPE('a) = CARD('a)\"\nlemma op_card_vec_pat_def[autoref_op_pat_def]: \"CARD('a) \\<equiv> OP (op_card_vec TYPE('a))\"\n  by (auto simp: op_card_vec_def)\nlemma op_card_vec_impl[autoref_rules]:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::enum rvec) E\"\n  shows \"(E, op_card_vec TYPE('a)) \\<in> nat_rel\"\n  using assms by (auto simp: op_card_vec_def)\n\n\ncontext approximate_sets\nbegin\n\nsublocale approximate_sets_ode' where ode_ops = ode_ops for ode_ops ..\\<comment> \\<open>parametrized by \\<open>ode_ops\\<close>\\<close>\n\nend\n\ncontext approximate_sets\nbegin\n\nlemma nonneg_reals_autoref[autoref_rules]: \"(None, nonneg_reals) \\<in> \\<langle>Id\\<rangle>phantom_rel\"\n  and pos_reals_autoref[autoref_rules]: \"(None, pos_reals) \\<in> \\<langle>Id\\<rangle>phantom_rel\"\n  by (auto simp: phantom_rel_def)\n\nlemma appr1_relI:\n  assumes \"c1_info_invar DIM('n::executable_euclidean_space) X0i\"\n  shows \"(X0i, (c1_info_of_appr X0i::'n c1_info set)) \\<in> appr1_rel\"\n    using assms\n  apply (cases \"snd X0i\")\n  subgoal\n    apply (simp add: c1_info_of_appr_def c1_info_invar_def)\n    unfolding appr1_rel_internal\n    apply (rule UnI1)\n    apply auto\n    apply (rule exI[where x=\"fst X0i\"])\n    apply safe\n    subgoal by (auto simp: prod_eq_iff)\n    subgoal\n      apply (rule exI[where x=\"eucl_of_list ` set_of_appr (fst X0i)\"])\n      apply (auto simp: appr_rel_def)\n      by (auto simp: appr_rell_internal lv_rel_def set_rel_br br_chain length_set_of_appr\n          intro!: brI)\n    done\n  subgoal for D\n    apply (simp add: c1_info_of_appr_def c1_info_invar_def)\n    unfolding appr1_rel_internal\n    apply (rule UnI2)\n    apply (auto simp: set_rel_br)\n    apply (rule exI[where x=\"fst X0i\"])\n    apply (rule exI[where x=D])\n    apply safe\n    subgoal by (auto simp: prod_eq_iff)\n    subgoal\n      by (auto simp: appr_rell_internal lv_rel_def set_rel_br br_chain length_set_of_appr\n          intro!: brI) (auto simp:  power2_eq_square)\n    done\n  done\n\nlemma appr1_rel_br: \"appr1_rel = br (c1_info_of_appr::_\\<Rightarrow>('n c1_info)set) (c1_info_invar DIM('n::executable_euclidean_space))\"\n  apply (auto simp: dest!: brD intro!: appr1_relI)\n  apply (rule brI)\n  subgoal by (auto simp: appr1_rel_internal c1_info_of_appr_def appr_rel_br set_rel_br dest!: brD)\n  subgoal by (auto simp: c1_info_invar_def appr1_rel_internal appr_rel_br power2_eq_square dest!: brD)\n  done\n\nlemma appr1_rel_aux:\n  \"{((xs, Some ys), X) |xs ys X. (xs @ ys, X) \\<in> appr_rel \\<and> length ys = (length xs)\\<^sup>2} O\n    \\<langle>br flow1_of_vec1 top\\<rangle>set_rel =\n  {((xs, Some ys), X::'n eucl1 set) |xs ys X.\n     X = (\\<lambda>xs. flow1_of_vec1 (eucl_of_list xs)) ` set_of_appr (xs @ ys) \\<and>\n     length xs = DIM((real, 'n::enum) vec) \\<and> length ys = DIM((real, 'n) vec) * DIM((real, 'n) vec)}\"\n  apply (auto simp: set_rel_br appr_rel_br power2_eq_square dest!: brD)\n  apply (rule relcompI)\n   apply simp\n   apply (rule brI) apply (rule refl) apply simp\n  apply (rule brI) defer apply simp\n  apply auto\n  done\n\nlemma flow1_of_list_def':\n  shows \"flow1_of_list xs = flow1_of_vec1 (eucl_of_list xs)\"\n  by (auto simp: flow1_of_list_def flow1_of_vec1_def eucl_of_list_prod\n      blinfun_of_list_eq_blinfun_of_vmatrix)\n\nlemma appr1_rel_def:\n  \"appr1_rel =\n    {((xs, None   ), X \\<times> UNIV)| xs X. (xs, X) \\<in> appr_rel} \\<union>\n    {((xs, Some ys), X)| xs ys X. (xs @ ys, X) \\<in> appr_rel \\<and> length ys = (length xs)\\<^sup>2} O \\<langle>br flow1_of_vec1 top\\<rangle>set_rel\"\n  unfolding appr1_rel_internal flow1_of_list_def'[abs_def] appr1_rel_aux ..\n\nlemmas [autoref_rel_intf] = REL_INTFI[of appr1_rel i_appr1]\n\n\nlemma op_image_flow1_of_vec1[autoref_rules]:\n  assumes \"DIM_precond TYPE('a rvec) E\"\n  shows \"(\\<lambda>xs. (take E xs, Some (drop E xs)),\n    op_image_flow1_of_vec1::('a::enum) vec1 set\\<Rightarrow>_) \\<in> appr_rel \\<rightarrow> appr1_rel\"\n  using assms\n  apply (auto simp: appr1_rel_def set_rel_br flow1_of_vec1_def[abs_def] intro!: brI elim!: notE\n      split: option.splits list.splits)\n  apply (rule relcompI[OF _ brI[OF refl]])\n   apply (auto simp: power2_eq_square min_def appr_rel_br br_def)\n  done\n\nlemma index_autoref[autoref_rules]:\n  \"(index, index) \\<in> \\<langle>lv_rel\\<rangle>list_rel \\<rightarrow> lv_rel \\<rightarrow> nat_rel\"\n  unfolding index_def[abs_def] find_index_def\n  apply parametricity\n  apply (auto simp: lv_rel_def br_def list_rel_def)\n  using list_of_eucl_eucl_of_list by force\n\nlemma [autoref_op_pat]: \"(`) fst \\<equiv> OP op_image_fst\"\n  by auto\n\nlemma op_image_fst_flow1[autoref_rules]:\n  shows \"(\\<lambda>x. fst x, op_image_fst::_\\<Rightarrow>'n::executable_euclidean_space set) \\<in> appr1_rel \\<rightarrow> appr_rel\"\n  apply (auto simp: appr1_rel_internal flow1_of_list_def set_rel_br image_image power2_eq_square dest!: brD)\n  apply (auto simp: br_def appr_rel_br length_set_of_appr image_image eucl_of_list_prod\n      dest!: set_of_appr_takeD)\n  subgoal for xs ys a\n    apply (rule image_eqI[where x=\"take DIM('n) a\"])\n    by (auto intro!: take_set_of_apprI dest: length_set_of_appr)\n  subgoal for xs ys a\n    apply (frule set_of_appr_ex_append2[where b=ys])\n    apply auto\n    subgoal for r\n      apply (rule image_eqI[where x=\"a @ r\"])\n       apply (auto simp: length_set_of_appr )\n      apply (rule eucl_of_list_eqI)\n      by (auto dest!: length_set_of_appr)\n    done\n  done\n\nlemma op_image_fste_impl[autoref_rules]:\n  \"((\\<lambda>(_, x, _). x), op_image_fste) \\<in> appr1e_rel \\<rightarrow> appr_rel\"\n  by (auto simp: image_image split_beta' scaleR2_rel_def\n      dest!: op_image_fst_flow1[param_fo] brD)\n\nlemma DIM_precond_vec1I[autoref_rules_raw]:\n  assumes \"DIM_precond TYPE('n::enum rvec) E\"\n  shows \"DIM_precond TYPE('n::enum vec1) (E + E*E)\"\n  using assms\n  by (auto simp: )\n\nlemma vec1rep_impl[autoref_rules]:\n  \"(\\<lambda>(a, bs). RETURN (map_option ((@) a) bs), vec1rep) \\<in> appr1_rel \\<rightarrow> \\<langle>\\<langle>appr_rel\\<rangle>option_rel\\<rangle>nres_rel\"\n  apply (auto simp: vec1rep_def appr1_rel_def set_rel_br appr_rel_def power2_eq_square nres_rel_def\n      dest!: brD\n      intro!: RETURN_SPEC_refine)\n  subgoal for xs ys a b\n    apply (rule exI[where x=\"Some (eucl_of_list ` set_of_appr (xs @ ys))\"])\n    apply (auto simp: appr_rell_internal image_image lv_rel_def set_rel_br length_set_of_appr\n        intro!: brI dest!: brD)\n    done\n  done\n\nlemma [autoref_op_pat]: \"X \\<times> UNIV \\<equiv> OP op_times_UNIV $ X\" by simp\n\nlemma op_times_UNIV_impl[autoref_rules]: \"(\\<lambda>x. (x, None), op_times_UNIV) \\<in> appr_rel \\<rightarrow> appr1_rel\"\n  by (auto simp: appr1_rel_internal)\n\nschematic_goal solve_poincare_plane_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules]: \"(ni, n) \\<in> lv_rel\" and CX[autoref_rules]: \"(CXi, CX) \\<in> appr1_rel\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  shows \"(nres_of (?R), solve_poincare_plane odo n (CX::'n eucl1 set)) \\<in> \\<langle>appr1_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding solve_poincare_plane_def\n  including art\n  by autoref_monadic\nconcrete_definition solve_poincare_plane_impl for ni CXi uses solve_poincare_plane_impl\nlemmas solve_poincare_plane_impl_refine[autoref_rules] = solve_poincare_plane_impl.refine[autoref_higher_order_rule (1)]\nsublocale autoref_op_pat_def solve_poincare_plane .\n\nlemma [autoref_rules_raw]:\n  assumes \"DIM_precond TYPE((real, 'n::enum) vec) K\"\n  shows \"DIM_precond TYPE(((real, 'n) vec, 'n) vec) (K * K)\"\n  using assms by auto\n\nlemma embed1_impl[autoref_rules]:\n  assumes \"DIM_precond TYPE((real, 'n::enum) vec) E\"\n  shows \"((\\<lambda>x. x @ replicate (E * E) 0), embed1::'n rvec\\<Rightarrow>_) \\<in> lv_rel \\<rightarrow> lv_rel\"\n  using assms\n  by (auto simp: lv_rel_def br_def eucl_of_list_prod)\n\ndefinition \"var_ode_ops_impl = (\\<lambda>(ode_ops, _, _, vode_slps).\n    (var_ode_ops ode_ops, (case vode_slps of None =>\n      let _ = print_msg_impl ''ODE solver not properly initialized: vode_slps missing!'' in\n      ode_slps_of (approximate_sets_ode'.var_ode_ops ode_ops)\n    | Some (vode_slps) => vode_slps), None, None))\"\n\nlemma var_ode_ops[autoref_rules]: \"(var_ode_ops_impl, var_ode_ops) \\<in> ode_ops_rel \\<rightarrow> ode_ops_rel\"\n  by (auto simp: var_ode_ops_impl_def ode_ops_rel_def init_ode_ops_def split: option.splits)\n\nschematic_goal choose_step1_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE((real, 'n::enum) vec) E\"\n    \"ncc_precond TYPE('n vec1)\"\n    \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules]: \"(Xi, X::'n eucl1 set) \\<in> appr1_rel\" \"(hi, h) \\<in> rnv_rel\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  notes [autoref_post_simps] = fst_conv\n  shows \"(nres_of ?f, choose_step1 odo X h) \\<in> \\<langle>rnv_rel \\<times>\\<^sub>r appr1_rel \\<times>\\<^sub>r appr1_rel \\<times>\\<^sub>r appr1_rel\\<rangle>nres_rel\"\n  unfolding choose_step1_def\n  including art\n  by autoref_monadic\nconcrete_definition choose_step1_impl for Xi hi uses choose_step1_impl\nlemmas [autoref_rules] = choose_step1_impl.refine[autoref_higher_order_rule (1 2 3)]\nsublocale autoref_op_pat_def choose_step1 .\n\nlemma op_image_zerofst_impl[autoref_rules]:\n  \"(\\<lambda>(_, x). (appr_of_ivl ops (replicate E 0) (replicate E 0), x), op_image_zerofst::'n c1_info set \\<Rightarrow> _)\n    \\<in> appr1_rel \\<rightarrow> appr1_rel\"\n  if \"DIM_precond (TYPE('n::executable_euclidean_space)) E\"\n  using that\n  apply (auto simp: appr1_rel_br dest!: brD intro!: brI)\n  subgoal by (force simp: c1_info_of_appr_def image_image flow1_of_list_def\n        set_of_appr_of_ivl_point_append eucl_of_list_prod c1_info_invar_def length_set_of_appr\n        split: option.splits elim!: mem_set_of_appr_appendE cong del: image_cong_simp)\n  subgoal for a b c d\n    apply (auto simp: c1_info_of_appr_def\n        split: option.splits)\n    subgoal using set_of_appr_nonempty[of a]\n      by (force  simp del: set_of_appr_nonempty)\n    subgoal\n      supply [simp del] = eucl_of_list_take_DIM\n      apply (auto simp: image_image set_of_appr_of_ivl_point_append\n          flow1_of_list_def)\n      apply (frule set_of_appr_ex_append1[where b=a])\n      apply auto\n      apply (rule image_eqI) prefer 2 apply assumption\n      by (auto simp: eucl_of_list_prod c1_info_invar_def\n          dest!: length_set_of_appr)\n    done\n  subgoal\n    by (auto simp: c1_info_of_appr_def flow1_of_vec1_def image_image\n        set_of_appr_of_ivl_point_append eucl_of_list_prod c1_info_invar_def length_set_of_appr\n        split: option.splits elim!: mem_set_of_appr_appendE)\n  done\nsublocale autoref_op_pat_def op_image_zerofst .\n\nlemma op_image_zerofst_vec_impl[autoref_rules]:\n  \"(\\<lambda>x. (appr_of_ivl ops (replicate E 0) (replicate E 0) @ drop E x), op_image_zerofst_vec::'n vec1 set \\<Rightarrow> _)\n    \\<in> appr_rel \\<rightarrow> appr_rel\"\n  if \"DIM_precond (TYPE('n::enum rvec)) E\"\n  using that\n  apply (auto simp: appr_rel_br set_of_appr_of_ivl_point_append image_image eucl_of_list_prod\n      dest!: brD intro!: brI\n      dest: drop_set_of_apprD[where n=\"CARD('n)\"] cong del: image_cong_simp)\n  subgoal for a b\n    apply (drule set_of_appr_dropD)\n    apply safe\n    apply (rule image_eqI) defer apply assumption\n    apply (auto simp: eucl_of_list_prod)\n    apply (rule eucl_of_list_eq_takeI)\n    apply simp\n    done\n  done\nsublocale autoref_op_pat_def op_image_zerofst_vec .\n\nlemma [autoref_op_pat_def]: \"embed1 ` X \\<equiv> OP op_image_embed1 $ X\"\n  by auto\n\nlemma op_image_embed1_impl[autoref_rules]:\n  assumes \"DIM_precond TYPE((real, 'n::enum) vec) E\"\n  shows \"(\\<lambda>x. x@appr_of_ivl ops (replicate (E*E) 0) (replicate (E*E) 0), op_image_embed1::'n rvec set \\<Rightarrow> _)\n    \\<in> appr_rel \\<rightarrow> appr_rel\"\n  using assms\n  by (force simp: appr_rel_br br_def set_of_appr_of_ivl_point_append set_of_appr_of_ivl_append_point\n      image_image eucl_of_list_prod length_set_of_appr)\nsublocale autoref_op_pat_def op_image_embed1 .\n\nlemma sv_appr1_rel[relator_props]: \"single_valued appr1_rel\"\n  apply (auto simp:  appr1_rel_internal appr_rel_def intro!: relator_props single_valued_union)\n   apply (auto simp: single_valued_def)\n   apply (auto simp: lv_rel_def set_rel_br)\n   apply (auto simp: br_def)\n   apply (rule imageI)\n  apply (metis single_valued_def sv_appr_rell)\n  by (metis imageI single_valued_def sv_appr_rell)\n\nschematic_goal inter_sctn1_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE((real, 'n::enum) vec) E\" \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(Xi, (X::'n eucl1 set)) \\<in> appr1_rel\" \"(hi, h) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n  shows \"(nres_of ?f, inter_sctn1_spec X h) \\<in> \\<langle>appr1_rel \\<times>\\<^sub>r appr1_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding inter_sctn1_spec_def\n  including art\n  by autoref_monadic\nconcrete_definition inter_sctn1_impl for Xi hi uses inter_sctn1_impl\nlemmas [autoref_rules] = inter_sctn1_impl.refine[autoref_higher_order_rule (1 2)]\nsublocale autoref_op_pat_def inter_sctn1_spec .\n\nschematic_goal op_image_fst_coll_nres_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::executable_euclidean_space) E\"\n  assumes [autoref_rules]: \"(XSi, (XS::'n c1_info set)) \\<in> clw_rel appr1_rel\"\n  shows \"(RETURN ?r, op_image_fst_coll_nres XS) \\<in> \\<langle>clw_rel appr_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding op_image_fst_coll_nres_def\n  including art\n  by (autoref_monadic (plain))\nconcrete_definition op_image_fst_coll_nres_impl for XSi uses op_image_fst_coll_nres_impl\nlemmas [autoref_rules] = op_image_fst_coll_nres_impl.refine[autoref_higher_order_rule (1)]\nsublocale autoref_op_pat_def op_image_fst_coll_nres .\n\nlemma [autoref_op_pat]: \"(`) fst \\<equiv> OP op_image_fst_coll\"\n  by auto\nlemma op_image_fst_coll_impl[autoref_rules]:\n  assumes \"DIM_precond TYPE('n::executable_euclidean_space) E\"\n  shows \"(op_image_fst_coll_nres_impl, op_image_fst_coll::_\\<Rightarrow>'n set) \\<in> clw_rel appr1_rel \\<rightarrow> clw_rel appr_rel\"\n  apply rule\n  subgoal premises prems for x\n    using nres_rel_trans2[OF op_image_fst_coll_nres_spec[OF order_refl]\n      op_image_fst_coll_nres_impl.refine[OF assms, simplified, OF prems]]\n    by (auto simp: nres_rel_def RETURN_RES_refine_iff)\n  done\n\nschematic_goal fst_safe_coll_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::executable_euclidean_space) E\"\n  assumes [autoref_rules]: \"(XSi, (XS::'n c1_info set)) \\<in> clw_rel appr1_rel\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  shows \"(nres_of ?r, fst_safe_coll odo XS) \\<in> \\<langle>clw_rel appr_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding fst_safe_coll_def\n  including art\n  by autoref_monadic\nconcrete_definition fst_safe_coll_impl for XSi uses fst_safe_coll_impl\nlemmas [autoref_rules] = fst_safe_coll_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def fst_safe_coll_impl .\n\nlemma [autoref_op_pat]: \"(`) flow1_of_vec1 \\<equiv> OP op_image_flow1_of_vec1_coll\"\n  by auto\n\nlemma op_image_flow1_of_vec1_coll[autoref_rules]:\n  \"(map (\\<lambda>x. (take E x, Some (drop E x))), op_image_flow1_of_vec1_coll::_\\<Rightarrow>'n eucl1 set) \\<in> clw_rel appr_rel \\<rightarrow> clw_rel appr1_rel\"\n  if \"DIM_precond TYPE('n::enum rvec) E\"\n  apply (rule lift_clw_rel_map)\n     apply (rule relator_props)\n  apply (rule relator_props)\n  unfolding op_image_flow1_of_vec1_coll_def op_image_flow1_of_vec1_def[symmetric]\n  apply (rule op_image_flow1_of_vec1)\n  using that\n  by auto\nsublocale autoref_op_pat_def op_image_flow1_of_vec1_coll .\n\nschematic_goal vec1reps_impl:\n  assumes [autoref_rules]: \"(Xi, X) \\<in> clw_rel appr1_rel\"\n  shows \"(RETURN ?r, vec1reps X) \\<in> \\<langle>\\<langle>clw_rel appr_rel\\<rangle>option_rel\\<rangle>nres_rel\"\n  unfolding vec1reps_def\n  including art\n  by (autoref_monadic (plain))\nconcrete_definition vec1reps_impl for Xi uses vec1reps_impl\nlemma vec1reps_impl_refine[autoref_rules]:\n  \"(\\<lambda>x. RETURN (vec1reps_impl x), vec1reps) \\<in> clw_rel appr1_rel \\<rightarrow> \\<langle>\\<langle>clw_rel appr_rel\\<rangle>option_rel\\<rangle>nres_rel\"\n  using vec1reps_impl.refine by force\nsublocale autoref_op_pat_def vec1reps .\n\nabbreviation \"intersection_STATE_rel \\<equiv>\n  (appr1_rel \\<times>\\<^sub>r \\<langle>Id\\<rangle>phantom_rel \\<times>\\<^sub>r clw_rel appr1_rel \\<times>\\<^sub>r clw_rel appr1_rel \\<times>\\<^sub>r\n    clw_rel (\\<langle>appr_rel, \\<langle>lv_rel\\<rangle>sbelows_rel\\<rangle>inter_rel) \\<times>\\<^sub>r bool_rel \\<times>\\<^sub>r bool_rel)\"\n\nlemma print_set_impl1[autoref_rules]:\n  shows \"(\\<lambda>a s. printing_fun optns a (list_of_appr1 s), print_set1) \\<in> bool_rel \\<rightarrow> A \\<rightarrow> Id\"\n  by auto\nsublocale autoref_op_pat_def print_set1 .\n\nlemma trace_set1_impl1[autoref_rules]:\n  shows \"(\\<lambda>s a. tracing_fun optns s (map_option list_of_appr1 a), trace_set1) \\<in> string_rel \\<rightarrow> \\<langle>A\\<rangle>option_rel \\<rightarrow> Id\"\n  by auto\nsublocale autoref_op_pat_def trace_set1 .\n\nlemma print_set_impl1e[autoref_rules]:\n  shows \"(\\<lambda>a s. printing_fun optns a (list_of_appr1e s), print_set1e) \\<in> bool_rel \\<rightarrow> A \\<rightarrow> Id\"\n  by auto\nsublocale autoref_op_pat_def print_set1e .\nlemma trace_set1_impl1e[autoref_rules]:\n  shows \"(\\<lambda>s a. tracing_fun optns s (map_option (list_of_appr1e) a), trace_set1e) \\<in> string_rel \\<rightarrow> \\<langle>A\\<rangle>option_rel \\<rightarrow> Id\"\n  by auto\nsublocale autoref_op_pat_def trace_set1e .\n\nschematic_goal split_spec_param1_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::enum rvec) E\"\n  assumes [autoref_rules]: \"(Xi, X) \\<in> appr1_rel\"\n  notes [autoref_post_simps] = case_prod_eta\n  shows \"(nres_of (?f), split_spec_param1 (X::'a eucl1 set)) \\<in> \\<langle>appr1_rel \\<times>\\<^sub>r appr1_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding split_spec_param1_def\n  including art\n  by autoref_monadic\nconcrete_definition split_spec_param1_impl for Xi uses split_spec_param1_impl\nlemmas split_spec_param1_refine[autoref_rules] =\n  split_spec_param1_impl.refine[autoref_higher_order_rule (1)]\nsublocale autoref_op_pat_def split_spec_param1 .\n\nlemma [autoref_op_pat del]: \"{} \\<equiv> OP op_empty_default\" \"{} \\<equiv> OP op_empty_coll\"\n  and [autoref_op_pat_def del]: \"get_inter p \\<equiv> OP (get_inter p)\"\n  by simp_all\n\nlemma fst_image_c1_info_of_appr:\n  \"c1_info_invar (DIM('a)) X \\<Longrightarrow>\n    (fst ` c1_info_of_appr X::'a::executable_euclidean_space set) = eucl_of_list ` (set_of_appr (fst X))\"\n  apply (auto simp: c1_info_invar_def power2_eq_square image_image flow1_of_list_def\n      c1_info_of_appr_def flow1_of_vec1_def eucl_of_list_prod split: option.splits)\n  subgoal for a b\n    by (rule image_eqI[where x=\"take DIM('a) b\"]) (auto intro!: take_set_of_apprI simp: length_set_of_appr)\n  subgoal for a b\n    apply (frule set_of_appr_ex_append2[where b=a])\n    apply auto\n    subgoal for r\n      by (rule image_eqI[where x=\"b@r\"])\n         (auto intro!: eucl_of_list_eqI dest!: length_set_of_appr)\n    done\n  done\n\nlemma op_image_fst_colle_impl[autoref_rules]:\n  \"(map (\\<lambda>(_, x, _). x), op_image_fst_colle) \\<in> clw_rel appr1e_rel \\<rightarrow> clw_rel appr_rel\"\n  apply (rule fun_relI)\n  unfolding appr_rel_br\n  apply (rule map_mem_clw_rel_br)\n  unfolding appr1_rel_br\n  unfolding scaleR2_rel_br\n  unfolding clw_rel_br\n   apply (auto dest!: brD simp: image_Union split_beta')\n    apply (drule bspec, assumption)\n    apply auto\n    apply (drule bspec, assumption)\n    apply (auto simp: fst_image_c1_info_of_appr)\n   apply (rule bexI) prefer 2 apply assumption\n   apply (auto simp: scaleR2_rel_br scaleR2_def image_def c1_info_of_appr_def\n      split: option.splits)\n  subgoal for a b c d e f g h i\n    apply (rule bexI[where x=\"take DIM('a) i\"])\n    by (auto intro!: take_set_of_apprI simp: flow1_of_list_def eucl_of_list_prod c1_info_invar_def\n        length_set_of_appr)\n  subgoal\n    by (auto intro!: take_set_of_apprI simp: flow1_of_vec1_def eucl_of_list_prod\n        length_set_of_appr c1_info_invar_def)\n  done\nsublocale autoref_op_pat_def op_image_fst_colle .\n\nlemma is_empty_appr1_rel[autoref_rules]:\n  \"(\\<lambda>_. False, is_empty) \\<in> appr1_rel \\<rightarrow> bool_rel\"\n  by (auto simp: appr1_rel_internal set_rel_br) (auto simp: appr_rel_br br_def)\nsublocale autoref_op_pat_def is_empty .\n\nschematic_goal split_spec_param1e_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::enum rvec) E\"\n  assumes [autoref_rules]: \"(Xi, X) \\<in> \\<langle>appr1_rel\\<rangle>scaleR2_rel\"\n  notes [autoref_post_simps] = case_prod_eta\n  shows \"(nres_of (?f), split_spec_param1e (X::'a eucl1 set)) \\<in>\n    \\<langle>\\<langle>appr1_rel\\<rangle>scaleR2_rel \\<times>\\<^sub>r \\<langle>appr1_rel\\<rangle>scaleR2_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding split_spec_param1e_def\n  including art\n  by autoref_monadic\nconcrete_definition split_spec_param1e_impl for Xi uses split_spec_param1e_impl\nlemmas split_spec_param1e_refine[autoref_rules] =\n  split_spec_param1e_impl.refine[autoref_higher_order_rule (1)]\nsublocale autoref_op_pat_def split_spec_param1e .\n\nschematic_goal reduce_spec1_impl:\n  \"(nres_of ?r, reduce_spec1 C X) \\<in> \\<langle>appr1_rel\\<rangle>nres_rel\"\n  if [autoref_rules_raw]: \"DIM_precond TYPE((real, 'n::enum) vec) E\"\n    and [autoref_rules]: \"(Xi, X::'n eucl1 set) \\<in> appr1_rel\" \"(Ci, C) \\<in> reduce_argument_rel TYPE('b)\"\n  unfolding reduce_spec1_def\n  including art\n  by autoref_monadic\nconcrete_definition reduce_spec1_impl for Ci Xi uses reduce_spec1_impl\nlemmas reduce_spec1_impl_refine[autoref_rules] = reduce_spec1_impl.refine[autoref_higher_order_rule (1)]\nsublocale autoref_op_pat_def reduce_spec1 .\n\nschematic_goal reduce_spec1e_impl:\n  \"(nres_of ?r, reduce_spec1e C X) \\<in> \\<langle>\\<langle>appr1_rel\\<rangle>scaleR2_rel\\<rangle>nres_rel\"\n  if [autoref_rules_raw]: \"DIM_precond TYPE((real, 'n::enum) vec) E\"\n  and [autoref_rules]: \"(Xi, X::'n eucl1 set) \\<in> \\<langle>appr1_rel\\<rangle>scaleR2_rel\" \"(Ci, C) \\<in> reduce_argument_rel TYPE('b)\"\n  unfolding reduce_spec1e_def\n  including art\n  by autoref_monadic\nconcrete_definition reduce_spec1e_impl for Ci Xi uses reduce_spec1e_impl\nlemmas reduce_spec1e_impl_refine[autoref_rules] =\n  reduce_spec1e_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def reduce_spec1e .\n\nlemma eq_spec_impl[autoref_rules]:\n  \"(\\<lambda>a b. RETURN (a = b), eq_spec) \\<in> A \\<rightarrow> A \\<rightarrow> \\<langle>bool_rel\\<rangle>nres_rel\"\n  if \"PREFER single_valued A\"\n  using that by (auto simp: nres_rel_def single_valued_def)\n\nschematic_goal select_with_inter_impl:\n  assumes [relator_props]: \"single_valued A\" \"single_valued P\"\n  assumes [autoref_rules]: \"(ci, c) \\<in> clw_rel (\\<langle>A, P\\<rangle>inter_rel)\" \"(ai, a) \\<in> clw_rel A\"\n  shows \"(RETURN ?r, select_with_inter $ c $ a) \\<in> \\<langle>clw_rel (\\<langle>A, P\\<rangle>inter_rel)\\<rangle>nres_rel\"\n  unfolding select_with_inter_def\n  including art\n  by (autoref_monadic (plain))\nconcrete_definition select_with_inter_impl for ci ai uses select_with_inter_impl\nlemmas [autoref_rules] = select_with_inter_impl.refine[OF PREFER_sv_D PREFER_sv_D]\nsublocale autoref_op_pat_def select_with_inter .\n\nschematic_goal choose_step1e_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE((real, 'n::enum) vec) E\"\n    \"ncc_precond TYPE('n vec1)\"\n    \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules]: \"(Xi, X::'n eucl1 set) \\<in> appr1e_rel\" \"(hi, h) \\<in> rnv_rel\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  shows \"(nres_of ?r, choose_step1e odo X h) \\<in> \\<langle>rnv_rel \\<times>\\<^sub>r appr1_rel \\<times>\\<^sub>r appr_rel \\<times>\\<^sub>r appr1e_rel\\<rangle>nres_rel\"\n  unfolding choose_step1e_def\n  including art\n  by autoref_monadic\nconcrete_definition choose_step1e_impl for Xi hi uses choose_step1e_impl\nlemmas [autoref_rules] = choose_step1e_impl.refine[autoref_higher_order_rule (1 2 3)]\nsublocale autoref_op_pat_def choose_step1e .\n\nlemma pre_split_reduce_impl[autoref_rules]:\n  \"(\\<lambda>ro. RETURN (pre_split_reduce ro), pre_split_reduce_spec) \\<in> reach_optns_rel \\<rightarrow> \\<langle>reduce_argument_rel TYPE('b)\\<rangle>nres_rel\"\n  by (auto simp: pre_split_reduce_spec_def nres_rel_def reduce_argument_rel_def RETURN_RES_refine)\n\nschematic_goal step_split_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules]: \"(Xi, X::'n eucl1 set) \\<in> appr1e_rel\"\n    and [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n  shows \"(nres_of (?f), step_split odo ro X)\\<in>\\<langle>clw_rel appr1e_rel\\<rangle>nres_rel\"\n  using assms\n  unfolding step_split_def[abs_def]\n  including art\n  by autoref_monadic\nconcrete_definition step_split_impl for odoi Xi uses step_split_impl\nlemmas [autoref_rules] = step_split_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def step_split .\n\nschematic_goal width_spec_appr1_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules]: \"(Xi, X::'n eucl1 set) \\<in> appr1_rel\"\n  shows \"(?r, width_spec_appr1 X) \\<in> \\<langle>rnv_rel\\<rangle>nres_rel\"\n  unfolding width_spec_appr1_def\n  by autoref_monadic\nconcrete_definition width_spec_appr1_impl for Xi uses width_spec_appr1_impl\nlemmas width_spec_appr1_impl_refine[autoref_rules] =\n  width_spec_appr1_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def width_spec_appr1 .\n\nschematic_goal split_under_threshold_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE((real, 'n::enum) vec) E\"\n  assumes [autoref_rules]: \"(thi, th) \\<in> rnv_rel\" \"(Xi, X) \\<in> clw_rel (\\<langle>appr1_rel\\<rangle>scaleR2_rel)\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n  shows \"(nres_of ?x, split_under_threshold ro th (X::'n eucl1 set)) \\<in> \\<langle>clw_rel (\\<langle>appr1_rel\\<rangle>scaleR2_rel)\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding split_under_threshold_def\n  by autoref_monadic\nconcrete_definition split_under_threshold_impl for thi Xi uses split_under_threshold_impl\nlemmas [autoref_rules] = split_under_threshold_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def split_under_threshold .\n\nschematic_goal pre_intersection_step_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules]:\n    \"(Xi, X::'n eucl1 set) \\<in> appr1e_rel\"\n    \"(hi, (h::real)) \\<in> rnv_rel\"\n    and [autoref_rules]: \"(roptnsi, roptns) \\<in> reach_optns_rel\"\n    \"(odoi, odo) \\<in> ode_ops_rel\"\n  shows \"(nres_of ?r, pre_intersection_step odo roptns X h) \\<in>\n    \\<langle>clw_rel (iinfo_rel appr1e_rel) \\<times>\\<^sub>r clw_rel appr_rel \\<times>\\<^sub>r clw_rel (iinfo_rel appr1e_rel)\\<rangle>nres_rel\"\n  unfolding pre_intersection_step_def\n  including art\n  by autoref_monadic\nconcrete_definition pre_intersection_step_impl for roptnsi Xi hi uses pre_intersection_step_impl\nlemmas [autoref_rules] = pre_intersection_step_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def pre_intersection_step .\n\nschematic_goal subset_spec_plane_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('a) E\"\n  assumes [autoref_rules]: \"(Xi, X::'a::executable_euclidean_space set) \\<in> lvivl_rel\" \"(sctni, sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n  shows \"(nres_of ?R, subset_spec_plane X sctn) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding subset_spec_plane_def\n  by autoref_monadic\nconcrete_definition subset_spec_plane_impl for Xi sctni uses subset_spec_plane_impl\nlemmas [autoref_rules] = subset_spec_plane_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def subset_spec_plane .\n\nschematic_goal op_eventually_within_sctn_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n  assumes [autoref_rules]: \"(Xi, X::'a set) \\<in> appr_rel\" \"(sctni, sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\" \"(Si, S) \\<in> lvivl_rel\"\n  shows \"(nres_of ?R, op_eventually_within_sctn X sctn S) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding op_eventually_within_sctn_def\n  including art\n  by autoref_monadic\nconcrete_definition op_eventually_within_sctn_impl for Xi sctni Si uses op_eventually_within_sctn_impl\nlemmas [autoref_rules] = op_eventually_within_sctn_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def op_eventually_within_sctn .\n\nschematic_goal nonzero_component_within_impl:\n  \"(nres_of ?r, nonzero_component_within odo ivl sctn (PDP::'n eucl1 set)) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  if [autoref_rules_raw]: \"DIM_precond TYPE((real, 'n::enum) vec) E\"\n  and [autoref_rules]:\n    \"(ivli, ivl) \\<in> lvivl_rel\"\n    \"(sctni, sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n    \"(PDPi, PDP) \\<in> appr1_rel\"\n    \"(odoi, odo) \\<in> ode_ops_rel\"\n  unfolding nonzero_component_within_def\n  including art\n  by autoref_monadic\nconcrete_definition nonzero_component_within_impl uses nonzero_component_within_impl\nlemmas [autoref_rules] = nonzero_component_within_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def nonzero_component_within .\n\nschematic_goal disjoints_spec_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules]: \"(Xi, (X::'n::enum rvec set)) \\<in> clw_rel appr_rel\" \"(Yi, (Y::'n rvec set)) \\<in> clw_rel lvivl_rel\"\n  shows \"(nres_of ?f, disjoints_spec X Y) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding disjoints_spec_def op_coll_is_empty_def[symmetric]\n  including art\n  by autoref_monadic\nconcrete_definition disjoints_spec_impl for Xi Yi uses disjoints_spec_impl\nlemmas [autoref_rules] = disjoints_spec_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def disjoints_spec .\n\nschematic_goal do_intersection_body_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(hi, h) \\<in> rnv_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> clw_rel lvivl_rel\"\n    and civl[autoref_rules]: \"(ivli, ivl::'n rvec set) \\<in> lvivl_rel\"\n    and csctns[autoref_rules]: \"(sctni, sctn::'n rvec sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n  and [autoref_rules]: \"(STATEi, STATE) \\<in> intersection_STATE_rel\"\n  notes [intro, simp] = list_set_rel_finiteD closed_ivl_rel[OF civl]\n  shows \"(nres_of ?f, do_intersection_body odo guards ivl sctn h STATE) \\<in> \\<langle>intersection_STATE_rel\\<rangle>nres_rel\"\n  unfolding do_intersection_body_def\n  by autoref_monadic\nconcrete_definition do_intersection_body_impl for odoi guardsi ivli sctni hi STATEi uses do_intersection_body_impl\nlemmas do_intersection_body_impl_refine[autoref_rules] =\n  do_intersection_body_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def do_intersection_body .\n\nschematic_goal do_intersection_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(Xi, X) \\<in> appr1_rel\" \"(hi, h) \\<in> rnv_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> clw_rel (\\<langle>lvivl_rel, \\<langle>lv_rel\\<rangle>plane_rel\\<rangle>inter_rel)\"\n    and civl[autoref_rules]: \"(ivli, ivl::'n rvec set) \\<in> lvivl_rel\"\n    and csctns[autoref_rules]: \"(sctni, sctn::'n rvec sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n  notes [intro, simp] = list_set_rel_finiteD closed_ivl_rel[OF civl]\n  shows \"(nres_of ?f, do_intersection odo guards ivl sctn (X::'n eucl1 set) h)\\<in>\n    \\<langle>bool_rel \\<times>\\<^sub>r clw_rel appr1_rel \\<times>\\<^sub>r clw_rel appr1_rel \\<times>\\<^sub>r\n      clw_rel (\\<langle>appr_rel, \\<langle>lv_rel\\<rangle>sbelows_rel\\<rangle>inter_rel)\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding do_intersection_def\n  including art\n  by autoref_monadic\nconcrete_definition do_intersection_impl for odoi guardsi ivli sctni Xi hi uses do_intersection_impl\nlemmas do_intersection_impl_refine[autoref_rules] =\n  do_intersection_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def do_intersection .\n\nschematic_goal tolerate_error1_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) dd\"\n  assumes [autoref_rules]: \"(Yi, Y::'n eucl1 set) \\<in> appr1e_rel\"\n  assumes [autoref_rules]: \"(Ei, E) \\<in> appr1_rel\"\n  shows \"(nres_of ?r, tolerate_error1 Y E) \\<in> \\<langle>bool_rel \\<times>\\<^sub>r rnv_rel\\<rangle>nres_rel\"\n  unfolding tolerate_error1_def\n  including art\n  by autoref_monadic\nconcrete_definition tolerate_error1_impl for dd Yi Ei uses tolerate_error1_impl\nlemmas tolerate_error1_refine[autoref_rules] = tolerate_error1_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def tolerate_error1 .\n\nlemma lower_impl[autoref_rules]: \"(lower, lower) \\<in> Id \\<rightarrow> Id\"\n  and upper_impl[autoref_rules]: \"(lower, lower) \\<in> Id \\<rightarrow> Id\"\n  by auto\n\nschematic_goal step_adapt_time_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]:\n    \"(hi, h) \\<in> rnv_rel\"\n    \"(Xi, X::'n eucl1 set) \\<in> (appr1e_rel)\"\n  shows \"(nres_of ?f, step_adapt_time odo X h)\\<in>\\<langle>rnv_rel \\<times>\\<^sub>r appr_rel \\<times>\\<^sub>r appr1e_rel \\<times>\\<^sub>r rnv_rel\\<rangle>nres_rel\"\n  unfolding step_adapt_time_def[abs_def]\n  including art\n  by autoref_monadic\nconcrete_definition step_adapt_time_impl for Xi hi uses step_adapt_time_impl\nlemmas [autoref_rules] = step_adapt_time_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def step_adapt_time .\n\n\nschematic_goal resolve_step_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]:\n    \"(hi, h) \\<in> rnv_rel\"\n    \"(Xi, X::'n eucl1 set) \\<in> (appr1e_rel)\"\n    \"(roptnsi, roptns) \\<in> reach_optns_rel\"\n  shows \"(nres_of ?f, resolve_step odo roptns X h)\\<in>\\<langle>rnv_rel \\<times>\\<^sub>r clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r rnv_rel\\<rangle>nres_rel\"\n  unfolding resolve_step_def[abs_def]\n  including art\n  by autoref_monadic\nconcrete_definition resolve_step_impl for roptnsi Xi hi uses resolve_step_impl\nlemmas [autoref_rules] = resolve_step_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def resolve_step .\n\nsublocale autoref_op_pat_def fst_safe_coll .\n\nschematic_goal reach_cont_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]:\n    \"(XSi, XS) \\<in> clw_rel appr1e_rel\"\n    \"(guardsi, guards::'n rvec set) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and [autoref_rules]: \"(roptnsi, roptns) \\<in> reach_optns_rel\"\n  notes [relator_props, autoref_rules_raw] = sv_appr1_rel\n  shows \"(nres_of (?f::?'f dres), reach_cont odo roptns guards XS)\\<in>?R\"\n  unfolding autoref_tag_defs\n  unfolding reach_cont_def\n  including art\n  by autoref_monadic\nconcrete_definition reach_cont_impl for guardsi XSi uses reach_cont_impl\nlemmas reach_cont_ho[autoref_rules] = reach_cont_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def reach_cont .\n\nschematic_goal reach_cont_par_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]:\n    \"(XSi, XS) \\<in> clw_rel appr1e_rel\"\n    \"(guardsi, guards::'n rvec set) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and [autoref_rules]: \"(roptnsi, roptns) \\<in> reach_optns_rel\"\n  shows \"(nres_of (?f::?'f dres), reach_cont_par odo roptns guards XS)\\<in>?R\"\n  unfolding autoref_tag_defs\n  unfolding reach_cont_par_def\n  including art\n  by autoref_monadic\nconcrete_definition reach_cont_par_impl for roptnsi guardsi XSi uses reach_cont_par_impl\nlemmas reach_cont_par_impl_refine[autoref_rules] = reach_cont_par_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def reach_cont_par .\n\nschematic_goal subset_iplane_coll_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n  assumes [autoref_rules]: \"(xi, x::'a set) \\<in> iplane_rel lvivl_rel\"\n  assumes [autoref_rules]: \"(icsi, ics) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n  shows \"(nres_of ?r, subset_iplane_coll x ics) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding subset_iplane_coll_def\n  including art\n  by autoref_monadic\nconcrete_definition subset_iplane_coll_impl uses subset_iplane_coll_impl\nlemmas subset_iplane_coll_impl_refine[autoref_rules] = subset_iplane_coll_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def subset_iplane_coll .\n\n\nschematic_goal subsets_iplane_coll_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n  assumes [autoref_rules]: \"(xi, x::'a set set) \\<in> \\<langle>iplane_rel lvivl_rel\\<rangle>list_wset_rel\"\n  assumes [autoref_rules]: \"(icsi, ics) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n  shows \"(nres_of ?r, subsets_iplane_coll x ics) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding subsets_iplane_coll_def\n  including art\n  by autoref_monadic\nconcrete_definition subsets_iplane_coll_impl uses subsets_iplane_coll_impl\nlemmas [autoref_rules] = subsets_iplane_coll_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def subsets_iplane_coll .\n\n\nschematic_goal symstart_coll_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(XSi, XS::'n eucl1 set) \\<in> clw_rel appr1e_rel\"\n  assumes [autoref_rules]: \"(symstarti, symstart::'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set)nres)\n    \\<in> appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  assumes [unfolded autoref_tag_defs, refine_transfer]: \"\\<And>X. TRANSFER (nres_of (symstartd X) \\<le> symstarti X)\"\n  shows \"(nres_of ?r, symstart_coll $ odo $ symstart $ XS) \\<in> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  unfolding symstart_coll_def\n  including art\n  by autoref_monadic\nconcrete_definition symstart_coll_impl for symstartd XSi uses symstart_coll_impl\nlemmas [autoref_rules] = symstart_coll_impl.refine\nsublocale autoref_op_pat_def symstart_coll .\n\nschematic_goal reach_cont_symstart_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]:\n    \"(XSi, XS::'n eucl1 set) \\<in> clw_rel appr1e_rel\"\n    \"(guardsi, guards::'n rvec set) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    \"(roptnsi, roptns) \\<in> reach_optns_rel\"\n  assumes [autoref_rules]: \"(symstarti, symstart::'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set)nres)\n    \\<in> appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  assumes [unfolded autoref_tag_defs, refine_transfer]: \"\\<And>X. TRANSFER (nres_of (symstartd X) \\<le> symstarti X)\"\n  shows \"(nres_of (?r), reach_cont_symstart $ odo $ roptns $ symstart $ guards $ XS) \\<in>\n  \\<langle>clw_rel appr_rel \\<times>\\<^sub>r\n    clw_rel (\\<langle>iplane_rel lvivl_rel::(_ \\<times> 'n rvec set)set, iinfo_rel appr1e_rel\\<rangle>info_rel)\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding reach_cont_symstart_def Let_def\n  including art\n  by autoref_monadic\nconcrete_definition reach_cont_symstart_impl for roptnsi symstartd XSi uses reach_cont_symstart_impl\nlemmas [autoref_rules] = reach_cont_symstart_impl.refine\nsublocale autoref_op_pat_def reach_cont_symstart .\n\nlemma sv_reach_conts_impl_aux:\n  \"single_valued (clw_rel (iinfo_rel appr1e_rel))\" by (auto intro!: relator_props)\n\nschematic_goal reach_conts_impl:\n  assumes [autoref_rules]: \"(symstarti, symstart::'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set)nres)\n    \\<in> appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]:\n    \"(XSi, XS) \\<in> clw_rel appr1e_rel\"\n    \"(guardsi, guards::'n rvec set) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and [autoref_rules]: \"(roptnsi, roptns) \\<in> reach_optns_rel\"\n  notes [simp] = list_wset_rel_finite[OF sv_reach_conts_impl_aux]\n    assumes \"(trapi, trap) \\<in> ghost_rel\"\n  assumes [unfolded autoref_tag_defs, refine_transfer]: \"\\<And>X. TRANSFER (nres_of (symstartd X) \\<le> symstarti X)\"\n  shows \"(nres_of (?f::?'f dres), reach_conts $ odo $ roptns $ symstart $ trap $ guards $ XS)\\<in>?R\"\n  unfolding autoref_tag_defs\n  unfolding reach_conts_def\n  including art\n  by autoref_monadic\nconcrete_definition reach_conts_impl for odoi guardsi XSi uses reach_conts_impl\nlemmas [autoref_rules] = reach_conts_impl.refine\nsublocale autoref_op_pat_def reach_conts .\n\nlemma get_sctns_autoref[autoref_rules]:\n  \"(\\<lambda>x. RETURN x, get_sctns) \\<in> \\<langle>R\\<rangle>halfspaces_rel \\<rightarrow> \\<langle>\\<langle>\\<langle>R\\<rangle>sctn_rel\\<rangle>list_set_rel\\<rangle>nres_rel\"\n  by (auto simp: get_sctns_def nres_rel_def halfspaces_rel_def br_def intro!: RETURN_SPEC_refine)\nsublocale autoref_op_pat_def get_sctns .\n\nschematic_goal leaves_halfspace_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes nccp[autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  notes [simp] = ncc_precondD[OF nccp]\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(Si, S) \\<in> \\<langle>lv_rel\\<rangle>halfspaces_rel\"\n  assumes [autoref_rules]: \"(Xi, X::'n rvec set) \\<in> clw_rel appr_rel\"\n  shows \"(nres_of ?r, leaves_halfspace $ odo $ S $ X) \\<in> \\<langle>\\<langle>\\<langle>lv_rel\\<rangle>sctn_rel\\<rangle>option_rel\\<rangle>nres_rel\"\n  unfolding leaves_halfspace_def\n  including art\n  by autoref_monadic\nconcrete_definition leaves_halfspace_impl for Si Xi uses leaves_halfspace_impl\nlemmas [autoref_rules] = leaves_halfspace_impl.refine\nsublocale autoref_op_pat_def leaves_halfspace .\n\nschematic_goal poincare_start_on_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes ncc2[autoref_rules_raw]: \"ncc_precond TYPE('n::enum rvec)\"\n  assumes ncc2[autoref_rules_raw]: \"ncc_precond TYPE('n::enum vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]:\n    \"(sctni, sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n    \"(guardsi, guards) \\<in> clw_rel lvivl_rel\"\n    \"(X0i, X0::'n eucl1 set) \\<in> clw_rel (appr1e_rel)\"\n  shows \"(nres_of (?f), poincare_start_on $ odo $ guards $ sctn $ X0) \\<in>\n      \\<langle>clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding poincare_start_on_def\n  including art\n  by autoref_monadic\nconcrete_definition poincare_start_on_impl for guardsi sctni X0i uses poincare_start_on_impl\nlemmas [autoref_rules] = poincare_start_on_impl.refine\nsublocale autoref_op_pat_def poincare_start_on .\n\nlemma isets_of_iivls[autoref_rules]:\n  assumes \"PREFER single_valued A\"\n  assumes le[THEN GEN_OP_D, param_fo]: \"GEN_OP le (\\<le>) ((lv_rel::(_ \\<times> 'a::executable_euclidean_space)set) \\<rightarrow> lv_rel \\<rightarrow> bool_rel)\"\n  shows \"(\\<lambda>xs. map (\\<lambda>((i, s), x). (appr_of_ivl ops i s, x)) [((i,s), x) \\<leftarrow> xs. le i s], isets_of_iivls::_\\<Rightarrow>'a set)\n    \\<in> clw_rel (\\<langle>lvivl_rel, A\\<rangle>inter_rel) \\<rightarrow> clw_rel (\\<langle>appr_rel, A\\<rangle>inter_rel)\"\n  apply (rule fun_relI)\n  using assms\n  apply (auto elim!: single_valued_as_brE)\n  unfolding appr_rel_br ivl_rel_br clw_rel_br lvivl_rel_br inter_rel_br\n  apply (auto simp: br_def set_of_ivl_def)\n  subgoal for a b c d e f g\n    apply (rule exI[where x=e])\n    apply (rule exI[where x=f])\n    apply (rule exI[where x=g])\n    apply (rule conjI)\n    apply (assumption)\n    apply (rule conjI)\n    subgoal\n      using transfer_operations1[where 'a='a, of \"eucl_of_list e\" \"eucl_of_list f\" e f]\n        le[of e _ f _, OF lv_relI lv_relI]\n      by (auto simp: appr_rel_br br_def lvivl_rel_br set_of_ivl_def lv_rel_def)\n    subgoal\n      apply (drule bspec, assumption)\n      using transfer_operations1[where 'a='a, of \"eucl_of_list e\" \"eucl_of_list f\" e f]\n        le[of e _ f _, OF lv_relI lv_relI]\n      apply (auto simp: appr_rel_br br_def lvivl_rel_br set_of_ivl_def lv_rel_def)\n      using atLeastAtMost_iff apply blast\n      apply (drule order_trans)\n       apply assumption apply simp\n      done\n    done\n  subgoal for a b c d e f g\n    apply (drule bspec, assumption)\n    using transfer_operations1[where 'a='a, of \"eucl_of_list d\" \"eucl_of_list e\" d e]\n      le[of d _ e _, OF lv_relI lv_relI]\n    by (auto simp: appr_rel_br br_def lvivl_rel_br set_of_ivl_def lv_rel_def intro!: bexI)\n  subgoal for a b c d e f\n    apply (drule bspec, assumption)\n    using transfer_operations1[where 'a='a, of \"eucl_of_list d\" \"eucl_of_list e\" d e]\n      le[of d _ e _, OF lv_relI lv_relI]\n    by (auto simp: appr_rel_br br_def lvivl_rel_br set_of_ivl_def lv_rel_def intro!: bexI)\n  done\nsublocale autoref_op_pat_def isets_of_iivls .\n\nlemma [autoref_op_pat]: \"X \\<times> UNIV \\<equiv> OP op_times_UNIV_coll $ X\" by simp\n\nlemma op_times_UNIV_coll_impl[autoref_rules]: \"(map (\\<lambda>x. (x, None)), op_times_UNIV_coll) \\<in> clw_rel appr_rel \\<rightarrow> clw_rel appr1_rel\"\n  apply (rule lift_clw_rel_map)\n     apply (rule relator_props)\n    apply (rule relator_props)\n  unfolding op_times_UNIV_coll_def op_times_UNIV_def[symmetric]\n   apply (rule op_times_UNIV_impl)\n  by auto\nsublocale autoref_op_pat_def op_times_UNIV_coll .\n\nschematic_goal do_intersection_core_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE((real, 'n::enum) vec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(Xi, X::'n eucl1 set) \\<in> iinfo_rel appr1e_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and csctns[autoref_rules]: \"(sctni, sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n    and csctns[autoref_rules]: \"(ivli, ivl) \\<in> lvivl_rel\"\n  notes [simp] = list_set_rel_finiteD\n  shows \"(nres_of ?f, do_intersection_core odo guards ivl sctn X) \\<in>\n      \\<langle>clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  unfolding do_intersection_core_def[abs_def]\n  including art\n  by autoref_monadic\nconcrete_definition do_intersection_core_impl for guardsi ivli sctni Xi uses do_intersection_core_impl\nsublocale autoref_op_pat_def do_intersection_core .\n\nlemmas do_intersection_core_impl_refine[autoref_rules] =\n  do_intersection_core_impl.refine[autoref_higher_order_rule(1 2 3)]\n\nlemma finite_ra1eicacacslsbicae1lw: \"(xc, x'c) \\<in> \\<langle>\\<langle>rnv_rel, appr1e_rel\\<rangle>info_rel \\<times>\\<^sub>r\n          clw_rel appr1e_rel \\<times>\\<^sub>r\n          clw_rel appr1e_rel \\<times>\\<^sub>r\n          clw_rel\n           (\\<langle>appr_rel,\n            \\<langle>lv_rel\\<rangle>sbelows_rel\\<rangle>inter_rel) \\<times>\\<^sub>r\n          clw_rel appr1e_rel\\<rangle>list_wset_rel \\<Longrightarrow> finite x'c\"\n  for x'c::\"('n::enum eucl1 set * 'n eucl1 set * 'n eucl1 set * 'n rvec set * 'n eucl1 set) set\"\n  apply (rule list_wset_rel_finite)\n  by (auto intro!: relator_props)\n\nschematic_goal do_intersection_coll_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE((real, 'n::enum) vec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(Xi, X::'n eucl1 set) \\<in> clw_rel (iinfo_rel appr1e_rel)\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and csctns[autoref_rules]: \"(sctni, sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n    and csctns[autoref_rules]: \"(ivli, ivl) \\<in> lvivl_rel\"\n  notes [simp] = finite_ra1eicacacslsbicae1lw[where 'n='n]\n  shows \"(nres_of ?f, do_intersection_coll odo guards ivl sctn X) \\<in>\n      \\<langle>clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  unfolding do_intersection_coll_def[abs_def]\n  including art\n  by autoref_monadic\nconcrete_definition do_intersection_coll_impl for guardsi ivli sctni Xi uses do_intersection_coll_impl\nlemmas [autoref_rules] = do_intersection_coll_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def do_intersection_coll .\n\nschematic_goal op_enlarge_ivl_sctn_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n  assumes [autoref_rules]: \"(ivli, ivl::'a set) \\<in> lvivl_rel\" \"(sctni, sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\" \"(di, d) \\<in> rnv_rel\"\n  shows \"(nres_of ?R, op_enlarge_ivl_sctn $ ivl $ sctn $ d) \\<in> \\<langle>lvivl_rel\\<rangle>nres_rel\"\n  unfolding op_enlarge_ivl_sctn_def\n  including art\n  by autoref_monadic\nconcrete_definition op_enlarge_ivl_sctn_impl for ivli sctni di uses op_enlarge_ivl_sctn_impl\nlemmas [autoref_rules] = op_enlarge_ivl_sctn_impl.refine\nsublocale autoref_op_pat_def op_enlarge_ivl_sctn .\n\nschematic_goal resolve_ivlplanes_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(XSi, XS::('n rvec set \\<times> 'n eucl1 set) set) \\<in> \\<langle>iplane_rel lvivl_rel \\<times>\\<^sub>r clw_rel (iinfo_rel appr1e_rel)\\<rangle>list_wset_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and osctns[autoref_rules]: \"(ivlplanesi, ivlplanes) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n  notes [intro, simp] = list_set_rel_finiteD\n  shows \"(nres_of ?r, resolve_ivlplanes odo guards ivlplanes XS) \\<in>\n    \\<langle>\\<langle>clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel \\<times>\\<^sub>r clw_rel (isbelows_rel appr_rel)\\<rangle>list_wset_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding resolve_ivlplanes_def\n  including art\n  by autoref_monadic\nconcrete_definition resolve_ivlplanes_impl for guardsi ivlplanesi XSi uses resolve_ivlplanes_impl\nlemmas [autoref_rules] = resolve_ivlplanes_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def resolve_ivlplanes .\n\nschematic_goal poincare_onto_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(XSi, XS::'n eucl1 set) \\<in> clw_rel appr1e_rel\"\n  assumes [autoref_rules]: \"(CXSi, CXS::'n rvec set) \\<in> clw_rel appr_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and osctns[autoref_rules]: \"(ivlplanesi, ivlplanes) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n  assumes [autoref_rules]: \"((), trap) \\<in> ghost_rel\"\n  assumes [autoref_rules]: \"(symstarti, symstart::'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set)nres)\n    \\<in> appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  assumes [unfolded autoref_tag_defs, refine_transfer]: \"\\<And>X. TRANSFER (nres_of (symstartd X) \\<le> symstarti X)\"\n  notes [intro, simp] = list_set_rel_finiteD\n  shows \"(nres_of ?r, poincare_onto $ odo $ ro $ symstart $ trap $ guards $ ivlplanes $ XS $ CXS) \\<in>\n    \\<langle>\\<langle>clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel\n      \\<times>\\<^sub>r clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding poincare_onto_def\n  including art\n  by autoref_monadic\nconcrete_definition poincare_onto_impl for odoi roi symstarti guardsi ivlplanesi XSi uses poincare_onto_impl\nlemmas [autoref_rules] = poincare_onto_impl.refine[autoref_higher_order_rule]\nsublocale autoref_op_pat_def poincare_onto .\n\nschematic_goal empty_remainders_impl:\n  assumes [autoref_rules]:\n    \"(PSi, PS) \\<in> \\<langle>clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel\n            \\<times>\\<^sub>r clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\"\n  shows \"(nres_of ?r, empty_remainders PS) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding empty_remainders_def\n  including art\n  by autoref_monadic\nconcrete_definition empty_remainders_impl uses empty_remainders_impl\n\nlemmas empty_remainders_impl_refine[autoref_rules] = empty_remainders_impl.refine[autoref_higher_order_rule]\nsublocale autoref_op_pat_def empty_remainders .\n\nlemma empty_trap_impl[autoref_rules]: \"((), empty_trap) \\<in> ghost_rel\"\n  by (auto intro!: ghost_relI)\nsublocale autoref_op_pat_def empty_trap .\n\nlemma empty_symstart_impl:\\<comment> \\<open>why this? \\<close>\n  \"((\\<lambda>x. nres_of (dRETURN ([], [x]))), empty_symstart) \\<in>\n    appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  unfolding empty_symstart_def\n  using mk_coll[unfolded autoref_tag_defs, OF sv_appr1e_rel[OF sv_appr1_rel], param_fo]\n  by (auto intro!: nres_relI simp:)\nlemma empty_symstart_nres_rel[autoref_rules]:\n  \"((\\<lambda>x. RETURN ([], [x])), empty_symstart::'n::enum eucl1 set\\<Rightarrow>_) \\<in>\n    appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  using mk_coll[OF PREFER_I[of single_valued, OF sv_appr1e_rel[OF sv_appr1_rel]], param_fo, of x y for x and y::\"'n eucl1 set\"]\n  by (auto simp: mk_coll_def[abs_def] nres_rel_def)\nsublocale autoref_op_pat_def empty_symstart .\nlemma empty_symstart_dres_nres_rel:\n  \"((\\<lambda>x. dRETURN ([], [x])), empty_symstart::'n::enum eucl1 set\\<Rightarrow>_) \\<in>\n    (appr1e_rel) \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>dres_nres_rel\"\n  using mk_coll[OF PREFER_I[of single_valued, OF sv_appr1e_rel[OF sv_appr1_rel]], param_fo, of x y for x and y::\"'n eucl1 set\"]\n  by (auto simp: mk_coll_def[abs_def] dres_nres_rel_def)\n\n\nschematic_goal poincare_onto_empty_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(XSi, XS::'n eucl1 set) \\<in> clw_rel appr1e_rel\"\n  assumes [autoref_rules]: \"(CXSi, CXS::'n rvec set) \\<in> clw_rel appr_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and osctns[autoref_rules]: \"(ivlplanesi, ivlplanes) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n  notes [intro, simp] = list_set_rel_finiteD\n  shows \"(nres_of (?r), poincare_onto_empty odo ro guards ivlplanes XS CXS) \\<in>\n    \\<langle>\\<langle>clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel\n      \\<times>\\<^sub>r clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding poincare_onto_empty_def\n  including art\n  apply (rule autoref_monadicI)\n   apply (autoref phases: id_op rel_inf fix_rel)\\<comment> \\<open>TODO: what is going wrong here?\\<close>\n  apply (simp only: autoref_tag_defs)\n   apply (rule poincare_onto_impl.refine[unfolded autoref_tag_defs])\n            apply fact+\n     apply (rule ghost_relI)\n    apply (rule empty_symstart_impl)\n   apply refine_transfer\n  apply refine_transfer\n  done\n\nconcrete_definition poincare_onto_empty_impl for guardsi XSi CXSi uses poincare_onto_empty_impl\nlemmas [autoref_rules] = poincare_onto_empty_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def poincare_onto_empty .\n\nlemma sv_thingy: \"single_valued (clw_rel appr1e_rel \\<times>\\<^sub>r\n          clw_rel appr1e_rel \\<times>\\<^sub>r\n          clw_rel appr1e_rel \\<times>\\<^sub>r\n          clw_rel appr1e_rel \\<times>\\<^sub>r\n          \\<langle>lv_rel\\<rangle>ivl_rel \\<times>\\<^sub>r\n          \\<langle>lv_rel\\<rangle>sctn_rel \\<times>\\<^sub>r\n          clw_rel\n           (\\<langle>appr_rel,\n            \\<langle>lv_rel\\<rangle>sbelows_rel\\<rangle>inter_rel) \\<times>\\<^sub>r\n          clw_rel appr_rel)\"\n  by (intro relator_props)\n\nschematic_goal poincare_onto2_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(symstarti, symstart::'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set)nres)\n    \\<in> appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  assumes [unfolded autoref_tag_defs, refine_transfer]: \"\\<And>X. TRANSFER (nres_of (symstartd X) \\<le> symstarti X)\"\n  assumes [autoref_rules]: \"(XSi, XS::'n eucl1 set) \\<in> clw_rel appr1e_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and osctns[autoref_rules]: \"(ivlplanesi, ivlplanes) \\<in> clw_rel (iplane_rel lvivl_rel)\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n  assumes [autoref_rules]: \"((), trap) \\<in> ghost_rel\"\n  notes [intro, simp] = list_set_rel_finiteD list_wset_rel_finite[OF sv_thingy]\n  shows \"(nres_of (?r), poincare_onto2 $ odo $ ro $ symstart $ trap $ guards $ ivlplanes $ XS) \\<in>\n    \\<langle>\\<langle>bool_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel \\<times>\\<^sub>r\n      clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding poincare_onto2_def\n    including art\n  by autoref_monadic\nconcrete_definition poincare_onto2_impl for odoi guardsi XSi uses poincare_onto2_impl\nlemmas [autoref_rules] = poincare_onto2_impl.refine\nsublocale autoref_op_pat_def poincare_onto2 .\n\nschematic_goal width_spec_ivl_impl:\n  assumes [autoref_rules]: \"(Mi, M) \\<in> nat_rel\" \"(xi, x) \\<in> lvivl_rel\"\n  shows \"(RETURN ?r, width_spec_ivl M x) \\<in> \\<langle>rnv_rel\\<rangle>nres_rel\"\n  unfolding width_spec_ivl_def\n  including art\n  by (autoref_monadic (plain))\nconcrete_definition width_spec_ivl_impl for Mi xi uses width_spec_ivl_impl\n\nlemmas width_spec_ivl_impl_refine[autoref_rules]\n  = width_spec_ivl_impl.refine[autoref_higher_order_rule]\nsublocale autoref_op_pat_def width_spec_ivl .\n\nschematic_goal partition_ivl_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('a::executable_euclidean_space) E\"\n  assumes [autoref_rules]: \"(xsi, xs::'a set)\\<in> clw_rel lvivl_rel\" \"(roi, ro) \\<in> reach_optns_rel\"\n  shows \"(nres_of (?f), partition_ivl ro xs)\\<in>\\<langle>clw_rel lvivl_rel\\<rangle>nres_rel\"\n  unfolding partition_ivl_def[abs_def]\n  including art\n  by autoref_monadic\nconcrete_definition partition_ivl_impl for roi xsi uses partition_ivl_impl\nlemmas [autoref_rules] = partition_ivl_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def partition_ivl .\n\nschematic_goal vec1repse_impl:\n  assumes [autoref_rules]: \"(Xi, X) \\<in> clw_rel appr1e_rel\"\n  shows \"(nres_of ?r, vec1repse X) \\<in> \\<langle>\\<langle>clw_rel appre_rel\\<rangle>option_rel\\<rangle>nres_rel\"\n  unfolding vec1repse_def\n  including art\n  by autoref_monadic\nconcrete_definition vec1repse_impl for Xi uses vec1repse_impl\nlemmas vec1repse_impl_refine[autoref_rules] = vec1repse_impl.refine[autoref_higher_order_rule]\nsublocale autoref_op_pat_def vec1repse .\n\nschematic_goal scaleR2_rep1_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules]: \"(Yi, Y::'n vec1 set) \\<in> appre_rel\"\n  shows \"(nres_of ?r, scaleR2_rep1 Y) \\<in> \\<langle>elvivl_rel\\<rangle>nres_rel\"\n  unfolding scaleR2_rep1_def\n  including art\n  by autoref_monadic\nconcrete_definition scaleR2_rep1_impl uses scaleR2_rep1_impl\nlemmas [autoref_rules] = scaleR2_rep1_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def scaleR2_rep1 .\n\nschematic_goal ivlse_of_setse_impl:\n  \"(nres_of ?r, ivlse_of_setse X) \\<in> \\<langle>clw_rel elvivl_rel\\<rangle>nres_rel\"\n  if [autoref_rules_raw]:\"DIM_precond TYPE('n::enum rvec) E\"\n    and [autoref_rules]: \"(Xi, X::'n vec1 set) \\<in> clw_rel (appre_rel)\"\n  unfolding ivlse_of_setse_def\n  including art\n  by autoref_monadic\nconcrete_definition ivlse_of_setse_impl uses ivlse_of_setse_impl\nlemmas [autoref_rules] = ivlse_of_setse_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def ivlse_of_setse .\n\nschematic_goal setse_of_ivlse_impl:\n  \"(nres_of ?r, setse_of_ivlse X) \\<in> \\<langle>clw_rel (appre_rel)\\<rangle>nres_rel\"\n  if [autoref_rules]: \"(Xi, X) \\<in> clw_rel elvivl_rel\"\n  unfolding setse_of_ivlse_def\n  including art\n  by autoref_monadic\nconcrete_definition setse_of_ivlse_impl uses setse_of_ivlse_impl\nlemmas setse_of_ivlse_impl_refine[autoref_rules] =\n  setse_of_ivlse_impl.refine[autoref_higher_order_rule]\nsublocale autoref_op_pat_def setse_of_ivlse .\n\nlemma op_image_flow1_of_vec1_colle[autoref_rules]:\n  \"(map (\\<lambda>(lu, x). (lu, (take E x, Some (drop E x)))), op_image_flow1_of_vec1_colle::_\\<Rightarrow>'n eucl1 set) \\<in> clw_rel appre_rel \\<rightarrow> clw_rel appr1e_rel\"\n  if \"DIM_precond TYPE('n::enum rvec) E\"\n  apply (rule lift_clw_rel_map)\n     apply (rule relator_props)\n     apply (rule relator_props)\n    apply (rule relator_props)\n    apply (rule relator_props)\n    apply (rule lift_scaleR2)\n  unfolding op_image_flow1_of_vec1_colle_def op_image_flow1_of_vec1_coll_def op_image_flow1_of_vec1_def[symmetric]\n    apply (rule op_image_flow1_of_vec1)\n  using that\n  subgoal by force\n  subgoal for l u x\n    unfolding op_image_flow1_of_vec1_def flow1_of_vec1_def scaleR2_def\n    apply (auto simp: image_def vimage_def)\n    subgoal for a b c d e\n      apply (rule exI[where x=\"c *\\<^sub>R e\"])\n      apply (auto simp: blinfun_of_vmatrix_scaleR)\n      apply (rule exI[where x=\"c\"])\n      apply auto\n      apply (rule bexI) prefer 2 apply assumption\n      apply auto\n      done\n    subgoal for a b c d e\n      apply (rule exI[where x=\"c\"])\n      apply (auto simp: blinfun_of_vmatrix_scaleR)\n      apply (rule exI[where x=\"blinfun_of_vmatrix e\"])\n      apply auto\n      apply (rule bexI) prefer 2 apply assumption\n      apply auto\n      done\n    done\n  subgoal by auto\n  done\nsublocale autoref_op_pat_def op_image_flow1_of_vec1_colle .\n\nschematic_goal okay_granularity_impl:\n  assumes [autoref_rules]: \"(ivli,ivl::'n::enum vec1 set)\\<in> lvivl_rel\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n  shows \"(nres_of ?f, okay_granularity ro ivl) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding okay_granularity_def[abs_def]\n  including art\n  by autoref_monadic\nconcrete_definition okay_granularity_impl for roi ivli uses okay_granularity_impl\nlemmas [autoref_rules] = okay_granularity_impl.refine[autoref_higher_order_rule]\nsublocale autoref_op_pat_def okay_granularity .\n\nlemma le_post_inter_granularity_op[autoref_rules]:\n  \"(\\<lambda>roi (ls, us). RETURN (width_appr ops optns (appr_of_ivl ops ls us) \\<le> post_inter_granularity roi),\n    (le_post_inter_granularity_op::_\\<Rightarrow>'a::executable_euclidean_space set\\<Rightarrow>_)) \\<in>\n    (reach_optns_rel \\<rightarrow> lvivl_rel \\<rightarrow> \\<langle>bool_rel\\<rangle>nres_rel)\"\n  by (auto simp: nres_rel_def le_post_inter_granularity_op_def)\nsublocale autoref_op_pat_def le_post_inter_granularity_op .\n\nschematic_goal partition_set_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules]: \"(xsi,xs::'n eucl1 set)\\<in> clw_rel appr1e_rel\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n  shows \"(nres_of (?f), partition_set ro xs) \\<in> \\<langle>clw_rel appr1e_rel\\<rangle>nres_rel\"\n  unfolding partition_set_def\n  including art\n  by autoref_monadic\n\nconcrete_definition partition_set_impl for roi xsi uses partition_set_impl\nlemmas [autoref_rules] = partition_set_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def partition_set .\n\nschematic_goal partition_sets_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules]: \"(xsi,xs::(bool \\<times> 'n eucl1 set \\<times> _)set)\\<in>\n    \\<langle>bool_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel\n              \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel \\<times>\\<^sub>r\n      clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n  shows \"(nres_of (?f), partition_sets ro xs)\\<in>\\<langle>clw_rel appr1e_rel\\<rangle>nres_rel\"\n  unfolding partition_sets_def[abs_def]\n  including art\n  by autoref_monadic\nconcrete_definition partition_sets_impl for roi xsi uses partition_sets_impl\nlemmas [autoref_rules] = partition_sets_impl.refine[autoref_higher_order_rule(1)]\nsublocale autoref_op_pat_def partition_sets .\n\nlemma [autoref_rules]:\n  assumes \"PREFER single_valued A\"\n  shows \"(\\<lambda>xs. case xs of [x] \\<Rightarrow> RETURN x | _ \\<Rightarrow> SUCCEED, singleton_spec) \\<in> \\<langle>A\\<rangle>list_wset_rel \\<rightarrow> \\<langle>A\\<rangle>nres_rel\"\n  using assms\n  by (auto simp: nres_rel_def singleton_spec_def list_wset_rel_def set_rel_br\n      split: list.splits elim!: single_valued_as_brE dest!: brD\n      intro!: RETURN_SPEC_refine brI)\nsublocale autoref_op_pat_def singleton_spec .\n\nlemma closed_ivl_prod8_list_rel:\n  assumes \"(xl, x'l)\n       \\<in> \\<langle>bool_rel \\<times>\\<^sub>r\n          clw_rel appr1e_rel \\<times>\\<^sub>r\n          clw_rel appr1e_rel \\<times>\\<^sub>r\n          clw_rel appr1e_rel \\<times>\\<^sub>r\n          clw_rel appr1e_rel \\<times>\\<^sub>r\n          \\<langle>lv_rel\\<rangle>ivl_rel \\<times>\\<^sub>r\n          \\<langle>lv_rel\\<rangle>sctn_rel \\<times>\\<^sub>r clw_rel (\\<langle>appr_rel, \\<langle>lv_rel\\<rangle>sbelows_rel\\<rangle>inter_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\"\n  shows \"(\\<forall>(b, X, PS1, PS2, R, ivl, sctn, CX, CXS)\\<in>x'l. closed ivl)\"\n  using assms\n  unfolding list_wset_rel_def set_rel_sv[OF single_valued_Id_arbitrary_interface]\n  apply (subst (asm) set_rel_sv)\n  subgoal\n    by (auto simp: Id_arbitrary_interface_def intro!: relator_props intro: single_valuedI)\n  by (auto simp: Id_arbitrary_interface_def)\n\nlemma\n  poincare_onto_series_rec_list_eq:\\<comment> \\<open>TODO: here is a problem if interrupt gets uncurried, too\\<close>\n  \"poincare_onto_series odo interrupt trap guards XS ivl sctn ro = rec_list\n      (\\<lambda>(((((trap), XS0), ivl), sctn), ro).\n          let guard0 = mk_coll (mk_inter ivl (plane_of sctn))\n          in ASSUME (closed guard0) \\<bind>\n             (\\<lambda>_. (poincare_onto2 odo (ro ::: reach_optns_rel) (interrupt:::appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel) trap\n                    (op_empty_coll ::: clw_rel (\\<langle>\\<langle>lv_rel\\<rangle>ivl_rel, \\<langle>lv_rel\\<rangle>plane_rel\\<rangle>inter_rel)) guard0 XS0 :::\n                   \\<langle>\\<langle>bool_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel \\<times>\\<^sub>r\n      clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel) \\<bind>\n                  (\\<lambda>(XS1).\n                      singleton_spec XS1 \\<bind>\n                      (\\<lambda>(b, X, PS1, PS2, R, ivl', sctn', CX, CXS). CHECKs ''poincare_onto_series: last return!'' (ivl' = ivl \\<and> sctn' = sctn) \\<bind> (\\<lambda>_. RETURN PS2)))))\n      (\\<lambda>x xs rr (((((trap), XS0), ivl), sctn), ro0).\n          case x of\n          (guard, ro) \\<Rightarrow>\n            ASSUME (closed ivl) \\<bind> \n            (\\<lambda>_. let guard0 = mk_coll (mk_inter ivl (plane_of sctn))\n                 in ASSUME (closed guard0) \\<bind>\n                 (\\<lambda>_. ASSUME (\\<forall>(guard, ro)\\<in>set (x # xs). closed guard) \\<bind>\n                      (\\<lambda>_. let guardset = \\<Union>(guard, ro)\\<in>set ((guard0, ro0) # xs). guard\n                           in (poincare_onto2 odo ro (interrupt:::appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel) trap (guardset ::: clw_rel (\\<langle>\\<langle>lv_rel\\<rangle>ivl_rel, \\<langle>lv_rel\\<rangle>plane_rel\\<rangle>inter_rel))\n                                guard XS0 :::\n                               \\<langle>\\<langle>bool_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel \\<times>\\<^sub>r\n      clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel) \\<bind>\n                              (\\<lambda>(XS1).\n                                  ASSUME (\\<forall>(b, X, PS, PS2, R, ivl, sctn, CX, CXS)\\<in>XS1. closed ivl) \\<bind>\n                                  (\\<lambda>_.\n                                    partition_sets ro XS1 \\<bind>\n                                    (\\<lambda>XS2. fst_safe_colle odo XS2 \\<bind> (\\<lambda>_. rr (((((trap), XS2), ivl), sctn), ro0 ::: reach_optns_rel) \\<bind> RETURN))))))))\n      guards (((((trap), XS), ivl), sctn), ro)\"\n  by (induction guards arbitrary: XS ivl sctn ro) (auto simp: split_beta' split: prod.splits)\n\nschematic_goal poincare_onto_series_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(XSi, XS::'n eucl1 set) \\<in> clw_rel appr1e_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> \\<langle>clw_rel (iplane_rel lvivl_rel)\\<times>\\<^sub>rreach_optns_rel\\<rangle>list_rel\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\" \"(ivli, ivl) \\<in> lvivl_rel\" \"(sctni, sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n  assumes [autoref_rules]: \"(symstarti, symstart::'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set)nres)\n    \\<in> appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  assumes [unfolded autoref_tag_defs, refine_transfer]: \"\\<And>X. TRANSFER (nres_of (symstartd X) \\<le> symstarti X)\"\n    and [autoref_rules]: \"((), trap) \\<in> ghost_rel\"\n  notes [intro, simp] = list_set_rel_finiteD closed_ivl_prod3_list_rel closed_clw_rel_iplane_rel\n    closed_ivl_prod8_list_rel\n  notes [autoref_rules_raw] = ghost_relI[of x for x::\"'n eucl1 set\"]\n  shows \"(nres_of ?r, poincare_onto_series $ odo $ symstart $ trap $ guards $ XS $ ivl $ sctn $ ro) \\<in> \\<langle>clw_rel appr1e_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding poincare_onto_series_rec_list_eq\n  including art\n  apply autoref_monadic\n  apply (rule ghost_relI)\n  apply (autoref phases: trans)\n  apply (autoref phases: trans)\n  apply (rule ghost_relI)\n  apply (autoref phases: trans)\n  apply (autoref phases: trans)\n  apply simp\n  apply (autoref phases: trans)\n    apply (autoref phases: trans)\n   apply simp\n  apply (refine_transfer)\n  done\n\nconcrete_definition poincare_onto_series_impl for symstartd guardsi XSi ivli sctni roi uses poincare_onto_series_impl\nlemmas [autoref_rules] = poincare_onto_series_impl.refine\nsublocale autoref_op_pat_def poincare_onto_series .\n\nschematic_goal poincare_onto_from_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(XSi, XS) \\<in> clw_rel appr1e_rel\"\n    and [autoref_rules]: \"(Si, S) \\<in> \\<langle>lv_rel\\<rangle>halfspaces_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> \\<langle>clw_rel (iplane_rel lvivl_rel)\\<times>\\<^sub>rreach_optns_rel\\<rangle>list_rel\"\n    and civl[autoref_rules]: \"(ivli, ivl::'n rvec set) \\<in> lvivl_rel\"\n    and csctns[autoref_rules]: \"(sctni, sctn::'n rvec sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n  assumes [autoref_rules]: \"(symstarti, symstart::'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set)nres)\n    \\<in> appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  assumes [unfolded autoref_tag_defs, refine_transfer]: \"\\<And>X. TRANSFER (nres_of (symstartd X) \\<le> symstarti X)\"\n    and [autoref_rules]: \"((), trap) \\<in> ghost_rel\"\n  notes [intro, simp] = list_set_rel_finiteD closed_ivl_rel[OF civl] closed_ivl_prod3_list_rel\n  shows \"(nres_of ?r, poincare_onto_from $ odo $ symstart $ trap $ S $ guards $ ivl $ sctn $ ro $ XS) \\<in>\n    \\<langle>clw_rel appr1e_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding poincare_onto_from_def\n  including art\n  by autoref_monadic\n\nconcrete_definition poincare_onto_from_impl for symstartd Si guardsi ivli sctni roi XSi uses poincare_onto_from_impl\nlemmas [autoref_rules] = poincare_onto_from_impl.refine\nsublocale autoref_op_pat_def poincare_onto_from .\n\nschematic_goal subset_spec1_impl:\n  \"(nres_of ?r, subset_spec1 R P dP) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  if [autoref_rules]:\n    \"(Ri, R) \\<in> appr1_rel\"\n    \"(Pimpl, P) \\<in> lvivl_rel\"\n    \"(dPi, dP) \\<in> \\<langle>lvivl_rel\\<rangle>(default_rel UNIV)\"\n  unfolding subset_spec1_def\n  including art\n  by autoref_monadic\nlemmas [autoref_rules] = subset_spec1_impl[autoref_higher_order_rule]\nsublocale autoref_op_pat_def subset_spec1 .\n\nschematic_goal subset_spec1_collc:\n  \"(nres_of (?f), subset_spec1_coll R P dP) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  if [autoref_rules]:\n    \"(Ri, R) \\<in> clw_rel appr1_rel\"\n    \"(Pimpl, P) \\<in> lvivl_rel\"\n    \"(dPi, dP) \\<in> \\<langle>lvivl_rel\\<rangle>(default_rel UNIV)\"\n  unfolding subset_spec1_coll_def\n  including art\n  by autoref_monadic\nconcrete_definition subset_spec1_collc for Ri Pimpl dPi uses subset_spec1_collc\nlemmas subset_spec1_collc_refine[autoref_rules] = subset_spec1_collc.refine[autoref_higher_order_rule]\nsublocale autoref_op_pat_def subset_spec1_coll .\n\nschematic_goal one_step_until_time_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(X0i, X0::'n eucl1 set) \\<in> appr1e_rel\"\n  assumes [autoref_rules]: \"(phi, ph) \\<in> bool_rel\"\n  assumes [autoref_rules]: \"(t1i, t1) \\<in> rnv_rel\"\n  notes [autoref_tyrel] = ty_REL[where 'a=\"real\" and R=\"Id\"]\n  shows \"(nres_of ?f, one_step_until_time odo X0 ph t1)\\<in>\\<langle>appr1e_rel \\<times>\\<^sub>r \\<langle>clw_rel appr_rel\\<rangle>phantom_rel\\<rangle>nres_rel\"\n  unfolding one_step_until_time_def[abs_def]\n  including art\n  by autoref_monadic\nconcrete_definition one_step_until_time_impl for odoi X0i phi t1i uses one_step_until_time_impl\nlemmas one_step_until_time_impl_refine[autoref_rules] = one_step_until_time_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def one_step_until_time .\n\nschematic_goal ivl_of_appr1_coll_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules]: \"(Xi, X::'n::enum rvec set) \\<in> clw_rel appr_rel\"\n  shows \"(nres_of ?r, ivl_of_eucl_coll X) \\<in> \\<langle>appr1_rel\\<rangle>nres_rel\"\n  unfolding ivl_of_eucl_coll_def\n  by autoref_monadic\nconcrete_definition ivl_of_appr1_coll_impl uses ivl_of_appr1_coll_impl\nsublocale autoref_op_pat_def ivl_of_eucl_coll .\nlemmas ivl_of_appr1_coll_impl_refine[autoref_rules] =\n  ivl_of_appr1_coll_impl.refine[autoref_higher_order_rule(1)]\n\nschematic_goal one_step_until_time_ivl_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(X0i, X0::'n eucl1 set) \\<in> appr1e_rel\"\n  assumes [autoref_rules]: \"(phi, ph) \\<in> bool_rel\"\n  assumes [autoref_rules]: \"(t1i, t1) \\<in> rnv_rel\"\n  assumes [autoref_rules]: \"(t2i, t2) \\<in> rnv_rel\"\n  shows \"(nres_of ?r, one_step_until_time_ivl odo X0 ph t1 t2) \\<in> \\<langle>appr1e_rel \\<times>\\<^sub>r \\<langle>clw_rel appr_rel\\<rangle>phantom_rel\\<rangle>nres_rel\"\n  unfolding one_step_until_time_ivl_def\n  including art\n  by autoref_monadic\nconcrete_definition one_step_until_time_ivl_impl for X0i phi t1i t2i uses one_step_until_time_ivl_impl\nlemmas [autoref_rules] = one_step_until_time_ivl_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def one_step_until_time_ivl .\n\n\nschematic_goal poincare_onto_from_in_ivl_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(XSi, XS) \\<in> clw_rel appr1e_rel\"\n    and [autoref_rules]: \"(Si, S) \\<in> \\<langle>lv_rel\\<rangle>halfspaces_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> \\<langle>clw_rel (iplane_rel lvivl_rel)\\<times>\\<^sub>rreach_optns_rel\\<rangle>list_rel\"\n    and civl[autoref_rules]: \"(ivli, ivl::'n rvec set) \\<in> lvivl_rel\"\n    and csctns[autoref_rules]: \"(sctni, sctn::'n rvec sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n  assumes [autoref_rules]: \"(symstarti, symstart::'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set)nres)\n    \\<in> appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel\"\n  assumes [unfolded autoref_tag_defs, refine_transfer]: \"\\<And>X. TRANSFER (nres_of (symstartd X) \\<le> symstarti X)\"\n    and [autoref_rules]: \"((), trap) \\<in> ghost_rel\"\n    \"(Pimpl, P) \\<in> lvivl_rel\"\n    \"(dPi, dP) \\<in> \\<langle>lvivl_rel\\<rangle>(default_rel UNIV)\"\n  notes [intro, simp] = list_set_rel_finiteD closed_ivl_rel[OF civl] closed_ivl_prod3_list_rel\n  shows \"(nres_of ?r, poincare_onto_from_in_ivl\n      $ odo $ symstart $ trap $ S $ guards $ ivl $ sctn $ ro $ XS $ P $ dP) \\<in>\n    \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding poincare_onto_from_in_ivl_def\n  including art\n  by autoref_monadic\n\nconcrete_definition poincare_onto_from_in_ivl_impl for E odoi symstartd Si guardsi ivli sctni roi XSi Pimpl dPi uses poincare_onto_from_in_ivl_impl\nlemmas [autoref_rules] = poincare_onto_from_in_ivl_impl.refine\nsublocale autoref_op_pat_def poincare_onto_from_in_ivl .\n\nlemma TRANSFER_I: \"x \\<Longrightarrow> TRANSFER x\"\n  by simp\n\nlemma dres_nres_rel_nres_relD: \"(symstartd, symstart) \\<in> A \\<rightarrow> \\<langle>B\\<rangle>dres_nres_rel \\<Longrightarrow> (\\<lambda>x. nres_of (symstartd x), symstart) \\<in> A \\<rightarrow> \\<langle>B\\<rangle>nres_rel\"\n  by (auto simp: dres_nres_rel_def nres_rel_def dest!: fun_relD)\n\nlemma c1_info_of_apprsI:\n  assumes \"(b, a) \\<in> clw_rel appr1_rel\"\n  assumes \"x \\<in> a\"\n  shows \"x \\<in> c1_info_of_apprs b\"\n  using assms\n  by (auto simp: appr1_rel_br clw_rel_br c1_info_of_apprs_def dest!: brD)\n\nlemma clw_rel_appr1_relI:\n  assumes \"\\<And>X. X \\<in> set XS \\<Longrightarrow> c1_info_invar CARD('n::enum) X\"\n  shows \"(XS, c1_info_of_apprs XS::('n rvec\\<times>_)set) \\<in> clw_rel appr1_rel\"\n  by (auto simp: appr1_rel_br clw_rel_br c1_info_of_apprs_def intro!: brI assms)\n\nlemma c1_info_of_appr'I:\n  assumes \"(b, a) \\<in> \\<langle>clw_rel appr1_rel\\<rangle>phantom_rel\"\n  assumes \"x \\<in> a\"\n  shows \"x \\<in> c1_info_of_appr' b\"\n  using assms\n  by (auto simp add: c1_info_of_appr'_def intro!: c1_info_of_apprsI split: option.splits)\n\nlemma appr1e_relI:\n  assumes \"c1_info_invare CARD('n::enum) X0i\"\n  shows \"(X0i, c1_info_of_appre X0i::'n eucl1 set) \\<in> appr1e_rel\"\n  using assms\n  apply (cases X0i)\n  apply (auto simp: scaleR2_rel_def c1_info_of_appre_def c1_info_invare_def)\n  apply (rule relcompI)\n   apply (rule prod_relI)\n    apply (rule IdI)\n   apply (rule appr1_relI)\n    apply (auto simp: vimage_def intro!: brI)\n   apply (metis ereal_dense2 less_imp_le)\n    apply (rule relcompI)\n   apply (rule prod_relI)\n    apply (rule IdI)\n   apply (rule appr1_relI)\n   apply (auto simp: vimage_def intro!: brI)\n  by (metis basic_trans_rules(23) ereal_cases ereal_less_eq(1) ereal_top order_eq_refl)\n\nlemma c1_info_of_apprI:\n  assumes \"(b, a) \\<in> appr1_rel\"\n  assumes \"x \\<in> a\"\n  shows \"x \\<in> c1_info_of_appr b\"\n  using assms\n  apply (auto simp add: c1_info_of_appr_def c1_info_invar_def appr1_rel_internal appr_rel_def lv_rel_def\n      set_rel_br\n      dest!: brD\n      split: option.splits)\n   apply (auto simp add:  appr_rell_internal dest!: brD)\n  done\n\nlemma c1_info_of_appreI:\n  assumes \"(lub, a) \\<in> appr1e_rel\"\n  assumes \"x \\<in> a\"\n  shows \"x \\<in> c1_info_of_appre lub\"\n  using assms\n  apply (auto simp add: scaleR2_def c1_info_of_appre_def image_def vimage_def scaleR2_rel_def\n      dest!: brD\n      intro!: c1_info_of_apprsI split: option.splits)\n  subgoal for a b c d e f g h i\n    apply (rule exI[where x=g])\n    apply (rule conjI, assumption)+\n    apply (rule bexI)\n     prefer 2\n     apply (rule c1_info_of_apprI) apply assumption\n     apply assumption apply simp\n    done\n  done\n\nlemma c1_info_of_apprseI:\n  assumes \"(b, a) \\<in> clw_rel appr1e_rel\"\n  assumes \"x \\<in> a\"\n  shows \"x \\<in> c1_info_of_apprse b\"\n  using assms\n  by (force simp: appr1_rel_br scaleR2_rel_br clw_rel_br c1_info_of_appre_def c1_info_of_apprse_def\n      dest!: brD)\n\nlemma clw_rel_appr1e_relI:\n  assumes \"\\<And>X. X \\<in> set XS \\<Longrightarrow> c1_info_invare CARD('n::enum) X\"\n  shows \"(XS, c1_info_of_apprse XS::('n rvec\\<times>_)set) \\<in> clw_rel appr1e_rel\"\n  using assms\n  apply (auto simp: c1_info_of_apprse_def c1_info_of_appre_def c1_info_invare_def)\n  unfolding appr1_rel_br scaleR2_rel_br clw_rel_br\n  apply (rule brI)\n   apply (auto simp: c1_info_invar_def vimage_def)\n  subgoal premises prems for a b c d\n    using prems(1)[OF prems(2)]\n    by (cases a; cases b) auto\n  done\n\nschematic_goal one_step_until_time_ivl_in_ivl_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n::enum rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(X0i, X0::'n eucl1 set) \\<in> appr1e_rel\"\n  assumes [autoref_rules]: \"(t1i, t1) \\<in> rnv_rel\"\n  assumes [autoref_rules]: \"(t2i, t2) \\<in> rnv_rel\"\n      \"(Ri, R) \\<in> lvivl_rel\"\n      \"(dRi, dR) \\<in> \\<langle>lvivl_rel\\<rangle>(default_rel UNIV)\"\n  shows \"(nres_of ?r, one_step_until_time_ivl_in_ivl odo X0 t1 t2 R dR) \\<in> \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding one_step_until_time_ivl_in_ivl_def\n  including art\n  by autoref_monadic\nconcrete_definition one_step_until_time_ivl_in_ivl_impl for odoi X0i t1i t2i Ri dRi\n  uses one_step_until_time_ivl_in_ivl_impl\nlemmas one_step_until_time_ivl_in_ivl_impl_refine[autoref_rules] =\n  one_step_until_time_ivl_in_ivl_impl.refine[autoref_higher_order_rule(1 2 3)]\nsublocale autoref_op_pat_def one_step_until_time_ivl_in_ivl .\n\nschematic_goal poincare_onto_in_ivl_impl:\n  assumes [autoref_rules_raw]: \"DIM_precond TYPE('n::enum rvec) E\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n::enum rvec)\"\n  assumes [autoref_rules_raw]: \"ncc_precond TYPE('n vec1)\"\n  assumes [autoref_rules]: \"(odoi, odo) \\<in> ode_ops_rel\"\n  assumes [autoref_rules]: \"(XSi, XS) \\<in> clw_rel appr1e_rel\"\n    and osctns[autoref_rules]: \"(guardsi, guards) \\<in> \\<langle>clw_rel (iplane_rel lvivl_rel)\\<times>\\<^sub>rreach_optns_rel\\<rangle>list_rel\"\n    and civl[autoref_rules]: \"(ivli, ivl::'n rvec set) \\<in> lvivl_rel\"\n    and csctns[autoref_rules]: \"(sctni, sctn::'n rvec sctn) \\<in> \\<langle>lv_rel\\<rangle>sctn_rel\"\n    and [autoref_rules]: \"(roi, ro) \\<in> reach_optns_rel\"\n      \"(Pimpl, P::'n rvec set) \\<in> lvivl_rel\"\n      \"(dPi, dP:: ((real, 'n) vec, 'n) vec set) \\<in> \\<langle>lvivl_rel\\<rangle>(default_rel UNIV)\"\n  notes [intro, simp] = list_set_rel_finiteD closed_ivl_rel[OF civl] closed_ivl_prod3_list_rel\n  shows \"(nres_of ?r,\n    poincare_onto_in_ivl odo guards ivl sctn ro XS P dP) \\<in>\n    \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding autoref_tag_defs\n  unfolding poincare_onto_in_ivl_def\n  including art\n  apply (rule autoref_monadicI)\n   apply (autoref phases: id_op rel_inf fix_rel)\n   apply (autoref_trans_step)\n    apply (autoref_trans_step)\n     apply (autoref_trans_step)\n    apply (simp only: autoref_tag_defs)\n    apply (rule poincare_onto_series_impl.refine[unfolded autoref_tag_defs])\\<comment> \\<open>TODO: why?\\<close>\n               apply fact+\n      apply (rule empty_symstart_impl)\n     apply refine_transfer\n    apply (rule ghost_relI)\n   apply (autoref phases: trans)\n  unfolding autoref_tag_defs\n  by refine_transfer\n\nconcrete_definition poincare_onto_in_ivl_impl for E odoi guardsi ivli sctni roi XSi Pimpl dPi\n  uses poincare_onto_in_ivl_impl\nlemmas [autoref_rules] = poincare_onto_in_ivl_impl.refine[autoref_higher_order_rule(1 2 3)]\n\n\nsubsection \\<open>Main (executable) interfaces to the ODE solver, with initialization\\<close>\n\ndefinition \"carries_c1 = Not o Option.is_none o (snd o snd)\"\n\ndefinition \"solves_poincare_map odo symstart S guards ivli sctni roi XS P dP \\<longleftrightarrow>\n  poincare_onto_from_in_ivl_impl (D odo) (init_ode_ops True (carries_c1 (hd XS)) odo) symstart S guards ivli sctni\n    roi XS P dP = dRETURN True\"\n\ndefinition \"solves_poincare_map' odo S = solves_poincare_map odo (\\<lambda>x. dRETURN ([], [x])) [S]\"\n\ndefinition \"one_step_until_time_ivl_in_ivl_check odo X t0 t1 Ri dRi \\<longleftrightarrow>\n  one_step_until_time_ivl_in_ivl_impl (D odo) (init_ode_ops True (carries_c1 X) odo) X t0 t1 Ri dRi = dRETURN True\"\n\ndefinition \"solves_poincare_map_onto odo guards ivli sctni roi XS P dP \\<longleftrightarrow>\n  poincare_onto_in_ivl_impl (D odo) (init_ode_ops True (carries_c1 (hd XS)) odo) guards ivli sctni roi XS P dP = dRETURN True\"\n\nend\n\ncontext approximate_sets begin\n\nlemma c1_info_of_appre_c0_I:\n  \"(x, d) \\<in> c1_info_of_appre ((1, 1), X0, None)\"\n  if \"list_of_eucl x \\<in> set_of_appr X0\"\n  using that\n  by (force simp: c1_info_of_appre_def c1_info_of_appr_def)\n\nlemma lvivl'_invar_None[simp]: \"lvivl'_invar n None\"\n  by (auto simp: lvivl'_invar_def)\n\nlemma c1_info_invar_None: \"c1_info_invar n (u, None) \\<longleftrightarrow> length u = n\"\n  by (auto simp: c1_info_invar_def)\n\nlemma c1_info_invare_None: \"c1_info_invare n ((l, u), x, None) \\<longleftrightarrow>((l < u \\<or> -\\<infinity> < l \\<and> l \\<le> u \\<and> u < \\<infinity>) \\<and> length x = n)\"\n  by (auto simp: c1_info_invare_def Let_def c1_info_invar_None)\n\nend\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Ordinary_Differential_Equations/Numerics/Concrete_Reachability_Analysis_C1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.32388227054517593}}
{"text": "(*  Title:      HOL/Auth/n_german.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german imports n_german_lemma_invs_on_rules n_german_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.61878043374385, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3238822705451759}}
{"text": "header {* \\isaheader{Definition of the CFG} *}\n\ntheory PCFG imports ProcState begin\n\ndefinition Main :: \"pname\"\n  where \"Main = ''Main''\"\n\ndatatype label = Label nat | Entry | Exit\n\nsubsection{* The CFG for every procedure *}\n\nsubsubsection {* Definition of @{text \"\\<oplus>\"} *}\n\nfun label_incr :: \"label \\<Rightarrow> nat \\<Rightarrow> label\" (\"_ \\<oplus> _\" 60)\nwhere \"(Label l) \\<oplus> i = Label (l + i)\"\n  | \"Entry \\<oplus> i       = Entry\"\n  | \"Exit \\<oplus> i        = Exit\"\n\n\nlemma Exit_label_incr [dest]: \"Exit = n \\<oplus> i \\<Longrightarrow> n = Exit\"\n  by(cases n,auto)\n\nlemma label_incr_Exit [dest]: \"n \\<oplus> i = Exit \\<Longrightarrow> n = Exit\"\n  by(cases n,auto)\n\nlemma Entry_label_incr [dest]: \"Entry = n \\<oplus> i \\<Longrightarrow> n = Entry\"\n  by(cases n,auto)\n\nlemma label_incr_Entry [dest]: \"n \\<oplus> i = Entry \\<Longrightarrow> n = Entry\"\n  by(cases n,auto)\n\nlemma label_incr_inj:\n  \"n \\<oplus> c = n' \\<oplus> c \\<Longrightarrow> n = n'\"\nby(cases n)(cases n',auto)+\n\nlemma label_incr_simp:\"n \\<oplus> i = m \\<oplus> (i + j) \\<Longrightarrow> n = m \\<oplus> j\"\nby(cases n,auto,cases m,auto)\n\n\n\nlemma label_incr_start_Node_smaller:\n  \"Label l = n \\<oplus> i \\<Longrightarrow> n = Label (l - i)\"\nby(cases n,auto)\n\nlemma label_incr_start_Node_smaller_rev:\n  \"n \\<oplus> i = Label l \\<Longrightarrow> n = Label (l - i)\"\nby(cases n,auto)\n\n\nlemma label_incr_ge:\"Label l = n \\<oplus> i \\<Longrightarrow> l \\<ge> i\"\nby(cases n) auto\n\nlemma label_incr_0 [dest]:\n  \"\\<lbrakk>Label 0 = n \\<oplus> i; i > 0\\<rbrakk> \\<Longrightarrow> False\" \nby(cases n) auto\n\nlemma label_incr_0_rev [dest]:\n  \"\\<lbrakk>n \\<oplus> i = Label 0; i > 0\\<rbrakk> \\<Longrightarrow> False\" \nby(cases n) auto\n\nsubsubsection {* The edges of the procedure CFG *}\n\ntext {* Control flow information in this language is the node, to which we return\n  after the calles procedure is finished. *}\n\ndatatype p_edge_kind = \n  IEdge \"(vname,val,pname \\<times> label,pname) edge_kind\"\n| CEdge \"pname \\<times> expr list \\<times> vname list\"\n\n\ntype_synonym p_edge = \"(label \\<times> p_edge_kind \\<times> label)\"\n\ninductive Proc_CFG :: \"cmd \\<Rightarrow> label \\<Rightarrow> p_edge_kind \\<Rightarrow> label \\<Rightarrow> bool\"\n(\"_ \\<turnstile> _ -_\\<rightarrow>\\<^sub>p _\")\nwhere\n\n  Proc_CFG_Entry_Exit:\n  \"prog \\<turnstile> Entry -IEdge (\\<lambda>s. False)\\<^sub>\\<surd>\\<rightarrow>\\<^sub>p Exit\"\n\n| Proc_CFG_Entry:\n  \"prog \\<turnstile> Entry -IEdge (\\<lambda>s. True)\\<^sub>\\<surd>\\<rightarrow>\\<^sub>p Label 0\"\n\n| Proc_CFG_Skip: \n  \"Skip \\<turnstile> Label 0 -IEdge \\<Up>id\\<rightarrow>\\<^sub>p Exit\"\n\n| Proc_CFG_LAss: \n  \"V:=e \\<turnstile> Label 0 -IEdge \\<Up>(\\<lambda>cf. update cf V e)\\<rightarrow>\\<^sub>p Label 1\"\n\n| Proc_CFG_LAssSkip:\n  \"V:=e \\<turnstile> Label 1 -IEdge \\<Up>id\\<rightarrow>\\<^sub>p Exit\"\n\n| Proc_CFG_SeqFirst:\n  \"\\<lbrakk>c\\<^sub>1 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'; n' \\<noteq> Exit\\<rbrakk> \\<Longrightarrow> c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'\"\n\n| Proc_CFG_SeqConnect: \n  \"\\<lbrakk>c\\<^sub>1 \\<turnstile> n -et\\<rightarrow>\\<^sub>p Exit; n \\<noteq> Entry\\<rbrakk> \\<Longrightarrow> c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n -et\\<rightarrow>\\<^sub>p Label #:c\\<^sub>1\"\n\n| Proc_CFG_SeqSecond: \n  \"\\<lbrakk>c\\<^sub>2 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'; n \\<noteq> Entry\\<rbrakk> \\<Longrightarrow> c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n \\<oplus> #:c\\<^sub>1 -et\\<rightarrow>\\<^sub>p n' \\<oplus> #:c\\<^sub>1\"\n\n| Proc_CFG_CondTrue:\n    \"if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> Label 0 \n  -IEdge (\\<lambda>cf. state_check cf b (Some true))\\<^sub>\\<surd>\\<rightarrow>\\<^sub>p Label 1\"\n\n| Proc_CFG_CondFalse:\n    \"if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> Label 0 -IEdge (\\<lambda>cf. state_check cf b (Some false))\\<^sub>\\<surd>\\<rightarrow>\\<^sub>p \n                        Label (#:c\\<^sub>1 + 1)\"\n\n| Proc_CFG_CondThen:\n  \"\\<lbrakk>c\\<^sub>1 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'; n \\<noteq> Entry\\<rbrakk> \\<Longrightarrow> if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n \\<oplus> 1 -et\\<rightarrow>\\<^sub>p n' \\<oplus> 1\"\n\n| Proc_CFG_CondElse:\n  \"\\<lbrakk>c\\<^sub>2 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'; n \\<noteq> Entry\\<rbrakk> \n  \\<Longrightarrow> if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n \\<oplus> (#:c\\<^sub>1 + 1) -et\\<rightarrow>\\<^sub>p n' \\<oplus> (#:c\\<^sub>1 + 1)\"\n\n| Proc_CFG_WhileTrue:\n    \"while (b) c' \\<turnstile> Label 0 -IEdge (\\<lambda>cf. state_check cf b (Some true))\\<^sub>\\<surd>\\<rightarrow>\\<^sub>p Label 2\"\n\n| Proc_CFG_WhileFalse:\n    \"while (b) c' \\<turnstile> Label 0 -IEdge (\\<lambda>cf. state_check cf b (Some false))\\<^sub>\\<surd>\\<rightarrow>\\<^sub>p Label 1\"\n\n| Proc_CFG_WhileFalseSkip:\n  \"while (b) c' \\<turnstile> Label 1 -IEdge \\<Up>id\\<rightarrow>\\<^sub>p Exit\"\n\n| Proc_CFG_WhileBody:\n  \"\\<lbrakk>c' \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'; n \\<noteq> Entry; n' \\<noteq> Exit\\<rbrakk> \n  \\<Longrightarrow> while (b) c' \\<turnstile> n \\<oplus> 2 -et\\<rightarrow>\\<^sub>p n' \\<oplus> 2\"\n\n| Proc_CFG_WhileBodyExit:\n  \"\\<lbrakk>c' \\<turnstile> n -et\\<rightarrow>\\<^sub>p Exit; n \\<noteq> Entry\\<rbrakk> \\<Longrightarrow> while (b) c' \\<turnstile> n \\<oplus> 2 -et\\<rightarrow>\\<^sub>p Label 0\"\n\n| Proc_CFG_Call:\n  \"Call p es rets \\<turnstile> Label 0 -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p Label 1\"\n\n| Proc_CFG_CallSkip:\n  \"Call p es rets \\<turnstile> Label 1 -IEdge \\<Up>id\\<rightarrow>\\<^sub>p Exit\"\n\n\nsubsubsection{* Some lemmas about the procedure CFG *}\n\nlemma Proc_CFG_Exit_no_sourcenode [dest]:\n  \"prog \\<turnstile> Exit -et\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> False\"\nby(induct prog n\\<equiv>\"Exit\" et n' rule:Proc_CFG.induct,auto)\n\n\nlemma Proc_CFG_Entry_no_targetnode [dest]:\n  \"prog \\<turnstile> n -et\\<rightarrow>\\<^sub>p Entry \\<Longrightarrow> False\"\nby(induct prog n et n'\\<equiv>\"Entry\" rule:Proc_CFG.induct,auto)\n\n\nlemma Proc_CFG_IEdge_intra_kind:\n  \"prog \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> intra_kind et\"\nby(induct prog n x\\<equiv>\"IEdge et\" n' rule:Proc_CFG.induct,auto simp:intra_kind_def)\n\n\nlemma [dest]:\"prog \\<turnstile> n -IEdge (Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs)\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> False\"\nby(fastforce dest:Proc_CFG_IEdge_intra_kind simp:intra_kind_def)\n\nlemma [dest]:\"prog \\<turnstile> n -IEdge (Q\\<hookleftarrow>\\<^bsub>p\\<^esub>f)\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> False\"\nby(fastforce dest:Proc_CFG_IEdge_intra_kind simp:intra_kind_def)\n\n\nlemma Proc_CFG_sourcelabel_less_num_nodes:\n  \"prog \\<turnstile> Label l -et\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> l < #:prog\"\nproof(induct prog \"Label l\" et n' arbitrary:l rule:Proc_CFG.induct)\n  case (Proc_CFG_SeqFirst c\\<^sub>1 et n' c\\<^sub>2 l)\n  thus ?case by simp\nnext\n  case (Proc_CFG_SeqConnect c\\<^sub>1 et c\\<^sub>2 l)\n  thus ?case by simp\nnext\n  case (Proc_CFG_SeqSecond c\\<^sub>2 n et n' c\\<^sub>1 l) \n  note n = `n \\<oplus> #:c\\<^sub>1 = Label l` \n  note IH = `\\<And>l. n = Label l \\<Longrightarrow> l < #:c\\<^sub>2`\n  from n obtain l' where l':\"n = Label l'\" by(cases n) auto\n  from IH[OF this] have \"l' < #:c\\<^sub>2\" .\n  with n l' show ?case by simp\nnext\n  case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2 l) \n  note n = `n \\<oplus> 1 = Label l`\n  note IH = `\\<And>l. n = Label l \\<Longrightarrow> l < #:c\\<^sub>1`\n  from n obtain l' where l':\"n = Label l'\" by(cases n) auto\n  from IH[OF this] have \"l' < #:c\\<^sub>1\" .\n  with n l' show ?case by simp\nnext\n  case (Proc_CFG_CondElse c\\<^sub>2 n et n' b c\\<^sub>1 l)\n  note n = `n \\<oplus> (#:c\\<^sub>1 + 1) = Label l`\n  note IH = `\\<And>l. n = Label l \\<Longrightarrow> l < #:c\\<^sub>2`\n  from n obtain l' where l':\"n = Label l'\" by(cases n) auto\n  from IH[OF this] have \"l' < #:c\\<^sub>2\" .\n  with n l' show ?case by simp\nnext\n  case (Proc_CFG_WhileBody c' n et n' b l)\n  note n = `n \\<oplus> 2 = Label l` \n  note IH = `\\<And>l. n = Label l \\<Longrightarrow> l < #:c'`\n  from n obtain l' where l':\"n = Label l'\" by(cases n) auto\n  from IH[OF this] have \"l' < #:c'\" .\n  with n l' show ?case by simp\nnext\n  case (Proc_CFG_WhileBodyExit c' n et b l)\n  note n = `n \\<oplus> 2 = Label l` \n  note IH = `\\<And>l. n = Label l \\<Longrightarrow> l < #:c'`\n  from n obtain l' where l':\"n = Label l'\" by(cases n) auto\n  from IH[OF this] have \"l' < #:c'\" .\n  with n l' show ?case by simp\nqed (auto simp:num_inner_nodes_gr_0)\n\n\nlemma Proc_CFG_targetlabel_less_num_nodes:\n  \"prog \\<turnstile> n -et\\<rightarrow>\\<^sub>p Label l \\<Longrightarrow> l < #:prog\"\nproof(induct prog n et \"Label l\" arbitrary:l rule:Proc_CFG.induct)\n  case (Proc_CFG_SeqFirst c\\<^sub>1 n et c\\<^sub>2 l)\n thus ?case by simp\nnext\n  case (Proc_CFG_SeqSecond c\\<^sub>2 n et n' c\\<^sub>1 l)\n  note n' = `n' \\<oplus> #:c\\<^sub>1 = Label l` \n  note IH = `\\<And>l. n' = Label l \\<Longrightarrow> l < #:c\\<^sub>2`\n  from n' obtain l' where l':\"n' = Label l'\" by(cases n') auto\n  from IH[OF this] have \"l' < #:c\\<^sub>2\" .\n  with n' l' show ?case by simp\nnext\n  case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2 l)\n  note n' = `n' \\<oplus> 1 = Label l` \n  note IH = `\\<And>l. n' = Label l \\<Longrightarrow> l < #:c\\<^sub>1`\n  from n' obtain l' where l':\"n' = Label l'\" by(cases n') auto\n  from IH[OF this] have \"l' < #:c\\<^sub>1\" .\n  with n' l' show ?case by simp\nnext\n  case (Proc_CFG_CondElse c\\<^sub>2 n et n' b c\\<^sub>1 l)\n  note n' = `n' \\<oplus> (#:c\\<^sub>1 + 1) = Label l` \n  note IH = `\\<And>l. n' = Label l \\<Longrightarrow> l < #:c\\<^sub>2`\n  from n' obtain l' where l':\"n' = Label l'\" by(cases n') auto\n  from IH[OF this] have \"l' < #:c\\<^sub>2\" .\n  with n' l' show ?case by simp\nnext\n  case (Proc_CFG_WhileBody c' n et n' b l)\n  note n' = `n' \\<oplus> 2 = Label l` \nnote IH = `\\<And>l. n' = Label l \\<Longrightarrow> l < #:c'`\n  from n' obtain l' where l':\"n' = Label l'\" by(cases n') auto\n  from IH[OF this] have \"l' < #:c'\" .\n  with n' l' show ?case by simp\nqed (auto simp:num_inner_nodes_gr_0)\n\n\nlemma Proc_CFG_EntryD:\n  \"prog \\<turnstile> Entry -et\\<rightarrow>\\<^sub>p n' \n  \\<Longrightarrow> (n' = Exit \\<and> et = IEdge(\\<lambda>s. False)\\<^sub>\\<surd>) \\<or> (n' = Label 0 \\<and> et = IEdge (\\<lambda>s. True)\\<^sub>\\<surd>)\"\nby(induct prog n\\<equiv>\"Entry\" et n' rule:Proc_CFG.induct,auto)\n\n\n\n\n\ntext {* Lots of lemmas for call edges @{text \"\\<dots>\"} *}\n\nlemma Proc_CFG_Call_Labels:\n  \"prog \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> \\<exists>l. n = Label l \\<and> n' = Label (Suc l)\"\nby(induct prog n et\\<equiv>\"CEdge (p,es,rets)\" n' rule:Proc_CFG.induct,auto)\n\n\nlemma Proc_CFG_Call_target_0:\n  \"prog \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p Label 0 \\<Longrightarrow> n = Entry\"\nby(induct prog n et\\<equiv>\"CEdge (p,es,rets)\" n'\\<equiv>\"Label 0\" rule:Proc_CFG.induct)\n  (auto dest:Proc_CFG_Call_Labels)\n\n\nlemma Proc_CFG_Call_Intra_edge_not_same_source:\n  \"\\<lbrakk>prog \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'; prog \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p n''\\<rbrakk> \\<Longrightarrow> False\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n  case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> False`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p n''` `c\\<^sub>1 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p n'` \n    `n' \\<noteq> Exit`\n  obtain nx where \"c\\<^sub>1 \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases)\n    apply(auto intro:Proc_CFG_Entry_Exit Proc_CFG_Entry)\n    by(case_tac n)(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n  from `c\\<^sub>1 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p Exit`\n  show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n  case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> False`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n \\<oplus> #:c\\<^sub>1 -IEdge et\\<rightarrow>\\<^sub>p n''` `c\\<^sub>2 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p n'` \n    `n \\<noteq> Entry`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n      apply(cases n) apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n     apply(cases n) apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n    by(cases n,auto,case_tac n,auto)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> False`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n \\<oplus> 1 -IEdge et\\<rightarrow>\\<^sub>p n''` `c\\<^sub>1 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p n'`\n    `n \\<noteq> Entry`\n  obtain nx where \"c\\<^sub>1 \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n     apply(cases n) apply auto apply(case_tac n) apply auto\n    apply(cases n) apply auto\n    by(case_tac n)(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> False`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n \\<oplus> #:c\\<^sub>1 + 1 -IEdge et\\<rightarrow>\\<^sub>p n''` `c\\<^sub>2 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p n'`\n    `n \\<noteq> Entry`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n     apply(cases n) apply auto\n     apply(case_tac n) apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n    by(cases n,auto,case_tac n,auto)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_WhileBody c' n n' b)\n  note IH = `\\<And>n''. c' \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> False`\n  from `while (b) c' \\<turnstile> n \\<oplus> 2 -IEdge et\\<rightarrow>\\<^sub>p n''` `c' \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p n'`\n    `n \\<noteq> Entry` `n' \\<noteq> Exit`\n  obtain nx where \"c' \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n      apply(drule label_incr_ge[OF sym]) apply simp\n     apply(cases n) apply auto apply(case_tac n) apply auto\n    by(cases n,auto,case_tac n,auto)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_WhileBodyExit c' n b)\n  from `c' \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p Exit`\n  show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n  case Proc_CFG_Call\n  from `Call p es rets \\<turnstile> Label 0 -IEdge et\\<rightarrow>\\<^sub>p n''`\n  show ?case by(fastforce elim:Proc_CFG.cases)\nqed\n\n\nlemma Proc_CFG_Call_Intra_edge_not_same_target:\n  \"\\<lbrakk>prog \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'; prog \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n'\\<rbrakk> \\<Longrightarrow> False\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n  case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> False`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n'` `c\\<^sub>1 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p n'` \n    `n' \\<noteq> Exit`\n  have \"c\\<^sub>1 \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n'\"\n    apply - apply(erule Proc_CFG.cases)\n    apply(auto intro:Proc_CFG_Entry dest:Proc_CFG_targetlabel_less_num_nodes) \n    by(case_tac n')(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n  from `c\\<^sub>1 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p Exit`\n  show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n  case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> False`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n' \\<oplus> #:c\\<^sub>1` `c\\<^sub>2 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p n'` \n    `n \\<noteq> Entry`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> nx -IEdge et\\<rightarrow>\\<^sub>p n'\"\n    apply - apply(erule Proc_CFG.cases,auto)\n       apply(fastforce intro:Proc_CFG_Entry_Exit)\n      apply(cases n') apply(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n     apply(cases n') apply(auto dest:Proc_CFG_Call_target_0)\n    apply(cases n') apply(auto dest:Proc_CFG_Call_Labels)\n    by(case_tac n') auto\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> False`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n' \\<oplus> 1` `c\\<^sub>1 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p n'`\n    `n \\<noteq> Entry`\n  obtain nx where \"c\\<^sub>1 \\<turnstile> nx -IEdge et\\<rightarrow>\\<^sub>p n'\"\n    apply - apply(erule Proc_CFG.cases,auto)\n        apply(cases n') apply(auto intro:Proc_CFG_Entry_Exit)\n       apply(cases n') apply(auto dest:Proc_CFG_Call_target_0)\n      apply(cases n') apply(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n     apply(cases n') apply auto apply(case_tac n') apply auto\n    apply(cases n') apply auto\n    apply(case_tac n') apply(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n    by(case_tac n')(auto dest:Proc_CFG_Call_Labels)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> False`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n' \\<oplus> #:c\\<^sub>1 + 1` `c\\<^sub>2 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p n'`\n    `n \\<noteq> Entry`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> nx -IEdge et\\<rightarrow>\\<^sub>p n'\"\n    apply - apply(erule Proc_CFG.cases,auto)\n        apply(cases n') apply(auto intro:Proc_CFG_Entry_Exit)\n       apply(cases n') apply(auto dest:Proc_CFG_Call_target_0)\n      apply(cases n') apply(auto dest:Proc_CFG_Call_target_0)\n     apply(cases n') apply auto\n      apply(case_tac n') apply(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n     apply(case_tac n') apply(auto dest:Proc_CFG_Call_Labels)\n    by(cases n',auto,case_tac n',auto)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_WhileBody c' n n' b)\n  note IH = `\\<And>n''. c' \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> False`\n  from `while (b) c' \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p n' \\<oplus> 2` `c' \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p n'`\n    `n \\<noteq> Entry` `n' \\<noteq> Exit`\n  obtain nx where \"c' \\<turnstile> nx -IEdge et\\<rightarrow>\\<^sub>p n'\"\n    apply - apply(erule Proc_CFG.cases,auto)\n      apply(cases n') apply(auto dest:Proc_CFG_Call_target_0)\n     apply(cases n') apply auto\n    by(cases n',auto,case_tac n',auto)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_WhileBodyExit c' n b)\n  from `c' \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p Exit`\n  show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n  case Proc_CFG_Call\n  from `Call p es rets \\<turnstile> n'' -IEdge et\\<rightarrow>\\<^sub>p Label 1`\n  show ?case by(fastforce elim:Proc_CFG.cases)\nqed\n\n\nlemma Proc_CFG_Call_nodes_eq:\n  \"\\<lbrakk>prog \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'; prog \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''\\<rbrakk>\n  \\<Longrightarrow> n' = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n  case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''\n    \\<Longrightarrow> n' = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'`\n  from `c\\<^sub>1;; c\\<^sub>2 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''` `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n  have \"c\\<^sub>1 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''\"\n    apply - apply(erule Proc_CFG.cases,auto)\n     apply(fastforce dest:Proc_CFG_Call_Labels)\n    by(case_tac n,(fastforce dest:Proc_CFG_sourcelabel_less_num_nodes)+)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n  from `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p Exit` have False\n    by(fastforce dest:Proc_CFG_Call_Labels)\n  thus ?case by simp\nnext\n  case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''\n    \\<Longrightarrow> n' = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n \\<oplus> #:c\\<^sub>1 -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''` `n \\<noteq> Entry`\n  obtain nx where edge:\"c\\<^sub>2 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx\" and nx:\"nx \\<oplus> #:c\\<^sub>1 = n''\"\n    apply - apply(erule Proc_CFG.cases,auto)\n    by(cases n,auto dest:Proc_CFG_sourcelabel_less_num_nodes label_incr_inj)+\n  from edge have \"n' = nx \\<and> p = p' \\<and> es = es' \\<and> rets = rets'\" by (rule IH)\n  with nx show ?case by auto\nnext\n  case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''\n    \\<Longrightarrow> n' = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n \\<oplus> 1 -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''`\n  obtain nx where \"c\\<^sub>1 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx \\<and> nx \\<oplus> 1 = n''\"\n  proof(rule Proc_CFG.cases)\n    fix c\\<^sub>2' nx etx nx' bx c\\<^sub>1'\n    assume \"if (b) c\\<^sub>1 else c\\<^sub>2 = if (bx) c\\<^sub>1' else c\\<^sub>2'\"\n      and \"n \\<oplus> 1 = nx \\<oplus> #:c\\<^sub>1' + 1\" and \"nx \\<noteq> Entry\"\n    with `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'` obtain l where \"n = Label l\" and \"l \\<ge> #:c\\<^sub>1\"\n      by(cases n,auto,cases nx,auto)\n    with `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'` have False\n      by(fastforce dest:Proc_CFG_sourcelabel_less_num_nodes)\n    thus ?thesis by simp\n  qed (auto dest:label_incr_inj)\n  then obtain nx where edge:\"c\\<^sub>1 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx\" \n    and nx:\"nx \\<oplus> 1 = n''\" by blast\n  from IH[OF edge] nx show ?case by simp\nnext\n  case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''\n    \\<Longrightarrow> n' = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n \\<oplus> #:c\\<^sub>1 + 1 -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx \\<and> nx \\<oplus> #:c\\<^sub>1 + 1 = n''\"\n  proof(rule Proc_CFG.cases)\n    fix c\\<^sub>1' nx etx nx' bx c\\<^sub>2'\n    assume ifs:\"if (b) c\\<^sub>1 else c\\<^sub>2 = if (bx) c\\<^sub>1' else c\\<^sub>2'\"\n      and \"n \\<oplus> #:c\\<^sub>1 + 1 = nx \\<oplus> 1\" and \"nx \\<noteq> Entry\"\n      and edge:\"c\\<^sub>1' \\<turnstile> nx -etx\\<rightarrow>\\<^sub>p nx'\"\n    then obtain l where \"nx = Label l\" and \"l \\<ge> #:c\\<^sub>1\"\n      by(cases n,auto,cases nx,auto)\n    with edge ifs have False\n      by(fastforce dest:Proc_CFG_sourcelabel_less_num_nodes)\n    thus ?thesis by simp\n  qed (auto dest:label_incr_inj)\n  then obtain nx where edge:\"c\\<^sub>2 \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx\"\n    and nx:\"nx \\<oplus> #:c\\<^sub>1 + 1 = n''\"\n    by blast\n  from IH[OF edge] nx show ?case by simp\nnext\n  case (Proc_CFG_WhileBody c' n n' b)\n  note IH = `\\<And>n''. c' \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''\n    \\<Longrightarrow> n' = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'`\n  from `while (b) c' \\<turnstile> n \\<oplus> 2 -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''`\n  obtain nx where \"c' \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx \\<and> nx \\<oplus> 2 = n''\"\n    by(rule Proc_CFG.cases,auto dest:label_incr_inj Proc_CFG_Call_Labels)\n  then obtain nx where edge:\"c' \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx\" \n    and nx:\"nx \\<oplus> 2 = n''\" by blast\n  from IH[OF edge] nx show ?case by simp\nnext\n  case (Proc_CFG_WhileBodyExit c' n b)\n  from `c' \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p Exit` have False\n    by(fastforce dest:Proc_CFG_Call_Labels)\n  thus ?case by simp\nnext\n  case Proc_CFG_Call\n  from `Call p es rets \\<turnstile> Label 0 -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''`\n  have \"p = p' \\<and> es = es' \\<and> rets = rets' \\<and> n'' = Label 1\"\n    by(auto elim:Proc_CFG.cases)\n  then show ?case by simp\nqed\n\n\nlemma Proc_CFG_Call_nodes_eq':\n  \"\\<lbrakk>prog \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'; prog \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\\<rbrakk>\n  \\<Longrightarrow> n = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n  case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\n    \\<Longrightarrow> n = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'` `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n  have \"c\\<^sub>1 \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\"\n    apply - apply(erule Proc_CFG.cases,auto)\n     apply(fastforce dest:Proc_CFG_Call_Labels)\n    by(case_tac n',auto dest:Proc_CFG_targetlabel_less_num_nodes Proc_CFG_Call_Labels)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n  from `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p Exit` have False\n    by(fastforce dest:Proc_CFG_Call_Labels)\n  thus ?case by simp\nnext\n  case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\n    \\<Longrightarrow> n = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n' \\<oplus> #:c\\<^sub>1`\n  obtain nx where edge:\"c\\<^sub>2 \\<turnstile> nx -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\" and nx:\"nx \\<oplus> #:c\\<^sub>1 = n''\"\n    apply - apply(erule Proc_CFG.cases,auto)\n    by(cases n',\n       auto dest:Proc_CFG_targetlabel_less_num_nodes Proc_CFG_Call_Labels \n                 label_incr_inj)\n  from edge have \"n = nx \\<and> p = p' \\<and> es = es' \\<and> rets = rets'\" by (rule IH)\n  with nx show ?case by auto\nnext\n  case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\n    \\<Longrightarrow> n = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n' \\<oplus> 1`\n  obtain nx where \"c\\<^sub>1 \\<turnstile> nx -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n' \\<and> nx \\<oplus> 1 = n''\"\n  proof(cases)\n    case (Proc_CFG_CondElse nx nx')\n    from `n' \\<oplus> 1 = nx' \\<oplus> #:c\\<^sub>1 + 1`\n      `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n    obtain l where \"n' = Label l\" and \"l \\<ge> #:c\\<^sub>1\"\n      by(cases n', auto dest:Proc_CFG_Call_Labels,cases nx',auto)\n    with `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'` have False\n      by(fastforce dest:Proc_CFG_targetlabel_less_num_nodes)\n    thus ?thesis by simp\n  qed (auto dest:label_incr_inj)\n  then obtain nx where edge:\"c\\<^sub>1 \\<turnstile> nx -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\" \n    and nx:\"nx \\<oplus> 1 = n''\"\n    by blast\n  from IH[OF edge] nx show ?case by simp\nnext\n  case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\n    \\<Longrightarrow> n = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n' \\<oplus> #:c\\<^sub>1 + 1`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> nx -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n' \\<and> nx \\<oplus> #:c\\<^sub>1 + 1 = n''\"\n  proof(cases)\n    case (Proc_CFG_CondThen nx nx')\n    from `n' \\<oplus> #:c\\<^sub>1 + 1 = nx' \\<oplus> 1`\n      `c\\<^sub>1 \\<turnstile> nx -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx'`\n    obtain l where \"nx' = Label l\" and \"l \\<ge> #:c\\<^sub>1\"\n      by(cases n',auto,cases nx',auto dest:Proc_CFG_Call_Labels)\n    with `c\\<^sub>1 \\<turnstile> nx -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx'`\n    have False by(fastforce dest:Proc_CFG_targetlabel_less_num_nodes)\n    thus ?thesis by simp\n  qed (auto dest:label_incr_inj)\n  then obtain nx where edge:\"c\\<^sub>2 \\<turnstile> nx -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\" \n    and nx:\"nx \\<oplus> #:c\\<^sub>1 + 1 = n''\"\n    by blast\n  from IH[OF edge] nx show ?case by simp\nnext\n  case (Proc_CFG_WhileBody c' n n' b)\n  note IH = `\\<And>n''. c' \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\n    \\<Longrightarrow> n = n'' \\<and> p = p' \\<and> es = es' \\<and> rets = rets'`\n  from `while (b) c' \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n' \\<oplus> 2`\n  obtain nx where edge:\"c' \\<turnstile> nx -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'\" and nx:\"nx \\<oplus> 2 = n''\"\n    by(rule Proc_CFG.cases,auto dest:label_incr_inj)\n  from IH[OF edge] nx show ?case by simp\nnext\n  case (Proc_CFG_WhileBodyExit c' n b)\n  from `c' \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p Exit`\n  have False by(fastforce dest:Proc_CFG_Call_Labels)\n  thus ?case by simp\nnext\n  case Proc_CFG_Call\n  from `Call p es rets \\<turnstile> n'' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p Label 1`\n  have \"p = p' \\<and> es = es' \\<and> rets = rets' \\<and> n'' = Label 0\"\n    by(auto elim:Proc_CFG.cases)\n  then show ?case by simp\nqed\n\n\nlemma Proc_CFG_Call_targetnode_no_Call_sourcenode:\n  \"\\<lbrakk>prog \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'; prog \\<turnstile> n' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''\\<rbrakk> \n  \\<Longrightarrow> False\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n  case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n' -CEdge (p', es', rets')\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> False`\n  from `c\\<^sub>1;; c\\<^sub>2 \\<turnstile> n' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''` `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n  have \"c\\<^sub>1 \\<turnstile> n' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n''\"\n    apply - apply(erule Proc_CFG.cases,auto)\n     apply(fastforce dest:Proc_CFG_Call_Labels)\n    by(case_tac n)(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n  from `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p Exit` have False\n    by(fastforce dest:Proc_CFG_Call_Labels)\n  thus ?case by simp\nnext\n  case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n' -CEdge (p', es', rets')\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> False`\n  from `c\\<^sub>1;; c\\<^sub>2 \\<turnstile> n' \\<oplus> #:c\\<^sub>1 -CEdge (p', es', rets')\\<rightarrow>\\<^sub>p n''` `c\\<^sub>2 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> n' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n      apply(cases n') apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n     apply(fastforce dest:Proc_CFG_Call_Labels)\n    by(cases n',auto,case_tac n,auto)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> False`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n' \\<oplus> 1 -CEdge (p', es', rets')\\<rightarrow>\\<^sub>p n''` `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n  obtain nx where \"c\\<^sub>1 \\<turnstile> n' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n     apply(cases n') apply auto apply(case_tac n) apply auto\n    apply(cases n') apply auto\n    by(case_tac n)(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> False`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n' \\<oplus> #:c\\<^sub>1 + 1 -CEdge (p', es', rets')\\<rightarrow>\\<^sub>p n''` \n    `c\\<^sub>2 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> n' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n     apply(cases n') apply auto\n     apply(case_tac n) apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n    by(cases n',auto,case_tac n,auto)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_WhileBody c' n n' b)\n  note IH = `\\<And>n''. c' \\<turnstile> n' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> False`\n  from `while (b) c' \\<turnstile> n' \\<oplus> 2 -CEdge (p', es', rets')\\<rightarrow>\\<^sub>p n''` `c' \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n  obtain nx where \"c' \\<turnstile> n' -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n    by(cases n',auto,case_tac n,auto)+\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_WhileBodyExit c' n b)\n  from `c' \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p Exit` \n  show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n  case Proc_CFG_Call\n  from `Call p es rets \\<turnstile> Label 1 -CEdge (p', es', rets')\\<rightarrow>\\<^sub>p n''`\n  show ?case by(fastforce elim:Proc_CFG.cases)\nqed\n\n\nlemma Proc_CFG_Call_follows_id_edge:\n  \"\\<lbrakk>prog \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'; prog \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p n''\\<rbrakk> \\<Longrightarrow> et = \\<Up>id\"\nproof(induct prog n \"CEdge (p,es,rets)\" n' arbitrary:n'' rule:Proc_CFG.induct)\n  case (Proc_CFG_SeqFirst c\\<^sub>1 n n' c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> et = \\<Up>id`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p n''` `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'` `n' \\<noteq> Exit`\n  obtain nx where \"c\\<^sub>1 \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n    by(case_tac n)(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_SeqConnect c\\<^sub>1 n c\\<^sub>2)\n  from `c\\<^sub>1 \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p Exit`\n  show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n  case (Proc_CFG_SeqSecond c\\<^sub>2 n n' c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> et = \\<Up>id`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n' \\<oplus> #:c\\<^sub>1 -IEdge et\\<rightarrow>\\<^sub>p n''` `c\\<^sub>2 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n      apply(cases n') apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n     apply(cases n') apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n    by(cases n',auto,case_tac n,auto)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_CondThen c\\<^sub>1 n n' b c\\<^sub>2)\n  note IH = `\\<And>n''. c\\<^sub>1 \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> et = \\<Up>id`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n' \\<oplus> 1 -IEdge et\\<rightarrow>\\<^sub>p n''` `c\\<^sub>1 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n    `n \\<noteq> Entry`\n  obtain nx where \"c\\<^sub>1 \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n     apply(cases n') apply auto apply(case_tac n) apply auto\n    apply(cases n') apply auto\n    by(case_tac n)(auto dest:Proc_CFG_targetlabel_less_num_nodes)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_CondElse c\\<^sub>2 n n' b c\\<^sub>1)\n  note IH = `\\<And>n''. c\\<^sub>2 \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> et = \\<Up>id`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n' \\<oplus> #:c\\<^sub>1 + 1 -IEdge et\\<rightarrow>\\<^sub>p n''` `c\\<^sub>2 \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n     apply(cases n') apply auto\n     apply(case_tac n) apply(auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n    by(cases n',auto,case_tac n,auto)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_WhileBody c' n n' b)\n  note IH = `\\<And>n''. c' \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p n'' \\<Longrightarrow> et = \\<Up>id`\n  from `while (b) c' \\<turnstile> n' \\<oplus> 2 -IEdge et\\<rightarrow>\\<^sub>p n''` `c' \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'`\n  obtain nx where \"c' \\<turnstile> n' -IEdge et\\<rightarrow>\\<^sub>p nx\"\n    apply - apply(erule Proc_CFG.cases,auto)\n      apply(cases n') apply auto\n     apply(cases n') apply auto apply(case_tac n) apply auto\n    by(cases n',auto,case_tac n,auto)\n  then show ?case by (rule IH)\nnext\n  case (Proc_CFG_WhileBodyExit c' n et' b)\n  from `c' \\<turnstile> n -CEdge (p, es, rets)\\<rightarrow>\\<^sub>p Exit` \n  show ?case by(fastforce dest:Proc_CFG_Call_Labels)\nnext\n  case Proc_CFG_Call\n  from `Call p es rets \\<turnstile> Label 1 -IEdge et\\<rightarrow>\\<^sub>p n''` show ?case\n    by(fastforce elim:Proc_CFG.cases)\nqed\n\n\nlemma Proc_CFG_edge_det:\n  \"\\<lbrakk>prog \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'; prog \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n'\\<rbrakk> \\<Longrightarrow> et = et'\"\nproof(induct rule:Proc_CFG.induct)\n  case Proc_CFG_Entry_Exit thus ?case by(fastforce dest:Proc_CFG_EntryD)\nnext\n  case Proc_CFG_Entry thus ?case by(fastforce dest:Proc_CFG_EntryD)\nnext\n  case Proc_CFG_Skip thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n  case Proc_CFG_LAss thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n  case Proc_CFG_LAssSkip thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n  case (Proc_CFG_SeqFirst c\\<^sub>1 n et n' c\\<^sub>2)\n  note edge = `c\\<^sub>1 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'` \n  note IH = `c\\<^sub>1 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> et = et'`\n  from edge `n' \\<noteq> Exit` obtain l where l:\"n' = Label l\" by (cases n') auto\n  with edge have \"l < #:c\\<^sub>1\" by(fastforce intro:Proc_CFG_targetlabel_less_num_nodes)\n  with `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n'` l have \"c\\<^sub>1 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n'\"\n    by(fastforce elim:Proc_CFG.cases intro:Proc_CFG.intros dest:label_incr_ge)\n  from IH[OF this] show ?case .\nnext\n  case (Proc_CFG_SeqConnect c\\<^sub>1 n et c\\<^sub>2)\n  note edge = `c\\<^sub>1 \\<turnstile> n -et\\<rightarrow>\\<^sub>p Exit`\n  note IH = `c\\<^sub>1 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p Exit \\<Longrightarrow> et = et'`\n  from edge `n \\<noteq> Entry` obtain l where l:\"n = Label l\" by (cases n) auto\n  with edge have \"l < #:c\\<^sub>1\" by(fastforce intro: Proc_CFG_sourcelabel_less_num_nodes)\n  with `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p Label #:c\\<^sub>1` l have \"c\\<^sub>1 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p Exit\"\n    by(fastforce elim:Proc_CFG.cases \n                dest:Proc_CFG_targetlabel_less_num_nodes label_incr_ge)\n  from IH[OF this] show ?case .\nnext\n  case (Proc_CFG_SeqSecond c\\<^sub>2 n et n' c\\<^sub>1)\n  note edge = `c\\<^sub>2 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'` \n  note IH = `c\\<^sub>2 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> et = et'`\n  from edge `n \\<noteq> Entry` obtain l where l:\"n = Label l\" by (cases n) auto\n  with edge have \"l < #:c\\<^sub>2\" by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n  with `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n \\<oplus> #:c\\<^sub>1 -et'\\<rightarrow>\\<^sub>p n' \\<oplus> #:c\\<^sub>1` l have \"c\\<^sub>2 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n'\"\n    by -(erule Proc_CFG.cases,\n    (fastforce dest:Proc_CFG_sourcelabel_less_num_nodes label_incr_ge\n              dest!:label_incr_inj)+)\n  from IH[OF this] show ?case .\nnext\n  case Proc_CFG_CondTrue thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n  case Proc_CFG_CondFalse thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n  case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2)\n  note edge = `c\\<^sub>1 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'`\n  note IH = `c\\<^sub>1 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> et = et'`\n  from edge `n \\<noteq> Entry` obtain l where l:\"n = Label l\" by (cases n) auto\n  with edge have \"l < #:c\\<^sub>1\" by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n  with `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n \\<oplus> 1 -et'\\<rightarrow>\\<^sub>p n' \\<oplus> 1` l have \"c\\<^sub>1 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n'\"\n    by -(erule Proc_CFG.cases,(fastforce dest:label_incr_ge label_incr_inj)+)\n  from IH[OF this] show ?case .\nnext\n  case (Proc_CFG_CondElse c\\<^sub>2 n et n' b c\\<^sub>1)\n  note edge = `c\\<^sub>2 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'`\n  note IH = `c\\<^sub>2 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> et = et'`\n  from edge `n \\<noteq> Entry` obtain l where l:\"n = Label l\" by (cases n) auto\n  with edge have \"l < #:c\\<^sub>2\" by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n  with `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n \\<oplus> (#:c\\<^sub>1 + 1) -et'\\<rightarrow>\\<^sub>p n' \\<oplus> (#:c\\<^sub>1 + 1)` l \n  have \"c\\<^sub>2 \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n'\"\n    by -(erule Proc_CFG.cases,(fastforce dest:Proc_CFG_sourcelabel_less_num_nodes \n                             label_incr_inj label_incr_ge label_incr_simp_rev)+)\n  from IH[OF this] show ?case .\nnext\n  case Proc_CFG_WhileTrue thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n  case Proc_CFG_WhileFalse thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n  case Proc_CFG_WhileFalseSkip thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n  case (Proc_CFG_WhileBody c' n et n' b)\n  note edge = `c' \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'`\n  note IH = `c' \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> et = et'`\n  from edge `n \\<noteq> Entry` obtain l where l:\"n = Label l\" by (cases n) auto\n  with edge have less:\"l < #:c'\" \n    by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n  from edge `n' \\<noteq> Exit` obtain l' where l':\"n' = Label l'\" by (cases n') auto\n  with edge have \"l' < #:c'\" by(fastforce intro:Proc_CFG_targetlabel_less_num_nodes)\n  with `while (b) c' \\<turnstile> n \\<oplus> 2 -et'\\<rightarrow>\\<^sub>p n' \\<oplus> 2` l less l' have \"c' \\<turnstile> n -et'\\<rightarrow>\\<^sub>p n'\"\n    by(fastforce elim:Proc_CFG.cases dest:label_incr_start_Node_smaller)\n  from IH[OF this] show ?case .\nnext\n  case (Proc_CFG_WhileBodyExit c' n et b)\n  note edge = `c' \\<turnstile> n -et\\<rightarrow>\\<^sub>p Exit`\n  note IH = `c' \\<turnstile> n -et'\\<rightarrow>\\<^sub>p Exit \\<Longrightarrow> et = et'`\n  from edge `n \\<noteq> Entry` obtain l where l:\"n = Label l\" by (cases n) auto\n  with edge have \"l < #:c'\" by(fastforce intro:Proc_CFG_sourcelabel_less_num_nodes)\n  with `while (b) c' \\<turnstile> n \\<oplus> 2 -et'\\<rightarrow>\\<^sub>p Label 0` l have \"c' \\<turnstile> n -et'\\<rightarrow>\\<^sub>p Exit\"\n    by -(erule Proc_CFG.cases,auto dest:label_incr_start_Node_smaller)\n  from IH[OF this] show ?case .\nnext\n  case Proc_CFG_Call thus ?case by(fastforce elim:Proc_CFG.cases)\nnext\n  case Proc_CFG_CallSkip thus ?case by(fastforce elim:Proc_CFG.cases)\nqed\n\n\nlemma WCFG_deterministic:\n  \"\\<lbrakk>prog \\<turnstile> n\\<^sub>1 -et\\<^sub>1\\<rightarrow>\\<^sub>p n\\<^sub>1'; prog \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'; n\\<^sub>1 = n\\<^sub>2; n\\<^sub>1' \\<noteq> n\\<^sub>2'\\<rbrakk>\n  \\<Longrightarrow> \\<exists>Q Q'. et\\<^sub>1 = IEdge (Q)\\<^sub>\\<surd> \\<and> et\\<^sub>2 = IEdge (Q')\\<^sub>\\<surd> \\<and> \n            (\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s))\"\nproof(induct arbitrary:n\\<^sub>2 n\\<^sub>2' rule:Proc_CFG.induct)\n  case (Proc_CFG_Entry_Exit prog)\n  from `prog \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `Entry = n\\<^sub>2` `Exit \\<noteq> n\\<^sub>2'`\n  have \"et\\<^sub>2 = IEdge (\\<lambda>s. True)\\<^sub>\\<surd>\" by(fastforce dest:Proc_CFG_EntryD)\n  thus ?case by simp\nnext\n  case (Proc_CFG_Entry prog)\n  from `prog \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `Entry = n\\<^sub>2` `Label 0 \\<noteq> n\\<^sub>2'`\n  have \"et\\<^sub>2 = IEdge (\\<lambda>s. False)\\<^sub>\\<surd>\" by(fastforce dest:Proc_CFG_EntryD)\n  thus ?case by simp\nnext\n  case Proc_CFG_Skip\n  from `Skip \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `Label 0 = n\\<^sub>2` `Exit \\<noteq> n\\<^sub>2'`\n  have False by(fastforce elim:Proc_CFG.cases)\n  thus ?case by simp\nnext\n  case (Proc_CFG_LAss V e)\n  from `V:=e \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `Label 0 = n\\<^sub>2` `Label 1 \\<noteq> n\\<^sub>2'`\n  have False by -(erule Proc_CFG.cases,auto)\n  thus ?case by simp\nnext\n  case (Proc_CFG_LAssSkip V e)\n  from `V:=e \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `Label 1 = n\\<^sub>2` `Exit \\<noteq> n\\<^sub>2'`\n  have False by -(erule Proc_CFG.cases,auto)\n  thus ?case by simp\nnext\n  case (Proc_CFG_SeqFirst c\\<^sub>1 n et n' c\\<^sub>2)\n  note IH = `\\<And>n\\<^sub>2 n\\<^sub>2'. \\<lbrakk>c\\<^sub>1 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; n' \\<noteq> n\\<^sub>2'\\<rbrakk>\n  \\<Longrightarrow> \\<exists>Q Q'. et = IEdge (Q)\\<^sub>\\<surd> \\<and> et\\<^sub>2 = IEdge (Q')\\<^sub>\\<surd> \\<and> \n            (\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s))`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `c\\<^sub>1 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'` `n = n\\<^sub>2` `n' \\<noteq> n\\<^sub>2'`\n  have \"c\\<^sub>1 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2' \\<or> (c\\<^sub>1 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p Exit \\<and> n\\<^sub>2' = Label #:c\\<^sub>1)\"\n    apply hypsubst_thin apply(erule Proc_CFG.cases)\n    apply(auto intro:Proc_CFG.intros)\n    by(case_tac n,auto dest:Proc_CFG_sourcelabel_less_num_nodes)+\n  thus ?case\n  proof\n    assume \"c\\<^sub>1 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'\"\n    from IH[OF this `n = n\\<^sub>2` `n' \\<noteq> n\\<^sub>2'`] show ?case .\n  next\n    assume \"c\\<^sub>1 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p Exit \\<and> n\\<^sub>2' = Label #:c\\<^sub>1\"\n    hence edge:\"c\\<^sub>1 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p Exit\" and n2':\"n\\<^sub>2' = Label #:c\\<^sub>1\" by simp_all\n    from IH[OF edge `n = n\\<^sub>2` `n' \\<noteq> Exit`] show ?case .\n  qed\nnext\n  case (Proc_CFG_SeqConnect c\\<^sub>1 n et c\\<^sub>2)\n  note IH = `\\<And>n\\<^sub>2 n\\<^sub>2'. \\<lbrakk>c\\<^sub>1 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; Exit \\<noteq> n\\<^sub>2'\\<rbrakk>\n  \\<Longrightarrow> \\<exists>Q Q'. et = IEdge (Q)\\<^sub>\\<surd> \\<and> et\\<^sub>2 = IEdge (Q')\\<^sub>\\<surd> \\<and> \n            (\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s))`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `c\\<^sub>1 \\<turnstile> n -et\\<rightarrow>\\<^sub>p Exit` `n = n\\<^sub>2` `n \\<noteq> Entry`\n    `Label #:c\\<^sub>1 \\<noteq> n\\<^sub>2'` have \"c\\<^sub>1 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2' \\<and> Exit \\<noteq> n\\<^sub>2'\"\n    apply hypsubst_thin apply(erule Proc_CFG.cases)\n    apply(auto intro:Proc_CFG.intros)\n    by(case_tac n,auto dest:Proc_CFG_sourcelabel_less_num_nodes)+\n  from IH[OF this[THEN conjunct1] `n = n\\<^sub>2` this[THEN conjunct2]]\n  show ?case .\nnext\n  case (Proc_CFG_SeqSecond c\\<^sub>2 n et n' c\\<^sub>1)\n  note IH = `\\<And>n\\<^sub>2 n\\<^sub>2'. \\<lbrakk>c\\<^sub>2 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; n' \\<noteq> n\\<^sub>2'\\<rbrakk>\n  \\<Longrightarrow> \\<exists>Q Q'. et = IEdge (Q)\\<^sub>\\<surd> \\<and> et\\<^sub>2 = IEdge (Q')\\<^sub>\\<surd> \\<and> \n            (\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s))`\n  from `c\\<^sub>1;;c\\<^sub>2 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `c\\<^sub>2 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'` `n \\<oplus> #:c\\<^sub>1 = n\\<^sub>2`\n    `n' \\<oplus> #:c\\<^sub>1 \\<noteq> n\\<^sub>2'` `n \\<noteq> Entry`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> n -et\\<^sub>2\\<rightarrow>\\<^sub>p nx \\<and> nx \\<oplus> #:c\\<^sub>1 = n\\<^sub>2'\"\n    apply - apply(erule Proc_CFG.cases)\n    apply(auto intro:Proc_CFG.intros)\n      apply(cases n,auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n     apply(cases n,auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n    by(fastforce dest:label_incr_inj)\n  with `n' \\<oplus> #:c\\<^sub>1 \\<noteq> n\\<^sub>2'` have edge:\"c\\<^sub>2 \\<turnstile> n -et\\<^sub>2\\<rightarrow>\\<^sub>p nx\" and neq:\"n' \\<noteq> nx\"\n    by auto\n  from IH[OF edge _ neq] show ?case by simp\nnext\n  case (Proc_CFG_CondTrue b c\\<^sub>1 c\\<^sub>2)\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `Label 0 = n\\<^sub>2` `Label 1 \\<noteq> n\\<^sub>2'`\n  show ?case by -(erule Proc_CFG.cases,auto)\nnext\n  case (Proc_CFG_CondFalse b c\\<^sub>1 c\\<^sub>2)\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `Label 0 = n\\<^sub>2` `Label (#:c\\<^sub>1 + 1) \\<noteq> n\\<^sub>2'`\n  show ?case by -(erule Proc_CFG.cases,auto)\nnext\n  case (Proc_CFG_CondThen c\\<^sub>1 n et n' b c\\<^sub>2)\n  note IH = `\\<And>n\\<^sub>2 n\\<^sub>2'. \\<lbrakk>c\\<^sub>1 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; n' \\<noteq> n\\<^sub>2'\\<rbrakk>\n    \\<Longrightarrow> \\<exists>Q Q'. et = IEdge (Q)\\<^sub>\\<surd> \\<and> et\\<^sub>2 = IEdge (Q')\\<^sub>\\<surd> \\<and> \n              (\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s))`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `c\\<^sub>1 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'` `n \\<noteq> Entry` \n    `n \\<oplus> 1 = n\\<^sub>2` `n' \\<oplus> 1 \\<noteq> n\\<^sub>2'`\n  obtain nx where \"c\\<^sub>1 \\<turnstile> n -et\\<^sub>2\\<rightarrow>\\<^sub>p nx \\<and> n' \\<noteq> nx\"\n    apply - apply(erule Proc_CFG.cases)\n    apply(auto intro:Proc_CFG.intros simp del:One_nat_def)\n     apply(drule label_incr_inj) apply(auto simp del:One_nat_def)\n    apply(drule label_incr_simp_rev[OF sym])\n    by(case_tac na,auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n  from IH[OF this[THEN conjunct1] _ this[THEN conjunct2]] show ?case by simp\nnext\n  case (Proc_CFG_CondElse c\\<^sub>2 n et n' b c\\<^sub>1)\n  note IH = `\\<And>n\\<^sub>2 n\\<^sub>2'. \\<lbrakk>c\\<^sub>2 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; n' \\<noteq> n\\<^sub>2'\\<rbrakk>\n    \\<Longrightarrow> \\<exists>Q Q'. et = IEdge (Q)\\<^sub>\\<surd> \\<and> et\\<^sub>2 = IEdge (Q')\\<^sub>\\<surd> \\<and> \n              (\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s))`\n  from `if (b) c\\<^sub>1 else c\\<^sub>2 \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `c\\<^sub>2 \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'` `n \\<noteq> Entry` \n    `n \\<oplus> #:c\\<^sub>1 + 1 = n\\<^sub>2` `n' \\<oplus> #:c\\<^sub>1 + 1 \\<noteq> n\\<^sub>2'`\n  obtain nx where \"c\\<^sub>2 \\<turnstile> n -et\\<^sub>2\\<rightarrow>\\<^sub>p nx \\<and> n' \\<noteq> nx\"\n    apply - apply(erule Proc_CFG.cases)\n    apply(auto intro:Proc_CFG.intros simp del:One_nat_def)\n     apply(drule label_incr_simp_rev)\n     apply(case_tac na,auto,cases n,auto dest:Proc_CFG_sourcelabel_less_num_nodes)\n    by(fastforce dest:label_incr_inj)\n  from IH[OF this[THEN conjunct1] _ this[THEN conjunct2]] show ?case by simp\nnext\n  case (Proc_CFG_WhileTrue b c')\n  from `while (b) c' \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `Label 0 = n\\<^sub>2` `Label 2 \\<noteq> n\\<^sub>2'`\n  show ?case by -(erule Proc_CFG.cases,auto)\nnext\n  case (Proc_CFG_WhileFalse b c')\n  from `while (b) c' \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `Label 0 = n\\<^sub>2` `Label 1 \\<noteq> n\\<^sub>2'`\n  show ?case by -(erule Proc_CFG.cases,auto)\nnext\n  case (Proc_CFG_WhileFalseSkip b c')\n  from `while (b) c' \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `Label 1 = n\\<^sub>2` `Exit \\<noteq> n\\<^sub>2'`\n  show ?case by -(erule Proc_CFG.cases,auto dest:label_incr_ge)\nnext\n  case (Proc_CFG_WhileBody c' n et n' b)\n  note IH = `\\<And>n\\<^sub>2 n\\<^sub>2'. \\<lbrakk>c' \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; n' \\<noteq> n\\<^sub>2'\\<rbrakk>\n    \\<Longrightarrow> \\<exists>Q Q'. et = IEdge (Q)\\<^sub>\\<surd> \\<and> et\\<^sub>2 = IEdge (Q')\\<^sub>\\<surd> \\<and> \n              (\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s))`\n  from `while (b) c' \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `c' \\<turnstile> n -et\\<rightarrow>\\<^sub>p n'` `n \\<noteq> Entry`\n    `n' \\<noteq> Exit` `n \\<oplus> 2 = n\\<^sub>2` `n' \\<oplus> 2 \\<noteq> n\\<^sub>2'`\n  obtain nx where \"c' \\<turnstile> n -et\\<^sub>2\\<rightarrow>\\<^sub>p nx \\<and> n' \\<noteq> nx\"\n    apply - apply(erule Proc_CFG.cases)\n    apply(auto intro:Proc_CFG.intros)\n      apply(fastforce dest:label_incr_ge[OF sym])\n     apply(fastforce dest:label_incr_inj)\n    by(fastforce dest:label_incr_inj)\n  from IH[OF this[THEN conjunct1] _ this[THEN conjunct2]] show ?case by simp\nnext\n  case (Proc_CFG_WhileBodyExit c' n et b)\n  note IH = `\\<And>n\\<^sub>2 n\\<^sub>2'. \\<lbrakk>c' \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'; n = n\\<^sub>2; Exit \\<noteq> n\\<^sub>2'\\<rbrakk>\n    \\<Longrightarrow> \\<exists>Q Q'. et = IEdge (Q)\\<^sub>\\<surd> \\<and> et\\<^sub>2 = IEdge (Q')\\<^sub>\\<surd> \\<and> \n              (\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s))`\n  from `while (b) c' \\<turnstile> n\\<^sub>2 -et\\<^sub>2\\<rightarrow>\\<^sub>p n\\<^sub>2'` `c' \\<turnstile> n -et\\<rightarrow>\\<^sub>p Exit` `n \\<noteq> Entry`\n    `n \\<oplus> 2 = n\\<^sub>2` `Label 0 \\<noteq> n\\<^sub>2'`\n  obtain nx where \"c' \\<turnstile> n -et\\<^sub>2\\<rightarrow>\\<^sub>p nx \\<and> Exit \\<noteq> nx\"\n    apply - apply(erule Proc_CFG.cases)\n    apply(auto intro:Proc_CFG.intros)\n     apply(fastforce dest:label_incr_ge[OF sym])\n    by(fastforce dest:label_incr_inj)\n  from IH[OF this[THEN conjunct1] _ this[THEN conjunct2]] show ?case by simp\nnext\n  case Proc_CFG_Call thus ?case by -(erule Proc_CFG.cases,auto)\nnext\n  case Proc_CFG_CallSkip thus ?case by -(erule Proc_CFG.cases,auto)\nqed\n\n\nsubsection {* And now: the interprocedural CFG *}\n\nsubsubsection {* Statements containing calls *}\n\ntext {* A procedure is a tuple composed of its name, its input and output variables\n  and its method body *}\n\ntype_synonym proc = \"(pname \\<times> vname list \\<times> vname list \\<times> cmd)\"\ntype_synonym procs = \"proc list\"\n\n\ntext {* @{text \"containsCall\"} guarantees that a call to procedure p is in\n  a certain statement. *}\n\ndeclare conj_cong[fundef_cong]\n\nfunction containsCall :: \n  \"procs \\<Rightarrow> cmd \\<Rightarrow> pname list \\<Rightarrow> pname \\<Rightarrow> bool\"\nwhere \"containsCall procs Skip ps p \\<longleftrightarrow> False\"\n  | \"containsCall procs (V:=e) ps p \\<longleftrightarrow> False\"\n  | \"containsCall procs (c\\<^sub>1;;c\\<^sub>2) ps p \\<longleftrightarrow> \n       containsCall procs c\\<^sub>1 ps p \\<or> containsCall procs c\\<^sub>2 ps p\"\n  | \"containsCall procs (if (b) c\\<^sub>1 else c\\<^sub>2) ps p \\<longleftrightarrow> \n       containsCall procs c\\<^sub>1 ps p \\<or> containsCall procs c\\<^sub>2 ps p\"\n  | \"containsCall procs (while (b) c) ps p \\<longleftrightarrow> \n       containsCall procs c ps p\"\n  | \"containsCall procs (Call q es' rets') ps p \\<longleftrightarrow> p = q \\<and> ps = [] \\<or> \n       (\\<exists>ins outs c ps'. ps = q#ps' \\<and> (q,ins,outs,c) \\<in> set procs \\<and>\n                     containsCall procs c ps' p)\"\nby pat_completeness auto\ntermination containsCall\nby(relation \"measures [\\<lambda>(procs,c,ps,p). length ps, \n  \\<lambda>(procs,c,ps,p). size c]\") auto\n\n\nlemmas containsCall_induct[case_names Skip LAss Seq Cond While Call] = \n  containsCall.induct\n\n\nlemma containsCallcases: \n  \"containsCall procs prog ps p\n  \\<Longrightarrow> ps = [] \\<and> containsCall procs prog ps p \\<or> \n  (\\<exists>q ins outs c ps'. ps = ps'@[q] \\<and> (q,ins,outs,c) \\<in> set procs \\<and>\n  containsCall procs c [] p \\<and> containsCall procs prog ps' q)\"\nproof(induct procs prog ps p rule:containsCall_induct)\n  case (Call procs q es' rets' ps p)\n  note IH = `\\<And>x y z ps'. \\<lbrakk>ps = q#ps'; (q,x,y,z) \\<in> set procs;\n    containsCall procs z ps' p\\<rbrakk>\n    \\<Longrightarrow> ps' = [] \\<and> containsCall procs z ps' p \\<or> \n    (\\<exists>qx ins outs c psx. ps' = psx@[qx] \\<and> (qx,ins,outs,c) \\<in> set procs \\<and>\n    containsCall procs c [] p \\<and> \n    containsCall procs z psx qx)`\n  from `containsCall procs (Call q es' rets') ps p`\n  have \"p = q \\<and> ps = [] \\<or> \n    (\\<exists>ins outs c ps'. ps = q#ps' \\<and> (q,ins,outs,c) \\<in> set procs \\<and>\n                  containsCall procs c ps' p)\" by simp\n  thus ?case\n  proof\n    assume assms:\"p = q \\<and> ps = []\"\n    hence \"containsCall procs (Call q es' rets') ps p\" by simp\n    with assms show ?thesis by simp\n  next\n    assume \"\\<exists>ins outs c ps'. ps = q#ps' \\<and> (q,ins,outs,c) \\<in> set procs \\<and>\n      containsCall procs c ps' p\"\n    then obtain ins outs c ps' where \"ps = q#ps'\" and \"(q,ins,outs,c) \\<in> set procs\"\n      and \"containsCall procs c ps' p\" by blast\n    from IH[OF this] have \"ps' = [] \\<and> containsCall procs c ps' p \\<or>\n      (\\<exists>qx insx outsx cx psx. \n         ps' = psx @ [qx] \\<and> (qx,insx,outsx,cx) \\<in> set procs \\<and>\n         containsCall procs cx [] p \\<and> containsCall procs c psx qx)\" .\n    thus ?thesis\n    proof\n      assume assms:\"ps' = [] \\<and> containsCall procs c ps' p\"\n      have \"containsCall procs (Call q es' rets') [] q\" by simp\n      with assms `ps = q#ps'` `(q,ins,outs,c) \\<in> set procs` show ?thesis by fastforce\n    next\n      assume \"\\<exists>qx insx outsx cx psx. \n        ps' = psx@[qx] \\<and> (qx,insx,outsx,cx) \\<in> set procs \\<and>\n        containsCall procs cx [] p \\<and> containsCall procs c psx qx\"\n      then obtain qx insx outsx cx psx\n        where \"ps' = psx@[qx]\" and \"(qx,insx,outsx,cx) \\<in> set procs\"\n        and \"containsCall procs cx [] p\"\n        and \"containsCall procs c psx qx\" by blast\n      from `(q,ins,outs,c) \\<in> set procs` `containsCall procs c psx qx`\n      have \"containsCall procs (Call q es' rets') (q#psx) qx\" by fastforce\n      with `ps' = psx@[qx]` `ps = q#ps'` `(qx,insx,outsx,cx) \\<in> set procs`\n        `containsCall procs cx [] p` show ?thesis by fastforce\n    qed\n  qed\nqed auto\n\n\n\nlemma containsCallE:\n  \"\\<lbrakk>containsCall procs prog ps p; \n    \\<lbrakk>ps = []; containsCall procs prog ps p\\<rbrakk> \\<Longrightarrow> P procs prog ps p;\n    \\<And>q ins outs c es' rets' ps'. \\<lbrakk>ps = ps'@[q]; (q,ins,outs,c) \\<in> set procs; \n      containsCall procs c [] p; containsCall procs prog ps' q\\<rbrakk> \n     \\<Longrightarrow> P procs prog ps p\\<rbrakk> \\<Longrightarrow> P procs prog ps p\"\n  by(auto dest:containsCallcases)\n\n\nlemma containsCall_in_proc: \n  \"\\<lbrakk>containsCall procs prog qs q; (q,ins,outs,c) \\<in> set procs; \n  containsCall procs c [] p\\<rbrakk>\n  \\<Longrightarrow> containsCall procs prog (qs@[q]) p\"\nproof(induct procs prog qs q rule:containsCall_induct)\n  case (Call procs qx esx retsx ps p')\n  note IH = `\\<And>x y z psx. \\<lbrakk>ps = qx#psx; (qx,x,y,z) \\<in> set procs;\n    containsCall procs z psx p'; (p',ins,outs,c) \\<in> set procs; \n    containsCall procs c [] p\\<rbrakk> \\<Longrightarrow> containsCall procs z (psx@[p']) p`\n  from `containsCall procs (Call qx esx retsx) ps p'`\n  have \"p' = qx \\<and> ps = [] \\<or>\n    (\\<exists>insx outsx cx psx. ps = qx#psx \\<and> (qx,insx,outsx,cx) \\<in> set procs \\<and>\n    containsCall procs cx psx p')\" by simp\n  thus ?case\n  proof\n    assume assms:\"p' = qx \\<and> ps = []\"\n    with `(p', ins, outs, c) \\<in> set procs` `containsCall procs c [] p`\n    have \"containsCall procs (Call qx esx retsx) [p'] p\" by fastforce\n    with assms show ?thesis by simp\n  next\n    assume \"\\<exists>insx outsx cx psx. ps = qx#psx \\<and> (qx,insx,outsx,cx) \\<in> set procs \\<and>\n      containsCall procs cx psx p'\"\n    then obtain insx outsx cx psx where \"ps = qx#psx\" \n      and \"(qx,insx,outsx,cx) \\<in> set procs\"\n      and \"containsCall procs cx psx p'\" by blast\n    from IH[OF this `(p', ins, outs, c) \\<in> set procs` \n      `containsCall procs c [] p`] \n    have \"containsCall procs cx (psx @ [p']) p\" .\n    with `ps = qx#psx` `(qx,insx,outsx,cx) \\<in> set procs`\n    show ?thesis by fastforce\n  qed\nqed auto\n    \n\nlemma containsCall_indirection:\n  \"\\<lbrakk>containsCall procs prog qs q; containsCall procs c ps p;\n  (q,ins,outs,c) \\<in> set procs\\<rbrakk>\n  \\<Longrightarrow> containsCall procs prog (qs@q#ps) p\"\nproof(induct procs prog qs q rule:containsCall_induct)\n  case (Call procs px esx retsx ps' p')\n  note IH = `\\<And>x y z psx. \\<lbrakk>ps' = px # psx; (px, x, y, z) \\<in> set procs;\n    containsCall procs z psx p'; containsCall procs c ps p;\n    (p', ins, outs, c) \\<in> set procs\\<rbrakk>\n    \\<Longrightarrow> containsCall procs z (psx @ p' # ps) p`\n  from `containsCall procs (Call px esx retsx) ps' p'`\n  have \"p' = px \\<and> ps' = [] \\<or>\n    (\\<exists>insx outsx cx psx. ps' = px#psx \\<and> (px,insx,outsx,cx) \\<in> set procs \\<and>\n    containsCall procs cx psx p')\" by simp\n  thus ?case\n  proof\n    assume \"p' = px \\<and> ps' = []\"\n    with `containsCall procs c ps p` `(p', ins, outs, c) \\<in> set procs`\n    show ?thesis by fastforce\n  next\n    assume \"\\<exists>insx outsx cx psx. ps' = px#psx \\<and> (px,insx,outsx,cx) \\<in> set procs \\<and>\n      containsCall procs cx psx p'\"\n    then obtain insx outsx cx psx where \"ps' = px#psx\" \n      and \"(px,insx,outsx,cx) \\<in> set procs\"\n      and \"containsCall procs cx psx p'\" by blast\n    from IH[OF this `containsCall procs c ps p`\n      `(p', ins, outs, c) \\<in> set procs`] \n    have \"containsCall procs cx (psx @ p' # ps) p\" .\n    with `ps' = px#psx` `(px,insx,outsx,cx) \\<in> set procs`\n    show ?thesis by fastforce\n  qed\nqed auto\n\n\nlemma Proc_CFG_Call_containsCall:\n  \"prog \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> containsCall procs prog [] p\"\nby(induct prog n et\\<equiv>\"CEdge (p,es,rets)\" n' rule:Proc_CFG.induct,auto)\n\n\nlemma containsCall_empty_Proc_CFG_Call_edge: \n  assumes \"containsCall procs prog [] p\"\n  obtains l es rets l' where \"prog \\<turnstile> Label l -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p Label l'\"\nproof(atomize_elim)\n  from `containsCall procs prog [] p`\n  show \"\\<exists>l es rets l'. prog \\<turnstile> Label l -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p Label l'\"\n  proof(induct procs prog ps\\<equiv>\"[]::pname list\" p rule:containsCall_induct)\n    case Seq thus ?case\n      by auto(fastforce dest:Proc_CFG_SeqFirst,fastforce dest:Proc_CFG_SeqSecond)\n  next\n    case Cond thus ?case\n      by auto(fastforce dest:Proc_CFG_CondThen,fastforce dest:Proc_CFG_CondElse)\n  next\n    case While thus ?case by(fastforce dest:Proc_CFG_WhileBody)\n  next\n    case Call thus ?case by(fastforce intro:Proc_CFG_Call)\n  qed auto\nqed\n\n\nsubsubsection{* The edges of the combined CFG *}\n\ntype_synonym node = \"(pname \\<times> label)\"\ntype_synonym edge = \"(node \\<times> (vname,val,node,pname) edge_kind \\<times> node)\"\n\nfun get_proc :: \"node \\<Rightarrow> pname\"\n  where \"get_proc (p,l) = p\"\n\n\ninductive PCFG :: \n  \"cmd \\<Rightarrow> procs \\<Rightarrow> node \\<Rightarrow> (vname,val,node,pname) edge_kind \\<Rightarrow> node \\<Rightarrow> bool\" \n(\"_,_ \\<turnstile> _ -_\\<rightarrow> _\" [51,51,0,0,0] 81)\nfor prog::cmd and procs::procs\nwhere\n\n  Main:\n  \"prog \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p n' \\<Longrightarrow> prog,procs \\<turnstile> (Main,n) -et\\<rightarrow> (Main,n')\"\n\n| Proc:\n  \"\\<lbrakk>(p,ins,outs,c) \\<in> set procs; c \\<turnstile> n -IEdge et\\<rightarrow>\\<^sub>p n'; \n    containsCall procs prog ps p\\<rbrakk> \n  \\<Longrightarrow> prog,procs \\<turnstile> (p,n) -et\\<rightarrow> (p,n')\"\n\n\n| MainCall:\n  \"\\<lbrakk>prog \\<turnstile> Label l -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'; (p,ins,outs,c) \\<in> set procs\\<rbrakk>\n  \\<Longrightarrow> prog,procs \\<turnstile> (Main,Label l) \n                  -(\\<lambda>s. True):(Main,n')\\<hookrightarrow>\\<^bsub>p\\<^esub>map (\\<lambda>e cf. interpret e cf) es\\<rightarrow> (p,Entry)\"\n\n| ProcCall:\n  \"\\<lbrakk>(p,ins,outs,c) \\<in> set procs; c \\<turnstile> Label l -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p Label l';\n    (p',ins',outs',c') \\<in> set procs; containsCall procs prog ps p\\<rbrakk>\n  \\<Longrightarrow> prog,procs \\<turnstile> (p,Label l) \n               -(\\<lambda>s. True):(p,Label l')\\<hookrightarrow>\\<^bsub>p'\\<^esub>map (\\<lambda>e cf. interpret e cf) es'\\<rightarrow> (p',Entry)\"\n\n| MainReturn:\n  \"\\<lbrakk>prog \\<turnstile> Label l -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p Label l'; (p,ins,outs,c) \\<in> set procs\\<rbrakk>\n  \\<Longrightarrow> prog,procs \\<turnstile> (p,Exit) -(\\<lambda>cf. snd cf = (Main,Label l'))\\<hookleftarrow>\\<^bsub>p\\<^esub>\n       (\\<lambda>cf cf'. cf'(rets [:=] map cf outs))\\<rightarrow> (Main,Label l')\"\n\n| ProcReturn:\n  \"\\<lbrakk>(p,ins,outs,c) \\<in> set procs; c \\<turnstile> Label l -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p Label l'; \n   (p',ins',outs',c') \\<in> set procs; containsCall procs prog ps p\\<rbrakk>\n  \\<Longrightarrow> prog,procs \\<turnstile> (p',Exit) -(\\<lambda>cf. snd cf = (p,Label l'))\\<hookleftarrow>\\<^bsub>p'\\<^esub>\n       (\\<lambda>cf cf'. cf'(rets' [:=] map cf outs'))\\<rightarrow> (p,Label l')\"\n\n| MainCallReturn:\n  \"prog \\<turnstile> n -CEdge (p,es,rets)\\<rightarrow>\\<^sub>p n'\n  \\<Longrightarrow> prog,procs \\<turnstile> (Main,n) -(\\<lambda>s. False)\\<^sub>\\<surd>\\<rightarrow> (Main,n')\"\n\n| ProcCallReturn:\n  \"\\<lbrakk>(p,ins,outs,c) \\<in> set procs; c \\<turnstile> n -CEdge (p',es',rets')\\<rightarrow>\\<^sub>p n'; \n    containsCall procs prog ps p\\<rbrakk> \n  \\<Longrightarrow> prog,procs \\<turnstile> (p,n) -(\\<lambda>s. False)\\<^sub>\\<surd>\\<rightarrow> (p,n')\"\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/HRB-Slicing/Proc/PCFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300698514778, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.3238781501729846}}
{"text": "theory RecComb\nimports SimpComb\nbegin\n\nsyntax\n  \"pow\" :: \"[i,i,i] \\<Rightarrow> i\" (\"(pow'(_,/ _,/ _'))\" [75] 75)\n  \"col\" :: \"[i,i,i] \\<Rightarrow> i\" (\"(col'(_,/ _,/ _'))\" [75] 75)\n  \"row\" :: \"[i,i,i] \\<Rightarrow> i\" (\"(row'(_,/ _,/ _'))\" [75] 75)\n  \"Map\" :: \"[i,i] \\<Rightarrow> i\" (\"(Map'(_,/ _'))\" [75] 75)\n\n  \"powf\" :: \"[i,i,i] \\<Rightarrow> i\"\n  \"colf\" :: \"[i,i,i] \\<Rightarrow> i\"\n  \"rowf\" :: \"[i,i,i] \\<Rightarrow> i\"\n  \"mapf\" :: \"[i,i] \\<Rightarrow> i\"\n\n  \"Lambda\" :: \"[i,i] \\<Rightarrow> i\"\n  \"nat\" :: \"i\"\ntranslations\n  \"pow(A,n,R)\" => \"powf(A, n, Lambda(nat, %_. R))\"\n  \"col(A,n,R)\" => \"colf(A, n, Lambda(nat, %_. R))\"\n  \"row(A,n,R)\" => \"rowf(A, n, Lambda(nat, %_. R))\"\n  \"Map(n,R)\" => \"mapf(n, Lambda(nat, %_. R))\"\n\ndefinition powf :: \"[i,i,i] \\<Rightarrow> i\" where\n  \"powf(A,n,R) == rec(n, Id(A), %x y. y ;; R`x)\"\n\ndefinition mapf' :: \"[i,i,i,i] \\<Rightarrow> i\" where\n  \"mapf'(A,B,n,R) == rec(n, NNIL, %x y.(apr(A,x)~);;[[y,R`x]];;apr(B,x))\"\n\ndefinition mapf :: \"[i,i] \\<Rightarrow> i\" where\n  \"mapf(n,R) == mapf'(dtyp(Union(range(R))), rtyp(Union(range(R))), n, R)\"\n\ndefinition tri :: \"[i,i,i] \\<Rightarrow> i\" where\n  \"tri(A,n,R) == mapf(n, lam i:nat. pow(A,i,R))\"\n\ndefinition colf' :: \"[i,i,i,i,i] \\<Rightarrow> i\" where\n  \"colf'(A,B,C,n,R) ==\n    rec(n, Fst(B,NNIL) ;; cross(nlist[0]C, B),\n    %x y. Fst(B,apr(A,x)~) ;; (y || (R`x)) ;; Snd(B,apr(C,x)))\"\n\ndefinition colf :: \"[i,i,i] \\<Rightarrow> i\" where\n  \"colf(B,n,R) == colf'(ddtyp(Union(range(R))), B, rrtyp(Union(range(R))), n, R)\"\n\ndefinition rowf :: \"[i,i,i] \\<Rightarrow> i\" where\n  \"rowf(B,n,R) == (colf(B,n,lam m:nat. ((R`m)~)))~\"\n\ntheorem dtypUR: \"\\<lbrakk> x:sig(dtyp(Union(range(R)))); R:nat\\<rightarrow>A<~>B \\<rbrakk> \\<Longrightarrow> x:sig(A)\"\napply(rule dtyp_rel[of \"Union(range(R))\"], simp_all)\napply(auto, drule range_type, blast+)\ndone\n\ntheorem rtypUR: \"\\<lbrakk> x:sig(rtyp(Union(range(R)))); R:nat\\<rightarrow>B<~>A \\<rbrakk> \\<Longrightarrow> x:sig(A)\"\napply(rule rtyp_rel[of \"Union(range(R))\"], simp_all)\napply(auto, drule range_type, blast+)\ndone\n\ntheorem dtyp_sigUR: \n  \"\\<lbrakk> <x,y>:R`n; R:nat\\<rightarrow>A<~>B; n:nat; x:sig(A) \\<rbrakk>\n    \\<Longrightarrow> x:sig(dtyp(Union(range(R))))\"\napply(rule dtyp_sig)\napply(frule apply_rangeI, simp, blast+)\ndone\n\ntheorem rtyp_sigUR:\n  \"\\<lbrakk> <x,y>:R`n; R:nat\\<rightarrow>A<~>B; n:nat; y:sig(B) \\<rbrakk>\n    \\<Longrightarrow> y:sig(rtyp(Union(range(R))))\"\napply(rule rtyp_sig)\napply(frule apply_rangeI, simp, blast+)\ndone\n\ntheorem dtyp_rtyp_fun: \n  \"\\<lbrakk> R:nat\\<rightarrow>A<~>B; m:nat \\<rbrakk>\n    \\<Longrightarrow> R`m:(dtyp(Union(range(R))))<~>(rtyp(Union(range(R))))\"\napply(auto)\napply(frule apply_funtype, auto)\napply(drule subsetD, auto)\napply(rule dtyp_sigUR, simp_all)\napply(rule rtyp_sigUR, simp_all)\ndone\n\ntheorem nlist_dtypUR: \n  \"\\<lbrakk> x:sig(nlist[n]dtyp(Union(range(R)))); R:nat\\<rightarrow>A<~>B \\<rbrakk>\n    \\<Longrightarrow> x:sig(nlist[n]A)\"\napply(rule sig_sub_func, simp)\napply(drule apply_funtype, simp)\napply(subgoal_tac \"dtyp(Union(range(R))) \\<subseteq> A\", drule nlist_mono[of _ _n], blast)\napply(auto simp add: dtyp_def)\napply(drule range_type, simp)\napply(drule PowD, drule subsetD, simp)\napply(auto, drule range_type, simp+)\ndone\n\ntheorem nlist_rtypUR: \n  \"\\<lbrakk> x:sig(nlist[n]rtyp(Union(range(R)))); R:nat\\<rightarrow>A<~>B \\<rbrakk>\n    \\<Longrightarrow> x:sig(nlist[n]B)\"\napply(rule sig_sub_func, simp)\napply(drule apply_funtype, simp)\napply(subgoal_tac \"rtyp(Union(range(R))) \\<subseteq> B\", drule nlist_mono[of _ _n], blast)\napply(auto simp add: rtyp_def)\napply(drule range_type, simp)\napply(drule PowD, drule subsetD, simp)\napply(auto, drule range_type, simp+)\ndone\n\ntheorem nlist_ddtypUR: \n  \"\\<lbrakk> a:sig(nlist[n]ddtyp(Union(range(Rf)))); Rf:nat \\<rightarrow> A*B<~>B1*C \\<rbrakk>\n    \\<Longrightarrow> a:sig(nlist[n]A)\"\napply(rule sig_sub_func, simp)\napply(drule apply_funtype, simp)\napply(subgoal_tac \"ddtyp(Union(range(Rf))) \\<subseteq> A\", drule nlist_mono[of _ _n], blast)\napply(auto simp add: dtyp_def ddtyp_def)\napply(drule range_type[of _ _ Rf], simp)\napply(drule PowD, drule subsetD, simp, auto)\napply(drule range_type, simp, blast)\ndone\n\ntheorem nlist_rrtypUR: \n  \"\\<lbrakk> a:sig(nlist[n]rrtyp(Union(range(Rf)))); Rf:nat \\<rightarrow> A*B<~>B1*C \\<rbrakk>\n    \\<Longrightarrow> a:sig(nlist[n]C)\"\napply(rule sig_sub_func, simp)\napply(drule apply_funtype, simp)\napply(subgoal_tac \"rrtyp(Union(range(Rf))) \\<subseteq> C\", drule nlist_mono[of _ _n], blast)\napply(auto simp add: rtyp_def rrtyp_def)\napply(drule range_type[of _ _ Rf], simp)\napply(drule PowD, drule subsetD, simp, auto)\napply(drule range_type, simp, blast)\ndone\n\ntheorem rdtypUR: \n  \"\\<lbrakk> b:sig(rdtyp(Union(range(Rf)))); Rf:nat\\<rightarrow>A*B<~>B1*C \\<rbrakk>\n    \\<Longrightarrow> b:sig(B)\"\napply(rule sig_sub_func, simp)\napply(drule apply_funtype, simp)\napply(subgoal_tac \"rdtyp(Union(range(Rf))) \\<subseteq> B\", blast)\napply(auto simp add: dtyp_def rdtyp_def)\napply(drule range_type[of _ _ Rf], simp) back\napply(drule PowD, drule subsetD, simp, auto)\napply(drule range_type, simp) back\napply(blast)\ndone\n\ntheorem powf_type: \"\\<lbrakk> n:nat; R:nat\\<rightarrow>A<~>A \\<rbrakk> \\<Longrightarrow> powf(A,n,R):A<~>A\"\napply(unfold powf_def)\napply(induct_tac n)\napply(simp, rule PowD, typecheck)\napply(subst rec_succ, typecheck)\ndone\n\ntheorem powfR: \"\\<lbrakk> A:ChTy; n:nat; R:nat\\<rightarrow>A<R>A \\<rbrakk> \\<Longrightarrow> powf(A,n,R):A<R>A\"\napply(unfold powf_def)\napply(induct_tac n)\napply(simp, rule IdR, simp)\napply(simp, intro RubyR, simp+)\ndone\n\ntheorem powf_zero: \"a:sig(A) \\<Longrightarrow> <a,a>:powf(A,0,R)\"\napply(unfold powf_def)\napply(simp)\napply(rule IdI, simp)\ndone\n\ntheorem powf_zero_iff: \"powf(A,0,R) = Id(A)\"\napply(unfold powf_def, simp)\ndone\n\ntheorem powf_succ: \"powf(A, succ(n), R) = powf(A,n,R) ;; R`n\"\napply(unfold powf_def, simp)\ndone\n\ntheorem powfI: \"x:powf(A,n,R) ;; R`n \\<Longrightarrow> x:powf(A,succ(n),R)\"\napply(unfold powf_def, simp)\ndone\n\ntheorem powfE: \"\\<lbrakk> x:powf(A,succ(n),R); \\<lbrakk> x:powf(A,n,R) ;; R`n \\<rbrakk> \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> P\"\napply(subst (asm) powf_succ, simp)\ndone\n\ntheorem mapf'_type: \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>A<~>B \\<rbrakk> \\<Longrightarrow> mapf'(A,B,n,Rf):nlist[n]A<~>nlist[n]B\"\napply(unfold mapf'_def)\napply(induct_tac n)\napply(simp, rule PowD, typecheck)\napply(simp, rule PowD, typecheck)\napply(simp)\ndone\n\nlemma nat_dtyp_rtyp_fun: \"R:nat\\<rightarrow>A<~>B \\<Longrightarrow> R:nat\\<rightarrow>dtyp(Union(range(R)))<~>rtyp(Union(range(R)))\"\napply(rule Pi_type, simp)\napply(rule dtyp_rtyp_fun, simp_all)\ndone\n\ntheorem mapf_type: \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>A<~>B \\<rbrakk> \\<Longrightarrow> mapf(n,Rf):nlist[n]A<~>nlist[n]B\"\napply(unfold mapf_def)\napply(frule nat_dtyp_rtyp_fun)\napply(frule mapf'_type, simp) back\napply(subgoal_tac \"nlist[n]dtyp(\\<Union>range(Rf))<~>nlist[n]rtyp(\\<Union>range(Rf)) \\<subseteq> nlist[n]A<~>nlist[n]B\")\napply(blast)\napply(auto, drule subsetD, simp,  auto)\napply(rule nlist_dtypUR, auto)\napply(rule nlist_rtypUR, auto)\ndone\n\ntheorem mapf_rtyp_sigUR: \n  \"\\<lbrakk> <la, lb>:mapf(n,R); R:nat\\<rightarrow>A<~>B; n:nat \\<rbrakk>\n    \\<Longrightarrow> lb:sig(nlist[n]rtyp(Union(range(R))))\"\napply(frule nat_dtyp_rtyp_fun)\napply(frule mapf_type[of n R \"dtyp(Union(range(R)))\" \"rtyp(Union(range(R)))\"], simp)\napply(blast)\ndone\n\ntheorem mapf_dtyp_sigUR: \n  \"\\<lbrakk> <la, lb>:mapf(n,R); R:nat\\<rightarrow>A<~>B; n:nat \\<rbrakk>\n    \\<Longrightarrow> la:sig(nlist[n]dtyp(Union(range(R))))\"\napply(frule nat_dtyp_rtyp_fun)\napply(frule mapf_type[of n R \"dtyp(Union(range(R)))\" \"rtyp(Union(range(R)))\"], simp)\napply(blast)\ndone\n\ntheorem mapf_zero: \"<snil, snil>:mapf(0, Rf)\"\napply(unfold mapf_def mapf'_def)\napply(simp)\napply(rule NNILI)\ndone\n\ntheorem mapf_zero_ifft: \"mapf(0, Rf) = NNIL\"\napply(unfold mapf_def mapf'_def)\napply(simp)\ndone\n\ntheorem mapf'_zero_ifft: \"mapf'(A,B,0, Rf) = NNIL\"\napply(unfold mapf'_def)\napply(simp)\ndone\n\ntheorem mapf_succ_ifft:\n  \"mapf(succ(n), Rf) =\n    (apr(dtyp(Union(range(Rf))), n)~);;[[mapf(n,Rf), Rf`n]];;\n    apr(rtyp(Union(range(Rf))), n)\"\napply(unfold mapf_def mapf'_def)\napply(simp)\ndone\n\ntheorem mapf_succ:\n  \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>A<~>B; a:sig(A); b:sig(B);\n    la:sig(nlist[n]A); lb:sig(nlist[n]B) \\<rbrakk>\n    \\<Longrightarrow> <[la<@a|n], [lb<@b|n]>:mapf(succ(n), Rf)\n        \\<longleftrightarrow> (<a,b>:Rf`n & <la, lb>:mapf(n, Rf))\"\napply(subst mapf_succ_ifft)\napply(auto)\napply((drule nat_dtyp_rtyp_fun,\n      elim compE, typecheck add: mapf_type,\n      elim sig_pairE, simp,\n      elim invE, typecheck,\n      elim RubyE, simp_all)+)\napply(intro RubyI)\napply(subgoal_tac \"<<la#a>, [la<@a|n]>:apr(dtyp(\\<Union>range(Rf)), n)\", simp)\napply(rule aprI)\napply(rule dtyp_sigUR, simp_all)\napply(rule mapf_dtyp_sigUR, simp_all)\napply(subgoal_tac \"<<la#a>, <lb#b>>:[[mapf(n, Rf),Rf ` n]]\", simp)\napply(intro RubyI, simp_all)\napply(intro RubyI)\napply(rule rtyp_sigUR, simp_all)\napply(rule mapf_rtyp_sigUR, simp_all)\ndone\n\nlemma mapf'_succ_ifft:\n  \"mapf'(A,B,succ(n), Rf) =\n    (apr(A, n)~);;[[mapf'(A,B,n,Rf), Rf`n]];;apr(B, n)\"\napply(unfold mapf'_def, simp)\ndone\n\ntheorem mapf'_succ:\n  \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>A<~>B; a:sig(A); b:sig(B);\n    la:sig(nlist[n]A); lb:sig(nlist[n]B) \\<rbrakk>\n    \\<Longrightarrow> <[la<@a|n], [lb<@b|n]>:mapf'(A,B,succ(n),Rf)\n        \\<longleftrightarrow> (<a,b>:Rf`n & <la, lb>:mapf'(A,B,n,Rf))\"\napply(subst mapf'_succ_ifft)\napply(auto)\napply((elim compE, typecheck add: mapf'_type,\n      elim sig_pairE, simp,\n      elim invE, typecheck,\n      elim RubyE, simp_all)+)\napply(intro RubyI)\napply(subgoal_tac \"<<la#a>, [la<@a|n]>:apr(A, n)\", simp)\napply(rule aprI, simp_all)\napply(subgoal_tac \"<<la#a>, <lb#b>>:[[mapf'(A,B,n, Rf),Rf ` n]]\", simp)\napply(intro RubyI, simp_all)\napply(intro RubyI, simp_all)\ndone\n\ntheorem mapf_mapf'_iff: \n  \"\\<lbrakk> n:nat; R:nat\\<rightarrow>A<~>B \\<rbrakk> \\<Longrightarrow> mapf(n,R) = mapf'(A,B,n,R)\"\napply(induct_tac n)\napply(subst mapf'_zero_ifft, subst mapf_zero_ifft, simp)\napply(rule, auto)\napply(frule mapf_type[of \"succ(_)\", OF nat_succI], simp+)\napply(drule subsetD, simp, safe)\napply(elim sig_ssnocE, simp)\napply(subst (asm) mapf_succ, simp_all)\napply(erule conjE)\napply(subst mapf'_succ, simp_all)\napply(frule mapf'_type[of \"succ(_)\", OF nat_succI], simp+)\napply(drule subsetD, simp, safe)\napply(elim sig_ssnocE, simp)\napply(subst (asm) mapf'_succ, simp_all)\napply(erule conjE)\napply(subst mapf_succ, simp_all)\ndone\n\ntheorem mapf_zero_iff: \"mapf(0,R) = NNIL\"\napply(rule mapf_zero_ifft)\ndone\n\ntheorem mapf_zero_iff2: \"R:nat\\<rightarrow>A<~>B \\<Longrightarrow> mapf(0,R) = NNIL\"\napply(rule mapf_zero_ifft)\ndone\n\ntheorem mapf_succ_iff: \n  \"\\<lbrakk> n:nat; R:nat\\<rightarrow>A<~>B \\<rbrakk> \n  \\<Longrightarrow> mapf(succ(n),R) = (apr(A,n)~);;[[mapf(n,R), R`n]];;apr(B,n)\"\napply((subst mapf_mapf'_iff, simp_all)+)\napply(unfold mapf'_def, simp)\ndone\n\ntheorem mapf_succE: \n  \"\\<lbrakk> <[la<@a|n], [lb<@b|n]>:mapf(succ(n), Rf);\n    \\<lbrakk> <a,b>:Rf`n; <la,lb>:mapf(n,Rf) \\<rbrakk> \\<Longrightarrow> P;\n    n:nat; Rf:nat\\<rightarrow>A<~>B; a:sig(A); b:sig(B);\n    la:sig(nlist[n]A); lb:sig(nlist[n]B) \\<rbrakk> \\<Longrightarrow> P\"\napply(subst (asm) mapf_succ, simp_all)\ndone\n\ntheorem mapfR: \n  \"\\<lbrakk> A:ChTy; B:ChTy; n:nat; Rf:nat\\<rightarrow>A<R>B \\<rbrakk>\n    \\<Longrightarrow> mapf(n,Rf):nlist[n]A<R>nlist[n]B\"\napply(induct_tac n)\napply(subst mapf_zero_iff)\napply(intro RubyR, simp+)\napply(subst mapf_succ_iff, simp)\napply(rule fun_weaken_type[OF _ ruby_sub_sig], simp)\napply(intro RubyR)\napply(rule aprR, simp)\napply(rule parR, simp, simp)\napply(rule aprR, simp)\ndone\n\ntheorem tri_type: \"\\<lbrakk> n:nat; R:A<~>A \\<rbrakk> \\<Longrightarrow> tri(A,n,R):nlist[n]A<~>nlist[n]A\"\napply(unfold tri_def)\napply(typecheck add: mapf_type powf_type)\ndone\n\ntheorem tri_zero: \"<snil, snil>: tri(A,0,R)\"\napply(unfold tri_def)\napply(rule mapf_zero)\ndone\n\ntheorem tri_zero_iff: \"tri(A,0,Rf) = NNIL\"\napply(unfold tri_def)\napply(rule mapf_zero_iff)\ndone\n\ntheorem tri_succ_iff:\n  \"\\<lbrakk> n:nat; R:A<~>A \\<rbrakk>\n    \\<Longrightarrow> tri(A, succ(n), R) = \n    (apr(A,n)~);;[[tri(A,n,R), pow(A,n,R)]];;apr(A,n)\"\napply(unfold tri_def)\napply(subst mapf_succ_iff, simp)\napply(typecheck add: powf_type)\napply(simp)\ndone\n\ntheorem tri_succ:\n  \"\\<lbrakk> n:nat; R:A<~>A; a:sig(A); b:sig(A);\n    la:sig(nlist[n]A); lb:sig(nlist[n]A) \\<rbrakk> \\<Longrightarrow>\n    <[la<@a|n], [lb<@b|n]>:tri(A, succ(n), R) \\<longleftrightarrow>\n    (<a,b>:pow(A,n,R) & <la,lb>:tri(A,n,R))\"\napply(unfold tri_def)\napply(subst mapf_succ, typecheck add: powf_type, simp_all)\ndone\n\ntheorem tri_succE:\n  \"\\<lbrakk> <[la<@a|n], [lb<@b|n]>:tri(A, succ(n), R);\n    \\<lbrakk> <a,b>:pow(A,n,R); <la,lb>:tri(A,n,R) \\<rbrakk> \\<Longrightarrow> P;\n    n:nat; R:A<~>A; a:sig(A); b:sig(A);\n    la:sig(nlist[n]A); lb:sig(nlist[n]A) \\<rbrakk> \\<Longrightarrow> P\"\napply(subst (asm) tri_succ, simp_all)\ndone\n\ntheorem colf'_type: \n  \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>A*B<~>B*C \\<rbrakk>\n    \\<Longrightarrow> colf'(A,B,C,n,Rf):nlist[n]A*B<~>B*nlist[n]C\"\napply(unfold colf'_def)\napply(induct_tac n)\napply(simp, rule PowD, typecheck)\napply(simp, rule PowD)\napply(typecheck, simp)\ndone\n\nlemma nat_ddtyp_rrtyp_fun: \n  \"Rf:nat\\<rightarrow>A*B<~>B*C \\<Longrightarrow> Rf \\<in> nat \\<rightarrow> ddtyp(\\<Union>range(Rf))\\<times> B<~>B \\<times> rrtyp(\\<Union>range(Rf))\"\napply(rule Pi_type, simp)\napply(frule apply_funtype, simp)\napply(auto, drule subsetD, simp, safe)\napply(elim sig_pairE, simp, typecheck)\napply(rule ddtyp_sig, simp)\napply(subgoal_tac \"\\<langle><a#b>, <aa#ba>\\<rangle>\\<in> \\<Union>range(Rf)\", simp)\napply(rule, rule apply_rangeI, simp+)\napply(elim sig_pairE, simp, typecheck)\napply(rule rrtyp_sig, simp)\napply(subgoal_tac \"\\<langle><a#b>, <aa#ba>\\<rangle>\\<in> \\<Union>range(Rf)\", simp)\napply(rule, rule apply_rangeI, simp+)\ndone\n\ntheorem colf_type:\n  \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>A*B<~>B*C \\<rbrakk> \\<Longrightarrow>\n    colf(B,n,Rf):nlist[n]A*B<~>B*nlist[n]C\"\napply(unfold colf_def)\napply(frule nat_ddtyp_rrtyp_fun)\napply(frule colf'_type, simp) back\napply(subgoal_tac \"nlist[n]ddtyp(\\<Union>range(Rf))\\<times> B<~>B \\<times> nlist[n]rrtyp(\\<Union>range(Rf)) \n                    \\<subseteq> nlist[n]A \\<times> B<~>B \\<times> nlist[n]C\")\napply(blast)\napply(subgoal_tac \"sig(nlist[n]ddtyp(\\<Union>range(Rf)) \\<times> B) \\<subseteq> sig(nlist[n]A \\<times> B)\")\napply(subgoal_tac \"sig(B \\<times> nlist[n]rrtyp(\\<Union>range(Rf))) \\<subseteq> sig(B \\<times> nlist[n]C)\")\napply(auto)\napply(elim sig_pairE, simp, typecheck)\napply(rule nlist_rrtypUR, simp+)\napply(elim sig_pairE, simp, typecheck)\napply(rule nlist_ddtypUR, simp+)\ndone\n\ntheorem colf_basetype: \n  \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>A*B<~>B*C \\<rbrakk>\n    \\<Longrightarrow> colf(B,n,Rf): nlist[n]ddtyp(\\<Union>range(Rf))\\<times> B<~>B \\<times> nlist[n]rrtyp(\\<Union>range(Rf))\"\napply(unfold colf_def)\napply(rule colf'_type, simp)\napply(rule nat_ddtyp_rrtyp_fun, simp)\ndone\n\ntheorem ddtyp_sigUR:\n  \"\\<lbrakk> <<a#bs>,<x#c>>:Rf`n; n:nat; Rf:nat\\<rightarrow>A*B<~>B*C;\n    a:sig(A'); c:sig(C'); x:sig(B'); bs:sig(E') \\<rbrakk>\n    \\<Longrightarrow> a:sig(ddtyp(Union(range(Rf))))\"\napply(drule nat_ddtyp_rrtyp_fun)\napply(drule apply_funtype, simp)\napply(simp, drule subsetD, simp)\napply(safe, drule spair_type_rev, simp+)\ndone\n\ntheorem rrtyp_sigUR:\n  \"\\<lbrakk> <<a#bs>,<x#c>>:Rf`n; n:nat; Rf:nat\\<rightarrow>A*B<~>B*C;\n    a:sig(A'); c:sig(C'); x:sig(B'); bs:sig(E') \\<rbrakk>\n    \\<Longrightarrow> c:sig(rrtyp(Union(range(Rf))))\"\napply(drule nat_ddtyp_rrtyp_fun)\napply(drule apply_funtype, simp)\napply(simp, drule subsetD, simp)\napply(safe, drule spair_type_rev, simp+) back\ndone\n\ntheorem colf_sigUR:\n  \"\\<lbrakk> <<la#x>,<b0#lc>>:colf(B,n,Rf); n:nat; Rf:nat\\<rightarrow>A*B<~>B*C;\n    la:sig(A'); x:sig(B'); b0:sig(C'); lc:sig(E') \\<rbrakk> \\<Longrightarrow>\n    la:sig(nlist[n]ddtyp(Union(range(Rf)))) &\n    lc:sig(nlist[n]rrtyp(Union(range(Rf))))\"\napply(frule colf_basetype, simp)\napply(simp, drule subsetD, simp)\napply(safe, drule spair_type_rev, simp+)\napply(drule spair_type_rev, simp+) back\ndone\n\ntheorem colf_zero_ifft: \n  \"colf(B,0,Rf) =\n    Fst(B,NNIL) ;; cross(nlist[0]rrtyp(Union(range(Rf))), B)\"\napply(unfold colf_def colf'_def)\napply(simp)\ndone\n\ntheorem colf'_zero_ifft: \n  \"colf'(A,B,C,0,Rf) =\n    Fst(B,NNIL) ;; cross(nlist[0]C, B)\"\napply(unfold colf_def colf'_def)\napply(simp)\ndone\n\ntheorem colf_zero: \"\\<lbrakk> a:sig(A) \\<rbrakk> \\<Longrightarrow> <<snil#a>,<a#snil>>:colf(A,0,Rf)\"\napply(subst colf_zero_ifft)\napply(intro RubyI)\napply(subgoal_tac \"<<snil#a>, <snil#a>>:[[NNIL, Id(A)]]\", simp)\napply(intro RubyI, simp_all)\napply(intro RubyI, simp_all)\ndone\n\ntheorem colf'_zero: \"\\<lbrakk> a:sig(B) \\<rbrakk> \\<Longrightarrow> <<snil#a>,<a#snil>>:colf'(A,B,C,0,Rf)\"\napply(subst colf'_zero_ifft)\napply(intro RubyI)\napply(subgoal_tac \"<<snil#a>, <snil#a>>:[[NNIL, Id(B)]]\", simp)\napply(intro RubyI, simp_all)\napply(intro RubyI, simp_all)\ndone\n\ntheorem colf_succ_ifft: \n  \"colf(B, succ(n), Rf) = \n    Fst(B, apr(ddtyp(Union(range(Rf))), n)~) ;;\n    (colf(B,n,Rf) || (Rf`n)) ;;\n    Snd(B,apr(rrtyp(Union(range(Rf))), n))\"\napply(unfold colf_def colf'_def)\napply(simp)\ndone\n\ntheorem colf'_succ_ifft: \n  \"colf'(A,B,C,succ(n), Rf) = \n    Fst(B, apr(A, n)~) ;;\n    (colf'(A,B,C,n,Rf) || (Rf`n)) ;;\n    Snd(B,apr(C, n))\"\napply(unfold colf_def colf'_def)\napply(simp)\ndone\n\ntheorem colf_succ:\n  \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>A*B<~>B*C; a:sig(A'); c:sig(C'); bs:sig(B);\n    b0:sig(B); la:sig(nlist[n]A'); lc:sig(nlist[n]C') \\<rbrakk>\n    \\<Longrightarrow> <<[la<@a|n]#bs>,<b0#[lc<@c|n]>>: colf(B,succ(n), Rf) \\<longleftrightarrow>\n    (EX bn:sig(B). (<<a#bs>,<bn#c>>:Rf`n & <<la#bn>,<b0#lc>>:colf(B,n,Rf)))\"\napply(subst colf_succ_ifft)\napply(rule)\napply(drule nat_ddtyp_rrtyp_fun)\napply(elim compE, typecheck add: colf_type)\napply(elim sig_pairE, simp)\napply(elim belowE, typecheck add: colf_type)\napply(elim RubyE, typecheck, simp)\napply(blast)\napply(erule bexE, erule conjE)\napply(intro RubyI)\napply(subgoal_tac \"\\<langle><[la<@a|n]#bs>, <<la#a>#bs>\\<rangle> \\<in> [[apr(ddtyp(\\<Union>range(Rf)), n)~,Id(B)]]\")\napply(simp)\napply(intro RubyI, typecheck)\napply(rule ddtyp_sigUR, simp+)\napply(drule colf_sigUR, simp+)\napply(subgoal_tac \"\\<langle><<la#a>#bs>, <b0#<lc#c>>\\<rangle> \\<in> colf(B, n, Rf) || Rf ` n\")\napply(simp)\napply(rule belowI[of _ _ _ B], simp, thin_tac \"bs:sig(B)\", thin_tac \"b0:sig(B)\", simp+)\napply(intro RubyI, simp+)\napply(rule rrtyp_sigUR, simp+)\napply(drule colf_sigUR, simp+)\ndone\n\ntheorem colf'_succ:\n   \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>A*B<~>B*C; a:sig(A); c:sig(C); bs:sig(B);\n    b0:sig(B); la:sig(nlist[n]A); lc:sig(nlist[n]C) \\<rbrakk>\n    \\<Longrightarrow> <<[la<@a|n]#bs>,<b0#[lc<@c|n]>>: colf'(A,B,C,succ(n), Rf) \\<longleftrightarrow>\n    (EX bn:sig(B). (<<a#bs>,<bn#c>>:Rf`n & <<la#bn>,<b0#lc>>:colf'(A,B,C,n,Rf)))\"\napply(subst colf'_succ_ifft)\napply(rule)\napply(elim compE, typecheck add: colf'_type)\napply(elim sig_pairE, simp)\napply(elim belowE, typecheck add: colf'_type)\napply(elim RubyE, typecheck, simp)\napply(blast)\napply(erule bexE, erule conjE)\napply(intro RubyI)\napply(subgoal_tac \"\\<langle><[la<@a|n]#bs>, <<la#a>#bs>\\<rangle> \\<in> [[apr(A, n)~,Id(B)]]\", simp)\napply(intro RubyI, typecheck)\napply(subgoal_tac \"\\<langle><<la#a>#bs>, <b0#<lc#c>>\\<rangle> \\<in> colf'(A,B,C,n,Rf) || Rf ` n\", simp)\napply(rule belowI[of _ _ _ B], simp, thin_tac \"bs:sig(B)\", thin_tac \"b0:sig(B)\", simp+)\napply(intro RubyI, simp+)\ndone\n\nlemma colf_colf'_iff_zero: \n    \"R \\<in> nat \\<rightarrow> A \\<times> B<~>B \\<times> C \n      \\<Longrightarrow> colf(B, 0, R) = colf'(A, B, C, 0, R)\"\napply(rule, safe)\napply(frule colf_type[OF nat_0I], simp)\napply(drule subsetD, simp, auto)\napply(elim sig_pairE, simp)\napply(subst (asm) colf_zero_ifft)\napply(erule compE, typecheck, elim sig_pairE, simp)\napply(erule FstE, erule parE, simp+)\napply(elim NNILE IdE, simp+)\napply(erule crossE, simp)\napply(rule colf'_zero, simp+)\napply(frule colf'_type[OF nat_0I], simp)\napply(drule subsetD, simp, auto)\napply(elim sig_pairE, simp)\napply(subst (asm) colf'_zero_ifft)\napply(erule compE, typecheck, elim sig_pairE, simp)\napply(erule FstE, erule parE, simp+)\napply(elim NNILE IdE, simp+)\napply(erule crossE, simp)\napply(rule colf_zero, simp+)\ndone\n\ntheorem colf_colf'_iff: \"\\<lbrakk> n:nat; R:nat\\<rightarrow>A*B<~>B*C \\<rbrakk> \\<Longrightarrow> colf(B,n,R) = colf'(A,B,C,n,R)\"\napply(induct_tac n)\napply(rule colf_colf'_iff_zero, simp)\napply(rule, safe)\napply(frule colf_type[of \"succ(_)\", OF nat_succI], simp+)\napply(drule subsetD, simp, safe)\napply(elim sig_pairE sig_ssnocE, simp)\napply(subst (asm) colf_succ, simp+)\napply(subst colf'_succ, simp+)\napply(frule colf'_type[of \"succ(_)\", OF nat_succI], simp+)\napply(drule subsetD, simp, safe)\napply(elim sig_pairE sig_ssnocE, simp)\napply(subst (asm) colf'_succ, simp+)\napply(subst colf_succ, simp+)\ndone\n\ntheorem colf_zero_iff: \n  \"colf(B,0,R) = (Fst(B,NNIL) ;; cross(nlist[0]rrtyp(\\<Union>range(R)),B))\"\napply(rule colf_zero_ifft)\ndone\n\ntheorem colf_zero_iff2: \n  \"R:nat\\<rightarrow>A*B<~>B*C \\<Longrightarrow> colf(B,0,R) = (Fst(B,NNIL) ;; cross(nlist[0]C,B))\"\napply(subst colf_colf'_iff, simp+)\napply(subst colf'_zero_ifft, simp)\ndone\n\ntheorem colf_succ_iff: \n  \"\\<lbrakk> n:nat; R:nat\\<rightarrow>A*B<~>B*C \\<rbrakk> \\<Longrightarrow> colf(B, succ(n), R) =\n    Fst(B, apr(A,n)~) ;; (colf(B,n,R) || (R`n)) ;; Snd(B, apr(C,n))\"\napply((subst colf_colf'_iff, simp+)+)\napply(subst colf'_succ_ifft, simp)\ndone\n\ntheorem colfR: \n  \"\\<lbrakk> A:ChTy; B:ChTy; C:ChTy; n:nat; R:nat\\<rightarrow>A*B<R>B*C \\<rbrakk>\n    \\<Longrightarrow> colf(B,n,R):nlist[n]A*B<R>B*nlist[n]C\"\napply(induct_tac n)\napply(subst colf_zero_iff2)\napply(rule fun_weaken_type[OF _ ruby_sub_sig], simp)\napply(intro RubyR, rule FstR, rule NNILR)\napply(simp, rotate_tac 2, simp+)\napply(rule crossR, rule nlist_in_chty, simp+)\napply(subst colf_succ_iff, simp)\napply(rule fun_weaken_type[OF _ ruby_sub_sig], simp)\napply(intro RubyR)\napply(rule FstR, rule invR, rule aprR, simp+)\napply(rule belowR[of \"nlist[_]A\" B B \"nlist[_]C\" A B C])\napply((simp add: nlist_in_chty)+)\napply(rule SndR, rule aprR, simp+)\ndone\n\ntheorem colf_succE: \n  \"\\<lbrakk> <<[la<@a|n]#bs>,<b0#[lc<@c|n]>>:colf(B,succ(n), Rf);\n    \\<And>bn. \\<lbrakk> bn:sig(B); <<a#bs>,<bn#c>>:Rf`n;\n          <<la#bn>,<b0#lc>>:colf(B,n,Rf) \\<rbrakk> \\<Longrightarrow> P;\n    n:nat; Rf:nat\\<rightarrow>A*B<~>B*C; a:sig(A'); c:sig(C');\n    bs:sig(B); b0:sig(B); la:sig(nlist[n]A'); lc:sig(nlist[n]C') \\<rbrakk> \\<Longrightarrow> P\"\napply(subst (asm) colf_succ, simp+, blast)\ndone\n\ntheorem colf_zeroE: \n  \"\\<lbrakk> <<snil#a>,<b#snil>>:colf(B,0,Rf);\n    \\<lbrakk> a = b \\<rbrakk> \\<Longrightarrow> P; a:sig(B); b:sig(B) \\<rbrakk> \\<Longrightarrow> P\"\napply(subst (asm) colf_zero_ifft)\napply(erule compE, typecheck, elim sig_pairE, simp)\napply(erule FstE, erule parE, simp+)\napply(elim NNILE IdE, simp+)\napply(erule crossE, simp, typecheck)\ndone\n\ntheorem rowf_type: \n  \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>B*A<~>C*B \\<rbrakk>\n    \\<Longrightarrow> rowf(B,n,Rf):B*nlist[n]A<~>nlist[n]C*B\"\napply(unfold rowf_def)\napply(typecheck add: colf_type)\ndone\n\ntheorem rowfR:\n  \"\\<lbrakk> A:ChTy; B:ChTy; C:ChTy; n:nat; R:nat\\<rightarrow>B*A<R>C*B \\<rbrakk>\n    \\<Longrightarrow> rowf(B,n,R):B*nlist[n]A<R>nlist[n]C*B\"\napply(unfold rowf_def)\napply(intro RubyR colfR, simp+)\napply(rule lam_type)\napply(intro RubyR, simp)\ndone\n\ntheorem rowf_zero_iff: \n  \"rowf(B,0,Rf) = (Fst(B,NNIL) ;; cross(nlist[0]rrtyp(\\<Union>range(\\<lambda>m\\<in>nat. Rf ` m~)),B))~\"\napply(unfold rowf_def)\napply(subst colf_zero_iff, simp)\ndone\n\ntheorem rowf_zero_iff2:\n  \"Rf:nat\\<rightarrow>B*A<~>C*B \\<Longrightarrow>\n    rowf(B,0,Rf) = \n    (Fst(B,NNIL) ;; cross(nlist[0]A,B))~\"\napply(unfold rowf_def)\napply(subst colf_zero_iff2, simp+)\ndone\n\ntheorem row_zero_iff2:\n  \"R:B*A<~>C*B \\<Longrightarrow>\n    row(B,0,R) = (Fst(B,NNIL) ;; cross(nlist[0]A,B))~\"\napply(subst rowf_zero_iff2)\napply(rule lam_type, simp+)\ndone\n\ntheorem rowf_zero: \"a:sig(B) \\<Longrightarrow> <<a#snil>,<snil#a>>:rowf(B,0,R)\"\napply(unfold rowf_def)\napply(intro RubyI, typecheck)\napply(erule colf_zero)\ndone\n\ntheorem rowf_succ: \n  \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>B*A<~>C*B; a:sig(A); c:sig(C); bs:sig(B);\n    b0:sig(B); la:sig(nlist[n]A); lc:sig(nlist[n]C) \\<rbrakk>\n    \\<Longrightarrow> <<b0#[la<@a|n]>,<[lc<@c|n]#bs>>:rowf(B,succ(n),Rf) \\<longleftrightarrow>\n        (EX bn:sig(B). (<<bn#a>,<c#bs>>:Rf`n & <<b0#la>,<lc#bn>>:rowf(B,n,Rf)))\"\napply(rule)\napply(unfold rowf_def)\napply(erule invE, typecheck add: colf_type)\napply(subst (asm) colf_succ, simp+)\napply(erule bexE, erule conjE)\napply(drule invI[of \"<lc#_>\"], simp+)\napply(erule invE, typecheck, blast)\napply(rule invI, typecheck)\napply(subst colf_succ, simp+)\napply(elim bexE conjE invE, typecheck add: colf_type)\napply(drule invI[of \"<_#a>\"], simp+, blast)\ndone\n\ntheorem rowf_succ_iff: \n  \"\\<lbrakk> n:nat; Rf:nat\\<rightarrow>B*A<~>C*B \\<rbrakk> \\<Longrightarrow>\n    rowf(B,succ(n), Rf) = \n    Snd(B,apr(A,n)~) ;; (rowf(B,n,Rf) <~~> Rf`n) ;; Fst(B,apr(C,n))\"\napply(rule, auto)\napply(frule rowf_type[of \"succ(_)\", OF nat_succI], simp+)\napply(drule subsetD, simp, safe)\napply(elim sig_pairE sig_ssnocE, simp)\napply(subst (asm) rowf_succ, simp+)\napply(erule bexE, erule conjE)\napply(intro RubyI)\napply(subgoal_tac \"\\<langle><a#[l<@ab|n]>,<a#<l#ab>>\\<rangle> \\<in>[[Id(B),apr(A, n)~]]\", simp)\napply(intro RubyI, simp+)\napply(subgoal_tac \"\\<langle><a#<l#ab>>,<<la#ac>#ba>\\<rangle> \\<in>rowf(B, n, Rf) <~~> Rf ` n\", simp)\napply(rule besideI[of _ B], rotate_tac 12, simp+)\napply(intro RubyI, simp+)\napply(subgoal_tac \"\n    Snd(B, apr(A, n)~) ;; rowf(B, n, Rf) <~~> Rf ` n ;;\n    Fst(B, apr(C, n)):B \\<times> nlist[succ(n)]A<~>nlist[succ(n)]C \\<times> B\")\napply(typecheck add: rowf_type, simp)\napply(drule subsetD, simp, safe)\napply(elim sig_pairE sig_ssnocE, simp)\napply(erule compE, typecheck add: rowf_type)\napply(elim sig_pairE, simp)\napply(erule FstE, erule parE, typecheck, erule aprE, erule IdE, simp+)\napply(erule compE, typecheck add: rowf_type)\napply(elim sig_pairE, simp)\napply(erule besideE, typecheck add: rowf_type)\napply(erule SndE, erule parE, simp+, erule IdE, simp)\napply(erule invE, typecheck, erule aprE, simp+)\napply(erule IdE, simp)\napply(subst rowf_succ, simp+, blast)\ndone\n\ntheorem rowf_succE: \n  \"\\<lbrakk> <<b0#[la<@a|n]>,<[lc<@c|n]#bs>>:rowf(B,succ(n),Rf);\n    \\<And>bn. \\<lbrakk> bn:sig(B); <<bn#a>,<c#bs>>:Rf`n; \n    <<b0#la>,<lc#bn>>:rowf(B,n,Rf)  \\<rbrakk> \\<Longrightarrow> P;\n    n:nat; Rf:nat\\<rightarrow>B*A<~>C*B; a:sig(A); c:sig(C); \n    bs:sig(B); b0:sig(B);\n    la:sig(nlist[n]A); lc:sig(nlist[n]C) \\<rbrakk> \\<Longrightarrow> P\"\napply(subst (asm) rowf_succ, simp+)\napply(blast)\ndone\n\ntheorem rowf_zeroE: \n  \"\\<lbrakk> <<b0#snil>,<snil#bs>>:rowf(B,0,Rf);\n    \\<lbrakk> b0 = bs \\<rbrakk> \\<Longrightarrow> P;\n    Rf:nat\\<rightarrow>B*A<~>C*B; bs:sig(B); b0:sig(B) \\<rbrakk> \\<Longrightarrow> P\"\napply(unfold rowf_def)\napply(erule invE, typecheck add: colf_type)\napply(erule colf_zeroE, simp+)\ndone\n\nlemmas RecComb_type = \n  powf_type mapf_type tri_type\n  colf_type rowf_type \n\ndeclare RecComb_type [TC]\n\nend", "meta": {"author": "kaiboy05", "repo": "rubyzf_mirror", "sha": "cdf3b1042ffa9f2d5c11de82098ee223b242ebbf", "save_path": "github-repos/isabelle/kaiboy05-rubyzf_mirror", "path": "github-repos/isabelle/kaiboy05-rubyzf_mirror/rubyzf_mirror-cdf3b1042ffa9f2d5c11de82098ee223b242ebbf/RecComb.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.32378166376251405}}
{"text": "theory UnpairedExecution\nimports\n  \"../Protocol\"\n  ExecMessage\n  WelltypedSubst\n  ThreadPool\n  PaulsonSemantics\n  \"../DistinctList\"\nbegin\n\ntext{* An execution model resulting in knowledge-event traces *}\n\nsection{* Execution Model *}\n\nsubsection{* Types and Operations *}\n\nsubsubsection{* Execution Events *}\n\ndatatype execevent = \n    FromIK0 execmsg\n  | MkStep tid rolestep\n  | MkHash execmsg\n  | MkFst  execmsg execmsg\n  | MkSnd  execmsg execmsg\n  | MkTup  execmsg execmsg\n  | MkEncr execmsg execmsg\n  | MkDecr execmsg execmsg\n\ndatatype knevent = \"Knows\" \"execmsg\"   (\"\\<star>_\" [900] 900)\n                 | \"Event\" \"execevent\" (\"\\<Delta>_\" [900] 900)\n\ntypes kntrace = \"knevent list\"\n\ntext{*\n  The eventMsg is a technical construction used as an over-approximation\n  over the input and output messages in order to simplify formulating\n  the lemma about all messages of past events in the system being ground.\n*}\n\nfun eventMsg :: \"wt_subst \\<Rightarrow> execevent \\<Rightarrow> execmsg\" \nwhere\n  \"eventMsg s (MkStep tid (Send lbl msg)) = subst s (s2e msg tid)\"\n| \"eventMsg s (MkStep tid (Recv lbl msg)) = subst s (s2e msg tid)\"\n| \"eventMsg s (FromIK0 m) = m\"\n| \"eventMsg s (MkTup x y)  = Tup x y\"\n| \"eventMsg s (MkFst x y)  = Tup x y\"\n| \"eventMsg s (MkSnd x y)  = Tup x y\"\n| \"eventMsg s (MkHash m)   = Hash m\"\n| \"eventMsg s (MkEncr m k) = Enc m k\"\n| \"eventMsg s (MkDecr m k) = Enc m k\"\n\nfun pairParts :: \"'a msg \\<Rightarrow> 'a msg set\"\nwhere\n  \"pairParts (Tup x y) = \n     insert (Tup x y) (pairParts x \\<union> pairParts y)\"\n| \"pairParts m = {m}\"\n\nfun unpairMsg :: \"execmsg set \\<Rightarrow> execmsg \\<Rightarrow> kntrace\"\nwhere\n  \"unpairMsg known (Tup x y) = \n    (if x \\<in> known \n     then []\n     else [\\<Delta> MkFst x y, \\<star> x]) @\n     unpairMsg (insert x known) x @\n    (if y \\<in> (insert x (known \\<union> pairParts x))\n     then []\n     else [\\<Delta> MkSnd x y, \\<star> y]) @\n     unpairMsg (insert y (insert x (known \\<union> pairParts x))) y\"\n| \"unpairMsg known m = []\"\n\n\nlemma notin_set_unpairMsg [simp]:\n  \"\\<Delta> MkStep tid step \\<notin> set (unpairMsg knows m')\"\n  \"\\<Delta> MkEncr m k \\<notin> set (unpairMsg knows m')\"\n  \"\\<Delta> MkDecr m k \\<notin> set (unpairMsg knows m')\"\n  \"\\<Delta> MkTup x y \\<notin> set (unpairMsg knows m')\"\n  \"\\<Delta> MkHash m \\<notin> set (unpairMsg knows m')\"\n  \"\\<Delta> FromIK0 m \\<notin> set (unpairMsg knows m')\"\n  by(induct m' arbitrary: knows, auto)\n\n\nlemma pairParts_mono [iff]: \"m \\<in> pairParts m\"\n  by(induct m rule: pairParts.induct, auto)\n\n\nlemma in_set_unpairMsg_casesD:\n  \"knev \\<in> set (unpairMsg knows m) \\<Longrightarrow> \n   (\\<exists> m'. knev = \\<star> m' \\<and> m' \\<notin> knows \\<and> m' \\<in> pairParts m \\<and> size m' < size m ) \\<or>\n   (\\<exists> x y. knev = \\<Delta> MkFst x y \\<and> x \\<notin> knows \\<and> x \\<in> pairParts m \\<and> \n                                size x < size m \\<and> size y < size m) \\<or>\n   (\\<exists> x y. knev = \\<Delta> MkSnd x y \\<and> y \\<notin> knows \\<and> y \\<in> pairParts m \\<and>\n                                size x < size m \\<and> size y < size m)\"\nproof(induct m arbitrary: knows)\n  case Lit thus ?case by simp next\n  case Enc thus ?case by simp next\n  case Hash thus ?case by simp next\n  case K thus ?case by simp next\n  case PK thus ?case by simp next\n  case SK thus ?case by simp next\n  case (Tup m1 m2 knows) show ?case using prems(3)\n    by(auto split: if_splits dest: prems(1,2))\nqed\n\nlemma distinct_unpairMsg [iff]: \"distinct (unpairMsg knows m)\"\n  apply(induct m arbitrary: knows, simp_all, safe)\n  apply((drule in_set_unpairMsg_casesD)+, \n        force dest: in_set_unpairMsg_casesD)+\n  done\n\nlemma Knows_size_unpairMsgD: \n  \"\\<star> m' \\<in> set (unpairMsg knows m) \\<Longrightarrow> size m' < size m\"\nproof(induct m arbitrary: knows)\n  case Lit thus ?case by simp next\n  case Enc thus ?case by simp next\n  case Hash thus ?case by simp next\n  case K thus ?case by simp next\n  case PK thus ?case by simp next\n  case SK thus ?case by simp next\n  case (Tup m1 m2 knows) show ?case using prems(3)\n    apply(auto split: if_splits)\n    by(drule prems, simp)+\nqed\n\nlemma MkFst_size_unpairMsgD: \n  \"\\<Delta> MkFst x y \\<in> set (unpairMsg knows m) \\<Longrightarrow> size x < size m \\<and> size y < size m\"\nproof(induct m arbitrary: knows)\n  case Lit thus ?case by simp next\n  case Enc thus ?case by simp next\n  case Hash thus ?case by simp next\n  case K thus ?case by simp next\n  case PK thus ?case by simp next\n  case SK thus ?case by simp next\n  case (Tup m1 m2 knows) show ?case using prems(3)\n    apply(auto split: if_splits)\n    by(drule prems, simp)+\nqed\n\nlemma MkSnd_size_unpairMsgD: \n  \"\\<Delta> MkSnd x y \\<in> set (unpairMsg knows m) \\<Longrightarrow> size x < size m \\<and> size y < size m\"\nproof(induct m arbitrary: knows)\n  case Lit thus ?case by simp next\n  case Enc thus ?case by simp next\n  case Hash thus ?case by simp next\n  case K thus ?case by simp next\n  case PK thus ?case by simp next\n  case SK thus ?case by simp next\n  case (Tup m1 m2 knows) show ?case using prems(3)\n    apply(auto split: if_splits)\n    by(drule prems, simp)+\nqed\n\nlemmas size_unpairMsgD = \n  Knows_size_unpairMsgD MkFst_size_unpairMsgD MkSnd_size_unpairMsgD\n\nlemma noteq_Tup_simps [simp]: \n  \"x \\<noteq> Tup x y\" \"Tup x y \\<noteq> x\" \n  \"x \\<noteq> Tup y x\" \"Tup y x \\<noteq> x\" \n  by safe (drule_tac f=size in arg_cong, simp)+\n\n\nlemma Knows_in_set_unpairMsgD:\n  \"\\<star> m' \\<in> set (unpairMsg knows m) \\<Longrightarrow>\n   m' \\<in> pairParts m \\<and> size m' < size m \\<and> m' \\<notin> knows\"\n  apply(induct m arbitrary: knows)\n  prefer 2 apply(force split: if_splits)\n  by(force)+\n\nlemma MkFst_in_set_unpairMsgD:\n  \"\\<Delta> MkFst x y \\<in> set (unpairMsg knows m) \\<Longrightarrow> \n   \\<star> x \\<in> set (unpairMsg knows m)\"\n  by(induct m arbitrary: knows, auto)\n\nlemma MkSnd_in_set_unpairMsgD:\n  \"\\<Delta> MkSnd x y \\<in> set (unpairMsg knows m) \\<Longrightarrow> \n   \\<star> y \\<in> set (unpairMsg knows m)\"\n  by(induct m arbitrary: knows, auto)\n\n\n\nsubsubsection{* Reachable States during Execution *}\n\ntypes state = \"kntrace \\<times> rolestep threadpool \\<times> wt_subst\"\n\ntext{* access the state's substitution *}\nfun sts :: \"state \\<Rightarrow> wt_subst\"\nwhere \"sts (t,r,s) = s\"\n\ninductive_set \n  reachable :: \"proto \\<Rightarrow> state set\" \n  for P     :: \"proto\"\nwhere\n  init: \"([], empty, empty_wts) \\<in> reachable P\"\n\n| create:\"\\<lbrakk> (t, r, s) \\<in> reachable P;\n            tid \\<notin> dom r;\n            R \\<in> P;\n            dom_wts \\<alpha> = {EVar (AVar a) tid | a tid. True};\n            ran_wts \\<alpha> = {Lit (EHonest a)   | a. True} \\<union> {Lit Eve}\n          \\<rbrakk>\n          \\<Longrightarrow> (t, r(tid \\<mapsto> newThread (Rep_role R)), extend_wts s \\<alpha>) \\<in> reachable P\"\n\n| send:  \"\\<lbrakk> (t, r, s) \\<in> reachable P;\n            Some (Send l msg) = curStep r tid;\n            m = subst s (s2e msg tid)\n          \\<rbrakk>\n          \\<Longrightarrow> (t @ [\\<Delta>(MkStep tid (Send l msg))] \n                 @ (if \\<star>(m) \\<in> set t \n                    then [] \n                    else \\<star>(m) # unpairMsg (insert m {x | x. \\<star> x \\<in> set t}) m)\n              , nextStep r tid\n              , s) \\<in> reachable P\"\n            \n| recv:  \"\\<lbrakk> (t, r, s) \\<in> reachable P;\n            Some (Recv l msg) = curStep r tid;\n            dom_wts \\<alpha> = { EVar v tid | v. v \\<in> FV msg };\n            \\<star>(subst (extend_wts s \\<alpha>) (s2e msg tid)) \\<in> set t\n          \\<rbrakk>\n          \\<Longrightarrow> (t @ [\\<Delta>(MkStep tid (Recv l msg))], nextStep r tid, extend_wts s \\<alpha>) \\<in> reachable P\"\n\n| ik0:   \"\\<lbrakk> (t, r, s) \\<in> reachable P;\n            m \\<in> IK0; \n            \\<Delta>(FromIK0 m) \\<notin> set t; \\<star>(m) \\<notin> set t\n          \\<rbrakk>\n          \\<Longrightarrow> (t @ [\\<Delta>(FromIK0 m), \\<star>(m)], r, s) \\<in> reachable P\"\n\n| hash:  \"\\<lbrakk> (t, r, s) \\<in> reachable P;\n            \\<star>(m) \\<in> set t;\n            \\<Delta>(MkHash m) \\<notin> set t; \\<star>(Hash m) \\<notin> set t\n          \\<rbrakk>\n          \\<Longrightarrow> (t @ [\\<Delta>(MkHash m), \\<star>(Hash m)], r, s) \\<in> reachable P\"\n\n| tuple: \"\\<lbrakk> (t, r, s) \\<in> reachable P;\n            \\<star>(x) \\<in> set t;\n            \\<star>(y) \\<in> set t;\n            \\<Delta>(MkTup x y) \\<notin> set t; \\<star>(Tup x y) \\<notin> set t\n          \\<rbrakk>\n          \\<Longrightarrow> (t @ [\\<Delta>(MkTup x y), \\<star>(Tup x y)], r, s) \\<in> reachable P\"\n\n| encr:  \"\\<lbrakk> (t, r, s) \\<in> reachable P;\n            \\<star>(m) \\<in> set t;\n            \\<star>(k) \\<in> set t;\n            \\<Delta>(MkEncr m k) \\<notin> set t; \\<star>(Enc m k) \\<notin> set t\n          \\<rbrakk>\n          \\<Longrightarrow> (t @ [\\<Delta>(MkEncr m k), \\<star>(Enc m k)], r, s) \\<in> reachable P\"\n\n\n| decr:  \"\\<lbrakk> (t, r, s) \\<in> reachable P;\n            \\<star>(Enc m k) \\<in> set t;\n            \\<star>(inv k) \\<in> set t;\n            \\<Delta>(MkDecr m k) \\<notin> set t; \\<star>(m) \\<notin> set t\n          \\<rbrakk>\n          \\<Longrightarrow> (t @ [\\<Delta>(MkDecr m k), \\<star>(m)] \n                 @ unpairMsg (insert m {x | x. \\<star> x \\<in> set t}) m \n              , r, s) \\<in> reachable P\"\n\n\nsubsection{* Properties *}\n\nsubsubsection{* Execution Events *}\n\nlemma eventMsg_ground_extend_wts:\n  \"ground (eventMsg s e) \\<Longrightarrow>\n   eventMsg (extend_wts s s') e = eventMsg s e\"\n  apply(induct rule: eventMsg.induct)\n  by(simp_all add: extend_wts_conv_subst)\n\n\nsubsubsection{* Reachable States *}\n\nlocale reachable_state =\n  fixes P :: proto\n  and   t :: kntrace\n  and   r :: \"rolestep threadpool\"\n  and   s :: wt_subst\n  assumes reachable [simp,intro!]: \"(t,r,s) \\<in> reachable P\"\nbegin\n\nlemma proto_roles:\n  \"r tid = Some (todo,done) \\<Longrightarrow> \n  \\<exists> R \\<in> P. Rep_role R = rev done @ todo\"\n  apply(insert reachable, rotate_tac -1)\n  apply(induct arbitrary: tid todo \"done\" rule: reachable.induct)\n  apply(auto simp: newThread_def curStep_def nextStep_def split: if_splits option.splits list.splits)\n  done\n\nlemma Step_in_threadpool: \n  \"\\<Delta>(MkStep tid step) \\<in> set t \\<Longrightarrow> \n  \\<exists> todo done. r tid = Some (todo,done)\"\n  apply(insert reachable, rotate_tac -1)\n  apply(induct rule: reachable.induct)\n  by(auto simp: nextStep_def split: if_splits)\n\nlemma todo_notin_trace: \n  \"\\<lbrakk> r tid = Some (todo,done); step \\<in> set todo \\<rbrakk> \\<Longrightarrow> \n     \\<Delta>(MkStep tid step) \\<notin> set t\"\n  apply(insert reachable, rotate_tac -1)\n  proof(induct arbitrary: tid todo \"done\" rule: reachable.induct)\n    case init thus ?case by simp next\n    case (create t r s tid' R \\<alpha>)\n      then interpret old_state: reachable_state P t r s by unfold_locales\n      show ?case using prems\n      apply(clarsimp simp: newThread_def curStep_def split: option.splits if_splits)\n      apply(drule old_state.Step_in_threadpool)\n      apply(auto)\n      done\n  next\n    case (send t r s l msg tid')\n      then interpret old_state: reachable_state P t r s by unfold_locales\n      show ?case using prems\n      apply(clarsimp simp: nextStep_def curStep_def \n                    split: option.splits if_splits list.splits)\n      apply(frule old_state.proto_roles)\n      apply(clarsimp)\n      apply(subgoal_tac \"distinct (Rep_role R)\")\n      apply(force)\n      apply(rule Rep_role_distinct)\n      apply(force)\n      done\n  next\n    case (recv t r s l msg tid \\<alpha> tid' todo \"done\")\n      then interpret old_state: reachable_state P t r s by unfold_locales\n      show ?case using prems\n      apply(clarsimp simp: nextStep_def curStep_def \n                    split: option.splits if_splits list.splits)\n      apply(frule old_state.proto_roles)\n      apply(clarsimp)\n      apply(subgoal_tac \"distinct (Rep_role R)\")\n      apply(force)\n      apply(rule Rep_role_distinct)\n      apply(force)\n      done\n  next case hash thus ?case by auto\n  next case encr thus ?case by auto\n  next case decr thus ?case by auto\n  next case tuple thus ?case by auto\n  next case ik0 thus ?case by auto\nqed\n\nlemma done_in_trace: \n  \"\\<lbrakk> r tid = Some (todo,done); step \\<in> set done \\<rbrakk> \\<Longrightarrow> \n     \\<Delta>(MkStep tid step) \\<in> set t\"\n  apply(insert reachable, rotate_tac -1)\n  proof(induct arbitrary: tid todo \"done\" rule: reachable.induct)\n    case init thus ?case by simp next\n    case (create t r s tid' R \\<alpha>) thus ?case\n      apply(clarsimp simp: newThread_def curStep_def split: option.splits if_splits)\n      apply(rule FalseE)\n      apply(thin_tac \"dom_wts ?x = ?X\")\n      apply(auto)\n      done\n  next\n    case (send t r s l msg tid') thus ?case \n      apply(clarsimp simp: nextStep_def curStep_def \n                    split: option.splits if_splits list.splits)\n      apply(auto)\n      done\n  next\n    case (recv t r s l msg tid \\<alpha> tid' todo \"done\") thus ?case\n      apply(clarsimp simp: nextStep_def curStep_def \n                    split: option.splits if_splits list.splits)\n      apply(thin_tac \"dom_wts ?x = ?X\", force)+\n      done\n  next case hash thus ?case by auto\n  next case encr thus ?case by auto\n  next case decr thus ?case by auto\n  next case tuple thus ?case by auto\n  next case ik0 thus ?case by auto\nqed\n\nlemma Knows_in_set_unpairMsgI:\n  \"\\<lbrakk> x \\<in> pairParts m; x \\<notin> knows; x \\<noteq> m \\<rbrakk> \\<Longrightarrow> \n   \\<star> x \\<in> set (unpairMsg knows m)\"\n  apply(induct m arbitrary: x knows)\n  apply(simp_all)\n  apply(case_tac \"x = m1\", simp+)\n  apply(case_tac \"x = m2\", simp+)\n  apply(case_tac \"x \\<in> pairParts m1\", simp+)\n  apply(case_tac \"m1 = m2\", simp+)\n  done\n\nlemma MkFst_in_trace_imp_Knows_fst:\n  \"\\<Delta> MkFst x y \\<in> set t \\<Longrightarrow> \\<star> x \\<in> set t\"\n  apply(insert reachable, rotate_tac -1)\n  apply(induct arbitrary: x rule: reachable.induct)\n  apply(auto dest!: in_set_unpairMsg_casesD intro!: Knows_in_set_unpairMsgI)\n  done\n\nlemma MkSnd_in_trace_imp_Knows_snd:\n  \"\\<Delta> MkSnd x y \\<in> set t \\<Longrightarrow> \\<star> y \\<in> set t\"\n  apply(insert reachable, rotate_tac -1)\n  apply(induct arbitrary: x rule: reachable.induct)\n  apply(auto dest!: in_set_unpairMsg_casesD intro!: Knows_in_set_unpairMsgI)\n  done\n\n\nlemma distinct_trace:\n  \"distinct t\"\n  apply(insert reachable, rotate_tac -1)\nproof(induct rule: reachable.induct)\nnext\n  case (recv t r s l msg tid \\<alpha>)\n    then interpret old_state: reachable_state P t r s by unfold_locales\n    show ?case using prems(3,4)\n      by(auto simp: curStep_def  split: option.splits list.splits\n             dest!: old_state.todo_notin_trace)\nnext\n  case (send t r s l msg tid m)\n    then interpret old_state: reachable_state P t r s by unfold_locales\n    show ?case using prems(3,4)\n      by(auto simp: curStep_def  split: option.splits list.splits\n              dest: in_set_unpairMsg_casesD\n             dest!: old_state.todo_notin_trace\n                    old_state.MkFst_in_trace_imp_Knows_fst\n                    old_state.MkSnd_in_trace_imp_Knows_snd)\nnext \n  case (decr t r s m k)\n    then interpret old_state: reachable_state P t r s by unfold_locales\n    show ?case using prems(3,6-7)\n      by(auto dest: in_set_unpairMsg_casesD\n             dest!: old_state.MkFst_in_trace_imp_Knows_fst\n                    old_state.MkSnd_in_trace_imp_Knows_snd)\nnext case hash thus ?case by auto\nnext case encr thus ?case by auto\nnext case tuple thus ?case by auto\nnext case ik0 thus ?case by auto\nnext case init thus ?case by auto\nnext case create thus ?case by auto \nqed\n\nend\n\nsublocale reachable_state \\<subseteq> distinct_list \"t\"\n  by(unfold_locales, rule distinct_trace)\n\ncontext reachable_state begin\n\n(*\nnotation \n  \"directPred\" (infixl \"\\<prec>\\<^sub>1\" 50) and\n  \"pred\" (infixl \"\\<prec>\" 50) and\n  \"reflPred\" (infixl \"\\<preceq>\" 50)\n*)\n\n  abbreviation \n    \"next'\" (infixl \"\\<prec>\\<^sub>1\" 50) where \"next' \\<equiv> next\" \n  abbreviation \"pred'\" (infixl \"\\<prec>\" 50) where \"pred' \\<equiv> pred\"\n  abbreviation \"predEq'\" (infixl \"\\<preceq>\" 50) where \"predEq' \\<equiv>  predEq\"\n\n\nlemma roleOrd: \n  \"\\<lbrakk> r tid = Some (todo,done); \n     listOrd (rev done) prev step \\<rbrakk> \n   \\<Longrightarrow> \\<Delta>(MkStep tid prev) \\<prec> \\<Delta>(MkStep tid step)\"\n  apply(simp add: pred_def)\n  apply(insert reachable, rotate_tac -1)\n  proof (induct arbitrary: tid todo \"done\" rule: reachable.induct)\n    case init thus ?case by simp\n  next\n    case (create t r s tid' R \\<alpha>) thus ?case\n      by(auto simp: newThread_def split: if_splits)\n  next\n    case (send t r s l msg tid' m)\n      then interpret old_state: reachable_state P t r s by unfold_locales\n      show ?case using prems\n      apply(clarsimp simp: nextStep_def curStep_def \n                    split: option.splits if_splits list.splits)\n      by(auto dest: old_state.proto_roles old_state.todo_notin_trace \n                    old_state.done_in_trace)\n  next\n   case (recv t r s l msg tid')\n      then interpret old_state: reachable_state P t r s by unfold_locales\n      show ?case using prems(3,4,6-8)\n      apply(clarsimp simp: nextStep_def curStep_def \n                    split: option.splits if_splits list.splits)\n      by(auto dest: old_state.proto_roles old_state.todo_notin_trace \n                    old_state.done_in_trace)\n  next case hash thus ?case by auto\n  next case encr thus ?case by auto\n  next case decr thus ?case by auto\n  next case tuple thus ?case by auto\n  next case ik0 thus ?case by auto\nqed\n\nlemma subst_dom_AVar: \n  \"r tid = Some thread \\<Longrightarrow> EVar (AVar a) tid \\<in> dom_wts s\"\n  apply(insert reachable, rotate_tac -1)\n  apply(induct arbitrary: tid thread rule: reachable.induct, simp_all)\n  by(simp_all add: curStep_def nextStep_def split: option.splits if_splits)\n\nlemma subst_dom_MVar:\n  \"\\<lbrakk> r tid = Some (todo,done); Recv l msg \\<in> set done; \n     MVar v \\<in> FV msg\n   \\<rbrakk> \\<Longrightarrow> \n   EVar (MVar v) tid \\<in> dom_wts s\"\n  apply(insert reachable, rotate_tac -1)\nproof(induct arbitrary: tid todo \"done\" rule: reachable.induct)\n  case init thus ?case by simp next\n  case create thus ?case \n    by(auto simp: newThread_def split: option.splits if_splits) \nnext\n  case (send t r s lbl msg' tid tid') thus ?case\n    apply(clarsimp simp: curStep_def nextStep_def \n                  split: option.splits if_splits list.splits)\n    by(auto)\nnext\n  case (recv t r s lbl msg' tid \\<alpha> tid') thus ?case\n    apply(clarsimp simp: curStep_def nextStep_def \n                  split: option.splits if_splits list.splits)\n    apply(thin_tac \"dom_wts \\<alpha> = ?X\", force)\n    apply(thin_tac \"?x = ?y\", force)\n    done\nqed\n\nlemma Event_ground_unpairMsg:\n  \"\\<lbrakk> \\<Delta> e \\<in> set (unpairMsg knows m); ground m \\<rbrakk> \\<Longrightarrow> \n   ground (eventMsg s' e)\"\n  apply(induct m arbitrary: knows)\n  by(auto dest: in_set_unpairMsg_casesD split: if_splits)\n\nlemma Knows_ground_unpairMsg:\n  \"\\<lbrakk> \\<star> x \\<in> set (unpairMsg knows m); ground m \\<rbrakk> \\<Longrightarrow> \n   ground x\"\n  apply(induct m arbitrary: knows)\n  by(auto dest: in_set_unpairMsg_casesD split: if_splits)\n\nlemma eventMsg_Knows_ground:\n  \"(\\<forall>e. \\<Delta>(e) \\<in> set t \\<longrightarrow> ground (eventMsg s e)) \\<and>\n   (\\<forall>m. \\<star>(m) \\<in> set t \\<longrightarrow> ground m)\"\n  apply(insert reachable, rotate_tac -1)\nproof (induct arbitrary: m e rule: reachable.induct)\n  case (create t r s tid' R \\<alpha>) thus ?case\n    by(auto simp: eventMsg_ground_extend_wts)\nnext\n  case (send t r s l msg tid m)\n    then interpret old_state: reachable_state P t r s by unfold_locales\n    show ?case using prems(3-5)\n      apply(subgoal_tac \"ground m\")\n      apply(auto intro: Event_ground_unpairMsg Knows_ground_unpairMsg)\n      apply(subst ground_subst_s2e_conv_FV)\n      apply(clarsimp)\n      apply(case_tac v, simp_all)\n      apply(frule Some_curStepD, clarsimp)\n      apply(rule old_state.subst_dom_AVar, assumption)\n      apply(frule Some_curStepD, clarsimp)\n      apply(frule old_state.proto_roles, clarsimp)\n      apply(auto dest!: Rep_role_Send_FV intro: old_state.subst_dom_MVar)\n      done\nnext\n  case (recv t r s l msg tid \\<alpha>) thus ?case\n    by(auto simp: eventMsg_ground_extend_wts ground_subst_s2e_conv_FV)\nnext \n  case (decr t r s m k) thus ?case\n    by(auto dest!: Event_ground_unpairMsg Knows_ground_unpairMsg)\nnext case init thus ?case by auto\nnext case (hash t r s m) thus ?case by auto\nnext case ik0 thus ?case by auto\nnext case encr thus ?case by auto\nnext case tuple thus ?case by auto\nqed\n\nlemma Knows_ground:\n  \"\\<star>(m) \\<in> set t \\<Longrightarrow> ground m\"\n  by(auto simp: eventMsg_Knows_ground)\n\nlemma eventMsg_ground:\n  \"\\<Delta>(e) \\<in> set t \\<Longrightarrow> ground (eventMsg s e)\"\n  by(auto simp: eventMsg_Knows_ground)\n\nlemma Send_ground:\n  assumes send: \"Some (Send l msg) = curStep r tid\"\n  shows \"ground (subst s (s2e msg tid))\"\nproof -\nthm reachable.send\n  interpret sent_state: reachable_state P\n    \"let m = subst s (s2e msg tid) in\n     t @ [\\<Delta> MkStep tid (Send l msg)] @ \n         (if \\<star>(m) \\<in> set t then [] else \\<star> m # unpairMsg (insert m {x |x. \\<star> x \\<in> set t}) m)\"\n    \"nextStep r tid\" \"s\"\n    apply(unfold_locales)\n    apply(insert reachable)\n    apply(drule reachable.send)\n    apply(auto intro!: send simp: Let_def)\n    done\n  show ?thesis\n    apply(rule_tac P=ground in ssubst) prefer 2\n    apply(rule sent_state.eventMsg_ground, auto simp: Let_def)\n    done\nqed\n\n\nsubsubsection{* Destruction rules capturing the knowledge effect of an event *}\n\nlemma SendD: \n  \"\\<Delta>(MkStep tid (Send lbl msg)) \\<in> set t \\<Longrightarrow> \\<star>(subst s (s2e msg tid)) \\<in> set t\"\n  apply(insert reachable, rotate_tac -1)\n  apply(induct rule: reachable.induct)\n  by(auto simp: extend_wts_conv_subst\n          dest: reachable_state.eventMsg_ground[OF reachable_state.intro]) \n\nlemma FromIK0D: \n  \"\\<Delta>(FromIK0 m) \\<in> set t \\<Longrightarrow> \\<star>m \\<in> set t\"\n  by(insert reachable, rotate_tac -1, \n     induct rule: reachable.induct, auto)\n\nlemma MkHashD: \n  \"\\<Delta>(MkHash m) \\<in> set t \\<Longrightarrow> \\<star>(Hash m) \\<in> set t\"\n  by(insert reachable, rotate_tac -1, \n     induct rule: reachable.induct, auto)\n\nlemma MkFstD: \n  \"\\<Delta>(MkFst x y) \\<in> set t \\<Longrightarrow> \\<star>x \\<in> set t\"\n  by(insert reachable, rotate_tac -1, \n     induct rule: reachable.induct, auto dest: MkFst_in_set_unpairMsgD)\n\nlemma MkSndD: \n  \"\\<Delta>(MkSnd x y) \\<in> set t \\<Longrightarrow> \\<star>y \\<in> set t\"\n  by(insert reachable, rotate_tac -1, \n     induct rule: reachable.induct, auto dest: MkSnd_in_set_unpairMsgD)\n\nlemma MkTupD: \n  \"\\<Delta>(MkTup x y) \\<in> set t \\<Longrightarrow> \\<star>(Tup x y) \\<in> set t\"\n  by(insert reachable, rotate_tac -1, \n     induct rule: reachable.induct, auto)\n\nlemma MkEncrD: \n  \"\\<Delta>(MkEncr m k) \\<in> set t \\<Longrightarrow> \\<star>Enc m k \\<in> set t\"\n  by(insert reachable, rotate_tac -1, \n     induct rule: reachable.induct, auto)\n\nlemma MkDecrD: \n  \"\\<Delta>(MkDecr m k) \\<in> set t \\<Longrightarrow> \\<star>m \\<in> set t\"\n  by(insert reachable, rotate_tac -1, \n     induct rule: reachable.induct, auto)\n\nend\n\nsubsection{* Relating @{term reachable} to @{term ossp} *}\n\n\nfun kntrace2trace :: \"kntrace \\<Rightarrow> trace\"\nwhere\n  \"kntrace2trace [] = []\"\n| \"kntrace2trace (\\<Delta>(MkStep tid step) # kes) = (tid,step) # kntrace2trace kes\"\n| \"kntrace2trace (_                  # kes) =              kntrace2trace kes\"\n\n\nlemma kntrace2trace_append [simp]: \n  \"kntrace2trace (t@t') = kntrace2trace t @ kntrace2trace t'\"\n  by(induct t rule: kntrace2trace.induct, auto)\n\nlemma set_kntrace2trace_conv_set [simp]:\n  \"set (kntrace2trace t) = \n   { (tid,step) | tid step. \\<Delta>(MkStep tid step) \\<in> set t}\"\n  by(induct t rule: kntrace2trace.induct, auto)\n\ncontext reachable_state begin\n\nlemma spies_kntrace2trace_extend_wts [simp]:\n  \"spies (extend_wts s \\<alpha>) (kntrace2trace t) = spies s (kntrace2trace t)\"\n  by(force simp: spies_conv_set extend_wts_conv_subst\n           dest: eventMsg_ground)\n\nlemma kntrace2trace_unpairMsg [simp]:\n  \"kntrace2trace (unpairMsg knows m) = []\"\n  by(induct m arbitrary: knows, auto)\n\nlemma pairParts_in_infer:\n  \"\\<lbrakk> x \\<in> pairParts m; m \\<in> infer M \\<rbrakk> \\<Longrightarrow> x \\<in> infer M\"\n  by(induct m arbitrary: x, auto)\n\nlemma Knows_spies_kntrace2trace:\n  \"\\<star>m \\<in> set t \\<Longrightarrow> m \\<in> infer (spies s (kntrace2trace t))\"\n  apply(insert reachable, rotate_tac -1)\n  apply(induct arbitrary: m rule: reachable.induct)\n  prefer 9\n  apply(subgoal_tac \"m \\<in> infer (spies s (kntrace2trace t))\")\n  apply(auto intro: infer.intros pairParts_in_infer\n             split: if_splits  \n              dest: in_set_unpairMsg_casesD\n              simp: reachable_state.spies_kntrace2trace_extend_wts[OF reachable_state.intro])\n  done\n\nlemma in_ossp:\n  \"(kntrace2trace t, r, s) \\<in> ossp P\"\n  apply(insert reachable)\n  apply(induct rule: reachable.induct)\n  apply(simp_all add: ossp.intros)\n  apply(drule ossp.create, simp+)\n  apply(rule_tac P=\"\\<lambda>x. (kntrace2trace t,x,extend_wts s \\<alpha>) \\<in> ?X\" in subst)\n  apply(rule ext)\n  apply(auto intro: ossp.intros \n            intro!: reachable_state.Knows_spies_kntrace2trace\n                    reachable_state.intro)\n  done\n\nend\n\n(*\n \nlemma infer_Knows:\n  \"\\<lbrakk> m \\<in> infer M; (t,r,s) \\<in> reachable P; \\<forall> x \\<in> M. \\<star>x \\<in> set t \\<rbrakk>\n  \\<Longrightarrow> \\<exists> t'. (t@t',r,s) \\<in> reachable P \\<and> kntrace2trace t' = [] \\<and> \n            \\<star>m \\<in> set (t@t') \\<and> (\\<forall> x \\<in> M. \\<star>x \\<notin> set t')\"\nproof(induct arbitrary: t rule: infer.induct)\n  case (Inj m) thus ?case by(rule_tac x=\"[]\" in exI, simp)\nnext\n  case (Hash m) show ?case using prems(3)\n    apply(simp)\n    apply(drule prems(2))\n    apply(rule prems)\n    apply(clarsimp)\n    apply(case_tac \"\\<star>(Hash m) \\<in> set (t@t')\")\n    apply(rule_tac x=\"t'\" in exI, simp)\n    apply(case_tac \"\\<Delta>(MkHash m) \\<in> set (t@t')\")\n    apply(drule reachable_state.MkHashD[OF reachable_state.intro])\n    apply(simp+)\n    apply(drule reachable.hash, simp+)\n    apply(auto simp: prems(4))\n    done\nnext\n  case (Fst m x) show ?case using prems(3)\n    apply(simp)\n    apply(drule prems(2), rule prems, clarsimp)\n    apply(case_tac \"\\<star>m \\<in> set (t@t')\")\n    apply(rule_tac x=\"t'\" in exI, simp)\n    apply(case_tac \"\\<Delta>(MkFst m x) \\<in> set (t@t')\")\n    apply(drule reachable_state.MkFstD[OF reachable_state.intro])\n    apply(simp+)\n    apply(drule reachable.fst, simp+)\n    apply(auto simp: prems(4))\n    done\nnext\n  case (Snd x m) show ?case using prems(3)\n    apply(simp)\n    apply(drule prems(2), rule prems, clarsimp)\n    apply(case_tac \"\\<star>m \\<in> set (t@t')\")\n    apply(rule_tac x=\"t'\" in exI, simp)\n    apply(case_tac \"\\<Delta>(MkSnd x m) \\<in> set (t@t')\")\n    apply(drule reachable_state.MkSndD[OF reachable_state.intro])\n    apply(simp+)\n    apply(drule reachable.snd, simp+)\n    apply(auto simp: prems(4))\n    done\nnext\n  case (Tup x y) show ?case using prems(5)\n    apply(simp)\n    apply(drule prems(2), rule prems, clarsimp)\n    apply(drule prems(4))\n    apply(simp add: prems)\n    apply(clarsimp)\n    apply(case_tac \"\\<star>(Tup x y) \\<in> set (t@t'@t'a)\")\n    apply(rule_tac x=\"t'@t'a\" in exI, simp)\n    apply(case_tac \"\\<Delta>(MkTup x y) \\<in> set (t@t'@t'a)\")\n    apply(drule reachable_state.MkTupD[OF reachable_state.intro])\n    apply(simp+)\n    apply(drule_tac x=x and y=y in reachable.tuple)\n    apply(auto simp: prems(6))\n    done\nnext\n  case (Enc m k) show ?case using prems(5)\n    apply(simp)\n    apply(drule prems(2), rule prems, clarsimp)\n    apply(drule prems(4))\n    apply(simp add: prems)\n    apply(clarsimp)\n    apply(case_tac \"\\<star>(Enc m k) \\<in> set (t@t'@t'a)\")\n    apply(rule_tac x=\"t'@t'a\" in exI, simp)\n    apply(case_tac \"\\<Delta>(MkEncr m k) \\<in> set (t@t'@t'a)\")\n    apply(drule reachable_state.MkEncrD[OF reachable_state.intro])\n    apply(simp+)\n    apply(drule_tac m=m and k=k in reachable.encr)\n    apply(auto simp: prems(6))\n    done\nnext\n  case (Dec m k) show ?case using prems(5)\n    apply(simp)\n    apply(drule prems(2), rule prems, clarsimp)\n    apply(drule prems(4))\n    apply(simp add: prems)\n    apply(clarsimp)\n    apply(case_tac \"\\<star>m \\<in> set (t@t'@t'a)\")\n    apply(rule_tac x=\"t'@t'a\" in exI, simp)\n    apply(case_tac \"\\<Delta>(MkDecr m k) \\<in> set (t@t'@t'a)\")\n    apply(drule reachable_state.MkDecrD[OF reachable_state.intro])\n    apply(simp+)\n    apply(drule_tac m=m and k=k in reachable.decr)\n    apply(auto simp: prems(6))\n    done\nqed\n\nlemma spies_kntrace_Knows:\n  \"\\<lbrakk> finite M; (t,r,s) \\<in> reachable P; M \\<subseteq> spies s (kntrace2trace t) \\<rbrakk> \\<Longrightarrow> \n   \\<exists> t'. (t@t',r,s) \\<in> reachable P \\<and> \n         kntrace2trace t' = [] \\<and>  (\\<forall> m \\<in> M. \\<star>m \\<in> set (t@t'))\"\n  apply(induct rule: finite.induct)\n  apply(rule_tac x=\"[]\" in exI, simp)\n  apply(clarsimp)\n  apply(thin_tac \"A \\<subseteq> ?X\", thin_tac \"(t,r,s) \\<in> ?X\", thin_tac \"finite ?X\")\n  apply(clarsimp simp: spies_conv_set)\n  apply(erule disjE)\n  apply(case_tac \"\\<star>a \\<in> set (t@t')\")\n  apply(rule_tac x=\"t'\" in exI, simp)\n  apply(case_tac \"\\<Delta>(FromIK0 a) \\<in> set (t@t')\")\n  apply(drule reachable_state.FromIK0D[OF reachable_state.intro])\n  apply(simp+)\n  apply(drule reachable.ik0, simp+)\n  apply(rule exI, rule conjI)\n  apply(auto)\n  apply(rule_tac x=\"t'\" in exI)\n  apply(auto dest: reachable_state.SendD[OF reachable_state.intro])\n  done\n\nlemma ossp_in_reachable:\n  \"(t,r,s) \\<in> ossp P \\<Longrightarrow>\n   \\<exists> t'. t = kntrace2trace t' \\<and> (t',r,s) \\<in> reachable P\"\nproof(induct rule: ossp.induct)\n  case init thus ?case \n    apply(rule_tac x=\"[]\" in exI)\n    by(auto intro: reachable.intros)\nnext\n  case (create t r s tid R \\<alpha>) thus ?case\n    apply(simp)\n    apply(erule exE, erule conjE)\n    apply(rule_tac x=\"t'\" in exI)\n    apply(simp)\n    apply(drule reachable.create, simp+)\n    apply(rule_tac P=\"\\<lambda>x. (t',x,extend_wts s \\<alpha>) \\<in> ?X\" in subst)\n    apply(rule ext)\n    apply(auto)\n    done\nnext\n  case (send t r s l msg tid) thus ?case\n    apply(clarsimp)\n    apply(rule exI, rule conjI) prefer 2\n    apply(erule reachable.send, simp+)\n    done\nnext\n  case (recv t r s l msg tid \\<alpha>) thus ?case\n    apply(clarsimp)\n    apply(drule infer_finite_support)\n    apply(clarsimp)\n    apply(drule spies_kntrace_Knows, assumption+)\n    apply(clarsimp)\n    apply(thin_tac \"(t',r,s) \\<in> ?X\")\n    apply(frule infer_Knows, simp+)\n    apply(clarsimp)\n    apply(rule_tac x=\"t' @ t'a @ t'b @ [\\<Delta>(MkStep tid (Recv l msg))]\" in exI)\n    apply(simp)\n    apply(thin_tac \"(t'@t'a,r,s) \\<in> ?X\")\n    apply(drule reachable.recv)\n    apply(assumption+)\n    apply(auto)\n    done\nqed\n\n\nlemma ossp_conv_reachable:\n  \"ossp P = {(kntrace2trace t,r,s) | t r s. (t,r,s) \\<in> reachable P}\"\n  by(auto intro!: ossp_in_reachable reachable_state.in_ossp\n                  reachable_state.intro)\n\n*)\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/data/isabelle/src/experiments/protocol_semantics/UnpairedExecution.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3237816559741216}}
{"text": "(*  Title:      JinjaDCI/J/Progress.thy\n\n    Author:     Tobias Nipkow, Susannah Mansky\n    Copyright   2003 Technische Universitaet Muenchen, 2019-20 UIUC\n\n    Based on the Jinja theory J/Progress.thy by Tobias Nipkow\n*)\n\nsection \\<open> Progress of Small Step Semantics \\<close>\n\ntheory Progress\nimports WellTypeRT DefAss \"../Common/Conform\" EConform\nbegin\n\nlemma final_addrE:\n  \"\\<lbrakk> P,E,h,sh \\<turnstile> e : Class C; final e;\n    \\<And>a. e = addr a \\<Longrightarrow> R;\n    \\<And>a. e = Throw a \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n(*<*)by(auto simp:final_def)(*>*)\n\n\nlemma finalRefE:\n \"\\<lbrakk> P,E,h,sh \\<turnstile> e : T; is_refT T; final e;\n   e = null \\<Longrightarrow> R;\n   \\<And>a C. \\<lbrakk> e = addr a; T = Class C \\<rbrakk> \\<Longrightarrow> R;\n   \\<And>a. e = Throw a \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n(*<*)by(auto simp:final_def is_refT_def)(*>*)\n\n\ntext\\<open> Derivation of new induction scheme for well typing: \\<close>\n\ninductive\n  WTrt' :: \"[J_prog,heap,sheap,env,expr,ty] \\<Rightarrow> bool\"\n  and WTrts' :: \"[J_prog,heap,sheap,env,expr list, ty list] \\<Rightarrow> bool\"\n  and WTrt2' :: \"[J_prog,env,heap,sheap,expr,ty] \\<Rightarrow> bool\"\n        (\"_,_,_,_ \\<turnstile> _ :'' _\"   [51,51,51,51]50)\n  and WTrts2' :: \"[J_prog,env,heap,sheap,expr list, ty list] \\<Rightarrow> bool\"\n        (\"_,_,_,_ \\<turnstile> _ [:''] _\" [51,51,51,51]50)\n  for P :: J_prog and h :: heap and sh :: sheap\nwhere\n  \"P,E,h,sh \\<turnstile> e :' T \\<equiv> WTrt' P h sh E e T\"\n| \"P,E,h,sh \\<turnstile> es [:'] Ts \\<equiv> WTrts' P h sh E es Ts\"\n\n| \"is_class P C  \\<Longrightarrow>  P,E,h,sh \\<turnstile> new C :' Class C\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e :' T; is_refT T; is_class P C \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> Cast C e :' Class C\"\n| \"typeof\\<^bsub>h\\<^esub> v = Some T \\<Longrightarrow> P,E,h,sh \\<turnstile> Val v :' T\"\n| \"E v = Some T  \\<Longrightarrow>  P,E,h,sh \\<turnstile> Var v :' T\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e\\<^sub>1 :' T\\<^sub>1;  P,E,h,sh \\<turnstile> e\\<^sub>2 :' T\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> e\\<^sub>1 \\<guillemotleft>Eq\\<guillemotright> e\\<^sub>2 :' Boolean\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e\\<^sub>1 :' Integer;  P,E,h,sh \\<turnstile> e\\<^sub>2 :' Integer \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> e\\<^sub>1 \\<guillemotleft>Add\\<guillemotright> e\\<^sub>2 :' Integer\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> Var V :' T;  P,E,h,sh \\<turnstile> e :' T';  P \\<turnstile> T' \\<le> T \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> V:=e :' Void\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e :' Class C; P \\<turnstile> C has F,NonStatic:T in D \\<rbrakk> \\<Longrightarrow> P,E,h,sh \\<turnstile> e\\<bullet>F{D} :' T\"\n| \"P,E,h,sh \\<turnstile> e :' NT \\<Longrightarrow> P,E,h,sh \\<turnstile> e\\<bullet>F{D} :' T\"\n| \"\\<lbrakk> P \\<turnstile> C has F,Static:T in D \\<rbrakk> \\<Longrightarrow> P,E,h,sh \\<turnstile> C\\<bullet>\\<^sub>sF{D} :' T\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e\\<^sub>1 :' Class C;  P \\<turnstile> C has F,NonStatic:T in D;\n    P,E,h,sh \\<turnstile> e\\<^sub>2 :' T\\<^sub>2;  P \\<turnstile> T\\<^sub>2 \\<le> T \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> e\\<^sub>1\\<bullet>F{D}:=e\\<^sub>2 :' Void\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e\\<^sub>1:'NT; P,E,h,sh \\<turnstile> e\\<^sub>2 :' T\\<^sub>2 \\<rbrakk> \\<Longrightarrow> P,E,h,sh \\<turnstile> e\\<^sub>1\\<bullet>F{D}:=e\\<^sub>2 :' Void\"\n| \"\\<lbrakk> P \\<turnstile> C has F,Static:T in D;\n    P,E,h,sh \\<turnstile> e\\<^sub>2 :' T\\<^sub>2;  P \\<turnstile> T\\<^sub>2 \\<le> T \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> C\\<bullet>\\<^sub>sF{D}:=e\\<^sub>2 :' Void\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e :' Class C; P \\<turnstile> C sees M,NonStatic:Ts \\<rightarrow> T = (pns,body) in D;\n    P,E,h,sh \\<turnstile> es [:'] Ts'; P \\<turnstile> Ts' [\\<le>] Ts \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> e\\<bullet>M(es) :' T\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e :' NT; P,E,h,sh \\<turnstile> es [:'] Ts \\<rbrakk> \\<Longrightarrow> P,E,h,sh \\<turnstile> e\\<bullet>M(es) :' T\"\n| \"\\<lbrakk> P \\<turnstile> C sees M,Static:Ts \\<rightarrow> T = (pns,body) in D;\n    P,E,h,sh \\<turnstile> es [:'] Ts'; P \\<turnstile> Ts' [\\<le>] Ts;\n    M = clinit \\<longrightarrow> sh D = \\<lfloor>(sfs,Processing)\\<rfloor> \\<and> es = map Val vs \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> C\\<bullet>\\<^sub>sM(es) :' T\"\n| \"P,E,h,sh \\<turnstile> [] [:'] []\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e :' T;  P,E,h,sh \\<turnstile> es [:'] Ts \\<rbrakk> \\<Longrightarrow>  P,E,h,sh \\<turnstile> e#es [:'] T#Ts\"\n| \"\\<lbrakk> typeof\\<^bsub>h\\<^esub> v = Some T\\<^sub>1; P \\<turnstile> T\\<^sub>1 \\<le> T; P,E(V\\<mapsto>T),h,sh \\<turnstile> e\\<^sub>2 :' T\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow>  P,E,h,sh \\<turnstile> {V:T := Val v; e\\<^sub>2} :' T\\<^sub>2\"\n| \"\\<lbrakk> P,E(V\\<mapsto>T),h,sh \\<turnstile> e :' T'; \\<not> assigned V e \\<rbrakk> \\<Longrightarrow>  P,E,h,sh \\<turnstile> {V:T; e} :' T'\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e\\<^sub>1:' T\\<^sub>1;  P,E,h,sh \\<turnstile> e\\<^sub>2:'T\\<^sub>2 \\<rbrakk>  \\<Longrightarrow>  P,E,h,sh \\<turnstile> e\\<^sub>1;;e\\<^sub>2 :' T\\<^sub>2\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e :' Boolean;  P,E,h,sh \\<turnstile> e\\<^sub>1:' T\\<^sub>1;  P,E,h,sh \\<turnstile> e\\<^sub>2:' T\\<^sub>2;\n    P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1;\n    P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<longrightarrow> T = T\\<^sub>2; P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1 \\<longrightarrow> T = T\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> if (e) e\\<^sub>1 else e\\<^sub>2 :' T\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e :' Boolean;  P,E,h,sh \\<turnstile> c:' T \\<rbrakk>\n  \\<Longrightarrow>  P,E,h,sh \\<turnstile> while(e) c :' Void\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e :' T\\<^sub>r; is_refT T\\<^sub>r \\<rbrakk>  \\<Longrightarrow>  P,E,h,sh \\<turnstile> throw e :' T\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e\\<^sub>1 :' T\\<^sub>1;  P,E(V \\<mapsto> Class C),h,sh \\<turnstile> e\\<^sub>2 :' T\\<^sub>2; P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> try e\\<^sub>1 catch(C V) e\\<^sub>2 :' T\\<^sub>2\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e :' T; \\<forall>C' \\<in> set (C#Cs). is_class P C'; \\<not>sub_RI e;\n     \\<forall>C' \\<in> set (tl Cs). \\<exists>sfs. sh C' = \\<lfloor>(sfs,Processing)\\<rfloor>;\n     b \\<longrightarrow> (\\<forall>C' \\<in> set Cs. \\<exists>sfs. sh C' = \\<lfloor>(sfs,Processing)\\<rfloor>);\n     distinct Cs; supercls_lst P Cs \\<rbrakk> \\<Longrightarrow> P,E,h,sh \\<turnstile> INIT C (Cs, b) \\<leftarrow> e :' T\"\n| \"\\<lbrakk> P,E,h,sh \\<turnstile> e :' T; P,E,h,sh \\<turnstile> e' :' T'; \\<forall>C' \\<in> set (C#Cs). is_class P C'; \\<not>sub_RI e';\n     \\<forall>C' \\<in> set (C#Cs). not_init C' e;\n     \\<forall>C' \\<in> set Cs. \\<exists>sfs. sh C' = \\<lfloor>(sfs,Processing)\\<rfloor>;\n     \\<exists>sfs. sh C = \\<lfloor>(sfs, Processing)\\<rfloor> \\<or> (sh C = \\<lfloor>(sfs, Error)\\<rfloor> \\<and> e = THROW NoClassDefFoundError);\n     distinct (C#Cs); supercls_lst P (C#Cs) \\<rbrakk>\n  \\<Longrightarrow> P,E,h,sh \\<turnstile> RI(C, e);Cs \\<leftarrow> e' :' T'\"\n\n(*<*)\nlemmas WTrt'_induct = WTrt'_WTrts'.induct [split_format (complete)]\n  and WTrt'_inducts = WTrt'_WTrts'.inducts [split_format (complete)]\n\ninductive_cases WTrt'_elim_cases[elim!]:\n  \"P,E,h,sh \\<turnstile> V :=e :' T\"\n(*>*)\n\n\n\nlemma [iff]: \"P,E,h,sh \\<turnstile> Val v :' T = (typeof\\<^bsub>h\\<^esub> v = Some T)\"\n(*<*)by(rule iffI) (auto elim: WTrt'.cases intro!:WTrt'_WTrts'.intros)(*>*)\n\nlemma [iff]: \"P,E,h,sh \\<turnstile> Var v :' T = (E v = Some T)\"\n(*<*)by(rule iffI) (auto elim: WTrt'.cases intro!:WTrt'_WTrts'.intros)(*>*)\n\n\nlemma wt_wt': \"P,E,h,sh \\<turnstile> e : T \\<Longrightarrow> P,E,h,sh \\<turnstile> e :' T\"\nand wts_wts': \"P,E,h,sh \\<turnstile> es [:] Ts \\<Longrightarrow> P,E,h,sh \\<turnstile> es [:'] Ts\"\n(*<*)\nproof(induct rule:WTrt_inducts)\n  case (WTrtBlock E V T e T')\n  then show ?case\n  proof(cases \"assigned V e\")\n    case True then show ?thesis using WTrtBlock.hyps(2)\n      by(clarsimp simp add:fun_upd_same assigned_def WTrt'_WTrts'.intros\n                  simp del:fun_upd_apply)\n  next\n    case False then show ?thesis\n      by (simp add: WTrtBlock.hyps(2) WTrt'_WTrts'.intros)\n  qed\nqed (blast intro:WTrt'_WTrts'.intros)+\n(*>*)\n\n\nlemma wt'_wt: \"P,E,h,sh \\<turnstile> e :' T \\<Longrightarrow> P,E,h,sh \\<turnstile> e : T\"\nand wts'_wts: \"P,E,h,sh \\<turnstile> es [:'] Ts \\<Longrightarrow> P,E,h,sh \\<turnstile> es [:] Ts\"\n(*<*)\nproof(induct rule:WTrt'_inducts)\n  case Block: (19 v T\\<^sub>1 T E V e\\<^sub>2 T\\<^sub>2)\n  let ?E = \"E(V \\<mapsto> T)\"\n  have \"P,?E,h,sh \\<turnstile> Val v : T\\<^sub>1\" using Block.hyps(1) by simp\n  moreover have \"P \\<turnstile> T\\<^sub>1 \\<le> T\" by(rule Block.hyps(2))\n  ultimately have \"P,?E,h,sh \\<turnstile> V:=Val v : Void\" using WTrtLAss by simp\n  moreover have \"P,?E,h,sh \\<turnstile> e\\<^sub>2 : T\\<^sub>2\" by(rule Block.hyps(4))\n  ultimately have \"P,?E,h,sh \\<turnstile> V:=Val v;; e\\<^sub>2 : T\\<^sub>2\" by blast\n  then show ?case by simp\nqed (blast intro:WTrt_WTrts.intros)+\n(*>*)\n\n\ncorollary wt'_iff_wt: \"(P,E,h,sh \\<turnstile> e :' T) = (P,E,h,sh \\<turnstile> e : T)\"\n(*<*)by(blast intro:wt_wt' wt'_wt)(*>*)\n\n\ncorollary wts'_iff_wts: \"(P,E,h,sh \\<turnstile> es [:'] Ts) = (P,E,h,sh \\<turnstile> es [:] Ts)\"\n(*<*)by(blast intro:wts_wts' wts'_wts)(*>*)\n\n(*<*)\nlemmas WTrt_inducts2 = WTrt'_inducts [unfolded wt'_iff_wt wts'_iff_wts,\n case_names WTrtNew WTrtCast WTrtVal WTrtVar WTrtBinOpEq WTrtBinOpAdd WTrtLAss\n WTrtFAcc WTrtFAccNT WTrtSFAcc WTrtFAss WTrtFAssNT WTrtSFAss WTrtCall WTrtCallNT WTrtSCall\n WTrtNil WTrtCons WTrtInitBlock WTrtBlock WTrtSeq WTrtCond WTrtWhile WTrtThrow WTrtTry\n WTrtInit WTrtRI, consumes 1]\n(*>*)\n\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/J/Progress.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.32378165597412156}}
{"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      VcgEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Examples using the Verification Environment *}\n\ntheory VcgEx imports \"../HeapList\" \"../Vcg\" begin\n\ntext {* Some examples, especially the single-step Isar proofs are taken from\n\\texttt{HOL/Isar\\_examples/HoareEx.thy}. \n*}\n\nsubsection {* State Spaces *}\n\ntext {*\n First of all we provide a store of program variables that\n occur in the programs considered later.  Slightly unexpected\n things may happen when attempting to work with undeclared variables.\n*}\n\nrecord 'g vars = \"'g state\" +\n  A_' :: nat\n  I_' :: nat\n  M_' :: nat\n  N_' :: nat\n  R_' :: nat\n  S_' :: nat\n  B_' :: bool\n  Arr_' :: \"nat list\"\n  Abr_':: string\n\n\n\ntext {* We decorate the state components in the record with the suffix @{text \"_'\"},\nto avoid cluttering the namespace with the simple names that could no longer\nbe used for logical variables otherwise. \n*}\n\ntext {* We will first consider programs without procedures, later on\nwe will regard procedures without global variables and finally we\nwill get the full pictures: mutually recursive procedures with global\nvariables (including heap).\n*}\n\nsubsection {* Basic Examples *}\n\ntext {*\n We look at few trivialities involving assignment and sequential\n composition, in order to get an idea of how to work with our\n formulation of Hoare Logic.\n*}\n\ntext {*\n Using the basic rule directly is a bit cumbersome.\n*}\n \nlemma \"\\<Gamma>\\<turnstile> {|\\<acute>N = 5|} \\<acute>N :== 2 * \\<acute>N {|\\<acute>N = 10|}\"\n  apply (rule HoarePartial.Basic)  apply simp\n  done\n\ntext {*\n If we refer to components (variables) of the state-space of the program\n we always mark these with @{text \"\\<acute>\"}. It is the acute-symbol and is present on\n most keyboards. So all program variables are marked with the acute and all\n logical variables are not.\n The assertions of the Hoare tuple are\n ordinary Isabelle sets. As we usually want to refer to the state space\n in the assertions, we provide special brackets for them. They can be written \n as {\\verb+{| |}+} in ASCII or @{text \"\\<lbrace> \\<rbrace>\"} with X-symbols. Internally\n marking variables has two effects. First of all we refer to the implicit\n state and secondary we get rid of the suffix @{text \"_'\"}.\n So the assertion @{term \"{|\\<acute>N = 5|}\"} internally gets expanded to \n @{text \"{s. N_' s = 5}\"} written in ordinary set comprehension notation of\n Isabelle. It describes the set of states where the @{text \"N_'\"} component\n is equal to @{text \"5\"}. \n*}\n\n\ntext {*\n Certainly we want the state modification already done, e.g.\\ by\n simplification.  The @{text vcg} method performs the basic state\n update for us; we may apply the Simplifier afterwards to achieve\n ``obvious'' consequences as well.\n*}\n\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \\<acute>N :== 10 \\<lbrace>\\<acute>N = 10\\<rbrace>\"\n  by vcg\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>2 * \\<acute>N = 10\\<rbrace> \\<acute>N :== 2 * \\<acute>N \\<lbrace>\\<acute>N = 10\\<rbrace>\"\n  by vcg\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = 5\\<rbrace> \\<acute>N :== 2 * \\<acute>N \\<lbrace>\\<acute>N = 10\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N + 1 = a + 1\\<rbrace> \\<acute>N :== \\<acute>N + 1 \\<lbrace>\\<acute>N = a + 1\\<rbrace>\"\n  by vcg \n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = a\\<rbrace> \\<acute>N :== \\<acute>N + 1 \\<lbrace>\\<acute>N = a + 1\\<rbrace>\"\n  by vcg\n \n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>a = a \\<and> b = b\\<rbrace> \\<acute>M :== a;; \\<acute>N :== b \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\"\n  by vcg\n  \n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \\<acute>M :== a;; \\<acute>N :== b \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\"\n  by vcg\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\n                \\<acute>I :== \\<acute>M;; \\<acute>M :== \\<acute>N;; \\<acute>N :== \\<acute>I\n              \\<lbrace>\\<acute>M = b \\<and> \\<acute>N = a\\<rbrace>\"\n  by vcg\n\ntext {*\nWe can also perform verification conditions generation step by step by using\nthe @{text vcg_step} method.\n*}\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\n               \\<acute>I :== \\<acute>M;; \\<acute>M :== \\<acute>N;; \\<acute>N :== \\<acute>I\n              \\<lbrace>\\<acute>M = b \\<and> \\<acute>N = a\\<rbrace>\"\n  apply vcg_step\n  apply vcg_step\n  apply vcg_step\n  apply vcg_step\n  done\n\ntext {*\n It is important to note that statements like the following one can\n only be proven for each individual program variable.  Due to the\n extra-logical nature of record fields, we cannot formulate a theorem\n relating record selectors and updates schematically.\n*}\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = a\\<rbrace> \\<acute>N :== \\<acute>N \\<lbrace>\\<acute>N = a\\<rbrace>\"\n  by vcg\n\n\n(*\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>x = a\\<rbrace> \\<acute>x :== \\<acute>x \\<lbrace>\\<acute>x = a\\<rbrace>\"\n  apply (rule HoarePartial.Basic)\n  -- {* We can't proof this since we don't know what @{text \"x_'_update\"} is. *}\n  oops\n *)\nlemma \"\\<Gamma>\\<turnstile>{s. x_' s = a} (Basic (\\<lambda>s. x_'_update (x_' s) s)) {s. x_' s = a}\"\n  oops\n\n\ntext {*\n In the following assignments we make use of the consequence rule in\n order to achieve the intended precondition.  Certainly, the\n @{text vcg} method is able to handle this case, too.\n*}\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\nproof -\n  have \"\\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>M + 1 \\<noteq> \\<acute>N\\<rbrace>\"\n    by auto\n  also have \"\\<Gamma>\\<turnstile> \\<dots> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\n    by vcg\n  finally show ?thesis .\nqed\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\nproof -\n  have \"\\<And>m n::nat. m = n \\<longrightarrow> m + 1 \\<noteq> n\"\n      -- {* inclusion of assertions expressed in ``pure'' logic, *}\n      -- {* without mentioning the state space *}\n    by simp\n  also have \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M + 1 \\<noteq> \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\n    by vcg\n  finally show ?thesis .\nqed\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\nsubsection {* Multiplication by Addition *}\n\ntext {*\n We now do some basic examples of actual \\texttt{WHILE} programs.\n This one is a loop for calculating the product of two natural\n numbers, by iterated addition.  We first give detailed structured\n proof based on single-step Hoare rules.\n*}\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n      WHILE \\<acute>M \\<noteq> a\n      DO \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 OD\n      \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\nproof -\n  let \"\\<Gamma>\\<turnstile> _ ?while _\" = ?thesis\n  let \"\\<lbrace>\\<acute>?inv\\<rbrace>\" = \"\\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\"\n\n  have \"\\<lbrace>\\<acute>M = 0 & \\<acute>S = 0\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>?inv\\<rbrace>\" by auto\n  also have \"\\<Gamma>\\<turnstile> \\<dots> ?while \\<lbrace>\\<acute>?inv \\<and> \\<not> (\\<acute>M \\<noteq> a)\\<rbrace>\"\n  proof\n    let ?c = \"\\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1\"\n    have \"\\<lbrace>\\<acute>?inv \\<and> \\<acute>M \\<noteq> a\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>S + b = (\\<acute>M + 1) * b\\<rbrace>\"\n      by auto\n    also have \"\\<Gamma>\\<turnstile> \\<dots> ?c \\<lbrace>\\<acute>?inv\\<rbrace>\" by vcg\n    finally show \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>?inv \\<and> \\<acute>M \\<noteq> a\\<rbrace> ?c \\<lbrace>\\<acute>?inv\\<rbrace>\" .\n  qed\n  also have \"\\<lbrace>\\<acute>?inv \\<and> \\<not> (\\<acute>M \\<noteq> a)\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>S = a * b\\<rbrace>\" by auto\n  finally show ?thesis by blast\nqed\n\n\ntext {*\n The subsequent version of the proof applies the @{text vcg} method\n to reduce the Hoare statement to a purely logical problem that can be\n solved fully automatically.  Note that we have to specify the\n \\texttt{WHILE} loop invariant in the original statement.\n*}\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          WHILE \\<acute>M \\<noteq> a\n          INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n          DO \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 OD\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\n  apply vcg    \n  apply auto\n  done\n\ntext {* Here some examples of ``breaking'' out of a loop *}\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          TRY       \n            WHILE True\n            INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n            DO IF \\<acute>M = a THEN THROW ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 FI OD\n          CATCH\n            SKIP\n          END\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          TRY       \n            WHILE True\n            INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n            DO IF \\<acute>M = a THEN \\<acute>Abr :== ''Break'';;THROW \n               ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 \n               FI \n            OD\n          CATCH\n            IF \\<acute>Abr = ''Break'' THEN SKIP ELSE Throw FI\n          END\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\n\ntext {* Some more syntactic sugar, the label statement @{text \"\\<dots> \\<bullet> \\<dots>\"} as shorthand\nfor the @{text \"TRY-CATCH\"} above, and the @{text \"RAISE\"} for an state-update followed\nby a @{text \"THROW\"}. \n*}\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          \\<lbrace>\\<acute>Abr = ''Break''\\<rbrace>\\<bullet> WHILE True INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n           DO IF \\<acute>M = a THEN RAISE \\<acute>Abr :== ''Break'' \n              ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 \n              FI \n           OD\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          TRY       \n            WHILE True\n            INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n            DO IF \\<acute>M = a THEN RAISE \\<acute>Abr :== ''Break'' \n               ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 \n               FI \n            OD\n          CATCH\n            IF \\<acute>Abr = ''Break'' THEN SKIP ELSE Throw FI\n          END\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          \\<lbrace>\\<acute>Abr = ''Break''\\<rbrace> \\<bullet> WHILE True\n          INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n          DO IF \\<acute>M = a THEN RAISE \\<acute>Abr :== ''Break'' \n               ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 \n               FI \n          OD\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\ntext {* Blocks *}\n\nlemma  \"\\<Gamma>\\<turnstile>\\<lbrace>\\<acute>I = i\\<rbrace> LOC \\<acute>I;; \\<acute>I :== 2  COL \\<lbrace>\\<acute>I \\<le> i\\<rbrace>\"\n  apply vcg\n  by simp\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n\\<rbrace> LOC \\<acute>N :== 10;; \\<acute>N :== \\<acute>N + 2 COL \\<lbrace>\\<acute>N = n\\<rbrace>\"\n  by vcg\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n\\<rbrace> LOC \\<acute>N :== 10, \\<acute>M;; \\<acute>N :== \\<acute>N + 2 COL \\<lbrace>\\<acute>N = n\\<rbrace>\"\n  by vcg\n\n\nsubsection {* Summing Natural Numbers *}\n\ntext {*\n We verify an imperative program to sum natural numbers up to a given\n limit.  First some functional definition for proper specification of\n the problem.\n*}\n\nprimrec\n  sum :: \"(nat => nat) => nat => nat\"\nwhere\n  \"sum f 0 = 0\"\n| \"sum f (Suc n) = f n + sum f n\"\n\nsyntax\n  \"_sum\" :: \"idt => nat => nat => nat\"\n    (\"SUMM _<_. _\" [0, 0, 10] 10)\ntranslations\n  \"SUMM j<k. b\" == \"CONST sum (\\<lambda>j. b) k\"\n\ntext {*\n The following proof is quite explicit in the individual steps taken,\n with the @{text vcg} method only applied locally to take care of\n assignment and sequential composition.  Note that we express\n intermediate proof obligation in pure logic, without referring to the\n state space.\n*}\n\ntheorem \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n           \\<acute>S :== 0;; \\<acute>I :== 1;;\n           WHILE \\<acute>I \\<noteq> n\n           DO\n             \\<acute>S :== \\<acute>S + \\<acute>I;;\n             \\<acute>I :== \\<acute>I + 1\n           OD\n           \\<lbrace>\\<acute>S = (SUMM j<n. j)\\<rbrace>\"\n  (is \"\\<Gamma>\\<turnstile> _ (_;; ?while) _\")\nproof -\n  let ?sum = \"\\<lambda>k. SUMM j<k. j\"\n  let ?inv = \"\\<lambda>s i. s = ?sum i\"\n\n  have \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \\<acute>S :== 0;; \\<acute>I :== 1 \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\"\n  proof -\n    have \"True \\<longrightarrow> 0 = ?sum 1\"\n      by simp\n    also have \"\\<Gamma>\\<turnstile> \\<lbrace>\\<dots>\\<rbrace> \\<acute>S :== 0;; \\<acute>I :== 1 \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\"\n      by vcg\n    finally show ?thesis .\n  qed\n  also have \"\\<Gamma>\\<turnstile> \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace> ?while \\<lbrace>?inv \\<acute>S \\<acute>I \\<and> \\<not> \\<acute>I \\<noteq> n\\<rbrace>\"\n  proof\n    let ?body = \"\\<acute>S :== \\<acute>S + \\<acute>I;; \\<acute>I :== \\<acute>I + 1\"\n    have \"\\<And>s i. ?inv s i \\<and> i \\<noteq> n \\<longrightarrow>  ?inv (s + i) (i + 1)\"\n      by simp\n    also have \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>S + \\<acute>I = ?sum (\\<acute>I + 1)\\<rbrace> ?body \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\"\n      by vcg\n    finally show \"\\<Gamma>\\<turnstile> \\<lbrace>?inv \\<acute>S \\<acute>I \\<and> \\<acute>I \\<noteq> n\\<rbrace> ?body \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\" .\n  qed\n  also have \"\\<And>s i. s = ?sum i \\<and> \\<not> i \\<noteq> n \\<longrightarrow> s = ?sum n\"\n    by simp \n  finally show ?thesis .\nqed\n\ntext {*\n The next version uses the @{text vcg} method, while still explaining\n the resulting proof obligations in an abstract, structured manner.\n*}\n\ntheorem \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n           \\<acute>S :== 0;; \\<acute>I :== 1;;\n           WHILE \\<acute>I \\<noteq> n\n           INV \\<lbrace>\\<acute>S = (SUMM j<\\<acute>I. j)\\<rbrace>\n           DO\n             \\<acute>S :== \\<acute>S + \\<acute>I;;\n             \\<acute>I :== \\<acute>I + 1\n           OD\n          \\<lbrace>\\<acute>S = (SUMM j<n. j)\\<rbrace>\"\nproof -\n  let ?sum = \"\\<lambda>k. SUMM j<k. j\"\n  let ?inv = \"\\<lambda>s i. s = ?sum i\"\n\n  show ?thesis\n  proof vcg\n    show \"?inv 0 1\" by simp\n  next\n    fix i s assume \"?inv s i\" \"i \\<noteq> n\"\n    thus \"?inv (s + i) (i + 1)\" by simp\n  next \n    fix i s assume x: \"?inv s i\" \"\\<not> i \\<noteq> n\"  \n    thus \"s = ?sum n\" by simp\n  qed\nqed\n\ntext {*\n Certainly, this proof may be done fully automatically as well, provided\n that the invariant is given beforehand.\n*}\n\ntheorem \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n           \\<acute>S :== 0;; \\<acute>I :== 1;;\n           WHILE \\<acute>I \\<noteq> n\n           INV \\<lbrace>\\<acute>S = (SUMM j<\\<acute>I. j)\\<rbrace>\n           DO\n             \\<acute>S :== \\<acute>S + \\<acute>I;;\n             \\<acute>I :== \\<acute>I + 1\n           OD\n           \\<lbrace>\\<acute>S = (SUMM j<n. j)\\<rbrace>\"\n  apply vcg \n  apply auto\n  done\n\nsubsection {* SWITCH *}\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = 5\\<rbrace> SWITCH \\<acute>B \n                        {True} \\<Rightarrow> \\<acute>N :== 6\n                      | {False} \\<Rightarrow> \\<acute>N :== 7\n                     END\n          \\<lbrace>\\<acute>N > 5\\<rbrace>\"\napply vcg\napply simp\ndone\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = 5\\<rbrace> SWITCH \\<acute>N \n                        {v. v < 5} \\<Rightarrow> \\<acute>N :== 6\n                      | {v. v \\<ge> 5} \\<Rightarrow> \\<acute>N :== 7\n                     END\n          \\<lbrace>\\<acute>N > 5\\<rbrace>\"\napply vcg\napply simp\ndone\n\nsubsection {* (Mutually) Recursive Procedures *}\n\nsubsubsection {* Factorial *}\n\ntext {* We want to define a procedure for the factorial. We first\ndefine a HOL functions that calculates it to specify the procedure later on.\n*}\n\nprimrec fac:: \"nat \\<Rightarrow> nat\"\nwhere\n\"fac 0 = 1\" |\n\"fac (Suc n) = (Suc n) * fac n\"\n\nlemma fac_simp [simp]: \"0 < i \\<Longrightarrow>  fac i = i * fac (i - 1)\"\n  by (cases i) simp_all\n\ntext {* Now we define the procedure *}\n\nprocedures\n  Fac (N|R) = \"IF \\<acute>N = 0 THEN \\<acute>R :== 1\n                       ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);;\n                            \\<acute>R :== \\<acute>N * \\<acute>R\n                       FI\"\n\n\n\ntext {* A procedure is given by the signature of the procedure\nfollowed by the procedure body.\nThe signature consists of the name of the procedure and a list of \nparameters. The parameters in front of the pipe @{text \"|\"} are value parameters \nand behind the pipe are the result parameters. Value parameters model call by value\nsemantics. The value of a result parameter at the end of the procedure is passed back\nto the caller. \n*}\n\n\n\ntext {*\nBehind the scenes the @{text \"procedures\"} command provides us convenient syntax\nfor procedure calls, defines a constant for the procedure body \n(named @{term \"Fac_body\"}) and creates some locales. The purpose of locales \nis to set up logical contexts to support modular reasoning.\nA locale is named @{text Fac_impl} and extends the @{text hoare} locale\nwith a theorem @{term \"\\<Gamma> ''Fac'' = Fac_body\"} that simply states how the \nprocedure is defined in the procedure context. Check out the locales. \nThe purpose of the locales is to give us easy means to setup the context \nin which we will prove programs correct.  \nIn these locales the procedure context @{term \"\\<Gamma>\"} is fixed. \nSo always use this letter in procedure\nspecifications. This is crucial, if we later on prove some tuples under the\nassumption of some procedure specifications.\n*}\n\nthm Fac_body.Fac_body_def\nprint_locale Fac_impl\n\ntext {*\nTo see how a call is syntactically translated you can switch off the\nprinting translation via the configuration option @{text hoare_use_call_tr'}\n*}\n\ncontext Fac_impl\nbegin\ntext {*\n@{term \"CALL Fac(\\<acute>N,\\<acute>M)\"} is internally:\n*}\ndeclare [[hoare_use_call_tr' = false]]\ntext {*\n@{term \"CALL Fac(\\<acute>N,\\<acute>M)\"}\n*}\nterm \"CALL Fac(\\<acute>N,\\<acute>M)\"\ndeclare [[hoare_use_call_tr' = true]]\nend\n\ntext {*\nNow let us prove that @{term \"Fac\"} meets its specification. \n*}\n\ntext {*\nProcedure specifications are ordinary Hoare tuples. We use the parameterless\ncall for the specification; @{text \"\\<acute>R :== PROC Fac(\\<acute>N)\"} is syntactic sugar\nfor @{text \"Call ''Fac''\"}. This emphasises that the specification \ndescribes the internal behaviour of the procedure, whereas parameter passing\ncorresponds to the procedure call.\n*}\n\n\nlemma (in Fac_impl) \n  shows \"\\<forall>n. \\<Gamma>,\\<Theta>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace>  PROC Fac(\\<acute>N,\\<acute>R) \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply vcg\n  apply simp\n  done\n\n\ntext {* \nSince the factorial was implemented recursively,\nthe main ingredient of this proof is, to assume that the specification holds for \nthe recursive call of @{term Fac} and prove the body correct.\nThe assumption for recursive calls is added to the context by\nthe rule @{thm [source] HoarePartial.ProcRec1} \n(also derived from general rule for mutually recursive procedures):\n@{thm [display] HoarePartial.ProcRec1 [no_vars]}\nThe verification condition generator will infer the specification out of the\ncontext when it encounters a recursive call of the factorial.\n*}\n\ntext {* We can also step through verification condition generation. When\nthe verification condition generator encounters a procedure call it tries to\nuse the rule @{text ProcSpec}. To be successful there must be a specification\nof the procedure in the context.  \n*}\n\nlemma (in Fac_impl)\n  shows \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply vcg_step\n  apply   vcg_step\n  apply  vcg_step\n  apply vcg_step\n  apply vcg_step\n  apply simp\n  done\n\n\ntext {* Here some Isar style version of the proof *}\nlemma (in Fac_impl)\n  shows \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\nproof (hoare_rule HoarePartial.ProcRec1)\n  have Fac_spec: \"\\<forall>n. \\<Gamma>,(\\<Union>n. {(\\<lbrace>\\<acute>N=n\\<rbrace>, Fac_'proc, \\<lbrace>\\<acute>R = fac n\\<rbrace>,{})})\n                       \\<turnstile> \\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\n    apply (rule allI)\n    apply (rule hoarep.Asm) \n    by auto\n  show \"\\<forall>n. \\<Gamma>,(\\<Union>n. {(\\<lbrace>\\<acute>N=n\\<rbrace>, Fac_'proc, \\<lbrace>\\<acute>R = fac n\\<rbrace>,{})})\n            \\<turnstile> \\<lbrace>\\<acute>N=n\\<rbrace> IF \\<acute>N = 0 THEN \\<acute>R :== 1\n            ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);; \\<acute>R :== \\<acute>N * \\<acute>R FI \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\n    apply vcg\n    apply simp\n    done\nqed\n\ntext {* To avoid retyping of potentially large pre and postconditions in \nthe previous proof we can use the casual term abbreviations of the Isar \nlanguage.\n*}\n\nlemma (in Fac_impl)\n  shows \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac n\\<rbrace>\" \n  (is \"\\<forall>n. \\<Gamma>\\<turnstile>(?Pre n) ?Fac (?Post n)\")\nproof (hoare_rule HoarePartial.ProcRec1)\n  have Fac_spec: \"\\<forall>n. \\<Gamma>,(\\<Union>n. {(?Pre n, Fac_'proc, ?Post n,{})})\n                       \\<turnstile>(?Pre n) ?Fac (?Post n)\"\n    apply (rule allI)\n    apply (rule hoarep.Asm) \n    by auto\n  show \"\\<forall>n. \\<Gamma>,(\\<Union>n. {(?Pre n, Fac_'proc, ?Post n,{})})\n            \\<turnstile> (?Pre n) IF \\<acute>N = 0 THEN \\<acute>R :== 1\n            ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);; \\<acute>R :== \\<acute>N * \\<acute>R FI (?Post n)\"\n    apply vcg\n    apply simp\n    done\nqed\n\ntext {* The previous proof pattern has still some kind of inconvenience.\nThe augmented context is always printed in the proof state. That can\nmess up the state, especially if we have large specifications. This may\nbe annoying if we want to develop single step or structured proofs. In this\ncase it can be a good idea to introduce a new variable for the augmented\ncontext.\n*}\n\nlemma (in Fac_impl) Fac_spec:\n  shows \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac n\\<rbrace>\" \n  (is \"\\<forall>n. \\<Gamma>\\<turnstile>(?Pre n) ?Fac (?Post n)\")\nproof (hoare_rule HoarePartial.ProcRec1)\n  def \"\\<Theta>'\"==\"(\\<Union>n. {(?Pre n, Fac_'proc, ?Post n,{}::('a, 'b) vars_scheme set)})\"\n  have Fac_spec: \"\\<forall>n. \\<Gamma>,\\<Theta>'\\<turnstile>(?Pre n) ?Fac (?Post n)\"\n    by (unfold \\<Theta>'_def, rule allI, rule hoarep.Asm) auto\n  txt {* We have to name the fact @{text \"Fac_spec\"}, so that the vcg can\n   use the specification for the recursive call, since it cannot infer it\n   from the opaque @{term \"\\<Theta>'\"}. *}\n  show \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>'\\<turnstile> (?Pre \\<sigma>) IF \\<acute>N = 0 THEN \\<acute>R :== 1\n            ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);; \\<acute>R :== \\<acute>N * \\<acute>R FI (?Post \\<sigma>)\"\n    apply vcg\n    apply simp\n    done\nqed\n\ntext {* There are different rules available to prove procedure calls,\ndepending on the kind of postcondition and whether or not the\nprocedure is recursive or even mutually recursive. \nSee for example @{thm [source] HoarePartial.ProcRec1}, \n@{thm [source] HoarePartial.ProcNoRec1}. \nThey are all derived from the most general rule\n@{thm [source] HoarePartial.ProcRec}. \nAll of them have some side-condition concerning definedness of the procedure. \nThey can be\nsolved in a uniform fashion. Thats why we have created the method \n@{text \"hoare_rule\"}, which behaves like the method @{text \"rule\"} but automatically\ntries to solve the side-conditions.\n*}\n\nsubsubsection {* Odd and Even *}\n\ntext {* Odd and even are defined mutually recursive here. In the \n@{text \"procedures\"} command we conjoin both definitions with @{text \"and\"}.\n*}\n\nprocedures \n odd(N | A) = \"IF \\<acute>N=0 THEN \\<acute>A:==0\n                     ELSE IF \\<acute>N=1 THEN CALL even (\\<acute>N - 1,\\<acute>A)\n                          ELSE CALL odd (\\<acute>N - 2,\\<acute>A)\n                          FI\n                     FI\"\n\n   \nand\n  even(N | A) = \"IF \\<acute>N=0 THEN \\<acute>A:==1\n                        ELSE IF \\<acute>N=1 THEN CALL odd (\\<acute>N - 1,\\<acute>A)\n                             ELSE CALL even (\\<acute>N - 2,\\<acute>A)\n                             FI\n                        FI\"\n\nprint_theorems\nthm odd_body.odd_body_def\nthm even_body.even_body_def\nprint_locale odd_even_clique \n\n\ntext {* To prove the procedure calls to @{term \"odd\"} respectively \n@{term \"even\"} correct we first derive a rule to justify that we\ncan assume both specifications to verify the bodies. This rule can\nbe derived from the general @{thm [source] HoarePartial.ProcRec} rule. An ML function does \nthis work:\n*}\n\nML {* ML_Thms.bind_thm (\"ProcRec2\", Hoare.gen_proc_rec @{context} Hoare.Partial 2) *}\n\n\nlemma (in odd_even_clique)\n  shows odd_spec: \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>A :== PROC odd(\\<acute>N) \n                  \\<lbrace>(\\<exists>b. n = 2 * b + \\<acute>A) \\<and> \\<acute>A < 2 \\<rbrace>\" (is ?P1)\n   and even_spec: \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>A :== PROC even(\\<acute>N)\n                  \\<lbrace>(\\<exists>b. n + 1 = 2 * b + \\<acute>A) \\<and> \\<acute>A < 2 \\<rbrace>\" (is ?P2)\nproof -\n  have \"?P1 \\<and> ?P2\"\n    apply (hoare_rule ProcRec2)\n    apply  vcg\n    apply  clarsimp\n    apply  (rule_tac x=\"b + 1\" in exI)\n    apply  arith\n    apply vcg\n    apply clarsimp\n    apply arith\n    done\n  thus \"?P1\" \"?P2\"\n    by iprover+\nqed\n\nsubsection {*Expressions With Side Effects *}\n\n\ntext {* \\texttt{R := N++ + M++} *}\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \n  \\<acute>N \\<ggreater> n. \\<acute>N :== \\<acute>N + 1 \\<ggreater>  \n  \\<acute>M \\<ggreater> m. \\<acute>M :== \\<acute>M + 1 \\<ggreater>\n  \\<acute>R :== n + m\n  \\<lbrace>\\<acute>R = \\<acute>N + \\<acute>M - 2\\<rbrace>\"\napply vcg\napply simp\ndone\n\ntext {*\\texttt{R := Fac (N) + Fac (M)} *}\nlemma (in Fac_impl) shows \n  \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \n  CALL Fac(\\<acute>N) \\<ggreater> n. CALL Fac(\\<acute>M) \\<ggreater> m. \n  \\<acute>R :== n + m\n  \\<lbrace>\\<acute>R = fac \\<acute>N + fac \\<acute>M\\<rbrace>\"\napply vcg\ndone\n\n\ntext {*\\texttt{ R := (Fac(Fac (N)))}*}\nlemma (in Fac_impl) shows \n  \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \n  CALL Fac(\\<acute>N) \\<ggreater> n. CALL Fac(n) \\<ggreater> m. \n  \\<acute>R :== m\n  \\<lbrace>\\<acute>R = fac (fac \\<acute>N)\\<rbrace>\"\napply vcg\ndone\n\n\nsubsection {* Global Variables and Heap *}\n\n\ntext {*\nNow we define and verify some procedures on heap-lists. We consider\nlist structures consisting of two fields, a content element @{term \"cont\"} and\na reference to the next list element @{term \"next\"}. We model this by the \nfollowing state space where every field has its own heap.\n*}\n\nrecord globals_list = \n  next_' :: \"ref \\<Rightarrow> ref\"\n  cont_' :: \"ref \\<Rightarrow> nat\"\n\nrecord 'g list_vars = \"'g state\" +\n  p_'    :: \"ref\"\n  q_'    :: \"ref\"\n  r_'    :: \"ref\"\n  root_' :: \"ref\"\n  tmp_'  :: \"ref\"\n\ntext {* Updates to global components inside a procedure will\nalways be propagated to the caller. This is implicitly done by the\nparameter passing syntax translations. The record containing the global variables must begin with the prefix \"globals\".\n*}\n\ntext {* We first define an append function on lists. It takes two \nreferences as parameters. It appends the list referred to by the first\nparameter with the list referred to by the second parameter, and returns\nthe result right into the first parameter.\n*}\n\nprocedures\n  append(p,q|p) = \n    \"IF \\<acute>p=Null THEN \\<acute>p :== \\<acute>q ELSE \\<acute>p \\<rightarrow>\\<acute>next:== CALL append(\\<acute>p\\<rightarrow>\\<acute>next,\\<acute>q) FI\"\n\n(*\n  append_spec: \n   \"\\<forall>\\<sigma> Ps Qs. \n     \\<Gamma>\\<turnstile> \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<and>  List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {}\\<rbrace>\n           \\<acute>p :== PROC append(\\<acute>p,\\<acute>q) \n         \\<lbrace>List \\<acute>p \\<acute>next (Ps@Qs) \\<and> (\\<forall>x. x\\<notin>set Ps \\<longrightarrow> \\<acute>next x = \\<^bsup>\\<sigma>\\<^esup>next x)\\<rbrace>\"\n\n  append_modifies:\n   \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC append(\\<acute>p,\\<acute>q){t. t may_only_modify_globals \\<sigma> in [next]}\"\n*)\n\ncontext append_impl\nbegin\ndeclare [[hoare_use_call_tr' = false]]\nterm \"CALL append(\\<acute>p,\\<acute>q,\\<acute>p\\<rightarrow>\\<acute>next)\"\ndeclare [[hoare_use_call_tr' = true]]\nend\ntext {* Below we give two specifications this time.\nOne captures the functional behaviour and focuses on the\nentities that are potentially modified by the procedure, the other one\nis a pure frame condition.\nThe list in the modifies clause has to list all global state components that\nmay be changed by the procedure. Note that we know from the modifies clause\nthat the @{term cont} parts of the lists will not be changed. Also a small\nside note on the syntax. We use ordinary brackets in the postcondition\nof the modifies clause, and also the state components do not carry the\nacute, because we explicitly note the state @{term t} here. \n\nThe functional specification now introduces two logical variables besides the\nstate space variable @{term \"\\<sigma>\"}, namely @{term \"Ps\"} and @{term \"Qs\"}.\nThey are universally quantified and range over both the pre and the postcondition, so \nthat we are able to properly instantiate the specification\nduring the proofs. The syntax @{text \"\\<lbrace>\\<sigma>. \\<dots>\\<rbrace>\"} is a shorthand to fix the current \nstate: @{text \"{s. \\<sigma> = s \\<dots>}\"}.  \n*}\n\nlemma (in append_impl) append_spec:\n  shows \"\\<forall>\\<sigma> Ps Qs. \\<Gamma>\\<turnstile> \n            \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<and>  List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {}\\<rbrace>\n                \\<acute>p :== PROC append(\\<acute>p,\\<acute>q) \n            \\<lbrace>List \\<acute>p \\<acute>next (Ps@Qs) \\<and> (\\<forall>x. x\\<notin>set Ps \\<longrightarrow> \\<acute>next x = \\<^bsup>\\<sigma>\\<^esup>next x)\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply vcg\n  apply fastforce\n  done\n\n\ntext {* The modifies clause is equal to a proper record update specification\nof the following form. \n*}\n\n\nlemma \"{t. t may_only_modify_globals Z in [next]} \n       = \n       {t. \\<exists>next. globals t=next_'_update (\\<lambda>_. next) (globals Z)}\"\n  apply (unfold mex_def meq_def)\n  apply (simp)\n  done\n\ntext {* If the verification condition generator works on a procedure call\nit checks whether it can find a modified clause in the context. If one\nis present the procedure call is simplified before the Hoare rule \n@{thm [source] HoarePartial.ProcSpec} is applied. Simplification of the procedure call means,\nthat the ``copy back'' of the global components is simplified. Only those\ncomponents that occur in the modifies clause will actually be copied back.\nThis simplification is justified by the rule @{thm [source] HoarePartial.ProcModifyReturn}. \nSo after this simplification all global components that do not appear in\nthe modifies clause will be treated as local variables. \n*}\n\ntext {* You can study the effect of the modifies clause on the following two\nexamples, where we want to prove that @{term \"append\"} does not change\nthe @{term \"cont\"} part of the heap.\n*}\n\nlemma (in append_impl)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>p=Null \\<and> \\<acute>cont=c\\<rbrace> \\<acute>p :== CALL append(\\<acute>p,Null) \\<lbrace>\\<acute>cont=c\\<rbrace>\" \n  apply vcg\n  oops\n\ntext {* To prove the frame condition, \nwe have to tell the verification condition generator to use only the\nmodifies clauses and not to search for functional specifications by \nthe parameter @{text \"spec=modifies\"} It will also try to solve the \nverification conditions automatically.\n*}\n\nlemma (in append_impl) append_modifies: \n  shows\n   \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC append(\\<acute>p,\\<acute>q){t. t may_only_modify_globals \\<sigma> in [next]}\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply (vcg spec=modifies)\n  done\n\n\nlemma (in append_impl)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>p=Null \\<and> \\<acute>cont=c\\<rbrace> \\<acute>p\\<rightarrow>\\<acute>next :== CALL append(\\<acute>p,Null) \\<lbrace>\\<acute>cont=c\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\ntext {*\nOf course we could add the modifies clause to the functional specification as \nwell. But separating both has the advantage that we split up the verification\nwork. We can make use of the modifies clause before we apply the\nfunctional specification in a fully automatic fashion.\n*}\n \n\ntext {* To verify the body of @{term \"append\"} we do not need the modifies\nclause, since the specification does not talk about @{term \"cont\"} at all, and\nwe don't access @{term \"cont\"} inside the body. This may be different for \nmore complex procedures.\n*}\n\ntext {* \nTo prove that a procedure respects the modifies clause, we only need\nthe modifies clauses of the procedures called in the body. We do not need\nthe functional specifications. So we can always prove the modifies\nclause without functional specifications, but me may need the modifies\nclause to prove the functional specifications.\n*}\n\n\n\n\n\n\n\n \nsubsubsection {*Insertion Sort*}\n\nprimrec sorted:: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a list  \\<Rightarrow> bool\"\nwhere\n\"sorted le [] = True\" |\n\"sorted le (x#xs) = ((\\<forall>y\\<in>set xs. le x y) \\<and> sorted le xs)\"\n\n\n \nprocedures\n  insert(r,p | p) =\n    \"IF \\<acute>r=Null THEN SKIP\n     ELSE IF \\<acute>p=Null THEN \\<acute>p :== \\<acute>r;; \\<acute>p\\<rightarrow>\\<acute>next :== Null\n          ELSE IF \\<acute>r\\<rightarrow>\\<acute>cont \\<le> \\<acute>p\\<rightarrow>\\<acute>cont \n               THEN \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>p;; \\<acute>p:==\\<acute>r\n               ELSE \\<acute>p\\<rightarrow>\\<acute>next :== CALL insert(\\<acute>r,\\<acute>p\\<rightarrow>\\<acute>next)\n               FI\n          FI\n     FI\"\n\n\ntext {*\nIn the postcondition of the functional specification there is a small but \nimportant subtlety. Whenever we talk about the @{term \"cont\"} part we refer to \nthe one of the pre-state, even in the conclusion of the implication.\nThe reason is, that we have separated out, that @{term \"cont\"} is not modified\nby the procedure, to the modifies clause. So whenever we talk about unmodified\nparts in the postcondition we have to use the pre-state part, or explicitly\nstate an equality in the postcondition.\nThe reason is simple. If the postcondition would talk about @{text \"\\<acute>cont\"}\ninstead of @{text \"\\<^bsup>\\<sigma>\\<^esup>cont\"}, we get a new instance of @{text \"cont\"} during\nverification and the postcondition would only state something about this\nnew instance. But as the verification condition generator uses the\nmodifies clause the caller of @{text \"insert\"} instead still has the\nold @{text \"cont\"} after the call. Thats the very reason for the modifies clause.\nSo the caller and the specification will simply talk about two different things,\nwithout being able to relate them (unless an explicit equality is added to\nthe specification). \n*}\n\nlemma (in insert_impl) insert_modifies:\n  \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC insert(\\<acute>r,\\<acute>p){t. t may_only_modify_globals \\<sigma> in [next]}\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\n\nlemma (in insert_impl) insert_spec:\n    \"\\<forall>\\<sigma> Ps . \\<Gamma>\\<turnstile> \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<and> sorted (op \\<le>) (map \\<acute>cont Ps) \\<and> \n                  \\<acute>r \\<noteq> Null \\<and> \\<acute>r \\<notin> set Ps\\<rbrace>  \n         \\<acute>p :== PROC insert(\\<acute>r,\\<acute>p) \n   \\<lbrace>\\<exists>Qs. List \\<acute>p \\<acute>next Qs \\<and> sorted (op \\<le>) (map \\<^bsup>\\<sigma>\\<^esup>cont  Qs) \\<and>\n           set Qs = insert \\<^bsup>\\<sigma>\\<^esup>r (set Ps) \\<and>\n           (\\<forall>x. x \\<notin> set Qs \\<longrightarrow> \\<acute>next x = \\<^bsup>\\<sigma>\\<^esup>next x)\\<rbrace>\"\n\napply (hoare_rule HoarePartial.ProcRec1)\napply vcg\napply (intro conjI impI)\napply    fastforce\napply   fastforce\napply  fastforce\napply (clarsimp) \napply force\ndone\n\nprocedures\n  insertSort(p | p) =\n    \"\\<acute>r:==Null;;\n     WHILE (\\<acute>p \\<noteq> Null) DO\n       \\<acute>q :== \\<acute>p;;\n       \\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;;\n       \\<acute>r :== CALL insert(\\<acute>q,\\<acute>r)\n     OD;;\n     \\<acute>p:==\\<acute>r\"\n\n\n\n\nlemma (in insertSort_impl) insertSort_modifies: \n  shows\n   \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC insertSort(\\<acute>p)\n              {t. t may_only_modify_globals \\<sigma> in [next]}\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\n\ntext {* Insertion sort is not implemented recursively here but with a while\nloop. Note that the while loop is not annotated with an invariant in the\nprocedure definition. The invariant only comes into play during verification.\nTherefore we will annotate the body during the proof with the\nrule @{thm [source] HoarePartial.annotateI}.\n*}\n\n\nlemma (in insertSort_impl) insertSort_body_spec:\n  shows \"\\<forall>\\<sigma> Ps. \\<Gamma>,\\<Theta>\\<turnstile> \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<rbrace> \n              \\<acute>p :== PROC insertSort(\\<acute>p)\n          \\<lbrace>\\<exists>Qs. List \\<acute>p \\<acute>next Qs \\<and> sorted (op \\<le>) (map \\<^bsup>\\<sigma>\\<^esup>cont Qs) \\<and>\n           set Qs = set Ps\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)  \n  apply (hoare_rule anno= \n         \"\\<acute>r :== Null;;\n         WHILE \\<acute>p \\<noteq> Null\n         INV \\<lbrace>\\<exists>Qs Rs. List \\<acute>p \\<acute>next Qs \\<and> List \\<acute>r \\<acute>next Rs \\<and> \n                  set Qs \\<inter> set Rs = {} \\<and>\n                  sorted (op \\<le>) (map \\<acute>cont Rs) \\<and> set Qs \\<union> set Rs = set Ps \\<and>\n                  \\<acute>cont = \\<^bsup>\\<sigma>\\<^esup>cont \\<rbrace>\n          DO \\<acute>q :== \\<acute>p;; \\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;; \\<acute>r :== CALL insert(\\<acute>q,\\<acute>r) OD;;\n          \\<acute>p :== \\<acute>r\" in HoarePartial.annotateI)\n  apply vcg\n  apply   fastforce\n  prefer 2\n  apply  fastforce\n  apply (clarsimp)\n  apply (rule_tac x=ps in exI)\n  apply (intro conjI)\n  apply    (rule heap_eq_ListI1)\n  apply     assumption\n  apply    clarsimp\n  apply    (subgoal_tac \"x\\<noteq>p \\<and> x \\<notin> set Rs\")\n  apply     auto\n  done\n\nsubsubsection \"Memory Allocation and Deallocation\"\n\ntext {* The basic idea of memory management is to keep a list of allocated\nreferences in the state space. Allocation of a new reference adds a\nnew reference to the list deallocation removes a reference. Moreover\nwe keep a counter \"free\" for the free memory.\n*}\n\nrecord globals_list_alloc = globals_list +\n  alloc_'::\"ref list\"\n  free_'::nat \n\nrecord 'g list_vars' = \"'g list_vars\" +\n  i_'::nat\n  first_'::ref\n\n\ndefinition \"sz = (2::nat)\"\n\ntext {* Restrict locale @{text hoare} to the required type. *}\n\nlocale hoare_ex =\n  hoare \\<Gamma> for \\<Gamma> :: \"'c ~=> (('a globals_list_alloc_scheme, 'b) list_vars'_scheme, 'c, 'd) com\"\n\nlemma (in hoare_ex)\n  \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>i = 0 \\<and> \\<acute>first = Null \\<and> n*sz \\<le> \\<acute>free\\<rbrace>\n       WHILE \\<acute>i < n \n       INV \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next Ps \\<and> length Ps = \\<acute>i \\<and> \\<acute>i \\<le> n \\<and> \n             set Ps \\<subseteq> set \\<acute>alloc \\<and> (n - \\<acute>i)*sz \\<le> \\<acute>free\\<rbrace>\n       DO\n         \\<acute>p :== NEW sz [\\<acute>cont:==0,\\<acute>next:== Null];;\n         \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>first;;\n         \\<acute>first :== \\<acute>p;;\n         \\<acute>i :== \\<acute>i+ 1 \n       OD\n       \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next  Ps \\<and> length Ps = n \\<and> set Ps \\<subseteq> set \\<acute>alloc\\<rbrace>\"\n\napply (vcg)\napply   simp\napply  clarsimp\napply  (rule conjI)\napply   clarsimp\napply   (rule_tac x=\"new (set alloc)#Ps\" in exI)\napply   clarsimp\napply   (rule conjI)\napply    fastforce\napply   (simp add: sz_def)\napply  (simp add: sz_def)\napply fastforce\ndone\n\n\nlemma (in hoare_ex)\n  \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>i = 0 \\<and> \\<acute>first = Null \\<and> n*sz \\<le> \\<acute>free\\<rbrace>\n       WHILE \\<acute>i < n \n       INV \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next Ps \\<and> length Ps = \\<acute>i \\<and> \\<acute>i \\<le> n \\<and> \n             set Ps \\<subseteq> set \\<acute>alloc \\<and> (n - \\<acute>i)*sz \\<le> \\<acute>free\\<rbrace>\n       DO\n         \\<acute>p :== NNEW sz [\\<acute>cont:==0,\\<acute>next:== Null];;\n         \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>first;;\n         \\<acute>first :== \\<acute>p;;\n         \\<acute>i :== \\<acute>i+ 1 \n       OD\n       \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next  Ps \\<and> length Ps = n \\<and> set Ps \\<subseteq> set \\<acute>alloc\\<rbrace>\"\n\napply (vcg)\napply   simp\napply  clarsimp\napply  (rule conjI)\napply   clarsimp\napply   (rule_tac x=\"new (set alloc)#Ps\" in exI)\napply   clarsimp\napply   (rule conjI)\napply    fastforce\napply   (simp add: sz_def)\napply  (simp add: sz_def)\napply fastforce\ndone\n\nsubsection {* Fault Avoiding Semantics *}\n\ntext {*\nIf we want to ensure that no runtime errors occur we can insert guards into\nthe code. We will not be able to prove any nontrivial Hoare triple \nabout code with guards, if we cannot show that the guards will never fail.\nA trivial hoare triple is one with an empty precondition. \n*}\n\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>  \\<lbrace>\\<acute>p\\<noteq>Null\\<rbrace>\\<longmapsto> \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>p \\<lbrace>True\\<rbrace>\"\napply vcg\noops\n\nlemma \"\\<Gamma>\\<turnstile> {}  \\<lbrace>\\<acute>p\\<noteq>Null\\<rbrace>\\<longmapsto> \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>p \\<lbrace>True\\<rbrace>\"\napply vcg\ndone\n\ntext {* Let us consider this small program that reverts a list. At\nfirst without guards. \n*}\nlemma (in hoare_ex) rev_strip:\n  \"\\<Gamma>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and> \n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;; \n     \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;; \n     \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;; \n     \\<acute>q :== \\<acute>r OD\n  \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps\\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\napply (vcg)\napply fastforce+\ndone\n\ntext {* If we want to ensure that we do not dereference @{term \"Null\"} or\naccess unallocated memory, we have to add some guards.\n*}\n\nlocale hoare_ex_guard =\n  hoare \\<Gamma> for \\<Gamma> :: \"'c ~=> (('a globals_list_alloc_scheme, 'b) list_vars'_scheme, 'c, bool) com\"\n\nlemma \n  (in hoare_ex_guard)\n  \"\\<Gamma>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and> \n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;; \n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;; \n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;; \n     \\<acute>q :== \\<acute>r OD\n \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\napply (vcg)\napply fastforce+\ndone\n\n\ntext {* We can also just prove that no faults will occur, by giving the\ntrivial postcondition.\n*}\nlemma (in hoare_ex_guard) rev_noFault:   \n  \"\\<Gamma>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and> \n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;; \n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;; \n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;; \n     \\<acute>q :== \\<acute>r OD\n  UNIV,UNIV\"\napply (vcg)\napply fastforce+\ndone\n\nlemma (in hoare_ex_guard) rev_moduloGuards: \n  \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and> \n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;; \n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<surd> \\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;; \n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<surd> \\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;; \n     \\<acute>q :== \\<acute>r OD\n \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\napply vcg\napply fastforce+\ndone\n\n\n\n\nlemma CombineStrip': \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c' Q,A\"\n  assumes deriv_strip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n  assumes c'': \"c''= mark_guards False (strip_guards (-F) c')\"\n  assumes c: \"c = mark_guards False c'\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof -\n  from deriv_strip [simplified c'']\n  have \"\\<Gamma>,\\<Theta>\\<turnstile> P (strip_guards (- F) c') UNIV,UNIV\"\n    by (rule HoarePartialProps.MarkGuardsD)\n  with deriv \n  have \"\\<Gamma>,\\<Theta>\\<turnstile> P c' Q,A\"\n    by (rule HoarePartialProps.CombineStrip)\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile> P mark_guards False c' Q,A\"\n    by (rule HoarePartialProps.MarkGuardsI)\n  thus ?thesis\n    by (simp add: c)\nqed\n\n\ntext {* We can then combine the prove that no fault will occur with the\nfunctional proof of the programme without guards to get the full prove by\nthe rule @{thm HoarePartialProps.CombineStrip}\n*}\n\n\nlemma \n  (in hoare_ex_guard)\n  \"\\<Gamma>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and> \n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;; \n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;; \n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;; \n     \\<acute>q :== \\<acute>r OD\n \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\n\napply (rule CombineStrip' [OF rev_moduloGuards rev_noFault])\napply  simp\napply simp\ndone\n\n\ntext {* In the previous example the effort to split up the prove did not\nreally pay off. But when we think of programs with a lot of guards and\ncomplicated specifications it may be better to first focus on a prove without\nthe messy guards. Maybe it is possible to automate the no fault proofs so\nthat it suffices to focus on the stripped program. \n*}\n\n\ntext {*\nThe purpose of guards is to watch for faults that can occur during \nevaluation of expressions. In the example before we watched for null pointer\ndereferencing or memory faults. We can also look for array index bounds or\ndivision by zero. As the condition of a while loop is evaluated in each\niteration we cannot just add a guard before the while loop. Instead we need\na special guard for the condition.\nExample: @{term \"WHILE  \\<lbrace>\\<acute>p\\<noteq>Null\\<rbrace>\\<longmapsto> \\<acute>p\\<rightarrow>\\<acute>next\\<noteq>Null DO SKIP OD\"}\n*}\n\nsubsection {* Circular Lists *}\ndefinition\n  distPath :: \"ref \\<Rightarrow> (ref \\<Rightarrow> ref) \\<Rightarrow> ref \\<Rightarrow> ref list \\<Rightarrow> bool\" where\n  \"distPath x next y as = (Path x next y as  \\<and>  distinct as)\"\n\nlemma neq_dP: \"\\<lbrakk>p \\<noteq> q; Path p h q Ps; distinct Ps\\<rbrakk> \\<Longrightarrow>\n \\<exists>Qs. p\\<noteq>Null \\<and> Ps = p#Qs \\<and> p \\<notin> set Qs\"\nby (cases Ps, auto)\n\nlemma circular_list_rev_I:\n  \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>root = r \\<and>  distPath \\<acute>root \\<acute>next \\<acute>root (r#Ps)\\<rbrace>\n   \\<acute>p :== \\<acute>root;; \\<acute>q :== \\<acute>root\\<rightarrow>\\<acute>next;;\n  WHILE \\<acute>q \\<noteq> \\<acute>root\n  INV \\<lbrace>\\<exists> ps qs. distPath \\<acute>p \\<acute>next \\<acute>root ps  \\<and> distPath \\<acute>q \\<acute>next \\<acute>root qs \\<and> \n             \\<acute>root = r \\<and> r\\<noteq>Null \\<and> r \\<notin> set Ps  \\<and> set ps \\<inter> set qs = {} \\<and> \n             Ps = (rev ps) @ qs \\<rbrace>\n  DO \\<acute>tmp :== \\<acute>q;; \\<acute>q :== \\<acute>q\\<rightarrow>\\<acute>next;; \\<acute>tmp\\<rightarrow>\\<acute>next :== \\<acute>p;; \\<acute>p:==\\<acute>tmp OD;;\n  \\<acute>root\\<rightarrow>\\<acute>next :== \\<acute>p\n  \\<lbrace>\\<acute>root = r \\<and> distPath \\<acute>root \\<acute>next \\<acute>root (r#rev Ps)\\<rbrace>\"\napply (simp only:distPath_def)\napply vcg\napply   (rule_tac x=\"[]\" in exI)\napply   fastforce\napply  clarsimp\napply  (drule (2) neq_dP)\napply  (rule_tac x=\"q # ps\" in exI)\napply  clarsimp\napply fastforce\ndone\n\n\n\nlemma path_is_list:\"\\<And>a next b. \\<lbrakk>Path b next a Ps ; a \\<notin> set Ps; a\\<noteq>Null\\<rbrakk> \n\\<Longrightarrow> List b (next(a := Null)) (Ps @ [a])\"\napply (induct Ps)\napply (auto simp add:fun_upd_apply)\ndone\n\ntext {*\nThe simple algorithm for acyclic list reversal, with modified\nannotations, works for cyclic lists as well.: \n*}\n\nlemma circular_list_rev_II:\n \"\\<Gamma>\\<turnstile>\n \\<lbrace>\\<acute>p = r \\<and> distPath \\<acute>p \\<acute>next \\<acute>p (r#Ps)\\<rbrace>\n\\<acute>q:==Null;;\nWHILE \\<acute>p \\<noteq> Null\nINV\n \\<lbrace> ((\\<acute>q = Null) \\<longrightarrow> (\\<exists>ps. distPath \\<acute>p \\<acute>next r ps  \\<and>  ps = r#Ps)) \\<and>\n  ((\\<acute>q \\<noteq> Null) \\<longrightarrow> (\\<exists>ps qs. distPath \\<acute>q \\<acute>next r qs  \\<and> List \\<acute>p \\<acute>next ps  \\<and>\n                   set ps \\<inter> set qs = {} \\<and> rev qs @ ps = Ps@[r])) \\<and>\n  \\<not> (\\<acute>p = Null \\<and> \\<acute>q = Null \\<and> r = Null )\n   \\<rbrace>\nDO\n  \\<acute>tmp :== \\<acute>p;; \\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;; \\<acute>tmp\\<rightarrow>\\<acute>next :== \\<acute>q;; \\<acute>q:==\\<acute>tmp\nOD\n \\<lbrace>\\<acute>q = r \\<and> distPath \\<acute>q \\<acute>next \\<acute>q (r # rev Ps)\\<rbrace>\"\n\napply (simp only:distPath_def)\napply vcg\napply   clarsimp\napply  clarsimp\napply  (case_tac \"(q = Null)\")\napply   (fastforce intro: path_is_list)\napply  clarify\napply  (rule_tac x=\"psa\" in exI)\napply  (rule_tac x=\" p # qs\" in exI) \napply  force\napply fastforce\ndone\n\ntext{* Although the above algorithm is more succinct, its invariant\nlooks more involved. The reason for the case distinction on @{term q}\nis due to the fact that during execution, the pointer variables can\npoint to either cyclic or acyclic structures.\n*}\n\ntext {*\nWhen working on lists, its sometimes better to remove\n@{thm[source] fun_upd_apply} from the simpset, and instead include @{thm[source] fun_upd_same} and @{thm[source] fun_upd_other} to\nthe simpset\n*}\n\n(*\ndeclare fun_upd_apply[simp del]fun_upd_same[simp] fun_upd_other[simp]\n*)\n\n\nlemma \"\\<Gamma>\\<turnstile> {\\<sigma>}\n            \\<acute>I :== \\<acute>M;; \n            ANNO \\<tau>. \\<lbrace>\\<tau>. \\<acute>I = \\<^bsup>\\<sigma>\\<^esup>M\\<rbrace>\n                      \\<acute>M :== \\<acute>N;; \\<acute>N :== \\<acute>I \n                    \\<lbrace>\\<acute>M = \\<^bsup>\\<tau>\\<^esup>N \\<and> \\<acute>N = \\<^bsup>\\<tau>\\<^esup>I\\<rbrace>\n            \\<lbrace>\\<acute>M = \\<^bsup>\\<sigma>\\<^esup>N \\<and> \\<acute>N = \\<^bsup>\\<sigma>\\<^esup>M\\<rbrace>\"\napply vcg\napply auto\ndone\n\n\nlemma \"\\<Gamma>\\<turnstile> ({\\<sigma>} \\<inter> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>)\n      (ANNO \\<tau>. ({\\<tau>} \\<inter> \\<lbrace>\\<acute>A=\\<^bsup>\\<sigma>\\<^esup>A \\<and> \\<acute>I=\\<^bsup>\\<sigma>\\<^esup>I \\<and> \\<acute>M=0 \\<and> \\<acute>S=0\\<rbrace>)\n      WHILE \\<acute>M \\<noteq> \\<acute>A\n      INV \\<lbrace>\\<acute>S = \\<acute>M * \\<acute>I \\<and> \\<acute>A=\\<^bsup>\\<tau>\\<^esup>A \\<and> \\<acute>I=\\<^bsup>\\<tau>\\<^esup>I\\<rbrace>\n      DO \\<acute>S :== \\<acute>S + \\<acute>I;; \\<acute>M :== \\<acute>M + 1 OD\n      \\<lbrace>\\<acute>S = \\<^bsup>\\<tau>\\<^esup>A * \\<^bsup>\\<tau>\\<^esup>I\\<rbrace>)\n      \\<lbrace>\\<acute>S = \\<^bsup>\\<sigma>\\<^esup>A * \\<^bsup>\\<sigma>\\<^esup>I\\<rbrace>\"\napply vcg_step\napply vcg_step\napply simp\napply vcg_step\napply vcg_step\napply simp\napply vcg\napply simp\napply simp\napply vcg_step\napply auto\ndone\n\ntext {* Instead of annotations one can also directly use previously proven lemmas.*}\nlemma foo_lemma: \"\\<forall>n m. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n \\<and> \\<acute>M = m\\<rbrace> \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1   \n                     \\<lbrace>\\<acute>N = n + 1 \\<and> \\<acute>M = m + 1\\<rbrace>\"\n  by vcg\n\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n \\<and> \\<acute>M = m\\<rbrace> LEMMA foo_lemma \n                               \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n                             END;; \n                             \\<acute>N :== \\<acute>N + 1 \n           \\<lbrace>\\<acute>N = n + 2 \\<and> \\<acute>M = m + 1\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n \\<and> \\<acute>M = m\\<rbrace> \n           LEMMA foo_lemma \n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n           END;;\n           LEMMA foo_lemma \n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n           END\n           \\<lbrace>\\<acute>N = n + 2 \\<and> \\<acute>M = m + 2\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n \\<and> \\<acute>M = m\\<rbrace> \n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1;;\n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n           \\<lbrace>\\<acute>N = n + 2 \\<and> \\<acute>M = m + 2\\<rbrace>\"\n  apply (hoare_rule anno= \n          \"LEMMA foo_lemma \n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n           END;;\n           LEMMA foo_lemma \n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n           END\"\n          in HoarePartial.annotate_normI)\n  apply vcg\n  apply simp\n  done\n\ntext {* Just some test on marked, guards *}\nlemma \"\\<Gamma>\\<turnstile>\\<lbrace>True\\<rbrace> WHILE \\<lbrace>P \\<acute>N \\<rbrace>\\<surd>, \\<lbrace>Q \\<acute>M\\<rbrace>#, \\<lbrace>R \\<acute>N\\<rbrace>\\<longmapsto> \\<acute>N < \\<acute>M \n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace> DO\n                    \\<acute>N :== \\<acute>M\n                  OD \n           \\<lbrace>hard\\<rbrace>\"\napply vcg\noops\n\nlemma \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>True\\<rbrace> WHILE \\<lbrace>P \\<acute>N \\<rbrace>\\<surd>, \\<lbrace>Q \\<acute>M\\<rbrace>#, \\<lbrace>R \\<acute>N\\<rbrace>\\<longmapsto> \\<acute>N < \\<acute>M \n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace> DO\n                    \\<acute>N :== \\<acute>M\n                  OD \n           \\<lbrace>hard\\<rbrace>\"\napply vcg\noops\n\n\n\nterm \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>True\\<rbrace> WHILE\\<^sub>g  \\<acute>N < \\<acute>Arr!i\n                    FIX Z.\n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace> \n                    \n                  DO\n                    \\<acute>N :== \\<acute>M\n                  OD \n           \\<lbrace>hard\\<rbrace>\"\n\nlemma \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>True\\<rbrace> WHILE\\<^sub>g  \\<acute>N < \\<acute>Arr!i\n                    FIX Z.\n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace> \n                    VAR arbitrary\n                  DO\n                    \\<acute>N :== \\<acute>M\n                  OD \n           \\<lbrace>hard\\<rbrace>\"\napply vcg\noops\n\nlemma \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>True\\<rbrace> WHILE \\<lbrace>P \\<acute>N \\<rbrace>\\<surd>, \\<lbrace>Q \\<acute>M\\<rbrace>#, \\<lbrace>R \\<acute>N\\<rbrace>\\<longmapsto> \\<acute>N < \\<acute>M \n                    FIX Z.\n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace> \n                    VAR arbitrary\n                  DO\n                    \\<acute>N :== \\<acute>M\n                  OD \n           \\<lbrace>hard\\<rbrace>\"\napply vcg\noops\n\nend ", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/ex/VcgEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5964331462646254, "lm_q1q2_score": 0.32378165597412156}}
{"text": "(*<*)\n(* Author: Thomas Bauereiss *)\ntheory Address_Translation_Pure\n  imports AArch64_Aux Address_Translation_Orig\nbegin\n(*>*)\n\nsection \\<open>Pure characterisation\\<close>\n\nsubsection \\<open>Types\\<close>\n\ntext \\<open>Translation tables are represented as a list of entries, each of which might recursively\ncontain another table.\\<close>\n\ndatatype TableEntry =\n  Invalid\n  | Descriptor \"64 word\" (* 64-bit block or page descriptor *)\n  | Table \"52 word\" bool bool bool bool bool \"TableEntry list\" (* base address, table attributes, entries *)\n\ntext \\<open>A record for the main parameters of the translation, e.g. address size or page size.\\<close>\n\nrecord Parameters =\n  inputsize :: int\n  outputsize :: int\n  grainsize :: int\n  firstblocklevel :: int\n  updateAF :: bool\n  SH :: \"2 word\"\n  ORGN :: \"2 word\"\n  IRGN :: \"2 word\"\n\nsubsection \\<open>Auxiliary functions for our pure characterisation, e.g. for reading the translation\nparameters from the control registers or decoding descriptor attributes.\\<close>\n\ndefinition read_params :: \"bool \\<Rightarrow> regstate sequential_state \\<Rightarrow> Parameters\" where\n  \"read_params high s =\n     (let\n        largegrain = (if high then Word.slice 30 (TCR_EL1 (regstate s)) = (3 :: 2 word)\n                      else Word.slice 14 (TCR_EL1 (regstate s)) = (1 :: 2 word));\n        midgrain = (if high then Word.slice 30 (TCR_EL1 (regstate s)) = (1 :: 2 word)\n                    else Word.slice 14 (TCR_EL1 (regstate s)) = (2 :: 2 word));\n        grainsize = (if largegrain then 16 else if midgrain then 14 else 12);\n        outputsize = calc_outputsize (Word.slice 32 (TCR_EL1 (regstate s))) largegrain;\n        inputsize_max = (if largegrain then 52 else 48);\n        inputsize = 64 - (uint (Word.slice (if high then 16 else 0) (TCR_EL1 (regstate s)) :: 6 word)) in\n      \\<lparr>inputsize = min (max inputsize 25) inputsize_max,\n       outputsize = outputsize,\n       grainsize = grainsize,\n       firstblocklevel = (if \\<not>largegrain \\<and> midgrain then 2 else 1),\n       updateAF = TCR_EL1 (regstate s) !! 39,\n       SH = Word.slice (if high then 28 else 12) (TCR_EL1 (regstate s)),\n       ORGN = Word.slice (if high then 26 else 10) (TCR_EL1 (regstate s)),\n       IRGN = Word.slice (if high then 24 else 8) (TCR_EL1 (regstate s))\\<rparr>)\"\n\nabbreviation \"largegrain p \\<equiv> (grainsize p = 16)\"\nabbreviation \"midgrain p \\<equiv> (grainsize p = 14)\"\n\ndefinition startlevel :: \"Parameters \\<Rightarrow> int\" where\n  \"startlevel p \\<equiv> calc_startlevel (inputsize p) (grainsize p) (grainsize p - 3)\"\n\ndefinition baselowerbound :: \"Parameters \\<Rightarrow> int\" where\n  \"baselowerbound p \\<equiv>\n     3 + (inputsize p) - ((3 - startlevel p) * (grainsize p - 3) + (grainsize p))\"\n\nabbreviation \"contiguousbitcheck p level \\<equiv>\n  calc_contiguousbitcheck (inputsize p) (largegrain p) (midgrain p) level\"\n\ndefinition baseaddress :: \"64 word \\<Rightarrow> int \\<Rightarrow> int \\<Rightarrow> 52 word\" where\n  \"baseaddress baseregister baselowerbound_arg outputsize_arg \\<equiv>\n     (if outputsize_arg = 52 then\n        (let z = max baselowerbound_arg 6 in\n         concat_vec (Word.slice 2 baseregister :: 4 word)\n                    (slice_zeros_concat 48 baseregister z (48 - z) z :: 48 word))\n      else\n        place_slice 52 baseregister baselowerbound_arg (48 - baselowerbound_arg) baselowerbound_arg)\"\n\ndefinition valid_vaddr :: \"64 word \\<Rightarrow> int \\<Rightarrow> regstate sequential_state \\<Rightarrow> bool\" where\n  \"valid_vaddr addr addrtop s \\<equiv>\n     (let high = addr !! nat addrtop;\n          p = read_params high s in\n        (if high\n         then addr AND slice_mask 64 (inputsize p) (addrtop - inputsize p + 1) =\n              slice_mask 64 (inputsize p) (addrtop - inputsize p + 1)\n         else addr AND slice_mask 64 (inputsize p) (addrtop - inputsize p + 1) = 0))\"\n\nabbreviation IsBlockDescriptor :: \"64 word \\<Rightarrow> bool\" where\n  \"IsBlockDescriptor desc \\<equiv> Word.slice 0 desc = (0b01 :: 2 word)\"\n\ndefinition ValidDescriptor :: \"int \\<Rightarrow> int \\<Rightarrow> int \\<Rightarrow> 64 word \\<Rightarrow> bool\" where\n  \"ValidDescriptor level grainsize_arg outputsize_arg desc \\<equiv>\n     desc !! 0 \\<and>\n     \\<not>(IsBlockDescriptor desc \\<and> level = 3) \\<and>\n     (\\<not>IsBlockDescriptor desc \\<and> level < 3 \\<longrightarrow>\n        (outputsize_arg < 52 \\<and> grainsize_arg = 16 \\<longrightarrow> Word.slice 12 desc = (0 :: 4 word)) \\<and>\n        (outputsize_arg < 48 \\<longrightarrow> desc AND slice_mask 64 outputsize_arg (48 - outputsize_arg) = 0))\"\n\ndefinition read_WalkAttrDecode :: \"2 word \\<Rightarrow> 2 word \\<Rightarrow> 2 word \\<Rightarrow> bool \\<Rightarrow> regstate sequential_state \\<Rightarrow> MemoryAttributes\" where\n  \"read_WalkAttrDecode SH_arg ORGN_arg IRGN_arg secondstage s \\<equiv>\n     \\<lparr>MemoryAttributes_typ = MemType_Normal, MemoryAttributes_device = DeviceType_GRE,\n             MemoryAttributes_inner =\n               \\<lparr>MemAttrHints_attrs =\n                  if \\<not> secondstage \\<and> (read_SCTLR (read_S1TranslationRegime (read_EL s) s) s !! 2 \\<longrightarrow> IRGN_arg = 0) \\<or>\n                     secondstage \\<and> (HCR_EL2 (regstate s) !! 32 \\<or> IRGN_arg = 0)\n                  then 0 else if IRGN_arg = 1 \\<or> IRGN_arg \\<noteq> 2 then 3 else 2,\n                  MemAttrHints_hints =\n                    if \\<not> secondstage \\<and> (read_SCTLR (read_S1TranslationRegime (read_EL s) s) s !! 2 \\<longrightarrow> IRGN_arg = 0) \\<or>\n                       secondstage \\<and> (HCR_EL2 (regstate s) !! 32 \\<or> IRGN_arg = 0)\n                    then MemHint_No else if IRGN_arg = 1 then MemHint_RWA else MemHint_RA,\n                  MemAttrHints_transient = False\\<rparr>,\n             MemoryAttributes_outer =\n               \\<lparr>MemAttrHints_attrs =\n                  if \\<not> secondstage \\<and> (read_SCTLR (read_S1TranslationRegime (read_EL s) s) s !! 2 \\<longrightarrow> ORGN_arg = 0) \\<or>\n                     secondstage \\<and> (HCR_EL2 (regstate s) !! 32 \\<or> ORGN_arg = 0)\n                  then 0 else if ORGN_arg = 1 \\<or> ORGN_arg \\<noteq> 2 then 3 else 2,\n                  MemAttrHints_hints =\n                    if \\<not> secondstage \\<and> (read_SCTLR (read_S1TranslationRegime (read_EL s) s) s !! 2 \\<longrightarrow> ORGN_arg = 0) \\<or>\n                       secondstage \\<and> (HCR_EL2 (regstate s) !! 32 \\<or> ORGN_arg = 0)\n                    then MemHint_No else if ORGN_arg = 1 then MemHint_RWA else MemHint_RA,\n                  MemAttrHints_transient = False\\<rparr>,\n             MemoryAttributes_shareable =\n               if \\<not> secondstage then read_SCTLR (read_S1TranslationRegime (read_EL s) s) s !! 2 \\<longrightarrow> IRGN_arg = 0 \\<and> ORGN_arg = 0 \\<or> SH_arg !! Suc 0\n               else (HCR_EL2 (regstate s) !! 32 \\<or> IRGN_arg = 0) \\<and> (HCR_EL2 (regstate s) !! 32 \\<or> ORGN_arg = 0) \\<or> SH_arg !! Suc 0,\n             MemoryAttributes_outershareable =\n               if \\<not> secondstage then read_SCTLR (read_S1TranslationRegime (read_EL s) s) s !! 2 \\<longrightarrow> IRGN_arg = 0 \\<and> ORGN_arg = 0 \\<or> SH_arg = 2\n               else (HCR_EL2 (regstate s) !! 32 \\<or> IRGN_arg = 0) \\<and> (HCR_EL2 (regstate s) !! 32 \\<or> ORGN_arg = 0) \\<or> SH_arg = 2\\<rparr>\"\n\ndefinition read_S1CacheDisabled :: \"AccType \\<Rightarrow> regstate sequential_state \\<Rightarrow> bool\" where\n  \"read_S1CacheDisabled acctype s =\n     (let sctlr = read_SCTLR (read_S1TranslationRegime (read_EL s) s) s in\n      if acctype = AccType_IFETCH then \\<not>(sctlr !! 12) else \\<not>(sctlr !! 2))\"\n\ndefinition read_LongConvertAttrsHints :: \"4 word \\<Rightarrow> AccType \\<Rightarrow> regstate sequential_state \\<Rightarrow> MemAttrHints\" where\n  \"read_LongConvertAttrsHints attrfield acctype s \\<equiv>\n     \\<lparr>MemAttrHints_attrs =\n        if read_S1CacheDisabled acctype s \\<or> attrfield = 4 then MemAttr_NC else\n        if Word.slice 2 attrfield = (0 :: 2 word) then MemAttr_WT else\n        if Word.slice 2 attrfield = (1 :: 2 word) then Word.slice 0 attrfield else\n        Word.slice 2 attrfield,\n      MemAttrHints_hints =\n        if read_S1CacheDisabled acctype s \\<or> attrfield = 4 then MemHint_No else\n        if Word.slice 2 attrfield = (0 :: 2 word) then Word.slice 0 attrfield else\n        if Word.slice 2 attrfield = (1 :: 2 word) then MemAttr_WB else (* Is this intentional? *)\n        Word.slice 0 attrfield,\n      MemAttrHints_transient =\n        if read_S1CacheDisabled acctype s then False else\n        attrfield \\<noteq> 4 \\<and> \\<not>(attrfield !! 3)\\<rparr>\"\n\ndefinition read_S1AttrDecode :: \"2 word \\<Rightarrow> 3 word \\<Rightarrow> AccType \\<Rightarrow> regstate sequential_state \\<Rightarrow> MemoryAttributes\" where\n  \"read_S1AttrDecode SH_arg attr acctype s =\n     (let mair = read_MAIR (read_S1TranslationRegime (read_EL s) s) s;\n          attrslo = Word.slice (nat (8 * uint attr)) mair :: 4 word;\n          attrshi = Word.slice (4 + nat (8 * uint attr)) mair :: 4 word;\n          ihints = read_LongConvertAttrsHints attrslo acctype s;\n          ohints = read_LongConvertAttrsHints attrshi acctype s in\n      \\<lparr>MemoryAttributes_typ = if attrslo = 0 \\<or> attrshi = 0 then MemType_Device else MemType_Normal,\n       MemoryAttributes_device =\n         if attrslo = 0 \\<or> attrshi = 0 then\n           (if attrslo = 0 then DeviceType_nGnRnE\n            else if attrslo = 4 then DeviceType_nGnRE\n            else if attrslo = 8 then DeviceType_nGRE\n            else if attrslo = 12 then DeviceType_GRE\n            else DeviceType_nGnRnE)\n         else DeviceType_GRE,\n       MemoryAttributes_inner =\n         if attrslo \\<noteq> 0 \\<and> attrshi \\<noteq> 0 then ihints\n         else \\<lparr>MemAttrHints_attrs = 0, MemAttrHints_hints = 0, MemAttrHints_transient = False\\<rparr>,\n       MemoryAttributes_outer =\n         if attrslo \\<noteq> 0 \\<and> attrshi \\<noteq> 0 then ohints\n         else \\<lparr>MemAttrHints_attrs = 0, MemAttrHints_hints = 0, MemAttrHints_transient = False\\<rparr>,\n       MemoryAttributes_shareable =\n         attrslo = 0 \\<or> attrshi = 0 \\<or>\n         MemAttrHints_attrs ihints = 0 \\<and> MemAttrHints_attrs ohints = 0 \\<or>\n         SH_arg !! 1,\n       MemoryAttributes_outershareable =\n         attrslo = 0 \\<or> attrshi = 0 \\<or>\n         MemAttrHints_attrs ihints = 0 \\<and> MemAttrHints_attrs ohints = 0 \\<or>\n         SH_arg = 2\\<rparr>)\"\n\nfun read_TTBR0 where\n  \"read_TTBR0 s =\n     (let el = read_S1TranslationRegime (read_EL s) s in\n      if el = 3 then TTBR0_EL3 (regstate s) else\n      if el = 2 then TTBR0_EL2 (regstate s) else TTBR0_EL1 (regstate s))\"\n\nfun read_TTBR1 where\n  \"read_TTBR1 s =\n     (let el = read_S1TranslationRegime (read_EL s) s in\n      if el = 3 then TTBR0_EL3 (regstate s) else\n      if el = 2 then TTBR1_EL2 (regstate s) else TTBR1_EL1 (regstate s))\"\n\ndefinition read_TTBR :: \"bool \\<Rightarrow> regstate sequential_state \\<Rightarrow> 64 word\" where\n  \"read_TTBR high s = (if high then read_TTBR1 s else read_TTBR0 s)\"\n\ndefinition TTBR_valid_for_vaddr :: \"64 word \\<Rightarrow> int \\<Rightarrow> regstate sequential_state \\<Rightarrow> bool\" where\n  \"TTBR_valid_for_vaddr addr addrtop s \\<equiv>\n     (let high = addr !! nat addrtop;\n          p = read_params high s in\n        (outputsize p < 48 \\<longrightarrow> read_TTBR high s AND slice_mask 64 (outputsize p) (48 - outputsize p) = 0))\"\n\ndefinition addrselecttop :: \"int \\<Rightarrow> Parameters \\<Rightarrow> int\" where\n  \"addrselecttop level p =\n     (min (inputsize p) ((4 - level) * (grainsize p - 3) + grainsize p) - 1)\"\n\ndefinition addrselectbottom :: \"int \\<Rightarrow> Parameters \\<Rightarrow> int\" where\n  \"addrselectbottom level p = (3 - level) * (grainsize p - 3) + grainsize p\"\n\ndefinition stride :: \"int \\<Rightarrow> Parameters \\<Rightarrow> int\" where\n  \"stride level p = addrselecttop level p - addrselectbottom level p + 1\"\n\nfunction read_table :: \"int \\<Rightarrow> bool \\<Rightarrow> 52 word \\<Rightarrow> regstate sequential_state \\<Rightarrow> TableEntry list\" where\n  \"read_table level high baseaddr s =\n     (let p = read_params high s;\n          stride = stride level p;\n          descaddrs = map (\\<lambda>idx. baseaddr OR (word_of_int idx << 3)) [0..2 ^ nat stride - 1];\n          read_desc =\n            (\\<lambda>addr. case read_mem_word addr 8 s of\n                      None \\<Rightarrow> Invalid\n                    | Some desc \\<Rightarrow>\n                        let desc = if read_bigendian s then reverse_endianness desc else desc in\n                        (if ValidDescriptor level (grainsize p) (outputsize p) desc \\<and> level \\<ge> 0 \\<and> level < 4 then\n                           (if (IsBlockDescriptor desc \\<or> level = 3) then Descriptor desc\n                            else\n                              let lbaseaddr = ((Word.slice (nat (grainsize p)) desc) << nat (grainsize p)) :: 48 word;\n                                  ubaseaddr = (if outputsize p = 52 then Word.slice 12 desc else 0) :: 4 word;\n                                  baseaddr = word_cat ubaseaddr lbaseaddr :: 52 word;\n                                  ns = desc !! 63; ap1 = desc !! 62; ap0 = desc !! 61; xn = desc !! 60; pxn = desc !! 59 in\n                              Table baseaddr ns ap1 ap0 xn pxn (read_table (level + 1) high baseaddr s))\n                         else Invalid)) in\n      map read_desc descaddrs)\"\n  by pat_completeness auto\ntermination by (relation \"measure (\\<lambda>(level, _). 4 - nat level)\") auto\n\nlemma size_list_table_nth_dec[termination_simp]:\n  assumes i: \"i < length table\" and table': \"table ! i = Table baseaddr ns ap1 ap0 xn pxn table'\"\n  shows \"size_list size table' < size_list size table\"\n  using table'\n  by (auto intro: size_list_estimation[OF nth_mem[OF i]])\n\nfun walk_table :: \"64 word \\<Rightarrow> int \\<Rightarrow> Parameters \\<Rightarrow> 52 word \\<Rightarrow> TableEntry list \\<Rightarrow>\n                       (64 word \\<times> 52 word \\<times> 52 word \\<times> int \\<times> bool \\<times> bool \\<times> bool \\<times> bool \\<times> bool) option\" where\n  \"walk_table inputaddr level p baseaddr table =\n     (let index = uint (inputaddr AND slice_mask 52 (addrselectbottom level p) (stride level p) >> nat (addrselectbottom level p));\n          descaddr = baseaddr OR (word_of_int index << 3) in\n      if nat index < length table then\n        (case table ! nat index of\n           Invalid \\<Rightarrow> None\n         | Descriptor desc \\<Rightarrow> Some (desc, descaddr, baseaddr, level, False, False, False, False, False)\n         | Table baseaddr ns ap1 ap0 xn pxn table \\<Rightarrow>\n             (case walk_table inputaddr (level + 1) p baseaddr table of\n               None \\<Rightarrow> None\n              | Some (desc, descaddr, baseaddr, level, ns', ap1', ap0', xn', pxn') \\<Rightarrow>\n                  Some (desc, descaddr, baseaddr, level, ns \\<or> ns', ap1 \\<or> ap1', ap0 \\<or> ap0', xn \\<or> xn', pxn \\<or> pxn')))\n      else None)\"\n\ndeclare walk_table.simps[simp del]\n\nabbreviation\n  \"default_FaultRecord \\<equiv>\n     \\<lparr>FaultRecord_typ = Fault_None, FaultRecord_acctype = AccType_NORMAL, FaultRecord_ipaddress = 0,\n      FaultRecord_s2fs1walk = False, FaultRecord_write = False, FaultRecord_level = 0,\n      FaultRecord_extflag = 0, FaultRecord_secondstage = False, FaultRecord_domain = 0,\n      FaultRecord_errortype = 0, FaultRecord_debugmoe = 0\\<rparr>\"\n\ndefinition valid_perms :: \"Permissions \\<Rightarrow> AccType \\<Rightarrow> bool \\<Rightarrow> regstate sequential_state \\<Rightarrow> bool\" where\n  \"valid_perms perms acctype iswrite s \\<equiv>\n     (let wxn = SCTLR_EL1 (regstate s) !! 19;\n          r = Permissions_ap perms !! 1;\n          w = (Word.slice 1 (Permissions_ap perms) = (1 :: 2 word));\n          xn = (Permissions_xn perms = 1) \\<or> (w \\<and> wxn) in\n      if acctype = AccType_IFETCH then \\<not>xn\n      else if acctype \\<in> { AccType_ATOMICRW, AccType_ORDEREDRW } then r \\<and> w\n      else if iswrite then w\n      else r)\"\n\ndefinition lookup_TLBRecord :: \"64 word \\<Rightarrow> AccType \\<Rightarrow> regstate sequential_state \\<Rightarrow> TLBRecord option\" where\n  \"lookup_TLBRecord vaddress acctype s =\n     (let top = read_AddrTop_EL0 vaddress (acctype = AccType_IFETCH) s;\n          high = vaddress !! nat top;\n          p = read_params high s;\n          baseaddress = baseaddress (read_TTBR high s) (baselowerbound p) (outputsize p);\n          hierattrs = \\<not>(if high then TCR_EL1 (regstate s) !! 42 else TCR_EL1 (regstate s) !! 41);\n          secure = \\<not> SCR_EL3 (regstate s) !! 0 in\n      case walk_table vaddress (startlevel p) p baseaddress\n             (read_table (startlevel p) high baseaddress s) of\n        None \\<Rightarrow> None\n      | Some (desc, descaddr, baseaddr, level, ns, ap1, ap0, xn, pxn) \\<Rightarrow>\n          let addrselectbottom = addrselectbottom level p;\n              walkattrs = read_WalkAttrDecode (SH p) (ORGN p) (IRGN p) False s;\n              memattrs = read_S1AttrDecode (Word.slice 8 desc) (Word.slice (Suc (Suc 0)) desc) acctype s;\n              perms =\n                \\<lparr>Permissions_ap = of_bl [\\<not>desc !! 51 \\<and> desc !! 7 \\<or> hierattrs \\<and> ap1, desc !! 6 \\<and> \\<not>(hierattrs \\<and> ap0), True],\n                 Permissions_xn = of_bl [desc !! 54 \\<or> hierattrs \\<and> xn],\n                 Permissions_xxn = 0,\n                 Permissions_pxn = of_bl [desc !! 53 \\<or> hierattrs \\<and> pxn]\\<rparr> in\n          if level \\<ge> firstblocklevel p \\<and>\n             valid_vaddr vaddress top s \\<and>\n             TTBR_valid_for_vaddr vaddress top s \\<and>\n             (outputsize p < 48 \\<longrightarrow>\n                desc AND slice_mask 64 (outputsize p) (48 - outputsize p) = 0) \\<and>\n             (outputsize p < 52 \\<and> largegrain p \\<longrightarrow> Word.slice 12 desc = (0 :: 4 word)) \\<and>\n             (contiguousbitcheck p level \\<longrightarrow> \\<not>desc !! 52)\n          then\n            let outputaddr :: 52 word =\n              if outputsize p = 52\n              then word_cat (Word.slice 12 desc :: 4 word)\n                     (slice_slice_concat 48 desc addrselectbottom (48 - addrselectbottom)\n                                         vaddress 0 addrselectbottom :: 48 word)\n              else slice_slice_concat 52 desc addrselectbottom (48 - addrselectbottom) vaddress 0 addrselectbottom in\n            Some \\<lparr>TLBRecord_perms = perms,\n                  TLBRecord_nG = of_bl [desc !! 11 \\<or> (secure \\<and> ns)],\n                  TLBRecord_domain = 0, TLBRecord_contiguous = desc !! 52,\n                  TLBRecord_level = level,\n                  TLBRecord_blocksize = 2 ^ (nat addrselectbottom),\n                  TLBRecord_descupdate =\n                    \\<lparr>DescriptorUpdate_AF = \\<not>desc !! 10,\n                     DescriptorUpdate_AP = desc !! 51 \\<and> desc !! 7,\n                     DescriptorUpdate_descaddr =\n                       \\<lparr>AddressDescriptor_fault = default_FaultRecord,\n                        AddressDescriptor_memattrs = walkattrs,\n                        AddressDescriptor_paddress =\n                          \\<lparr>FullAddress_physicaladdress = descaddr,\n                           FullAddress_NS = of_bl [ns \\<or> \\<not>secure]\\<rparr>,\n                        AddressDescriptor_vaddress = vaddress\\<rparr>\\<rparr>,\n                  TLBRecord_CnP = of_bl [read_TTBR high s !! 0],\n                  TLBRecord_addrdesc =\n                    \\<lparr>AddressDescriptor_fault = default_FaultRecord,\n                     AddressDescriptor_memattrs = memattrs,\n                     AddressDescriptor_paddress =\n                       \\<lparr>FullAddress_physicaladdress = outputaddr,\n                        FullAddress_NS = of_bl [desc !! 5 \\<or> ns \\<or> \\<not>secure]\\<rparr>,\n                     AddressDescriptor_vaddress = vaddress\\<rparr> \\<rparr>\n          else None)\"\n\ndefinition translate_address :: \"64 word \\<Rightarrow> AccType \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> regstate sequential_state \\<Rightarrow> TLBRecord option\" where\n  \"translate_address vaddress acctype iswrite wasaligned s =\n     (case lookup_TLBRecord vaddress acctype s of\n        None \\<Rightarrow> None\n      | Some r \\<Rightarrow>\n          let top = read_AddrTop_EL0 vaddress (acctype = AccType_IFETCH) s in\n          if valid_perms (TLBRecord_perms r) acctype iswrite s \\<and>\n             AddressDescriptor_physicaladdress (DescriptorUpdate_descaddr (TLBRecord_descupdate r)) \\<noteq> 0x13000000 \\<and> (* debug console hard-coded in this ASL model *)\n             (MemoryAttributes_typ (AddressDescriptor_memattrs (TLBRecord_addrdesc r)) = MemType_Device \\<longrightarrow>\n              wasaligned \\<and> acctype \\<notin> {AccType_IFETCH, AccType_DCZVA})\n          then Some r else None)\"\n\ndefinition read_descriptor :: \"52 word \\<Rightarrow> regstate sequential_state \\<Rightarrow> 64 word option\" where\n  \"read_descriptor addr s \\<equiv>\n     (case read_mem_word addr 8 s of\n        None \\<Rightarrow> None\n      | Some desc \\<Rightarrow> Some (if read_bigendian s then reverse_endianness desc else desc))\"\n\ndefinition write_descriptor :: \"52 word \\<Rightarrow> 64 word \\<Rightarrow> regstate sequential_state \\<Rightarrow> regstate sequential_state\" where\n  \"write_descriptor addr desc s \\<equiv>\n     (let desc = if read_bigendian s then reverse_endianness desc else desc in\n      write_mem_bytes (uint addr) 8 (mem_bytes_of_word desc) (s\\<lparr>write_ea := Some (Write_plain, uint addr, 8)\\<rparr>))\"\n\ndefinition update_descriptor :: \"DescriptorUpdate \\<Rightarrow> AccType \\<Rightarrow> bool \\<Rightarrow> regstate sequential_state \\<Rightarrow> regstate sequential_state\" where\n  \"update_descriptor descupd acctype iswrite s \\<equiv>\n     (case read_descriptor (AddressDescriptor_physicaladdress (DescriptorUpdate_descaddr descupd)) s of\n        None \\<Rightarrow> s\n      | Some desc \\<Rightarrow>\n          (let ap = DescriptorUpdate_AP descupd \\<and>\n                    (iswrite \\<or> acctype = AccType_ATOMICRW \\<or> acctype = AccType_ORDEREDRW) \\<and>\n                    acctype \\<noteq> AccType_AT \\<and> acctype \\<noteq> AccType_DC;\n               af = DescriptorUpdate_AF descupd;\n               desc = if af then set_bit desc 10 True else desc;\n               desc = if ap then set_bit desc 7 False else desc;\n               addr = AddressDescriptor_physicaladdress (DescriptorUpdate_descaddr descupd) in\n           if af \\<or> ap\n           then write_descriptor addr desc s\n           else s))\"\n\nend\n", "meta": {"author": "rems-project", "repo": "armv8a-address-translation", "sha": "3ddeec3949ee4a859be1b38b41e93f8d9523970c", "save_path": "github-repos/isabelle/rems-project-armv8a-address-translation", "path": "github-repos/isabelle/rems-project-armv8a-address-translation/armv8a-address-translation-3ddeec3949ee4a859be1b38b41e93f8d9523970c/Address_Translation_Pure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370308082623216, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.32349180234697794}}
{"text": "chapter {* Distributed and executable algorithm *}\n\ntheory AbstractMultiPaxosR3\n  imports Utils FinFun_Supplemental MaxByKey IOA Quorums Paxos_Sig\nbegin\n\nunbundle finfun_syntax\n\ntype_synonym bal = nat\ntype_synonym inst = nat\n\nsection {* Local state and transitions *}\n\nsubsection {* Data structures *}\n\nrecord ('a, 'v) acc =\n  -- {* The local state of an acceptor. *}\n  id :: 'a\n  acceptors :: \"'a set\"\n  ballot :: bal\n  decision :: \"inst \\<Rightarrow>f 'v option\"\n    -- {* Last ballot in which the acceptor voted. *}\n  inst_status :: \"bal \\<Rightarrow>f (inst \\<Rightarrow>f 'v option) option\"\n    -- {* Mirrors the member of the same name in R1 *}\n  proposal :: \"inst \\<Rightarrow>f bal \\<Rightarrow>f 'v option\"\n  votes :: \"inst \\<Rightarrow>f ('v \\<times> bal) option\"\n  onebs :: \"bal \\<Rightarrow>f ('a \\<Rightarrow>f (inst \\<Rightarrow>f ('v\\<times>bal) option) option)\"\n    -- {* The oneb messages received when the acceptor tries to acquire leadership. \n    Note that we need the outermost option to signify that we did not receive a oneb message\n    from the acceptor, as opposed to receiving a oneb message from an acceptor that never voted.  *}\n  twobs :: \"inst \\<Rightarrow>f bal \\<Rightarrow>f 'a set\"\n    -- {* the twob messages received (they are broadcast). *}\n\ndatatype ('aa,'vv) msg =\n  Phase1a bal\n  | Phase1b 'aa bal \"inst \\<Rightarrow>f ('vv \\<times> bal) option\"\n  | Phase2a inst bal 'vv\n  | Phase2b 'aa inst bal 'vv\n  | Fwd 'vv\n  \ndatatype ('aa,'vv) packet =\n  Packet 'aa  \"('aa,'vv) msg\"\n\nlocale amp_r3 =\n  fixes leader :: \"bal \\<Rightarrow> 'a::linorder\"\n  and next_bal :: \"bal \\<Rightarrow> 'a \\<Rightarrow> bal\"\n  and as :: \"'a set\"\n  and quorums :: \"'a set set\"\nbegin\n\ndefinition local_start where \"local_start a \\<equiv>\n  \\<lparr>id = a, acceptors = as, ballot = 0, decision = K$ None, inst_status = K$ None,\n  proposal = K$ K$ None, votes = K$ None, onebs = K$ K$ None, twobs = K$ K$ {}\\<rparr>\"\n  \nend\n\nsubsection {* The propose action *}\n\ndefinition send_all where send_all_def[code del]:\n  \"send_all s m \\<equiv> { Packet a m | a . a \\<in> acceptors s \\<and> a \\<noteq> id s}\"\n  -- {* TODO: This definition does not always work for code generation. Why? \n  That's why there is a code equation below. *}\n  \nlemma send_all_code[code]:\n  \"send_all s m = (flip Packet m) ` (acceptors s - {id s})\"\n  by (auto simp add:send_all_def)\n\nfun first_hole :: \"nat list \\<Rightarrow> nat\" where \n  \"first_hole [] = 0\"\n| \"first_hole [x] = Suc x\"\n| \"first_hole (x#y#xs) = (if y = Suc x then first_hole (y#xs) else Suc x)\"\n\nlemma first_hole_lemma:\n  assumes \"sorted l\" and \"distinct l\"\n    shows \"first_hole l \\<notin> set l\" and \"l \\<noteq> [] \\<Longrightarrow> first_hole l > hd l\"\nproof -\n  have \"first_hole l \\<notin> set l \\<and> (l \\<noteq> [] \\<longrightarrow> first_hole l > hd l)\"\n    using assms\n  proof (induct l rule:first_hole.induct)\n    case 1\n    then show ?case\n      by simp \n  next\n    case (2 x)\n    then show ?case\n      by simp\n  next\n    case (3 x y xs)\n    from \"3.prems\" have 4:\"sorted (y#xs)\" and 5:\"distinct (y#xs)\" using sorted_Cons by auto\n    show ?case proof (cases \"y = Suc x\")\n      case True\n      hence 6:\"first_hole (x#y#xs) = first_hole (y#xs)\" by auto\n      have 7:\"y < first_hole (y#xs)\" using 4 5 3 True by auto\n      show ?thesis using 3 4 5 6 7 True by auto\n    next\n      case False\n      with \\<open>sorted (x#y#xs)\\<close> and \\<open>distinct (x#y#xs)\\<close> have \"\\<And> z . z \\<in> set (y#xs) \\<Longrightarrow> z > Suc x\"\n        apply auto by (metis Suc_lessI le_imp_less_or_eq le_less_Suc_eq le_trans sorted_Cons)\n      then show ?thesis apply simp using not_less by blast\n    qed\n  qed\n  thus \"first_hole l \\<notin> set l\" and \"l \\<noteq> [] \\<Longrightarrow> first_hole l > hd l\"\n    by auto\nqed\n  \ncontext amp_r3\nbegin\n\ndefinition next_inst where \"next_inst s \\<equiv> let b = ballot s in \n  first_hole (finfun_to_list (the (inst_status s $ b)))\"\n  \nlemma next_inst_lemma:\n  fixes s \n  assumes \"inst_status s $ (ballot s) = Some f\" and \"finfun_default f = None\"\n  shows \"f $ (next_inst s) = None\"\nproof -\n  let ?b=\"ballot s\"\n  let ?l=\"finfun_to_list (the (inst_status s $ ?b))\" \n  have 2:\"distinct ?l\" and 3:\"sorted ?l\" by (simp_all add: distinct_finfun_to_list sorted_finfun_to_list)\n  moreover have \"next_inst s = first_hole (finfun_to_list f)\" using assms(1) unfolding next_inst_def  by auto\n  ultimately show \"f $ (next_inst s) = None\" using assms first_hole_lemma[OF 3 2] by (auto simp add:next_inst_def finfun_dom_conv)\nqed\n  \ndefinition do_2a where \"do_2a s v \\<equiv>\n  let\n    i = next_inst s;\n    b = ballot s;\n    s' = s\\<lparr>proposal := (proposal s)(i $:= (proposal s $ i)(b $:= Some v)),\n      twobs := (twobs s)(i $:= (twobs s $ i)(b $:= {id s}))\\<rparr>;\n    msgs = send_all s (Phase2a i b v)\n  in (s', msgs)\"\n \ndefinition propose where \"propose s v \\<equiv> \n  let l = leader (ballot s) in\n    if l = id s\n    then (do_2a s v)\n    else (s, {Packet l (Fwd v)})\"\n  -- {* TODO: Here we loose the proposal if it happens during an unsuccessful leadership acquisition attempt. *} \n\nsubsection {* The @{text receive_fwd} action *}\n\ndefinition receive_fwd where \"receive_fwd s v \\<equiv>\n  let l = leader (ballot s) in\n    if l = id s\n    then do_2a s v\n    else (s, {Packet l (Fwd v)})\"\n  -- {* TODO: Here we loose the proposal if it happens during an unsuccessful leadership acquisition attempt. *}\n  \nend\n\nsubsection {* The @{text try_acquire_leadership} action *}\n\ncontext amp_r3 begin\n\ndefinition try_acquire_leadership where \"try_acquire_leadership s \\<equiv>\n  let\n    a = id s;\n    b = next_bal (ballot s) a;\n    s' = s\\<lparr>onebs := (onebs s)(b $:= ((onebs s) $ b)(a $:= Some (votes s))), \n      ballot := b\\<rparr>;\n    msgs = send_all s (Phase1a b)\n  in (s', msgs)\"\n\nsubsection {* The @{text receive_1a} action *}\n\ndefinition receive_1a where \"receive_1a s b \\<equiv> \n  if b > ballot s then let\n      msgs = {Packet (leader b) (Phase1b (id s) b (votes s))};\n      s' = s\\<lparr>ballot := b\\<rparr>\n    in (s', msgs)\n  else (s, {})\"\n  \nend \n\nsubsection {* The @{text receive_1b} action *}\n\nlocale receive_1b =\n  fixes onebs :: \"'a \\<Rightarrow>f (inst \\<Rightarrow>f ('v\\<times>bal) option) option\"\n  fixes q :: \"'a set\"\n  fixes decision :: \"inst \\<Rightarrow>f 'v option\"\n  fixes b :: bal\nbegin\n\ntext {* Why not do things with @{term finfun_rec}? *}\n\ntext {* Intended to be used when a oneb message has been received from each member of q. *}\n\ndefinition c where \n  \"c a vs \\<equiv> (\\<lambda> (vo, vs) . option_as_set vo \\<union> vs) o$ ($ the (onebs $ a), vs $)\"\n  \ndefinition pre_votes_per_inst where\n  \"pre_votes_per_inst S \\<equiv> Finite_Set.fold c (K$ {}) S\"\n\ndefinition votes_per_inst where\n  \"votes_per_inst \\<equiv> pre_votes_per_inst q\"\n  \nsublocale folding_idem c \"K$ {}\"\n  apply (unfold_locales)\n   apply (auto simp add:c_def option_as_set_def fun_eq_iff expand_finfun_eq split!:option.splits)\n  done\n\nlemma votes_per_inst_code[code]:\n  \"pre_votes_per_inst (set (x#xs)) = c x (pre_votes_per_inst (set xs))\" \n  using insert_idem[of \"set xs\" x]\n  by (simp add: eq_fold pre_votes_per_inst_def) \n\ndefinition max_per_inst where \"max_per_inst \\<equiv> (flip max_by_key snd) o$ votes_per_inst\"\n  \ndefinition new_status where \"new_status \\<equiv>\n  (map_option fst) o$ (\\<lambda> m . if m = {} then None else Some (the_elem m)) o$ max_per_inst\"\n  \ndefinition to_propose where \"to_propose \\<equiv>\n  (\\<lambda> (d,s) . case d of Some _ \\<Rightarrow> {} | None \\<Rightarrow> fst ` s) o$ ($ decision, max_per_inst $)\"\n  \ndefinition msgs where \"msgs \\<equiv>\n  let \n    is = finfun_to_list to_propose;\n    to_propose = map (\\<lambda> i . (i, to_propose $ i)) is;\n    msg_list = map (\\<lambda> (i,vs) . (Phase2a i b) ` vs) to_propose\n  in \\<Union> (set msg_list)\"\n\nlemma msgs_lemma:\n  \"\\<And> m . m \\<in> msgs \\<Longrightarrow> case m of (Phase2a _ _ _) \\<Rightarrow> True | _ \\<Rightarrow> False\"\n  by (auto simp add:local.msgs_def) \n\nend\n\nglobal_interpretation r1b:receive_1b onebs as decision b for onebs as decision b\n  defines new_status = receive_1b.new_status and msgs = receive_1b.msgs\n  .\n\ncontext amp_r3 begin\n\ndefinition receive_1b where \"receive_1b s a b vs \\<equiv>\n  let s' = s\\<lparr>onebs := (onebs s)(b $:= ((onebs s) $ b)(a $:= Some vs))\\<rparr>\n  in (if (set (finfun_to_list (onebs s' $ b)) = acceptors s)\n      \\<and> inst_status s $ b = None\n    then let\n        s'' = s'\\<lparr>inst_status := (inst_status s)(b $:= Some (new_status (onebs s $ b) (acceptors s)))\\<rparr>;\n        msgs = msgs (onebs s $ b) (acceptors s) (decision s) (ballot s)\n      in (s'', \\<Union> {send_all s m | m . m \\<in> msgs})\n    else (s', {}))\"\n\nsubsection {* The @{text receive_2a} action *}\n\nabbreviation(input) decided where \"decided s i \\<equiv> \n  case (decision s $ i) of Some _ \\<Rightarrow> True | _ \\<Rightarrow> False\"\n  \ndefinition receive_2a where \"receive_2a s i b v \\<equiv>\n  if b \\<ge> ballot s then\n    let s' = s\\<lparr>votes := (votes s)(i $:= Some (v, b)),\n      twobs := (twobs s)(i $:= (twobs s $ i)(b $:= insert (id s) (twobs s $ i $ b))),\n      ballot := b\\<rparr>;\n      msgs = send_all s (Phase2b (id s) i b v)\n    in (s', msgs)\n  else (s, {})\"\n  \nsubsection {* The @{text receive_2b} action *}\n\ndefinition receive_2b where \"receive_2b s i b a v \\<equiv>\n  if (~ decided s i)\n  then let\n      s' = s\\<lparr>twobs := (twobs s)(i $:= (twobs s $ i)(b $:= insert a (twobs s $ i $ b)))\\<rparr>\n    in (\n      if (twobs s' $ i $ b = (acceptors s))\n      then let s'' = s'\\<lparr>decision := (decision s)(i $:= Some v)\\<rparr>\n        in (s'', {})\n      else (s', {}) )\n  else (s, {})\"\n\nsubsection {* The @{text process_msg} action *}\n\nfun process_msg where\n  \"process_msg s (Phase1a b) = receive_1a s b\"\n  | \"process_msg s (Phase2a i b v) = receive_2a s i b v\"\n  | \"process_msg s (Phase2b a i b v) = receive_2b s i b a v\"\n  | \"process_msg s (Phase1b a b vs) = receive_1b s a b vs\"\n  | \"process_msg s (Fwd v) = receive_fwd s v\"\n\nend\n\nsubsection {* Global system IOA. *} \n\nrecord ('a,'v) global_state =\n  lstate :: \"'a \\<Rightarrow> ('a, 'v)acc\"\n  network :: \"('a, 'v) packet set\"\n\ncontext amp_r3 begin\n\ndefinition global_start where \"global_start \\<equiv>\n  \\<lparr>lstate = (\\<lambda> a . local_start a), network = {}\\<rparr>\"\n\ninductive trans_rel :: \"(('a,'v) global_state \\<times> 'v paxos_action \\<times> ('a,'v) global_state) \\<Rightarrow> bool\" where\n  \"\\<lbrakk>(Packet a m) \\<in> network s; process_msg ((lstate s) a) m = (sa', ms); m = Phase2b a i b v;\n    decision ((lstate s) a) \\<noteq> decision sa'\\<rbrakk>\n    \\<Longrightarrow> trans_rel (s, Learn i v, \n      s\\<lparr>lstate := (lstate s)(a := sa'), network := network s \\<union> ms\\<rparr>)\"\n| \"\\<lbrakk>(Packet a m) \\<in> network s; process_msg ((lstate s) a) m = (sa', ms)\\<rbrakk>\n    \\<Longrightarrow> trans_rel (s, Internal, \n      s\\<lparr>lstate := (lstate s)(a := sa'), network := network s \\<union> ms\\<rparr>)\"\n| \"\\<lbrakk>propose ((lstate s) a) v = (sa', ms)\\<rbrakk>\n    \\<Longrightarrow> trans_rel (s, Propose v, \n      s\\<lparr>lstate := (lstate s)(a := sa'), network := network s \\<union> ms\\<rparr>)\"\n| \"\\<lbrakk>try_acquire_leadership ((lstate s) a) = (sa', ms)\\<rbrakk>\n    \\<Longrightarrow> trans_rel (s, Internal, \n      s\\<lparr>lstate := (lstate s)(a := sa'), network := network s \\<union> ms\\<rparr>)\"\n  \ninductive_cases trans_rel_cases:\"trans_rel (s,a,s')\"\n\nabbreviation(input) local_step where \"local_step a p r r' \\<equiv> \n  r' = r\\<lparr>lstate := (lstate r)(a := fst p), network := network r \\<union> snd p\\<rparr>\"\n  \nlemma trans_cases:\n  assumes \"trans_rel (r, act, r')\"\n  obtains\n    (propose) a v where \"act = Propose v\" and \"local_step a (propose (lstate r a) v) r r'\"\n  | (learn) a i b v m p where \"act = Learn i v\" and \"m = Phase2b a i b v\"\n    and \"p = receive_2b (lstate r a) i b a v\"\n    and \"local_step a p r r'\"\n    and \"Packet a m \\<in> network r\" \n    and \"decision (lstate r a) \\<noteq> decision (fst p)\"\n  | (acquire_leadership) a where \"act = Internal\" and \"local_step a (try_acquire_leadership (lstate r a)) r r'\"\n  | (receive_1a) a b m p where \"act = Internal\" and \"m = Phase1a b\"\n    and \"p = receive_1a (lstate r a) b\"\n    and \"local_step a p r r'\"\n    and \"Packet a m \\<in> network r\"\n  | (receive_2a) a i b v m p where \"act = Internal\" and \"m = Phase2a i b v\"\n    and \"p = receive_2a (lstate r a) i b v\"\n    and \"local_step a p r r'\"\n    and \"Packet a m \\<in> network r\"\n  | (receive_2b) a a2 i b v m p where \"act = Internal\" and \"m = Phase2b a2 i b v\"\n    and \"p = receive_2b (lstate r a) i b a2 v\"\n    and \"local_step a p r r'\"\n    and \"Packet a m \\<in> network r\"\n  | (receive_1b) a b vs m p a2 where \"act = Internal\" and \"m = Phase1b a2 b vs\"\n    and \"p = receive_1b (lstate r a) a2 b vs\"\n    and \"local_step a p r r'\"\n    and \"Packet a m \\<in> network r\"\n  | (fwd) a v m p where \"act = Internal\" and \"m = Fwd v\"\n    and \"p = receive_fwd (lstate r a) v\"\n    and \"local_step a p r r'\"\n    and \"Packet a m \\<in> network r\"\nproof -\n  show ?thesis using assms\n    apply (rule trans_rel_cases)\n       apply (metis fst_conv learn snd_conv)\n      defer\n      apply (metis fst_conv propose snd_conv)\n     apply (metis acquire_leadership fst_conv snd_conv)\n    subgoal premises prems for a m (* TODO: how to apply induct here without subgoal? *)\n      using prems\n      apply (induct rule:process_msg.induct)\n          apply (metis fst_conv process_msg.simps(1) receive_1a snd_conv)\n         apply (metis fst_conv process_msg.simps(2) receive_2a snd_conv)\n        defer\n        apply (metis fst_conv process_msg.simps(4) receive_1b snd_conv)\n       apply (metis amp_r3.process_msg.simps(5) fst_conv fwd snd_conv)\n      by (metis fst_conv process_msg.simps(3) receive_2b snd_conv)\n    done\nqed\n\ndefinition ioa where\n  \"ioa \\<equiv> \\<lparr>ioa.asig = paxos_asig, ioa.start = {global_start}, ioa.trans = Collect trans_rel\\<rparr>\"\n\nend\n\nend", "meta": {"author": "nano-o", "repo": "dist-systems-verif", "sha": "9826370dd5f1c6df6543e64481bfafc3e164674e", "save_path": "github-repos/isabelle/nano-o-dist-systems-verif", "path": "github-repos/isabelle/nano-o-dist-systems-verif/dist-systems-verif-9826370dd5f1c6df6543e64481bfafc3e164674e/Isabelle2/AbstractMultiPaxosR3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.32320594924401846}}
{"text": "theory OpSem_New\nimports Main OpSem\nbegin\n\ntype_synonym W = \"L \\<times> TS\"\n\n\ndefinition vfs :: \"surrey_state \\<Rightarrow> W \\<Rightarrow> rat set\"\n  where \"vfs \\<sigma> w \\<equiv> {ts'. valid_fresh_ts \\<sigma> w ts'}\"\n\ndefinition \"vws \\<sigma> t x \\<equiv> {w . w\\<in> visible_writes \\<sigma> t x \\<and> write_available \\<sigma> w}\"\n\ndefinition \"obsW \\<sigma> t x \\<equiv> {w . w\\<in> visible_writes \\<sigma> t x}\"\n\ndefinition \"getVWNC \\<sigma> t x \\<equiv> (SOME e . e \\<in> vws \\<sigma> t x)\"\n\ndefinition \"getVW \\<sigma> t x \\<equiv> (SOME e . e \\<in> obsW \\<sigma> t x)\"\n\ndefinition getTS :: \"surrey_state \\<Rightarrow> W \\<Rightarrow> rat\"\n  where \"getTS \\<sigma> w \\<equiv> (SOME e . e \\<in> vfs \\<sigma> w)\"\n\n\n\nlemma last_ts: \"wfs \\<sigma> \\<Longrightarrow> \n      lastWr \\<sigma> x = thrView \\<sigma> t x \\<Longrightarrow>\n      tst (lastWr \\<sigma> x) = ts \\<Longrightarrow>\n       w\\<in>visible_writes \\<sigma> t x \\<Longrightarrow> \n        tst w = ts \"\n  apply(simp add: visible_writes_def lastWr_def)\n  by (metis dual_order.antisym lastWr_def last_write_max)\n\n\nlemma same_ws: \" w \\<in> writes_on \\<sigma> x \\<Longrightarrow>  w' \\<in> writes_on \\<sigma> x \\<Longrightarrow> tst w = tst w' \\<Longrightarrow> w = w'\"\n  apply (unfold  writes_on_def writes_def)\n   by (simp add: prod_eqI)\n\nlemma last_sing: \"wfs \\<sigma> \\<Longrightarrow> \n      lastWr \\<sigma> x = thrView \\<sigma> t x \\<Longrightarrow>\n      tst (lastWr \\<sigma> x) = ts \\<Longrightarrow>\n      w \\<in> visible_writes \\<sigma> t x \\<Longrightarrow>  w =  lastWr \\<sigma> x\"\n  using last_ts [where \\<sigma> = \\<sigma> and x = x and t = t and ts = ts and w = w]\n  apply simp\n  using same_ws\n  by (metis (no_types, lifting) mem_Collect_eq visible_writes_def wfs_def)\n  \nlemma vws_not_empty: \"wfs \\<sigma> \\<Longrightarrow> vws \\<sigma> t x \\<noteq> {}\"\n  apply (unfold wfs_def vws_def)\n    \n  by (metis (mono_tags) Collect_empty_eq_bot bot_empty_eq empty_iff lastWr_visible wfs_def)\n\n\nlemma getVW_var : \"wfs \\<sigma> \\<Longrightarrow> w = getVW \\<sigma> t x \\<Longrightarrow> var w = x\"\n  apply(simp add: getVW_def obsW_def)\n  by (meson lastWr_visible someI_ex visible_var)\n\n\nlemma getVW_in_vw : \"wfs \\<sigma> \\<Longrightarrow> w = getVW \\<sigma> t x \\<Longrightarrow> w \\<in> visible_writes \\<sigma> t x\"\n  apply(simp add: getVW_def obsW_def)\n  by (meson lastWr_visible someI_ex visible_var)\n\n\nlemma getVWNC_var : \"wfs \\<sigma> \\<Longrightarrow> w = getVWNC \\<sigma> t x \\<Longrightarrow> var w = x\"\n  apply(simp add: getVWNC_def vws_def)\n  by (metis (no_types, lifting) lastWr_visible tfl_some visible_var wfs_def)\n\n\nlemma getVWNC_in_vw : \"wfs \\<sigma> \\<Longrightarrow> w = getVWNC \\<sigma> t x \\<Longrightarrow> w \\<in> visible_writes \\<sigma> t x\"\n  apply(simp add: getVWNC_def vws_def)\n  by (metis (mono_tags) Collect_empty_eq someI_ex vws_def vws_not_empty)\n\nlemma last_biggest_ts: \"wfs \\<sigma> \\<Longrightarrow> w \\<in> writes \\<sigma> \\<Longrightarrow> w = lastWr \\<sigma> (var w) \\<Longrightarrow> w' \\<in> writes_on \\<sigma> (var w) \\<Longrightarrow> w'\\<noteq> w \\<Longrightarrow> tst w' < tst w \"\n  by (metis last_write_max last_write_write_on less_eq_rat_def same_ws)\n\n\n\ndefinition \"after \\<sigma> w \\<equiv> {w'. w' \\<in> writes_on \\<sigma> (var w) \\<and> tst w' > tst w}\"\n\n\nlemma after_nlast_n_empty: \"wfs \\<sigma> \\<Longrightarrow> w \\<in> writes_on \\<sigma> x \n                          \\<Longrightarrow> w \\<noteq> lastWr \\<sigma> x \\<Longrightarrow> after \\<sigma> w \\<noteq> {}\"\n  apply(unfold  after_def)\n  by (metis (no_types, lifting) empty_iff last_write_max last_write_write_on le_neq_trans mem_Collect_eq same_ws writes_on_var)\n\nlemma tst_between_after: \"wfs \\<sigma> \\<Longrightarrow> w \\<in> writes_on \\<sigma> x \n                          \\<Longrightarrow> w \\<noteq> lastWr \\<sigma> x \\<Longrightarrow> tst`(after \\<sigma> w) \\<noteq> {}\"\n  apply(unfold  after_def)\n  by (metis after_def empty_is_image after_nlast_n_empty)\n\n\n\nlemma tst_w_less_min_after:  \"wfs \\<sigma> \\<Longrightarrow> w \\<in> writes_on \\<sigma> x \\<Longrightarrow> after \\<sigma> w \\<noteq> {} \\<Longrightarrow>\n  tst w <  Min (tst`(after \\<sigma> w))\"\n  by(simp add: after_def)\n\nlemma last_write_max2: \"wfs \\<sigma> \\<Longrightarrow> (a, b) \\<in> writes_on \\<sigma> x \\<Longrightarrow> \\<not> tst (lastWr \\<sigma> x) < b\"\n  using last_write_max [where w=\"(a, b)\"] \n  by fastforce\n\nlemma \"wfs \\<sigma> \\<Longrightarrow> w \\<in> writes_on \\<sigma> x \\<Longrightarrow> w = lastWr \\<sigma> x \\<Longrightarrow> after \\<sigma> w = {}\"\n  apply(simp add: after_def)\n  apply(intro allI impI) apply clarsimp\n  using last_write_max2 by blast\n\nlemma tst_between: \"wfs \\<sigma> \\<Longrightarrow> w \\<in> writes_on \\<sigma> x\n                          \\<Longrightarrow> w \\<noteq> lastWr \\<sigma> x \\<Longrightarrow>\n                     \\<exists> ts. tst w < ts \\<and> ts <  (Min(tst` (after \\<sigma> w)))\"\n  by (simp add: dense after_nlast_n_empty tst_w_less_min_after)\n\n\nlemma \"wfs \\<sigma> \\<Longrightarrow> w \\<in> writes_on \\<sigma> x \\<Longrightarrow> w' \\<in> writes_on \\<sigma> x \\<Longrightarrow> w \\<noteq> w' \\<Longrightarrow> tst w \\<noteq> tst w'\"\n  apply(unfold wfs_def)\n  by (meson same_ws)\n\n\nlemma vfs_not_empty: \"wfs \\<sigma> \\<Longrightarrow>  w \\<in> writes_on \\<sigma> x  \\<Longrightarrow> vfs \\<sigma> w \\<noteq> {}\"\n  apply(simp add: vfs_def valid_fresh_ts_def )\n  apply(case_tac \"w = lastWr \\<sigma> x\")\n   apply (simp add: gt_ex last_write_max leD)\nproof -\n  assume a1: \"wfs \\<sigma>\" \n    and a2: \"w \\<in> writes_on \\<sigma> x\" \n    and a3: \"w \\<noteq> lastWr \\<sigma> x\"\n  have c1: \"\\<exists> ts. tst w < ts \\<and> ts <  (Min(tst` (after \\<sigma> w)))\"\n    using tst_between a1 a2 a3 by blast\n  obtain ts where c2: \"tst w < ts \\<and> ts <  (Min(tst` (after \\<sigma> w)))\" \n    using c1 by auto\n  have c3: \"\\<forall> w'. w' \\<in> after \\<sigma> w \\<longrightarrow> (Min(tst` (after \\<sigma> w))) \\<le> tst w'\"\n    using a1 a2 a3\n    by (simp add: after_def)\n  have c4: \"\\<forall> a b. (a, b) \\<in> writes_on \\<sigma> x \\<and> tst w < b \\<longrightarrow> (Min(tst` (after \\<sigma> w))) \\<le> b\"\n    apply safe\n    using a1 a2 a3 c3\n    apply clarsimp\n    by (simp add: after_def)\n  show \"\\<exists>xa>tst w. \\<forall>w'\\<in>writes_on \\<sigma> x. tst w < tst w' \\<longrightarrow> xa < tst w'\"\n    apply (rule_tac x=\"ts\" in exI)\n    apply (intro conjI)\n    apply (simp add: c2) \n    apply clarsimp\n    using c4 c2 \n    using less_le_trans by blast\n   qed\n\n\n\n\n\n\nlemma getTS_in_vfs : \"wfs \\<sigma> \\<Longrightarrow> w = getVWNC \\<sigma> t x   \\<Longrightarrow>  ts' = getTS \\<sigma> w  \\<Longrightarrow> ts'\\<in> vfs \\<sigma> w\"\n  apply(simp add:  getTS_def)\n  apply (simp add: getVWNC_in_vw some_in_eq vfs_not_empty)  \nproof -\nassume a1: \"wfs \\<sigma>\"\n  assume a2: \"w = getVWNC \\<sigma> t x\"\n  then have \"w \\<in> {p \\<in> writes_on \\<sigma> x. tst (thrView \\<sigma> t x) \\<le> tst p}\"\n    using a1 by (metis (no_types) getVWNC_in_vw visible_writes_def)\n  then have \"w \\<in> {p. var p = x \\<and> p \\<in> surrey_state.writes \\<sigma>}\"\n    using writes_on_def by auto\n  then show \"vfs \\<sigma> (getVWNC \\<sigma> t x) \\<noteq> {}\"\n    using a2 a1 by (metis (no_types) vfs_not_empty writes_on_def)\nqed\n\nlemma getTS_valid : \"wfs \\<sigma> \\<Longrightarrow>  getVWNC \\<sigma> t x = w  \\<Longrightarrow>   getTS \\<sigma> w = ts'  \\<Longrightarrow> valid_fresh_ts \\<sigma> w ts'\"\n  using getVWNC_var[where \\<sigma> = \\<sigma> and x = x and t = t and w = w]\n  using getTS_in_vfs[where \\<sigma> = \\<sigma> and t = t and  x = x and w = w]\n  using getVWNC_in_vw[where \\<sigma> = \\<sigma> and x = x and t = t and w = w]\n  apply simp\n  apply(simp add:  getVWNC_def vws_def getTS_def vfs_def)\n  done  \n  \n\n\nlemma \"wfs \\<sigma> \\<Longrightarrow> \\<exists> w . w \\<in> vws \\<sigma> t x\"\nproof -\n  assume \"wfs \\<sigma>\"\n  then have \"\\<exists>p. p \\<in> visible_writes \\<sigma> t x \\<and> write_available \\<sigma> p\"\n    using lastWr_visible wfs_def by blast\n  then show ?thesis\n    by (simp add: vws_def)\nqed\n\n\nlemma \"wfs \\<sigma> \\<Longrightarrow>  getVWNC \\<sigma> t x \\<in> vws \\<sigma> t x\"\n  by (simp add: getVWNC_def some_in_eq vws_not_empty)\n\nlemma \"wfs \\<sigma> \\<Longrightarrow> ts =  Max (tst`(writes_on \\<sigma> x)) \\<Longrightarrow> tst w = ts \\<Longrightarrow> var w = x \\<Longrightarrow> w = lastWr \\<sigma> x\"\n  apply(simp add: lastWr_def)\n  apply(unfold writes_on_def wfs_def)\n  by (metis prod.collapse)\n\nlemma getts_greater_than: \"wfs \\<sigma> \\<Longrightarrow> w = lastWr \\<sigma> x  \\<Longrightarrow> tst w  < getTS \\<sigma> w\"\n  apply(simp add: getTS_def vfs_def valid_fresh_ts_def)\n  using last_write_max [where \\<sigma> = \\<sigma> and w = w and x = x]\n  apply simp\n  by (simp add: gt_ex last_write_max leD someI_ex)\n\n\nlemma getVW_in_writes_on: \"wfs \\<sigma> \\<Longrightarrow>  getVW \\<sigma> t x \\<in> writes_on \\<sigma> x\"\n apply (simp add: getVW_def obsW_def)\n  by (metis (mono_tags, lifting) lastWr_visible mem_Collect_eq verit_sko_ex' visible_writes_def)\n\nlemma getVWNC_in_writes_on: \"wfs \\<sigma> \\<Longrightarrow>  getVWNC \\<sigma> t x \\<in> writes_on \\<sigma> x\"\n apply (simp add: getVWNC_def vws_def)\n  by (metis (mono_tags, lifting) lastWr_visible mem_Collect_eq verit_sko_ex' visible_writes_def wfs_def)\n\nlemma getVWNC_in_visible_writes: \"wfs \\<sigma> \\<Longrightarrow>  getVWNC \\<sigma> t x \\<in> visible_writes \\<sigma> t x\"\n apply (simp add: getVWNC_def vws_def)\n  by (metis (mono_tags, lifting) empty_Collect_eq some_eq_ex vws_def vws_not_empty)\n\nlemma getVWNC_lastWr: \"wfs \\<sigma> \\<Longrightarrow> thrView \\<sigma> t x = lastWr \\<sigma> x \\<Longrightarrow> getVWNC \\<sigma> t x = lastWr \\<sigma> x\"\n  apply (simp add: getVWNC_def vws_def lastWr_def)\n  by (metis (no_types, lifting) lastWr_def lastWr_visible last_sing tfl_some wfs_def)\n\n\n\nlemma lastWr_write_changes2:  \"wfs \\<sigma> \\<Longrightarrow> thrView \\<sigma> t x = lastWr \\<sigma> x \\<Longrightarrow> w = lastWr \\<sigma> x \\<Longrightarrow> ts' = getTS \\<sigma> w \\<Longrightarrow>\n         (x, ts') =  lastWr (write_trans t False w u \\<sigma> ts') x \"\n  apply(subgoal_tac \"ts' > tst w\")\n  defer\n  using getts_greater_than apply blast\n  apply(simp add: lastWr_def)\n  apply(unfold writes_on_def)\n  apply clarsimp\nproof -\n  assume a1: \"wfs \\<sigma>\"\n  assume a2: \"w = (x, Max (tst ` {w. var w = x \\<and> w \\<in> surrey_state.writes \\<sigma>}))\"\n  assume \"ts' = getTS \\<sigma> (x, Max (tst ` {w. var w = x \\<and> w \\<in> surrey_state.writes \\<sigma>}))\"\n  assume a3: \"thrView \\<sigma> t x = (x, Max (tst ` {w. var w = x \\<and> w \\<in> surrey_state.writes \\<sigma>}))\"\n  assume a4: \"\\<forall>b. (x, b) \\<in> surrey_state.writes \\<sigma> \\<longrightarrow> b < getTS \\<sigma> (x, Max (tst ` {w. var w = x \\<and> w \\<in> surrey_state.writes \\<sigma>}))\"\n  have f5: \"\\<And>n na. getVWNC \\<sigma> n na \\<in> {p. var p = na \\<and> p \\<in> surrey_state.writes \\<sigma>}\"\n    using a1 getVWNC_in_writes_on writes_on_def by blast\n  have \"getVWNC \\<sigma> t x = w\"\n    using a3 a2 a1 by (metis getVWNC_in_vw lastWr_def last_sing writes_on_def)\n  then have \"w \\<in> surrey_state.writes \\<sigma>\"\n    using f5 by blast\n  then show \"getTS \\<sigma> (x, Max (tst ` {p. var p = x \\<and> p \\<in> surrey_state.writes \\<sigma>})) = max (getTS \\<sigma> (x, Max (tst ` {p. var p = x \\<and> p \\<in> surrey_state.writes \\<sigma>}))) (Max (tst ` {p. var p = x \\<and> p \\<in> surrey_state.writes \\<sigma>}))\"\n    using a4 a2 by (meson max.strict_order_iff)\nqed\n\nlemma value_last: \"wfs \\<sigma> \\<Longrightarrow> \n        thrView \\<sigma> t x = lastWr \\<sigma> x \\<Longrightarrow>\n        w = lastWr \\<sigma> x \\<Longrightarrow> \n        ts' = getTS \\<sigma> w \\<Longrightarrow>\n        value (write_trans t b w u \\<sigma> ts') (lastWr (write_trans t b w u \\<sigma> ts') x) =  u\"\n  apply(subgoal_tac \"ts' > tst w\")\n  defer\n  using getts_greater_than apply blast\n  apply(subgoal_tac \" lastWr (write_trans t b w u \\<sigma> ts') x = (x, ts')\")\n   defer   \n  apply (metis (full_types) getTS_valid getVWNC_lastWr lastWr_def lastWr_visible lastWr_w)\n  apply(subgoal_tac \"value (write_trans t b w u \\<sigma> ts') (x, ts') = u\")\n   apply simp\n  apply(simp add: value_def)\n  done\n\nlemma var_last: \"wfs \\<sigma> \\<Longrightarrow> w = lastWr \\<sigma> x \\<Longrightarrow> var w = x\"\n  by simp\n\nlemma var_last_write: \"wfs \\<sigma> \\<Longrightarrow>\n w' = getVWNC \\<sigma> t y \\<Longrightarrow> \ngetTS \\<sigma> w' = ts' \\<Longrightarrow> \n w = lastWr (write_trans t b w' v \\<sigma> ts') x\n \\<Longrightarrow> var w = x\"\n    by (simp add: write_trans_def)\n\nlemma getVWNC_wa: \"wfs \\<sigma> \\<Longrightarrow> getVWNC \\<sigma> t x = w \\<Longrightarrow> write_available \\<sigma> w\"\n  apply(simp add: getVWNC_def vws_def)\n  by (metis (no_types, lifting) lastWr_visible tfl_some  wfs_def) \n\nlemma var_last_vws:\"wfs \\<sigma> \\<Longrightarrow>\n                      w = lastWr \\<sigma> x \\<Longrightarrow>\n                      w \\<in> vws \\<sigma> t x\"\n  apply(simp add: vws_def)\n  using lastWr_visible wfs_def by blast\n\nlemma w_n_last_ts_less_tst_last: \"wfs \\<sigma> \\<Longrightarrow> getVWNC \\<sigma> t x = w \\<Longrightarrow>   getTS \\<sigma> w = ts' \\<Longrightarrow> w \\<noteq> lastWr \\<sigma> x \\<Longrightarrow> ts' < tst (lastWr \\<sigma> x)\"\n   by (smt getTS_valid getVWNC_in_writes_on getVWNC_var in_mono lastWr_visible last_biggest_ts last_write_write_on valid_fresh_ts_def var_last visible_writes_in_writes)\n\nlemma ts_not_in_writes_on: \"wfs \\<sigma>  \\<Longrightarrow> getVWNC \\<sigma> t x = w \\<Longrightarrow> getTS \\<sigma> w = ts' \\<Longrightarrow>  ts' \\<notin> (tst ` writes_on \\<sigma> x)\"\n  by (metis (no_types, lifting) antisym_conv2 getTS_valid getVWNC_var image_iff order_refl valid_fresh_ts_def)\n\nlemma w_not_in_writes_on: \"wfs \\<sigma>  \\<Longrightarrow> getVWNC \\<sigma> t x = w \\<Longrightarrow> getTS \\<sigma> w = ts' \\<Longrightarrow> (x, ts') \\<notin>  writes_on \\<sigma> x\"\n  apply(subgoal_tac \"var w = x\")\n  defer  \n  using getVWNC_in_writes_on writes_on_var apply blast\n  apply(unfold writes_on_def)\n  using ts_not_in_writes_on [where \\<sigma> = \\<sigma> and t =t and w = w and ts'=ts' and x=x]\n  apply(unfold writes_on_def)  \n  by (simp add: image_iff)\n\nlemma writes_new_writes: \"wfs \\<sigma>  \\<Longrightarrow> getVWNC \\<sigma> t x = w \\<Longrightarrow> getTS \\<sigma> w = ts' \\<Longrightarrow>  writes_on (write_trans t b w v \\<sigma> ts') x = writes_on \\<sigma> x \\<union> {(x, ts')}\"\n  apply(unfold writes_on_def)\n  apply (simp add: write_trans_def)\n  apply(simp add:  rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n  using  w_not_in_writes_on[where \\<sigma> = \\<sigma> and t =t and w = w and ts'=ts' and x=x]\n  apply(unfold writes_on_def, simp )  \n  apply(subgoal_tac \"(x, ts')\\<notin> {w. var w = x \\<and> w \\<in> surrey_state.writes \\<sigma>}\")\n  apply simp\n  defer\n  apply(unfold writes_on_def insert_def)\n   apply simp\n  apply(subgoal_tac \"var w = x\")\n   apply simp\n   defer\n  using getVWNC_var apply blast\n  apply(subgoal_tac \"(x,ts') \\<in> {w. var w = x \\<and> (w = (x, ts') \\<or> w \\<in> surrey_state.writes \\<sigma>)}\")\n   defer\n   apply safe\n  by(simp)\n\n\n\nlemma writes_new_update: \"wfs \\<sigma>  \\<Longrightarrow> getVWNC \\<sigma> t x = w \\<Longrightarrow> getTS \\<sigma> w = ts' \\<Longrightarrow>  writes_on (update_trans t w u \\<sigma> ts') x = writes_on \\<sigma> x \\<union> {(x, ts')}\"\n  apply(unfold writes_on_def)\n  apply (simp add: update_trans_def)\n  apply(simp add:  Let_def rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n  using  w_not_in_writes_on[where \\<sigma> = \\<sigma> and t =t and w = w and ts'=ts' and x=x]\n  apply(unfold writes_on_def, simp )  \n  apply(subgoal_tac \"(x, ts')\\<notin> {w. var w = x \\<and> w \\<in> surrey_state.writes \\<sigma>}\")\n  apply simp\n  defer\n  apply(unfold writes_on_def insert_def)\n   apply simp\n  apply(subgoal_tac \"var w = x\")\n   apply simp\n   defer\n  using getVWNC_var apply blast\n  apply(subgoal_tac \"(x,ts') \\<in> {w. var w = x \\<and> (w = (x, ts') \\<or> w \\<in> surrey_state.writes \\<sigma>)}\")\n   defer\n   apply safe\n  by(simp)\n\n\nlemma writes_new_update_diff_var: \"wfs \\<sigma>  \\<Longrightarrow> getVWNC \\<sigma> t x = w \\<Longrightarrow> getTS \\<sigma> w = ts' \\<Longrightarrow> x\\<noteq>y \\<Longrightarrow> writes_on (update_trans t w u \\<sigma> ts') y = writes_on \\<sigma> y\"\n  apply(unfold writes_on_def)\n  apply (simp add: update_trans_def)\n  apply(simp add:  Let_def rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n   apply(subgoal_tac \"var w = x\")\n   apply(unfold wfs_def)\n   apply simp\n  apply(subgoal_tac \"var (x, ts') = x\")\n    apply auto[1]\n  apply simp\n  by (meson getVWNC_in_writes_on wfs_def writes_on_var)\n\n\nlemma \"wfs \\<sigma> \\<Longrightarrow> var w \\<noteq> x \\<Longrightarrow> writes_on (write_trans t b w v \\<sigma> ts') x = writes_on \\<sigma> x\"\n  apply(simp add: write_trans_def rev_app_def)\n  apply(simp add: update_mods_def update_wa_def update_modView_def update_thrView_def)\n  apply(unfold writes_on_def, simp)\n  by auto\n\nlemma  \"wfs \\<sigma> \\<Longrightarrow> var w = x \\<Longrightarrow> writes_on (write_trans t b w v \\<sigma> ts') x = writes_on \\<sigma> x \\<union> {(x,ts')}\"\n  apply(simp add: write_trans_def rev_app_def)\n  apply(simp add: update_mods_def update_wa_def update_modView_def update_thrView_def)\n  apply(unfold writes_on_def, simp)\n  by auto\n\n\nlemma  \"wfs \\<sigma> \\<Longrightarrow> var w \\<noteq> x \\<Longrightarrow> writes_on (update_trans t w v \\<sigma> ts') x = writes_on \\<sigma> x\"\n  apply(simp add: update_trans_def rev_app_def)\n  apply(simp add: Let_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  apply(unfold writes_on_def, simp)\n  by auto\n\nlemma  \"wfs \\<sigma> \\<Longrightarrow> var w = x \\<Longrightarrow> writes_on (update_trans t w v \\<sigma> ts') x = writes_on \\<sigma> x \\<union> {(x,ts')}\"\n  apply(simp add: update_trans_def rev_app_def)\n  apply(simp add: Let_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  apply(unfold writes_on_def, simp)\n  by auto\n\n\nlemma getTS_w_greater_tst_w : \"wfs \\<sigma> \\<Longrightarrow> w = getVWNC \\<sigma> t x \\<Longrightarrow> ts' = getTS \\<sigma> w \\<Longrightarrow> ts' > tst w\"\n  using getTS_valid valid_fresh_ts_def by blast\n\nlemma w3_greater_w1: \"wfs \\<sigma> \\<Longrightarrow>\nw1 \\<in> writes_on \\<sigma> x \\<Longrightarrow>\n\\<forall>w2 . w2\\<in> writes_on \\<sigma> x \\<and> w2\\<noteq>w1 \\<longrightarrow> tst w1 < tst w2 \\<Longrightarrow> w3 \\<in> writes_on \\<sigma> x \\<Longrightarrow>\nw1 \\<noteq> w3 \\<Longrightarrow> tst w3>tst w1\"  \n  by blast\n\nlemma getTS_greater_init_ts: \"wfs \\<sigma> \\<Longrightarrow>\n      (x, ts) \\<in> writes_on \\<sigma> x \\<Longrightarrow>\n      (\\<forall>w' . w'\\<in> writes_on \\<sigma> x \\<and> w'\\<noteq>(x, ts) \\<longrightarrow> ts < tst w') \\<Longrightarrow>\n      getVWNC \\<sigma> t x = w \\<Longrightarrow>\n      getTS \\<sigma> w = ts' \\<Longrightarrow>\n      ts' > ts\"\n  apply(case_tac \"w = (x,ts)\")\n  using getTS_w_greater_tst_w [where \\<sigma> = \\<sigma> and x=x and ts'=ts' and w = w and t=t]\n  apply(subgoal_tac \"tst w = ts\")\n    apply blast\n   apply(simp)\n  \n  by (metis \\<open>\\<lbrakk>wfs \\<sigma>; w = getVWNC \\<sigma> t x; ts' = getTS \\<sigma> w\\<rbrakk> \\<Longrightarrow> tst w < ts'\\<close> dual_order.strict_trans getVWNC_in_writes_on)\n\n(***************Lemmas for WFS***********************)\n(*lemma read_pres_wfs  :\n  assumes \"wfs \\<sigma>\"\n  and \"w = getVW \\<sigma> t x\"\n  shows \"wfs (read_trans t b w \\<sigma>)\"\n  using assms\n  apply (unfold wfs_def read_trans_def getVW_def obsW_def)\n  apply(simp add: Let_def rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def syncing_def ts_oride_def)\n  apply(unfold writes_on_def lastWr_def)\n  apply clarsimp\n  apply (intro conjI impI allI)\n  apply (metis surj_pair)\n  apply (metis (full_types) old.prod.exhaust)\n  apply (meson assms(1) in_mono lastWr_visible tfl_some visible_writes_in_writes)\n  apply (metis old.prod.exhaust)\n  apply (metis surj_pair)\n  by (meson assms(1) lastWr_visible subset_iff tfl_some visible_writes_in_writes)\n\n\nlemma write_pres_wfs  :\n  assumes \"wfs \\<sigma>\"\n      and \"getVWNC \\<sigma> t x = w\"\n      and \"getTS \\<sigma> w = ts'\"\n    shows \"wfs (write_trans t b w v \\<sigma> ts')\"\n  using assms\n  apply(unfold wfs_def)\n  apply(intro conjI)\n  apply (simp add: write_trans_def)\n      apply(simp add:  rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n      apply(intro allI conjI impI)\n  apply(unfold writes_on_def, clarsimp)\n       apply simp+\n apply (simp add: write_trans_def)\n      apply(simp add:  rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n    defer\n      apply(intro allI conjI impI)\n   apply (simp add: write_trans_def)\n     apply(simp add:  rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n  using assms(1) own_ModView apply blast\n\n   \n   \n   apply(intro allI conjI impI)\n   apply(case_tac \" write_available \\<sigma> wa\")\n   apply (simp add: write_trans_def)\n    apply(simp add:  rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n   apply (case_tac \"xa \\<noteq> x\")\n    apply simp\n      apply (metis assms(1) getVWNC_var wfs_def write_to_different_var)\n   apply simp\n   apply(case_tac \"wa = (x, ts')\")\n  apply (simp add: write_trans_def)\n    apply(simp add:  rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n    apply (metis assms(1) getVWNC_var)\n  apply(subgoal_tac \"wa = lastWr  \\<sigma> x\")\n  using assms(1) wfs_def apply blast\n   apply(simp add: lastWr_def)\n  apply(case_tac \"w = lastWr \\<sigma> x\")\n    apply (simp add: assms(1))\n  using assms(1) w_n_last_ts_less_tst_last [where x=x and \\<sigma> = \\<sigma> and t = t and w = w and ts'=ts']\n   apply(simp add: lastWr_def)\n   apply(subgoal_tac \" tst ` writes_on (write_trans t b w v \\<sigma> ts') x = tst ` writes_on \\<sigma> x \\<union> {ts'} \")\n    apply auto[1]\n  using writes_new_writes[where x=x and \\<sigma> = \\<sigma> and t = t and w = w and ts'=ts']\n   apply(simp)\n  apply(intro allI)\n  using assms(1) writes_new_writes[where x=x and \\<sigma> = \\<sigma> and t = t and w = w and ts'=ts' and b=b and v=v]\n  apply(unfold writes_on_def)\n  apply (simp add: write_trans_def)\n  apply(simp add:  rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n  apply(subgoal_tac \"var w = x\")\n   apply simp\n  apply(subgoal_tac \"finite({w. var w = x \\<and> w \\<in> surrey_state.writes \\<sigma>})\")\n  defer\n      apply blast\n  using getVWNC_var apply blast\n  apply(subgoal_tac \"finite( insert (x, ts') {w. var w = x \\<and> w \\<in> surrey_state.writes \\<sigma>})\")\n  defer  \n   apply blast\n  apply(case_tac \"xa = x\")\n   apply simp\n  apply(case_tac \"{w. var w = xa \\<and> (w = (x, ts') \\<or> w \\<in> surrey_state.writes \\<sigma>)} = {(x,ts')}\")\n   apply simp\n  apply (case_tac \"{w. var w = xa \\<and> (w = (x, ts') \\<or> w \\<in> surrey_state.writes \\<sigma>)} = {w. var w = xa \\<and>  w \\<in> surrey_state.writes \\<sigma>}\")\n   apply simp\n  by auto\n\n\nlemma update_pres_wfs  :\n  assumes \"wfs \\<sigma>\"\n      and \"getVWNC \\<sigma> t x = w\"\n      and \"getTS \\<sigma> w = ts'\"\n    shows \"wfs (update_trans t w u \\<sigma> ts')\"\n  using assms\n  apply(unfold wfs_def)\n  apply(intro conjI)\n      defer\n      apply(intro allI)\n      apply(case_tac \"var w \\<noteq> var wa\")\n       apply simp\n       apply(case_tac \"var wa \\<noteq> xa\")\n  apply (metis Un_empty_right Un_insert_right assms(1) insertCI wfs_def writes_new_update writes_new_update_diff_var)\n  apply(subgoal_tac \"writes_on (update_trans t w u \\<sigma> ts') xa = writes_on \\<sigma> xa\")\n        apply auto[1]\n  using assms(1)  writes_new_update_diff_var\n       apply simp\n  apply simp\n      apply(case_tac \"ts' = tst wa\")\n       apply(case_tac \"releasing \\<sigma> w\")\n        apply simp\n  apply(simp add: ts_oride_def)\n  using assms(1) apply auto[1]\n       apply simp\n  apply simp\n  apply (metis UnCI assms(1) wfs_def writes_new_update writes_new_update_diff_var)\n     apply(intro allI)\n  using assms(1) writes_new_update\n  apply (metis finite.emptyI finite.insertI finite_UnI writes_new_update_diff_var)\n    apply(intro allI impI)\n      apply(case_tac \"var w \\<noteq> var wa\")\n        apply simp\n     apply (elim disjE)\n  apply clarsimp\n   using assms(1) own_ModView apply blast\n    apply simp\n    apply (elim disjE)\n       apply(subgoal_tac \"ts' = tst wa\")\n    apply(case_tac \"releasing \\<sigma> w\")\n  apply simp\n       apply (metis (mono_tags, lifting) assms(1) fun_upd_same getTS_valid getVWNC_in_vw leD own_ModView subset_Compl_singleton subset_trans ts_oride_def valid_fresh_ts_def visible_writes_in_writes)\n      apply simp\n  apply(simp add: sndI)\n  using assms(1)\n  apply simp\n       apply(case_tac \"ts' = tst wa\")\n     apply (metis getVWNC_var imageI ts_not_in_writes_on wfs_def)\n    apply (simp add: own_ModView)\napply(intro allI impI)\n   apply(case_tac \"var w \\<noteq> var wa\")\n  using assms(1)\n  apply simp\n  apply (simp add: lastWr_def)\n  apply simp\n  using assms(1)\n  apply(case_tac \"xa \\<noteq> x\")\n  using getVWNC_var apply blast\n   apply simp\n  using assms(1)\n  apply simp\n   apply(subgoal_tac \"tst w \\<noteq> ts'\")\n    apply (case_tac \"tst wa = ts'\")\n     apply simp\n    apply(simp add: lastWr_def)\n  apply(case_tac \"w = lastWr \\<sigma> x\")\n  apply (metis getts_greater_than lastWr_def last_write_max2 last_write_write_on max.strict_coboundedI1 max_def_raw)\n    apply(subgoal_tac \"tst wa \\<noteq> tst w\")\n  apply simp\n     apply (metis max_def_raw)\n  apply (metis getVWNC_in_writes_on lastWr_def last_write_write_on max_def_raw same_ws)\n   apply (metis assms(1) assms(2) assms(3) dual_order.irrefl getTS_valid valid_fresh_ts_def)\n  apply(intro allI)\n  apply(case_tac \"releasing \\<sigma> w\")\n   apply simp\n   apply(case_tac \"t = ta\")\n  apply simp\n  apply (simp add: getVWNC_var ts_oride_def  writes_new_update writes_new_update_diff_var)\n    apply (simp add: assms(1))\n   apply simp\n  apply (metis Un_iff assms(1) writes_new_update writes_new_update_diff_var)\n  apply simp\n   apply(case_tac \"t = ta\")\n  apply simp+\n  by (metis Un_iff assms(1) writes_new_update writes_new_update_diff_var)\n \n\n\n(*********** Lemmas for d_obs *************)\n\nlemma d_obs_getVW: \" wfs \\<sigma> \\<Longrightarrow> [x =\\<^sub>t u] \\<sigma> \\<Longrightarrow>\n   w =  getVW \\<sigma> t x \\<Longrightarrow>\n  getVW (read_trans t False w \\<sigma>) t x =  getVW \\<sigma> t x\"\n  apply (simp add: getVW_def obsW_def visible_writes_def d_obs_t_def  d_obs_def)\n  apply(intro impI)\n  by (metis (full_types, lifting) dual_order.antisym last_write_max last_write_write_on tfl_some)\n\n \nlemma read_pres_d_obs  :\n  assumes \"wfs \\<sigma>\"\n    and \"[x =\\<^sub>t u] \\<sigma>\"\n    and \"w = getVW \\<sigma> t y\"\n  shows \"[x =\\<^sub>t u] (read_trans t b w \\<sigma>)\"\n  using assms \n  apply (simp add:  d_obs_t_def  d_obs_def)\n  apply (intro conjI)\n   apply(simp add: lastWr_def)\n   apply (elim conjE)\n   apply(simp add: read_trans_def rev_app_def Let_def update_thrView_def value_def) \n   apply(case_tac \"syncing \\<sigma> (getVW \\<sigma> t y) b\")\n    apply simp\n  using getVW_in_vw [where \\<sigma> = \\<sigma> and t=t and w =w and x = y]\n    getVW_var [where \\<sigma> = \\<sigma> and t=t and w =w and x = y]\n    apply(unfold wfs_def)\n    apply clarsimp\n  apply(intro conjI impI)\n  apply (metis \\<open>\\<lbrakk>wfs \\<sigma>; w = getVW \\<sigma> t y\\<rbrakk> \\<Longrightarrow> var w = y\\<close> assms(1) assms(2) d_obs_lastWr_visible lastWr_def ts_oride_same_var)\n  using assms(1,2)\n  apply(simp add: d_obs_def d_obs_t_def lastWr_def)\n    apply (unfold  antisym fun_upd_other lastWr_def modView_lte_last same_ws ts_oride_def wfs_def)\n    apply (metis antisym assms(1) lastWr_def modView_lte_last same_ws)\n  using assms(1) assms(2)\n  apply(simp add: d_obs_t_def d_obs_def lastWr_def)\n  apply (metis assms(2) d_obs_lastWr_visible lastWr_def)\n   apply(simp add: read_trans_def rev_app_def Let_def update_thrView_def value_def) \n  apply(intro conjI impI)\n   apply(unfold writes_on_def)\n  apply clarsimp+  \n    done\n\n\nlemma read_pres_d_obs_other_var  :\n  assumes \"wfs \\<sigma>\"\n    and \"[x =\\<^sub>t u] \\<sigma>\"\n    and \"w = getVW \\<sigma> t' y\"\n    and \"t \\<noteq> t'\"\n  shows \"[x =\\<^sub>t u] (read_trans t' b w \\<sigma>)\"\n  using assms\n   apply(simp add:  getVW_def obsW_def)\n  apply(subgoal_tac \"var w = y\")\n  defer\n   apply (metis (mono_tags) Nitpick.Eps_psimp assms(1) lastWr_visible visible_var)\n  apply(simp add: d_obs_t_def d_obs_def)\n  apply(intro conjI)\n    apply (simp add: lastWr_read_pres)\n  apply(elim conjE)\n  apply(simp add: value_def)\n      by (simp add: lastWr_read_pres)\n\n\nlemma ext_d_obs_d_obs  :\n  assumes \"wfs \\<sigma>\"\n      and \"[x =\\<^sub>t v] \\<sigma>\"\n      and \"getVWNC \\<sigma> t x = w\"\n      and \" ts' = getTS \\<sigma> w\"\n    shows\"[x =\\<^sub>t u] (write_trans t False w u \\<sigma> ts')\"\n  using assms\n  apply(simp add: d_obs_t_def d_obs_def)\n  apply (intro conjI)\n   apply (intro impI conjI, elim conjE)   \n  apply clarsimp\n  apply(simp add: getVWNC_def vws_def)\n    defer\n    defer\n  apply(simp add: getVWNC_def vws_def)\n  apply (metis (mono_tags) assms(1)  mem_Collect_eq some_in_eq tfl_some visible_var  vws_def vws_not_empty)\n   apply(subgoal_tac \"w = lastWr \\<sigma> x\")\n    defer\n  using assms(3) getVWNC_lastWr apply fastforce\n   apply(elim conjE)\n   defer\n  using lastWr_write_changes2 apply blast\n  by (simp add: getVWNC_lastWr value_last)\n  \n\nlemma ext_upd_d_obs_d_obs  :\n  assumes \"wfs \\<sigma>\"\n      and \"[x =\\<^sub>t v] \\<sigma>\"\n      and \"getVWNC \\<sigma> t x = w\"\n      and \"getTS \\<sigma> w = ts'\"\n    shows\"[x =\\<^sub>t u] (update_trans t w u \\<sigma> ts')\"\n  using assms\n  apply(simp add: d_obs_t_def d_obs_def)\n  apply(elim conjE, intro conjI)\n   apply(case_tac \"releasing \\<sigma> w\")\n    apply simp\n  apply (smt dual_order.strict_trans2 fun_upd_same getTS_valid getVWNC_in_visible_writes getVWNC_lastWr getVWNC_var getts_greater_than in_mono lastWr_def lastWr_upd last_write_max2 last_write_write_on own_ModView ts_oride_def update_pres_wfs visible_writes_in_writes)\n    apply simp\n   apply (metis getTS_valid getVWNC_in_vw getVWNC_lastWr getVWNC_var lastWr_def lastWr_upd)\n  apply(simp add: value_def)\n  apply(subgoal_tac \"var (lastWr (update_trans t w u \\<sigma> ts') x) = x\")\n  apply(case_tac \"tst (lastWr (update_trans t w u \\<sigma> ts') x) \\<noteq> ts'\")\n  using assms (1,2)\n    apply(simp add: lastWr_def)  \n  apply (metis getTS_valid getVWNC_in_vw getVWNC_lastWr lastWr_def lastWr_upd prod.inject)\n   apply simp\n   apply(simp add: lastWr_def)  \n   apply(subgoal_tac \"var w = x\")\n  apply simp\n  using getVWNC_var apply blast\n  by simp\n  \n\n\nlemma d_obs_read_value:\n  assumes \"wfs \\<sigma>\"\n    and \"[x =\\<^sub>t u] \\<sigma>\"\n  shows \"value \\<sigma> ((getVW (read_trans t False (getVW \\<sigma> t x) \\<sigma>) t x)) = u\"\n  by (metis Collect_mem_eq assms(1) assms(2) d_obs_getVW d_obs_implies_p_obs d_obs_lastWr_visible getVW_def obsW_def p_obs_def tfl_some)\n  \nlemma d_obs_diff_false  :\n  assumes  \"wfs \\<sigma>\"\nand \" [x =\\<^sub>t u] \\<sigma>\"\nand \"[x =\\<^sub>t' v] \\<sigma>\"\nand \"u \\<noteq> v\"\nshows \"False\"\n  using assms\n  by (simp add: d_obs_def d_obs_t_def)  \n\n\nlemma ext_write_other_pres_d_obs  :\n  assumes \"wfs \\<sigma>\"\n      and \"[x =\\<^sub>t u] \\<sigma>\"\n      and \"getVWNC \\<sigma> t' y = w\"\n      and \" getTS \\<sigma> w = ts'\"\n      and \"y \\<noteq> x\"\n    shows\"[x =\\<^sub>t u] (write_trans t' b w v \\<sigma> ts')\"\n  using assms\n  apply(simp add: d_obs_t_def d_obs_def)\n  apply(intro conjI)\n   apply(subgoal_tac \"var w = y\")\n    apply simp\n  using assms(1,2)\n    apply(case_tac \"t = t'\")\n     apply simp\n  apply simp\n    using getVWNC_var apply blast\n    apply (simp add: value_def)\n      apply(subgoal_tac \"var w = y\")\n     apply simp\n    using getVWNC_var by blast\n  \n\n\nlemma d_obs_value:\n  assumes \"wfs \\<sigma>\"\nand  \"[x =\\<^sub>t u] \\<sigma>\"\n  and \"w = getVW \\<sigma> t x\"\n  shows \"value \\<sigma> w = u\"\n  using assms\n  using d_obs_getVW d_obs_read_value by auto \n\n\nlemma update_diff_var_pres_dobs_ext  :\n  assumes  \"wfs \\<sigma>\"\n  and \"[x =\\<^sub>t u] \\<sigma>\"\n  and \"getVWNC \\<sigma> t' y = w\"\n  and \" getTS \\<sigma> w = ts'\"\n  and \"y \\<noteq> x\"\nshows \"[x =\\<^sub>t u] (update_trans t' w v \\<sigma> ts')\"\n  using assms\n  apply(simp add: d_obs_t_def)\n  apply(simp add: d_obs_def)\n  apply(elim conjE, intro conjI)\n   apply(subgoal_tac \"var w = y\")\n    apply(case_tac \"t = t'\")\n      apply(case_tac \"releasing \\<sigma> w\")\n      apply simp\n  apply(simp add: ts_oride_def)\n      apply (metis dual_order.antisym lastWr_def modView_lte_last same_ws wfs_def writes_new_update_diff_var)\n     apply simp\n     apply (simp add: lastWr_def)\n    apply simp\n    apply (simp add: lastWr_def) \n  using getVWNC_var apply blast\n  apply (simp add: value_def)\n   apply(subgoal_tac \"var w = y\")\n   apply simp\n   apply (simp add: lastWr_def)\n  using getVWNC_var by blast\n\nlemma ext_cvd_update_d_obs  :\n  assumes \"wfs \\<sigma>\"\n      and \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> \\<sigma>\"\n      and \"getVWNC \\<sigma> t x = w\"\n      and \"getTS \\<sigma> w = ts'\"\n      and \"cvd[x, u] \\<sigma>\"\n      and \"x \\<noteq> y\"\n    shows \"[y =\\<^sub>t v] (update_trans t w m \\<sigma> ts')\"\n  using assms(2)\n  apply(simp add: c_obs_def d_obs_t_def d_obs_def)\n  apply(subgoal_tac \"var w = x\") defer \n  using assms(1) assms(3) getVWNC_var apply blast\n  apply(subgoal_tac \"value \\<sigma> w = u\") defer \n  apply (metis assms(1) assms(3) assms(5) covered_v_def getVWNC_in_writes_on getVWNC_wa)\n  apply(intro conjI)\n   apply(case_tac \"releasing \\<sigma> w\")\n    apply simp  \n    apply(simp add: ts_oride_def)\n  apply(intro conjI)  \n  using assms(6) apply blast\n    apply(intro impI conjI)\n  apply(simp add: lastWr_def)    \n     apply (metis assms(1) assms(3) getVWNC_in_visible_writes)\n  apply(simp add: lastWr_def)  \n    apply (metis assms(1) assms(3) getVWNC_in_visible_writes lastWr_def last_write_max wfs_def)\n   apply simp\n  apply(intro conjI impI)  \n  using assms(6) apply blast  \n   apply (metis assms(1) assms(3) getVWNC_in_visible_writes)\n  apply(simp add: value_def)\n  using assms(6)\n  apply(case_tac \"releasing \\<sigma> w\")\n  apply simp  \n   apply (metis assms(1) assms(3) assms(4) getVWNC_in_visible_writes lastWr_def writes_new_update_diff_var)\n  apply simp  \n  by (metis assms(1) assms(3) getVWNC_in_visible_writes)\n\nlemma ext_cvd_up_dobs  : \n  assumes  \"cvd[x, u] \\<sigma>\"\n    and \"wfs \\<sigma>\"\n      and \" getVWNC \\<sigma> t x = w\"\n      and \"getTS \\<sigma> w = ts'\"\n    shows \"[x =\\<^sub>t v] (update_trans t w v \\<sigma> ts')\"\n  using assms\n  apply(simp add: covered_v_def d_obs_t_def)\n  apply(simp add:  d_obs_def)\n  apply(subgoal_tac \"var w = x\")\n  apply(intro conjI)\n    apply(case_tac \"releasing \\<sigma> w\")\n     apply simp\n     apply(simp add: ts_oride_def)\n  apply(intro conjI)\n      apply (metis assms(1) covered_v_def getVWNC_in_writes_on getVWNC_wa getts_greater_than leD less_le_trans modView_lte_last) \n  apply (metis (no_types, lifting) assms(1) covered_v_def getTS_valid getVWNC_in_visible_writes getVWNC_in_writes_on getVWNC_wa lastWr_def lastWr_upd)\n    apply simp  \n    apply (metis (no_types, lifting) assms(1) covered_v_def getTS_valid getVWNC_in_visible_writes getVWNC_in_writes_on getVWNC_wa lastWr_def lastWr_upd)\n  apply(simp add: value_def)\n  apply(case_tac \"tst (lastWr (update_trans t w v \\<sigma> ts') x) = ts'\")\n    apply simp\n   apply simp\n  apply(simp add: lastWr_def)  \n   apply (metis assms(1) covered_v_def getTS_valid getVWNC_in_writes_on getVWNC_wa lastWr_def last_write_max2 less_max_iff_disj max_def valid_fresh_ts_def)\n   using getVWNC_var by blast\n  \n\n\nlemma ext_d_obs_rd_pres2  :\n  assumes \"wfs \\<sigma>\"\n      and \"[x =\\<^sub>t u] \\<sigma>\"\n      and \" getVW \\<sigma> t' y = w\"\n      and \"t \\<noteq> t'\"\n      and \"\\<sigma>' = (read_trans t' b w \\<sigma>)\"\n    shows \"[x =\\<^sub>t u] \\<sigma>'\"\n  using assms\n  apply(simp add: getVW_def obsW_def)\n  apply (unfold d_obs_t_def d_obs_def visible_writes_def writes_on_def lastWr_def)\n  apply(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n  apply (case_tac \"syncing \\<sigma> w b\")\n  apply simp_all\n   apply (simp add: value_def)\n  apply (simp add: value_def)\ndone\n\n\nlemma ext_d_obs_rd_pres  :\n  assumes \"wfs \\<sigma>\"\nand \"[x =\\<^sub>t u] \\<sigma>\"\nand \" getVW \\<sigma> t' y = w\"\n      and \"\\<sigma>' = (read_trans t' b w \\<sigma>)\"\nshows \"[x =\\<^sub>t u] \\<sigma>'\"\n  using assms\n  apply (unfold wfs_def d_obs_t_def d_obs_def visible_writes_def writes_on_def lastWr_def)\n  apply(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n  apply (case_tac \"syncing \\<sigma> w b\", simp_all)\n  apply(elim conjE)\n   apply(intro conjI impI)\n  apply(simp add: ts_oride_def)\n        apply(intro conjI impI)\n         apply (metis (no_types, lifting) assms(1) assms(2) d_obs_def d_obs_lastWr_visible d_obs_t_def getVW_in_vw getVW_var)\n        apply (metis assms(1) assms(2) d_obs_def d_obs_lastWr_visible d_obs_t_def getVW_in_vw getVW_var)\n        apply (metis (no_types, lifting) Collect_cong surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(2) value_def)\n      apply (metis (no_types, lifting) Collect_cong surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(2) value_def)\n  using  assms(1) assms(2) \n     apply(unfold d_obs_def d_obs_t_def lastWr_def ts_oride_def)\n     apply clarsimp\n     apply (metis (no_types, lifting) dual_order.antisym lastWr_def modView_lte_last same_ws wfs_def)\n  apply(simp_all add: value_def)\n  by (metis  assms(2) d_obs_lastWr_visible getVW_in_vw getVW_var lastWr_def)\n  \n\n\nlemma ext_d_obs_rd_pres3  :\n  assumes \"wfs \\<sigma>\"\nand \"[x =\\<^sub>t u] \\<sigma>\"\nand \" getVW \\<sigma> t' y = w\"\n      and \"\\<sigma>' = (read_trans t' b w \\<sigma>)\"\nshows \"[x =\\<^sub>t u] \\<sigma>'\"\n  using assms\n  using getVW_var [where \\<sigma> = \\<sigma> and t = t' and w = w and x = y]\n  using getVW_in_vw [where \\<sigma> = \\<sigma> and t = t' and w = w and x = y]\n    apply (unfold wfs_def d_obs_t_def d_obs_def visible_writes_def writes_on_def lastWr_def)\n  apply(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n  apply (case_tac \"syncing \\<sigma> w b\", simp_all)\n  apply(elim conjE)\n   apply(intro conjI impI)\n  apply(simp add: ts_oride_def)\n        apply(intro conjI impI)\n  apply (metis (no_types, lifting) \\<open>\\<lbrakk>wfs \\<sigma>; w = getVW \\<sigma> t' y\\<rbrakk> \\<Longrightarrow> w \\<in> visible_writes \\<sigma> t' y\\<close> assms(1) assms(2) d_obs_def d_obs_lastWr_visible d_obs_t_def)\n        apply (metis assms(1) order_refl own_ModView)\n  apply(simp_all add: value_def)\n     apply(simp add: ts_oride_def)\n     apply(intro impI)\n  using assms(1,2)\n  apply(unfold d_obs_def d_obs_t_def lastWr_def wfs_def)\n  apply (metis (mono_tags, lifting) Max_ge Pair_inject antisym assms(1) finite_imageI image_eqI lastWr_def modView_lte_last same_ws)\n      apply(simp add: value_def)\n        apply(intro conjI impI)\n  apply (metis  \\<open>\\<lbrakk>wfs \\<sigma>; w = getVW \\<sigma> t' y\\<rbrakk> \\<Longrightarrow> w \\<in> visible_writes \\<sigma> t' y\\<close> assms(1) assms(2) d_obs_lastWr_visible lastWr_def)\n  by(simp_all add: value_def)\n\n\n\n\n(****************Lemmas for p_obs ******************)\nlemma not_p_obs_other_pres_not_p_obs  :\n  assumes \"wfs \\<sigma>\"\n      and \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\n      and \"w = getVWNC \\<sigma> t' y\"\n      and \"ts' = getTS \\<sigma> w\"\n      and \"y \\<noteq> x\"\n    shows \"\\<not>[x \\<approx>\\<^sub>t u] (write_trans t' b w v \\<sigma> ts')\"\n  using assms\n  apply simp\n  apply(unfold  write_trans_def rev_app_def update_wa_def update_thrView_def update_modView_def update_mods_def)\n  apply simp\n  apply (unfold p_obs_def)\n  apply safe\n  apply(simp add: value_def)\n  apply(subgoal_tac \"var (getVWNC \\<sigma> t' y) = y\")\n   defer\n  using getVWNC_var apply blast\n  apply clarsimp\n  apply(subgoal_tac \"a = x\")\n  defer\n   apply(simp add: visible_writes_def)\n   apply(unfold writes_on_def)\n   apply clarsimp\n  apply clarsimp\n   apply(simp add: visible_writes_def)\n   apply(unfold writes_on_def)\n   apply clarsimp\n  by (metis (full_types) fun_upd_apply)\n\nlemma w_in_writes_on_var: \"(a,b) \\<in> writes_on \\<sigma> x \\<Longrightarrow> a = x\"\n  apply(unfold writes_on_def)\n  by simp\n\nlemma not_p_obs_read  :\n  assumes \"wfs \\<sigma>\"\n    and \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\n    and \"getVW \\<sigma> t y = w\"\n  shows \"\\<not>[x \\<approx>\\<^sub>t u] (read_trans t b w \\<sigma>)\"\n  using assms\n  apply(unfold p_obs_def)\n  apply(simp add: value_def)\n  apply(subgoal_tac \"var w = y\")\n   defer\n  using getVW_var apply blast\n  apply(intro allI impI)\n  apply(subgoal_tac \"a = x\")\n   defer\n  apply (metis order.not_eq_order_implies_strict psubsetD read_pres_wfs visible_var visible_writes_in_writes w_in_writes_on_var wfs_def)\n  apply simp\n  apply(subgoal_tac \"(x, ba) \\<in> writes_on \\<sigma> x\")\n   defer\n  apply(simp add: visible_writes_def)\n  apply(simp add: visible_writes_def)\n  apply(case_tac \"\\<not>syncing \\<sigma> w b\")\n   apply simp\n   apply(case_tac \"x = y\", simp)\n    defer \n    apply simp\n   apply simp\n   apply(case_tac \"x = y\", simp)\n    apply(simp add:ts_oride_def)\n    apply(case_tac \"tst w \\<le> tst (modView \\<sigma> w y)\", simp)\n     defer\n     apply (metis eq_iff getVW_in_vw own_ModView subsetD visible_writes_in_writes)\n    apply (smt dual_order.trans fun_upd_other ts_oride_def)\n  apply(simp add: getVW_def obsW_def)\n  apply (smt assms(3) dual_order.trans getVW_in_vw mem_Collect_eq visible_writes_def)\n  apply(simp add: getVW_def obsW_def) \nproof -\nfix a :: nat and ba :: rat\n  assume a1: \"tst (modView \\<sigma> w y) \\<le> ba\"\n  assume a2: \"tst w \\<le> tst (modView \\<sigma> w y)\"\n  assume a3: \"\\<forall>a b. (a, b) \\<in> writes_on \\<sigma> y \\<and> tst (thrView \\<sigma> t y) \\<le> b \\<longrightarrow> u \\<noteq> val (mods \\<sigma> (a, b))\"\n  assume a4: \"(y, ba) \\<in> writes_on \\<sigma> y\"\n  assume a5: \"(SOME e. e \\<in> visible_writes \\<sigma> t y) = w\"\n  assume a6: \"wfs \\<sigma>\"\n  have f7: \"\\<forall>r. r \\<le> ba \\<or> \\<not> r \\<le> tst w\"\nusing a2 a1 by (metis dual_order.trans)\nhave \"w \\<in> visible_writes \\<sigma> t y\"\n  using a6 a5 by (meson lastWr_visible tfl_some)\n  then have \"tst (thrView \\<sigma> t y) \\<le> ba\"\nusing f7 visible_writes_def by fastforce\n  then show \"u \\<noteq> val (mods \\<sigma> (y, ba))\"\n    using a4 a3 by metis\nqed\n\n\nlemma d_obs_not_p_obs:\n  assumes \"wfs \\<sigma>\"\nand \"[x =\\<^sub>t z] \\<sigma>\"\n  and \"z \\<noteq> u\"\nshows \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\n  using assms\n  using d_obs_p_obs_agree by blast\n  \n\nlemma cvd_p_obs: \"wfs \\<sigma> \\<Longrightarrow> cvd[x,u] \\<sigma> \\<Longrightarrow> [x \\<approx>\\<^sub>t u] \\<sigma>\"\n  by (metis covered_v_def lastWr_visible last_write_write_on p_obs_def wfs_def)\n\nlemma not_p_obs_value  :\n  assumes \"wfs \\<sigma>\"\nand \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\nand \"w = getVW \\<sigma> t x\"\nshows \"value \\<sigma> w \\<noteq> u\"\n  using assms\n  using getVW_in_vw p_obs_def by blast\n\nlemma ext_p_obs_contradiction  :\n  assumes \"wfs \\<sigma>\"\nand \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\n  and \" getVW \\<sigma> t' y = w\"\nand \"x \\<noteq> y\"\nand \"[x \\<approx>\\<^sub>t u] (read_trans t' b w \\<sigma>)\"\nshows \"False\"\n  using assms\n  apply(unfold read_trans_def)\n  apply(unfold rev_app_def Let_def update_thrView_def)\n  apply(unfold  p_obs_def)\n  apply(case_tac \"syncing \\<sigma> w b\")\n   apply(simp add: value_def visible_writes_def)\n   apply(unfold writes_on_def)\n  apply clarsimp\n   apply (smt assms(2) assms(5) not_p_obs_read)\n   apply(simp add: value_def visible_writes_def)\n  by (smt assms(2) assms(5) mem_Collect_eq not_p_obs_read surrey_state.select_convs(1) surrey_state.surjective surrey_state.update_convs(2) writes_on_def)\n  \n\nlemma ext_p_obs_rd_pres  :\n  assumes \"wfs \\<sigma>\"\nand \"[x \\<approx>\\<^sub>t u] \\<sigma>\"\nand \" getVW \\<sigma> t' y = w\"\nand \"t \\<noteq> t'\"\nshows \"[x \\<approx>\\<^sub>t u] (read_trans t' b w \\<sigma>)\"\n  using assms\n  apply(unfold p_obs_def read_trans_def)\n  apply(unfold rev_app_def Let_def update_thrView_def)\n  apply(simp add: value_def)\n  apply(case_tac \"syncing \\<sigma> w b\")\n   apply simp\n   apply(unfold visible_writes_def writes_on_def, simp)\n  by simp\n\n\nlemma p_obs_contradiction  :\n  assumes \"wfs \\<sigma>\"\n  and \"\\<not> [x \\<approx>\\<^sub>t v] \\<sigma>\"\n  and \" getVW \\<sigma> t' y = w\"\n  and  \"[x \\<approx>\\<^sub>t v] (read_trans t' b w \\<sigma>)\"\nshows \"False\"\n  using assms\n  apply(unfold p_obs_def read_trans_def)\n  apply(unfold rev_app_def Let_def update_thrView_def)\n  apply(simp add: value_def)\n  apply(case_tac \"syncing \\<sigma> w b\", clarsimp)\n    apply(unfold visible_writes_def writes_on_def, simp)\n    apply (smt assms(2) assms(4) not_p_obs_read)\n  apply clarsimp\n  by (smt assms(2) assms(4) not_p_obs_read)\n\n\n(****************Lemmas for c_obs ******************)\n\nlemma not_p_obs_write_pres_c_obs_diff_var  :\n  assumes \"wfs \\<sigma>\"\n  and \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\n  and \"getVWNC \\<sigma> t' y = w\"\n  and \"getTS \\<sigma> w = ts'\"\n  and \"t \\<noteq> t'\"\n  and \"x \\<noteq> y\"\n  shows \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> (write_trans t' b  w z \\<sigma> ts')\"\n  using assms(2)\n by (metis assms(1) assms(3) assms(4) assms(6) not_p_obs_implies_c_obs not_p_obs_other_pres_not_p_obs)\n\n  \n\nlemma ext_c_obs_intro  :\n  assumes \"wfs \\<sigma>\"\n  and \"[y =\\<^sub>t v] \\<sigma>\"\n  and \"\\<not>[x \\<approx>\\<^sub>t' u] \\<sigma>\"\n  and \"getVWNC \\<sigma> t x = w\"\n  and \"getTS \\<sigma> w = ts'\"\n  and \"x \\<noteq> y\"\n  and \"t \\<noteq> t'\"\nshows \"[x = u]\\<lparr>y =\\<^sub>t' v\\<rparr> (write_trans t True w u \\<sigma> ts')\"\n  using assms (2,3)\n  apply (simp add: d_obs_t_def p_obs_def d_obs_def c_obs_def)\n  apply(simp add: visible_writes_def)\n  apply(intro allI impI conjI)\n  using assms (4,5,6,7)\n    apply simp\n    apply(subgoal_tac \"var w = x\")\n     apply simp\n     apply(elim conjE)\n     apply(subgoal_tac \"a = x\")\n      apply simp\n      apply(elim disjE)\n  apply simp \n       apply (simp add: assms(1))\n      apply(case_tac \"b = ts'\")\n       apply simp\n  using assms(1) w_not_in_writes_on apply blast\n      apply simp\n  apply(simp add: lastWr_def value_def)\n      apply blast\n  using w_in_writes_on_var apply blast\n  using assms(1) getVWNC_in_writes_on writes_on_var apply blast \n   apply (metis assms(1) assms(4) assms(5) assms(6) d_obs_def d_obs_t_def ext_write_other_pres_d_obs w_in_writes_on_var)\n  apply(simp add: value_def)\n  apply(elim conjE)\n     apply(subgoal_tac \"a = x\")\n  apply simp\n  apply(subgoal_tac \"var w = x\")\n  apply simp\n    apply(elim disjE)\n  apply (simp add: releasing_def)\n    apply(simp add: write_trans_def update_wa_def update_mods_def update_modView_def update_thrView_def rev_app_def releasing_def)\n  using assms(7) apply fastforce  \n  using assms(1) assms(4) getVWNC_var apply blast\n  using w_in_writes_on_var by blast\n  \n\n\n\nlemma c_obs_read_pres  :\n  assumes \"wfs \\<sigma>\"\n  and \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> \\<sigma>\"\n  and \"getVW \\<sigma> t x = w\"\nshows \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> (read_trans t b w \\<sigma>)\"\n  using assms\n  apply(unfold c_obs_def d_obs_def visible_writes_def read_trans_def)\n    apply(unfold rev_app_def Let_def update_thrView_def)\n  apply (simp add: value_def lastWr_def)\n  apply(intro conjI impI allI)\n             apply(unfold writes_on_def)\n  apply clarsimp\n             apply (smt dual_order.trans getVW_in_vw mem_Collect_eq ts_oride_same_var visible_writes_def)\n            apply(simp add: visible_writes_def)\n  apply (smt Collect_cong dual_order.trans getVW_in_vw mem_Collect_eq surrey_state.ext_inject surrey_state.surjective surrey_state.update_convs(2) ts_oride_same_var visible_writes_def)\n           apply(simp add: ts_oride_def)\n  apply(elim conjE)\n\n  apply (smt dual_order.trans fun_upd_same getVW_in_vw mem_Collect_eq releasing_def surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(2) visible_writes_def)\n  apply clarsimp\n    apply (smt dual_order.trans getVW_in_vw mem_Collect_eq visible_writes_def)\n         apply clarsimp\n         apply (smt dual_order.trans getVW_in_vw mem_Collect_eq visible_writes_def)\n        apply clarsimp\n  defer\n        apply (metis getVW_var)\n       apply (metis getVW_var)\n      apply (metis getVW_var)\n     apply auto[2]\n   apply (metis assms(1) assms(3) getVW_in_vw visible_var)\n  using assms(1) assms(2)\n  apply(unfold wfs_def)\n  by (smt assms(1) dual_order.trans getVW_in_vw mem_Collect_eq releasing_def surrey_state.select_convs(4) surrey_state.surjective surrey_state.update_convs(2) visible_writes_def)\n  \n\n\nlemma c_obs_read_d_obs  :\n  assumes \"wfs \\<sigma>\"\n  and \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> \\<sigma>\"\n  and \"getVW \\<sigma> t x = w\"\n  and \"value \\<sigma> w = u\"\nshows \"[y =\\<^sub>t v] (read_trans t True w \\<sigma>)\"\n  using assms\n  apply(unfold c_obs_def d_obs_def d_obs_t_def)\n  apply(intro conjI)\n   apply(unfold  value_def)\n   apply clarsimp\n   apply (simp add: getVW_in_vw lastWr_read_pres last_write_max  ts_oride_def)\n  apply (metis getVW_in_vw own_ModView subsetD visible_writes_in_writes)\n  apply(simp add: read_trans_def Let_def rev_app_def update_thrView_def)\n   apply(intro conjI impI)\n   apply(simp add: lastWr_def)\n  apply(unfold writes_on_def, clarsimp)\n  using getVW_in_vw apply blast\n   apply(simp add: lastWr_def)\n  apply(unfold writes_on_def, clarsimp)\n  using getVW_in_vw apply blast\n  done\n\nlemma d_obs_diff_c_obs  :\n  assumes \"wfs \\<sigma>\"\nand \"[x =\\<^sub>t z] \\<sigma>\"\n  and \"z \\<noteq> u\"\nshows \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> \\<sigma>\"\n  using assms\n  using d_obs_not_p_obs not_p_obs_implies_c_obs by blast\n\n\nlemma not_d_obs_c_obs_ext  :\n  assumes \"wfs \\<sigma>\"\n      and \"\\<not>[x \\<approx>\\<^sub>t' u] \\<sigma>\"\n      and \"[y =\\<^sub>t v] \\<sigma>\"\n      and \"getVWNC \\<sigma> t' x = w\"\n      and \" ts' = getTS \\<sigma> w\"\n      and \"value \\<sigma> w = u\"\n      and \"y \\<noteq> x\"\n      and \"t \\<noteq> t'\"\n    shows\"[x = u]\\<lparr> y =\\<^sub>t' v\\<rparr> (write_trans t' True w v \\<sigma> ts')\"\n  using assms\n  apply(unfold p_obs_def d_obs_def d_obs_t_def c_obs_def visible_writes_def)\n  apply(unfold visible_writes_def value_def lastWr_def writes_on_def)\n  apply(unfold write_trans_def rev_app_def update_wa_def update_mods_def update_thrView_def update_modView_def)\n  by (metis assms(1) assms(2) assms(4) assms(6) getVWNC_in_vw p_obs_def value_def)\n\n\nlemma c_obs_pres_write_diff_var_ext  :\n  assumes \"wfs \\<sigma>\"\n      and \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> \\<sigma>\"\n      and \"getVWNC \\<sigma> t z = w\"\n      and \"x \\<noteq> z\"\n      and \"y \\<noteq> z\"\n      and \" getTS \\<sigma> w = ts'\"\n    shows \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> (write_trans t b w v \\<sigma> ts')\"\n  using assms(2)\n  apply(simp add: p_obs_def d_obs_def d_obs_t_def c_obs_def visible_writes_def value_def)\n  apply(intro conjI impI allI, elim conjE)\n       apply simp\n  \n  using assms(1) assms(3) assms(4) getVWNC_var apply blast\n  \n  using assms(1) assms(3) assms(4) getVWNC_var apply blast\n  \n  using assms(1) assms(3) assms(4) getVWNC_var apply blast\n    apply(elim conjE)\n    apply(subgoal_tac \"a = x\")\n     apply simp\n  using assms(3,4,5,6)\n  \n  apply (metis assms(1) getVWNC_var write_to_different_var)\n  \n  using w_in_writes_on_var apply blast\n  using assms(3,4,5,6)\n    apply(elim conjE)\n   apply(subgoal_tac \"a = x\")\n    apply simp\n    apply(subgoal_tac \"var w = z\")\n  apply simp\n  \n     apply (simp add: assms(1))\n  \n  using assms(1) getVWNC_var apply blast\n  \n  using w_in_writes_on_var apply blast\n  apply(subgoal_tac \"a = x\")\n  apply (simp add: releasing_def)\n  using w_in_writes_on_var by blast\n\nlemma ext_c_obs_Up_intro  : \n  assumes  \"wfs \\<sigma>\"\n  and \"getVWNC \\<sigma> t x = w\"\n  and \"getTS \\<sigma> w = ts'\"\n  and  \"[y =\\<^sub>t v] \\<sigma>\"\n  and  \" \\<not> [x \\<approx>\\<^sub>t' u] \\<sigma>\"\n  and  \"x \\<noteq> y\"  \n  and \"t' \\<noteq> t\"\nshows \"[x = u]\\<lparr>y =\\<^sub>t' v\\<rparr> (update_trans t w u \\<sigma> ts')\"\n  using assms(4,5)\n  apply(simp add: c_obs_def p_obs_def d_obs_def d_obs_t_def visible_writes_def)\n  apply(intro allI impI conjI, elim conjE)\n  using assms(2,3,6,7)\n    apply(subgoal_tac \"a = x\")\n    apply(subgoal_tac \"var w = x\")\n      apply simp\n      apply(elim disjE)\n       apply simp\n       apply(case_tac \"releasing \\<sigma> w\")\n        apply simp\n  apply(simp add: ts_oride_def)\n        apply (metis assms(1) dual_order.antisym lastWr_def modView_lte_last same_ws wfs_def writes_new_update_diff_var)\n       apply simp\n        apply (simp add: lastWr_def writes_new_update_diff_var)\n  apply (case_tac \"b = ts'\")\n  using assms(1) w_not_in_writes_on apply blast\n      apply simp\n      apply(simp add: value_def)\n      apply blast\n  using assms(1) getVWNC_var apply blast\n   using w_in_writes_on_var apply blast\n    apply (metis assms(1) assms(2) assms(3) assms(6) d_obs_def d_obs_t_def update_diff_var_pres_dobs_ext)\n  apply(elim conjE)\n    apply(subgoal_tac \"a = x\")\n   apply(subgoal_tac \"var w = x\")\n    apply simp\n    apply(elim disjE)\n  apply(simp add: releasing_def)\n    apply(simp add: releasing_def)\n  apply(case_tac \"b = ts'\")\n  using assms(1) assms(2) assms(3) w_not_in_writes_on apply blast\n  using assms(7)\n    apply simp\n  apply(simp add: value_def)\n    apply blast\n  using assms(1) assms(2) getVWNC_var apply blast\n  using w_in_writes_on_var by blast\n  \n\n\nlemma ext_c_obs_read_diff_var_pres  : \n  assumes  \"wfs \\<sigma>\"\n  and  \"[x = u]\\<lparr>y =\\<^sub>t' v\\<rparr> \\<sigma>\"\n  and  \"z \\<noteq> x\"  \n  and \"x \\<noteq> y\"\n  and \"w = getVW \\<sigma> t z\"\nshows \"[x = u]\\<lparr>y =\\<^sub>t' v\\<rparr> (read_trans t b w \\<sigma>)\"\n  using assms(2)\n  apply(simp add: c_obs_def d_obs_def visible_writes_def)\n  apply(subgoal_tac \"var w = z\")\n   defer\n  using assms(1) assms(5) getVW_var apply blast\n  apply(intro allI impI)\n  apply(subgoal_tac \"a = x\") defer\n  using w_in_writes_on_var apply blast\n  apply simp\n  apply(intro conjI, elim conjE)\n    apply (simp add: value_def)\n    apply(subgoal_tac \"var w \\<noteq> x\") \n     apply simp\n  apply(case_tac \"t \\<noteq> t'\")\n      apply (simp add: lastWr_read_pres)\n     apply(case_tac \"\\<not>syncing \\<sigma> w b\")\n      apply (simp add: lastWr_read_pres)\n     apply simp\n     apply(simp add: ts_oride_def)\n  apply(case_tac \"tst (thrView \\<sigma> t' x)\n              \\<le> tst (modView \\<sigma> w x)\")\n      apply (simp add: lastWr_read_pres)\n     apply (simp add: lastWr_read_pres)\n  using assms(3) apply blast\n   apply (simp add: value_def)\n   apply(case_tac \"t \\<noteq> t'\")\n    apply (simp add: lastWr_read_pres)\n   apply simp\n   apply(case_tac \"\\<not>syncing \\<sigma> w b\")\n    apply simp\n  apply(case_tac \"x = z\")\n  using assms(3) apply blast\n  apply (simp add: lastWr_read_pres)\n   apply simp\n     apply(simp add: ts_oride_def)\n  apply(case_tac \"x = z\")\n  using assms(3) apply blast\n   apply simp\n  apply(case_tac \"tst (thrView \\<sigma> t' x)\n               \\<le> tst (modView \\<sigma> w x)\")\n  apply simp\n    apply (metis dual_order.trans lastWr_read_pres)\n   apply simp\n   apply (simp add: lastWr_read_pres)\n  apply(simp add: releasing_def)\n  apply(case_tac \"t \\<noteq> t'\", simp)\n   apply(simp add: value_def)\n   apply(simp add: value_def)\n    apply(case_tac \"\\<not>syncing \\<sigma> w b\", simp)\n   \n  using assms(3) apply auto[1]\n  apply simp\n     apply(simp add: ts_oride_def)\n  apply(case_tac \"x = z\")\n  \n  using assms(3) apply blast\n  apply simp\n  apply(case_tac \"tst (thrView \\<sigma> t' x)\n               \\<le> tst (modView \\<sigma> w x)\")\n   apply simp\n  by simp\n  \n\nlemma ext_c_obs_rdx_pres  :\n  assumes  \"wfs \\<sigma>\"\n  and  \"[x = u]\\<lparr>y =\\<^sub>t' v\\<rparr> \\<sigma>\"\n  and  \"y \\<noteq> x\"  \n  and \"w = getVW \\<sigma> t z\"\n  and \"t \\<noteq> t'\"\nshows \"[x = u]\\<lparr>y =\\<^sub>t' v\\<rparr> (read_trans t b w \\<sigma>)\"\n  using assms(2,5)\n  apply(simp add: c_obs_def d_obs_def visible_writes_def)\n  apply (intro allI impI)\n  apply(subgoal_tac \"a = x\")\n  defer \n  using w_in_writes_on_var apply blast\n  apply simp\n  apply(intro conjI)\n    apply(case_tac \"x \\<noteq> z\")\n     apply(simp add: value_def)\n  apply(subgoal_tac \"var w \\<noteq> x\")\n    apply (simp add: lastWr_read_pres)\n  using assms(1) assms(4) getVW_var apply blast\n    apply simp\n  apply(simp add: value_def)\n  \n    apply (simp add: lastWr_read_pres)\n   apply(simp add: value_def)\n  \n   apply (simp add: lastWr_read_pres)\n by(simp add: value_def releasing_def)\n\n\n(******* Covered **********)\n\nlemma covered_contradiction [simp]:\n  assumes \"wfs \\<sigma>\"\n    and \"cvd[x, u] \\<sigma>\"\n    and \"u \\<noteq> v\"\n    and \"[x =\\<^sub>t v] \\<sigma>\"\n  shows \"False\"\n  using assms\n  by (metis covered_v_def d_obs_def d_obs_t_def wfs_def)\n\n\nlemma covered_contradiction2  :\n  assumes \"wfs \\<sigma>\"\n    and \"cvd[x, u] \\<sigma>\"\n    and \"cvd[x, v] \\<sigma>\"\n    and \"u \\<noteq> v\"\n  shows \"False\"\n  using assms\n  by (metis covered_v_def last_write_write_on wfs_def)\n\nlemma covered_wr_diif_var_pres  :\n  assumes \"wfs \\<sigma>\"\n  and \"cvd[x, u] \\<sigma>\"\n  and \"getVWNC \\<sigma> t y = w\"\n  and \"getTS \\<sigma> w = ts'\"\n  and \"x \\<noteq> y\"\nshows \"cvd[x, u] (write_trans t b w v \\<sigma> ts')\"\n  using assms(2,5)\n  apply(simp add: covered_v_def)\n  apply(intro allI impI conjI, elim conjE)\n   apply(subgoal_tac \"a = x\")\n    apply simp\n    apply(simp add: lastWr_def)\n    apply(subgoal_tac \"var w = y\")\n  apply simp\n  using assms(1) assms(3) getVWNC_var apply blast\n  using w_in_writes_on_var apply blast\n  apply(simp add: value_def)\n  apply(subgoal_tac \"a = x\")\n    apply(subgoal_tac \"var w = y\")\n  apply simp\n  using assms(1) assms(3) getVWNC_var apply blast \n  using w_in_writes_on_var by blast\n\n\n\nlemma ext_cvd_update_cvd  :\n  assumes \"wfs \\<sigma>\"\n      and \"w = getVWNC \\<sigma> t x\"\n      and \"ts' = getTS \\<sigma> w\"\n      and \"cvd[x, u] \\<sigma>\"\n    shows \"cvd[x, v] (update_trans t w v \\<sigma> ts')\"\n  apply(case_tac \"w \\<noteq> lastWr \\<sigma> x\")\n  using assms(1) assms(2) assms(4) covered_v_def getVWNC_in_writes_on getVWNC_wa apply blast\n  apply simp\n  apply(subgoal_tac \"var w = x\")\n  defer\n   apply simp\n  apply (subgoal_tac \"value \\<sigma> w = u\") defer\n  using assms(1) assms(4) covered_v_def last_write_write_on wfs_def apply blast\n  using assms(4)\n  apply(simp add: covered_v_def)\n  apply(intro allI impI)\n   apply(subgoal_tac \"a=x\")\n   apply simp\n   defer\n  using w_in_writes_on_var apply blast\n  apply(elim conjE, intro conjI)\n   apply(case_tac \"b = ts'\") \n    apply (metis assms(1) assms(2) assms(3) getTS_valid getVWNC_in_vw lastWr_def lastWr_upd)\n   apply simp\n   apply(case_tac \"(x, b) = w\")\n    apply simp\n   apply simp\n   apply(case_tac \"b < tst w\")\n  apply simp\n  apply (metis Max.coboundedI assms(1) assms(2) finite_imageI getVWNC_in_writes_on image_eqI lastWr_def last_write_max2 not_less_iff_gr_or_eq order.not_eq_order_implies_strict wfs_def)\n  apply(case_tac \"b = ts'\") \n   apply(simp add: value_def)\n  apply simp\n   apply(case_tac \"(x, b) = w\")\n   apply simp\n  apply(case_tac \"b < tst w\")\n  apply simp \n  by (metis Max.coboundedI assms(1) assms(2) finite_imageI getVWNC_in_writes_on image_eqI lastWr_def last_write_max2 not_less_iff_gr_or_eq order.not_eq_order_implies_strict wfs_def)\n  \nlemma covered_update_pres_ext  :\n  assumes  \"wfs \\<sigma>\"\n  and \"cvd[x, u] \\<sigma>\"\n  and \"getVWNC \\<sigma> t x = w\"\n  and \"getTS \\<sigma> w = ts'\"\nshows \"cvd[x, v] (update_trans t w v \\<sigma> ts')\"\n  using assms(1) assms(2) assms(3) assms(4) ext_cvd_update_cvd by blast\n\nlemma ext_cvd_rd_pres  :\n     assumes  \"cvd[x, u] \\<sigma>\"\n    and \"wfs \\<sigma>\"\n      and \"w = getVW \\<sigma> t y\"\n    shows \"cvd[x, u]  (read_trans t b w \\<sigma>)\"\n  using assms(1)\n  apply(simp add: covered_v_def)\n  apply(intro allI impI conjI)\n   apply (simp add: lastWr_read_pres)\n  by(simp add: value_def)\n  \n\n\n(************* INIT *****************)\nlemma init_rd_pres  :\n  assumes \"wfs \\<sigma>\"\n  and \" [init x u] \\<sigma>\"\n  and \"w = getVW \\<sigma> t y\"\nshows \"[init x u]  (read_trans t b w \\<sigma>)\"\n  using assms(2)\n  apply(unfold init_val_def value_def)\n  apply(unfold read_trans_def rev_app_def Let_def update_thrView_def writes_on_def)\n  by simp\n\n\nlemma init_wr_pres_1:\n  assumes \"wfs \\<sigma>\"\n  and \" [init x u] \\<sigma>\"\n  and \"getVWNC \\<sigma> t y = w\"\n  and \"getTS \\<sigma> w = ts'\"\n  and \"x = y\"\nshows \"[init x u] (write_trans t b w v \\<sigma> ts')\"\n  using assms(2)\n  apply(simp add: init_val_def mo_def)\n  apply(simp add: value_def)\n  apply clarsimp\n  apply(subgoal_tac \"a = x\")\n  defer\n    apply (simp add: w_in_writes_on_var)\n  apply simp\n  apply(subgoal_tac \"var w = x\")\n   defer \n  using assms(5)\n  using assms(1) assms(3) getVWNC_var apply blast\n  apply simp\n  apply(rule_tac x = x in exI)\n  apply simp\n  apply(subgoal_tac \"ba \\<noteq> ts'\")\n   defer  \n  using assms(1) assms(3) assms(4) assms(5) w_not_in_writes_on apply blast\n  apply(rule_tac x = ba in exI)\n  apply(intro conjI)  \n     apply simp\n    defer  \n    apply blast\n   apply simp\n  apply simp\n  using assms(3,4,5)\n  by (metis assms(1) getTS_greater_init_ts)\n\nlemma init_wr_pres_2:\n  assumes \"wfs \\<sigma>\"\n  and \" [init x u] \\<sigma>\"\n  and \"getVWNC \\<sigma> t y = w\"\n  and \"getTS \\<sigma> w = ts'\"\n  and \"x \\<noteq> y\"\nshows \"[init x u] (write_trans t b w v \\<sigma> ts')\"\n  using assms(2)\n  apply(simp add: init_val_def mo_def)\n  apply(simp add: value_def)\n  apply clarsimp\n  apply(subgoal_tac \"a = x\")\n  defer\n   apply (simp add: w_in_writes_on_var)\n    apply simp\n  apply(subgoal_tac \"var w = y\")\n   defer \n  using assms(1) assms(3) getVWNC_var apply blast\n  using assms(5)\n  apply simp\n  using assms(3,4)\n  apply(rule_tac x = x in exI)\n  apply simp\n  by blast \n\n\nlemma init_wr_pres:\n  assumes \"wfs \\<sigma>\"\n  and \" [init x u] \\<sigma>\"\n  and \"getVWNC \\<sigma> t y = w\"\n  and \"getTS \\<sigma> w = ts'\"\nshows \"[init x u] (write_trans t b w v \\<sigma> ts')\"\n  apply(case_tac \"y = x\")\n  using assms(1) assms(2) assms(3) assms(4) init_wr_pres_1 apply blast\n  using assms(1) assms(2) assms(3) assms(4) init_wr_pres_2 by auto\n\n\nlemma init_upd_pres  :\n  assumes \"wfs \\<sigma>\"\n  and \" [init x u] \\<sigma>\"\n  and \"w = getVWNC \\<sigma> t y\"\n  and \" ts' = getTS \\<sigma> w\"\nshows \"[init x u]  (update_trans t w v \\<sigma> ts')\"\n  apply(case_tac \"x = y\")\n  using assms(2)\n   apply(simp add: init_val_def mo_def)\n  apply(simp add: value_def)\n  apply clarsimp\n   apply(subgoal_tac \"a = y\") defer\n    apply (simp add: w_in_writes_on_var) defer\n   apply simp\n  apply(subgoal_tac \"var w = y\")\n    apply simp\n  apply(rule_tac x = y in exI)\n  apply(rule_tac x = b in exI)\n  apply(intro conjI)   \n       apply blast\n      apply (metis assms(1) assms(3) assms(4) getTS_greater_init_ts)\n     apply simp\n  apply(case_tac \"b = ts'\")\n     apply (simp add: assms(1) assms(3) assms(4) w_not_in_writes_on)\n  apply simp \n  using assms(1) assms(3) getVWNC_var apply blast\n  using assms(2)\n   apply(simp add: init_val_def mo_def)\n  apply(simp add: value_def)\n  apply clarsimp\n   apply(subgoal_tac \"a = x\") defer\n    apply (simp add: w_in_writes_on_var) defer\n  apply simp\n  apply(subgoal_tac \"var w = y\")\n    apply simp\n  apply(rule_tac x = x in exI)\n  apply(rule_tac x = b in exI)\n  apply(intro conjI)     \n     apply simp\n    apply simp\n  apply simp\n  using assms(1) assms(3) getVWNC_var by blast  \n\n*)\n\n\nend\n", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/OpSem_New.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.689305616785446, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.32314001202983866}}
{"text": "section \\<open>More derived facts about quantum registers\\<close>\n\ntext \\<open>This theory contains some derived facts that cannot be placed in theory \\<open>Quantum_Extra\\<close> \n      because they depend on \\<open>Laws_Complement_Quantum\\<close>.\\<close>\n\ntheory Quantum_Extra2\n  imports\n    Laws_Complement_Quantum\n    Quantum\nbegin\n\ndefinition empty_var :: \\<open>'a::{CARD_1,enum} update \\<Rightarrow> 'b::finite update\\<close> where\n  \"empty_var a = one_dim_iso a *\\<^sub>C id_cblinfun\"\n\nlemma is_unit_register_empty_var[register]: \\<open>is_unit_register empty_var\\<close>\nproof -\n  have [simp]: \\<open>register empty_var\\<close>\n    unfolding register_def empty_var_def\n    by (simp add: clinearI scaleC_left.add)\n  have [simp]: \\<open>compatible empty_var id\\<close>\n    by (auto intro!: compatibleI simp: empty_var_def)\n  have [simp]: \\<open>iso_register (empty_var;id)\\<close>\n    by (auto intro!: same_range_equivalent range_eqI[where x=\\<open>id_cblinfun \\<otimes>\\<^sub>o _\\<close>] \n        simp del: id_cblinfun_eq_1 simp flip: iso_register_equivalent_id simp: register_pair_apply)\n  show ?thesis\n    by (auto intro!: complementsI simp: is_unit_register_def)\nqed\n\ninstance complement_domain :: (type, type) default ..\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Registers/Quantum_Extra2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548782017745, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3231331358716827}}
{"text": "theory CategorySetV3 imports \"ZFC_in_HOL.ZFC_Typeclasses\" Category\n                                                \nbegin\n\n (*Begin: some useful parameter settings*)\ndeclare [[ smt_solver = cvc4, smt_oracle = true, smt_timeout = 120]] declare [[ show_types ]] \nsledgehammer_params [provers = cvc4 z3 spass e vampire]\nnitpick_params [user_axioms, show_all, format = 2]\n(*nitpick_params[user_axioms, show_all, format = 2, expect = genuine]*)\n (*End: some useful parameter settings*)\n\n\\<comment>\\<open>The type of set functions\\<close>\ntypedef setCat = \"UNIV::(V\\<times>V\\<times>V) set\"\n  morphisms getFunc setFunc\n  using VPi_I by blast\n\nabbreviation funcP:: \"setCat \\<Rightarrow> V\" where \"funcP f \\<equiv> fst (getFunc f)\"\nabbreviation domP :: \"setCat \\<Rightarrow> V\" where \"domP f \\<equiv> fst (snd (getFunc f))\"\nabbreviation codP :: \"setCat \\<Rightarrow> V\" where \"codP f \\<equiv> snd (snd (getFunc f))\"\n\nlemma \"\\<not> (single_valued (pairs (vinsert \\<langle>0,0\\<rangle> \\<langle>0,1\\<rangle>)))\"\n  apply(simp add: pairs_def single_valued_def vinsert_def)\n  apply(simp add: vpair_def set_def)\n  sorry\n\nabbreviation compositionF :: \"setCat \\<Rightarrow> setCat \\<Rightarrow> setCat\" (infixl \"\\<^bold>\\<odot>\" 110)\n  where \"g \\<^bold>\\<odot> f \\<equiv> setFunc (if codP f = domP g then\n                  ((THE h. h \\<in> elts (VPi (domP f) (\\<lambda>x. codP g)) \\<and>\n                    (\\<forall>a\\<in>(elts (domP f)). \\<langle>a, (app (funcP g) (app (funcP f) a))\\<rangle> \\<in> elts h)), \n                     domP f, codP g)\n                      else (vinsert \\<langle>0,0\\<rangle> \\<langle>0,1\\<rangle>, 0, 0))\"\n    \n\n\n\n\n\n\nend", "meta": {"author": "LuccaT95", "repo": "ToposTheory", "sha": "8e468a6bf7111aecd93d48458d8608106fd43256", "save_path": "github-repos/isabelle/LuccaT95-ToposTheory", "path": "github-repos/isabelle/LuccaT95-ToposTheory/ToposTheory-8e468a6bf7111aecd93d48458d8608106fd43256/CategorySetV3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548511303336, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3231331224417079}}
{"text": "section {* Relational Refinement Calculus *}\n\ntheory utp_morgan\n  imports utp_hoare\nbegin\n  \ndefinition spec :: \"('a \\<Longrightarrow> '\\<alpha>) \\<Rightarrow> '\\<alpha> upred \\<Rightarrow> ('\\<alpha> \\<Rightarrow> '\\<alpha> upred) \\<Rightarrow> '\\<alpha> hrel\" where\n[upred_defs]: \"spec x p q = (\\<Squnion> v \\<bullet> \\<lceil>p \\<and> &\\<^bold>v =\\<^sub>u \\<guillemotleft>v\\<guillemotright>\\<rceil>\\<^sub>< \\<Rightarrow> x:[\\<lceil>q(v)\\<rceil>\\<^sub>>])\"\n\nsyntax\n  \"_init_var\"  :: \"logic\"\n  \"_spec\"      :: \"salpha \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_:[_,/ _]\" [99,0,0] 100)\n  \"_log_const\" :: \"pttrn \\<Rightarrow> logic \\<Rightarrow> logic\" (\"con _ \\<bullet> _\" [0, 10] 10)\n  \ntranslations\n  \"_spec x p q\" => \"CONST spec x p (\\<lambda> _init_var. q)\"\n  \"_spec (_salphaset (_salphamk x)) p q\" <= \"CONST spec x p (\\<lambda> iv. q)\"\n  \"_log_const x P\" => \"\\<Squnion> x \\<bullet> P\"\n  \nparse_translation {*\nlet\n  fun init_var_tr [] = Syntax.free \"iv\"\n    | init_var_tr _  = raise Match;\nin\n[(@{syntax_const \"_init_var\"}, K init_var_tr)]\nend\n*}\n  \nlemma spec_simple_def: \n  \"x:[pre,post] = (\\<lceil>pre\\<rceil>\\<^sub>< \\<Rightarrow> x:[\\<lceil>post\\<rceil>\\<^sub>>])\"\n  by (rel_auto)\n  \nlemma spec_abort:\n  \"x:[false,post] = true\"\n  by (rel_auto)\n \nlemma spec_skip:\n  \"\\<emptyset>:[true,true] = II\"\n  by (rel_auto)\n    \nlemma assign_refine:\n  assumes \"vwb_lens w\" \"vwb_lens x\" \"w \\<bowtie> x\" \"`pre \\<Rightarrow> post\\<lbrakk>E/w\\<rbrakk>`\"\n  shows \"{&w,&x}:[pre,post] \\<sqsubseteq> w := E\"\n  apply (insert assms)\n  apply (rel_simp)\n  apply (metis lens_indep.lens_put_irr2 lens_override_def lens_override_idem vwb_lens_wb wb_lens_def weak_lens.put_get)\ndone\n    \nlemma seqr_refine:\n  \"\\<lbrakk> vwb_lens w; w \\<natural> mid \\<rbrakk> \\<Longrightarrow> w:[pre,post] \\<sqsubseteq> w:[pre,mid] ;; w:[mid,post]\"  \n  by (rel_simp)\n   \nlemma log_const_intro:\n  assumes \"vwb_lens w\" \"`pre \\<Rightarrow> (\\<^bold>\\<exists> c \\<bullet> pre'(c))`\"\n  shows \"w:[pre,post] \\<sqsubseteq> (con c \\<bullet> w:[pre'(c),post])\"\n  apply (insert assms)\n  apply (rel_blast)\ndone\n    \nlemma log_const_initial:\n  assumes \"vwb_lens w\"\n  shows \"w:[pre,post] \\<sqsubseteq> (con c \\<bullet> w:[pre \\<and> \\<guillemotleft>c\\<guillemotright> =\\<^sub>u E, post])\"\n  using assms by (rule log_const_intro, rel_auto)\n    \nlemma log_const_remove:\n  assumes \"vwb_lens w\"\n  shows \"(con c \\<bullet> w:[pre,post]) \\<sqsubseteq> w:[pre,post]\"\n  by (rel_auto)\n    \nsyntax\n  \"_ulens_expr\" :: \"logic \\<Rightarrow> svid \\<Rightarrow> logic\" (\"_:'(_')\" [100,100] 100)\n\ntranslations\n  \"_ulens_expr e x\" == \"CONST uop get\\<^bsub>x\\<^esub> e\"\n  \nlemma expand_frame:\n  assumes \"vwb_lens w\" \"vwb_lens x\" \"x \\<bowtie> w\" \"w \\<natural> post\"\n  shows \"{&w}:[true,post] = {&w,&x}:[true, post \\<and> &x =\\<^sub>u \\<guillemotleft>iv\\<guillemotright>:(x)]\"\n  apply (simp add: spec_def)\n  using assms apply (rel_auto)\n  apply fastforce\ndone  \n    \nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/utp/utp_morgan.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723316860482763, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3230410397221963}}
{"text": "(*  Title:      HOL/Auth/KerberosIV_Gets.thy\n    Author:     Giampaolo Bella, Cambridge University Computer Laboratory\n    Copyright   1998  University of Cambridge\n*)\n\nsection\\<open>The Kerberos Protocol, Version IV\\<close>\n\ntheory KerberosIV_Gets imports Public begin\n\ntext\\<open>The \"u\" prefix indicates theorems referring to an updated version of the protocol. The \"r\" suffix indicates theorems where the confidentiality assumptions are relaxed by the corresponding arguments.\\<close>\n\nabbreviation\n  Kas :: agent where \"Kas == Server\"\n\nabbreviation\n  Tgs :: agent where \"Tgs == Friend 0\"\n\n\naxiomatization where\n  Tgs_not_bad [iff]: \"Tgs \\<notin> bad\"\n   \\<comment>\\<open>Tgs is secure --- we already know that Kas is secure\\<close>\n\ndefinition\n (* authKeys are those contained in an authTicket *)\n    authKeys :: \"event list => key set\" where\n    \"authKeys evs = {authK. \\<exists>A Peer Ta. Says Kas A\n                        (Crypt (shrK A) \\<lbrace>Key authK, Agent Peer, Number Ta,\n               (Crypt (shrK Peer) \\<lbrace>Agent A, Agent Peer, Key authK, Number Ta\\<rbrace>)\n                  \\<rbrace>) \\<in> set evs}\"\n\ndefinition\n (* States than an event really appears only once on a trace *)\n  Unique :: \"[event, event list] => bool\" (\"Unique _ on _\" [0, 50] 50)\n  where \"(Unique ev on evs) = (ev \\<notin> set (tl (dropWhile (% z. z \\<noteq> ev) evs)))\"\n\n\nconsts\n    (*Duration of the authentication key*)\n    authKlife   :: nat\n\n    (*Duration of the service key*)\n    servKlife   :: nat\n\n    (*Duration of an authenticator*)\n    authlife   :: nat\n\n    (*Upper bound on the time of reaction of a server*)\n    replylife   :: nat\n\nspecification (authKlife)\n  authKlife_LB [iff]: \"2 \\<le> authKlife\"\n    by blast\n\nspecification (servKlife)\n  servKlife_LB [iff]: \"2 + authKlife \\<le> servKlife\"\n    by blast\n\nspecification (authlife)\n  authlife_LB [iff]: \"Suc 0 \\<le> authlife\"\n    by blast\n\nspecification (replylife)\n  replylife_LB [iff]: \"Suc 0 \\<le> replylife\"\n    by blast\n\nabbreviation\n  (*The current time is just the length of the trace!*)\n  CT :: \"event list=>nat\" where\n  \"CT == length\"\n\nabbreviation\n  expiredAK :: \"[nat, event list] => bool\" where\n  \"expiredAK Ta evs == authKlife + Ta < CT evs\"\n\nabbreviation\n  expiredSK :: \"[nat, event list] => bool\" where\n  \"expiredSK Ts evs == servKlife + Ts < CT evs\"\n\nabbreviation\n  expiredA :: \"[nat, event list] => bool\" where\n  \"expiredA T evs == authlife + T < CT evs\"\n\nabbreviation\n  valid :: \"[nat, nat] => bool\" (\"valid _ wrt _\" [0, 50] 50) where\n  \"valid T1 wrt T2 == T1 <= replylife + T2\"\n\n(*---------------------------------------------------------------------*)\n\n\n(* Predicate formalising the association between authKeys and servKeys *)\ndefinition AKcryptSK :: \"[key, key, event list] => bool\" where\n  \"AKcryptSK authK servK evs ==\n     \\<exists>A B Ts.\n       Says Tgs A (Crypt authK\n                     \\<lbrace>Key servK, Agent B, Number Ts,\n                       Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace> \\<rbrace>)\n         \\<in> set evs\"\n\ninductive_set \"kerbIV_gets\" :: \"event list set\"\n  where\n\n   Nil:  \"[] \\<in> kerbIV_gets\"\n\n | Fake: \"\\<lbrakk> evsf \\<in> kerbIV_gets;  X \\<in> synth (analz (spies evsf)) \\<rbrakk>\n          \\<Longrightarrow> Says Spy B X  # evsf \\<in> kerbIV_gets\"\n\n | Reception: \"\\<lbrakk> evsr \\<in> kerbIV_gets;  Says A B X \\<in> set evsr \\<rbrakk>\n                \\<Longrightarrow> Gets B X # evsr \\<in> kerbIV_gets\"\n\n(* FROM the initiator *)\n | K1:   \"\\<lbrakk> evs1 \\<in> kerbIV_gets \\<rbrakk>\n          \\<Longrightarrow> Says A Kas \\<lbrace>Agent A, Agent Tgs, Number (CT evs1)\\<rbrace> # evs1\n          \\<in> kerbIV_gets\"\n\n(* Adding the timestamp serves to A in K3 to check that\n   she doesn't get a reply too late. This kind of timeouts are ordinary.\n   If a server's reply is late, then it is likely to be fake. *)\n\n(*---------------------------------------------------------------------*)\n\n(*FROM Kas *)\n | K2:  \"\\<lbrakk> evs2 \\<in> kerbIV_gets; Key authK \\<notin> used evs2; authK \\<in> symKeys;\n            Gets Kas \\<lbrace>Agent A, Agent Tgs, Number T1\\<rbrace> \\<in> set evs2 \\<rbrakk>\n          \\<Longrightarrow> Says Kas A\n                (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number (CT evs2),\n                      (Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK,\n                          Number (CT evs2)\\<rbrace>)\\<rbrace>) # evs2 \\<in> kerbIV_gets\"\n(*\n  The internal encryption builds the authTicket.\n  The timestamp doesn't change inside the two encryptions: the external copy\n  will be used by the initiator in K3; the one inside the\n  authTicket by Tgs in K4.\n*)\n\n(*---------------------------------------------------------------------*)\n\n(* FROM the initiator *)\n | K3:  \"\\<lbrakk> evs3 \\<in> kerbIV_gets;\n            Says A Kas \\<lbrace>Agent A, Agent Tgs, Number T1\\<rbrace> \\<in> set evs3;\n            Gets A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n              authTicket\\<rbrace>) \\<in> set evs3;\n            valid Ta wrt T1\n         \\<rbrakk>\n          \\<Longrightarrow> Says A Tgs \\<lbrace>authTicket,\n                           (Crypt authK \\<lbrace>Agent A, Number (CT evs3)\\<rbrace>),\n                           Agent B\\<rbrace> # evs3 \\<in> kerbIV_gets\"\n(*The two events amongst the premises allow A to accept only those authKeys\n  that are not issued late. *)\n\n(*---------------------------------------------------------------------*)\n\n(* FROM Tgs *)\n(* Note that the last temporal check is not mentioned in the original MIT\n   specification. Adding it makes many goals \"available\" to the peers. \n   Theorems that exploit it have the suffix `_u', which stands for updated \n   protocol.\n*)\n | K4:  \"\\<lbrakk> evs4 \\<in> kerbIV_gets; Key servK \\<notin> used evs4; servK \\<in> symKeys;\n            B \\<noteq> Tgs;  authK \\<in> symKeys;\n            Gets Tgs \\<lbrace>\n             (Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK,\n                                 Number Ta\\<rbrace>),\n             (Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>), Agent B\\<rbrace>\n                \\<in> set evs4;\n            \\<not> expiredAK Ta evs4;\n            \\<not> expiredA T2 evs4;\n            servKlife + (CT evs4) <= authKlife + Ta\n         \\<rbrakk>\n          \\<Longrightarrow> Says Tgs A\n                (Crypt authK \\<lbrace>Key servK, Agent B, Number (CT evs4),\n                               Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK,\n                                                Number (CT evs4)\\<rbrace> \\<rbrace>)\n                # evs4 \\<in> kerbIV_gets\"\n(* Tgs creates a new session key per each request for a service, without\n   checking if there is still a fresh one for that service.\n   The cipher under Tgs' key is the authTicket, the cipher under B's key\n   is the servTicket, which is built now.\n   NOTE that the last temporal check is not present in the MIT specification.\n\n*)\n\n(*---------------------------------------------------------------------*)\n\n(* FROM the initiator *)\n | K5:  \"\\<lbrakk> evs5 \\<in> kerbIV_gets; authK \\<in> symKeys; servK \\<in> symKeys;\n            Says A Tgs\n                \\<lbrace>authTicket, Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>,\n                  Agent B\\<rbrace>\n              \\<in> set evs5;\n            Gets A\n             (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n                \\<in> set evs5;\n            valid Ts wrt T2 \\<rbrakk>\n          \\<Longrightarrow> Says A B \\<lbrace>servTicket,\n                         Crypt servK \\<lbrace>Agent A, Number (CT evs5)\\<rbrace> \\<rbrace>\n               # evs5 \\<in> kerbIV_gets\"\n(* Checks similar to those in K3. *)\n\n(*---------------------------------------------------------------------*)\n\n(* FROM the responder*)\n  | K6:  \"\\<lbrakk> evs6 \\<in> kerbIV_gets;\n            Gets B \\<lbrace>\n              (Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>),\n              (Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>)\\<rbrace>\n            \\<in> set evs6;\n            \\<not> expiredSK Ts evs6;\n            \\<not> expiredA T3 evs6\n         \\<rbrakk>\n          \\<Longrightarrow> Says B A (Crypt servK (Number T3))\n               # evs6 \\<in> kerbIV_gets\"\n(* Checks similar to those in K4. *)\n\n(*---------------------------------------------------------------------*)\n\n(* Leaking an authK... *)\n | Oops1: \"\\<lbrakk> evsO1 \\<in> kerbIV_gets;  A \\<noteq> Spy;\n              Says Kas A\n                (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n                                  authTicket\\<rbrace>)  \\<in> set evsO1;\n              expiredAK Ta evsO1 \\<rbrakk>\n          \\<Longrightarrow> Says A Spy \\<lbrace>Agent A, Agent Tgs, Number Ta, Key authK\\<rbrace>\n               # evsO1 \\<in> kerbIV_gets\"\n\n(*---------------------------------------------------------------------*)\n\n(*Leaking a servK... *)\n | Oops2: \"\\<lbrakk> evsO2 \\<in> kerbIV_gets;  A \\<noteq> Spy;\n              Says Tgs A\n                (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n                   \\<in> set evsO2;\n              expiredSK Ts evsO2 \\<rbrakk>\n          \\<Longrightarrow> Says A Spy \\<lbrace>Agent A, Agent B, Number Ts, Key servK\\<rbrace>\n               # evsO2 \\<in> kerbIV_gets\"\n\n(*---------------------------------------------------------------------*)\n\ndeclare Says_imp_knows_Spy [THEN parts.Inj, dest]\ndeclare parts.Body [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un [dest]\n\nsubsection\\<open>Lemmas about reception event\\<close>\n\nlemma Gets_imp_Says :\n     \"\\<lbrakk> Gets B X \\<in> set evs; evs \\<in> kerbIV_gets \\<rbrakk> \\<Longrightarrow> \\<exists>A. Says A B X \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply auto\ndone\n\nlemma Gets_imp_knows_Spy: \n     \"\\<lbrakk> Gets B X \\<in> set evs; evs \\<in> kerbIV_gets \\<rbrakk>  \\<Longrightarrow> X \\<in> knows Spy evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\n(*Needed for force to work for example in new_keys_not_used*)\ndeclare Gets_imp_knows_Spy [THEN parts.Inj, dest]\n\nlemma Gets_imp_knows:\n     \"\\<lbrakk> Gets B X \\<in> set evs; evs \\<in> kerbIV_gets \\<rbrakk>  \\<Longrightarrow> X \\<in> knows B evs\"\nby (metis Gets_imp_knows_Spy Gets_imp_knows_agents)\n\nsubsection\\<open>Lemmas about @{term authKeys}\\<close>\n\nlemma authKeys_empty: \"authKeys [] = {}\"\nby (simp add: authKeys_def)\n\nlemma authKeys_not_insert:\n \"(\\<forall>A Ta akey Peer.\n   ev \\<noteq> Says Kas A (Crypt (shrK A) \\<lbrace>akey, Agent Peer, Ta,\n              (Crypt (shrK Peer) \\<lbrace>Agent A, Agent Peer, akey, Ta\\<rbrace>)\\<rbrace>))\n       \\<Longrightarrow> authKeys (ev # evs) = authKeys evs\"\nby (unfold authKeys_def, auto)\n\nlemma authKeys_insert:\n  \"authKeys\n     (Says Kas A (Crypt (shrK A) \\<lbrace>Key K, Agent Peer, Number Ta,\n      (Crypt (shrK Peer) \\<lbrace>Agent A, Agent Peer, Key K, Number Ta\\<rbrace>)\\<rbrace>) # evs)\n       = insert K (authKeys evs)\"\nby (unfold authKeys_def, auto)\n\nlemma authKeys_simp:\n   \"K \\<in> authKeys\n    (Says Kas A (Crypt (shrK A) \\<lbrace>Key K', Agent Peer, Number Ta,\n     (Crypt (shrK Peer) \\<lbrace>Agent A, Agent Peer, Key K', Number Ta\\<rbrace>)\\<rbrace>) # evs)\n        \\<Longrightarrow> K = K' | K \\<in> authKeys evs\"\nby (unfold authKeys_def, auto)\n\nlemma authKeysI:\n   \"Says Kas A (Crypt (shrK A) \\<lbrace>Key K, Agent Tgs, Number Ta,\n     (Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key K, Number Ta\\<rbrace>)\\<rbrace>) \\<in> set evs\n        \\<Longrightarrow> K \\<in> authKeys evs\"\nby (unfold authKeys_def, auto)\n\nlemma authKeys_used: \"K \\<in> authKeys evs \\<Longrightarrow> Key K \\<in> used evs\"\nby (simp add: authKeys_def, blast)\n\n\nsubsection\\<open>Forwarding Lemmas\\<close>\n\nlemma Says_ticket_parts:\n     \"Says S A (Crypt K \\<lbrace>SesKey, B, TimeStamp, Ticket\\<rbrace>) \\<in> set evs\n      \\<Longrightarrow> Ticket \\<in> parts (spies evs)\"\nby blast\n\nlemma Gets_ticket_parts:\n     \"\\<lbrakk>Gets A (Crypt K \\<lbrace>SesKey, Peer, Ta, Ticket\\<rbrace>) \\<in> set evs; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Ticket \\<in> parts (spies evs)\"\nby (blast dest: Gets_imp_knows_Spy [THEN parts.Inj])\n\nlemma Oops_range_spies1:\n     \"\\<lbrakk> Says Kas A (Crypt KeyA \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>)\n           \\<in> set evs ;\n         evs \\<in> kerbIV_gets \\<rbrakk> \\<Longrightarrow> authK \\<notin> range shrK & authK \\<in> symKeys\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, auto)\ndone\n\nlemma Oops_range_spies2:\n     \"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Ts, servTicket\\<rbrace>)\n           \\<in> set evs ;\n         evs \\<in> kerbIV_gets \\<rbrakk> \\<Longrightarrow> servK \\<notin> range shrK & servK \\<in> symKeys\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, auto)\ndone\n\n\n(*Spy never sees another agent's shared key! (unless it's lost at start)*)\nlemma Spy_see_shrK [simp]:\n     \"evs \\<in> kerbIV_gets \\<Longrightarrow> (Key (shrK A) \\<in> parts (spies evs)) = (A \\<in> bad)\"\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\napply (blast+)\ndone\n\nlemma Spy_analz_shrK [simp]:\n     \"evs \\<in> kerbIV_gets \\<Longrightarrow> (Key (shrK A) \\<in> analz (spies evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"\\<lbrakk> Key (shrK A) \\<in> parts (spies evs);  evs \\<in> kerbIV_gets \\<rbrakk> \\<Longrightarrow> A:bad\"\nby (blast dest: Spy_see_shrK)\nlemmas Spy_analz_shrK_D = analz_subset_parts [THEN subsetD, THEN Spy_see_shrK_D, dest!]\n\ntext\\<open>Nobody can have used non-existent keys!\\<close>\nlemma new_keys_not_used [simp]:\n    \"\\<lbrakk>Key K \\<notin> used evs; K \\<in> symKeys; evs \\<in> kerbIV_gets\\<rbrakk>\n     \\<Longrightarrow> K \\<notin> keysFor (parts (spies evs))\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\ntxt\\<open>Fake\\<close>\napply (force dest!: keysFor_parts_insert)\ntxt\\<open>Others\\<close>\napply (force dest!: analz_shrK_Decrypt)+\ndone\n\n(*Earlier, all protocol proofs declared this theorem.\n  But few of them actually need it! (Another is Yahalom) *)\nlemma new_keys_not_analzd:\n \"\\<lbrakk>evs \\<in> kerbIV_gets; K \\<in> symKeys; Key K \\<notin> used evs\\<rbrakk>\n  \\<Longrightarrow> K \\<notin> keysFor (analz (spies evs))\"\nby (blast dest: new_keys_not_used intro: keysFor_mono [THEN subsetD])\n\n\nsubsection\\<open>Regularity Lemmas\\<close>\ntext\\<open>These concern the form of items passed in messages\\<close>\n\ntext\\<open>Describes the form of all components sent by Kas\\<close>\n\nlemma Says_Kas_message_form:\n     \"\\<lbrakk> Says Kas A (Crypt K \\<lbrace>Key authK, Agent Peer, Number Ta, authTicket\\<rbrace>)\n           \\<in> set evs;\n         evs \\<in> kerbIV_gets \\<rbrakk> \\<Longrightarrow>  \n  K = shrK A  & Peer = Tgs &\n  authK \\<notin> range shrK & authK \\<in> authKeys evs & authK \\<in> symKeys & \n  authTicket = (Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>)\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (simp_all (no_asm) add: authKeys_def authKeys_insert)\napply blast+\ndone\n\n\nlemma SesKey_is_session_key:\n     \"\\<lbrakk> Crypt (shrK Tgs_B) \\<lbrace>Agent A, Agent Tgs_B, Key SesKey, Number T\\<rbrace>\n            \\<in> parts (spies evs); Tgs_B \\<notin> bad;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> SesKey \\<notin> range shrK\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all, blast)\ndone\n\nlemma authTicket_authentic:\n     \"\\<lbrakk> Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\n           \\<in> parts (spies evs);\n         evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n                 Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n            \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\ntxt\\<open>Fake, K4\\<close>\napply (blast+)\ndone\n\nlemma authTicket_crypt_authK:\n     \"\\<lbrakk> Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\n           \\<in> parts (spies evs);\n         evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> authK \\<in> authKeys evs\"\napply (frule authTicket_authentic, assumption)\napply (simp (no_asm) add: authKeys_def)\napply blast\ndone\n\nlemma Says_Tgs_message_form:\n     \"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n           \\<in> set evs;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n  \\<Longrightarrow> B \\<noteq> Tgs & \n      authK \\<notin> range shrK & authK \\<in> authKeys evs & authK \\<in> symKeys &\n      servK \\<notin> range shrK & servK \\<notin> authKeys evs & servK \\<in> symKeys &\n      servTicket = (Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>)\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (simp_all add: authKeys_insert authKeys_not_insert authKeys_empty authKeys_simp, blast, auto)\ntxt\\<open>Three subcases of Message 4\\<close>\napply (blast dest!: SesKey_is_session_key)\napply (blast dest: authTicket_crypt_authK)\napply (blast dest!: authKeys_used Says_Kas_message_form)\ndone\n\n\nlemma authTicket_form:\n     \"\\<lbrakk> Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         A \\<notin> bad;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n    \\<Longrightarrow> authK \\<notin> range shrK & authK \\<in> symKeys & \n        authTicket = Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Ta\\<rbrace>\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\napply blast+\ndone\n\ntext\\<open>This form holds also over an authTicket, but is not needed below.\\<close>\nlemma servTicket_form:\n     \"\\<lbrakk> Crypt authK \\<lbrace>Key servK, Agent B, Ts, servTicket\\<rbrace>\n              \\<in> parts (spies evs);\n            Key authK \\<notin> analz (spies evs);\n            evs \\<in> kerbIV_gets \\<rbrakk>\n         \\<Longrightarrow> servK \\<notin> range shrK & servK \\<in> symKeys & \n    (\\<exists>A. servTicket = Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Ts\\<rbrace>)\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all, blast)\ndone\n\ntext\\<open>Essentially the same as \\<open>authTicket_form\\<close>\\<close>\nlemma Says_kas_message_form:\n     \"\\<lbrakk> Gets A (Crypt (shrK A)\n              \\<lbrace>Key authK, Agent Tgs, Ta, authTicket\\<rbrace>) \\<in> set evs;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> authK \\<notin> range shrK & authK \\<in> symKeys & \n          authTicket =\n                  Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Ta\\<rbrace>\n          | authTicket \\<in> analz (spies evs)\"\nby (blast dest: analz_shrK_Decrypt authTicket_form\n                Gets_imp_knows_Spy [THEN analz.Inj])\n\nlemma Says_tgs_message_form:\n \"\\<lbrakk> Gets A (Crypt authK \\<lbrace>Key servK, Agent B, Ts, servTicket\\<rbrace>)\n       \\<in> set evs;  authK \\<in> symKeys;\n     evs \\<in> kerbIV_gets \\<rbrakk>\n  \\<Longrightarrow> servK \\<notin> range shrK &\n      (\\<exists>A. servTicket =\n              Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Ts\\<rbrace>)\n       | servTicket \\<in> analz (spies evs)\"\napply (frule Gets_imp_knows_Spy [THEN analz.Inj], auto)\n apply (force dest!: servTicket_form)\napply (frule analz_into_parts)\napply (frule servTicket_form, auto)\ndone\n\n\nsubsection\\<open>Authenticity theorems: confirm origin of sensitive messages\\<close>\n\nlemma authK_authentic:\n     \"\\<lbrakk> Crypt (shrK A) \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         A \\<notin> bad;  evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>)\n            \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>K4\\<close>\napply (blast dest!: authTicket_authentic [THEN Says_Kas_message_form])\ndone\n\ntext\\<open>If a certain encrypted message appears then it originated with Tgs\\<close>\nlemma servK_authentic:\n     \"\\<lbrakk> Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Key authK \\<notin> analz (spies evs);\n         authK \\<notin> range shrK;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> \\<exists>A. Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>K2\\<close>\napply blast\ntxt\\<open>K4\\<close>\napply auto\ndone\n\nlemma servK_authentic_bis:\n     \"\\<lbrakk> Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Key authK \\<notin> analz (spies evs);\n         B \\<noteq> Tgs;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> \\<exists>A. Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>K4\\<close>\napply blast\ndone\n\ntext\\<open>Authenticity of servK for B\\<close>\nlemma servTicket_authentic_Tgs:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs); B \\<noteq> Tgs;  B \\<notin> bad;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> \\<exists>authK.\n       Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts,\n                   Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\\<rbrace>)\n       \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\napply blast+\ndone\n\ntext\\<open>Anticipated here from next subsection\\<close>\nlemma K4_imp_K2:\n\"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n      \\<in> set evs;  evs \\<in> kerbIV_gets\\<rbrakk>\n   \\<Longrightarrow> \\<exists>Ta. Says Kas A\n        (Crypt (shrK A)\n         \\<lbrace>Key authK, Agent Tgs, Number Ta,\n           Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n        \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all, auto)\napply (blast dest!: Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Fst, THEN authTicket_authentic])\ndone\n\ntext\\<open>Anticipated here from next subsection\\<close>\nlemma u_K4_imp_K2:\n\"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n      \\<in> set evs; evs \\<in> kerbIV_gets\\<rbrakk>\n   \\<Longrightarrow> \\<exists>Ta. (Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n           Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n             \\<in> set evs\n          & servKlife + Ts <= authKlife + Ta)\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all, auto)\napply (blast dest!: Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Fst, THEN authTicket_authentic])\ndone\n\nlemma servTicket_authentic_Kas:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);  B \\<noteq> Tgs;  B \\<notin> bad;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n  \\<Longrightarrow> \\<exists>authK Ta.\n       Says Kas A\n         (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n            Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n        \\<in> set evs\"\nby (blast dest!: servTicket_authentic_Tgs K4_imp_K2)\n\nlemma u_servTicket_authentic_Kas:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);  B \\<noteq> Tgs;  B \\<notin> bad;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n  \\<Longrightarrow> \\<exists>authK Ta. Says Kas A (Crypt(shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n           Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n             \\<in> set evs\n           & servKlife + Ts <= authKlife + Ta\"\nby (blast dest!: servTicket_authentic_Tgs u_K4_imp_K2)\n\nlemma servTicket_authentic:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);  B \\<noteq> Tgs;  B \\<notin> bad;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> \\<exists>Ta authK.\n     Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n                   Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n       \\<in> set evs\n     & Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts,\n                   Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\\<rbrace>)\n       \\<in> set evs\"\nby (blast dest: servTicket_authentic_Tgs K4_imp_K2)\n\nlemma u_servTicket_authentic:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);  B \\<noteq> Tgs;  B \\<notin> bad;\n         evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> \\<exists>Ta authK.\n     (Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta,\n                   Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n       \\<in> set evs\n     & Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts,\n                   Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\\<rbrace>)\n       \\<in> set evs\n     & servKlife + Ts <= authKlife + Ta)\"\nby (blast dest: servTicket_authentic_Tgs u_K4_imp_K2)\n\nlemma u_NotexpiredSK_NotexpiredAK:\n     \"\\<lbrakk> \\<not> expiredSK Ts evs; servKlife + Ts <= authKlife + Ta \\<rbrakk>\n      \\<Longrightarrow> \\<not> expiredAK Ta evs\"\nby (blast dest: leI le_trans dest: leD)\n\n\nsubsection\\<open>Reliability: friendly agents send something if something else happened\\<close>\n\nlemma K3_imp_K2:\n     \"\\<lbrakk> Says A Tgs\n             \\<lbrace>authTicket, Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>, Agent B\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> \\<exists>Ta. Says Kas A (Crypt (shrK A)\n                      \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>)\n                   \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all, blast, blast)\napply (blast dest: Gets_imp_knows_Spy [THEN parts.Inj, THEN authK_authentic])\ndone\n\ntext\\<open>Anticipated here from next subsection. An authK is encrypted by one and only one Shared key. A servK is encrypted by one and only one authK.\\<close>\nlemma Key_unique_SesKey:\n     \"\\<lbrakk> Crypt K  \\<lbrace>Key SesKey,  Agent B, T, Ticket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt K' \\<lbrace>Key SesKey,  Agent B', T', Ticket'\\<rbrace>\n           \\<in> parts (spies evs);  Key SesKey \\<notin> analz (spies evs);\n         evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> K=K' & B=B' & T=T' & Ticket=Ticket'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\ntxt\\<open>Fake, K2, K4\\<close>\napply (blast+)\ndone\n\nlemma Tgs_authenticates_A:\n  \"\\<lbrakk>  Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace> \\<in> parts (spies evs); \n      Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\n           \\<in> parts (spies evs);\n      Key authK \\<notin> analz (spies evs); A \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> \\<exists> B. Says A Tgs \\<lbrace>\n          Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>,\n          Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>, Agent B \\<rbrace> \\<in> set evs\"  \napply (drule authTicket_authentic, assumption, rotate_tac 4)\napply (erule rev_mp, erule rev_mp, erule rev_mp)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [6] Gets_ticket_parts)\napply (frule_tac [9] Gets_ticket_parts)\napply (simp_all (no_asm_simp) add: all_conj_distrib)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>K2\\<close>\napply (force dest!: Crypt_imp_keysFor)\ntxt\\<open>K3\\<close>\napply (blast dest: Key_unique_SesKey)\ntxt\\<open>K5\\<close>\ntxt\\<open>If authKa were compromised, so would be authK\\<close>\napply (case_tac \"Key authKa \\<in> analz (spies evs5)\")\napply (force dest!: Gets_imp_knows_Spy [THEN analz.Inj, THEN analz.Decrypt, THEN analz.Fst])\ntxt\\<open>Besides, since authKa originated with Kas anyway...\\<close>\napply (clarify, drule K3_imp_K2, assumption, assumption)\napply (clarify, drule Says_Kas_message_form, assumption)\ntxt\\<open>...it cannot be a shared key*. Therefore @{term servK_authentic} applies. \n     Contradition: Tgs used authK as a servkey, \n     while Kas used it as an authkey\\<close>\napply (blast dest: servK_authentic Says_Tgs_message_form)\ndone\n\nlemma Says_K5:\n     \"\\<lbrakk> Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace> \\<in> parts (spies evs);\n         Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts,\n                                     servTicket\\<rbrace>) \\<in> set evs;\n         Key servK \\<notin> analz (spies evs);\n         A \\<notin> bad; B \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> Says A B \\<lbrace>servTicket, Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [6] Gets_ticket_parts)\napply (frule_tac [9] Gets_ticket_parts)\napply (simp_all (no_asm_simp) add: all_conj_distrib)\napply blast\ntxt\\<open>K3\\<close>\napply (blast dest: authK_authentic Says_Kas_message_form Says_Tgs_message_form)\ntxt\\<open>K4\\<close>\napply (force dest!: Crypt_imp_keysFor)\ntxt\\<open>K5\\<close>\napply (blast dest: Key_unique_SesKey)\ndone\n\ntext\\<open>Anticipated here from next subsection\\<close>\nlemma unique_CryptKey:\n     \"\\<lbrakk> Crypt (shrK B)  \\<lbrace>Agent A,  Agent B,  Key SesKey, T\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt (shrK B') \\<lbrace>Agent A', Agent B', Key SesKey, T'\\<rbrace>\n           \\<in> parts (spies evs);  Key SesKey \\<notin> analz (spies evs);\n         evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> A=A' & B=B' & T=T'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\ntxt\\<open>Fake, K2, K4\\<close>\napply (blast+)\ndone\n\nlemma Says_K6:\n     \"\\<lbrakk> Crypt servK (Number T3) \\<in> parts (spies evs);\n         Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts,\n                                     servTicket\\<rbrace>) \\<in> set evs;\n         Key servK \\<notin> analz (spies evs);\n         A \\<notin> bad; B \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Says B A (Crypt servK (Number T3)) \\<in> set evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts)\napply (simp_all (no_asm_simp))\napply blast\napply (force dest!: Crypt_imp_keysFor, clarify)\napply (frule Says_Tgs_message_form, assumption, clarify) (*PROOF FAILED if omitted*)\napply (blast dest: unique_CryptKey)\ndone\n\ntext\\<open>Needs a unicity theorem, hence moved here\\<close>\nlemma servK_authentic_ter:\n \"\\<lbrakk> Says Kas A\n    (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>) \\<in> set evs;\n     Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n       \\<in> parts (spies evs);\n     Key authK \\<notin> analz (spies evs);\n     evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs\"\napply (frule Says_Kas_message_form, assumption)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all, blast)\ntxt\\<open>K2 and K4 remain\\<close>\nprefer 2 apply (blast dest!: unique_CryptKey)\napply (blast dest!: servK_authentic Says_Tgs_message_form authKeys_used)\ndone\n\n\nsubsection\\<open>Unicity Theorems\\<close>\n\ntext\\<open>The session key, if secure, uniquely identifies the Ticket\n   whether authTicket or servTicket. As a matter of fact, one can read\n   also Tgs in the place of B.\\<close>\n\n\nlemma unique_authKeys:\n     \"\\<lbrakk> Says Kas A\n              (Crypt Ka \\<lbrace>Key authK, Agent Tgs, Ta, X\\<rbrace>) \\<in> set evs;\n         Says Kas A'\n              (Crypt Ka' \\<lbrace>Key authK, Agent Tgs, Ta', X'\\<rbrace>) \\<in> set evs;\n         evs \\<in> kerbIV_gets \\<rbrakk> \\<Longrightarrow> A=A' & Ka=Ka' & Ta=Ta' & X=X'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\ntxt\\<open>K2\\<close>\napply blast\ndone\n\ntext\\<open>servK uniquely identifies the message from Tgs\\<close>\nlemma unique_servKeys:\n     \"\\<lbrakk> Says Tgs A\n              (Crypt K \\<lbrace>Key servK, Agent B, Ts, X\\<rbrace>) \\<in> set evs;\n         Says Tgs A'\n              (Crypt K' \\<lbrace>Key servK, Agent B', Ts', X'\\<rbrace>) \\<in> set evs;\n         evs \\<in> kerbIV_gets \\<rbrakk> \\<Longrightarrow> A=A' & B=B' & K=K' & Ts=Ts' & X=X'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\ntxt\\<open>K4\\<close>\napply blast\ndone\n\ntext\\<open>Revised unicity theorems\\<close>\n\nlemma Kas_Unique:\n     \"\\<lbrakk> Says Kas A\n              (Crypt Ka \\<lbrace>Key authK, Agent Tgs, Ta, authTicket\\<rbrace>) \\<in> set evs;\n        evs \\<in> kerbIV_gets \\<rbrakk> \\<Longrightarrow> \n   Unique (Says Kas A (Crypt Ka \\<lbrace>Key authK, Agent Tgs, Ta, authTicket\\<rbrace>)) \n   on evs\"\napply (erule rev_mp, erule kerbIV_gets.induct, simp_all add: Unique_def)\napply blast\ndone\n\nlemma Tgs_Unique:\n     \"\\<lbrakk> Says Tgs A\n              (Crypt authK \\<lbrace>Key servK, Agent B, Ts, servTicket\\<rbrace>) \\<in> set evs;\n        evs \\<in> kerbIV_gets \\<rbrakk> \\<Longrightarrow> \n  Unique (Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Ts, servTicket\\<rbrace>)) \n  on evs\"\napply (erule rev_mp, erule kerbIV_gets.induct, simp_all add: Unique_def)\napply blast\ndone\n\n\nsubsection\\<open>Lemmas About the Predicate @{term AKcryptSK}\\<close>\n\nlemma not_AKcryptSK_Nil [iff]: \"\\<not> AKcryptSK authK servK []\"\nby (simp add: AKcryptSK_def)\n\nlemma AKcryptSKI:\n \"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, X \\<rbrace>) \\<in> set evs;\n     evs \\<in> kerbIV_gets \\<rbrakk> \\<Longrightarrow> AKcryptSK authK servK evs\"\napply (unfold AKcryptSK_def)\napply (blast dest: Says_Tgs_message_form)\ndone\n\nlemma AKcryptSK_Says [simp]:\n   \"AKcryptSK authK servK (Says S A X # evs) =\n     (Tgs = S &\n      (\\<exists>B Ts. X = Crypt authK\n                \\<lbrace>Key servK, Agent B, Number Ts,\n                  Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace> \\<rbrace>)\n     | AKcryptSK authK servK evs)\"\nby (auto simp add: AKcryptSK_def)\n\n(*A fresh authK cannot be associated with any other\n  (with respect to a given trace). *)\nlemma Auth_fresh_not_AKcryptSK:\n     \"\\<lbrakk> Key authK \\<notin> used evs; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK authK servK evs\"\napply (unfold AKcryptSK_def)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all, blast)\ndone\n\n(*A fresh servK cannot be associated with any other\n  (with respect to a given trace). *)\nlemma Serv_fresh_not_AKcryptSK:\n \"Key servK \\<notin> used evs \\<Longrightarrow> \\<not> AKcryptSK authK servK evs\"\nby (unfold AKcryptSK_def, blast)\n\nlemma authK_not_AKcryptSK:\n     \"\\<lbrakk> Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, tk\\<rbrace>\n           \\<in> parts (spies evs);  evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK K authK evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>Reception\\<close>\napply (simp add: AKcryptSK_def)\ntxt\\<open>K2: by freshness\\<close>\napply (simp add: AKcryptSK_def)\ntxt\\<open>K4\\<close>\nby (blast+)\n\ntext\\<open>A secure serverkey cannot have been used to encrypt others\\<close>\nlemma servK_not_AKcryptSK:\n \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key SK, Number Ts\\<rbrace> \\<in> parts (spies evs);\n     Key SK \\<notin> analz (spies evs);  SK \\<in> symKeys;\n     B \\<noteq> Tgs;  evs \\<in> kerbIV_gets \\<rbrakk>\n  \\<Longrightarrow> \\<not> AKcryptSK SK K evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all, blast)\ntxt\\<open>Reception\\<close>\napply (simp add: AKcryptSK_def)\ntxt\\<open>K4 splits into distinct subcases\\<close>\napply auto\ntxt\\<open>servK can't have been enclosed in two certificates\\<close>\n prefer 2 apply (blast dest: unique_CryptKey)\ntxt\\<open>servK is fresh and so could not have been used, by\n   \\<open>new_keys_not_used\\<close>\\<close>\nby (force dest!: Crypt_imp_invKey_keysFor simp add: AKcryptSK_def)\n\ntext\\<open>Long term keys are not issued as servKeys\\<close>\nlemma shrK_not_AKcryptSK:\n     \"evs \\<in> kerbIV_gets \\<Longrightarrow> \\<not> AKcryptSK K (shrK A) evs\"\napply (unfold AKcryptSK_def)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\nby (frule_tac [6] Gets_ticket_parts, auto)\n\ntext\\<open>The Tgs message associates servK with authK and therefore not with any\n  other key authK.\\<close>\nlemma Says_Tgs_AKcryptSK:\n     \"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, X \\<rbrace>)\n           \\<in> set evs;\n         authK' \\<noteq> authK;  evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK authK' servK evs\"\napply (unfold AKcryptSK_def)\nby (blast dest: unique_servKeys)\n\ntext\\<open>Equivalently\\<close>\nlemma not_different_AKcryptSK:\n     \"\\<lbrakk> AKcryptSK authK servK evs;\n        authK' \\<noteq> authK;  evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK authK' servK evs  \\<and> servK \\<in> symKeys\"\napply (simp add: AKcryptSK_def)\nby (blast dest: unique_servKeys Says_Tgs_message_form)\n\nlemma AKcryptSK_not_AKcryptSK:\n     \"\\<lbrakk> AKcryptSK authK servK evs;  evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK servK K evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts)\ntxt\\<open>Reception\\<close>\nprefer 3 apply (simp add: AKcryptSK_def)\napply (simp_all, safe)\ntxt\\<open>K4 splits into subcases\\<close>\nprefer 4 apply (blast dest!: authK_not_AKcryptSK)\ntxt\\<open>servK is fresh and so could not have been used, by\n   \\<open>new_keys_not_used\\<close>\\<close>\n prefer 2 \n apply (force dest!: Crypt_imp_invKey_keysFor simp add: AKcryptSK_def)\ntxt\\<open>Others by freshness\\<close>\nby (blast+)\n\ntext\\<open>The only session keys that can be found with the help of session keys are\n  those sent by Tgs in step K4.\\<close>\n\ntext\\<open>We take some pains to express the property\n  as a logical equivalence so that the simplifier can apply it.\\<close>\nlemma Key_analz_image_Key_lemma:\n     \"P \\<longrightarrow> (Key K \\<in> analz (Key`KK Un H)) \\<longrightarrow> (K:KK | Key K \\<in> analz H)\n      \\<Longrightarrow>\n      P \\<longrightarrow> (Key K \\<in> analz (Key`KK Un H)) = (K:KK | Key K \\<in> analz H)\"\nby (blast intro: analz_mono [THEN subsetD])\n\n\nlemma AKcryptSK_analz_insert:\n     \"\\<lbrakk> AKcryptSK K K' evs; K \\<in> symKeys; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Key K' \\<in> analz (insert (Key K) (spies evs))\"\napply (simp add: AKcryptSK_def, clarify)\nby (drule Says_imp_spies [THEN analz.Inj, THEN analz_insertI], auto)\n\nlemma authKeys_are_not_AKcryptSK:\n     \"\\<lbrakk> K \\<in> authKeys evs Un range shrK;  evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> \\<forall>SK. \\<not> AKcryptSK SK K evs \\<and> K \\<in> symKeys\"\napply (simp add: authKeys_def AKcryptSK_def)\nby (blast dest: Says_Kas_message_form Says_Tgs_message_form)\n\nlemma not_authKeys_not_AKcryptSK:\n     \"\\<lbrakk> K \\<notin> authKeys evs;\n         K \\<notin> range shrK; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> \\<forall>SK. \\<not> AKcryptSK K SK evs\"\napply (simp add: AKcryptSK_def)\nby (blast dest: Says_Tgs_message_form)\n\n\nsubsection\\<open>Secrecy Theorems\\<close>\n\ntext\\<open>For the Oops2 case of the next theorem\\<close>\nlemma Oops2_not_AKcryptSK:\n     \"\\<lbrakk> evs \\<in> kerbIV_gets;\n         Says Tgs A (Crypt authK\n                     \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n           \\<in> set evs \\<rbrakk>\n      \\<Longrightarrow> \\<not> AKcryptSK servK SK evs\"\nby (blast dest: AKcryptSKI AKcryptSK_not_AKcryptSK)\n   \ntext\\<open>Big simplification law for keys SK that are not crypted by keys in KK\n It helps prove three, otherwise hard, facts about keys. These facts are\n exploited as simplification laws for analz, and also \"limit the damage\"\n in case of loss of a key to the spy. See ESORICS98.\\<close>\nlemma Key_analz_image_Key [rule_format (no_asm)]:\n     \"evs \\<in> kerbIV_gets \\<Longrightarrow>\n      (\\<forall>SK KK. SK \\<in> symKeys & KK <= -(range shrK) \\<longrightarrow>\n       (\\<forall>K \\<in> KK. \\<not> AKcryptSK K SK evs)   \\<longrightarrow>\n       (Key SK \\<in> analz (Key`KK Un (spies evs))) =\n       (SK \\<in> KK | Key SK \\<in> analz (spies evs)))\"\napply (erule kerbIV_gets.induct)\napply (frule_tac [11] Oops_range_spies2)\napply (frule_tac [10] Oops_range_spies1)\napply (frule_tac [8] Says_tgs_message_form)\napply (frule_tac [6] Says_kas_message_form)\napply (safe del: impI intro!: Key_analz_image_Key_lemma [THEN impI])\ntxt\\<open>Case-splits for Oops1 and message 5: the negated case simplifies using\n the induction hypothesis\\<close>\napply (case_tac [12] \"AKcryptSK authK SK evsO1\")\napply (case_tac [9] \"AKcryptSK servK SK evs5\")\napply (simp_all del: image_insert\n        add: analz_image_freshK_simps AKcryptSK_Says shrK_not_AKcryptSK\n             Oops2_not_AKcryptSK Auth_fresh_not_AKcryptSK\n       Serv_fresh_not_AKcryptSK Says_Tgs_AKcryptSK Spy_analz_shrK)\n  \\<comment>\\<open>18 seconds on a 1.8GHz machine??\\<close>\ntxt\\<open>Fake\\<close> \napply spy_analz\ntxt\\<open>Reception\\<close>\napply (simp add: AKcryptSK_def)\ntxt\\<open>K2\\<close>\napply blast \ntxt\\<open>K3\\<close>\napply blast \ntxt\\<open>K4\\<close>\napply (blast dest!: authK_not_AKcryptSK)\ntxt\\<open>K5\\<close>\napply (case_tac \"Key servK \\<in> analz (spies evs5) \")\ntxt\\<open>If servK is compromised then the result follows directly...\\<close>\napply (simp (no_asm_simp) add: analz_insert_eq Un_upper2 [THEN analz_mono, THEN subsetD])\ntxt\\<open>...therefore servK is uncompromised.\\<close>\ntxt\\<open>The AKcryptSK servK SK evs5 case leads to a contradiction.\\<close>\napply (blast elim!: servK_not_AKcryptSK [THEN [2] rev_notE] del: allE ballE)\ntxt\\<open>Another K5 case\\<close>\napply blast \ntxt\\<open>Oops1\\<close>\napply simp \nby (blast dest!: AKcryptSK_analz_insert)\n\ntext\\<open>First simplification law for analz: no session keys encrypt\nauthentication keys or shared keys.\\<close>\nlemma analz_insert_freshK1:\n     \"\\<lbrakk> evs \\<in> kerbIV_gets;  K \\<in> authKeys evs Un range shrK;\n        SesKey \\<notin> range shrK \\<rbrakk>\n      \\<Longrightarrow> (Key K \\<in> analz (insert (Key SesKey) (spies evs))) =\n          (K = SesKey | Key K \\<in> analz (spies evs))\"\napply (frule authKeys_are_not_AKcryptSK, assumption)\napply (simp del: image_insert\n            add: analz_image_freshK_simps add: Key_analz_image_Key)\ndone\n\n\ntext\\<open>Second simplification law for analz: no service keys encrypt any other keys.\\<close>\nlemma analz_insert_freshK2:\n     \"\\<lbrakk> evs \\<in> kerbIV_gets;  servK \\<notin> (authKeys evs); servK \\<notin> range shrK;\n        K \\<in> symKeys \\<rbrakk>\n      \\<Longrightarrow> (Key K \\<in> analz (insert (Key servK) (spies evs))) =\n          (K = servK | Key K \\<in> analz (spies evs))\"\napply (frule not_authKeys_not_AKcryptSK, assumption, assumption)\napply (simp del: image_insert\n            add: analz_image_freshK_simps add: Key_analz_image_Key)\ndone\n\n\ntext\\<open>Third simplification law for analz: only one authentication key encrypts a certain service key.\\<close>\n\nlemma analz_insert_freshK3:\n \"\\<lbrakk> AKcryptSK authK servK evs;\n    authK' \\<noteq> authK; authK' \\<notin> range shrK; evs \\<in> kerbIV_gets \\<rbrakk>\n        \\<Longrightarrow> (Key servK \\<in> analz (insert (Key authK') (spies evs))) =\n                (servK = authK' | Key servK \\<in> analz (spies evs))\"\napply (drule_tac authK' = authK' in not_different_AKcryptSK, blast, assumption)\napply (simp del: image_insert\n            add: analz_image_freshK_simps add: Key_analz_image_Key)\ndone\n\nlemma analz_insert_freshK3_bis:\n \"\\<lbrakk> Says Tgs A\n            (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n        \\<in> set evs; \n     authK \\<noteq> authK'; authK' \\<notin> range shrK; evs \\<in> kerbIV_gets \\<rbrakk>\n        \\<Longrightarrow> (Key servK \\<in> analz (insert (Key authK') (spies evs))) =\n                (servK = authK' | Key servK \\<in> analz (spies evs))\"\napply (frule AKcryptSKI, assumption)\nby (simp add: analz_insert_freshK3)\n\ntext\\<open>a weakness of the protocol\\<close>\nlemma authK_compromises_servK:\n     \"\\<lbrakk> Says Tgs A\n              (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n           \\<in> set evs;  authK \\<in> symKeys;\n         Key authK \\<in> analz (spies evs); evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<in> analz (spies evs)\"\nby (force dest: Says_imp_spies [THEN analz.Inj, THEN analz.Decrypt, THEN analz.Fst])\n\nlemma servK_notin_authKeysD:\n     \"\\<lbrakk> Crypt authK \\<lbrace>Key servK, Agent B, Ts,\n                      Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Ts\\<rbrace>\\<rbrace>\n           \\<in> parts (spies evs);\n         Key servK \\<notin> analz (spies evs);\n         B \\<noteq> Tgs; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> servK \\<notin> authKeys evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (simp add: authKeys_def)\napply (erule kerbIV_gets.induct, analz_mono_contra)\napply (frule_tac [8] Gets_ticket_parts)\napply (frule_tac [6] Gets_ticket_parts, simp_all)\nby (blast+)\n\n\ntext\\<open>If Spy sees the Authentication Key sent in msg K2, then\n    the Key has expired.\\<close>\nlemma Confidentiality_Kas_lemma [rule_format]:\n     \"\\<lbrakk> authK \\<in> symKeys; A \\<notin> bad;  evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Says Kas A\n               (Crypt (shrK A)\n                  \\<lbrace>Key authK, Agent Tgs, Number Ta,\n          Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n            \\<in> set evs \\<longrightarrow>\n          Key authK \\<in> analz (spies evs) \\<longrightarrow>\n          expiredAK Ta evs\"\napply (erule kerbIV_gets.induct)\napply (frule_tac [11] Oops_range_spies2)\napply (frule_tac [10] Oops_range_spies1)\napply (frule_tac [8] Says_tgs_message_form)\napply (frule_tac [6] Says_kas_message_form)\napply (safe del: impI conjI impCE)\napply (simp_all (no_asm_simp) add: Says_Kas_message_form less_SucI analz_insert_eq not_parts_not_analz analz_insert_freshK1 pushes)\ntxt\\<open>Fake\\<close>\napply spy_analz\ntxt\\<open>K2\\<close>\napply blast\ntxt\\<open>K4\\<close>\napply blast\ntxt\\<open>Level 8: K5\\<close>\napply (blast dest: servK_notin_authKeysD Says_Kas_message_form intro: less_SucI)\ntxt\\<open>Oops1\\<close>\napply (blast dest!: unique_authKeys intro: less_SucI)\ntxt\\<open>Oops2\\<close>\nby (blast dest: Says_Tgs_message_form Says_Kas_message_form)\n\nlemma Confidentiality_Kas:\n     \"\\<lbrakk> Says Kas A\n              (Crypt Ka \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>)\n           \\<in> set evs;\n         \\<not> expiredAK Ta evs;\n         A \\<notin> bad;  evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Key authK \\<notin> analz (spies evs)\"\nby (blast dest: Says_Kas_message_form Confidentiality_Kas_lemma)\n\ntext\\<open>If Spy sees the Service Key sent in msg K4, then\n    the Key has expired.\\<close>\n\nlemma Confidentiality_lemma [rule_format]:\n     \"\\<lbrakk> Says Tgs A\n            (Crypt authK\n               \\<lbrace>Key servK, Agent B, Number Ts,\n                 Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\\<rbrace>)\n           \\<in> set evs;\n        Key authK \\<notin> analz (spies evs);\n        servK \\<in> symKeys;\n        A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<in> analz (spies evs) \\<longrightarrow>\n          expiredSK Ts evs\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply (rule_tac [10] impI)+\n  \\<comment>\\<open>The Oops1 case is unusual: must simplify\n    @{term \"Authkey \\<notin> analz (spies (ev#evs))\"}, not letting\n   \\<open>analz_mono_contra\\<close> weaken it to\n   @{term \"Authkey \\<notin> analz (spies evs)\"},\n  for we then conclude @{term \"authK \\<noteq> authKa\"}.\\<close>\napply analz_mono_contra\napply (frule_tac [11] Oops_range_spies2)\napply (frule_tac [10] Oops_range_spies1)\napply (frule_tac [8] Says_tgs_message_form)\napply (frule_tac [6] Says_kas_message_form)\napply (safe del: impI conjI impCE)\napply (simp_all add: less_SucI new_keys_not_analzd Says_Kas_message_form Says_Tgs_message_form analz_insert_eq not_parts_not_analz analz_insert_freshK1 analz_insert_freshK2 analz_insert_freshK3_bis pushes)\ntxt\\<open>Fake\\<close>\napply spy_analz\ntxt\\<open>K2\\<close>\napply (blast intro: parts_insertI less_SucI)\ntxt\\<open>K4\\<close>\napply (blast dest: authTicket_authentic Confidentiality_Kas)\ntxt\\<open>Oops2\\<close>\n  prefer 3\n  apply (blast dest: Says_imp_spies [THEN parts.Inj] Key_unique_SesKey intro: less_SucI)\ntxt\\<open>Oops1\\<close>\n prefer 2\napply (blast dest: Says_Kas_message_form Says_Tgs_message_form intro: less_SucI)\ntxt\\<open>K5. Not clear how this step could be integrated with the main\n       simplification step. Done in KerberosV.thy\\<close>\napply clarify\napply (erule_tac V = \"Says Aa Tgs X \\<in> set evs\" for X evs in thin_rl)\napply (frule Gets_imp_knows_Spy [THEN parts.Inj, THEN servK_notin_authKeysD])\napply (assumption, assumption, blast, assumption)\napply (simp add: analz_insert_freshK2)\napply (blast dest: Key_unique_SesKey intro: less_SucI)\ndone\n\n\ntext\\<open>In the real world Tgs can't check wheter authK is secure!\\<close>\nlemma Confidentiality_Tgs:\n     \"\\<lbrakk> Says Tgs A\n              (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n           \\<in> set evs;\n         Key authK \\<notin> analz (spies evs);\n         \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<notin> analz (spies evs)\"\nby (blast dest: Says_Tgs_message_form Confidentiality_lemma)\n\ntext\\<open>In the real world Tgs CAN check what Kas sends!\\<close>\nlemma Confidentiality_Tgs_bis:\n     \"\\<lbrakk> Says Kas A\n               (Crypt Ka \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>)\n           \\<in> set evs;\n         Says Tgs A\n              (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n           \\<in> set evs;\n         \\<not> expiredAK Ta evs; \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<notin> analz (spies evs)\"\nby (blast dest!: Confidentiality_Kas Confidentiality_Tgs)\n\ntext\\<open>Most general form\\<close>\nlemmas Confidentiality_Tgs_ter = authTicket_authentic [THEN Confidentiality_Tgs_bis]\n\nlemmas Confidentiality_Auth_A = authK_authentic [THEN Confidentiality_Kas]\n\ntext\\<open>Needs a confidentiality guarantee, hence moved here.\n      Authenticity of servK for A\\<close>\nlemma servK_authentic_bis_r:\n     \"\\<lbrakk> Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredAK Ta evs; A \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow>Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs\"\nby (blast dest: authK_authentic Confidentiality_Auth_A servK_authentic_ter)\n\nlemma Confidentiality_Serv_A:\n     \"\\<lbrakk> Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredAK Ta evs; \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<notin> analz (spies evs)\"\nby (metis Confidentiality_Auth_A Confidentiality_Tgs K4_imp_K2 authK_authentic authTicket_form servK_authentic unique_authKeys)\n\n(*deleted Confidentiality_B, which was identical to Confidentiality_Serv_A*)\n\nlemma u_Confidentiality_B:\n     \"\\<lbrakk> Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>\n           \\<in> parts (spies evs);\n         \\<not> expiredSK Ts evs;\n         A \\<notin> bad;  B \\<notin> bad;  B \\<noteq> Tgs; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Key servK \\<notin> analz (spies evs)\"\nby (blast dest: u_servTicket_authentic u_NotexpiredSK_NotexpiredAK Confidentiality_Tgs_bis)\n\n\n\nsubsection\\<open>2. Parties' strong authentication: \n       non-injective agreement on the session key. The same guarantees also\n       express key distribution, hence their names\\<close>\n\ntext\\<open>Authentication here still is weak agreement - of B with A\\<close>\nlemma A_authenticates_B:\n     \"\\<lbrakk> Crypt servK (Number T3) \\<in> parts (spies evs);\n         Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>\n           \\<in> parts (spies evs);\n         Key authK \\<notin> analz (spies evs); Key servK \\<notin> analz (spies evs);\n         A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n      \\<Longrightarrow> Says B A (Crypt servK (Number T3)) \\<in> set evs\"\nby (blast dest: authK_authentic servK_authentic Says_Kas_message_form Key_unique_SesKey K4_imp_K2 intro: Says_K6)\n\n(*These two have never been proved, because never were they needed before!*)\nlemma shrK_in_initState_Server[iff]:  \"Key (shrK A) \\<in> initState Kas\"\nby (induct_tac \"A\", auto)\n\nlemma shrK_in_knows_Server [iff]: \"Key (shrK A) \\<in> knows Kas evs\"\nby (simp add: initState_subset_knows [THEN subsetD])\n(*Because of our simple model of Tgs, the equivalent for it required an axiom*)\n\n\nlemma A_authenticates_and_keydist_to_Kas:\n   \"\\<lbrakk> Gets A (Crypt (shrK A) \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>) \\<in> set evs;\n      A \\<notin> bad;  evs \\<in> kerbIV_gets \\<rbrakk>\n  \\<Longrightarrow> Says Kas A (Crypt (shrK A) \\<lbrace>Key authK, Peer, Ta, authTicket\\<rbrace>) \\<in> set evs\n  \\<and> Key authK \\<in> analz(knows Kas evs)\"\nby (force dest!: authK_authentic Says_imp_knows [THEN analz.Inj, THEN analz.Decrypt, THEN analz.Fst])\n\n\nlemma K3_imp_Gets_evs:\n  \"\\<lbrakk> Says A Tgs \\<lbrace>Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>,\n                 Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>, Agent B\\<rbrace> \n      \\<in> set evs;  A \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow>  Gets A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, \n                 Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>\\<rbrace>)\n       \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply auto\napply (blast dest: authTicket_form)\ndone\n\nlemma Tgs_authenticates_and_keydist_to_A:\n  \"\\<lbrakk>  Gets Tgs \\<lbrace>\n          Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>,\n          Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>, Agent B \\<rbrace> \\<in> set evs;\n      Key authK \\<notin> analz (spies evs); A \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> \\<exists> B. Says A Tgs \\<lbrace>\n          Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>,\n          Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>, Agent B \\<rbrace> \\<in> set evs\n \\<and>  Key authK \\<in> analz (knows A evs)\"  \napply (frule Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Fst], assumption)\napply (drule Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Snd, THEN parts.Fst], assumption)\napply (drule Tgs_authenticates_A, assumption+, simp)\napply (force dest!: K3_imp_Gets_evs Gets_imp_knows [THEN analz.Inj, THEN analz.Decrypt, THEN analz.Fst])\ndone\n\nlemma K4_imp_Gets:\n  \"\\<lbrakk> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs; evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> \\<exists> Ta X. \n     Gets Tgs \\<lbrace>Crypt (shrK Tgs) \\<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\\<rbrace>, X\\<rbrace>\n       \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply auto\ndone\n\nlemma A_authenticates_and_keydist_to_Tgs:\n \"\\<lbrakk>  Gets A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>)\n       \\<in> set evs;\n     Gets A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs;\n     Key authK \\<notin> analz (spies evs); A \\<notin> bad;\n     evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> Says Tgs A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>)\n       \\<in> set evs\n  \\<and> Key authK \\<in> analz (knows Tgs evs)\n  \\<and> Key servK \\<in> analz (knows Tgs evs)\"\napply (drule Gets_imp_knows_Spy [THEN parts.Inj], assumption)\napply (drule Gets_imp_knows_Spy [THEN parts.Inj], assumption)\napply (frule authK_authentic, assumption+)\napply (drule servK_authentic_ter, assumption+)\napply (frule K4_imp_Gets, assumption, erule exE, erule exE)\napply (drule Gets_imp_knows [THEN analz.Inj, THEN analz.Fst, THEN analz.Decrypt, THEN analz.Snd, THEN analz.Snd, THEN analz.Fst], assumption, force)\napply (metis Says_imp_knows analz.Fst analz.Inj analz_symKeys_Decrypt authTicket_form)\ndone\n\nlemma K5_imp_Gets:\n  \"\\<lbrakk> Says A B \\<lbrace>servTicket, Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>\\<rbrace> \\<in> set evs;\n    A \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> \\<exists> authK Ts authTicket T2.\n    Gets A (Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>) \\<in> set evs\n \\<and> Says A Tgs \\<lbrace>authTicket, Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>, Agent B\\<rbrace>  \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply auto\ndone \n\nlemma K3_imp_Gets:\n  \"\\<lbrakk> Says A Tgs \\<lbrace>authTicket, Crypt authK \\<lbrace>Agent A, Number T2\\<rbrace>, Agent B\\<rbrace>\n       \\<in> set evs;\n    A \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> \\<exists> Ta. Gets A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>) \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply auto\ndone \n\nlemma B_authenticates_and_keydist_to_A:\n     \"\\<lbrakk> Gets B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>,\n                Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>\\<rbrace> \\<in> set evs;\n        Key servK \\<notin> analz (spies evs);\n        A \\<notin> bad; B \\<notin> bad; B \\<noteq> Tgs; evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> Says A B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>,\n               Crypt servK \\<lbrace>Agent A, Number T3\\<rbrace>\\<rbrace> \\<in> set evs\n  \\<and> Key servK \\<in> analz (knows A evs)\"\napply (frule Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Fst, THEN servTicket_authentic_Tgs], assumption+)  \napply (drule Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Snd], assumption)\napply (erule exE, drule Says_K5, assumption+)\napply (frule K5_imp_Gets, assumption+)\napply clarify\napply (drule K3_imp_Gets, assumption+)\napply (erule exE)\napply (frule Gets_imp_knows_Spy [THEN parts.Inj, THEN authK_authentic, THEN Says_Kas_message_form], assumption+, clarify)\napply (force dest!: Gets_imp_knows [THEN analz.Inj, THEN analz.Decrypt, THEN analz.Fst])\ndone\n\n\nlemma K6_imp_Gets:\n  \"\\<lbrakk> Says B A (Crypt servK (Number T3)) \\<in> set evs;\n     B \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n\\<Longrightarrow> \\<exists> Ts X. Gets B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Agent B, Key servK, Number Ts\\<rbrace>,X\\<rbrace>\n       \\<in> set evs\"\napply (erule rev_mp)\napply (erule kerbIV_gets.induct)\napply auto\ndone\n\n\nlemma A_authenticates_and_keydist_to_B:\n  \"\\<lbrakk> Gets A \\<lbrace>Crypt authK \\<lbrace>Key servK, Agent B, Number Ts, servTicket\\<rbrace>,\n             Crypt servK (Number T3)\\<rbrace> \\<in> set evs;\n     Gets A (Crypt (shrK A) \\<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\\<rbrace>)\n           \\<in> set evs;\n     Key authK \\<notin> analz (spies evs); Key servK \\<notin> analz (spies evs);\n     A \\<notin> bad;  B \\<notin> bad; evs \\<in> kerbIV_gets \\<rbrakk>\n \\<Longrightarrow> Says B A (Crypt servK (Number T3)) \\<in> set evs \n   \\<and> Key servK \\<in> analz (knows B evs)\"\napply (frule Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Fst], assumption)\napply (drule Gets_imp_knows_Spy [THEN parts.Inj, THEN parts.Snd], assumption)\napply (drule Gets_imp_knows_Spy [THEN parts.Inj], assumption)\napply (drule A_authenticates_B, assumption+)\napply (force dest!: K6_imp_Gets Gets_imp_knows [THEN analz.Inj, THEN analz.Fst, THEN analz.Decrypt, THEN analz.Snd, THEN analz.Snd, THEN analz.Fst])\ndone\n\nend\n\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Auth/KerberosIV_Gets.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7185943925708561, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.3229310271890207}}
{"text": "theory List_Copy\n  imports\n    Arl_Ext\n    \"../Separation_Logic_Solver/Methods\"\nbegin\n\n\nlocale arl_copy =\n  fixes\n    ai_type :: \"'ai :: llvm_rep itself\" and\n    el_assn :: \"('a, 'ai) dr_assn\" and\n    el_copy :: \"'ai \\<Rightarrow> 'ai llM\"\n  assumes\n    el_copy_rule [vcg_rules]:\n    \"llvm_htriple (\\<upharpoonleft>el_assn a ai) (el_copy ai) (\\<lambda>copied. \\<upharpoonleft>el_assn a ai ** \\<upharpoonleft>el_assn a copied)\"\nbegin\n\n\nunbundle monad_syntax_M\n\n\npartial_function (M) arl_copy' ::\n  \"('ai, 'l::len2) array_list \\<Rightarrow> ('ai, 'l) array_list \\<Rightarrow> 'l word \\<Rightarrow> unit llM\" where\n  \"arl_copy' xs ys i =\n  do {\n    len \\<leftarrow> arl_len xs;\n    le \\<leftarrow> ll_icmp_ult i len;\n    if le = 1\n    then do {\n      el \\<leftarrow> arl_nth xs i;\n      copied \\<leftarrow> el_copy el;\n      arl_upd ys i copied;\n      ip1 \\<leftarrow> ll_add i 1;\n      arl_copy' xs ys ip1\n    }\n    else return ()\n  }\"\n\n\n\nlemma STATE_pure_partI:\n  \"STATE asf P s \\<Longrightarrow> pure_part P\"\n  unfolding STATE_def pure_part_def by blast\n\n\nlemma STATE_pure_partE:\n  \"\\<lbrakk>STATE asf P s; pure_part P \\<Longrightarrow> T\\<rbrakk> \\<Longrightarrow> T\"\n  using STATE_pure_partI by blast\n\n\nlemma arl_copy'_rule:\n  \"\n  llvm_htriple\n  (\n    \\<upharpoonleft>snat.assn i ii **\n    arl_elem_assn el_assn xs xsi **\n    \\<upharpoonleft>(list_assn el_assn Map.empty) (take i xs) (take i ys') **\n    \\<upharpoonleft>arl_assn ys' ysi **\n    \\<up>(length ys' = length xs)\n  )\n  (arl_copy' xsi ysi ii)\n  (\\<lambda>_.\n    arl_elem_assn el_assn xs xsi ** arl_elem_assn el_assn xs ysi)\n\"\n  unfolding arl_elem_assn_def'\nproof(induction \"length xs - i\" arbitrary: i ii ys')\n  case 0\n  hence \"i \\<ge> length xs\" by simp\n  then show ?case\n    apply (subst arl_copy'.simps)\n    unfolding arl_elem_assn_def'\n    apply vcg\n    subgoal (*contradiction*)\n      apply (erule STATE_pure_partE)\n      apply (star \\<open>erule conjE | drule pure_part_split_conj\\<close>)\n      using list_assn_pure_partD by fastforce\n\n    subgoal by vcg\n    done\nnext\n  case (Suc x)\n  note Suc(1)[vcg_rules]\n  show ?case\n    apply (subst arl_copy'.simps)\n    unfolding arl_elem_assn_def'\n    apply vcg\n    subgoal for asf r sa\n      apply vcg_rl\n       apply vcg_compat\n      using Suc(2) apply - apply (sepwith simp)\n      apply vcg_solve\n      apply vcg\n      apply vcg_rl\n        apply vcg_compat\n        apply (isep_rule rule: pure_pure_asm_prefixI, simp)\n        apply sep \n         apply (simp add: list_update_append take_update_last take_Suc_conv_app_nth)\n        apply sepE\n         apply simp\n\n        apply (isep_drule drule: list_assn_push_back)\n        apply (drule list_assn_pure_partD)+\n        apply (simp add: list_update_append take_update_last take_Suc_conv_app_nth)\n        apply sep\n       apply auto\n      apply vcg_solve+\n done\n    subgoal\n      apply vcg\n      apply vcg_compat\n      apply sepE\n      apply (auto dest!: list_assn_pure_partD)\n      done\n    done\nqed\n\n\ndefinition arl_copy ::\n  \"('ai, 'l::len2) array_list \\<Rightarrow> ('ai, 'l) array_list llM\" where\n  \"arl_copy xs =\n  do {\n    len \\<leftarrow> arl_len xs;\n    ys \\<leftarrow> arl_new_sz TYPE('ai) len;\n    arl_copy' xs ys 0;\n    return ys\n  }\"\n\n\nlemmas arl_copy'.simps[llvm_code]\nlemmas arl_copy_def[llvm_code]\n\n\nlemma snat_assn_z_z:  \n  \"\\<box> \\<turnstile>\\<upharpoonleft>snat.assn 0 0\"\n  by (simp add: prepare_pure_assn snat.assn_pure snat_z_z_init)\n\n\nlemma arl_copy_rule [vcg_rules]:\n  \"\n  llvm_htriple\n  (arl_elem_assn el_assn xs (xsi::('ai, 'l::len2) array_list) ** \\<up>(LENGTH('l) > 4))\n  (arl_copy xsi)\n  (\\<lambda>arl_copy. arl_elem_assn el_assn xs xsi ** arl_elem_assn el_assn xs arl_copy)\n\"\n  supply arl_copy'_rule[vcg_rules]\n  apply (subst arl_copy_def)\n  apply vcg\n  apply vcg_rl\n   apply vcg_compat\n   apply isep_extract_pure\n   apply (sepE isep_intro: snat_assn_z_z)\n    apply (auto dest: list_assn_pure_partD)[]\n   apply simp\n   apply (sepE isep_intro: list_assn_empty)\n  apply vcg_solve\n  apply vcg\n  done\n\n\nend\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Example/List_Copy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.5039061705290806, "lm_q1q2_score": 0.32282036723073554}}
{"text": "(*  Title:      HOL/Auth/n_mutualExFsm_on_inis.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExFsm Protocol Case Study*} \n\ntheory n_mutualExFsm_on_inis imports n_mutualExFsm_on_ini\nbegin\nlemma on_inis:\n  assumes b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  shows \"formEval f s\"\n  proof -\n  have c1: \"(\\<exists> p__Inv0 p__Inv1. p__Inv0\\<le>N\\<and>p__Inv1\\<le>N\\<and>p__Inv0~=p__Inv1\\<and>f=inv__1  p__Inv0 p__Inv1)\\<or>\n    (\\<exists> p__Inv0. p__Inv0\\<le>N\\<and>f=inv__2  p__Inv0)\\<or>\n    (\\<exists> p__Inv0 p__Inv1. p__Inv0\\<le>N\\<and>p__Inv1\\<le>N\\<and>p__Inv0~=p__Inv1\\<and>f=inv__3  p__Inv0 p__Inv1)\\<or>\n    (\\<exists> p__Inv0. p__Inv0\\<le>N\\<and>f=inv__4  p__Inv0)\\<or>\n    (\\<exists> p__Inv0 p__Inv1. p__Inv0\\<le>N\\<and>p__Inv1\\<le>N\\<and>p__Inv0~=p__Inv1\\<and>f=inv__5  p__Inv0 p__Inv1)\"\n  apply (cut_tac b1, simp) done\n    moreover {\n      assume d1: \"(\\<exists> p__Inv0 p__Inv1. p__Inv0\\<le>N\\<and>p__Inv1\\<le>N\\<and>p__Inv0~=p__Inv1\\<and>f=inv__1  p__Inv0 p__Inv1)\"\n      have \"formEval f s\"\n      apply (rule iniImply_inv__1)\n      apply (cut_tac d1, assumption)\n      apply (cut_tac b2 b3, blast) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> p__Inv0. p__Inv0\\<le>N\\<and>f=inv__2  p__Inv0)\"\n      have \"formEval f s\"\n      apply (rule iniImply_inv__2)\n      apply (cut_tac d1, assumption)\n      apply (cut_tac b2 b3, blast) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> p__Inv0 p__Inv1. p__Inv0\\<le>N\\<and>p__Inv1\\<le>N\\<and>p__Inv0~=p__Inv1\\<and>f=inv__3  p__Inv0 p__Inv1)\"\n      have \"formEval f s\"\n      apply (rule iniImply_inv__3)\n      apply (cut_tac d1, assumption)\n      apply (cut_tac b2 b3, blast) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> p__Inv0. p__Inv0\\<le>N\\<and>f=inv__4  p__Inv0)\"\n      have \"formEval f s\"\n      apply (rule iniImply_inv__4)\n      apply (cut_tac d1, assumption)\n      apply (cut_tac b2 b3, blast) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> p__Inv0 p__Inv1. p__Inv0\\<le>N\\<and>p__Inv1\\<le>N\\<and>p__Inv0~=p__Inv1\\<and>f=inv__5  p__Inv0 p__Inv1)\"\n      have \"formEval f s\"\n      apply (rule iniImply_inv__5)\n      apply (cut_tac d1, assumption)\n      apply (cut_tac b2 b3, blast) done\n    }\n\n  ultimately show \"formEval f s\"\n  by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExFsm/n_mutualExFsm_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3228203672307354}}
{"text": "theory TS_Proof_Rules\nimports  TS_Model\nbegin\nlemmas [simp] = push_inv_def\n\n\nlemma CAS_Top_written_addr_post: \"cls ccs CAS\\<^sup>R[libTop, True, a , b]\\<^sub>t cls' ccs'\n \\<Longrightarrow> c \\<in> written_addr cls' \\<Longrightarrow> c \\<notin> written_addr cls \\<Longrightarrow> c = b \"\n  apply(simp add: written_addr_def)\n  apply(subgoal_tac \"lib_value cls' ` lib_writes_on cls' Top = lib_value cls ` lib_writes_on cls Top \\<union> {b}\")\n   apply simp\n  apply(simp add: lib_CAS_Rel_step_def,elim exE conjE)\n  apply(case_tac \"lib_value cls (aa, ba) = a\", simp_all)\n  apply(simp add: lib_update_r_def all_updates_l lib_writes_on_def var_def tst_def lib_value_def)\n  apply safe\n  apply simp_all\n       apply auto[3]\n    apply (smt Lib.lib_write_record.select_convs(1) fst_conv image_iff mem_Collect_eq)\n   apply safe\n  apply clarsimp\n  apply (smt fresh_ts_not_in_writes fst_conv imageI less_numeral_extra(3) lib_value_def mem_Collect_eq var_def)\n  apply clarsimp\n  apply (smt fresh_ts_not_in_writes fst_conv imageI less_numeral_extra(3) lib_value_def mem_Collect_eq var_def)  \n  done\n\nlemma CAS_Top_written_addr_post2: \"cls ccs CAS\\<^sup>R[libTop, True, a , b]\\<^sub>t cls' ccs' \\<Longrightarrow>\n c \\<in> lib_value cls' `(lib_writes_on cls' Top) - {Null} \\<Longrightarrow>\n c \\<notin> lib_value cls `(lib_writes_on cls Top) - {Null} \\<Longrightarrow>  c = b \"\n  using CAS_Top_written_addr_post written_addr_def\n      by blast\n\n\nlemma failed_CAS_Top_written_addr_post: \"cls ccs CAS\\<^sup>R[libTop, False, a , b]\\<^sub>t cls' ccs'\n \\<Longrightarrow> lib_value cls' `lib_writes_on cls' Top = lib_value cls `lib_writes_on cls Top\"\n  apply(simp add: lib_CAS_Rel_step_def,elim exE conjE)\n  apply(case_tac \"lib_value cls (aa, ba) = a\", simp_all)\n  apply(simp add: lib_read_def all_updates_l lib_writes_on_def var_def tst_def lib_value_def)\n  done\n\nlemma failed_CAS_Top_written_addr_post2: \"cls ccs CAS\\<^sup>R[libTop, False, a , b]\\<^sub>t cls' ccs'\n \\<Longrightarrow> written_addr cls' = written_addr cls\"\n  apply(simp add: written_addr_def)\n  using failed_CAS_Top_written_addr_post apply metis\n  done\n\n\nlemma diff_var_write_written_addr: \"lib_wfs cls ccs \\<Longrightarrow>\n cls ccs [lib(x) := b]\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq>Top \\<Longrightarrow> written_addr cls' = written_addr cls\"\n  apply(simp add: written_addr_def lib_write_step_def, elim exE conjE)\n  apply(simp add: lib_write_def all_updates_l lib_writes_on_def var_def tst_def lib_visible_writes_def\n      lib_valid_fresh_ts_def) \n  apply safe\n       apply simp\n  apply(simp add: lib_value_def)\n  apply linarith\n  apply linarith\n   apply(simp add: lib_value_def)\n   apply(simp add: lib_wfs_def)\n  apply(simp add: lib_write_def all_updates_l lib_writes_on_def var_def tst_def lib_visible_writes_def\n      lib_valid_fresh_ts_def) \n  apply safe\n  apply (smt image_iff mem_Collect_eq)\n  by linarith\n\n\nlemma success_CAS_Top_written_addr_post: \"cls ccs CAS\\<^sup>R[libTop, True, a , b]\\<^sub>t cls' ccs'\n \\<Longrightarrow> lib_value cls' `lib_writes_on cls' Top = lib_value cls `lib_writes_on cls Top \\<union> {b}\"\n  apply(simp add: lib_CAS_Rel_step_def,elim exE conjE)\n  apply(case_tac \"lib_value cls (aa, ba) = a\", simp_all)\n  apply(simp add: lib_update_r_def all_updates_l lib_writes_on_def var_def tst_def lib_value_def)\n  apply safe  \n     apply auto[1]\n  apply auto[1]\n  apply (smt Lib.lib_write_record.select_convs(1) a_is_x fst_conv image_iff mem_Collect_eq)\n   by (smt fresh_ts_not_in_writes image_iff mem_Collect_eq)\n\n\nlemma success_CAS_Top_written_addr_post2: \"cls ccs CAS\\<^sup>R[libTop, True, a , b]\\<^sub>t cls' ccs'\n \\<Longrightarrow> b \\<noteq> Null \\<Longrightarrow>  written_addr  cls' = written_addr cls \\<union> {b}\"\n  using success_CAS_Top_written_addr_post written_addr_def\n  by (simp add: written_addr_def insert_Diff_if)\n\n\nlemma read_value_in_written: \"cls ccs [r \\<leftarrow>\\<^sup>A lib x]\\<^sub>t cls' ccs' \\<Longrightarrow>\n r \\<in> lib_value cls ` lib_writes_on cls x\"\n  apply(simp add: lib_writes_on_def  lib_value_def lib_read_step_def lib_read_def all_updates_l, elim exE conjE)\n  by (smt image_iff lib_visible_writes_def lib_writes_on_def mem_Collect_eq)\n\n     \n\n\n\nlemma c_obs_Top_read:\n  assumes \"wfs cs\"\n      and \"lib_wfs ls cs\"\n      and \"c_obs_Top t ps cls ccs\"\n      and \"lib_read_step t' x b cls ccs cls' ccs' v \"\n    shows \"c_obs_Top t ps' cls' ccs'\"\n  using assms\n  apply(simp add: c_obs_Top_def)\n  apply(intro conjI allI impI)\n  apply(erule_tac x=ad in allE)\n  apply(subgoal_tac \"written_addr cls' = written_addr cls\")\n   defer\n     apply(simp add:  written_addr_def  , elim exE conjE)\n   apply(subgoal_tac \"lib_writes_on cls' Top = lib_writes_on cls Top\", simp)\n  apply(simp add: lib_value_def)\n  apply(subgoal_tac \"\\<forall> w . w\\<in>lib_writes_on cls Top \\<longrightarrow> lib_mods cls w = lib_mods cls' w\")\n     apply (metis (no_types, lifting) image_cong)\n    apply(intro allI impI)\n  apply(simp add: lib_read_step_def lib_read_def all_updates_l)\n    apply auto[1]\n  apply(simp add: lib_read_step_def lib_read_def all_updates_l lib_writes_on_def var_def tst_def)\n  apply auto[1]\n  apply (simp, elim conjE exE)\n  apply(rule_tac x=xa in exI)\n  apply(simp add: lib_c_obs_lib_only_def)\n  apply(simp add: lib_visible_writes_def lib_d_obs_def, intro allI impI conjI)\n    apply(simp add: lib_read_step_def lib_visible_writes_def lib_read_def all_updates_l, elim conjE exE)\n    apply(case_tac \"lib_syncing cls (aa, baa) b\", simp_all)\n     apply(simp add: lib_writes_on_def lib_lastWr_def var_def tst_def)\n  apply(unfold lib_wfs_def lib_writes_on_def var_def tst_def lib_value_def lib_lastWr_def, simp)[1]\n  apply (smt dual_order.trans fun_upd_other fun_upd_same snd_conv ts_oride_def tst_def)\n  apply(unfold lib_wfs_def lib_writes_on_def var_def tst_def lib_value_def lib_lastWr_def, simp)[1]\n  apply (smt dual_order.trans fun_upd_apply snd_conv)   \n    apply(simp add: lib_read_step_def lib_visible_writes_def lib_read_def all_updates_l, elim conjE exE)\n  apply(unfold lib_wfs_def lib_writes_on_def var_def tst_def lib_value_def lib_lastWr_def, simp)[1]\n   apply(case_tac \"lib_syncing cls (x, baa) b\", simp_all, elim conjE exE)\n  apply (smt dual_order.trans fst_conv fun_upd_other fun_upd_same snd_conv ts_oride_def tst_def)\n  apply (smt dual_order.trans fst_conv fun_upd_other fun_upd_same snd_conv ts_oride_def tst_def)\n  apply(simp add: lib_read_step_def lib_visible_writes_def lib_read_def all_updates_l, elim conjE exE)\n  apply(unfold lib_wfs_def lib_writes_on_def var_def tst_def lib_value_def lib_lastWr_def, simp)[1]\n  apply(case_tac \"lib_syncing cls (x, baa) b\", simp_all, elim conjE exE)\n   apply(simp_all add: lib_releasing_def)  \n  apply (smt dual_order.trans fst_conv fun_upd_other fun_upd_same snd_conv ts_oride_def tst_def)\n  by (smt dual_order.trans fst_conv fun_upd_apply snd_conv)\n\nlemma c_obs_TopNxt_read:\n  assumes \"wfs cs\"\n      and \"lib_wfs ls cs\"\n      and \"c_obs_TopNxt t ps cls ccs\"\n      and \"lib_read_step t' x b cls ccs cls' ccs' v \"\n    shows \"c_obs_TopNxt t ps' cls' ccs'\"\n  using assms\n  apply(simp add: c_obs_TopNxt_def)\n  apply(intro conjI allI impI)\n  apply(erule_tac x=ad in allE)\n  apply(subgoal_tac \"written_addr cls' = written_addr cls\")\n   defer\n     apply(simp add:  written_addr_def  , elim exE conjE)\n   apply(subgoal_tac \"lib_writes_on cls' Top = lib_writes_on cls Top\", simp)\n  apply(simp add: lib_value_def)\n  apply(subgoal_tac \"\\<forall> w . w\\<in>lib_writes_on cls Top \\<longrightarrow> lib_mods cls w = lib_mods cls' w\")\n     apply (metis (no_types, lifting) image_cong)\n    apply(intro allI impI)\n  apply(simp add: lib_read_step_def lib_read_def all_updates_l)\n    apply auto[1]\n  apply(simp add: lib_read_step_def lib_read_def all_updates_l lib_writes_on_def var_def tst_def)\n  apply auto[1]\n  apply (simp, elim conjE exE)\n  apply(rule_tac x=xa in exI)\n  apply(simp add: lib_c_obs_lib_only_def)\n  apply(simp add: lib_visible_writes_def lib_d_obs_def, intro allI impI conjI)\n    apply(simp add: lib_read_step_def lib_visible_writes_def lib_read_def all_updates_l, elim conjE exE)\n    apply(case_tac \"lib_syncing cls (aa, baa) b\", simp_all)\n     apply(simp add: lib_writes_on_def lib_lastWr_def var_def tst_def)\n  apply(unfold lib_wfs_def lib_writes_on_def var_def tst_def lib_value_def lib_lastWr_def, simp)[1]\n  apply (smt dual_order.trans fun_upd_other fun_upd_same snd_conv ts_oride_def tst_def)\n  apply(unfold lib_wfs_def lib_writes_on_def var_def tst_def lib_value_def lib_lastWr_def, simp)[1]\n  \n  apply (smt dual_order.trans fun_upd_apply snd_conv)\n    apply(simp add: lib_read_step_def lib_visible_writes_def lib_read_def all_updates_l, elim conjE exE)\n  apply(unfold lib_wfs_def lib_writes_on_def var_def tst_def lib_value_def lib_lastWr_def, simp)[1]\n  apply(case_tac \"lib_syncing cls (x, baa) b\", simp_all, elim conjE exE)\n  \n  apply (smt dual_order.trans fst_conv fun_upd_other fun_upd_same snd_conv ts_oride_def tst_def)\n  apply (smt dual_order.trans fst_conv fun_upd_other fun_upd_same snd_conv ts_oride_def tst_def)\n  apply(unfold lib_wfs_def lib_writes_on_def var_def tst_def lib_value_def lib_lastWr_def, simp)[1]\n     apply(simp add: lib_read_step_def lib_visible_writes_def lib_read_def all_updates_l, elim conjE exE)\n apply(simp_all add: lib_releasing_def)\n  by (smt fun_upd_other fun_upd_same lib_writes_on_def mem_Collect_eq order.trans snd_conv ts_oride_def tst_def)\n\n\n\nlemma c_obs_Top_CASR_unsuccessful:\n  assumes \"wfs cs\"\n      and \"lib_wfs ls cs\"\n      and \"c_obs_Top t ps cls ccs\"\n      and \"cls ccs CAS\\<^sup>R[lib(x), False, u , u']\\<^sub>t' cls' ccs' \"\n    shows \"c_obs_Top t ps' cls' ccs'\"\n  using assms\n  apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply(case_tac \"lib_value cls (a, b) = u\", simp_all)\n  by (meson  c_obs_Top_read lib_read_step_def)\n\n\nlemma c_obs_TopNxt_CASR_unsuccessful:\n  assumes \"wfs cs\"\n      and \"lib_wfs ls cs\"\n      and \"c_obs_TopNxt t ps cls ccs\"\n      and \"cls ccs CAS\\<^sup>R[lib(x), False, u , u']\\<^sub>t' cls' ccs' \"\n    shows \"c_obs_TopNxt t ps' cls' ccs'\"\n  using assms\n  apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply(case_tac \"lib_value cls (a, b) = u\", simp_all)\n  by (meson  c_obs_TopNxt_read lib_read_step_def)\n\n\nlemma last_the_same1: \"lib_wfs cls als \\<Longrightarrow> w \\<in> lib_visible_writes cls t Top \\<Longrightarrow>\n       w \\<notin> lib_covered cls \\<Longrightarrow>\n       lib_valid_fresh_ts cls w ts' \\<Longrightarrow> cls' = fst (lib_update_r t w u cls ccs\n                  ts') \\<Longrightarrow> ts' < tst (lib_lastWr cls Top) \\<Longrightarrow> lib_lastWr cls' Top = lib_lastWr cls Top\"\n  apply(simp add: lib_visible_writes_def lib_valid_fresh_ts_def lib_lastWr_def lib_writes_on_def all_updates_l lib_update_r_def)\n  apply(simp add:  var_def tst_def)\n  apply safe\n  apply(subgoal_tac \"ts' < Max (snd ` {w. fst w = Top \\<and> w \\<in> lib_writes cls})\") defer\n   apply blast\n  apply(subgoal_tac \"{w. fst w = Top \\<and>\n             (w = (Top, ts') \\<or> w \\<in> lib_writes cls)} = {w. fst w = Top \\<and>\n             (w \\<in> lib_writes cls)} \\<union> {(Top, ts')}\")\n  defer\n  apply safe\n   apply simp\n  apply simp\n  apply(subgoal_tac \" Max (insert ts'\n          (snd ` {w. fst w = Top \\<and> w \\<in> lib_writes cls})) \\<in> {ts',     Max (snd ` {w. fst w = Top \\<and> w \\<in> lib_writes cls})}\")\n   defer\n  apply(subgoal_tac \"finite(snd ` {w. fst w = Top \\<and> w \\<in> lib_writes cls})\")\n  apply (metis (no_types, lifting) Max_in finite.insertI infinite_growing insertCI insertE insert_not_empty member_less_max)\n   apply(simp add: lib_wfs_def lib_writes_on_def var_def tst_def)\n  apply(subgoal_tac \"Max ((snd ` {w. fst w = Top \\<and> w \\<in> lib_writes cls}))\n    \\<noteq> ts'\") defer\n   apply linarith\n  apply simp \n   apply(simp add: lib_wfs_def lib_writes_on_def var_def tst_def)\n  apply(subgoal_tac \"ts'\\<notin> snd ` {w. fst w = Top \\<and> w \\<in> lib_writes cls}\") defer\n   apply(elim disjE)\n  apply safe\n    apply auto[1]\n   apply auto[1]\n  apply(subgoal_tac \"snd ` {w. fst w = Top \\<and> w \\<in> lib_writes cls} \\<noteq> {}\") defer\n   apply blast\n  by auto\n\nlemma last_the_same2: \"lib_wfs cls als \\<Longrightarrow> w \\<in> lib_visible_writes cls t Top \\<Longrightarrow>\n       w \\<notin> lib_covered cls \\<Longrightarrow>\n       lib_valid_fresh_ts cls w ts' \\<Longrightarrow> cls' = fst (lib_update_r t w u cls ccs\n                  ts') \\<Longrightarrow> ts' > tst (lib_lastWr cls Top) \\<Longrightarrow> lib_lastWr cls' Top = (Top, ts')\"\n  apply(simp add: lib_visible_writes_def lib_valid_fresh_ts_def lib_lastWr_def lib_writes_on_def all_updates_l lib_update_r_def)\n  apply(simp add:  var_def tst_def)\n  apply safe\n   apply(subgoal_tac \"ts' > Max (snd ` {w. fst w = Top \\<and> w \\<in> lib_writes cls})\") defer\n   apply blast\n   apply(subgoal_tac \"{w. fst w = Top \\<and> w \\<in> lib_writes cls} \\<noteq> {}\")\n   apply(subgoal_tac \"finite({w. fst w = Top \\<and> w \\<in> lib_writes cls})\")\n    apply(subgoal_tac \"{w. fst w = Top \\<and>\n             (w = (Top, ts') \\<or> w \\<in> lib_writes cls)} = {w. fst w = Top \\<and>\n             (w \\<in> lib_writes cls)} \\<union> {(Top, ts')}\")\n\n  using max_of_union apply auto[1]\n    apply(simp add: lib_wfs_def lib_writes_on_def var_def)\n  apply (simp add: writes_ts_rewrite)\n     apply(simp add: lib_wfs_def lib_writes_on_def var_def)\n  by blast\n\n\n\nlemma nxt_rel_subset: \"a \\<notin> pushed_addr ps \\<Longrightarrow> b\\<in>pushed_addr ps \n       \\<Longrightarrow>  pushed_addr ps' = pushed_addr ps \\<union> {a} \\<Longrightarrow> nxt_rel ps cls \\<subseteq> nxt_rel ps' cls\"\n  apply(simp add: nxt_rel_def)\n  by auto\n\nlemma nxt_rel_subset1: \"a\\<notin>pushed_addr ps \\<Longrightarrow>  pushed_addr ps' = pushed_addr ps  \n      \\<Longrightarrow> nxt_rel ps cls\\<subseteq> nxt_rel ps' cls\"\n  by(simp add: nxt_rel_def)\n\n\nlemma agt_add_n: \"a \\<in> pushed_addr ps \\<Longrightarrow> b\\<in>pushed_addr ps \\<Longrightarrow> \n   agt a b ps cls \\<Longrightarrow>  pushed_addr ps' = pushed_addr ps \\<union> {c} \\<Longrightarrow>\n     c\\<notin>pushed_addr ps \\<Longrightarrow> agt a b ps' cls\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls\\<subseteq> nxt_rel ps' cls\")\n  using trancl_mono apply blast\n  using nxt_rel_subset\n  by (simp add: nxt_rel_subset)\n\n\n\nlemma agt_pushed_same: \"a\\<notin>pushed_addr ps \\<Longrightarrow> agt a b ps cls \\<Longrightarrow>\n  pushed_addr ps' = pushed_addr ps \\<Longrightarrow> agt a b ps' cls\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls \\<subseteq> nxt_rel ps' cls\")\n  using trancl_mono apply blast\n  using nxt_rel_subset\n  by (simp add: nxt_rel_subset1)\n\n\n(*nxt ps' = (nxt ps) (a := b) \\<Longrightarrow>*)\nlemma agt_pushed_same2: \"agt c d ps cls \\<Longrightarrow> \n   pushed_addr ps' = pushed_addr ps \\<Longrightarrow>\n   agt c d ps' cls\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls\\<subseteq> nxt_rel ps' cls\")\n  using trancl_mono apply blast\n  using nxt_rel_subset\n  by (simp add: nxt_rel_def)\n\n\n\nlemma agt_pushed_failed_cas: \" glb_inv ps cls \\<Longrightarrow>\n               cls ccs CAS\\<^sup>R[lib a, False, u, u']\\<^sub>t cls' ccs'\\<Longrightarrow>\n               agt c d ps cls \\<Longrightarrow>  \n               same_except_for_pc_and_top ps ps' \\<Longrightarrow>\n               agt c d ps' cls'\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls \\<subseteq> nxt_rel ps' cls'\")\n   apply (simp add: nxt_rel_def)\n  apply (simp add: trancl_mono)\n  apply (simp add: nxt_rel_def)\n  apply safe\n  apply(rule_tac x= aaa in exI)\n  apply safe\n  apply(simp add: globals)\n  using failed_CAS_preserves_last by auto\n\nlemma agt_pushed_successful_cas: \" glb_inv ps cls \\<Longrightarrow>\n               cls ccs CAS\\<^sup>R[lib Top, True, u, u']\\<^sub>t cls' ccs'\\<Longrightarrow>\n               u' \\<noteq> c \\<Longrightarrow> u' \\<noteq> d \\<Longrightarrow>\n               agt c d ps cls \\<Longrightarrow>  \n               pushed_addr ps' = pushed_addr ps \\<union> {u'} \\<Longrightarrow>\n               agt c d ps' cls'\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls \\<subseteq> nxt_rel ps' cls'\")\n   apply (simp add: nxt_rel_def)\n  apply (simp add: trancl_mono)\n  apply (simp add: nxt_rel_def)\n  apply(simp add: globals)\n  by (smt Collect_mono_iff succ_CAS_preserves_last)\n\n\nlemma cls_after_new_before:\n  assumes \"(a,b)\\<in>f'\\<^sup>+\"\n      and \"(a,c)\\<notin>f'\\<^sup>+\"\n      and \"c \\<noteq> a\"\n      and \"f' = f \\<union> {(c,d)}\"\n    shows \"(a,b)\\<in>f\\<^sup>+\"\n  using assms\n  apply(induction a b rule: trancl.induct)\n   apply auto[1]\n  by (metis Un_insert_right insert_iff old.prod.inject sup_bot.right_neutral trancl.trancl_into_trancl)\n\nlemma no_nxt_no_agt: \"\\<forall> e . e\\<in>pushed_addr ps \\<longrightarrow> lib_value cls (lib_lastWr cls (Suc e)) \\<noteq> b \n\\<Longrightarrow> \\<not> agt a b ps cls\"\n  apply(simp add: agt_def clss_def nxt_rel_def)\n  apply(case_tac \"a \\<in> pushed_addr ps\")\n  apply(simp add: trancl_def )\n  apply (smt tranclp.cases)\n  apply(simp add: trancl_def )\n  using converse_tranclpE by fastforce\n\n\nlemma agt_pushed_successful_cas_before: \" glb_inv ps cls \\<Longrightarrow> to ps cls \\<Longrightarrow> glb ps cls \\<Longrightarrow>\n               cls ccs CAS\\<^sup>R[lib Top, True, u, u']\\<^sub>t cls' ccs'\\<Longrightarrow> u' \\<notin> pushed_addr ps \\<Longrightarrow>\n               u' \\<noteq> c \\<Longrightarrow> u' \\<noteq> d \\<Longrightarrow> c\\<in>pushed_addr ps \\<Longrightarrow> d\\<in>pushed_addr ps \\<Longrightarrow>\n               agt c d ps' cls' \\<Longrightarrow> \\<not>agt c u' ps' cls' \\<Longrightarrow> u' \\<noteq> Top \\<Longrightarrow> Suc u' \\<noteq> Top \\<Longrightarrow>\n               pushed_addr ps' = pushed_addr ps \\<union> {u'} \\<Longrightarrow>\n               agt c d ps cls\"\n  apply(simp add: agt_def clss_def)  \n  apply(subgoal_tac \" nxt_rel ps' cls' =  nxt_rel ps cls \\<union> {(u', lib_value cls (lib_lastWr cls (Suc (u'))))}\", simp)\n   apply (metis Un_empty_right Un_insert_right cls_after_new_before)\n  apply(simp add: nxt_rel_def)\n        apply(subgoal_tac \"\\<forall> p . p\\<in>pushed_addr ps \\<longrightarrow> lib_value cls' (lib_lastWr cls' (Suc p)) = lib_value cls (lib_lastWr cls (Suc p))\")\n   defer\n  apply(simp add: globals)\n  apply (metis succ_CAS_preserves_last)\n\n  apply safe\n  using succ_CAS_preserves_last apply auto[1]\n  defer\n     apply blast\n    using succ_CAS_preserves_last apply auto[1]\n    apply simp\n    by blast\n\n\n\n\n\nlemma aa:  \"finite (A::((nat \\<times> nat) set)) \\<Longrightarrow> A \\<noteq> {} \\<Longrightarrow> Max (snd `A) \\<in> snd `A\"\n  using Max_in by blast\n\nlemma aa1:  \"finite (A::((nat \\<times> nat) set)) \\<Longrightarrow> A \\<noteq> {} \\<Longrightarrow> Max (snd `A) \\<in> snd `A\"\n  using Max_in by blast\n\n\nlemma lib_lastWr_in_lib_writes_on: \n\"finite(lib_writes_on cls Top) \\<Longrightarrow> lib_writes_on cls Top \\<noteq> {} \\<Longrightarrow> lib_lastWr cls Top \\<in> lib_writes_on cls Top\"\n  apply(simp add: lib_lastWr_def ) \n  apply safe\n  apply(subgoal_tac \"a = Top\", simp)\n   defer\n   apply(simp add: lib_writes_on_def)\n  apply(subgoal_tac \"b \\<in> (tst ` lib_writes_on cls Top)\")\n   defer\n     apply(simp add: lib_writes_on_def var_def tst_def)\n   apply (simp add: image_iff)\n  apply(subgoal_tac \"Max (tst ` lib_writes_on cls Top) \\<notin> tst ` lib_writes_on cls Top\")\n   defer\n       apply(simp add: lib_writes_on_def var_def tst_def)\n   apply (simp add: image_iff)\n       apply(simp add: lib_writes_on_def var_def tst_def)\n  by (metis (no_types, lifting) Max_eq_iff empty_iff finite_imageI)\n\n\n\n\nlemma agt_pop_successful_cas_before3: \"lib_wfs cls ccs \\<Longrightarrow> glb_inv ps cls \\<Longrightarrow>\nglb ps cls \\<Longrightarrow> to ps cls \\<Longrightarrow>\n               cvd[lib(Top), u] cls \\<Longrightarrow>\n               cls ccs CAS\\<^sup>R[lib Top, True, u, u']\\<^sub>t cls' ccs'\\<Longrightarrow>\n               u \\<noteq> u' \\<Longrightarrow> c\\<in>pushed_addr ps \\<Longrightarrow> d\\<in>pushed_addr ps \\<Longrightarrow>\n                u \\<noteq> c \\<Longrightarrow>  u\\<noteq>d \\<Longrightarrow>\n               agt c d ps' cls' \\<Longrightarrow>\n               pushed_addr ps' = pushed_addr ps - {u} \\<Longrightarrow>\n               agt c d ps cls\"\n        apply(subgoal_tac \"lastTop cls = u\") defer\n         apply(simp add: lastTop_def lib_covered_v_def)\n         apply safe\n        apply(subgoal_tac \"\\<exists> w . w\\<in>lib_writes_on cls Top \\<and> w = lib_lastWr cls Top\")\n          apply(elim exE conjE)\n        apply(subgoal_tac \"w \\<notin> lib_covered cls\")\n           apply fastforce\n        apply(simp add: lib_wfs_def)\n          apply auto[1]\n         apply(subgoal_tac \"lib_lastWr cls Top\\<in>lib_writes_on cls Top\")\n          apply blast\n         apply(simp add: lib_wfs_def )\n        using lib_lastWr_in_lib_writes_on apply fastforce\n        apply(simp add: agt_def)\n        apply(subgoal_tac \" agt u c ps cls \\<and> agt u d ps cls\") defer\n         apply (simp add: globals to_p2_def)\n        apply(simp add: agt_def clss_def)\n        apply(subgoal_tac \"nxt_rel ps' cls' = nxt_rel ps cls - {(u, lib_value cls (lib_lastWr cls (Suc u)))}\")\n         apply (simp add: trancl_mono)\n        apply(simp add: nxt_rel_def)\n        apply(subgoal_tac \"\\<forall> p . p\\<in>pushed_addr ps \\<longrightarrow> lib_value cls' (lib_lastWr cls' (Suc p)) = lib_value cls (lib_lastWr cls (Suc p))\")\n        apply(subgoal_tac \"{(a, lib_value cls' (lib_lastWr cls' (Suc a))) |a.\n           a \\<in> pushed_addr ps \\<and> a \\<noteq> lastTop cls} = {(a, lib_value cls' (lib_lastWr cls' (Suc a))) |a.\n           a \\<in> pushed_addr ps} - {(lastTop cls, lib_value cls' (lib_lastWr cls' (Suc (lastTop cls))))} \") \n          apply(simp add: lastTop_def)\n        apply safe\n        apply blast\n        apply blast\n        apply simp\n        apply simp\n        apply blast\n        apply blast\n         apply blast\n        apply(simp add: globals)\n        by (metis succ_CAS_preserves_last)\n\n\n\nlemma agt_pushed_failed_cas_before_state: \" glb_inv ps cls \\<Longrightarrow>\n               cls ccs CAS\\<^sup>R[lib a, False, u, u']\\<^sub>t cls' ccs'\\<Longrightarrow>\n               agt c d ps' cls' \\<Longrightarrow>  \n               same_except_for_pc_and_top ps ps' \\<Longrightarrow>\n               agt c d ps cls\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls = nxt_rel ps' cls'\")\n   apply (simp add: nxt_rel_def)\n  apply (simp add: nxt_rel_def)\n  apply safe\n  apply(rule_tac x= aaa in exI)\n  apply safe\n  apply(simp add: globals)\n  using failed_CAS_preserves_last by auto\n\n\n\n\nlemma agt_pushed_same2wr: \" glb_inv ps cls \\<Longrightarrow>\na \\<notin> pushed_addr ps \\<Longrightarrow> a\\<in>addr_val ps \\<Longrightarrow>\n               cls ccs [lib a := v]\\<^sub>t cls' ccs'\\<Longrightarrow>\n               agt c d ps cls \\<Longrightarrow>  \n               same_except_for_pc_and_top ps ps' \\<Longrightarrow>\n               agt c d ps' cls'\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls \\<subseteq> nxt_rel ps' cls'\")\n   apply (simp add: nxt_rel_def)\n  apply (simp add: trancl_mono)\n  apply (simp add: nxt_rel_def)\n  apply safe\n  apply(rule_tac x= aaa in exI)\n  apply safe\n  apply(simp add: globals)\n   by (metis wr_preserves_last)\n\n\nlemma agt_pushed_same2wr_before_state: \" glb_inv ps cls \\<Longrightarrow>\n                a \\<notin> pushed_addr ps \\<Longrightarrow> a\\<in>addr_val ps \\<Longrightarrow>\n               cls ccs [lib a := v]\\<^sub>t cls' ccs'\\<Longrightarrow>\n               agt c d ps' cls' \\<Longrightarrow>  \n               same_except_for_pc_and_top ps ps' \\<Longrightarrow>\n               agt c d ps cls\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls = nxt_rel ps' cls'\")\n   apply simp\n  apply (simp add: nxt_rel_def written_addr_def globals)\n  apply safe\n  apply (metis wr_preserves_last)\n  apply (metis wr_preserves_last)\n  apply (metis wr_preserves_last)\n  by (metis wr_preserves_last)\n\n\n\nlemma agt_pushed_same2wr_nxt: \" glb_inv ps cls \\<Longrightarrow>\na \\<notin> pushed_addr ps \\<Longrightarrow> a\\<in>addr_val ps \\<Longrightarrow>\n               cls ccs [lib (a+1) := v]\\<^sub>t cls' ccs'\\<Longrightarrow>\n               agt c d ps cls \\<Longrightarrow>  \n               same_except_for_pc_and_top ps ps' \\<Longrightarrow>\n               agt c d ps' cls'\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls \\<subseteq> nxt_rel ps' cls'\")\n   apply (simp add: nxt_rel_def)\n  apply (simp add: trancl_mono)\n  apply (simp add: nxt_rel_def)\n  apply safe\n  apply(rule_tac x= aaa in exI)\n  apply safe\n  apply(simp add: globals)\n  by (metis Suc_inject wr_preserves_last)\n\n\n\nlemma agt_pushed_same2wr_nxt_before_state: \" glb_inv ps cls \\<Longrightarrow>\na \\<notin> pushed_addr ps \\<Longrightarrow> a\\<in>addr_val ps \\<Longrightarrow>\n               cls ccs [lib (a+1) := v]\\<^sub>t cls' ccs'\\<Longrightarrow>\n               agt c d ps' cls' \\<Longrightarrow>  \n               same_except_for_pc_and_top ps ps' \\<Longrightarrow>\n               agt c d ps cls\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls \\<subseteq> nxt_rel ps' cls'\")\n   apply (simp add: nxt_rel_def)\n  apply (smt Collect_cong nat.inject wr_preserves_last)\n  apply (simp add: nxt_rel_def)\n  apply safe\n  apply(rule_tac x= aaa in exI)\n  apply safe\n  apply(simp add: globals)\n  by (metis Suc_inject wr_preserves_last)\n\n\nlemma agt_pushed_same2rd: \"cls ccs [a \\<leftarrow>\\<^sup>A lib b]\\<^sub>t cls' ccs' \\<Longrightarrow>\n   agt c d ps cls \\<Longrightarrow>  pushed_addr ps' = pushed_addr ps\n \\<Longrightarrow> agt c d ps' cls'\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls \\<subseteq> nxt_rel ps' cls'\")\n  using trancl_mono apply blast\n  apply (simp add: nxt_rel_def)\n  by (simp add: rd_A_preserves_last)\n\nlemma agt_pushed_same2rd_relax: \"cls ccs [a \\<leftarrow> lib b]\\<^sub>t cls' ccs' \\<Longrightarrow>  \n agt c d ps cls \\<Longrightarrow>  pushed_addr ps' = pushed_addr ps \\<Longrightarrow> agt c d ps' cls'\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls \\<subseteq> nxt_rel ps' cls'\")\n  using trancl_mono apply blast\n  apply (simp add: nxt_rel_def)\n  by (simp add: rd_preserves_last)\n\n\nlemma agt_pushed_same2rd_before_state: \"cls ccs [a \\<leftarrow>\\<^sup>A lib b]\\<^sub>t cls' ccs' \\<Longrightarrow> \n  agt c d ps' cls' \\<Longrightarrow>  pushed_addr ps' = pushed_addr ps \\<Longrightarrow> agt c d ps cls\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls = nxt_rel ps' cls'\")\n  using trancl_mono apply blast\n  apply (simp add: nxt_rel_def)\n  by (simp add: rd_A_preserves_last)\n\nlemma agt_pushed_same2rd_relax_before_state: \"cls ccs [a \\<leftarrow> lib b]\\<^sub>t cls' ccs' \\<Longrightarrow> \n  agt c d ps' cls' \\<Longrightarrow>  pushed_addr ps' = pushed_addr ps \\<Longrightarrow> agt c d ps cls\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls = nxt_rel ps' cls'\")\n  using trancl_mono apply blast\n  apply (simp add: nxt_rel_def)\n  by (simp add: rd_preserves_last)\n\n\nlemma agt_pushed_same3: \"a\\<notin>pushed_addr ps \\<Longrightarrow>  b\\<in>pushed_addr ps \\<Longrightarrow> \n agt b c ps cls \\<Longrightarrow>  pushed_addr ps' = pushed_addr ps \\<union> {a} \\<Longrightarrow> agt b c ps' cls\"\n  apply(simp add: agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps cls\\<subseteq> nxt_rel ps' cls\")\n  using trancl_mono apply blast\n  apply(simp add: nxt_rel_def)\n  by auto\n\nlemma clss_same: \"a\\<notin>pushed_addr ps \\<Longrightarrow> pushed_addr ps' = pushed_addr ps \n      \\<Longrightarrow> clss ps' cls = clss ps cls\"\n  apply(simp add: clss_def)\n  by (metis (full_types) nxt_rel_subset1 subset_antisym)\n\n\nlemma a_not_in_pushed_nxt_rel:  \"a \\<notin> pushed_addr ps \\<Longrightarrow> (a,b)\\<notin>nxt_rel ps cls\"\n   apply(simp add: clss_def nxt_rel_def)\n  done\n\nlemma a_not_in_pushed_clss:  \"a \\<notin> pushed_addr ps \\<Longrightarrow> (a,b)\\<notin>clss ps cls\"\n  apply(simp add: clss_def)\n  by (meson a_not_in_pushed_nxt_rel tranclD)\n\n\nlemma not_dom: \"glb_inv ps cls \\<Longrightarrow>  a\\<notin>pushed_addr ps \\<Longrightarrow> a \\<noteq> Null \\<Longrightarrow> a \\<notin> Domain (nxt_rel ps cls)\"\n  apply (simp add: agt_def clss_def nxt_rel_def)\n  by auto\n\nlemma not_range: \"glb_inv ps cls \\<Longrightarrow>  a\\<notin>pushed_addr ps \\<Longrightarrow> a \\<noteq> Null \\<Longrightarrow> a \\<notin> Range (nxt_rel ps cls)\"\n  apply (simp add: agt_def globals  clss_def nxt_rel_def)\n  by auto\n\nlemma a_not_in_range: \"glb_inv ps cls \\<Longrightarrow> a \\<noteq> Null \n    \\<Longrightarrow>   a\\<notin>pushed_addr ps \\<Longrightarrow> pushed_addr ps' = pushed_addr ps \\<union> {a} \n    \\<Longrightarrow> lastNxtVal cls a \\<noteq> a \\<Longrightarrow> a\\<notin>Range (clss ps' cls)\"\n  apply (simp add:  clss_def)\n  apply (simp add:  clss_def nxt_rel_def)\n  using not_range \n  by (smt Null_def RangeE Suc_eq_plus1 glb_inv8_def globals(1) lastVal_def mem_Collect_eq neq0_conv prod.sel(2))\n\nlemma a_not_in_clss_prime: \"glb_inv ps cls \\<Longrightarrow> a \\<noteq> Null \\<Longrightarrow>  a\\<notin>pushed_addr ps \\<Longrightarrow> pushed_addr ps' = pushed_addr ps \\<union> {a} \\<Longrightarrow> lastNxtVal cls a \\<noteq> a \\<Longrightarrow> (a,a)\\<notin>clss ps' cls\"\n  by (meson Range_iff a_not_in_range)\n\n\nlemma failed_cas_preserves_clss: \"cls ccs CAS\\<^sup>R[lib(x), False, v, u]\\<^sub>t cls' ccs' \\<Longrightarrow> \n    pushed_addr ps' = pushed_addr ps \\<Longrightarrow>\n   clss ps' cls' = clss ps cls\"\n  apply(simp add: clss_def nxt_rel_def)\n  by (simp add: failed_CAS_preserves_last)\n\nlemma or_union_eq: \"finite P \\<Longrightarrow>\n        {(x, f x) | x . x\\<in>P \\<or> x = a} = insert (a, f a) {(x, f x) | x . x\\<in>P}\"\n  apply safe\n      apply simp\n    apply simp\n   apply simp\n  by simp\n\nlemma or_union_eq': \"finite (pushed_addr ps)  \\<Longrightarrow>\n  {(a, lib_value cls' (lib_lastWr cls' (Suc a))) |a.\n          a = n_val ps t \\<or> a \\<in> pushed_addr ps} =\n         insert (n_val ps t, lib_value cls' (lib_lastWr cls' (Suc (n_val ps t))))\n          {(a, lib_value cls' (lib_lastWr cls' (Suc a))) | a.\n           a \\<in> pushed_addr ps}\"\n  using or_union_eq[where a = \"n_val ps t\" and P = \"pushed_addr ps\"]\n  by blast\n\n\nlemma tc1: \"a\\<in>f \\<Longrightarrow> f' = f - {a} \\<Longrightarrow> f'\\<^sup>+\\<subseteq>f\\<^sup>+\" \n  by (simp add: subrelI trancl_mono)\n\nlemma to1: \"to ps cls \\<Longrightarrow> glb ps cls \\<Longrightarrow>\n       glb_inv ps cls \\<Longrightarrow> Null \\<notin> Domain (nxt_rel ps cls)\"\n  by (meson Domain.simps a_not_in_pushed_nxt_rel agt_def to_def to_p3_def to_p4_def)\n\nlemma to2: \"to ps cls \\<Longrightarrow> glb ps cls \\<Longrightarrow>\n       glb_inv ps cls \\<Longrightarrow> Null \\<notin> Domain (clss ps cls)\"\n  by (metis clss_def to1 trancl_domain)\n\nlemma a_nxt_null_smallest: \"to ps cls \\<Longrightarrow> glb ps cls \\<Longrightarrow>\n       glb_inv ps cls \\<Longrightarrow> a\\<in>pushed_addr ps \\<Longrightarrow> b\\<in>pushed_addr ps \\<Longrightarrow> a\\<noteq>b \\<Longrightarrow>\n       lastNxtVal cls a = Null \\<Longrightarrow> agt b a ps cls\"\n  apply(simp add: agt_def)\n  apply(subgoal_tac \"(a,Null)\\<in>clss ps cls\") defer  \n   apply (simp add: agt_def to_def to_p3_def)\n  apply(subgoal_tac \"(a, Null)\\<in>nxt_rel ps cls\") defer\n   apply(simp add: nxt_rel_def)\n  apply(subgoal_tac \"\\<forall> add. add\\<in>pushed_addr ps \\<and> add \\<noteq> a \\<longrightarrow> (add, Null)\\<notin>nxt_rel ps cls\")\n  defer apply (intro allI impI)\n   apply(simp add: nxt_rel_def globals)\n   apply (metis bot.not_eq_extremum bot_nat_def)\n  apply(simp add:  globals to_p2_def to_p3_def to_p4_def agt_def clss_def)\n  by (metis (no_types, hide_lams)  a_not_in_pushed_nxt_rel trancl.cases)\n\n\nlemma nothing_between_a_nxt: \"to ps cls \\<Longrightarrow> glb ps cls \\<Longrightarrow>\n       glb_inv ps cls \\<Longrightarrow> a\\<in>pushed_addr ps \\<Longrightarrow>\n      x\\<in>pushed_addr ps \\<Longrightarrow> agt a x ps cls \\<Longrightarrow> x\\<noteq> lastNxtVal cls a \\<Longrightarrow> x\\<noteq>a \\<Longrightarrow> agt (lastNxtVal cls a) x ps cls\"\n    apply(simp add:  globals to_p2_def to_p3_def to_p4_def)\n  apply safe\n     apply (metis a_not_in_pushed_clss agt_def )\n  by (smt Suc_eq_plus1 agt_def clss_def converse_tranclE fst_conv lastVal_def mem_Collect_eq nxt_rel_def prod.sel(2))\n\n\nlemmas to_simps = to_def to_p1_def to_p2_def to_p4_def to_p3_def\ndefinition \"rel_img r e \\<equiv> {a . (e, a)\\<in>r}\"\ndefinition \"rel_dr r e \\<equiv> {(e,a) | a . (e, a)\\<in>r}\"\n\nlemma domain_clss: \"to ps cls \\<Longrightarrow> glb ps cls \\<Longrightarrow> glb_inv ps cls\n     \\<Longrightarrow> Domain (clss ps cls) = pushed_addr ps\"\n  apply(simp add: clss_def nxt_rel_def globals )\n  apply safe\n     apply auto[1]\n  by blast\n\n\nlemma range_clss: \"to ps cls \\<Longrightarrow> glb ps cls \\<Longrightarrow> glb_inv ps cls\n     \\<Longrightarrow> Range (clss ps cls) = (pushed_addr ps \\<union> {Null}) - {lastTop cls}\"\n  apply(simp add: clss_def nxt_rel_def globals to_p2_def to_p3_def to_p4_def)\n  apply safe\n                 apply auto[2]\n               apply(simp_all) \n     apply fastforce   apply(simp add: agt_def clss_def nxt_rel_def)\n  apply (meson Range.intros trancl.cases)\n  apply (meson a_not_in_pushed_clss agt_def subset_iff)\n  apply(simp add: agt_def clss_def nxt_rel_def)\n  by (metis (mono_tags, lifting) Range.intros trancl_range)\n\n\nlemma ntop_other_stable: \n    \"t \\<noteq> ta \\<Longrightarrow> lib_pop t v ps cls ccs ps' cls' ccs' \\<Longrightarrow>\n pc ps t = L2  \\<Longrightarrow> ntop ps' ta = ntop ps ta\"\n  apply (subgoal_tac \"ta \\<noteq> t \\<longrightarrow> ntop ps' ta = ntop ps ta\")\n  apply simp\n  by (simp add: lib_pop_def)\n\nlemma read_lib_d_obs: \"lib_wfs cls ccs \\<Longrightarrow> cls ccs [ r \\<leftarrow> lib x]\\<^sub>t cls' ccs'\n \\<Longrightarrow> [lib x =\\<^sub>t n] cls \\<Longrightarrow> r = n\"\n  apply(simp add: lib_read_step_def lib_d_obs_def lib_d_obs_t_def, elim exE conjE)\n  apply(simp add: lib_read_def all_updates_l)\n  apply(case_tac \"lib_syncing cls (a, b) False\", simp_all)\n   apply (simp add: lib_syncing_def)\n  apply(simp add: lib_wfs_def lib_syncing_def lib_visible_writes_def lib_writes_on_def lib_value_def tst_def var_def lib_lastWr_def)\n  apply clarsimp\n  by (metis (mono_tags, lifting) Max.coboundedI antisym finite_imageI image_eqI mem_Collect_eq snd_conv)\n\n\nlemma l5: \"glb ps cls \\<Longrightarrow> glb_inv12 ps cls \\<Longrightarrow> glb_inv10 ps cls \\<Longrightarrow> \nglb_inv6 ps cls \\<Longrightarrow> glb_inv3 ps cls \\<Longrightarrow> glb_inv4 ps cls \\<Longrightarrow> glb_inv5 ps cls\n \\<Longrightarrow> to ps cls \\<Longrightarrow> lastTop cls \\<noteq> Null \\<Longrightarrow> lastVal cls ((lastTop cls) + 1) = Null  \\<Longrightarrow> pushed_addr ps \\<subseteq> {lastTop cls}\"\n  apply (simp add: globals  agt_def clss_def nxt_rel_def to_p3_def)\n  apply safe\n     apply simp  \n  apply(subgoal_tac \"Null\\<notin>pushed_addr ps\") defer\n   apply auto[1]\n  apply simp\n  by (smt mem_Collect_eq old.prod.inject tranclE)\n\n\nlemma Top_next_not_null: \"glb ps cls \\<Longrightarrow> to ps cls \\<Longrightarrow>  glb_inv ps cls \\<Longrightarrow> \n  e\\<in>pushed_addr ps \\<Longrightarrow> e \\<noteq> lastTop cls \\<Longrightarrow> lastTop cls \\<noteq> Null \\<Longrightarrow> \n  lastNxtVal cls (lastTop cls) \\<noteq> Null\"\n  apply(simp add: glb_inv_def)\n  using TS_Proof_Rules.l5 by auto\n\n\nlemma TopLV_Null_pushed_empty: \n  \"to ps cls \\<Longrightarrow> glb_inv ps cls \\<Longrightarrow> glb ps cls \\<Longrightarrow> lastTop cls = Null\n \\<Longrightarrow> pushed_addr ps = {}\"\n  apply (simp add: globals to_p3_def  agt_def clss_def nxt_rel_def)\n  apply safe\n  by (smt Collect_empty_eq Collect_empty_eq_bot bot_set_def empty_Collect_eq ex_in_conv exists_least_iff less_numeral_extra(3) mem_Collect_eq neq0_conv neqE not_less_zero of_nat_0_less_iff of_nat_eq_iff of_nat_less_0_iff of_nat_less_iff old.prod.exhaust old.prod.inject  singleton_conv singleton_conv2 surj_pair tranclE trancl_trans zero_less_imp_eq_int)\n\nlemma agt_order: \"agt a b ps cls \\<Longrightarrow> agt b c ps  cls \\<Longrightarrow> agt a c ps cls \"\n  apply(simp add:  agt_def clss_def nxt_rel_def)\n  done\n\n\nlemma TopLV_agt_others: \n  \"to ps cls \\<Longrightarrow> glb_inv ps cls \\<Longrightarrow> glb ps cls \\<Longrightarrow> b \\<noteq> lastTop cls \n       \\<Longrightarrow> lastTop cls \\<noteq> Null \\<Longrightarrow> b\\<in>pushed_addr ps\n       \\<Longrightarrow> agt (lastTop cls) b ps cls\"\n  apply (simp add: globals to_p3_def  agt_def clss_def nxt_rel_def)\n  apply safe\n  by (smt Collect_empty_eq Collect_empty_eq_bot bot_set_def empty_Collect_eq ex_in_conv exists_least_iff less_numeral_extra(3) mem_Collect_eq neq0_conv neqE not_less_zero of_nat_0_less_iff of_nat_eq_iff of_nat_less_0_iff of_nat_less_iff old.prod.exhaust old.prod.inject  singleton_conv singleton_conv2 surj_pair tranclE trancl_trans zero_less_imp_eq_int)\n\n\nlemma failed_CAS_R_preserves_dobs:\n  assumes \"[lib(x) =\\<^sub>t u] cls\"\n    and \"cls ccs CAS\\<^sup>R[lib(y), False, u, u']\\<^sub>t' cls' ccs'\"\n    and \"lib_wfs cls ccs\"\n    and \"wfs ccs\"\n  shows \"[lib(x) =\\<^sub>t u] cls'\"\n  using assms\n  apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply(case_tac \"lib_value cls (a, b) = u\", simp_all)\n   using failed_CASR_pres_d_obs_lib by blast\n\n\nlemma failed_cas_dobs_to:\n\"lib_wfs cls ccs \\<Longrightarrow> wfs ccs \\<Longrightarrow>\n dobs_to t ps cls ccs \\<Longrightarrow> pushed_addr ps' = pushed_addr ps \\<Longrightarrow> top ps' = top ps \\<Longrightarrow>\n cls ccs CAS\\<^sup>R[lib Top, False, u, u']\\<^sub>t' cls' ccs'\\<Longrightarrow>\n dobs_to t ps' cls' ccs'\"\n  apply(simp add: dobs_to_def same_except_for_pc_and_top_def)\n  apply(intro conjI allI impI)\n  apply(subgoal_tac \"\\<exists>vl. [libad =\\<^sub>t vl] cls\") \n  apply(elim exE, rule_tac x=vl in exI)\n  using failed_CAS_R_preserves_dobs   \n   apply (meson failed_CASR_pres_d_obs_lib)\n  apply(subgoal_tac \"agt (prog_state.top ps t) ad ps' cls' = agt (prog_state.top ps t) ad ps cls\")\n  apply blast\n   apply(simp add: agt_def clss_def)\n  apply (metis clss_def failed_cas_preserves_clss)\n   apply(simp add: agt_def clss_def)\n  by (smt clss_def failed_CASR_pres_d_obs_lib failed_cas_preserves_clss)\n\n\nlemma read_pres_last_val:\n  assumes \"wfs ccs\"\n      and \"lib_wfs cls ccs\"\n      and \"lib_read_step t' x b cls ccs cls' ccs' v \"\n    shows \"lib_value cls' (lib_lastWr cls' y) = lib_value cls (lib_lastWr cls y)\"\n  using assms\n  apply(simp add: lib_read_step_def lib_value_def lib_lastWr_def, elim exE)\n  apply(simp add: lib_read_def all_updates_l)\n  by (simp add: read_pres_writes_on_diff_var)\n\nlemma cobs_to_read_pres:\n  assumes \"wfs ccs\"\n      and \"lib_wfs cls ccs\"\n      and \"cobs_to t ps cls ccs\"\n      and \"lib_read_step t' x b cls ccs cls' ccs' v \"\n      and \"pushed_addr ps' = pushed_addr ps\"\n    shows \"cobs_to t ps' cls' ccs'\"\n  using assms\n  apply(simp add: cobs_to_def)\n  apply safe\n     apply(subgoal_tac \"\\<exists>vl. [libTop = ad1]\\<lparr>libad2 =\\<^sub>t vl \\<rparr> cls\")\n      apply(elim exE conjE)\n      apply(rule_tac x=vl in exI)\n  using lib_c_obs_lib_only_pres_read_var apply blast\n  apply(subgoal_tac \"agt ad1 ad2 ps' cls' = agt ad1 ad2 ps cls\")\n      apply simp\n     apply(simp add: agt_def clss_def nxt_rel_def)\n  apply(subgoal_tac \"{(a, lib_value cls' (lib_lastWr cls' (Suc a))) |a.\n           a \\<in> pushed_addr ps} = {(a, lib_value cls (lib_lastWr cls (Suc a))) |a.\n           a \\<in> pushed_addr ps}\")\n      apply simp\n     apply(subgoal_tac \"\\<forall> a . a\\<in>pushed_addr ps \\<longrightarrow> lib_value cls' (lib_lastWr cls' (Suc a)) = lib_value cls (lib_lastWr cls (Suc a))\")\n      apply auto[1]\n     apply safe\n     apply (simp add: read_pres_last_val)\n     apply(subgoal_tac \"\\<exists>vl. [libTop = ad1]\\<lparr>libSuc(ad2) =\\<^sub>t vl \\<rparr> cls\")\n      apply(elim exE conjE)\n      apply(rule_tac x=vl in exI)\n  using lib_c_obs_lib_only_pres_read_var apply blast\n  apply(subgoal_tac \"agt ad1 ad2 ps' cls' = agt ad1 ad2 ps cls\")\n      apply simp\n     apply(simp add: agt_def clss_def nxt_rel_def)\n  apply(subgoal_tac \"{(a, lib_value cls' (lib_lastWr cls' (Suc a))) |a.\n           a \\<in> pushed_addr ps} = {(a, lib_value cls (lib_lastWr cls (Suc a))) |a.\n           a \\<in> pushed_addr ps}\")\n      apply simp\n     apply(subgoal_tac \"\\<forall> a . a\\<in>pushed_addr ps \\<longrightarrow> lib_value cls' (lib_lastWr cls' (Suc a)) = lib_value cls (lib_lastWr cls (Suc a))\")\n      apply auto[1]\n     apply safe\n  apply (simp add: read_pres_last_val)\n using lib_c_obs_lib_only_pres_read_var apply blast\n  using lib_c_obs_lib_only_pres_read_var by blast\n\n\nlemma cobs_to_CAS_pres:\n  assumes \"wfs ccs\"\n      and \"lib_wfs cls ccs\"\n      and \"cobs_to t ps cls ccs\"\n      and \"cls ccs CAS\\<^sup>R[lib Top, False, u, u']\\<^sub>t' cls' ccs'\"\n      and \"pushed_addr ps' = pushed_addr ps\"\n    shows \"cobs_to t ps' cls' ccs'\"\n  using assms\n  apply(simp add: cobs_to_def)\n  apply safe\n     apply(subgoal_tac \"\\<exists>vl. [libTop = ad1]\\<lparr>libad2 =\\<^sub>t vl \\<rparr> cls\")\n      apply(elim exE conjE)\n      apply(rule_tac x=vl in exI)\n  using failed_CASR_pres_c_obs_lib_only apply blast\n  apply(subgoal_tac \"agt ad1 ad2 ps' cls' = agt ad1 ad2 ps cls\")\n      apply simp\n     apply(simp add: agt_def clss_def nxt_rel_def)\n  apply(subgoal_tac \"{(a, lib_value cls' (lib_lastWr cls' (Suc a))) |a.\n           a \\<in> pushed_addr ps} = {(a, lib_value cls (lib_lastWr cls (Suc a))) |a.\n           a \\<in> pushed_addr ps}\")\n      apply simp\n     apply(subgoal_tac \"\\<forall> a . a\\<in>pushed_addr ps \\<longrightarrow> lib_value cls' (lib_lastWr cls' (Suc a)) = lib_value cls (lib_lastWr cls (Suc a))\")\n      apply auto[1]\n  apply (simp add: failed_CAS_preserves_last)\n     apply(subgoal_tac \"\\<exists>vl. [libTop = ad1]\\<lparr>libSuc(ad2) =\\<^sub>t vl \\<rparr> cls\")\n      apply(elim exE conjE)\n     apply(rule_tac x=vl in exI)\n  using failed_CASR_pres_c_obs_lib_only apply auto[1]\n  apply(subgoal_tac \"agt ad1 ad2 ps' cls' = agt ad1 ad2 ps cls\")\n      apply simp\n     apply(simp add: agt_def clss_def nxt_rel_def)\n  apply(subgoal_tac \"{(a, lib_value cls' (lib_lastWr cls' (Suc a))) |a.\n           a \\<in> pushed_addr ps} = {(a, lib_value cls (lib_lastWr cls (Suc a))) |a.\n           a \\<in> pushed_addr ps}\")\n      apply simp\n     apply(subgoal_tac \"\\<forall> a . a\\<in>pushed_addr ps \\<longrightarrow> lib_value cls' (lib_lastWr cls' (Suc a)) = lib_value cls (lib_lastWr cls (Suc a))\")\n     apply auto[1]\n  using failed_CAS_preserves_last apply auto[1]\n  using failed_CASR_pres_c_obs_lib_only apply blast\n  using failed_CASR_pres_c_obs_lib_only apply blast\n  done\n\nlemma no_Top_n_written_addr: \"no_Top_n t ps cls \\<longrightarrow> n_val ps t \\<notin> written_addr cls\n        \\<and> n_nxt ps t \\<notin> written_addr cls\"\n  apply(simp add: no_Top_n_def written_addr_def)\n  by fastforce\n\nlemma pobs_cobs_same_val: \"lib_wfs cls ccs \\<Longrightarrow> wfs ccs \\<Longrightarrow> [lib(a)\\<approx>\\<^sub>t u]cls \\<Longrightarrow> [lib(a)\\<approx>\\<^sub>t' u]cls \\<Longrightarrow> [lib(a) = u]\\<lparr>lib(b) =\\<^sub>t u'\\<rparr> cls \\<Longrightarrow> [lib(a) = u]\\<lparr>lib(b) =\\<^sub>t' v'\\<rparr> cls \\<Longrightarrow> t\\<noteq>t' \\<Longrightarrow> u' = v'\"\n  by (smt lib_c_obs_lib_only_def lib_d_obs_def lib_p_obs_def)\n\n\nlemma dobs_pobs_cobs_same_val: \"lib_wfs cls ccs \\<Longrightarrow> wfs ccs \\<Longrightarrow>\n   [lib(b) =\\<^sub>t v']cls \\<Longrightarrow> [lib(a)\\<approx>\\<^sub>t u]cls \\<Longrightarrow> [lib(a) = u]\\<lparr>lib(b) =\\<^sub>t u'\\<rparr> cls  \\<Longrightarrow> u' = v'\"\n  by (smt lib_c_obs_lib_only_def lib_d_obs_def lib_d_obs_t_def lib_p_obs_def)\n\n\nlemma pobs_cobs_dobs_same_val: \"lib_wfs cls ccs \\<Longrightarrow> wfs ccs \\<Longrightarrow> [lib(a)\\<approx>\\<^sub>t u]cls \\<Longrightarrow> \n [lib(a) = u]\\<lparr>lib(b) =\\<^sub>t u'\\<rparr> cls \\<Longrightarrow> [lib(b) =\\<^sub>t' v'] cls \\<Longrightarrow> t\\<noteq>t' \\<Longrightarrow> u' = v'\"\n  by (smt lib_c_obs_lib_only_def lib_d_obs_def lib_d_obs_t_def lib_p_obs_def)\n\nlemma successful_CAS_lib_c_obs_lib_pre_same_value_pres2:\n  assumes \"wfs cs\"\n  and \"lib_wfs ls cs\" \n  and \"[lib(x) = u]\\<lparr>lib(y) =\\<^sub>t v \\<rparr> cls\"\n  and \"[lib(y) =\\<^sub>t' v] cls\"\n  and \"[lib(x) \\<approx>\\<^sub>t u] cls\"\n  and \"\\<not>[lib(x) \\<approx>\\<^sub>t' u] cls\"\n  and \"cls ccs CAS\\<^sup>R[lib(x), True, m, u]\\<^sub>t' cls' ccs'\"\n  and \"t \\<noteq> t'\"\n  and \"x \\<noteq> y\"\nshows \"[lib(x) = u]\\<lparr>lib(y) =\\<^sub>t v \\<rparr> cls'\"\n  using assms\n  apply(simp add: lib_c_obs_lib_only_def lib_visible_writes_def)\n  apply(intro allI impI conjI, elim conjE)\n  apply(simp add: lib_d_obs_def lib_d_obs_t_def)\n   apply(intro conjI, elim conjE)\n    apply(simp add: lib_CAS_Rel_step_def, elim conjE exE)\n    apply(case_tac \"lib_value cls (aa, ba) = m\", simp_all)\n    apply(simp add: lib_update_r_def all_updates_l)\n  apply safe\n  using a_is_x apply blast\n  using a_is_x apply blast\n  using a_is_x apply blast\n  apply(simp add: lib_lastWr_def)\n  using CAS_Rel_preserves_writes_on_diff_var assms(7) apply auto[1]\n  apply(simp add: lib_lastWr_def lib_writes_on_def)\n  using a_is_x apply blast\n    apply(simp add: lib_visible_writes_def lib_lastWr_def lib_writes_on_def lib_valid_fresh_ts_def tst_def var_def lib_value_def)\n  apply safe\n  apply (smt Collect_cong fst_conv)\n  using succ_CAS_preserves_last apply blast\n    apply(simp add: lib_CAS_Rel_step_def, elim conjE exE)\n    apply(case_tac \"lib_value cls (aa, ba) = m\", simp_all)\n    apply(simp add: lib_update_r_def all_updates_l lib_releasing_def)\n apply safe\n  by (smt CAS_Rel_preserves_releasing_new CAS_Rel_preserves_value_old a_is_x assms(7) fun_upd_other lib_releasing_def lib_state.ext_inject lib_state.surjective lib_state.update_convs(1) lib_state.update_convs(2) lib_state.update_convs(3) lib_state.update_convs(4) lib_state.update_convs(5) lib_visible_writes_def mem_Collect_eq ts_not_in_writes_on)\n\n\nlemma nxt_a_b_not_agt_b_a: \"glb_inv ps cls \\<Longrightarrow> to ps cls \\<Longrightarrow> a\\<in>pushed_addr ps \\<Longrightarrow> b\\<in>pushed_addr ps \\<Longrightarrow>\n lastNxtVal cls a = b \\<Longrightarrow> \\<not>agt b a ps cls\"\n  apply simp\n  apply(simp add: globals to_p2_def to_p3_def to_p4_def agt_def clss_def nxt_rel_def )\n  apply safe\n   apply (metis (no_types, lifting) trancl_trans)\n  by (metis (mono_tags, lifting) mem_Collect_eq trancl_into_trancl2)\n\n\nlemma nxt_rel_after_successful_CAS: \"glb ps cls \\<Longrightarrow> glb_inv ps cls \\<Longrightarrow> to ps cls \\<Longrightarrow> \n        cls ccs CAS\\<^sup>R[lib(Top), True, b, a]\\<^sub>t cls' ccs' \\<Longrightarrow> lib_value cls\n        (lib_lastWr cls (Suc (a))) =\n       b \\<Longrightarrow>a\\<in>addr_val ps \\<Longrightarrow> a\\<notin>pushed_addr ps \\<Longrightarrow>\n         pushed_addr ps' = pushed_addr ps \\<union> {a} \\<Longrightarrow> nxt_rel ps' cls' =\n       nxt_rel ps cls \\<union>\n       {(a, b)}\"\n  apply(simp add: nxt_rel_def globals to_simps)\n  apply safe\n  apply (metis (full_types) succ_CAS_preserves_last)\n  apply (metis (full_types) succ_CAS_preserves_last)\n  apply (metis (full_types) succ_CAS_preserves_last)\n  apply (metis (full_types) succ_CAS_preserves_last)\n  apply (metis (full_types) succ_CAS_preserves_last)\n  apply (metis (full_types) succ_CAS_preserves_last)\n  apply (metis (full_types) succ_CAS_preserves_last)\n  apply (metis (full_types) succ_CAS_preserves_last)\n  apply (metis (full_types) succ_CAS_preserves_last)\n  apply (metis (full_types) succ_CAS_preserves_last)\n  done\n\n\n\nlemma written_vals_write: \"cls ccs [lib(x) := v]\\<^sub>t cls' ccs' \\<Longrightarrow> written_vals cls' x =  written_vals cls x \\<union> {v}\"\n  apply(simp add: lib_write_step_def written_vals_def, elim exE conjE)\n  apply(simp add: lib_write_def all_updates_l lib_writes_on_def var_def tst_def lib_value_def)\n  apply safe\n     apply simp\n  apply auto[1]\n  apply (smt Lib.lib_write_record.select_convs(1) a_is_x fst_conv image_iff mem_Collect_eq)\n  by (smt fresh_ts_not_in_writes image_iff mem_Collect_eq)\n\nlemma written_vals_write_diff_var: \"cls ccs [lib(y) := v]\\<^sub>t cls' ccs' \\<Longrightarrow> x\\<noteq>y \\<Longrightarrow> written_vals cls' x =  written_vals cls x\"\n  apply(simp add: lib_write_step_def written_vals_def, elim exE conjE)\n  apply(simp add: lib_write_def all_updates_l lib_writes_on_def var_def tst_def lib_value_def)\n  apply safe\n     apply simp\n  apply auto[1]\n    apply (smt Lib.lib_write_record.select_convs(1) a_is_x fst_conv image_iff mem_Collect_eq)\n  apply (smt fresh_ts_not_in_writes image_iff mem_Collect_eq)\n  by (smt fresh_ts_not_in_writes image_iff mem_Collect_eq)\n\n\nlemma written_vals_CAS_Rel_diff_var: \"cls ccs CAS\\<^sup>R[lib(y), b, v, v']\\<^sub>t cls' ccs' \\<Longrightarrow> x\\<noteq>y \\<Longrightarrow> written_vals cls' x =  written_vals cls x\"\n  apply(simp add: lib_CAS_Rel_step_def written_vals_def, elim exE conjE)\n  apply(case_tac \"lib_value cls (a, ba) = v\", simp_all)\n  apply(simp add: lib_update_r_def all_updates_l lib_writes_on_def var_def tst_def lib_value_def)\n  apply safe\n     apply simp\n  apply auto[1]\n    apply (smt Lib.lib_write_record.select_convs(1) a_is_x fst_conv image_iff mem_Collect_eq)\n  apply (smt fresh_ts_not_in_writes image_iff mem_Collect_eq)\n    apply (smt fresh_ts_not_in_writes image_iff mem_Collect_eq)\n  apply(simp add: lib_read_def all_updates_l lib_writes_on_def var_def tst_def lib_value_def)\n  apply auto[1]\n  apply(simp add: lib_read_def all_updates_l lib_writes_on_def var_def tst_def lib_value_def)\n  apply auto[1]\n  done\n\nlemma \"no_Top_n t' ps cls \\<Longrightarrow> \\<not>[lib(Top) \\<approx>\\<^sub>t (n_val ps t')] cls\"\n  apply(simp add: no_Top_n_def)\n  by (simp add: no_Top_n_def no_Top_n_implies_no_p_obs)\n\n\n\n\n\nlemma agt_pres_diff_write:  \"cls ccs [lib(a) := b]\\<^sub>t cls' ccs' \\<Longrightarrow> a \\<notin> pushed_addr ps \\<Longrightarrow>  pushed_addr ps' = pushed_addr ps\n\\<Longrightarrow> (\\<forall> e . e\\<in>pushed_addr ps \\<longrightarrow> Suc e \\<noteq> a)\n\\<Longrightarrow> agt c d ps cls = agt c d ps' cls'\"\n  apply(simp add : agt_def clss_def)\n  apply(subgoal_tac \"nxt_rel ps' cls' = nxt_rel ps cls\")\n   apply auto[1]\n   apply(simp add: nxt_rel_def)\n  using wr_preserves_last by auto\n\n\nlemma agt_ad2_pushed_or_null: \"glb_inv ps cls \\<Longrightarrow> to ps cls \\<Longrightarrow> agt ad1 ad2 ps cls \\<Longrightarrow> ad2\\<in>pushed_addr ps \\<union> {Null}\"\n  apply(simp add: agt_def clss_def)\n  by (metis Null_def Range.intros not_range trancl_range)\n\n\nlemma agt_n_val_False: \"(\\<forall> p . p\\<in>pushed_addr ps \\<longrightarrow> lastVal cls (Suc p)  \\<noteq> ad2) \\<Longrightarrow>\n agt ad1 ad2 ps cls \\<Longrightarrow> False\"\n  apply(simp add: agt_def clss_def )\n  apply(subgoal_tac \"ad2\\<notin>Range (nxt_rel ps cls)\")\n   apply (metis Range.intros trancl_range)\n  apply(simp add: nxt_rel_def)\n  by blast\n\n\nlemma agt_ad1_not_in_pushed_False: \"ad1\\<notin>pushed_addr ps \\<Longrightarrow>\n agt ad1 ad2 ps cls \\<Longrightarrow> False\"\n  apply(simp add: agt_def clss_def nxt_rel_def)\n  by (smt Pair_inject converse_tranclE mem_Collect_eq)\n\n\n\n\nend\n", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Treiber Stack C11/TS_Proof_Rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6406358411176238, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.32282035340125825}}
{"text": "theory \"Andrew_Secure_RPC_cert_auto\"\nimports\n  \"ESPLogic\"\nbegin\n\n(* section:  Andrew Secure RPC  *)\n\n(* text: \n  Modeled after the model in the SPORE library.\n\n  Notable differences:\n\n    1. 'succ(x)' is invertible. Hence, we just model it as a tuple ('succ',x) of\n       a global constant 'succ' and the variable x.  This means that we only\n       exploit the tagging properties of 'succ', but do not assume any\n       information hiding.\n\n    2. Instead of implicit typing, we are using explicit global constants to\n       discern messages.\n\n  Note that when using a bidirectional key k[A,B] instead of the\n  uni-directional key k(A,B) that is different depending on the used direction\n  an attack becomes possible, as agreement on the agent identities is partially\n  lost. Adding the A identity in the first message fixes that flaw.\n *)\n\nrole A\nwhere \"A =\n  [ Send ''1'' <| sAV ''A'',\n                  PEnc <| sC ''1'', sN ''Na'' |> ( sK ''A'' ''B'' )\n               |>\n  , Recv ''2'' ( PEnc <| sC ''2'', <| sC ''succ'', sN ''Na'' |>, sMV ''Nb''\n                      |>\n                      ( sK ''A'' ''B'' )\n               )\n  , Send ''3'' ( PEnc <| sC ''3'', sC ''succ'', sMV ''Nb'' |>\n                      ( sK ''A'' ''B'' )\n               )\n  , Recv ''4'' ( PEnc <| sC ''4'', sMV ''Kab'', sMV ''Nbp'' |>\n                      ( sK ''A'' ''B'' )\n               )\n  ]\"\n\nrole B\nwhere \"B =\n  [ Recv ''1'' <| sMV ''A'',\n                  PEnc <| sC ''1'', sMV ''Na'' |> ( PSymK ( sMV ''A'' ) ( sAV ''B'' ) )\n               |>\n  , Send ''2'' ( PEnc <| sC ''2'', <| sC ''succ'', sMV ''Na'' |>, sN ''Nb''\n                      |>\n                      ( PSymK ( sMV ''A'' ) ( sAV ''B'' ) )\n               )\n  , Recv ''3'' ( PEnc <| sC ''3'', sC ''succ'', sN ''Nb'' |>\n                      ( PSymK ( sMV ''A'' ) ( sAV ''B'' ) )\n               )\n  , Send ''4'' ( PEnc <| sC ''4'', sN ''Kab'', sN ''Nbp'' |>\n                      ( PSymK ( sMV ''A'' ) ( sAV ''B'' ) )\n               )\n  ]\"\n\nprotocol Andrew\nwhere \"Andrew = { A, B }\"\n\nlocale restricted_Andrew_state = Andrew_state\n\ntype_invariant Andrew_msc_typing for Andrew\nwhere \"Andrew_msc_typing = mk_typing\n  [ ((B, ''A''), (KnownT B_1))\n  , ((A, ''Kab''), (SumT (KnownT A_4) (NonceT B ''Kab'')))\n  , ((B, ''Na''), (SumT (KnownT B_1) (NonceT A ''Na'')))\n  , ((A, ''Nb''), (SumT (KnownT A_2) (NonceT B ''Nb'')))\n  , ((A, ''Nbp''), (SumT (KnownT A_4) (NonceT B ''Nbp'')))\n  ]\"\n\nsublocale Andrew_state < Andrew_msc_typing_state\nproof -\n  have \"(t,r,s) : approx Andrew_msc_typing\"\n  proof(cases rule: reachable_in_approxI_ext\n        [OF Andrew_msc_typing.monoTyp, completeness_cases_rule])\n    case (A_2_Nb t r s tid0)\n    then interpret state: Andrew_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_2_Nb\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''2'', {| LC ''succ'', LN ''Na'' tid0 |}, s(MV ''Nb'' tid0) |}\n            ( K ( s(AV ''A'' tid0) ) ( s(AV ''B'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (A_4_Kab t r s tid0)\n    then interpret state: Andrew_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_4_Kab\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''4'', s(MV ''Kab'' tid0), s(MV ''Nbp'' tid0) |}\n            ( K ( s(AV ''A'' tid0) ) ( s(AV ''B'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (A_4_Nbp t r s tid0)\n    then interpret state: Andrew_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_4_Nbp\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''4'', s(MV ''Kab'' tid0), s(MV ''Nbp'' tid0) |}\n            ( K ( s(AV ''A'' tid0) ) ( s(AV ''B'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (B_1_A t r s tid0)\n    then interpret state: Andrew_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = B_1_A\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (B_1_Na t r s tid0)\n    then interpret state: Andrew_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = B_1_Na\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''1'', s(MV ''Na'' tid0) |}\n            ( K ( s(MV ''A'' tid0) ) ( s(AV ''B'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  qed\n  thus \"Andrew_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext Andrew_state begin\n\n  (* This rule is unsafe in general, but OK here, \n     as we are only reasoning about static compromise. \n  *)\n  lemma static_longterm_key_reveal[dest!]:\n    \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n    by (auto intro: compr_predOrdI)\n\n  lemma longterm_private_key_secrecy:\n    assumes facts:\n      \"SK m : knows t\"\n      \"RLKR m ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"SK m\")\n\n  lemma longterm_sym_ud_key_secrecy:\n    assumes facts:\n      \"K m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"K m1 m2\")\n\n  lemma longterm_sym_bd_key_secrecy:\n    assumes facts:\n      \"Kbd m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n      \"m1 : Agent\"\n      \"m2 : Agent\"\n    shows \"False\"\n  proof -\n    from facts \n    have \"KShr (agents {m1, m2}) : knows t\"\n      by (auto simp: Kbd_def)\n    thus ?thesis using facts\n    proof (sources \"KShr (agents {m1, m2})\")\n    qed (auto simp: agents_def Agent_def)\n  qed\n\n  lemmas ltk_secrecy =\n    longterm_sym_ud_key_secrecy\n    longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n    longterm_sym_bd_key_secrecy\n    longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n    longterm_private_key_secrecy\n    longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection:  Security Properties  *)\n\nlemma (in restricted_Andrew_state) B_sec_Kab:\n  assumes facts:\n    \"roleMap r tid0 = Some B\"\n    \"RLKR(s(AV ''B'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n    \"LN ''Kab'' tid0 : knows t\"\n  shows \"False\"\nusing facts proof(sources! \" LN ''Kab'' tid0 \")\n  case B_4_Kab note_unified facts = this facts\n  thus ?thesis by (auto dest!: ltk_secrecy)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_Andrew_state) A_sec_Kab:\n  assumes facts:\n    \"roleMap r tid0 = Some A\"\n    \"RLKR(s(AV ''A'' tid0)) ~: reveals t\"\n    \"RLKR(s(AV ''B'' tid0)) ~: reveals t\"\n    \"( tid0, A_4 ) : steps t\"\n    \"s(MV ''Kab'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''4'', s(MV ''Kab'' tid0), s(MV ''Nbp'' tid0) |}\n                       ( K ( s(AV ''A'' tid0) ) ( s(AV ''B'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (B_4_enc tid1) note_unified facts = this facts\n    thus ?thesis by (fastforce dest: B_sec_Kab intro: event_predOrdI)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_Andrew_state) A_noninjective_agreement:\n  assumes facts:\n    \"roleMap r tid1 = Some A\"\n    \"RLKR(s(AV ''A'' tid1)) ~: reveals t\"\n    \"RLKR(s(AV ''B'' tid1)) ~: reveals t\"\n    \"( tid1, A_4 ) : steps t\"\n  shows\n    \"(?  tid2.\n        roleMap r tid2 = Some B &\n        s(AV ''A'' tid1) = s(MV ''A'' tid2) &\n        s(AV ''B'' tid1) = s(AV ''B'' tid2) &\n        s(MV ''Nbp'' tid1) = LN ''Nbp'' tid2 &\n        s(MV ''Kab'' tid1) = LN ''Kab'' tid2)\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''4'', s(MV ''Kab'' tid1), s(MV ''Nbp'' tid1) |}\n                       ( K ( s(AV ''A'' tid1) ) ( s(AV ''B'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (B_4_enc tid2) note_unified facts = this facts\n    thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\n(* text: \nThe protocol does not achieve agreement over Na and Nb. They could be sent\nby a different thread also executing the B role. Hence, the B-thread that sent\nthe key Kab does not agree on anything that is fresh from the perspective of A.\nThis gives rise to the claimed attack referenced in the SPORE library.\n *)\n\nlemma (in restricted_Andrew_state) B_noninjective_agreement:\n  assumes facts:\n    \"roleMap r tid1 = Some B\"\n    \"RLKR(s(AV ''B'' tid1)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid1)) ~: reveals t\"\n    \"( tid1, B_3 ) : steps t\"\n  shows\n    \"(?  tid2.\n        roleMap r tid2 = Some A &\n        s(MV ''A'' tid1) = s(AV ''A'' tid2) &\n        s(AV ''B'' tid1) = s(AV ''B'' tid2) &\n        s(MV ''Na'' tid1) = LN ''Na'' tid2 & LN ''Nb'' tid1 = s(MV ''Nb'' tid2))\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''3'', LC ''succ'', LN ''Nb'' tid1 |}\n                       ( K ( s(MV ''A'' tid1) ) ( s(AV ''B'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (A_3_enc tid2) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''2'', {| LC ''succ'', LN ''Na'' tid2 |}, LN ''Nb'' tid1 |}\n                         ( K ( s(AV ''A'' tid2) ) ( s(AV ''B'' tid1) ) ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (auto dest!: ltk_secrecy)\n    next\n      case (B_2_enc tid3) note_unified facts = this facts\n      thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\n(* text: \nThe protocol does not achieve agreement on the key because B cannot check if it\nhas been received.\n *)\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/spore/isabelle-proofs/Andrew_Secure_RPC_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.32279637166924086}}
{"text": "subsection\\<open>Example\\<close> \ntext\\<open>This theory shows how contexts can be used to prove transition subsumption.\\<close>\ntheory Drinks_Subsumption\nimports \"Extended_Finite_State_Machine_Inference.Subsumption\" \"Extended_Finite_State_Machines.Drinks_Machine_2\"\nbegin\n\nlemma stop_at_3: \"\\<not>obtains 1 c drinks2 3 r t\"\nproof(induct t arbitrary: r)\n  case Nil\n  then show ?case\n    by (simp add: obtains_base)\nnext\n  case (Cons a t)\n  then show ?case\n    apply (case_tac a)\n    apply (simp add: obtains_step)\n    apply clarify\n    apply (simp add: in_possible_steps[symmetric])\n    by (simp add: drinks2_def)\nqed\n\nlemma no_1_2: \"\\<not>obtains 1 c drinks2 2 r t\"\nproof(induct t arbitrary: r)\n  case Nil\n  then show ?case\n    by (simp add: obtains_base)\nnext\n  case (Cons a t)\n  then show ?case\n    apply (case_tac a)\n    apply (simp add: obtains_step)\n    apply clarify\n    apply (simp add: in_possible_steps[symmetric])\n    apply (simp add: drinks2_def)\n    apply clarsimp\n    apply (simp add: drinks2_def[symmetric])\n    apply (erule disjE)\n     apply simp\n    apply (erule disjE)\n     apply simp\n    by (simp add: stop_at_3)\nqed\n\nlemma no_change_1_1: \"obtains 1 c drinks2 1 r t \\<Longrightarrow> c = r\"\nproof(induct t)\n  case Nil\n  then show ?case\n    by (simp add: obtains_base)\nnext\n  case (Cons a t)\n  then show ?case\n    apply (case_tac a)\n    apply (simp add: obtains_step)\n    apply clarify\n    apply (simp add: in_possible_steps[symmetric])\n    apply (simp add: drinks2_def)\n    apply clarsimp\n    apply (simp add: drinks2_def[symmetric])\n    apply (erule disjE)\n     apply (simp add: vend_nothing_def apply_updates_def)\n    by (simp add: no_1_2)\nqed\n\nlemma obtains_1: \"obtains 1 c drinks2 0 <> t \\<Longrightarrow> c $ 2 = Some (Num 0)\"\nproof(induct t)\n  case Nil\n  then show ?case\n    by (simp add: obtains_base)\nnext\n  case (Cons a t)\n  then show ?case\n    apply (case_tac a)\n    apply (simp add: obtains_step)\n    apply clarify\n    apply (simp add: in_possible_steps[symmetric])\n    apply (simp add: drinks2_def)\n    apply (simp add: drinks2_def[symmetric])\n    apply (simp add: select_def can_take apply_updates_def)\n    using no_change_1_1 by fastforce\nqed\n\nlemma obtains_1_1_2:\n  \"obtains 1 c1 drinks2 1 r t \\<Longrightarrow>\n   obtains 1 c2 drinks 1 r t \\<Longrightarrow>\n   c1 = r \\<and> c2 = r\"\nproof(induct t arbitrary: r)\n  case Nil\n  then show ?case\n    by (simp add: obtains_base)\nnext\n  case (Cons a t)\n  then show ?case\n    apply (case_tac a)\n    apply (simp add: obtains_step)\n    apply clarify\n    apply (simp add: in_possible_steps[symmetric])\n    apply (simp add: drinks2_def drinks_def)\n    apply clarsimp\n    apply (simp add: drinks2_def[symmetric] drinks_def[symmetric])\n    apply safe\n    using Cons.prems(1) no_change_1_1 apply blast\n              apply (simp add: coin_def vend_nothing_def)\n    using Cons.prems(1) no_change_1_1 apply blast\n            apply (simp add: vend_fail_def vend_nothing_def apply_updates_def)\n    using Cons.prems(1) no_change_1_1 apply blast\n          apply (metis drinks_rejects_future numeral_eq_one_iff obtains.cases obtains_recognises semiring_norm(85))\n    using no_1_2 apply blast\n    using no_1_2 apply blast\n    using Cons.prems(1) no_change_1_1 apply blast\n    using no_1_2 apply blast\n    using no_1_2 apply blast\n    using no_1_2 by blast\nqed\n\nlemma obtains_1_c2:\n  \"obtains 1 c1 drinks2 0 <> t \\<Longrightarrow> obtains 1 c2 drinks 0 <> t \\<Longrightarrow> c2 $ 2 = Some (Num 0)\"\nproof(induct t)\n  case Nil\n  then show ?case\n    by (simp add: obtains_base)\nnext\n  case (Cons a t)\n  then show ?case\n    apply (case_tac a)\n    apply (simp add: obtains_step)\n    apply clarify\n    apply (simp add: in_possible_steps[symmetric])\n    apply (simp add: drinks2_def drinks_def)\n    apply clarsimp\n    apply (simp add: drinks2_def[symmetric] drinks_def[symmetric])\n    apply (simp add: select_def can_take apply_updates_def)\n    using obtains_1_1_2 by fastforce\nqed\n\nlemma directly_subsumes: \"directly_subsumes drinks2 drinks 1 1 vend_fail vend_nothing\"\n  apply (rule direct_subsumption[of _ _ _ _ \"\\<lambda>c2. c2 $ 2 = Some (Num 0)\"])\n   apply (simp add: obtains_1_c2)\n  apply (rule subsumption)\n     apply (simp add: vend_fail_def vend_nothing_def)\n    apply (simp add: vend_fail_def vend_nothing_def can_take value_gt_true)\n   apply (simp add: vend_fail_def vend_nothing_def)\n  by (simp add: posterior_separate_def vend_fail_def vend_nothing_def)\n\nlemma directly_subsumes_flip: \"directly_subsumes drinks2 drinks 1 1 vend_nothing vend_fail\"\n  apply (rule direct_subsumption[of _ _ _ _ \"\\<lambda>c2. c2 $ 2 = Some (Num 0)\"])\n   apply (simp add: obtains_1_c2)\n  apply (rule subsumption)\n     apply (simp add: vend_fail_def vend_nothing_def)\n    apply (simp add: vend_fail_def vend_nothing_def can_take value_gt_true)\n   apply (simp add: vend_fail_def vend_nothing_def can_take value_gt_true)\n  by (simp add: posterior_separate_def vend_fail_def vend_nothing_def)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Extended_Finite_State_Machine_Inference/examples/Drinks_Subsumption.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3227963716692408}}
{"text": "(*  Title:      HOL/IOA/Solve.thy\n    Author:     Tobias Nipkow & Konrad Slind\n    Copyright   1994  TU Muenchen\n*)\n\nsection {* Weak possibilities mapping (abstraction) *}\n\ntheory Solve\nimports IOA\nbegin\n\ndefinition is_weak_pmap :: \"['c => 'a, ('action,'c)ioa,('action,'a)ioa] => bool\" where\n  \"is_weak_pmap f C A ==\n   (!s:starts_of(C). f(s):starts_of(A)) &\n   (!s t a. reachable C s &\n            (s,a,t):trans_of(C)\n            --> (if a:externals(asig_of(C)) then\n                   (f(s),a,f(t)):trans_of(A)\n                 else f(s)=f(t)))\"\n\ndeclare mk_trace_thm [simp] trans_in_actions [simp]\n\nlemma trace_inclusion: \n  \"[| IOA(C); IOA(A); externals(asig_of(C)) = externals(asig_of(A));  \n           is_weak_pmap f C A |] ==> traces(C) <= traces(A)\"\n  apply (unfold is_weak_pmap_def traces_def)\n\n  apply (simp (no_asm) add: has_trace_def)\n  apply safe\n  apply (rename_tac ex1 ex2)\n\n  (* choose same trace, therefore same NF *)\n  apply (rule_tac x = \"mk_trace C ex1\" in exI)\n  apply simp\n\n  (* give execution of abstract automata *)\n  apply (rule_tac x = \"(mk_trace A ex1,%i. f (ex2 i))\" in bexI)\n\n  (* Traces coincide *)\n   apply (simp (no_asm_simp) add: mk_trace_def filter_oseq_idemp)\n\n  (* Use lemma *)\n  apply (frule states_of_exec_reachable)\n\n  (* Now show that it's an execution *)\n  apply (simp add: executions_def)\n  apply safe\n\n  (* Start states map to start states *)\n  apply (drule bspec)\n  apply assumption\n\n  (* Show that it's an execution fragment *)\n  apply (simp add: is_execution_fragment_def)\n  apply safe\n\n  apply (erule_tac x = \"ex2 n\" in allE)\n  apply (erule_tac x = \"ex2 (Suc n)\" in allE)\n  apply (erule_tac x = a in allE)\n  apply simp\n  done\n\n(* Lemmata *)\n\nlemma imp_conj_lemma: \"(P ==> Q-->R) ==> P&Q --> R\"\n  by blast\n\n\n(* fist_order_tautology of externals_of_par *)\nlemma externals_of_par_extra:\n  \"a:externals(asig_of(A1||A2)) =     \n   (a:externals(asig_of(A1)) & a:externals(asig_of(A2)) |   \n   a:externals(asig_of(A1)) & a~:externals(asig_of(A2)) |   \n   a~:externals(asig_of(A1)) & a:externals(asig_of(A2)))\"\n  apply (auto simp add: externals_def asig_of_par asig_comp_def asig_inputs_def asig_outputs_def)\n  done\n\nlemma comp1_reachable: \"[| reachable (C1||C2) s |] ==> reachable C1 (fst s)\"\n  apply (simp add: reachable_def)\n  apply (erule bexE)\n  apply (rule_tac x =\n    \"(filter_oseq (%a. a:actions (asig_of (C1))) (fst ex) , %i. fst (snd ex i))\" in bexI)\n(* fst(s) is in projected execution *)\n  apply force\n(* projected execution is indeed an execution *)\n  apply (simp cong del: if_weak_cong\n    add: executions_def is_execution_fragment_def par_def starts_of_def\n      trans_of_def filter_oseq_def\n    split add: option.split)\n  done\n\n\n(* Exact copy of proof of comp1_reachable for the second\n   component of a parallel composition.     *)\nlemma comp2_reachable: \"[| reachable (C1||C2) s|] ==> reachable C2 (snd s)\"\n  apply (simp add: reachable_def)\n  apply (erule bexE)\n  apply (rule_tac x =\n    \"(filter_oseq (%a. a:actions (asig_of (C2))) (fst ex) , %i. snd (snd ex i))\" in bexI)\n(* fst(s) is in projected execution *)\n  apply force\n(* projected execution is indeed an execution *)\n  apply (simp cong del: if_weak_cong\n    add: executions_def is_execution_fragment_def par_def starts_of_def\n    trans_of_def filter_oseq_def\n    split add: option.split)\n  done\n\ndeclare split_if [split del] if_weak_cong [cong del]\n\n(*Composition of possibility-mappings *)\nlemma fxg_is_weak_pmap_of_product_IOA: \n     \"[| is_weak_pmap f C1 A1;  \n         externals(asig_of(A1))=externals(asig_of(C1)); \n         is_weak_pmap g C2 A2;   \n         externals(asig_of(A2))=externals(asig_of(C2));  \n         compat_ioas C1 C2; compat_ioas A1 A2  |]      \n   ==> is_weak_pmap (%p.(f(fst(p)),g(snd(p)))) (C1||C2) (A1||A2)\"\n  apply (unfold is_weak_pmap_def)\n  apply (rule conjI)\n(* start_states *)\n  apply (simp add: par_def starts_of_def)\n(* transitions *)\n  apply (rule allI)+\n  apply (rule imp_conj_lemma)\n  apply (simp (no_asm) add: externals_of_par_extra)\n  apply (simp (no_asm) add: par_def)\n  apply (simp add: trans_of_def)\n  apply (simplesubst split_if)\n  apply (rule conjI)\n  apply (rule impI)\n  apply (erule disjE)\n(* case 1      a:e(A1) | a:e(A2) *)\n  apply (simp add: comp1_reachable comp2_reachable ext_is_act)\n  apply (erule disjE)\n(* case 2      a:e(A1) | a~:e(A2) *)\n  apply (simp add: comp1_reachable comp2_reachable ext_is_act ext1_ext2_is_not_act2)\n(* case 3      a:~e(A1) | a:e(A2) *)\n  apply (simp add: comp1_reachable comp2_reachable ext_is_act ext1_ext2_is_not_act1)\n(* case 4      a:~e(A1) | a~:e(A2) *)\n  apply (rule impI)\n  apply (subgoal_tac \"a~:externals (asig_of (A1)) & a~:externals (asig_of (A2))\")\n(* delete auxiliary subgoal *)\n  prefer 2\n  apply force\n  apply (simp (no_asm) add: conj_disj_distribR cong add: conj_cong split add: split_if)\n  apply (tactic {*\n    REPEAT((resolve_tac [conjI,impI] 1 ORELSE etac conjE 1) THEN\n      asm_full_simp_tac(@{context} addsimps [@{thm comp1_reachable}, @{thm comp2_reachable}]) 1) *})\n  done\n\n\nlemma reachable_rename_ioa: \"[| reachable (rename C g) s |] ==> reachable C s\"\n  apply (simp add: reachable_def)\n  apply (erule bexE)\n  apply (rule_tac x = \"((%i. case (fst ex i) of None => None | Some (x) => g x) ,snd ex)\" in bexI)\n  apply (simp (no_asm))\n(* execution is indeed an execution of C *)\n  apply (simp add: executions_def is_execution_fragment_def par_def\n    starts_of_def trans_of_def rename_def split add: option.split)\n  apply force\n  done\n\n\nlemma rename_through_pmap: \"[| is_weak_pmap f C A |] \n                       ==> (is_weak_pmap f (rename C g) (rename A g))\"\n  apply (simp add: is_weak_pmap_def)\n  apply (rule conjI)\n  apply (simp add: rename_def starts_of_def)\n  apply (rule allI)+\n  apply (rule imp_conj_lemma)\n  apply (simp (no_asm) add: rename_def)\n  apply (simp add: externals_def asig_inputs_def asig_outputs_def asig_of_def trans_of_def)\n  apply safe\n  apply (simplesubst split_if)\n  apply (rule conjI)\n  apply (rule impI)\n  apply (erule disjE)\n  apply (erule exE)\n  apply (erule conjE)\n(* x is input *)\n  apply (drule sym)\n  apply (drule sym)\n  apply simp\n  apply hypsubst+\n  apply (cut_tac C = \"C\" and g = \"g\" and s = \"s\" in reachable_rename_ioa)\n  apply assumption\n  apply simp\n(* x is output *)\n  apply (erule exE)\n  apply (erule conjE)\n  apply (drule sym)\n  apply (drule sym)\n  apply simp\n  apply hypsubst+\n  apply (cut_tac C = \"C\" and g = \"g\" and s = \"s\" in reachable_rename_ioa)\n  apply assumption\n  apply simp\n(* x is internal *)\n  apply (simp (no_asm) add: de_Morgan_disj de_Morgan_conj not_ex cong add: conj_cong)\n  apply (rule impI)\n  apply (erule conjE)\n  apply (cut_tac C = \"C\" and g = \"g\" and s = \"s\" in reachable_rename_ioa)\n  apply auto\n  done\n\ndeclare split_if [split] if_weak_cong [cong]\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/IOA/Solve.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.32279636412061613}}
{"text": "theory flash12Bra  imports flash12Rev\n \n  begin\nlemma onInv12:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv12 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv12 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv12 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash12Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7371581626286833, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.32274516616268606}}
{"text": "(*  Title:      JinjaThreads/Compiler/TypeComp.thy\n    Author:     Tobias Nipkow, Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Preservation of Well-Typedness in Stage 2} *}\n\ntheory TypeComp\nimports \n  Exception_Tables\n  \"J1WellForm\"\n  \"../BV/BVSpec\"\n  \"~~/src/HOL/Library/Prefix_Order\"\n  \"~~/src/HOL/Library/Sublist\"\nbegin\n\n(*<*)\ndeclare nth_append[simp]\n(*>*)\n\nlocale TC0 =\n  fixes P :: \"'addr J1_prog\" and mxl :: nat\nbegin\n\ndefinition ty :: \"ty list \\<Rightarrow> 'addr expr1 \\<Rightarrow> ty\"\nwhere \"ty E e \\<equiv> THE T. P,E \\<turnstile>1 e :: T\"\n\ndefinition ty\\<^sub>l :: \"ty list \\<Rightarrow> nat set \\<Rightarrow> ty\\<^sub>l\"\nwhere \"ty\\<^sub>l E A' \\<equiv> map (\\<lambda>i. if i \\<in> A' \\<and> i < size E then OK(E!i) else Err) [0..<mxl]\"\n\ndefinition ty\\<^sub>i' :: \"ty list \\<Rightarrow> ty list \\<Rightarrow> nat set option \\<Rightarrow> ty\\<^sub>i'\"\nwhere \"ty\\<^sub>i' ST E A \\<equiv> case A of None \\<Rightarrow> None | \\<lfloor>A'\\<rfloor> \\<Rightarrow> Some(ST, ty\\<^sub>l E A')\"\n\ndefinition after :: \"ty list \\<Rightarrow> nat set option \\<Rightarrow> ty list \\<Rightarrow> 'addr expr1 \\<Rightarrow> ty\\<^sub>i'\"\n  where \"after E A ST e \\<equiv> ty\\<^sub>i' (ty E e # ST) E (A \\<squnion> \\<A> e)\"\n\nend\n\nlocale TC1 = TC0 +\n  fixes wfmd\n  assumes wf_prog: \"wf_prog wfmd P\"\nbegin\n\nlemma ty_def2 [simp]: \"P,E \\<turnstile>1 e :: T \\<Longrightarrow> ty E e = T\"\napply(unfold ty_def ty_def)\napply(blast intro: the_equality WT1_unique[OF wf_prog])\ndone\n\nend\n\ncontext TC0 begin\n\nlemma ty\\<^sub>i'_None [simp]: \"ty\\<^sub>i' ST E None = None\"\nby(simp add:ty\\<^sub>i'_def)\n\nlemma ty\\<^sub>l_app_diff[simp]:\n \"ty\\<^sub>l (E@[T]) (A - {size E}) = ty\\<^sub>l E A\"\nby(auto simp add:ty\\<^sub>l_def hyperset_defs)\n\nlemma ty\\<^sub>i'_app_diff[simp]:\n \"ty\\<^sub>i' ST (E @ [T]) (A \\<ominus> size E) = ty\\<^sub>i' ST E A\"\nby(auto simp add:ty\\<^sub>i'_def hyperset_defs)\n\nlemma ty\\<^sub>l_antimono:\n \"A \\<subseteq> A' \\<Longrightarrow> P \\<turnstile> ty\\<^sub>l E A' [\\<le>\\<^sub>\\<top>] ty\\<^sub>l E A\"\nby(auto simp:ty\\<^sub>l_def list_all2_conv_all_nth)\n\n\nlemma ty\\<^sub>i'_antimono:\n \"A \\<subseteq> A' \\<Longrightarrow> P \\<turnstile> ty\\<^sub>i' ST E \\<lfloor>A'\\<rfloor> \\<le>' ty\\<^sub>i' ST E \\<lfloor>A\\<rfloor>\"\nby(auto simp:ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth)\n\nlemma ty\\<^sub>l_env_antimono:\n \"P \\<turnstile> ty\\<^sub>l (E@[T]) A [\\<le>\\<^sub>\\<top>] ty\\<^sub>l E A\" \nby(auto simp:ty\\<^sub>l_def list_all2_conv_all_nth)\n\n\nlemma ty\\<^sub>i'_env_antimono:\n \"P \\<turnstile> ty\\<^sub>i' ST (E@[T]) A \\<le>' ty\\<^sub>i' ST E A\" \nby(auto simp:ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth)\n\n\nlemma ty\\<^sub>i'_incr:\n \"P \\<turnstile> ty\\<^sub>i' ST (E @ [T]) \\<lfloor>insert (size E) A\\<rfloor> \\<le>' ty\\<^sub>i' ST E \\<lfloor>A\\<rfloor>\"\nby(auto simp:ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth)\n\n\nlemma ty\\<^sub>l_incr:\n \"P \\<turnstile> ty\\<^sub>l (E @ [T]) (insert (size E) A) [\\<le>\\<^sub>\\<top>] ty\\<^sub>l E A\"\nby(auto simp: hyperset_defs ty\\<^sub>l_def list_all2_conv_all_nth)\n\n\nlemma ty\\<^sub>l_in_types:\n \"set E \\<subseteq> types P \\<Longrightarrow> ty\\<^sub>l E A \\<in> list mxl (err (types P))\"\nby(auto simp add:ty\\<^sub>l_def intro!:listI dest!: nth_mem)\n\n\nfunction compT :: \"ty list \\<Rightarrow> nat hyperset \\<Rightarrow> ty list \\<Rightarrow> 'addr expr1 \\<Rightarrow> ty\\<^sub>i' list\"\n  and compTs :: \"ty list \\<Rightarrow> nat hyperset \\<Rightarrow> ty list \\<Rightarrow> 'addr expr1 list \\<Rightarrow> ty\\<^sub>i' list\"\nwhere\n  \"compT E A ST (new C) = []\"\n| \"compT E A ST (newA T\\<lfloor>e\\<rceil>) = compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (Cast C e) = compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (e instanceof T) = compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (Val v) = []\"\n| \"compT E A ST (e1 \\<guillemotleft>bop\\<guillemotright> e2) =\n  (let ST1 = ty E e1#ST; A1 = A \\<squnion> \\<A> e1 in\n   compT E A ST e1 @ [after E A ST e1] @\n   compT E A1 ST1 e2 @ [after E A1 ST1 e2])\"\n| \"compT E A ST (Var i) = []\"\n| \"compT E A ST (i := e) = compT E A ST e @ [after E A ST e, ty\\<^sub>i' ST E (A \\<squnion> \\<A> e \\<squnion> \\<lfloor>{i}\\<rfloor>)]\"\n| \"compT E A ST (a\\<lfloor>i\\<rceil>) =\n  (let ST1 = ty E a # ST; A1 = A \\<squnion> \\<A> a\n   in  compT E A ST a @ [after E A ST a] @ compT E A1 ST1 i @ [after E A1 ST1 i])\"\n| \"compT E A ST (a\\<lfloor>i\\<rceil> := e) =\n  (let ST1 = ty E a # ST; A1 = A \\<squnion> \\<A> a;\n       ST2 = ty E i # ST1; A2 = A1 \\<squnion> \\<A> i; A3 = A2 \\<squnion> \\<A> e\n   in compT E A ST a @ [after E A ST a] @ compT E A1 ST1 i @ [after E A1 ST1 i] @ compT E A2 ST2 e @ [after E A2 ST2 e, ty\\<^sub>i' ST E A3])\"\n| \"compT E A ST (a\\<bullet>length) = compT E A ST a @ [after E A ST a]\"\n| \"compT E A ST (e\\<bullet>F{D}) = compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (e1\\<bullet>F{D} := e2) =\n  (let ST1 = ty E e1#ST; A1 = A \\<squnion> \\<A> e1; A2 = A1 \\<squnion> \\<A> e2\n   in  compT E A ST e1 @ [after E A ST e1] @ compT E A1 ST1 e2 @ [after E A1 ST1 e2] @ [ty\\<^sub>i' ST E A2])\"\n| \"compT E A ST (e\\<bullet>M(es)) =\n   compT E A ST e @ [after E A ST e] @\n   compTs E (A \\<squnion> \\<A> e) (ty E e # ST) es\"\n| \"compT E A ST {i:T=None; e} = compT (E@[T]) (A\\<ominus>i) ST e\"\n| \"compT E A ST {i:T=\\<lfloor>v\\<rfloor>; e} = \n   [after E A ST (Val v), ty\\<^sub>i' ST (E@[T]) (A \\<squnion> \\<lfloor>{i}\\<rfloor>)] @ compT (E@[T]) (A \\<squnion> \\<lfloor>{i}\\<rfloor>) ST e\"\n\n| \"compT E A ST (sync\\<^bsub>i\\<^esub> (e1) e2) =\n  (let A1 = A \\<squnion> \\<A> e1 \\<squnion> \\<lfloor>{i}\\<rfloor>; E1 = E @ [Class Object]; ST2 = ty E1 e2 # ST; A2 = A1 \\<squnion> \\<A> e2\n   in  compT E A ST e1 @\n       [after E A ST e1,\n        ty\\<^sub>i' (Class Object # Class Object # ST) E (A \\<squnion> \\<A> e1),\n        ty\\<^sub>i' (Class Object # ST) E1 A1,\n        ty\\<^sub>i' ST E1 A1] @\n       compT E1 A1 ST e2 @ \n       [ty\\<^sub>i' ST2 E1 A2, ty\\<^sub>i' (Class Object # ST2) E1 A2, ty\\<^sub>i' ST2 E1 A2, \n        ty\\<^sub>i' (Class Throwable # ST) E1 A1,\n        ty\\<^sub>i' (Class Object # Class Throwable # ST) E1 A1,\n        ty\\<^sub>i' (Class Throwable # ST) E1 A1])\"\n| \"compT E A ST (insync\\<^bsub>i\\<^esub> (a) e) = []\"\n\n| \"compT E A ST (e1;;e2) =\n  (let A1 = A \\<squnion> \\<A> e1 in\n   compT E A ST e1 @ [after E A ST e1, ty\\<^sub>i' ST E A1] @\n   compT E A1 ST e2)\"\n| \"compT E A ST (if (e) e1 else e2) =\n   (let A0 = A \\<squnion> \\<A> e; \\<tau> = ty\\<^sub>i' ST E A0 in\n    compT E A ST e @ [after E A ST e, \\<tau>] @\n    compT E A0 ST e1 @ [after E A0 ST e1, \\<tau>] @\n    compT E A0 ST e2)\"\n| \"compT E A ST (while (e) c) =\n   (let A0 = A \\<squnion> \\<A> e;  A1 = A0 \\<squnion> \\<A> c; \\<tau> = ty\\<^sub>i' ST E A0 in\n    compT E A ST e @ [after E A ST e, \\<tau>] @\n    compT E A0 ST c @ [after E A0 ST c, ty\\<^sub>i' ST E A1, ty\\<^sub>i' ST E A0])\"\n| \"compT E A ST (throw e) = compT E A ST e @ [after E A ST e]\"\n| \"compT E A ST (try e1 catch(C i) e2) =\n   compT E A ST e1 @ [after E A ST e1] @\n   [ty\\<^sub>i' (Class C#ST) E A, ty\\<^sub>i' ST (E@[Class C]) (A \\<squnion> \\<lfloor>{i}\\<rfloor>)] @\n   compT (E@[Class C]) (A \\<squnion> \\<lfloor>{i}\\<rfloor>) ST e2\"\n\n| \"compTs E A ST [] = []\"\n| \"compTs E A ST (e#es) = compT E A ST e @ [after E A ST e] @\n                            compTs E (A \\<squnion> (\\<A> e)) (ty E e # ST) es\"\nby pat_completeness simp_all\ntermination\napply(relation \"case_sum (\\<lambda>p. size (snd (snd (snd p)))) (\\<lambda>p. size_list size (snd (snd (snd p)))) <*mlex*> {}\")\napply(rule wf_mlex[OF wf_empty])\napply(rule mlex_less, simp)+\ndone\n\nlemmas compT_compTs_induct =\n  compT_compTs.induct[\n    unfolded meta_all5_eq_conv meta_all4_eq_conv meta_all3_eq_conv meta_all2_eq_conv meta_all_eq_conv,\n    case_names\n      new NewArray Cast InstanceOf Val BinOp Var LAss AAcc AAss ALen FAcc FAss Call BlockNone BlockSome\n      Synchronized InSynchronized Seq Cond While throw TryCatch\n      Nil Cons]\n\ndefinition compTa :: \"ty list \\<Rightarrow> nat hyperset \\<Rightarrow> ty list \\<Rightarrow> 'addr expr1 \\<Rightarrow> ty\\<^sub>i' list\"\nwhere \"compTa E A ST e \\<equiv> compT E A ST e @ [after E A ST e]\"\n\nlemmas compE2_not_Nil = compE2_neq_Nil\ndeclare compE2_not_Nil[simp]\n\nlemma compT_sizes[simp]:\n  shows \"size(compT E A ST e) = size(compE2 e) - 1\"\n  and \"size(compTs E A ST es) = size(compEs2 es)\"\napply(induct E A ST e and E A ST es rule: compT_compTs_induct)\napply(auto split:nat_diff_split)\ndone\n\nlemma compT_None_not_Some [simp]: \"\\<lfloor>\\<tau>\\<rfloor> \\<notin> set (compT E None ST e)\"\n  and compTs_None_not_Some [simp]: \"\\<lfloor>\\<tau>\\<rfloor> \\<notin> set (compTs E None ST es)\"\nby(induct E A\\<equiv>\"None :: nat hyperset\" ST e and E A\\<equiv>\"None :: nat hyperset\" ST es rule: compT_compTs_induct) (simp_all add:after_def)\n\nlemma pair_eq_ty\\<^sub>i'_conv:\n  \"(\\<lfloor>(ST, LT)\\<rfloor> = ty\\<^sub>i' ST\\<^sub>0 E A) = (case A of None \\<Rightarrow> False | Some A \\<Rightarrow> (ST = ST\\<^sub>0 \\<and> LT = ty\\<^sub>l E A))\"\nby(simp add:ty\\<^sub>i'_def)\n\nlemma pair_conv_ty\\<^sub>i': \"\\<lfloor>(ST, ty\\<^sub>l E A)\\<rfloor> = ty\\<^sub>i' ST E \\<lfloor>A\\<rfloor>\"\nby(simp add:ty\\<^sub>i'_def)\n\nlemma ty\\<^sub>i'_antimono2:\n \"\\<lbrakk> E \\<le> E'; A \\<subseteq> A' \\<rbrakk> \\<Longrightarrow> P \\<turnstile> ty\\<^sub>i' ST E' \\<lfloor>A'\\<rfloor> \\<le>' ty\\<^sub>i' ST E \\<lfloor>A\\<rfloor>\"\nby(auto simp:ty\\<^sub>i'_def ty\\<^sub>l_def list_all2_conv_all_nth less_eq_list_def prefixeq_def)\n\ndeclare ty\\<^sub>i'_antimono [intro!] after_def[simp] pair_conv_ty\\<^sub>i'[simp] pair_eq_ty\\<^sub>i'_conv[simp]\n\nlemma compT_LT_prefix:\n  \"\\<lbrakk> \\<lfloor>(ST,LT)\\<rfloor> \\<in> set(compT E A ST0 e); \\<B> e (size E) \\<rbrakk> \\<Longrightarrow> P \\<turnstile> \\<lfloor>(ST,LT)\\<rfloor> \\<le>' ty\\<^sub>i' ST E A\"\n  and compTs_LT_prefix:\n  \"\\<lbrakk> \\<lfloor>(ST,LT)\\<rfloor> \\<in> set(compTs E A ST0 es); \\<B>s es (size E) \\<rbrakk> \\<Longrightarrow> P \\<turnstile> \\<lfloor>(ST,LT)\\<rfloor> \\<le>' ty\\<^sub>i' ST E A\"\nproof(induct E A ST0 e and E A ST0 es rule: compT_compTs_induct)\n  case FAss thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case BinOp thus ?case\n    by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans split:bop.splits)\nnext\n  case Seq thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case While thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case Cond thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case BlockNone thus ?case by(auto)\nnext\n  case BlockSome thus ?case\n    by(clarsimp simp only: ty\\<^sub>i'_def)(fastforce intro: ty\\<^sub>i'_incr simp add: hyperset_defs elim: sup_state_opt_trans)\nnext\n  case Call thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case Cons thus ?case\n    by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case TryCatch thus ?case\n    by(fastforce simp:hyperset_defs intro!: ty\\<^sub>i'_incr elim!:sup_state_opt_trans)\nnext\n  case NewArray thus ?case by(auto simp add: hyperset_defs)\nnext\n  case AAcc thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)\nnext\n  case AAss thus ?case by(auto simp:hyperset_defs Un_ac elim!:sup_state_opt_trans)    \nnext\n  case ALen thus ?case by(auto simp add: hyperset_defs)\nnext\n  case Synchronized thus ?case\n    by(fastforce simp add: hyperset_defs elim: sup_state_opt_trans intro: sup_state_opt_trans[OF ty\\<^sub>i'_incr] ty\\<^sub>i'_antimono2)\nqed (auto simp:hyperset_defs)\n\ndeclare ty\\<^sub>i'_antimono [rule del] after_def[simp del] pair_conv_ty\\<^sub>i'[simp del] pair_eq_ty\\<^sub>i'_conv[simp del]\n\nlemma OK_None_states [iff]: \"OK None \\<in> states P mxs mxl\"\nby(simp add: JVM_states_unfold)\n\nend\n\ncontext TC1 begin\n\nlemma after_in_states:\n \"\\<lbrakk> P,E \\<turnstile>1 e :: T; set E \\<subseteq> types P; set ST \\<subseteq> types P; size ST + max_stack e \\<le> mxs \\<rbrakk>\n \\<Longrightarrow> OK (after E A ST e) \\<in> states P mxs mxl\"\napply(subgoal_tac \"size ST + 1 \\<le> mxs\")\n apply(simp add:after_def ty\\<^sub>i'_def JVM_states_unfold ty\\<^sub>l_in_types)\n apply(clarify intro!: exI)\n apply(rule conjI)\n  apply(rule exI[where x=\"length ST + 1\"], fastforce)\n apply(clarsimp)\n apply(rule conjI[OF WT1_is_type[OF wf_prog]], auto intro: listI)\nusing max_stack1[of e] by simp\n\nend\n\ncontext TC0 begin\n\nlemma OK_ty\\<^sub>i'_in_statesI [simp]:\n  \"\\<lbrakk> set E \\<subseteq> types P; set ST \\<subseteq> types P; size ST \\<le> mxs \\<rbrakk>\n  \\<Longrightarrow> OK (ty\\<^sub>i' ST E A) \\<in> states P mxs mxl\"\napply(simp add:ty\\<^sub>i'_def JVM_states_unfold ty\\<^sub>l_in_types)\napply(blast intro!:listI)\ndone\n\nend\n\nlemma is_class_type_aux: \"is_class P C \\<Longrightarrow> is_type P (Class C)\"\nby(simp)\n\ncontext TC1 begin\n\ndeclare is_type.simps[simp del] subsetI[rule del]\n\ntheorem\n  shows compT_states:\n  \"\\<lbrakk> P,E \\<turnstile>1 e :: T; set E \\<subseteq> types P; set ST \\<subseteq> types P;\n     size ST + max_stack e \\<le> mxs; size E + max_vars e \\<le> mxl \\<rbrakk>\n  \\<Longrightarrow> OK ` set(compT E A ST e) \\<subseteq> states P mxs mxl\"\n  (is \"PROP ?P e E T A ST\")\n\n  and compTs_states: \n  \"\\<lbrakk> P,E \\<turnstile>1 es[::]Ts;  set E \\<subseteq> types P; set ST \\<subseteq> types P;\n    size ST + max_stacks es \\<le> mxs; size E + max_varss es \\<le> mxl \\<rbrakk>\n  \\<Longrightarrow> OK ` set(compTs E A ST es) \\<subseteq> states P mxs mxl\"\n    (is \"PROP ?Ps es E Ts A ST\")\nproof(induct E A ST e and E A ST es arbitrary: T and Ts rule: compT_compTs_induct)\n  case new thus ?case by(simp)\nnext\n  case (Cast C e) thus ?case by (auto simp:after_in_states)\nnext\n  case InstanceOf thus ?case by (auto simp:after_in_states)\nnext\n  case Val thus  ?case by(simp)\nnext\n  case Var thus ?case by(simp)\nnext\n  case LAss thus ?case  by(auto simp:after_in_states)\nnext\n  case FAcc thus ?case by(auto simp:after_in_states)\nnext\n  case FAss thus ?case\n    by(auto simp:image_Un WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case Seq thus ?case\n    by(auto simp:image_Un after_in_states)\nnext\n  case BinOp thus ?case\n    by(auto simp:image_Un WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case Cond thus ?case\n    by(force simp:image_Un WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case While thus ?case\n    by(auto simp:image_Un WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case BlockNone thus ?case by auto\nnext\n  case (BlockSome E A ST i ty v exp)\n  with max_stack1[of exp] show ?case by(auto intro: after_in_states)\nnext\n  case (TryCatch E A ST e\\<^sub>1 C i e\\<^sub>2)\n  moreover have \"size ST + 1 \\<le> mxs\" using TryCatch.prems max_stack1[of e\\<^sub>1] by auto\n  ultimately show ?case  \n    by(auto simp:image_Un WT1_is_type[OF wf_prog] after_in_states\n                  is_class_type_aux)\nnext\n  case Nil thus ?case by simp\nnext\n  case Cons thus ?case\n    by(auto simp:image_Un  WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case throw thus ?case\n    by(auto simp: WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case Call thus ?case\n    by(auto simp:image_Un WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case NewArray thus ?case\n    by(auto simp:image_Un WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case AAcc thus ?case by(auto simp:image_Un WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case AAss thus ?case by(auto simp:image_Un WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case ALen thus ?case by(auto simp:image_Un WT1_is_type[OF wf_prog] after_in_states)\nnext\n  case InSynchronized thus ?case by auto\nnext\n  case (Synchronized E A ST i exp1 exp2)\n  from `P,E \\<turnstile>1 sync\\<^bsub>i\\<^esub> (exp1) exp2 :: T` obtain T1\n    where wt1: \"P,E \\<turnstile>1 exp1 :: T1\" and T1: \"is_refT T1\" \"T1 \\<noteq> NT\"\n    and wt2: \"P,E@[Class Object] \\<turnstile>1 exp2 :: T\" by auto\n  moreover note E = `set E \\<subseteq> types P` with wf_prog\n  have E': \"set (E@[Class Object]) \\<subseteq> types P\" by(auto simp add: is_type.simps)\n  moreover from wf_prog wt2 E' have T: \"is_type P T\" by(rule WT1_is_type)\n  note ST = `set ST \\<subseteq> types P` with wf_prog\n  have ST': \"set (Class Object # ST) \\<subseteq> types P\" by(auto simp add: is_type.simps)\n  moreover from wf_prog have throwable: \"is_type P (Class Throwable)\"\n    unfolding is_type.simps by(rule is_class_Throwable)\n  ultimately show ?case using Synchronized max_stack1[of exp2] T\n    by(auto simp add: image_Un after_in_states)\nqed\n\ndeclare is_type.simps[simp] subsetI[intro!]\n\nend\n\n\nlocale TC2 = TC0 +\n  fixes T\\<^sub>r :: ty and mxs :: pc\nbegin\n  \ndefinition\n  wt_instrs :: \"'addr instr list \\<Rightarrow> ex_table \\<Rightarrow> ty\\<^sub>i' list \\<Rightarrow> bool\" (\"(\\<turnstile> _, _ /[::]/ _)\" [0,0,51] 50)\nwhere\n  \"\\<turnstile> is,xt [::] \\<tau>s \\<equiv> size is < size \\<tau>s \\<and> pcs xt \\<subseteq> {0..<size is} \\<and> (\\<forall>pc< size is. P,T\\<^sub>r,mxs,size \\<tau>s,xt \\<turnstile> is!pc,pc :: \\<tau>s)\"\n\nlemmas wt_defs = wt_instrs_def wt_instr_def app_def eff_def norm_eff_def\n\nlemma wt_instrs_Nil [simp]: \"\\<tau>s \\<noteq> [] \\<Longrightarrow> \\<turnstile> [],[] [::] \\<tau>s\"\nby(simp add:wt_defs)\n\nend\n\nlocale TC3 = TC1 + TC2\n\nlemma eff_None [simp]: \"eff i P pc et None = []\"\nby (simp add: Effect.eff_def)\n\ndeclare split_comp_eq[simp del]\n\nlemma wt_instr_appR:\n \"\\<lbrakk> P,T,m,mpc,xt \\<turnstile> is!pc,pc :: \\<tau>s;\n    pc < size is; size is < size \\<tau>s; mpc \\<le> size \\<tau>s; mpc \\<le> mpc' \\<rbrakk>\n  \\<Longrightarrow> P,T,m,mpc',xt \\<turnstile> is!pc,pc :: \\<tau>s@\\<tau>s'\"\nby (fastforce simp:wt_instr_def app_def)\n\n\nlemma relevant_entries_shift [simp]:\n  \"relevant_entries P i (pc+n) (shift n xt) = shift n (relevant_entries P i pc xt)\"\n  apply (induct xt)\n  apply (unfold relevant_entries_def shift_def) \n   apply simp\n  apply (auto simp add: is_relevant_entry_def)\n  done\n\n\n\nlemma xcpt_eff_shift [simp]:\n  \"xcpt_eff i P (pc+n) \\<tau> (shift n xt) =\n   map (\\<lambda>(pc,\\<tau>). (pc + n, \\<tau>)) (xcpt_eff i P pc \\<tau> xt)\"\napply(simp add: xcpt_eff_def)\napply(cases \\<tau>)\napply(auto simp add: shift_def)\ndone\n\n\nlemma  eff_shift [simp]:\n  \"app\\<^sub>i (i, P, pc, m, T, \\<tau>) \\<Longrightarrow>\n   eff i P (pc+n) (shift n xt) (Some \\<tau>) =\n   map (\\<lambda>(pc,\\<tau>). (pc+n,\\<tau>)) (eff i P pc xt (Some \\<tau>))\"\napply(simp add:eff_def norm_eff_def)\napply(cases \"i\",auto)\ndone\n\n\nlemma xcpt_app_shift [simp]:\n  \"xcpt_app i P (pc+n) m (shift n xt) \\<tau> = xcpt_app i P pc m xt \\<tau>\"\nby (simp add: xcpt_app_def) (auto simp add: shift_def)\n\n\nlemma wt_instr_appL:\n  \"\\<lbrakk> P,T,m,mpc,xt \\<turnstile> i,pc :: \\<tau>s; pc < size \\<tau>s; mpc \\<le> size \\<tau>s \\<rbrakk>\n  \\<Longrightarrow> P,T,m,mpc + size \\<tau>s',shift (size \\<tau>s') xt \\<turnstile> i,pc+size \\<tau>s' :: \\<tau>s'@\\<tau>s\"\napply(clarsimp simp add: wt_instr_def app_def)\napply(auto)\napply(cases \"i\", auto)\ndone\n\n\nlemma wt_instr_Cons:\n  \"\\<lbrakk> P,T,m,mpc - 1,[] \\<turnstile> i,pc - 1 :: \\<tau>s;\n     0 < pc; 0 < mpc; pc < size \\<tau>s + 1; mpc \\<le> size \\<tau>s + 1 \\<rbrakk>\n  \\<Longrightarrow> P,T,m,mpc,[] \\<turnstile> i,pc :: \\<tau>#\\<tau>s\"\napply(drule wt_instr_appL[where \\<tau>s' = \"[\\<tau>]\"])\napply arith\napply arith\napply (simp split:nat_diff_split_asm)\ndone\n\n\nlemma wt_instr_append:\n  \"\\<lbrakk> P,T,m,mpc - size \\<tau>s',[] \\<turnstile> i,pc - size \\<tau>s' :: \\<tau>s;\n     size \\<tau>s' \\<le> pc; size \\<tau>s' \\<le> mpc; pc < size \\<tau>s + size \\<tau>s'; mpc \\<le> size \\<tau>s + size \\<tau>s' \\<rbrakk>\n  \\<Longrightarrow> P,T,m,mpc,[] \\<turnstile> i,pc :: \\<tau>s'@\\<tau>s\"\napply(drule wt_instr_appL[where \\<tau>s' = \\<tau>s'])\napply arith\napply arith\napply (simp split:nat_diff_split_asm)\ndone\n\n\nlemma xcpt_app_pcs:\n  \"pc \\<notin> pcs xt \\<Longrightarrow> xcpt_app i P pc mxs xt \\<tau>\"\nby (auto simp add: xcpt_app_def relevant_entries_def is_relevant_entry_def pcs_def)\n\n\nlemma xcpt_eff_pcs:\n  \"pc \\<notin> pcs xt \\<Longrightarrow> xcpt_eff i P pc \\<tau> xt = []\"\nby (cases \\<tau>)\n   (auto simp add: is_relevant_entry_def xcpt_eff_def relevant_entries_def pcs_def\n           intro!: filter_False)\n\n\nlemma pcs_shift:\n  \"pc < n \\<Longrightarrow> pc \\<notin> pcs (shift n xt)\" \nby (auto simp add: shift_def pcs_def)\n\nlemma xcpt_eff_shift_pc_ge_n: assumes \"x \\<in> set (xcpt_eff i P pc \\<tau> (shift n xt))\"\n  shows \"n \\<le> pc\"\nproof -\n  { assume \"pc < n\"\n    hence \"pc \\<notin> pcs (shift n xt)\" by(rule pcs_shift)\n    with assms have False\n      by(auto simp add: pcs_def xcpt_eff_def is_relevant_entry_def relevant_entries_def split_beta cong: filter_cong) }\n  thus ?thesis by(cases \"n \\<le> pc\")(auto)\nqed\n\nlemma wt_instr_appRx:\n  \"\\<lbrakk> P,T,m,mpc,xt \\<turnstile> is!pc,pc :: \\<tau>s; pc < size is; size is < size \\<tau>s; mpc \\<le> size \\<tau>s \\<rbrakk>\n  \\<Longrightarrow> P,T,m,mpc,xt @ shift (size is) xt' \\<turnstile> is!pc,pc :: \\<tau>s\"\napply(clarsimp simp:wt_instr_def eff_def app_def)\napply(fastforce dest: xcpt_eff_shift_pc_ge_n intro!: xcpt_app_pcs[OF pcs_shift])\ndone\n\nlemma wt_instr_appLx: \n  \"\\<lbrakk> P,T,m,mpc,xt \\<turnstile> i,pc :: \\<tau>s; pc \\<notin> pcs xt' \\<rbrakk>\n  \\<Longrightarrow> P,T,m,mpc,xt'@xt \\<turnstile> i,pc :: \\<tau>s\"\nby (auto simp:wt_instr_def app_def eff_def xcpt_app_pcs xcpt_eff_pcs)\n\n\ncontext TC2 begin\n\nlemma wt_instrs_extR:\n  \"\\<turnstile> is,xt [::] \\<tau>s \\<Longrightarrow> \\<turnstile> is,xt [::] \\<tau>s @ \\<tau>s'\"\nby(auto simp add:wt_instrs_def wt_instr_appR)\n\n\nlemma wt_instrs_ext:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2; \\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>s\\<^sub>2; size \\<tau>s\\<^sub>1 = size is\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2\"\napply(clarsimp simp:wt_instrs_def)\napply(rule conjI, fastforce)\napply(rule conjI, fastforce simp add: pcs_shift_conv)\napply clarsimp\napply(rule conjI, fastforce simp:wt_instr_appRx)\napply clarsimp\napply(erule_tac x = \"pc - size is\\<^sub>1\" in allE)+\napply(thin_tac \"?P \\<longrightarrow> ?Q\")\napply(erule impE, arith) \napply(drule_tac \\<tau>s' = \"\\<tau>s\\<^sub>1\" in wt_instr_appL)\n  apply arith\n apply simp\napply(fastforce simp add:add.commute intro!: wt_instr_appLx)\ndone\n\n\ncorollary wt_instrs_ext2:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>s\\<^sub>2; \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2; size \\<tau>s\\<^sub>1 = size is\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2\"\nby(rule wt_instrs_ext)\n\n\ncorollary wt_instrs_ext_prefix [trans]:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2; \\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>s\\<^sub>3;\n     size \\<tau>s\\<^sub>1 = size is\\<^sub>1; \\<tau>s\\<^sub>3 \\<le> \\<tau>s\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2\"\nby(bestsimp simp:less_eq_list_def prefixeq_def elim: wt_instrs_ext dest:wt_instrs_extR)\n\n\ncorollary wt_instrs_app:\n  assumes is\\<^sub>1: \"\\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1@[\\<tau>]\"\n  assumes is\\<^sub>2: \"\\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>#\\<tau>s\\<^sub>2\"\n  assumes s: \"size \\<tau>s\\<^sub>1 = size is\\<^sub>1\"\n  shows \"\\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1@shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>s\\<^sub>1@\\<tau>#\\<tau>s\\<^sub>2\"\nproof -\n  from is\\<^sub>1 have \"\\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] (\\<tau>s\\<^sub>1@[\\<tau>])@\\<tau>s\\<^sub>2\"\n    by (rule wt_instrs_extR)\n  hence \"\\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1@\\<tau>#\\<tau>s\\<^sub>2\" by simp\n  from this is\\<^sub>2 s show ?thesis by (rule wt_instrs_ext) \nqed\n\n\ncorollary wt_instrs_app_last[trans]:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>2,xt\\<^sub>2 [::] \\<tau>#\\<tau>s\\<^sub>2; \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>s\\<^sub>1;\n     last \\<tau>s\\<^sub>1 = \\<tau>;  size \\<tau>s\\<^sub>1 = size is\\<^sub>1+1 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1@shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>s\\<^sub>1@\\<tau>s\\<^sub>2\"\napply(cases \\<tau>s\\<^sub>1 rule:rev_cases)\n apply simp\napply(simp add:wt_instrs_app)\ndone\n\n\ncorollary wt_instrs_append_last[trans]:\n  \"\\<lbrakk> \\<turnstile> is,xt [::] \\<tau>s; P,T\\<^sub>r,mxs,mpc,[] \\<turnstile> i,pc :: \\<tau>s;\n     pc = size is; mpc = size \\<tau>s; size is + 1 < size \\<tau>s \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is@[i],xt [::] \\<tau>s\"\napply(clarsimp simp add:wt_instrs_def)\napply(rule conjI, fastforce)\napply(fastforce intro!:wt_instr_appLx[where xt = \"[]\",simplified]\n               dest!:less_antisym)\ndone\n\n\ncorollary wt_instrs_app2:\n  \"\\<lbrakk> \\<turnstile> (is\\<^sub>2 :: 'b instr list),xt\\<^sub>2 [::] \\<tau>'#\\<tau>s\\<^sub>2;  \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>#\\<tau>s\\<^sub>1@[\\<tau>'];\n     xt' = xt\\<^sub>1 @ shift (size is\\<^sub>1) xt\\<^sub>2;  size \\<tau>s\\<^sub>1+1 = size is\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is\\<^sub>1@is\\<^sub>2,xt' [::] \\<tau>#\\<tau>s\\<^sub>1@\\<tau>'#\\<tau>s\\<^sub>2\"\nusing wt_instrs_app[where ?\\<tau>s\\<^sub>1.0 = \"\\<tau> # \\<tau>s\\<^sub>1\" and ?'b = \"'b\"] by simp\n\n\ncorollary wt_instrs_app2_simp[trans,simp]:\n  \"\\<lbrakk> \\<turnstile> (is\\<^sub>2 :: 'b instr list),xt\\<^sub>2 [::] \\<tau>'#\\<tau>s\\<^sub>2;  \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau>#\\<tau>s\\<^sub>1@[\\<tau>']; size \\<tau>s\\<^sub>1+1 = size is\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> is\\<^sub>1@is\\<^sub>2, xt\\<^sub>1@shift (size is\\<^sub>1) xt\\<^sub>2 [::] \\<tau>#\\<tau>s\\<^sub>1@\\<tau>'#\\<tau>s\\<^sub>2\"\nusing wt_instrs_app[where ?\\<tau>s\\<^sub>1.0 = \"\\<tau> # \\<tau>s\\<^sub>1\" and ?'b = \"'b\"] by simp\n\n\ncorollary wt_instrs_Cons[simp]:\n  \"\\<lbrakk> \\<tau>s \\<noteq> []; \\<turnstile> [i],[] [::] [\\<tau>,\\<tau>']; \\<turnstile> is,xt [::] \\<tau>'#\\<tau>s \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> i#is,shift 1 xt [::] \\<tau>#\\<tau>'#\\<tau>s\"\nusing wt_instrs_app2[where ?is\\<^sub>1.0 = \"[i]\" and ?\\<tau>s\\<^sub>1.0 = \"[]\" and ?is\\<^sub>2.0 = \"is\"\n                      and ?xt\\<^sub>1.0 = \"[]\"]\nby simp\n\n\ncorollary wt_instrs_Cons2[trans]:\n  assumes \\<tau>s: \"\\<turnstile> is,xt [::] \\<tau>s\"\n  assumes i: \"P,T\\<^sub>r,mxs,mpc,[] \\<turnstile> i,0 :: \\<tau>#\\<tau>s\"\n  assumes mpc: \"mpc = size \\<tau>s + 1\"\n  shows \"\\<turnstile> i#is,shift 1 xt [::] \\<tau>#\\<tau>s\"\nproof -\n  from \\<tau>s have \"\\<tau>s \\<noteq> []\" by (auto simp: wt_instrs_def)\n  with mpc i have \"\\<turnstile> [i],[] [::] [\\<tau>]@\\<tau>s\" by (simp add: wt_instrs_def)\n  with \\<tau>s show ?thesis by (fastforce dest: wt_instrs_ext)\nqed\n\n\nlemma wt_instrs_last_incr[trans]:\n  \"\\<lbrakk> \\<turnstile> is,xt [::] \\<tau>s@[\\<tau>]; P \\<turnstile> \\<tau> \\<le>' \\<tau>' \\<rbrakk> \\<Longrightarrow> \\<turnstile> is,xt [::] \\<tau>s@[\\<tau>']\"\napply(clarsimp simp add:wt_instrs_def wt_instr_def)\napply(rule conjI)\napply(fastforce)\napply(clarsimp)\napply(rename_tac pc' tau')\napply(erule allE, erule (1) impE)\napply(clarsimp)\napply(drule (1) bspec)\napply(clarsimp)\napply(subgoal_tac \"pc' = size \\<tau>s\")\nprefer 2\napply(clarsimp simp:app_def)\napply(drule (1) bspec)\napply(clarsimp)\napply(auto elim!:sup_state_opt_trans)\ndone\n\nend\n\n\n\n\n\n\ncontext TC2 begin\n\nlemma wt_New:\n  \"\\<lbrakk> is_class P C; size ST < mxs \\<rbrakk> \\<Longrightarrow>\n   \\<turnstile> [New C],[] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (Class C#ST) E A]\"\nby(simp add:wt_defs ty\\<^sub>i'_def)\n\n\nlemma wt_Cast:\n  \"is_type P T \\<Longrightarrow>\n   \\<turnstile> [Checkcast T],[] [::] [ty\\<^sub>i' (U # ST) E A, ty\\<^sub>i' (T # ST) E A]\"\nby(simp add: ty\\<^sub>i'_def wt_defs)\n\nlemma wt_Instanceof:\n  \"\\<lbrakk> is_type P T; is_refT U \\<rbrakk> \\<Longrightarrow>\n   \\<turnstile> [Instanceof T],[] [::] [ty\\<^sub>i' (U # ST) E A, ty\\<^sub>i' (Boolean # ST) E A]\"\nby(simp add: ty\\<^sub>i'_def wt_defs)\n\nlemma wt_Push:\n  \"\\<lbrakk> size ST < mxs; typeof v = Some T \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> [Push v],[] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (T#ST) E A]\"\nby(simp add: ty\\<^sub>i'_def wt_defs)\n\n\nlemma wt_Pop:\n \"\\<turnstile> [Pop],[] [::] (ty\\<^sub>i' (T#ST) E A # ty\\<^sub>i' ST E A # \\<tau>s)\"\nby(simp add: ty\\<^sub>i'_def wt_defs)\n\nlemma wt_BinOpInstr:\n  \"P \\<turnstile> T1\\<guillemotleft>bop\\<guillemotright>T2 :: T \\<Longrightarrow> \\<turnstile> [BinOpInstr bop],[] [::] [ty\\<^sub>i' (T2 # T1 # ST) E A, ty\\<^sub>i' (T # ST) E A]\"\nby(auto simp:ty\\<^sub>i'_def wt_defs dest: WT_binop_WTrt_binop intro: list_all2_refl)\n\nlemma wt_Load:\n  \"\\<lbrakk> size ST < mxs; size E \\<le> mxl; i \\<in>\\<in> A; i < size E \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> [Load i],[] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (E!i # ST) E A]\"\nby(auto simp add:ty\\<^sub>i'_def wt_defs ty\\<^sub>l_def hyperset_defs intro: widens_refl)\n\n\nlemma wt_Store:\n \"\\<lbrakk> P \\<turnstile> T \\<le> E!i; i < size E; size E \\<le> mxl \\<rbrakk> \\<Longrightarrow>\n  \\<turnstile> [Store i],[] [::] [ty\\<^sub>i' (T#ST) E A, ty\\<^sub>i' ST E (\\<lfloor>{i}\\<rfloor> \\<squnion> A)]\"\nby(auto simp:hyperset_defs nth_list_update ty\\<^sub>i'_def wt_defs ty\\<^sub>l_def\n        intro:list_all2_all_nthI)\n\n\nlemma wt_Get:\n \"\\<lbrakk> P \\<turnstile> C sees F:T (fm) in D; class_type_of' U = \\<lfloor>C\\<rfloor> \\<rbrakk> \\<Longrightarrow>\n  \\<turnstile> [Getfield F D],[] [::] [ty\\<^sub>i' (U # ST) E A, ty\\<^sub>i' (T # ST) E A]\"\nby(cases U)(auto simp: ty\\<^sub>i'_def wt_defs dest: sees_field_idemp sees_field_decl_above intro: widens_refl widen_trans widen_array_object)\n\nlemma wt_Put:\n  \"\\<lbrakk> P \\<turnstile> C sees F:T (fm) in D; class_type_of' U = \\<lfloor>C\\<rfloor>; P \\<turnstile> T' \\<le> T \\<rbrakk> \\<Longrightarrow>\n  \\<turnstile> [Putfield F D],[] [::] [ty\\<^sub>i' (T' # U # ST) E A, ty\\<^sub>i' ST E A]\"\nby(cases U)(auto 4 3 intro: sees_field_idemp widen_trans widen_array_object dest: sees_field_decl_above simp: ty\\<^sub>i'_def wt_defs)\n\nlemma wt_Throw:\n  \"P \\<turnstile> C \\<preceq>\\<^sup>* Throwable \\<Longrightarrow> \\<turnstile> [ThrowExc],[] [::] [ty\\<^sub>i' (Class C # ST) E A, \\<tau>']\"\nby(simp add: ty\\<^sub>i'_def wt_defs)\n\n\nlemma wt_IfFalse:\n  \"\\<lbrakk> 2 \\<le> i; nat i < size \\<tau>s + 2; P \\<turnstile> ty\\<^sub>i' ST E A \\<le>' \\<tau>s ! nat(i - 2) \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> [IfFalse i],[] [::] ty\\<^sub>i' (Boolean # ST) E A # ty\\<^sub>i' ST E A # \\<tau>s\"\nby(auto simp add: ty\\<^sub>i'_def wt_defs eval_nat_numeral nat_diff_distrib)\n\n\nlemma wt_Goto:\n \"\\<lbrakk> 0 \\<le> int pc + i; nat (int pc + i) < size \\<tau>s; size \\<tau>s \\<le> mpc;\n    P \\<turnstile> \\<tau>s!pc \\<le>' \\<tau>s ! nat (int pc + i) \\<rbrakk>\n \\<Longrightarrow> P,T,mxs,mpc,[] \\<turnstile> Goto i,pc :: \\<tau>s\"\nby(clarsimp simp add: wt_defs)\n\nend\n\ncontext TC3 begin\n\nlemma wt_Invoke:\n  \"\\<lbrakk> size es = size Ts'; class_type_of' U = \\<lfloor>C\\<rfloor>; P \\<turnstile> C sees M: Ts\\<rightarrow>T = m in D; P \\<turnstile> Ts' [\\<le>] Ts \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> [Invoke M (size es)],[] [::] [ty\\<^sub>i' (rev Ts' @ U # ST) E A, ty\\<^sub>i' (T#ST) E A]\"\napply(clarsimp simp add: ty\\<^sub>i'_def wt_defs)\napply safe\napply(simp_all (no_asm_use))\napply(auto simp add: intro: widens_refl)\ndone\n\nend\n\ndeclare nth_append[simp del]\ndeclare [[simproc del: list_to_set_comprehension]]\n\ncontext TC2 begin\n\ncorollary wt_instrs_app3[simp]:\n  \"\\<lbrakk> \\<turnstile> (is\\<^sub>2 :: 'b instr list),[] [::] (\\<tau>' # \\<tau>s\\<^sub>2);  \\<turnstile> is\\<^sub>1,xt\\<^sub>1 [::] \\<tau> # \\<tau>s\\<^sub>1 @ [\\<tau>']; size \\<tau>s\\<^sub>1+1 = size is\\<^sub>1\\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> (is\\<^sub>1 @ is\\<^sub>2),xt\\<^sub>1 [::] \\<tau> # \\<tau>s\\<^sub>1 @ \\<tau>' # \\<tau>s\\<^sub>2\"\nusing wt_instrs_app2[where ?xt\\<^sub>2.0 = \"[]\" and ?'b = \"'b\"] by (simp add:shift_def)\n\n\ncorollary wt_instrs_Cons3[simp]:\n  \"\\<lbrakk> \\<tau>s \\<noteq> []; \\<turnstile> [i],[] [::] [\\<tau>,\\<tau>']; \\<turnstile> is,[] [::] \\<tau>'#\\<tau>s \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> (i # is),[] [::] \\<tau> # \\<tau>' # \\<tau>s\"\nusing wt_instrs_Cons[where ?xt = \"[]\"]\nby (simp add:shift_def)\n\nlemma wt_instrs_xapp:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>1 @ is\\<^sub>2, xt [::] \\<tau>s\\<^sub>1 @ ty\\<^sub>i' (Class D # ST) E A # \\<tau>s\\<^sub>2;\n     \\<forall>\\<tau> \\<in> set \\<tau>s\\<^sub>1. \\<forall>ST' LT'. \\<tau> = Some(ST',LT') \\<longrightarrow> \n      size ST \\<le> size ST' \\<and> P \\<turnstile> Some (drop (size ST' - size ST) ST',LT') \\<le>' ty\\<^sub>i' ST E A;\n     size is\\<^sub>1 = size \\<tau>s\\<^sub>1; size ST < mxs; case Co of None \\<Rightarrow> D = Throwable | Some C \\<Rightarrow> D = C \\<and> is_class P C  \\<rbrakk> \\<Longrightarrow>\n  \\<turnstile> is\\<^sub>1 @ is\\<^sub>2, xt @ [(0,size is\\<^sub>1 - Suc n,Co,size is\\<^sub>1,size ST)] [::] \\<tau>s\\<^sub>1 @ ty\\<^sub>i' (Class D # ST) E A # \\<tau>s\\<^sub>2\"\napply(simp add:wt_instrs_def split del: option.split_asm)\napply(rule conjI)\n apply(clarsimp split del: option.split_asm)\n apply arith\napply(clarsimp split del: option.split_asm)\napply(erule allE, erule (1) impE)\napply(clarsimp simp add: wt_instr_def app_def eff_def split del: option.split_asm)\napply(rule conjI)\n apply (thin_tac \"\\<forall>x\\<in> ?A \\<union> ?B. ?P x\")\n apply (thin_tac \"\\<forall>x\\<in> ?A \\<union> ?B. ?P x\")\n apply (clarsimp simp add: xcpt_app_def relevant_entries_def split del: option.split_asm)\n apply (simp add: nth_append is_relevant_entry_def split: split_if_asm split del: option.split_asm)\n  apply (drule_tac x=\"\\<tau>s\\<^sub>1!pc\" in bspec)\n   apply (blast intro: nth_mem) \n  apply fastforce\n apply fastforce\napply (rule conjI)\n apply(clarsimp split del: option.split_asm)\n apply (erule disjE, blast)\n apply (erule disjE, blast)\n apply (clarsimp simp add: xcpt_eff_def relevant_entries_def split: split_if_asm)\napply(clarsimp split del: option.split_asm)\napply (erule disjE, blast)\napply (erule disjE, blast)\napply (clarsimp simp add: xcpt_eff_def relevant_entries_def split: split_if_asm split del: option.split_asm)\napply (simp add: nth_append is_relevant_entry_def split: split_if_asm split del: option.split_asm)\n apply (drule_tac x = \"\\<tau>s\\<^sub>1!pc\" in bspec)\n  apply (blast intro: nth_mem)\n apply (fastforce simp add: ty\\<^sub>i'_def)\ndone\n\nlemma wt_instrs_xapp_Some[trans]:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>1 @ is\\<^sub>2, xt [::] \\<tau>s\\<^sub>1 @ ty\\<^sub>i' (Class C # ST) E A # \\<tau>s\\<^sub>2;\n     \\<forall>\\<tau> \\<in> set \\<tau>s\\<^sub>1. \\<forall>ST' LT'. \\<tau> = Some(ST',LT') \\<longrightarrow> \n      size ST \\<le> size ST' \\<and> P \\<turnstile> Some (drop (size ST' - size ST) ST',LT') \\<le>' ty\\<^sub>i' ST E A;\n     size is\\<^sub>1 = size \\<tau>s\\<^sub>1; is_class P C; size ST < mxs  \\<rbrakk> \\<Longrightarrow>\n  \\<turnstile> is\\<^sub>1 @ is\\<^sub>2, xt @ [(0,size is\\<^sub>1 - Suc n,Some C,size is\\<^sub>1,size ST)] [::] \\<tau>s\\<^sub>1 @ ty\\<^sub>i' (Class C # ST) E A # \\<tau>s\\<^sub>2\"\nby(erule (3) wt_instrs_xapp) simp\n\nlemma wt_instrs_xapp_Any:\n  \"\\<lbrakk> \\<turnstile> is\\<^sub>1 @ is\\<^sub>2, xt [::] \\<tau>s\\<^sub>1 @ ty\\<^sub>i' (Class Throwable # ST) E A # \\<tau>s\\<^sub>2;\n     \\<forall>\\<tau> \\<in> set \\<tau>s\\<^sub>1. \\<forall>ST' LT'. \\<tau> = Some(ST',LT') \\<longrightarrow> \n      size ST \\<le> size ST' \\<and> P \\<turnstile> Some (drop (size ST' - size ST) ST',LT') \\<le>' ty\\<^sub>i' ST E A;\n     size is\\<^sub>1 = size \\<tau>s\\<^sub>1; size ST < mxs \\<rbrakk> \\<Longrightarrow>\n  \\<turnstile> is\\<^sub>1 @ is\\<^sub>2, xt @ [(0,size is\\<^sub>1 - Suc n,None,size is\\<^sub>1,size ST)] [::] \\<tau>s\\<^sub>1 @ ty\\<^sub>i' (Class Throwable # ST) E A # \\<tau>s\\<^sub>2\"\nby(erule (3) wt_instrs_xapp) simp\n\nend\n\ndeclare [[simproc add: list_to_set_comprehension]]\ndeclare nth_append[simp]\n\nlemma drop_Cons_Suc:\n  \"\\<And>xs. drop n xs = y#ys \\<Longrightarrow> drop (Suc n) xs = ys\"\n  apply (induct n)\n   apply simp\n  apply (simp add: drop_Suc)\n  done\n\nlemma drop_mess:\n  \"\\<lbrakk>Suc (length xs\\<^sub>0) \\<le> length xs; drop (length xs - Suc (length xs\\<^sub>0)) xs = x # xs\\<^sub>0\\<rbrakk> \n  \\<Longrightarrow> drop (length xs - length xs\\<^sub>0) xs = xs\\<^sub>0\"\napply (cases xs)\n apply simp\napply (simp add: Suc_diff_le)\napply (case_tac \"length list - length xs\\<^sub>0\")\n apply simp\napply (simp add: drop_Cons_Suc)\ndone\n\nlemma drop_mess2:\n  assumes len: \"Suc (Suc (length xs0)) \\<le> length xs\" \n  and drop: \"drop (length xs - Suc (Suc (length xs0))) xs = x1 # x2 # xs0\"\n  shows \"drop (length xs - length xs0) xs = xs0\"\nproof(cases xs)\n  case Nil with assms show ?thesis by simp\nnext\n  case (Cons x xs')\n  note Cons[simp]\n  show ?thesis\n  proof(cases xs')\n    case Nil with assms show ?thesis by(simp)\n  next\n    case (Cons x' xs'')\n    note Cons[simp]\n    show ?thesis \n    proof(rule drop_mess)\n      from len show \"Suc (length xs0) \\<le> length xs\" by simp\n    next\n      have \"drop (length xs - length (x2 # xs0)) xs = x2 # xs0\"\n      proof(rule drop_mess)\n        from len show \"Suc (length (x2 # xs0)) \\<le> length xs\" by(simp)\n      next\n        from drop show \"drop (length xs - Suc (length (x2 # xs0))) xs = x1 # x2 # xs0\" by simp\n      qed\n      thus \"drop (length xs - Suc (length xs0)) xs = x2 # xs0\" by(simp)\n    qed\n  qed\nqed\n\nabbreviation postfix :: \"'a list \\<Rightarrow> 'a list \\<Rightarrow> bool\" where\n  \"postfix xs ys \\<equiv> suffixeq ys xs\"\n\nnotation (xsymbols) \n  postfix (\"(_/ \\<guillemotright>= _)\" [51, 50] 50)\n\nlemma postfix_conv_eq_length_drop: \n  \"ST' \\<guillemotright>= ST \\<longleftrightarrow> length ST \\<le> length ST' \\<and> drop (length ST' - length ST) ST' = ST\"\napply(auto)\napply (metis append_eq_conv_conj append_take_drop_id diff_is_0_eq drop_0 linorder_not_less nat_le_linear suffixeq_take)\napply (metis append_take_drop_id length_drop suffixeq_take same_append_eq size_list_def)\nby (metis suffixeq_drop)\n\ndeclare suffixeq_ConsI[simp]\n\ncontext TC0 begin\n\ndeclare after_def[simp] pair_eq_ty\\<^sub>i'_conv[simp] \n\nlemma\n  assumes \"ST0 \\<guillemotright>= ST'\"\n  shows compT_ST_prefix: \n  \"\\<lfloor>(ST,LT)\\<rfloor> \\<in> set(compT E A ST0 e) \\<Longrightarrow> ST \\<guillemotright>= ST'\"\n\n  and compTs_ST_prefix:\n  \"\\<lfloor>(ST,LT)\\<rfloor> \\<in> set(compTs E A ST0 es) \\<Longrightarrow> ST \\<guillemotright>= ST'\"\nusing assms\nby(induct E A ST0 e and E A ST0 es rule: compT_compTs_induct) auto\n\ndeclare after_def[simp del] pair_eq_ty\\<^sub>i'_conv[simp del]\n\nend\ndeclare suffixeq_ConsI[simp del]\n\n(* FIXME *)\nlemma fun_of_simp [simp]: \"fun_of S x y = ((x,y) \\<in> S)\" \nby (simp add: fun_of_def)\n\ndeclare widens_refl [iff]\n\ncontext TC3 begin\n\ntheorem compT_wt_instrs:\n  \"\\<lbrakk> P,E \\<turnstile>1 e :: T; \\<D> e A; \\<B> e (size E); size ST + max_stack e \\<le> mxs; size E + max_vars e \\<le> mxl; set E \\<subseteq> types P \\<rbrakk>\n  \\<Longrightarrow> \\<turnstile> compE2 e, compxE2 e 0 (size ST) [::] ty\\<^sub>i' ST E A # compT E A ST e @ [after E A ST e]\"\n  (is \"PROP ?P e E T A ST\")\n\n  and compTs_wt_instrs:\n  \"\\<lbrakk> P,E \\<turnstile>1 es[::]Ts;  \\<D>s es A; \\<B>s es (size E); size ST + max_stacks es \\<le> mxs; size E + max_varss es \\<le> mxl; set E \\<subseteq> types P \\<rbrakk>\n  \\<Longrightarrow> let \\<tau>s = ty\\<^sub>i' ST E A # compTs E A ST es\n      in \\<turnstile> compEs2 es,compxEs2 es 0 (size ST) [::] \\<tau>s \\<and> last \\<tau>s = ty\\<^sub>i' (rev Ts @ ST) E (A \\<squnion> \\<A>s es)\"\n  (is \"PROP ?Ps es E Ts A ST\")\nproof(induct E A ST e and E A ST es arbitrary: T and Ts rule: compT_compTs_induct)\n  case (TryCatch E A ST e\\<^sub>1 C i e\\<^sub>2)\n  hence [simp]: \"i = size E\" by simp\n  have wt\\<^sub>1: \"P,E \\<turnstile>1 e\\<^sub>1 :: T\" and wt\\<^sub>2: \"P,E@[Class C] \\<turnstile>1 e\\<^sub>2 :: T\"\n    and \"class\": \"is_class P C\" using TryCatch by auto\n  let ?A\\<^sub>1 = \"A \\<squnion> \\<A> e\\<^sub>1\" let ?A\\<^sub>i = \"A \\<squnion> \\<lfloor>{i}\\<rfloor>\" let ?E\\<^sub>i = \"E @ [Class C]\"\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>1 = \"compT E A ST e\\<^sub>1\"\n  let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' (T#ST) E ?A\\<^sub>1\" let ?\\<tau>\\<^sub>2 = \"ty\\<^sub>i' (Class C#ST) E A\"\n  let ?\\<tau>\\<^sub>3 = \"ty\\<^sub>i' ST ?E\\<^sub>i ?A\\<^sub>i\" let ?\\<tau>s\\<^sub>2 = \"compT ?E\\<^sub>i ?A\\<^sub>i ST e\\<^sub>2\"\n  let ?\\<tau>\\<^sub>2' = \"ty\\<^sub>i' (T#ST) ?E\\<^sub>i (?A\\<^sub>i \\<squnion> \\<A> e\\<^sub>2)\"\n  let ?\\<tau>' = \"ty\\<^sub>i' (T#ST) E (A \\<squnion> \\<A> e\\<^sub>1 \\<sqinter> (\\<A> e\\<^sub>2 \\<ominus> i))\"\n  let ?go = \"Goto (int(size(compE2 e\\<^sub>2)) + 2)\"\n  have \"PROP ?P e\\<^sub>2 ?E\\<^sub>i T ?A\\<^sub>i ST\" by fact\n  hence \"\\<turnstile> compE2 e\\<^sub>2,compxE2 e\\<^sub>2 0 (size ST) [::] (?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2) @ [?\\<tau>\\<^sub>2']\"\n    using TryCatch.prems \"class\" by(auto simp:after_def)\n  also have \"?A\\<^sub>i \\<squnion> \\<A> e\\<^sub>2 = (A \\<squnion> \\<A> e\\<^sub>2) \\<squnion> \\<lfloor>{size E}\\<rfloor>\"\n    by(fastforce simp:hyperset_defs)\n  also have \"P \\<turnstile> ty\\<^sub>i' (T#ST) ?E\\<^sub>i \\<dots> \\<le>' ty\\<^sub>i' (T#ST) E (A \\<squnion> \\<A> e\\<^sub>2)\"\n    by(simp add:hyperset_defs ty\\<^sub>l_incr ty\\<^sub>i'_def)\n  also have \"P \\<turnstile> \\<dots> \\<le>' ty\\<^sub>i' (T#ST) E (A \\<squnion> \\<A> e\\<^sub>1 \\<sqinter> (\\<A> e\\<^sub>2 \\<ominus> i))\"\n    by(auto intro!: ty\\<^sub>l_antimono simp:hyperset_defs ty\\<^sub>i'_def)\n  also have \"(?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2) @ [?\\<tau>'] = ?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2 @ [?\\<tau>']\" by simp\n  also have \"\\<turnstile> [Store i],[] [::] ?\\<tau>\\<^sub>2 # [] @ [?\\<tau>\\<^sub>3]\"\n    using TryCatch.prems\n    by(auto simp:nth_list_update wt_defs ty\\<^sub>i'_def ty\\<^sub>l_def\n      list_all2_conv_all_nth hyperset_defs)\n  also have \"[] @ (?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2 @ [?\\<tau>']) = (?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2 @ [?\\<tau>'])\" by simp\n  also have \"P,T\\<^sub>r,mxs,size(compE2 e\\<^sub>2)+3,[] \\<turnstile> ?go,0 :: ?\\<tau>\\<^sub>1#?\\<tau>\\<^sub>2#?\\<tau>\\<^sub>3#?\\<tau>s\\<^sub>2 @ [?\\<tau>']\"\n    by(auto simp: hyperset_defs ty\\<^sub>i'_def wt_defs nth_Cons nat_add_distrib\n      fun_of_def intro: ty\\<^sub>l_antimono list_all2_refl split:nat.split)\n  also have \"\\<turnstile> compE2 e\\<^sub>1,compxE2 e\\<^sub>1 0 (size ST) [::] ?\\<tau> # ?\\<tau>s\\<^sub>1 @ [?\\<tau>\\<^sub>1]\"\n    using TryCatch by(auto simp:after_def)\n  also have \"?\\<tau> # ?\\<tau>s\\<^sub>1 @ ?\\<tau>\\<^sub>1 # ?\\<tau>\\<^sub>2 # ?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2 @ [?\\<tau>'] =\n             (?\\<tau> # ?\\<tau>s\\<^sub>1 @ [?\\<tau>\\<^sub>1]) @ ?\\<tau>\\<^sub>2 # ?\\<tau>\\<^sub>3 # ?\\<tau>s\\<^sub>2 @ [?\\<tau>']\" by simp\n  also have \"compE2 e\\<^sub>1 @ ?go  # [Store i] @ compE2 e\\<^sub>2 =\n             (compE2 e\\<^sub>1 @ [?go]) @ (Store i # compE2 e\\<^sub>2)\" by simp\n  also \n  let \"?Q \\<tau>\" = \"\\<forall>ST' LT'. \\<tau> = \\<lfloor>(ST', LT')\\<rfloor> \\<longrightarrow> \n    size ST \\<le> size ST' \\<and> P \\<turnstile> Some (drop (size ST' - size ST) ST',LT') \\<le>' ty\\<^sub>i' ST E A\"\n  {\n    have \"?Q (ty\\<^sub>i' ST E A)\" by(clarsimp simp add: ty\\<^sub>i'_def)\n    moreover have \"?Q (ty\\<^sub>i' (T # ST) E ?A\\<^sub>1)\" \n      by (fastforce simp add: ty\\<^sub>i'_def hyperset_defs intro!: ty\\<^sub>l_antimono)\n    moreover { fix \\<tau>\n      assume \\<tau>: \"\\<tau> \\<in> set (compT E A ST e\\<^sub>1)\"\n      hence \"\\<forall>ST' LT'. \\<tau> = \\<lfloor>(ST', LT')\\<rfloor> \\<longrightarrow> ST' \\<guillemotright>= ST\" by(auto intro: compT_ST_prefix[OF suffixeq_refl])\n      with \\<tau> have \"?Q \\<tau>\" unfolding postfix_conv_eq_length_drop using `\\<B> (try e\\<^sub>1 catch(C i) e\\<^sub>2) (length E)`\n        by(fastforce dest!: compT_LT_prefix simp add: ty\\<^sub>i'_def) }\n    ultimately\n    have \"\\<forall>\\<tau>\\<in>set (ty\\<^sub>i' ST E A # compT E A ST e\\<^sub>1 @ [ty\\<^sub>i' (T # ST) E ?A\\<^sub>1]). ?Q \\<tau>\" by auto\n  }\n  also from TryCatch.prems max_stack1[of e\\<^sub>1] have \"size ST + 1 \\<le> mxs\" by auto\n  ultimately show ?case using wt\\<^sub>1 wt\\<^sub>2 TryCatch.prems \"class\"\n    by (simp add:after_def)(erule_tac x=0 in meta_allE, simp)\nnext\n  case (Synchronized E A ST i e1 e2)\n  note wt = `P,E \\<turnstile>1 sync\\<^bsub>i\\<^esub> (e1) e2 :: T`\n  then obtain U where wt1: \"P,E \\<turnstile>1 e1 :: U\"\n    and U: \"is_refT U\" \"U \\<noteq> NT\"\n    and wt2: \"P,E@[Class Object] \\<turnstile>1 e2 :: T\" by auto\n  from `\\<B> (sync\\<^bsub>i\\<^esub> (e1) e2) (length E)` have [simp]: \"i = length E\"\n    and B1: \"\\<B> e1 (length E)\" and B2: \"\\<B> e2 (length (E@[Class Object]))\" by auto\n  \n  note lenST = `length ST + max_stack (sync\\<^bsub>i\\<^esub> (e1) e2) \\<le> mxs` \n  note lenE = `length E + max_vars (sync\\<^bsub>i\\<^esub> (e1) e2) \\<le> mxl`\n\n  let ?A1 = \"A \\<squnion> \\<A> e1\" let ?A2 = \"?A1 \\<squnion> \\<lfloor>{i}\\<rfloor>\"\n  let ?A3 = \"?A2 \\<squnion> \\<A> e2\" let ?A4 = \"?A1 \\<squnion> \\<A> e2\"\n  let ?E1 = \"E @ [Class Object]\"\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s1 = \"compT E A ST e1\"\n  let ?\\<tau>1 = \"ty\\<^sub>i' (U#ST) E ?A1\"\n  let ?\\<tau>1' = \"ty\\<^sub>i' (Class Object # Class Object # ST) E ?A1\"\n  let ?\\<tau>1'' = \"ty\\<^sub>i' (Class Object#ST) ?E1 ?A2\"\n  let ?\\<tau>1''' = \"ty\\<^sub>i' ST ?E1 ?A2\"\n  let ?\\<tau>s2 = \"compT ?E1 ?A2 ST e2\"\n  let ?\\<tau>2 = \"ty\\<^sub>i' (T#ST) ?E1 ?A3\" let ?\\<tau>2' = \"ty\\<^sub>i' (Class Object#T#ST) ?E1 ?A3\"\n  let ?\\<tau>2'' = ?\\<tau>2\n  let ?\\<tau>3 = \"ty\\<^sub>i' (Class Throwable#ST) ?E1 ?A2\"\n  let ?\\<tau>3' = \"ty\\<^sub>i' (Class Object#Class Throwable#ST) ?E1 ?A2\"\n  let ?\\<tau>3'' = ?\\<tau>3\n  let ?\\<tau>' = \"ty\\<^sub>i' (T#ST) E ?A4\"\n\n  from lenE lenST max_stack1[of e2] U \n  have \"\\<turnstile> [Load i, MExit, ThrowExc], [] [::] [?\\<tau>3, ?\\<tau>3', ?\\<tau>3'', ?\\<tau>']\"\n    by(auto simp add: ty\\<^sub>i'_def ty\\<^sub>l_def wt_defs hyperset_defs nth_Cons split: nat.split)\n  also have \"P,T\\<^sub>r,mxs,5,[] \\<turnstile> Goto 4,0 :: [?\\<tau>2'', ?\\<tau>3, ?\\<tau>3', ?\\<tau>3'', ?\\<tau>']\"\n    by(auto simp: hyperset_defs ty\\<^sub>i'_def wt_defs intro: ty\\<^sub>l_antimono ty\\<^sub>l_incr)\n  also have \"P,T\\<^sub>r,mxs,6,[] \\<turnstile> MExit,0 :: [?\\<tau>2', ?\\<tau>2'', ?\\<tau>3, ?\\<tau>3', ?\\<tau>3'', ?\\<tau>']\"\n    by(auto simp: hyperset_defs ty\\<^sub>i'_def wt_defs intro: ty\\<^sub>l_antimono ty\\<^sub>l_incr)\n  also from lenE lenST max_stack1[of e2]\n  have \"P,T\\<^sub>r,mxs,7,[] \\<turnstile> Load i,0 :: [?\\<tau>2, ?\\<tau>2', ?\\<tau>2'', ?\\<tau>3, ?\\<tau>3', ?\\<tau>3'', ?\\<tau>']\"\n    by(auto simp: hyperset_defs ty\\<^sub>i'_def wt_defs ty\\<^sub>l_def intro: ty\\<^sub>l_antimono)\n  also from `\\<D> (sync\\<^bsub>i\\<^esub> (e1) e2) A` have \"\\<D> e2 (A \\<squnion> \\<A> e1 \\<squnion> \\<lfloor>{length E}\\<rfloor>)\"\n    by(auto elim!: D_mono' simp add: hyperset_defs)\n  with `PROP ?P e2 ?E1 T ?A2 ST` Synchronized wt2 is_class_Object[OF wf_prog]\n  have \"\\<turnstile> compE2 e2, compxE2 e2 0 (size ST) [::] ?\\<tau>1'''#?\\<tau>s2@[?\\<tau>2]\"\n    by(auto simp add: after_def)\n  finally have \"\\<turnstile> (compE2 e2 @ [Load i, MExit, Goto 4]) @ [Load i, MExit, ThrowExc], compxE2 e2 0 (size ST) [::]\n             (?\\<tau>1''' # ?\\<tau>s2 @ [?\\<tau>2, ?\\<tau>2', ?\\<tau>2'']) @ [?\\<tau>3, ?\\<tau>3', ?\\<tau>3'', ?\\<tau>']\"\n    by(simp)\n  hence \"\\<turnstile> (compE2 e2 @ [Load i, MExit, Goto 4]) @ [Load i, MExit, ThrowExc],\n           compxE2 e2 0 (size ST) @ [(0, size (compE2 e2 @ [Load i, MExit, Goto 4]) - Suc 2, None, size (compE2 e2 @ [Load i, MExit, Goto 4]), size ST)] [::]\n           (?\\<tau>1''' # ?\\<tau>s2 @ [?\\<tau>2, ?\\<tau>2', ?\\<tau>2'']) @ [?\\<tau>3, ?\\<tau>3', ?\\<tau>3'', ?\\<tau>']\"\n  proof(rule wt_instrs_xapp_Any)\n    from lenST show \"length ST < mxs\" by simp\n  next\n    show \"\\<forall>\\<tau>\\<in>set (?\\<tau>1''' # ?\\<tau>s2 @ [?\\<tau>2, ?\\<tau>2', ?\\<tau>2'']). \\<forall>ST' LT'.\n          \\<tau> = \\<lfloor>(ST', LT')\\<rfloor> \\<longrightarrow> length ST \\<le> length ST' \\<and>\n          P \\<turnstile> \\<lfloor>(drop (length ST' - length ST) ST',  LT')\\<rfloor> \\<le>' ty\\<^sub>i' ST (E @ [Class Object]) ?A2\"\n    proof(intro strip)\n      fix \\<tau> ST' LT'\n      assume \"\\<tau>\\<in>set (?\\<tau>1''' # ?\\<tau>s2 @ [?\\<tau>2, ?\\<tau>2', ?\\<tau>2''])\" \"\\<tau> = \\<lfloor>(ST', LT')\\<rfloor>\"\n      hence \\<tau>: \"\\<lfloor>(ST', LT')\\<rfloor> \\<in> set (?\\<tau>1''' # ?\\<tau>s2 @ [?\\<tau>2, ?\\<tau>2', ?\\<tau>2''])\" by simp\n      show \"length ST \\<le> length ST' \\<and> P \\<turnstile> \\<lfloor>(drop (length ST' - length ST) ST',  LT')\\<rfloor> \\<le>' ty\\<^sub>i' ST (E @ [Class Object]) ?A2\"\n      proof(cases \"\\<lfloor>(ST', LT')\\<rfloor> \\<in> set ?\\<tau>s2\")\n        case True\n        from compT_ST_prefix[OF suffixeq_refl this] compT_LT_prefix[OF this B2]\n        show ?thesis unfolding postfix_conv_eq_length_drop by(simp add: ty\\<^sub>i'_def)\n      next\n        case False\n        with \\<tau> show ?thesis\n          by(auto simp add: ty\\<^sub>i'_def hyperset_defs intro: ty\\<^sub>l_antimono)\n      qed\n    qed\n  qed simp\n  hence \"\\<turnstile> compE2 e2 @ [Load i, MExit, Goto 4, Load i, MExit, ThrowExc],\n           compxE2 e2 0 (size ST) @ [(0, size (compE2 e2), None, Suc (Suc (Suc (size (compE2 e2)))), size ST)] [::]\n           ?\\<tau>1''' # ?\\<tau>s2 @ [?\\<tau>2, ?\\<tau>2', ?\\<tau>2'', ?\\<tau>3, ?\\<tau>3', ?\\<tau>3'', ?\\<tau>']\" by simp\n  also from wt1 `set E \\<subseteq> types P` have \"is_type P U\" by(rule WT1_is_type[OF wf_prog])\n  with U have \"P \\<turnstile> U \\<le> Class Object\" by(auto elim!: is_refT.cases intro: subcls_C_Object[OF _ wf_prog] widen_array_object)\n  with lenE lenST max_stack1[of e2]\n  have \"\\<turnstile> [Dup, Store i, MEnter], [] [::] [?\\<tau>1, ?\\<tau>1', ?\\<tau>1''] @ [?\\<tau>1''']\"\n    by(auto simp add: ty\\<^sub>i'_def ty\\<^sub>l_def wt_defs hyperset_defs nth_Cons nth_list_update list_all2_conv_all_nth split: nat.split)\n  finally have \"\\<turnstile> Dup # Store i # MEnter # compE2 e2 @ [Load i, MExit, Goto 4, Load i, MExit, ThrowExc],\n               compxE2 e2 3 (size ST) @ [(3, 3 + size (compE2 e2), None, 6 + size (compE2 e2), size ST)]\n            [::] ?\\<tau>1 # ?\\<tau>1' # ?\\<tau>1'' # ?\\<tau>1''' # ?\\<tau>s2 @ [?\\<tau>2, ?\\<tau>2', ?\\<tau>2'', ?\\<tau>3, ?\\<tau>3', ?\\<tau>3'', ?\\<tau>']\"\n    by(simp add: eval_nat_numeral shift_def)\n  also from `PROP ?P e1 E U A ST` wt1 B1 `\\<D> (sync\\<^bsub>i\\<^esub> (e1) e2) A` lenE lenST `set E \\<subseteq> types P`\n  have \"\\<turnstile> compE2 e1, compxE2 e1 0 (size ST) [::] ?\\<tau>#?\\<tau>s1@[?\\<tau>1]\"\n    by(auto simp add: after_def)\n  finally show ?case using wt1 wt2 wt by(simp add: after_def ac_simps shift_Cons_tuple hyperUn_assoc)\nnext\n  case new thus ?case by(auto simp add:after_def wt_New)\nnext\n  case (BinOp E A ST e\\<^sub>1 bop e\\<^sub>2) \n  have T: \"P,E \\<turnstile>1 e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2 :: T\" by fact\n  then obtain T\\<^sub>1 T\\<^sub>2 where T\\<^sub>1: \"P,E \\<turnstile>1 e\\<^sub>1 :: T\\<^sub>1\" and T\\<^sub>2: \"P,E \\<turnstile>1 e\\<^sub>2 :: T\\<^sub>2\" and \n    bopT: \"P \\<turnstile> T\\<^sub>1\\<guillemotleft>bop\\<guillemotright>T\\<^sub>2 :: T\" by auto\n  let ?A\\<^sub>1 = \"A \\<squnion> \\<A> e\\<^sub>1\" let ?A\\<^sub>2 = \"?A\\<^sub>1 \\<squnion> \\<A> e\\<^sub>2\"\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>1 = \"compT E A ST e\\<^sub>1\"\n  let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' (T\\<^sub>1#ST) E ?A\\<^sub>1\" let ?\\<tau>s\\<^sub>2 = \"compT E ?A\\<^sub>1 (T\\<^sub>1#ST) e\\<^sub>2\"\n  let ?\\<tau>\\<^sub>2 = \"ty\\<^sub>i' (T\\<^sub>2#T\\<^sub>1#ST) E ?A\\<^sub>2\" let ?\\<tau>' = \"ty\\<^sub>i' (T#ST) E ?A\\<^sub>2\"\n  from bopT have \"\\<turnstile> [BinOpInstr bop],[] [::] [?\\<tau>\\<^sub>2,?\\<tau>']\" by(rule wt_BinOpInstr)\n  also from BinOp.hyps(2)[of T\\<^sub>2] BinOp.prems T\\<^sub>2 T\\<^sub>1\n  have \"\\<turnstile> compE2 e\\<^sub>2, compxE2 e\\<^sub>2 0 (size (ty E e\\<^sub>1#ST)) [::] ?\\<tau>\\<^sub>1#?\\<tau>s\\<^sub>2@[?\\<tau>\\<^sub>2]\" by (auto simp: after_def)\n  also from BinOp T\\<^sub>1 have \"\\<turnstile> compE2 e\\<^sub>1, compxE2 e\\<^sub>1 0 (size ST) [::] ?\\<tau>#?\\<tau>s\\<^sub>1@[?\\<tau>\\<^sub>1]\" \n    by (auto simp: after_def)\n  finally show ?case using T T\\<^sub>1 T\\<^sub>2 by (simp add: after_def hyperUn_assoc)\nnext\n  case (Cons E A ST e es)\n  have \"P,E \\<turnstile>1 e # es [::] Ts\" by fact\n  then obtain T\\<^sub>e Ts' where \n    T\\<^sub>e: \"P,E \\<turnstile>1 e :: T\\<^sub>e\" and Ts': \"P,E \\<turnstile>1 es [::] Ts'\" and\n    Ts: \"Ts = T\\<^sub>e#Ts'\" by auto\n  let ?A\\<^sub>e = \"A \\<squnion> \\<A> e\"  \n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>e = \"compT E A ST e\"  \n  let ?\\<tau>\\<^sub>e = \"ty\\<^sub>i' (T\\<^sub>e#ST) E ?A\\<^sub>e\" let ?\\<tau>s' = \"compTs E ?A\\<^sub>e (T\\<^sub>e#ST) es\"\n  let ?\\<tau>s = \"?\\<tau> # ?\\<tau>s\\<^sub>e @ (?\\<tau>\\<^sub>e # ?\\<tau>s')\"\n  from Cons.hyps(2) Cons.prems T\\<^sub>e Ts'\n  have \"\\<turnstile> compEs2 es, compxEs2 es 0 (size (T\\<^sub>e#ST)) [::] ?\\<tau>\\<^sub>e#?\\<tau>s'\" by (simp add: after_def)\n  also from Cons T\\<^sub>e have \"\\<turnstile> compE2 e, compxE2 e 0 (size ST) [::] ?\\<tau>#?\\<tau>s\\<^sub>e@[?\\<tau>\\<^sub>e]\" by (auto simp: after_def)\n  moreover\n  from Cons.hyps(2)[OF Ts'] Cons.prems T\\<^sub>e Ts' Ts\n  have \"last ?\\<tau>s = ty\\<^sub>i' (rev Ts@ST) E (?A\\<^sub>e \\<squnion> \\<A>s es)\" by simp\n  ultimately show ?case using T\\<^sub>e\n    by(auto simp add: after_def hyperUn_assoc shift_compxEs2 stack_xlift_compxEs2 simp del: compxE2_size_convs compxEs2_size_convs compxEs2_stack_xlift_convs compxE2_stack_xlift_convs intro: wt_instrs_app2)\nnext\n  case (FAss E A ST e\\<^sub>1 F D e\\<^sub>2)\n  hence Void: \"P,E \\<turnstile>1 e\\<^sub>1\\<bullet>F{D} := e\\<^sub>2 :: Void\" by auto\n  then obtain U C T T' fm where    \n    C: \"P,E \\<turnstile>1 e\\<^sub>1 :: U\" and U: \"class_type_of' U = \\<lfloor>C\\<rfloor>\" and sees: \"P \\<turnstile> C sees F:T (fm) in D\" and\n    T': \"P,E \\<turnstile>1 e\\<^sub>2 :: T'\" and T'_T: \"P \\<turnstile> T' \\<le> T\" by auto\n  let ?A\\<^sub>1 = \"A \\<squnion> \\<A> e\\<^sub>1\" let ?A\\<^sub>2 = \"?A\\<^sub>1 \\<squnion> \\<A> e\\<^sub>2\"  \n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>1 = \"compT E A ST e\\<^sub>1\"\n  let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' (U#ST) E ?A\\<^sub>1\" let ?\\<tau>s\\<^sub>2 = \"compT E ?A\\<^sub>1 (U#ST) e\\<^sub>2\"\n  let ?\\<tau>\\<^sub>2 = \"ty\\<^sub>i' (T'#U#ST) E ?A\\<^sub>2\" let ?\\<tau>\\<^sub>3 = \"ty\\<^sub>i' ST E ?A\\<^sub>2\"\n  let ?\\<tau>' = \"ty\\<^sub>i' (Void#ST) E ?A\\<^sub>2\"\n  from FAss.prems sees T'_T U\n  have \"\\<turnstile> [Putfield F D,Push Unit],[] [::] [?\\<tau>\\<^sub>2,?\\<tau>\\<^sub>3,?\\<tau>']\"\n    by (fastforce simp add: wt_Push wt_Put)\n  also from FAss.hyps(2)[of T'] FAss.prems T' C\n  have \"\\<turnstile> compE2 e\\<^sub>2, compxE2 e\\<^sub>2 0 (size ST+1) [::] ?\\<tau>\\<^sub>1#?\\<tau>s\\<^sub>2@[?\\<tau>\\<^sub>2]\"\n    by (auto simp add: after_def hyperUn_assoc) \n  also from FAss C have \"\\<turnstile> compE2 e\\<^sub>1, compxE2 e\\<^sub>1 0 (size ST) [::] ?\\<tau>#?\\<tau>s\\<^sub>1@[?\\<tau>\\<^sub>1]\" \n    by (auto simp add: after_def)\n  finally show ?case using Void C T' by (simp add: after_def hyperUn_assoc) \nnext\n  case Val thus ?case by(auto simp:after_def wt_Push)\nnext\n  case (Cast T exp) thus ?case by (auto simp:after_def wt_Cast)\nnext\n  case (InstanceOf E A ST e) thus ?case\n    by(auto simp:after_def intro!: wt_Instanceof wt_instrs_app3 intro: widen_refT refT_widen)\nnext\n  case (BlockNone E A ST i Ti e)\n  from `P,E \\<turnstile>1 {i:Ti=None; e} :: T` have wte: \"P,E@[Ti] \\<turnstile>1 e :: T\"\n    and Ti: \"is_type P Ti\" by auto\n  let ?\\<tau>s = \"ty\\<^sub>i' ST E A # compT (E @ [Ti]) (A\\<ominus>i) ST e\"\n  from BlockNone wte Ti\n  have \"\\<turnstile> compE2 e, compxE2 e 0 (size ST) [::] ?\\<tau>s @ [ty\\<^sub>i' (T#ST) (E@[Ti]) (A\\<ominus>(size E) \\<squnion> \\<A> e)]\"\n    by(auto simp add: after_def)\n  also have \"P \\<turnstile> ty\\<^sub>i' (T # ST) (E@[Ti]) (A \\<ominus> size E \\<squnion> \\<A> e) \\<le>' ty\\<^sub>i' (T # ST) (E@[Ti]) ((A \\<squnion> \\<A> e) \\<ominus> size E)\"\n    by(auto simp add:hyperset_defs intro: ty\\<^sub>i'_antimono)\n  also have \"\\<dots> = ty\\<^sub>i' (T # ST) E (A \\<squnion> \\<A> e)\" by simp\n  also have \"P \\<turnstile> \\<dots> \\<le>' ty\\<^sub>i' (T # ST) E (A \\<squnion> (\\<A> e \\<ominus> i))\"\n    by(auto simp add:hyperset_defs intro: ty\\<^sub>i'_antimono)\n  finally show ?case using BlockNone.prems by(simp add: after_def)\nnext\n  case (BlockSome E A ST i Ti v e)\n  from `P,E \\<turnstile>1 {i:Ti=\\<lfloor>v\\<rfloor>; e} :: T` obtain Tv\n    where Tv: \"P,E \\<turnstile>1 Val v :: Tv\" \"P \\<turnstile> Tv \\<le> Ti\"\n    and wte: \"P,E@[Ti] \\<turnstile>1 e :: T\"\n    and Ti: \"is_type P Ti\" by auto\n  from `length ST + max_stack {i:Ti=\\<lfloor>v\\<rfloor>; e} \\<le> mxs`\n  have lenST: \"length ST + max_stack e \\<le> mxs\" by simp\n  from `length E + max_vars {i:Ti=\\<lfloor>v\\<rfloor>; e} \\<le> mxl`\n  have lenE: \"length (E@[Ti]) + max_vars e \\<le> mxl\" by simp\n  from `\\<B> {i:Ti=\\<lfloor>v\\<rfloor>; e} (length E)` have [simp]: \"i = length E\"\n    and B: \"\\<B> e (length (E@[Ti]))\" by auto\n\n\n  from BlockSome wte\n  have \"\\<turnstile> compE2 e, compxE2 e 0 (size ST) [::] (ty\\<^sub>i' ST (E @ [Ti]) (A \\<squnion> \\<lfloor>{length E}\\<rfloor>) # compT (E @ [Ti]) (A \\<squnion> \\<lfloor>{i}\\<rfloor>) ST e) @ [ty\\<^sub>i' (T#ST) (E@[Ti]) (A \\<squnion> \\<lfloor>{size E}\\<rfloor> \\<squnion> \\<A> e)]\"\n    by(auto simp add: after_def)\n  also have \"P \\<turnstile> ty\\<^sub>i' (T # ST) (E @ [Ti]) (A \\<squnion> \\<lfloor>{length E}\\<rfloor> \\<squnion> \\<A> e) \\<le>' ty\\<^sub>i' (T # ST) (E @ [Ti]) ((A \\<squnion> \\<A> e) \\<ominus> length E)\"\n    by(auto simp add: hyperset_defs intro: ty\\<^sub>i'_antimono)\n  also have \"\\<dots> = ty\\<^sub>i' (T # ST) E (A \\<squnion> \\<A> e)\" by simp\n  also have \"P \\<turnstile> \\<dots> \\<le>' ty\\<^sub>i' (T # ST) E (A \\<squnion> (\\<A> e \\<ominus> i))\"\n    by(auto simp add:hyperset_defs intro: ty\\<^sub>i'_antimono)\n  also note append_Cons\n  also {\n    from lenST max_stack1[of e] Tv\n    have \"\\<turnstile> [Push v], [] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (ty E (Val v) # ST) E A]\"\n      by(auto intro: wt_Push)\n    moreover from Tv lenE\n    have \"\\<turnstile> [Store (length E)], [] [::] [ty\\<^sub>i' (Tv # ST) (E @ [Ti]) (A \\<ominus> length E), ty\\<^sub>i' ST (E @ [Ti]) (\\<lfloor>{length E}\\<rfloor> \\<squnion> (A \\<ominus> length E))]\"\n      by -(rule wt_Store, auto)\n    moreover have \"ty\\<^sub>i' (Tv # ST) (E @ [Ti]) (A \\<ominus> length E) = ty\\<^sub>i' (Tv # ST) E A\" by(simp add: ty\\<^sub>i'_def)\n    moreover have \"\\<lfloor>{length E}\\<rfloor> \\<squnion> (A \\<ominus> length E) = A \\<squnion> \\<lfloor>{length E}\\<rfloor>\" by(simp add: hyperset_defs)\n    ultimately have \"\\<turnstile> [Push v, Store (length E)], [] [::] [ty\\<^sub>i' ST E A, ty\\<^sub>i' (Tv # ST) E A, ty\\<^sub>i' ST (E @ [Ti]) (A \\<squnion> \\<lfloor>{length E}\\<rfloor>)]\"\n      using Tv by(auto intro: wt_instrs_Cons3)\n  }\n  finally show ?case using Tv `P,E \\<turnstile>1 {i:Ti=\\<lfloor>v\\<rfloor>; e} :: T` wte by(simp add: after_def)\nnext\n  case Var thus ?case by(auto simp:after_def wt_Load)\nnext\n  case FAcc thus ?case by(auto simp:after_def wt_Get)\nnext\n  case (LAss E A ST i e) thus ?case using max_stack1[of e]\n    by(auto simp: hyper_insert_comm after_def wt_Store wt_Push simp del: hyperUn_comm hyperUn_leftComm)\nnext\n  case Nil thus ?case by auto\nnext\n  case throw thus ?case by(auto simp add: after_def wt_Throw)\nnext\n  case (While E A ST e c)\n  obtain Tc where wte: \"P,E \\<turnstile>1 e :: Boolean\" and wtc: \"P,E \\<turnstile>1 c :: Tc\"\n    and [simp]: \"T = Void\" using While by auto\n  have [simp]: \"ty E (while (e) c) = Void\" using While by simp\n  let ?A\\<^sub>0 = \"A \\<squnion> \\<A> e\" let ?A\\<^sub>1 = \"?A\\<^sub>0 \\<squnion> \\<A> c\"\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>e = \"compT E A ST e\"\n  let ?\\<tau>\\<^sub>e = \"ty\\<^sub>i' (Boolean#ST) E ?A\\<^sub>0\" let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' ST E ?A\\<^sub>0\"\n  let ?\\<tau>s\\<^sub>c = \"compT E ?A\\<^sub>0 ST c\" let ?\\<tau>\\<^sub>c = \"ty\\<^sub>i' (Tc#ST) E ?A\\<^sub>1\"\n  let ?\\<tau>\\<^sub>2 = \"ty\\<^sub>i' ST E ?A\\<^sub>1\" let ?\\<tau>' = \"ty\\<^sub>i' (Void#ST) E ?A\\<^sub>0\"\n  let ?\\<tau>s = \"(?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e]) @ ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c, ?\\<tau>\\<^sub>2, ?\\<tau>\\<^sub>1, ?\\<tau>']\"\n  have \"\\<turnstile> [],[] [::] [] @ ?\\<tau>s\" by(simp add:wt_instrs_def)\n  also\n  from While.hyps(1)[of Boolean] While.prems\n  have \"\\<turnstile> compE2 e,compxE2 e 0 (size ST) [::] ?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e]\"\n    by (auto simp:after_def)\n  also\n  have \"[] @ ?\\<tau>s = (?\\<tau> # ?\\<tau>s\\<^sub>e) @ ?\\<tau>\\<^sub>e # ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c,?\\<tau>\\<^sub>2,?\\<tau>\\<^sub>1,?\\<tau>']\" by simp\n  also\n  let ?n\\<^sub>e = \"size(compE2 e)\"  let ?n\\<^sub>c = \"size(compE2 c)\"\n  let ?if = \"IfFalse (int ?n\\<^sub>c + 3)\"\n  have \"\\<turnstile> [?if],[] [::] ?\\<tau>\\<^sub>e # ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c, ?\\<tau>\\<^sub>2, ?\\<tau>\\<^sub>1, ?\\<tau>']\"\n    by(simp add: wt_instr_Cons wt_instr_append wt_IfFalse\n                 nat_add_distrib split: nat_diff_split)\n  also\n  have \"(?\\<tau> # ?\\<tau>s\\<^sub>e) @ (?\\<tau>\\<^sub>e # ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c, ?\\<tau>\\<^sub>2, ?\\<tau>\\<^sub>1, ?\\<tau>']) = ?\\<tau>s\" by simp\n  also from While.hyps(2)[of Tc] While.prems wtc\n  have \"\\<turnstile> compE2 c,compxE2 c 0 (size ST) [::] ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c]\"\n    by (auto simp:after_def)\n  also have \"?\\<tau>s = (?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e,?\\<tau>\\<^sub>1] @ ?\\<tau>s\\<^sub>c) @ [?\\<tau>\\<^sub>c,?\\<tau>\\<^sub>2,?\\<tau>\\<^sub>1,?\\<tau>']\" by simp\n  also have \"\\<turnstile> [Pop],[] [::] [?\\<tau>\\<^sub>c, ?\\<tau>\\<^sub>2]\"  by(simp add:wt_Pop)\n  also have \"(?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e,?\\<tau>\\<^sub>1] @ ?\\<tau>s\\<^sub>c) @ [?\\<tau>\\<^sub>c,?\\<tau>\\<^sub>2,?\\<tau>\\<^sub>1,?\\<tau>'] = ?\\<tau>s\" by simp\n  also let ?go = \"Goto (-int(?n\\<^sub>c+?n\\<^sub>e+2))\"\n  have \"P \\<turnstile> ?\\<tau>\\<^sub>2 \\<le>' ?\\<tau>\" by(fastforce intro: ty\\<^sub>i'_antimono simp: hyperset_defs)\n  hence \"P,T\\<^sub>r,mxs,size ?\\<tau>s,[] \\<turnstile> ?go,?n\\<^sub>e+?n\\<^sub>c+2 :: ?\\<tau>s\"\n    by(simp add: wt_Goto split: nat_diff_split)\n  also have \"?\\<tau>s = (?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e,?\\<tau>\\<^sub>1] @ ?\\<tau>s\\<^sub>c @ [?\\<tau>\\<^sub>c, ?\\<tau>\\<^sub>2]) @ [?\\<tau>\\<^sub>1, ?\\<tau>']\"\n    by simp\n  also have \"\\<turnstile> [Push Unit],[] [::] [?\\<tau>\\<^sub>1,?\\<tau>']\"\n    using While.prems max_stack1[of c] by(auto simp add:wt_Push)\n  finally show ?case using wtc wte\n    by (simp add:after_def)\nnext\n  case (Cond E A ST e e\\<^sub>1 e\\<^sub>2)\n  obtain T\\<^sub>1 T\\<^sub>2 where wte: \"P,E \\<turnstile>1 e :: Boolean\"\n    and wt\\<^sub>1: \"P,E \\<turnstile>1 e\\<^sub>1 :: T\\<^sub>1\" and wt\\<^sub>2: \"P,E \\<turnstile>1 e\\<^sub>2 :: T\\<^sub>2\"\n    and sub\\<^sub>1: \"P \\<turnstile> T\\<^sub>1 \\<le> T\" and sub\\<^sub>2: \"P \\<turnstile> T\\<^sub>2 \\<le> T\"\n    using Cond by(auto dest: is_lub_upper)\n  have [simp]: \"ty E (if (e) e\\<^sub>1 else e\\<^sub>2) = T\" using Cond by simp\n  let ?A\\<^sub>0 = \"A \\<squnion> \\<A> e\" let ?A\\<^sub>2 = \"?A\\<^sub>0 \\<squnion> \\<A> e\\<^sub>2\" let ?A\\<^sub>1 = \"?A\\<^sub>0 \\<squnion> \\<A> e\\<^sub>1\"\n  let ?A' = \"?A\\<^sub>0 \\<squnion> \\<A> e\\<^sub>1 \\<sqinter> \\<A> e\\<^sub>2\"\n  let ?\\<tau>\\<^sub>2 = \"ty\\<^sub>i' ST E ?A\\<^sub>0\" let ?\\<tau>' = \"ty\\<^sub>i' (T#ST) E ?A'\"\n  let ?\\<tau>s\\<^sub>2 = \"compT E ?A\\<^sub>0 ST e\\<^sub>2\"\n  have \"PROP ?P e\\<^sub>2 E T\\<^sub>2 ?A\\<^sub>0 ST\" by fact\n  hence \"\\<turnstile> compE2 e\\<^sub>2, compxE2 e\\<^sub>2 0 (size ST) [::] (?\\<tau>\\<^sub>2#?\\<tau>s\\<^sub>2) @ [ty\\<^sub>i' (T\\<^sub>2#ST) E ?A\\<^sub>2]\"\n    using Cond.prems wt\\<^sub>2 by(auto simp add:after_def)\n  also have \"P \\<turnstile> ty\\<^sub>i' (T\\<^sub>2#ST) E ?A\\<^sub>2 \\<le>' ?\\<tau>'\" using sub\\<^sub>2\n    by(auto simp add: hyperset_defs ty\\<^sub>i'_def intro!: ty\\<^sub>l_antimono)\n  also\n  let ?\\<tau>\\<^sub>3 = \"ty\\<^sub>i' (T\\<^sub>1 # ST) E ?A\\<^sub>1\"\n  let ?g\\<^sub>2 = \"Goto(int (size (compE2 e\\<^sub>2) + 1))\"\n  from sub\\<^sub>1 have \"P,T\\<^sub>r,mxs,size(compE2 e\\<^sub>2)+2,[] \\<turnstile> ?g\\<^sub>2,0 :: ?\\<tau>\\<^sub>3#(?\\<tau>\\<^sub>2#?\\<tau>s\\<^sub>2)@[?\\<tau>']\"\n    by(cases \"length (compE2 e\\<^sub>2)\")\n      (auto simp: hyperset_defs wt_defs nth_Cons ty\\<^sub>i'_def neq_Nil_conv\n             split:nat.split intro!: ty\\<^sub>l_antimono)\n  also let ?\\<tau>s\\<^sub>1 = \"compT E ?A\\<^sub>0 ST e\\<^sub>1\"\n  have \"PROP ?P e\\<^sub>1 E T\\<^sub>1 ?A\\<^sub>0 ST\" by fact\n  hence \"\\<turnstile> compE2 e\\<^sub>1,compxE2 e\\<^sub>1 0 (size ST) [::] ?\\<tau>\\<^sub>2 # ?\\<tau>s\\<^sub>1 @ [?\\<tau>\\<^sub>3]\"\n    using Cond.prems wt\\<^sub>1 by(auto simp add:after_def)\n  also\n  let ?\\<tau>s\\<^sub>1\\<^sub>2 = \"?\\<tau>\\<^sub>2 # ?\\<tau>s\\<^sub>1 @ ?\\<tau>\\<^sub>3 # (?\\<tau>\\<^sub>2 # ?\\<tau>s\\<^sub>2) @ [?\\<tau>']\"\n  let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' (Boolean#ST) E ?A\\<^sub>0\"\n  let ?g\\<^sub>1 = \"IfFalse(int (size (compE2 e\\<^sub>1) + 2))\"\n  let ?code = \"compE2 e\\<^sub>1 @ ?g\\<^sub>2 # compE2 e\\<^sub>2\"\n  have \"\\<turnstile> [?g\\<^sub>1],[] [::] [?\\<tau>\\<^sub>1] @ ?\\<tau>s\\<^sub>1\\<^sub>2\"\n    by(simp add: wt_IfFalse nat_add_distrib split:nat_diff_split)\n  also (wt_instrs_ext2) have \"[?\\<tau>\\<^sub>1] @ ?\\<tau>s\\<^sub>1\\<^sub>2 = ?\\<tau>\\<^sub>1 # ?\\<tau>s\\<^sub>1\\<^sub>2\" by simp also\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\"\n  have \"PROP ?P e E Boolean A ST\" by fact\n  hence \"\\<turnstile> compE2 e, compxE2 e 0 (size ST) [::] ?\\<tau> # compT E A ST e @ [?\\<tau>\\<^sub>1]\"\n    using Cond.prems wte by(auto simp add:after_def)\n  finally show ?case using wte wt\\<^sub>1 wt\\<^sub>2 by(simp add:after_def hyperUn_assoc)\nnext\n  case (Call E A ST e M es)\n  from `P,E \\<turnstile>1 e\\<bullet>M(es) :: T`\n  obtain U C D Ts m Ts'\n    where C: \"P,E \\<turnstile>1 e :: U\"\n    and icto: \"class_type_of' U = \\<lfloor>C\\<rfloor>\"\n    and method: \"P \\<turnstile> C sees M:Ts \\<rightarrow> T = m in D\"\n    and wtes: \"P,E \\<turnstile>1 es [::] Ts'\" and subs: \"P \\<turnstile> Ts' [\\<le>] Ts\"\n    by(cases) auto\n  from wtes have same_size: \"size es = size Ts'\" by(rule WTs1_same_size)\n  let ?A\\<^sub>0 = \"A \\<squnion> \\<A> e\" let ?A\\<^sub>1 = \"?A\\<^sub>0 \\<squnion> \\<A>s es\"\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>s\\<^sub>e = \"compT E A ST e\"\n  let ?\\<tau>\\<^sub>e = \"ty\\<^sub>i' (U # ST) E ?A\\<^sub>0\"\n  let ?\\<tau>s\\<^sub>e\\<^sub>s = \"compTs E ?A\\<^sub>0 (U # ST) es\"\n  let ?\\<tau>\\<^sub>1 = \"ty\\<^sub>i' (rev Ts' @ U # ST) E ?A\\<^sub>1\"\n  let ?\\<tau>' = \"ty\\<^sub>i' (T # ST) E ?A\\<^sub>1\"\n  have \"\\<turnstile> [Invoke M (size es)],[] [::] [?\\<tau>\\<^sub>1,?\\<tau>']\"\n    by(rule wt_Invoke[OF same_size icto method subs])\n  also\n  from Call.hyps(2)[of Ts'] Call.prems wtes C\n  have \"\\<turnstile> compEs2 es,compxEs2 es 0 (size ST+1) [::] ?\\<tau>\\<^sub>e # ?\\<tau>s\\<^sub>e\\<^sub>s\"\n    \"last (?\\<tau>\\<^sub>e # ?\\<tau>s\\<^sub>e\\<^sub>s) = ?\\<tau>\\<^sub>1\"\n    by(auto simp add:after_def)\n  also have \"(?\\<tau>\\<^sub>e # ?\\<tau>s\\<^sub>e\\<^sub>s) @ [?\\<tau>'] = ?\\<tau>\\<^sub>e # ?\\<tau>s\\<^sub>e\\<^sub>s @ [?\\<tau>']\" by simp\n  also have \"\\<turnstile> compE2 e,compxE2 e 0 (size ST) [::] ?\\<tau> # ?\\<tau>s\\<^sub>e @ [?\\<tau>\\<^sub>e]\"\n    using Call C by(auto simp add:after_def)\n  finally show ?case using Call.prems C\n    by(simp add:after_def hyperUn_assoc shift_compxEs2 stack_xlift_compxEs2 del: compxEs2_stack_xlift_convs compxEs2_size_convs)\nnext\n  case Seq thus ?case\n    by(auto simp:after_def)\n      (fastforce simp:wt_Push wt_Pop hyperUn_assoc\n                intro:wt_instrs_app2 wt_instrs_Cons)\nnext\n  case (NewArray E A ST Ta e)\n  from `P,E \\<turnstile>1 newA Ta\\<lfloor>e\\<rceil> :: T`\n  have \"\\<turnstile> [NewArray Ta], [] [::] [ty\\<^sub>i' (Integer # ST) E (A \\<squnion> \\<A> e), ty\\<^sub>i' (Ta\\<lfloor>\\<rceil> # ST) E (A \\<squnion> \\<A> e)]\"\n    by(auto simp:hyperset_defs ty\\<^sub>i'_def wt_defs ty\\<^sub>l_def)\n  with NewArray show ?case by(auto simp: after_def intro: wt_instrs_app3)\nnext\n  case (ALen E A ST exp)\n  { fix T\n    have \"\\<turnstile> [ALength], [] [::] [ty\\<^sub>i' (T\\<lfloor>\\<rceil> # ST) E (A \\<squnion> \\<A> exp), ty\\<^sub>i' (Integer # ST) E (A \\<squnion> \\<A> exp)]\"\n      by(auto simp:hyperset_defs ty\\<^sub>i'_def wt_defs ty\\<^sub>l_def) }\n  with ALen show ?case by(auto simp add: after_def)(rule wt_instrs_app2, auto)\nnext\n  case (AAcc E A ST a i)\n  from `P,E \\<turnstile>1 a\\<lfloor>i\\<rceil> :: T` have wta: \"P,E \\<turnstile>1 a :: T\\<lfloor>\\<rceil>\" and wti: \"P,E \\<turnstile>1 i :: Integer\" by auto\n  let ?A1 = \"A \\<squnion> \\<A> a\" let ?A2 = \"?A1 \\<squnion> \\<A> i\"  \n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>sa = \"compT E A ST a\"\n  let ?\\<tau>1 = \"ty\\<^sub>i' (T\\<lfloor>\\<rceil>#ST) E ?A1\" let ?\\<tau>si = \"compT E ?A1 (T\\<lfloor>\\<rceil>#ST) i\"\n  let ?\\<tau>2 = \"ty\\<^sub>i' (Integer#T\\<lfloor>\\<rceil>#ST) E ?A2\" let ?\\<tau>' = \"ty\\<^sub>i' (T#ST) E ?A2\"\n  have \"\\<turnstile> [ALoad], [] [::] [?\\<tau>2,?\\<tau>']\" by(auto simp add: ty\\<^sub>i'_def wt_defs)\n  also from AAcc.hyps(2)[of Integer] AAcc.prems wti wta\n  have \"\\<turnstile> compE2 i, compxE2 i 0 (size ST+1) [::] ?\\<tau>1#?\\<tau>si@[?\\<tau>2]\"\n    by(auto simp add: after_def)\n  also from wta AAcc have \"\\<turnstile> compE2 a, compxE2 a 0 (size ST) [::] ?\\<tau>#?\\<tau>sa@[?\\<tau>1]\" \n    by(auto simp add: after_def)\n  finally show ?case using wta wti `P,E \\<turnstile>1 a\\<lfloor>i\\<rceil> :: T` by(simp add: after_def hyperUn_assoc)\nnext\n  case (AAss E A ST a i e)\n  note wt = `P,E \\<turnstile>1 a\\<lfloor>i\\<rceil> := e :: T`\n  then obtain Ta U where wta: \"P,E \\<turnstile>1 a :: Ta\\<lfloor>\\<rceil>\" and wti: \"P,E \\<turnstile>1 i :: Integer\"\n    and wte: \"P,E \\<turnstile>1 e :: U\" and U: \"P \\<turnstile> U \\<le> Ta\" and [simp]: \"T = Void\" by auto\n  let ?A1 = \"A \\<squnion> \\<A> a\" let ?A2 = \"?A1 \\<squnion> \\<A> i\" let ?A3 = \"?A2 \\<squnion> \\<A> e\"\n  let ?\\<tau> = \"ty\\<^sub>i' ST E A\" let ?\\<tau>sa = \"compT E A ST a\"\n  let ?\\<tau>1 = \"ty\\<^sub>i' (Ta\\<lfloor>\\<rceil>#ST) E ?A1\" let ?\\<tau>si = \"compT E ?A1 (Ta\\<lfloor>\\<rceil>#ST) i\"\n  let ?\\<tau>2 = \"ty\\<^sub>i' (Integer#Ta\\<lfloor>\\<rceil>#ST) E ?A2\" let ?\\<tau>se = \"compT E ?A2 (Integer#Ta\\<lfloor>\\<rceil>#ST) e\"\n  let ?\\<tau>3 = \"ty\\<^sub>i' (U#Integer#Ta\\<lfloor>\\<rceil>#ST) E ?A3\" let ?\\<tau>4 = \"ty\\<^sub>i' ST E ?A3\"\n  let ?\\<tau>' = \"ty\\<^sub>i' (Void#ST) E ?A3\"\n  from `length ST + max_stack (a\\<lfloor>i\\<rceil> := e) \\<le> mxs`\n  have \"\\<turnstile> [AStore, Push Unit], [] [::] [?\\<tau>3,?\\<tau>4,?\\<tau>']\"\n    by(auto simp add: ty\\<^sub>i'_def wt_defs nth_Cons split: nat.split)\n  also from AAss.hyps(3)[of U] wte AAss.prems wta wti\n  have \"\\<turnstile> compE2 e, compxE2 e 0 (size ST+2) [::] ?\\<tau>2#?\\<tau>se@[?\\<tau>3]\"\n    by(auto simp add: after_def)\n  also from AAss.hyps(2)[of Integer] wti wta AAss.prems\n  have \"\\<turnstile> compE2 i, compxE2 i 0 (size ST+1) [::] ?\\<tau>1#?\\<tau>si@[?\\<tau>2]\"\n    by(auto simp add: after_def)\n  also from wta AAss have \"\\<turnstile> compE2 a, compxE2 a 0 (size ST) [::] ?\\<tau>#?\\<tau>sa@[?\\<tau>1]\" \n    by(auto simp add: after_def)\n  finally show ?case using wta wti wte `P,E \\<turnstile>1 a\\<lfloor>i\\<rceil> := e :: T`\n    by(simp add: after_def hyperUn_assoc)\nnext\n  case (InSynchronized i a exp) thus ?case by auto\nqed\n\nend\n\nlemma states_compP [simp]: \"states (compP f P) mxs mxl = states P mxs mxl\"\nby (simp add: JVM_states_unfold)\n\nlemma [simp]: \"app\\<^sub>i (i, compP f P, pc, mpc, T, \\<tau>) = app\\<^sub>i (i, P, pc, mpc, T, \\<tau>)\"\nproof -\n  { fix ST LT\n    have \"app\\<^sub>i (i, compP f P, pc, mpc, T, (ST, LT)) = app\\<^sub>i (i, P, pc, mpc, T, (ST, LT))\"\n    proof(cases i)\n      case (Invoke M n)\n      have \"\\<And>C Ts D. (\\<exists>T m. compP f P \\<turnstile> C sees M: Ts\\<rightarrow>T = m in D) \\<longleftrightarrow> (\\<exists>T m. P \\<turnstile> C sees M: Ts\\<rightarrow>T = m in D)\"\n        by(auto dest!: sees_method_compPD dest: sees_method_compP)\n      with Invoke show ?thesis by clarsimp\n    qed(simp_all) }\n  thus ?thesis by(cases \\<tau>) simp\nqed\n\n  \nlemma [simp]: \"is_relevant_entry (compP f P) i = is_relevant_entry P i\"\n  apply (rule ext)+\n  apply (unfold is_relevant_entry_def)\n  apply (cases i)\n  apply auto\n  done\n\nlemma [simp]: \"relevant_entries (compP f P) i pc xt = relevant_entries P i pc xt\"\nby (simp add: relevant_entries_def)\n\nlemma [simp]: \"app i (compP f P) mpc T pc mxl xt \\<tau> = app i P mpc T pc mxl xt \\<tau>\"\n  apply (simp add: app_def xcpt_app_def eff_def xcpt_eff_def norm_eff_def)\n  apply (fastforce simp add: image_def)\n  done\n\nlemma [simp]: \"app i P mpc T pc mxl xt \\<tau> \\<Longrightarrow> eff i (compP f P) pc xt \\<tau> = eff i P pc xt \\<tau>\"\n  apply (clarsimp simp add: eff_def norm_eff_def xcpt_eff_def app_def)\n  apply (cases i)\n  apply(auto)\n  done\n\nlemma [simp]: \"widen (compP f P) = widen P\"\n  apply (rule ext)+\n  apply (simp)\n  done\n  \nlemma [simp]: \"compP f P \\<turnstile> \\<tau> \\<le>' \\<tau>' = P \\<turnstile> \\<tau> \\<le>' \\<tau>'\"\nby (simp add: sup_state_opt_def sup_state_def sup_ty_opt_def)(*>*)\n\nlemma [simp]: \"compP f P,T,mpc,mxl,xt \\<turnstile> i,pc :: \\<tau>s = P,T,mpc,mxl,xt \\<turnstile> i,pc :: \\<tau>s\"\nby (simp add: wt_instr_def cong: conj_cong)\n\ndeclare TC0.compT_sizes[simp]  TC1.ty_def2[OF TC1.intro, simp]\n\nlemma compT_method:\n  fixes e and A and C and Ts and mxl\\<^sub>0\n  defines [simp]: \"E \\<equiv> Class C # Ts\"\n      and [simp]: \"A \\<equiv> \\<lfloor>{..size Ts}\\<rfloor>\"\n      and [simp]: \"A' \\<equiv> A \\<squnion> \\<A> e\"\n      and [simp]: \"mxs \\<equiv> max_stack e\"\n      and [simp]: \"mxl\\<^sub>0 \\<equiv> max_vars e\"\n      and [simp]: \"mxl \\<equiv> 1 + size Ts + mxl\\<^sub>0\"\n  assumes wf_prog: \"wf_prog p P\"\n  shows \"\\<lbrakk> P,E \\<turnstile>1 e :: T; \\<D> e A; \\<B> e (size E); set E \\<subseteq> types P; P \\<turnstile> T \\<le> T' \\<rbrakk> \\<Longrightarrow>\n   wt_method (compP2 P) C Ts T' mxs mxl\\<^sub>0 (compE2 e @ [Return]) (compxE2 e 0 0)\n      (TC0.ty\\<^sub>i' mxl [] E A # TC0.compTa P mxl E A [] e)\"\nusing wf_prog\napply(simp add:wt_method_def TC0.compTa_def TC0.after_def compP2_def compMb2_def)\napply(rule conjI)\n apply(simp add:check_types_def TC0.OK_ty\\<^sub>i'_in_statesI)\n apply(rule conjI)\n  apply(frule WT1_is_type[OF wf_prog])\n   apply simp\n  apply(insert max_stack1[of e])\n  apply(fastforce intro!: TC0.OK_ty\\<^sub>i'_in_statesI)\n apply(erule (1) TC1.compT_states[OF TC1.intro])\n    apply simp\n   apply simp\n  apply simp\n apply simp\napply(rule conjI)\n apply(fastforce simp add:wt_start_def TC0.ty\\<^sub>i'_def TC0.ty\\<^sub>l_def list_all2_conv_all_nth nth_Cons split:nat.split dest:less_antisym)\napply (frule (1) TC3.compT_wt_instrs[OF TC3.intro[OF TC1.intro], where ST = \"[]\" and mxs = \"max_stack e\" and mxl = \"1 + size Ts + max_vars e\"])\n     apply simp\n    apply simp\n   apply simp\n  apply simp\n apply simp\napply (clarsimp simp:TC2.wt_instrs_def TC0.after_def)\napply(rule conjI)\n apply (fastforce)\napply(clarsimp)\napply(drule (1) less_antisym)\napply(thin_tac \"\\<forall>x. ?P x\")\napply(clarsimp simp:TC2.wt_defs xcpt_app_pcs xcpt_eff_pcs TC0.ty\\<^sub>i'_def)\ndone\n(*>*)\n\n\ndefinition compTP :: \"'addr J1_prog \\<Rightarrow> ty\\<^sub>P\"\nwhere\n  \"compTP P C M  \\<equiv>\n  let (D,Ts,T,meth) = method P C M;\n       e = the meth;\n       E = Class C # Ts;\n       A = \\<lfloor>{..size Ts}\\<rfloor>;\n       mxl = 1 + size Ts + max_vars e\n  in  (TC0.ty\\<^sub>i' mxl [] E A # TC0.compTa P mxl E A [] e)\"\n\ntheorem wt_compTP_compP2:\n  \"wf_J1_prog P \\<Longrightarrow> wf_jvm_prog\\<^bsub>compTP P\\<^esub> (compP2 P)\"\n  apply (simp add: wf_jvm_prog_phi_def compP2_def compMb2_def)\n  apply (rule wf_prog_compPI)\n   prefer 2 apply assumption\n  apply (clarsimp simp add: wf_mdecl_def)\n  apply (simp add: compTP_def)\n  apply (rule compT_method [simplified compP2_def compMb2_def, simplified])\n       apply assumption+\n    apply (drule (1) sees_wf_mdecl)\n    apply (simp add: wf_mdecl_def)\n   apply (fastforce intro: sees_method_is_class)\n  apply assumption\n  done\n\n\ntheorem wt_compP2:\n  \"wf_J1_prog P \\<Longrightarrow> wf_jvm_prog (compP2 P)\"\nby(auto simp add: wf_jvm_prog_def intro: wt_compTP_compP2)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Compiler/TypeComp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737344123242, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.3226413258318094}}
{"text": "(*  Title:      JinjaThreads/Common/Conform.thy\n    Author:     David von Oheimb, Tobias Nipkow, Andreas Lochbihler\n\n    Based on the Jinja theory Common/Conform.thy by David von Oheimb and Tobias Nipkow\n*)\n\nheader {* \\isaheader{Conformance Relations for Type Soundness Proofs} *}\n\ntheory Conform\nimports\n  StartConfig\nbegin\n\ncontext heap_base begin\n\ndefinition conf :: \"'m prog \\<Rightarrow> 'heap \\<Rightarrow> 'addr val \\<Rightarrow> ty \\<Rightarrow> bool\"   (\"_,_ \\<turnstile> _ :\\<le> _\"  [51,51,51,51] 50)\nwhere \"P,h \\<turnstile> v :\\<le> T  \\<equiv> \\<exists>T'. typeof\\<^bsub>h\\<^esub> v = Some T' \\<and> P \\<turnstile> T' \\<le> T\"\n\ndefinition lconf :: \"'m prog \\<Rightarrow> 'heap \\<Rightarrow> (vname \\<rightharpoonup> 'addr val) \\<Rightarrow> (vname \\<rightharpoonup> ty) \\<Rightarrow> bool\"   (\"_,_ \\<turnstile> _ '(:\\<le>') _\" [51,51,51,51] 50)\nwhere \"P,h \\<turnstile> l (:\\<le>) E  \\<equiv> \\<forall>V v. l V = Some v \\<longrightarrow> (\\<exists>T. E V = Some T \\<and> P,h \\<turnstile> v :\\<le> T)\"\n\nabbreviation confs :: \"'m prog \\<Rightarrow> 'heap \\<Rightarrow> 'addr val list \\<Rightarrow> ty list \\<Rightarrow> bool\" (\"_,_ \\<turnstile> _ [:\\<le>] _\" [51,51,51,51] 50)\nwhere \"P,h \\<turnstile> vs [:\\<le>] Ts  ==  list_all2 (conf P h) vs Ts\"\n\ndefinition tconf :: \"'m prog \\<Rightarrow> 'heap \\<Rightarrow> 'thread_id \\<Rightarrow> bool\" (\"_,_ \\<turnstile> _ \\<surd>t\" [51,51,51] 50)\nwhere \"P,h \\<turnstile> t \\<surd>t \\<equiv> \\<exists>C. typeof_addr h (thread_id2addr t) = \\<lfloor>Class_type C\\<rfloor> \\<and> P \\<turnstile> C \\<preceq>\\<^sup>* Thread\"\n\nend\n\nlocale heap_conf_base =\n  heap_base +\n  constrains addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  fixes hconf :: \"'heap \\<Rightarrow> bool\"\n  and P :: \"'m prog\"\n\nsublocale heap_conf_base < prog P .\n\nlocale heap_conf = \n  heap\n    addr2thread_id thread_id2addr\n    spurious_wakeups\n    empty_heap allocate typeof_addr heap_read heap_write \n    P\n  +\n  heap_conf_base\n    addr2thread_id thread_id2addr\n    spurious_wakeups\n    empty_heap allocate typeof_addr heap_read heap_write \n    hconf P\n  for addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  and hconf :: \"'heap \\<Rightarrow> bool\" \n  and P :: \"'m prog\" \n  +\n  assumes hconf_empty [iff]: \"hconf empty_heap\"\n  and typeof_addr_is_type: \"\\<lbrakk> typeof_addr h a = \\<lfloor>hT\\<rfloor>; hconf h \\<rbrakk> \\<Longrightarrow> is_type P (ty_of_htype hT)\"\n  and hconf_allocate_mono: \"\\<And>a. \\<lbrakk> (h', a) \\<in> allocate h hT; hconf h; is_htype P hT \\<rbrakk> \\<Longrightarrow> hconf h'\"\n  and hconf_heap_write_mono:\n  \"\\<And>T. \\<lbrakk> heap_write h a al v h'; hconf h; P,h \\<turnstile> a@al : T; P,h \\<turnstile> v :\\<le> T \\<rbrakk> \\<Longrightarrow> hconf h'\"\n\nlocale heap_progress =\n  heap_conf\n    addr2thread_id thread_id2addr\n    spurious_wakeups\n    empty_heap allocate typeof_addr heap_read heap_write\n    hconf P\n  for addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  and hconf :: \"'heap \\<Rightarrow> bool\" \n  and P :: \"'m prog\" \n  +\n  assumes heap_read_total: \"\\<lbrakk> hconf h; P,h \\<turnstile> a@al : T \\<rbrakk> \\<Longrightarrow> \\<exists>v. heap_read h a al v \\<and> P,h \\<turnstile> v :\\<le> T\"\n  and heap_write_total: \"\\<lbrakk> hconf h; P,h \\<turnstile> a@al : T; P,h \\<turnstile> v :\\<le> T \\<rbrakk> \\<Longrightarrow> \\<exists>h'. heap_write h a al v h'\"\n\nlocale heap_conf_read =\n  heap_conf\n    addr2thread_id thread_id2addr\n    spurious_wakeups\n    empty_heap allocate typeof_addr heap_read heap_write\n    hconf P\n  for addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  and hconf :: \"'heap \\<Rightarrow> bool\" \n  and P :: \"'m prog\" \n  +\n  assumes heap_read_conf: \"\\<lbrakk> heap_read h a al v; P,h \\<turnstile> a@al : T; hconf h \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T\"\n\nlocale heap_typesafe =\n  heap_conf_read +\n  heap_progress +\n  constrains addr2thread_id :: \"('addr :: addr) \\<Rightarrow> 'thread_id\"\n  and thread_id2addr :: \"'thread_id \\<Rightarrow> 'addr\"\n  and spurious_wakeups :: bool\n  and empty_heap :: \"'heap\"\n  and allocate :: \"'heap \\<Rightarrow> htype \\<Rightarrow> ('heap \\<times> 'addr) set\"\n  and typeof_addr :: \"'heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\n  and heap_read :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\n  and heap_write :: \"'heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'heap \\<Rightarrow> bool\"\n  and hconf :: \"'heap \\<Rightarrow> bool\"\n  and P :: \"'m prog\"\n\ncontext heap_conf begin\n\nlemmas hconf_heap_ops_mono = \n  hconf_allocate_mono\n  hconf_heap_write_mono\n\nend\n\nsection{* Value conformance @{text\":\\<le>\"} *}\n\ncontext heap_base begin\n\nlemma conf_Null [simp]: \"P,h \\<turnstile> Null :\\<le> T  =  P \\<turnstile> NT \\<le> T\"\nunfolding conf_def by(simp (no_asm))\n\nlemma typeof_conf[simp]: \"typeof\\<^bsub>h\\<^esub> v = Some T \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T\"\nunfolding conf_def by (cases v) auto\n\nlemma typeof_lit_conf[simp]: \"typeof v = Some T \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T\"\nby (rule typeof_conf[OF typeof_lit_typeof])\n\nlemma defval_conf[simp]: \"P,h \\<turnstile> default_val T :\\<le> T\"\nunfolding conf_def by (cases T) auto\n\nlemma conf_widen: \"P,h \\<turnstile> v :\\<le> T \\<Longrightarrow> P \\<turnstile> T \\<le> T' \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T'\"\nunfolding conf_def by (cases v) (auto intro: widen_trans)\n\nlemma conf_sys_xcpt:\n  \"\\<lbrakk>preallocated h; C \\<in> sys_xcpts\\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> Addr (addr_of_sys_xcpt C) :\\<le> Class C\"\nby(simp add: conf_def typeof_addr_sys_xcp)\n\nlemma conf_NT [iff]: \"P,h \\<turnstile> v :\\<le> NT = (v = Null)\"\nby (auto simp add: conf_def)\n\nlemma is_IntgI: \"P,h \\<turnstile> v :\\<le> Integer \\<Longrightarrow> is_Intg v\"\nby (unfold conf_def) auto\n\nlemma is_BoolI: \"P,h \\<turnstile> v :\\<le> Boolean \\<Longrightarrow> is_Bool v\"\nby (unfold conf_def) auto\n\nlemma is_RefI: \"P,h \\<turnstile> v :\\<le> T \\<Longrightarrow> is_refT T \\<Longrightarrow> is_Ref v\"\nby(cases v)(auto elim: is_refT.cases simp add: conf_def is_Ref_def)\n\nlemma non_npD:\n  \"\\<lbrakk> v \\<noteq> Null; P,h \\<turnstile> v :\\<le> Class C; C \\<noteq> Object \\<rbrakk> \n  \\<Longrightarrow> \\<exists>a C'. v = Addr a \\<and> typeof_addr h a = \\<lfloor>Class_type C'\\<rfloor> \\<and> P \\<turnstile> C' \\<preceq>\\<^sup>* C\"\nby(cases v)(auto simp add: conf_def widen_Class)\n\nlemma non_npD2:\n  \"\\<lbrakk>v \\<noteq> Null; P,h \\<turnstile> v :\\<le> Class C \\<rbrakk>\n  \\<Longrightarrow> \\<exists>a hT. v = Addr a \\<and> typeof_addr h a = \\<lfloor>hT\\<rfloor> \\<and> P \\<turnstile> class_type_of hT \\<preceq>\\<^sup>* C\"\nby(cases v)(auto simp add: conf_def widen_Class)\n\nend\n\ncontext heap begin\n\nlemma conf_hext: \"\\<lbrakk> h \\<unlhd> h'; P,h \\<turnstile> v :\\<le> T \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> v :\\<le> T\"\nunfolding conf_def by(cases v)(auto dest: typeof_addr_hext_mono)\n\nlemma conf_heap_ops_mono:\n  assumes \"P,h \\<turnstile> v :\\<le> T\"\n  shows conf_allocate_mono: \"(h', a) \\<in> allocate h hT \\<Longrightarrow> P,h' \\<turnstile> v :\\<le> T\"\n  and conf_heap_write_mono: \"heap_write h a al v' h' \\<Longrightarrow> P,h' \\<turnstile> v :\\<le> T\"\nusing assms\nby(auto intro: conf_hext dest: hext_heap_ops)\n\nend\n\nsection{* Value list conformance @{text\"[:\\<le>]\"} *}\n\ncontext heap_base begin\n\nlemma confs_widens [trans]: \"\\<lbrakk>P,h \\<turnstile> vs [:\\<le>] Ts; P \\<turnstile> Ts [\\<le>] Ts'\\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> vs [:\\<le>] Ts'\"\nby (rule list_all2_trans)(rule conf_widen)\n\nlemma confs_rev: \"P,h \\<turnstile> rev s [:\\<le>] t = (P,h \\<turnstile> s [:\\<le>] rev t)\"\nby(rule list_all2_rev1)\n\nlemma confs_conv_map:\n  \"P,h \\<turnstile> vs [:\\<le>] Ts' = (\\<exists>Ts. map typeof\\<^bsub>h\\<^esub> vs = map Some Ts \\<and> P \\<turnstile> Ts [\\<le>] Ts')\"\napply(induct vs arbitrary: Ts')\n apply simp\napply(case_tac Ts')\napply(auto simp add:conf_def)\napply(rule_tac x=\"T' # Ts\" in exI)\napply(simp add: fun_of_def)\ndone\n\nlemma confs_Cons2: \"P,h \\<turnstile> xs [:\\<le>] y#ys = (\\<exists>z zs. xs = z#zs \\<and> P,h \\<turnstile> z :\\<le> y \\<and> P,h \\<turnstile> zs [:\\<le>] ys)\"\nby (rule list_all2_Cons2)\n\nend\n\ncontext heap begin\n\nlemma confs_hext: \"P,h \\<turnstile> vs [:\\<le>] Ts \\<Longrightarrow> h \\<unlhd> h' \\<Longrightarrow> P,h' \\<turnstile> vs [:\\<le>] Ts\"\nby (erule list_all2_mono, erule conf_hext, assumption)\n\nend\n\nsection {* Local variable conformance *}\n\ncontext heap_base begin\n\nlemma lconf_upd:\n  \"\\<lbrakk> P,h \\<turnstile> l (:\\<le>) E; P,h \\<turnstile> v :\\<le> T; E V = Some T \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> l(V\\<mapsto>v) (:\\<le>) E\"\nunfolding lconf_def by auto\n\nlemma lconf_empty [iff]: \"P,h \\<turnstile> empty (:\\<le>) E\"\nby(simp add:lconf_def)\n\nlemma lconf_upd2: \"\\<lbrakk>P,h \\<turnstile> l (:\\<le>) E; P,h \\<turnstile> v :\\<le> T\\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> l(V\\<mapsto>v) (:\\<le>) E(V\\<mapsto>T)\"\nby(simp add:lconf_def)\n\nend\n\ncontext heap begin\n\nlemma lconf_hext: \"\\<lbrakk> P,h \\<turnstile> l (:\\<le>) E; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> l (:\\<le>) E\"\nunfolding lconf_def by(fast elim: conf_hext)\n\nend\n\nsection {* Thread object conformance *}\n\ncontext heap_base begin\n\nlemma tconfI: \"\\<lbrakk> typeof_addr h (thread_id2addr t) = \\<lfloor>Class_type C\\<rfloor>; P \\<turnstile> C \\<preceq>\\<^sup>* Thread \\<rbrakk> \\<Longrightarrow> P,h \\<turnstile> t \\<surd>t\"\nby(simp add: tconf_def)\n\nlemma tconfD: \"P,h \\<turnstile> t \\<surd>t \\<Longrightarrow> \\<exists>C. typeof_addr h (thread_id2addr t) = \\<lfloor>Class_type C\\<rfloor> \\<and> P \\<turnstile> C \\<preceq>\\<^sup>* Thread\"\nby(auto simp add: tconf_def)\n\nend\n\ncontext heap begin\n \nlemma tconf_hext_mono: \"\\<lbrakk> P,h \\<turnstile> t \\<surd>t; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> t \\<surd>t\"\nby(auto simp add: tconf_def dest: typeof_addr_hext_mono)\n\nlemma tconf_heap_ops_mono:\n  assumes \"P,h \\<turnstile> t \\<surd>t\"\n  shows tconf_allocate_mono: \"(h', a) \\<in> allocate h hT \\<Longrightarrow> P,h' \\<turnstile> t \\<surd>t\"\n  and tconf_heap_write_mono: \"heap_write h a al v h' \\<Longrightarrow> P,h' \\<turnstile> t \\<surd>t\"\nusing tconf_hext_mono[OF assms, of h']\nby(blast intro: hext_heap_ops)+\n\nlemma tconf_start_heap_start_tid:\n  \"\\<lbrakk> start_heap_ok; wf_syscls P \\<rbrakk> \\<Longrightarrow> P,start_heap \\<turnstile> start_tid \\<surd>t\"\nunfolding start_tid_def start_heap_def start_heap_ok_def start_heap_data_def initialization_list_def addr_of_sys_xcpt_def start_addrs_def sys_xcpts_list_def \napply(clarsimp split: prod.split_asm simp add: create_initial_object_simps split: split_if_asm)\napply(erule not_empty_pairE)+\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule (1) allocate_Eps)\napply(drule allocate_SomeD[where hT=\"Class_type Thread\"])\n apply simp\napply(rule tconfI)\n apply(erule typeof_addr_hext_mono[OF hext_allocate])+\n apply simp\napply blast\ndone\n\nlemma start_heap_write_typeable:\n  assumes \"WriteMem ad al v \\<in> set start_heap_obs\"\n  shows \"\\<exists>T. P,start_heap \\<turnstile> ad@al : T \\<and> P,start_heap \\<turnstile> v :\\<le> T\"\nusing assms\nunfolding start_heap_obs_def start_heap_def\nby clarsimp\n\nend\n\nsection {* Well-formed start state *}\n\ncontext heap_base begin\n\ninductive wf_start_state :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> 'addr val list \\<Rightarrow> bool\"\nfor P :: \"'m prog\" and C :: cname and M :: mname and vs :: \"'addr val list\"\nwhere\n  wf_start_state:\n  \"\\<lbrakk> P \\<turnstile> C sees M:Ts\\<rightarrow>T = \\<lfloor>meth\\<rfloor> in D; start_heap_ok; P,start_heap \\<turnstile> vs [:\\<le>] Ts \\<rbrakk>\n  \\<Longrightarrow> wf_start_state P C M vs\"\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Common/Conform.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850278370112, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.32264025041141337}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\n(*\n  Structures supporting CTypes.\n  Primarily sets up types, defines pointers and the raw heap view.\n*)\n\ntheory CTypesBase\nimports\n  Vanilla32_typinfo\n  \"~~/src/HOL/Library/Prefix_Order\"\n  \"../../lib/SignedWords\"\nbegin\n\nsection \"Type setup\"\n\ntype_synonym byte = \"8 word\"\n\nclass unit_class =\n  assumes there_is_only_one: \"x = y\"\n\ninstantiation unit :: unit_class\nbegin\ninstance by (intro_classes, simp)\nend\n\nsubsection \"Pointers\"\n\ndatatype 'a ptr = Ptr addr\n\nabbreviation\n  NULL :: \"'a ptr\" where\n  \"NULL \\<equiv> Ptr 0\"\n\nprimrec\n  ptr_val :: \"'a ptr \\<Rightarrow> addr\"\nwhere\n  ptr_val_def: \"ptr_val (Ptr a) = a\"\n\nprimrec\n  ptr_coerce :: \"'a ptr \\<Rightarrow> 'b ptr\" where\n  \"ptr_coerce (Ptr a) = Ptr a\"\n\ndefinition\n  (* no ctype/memtype-class constraints on these so as to allow comparison of\n     void * pointers, which are represented as Isabelle type unit ptr *)\n  ptr_less :: \"'a ptr \\<Rightarrow> 'a ptr \\<Rightarrow> bool\" (infixl \"<\\<^sub>p\" 50) where\n  \"p <\\<^sub>p q \\<equiv> ptr_val p < ptr_val q\"\n\ndefinition\n  ptr_le :: \"'a ptr \\<Rightarrow> 'a ptr \\<Rightarrow> bool\" (infixl \"\\<le>\\<^sub>p\" 50) where\n  \"p \\<le>\\<^sub>p q \\<equiv> ptr_val p \\<le> ptr_val q\"\n\ninstantiation ptr :: (type) ord\nbegin\n\ndefinition\n  ptr_less_def': \"p < q \\<equiv> p <\\<^sub>p q\"\ndefinition\n  ptr_le_def': \"p \\<le> q \\<equiv> p \\<le>\\<^sub>p q\"\n\ninstance ..\n\nend\n\nlemma ptr_val_case: \"ptr_val p = (case p of Ptr v \\<Rightarrow> v)\"\n  by (cases p) simp\n\ninstantiation ptr :: (type) linorder\nbegin\ninstance\n  by (intro_classes)\n     (unfold ptr_le_def' ptr_le_def ptr_less_def' ptr_less_def ptr_val_case,\n      auto split: ptr.splits)\nend\n\nsubsection \"Raw heap\"\n\ntext {* A raw map from addresses to bytes *}\n\ntype_synonym heap_mem = \"addr \\<Rightarrow> byte\"\n\ntext {* For heap h, pointer p and nat n, (heap_list h n p) returns the list\n        of bytes in the heap taken from addresses {p..+n} *}\n\nprimrec\n  heap_list :: \"heap_mem \\<Rightarrow> nat \\<Rightarrow> addr \\<Rightarrow> byte list\"\nwhere\n  heap_list_base: \"heap_list h 0 p = []\"\n| heap_list_rec:  \"heap_list h (Suc n) p = h p # heap_list h n (p + 1)\"\n\n\nsection \"Intervals\"\n\ntext {*\n  For word a and nat b, {a..+b} is the set of words x,\n  with unat (x - a) < b. *}\n\ndefinition\n  intvl :: \"'a::len word \\<times> nat \\<Rightarrow> 'a::len word set\" where\n  \"intvl x \\<equiv> {z. \\<exists>k. z = fst x + of_nat k \\<and> k < snd x}\"\n\nabbreviation\n  \"intvl_abbr\" :: \"'a::len word \\<Rightarrow> nat \\<Rightarrow> 'a word set\" (\"{_..+_}\") where\n  \"{a..+b} \\<equiv> intvl (a,b)\"\n\n\nsection \"dt_pair: a reimplementation of 2 item tuples\"\n\ndatatype (plugins del: size)\n    ('a,'b) dt_pair = DTPair 'a 'b\n\nprimrec\n  dt_fst :: \"('a,'b) dt_pair \\<Rightarrow> 'a\"\nwhere\n  \"dt_fst (DTPair a b) = a\"\n\nprimrec\n  dt_snd :: \"('a,'b) dt_pair \\<Rightarrow> 'b\"\nwhere\n  \"dt_snd (DTPair a b) = b\"\n\ntype_synonym normalisor = \"byte list \\<Rightarrow> byte list\"\n\n\nsection \"Properties of pointers\"\n\nlemma Ptr_ptr_val [simp]:\n  \"Ptr (ptr_val p) = p\"\n  by (case_tac p) simp\n\nlemma ptr_val_ptr_coerce [simp]:\n  \"ptr_val (ptr_coerce p) = ptr_val p\"\n  by (case_tac p) simp\n\nlemma Ptr_ptr_coerce [simp]:\n  \"Ptr (ptr_val p) = ptr_coerce p\"\n  by (case_tac p) simp\n\nlemma ptr_coerce_id [simp]:\n  \"ptr_coerce p = p\"\n  by (case_tac p) simp\n\nlemma ptr_coerce_idem [simp]:\n  \"ptr_coerce (ptr_coerce p) = ptr_coerce p\"\n  by (case_tac p) simp\n\nlemma ptr_val_inj [simp]:\n  \"(ptr_val p = ptr_val q) = (p = q)\"\n  by (case_tac p, case_tac q) auto\n\nlemma ptr_coerce_NULL [simp]:\n  \"(ptr_coerce p = NULL) = (p = NULL)\"\n  by (case_tac p) simp\n\nlemma NULL_ptr_val:\n  \"(p = NULL) = (ptr_val p = 0)\"\n  by (case_tac p) simp\n\ninstantiation ptr :: (type) finite\nbegin\ninstance\n  by (intro_classes)\n     (auto intro!: finite_code finite_imageD [where f=ptr_val] injI)\nend\n\nsection \"Properties of the raw heap\"\n\nlemma heap_list_length [simp]:\n  \"length (heap_list h n p) = n\"\n  by (induct n arbitrary: p) auto\n\nlemma heap_list_split:\n  shows \"k \\<le> n \\<Longrightarrow> heap_list h n x = heap_list h k x @ heap_list h (n - k) (x + of_nat k)\"\nproof (induct n arbitrary: k x)\n  case 0 thus ?case by simp\nnext\n  case (Suc n) thus ?case\n    by (cases k, auto simp: ac_simps)\nqed\n\nlemma heap_list_split2:\n  \"heap_list h (x + y) p = heap_list h x p @ heap_list h y (p + of_nat x)\"\n  by (subst heap_list_split [where k=x], auto)\n\n\nsection \"Properties of intervals\"\n\nlemma intvlI:\n  \"x < n \\<Longrightarrow> p + of_nat x \\<in> {p..+n}\"\n  by (force simp: intvl_def)\n\nlemma intvlD:\n  \"q \\<in> {p..+n} \\<Longrightarrow> \\<exists>k. q = p + of_nat k \\<and> k < n\"\n  by (force simp: intvl_def)\n\nlemma intvl_empty [simp]:\n  \"{p..+0} = {}\"\n  by (fast dest: intvlD)\n\nlemma intvl_Suc:\n  \"q \\<in> {p..+Suc 0} \\<Longrightarrow> p = q\"\n  by (force dest: intvlD)\n\nlemma intvl_self:\n  \"0 < n \\<Longrightarrow> x \\<in> {x..+n}\"\n  by (force simp: intvl_def)\n\nlemma intvl_start_inter:\n  \"\\<lbrakk> 0 < m; 0 < n \\<rbrakk> \\<Longrightarrow> {p..+m} \\<inter> {p..+n} \\<noteq> {}\"\n  by (force simp: disjoint_iff_not_equal dest: intvl_self)\n\nlemma intvl_overflow:\n  assumes \"2^len_of TYPE('a) \\<le> n\"\n  shows \"{(p::'a::len word)..+n} = UNIV\"\nproof -\n  have witness:\n    \"\\<And>x. x = p + of_nat (unat (x - p)) \\<and> unat (x - p) < n\"\n    using assms by simp unat_arith \n  show ?thesis unfolding intvl_def by (auto intro!: witness)\nqed\n\ndeclare of_nat_diff [simp]\n\nlemma intvl_self_offset:\n  fixes p::\"'a::len word\"\n  assumes a: \"2^len_of TYPE('a) - n < x\" and b: \"x < 2^len_of TYPE('a)\" and\n      c: \"(p::'a::len word) \\<notin> {p + of_nat x..+n}\"\n  shows False\nproof -\n  let ?j = \"2^len_of TYPE('a) - x\"\n  from b have b': \"of_nat x + of_nat ?j  = (0::'a::len word)\" by simp\n  moreover from a b have \"?j < n\" by arith\n  with b b' c show  ?thesis by (force simp: intvl_def)\nqed\n\nlemma intvl_mem_offset:\n  \"\\<lbrakk> q \\<in> {p..+unat x}; q \\<notin> {p..+unat y}; unat y \\<le> unat x \\<rbrakk> \\<Longrightarrow>\n      q \\<in> {p + y..+unat x - unat y}\"\n  by (clarsimp simp: intvl_def) (rule_tac x=\"k - unat y\" in exI, auto)\n\nlemma intvl_plus_sub_offset:\n  \"x \\<in> {p + y..+q - unat y} \\<Longrightarrow> x \\<in> {p..+q}\"\n  by (clarsimp simp: intvl_def) (rule_tac x=\"k + unat y\" in exI, auto)\n\nlemma intvl_plus_sub_Suc:\n  \"x \\<in> {p + 1..+q - Suc 0} \\<Longrightarrow> x \\<in> {p..+q}\"\n  by (rule intvl_plus_sub_offset [where y=1], simp)\n\nlemma intvl_neq_start:\n  \"\\<lbrakk> (q::'a::len word) \\<in> {p..+n}; p \\<noteq> q \\<rbrakk> \\<Longrightarrow> q \\<in> {p + 1..+n - Suc 0}\"\n  by (clarsimp simp: intvl_def)\n     (metis (no_types) Suc_diff_1 add.commute add_Suc_right diff_diff_left neq0_conv\n                       of_nat_Suc semiring_1_class.of_nat_0 zero_less_diff)\n\nlemmas unat_simps' =\n  word_arith_nat_defs word_unat.eq_norm len_of_addr_card mod_less\n\nlemma intvl_offset_nmem:\n  \"\\<lbrakk> q \\<in> {(p::'a::len word)..+unat x}; y \\<le>  2^len_of TYPE('a) - unat x \\<rbrakk> \\<Longrightarrow>\n      q \\<notin> {p + x..+y}\"\n  apply (clarsimp simp: intvl_def)\n  apply (simp only: unat_simps')\n  apply (subst (asm) word_unat.Abs_inject)\n    apply (auto simp: unats_def)\n  done\n\nlemma intvl_Suc_nmem' [simp]:\n  \"n < 2^len_of TYPE('a) \\<Longrightarrow> (p::'a::len word) \\<notin> {p + 1..+n - Suc 0}\"\n  by (clarsimp simp: intvl_def)\n     (unat_arith, simp only: unat_simps')\n\nlemma intvl_start_le:\n  \"x \\<le> y \\<Longrightarrow> {p..+x} \\<subseteq> {p..+y}\"\n  by (force simp: intvl_def)\n\nlemma intvl_sub_eq:\n  assumes \"x \\<le> y\"\n  shows \"{p + x..+unat (y - x)} = {p..+unat y} - {p..+unat x}\"\nproof -\n  have \"unat y - unat x \\<le> 2 ^ len_of TYPE('a) - unat x\"\n    by (insert unat_lt2p [of y], arith)\n  moreover have \"x \\<le> y\" by fact\n  moreover hence \"unat (y - x) = unat y - unat x\"\n    by (simp add: word_le_nat_alt, unat_arith)\n  ultimately show ?thesis\n    by (force dest: intvl_offset_nmem intvl_mem_offset elim: intvl_plus_sub_offset\n              simp: word_le_nat_alt)\n\nqed\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/umm_heap/CTypesBase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185498374789, "lm_q2_score": 0.5698526514141572, "lm_q1q2_score": 0.32254717137448363}}
{"text": "section \\<open>Lifting Lemma\\<close>\n\ntheory Completeness imports Resolution begin\n\nlocale unification =\n  assumes unification: \"\\<And>\\<sigma> L. finite L \\<Longrightarrow> unifier\\<^sub>l\\<^sub>s \\<sigma> L \\<Longrightarrow> \\<exists>\\<theta>. mgu\\<^sub>l\\<^sub>s \\<theta> L\"\nbegin\ntext \\<open>\n  A proof of this assumption is available in @{file \\<open>Unification_Theorem.thy\\<close>} and used in\n  @{file \\<open>Completeness_Instance.thy\\<close>}.\n\\<close>\n\nlemma lifting:\n  assumes fin: \"finite C\\<^sub>1 \\<and> finite C\\<^sub>2\"\n  assumes apart: \"vars\\<^sub>l\\<^sub>s C\\<^sub>1 \\<inter> vars\\<^sub>l\\<^sub>s C\\<^sub>2 = {}\"\n  assumes inst: \"instance_of\\<^sub>l\\<^sub>s C\\<^sub>1' C\\<^sub>1 \\<and> instance_of\\<^sub>l\\<^sub>s C\\<^sub>2' C\\<^sub>2\"\n  assumes appl: \"applicable C\\<^sub>1' C\\<^sub>2' L\\<^sub>1' L\\<^sub>2' \\<sigma>\"\n  shows \"\\<exists>L\\<^sub>1 L\\<^sub>2 \\<tau>. applicable C\\<^sub>1 C\\<^sub>2 L\\<^sub>1 L\\<^sub>2 \\<tau> \\<and>\n                instance_of\\<^sub>l\\<^sub>s (resolution C\\<^sub>1' C\\<^sub>2' L\\<^sub>1' L\\<^sub>2' \\<sigma>) (resolution C\\<^sub>1 C\\<^sub>2 L\\<^sub>1 L\\<^sub>2 \\<tau>)\"\nproof -\n  \\<comment> \\<open>Obtaining the subsets we resolve upon:\\<close>\n  let ?R\\<^sub>1' = \"C\\<^sub>1' - L\\<^sub>1'\" and ?R\\<^sub>2' = \"C\\<^sub>2' - L\\<^sub>2'\"\n\n  from inst obtain \\<gamma> \\<mu> where \"C\\<^sub>1 \\<cdot>\\<^sub>l\\<^sub>s \\<gamma> = C\\<^sub>1' \\<and> C\\<^sub>2 \\<cdot>\\<^sub>l\\<^sub>s \\<mu> = C\\<^sub>2'\"\n    unfolding instance_of\\<^sub>l\\<^sub>s_def by auto\n  then obtain \\<eta> where \\<eta>_p: \"C\\<^sub>1 \\<cdot>\\<^sub>l\\<^sub>s \\<eta> = C\\<^sub>1' \\<and> C\\<^sub>2 \\<cdot>\\<^sub>l\\<^sub>s \\<eta> = C\\<^sub>2'\"\n    using apart merge_sub by force\n\n  from \\<eta>_p obtain L\\<^sub>1 where L\\<^sub>1_p: \"L\\<^sub>1 \\<subseteq> C\\<^sub>1 \\<and> L\\<^sub>1 \\<cdot>\\<^sub>l\\<^sub>s \\<eta> = L\\<^sub>1' \\<and> (C\\<^sub>1 - L\\<^sub>1) \\<cdot>\\<^sub>l\\<^sub>s \\<eta> = ?R\\<^sub>1'\"\n    using appl project_sub using applicable_def by metis\n  let ?R\\<^sub>1 = \"C\\<^sub>1 - L\\<^sub>1\"\n  from \\<eta>_p obtain L\\<^sub>2 where L\\<^sub>2_p: \"L\\<^sub>2 \\<subseteq> C\\<^sub>2 \\<and> L\\<^sub>2 \\<cdot>\\<^sub>l\\<^sub>s \\<eta> = L\\<^sub>2' \\<and> (C\\<^sub>2 - L\\<^sub>2) \\<cdot>\\<^sub>l\\<^sub>s \\<eta> = ?R\\<^sub>2'\"\n    using appl project_sub using applicable_def by metis\n  let ?R\\<^sub>2 = \"C\\<^sub>2 - L\\<^sub>2\"\n\n  \\<comment> \\<open>Obtaining substitutions:\\<close>\n  from appl have \"mgu\\<^sub>l\\<^sub>s \\<sigma> (L\\<^sub>1' \\<union> L\\<^sub>2'\\<^sup>C)\" using applicable_def by auto\n  then have \"mgu\\<^sub>l\\<^sub>s \\<sigma> ((L\\<^sub>1 \\<cdot>\\<^sub>l\\<^sub>s \\<eta>) \\<union> (L\\<^sub>2 \\<cdot>\\<^sub>l\\<^sub>s \\<eta>)\\<^sup>C)\" using L\\<^sub>1_p L\\<^sub>2_p by auto\n  then have \"mgu\\<^sub>l\\<^sub>s \\<sigma> ((L\\<^sub>1  \\<union> L\\<^sub>2\\<^sup>C) \\<cdot>\\<^sub>l\\<^sub>s \\<eta>)\" using compls_subls subls_union by auto\n  then have \"unifier\\<^sub>l\\<^sub>s \\<sigma> ((L\\<^sub>1  \\<union> L\\<^sub>2\\<^sup>C) \\<cdot>\\<^sub>l\\<^sub>s \\<eta>)\" using mgu\\<^sub>l\\<^sub>s_def by auto\n  then have \\<eta>\\<sigma>uni: \"unifier\\<^sub>l\\<^sub>s (\\<eta> \\<cdot> \\<sigma>) (L\\<^sub>1  \\<union> L\\<^sub>2\\<^sup>C)\"\n    using unifier\\<^sub>l\\<^sub>s_def composition_conseq2l by auto\n  then obtain \\<tau> where \\<tau>_p: \"mgu\\<^sub>l\\<^sub>s \\<tau> (L\\<^sub>1  \\<union> L\\<^sub>2\\<^sup>C)\"\n    using unification fin L\\<^sub>1_p L\\<^sub>2_p by (meson finite_UnI finite_imageI rev_finite_subset)\n  then obtain \\<phi> where \\<phi>_p: \"\\<tau> \\<cdot> \\<phi> = \\<eta> \\<cdot> \\<sigma>\" using \\<eta>\\<sigma>uni mgu\\<^sub>l\\<^sub>s_def by auto\n\n  \\<comment> \\<open>Showing that we have the desired resolvent:\\<close>\n  let ?C = \"((C\\<^sub>1 - L\\<^sub>1)  \\<union> (C\\<^sub>2 - L\\<^sub>2)) \\<cdot>\\<^sub>l\\<^sub>s \\<tau>\"\n  have \"?C \\<cdot>\\<^sub>l\\<^sub>s \\<phi>  = (?R\\<^sub>1 \\<union> ?R\\<^sub>2 ) \\<cdot>\\<^sub>l\\<^sub>s (\\<tau> \\<cdot> \\<phi>)\"\n    using subls_union composition_conseq2ls by auto\n  also have \"... = (?R\\<^sub>1 \\<union> ?R\\<^sub>2 ) \\<cdot>\\<^sub>l\\<^sub>s (\\<eta> \\<cdot> \\<sigma>)\" using \\<phi>_p by auto\n  also have \"... = ((?R\\<^sub>1 \\<cdot>\\<^sub>l\\<^sub>s \\<eta>) \\<union> (?R\\<^sub>2 \\<cdot>\\<^sub>l\\<^sub>s \\<eta>)) \\<cdot>\\<^sub>l\\<^sub>s \\<sigma>\"\n    using subls_union composition_conseq2ls by auto\n  also have \"... = (?R\\<^sub>1' \\<union> ?R\\<^sub>2') \\<cdot>\\<^sub>l\\<^sub>s \\<sigma>\" using \\<eta>_p L\\<^sub>1_p L\\<^sub>2_p by auto\n  finally have \"?C \\<cdot>\\<^sub>l\\<^sub>s \\<phi> = ((C\\<^sub>1' - L\\<^sub>1') \\<union> (C\\<^sub>2' - L\\<^sub>2')) \\<cdot>\\<^sub>l\\<^sub>s \\<sigma>\" by auto\n  then have ins: \"instance_of\\<^sub>l\\<^sub>s (resolution C\\<^sub>1' C\\<^sub>2' L\\<^sub>1' L\\<^sub>2' \\<sigma>) (resolution C\\<^sub>1 C\\<^sub>2 L\\<^sub>1 L\\<^sub>2 \\<tau>)\"\n    using resolution_def instance_of\\<^sub>l\\<^sub>s_def by metis\n\n  \\<comment> \\<open>Showing that the resolution rule is applicable:\\<close>\n  have \"C\\<^sub>1' \\<noteq> {} \\<and> C\\<^sub>2' \\<noteq> {} \\<and> L\\<^sub>1' \\<noteq> {} \\<and> L\\<^sub>2' \\<noteq> {}\"\n    using appl applicable_def by auto\n  then have \"C\\<^sub>1 \\<noteq> {} \\<and> C\\<^sub>2 \\<noteq> {} \\<and> L\\<^sub>1 \\<noteq> {} \\<and> L\\<^sub>2 \\<noteq> {}\" using \\<eta>_p L\\<^sub>1_p L\\<^sub>2_p by auto\n  then have appli: \"applicable C\\<^sub>1 C\\<^sub>2 L\\<^sub>1 L\\<^sub>2 \\<tau>\"\n    using apart L\\<^sub>1_p L\\<^sub>2_p \\<tau>_p applicable_def by auto\n\n  from ins appli show ?thesis by auto\nqed\n\n\nsection \\<open>Completeness\\<close>\n\nlemma falsifies\\<^sub>g_empty:\n  assumes \"falsifies\\<^sub>g [] C\"\n  shows \"C = {}\"\nproof -\n  have \"\\<forall>l \\<in> C. False\"\n    proof\n      fix l\n      assume \"l\\<in>C\"\n      then have \"falsifies\\<^sub>l [] l\" using assms by auto\n      then show False unfolding falsifies\\<^sub>l_def by (cases l) auto\n    qed\n  then show ?thesis by auto\nqed\n\nlemma falsifies\\<^sub>c\\<^sub>s_empty:\n  assumes \"falsifies\\<^sub>c [] C\"\n  shows \"C = {}\"\nproof -\n  from assms obtain C' where C'_p: \"instance_of\\<^sub>l\\<^sub>s C' C \\<and> falsifies\\<^sub>g [] C'\" by auto\n  then have \"C'= {}\" using falsifies\\<^sub>g_empty by auto\n  then show \"C = {}\" using C'_p unfolding instance_of\\<^sub>l\\<^sub>s_def by auto\nqed\n\nlemma complements_do_not_falsify':\n  assumes l1C1': \"l\\<^sub>1 \\<in> C\\<^sub>1'\"\n  assumes l\\<^sub>2C1': \"l\\<^sub>2 \\<in> C\\<^sub>1'\"\n  assumes comp: \"l\\<^sub>1 = l\\<^sub>2\\<^sup>c\"\n  assumes falsif: \"falsifies\\<^sub>g G C\\<^sub>1'\"\n  shows \"False\"\nproof (cases l\\<^sub>1)\n  case (Pos p ts)\n  let ?i1 = \"nat_of_fatom (p, ts)\"\n\n  from assms have gr: \"ground\\<^sub>l l\\<^sub>1\" unfolding falsifies\\<^sub>l_def by auto\n  then have Neg: \"l\\<^sub>2 = Neg p ts\" using comp Pos by (cases l\\<^sub>2) auto\n\n  from falsif have \"falsifies\\<^sub>l G l\\<^sub>1\" using l1C1' by auto\n  then have \"G ! ?i1 = False\" using l1C1' Pos unfolding falsifies\\<^sub>l_def by (induction \"Pos p ts\") auto\n  moreover\n  let ?i2 = \"nat_of_fatom (get_atom l\\<^sub>2)\"\n  from falsif have \"falsifies\\<^sub>l G l\\<^sub>2\" using l\\<^sub>2C1' by auto\n  then have \"G ! ?i2 = (\\<not>sign l\\<^sub>2)\" unfolding falsifies\\<^sub>l_def by meson\n  then have \"G ! ?i1 = (\\<not>sign l\\<^sub>2)\" using Pos Neg comp by simp\n  then have \"G ! ?i1 = True\" using Neg by auto\n  ultimately show ?thesis by auto\nnext\n  case (Neg p ts)\n  let ?i1 = \"nat_of_fatom (p,ts)\"\n\n  from assms have gr: \"ground\\<^sub>l l\\<^sub>1\" unfolding falsifies\\<^sub>l_def by auto\n  then have Pos: \"l\\<^sub>2 = Pos p ts\" using comp Neg by (cases l\\<^sub>2) auto\n\n  from falsif have \"falsifies\\<^sub>l G l\\<^sub>1\" using l1C1' by auto\n  then have \"G ! ?i1 = True\" using l1C1' Neg unfolding falsifies\\<^sub>l_def by (metis get_atom.simps(2) literal.disc(2)) \n  moreover\n  let ?i2 = \"nat_of_fatom (get_atom l\\<^sub>2)\"\n  from falsif have \"falsifies\\<^sub>l G l\\<^sub>2\" using l\\<^sub>2C1' by auto\n  then have \"G ! ?i2 = (\\<not>sign l\\<^sub>2)\" unfolding falsifies\\<^sub>l_def by meson\n  then have \"G ! ?i1 = (\\<not>sign l\\<^sub>2)\" using Pos Neg comp by simp\n  then have \"G ! ?i1 = False\" using Pos using literal.disc(1) by blast\n  ultimately show ?thesis by auto\nqed\n\nlemma complements_do_not_falsify:\n  assumes l1C1': \"l\\<^sub>1 \\<in> C\\<^sub>1'\"\n  assumes l\\<^sub>2C1': \"l\\<^sub>2 \\<in> C\\<^sub>1'\"\n  assumes fals: \"falsifies\\<^sub>g G C\\<^sub>1'\"\n  shows \"l\\<^sub>1 \\<noteq> l\\<^sub>2\\<^sup>c\"\nusing assms complements_do_not_falsify' by blast\n\nlemma other_falsified:\n  assumes C1'_p: \"ground\\<^sub>l\\<^sub>s C\\<^sub>1' \\<and> falsifies\\<^sub>g (B@[d]) C\\<^sub>1'\" \n  assumes l_p: \"l \\<in> C\\<^sub>1'\" \"nat_of_fatom (get_atom l) = length B\"\n  assumes other: \"lo \\<in> C\\<^sub>1'\" \"lo \\<noteq> l\"\n  shows \"falsifies\\<^sub>l B lo\"\nproof -\n  let ?i = \"nat_of_fatom (get_atom lo)\"\n  have ground_l\\<^sub>2: \"ground\\<^sub>l l\" using l_p C1'_p by auto\n  \\<comment> \\<open>They are, of course, also ground:\\<close>\n  have ground_lo: \"ground\\<^sub>l lo\" using C1'_p other by auto\n  from C1'_p have \"falsifies\\<^sub>g (B@[d]) (C\\<^sub>1' - {l})\" by auto\n  \\<comment> \\<open>And indeed, falsified by @{term \"B@[d]\"}:\\<close>\n  then have loB\\<^sub>2: \"falsifies\\<^sub>l (B@[d]) lo\" using other by auto\n  then have \"?i < length (B @ [d])\" unfolding falsifies\\<^sub>l_def by meson\n  \\<comment> \\<open>And they have numbers in the range of @{term \"B@[d]\"}, i.e. less than @{term \"length B + 1\"}:\\<close>\n  then have \"nat_of_fatom (get_atom lo) < length B + 1\" using undiag_diag_fatom by (cases lo) auto\n  moreover\n  have l_lo: \"l\\<noteq>lo\" using other by auto\n  \\<comment> \\<open>The are not the complement of @{term l }, since then the clause could not be falsified:\\<close>\n  have lc_lo: \"lo \\<noteq> l\\<^sup>c\" using C1'_p l_p other complements_do_not_falsify[of lo C\\<^sub>1' l \"(B@[d])\"] by auto\n  from l_lo lc_lo have \"get_atom l \\<noteq> get_atom lo\" using sign_comp_atom by metis\n  then have \"nat_of_fatom (get_atom lo) \\<noteq> nat_of_fatom (get_atom l)\" \n    using nat_of_fatom_bij ground_lo ground_l\\<^sub>2 ground\\<^sub>l_ground_fatom \n    unfolding bij_betw_def inj_on_def by metis\n  \\<comment> \\<open>Therefore they have different numbers:\\<close>\n  then have \"nat_of_fatom (get_atom lo) \\<noteq> length B\" using l_p by auto\n  ultimately \n  \\<comment> \\<open>So their numbers are in the range of @{term B}:\\<close>\n  have \"nat_of_fatom (get_atom lo) < length B\" by auto\n  \\<comment> \\<open>So we did not need the last index of @{term \"B@[d]\"} to falsify them, i.e. @{term B} suffices:\\<close>\n  then show \"falsifies\\<^sub>l B lo\" using loB\\<^sub>2 shorter_falsifies\\<^sub>l by blast\nqed\n\ntheorem completeness':\n  assumes \"closed_tree T Cs\"\n  assumes \"\\<forall>C\\<in>Cs. finite C\"\n  shows \"\\<exists>Cs'. resolution_deriv Cs Cs' \\<and> {} \\<in> Cs'\"\nusing assms proof (induction T arbitrary: Cs rule: measure_induct_rule[of treesize])\n  fix T :: tree\n  fix Cs :: \"fterm clause set\"\n  assume ih: \"\\<And>T' Cs. treesize T' < treesize T \\<Longrightarrow> closed_tree T' Cs \\<Longrightarrow> \n                            \\<forall>C\\<in>Cs. finite C \\<Longrightarrow> \\<exists>Cs'. resolution_deriv Cs Cs' \\<and> {} \\<in> Cs'\"\n  assume clo: \"closed_tree T Cs\"\n  assume finite_Cs: \"\\<forall>C\\<in>Cs. finite C\"\n  { \\<comment> \\<open>Base case:\\<close>\n    assume \"treesize T = 0\"\n    then have \"T=Leaf\" using treesize_Leaf by auto\n    then have \"closed_branch [] Leaf Cs\" using branch_inv_Leaf clo unfolding closed_tree_def by auto\n    then have \"falsifies\\<^sub>c\\<^sub>s [] Cs\" by auto\n    then have \"{} \\<in> Cs\" using falsifies\\<^sub>c\\<^sub>s_empty by auto\n    then have \"\\<exists>Cs'. resolution_deriv Cs Cs' \\<and> {} \\<in> Cs'\" \n      unfolding resolution_deriv_def by auto\n  }\n  moreover\n  { \\<comment> \\<open>Induction case:\\<close>\n    assume \"treesize T > 0\"\n    then have \"\\<exists>l r. T=Branching l r\" by (cases T) auto\n    \n    \\<comment> \\<open>Finding sibling branches and their corresponding clauses:\\<close>\n    then obtain B where b_p: \"internal B T \\<and> branch (B@[True]) T \\<and> branch (B@[False]) T\"\n      using internal_branch[of _ \"[]\" _ T] Branching_Leaf_Leaf_Tree by fastforce \n    let ?B\\<^sub>1 = \"B@[True]\"\n    let ?B\\<^sub>2 = \"B@[False]\"\n\n    obtain C\\<^sub>1o where C\\<^sub>1o_p: \"C\\<^sub>1o \\<in> Cs \\<and> falsifies\\<^sub>c ?B\\<^sub>1 C\\<^sub>1o\" using b_p clo unfolding closed_tree_def by metis \n    obtain C\\<^sub>2o where C\\<^sub>2o_p: \"C\\<^sub>2o \\<in> Cs \\<and> falsifies\\<^sub>c ?B\\<^sub>2 C\\<^sub>2o\" using b_p clo unfolding closed_tree_def by metis\n\n    \\<comment> \\<open>Standardizing the clauses apart:\\<close>\n    let ?C\\<^sub>1 = \"std\\<^sub>1 C\\<^sub>1o\"\n    let ?C\\<^sub>2 = \"std\\<^sub>2 C\\<^sub>2o\"\n    have C\\<^sub>1_p: \"falsifies\\<^sub>c ?B\\<^sub>1 ?C\\<^sub>1\" using std\\<^sub>1_falsifies C\\<^sub>1o_p by auto\n    have C\\<^sub>2_p: \"falsifies\\<^sub>c ?B\\<^sub>2 ?C\\<^sub>2\" using std\\<^sub>2_falsifies C\\<^sub>2o_p by auto\n\n    have fin: \"finite ?C\\<^sub>1 \\<and> finite ?C\\<^sub>2\" using C\\<^sub>1o_p C\\<^sub>2o_p finite_Cs by auto\n\n    \\<comment> \\<open>We go down to the ground world.\\<close>\n    \\<comment> \\<open>Finding the falsifying ground instance @{term C\\<^sub>1'} of @{term ?C\\<^sub>1}, and proving properties about it:\\<close>\n    \n    \\<comment> \\<open>@{term C\\<^sub>1'} is falsified by @{term ?B\\<^sub>1}:\\<close>\n    from C\\<^sub>1_p  obtain C\\<^sub>1' where C\\<^sub>1'_p: \"ground\\<^sub>l\\<^sub>s C\\<^sub>1' \\<and> instance_of\\<^sub>l\\<^sub>s C\\<^sub>1' ?C\\<^sub>1 \\<and> falsifies\\<^sub>g ?B\\<^sub>1 C\\<^sub>1'\" by metis\n\n    have \"\\<not>falsifies\\<^sub>c B C\\<^sub>1o\" using C\\<^sub>1o_p b_p clo unfolding closed_tree_def by metis\n    then have \"\\<not>falsifies\\<^sub>c B ?C\\<^sub>1\" using std\\<^sub>1_falsifies using prod.exhaust_sel by blast\n    \\<comment> \\<open>@{term C\\<^sub>1'} is not falsified by @{term B}:\\<close>\n    then have l_B: \"\\<not>falsifies\\<^sub>g B C\\<^sub>1'\" using C\\<^sub>1'_p by auto\n\n    \\<comment> \\<open>@{term C\\<^sub>1'} contains a literal @{term l\\<^sub>1} that is falsified by @{term ?B\\<^sub>1}, but not @{term B}:\\<close>\n    from C\\<^sub>1'_p l_B obtain l\\<^sub>1 where l\\<^sub>1_p: \"l\\<^sub>1 \\<in> C\\<^sub>1' \\<and> falsifies\\<^sub>l (B@[True]) l\\<^sub>1 \\<and> \\<not>(falsifies\\<^sub>l B l\\<^sub>1)\" by auto\n    let ?i = \"nat_of_fatom (get_atom l\\<^sub>1)\"\n\n    \\<comment> \\<open>@{term l\\<^sub>1} is of course ground:\\<close>\n    have ground_l\\<^sub>1: \"ground\\<^sub>l l\\<^sub>1\" using C\\<^sub>1'_p l\\<^sub>1_p by auto\n\n    from l\\<^sub>1_p have \"\\<not>(?i < length B \\<and> B ! ?i = (\\<not>sign l\\<^sub>1))\" using ground_l\\<^sub>1 unfolding falsifies\\<^sub>l_def by meson\n    then have \"\\<not>(?i < length B \\<and> (B@[True]) ! ?i = (\\<not>sign l\\<^sub>1))\" by (metis nth_append) \\<comment> \\<open>Not falsified by @{term B}.\\<close>\n    moreover\n    from l\\<^sub>1_p have \"?i < length (B @ [True]) \\<and> (B @ [True]) ! ?i = (\\<not>sign l\\<^sub>1)\" unfolding falsifies\\<^sub>l_def by meson\n    ultimately\n    have l\\<^sub>1_sign_no: \"?i = length B \\<and> (B @ [True]) ! ?i = (\\<not>sign l\\<^sub>1)\" by auto\n\n    \\<comment> \\<open>@{term l\\<^sub>1} is negative:\\<close>\n    from l\\<^sub>1_sign_no have l\\<^sub>1_sign: \"sign l\\<^sub>1 = False\" by auto\n    from l\\<^sub>1_sign_no have l\\<^sub>1_no: \"nat_of_fatom (get_atom l\\<^sub>1) = length B\" by auto\n\n    \\<comment> \\<open>All the other literals in @{term C\\<^sub>1'} must be falsified by B, since they are falsified by @{term ?B\\<^sub>1}, but not @{term l\\<^sub>1}.\\<close>\n    from C\\<^sub>1'_p l\\<^sub>1_no l\\<^sub>1_p have B_C\\<^sub>1'l\\<^sub>1: \"falsifies\\<^sub>g B (C\\<^sub>1' - {l\\<^sub>1})\" (* This should be a lemma *)\n      using other_falsified by blast\n\n    \\<comment> \\<open>We do the same exercise for @{term ?C\\<^sub>2}, @{term C\\<^sub>2'}, @{term ?B\\<^sub>2}, @{term l\\<^sub>2}:\\<close>\n    from C\\<^sub>2_p obtain C\\<^sub>2' where C\\<^sub>2'_p: \"ground\\<^sub>l\\<^sub>s C\\<^sub>2' \\<and> instance_of\\<^sub>l\\<^sub>s C\\<^sub>2' ?C\\<^sub>2 \\<and> falsifies\\<^sub>g ?B\\<^sub>2 C\\<^sub>2'\" by metis\n\n    have \"\\<not>falsifies\\<^sub>c B C\\<^sub>2o\" using C\\<^sub>2o_p b_p clo unfolding closed_tree_def by metis\n    then have \"\\<not>falsifies\\<^sub>c B ?C\\<^sub>2\" using std\\<^sub>2_falsifies using prod.exhaust_sel by blast\n    then have l_B: \"\\<not>falsifies\\<^sub>g B C\\<^sub>2'\" using C\\<^sub>2'_p by auto (* I already had something called l_B... I could give it a new name *)\n    \n    \\<comment> \\<open>@{term C\\<^sub>2'} contains a literal @{term l\\<^sub>2} that is falsified by @{term ?B\\<^sub>2}, but not B:\\<close>\n    from C\\<^sub>2'_p l_B obtain l\\<^sub>2 where l\\<^sub>2_p: \"l\\<^sub>2 \\<in> C\\<^sub>2' \\<and> falsifies\\<^sub>l (B@[False]) l\\<^sub>2 \\<and> \\<not>falsifies\\<^sub>l B l\\<^sub>2\" by auto\n    let ?i = \"nat_of_fatom (get_atom l\\<^sub>2)\"\n\n    have ground_l\\<^sub>2: \"ground\\<^sub>l l\\<^sub>2\" using C\\<^sub>2'_p l\\<^sub>2_p by auto\n\n    from l\\<^sub>2_p have \"\\<not>(?i < length B \\<and> B ! ?i = (\\<not>sign l\\<^sub>2))\" using ground_l\\<^sub>2 unfolding falsifies\\<^sub>l_def by meson\n    then have \"\\<not>(?i < length B \\<and> (B@[False]) ! ?i = (\\<not>sign l\\<^sub>2))\" by (metis nth_append) \\<comment> \\<open>Not falsified by @{term B}.\\<close>\n    moreover\n    from l\\<^sub>2_p have \"?i < length (B @ [False]) \\<and> (B @ [False]) ! ?i = (\\<not>sign l\\<^sub>2)\" unfolding falsifies\\<^sub>l_def by meson\n    ultimately\n    have l\\<^sub>2_sign_no: \"?i = length B \\<and> (B @ [False]) ! ?i = (\\<not>sign l\\<^sub>2)\" by auto\n\n    \\<comment> \\<open>@{term l\\<^sub>2} is negative:\\<close>\n    from l\\<^sub>2_sign_no have l\\<^sub>2_sign: \"sign l\\<^sub>2 = True\" by auto\n    from l\\<^sub>2_sign_no have l\\<^sub>2_no: \"nat_of_fatom (get_atom l\\<^sub>2) = length B\" by auto\n\n    \\<comment> \\<open>All the other literals in @{term C\\<^sub>2'} must be falsified by B, since they are falsified by \n          @{term ?B\\<^sub>2}, but not @{term l\\<^sub>2}.\\<close>\n    from C\\<^sub>2'_p l\\<^sub>2_no l\\<^sub>2_p have B_C\\<^sub>2'l\\<^sub>2: \"falsifies\\<^sub>g B (C\\<^sub>2' - {l\\<^sub>2})\"\n      using other_falsified by blast\n\n    \\<comment> \\<open>Proving some properties about @{term C\\<^sub>1'} and @{term C\\<^sub>2'}, @{term l\\<^sub>1} and @{term l\\<^sub>2}, as well as \n          the resolvent of @{term C\\<^sub>1'} and @{term C\\<^sub>2'}:\\<close>\n    have l\\<^sub>2cisl\\<^sub>1: \"l\\<^sub>2\\<^sup>c = l\\<^sub>1\" (* Could perhaps be a lemma *)\n      proof -\n        from l\\<^sub>1_no l\\<^sub>2_no ground_l\\<^sub>1 ground_l\\<^sub>2 have \"get_atom l\\<^sub>1 = get_atom l\\<^sub>2\"\n              using nat_of_fatom_bij ground\\<^sub>l_ground_fatom \n              unfolding bij_betw_def inj_on_def by metis\n        then show \"l\\<^sub>2\\<^sup>c = l\\<^sub>1\" using l\\<^sub>1_sign l\\<^sub>2_sign using sign_comp_atom by metis \n      qed\n    \n    have \"applicable C\\<^sub>1' C\\<^sub>2' {l\\<^sub>1} {l\\<^sub>2} Resolution.\\<epsilon>\" unfolding applicable_def\n      using l\\<^sub>1_p l\\<^sub>2_p C\\<^sub>1'_p ground\\<^sub>l\\<^sub>s_vars\\<^sub>l\\<^sub>s l\\<^sub>2cisl\\<^sub>1 empty_comp2 unfolding mgu\\<^sub>l\\<^sub>s_def unifier\\<^sub>l\\<^sub>s_def by auto\n    \\<comment> \\<open>Lifting to get a resolvent of @{term ?C\\<^sub>1} and @{term ?C\\<^sub>2}:\\<close>\n    then obtain L\\<^sub>1 L\\<^sub>2 \\<tau> where L\\<^sub>1L\\<^sub>2\\<tau>_p: \"applicable ?C\\<^sub>1 ?C\\<^sub>2 L\\<^sub>1 L\\<^sub>2 \\<tau>  \\<and> instance_of\\<^sub>l\\<^sub>s (resolution C\\<^sub>1' C\\<^sub>2' {l\\<^sub>1} {l\\<^sub>2} Resolution.\\<epsilon>) (resolution ?C\\<^sub>1 ?C\\<^sub>2 L\\<^sub>1 L\\<^sub>2 \\<tau>)\"\n      using std_apart_apart C\\<^sub>1'_p C\\<^sub>2'_p lifting[of ?C\\<^sub>1 ?C\\<^sub>2 C\\<^sub>1' C\\<^sub>2' \"{l\\<^sub>1}\" \"{l\\<^sub>2}\" Resolution.\\<epsilon>] fin by auto\n\n\n    \\<comment> \\<open>Defining the clause to be derived, the new clausal form and the new tree:\\<close>\n    \\<comment> \\<open>We name the resolvent @{term C}.\\<close>\n    obtain C where C_p: \"C = resolution ?C\\<^sub>1 ?C\\<^sub>2 L\\<^sub>1 L\\<^sub>2 \\<tau>\" by auto\n    obtain CsNext where CsNext_p: \"CsNext = Cs \\<union> {?C\\<^sub>1, ?C\\<^sub>2, C}\" by auto\n    obtain T'' where T''_p: \"T'' = delete B T\" by auto \n        \\<comment> \\<open>Here we delete the two branch children @{term ?B\\<^sub>1} and @{term ?B\\<^sub>2} of @{term B}.\\<close>\n    \n    \\<comment> \\<open>Our new clause is falsified by the branch @{term B} of our new tree:\\<close>\n    have \"falsifies\\<^sub>g B ((C\\<^sub>1' - {l\\<^sub>1}) \\<union> (C\\<^sub>2' - {l\\<^sub>2}))\" using B_C\\<^sub>1'l\\<^sub>1 B_C\\<^sub>2'l\\<^sub>2 by cases auto\n    then have \"falsifies\\<^sub>g B (resolution C\\<^sub>1' C\\<^sub>2' {l\\<^sub>1} {l\\<^sub>2} Resolution.\\<epsilon>)\" unfolding resolution_def empty_subls by auto\n    then have falsifies_C: \"falsifies\\<^sub>c B C\" using C_p L\\<^sub>1L\\<^sub>2\\<tau>_p by auto\n\n    have T''_smaller: \"treesize T'' < treesize T\" using treezise_delete T''_p b_p by auto\n    have T''_bran: \"anybranch T'' (\\<lambda>b. closed_branch b T'' CsNext)\"\n      proof (rule allI; rule impI)\n        fix b\n        assume br: \"branch b T''\"\n        from br have \"b = B \\<or> branch b T\" using branch_delete T''_p by auto\n        then show \"closed_branch b T'' CsNext\"\n          proof\n            assume \"b=B\"\n            then show \"closed_branch b T'' CsNext\" using falsifies_C br CsNext_p by auto\n          next\n            assume \"branch b T\"\n            then show \"closed_branch b T'' CsNext\" using clo br T''_p CsNext_p unfolding closed_tree_def by auto\n          qed\n      qed\n    then have T''_bran2: \"anybranch T'' (\\<lambda>b. falsifies\\<^sub>c\\<^sub>s b CsNext)\" by auto (* replace T''_bran with this maybe? *)\n\n    \\<comment> \\<open>We cut the tree even smaller to ensure only the branches are falsified, i.e. it is a closed tree:\\<close>\n    obtain T' where T'_p: \"T' = cutoff (\\<lambda>G. falsifies\\<^sub>c\\<^sub>s G CsNext) [] T''\" by auto\n    have T'_smaller: \"treesize T' < treesize T\" using treesize_cutoff[of \"\\<lambda>G. falsifies\\<^sub>c\\<^sub>s G CsNext\" \"[]\" T''] T''_smaller unfolding T'_p by auto\n\n    from T''_bran2 have \"anybranch T' (\\<lambda>b. falsifies\\<^sub>c\\<^sub>s b CsNext)\" using cutoff_branch[of T'' \"\\<lambda>b. falsifies\\<^sub>c\\<^sub>s b CsNext\"] T'_p by auto\n    then have T'_bran: \"anybranch T' (\\<lambda>b. closed_branch b T' CsNext)\" by auto\n    have T'_intr: \"anyinternal T' (\\<lambda>p. \\<not>falsifies\\<^sub>c\\<^sub>s p CsNext)\" using T'_p cutoff_internal[of T'' \"\\<lambda>b. falsifies\\<^sub>c\\<^sub>s b CsNext\"] T''_bran2 by blast\n    have T'_closed: \"closed_tree T' CsNext\" using T'_bran T'_intr unfolding closed_tree_def by auto\n    have finite_CsNext: \"\\<forall>C\\<in>CsNext. finite C\" unfolding CsNext_p C_p resolution_def using finite_Cs fin by auto\n\n    \\<comment> \\<open>By induction hypothesis we get a resolution derivation of @{term \"{}\"} from our new clausal form:\\<close>\n    from T'_smaller T'_closed have \"\\<exists>Cs''. resolution_deriv CsNext Cs'' \\<and> {} \\<in> Cs''\" using ih[of T' CsNext] finite_CsNext by blast\n    then obtain Cs'' where Cs''_p: \"resolution_deriv CsNext Cs'' \\<and> {} \\<in> Cs''\" by auto\n    moreover\n    { \\<comment> \\<open>Proving that we can actually derive the new clausal form:\\<close>\n      have \"resolution_step Cs (Cs \\<union> {?C\\<^sub>1})\" using std\\<^sub>1_renames standardize_apart C\\<^sub>1o_p by (metis Un_insert_right)\n      moreover\n      have \"resolution_step (Cs \\<union> {?C\\<^sub>1}) (Cs \\<union> {?C\\<^sub>1} \\<union> {?C\\<^sub>2})\" using std\\<^sub>2_renames[of C\\<^sub>2o] standardize_apart[of C\\<^sub>2o _ ?C\\<^sub>2] C\\<^sub>2o_p by auto \n      then have \"resolution_step (Cs \\<union> {?C\\<^sub>1}) (Cs \\<union> {?C\\<^sub>1,?C\\<^sub>2})\" by (simp add: insert_commute)\n      moreover\n      then have \"resolution_step (Cs \\<union> {?C\\<^sub>1,?C\\<^sub>2}) (Cs \\<union> {?C\\<^sub>1,?C\\<^sub>2} \\<union> {C})\" \n        using L\\<^sub>1L\\<^sub>2\\<tau>_p resolution_rule[of ?C\\<^sub>1 \"Cs \\<union> {?C\\<^sub>1,?C\\<^sub>2}\" ?C\\<^sub>2 L\\<^sub>1 L\\<^sub>2 \\<tau> ] using C_p by auto\n      then have \"resolution_step (Cs \\<union> {?C\\<^sub>1,?C\\<^sub>2}) CsNext\" using CsNext_p by (simp add:  Un_commute)\n      ultimately\n      have \"resolution_deriv Cs CsNext\"  unfolding resolution_deriv_def by auto\n    }\n    \\<comment> \\<open>Combining the two derivations, we get the desired derivation from @{term Cs} of @{term \"{}\"}:\\<close>\n    ultimately have \"resolution_deriv Cs Cs''\"  unfolding resolution_deriv_def by auto\n    then have \"\\<exists>Cs'. resolution_deriv Cs Cs' \\<and> {} \\<in> Cs'\" using Cs''_p by auto\n  }\n  ultimately show \"\\<exists>Cs'. resolution_deriv Cs Cs' \\<and> {} \\<in> Cs'\" by auto\nqed\n\ntheorem completeness:\n  assumes finite_cs: \"finite Cs\" \"\\<forall>C\\<in>Cs. finite C\"\n  assumes unsat: \"\\<forall>(F::hterm fun_denot) (G::hterm pred_denot) . \\<not>eval\\<^sub>c\\<^sub>s F G Cs\"\n  shows \"\\<exists>Cs'. resolution_deriv Cs Cs' \\<and> {} \\<in> Cs'\"\nproof -\n  from unsat have \"\\<forall>(G::hterm pred_denot) . \\<not>eval\\<^sub>c\\<^sub>s HFun G Cs\" by auto\n  then obtain T where \"closed_tree T Cs\" using herbrand assms by blast\n  then show \"\\<exists>Cs'. resolution_deriv Cs Cs' \\<and> {} \\<in> Cs'\" using completeness' assms by auto\nqed \n\ndefinition E_conv :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a var_denot \\<Rightarrow> 'b var_denot\" where\n  \"E_conv b_of_a E \\<equiv> \\<lambda>x. (b_of_a (E x))\"\n\ndefinition F_conv :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a fun_denot \\<Rightarrow> 'b fun_denot\" where\n  \"F_conv b_of_a F \\<equiv> \\<lambda>f bs. b_of_a (F f (map (inv b_of_a) bs))\"\n\ndefinition G_conv :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a pred_denot \\<Rightarrow> 'b pred_denot\" where\n  \"G_conv b_of_a G \\<equiv> \\<lambda>p bs. (G p (map (inv b_of_a) bs))\"\n  \nlemma eval\\<^sub>t_bij:\n  assumes \"bij (b_of_a::'a \\<Rightarrow> 'b)\"\n  shows\"eval\\<^sub>t (E_conv b_of_a E) (F_conv b_of_a F) t = b_of_a (eval\\<^sub>t E F t)\"\nproof (induction t)\n  case (Fun f ts)\n  then have \"map (inv b_of_a \\<circ> eval\\<^sub>t (E_conv b_of_a E) (F_conv b_of_a F)) ts = eval\\<^sub>t\\<^sub>s E F ts\"\n    unfolding E_conv_def F_conv_def\n    using assms bij_is_inj by fastforce\n  then have \"b_of_a (F f (map (inv b_of_a \\<circ> eval\\<^sub>t (E_conv b_of_a E) ((F_conv b_of_a F))) ts)) = b_of_a (F f (eval\\<^sub>t\\<^sub>s E F ts))\" by metis\n  then show ?case using assms unfolding E_conv_def F_conv_def by auto\nnext\n  case (Var x)\n  then show ?case using assms unfolding E_conv_def by auto\nqed\n\nlemma eval\\<^sub>t\\<^sub>s_bij:\n  assumes \"bij (b_of_a::'a \\<Rightarrow> 'b)\"\n  shows \"G_conv b_of_a G p (eval\\<^sub>t\\<^sub>s (E_conv b_of_a E) (F_conv b_of_a F) ts) = G p (eval\\<^sub>t\\<^sub>s E F ts)\" \n  using assms using eval\\<^sub>t_bij\nproof -\n  have \"map (inv b_of_a \\<circ> eval\\<^sub>t (E_conv b_of_a E) (F_conv b_of_a F)) ts = eval\\<^sub>t\\<^sub>s E F ts\"\n    using eval\\<^sub>t_bij assms bij_is_inj by fastforce\n  then show ?thesis\n    by (metis (no_types) G_conv_def map_map)\nqed\n   \n  \nlemma eval\\<^sub>l_bij:\n  assumes \"bij (b_of_a::'a \\<Rightarrow> 'b)\"\n  shows \"eval\\<^sub>l (E_conv b_of_a E) (F_conv b_of_a F) (G_conv b_of_a G) l = eval\\<^sub>l E F G l\"\n  using assms eval\\<^sub>t\\<^sub>s_bij \nproof (cases l)\n  case (Pos p ts)\n  then show ?thesis\n    by (simp add: eval\\<^sub>t\\<^sub>s_bij assms) \nnext\n  case (Neg p ts)\n  then show ?thesis\n    by (simp add: eval\\<^sub>t\\<^sub>s_bij assms)\nqed \n            \nlemma eval\\<^sub>c_bij:\n  assumes \"bij (b_of_a::'a \\<Rightarrow> 'b)\"\n  shows \"eval\\<^sub>c (F_conv b_of_a F) (G_conv b_of_a G) C = eval\\<^sub>c F G C\"\nproof -\n  {\n    fix E :: \"char list \\<Rightarrow> 'b\"\n    assume bij_b_of_a: \"bij b_of_a\"\n    assume C_sat: \"\\<forall>E :: char list \\<Rightarrow> 'a. \\<exists>l\\<in>C. eval\\<^sub>l E F G l\" \n    have E_p: \"E = E_conv b_of_a (E_conv (inv b_of_a) E)\" \n      unfolding E_conv_def using bij_b_of_a\n      using bij_betw_inv_into_right by fastforce \n    have \"\\<exists>l\\<in>C. eval\\<^sub>l (E_conv b_of_a (E_conv (inv b_of_a) E)) (F_conv b_of_a F) (G_conv b_of_a G) l\"\n      using eval\\<^sub>l_bij bij_b_of_a C_sat by blast\n    then have \"\\<exists>l\\<in>C. eval\\<^sub>l E (F_conv b_of_a F) (G_conv b_of_a G) l\" using E_p by auto \n  }\n  then show ?thesis\n    by (meson eval\\<^sub>l_bij assms eval\\<^sub>c_def) \nqed\n\nlemma eval\\<^sub>c\\<^sub>s_bij:\n  assumes \"bij (b_of_a::'a \\<Rightarrow> 'b)\"\n  shows \"eval\\<^sub>c\\<^sub>s (F_conv b_of_a F) (G_conv b_of_a G) Cs \\<longleftrightarrow> eval\\<^sub>c\\<^sub>s F G Cs\"\n    by (meson eval\\<^sub>c_bij assms eval\\<^sub>c\\<^sub>s_def)\n    \nlemma countably_inf_bij:\n  assumes inf_a_uni: \"infinite (UNIV :: ('a ::countable) set)\"\n  assumes inf_b_uni: \"infinite (UNIV :: ('b ::countable) set)\"\n  shows \"\\<exists>b_of_a :: 'a \\<Rightarrow> 'b. bij b_of_a\"\nproof -\n  let ?S = \"UNIV :: (('a::countable)) set\"\n  have \"countable ?S\" by auto\n  moreover\n  have \"infinite ?S\" using inf_a_uni by auto\n  ultimately\n  obtain nat_of_a where QWER: \"bij (nat_of_a :: 'a \\<Rightarrow> nat)\" using countableE_infinite[of ?S] by blast\n      \n  let ?T = \"UNIV :: (('b::countable)) set\"\n  have \"countable ?T\" by auto\n  moreover\n  have \"infinite ?T\" using inf_b_uni by auto\n  ultimately\n  obtain nat_of_b where TYUI: \"bij (nat_of_b :: 'b \\<Rightarrow> nat)\" using countableE_infinite[of ?T] by blast\n      \n  let ?b_of_a = \"\\<lambda>a. (inv nat_of_b) (nat_of_a a)\"\n    \n  have bij_nat_of_b: \"\\<forall>n. nat_of_b (inv nat_of_b n) = n\"\n    using TYUI bij_betw_inv_into_right by fastforce\n  have \"\\<forall>a. inv nat_of_a (nat_of_a a) = a\"\n    by (meson QWER UNIV_I bij_betw_inv_into_left) \n  then have \"inj (\\<lambda>a. inv nat_of_b (nat_of_a a))\"\n    using bij_nat_of_b injI by (metis (no_types))\n  moreover\n  have \"range (\\<lambda>a. inv nat_of_b (nat_of_a a)) = UNIV\"\n    by (metis QWER TYUI bij_def image_image inj_imp_surj_inv)\n  ultimately\n  have \"bij ?b_of_a\"\n    unfolding bij_def by auto\n      \n  then show ?thesis by auto\nqed\n  \nlemma infinite_hterms: \"infinite (UNIV :: hterm set)\"\nproof -\n  let ?diago = \"\\<lambda>n. HFun (string_of_nat n) []\"\n  let ?undiago = \"\\<lambda>a. nat_of_string (case a of HFun f ts \\<Rightarrow> f)\"\n  have \"\\<forall>n. ?undiago (?diago n) = n\" using nat_of_string_string_of_nat by auto\n  moreover\n  have \"\\<forall>n. ?diago n \\<in> UNIV\" by auto\n  ultimately show \"infinite (UNIV :: hterm set)\" using infinity[of ?undiago ?diago UNIV] by simp\nqed\n\ntheorem completeness_countable:\n  assumes inf_uni: \"infinite (UNIV :: ('u :: countable) set)\"\n  assumes finite_cs: \"finite Cs\" \"\\<forall>C\\<in>Cs. finite C\"\n  assumes unsat: \"\\<forall>(F::'u fun_denot) (G::'u pred_denot). \\<not>eval\\<^sub>c\\<^sub>s F G Cs\"\n  shows \"\\<exists>Cs'. resolution_deriv Cs Cs' \\<and> {} \\<in> Cs'\"\nproof -\n  have \"\\<forall>(F::hterm fun_denot) (G::hterm pred_denot) . \\<not>eval\\<^sub>c\\<^sub>s F G Cs\"\n  proof (rule; rule)\n    fix F :: \"hterm fun_denot\"\n    fix G :: \"hterm pred_denot\"\n      \n    obtain u_of_hterm :: \"hterm \\<Rightarrow> 'u\" where p_u_of_hterm: \"bij u_of_hterm\"\n      using countably_inf_bij inf_uni infinite_hterms by auto\n        \n    let ?F = \"F_conv u_of_hterm F\"\n    let ?G = \"G_conv u_of_hterm G\"\n    \n    have \"\\<not> eval\\<^sub>c\\<^sub>s ?F ?G Cs\" using unsat by auto\n    then show \"\\<not> eval\\<^sub>c\\<^sub>s F G Cs\" using eval\\<^sub>c\\<^sub>s_bij using p_u_of_hterm by auto\n  qed\n  then show \"\\<exists>Cs'. resolution_deriv Cs Cs' \\<and> {} \\<in> Cs'\" using finite_cs completeness by auto\nqed\n  \ntheorem completeness_nat:\n  assumes finite_cs: \"finite Cs\" \"\\<forall>C\\<in>Cs. finite C\"\n  assumes unsat: \"\\<forall>(F::nat fun_denot) (G::nat pred_denot) . \\<not>eval\\<^sub>c\\<^sub>s F G Cs\"\n  shows \"\\<exists>Cs'. resolution_deriv Cs Cs' \\<and> {} \\<in> Cs'\"\n  using assms completeness_countable by blast\n\nend \\<comment> \\<open>unification locale\\<close>\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Resolution_FOL/Completeness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526660244838, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.32254717130077154}}
{"text": "section \\<open>Big-step semantics\\<close>\n\ntheory Big_Step_Sterm\nimports\n  Rewriting_Sterm\n  \"../Terms/Term_as_Value\"\nbegin\n\nsubsection \\<open>Big-step semantics evaluating to irreducible @{typ sterm}s\\<close>\n\ninductive (in constructors) seval :: \"srule list \\<Rightarrow> (name, sterm) fmap \\<Rightarrow> sterm \\<Rightarrow> sterm \\<Rightarrow> bool\"  (\"_, _/ \\<turnstile>\\<^sub>s/ _ \\<down>/ _\" [50,0,50] 50) for rs where\nconst: \"(name, rhs) \\<in> set rs \\<Longrightarrow> rs, \\<Gamma> \\<turnstile>\\<^sub>s Sconst name \\<down> rhs\" |\nvar: \"fmlookup \\<Gamma> name = Some val \\<Longrightarrow> rs, \\<Gamma> \\<turnstile>\\<^sub>s Svar name \\<down> val\" |\nabs: \"rs, \\<Gamma> \\<turnstile>\\<^sub>s Sabs cs \\<down> Sabs (map (\\<lambda>(pat, t). (pat, subst t (fmdrop_fset (frees pat) \\<Gamma>))) cs)\" |\ncomb: \"\n  rs, \\<Gamma> \\<turnstile>\\<^sub>s t \\<down> Sabs cs \\<Longrightarrow> rs, \\<Gamma> \\<turnstile>\\<^sub>s u \\<down> u' \\<Longrightarrow>\n  find_match cs u' = Some (env, _, rhs) \\<Longrightarrow>\n  rs, \\<Gamma> ++\\<^sub>f env \\<turnstile>\\<^sub>s rhs \\<down> val \\<Longrightarrow>\n  rs, \\<Gamma> \\<turnstile>\\<^sub>s t $\\<^sub>s u \\<down> val\" |\nconstr: \"\n  name |\\<in>| C \\<Longrightarrow>\n  list_all2 (seval rs \\<Gamma>) ts us \\<Longrightarrow>\n  rs, \\<Gamma> \\<turnstile>\\<^sub>s name $$ ts \\<down> name $$ us\"\n\nlemma (in constructors) seval_closed:\n  assumes \"rs, \\<Gamma> \\<turnstile>\\<^sub>s t \\<down> u\" \"closed_srules rs\" \"closed_env \\<Gamma>\" \"closed_except t (fmdom \\<Gamma>)\"\n  shows \"closed u\"\nusing assms proof induction\n  case (const name rhs \\<Gamma>)\n  thus ?case\n    by (auto simp: list_all_iff)\nnext\n  case (comb \\<Gamma> t cs u u' env pat rhs val)\n  hence \"closed (Sabs cs)\" \"closed u'\"\n    by (auto simp: closed_except_def)\n  moreover have \"(pat, rhs) \\<in> set cs\" \"match pat u' = Some env\"\n    using comb by (auto simp: find_match_elem)\n  ultimately have \"closed_except rhs (frees pat)\"\n    by (auto dest: closed_except_sabs)\n\n  show ?case\n    proof (rule comb)\n      have \"closed_env env\"\n        by (rule closed.match) fact+\n      thus \"closed_env (\\<Gamma> ++\\<^sub>f env)\"\n        using \\<open>closed_env \\<Gamma>\\<close> by auto\n    next\n      have \"closed_except rhs (fmdom \\<Gamma> |\\<union>| frees pat)\"\n        using \\<open>closed_except rhs _\\<close>\n        unfolding closed_except_def by auto\n      hence \"closed_except rhs (fmdom \\<Gamma> |\\<union>| fmdom env)\"\n        using \\<open>match pat u' = Some env\\<close> by (metis match_dom)\n      thus \"closed_except rhs (fmdom (\\<Gamma> ++\\<^sub>f env))\"\n        using comb by simp\n    qed fact\nnext\n  case (abs \\<Gamma> cs)\n  show ?case\n    apply (subst subst_sterm.simps[symmetric])\n    apply (subst closed_except_def)\n    apply (subst subst_frees)\n    apply fact+\n    apply (subst fminus_fsubset_conv)\n    apply (subst closed_except_def[symmetric])\n    apply (subst funion_fempty_right)\n    apply fact\n    done\nnext\n  case (constr name \\<Gamma> ts us)\n  have \"list_all closed us\"\n    using \\<open>list_all2 _ _ _\\<close> \\<open>closed_except (list_comb _ _) _\\<close>\n    proof (induction ts us rule: list.rel_induct)\n      case (Cons v vs u us)\n      thus ?case\n        using constr unfolding closed.list_comb\n        by auto\n    qed simp\n  thus ?case\n    unfolding closed.list_comb\n    by (simp add: closed_except_def)\nqed auto\n\nlemma (in srules) seval_wellformed:\n  assumes \"rs, \\<Gamma> \\<turnstile>\\<^sub>s t \\<down> u\" \"wellformed t\" \"wellformed_env \\<Gamma>\"\n  shows \"wellformed u\"\nusing assms proof induction\n  case (const name rhs \\<Gamma>)\n  thus ?case\n    using all_rules\n    by (auto simp: list_all_iff)\nnext\n  case (comb \\<Gamma> t cs u u' env pat rhs val)\n  hence \"(pat, rhs) \\<in> set cs\" \"match pat u' = Some env\"\n    by (auto simp: find_match_elem)\n\n  show ?case\n    proof (rule comb)\n      show \"wellformed rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> comb\n        by (auto simp: list_all_iff)\n    next\n      have \"wellformed_env env\"\n        apply (rule wellformed.match)\n         apply fact\n        apply (rule comb)\n        using comb apply simp\n        apply fact+\n        done\n      thus \"wellformed_env (\\<Gamma> ++\\<^sub>f env)\"\n        using comb by auto\n    qed\nnext\n  case (abs \\<Gamma> cs)\n  thus ?case\n    by (metis subst_sterm.simps subst_wellformed)\nnext\n  case (constr name \\<Gamma> ts us)\n  have \"list_all wellformed us\"\n    using \\<open>list_all2 _ _ _\\<close> \\<open>wellformed (list_comb _ _)\\<close>\n    proof (induction ts us rule: list.rel_induct)\n      case (Cons v vs u us)\n      thus ?case\n        using constr by (auto simp: wellformed.list_comb app_sterm_def)\n    qed simp\n  thus ?case\n    by (simp add: wellformed.list_comb const_sterm_def)\nqed auto\n\nlemma (in constants) seval_shadows:\n  assumes \"rs, \\<Gamma> \\<turnstile>\\<^sub>s t \\<down> u\" \"\\<not> shadows_consts t\"\n  assumes \"list_all (\\<lambda>(_, rhs). \\<not> shadows_consts rhs) rs\"\n  assumes \"not_shadows_consts_env \\<Gamma>\"\n  shows \"\\<not> shadows_consts u\"\nusing assms proof induction\n  case (const name rhs \\<Gamma>)\n  thus ?case\n    unfolding srules_def\n    by (auto simp: list_all_iff)\nnext\n  case (comb \\<Gamma> t cs u u' env pat rhs val)\n  hence \"\\<not> shadows_consts (Sabs cs)\" \"\\<not> shadows_consts u'\"\n    by auto\n  moreover from comb have \"(pat, rhs) \\<in> set cs\" \"match pat u' = Some env\"\n    by (auto simp: find_match_elem)\n  ultimately have \"\\<not> shadows_consts rhs\"\n    by (auto simp: list_ex_iff)\n\n  moreover have \"not_shadows_consts_env env\"\n    using comb \\<open>match pat u' = _\\<close> by (auto intro: shadows.match)\n\n  ultimately show ?case\n    using comb by blast\nnext\n  case (abs \\<Gamma> cs)\n  show ?case\n    apply (subst subst_sterm.simps[symmetric])\n    apply (rule subst_shadows)\n     apply fact+\n    done\nnext\n  case (constr name \\<Gamma> ts us)\n  have \"list_all (Not \\<circ> shadows_consts) us\"\n    using \\<open>list_all2 _ _ _\\<close> \\<open>\\<not> shadows_consts (name $$ ts)\\<close>\n    proof (induction ts us rule: list.rel_induct)\n      case (Cons v vs u us)\n      thus ?case\n        using constr by (auto simp: shadows.list_comb const_sterm_def app_sterm_def)\n    qed simp\n  thus ?case\n    by (auto simp: shadows.list_comb list_ex_iff list_all_iff const_sterm_def)\nqed auto\n\nlemma (in constructors) seval_list_comb_abs:\n  assumes \"rs, \\<Gamma> \\<turnstile>\\<^sub>s name $$ args \\<down> Sabs cs\"\n  shows \"name \\<in> dom (map_of rs)\"\nusing assms\nproof (induction \\<Gamma> \"name $$ args\" \"Sabs cs\" arbitrary: args cs)\n  case (constr name' _ _ us)\n  hence \"Sabs cs = name' $$ us\" by simp\n  hence False\n    by (cases rule: list_comb_cases) (auto simp: const_sterm_def app_sterm_def)\n  thus ?case ..\nnext\n  case (comb \\<Gamma> t cs' u u' env pat rhs)\n\n  hence \"strip_comb (t $\\<^sub>s u) = strip_comb (name $$ args)\"\n    by simp\n  hence \"strip_comb t = (Sconst name, butlast args)\" \"u = last args\"\n     apply -\n    subgoal\n      apply (simp add: strip_list_comb_const)\n      apply (fold app_sterm_def const_sterm_def)\n      by (auto split: prod.splits)\n    subgoal\n      apply (simp add: strip_list_comb_const)\n      apply (fold app_sterm_def const_sterm_def)\n      by (auto split: prod.splits)\n    done\n  hence \"t = name $$ butlast args\"\n    apply (fold const_sterm_def)\n    by (metis list_strip_comb fst_conv snd_conv)\n\n  thus ?case\n    using comb by auto\nqed (auto elim: list_comb_cases simp: const_sterm_def app_sterm_def intro: weak_map_of_SomeI)\n\nlemma (in constructors) is_value_eval_id:\n  assumes \"is_value t\" \"closed t\"\n  shows \"rs, \\<Gamma> \\<turnstile>\\<^sub>s t \\<down> t\"\nusing assms proof induction\n  case (abs cs)\n\n  have \"rs, \\<Gamma> \\<turnstile>\\<^sub>s Sabs cs \\<down> Sabs (map (\\<lambda>(pat, t). (pat, subst t (fmdrop_fset (frees pat) \\<Gamma>))) cs)\"\n    by (rule seval.abs)\n  moreover have \"subst (Sabs cs) \\<Gamma> = Sabs cs\"\n    using abs by (metis subst_closed_id)\n  ultimately show ?case\n    by simp\nnext\n  case (constr vs name)\n  have \"list_all2 (seval rs \\<Gamma>) vs vs\"\n    proof (rule list.rel_refl_strong)\n      fix v\n      assume \"v \\<in> set vs\"\n      moreover hence \"closed v\"\n        using constr\n        unfolding closed.list_comb\n        by (auto simp: list_all_iff)\n      ultimately show \"rs, \\<Gamma> \\<turnstile>\\<^sub>s v \\<down> v\"\n        using \\<open>list_all _ _\\<close>\n        by (force simp: list_all_iff)\n    qed\n    with \\<open>name |\\<in>| C\\<close> show ?case\n      by (rule seval.constr)\nqed\n\nlemma (in constructors) ssubst_eval:\n  assumes \"rs, \\<Gamma> \\<turnstile>\\<^sub>s t \\<down> t'\" \"\\<Gamma>' \\<subseteq>\\<^sub>f \\<Gamma>\" \"closed_env \\<Gamma>\" \"value_env \\<Gamma>\"\n  shows \"rs, \\<Gamma> \\<turnstile>\\<^sub>s subst t \\<Gamma>' \\<down> t'\"\nusing assms proof induction\n  case (var \\<Gamma> name val)\n  show ?case\n    proof (cases \"fmlookup \\<Gamma>' name\")\n      case None\n      thus ?thesis\n        using var by (auto intro: seval.intros)\n    next\n      case (Some val')\n      with var have \"val' = val\"\n        unfolding fmsubset_alt_def by force\n      show ?thesis\n        apply simp\n        apply (subst Some)\n        apply (subst \\<open>val' = _\\<close>)\n        apply simp\n        apply (rule is_value_eval_id)\n        using var by auto\n    qed\nnext\n  case (abs \\<Gamma> cs)\n  hence \"subst (subst (Sabs cs) \\<Gamma>') \\<Gamma> = subst (Sabs cs) \\<Gamma>\"\n    by (metis subst_twice fmsubset_pred)\n  moreover have \"rs, \\<Gamma> \\<turnstile>\\<^sub>s subst (Sabs cs) \\<Gamma>' \\<down> subst (subst (Sabs cs) \\<Gamma>') \\<Gamma>\"\n    apply simp\n    apply (subst map_map[symmetric])\n    apply (rule seval.abs)\n    done\n  ultimately have \"rs, \\<Gamma> \\<turnstile>\\<^sub>s subst (Sabs cs) \\<Gamma>' \\<down> subst (Sabs cs) \\<Gamma>\"\n    by metis\n  thus ?case by simp\nnext\n  case (constr name \\<Gamma> ts us)\n  hence \"list_all2 (\\<lambda>t. seval rs \\<Gamma> (subst t \\<Gamma>')) ts us\"\n    by (blast intro: list.rel_mono_strong)\n  with constr show ?case\n    by (auto simp: subst_list_comb list_all2_map1 intro: seval.constr)\nqed (auto intro: seval.intros)\n\nlemma (in constructors) seval_agree_eq:\n  assumes \"rs, \\<Gamma> \\<turnstile>\\<^sub>s t \\<down> u\" \"fmrestrict_fset S \\<Gamma> = fmrestrict_fset S \\<Gamma>'\" \"closed_except t S\"\n  assumes \"S |\\<subseteq>| fmdom \\<Gamma>\" \"closed_srules rs\" \"closed_env \\<Gamma>\"\n  shows \"rs, \\<Gamma>' \\<turnstile>\\<^sub>s t \\<down> u\"\nusing assms proof (induction arbitrary: \\<Gamma>' S)\n  case (var \\<Gamma> name val)\n  hence \"name |\\<in>| S\"\n    by (simp add: closed_except_def)\n  hence \"fmlookup \\<Gamma> name = fmlookup \\<Gamma>' name\"\n    using \\<open>fmrestrict_fset S \\<Gamma> = _\\<close>\n    unfolding fmfilter_alt_defs\n    including fmap.lifting\n    by transfer' (auto simp: map_filter_def fun_eq_iff split: if_splits)\n  with var show ?case\n    by (auto intro: seval.var)\nnext\n  case (abs \\<Gamma> cs)\n\n  \\<comment> \\<open>Intentionally local: not really a useful lemma outside of its scope\\<close>\n  have *: \"fmdrop_fset S (fmrestrict_fset T m) = fmrestrict_fset (T |\\<union>| S) (fmdrop_fset S m)\" for S T m\n    unfolding fmfilter_alt_defs fmfilter_comp\n    by (rule fmfilter_cong) auto\n\n  {\n    fix pat t\n    assume \"(pat, t) \\<in> set cs\"\n    with abs have \"closed_except t (S |\\<union>| frees pat)\"\n      by (auto simp: Sterm.closed_except_simps list_all_iff)\n\n    have\n      \"subst t (fmdrop_fset (frees pat) (fmrestrict_fset S \\<Gamma>)) = subst t (fmdrop_fset (frees pat) \\<Gamma>)\"\n      apply (subst *)\n      apply (rule subst_restrict_closed)\n      apply fact\n      done\n\n    moreover have\n      \"subst t (fmdrop_fset (frees pat) (fmrestrict_fset S \\<Gamma>')) = subst t (fmdrop_fset (frees pat) \\<Gamma>')\"\n      apply (subst *)\n      apply (rule subst_restrict_closed)\n      apply fact\n      done\n\n    ultimately have \"subst t (fmdrop_fset (frees pat) \\<Gamma>) = subst t (fmdrop_fset (frees pat) \\<Gamma>')\"\n      using abs by metis\n  }\n\n  hence \"map (\\<lambda>(pat, t). (pat, subst t (fmdrop_fset (frees pat) \\<Gamma>))) cs =\n         map (\\<lambda>(pat, t). (pat, subst t (fmdrop_fset (frees pat) \\<Gamma>'))) cs\"\n    by auto\n\n  thus ?case\n    by (metis seval.abs)\nnext\n  case (comb \\<Gamma> t cs u u' env pat rhs val)\n  have \"fmdom env = frees pat\"\n    apply (rule match_dom)\n    apply (rule find_match_elem)\n    apply fact\n    done\n\n  show ?case\n    proof (rule seval.comb)\n      show \"rs, \\<Gamma>' \\<turnstile>\\<^sub>s t \\<down> Sabs cs\" \"rs, \\<Gamma>' \\<turnstile>\\<^sub>s u \\<down> u'\"\n        using comb by (auto simp: Sterm.closed_except_simps)\n    next\n      show \"rs, \\<Gamma>' ++\\<^sub>f env \\<turnstile>\\<^sub>s rhs \\<down> val\"\n        proof (rule comb)\n          have \"fmrestrict_fset (S |\\<union>| fmdom env) (\\<Gamma> ++\\<^sub>f env) = fmrestrict_fset (S |\\<union>| fmdom env) (\\<Gamma>' ++\\<^sub>f env)\"\n            using comb(8)\n            unfolding fmfilter_alt_defs\n            including fmap.lifting fset.lifting\n            by transfer' (auto simp: map_filter_def fun_eq_iff map_add_def split: option.splits if_splits)\n\n          thus \"fmrestrict_fset (S |\\<union>| frees pat) (\\<Gamma> ++\\<^sub>f env) = fmrestrict_fset (S |\\<union>| frees pat) (\\<Gamma>' ++\\<^sub>f env)\"\n            unfolding \\<open>fmdom env = _\\<close> .\n        next\n          have \"closed_except t S\"\n            using comb by (simp add: Sterm.closed_except_simps)\n\n          have \"closed (Sabs cs)\"\n            apply (rule seval_closed)\n            apply fact+\n            using \\<open>closed_except t S\\<close> \\<open>S |\\<subseteq>| fmdom \\<Gamma>\\<close>\n            unfolding closed_except_def apply simp\n            done\n\n          have \"(pat, rhs) \\<in> set cs\"\n            using \\<open>find_match _ _ = _\\<close> by (rule find_match_elem)\n          hence \"closed_except rhs (frees pat)\"\n            using \\<open>closed (Sabs cs)\\<close> by (auto dest: closed_except_sabs)\n          thus \"closed_except rhs (S |\\<union>| frees pat)\"\n            unfolding closed_except_def by auto\n        next\n          show \"S |\\<union>| frees pat |\\<subseteq>| fmdom (\\<Gamma> ++\\<^sub>f env)\"\n            apply simp\n            apply (intro conjI)\n            using comb(10) apply blast\n            unfolding \\<open>fmdom env = _\\<close> by blast\n        next\n          have \"closed_except u S\"\n            using comb by (auto simp: closed_except_def)\n\n          show \"closed_env (\\<Gamma> ++\\<^sub>f env)\"\n            apply rule\n             apply fact\n            apply (rule closed.match[where t = u' and pat = pat])\n            subgoal\n              by (rule find_match_elem) fact\n            subgoal\n              apply (rule seval_closed)\n                 apply fact+\n              using \\<open>closed_except u S\\<close> \\<open>S |\\<subseteq>| fmdom \\<Gamma>\\<close> unfolding closed_except_def by blast\n            done\n        qed fact\n    qed fact\nnext\n  case (constr name \\<Gamma> ts us)\n  show ?case\n    apply (rule seval.constr)\n     apply fact\n    apply (rule list.rel_mono_strong)\n     apply fact\n    using constr\n    unfolding closed.list_comb list_all_iff\n    by auto\nqed (auto intro: seval.intros)\n\n\nsubsubsection \\<open>Correctness wrt @{const srewrite}\\<close>\n\ncontext srules begin context begin\n\nprivate lemma seval_correct0:\n  assumes \"rs, \\<Gamma> \\<turnstile>\\<^sub>s t \\<down> u\" \"closed_except t (fmdom \\<Gamma>)\" \"closed_env \\<Gamma>\"\n  shows \"rs \\<turnstile>\\<^sub>s subst t \\<Gamma> \\<longrightarrow>* u\"\nusing assms proof induction\n  case (const name rhs \\<Gamma>)\n\n  have \"srewrite_step rs name rhs\"\n    by (rule srewrite_stepI) fact\n  thus ?case\n    by (auto intro: srewrite.intros)\nnext\n  case (comb \\<Gamma> t cs u u' env pat rhs val)\n  hence \"closed_except t (fmdom \\<Gamma>)\" \"closed_except u (fmdom \\<Gamma>)\"\n    by (simp add: Sterm.closed_except_simps)+\n  moreover have \"closed_srules rs\"\n    using all_rules\n    unfolding list_all_iff by fastforce\n  ultimately have \"closed (Sabs cs)\" \"closed u'\"\n    using comb by (metis seval_closed)+\n\n  from comb have \"(pat, rhs) \\<in> set cs\" \"match pat u' = Some env\"\n    by (auto simp: find_match_elem)\n  hence \"closed_except rhs (frees pat)\"\n    using \\<open>closed (Sabs cs)\\<close> by (auto dest: closed_except_sabs)\n  hence \"frees rhs |\\<subseteq>| frees pat\"\n    by (simp add: closed_except_def)\n  moreover have \"fmdom env = frees pat\"\n    using \\<open>match pat u' = _\\<close> by (auto simp: match_dom)\n  ultimately have \"frees rhs |\\<subseteq>| fmdom env\"\n    by simp\n  hence \"subst rhs (\\<Gamma> ++\\<^sub>f env) = subst rhs env\"\n    by (rule subst_add_shadowed_env)\n\n  have \"rs \\<turnstile>\\<^sub>s subst t \\<Gamma> $\\<^sub>s subst u \\<Gamma> \\<longrightarrow>* Sabs cs $\\<^sub>s u'\"\n    using comb by (force intro: srewrite.rt_comb[unfolded app_sterm_def] simp: Sterm.closed_except_simps)\n  also have \"rs \\<turnstile>\\<^sub>s Sabs cs $\\<^sub>s u' \\<longrightarrow>* subst rhs env\"\n    using comb \\<open>closed u'\\<close> by (force intro: srewrite.beta find_match_rewrite_first)\n  also have \"rs \\<turnstile>\\<^sub>s subst rhs env \\<longrightarrow>* subst rhs (\\<Gamma> ++\\<^sub>f env)\"\n    unfolding \\<open>subst rhs (\\<Gamma> ++\\<^sub>f env) = _\\<close> by simp\n  also have \"rs \\<turnstile>\\<^sub>s subst rhs (\\<Gamma> ++\\<^sub>f env) \\<longrightarrow>* val\"\n    proof (rule comb)\n      show \"closed_except rhs (fmdom (\\<Gamma> ++\\<^sub>f env))\"\n        using comb \\<open>match pat u' = Some env\\<close> \\<open>fmdom env = _\\<close> \\<open>frees rhs |\\<subseteq>| frees pat\\<close>\n        by (auto simp: closed_except_def)\n    next\n      show \"closed_env (\\<Gamma> ++\\<^sub>f env)\"\n        using comb \\<open>match pat u' = Some env\\<close> \\<open>closed u'\\<close>\n        by (blast intro: closed.match)\n    qed\n\n  finally show ?case by simp\nnext\n  case (constr name \\<Gamma> ts us)\n  show ?case\n    apply (simp add: subst_list_comb)\n    apply (rule srewrite.rt_list_comb)\n    subgoal\n      apply (simp add: list.rel_map)\n      apply (rule list.rel_mono_strong[OF constr(2)])\n      apply clarify\n      apply (elim impE)\n      using constr(3) apply (erule closed.list_combE)\n       apply (rule constr)+\n      apply (auto simp: const_sterm_def)\n      done\n    subgoal by auto\n    done\nqed auto\n\ncorollary seval_correct:\n  assumes \"rs, fmempty \\<turnstile>\\<^sub>s t \\<down> u\" \"closed t\"\n  shows \"rs \\<turnstile>\\<^sub>s t \\<longrightarrow>* u\"\nproof -\n  have \"closed_except t (fmdom fmempty)\"\n    using assms by simp\n  with assms have \"rs \\<turnstile>\\<^sub>s subst t fmempty \\<longrightarrow>* u\"\n    by (fastforce intro!: seval_correct0)\n  thus ?thesis\n    by simp\nqed\n\nend end\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CakeML_Codegen/Rewriting/Big_Step_Sterm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3225471630310558}}
{"text": "(*  Title:      HOL/Statespace/StateSpaceEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n*)\n\nsection \\<open>Examples \\label{sec:Examples}\\<close>\ntheory StateSpaceEx\nimports StateSpaceLocale StateSpaceSyntax\nbegin\n\n(*<*)\nsyntax\n \"_statespace_updates\" :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> updbinds \\<Rightarrow> ('a \\<Rightarrow> 'b)\" (\"_\\<langle>_\\<rangle>\" [900,0] 900)\n(*>*)\n\ntext \\<open>Did you ever dream about records with multiple inheritance?\nThen you should definitely have a look at statespaces. They may be\nwhat you are dreaming of. Or at least almost \\dots\\<close>\n\n\ntext \\<open>Isabelle allows to add new top-level commands to the\nsystem. Building on the locale infrastructure, we provide a command\n\\<^theory_text>\\<open>statespace\\<close> like this:\\<close>\n\nstatespace vars =\n  n::nat\n  b::bool\n\nprint_locale vars_namespace\nprint_locale vars_valuetypes\nprint_locale vars\n\ntext \\<open>\\noindent This resembles a \\<^theory_text>\\<open>record\\<close> definition, \nbut introduces sophisticated locale\ninfrastructure instead of HOL type schemes.  The resulting context\npostulates two distinct names @{term \"n\"} and @{term \"b\"} and\nprojection~/ injection functions that convert from abstract values to\n@{typ \"nat\"} and \\<open>bool\\<close>. The logical content of the locale is:\\<close>\n\nlocale vars' =\n  fixes n::'name and b::'name\n  assumes \"distinct [n, b]\" \n\n  fixes project_nat::\"'value \\<Rightarrow> nat\" and inject_nat::\"nat \\<Rightarrow> 'value\"\n  assumes \"\\<And>n. project_nat (inject_nat n) = n\" \n\n  fixes project_bool::\"'value \\<Rightarrow> bool\" and inject_bool::\"bool \\<Rightarrow> 'value\"\n  assumes \"\\<And>b. project_bool (inject_bool b) = b\"\n \ntext \\<open>\\noindent The HOL predicate @{const \"distinct\"} describes\ndistinctness of all names in the context.  Locale \\<open>vars'\\<close>\ndefines the raw logical content that is defined in the state space\nlocale. We also maintain non-logical context information to support\nthe user:\n\n\\begin{itemize}\n\n\\item Syntax for state lookup and updates that automatically inserts\nthe corresponding projection and injection functions.\n\n\\item Setup for the proof tools that exploit the distinctness\ninformation and the cancellation of projections and injections in\ndeductions and simplifications.\n\n\\end{itemize}\n\nThis extra-logical information is added to the locale in form of\ndeclarations, which associate the name of a variable to the\ncorresponding projection and injection functions to handle the syntax\ntransformations, and a link from the variable name to the\ncorresponding distinctness theorem. As state spaces are merged or\nextended there are multiple distinctness theorems in the context. Our\ndeclarations take care that the link always points to the strongest\ndistinctness assumption.  With these declarations in place, a lookup\ncan be written as \\<open>s\\<cdot>n\\<close>, which is translated to \\<open>project_nat (s n)\\<close>, and an update as \\<open>s\\<langle>n := 2\\<rangle>\\<close>, which is\ntranslated to \\<open>s(n := inject_nat 2)\\<close>. We can now establish the\nfollowing lemma:\\<close>\n\nlemma (in vars) foo: \"s<n := 2>\\<cdot>b = s\\<cdot>b\" by simp\n\ntext \\<open>\\noindent Here the simplifier was able to refer to\ndistinctness of @{term \"b\"} and @{term \"n\"} to solve the equation.\nThe resulting lemma is also recorded in locale \\<open>vars\\<close> for\nlater use and is automatically propagated to all its interpretations.\nHere is another example:\\<close>\n\nstatespace 'a varsX = NB: vars [n=N, b=B] + vars + x::'a\n\ntext \\<open>\\noindent The state space \\<open>varsX\\<close> imports two copies\nof the state space \\<open>vars\\<close>, where one has the variables renamed\nto upper-case letters, and adds another variable @{term \"x\"} of type\n@{typ \"'a\"}. This type is fixed inside the state space but may get\ninstantiated later on, analogous to type parameters of an ML-functor.\nThe distinctness assumption is now \\<open>distinct [N, B, n, b, x]\\<close>,\nfrom this we can derive both @{term \"distinct [N,B]\"} and @{term\n\"distinct [n,b]\"}, the distinction assumptions for the two versions of\nlocale \\<open>vars\\<close> above.  Moreover we have all necessary\nprojection and injection assumptions available. These assumptions\ntogether allow us to establish state space @{term \"varsX\"} as an\ninterpretation of both instances of locale @{term \"vars\"}. Hence we\ninherit both variants of theorem \\<open>foo\\<close>: \\<open>s\\<langle>N := 2\\<rangle>\\<cdot>B =\ns\\<cdot>B\\<close> as well as \\<open>s\\<langle>n := 2\\<rangle>\\<cdot>b = s\\<cdot>b\\<close>. These are immediate\nconsequences of the locale interpretation action.\n\nThe declarations for syntax and the distinctness theorems also observe\nthe morphisms generated by the locale package due to the renaming\n@{term \"n = N\"}:\\<close>\n\nlemma (in varsX) foo: \"s\\<langle>N := 2\\<rangle>\\<cdot>x = s\\<cdot>x\" by simp\n\ntext \\<open>To assure scalability towards many distinct names, the\ndistinctness predicate is refined to operate on balanced trees. Thus\nwe get logarithmic certificates for the distinctness of two names by\nthe distinctness of the paths in the tree. Asked for the distinctness\nof two names, our tool produces the paths of the variables in the tree\n(this is implemented in SML, outside the logic) and returns a\ncertificate corresponding to the different paths.  Merging state\nspaces requires to prove that the combined distinctness assumption\nimplies the distinctness assumptions of the components.  Such a proof\nis of the order $m \\cdot \\log n$, where $n$ and $m$ are the number of\nnodes in the larger and smaller tree, respectively.\\<close>\n\ntext \\<open>We continue with more examples.\\<close>\n\nstatespace 'a foo = \n  f::\"nat\\<Rightarrow>nat\"\n  a::int\n  b::nat\n  c::'a\n\n\n\nlemma (in foo) foo1: \n  shows \"s\\<langle>a := i\\<rangle>\\<cdot>a = i\"\n  by simp\n\nlemma (in foo) foo2: \n  shows \"(s\\<langle>a:=i\\<rangle>)\\<cdot>a = i\"\n  by simp\n\nlemma (in foo) foo3: \n  shows \"(s\\<langle>a:=i\\<rangle>)\\<cdot>b = s\\<cdot>b\"\n  by simp\n\nlemma (in foo) foo4: \n  shows \"(s\\<langle>a:=i,b:=j,c:=k,a:=x\\<rangle>) = (s\\<langle>b:=j,c:=k,a:=x\\<rangle>)\"\n  by simp\n\nstatespace bar =\n  b::bool\n  c::string\n\nlemma (in bar) bar1: \n  shows \"(s\\<langle>b:=True\\<rangle>)\\<cdot>c = s\\<cdot>c\"\n  by simp\n\ntext \\<open>You can define a derived state space by inheriting existing state spaces, renaming\nof components if you like, and by declaring new components.\n\\<close>\n\nstatespace ('a,'b) loo = 'a foo + bar [b=B,c=C] +\n  X::'b\n\nlemma (in loo) loo1: \n  shows \"s\\<langle>a:=i\\<rangle>\\<cdot>B = s\\<cdot>B\"\nproof -\n  thm foo1\n  txt \\<open>The Lemma @{thm [source] foo1} from the parent state space \n         is also available here: \\begin{center}@{thm foo1}\\end{center}\\<close>\n  have \"s<a:=i>\\<cdot>a = i\"\n    by (rule foo1)\n  thm bar1\n  txt \\<open>Note the renaming of the parameters in Lemma @{thm [source] bar1}: \n         \\begin{center}@{thm bar1}\\end{center}\\<close>\n  have \"s<B:=True>\\<cdot>C = s\\<cdot>C\"\n    by (rule bar1)\n  show ?thesis\n    by simp\nqed\n\n\nstatespace 'a dup = FA: 'a foo [f=F, a=A] + 'a foo +\n  x::int\n\nlemma (in dup)\n shows \"s<a := i>\\<cdot>x = s\\<cdot>x\"\n  by simp\n\nlemma (in dup)\n shows \"s<A := i>\\<cdot>a = s\\<cdot>a\"\n  by simp\n\nlemma (in dup)\n shows \"s<A := i>\\<cdot>x = s\\<cdot>x\"\n  by simp\n\n\n(*\ntext \"Hmm, I hoped this would work now...\"\n\nlocale fooX = foo +\n assumes \"s<a:=i>\\<cdot>b = k\"\n*)\n\n(* ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *)\ntext \\<open>There are known problems with syntax-declarations. They currently\nonly work, when the context is already built. Hopefully this will be \nimplemented correctly in future Isabelle versions.\\<close>\n\n(*\nlemma \n  assumes \"foo f a b c p1 i1 p2 i2 p3 i3 p4 i4\"\n  shows True\nproof\n  interpret foo [f a b c p1 i1 p2 i2 p3 i3 p4 i4] by fact\n  term \"s<a := i>\\<cdot>a = i\"\nqed\n*)\n(*\nlemma \n  includes foo\n  shows \"s<a := i>\\<cdot>a = i\"\n*)\n\ntext \\<open>It would be nice to have nested state spaces. This is\nlogically no problem. From the locale-implementation side this may be\nsomething like an 'includes' into a locale. When there is a more\nelaborate locale infrastructure in place this may be an easy exercise.\n\\<close> \n\n\nsubsection \\<open>Benchmarks\\<close>\n\ntext \\<open>Here are some bigger examples for benchmarking.\\<close>\n\nML \\<open>\n  fun make_benchmark n =\n    writeln (Active.sendback_markup_command\n      (\"statespace benchmark\" ^ string_of_int n ^ \" =\\n\" ^\n        (cat_lines (map (fn i => \"A\" ^ string_of_int i ^ \"::nat\") (1 upto n)))));\n\\<close>\n\ntext \"0.2s\"\nstatespace benchmark100 = A1::nat A2::nat A3::nat A4::nat A5::nat\nA6::nat A7::nat A8::nat A9::nat A10::nat A11::nat A12::nat A13::nat\nA14::nat A15::nat A16::nat A17::nat A18::nat A19::nat A20::nat\nA21::nat A22::nat A23::nat A24::nat A25::nat A26::nat A27::nat\nA28::nat A29::nat A30::nat A31::nat A32::nat A33::nat A34::nat\nA35::nat A36::nat A37::nat A38::nat A39::nat A40::nat A41::nat\nA42::nat A43::nat A44::nat A45::nat A46::nat A47::nat A48::nat\nA49::nat A50::nat A51::nat A52::nat A53::nat A54::nat A55::nat\nA56::nat A57::nat A58::nat A59::nat A60::nat A61::nat A62::nat\nA63::nat A64::nat A65::nat A66::nat A67::nat A68::nat A69::nat\nA70::nat A71::nat A72::nat A73::nat A74::nat A75::nat A76::nat\nA77::nat A78::nat A79::nat A80::nat A81::nat A82::nat A83::nat\nA84::nat A85::nat A86::nat A87::nat A88::nat A89::nat A90::nat\nA91::nat A92::nat A93::nat A94::nat A95::nat A96::nat A97::nat\nA98::nat A99::nat A100::nat\n\ntext \"2.4s\"\nstatespace benchmark500 = A1::nat A2::nat A3::nat A4::nat A5::nat\nA6::nat A7::nat A8::nat A9::nat A10::nat A11::nat A12::nat A13::nat\nA14::nat A15::nat A16::nat A17::nat A18::nat A19::nat A20::nat\nA21::nat A22::nat A23::nat A24::nat A25::nat A26::nat A27::nat\nA28::nat A29::nat A30::nat A31::nat A32::nat A33::nat A34::nat\nA35::nat A36::nat A37::nat A38::nat A39::nat A40::nat A41::nat\nA42::nat A43::nat A44::nat A45::nat A46::nat A47::nat A48::nat\nA49::nat A50::nat A51::nat A52::nat A53::nat A54::nat A55::nat\nA56::nat A57::nat A58::nat A59::nat A60::nat A61::nat A62::nat\nA63::nat A64::nat A65::nat A66::nat A67::nat A68::nat A69::nat\nA70::nat A71::nat A72::nat A73::nat A74::nat A75::nat A76::nat\nA77::nat A78::nat A79::nat A80::nat A81::nat A82::nat A83::nat\nA84::nat A85::nat A86::nat A87::nat A88::nat A89::nat A90::nat\nA91::nat A92::nat A93::nat A94::nat A95::nat A96::nat A97::nat\nA98::nat A99::nat A100::nat A101::nat A102::nat A103::nat A104::nat\nA105::nat A106::nat A107::nat A108::nat A109::nat A110::nat A111::nat\nA112::nat A113::nat A114::nat A115::nat A116::nat A117::nat A118::nat\nA119::nat A120::nat A121::nat A122::nat A123::nat A124::nat A125::nat\nA126::nat A127::nat A128::nat A129::nat A130::nat A131::nat A132::nat\nA133::nat A134::nat A135::nat A136::nat A137::nat A138::nat A139::nat\nA140::nat A141::nat A142::nat A143::nat A144::nat A145::nat A146::nat\nA147::nat A148::nat A149::nat A150::nat A151::nat A152::nat A153::nat\nA154::nat A155::nat A156::nat A157::nat A158::nat A159::nat A160::nat\nA161::nat A162::nat A163::nat A164::nat A165::nat A166::nat A167::nat\nA168::nat A169::nat A170::nat A171::nat A172::nat A173::nat A174::nat\nA175::nat A176::nat A177::nat A178::nat A179::nat A180::nat A181::nat\nA182::nat A183::nat A184::nat A185::nat A186::nat A187::nat A188::nat\nA189::nat A190::nat A191::nat A192::nat A193::nat A194::nat A195::nat\nA196::nat A197::nat A198::nat A199::nat A200::nat A201::nat A202::nat\nA203::nat A204::nat A205::nat A206::nat A207::nat A208::nat A209::nat\nA210::nat A211::nat A212::nat A213::nat A214::nat A215::nat A216::nat\nA217::nat A218::nat A219::nat A220::nat A221::nat A222::nat A223::nat\nA224::nat A225::nat A226::nat A227::nat A228::nat A229::nat A230::nat\nA231::nat A232::nat A233::nat A234::nat A235::nat A236::nat A237::nat\nA238::nat A239::nat A240::nat A241::nat A242::nat A243::nat A244::nat\nA245::nat A246::nat A247::nat A248::nat A249::nat A250::nat A251::nat\nA252::nat A253::nat A254::nat A255::nat A256::nat A257::nat A258::nat\nA259::nat A260::nat A261::nat A262::nat A263::nat A264::nat A265::nat\nA266::nat A267::nat A268::nat A269::nat A270::nat A271::nat A272::nat\nA273::nat A274::nat A275::nat A276::nat A277::nat A278::nat A279::nat\nA280::nat A281::nat A282::nat A283::nat A284::nat A285::nat A286::nat\nA287::nat A288::nat A289::nat A290::nat A291::nat A292::nat A293::nat\nA294::nat A295::nat A296::nat A297::nat A298::nat A299::nat A300::nat\nA301::nat A302::nat A303::nat A304::nat A305::nat A306::nat A307::nat\nA308::nat A309::nat A310::nat A311::nat A312::nat A313::nat A314::nat\nA315::nat A316::nat A317::nat A318::nat A319::nat A320::nat A321::nat\nA322::nat A323::nat A324::nat A325::nat A326::nat A327::nat A328::nat\nA329::nat A330::nat A331::nat A332::nat A333::nat A334::nat A335::nat\nA336::nat A337::nat A338::nat A339::nat A340::nat A341::nat A342::nat\nA343::nat A344::nat A345::nat A346::nat A347::nat A348::nat A349::nat\nA350::nat A351::nat A352::nat A353::nat A354::nat A355::nat A356::nat\nA357::nat A358::nat A359::nat A360::nat A361::nat A362::nat A363::nat\nA364::nat A365::nat A366::nat A367::nat A368::nat A369::nat A370::nat\nA371::nat A372::nat A373::nat A374::nat A375::nat A376::nat A377::nat\nA378::nat A379::nat A380::nat A381::nat A382::nat A383::nat A384::nat\nA385::nat A386::nat A387::nat A388::nat A389::nat A390::nat A391::nat\nA392::nat A393::nat A394::nat A395::nat A396::nat A397::nat A398::nat\nA399::nat A400::nat A401::nat A402::nat A403::nat A404::nat A405::nat\nA406::nat A407::nat A408::nat A409::nat A410::nat A411::nat A412::nat\nA413::nat A414::nat A415::nat A416::nat A417::nat A418::nat A419::nat\nA420::nat A421::nat A422::nat A423::nat A424::nat A425::nat A426::nat\nA427::nat A428::nat A429::nat A430::nat A431::nat A432::nat A433::nat\nA434::nat A435::nat A436::nat A437::nat A438::nat A439::nat A440::nat\nA441::nat A442::nat A443::nat A444::nat A445::nat A446::nat A447::nat\nA448::nat A449::nat A450::nat A451::nat A452::nat A453::nat A454::nat\nA455::nat A456::nat A457::nat A458::nat A459::nat A460::nat A461::nat\nA462::nat A463::nat A464::nat A465::nat A466::nat A467::nat A468::nat\nA469::nat A470::nat A471::nat A472::nat A473::nat A474::nat A475::nat\nA476::nat A477::nat A478::nat A479::nat A480::nat A481::nat A482::nat\nA483::nat A484::nat A485::nat A486::nat A487::nat A488::nat A489::nat\nA490::nat A491::nat A492::nat A493::nat A494::nat A495::nat A496::nat\nA497::nat A498::nat A499::nat A500::nat\n\ntext \"9.0s\"\nstatespace benchmark1000 = A1::nat A2::nat A3::nat A4::nat A5::nat\nA6::nat A7::nat A8::nat A9::nat A10::nat A11::nat A12::nat A13::nat\nA14::nat A15::nat A16::nat A17::nat A18::nat A19::nat A20::nat\nA21::nat A22::nat A23::nat A24::nat A25::nat A26::nat A27::nat\nA28::nat A29::nat A30::nat A31::nat A32::nat A33::nat A34::nat\nA35::nat A36::nat A37::nat A38::nat A39::nat A40::nat A41::nat\nA42::nat A43::nat A44::nat A45::nat A46::nat A47::nat A48::nat\nA49::nat A50::nat A51::nat A52::nat A53::nat A54::nat A55::nat\nA56::nat A57::nat A58::nat A59::nat A60::nat A61::nat A62::nat\nA63::nat A64::nat A65::nat A66::nat A67::nat A68::nat A69::nat\nA70::nat A71::nat A72::nat A73::nat A74::nat A75::nat A76::nat\nA77::nat A78::nat A79::nat A80::nat A81::nat A82::nat A83::nat\nA84::nat A85::nat A86::nat A87::nat A88::nat A89::nat A90::nat\nA91::nat A92::nat A93::nat A94::nat A95::nat A96::nat A97::nat\nA98::nat A99::nat A100::nat A101::nat A102::nat A103::nat A104::nat\nA105::nat A106::nat A107::nat A108::nat A109::nat A110::nat A111::nat\nA112::nat A113::nat A114::nat A115::nat A116::nat A117::nat A118::nat\nA119::nat A120::nat A121::nat A122::nat A123::nat A124::nat A125::nat\nA126::nat A127::nat A128::nat A129::nat A130::nat A131::nat A132::nat\nA133::nat A134::nat A135::nat A136::nat A137::nat A138::nat A139::nat\nA140::nat A141::nat A142::nat A143::nat A144::nat A145::nat A146::nat\nA147::nat A148::nat A149::nat A150::nat A151::nat A152::nat A153::nat\nA154::nat A155::nat A156::nat A157::nat A158::nat A159::nat A160::nat\nA161::nat A162::nat A163::nat A164::nat A165::nat A166::nat A167::nat\nA168::nat A169::nat A170::nat A171::nat A172::nat A173::nat A174::nat\nA175::nat A176::nat A177::nat A178::nat A179::nat A180::nat A181::nat\nA182::nat A183::nat A184::nat A185::nat A186::nat A187::nat A188::nat\nA189::nat A190::nat A191::nat A192::nat A193::nat A194::nat A195::nat\nA196::nat A197::nat A198::nat A199::nat A200::nat A201::nat A202::nat\nA203::nat A204::nat A205::nat A206::nat A207::nat A208::nat A209::nat\nA210::nat A211::nat A212::nat A213::nat A214::nat A215::nat A216::nat\nA217::nat A218::nat A219::nat A220::nat A221::nat A222::nat A223::nat\nA224::nat A225::nat A226::nat A227::nat A228::nat A229::nat A230::nat\nA231::nat A232::nat A233::nat A234::nat A235::nat A236::nat A237::nat\nA238::nat A239::nat A240::nat A241::nat A242::nat A243::nat A244::nat\nA245::nat A246::nat A247::nat A248::nat A249::nat A250::nat A251::nat\nA252::nat A253::nat A254::nat A255::nat A256::nat A257::nat A258::nat\nA259::nat A260::nat A261::nat A262::nat A263::nat A264::nat A265::nat\nA266::nat A267::nat A268::nat A269::nat A270::nat A271::nat A272::nat\nA273::nat A274::nat A275::nat A276::nat A277::nat A278::nat A279::nat\nA280::nat A281::nat A282::nat A283::nat A284::nat A285::nat A286::nat\nA287::nat A288::nat A289::nat A290::nat A291::nat A292::nat A293::nat\nA294::nat A295::nat A296::nat A297::nat A298::nat A299::nat A300::nat\nA301::nat A302::nat A303::nat A304::nat A305::nat A306::nat A307::nat\nA308::nat A309::nat A310::nat A311::nat A312::nat A313::nat A314::nat\nA315::nat A316::nat A317::nat A318::nat A319::nat A320::nat A321::nat\nA322::nat A323::nat A324::nat A325::nat A326::nat A327::nat A328::nat\nA329::nat A330::nat A331::nat A332::nat A333::nat A334::nat A335::nat\nA336::nat A337::nat A338::nat A339::nat A340::nat A341::nat A342::nat\nA343::nat A344::nat A345::nat A346::nat A347::nat A348::nat A349::nat\nA350::nat A351::nat A352::nat A353::nat A354::nat A355::nat A356::nat\nA357::nat A358::nat A359::nat A360::nat A361::nat A362::nat A363::nat\nA364::nat A365::nat A366::nat A367::nat A368::nat A369::nat A370::nat\nA371::nat A372::nat A373::nat A374::nat A375::nat A376::nat A377::nat\nA378::nat A379::nat A380::nat A381::nat A382::nat A383::nat A384::nat\nA385::nat A386::nat A387::nat A388::nat A389::nat A390::nat A391::nat\nA392::nat A393::nat A394::nat A395::nat A396::nat A397::nat A398::nat\nA399::nat A400::nat A401::nat A402::nat A403::nat A404::nat A405::nat\nA406::nat A407::nat A408::nat A409::nat A410::nat A411::nat A412::nat\nA413::nat A414::nat A415::nat A416::nat A417::nat A418::nat A419::nat\nA420::nat A421::nat A422::nat A423::nat A424::nat A425::nat A426::nat\nA427::nat A428::nat A429::nat A430::nat A431::nat A432::nat A433::nat\nA434::nat A435::nat A436::nat A437::nat A438::nat A439::nat A440::nat\nA441::nat A442::nat A443::nat A444::nat A445::nat A446::nat A447::nat\nA448::nat A449::nat A450::nat A451::nat A452::nat A453::nat A454::nat\nA455::nat A456::nat A457::nat A458::nat A459::nat A460::nat A461::nat\nA462::nat A463::nat A464::nat A465::nat A466::nat A467::nat A468::nat\nA469::nat A470::nat A471::nat A472::nat A473::nat A474::nat A475::nat\nA476::nat A477::nat A478::nat A479::nat A480::nat A481::nat A482::nat\nA483::nat A484::nat A485::nat A486::nat A487::nat A488::nat A489::nat\nA490::nat A491::nat A492::nat A493::nat A494::nat A495::nat A496::nat\nA497::nat A498::nat A499::nat A500::nat A501::nat A502::nat A503::nat\nA504::nat A505::nat A506::nat A507::nat A508::nat A509::nat A510::nat\nA511::nat A512::nat A513::nat A514::nat A515::nat A516::nat A517::nat\nA518::nat A519::nat A520::nat A521::nat A522::nat A523::nat A524::nat\nA525::nat A526::nat A527::nat A528::nat A529::nat A530::nat A531::nat\nA532::nat A533::nat A534::nat A535::nat A536::nat A537::nat A538::nat\nA539::nat A540::nat A541::nat A542::nat A543::nat A544::nat A545::nat\nA546::nat A547::nat A548::nat A549::nat A550::nat A551::nat A552::nat\nA553::nat A554::nat A555::nat A556::nat A557::nat A558::nat A559::nat\nA560::nat A561::nat A562::nat A563::nat A564::nat A565::nat A566::nat\nA567::nat A568::nat A569::nat A570::nat A571::nat A572::nat A573::nat\nA574::nat A575::nat A576::nat A577::nat A578::nat A579::nat A580::nat\nA581::nat A582::nat A583::nat A584::nat A585::nat A586::nat A587::nat\nA588::nat A589::nat A590::nat A591::nat A592::nat A593::nat A594::nat\nA595::nat A596::nat A597::nat A598::nat A599::nat A600::nat A601::nat\nA602::nat A603::nat A604::nat A605::nat A606::nat A607::nat A608::nat\nA609::nat A610::nat A611::nat A612::nat A613::nat A614::nat A615::nat\nA616::nat A617::nat A618::nat A619::nat A620::nat A621::nat A622::nat\nA623::nat A624::nat A625::nat A626::nat A627::nat A628::nat A629::nat\nA630::nat A631::nat A632::nat A633::nat A634::nat A635::nat A636::nat\nA637::nat A638::nat A639::nat A640::nat A641::nat A642::nat A643::nat\nA644::nat A645::nat A646::nat A647::nat A648::nat A649::nat A650::nat\nA651::nat A652::nat A653::nat A654::nat A655::nat A656::nat A657::nat\nA658::nat A659::nat A660::nat A661::nat A662::nat A663::nat A664::nat\nA665::nat A666::nat A667::nat A668::nat A669::nat A670::nat A671::nat\nA672::nat A673::nat A674::nat A675::nat A676::nat A677::nat A678::nat\nA679::nat A680::nat A681::nat A682::nat A683::nat A684::nat A685::nat\nA686::nat A687::nat A688::nat A689::nat A690::nat A691::nat A692::nat\nA693::nat A694::nat A695::nat A696::nat A697::nat A698::nat A699::nat\nA700::nat A701::nat A702::nat A703::nat A704::nat A705::nat A706::nat\nA707::nat A708::nat A709::nat A710::nat A711::nat A712::nat A713::nat\nA714::nat A715::nat A716::nat A717::nat A718::nat A719::nat A720::nat\nA721::nat A722::nat A723::nat A724::nat A725::nat A726::nat A727::nat\nA728::nat A729::nat A730::nat A731::nat A732::nat A733::nat A734::nat\nA735::nat A736::nat A737::nat A738::nat A739::nat A740::nat A741::nat\nA742::nat A743::nat A744::nat A745::nat A746::nat A747::nat A748::nat\nA749::nat A750::nat A751::nat A752::nat A753::nat A754::nat A755::nat\nA756::nat A757::nat A758::nat A759::nat A760::nat A761::nat A762::nat\nA763::nat A764::nat A765::nat A766::nat A767::nat A768::nat A769::nat\nA770::nat A771::nat A772::nat A773::nat A774::nat A775::nat A776::nat\nA777::nat A778::nat A779::nat A780::nat A781::nat A782::nat A783::nat\nA784::nat A785::nat A786::nat A787::nat A788::nat A789::nat A790::nat\nA791::nat A792::nat A793::nat A794::nat A795::nat A796::nat A797::nat\nA798::nat A799::nat A800::nat A801::nat A802::nat A803::nat A804::nat\nA805::nat A806::nat A807::nat A808::nat A809::nat A810::nat A811::nat\nA812::nat A813::nat A814::nat A815::nat A816::nat A817::nat A818::nat\nA819::nat A820::nat A821::nat A822::nat A823::nat A824::nat A825::nat\nA826::nat A827::nat A828::nat A829::nat A830::nat A831::nat A832::nat\nA833::nat A834::nat A835::nat A836::nat A837::nat A838::nat A839::nat\nA840::nat A841::nat A842::nat A843::nat A844::nat A845::nat A846::nat\nA847::nat A848::nat A849::nat A850::nat A851::nat A852::nat A853::nat\nA854::nat A855::nat A856::nat A857::nat A858::nat A859::nat A860::nat\nA861::nat A862::nat A863::nat A864::nat A865::nat A866::nat A867::nat\nA868::nat A869::nat A870::nat A871::nat A872::nat A873::nat A874::nat\nA875::nat A876::nat A877::nat A878::nat A879::nat A880::nat A881::nat\nA882::nat A883::nat A884::nat A885::nat A886::nat A887::nat A888::nat\nA889::nat A890::nat A891::nat A892::nat A893::nat A894::nat A895::nat\nA896::nat A897::nat A898::nat A899::nat A900::nat A901::nat A902::nat\nA903::nat A904::nat A905::nat A906::nat A907::nat A908::nat A909::nat\nA910::nat A911::nat A912::nat A913::nat A914::nat A915::nat A916::nat\nA917::nat A918::nat A919::nat A920::nat A921::nat A922::nat A923::nat\nA924::nat A925::nat A926::nat A927::nat A928::nat A929::nat A930::nat\nA931::nat A932::nat A933::nat A934::nat A935::nat A936::nat A937::nat\nA938::nat A939::nat A940::nat A941::nat A942::nat A943::nat A944::nat\nA945::nat A946::nat A947::nat A948::nat A949::nat A950::nat A951::nat\nA952::nat A953::nat A954::nat A955::nat A956::nat A957::nat A958::nat\nA959::nat A960::nat A961::nat A962::nat A963::nat A964::nat A965::nat\nA966::nat A967::nat A968::nat A969::nat A970::nat A971::nat A972::nat\nA973::nat A974::nat A975::nat A976::nat A977::nat A978::nat A979::nat\nA980::nat A981::nat A982::nat A983::nat A984::nat A985::nat A986::nat\nA987::nat A988::nat A989::nat A990::nat A991::nat A992::nat A993::nat\nA994::nat A995::nat A996::nat A997::nat A998::nat A999::nat A1000::nat\n\nlemma (in benchmark100) test: \"s<A1 := a>\\<cdot>A100 = s\\<cdot>A100\" by simp\nlemma (in benchmark500) test: \"s<A1 := a>\\<cdot>A100 = s\\<cdot>A100\" by simp\nlemma (in benchmark1000) test: \"s<A1 := a>\\<cdot>A100 = s\\<cdot>A100\" by simp\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Statespace/StateSpaceEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.322508519735389}}
{"text": "(*  Title:      HOL/Library/Mapping.thy\n    Author:     Florian Haftmann and Ondrej Kuncar\n*)\n\nsection \\<open>An abstract view on maps for code generation.\\<close>\n\ntheory Mapping\nimports Main AList\nbegin\n\nsubsection \\<open>Parametricity transfer rules\\<close>\n\nlemma map_of_foldr: \"map_of xs = foldr (\\<lambda>(k, v) m. m(k \\<mapsto> v)) xs Map.empty\"  (* FIXME move *)\n  using map_add_map_of_foldr [of Map.empty] by auto\n\ncontext includes lifting_syntax\nbegin\n\nlemma empty_parametric: \"(A ===> rel_option B) Map.empty Map.empty\"\n  by transfer_prover\n\nlemma lookup_parametric: \"((A ===> B) ===> A ===> B) (\\<lambda>m k. m k) (\\<lambda>m k. m k)\"\n  by transfer_prover\n\nlemma update_parametric:\n  assumes [transfer_rule]: \"bi_unique A\"\n  shows \"(A ===> B ===> (A ===> rel_option B) ===> A ===> rel_option B)\n    (\\<lambda>k v m. m(k \\<mapsto> v)) (\\<lambda>k v m. m(k \\<mapsto> v))\"\n  by transfer_prover\n\nlemma delete_parametric:\n  assumes [transfer_rule]: \"bi_unique A\"\n  shows \"(A ===> (A ===> rel_option B) ===> A ===> rel_option B)\n    (\\<lambda>k m. m(k := None)) (\\<lambda>k m. m(k := None))\"\n  by transfer_prover\n\nlemma is_none_parametric [transfer_rule]:\n  \"(rel_option A ===> HOL.eq) Option.is_none Option.is_none\"\n  by (auto simp add: Option.is_none_def rel_fun_def rel_option_iff split: option.split)\n\nlemma dom_parametric:\n  assumes [transfer_rule]: \"bi_total A\"\n  shows \"((A ===> rel_option B) ===> rel_set A) dom dom\"\n  unfolding dom_def [abs_def] Option.is_none_def [symmetric] by transfer_prover\n\nlemma graph_parametric:\n  assumes \"bi_total A\"\n  shows \"((A ===> rel_option B) ===> rel_set (rel_prod A B)) Map.graph Map.graph\"\nproof\n  fix f g assume \"(A ===> rel_option B) f g\"\n  with assms[unfolded bi_total_def] show \"rel_set (rel_prod A B) (Map.graph f) (Map.graph g)\"\n    unfolding graph_def rel_set_def rel_fun_def\n    by auto (metis option_rel_Some1 option_rel_Some2)+\nqed\n\nlemma map_of_parametric [transfer_rule]:\n  assumes [transfer_rule]: \"bi_unique R1\"\n  shows \"(list_all2 (rel_prod R1 R2) ===> R1 ===> rel_option R2) map_of map_of\"\n  unfolding map_of_def by transfer_prover\n\nlemma map_entry_parametric [transfer_rule]:\n  assumes [transfer_rule]: \"bi_unique A\"\n  shows \"(A ===> (B ===> B) ===> (A ===> rel_option B) ===> A ===> rel_option B)\n    (\\<lambda>k f m. (case m k of None \\<Rightarrow> m\n      | Some v \\<Rightarrow> m (k \\<mapsto> (f v)))) (\\<lambda>k f m. (case m k of None \\<Rightarrow> m\n      | Some v \\<Rightarrow> m (k \\<mapsto> (f v))))\"\n  by transfer_prover\n\nlemma tabulate_parametric:\n  assumes [transfer_rule]: \"bi_unique A\"\n  shows \"(list_all2 A ===> (A ===> B) ===> A ===> rel_option B)\n    (\\<lambda>ks f. (map_of (map (\\<lambda>k. (k, f k)) ks))) (\\<lambda>ks f. (map_of (map (\\<lambda>k. (k, f k)) ks)))\"\n  by transfer_prover\n\nlemma bulkload_parametric:\n  \"(list_all2 A ===> HOL.eq ===> rel_option A)\n    (\\<lambda>xs k. if k < length xs then Some (xs ! k) else None)\n    (\\<lambda>xs k. if k < length xs then Some (xs ! k) else None)\"\nproof\n  fix xs ys\n  assume \"list_all2 A xs ys\"\n  then show\n    \"(HOL.eq ===> rel_option A)\n      (\\<lambda>k. if k < length xs then Some (xs ! k) else None)\n      (\\<lambda>k. if k < length ys then Some (ys ! k) else None)\"\n    apply induct\n     apply auto\n    unfolding rel_fun_def\n    apply clarsimp\n    apply (case_tac xa)\n     apply (auto dest: list_all2_lengthD list_all2_nthD)\n    done\nqed\n\nlemma map_parametric:\n  \"((A ===> B) ===> (C ===> D) ===> (B ===> rel_option C) ===> A ===> rel_option D)\n     (\\<lambda>f g m. (map_option g \\<circ> m \\<circ> f)) (\\<lambda>f g m. (map_option g \\<circ> m \\<circ> f))\"\n  by transfer_prover\n\nlemma combine_with_key_parametric:\n  \"((A ===> B ===> B ===> B) ===> (A ===> rel_option B) ===> (A ===> rel_option B) ===>\n    (A ===> rel_option B)) (\\<lambda>f m1 m2 x. combine_options (f x) (m1 x) (m2 x))\n    (\\<lambda>f m1 m2 x. combine_options (f x) (m1 x) (m2 x))\"\n  unfolding combine_options_def by transfer_prover\n\nlemma combine_parametric:\n  \"((B ===> B ===> B) ===> (A ===> rel_option B) ===> (A ===> rel_option B) ===>\n    (A ===> rel_option B)) (\\<lambda>f m1 m2 x. combine_options f (m1 x) (m2 x))\n    (\\<lambda>f m1 m2 x. combine_options f (m1 x) (m2 x))\"\n  unfolding combine_options_def by transfer_prover\n\nend\n\n\nsubsection \\<open>Type definition and primitive operations\\<close>\n\ntypedef ('a, 'b) mapping = \"UNIV :: ('a \\<rightharpoonup> 'b) set\"\n  morphisms rep Mapping ..\n\nsetup_lifting type_definition_mapping\n\nlift_definition empty :: \"('a, 'b) mapping\"\n  is Map.empty parametric empty_parametric .\n\nlift_definition lookup :: \"('a, 'b) mapping \\<Rightarrow> 'a \\<Rightarrow> 'b option\"\n  is \"\\<lambda>m k. m k\" parametric lookup_parametric .\n\ndefinition \"lookup_default d m k = (case Mapping.lookup m k of None \\<Rightarrow> d | Some v \\<Rightarrow> v)\"\n\nlift_definition update :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  is \"\\<lambda>k v m. m(k \\<mapsto> v)\" parametric update_parametric .\n\nlift_definition delete :: \"'a \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  is \"\\<lambda>k m. m(k := None)\" parametric delete_parametric .\n\nlift_definition filter :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  is \"\\<lambda>P m k. case m k of None \\<Rightarrow> None | Some v \\<Rightarrow> if P k v then Some v else None\" .\n\nlift_definition keys :: \"('a, 'b) mapping \\<Rightarrow> 'a set\"\n  is dom parametric dom_parametric .\n\nlift_definition entries :: \"('a, 'b) mapping \\<Rightarrow> ('a \\<times> 'b) set\"\n  is Map.graph parametric graph_parametric .\n\nlift_definition tabulate :: \"'a list \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> ('a, 'b) mapping\"\n  is \"\\<lambda>ks f. (map_of (List.map (\\<lambda>k. (k, f k)) ks))\" parametric tabulate_parametric .\n\nlift_definition bulkload :: \"'a list \\<Rightarrow> (nat, 'a) mapping\"\n  is \"\\<lambda>xs k. if k < length xs then Some (xs ! k) else None\" parametric bulkload_parametric .\n\nlift_definition map :: \"('c \\<Rightarrow> 'a) \\<Rightarrow> ('b \\<Rightarrow> 'd) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('c, 'd) mapping\"\n  is \"\\<lambda>f g m. (map_option g \\<circ> m \\<circ> f)\" parametric map_parametric .\n\nlift_definition map_values :: \"('c \\<Rightarrow> 'a \\<Rightarrow> 'b) \\<Rightarrow> ('c, 'a) mapping \\<Rightarrow> ('c, 'b) mapping\"\n  is \"\\<lambda>f m x. map_option (f x) (m x)\" .\n\nlift_definition combine_with_key ::\n  \"('a \\<Rightarrow> 'b \\<Rightarrow> 'b \\<Rightarrow> 'b) \\<Rightarrow> ('a,'b) mapping \\<Rightarrow> ('a,'b) mapping \\<Rightarrow> ('a,'b) mapping\"\n  is \"\\<lambda>f m1 m2 x. combine_options (f x) (m1 x) (m2 x)\" parametric combine_with_key_parametric .\n\nlift_definition combine ::\n  \"('b \\<Rightarrow> 'b \\<Rightarrow> 'b) \\<Rightarrow> ('a,'b) mapping \\<Rightarrow> ('a,'b) mapping \\<Rightarrow> ('a,'b) mapping\"\n  is \"\\<lambda>f m1 m2 x. combine_options f (m1 x) (m2 x)\" parametric combine_parametric .\n\ndefinition \"All_mapping m P \\<longleftrightarrow>\n  (\\<forall>x. case Mapping.lookup m x of None \\<Rightarrow> True | Some y \\<Rightarrow> P x y)\"\n\ndeclare [[code drop: map]]\n\n\nsubsection \\<open>Functorial structure\\<close>\n\nfunctor map: map\n  by (transfer, auto simp add: fun_eq_iff option.map_comp option.map_id)+\n\n\nsubsection \\<open>Derived operations\\<close>\n\ndefinition ordered_keys :: \"('a::linorder, 'b) mapping \\<Rightarrow> 'a list\"\n  where \"ordered_keys m = (if finite (keys m) then sorted_list_of_set (keys m) else [])\"\n\ndefinition ordered_entries :: \"('a::linorder, 'b) mapping \\<Rightarrow> ('a \\<times> 'b) list\"\n  where \"ordered_entries m = (if finite (entries m) then sorted_key_list_of_set fst (entries m)\n                                                    else [])\"\n\ndefinition fold :: \"('a::linorder \\<Rightarrow> 'b \\<Rightarrow> 'c \\<Rightarrow> 'c) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> 'c \\<Rightarrow> 'c\"\n  where \"fold f m a = List.fold (case_prod f) (ordered_entries m) a\"\n\ndefinition is_empty :: \"('a, 'b) mapping \\<Rightarrow> bool\"\n  where \"is_empty m \\<longleftrightarrow> keys m = {}\"\n\ndefinition size :: \"('a, 'b) mapping \\<Rightarrow> nat\"\n  where \"size m = (if finite (keys m) then card (keys m) else 0)\"\n\ndefinition replace :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  where \"replace k v m = (if k \\<in> keys m then update k v m else m)\"\n\ndefinition default :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  where \"default k v m = (if k \\<in> keys m then m else update k v m)\"\n\ntext \\<open>Manual derivation of transfer rule is non-trivial\\<close>\n\nlift_definition map_entry :: \"'a \\<Rightarrow> ('b \\<Rightarrow> 'b) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\" is\n  \"\\<lambda>k f m.\n    (case m k of\n      None \\<Rightarrow> m\n    | Some v \\<Rightarrow> m (k \\<mapsto> (f v)))\" parametric map_entry_parametric .\n\nlemma map_entry_code [code]:\n  \"map_entry k f m =\n    (case lookup m k of\n      None \\<Rightarrow> m\n    | Some v \\<Rightarrow> update k (f v) m)\"\n  by transfer rule\n\ndefinition map_default :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('b \\<Rightarrow> 'b) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\n  where \"map_default k v f m = map_entry k f (default k v m)\"\n\ndefinition of_alist :: \"('k \\<times> 'v) list \\<Rightarrow> ('k, 'v) mapping\"\n  where \"of_alist xs = foldr (\\<lambda>(k, v) m. update k v m) xs empty\"\n\ninstantiation mapping :: (type, type) equal\nbegin\n\ndefinition \"HOL.equal m1 m2 \\<longleftrightarrow> (\\<forall>k. lookup m1 k = lookup m2 k)\"\n\ninstance\n  apply standard\n  unfolding equal_mapping_def\n  apply transfer\n  apply auto\n  done\n\nend\n\ncontext includes lifting_syntax\nbegin\n\n\n\nlemma of_alist_transfer [transfer_rule]:\n  assumes [transfer_rule]: \"bi_unique R1\"\n  shows \"(list_all2 (rel_prod R1 R2) ===> pcr_mapping R1 R2) map_of of_alist\"\n  unfolding of_alist_def [abs_def] map_of_foldr [abs_def] by transfer_prover\n\nend\n\n\nsubsection \\<open>Properties\\<close>\n\nlemma mapping_eqI: \"(\\<And>x. lookup m x = lookup m' x) \\<Longrightarrow> m = m'\"\n  by transfer (simp add: fun_eq_iff)\n\nlemma mapping_eqI':\n  assumes \"\\<And>x. x \\<in> Mapping.keys m \\<Longrightarrow> Mapping.lookup_default d m x = Mapping.lookup_default d m' x\"\n    and \"Mapping.keys m = Mapping.keys m'\"\n  shows \"m = m'\"\nproof (intro mapping_eqI)\n  show \"Mapping.lookup m x = Mapping.lookup m' x\" for x\n  proof (cases \"Mapping.lookup m x\")\n    case None\n    then have \"x \\<notin> Mapping.keys m\"\n      by transfer (simp add: dom_def)\n    then have \"x \\<notin> Mapping.keys m'\"\n      by (simp add: assms)\n    then have \"Mapping.lookup m' x = None\"\n      by transfer (simp add: dom_def)\n    with None show ?thesis\n      by simp\n  next\n    case (Some y)\n    then have A: \"x \\<in> Mapping.keys m\"\n      by transfer (simp add: dom_def)\n    then have \"x \\<in> Mapping.keys m'\"\n      by (simp add: assms)\n    then have \"\\<exists>y'. Mapping.lookup m' x = Some y'\"\n      by transfer (simp add: dom_def)\n    with Some assms(1)[OF A] show ?thesis\n      by (auto simp add: lookup_default_def)\n  qed\nqed\n\nlemma lookup_update[simp]: \"lookup (update k v m) k = Some v\"\n  by transfer simp\n\nlemma lookup_update_neq[simp]: \"k \\<noteq> k' \\<Longrightarrow> lookup (update k v m) k' = lookup m k'\"\n  by transfer simp\n\nlemma lookup_update': \"lookup (update k v m) k' = (if k = k' then Some v else lookup m k')\"\n  by transfer simp\n\nlemma lookup_empty[simp]: \"lookup empty k = None\"\n  by transfer simp\n\nlemma lookup_delete[simp]: \"lookup (delete k m) k = None\"\n  by transfer simp\n\nlemma lookup_delete_neq[simp]: \"k \\<noteq> k' \\<Longrightarrow> lookup (delete k m) k' = lookup m k'\"\n  by transfer simp\n\nlemma lookup_filter:\n  \"lookup (filter P m) k =\n    (case lookup m k of\n      None \\<Rightarrow> None\n    | Some v \\<Rightarrow> if P k v then Some v else None)\"\n  by transfer simp_all\n\nlemma lookup_map_values: \"lookup (map_values f m) k = map_option (f k) (lookup m k)\"\n  by transfer simp_all\n\nlemma lookup_default_empty: \"lookup_default d empty k = d\"\n  by (simp add: lookup_default_def lookup_empty)\n\nlemma lookup_default_update: \"lookup_default d (update k v m) k = v\"\n  by (simp add: lookup_default_def)\n\nlemma lookup_default_update_neq:\n  \"k \\<noteq> k' \\<Longrightarrow> lookup_default d (update k v m) k' = lookup_default d m k'\"\n  by (simp add: lookup_default_def)\n\nlemma lookup_default_update':\n  \"lookup_default d (update k v m) k' = (if k = k' then v else lookup_default d m k')\"\n  by (auto simp: lookup_default_update lookup_default_update_neq)\n\nlemma lookup_default_filter:\n  \"lookup_default d (filter P m) k =\n     (if P k (lookup_default d m k) then lookup_default d m k else d)\"\n  by (simp add: lookup_default_def lookup_filter split: option.splits)\n\nlemma lookup_default_map_values:\n  \"lookup_default (f k d) (map_values f m) k = f k (lookup_default d m k)\"\n  by (simp add: lookup_default_def lookup_map_values split: option.splits)\n\nlemma lookup_combine_with_key:\n  \"Mapping.lookup (combine_with_key f m1 m2) x =\n    combine_options (f x) (Mapping.lookup m1 x) (Mapping.lookup m2 x)\"\n  by transfer (auto split: option.splits)\n\nlemma combine_altdef: \"combine f m1 m2 = combine_with_key (\\<lambda>_. f) m1 m2\"\n  by transfer' (rule refl)\n\nlemma lookup_combine:\n  \"Mapping.lookup (combine f m1 m2) x =\n     combine_options f (Mapping.lookup m1 x) (Mapping.lookup m2 x)\"\n  by transfer (auto split: option.splits)\n\nlemma lookup_default_neutral_combine_with_key:\n  assumes \"\\<And>x. f k d x = x\" \"\\<And>x. f k x d = x\"\n  shows \"Mapping.lookup_default d (combine_with_key f m1 m2) k =\n    f k (Mapping.lookup_default d m1 k) (Mapping.lookup_default d m2 k)\"\n  by (auto simp: lookup_default_def lookup_combine_with_key assms split: option.splits)\n\nlemma lookup_default_neutral_combine:\n  assumes \"\\<And>x. f d x = x\" \"\\<And>x. f x d = x\"\n  shows \"Mapping.lookup_default d (combine f m1 m2) x =\n    f (Mapping.lookup_default d m1 x) (Mapping.lookup_default d m2 x)\"\n  by (auto simp: lookup_default_def lookup_combine assms split: option.splits)\n\nlemma lookup_map_entry: \"lookup (map_entry x f m) x = map_option f (lookup m x)\"\n  by transfer (auto split: option.splits)\n\nlemma lookup_map_entry_neq: \"x \\<noteq> y \\<Longrightarrow> lookup (map_entry x f m) y = lookup m y\"\n  by transfer (auto split: option.splits)\n\nlemma lookup_map_entry':\n  \"lookup (map_entry x f m) y =\n     (if x = y then map_option f (lookup m y) else lookup m y)\"\n  by transfer (auto split: option.splits)\n\nlemma lookup_default: \"lookup (default x d m) x = Some (lookup_default d m x)\"\n  unfolding lookup_default_def default_def\n  by transfer (auto split: option.splits)\n\nlemma lookup_default_neq: \"x \\<noteq> y \\<Longrightarrow> lookup (default x d m) y = lookup m y\"\n  unfolding lookup_default_def default_def\n  by transfer (auto split: option.splits)\n\nlemma lookup_default':\n  \"lookup (default x d m) y =\n    (if x = y then Some (lookup_default d m x) else lookup m y)\"\n  unfolding lookup_default_def default_def\n  by transfer (auto split: option.splits)\n\nlemma lookup_map_default: \"lookup (map_default x d f m) x = Some (f (lookup_default d m x))\"\n  unfolding lookup_default_def default_def\n  by (simp add: map_default_def lookup_map_entry lookup_default lookup_default_def)\n\nlemma lookup_map_default_neq: \"x \\<noteq> y \\<Longrightarrow> lookup (map_default x d f m) y = lookup m y\"\n  unfolding lookup_default_def default_def\n  by (simp add: map_default_def lookup_map_entry_neq lookup_default_neq)\n\nlemma lookup_map_default':\n  \"lookup (map_default x d f m) y =\n    (if x = y then Some (f (lookup_default d m x)) else lookup m y)\"\n  unfolding lookup_default_def default_def\n  by (simp add: map_default_def lookup_map_entry' lookup_default' lookup_default_def)\n\nlemma lookup_tabulate:\n  assumes \"distinct xs\"\n  shows \"Mapping.lookup (Mapping.tabulate xs f) x = (if x \\<in> set xs then Some (f x) else None)\"\n  using assms by transfer (auto simp: map_of_eq_None_iff o_def dest!: map_of_SomeD)\n\nlemma lookup_of_alist: \"lookup (of_alist xs) k = map_of xs k\"\n  by transfer simp_all\n\nlemma keys_is_none_rep [code_unfold]: \"k \\<in> keys m \\<longleftrightarrow> \\<not> (Option.is_none (lookup m k))\"\n  by transfer (auto simp add: Option.is_none_def)\n\nlemma update_update:\n  \"update k v (update k w m) = update k v m\"\n  \"k \\<noteq> l \\<Longrightarrow> update k v (update l w m) = update l w (update k v m)\"\n  by (transfer; simp add: fun_upd_twist)+\n\nlemma update_delete [simp]: \"update k v (delete k m) = update k v m\"\n  by transfer simp\n\nlemma delete_update:\n  \"delete k (update k v m) = delete k m\"\n  \"k \\<noteq> l \\<Longrightarrow> delete k (update l v m) = update l v (delete k m)\"\n  by (transfer; simp add: fun_upd_twist)+\n\nlemma delete_empty [simp]: \"delete k empty = empty\"\n  by transfer simp\n\nlemma Mapping_delete_if_notin_keys[simp]:\n  \"k \\<notin> keys m \\<Longrightarrow> delete k m = m\"\n  by transfer simp\n\nlemma replace_update:\n  \"k \\<notin> keys m \\<Longrightarrow> replace k v m = m\"\n  \"k \\<in> keys m \\<Longrightarrow> replace k v m = update k v m\"\n  by (transfer; auto simp add: replace_def fun_upd_twist)+\n\nlemma map_values_update: \"map_values f (update k v m) = update k (f k v) (map_values f m)\"\n  by transfer (simp_all add: fun_eq_iff)\n\nlemma size_mono: \"finite (keys m') \\<Longrightarrow> keys m \\<subseteq> keys m' \\<Longrightarrow> size m \\<le> size m'\"\n  unfolding size_def by (auto intro: card_mono)\n\nlemma size_empty [simp]: \"size empty = 0\"\n  unfolding size_def by transfer simp\n\nlemma size_update:\n  \"finite (keys m) \\<Longrightarrow> size (update k v m) =\n    (if k \\<in> keys m then size m else Suc (size m))\"\n  unfolding size_def by transfer (auto simp add: insert_dom)\n\nlemma size_delete: \"size (delete k m) = (if k \\<in> keys m then size m - 1 else size m)\"\n  unfolding size_def by transfer simp\n\nlemma size_tabulate [simp]: \"size (tabulate ks f) = length (remdups ks)\"\n  unfolding size_def by transfer (auto simp add: map_of_map_restrict card_set comp_def)\n\nlemma keys_filter: \"keys (filter P m) \\<subseteq> keys m\"\n  by transfer (auto split: option.splits)\n\nlemma size_filter: \"finite (keys m) \\<Longrightarrow> size (filter P m) \\<le> size m\"\n  by (intro size_mono keys_filter)\n\nlemma bulkload_tabulate: \"bulkload xs = tabulate [0..<length xs] (nth xs)\"\n  by transfer (auto simp add: map_of_map_restrict)\n\nlemma is_empty_empty [simp]: \"is_empty empty\"\n  unfolding is_empty_def by transfer simp\n\nlemma is_empty_update [simp]: \"\\<not> is_empty (update k v m)\"\n  unfolding is_empty_def by transfer simp\n\nlemma is_empty_delete: \"is_empty (delete k m) \\<longleftrightarrow> is_empty m \\<or> keys m = {k}\"\n  unfolding is_empty_def by transfer (auto simp del: dom_eq_empty_conv)\n\nlemma is_empty_replace [simp]: \"is_empty (replace k v m) \\<longleftrightarrow> is_empty m\"\n  unfolding is_empty_def replace_def by transfer auto\n\nlemma is_empty_default [simp]: \"\\<not> is_empty (default k v m)\"\n  unfolding is_empty_def default_def by transfer auto\n\nlemma is_empty_map_entry [simp]: \"is_empty (map_entry k f m) \\<longleftrightarrow> is_empty m\"\n  unfolding is_empty_def by transfer (auto split: option.split)\n\nlemma is_empty_map_values [simp]: \"is_empty (map_values f m) \\<longleftrightarrow> is_empty m\"\n  unfolding is_empty_def by transfer (auto simp: fun_eq_iff)\n\nlemma is_empty_map_default [simp]: \"\\<not> is_empty (map_default k v f m)\"\n  by (simp add: map_default_def)\n\nlemma keys_dom_lookup: \"keys m = dom (Mapping.lookup m)\"\n  by transfer rule\n\nlemma keys_empty [simp]: \"keys empty = {}\"\n  by transfer (fact dom_empty)\n\nlemma in_keysD: \"k \\<in> keys m \\<Longrightarrow> \\<exists>v. lookup m k = Some v\"\n  by transfer (fact domD)\n\nlemma keys_update [simp]: \"keys (update k v m) = insert k (keys m)\"\n  by transfer simp\n\nlemma keys_delete [simp]: \"keys (delete k m) = keys m - {k}\"\n  by transfer simp\n\nlemma keys_replace [simp]: \"keys (replace k v m) = keys m\"\n  unfolding replace_def by transfer (simp add: insert_absorb)\n\nlemma keys_default [simp]: \"keys (default k v m) = insert k (keys m)\"\n  unfolding default_def by transfer (simp add: insert_absorb)\n\nlemma keys_map_entry [simp]: \"keys (map_entry k f m) = keys m\"\n  by transfer (auto split: option.split)\n\nlemma keys_map_default [simp]: \"keys (map_default k v f m) = insert k (keys m)\"\n  by (simp add: map_default_def)\n\nlemma keys_map_values [simp]: \"keys (map_values f m) = keys m\"\n  by transfer (simp_all add: dom_def)\n\nlemma keys_combine_with_key [simp]:\n  \"Mapping.keys (combine_with_key f m1 m2) = Mapping.keys m1 \\<union> Mapping.keys m2\"\n  by transfer (auto simp: dom_def combine_options_def split: option.splits)\n\nlemma keys_combine [simp]: \"Mapping.keys (combine f m1 m2) = Mapping.keys m1 \\<union> Mapping.keys m2\"\n  by (simp add: combine_altdef)\n\nlemma keys_tabulate [simp]: \"keys (tabulate ks f) = set ks\"\n  by transfer (simp add: map_of_map_restrict o_def)\n\nlemma keys_of_alist [simp]: \"keys (of_alist xs) = set (List.map fst xs)\"\n  by transfer (simp_all add: dom_map_of_conv_image_fst)\n\nlemma keys_bulkload [simp]: \"keys (bulkload xs) = {0..<length xs}\"\n  by (simp add: bulkload_tabulate)\n\nlemma finite_keys_update[simp]:\n  \"finite (keys (update k v m)) = finite (keys m)\"\n  by transfer simp\n\nlemma set_ordered_keys[simp]:\n  \"finite (Mapping.keys m) \\<Longrightarrow> set (Mapping.ordered_keys m) = Mapping.keys m\"\n  unfolding ordered_keys_def by transfer auto\n\nlemma distinct_ordered_keys [simp]: \"distinct (ordered_keys m)\"\n  by (simp add: ordered_keys_def)\n\nlemma ordered_keys_infinite [simp]: \"\\<not> finite (keys m) \\<Longrightarrow> ordered_keys m = []\"\n  by (simp add: ordered_keys_def)\n\nlemma ordered_keys_empty [simp]: \"ordered_keys empty = []\"\n  by (simp add: ordered_keys_def)\n\nlemma sorted_ordered_keys[simp]: \"sorted (ordered_keys m)\"\n  unfolding ordered_keys_def by simp\n\nlemma ordered_keys_update [simp]:\n  \"k \\<in> keys m \\<Longrightarrow> ordered_keys (update k v m) = ordered_keys m\"\n  \"finite (keys m) \\<Longrightarrow> k \\<notin> keys m \\<Longrightarrow>\n    ordered_keys (update k v m) = insort k (ordered_keys m)\"\n  by (simp_all add: ordered_keys_def)\n     (auto simp only: sorted_list_of_set_insert_remove[symmetric] insert_absorb)\n\nlemma ordered_keys_delete [simp]: \"ordered_keys (delete k m) = remove1 k (ordered_keys m)\"\nproof (cases \"finite (keys m)\")\n  case False\n  then show ?thesis by simp\nnext\n  case fin: True\n  show ?thesis\n  proof (cases \"k \\<in> keys m\")\n    case False\n    with fin have \"k \\<notin> set (sorted_list_of_set (keys m))\"\n      by simp\n    with False show ?thesis\n      by (simp add: ordered_keys_def remove1_idem)\n  next\n    case True\n    with fin show ?thesis\n      by (simp add: ordered_keys_def sorted_list_of_set_remove)\n  qed\nqed\n\nlemma ordered_keys_replace [simp]: \"ordered_keys (replace k v m) = ordered_keys m\"\n  by (simp add: replace_def)\n\nlemma ordered_keys_default [simp]:\n  \"k \\<in> keys m \\<Longrightarrow> ordered_keys (default k v m) = ordered_keys m\"\n  \"finite (keys m) \\<Longrightarrow> k \\<notin> keys m \\<Longrightarrow> ordered_keys (default k v m) = insort k (ordered_keys m)\"\n  by (simp_all add: default_def)\n\nlemma ordered_keys_map_entry [simp]: \"ordered_keys (map_entry k f m) = ordered_keys m\"\n  by (simp add: ordered_keys_def)\n\nlemma ordered_keys_map_default [simp]:\n  \"k \\<in> keys m \\<Longrightarrow> ordered_keys (map_default k v f m) = ordered_keys m\"\n  \"finite (keys m) \\<Longrightarrow> k \\<notin> keys m \\<Longrightarrow> ordered_keys (map_default k v f m) = insort k (ordered_keys m)\"\n  by (simp_all add: map_default_def)\n\nlemma ordered_keys_tabulate [simp]: \"ordered_keys (tabulate ks f) = sort (remdups ks)\"\n  by (simp add: ordered_keys_def sorted_list_of_set_sort_remdups)\n\nlemma ordered_keys_bulkload [simp]: \"ordered_keys (bulkload ks) = [0..<length ks]\"\n  by (simp add: ordered_keys_def)\n\nlemma tabulate_fold: \"tabulate xs f = List.fold (\\<lambda>k m. update k (f k) m) xs empty\"\nproof transfer\n  fix f :: \"'a \\<Rightarrow> 'b\" and xs\n  have \"map_of (List.map (\\<lambda>k. (k, f k)) xs) = foldr (\\<lambda>k m. m(k \\<mapsto> f k)) xs Map.empty\"\n    by (simp add: foldr_map comp_def map_of_foldr)\n  also have \"foldr (\\<lambda>k m. m(k \\<mapsto> f k)) xs = List.fold (\\<lambda>k m. m(k \\<mapsto> f k)) xs\"\n    by (rule foldr_fold) (simp add: fun_eq_iff)\n  ultimately show \"map_of (List.map (\\<lambda>k. (k, f k)) xs) = List.fold (\\<lambda>k m. m(k \\<mapsto> f k)) xs Map.empty\"\n    by simp\nqed\n\nlemma All_mapping_mono:\n  \"(\\<And>k v. k \\<in> keys m \\<Longrightarrow> P k v \\<Longrightarrow> Q k v) \\<Longrightarrow> All_mapping m P \\<Longrightarrow> All_mapping m Q\"\n  unfolding All_mapping_def by transfer (auto simp: All_mapping_def dom_def split: option.splits)\n\nlemma All_mapping_empty [simp]: \"All_mapping Mapping.empty P\"\n  by (auto simp: All_mapping_def lookup_empty)\n\nlemma All_mapping_update_iff:\n  \"All_mapping (Mapping.update k v m) P \\<longleftrightarrow> P k v \\<and> All_mapping m (\\<lambda>k' v'. k = k' \\<or> P k' v')\"\n  unfolding All_mapping_def\nproof safe\n  assume \"\\<forall>x. case Mapping.lookup (Mapping.update k v m) x of None \\<Rightarrow> True | Some y \\<Rightarrow> P x y\"\n  then have *: \"case Mapping.lookup (Mapping.update k v m) x of None \\<Rightarrow> True | Some y \\<Rightarrow> P x y\" for x\n    by blast\n  from *[of k] show \"P k v\"\n    by (simp add: lookup_update)\n  show \"case Mapping.lookup m x of None \\<Rightarrow> True | Some v' \\<Rightarrow> k = x \\<or> P x v'\" for x\n    using *[of x] by (auto simp add: lookup_update' split: if_splits option.splits)\nnext\n  assume \"P k v\"\n  assume \"\\<forall>x. case Mapping.lookup m x of None \\<Rightarrow> True | Some v' \\<Rightarrow> k = x \\<or> P x v'\"\n  then have A: \"case Mapping.lookup m x of None \\<Rightarrow> True | Some v' \\<Rightarrow> k = x \\<or> P x v'\" for x\n    by blast\n  show \"case Mapping.lookup (Mapping.update k v m) x of None \\<Rightarrow> True | Some xa \\<Rightarrow> P x xa\" for x\n    using \\<open>P k v\\<close> A[of x] by (auto simp: lookup_update' split: option.splits)\nqed\n\nlemma All_mapping_update:\n  \"P k v \\<Longrightarrow> All_mapping m (\\<lambda>k' v'. k = k' \\<or> P k' v') \\<Longrightarrow> All_mapping (Mapping.update k v m) P\"\n  by (simp add: All_mapping_update_iff)\n\nlemma All_mapping_filter_iff: \"All_mapping (filter P m) Q \\<longleftrightarrow> All_mapping m (\\<lambda>k v. P k v \\<longrightarrow> Q k v)\"\n  by (auto simp: All_mapping_def lookup_filter split: option.splits)\n\nlemma All_mapping_filter: \"All_mapping m Q \\<Longrightarrow> All_mapping (filter P m) Q\"\n  by (auto simp: All_mapping_filter_iff intro: All_mapping_mono)\n\nlemma All_mapping_map_values: \"All_mapping (map_values f m) P \\<longleftrightarrow> All_mapping m (\\<lambda>k v. P k (f k v))\"\n  by (auto simp: All_mapping_def lookup_map_values split: option.splits)\n\nlemma All_mapping_tabulate: \"(\\<forall>x\\<in>set xs. P x (f x)) \\<Longrightarrow> All_mapping (Mapping.tabulate xs f) P\"\n  unfolding All_mapping_def\n  apply (intro allI)\n  apply transfer\n  apply (auto split: option.split dest!: map_of_SomeD)\n  done\n\nlemma All_mapping_alist:\n  \"(\\<And>k v. (k, v) \\<in> set xs \\<Longrightarrow> P k v) \\<Longrightarrow> All_mapping (Mapping.of_alist xs) P\"\n  by (auto simp: All_mapping_def lookup_of_alist dest!: map_of_SomeD split: option.splits)\n\nlemma combine_empty [simp]: \"combine f Mapping.empty y = y\" \"combine f y Mapping.empty = y\"\n  by (transfer; force)+\n\nlemma (in abel_semigroup) comm_monoid_set_combine: \"comm_monoid_set (combine f) Mapping.empty\"\n  by standard (transfer fixing: f, simp add: combine_options_ac[of f] ac_simps)+\n\nlocale combine_mapping_abel_semigroup = abel_semigroup\nbegin\n\nsublocale combine: comm_monoid_set \"combine f\" Mapping.empty\n  by (rule comm_monoid_set_combine)\n\nlemma fold_combine_code:\n  \"combine.F g (set xs) = foldr (\\<lambda>x. combine f (g x)) (remdups xs) Mapping.empty\"\nproof -\n  have \"combine.F g (set xs) = foldr (\\<lambda>x. combine f (g x)) xs Mapping.empty\"\n    if \"distinct xs\" for xs\n    using that by (induction xs) simp_all\n  from this[of \"remdups xs\"] show ?thesis by simp\nqed\n\nlemma keys_fold_combine: \"finite A \\<Longrightarrow> Mapping.keys (combine.F g A) = (\\<Union>x\\<in>A. Mapping.keys (g x))\"\n  by (induct A rule: finite_induct) simp_all\n\nend\n\nsubsubsection \\<open>@{term [source] entries}, @{term [source] ordered_entries},\n               and @{term [source] fold}\\<close>\n\ncontext linorder\nbegin\n\nsublocale folding_Map_graph: folding_insort_key \"(\\<le>)\" \"(<)\" \"Map.graph m\" fst for m\n  by unfold_locales (fact inj_on_fst_graph)\n\nend\n\nlemma sorted_fst_list_of_set_insort_Map_graph[simp]:\n  assumes \"finite (dom m)\" \"fst x \\<notin> dom m\"\n  shows \"sorted_key_list_of_set fst (insert x (Map.graph m))\n       = insort_key fst x (sorted_key_list_of_set fst (Map.graph m))\"\nproof(cases x)\n  case (Pair k v)\n  with \\<open>fst x \\<notin> dom m\\<close> have \"Map.graph m \\<subseteq> Map.graph (m(k \\<mapsto> v))\"\n    by(auto simp: graph_def)\n  moreover from Pair \\<open>fst x \\<notin> dom m\\<close> have \"(k, v) \\<notin> Map.graph m\"\n    using graph_domD by fastforce\n  ultimately show ?thesis\n    using Pair assms folding_Map_graph.sorted_key_list_of_set_insert[where ?m=\"m(k \\<mapsto> v)\"]\n    by auto\nqed\n\nlemma sorted_fst_list_of_set_insort_insert_Map_graph[simp]:\n  assumes \"finite (dom m)\" \"fst x \\<notin> dom m\"\n  shows \"sorted_key_list_of_set fst (insert x (Map.graph m))\n       = insort_insert_key fst x (sorted_key_list_of_set fst (Map.graph m))\"\nproof(cases x)\n  case (Pair k v)\n  with \\<open>fst x \\<notin> dom m\\<close> have \"Map.graph m \\<subseteq> Map.graph (m(k \\<mapsto> v))\"\n    by(auto simp: graph_def)    \n  with assms Pair show ?thesis\n    unfolding sorted_fst_list_of_set_insort_Map_graph[OF assms] insort_insert_key_def\n    using folding_Map_graph.set_sorted_key_list_of_set in_graphD by (fastforce split: if_splits)\nqed\n\nlemma linorder_finite_Map_induct[consumes 1, case_names empty update]:\n  fixes m :: \"'a::linorder \\<rightharpoonup> 'b\"\n  assumes \"finite (dom m)\"\n  assumes \"P Map.empty\"\n  assumes \"\\<And>k v m. \\<lbrakk> finite (dom m); k \\<notin> dom m; (\\<And>k'. k' \\<in> dom m \\<Longrightarrow> k' \\<le> k); P m \\<rbrakk>\n                    \\<Longrightarrow> P (m(k \\<mapsto> v))\"\n  shows \"P m\"\nproof -\n  let ?key_list = \"\\<lambda>m. sorted_list_of_set (dom m)\"\n  from assms(1,2) show ?thesis\n  proof(induction \"length (?key_list m)\" arbitrary: m)\n    case 0\n    then have \"sorted_list_of_set (dom m) = []\"\n      by auto\n    with \\<open>finite (dom m)\\<close> have \"m = Map.empty\"\n       by auto\n     with \\<open>P Map.empty\\<close> show ?case by simp\n  next\n    case (Suc n)\n    then obtain x xs where x_xs: \"sorted_list_of_set (dom m) = xs @ [x]\"\n      by (metis append_butlast_last_id length_greater_0_conv zero_less_Suc)\n    have \"sorted_list_of_set (dom (m(x := None))) = xs\"\n    proof -\n      have \"distinct (xs @ [x])\"\n        by (metis sorted_list_of_set.distinct_sorted_key_list_of_set x_xs)\n      then have \"remove1 x (xs @ [x]) = xs\"\n        by (simp add: remove1_append)\n      with \\<open>finite (dom m)\\<close> x_xs show ?thesis\n        by (simp add: sorted_list_of_set_remove)\n    qed\n    moreover have \"k \\<le> x\" if \"k \\<in> dom (m(x := None))\" for k\n    proof -\n      from x_xs have \"sorted (xs @ [x])\"\n        by (metis sorted_list_of_set.sorted_sorted_key_list_of_set)\n      moreover from \\<open>k \\<in> dom (m(x := None))\\<close> have \"k \\<in> set xs\"\n        using \\<open>finite (dom m)\\<close> \\<open>sorted_list_of_set (dom (m(x := None))) = xs\\<close>\n        by auto\n      ultimately show \"k \\<le> x\"\n        by (simp add: sorted_append)\n    qed     \n    moreover from \\<open>finite (dom m)\\<close> have \"finite (dom (m(x := None)))\" \"x \\<notin> dom (m(x := None))\"\n      by simp_all\n    moreover have \"P (m(x := None))\"\n      using Suc \\<open>sorted_list_of_set (dom (m(x := None))) = xs\\<close> x_xs by auto\n    ultimately show ?case\n      using assms(3)[where ?m=\"m(x := None)\"] by (metis fun_upd_triv fun_upd_upd not_Some_eq)\n  qed\nqed\n\nlemma delete_insort_fst[simp]: \"AList.delete k (insort_key fst (k, v) xs) = AList.delete k xs\"\n  by (induction xs) simp_all\n\nlemma insort_fst_delete: \"\\<lbrakk> fst x \\<noteq> k2; sorted (List.map fst xs) \\<rbrakk>\n  \\<Longrightarrow> insort_key fst x (AList.delete k2 xs) = AList.delete k2 (insort_key fst x xs)\"\n  by (induction xs) (fastforce simp add: insort_is_Cons order_trans)+\n\nlemma sorted_fst_list_of_set_Map_graph_fun_upd_None[simp]:\n  \"sorted_key_list_of_set fst (Map.graph (m(k := None)))\n   = AList.delete k (sorted_key_list_of_set fst (Map.graph m))\"\nproof(cases \"finite (Map.graph m)\")\n  assume \"finite (Map.graph m)\"\n  from this[unfolded finite_graph_iff_finite_dom] show ?thesis\n  proof(induction rule: finite_Map_induct)\n    let ?list_of=\"sorted_key_list_of_set fst\"\n    case (update k2 v2 m)\n    note [simp] = \\<open>k2 \\<notin> dom m\\<close> \\<open>finite (dom m)\\<close>\n\n    have right_eq: \"AList.delete k (?list_of (Map.graph (m(k2 \\<mapsto> v2))))\n      = AList.delete k (insort_key fst (k2, v2) (?list_of (Map.graph m)))\"\n      by simp\n\n    show ?case\n    proof(cases \"k = k2\")\n      case True\n      then have \"?list_of (Map.graph ((m(k2 \\<mapsto> v2))(k := None)))\n        = AList.delete k (insort_key fst (k2, v2) (?list_of (Map.graph m)))\"\n        using fst_graph_eq_dom update.IH by auto\n      then show ?thesis\n        using right_eq by metis\n    next\n      case False\n      then have \"AList.delete k (insort_key fst (k2, v2) (?list_of (Map.graph m)))\n        = insort_key fst (k2, v2) (?list_of (Map.graph (m(k := None))))\"\n        by (auto simp add: insort_fst_delete update.IH\n                      folding_Map_graph.sorted_sorted_key_list_of_set[OF subset_refl])\n      also have \"\\<dots> = ?list_of (insert (k2, v2) (Map.graph (m(k := None))))\"\n        by auto\n      also from False \\<open>k2 \\<notin> dom m\\<close> have \"\\<dots> = ?list_of (Map.graph ((m(k2 \\<mapsto> v2))(k := None)))\"\n        by (metis graph_map_upd domIff fun_upd_triv fun_upd_twist)\n      finally show ?thesis using right_eq by metis\n    qed\n  qed simp\nqed simp\n\nlemma entries_empty[simp]: \"entries empty = {}\"\n  by transfer (fact graph_empty)\n\nlemma entries_lookup: \"entries m = Map.graph (lookup m)\"\n  by transfer rule\n\nlemma in_entriesI: \"lookup m k = Some v \\<Longrightarrow> (k, v) \\<in> entries m\"\n  by transfer (fact in_graphI)\n\nlemma in_entriesD: \"(k, v) \\<in> entries m \\<Longrightarrow> lookup m k = Some v\"\n  by transfer (fact in_graphD)\n\nlemma fst_image_entries_eq_keys[simp]: \"fst ` Mapping.entries m = Mapping.keys m\"\n  by transfer (fact fst_graph_eq_dom)\n\nlemma finite_entries_iff_finite_keys[simp]:\n  \"finite (entries m) = finite (keys m)\"\n  by transfer (fact finite_graph_iff_finite_dom)\n\nlemma entries_update:\n  \"entries (update k v m) = insert (k, v) (entries (delete k m))\"\n  by transfer (fact graph_map_upd)\n\nlemma entries_delete:\n  \"entries (delete k m) = {e \\<in> entries m. fst e \\<noteq> k}\"\n  by transfer (fact graph_fun_upd_None)\n\nlemma entries_of_alist[simp]:\n  \"distinct (List.map fst xs) \\<Longrightarrow> entries (of_alist xs) = set xs\"\n  by transfer (fact graph_map_of_if_distinct_dom)\n\nlemma entries_keysD:\n  \"x \\<in> entries m \\<Longrightarrow> fst x \\<in> keys m\"\n  by transfer (fact graph_domD)\n\nlemma set_ordered_entries[simp]:\n  \"finite (keys m) \\<Longrightarrow> set (ordered_entries m) = entries m\"\n  unfolding ordered_entries_def\n  by transfer (auto simp: folding_Map_graph.set_sorted_key_list_of_set[OF subset_refl])\n\nlemma distinct_ordered_entries[simp]: \"distinct (List.map fst (ordered_entries m))\"\n  unfolding ordered_entries_def\n  by transfer (simp add: folding_Map_graph.distinct_sorted_key_list_of_set[OF subset_refl])\n\nlemma sorted_ordered_entries[simp]: \"sorted (List.map fst (ordered_entries m))\"\n  unfolding ordered_entries_def\n  by transfer (auto intro: folding_Map_graph.sorted_sorted_key_list_of_set)\n\nlemma ordered_entries_infinite[simp]:\n  \"\\<not> finite (Mapping.keys m) \\<Longrightarrow> ordered_entries m = []\"\n  by (simp add: ordered_entries_def)\n\nlemma ordered_entries_empty[simp]: \"ordered_entries empty = []\"\n  by (simp add: ordered_entries_def)\n\nlemma ordered_entries_update[simp]:\n  assumes \"finite (keys m)\"\n  shows \"ordered_entries (update k v m)\n   = insort_insert_key fst (k, v) (AList.delete k (ordered_entries m))\"\nproof -\n  let ?list_of=\"sorted_key_list_of_set fst\" and ?insort=\"insort_insert_key fst\"\n\n  have *: \"?list_of (insert (k, v) (Map.graph (m(k := None))))\n    = ?insort (k, v) (AList.delete k (?list_of (Map.graph m)))\" if \"finite (dom m)\" for m\n  proof -\n    from \\<open>finite (dom m)\\<close> have \"?list_of (insert (k, v) (Map.graph (m(k := None))))\n      = ?insort (k, v) (?list_of (Map.graph (m(k := None))))\"\n      by (intro sorted_fst_list_of_set_insort_insert_Map_graph) (simp_all add: subset_insertI) \n    then show ?thesis by simp\n  qed\n  from assms show ?thesis\n    unfolding ordered_entries_def\n    apply (transfer fixing: k v) using \"*\" by auto\nqed\n\nlemma ordered_entries_delete[simp]:\n  \"ordered_entries (delete k m) = AList.delete k (ordered_entries m)\"\n  unfolding ordered_entries_def by transfer auto\n\nlemma map_fst_ordered_entries[simp]:\n  \"List.map fst (ordered_entries m) = ordered_keys m\"\nproof(cases \"finite (Mapping.keys m)\")\n  case True\n  then have \"set (List.map fst (Mapping.ordered_entries m)) = set (Mapping.ordered_keys m)\"\n    unfolding ordered_entries_def ordered_keys_def\n    by (transfer) (simp add: folding_Map_graph.set_sorted_key_list_of_set[OF subset_refl] fst_graph_eq_dom)\n  with True show \"List.map fst (Mapping.ordered_entries m) = Mapping.ordered_keys m\"\n    by (metis distinct_ordered_entries ordered_keys_def sorted_list_of_set.idem_if_sorted_distinct          \n              sorted_list_of_set.set_sorted_key_list_of_set sorted_ordered_entries)\nnext\n  case False\n  then show ?thesis\n    unfolding ordered_entries_def ordered_keys_def by simp\nqed\n\nlemma fold_empty[simp]: \"fold f empty a = a\"\n  unfolding fold_def by simp\n\nlemma insort_key_is_snoc_if_sorted_and_distinct:\n  assumes \"sorted (List.map f xs)\" \"f y \\<notin> f ` set xs\" \"\\<forall>x \\<in> set xs. f x \\<le> f y\"\n  shows \"insort_key f y xs = xs @ [y]\"\n  using assms by (induction xs) (auto dest!: insort_is_Cons)\n\nlemma fold_update:\n  assumes \"finite (keys m)\"\n  assumes \"k \\<notin> keys m\" \"\\<And>k'. k' \\<in> keys m \\<Longrightarrow> k' \\<le> k\"\n  shows \"fold f (update k v m) a = f k v (fold f m a)\"\nproof -\n  from assms have k_notin_entries: \"k \\<notin> fst ` set (ordered_entries m)\"\n    using entries_keysD by fastforce\n  with assms have \"ordered_entries (update k v m)\n    = insort_insert_key fst (k, v) (ordered_entries m)\"\n    by simp\n  also from k_notin_entries have \"\\<dots> = ordered_entries m @ [(k, v)]\"\n  proof -\n    from assms have \"\\<forall>x \\<in> set (ordered_entries m). fst x \\<le> fst (k, v)\"\n      unfolding ordered_entries_def\n      by transfer (fastforce simp: folding_Map_graph.set_sorted_key_list_of_set[OF order_refl]\n                             dest: graph_domD)\n    from insort_key_is_snoc_if_sorted_and_distinct[OF _ _ this] k_notin_entries \\<open>finite (keys m)\\<close>\n    show ?thesis\n      using sorted_ordered_keys\n      unfolding insort_insert_key_def by auto\n  qed\n  finally show ?thesis unfolding fold_def by simp\nqed\n\nlemma linorder_finite_Mapping_induct[consumes 1, case_names empty update]:\n  fixes m :: \"('a::linorder, 'b) mapping\"\n  assumes \"finite (keys m)\"\n  assumes \"P empty\"\n  assumes \"\\<And>k v m.\n    \\<lbrakk> finite (keys m); k \\<notin> keys m; (\\<And>k'. k' \\<in> keys m \\<Longrightarrow> k' \\<le> k); P m \\<rbrakk>\n    \\<Longrightarrow> P (update k v m)\"\n  shows \"P m\"\n  using assms by transfer (simp add: linorder_finite_Map_induct)\n\n\nsubsection \\<open>Code generator setup\\<close>\n\nhide_const (open) empty is_empty rep lookup lookup_default filter update delete ordered_keys\n  keys size replace default map_entry map_default tabulate bulkload map map_values combine of_alist\n  entries ordered_entries fold\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Library/Mapping.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953797290152, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.32243125960666674}}
{"text": "theory Dominant imports Composition\nbegin\n\n(*\n * One very common case that arises when working with merged semantics is a situation where\n * two or more semantics are trivially non-conflicting for certain relevant pieces of syntax.\n * \n * This style of reasoning is used in general Hoare rules covering extensions of a language\n * (see the Hoare directory). We show that the rule corresponding to construct C\n * in language L holds for any extension of L, provided the semantics function for L\n * remains \"dominant\" over the others for the syntax corresponding to C\n * (that is, will not be overridden).\n *\n * (Concretely: if I know my IMP semantics is dominant for IF statements,\n * I do not need to worry about other languages being merged in disrupting the intended\n * behavior of IF.)\n *)\n\n(* dominant: for the given syntax x, f \"dominates\" set S if for all state inputs b,\n * f x b is the least upper bound of\n * applying each f' in S to x and b.\n *)\ndefinition dominant ::\n  \"('a \\<Rightarrow> ('b :: Mergeable) \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> ('b :: Mergeable) \\<Rightarrow> 'b) set \\<Rightarrow> 'a \\<Rightarrow> bool\"\n(\"_ \\<downharpoonleft> _ _\" [250, 252, 254])\nwhere\n\"(f \\<downharpoonleft> S x) =\n (\\<forall> b . is_sup ((\\<lambda> g . g x b) ` S) (f x b))\"\n\n(* TODO: might be a good idea to have a special version of dominant for lifters.\n * Similar e.g. to ortho.\n *)\n\nlemma dominantI [intro] :\n  assumes \"\\<And> b . is_sup ((\\<lambda> g . g x b) ` S) (f x b)\"\n  shows \"(f \\<downharpoonleft> S x)\" using assms\n  unfolding dominant_def by auto\n\nlemma dominantE [elim] :\n  assumes \"(f \\<downharpoonleft> S x)\"\n  shows \"is_sup ((\\<lambda> g . g x b) ` S) (f x b)\" using assms\n  unfolding dominant_def by auto\n\n(* If sups_pres holds on a set\n * (I believe this hypothesis is needed to rule out badly-behaved sets that subvert the intuitive\n * meaning of dominant, though not 100% sure - TODO)\n * and f is dominant for some syntax x\n * then the result of running the merged semantics will exactly equal the result of f\n * on that syntax.\n *)\n\nlemma dominant_pcomps :\n  assumes Hpres : \"sups_pres (set l) S\"\n  assumes Hne : \"z \\<in> set l\"\n  assumes H : \"(f \\<downharpoonleft> (set l) x)\"\n  assumes Bin : \"b \\<in> S x\"\n  shows \"pcomps l x b = f x b\"\nproof-\n\n  have B : \"is_sup {b} b\"\n    using sup_singleton by auto\n\n  have Hne' : \"l \\<noteq> []\"\n    using Hne by auto\n\n\n  have Sup1 : \"is_sup (((\\<lambda>f. f x b) ` set l)) (pcomps l x b)\"\n    using sups_pres_pcomps_sup'[OF Hpres Hne'] Bin B\n    by auto\n\n  have Rewrite1 : \"(\\<lambda>f. f b) ` (\\<lambda>f. f x) ` set l = (\\<lambda> f . f x b) ` set l\"\n    by blast\n\n  have Sup2 : \"is_sup ((\\<lambda>f. f x b) ` set l) (pcomps l x b)\"\n    using Sup1\n    unfolding scross_singleton2 Rewrite1\n    by auto\n\n  have Sup2' : \"is_sup ((\\<lambda>f. f x b) ` set l) (f x b)\"\n    using dominantE[OF H, of b]\n    by auto\n\n  show ?thesis using is_sup_unique[OF Sup2 Sup2'] by auto\nqed\n\nlemma dominant_pcomps_set :\n  assumes Hpres : \"sups_pres Fs S\"\n  assumes Hne : \"z \\<in> Fs\"\n  assumes H : \"(f \\<downharpoonleft> Fs x)\"\n  assumes L : \"set l = Fs\"\n  assumes Bin : \"b \\<in> S x\"\n  shows \"pcomps l x b = f x b\"\n  using dominant_pcomps assms unfolding sym[OF L] by auto\n\n(* \n * A more fine-grained version of dominant - capturing the idea of \"quotiented\" dominance.\n * Whereas \"true\" dominance says that f's result is equal to the sep, this one says that\n * some relation holds (?)\n *)\n\n(* dominant: for the given syntax x, f \"dominates\" set S if for all state inputs b,\n * f x b is the least upper bound of\n * applying each f' in S to x and b.\n * how can we special-case this?\n *)\n(*\ndefinition dominantP ::\n  \"('a \\<Rightarrow> ('b :: Mergeable) \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'b set) \\<Rightarrow> ('a \\<Rightarrow> ('b :: Mergeable) \\<Rightarrow> 'b) set \\<Rightarrow> 'a \\<Rightarrow> bool\"\n(\"_; _ \\<downharpoonleft> _ _\" [280, 282, 284, 286])\nwhere\n\"(f; P \\<downharpoonleft> S x) =\n (\\<forall> b . is_sup ((\\<lambda> g . g x b) ` S) (f x b))\"\n\nlemma dominantI [intro] :\n  assumes \"\\<And> b . is_sup ((\\<lambda> g . g x b) ` S) (f x b)\"\n  shows \"(f \\<downharpoonleft> S x)\" using assms\n  unfolding dominant_def by auto\n\nlemma dominantE [elim] :\n  assumes \"(f \\<downharpoonleft> S x)\"\n  shows \"is_sup ((\\<lambda> g . g x b) ` S) (f x b)\" using assms\n  unfolding dominant_def by auto\n*)\n\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Composition/Dominant_Old.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953506426082, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.32243124336694057}}
{"text": "section \\<open>Preliminaries\\<close>\n\ntheory Cap9\nimports\n  \"HOL-Word.Word\"\n  \"HOL-Library.Adhoc_Overloading\"\n  \"HOL-Library.DAList\"\n  \"HOL-Library.AList\"\n  \"HOL-Library.Rewrite\"\n  \"Word_Lib/Word_Lemmas\"\nbegin\n\nsubsection \\<open>Type class instantiations\\<close>\n\ntext \\<open>\n  Instantiate @{class len} type class to extract lengths from word\n  types avoiding repeated explicit numeric specification of the length e.g.\n  @{text \"LENGTH(byte)\"} or @{text \"LENGTH('a :: len word)\"} instead of @{text 8} or\n  @{term \"LENGTH('a :: len)\"}, where @{text \"'a\"} cannot be directly extracted from a type\n  such as @{text \"'a word\"}.\n\\<close>\n\ninstantiation word :: (len) len begin\ndefinition len_word[simp]: \"len_of (_ :: 'a::len word itself) = LENGTH('a)\"\ninstance by (standard, simp)\nend\n\nlemma len_word': \"LENGTH('a::len word) = LENGTH('a)\" by (rule len_word)\n\ntext \\<open>\n  Instantiate @{class size} type class for types of the form @{text \"'a itself\"}. This allows\n  us to parametrize operations by word lengths using the dummy variables of type\n  @{text \"'a word itself\"}. The operations cannot be directly parametrized by numbers as there is\n  no lifting from term numbers to type numbers due to the lack of dependent types.\n\\<close>\n\ninstantiation itself :: (len) size begin\ndefinition size_itself where [simp, code]: \"size (n::'a::len itself) = LENGTH('a)\"\ninstance ..\nend\n\ndeclare unat_word_ariths[simp] word_size[simp] is_up_def[simp] wsst_TYs(1,2)[simp]\n\nsubsection \\<open>Word width\\<close>\n\ntext \\<open>\n  We introduce definition of the least number of bits to hold the current value of a word. This is\n  needed because in our specification we often word with @{const \"ucast\"}'ed values\n  (right aligned subranges of bits), largely\n  again due to the lack of dependent types (or true type-level functions),\n  e.g. the it's hard to specify that the length of\n  @{text \"a \\<Join> b\"} (where @{text \"\\<Join>\"} stands for concatenation) is the sum of the length of\n  @{text \"a\"} and @{text \"b\"}, since length is a type parameter and there's no equivalent of\n  sum on the type level. So we instead fix the length of @{text \"a \\<Join> b\"} to be the maximum\n  possible one (say, 32 bytes) and then use conditions of the form @{text \"width a \\<le> s\"} to\n  specify that the actual ``size'' of @{text \"a\"} is @{text \"s\"}.\n\\<close>\n\ndefinition \"width w \\<equiv> LEAST n. unat w < 2 ^ n\" for w :: \"'a::len word\"\n\nlemma widthI[intro]: \"\\<lbrakk>\\<And> u. u < n \\<Longrightarrow> 2 ^ u \\<le> unat w; unat w < 2 ^ n\\<rbrakk> \\<Longrightarrow> width w = n\"\n  unfolding width_def Least_def\n  using not_le\n  apply (intro the_equality, blast)\n  by (meson nat_less_le)\n\nlemma width_wf: \"\\<exists>! n. (\\<forall> u < n. 2 ^ u \\<le> unat w) \\<and> unat w < 2 ^ n\"\n  (is \"?Ex1 (unat w)\")\nproof (induction (\"unat w\"))\n  case 0\n  show \"?Ex1 0\" by (intro ex1I[of _ 0], auto)\nnext\n  case (Suc x)\n  then obtain n where x:\"(\\<forall>u<n. 2 ^ u \\<le> x) \\<and> x < 2 ^ n \" by auto\n  show  \"?Ex1 (Suc x)\"\n  proof (cases \"Suc x < 2 ^ n\")\n    case True\n    thus \"?Ex1 (Suc x)\"\n      using x\n      apply (intro ex1I[of _ \"n\"], auto)\n      by (meson Suc_lessD leD linorder_neqE_nat)\n  next\n    case False\n    thus \"?Ex1 (Suc x)\"\n      using x\n      apply (intro ex1I[of _ \"Suc n\"], auto simp add: less_Suc_eq)\n      apply (intro antisym)\n       apply (metis One_nat_def Suc_lessI Suc_n_not_le_n leI numeral_2_eq_2 power_increasing_iff)\n      by (metis Suc_lessD le_antisym not_le not_less_eq_eq)\n  qed\nqed\n\nlemma width_iff[iff]: \"(width w = n) = ((\\<forall> u < n. 2 ^ u \\<le> unat w) \\<and> unat w < 2 ^ n)\"\n  using width_wf widthI by metis\n\nlemma width_le_size: \"width x \\<le> size x\"\nproof-\n  {\n    assume \"size x < width x\"\n    hence \"2 ^ size x \\<le> unat x\" using width_iff by metis\n    hence \"2 ^ size x \\<le> uint x\" unfolding unat_def by simp\n  }\n  thus ?thesis using uint_range_size[of x] by (force simp del:word_size)\nqed\n\nlemma width_le_size'[simp]: \"size x \\<le> n \\<Longrightarrow> width x \\<le> n\" by (insert width_le_size[of x], simp)\n\nlemma nth_width_high[simp]: \"width x \\<le> i \\<Longrightarrow> \\<not> x !! i\"\nproof (cases \"i < size x\")\n  case False\n  thus ?thesis by (simp add: test_bit_bin')\nnext\n  case True\n  hence \"(x < 2 ^ i) = (unat x < 2 ^ i)\"\n    unfolding unat_def\n    using word_2p_lem by fastforce\n  moreover assume \"width x \\<le> i\"\n  then obtain n where \"unat x < 2 ^ n\" and \"n \\<le> i\" using width_iff by metis\n  hence \"unat x < 2 ^ i\"\n    by (meson le_less_trans nat_power_less_imp_less not_less zero_less_numeral)\n  ultimately show ?thesis using bang_is_le by force\nqed\n\nlemma width_zero[iff]: \"(width x = 0) = (x = 0)\"\nproof\n  show \"width x = 0 \\<Longrightarrow> x = 0\" using nth_width_high[of x] word_eq_iff[of x 0] nth_0 by (metis le0)\n  show \"x = 0 \\<Longrightarrow> width x = 0\" by simp\nqed\n\nlemma width_zero'[simp]: \"width 0 = 0\" by simp\n\nlemma width_one[simp]: \"width 1 = 1\" by simp\n\nlemma high_zeros_less: \"(\\<forall> i \\<ge> u. \\<not> x !! i) \\<Longrightarrow> unat x < 2 ^ u\"\n  (is \"?high \\<Longrightarrow> _\") for x :: \"'a::len word\"\nproof-\n  assume ?high\n  have size:\"size (mask u :: 'a word) = size x\" by simp\n  {\n    fix i\n    from \\<open>?high\\<close> have \"(x AND mask u) !! i = x !! i\"\n      using nth_mask[of u i] size test_bit_size[of x i]\n      by (subst word_ao_nth) (elim allE[of _ i], auto)\n  }\n  with \\<open>?high\\<close> have \"x AND mask u = x\" using word_eq_iff by blast\n  thus ?thesis unfolding unat_def using mask_eq_iff by auto\nqed\n\nlemma nth_width_msb[simp]: \"x \\<noteq> 0 \\<Longrightarrow> x !! (width x - 1)\"\nproof (rule ccontr)\n  fix x :: \"'a word\"\n  assume \"x \\<noteq> 0\"\n  hence width:\"width x > 0\" using width_zero by fastforce\n  assume \"\\<not> x !! (width x - 1)\"\n  with width have \"\\<forall> i \\<ge> width x - 1. \\<not> x !! i\"\n    using nth_width_high[of x] antisym_conv2 by fastforce\n  hence \"unat x < 2 ^ (width x - 1)\" using high_zeros_less[of \"width x - 1\" x] by simp\n  moreover from width have \"unat x \\<ge> 2 ^ (width x - 1)\" using width_iff[of x \"width x\"] by simp\n  ultimately show False by simp\nqed\n\nlemma width_iff': \"((\\<forall> i > u. \\<not> x !! i) \\<and> x !! u) = (width x = Suc u)\"\nproof (rule; (elim conjE | intro conjI))\n  assume \"x !! u\" and \"\\<forall> i > u. \\<not> x !! i\"\n  show \"width x = Suc u\"\n  proof (rule antisym)\n    from \\<open>x !! u\\<close> show \"width x \\<ge> Suc u\" using not_less nth_width_high by force\n    from \\<open>x !! u\\<close> have \"x \\<noteq> 0\" by auto\n    with \\<open>\\<forall> i > u. \\<not> x !! i\\<close> have \"width x - 1 \\<le> u\" using not_less nth_width_msb by metis\n    thus \"width x \\<le> Suc u\" by simp\n  qed\nnext\n  assume \"width x = Suc u\"\n  show \"\\<forall>i>u. \\<not> x !! i\" by (simp add:\\<open>width x = Suc u\\<close>)\n  from \\<open>width x = Suc u\\<close> show \"x !! u\" using nth_width_msb width_zero\n    by (metis diff_Suc_1 old.nat.distinct(2))\nqed\n\nlemma width_word_log2: \"x \\<noteq> 0 \\<Longrightarrow> width x = Suc (word_log2 x)\"\n  using word_log2_nth_same word_log2_nth_not_set width_iff' test_bit_size\n  by metis\n\nlemma width_ucast[OF refl, simp]: \"uc = ucast \\<Longrightarrow> is_up uc \\<Longrightarrow> width (uc x) = width x\"\n  by (metis uint_up_ucast unat_def width_def)\n\nlemma width_ucast'[OF refl, simp]:\n  \"uc = ucast \\<Longrightarrow> width x \\<le> size (uc x) \\<Longrightarrow> width (uc x) = width x\"\nproof-\n  have \"unat x < 2 ^ width x\" unfolding width_def by (rule LeastI_ex, auto)\n  moreover assume \"width x \\<le> size (uc x)\"\n  ultimately have \"unat x < 2 ^ size (uc x)\" by (simp add: less_le_trans)\n  moreover assume \"uc = ucast\"\n  ultimately have \"unat x = unat (uc x)\" by (metis unat_ucast mod_less word_size)\n  thus ?thesis unfolding width_def by simp\nqed\n\nlemma width_lshift[simp]:\n  \"\\<lbrakk>x \\<noteq> 0; n \\<le> size x - width x\\<rbrakk> \\<Longrightarrow> width (x << n) = width x + n\"\n  (is \"\\<lbrakk>_; ?nbound\\<rbrakk> \\<Longrightarrow> _\")\nproof-\n  assume \"x \\<noteq> 0\"\n  hence 0:\"width x = Suc (width x - 1)\" using width_zero by (metis Suc_pred' neq0_conv)\n  from \\<open>x \\<noteq> 0\\<close> have 1:\"width x > 0\" by (auto intro:gr_zeroI)\n  assume ?nbound\n  {\n    fix i\n    from \\<open>?nbound\\<close> have \"i \\<ge> size x \\<Longrightarrow> \\<not> x !! (i - n)\" by (auto simp add:le_diff_conv2)\n    hence \"(x << n) !! i = (n \\<le> i \\<and> x !! (i - n))\" using nth_shiftl'[of x n i] by auto\n  } note corr = this\n  hence \"\\<forall> i > width x + n - 1. \\<not> (x << n) !! i\" by auto\n  moreover from corr have \"(x << n) !! (width x + n - 1)\"\n    using width_iff'[of \"width x - 1\" x] 1\n    by auto\n  ultimately have \"width (x << n) = Suc (width x + n - 1)\" using width_iff' by auto\n  thus ?thesis using 0 by simp\nqed\n\nlemma width_lshift'[simp]: \"n \\<le> size x - width x \\<Longrightarrow> width (x << n) \\<le> width x + n\"\n  using width_zero width_lshift shiftl_0 by (metis eq_iff le0)\n\nlemma width_or[simp]: \"width (x OR y) = max (width x) (width y)\"\nproof-\n  {\n    fix a b\n    assume \"width x = Suc a\" and \"width y = Suc b\"\n    hence \"width (x OR y) = Suc (max a b)\"\n      using width_iff' word_ao_nth[of x y] max_less_iff_conj[of \"a\" \"b\"]\n      by (metis (no_types) max_def)\n  } note succs = this\n  thus ?thesis\n  proof (cases \"width x = 0 \\<or> width y = 0\")\n    case True\n    thus ?thesis using width_zero word_log_esimps(3,9) by (metis max_0L max_0R)\n  next\n    case False\n    with succs show ?thesis by (metis max_Suc_Suc not0_implies_Suc)\n  qed\nqed\n\nsubsection \\<open>Right zero-padding\\<close>\n\ntext \\<open>\n  Here's the first time we use @{const width}. If @{text x} is a value of size @{text n}\n  right-aligned in a word of size @{text \"s = size x\"} (note there's nowhere to keep the value n,\n  since the size of @{text x} is some @{text \"s \\<ge> n\"}, so we require it to be\n  provided explicitly),\n  then @{text \"rpad n x\"} will move the value @{text x} to the left. For the operation to be\n  correct (no losing of significant higher bits) we need the precondition @{text \"width x \\<le> n\"}\n  in all the lemmas, hence the need for @{const width}.\n\\<close>\n\ndefinition rpad where \"rpad n x \\<equiv> x << size x - n\"\n\nlemma rpad_low[simp]: \"\\<lbrakk>width x \\<le> n; i < size x - n\\<rbrakk> \\<Longrightarrow> \\<not> (rpad n x) !! i\"\n  unfolding rpad_def by (simp add:nth_shiftl)\n\nlemma rpad_high[simp]:\n  \"\\<lbrakk>width x \\<le> n; n \\<le> size x; size x - n \\<le> i\\<rbrakk> \\<Longrightarrow> (rpad n x) !! i = x !! (i + n - size x)\"\n  (is \"\\<lbrakk>?xbound; ?nbound; i \\<ge> ?ibound\\<rbrakk> \\<Longrightarrow> ?goal i\")\nproof-\n  fix i\n  assume ?xbound ?nbound and \"i \\<ge> ?ibound\"\n  moreover from \\<open>?nbound\\<close> have \"i + n - size x = i - ?ibound\" by simp\n  moreover from \\<open>?xbound\\<close> have \"x !! (i + n - size x) \\<Longrightarrow> i < size x\" by - (rule ccontr, simp)\n  ultimately show \"?goal i\" unfolding rpad_def by (subst nth_shiftl', metis)\nqed\n\nlemma rpad_inj: \"\\<lbrakk>width x \\<le> n; width y \\<le> n; n \\<le> size x\\<rbrakk> \\<Longrightarrow> rpad n x = rpad n y \\<Longrightarrow> x = y\"\n  (is \"\\<lbrakk>?xbound; ?ybound; ?nbound; _\\<rbrakk> \\<Longrightarrow> _\")\n  unfolding inj_def word_eq_iff\nproof (intro allI impI)\n  fix i\n  let ?i' = \"i + size x - n\"\n  assume ?xbound ?ybound ?nbound\n  assume \"\\<forall>j < LENGTH('a). rpad n x !! j = rpad n y !! j\"\n  hence \"\\<And> j. rpad n x !! j = rpad n y !! j\" using test_bit_bin by blast\n  from this[of ?i'] and \\<open>?xbound\\<close> \\<open>?ybound\\<close> \\<open>?nbound\\<close> show \"x !! i = y !! i\" by simp\nqed\n\nsubsection \\<open>Spanning concatenation\\<close>\n\nabbreviation ucastl (\"'(ucast')\\<^bsub>_\\<^esub> _\" [1000, 100] 100) where\n  \"(ucast)\\<^bsub>l\\<^esub> a \\<equiv> ucast a :: 'b word\" for l :: \"'b::len0 itself\"\n\nnotation (input) ucastl (\"'(ucast')\\<^sub>_ _\" [1000, 100] 100)\n\ndefinition pad_join :: \"'a::len word \\<Rightarrow> nat \\<Rightarrow> 'c::len itself \\<Rightarrow> 'b::len word \\<Rightarrow> 'c word\"\n  (\"_ \\<^bsub>_\\<^esub>\\<diamond>\\<^bsub>_\\<^esub> _\" [60, 1000, 1000, 61] 60) where\n  \"x \\<^bsub>n\\<^esub>\\<diamond>\\<^bsub>l\\<^esub> y \\<equiv> rpad n (ucast x) OR ucast y\"\n\nnotation (input) pad_join (\"_ \\<^sub>_\\<diamond>\\<^sub>_ _\" [60, 1000, 1000, 61] 60)\n\nlemma pad_join_high:\n  \"\\<lbrakk>width a \\<le> n; n \\<le> size l; width b \\<le> size l - n; size l - n \\<le> i\\<rbrakk>\n   \\<Longrightarrow> (a \\<^sub>n\\<diamond>\\<^sub>l b) !! i = a !! (i + n - size l)\"\n  unfolding pad_join_def\n  using nth_ucast nth_width_high by fastforce\n\nlemma pad_join_high'[simp]:\n  \"\\<lbrakk>width a \\<le> n; n \\<le> size l; width b \\<le> size l - n\\<rbrakk> \\<Longrightarrow> a !! i = (a \\<^sub>n\\<diamond>\\<^sub>l b) !! (i + size l - n)\"\n  using pad_join_high[of a n l b \"i + size l - n\"] by simp\n\nlemma pad_join_mid[simp]:\n  \"\\<lbrakk>width a \\<le> n; n \\<le> size l; width b \\<le> size l - n; width b \\<le> i; i < size l - n\\<rbrakk>\n   \\<Longrightarrow> \\<not> (a \\<^sub>n\\<diamond>\\<^sub>l b) !! i\"\n  unfolding pad_join_def by auto\n\nlemma pad_join_low[simp]:\n  \"\\<lbrakk>width a \\<le> n; n \\<le> size l; width b \\<le> size l - n; i < width b\\<rbrakk> \\<Longrightarrow> (a \\<^sub>n\\<diamond>\\<^sub>l b) !! i = b !! i\"\n  unfolding pad_join_def by (auto simp add: nth_ucast)\n\nlemma pad_join_inj:\n  assumes eq:\"a \\<^sub>n\\<diamond>\\<^sub>l b = c \\<^sub>n\\<diamond>\\<^sub>l d\"\n  assumes a:\"width a \\<le> n\" and c:\"width c \\<le> n\"\n  assumes n: \"n \\<le> size l\"\n  assumes b:\"width b \\<le> size l - n\"\n  assumes d:\"width d \\<le> size l - n\"\n  shows   \"a = c\" and \"b = d\"\nproof-\n  from eq have eq':\"\\<And>j. (a \\<^sub>n\\<diamond>\\<^sub>l b) !! j = (c \\<^sub>n\\<diamond>\\<^sub>l d) !! j\"\n    using test_bit_bin unfolding word_eq_iff by auto\n  moreover from a n b\n  have \"\\<And> i. a !! i = (a \\<^sub>n\\<diamond>\\<^sub>l b) !! (i + size l - n)\" by simp\n  moreover from c n d\n  have \"\\<And> i. c !! i = (c \\<^sub>n\\<diamond>\\<^sub>l d) !! (i + size l - n)\" by simp\n  ultimately show \"a = c\" unfolding word_eq_iff by auto\n\n  {\n    fix i\n    from a n b have \"i < width b \\<Longrightarrow> b !! i = (a \\<^sub>n\\<diamond>\\<^sub>l b) !! i\" by simp\n    moreover from c n d have \"i < width d \\<Longrightarrow> d !! i = (c \\<^sub>n\\<diamond>\\<^sub>l d) !! i\" by simp\n    moreover have \"i \\<ge> width b \\<Longrightarrow> \\<not> b !! i\" and \"i \\<ge> width d \\<Longrightarrow> \\<not> d !! i\" by auto\n    ultimately have \"b !! i = d !! i\"\n      using eq'[of i] b d\n        pad_join_mid[of a n l b i, OF a n b]\n        pad_join_mid[of c n l d i, OF c n d]\n      by (meson leI less_le_trans)\n  }\n  thus \"b = d\" unfolding word_eq_iff by simp\nqed\n\nlemma pad_join_inj'[dest!]:\n \"\\<lbrakk>a \\<^sub>n\\<diamond>\\<^sub>l b = c \\<^sub>n\\<diamond>\\<^sub>l d;\n   width a \\<le> n; width c \\<le> n; n \\<le> size l;\n   width b \\<le> size l - n;\n   width d \\<le> size l - n\\<rbrakk> \\<Longrightarrow> a = c \\<and> b = d\"\n  apply (rule conjI)\n  subgoal by (frule (4) pad_join_inj(1))\n  by (frule (4) pad_join_inj(2))\n\nlemma pad_join_and[simp]:\n  assumes \"width x \\<le> n\" \"n \\<le> m\" \"width a \\<le> m\" \"m \\<le> size l\" \"width b \\<le> size l - m\"\n  shows   \"(a \\<^sub>m\\<diamond>\\<^sub>l b) AND rpad n x = rpad m a AND rpad n x\"\n  unfolding word_eq_iff\nproof ((subst word_ao_nth)+, intro allI impI)\n  from assms have 0:\"n \\<le> size x\" by simp\n  from assms have 1:\"m \\<le> size a\" by simp\n  fix i\n  assume \"i < LENGTH('a)\"\n  from assms show \"((a \\<^bsub>m\\<^esub>\\<diamond>\\<^bsub>l\\<^esub> b) !! i \\<and> rpad n x !! i) = (rpad m a !! i \\<and> rpad n x !! i)\"\n    using rpad_low[of x n i, OF assms(1)] rpad_high[of x n i, OF assms(1) 0]\n          rpad_low[of a m i, OF assms(3)] rpad_high[of a m i, OF assms(3) 1]\n          pad_join_high[of a m l b i, OF assms(3,4,5)]\n          size_itself_def[of l] word_size[of x] word_size[of a]\n    by (metis add.commute add_lessD1 le_Suc_ex le_diff_conv not_le)\nqed\n\nsubsection \\<open>Deal with partially undefined results\\<close>\n\ndefinition restrict :: \"'a::len word \\<Rightarrow> nat set \\<Rightarrow> 'a word\" (infixl \"\\<restriction>\" 60) where\n  \"restrict x s \\<equiv> BITS i. i \\<in> s \\<and> x !! i\"\n\nlemma nth_restrict[iff]: \"(x \\<restriction> s) !! n = (n \\<in> s \\<and> x !! n)\"\n  unfolding restrict_def\n  by (simp add: bang_conj_lt test_bit.eq_norm)\n\nlemma restrict_inj2:\n  assumes eq:\"f x\\<^sub>1 y\\<^sub>1 OR v\\<^sub>1 \\<restriction> s = f x\\<^sub>2 y\\<^sub>2 OR v\\<^sub>2 \\<restriction> s\"\n  assumes fi:\"\\<And> x y i. i \\<in> s \\<Longrightarrow> \\<not> f x y !! i\"\n  assumes inj:\"\\<And> x\\<^sub>1 y\\<^sub>1 x\\<^sub>2 y\\<^sub>2. f x\\<^sub>1 y\\<^sub>1 = f x\\<^sub>2 y\\<^sub>2 \\<Longrightarrow> x\\<^sub>1 = x\\<^sub>2 \\<and> y\\<^sub>1 = y\\<^sub>2\"\n  shows   \"x\\<^sub>1 = x\\<^sub>2 \\<and> y\\<^sub>1 = y\\<^sub>2\"\nproof-\n  from eq and fi have \"f x\\<^sub>1 y\\<^sub>1 = f x\\<^sub>2 y\\<^sub>2\" unfolding word_eq_iff by auto\n  with inj show ?thesis .\nqed\n\nlemma restrict_ucast_inv[simp]:\n  \"\\<lbrakk>a = LENGTH('a); b = LENGTH('b)\\<rbrakk> \\<Longrightarrow> (ucast x OR y \\<restriction> {a..<b}) AND mask a = ucast x\"\n  for x :: \"'a::len word\" and y :: \"'b::len word\"\n  unfolding word_eq_iff\n  by (rewrite nth_ucast word_ao_nth nth_mask nth_restrict test_bit_bin)+ auto\n\nlemmas restrict_inj_pad_join[dest] = restrict_inj2[of \"\\<lambda> x y. x \\<^sub>_\\<diamond>\\<^sub>_ y\"]\n\nsubsection \\<open>Plain concatenation\\<close>\n\ndefinition join :: \"'a::len word \\<Rightarrow> 'c::len itself \\<Rightarrow> nat \\<Rightarrow> 'b::len word \\<Rightarrow> 'c word\"\n  (\"_ \\<^bsub>_\\<^esub>\\<Join>\\<^bsub>_\\<^esub> _\" [62,1000,1000,61] 61) where\n  \"(a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>n\\<^esub> b) \\<equiv> (ucast a << n) OR (ucast b)\"\n\nnotation (input) join (\"_ \\<^sub>_\\<Join>\\<^sub>_ _\" [62,1000,1000,61] 61)\n\nlemma width_join:\n  \"\\<lbrakk>width a + n \\<le> size l; width b \\<le> n\\<rbrakk> \\<Longrightarrow> width (a \\<^sub>l\\<Join>\\<^sub>n b) \\<le> width a + n\"\n  (is \"\\<lbrakk>?abound; ?bbound\\<rbrakk> \\<Longrightarrow> _\")\nproof-\n  assume ?abound and ?bbound\n  moreover hence \"width b \\<le> size l\" by simp\n  ultimately show ?thesis\n    using width_lshift'[of n \"(ucast)\\<^sub>l a\"]\n    unfolding join_def\n    by simp\nqed\n\nlemma width_join'[simp]:\n  \"\\<lbrakk>width a + n \\<le> size l; width b \\<le> n; width a + n \\<le> q\\<rbrakk> \\<Longrightarrow> width (a \\<^sub>l\\<Join>\\<^sub>n b) \\<le> q\"\n  by (drule (1) width_join, simp)\n\nlemma join_high[simp]:\n  \"\\<lbrakk>width a + n \\<le> size l; width b \\<le> n; width a + n \\<le> i\\<rbrakk> \\<Longrightarrow> \\<not> (a \\<^sub>l\\<Join>\\<^sub>n b) !! i\"\n  by (drule (1) width_join, simp)\n\nlemma join_mid:\n  \"\\<lbrakk>width a + n \\<le> size l; width b \\<le> n; n \\<le> i; i < width a + n\\<rbrakk> \\<Longrightarrow> (a \\<^sub>l\\<Join>\\<^sub>n b) !! i = a !! (i - n)\"\n  apply (subgoal_tac \"i < size ((ucast)\\<^sub>l a) \\<and> size ((ucast)\\<^sub>l a) = size l\")\n  unfolding join_def\n  using word_ao_nth nth_ucast nth_width_high nth_shiftl'\n   apply (metis less_imp_diff_less order_trans word_size)\n  by simp\n\nlemma join_mid'[simp]:\n  \"\\<lbrakk>width a + n \\<le> size l; width b \\<le> n\\<rbrakk> \\<Longrightarrow> a !! i = (a \\<^sub>l\\<Join>\\<^sub>n b) !! (i + n)\"\n  using join_mid[of a n l b \"i + n\"] nth_width_high[of a i] join_high[of a n l b \"i + n\"]\n  by force\n\nlemma join_low[simp]:\n  \"\\<lbrakk>width a + n \\<le> size l; width b \\<le> n; i < n\\<rbrakk> \\<Longrightarrow> (a \\<^sub>l\\<Join>\\<^sub>n b) !! i = b !! i\"\n  unfolding join_def\n  by (simp add: nth_shiftl nth_ucast)\n\nlemma join_inj:\n  assumes eq:\"a \\<^sub>l\\<Join>\\<^sub>n b = c \\<^sub>l\\<Join>\\<^sub>n d\"\n  assumes \"width a + n \\<le> size l\" and \"width b \\<le> n\"\n  assumes \"width c + n \\<le> size l\" and \"width d \\<le> n\"\n  shows   \"a = c\" and \"b = d\"\nproof-\n  from assms show \"a = c\" unfolding word_eq_iff using join_mid' eq by metis\n  from assms show \"b = d\" unfolding word_eq_iff using join_low nth_width_high\n    by (metis eq less_le_trans not_le)\nqed\n\nlemma join_inj'[dest!]:\n  \"\\<lbrakk>a \\<^sub>l\\<Join>\\<^sub>n b = c \\<^sub>l\\<Join>\\<^sub>n d;\n    width a + n \\<le> size l; width b \\<le> n;\n    width c + n \\<le> size l; width d \\<le> n\\<rbrakk> \\<Longrightarrow> a = c \\<and> b = d\"\n  apply (rule conjI)\n  subgoal by (frule (4) join_inj(1))\n  by (frule (4) join_inj(2))\n\nlemma join_and:\n  assumes \"width x \\<le> n\" \"n \\<le> size l\" \"k \\<le> size l\" \"m \\<le> k\"\n          \"n \\<le> k - m\" \"width a \\<le> k - m\" \"width a + m \\<le> k\" \"width b \\<le> m\"\n  shows   \"rpad k (a \\<^sub>l\\<Join>\\<^sub>m b) AND rpad n x = rpad (k - m) a AND rpad n x\"\n  unfolding word_eq_iff\nproof ((subst word_ao_nth)+, intro allI impI)\n  from assms have 0:\"n \\<le> size x\" by simp\n  from assms have 1:\"k - m \\<le> size a\" by simp\n  from assms have 2:\"width (a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b) \\<le> k\" by simp\n  from assms have 3:\"k \\<le> size (a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b)\" by simp\n  from assms have 4:\"width a + m \\<le> size l\" by simp\n  fix i\n  assume \"i < LENGTH('a)\"\n  moreover with assms have \"i + k - size (a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b) - m = i + (k - m) - size a\" by simp\n  moreover from assms have \"i + k - size (a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b) < m \\<Longrightarrow> i < size x - n\" by simp\n  moreover from assms have\n    \"\\<lbrakk>i \\<ge> size l - k; m \\<le> i + k - size (a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b)\\<rbrakk> \\<Longrightarrow> size a - (k - m) \\<le> i\" by simp\n  moreover from assms have \"width a + m \\<le> i + k - size (a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b) \\<Longrightarrow> \\<not> rpad (k - m) a !! i\"\n    by (simp add: nth_shiftl' rpad_def)\n  moreover from assms have \"\\<not> i \\<ge> size l - k \\<Longrightarrow> i < size x - n\" by simp\n  ultimately show \"(rpad k (a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b) !! i \\<and> rpad n x !! i) =\n                   (rpad (k - m) a !! i \\<and> rpad n x !! i)\"\n    using assms\n          rpad_high[of x n i, OF assms(1) 0] rpad_low[of x n i, OF assms(1)]\n          rpad_high[of a \"k - m\" i, OF assms(6) 1] rpad_low[of a \"k - m\" i, OF assms(6)]\n          rpad_high[of \"a \\<^sub>l\\<Join>\\<^sub>m b\" k i, OF 2 3] rpad_low[of \"a \\<^sub>l\\<Join>\\<^sub>m b\" k i, OF 2]\n          join_high[of a m l b \"i + k - size (a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b)\", OF 4 assms(8)]\n          join_mid[of a m l b \"i + k - size (a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b)\", OF 4 assms(8)]\n          join_low[of a m l b \"i + k - size (a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b)\", OF 4 assms(8)]\n          size_itself_def[of l] word_size[of x] word_size[of a] word_size[of \"a \\<^bsub>l\\<^esub>\\<Join>\\<^bsub>m\\<^esub> b\"]\n    by (metis not_le)\nqed\n\nlemma join_and'[simp]:\n   \"\\<lbrakk>width x \\<le> n; n \\<le> size l; k \\<le> size l; m \\<le> k;\n     n \\<le> k - m; width a \\<le> k - m; width a + m \\<le> k; width b \\<le> m\\<rbrakk> \\<Longrightarrow>\n    rpad k (a \\<^sub>l\\<Join>\\<^sub>m b) AND rpad n x = rpad (k - m) (ucast a) AND rpad n x\"\n  using join_and[of x n l k m \"ucast a\" b] unfolding join_def\n  by (simp add: ucast_id)\n\nsection \\<open>Data formats\\<close>\n\ntext \\<open>This section contains definitions of various data formats used in the specification.\\<close>\n\nsubsection \\<open>Common notation\\<close>\n\ntext \\<open>Before we proceed some common notation that would be used later will be established.\\<close>\n\nsubsubsection \\<open>Machine words\\<close>\n\ntext \\<open>Procedure keys are represented as 24-byte (192 bits) machine words.\\<close>\n\ntype_synonym word24 = \"192 word\" \\<comment> \\<open>24 bytes\\<close>\ntype_synonym key = word24\n\ntext \\<open>Byte is 8-bit machine word.\\<close>\ntype_synonym byte = \"8 word\"\n\ntext \\<open>32-byte machine words that are used to model keys and values of the storage.\\<close>\ntype_synonym word32 = \"256 word\" \\<comment> \\<open>32 bytes\\<close>\n\ntext \\<open>\n  Storage is a function that takes a 32-byte word (key) and returns another\n  32-byte word (value).\n\\<close>\ntype_synonym storage = \"word32 \\<Rightarrow> word32\"\n\nsubsubsection \\<open>Concatenation operations\\<close>\n\ntext \\<open>\n  Specialize previously defined general concatenation operations for the fixed result size of\n  32 bytes. Thus we avoid lots of redundant type annotations for every intermediate result\n  (note that these intermediate types cannot be inferred automatically\n  (in a purely Hindley-Milner setting as in Isabelle),\n  because this would require type-level functions/dependent types).\n\\<close>\n\nabbreviation \"len (_ :: 'a::len word itself) \\<equiv> TYPE('a)\"\n\nno_notation join  (\"_ \\<^bsub>_\\<^esub>\\<Join>\\<^bsub>_\\<^esub> _\" [62,1000,1000,61] 61)\nno_notation (input) join (\"_ \\<^sub>_\\<Join>\\<^sub>_ _\" [62,1000,1000,61] 61)\n\nabbreviation join32 (\"_ \\<Join>\\<^bsub>_\\<^esub> _\" [62,1000,61] 61) where\n  \"a \\<Join>\\<^bsub>n\\<^esub> b \\<equiv> join a (len TYPE(word32)) (n * 8) b\"\nabbreviation (output) join32_out (\"_ \\<Join>\\<^bsub>_\\<^esub> _\" [62,1000,61] 61) where\n  \"join32_out a n b \\<equiv> join a (TYPE(256)) n b\"\nnotation (input) join32 (\"_ \\<Join>\\<^sub>_ _\" [62,1000,61] 61)\n\nno_notation pad_join  (\"_ \\<^bsub>_\\<^esub>\\<diamond>\\<^bsub>_\\<^esub> _\" [60,1000,1000,61] 60)\nno_notation (input) pad_join (\"_ \\<^sub>_\\<diamond>\\<^sub>_ _\" [60,1000,1000,61] 60)\n\nabbreviation pad_join32 (\"_ \\<^bsub>_\\<^esub>\\<diamond> _\" [60,1000,61] 60) where\n  \"a \\<^bsub>n\\<^esub>\\<diamond> b \\<equiv> pad_join a (n * 8) (len TYPE(word32)) b\"\nabbreviation (output) pad_join32_out (\"_ \\<^bsub>_\\<^esub>\\<diamond> _\" [60,1000,61] 60) where\n  \"pad_join32_out a n b \\<equiv> pad_join a n (TYPE(256)) b\"\nnotation (input) pad_join32 (\"_ \\<^sub>_\\<diamond> _\" [60,1000,61] 60)\n\ntext \\<open>\n  Override treatment of hexidecimal numeric constants to make them monomorphic words of\n  fixed length, mimicking the notation used in the informal specification (e.g. @{term \"0x01\"})\n  is always a word 1 byte long and is not, say, the natural number one). Otherwise, again, lots\n  of redundant type annotations would arise.\n\\<close>\n\nparse_ast_translation \\<open>\n  let\n    open Ast\n    fun mk_numeral t = mk_appl (Constant @{syntax_const \"_Numeral\"}) t\n    fun mk_word_numeral num t =\n      if String.isPrefix \"0x\" num then\n        mk_appl (Constant @{syntax_const \"_constrain\"})\n          [mk_numeral t,\n           mk_appl (Constant @{type_syntax \"word\"})\n             [mk_appl (Constant @{syntax_const \"_NumeralType\"})\n             [Variable (4 * (size num - 2) |> string_of_int)]]]\n      else\n        mk_numeral t\n    fun numeral_ast_tr ctxt (t as [Appl [Constant @{syntax_const \"_constrain\"},\n                                         Constant num,\n                                         _]])\n                                                  = mk_word_numeral num t\n      | numeral_ast_tr ctxt (t as [Constant num]) = mk_word_numeral num t\n      | numeral_ast_tr _ t                        = mk_numeral t\n      | numeral_ast_tr _ t                        = raise AST (@{syntax_const \"_Numeral\"}, t)\n  in\n     [(@{syntax_const \"_Numeral\"}, numeral_ast_tr)]\n  end\n\\<close>\n\nsubsection \\<open>Datatypes\\<close>\n\ntext \\<open>\n  Introduce generic notation for mapping of various entities into high-level and low-level\n  representations. A high-level representation of an entity @{text e} would be written as\n  @{text \"\\<lceil>e\\<rceil>\"} and a low-level as @{text \"\\<lfloor>e\\<rfloor>\"} accordingly. Using a high-level representation it is\n  easier to express and proof some properties and invariants, but some of them can be expressed only\n  using a low-level representation.\n\n  We use adhoc overloading to use the same notation for various types of entities (indices, offsets,\n  addresses, capabilities etc.).\n\\<close>\n\nno_notation floor (\"\\<lfloor>_\\<rfloor>\")\n\nconsts rep :: \"'a \\<Rightarrow> 'b\" (\"\\<lfloor>_\\<rfloor>\")\n\nno_notation ceiling (\"\\<lceil>_\\<rceil>\")\n\nconsts abs :: \"'a \\<Rightarrow> 'b\" (\"\\<lceil>_\\<rceil>\")\n\nsubsubsection \\<open>Deterministic inverse functions\\<close>\n\ndefinition \"maybe_inv f y \\<equiv> if y \\<in> range f then Some (the_inv f y) else None\"\n\nlemma maybe_inv_inj[intro]: \"inj f \\<Longrightarrow> maybe_inv f (f x) = Some x\"\n  unfolding maybe_inv_def\n  by (auto simp add:inj_def the_inv_f_f)\n\nlemma maybe_inv_inj'[dest]: \"\\<lbrakk>inj f; maybe_inv f y = Some x\\<rbrakk> \\<Longrightarrow> f x = y\"\n  unfolding maybe_inv_def\n  by (auto intro:f_the_inv_into_f simp add:inj_def split:if_splits)\n\nlocale invertible =\n  fixes rep :: \"'a \\<Rightarrow> 'b\" (\"\\<lfloor>_\\<rfloor>\")\n  assumes inj:\"inj rep\"\nbegin\ndefinition inv :: \"'b \\<Rightarrow> 'a option\" where \"inv \\<equiv> maybe_inv rep\"\n\nlemmas inv_inj[folded inv_def, simp] = maybe_inv_inj[OF inj]\n\nlemmas inv_inj'[folded inv_def, dest] = maybe_inv_inj'[OF inj]\nend\n\ndefinition \"range2 f \\<equiv> {y. \\<exists>x\\<^sub>1 \\<in> UNIV. \\<exists> x\\<^sub>2 \\<in> UNIV. y = f x\\<^sub>1 x\\<^sub>2}\"\n\ndefinition \"the_inv2 f \\<equiv> \\<lambda> x. THE y. \\<exists> y'. f y y' = x\"\n\ndefinition \"maybe_inv2 f y \\<equiv> if y \\<in> range2 f then Some (the_inv2 f y) else None\"\n\ndefinition \"inj2 f \\<equiv> \\<forall> x\\<^sub>1 x\\<^sub>2 y\\<^sub>1 y\\<^sub>2. f x\\<^sub>1 y\\<^sub>1 = f x\\<^sub>2 y\\<^sub>2 \\<longrightarrow> x\\<^sub>1 = x\\<^sub>2\"\n\nlemma inj2I: \"(\\<And> x\\<^sub>1 x\\<^sub>2 y\\<^sub>1 y\\<^sub>2. f x\\<^sub>1 y\\<^sub>1 = f x\\<^sub>2 y\\<^sub>2 \\<Longrightarrow> x\\<^sub>1 = x\\<^sub>2) \\<Longrightarrow> inj2 f\" unfolding inj2_def\n  by blast\n\nlemma maybe_inv2_inj[intro]: \"inj2 f \\<Longrightarrow> maybe_inv2 f (f x y) = Some x\"\n  unfolding maybe_inv2_def the_inv2_def inj2_def range2_def\n  by (simp split:if_splits, blast)\n\nlemma maybe_inv2_inj'[dest]:\n  \"\\<lbrakk>inj2 f; maybe_inv2 f y = Some x\\<rbrakk> \\<Longrightarrow> \\<exists> y'. f x y' = y\"\n  unfolding maybe_inv2_def the_inv2_def range2_def inj2_def\n  by (force split:if_splits intro:theI)\n\nlocale invertible2 =\n  fixes rep :: \"'a \\<Rightarrow> 'c \\<Rightarrow> 'c\" (\"\\<lfloor>_\\<rfloor>\")\n  assumes inj:\"inj2 rep\"\nbegin\ndefinition inv2 :: \"'c \\<Rightarrow> 'a option\" where \"inv2 \\<equiv> maybe_inv2 rep\"\n\nlemmas inv2_inj[folded inv2_def, simp] = maybe_inv2_inj[OF inj]\n\nlemmas inv2_inj'[folded inv_def, dest] = maybe_inv2_inj'[OF inj]\nend\n\nsubsubsection \\<open>Capability\\<close>\n\ntext \\<open>\n  Introduce capability type. Note that we don't include @{text Null} capability into it.\n  @{text Null} is only handled specially inside the call delegation, otherwise it only complicates\n  the proofs with side additional cases.\n\n  There will be separate type @{text call} defined as @{text \"capability option\"} to respect\n  the fact that in some places it can indeed be @{text Null}.\n\\<close>\n\ndatatype capability =\n    Call\n  | Reg\n  | Del\n  | Entry\n  | Write\n  | Log\n  | Send\n\ntext \\<open>\n  In general, in the following we strive to make all encoding functions injective without any\n  preconditions. All the necessary invariants are built into the type definitions.\n\n  Capability representation would be its assigned number.\n\\<close>\n\ndefinition cap_type_rep :: \"capability \\<Rightarrow> byte\" where\n  \"cap_type_rep c \\<equiv> case c of\n      Call  \\<Rightarrow> 0x03\n    | Reg   \\<Rightarrow> 0x04\n    | Del   \\<Rightarrow> 0x05\n    | Entry \\<Rightarrow> 0x06\n    | Write \\<Rightarrow> 0x07\n    | Log   \\<Rightarrow> 0x08\n    | Send  \\<Rightarrow> 0x09\"\n\nadhoc_overloading rep cap_type_rep\n\ntext \\<open>\n  Capability representation range from @{text 3} to @{text 9} since @{text Null} is not included\n  and @{text 2} does not exist.\n\\<close>\n\nlemma cap_type_rep_rng[simp]: \"\\<lfloor>c\\<rfloor> \\<in> {0x03..0x09}\" for c :: capability\n  unfolding cap_type_rep_def by (simp split:capability.split)\n\ntext \\<open>Capability representation is injective.\\<close>\n\nlemma cap_type_rep_inj[dest]: \"\\<lfloor>c\\<^sub>1\\<rfloor> = \\<lfloor>c\\<^sub>2\\<rfloor> \\<Longrightarrow> c\\<^sub>1 = c\\<^sub>2\" for c\\<^sub>1 c\\<^sub>2 :: capability\n  unfolding cap_type_rep_def\n  by (simp split:capability.splits)\n\ntext \\<open>@{text 4} bits is sufficient to store a capability number.\\<close>\n\nlemma width_cap_type: \"width \\<lfloor>c\\<rfloor> \\<le> 4\" for c :: capability\nproof (rule ccontr, drule not_le_imp_less)\n  assume \"4 < width \\<lfloor>c\\<rfloor>\"\n  moreover hence \"\\<lfloor>c\\<rfloor> !! (width \\<lfloor>c\\<rfloor> - 1)\" using nth_width_msb by force\n  ultimately obtain n where \"\\<lfloor>c\\<rfloor> !! n\" and \"n \\<ge> 4\" by (metis le_step_down_nat nat_less_le)\n  thus False unfolding cap_type_rep_def by (simp split:capability.splits)\nqed\n\ntext \\<open>So, any number greater than or equal to @{text 4} will be enough.\\<close>\n\nlemma width_cap_type'[simp]: \"4 \\<le> n \\<Longrightarrow> width \\<lfloor>c\\<rfloor> \\<le> n\" for c :: capability\n  using width_cap_type[of c] by simp\n\ntext \\<open>Capability representation can't be zero.\\<close>\n\nlemma cap_type_nonzero[simp]: \"\\<lfloor>c\\<rfloor> \\<noteq> 0\" for c :: capability\n  unfolding cap_type_rep_def by (simp split:capability.splits)\n\nsubsubsection \\<open>Capability index\\<close>\n\ntext \\<open>Introduce capability index type that is a natural number in range from 0 to 254.\\<close>\n\ntypedef capability_index = \"{i :: nat. i < 2 ^ LENGTH(byte) - 1}\"\n  morphisms cap_index_rep' cap_index\n  by (intro exI[of _ \"0\"], simp)\n\nadhoc_overloading rep cap_index_rep'\n\nadhoc_overloading abs cap_index\n\ntext \\<open>\n  Capability index representation is a byte. Zero byte is reserved, so capability index\n  representation starts with 1.\n\\<close>\n\ndefinition \"cap_index_rep i \\<equiv> of_nat (\\<lfloor>i\\<rfloor> + 1) :: byte\" for i :: capability_index\n\nadhoc_overloading rep cap_index_rep\n\ntext \\<open>\n  A single byte is sufficient to store the least number of bits of capability index representation.\n\\<close>\n\nlemma width_cap_index: \"width \\<lfloor>i\\<rfloor> \\<le> LENGTH(byte)\" for i :: capability_index by simp\n\nlemma width_cap_index'[simp]: \"LENGTH(byte) \\<le> n \\<Longrightarrow> width \\<lfloor>i\\<rfloor> \\<le> n\"\n  for i :: capability_index by simp\n\ntext \\<open>Capability index representation can't be zero byte.\\<close>\n\nlemma cap_index_nonzero[simp]: \"\\<lfloor>i\\<rfloor> \\<noteq> 0x00\" for i :: capability_index\n  unfolding cap_index_rep_def using cap_index_rep'[of i] of_nat_neq_0[of \"Suc \\<lfloor>i\\<rfloor>\"]\n  by force\n\ntext \\<open>Capability index representation is injective.\\<close>\n\nlemma cap_index_inj[dest]: \"(\\<lfloor>i\\<^sub>1\\<rfloor> :: byte) = \\<lfloor>i\\<^sub>2\\<rfloor> \\<Longrightarrow> i\\<^sub>1 = i\\<^sub>2\" for i\\<^sub>1 i\\<^sub>2 :: capability_index\n  unfolding cap_index_rep_def\n  using cap_index_rep'[of i\\<^sub>1] cap_index_rep'[of i\\<^sub>2] word_of_nat_inj[of \"\\<lfloor>i\\<^sub>1\\<rfloor>\" \"\\<lfloor>i\\<^sub>2\\<rfloor>\"]\n        cap_index_rep'_inject\n  by force\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas cap_index_invertible[intro] = invertible.intro[OF injI, OF cap_index_inj]\n\ninterpretation cap_index_inv: invertible cap_index_rep ..\n\nadhoc_overloading abs cap_index_inv.inv\n\nsubsubsection \\<open>Capability offset\\<close>\n\ntext \\<open>The following datatype specifies data offsets for addresses in the procedure heap.\\<close>\n\ntype_synonym capability_offset = byte\n\ndatatype data_offset =\n  Addr\n  | Index\n  | Ncaps capability\n  | Cap capability capability_index capability_offset\n\n\ntext \\<open>\n  Machine word representation of data offsets. Using these offsets the following data can be\n  obtained:\n  \\begin{itemize}\n    \\item @{text Addr}: procedure Ethereum address;\n    \\item @{text Index}: procedure index;\n    \\item @{text \"Ncaps ty\"}: the number of capabilities of type @{text \"ty\"};\n    \\item @{text \"Cap ty i off\"}: capability of type @{text \"ty\"}, with index @{text \"ty\"} and\n          offset @{text \"off\"} into that capability.\n  \\end{itemize}\n\\<close>\n\ndefinition data_offset_rep :: \"data_offset \\<Rightarrow> word32\" where\n \"data_offset_rep off \\<equiv> case off of\n     Addr         \\<Rightarrow> 0x00  \\<Join>\\<^sub>2 0x00  \\<Join>\\<^sub>1  0x00\n   | Index        \\<Rightarrow> 0x00  \\<Join>\\<^sub>2 0x00  \\<Join>\\<^sub>1  0x01\n   | Ncaps ty     \\<Rightarrow> \\<lfloor>ty\\<rfloor>  \\<Join>\\<^sub>2 0x00  \\<Join>\\<^sub>1  0x00\n   | Cap ty i off \\<Rightarrow> \\<lfloor>ty\\<rfloor>  \\<Join>\\<^sub>2 \\<lfloor>i\\<rfloor>   \\<Join>\\<^sub>1  off\"\n\nadhoc_overloading rep data_offset_rep\n\ntext \\<open>Data offset representation is injective.\\<close>\n\nlemma data_offset_inj[dest]:\n  \"\\<lfloor>d\\<^sub>1\\<rfloor> = \\<lfloor>d\\<^sub>2\\<rfloor> \\<Longrightarrow> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: data_offset\n  unfolding data_offset_rep_def\n  by (auto split:data_offset.splits)\n\ntext \\<open>Least number of bytes to hold the current value of a data offset is @{text 3}.\\<close>\n\nlemma width_data_offset: \"width \\<lfloor>d\\<rfloor> \\<le> 3 * LENGTH(byte)\" for d :: data_offset\n  unfolding data_offset_rep_def\n  by (simp split:data_offset.splits)\n\nlemma width_data_offset'[simp]: \"3 * LENGTH(byte) \\<le> n \\<Longrightarrow> width \\<lfloor>d\\<rfloor> \\<le> n\" for d :: data_offset\n  using width_data_offset[of d] by simp\n\nsubsubsection \\<open>Kernel storage address\\<close>\n\ntext \\<open>\n  Type definition for procedure indices. A procedure index is represented as a natural number that\n  is smaller then @{text \"2\\<^sup>1\\<^sup>9\\<^sup>2 - 1\"}. It can be zero here, to simplify its future use as an array\n  index, but its low-level representation will start from @{text 1}.\n\\<close>\ntypedef key_index = \"{i :: nat. i < 2 ^ LENGTH(key) - 1}\" morphisms key_index_rep' key_index\n  by (rule exI[of _ \"0\"], simp)\n\nadhoc_overloading rep key_index_rep'\n\nadhoc_overloading abs key_index\n\ntext \\<open>Introduce address datatype that describes possible addresses in the kernel storage.\\<close>\n\ndatatype address =\n   Heap_proc key data_offset\n  | Nprocs\n  | Proc_key key_index\n  | Kernel\n  | Curr_proc\n  | Entry_proc\n\ntext \\<open>Low-level representation of a procedure index is a machine word that starts from @{text 1}.\\<close>\n\ndefinition \"key_index_rep i \\<equiv> of_nat (\\<lfloor>i\\<rfloor> + 1) :: key\" for i :: key_index\n\nadhoc_overloading rep key_index_rep\n\ntext \\<open>Proof that low-level representation can't be @{text 0}.\\<close>\n\nlemma key_index_nonzero[simp]: \"\\<lfloor>i\\<rfloor> \\<noteq> (0 :: key)\" for i :: key_index\n  unfolding key_index_rep_def using key_index_rep'[of i]\n  by (intro of_nat_neq_0, simp_all)\n\ntext \\<open>Low-level representation is injective.\\<close>\n\nlemma key_index_inj[dest]: \"(\\<lfloor>i\\<^sub>1\\<rfloor> :: key) = \\<lfloor>i\\<^sub>2\\<rfloor> \\<Longrightarrow> i\\<^sub>1 = i\\<^sub>2\" for i :: key_index\n  unfolding key_index_rep_def using key_index_rep'[of i\\<^sub>1] key_index_rep'[of i\\<^sub>2]\n  by (simp add:key_index_rep'_inject of_nat_inj)\n\ntext \\<open>Address prefix for all addresses that belong to the kernel storage.\\<close>\n\nabbreviation \"kern_prefix \\<equiv> 0xffffffff\"\n\ntext \\<open>\n  Machine word representation of the kernel storage layout, which consists of the following\n  addresses:\n  \\begin{itemize}\n    \\item @{text \"Heap_proc k offs\"}: procedure heap of key @{text k} and data offset @{text offs};\n    \\item @{text Nprocs}: number of procedures;\n    \\item @{text \"Proc_key i\"}: a procedure with index @{text i} in the procedure list;\n    \\item @{text Kernel}: kernel Ethereum address;\n    \\item @{text Curr_proc}: current procedure;\n    \\item @{text Entry_proc}: entry procedure.\n  \\end{itemize}\n\\<close>\n\ndefinition addr_rep :: \"address \\<Rightarrow> word32\" where\n  \"addr_rep a \\<equiv> case a of\n    Heap_proc k offs \\<Rightarrow> kern_prefix \\<Join>\\<^sub>1 0x00 \\<^sub>5\\<diamond> k          \\<Join>\\<^sub>3 \\<lfloor>offs\\<rfloor>\n  | Nprocs           \\<Rightarrow> kern_prefix \\<Join>\\<^sub>1 0x01 \\<^sub>5\\<diamond> (0 :: key) \\<Join>\\<^sub>3 0x000000\n  | Proc_key i       \\<Rightarrow> kern_prefix \\<Join>\\<^sub>1 0x01 \\<^sub>5\\<diamond> \\<lfloor>i\\<rfloor>        \\<Join>\\<^sub>3 0x000000\n  | Kernel           \\<Rightarrow> kern_prefix \\<Join>\\<^sub>1 0x02 \\<^sub>5\\<diamond> (0 :: key) \\<Join>\\<^sub>3 0x000000\n  | Curr_proc        \\<Rightarrow> kern_prefix \\<Join>\\<^sub>1 0x03 \\<^sub>5\\<diamond> (0 :: key) \\<Join>\\<^sub>3 0x000000\n  | Entry_proc       \\<Rightarrow> kern_prefix \\<Join>\\<^sub>1 0x04 \\<^sub>5\\<diamond> (0 :: key) \\<Join>\\<^sub>3 0x000000\"\n\nadhoc_overloading rep addr_rep\n\ntext \\<open>Kernel storage address representation is injective.\\<close>\n\nlemma addr_inj[dest]: \"\\<lfloor>a\\<^sub>1\\<rfloor> = \\<lfloor>a\\<^sub>2\\<rfloor> \\<Longrightarrow> a\\<^sub>1 = a\\<^sub>2\" for a\\<^sub>1 a\\<^sub>2 :: address\n  unfolding addr_rep_def\n  by (split address.splits) (force split:address.splits)+\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas addr_invertible[intro] = invertible.intro[OF injI, OF addr_inj]\n\ninterpretation addr_inv: invertible addr_rep ..\n\nadhoc_overloading abs addr_inv.inv\n\ntext \\<open>Lowest address of the kernel storage (0xffffffff0000...).\\<close>\n\nabbreviation \"prefix_bound \\<equiv> rpad (size kern_prefix) (ucast kern_prefix :: word32)\"\n\nlemma prefix_bound: \"unat prefix_bound < 2 ^ LENGTH(word32)\" unfolding rpad_def by simp\n\nlemma prefix_bound'[simplified, simp]: \"x \\<le> unat prefix_bound \\<Longrightarrow> x < 2 ^ LENGTH(word32)\"\n  using prefix_bound by simp\n\ntext \\<open>All addresses in the kernel storage are indeed start with the kernel prefix (0xffffffff).\\<close>\n\nlemma addr_prefix[simp, intro]: \"limited_and prefix_bound \\<lfloor>a\\<rfloor>\" for a :: address\n  unfolding limited_and_def addr_rep_def\n  by (subst word_bw_comms) (auto split:address.split simp del:ucast_bintr)\n\nsubsection \\<open>Capability formats\\<close>\n\ntext \\<open>\n  We define capability format generally as a @{text locale}. It has two parameters: first one is a\n  @{text \"subset\"} function (denoted as @{text \"\\<subseteq>\\<^sub>c\"}), and second one is a @{text \"set_of\"} function,\n  which maps a capability to its high-level representation that is expressed as a set.\n  We have an assumption that  @{text \"Capability A\"} is a subset of @{text \"Capability B\"} if and\n  only if their high-level representations are also subsets of each other.\n  We call it the well-definedness assumption (denoted as wd) and using it we can prove abstractly\n  that such generic capability format satisfies the properties of reflexivity and transitivity.\n\n  Then using this locale we can prove that capability formats of all available system calls\n  satisfy the properties of reflexivity and transitivity simply by formalizing corresponding\n  @{text \"subset\"} and @{text \"set_of\"} functions and then proving the well-definedness assumption.\n  This process is called locale interpretation.\n\\<close>\n\nno_notation abs (\"\\<lceil>_\\<rceil>\")\n\nlocale cap_sub =\n  fixes set_of :: \"'a \\<Rightarrow> 'b set\" (\"\\<lceil>_\\<rceil>\")\n  fixes sub :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\" (\"(_/ \\<subseteq>\\<^sub>c _)\" [51, 51] 50)\n  assumes wd:\"a \\<subseteq>\\<^sub>c b = (\\<lceil>a\\<rceil> \\<subseteq> \\<lceil>b\\<rceil>)\" begin\n\nlemma sub_refl: \"a \\<subseteq>\\<^sub>c a\" using wd by auto\n\nlemma sub_trans: \"\\<lbrakk>a \\<subseteq>\\<^sub>c b; b \\<subseteq>\\<^sub>c c\\<rbrakk> \\<Longrightarrow> a \\<subseteq>\\<^sub>c c\" using wd by blast\nend\n\nnotation abs (\"\\<lceil>_\\<rceil>\")\n\nconsts sub :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\" (\"(_/ \\<subseteq>\\<^sub>c _)\" [51, 51] 50)\n\nsubsubsection \\<open>Call, Register and Delete capabilities\\<close>\n\ntext \\<open>\n  Call, Register and Delete capabilities have the same format, so we combine them together here.\n  The capability format defines a range of procedure keys that the capability allows one\n  to call. This is defined as a base procedure key and a prefix.\n\n  Prefix is defined as a natural number, whose length is bounded by a maximum length of a procedure\n  key.\n\\<close>\n\ntypedef prefix_size = \"{n :: nat. n \\<le> LENGTH(key)}\"\n  morphisms prefix_size_rep' prefix_size\n  by auto\n\nadhoc_overloading rep prefix_size_rep'\n\ntext \\<open>Low-level representation of a prefix is a 8-bit machine word (or simply a byte).\\<close>\n\ndefinition \"prefix_size_rep s \\<equiv> of_nat \\<lfloor>s\\<rfloor> :: byte\" for s :: prefix_size\n\nadhoc_overloading rep prefix_size_rep\n\ntext \\<open>Prefix representation is injective.\\<close>\n\nlemma prefix_size_inj[dest]: \"(\\<lfloor>s\\<^sub>1\\<rfloor> :: byte) = \\<lfloor>s\\<^sub>2\\<rfloor> \\<Longrightarrow> s\\<^sub>1 = s\\<^sub>2\" for s\\<^sub>1 s\\<^sub>2 :: prefix_size\n  unfolding prefix_size_rep_def using prefix_size_rep'[of s\\<^sub>1] prefix_size_rep'[of s\\<^sub>2]\n  by (simp add:prefix_size_rep'_inject of_nat_inj)\n\ntext \\<open>\n  Any number that is greater or equal to a maximum length of a procedure key is greater or equal\n  to any procedure index.\n\\<close>\n\nlemma prefix_size_rep_less[simp]: \"LENGTH(key) \\<le> n \\<Longrightarrow> \\<lfloor>s\\<rfloor> \\<le> (n :: nat)\" for s :: prefix_size\n  using prefix_size_rep'[of s] by simp\n\ntext \\<open>\n  Capabilities that have the same format based on prefixes we call \"prefixed\". Type of prefixed\n  capabilities is defined as a direct product of prefixes and procedure keys.\n\\<close>\n\ntype_synonym prefixed_capability = \"prefix_size \\<times> key\"\n\ntext \\<open>\n  High-level representation of a prefixed capability is a set of all procedure keys whose first\n  @{text s} number of bits (specified by the prefix) are the same as the first @{text s} number of\n  bits of the base procedure key @{text k}.\n\\<close>\n\ndefinition\n  \"set_of_pref_cap sk \\<equiv> let (s, k) = sk in {k' :: key. take \\<lfloor>s\\<rfloor> (to_bl k') = take \\<lfloor>s\\<rfloor> (to_bl k)}\"\n  for sk :: prefixed_capability\n\nadhoc_overloading abs set_of_pref_cap\n\ntext \\<open>\n  A prefixed capability A is a subset of a prefixed capability B if:\n  \\begin{itemize}\n    \\item the prefix size of A is equal to or greater than the prefix size of B;\n    \\item the first s bits (specified by the prefix size of B) of the base procedure of A is equal\n          to the first s bits of the base procedure of B.\n  \\end{itemize}\n\\<close>\n\ndefinition \"pref_cap_sub A B \\<equiv>\n  let (s\\<^sub>A, k\\<^sub>A) = A; (s\\<^sub>B, k\\<^sub>B) = B in\n  (\\<lfloor>s\\<^sub>A\\<rfloor> :: nat) \\<ge> \\<lfloor>s\\<^sub>B\\<rfloor> \\<and> take \\<lfloor>s\\<^sub>B\\<rfloor> (to_bl k\\<^sub>A) = take \\<lfloor>s\\<^sub>B\\<rfloor> (to_bl k\\<^sub>B)\"\n  for A B :: prefixed_capability\n\nadhoc_overloading sub pref_cap_sub\n\ntext \\<open>\n  Auxiliary lemma: if first @{text n} elements of lists @{text a} and @{text b} are equal, and the\n  number @{text i} is smaller than @{text n}, then the @{text ith} elements of both lists are\n  also equal.\n\\<close>\n\nlemma nth_take_i[dest]: \"\\<lbrakk>take n a = take n b; i < n\\<rbrakk> \\<Longrightarrow> a ! i = b ! i\"\n  by (metis nth_take)\n\nlemma take_less_diff:\n  fixes l' l'' :: \"'a list\"\n  assumes ex:\"\\<And> u :: 'a. \\<exists> u'. u' \\<noteq> u\"\n  assumes \"n < m\"\n  assumes \"length l' = length l''\"\n  assumes \"n \\<le> length l'\"\n  assumes \"m \\<le> length l'\"\n  obtains l where\n      \"length l = length l'\"\n  and \"take n l = take n l'\"\n  and \"take m l \\<noteq> take m l''\"\nproof-\n  let ?x = \"l'' ! n\"\n  from ex obtain y where neq:\"y \\<noteq> ?x\" by auto\n  let ?l = \"take n l' @ y # drop (n + 1) l'\"\n  from assms have 0:\"n = length (take n l') + 0\" by simp\n  from assms have \"take n ?l = take n l'\" by simp\n  moreover from assms and neq have \"take m ?l \\<noteq> take m l''\"\n    using 0 nth_take_i nth_append_length\n    by (metis add.right_neutral)\n  moreover have \"length ?l = length l'\" using assms by auto\n  ultimately show ?thesis using that by blast\nqed\n\ntext \\<open>Prove the well-definedness assumption for the prefixed capability format.\\<close>\n\nlemma pref_cap_sub_iff[iff]: \"a \\<subseteq>\\<^sub>c b = (\\<lceil>a\\<rceil> \\<subseteq> \\<lceil>b\\<rceil>)\" for a b :: prefixed_capability\nproof\n  show \"a \\<subseteq>\\<^sub>c b \\<Longrightarrow> \\<lceil>a\\<rceil> \\<subseteq> \\<lceil>b\\<rceil>\"\n    unfolding pref_cap_sub_def set_of_pref_cap_def\n    by (force intro:nth_take_lemma)\n  {\n    fix n m :: prefix_size\n    fix x y :: key\n    assume \"\\<lfloor>n\\<rfloor> < (\\<lfloor>m\\<rfloor> :: nat)\"\n    then obtain z where\n      \"length z = size x\"\n      \"take \\<lfloor>n\\<rfloor> z = take \\<lfloor>n\\<rfloor> (to_bl x)\" and \"take \\<lfloor>m\\<rfloor> z \\<noteq> take \\<lfloor>m\\<rfloor> (to_bl y)\"\n      using take_less_diff[of \"\\<lfloor>n\\<rfloor>\" \"\\<lfloor>m\\<rfloor>\" \"to_bl x\" \"to_bl y\"]\n      by auto\n    moreover hence \"to_bl (of_bl z :: key) = z\" by (intro word_bl.Abs_inverse[of z], simp)\n    ultimately\n    have \"\\<exists> u :: key.\n           take \\<lfloor>n\\<rfloor> (to_bl u) = take \\<lfloor>n\\<rfloor> (to_bl x) \\<and> take \\<lfloor>m\\<rfloor> (to_bl u) \\<noteq> take \\<lfloor>m\\<rfloor> (to_bl y)\"\n      by metis\n  }\n  thus \"\\<lceil>a\\<rceil> \\<subseteq> \\<lceil>b\\<rceil> \\<Longrightarrow> a \\<subseteq>\\<^sub>c b\"\n    unfolding pref_cap_sub_def set_of_pref_cap_def subset_eq\n    apply (auto split:prod.split)\n    by (erule contrapos_pp[of \"\\<forall> x. _ x\"], simp)\nqed\n\nlemmas pref_cap_subsets[intro] = cap_sub.intro[OF pref_cap_sub_iff]\n\ntext \\<open>\n  Locale interpretation to prove the reflexivity and transitivity properties of a subset function\n  of the prefixed capability format.\n\\<close>\n\ninterpretation pref_cap_sub: cap_sub set_of_pref_cap pref_cap_sub ..\n\ntext \\<open>\n  Low-level 32-byte machine word representation of the prefixed capability format:\n  \\begin{itemize}\n    \\item first byte is the prefix;\n    \\item next seven bytes are undefined;\n    \\item 24 bytes of the base procedure key.\n  \\end{itemize}\n\\<close>\n\ndefinition \"pref_cap_rep sk r \\<equiv>\n  let (s, k) = sk in \\<lfloor>s\\<rfloor> \\<^sub>1\\<diamond> k OR r \\<restriction> {LENGTH(key)..<LENGTH(word32) - LENGTH(byte)}\"\n  for sk :: prefixed_capability\n\nadhoc_overloading rep pref_cap_rep\n\ntext \\<open>Low-level representation is injective.\\<close>\n\nlemma pref_cap_rep_inj_helper_inj[dest]: \"\\<lfloor>s\\<^sub>1\\<rfloor> \\<^sub>1\\<diamond> k\\<^sub>1 = \\<lfloor>s\\<^sub>2\\<rfloor> \\<^sub>1\\<diamond> k\\<^sub>2 \\<Longrightarrow> s\\<^sub>1 = s\\<^sub>2 \\<and> k\\<^sub>1 = k\\<^sub>2\"\n  for s\\<^sub>1 s\\<^sub>2 :: prefix_size and k\\<^sub>1 k\\<^sub>2 :: key\n  by auto\n\nlemma pref_cap_rep_inj_helper_zero[simplified, simp]:\n  \"n \\<in> {LENGTH(key)..<LENGTH(word32) - LENGTH(byte)} \\<Longrightarrow> \\<not> (\\<lfloor>s\\<rfloor> \\<^sub>1\\<diamond> k) !! n\"\n  for s :: prefix_size and k :: key\n  by simp\n\nlemma pref_cap_rep_inj[dest]: \"\\<lfloor>c\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>c\\<^sub>2\\<rfloor> r\\<^sub>2 \\<Longrightarrow> c\\<^sub>1 = c\\<^sub>2\" for c\\<^sub>1 c\\<^sub>2 :: prefixed_capability\n  unfolding pref_cap_rep_def\n  by (auto split:prod.splits)\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas pref_cap_invertible[intro] = invertible2.intro[OF inj2I, OF pref_cap_rep_inj]\n\ninterpretation pref_cap_inv: invertible2 pref_cap_rep ..\n\nadhoc_overloading abs pref_cap_inv.inv2\n\nsubsubsection \\<open>Write capability\\<close>\n\ntext \\<open>\n  The write capability format includes 2 values: the first is the base address where we can write\n  to storage. The second is the number of additional addresses we can write to.\n\n  Note that write capability must not allow to write to the kernel storage.\n\\<close>\n\ntypedef write_capability = \"{(a :: word32, n). n < unat prefix_bound - unat a}\"\n  morphisms write_cap_rep' write_cap\n  unfolding rpad_def\n  by (intro exI[of _ \"(0, 0)\"], simp)\n\nadhoc_overloading rep write_cap_rep'\n\ntext \\<open>A write capability is correctly bounded by the lowest kernel storage address.\\<close>\n\nlemma write_cap_additional_bound[simplified, simp]:\n  \"snd \\<lfloor>w\\<rfloor> < unat prefix_bound\" for w :: write_capability\n  using write_cap_rep'[of w]\n  by (auto split:prod.split)\n\nlemma write_cap_additional_bound'[simplified, simp]:\n  \"unat prefix_bound \\<le> n \\<Longrightarrow> \\<lfloor>w\\<rfloor> = (a, b) \\<Longrightarrow> b < n\"\n  using write_cap_additional_bound[of w] by simp\n\nlemma write_cap_bound: \"unat (fst \\<lfloor>w\\<rfloor>) + snd \\<lfloor>w\\<rfloor> < unat prefix_bound\"\n  using write_cap_rep'[of w]\n  by (simp split:prod.splits)\n\nlemma write_cap_bound'[simplified, simp]: \"\\<lfloor>w\\<rfloor> = (a, b) \\<Longrightarrow> unat a + b < unat prefix_bound\"\n  using write_cap_bound[of w] by simp\n\ntext \\<open>\n  There is no possible overflow in adding the number of additional addresses to the base write\n  address.\n\\<close>\n\nlemma write_cap_no_overflow: \"fst \\<lfloor>w\\<rfloor> \\<le> fst \\<lfloor>w\\<rfloor> + of_nat (snd \\<lfloor>w\\<rfloor>)\" for w :: write_capability\n  by (simp add:word_le_nat_alt unat_of_nat_eq less_imp_le)\n\nlemma write_cap_no_overflow'[simp]: \"\\<lfloor>w\\<rfloor> = (a, b) \\<Longrightarrow> a \\<le> a + of_nat b\"\n  for w :: write_capability\n  using write_cap_no_overflow[of w] by simp\n\ntext \\<open>\n  Auxiliary lemma: the @{text ith} element of the kernel address prefix is binary @{text 1} if and\n  only if @{text i} is smaller then the size of the prefix, otherwise it is @{text 0}.\n\\<close>\n\nlemma nth_kern_prefix: \"kern_prefix !! i = (i < size kern_prefix)\"\nproof-\n  fix i\n  {\n    fix c :: nat\n    assume \"i < c\"\n    then consider \"i = c - 1\" | \"i < c - 1 \\<and> c \\<ge> 1\"\n      by fastforce\n  } note elim = this\n  have \"i < size kern_prefix \\<Longrightarrow> kern_prefix !! i\"\n    by (subst test_bit_bl, (erule elim, simp_all)+)\n  moreover have \"i \\<ge> size kern_prefix \\<Longrightarrow> \\<not> kern_prefix !! i\" by simp\n  ultimately show \"kern_prefix !! i = (i < size kern_prefix)\" by auto\nqed\n\ntext \\<open>\n  The @{text ith} bit of the lowest kernel address is @{text 1} if and only if @{text i} is smaller\n  or equal to the size of the kernel prefix, otherwise it is @{text 0}.\n\\<close>\n\nlemma nth_prefix_bound[iff]:\n  \"prefix_bound !! i = (i \\<in> {LENGTH(word32) - size (kern_prefix)..<LENGTH(word32)})\"\n  (is \"_ = (i \\<in> {?l..<?r})\")\nproof-\n  have 0:\"is_up (ucast :: 32 word \\<Rightarrow> word32)\" by simp\n  have 1:\"width (ucast kern_prefix :: word32) \\<le> size kern_prefix\"\n    using width_ucast[of kern_prefix, OF 0] by (simp del:width_iff)\n  fix i\n  show \"prefix_bound !! i = (i \\<in> {?l..<?r})\"\n    using rpad_high\n      [of \"(ucast)\\<^bsub>(len TYPE(word32))\\<^esub> kern_prefix\" \"size (kern_prefix)\" i, OF 1, simplified]\n      rpad_low\n      [of \"(ucast)\\<^bsub>(len TYPE(word32))\\<^esub> kern_prefix\" \"size (kern_prefix)\" i, OF 1, simplified]\n      nth_kern_prefix[of \"i - ?l\", simplified] nth_ucast[of kern_prefix i, simplified]\n      test_bit_size[of prefix_bound i, simplified]\n  by (simp (no_asm_simp)) linarith\nqed\n\ntext \\<open>Addresses from write capabilities can not contain the prefix of the kernel storage.\\<close>\n\nlemma write_cap_high[dest]:\n  \"unat a < unat prefix_bound \\<Longrightarrow>\n   \\<exists> i \\<in> {LENGTH(word32) - size (kern_prefix)..<LENGTH(word32)}. \\<not> a !! i\"\n  (is \"_ \\<Longrightarrow> \\<exists> i \\<in> {?l..<?r}. _\")\n  for a :: word32\nproof (rule ccontr, simp del:word_size len_word ucast_bintr)\n  {\n    fix i\n    have \"(ucast kern_prefix :: word32) !! i = (i < size kern_prefix)\"\n      using nth_kern_prefix[of i] nth_ucast[of kern_prefix i] by auto\n    moreover assume \"i + ?l < ?r \\<Longrightarrow> a !! (i + ?l)\"\n    ultimately have \"(a >> ?l) !! i = (ucast kern_prefix :: word32) !! i\"\n      using nth_shiftr[of a ?l i] by fastforce\n  }\n  moreover assume \"\\<forall>i\\<in>{?l..<?r}. a !! i\"\n  ultimately have \"a >> ?l = ucast kern_prefix\" unfolding word_eq_iff using nth_ucast by auto\n  moreover have \"unat (a >> ?l) = unat a div 2 ^ ?l\" using shiftr_div_2n' by blast\n  moreover have \"unat (ucast kern_prefix :: word32) = unat kern_prefix\"\n    by (rule unat_ucast_upcast, simp)\n  ultimately have \"unat a div 2 ^ ?l = unat kern_prefix\" by simp\n  hence \"unat a \\<ge> unat kern_prefix * 2 ^ ?l\" by simp\n  hence \"unat a \\<ge> unat prefix_bound\" unfolding rpad_def by simp\n  also assume \"unat a < unat prefix_bound\"\n  finally show False ..\nqed\n\ntext \\<open>\n  High-level representation of a write capability is a set of all addresses to which the capability\n  allows to write.\n\\<close>\n\ndefinition \"set_of_write_cap w \\<equiv> let (a, n) = \\<lfloor>w\\<rfloor> in {a .. a + of_nat n}\" for w :: write_capability\n\nadhoc_overloading abs set_of_write_cap\n\ntext \\<open>\n  A write capability A is a subset of a write capability B if:\n  \\begin{itemize}\n    \\item the lowest writable address (which is the base address) of B is less than or equal to\n          the lowest writable address of A;\n    \\item the highest writable address (which is base address plus the number of additional keys)\n          of A is less than or equal to the highest writable address of B.\n  \\end{itemize}\n\\<close>\n\ndefinition \"write_cap_sub A B \\<equiv>\n  let (a\\<^sub>A, n\\<^sub>A) = \\<lfloor>A\\<rfloor> in let (a\\<^sub>B, n\\<^sub>B) = \\<lfloor>B\\<rfloor> in a\\<^sub>B \\<le> a\\<^sub>A \\<and> a\\<^sub>A + of_nat n\\<^sub>A \\<le> a\\<^sub>B + of_nat n\\<^sub>B\"\n  for A B :: write_capability\n\nadhoc_overloading sub write_cap_sub\n\ntext \\<open>Prove the well-definedness assumption for the write capability format.\\<close>\n\nlemma write_cap_sub_iff[iff]: \"a \\<subseteq>\\<^sub>c b = (\\<lceil>a\\<rceil> \\<subseteq> \\<lceil>b\\<rceil>)\" for a b :: write_capability\n  unfolding write_cap_sub_def set_of_write_cap_def\n  by (auto split:prod.splits)\n\nlemmas write_cap_subsets[intro] = cap_sub.intro[OF write_cap_sub_iff]\n\ntext \\<open>\n  Locale interpretation to prove the reflexivity and transitivity properties of a subset function\n  of the write capability format.\n\\<close>\n\ninterpretation write_cap_sub: cap_sub set_of_write_cap write_cap_sub ..\n\ntext \\<open>\n  Low-level representation of the write capability format is a 32-byte machine word list of two\n  elements:\n  \\begin{itemize}\n    \\item the base address;\n    \\item the number of additional addresses (also as a machine word).\n  \\end{itemize}\n\\<close>\n\ndefinition \"write_cap_rep w \\<equiv> let (a, n) = \\<lfloor>w\\<rfloor> in (a, of_nat n :: word32)\"\n\nadhoc_overloading rep write_cap_rep\n\ntext \\<open>Low-level representation is injective.\\<close>\n\nlemma write_cap_inj[dest]: \"(\\<lfloor>w\\<^sub>1\\<rfloor> :: word32 \\<times> word32) = \\<lfloor>w\\<^sub>2\\<rfloor> \\<Longrightarrow> w\\<^sub>1 = w\\<^sub>2\"\n  for w\\<^sub>1 w\\<^sub>2 :: write_capability\n  unfolding write_cap_rep_def\n  by (auto\n      split:prod.splits iff:write_cap_rep'_inject[symmetric]\n      intro!:word_of_nat_inj simp add:rpad_def)\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas write_cap_invertible[intro] = invertible.intro[OF injI, OF write_cap_inj]\n\ninterpretation write_cap_inv: invertible write_cap_rep ..\n\nadhoc_overloading abs write_cap_inv.inv\n\ntext \\<open>\n  An address from the high-level representation of the write capability must be below the lowest\n  kernel storage address.\n\\<close>\n\nlemma write_cap_prefix[dest]: \"a \\<in> \\<lceil>w\\<rceil> \\<Longrightarrow> \\<not> limited_and prefix_bound a\" for w :: write_capability\nproof\n  assume \"a \\<in> \\<lceil>w\\<rceil>\"\n  hence \"unat a < unat prefix_bound\"\n    unfolding set_of_write_cap_def\n    apply (simp split:prod.splits)\n    using write_cap_bound'[of w] word_less_nat_alt word_of_nat_less by fastforce\n  then obtain n where \"n\\<in>{LENGTH(256 word) - size kern_prefix..<LENGTH(256 word)}\" and \"\\<not> a !! n\"\n    using write_cap_high[of a] by auto\n  moreover assume \"limited_and prefix_bound a\"\n  ultimately show False\n    unfolding limited_and_def word_eq_iff\n    by (subst (asm) nth_prefix_bound, auto)\nqed\n\ntext \\<open>\n  An address from the high-level representation is different from any address from the kernel\n  storage.\n\\<close>\n\nlemma write_cap_safe[simp]: \"a \\<in> \\<lceil>w\\<rceil> \\<Longrightarrow> a \\<noteq> \\<lfloor>a'\\<rfloor>\" for w :: write_capability and a' :: address\n  by auto\n\ndeclare\n  write_cap_additional_bound'[simp del] write_cap_bound'[simp del] write_cap_no_overflow'[simp del]\n\nsubsubsection \\<open>Log capability\\<close>\n\ntext \\<open>\n  The log capability format includes between 0 and 4 values for log topics and 1 value that\n  specifies the number of enforced topics. We model it as a 32-byte machine word list whose length\n  is between 0 and 4.\n\\<close>\n\ntypedef log_capability = \"{ws :: word32 list. length ws \\<le> 4}\"\n  morphisms log_cap_rep' log_capability\n  by (intro exI[of _ \"[]\"], simp)\n\nadhoc_overloading rep log_cap_rep'\n\ntext \\<open>\n  High-level representation of a log capability is a set of all possible log capabilities whose\n  list prefix in the same and equals to the given log capability.\n\\<close>\n\ndefinition \"set_of_log_cap l \\<equiv> {xs . prefix \\<lfloor>l\\<rfloor> xs}\" for l :: log_capability\n\nadhoc_overloading abs set_of_log_cap\n\ntext \\<open>\n  A log capability A is a subset of a log capability B if for each log topic of B the topic\n  is either undefined or equal to that of A. But here we specify that A is a subset of B  if B is a\n  list prefix for A. Below we prove that this conditions are equivalent.\n\\<close>\n\ndefinition \"log_cap_sub A B \\<equiv> prefix \\<lfloor>B\\<rfloor> \\<lfloor>A\\<rfloor>\" for A B :: log_capability\n\nadhoc_overloading sub log_cap_sub\n\ntext \\<open>Prove the well-definedness assumption for the log capability format.\\<close>\n\nlemma log_cap_sub_iff[iff]: \"a \\<subseteq>\\<^sub>c b = (\\<lceil>a\\<rceil> \\<subseteq> \\<lceil>b\\<rceil>)\" for a b :: log_capability\n  unfolding log_cap_sub_def set_of_log_cap_def\n  by force\n\nlemmas log_cap_subsets[intro] = cap_sub.intro[OF log_cap_sub_iff]\n\ntext \\<open>\n  Locale interpretation to prove the reflexivity and transitivity properties of a subset function\n  of the log capability format.\n\\<close>\n\ninterpretation log_cap_sub: cap_sub set_of_log_cap log_cap_sub ..\n\ntext \\<open>Proof that that the log capability subset is defined according to the specification.\\<close>\n\nlemma \"a \\<subseteq>\\<^sub>c b = (\\<forall>i < length \\<lfloor>b\\<rfloor> . \\<lfloor>a\\<rfloor> ! i = \\<lfloor>b\\<rfloor> ! i \\<and> i < length \\<lfloor>a\\<rfloor>)\"\n  (is \"_ = ?R\") for a b :: log_capability\n  unfolding log_cap_sub_def prefix_def\nproof\n  let ?L = \"\\<exists>zs. \\<lfloor>a\\<rfloor> = \\<lfloor>b\\<rfloor> @ zs\"\n  {\n    assume ?L\n    moreover hence \"length \\<lfloor>b\\<rfloor> \\<le> length \\<lfloor>a\\<rfloor>\" by auto\n    ultimately show \"?L \\<Longrightarrow> ?R\"\n      by (auto simp add:nth_append)\n  next\n    assume ?R\n    moreover hence len:\"length \\<lfloor>b\\<rfloor> \\<le> length \\<lfloor>a\\<rfloor>\"\n      using le_def by blast\n    moreover from \\<open>?R\\<close> have \"\\<lfloor>a\\<rfloor> = take (length \\<lfloor>b\\<rfloor>) \\<lfloor>a\\<rfloor> @ drop (length \\<lfloor>b\\<rfloor>) \\<lfloor>a\\<rfloor> \"\n      by simp\n    moreover from \\<open>?R\\<close> len have \"take (length \\<lfloor>b\\<rfloor>) \\<lfloor>a\\<rfloor> = \\<lfloor>b\\<rfloor>\"\n      by (metis nth_take_lemma order_refl take_all)\n    ultimately show \"?R \\<Longrightarrow> ?L\" by (intro exI[of _ \"drop (length \\<lfloor>b\\<rfloor>) \\<lfloor>a\\<rfloor>\"], arith)\n  }\nqed\n\n\ntext \\<open>\n  Low-level representation of the log capability format is a 32-byte machine word list that includes\n  between 1 and 5 values. First value is the number of enforced topics and the rest are possible\n  values for log topics.\n\\<close>\n\ndefinition \"log_cap_rep l \\<equiv> (of_nat (length \\<lfloor>l\\<rfloor>) :: word32) # \\<lfloor>l\\<rfloor>\"\n\nno_adhoc_overloading rep log_cap_rep'\n\nadhoc_overloading rep log_cap_rep\n\ntext \\<open>Low-level representation is injective.\\<close>\n\nlemma log_cap_rep_inj[dest]: \"(\\<lfloor>l\\<^sub>1\\<rfloor> :: word32 list) = \\<lfloor>l\\<^sub>2\\<rfloor> \\<Longrightarrow> l\\<^sub>1 = l\\<^sub>2\" for l\\<^sub>1 l\\<^sub>2 :: log_capability\n  unfolding log_cap_rep_def using log_cap_rep'_inject by auto\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas log_cap_rep_invertible[intro] = invertible.intro[OF injI, OF log_cap_rep_inj]\n\ninterpretation log_cap_inv: invertible log_cap_rep ..\n\nadhoc_overloading abs log_cap_inv.inv\n\ntext \\<open>\n  Length of a low-level representation is correct: it is the length of the topics list plus 1 for\n  storing the number of topics.\n\\<close>\n\nlemma log_cap_rep_length[simp]: \"length \\<lfloor>l\\<rfloor> = length (log_cap_rep' l) + 1\"\n  unfolding log_cap_rep_def by simp\n\nsubsubsection \\<open>External call capability\\<close>\n\ntext \\<open>\n  We model the external call capability format using a record with two fields: @{text \"allow_addr\"}\n  and @{text \"may_send\"}, with the following semantic:\n  \\begin{itemize}\n    \\item if the field  @{text \"allow_addr\"} has value, then only the Ethereum address specified\n          by it can be called, otherwise any address can be called. This models the @{text CallAny}\n          flag and the @{text EthAddress} together;\n    \\item if the value of the field  @{text \"may_send\"} is true, the any quantity of Ether can be\n          sent, otherwise no Ether can be sent. It models the @{text SendValue} flag.\n  \\end{itemize}\n\\<close>\n\ntype_synonym ethereum_address = \"160 word\" \\<comment> \\<open>20 bytes\\<close>\n\nrecord external_call_capability =\n  allow_addr :: \"ethereum_address option\"\n  may_send   :: bool\n\ntext \\<open>\n  High-level representation of an external call capability is a set of all possible pairs of account\n  addresses and Ether amount that can be sent using this capability.\n\\<close>\n\ndefinition \"set_of_ext_cap e \\<equiv>\n  {(a, v) . case_option True ((=) a) (allow_addr e) \\<and> (\\<not> may_send e \\<longrightarrow> v = (0 :: word32)) }\"\n\nadhoc_overloading abs set_of_ext_cap\n\ntext \\<open>\n  Auxiliary abbreviation: @{text \"allow_any e\"} returns @{text True} if the field @{text allow_addr}\n  of the capability @{text e} does not contain any value, and @{text False} otherwise.\n\\<close>\n\nabbreviation \"allow_any e \\<equiv> Option.is_none (allow_addr e)\"\n\ntext \\<open>\n  Auxiliary abbreviation: @{text \"the_addr e\"} returns the value of the field @{text allow_addr}\n  of the capability @{text e}. It can be used only if @{text \"allow_any e\"} is @{text False}.\n\\<close>\n\nabbreviation \"the_addr e \\<equiv> the (allow_addr e)\"\n\ntext \\<open>\n  An external call capability A is a subset of an external call capability B if and only if:\n  \\begin{itemize}\n    \\item if A allows to call any Ethereum address, then B also must allow to call any address;\n    \\item if A allows to call only specified Ethereum address, then B either must allow to call any\n          address, or it must allow to only call the same address as A;\n    \\item if A may send Ether, then B also must be able to send Ether.\n  \\end{itemize}\n\\<close>\n\ndefinition \"ext_cap_sub A B \\<equiv>\n    (allow_any A \\<longrightarrow> allow_any B)\n  \\<and> ((\\<not> allow_any A \\<longrightarrow> allow_any B) \\<or> (the_addr A = the_addr B))\n  \\<and> (may_send A \\<longrightarrow> may_send B)\"\n  for A B :: external_call_capability\n\nadhoc_overloading sub ext_cap_sub\n\ntext \\<open>Prove the well-definedness assumption for the external call capability format.\\<close>\n\nlemma ext_cap_sub_iff[iff]: \"a \\<subseteq>\\<^sub>c b = (\\<lceil>a\\<rceil> \\<subseteq> \\<lceil>b\\<rceil>)\" for a b :: external_call_capability\nproof-\n  {\n    fix v' :: word32\n    have \"\\<exists> v. v \\<noteq> v'\" by (intro exI[of _ \"v' - 1\"], simp)\n  } note [intro] = this\n  {\n    fix a' :: ethereum_address\n    have \"\\<exists> a. a \\<noteq> a'\" by (intro exI[of _ \"a' - 1\"], simp)\n  } note [intro] = this\n  show ?thesis\n  unfolding set_of_ext_cap_def ext_cap_sub_def\n  by (cases \"allow_addr a\";\n      cases \"allow_addr b\";\n      cases \"may_send a\";\n      cases \"may_send b\",\n      auto iff:subset_iff)\nqed\n\nlemmas ext_cap_subsets[intro] = cap_sub.intro[OF ext_cap_sub_iff]\n\ntext \\<open>\n  Locale interpretation to prove the reflexivity and transitivity properties of a subset function\n  of the external call capability format.\n\\<close>\n\ninterpretation ext_cap_sub: cap_sub set_of_ext_cap ext_cap_sub ..\n\ntext \\<open>Helper functions to define low-level representation.\\<close>\n\ndefinition \"ext_cap_val e \\<equiv>\n  (of_bl ([allow_any e, may_send e]\n          @ replicate 6 False) :: byte) \\<^sub>1\\<diamond> case_option 0 id (allow_addr e)\"\n\ndefinition \"ext_cap_frame e \\<equiv>\n  {if allow_any e then 0 else LENGTH(ethereum_address)..<LENGTH(word32) - LENGTH(byte)}\"\n\ntext \\<open>\n  Low-level 32-byte machine word representation of the external call capability format:\n  \\begin{itemize}\n    \\item first bit is the CallAny flag;\n    \\item second bit is the SendValue flag;\n    \\item 6 undefined bits;\n    \\item 11 undefined bytes;\n    \\item 20 bytes of the Ethereum address.\n  \\end{itemize}\n\\<close>\n\ndefinition \"ext_cap_rep e r \\<equiv>  ext_cap_val e OR r \\<restriction> ext_cap_frame e\"\n  for e :: external_call_capability\n\nadhoc_overloading rep ext_cap_rep\n\ntext \\<open>Low-level representation is injective.\\<close>\n\nlemma ext_cap_rep_helper_inj[dest]: \"ext_cap_val e\\<^sub>1 = ext_cap_val e\\<^sub>2 \\<Longrightarrow> e\\<^sub>1 = e\\<^sub>2\"\n  for e\\<^sub>1 e\\<^sub>2 :: external_call_capability\n  unfolding ext_cap_val_def\n  by (cases \"allow_any e\\<^sub>1\"; cases \"allow_any e\\<^sub>2\")\n     (auto simp del:of_bl_True of_bl_False dest:word_bl.Abs_eqD split:option.splits)\n\nlemma ext_cap_rep_helper_zero[simp]: \"n \\<in> ext_cap_frame e \\<Longrightarrow> \\<not> ext_cap_val e !! n\"\n  unfolding ext_cap_frame_def ext_cap_val_def\n  by (auto simp del:of_bl_True split:option.split)\n\nlemma ext_cap_rep_inj[dest]: \"\\<lfloor>e\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>e\\<^sub>2\\<rfloor> r\\<^sub>2 \\<Longrightarrow> e\\<^sub>1 = e\\<^sub>2\" for e\\<^sub>1 e\\<^sub>2 :: external_call_capability\nproof (erule rev_mp; cases \"allow_any e\\<^sub>1\"; cases \"allow_any e\\<^sub>2\")\n  let ?goal = \"\\<lfloor>e\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>e\\<^sub>2\\<rfloor> r\\<^sub>2 \\<longrightarrow> e\\<^sub>1 = e\\<^sub>2\"\n  {\n    {\n      fix P e\n      have \"allow_any e \\<Longrightarrow> (\\<And>s. P \\<lparr> allow_addr = None, may_send = s \\<rparr>) \\<Longrightarrow> P e\"\n        by (cases e, simp add:Option.is_none_def)\n    } note[elim!] = this\n    note [dest] =\n      restrict_inj2[of \"\\<lambda> s (_ :: unit). ext_cap_val \\<lparr> allow_addr = None, may_send = s \\<rparr>\"]\n    assume \"allow_any e\\<^sub>1\" and \"allow_any e\\<^sub>2\"\n    thus ?goal unfolding ext_cap_rep_def by (auto simp add:ext_cap_frame_def)\n  next\n    {\n      fix P e\n      have \"\\<not> allow_any e \\<Longrightarrow> (\\<And>a s. P \\<lparr> allow_addr = Some a, may_send = s \\<rparr>) \\<Longrightarrow> P e\"\n        by (cases e, auto simp add:Option.is_none_def)\n    } note [elim!] = this\n    note [dest] = restrict_inj2[of \"\\<lambda> a s. ext_cap_val \\<lparr> allow_addr = Some a, may_send = s \\<rparr>\"]\n    assume \"\\<not> allow_any e\\<^sub>1\" and \"\\<not> allow_any e\\<^sub>2\"\n    thus ?goal unfolding ext_cap_rep_def by (auto simp add:ext_cap_frame_def)\n  next\n    let ?neq = \"allow_any e\\<^sub>1 \\<noteq> allow_any e\\<^sub>2\"\n    {\n      presume ?neq\n      moreover hence \"msb (ext_cap_val e\\<^sub>1) \\<noteq> msb (ext_cap_val e\\<^sub>2)\"\n        unfolding ext_cap_val_def msb_nth\n        by (auto simp del:of_bl_True of_bl_False simp add:pad_join_high iff:test_bit_of_bl)\n      ultimately show ?goal\n        unfolding ext_cap_rep_def ext_cap_frame_def word_eq_iff msb_nth word_or_nth nth_restrict\n        by simp  (meson less_irrefl numeral_less_iff semiring_norm(76) semiring_norm(81))\n      thus ?goal .\n    next\n      assume \"allow_any e\\<^sub>1\" and \"\\<not> allow_any e\\<^sub>2\"\n      thus ?neq by simp\n    next\n      assume \"\\<not> allow_any e\\<^sub>1\" and \"allow_any e\\<^sub>2\"\n      thus ?neq by simp\n    }\n  }\nqed\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas ext_cap_invertible[intro] = invertible2.intro[OF inj2I, OF ext_cap_rep_inj]\n\ninterpretation ext_cap_inv: invertible2 ext_cap_rep ..\n\nadhoc_overloading abs ext_cap_inv.inv2\n\nsection \\<open>Kernel state\\<close>\n\ntext \\<open>This section contains definition of the kernel state.\\<close>\n\nsubsection \\<open>Procedure data\\<close>\n\ntext \\<open>\n  Introduce @{text \"'a capability_list\"} type that is a list of capabilities of a specific type\n  @{text \"'a\"}, whose length is smaller than 255.\n\\<close>\n\ntypedef 'a capability_list = \"{l :: 'a list. length l < 2 ^ LENGTH(byte) - 1}\"\n  morphisms cap_list_rep cap_list\n  by (intro exI[of _ \"[]\"], simp)\n\nadhoc_overloading rep cap_list_rep\n\ntext \\<open>\n  We model a procedure using a record with the following fields:\n  \\begin{itemize}\n    \\item @{text eth_addr} field stores the Ethereum address of the procedure;\n    \\item @{text entry_cap} field is @{text True} if the procedure is the entry procedure, and\n          @{text False} otherwise;\n    \\item other fields are lists of capabilities of corresponding types assigned to the procedure.\n  \\end{itemize}\n\\<close>\n\nrecord procedure =\n  eth_addr   :: ethereum_address\n  call_caps  :: \"prefixed_capability capability_list\"\n  reg_caps   :: \"prefixed_capability capability_list\"\n  del_caps   :: \"prefixed_capability capability_list\"\n  entry_cap  :: bool\n  write_caps :: \"write_capability capability_list\"\n  log_caps   :: \"log_capability capability_list\"\n  ext_caps   :: \"external_call_capability capability_list\"\n\nlemmas alist_simps = size_alist_def alist.Alist_inverse alist.impl_of_inverse\n\ndeclare alist_simps[simp]\n\ntext \\<open>\n  Low-level representation of the capability as it is stored in the kernel storage: given the\n  procedure, the capability type, index and offset, it checks that all parameters are valid and\n  correct and returns the machine word representation of the capability.\n\\<close>\n\ndefinition \"caps_rep (k :: key) p r ty (i :: capability_index) (off :: capability_offset) \\<equiv>\n  let addr = \\<lfloor>Heap_proc k (Cap ty i off)\\<rfloor> in\n  case ty of\n    Call  \\<Rightarrow> if \\<lfloor>i\\<rfloor> < length \\<lfloor>call_caps p\\<rfloor> \\<and> off = 0\n             then \\<lfloor>\\<lfloor>call_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> (r addr)\n             else r addr\n\n  | Reg   \\<Rightarrow> if \\<lfloor>i\\<rfloor> < length \\<lfloor>reg_caps p\\<rfloor> \\<and> off = 0\n             then \\<lfloor>\\<lfloor>reg_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> (r addr)\n             else r addr\n  | Del   \\<Rightarrow> if \\<lfloor>i\\<rfloor> < length \\<lfloor>del_caps p\\<rfloor> \\<and> off = 0\n             then \\<lfloor>\\<lfloor>del_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> (r addr)\n             else r addr\n  | Entry \\<Rightarrow> r addr\n  | Write \\<Rightarrow> if \\<lfloor>i\\<rfloor> < length \\<lfloor>write_caps p\\<rfloor>\n             then\n               if off = 0x00      then fst (\\<lfloor>\\<lfloor>write_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> :: _ \\<times> word32)\n               else if off = 0x01 then snd \\<lfloor>\\<lfloor>write_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor>\n               else                    r addr\n             else                      r addr\n  | Log   \\<Rightarrow> if \\<lfloor>i\\<rfloor> < length \\<lfloor>log_caps p\\<rfloor>\n             then\n               if unat off < length \\<lfloor>\\<lfloor>log_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> then \\<lfloor>\\<lfloor>log_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> ! unat off\n               else                                          r addr\n             else                                            r addr\n  | Send  \\<Rightarrow> if \\<lfloor>i\\<rfloor> < length \\<lfloor>ext_caps p\\<rfloor> \\<and> off = 0\n             then \\<lfloor>\\<lfloor>ext_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> (r addr)\n             else r addr\"\n\ntext \\<open>Capability representation is injective.\\<close>\n\nlemma caps_rep_inj[dest]:\n  assumes \"caps_rep k\\<^sub>1 p\\<^sub>1 r\\<^sub>1 = caps_rep k\\<^sub>2 p\\<^sub>2 r\\<^sub>2\"\n  shows   \"length \\<lfloor>call_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>call_caps p\\<^sub>2\\<rfloor>   \\<Longrightarrow> call_caps p\\<^sub>1 = call_caps p\\<^sub>2\"\n    and   \"length \\<lfloor>reg_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>reg_caps p\\<^sub>2\\<rfloor>     \\<Longrightarrow> reg_caps p\\<^sub>1 = reg_caps p\\<^sub>2\"\n    and   \"length \\<lfloor>del_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>del_caps p\\<^sub>2\\<rfloor>     \\<Longrightarrow> del_caps p\\<^sub>1 = del_caps p\\<^sub>2\"\n    and   \"length \\<lfloor>write_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>write_caps p\\<^sub>2\\<rfloor> \\<Longrightarrow> write_caps p\\<^sub>1 = write_caps p\\<^sub>2\"\n    and   \"length \\<lfloor>log_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>log_caps p\\<^sub>2\\<rfloor>     \\<Longrightarrow> log_caps p\\<^sub>1 = log_caps p\\<^sub>2\"\n    and   \"length \\<lfloor>ext_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>ext_caps p\\<^sub>2\\<rfloor>     \\<Longrightarrow> ext_caps p\\<^sub>1 = ext_caps p\\<^sub>2\"\nproof-\n  from assms have eq:\"\\<And> ty i off. caps_rep k\\<^sub>1 p\\<^sub>1 r\\<^sub>1 ty i off = caps_rep k\\<^sub>2 p\\<^sub>2 r\\<^sub>2 ty i off\"\n    by simp\n  note Let_def[simp] if_splits[split] nth_equalityI[intro] cap_list_rep_inject[symmetric, iff]\n  {\n    fix i :: nat\n    let ?addr\\<^sub>1 = \"\\<lfloor>Heap_proc k\\<^sub>1 (Cap Call \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    and ?addr\\<^sub>2 = \"\\<lfloor>Heap_proc k\\<^sub>2 (Cap Call \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    assume idx:\"i < length \\<lfloor>call_caps p\\<^sub>1\\<rfloor>\"\n    hence 0:\"i \\<in>  {i. i < 2 ^ LENGTH(8 word) - 1}\"\n      using cap_list_rep[of \"call_caps p\\<^sub>1\"] by simp\n    assume \"length \\<lfloor>call_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>call_caps p\\<^sub>2\\<rfloor>\"\n    with idx eq[of Call \"\\<lceil>i\\<rceil>\" 0]\n    have \"\\<lfloor>\\<lfloor>call_caps p\\<^sub>1\\<rfloor> ! i\\<rfloor> (r\\<^sub>1 ?addr\\<^sub>1) = \\<lfloor>\\<lfloor>call_caps p\\<^sub>2\\<rfloor> ! i\\<rfloor> (r\\<^sub>2 ?addr\\<^sub>2)\"\n      unfolding caps_rep_def by (simp add:cap_index_inverse[OF 0])\n  }\n  thus \"length \\<lfloor>call_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>call_caps p\\<^sub>2\\<rfloor> \\<Longrightarrow> call_caps p\\<^sub>1 = call_caps p\\<^sub>2\"\n    by force\n\n  {\n    fix i :: nat\n    let ?addr\\<^sub>1 = \"\\<lfloor>Heap_proc k\\<^sub>1 (Cap Reg \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    and ?addr\\<^sub>2 = \"\\<lfloor>Heap_proc k\\<^sub>2 (Cap Reg \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    assume idx:\"i < length \\<lfloor>reg_caps p\\<^sub>1\\<rfloor>\"\n    hence 0:\"i \\<in>  {i. i < 2 ^ LENGTH(8 word) - 1}\"\n      using capability_list.cap_list_rep[of \"reg_caps p\\<^sub>1\"] by simp\n    assume \"length \\<lfloor>reg_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>reg_caps p\\<^sub>2\\<rfloor>\"\n    with idx eq[of Reg \"\\<lceil>i\\<rceil>\" 0]\n    have \"\\<lfloor>\\<lfloor>reg_caps p\\<^sub>1\\<rfloor> ! i\\<rfloor> (r\\<^sub>1 ?addr\\<^sub>1) = \\<lfloor>\\<lfloor>reg_caps p\\<^sub>2\\<rfloor> ! i\\<rfloor> (r\\<^sub>2 ?addr\\<^sub>2)\"\n      unfolding caps_rep_def by (simp add:cap_index_inverse[OF 0])\n  }\n  thus \"length \\<lfloor>reg_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>reg_caps p\\<^sub>2\\<rfloor> \\<Longrightarrow> reg_caps p\\<^sub>1 = reg_caps p\\<^sub>2\"\n    by force\n\n  {\n    fix i :: nat\n    let ?addr\\<^sub>1 = \"\\<lfloor>Heap_proc k\\<^sub>1 (Cap Del \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    and ?addr\\<^sub>2 = \"\\<lfloor>Heap_proc k\\<^sub>2 (Cap Del \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    assume idx:\"i < length \\<lfloor>del_caps p\\<^sub>1\\<rfloor>\"\n    hence 0:\"i \\<in>  {i. i < 2 ^ LENGTH(8 word) - 1}\"\n      using cap_list_rep[of \"del_caps p\\<^sub>1\"] by simp\n    assume \"length \\<lfloor>del_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>del_caps p\\<^sub>2\\<rfloor>\"\n    with idx eq[of Del \"\\<lceil>i\\<rceil>\" 0]\n    have \"\\<lfloor>\\<lfloor>del_caps p\\<^sub>1\\<rfloor> ! i\\<rfloor> (r\\<^sub>1 ?addr\\<^sub>1) = \\<lfloor>\\<lfloor>del_caps p\\<^sub>2\\<rfloor> ! i\\<rfloor> (r\\<^sub>2 ?addr\\<^sub>2)\"\n      unfolding caps_rep_def by (simp add:cap_index_inverse[OF 0])\n  }\n  thus \"length \\<lfloor>del_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>del_caps p\\<^sub>2\\<rfloor> \\<Longrightarrow> del_caps p\\<^sub>1 = del_caps p\\<^sub>2\"\n    by force\n\n  {\n    fix i :: nat\n    let ?addr\\<^sub>1 = \"\\<lfloor>Heap_proc k\\<^sub>1 (Cap Send \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    and ?addr\\<^sub>2 = \"\\<lfloor>Heap_proc k\\<^sub>2 (Cap Send \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    assume idx:\"i < length \\<lfloor>ext_caps p\\<^sub>1\\<rfloor>\"\n    hence 0:\"i \\<in>  {i. i < 2 ^ LENGTH(8 word) - 1}\"\n      using capability_list.cap_list_rep[of \"ext_caps p\\<^sub>1\"] by simp\n    assume \"length \\<lfloor>ext_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>ext_caps p\\<^sub>2\\<rfloor>\"\n    with idx eq[of Send \"\\<lceil>i\\<rceil>\" 0]\n    have \"\\<lfloor>\\<lfloor>ext_caps p\\<^sub>1\\<rfloor> ! i\\<rfloor> (r\\<^sub>1 ?addr\\<^sub>1) = \\<lfloor>\\<lfloor>ext_caps p\\<^sub>2\\<rfloor> ! i\\<rfloor> (r\\<^sub>2 ?addr\\<^sub>2)\"\n      unfolding caps_rep_def by (simp add:cap_index_inverse[OF 0])\n  }\n  thus \"length \\<lfloor>ext_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>ext_caps p\\<^sub>2\\<rfloor> \\<Longrightarrow> ext_caps p\\<^sub>1 = ext_caps p\\<^sub>2\"\n    by force\n\n  {\n    fix i :: nat\n    let ?addr\\<^sub>1 = \"\\<lfloor>Heap_proc k\\<^sub>1 (Cap Write \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    and ?addr\\<^sub>2 = \"\\<lfloor>Heap_proc k\\<^sub>2 (Cap Write \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    assume idx:\"i < length \\<lfloor>write_caps p\\<^sub>1\\<rfloor>\"\n    hence 0:\"i \\<in>  {i. i < 2 ^ LENGTH(8 word) - 1}\"\n      using capability_list.cap_list_rep[of \"write_caps p\\<^sub>1\"] by simp\n    assume \"length \\<lfloor>write_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>write_caps p\\<^sub>2\\<rfloor>\"\n    with idx eq[of Write \"\\<lceil>i\\<rceil>\" \"0x00\"] eq[of Write \"\\<lceil>i\\<rceil>\" \"0x01\"]\n    have \"(\\<lfloor>\\<lfloor>write_caps p\\<^sub>1\\<rfloor> ! i\\<rfloor> :: word32 \\<times> word32) = \\<lfloor>\\<lfloor>write_caps p\\<^sub>2\\<rfloor> ! i\\<rfloor>\"\n      unfolding caps_rep_def by (simp add:cap_index_inverse[OF 0] prod_eqI)\n  }\n  thus \"length \\<lfloor>write_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>write_caps p\\<^sub>2\\<rfloor> \\<Longrightarrow> write_caps p\\<^sub>1 = write_caps p\\<^sub>2\"\n    by force\n\n  {\n    fix i :: nat\n    let ?addr\\<^sub>1 = \"\\<lfloor>Heap_proc k\\<^sub>1 (Cap Log \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    and ?addr\\<^sub>2 = \"\\<lfloor>Heap_proc k\\<^sub>2 (Cap Log \\<lceil>i\\<rceil> 0)\\<rfloor>\"\n    assume idx:\"i < length \\<lfloor>log_caps p\\<^sub>1\\<rfloor>\"\n    hence 0:\"i \\<in>  {i. i < 2 ^ LENGTH(8 word) - 1}\"\n      using capability_list.cap_list_rep[of \"log_caps p\\<^sub>1\"] by simp\n    {\n      fix l\n      from log_cap_rep'[of l]\n      have \"unat (of_nat (length (log_cap_rep' l)) :: word32) = length (log_cap_rep' l)\"\n        by (simp add:unat_of_nat_eq)\n    }\n    moreover assume len:\"length \\<lfloor>log_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>log_caps p\\<^sub>2\\<rfloor>\"\n    ultimately have rep_len:\"length \\<lfloor>\\<lfloor>log_caps p\\<^sub>1\\<rfloor> ! i\\<rfloor> = length \\<lfloor>\\<lfloor>log_caps p\\<^sub>2\\<rfloor> ! i\\<rfloor>\"\n      using idx eq[of Log \"\\<lceil>i\\<rceil>\" 0]\n      unfolding caps_rep_def log_cap_rep_def\n      by (auto simp add:cap_index_inverse[OF 0], metis)\n    {\n      fix off\n      assume off:\"off < length \\<lfloor>\\<lfloor>log_caps p\\<^sub>1\\<rfloor> ! i\\<rfloor>\"\n      hence \"unat (of_nat off :: byte) = off\"\n        using log_cap_rep'[of \"\\<lfloor>log_caps p\\<^sub>1\\<rfloor> ! i\"] by (simp add:unat_of_nat_eq)\n      with idx off eq[of Log \"\\<lceil>i\\<rceil>\" \"of_nat off\"] len rep_len\n      have \"\\<lfloor>\\<lfloor>log_caps p\\<^sub>1\\<rfloor> ! i\\<rfloor> ! off = \\<lfloor>\\<lfloor>log_caps p\\<^sub>2\\<rfloor> ! i\\<rfloor> ! off\"\n        unfolding caps_rep_def\n        by (auto simp add:cap_index_inverse[OF 0])\n    }\n    with len rep_len have \"\\<lfloor>\\<lfloor>log_caps p\\<^sub>1\\<rfloor> ! i\\<rfloor> = \\<lfloor>\\<lfloor>log_caps p\\<^sub>2\\<rfloor> ! i\\<rfloor>\" by auto\n  }\n  thus \"length \\<lfloor>log_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>log_caps p\\<^sub>2\\<rfloor> \\<Longrightarrow> log_caps p\\<^sub>1 = log_caps p\\<^sub>2\"\n    by force\nqed\n\ntext \\<open>\n  Low-level representation of the procedure as it is stored in the kernel storage: given the\n  procedure and the data offset it returns the machine word representation of the data\n  that can be found by that offset.\n\\<close>\n\ndefinition \"proc_rep k (i :: key_index) (p :: procedure) r (off :: data_offset) \\<equiv>\n  let addr = \\<lfloor>off\\<rfloor> in\n  let ncaps = \\<lambda> n. ucast (of_nat n :: byte) OR r addr \\<restriction> {LENGTH(byte)..<LENGTH(word32)} in\n  case off of\n    Addr         \\<Rightarrow> ucast (eth_addr p) OR r addr \\<restriction> {LENGTH(ethereum_address) ..<LENGTH(word32)}\n  | Index        \\<Rightarrow> ucast \\<lfloor>i\\<rfloor> OR r addr \\<restriction> {LENGTH(key) ..<LENGTH(word32)}\n  | Ncaps Call   \\<Rightarrow> ncaps (length \\<lfloor>call_caps p\\<rfloor>)\n  | Ncaps Reg    \\<Rightarrow> ncaps (length \\<lfloor>reg_caps p\\<rfloor>)\n  | Ncaps Del    \\<Rightarrow> ncaps (length \\<lfloor>del_caps p\\<rfloor>)\n  | Ncaps Entry  \\<Rightarrow> ncaps (of_bool (entry_cap p))\n  | Ncaps Write  \\<Rightarrow> ncaps (length \\<lfloor>write_caps p\\<rfloor>)\n  | Ncaps Log    \\<Rightarrow> ncaps (length \\<lfloor>log_caps p\\<rfloor>)\n  | Ncaps Send   \\<Rightarrow> ncaps (length \\<lfloor>ext_caps p\\<rfloor>)\n  | Cap ty i off \\<Rightarrow> caps_rep k p r ty i off\"\n\ntext \\<open>Low-level representation is injective.\\<close>\n\nlemma restrict_ucast_inj[simplified, dest!]:\n  \"\\<lbrakk>ucast x\\<^sub>1 OR y\\<^sub>1 \\<restriction> {l ..<LENGTH(word32)} = ucast x\\<^sub>2 OR y\\<^sub>2 \\<restriction> {l ..<LENGTH(word32)};\n   l = LENGTH('b); LENGTH('b) < LENGTH(word32)\\<rbrakk> \\<Longrightarrow> x\\<^sub>1 = x\\<^sub>2\"\n  for x\\<^sub>1 x\\<^sub>2 :: \"'b::len word\" and y\\<^sub>1 y\\<^sub>2 :: word32\n    by (auto dest!:restrict_inj2[of \"\\<lambda> x (_ :: unit). ucast x\"] intro:ucast_up_inj)\n\nlemma proc_rep_inj[dest]:\n  assumes \"proc_rep k\\<^sub>1 i\\<^sub>1 p\\<^sub>1 r\\<^sub>1 = proc_rep k\\<^sub>2 i\\<^sub>2 p\\<^sub>2 r\\<^sub>2\"\n  shows   \"p\\<^sub>1 = p\\<^sub>2\" and \"i\\<^sub>1 = i\\<^sub>2\"\nproof (rule procedure.equality)\n  from assms have eq:\"\\<And> off. proc_rep k\\<^sub>1 i\\<^sub>1 p\\<^sub>1 r\\<^sub>1 off = proc_rep k\\<^sub>2 i\\<^sub>2 p\\<^sub>2 r\\<^sub>2 off\" by simp\n\n  from eq[of Addr] show \"eth_addr p\\<^sub>1 = eth_addr p\\<^sub>2\"\n    unfolding proc_rep_def by auto\n  from eq[of Index] show \"i\\<^sub>1 = i\\<^sub>2\" unfolding proc_rep_def by auto\n\n  {\n    fix l :: \"'b capability_list\"\n    from cap_list_rep[of l]\n    have \"unat (of_nat (length \\<lfloor>l\\<rfloor>) :: byte) = length \\<lfloor>l\\<rfloor>\" by (simp add:unat_of_nat_eq)\n  }\n  hence [dest]:\"\\<And> l\\<^sub>1 :: 'b capability_list. \\<And> l\\<^sub>2 :: 'b capability_list.\n           (of_nat (length \\<lfloor>l\\<^sub>1\\<rfloor>) :: byte) = of_nat (length \\<lfloor>l\\<^sub>2\\<rfloor>) \\<Longrightarrow> length \\<lfloor>l\\<^sub>1\\<rfloor> = length \\<lfloor>l\\<^sub>2\\<rfloor>\"\n    by metis\n\n  from eq[of \"Cap _ _ _\"] have caps:\"caps_rep k\\<^sub>1 p\\<^sub>1 r\\<^sub>1 = caps_rep k\\<^sub>2 p\\<^sub>2 r\\<^sub>2\"\n    unfolding proc_rep_def by force\n\n  from eq[of \"Ncaps Call\"] have \"length \\<lfloor>call_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>call_caps p\\<^sub>2\\<rfloor>\"\n    unfolding proc_rep_def by auto\n  with caps show \"call_caps p\\<^sub>1 = call_caps p\\<^sub>2\" ..\n\n  from eq[of \"Ncaps Reg\"] have \"length \\<lfloor>reg_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>reg_caps p\\<^sub>2\\<rfloor>\"\n    unfolding proc_rep_def by auto\n  with caps show \"reg_caps p\\<^sub>1 = reg_caps p\\<^sub>2\" ..\n\n  from eq[of \"Ncaps Del\"] have \"length \\<lfloor>del_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>del_caps p\\<^sub>2\\<rfloor>\"\n    unfolding proc_rep_def by auto\n  with caps show \"del_caps p\\<^sub>1 = del_caps p\\<^sub>2\" ..\n\n  from eq[of \"Ncaps Write\"] have \"length \\<lfloor>write_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>write_caps p\\<^sub>2\\<rfloor>\"\n    unfolding proc_rep_def by auto\n  with caps show \"write_caps p\\<^sub>1 = write_caps p\\<^sub>2\" ..\n\n  from eq[of \"Ncaps Log\"] have \"length \\<lfloor>log_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>log_caps p\\<^sub>2\\<rfloor>\"\n    unfolding proc_rep_def by auto\n  with caps show \"log_caps p\\<^sub>1 = log_caps p\\<^sub>2\" ..\n\n  from eq[of \"Ncaps Send\"] have \"length \\<lfloor>ext_caps p\\<^sub>1\\<rfloor> = length \\<lfloor>ext_caps p\\<^sub>2\\<rfloor>\"\n    unfolding proc_rep_def by auto\n  with caps show \"ext_caps p\\<^sub>1 = ext_caps p\\<^sub>2\" ..\n\n  from eq[of \"Ncaps Entry\"] show \"entry_cap p\\<^sub>1 = entry_cap p\\<^sub>2\"\n    unfolding proc_rep_def by (auto del:iffI) (simp split:if_splits add:of_bool_def)\nqed simp\n\nsubsection \\<open>Kernel storage layout\\<close>\n\ntext \\<open>Maximum number of procedures registered in the kernel is @{text \"2\\<^sup>1\\<^sup>9\\<^sup>2 - 1\"}.\\<close>\n\nabbreviation \"max_nprocs \\<equiv> 2 ^ LENGTH(key) - 1 :: nat\"\n\ntext \\<open>\n  Introduce @{text procedure_list} type that is an association list of elements (a list in which\n  each list element comprises a key and a value, and all keys are distinct), where element key is\n  a procedure key and element value is a procedure itself.\n\\<close>\n\ntypedef procedure_list = \"{l :: (key, procedure) alist. size l \\<le> max_nprocs}\"\n  morphisms proc_list_rep proc_list\n  by (intro exI[of _ \"Alist []\"], simp)\n\nadhoc_overloading rep proc_list_rep\n\nadhoc_overloading rep DAList.impl_of\n\nadhoc_overloading abs proc_list\n\ntext \\<open>\n  We model the kernel storage as a record with three fields:\n  \\begin{itemize}\n    \\item @{text curr_proc} field stores the Ethereum address of the current procedure;\n    \\item @{text entry_proc} field stores the Ethereum address of the entry procedure;\n    \\item @{text proc_list} field stores the list of all registered procedures (with their data).\n  \\end{itemize}\n\\<close>\n\nrecord kernel =\n  curr_proc  :: key\n  entry_proc :: key\n  proc_list  :: procedure_list\n\ntext \\<open>\n  Here we introduce some useful abbreviations and definitions that will simplify the high-level\n  expression of the kernel state properties.\n\n  @{text nprocs} returns the number of the procedures registered in the kernel. @{text \\<sigma>} is a\n  parameter that refers to the state of the kernel storage.\n\\<close>\n\nabbreviation \"nprocs \\<sigma> \\<equiv> size \\<lfloor>proc_list \\<sigma>\\<rfloor>\"\n\ntext \\<open>Function that returns set of all current procedure indexes.\\<close>\n\ndefinition \"proc_ids \\<sigma> \\<equiv> {0..<nprocs \\<sigma>}\"\n\ntext \\<open>\n  @{text procs} returns map of procedure keys and corresponding procedures. This is an\n  alternative representation of an association list @{text procedure_list} described above.\n  Note that not all keys contain procedures.\n\\<close>\n\nabbreviation \"procs \\<sigma> \\<equiv> DAList.lookup \\<lfloor>proc_list \\<sigma>\\<rfloor>\"\n\ntext \\<open>\n  Auxiliary function that returns true if and only if a procedure with the key @{text k} is\n  registered in the state @{text \\<sigma>}.\n \\<close>\n\ndefinition \"has_key k \\<sigma> \\<equiv> k \\<in> dom (procs \\<sigma>)\"\n\ntext \\<open>\n  @{text proc} returns the procedure by its key. Can be used only if @{text \"has_key k \\<sigma> = True\"}.\n\\<close>\n\ndefinition \"proc \\<sigma> k \\<equiv> the (procs \\<sigma> k)\"\n\nabbreviation \"curr_proc' \\<sigma> \\<equiv> proc \\<sigma> (curr_proc \\<sigma>)\"\n\ntext \\<open>@{text proc_key} returns the procedure key by its index in the procedure list.\\<close>\n\nabbreviation \"proc_key \\<sigma> i \\<equiv> fst (\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> ! i)\"\n\ntext \\<open>@{text proc_id} returns the procedure index in the procedure list by its key.\\<close>\n\ndefinition \"proc_id \\<sigma> k \\<equiv> \\<lceil>length (takeWhile ((\\<noteq>) k \\<circ> fst) \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor>)\\<rceil> :: key_index\"\n\ntext \\<open>\n  @{text proc_id} always returns the procedure index that exists in the current state. Given that\n  index the correct corresponding procedure can be found in the procedure list.\n\\<close>\n\nlemma proc_id_alt[simp]:\n  \"has_key k \\<sigma> \\<Longrightarrow> \\<lfloor>proc_id \\<sigma> k\\<rfloor> \\<in> proc_ids \\<sigma>\"\n  \"has_key k \\<sigma> \\<Longrightarrow> \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> ! \\<lfloor>proc_id \\<sigma> k\\<rfloor> = (k, proc \\<sigma> k)\"\nproof-\n  assume \"has_key k \\<sigma>\"\n  hence 0:\"(k, proc \\<sigma> k) \\<in> set \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor>\"\n    unfolding has_key_def proc_def DAList.lookup_def\n    by auto\n  hence \"length (takeWhile ((\\<noteq>) k \\<circ> fst) \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor>) \\<in> proc_ids \\<sigma>\"\n    unfolding has_key_def proc_id_def proc_ids_def\n    using length_takeWhile_less[of \"\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> :: (key \\<times> procedure) list\" \"(\\<noteq>) k \\<circ> fst\"]\n    by force\n  moreover hence [simp]:\"\\<lfloor>\\<lceil>length (takeWhile ((\\<noteq>) k \\<circ> fst) \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor>)\\<rceil> :: key_index\\<rfloor> =\n                         length (takeWhile ((\\<noteq>) k \\<circ> fst) \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor>)\"\n    unfolding proc_ids_def\n    using key_index_inverse proc_list_rep[of \"proc_list \\<sigma>\"]\n    by auto\n  ultimately show 1:\"\\<lfloor>proc_id \\<sigma> k\\<rfloor> \\<in> proc_ids \\<sigma>\" unfolding proc_ids_def proc_id_def by simp\n\n  from 0 have \"\\<exists>! i. i < length \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> \\<and> \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> ! i = (k, proc \\<sigma> k)\"\n    using distinct_map by (auto intro!:distinct_Ex1)\n  moreover\n  {\n    fix p i j\n    assume 0:\"i < length \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor>\" and 1:\"j < length \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor>\"\n    moreover assume \"\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> ! i = (k, p)\" and \"fst (\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> ! j) = k\"\n    ultimately have \"snd (\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> ! j) = p\"\n      using impl_of_distinct nth_mem distinct_map[of fst] unfolding inj_on_def\n      by (metis fst_conv snd_conv)\n  }\n  ultimately have \"\\<forall> i < length \\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor>.\n                     fst (\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> ! i) = k \\<longrightarrow> snd (\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> ! i) = proc \\<sigma> k\"\n    by auto\n  with 1 show \"\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> ! \\<lfloor>proc_id \\<sigma> k\\<rfloor> = (k, proc \\<sigma> k)\"\n    unfolding proc_id_def proc_def proc_ids_def DAList.lookup_def\n    using nth_length_takeWhile[of \"(\\<noteq>) k \\<circ> fst\" \"\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rfloor> :: (key \\<times> procedure) list\"]\n    by (auto intro:prod_eqI)\nqed\n\ntext \\<open>Low-level representation of the kernel storage is a 256 x 256 bits key-value store.\\<close>\n\ndefinition \"kernel_rep (\\<sigma> :: kernel) r a \\<equiv>\n  case \\<lceil>a\\<rceil> of\n    None              \\<Rightarrow> r a\n  | Some addr         \\<Rightarrow> (case addr of\n      Nprocs          \\<Rightarrow> ucast (of_nat (nprocs \\<sigma>) :: key) OR r a \\<restriction> {LENGTH(key) ..<LENGTH(word32)}\n    | Proc_key i      \\<Rightarrow> ucast (proc_key \\<sigma> \\<lfloor>i\\<rfloor>) OR r a \\<restriction> {LENGTH(key) ..<LENGTH(word32)}\n    | Kernel          \\<Rightarrow> 0\n    | Curr_proc       \\<Rightarrow> ucast (curr_proc \\<sigma>) OR r a \\<restriction> {LENGTH(key) ..<LENGTH(word32)}\n    | Entry_proc      \\<Rightarrow> ucast (entry_proc \\<sigma>) OR r a \\<restriction> {LENGTH(key) ..<LENGTH(word32)}\n    | Heap_proc k off \\<Rightarrow> if has_key k \\<sigma>\n                         then proc_rep k (proc_id \\<sigma> k) (proc \\<sigma> k) r off\n                         else r a)\"\n\nadhoc_overloading rep kernel_rep\n\ntext \\<open>\n  If the number of procedures in two kernel states is the same, procedure keys that can be found\n  by the same index in two corresponding procedure lists are the same, and for each such procedure\n  key its data is also the same in both states, then procedure lists in both states are equal.\n\\<close>\n\nlemma proc_list_eqI[intro]:\n  assumes \"nprocs \\<sigma>\\<^sub>1 = nprocs \\<sigma>\\<^sub>2\"\n      and \"\\<And> i. i < nprocs \\<sigma>\\<^sub>1 \\<Longrightarrow> proc_key \\<sigma>\\<^sub>1 i = proc_key \\<sigma>\\<^sub>2 i\"\n      and \"\\<And> k. \\<lbrakk>has_key k \\<sigma>\\<^sub>1; has_key k \\<sigma>\\<^sub>2\\<rbrakk> \\<Longrightarrow> proc \\<sigma>\\<^sub>1 k = proc \\<sigma>\\<^sub>2 k\"\n    shows \"proc_list \\<sigma>\\<^sub>1 = proc_list \\<sigma>\\<^sub>2\"\n  unfolding has_key_def DAList.lookup_def proc_def\nproof-\n  from assms have \"\\<forall> i < nprocs \\<sigma>\\<^sub>1.\n                    snd (\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<^sub>1\\<rfloor>\\<rfloor> ! i) = snd (\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<^sub>2\\<rfloor>\\<rfloor> ! i)\"\n    unfolding has_key_def DAList.lookup_def proc_def\n    apply (auto iff:fun_eq_iff)\n    using\n      Some_eq_map_of_iff[of \"\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<^sub>1\\<rfloor>\\<rfloor>\"] Some_eq_map_of_iff[of \"\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<^sub>2\\<rfloor>\\<rfloor>\"]\n      nth_mem[of _ \"\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<^sub>1\\<rfloor>\\<rfloor>\"]          nth_mem[of _ \"\\<lfloor>\\<lfloor>proc_list \\<sigma>\\<^sub>2\\<rfloor>\\<rfloor>\"]\n      impl_of_distinct[of \"\\<lfloor>proc_list \\<sigma>\\<^sub>1\\<rfloor>\"]     impl_of_distinct[of \"\\<lfloor>proc_list \\<sigma>\\<^sub>2\\<rfloor>\"]\n    by (metis domIff option.sel option.simps(3) surjective_pairing)\n  with assms show ?thesis\n    by (auto intro!:nth_equalityI prod_eqI\n             iff:proc_list_rep_inject[symmetric] impl_of_inject[symmetric] fun_eq_iff)\nqed\n\ntext \\<open>Low-level representation of the kernel storage is injective.\\<close>\n\nlemma kernel_rep_inj[dest]: \"\\<lfloor>\\<sigma>\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>\\<sigma>\\<^sub>2\\<rfloor> r\\<^sub>2 \\<Longrightarrow> \\<sigma>\\<^sub>1 = \\<sigma>\\<^sub>2\" for \\<sigma>\\<^sub>1 \\<sigma>\\<^sub>2 :: kernel\nproof (rule kernel.equality)\n  assume \"\\<lfloor>\\<sigma>\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>\\<sigma>\\<^sub>2\\<rfloor> r\\<^sub>2\"\n  hence eq:\"\\<And> a. \\<lfloor>\\<sigma>\\<^sub>1\\<rfloor> r\\<^sub>1 a = \\<lfloor>\\<sigma>\\<^sub>2\\<rfloor> r\\<^sub>2 a\" by simp\n\n  from eq[of \"\\<lfloor>Curr_proc\\<rfloor>\"] show \"curr_proc \\<sigma>\\<^sub>1 = curr_proc \\<sigma>\\<^sub>2\"\n    unfolding kernel_rep_def by auto\n\n  from eq[of \"\\<lfloor>Entry_proc\\<rfloor>\"] show \"entry_proc \\<sigma>\\<^sub>1 = entry_proc \\<sigma>\\<^sub>2\"\n    unfolding kernel_rep_def by auto\n\n  from eq[of \"\\<lfloor>Nprocs\\<rfloor>\"] have \"nprocs \\<sigma>\\<^sub>1 = nprocs \\<sigma>\\<^sub>2\"\n    unfolding kernel_rep_def\n    using proc_list_rep[of \"proc_list \\<sigma>\\<^sub>1\"] proc_list_rep[of \"proc_list \\<sigma>\\<^sub>2\"]\n    by (auto iff:of_nat_inj[symmetric])\n  moreover {\n    fix i\n    assume \"i < nprocs \\<sigma>\\<^sub>1\"\n    with eq[of \"\\<lfloor>Proc_key \\<lceil>i\\<rceil>\\<rfloor>\"] have \"proc_key \\<sigma>\\<^sub>1 i = proc_key \\<sigma>\\<^sub>2 i\"\n      unfolding kernel_rep_def\n      using proc_list_rep[of \"proc_list \\<sigma>\\<^sub>1\"]\n      by (auto simp add:key_index_inject simp add: key_index_inverse)\n  }\n  moreover {\n    fix k\n    assume \"has_key k \\<sigma>\\<^sub>1\" and \" has_key k \\<sigma>\\<^sub>2\"\n    with eq[of \"\\<lfloor>Heap_proc k _\\<rfloor>\"] have \"proc \\<sigma>\\<^sub>1 k = proc \\<sigma>\\<^sub>2 k\"\n      unfolding kernel_rep_def\n      by (auto iff:fun_eq_iff[symmetric])\n  }\n  ultimately show \"proc_list \\<sigma>\\<^sub>1 = proc_list \\<sigma>\\<^sub>2\" ..\nqed simp\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas kernel_invertible[intro] = invertible2.intro[OF inj2I, OF kernel_rep_inj]\n\ninterpretation kernel_inv: invertible2 kernel_rep ..\n\nadhoc_overloading abs kernel_inv.inv2\n\nlemma kernel_update_neq[simp]: \"\\<not> limited_and prefix_bound a \\<Longrightarrow> \\<lfloor>\\<sigma>\\<rfloor> r a = r a\"\nproof-\n  assume \"\\<not> limited_and prefix_bound a\"\n  hence \"(\\<lceil>a\\<rceil> :: address option) = None\"\n    using addr_prefix by - (rule ccontr, auto)\n  thus ?thesis unfolding kernel_rep_def by auto\nqed\n\nsection \\<open>Call formats\\<close>\n\ntext \\<open>Here we describe formats of all available system calls.\\<close>\n\nprimrec split :: \"'a::len word list \\<Rightarrow> 'b::len word list list\" where\n  \"split []       = []\" |\n  \"split (x # xs) = word_rsplit x # split xs\"\n\nlemma cat_split: \"map word_rcat (split x) = x\"\n  unfolding split_def\n  by (induct x, simp_all add:word_rcat_rsplit)\n\nlemma split_inj[dest]: \"split x = split y \\<Longrightarrow> x = y\"\n  by (frule arg_cong[where f=\"map word_rcat\"]) (subst (asm) cat_split)+\n\nlemma split_distrib[simp]:\"split (a @ b) = split a @ split b\" by (induct a, simp_all)\n\nlemma split_length_indep[dest]: \"length a = length b \\<Longrightarrow> length (split a) = length (split b)\"\nproof (induct a arbitrary:b, simp)\n  case (Cons x xs)\n  from Cons(1)[of \"tl b\"] Cons(2) show ?case by (cases b, simp_all)\nqed\n\nlemma split_concat_length_indep[dest]:\n  \"length a = length b \\<Longrightarrow>\n   length (concat (split a :: 'b::len word list list)) =\n   length (concat (split b :: 'b::len word list list))\"\n  for a b :: \"'a::len word list\"\nproof (induct a arbitrary:b, simp)\n  case (Cons x xs)\n  from Cons(1)[of \"tl b\"] Cons(2) show ?case by (cases b, simp_all add:word_rsplit_len_indep)\nqed\n\nlemma split_lengths:\n  \"i \\<in> set (split (a :: 'a::len word list) :: 'b::len word list list)\n   \\<Longrightarrow> length i = (LENGTH('a) + LENGTH('b) - 1) div LENGTH('b)\"\n  by (induct a, auto simp add:length_word_rsplit_exp_size')\n\nlemma sum_list_mul[simp]:\"\\<forall> x \\<in> set l. f x = n \\<Longrightarrow> sum_list (map f l) = n * length l\"\n  by (induct l, simp_all)\n\nlemma length_split[simp]: \"length (split a) = length a\" by (induct a, simp_all)\n\nlemma length_concat_split[simp]:\n  \"length (concat (split (a :: 'a::len word list) :: 'b::len word list list)) =\n   (LENGTH('a) + LENGTH('b) - 1) div LENGTH('b) * length a\"\n  using split_lengths[of _ a]\n  by (auto simp add:length_concat, subst sum_list_mul, auto)\n\nfunction (sequential, domintros) cat :: \"'a::len word list \\<Rightarrow> 'b::len word list\" where\n  \"cat [] = []\" |\n  \"cat l  =\n    (let d = LENGTH('b) div LENGTH('a) in word_rcat (take d l) # cat (drop d l))\"\n  using list.exhaust by auto\n\nfun group_by' :: \"'a list \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> 'a list \\<Rightarrow> 'a list list\" where\n  \"group_by' g _ _ []             = [rev g]\" |\n  \"group_by' g 0 n (x # xs)       = rev g # group_by' [x] (n - 1) n xs\" |\n  \"group_by' g (Suc m) n (x # xs) = group_by' (x # g) m n xs\"\n\nlemma concat_group_by': \"concat (group_by' g m n l) = rev g @ l\"\n  by (induct rule:group_by'.induct[of _ g _ _ l], simp_all)\n\nlemma group_by'_lengths:\n  \"\\<lbrakk>0 < n; length g + m = n; m \\<le> length l; n dvd length g + length l\\<rbrakk>\n   \\<Longrightarrow> \\<forall> x \\<in> set (group_by' g m n l). length x = n\"\nproof (induct rule:group_by'.induct[of _ g m n l])\n  case (1 g m n)\n  thus ?case by simp\nnext\n  case (2 g n x xs)\n  from 2(2) have p0:\"length [x] + (n - 1) = n\" by simp\n  from 2(2-5) have p1:\"n - 1 \\<le> length xs\"\n    by (simp add: diff_add_inverse dvd_imp_le le_diff_conv less_eq_dvd_minus)\n  from 2(3,5) have p2:\"n dvd length [x] + length xs\" using dvd_add_triv_left_iff by fastforce\n  from 2(3) 2(1)[OF 2(2) p0 p1 p2] show ?case by simp\nnext\n  case (3 g m n x xs)\n  from 3(3) have p0:\"length (x # g) + m = n\" by simp\n  from 3(4) have p1:\"m \\<le> length xs\" by simp\n  from 3(5) have p2:\"n dvd length (x # g) + length xs\" by simp\n  from 3(1)[OF 3(2) p0 p1 p2] show ?case by simp\nqed\n\ndefinition \"group_by n l \\<equiv> if l = [] then [] else group_by' [] n n l\"\n\nlemma concat_group_by[simp]: \"concat (group_by n l) = l\"\n  unfolding group_by_def using concat_group_by'[of \"[]\" n n l] by simp\n\nlemma group_by_lengths[intro]: \"\\<lbrakk>0 < n; n dvd length l; x \\<in> set (group_by n l)\\<rbrakk> \\<Longrightarrow> length x = n\"\n  unfolding group_by_def using group_by'_lengths[of n \"[]\" n l]\n  by (auto dest:dvd_imp_le split:if_splits)\n\nlemma cat_induct[consumes 2]:\n  assumes major0:\"0 < n\" and major1:\"n dvd length l\"\n      and base: \"P []\"\n      and induct:\"\\<And> l. P (drop n l) \\<Longrightarrow> P l\"\n    shows \"P l\"\nproof-\n  obtain u where\n    \"l = concat u\" and\n    \"\\<forall> x \\<in> set u. length x = n\" and\n    \"concat (tl u) = drop n l\"\n  proof-\n    have p0:\"l = concat (group_by n l)\" by simp\n    from major0 and major1 have p1:\"\\<forall>x \\<in> set (group_by n l). length x = n\" by auto\n    from p0 p1 have p2:\"concat (tl (group_by n l)) = drop n l\" by (cases \"group_by n l\", simp_all)\n    from that[of \"group_by n l\"] p0 p1 p2 show ?thesis .\n  qed\n  thus ?thesis proof (induct u arbitrary:l)\n    case Nil\n    with base show ?case by simp\n  next\n    case (Cons u us)\n    let ?l = \"concat us\"\n    from Cons(3) have 0:\"\\<forall>x\\<in>set us. length x = n\" by simp\n    from Cons(3) have 1:\"concat (tl us) = drop n ?l\" by (cases us, simp_all)\n    from Cons(2,3) have \"concat us = drop n l\" by simp\n    with Cons(1)[of ?l, simplified, OF 0 1] induct[of l] show ?case by simp\n  qed\nqed\n\nlemma cat_domintros_2:\n  \"cat_dom TYPE('b::len) (drop (LENGTH('b) div LENGTH('a)) l) \\<Longrightarrow> cat_dom TYPE('b) l\"\n  for l :: \"'a::len word list\"\n  by (cases l, auto intro:cat.domintros)\n\nlemmas cat_domintros = cat.domintros(1) cat_domintros_2\n\nlemma cat_dom_divides[intro]:\n  \"\\<lbrakk>0 < LENGTH('b::len) div LENGTH('a); (LENGTH('b) div LENGTH('a)) dvd length l\\<rbrakk>\n   \\<Longrightarrow> cat_dom (TYPE ('b)) l\"\n  for l :: \"'a::len word list\"\n  by (induct l rule:cat_induct, auto intro:cat_domintros)\n\nlemma concat_split:\n  \"LENGTH('b) dvd LENGTH('a) \\<Longrightarrow> cat (concat (split a) :: 'b::len word list) = a\"\n  (is \"?dvd \\<Longrightarrow> cat (?concat a) = a\")\n  for a :: \"'a::len word list\"\nproof -\n  assume ?dvd\n  moreover hence \"(LENGTH('a) div LENGTH('b)) dvd length (?concat a)\"\n    by (simp, metis dvd_div_mult_self dvd_mult2 dvd_refl given_quot_alt len_gt_0)\n  ultimately have dom:\"cat_dom TYPE('a) (?concat a)\" using div_positive dvd_imp_le by blast\n  thus ?thesis proof (induction a)\n    case Nil\n    note [simp] = cat.psimps(1)[OF cat.domintros(1)] cat.psimps(2)\n    thus ?case by simp\n  next\n    case (Cons x xs)\n    from \\<open>?dvd\\<close> have x:\"length (word_rsplit x) > 0\"\n      using length_word_rsplit_lt_size by fastforce\n    then obtain y ys where y:\"?concat (x # xs) = y # ys\"\n      apply (auto iff:neq_Nil_conv)\n      using x list_exhaust_size_gt0 by auto\n    with Cons(2) have 0:\"cat_dom TYPE('a) (y # ys)\" by simp\n    note [simp] = cat.psimps(2)[OF 0]\n    from \\<open>?dvd\\<close> have len:\"length (word_rsplit x :: 'b word list) = LENGTH('a) div LENGTH('b)\"\n      by (metis dvd_div_mult_self length_word_rsplit_even_size word_size)\n    from \\<open>?dvd\\<close> len x have dom0:\"0 < LENGTH('a) div LENGTH('b)\" by auto\n    from \\<open>?dvd\\<close> have\n      dom1:\"LENGTH('a) div LENGTH('b) dvd\n       (LENGTH('a) + LENGTH('b) - 1) div LENGTH('b) * length xs\"\n      by (metis dvd_def len length_word_rsplit_exp_size' word_size)\n    from cat_dom_divides[of \"?concat xs\", OF dom0] dom1\n    have dom:\"cat_dom TYPE('a) (?concat xs)\" by simp\n    from Cons(1)[OF dom] show ?case unfolding y by (simp, fold y, simp add:len word_rcat_rsplit)\n  qed\nqed\n\nlemma concat_split':\"cat (concat (split a :: byte list list)) = a\" for a :: \"word32 list\"\n  by (auto intro:concat_split)\n\nsubsection \\<open>Deterministic inverse function\\<close>\n\ndefinition \"maybe_inv2_tf z f l \\<equiv>\n  if \\<exists> n. takefill z n l \\<in> range2 f\n  then Some (the_inv2 f (takefill z (SOME n. takefill z n l \\<in> range2 f) l))\n  else None\"\n\nlemma takefill_implies_prefix:\n  assumes \"x = takefill u n y\"\n  obtains (Prefix) \"prefix x y\" | (Postfix) \"prefix y x\"\nproof (cases \"length x \\<le> length y\")\n  case True\n  with assms have \"prefix x y\" unfolding takefill_alt by (simp add: take_is_prefix)\n  with that show ?thesis by simp\nnext\n  case False\n  with assms have \"prefix y x\" unfolding takefill_alt by simp\n  with that show ?thesis by simp\nqed\n\nlemma takefill_prefix_inj:\n  \"\\<lbrakk>\\<And> x y. \\<lbrakk>P x; P y; prefix x y\\<rbrakk> \\<Longrightarrow> x = y; P x; P y; x = takefill u n y\\<rbrakk> \\<Longrightarrow> x = y\"\n  by (elim takefill_implies_prefix) auto\n\ndefinition \"inj2_tf f \\<equiv> \\<forall> x\\<^sub>1 y\\<^sub>1 x\\<^sub>2 y\\<^sub>2. prefix (f x\\<^sub>1 y\\<^sub>1) (f x\\<^sub>2 y\\<^sub>2) \\<longrightarrow> x\\<^sub>1 = x\\<^sub>2\"\n\nlemma inj2_tfI: \"(\\<And> x\\<^sub>1 y\\<^sub>1 x\\<^sub>2 y\\<^sub>2. prefix (f x\\<^sub>1 y\\<^sub>1) (f x\\<^sub>2 y\\<^sub>2) \\<Longrightarrow> x\\<^sub>1 = x\\<^sub>2) \\<Longrightarrow> inj2_tf f\"\n  unfolding inj2_tf_def\n  by blast\n\nlemma exI2[intro]: \"P x y \\<Longrightarrow> \\<exists> x y. P x y\" by auto\n\nlemma maybe_inv2_tf_inj[intro]:\n  \"\\<lbrakk>inj2_tf f; \\<And> x y y'. length (f x y) = length (f x y')\\<rbrakk> \\<Longrightarrow> maybe_inv2_tf z f (f x y) = Some x\"\n  unfolding maybe_inv2_tf_def range2_def the_inv2_def inj2_tf_def\n  apply (auto split:if_splits)\n   apply (subst some1_equality[rotated], erule exI2)\n     apply (metis length_takefill takefill_implies_prefix)\n  apply (smt length_takefill takefill_implies_prefix the_equality)\n  by (meson takefill_same)\n\nlemma maybe_inv2_tf_inj':\n  \"\\<lbrakk>inj2_tf f; \\<And> x y y'. length (f x y) = length (f x y')\\<rbrakk> \\<Longrightarrow>\n    maybe_inv2_tf z f v = Some x \\<Longrightarrow> \\<exists> y n. f x y = takefill z n v\"\n  unfolding maybe_inv2_tf_def range2_def the_inv2_def inj2_tf_def\n  apply (simp split:if_splits)\n  apply (subst (asm) some1_equality[rotated], erule exI2)\n   apply (metis length_takefill nat_less_le not_less take_prefix take_takefill)\n  by (smt prefix_order.eq_iff the1_equality)\n\nlocale invertible2_tf =\n  fixes rep :: \"'a \\<Rightarrow> 'c \\<Rightarrow> 'c::zero list\" (\"\\<lfloor>_\\<rfloor>\")\n  assumes inj:\"inj2_tf rep\"\n      and len_inv:\"\\<And> x y y'. length (rep x y) = length (rep x y')\"\nbegin\ndefinition inv2_tf :: \"'c list \\<Rightarrow> 'a option\" where \"inv2_tf \\<equiv> maybe_inv2_tf 0 rep\"\n\nlemmas inv2_tf_inj[folded inv2_tf_def, simp] = maybe_inv2_tf_inj[where z=0, OF inj len_inv]\n\nlemmas inv2_tf_inj'[folded inv2_tf_def, dest] = maybe_inv2_tf_inj'[where z=0, OF inj len_inv]\nend\n\nsubsection \\<open>Register system call\\<close>\n\ntext \\<open>\n  Definition of well-formedness for capability @{text l} (represented as a 32-byte machine word\n  list) of type @{text c}. @{text l} must be correctly formatted to be correctly decoded into\n  the more high-level representation.\n\\<close>\n\ndefinition \"wf_cap c l \\<equiv>\n  case (c, l) of\n    (Entry, [])       \\<Rightarrow> True\n  | (_,     [])       \\<Rightarrow> True \\<comment> \\<open>A hole representing a copy of the parent capability\\<close>\n  | (Call,  [c])      \\<Rightarrow> (\\<lceil>c\\<rceil> :: prefixed_capability option) \\<noteq> None\n  | (Reg,   [c])      \\<Rightarrow> (\\<lceil>c\\<rceil> :: prefixed_capability option) \\<noteq> None\n  | (Del,   [c])      \\<Rightarrow> (\\<lceil>c\\<rceil> :: prefixed_capability option) \\<noteq> None\n  | (Write, [c1, c2]) \\<Rightarrow> (\\<lceil>(c1, c2)\\<rceil> :: write_capability option) \\<noteq> None\n  | (Log,   c)        \\<Rightarrow> (\\<lceil>c\\<rceil> :: log_capability option) \\<noteq> None\n  | (Send,  [c])      \\<Rightarrow> (\\<lceil>c\\<rceil> :: external_call_capability option) \\<noteq> None\n  | _                 \\<Rightarrow> False\"\n\ntext \\<open>\n  If some capability @{text l} of the type @{text c} is well-formed, then the length of l\n  (word list) is smaller or equal to 5.\n\\<close>\n\nlemma length_wf_cap[dest]: \"wf_cap c l \\<Longrightarrow> length l \\<le> 5\" (is \"?wf \\<Longrightarrow> _\")\nproof-\n  have [dest]: \"\\<lceil>h # t\\<rceil> = Some y \\<Longrightarrow> length t \\<le> 4\" for h t and y :: log_capability\n  using log_cap_inv.inv_inj'[of \"h # t\" y] log_cap_rep_length[of y] log_cap_rep'[of y] by simp\n  assume ?wf thus ?thesis unfolding wf_cap_def by (auto split:capability.splits list.splits)\nqed\n\ntext \\<open>\n  Capabilities @{text l\\<^sub>1} and @{text l\\<^sub>2} of the type @{text c} are the same if their high-level\n  representation are the same.\n\\<close>\n\ndefinition \"same_cap c l\\<^sub>1 l\\<^sub>2 \\<equiv>\n  case (c, l\\<^sub>1, l\\<^sub>2) of\n    (Entry, [],   [])              \\<Rightarrow> True\n  | (_,     [],   [])              \\<Rightarrow> True \\<comment> \\<open>The same parent capability\\<close>\n  | (Call,  [c\\<^sub>1], [c\\<^sub>2])            \\<Rightarrow> the \\<lceil>c\\<^sub>1\\<rceil> = (the \\<lceil>c\\<^sub>2\\<rceil> :: prefixed_capability)\n  | (Reg,   [c\\<^sub>1], [c\\<^sub>2])            \\<Rightarrow> the \\<lceil>c\\<^sub>1\\<rceil> = (the \\<lceil>c\\<^sub>2\\<rceil> :: prefixed_capability)\n  | (Del,   [c\\<^sub>1], [c\\<^sub>2])            \\<Rightarrow> the \\<lceil>c\\<^sub>1\\<rceil> = (the \\<lceil>c\\<^sub>2\\<rceil> :: prefixed_capability)\n  | (Write, [c1\\<^sub>1, c2\\<^sub>1], [c1\\<^sub>2, c2\\<^sub>2]) \\<Rightarrow> the \\<lceil>(c1\\<^sub>1, c2\\<^sub>1)\\<rceil> = (the \\<lceil>(c1\\<^sub>2, c2\\<^sub>2)\\<rceil> :: write_capability)\n  | (Log,   c\\<^sub>1,   c\\<^sub>2)              \\<Rightarrow> length c\\<^sub>1 = length c\\<^sub>2 \\<and>\n                                     the \\<lceil>c\\<^sub>1\\<rceil> = (the \\<lceil>c\\<^sub>2\\<rceil> :: log_capability)\n  | (Send,  [c\\<^sub>1], [c\\<^sub>2])            \\<Rightarrow> the \\<lceil>c\\<^sub>1\\<rceil> = (the \\<lceil>c\\<^sub>2\\<rceil> :: external_call_capability)\n  |  _                             \\<Rightarrow> False\"\n\ntext \\<open>\n  Some capability formats have undefined bits or bytes. Here we define function that takes\n  capability @{text l} of the type @{text c} and writes it over some 32-byte machine word list\n  @{text r} in such a way that these undefined parts will contain corresponding parts from\n  @{text r}.\n\\<close>\n\ndefinition \"overwrite_cap c l r \\<equiv>\n  case (c, l) of\n    (Entry, [])         \\<Rightarrow> []\n  | (_,     [])         \\<Rightarrow> [] \\<comment> \\<open>Parent capabilty\\<close>\n  | (Call,  [c])        \\<Rightarrow> [\\<lfloor>the \\<lceil>c\\<rceil> :: prefixed_capability\\<rfloor> (r ! 0)]\n  | (Reg,   [c])        \\<Rightarrow> [\\<lfloor>the \\<lceil>c\\<rceil> :: prefixed_capability\\<rfloor> (r ! 0)]\n  | (Del,   [c])        \\<Rightarrow> [\\<lfloor>the \\<lceil>c\\<rceil> :: prefixed_capability\\<rfloor> (r ! 0)]\n  | (Write, [c1, c2])   \\<Rightarrow> let (c1, c2) = \\<lfloor>the \\<lceil>(c1, c2)\\<rceil> :: write_capability\\<rfloor> in [c1, c2]\n                           \\<comment> \\<open>for mere consistency, no actual need in this,\n                               can be just [c1, c2]\\<close>\n  | (Log,   c)          \\<Rightarrow> \\<lfloor>the \\<lceil>c\\<rceil> :: log_capability\\<rfloor>\n  | (Send,  [c])        \\<Rightarrow> [\\<lfloor>the \\<lceil>c\\<rceil> :: external_call_capability\\<rfloor> (r ! 0)]\"\n\ntext \\<open>\n  If some capability @{text l} of the type @{text c} is well-wormed, then the result of its writing\n  over a 32-byte machine word list @{text r} will also be well-formed.\n\\<close>\n\nabbreviation \"zero_fill l \\<equiv> replicate (length l) 0\"\n\ntext \\<open>\n  Writing two equal capabilities over 32-byte machine word list filled with zeroes will produce the\n  same result.\n\\<close>\n\nlemma same_cap_inj[dest]:\n  \"same_cap c l\\<^sub>1 l\\<^sub>2 \\<Longrightarrow> overwrite_cap c l\\<^sub>1 (zero_fill l\\<^sub>1) = overwrite_cap c l\\<^sub>2 (zero_fill l\\<^sub>2)\"\n  unfolding same_cap_def overwrite_cap_def\n  by (simp split:capability.splits) (auto split:capability.splits list.splits)+\n\ntext \\<open>\n  If the result of writing capability @{text l\\<^sub>1} over @{text r\\<^sub>1} is equal to the result of writing\n  @{text l\\<^sub>2} over @{text r\\<^sub>2}, and both these capabilities are well-formed, then they are the same.\n\\<close>\n\nlemma overwrite_cap_inj[dest]:\n  \"\\<lbrakk>overwrite_cap c l\\<^sub>1 r\\<^sub>1 = overwrite_cap c l\\<^sub>2 r\\<^sub>2; wf_cap c l\\<^sub>1; wf_cap c l\\<^sub>2\\<rbrakk> \\<Longrightarrow> same_cap c l\\<^sub>1 l\\<^sub>2\"\n  unfolding wf_cap_def overwrite_cap_def same_cap_def\n  by (simp split:capability.splits; cases l\\<^sub>1; cases l\\<^sub>2)\n    (auto split:capability.splits list.splits simp add:write_cap_inv.inv_inj' log_cap_inv.inv_inj')\n\ntext \\<open>Writing well-formed capability over some machine word list some does not change its length.\\<close>\n\nlemma length_overwrite_cap[simp]: \"wf_cap c l \\<Longrightarrow> length (overwrite_cap c l r) = length l\"\n  unfolding wf_cap_def overwrite_cap_def\n  apply (auto split:capability.splits list.split prod.split)\n  using log_cap_rep_length[of \"the \\<lceil>l\\<rceil>\"] by (simp add:log_cap_inv.inv_inj')\n\ntext \\<open>\n  Introduce type the described capability data as sent in the Register Procedure system call.\n  It is represented as a list of elements, each of which contains some capability type, capability\n  index, and well-formed capability itself.\n\\<close>\n\ntypedef capability_data =\n  \"{ l :: ((capability \\<times> capability_index) \\<times> word32 list) list.\n       \\<forall> ((c, _), l) \\<in> set l. wf_cap c l \\<and> l = overwrite_cap c l (zero_fill l) }\"\n  morphisms cap_data_rep' cap_data\n  by (intro exI[of _ \"[]\"], simp)\n\nadhoc_overloading rep cap_data_rep'\n\nadhoc_overloading abs cap_data\n\ntext \\<open>\n  Data format of the Register Procedure system call is modeled as a record with three fields:\n  \\begin{itemize}\n    \\item @{text proc_key}: procedure key;\n    \\item @{text eth_addr}: procedure Ethereum address;\n    \\item @{text cap_data}: a series of capabilities, and each one is in the format specified above.\n  \\end{itemize}\n\\<close>\n\nrecord register_call_data =\n  proc_key :: key\n  eth_addr :: ethereum_address\n  cap_data :: capability_data\n\nno_adhoc_overloading rep cap_index_rep\n\nno_adhoc_overloading abs cap_index_inv.inv\n\ntext \\<open>\n  Redefine low-level representation of capability index. Previously it started with 1, but in the\n  call data format it should start with 0.\n\\<close>\n\ndefinition \"cap_index_rep0 i \\<equiv> of_nat \\<lfloor>i\\<rfloor> :: byte\" for i :: capability_index\n\nadhoc_overloading rep cap_index_rep0\n\ntext \\<open>\n  A single byte is sufficient to store the least number of bits of capability index representation.\n\\<close>\n\nlemma width_cap_index0: \"width \\<lfloor>i\\<rfloor> \\<le> LENGTH(byte)\" for i :: capability_index by simp\n\nlemma width_cap_index0'[simp]: \"LENGTH(byte) \\<le> n \\<Longrightarrow> width \\<lfloor>i\\<rfloor> \\<le> n\"\n  for i :: capability_index by simp\n\ntext \\<open>Capability index representation is injective.\\<close>\n\nlemma cap_index_inj0[simp]: \"(\\<lfloor>i\\<^sub>1\\<rfloor> :: byte) = \\<lfloor>i\\<^sub>2\\<rfloor> \\<Longrightarrow> i\\<^sub>1 = i\\<^sub>2\" for i\\<^sub>1 i\\<^sub>2 :: capability_index\n  unfolding cap_index_rep0_def\n  using cap_index_rep'[of i\\<^sub>1] cap_index_rep'[of i\\<^sub>2] word_of_nat_inj[of \"\\<lfloor>i\\<^sub>1\\<rfloor>\" \"\\<lfloor>i\\<^sub>2\\<rfloor>\"]\n        cap_index_rep'_inject\n  by force\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas cap_index0_invertible[intro] = invertible.intro[OF injI, OF cap_index_inj0]\n\ninterpretation cap_index_inv0: invertible cap_index_rep0 ..\n\nadhoc_overloading abs cap_index_inv0.inv\n\ntext \\<open>\n  Low-level representation of a single element from the capability data list. It starts with the\n  number of 32-byte machine words associated with the capability, which is 3 + the length of the\n  capability, and stored in a byte aligned right in the 32 bytes. Then there is the type of the\n  capability and the index into the capability list of this type for the current procedure,\n  both of which are also represented as bytes aligned right in the 32 bytes. And finally there is\n  the capability itself as a 32-byte machine word list.\n\\<close>\n\nabbreviation \"cap_data_rep_single r (c :: capability) (i :: capability_index) l j \\<equiv>\n  [ucast (of_nat (3 + length l) :: byte) OR (r ! j) \\<restriction> {LENGTH(byte) ..<LENGTH(word32)},\n   ucast \\<lfloor>c\\<rfloor> OR (r ! (j + 1)) \\<restriction> {LENGTH(byte) ..<LENGTH(word32)},\n   ucast \\<lfloor>i\\<rfloor> OR (r ! (j + 2)) \\<restriction> {LENGTH(byte) ..<LENGTH(word32)}]\n  @ overwrite_cap c l (drop (j + 3) r)\"\n\ntext \\<open>\n  Auxiliary function that will be applied to each element from the capability data list to get its\n  low-level representation.\n\\<close>\n\ndefinition \"cap_data_rep0 r \\<equiv>\n  \\<lambda> ((c, i), l) (j, d). (j + 3 + length l, cap_data_rep_single r c i l j # d)\"\n\ntext \\<open>\n  Length of each element from the capability data list is correctly stored in the element itself\n  in its head (since the element is also a list).\n\\<close>\n\nlemma length_cap_data_rep0:\n  fixes d :: capability_data\n  assumes \"cap_data_rep0 r ((c, i), l) acc = (j, x # xs)\" and \"((c, i), l) \\<in> set \\<lfloor>d\\<rfloor>\"\n  shows   \"length x = unat (hd x AND mask LENGTH(byte))\"\nproof-\n  from assms(2) have \"wf_cap c l\" using cap_data_rep'[of d] by auto\n  with assms(1) show ?thesis\n    unfolding cap_data_rep0_def\n    by (force split:prod.splits simp add:unat_ucast_upcast unat_of_nat_eq)\nqed\n\nlemma length_cap_data_rep0':\n  \"\\<lbrakk>[l] = snd (cap_data_rep0 r x acc); x \\<in> set \\<lfloor>d\\<rfloor>\\<rbrakk> \\<Longrightarrow>\n     length l = unat (hd l AND mask LENGTH(byte))\"\n  (is \"\\<lbrakk>?l; ?in_set\\<rbrakk> \\<Longrightarrow> _\")\n  for d :: capability_data\nproof-\n  assume ?l and ?in_set\n  obtain c i l' j\n    where \"cap_data_rep0 r ((c, i), l') acc = (j, l # [])\"\n      and \"((c, i), l') \\<in> set \\<lfloor>d\\<rfloor>\"\n  proof (cases \"cap_data_rep0 r x acc\", cases x, cases \"fst x\")\n    fix c i l' j ci ls\n    assume \"cap_data_rep0 r x acc = (j, ls)\" and \"x = (ci, l')\" and \"fst x = (c, i)\"\n    with that[of c i l' j] \\<open>?in_set\\<close> \\<open>?l\\<close> show ?thesis by simp\n  qed\n  thus ?thesis using length_cap_data_rep0 by simp\nqed\n\ntext \\<open>\n  Low-level representation of the capability data list is achieved by applying the\n  @{text \"cap_data_rep0\"} function to each element of the list.\n\\<close>\n\ndefinition \"cap_data_rep (d :: capability_data) r \\<equiv> fold (cap_data_rep0 r) \\<lfloor>d\\<rfloor>\"\n\nlemma cap_data_rep'_tail: \"\\<lfloor>d\\<rfloor> = x # xs \\<Longrightarrow> xs = \\<lfloor>\\<lceil>xs\\<rceil>\\<rfloor>\" for d :: capability_data\n  using cap_data_rep'[of d]\n  by (auto intro:cap_data_inverse[symmetric])\n\nlemma length_snd_fold_cap_data_rep0:\n  \"length (snd (fold (cap_data_rep0 r) xs i)) = length xs + length (snd i)\"\n  unfolding cap_data_rep0_def by (induction xs arbitrary: i, simp_all split:prod.split)\n\nlemma length_snd_cap_data_rep[simp]:\n  \"length (snd (cap_data_rep d r i)) = length \\<lfloor>d\\<rfloor> + length (snd i)\"\n  unfolding cap_data_rep_def by (simp add:length_snd_fold_cap_data_rep0)\n\ntext \\<open>\n  First we prove injectivity of \"extended\" capability data representation, i.e. for capability\n  data represented as a list of separate lists (of 32-byte words), each corresponding to a\n  low-level representation of one capability. The outer list is paired with the total length of\n  the representations. This directly corresponds\n  to the result of @{const \"cap_data_rep\"}. However, to obtain the actual representation,\n  we later take only the list of lists out from this result (no total length),\n  then reverse and concatenate it.\n  So this lemma is not enough to show the overall injectivity of the representation, but\n  in the following we reduce overall injectivity to this intermediate result. We do this by\n  proving that the total length is unambiguously recoverable from the resulting lists and that\n  the resulting list of lists can be recovered from the concatenated list due to the lengths\n  encoded in the initial 32-byte words.\n\\<close>\n\nlemma cap_data_rep_inj[dest]:\n  \"\\<lbrakk>cap_data_rep d\\<^sub>1 r\\<^sub>1 i\\<^sub>1 = cap_data_rep d\\<^sub>2 r\\<^sub>2 i\\<^sub>2; length (snd i\\<^sub>1) = length (snd i\\<^sub>2)\\<rbrakk> \\<Longrightarrow> d\\<^sub>1 = d\\<^sub>2\"\n  (is \"\\<lbrakk>?eq_rep d\\<^sub>1 i\\<^sub>1 d\\<^sub>2 i\\<^sub>2; ?eq_length i\\<^sub>1 i\\<^sub>2\\<rbrakk> \\<Longrightarrow> _\")\nproof (induction \"\\<lfloor>d\\<^sub>1\\<rfloor>\" arbitrary:d\\<^sub>1 d\\<^sub>2 i\\<^sub>1 i\\<^sub>2)\n  case Nil\n  moreover hence \"length (snd (cap_data_rep d\\<^sub>1 r\\<^sub>1 i\\<^sub>1)) = length (snd i\\<^sub>1)\" by (simp (no_asm))\n  ultimately have \"\\<lfloor>d\\<^sub>1\\<rfloor> = \\<lfloor>d\\<^sub>2\\<rfloor>\" by simp\n  thus ?case by (simp add:cap_data_rep'_inject)\nnext\n  {\n    fix xs j\\<^sub>1 j\\<^sub>2 l\\<^sub>1 l\\<^sub>2\n    have \"fold (cap_data_rep0 r\\<^sub>1) xs (j\\<^sub>1, l\\<^sub>1) = fold (cap_data_rep0 r\\<^sub>2) xs (j\\<^sub>2, l\\<^sub>2) \\<Longrightarrow> l\\<^sub>1 = l\\<^sub>2\"\n      unfolding cap_data_rep0_def\n      by (induction xs arbitrary: j\\<^sub>1 j\\<^sub>2 l\\<^sub>1 l\\<^sub>2, auto split:prod.splits)\n  } note inj = this\n  case (Cons x xs)\n  hence \"length \\<lfloor>d\\<^sub>2\\<rfloor> = length \\<lfloor>d\\<^sub>1\\<rfloor>\" by (metis add_right_cancel length_snd_cap_data_rep)\n  with \\<open>x # xs = \\<lfloor>d\\<^sub>1\\<rfloor>\\<close> obtain y ys where \"\\<lfloor>d\\<^sub>2\\<rfloor> = y # ys\" by (metis length_Suc_conv)\n  from \\<open>x # xs = \\<lfloor>d\\<^sub>1\\<rfloor>\\<close> have d\\<^sub>1:\"\\<lfloor>d\\<^sub>1\\<rfloor> = x # xs\" ..\n  note d\\<^sub>2 = \\<open>\\<lfloor>d\\<^sub>2\\<rfloor> = y # ys\\<close>\n  from \\<open>?eq_rep d\\<^sub>1 i\\<^sub>1 d\\<^sub>2 i\\<^sub>2\\<close> obtain i\\<^sub>1' and i\\<^sub>2'\n    where \"cap_data_rep \\<lceil>xs\\<rceil> r\\<^sub>1 i\\<^sub>1' = cap_data_rep \\<lceil>ys\\<rceil> r\\<^sub>2 i\\<^sub>2'\"\n      and \"length (snd i\\<^sub>1') = length (snd i\\<^sub>1) + 1\"\n      and \"length (snd i\\<^sub>2') = length (snd i\\<^sub>2) + 1\"\n    unfolding cap_data_rep_def cap_data_rep0_def\n    using cap_data_rep'_tail[OF d\\<^sub>2] cap_data_rep'_tail[OF d\\<^sub>1]\n    by (auto simp add:d\\<^sub>1 d\\<^sub>2 split:prod.split)\n  with \\<open>?eq_rep d\\<^sub>1 i\\<^sub>1 d\\<^sub>2 i\\<^sub>2\\<close> \\<open>?eq_length i\\<^sub>1 i\\<^sub>2\\<close> have tls:\"xs = ys\"\n    using cap_data_rep'_tail[OF d\\<^sub>1] cap_data_rep'_tail[OF d\\<^sub>2]\n    by (auto dest:Cons.hyps(1)[OF cap_data_rep'_tail[OF d\\<^sub>1]])\n  with \\<open>?eq_rep d\\<^sub>1 i\\<^sub>1 d\\<^sub>2 i\\<^sub>2\\<close> d\\<^sub>1 d\\<^sub>2 have \"snd (cap_data_rep0 r\\<^sub>1 x i\\<^sub>1) = snd (cap_data_rep0 r\\<^sub>2 y i\\<^sub>2)\"\n    unfolding cap_data_rep_def\n    by auto (metis inj prod.collapse)\n  moreover have \"wf_cap (fst (fst x)) (snd x)\" and  \"wf_cap (fst (fst y)) (snd y)\"\n    using cap_data_rep'[of d\\<^sub>1] d\\<^sub>1 cap_data_rep'[of d\\<^sub>2]  d\\<^sub>2\n    by auto\n  ultimately have \"x = y\" unfolding cap_data_rep0_def\n    apply (auto split:prod.splits\n        del:cap_type_rep_inj overwrite_cap_inj\n        dest!:cap_type_rep_inj overwrite_cap_inj)\n    using cap_data_rep'[of d\\<^sub>1] d\\<^sub>1 cap_data_rep'[of d\\<^sub>2] d\\<^sub>2\n    by auto\n  with tls d\\<^sub>1 d\\<^sub>2 have \"\\<lfloor>d\\<^sub>1\\<rfloor> = \\<lfloor>d\\<^sub>2\\<rfloor>\" by simp\n  thus ?case by (simp add:cap_data_rep'_inject)\nqed\n\ntext \\<open>\n  Helper lemma for induction base proofs. Since @{prop \"concat a = []\"} implies\n  @{prop \"\\<forall> x \\<in> set a. x = []\"}, to obtain @{prop \"a = []\"} we need this lemma.\n\\<close>\n\nlemma cap_data_rep_lengths:\n  \"list_all ((\\<noteq>) []) l \\<Longrightarrow> list_all ((\\<noteq>) []) (snd (cap_data_rep d r (i, l)))\"\nproof (induction \"\\<lfloor>d\\<rfloor>\" arbitrary:d i l)\n  case Nil\n  thus ?case unfolding cap_data_rep_def by simp\nnext\n  case (Cons x xs)\n  then obtain i' l' where \"cap_data_rep0 r x (i, l) = (i', l')\" and \"list_all ((\\<noteq>) []) l'\"\n    unfolding cap_data_rep0_def by (induction x) auto\n  with Cons show ?case\n    using cap_data_rep'_tail[of d, OF Cons.hyps(2)[symmetric]] Cons.hyps(1)[of \"\\<lceil>xs\\<rceil>\" l' i']\n    unfolding cap_data_rep_def\n    by (rewrite in \\<open>_ # _ = \\<lfloor>d\\<rfloor>\\<close> in asm eq_commute) auto\nqed\n\ntext \\<open>\n  Now proving that the total length is unambiguously recoverable from the length of\n  the resulting lists (and the initial total length in the general case).\n\\<close>\n\nlemma cap_data_rep_index[simp]:\n  assumes \"sum_list (map length l) \\<le> i\"\n  shows   \"fst (cap_data_rep d r (i, l)) =\n           sum_list (map length (snd (cap_data_rep d r (i, l)))) + (i - sum_list (map length l))\"\n  using assms\nproof (induction \"\\<lfloor>d\\<rfloor>\" arbitrary:d i l)\n  case Nil\n  thus ?case unfolding cap_data_rep_def by auto\nnext\n  case (Cons x xs)\n  from Cons(2) have wf:\"wf_cap (fst (fst x)) (snd x)\"\n    using cap_data_rep'[of d] list.set_intros(1)[of x xs]\n    by (induction x) auto\n  hence 0:\"length (overwrite_cap (fst (fst x)) (snd x) (drop (i + 3) r)) = length (snd x)\" by simp\n  let \"?i'\" = \"fst (cap_data_rep0 r x (i, l))\"\n    and \"?l'\" = \"snd (cap_data_rep0 r x (i, l))\"\n  from 0 have \"sum_list (map length ?l') = sum_list (map length l) + length (snd x) + 3\"\n    unfolding cap_data_rep0_def by (auto split:prod.splits)\n  hence 1:\"?i' = sum_list (map length ?l') + (i - sum_list (map length l))\"\n    unfolding cap_data_rep0_def using Cons(3) by (simp split:prod.splits)\n  from Cons(3) have 2:\"sum_list (map length ?l') \\<le> ?i'\"\n    unfolding cap_data_rep0_def using wf by (auto split:prod.splits)\n  from Cons(1)[of \"\\<lceil>xs\\<rceil>\" ?l' ?i', OF _ 2] cap_data_rep'_tail[OF Cons(2)[symmetric]]\n  show ?case unfolding cap_data_rep_def by ((subst Cons(2)[symmetric])+, simp) (insert 1, simp)\nqed\n\nlemma cap_data_rep_dest:\n  assumes \"snd (cap_data_rep d r (i, [])) \\<noteq> []\"\n  obtains i' where\n    \"snd (cap_data_rep d r (i, l)) =\n     hd (snd (cap_data_rep0 r (last \\<lfloor>d\\<rfloor>) (i', []))) # snd (cap_data_rep \\<lceil>butlast \\<lfloor>d\\<rfloor>\\<rceil> r (i, l))\"\n  using assms(1)\nproof (induction \"\\<lfloor>d\\<rfloor>\" arbitrary:d i l ?thesis)\n  case Nil\n  thus ?case unfolding cap_data_rep_def by simp\nnext\n  case nonemp:(Cons x xs)\n  show ?case proof (cases xs)\n    case Nil\n    from nonemp(1,3,4) show ?thesis\n      unfolding cap_data_rep_def cap_data_rep0_def using cap_data_inverse\n      by (simp add:nonemp(2)[symmetric] Nil split:prod.splits)\n  next\n    case (Cons x' xs')\n    let ?l' = \"snd (cap_data_rep0 r x (i, l))\"\n      and ?i' = \"fst (cap_data_rep0 r x (i, l))\"\n    from cap_data_rep'_tail[OF nonemp(2)[symmetric]] have xs:\"\\<lfloor>\\<lceil>xs\\<rceil>\\<rfloor> = xs\" ..\n    let ?repx' = \"cap_data_rep0 r x' (?i', [])\"\n    have lenx':\"length (snd ?repx') > 0\" unfolding cap_data_rep0_def by (simp split:prod.split)\n    from cap_data_rep'_tail[of \"\\<lceil>xs\\<rceil>\"] xs Cons have xs':\"\\<lfloor>\\<lceil>xs'\\<rceil>\\<rfloor> = xs'\" by simp\n    from xs' have \"\\<And> i l. length l \\<le> length (snd (cap_data_rep \\<lceil>xs'\\<rceil> r (i, l)))\"\n    proof (induction xs')\n      case Nil\n      thus ?case by simp\n    next\n      case (Cons y ys)\n      let ?i' = \"fst (cap_data_rep0 r y (i, l))\"\n        and ?l' = \"snd (cap_data_rep0 r y (i, l))\"\n      note 0 = cap_data_rep'_tail[OF Cons(2), symmetric]\n      with Cons(1)[OF 0, of ?l' ?i'] Cons(2)\n      show ?case unfolding cap_data_rep_def cap_data_rep0_def by (simp split:prod.splits)\n    qed\n    from this[of \"snd ?repx'\" \"fst ?repx'\"] xs xs' Cons lenx'\n    have 0:\"snd (cap_data_rep \\<lceil>x' # xs'\\<rceil> r (?i', [])) \\<noteq> []\" unfolding cap_data_rep_def by auto\n    from nonemp(2) Cons last_ConsR[of xs x] have 1:\"last xs = last \\<lfloor>d\\<rfloor>\" by simp\n    from cap_data_inverse[of \"butlast xs\"] cap_data_rep'[of \"\\<lceil>xs\\<rceil>\"] xs\n    have 2:\"\\<lfloor>\\<lceil>butlast xs\\<rceil>\\<rfloor> = butlast xs\" by (auto split:prod.splits dest!:in_set_butlastD)\n    from cap_data_inverse[of \"butlast \\<lfloor>d\\<rfloor>\"] cap_data_rep'[of \"d\"]\n    have 3:\"\\<lfloor>\\<lceil>butlast \\<lfloor>d\\<rfloor>\\<rceil>\\<rfloor> = butlast \\<lfloor>d\\<rfloor>\" by (auto split:prod.splits dest!:in_set_butlastD)\n    from Cons have 4:\"butlast \\<lfloor>d\\<rfloor> = x # butlast xs\" by (rewrite nonemp(2)[symmetric], simp)\n    from nonemp(1)[of \"\\<lceil>xs\\<rceil>\" ?i' ?l', OF xs[symmetric]] 0 Cons obtain i'' where\n      \"snd (cap_data_rep \\<lceil>xs\\<rceil> r (?i', ?l')) =\n         hd (snd (cap_data_rep0 r (last xs) (i'', []))) #\n           snd (cap_data_rep \\<lceil>butlast xs\\<rceil> r (?i', ?l'))\"\n      using xs\n      by auto\n    with nonemp(3) xs show ?thesis unfolding cap_data_rep_def\n      by (rewrite in asm nonemp(2)[symmetric]) (rewrite in asm 3, simp add: 1 2 4)\n  qed\nqed\n\ntext \\<open>\n  Now we need to prove that the list of lists resulting from @{const \"cap_data_rep\"} can be\n  recovered from its reversed and concatenated representation. This is quite hard to do directly,\n  so we introduce an intermediate definition @{text \"cap_data_rep1\"}, prove the\n  bijective correspondence between it and @{const \"cap_data_rep\"}, then prove injectivity for\n  concatenation of @{text \"cap_data_rep1\"} and use it to prove that the initial list of lists\n  is recoverable.\n\\<close>\n\ndefinition \"cap_data_rep1 r \\<equiv>\n  \\<lambda> ((c, i), l) (j, d). (j + 3 + length l, d @ [cap_data_rep_single r c i l j])\"\n\nlemma cap_data_rep1_fold_pull[simp]:\n  \"snd (fold (cap_data_rep1 r) d (i, x # xs)) = x # snd (fold (cap_data_rep1 r) d (i, xs))\"\nproof (induction d arbitrary:xs i)\n  case Nil\n  thus ?case by simp\nnext\n  case (Cons d ds)\n  obtain xs' i' where\n    \"cap_data_rep1 r d (i, x # xs) = (i', x # xs @ xs')\" and\n    \"cap_data_rep1 r d (i, xs) = (i', xs @ xs')\"\n    unfolding cap_data_rep1_def by (induction d) auto\n  with Cons(1)[of i' \"xs @ xs'\"] show ?case by simp\nqed\n\ntext \\<open>\n Proving bijective correspondence between @{const \"cap_data_rep\"} and @{const \"cap_data_rep1\"}.\n\\<close>\n\nlemma cap_data_rep_rel:\n  \"rev (snd (cap_data_rep d r (i, l))) = rev l @ snd (fold (cap_data_rep1 r) \\<lfloor>d\\<rfloor> (i, []))\"\nproof (induction \"\\<lfloor>d\\<rfloor>\" arbitrary: d i l)\n  case Nil\n  thus ?case unfolding cap_data_rep_def by simp\nnext\n  case (Cons x xs)\n  from cap_data_rep'_tail[OF Cons(2)[symmetric]] have xs:\"\\<lfloor>\\<lceil>xs\\<rceil>\\<rfloor> = xs\" ..\n  let ?i' = \"fst (cap_data_rep0 r x (i, l))\"\n    and ?l' = \"snd (cap_data_rep0 r x (i, l))\"\n  obtain i'' x' where 0:\"cap_data_rep1 r x (i, []) = (i'', x' # [])\"\n    unfolding cap_data_rep1_def by (induction x) auto\n  hence 1:\"rev (snd (cap_data_rep0 r x (i, []))) = [x']\"\n    unfolding cap_data_rep0_def cap_data_rep1_def by (induction x) auto\n  have [simp]: \"fst (cap_data_rep0 r x (i, [])) = fst (cap_data_rep1 r x (i, []))\"\n    unfolding cap_data_rep0_def cap_data_rep1_def by (induction x) auto\n  have [simp]:\n    \"cap_data_rep0 r x (i, l) =\n    (fst (cap_data_rep0 r x (i, [])), snd (cap_data_rep0 r x (i, [])) @ l)\"\n    unfolding cap_data_rep0_def by (simp split:prod.split)\n  from Cons(1)[of \"\\<lceil>xs\\<rceil>\" ?i' ?l', OF xs[symmetric]] xs\n  show ?case unfolding cap_data_rep_def by (simp add: Cons(2)[symmetric] 0 1)\nqed\n\ntext \\<open>\n  Prove that we can recover result of @{const \"cap_data_rep1\"} from its concatenation.\n\\<close>\n\nlemma concat_cap_data_rep_inj_snd[dest]:\n  fixes d\\<^sub>1' d\\<^sub>2' :: capability_data\n  assumes \"concat (snd (fold (cap_data_rep1 r\\<^sub>1) d\\<^sub>1 (i\\<^sub>1, []))) =\n           concat (snd (fold (cap_data_rep1 r\\<^sub>2) d\\<^sub>2 (i\\<^sub>2, [])))\"\n  assumes \"d\\<^sub>1 = \\<lfloor>d\\<^sub>1'\\<rfloor>\" and \"d\\<^sub>2 = \\<lfloor>d\\<^sub>2'\\<rfloor>\"\n  shows   \"snd (fold (cap_data_rep1 r\\<^sub>1) d\\<^sub>1 (i\\<^sub>1, [])) =\n           snd (fold (cap_data_rep1 r\\<^sub>2) d\\<^sub>2 (i\\<^sub>2, []))\"\n  using assms\nproof (induction d\\<^sub>1 arbitrary: d\\<^sub>1' d\\<^sub>2 d\\<^sub>2' i\\<^sub>1 i\\<^sub>2)\n  case Nil\n  from Nil(3) have 0: \"snd (fold (cap_data_rep1 r\\<^sub>2) d\\<^sub>2 (i\\<^sub>2, [])) =\n                       rev (snd (cap_data_rep d\\<^sub>2' r\\<^sub>2 (i\\<^sub>2, [])))\"\n    by (subst rev_is_rev_conv[symmetric], simp add:cap_data_rep_rel)\n  from Nil(3) have 1:\"d\\<^sub>2 \\<noteq> [] \\<Longrightarrow> set (snd (cap_data_rep d\\<^sub>2' r\\<^sub>2 (i\\<^sub>2, []))) \\<noteq> {}\"\n    using length_snd_cap_data_rep[of d\\<^sub>2' r\\<^sub>2 \"(i\\<^sub>2, [])\"] by force\n  from Nil[simplified] have \"d\\<^sub>2 \\<noteq> [] \\<Longrightarrow> False\"\n    using cap_data_rep_lengths[of \"[]\" d\\<^sub>2' r\\<^sub>2 i\\<^sub>2, simplified, unfolded list_all_def]\n    by (subst (asm) 0) (subst (asm) set_rev, frule 1, metis equals0I)\n  thus ?case by (cases d\\<^sub>2, simp_all)\nnext\n  case (Cons x xs)\n  obtain i\\<^sub>1' l\\<^sub>1' where\n    0:\"cap_data_rep1 r\\<^sub>1 x (i\\<^sub>1, []) = (i\\<^sub>1', l\\<^sub>1' # [])\" and\n    1:\"l\\<^sub>1' \\<noteq> []\" and\n    2:\"[l\\<^sub>1'] = snd (cap_data_rep1 r\\<^sub>1 x (i\\<^sub>1, []))\"\n    unfolding cap_data_rep1_def by (induction x) auto\n  have\n    l:\"concat (snd (fold (cap_data_rep1 r\\<^sub>1) (x # xs) (i\\<^sub>1, []))) =\n       l\\<^sub>1' @ concat (snd (fold (cap_data_rep1 r\\<^sub>1) xs (i\\<^sub>1', [])))\"\n    by (simp add:0)\n  from Cons(2) have \"snd (fold (cap_data_rep1 r\\<^sub>2) d\\<^sub>2 (i\\<^sub>2, [])) \\<noteq> []\" by (auto simp add:0 1)\n  hence \"d\\<^sub>2 \\<noteq> []\" by auto\n  then obtain y ys where 3:\"d\\<^sub>2 = y # ys\" by (cases d\\<^sub>2, auto)\n  obtain i\\<^sub>2' l\\<^sub>2' where\n    4:\"cap_data_rep1 r\\<^sub>2 y (i\\<^sub>2, []) = (i\\<^sub>2', l\\<^sub>2' # [])\" and\n    5:\"l\\<^sub>2' \\<noteq> []\" and\n    6:\"[l\\<^sub>2'] = snd (cap_data_rep1 r\\<^sub>2 y (i\\<^sub>2, []))\"\n    unfolding cap_data_rep1_def by (induction y) auto\n  have\n    r:\"concat (snd (fold (cap_data_rep1 r\\<^sub>2) d\\<^sub>2 (i\\<^sub>2, []))) =\n       l\\<^sub>2' @ concat (snd (fold (cap_data_rep1 r\\<^sub>2) ys (i\\<^sub>2', [])))\"\n    by (simp add: 3 4)\n\n  from 2 have 7:\"[l\\<^sub>1'] = snd (cap_data_rep0 r\\<^sub>1 x (i\\<^sub>1, []))\"\n    unfolding cap_data_rep0_def cap_data_rep1_def by (cases x) auto\n  from Cons(3) have 8:\"x \\<in> set \\<lfloor>d\\<^sub>1'\\<rfloor>\" using list.set_intros(1)[of x xs] by simp\n  note 9 = length_cap_data_rep0'[OF 7 8]\n  from 6 have 10:\"[l\\<^sub>2'] = snd (cap_data_rep0 r\\<^sub>2 y (i\\<^sub>2, []))\"\n    unfolding cap_data_rep0_def cap_data_rep1_def by (cases y) auto\n  from Cons(4) 3 have 11:\"y \\<in> set \\<lfloor>d\\<^sub>2'\\<rfloor>\" using list.set_intros(1)[of y ys] by simp\n  note 12 = length_cap_data_rep0'[OF 10 11]\n  from Cons(2) l r 1 5 9 12 have 13:\"l\\<^sub>1' = l\\<^sub>2'\" by (metis append_eq_append_conv hd_append2)\n  with Cons(2) l r\n  have 14:\"concat (snd (fold (cap_data_rep1 r\\<^sub>1) xs (i\\<^sub>1', []))) =\n           concat (snd (fold (cap_data_rep1 r\\<^sub>2) ys (i\\<^sub>2', [])))\"\n    by simp\n\n  note xs = cap_data_rep'_tail[OF Cons(3)[symmetric]]\n  from cap_data_rep'_tail[of d\\<^sub>2'] Cons(4) 3 have ys:\"ys = \\<lfloor>\\<lceil>ys\\<rceil>\\<rfloor>\" by blast\n  note 15 = Cons(1)[OF 14 xs ys]\n\n  from 0 3 4 13 15 show ?case by simp\nqed\n\ntext \\<open>Final injectivity proof for capability data representation:\\<close>\n\nlemma concat_cap_data_rep_inj[simplified, dest]:\n  \"(concat \\<circ> rev \\<circ> snd) (cap_data_rep d\\<^sub>1 r\\<^sub>1 (i, [])) =\n   (concat \\<circ> rev \\<circ> snd) (cap_data_rep d\\<^sub>2 r\\<^sub>2 (i, [])) \\<Longrightarrow>\n   cap_data_rep d\\<^sub>1 r\\<^sub>1 (i, []) = cap_data_rep d\\<^sub>2 r\\<^sub>2 (i, [])\"\n  (is \"?prem \\<Longrightarrow> _\")\nproof\n  assume ?prem\n  hence\n    \"concat (snd (fold (cap_data_rep1 r\\<^sub>1) \\<lfloor>d\\<^sub>1\\<rfloor> (i, []))) =\n     concat (snd (fold (cap_data_rep1 r\\<^sub>2) \\<lfloor>d\\<^sub>2\\<rfloor> (i, [])))\"\n    by (simp add:cap_data_rep_rel)\n  hence \"snd (fold (cap_data_rep1 r\\<^sub>1) \\<lfloor>d\\<^sub>1\\<rfloor> (i, [])) = snd (fold (cap_data_rep1 r\\<^sub>2) \\<lfloor>d\\<^sub>2\\<rfloor> (i, []))\"\n    by auto\n  thus \"snd (cap_data_rep d\\<^sub>1 r\\<^sub>1 (i, [])) = snd (cap_data_rep d\\<^sub>2 r\\<^sub>2 (i, []))\"\n    by (simp add:cap_data_rep_rel[where l=\"[]\", simplified, symmetric])\n  thus \"fst (cap_data_rep d\\<^sub>1 r\\<^sub>1 (i, [])) = fst (cap_data_rep d\\<^sub>2 r\\<^sub>2 (i, []))\"\n    by simp\nqed\n\ndefinition \"reg_call_rep (d :: register_call_data) r \\<equiv>\n    [ucast (proc_key d) OR (r ! 0) \\<restriction> {LENGTH(key) ..<LENGTH(word32)},\n     ucast (eth_addr d) OR (r ! 1) \\<restriction> {LENGTH(ethereum_address) ..<LENGTH(word32)}] @\n     ((concat \\<circ> rev \\<circ> snd) (cap_data_rep (cap_data d) r (2, [])))\"\n\nadhoc_overloading rep reg_call_rep\n\nlemma reg_call_rep_inj[dest]: \"\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2 \\<Longrightarrow> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: register_call_data\nproof (rule register_call_data.equality)\n  assume eq:\"\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2\"\n\n  from eq show \"proc_key d\\<^sub>1 = proc_key d\\<^sub>2\" unfolding reg_call_rep_def by auto\n  from eq show \"eth_addr d\\<^sub>1 = eth_addr d\\<^sub>2\" unfolding reg_call_rep_def by auto\n\n  from eq show \"cap_data d\\<^sub>1 = cap_data d\\<^sub>2\" unfolding reg_call_rep_def by auto\nqed simp\n\nlemmas reg_call_invertible[intro] = invertible2.intro[OF inj2I, OF reg_call_rep_inj]\n\ninterpretation reg_call_inv: invertible2 reg_call_rep ..\n\nadhoc_overloading abs reg_call_inv.inv2\n\nsubsection \\<open>Procedure call system call\\<close>\n\ntext \\<open>\n  Data format of the Call Procedure system call is modeled as a direct product of procedure keys\n  and byte lists (representing payload for the procedure).\n\\<close>\n\ntype_synonym procedure_call_data = \"(key \\<times> byte list)\"\n\ntext \\<open>Low-level representation of the call data.\\<close>\n\ndefinition \"proc_call_rep (cd :: procedure_call_data) (r :: byte list) \\<equiv>\n  let (k, d) = cd;\n       r' = word_rcat (take (LENGTH(word32) div LENGTH(byte)) r) :: word32 in\n  word_rsplit (ucast k OR r' \\<restriction> {LENGTH(key) ..<LENGTH(word32)}) @ d\"\n\nadhoc_overloading rep proc_call_rep\n\nlemma word_rsplit_inj[dest]: \"word_rsplit a = word_rsplit b \\<Longrightarrow> a = b\" for a::\"'a::len word\"\n  by (auto dest:arg_cong[where f=\"word_rcat :: _ \\<Rightarrow> 'a word\"] simp add:word_rcat_rsplit)\n\ntext \\<open>Low-level representation is injective.\\<close>\n\nlemma proc_call_rep_inj[dest]: \"\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2 \\<Longrightarrow> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: procedure_call_data\nproof-\n  let \"?key_rep k r\" =\n    \"word_rsplit (ucast (k :: key) OR (r :: word32) \\<restriction> {LENGTH(key) ..<LENGTH(word32)})\n     :: byte list\"\n  assume \"\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2\"\n  moreover then obtain k\\<^sub>1 d\\<^sub>1' and r\\<^sub>1' :: word32 and k\\<^sub>2 d\\<^sub>2' and r\\<^sub>2' :: word32 where\n    \"\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1 = ?key_rep k\\<^sub>1 r\\<^sub>1' @ d\\<^sub>1'\" \"\\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2 = ?key_rep k\\<^sub>2 r\\<^sub>2' @ d\\<^sub>2'\" and\n    d\\<^sub>1:\"(k\\<^sub>1, d\\<^sub>1') = d\\<^sub>1\" and d\\<^sub>2:\"(k\\<^sub>2, d\\<^sub>2') = d\\<^sub>2\"\n    unfolding proc_call_rep_def\n    by (simp add: Let_def split:prod.splits, metis)\n  moreover have \"length (?key_rep k\\<^sub>1 r\\<^sub>1') = length (?key_rep k\\<^sub>2 r\\<^sub>2')\"\n    by (rule word_rsplit_len_indep)\n  ultimately have \"?key_rep k\\<^sub>1 r\\<^sub>1' = ?key_rep k\\<^sub>2 r\\<^sub>2'\" and \"d\\<^sub>1' = d\\<^sub>2'\" by auto\n  with d\\<^sub>1 and d\\<^sub>2 show ?thesis by auto\nqed\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas proc_call_invertible[intro] = invertible2.intro[OF inj2I, OF proc_call_rep_inj]\n\ninterpretation proc_call_inv: invertible2 proc_call_rep ..\n\nadhoc_overloading abs proc_call_inv.inv2\n\nsubsection \\<open>External call system call\\<close>\n\ntext \\<open>\n  Data format of the External Call system call is modeled as a record with three fields:\n  \\begin{itemize}\n    \\item @{text addr}: account Ethereum address;\n    \\item @{text amount}: value amount;\n    \\item @{text data}: payload for the contract.\n  \\end{itemize}\n\\<close>\n\nrecord external_call_data =\n  addr   :: ethereum_address\n  amount :: word32\n  data   :: \"byte list\"\n\ntext \\<open>Low-level representation of the external call data.\\<close>\n\ndefinition \"ext_call_rep (d :: external_call_data) (r :: byte list) \\<equiv>\n  let r' = word_rcat (take (LENGTH(word32) div LENGTH(byte)) r) :: word32 in\n  concat (split\n    [ucast (addr d) OR r' \\<restriction> {LENGTH(ethereum_address) ..<LENGTH(word32)},\n     amount d])\n  @ data d\"\n\nadhoc_overloading rep ext_call_rep\n\ntext \\<open>Low-level representation is injective.\\<close>\n\ndeclare length_split[simp del] length_concat_split[simp del]\n\nlemma ext_call_rep_inj[dest]: \"\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2 \\<Longrightarrow> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: external_call_data\nproof (rule external_call_data.equality)\n  {\n    fix a\\<^sub>1 b\\<^sub>1 a\\<^sub>2 b\\<^sub>2 :: word32 and d\\<^sub>1 d\\<^sub>2 :: \"byte list\"\n    assume \"concat (split [a\\<^sub>1, b\\<^sub>1]) @ d\\<^sub>1 = concat (split [a\\<^sub>2, b\\<^sub>2]) @ d\\<^sub>2\"\n    hence \"a\\<^sub>1 = a\\<^sub>2\" and \"b\\<^sub>1 = b\\<^sub>2\" by (auto simp add:word_rsplit_len_indep)\n  } note dest[dest] = this\n  assume eq:\"\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2\"\n\n  from eq show \"addr d\\<^sub>1 = addr d\\<^sub>2\" unfolding ext_call_rep_def\n    by (auto simp del:concat.simps split.simps)\n  from eq show \"amount d\\<^sub>1 = amount d\\<^sub>2\" unfolding ext_call_rep_def by (auto simp only:Let_def)\n  from eq show \"data d\\<^sub>1 = data d\\<^sub>2\" unfolding ext_call_rep_def\n    by (auto simp add:word_rsplit_len_indep)\nqed simp\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas external_call_invertible[intro] = invertible2.intro[OF inj2I, OF ext_call_rep_inj]\n\ninterpretation ext_call_inv: invertible2 ext_call_rep ..\n\nadhoc_overloading abs ext_call_inv.inv2\n\nsubsection \\<open>Log system call\\<close>\n\ntext \\<open>Log topics format is the same as the log capability format.\\<close>\n\ntype_synonym log_topics = log_capability\n\ntext \\<open>\n  Data format of the Log system call is modeled as a direct product of set of log topics and\n  byte lists (representing log value).\n\\<close>\n\ntype_synonym log_call_data = \"log_topics \\<times> byte list\"\n\ntext \\<open>Low-level representation of the log call data.\\<close>\n\ndefinition \"log_call_rep td r \\<equiv>\n  let (t, d) = td;\n      n = length \\<lfloor>t\\<rfloor>;\n      c = LENGTH(word32) div LENGTH(byte);\n      r' = word_rcat (take c (drop (c * (n + 1)) r)) :: word32 in\n  concat (split (\\<lfloor>t\\<rfloor> @ [r'])) @ d\"\n  for td :: log_call_data\n\nadhoc_overloading rep log_call_rep\n\ntext \\<open>Low-level representation is injective.\\<close>\n\nlemma log_call_rep_inj[dest]: \"\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2 \\<Longrightarrow> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: log_call_data\nproof\n  {\n    fix a b :: \"word32 list\" and d\\<^sub>1 d\\<^sub>2\n    assume \"(concat (split a) :: byte list) @ d\\<^sub>1 = concat (split b) @ d\\<^sub>2\"\n      and \"length a = length b\"\n    hence \"a = b\"\n      by (intro split_inj, intro concat_injective, auto)\n        (subst (asm) append_eq_append_conv, auto elim:in_set_zipE simp add:split_lengths)\n  } note [dest] = this\n\n  assume eq:\"\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2\"\n  moreover hence \"length \\<lfloor>fst d\\<^sub>1\\<rfloor> = length \\<lfloor>fst d\\<^sub>2\\<rfloor>\" unfolding log_call_rep_def log_cap_rep_def\n    using log_cap_rep'[of \"fst d\\<^sub>1\"] log_cap_rep'[of \"fst d\\<^sub>2\"]\n    by (auto split:prod.splits simp add:word_rsplit_len_indep of_nat_inj)\n  ultimately show \"fst d\\<^sub>1 = fst d\\<^sub>2\" unfolding log_call_rep_def by (auto split:prod.splits)\n\n  with eq show \"snd d\\<^sub>1 = snd d\\<^sub>2\" unfolding log_call_rep_def\n    by (auto split:prod.splits simp add:word_rsplit_len_indep)\nqed\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas log_call_invertible[intro] = invertible2.intro[OF inj2I, OF log_call_rep_inj]\n\ninterpretation log_call_inv: invertible2 log_call_rep ..\n\nadhoc_overloading abs log_call_inv.inv2\n\nsubsection \\<open>Delete and Set entry system calls\\<close>\n\ntext \\<open>Data format of the Delete and Set entry system calls are modeled as a single procedure key.\\<close>\n\ntype_synonym delete_call_data = key\n\ntype_synonym set_entry_call_data = key\n\ntext \\<open>Low-level representation of the delete and set entry calls data.\\<close>\n\ndefinition \"proc_key_call_rep k r = [ucast k OR r \\<restriction> {LENGTH(key) ..<LENGTH(word32)}]\"\n  for k :: key and r :: word32\n\nadhoc_overloading rep proc_key_call_rep\n\ntext \\<open>Low-level representation is injective.\\<close>\n\nlemma proc_key_call_rep_inj0[dest]: \"\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1 = \\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2 \\<Longrightarrow> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: key\n  unfolding proc_key_call_rep_def by auto\n\nlemma proc_key_call_rep_length[simp]: \"length (\\<lfloor>d\\<rfloor> r) = 1\" for d :: key\n  unfolding proc_key_call_rep_def by simp\n\nlemma proc_key_call_rep_inj[dest]: \"prefix (\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1) (\\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2) \\<Longrightarrow> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: key\n  unfolding prefix_def using proc_key_call_rep_length\n  by (subst (asm) append_Nil2[symmetric]) (subst (asm) append_eq_append_conv, auto)\n\nlemma proc_key_call_rep_indep: \"length (\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1) = length (\\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2)\" for d\\<^sub>1 d\\<^sub>2 :: key by simp\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas proc_key_call_invertible[intro] =\n  invertible2_tf.intro[OF inj2_tfI, OF proc_key_call_rep_inj proc_key_call_rep_indep]\n\ninterpretation proc_key_call_inv: invertible2_tf proc_key_call_rep ..\n\nadhoc_overloading abs proc_key_call_inv.inv2_tf\n\nsubsection \\<open>Write system call\\<close>\n\ntext \\<open>\n  Data format of the Write system call is modeled as a direct product of write addresses and write\n  values, both represented as 32-byte machine words.\n\\<close>\n\ntype_synonym write_call_data = \"word32 \\<times> word32\"\n\ntext \\<open>Low-level representation of the write call data.\\<close>\n\ndefinition \"write_call_rep w _ \\<equiv> let (a, v) = w in [a, v]\" for w :: write_call_data\n\nadhoc_overloading rep write_call_rep\n\ntext \\<open>Low-level representation is injective.\\<close>\n\nlemma write_call_rep_inj[dest]: \"prefix (\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1) (\\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2) \\<Longrightarrow> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: write_call_data\n  unfolding write_call_rep_def by (simp split:prod.splits)\n\nlemma write_call_rep_indep: \"length (\\<lfloor>d\\<^sub>1\\<rfloor> r\\<^sub>1) = length (\\<lfloor>d\\<^sub>2\\<rfloor> r\\<^sub>2)\" for d\\<^sub>1 d\\<^sub>2 :: write_call_data\n  unfolding write_call_rep_def by (simp split:prod.split)\n\ntext \\<open>Representation function is invertible.\\<close>\n\nlemmas write_call_invertible[intro] =\n  invertible2_tf.intro[OF inj2_tfI, OF write_call_rep_inj write_call_rep_indep]\n\ninterpretation write_call_inv: invertible2_tf write_call_rep ..\n\nadhoc_overloading abs write_call_inv.inv2_tf\n\nsection \\<open>System calls\\<close>\n\nsubsection \\<open>Return and error codes\\<close>\n\ntext \\<open>\n  The result of executing a system call is either Success and a new state of the storage, or Revert.\n\\<close>\n\ndatatype result =\n    Success storage\n  | Revert\n\ntext \\<open>\n  Here are general error codes that are returned by system calls in case of revert in the kernel.\n\\<close>\n\nabbreviation \"SYSCALL_BADCAP \\<equiv> 0x33\"  \\<comment> \\<open>Capability insufficient.\\<close>\n\nabbreviation \"SYSCALL_NOGAS \\<equiv> 0x44\" \\<comment> \\<open>Procedure execution ran out of gas.\\<close>\n\nabbreviation \"SYSCALL_REVERT \\<equiv> 0x55\" \\<comment> \\<open>The called procedure reverted.\\<close>\n\nabbreviation \"SYSCALL_FAIL \\<equiv> 0x66\" \\<comment> \\<open>The system call failed for specific reasons.\\<close>\n\nabbreviation \"SYSCALL_NOEXIST \\<equiv> 0xaa\" \\<comment> \\<open>Not a valid system call.\\<close>\n\nsubsection \\<open>Register system call\\<close>\n\ntext \\<open>\n  If too many capabilities are provided, the Register Procedure system call fails and returns\n  @{text SYSCALL_FAIL} followed by the @{text REG_TOOMANYCAPS} error code.\n\\<close>\n\nabbreviation \"REG_TOOMANYCAPS \\<equiv> 0x77\"\n\ntext \\<open>\n  Undefined function that is used to validate the contract code at the given address to show that\n  it complies with the requirements of procedure code.\n\\<close>\n\ndefinition \"valid_code (_ :: ethereum_address) = undefined\"\n\ndefinition \"caps t d \\<equiv>\n  let caps = filter ((=) t \\<circ> fst \\<circ> fst) \\<lfloor>cap_data d\\<rfloor> in\n  if length caps < 2 ^ LENGTH(byte) - 1\n  then Some (map (apfst snd) caps)\n  else None\"\n\nlemma wf_caps: \"caps t d = Some c \\<Longrightarrow> \\<forall> (_, l) \\<in> set c. wf_cap t l\"\n  unfolding caps_def using cap_data_rep'[of \"cap_data d\"]\n  by (auto split:prod.splits if_splits simp add:Let_def)\n\ndefinition \"sub_caps t cs p \\<equiv>\n   list_all\n     (\\<lambda> (i :: capability_index, l) \\<Rightarrow>\n      (case (t, l) of\n        (Call,  [])       \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>call_caps p\\<rfloor>\n      | (Call,  [c])      \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>call_caps p\\<rfloor> \\<and>\n                             the (\\<lceil>c\\<rceil> :: prefixed_capability option) \\<subseteq>\\<^sub>c \\<lfloor>call_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\n      | (Reg,   [])       \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>reg_caps p\\<rfloor>\n      | (Reg,   [c])      \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>reg_caps p\\<rfloor> \\<and>\n                             the (\\<lceil>c\\<rceil> :: prefixed_capability option) \\<subseteq>\\<^sub>c \\<lfloor>reg_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\n      | (Del,   [])       \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>del_caps p\\<rfloor>\n      | (Del,   [c])      \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>del_caps p\\<rfloor> \\<and>\n                             the (\\<lceil>c\\<rceil> :: prefixed_capability option) \\<subseteq>\\<^sub>c \\<lfloor>del_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\n      | (Entry, [])       \\<Rightarrow> entry_cap p\n      | (Write, [])       \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>write_caps p\\<rfloor>\n      | (Write, [c1, c2]) \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>write_caps p\\<rfloor> \\<and>\n                             the (\\<lceil>(c1, c2)\\<rceil> :: write_capability option) \\<subseteq>\\<^sub>c \\<lfloor>write_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\n      | (Log,   [])       \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>log_caps p\\<rfloor>\n      | (Log,   c)        \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>log_caps p\\<rfloor> \\<and>\n                             the (\\<lceil>c\\<rceil> :: log_capability option) \\<subseteq>\\<^sub>c \\<lfloor>log_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\n      | (Send,  [])       \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>ext_caps p\\<rfloor>\n      | (Send,  [c])      \\<Rightarrow> \\<lfloor>i\\<rfloor> < length \\<lfloor>ext_caps p\\<rfloor> \\<and>\n                             the (\\<lceil>c\\<rceil> :: external_call_capability option) \\<subseteq>\\<^sub>c \\<lfloor>ext_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>))\n     cs\"\n\ndefinition \"fill_caps t cs p \\<equiv>\n  map\n   (\\<lambda> (i :: capability_index, l) \\<Rightarrow>\n     if l = [] then\n       case t of\n         Call  \\<Rightarrow> (i, [\\<lfloor>\\<lfloor>call_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> (0 :: word32)])\n       | Reg   \\<Rightarrow> (i, [\\<lfloor>\\<lfloor>reg_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> (0 :: word32)])\n       | Del   \\<Rightarrow> (i, [\\<lfloor>\\<lfloor>del_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> (0 :: word32)])\n       | Entry \\<Rightarrow> (i, [])\n       | Write \\<Rightarrow> (i, let (a, s) = \\<lfloor>\\<lfloor>write_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> in [a, s])\n       | Log   \\<Rightarrow> (i, \\<lfloor>\\<lfloor>log_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor>)\n       | Send  \\<Rightarrow> (i, [\\<lfloor>\\<lfloor>ext_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rfloor> (0 :: word32)])\n     else         (i, l))\n   cs\"\n\ntext \\<open>\n  Register Procedure system call registers a contract as a procedure by adding its key to the\n  procedure list and its data to the procedure heap. But if one of the following is true:\n  \\begin{itemize}\n    \\item the contract code cannot pass the validation process,\n    \\item the call data is malformed,\n    \\item there is already a maximum number of registered procedures,\n    \\item procedure with the specified key already exists,\n    \\item the specified capability index is out of range,\n    \\item the capability found by the index does not allow registering this procedure,\n    \\item if one of the specified capabilities is not a subset of a one of the capabilities of the\n          procedure performing the system call,\n    \\item too many capabilities are provided,\n  \\end{itemize}\n  then the kernel performs Revert and returns a specified error code.\n\\<close>\n\ndefinition register :: \"capability_index \\<Rightarrow> byte list \\<Rightarrow> storage \\<Rightarrow> result \\<times> byte list\" where\n  \"register i d s \\<equiv>\n     let \\<sigma> = the \\<lceil>s\\<rceil>;\n         p = curr_proc' \\<sigma> in\n     if \\<not> LENGTH(word32) div LENGTH(byte) dvd length d then\n                                                      (Revert, [])\n     else case \\<lceil>cat d\\<rceil> of\n       None                                      \\<Rightarrow>   (Revert, [])\n                                  \\<comment> \\<open>Malformed call data, currently the error code is not defined\\<close>\n     | Some d                                    \\<Rightarrow>\n       if max_nprocs = nprocs \\<sigma>                  then (Revert, [SYSCALL_FAIL])\n                                                             \\<comment> \\<open>Too many procs: Unrealistic,\n                                                                  but needed for formal\n                                                                  correctness\\<close>\n       else if has_key (proc_key d) \\<sigma>            then (Revert, [SYSCALL_FAIL])\n                                                                   \\<comment> \\<open>Proc key exists,\n                                                                        specific error code not\n                                                                        defined\\<close>\n       else if length \\<lfloor>reg_caps p\\<rfloor> \\<le> \\<lfloor>i\\<rfloor>         then (Revert, [SYSCALL_BADCAP])\n                                                                                 \\<comment> \\<open>No such cap\\<close>\n       else if proc_key d \\<notin> \\<lceil>\\<lfloor>reg_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rceil>  then (Revert, [SYSCALL_BADCAP])\n       else if \\<not> valid_code (eth_addr d)         then (Revert, [SYSCALL_FAIL]) \\<comment> \\<open>Code invalid\\<close>\n       else (case (caps Call d,\n                  caps Reg d,\n                  caps Del d,\n                  caps Entry d,\n                  caps Write d,\n                  caps Log d,\n                  caps Send d) of\n       (Some calls, Some regs, Some dels, Some ents, Some wrts, Some logs, Some exts) \\<Rightarrow>\n         if sub_caps Call  calls p \\<and>\n            sub_caps Reg   regs  p \\<and>\n            sub_caps Del   dels  p \\<and>\n            sub_caps Entry ents  p \\<and>\n            sub_caps Write wrts  p \\<and>\n            sub_caps Log   logs  p \\<and>\n            sub_caps Send  exts  p               then\n           let calls = fill_caps Call  calls p;\n               regs  = fill_caps Reg   regs  p;\n               dels  = fill_caps Del   dels  p;\n               ents  = fill_caps Entry ents  p;\n               wrts  = fill_caps Write wrts  p;\n               logs  = fill_caps Log   logs  p;\n               exts  = fill_caps Send  exts  p  in\n           let p' =\n              \\<lparr> procedure.eth_addr   = eth_addr d,\n                call_caps  = cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) calls),\n                reg_caps   = cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) regs),\n                del_caps   = cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) dels),\n                entry_cap  = ents \\<noteq> [],\n                write_caps = cap_list (map (\\<lambda> (_, [a, s]) \\<Rightarrow> the \\<lceil>(a, s)\\<rceil>) wrts),\n                log_caps   = cap_list (map (the \\<circ> abs \\<circ> snd) logs),\n                ext_caps   = cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) exts) \\<rparr>;\n               procs = \\<lceil>DAList.update (proc_key d) p' \\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rceil>;\n               \\<sigma>' = \\<sigma> \\<lparr> proc_list := procs \\<rparr> in\n                                                      (Success (\\<lfloor>\\<sigma>'\\<rfloor> s), [])\n         else                                         (Revert, [SYSCALL_BADCAP])\n                                                      \\<comment> \\<open>No cap inclusion\\<close>\n      | _                                        \\<Rightarrow>   (Revert, [SYSCALL_FAIL, REG_TOOMANYCAPS]))\"\n\nconsts sim :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\" (infixl \"~\" 50)\n\ndefinition \"same_explicit_cap t c\\<^sub>1 c\\<^sub>2 \\<equiv> c\\<^sub>1 \\<noteq> [] \\<and> c\\<^sub>2 \\<noteq> [] \\<longrightarrow> same_cap t c\\<^sub>1 c\\<^sub>2\"\n\ndefinition \"sim_register_call d\\<^sub>1 d\\<^sub>2 \\<equiv>\n  proc_key d\\<^sub>1 = proc_key d\\<^sub>2 \\<and>\n  eth_addr d\\<^sub>1 = eth_addr d\\<^sub>2 \\<and>\n  (let caps' = \\<lambda> t d. map snd (the (caps t d)) in\n  list_all2 (same_explicit_cap Call) (caps' Call d\\<^sub>1) (caps' Call d\\<^sub>2) \\<and>\n  list_all2 (same_explicit_cap Reg)  (caps' Reg d\\<^sub>1) (caps' Reg d\\<^sub>2) \\<and>\n  list_all2 (same_explicit_cap Del)  (caps' Del d\\<^sub>1) (caps' Del d\\<^sub>2) \\<and>\n  (the (caps Entry d\\<^sub>1) = []) = (the (caps Entry d\\<^sub>2) = []) \\<and>\n  list_all2 (same_explicit_cap Write) (caps' Write d\\<^sub>1) (caps' Write d\\<^sub>2) \\<and>\n  list_all2 (same_explicit_cap Log) (caps' Log d\\<^sub>1) (caps' Log d\\<^sub>2) \\<and>\n  list_all2 (same_explicit_cap Send) (caps' Send d\\<^sub>1) (caps' Send d\\<^sub>2))\"\n\nadhoc_overloading sim sim_register_call\n\nlemma fill_caps_inj_helper:\n  \"map snd (fill_caps t c\\<^sub>1 p) = map snd (fill_caps t c\\<^sub>2 p)\n   \\<Longrightarrow> list_all2 (\\<lambda> c\\<^sub>1 c\\<^sub>2. c\\<^sub>1 \\<noteq> [] \\<and> c\\<^sub>2 \\<noteq> [] \\<longrightarrow> c\\<^sub>1 = c\\<^sub>2) (map snd c\\<^sub>1) (map snd c\\<^sub>2)\"\nproof (induct c\\<^sub>1 arbitrary:c\\<^sub>2)\n  case Nil\n  thus ?case unfolding fill_caps_def by simp\nnext\n  case (Cons x xs)\n  from Cons(2) have \"c\\<^sub>2 \\<noteq> []\" unfolding fill_caps_def by auto\n  then obtain y ys where c\\<^sub>2:\"c\\<^sub>2 = y # ys\" using list.exhaust by blast\n  from Cons(2) have p0:\"map snd (fill_caps t xs p) = map snd (fill_caps t ys p)\"\n    unfolding fill_caps_def by (simp add:c\\<^sub>2)\n  obtain ix cx iy cy where x:\"x = (ix, cx)\" and y:\"y = (iy, cy)\" by (metis surj_pair)\n  from Cons(1)[OF p0] Cons(2)\n  show \"list_all2 (\\<lambda> c\\<^sub>1 c\\<^sub>2. c\\<^sub>1 \\<noteq> [] \\<and> c\\<^sub>2 \\<noteq> [] \\<longrightarrow> c\\<^sub>1 = c\\<^sub>2) (map snd (x # xs)) (map snd c\\<^sub>2)\"\n    unfolding fill_caps_def by (unfold c\\<^sub>2 x y, auto)\nqed\n\nlemma same_cap_triv: \"\\<lbrakk>wf_cap t c\\<^sub>1; wf_cap t c\\<^sub>2; c\\<^sub>1 = c\\<^sub>2\\<rbrakk> \\<Longrightarrow> same_cap t c\\<^sub>1 c\\<^sub>2\"\n  unfolding same_cap_def wf_cap_def by (auto split: capability.splits list.splits)\n\nlemma fill_caps_inj: \"\\<lbrakk>list_all (wf_cap t \\<circ> snd) c\\<^sub>1;\n                       list_all (wf_cap t \\<circ> snd) c\\<^sub>2;\n                       map snd (fill_caps t c\\<^sub>1 p) = map snd (fill_caps t c\\<^sub>2 p)\\<rbrakk>\n   \\<Longrightarrow> list_all2 (same_explicit_cap t) (map snd c\\<^sub>1) (map snd c\\<^sub>2)\"\n  using fill_caps_inj_helper[of t c\\<^sub>1 p c\\<^sub>2]\n  unfolding same_explicit_cap_def list_all2_conv_all_nth list_all_def\n  by (auto simp add:same_cap_triv)\n\nlemma pref_cap_list_inj:\n  \"\\<lbrakk>length c\\<^sub>1 <  2 ^ LENGTH(8 word) - 1;\n   length c\\<^sub>2 <  2 ^ LENGTH(8 word) - 1;\n   t \\<in> {Call, Reg, Del};\n   list_all ((\\<lambda> c. wf_cap t c \\<and> c = overwrite_cap t c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) c\\<^sub>1;\n   list_all ((\\<lambda> c. wf_cap t c \\<and> c = overwrite_cap t c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) c\\<^sub>2;\n   (cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) c\\<^sub>1) :: prefixed_capability capability_list) =\n    cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) c\\<^sub>2)\\<rbrakk>\n   \\<Longrightarrow> map snd c\\<^sub>1 = map snd c\\<^sub>2\"\n  (is \"\\<lbrakk>?len\\<^sub>1; ?len\\<^sub>2; ?t; ?all\\<^sub>1; ?all\\<^sub>2; ?eq\\<rbrakk> \\<Longrightarrow> _\")\nproof (subst list_eq_iff_nth_eq, intro conjI allI impI)\n  let ?l\\<^sub>1 = \"map (the \\<circ> abs \\<circ> hd \\<circ> snd) c\\<^sub>1 :: prefixed_capability list\"\n    and ?l\\<^sub>2 =  \"map (the \\<circ> abs \\<circ> hd \\<circ> snd) c\\<^sub>2 :: prefixed_capability list\"\n  assume ?len\\<^sub>1 ?len\\<^sub>2 ?eq\n  hence eq:\"?l\\<^sub>1 = ?l\\<^sub>2\" by (auto iff:cap_list_inject)\n  thus 0:\"length (map snd c\\<^sub>1) = length (map snd c\\<^sub>2)\" using map_eq_imp_length_eq by simp\n  {\n    fix i\n    let ?c\\<^sub>1 = \"snd (c\\<^sub>1 ! i)\" and ?c\\<^sub>2 = \"snd (c\\<^sub>2 ! i)\"\n    assume i:\"i < length (map snd c\\<^sub>1)\"\n    with 0 have i':\"i < length (map snd c\\<^sub>2)\" by simp\n    with eq have eq':\"(the \\<lceil>hd ?c\\<^sub>1\\<rceil> :: prefixed_capability) = the \\<lceil>hd ?c\\<^sub>2\\<rceil>\"\n      by (auto iff:list_eq_iff_nth_eq)\n    assume ?all\\<^sub>1 ?all\\<^sub>2\n    with i i' have wf:\"wf_cap t ?c\\<^sub>1\" \"wf_cap t ?c\\<^sub>2\"\n                      \"?c\\<^sub>1 = overwrite_cap t ?c\\<^sub>1 (zero_fill ?c\\<^sub>1)\"\n                      \"?c\\<^sub>2 = overwrite_cap t ?c\\<^sub>2 (zero_fill ?c\\<^sub>2)\"\n                      \"?c\\<^sub>1 \\<noteq> []\"         \"?c\\<^sub>2 \\<noteq> []\"\n      unfolding list_all_def by auto\n    assume ?t\n    with eq' wf i i' show \"map snd c\\<^sub>1 ! i = map snd c\\<^sub>2 ! i\"\n      unfolding wf_cap_def overwrite_cap_def by (induct t) (auto split:list.splits)\n  }\nqed\n\nlemma write_cap_list_inj:\n  \"\\<lbrakk>length c\\<^sub>1 <  2 ^ LENGTH(8 word) - 1;\n   length c\\<^sub>2 <  2 ^ LENGTH(8 word) - 1;\n   list_all ((\\<lambda> c. wf_cap Write c \\<and> c = overwrite_cap Write c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) c\\<^sub>1;\n   list_all ((\\<lambda> c. wf_cap Write c \\<and> c = overwrite_cap Write c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) c\\<^sub>2;\n   (cap_list (map (\\<lambda> (_, [a, s]) \\<Rightarrow> the \\<lceil>(a, s)\\<rceil>) c\\<^sub>1) :: write_capability capability_list) =\n    cap_list (map (\\<lambda> (_, [a, s]) \\<Rightarrow> the \\<lceil>(a, s)\\<rceil>) c\\<^sub>2)\\<rbrakk>\n   \\<Longrightarrow> map snd c\\<^sub>1 = map snd c\\<^sub>2\"\n  (is \"\\<lbrakk>?len\\<^sub>1; ?len\\<^sub>2; list_all (?P \\<circ> snd) c\\<^sub>1; _; ?eq\\<rbrakk> \\<Longrightarrow> _\")\nproof (subst list_eq_iff_nth_eq, intro conjI allI impI)\n  let ?l\\<^sub>1 = \"map (\\<lambda> (_, [a, s]) \\<Rightarrow> the \\<lceil>(a, s)\\<rceil>) c\\<^sub>1 :: write_capability list\"\n    and ?l\\<^sub>2 =  \"map (\\<lambda> (_, [a, s]) \\<Rightarrow> the \\<lceil>(a, s)\\<rceil>) c\\<^sub>2 :: write_capability list\"\n  assume ?len\\<^sub>1 ?len\\<^sub>2 ?eq\n  hence eq:\"?l\\<^sub>1 = ?l\\<^sub>2\" by (auto iff:cap_list_inject)\n  thus 0:\"length (map snd c\\<^sub>1) = length (map snd c\\<^sub>2)\" using map_eq_imp_length_eq by simp\n  {\n    fix i\n    let ?c\\<^sub>1 = \"snd (c\\<^sub>1 ! i)\" and ?c\\<^sub>2 = \"snd (c\\<^sub>2 ! i)\"\n    assume i:\"i < length (map snd c\\<^sub>1)\"\n    with 0 have i':\"i < length (map snd c\\<^sub>2)\" by simp\n    assume \"list_all (?P \\<circ> snd) c\\<^sub>1\" \"list_all (?P \\<circ> snd) c\\<^sub>2\"\n    hence \"?P ?c\\<^sub>1\" \"?P ?c\\<^sub>2\" unfolding list_all_def using i i' by auto\n    with i i' obtain c1\\<^sub>1 c1\\<^sub>2 c2\\<^sub>1 c2\\<^sub>2 where\n      wf:\"wf_cap Write ?c\\<^sub>1\" \"wf_cap Write ?c\\<^sub>2\"\n         \"?c\\<^sub>1 = overwrite_cap Write ?c\\<^sub>1 (zero_fill ?c\\<^sub>1)\"\n         \"?c\\<^sub>2 = overwrite_cap Write ?c\\<^sub>2 (zero_fill ?c\\<^sub>2)\"\n         \"?c\\<^sub>1 = [c1\\<^sub>1, c1\\<^sub>2]\"         \"?c\\<^sub>2 = [c2\\<^sub>1, c2\\<^sub>2]\"\n      using that[of \"?c\\<^sub>1 ! 0\" \"?c\\<^sub>1 ! 1\" \"?c\\<^sub>2 ! 0\" \"?c\\<^sub>2 ! 1\"] unfolding wf_cap_def\n      by (auto  split:list.splits)\n    have ith:\"\\<And> l\\<^sub>1 l\\<^sub>2 i. l\\<^sub>1 = l\\<^sub>2 \\<Longrightarrow> l\\<^sub>1 ! i = l\\<^sub>2 ! i\" by simp\n    from i i' wf ith[OF eq, where i = i] have \"(c1\\<^sub>1, c1\\<^sub>2) = (c2\\<^sub>1, c2\\<^sub>2)\"\n      unfolding wf_cap_def using write_cap_inv.inv_inj' by (auto split:prod.splits)\n    with wf i i' show \"map snd c\\<^sub>1 ! i = map snd c\\<^sub>2 ! i\" by simp\n  }\nqed\n\nlemma log_cap_list_inj:\n  \"\\<lbrakk>length c\\<^sub>1 <  2 ^ LENGTH(8 word) - 1;\n   length c\\<^sub>2 <  2 ^ LENGTH(8 word) - 1;\n   list_all ((\\<lambda> c. wf_cap Log c \\<and> c = overwrite_cap Log c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) c\\<^sub>1;\n   list_all ((\\<lambda> c. wf_cap Log c \\<and> c = overwrite_cap Log c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) c\\<^sub>2;\n   (cap_list (map (the \\<circ> abs \\<circ> snd) c\\<^sub>1) :: log_capability capability_list) =\n    cap_list (map (the \\<circ> abs \\<circ> snd) c\\<^sub>2)\\<rbrakk>\n   \\<Longrightarrow> map snd c\\<^sub>1 = map snd c\\<^sub>2\"\n  (is \"\\<lbrakk>?len\\<^sub>1; ?len\\<^sub>2; list_all (?P \\<circ> snd) c\\<^sub>1; _; ?eq\\<rbrakk> \\<Longrightarrow> _\")\nproof (subst list_eq_iff_nth_eq, intro conjI allI impI)\n  let ?l\\<^sub>1 = \"map (the \\<circ> abs \\<circ> snd) c\\<^sub>1 :: log_capability list\"\n    and ?l\\<^sub>2 =  \"map (the \\<circ> abs \\<circ> snd) c\\<^sub>2 :: log_capability list\"\n  assume ?len\\<^sub>1 ?len\\<^sub>2 ?eq\n  hence eq:\"?l\\<^sub>1 = ?l\\<^sub>2\" by (auto iff:cap_list_inject)\n  thus 0:\"length (map snd c\\<^sub>1) = length (map snd c\\<^sub>2)\" using map_eq_imp_length_eq by simp\n  {\n    fix i\n    let ?c\\<^sub>1 = \"snd (c\\<^sub>1 ! i)\" and ?c\\<^sub>2 = \"snd (c\\<^sub>2 ! i)\"\n    assume i:\"i < length (map snd c\\<^sub>1)\"\n    with 0 have i':\"i < length (map snd c\\<^sub>2)\" by simp\n    assume \"list_all (?P \\<circ> snd) c\\<^sub>1\" \"list_all (?P \\<circ> snd) c\\<^sub>2\"\n    hence \"?P ?c\\<^sub>1\" \"?P ?c\\<^sub>2\" unfolding list_all_def using i i' by auto\n    with i i' have\n      wf:\"wf_cap Log ?c\\<^sub>1\" \"wf_cap Log ?c\\<^sub>2\"\n         \"?c\\<^sub>1 \\<noteq> []\"       \"?c\\<^sub>2 \\<noteq> []\"\n         \"?c\\<^sub>1 = overwrite_cap Log ?c\\<^sub>1 (zero_fill ?c\\<^sub>1)\"\n         \"?c\\<^sub>2 = overwrite_cap Log ?c\\<^sub>2 (zero_fill ?c\\<^sub>2)\"\n    unfolding wf_cap_def by auto\n    have ith:\"\\<And> l\\<^sub>1 l\\<^sub>2 i. l\\<^sub>1 = l\\<^sub>2 \\<Longrightarrow> l\\<^sub>1 ! i = l\\<^sub>2 ! i\" by simp\n    from i i' wf ith[OF eq, where i = i] have \"?c\\<^sub>1 = ?c\\<^sub>2\"\n      unfolding wf_cap_def using log_cap_inv.inv_inj' by (force split: list.splits)\n    with wf i i' show \"map snd c\\<^sub>1 ! i = map snd c\\<^sub>2 ! i\" by simp\n  }\nqed\n\nlemma ext_cap_list_inj:\n  \"\\<lbrakk>length c\\<^sub>1 <  2 ^ LENGTH(8 word) - 1;\n   length c\\<^sub>2 <  2 ^ LENGTH(8 word) - 1;\n   list_all ((\\<lambda> c. wf_cap Send c \\<and> c = overwrite_cap Send c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) c\\<^sub>1;\n   list_all ((\\<lambda> c. wf_cap Send c \\<and> c = overwrite_cap Send c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) c\\<^sub>2;\n   (cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) c\\<^sub>1) :: external_call_capability capability_list) =\n    cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) c\\<^sub>2)\\<rbrakk>\n   \\<Longrightarrow> map snd c\\<^sub>1 = map snd c\\<^sub>2\"\n  (is \"\\<lbrakk>?len\\<^sub>1; ?len\\<^sub>2; ?all\\<^sub>1; ?all\\<^sub>2; ?eq\\<rbrakk> \\<Longrightarrow> _\")\nproof (subst list_eq_iff_nth_eq, intro conjI allI impI)\n  let ?l\\<^sub>1 = \"map (the \\<circ> abs \\<circ> hd \\<circ> snd) c\\<^sub>1 :: external_call_capability list\"\n    and ?l\\<^sub>2 =  \"map (the \\<circ> abs \\<circ> hd \\<circ> snd) c\\<^sub>2 :: external_call_capability list\"\n  assume ?len\\<^sub>1 ?len\\<^sub>2 ?eq\n  hence eq:\"?l\\<^sub>1 = ?l\\<^sub>2\" by (auto iff:cap_list_inject)\n  thus 0:\"length (map snd c\\<^sub>1) = length (map snd c\\<^sub>2)\" using map_eq_imp_length_eq by simp\n  {\n    fix i\n    let ?c\\<^sub>1 = \"snd (c\\<^sub>1 ! i)\" and ?c\\<^sub>2 = \"snd (c\\<^sub>2 ! i)\"\n    assume i:\"i < length (map snd c\\<^sub>1)\"\n    with 0 have i':\"i < length (map snd c\\<^sub>2)\" by simp\n    with eq have eq':\"(the \\<lceil>hd ?c\\<^sub>1\\<rceil> :: external_call_capability) = the \\<lceil>hd ?c\\<^sub>2\\<rceil>\"\n      by (auto iff:list_eq_iff_nth_eq)\n    assume ?all\\<^sub>1 ?all\\<^sub>2\n    with i i' have wf:\"wf_cap Send ?c\\<^sub>1\" \"wf_cap Send ?c\\<^sub>2\"\n                      \"?c\\<^sub>1 = overwrite_cap Send ?c\\<^sub>1 (zero_fill ?c\\<^sub>1)\"\n                      \"?c\\<^sub>2 = overwrite_cap Send ?c\\<^sub>2 (zero_fill ?c\\<^sub>2)\"\n                      \"?c\\<^sub>1 \\<noteq> []\"         \"?c\\<^sub>2 \\<noteq> []\"\n      unfolding list_all_def by auto\n    with eq' wf i i' show \"map snd c\\<^sub>1 ! i = map snd c\\<^sub>2 ! i\"\n      unfolding wf_cap_def overwrite_cap_def by (auto split:list.splits)\n  }\nqed\n\nlemma length_alist_update: \"k \\<notin> dom (map_of l) \\<Longrightarrow> length (AList.update k v l) = length l + 1\"\n  by (induct l, auto)\n\nlemma length_alist_update'[simp]:\n  \"\\<lbrakk>k \\<notin> dom (map_of l); length l + 1 \\<le> n\\<rbrakk> \\<Longrightarrow> length (AList.update k v l) \\<le> n\"\n  using length_alist_update by force\n\nlemma alist_update_eqD'[dest]:\n  \"\\<lbrakk>AList.update k\\<^sub>1 v\\<^sub>1 l = AList.update k\\<^sub>2 v\\<^sub>2 l; k\\<^sub>1 \\<notin> dom (map_of l); k\\<^sub>2 \\<notin> dom (map_of l)\\<rbrakk>\n   \\<Longrightarrow> k\\<^sub>1 = k\\<^sub>2 \\<and> v\\<^sub>1 = v\\<^sub>2\"\n  by (induct l, auto)\n\nlemma dalist_update_eqD'[dest]:\n  \"\\<lbrakk>DAList.update k\\<^sub>1 v\\<^sub>1 l = DAList.update k\\<^sub>2 v\\<^sub>2 l;\n   k\\<^sub>1 \\<notin> dom (DAList.lookup l); k\\<^sub>2 \\<notin> dom (DAList.lookup l)\\<rbrakk> \\<Longrightarrow>\n   k\\<^sub>1 = k\\<^sub>2 \\<and> v\\<^sub>1 = v\\<^sub>2\"\n  by (transfer, auto)\n\nlemma register_inj:\n  \"\\<lbrakk>register i\\<^sub>1 d\\<^sub>1 s = (Success s', r\\<^sub>1); register i\\<^sub>2 d\\<^sub>2 s = (Success s', r\\<^sub>2)\\<rbrakk>\n   \\<Longrightarrow> (the \\<lceil>cat d\\<^sub>1\\<rceil> :: register_call_data) ~ the \\<lceil>cat d\\<^sub>2\\<rceil>\"\n  unfolding sim_register_call_def Let_def\nproof (intro conjI)\n  assume eq1:\"register i\\<^sub>1 d\\<^sub>1 s = (Success s', r\\<^sub>1)\"\n     and eq2:\"register i\\<^sub>2 d\\<^sub>2 s = (Success s', r\\<^sub>2)\"\n\n  let ?d\\<^sub>1' = \"the \\<lceil>cat d\\<^sub>1\\<rceil> :: register_call_data\"\n  and ?d\\<^sub>2' = \"the \\<lceil>cat d\\<^sub>2\\<rceil> :: register_call_data\"\n\n  let ?\\<sigma> = \"the \\<lceil>s\\<rceil>\"\n  let ?p = \"curr_proc' ?\\<sigma>\"\n\n  from eq1 eq2 have eq:\"fst (register i\\<^sub>1 d\\<^sub>1 s) = fst (register i\\<^sub>2 d\\<^sub>2 s)\" by simp\n\n  note [simp] = Let_def register_def\n\n  from eq1 have 1:\"LENGTH(word32) div LENGTH(byte) dvd length d\\<^sub>1\"\n                  \"(\\<lceil>cat d\\<^sub>1\\<rceil> :: register_call_data option) \\<noteq> None\"\n                  \"max_nprocs \\<noteq> nprocs ?\\<sigma>\"\n                  \"\\<not> has_key (proc_key ?d\\<^sub>1') ?\\<sigma>\"\n                  \"\\<lfloor>i\\<^sub>1\\<rfloor> < length \\<lfloor>reg_caps ?p\\<rfloor>\"\n                  \"proc_key ?d\\<^sub>1' \\<in> \\<lceil>\\<lfloor>reg_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>1\\<rfloor>\\<rceil>\"\n                  \"valid_code (eth_addr ?d\\<^sub>1')\"\n                  \"caps Call ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Reg ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Del ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Entry ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Write ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Log ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Send ?d\\<^sub>1' \\<noteq> None\"\n                  \"sub_caps Call   (the (caps Call ?d\\<^sub>1')) ?p \\<and>\n                   sub_caps Reg    (the (caps Reg ?d\\<^sub>1')) ?p \\<and>\n                   sub_caps Del    (the (caps Del ?d\\<^sub>1')) ?p \\<and>\n                   sub_caps Entry  (the (caps Entry ?d\\<^sub>1')) ?p \\<and>\n                   sub_caps Write  (the (caps Write ?d\\<^sub>1')) ?p \\<and>\n                   sub_caps Log    (the (caps Log ?d\\<^sub>1')) ?p \\<and>\n                   sub_caps Send   (the (caps Send ?d\\<^sub>1')) ?p\"\n    by (simp_all split:if_splits option.splits)\n\n  from eq2 have 2:\"LENGTH(word32) div LENGTH(byte) dvd length d\\<^sub>2\"\n                  \"(\\<lceil>cat d\\<^sub>2\\<rceil> :: register_call_data option) \\<noteq> None\"\n                  \"max_nprocs \\<noteq> nprocs ?\\<sigma>\"\n                  \"\\<not> has_key (proc_key ?d\\<^sub>2') ?\\<sigma>\"\n                  \"\\<lfloor>i\\<^sub>2\\<rfloor> < length \\<lfloor>reg_caps ?p\\<rfloor>\"\n                  \"proc_key ?d\\<^sub>2' \\<in> \\<lceil>\\<lfloor>reg_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>2\\<rfloor>\\<rceil>\"\n                  \"valid_code (eth_addr ?d\\<^sub>2')\"\n                  \"caps Call ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Reg ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Del ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Entry ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Write ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Log ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Send ?d\\<^sub>2' \\<noteq> None\"\n                  \"sub_caps Call   (the (caps Call ?d\\<^sub>2')) ?p \\<and>\n                   sub_caps Reg    (the (caps Reg ?d\\<^sub>2')) ?p \\<and>\n                   sub_caps Del    (the (caps Del ?d\\<^sub>2')) ?p \\<and>\n                   sub_caps Entry  (the (caps Entry ?d\\<^sub>2')) ?p \\<and>\n                   sub_caps Write  (the (caps Write ?d\\<^sub>2')) ?p \\<and>\n                   sub_caps Log    (the (caps Log ?d\\<^sub>2')) ?p \\<and>\n                   sub_caps Send   (the (caps Send ?d\\<^sub>2')) ?p\"\n    by (simp_all split:if_splits option.splits)\n\n  from 1\n  have size1[simplified, simp]:\"\\<And> y v. \\<not> has_key (proc_key y) (the \\<lceil>s\\<rceil>)\n              \\<Longrightarrow> length \\<lfloor>DAList.update (proc_key y) v \\<lfloor>proc_list (the \\<lceil>s\\<rceil>)\\<rfloor>\\<rfloor> \\<le> max_nprocs\"\n    using proc_list_rep[of \"kernel.proc_list (the \\<lceil>s\\<rceil>)\"]\n    by (auto simp add:update.rep_eq has_key_def DAList.lookup_def)\n\n  from eq 1 2 have \"proc_key ?d\\<^sub>1' = proc_key ?d\\<^sub>2' \\<and> eth_addr ?d\\<^sub>1' = eth_addr ?d\\<^sub>2'\"\n    apply (simp split:if_splits option.splits)\n    apply (drule kernel_rep_inj)\n    apply (rewrite in \\<open>\\<hole> = (_ :: kernel)\\<close> in asm kernel.surjective)\n    apply (rewrite in \\<open>(_ :: kernel) = \\<hole>\\<close> in asm kernel.surjective, simp)\n    by (auto iff:proc_list_inject simp add:has_key_def)\n  thus key:\"proc_key ?d\\<^sub>1' = proc_key ?d\\<^sub>2'\" and \"eth_addr ?d\\<^sub>1' = eth_addr ?d\\<^sub>2'\" by simp_all\n\n  {\n    fix t\n    let ?c\\<^sub>1 = \"fill_caps t (the (caps t ?d\\<^sub>1')) ?p\"\n    let ?c\\<^sub>2 = \"fill_caps t (the (caps t ?d\\<^sub>2')) ?p\"\n    have length1[simplified]:\"caps t ?d\\<^sub>1' \\<noteq> None \\<Longrightarrow> length ?c\\<^sub>1 < 2 ^ LENGTH(8 word) - 1\"\n      unfolding caps_def fill_caps_def by (simp split:if_splits)\n    from 1 have length1:\"length ?c\\<^sub>1 <  2 ^ LENGTH(8 word) - 1\"\n      by simp (rule length1, induct t, simp+)\n    have length2[simplified]:\"caps t ?d\\<^sub>2' \\<noteq> None \\<Longrightarrow> length ?c\\<^sub>2 < 2 ^ LENGTH(8 word) - 1\"\n      unfolding caps_def fill_caps_def by (simp split:if_splits)\n    from 2 have length2: \"length ?c\\<^sub>2 <  2 ^ LENGTH(8 word) - 1\"\n      by simp (rule length2, induct t, simp+)\n\n    have [intro]:\"\\<And> c i l d. ((c, i), l) \\<in> set \\<lfloor>d :: capability_data\\<rfloor> \\<Longrightarrow> wf_cap c l\"\n      using cap_data_rep' by force\n    have [intro]:\n      \"\\<And> c i l d. ((c, i), l) \\<in> set \\<lfloor>d :: capability_data\\<rfloor> \\<Longrightarrow> l = overwrite_cap c l (zero_fill l)\"\n      using cap_data_rep' by force\n    assume t:\"t \\<noteq> Entry\"\n    hence\n      \"\\<lbrakk>(\\<lceil>cat d\\<^sub>1\\<rceil> :: register_call_data option) \\<noteq> None; caps t ?d\\<^sub>1' \\<noteq> None\\<rbrakk>\n       \\<Longrightarrow> list_all ((\\<lambda> c. wf_cap t c \\<and> c = overwrite_cap t c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) ?c\\<^sub>1\"\n      unfolding list_all_def fill_caps_def caps_def\n      apply (induct t, auto)\n                   apply (simp_all add:wf_cap_def overwrite_cap_def split:prod.splits list.splits)\n          apply (metis write_cap_inv.inv_inj)\n         apply (metis write_cap_inv.inv_inj option.sel prod.inject)\n        apply (metis log_cap_inv.inv_inj)\n       apply (metis log_cap_inv.inv_inj option.sel)\n      by (metis add_is_0 numerals(1) zero_neq_numeral log_cap_rep_length list.size(3))\n    with 1 have\n     all1:\"list_all ((\\<lambda> c. wf_cap t c \\<and> c = overwrite_cap t c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) ?c\\<^sub>1\"\n      by (induct t, simp_all)\n\n    from t have\n      \"\\<lbrakk>(\\<lceil>cat d\\<^sub>2\\<rceil> :: register_call_data option) \\<noteq> None; caps t ?d\\<^sub>2' \\<noteq> None\\<rbrakk>\n       \\<Longrightarrow> list_all ((\\<lambda> c. wf_cap t c \\<and> c = overwrite_cap t c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) ?c\\<^sub>2\"\n      unfolding list_all_def fill_caps_def caps_def\n      apply (induct t, auto)\n                   apply (simp_all add:wf_cap_def overwrite_cap_def split:prod.splits list.splits)\n          apply (metis write_cap_inv.inv_inj)\n         apply (metis write_cap_inv.inv_inj option.sel prod.inject)\n        apply (metis log_cap_inv.inv_inj)\n       apply (metis log_cap_inv.inv_inj option.sel)\n      by (metis add_is_0 numerals(1) zero_neq_numeral log_cap_rep_length list.size(3))\n    with 2 have\n     all2:\"list_all ((\\<lambda> c. wf_cap t c \\<and> c = overwrite_cap t c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) ?c\\<^sub>2\"\n      by (induct t, simp_all)\n\n    have \"\\<lbrakk>(\\<lceil>cat d\\<^sub>1\\<rceil> :: register_call_data option) \\<noteq> None; caps t ?d\\<^sub>1' \\<noteq> None\\<rbrakk> \\<Longrightarrow>\n          list_all (wf_cap t \\<circ> snd) (the (caps t ?d\\<^sub>1'))\"\n      unfolding list_all_def caps_def using cap_data_rep' by (auto split:if_splits)\n    with 1 have all3:\"list_all (wf_cap t \\<circ> snd) (the (caps t ?d\\<^sub>1'))\" by (induct t, simp_all)\n\n    have \"\\<lbrakk>(\\<lceil>cat d\\<^sub>2\\<rceil> :: register_call_data option) \\<noteq> None; caps t ?d\\<^sub>2' \\<noteq> None\\<rbrakk> \\<Longrightarrow>\n          list_all (wf_cap t \\<circ> snd) (the (caps t ?d\\<^sub>2'))\"\n      unfolding list_all_def caps_def using cap_data_rep' by (auto split:if_splits)\n    with 2 have all4:\"list_all (wf_cap t \\<circ> snd) (the (caps t ?d\\<^sub>2'))\" by (induct t, simp_all)\n\n    note length1 length2 all1 all2 all3 all4\n  } note ps = this\n\n  note fill = fill_caps_inj[OF ps(5) ps(6), rotated 2]\n\n  note call =  pref_cap_list_inj[where t=Call,\n                                OF ps(1)[of Call] ps(2)[of Call], simplified,\n                                OF ps(3)[of Call], simplified, OF ps(4)[of Call], simplified]\n  note del = pref_cap_list_inj[where t=Del,\n                               OF ps(1)[of Del] ps(2)[of Del], simplified,\n                               OF ps(3)[of Del], simplified, OF ps(4)[of Del], simplified]\n  note reg = pref_cap_list_inj[where t=Reg,\n                               OF ps(1)[of Reg] ps(2)[of Reg], simplified,\n                               OF ps(3)[of Reg], simplified, OF ps(4)[of Reg], simplified]\n  note wri = write_cap_list_inj[OF ps(1)[of Write] ps(2)[of Write], simplified,\n                                  OF ps(3)[of Write], simplified, OF ps(4)[of Write], simplified]\n\n  note log = log_cap_list_inj[OF ps(1)[of Log] ps(2)[of Log], simplified,\n                              OF ps(3)[of Log], simplified, OF ps(4)[of Log], simplified]\n\n  note send = ext_cap_list_inj[OF ps(1)[of Send] ps(2)[of Send], simplified,\n                               OF ps(3)[of Send], simplified, OF ps(4)[of Send], simplified]\n\n  have [dest!]: \"\\<And> k p\\<^sub>1 p\\<^sub>2 l\\<^sub>1 l\\<^sub>2. DAList.update k p\\<^sub>1 \\<lfloor>l\\<^sub>1\\<rfloor> = DAList.update k p\\<^sub>2 \\<lfloor>l\\<^sub>2\\<rfloor> \\<Longrightarrow> p\\<^sub>1 = p\\<^sub>2\"\n    by (auto iff:Alist_inject dest:update_eqD simp add: distinct_update DAList.update_def)\n\n  from eq 1 2 show\n    \"list_all2 (same_explicit_cap Call)\n       (map snd (the (caps Call ?d\\<^sub>1'))) (map snd (the (caps Call ?d\\<^sub>2')))\"\n    \"list_all2 (same_explicit_cap Reg)\n       (map snd (the (caps Reg ?d\\<^sub>1'))) (map snd (the (caps Reg ?d\\<^sub>2')))\"\n    \"list_all2 (same_explicit_cap Del)\n       (map snd (the (caps Del ?d\\<^sub>1'))) (map snd (the (caps Del ?d\\<^sub>2')))\"\n    \"list_all2 (same_explicit_cap Write)\n       (map snd (the (caps Write ?d\\<^sub>1'))) (map snd (the (caps Write ?d\\<^sub>2')))\"\n    \"list_all2 (same_explicit_cap Log)\n       (map snd (the (caps Log ?d\\<^sub>1'))) (map snd (the (caps Log ?d\\<^sub>2')))\"\n    \"list_all2 (same_explicit_cap Send)\n       (map snd (the (caps Send ?d\\<^sub>1'))) (map snd (the (caps Send ?d\\<^sub>2')))\"\n    using key\n    by -\n      (rule fill, rule call reg del wri log send,\n        simp split:if_splits option.splits,\n        drule kernel_rep_inj,\n        rewrite in \\<open>\\<hole> = (_ :: kernel)\\<close> in asm kernel.surjective,\n        rewrite in \\<open>(_ :: kernel) = \\<hole>\\<close> in asm kernel.surjective,\n        (auto iff:proc_list_inject)[3])+\n\n  have [simp]: \"fill_caps Entry [] ?p = []\" unfolding fill_caps_def by simp\n\n  have [dest]: \"\\<And> y. fill_caps Entry y ?p = [] \\<Longrightarrow> y = []\" unfolding fill_caps_def by simp\n\n  from eq 1 2 show \"(the (caps Entry ?d\\<^sub>1') = []) = (the (caps Entry ?d\\<^sub>2') = [])\"\n    using key\n    apply (simp split:if_splits option.splits)\n    apply (drule kernel_rep_inj)\n    apply (rewrite in \\<open>\\<hole> = (_ :: kernel)\\<close> in asm kernel.surjective)\n    apply (rewrite in \\<open>(_ :: kernel) = \\<hole>\\<close> in asm kernel.surjective)\n    by (auto iff:proc_list_inject)\nqed\n\nsubsection \\<open>Delete system call\\<close>\n\ntext \\<open>\n  If the Delete Procedure system call is executed with a procedure key that does not exist,\n  it fails and returns @{text SYSCALL_FAIL} followed by the @{text DEL_NOPROC} error code.\n\\<close>\n\nabbreviation \"DEL_NOPROC \\<equiv> 0x33\"\n\ntext \\<open>\n  Delete Procedure system call deletes a procedure by its key. But if the call data is malformed,\n  the procedure does not exist, the specified capability index is out of range, the capability\n  found by the index does not allow deleting this procedure, then the kernel performs Revert and\n  returns a specified error code.\n\\<close>\n\ndefinition delete :: \"capability_index \\<Rightarrow> byte list \\<Rightarrow> storage \\<Rightarrow> result \\<times> byte list\" where\n  \"delete i d s \\<equiv>\n     let \\<sigma> = the \\<lceil>s\\<rceil>;\n         p = curr_proc' \\<sigma> in\n     if \\<not> LENGTH(word32) div LENGTH(byte) dvd length d then\n                                                      (Revert, [])\n     else case \\<lceil>cat d\\<rceil> of\n       None                                      \\<Rightarrow>   (Revert, [])\n                                  \\<comment> \\<open>Malformed call data, currently the error code is not defined\\<close>\n     | Some k                                    \\<Rightarrow>\n       if \\<not> has_key k \\<sigma>                          then (Revert, [SYSCALL_FAIL, DEL_NOPROC])\n       else if length \\<lfloor>del_caps p\\<rfloor> \\<le> \\<lfloor>i\\<rfloor>         then (Revert, [SYSCALL_BADCAP])\n                                                                               \\<comment> \\<open>No such cap\\<close>\n       else if k \\<notin> \\<lceil>\\<lfloor>del_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rceil>           then (Revert, [SYSCALL_BADCAP])\n       else\n         let procs = \\<lceil>DAList.delete k \\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rceil>;\n             \\<sigma>' = \\<sigma> \\<lparr> proc_list := procs \\<rparr> in\n                                                      (Success (\\<lfloor>\\<sigma>'\\<rfloor> s), [])\"\n\ndefinition \"sim_delete_call k\\<^sub>1 k\\<^sub>2 \\<equiv> k\\<^sub>1 = k\\<^sub>2\" for k\\<^sub>1 k\\<^sub>2 :: delete_call_data\n\nadhoc_overloading sim sim_delete_call\n\nlemma delete_inj:\n  \"\\<lbrakk>delete i\\<^sub>1 d\\<^sub>1 s = (Success s', r\\<^sub>1); delete i\\<^sub>2 d\\<^sub>2 s = (Success s', r\\<^sub>2)\\<rbrakk>\n   \\<Longrightarrow> (the \\<lceil>cat d\\<^sub>1\\<rceil> :: delete_call_data) ~ the \\<lceil>cat d\\<^sub>2\\<rceil>\"\nunfolding sim_delete_call_def\nproof-\n  assume eq1:\"delete i\\<^sub>1 d\\<^sub>1 s = (Success s', r\\<^sub>1)\"\n     and eq2:\"delete i\\<^sub>2 d\\<^sub>2 s = (Success s', r\\<^sub>2)\"\n\n  let ?d\\<^sub>1' = \"the \\<lceil>cat d\\<^sub>1\\<rceil> :: delete_call_data\"\n  and ?d\\<^sub>2' = \"the \\<lceil>cat d\\<^sub>2\\<rceil> :: delete_call_data\"\n\n  let ?\\<sigma> = \"the \\<lceil>s\\<rceil>\"\n  let ?p = \"curr_proc' ?\\<sigma>\"\n\n  from eq1 eq2 have eq:\"fst (delete i\\<^sub>1 d\\<^sub>1 s) = fst (delete i\\<^sub>2 d\\<^sub>2 s)\" by simp\n\n  note [simp] = Let_def delete_def\n\n  from eq1 have 1:\"LENGTH(word32) div LENGTH(byte) dvd length d\\<^sub>1\"\n                  \"(\\<lceil>cat d\\<^sub>1\\<rceil> :: delete_call_data option) \\<noteq> None\"\n                  \"has_key ?d\\<^sub>1' ?\\<sigma>\"\n                  \"\\<lfloor>i\\<^sub>1\\<rfloor> < length \\<lfloor>del_caps ?p\\<rfloor>\"\n                  \"?d\\<^sub>1' \\<in> \\<lceil>\\<lfloor>del_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>1\\<rfloor>\\<rceil>\"\n    by (simp_all split:if_splits option.splits)\n\n  from eq2 have 2:\"LENGTH(word32) div LENGTH(byte) dvd length d\\<^sub>2\"\n                  \"(\\<lceil>cat d\\<^sub>2\\<rceil> :: delete_call_data option) \\<noteq> None\"\n                  \"has_key ?d\\<^sub>2' ?\\<sigma>\"\n                  \"\\<lfloor>i\\<^sub>2\\<rfloor> < length \\<lfloor>del_caps ?p\\<rfloor>\"\n                  \"?d\\<^sub>2' \\<in> \\<lceil>\\<lfloor>del_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>2\\<rfloor>\\<rceil>\"\n    by (simp_all split:if_splits option.splits)\n\n\n  {\n    fix k\\<^sub>1 k\\<^sub>2\n    have inset:\"DAList.delete k\\<^sub>1 \\<lfloor>proc_list (the \\<lceil>s\\<rceil>)\\<rfloor> \\<in> {l. size l \\<le> max_nprocs}\"\n      using AList.length_delete_le[of k\\<^sub>1 \"\\<lfloor>\\<lfloor>proc_list (the \\<lceil>s\\<rceil>)\\<rfloor>\\<rfloor>\"]\n             proc_list_rep[of \"proc_list (the \\<lceil>s\\<rceil>)\"]\n      by (simp add:delete.rep_eq)\n    {\n      fix k and l :: \"(key \\<times> 'a) list\"\n      have \"\\<lbrakk>distinct (map fst l); k \\<notin> dom (map_of l)\\<rbrakk>\n             \\<Longrightarrow> length (filter (\\<lambda>(k', _). k \\<noteq> k') l) = length l\"\n        by (induct l, auto)\n    } note notin = this\n    {\n      fix k and l :: \"(key \\<times> 'a) list\"\n      have \"\\<lbrakk>distinct (map fst l); k \\<in> dom (map_of l)\\<rbrakk>\n            \\<Longrightarrow> length (filter (\\<lambda>(k', _). k \\<noteq> k') l) = length l - 1\"\n      proof (induct l, simp)\n        case (Cons x xs)\n        thus ?case proof (cases \"k = fst x\")\n          case True\n          with Cons(2) have p1:\"k \\<notin> dom (map_of xs)\" using image_iff by fastforce\n          from Cons(2) have p0:\"distinct (map fst xs)\" by simp\n          from True notin[OF p0 p1]\n          show \"length (filter (\\<lambda>(k', _). k \\<noteq> k') (x # xs)) = length (x # xs) - 1\" by auto\n        next\n          case False\n          with Cons(3) have p1:\"k \\<in> dom (map_of xs)\" by auto\n          from Cons(2) have p0:\"distinct (map fst xs)\" by simp\n          from Cons(3) False have \"xs \\<noteq> []\" by auto\n          with Cons(1)[OF p0 p1] False\n          show \"length (filter (\\<lambda>(k', _). k \\<noteq> k') (x # xs)) = length (x # xs) - 1\"\n            by auto\n        qed\n      qed\n    } note length = this\n    {\n      fix k and l :: \"(key \\<times> 'a) list\"\n      have \"\\<lbrakk>filter (\\<lambda>(k', _). k\\<^sub>1 \\<noteq> k') l = filter (\\<lambda>(k', _). k\\<^sub>2 \\<noteq> k') l;\n             k\\<^sub>1 \\<in> dom (map_of l); k\\<^sub>2 \\<in> dom (map_of l);\n             distinct (map fst l)\\<rbrakk>\n            \\<Longrightarrow> k\\<^sub>1 = k\\<^sub>2\"\n        by (induct l, auto split:if_splits)\n          (metis (mono_tags) case_prod_conv list.set_intros(1) mem_Collect_eq set_filter)+\n    } note [dest] = this\n\n    have inj:\"\\<lbrakk>DAList.delete k\\<^sub>1 \\<lfloor>kernel.proc_list (the \\<lceil>s\\<rceil>)\\<rfloor> =\n           DAList.delete k\\<^sub>2 \\<lfloor>kernel.proc_list (the \\<lceil>s\\<rceil>)\\<rfloor>;\n           k\\<^sub>1 \\<in> dom (DAList.lookup \\<lfloor>kernel.proc_list (the \\<lceil>s\\<rceil>)\\<rfloor>);\n           k\\<^sub>2 \\<in> dom (DAList.lookup \\<lfloor>kernel.proc_list (the \\<lceil>s\\<rceil>)\\<rfloor>)\\<rbrakk>\n           \\<Longrightarrow> k\\<^sub>1 = k\\<^sub>2\"\n      apply (auto iff:Alist_inject simp add:DAList.delete_def, subst (asm) Alist_inject)\n      using impl_of[of \"\\<lfloor>kernel.proc_list (the \\<lceil>s\\<rceil>)\\<rfloor>\"]\n      by ((simp add:distinct_delete)+)[2]\n        (auto simp add:DAList.lookup_def AList.delete_eq distinct_delete)\n    note inset inj\n  } note aux[simplified, simp] = this\n\n  note [dest] = aux(2)\n\n  from eq 1 2 show \"?d\\<^sub>1' = ?d\\<^sub>2'\"\n    apply (simp split:option.splits)\n    apply (drule kernel_rep_inj)\n    apply (rewrite in \\<open>\\<hole> = (_ :: kernel)\\<close> in asm kernel.surjective)\n    apply (rewrite in \\<open>(_ :: kernel) = \\<hole>\\<close> in asm kernel.surjective)\n    by (auto iff:proc_list_inject simp add: has_key_def)\nqed\n\nsubsection \\<open>Write system call\\<close>\n\ntext \\<open>\n  Write system call writes a single 32-byte value under a single 32-byte key in the storage of the\n  kernel instance. But if the call data is malformed, the specified capability index is out of\n  range, or the capability found by the index does not allow writing to the Storage at the\n  specified address, then the kernel performs Revert and returns a specified error code.\n\\<close>\n\ndefinition write_addr :: \"capability_index \\<Rightarrow> byte list \\<Rightarrow> storage \\<Rightarrow> result \\<times> byte list\" where\n  \"write_addr i d s \\<equiv>\n     let \\<sigma> = the \\<lceil>s\\<rceil>;\n         p = curr_proc' \\<sigma> in\n     if \\<not> LENGTH(word32) div LENGTH(byte) dvd length d then\n                                                      (Revert, [])\n     else case \\<lceil>cat d\\<rceil> of\n       None                                      \\<Rightarrow>   (Revert, [])\n                                  \\<comment> \\<open>Malformed call data, currently the error code is not defined\\<close>\n     | Some (a, v)                               \\<Rightarrow>\n       if length \\<lfloor>write_caps p\\<rfloor> \\<le> \\<lfloor>i\\<rfloor>            then (Revert, [SYSCALL_BADCAP])\n                                                                               \\<comment> \\<open>No such cap\\<close>\n       else if a \\<notin> \\<lceil>\\<lfloor>write_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rceil>         then (Revert, [SYSCALL_BADCAP])\n       else\n                                                      (Success (s (a := v)), [])\"\n\ndefinition \"sim_write_call d\\<^sub>1 d\\<^sub>2 \\<equiv> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: write_call_data\n\ndefinition \"relevant_write d s \\<equiv> let (a :: word32, v) = the \\<lceil>cat d\\<rceil> in s a \\<noteq> v\"\n  for d :: \"byte list\"\n\nadhoc_overloading sim sim_write_call\n\nlemma write_inj:\n  \"\\<lbrakk>write_addr i\\<^sub>1 d\\<^sub>1 s = (Success s', r\\<^sub>1); write_addr i\\<^sub>2 d\\<^sub>2 s = (Success s', r\\<^sub>2);\n    relevant_write d\\<^sub>1 s; relevant_write d\\<^sub>2 s\\<rbrakk>\n   \\<Longrightarrow> (the \\<lceil>cat d\\<^sub>1\\<rceil> :: write_call_data) ~ the \\<lceil>cat d\\<^sub>2\\<rceil>\"\nunfolding sim_write_call_def\nproof-\n  assume eq1:\"write_addr i\\<^sub>1 d\\<^sub>1 s = (Success s', r\\<^sub>1)\"\n     and eq2:\"write_addr i\\<^sub>2 d\\<^sub>2 s = (Success s', r\\<^sub>2)\"\n\n  let ?d\\<^sub>1' = \"the \\<lceil>cat d\\<^sub>1\\<rceil> :: write_call_data\"\n  and ?d\\<^sub>2' = \"the \\<lceil>cat d\\<^sub>2\\<rceil> :: write_call_data\"\n\n  let ?\\<sigma> = \"the \\<lceil>s\\<rceil>\"\n  let ?p = \"curr_proc' ?\\<sigma>\"\n\n  from eq1 eq2 have eq:\"fst (write_addr i\\<^sub>1 d\\<^sub>1 s) = fst (write_addr i\\<^sub>2 d\\<^sub>2 s)\" by simp\n\n  note [simp] = Let_def write_addr_def\n\n  from eq1 have 1:\"LENGTH(word32) div LENGTH(byte) dvd length d\\<^sub>1\"\n                  \"(\\<lceil>cat d\\<^sub>1\\<rceil> :: write_call_data option) \\<noteq> None\"\n                  \"\\<lfloor>i\\<^sub>1\\<rfloor> < length \\<lfloor>write_caps ?p\\<rfloor>\"\n                  \"fst ?d\\<^sub>1' \\<in> \\<lceil>\\<lfloor>write_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>1\\<rfloor>\\<rceil>\"\n    by (simp_all split:if_splits prod.splits option.splits)\n\n  from eq2 have 2:\"LENGTH(word32) div LENGTH(byte) dvd length d\\<^sub>2\"\n                  \"(\\<lceil>cat d\\<^sub>2\\<rceil> :: write_call_data option) \\<noteq> None\"\n                  \"\\<lfloor>i\\<^sub>2\\<rfloor> < length \\<lfloor>write_caps ?p\\<rfloor>\"\n                  \"fst ?d\\<^sub>2' \\<in> \\<lceil>\\<lfloor>write_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>2\\<rfloor>\\<rceil>\"\n    by (simp_all split:if_splits prod.splits option.splits)\n\n  assume \"relevant_write d\\<^sub>1 s\" \"relevant_write d\\<^sub>2 s\"\n  with eq 1 2 show \"?d\\<^sub>1' = ?d\\<^sub>2'\" unfolding relevant_write_def\n    by (simp split:option.splits prod.splits) (metis fun_upd_apply)\nqed\n\nsubsection \\<open>Set entry system call\\<close>\n\ntext \\<open>\n  Set Entry Procedure system call marks a procedure which should be called first upon receiving\n  a transaction. But if the call data is malformed, the procedure does not exist, the calling\n  procedure does not have capability to set entry procedure, then the kernel performs Revert\n  and returns a specified error code.\n\\<close>\n\ndefinition set_entry :: \"capability_index \\<Rightarrow> byte list \\<Rightarrow> storage \\<Rightarrow> result \\<times> byte list\" where\n  \"set_entry i d s \\<equiv>\n     let \\<sigma> = the \\<lceil>s\\<rceil>;\n         p = curr_proc' \\<sigma> in\n     if \\<not> LENGTH(word32) div LENGTH(byte) dvd length d then\n                                                      (Revert, [])\n     else case \\<lceil>cat d\\<rceil> of\n       None                                      \\<Rightarrow>   (Revert, [])\n                                  \\<comment> \\<open>Malformed call data, currently the error code is not defined\\<close>\n     | Some k                                    \\<Rightarrow>\n       if \\<not> has_key k \\<sigma>                          then (Revert, [SYSCALL_FAIL])\n                                                                   \\<comment> \\<open>No such proc key,\n                                                                        specific error code not\n                                                                        defined\\<close>\n       else if \\<not> entry_cap p                     then (Revert, [SYSCALL_BADCAP])\n       else\n         let \\<sigma>' = \\<sigma> \\<lparr> entry_proc := k \\<rparr> in\n                                                      (Success (\\<lfloor>\\<sigma>'\\<rfloor> s), [])\"\n\ndefinition \"sim_entry_call k\\<^sub>1 k\\<^sub>2 \\<equiv> k\\<^sub>1 = k\\<^sub>2\" for k\\<^sub>1 k\\<^sub>2 :: set_entry_call_data\n\ndefinition \"relevant_set_entry d s \\<equiv> entry_proc (the \\<lceil>s\\<rceil>) \\<noteq> the \\<lceil>cat d\\<rceil>\"\n  for d :: \"byte list\"\n\nno_adhoc_overloading sim sim_delete_call\n\nadhoc_overloading sim sim_entry_call\n\nlemma set_entry_inj:\n  \"\\<lbrakk>set_entry i\\<^sub>1 d\\<^sub>1 s = (Success s', r\\<^sub>1); set_entry i\\<^sub>2 d\\<^sub>2 s = (Success s', r\\<^sub>2);\n    relevant_set_entry d\\<^sub>1 s; relevant_set_entry d\\<^sub>2 s\\<rbrakk>\n   \\<Longrightarrow> (the \\<lceil>cat d\\<^sub>1\\<rceil> :: set_entry_call_data) ~ the \\<lceil>cat d\\<^sub>2\\<rceil>\"\nunfolding sim_entry_call_def\nproof-\n  assume eq1:\"set_entry i\\<^sub>1 d\\<^sub>1 s = (Success s', r\\<^sub>1)\"\n     and eq2:\"set_entry i\\<^sub>2 d\\<^sub>2 s = (Success s', r\\<^sub>2)\"\n\n  let ?d\\<^sub>1' = \"the \\<lceil>cat d\\<^sub>1\\<rceil> :: set_entry_call_data\"\n  and ?d\\<^sub>2' = \"the \\<lceil>cat d\\<^sub>2\\<rceil> :: set_entry_call_data\"\n\n  let ?\\<sigma> = \"the \\<lceil>s\\<rceil>\"\n  let ?p = \"curr_proc' ?\\<sigma>\"\n\n  from eq1 eq2 have eq:\"fst (set_entry i\\<^sub>1 d\\<^sub>1 s) = fst (set_entry i\\<^sub>2 d\\<^sub>2 s)\" by simp\n\n  note [simp] = Let_def set_entry_def\n\n  from eq1 have 1:\"LENGTH(word32) div LENGTH(byte) dvd length d\\<^sub>1\"\n                  \"(\\<lceil>cat d\\<^sub>1\\<rceil> :: set_entry_call_data option) \\<noteq> None\"\n                  \"has_key ?d\\<^sub>1' ?\\<sigma>\" \"entry_cap ?p\"\n    by (simp_all split:if_splits option.splits)\n\n  from eq2 have 2:\"LENGTH(word32) div LENGTH(byte) dvd length d\\<^sub>2\"\n                  \"(\\<lceil>cat d\\<^sub>2\\<rceil> :: set_entry_call_data option) \\<noteq> None\"\n                  \"has_key ?d\\<^sub>2' ?\\<sigma>\" \"entry_cap ?p\"\n    by (simp_all split:if_splits option.splits)\n\n  assume \"relevant_set_entry d\\<^sub>1 s\" \"relevant_set_entry d\\<^sub>2 s\"\n  with eq 1 2 show \"?d\\<^sub>1' = ?d\\<^sub>2'\" unfolding relevant_set_entry_def\n    apply auto\n    apply (drule kernel_rep_inj)\n    apply (rewrite in \\<open>\\<hole> = (_ :: kernel)\\<close> in asm kernel.surjective)\n    apply (rewrite in \\<open>(_ :: kernel) = \\<hole>\\<close> in asm kernel.surjective)\n    by simp\nqed\n\nsubsection \\<open>Log system call\\<close>\n\ntext \\<open>\n  Log system call appends an additional log entry (with a possibly empty list of log topics) to\n  the log series. This call does not change the state of the kernel storage. If the call data\n  is malformed, the specified capability index is out of range, or the capability found by the\n  index does not allow such logging, then the kernel performs Revert and returns a specified\n  error code.\n\\<close>\n\ntype_synonym log = \"(ethereum_address \\<times> log_topics \\<times> byte list) list\"\n\ndefinition log ::\n  \"capability_index \\<Rightarrow> byte list \\<Rightarrow> storage \\<Rightarrow> (result \\<times> byte list) \\<times> log\" where\n  \"log i d s \\<equiv>\n     let \\<sigma> = the \\<lceil>s\\<rceil>;\n         p = curr_proc' \\<sigma> in\n     let nolog = \\<lambda> r. (r, []) in\n     case \\<lceil>d\\<rceil> of\n       None                                      \\<Rightarrow>     nolog (Revert, [])\n                                  \\<comment> \\<open>Malformed call data, currently the error code is not defined\\<close>\n     | Some (ts, l)                              \\<Rightarrow>\n       if length \\<lfloor>log_caps p\\<rfloor> \\<le> \\<lfloor>i\\<rfloor>                then nolog (Revert, [SYSCALL_BADCAP])\n                                                                               \\<comment> \\<open>No such cap\\<close>\n       else if \\<lfloor>ts\\<rfloor> \\<notin> \\<lceil>\\<lfloor>log_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rceil>          then nolog (Revert, [SYSCALL_BADCAP])\n       else\n         let log = [(procedure.eth_addr (curr_proc' \\<sigma>), ts, l)] in\n                                                              ((Success s, []), log)\"\n\ndefinition \"sim_log_call d\\<^sub>1 d\\<^sub>2 \\<equiv> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: log_call_data\n\nadhoc_overloading sim sim_log_call\n\nlemma log_inj:\n  \"\\<lbrakk>log i\\<^sub>1 d\\<^sub>1 s = ((Success s\\<^sub>1', r\\<^sub>1), l); log i\\<^sub>2 d\\<^sub>2 s = ((Success s\\<^sub>2', r\\<^sub>2), l)\\<rbrakk>\n   \\<Longrightarrow> (the \\<lceil>d\\<^sub>1\\<rceil> :: log_call_data) ~ the \\<lceil>d\\<^sub>2\\<rceil>\"\nunfolding sim_log_call_def\nproof-\n  assume eq1:\"log i\\<^sub>1 d\\<^sub>1 s = ((Success s\\<^sub>1', r\\<^sub>1), l)\"\n     and eq2:\"log i\\<^sub>2 d\\<^sub>2 s = ((Success s\\<^sub>2', r\\<^sub>2), l)\"\n\n  let ?d\\<^sub>1' = \"the \\<lceil>d\\<^sub>1\\<rceil> :: log_call_data\"\n  and ?d\\<^sub>2' = \"the \\<lceil>d\\<^sub>2\\<rceil> :: log_call_data\"\n\n  let ?\\<sigma> = \"the \\<lceil>s\\<rceil>\"\n  let ?p = \"curr_proc' ?\\<sigma>\"\n\n  from eq1 eq2 have eq:\"snd (log i\\<^sub>1 d\\<^sub>1 s) = snd (log i\\<^sub>2 d\\<^sub>2 s)\" by simp\n\n  note [simp] = Let_def log_def\n\n  from eq1 have 1:\"(\\<lceil>d\\<^sub>1\\<rceil> :: log_call_data option) \\<noteq> None\"\n                  \"\\<lfloor>i\\<^sub>1\\<rfloor> < length \\<lfloor>log_caps ?p\\<rfloor>\"\n                  \"\\<lfloor>fst ?d\\<^sub>1'\\<rfloor> \\<in> \\<lceil>\\<lfloor>log_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>1\\<rfloor>\\<rceil>\"\n    by (simp_all split:if_splits prod.splits option.splits)\n\n  from eq2 have 2:\"(\\<lceil>d\\<^sub>2\\<rceil> :: log_call_data option) \\<noteq> None\"\n                  \"\\<lfloor>i\\<^sub>2\\<rfloor> < length \\<lfloor>log_caps ?p\\<rfloor>\"\n                  \"\\<lfloor>fst ?d\\<^sub>2'\\<rfloor> \\<in> \\<lceil>\\<lfloor>log_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>2\\<rfloor>\\<rceil>\"\n    by (simp_all split:if_splits prod.splits option.splits)\n\n  with eq 1 2 show \"?d\\<^sub>1' = ?d\\<^sub>2'\"\n    by (simp split:option.splits prod.splits)\nqed\n\nsubsection \\<open>Call system call\\<close>\n\ntext \\<open>\n  If the Procedure Call system call is executed with a procedure key that does not exist,\n  it fails and returns @{text SYSCALL_FAIL} followed by the @{text CALL_NOPROC} error code.\n\\<close>\n\nabbreviation \"CALL_NOPROC \\<equiv> 0x33\"\n\ntext \\<open>\n  Undefined function @{text exec_call} models the execution of a called procedure. The procedure\n  either returns Success and some new storage state, reverts due to an error, or runs out of gas.\n\\<close>\n\ndefinition exec_call :: \"[key, byte list, storage] \\<Rightarrow> result option \\<times> byte list\"\n  where \"exec_call k d s \\<equiv> undefined\"\n\ntext \\<open>\n  Procedure Call system call calls a procedure with a specified key. But if the call data is\n  malformed, the procedure does not exist, the specified capability index is out of range,\n  the capability found by the index does not allow calling this procedure, then the kernel performs\n  Revert and returns a specified error code.\n\\<close>\n\ndefinition call :: \"capability_index \\<Rightarrow> byte list \\<Rightarrow> storage \\<Rightarrow> result \\<times> byte list\" where\n  \"call i d s \\<equiv>\n     let \\<sigma> = the \\<lceil>s\\<rceil>;\n         p = curr_proc' \\<sigma> in\n     case \\<lceil>d\\<rceil> of\n       None                                      \\<Rightarrow>   (Revert, [])\n                                  \\<comment> \\<open>Malformed call data, currently the error code is not defined\\<close>\n     | Some (k, a)                               \\<Rightarrow>\n       if \\<not> has_key k \\<sigma>                          then (Revert, [SYSCALL_FAIL, CALL_NOPROC])\n       else if length \\<lfloor>call_caps p\\<rfloor> \\<le> \\<lfloor>i\\<rfloor>        then (Revert, [SYSCALL_BADCAP])\n                                                                               \\<comment> \\<open>No such cap\\<close>\n       else if k \\<notin> \\<lceil>\\<lfloor>call_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rceil>          then (Revert, [SYSCALL_BADCAP])\n       else\n         (case exec_call k a s of\n           (None,             _)                 \\<Rightarrow>   (Revert, [SYSCALL_NOGAS])\n         | (Some (Success s), r)                 \\<Rightarrow>   (Success s, r)\n         | (Some Revert,      r)                 \\<Rightarrow>   (Revert, SYSCALL_REVERT # r))\"\n\ndefinition \"sim_proc_call d\\<^sub>1 d\\<^sub>2 \\<equiv> d\\<^sub>1 = d\\<^sub>2\" for d\\<^sub>1 d\\<^sub>2 :: procedure_call_data\n\nadhoc_overloading sim sim_proc_call\n\nlemma call_inj:\n  \"\\<lbrakk>call i\\<^sub>1 d\\<^sub>1 s = (Success s', r); call i\\<^sub>2 d\\<^sub>2 s = (Success s', r);\n    \\<And> k\\<^sub>1 a\\<^sub>1 k\\<^sub>2 a\\<^sub>2. \\<lbrakk>exec_call k\\<^sub>1 a\\<^sub>1 s = (Some (Success s'), r);\n                   exec_call k\\<^sub>2 a\\<^sub>2 s = (Some (Success s'), r)\\<rbrakk>\n    \\<Longrightarrow> a\\<^sub>1 = a\\<^sub>2 \\<and> k\\<^sub>1 = k\\<^sub>2\\<rbrakk>\n   \\<Longrightarrow> (the \\<lceil>d\\<^sub>1\\<rceil> :: procedure_call_data) ~ the \\<lceil>d\\<^sub>2\\<rceil>\"\nunfolding sim_proc_call_def\nproof-\n  assume eq1:\"call i\\<^sub>1 d\\<^sub>1 s = (Success s', r)\"\n     and eq2:\"call i\\<^sub>2 d\\<^sub>2 s = (Success s', r)\"\n\n  let ?d\\<^sub>1' = \"the \\<lceil>d\\<^sub>1\\<rceil> :: procedure_call_data\"\n  and ?d\\<^sub>2' = \"the \\<lceil>d\\<^sub>2\\<rceil> :: procedure_call_data\"\n\n  let ?\\<sigma> = \"the \\<lceil>s\\<rceil>\"\n  let ?p = \"curr_proc' ?\\<sigma>\"\n\n  note [simp] = Let_def call_def\n\n  from eq1 have 1:\"(\\<lceil>d\\<^sub>1\\<rceil> :: procedure_call_data option) \\<noteq> None\"\n                  \"has_key (fst ?d\\<^sub>1') ?\\<sigma>\"\n                  \"\\<lfloor>i\\<^sub>1\\<rfloor> < length \\<lfloor>call_caps ?p\\<rfloor>\"\n                  \"fst ?d\\<^sub>1' \\<in> \\<lceil>\\<lfloor>call_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>1\\<rfloor>\\<rceil>\"\n    by (simp_all split:if_splits prod.splits option.splits)\n\n  from eq2 have 2:\"(\\<lceil>d\\<^sub>2\\<rceil> :: procedure_call_data option) \\<noteq> None\"\n                  \"has_key (fst ?d\\<^sub>2') ?\\<sigma>\"\n                  \"\\<lfloor>i\\<^sub>2\\<rfloor> < length \\<lfloor>call_caps ?p\\<rfloor>\"\n                  \"fst ?d\\<^sub>2' \\<in> \\<lceil>\\<lfloor>call_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>2\\<rfloor>\\<rceil>\"\n    by (simp_all split:if_splits prod.splits option.splits)\n\n  assume \"\\<And> k\\<^sub>1 a\\<^sub>1 k\\<^sub>2 a\\<^sub>2.\n          \\<lbrakk>exec_call k\\<^sub>1 a\\<^sub>1 s = (Some (Success s'), r); exec_call k\\<^sub>2 a\\<^sub>2 s = (Some (Success s'), r)\\<rbrakk>\n          \\<Longrightarrow> a\\<^sub>1 = a\\<^sub>2 \\<and> k\\<^sub>1 = k\\<^sub>2\"\n  with eq1 eq2 1 2 show \"?d\\<^sub>1' = ?d\\<^sub>2'\"\n    by (simp split:prod.splits if_splits option.splits result.splits)\nqed\n\nsubsection \\<open>External system call\\<close>\n\ntext \\<open>\n  Undefined function @{text exec_ext} models the execution of a called external contract. The\n  contract either returns Success and some new storage state, reverts due to an error, or runs\n  out of gas.\n\\<close>\n\ndefinition exec_ext ::\n  \"[ethereum_address, word32, byte list, storage] \\<Rightarrow> result option \\<times> byte list\"\n  where \"exec_ext a v d s \\<equiv> undefined\"\n\ntext \\<open>\n  External Call system call calls a contract with a specified Ethereum address. But if the call\n  data is malformed, the contract does not exist, the specified capability index is out of range,\n  the capability found by the index does not allow calling this procedure, then the kernel performs\n  Revert and returns a specified error code.\n\\<close>\n\ndefinition external :: \"capability_index \\<Rightarrow> byte list \\<Rightarrow> storage \\<Rightarrow> result \\<times> byte list\" where\n  \"external i d s \\<equiv>\n     let \\<sigma> = the \\<lceil>s\\<rceil>;\n         p = curr_proc' \\<sigma> in\n     case \\<lceil>d\\<rceil> of\n       None                                      \\<Rightarrow>   (Revert, [])\n                                  \\<comment> \\<open>Malformed call data, currently the error code is not defined\\<close>\n     | Some d                                    \\<Rightarrow>\n       let a = addr d; g = amount d in\n       if length \\<lfloor>ext_caps p\\<rfloor> \\<le> \\<lfloor>i\\<rfloor>              then (Revert, [SYSCALL_BADCAP])\n                                                                               \\<comment> \\<open>No such cap\\<close>\n       else if (a, g) \\<notin> \\<lceil>\\<lfloor>ext_caps p\\<rfloor> ! \\<lfloor>i\\<rfloor>\\<rceil>      then (Revert, [SYSCALL_BADCAP])\n       else\n         (case exec_ext a g (data d) s of\n           (None,             _)                 \\<Rightarrow>   (Revert, [SYSCALL_NOGAS])\n         | (Some (Success s), r)                 \\<Rightarrow>   (Success s, r)\n         | (Some Revert,      r)                 \\<Rightarrow>   (Revert, SYSCALL_REVERT # r))\"\n\ndefinition \"sim_ext_call d\\<^sub>1 d\\<^sub>2 \\<equiv> addr d\\<^sub>1 = addr d\\<^sub>2 \\<and> data d\\<^sub>1 = data d\\<^sub>2\"\n\nadhoc_overloading sim sim_ext_call\n\nlemma ext_call_inj:\n  \"\\<lbrakk>external i\\<^sub>1 d\\<^sub>1 s = (Success s', r); external i\\<^sub>2 d\\<^sub>2 s = (Success s', r);\n    \\<And> a\\<^sub>1 g\\<^sub>1 d\\<^sub>1 a\\<^sub>2 g\\<^sub>2 d\\<^sub>2. \\<lbrakk>exec_ext a\\<^sub>1 g\\<^sub>1 d\\<^sub>1 s = (Some (Success s'), r);\n                         exec_ext a\\<^sub>2 g\\<^sub>2 d\\<^sub>2 s = (Some (Success s'), r)\\<rbrakk>\n    \\<Longrightarrow> a\\<^sub>1 = a\\<^sub>2 \\<and> d\\<^sub>1 = d\\<^sub>2\\<rbrakk>\n   \\<Longrightarrow> (the \\<lceil>d\\<^sub>1\\<rceil> :: external_call_data) ~ the \\<lceil>d\\<^sub>2\\<rceil>\"\nunfolding sim_ext_call_def\nproof-\n  assume eq1:\"external i\\<^sub>1 d\\<^sub>1 s = (Success s', r)\"\n     and eq2:\"external i\\<^sub>2 d\\<^sub>2 s = (Success s', r)\"\n\n  let ?d\\<^sub>1' = \"the \\<lceil>d\\<^sub>1\\<rceil> :: external_call_data\"\n  and ?d\\<^sub>2' = \"the \\<lceil>d\\<^sub>2\\<rceil> :: external_call_data\"\n\n  let ?\\<sigma> = \"the \\<lceil>s\\<rceil>\"\n  let ?p = \"curr_proc' ?\\<sigma>\"\n\n  note [simp] = Let_def external_def\n\n  from eq1 have 1:\"(\\<lceil>d\\<^sub>1\\<rceil> :: external_call_data option) \\<noteq> None\"\n                  \"\\<lfloor>i\\<^sub>1\\<rfloor> < length \\<lfloor>ext_caps ?p\\<rfloor>\"\n                  \"(addr ?d\\<^sub>1', amount ?d\\<^sub>1') \\<in> \\<lceil>\\<lfloor>ext_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>1\\<rfloor>\\<rceil>\"\n    by (simp_all split:if_splits option.splits)\n\n  from eq2 have 2:\"(\\<lceil>d\\<^sub>2\\<rceil> :: external_call_data option) \\<noteq> None\"\n                  \"\\<lfloor>i\\<^sub>2\\<rfloor> < length \\<lfloor>ext_caps ?p\\<rfloor>\"\n                  \"(addr ?d\\<^sub>2', amount ?d\\<^sub>2') \\<in> \\<lceil>\\<lfloor>ext_caps ?p\\<rfloor> ! \\<lfloor>i\\<^sub>2\\<rfloor>\\<rceil>\"\n    by (simp_all split:if_splits option.splits)\n\n  assume \"\\<And> a\\<^sub>1 g\\<^sub>1 d\\<^sub>1 a\\<^sub>2 g\\<^sub>2 d\\<^sub>2. \\<lbrakk>exec_ext a\\<^sub>1 g\\<^sub>1 d\\<^sub>1 s = (Some (Success s'), r);\n                               exec_ext a\\<^sub>2 g\\<^sub>2 d\\<^sub>2 s = (Some (Success s'), r)\\<rbrakk>\n            \\<Longrightarrow> a\\<^sub>1 = a\\<^sub>2 \\<and> d\\<^sub>1 = d\\<^sub>2\"\n  with eq1 eq2 1 2 show \"addr ?d\\<^sub>1' = addr ?d\\<^sub>2' \\<and> data ?d\\<^sub>1' = data ?d\\<^sub>2'\"\n    by (simp split:prod.splits if_splits option.splits result.splits)\nqed\n\ndefinition \"cap_type_opt_rep c \\<equiv> case c of Some c \\<Rightarrow> \\<lfloor>c\\<rfloor> | None \\<Rightarrow> 0x00\"\n  for c :: \"capability option\"\n\nadhoc_overloading rep cap_type_opt_rep\n\nlemma cap_type_opt_rep_inj[intro]: \"inj cap_type_opt_rep\" unfolding cap_type_opt_rep_def inj_def\n  by (auto split:option.split)\n\nlemmas cap_type_opt_invertible[intro] = invertible.intro[OF cap_type_opt_rep_inj]\n\ninterpretation cap_type_opt_inv: invertible cap_type_opt_rep ..\n\nadhoc_overloading abs cap_type_opt_inv.inv\n\ntext \\<open>\n  @{text execute} function models a single state-changing transition as executing of one of the\n  system calls.\n\\<close>\n\ndefinition execute :: \"byte list \\<Rightarrow> storage \\<Rightarrow> (result \\<times> byte list) \\<times> log\" where\n  \"execute c s \\<equiv> case takefill 0x00 2 c of ct # ci # c \\<Rightarrow>\n    let nolog = \\<lambda> r. (r, []) in\n    (case \\<lceil>ct\\<rceil> of\n      None           \\<Rightarrow> nolog (Revert, [SYSCALL_NOEXIST])\n    | Some None      \\<Rightarrow> nolog (Success s, [])\n    | Some (Some ct) \\<Rightarrow> (case \\<lceil>ci\\<rceil> of\n       None          \\<Rightarrow> nolog (Revert, [SYSCALL_BADCAP]) \\<comment> \\<open>Capability index out of bounds\\<close>\n     | Some ci       \\<Rightarrow> (case ct of\n         Call        \\<Rightarrow> nolog (call ci c s)\n       | Reg         \\<Rightarrow> nolog (register ci c s)\n       | Del         \\<Rightarrow> nolog (delete ci c s)\n       | Entry       \\<Rightarrow> nolog (set_entry ci c s)\n       | Write       \\<Rightarrow> nolog (write_addr ci c s)\n       | Log         \\<Rightarrow> log ci c s\n       | Send        \\<Rightarrow> nolog (external ci c s))))\"\n\nsection \\<open>Initialization\\<close>\n\ntext \\<open>\n  State of the storage before the initialization: no current procedure, no entry procedure, and\n  the procedure list is empty.\n\\<close>\n\ndefinition \"empty_kernel \\<equiv>\n          \\<lparr>  curr_proc  = 0,\n             entry_proc = 0,\n             proc_list = \\<lceil>Alist []\\<rceil> \\<rparr>\"\n\ndefinition \"filled_caps t cs =\n   list_all\n     (\\<lambda> (_, l) \\<Rightarrow>\n      (case (t, l) of\n        (Entry, []) \\<Rightarrow> True\n      | (_,     []) \\<Rightarrow> False\n      | (_,      _) \\<Rightarrow> True))\n     cs\"\n\ntext \\<open>\n  Initialisation process is similar to Register Procedure system call: it shares the same format of\n  the call data. The difference is following: a registered procedure also becomes and entry\n  procedure, its capabilities are not checked for subsets, and since there is no registered\n  procedures in the kernel before initialisation, some related checks are also skipped.\n\\<close>\n\ndefinition init :: \"capability_index \\<Rightarrow> byte list \\<Rightarrow> storage \\<Rightarrow> result \\<times> byte list\" where\n  \"init i d s \\<equiv>\n     let \\<sigma> = empty_kernel in\n     if \\<not> LENGTH(word32) div LENGTH(byte) dvd length d then\n                                                      (Revert, [])\n     else case \\<lceil>cat d\\<rceil> of\n       None                                      \\<Rightarrow>   (Revert, [])\n                                  \\<comment> \\<open>Malformed call data, currently the error code is not defined\\<close>\n     | Some d                                    \\<Rightarrow>\n       if \\<not> valid_code (eth_addr d)              then (Revert, [SYSCALL_FAIL]) \\<comment> \\<open>Code invalid\\<close>\n       else (case (caps Call d,\n                  caps Reg d,\n                  caps Del d,\n                  caps Entry d,\n                  caps Write d,\n                  caps Log d,\n                  caps Send d) of\n       (Some calls, Some regs, Some dels, Some ents, Some wrts, Some logs, Some exts) \\<Rightarrow>\n         if filled_caps Call  calls \\<and>\n            filled_caps Reg   regs  \\<and>\n            filled_caps Del   dels  \\<and>\n            filled_caps Entry ents  \\<and>\n            filled_caps Write wrts  \\<and>\n            filled_caps Log   logs  \\<and>\n            filled_caps Send  exts               then\n           let p' =\n              \\<lparr> procedure.eth_addr   = eth_addr d,\n                call_caps  = cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) calls),\n                reg_caps   = cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) regs),\n                del_caps   = cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) dels),\n                entry_cap  = ents \\<noteq> [],\n                write_caps = cap_list (map (\\<lambda> (_, [a, s]) \\<Rightarrow> the \\<lceil>(a, s)\\<rceil>) wrts),\n                log_caps   = cap_list (map (the \\<circ> abs \\<circ> snd) logs),\n                ext_caps   = cap_list (map (the \\<circ> abs \\<circ> hd \\<circ> snd) exts) \\<rparr>;\n               procs = \\<lceil>DAList.update (proc_key d) p' \\<lfloor>proc_list \\<sigma>\\<rfloor>\\<rceil>;\n               \\<sigma>' = \\<sigma> \\<lparr> proc_list := procs, entry_proc := proc_key d \\<rparr> in\n                                                      (Success (\\<lfloor>\\<sigma>'\\<rfloor> s), [])\n         else                                         (Revert, [SYSCALL_BADCAP])\n                                                      \\<comment> \\<open>Some parent caps were specified\\<close>\n      | _                                        \\<Rightarrow>   (Revert, [SYSCALL_FAIL, REG_TOOMANYCAPS]))\"\n\ndefinition \"sim_init_call d\\<^sub>1 d\\<^sub>2 \\<equiv>\n  proc_key d\\<^sub>1 = proc_key d\\<^sub>2 \\<and>\n  eth_addr d\\<^sub>1 = eth_addr d\\<^sub>2 \\<and>\n  (let caps' = \\<lambda> t d. map snd (the (caps t d)) in\n  list_all2 (same_cap Call) (caps' Call d\\<^sub>1) (caps' Call d\\<^sub>2) \\<and>\n  list_all2 (same_cap Reg)  (caps' Reg d\\<^sub>1) (caps' Reg d\\<^sub>2) \\<and>\n  list_all2 (same_cap Del)  (caps' Del d\\<^sub>1) (caps' Del d\\<^sub>2) \\<and>\n  (the (caps Entry d\\<^sub>1) = []) = (the (caps Entry d\\<^sub>2) = []) \\<and>\n  list_all2 (same_cap Write) (caps' Write d\\<^sub>1) (caps' Write d\\<^sub>2) \\<and>\n  list_all2 (same_cap Log) (caps' Log d\\<^sub>1) (caps' Log d\\<^sub>2) \\<and>\n  list_all2 (same_cap Send) (caps' Send d\\<^sub>1) (caps' Send d\\<^sub>2))\"\n\nno_adhoc_overloading sim sim_register_call\n\nadhoc_overloading sim sim_init_call\n\nlemma init_inj:\n  \"\\<lbrakk>init i\\<^sub>1 d\\<^sub>1 s = (Success s', r\\<^sub>1); init i\\<^sub>2 d\\<^sub>2 s = (Success s', r\\<^sub>2)\\<rbrakk>\n   \\<Longrightarrow> (the \\<lceil>cat d\\<^sub>1\\<rceil> :: register_call_data) ~ the \\<lceil>cat d\\<^sub>2\\<rceil>\"\n  unfolding sim_init_call_def Let_def\nproof (intro conjI)\n  assume eq1:\"init i\\<^sub>1 d\\<^sub>1 s = (Success s', r\\<^sub>1)\"\n     and eq2:\"init i\\<^sub>2 d\\<^sub>2 s = (Success s', r\\<^sub>2)\"\n\n  let ?d\\<^sub>1' = \"the \\<lceil>cat d\\<^sub>1\\<rceil> :: register_call_data\"\n  and ?d\\<^sub>2' = \"the \\<lceil>cat d\\<^sub>2\\<rceil> :: register_call_data\"\n\n  from eq1 eq2 have eq:\"fst (init i\\<^sub>1 d\\<^sub>1 s) = fst (init i\\<^sub>2 d\\<^sub>2 s)\" by simp\n\n  note [simp] = Let_def init_def\n\n  from eq1 have 1:\"LENGTH(word32) div LENGTH(byte) dvd length d\\<^sub>1\"\n                  \"(\\<lceil>cat d\\<^sub>1\\<rceil> :: register_call_data option) \\<noteq> None\"\n                  \"max_nprocs \\<noteq> nprocs empty_kernel\"\n                  \"\\<not> has_key (proc_key ?d\\<^sub>1') empty_kernel\"\n                  \"valid_code (eth_addr ?d\\<^sub>1')\"\n                  \"caps Call ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Reg ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Del ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Entry ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Write ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Log ?d\\<^sub>1' \\<noteq> None\"\n                  \"caps Send ?d\\<^sub>1' \\<noteq> None\"\n                  \"filled_caps Call   (the (caps Call ?d\\<^sub>1')) \\<and>\n                   filled_caps Reg    (the (caps Reg ?d\\<^sub>1')) \\<and>\n                   filled_caps Del    (the (caps Del ?d\\<^sub>1')) \\<and>\n                   filled_caps Entry  (the (caps Entry ?d\\<^sub>1')) \\<and>\n                   filled_caps Write  (the (caps Write ?d\\<^sub>1')) \\<and>\n                   filled_caps Log    (the (caps Log ?d\\<^sub>1')) \\<and>\n                   filled_caps Send   (the (caps Send ?d\\<^sub>1'))\"\n    unfolding empty_kernel_def\n    by (simp_all split:if_splits option.splits add:has_key_def proc_list_inverse DAList.lookup_def)\n\n\n  from eq2 have 2:\"LENGTH(word32) div LENGTH(byte) dvd length d\\<^sub>2\"\n                  \"(\\<lceil>cat d\\<^sub>2\\<rceil> :: register_call_data option) \\<noteq> None\"\n                  \"max_nprocs \\<noteq> nprocs empty_kernel\"\n                  \"\\<not> has_key (proc_key ?d\\<^sub>2') empty_kernel\"\n                  \"valid_code (eth_addr ?d\\<^sub>2')\"\n                  \"caps Call ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Reg ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Del ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Entry ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Write ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Log ?d\\<^sub>2' \\<noteq> None\"\n                  \"caps Send ?d\\<^sub>2' \\<noteq> None\"\n                  \"filled_caps Call   (the (caps Call ?d\\<^sub>2')) \\<and>\n                   filled_caps Reg    (the (caps Reg ?d\\<^sub>2')) \\<and>\n                   filled_caps Del    (the (caps Del ?d\\<^sub>2')) \\<and>\n                   filled_caps Entry  (the (caps Entry ?d\\<^sub>2')) \\<and>\n                   filled_caps Write  (the (caps Write ?d\\<^sub>2')) \\<and>\n                   filled_caps Log    (the (caps Log ?d\\<^sub>2')) \\<and>\n                   filled_caps Send   (the (caps Send ?d\\<^sub>2'))\"\n    unfolding empty_kernel_def\n    by (simp_all split:if_splits option.splits add:has_key_def proc_list_inverse DAList.lookup_def)\n\n  from 1\n  have size1[simplified, simp]:\n    \"\\<And> y v. length \\<lfloor>DAList.update (proc_key y) v \\<lfloor>proc_list empty_kernel\\<rfloor>\\<rfloor> \\<le> max_nprocs\"\n    unfolding empty_kernel_def\n    by (auto simp add: DAList.update.rep_eq proc_list_inverse)\n\n  from eq 1 2 have \"proc_key ?d\\<^sub>1' = proc_key ?d\\<^sub>2' \\<and> eth_addr ?d\\<^sub>1' = eth_addr ?d\\<^sub>2'\"\n    apply (simp split:if_splits option.splits)\n    apply (drule kernel_rep_inj)\n    apply (rewrite in \\<open>\\<hole> = (_ :: kernel)\\<close> in asm kernel.surjective)\n    apply (rewrite in \\<open>(_ :: kernel) = \\<hole>\\<close> in asm kernel.surjective, simp)\n    by (auto iff:proc_list_inject simp add:has_key_def)\n  thus key:\"proc_key ?d\\<^sub>1' = proc_key ?d\\<^sub>2'\" and \"eth_addr ?d\\<^sub>1' = eth_addr ?d\\<^sub>2'\" by simp_all\n\n  {\n    fix t\n    let ?c\\<^sub>1 = \"the (caps t ?d\\<^sub>1')\"\n    let ?c\\<^sub>2 = \"the (caps t ?d\\<^sub>2')\"\n    have length1[simplified]:\"caps t ?d\\<^sub>1' \\<noteq> None \\<Longrightarrow> length ?c\\<^sub>1 < 2 ^ LENGTH(8 word) - 1\"\n      unfolding caps_def fill_caps_def by (simp split:if_splits)\n    from 1 have length1:\"length ?c\\<^sub>1 <  2 ^ LENGTH(8 word) - 1\"\n      by simp (rule length1, induct t, simp+)\n    have length2[simplified]:\"caps t ?d\\<^sub>2' \\<noteq> None \\<Longrightarrow> length ?c\\<^sub>2 < 2 ^ LENGTH(8 word) - 1\"\n      unfolding caps_def fill_caps_def by (simp split:if_splits)\n    from 2 have length2: \"length ?c\\<^sub>2 <  2 ^ LENGTH(8 word) - 1\"\n      by simp (rule length2, induct t, simp+)\n\n    have [intro]:\"\\<And> c i l d. ((c, i), l) \\<in> set \\<lfloor>d :: capability_data\\<rfloor> \\<Longrightarrow> wf_cap c l\"\n      using cap_data_rep' by force\n    have [intro]:\n      \"\\<And> c i l d. ((c, i), l) \\<in> set \\<lfloor>d :: capability_data\\<rfloor> \\<Longrightarrow> l = overwrite_cap c l (zero_fill l)\"\n      using cap_data_rep' by force\n    assume t:\"t \\<noteq> Entry\"\n    hence\n      \"\\<lbrakk>(\\<lceil>cat d\\<^sub>1\\<rceil> :: register_call_data option) \\<noteq> None; caps t ?d\\<^sub>1' \\<noteq> None; filled_caps t ?c\\<^sub>1\\<rbrakk>\n       \\<Longrightarrow> list_all ((\\<lambda> c. wf_cap t c \\<and> c = overwrite_cap t c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) ?c\\<^sub>1\"\n      unfolding caps_def\n      by (induct t,  auto simp add:filled_caps_def list_all_def split:list.splits)\n    with 1 have\n     all1:\"list_all ((\\<lambda> c. wf_cap t c \\<and> c = overwrite_cap t c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) ?c\\<^sub>1\"\n      by (induct t, simp_all)\n\n    from t have\n      \"\\<lbrakk>(\\<lceil>cat d\\<^sub>2\\<rceil> :: register_call_data option) \\<noteq> None; caps t ?d\\<^sub>2' \\<noteq> None; filled_caps t ?c\\<^sub>2\\<rbrakk>\n       \\<Longrightarrow> list_all ((\\<lambda> c. wf_cap t c \\<and> c = overwrite_cap t c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) ?c\\<^sub>2\"\n      unfolding caps_def\n      by (induct t,  auto simp add:filled_caps_def list_all_def split:list.splits)\n    with 2 have\n     all2:\"list_all ((\\<lambda> c. wf_cap t c \\<and> c = overwrite_cap t c (zero_fill c) \\<and> c \\<noteq> []) \\<circ> snd) ?c\\<^sub>2\"\n      by (induct t, simp_all)\n\n    have \"\\<And> p. filled_caps t ?c\\<^sub>1 \\<Longrightarrow> fill_caps t ?c\\<^sub>1 p = ?c\\<^sub>1\"\n      unfolding filled_caps_def fill_caps_def list_all_def\n      by (induct t) (auto intro!:map_idI split:list.splits prod.splits)\n    with 1 have eq1:\"\\<And> p. fill_caps t ?c\\<^sub>1 p = ?c\\<^sub>1\" by (induct t, auto)\n\n    have \"\\<And> p. filled_caps t ?c\\<^sub>2 \\<Longrightarrow> fill_caps t ?c\\<^sub>2 p = ?c\\<^sub>2\"\n      unfolding filled_caps_def fill_caps_def list_all_def\n      by (induct t) (auto intro!:map_idI split:list.splits prod.splits)\n    with 2 have eq2:\"\\<And> p. fill_caps t ?c\\<^sub>2 p = ?c\\<^sub>2\" by (induct t, auto)\n\n    have \"\\<lbrakk>(\\<lceil>cat d\\<^sub>1\\<rceil> :: register_call_data option) \\<noteq> None; caps t ?d\\<^sub>1' \\<noteq> None\\<rbrakk> \\<Longrightarrow>\n          list_all (wf_cap t \\<circ> snd) (the (caps t ?d\\<^sub>1'))\"\n      unfolding list_all_def caps_def using cap_data_rep' by (auto split:if_splits)\n    with 1 have all3:\"list_all (wf_cap t \\<circ> snd) (the (caps t ?d\\<^sub>1'))\" by (induct t, simp_all)\n\n    have \"\\<lbrakk>(\\<lceil>cat d\\<^sub>2\\<rceil> :: register_call_data option) \\<noteq> None; caps t ?d\\<^sub>2' \\<noteq> None\\<rbrakk> \\<Longrightarrow>\n          list_all (wf_cap t \\<circ> snd) (the (caps t ?d\\<^sub>2'))\"\n      unfolding list_all_def caps_def using cap_data_rep' by (auto split:if_splits)\n    with 2 have all4:\"list_all (wf_cap t \\<circ> snd) (the (caps t ?d\\<^sub>2'))\" by (induct t, simp_all)\n\n    note length1 length2 all1 all2 all3 all4 eq1 eq2\n  } note ps = this\n\n  note fill = fill_caps_inj[OF ps(5) ps(6), rotated 2]\n\n  note call =  pref_cap_list_inj[where t=Call,\n                                OF ps(1)[of Call] ps(2)[of Call], simplified,\n                                OF ps(3)[of Call], simplified, OF ps(4)[of Call], simplified]\n  note del = pref_cap_list_inj[where t=Del,\n                               OF ps(1)[of Del] ps(2)[of Del], simplified,\n                               OF ps(3)[of Del], simplified, OF ps(4)[of Del], simplified]\n  note reg = pref_cap_list_inj[where t=Reg,\n                               OF ps(1)[of Reg] ps(2)[of Reg], simplified,\n                               OF ps(3)[of Reg], simplified, OF ps(4)[of Reg], simplified]\n  note wri = write_cap_list_inj[OF ps(1)[of Write] ps(2)[of Write], simplified,\n                                  OF ps(3)[of Write], simplified, OF ps(4)[of Write], simplified]\n\n  note log = log_cap_list_inj[OF ps(1)[of Log] ps(2)[of Log], simplified,\n                              OF ps(3)[of Log], simplified, OF ps(4)[of Log], simplified]\n\n  note send = ext_cap_list_inj[OF ps(1)[of Send] ps(2)[of Send], simplified,\n                               OF ps(3)[of Send], simplified, OF ps(4)[of Send], simplified]\n\n  have [dest!]: \"\\<And> k p\\<^sub>1 p\\<^sub>2 l\\<^sub>1 l\\<^sub>2. DAList.update k p\\<^sub>1 \\<lfloor>l\\<^sub>1\\<rfloor> = DAList.update k p\\<^sub>2 \\<lfloor>l\\<^sub>2\\<rfloor> \\<Longrightarrow> p\\<^sub>1 = p\\<^sub>2\"\n    by (auto iff:Alist_inject dest:update_eqD simp add: distinct_update DAList.update_def)\n\n  from eq 1 2 have\n    all:\"list_all2 (same_explicit_cap Call)\n       (map snd (the (caps Call ?d\\<^sub>1'))) (map snd (the (caps Call ?d\\<^sub>2')))\"\n    \"list_all2 (same_explicit_cap Reg)\n       (map snd (the (caps Reg ?d\\<^sub>1'))) (map snd (the (caps Reg ?d\\<^sub>2')))\"\n    \"list_all2 (same_explicit_cap Del)\n       (map snd (the (caps Del ?d\\<^sub>1'))) (map snd (the (caps Del ?d\\<^sub>2')))\"\n    \"list_all2 (same_explicit_cap Write)\n       (map snd (the (caps Write ?d\\<^sub>1'))) (map snd (the (caps Write ?d\\<^sub>2')))\"\n    \"list_all2 (same_explicit_cap Log)\n       (map snd (the (caps Log ?d\\<^sub>1'))) (map snd (the (caps Log ?d\\<^sub>2')))\"\n    \"list_all2 (same_explicit_cap Send)\n       (map snd (the (caps Send ?d\\<^sub>1'))) (map snd (the (caps Send ?d\\<^sub>2')))\"\n    using key\n    by -\n      (rule fill, subst ps(7), simp, subst ps(8), simp,\n        rule call reg del wri log send,\n        simp split:if_splits option.splits,\n        drule kernel_rep_inj,\n        rewrite in \\<open>\\<hole> = (_ :: kernel)\\<close> in asm kernel.surjective,\n        rewrite in \\<open>(_ :: kernel) = \\<hole>\\<close> in asm kernel.surjective,\n        (auto iff:proc_list_inject)[1])+\n\n  {\n    fix t and l\\<^sub>1 l\\<^sub>2 :: \"(capability_index \\<times> word32 list) list\"\n    assume \"filled_caps t l\\<^sub>1\" \"filled_caps t l\\<^sub>2\" \"t \\<noteq> Entry\"\n           \"list_all2 (same_explicit_cap t) (map snd l\\<^sub>1) (map snd l\\<^sub>2)\"\n    hence \"list_all2 (same_cap t) (map snd l\\<^sub>1) (map snd l\\<^sub>2)\"\n      unfolding filled_caps_def list_all_def same_explicit_cap_def list_all2_conv_all_nth\n      by (induct t)\n         (auto split:prod.splits capability.splits list.splits, (metis nth_mem prod.collapse)+)\n   } note dest = this\n\n  from all 1 2 show\n    \"list_all2 (same_cap Call)\n       (map snd (the (caps Call ?d\\<^sub>1'))) (map snd (the (caps Call ?d\\<^sub>2')))\"\n    \"list_all2 (same_cap Reg)\n       (map snd (the (caps Reg ?d\\<^sub>1'))) (map snd (the (caps Reg ?d\\<^sub>2')))\"\n    \"list_all2 (same_cap Del)\n       (map snd (the (caps Del ?d\\<^sub>1'))) (map snd (the (caps Del ?d\\<^sub>2')))\"\n    \"list_all2 (same_cap Write)\n       (map snd (the (caps Write ?d\\<^sub>1'))) (map snd (the (caps Write ?d\\<^sub>2')))\"\n    \"list_all2 (same_cap Log)\n       (map snd (the (caps Log ?d\\<^sub>1'))) (map snd (the (caps Log ?d\\<^sub>2')))\"\n    \"list_all2 (same_cap Send)\n       (map snd (the (caps Send ?d\\<^sub>1'))) (map snd (the (caps Send ?d\\<^sub>2')))\"\n    by -\n      (rule dest[where ?t3=Call]\n        dest[where ?t3=Reg]\n        dest[where ?t3=Del]\n        dest[where ?t3=Write]\n        dest[where ?t3=Log]\n        dest[where ?t3=Send], (simp+)[4])+\n\n  from eq 1 2 show \"(the (caps Entry ?d\\<^sub>1') = []) = (the (caps Entry ?d\\<^sub>2') = [])\"\n    using key\n    apply (simp split:if_splits option.splits)\n    apply (drule kernel_rep_inj)\n    apply (rewrite in \\<open>\\<hole> = (_ :: kernel)\\<close> in asm kernel.surjective)\n    apply (rewrite in \\<open>(_ :: kernel) = \\<hole>\\<close> in asm kernel.surjective)\n    by (auto iff:proc_list_inject)\nqed\n\nend\n", "meta": {"author": "Daohub-io", "repo": "cap9-spec", "sha": "de42d102f2054547c1aa0c8d0dc6d9cc2c763181", "save_path": "github-repos/isabelle/Daohub-io-cap9-spec", "path": "github-repos/isabelle/Daohub-io-cap9-spec/cap9-spec-de42d102f2054547c1aa0c8d0dc6d9cc2c763181/Cap9.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.3224312433669405}}
{"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\<open>\\<open>Set\\<close>\\<close>\ntheory CZH_ECAT_Set\n  imports \n    CZH_Foundations.CZH_SMC_Set\n    CZH_ECAT_Par\n    CZH_ECAT_Subcategory\n    CZH_ECAT_PCategory\nbegin\n\n\n\nsubsection\\<open>Background\\<close>\n\n\ntext\\<open>\nThe methodology chosen for the exposition of \\<open>Set\\<close> as a category is \nanalogous to the one used in \\<^cite>\\<open>\"milehins_category_2021\"\\<close> \nfor the exposition of \\<open>Set\\<close> as a semicategory. \n\\<close>\n\nnamed_theorems cat_Set_cs_simps\nnamed_theorems cat_Set_cs_intros\n\nlemmas (in arr_Set) [cat_Set_cs_simps] = \n  dg_Rel_shared_cs_simps\n\nlemmas (in arr_Set) [cat_cs_intros, cat_Set_cs_intros] = \n  arr_Set_axioms'\n\nlemmas [cat_Set_cs_simps] =\n  dg_Rel_shared_cs_simps\n  arr_Set.arr_Set_ArrVal_vdomain\n  arr_Set_comp_Set_id_Set_left\n  arr_Set_comp_Set_id_Set_right\n\nlemmas [cat_Set_cs_intros] = \n  dg_Rel_shared_cs_intros\n  arr_Set_comp_Set\n\n(*\nCertain lemmas are applicable to any of the categories among\nRel, Par, Set. If these lemmas are included in general-purpose\ncollections like cat_cs_simps/cat_cs_intros, then backtracking\ncan become slow. The following collections were created to resolve\nsuch issues.\n*)\nnamed_theorems cat_rel_par_Set_cs_intros\nnamed_theorems cat_rel_par_Set_cs_simps\nnamed_theorems cat_rel_Par_set_cs_intros\nnamed_theorems cat_rel_Par_set_cs_simps\nnamed_theorems cat_Rel_par_set_cs_intros\nnamed_theorems cat_Rel_par_set_cs_simps\n\n\n\nsubsection\\<open>\\<open>Set\\<close> as a category\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition cat_Set :: \"V \\<Rightarrow> V\"\n  where \"cat_Set \\<alpha> =\n    [\n      Vset \\<alpha>,\n      set {T. arr_Set \\<alpha> T},\n      (\\<lambda>T\\<in>\\<^sub>\\<circ>set {T. arr_Set \\<alpha> T}. T\\<lparr>ArrDom\\<rparr>),\n      (\\<lambda>T\\<in>\\<^sub>\\<circ>set {T. arr_Set \\<alpha> T}. T\\<lparr>ArrCod\\<rparr>),\n      (\\<lambda>ST\\<in>\\<^sub>\\<circ>composable_arrs (dg_Set \\<alpha>). ST\\<lparr>0\\<rparr> \\<circ>\\<^sub>R\\<^sub>e\\<^sub>l ST\\<lparr>1\\<^sub>\\<nat>\\<rparr>),\n      VLambda (Vset \\<alpha>) id_Set \n    ]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma cat_Set_components:\n  shows \"cat_Set \\<alpha>\\<lparr>Obj\\<rparr> = Vset \\<alpha>\"\n    and \"cat_Set \\<alpha>\\<lparr>Arr\\<rparr> = set {T. arr_Set \\<alpha> T}\"\n    and \"cat_Set \\<alpha>\\<lparr>Dom\\<rparr> = (\\<lambda>T\\<in>\\<^sub>\\<circ>set {T. arr_Set \\<alpha> T}. T\\<lparr>ArrDom\\<rparr>)\"\n    and \"cat_Set \\<alpha>\\<lparr>Cod\\<rparr> = (\\<lambda>T\\<in>\\<^sub>\\<circ>set {T. arr_Set \\<alpha> T}. T\\<lparr>ArrCod\\<rparr>)\"\n    and \"cat_Set \\<alpha>\\<lparr>Comp\\<rparr> =\n      (\\<lambda>ST\\<in>\\<^sub>\\<circ>composable_arrs (dg_Set \\<alpha>). ST\\<lparr>0\\<rparr> \\<circ>\\<^sub>P\\<^sub>a\\<^sub>r ST\\<lparr>1\\<^sub>\\<nat>\\<rparr>)\"\n    and \"cat_Set \\<alpha>\\<lparr>CId\\<rparr> = VLambda (Vset \\<alpha>) id_Set\"\n  unfolding cat_Set_def dg_field_simps by (simp_all add: nat_omega_simps)\n\n\ntext\\<open>Slicing.\\<close>\n\nlemma cat_smc_cat_Set: \"cat_smc (cat_Set \\<alpha>) = smc_Set \\<alpha>\"\nproof(rule vsv_eqI)\n  have dom_lhs: \"\\<D>\\<^sub>\\<circ> (cat_smc (cat_Set \\<alpha>)) = 5\\<^sub>\\<nat>\" \n    unfolding cat_smc_def by (simp add: nat_omega_simps)\n  have dom_rhs: \"\\<D>\\<^sub>\\<circ> (smc_Set \\<alpha>) = 5\\<^sub>\\<nat>\"\n    unfolding smc_Set_def by (simp add: nat_omega_simps)\n  show \"\\<D>\\<^sub>\\<circ> (cat_smc (cat_Set \\<alpha>)) = \\<D>\\<^sub>\\<circ> (smc_Set \\<alpha>)\"\n    unfolding dom_lhs dom_rhs by simp\n  show \"a \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (cat_smc (cat_Set \\<alpha>)) \\<Longrightarrow> cat_smc (cat_Set \\<alpha>)\\<lparr>a\\<rparr> = smc_Set \\<alpha>\\<lparr>a\\<rparr>\"\n    for a\n    by \n      (\n        unfold dom_lhs, \n        elim_in_numeral, \n        unfold cat_smc_def dg_field_simps cat_Set_def smc_Set_def\n      )\n      (auto simp: nat_omega_simps)\nqed (auto simp: cat_smc_def smc_Set_def)\n\nlemmas_with [folded cat_smc_cat_Set, unfolded slicing_simps]:\n  cat_Set_Obj_iff = smc_Set_Obj_iff\n  and cat_Set_Arr_iff[cat_Set_cs_simps] = smc_Set_Arr_iff\n  and cat_Set_Dom_vsv[intro] = smc_Set_Dom_vsv\n  and cat_Set_Dom_vdomain[simp] = smc_Set_Dom_vdomain\n  and cat_Set_Dom_vrange = smc_Set_Dom_vrange\n  and cat_Set_Dom_app = smc_Set_Dom_app\n  and cat_Set_Cod_vsv[intro] = smc_Set_Cod_vsv\n  and cat_Set_Cod_vdomain[simp] = smc_Set_Cod_vdomain\n  and cat_Set_Cod_vrange = smc_Set_Cod_vrange\n  and cat_Set_Cod_app[cat_Set_cs_simps] = smc_Set_Cod_app\n  and cat_Set_is_arrI = smc_Set_is_arrI\n  and cat_Set_is_arrD = smc_Set_is_arrD\n  and cat_Set_is_arrE = smc_Set_is_arrE\n  and cat_Set_ArrVal_vdomain[cat_cs_simps] = smc_Set_ArrVal_vdomain\n  and cat_Set_ArrVal_app_vrange[cat_Set_cs_intros] = smc_Set_ArrVal_app_vrange\n\nlemmas [cat_cs_simps] = cat_Set_is_arrD(2,3)\n\nlemmas [cat_Set_cs_intros] = \n  cat_Set_is_arrI\n\nlemmas_with [folded cat_smc_cat_Set, unfolded slicing_simps]: \n  cat_Set_composable_arrs_dg_Set = smc_Set_composable_arrs_dg_Set\n  and cat_Set_Comp = smc_Set_Comp\n  and cat_Set_Comp_app[cat_Set_cs_simps] = smc_Set_Comp_app\n  and cat_Set_Comp_vdomain[cat_Set_cs_simps] = smc_Set_Comp_vdomain\n  and cat_Set_is_monic_arrI = smc_Set_is_monic_arrI\n  and cat_Set_is_monic_arrD = smc_Set_is_monic_arrD\n  and cat_Set_is_monic_arr = smc_Set_is_monic_arr\n  and cat_Set_is_epic_arrI = smc_Set_is_epic_arrI\n  and cat_Set_is_epic_arrD = smc_Set_is_epic_arrD\n  and cat_Set_is_epic_arr = smc_Set_is_epic_arr\n\nlemmas_with (in \\<Z>) [folded cat_smc_cat_Set, unfolded slicing_simps]:\n  cat_Set_Hom_vifunion_in_Vset = smc_Set_Hom_vifunion_in_Vset\n  and cat_Set_incl_Set_is_arr = smc_Set_incl_Set_is_arr\n  and cat_Set_Comp_ArrVal = smc_Set_Comp_ArrVal\n  and cat_Set_Comp_vrange = smc_Set_Comp_vrange\n  and cat_Set_obj_terminal = smc_Set_obj_terminal\n  and cat_Set_obj_initial = smc_Set_obj_initial\n  and cat_Set_obj_null = smc_Set_obj_null\n  and cat_Set_is_zero_arr = smc_Set_is_zero_arr\n\nlemmas [cat_cs_simps] = \n  \\<Z>.cat_Set_Comp_ArrVal\n\nlemma (in \\<Z>) cat_Set_incl_Set_is_arr'[cat_cs_intros, cat_Set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"B \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"A \\<subseteq>\\<^sub>\\<circ> B\"\n    and \"A' = A\"\n    and \"B' = B\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"incl_Set A B : A' \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> B'\"\n  using assms(1-3) unfolding assms(4-6) by (rule cat_Set_incl_Set_is_arr)\n\nlemmas [cat_Set_cs_intros] = \\<Z>.cat_Set_incl_Set_is_arr'\n\n\nsubsubsection\\<open>Identity\\<close>\n\nlemma cat_Set_CId_app[cat_Set_cs_simps]:\n  assumes \"A \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> = id_Set A\"\n  using assms unfolding cat_Set_components by simp\n\nlemma cat_Set_CId_app_app[cat_cs_simps]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" and \"a \\<in>\\<^sub>\\<circ> A\"\n  shows \"cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr>\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr> = a\"\n  unfolding \n    cat_Set_CId_app[OF assms(1)[unfolded cat_Set_components(1)]] \n    id_Rel_ArrVal_app[OF assms(2)] \n  by simp\n\n\nsubsubsection\\<open>\\<open>Set\\<close> is a category\\<close>\n\nlemma (in \\<Z>) category_cat_Set: \"category \\<alpha> (cat_Set \\<alpha>)\"\nproof(rule categoryI, unfold cat_smc_cat_Par cat_smc_cat_Set)\n\n  interpret Set: semicategory \\<alpha> \\<open>cat_smc (cat_Set \\<alpha>)\\<close>\n    unfolding cat_smc_cat_Set by (simp add: semicategory_smc_Set)\n\n  show \"vfsequence (cat_Set \\<alpha>)\" unfolding cat_Set_def by simp\n  show \"vcard (cat_Set \\<alpha>) = 6\\<^sub>\\<nat>\"\n    unfolding cat_Set_def by (simp add: nat_omega_simps)\n  show \"semicategory \\<alpha> (smc_Set \\<alpha>)\" by (simp add: semicategory_smc_Set)\n  show \"cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\n    if \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" for A\n    using that\n    unfolding cat_Set_Obj_iff\n    by \n      (\n        cs_concl cs_shallow\n          cs_simp: cat_Set_cs_simps cs_intro: cat_Set_cs_intros arr_Set_id_SetI\n      )\n\n  show \"cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>B\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F = F\" \n    if \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" for F A B\n  proof-\n    from that have \"arr_Set \\<alpha> F\" \"B \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" by (auto elim: cat_Set_is_arrE)\n    with that show ?thesis\n      by \n        (\n          cs_concl cs_shallow\n            cs_simp: cat_cs_simps cat_Set_cs_simps\n            cs_intro: cat_Set_cs_intros arr_Set_id_SetI\n        )\n  qed\n\n  show \"F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>B\\<rparr> = F\"\n    if \"F : B \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> C\" for F B C\n  proof-\n    from that have \"arr_Set \\<alpha> F\" \"B \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" by (auto elim: cat_Set_is_arrE)\n    with that show ?thesis\n      by \n        (\n          cs_concl cs_shallow\n            cs_simp: cat_cs_simps cat_Set_cs_simps\n            cs_intro: cat_Set_cs_intros arr_Set_id_SetI\n        )\n  qed\n\nqed (auto simp: cat_Set_components)\n\nlemma (in \\<Z>) category_cat_Set':\n  assumes \"\\<beta> = \\<alpha>\"\n  shows \"category \\<beta> (cat_Set \\<alpha>)\"\n  unfolding assms by (rule category_cat_Set)\n\nlemmas [cat_cs_intros] = \\<Z>.category_cat_Set'\n\n\nsubsubsection\\<open>\\<open>Set\\<close> is a wide replete subcategory of \\<open>Par\\<close>\\<close>\n\nlemma (in \\<Z>) wide_replete_subcategory_cat_Set_cat_Par: \n  \"cat_Set \\<alpha> \\<subseteq>\\<^sub>C\\<^sub>.\\<^sub>w\\<^sub>r\\<^bsub>\\<alpha>\\<^esub> cat_Par \\<alpha>\"\nproof(intro wide_replete_subcategoryI)\n  show wide_subcategory_cat_Set_cat_Par: \"cat_Set \\<alpha> \\<subseteq>\\<^sub>C\\<^sub>.\\<^sub>w\\<^sub>i\\<^sub>d\\<^sub>e\\<^bsub>\\<alpha>\\<^esub> cat_Par \\<alpha>\"\n  proof(intro wide_subcategoryI, unfold cat_smc_cat_Par cat_smc_cat_Set)\n    interpret Par: category \\<alpha> \\<open>cat_Par \\<alpha>\\<close> by (rule category_cat_Par)\n    interpret Set: category \\<alpha> \\<open>cat_Set \\<alpha>\\<close> by (rule category_cat_Set)\n    interpret wide_subsemicategory \\<alpha> \\<open>smc_Set \\<alpha>\\<close> \\<open>smc_Par \\<alpha>\\<close>\n      by (simp add: wide_subsemicategory_smc_Set_smc_Par)\n    show \"cat_Set \\<alpha> \\<subseteq>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Par \\<alpha>\"\n    proof(intro subcategoryI, unfold cat_smc_cat_Par cat_smc_cat_Set)\n      show \"smc_Set \\<alpha> \\<subseteq>\\<^sub>S\\<^sub>M\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> smc_Par \\<alpha>\" by (simp add: subsemicategory_axioms)\n      fix A assume \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n      then show \"cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> = cat_Par \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr>\"\n        unfolding cat_Set_components cat_Par_components by simp\n    qed \n      (\n        auto simp: \n          subsemicategory_axioms Par.category_axioms Set.category_axioms\n      )\n  qed (rule wide_subsemicategory_smc_Set_smc_Par)\n  show \"cat_Set \\<alpha> \\<subseteq>\\<^sub>C\\<^sub>.\\<^sub>r\\<^sub>e\\<^sub>p\\<^bsub>\\<alpha>\\<^esub> cat_Par \\<alpha>\"\n  proof(intro replete_subcategoryI)\n    interpret wide_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Par \\<alpha>\\<close>\n      by (rule wide_subcategory_cat_Set_cat_Par)\n    show \"cat_Set \\<alpha> \\<subseteq>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Par \\<alpha>\" by (rule subcategory_axioms)    \n    fix A B F assume \"F : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Par \\<alpha>\\<^esub> B\"\n    note arr_Par = cat_Par_is_iso_arrD[OF this]\n    from arr_Par show \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n      by (intro cat_Set_is_arrI arr_Set_arr_ParI cat_Par_is_arrD[OF arr_Par(1)])\n        (auto simp: cat_Par_is_arrD(2))\n  qed\nqed\n\n\nsubsubsection\\<open>\\<open>Set\\<close> is a subcategory of \\<open>Set\\<close>\\<close>\n\nlemma (in \\<Z>) subcategory_cat_Set_cat_Set:(*TODO: generalize*)\n  assumes \"\\<Z> \\<beta>\" and \"\\<alpha> \\<in>\\<^sub>\\<circ> \\<beta>\"\n  shows \"cat_Set \\<alpha> \\<subseteq>\\<^sub>C\\<^bsub>\\<beta>\\<^esub> cat_Set \\<beta>\"\nproof-\n  interpret \\<beta>: \\<Z> \\<beta> by (rule assms(1))\n  show ?thesis  \n  proof(intro subcategoryI')\n    show \"category \\<beta> (cat_Set \\<alpha>)\"\n      by (rule category.cat_category_if_ge_Limit, insert assms(2))\n        (cs_concl cs_intro: cat_cs_intros cat_Rel_cs_intros)+\n    show \"A \\<in>\\<^sub>\\<circ> cat_Set \\<beta>\\<lparr>Obj\\<rparr>\" if \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" for A \n      using that \n      unfolding cat_Set_components(1)\n      by (meson assms(2) Vset_in_mono \\<beta>.Axiom_of_Extensionality(3))\n    show is_arr_if_is_arr: \n      \"F : A \\<mapsto>\\<^bsub>cat_Set \\<beta>\\<^esub> B\" if \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" for A B F\n    proof-\n      note f = cat_Set_is_arrD[OF that]\n      interpret f: arr_Set \\<alpha> F by (rule f(1))\n      show ?thesis\n      proof(intro cat_Set_is_arrI arr_SetI)\n        show \"\\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> F\\<lparr>ArrCod\\<rparr>\"  \n           by (auto simp: f.arr_Set_ArrVal_vrange)\n        show \"F\\<lparr>ArrDom\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<beta>\"\n          by (auto intro!: f.arr_Set_ArrDom_in_Vset Vset_in_mono assms(2))\n        show \"F\\<lparr>ArrCod\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<beta>\"\n          by (auto intro!: f.arr_Set_ArrCod_in_Vset Vset_in_mono assms(2))\n      qed \n        (\n          auto simp: \n            f f.arr_Set_ArrVal_vdomain f.vfsequence_axioms f.arr_Set_length\n        )\n    qed\n    show \"G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F = G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<beta>\\<^esub> F\"\n      if \"G : B \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> C\" and \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" for B C G A F\n    proof-\n      note g = cat_Set_is_arrD[OF that(1)] and f = cat_Set_is_arrD[OF that(2)]      \n      from that have \\<alpha>_gf_is_arr: \"G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F : A \\<mapsto>\\<^bsub>cat_Set \\<beta>\\<^esub> C\"\n        by (cs_concl cs_intro: cat_cs_intros is_arr_if_is_arr)\n      from that have \\<beta>_gf_is_arr: \"G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<beta>\\<^esub> F : A \\<mapsto>\\<^bsub>cat_Set \\<beta>\\<^esub> C\"\n        by (cs_concl cs_intro: cat_cs_intros is_arr_if_is_arr)\n      note \\<alpha>_gf = cat_Set_is_arrD[OF \\<alpha>_gf_is_arr]\n        and \\<beta>_gf = cat_Set_is_arrD[OF \\<beta>_gf_is_arr]\n      show ?thesis\n      proof(rule arr_Set_eqI)\n        show \"arr_Set \\<beta> (G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F)\" by (rule \\<alpha>_gf(1))\n        then interpret arr_Set_\\<alpha>_gf: arr_Set \\<beta> \\<open>(G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F)\\<close> by simp\n        from \\<alpha>_gf_is_arr have dom_lhs: \"\\<D>\\<^sub>\\<circ> ((G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F)\\<lparr>ArrVal\\<rparr>) = A\"\n          by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n        show \"arr_Set \\<beta> (G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<beta>\\<^esub> F)\" by (rule \\<beta>_gf(1))\n        then interpret arr_Set_\\<beta>_gf: arr_Set \\<beta> \\<open>(G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<beta>\\<^esub> F)\\<close> by simp\n        from \\<beta>_gf_is_arr have dom_rhs: \"\\<D>\\<^sub>\\<circ> ((G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<beta>\\<^esub> F)\\<lparr>ArrVal\\<rparr>) = A\"\n          by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n        show \"(G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F)\\<lparr>ArrVal\\<rparr> = (G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<beta>\\<^esub> F)\\<lparr>ArrVal\\<rparr>\"\n        proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n          fix a assume \"a \\<in>\\<^sub>\\<circ> A\"\n          from that this show \n            \"(G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr> = (G \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<beta>\\<^esub> F)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\"\n            by \n              (\n                cs_concl cs_shallow\n                  cs_simp: cat_cs_simps cs_intro: cat_cs_intros is_arr_if_is_arr\n              )\n        qed auto\n      qed \n        (\n          use \\<alpha>_gf_is_arr \\<beta>_gf_is_arr in \n            \\<open>cs_concl cs_shallow cs_simp: cat_cs_simps\\<close>\n        )+\n    qed\n  qed \n    (\n      auto simp: \n        assms(2) cat_Set_components Vset_trans Vset_in_mono cat_cs_intros\n    )\nqed\n\n\nsubsubsection\\<open>Further properties\\<close>\n\nlemma cat_Set_Comp_ArrVal_vrange: (*FIXME: generalize/migrate*)\n  assumes \"S : B \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> C\" and \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n  shows \"\\<R>\\<^sub>\\<circ> ((S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T)\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>)\" \nproof(intro vsubsetI)\n  note SD = cat_Set_is_arrD[OF assms(1)]\n  interpret S: arr_Set \\<alpha> S \n    rewrites \"S\\<lparr>ArrDom\\<rparr> = B\" and \"S\\<lparr>ArrCod\\<rparr> = C\"\n    by (intro SD)+\n  from assms(1,2) have \"S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> C\"\n    by (cs_concl cs_intro: cat_cs_intros)\n  note ST = cat_Set_is_arrD[OF this]\n  interpret ST: arr_Set \\<alpha> \\<open>S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T\\<close>\n    rewrites \"(S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T)\\<lparr>ArrDom\\<rparr> = A\" \n      and \"(S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T)\\<lparr>ArrCod\\<rparr> = C\"\n    by (intro ST)+\n  fix y assume prems: \"y \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> ((S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T)\\<lparr>ArrVal\\<rparr>)\"\n  with ST.arr_Set_ArrVal_vdomain obtain x \n    where x: \"x \\<in>\\<^sub>\\<circ> A\" and y_def: \"y = (S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T)\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>\"\n    by force\n  show \"y \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>)\"\n  proof(intro S.ArrVal.vsv_vimageI2', unfold cat_Set_cs_simps)\n    from assms(1,2) x show \"y = S\\<lparr>ArrVal\\<rparr>\\<lparr>T\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>\\<rparr>\"\n      unfolding y_def \n      by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n    from assms(2) x show \"T\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr> \\<in>\\<^sub>\\<circ> B\"\n      by (cs_concl cs_intro: cat_Set_cs_intros)\n  qed\nqed\n\n\n\nsubsection\\<open>Isomorphism\\<close>\n\nlemma cat_Set_is_iso_arrI[intro]:\n  \\<comment>\\<open>\n  See \\cite{noauthor_nlab_nodate}\\footnote{\\url{\n  https://ncatlab.org/nlab/show/isomorphism\n  }}).\n  \\<close>\n  assumes \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n    and \"v11 (T\\<lparr>ArrVal\\<rparr>)\"\n    and \"\\<D>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) = A\"\n    and \"\\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) = B\"\n  shows \"T : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\nproof-\n  interpret T: arr_Set \\<alpha> T by (rule cat_Set_is_arrD(1)[OF assms(1)])\n  note [cat_cs_intros] = cat_Par_is_iso_arrI\n  from T.wide_replete_subcategory_cat_Set_cat_Par assms have \n    \"T : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Par \\<alpha>\\<^esub> B\"\n    by (cs_concl cs_intro: cat_cs_intros cat_sub_cs_intros cat_sub_fw_cs_intros)\n  with T.wide_replete_subcategory_cat_Set_cat_Par assms show \n    \"T : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n    by (cs_concl cs_shallow cs_simp: cat_sub_bw_cs_simps)\nqed\n\nlemma cat_Set_is_iso_arrD[dest]:\n  assumes \"T : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  shows \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n    and \"v11 (T\\<lparr>ArrVal\\<rparr>)\"\n    and \"\\<D>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) = A\"\n    and \"\\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) = B\"\nproof-\n  from assms have T: \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" by auto\n  interpret T: arr_Set \\<alpha> T by (rule cat_Set_is_arrD(1)[OF T])\n  from T.wide_replete_subcategory_cat_Set_cat_Par assms have T: \n    \"T : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Par \\<alpha>\\<^esub> B\"\n    by (cs_concl cs_shallow cs_intro: cat_sub_cs_intros cat_sub_fw_cs_intros)\n  show \"v11 (T\\<lparr>ArrVal\\<rparr>)\" \"\\<D>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) = A\" \"\\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) = B\"\n    by (intro cat_Par_is_iso_arrD[OF T])+\nqed (rule is_iso_arrD(1)[OF assms])\n\nlemma cat_Set_is_iso_arr:\n  \"T : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B \\<longleftrightarrow> \n    T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B \\<and>\n    v11 (T\\<lparr>ArrVal\\<rparr>) \\<and> \n    \\<D>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) = A \\<and> \n    \\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) = B\"\n  by auto\n\nlemma (in \\<Z>) cat_Set_is_iso_arr_if_monic_and_epic:\n  assumes \"F : A \\<mapsto>\\<^sub>m\\<^sub>o\\<^sub>n\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"F : A \\<mapsto>\\<^sub>e\\<^sub>p\\<^sub>i\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  shows \"F : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\nproof-\n  note cat_Set_is_monic_arrD[OF assms(1)] cat_Set_is_epic_arrD[OF assms(2)]\n  note FD = this(1,2,3,5) cat_Set_is_arrD[OF this(1)]\n  show ?thesis by (intro cat_Set_is_iso_arrI FD)\nqed\n\n\n\nsubsection\\<open>The inverse arrow\\<close>\n\nlemma cat_Set_ArrVal_app_is_arr[cat_cs_intros]:\n  assumes \"f : a \\<mapsto>\\<^bsub>\\<AA>\\<^esub> b\" \n    and \"category \\<alpha> \\<AA>\" (*the order of premises is important*)\n    and \"F : Hom \\<AA> a b \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> Hom \\<BB> c d\"\n  shows \"F\\<lparr>ArrVal\\<rparr>\\<lparr>f\\<rparr> : c \\<mapsto>\\<^bsub>\\<BB>\\<^esub> d\"\nproof-\n  interpret \\<AA>: category \\<alpha> \\<AA> by (rule assms(2))\n  interpret F: arr_Set \\<alpha> F by (rule cat_Set_is_arrD[OF assms(3)])  \n  from assms have \"F\\<lparr>ArrVal\\<rparr>\\<lparr>f\\<rparr> \\<in>\\<^sub>\\<circ> Hom \\<BB> c d\"\n    by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_Set_cs_intros)\n  then show ?thesis unfolding in_Hom_iff by simp\nqed\n\nabbreviation (input) converse_Set :: \"V \\<Rightarrow> V\" (\"(_\\<inverse>\\<^sub>S\\<^sub>e\\<^sub>t)\" [1000] 999)\n  where \"a\\<inverse>\\<^sub>S\\<^sub>e\\<^sub>t \\<equiv> a\\<inverse>\\<^sub>R\\<^sub>e\\<^sub>l\"\n\nlemma cat_Set_the_inverse[cat_Set_cs_simps]:\n  assumes \"T : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  shows \"T\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub> = T\\<inverse>\\<^sub>S\\<^sub>e\\<^sub>t\"\nproof-\n  from assms have T: \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" by auto\n  interpret arr_Set \\<alpha> T by (rule cat_Set_is_arrD(1)[OF T])\n  from wide_replete_subcategory_cat_Set_cat_Par assms have T:\n    \"T : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Par \\<alpha>\\<^esub> B\"\n    by (cs_concl cs_shallow cs_intro: cat_sub_cs_intros cat_sub_fw_cs_intros)\n  from wide_replete_subcategory_cat_Set_cat_Par assms \n  have [symmetric, cat_cs_simps]: \"T\\<inverse>\\<^sub>C\\<^bsub>cat_Par \\<alpha>\\<^esub> = T\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub>\"\n    by \n      (\n        cs_concl cs_shallow \n          cs_simp: cat_sub_bw_cs_simps cs_intro: cat_sub_cs_intros\n      )\n  from T show \"T\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub> = T\\<inverse>\\<^sub>S\\<^sub>e\\<^sub>t\"\n    by (cs_concl cs_shallow cs_simp: cat_Par_cs_simps cat_cs_simps cs_intro: \\<Z>_\\<beta>)\nqed\n\nlemma cat_Set_the_inverse_app[cat_cs_intros]:\n  assumes \"T : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n    and \"a \\<in>\\<^sub>\\<circ> A\"\n    and [cat_cs_simps]: \"T\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr> = b\"\n  shows \"(T\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub>)\\<lparr>ArrVal\\<rparr>\\<lparr>b\\<rparr> = a\"\nproof-\n  from assms have T: \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" by auto\n  interpret arr_Set \\<alpha> T by (rule cat_Set_is_arrD(1)[OF T])\n  note T = cat_Set_is_iso_arrD[OF assms(1)]\n  interpret T: v11 \\<open>T\\<lparr>ArrVal\\<rparr>\\<close> by (rule T(2))\n  from T.v11_axioms assms(1,2) show \"T\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub>\\<lparr>ArrVal\\<rparr>\\<lparr>b\\<rparr> = a\"\n    by\n      (\n        cs_concl cs_shallow\n          cs_simp: \n            converse_Rel_components V_cs_simps cat_Set_cs_simps cat_cs_simps \n          cs_intro: cat_arrow_cs_intros cat_cs_intros\n      )\nqed\n                                                          \nlemma cat_Set_ArrVal_app_the_inverse_is_arr[cat_cs_intros]:\n  assumes \"f : c \\<mapsto>\\<^bsub>\\<BB>\\<^esub> d\" \n    and \"category \\<alpha> \\<BB>\" (*the order of premises is important*)\n    and \"F : Hom \\<AA> a b \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> Hom \\<BB> c d\"\n  shows \"F\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub>\\<lparr>ArrVal\\<rparr>\\<lparr>f\\<rparr> : a \\<mapsto>\\<^bsub>\\<AA>\\<^esub> b\"\nproof-\n  interpret \\<BB>: category \\<alpha> \\<BB> by (rule assms(2))\n  from cat_Set_is_iso_arrD[OF assms(3)] interpret F: arr_Set \\<alpha> F \n    by (simp add: cat_Set_is_arrD)  \n  from assms have \"F\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub>\\<lparr>ArrVal\\<rparr>\\<lparr>f\\<rparr> \\<in>\\<^sub>\\<circ> Hom \\<AA> a b\"\n    by (cs_concl cs_intro: cat_cs_intros cat_arrow_cs_intros)\n  then show ?thesis unfolding in_Hom_iff by simp\nqed\n\nlemma cat_Set_app_the_inverse_app[cat_cs_simps]:\n  assumes \"F : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"b \\<in>\\<^sub>\\<circ> B\"\n  shows \"F\\<lparr>ArrVal\\<rparr>\\<lparr>F\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub>\\<lparr>ArrVal\\<rparr>\\<lparr>b\\<rparr>\\<rparr> = b\"\nproof-\n  note F = cat_Set_is_iso_arrD[OF assms(1)]\n  note F = F cat_Set_is_arrD[OF F(1)]\n  interpret F: arr_Set \\<alpha> F by (rule cat_Set_is_arrD[OF F(1)])  \n  from assms have [cat_cs_simps]: \n    \"F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub> = cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>B\\<rparr>\"\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n  from assms have [cat_cs_simps]: \n    \"F\\<lparr>ArrVal\\<rparr>\\<lparr>F\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub>\\<lparr>ArrVal\\<rparr>\\<lparr>b\\<rparr>\\<rparr> = \n      (F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub>)\\<lparr>ArrVal\\<rparr>\\<lparr>b\\<rparr>\"\n    by\n      (\n        cs_concl \n          cs_simp: cat_cs_simps cs_intro: cat_arrow_cs_intros cat_cs_intros\n      )\n  from assms F(1) F.arr_Par_ArrCod_in_Vset[unfolded F] show ?thesis\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\nqed\n\nlemma cat_Set_the_inverse_app_app[cat_cs_simps]:\n  assumes \"F : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"a \\<in>\\<^sub>\\<circ> A\"\n  shows \"F\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub>\\<lparr>ArrVal\\<rparr>\\<lparr>F\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\\<rparr> = a\"\nproof-\n  note F = cat_Set_is_iso_arrD[OF assms(1)]\n  note F = F cat_Set_is_arrD[OF F(1)]\n  interpret F: arr_Set \\<alpha> F by (rule cat_Set_is_arrD[OF F(1)])  \n  from assms have [cat_cs_simps]:\n    \"F\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F = cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr>\"\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n  from assms have [cat_cs_simps]: \n    \"F\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub>\\<lparr>ArrVal\\<rparr>\\<lparr>F\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\\<rparr> =\n      (F\\<inverse>\\<^sub>C\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\"\n    by\n      (\n        cs_concl \n          cs_simp: cat_cs_simps cs_intro: cat_arrow_cs_intros cat_cs_intros\n      )\n  from assms F(1) F.arr_Par_ArrDom_in_Vset[unfolded F] show ?thesis\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\nqed\n\n\n\nsubsection\\<open>Conversion of a single-valued relation to an arrow in \\<open>Set\\<close>\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\n\ndefinition cat_Set_arr_of_vsv :: \"V \\<Rightarrow> V \\<Rightarrow> V\"\n  where \"cat_Set_arr_of_vsv f B = [f, \\<D>\\<^sub>\\<circ> f, B]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma cat_Set_arr_of_vsv_components:\n  shows [cat_Set_cs_simps]: \"cat_Set_arr_of_vsv f B\\<lparr>ArrVal\\<rparr> = f\"\n    and [cat_Set_cs_simps]: \"cat_Set_arr_of_vsv f B\\<lparr>ArrDom\\<rparr> = \\<D>\\<^sub>\\<circ> f\"\n    and [cat_cs_simps, cat_Set_cs_simps]: \"cat_Set_arr_of_vsv f B\\<lparr>ArrCod\\<rparr> = B\"\n  unfolding cat_Set_arr_of_vsv_def arr_field_simps \n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>\nConversion of a single-valued relation to an arrow in \\<open>Set\\<close> is an arrow in \\<open>Set\\<close>\n\\<close>\n\nlemma (in \\<Z>) cat_Set_arr_of_vsv_is_arr:\n  assumes \"vsv r\" \n    and \"\\<R>\\<^sub>\\<circ> r \\<subseteq>\\<^sub>\\<circ> B\" \n    and \"\\<D>\\<^sub>\\<circ> r \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"cat_Set_arr_of_vsv r B : \\<D>\\<^sub>\\<circ> r \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\nproof-\n  interpret r: vsv r by (rule assms)\n  show ?thesis\n  proof(intro cat_Set_is_arrI arr_SetI, unfold cat_Set_arr_of_vsv_components)\n    show \"vfsequence (cat_Set_arr_of_vsv r B)\"\n      unfolding cat_Set_arr_of_vsv_def by auto\n    show \"vcard (cat_Set_arr_of_vsv r B) = 3\\<^sub>\\<nat>\"\n      unfolding cat_Set_arr_of_vsv_def by (auto simp: nat_omega_simps)\n  qed (use assms in \\<open>auto simp: cat_Set_components\\<close>)\nqed\n\n\n\nsubsection\\<open>Left restriction for \\<open>Set\\<close>\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition vlrestriction_Set :: \"V \\<Rightarrow> V \\<Rightarrow> V\" (infixr \\<open>\\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t\\<close> 80)\n  where \"T \\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t C = [T\\<lparr>ArrVal\\<rparr> \\<restriction>\\<^sup>l\\<^sub>\\<circ> C, C, T\\<lparr>ArrCod\\<rparr>]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma vlrestriction_Set_components:\n  shows [cat_Set_cs_simps]: \"(T \\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrVal\\<rparr> = T\\<lparr>ArrVal\\<rparr> \\<restriction>\\<^sup>l\\<^sub>\\<circ> C\"\n    and [cat_cs_simps, cat_Set_cs_simps]: \"(T \\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrDom\\<rparr> = C\"\n    and [cat_cs_simps, cat_Set_cs_simps]: \"(T \\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrCod\\<rparr> = T\\<lparr>ArrCod\\<rparr>\"\n  unfolding vlrestriction_Set_def arr_field_simps\n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Arrow value\\<close>\n\nlemma vlrestriction_Set_ArrVal_vdomain[cat_cs_simps]:\n  assumes \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"C \\<subseteq>\\<^sub>\\<circ> A\" \n  shows \"\\<D>\\<^sub>\\<circ> ((T \\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrVal\\<rparr>) = C\"\nproof-\n  note TD = cat_Set_is_arrD[OF assms(1)]\n  interpret T: arr_Set \\<alpha> T\n    rewrites \"T\\<lparr>ArrDom\\<rparr> = A\" and \"T\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro TD)+\n  from assms show ?thesis\n    unfolding vlrestriction_Set_components\n    by (cs_concl cs_simp: V_cs_simps cat_cs_simps cs_intro: V_cs_intros)\nqed\n\nlemma vlrestriction_Set_ArrVal_app[cat_cs_simps]:\n  assumes \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"C \\<subseteq>\\<^sub>\\<circ> A\" and \"x \\<in>\\<^sub>\\<circ> C\" \n  shows \"(T \\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr> = T\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>\"\nproof-\n  interpret T: arr_Set \\<alpha> T\n    rewrites \"T\\<lparr>ArrDom\\<rparr> = A\" and \"T\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro cat_Set_is_arrD[OF assms(1)])+\n  from assms have x: \"x \\<in>\\<^sub>\\<circ> A\" by auto\n  with assms show ?thesis \n    unfolding vlrestriction_Set_components\n    by (cs_concl cs_simp: V_cs_simps cat_cs_simps cs_intro: V_cs_intros)\nqed\n\n\nsubsubsection\\<open>Left restriction for \\<open>Set\\<close> is an arrow in \\<open>Set\\<close>\\<close>\n\nlemma vlrestriction_Set_is_arr:\n  assumes \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"C \\<subseteq>\\<^sub>\\<circ> A\"\n  shows \"T \\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t C : C \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\nproof-\n  note TD = cat_Set_is_arrD[OF assms(1)]\n  interpret T: arr_Set \\<alpha> T\n    rewrites \"T\\<lparr>ArrDom\\<rparr> = A\" and \"T\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro TD)+\n  show ?thesis\n  proof(intro cat_Set_is_arrI arr_SetI, unfold cat_Set_cs_simps TD(2,3))\n    show \"vfsequence (T \\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t C)\"\n      unfolding vlrestriction_Set_def by auto\n    show \"vcard (T \\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t C) = 3\\<^sub>\\<nat>\"\n      unfolding vlrestriction_Set_def by (simp add: nat_omega_simps)\n    from assms show \"\\<D>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr> \\<restriction>\\<^sup>l\\<^sub>\\<circ> C) = C\"\n      by (cs_concl cs_simp: V_cs_simps cat_cs_simps cs_intro: cat_cs_intros)\n    show \"\\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr> \\<restriction>\\<^sup>l\\<^sub>\\<circ> C) \\<subseteq>\\<^sub>\\<circ> B\"\n      unfolding app_vimage_def[symmetric]\n    proof(intro vsubsetI)\n      fix x assume prems: \"x \\<in>\\<^sub>\\<circ> T\\<lparr>ArrVal\\<rparr> `\\<^sub>\\<circ> C\"\n      then obtain c where \"c \\<in>\\<^sub>\\<circ> C\" and x_def: \"x = T\\<lparr>ArrVal\\<rparr>\\<lparr>c\\<rparr>\" by auto\n      with assms(2) have c: \"c \\<in>\\<^sub>\\<circ> A\" by auto\n      from c assms show \"x \\<in>\\<^sub>\\<circ> B\"\n        unfolding x_def by (cs_concl cs_intro: cat_Set_cs_intros)\n    qed\n    from assms(2) show \"C \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n      using vsubset_in_VsetI by (auto simp: T.arr_Set_ArrDom_in_Vset)\n  qed (auto simp: T.arr_Set_ArrCod_in_Vset)\nqed\n\nlemma (in \\<Z>) vlrestriction_Set_is_monic_arr:\n  assumes \"T : A \\<mapsto>\\<^sub>m\\<^sub>o\\<^sub>n\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"C \\<subseteq>\\<^sub>\\<circ> A\"\n  shows \"T \\<restriction>\\<^sup>l\\<^sub>S\\<^sub>e\\<^sub>t C : C \\<mapsto>\\<^sub>m\\<^sub>o\\<^sub>n\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\nproof-\n  note cat_Set_is_monic_arrD[OF assms(1)]\n  note TD = this cat_Set_is_arrD[OF this(1)]\n  interpret F: arr_Set \\<alpha> T by (intro TD)+\n  interpret ArrVal: v11 \\<open>T\\<lparr>ArrVal\\<rparr>\\<close> by (rule TD(2))\n  show ?thesis\n  proof\n    (\n      intro \n        cat_Set_is_monic_arrI \n        vlrestriction_Set_is_arr[OF TD(1) assms(2)],\n      unfold cat_Set_cs_simps\n    )\n    from TD(1) assms(2) show \"\\<D>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr> \\<restriction>\\<^sup>l\\<^sub>\\<circ> C) = C\"\n      by (cs_concl cs_simp: V_cs_simps cat_cs_simps)\n  qed auto\nqed\n\n\n\nsubsection\\<open>Right restriction for \\<open>Set\\<close>\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition vrrestriction_Set :: \"V \\<Rightarrow> V \\<Rightarrow> V\" (infixr \\<open>\\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t\\<close> 80)\n  where \"T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C = [T\\<lparr>ArrVal\\<rparr> \\<restriction>\\<^sup>r\\<^sub>\\<circ> C, T\\<lparr>ArrDom\\<rparr>, C]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma vrrestriction_Set_components:\n  shows [cat_Set_cs_simps]: \"(T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrVal\\<rparr> = T\\<lparr>ArrVal\\<rparr> \\<restriction>\\<^sup>r\\<^sub>\\<circ> C\"\n    and [cat_cs_simps, cat_Set_cs_simps]: \"(T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrDom\\<rparr> = T\\<lparr>ArrDom\\<rparr>\"\n    and [cat_cs_simps, cat_Set_cs_simps]: \"(T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrCod\\<rparr> = C\"\n  unfolding vrrestriction_Set_def arr_field_simps\n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Arrow value\\<close>\n\nlemma vrrestriction_Set_ArrVal_app[cat_cs_simps]:\n  assumes \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"\\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> C\" \n  shows \"(T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrVal\\<rparr> = T\\<lparr>ArrVal\\<rparr>\"\nproof-\n  interpret T: arr_Set \\<alpha> T\n    rewrites \"T\\<lparr>ArrDom\\<rparr> = A\" and \"T\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro cat_Set_is_arrD[OF assms(1)])+\n  from assms show ?thesis unfolding cat_Set_cs_simps by simp\nqed\n\n\nsubsubsection\\<open>Right restriction for \\<open>Set\\<close> is an arrow in \\<open>Set\\<close>\\<close>\n\nlemma vrrestriction_Set_is_arr:\n  assumes \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n    and \"\\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> C\" \n    and \"C \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> C\"\nproof-\n  note TD = cat_Set_is_arrD[OF assms(1)]\n  interpret T: arr_Set \\<alpha> T\n    rewrites \"T\\<lparr>ArrDom\\<rparr> = A\" and \"T\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro TD)+\n  show ?thesis\n  proof(intro cat_Set_is_arrI arr_SetI, unfold cat_Set_cs_simps)\n    show \"vfsequence (T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C)\" unfolding vrrestriction_Set_def by auto\n    show \"vcard (T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C) = 3\\<^sub>\\<nat>\"\n      unfolding vrrestriction_Set_def by (simp add: nat_omega_simps)\n  qed\n    (\n      use assms(2,3) in\n        \\<open>\n          auto simp:\n            TD(2)\n            cat_Set_components\n            T.arr_Set_ArrVal_vdomain\n            T.arr_Set_ArrDom_in_Vset\n        \\<close>\n    )\nqed\n\nlemma vrrestriction_Set_is_arr'[cat_cs_intros]:\n  assumes \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n    and \"\\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> C\" \n    and \"C \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"C' = C\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C : A \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> C'\"\n  using assms(1-3) unfolding assms(4,5) by (rule vrrestriction_Set_is_arr)\n\n\nsubsubsection\\<open>Further properties\\<close>\n\nlemma \n  assumes \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n  shows vrrestriction_Set_vrange_is_arr: \n      \"T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t \\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>)\"\n    and vrrestriction_Set_vrange_ArrVal_app[cat_cs_simps, cat_Set_cs_simps]: \n      \"(T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t \\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>))\\<lparr>ArrVal\\<rparr> = T\\<lparr>ArrVal\\<rparr>\"\nproof(intro vrrestriction_Set_is_arr, rule assms)\n  note TD = cat_Set_is_arrD[OF assms(1)]\n  interpret T: arr_Set \\<alpha> T\n    rewrites \"T\\<lparr>ArrDom\\<rparr> = A\" and \"T\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro TD)+\n  show \"\\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    by (auto simp: cat_Set_components T.arr_Rel_ArrVal_in_Vset vrange_in_VsetI)\nqed (auto intro: vrrestriction_Set_ArrVal_app[OF assms])\n\nlemma (in \\<Z>) vrrestriction_Set_vrange_is_iso_arr:\n  assumes \"T : A \\<mapsto>\\<^sub>m\\<^sub>o\\<^sub>n\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n  shows \"T \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t \\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>)\"\nproof-\n  note cat_Set_is_monic_arrD[OF assms]\n  note TD = this cat_Set_is_arrD[OF this(1)]\n  interpret T: arr_Set \\<alpha> T by (intro TD)+\n  show ?thesis\n    by \n      (\n        intro cat_Set_is_iso_arrI vrrestriction_Set_vrange_is_arr[OF TD(1)],\n        unfold cat_Set_cs_simps\n      )\n      (simp_all add: TD(2,3))\nqed\n\n\nsubsubsection\\<open>Connections\\<close>\n\nlemma cat_Set_Comp_vrrestriction_Set:\n  assumes \"S : B \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> C\" \n    and \"T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n    and \"\\<R>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> D\"\n    and \"D \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"S \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T = (S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T) \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D\"\nproof-\n\n  note SD = cat_Set_is_arrD[OF assms(1)]\n  interpret S: arr_Set \\<alpha> S \n    rewrites [cat_cs_simps]: \"S\\<lparr>ArrDom\\<rparr> = B\" and [cat_cs_simps]: \"S\\<lparr>ArrCod\\<rparr> = C\"\n    by (intro SD)+\n  note TD = cat_Set_is_arrD[OF assms(2)]\n  interpret T: arr_Set \\<alpha> T \n    rewrites [cat_cs_simps]: \"T\\<lparr>ArrDom\\<rparr> = A\" and [cat_cs_simps]: \"T\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro TD)+\n\n  from assms(3) S.arr_Par_ArrVal_vrange have RS_D: \"\\<R>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> D\" by auto\n\n  from assms(1,2) have \"S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> C\"\n    by (cs_concl cs_intro: cat_cs_intros)\n\n  from assms(1,2) have \"\\<R>\\<^sub>\\<circ> ((S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T)\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>)\" \n    by (intro cat_Set_Comp_ArrVal_vrange)\n  with assms(3) have RST: \"\\<R>\\<^sub>\\<circ> ((S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T)\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> D\" by auto\n\n  from assms(1,2,4) RS_D have SD_T: \n    \"S \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> D\" \n    by (cs_concl cs_intro: cat_cs_intros) \n  then have dom_lhs: \"\\<D>\\<^sub>\\<circ> ((S \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T)\\<lparr>ArrVal\\<rparr>) = A\"\n    by (simp add: cat_cs_simps)\n\n  from assms(1,2,4) RST have ST_D: \n    \"(S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T) \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> D\"\n    by (cs_concl cs_intro: cat_cs_intros)\n  then have dom_rhs: \"\\<D>\\<^sub>\\<circ> (((S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T) \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D)\\<lparr>ArrVal\\<rparr>) = A\"\n    by (simp add: cat_cs_simps)\n\n  show \"S \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T = (S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T) \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D\"\n  proof(rule arr_Set_eqI[of \\<alpha>])\n    show \n      \"(S \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T)\\<lparr>ArrVal\\<rparr> =\n        ((S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T) \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D)\\<lparr>ArrVal\\<rparr>\"\n    proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n      fix a assume \"a \\<in>\\<^sub>\\<circ> A\"\n      with assms(1,2,4) RST RS_D show\n        \"(S \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr> = \n          ((S \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> T) \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t D)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\"\n        by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n    qed (use SD_T ST_D in \\<open>auto dest: cat_Set_is_arrD\\<close>) \n  qed (use SD_T ST_D in \\<open>auto simp: cat_Set_is_arrD\\<close>) \n\nqed\n\nlemma (in \\<Z>) cat_Set_CId_vrrestriction_Set[cat_cs_simps]:\n  assumes \"A \\<subseteq>\\<^sub>\\<circ> B\" and \"B \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t B = incl_Set A B\"\nproof-\n\n  from assms have A: \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    unfolding cat_Set_components by auto\n  from A have CId_A: \"cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\n    by (cs_concl cs_intro: cat_cs_intros)\n  with cat_Set_is_arrD[OF CId_A] assms(1) have RA_B:\n    \"\\<R>\\<^sub>\\<circ> (cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr>\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> B\"\n    by (auto intro: arr_Set.arr_Set_ArrVal_vrange)\n\n  with assms A assms(1,2) have lhs_is_arr:\n    \"cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t B : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n    by (cs_concl cs_intro: cat_cs_intros)\n  then have dom_lhs: \"\\<D>\\<^sub>\\<circ> ((cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t B)\\<lparr>ArrVal\\<rparr>) = A\"\n    by (simp add: cat_cs_simps)\n\n  from A assms(1,2) have rhs_is_arr: \"incl_Set A B : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n    by (cs_concl cs_intro: cat_cs_intros)\n  then have dom_rhs: \"\\<D>\\<^sub>\\<circ> ((incl_Set A B)\\<lparr>ArrVal\\<rparr>) = A\"\n    by (simp add: cat_cs_simps)\n\n  show ?thesis\n  proof(rule arr_Set_eqI[of \\<alpha>])\n    show \"(cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t B)\\<lparr>ArrVal\\<rparr> = incl_Rel A B\\<lparr>ArrVal\\<rparr>\"\n    proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n      fix a assume \"a \\<in>\\<^sub>\\<circ> A\"\n      with A RA_B show \n        \"(cat_Set \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t B)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr> = incl_Rel A B\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\"\n        by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n    qed (use lhs_is_arr rhs_is_arr in \\<open>auto dest: cat_Set_is_arrD\\<close>)\n  qed (use lhs_is_arr rhs_is_arr in \\<open>auto simp: cat_Set_is_arrD\\<close>)\n\nqed\n\nlemma cat_Set_Comp_incl_Rel_vrrestriction_Set[cat_cs_simps]:\n  assumes \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"C \\<subseteq>\\<^sub>\\<circ> B\" and \"\\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> C\"\n  shows \"incl_Rel C B \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C = F\"\nproof-\n  note FD = cat_Set_is_arrD[OF assms(1)]\n  interpret F: arr_Set \\<alpha> F \n    rewrites [cat_cs_simps]: \"F\\<lparr>ArrDom\\<rparr> = A\" and [cat_cs_simps]: \"F\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro FD)+\n  from assms(2) have C: \"C \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    unfolding cat_Set_components(1) by (auto intro: F.arr_Par_ArrCod_in_Vset)\n  from assms C have lhs_is_arr:\n    \"incl_Rel C B \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n    by (cs_concl cs_intro: cat_cs_intros)\n  then have dom_lhs: \"\\<D>\\<^sub>\\<circ> ((incl_Rel C B \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrVal\\<rparr>) = A\"\n    by (cs_concl cs_simp: cat_cs_simps)\n  from assms(1) have dom_rhs: \"\\<D>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>) = A\" \n    by (cs_concl cs_simp: cat_cs_simps)\n  show ?thesis\n  proof(rule arr_Set_eqI[of \\<alpha>])\n    show \"(incl_Rel C B \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrVal\\<rparr> = F\\<lparr>ArrVal\\<rparr>\"\n    proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n      fix a assume prems: \"a \\<in>\\<^sub>\\<circ> A\"\n      with assms F.ArrVal.vsv_vimageI2 have \"F\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr> \\<in>\\<^sub>\\<circ> C\"\n        by (auto simp: F.arr_Set_ArrVal_vdomain)\n      with prems assms C show \n        \"(incl_Rel C B \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> F \\<restriction>\\<^sup>r\\<^sub>S\\<^sub>e\\<^sub>t C)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr> = F\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\"\n        by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n    qed (use assms(1) lhs_is_arr in \\<open>auto dest: cat_Set_is_arrD\\<close>)\n  qed (use assms(1) lhs_is_arr in \\<open>auto dest: cat_Set_is_arrD\\<close>)\nqed\n\n\n\nsubsection\\<open>Projection arrows for \\<open>vtimes\\<close>\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition vfst_arrow :: \"V \\<Rightarrow> V \\<Rightarrow> V\"\n  where \"vfst_arrow A B = [(\\<lambda>ab\\<in>\\<^sub>\\<circ>A \\<times>\\<^sub>\\<circ> B. vfst ab), A \\<times>\\<^sub>\\<circ> B, A]\\<^sub>\\<circ>\"\n\ndefinition vsnd_arrow :: \"V \\<Rightarrow> V \\<Rightarrow> V\"\n  where \"vsnd_arrow A B = [(\\<lambda>ab\\<in>\\<^sub>\\<circ>A \\<times>\\<^sub>\\<circ> B. vsnd ab), A \\<times>\\<^sub>\\<circ> B, B]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma vfst_arrow_components: \n  shows \"vfst_arrow A B\\<lparr>ArrVal\\<rparr> = (\\<lambda>ab\\<in>\\<^sub>\\<circ>A \\<times>\\<^sub>\\<circ> B. vfst ab)\"\n    and [cat_cs_simps]: \"vfst_arrow A B\\<lparr>ArrDom\\<rparr> = A \\<times>\\<^sub>\\<circ> B\"\n    and [cat_cs_simps]: \"vfst_arrow A B\\<lparr>ArrCod\\<rparr> = A\"\n  unfolding vfst_arrow_def arr_field_simps by (simp_all add: nat_omega_simps)\n\nlemma vsnd_arrow_components: \n  shows \"vsnd_arrow A B\\<lparr>ArrVal\\<rparr> = (\\<lambda>ab\\<in>\\<^sub>\\<circ>A \\<times>\\<^sub>\\<circ> B. vsnd ab)\"\n    and [cat_cs_simps]: \"vsnd_arrow A B\\<lparr>ArrDom\\<rparr> = A \\<times>\\<^sub>\\<circ> B\"\n    and [cat_cs_simps]: \"vsnd_arrow A B\\<lparr>ArrCod\\<rparr> = B\"\n  unfolding vsnd_arrow_def arr_field_simps by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Arrow value\\<close>\n\nmk_VLambda vfst_arrow_components(1)\n  |vsv vfst_arrow_ArrVal_vsv[cat_cs_intros]|\n  |vdomain vfst_arrow_ArrVal_vdomain[cat_cs_simps]|\n  |app vfst_arrow_ArrVal_app'|\n\nmk_VLambda vsnd_arrow_components(1)\n  |vsv vsnd_arrow_ArrVal_vsv[cat_cs_intros]|\n  |vdomain vsnd_arrow_ArrVal_vdomain[cat_cs_simps]|\n  |app vsnd_arrow_ArrVal_app'|\n\nlemma vfst_arrow_ArrVal_app[cat_cs_simps]:\n  assumes \"ab = \\<langle>a, b\\<rangle>\" and \"ab \\<in>\\<^sub>\\<circ> A \\<times>\\<^sub>\\<circ> B\"\n  shows \"vfst_arrow A B\\<lparr>ArrVal\\<rparr>\\<lparr>ab\\<rparr> = a\"\n  using assms(2) unfolding assms(1) by (simp add: vfst_arrow_ArrVal_app')\n\nlemma vfst_arrow_vrange: \"\\<R>\\<^sub>\\<circ> (vfst_arrow A B\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> A\"\n  unfolding vfst_arrow_components\nproof(intro vrange_VLambda_vsubset)\n  fix ab assume \"ab \\<in>\\<^sub>\\<circ> A \\<times>\\<^sub>\\<circ> B\"\n  then obtain a b where ab_def: \"ab = \\<langle>a, b\\<rangle>\" and a: \"a \\<in>\\<^sub>\\<circ> A\" by clarsimp\n  from a show \"vfst ab \\<in>\\<^sub>\\<circ> A\" unfolding ab_def by simp\nqed\n\nlemma vsnd_arrow_ArrVal_app[cat_cs_simps]:\n  assumes \"ab = \\<langle>a, b\\<rangle>\" and \"ab \\<in>\\<^sub>\\<circ> A \\<times>\\<^sub>\\<circ> B\"\n  shows \"vsnd_arrow A B\\<lparr>ArrVal\\<rparr>\\<lparr>ab\\<rparr> = b\"\n  using assms(2) unfolding assms(1) by (simp add: vsnd_arrow_ArrVal_app')\n\nlemma vsnd_arrow_vrange: \"\\<R>\\<^sub>\\<circ> (vsnd_arrow A B\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> B\"\n  unfolding vsnd_arrow_components\nproof(intro vrange_VLambda_vsubset)\n  fix ab assume \"ab \\<in>\\<^sub>\\<circ> A \\<times>\\<^sub>\\<circ> B\"\n  then obtain a b where ab_def: \"ab = \\<langle>a, b\\<rangle>\" and b: \"b \\<in>\\<^sub>\\<circ> B\" by clarsimp\n  from b show \"vsnd ab \\<in>\\<^sub>\\<circ> B\" unfolding ab_def by simp\nqed\n\n\nsubsubsection\\<open>Projection arrows are arrows in the category \\<open>Set\\<close>\\<close>\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Set_arr_Vset:\n  assumes \"A \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" and \"B \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"vfst_arrow A B : A \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\nproof(intro cat_Set_is_arrI arr_SetI, unfold cat_cs_simps)\n  show \"vfsequence (vfst_arrow A B)\" unfolding vfst_arrow_def by simp\n  show \"vcard (vfst_arrow A B) = 3\\<^sub>\\<nat>\"\n    unfolding vfst_arrow_def by (simp add: nat_omega_simps)\n  show \"\\<R>\\<^sub>\\<circ> (vfst_arrow A B\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> A\" by (rule vfst_arrow_vrange)\nqed (use assms in \\<open>cs_concl cs_shallow cs_intro: V_cs_intros cat_cs_intros\\<close>)+\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Set_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" and \"B \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vfst_arrow A B : A \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\n  using assms \n  unfolding cat_Set_components \n  by (rule vfst_arrow_is_cat_Set_arr_Vset)\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Set_arr'[cat_rel_par_Set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = A \\<times>\\<^sub>\\<circ> B\"\n    and \"A' = A\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"vfst_arrow A B : AB \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> A'\"\n  using assms(1-2) unfolding assms(3-5) by (rule vfst_arrow_is_cat_Set_arr)\n\nlemmas [cat_rel_par_Set_cs_intros] = \\<Z>.vfst_arrow_is_cat_Set_arr'\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Set_arr_Vset:\n  assumes \"A \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" and \"B \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"vsnd_arrow A B : A \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\nproof(intro cat_Set_is_arrI arr_SetI , unfold cat_cs_simps)\n  show \"vfsequence (vsnd_arrow A B)\" unfolding vsnd_arrow_def by simp\n  show \"vcard (vsnd_arrow A B) = 3\\<^sub>\\<nat>\"\n    unfolding vsnd_arrow_def by (simp add: nat_omega_simps)\n  show \"\\<R>\\<^sub>\\<circ> (vsnd_arrow A B\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> B\" by (rule vsnd_arrow_vrange)\nqed (use assms in \\<open>cs_concl cs_shallow cs_intro: V_cs_intros cat_cs_intros\\<close>)+\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Set_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" and \"B \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vsnd_arrow A B : A \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  using assms \n  unfolding cat_Set_components \n  by (rule vsnd_arrow_is_cat_Set_arr_Vset)\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Set_arr'[cat_rel_par_Set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = A \\<times>\\<^sub>\\<circ> B\"\n    and \"B' = B\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"vsnd_arrow A B : AB \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> B'\"\n  using assms(1-2) unfolding assms(3-5) by (rule vsnd_arrow_is_cat_Set_arr)\n\nlemmas [cat_rel_par_Set_cs_intros] = \\<Z>.vsnd_arrow_is_cat_Set_arr'\n\n\nsubsubsection\\<open>Projection arrows are arrows in the category \\<open>Par\\<close>\\<close>\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Par_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\" and \"B \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vfst_arrow A B : A \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^bsub>cat_Par \\<alpha>\\<^esub> A\"\nproof-\n  interpret Set_Par: wide_replete_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Par \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Set_cat_Par)\n  from assms show ?thesis\n    unfolding cat_Par_components(1)\n    by (intro Set_Par.subcat_is_arrD vfst_arrow_is_cat_Set_arr_Vset) auto\nqed\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Par_arr'[cat_rel_Par_set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = A \\<times>\\<^sub>\\<circ> B\"\n    and \"A' = A\"\n    and \"\\<CC>' = cat_Par \\<alpha>\"\n  shows \"vfst_arrow A B : AB \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> A'\"\n  using assms(1-2) unfolding assms(3-5) by (rule vfst_arrow_is_cat_Par_arr)\n\nlemmas [cat_rel_Par_set_cs_intros] = \\<Z>.vfst_arrow_is_cat_Par_arr'\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Par_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\" and \"B \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vsnd_arrow A B : A \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^bsub>cat_Par \\<alpha>\\<^esub> B\"\nproof-\n  interpret Set_Par: wide_replete_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Par \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Set_cat_Par)\n  from assms show ?thesis\n    unfolding cat_Par_components(1)\n    by (intro Set_Par.subcat_is_arrD vsnd_arrow_is_cat_Set_arr_Vset) auto\nqed\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Par_arr'[cat_rel_Par_set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = A \\<times>\\<^sub>\\<circ> B\"\n    and \"B' = B\"\n    and \"\\<CC>' = cat_Par \\<alpha>\"\n  shows \"vsnd_arrow A B : AB \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> B'\"\n  using assms(1-2) unfolding assms(3-5) by (rule vsnd_arrow_is_cat_Par_arr)\n\nlemmas [cat_rel_Par_set_cs_intros] = \\<Z>.vsnd_arrow_is_cat_Par_arr'\n\n\nsubsubsection\\<open>Projection arrows are arrows in the category \\<open>Rel\\<close>\\<close>\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Rel_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\" and \"B \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vfst_arrow A B : A \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> A\"\nproof-\n  interpret Set_Par: wide_replete_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Par \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Set_cat_Par)\n  interpret Par_Rel: wide_replete_subcategory \\<alpha> \\<open>cat_Par \\<alpha>\\<close> \\<open>cat_Rel \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Par_cat_Rel)\n  interpret Set_Rel: subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Rel \\<alpha>\\<close> \n    by \n      ( \n        rule subcat_trans[\n          OF Set_Par.subcategory_axioms Par_Rel.subcategory_axioms\n          ]\n      )\n  from assms show ?thesis\n    unfolding cat_Rel_components(1)\n    by (intro Set_Rel.subcat_is_arrD vfst_arrow_is_cat_Set_arr_Vset) auto\nqed\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Rel_arr'[cat_Rel_par_set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = A \\<times>\\<^sub>\\<circ> B\"\n    and \"A' = A\"\n    and \"\\<CC>' = cat_Rel \\<alpha>\"\n  shows \"vfst_arrow A B : AB \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> A'\"\n  using assms(1-2) unfolding assms(3-5) by (rule vfst_arrow_is_cat_Rel_arr)\n\nlemmas [cat_Rel_par_set_cs_intros] = \\<Z>.vfst_arrow_is_cat_Rel_arr'\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Rel_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\" and \"B \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vsnd_arrow A B : A \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B\"\nproof-\n  interpret Set_Par: wide_replete_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Par \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Set_cat_Par)\n  interpret Par_Rel: wide_replete_subcategory \\<alpha> \\<open>cat_Par \\<alpha>\\<close> \\<open>cat_Rel \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Par_cat_Rel)\n  interpret Set_Rel: subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Rel \\<alpha>\\<close> \n    by \n      ( \n        rule subcat_trans[\n          OF Set_Par.subcategory_axioms Par_Rel.subcategory_axioms\n          ]\n      )\n  from assms show ?thesis\n    unfolding cat_Rel_components(1)\n    by (intro Set_Rel.subcat_is_arrD vsnd_arrow_is_cat_Set_arr_Vset) auto\nqed\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Rel_arr'[cat_Rel_par_set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = A \\<times>\\<^sub>\\<circ> B\"\n    and \"B' = B\"\n    and \"\\<CC>' = cat_Rel \\<alpha>\"\n  shows \"vsnd_arrow A B : AB \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> B'\"\n  using assms(1-2) unfolding assms(3-5) by (rule vsnd_arrow_is_cat_Rel_arr)\n\nlemmas [cat_Rel_par_set_cs_intros] = \\<Z>.vsnd_arrow_is_cat_Rel_arr'\n\n\nsubsubsection\\<open>Projection arrows are isomorphisms in the category \\<open>Set\\<close>\\<close>\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Set_iso_arr_Vset:\n  assumes \"A \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" and \"b \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"vfst_arrow A (set {b}) : A \\<times>\\<^sub>\\<circ> set {b} \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\nproof\n  (\n    intro \n      cat_Set_is_iso_arrI \n      arr_SetI \n      vfst_arrow_is_cat_Set_arr_Vset \n      assms,\n    unfold cat_cs_simps\n  )\n  show \"v11 (vfst_arrow A (set {b})\\<lparr>ArrVal\\<rparr>)\"\n  proof(rule vsv.vsv_valeq_v11I, unfold cat_cs_simps)\n    fix ab ab' assume prems:\n      \"ab \\<in>\\<^sub>\\<circ> A \\<times>\\<^sub>\\<circ> set {b}\"\n      \"ab' \\<in>\\<^sub>\\<circ> A \\<times>\\<^sub>\\<circ> set {b}\"\n      \"vfst_arrow A (set {b})\\<lparr>ArrVal\\<rparr>\\<lparr>ab\\<rparr> = vfst_arrow A (set {b})\\<lparr>ArrVal\\<rparr>\\<lparr>ab'\\<rparr>\"\n    from prems obtain a where ab_def: \"ab = \\<langle>a, b\\<rangle>\" and a: \"a \\<in>\\<^sub>\\<circ> A\" \n      by clarsimp\n    from prems obtain a' where ab'_def: \"ab' = \\<langle>a', b\\<rangle>\" and a': \"a' \\<in>\\<^sub>\\<circ> A\" \n      by clarsimp\n    from prems(3) a a' have \"a = a'\"\n      unfolding ab_def ab'_def\n      by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: V_cs_intros)\n    then show \"ab = ab'\"  unfolding ab_def ab'_def by simp\n  qed (cs_concl cs_shallow cs_intro: cat_cs_intros)\n  show \"\\<R>\\<^sub>\\<circ> (vfst_arrow A (set {b})\\<lparr>ArrVal\\<rparr>) = A\"\n  proof(intro vsubset_antisym)\n    show \"A \\<subseteq>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (vfst_arrow A (set {b})\\<lparr>ArrVal\\<rparr>)\"\n    proof(intro vsubsetI)\n      fix a assume a: \"a \\<in>\\<^sub>\\<circ> A\"\n      then have a_def: \"a = vfst_arrow A (set {b})\\<lparr>ArrVal\\<rparr>\\<lparr>\\<langle>a, b\\<rangle>\\<rparr>\"\n        by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: V_cs_intros)\n      from a assms show \"a \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (vfst_arrow A (set {b})\\<lparr>ArrVal\\<rparr>)\"\n        by (subst a_def, use nothing in \\<open>intro vsv.vsv_vimageI2\\<close>) \n          (auto simp: cat_cs_simps cat_cs_intros)\n    qed\n  qed (rule vfst_arrow_vrange)\nqed (use assms in auto)\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Set_iso_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" and \"b \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vfst_arrow A (set {b}) : A \\<times>\\<^sub>\\<circ> set {b} \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\n  using assms \n  unfolding cat_Set_components \n  by (rule vfst_arrow_is_cat_Set_iso_arr_Vset)\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Set_iso_arr'[cat_rel_par_Set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"b \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = A \\<times>\\<^sub>\\<circ> set {b}\"\n    and \"A' = A\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"vfst_arrow A (set {b}) : AB \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>'\\<^esub> A\"\n  using assms(1-2) \n  unfolding assms(3-5)\n  by (rule vfst_arrow_is_cat_Set_iso_arr)\n\nlemmas [cat_rel_par_Set_cs_intros] = \\<Z>.vfst_arrow_is_cat_Set_iso_arr'\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Set_iso_arr_Vset:\n  assumes \"a \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" and \"B \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"vsnd_arrow (set {a}) B : set {a} \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\nproof\n  (\n    intro \n      cat_Set_is_iso_arrI \n      arr_SetI \n      vsnd_arrow_is_cat_Set_arr_Vset \n      assms,\n    unfold cat_cs_simps\n  )\n  show \"v11 (vsnd_arrow (set {a}) B\\<lparr>ArrVal\\<rparr>)\"\n  proof(rule vsv.vsv_valeq_v11I, unfold cat_cs_simps)\n    fix ab ab' assume prems:\n      \"ab \\<in>\\<^sub>\\<circ> set {a} \\<times>\\<^sub>\\<circ> B\"\n      \"ab' \\<in>\\<^sub>\\<circ> set {a} \\<times>\\<^sub>\\<circ> B\"\n      \"vsnd_arrow (set {a}) B\\<lparr>ArrVal\\<rparr>\\<lparr>ab\\<rparr> = vsnd_arrow (set {a}) B\\<lparr>ArrVal\\<rparr>\\<lparr>ab'\\<rparr>\"\n    from prems obtain b where ab_def: \"ab = \\<langle>a, b\\<rangle>\" and b: \"b \\<in>\\<^sub>\\<circ> B\" \n      by clarsimp\n    from prems obtain b' where ab'_def: \"ab' = \\<langle>a, b'\\<rangle>\" and b': \"b' \\<in>\\<^sub>\\<circ> B\" \n      by clarsimp\n    from prems(3) b b' have \"b = b'\"\n      unfolding ab_def ab'_def\n      by (cs_prems cs_shallow cs_simp: cat_cs_simps cs_intro: V_cs_intros)\n    then show \"ab = ab'\"  unfolding ab_def ab'_def by simp\n  qed (cs_concl cs_shallow cs_intro: cat_cs_intros)\n  show \"\\<R>\\<^sub>\\<circ> (vsnd_arrow (set {a}) B\\<lparr>ArrVal\\<rparr>) = B\"\n  proof(intro vsubset_antisym)\n    show \"B \\<subseteq>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (vsnd_arrow (set {a}) B\\<lparr>ArrVal\\<rparr>)\"\n    proof(intro vsubsetI)\n      fix b assume b: \"b \\<in>\\<^sub>\\<circ> B\"\n      then have b_def: \"b = vsnd_arrow (set {a}) B\\<lparr>ArrVal\\<rparr>\\<lparr>\\<langle>a, b\\<rangle>\\<rparr>\"\n        by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: V_cs_intros)\n      from b assms show \"b \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (vsnd_arrow (set {a}) B\\<lparr>ArrVal\\<rparr>)\"\n        by (subst b_def, use nothing in \\<open>intro vsv.vsv_vimageI2\\<close>) \n          (auto simp: cat_cs_simps cat_cs_intros)\n    qed\n  qed (rule vsnd_arrow_vrange)\nqed (use assms in auto)\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Set_iso_arr:\n  assumes \"a \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" and \"B \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vsnd_arrow (set {a}) B : set {a} \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  using assms \n  unfolding cat_Set_components \n  by (rule vsnd_arrow_is_cat_Set_iso_arr_Vset)\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Set_iso_arr'[cat_rel_par_Set_cs_intros]:\n  assumes \"a \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = set {a} \\<times>\\<^sub>\\<circ> B\"\n    and \"A' = A\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"vsnd_arrow (set {a}) B : AB \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>'\\<^esub> B\"\n  using assms(1-2) \n  unfolding assms(3-5)\n  by (rule vsnd_arrow_is_cat_Set_iso_arr)\n\nlemmas [cat_rel_par_Set_cs_intros] = \\<Z>.vsnd_arrow_is_cat_Set_iso_arr'\n\n\nsubsubsection\\<open>Projection arrows are isomorphisms in the category \\<open>Par\\<close>\\<close>\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Par_iso_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\" and \"b \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vfst_arrow A (set {b}) : A \\<times>\\<^sub>\\<circ> set {b} \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Par \\<alpha>\\<^esub> A\"\nproof-\n  interpret Set_Par: wide_replete_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Par \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Set_cat_Par)\n  show \"vfst_arrow A (set {b}) : A \\<times>\\<^sub>\\<circ> set {b} \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Par \\<alpha>\\<^esub> A\"\n    by \n      (\n        rule Set_Par.wr_subcat_is_iso_arr_is_iso_arr\n          [\n            THEN iffD1, \n            OF vfst_arrow_is_cat_Set_iso_arr_Vset[\n              OF assms[unfolded cat_Par_components]\n              ]\n          ]\n      )\nqed\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Par_iso_arr'[cat_rel_Par_set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"b \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = A \\<times>\\<^sub>\\<circ> set {b}\"\n    and \"A' = A\"\n    and \"\\<CC>' = cat_Par \\<alpha>\"\n  shows \"vfst_arrow A (set {b}) : AB \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>'\\<^esub> A\"\n  using assms(1-2) \n  unfolding assms(3-5)\n  by (rule vfst_arrow_is_cat_Par_iso_arr)\n\nlemmas [cat_rel_Par_set_cs_intros] = \\<Z>.vfst_arrow_is_cat_Par_iso_arr'\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Par_iso_arr:\n  assumes \"a \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\" and \"B \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vsnd_arrow (set {a}) B : set {a} \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Par \\<alpha>\\<^esub> B\"\nproof-\n  interpret Set_Par: wide_replete_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Par \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Set_cat_Par)\n  show \"vsnd_arrow (set {a}) B : set {a} \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Par \\<alpha>\\<^esub> B\"\n    by \n      (\n        rule Set_Par.wr_subcat_is_iso_arr_is_iso_arr\n          [\n            THEN iffD1, \n            OF vsnd_arrow_is_cat_Set_iso_arr_Vset[\n              OF assms[unfolded cat_Par_components]\n              ]\n          ]\n      )\nqed\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Par_iso_arr'[cat_rel_Par_set_cs_intros]:\n  assumes \"a \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B \\<in>\\<^sub>\\<circ> cat_Par \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = set {a} \\<times>\\<^sub>\\<circ> B\"\n    and \"A' = A\"\n    and \"\\<CC>' = cat_Par \\<alpha>\"\n  shows \"vsnd_arrow (set {a}) B : AB \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>'\\<^esub> B\"\n  using assms(1-2) \n  unfolding assms(3-5)\n  by (rule vsnd_arrow_is_cat_Par_iso_arr)\n\nlemmas [cat_rel_Par_set_cs_intros] = \\<Z>.vsnd_arrow_is_cat_Par_iso_arr'\n\n\nsubsubsection\\<open>Projection arrows are isomorphisms in the category \\<open>Rel\\<close>\\<close>\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Rel_iso_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\" and \"b \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vfst_arrow A (set {b}) : A \\<times>\\<^sub>\\<circ> set {b} \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Rel \\<alpha>\\<^esub> A\"\nproof-\n  interpret Set_Par: wide_replete_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Par \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Set_cat_Par)\n  interpret Par_Rel: wide_replete_subcategory \\<alpha> \\<open>cat_Par \\<alpha>\\<close> \\<open>cat_Rel \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Par_cat_Rel)\n  interpret Set_Rel: wide_replete_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Rel \\<alpha>\\<close> \n    by \n      ( \n        rule wr_subcat_trans\n          [\n            OF \n              Set_Par.wide_replete_subcategory_axioms \n              Par_Rel.wide_replete_subcategory_axioms\n          ]\n      )\n  show ?thesis\n    by \n      (\n        rule Set_Rel.wr_subcat_is_iso_arr_is_iso_arr\n          [\n            THEN iffD1, \n            OF vfst_arrow_is_cat_Set_iso_arr_Vset[\n              OF assms[unfolded cat_Rel_components]\n              ]\n          ]\n      )\nqed\n\nlemma (in \\<Z>) vfst_arrow_is_cat_Rel_iso_arr'[cat_Rel_par_set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"b \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = A \\<times>\\<^sub>\\<circ> set {b}\"\n    and \"A' = A\"\n    and \"\\<CC>' = cat_Rel \\<alpha>\"\n  shows \"vfst_arrow A (set {b}) : AB \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>'\\<^esub> A\"\n  using assms(1-2) \n  unfolding assms(3-5)\n  by (rule vfst_arrow_is_cat_Rel_iso_arr)\n\nlemmas [cat_Rel_par_set_cs_intros] = \\<Z>.vfst_arrow_is_cat_Rel_iso_arr'\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Rel_iso_arr:\n  assumes \"a \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\" and \"B \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vsnd_arrow (set {a}) B : set {a} \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Rel \\<alpha>\\<^esub> B\"\nproof-\n  interpret Set_Par: wide_replete_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Par \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Set_cat_Par)\n  interpret Par_Rel: wide_replete_subcategory \\<alpha> \\<open>cat_Par \\<alpha>\\<close> \\<open>cat_Rel \\<alpha>\\<close> \n    by (rule wide_replete_subcategory_cat_Par_cat_Rel)\n  interpret Set_Rel: wide_replete_subcategory \\<alpha> \\<open>cat_Set \\<alpha>\\<close> \\<open>cat_Rel \\<alpha>\\<close> \n    by \n      ( \n        rule wr_subcat_trans\n          [\n            OF \n              Set_Par.wide_replete_subcategory_axioms \n              Par_Rel.wide_replete_subcategory_axioms\n          ]\n      )\n  show ?thesis\n    by \n      (\n        rule Set_Rel.wr_subcat_is_iso_arr_is_iso_arr\n          [\n            THEN iffD1, \n            OF vsnd_arrow_is_cat_Set_iso_arr_Vset[\n              OF assms[unfolded cat_Rel_components]\n              ]\n          ]\n      )\nqed\n\nlemma (in \\<Z>) vsnd_arrow_is_cat_Rel_iso_arr'[cat_Rel_par_set_cs_intros]:\n  assumes \"a \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"AB = set {a} \\<times>\\<^sub>\\<circ> B\"\n    and \"A' = A\"\n    and \"\\<CC>' = cat_Rel \\<alpha>\"\n  shows \"vsnd_arrow (set {a}) B : AB \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>'\\<^esub> B\"\n  using assms(1-2) \n  unfolding assms(3-5)\n  by (rule vsnd_arrow_is_cat_Rel_iso_arr)\n\nlemmas [cat_Rel_par_set_cs_intros] = \\<Z>.vsnd_arrow_is_cat_Rel_iso_arr'\n\n\n\nsubsection\\<open>Projection arrow for \\<open>vproduct\\<close>\\<close>\n\ndefinition vprojection_arrow :: \"V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V \\<Rightarrow> V\"\n  where \"vprojection_arrow I A i = [vprojection I A i, (\\<Prod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. A i), A i]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma vprojection_arrow_components:\n  shows \"vprojection_arrow I A i\\<lparr>ArrVal\\<rparr> = vprojection I A i\"\n    and \"vprojection_arrow I A i\\<lparr>ArrDom\\<rparr> = (\\<Prod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. A i)\"\n    and \"vprojection_arrow I A i\\<lparr>ArrCod\\<rparr> = A i\"\n  unfolding vprojection_arrow_def arr_field_simps\n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Projection arrow value\\<close>\n\nmk_VLambda vprojection_arrow_components(1)[unfolded vprojection_def]\n  |vsv vprojection_arrow_ArrVal_vsv[cat_Set_cs_intros]|\n  |vdomain vprojection_arrow_ArrVal_vdomain[cat_Set_cs_simps]|\n  |app vprojection_arrow_ArrVal_app[cat_Set_cs_simps]|\n\n\nsubsubsection\\<open>Projection arrow is an arrow in the category \\<open>Set\\<close>\\<close>\n\nlemma (in \\<Z>) arr_Set_vprojection_arrow:\n  assumes \"i \\<in>\\<^sub>\\<circ> I\" and \"VLambda I A \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"arr_Set \\<alpha> (vprojection_arrow I A i)\"\nproof(intro arr_SetI)\n  show \"vfsequence (vprojection_arrow I A i)\"\n    unfolding vprojection_arrow_def by auto\n  show \"vcard (vprojection_arrow I A i) = 3\\<^sub>\\<nat>\"\n    unfolding vprojection_arrow_def by (simp add: nat_omega_simps)\n  show \"vprojection_arrow I A i\\<lparr>ArrCod\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    unfolding vprojection_arrow_components\n  proof-\n    from assms(1) have \"i \\<in>\\<^sub>\\<circ> I\" by simp\n    then have \"A i \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (VLambda I A)\" by auto\n    moreover from assms(2) have \"\\<R>\\<^sub>\\<circ> (VLambda I A) \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n      by (meson vrange_in_VsetI)\n    ultimately show \"A i \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" by auto   \n  qed\nqed \n  (\n    auto \n      simp: vprojection_arrow_components \n      intro!: \n        assms \n        vprojection_vrange_vsubset \n        Limit_vproduct_in_Vset_if_VLambda_in_VsetI\n  )\n\nlemma (in \\<Z>) vprojection_arrow_is_arr:\n  assumes \"i \\<in>\\<^sub>\\<circ> I\" and \"VLambda I A \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"vprojection_arrow I A i : (\\<Prod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. A i) \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A i\"\nproof(intro cat_Set_is_arrI)\n  from assms show \"arr_Set \\<alpha> (vprojection_arrow I A i)\"\n    by (rule arr_Set_vprojection_arrow)\nqed (simp_all add: vprojection_arrow_components)\n\n\n\nsubsection\\<open>Canonical injection arrow for \\<open>vdunion\\<close>\\<close>\n\ndefinition vcinjection_arrow :: \"V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V \\<Rightarrow> V\"\n  where \"vcinjection_arrow I A i = [vcinjection A i, A i, (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. A i)]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma vcinjection_arrow_components:\n  shows \"vcinjection_arrow I A i\\<lparr>ArrVal\\<rparr> = vcinjection A i\"\n    and \"vcinjection_arrow I A i\\<lparr>ArrDom\\<rparr> = A i\"\n    and \"vcinjection_arrow I A i\\<lparr>ArrCod\\<rparr> = (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. A i)\"\n  unfolding vcinjection_arrow_def arr_field_simps\n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Canonical injection arrow value\\<close>\n\nmk_VLambda vcinjection_arrow_components(1)[unfolded vcinjection_def]\n  |vsv vcinjection_arrow_ArrVal_vsv[cat_Set_cs_intros]|\n  |vdomain vcinjection_arrow_ArrVal_vdomain[cat_Set_cs_simps]|\n  |app vcinjection_arrow_ArrVal_app[cat_Set_cs_simps]|\n\n\nsubsubsection\\<open>Canonical injection arrow is an arrow in the category \\<open>Set\\<close>\\<close>\n\nlemma (in \\<Z>) arr_Set_vcinjection_arrow:\n  assumes \"i \\<in>\\<^sub>\\<circ> I\" and \"VLambda I A \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"arr_Set \\<alpha> (vcinjection_arrow I A i)\"\nproof(intro arr_SetI)\n  show \"vfsequence (vcinjection_arrow I A i)\"\n    unfolding vcinjection_arrow_def by auto\n  show \"vcard (vcinjection_arrow I A i) = 3\\<^sub>\\<nat>\"\n    unfolding vcinjection_arrow_def by (simp add: nat_omega_simps)\n  show \"vcinjection_arrow I A i\\<lparr>ArrDom\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    unfolding vcinjection_arrow_components\n  proof-\n    from assms(1) have Ai_def: \"A i = VLambda I A\\<lparr>i\\<rparr>\" by simp\n    with assms(1) have \"A i \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (VLambda I A)\" by auto\n    with assms(2) Limit_\\<alpha> show \"A i \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n      unfolding Ai_def by (auto intro: vrange_in_VsetI)\n  qed\n  show \"vcinjection_arrow I A i\\<lparr>ArrCod\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    unfolding vcinjection_arrow_components\n    by (intro Limit_vdunion_in_Vset_if_VLambda_in_VsetI Limit_\\<alpha> assms)\nqed \n  (\n    auto \n      simp: vcinjection_arrow_components \n      intro!: assms vcinjection_vrange_vsubset \n  )\n\nlemma (in \\<Z>) vcinjection_arrow_is_arr:\n  assumes \"i \\<in>\\<^sub>\\<circ> I\" and \"VLambda I A \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  shows \"vcinjection_arrow I A i : A i \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. A i)\"\nproof(intro cat_Set_is_arrI)\n  from assms show \"arr_Set \\<alpha> (vcinjection_arrow I A i)\"\n    by (rule arr_Set_vcinjection_arrow)\nqed (simp_all add: vcinjection_arrow_components)\n\nlemma (in \\<Z>) vcinjection_arrow_is_arr'[cat_cs_intros]:\n  assumes \"i \\<in>\\<^sub>\\<circ> I\" \n    and \"VLambda I A \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and \"A' = A i\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n    and \"P' = (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. A i)\"\n  shows \"vcinjection_arrow I A i : A' \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> P'\"\n  using assms(1,2) unfolding assms(3-5) by (rule vcinjection_arrow_is_arr)\n\n\n\nsubsection\\<open>Product arrow value for \\<open>Rel\\<close>\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition prod_2_Rel_ArrVal :: \"V \\<Rightarrow> V \\<Rightarrow> V\" \n  where \"prod_2_Rel_ArrVal S T =\n    set {\\<langle>\\<langle>a, b\\<rangle>, \\<langle>c, d\\<rangle>\\<rangle> | a b c d. \\<langle>a, c\\<rangle> \\<in>\\<^sub>\\<circ> S \\<and> \\<langle>b, d\\<rangle> \\<in>\\<^sub>\\<circ> T}\"\n\nlemma small_prod_2_Rel_ArrVal[simp]:\n  \"small {\\<langle>\\<langle>a, b\\<rangle>, \\<langle>c, d\\<rangle>\\<rangle> | a b c d. \\<langle>a, c\\<rangle> \\<in>\\<^sub>\\<circ> S \\<and> \\<langle>b, d\\<rangle> \\<in>\\<^sub>\\<circ> T}\"\n  (is \\<open>small ?S\\<close>)\nproof(rule down)\n  show \"?S \\<subseteq> elts ((\\<D>\\<^sub>\\<circ> S \\<times>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> T) \\<times>\\<^sub>\\<circ> (\\<R>\\<^sub>\\<circ> S \\<times>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> T))\" by auto\nqed\n\n\ntext\\<open>Rules.\\<close>\n\nlemma prod_2_Rel_ArrValI:\n  assumes \"ab_cd = \\<langle>\\<langle>a, b\\<rangle>, \\<langle>c, d\\<rangle>\\<rangle>\"\n    and \"\\<langle>a, c\\<rangle> \\<in>\\<^sub>\\<circ> S\"\n    and \"\\<langle>b, d\\<rangle> \\<in>\\<^sub>\\<circ> T\"\n  shows \"ab_cd \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal S T\"\n  using assms unfolding prod_2_Rel_ArrVal_def by simp\n\nlemma prod_2_Rel_ArrValD[dest]:\n  assumes \"\\<langle>\\<langle>a, b\\<rangle>, \\<langle>c, d\\<rangle>\\<rangle> \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal S T\"\n  shows \"\\<langle>a, c\\<rangle> \\<in>\\<^sub>\\<circ> S\" and \"\\<langle>b, d\\<rangle> \\<in>\\<^sub>\\<circ> T\"\n  using assms unfolding prod_2_Rel_ArrVal_def by auto\n\nlemma prod_2_Rel_ArrValE[elim!]:\n  assumes \"ab_cd \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal S T\"\n  obtains a b c d where \"ab_cd = \\<langle>\\<langle>a, b\\<rangle>, \\<langle>c, d\\<rangle>\\<rangle>\" \n    and \"\\<langle>a, c\\<rangle> \\<in>\\<^sub>\\<circ> S\"\n    and \"\\<langle>b, d\\<rangle> \\<in>\\<^sub>\\<circ> T\"\n  using assms unfolding prod_2_Rel_ArrVal_def by auto\n\n\ntext\\<open>Elementary properties\\<close>\n\nlemma prod_2_Rel_ArrVal_vsubset_vprod:\n  \"prod_2_Rel_ArrVal S T \\<subseteq>\\<^sub>\\<circ> ((\\<D>\\<^sub>\\<circ> S \\<times>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> T) \\<times>\\<^sub>\\<circ> (\\<R>\\<^sub>\\<circ> S \\<times>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> T))\"\n  by (intro vsubsetI) auto\n\nlemma prod_2_Rel_ArrVal_vbrelation: \"vbrelation (prod_2_Rel_ArrVal S T)\"\n  using prod_2_Rel_ArrVal_vsubset_vprod by auto\n\nlemma prod_2_Rel_ArrVal_vdomain: \"\\<D>\\<^sub>\\<circ> (prod_2_Rel_ArrVal S T) = \\<D>\\<^sub>\\<circ> S \\<times>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> T\"\nproof(intro vsubset_antisym)\n  show \"\\<D>\\<^sub>\\<circ> S \\<times>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> T \\<subseteq>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (prod_2_Rel_ArrVal S T)\"\n  proof(intro vsubsetI)\n    fix ab assume \"ab \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> S \\<times>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> T\"\n    then obtain a b\n      where ab_def: \"ab = \\<langle>a, b\\<rangle>\" \n        and \"a \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> S\"\n        and \"b \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> T\"\n      by auto\n    then obtain c d where \"\\<langle>a, c\\<rangle> \\<in>\\<^sub>\\<circ> S\" and \"\\<langle>b, d\\<rangle> \\<in>\\<^sub>\\<circ> T\" by force\n    then have \"\\<langle>\\<langle>a, b\\<rangle>, \\<langle>c, d\\<rangle>\\<rangle> \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal S T\"\n      by (intro prod_2_Rel_ArrValI) auto\n    then show \"ab \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (prod_2_Rel_ArrVal S T)\"\n      unfolding ab_def by (simp add: app_vdomainI)\n  qed\nqed (use prod_2_Rel_ArrVal_vsubset_vprod in blast)\n\nlemma prod_2_Rel_ArrVal_vrange: \"\\<R>\\<^sub>\\<circ> (prod_2_Rel_ArrVal S T) = \\<R>\\<^sub>\\<circ> S \\<times>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> T\"\nproof(intro vsubset_antisym)\n  show \"\\<R>\\<^sub>\\<circ> S \\<times>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> T \\<subseteq>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (prod_2_Rel_ArrVal S T)\"\n  proof(intro vsubsetI)\n    fix cd assume \"cd \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> S \\<times>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> T\"\n    then obtain c d\n      where cd_def: \"cd = \\<langle>c, d\\<rangle>\" \n        and \"c \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> S\"\n        and \"d \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> T\"\n      by auto\n    then obtain a b where \"\\<langle>a, c\\<rangle> \\<in>\\<^sub>\\<circ> S\" and \"\\<langle>b, d\\<rangle> \\<in>\\<^sub>\\<circ> T\" by force\n    then have \"\\<langle>\\<langle>a, b\\<rangle>, \\<langle>c, d\\<rangle>\\<rangle> \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal S T\"\n      by (intro prod_2_Rel_ArrValI) auto\n    then show \"cd \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (prod_2_Rel_ArrVal S T)\"\n      unfolding cd_def by (simp add: app_vrangeI)\n  qed\nqed (use prod_2_Rel_ArrVal_vsubset_vprod in blast)\n\n\nsubsubsection\\<open>Further properties\\<close>\n\nlemma \n  assumes \"vsv g\" and \"vsv f\"\n  shows prod_2_Rel_ArrVal_vsv: \"vsv (prod_2_Rel_ArrVal g f)\"\n    and prod_2_Rel_ArrVal_app: \n      \"\\<And>a b. \\<lbrakk> a \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> g; b \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> f \\<rbrakk> \\<Longrightarrow> \n        prod_2_Rel_ArrVal g f\\<lparr>\\<langle>a,b\\<rangle>\\<rparr> = \\<langle>g\\<lparr>a\\<rparr>, f\\<lparr>b\\<rparr>\\<rangle>\"\nproof-\n  interpret g: vsv g by (rule assms(1))\n  interpret f: vsv f by (rule assms(2))\n  show vsv_gf: \"vsv (prod_2_Rel_ArrVal g f)\"\n    by (intro vsvI; (elim prod_2_Rel_ArrValE)?; (unfold prod_2_Rel_ArrVal_def)?)\n      (auto simp: g.vsv f.vsv)\n  fix a b assume \"a \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> g\" \"b \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> f\"\n  then have a_ga: \"\\<langle>a, g\\<lparr>a\\<rparr>\\<rangle> \\<in>\\<^sub>\\<circ> g\" and b_fb: \"\\<langle>b, f\\<lparr>b\\<rparr>\\<rangle> \\<in>\\<^sub>\\<circ> f\" by auto\n  from a_ga b_fb show \"prod_2_Rel_ArrVal g f\\<lparr>\\<langle>a, b\\<rangle>\\<rparr> = \\<langle>g\\<lparr>a\\<rparr>, f\\<lparr>b\\<rparr>\\<rangle>\"\n    by \n      (\n        cs_concl cs_shallow \n          cs_simp: vsv.vsv_appI[OF vsv_gf] cs_intro: prod_2_Rel_ArrValI\n      )\nqed\n\nlemma prod_2_Rel_ArrVal_v11:\n  assumes \"v11 g\" and \"v11 f\"\n  shows \"v11 (prod_2_Rel_ArrVal g f)\"\nproof-\n  interpret g: v11 g by (rule assms(1))\n  interpret f: v11 f by (rule assms(2))\n  show ?thesis\n  proof\n    (\n      intro vsv.vsv_valeq_v11I prod_2_Rel_ArrVal_vsv g.vsv_axioms f.vsv_axioms, \n      unfold prod_2_Rel_ArrVal_vdomain\n    )\n    fix ab cd\n    assume prems:\n      \"ab \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> g \\<times>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> f\"  \n      \"cd \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> g \\<times>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> f\"\n      \"prod_2_Rel_ArrVal g f\\<lparr>ab\\<rparr> = prod_2_Rel_ArrVal g f\\<lparr>cd\\<rparr>\"\n    from prems(1) obtain a b\n      where ab_def: \"ab = \\<langle>a, b\\<rangle>\" and a: \"a \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> g\" and b: \"b \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> f\"\n      by auto\n    from prems(2) obtain c d\n      where cd_def: \"cd = \\<langle>c, d\\<rangle>\" and c: \"c \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> g\" and d: \"d \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> f\"\n      by auto\n    from prems(3) a b c d have \"\\<langle>g\\<lparr>a\\<rparr>, f\\<lparr>b\\<rparr>\\<rangle> = \\<langle>g\\<lparr>c\\<rparr>, f\\<lparr>d\\<rparr>\\<rangle>\"\n      unfolding ab_def cd_def\n      by \n        (\n          cs_prems cs_shallow \n            cs_simp: prod_2_Rel_ArrVal_app cs_intro: V_cs_intros\n        )\n    then have \"g\\<lparr>a\\<rparr> = g\\<lparr>c\\<rparr>\" and \"f\\<lparr>b\\<rparr> = f\\<lparr>d\\<rparr>\" by simp_all\n    then show \"ab = cd\"\n      by (auto simp: ab_def cd_def a b c d f.v11_injective g.v11_injective)\n  qed\nqed\n\nlemma prod_2_Rel_ArrVal_vcomp:\n  \"prod_2_Rel_ArrVal S' T' \\<circ>\\<^sub>\\<circ> prod_2_Rel_ArrVal S T =\n    prod_2_Rel_ArrVal (S' \\<circ>\\<^sub>\\<circ> S) (T' \\<circ>\\<^sub>\\<circ> T)\"\nproof-\n  interpret ST': vbrelation \\<open>prod_2_Rel_ArrVal S' T'\\<close>\n    by (rule prod_2_Rel_ArrVal_vbrelation)\n  interpret ST: vbrelation \\<open>prod_2_Rel_ArrVal S T\\<close>\n    by (rule prod_2_Rel_ArrVal_vbrelation)\n  show ?thesis (*TODO: simplify proof*)\n  proof(intro vsubset_antisym vsubsetI)\n    fix aa'_cc' assume \n      \"aa'_cc' \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal S' T' \\<circ>\\<^sub>\\<circ> prod_2_Rel_ArrVal S T\"\n    then obtain aa' bb' cc' where ac_def: \"aa'_cc' = \\<langle>aa', cc'\\<rangle>\" \n      and bc: \"\\<langle>bb', cc'\\<rangle> \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal S' T'\"\n      and ab: \"\\<langle>aa', bb'\\<rangle> \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal S T\"\n      by (elim vcompE)\n    from bc obtain b b' c c' \n      where bb'_cc'_def: \"\\<langle>bb', cc'\\<rangle> = \\<langle>\\<langle>b, b'\\<rangle>, \\<langle>c, c'\\<rangle>\\<rangle>\"\n        and bc: \"\\<langle>b, c\\<rangle> \\<in>\\<^sub>\\<circ> S'\"\n        and bc': \"\\<langle>b', c'\\<rangle> \\<in>\\<^sub>\\<circ> T'\"\n      by auto\n    with ab obtain a a' \n      where aa'_bb'_def: \"\\<langle>aa', bb'\\<rangle> = \\<langle>\\<langle>a, a'\\<rangle>, \\<langle>b, b'\\<rangle>\\<rangle>\"\n        and ab: \"\\<langle>a, b\\<rangle> \\<in>\\<^sub>\\<circ> S\"\n        and ab': \"\\<langle>a', b'\\<rangle> \\<in>\\<^sub>\\<circ> T\"\n      by auto\n    from bb'_cc'_def have bb'_def: \"bb' = \\<langle>b, b'\\<rangle>\" and cc'_def: \"cc' = \\<langle>c, c'\\<rangle>\"\n      by simp_all\n    from aa'_bb'_def have aa'_def: \"aa' = \\<langle>a, a'\\<rangle>\" and bb'_def: \"bb' = \\<langle>b, b'\\<rangle>\"\n      by simp_all\n    from bc bc' ab ab' show \"aa'_cc' \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal (S' \\<circ>\\<^sub>\\<circ> S) (T' \\<circ>\\<^sub>\\<circ> T)\"\n      unfolding ac_def aa'_def cc'_def\n      by (intro prod_2_Rel_ArrValI)\n        (cs_concl cs_shallow cs_intro: prod_2_Rel_ArrValI vcompI)+\n  next\n    fix aa'_cc' assume \"aa'_cc' \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal (S' \\<circ>\\<^sub>\\<circ> S) (T' \\<circ>\\<^sub>\\<circ> T)\"\n    then obtain a a' c c'\n      where aa'_cc'_def: \"aa'_cc' = \\<langle>\\<langle>a, a'\\<rangle>, \\<langle>c, c'\\<rangle>\\<rangle>\"\n        and ac: \"\\<langle>a, c\\<rangle> \\<in>\\<^sub>\\<circ> S' \\<circ>\\<^sub>\\<circ> S\"\n        and ac': \"\\<langle>a', c'\\<rangle> \\<in>\\<^sub>\\<circ> T' \\<circ>\\<^sub>\\<circ> T\"\n      by blast\n    from ac obtain b where ab: \"\\<langle>a, b\\<rangle> \\<in>\\<^sub>\\<circ> S\" and bc: \"\\<langle>b, c\\<rangle> \\<in>\\<^sub>\\<circ> S'\" \n      by auto\n    from ac' obtain b' where ab': \"\\<langle>a', b'\\<rangle> \\<in>\\<^sub>\\<circ> T\" and bc': \"\\<langle>b', c'\\<rangle> \\<in>\\<^sub>\\<circ> T'\" \n      by auto\n    from ab bc ab' bc' show \n      \"aa'_cc' \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal S' T' \\<circ>\\<^sub>\\<circ> prod_2_Rel_ArrVal S T\"\n      unfolding aa'_cc'_def \n      by (cs_concl cs_shallow cs_intro: vcompI prod_2_Rel_ArrValI)\n  qed\nqed\n\nlemma prod_2_Rel_ArrVal_vid_on[cat_cs_simps]:\n  \"prod_2_Rel_ArrVal (vid_on A) (vid_on B) = vid_on (A \\<times>\\<^sub>\\<circ> B)\"\n  unfolding prod_2_Rel_ArrVal_def by auto\n\n\n\nsubsection\\<open>Product arrow for \\<open>Rel\\<close>\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition prod_2_Rel :: \"V \\<Rightarrow> V \\<Rightarrow> V\" (infixr \\<open>\\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l\\<close> 80)\n  where \"prod_2_Rel S T =\n    [\n      prod_2_Rel_ArrVal (S\\<lparr>ArrVal\\<rparr>) (T\\<lparr>ArrVal\\<rparr>),\n      S\\<lparr>ArrDom\\<rparr> \\<times>\\<^sub>\\<circ> T\\<lparr>ArrDom\\<rparr>,\n      S\\<lparr>ArrCod\\<rparr> \\<times>\\<^sub>\\<circ> T\\<lparr>ArrCod\\<rparr>\n    ]\\<^sub>\\<circ>\"\n\nabbreviation (input) prod_2_Par :: \"V \\<Rightarrow> V \\<Rightarrow> V\" (infixr \\<open>\\<^sub>A\\<times>\\<^sub>P\\<^sub>a\\<^sub>r\\<close> 80)\n  where \"prod_2_Par \\<equiv> prod_2_Rel\"\nabbreviation (input) prod_2_Set :: \"V \\<Rightarrow> V \\<Rightarrow> V\" (infixr \\<open>\\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t\\<close> 80)\n  where \"prod_2_Set \\<equiv> prod_2_Rel\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma prod_2_Rel_components: \n  shows \"(S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\\<lparr>ArrVal\\<rparr> = prod_2_Rel_ArrVal (S\\<lparr>ArrVal\\<rparr>) (T\\<lparr>ArrVal\\<rparr>)\"\n    and [cat_cs_simps]: \"(S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\\<lparr>ArrDom\\<rparr> = S\\<lparr>ArrDom\\<rparr> \\<times>\\<^sub>\\<circ> T\\<lparr>ArrDom\\<rparr>\"\n    and [cat_cs_simps]: \"(S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\\<lparr>ArrCod\\<rparr> = S\\<lparr>ArrCod\\<rparr> \\<times>\\<^sub>\\<circ> T\\<lparr>ArrCod\\<rparr>\"\n  unfolding prod_2_Rel_def arr_field_simps by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Product arrow for \\<open>Rel\\<close> is an arrow in \\<open>Rel\\<close>\\<close>\n\nlemma prod_2_Rel_is_cat_Rel_arr:\n  assumes \"S : A \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B\" and \"T : C \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> D\"    \n  shows \"S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T : A \\<times>\\<^sub>\\<circ> C \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B \\<times>\\<^sub>\\<circ> D\"\nproof-\n  note S = cat_Rel_is_arrD[OF assms(1)]\n  note T = cat_Rel_is_arrD[OF assms(2)]\n  interpret S: arr_Rel \\<alpha> S \n    rewrites [simp]: \"S\\<lparr>ArrDom\\<rparr> = A\" and [simp]: \"S\\<lparr>ArrCod\\<rparr> = B\"\n    by (simp_all add: S)\n  interpret T: arr_Rel \\<alpha> T \n    rewrites [simp]: \"T\\<lparr>ArrDom\\<rparr> = C\" and [simp]: \"T\\<lparr>ArrCod\\<rparr> = D\"\n    by (simp_all add: T)\n  show ?thesis\n  proof(intro cat_Rel_is_arrI arr_RelI)\n    show \"vfsequence (S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\"\n      unfolding prod_2_Rel_def by simp\n    show \"vcard (S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T) = 3\\<^sub>\\<nat>\"\n      unfolding prod_2_Rel_def by (simp add: nat_omega_simps)\n    from S have \"\\<D>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> A\" and \"\\<R>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> B\" by auto\n    moreover from T have \"\\<D>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> C\" and \"\\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> D\" \n      by auto\n    ultimately have \n      \"\\<D>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>) \\<times>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> A \\<times>\\<^sub>\\<circ> C\"\n      \"\\<R>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>) \\<times>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> B \\<times>\\<^sub>\\<circ> D\"\n      by auto\n    then show \n      \"\\<D>\\<^sub>\\<circ> ((S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> (S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\\<lparr>ArrDom\\<rparr>\"\n      \"\\<R>\\<^sub>\\<circ> ((S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> (S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\\<lparr>ArrCod\\<rparr>\"\n      unfolding \n        prod_2_Rel_components prod_2_Rel_ArrVal_vdomain prod_2_Rel_ArrVal_vrange\n      by (force simp: prod_2_Rel_components)+\n    from \n      S.arr_Rel_ArrDom_in_Vset T.arr_Rel_ArrDom_in_Vset\n      S.arr_Rel_ArrCod_in_Vset T.arr_Rel_ArrCod_in_Vset\n    show \"(S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\\<lparr>ArrDom\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \"(S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\\<lparr>ArrCod\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n      unfolding prod_2_Rel_components \n      by (all\\<open>intro Limit_vtimes_in_VsetI\\<close>) auto\n  qed (auto simp: prod_2_Rel_components intro: prod_2_Rel_ArrVal_vbrelation)\nqed\n\nlemma prod_2_Rel_is_cat_Rel_arr'[cat_Rel_par_set_cs_intros]:\n  assumes \"S : A \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B\"\n    and \"T : C \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> D\"\n    and \"A' = A \\<times>\\<^sub>\\<circ> C\"\n    and \"B' = B \\<times>\\<^sub>\\<circ> D\"\n    and \"\\<CC>' = cat_Rel \\<alpha>\"\n  shows \"S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T : A' \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> B'\"\n  using assms(1,2) unfolding assms(3-5) by (rule prod_2_Rel_is_cat_Rel_arr)\n\n\nsubsubsection\\<open>Product arrow for \\<open>Rel\\<close> is an arrow in \\<open>Set\\<close>\\<close>\n\nlemma prod_2_Rel_app[cat_rel_par_Set_cs_simps]:\n  assumes \"S : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n    and \"T : C \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> D\"    \n    and \"a \\<in>\\<^sub>\\<circ> A\"\n    and \"c \\<in>\\<^sub>\\<circ> C\"\n    and \"ac = \\<langle>a, c\\<rangle>\"\n  shows \"(S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T)\\<lparr>ArrVal\\<rparr>\\<lparr>ac\\<rparr> = \\<langle>S\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>, T\\<lparr>ArrVal\\<rparr>\\<lparr>c\\<rparr>\\<rangle>\"\nproof-\n  note S = cat_Set_is_arrD[OF assms(1)]\n  note T = cat_Set_is_arrD[OF assms(2)]\n  interpret S: arr_Set \\<alpha> S \n    rewrites [simp]: \"S\\<lparr>ArrDom\\<rparr> = A\" and [simp]: \"S\\<lparr>ArrCod\\<rparr> = B\"\n    by (simp_all add: S)\n  interpret T: arr_Set \\<alpha> T \n    rewrites [simp]: \"T\\<lparr>ArrDom\\<rparr> = C\" and [simp]: \"T\\<lparr>ArrCod\\<rparr> = D\"\n    by (simp_all add: T)\n  from assms(3,4) show ?thesis\n    unfolding prod_2_Rel_components(1) assms(5)\n    by \n      (\n        cs_concl cs_shallow\n          cs_simp: \n            S.arr_Set_ArrVal_vdomain \n            T.arr_Set_ArrVal_vdomain \n            prod_2_Rel_ArrVal_app \n          cs_intro: V_cs_intros\n      )\nqed\n\nlemma prod_2_Rel_is_cat_Set_arr:\n  assumes \"S : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"T : C \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> D\"    \n  shows \"S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T : A \\<times>\\<^sub>\\<circ> C \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B \\<times>\\<^sub>\\<circ> D\"\nproof-\n\n  note S = cat_Set_is_arrD[OF assms(1)]\n  note T = cat_Set_is_arrD[OF assms(2)]\n\n  interpret S: arr_Set \\<alpha> S \n    rewrites [simp]: \"S\\<lparr>ArrDom\\<rparr> = A\" and [simp]: \"S\\<lparr>ArrCod\\<rparr> = B\"\n    by (simp_all add: S)\n  interpret T: arr_Set \\<alpha> T \n    rewrites [simp]: \"T\\<lparr>ArrDom\\<rparr> = C\" and [simp]: \"T\\<lparr>ArrCod\\<rparr> = D\"\n    by (simp_all add: T)\n\n  show ?thesis\n  proof(intro cat_Set_is_arrI arr_SetI)\n    show \"vfsequence (S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T)\"\n      unfolding prod_2_Rel_def by simp\n    show \"vcard (S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T) = 3\\<^sub>\\<nat>\"\n      unfolding prod_2_Rel_def by (simp add: nat_omega_simps)\n    from S.arr_Set_ArrVal_vrange T.arr_Set_ArrVal_vrange show \n      \"\\<R>\\<^sub>\\<circ> ((S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T)\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> (S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T)\\<lparr>ArrCod\\<rparr>\"\n      unfolding \n        prod_2_Rel_components prod_2_Rel_ArrVal_vdomain prod_2_Rel_ArrVal_vrange\n      by auto\n    from assms S.arr_Par_ArrDom_in_Vset T.arr_Par_ArrDom_in_Vset show \n      \"(S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T)\\<lparr>ArrDom\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n      by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: V_cs_intros)\n    from assms S.arr_Par_ArrCod_in_Vset T.arr_Par_ArrCod_in_Vset show \n      \"(S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T)\\<lparr>ArrCod\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n      by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: V_cs_intros)\n    from assms show \"(S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T)\\<lparr>ArrDom\\<rparr> = A \\<times>\\<^sub>\\<circ> C\"\n      by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n    from assms show \"(S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T)\\<lparr>ArrCod\\<rparr> = B \\<times>\\<^sub>\\<circ> D\"\n      by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n    show \"vsv ((S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T)\\<lparr>ArrVal\\<rparr>)\"\n      unfolding prod_2_Rel_components\n      by (intro prod_2_Rel_ArrVal_vsv S.ArrVal.vsv_axioms T.ArrVal.vsv_axioms)\n  qed \n    (\n      auto simp: \n        cat_cs_simps cat_Set_cs_simps \n        prod_2_Rel_ArrVal_vdomain prod_2_Rel_components(1)\n    )\n\nqed\n\nlemma prod_2_Rel_is_cat_Set_arr'[cat_rel_par_Set_cs_intros]:\n  assumes \"S : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n    and \"T : C \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> D\"\n    and \"AC = A \\<times>\\<^sub>\\<circ> C\"\n    and \"BD = B \\<times>\\<^sub>\\<circ> D\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T : AC \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> BD\"\n  using assms(1,2) unfolding assms(3-5) by (rule prod_2_Rel_is_cat_Set_arr)\n\n\nsubsubsection\\<open>Product arrow for \\<open>Rel\\<close> is an isomorphism in \\<open>Set\\<close>\\<close>\n\nlemma prod_2_Rel_is_cat_Set_iso_arr:\n  assumes \"S : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"T : C \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> D\"    \n  shows \"S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T : A \\<times>\\<^sub>\\<circ> C \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B \\<times>\\<^sub>\\<circ> D\"\nproof-\n  note S = cat_Set_is_iso_arrD[OF assms(1)]\n  note T = cat_Set_is_iso_arrD[OF assms(2)]\n  show ?thesis\n  proof\n    (\n      intro cat_Set_is_iso_arrI prod_2_Rel_is_cat_Set_arr[OF S(1) T(1)], \n      unfold prod_2_Rel_components\n    )\n    show \"\\<D>\\<^sub>\\<circ> (prod_2_Rel_ArrVal (S\\<lparr>ArrVal\\<rparr>) (T\\<lparr>ArrVal\\<rparr>)) = A \\<times>\\<^sub>\\<circ> C\"\n      unfolding prod_2_Rel_ArrVal_vdomain\n      by (cs_concl cs_shallow cs_simp: S(3) T(3) cs_intro: cat_cs_intros)\n    show \"\\<R>\\<^sub>\\<circ> (prod_2_Rel_ArrVal (S\\<lparr>ArrVal\\<rparr>) (T\\<lparr>ArrVal\\<rparr>)) = B \\<times>\\<^sub>\\<circ> D\"\n      unfolding prod_2_Rel_ArrVal_vrange\n      by (cs_concl cs_shallow cs_simp: S(4) T(4) cs_intro: cat_cs_intros)\n  qed (use S(2) T(2) in \\<open>cs_concl cs_shallow cs_intro: prod_2_Rel_ArrVal_v11\\<close>)\nqed\n\nlemma prod_2_Rel_is_cat_Set_iso_arr'[cat_rel_par_Set_cs_intros]:\n  assumes \"S : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n    and \"T : C \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> D\"    \n    and \"AC = A \\<times>\\<^sub>\\<circ> C\"\n    and \"BD = B \\<times>\\<^sub>\\<circ> D\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"S \\<^sub>A\\<times>\\<^sub>S\\<^sub>e\\<^sub>t T : AC \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>'\\<^esub> BD\"\n  using assms(1,2) \n  unfolding assms(3-5) \n  by (rule prod_2_Rel_is_cat_Set_iso_arr)\n\n\nsubsubsection\\<open>Further elementary properties\\<close>\n\nlemma prod_2_Rel_Comp:\n  assumes \"G' : B' \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B''\" \n    and \"F' : A' \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> A''\" \n    and \"G : B \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B'\"\n    and \"F : A \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> A'\"\n  shows\n    \"G' \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F =\n      (G' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> F)\"\nproof-\n\n  from cat_Rel_is_arrD(1)[OF assms(1)] interpret \\<Z> \\<alpha> by auto\n\n  interpret Rel: category \\<alpha> \\<open>cat_Rel \\<alpha>\\<close> by (rule category_cat_Rel)\n  note (*prefer cat_Rel*)[cat_cs_simps] = cat_Rel_is_arrD(2,3)\n\n  from assms have GF'_GF: \n    \"G' \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F :\n      B \\<times>\\<^sub>\\<circ> A \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B'' \\<times>\\<^sub>\\<circ> A''\"\n    by (cs_concl cs_shallow cs_intro: cat_Rel_par_set_cs_intros cat_cs_intros)\n  from assms Rel.category_axioms have GG'_FF':\n    \"(G' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> F) : \n      B \\<times>\\<^sub>\\<circ> A \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B'' \\<times>\\<^sub>\\<circ> A''\"\n    by (cs_concl cs_shallow cs_intro: cat_Rel_par_set_cs_intros cat_cs_intros)\n\n  show ?thesis\n  proof(rule arr_Rel_eqI[of \\<alpha>])\n    from GF'_GF show arr_Rel_GF'_GF:\n      \"arr_Rel \\<alpha> (G' \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F)\"\n      by (auto dest: cat_Rel_is_arrD(1))\n    from GG'_FF' show arr_Rel_GG'_FF':\n      \"arr_Rel \\<alpha> ((G' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> F))\"\n      by (auto dest: cat_Rel_is_arrD(1))\n    show \"(G' \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F)\\<lparr>ArrVal\\<rparr> = \n      ((G' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> F))\\<lparr>ArrVal\\<rparr>\"\n    proof(intro vsubset_antisym vsubsetI)\n      fix R assume\n        \"R \\<in>\\<^sub>\\<circ> (G' \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F)\\<lparr>ArrVal\\<rparr>\"\n      from this assms have \"R \\<in>\\<^sub>\\<circ>\n        prod_2_Rel_ArrVal (G'\\<lparr>ArrVal\\<rparr>) (F'\\<lparr>ArrVal\\<rparr>) \\<circ>\\<^sub>\\<circ>\n        prod_2_Rel_ArrVal (G\\<lparr>ArrVal\\<rparr>) (F\\<lparr>ArrVal\\<rparr>)\"\n        by \n          (\n            cs_prems cs_shallow\n              cs_simp: \n                prod_2_Rel_components(1) \n                comp_Rel_components(1)\n                cat_Rel_cs_simps \n              cs_intro: cat_Rel_par_set_cs_intros\n          )\n      from this[unfolded prod_2_Rel_ArrVal_vcomp] assms show \n        \"R \\<in>\\<^sub>\\<circ> ((G' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> F))\\<lparr>ArrVal\\<rparr>\"\n        by \n          (\n            cs_concl cs_shallow cs_simp: \n              prod_2_Rel_components comp_Rel_components(1) cat_Rel_cs_simps \n          )\n    next\n      fix R assume\n        \"R \\<in>\\<^sub>\\<circ> ((G' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> G) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (F' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> F))\\<lparr>ArrVal\\<rparr>\"\n      from this assms have \n        \"R \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal (G'\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> G\\<lparr>ArrVal\\<rparr>) (F'\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> F\\<lparr>ArrVal\\<rparr>)\"\n        by \n          (\n            cs_prems cs_shallow cs_simp:\n              comp_Rel_components prod_2_Rel_components cat_Rel_cs_simps\n          )\n      from this[folded prod_2_Rel_ArrVal_vcomp] assms show\n        \"R \\<in>\\<^sub>\\<circ> ((G' \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F') \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub> (G \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F))\\<lparr>ArrVal\\<rparr>\"\n        by\n          (\n            cs_concl cs_shallow\n              cs_simp:\n                prod_2_Rel_components comp_Rel_components(1) cat_Rel_cs_simps \n              cs_intro: cat_Rel_par_set_cs_intros\n          )\n    qed\n\n  qed\n    (\n      use GF'_GF assms in (*slow*)\n        \\<open>\n          cs_concl \n            cs_simp: cat_cs_simps\n            cs_intro: cat_cs_intros cat_Rel_cs_intros\n        \\<close>\n    )+\n\nqed\n\nlemma (in \\<Z>) prod_2_Rel_CId[cat_cs_simps]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\" and \"B \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \n    \"(cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>B\\<rparr>) = cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A \\<times>\\<^sub>\\<circ> B\\<rparr>\"\nproof-\n  interpret Rel: category \\<alpha> \\<open>cat_Rel \\<alpha>\\<close> by (rule category_cat_Rel)\n  from assms have A_B: \n    \"(cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>B\\<rparr>) :\n      A \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> A \\<times>\\<^sub>\\<circ> B\"\n    by (cs_concl cs_intro: cat_Rel_par_set_cs_intros cat_cs_intros)\n  from assms Rel.category_axioms have AB:\n    \"cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A \\<times>\\<^sub>\\<circ> B\\<rparr> : A \\<times>\\<^sub>\\<circ> B \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> A \\<times>\\<^sub>\\<circ> B\"\n    by \n      (\n        cs_concl  \n          cs_simp: cat_Rel_components(1) cs_intro: V_cs_intros cat_cs_intros\n      )\n  show ?thesis\n  proof(rule arr_Rel_eqI)\n    from A_B show arr_Rel_GF'_GF:\n      \"arr_Rel \\<alpha> ((cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>B\\<rparr>))\"\n      by (auto dest: cat_Rel_is_arrD(1))\n    from AB show arr_Rel_GG'_FF': \"arr_Rel \\<alpha> (cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A \\<times>\\<^sub>\\<circ> B\\<rparr>)\"\n      by (auto dest: cat_Rel_is_arrD(1))\n    from assms show \n      \"((cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>B\\<rparr>))\\<lparr>ArrVal\\<rparr> =\n        cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A \\<times>\\<^sub>\\<circ> B\\<rparr>\\<lparr>ArrVal\\<rparr>\"\n      by\n        (\n          cs_concl \n            cs_simp:\n              id_Rel_components prod_2_Rel_components\n              cat_cs_simps cat_Rel_cs_simps \n            cs_intro: V_cs_intros  cat_cs_intros \n        )\n  qed \n    (\n      use A_B assms in \n        \\<open>\n          cs_concl \n            cs_simp: prod_2_Rel_components cat_Rel_cs_simps \n            cs_intro: cat_cs_intros \n        \\<close>\n    )+\nqed\n\nlemma cf_dag_Rel_ArrMap_app_prod_2_Rel:\n  assumes \"S : A \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B\" and \"T : C \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> D\"\n  shows\n    \"\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T\\<rparr> =\n      (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr>)\"\nproof-\n\n  interpret S: arr_Rel \\<alpha> S by (intro cat_Rel_is_arrD[OF assms(1)])\n  interpret Rel: category \\<alpha> \\<open>cat_Rel \\<alpha>\\<close> by (rule S.category_cat_Rel)\n  interpret dag_Rel: is_iso_functor \\<alpha> \\<open>op_cat (cat_Rel \\<alpha>)\\<close> \\<open>cat_Rel \\<alpha>\\<close> \\<open>\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<close>\n    by (rule S.cf_dag_Rel_is_iso_functor)\n\n  note ST = prod_2_Rel_is_cat_Rel_arr[OF assms]\n\n  from assms have dag_S: \"\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr> : B \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> A\"\n    and dag_T: \"\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr> : D \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> C\"\n    by\n      (\n        cs_concl \n          cs_simp: cat_Rel_cs_simps cat_op_simps cs_intro: cat_cs_intros \n      )+\n  from assms have dag_prod:\n    \"\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T\\<rparr> : B \\<times>\\<^sub>\\<circ> D \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> A \\<times>\\<^sub>\\<circ> C\"\n    by\n      (\n        cs_concl \n          cs_simp: cat_Rel_cs_simps cat_op_simps \n          cs_intro: V_cs_intros cat_cs_intros cat_Rel_par_set_cs_intros \n      )\n  from dag_S dag_T have prod_dag:\n    \"(\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr>) :\n      B \\<times>\\<^sub>\\<circ> D \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> A \\<times>\\<^sub>\\<circ> C\" \n    by (cs_concl cs_shallow cs_intro: cat_Rel_par_set_cs_intros)\n\n  note [cat_cs_simps] = \n    prod_2_Rel_ArrVal_vdomain prod_2_Rel_ArrVal_vrange prod_2_Rel_components\n  from dag_prod ST have [cat_cs_simps]:\n    \"\\<D>\\<^sub>\\<circ> (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T\\<rparr>\\<lparr>ArrVal\\<rparr>) = \\<R>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>) \\<times>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>)\"\n    \"\\<R>\\<^sub>\\<circ> (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T\\<rparr>\\<lparr>ArrVal\\<rparr>) = \\<D>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>) \\<times>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>)\"\n    by (cs_concl cs_simp: cat_cs_simps)+\n\n show\n    \"\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T\\<rparr> =\n      (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr>)\"\n  proof(rule arr_Rel_eqI)\n    from dag_prod show arr_Rel_dag_prod: \n      \"arr_Rel \\<alpha> (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T\\<rparr>)\"\n      by (auto dest: cat_Rel_is_arrD)\n    then interpret dag_prod: arr_Rel \\<alpha> \\<open>\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T\\<rparr>\\<close> by simp\n    from prod_dag show arr_Rel_prod_dag:\n      \"arr_Rel \\<alpha> ((\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr>))\"\n      by (auto dest: cat_Rel_is_arrD)\n    then interpret prod_dag: \n      arr_Rel \\<alpha> \\<open>(\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr>)\\<close> \n      by simp\n    from ST have arr_Rel_ST: \"arr_Rel \\<alpha> (S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T)\" \n      by (auto dest: cat_Rel_is_arrD)\n    show\n      \"\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T\\<rparr>\\<lparr>ArrVal\\<rparr> =\n        ((\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr>))\\<lparr>ArrVal\\<rparr>\"\n    proof(intro vsubset_antisym vsubsetI)\n      fix bd_ac assume prems: \"bd_ac \\<in>\\<^sub>\\<circ> \\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T\\<rparr>\\<lparr>ArrVal\\<rparr>\"\n      then obtain bd ac \n        where bd_ac_def: \"bd_ac = \\<langle>bd, ac\\<rangle>\" \n          and bd: \"bd \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>) \\<times>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>)\" \n          and ac: \"ac \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (S\\<lparr>ArrVal\\<rparr>) \\<times>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (T\\<lparr>ArrVal\\<rparr>)\"\n        by (elim cat_Rel_is_arr_ArrValE[OF dag_prod prems, unfolded cat_cs_simps])\n      have \"\\<langle>ac, bd\\<rangle> \\<in>\\<^sub>\\<circ> prod_2_Rel_ArrVal (S\\<lparr>ArrVal\\<rparr>) (T\\<lparr>ArrVal\\<rparr>)\"\n        by \n          (\n            rule prems[\n              unfolded\n                bd_ac_def\n                cf_dag_Rel_ArrMap_app_iff[OF ST] \n                prod_2_Rel_components\n              ]\n          )\n      then obtain a b c d \n        where ab: \"\\<langle>a, b\\<rangle> \\<in>\\<^sub>\\<circ> S\\<lparr>ArrVal\\<rparr>\"\n          and cd: \"\\<langle>c, d\\<rangle> \\<in>\\<^sub>\\<circ> T\\<lparr>ArrVal\\<rparr>\"\n          and bd_def: \"bd = \\<langle>b, d\\<rangle>\" \n          and ac_def: \"ac = \\<langle>a, c\\<rangle>\"\n        by auto\n      show \"bd_ac \\<in>\\<^sub>\\<circ> ((\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr>))\\<lparr>ArrVal\\<rparr>\"\n        unfolding prod_2_Rel_components\n      proof(intro prod_2_Rel_ArrValI)\n        show \"bd_ac = \\<langle>\\<langle>b, d\\<rangle>, \\<langle>a, c\\<rangle>\\<rangle>\" unfolding bd_ac_def bd_def ac_def by simp\n        from assms ab cd show \n          \"\\<langle>b, a\\<rangle> \\<in>\\<^sub>\\<circ> \\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr>\\<lparr>ArrVal\\<rparr>\"\n          \"\\<langle>d, c\\<rangle> \\<in>\\<^sub>\\<circ> \\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr>\\<lparr>ArrVal\\<rparr>\"\n          by (cs_concl cs_shallow cs_simp: cat_cs_simps)+\n      qed\n    next\n      fix bd_ac assume prems:\n        \"bd_ac \\<in>\\<^sub>\\<circ> ((\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (\\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr>))\\<lparr>ArrVal\\<rparr>\"\n      then obtain a b c d \n        where bd_ac_def: \"bd_ac = \\<langle>\\<langle>b, d\\<rangle>, a, c\\<rangle>\"\n          and ba: \"\\<langle>b, a\\<rangle> \\<in>\\<^sub>\\<circ> \\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S\\<rparr>\\<lparr>ArrVal\\<rparr>\"\n          and dc: \"\\<langle>d, c\\<rangle> \\<in>\\<^sub>\\<circ> \\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>T\\<rparr>\\<lparr>ArrVal\\<rparr>\"\n        by (elim prod_2_Rel_ArrValE[OF prems[unfolded prod_2_Rel_components]])\n      then have ab: \"\\<langle>a, b\\<rangle> \\<in>\\<^sub>\\<circ> S\\<lparr>ArrVal\\<rparr>\" and cd: \"\\<langle>c, d\\<rangle> \\<in>\\<^sub>\\<circ> T\\<lparr>ArrVal\\<rparr>\"\n        unfolding assms[THEN cf_dag_Rel_ArrMap_app_iff] by simp_all\n      from ST ab cd show \"bd_ac \\<in>\\<^sub>\\<circ> \\<dagger>\\<^sub>C\\<^sub>.\\<^sub>R\\<^sub>e\\<^sub>l \\<alpha>\\<lparr>ArrMap\\<rparr>\\<lparr>S \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l T\\<rparr>\\<lparr>ArrVal\\<rparr>\"\n        unfolding bd_ac_def \n        by\n          (\n            cs_concl cs_shallow\n              cs_simp: prod_2_Rel_components cat_cs_simps \n              cs_intro: prod_2_Rel_ArrValI cat_cs_intros \n          )\n    qed\n  qed (use dag_prod prod_dag in \\<open>cs_concl cs_simp: cat_cs_simps\\<close>)+\n\nqed\n\n\n\nsubsection\\<open>Product functor for \\<open>Rel\\<close>\\<close>\n\ndefinition cf_prod_2_Rel :: \"V \\<Rightarrow> V\"\n  where \"cf_prod_2_Rel \\<AA> =\n    [\n      (\\<lambda>AB\\<in>\\<^sub>\\<circ>(\\<AA> \\<times>\\<^sub>C \\<AA>)\\<lparr>Obj\\<rparr>. AB\\<lparr>0\\<rparr> \\<times>\\<^sub>\\<circ> AB\\<lparr>1\\<^sub>\\<nat>\\<rparr>),\n      (\\<lambda>ST\\<in>\\<^sub>\\<circ>(\\<AA> \\<times>\\<^sub>C \\<AA>)\\<lparr>Arr\\<rparr>. (ST\\<lparr>0\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (ST\\<lparr>1\\<^sub>\\<nat>\\<rparr>)),\n      \\<AA> \\<times>\\<^sub>C \\<AA>,\n      \\<AA>\n    ]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma cf_prod_2_Rel_components: \n  shows \"cf_prod_2_Rel \\<AA>\\<lparr>ObjMap\\<rparr> = (\\<lambda>AB\\<in>\\<^sub>\\<circ>(\\<AA> \\<times>\\<^sub>C \\<AA>)\\<lparr>Obj\\<rparr>. AB\\<lparr>0\\<rparr> \\<times>\\<^sub>\\<circ> AB\\<lparr>1\\<^sub>\\<nat>\\<rparr>)\"\n    and \"cf_prod_2_Rel \\<AA>\\<lparr>ArrMap\\<rparr> =\n      (\\<lambda>ST\\<in>\\<^sub>\\<circ>(\\<AA> \\<times>\\<^sub>C \\<AA>)\\<lparr>Arr\\<rparr>. (ST\\<lparr>0\\<rparr>) \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l (ST\\<lparr>1\\<^sub>\\<nat>\\<rparr>))\"\n    and [cat_cs_simps]: \"cf_prod_2_Rel \\<AA>\\<lparr>HomDom\\<rparr> = \\<AA> \\<times>\\<^sub>C \\<AA>\"\n    and [cat_cs_simps]: \"cf_prod_2_Rel \\<AA>\\<lparr>HomCod\\<rparr> = \\<AA>\"\n  unfolding cf_prod_2_Rel_def dghm_field_simps by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Object map\\<close>\n\nmk_VLambda cf_prod_2_Rel_components(1)\n  |vsv cf_prod_2_Rel_ObjMap_vsv[cat_cs_intros]|\n  |vdomain cf_prod_2_Rel_ObjMap_vdomain[cat_cs_simps]|\n\nlemma cf_prod_2_Rel_ObjMap_app[cat_cs_simps]: \n  assumes \"AB = [A, B]\\<^sub>\\<circ>\" and \"AB \\<in>\\<^sub>\\<circ> (\\<AA> \\<times>\\<^sub>C \\<AA>)\\<lparr>Obj\\<rparr>\"\n  shows \"A \\<otimes>\\<^sub>H\\<^sub>M\\<^sub>.\\<^sub>O\\<^bsub>cf_prod_2_Rel \\<AA>\\<^esub> B = A \\<times>\\<^sub>\\<circ> B\"\n  using assms(2) \n  unfolding assms(1) cf_prod_2_Rel_components \n  by (simp add: nat_omega_simps)\n\nlemma (in \\<Z>) cf_prod_2_Rel_ObjMap_vrange: \n  \"\\<R>\\<^sub>\\<circ> (cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ObjMap\\<rparr>) \\<subseteq>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\nproof-\n  interpret Rel: category \\<alpha> \\<open>cat_Rel \\<alpha>\\<close>\n    by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_Rel_cs_intros)\n  show ?thesis\n  proof(rule vsv.vsv_vrange_vsubset, unfold cat_cs_simps)\n    fix AB assume prems: \"AB \\<in>\\<^sub>\\<circ> (cat_Rel \\<alpha> \\<times>\\<^sub>C cat_Rel \\<alpha>)\\<lparr>Obj\\<rparr>\"\n    with Rel.category_axioms obtain A B where AB_def: \"AB = [A, B]\\<^sub>\\<circ>\"\n      and A: \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n      and B: \"B \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n      by (elim cat_prod_2_ObjE[rotated 2])\n    from prems A B show \"cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ObjMap\\<rparr>\\<lparr>AB\\<rparr> \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n      unfolding AB_def cat_Rel_components(1)\n      by \n        (\n          cs_concl cs_shallow \n            cs_simp: cat_cs_simps cat_Rel_cs_simps cs_intro: V_cs_intros\n        )\n  qed (cs_concl cs_shallow cs_intro: cat_cs_intros)\nqed\n\n\nsubsubsection\\<open>Arrow map\\<close>\n\nmk_VLambda cf_prod_2_Rel_components(2)\n  |vsv cf_prod_2_Rel_ArrMap_vsv[cat_cs_intros]|\n  |vdomain cf_prod_2_Rel_ArrMap_vdomain[cat_cs_simps]|\n\nlemma cf_prod_2_Rel_ArrMap_app[cat_cs_simps]: \n  assumes \"GF = [G, F]\\<^sub>\\<circ>\" and \"GF \\<in>\\<^sub>\\<circ> (\\<AA> \\<times>\\<^sub>C \\<AA>)\\<lparr>Arr\\<rparr>\"\n  shows \"G \\<otimes>\\<^sub>H\\<^sub>M\\<^sub>.\\<^sub>A\\<^bsub>cf_prod_2_Rel \\<AA>\\<^esub> F = G \\<^sub>A\\<times>\\<^sub>R\\<^sub>e\\<^sub>l F\"\n  using assms(2) \n  unfolding assms(1) cf_prod_2_Rel_components \n  by (simp add: nat_omega_simps)\n\n\nsubsubsection\\<open>Product functor for \\<open>Rel\\<close> is a functor\\<close>\n\nlemma (in \\<Z>) cf_prod_2_Rel_is_functor:\n  \"cf_prod_2_Rel (cat_Rel \\<alpha>) : cat_Rel \\<alpha> \\<times>\\<^sub>C cat_Rel \\<alpha> \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> cat_Rel \\<alpha>\"\nproof-\n\n  interpret Rel: category \\<alpha> \\<open>cat_Rel \\<alpha>\\<close>\n    by (cs_concl cs_shallow cs_intro: cat_cs_intros cat_Rel_cs_intros)\n\n  show ?thesis\n  proof(rule is_functorI')\n   show \"vfsequence (cf_prod_2_Rel (cat_Rel \\<alpha>))\"\n      unfolding cf_prod_2_Rel_def by auto\n    show \"vcard (cf_prod_2_Rel (cat_Rel \\<alpha>)) = 4\\<^sub>\\<nat>\"\n      unfolding cf_prod_2_Rel_def by (simp add: nat_omega_simps)\n    show \"\\<R>\\<^sub>\\<circ> (cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ObjMap\\<rparr>) \\<subseteq>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n      by (rule cf_prod_2_Rel_ObjMap_vrange)\n    show \"cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ArrMap\\<rparr>\\<lparr>GF\\<rparr> :\n      cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ObjMap\\<rparr>\\<lparr>AB\\<rparr> \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub>\n      cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ObjMap\\<rparr>\\<lparr>CD\\<rparr>\"\n      if \"GF : AB \\<mapsto>\\<^bsub>cat_Rel \\<alpha> \\<times>\\<^sub>C cat_Rel \\<alpha>\\<^esub> CD\" for AB CD GF\n    proof-\n      from that obtain G F A B C D\n        where GF_def: \"GF = [G, F]\\<^sub>\\<circ>\"\n          and AB_def: \"AB = [A, B]\\<^sub>\\<circ>\"\n          and CD_def: \"CD = [C, D]\\<^sub>\\<circ>\"\n          and G: \"G : A \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> C\"\n          and F: \"F : B \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> D\"\n        by (elim cat_prod_2_is_arrE[OF Rel.category_axioms Rel.category_axioms])\n      from that G F show ?thesis\n        unfolding GF_def AB_def CD_def\n        by\n          (\n            cs_concl \n              cs_simp: cat_cs_simps \n              cs_intro: \n                cat_Rel_par_set_cs_intros cat_cs_intros cat_prod_cs_intros\n          )\n    qed\n\n    show \n      \"cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ArrMap\\<rparr>\\<lparr>GF' \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha> \\<times>\\<^sub>C cat_Rel \\<alpha>\\<^esub> GF\\<rparr> =\n        cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ArrMap\\<rparr>\\<lparr>GF'\\<rparr> \\<circ>\\<^sub>A\\<^bsub>cat_Rel \\<alpha>\\<^esub>\n          cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ArrMap\\<rparr>\\<lparr>GF\\<rparr>\"\n      if \"GF' : AB' \\<mapsto>\\<^bsub>cat_Rel \\<alpha> \\<times>\\<^sub>C cat_Rel \\<alpha>\\<^esub> AB''\"\n        and \"GF : AB \\<mapsto>\\<^bsub>cat_Rel \\<alpha> \\<times>\\<^sub>C cat_Rel \\<alpha>\\<^esub> AB'\"\n      for AB' AB'' GF' AB GF\n    proof-\n      from that(2) obtain G F A A' B B' \n        where GF_def: \"GF = [G, F]\\<^sub>\\<circ>\"\n          and AB_def: \"AB = [A, B]\\<^sub>\\<circ>\"\n          and AB'_def: \"AB' = [A', B']\\<^sub>\\<circ>\"\n          and G: \"G : A \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> A'\"\n          and F: \"F : B \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B'\"\n        by (elim cat_prod_2_is_arrE[OF Rel.category_axioms Rel.category_axioms])\n      with that(1) obtain G' F' A'' B''\n        where GF'_def: \"GF' = [G', F']\\<^sub>\\<circ>\"\n          and AB''_def: \"AB'' = [A'', B'']\\<^sub>\\<circ>\"\n          and G': \"G' : A' \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> A''\"\n          and F': \"F' : B' \\<mapsto>\\<^bsub>cat_Rel \\<alpha>\\<^esub> B''\"\n        by \n          (\n            auto elim: \n              cat_prod_2_is_arrE[OF Rel.category_axioms Rel.category_axioms]\n          )\n      from that G F G' F' show ?thesis\n        unfolding GF_def AB_def AB'_def GF'_def AB''_def\n        by\n          (\n            cs_concl cs_shallow\n              cs_simp: cat_cs_simps cat_prod_cs_simps prod_2_Rel_Comp\n              cs_intro: cat_cs_intros cat_prod_cs_intros\n          )\n    qed\n\n    show \n      \"cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ArrMap\\<rparr>\\<lparr>(cat_Rel \\<alpha> \\<times>\\<^sub>C cat_Rel \\<alpha>)\\<lparr>CId\\<rparr>\\<lparr>AB\\<rparr>\\<rparr> =\n        cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>cf_prod_2_Rel (cat_Rel \\<alpha>)\\<lparr>ObjMap\\<rparr>\\<lparr>AB\\<rparr>\\<rparr>\"\n      if \"AB \\<in>\\<^sub>\\<circ> (cat_Rel \\<alpha> \\<times>\\<^sub>C cat_Rel \\<alpha>)\\<lparr>Obj\\<rparr>\" for AB \n    proof-\n      from that obtain A B \n        where AB_def: \"AB = [A, B]\\<^sub>\\<circ>\"\n          and A: \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n          and B: \"B \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n        by (elim cat_prod_2_ObjE[OF Rel.category_axioms Rel.category_axioms])\n      from A B show ?thesis\n        unfolding AB_def     \n        by\n          (\n            cs_concl \n              cs_simp:\n                cf_prod_2_Rel_ObjMap_app cf_prod_2_Rel_ArrMap_app\n                cat_cs_simps cat_prod_cs_simps\n              cs_intro:\n                V_cs_intros cat_cs_intros cat_Rel_cs_intros cat_prod_cs_intros\n          )\n    qed\n\n  qed\n    (\n      cs_concl cs_shallow\n        cs_simp: cat_cs_simps \n        cs_intro: cat_cs_intros cat_cs_intros cat_Rel_cs_intros\n    )+\n\nqed\n\nlemma (in \\<Z>) cf_prod_2_Rel_is_functor'[cat_cs_intros]:\n  assumes \"\\<AA>' = cat_Rel \\<alpha> \\<times>\\<^sub>C cat_Rel \\<alpha>\"\n    and \"\\<BB>' = cat_Rel \\<alpha>\"\n    and \"\\<alpha>' = \\<alpha>\"\n  shows \"cf_prod_2_Rel (cat_Rel \\<alpha>) : \\<AA>' \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>'\\<^esub> \\<BB>'\"\n  unfolding assms by (rule cf_prod_2_Rel_is_functor)\n\nlemmas [cat_cs_intros] = \\<Z>.cf_prod_2_Rel_is_functor'\n\n\n\nsubsection\\<open>Product universal property arrow for \\<open>Set\\<close>\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition cat_Set_obj_prod_up :: \"V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V\"\n  where \"cat_Set_obj_prod_up I F A \\<phi> =\n    [(\\<lambda>a\\<in>\\<^sub>\\<circ>A. (\\<lambda>i\\<in>\\<^sub>\\<circ>I. \\<phi> i\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>)), A, (\\<Prod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma cat_Set_obj_prod_up_components: \n  shows \"cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr> = \n    (\\<lambda>a\\<in>\\<^sub>\\<circ>A. (\\<lambda>i\\<in>\\<^sub>\\<circ>I. \\<phi> i\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>))\"\n    and [cat_Set_cs_simps]: \n      \"cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrDom\\<rparr> = A\"\n    and [cat_Set_cs_simps]: \n      \"cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrCod\\<rparr> = (\\<Prod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\"\n  unfolding cat_Set_obj_prod_up_def arr_field_simps \n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Arrow value\\<close>\n\nmk_VLambda cat_Set_obj_prod_up_components(1)\n  |vsv cat_Set_obj_prod_up_ArrVal_vsv[cat_Set_cs_intros]|\n  |vdomain cat_Set_obj_prod_up_ArrVal_vdomain[cat_Set_cs_simps]|\n  |app cat_Set_obj_prod_up_ArrVal_app|\n\nlemma cat_Set_obj_prod_up_ArrVal_vrange: \n  assumes \"\\<And>i. i \\<in>\\<^sub>\\<circ> I \\<Longrightarrow> \\<phi> i : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> F i\"\n  shows \"\\<R>\\<^sub>\\<circ> (cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> (\\<Prod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\"\n  unfolding cat_Set_obj_prod_up_components \nproof(intro vrange_VLambda_vsubset vproductI)\n  fix a assume prems: \"a \\<in>\\<^sub>\\<circ> A\"\n  show \"\\<forall>i\\<in>\\<^sub>\\<circ>I. (\\<lambda>i\\<in>\\<^sub>\\<circ>I. \\<phi> i\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>)\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> F i\"\n  proof(intro ballI)\n    fix i assume \"i \\<in>\\<^sub>\\<circ> I\"\n    with assms prems show \"(\\<lambda>i\\<in>\\<^sub>\\<circ>I. \\<phi> i\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>)\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> F i\"\n      by (cs_concl cs_shallow cs_simp: V_cs_simps cs_intro: cat_Set_cs_intros)\n  qed\nqed auto\n\nlemma cat_Set_obj_prod_up_ArrVal_app_vdomain[cat_Set_cs_simps]:\n  assumes \"a \\<in>\\<^sub>\\<circ> A\"\n  shows \"\\<D>\\<^sub>\\<circ> (cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>) = I\"\n  unfolding cat_Set_obj_prod_up_ArrVal_app[OF assms] by simp\n\nlemma cat_Set_obj_prod_up_ArrVal_app_component[cat_Set_cs_simps]: \n  assumes \"a \\<in>\\<^sub>\\<circ> A\" and \"i \\<in>\\<^sub>\\<circ> I\"\n  shows \"cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\\<lparr>i\\<rparr> = \\<phi> i\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\"\n  using assms \n  by (cs_concl cs_shallow cs_simp: cat_Set_obj_prod_up_ArrVal_app V_cs_simps)\n\nlemma cat_Set_obj_prod_up_ArrVal_app_vrange: \n  assumes \"a \\<in>\\<^sub>\\<circ> A\" and \"\\<And>i. i \\<in>\\<^sub>\\<circ> I \\<Longrightarrow> \\<phi> i : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> F i\"\n  shows \"\\<R>\\<^sub>\\<circ> (cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>) \\<subseteq>\\<^sub>\\<circ> (\\<Union>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\"\nproof(intro vsubsetI)\n  fix b assume prems: \"b \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>)\"\n  from assms(1) have \"vsv (cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>)\"\n    by (auto simp: cat_Set_obj_prod_up_components)\n  with prems obtain i \n    where b_def: \"b = cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\\<lparr>i\\<rparr>\" \n      and i: \"i \\<in>\\<^sub>\\<circ> I\"\n    by \n      ( \n        auto \n          elim: vsv.vrange_atE \n          simp: cat_Set_obj_prod_up_ArrVal_app[OF assms(1)]\n      )\n  from cat_Set_obj_prod_up_ArrVal_app_component[OF assms(1) i] b_def have b_def':\n    \"b = \\<phi> i\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\"\n    by simp\n  from assms(1) assms(2)[OF i] have \"b \\<in>\\<^sub>\\<circ> F i\" \n    unfolding b_def' by (cs_concl cs_shallow cs_intro: cat_Set_cs_intros)\n  with i show \"b \\<in>\\<^sub>\\<circ> (\\<Union>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\" by force\nqed\n\n\nsubsubsection\\<open>Product universal property arrow for \\<open>Set\\<close> is an arrow in \\<open>Set\\<close>\\<close>\n\nlemma (in \\<Z>) cat_Set_obj_prod_up_cat_Set_is_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"VLambda I F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    and \"\\<And>i. i \\<in>\\<^sub>\\<circ> I \\<Longrightarrow> \\<phi> i : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> F i\"\n  shows \"cat_Set_obj_prod_up I F A \\<phi> : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> (\\<Prod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\"\nproof(intro cat_Set_is_arrI arr_SetI)\n  show \"vfsequence (cat_Set_obj_prod_up I F A \\<phi>)\"\n    unfolding cat_Set_obj_prod_up_def by auto\n  show \"vcard (cat_Set_obj_prod_up I F A \\<phi>) = 3\\<^sub>\\<nat>\"\n    unfolding cat_Set_obj_prod_up_def by (auto simp: nat_omega_simps)\n  show \n    \"\\<R>\\<^sub>\\<circ> (cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ>\n      cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrCod\\<rparr>\"\n    unfolding cat_Set_obj_prod_up_components(3)\n    by (rule cat_Set_obj_prod_up_ArrVal_vrange[OF assms(3)])\n  show \"cat_Set_obj_prod_up I F A \\<phi>\\<lparr>ArrCod\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    unfolding cat_Set_cs_simps\n    by (rule Limit_vproduct_in_Vset_if_VLambda_in_VsetI)\n      (simp_all add: cat_Set_cs_simps assms)\nqed \n  (\n    auto \n      simp: assms[unfolded cat_Set_components(1)] cat_Set_cs_simps \n      intro: cat_Set_cs_intros\n  )\n\n\nsubsubsection\\<open>Further properties\\<close>\n\nlemma (in \\<Z>) cat_Set_cf_comp_proj_obj_prod_up: \n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"VLambda I F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and \"\\<And>i. i \\<in>\\<^sub>\\<circ> I \\<Longrightarrow> \\<phi> i : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> F i\" \n    and \"i \\<in>\\<^sub>\\<circ> I\"\n  shows \n    \"\\<phi> i = vprojection_arrow I F i \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_obj_prod_up I F A \\<phi>\"\n    (is \\<open>\\<phi> i = ?Fi \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?\\<phi>\\<close>)\nproof(rule arr_Set_eqI[of \\<alpha>])\n  note \\<phi>i = assms(3)[OF assms(4)]\n  note \\<phi>i = cat_Set_is_arrD[OF \\<phi>i] \\<phi>i\n  have Fi: \"?Fi : (\\<Prod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i) \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> F i\"\n    by (rule vprojection_arrow_is_arr[OF assms(4,2)])\n  from cat_Set_obj_prod_up_cat_Set_is_arr[OF assms(1,2,3)] have \\<phi>:\n    \"cat_Set_obj_prod_up I F A \\<phi> : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> (\\<Prod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\"\n    by simp\n  show \"arr_Set \\<alpha> (\\<phi> i)\" by (rule \\<phi>i(1))\n  interpret \\<phi>i: arr_Set \\<alpha> \\<open>\\<phi> i\\<close> by (rule \\<phi>i(1))\n  from Fi \\<phi> have Fi_\\<phi>: \"?Fi \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?\\<phi> : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> F i\"\n    by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n  then show arr_Set_Fi_\\<phi>: \"arr_Set \\<alpha> (?Fi \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?\\<phi>)\"\n    by (auto simp: cat_Set_is_arrD(1))\n  interpret arr_Set \\<alpha> \\<open>?Fi \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?\\<phi>\\<close> by (rule arr_Set_Fi_\\<phi>)\n  from \\<phi>i have dom_lhs: \"\\<D>\\<^sub>\\<circ> (\\<phi> i\\<lparr>ArrVal\\<rparr>) = A\"\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n  from Fi_\\<phi> have dom_rhs: \"\\<D>\\<^sub>\\<circ> ((?Fi \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?\\<phi>)\\<lparr>ArrVal\\<rparr>) = A\"\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n  show \"\\<phi> i\\<lparr>ArrVal\\<rparr> = (?Fi \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?\\<phi>)\\<lparr>ArrVal\\<rparr>\"\n  proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n    fix a assume prems: \"a \\<in>\\<^sub>\\<circ> A\"\n    from assms(4) prems \\<phi>i(4) \\<phi> Fi show \n      \"\\<phi> i\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr> = (?Fi \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?\\<phi>)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\"\n      by \n        ( \n          cs_concl cs_shallow\n            cs_simp: cat_Set_cs_simps cat_cs_simps \n            cs_intro: cat_Set_cs_intros cat_cs_intros\n        )\n  qed auto\n  from Fi \\<phi> show\n    \"\\<phi> i\\<lparr>ArrDom\\<rparr> = (?Fi \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?\\<phi>)\\<lparr>ArrDom\\<rparr>\"\n    \"\\<phi> i\\<lparr>ArrCod\\<rparr> = (?Fi \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?\\<phi>)\\<lparr>ArrCod\\<rparr>\"\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cat_Set_cs_simps \\<phi>i(2,3))+\nqed\n\n\n\nsubsection\\<open>Coproduct universal property arrow for \\<open>Set\\<close>\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition cat_Set_obj_coprod_up :: \"V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V\"\n  where \"cat_Set_obj_coprod_up I F A \\<phi> =\n    [(\\<lambda>ix\\<in>\\<^sub>\\<circ>(\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i). \\<phi> (vfst ix)\\<lparr>ArrVal\\<rparr>\\<lparr>vsnd ix\\<rparr>), (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i), A]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma cat_Set_obj_coprod_up_components: \n  shows \"cat_Set_obj_coprod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr> = \n    (\\<lambda>ix\\<in>\\<^sub>\\<circ>(\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i). \\<phi> (vfst ix)\\<lparr>ArrVal\\<rparr>\\<lparr>vsnd ix\\<rparr>)\"\n    and [cat_Set_cs_simps]: \n      \"cat_Set_obj_coprod_up I F A \\<phi>\\<lparr>ArrDom\\<rparr> = (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\"\n    and [cat_Set_cs_simps]: \n      \"cat_Set_obj_coprod_up I F A \\<phi>\\<lparr>ArrCod\\<rparr> = A\"\n  unfolding cat_Set_obj_coprod_up_def arr_field_simps \n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Arrow value\\<close>\n\nmk_VLambda cat_Set_obj_coprod_up_components(1)\n  |vsv cat_Set_obj_coprod_up_ArrVal_vsv[cat_Set_cs_intros]|\n  |vdomain cat_Set_obj_coprod_up_ArrVal_vdomain[cat_Set_cs_simps]|\n  |app cat_Set_obj_coprod_up_ArrVal_app'|\n\nlemma cat_Set_obj_coprod_up_ArrVal_app[cat_cs_simps]:\n  assumes \"ix = \\<langle>i, x\\<rangle>\" and \"\\<langle>i, x\\<rangle> \\<in>\\<^sub>\\<circ> (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\"\n  shows \"cat_Set_obj_coprod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>\\<lparr>ix\\<rparr> = \\<phi> i\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>\"\n  using assms by (auto simp: cat_Set_obj_coprod_up_ArrVal_app')\n\nlemma cat_Set_obj_coprod_up_ArrVal_vrange:\n  assumes \"\\<And>i. i \\<in>\\<^sub>\\<circ> I \\<Longrightarrow> \\<phi> i : F i \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\n  shows \"\\<R>\\<^sub>\\<circ> (cat_Set_obj_coprod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> A\"\nproof\n  (\n    intro vsv.vsv_vrange_vsubset cat_Set_obj_coprod_up_ArrVal_vsv, \n    unfold cat_Set_cs_simps\n  )\n  fix ix assume \"ix \\<in>\\<^sub>\\<circ> (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\"\n  then obtain i x where ix_def: \"ix = \\<langle>i, x\\<rangle>\" and i: \"i \\<in>\\<^sub>\\<circ> I\" and x: \"x \\<in>\\<^sub>\\<circ> F i\" \n    by auto\n  show \"cat_Set_obj_coprod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>\\<lparr>ix\\<rparr> \\<in>\\<^sub>\\<circ> A\"\n  proof(cs_concl_step cat_Set_obj_coprod_up_ArrVal_app)\n    show \"ix = \\<langle>i, x\\<rangle>\" by (rule ix_def)\n    from i x show \"\\<langle>i, x\\<rangle> \\<in>\\<^sub>\\<circ> (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\" by auto\n    from i x assms[OF i] show \"\\<phi> i\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr> \\<in>\\<^sub>\\<circ> A\"\n      by (auto intro: cat_Set_ArrVal_app_vrange)\n  qed\nqed\n\n\nsubsubsection\\<open>Coproduct universal property arrow for \\<open>Set\\<close> is an arrow in \\<open>Set\\<close>\\<close>\n\nlemma (in \\<Z>) cat_Set_obj_coprod_up_cat_Set_is_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"VLambda I F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    and \"\\<And>i. i \\<in>\\<^sub>\\<circ> I \\<Longrightarrow> \\<phi> i : F i \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\n  shows \"cat_Set_obj_coprod_up I F A \\<phi> : (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i) \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\nproof(intro cat_Set_is_arrI arr_SetI)\n  show \"vfsequence (cat_Set_obj_coprod_up I F A \\<phi>)\"\n    unfolding cat_Set_obj_coprod_up_def by auto\n  show \"vcard (cat_Set_obj_coprod_up I F A \\<phi>) = 3\\<^sub>\\<nat>\"\n    unfolding cat_Set_obj_coprod_up_def by (auto simp: nat_omega_simps)\n  show \n    \"\\<R>\\<^sub>\\<circ> (cat_Set_obj_coprod_up I F A \\<phi>\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ>\n      cat_Set_obj_coprod_up I F A \\<phi>\\<lparr>ArrCod\\<rparr>\"\n    unfolding cat_Set_obj_coprod_up_components(3)\n    by (rule cat_Set_obj_coprod_up_ArrVal_vrange[OF assms(3)])\n  show \"cat_Set_obj_coprod_up I F A \\<phi>\\<lparr>ArrCod\\<rparr> \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    by (simp_all add: cat_Set_cs_simps assms[unfolded cat_Set_components(1)])\nqed \n  (\n    auto simp: \n      assms \n      cat_Set_obj_coprod_up_components \n      Limit_vdunion_in_Vset_if_VLambda_in_VsetI\n  ) \n\n\nsubsubsection\\<open>Further properties\\<close>\n\nlemma (in \\<Z>) cat_Set_cf_comp_coprod_up_vcia:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n    and \"VLambda I F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and \"\\<And>i. i \\<in>\\<^sub>\\<circ> I \\<Longrightarrow> \\<phi> i : F i \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\" \n    and \"i \\<in>\\<^sub>\\<circ> I\"\n  shows \n    \"\\<phi> i = cat_Set_obj_coprod_up I F A \\<phi> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> vcinjection_arrow I F i\"\n    (is \\<open>\\<phi> i = ?\\<phi> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Fi\\<close>)\nproof(rule arr_Set_eqI[of \\<alpha>])\n  note \\<phi>i = assms(3)[OF assms(4)]\n  note \\<phi>i = cat_Set_is_arrD[OF \\<phi>i] \\<phi>i\n  have Fi: \"?Fi : F i \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i)\"\n    by (rule vcinjection_arrow_is_arr[OF assms(4,2)])\n  from cat_Set_obj_coprod_up_cat_Set_is_arr[OF assms(1,2,3)] have \\<phi>:\n    \"cat_Set_obj_coprod_up I F A \\<phi> : (\\<Coprod>\\<^sub>\\<circ>i\\<in>\\<^sub>\\<circ>I. F i) \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\n    by simp\n  show \"arr_Set \\<alpha> (\\<phi> i)\" by (rule \\<phi>i(1))\n  then interpret \\<phi>i: arr_Set \\<alpha> \\<open>\\<phi> i\\<close> .\n  from Fi \\<phi> have Fi_\\<phi>: \"?\\<phi> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Fi : F i \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\n    by (cs_concl cs_shallow cs_intro: cat_cs_intros)\n  then show arr_Set_Fi_\\<phi>: \"arr_Set \\<alpha> (?\\<phi> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Fi)\"\n    by (auto simp: cat_Set_is_arrD(1))\n  interpret arr_Set \\<alpha> \\<open>?\\<phi> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Fi\\<close> by (rule arr_Set_Fi_\\<phi>)\n  from \\<phi>i have dom_lhs: \"\\<D>\\<^sub>\\<circ> (\\<phi> i\\<lparr>ArrVal\\<rparr>) = F i\"\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps)\n  from Fi_\\<phi> have dom_rhs: \"\\<D>\\<^sub>\\<circ> ((?\\<phi> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Fi)\\<lparr>ArrVal\\<rparr>) = F i\"\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n  show \"\\<phi> i\\<lparr>ArrVal\\<rparr> = (?\\<phi> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Fi)\\<lparr>ArrVal\\<rparr>\"\n  proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n    fix a assume \"a \\<in>\\<^sub>\\<circ> F i\"\n    from assms(4) this \\<phi>i(4) \\<phi> Fi show \n      \"\\<phi> i\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr> = (?\\<phi> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Fi)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\"\n      by\n        (\n          cs_concl cs_shallow\n            cs_simp: cat_Set_cs_simps cat_cs_simps \n            cs_intro: vdunionI cat_Set_cs_intros cat_cs_intros\n        )\n  qed auto\n  from Fi \\<phi> show \n    \"\\<phi> i\\<lparr>ArrDom\\<rparr> = (?\\<phi> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Fi)\\<lparr>ArrDom\\<rparr>\"\n    \"\\<phi> i\\<lparr>ArrCod\\<rparr> = (?\\<phi> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?Fi)\\<lparr>ArrCod\\<rparr>\"\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps cat_Set_cs_simps \\<phi>i(2,3))+\nqed\n\n\n\nsubsection\\<open>Equalizer object for the category \\<open>Set\\<close>\\<close>\n\n\ntext\\<open>\nThe definition of the (non-categorical concept of an) equalizer can be \nfound in \\<^cite>\\<open>\"noauthor_wikipedia_2001\"\\<close>\\footnote{\n\\url{https://en.wikipedia.org/wiki/Equaliser_(mathematics)}\n}\\<close>\n\ndefinition vequalizer :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V\"\n  where \"vequalizer X f g = set {x. x \\<in>\\<^sub>\\<circ> X \\<and> f\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr> = g\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>}\"\n\nlemma small_vequalizer[simp]: \n  \"small {x. x \\<in>\\<^sub>\\<circ> X \\<and> f\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr> = g\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>}\"\n  by auto\n\n\ntext\\<open>Rules.\\<close>\n\nlemma vequalizerI:\n  assumes \"x \\<in>\\<^sub>\\<circ> X\" and \"f\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr> = g\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>\"\n  shows \"x \\<in>\\<^sub>\\<circ> vequalizer X f g\"\n  using assms unfolding vequalizer_def by auto\n\nlemma vequalizerD[dest]:\n  assumes \"x \\<in>\\<^sub>\\<circ> vequalizer X f g\"\n  shows \"x \\<in>\\<^sub>\\<circ> X\" and \"f\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr> = g\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>\"\n  using assms unfolding vequalizer_def by auto\n\nlemma vequalizerE[elim]:\n  assumes \"x \\<in>\\<^sub>\\<circ> vequalizer X f g\"\n  obtains \"x \\<in>\\<^sub>\\<circ> X\" and \"f\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr> = g\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>\"\n  using assms unfolding vequalizer_def by auto\n\n\ntext\\<open>Elementary results.\\<close>\n\nlemma vequalizer_vsubset_vdomain[cat_Set_cs_intros]: \"vequalizer a g f \\<subseteq>\\<^sub>\\<circ> a\" \n  by auto\n  \nlemma Limit_vequalizer_in_Vset[cat_Set_cs_intros]:\n  assumes \"Limit \\<alpha>\" and \"a \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"vequalizer a g f \\<in>\\<^sub>\\<circ> cat_Set \\<alpha>\\<lparr>Obj\\<rparr>\"\n  using assms unfolding cat_Set_components(1) by auto\n\nlemma vequalizer_flip: \"vequalizer a f g = vequalizer a g f\"\n  unfolding vequalizer_def by auto\n\nlemma cat_Set_incl_Set_commute:\n  assumes \"\\<gg> : \\<aa> \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<bb>\" and \"\\<ff> : \\<aa> \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<bb>\" \n  shows \n    \"\\<gg> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> incl_Set (vequalizer \\<aa> \\<ff> \\<gg>) \\<aa> =\n      \\<ff> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> incl_Set (vequalizer \\<aa> \\<ff> \\<gg>) \\<aa>\"\n  (is \\<open>\\<gg> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl = \\<ff> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl\\<close>)\nproof-\n\n  interpret \\<gg>: arr_Set \\<alpha> \\<gg> \n    rewrites \"\\<gg>\\<lparr>ArrDom\\<rparr> = \\<aa>\" and \"\\<gg>\\<lparr>ArrCod\\<rparr> = \\<bb>\"\n    by (intro cat_Set_is_arrD[OF assms(1)])+\n  interpret \\<ff>: arr_Set \\<alpha> \\<ff> \n    rewrites \"\\<ff>\\<lparr>ArrDom\\<rparr> = \\<aa>\" and \"\\<ff>\\<lparr>ArrCod\\<rparr> = \\<bb>\"\n    by (intro cat_Set_is_arrD[OF assms(2)])+\n\n  note [cat_Set_cs_intros] = \\<gg>.arr_Set_ArrDom_in_Vset \\<ff>.arr_Set_ArrCod_in_Vset\n\n  from assms have \\<gg>_incl: \n    \"\\<gg> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl : vequalizer \\<aa> \\<ff> \\<gg> \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<bb>\"\n    by (cs_concl cs_intro: V_cs_intros cat_Set_cs_intros cat_cs_intros)\n  then have dom_lhs: \"\\<D>\\<^sub>\\<circ> ((\\<gg> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl)\\<lparr>ArrVal\\<rparr>) = vequalizer \\<aa> \\<ff> \\<gg>\"\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps)+\n  from assms have \\<ff>_incl: \n    \"\\<ff> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl : vequalizer \\<aa> \\<ff> \\<gg> \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> \\<bb>\"\n    by (cs_concl cs_intro: V_cs_intros cat_Set_cs_intros cat_cs_intros)\n  then have dom_rhs: \"\\<D>\\<^sub>\\<circ> ((\\<ff> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl)\\<lparr>ArrVal\\<rparr>) = vequalizer \\<aa> \\<ff> \\<gg>\"\n    by (cs_concl cs_shallow cs_simp: cat_cs_simps)+\n\n  show ?thesis\n  proof(rule arr_Set_eqI)\n    from \\<gg>_incl show arr_Set_\\<gg>_incl: \"arr_Set \\<alpha> (\\<gg> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl)\"\n      by (auto dest: cat_Set_is_arrD(1))\n    interpret arr_Set_\\<gg>_incl: arr_Set \\<alpha> \\<open>\\<gg> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl\\<close>\n      by (rule arr_Set_\\<gg>_incl)\n    from \\<ff>_incl show arr_Set_\\<ff>_incl: \"arr_Set \\<alpha> (\\<ff> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl)\"\n      by (auto dest: cat_Set_is_arrD(1))\n    interpret arr_Set_\\<ff>_incl: arr_Set \\<alpha> \\<open>\\<ff> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl\\<close>\n      by (rule arr_Set_\\<ff>_incl)\n    show \"(\\<gg> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl)\\<lparr>ArrVal\\<rparr> = (\\<ff> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl)\\<lparr>ArrVal\\<rparr>\"\n    proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n      fix a assume \"a \\<in>\\<^sub>\\<circ> vequalizer \\<aa> \\<ff> \\<gg>\"\n      with assms show \n        \"(\\<gg> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr> = (\\<ff> \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> ?incl)\\<lparr>ArrVal\\<rparr>\\<lparr>a\\<rparr>\"\n        by (*very slow*)\n          (\n            cs_concl \n              cs_simp: vequalizerD(2) cat_Set_cs_simps cat_cs_simps\n              cs_intro: V_cs_intros cat_Set_cs_intros cat_cs_intros\n          )\n    qed auto\n  qed (use \\<gg>_incl \\<ff>_incl in \\<open>cs_concl cs_shallow cs_simp: cat_cs_simps\\<close>)+\n\nqed\n\n\n\nsubsection\\<open>Application of a function to a finite sequence as an arrow in \\<open>Set\\<close>\\<close>\n\ndefinition vfsequence_map :: \"V \\<Rightarrow> V\"\n  where \"vfsequence_map F =\n    [\n      (\\<lambda>xs\\<in>\\<^sub>\\<circ>vfsequences_on (F\\<lparr>ArrDom\\<rparr>). F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> xs),\n      vfsequences_on (F\\<lparr>ArrDom\\<rparr>),\n      vfsequences_on (F\\<lparr>ArrCod\\<rparr>)\n    ]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma vfsequence_map_components:\n  shows \"vfsequence_map F\\<lparr>ArrVal\\<rparr> =\n    (\\<lambda>xs\\<in>\\<^sub>\\<circ>vfsequences_on (F\\<lparr>ArrDom\\<rparr>). F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> xs)\"\n    and [cat_cs_simps]: \"vfsequence_map F\\<lparr>ArrDom\\<rparr> = vfsequences_on (F\\<lparr>ArrDom\\<rparr>)\"\n    and [cat_cs_simps]: \"vfsequence_map F\\<lparr>ArrCod\\<rparr> = vfsequences_on (F\\<lparr>ArrCod\\<rparr>)\"\n  unfolding vfsequence_map_def arr_field_simps \n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Arrow value\\<close>\n\nmk_VLambda vfsequence_map_components(1)\n  |vsv vfsequence_map_ArrVal_vsv[cat_cs_intros, cat_Set_cs_intros]|\n  |vdomain vfsequence_map_ArrVal_vdomain[cat_cs_simps, cat_Set_cs_simps]|\n  |app vfsequence_map_ArrVal_app|\n\nlemma vfsequence_map_ArrVal_app_app:\n  assumes \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n    and \"xs \\<in>\\<^sub>\\<circ> vfsequences_on A\"\n    and \"i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> xs\"\n  shows \"vfsequence_map F\\<lparr>ArrVal\\<rparr>\\<lparr>xs\\<rparr>\\<lparr>i\\<rparr> = F\\<lparr>ArrVal\\<rparr>\\<lparr>xs\\<lparr>i\\<rparr>\\<rparr>\"\nproof-\n  note FD = cat_Set_is_arrD[OF assms(1)]\n  interpret arr_Set \\<alpha> F \n    rewrites \"F\\<lparr>ArrDom\\<rparr> = A\" and \"F\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro FD)+\n  note xsD = vfsequences_onD[OF assms(2)]\n  interpret xs: vfsequence xs by (rule xsD(1))\n  from assms xsD(2)[OF assms(3)] show ?thesis\n    by\n      (\n        cs_concl\n          cs_simp: V_cs_simps cat_cs_simps vfsequence_map_ArrVal_app\n          cs_intro: V_cs_intros\n      )\nqed\n\n\nsubsubsection\\<open>\nApplication of a function to a finite sequence is an arrow in \\<open>Set\\<close>\n\\<close>\n\nlemma vfsequence_map_is_arr:\n  assumes \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  shows \"vfsequence_map F : vfsequences_on A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> vfsequences_on B\"\nproof-\n\n  note FD = cat_Set_is_arrD[OF assms(1)]\n  interpret arr_Set \\<alpha> F \n    rewrites [cat_cs_simps]: \"F\\<lparr>ArrDom\\<rparr> = A\" and [cat_cs_simps]: \"F\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro FD)+\n\n  show ?thesis\n  proof(intro cat_Set_is_arrI arr_SetI , unfold cat_cs_simps)\n    show \"vfsequence (vfsequence_map F)\"\n      unfolding vfsequence_map_def by auto\n    show \"vcard (vfsequence_map F) = 3\\<^sub>\\<nat>\"\n      unfolding vfsequence_map_def by (simp_all add: nat_omega_simps)\n    show \"\\<R>\\<^sub>\\<circ> (vfsequence_map F\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> vfsequences_on B\"\n      unfolding vfsequence_map_components\n    proof\n      (\n        intro vrange_VLambda_vsubset vfsequences_onI; \n        elim vfsequences_onE; \n        unfold cat_cs_simps\n      )\n      fix xs assume prems: \"vfsequence xs\" \"i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> xs \\<Longrightarrow> xs\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> A\" for i\n      interpret xs: vfsequence xs by (rule prems(1))\n      have [intro]: \"x \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\" if \"x \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> xs\" for x\n      proof-\n        from that obtain i where i: \"i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> xs\" and x_def: \"x = xs\\<lparr>i\\<rparr>\"\n          by (auto dest: xs.vrange_atD)\n        from prems(2)[OF i] show \"x \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\"\n          unfolding x_def arr_Set_ArrVal_vdomain .\n      qed\n      show \"vfsequence (F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> xs)\"\n        by (intro vfsequence_vcomp_vsv_vfsequence vsubsetI)\n          (auto intro: prems(1))\n      fix i assume prems': \"i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> xs)\"\n      moreover have \"\\<D>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> xs) = \\<D>\\<^sub>\\<circ> xs\"\n        by (intro vdomain_vcomp_vsubset vsubsetI) (auto intro: prems(1))\n      ultimately have i: \"i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> xs\" by simp\n      with assms(1) prems(2)[OF i] show \"(F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> xs)\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> B\"\n        by \n          (\n            cs_concl\n              cs_simp: V_cs_simps cat_cs_simps \n              cs_intro: V_cs_intros cat_Set_cs_intros\n          )\n    qed\n\n  qed \n    (\n      auto intro: \n        vfsequences_on_in_VsetI \n        arr_Set_ArrDom_in_Vset \n        arr_Set_ArrCod_in_Vset\n        cat_cs_intros\n    )\n\nqed\n\nlemma (in \\<Z>) vfsequence_map_is_monic_arr:\n  assumes \"F : A \\<mapsto>\\<^sub>m\\<^sub>o\\<^sub>n\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  shows \"vfsequence_map F : vfsequences_on A \\<mapsto>\\<^sub>m\\<^sub>o\\<^sub>n\\<^bsub>cat_Set \\<alpha>\\<^esub> vfsequences_on B\"\nproof-\n  \n  note cat_Set_is_monic_arrD[OF assms]\n  note FD = this cat_Set_is_arrD[OF this(1)]\n  interpret F: arr_Set \\<alpha> F \n    rewrites [cat_cs_simps]: \"F\\<lparr>ArrDom\\<rparr> = A\" and [cat_cs_simps]: \"F\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro FD)+\n\n  show ?thesis\n  proof\n    (\n      intro cat_Set_is_monic_arrI vfsequence_map_is_arr FD(1) vsv.vsv_valeq_v11I,\n      unfold cat_cs_simps;\n      (elim vfsequences_onE)?\n    )\n  \n    fix xs ys assume prems:\n      \"vfsequence_map F\\<lparr>ArrVal\\<rparr>\\<lparr>xs\\<rparr> = vfsequence_map F\\<lparr>ArrVal\\<rparr>\\<lparr>ys\\<rparr>\"\n      \"vfsequence xs\"\n      \"\\<And>i. i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> xs \\<Longrightarrow> xs\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> A\"\n      \"vfsequence ys\"\n      \"\\<And>i. i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> ys \\<Longrightarrow> ys\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> A\"\n\n    interpret xs: vfsequence xs by (rule prems(2))\n    interpret ys: vfsequence ys by (rule prems(4))\n\n    have \"xs \\<in>\\<^sub>\\<circ> vfsequences_on (F\\<lparr>ArrDom\\<rparr>)\"\n      unfolding cat_cs_simps by (intro vfsequences_onI prems(2,3))\n    from vfsequence_map_ArrVal_app[OF this] have F_xs:\n      \"vfsequence_map F\\<lparr>ArrVal\\<rparr>\\<lparr>xs\\<rparr> = F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> xs\" \n      by simp\n    from prems(3) have rxs: \"\\<R>\\<^sub>\\<circ> xs \\<subseteq>\\<^sub>\\<circ> A\"\n      by (intro vsubsetI) (auto dest: xs.vrange_atD)\n    from xs.vfsequence_vdomain_in_omega have dxs: \"\\<D>\\<^sub>\\<circ> xs \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n      by (auto intro!: Axiom_of_Infinity)\n    note xs_is_arr = cat_Set_arr_of_vsv_is_arr\n      [\n        OF xs.vsv_axioms rxs,\n        unfolded cat_Set_components(1), \n        OF dxs F.arr_Par_ArrDom_in_Vset\n      ]\n\n    have ys: \"ys \\<in>\\<^sub>\\<circ> vfsequences_on (F\\<lparr>ArrDom\\<rparr>)\"\n      unfolding cat_cs_simps by (intro vfsequences_onI prems(4,5))\n    from vfsequence_map_ArrVal_app[OF this] have F_ys:\n      \"vfsequence_map F\\<lparr>ArrVal\\<rparr>\\<lparr>ys\\<rparr> = F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> ys\" \n      by simp\n    from prems(5) have rys: \"\\<R>\\<^sub>\\<circ> ys \\<subseteq>\\<^sub>\\<circ> A\"\n      by (intro vsubsetI) (auto dest: ys.vrange_atD)\n    from ys.vfsequence_vdomain_in_omega have dys: \"\\<D>\\<^sub>\\<circ> ys \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n      by (auto intro!: Axiom_of_Infinity)\n    note ys_is_arr = cat_Set_arr_of_vsv_is_arr\n      [\n        OF ys.vsv_axioms rys,\n        unfolded cat_Set_components(1), \n        OF dys F.arr_Par_ArrDom_in_Vset\n      ]\n\n    note Fxs_Fys = prems(1)[unfolded F_xs F_ys]\n\n    from rxs have dom_rxs: \"\\<D>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> xs) = \\<D>\\<^sub>\\<circ> xs\"\n      by (intro vdomain_vcomp_vsubset vsubsetI, unfold F.arr_Set_ArrVal_vdomain)\n        auto\n    moreover from rys have dom_rys: \"\\<D>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> ys) = \\<D>\\<^sub>\\<circ> ys\"\n      by (intro vdomain_vcomp_vsubset vsubsetI, unfold F.arr_Set_ArrVal_vdomain)\n        auto\n    ultimately have dxs_dys: \"\\<D>\\<^sub>\\<circ> xs = \\<D>\\<^sub>\\<circ> ys\"\n      by (simp add: prems(1)[unfolded F_xs F_ys])\n\n    from FD(1) xs_is_arr have lhs_is_arr:\n      \"F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_arr_of_vsv xs A : \\<D>\\<^sub>\\<circ> xs \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n      by (cs_concl cs_intro: cat_cs_intros)\n    then have dom_lhs: \n      \"\\<D>\\<^sub>\\<circ> ((F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_arr_of_vsv xs A)\\<lparr>ArrVal\\<rparr>) = \\<D>\\<^sub>\\<circ> xs\"\n      by (simp add: cat_cs_simps)\n\n    from FD(1) ys_is_arr have rhs_is_arr:\n      \"F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_arr_of_vsv ys A : \\<D>\\<^sub>\\<circ> xs \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n      by (cs_concl cs_simp: dxs_dys cs_intro: cat_cs_intros)\n    then have dom_rhs: \n      \"\\<D>\\<^sub>\\<circ> ((F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_arr_of_vsv ys A)\\<lparr>ArrVal\\<rparr>) = \\<D>\\<^sub>\\<circ> xs\"\n      by (simp add: cat_cs_simps)\n\n    have F_xs_F_ys:\n      \"F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_arr_of_vsv xs A = \n        F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_arr_of_vsv ys A\"\n    proof(rule arr_Set_eqI[of \\<alpha>])\n      show\n        \"(F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_arr_of_vsv xs A)\\<lparr>ArrVal\\<rparr> = \n          (F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_arr_of_vsv ys A)\\<lparr>ArrVal\\<rparr>\"\n      proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n        fix i assume prems: \"i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> xs\"\n        from prems rxs have xsi: \"xs\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> A\" \n          by (auto dest: xs.vdomain_atD)\n        from prems rys have ysi: \"ys\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> A\" \n          by (auto simp: dxs_dys dest: ys.vdomain_atD)\n        from arg_cong[OF Fxs_Fys, where f=\\<open>\\<lambda>x. x\\<lparr>i\\<rparr>\\<close>] prems FD(1) xsi ysi\n        have \"F\\<lparr>ArrVal\\<rparr>\\<lparr>xs\\<lparr>i\\<rparr>\\<rparr> = F\\<lparr>ArrVal\\<rparr>\\<lparr>ys\\<lparr>i\\<rparr>\\<rparr>\"\n          by\n            (\n              cs_prems \n                cs_simp: V_cs_simps cat_cs_simps dxs_dys[symmetric] \n                cs_intro: V_cs_intros cat_cs_intros\n            )\n        with prems FD(1) xs_is_arr ys_is_arr show \n          \"(F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_arr_of_vsv xs A)\\<lparr>ArrVal\\<rparr>\\<lparr>i\\<rparr> = \n            (F \\<circ>\\<^sub>A\\<^bsub>cat_Set \\<alpha>\\<^esub> cat_Set_arr_of_vsv ys A)\\<lparr>ArrVal\\<rparr>\\<lparr>i\\<rparr>\"\n          by\n            (\n              cs_concl \n                cs_simp: cat_Set_cs_simps cat_cs_simps dxs_dys[symmetric] \n                cs_intro: cat_cs_intros\n            )\n      qed (use lhs_is_arr rhs_is_arr in \\<open>auto dest: cat_Set_is_arrD\\<close>)\n    qed\n      (\n        use lhs_is_arr rhs_is_arr in \n          \\<open>auto simp: cat_cs_simps dest: cat_Set_is_arrD(1)\\<close>\n      )+\n    have \"cat_Set_arr_of_vsv xs A = cat_Set_arr_of_vsv ys A\"\n      by \n        (\n          rule is_monic_arrD(2)[\n            OF assms(1) xs_is_arr, unfolded dxs_dys, OF ys_is_arr, OF F_xs_F_ys\n            ]\n        )\n    from arg_cong [OF this, where f=\\<open>\\<lambda>x. x\\<lparr>ArrVal\\<rparr>\\<close>, unfolded cat_Set_cs_simps]\n    show \"xs = ys\" .\n\n  qed (auto intro: cat_cs_intros)\n\nqed\n\nlemma (in \\<Z>) vfsequence_map_is_epic_arr:\n  assumes \"F : A \\<mapsto>\\<^sub>e\\<^sub>p\\<^sub>i\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  shows \"vfsequence_map F : vfsequences_on A \\<mapsto>\\<^sub>e\\<^sub>p\\<^sub>i\\<^bsub>cat_Set \\<alpha>\\<^esub> vfsequences_on B\"\nproof-\n\n  note cat_Set_is_epic_arrD[OF assms]\n  note FD = this cat_Set_is_arrD[OF this(1)]\n\n  interpret F: arr_Set \\<alpha> F \n    rewrites [cat_cs_simps]: \"F\\<lparr>ArrDom\\<rparr> = A\" and [cat_cs_simps]: \"F\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro FD)+\n  interpret SF: arr_Set \\<alpha> \\<open>vfsequence_map F\\<close>\n    rewrites \"vfsequence_map F\\<lparr>ArrDom\\<rparr> = vfsequences_on A\"\n      and \"vfsequence_map F\\<lparr>ArrCod\\<rparr> = vfsequences_on B\"\n    by (intro cat_Set_is_arrD[OF vfsequence_map_is_arr[OF FD(1)]])+\n  \n  show ?thesis\n  proof\n    (\n      intro cat_Set_is_epic_arrI, \n      rule vfsequence_map_is_arr[OF FD(1)], \n      rule vsubset_antisym, \n      rule SF.arr_Par_ArrVal_vrange,\n      rule vsubsetI\n    )\n    fix xs assume prems: \"xs \\<in>\\<^sub>\\<circ> vfsequences_on B\"\n    note xsD = vfsequences_onD[OF prems]\n    interpret vfsequence xs by (rule xsD(1))\n    define ys where \"ys = (\\<lambda>i\\<in>\\<^sub>\\<circ>\\<D>\\<^sub>\\<circ> xs. SOME x. x \\<in>\\<^sub>\\<circ> A \\<and> xs\\<lparr>i\\<rparr> = F\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>)\"\n    have ys_vdomain: \"\\<D>\\<^sub>\\<circ> ys = \\<D>\\<^sub>\\<circ> xs\" unfolding ys_def by simp\n    interpret ys: vfsequence ys\n      by (rule vfsequenceI)\n        (auto intro: vfsequence_vdomain_in_omega simp: ys_def)\n    have ysi: \"ys\\<lparr>i\\<rparr> = (SOME x. x \\<in>\\<^sub>\\<circ> A \\<and> xs\\<lparr>i\\<rparr> = F\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>)\"\n      if \"i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> xs\" for i\n      using that unfolding ys_def by simp\n    have ysi: \"ys\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> A\" \n      and xsi_def: \"xs\\<lparr>i\\<rparr> = F\\<lparr>ArrVal\\<rparr>\\<lparr>ys\\<lparr>i\\<rparr>\\<rparr>\"\n      if \"i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> xs\" for i\n    proof-\n      have \"xs\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\" by (rule xsD(2)[OF that, folded FD(2)])\n      then obtain x where x: \"x \\<in>\\<^sub>\\<circ> A\" and xsi_def: \"xs\\<lparr>i\\<rparr> = F\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>\"\n        by (auto elim: F.ArrVal.vrange_atE simp: F.arr_Set_ArrVal_vdomain)\n      show \"ys\\<lparr>i\\<rparr> \\<in>\\<^sub>\\<circ> A\" and \"xs\\<lparr>i\\<rparr> = F\\<lparr>ArrVal\\<rparr>\\<lparr>ys\\<lparr>i\\<rparr>\\<rparr>\"\n        unfolding ysi[OF that]\n        by \n          (\n            all\\<open>rule someI2_ex, intro exI conjI; (elim conjE)?\\<close>, \n            tactic\\<open>distinct_subgoals_tac\\<close>\n          )\n          (auto simp: x xsi_def)\n    qed\n    show \"xs \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (vfsequence_map F\\<lparr>ArrVal\\<rparr>)\"\n    proof\n      (\n        intro vsv.vsv_vimageI2' cat_cs_intros, \n        cs_concl_step vfsequence_map_ArrVal_app, \n        unfold cat_cs_simps,\n        tactic\\<open>distinct_subgoals_tac\\<close>\n      )\n      show \"ys \\<in>\\<^sub>\\<circ> vfsequences_on A\"\n        by (intro vfsequences_onI ys.vfsequence_axioms)\n          (auto intro: ysi simp: ys_vdomain)\n      show \"xs = F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> ys\"  \n      proof(rule vsv_eqI)\n        show \"\\<D>\\<^sub>\\<circ> xs = \\<D>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> ys)\"\n          unfolding ys_vdomain[symmetric]\n        proof(intro vdomain_vcomp_vsubset[symmetric] vsubsetI)\n          fix y assume \"y \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> ys\"\n          then obtain i where i: \"i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> ys\" and y_def: \"y = ys\\<lparr>i\\<rparr>\"\n            by (auto dest: ys.vrange_atD)\n          from i show \"y \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\"\n            unfolding y_def F.arr_Set_ArrVal_vdomain ys_vdomain by (rule ysi)\n        qed\n        show \"xs\\<lparr>i\\<rparr> = (F\\<lparr>ArrVal\\<rparr> \\<circ>\\<^sub>\\<circ> ys)\\<lparr>i\\<rparr>\"\n          if \"i \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> xs\" for i \n          using FD(1) that \n          by\n            (\n              cs_concl\n                cs_simp: V_cs_simps cat_cs_simps xsi_def ys_vdomain\n                cs_intro: V_cs_intros ysi\n            )\n      qed (auto intro: vsv_vcomp)\n    qed\n  qed\n\nqed\n\nlemma vfsequence_map_is_iso_arr:\n  assumes \"F : A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  shows \"vfsequence_map F : vfsequences_on A \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>cat_Set \\<alpha>\\<^esub> vfsequences_on B\"\nproof-\n  note cat_Set_is_iso_arrD[OF assms]\n  note FD = this cat_Set_is_arrD[OF this(1)]\n  interpret F: arr_Set \\<alpha> F \n    rewrites [cat_cs_simps]: \"F\\<lparr>ArrDom\\<rparr> = A\" and [cat_cs_simps]: \"F\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro FD)+\n  interpret Set: category \\<alpha> \\<open>cat_Set \\<alpha>\\<close> by (cs_concl cs_intro: cat_cs_intros)\n  show ?thesis\n    by \n      ( \n        intro \n        F.cat_Set_is_iso_arr_if_monic_and_epic\n        F.vfsequence_map_is_monic_arr[\n          OF Set.cat_is_iso_arr_is_monic_arr[OF assms]\n          ]\n        F.vfsequence_map_is_epic_arr[\n          OF Set.cat_is_iso_arr_is_epic_arr[OF assms]\n          ]\n      )\nqed\n\n\n\nsubsection\\<open>An injection from the range of an arrow in \\<open>Set\\<close> into its domain\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition vrange_iso :: \"V \\<Rightarrow> V\"\n  where \"vrange_iso F =\n    [\n      (\\<lambda>y\\<in>\\<^sub>\\<circ>\\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>). (SOME x. x \\<in>\\<^sub>\\<circ> F\\<lparr>ArrDom\\<rparr> \\<and> y = F\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>)),\n      \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>),\n      F\\<lparr>ArrDom\\<rparr>\n    ]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma vrange_iso_components:\n  shows \"vrange_iso F\\<lparr>ArrVal\\<rparr> =\n    (\\<lambda>y\\<in>\\<^sub>\\<circ>\\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>). (SOME x. x \\<in>\\<^sub>\\<circ> F\\<lparr>ArrDom\\<rparr> \\<and> y = F\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>))\"\n    and [cat_cs_simps]: \"vrange_iso F\\<lparr>ArrDom\\<rparr> = \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\"\n    and [cat_cs_simps]: \"vrange_iso F\\<lparr>ArrCod\\<rparr> = F\\<lparr>ArrDom\\<rparr>\"\n  unfolding vrange_iso_def arr_field_simps by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Arrow value\\<close>\n\nmk_VLambda vrange_iso_components(1)\n  |vsv vrange_iso_ArrVal_vsv[cat_cs_intros]|\n  |vdomain vrange_iso_ArrVal_vdomain[cat_cs_simps]|\n  |app vrange_iso_ArrVal_app|\n\nlemma vrange_iso_ArrVal_rules:\n  assumes \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" and \"y \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\"\n  shows \"vrange_iso F\\<lparr>ArrVal\\<rparr>\\<lparr>y\\<rparr> \\<in>\\<^sub>\\<circ> A\"\n    and \"y = F\\<lparr>ArrVal\\<rparr>\\<lparr>vrange_iso F\\<lparr>ArrVal\\<rparr>\\<lparr>y\\<rparr>\\<rparr>\"\nproof-\n  note FD = cat_Set_is_arrD[OF assms(1)]\n  interpret F: arr_Set \\<alpha> F\n    rewrites [cat_cs_simps]: \"F\\<lparr>ArrDom\\<rparr> = A\" and [cat_cs_simps]: \"F\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro FD)+\n  from assms(2) have vri_Fy_def:\n    \"vrange_iso F\\<lparr>ArrVal\\<rparr>\\<lparr>y\\<rparr> = (SOME x. x \\<in>\\<^sub>\\<circ> F\\<lparr>ArrDom\\<rparr> \\<and> y = F\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>)\"\n    by (cs_concl cs_simp: vrange_iso_ArrVal_app)\n  from assms(2) F.arr_Set_ArrVal_vdomain obtain x \n    where x: \"x \\<in>\\<^sub>\\<circ> A\" and y_def: \"y = F\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr>\"\n    by (auto elim: F.ArrVal.vrange_atE)\n  show \"vrange_iso F\\<lparr>ArrVal\\<rparr>\\<lparr>y\\<rparr> \\<in>\\<^sub>\\<circ> A\"\n    and \"y = F\\<lparr>ArrVal\\<rparr>\\<lparr>vrange_iso F\\<lparr>ArrVal\\<rparr>\\<lparr>y\\<rparr>\\<rparr>\"\n    unfolding vri_Fy_def cat_cs_simps \n    by (all\\<open>rule someI2_ex; (intro exI conjI)?; (elim conjE)?\\<close>)\n      (simp_all add: x y_def)\nqed\n\n\nsubsubsection\\<open>\nAn injection from the range of a function into its domain is a monic in \\<open>Set\\<close>\n\\<close>\n\nlemma vrange_iso_is_arr:\n  assumes \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  shows \"vrange_iso F : \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>) \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\nproof-\n\n  note FD = cat_Set_is_arrD[OF assms(1)]\n  interpret F: arr_Set \\<alpha> F\n    rewrites [cat_cs_simps]: \"F\\<lparr>ArrDom\\<rparr> = A\" and [cat_cs_simps]: \"F\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro FD)+\n\n  show \"vrange_iso F : \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>) \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\n  proof(intro cat_Set_is_arrI arr_SetI, unfold cat_cs_simps)\n    show \"vfsequence (vrange_iso F)\" \n      unfolding vrange_iso_def by (simp_all add: nat_omega_simps)\n    show \"vsv (vrange_iso F\\<lparr>ArrVal\\<rparr>)\"\n      by (cs_concl cs_intro: cat_cs_intros)\n    then interpret vsv \\<open>vrange_iso F\\<lparr>ArrVal\\<rparr>\\<close> \n      rewrites \"\\<D>\\<^sub>\\<circ> (vrange_iso F\\<lparr>ArrVal\\<rparr>) = \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\"\n      unfolding cat_cs_simps by simp_all\n    show \"vcard (vrange_iso F) = 3\\<^sub>\\<nat>\"\n      unfolding vrange_iso_def by (simp_all add: nat_omega_simps)\n    show \"\\<R>\\<^sub>\\<circ> (vrange_iso F\\<lparr>ArrVal\\<rparr>) \\<subseteq>\\<^sub>\\<circ> A\"\n    proof(intro vsubsetI)\n      fix x assume \"x \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (vrange_iso F\\<lparr>ArrVal\\<rparr>)\"\n      then obtain y where y: \"y \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\"\n        and x_def: \"x = vrange_iso F\\<lparr>ArrVal\\<rparr>\\<lparr>y\\<rparr>\" \n        by (auto dest: vrange_atD)\n      show \"x \\<in>\\<^sub>\\<circ> A\"\n        unfolding x_def\n        by (rule vrange_iso_ArrVal_rules(1)[OF assms y, unfolded cat_cs_simps])\n    qed\n  qed \n    (\n      auto \n        simp: F.arr_Set_ArrDom_in_Vset \n        intro: vrange_in_VsetI F.arr_Rel_ArrVal_in_Vset\n    )\n\nqed\n\nlemma vrange_iso_is_arr':\n  assumes \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\" \n    and \"B' = \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"vrange_iso F : B' \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> A\"\n  using assms(1) unfolding assms(2,3) by (rule vrange_iso_is_arr)\n\nlemma vrange_iso_is_monic_arr:\n  assumes \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n  shows \"vrange_iso F : \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>) \\<mapsto>\\<^sub>m\\<^sub>o\\<^sub>n\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\nproof-\n  note FD = cat_Set_is_arrD[OF assms(1)]\n  interpret F: arr_Set \\<alpha> F\n    rewrites [cat_cs_simps]: \"F\\<lparr>ArrDom\\<rparr> = A\" and [cat_cs_simps]: \"F\\<lparr>ArrCod\\<rparr> = B\"\n    by (intro FD)+\n  show ?thesis\n  proof\n    (\n      intro cat_Set_is_monic_arrI vrange_iso_is_arr, \n      rule assms, \n      rule vsv.vsv_valeq_v11I[OF vrange_iso_ArrVal_vsv], \n      unfold cat_cs_simps\n    )\n    fix x y assume prems:\n      \"x \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\"\n      \"y \\<in>\\<^sub>\\<circ> \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\"\n      \"vrange_iso F\\<lparr>ArrVal\\<rparr>\\<lparr>x\\<rparr> = vrange_iso F\\<lparr>ArrVal\\<rparr>\\<lparr>y\\<rparr>\"    \n    show \"x = y\"\n      by \n        (\n          rule vrange_iso_ArrVal_rules(2)\n            [\n              OF assms prems(1), \n              unfolded prems(3), \n              folded vrange_iso_ArrVal_rules(2)[OF assms prems(2)]\n            ]\n        )\n  qed simp\nqed\n\nlemma vrange_iso_is_monic_arr':\n  assumes \"F : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> B\"\n    and \"B' = \\<R>\\<^sub>\\<circ> (F\\<lparr>ArrVal\\<rparr>)\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"vrange_iso F : B' \\<mapsto>\\<^sub>m\\<^sub>o\\<^sub>n\\<^bsub>\\<CC>'\\<^esub> A\"\n  using assms(1) unfolding assms(2,3) by (rule vrange_iso_is_monic_arr)\n\n\n\nsubsection\\<open>Auxiliary\\<close>\n\n\ntext\\<open>\nThis subsection is reserved for insignificant helper lemmas \nand rules that are used in applied formalization elsewhere.\n\\<close>\n\nlemma (in \\<Z>) cat_Rel_CId_is_cat_Set_arr:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\"\n  shows \"cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> : A \\<mapsto>\\<^bsub>cat_Set \\<alpha>\\<^esub> A\"\nproof-\n  from assms show ?thesis\n    unfolding cat_Rel_components cat_Set_components(6)[symmetric]\n    by \n      (\n        cs_concl cs_shallow \n          cs_simp: cat_Set_components(1) cs_intro: cat_cs_intros\n      )\nqed\n\nlemma (in \\<Z>) cat_Rel_CId_is_cat_Set_arr'[cat_rel_par_Set_cs_intros]:\n  assumes \"A \\<in>\\<^sub>\\<circ> cat_Rel \\<alpha>\\<lparr>Obj\\<rparr>\" \n    and \"B' = A\"\n    and \"C' = A\"\n    and \"\\<CC>' = cat_Set \\<alpha>\"\n  shows \"cat_Rel \\<alpha>\\<lparr>CId\\<rparr>\\<lparr>A\\<rparr> : B' \\<mapsto>\\<^bsub>\\<CC>'\\<^esub> C'\"\n  using assms(1) unfolding assms(2-4) by (rule cat_Rel_CId_is_cat_Set_arr)\n\ntext\\<open>\\newpage\\<close>\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Elementary_Categories/czh_ecategories/CZH_ECAT_Set.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.32243124336694046}}
{"text": "(*  Title:      HOL/Auth/Guard/Guard.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2002  University of Cambridge\n*)\n\nsection\\<open>Protocol-Independent Confidentiality Theorem on Nonces\\<close>\n\ntheory Guard imports Analz Extensions begin\n\n(******************************************************************************\nmessages where all the occurrences of Nonce n are\nin a sub-message of the form Crypt (invKey K) X with K:Ks\n******************************************************************************)\n\ninductive_set\n  guard :: \"nat \\<Rightarrow> key set \\<Rightarrow> msg set\"\n  for n :: nat and Ks :: \"key set\"\nwhere\n  No_Nonce [intro]: \"Nonce n \\<notin> parts {X} \\<Longrightarrow> X \\<in> guard n Ks\"\n| Guard_Nonce [intro]: \"invKey K \\<in> Ks \\<Longrightarrow> Crypt K X \\<in> guard n Ks\"\n| Crypt [intro]: \"X \\<in> guard n Ks \\<Longrightarrow> Crypt K X \\<in> guard n Ks\"\n| Pair [intro]: \"\\<lbrakk>X \\<in> guard n Ks; Y \\<in> guard n Ks\\<rbrakk> \\<Longrightarrow> \\<lbrace>X,Y\\<rbrace> \\<in> guard n Ks\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>guard\\<close>\\<close>\n\nlemma Key_is_guard [iff]: \"Key K \\<in> guard n Ks\"\nby auto\n\nlemma Agent_is_guard [iff]: \"Agent A \\<in> guard n Ks\"\nby auto\n\nlemma Number_is_guard [iff]: \"Number r \\<in> guard n Ks\"\nby auto\n\nlemma Nonce_notin_guard: \"X \\<in> guard n Ks \\<Longrightarrow> X \\<noteq> Nonce n\"\nby (erule guard.induct, auto)\n\nlemma Nonce_notin_guard_iff [iff]: \"Nonce n \\<notin> guard n Ks\"\nby (auto dest: Nonce_notin_guard)\n\nlemma guard_has_Crypt [rule_format]: \"X \\<in> guard n Ks \\<Longrightarrow> Nonce n \\<in> parts {X}\n\\<longrightarrow> (\\<exists>K Y. Crypt K Y \\<in> kparts {X} \\<and> Nonce n \\<in> parts {Y})\"\nby (erule guard.induct, auto)\n\nlemma Nonce_notin_kparts_msg: \"X \\<in> guard n Ks \\<Longrightarrow> Nonce n \\<notin> kparts {X}\"\nby (erule guard.induct, auto)\n\nlemma Nonce_in_kparts_imp_no_guard: \"Nonce n \\<in> kparts H\n\\<Longrightarrow> \\<exists>X. X \\<in> H \\<and> X \\<notin> guard n Ks\"\napply (drule in_kparts, clarify)\napply (rule_tac x=X in exI, clarify)\nby (auto dest: Nonce_notin_kparts_msg)\n\nlemma guard_kparts [rule_format]: \"X \\<in> guard n Ks \\<Longrightarrow>\nY \\<in> kparts {X} \\<longrightarrow> Y \\<in> guard n Ks\"\nby (erule guard.induct, auto)\n\nlemma guard_Crypt: \"\\<lbrakk>Crypt K Y \\<in> guard n Ks; K \\<notin> invKey`Ks\\<rbrakk> \\<Longrightarrow> Y \\<in> guard n Ks\"\n  by (ind_cases \"Crypt K Y \\<in> guard n Ks\") (auto intro!: image_eqI)\n\nlemma guard_MPair [iff]: \"(\\<lbrace>X,Y\\<rbrace> \\<in> guard n Ks) = (X \\<in> guard n Ks \\<and> Y \\<in> guard n Ks)\"\nby (auto, (ind_cases \"\\<lbrace>X,Y\\<rbrace> \\<in> guard n Ks\", auto)+)\n\nlemma guard_not_guard [rule_format]: \"X \\<in> guard n Ks \\<Longrightarrow>\nCrypt K Y \\<in> kparts {X} \\<longrightarrow> Nonce n \\<in> kparts {Y} \\<longrightarrow> Y \\<notin> guard n Ks\"\nby (erule guard.induct, auto dest: guard_kparts)\n\nlemma guard_extand: \"\\<lbrakk>X \\<in> guard n Ks; Ks \\<subseteq> Ks'\\<rbrakk> \\<Longrightarrow> X \\<in> guard n Ks'\"\nby (erule guard.induct, auto)\n\nsubsection\\<open>guarded sets\\<close>\n\ndefinition Guard :: \"nat \\<Rightarrow> key set \\<Rightarrow> msg set \\<Rightarrow> bool\" where\n\"Guard n Ks H \\<equiv> \\<forall>X. X \\<in> H \\<longrightarrow> X \\<in> guard n Ks\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>Guard\\<close>\\<close>\n\nlemma Guard_empty [iff]: \"Guard n Ks {}\"\nby (simp add: Guard_def)\n\nlemma notin_parts_Guard [intro]: \"Nonce n \\<notin> parts G \\<Longrightarrow> Guard n Ks G\"\napply (unfold Guard_def, clarify)\napply (subgoal_tac \"Nonce n \\<notin> parts {X}\")\nby (auto dest: parts_sub)\n\nlemma Nonce_notin_kparts [simplified]: \"Guard n Ks H \\<Longrightarrow> Nonce n \\<notin> kparts H\"\nby (auto simp: Guard_def dest: in_kparts Nonce_notin_kparts_msg)\n\nlemma Guard_must_decrypt: \"\\<lbrakk>Guard n Ks H; Nonce n \\<in> analz H\\<rbrakk> \\<Longrightarrow>\n\\<exists>K Y. Crypt K Y \\<in> kparts H \\<and> Key (invKey K) \\<in> kparts H\"\napply (drule_tac P=\"\\<lambda>G. Nonce n \\<in> G\" in analz_pparts_kparts_substD, simp)\nby (drule must_decrypt, auto dest: Nonce_notin_kparts)\n\nlemma Guard_kparts [intro]: \"Guard n Ks H \\<Longrightarrow> Guard n Ks (kparts H)\"\nby (auto simp: Guard_def dest: in_kparts guard_kparts)\n\nlemma Guard_mono: \"\\<lbrakk>Guard n Ks H; G <= H\\<rbrakk> \\<Longrightarrow> Guard n Ks G\"\nby (auto simp: Guard_def)\n\nlemma Guard_insert [iff]: \"Guard n Ks (insert X H)\n= (Guard n Ks H \\<and> X \\<in> guard n Ks)\"\nby (auto simp: Guard_def)\n\nlemma Guard_Un [iff]: \"Guard n Ks (G Un H) = (Guard n Ks G & Guard n Ks H)\"\nby (auto simp: Guard_def)\n\nlemma Guard_synth [intro]: \"Guard n Ks G \\<Longrightarrow> Guard n Ks (synth G)\"\nby (auto simp: Guard_def, erule synth.induct, auto)\n\nlemma Guard_analz [intro]: \"\\<lbrakk>Guard n Ks G; \\<forall>K. K \\<in> Ks \\<longrightarrow> Key K \\<notin> analz G\\<rbrakk>\n\\<Longrightarrow> Guard n Ks (analz G)\"\napply (auto simp: Guard_def)\napply (erule analz.induct, auto)\nby (ind_cases \"Crypt K Xa \\<in> guard n Ks\" for K Xa, auto)\n\nlemma in_Guard [dest]: \"\\<lbrakk>X \\<in> G; Guard n Ks G\\<rbrakk> \\<Longrightarrow> X \\<in> guard n Ks\"\nby (auto simp: Guard_def)\n\nlemma in_synth_Guard: \"\\<lbrakk>X \\<in> synth G; Guard n Ks G\\<rbrakk> \\<Longrightarrow> X \\<in> guard n Ks\"\nby (drule Guard_synth, auto)\n\nlemma in_analz_Guard: \"\\<lbrakk>X \\<in> analz G; Guard n Ks G;\n\\<forall>K. K \\<in> Ks \\<longrightarrow> Key K \\<notin> analz G\\<rbrakk> \\<Longrightarrow> X \\<in> guard n Ks\"\nby (drule Guard_analz, auto)\n\nlemma Guard_keyset [simp]: \"keyset G \\<Longrightarrow> Guard n Ks G\"\nby (auto simp: Guard_def)\n\nlemma Guard_Un_keyset: \"\\<lbrakk>Guard n Ks G; keyset H\\<rbrakk> \\<Longrightarrow> Guard n Ks (G \\<union> H)\"\nby auto\n\nlemma in_Guard_kparts: \"\\<lbrakk>X \\<in> G; Guard n Ks G; Y \\<in> kparts {X}\\<rbrakk> \\<Longrightarrow> Y \\<in> guard n Ks\"\nby blast\n\nlemma in_Guard_kparts_neq: \"\\<lbrakk>X \\<in> G; Guard n Ks G; Nonce n' \\<in> kparts {X}\\<rbrakk>\n\\<Longrightarrow> n \\<noteq> n'\"\nby (blast dest: in_Guard_kparts)\n\nlemma in_Guard_kparts_Crypt: \"\\<lbrakk>X \\<in> G; Guard n Ks G; is_MPair X;\nCrypt K Y \\<in> kparts {X}; Nonce n \\<in> kparts {Y}\\<rbrakk> \\<Longrightarrow> invKey K \\<in> Ks\"\napply (drule in_Guard, simp)\napply (frule guard_not_guard, simp+)\napply (drule guard_kparts, simp)\nby (ind_cases \"Crypt K Y \\<in> guard n Ks\", auto)\n\nlemma Guard_extand: \"\\<lbrakk>Guard n Ks G; Ks \\<subseteq> Ks'\\<rbrakk> \\<Longrightarrow> Guard n Ks' G\"\nby (auto simp: Guard_def dest: guard_extand)\n\nlemma guard_invKey [rule_format]: \"\\<lbrakk>X \\<in> guard n Ks; Nonce n \\<in> kparts {Y}\\<rbrakk> \\<Longrightarrow>\nCrypt K Y \\<in> kparts {X} \\<longrightarrow> invKey K \\<in> Ks\"\nby (erule guard.induct, auto)\n\nlemma Crypt_guard_invKey [rule_format]: \"\\<lbrakk>Crypt K Y \\<in> guard n Ks;\nNonce n \\<in> kparts {Y}\\<rbrakk> \\<Longrightarrow> invKey K \\<in> Ks\"\nby (auto dest: guard_invKey)\n\nsubsection\\<open>set obtained by decrypting a message\\<close>\n\nabbreviation (input)\n  decrypt :: \"msg set => key => msg => msg set\" where\n  \"decrypt H K Y == insert Y (H - {Crypt K Y})\"\n\nlemma analz_decrypt: \"\\<lbrakk>Crypt K Y \\<in> H; Key (invKey K) \\<in> H; Nonce n \\<in> analz H\\<rbrakk>\n\\<Longrightarrow> Nonce n \\<in> analz (decrypt H K Y)\"\napply (drule_tac P=\"\\<lambda>H. Nonce n \\<in> analz H\" in ssubst [OF insert_Diff])\napply assumption\napply (simp only: analz_Crypt_if, simp)\ndone\n\nlemma parts_decrypt: \"\\<lbrakk>Crypt K Y \\<in> H; X \\<in> parts (decrypt H K Y)\\<rbrakk> \\<Longrightarrow> X \\<in> parts H\"\nby (erule parts.induct, auto intro: parts.Fst parts.Snd parts.Body)\n\nsubsection\\<open>number of Crypt's in a message\\<close>\n\nfun crypt_nb :: \"msg => nat\"\nwhere\n  \"crypt_nb (Crypt K X) = Suc (crypt_nb X)\"\n| \"crypt_nb \\<lbrace>X,Y\\<rbrace> = crypt_nb X + crypt_nb Y\"\n| \"crypt_nb X = 0\" (* otherwise *)\n\nsubsection\\<open>basic facts about \\<^term>\\<open>crypt_nb\\<close>\\<close>\n\nlemma non_empty_crypt_msg: \"Crypt K Y \\<in> parts {X} \\<Longrightarrow> crypt_nb X \\<noteq> 0\"\nby (induct X, simp_all, safe, simp_all)\n\nsubsection\\<open>number of Crypt's in a message list\\<close>\n\nprimrec cnb :: \"msg list => nat\"\nwhere\n  \"cnb [] = 0\"\n| \"cnb (X#l) = crypt_nb X + cnb l\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>cnb\\<close>\\<close>\n\nlemma cnb_app [simp]: \"cnb (l @ l') = cnb l + cnb l'\"\nby (induct l, auto)\n\nlemma mem_cnb_minus: \"x \\<in> set l \\<Longrightarrow> cnb l = crypt_nb x + (cnb l - crypt_nb x)\"\n  by (induct l) auto\n\nlemmas mem_cnb_minus_substI = mem_cnb_minus [THEN ssubst]\n\nlemma cnb_minus [simp]: \"x \\<in> set l \\<Longrightarrow> cnb (remove l x) = cnb l - crypt_nb x\"\napply (induct l, auto)\napply (erule_tac l=l and x=x in mem_cnb_minus_substI)\napply simp\ndone\n\nlemma parts_cnb: \"Z \\<in> parts (set l) \\<Longrightarrow>\ncnb l = (cnb l - crypt_nb Z) + crypt_nb Z\"\nby (erule parts.induct, auto simp: in_set_conv_decomp)\n\nlemma non_empty_crypt: \"Crypt K Y \\<in> parts (set l) \\<Longrightarrow> cnb l \\<noteq> 0\"\nby (induct l, auto dest: non_empty_crypt_msg parts_insert_substD)\n\nsubsection\\<open>list of kparts\\<close>\n\nlemma kparts_msg_set: \"\\<exists>l. kparts {X} = set l \\<and> cnb l = crypt_nb X\"\napply (induct X, simp_all)\napply (rename_tac agent, rule_tac x=\"[Agent agent]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Number nat]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Nonce nat]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Key nat]\" in exI, simp)\napply (rename_tac X, rule_tac x=\"[Hash X]\" in exI, simp)\napply (clarify, rule_tac x=\"l@la\" in exI, simp)\nby (clarify, rename_tac nat X y, rule_tac x=\"[Crypt nat X]\" in exI, simp)\n\nlemma kparts_set: \"\\<exists>l'. kparts (set l) = set l' \\<and> cnb l' = cnb l\"\napply (induct l)\napply (rule_tac x=\"[]\" in exI, simp, clarsimp)\napply (rename_tac a b l')\napply (subgoal_tac \"\\<exists>l''.  kparts {a} = set l'' \\<and> cnb l'' = crypt_nb a\", clarify)\napply (rule_tac x=\"l''@l'\" in exI, simp)\napply (rule kparts_insert_substI, simp)\nby (rule kparts_msg_set)\n\nsubsection\\<open>list corresponding to \"decrypt\"\\<close>\n\ndefinition decrypt' :: \"msg list => key => msg => msg list\" where\n\"decrypt' l K Y == Y # remove l (Crypt K Y)\"\n\ndeclare decrypt'_def [simp]\n\nsubsection\\<open>basic facts about \\<^term>\\<open>decrypt'\\<close>\\<close>\n\nlemma decrypt_minus: \"decrypt (set l) K Y <= set (decrypt' l K Y)\"\nby (induct l, auto)\n\nsubsection\\<open>if the analyse of a finite guarded set gives n then it must also gives\none of the keys of Ks\\<close>\n\nlemma Guard_invKey_by_list [rule_format]: \"\\<forall>l. cnb l = p\n\\<longrightarrow> Guard n Ks (set l) \\<longrightarrow> Nonce n \\<in> analz (set l)\n\\<longrightarrow> (\\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz (set l))\"\napply (induct p)\n(* case p=0 *)\napply (clarify, drule Guard_must_decrypt, simp, clarify)\napply (drule kparts_parts, drule non_empty_crypt, simp)\n(* case p>0 *)\napply (clarify, frule Guard_must_decrypt, simp, clarify)\napply (drule_tac P=\"\\<lambda>G. Nonce n \\<in> G\" in analz_pparts_kparts_substD, simp)\napply (frule analz_decrypt, simp_all)\napply (subgoal_tac \"\\<exists>l'. kparts (set l) = set l' \\<and> cnb l' = cnb l\", clarsimp)\napply (drule_tac G=\"insert Y (set l' - {Crypt K Y})\"\nand H=\"set (decrypt' l' K Y)\" in analz_sub, rule decrypt_minus)\napply (rule_tac analz_pparts_kparts_substI, simp)\napply (case_tac \"K \\<in> invKey`Ks\")\n(* K:invKey`Ks *)\napply (clarsimp, blast)\n(* K ~:invKey`Ks *)\napply (subgoal_tac \"Guard n Ks (set (decrypt' l' K Y))\")\napply (drule_tac x=\"decrypt' l' K Y\" in spec, simp)\napply (subgoal_tac \"Crypt K Y \\<in> parts (set l)\")\napply (drule parts_cnb, rotate_tac -1, simp)\napply (clarify, drule_tac X=\"Key Ka\" and H=\"insert Y (set l')\" in analz_sub)\napply (rule insert_mono, rule set_remove)\napply (simp add: analz_insertD, blast)\n(* Crypt K Y:parts (set l) *)\napply (blast dest: kparts_parts)\n(* Guard n Ks (set (decrypt' l' K Y)) *)\napply (rule_tac H=\"insert Y (set l')\" in Guard_mono)\napply (subgoal_tac \"Guard n Ks (set l')\", simp)\napply (rule_tac K=K in guard_Crypt, simp add: Guard_def, simp)\napply (drule_tac t=\"set l'\" in sym, simp)\napply (rule Guard_kparts, simp, simp)\napply (rule_tac B=\"set l'\" in subset_trans, rule set_remove, blast)\nby (rule kparts_set)\n\nlemma Guard_invKey_finite: \"\\<lbrakk>Nonce n \\<in> analz G; Guard n Ks G; finite G\\<rbrakk>\n\\<Longrightarrow> \\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz G\"\napply (drule finite_list, clarify)\nby (rule Guard_invKey_by_list, auto)\n\nlemma Guard_invKey: \"\\<lbrakk>Nonce n \\<in> analz G; Guard n Ks G\\<rbrakk>\n\\<Longrightarrow> \\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz G\"\nby (auto dest: analz_needs_only_finite Guard_invKey_finite)\n\nsubsection\\<open>if the analyse of a finite guarded set and a (possibly infinite) set of keys\ngives n then it must also gives Ks\\<close>\n\nlemma Guard_invKey_keyset: \"\\<lbrakk>Nonce n \\<in> analz (G \\<union> H); Guard n Ks G; finite G;\nkeyset H\\<rbrakk> \\<Longrightarrow> \\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz (G \\<union> H)\"\napply (frule_tac P=\"\\<lambda>G. Nonce n \\<in> G\" and G=G in analz_keyset_substD, simp_all)\napply (drule_tac G=\"G Un (H Int keysfor G)\" in Guard_invKey_finite)\nby (auto simp: Guard_def intro: analz_sub)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/Guard/Guard.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3223918166144111}}
{"text": "theory Program_Analysis\n  imports\n    UPPAAL_State_Networks_Impl\n    TA_Library.More_Methods\n    \"HOL-Library.Lattice_Syntax\"\nbegin\n\n(*\nfun step_approx :: \"instr \\<Rightarrow> addr set\" where\n  \"step_approx (JMPZ q) (pc, _) = {pc + 1, q}\" |\n  \"step_approx CALL (pc, q # st, _) = {nat q}\n    (if q \\<ge> 0 then Some (nat q, int pc # st, m, f, rs) else None)\" |\n  \"step RETURN (pc, q # st, m, f, rs) =\n    (if q \\<ge> 0 then Some (nat q + 1, st, m, f, rs) else None)\" |\n  (*\n  \"step HALT s = Some s\" |\n  *)\n  \"step (STOREC c d) (pc, st, m, f, rs) =\n    (if d = 0 then Some (pc + 1, st, m, f, c # rs) else None)\" |\n  \"step (SETF b) (pc, st, m, f, rs) = Some (pc + 1, st, m, b, rs)\" |\n  \"step _ _ = None\"\n*)\n\nfun steps_approx :: \"nat \\<Rightarrow> 't instrc option list \\<Rightarrow> addr \\<Rightarrow> addr set\" where\n  \"steps_approx 0 prog pc = (if pc < length prog then {pc} else {})\" |\n  \"steps_approx (Suc n) prog pc =\n    (\n      if pc \\<ge> length prog\n      then {}\n      else\n        case prog ! pc of\n          None \\<Rightarrow> {pc}\n        | Some cmd \\<Rightarrow>\n          let succs =\n            (\n              case cmd of\n                CEXP ac \\<Rightarrow> {pc + 1}\n              | INSTR instr \\<Rightarrow>\n                  case instr of\n                    CALL   \\<Rightarrow> {..<length prog}\n                  | RETURN \\<Rightarrow> {..<length prog}\n                  | JMPZ pc' \\<Rightarrow> {pc + 1, pc'}\n                  | HALT \\<Rightarrow> {}\n                  |    _ \\<Rightarrow> {pc + 1}\n            )\n          in {pc} \\<union> \\<Union> (steps_approx n prog ` succs)\n    )\n  \"\n\nlemma bounded_less_simp[simp]:\n  \"\\<forall>q\\<in>{..<p::nat}. P q \\<equiv> \\<forall> q < p. P q\"\n  by (rule eq_reflection) auto\n\ncontext\n  fixes prog :: \"int instrc option list\"\n    and strip :: \"real instrc \\<Rightarrow> instr\"\n  assumes instr_id[simp]:\n    \"strip (INSTR cmd) = cmd\"\n    \"strip (CEXP ac) \\<notin> {CALL, RETURN, HALT} \\<union> (JMPZ ` UNIV)\"\nbegin\n\n(* XXX This is some idiosyncracy of Isabelle's context management *)\n(* We could move this to a different file but rather would like to introduce a private namespace\n   on the spot\n*)\nprivate definition [simp]:\n  \"P' \\<equiv> map_option strip o (conv_prog (\\<lambda> i. if i < length prog then prog ! i else None))\"\n\nlemma steps_out_of_range':\n  assumes \"steps P' n (pc, st, s, f, rs) (pc', st', s', f', rs')\" \"pc \\<ge> length prog\"\n  shows \"pc' = pc\"\n  using assms by cases (auto simp: striptp_def)\n\nlemmas steps_out_of_range = steps_out_of_range'[unfolded striptp_def P'_def]\n\nlemma steps_steps_approx':\n  assumes \"steps P' n (pc, st, s, f, rs) (pc', st', s', f', rs')\" \"pc' < length prog\"\n  shows \"pc' \\<in> steps_approx n prog pc\"\n  using assms\n  apply (\n      induction P' n \"(pc, st, s, f, rs)\" \"(pc', st', s', f', rs')\"\n      arbitrary: pc st s f rs rule: steps.induct\n      )\n   apply (simp split: option.split)\n  apply clarsimp\n  apply rule\n   apply (simp add: striptp_def split: if_split_asm; fail)\n  apply (clarsimp split: option.split)\n  apply rule\n   apply (auto simp add: striptp_def split: if_split_asm; fail)\n  apply safe\n  apply (case_tac x2)\n   apply (simp split: option.split_asm if_split_asm)\n   apply (case_tac x1)\n                    apply (auto split: if_split_asm; fail)\n                   apply (auto split: if_split_asm elim: UPPAAL_Asm.step.elims; fail)\n                  apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n                 apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n                apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n               apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n              apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n             apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n            apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n           apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n          apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n         apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n        apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n       apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n       apply (case_tac \"q < length prog\")\n        apply force\n       apply (drule steps_out_of_range; simp; fail)\n      apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n      apply (case_tac \"q + 1 < length prog\")\n       apply force\n      apply (drule steps_out_of_range; simp)\n     apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n    apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n   apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm; fail)\n  using instr_id by (fastforce split: if_split_asm elim!: UPPAAL_Asm.step.elims)\n\nlemmas steps_steps_approx = steps_steps_approx'[unfolded P'_def]\n\nend (* End of context for fixed program *)\n\n\ncontext\n  fixes prog :: \"int instrc option list\"\nbegin\n\nprivate abbreviation \"P i \\<equiv> if i < length prog then prog ! i else None\"\n\nlemma stepsc_out_of_range:\n  assumes \"stepsc (conv_prog P) n u (pc, st, s, f, rs) (pc', st', s', f', rs')\" \"pc \\<ge> length prog\"\n  shows \"pc' = pc\"\n  using assms by cases auto\n\nlemma stepsc_steps_approx:\n  assumes \"stepsc (conv_prog P) n u (pc, st, s, f, rs) (pc', st', s', f', rs')\" \"pc' < length prog\"\n  shows \"pc' \\<in> steps_approx n prog pc\"\n  using assms\n  apply (\n      induction \"conv_prog P\" n u \"(pc, st, s, f, rs)\" \"(pc', st', s', f', rs')\"\n      arbitrary: pc st s f rs rule: stepsc.induct\n      )\n   apply (simp split: option.split)\n  apply clarsimp\n  apply rule\n   apply (simp split: if_split_asm; fail)\n  apply (clarsimp split: option.split)\n  apply rule\n   apply (simp split: if_split_asm; fail)\n  apply (case_tac z)\n   apply (simp split: option.split_asm if_split_asm)\n   apply (case_tac x1)\n                    apply (simp split: if_split_asm)\n                   apply (auto elim: UPPAAL_Asm.step.elims)[]\n                  apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n                 apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n                apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n               apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n              apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n             apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n            apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n           apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n          apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n         apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n        apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n       apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n       apply (case_tac \"q < length prog\")\n        apply force\n       apply (drule stepsc_out_of_range; simp)\n      apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n      apply (case_tac \"q + 1 < length prog\")\n       apply force\n      apply (drule stepsc_out_of_range; simp)\n     apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n    apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n   apply (auto elim!: UPPAAL_Asm.step.elims split: if_split_asm)[]\n  by (force split: if_split_asm)\n\ndefinition\n  \"time_indep_check pc n \\<equiv>\n    \\<forall> pc' \\<in> steps_approx n prog pc. pc' < length prog\n    \\<longrightarrow> (case prog ! pc' of Some cmd \\<Rightarrow> is_instr cmd | _ \\<Rightarrow> True)\"\n\nlemma time_indep_overapprox:\n  assumes\n    \"time_indep_check pc n\"\n  shows \"time_indep (conv_prog P) n (pc, st, s, f, rs)\"\nproof -\n  { fix pc' st' s' f' rs' cmd u\n    assume A:\n      \"stepsc (conv_prog local.P) n u (pc, st, s, f, rs) (pc', st', s', f', rs')\"\n      \"conv_prog local.P pc' = Some cmd\"\n    have \"is_instr cmd\"\n    proof (cases \"pc' < length prog\")\n      case True\n      with A(2) obtain cmd' where \"prog ! pc' = Some cmd'\" by auto\n      with True stepsc_steps_approx[OF A(1)] A(2) assms show ?thesis\n        by (cases cmd') (auto simp: time_indep_check_def)\n    next\n      case False\n      with A(2) show ?thesis by (auto split: option.split_asm)\n    qed\n  }\n  then show ?thesis unfolding time_indep_def by blast\nqed\n\nend (* End of context for fixed program *)\n\ncontext UPPAAL_Reachability_Problem_precompiled_defs\nbegin\n\n  definition\n    \"collect_cexp' pc = {ac. Some (CEXP ac) \\<in> ((!) prog) ` steps_approx max_steps prog pc}\"\n\n  definition \"clkp_set'' i l \\<equiv>\n    collect_clock_pairs (inv ! i ! l) \\<union>\n    \\<Union> ((\\<lambda> (g, _). constraint_pair ` collect_cexp' g) ` set (trans ! i ! l))\"\n\n  definition\n    \"collect_cexp = {ac. Some (CEXP ac) \\<in> set prog}\"\n\n  definition\n    \"collect_store' pc =\n    {(c, x). Some (INSTR (STOREC c x)) \\<in> ((!) prog) ` steps_approx max_steps prog pc}\"\n\nend\n\n(* XXX Unused *)\n(* XXX Move *)\nlemma visited_resets_mono:\n  \"set r \\<subseteq> set r'\" if \"visited P n (pc, st, s, f, r) (pc', st', s', f', r') pcs\"\n  using that\n  apply (\n    induction P \\<equiv> P n \"(pc, st, s, f, r :: nat list)\" \"(pc', st', s', f', r')\" pcs\n    arbitrary: pc st s f r  rule: visited.induct\n    )\n   apply blast\n  by (erule step.elims; force split: option.splits if_splits elim!: step.elims)+\n\n(* XXX Unused *)\n(* XXX Move *)\nlemma visitedc_resets_mono:\n  \"set r \\<subseteq> set r'\" if \"visitedc P n u (pc, st, s, f, r) (pc', st', s', f', r') pcs\"\n  using that\n  apply (\n    induction P \\<equiv> P n u \"(pc, st, s, f, r :: nat list)\" \"(pc', st', s', f', r')\" pcs\n    arbitrary: pc st s f r  rule: visitedc.induct\n    )\n   apply blast\n  by (erule stepc.elims; force split: option.splits if_splits elim!: step.elims)+\n\n(* XXX Move *)\nlemma visited_reset:\n  \"\\<exists> x. \\<exists> pc \\<in> set pcs. Some (STOREC c x) = P pc\"\n  if \"visited P n (pc, st, s, f, r) (pc', st', s', f', r') pcs\" \"c \\<in> set r' - set r\"\n  using that\n  apply (\n      induction P \\<equiv> P n \"(pc, st, s, f, r :: nat list)\" \"(pc', st', s', f', r')\" pcs\n      arbitrary: pc st s f r rule: visited.induct\n      )\n   apply blast\n  by (erule step.elims; force split: option.split_asm if_split_asm elim!: step.elims)\n\n(* XXX Move *)\nlemma visitedc_reset:\n  \"\\<exists> x. \\<exists> pc \\<in> set pcs. Some (INSTR (STOREC c x)) = P pc\"\n  if \"visitedc P n u (pc, st, s, f, r) (pc', st', s', f', r') pcs\" \"c \\<in> set r' - set r\"\n  using that\n  apply (\n      induction P \\<equiv> P n u \"(pc, st, s, f, r :: nat list)\" \"(pc', st', s', f', r')\" pcs\n      arbitrary: pc st s f r rule: visitedc.induct\n      )\n   apply blast\n  by (erule stepc.elims; force split: option.split_asm if_split_asm elim!: step.elims)\n\n(* TTT Automate *)\nlemma visited_fuel_mono:\n  \"visited P n' s s' pcs\" if \"visited P n s s' pcs\" \"n' \\<ge> n\"\n  using that\n  apply (induction arbitrary: n')\n  subgoal for _ _ _ n'\n    by (cases n') (auto intro: visited.intros)\n  subgoal for _ _ _ _ _ _ _ _ _ _ _ n'\n    by (cases n') (auto intro: visited.intros)\n  done\n\n(* TTT Automate *)\nlemma visitedc_fuel_mono:\n  \"visitedc P n' u s s' pcs\" if \"visitedc P n u s s' pcs\" \"n' \\<ge> n\"\n  using that\n  apply (induction arbitrary: n')\n  subgoal for _ _ _ _ n'\n    by (cases n') (auto intro: visitedc.intros)\n  subgoal for _ _ _ _ _ _ _ _ _ _ _ _ n'\n    by (cases n') (auto intro: visitedc.intros)\n  done\n\nlemma visted_split:\n  assumes \"visited P n (pc, st, s, f, r) s'' (pcs' @ pc' # pcs)\"\n  obtains st' s' f' r' where\n    \"visited P n (pc, st, s, f, r) (pc', st', s', f', r') pcs\"\n    \"visited P n (pc', st', s', f', r') s'' (pcs' @ [pc'])\"\n  using assms\n    apply atomize_elim\n  proof (induction _ _ _ _ \"pcs' @ pc' # pcs\" arbitrary: pcs rule: visited.induct)\n    case (1 prog n u start)\n    then show ?case by simp\n  next\n    case prems: (2 cmd pc st m f rs s prog n s' pcs pcs'')\n    show ?case\n    proof (cases \"pcs'' = []\")\n      case True\n      with prems show ?thesis by (blast intro: visited.intros)\n    next\n      case False\n      with \\<open>pcs @ [pc] = _\\<close> obtain pcs3 where \"pcs'' = pcs3 @ [pc]\"\n        by (metis append_butlast_last_id last_ConsR last_append last_snoc list.distinct(1))\n      with prems obtain st' s'a f' r' where\n        \"visited prog n s (pc', st', s'a, f', r') pcs3\"\n        \"visited prog n (pc', st', s'a, f', r') s' (pcs' @ [pc'])\"\n        by (auto 9 2)\n      with prems \\<open>pcs'' = _\\<close> show ?thesis by (auto 4 6 intro: visited.intros visited_fuel_mono)\n    qed\n  qed\n\nlemma visited_steps':\n  assumes \"visited P n (pc, st, s, f, r) s'' pcs\" \"pc' \\<in> set pcs\"\n  obtains st' s' f' r' where \"steps P n (pc, st, s, f, r) (pc', st', s', f', r')\"\n  using assms by (force dest!: split_list dest: visited_steps elim: visted_split)\n\nlemma vistedc_split:\n  assumes \"visitedc P n u (pc, st, s, f, r) s'' (pcs' @ pc' # pcs)\"\n  obtains st' s' f' r' where\n    \"visitedc P n u (pc, st, s, f, r) (pc', st', s', f', r') pcs\"\n    \"visitedc P n u (pc', st', s', f', r') s'' (pcs' @ [pc'])\"\n  using assms\n    apply atomize_elim\n  proof (induction _ _ _ _ _ \"pcs' @ pc' # pcs\" arbitrary: pcs rule: visitedc.induct)\n    case (1 prog n u start)\n    then show ?case by simp\n  next\n    case prems: (2 cmd u pc st m f rs s prog n s' pcs pcs'')\n    show ?case\n    proof (cases \"pcs'' = []\")\n      case True\n      with prems show ?thesis by (blast intro: visitedc.intros)\n    next\n      case False\n      with \\<open>pcs @ [pc] = _\\<close> obtain pcs3 where \"pcs'' = pcs3 @ [pc]\"\n        by (metis append_butlast_last_id last_ConsR last_append last_snoc list.distinct(1))\n      with prems obtain st' s'a f' r' where\n        \"visitedc prog n u s (pc', st', s'a, f', r') pcs3\"\n        \"visitedc prog n u (pc', st', s'a, f', r') s' (pcs' @ [pc'])\"\n        by (auto 9 2)\n      with prems \\<open>pcs'' = _\\<close> show ?thesis by (auto 4 6 intro: visitedc.intros visitedc_fuel_mono)\n    qed\n  qed\n\nlemma visitedc_stepsc':\n  assumes \"visitedc P n u (pc, st, s, f, r) s'' pcs\" \"pc' \\<in> set pcs\"\n  obtains st' s' f' r' where \"stepsc P n u (pc, st, s, f, r) (pc', st', s', f', r')\"\n  using assms  by (force dest!: split_list dest: visitedc_stepsc elim: vistedc_split)\n\n(* XXX Automate *)\nlemma steps_fuel_mono:\n  \"steps P n' s s'\" if \"steps P n s s'\" \"n' \\<ge> n\"\n  using that\n  apply (induction arbitrary: n')\n  subgoal for _ _ _ n'\n    by (cases n') auto\n  subgoal for _ _ _ _ _ _ _ _ _ _ n'\n    by (cases n') auto\n  done\n\nlemma exec_steps':\n  assumes \"exec prog n s pcs = Some (s', pcs')\" \"pc' \\<in> set pcs' - set pcs\"\n  obtains st m f rs where \"steps prog n s (pc', st, m, f, rs)\"\n  using assms\n    apply atomize_elim\nproof (induction P \\<equiv> prog n s pcs arbitrary: s' rule: exec.induct)\n  case 1\n  then show ?case by simp\nnext\n  case (2 n pc st m f rs pcs)\n  then obtain instr where \"prog pc = Some instr\" by (cases \"prog pc\") auto\n  show ?case\n  proof (cases \"instr = HALT\")\n    case True\n    with \"2.prems\" \\<open>prog pc = _\\<close> show ?thesis by (auto; blast)\n  next\n    case F: False\n    show ?thesis\n    proof (cases \"pc' = pc\")\n      case True\n      with \\<open>prog pc = _\\<close> show ?thesis by (auto; blast)\n    next\n      case False\n      (* XXX A lot of implicit forward reasoning hides in here *)\n      with \\<open>prog pc = _\\<close> 2(2,3) F show ?thesis\n        by - (\n          erule exec.elims;\n          auto 5 6\n            dest!: 2(1)[OF \\<open>prog pc = _\\<close> F, rotated, OF sym]\n            simp: option.split_asm if_split_asm\n          )\n    qed\n  qed\nqed\n\nlemma exec_visited:\n  assumes \"exec prog n s pcs = Some ((pc, st, m, f, rs), pcs')\"\n  obtains pcs'' where\n    \"visited prog n s (pc, st, m, f, rs) pcs'' \\<and> pcs' = pc # pcs'' @ pcs \\<and> prog pc = Some HALT\"\n  apply atomize_elim\n  using assms proof (induction P \\<equiv> prog n s pcs arbitrary: pc st m f rs rule: exec.induct)\n  case 1\n  then show ?case by simp\nnext\n  case (2 n pc' st' m' f' rs' pcs')\n  then obtain instr where \"prog pc' = Some instr\" by (cases \"prog pc'\") auto\n  show ?case\n  proof (cases \"instr = HALT\")\n    case True\n    with \"2.prems\" \\<open>prog pc' = _\\<close> show ?thesis by (auto elim: exec.elims intro: visited.intros)\n  next\n    case False\n    with 2(2) \\<open>prog pc' = _\\<close> show ?thesis\n      by - (\n          erule exec.elims;\n          auto split: option.split_asm if_split_asm intro: visited.intros\n          dest!: 2(1)[OF \\<open>prog pc' = _\\<close> False, rotated, OF sym]\n          )\n  qed\nqed\n\nlemma exec_reset':\n  \"\\<exists> x. \\<exists> pc \\<in> set pcs'. Some (STOREC c x) = P pc\"\n  if \"exec P n (pc, st, s, f, r) pcs = Some ((pc', st', s', f', r'), pcs')\" \"c \\<in> set r' - set r\"\nproof -\n  from exec_visited[OF that(1)] obtain pcs'' where *:\n    \"visited P n (pc, st, s, f, r) (pc', st', s', f', r') pcs''\"\n    \"pcs' = pc' # pcs'' @ pcs \\<and> P pc' = Some HALT\"\n    by auto\n  from visited_reset[OF this(1) that(2)] obtain x pc where\n    \"pc\\<in>set pcs''\" \"Some (STOREC c x) = P pc\"\n    by auto\n  with *(2) show ?thesis by auto\nqed\n\nlemma steps_approx_out_of_range:\n  \"steps_approx n prog pc = {}\" if \"pc \\<ge> length prog\"\n  using that by (induction n) auto\n\nlemma steps_resets_mono:\n  \"set r \\<subseteq> set r'\" if \"steps P n (pc, st, s, f, r) (pc', st', s', f', r')\"\n  using that\n  by (induction \"(pc, st, s, f, r)\" \"(pc', st', s', f', r')\" arbitrary: pc st s f r;\n      fastforce intro: visited.intros elim!: step.elims split: if_split_asm)\n\nlemma resets_start:\n  assumes\n    \"\\<forall> pc \\<in> {pc..pc'}. \\<exists> c x. prog ! pc = Some (INSTR (STOREC c x))\"\n    \"steps\n      (map_option stripf o (\\<lambda>pc. if pc < size prog then prog ! pc else None))\n      n (pc, st, s, f, r) (pc_t, st', s', f', r')\"\n    \"prog ! pc_t = Some (INSTR HALT)\"\n  shows \"{c. \\<exists> x. \\<exists> pc \\<in> {pc .. pc'}. prog ! pc = Some (INSTR (STOREC c x))} \\<subseteq> set r'\"\n    using assms(2,3,1)\n  proof (induction\n    \"(map_option stripf o (\\<lambda>pc. if pc < size prog then prog ! pc else None))\" n \"(pc, st, s, f, r)\"\n    \"(pc_t, st', s', f', r')\" arbitrary: pc st s f r\n    )\n      case prems: 1\n      show ?case\n      proof (cases \"pc' \\<ge> pc_t\")\n        case True (* XXX Automate forward step *)\n        with prems obtain c x where \"prog ! pc_t = Some (INSTR (STOREC c x))\"\n          by fastforce\n        with prems show ?thesis by simp\n      next\n        case False\n        with prems show ?thesis by auto\n      qed\n    next\n      case prems: (2 cmd pc st m f rs s n)\n      show ?case\n      proof (cases \"pc' \\<ge> pc\")\n        case True (* XXX Automate forward step *)\n        with prems(6) obtain c d where \"prog ! pc = Some (INSTR (STOREC c d))\"\n          by fastforce\n        moreover obtain pc1 st' s' f' r1 where \"s = (pc1, st', s', f', r1)\"\n          using prod.exhaust by metis\n        ultimately have \"pc1 = pc + 1\"\n          using prems(1,2) by (auto elim!: step.elims split: if_split_asm)\n        with prems(4)[OF \\<open>s = _\\<close> prems(5)] prems(6) have\n          \"{c. \\<exists>x. \\<exists>pc\\<in>{pc1..pc'}. prog ! pc = Some (INSTR (STOREC c x))} \\<subseteq> set r'\"\n          by auto\n        moreover have \"c \\<in> set r1\"\n          using prems(1,2) \\<open>s = _\\<close> \\<open>prog ! pc = _\\<close> by (auto elim!: step.elims split: if_split_asm)\n        moreover then have \"c \\<in> set r'\"\n          using prems(3) \\<open>s = _\\<close> by (auto dest: steps_resets_mono)\n        ultimately show ?thesis\n          using \\<open>pc1 = _\\<close> \\<open>prog ! pc = _\\<close> apply clarsimp\n          subgoal for _ _ pc''\n            by (cases \"pc'' = pc\"; force)\n          done\n      next\n        case False\n        then show ?thesis by auto\n      qed\n    qed\n\nfunction find_resets_start where\n  \"find_resets_start prog pc =\n    (\n    if pc < length prog\n    then\n      case prog ! pc of\n        Some (INSTR (STOREC c x)) \\<Rightarrow> (Some pc \\<squnion> find_resets_start prog (pc + 1)) |\n        _ \\<Rightarrow> None\n    else None\n    )\n  \"\n  by auto\n\ntermination\n  by (relation \"measure (\\<lambda> (prog, pc). length prog - pc)\") auto\n\nlemma find_resets_start:\n  \"\\<forall> pc \\<in> {pc..pc'}. \\<exists> c x. prog ! pc = Some (INSTR (STOREC c x))\" if\n  \"find_resets_start prog pc = Some pc'\"\n  using that\n  proof (induction arbitrary: pc' rule: find_resets_start.induct)\n    case prems: (1 prog pc)\n    from prems(2) show ?case\n      apply (simp split: if_split_asm option.split_asm instrc.split_asm)\n      apply (\n          auto simp del: find_resets_start.simps simp: le_max_iff_disj sup_nat_def sup_option_def\n          split: option.split_asm instr.split_asm dest!: prems(1)\n          )\n      by (metis atLeastAtMost_iff le_antisym not_less_eq_eq)\n  qed\n\nlemmas resets_start' = resets_start[OF find_resets_start]\n\ncontext UPPAAL_Reachability_Problem_precompiled_defs\nbegin\n\n  definition\n    \"collect_store'' pc \\<equiv>\n    case find_resets_start prog pc of\n      None \\<Rightarrow> {} |\n      Some pc' \\<Rightarrow>\n        {(c, x). Some (INSTR (STOREC c x)) \\<in> ((!) prog) ` {pc .. pc'}}\"\n\nend\n\n(* XXX Move to Misc *)\n(* XXX Unused *)\nlemma bexp_atLeastAtMost_iff:\n  \"(\\<forall> pc \\<in> {pc_s..pc_t}. P pc) \\<longleftrightarrow> (\\<forall> pc. pc_s \\<le> pc \\<and> pc \\<le> pc_t \\<longrightarrow> P pc)\"\n  by auto\n\n(* XXX Move to Misc *)\n(* XXX Unused *)\nlemma bexp_atLeastLessThan_iff:\n  \"(\\<forall> pc \\<in> {pc_s..<pc_t}. P pc) \\<longleftrightarrow> (\\<forall> pc. pc_s \\<le> pc \\<and> pc < pc_t \\<longrightarrow> P pc)\"\n  by auto\n\nlemma guaranteed_execution:\n  assumes\n    \"\\<forall> pc \\<in> {pc..<pc_t}.\n      prog ! pc \\<noteq> None\n      \\<and> prog ! pc \\<notin> Some ` INSTR `\n        {STORE, HALT, POP, CALL, RETURN, instr.AND, instr.NOT, instr.ADD, instr.LT, instr.LE, instr.EQ}\n      \\<and> (\\<forall> c d. prog ! pc = Some (INSTR (STOREC c d)) \\<longrightarrow> d = 0)\n      \"\n    \"\\<forall> pc \\<in> {pc..<pc_t}. \\<forall> pc'. prog ! pc = Some (INSTR (JMPZ pc')) \\<longrightarrow> pc' > pc \\<and> pc' \\<le> pc_t\"\n    \"prog ! pc_t = Some (INSTR HALT)\" \"pc_t \\<ge> pc\" \"n > pc_t - pc\" \"pc_t < length prog\"\n  shows \"\\<exists> st' s' f' r'. steps\n      (map_option stripf o (\\<lambda>pc. if pc < size prog then prog ! pc else None))\n      n (pc, st, s, f, r) (pc_t, st', s', f', r')\"\n  using assms\nproof (induction \"pc_t - pc\" arbitrary: pc st s f r n rule: less_induct)\n  case less\n  let ?prog = \"(map_option stripf \\<circ> (\\<lambda>pc. if pc < length prog then prog ! pc else None))\"\n  from \\<open>pc_t - pc < n\\<close> obtain n' where [simp]: \"n = Suc n'\" by (cases n) auto\n  from less.prems(3-) have [simp]: \"pc < length prog\" \"pc_t < length prog\" by auto\n  show ?case\n  proof (cases \"pc_t = pc\")\n    case True\n    then show ?thesis by force\n  next\n    case False\n    with less.prems(1,4) have valid_instr:\n      \"prog ! pc \\<notin> Some ` INSTR `\n       {STORE, HALT, POP, CALL, RETURN, instr.AND, instr.NOT, instr.ADD, instr.LT, instr.LE, instr.EQ}\"\n      \"prog ! pc \\<noteq> None\"\n      by auto\n    from \\<open>pc \\<le> _\\<close> \\<open>pc_t \\<noteq> _\\<close> less.prems(2) have jumps:\n      \"pc' > pc \\<and> pc' \\<le> pc_t\" if \"prog ! pc = Some (INSTR (JMPZ pc'))\" for pc'\n      using that by fastforce\n    from \\<open>pc \\<le> _\\<close> \\<open>pc_t \\<noteq> _\\<close> less.prems(1) have stores:\n      \"d = 0\" if \"prog ! pc = Some (INSTR (STOREC c d))\" for c d\n      using that by fastforce\n    show ?thesis\n    proof (cases \"prog ! pc\")\n      case None\n      from \\<open>pc_t \\<noteq> _\\<close> less.prems(1,4) have \"prog ! pc \\<noteq> None\"\n        by simp\n      with None show ?thesis by auto\n    next\n      case (Some a)\n      then show ?thesis\n      proof (cases a)\n        case (INSTR instr)\n        have *:\n          \"\\<exists>st' s' f' r'. steps ?prog n' (pc', st, s, f, r) (pc_t, st', s', f', r')\"\n          if \"pc < pc'\" \"pc' \\<le> pc_t\" for pc' st s f r\n          apply (rule less.hyps[of pc'])\n          subgoal\n            using that by simp\n          subgoal\n            using that less.prems(1) by force\n          subgoal\n            apply clarsimp\n            subgoal premises prems for pc_s pc'\n            proof -\n              from prems that have \"pc_s \\<in> {pc..<pc_t}\" by simp\n              with prems(1) less.prems(2) show ?thesis by blast\n            qed\n            done\n          using \\<open>prog ! pc_t = _\\<close> \\<open>pc_t - pc < n\\<close> that by auto\n        from \\<open>pc_t \\<noteq> pc\\<close> \\<open>pc \\<le> _\\<close> have \"Suc pc \\<le> pc_t\" by simp\n        then obtain pc' st' s' f' r' where\n          \"step instr (pc, st, s, f, r) = Some (pc', st', s', f', r')\" \"pc < pc'\" \"pc' \\<le> pc_t\"\n          apply atomize_elim\n          apply (cases instr)\n          using valid_instr \\<open>a = _\\<close> \\<open>_ = Some a\\<close> by (auto simp: stores jumps)\n        with \\<open>a = _\\<close> \\<open>_ = Some a\\<close> show ?thesis by (force dest!: *)\n      next\n        case (CEXP x2)\n        have *:\n          \"\\<exists>st' s' f' r'. steps ?prog n' (Suc pc, st, s, f, r) (pc_t, st', s', f', r')\"\n          if \"Suc pc \\<le> pc_t\" for st s f r\n          apply (rule less.hyps[of \"Suc pc\"])\n          subgoal\n            using \\<open>pc \\<le> _\\<close> \\<open>pc_t \\<noteq> pc\\<close> by simp\n          subgoal\n            using less.prems(1) by force\n          subgoal\n            apply clarsimp\n            subgoal premises prems for pc_s pc'\n            proof -\n              from prems have \"pc_s \\<in> {pc..<pc_t}\" by simp\n              with prems(1) less.prems(2) show ?thesis by blast\n            qed\n            done\n          using \\<open>prog ! pc_t = _\\<close> \\<open>pc_t - pc < n\\<close> that by auto\n        from \\<open>pc_t \\<noteq> pc\\<close> \\<open>pc \\<le> _\\<close> have \"Suc pc \\<le> pc_t\" by simp\n        with \\<open>a = _\\<close> \\<open>_ = Some a\\<close> show ?thesis by (force dest!: *)\n      qed\n    qed\n  qed\nqed\n\nfunction find_next_halt where\n  \"find_next_halt prog pc =\n    (\n    if pc < length prog\n    then\n      case prog ! pc of\n        Some (INSTR HALT) \\<Rightarrow> Some pc |\n        _ \\<Rightarrow> find_next_halt prog (pc + 1)\n    else None\n    )\n  \"\n  by auto\n\ntermination\n  by (relation \"measure (\\<lambda> (prog, pc). length prog - pc)\") auto\n\nlemma find_next_halt_finds_halt:\n  \"prog ! pc' = Some (INSTR HALT) \\<and> pc \\<le> pc' \\<and> pc' < length prog\"\n  if \"find_next_halt prog pc = Some pc'\"\nusing that proof (induction prog pc rule: find_next_halt.induct)\n  case prems: (1 prog pc)\n  from prems(20) show ?case\n    by (\n        simp,\n        simp\n        split: if_split_asm option.split_asm instrc.split_asm instr.split_asm\n        del: find_next_halt.simps;\n        fastforce dest: prems(1-19) simp del: find_next_halt.simps)\nqed\n\ndefinition\n  \"guaranteed_execution_cond prog pc_s n \\<equiv>\n    case find_next_halt prog pc_s of\n      None \\<Rightarrow> False |\n      Some pc_t \\<Rightarrow>\n       (\n       \\<forall> pc \\<in> {pc_s..<pc_t}.\n          prog ! pc \\<noteq> None\n          \\<and> prog ! pc \\<notin> Some ` INSTR `\n            {STORE, HALT, POP, CALL, RETURN, instr.AND, instr.NOT, instr.ADD, instr.LT, instr.LE, instr.EQ}\n          \\<and> (\\<forall> c d. prog ! pc = Some (INSTR (STOREC c d)) \\<longrightarrow> d = 0)\n        ) \\<and>\n        (\\<forall> pc \\<in> {pc_s..<pc_t}. \\<forall> pc'. prog ! pc = Some (INSTR (JMPZ pc')) \\<longrightarrow> pc' > pc \\<and> pc' \\<le> pc_t)\n       \\<and> n > pc_t - pc_s\n  \"\n\nlemma guaranteed_execution_cond_alt_def[code]:\n  \"guaranteed_execution_cond prog pc_s n \\<equiv>\n    case find_next_halt prog pc_s of\n      None \\<Rightarrow> False |\n      Some pc_t \\<Rightarrow>\n       (\n       \\<forall> pc \\<in> {pc_s..<pc_t}.\n          prog ! pc \\<noteq> None\n          \\<and> prog ! pc \\<notin> Some ` INSTR `\n            {STORE, HALT, POP, CALL, RETURN, instr.AND, instr.NOT, instr.ADD, instr.LT, instr.LE, instr.EQ}\n          \\<and> (case prog ! pc of Some (INSTR (STOREC c d)) \\<Rightarrow> d = 0 | _ \\<Rightarrow> True)\n        ) \\<and>\n        (\\<forall> pc \\<in> {pc_s..<pc_t}.\n          case prog ! pc of Some (INSTR (JMPZ pc')) \\<Rightarrow> pc' > pc \\<and> pc' \\<le> pc_t | _ \\<Rightarrow> True)\n       \\<and> n > pc_t - pc_s\n  \"\nproof (rule eq_reflection, goal_cases)\n  case 1\n  have *:\n    \"(\\<forall> c d. prog ! pc = Some (INSTR (STOREC c d)) \\<longrightarrow> d = 0) \\<longleftrightarrow>\n     (case prog ! pc of Some (INSTR (STOREC c d)) \\<Rightarrow> d = 0 | _ \\<Rightarrow> True)\" for pc\n    by (auto split: option.split instrc.split instr.split)\n  have **:\n    \"(\\<forall> pc'. prog ! pc = Some (INSTR (JMPZ pc')) \\<longrightarrow> pc' > pc \\<and> pc' \\<le> pc_t) \\<longleftrightarrow>\n     (case prog ! pc of Some (INSTR (JMPZ pc')) \\<Rightarrow> pc' > pc \\<and> pc' \\<le> pc_t | _ \\<Rightarrow> True)\" for pc pc_t\n    by (auto split: option.split instrc.split instr.split)\n  show ?case unfolding guaranteed_execution_cond_def * ** ..\nqed\n\nlemma guaranteed_execution':\n  \"\\<exists> pc_t st' s' f' r' pcs'. exec\n      (map_option stripf o (\\<lambda>pc. if pc < size prog then prog ! pc else None))\n      n (pc, st, s, f, r) pcs = Some ((pc_t, st', s', f', r'), pcs')\"\n  if \"guaranteed_execution_cond prog pc n\"\nproof -\n  from that obtain pc_t where \"find_next_halt prog pc = Some pc_t\"\n    unfolding guaranteed_execution_cond_def bexp_atLeastAtMost_iff\n    by (auto split: option.split_asm)\n  then have \"prog ! pc_t = Some (INSTR HALT) \\<and> pc \\<le> pc_t \\<and> pc_t < length prog\"\n    by (rule find_next_halt_finds_halt)\n  moreover then have \"\\<exists> st' s' f' r'. steps\n      (map_option stripf o (\\<lambda>pc. if pc < size prog then prog ! pc else None))\n      n (pc, st, s, f, r) (pc_t, st', s', f', r')\"\n    using \\<open>_ = Some pc_t\\<close> that\n    unfolding guaranteed_execution_cond_def bexp_atLeastAtMost_iff\n    by - (rule guaranteed_execution, auto)\n  ultimately show ?thesis by (force dest: steps_exec)\n  qed\n\n\ncontext UPPAAL_Reachability_Problem_precompiled_defs\nbegin\n\n  lemma collect_cexp_alt_def:\n    \"collect_cexp =\n      set (List.map_filter\n        (\\<lambda> x. case x of Some (CEXP ac) \\<Rightarrow> Some ac | _ \\<Rightarrow> None)\n         prog)\"\n    unfolding collect_cexp_def set_map_filter by (auto split: option.split_asm instrc.split_asm)\n\n  lemma clkp_set'_alt_def:\n    \"clkp_set' =\n      \\<Union> (collect_clock_pairs ` set (concat inv)) \\<union> (constraint_pair ` collect_cexp)\"\n    unfolding clkp_set'_def collect_cexp_def by auto\n\n  definition\n    \"collect_store = {(c, x). Some (INSTR (STOREC c x)) \\<in> set prog}\"\n\n  lemma collect_store_alt_def:\n    \"collect_store =\n      set (List.map_filter\n        (\\<lambda> x. case x of Some (INSTR (STOREC c x)) \\<Rightarrow> Some (c, x) | _ \\<Rightarrow> None)\n         prog)\"\n    unfolding collect_store_def set_map_filter\n    by (auto split: option.split_asm instrc.split_asm instr.split_asm)\n\n  lemma clk_set'_alt_def: \"clk_set' = (fst ` clkp_set' \\<union> fst ` collect_store)\"\n    unfolding clk_set'_def collect_store_def by auto\n\nend\n\n\nfun conj_instr :: \"'t instrc \\<Rightarrow> addr \\<Rightarrow> bool\" where\n  \"conj_instr (CEXP _) _ = True\" |\n  \"conj_instr (INSTR COPY) _ = True\" |\n  \"conj_instr (INSTR (JMPZ pc)) pc_t = (pc = pc_t)\" |\n  \"conj_instr (INSTR instr.AND) _ = True\" |\n  \"conj_instr _ _ = False\"\n\n(*\ninductive is_conj_block :: \"'t instrc option list \\<Rightarrow> addr \\<Rightarrow> addr \\<Rightarrow> bool\" where\n  (* \"is_conj_block prog pc pc\" if \"prog ! pc = Some (INSTR HALT)\" | *)\n  \"is_conj_block prog pc (pc' + 1)\" if\n  \"prog ! (pc' + 1) = Some (INSTR HALT)\" \"is_conj_block prog pc pc'\" |\n  \"is_conj_block prog pc pc\" if \"prog ! pc = Some (CEXP ac)\" |\n  \"is_conj_block prog pc (pc' + 3)\" if\n  \"prog ! (pc' + 1) = Some (INSTR COPY)\" \"prog ! (pc' + 2) = Some (CEXP ac)\"\n  \"prog ! (pc' + 3) = Some (INSTR instr.AND)\"\n  \"is_conj_block prog pc pc'\" |\n  \"is_conj_block prog pc (pc' + 4)\" if\n  \"prog ! (pc' + 1) = Some (INSTR COPY)\"\n  \"prog ! (pc' + 2) = Some (INSTR (JMPZ pc_t))\" \"prog ! pc_t = Some (INSTR HALT)\"\n  \"prog ! (pc' + 3) = Some (CEXP ac)\" \"prog ! (pc' + 4) = Some (INSTR instr.AND)\"\n  \"is_conj_block prog pc pc'\"\n*)\n\ninductive is_conj_block' :: \"'t instrc option list \\<Rightarrow> addr \\<Rightarrow> addr \\<Rightarrow> bool\" where\n  \"is_conj_block' prog pc pc\" if\n  \"pc < length prog\"\n  \"prog ! pc = Some (INSTR HALT)\" |\n  (*\n  \"is_conj_block' prog pc (pc + 2)\" if\n  \"pc + 2 < length prog\"\n  \"prog ! (pc) = Some (INSTR COPY)\" \"prog ! (pc + 1) = Some (CEXP ac)\"\n  \"prog ! (pc + 2) = Some (INSTR instr.AND)\" |\n  *)\n  (*\n  \"is_conj_block' prog pc (pc' + 2)\" if\n  \"pc' + 2 < length prog\"\n  \"prog ! (pc') = Some (INSTR COPY)\" \"prog ! (pc' + 1) = Some (CEXP ac)\"\n  \"prog ! (pc' + 2) = Some (INSTR instr.AND)\"\n  \"is_conj_block' prog pc pc'\"\n  *)\n  \"is_conj_block' prog pc pc'\" if\n  \"pc' < length prog\"\n  \"prog ! pc = Some (INSTR COPY)\" \"prog ! (pc + 1) = Some (CEXP ac)\"\n  \"prog ! (pc + 2) = Some (INSTR instr.AND)\"\n  \"is_conj_block' prog (pc + 3) pc'\" |\n  \"is_conj_block' prog pc pc'\" if\n  \"pc' < length prog\"\n  \"prog ! pc = Some (INSTR COPY)\"\n  \"prog ! (pc + 1) = Some (INSTR (JMPZ pc'))\" (* \"prog ! pc_t = Some (INSTR HALT)\" *)\n  \"prog ! (pc + 2) = Some (CEXP ac)\"\n  \"prog ! (pc + 3) = Some (INSTR instr.AND)\"\n  \"is_conj_block' prog (pc + 4) pc'\"\n\ninductive_cases stepscE: \"stepsc prog n u (pc, st, m, f, rs) (pc', st', m', f', rs')\"\n\nfunction check_conj_block' :: \"'t instrc option list \\<Rightarrow> addr \\<Rightarrow> addr option\" where\n  \"check_conj_block' prog pc = (\n    if pc \\<ge> length prog then None\n    else if prog ! pc = Some (INSTR HALT) then Some pc\n    else if\n      prog ! pc = Some (INSTR COPY) \\<and> (case prog ! (pc + 1) of Some (CEXP ac) \\<Rightarrow> True | _ \\<Rightarrow> False)\n      \\<and> prog ! (pc + 2) = Some (INSTR instr.AND)\n    then check_conj_block' prog (pc + 3)\n    else if\n      prog ! pc = Some (INSTR COPY) \\<and> (case prog ! (pc + 2) of Some (CEXP ac) \\<Rightarrow> True | _ \\<Rightarrow> False)\n      \\<and> prog ! (pc + 3) = Some (INSTR instr.AND)\n      \\<and> (case prog ! (pc + 1) of Some (INSTR (JMPZ pc')) \\<Rightarrow> True | _ \\<Rightarrow> False)\n    then\n      (case (prog ! (pc + 1), check_conj_block' prog (pc + 4)) of (Some (INSTR (JMPZ pc')), Some pc'')\n        \\<Rightarrow> if pc' = pc'' then Some pc' else None | _ \\<Rightarrow> None)\n    else None\n    )\n  \"\n  by pat_completeness auto\n\ntermination\n  by (relation \"measure (\\<lambda> (prog, pc). length prog - pc)\") auto\n\nlemma is_conj_block'_len_prog:\n  \"pc' < length prog\" if \"is_conj_block' prog pc pc'\"\n  using that by induction auto\n\nlemma check_conj_block':\n  \"check_conj_block' prog pc = Some pc' \\<Longrightarrow> is_conj_block' prog pc pc'\"\n  apply (induction prog pc rule: check_conj_block'.induct)\n    apply (erule check_conj_block'.elims)\n  by (auto\n        split: if_split_asm option.split_asm instrc.split_asm instr.split_asm\n        simp del: check_conj_block'.simps\n        intro: is_conj_block'.intros is_conj_block'_len_prog)\n\nlemma stepsc_reverseE':\n  assumes \"stepsc prog (Suc n) u s s''\" \"s'' \\<noteq> s\"\n  obtains pc' st' m' f' rs' cmd where\n    \"stepc cmd u (pc', st', m', f', rs') = Some s''\"\n    \"prog pc' = Some cmd\"\n    \"stepsc prog n u s (pc', st', m', f', rs')\"\n  apply atomize_elim\n  using assms\nproof (induction prog \"Suc n\" u s s'' arbitrary: n rule: stepsc.induct) thm stepsc.induct\n  case (1 prog n u start)\n  then show ?case by simp\nnext\n  case prems: (2 cmd u pc st m f rs s prog n s')\n  then show ?case\n  proof (cases \"s' = s\")\n    case True\n    with prems show ?thesis\n      apply simp\n      apply solve_ex_triv+\n      by (auto elim: stepsc.cases)\n  next\n    case False\n    with prems(3) have \"n > 0\" by (auto elim!: stepsc.cases)\n    then obtain n' where \"n = Suc n'\" by (cases n) auto\n    from prems(4)[OF this False] obtain cmd pc' st' m' f' rs' where\n      \"stepc cmd u (pc', st', m', f', rs') = Some s'\" \"prog pc' = Some cmd\"\n      \"stepsc prog n' u s (pc', st', m', f', rs')\"\n      by atomize_elim\n    with prems show ?thesis unfolding \\<open>n = _\\<close> by blast\n  qed\nqed\n\nlemma stepsc_reverseE:\n  assumes \"stepsc prog n u s s''\" \"s'' \\<noteq> s\"\n  obtains n' pc' st' m' f' rs' cmd where\n    \"n = Suc n'\"\n    \"stepc cmd u (pc', st', m', f', rs') = Some s''\"\n    \"prog pc' = Some cmd\"\n    \"stepsc prog n' u s (pc', st', m', f', rs')\"\nproof -\n  from assms have \"n > 0\" by (auto elim!: stepsc.cases)\n  then obtain n' where \"n = Suc n'\" by (cases n) auto\n  with assms show ?thesis by (auto elim!: stepsc_reverseE' intro!: that)\nqed\n\nlemma\n  \"pc = pc' - 1\" if\n  \"stepc (CEXP cc) u (pc, st, m, f, rs) = Some (pc', st', m', f', rs')\"\n  using that by auto\n\nlemma\n  \"pc = pc' - 1\" if\n  \"stepc (INSTR instr) u (pc, st, m, f, rs) = Some (pc', st', m', f', rs')\"\n  \"\\<not> (\\<exists> x. instr = JMPZ pc')\" \"instr \\<noteq> RETURN\" \"instr \\<noteq> CALL\"\n  using that by (auto split: option.split_asm if_split_asm elim!: step.elims)\n\nlemma stepc_pc_no_jump:\n  \"pc = pc' - 1\" if\n  \"stepc cmd u (pc, st, m, f, rs) = Some (pc', st', m', f', rs')\"\n  \"cmd \\<noteq> INSTR (JMPZ pc')\" \"cmd \\<noteq> INSTR RETURN\" \"cmd \\<noteq> INSTR CALL\"\n  using that by (cases cmd) (auto split: option.split_asm if_split_asm elim!: step.elims)\n\ninductive stepsn :: \"'t programc \\<Rightarrow> nat \\<Rightarrow> (nat, 't :: time) cval \\<Rightarrow> state \\<Rightarrow> state \\<Rightarrow> bool\"\n  for prog where\n  \"stepsn prog 0 u start start\" | (*\n  \"stepsc prog (Suc n) u s s'\" if\n    \"stepc cmd u (pc, st, m, f, rs) = Some s'\"\n    \"stepsc prog n u s (pc, st, m, f, rs)\"\n    \"prog pc = Some cmd\" *)\n  \"stepsn prog (Suc n) u (pc, st, m, f, rs) s'\" if\n    \"stepc cmd u (pc, st, m, f, rs) = Some s\"\n    \"prog pc = Some cmd\"\n    \"stepsn prog n u s s'\"\n\ndeclare stepsn.intros[intro]\n\nlemma stepsc_stepsn:\n  assumes \"stepsc P n u s s'\"\n  obtains n' where \"stepsn P n' u s s'\" \"n' < n\"\n  using assms by induction auto\n\nlemma stepsn_stepsc:\n  assumes \"stepsn P n' u s s'\" \"n' < n\"\n  shows \"stepsc P n u s s'\"\n  using assms\n  proof (induction arbitrary: n)\n    case (1 u start)\n    then obtain n' where \"n = Suc n'\" by (cases n) auto\n    then show ?case by auto\n  next\n    case (2 cmd u pc st m f rs s n s' n')\n    from \\<open>_ < n'\\<close> have \"n < n' - 1\" by simp\n    from 2(4)[OF this] 2(1,2,3,5) show ?case\n    proof -\n      have \"(\\<exists>fa n fb p. P = fa \\<and> n' = Suc n \\<and> u = fb \\<and> (pc, st, m, f, rs) = p \\<and> s' = p) \\<or> (\\<exists>i fa n is isa b ns p fb na pa. P = fb \\<and> n' = Suc na \\<and> u = fa \\<and> (pc, st, m, f, rs) = (n, is, isa, b, ns) \\<and> s' = pa \\<and> stepc i fa (n, is, isa, b, ns) = Some p \\<and> fb n = Some i \\<and> stepsc fb na fa p pa)\"\n        using \"2.prems\" Suc_pred' \\<open>P pc = Some cmd\\<close> \\<open>stepc cmd u (pc, st, m, f, rs) = Some s\\<close> \\<open>stepsc P (n' - 1) u s s'\\<close> gr_implies_not_zero by blast\n      then show ?thesis\n        by blast\n    qed\n  qed\n\nlemma stepsn_extend:\n  assumes \"stepsn P n1 u s s1\" \"stepsn P n2 u s s2\" \"n1 \\<le> n2\"\n  shows \"stepsn P (n2 - n1) u s1 s2\"\nusing assms\nproof (induction arbitrary: n2 s2)\n  case (1 u start)\n  then show ?case by simp\nnext\n  case (2 cmd u pc st m f rs s n s')\n  from 2(1,2,5-) have \"stepsn P (n2 - 1) u s s2\" by (auto elim: stepsn.cases)\n  from 2(4)[OF this] \\<open>Suc n <= _\\<close> show ?case by simp\nqed\n\n(* XXX Move *)\nlemma stepsc_halt:\n  \"s' = (pc, s)\" if \"stepsc P n u (pc, s) s'\" \"P pc = Some (INSTR HALT)\"\n  using that by (induction P n u \"(pc, s)\" s') auto\n\nlemma stepsn_halt:\n  \"s' = (pc, s)\" if \"stepsn P n u (pc, s) s'\" \"P pc = Some (INSTR HALT)\"\n  apply (rule stepsc_halt[OF stepsn_stepsc[where n = \"Suc n\"]])\n  using that by simp+\n\nlemma is_conj_block'_pc_mono:\n  \"pc \\<le> pc'\" if \"is_conj_block' prog pc pc'\"\n  using that by induction auto\n\nlemma is_conj_block'_halt:\n  \"prog ! pc' = Some (INSTR HALT)\" if \"is_conj_block' prog pc pc'\"\n  using that by induction auto\n\nlemma numeral_4_eq_4:\n  \"4 = Suc (Suc (Suc (Suc 0)))\"\n  by simp\n\nlemma is_conj_block'_is_conj:\n  assumes \"is_conj_block' P pc pc'\"\n    and \"stepsn (\\<lambda> i. if i < length P then P ! i else None) n u (pc, st, s, f, rs) (pc_t, st_t, s_t, True, rs_t)\"\n    and \"P ! pc_t = Some (INSTR HALT)\"\n    (* and \"pc < pc_t\" (* \"pc_t \\<le> pc'\" *) *)\n  shows \"f \\<and> pc_t = pc'\"\n  using assms\nproof (induction arbitrary: n st s f rs)\n  case (1 pc prog)\n  with stepsn_halt[OF this(3)] show ?case by simp\nnext\n  case prems: (2 pc' prog pc ac)\n  let ?P = \"(\\<lambda>i. if i < length prog then prog ! i else None)\"\n  consider (0) \"n = 0\" | (1) \"n = 1\" | (2) \"n = 2\" | (3) \"n \\<ge> 3\" by force\n  then show ?case\n  proof cases\n    case 0\n    with prems show ?thesis by (auto elim!: stepsn.cases)\n  next\n    case 1\n    with prems show ?thesis by (auto elim!: stepsn.cases simp: int_of_def split: if_split_asm)\n  next\n    case 2\n    with prems show ?thesis by (auto elim!: stepsn.cases simp: int_of_def numeral_2_eq_2 split: if_split_asm)\n  next\n    case 3\n    from prems have \"pc + 2 < length prog\" by (auto dest: is_conj_block'_pc_mono)\n    with prems(2-4) obtain st1 s1 rs1 where\n      \"stepsn ?P 3 u (pc, st, s, f, rs) (pc + 3, st1, s1, f \\<and> (u \\<turnstile>\\<^sub>a ac), rs1)\"\n      by (force simp: int_of_def numeral_3_eq_3)\n    from stepsn_extend[OF this prems(7) 3] have\n      \"stepsn ?P (n - 3) u (pc + 3, st1, s1, f \\<and> (u \\<turnstile>\\<^sub>a ac), rs1) (pc_t, st_t, s_t, True, rs_t)\" .\n    from prems(6)[OF this \\<open>prog ! pc_t = _\\<close>] have \"pc_t = pc'\" \"u \\<turnstile>\\<^sub>a ac\" f by auto\n    then show ?thesis by simp\n  qed\nnext\n  case prems: (3 pc' prog pc ac)\n  let ?P = \"(\\<lambda>i. if i < length prog then prog ! i else None)\"\n  consider (0) \"n = 0\" | (1) \"n = 1\" | (2) \"n = 2\" | (3) \"n = 3\" | (4) \"n \\<ge> 4\" by force\n  then show ?case\n  proof cases\n    case 0\n    with prems show ?thesis by (auto elim!: stepsn.cases)\n  next\n    case 1\n    with prems show ?thesis by (auto elim!: stepsn.cases simp: int_of_def split: if_split_asm)\n  next\n    case 2\n    with prems show ?thesis by (auto elim!: stepsn.cases simp: int_of_def numeral_2_eq_2 split: if_split_asm)\n  next\n    case 3\n    with prems show ?thesis\n      by (auto elim!: stepsn.cases simp: int_of_def numeral_3_eq_3 split: if_split_asm dest!: is_conj_block'_halt)\n  next\n    case 4\n    from prems have \"pc + 3 < length prog\" by (auto dest: is_conj_block'_pc_mono)\n    show ?thesis\n    proof (cases f)\n      case True\n      with \\<open>pc + 3 < _\\<close> prems(2-6) obtain st1 s1 rs1 where\n        \"stepsn ?P 4 u (pc, st, s, f, rs) (pc + 4, st1, s1, f \\<and> (u \\<turnstile>\\<^sub>a ac), rs1)\"\n      by (force simp: int_of_def numeral_3_eq_3 numeral_4_eq_4)\n      from stepsn_extend[OF this prems(8) 4] have\n        \"stepsn ?P (n - 4) u (pc + 4, st1, s1, f \\<and> (u \\<turnstile>\\<^sub>a ac), rs1) (pc_t, st_t, s_t, True, rs_t)\" .\n      from prems(7)[OF this \\<open>prog ! pc_t = _\\<close>] have \"pc_t = pc'\" \"u \\<turnstile>\\<^sub>a ac\" f by auto\n      then show ?thesis by simp\n    next\n      case False\n      with \\<open>pc + 3 < _\\<close> prems(1-6) obtain st1 s1 rs1 where\n        \"stepsn ?P 2 u (pc, st, s, f, rs) (pc', st1, s1, False, rs1)\"\n        by (force simp: int_of_def numeral_2_eq_2)\n      from stepsn_extend[OF this prems(8)] 4 have\n        \"stepsn ?P (n - 2) u (pc', st1, s1, False, rs1) (pc_t, st_t, s_t, True, rs_t)\" by simp\n      from stepsn_halt[OF this] prems(1,6) show ?thesis by (auto dest: is_conj_block'_halt)\n    qed\n  qed\nqed\n\nlemma is_conj_block'_is_conj':\n  assumes \"is_conj_block' P pc pc'\"\n    and \"stepst (\\<lambda> i. if i < length P then P ! i else None) n u (pc, st, s, f, rs) (pc_t, st_t, s_t, True, rs_t)\"\n    (* and \"pc < pc_t\" (* \"pc_t \\<le> pc'\" *) *)\n  shows \"f \\<and> pc_t = pc'\"\n  using assms\n  unfolding stepst_def by (auto split: if_split_asm elim!: is_conj_block'_is_conj stepsc_stepsn)\n\nlemma is_conj_block'_is_conj2:\n  assumes \"is_conj_block' P (pc + 1) pc'\" \"P ! pc = Some (CEXP ac)\"\n    and \"stepst (\\<lambda> i. if i < length P then P ! i else None) n u (pc, st, s, f, rs) (pc_t, st_t, s_t, True, rs_t)\"\n  shows \"(u \\<turnstile>\\<^sub>a ac) \\<and> pc_t = pc'\"\nproof -\n  let ?P = \"(\\<lambda> i. if i < length P then P ! i else None)\"\n  from assms(1) have \"pc < pc'\" \"pc' < length P\"\n    by (auto dest: is_conj_block'_pc_mono is_conj_block'_len_prog)\n  with assms(2,3) obtain st' s' rs' where\n    \"stepst ?P (n - 1) u (pc + 1, st', s', u \\<turnstile>\\<^sub>a ac, rs') (pc_t, st_t, s_t, True, rs_t)\"\n    unfolding stepst_def\n    apply (clarsimp split: if_split_asm)\n    apply (erule stepsc.cases)\n    by auto\n  from is_conj_block'_is_conj'[OF assms(1) this] show ?thesis .\nqed\n\nlemma is_conj_block'_is_conj3:\n  assumes \"is_conj_block' P (pc + 2) pc'\" \"P ! pc = Some (CEXP ac)\" \"P ! (pc + 1) = Some (INSTR instr.AND)\"\n    and \"stepst (\\<lambda> i. if i < length P then P ! i else None) n u (pc, st, s, f, rs) (pc_t, st_t, s_t, True, rs_t)\"\n  shows \"(u \\<turnstile>\\<^sub>a ac) \\<and> pc_t = pc'\"\nproof -\n  let ?P = \"(\\<lambda> i. if i < length P then P ! i else None)\"\n  from assms(1) have \"pc < pc'\" \"pc' < length P\"\n    by (auto dest: is_conj_block'_pc_mono is_conj_block'_len_prog)\n  with assms(2,3,4) obtain st' s' rs' f where\n    \"stepst ?P (n - 2) u (pc + 2, st', s', f \\<and> (u \\<turnstile>\\<^sub>a ac), rs') (pc_t, st_t, s_t, True, rs_t)\"\n    unfolding stepst_def\n    apply (clarsimp split: if_split_asm)\n    apply (erule stepsc.cases)\n     apply force\n    apply (erule stepsc.cases)\n    by (auto split: if_split_asm option.split_asm elim!: UPPAAL_Asm.step.elims)\n  from is_conj_block'_is_conj'[OF assms(1) this] show ?thesis by simp\nqed\n\ndefinition\n  \"is_conj_block P pc pc' \\<equiv>\n   (\\<exists> ac. P ! pc = Some (CEXP ac)) \\<and> is_conj_block' P (pc + 1) pc'\n   \\<or> (\\<exists> ac.\n      P ! pc = Some (CEXP ac)) \\<and> P ! (pc + 1) = Some (INSTR instr.AND)\n      \\<and> is_conj_block' P (pc + 2) pc'\"\n\nlemma is_conj_block_alt_def[code]:\n\"is_conj_block P pc pc' \\<equiv>\n   (case P ! pc of Some (CEXP ac) \\<Rightarrow> True | _ \\<Rightarrow> False) \\<and> is_conj_block' P (pc + 1) pc'\n   \\<or> (case P ! pc of Some (CEXP ac) \\<Rightarrow> True | _ \\<Rightarrow> False) \\<and> P ! (pc + 1) = Some (INSTR instr.AND)\n      \\<and> is_conj_block' P (pc + 2) pc'\"\n  unfolding is_conj_block_def\n  by (rule eq_reflection) (auto split: option.split_asm instrc.split_asm)\n\nlemma is_conj_block_is_conj:\n  assumes \"is_conj_block P pc pc'\" \"P ! pc = Some (CEXP ac)\"\n    and\n      \"stepst\n        (\\<lambda> i. if i < length P then P ! i else None) n u\n        (pc, st, s, f, rs)\n        (pc_t, st_t, s_t, True, rs_t)\"\n  shows \"(u \\<turnstile>\\<^sub>a ac) \\<and> pc_t = pc'\"\n  using assms\n  unfolding is_conj_block_def\n  apply safe\n  by ((drule is_conj_block'_is_conj2 is_conj_block'_is_conj3; simp), simp)+\n\nlemma is_conj_block'_decomp:\n  \"is_conj_block P pc' pc''\" if\n  \"is_conj_block' P pc pc''\" \"P ! pc' = Some (CEXP ac)\" \"pc \\<le> pc'\" \"pc' \\<le> pc''\"\n  using that\nproof (induction arbitrary: pc')\n  case (1 pc prog)\n  then show ?case by (simp add: is_conj_block_def)\nnext\n  case prems: (2 pc'' prog pc ac)\n  with \\<open>pc \\<le> _\\<close> consider \"pc' = pc\" | \"pc' = Suc pc\" | \"pc' = Suc (Suc pc)\" | \"pc + 3 \\<le> pc'\"\n    by force\n  then show ?case using prems by cases (auto simp add: numeral_3_eq_3 is_conj_block_def)\nnext\n  case prems: (3 pc'' prog pc ac)\n  with \\<open>pc \\<le> _\\<close> consider\n    \"pc' = pc\" | \"pc' = Suc pc\" | \"pc' = Suc (Suc pc)\" | \"pc' = Suc (Suc (Suc pc))\" | \"pc + 4 \\<le> pc'\"\n    by force\n  then show ?case using prems by cases (auto simp add: numeral_3_eq_3 numeral_4_eq_4 is_conj_block_def)+\nqed\n\nlemma is_conj_block_decomp:\n  \"is_conj_block P pc' pc''\" if\n  \"is_conj_block P pc pc''\" \"P ! pc' = Some (CEXP ac)\" \"pc \\<le> pc'\" \"pc' \\<le> pc''\"\n  using that\n  apply (subst (asm) is_conj_block_def)\n  apply safe\n  (* XXX Should work without metis *)\n  apply (metis\n    One_nat_def add_Suc_right diff_diff_cancel diff_is_0_eq diff_le_self gr_zeroI\n    is_conj_block'_decomp le_simps(3) mpl_lem pl_pl_mm that(1))\n  by (metis\n    One_nat_def Suc_1 add.right_neutral add_Suc_right instrc.simps(4) is_conj_block'_decomp\n    le_antisym not_less_eq_eq option.inject that(1))\n\nlemma steps_approx_finite[intro,simp]:\n  \"finite (steps_approx n P pc_s)\"\n  by (induction rule: steps_approx.induct; clarsimp split: option.split instrc.split instr.split)\n\nabbreviation \"conv_P \\<equiv> map (map_option (map_instrc real_of_int))\"\n\nlemma stepst_stepc_extend:\n  \"stepst P n u (pc', s') (pc'', s'')\"\n  if \"stepst P n u (pc, s) (pc'', s'')\" \"stepsc P n u (pc, s) (pc', s')\"\nproof -\n  from that have \"P pc'' = Some (INSTR HALT)\" unfolding stepst_def by auto\n  from that obtain n1 n2 where *:\n    \"stepsn P n1 u (pc, s) (pc'', s'')\" \"stepsn P n2 u (pc, s) (pc', s')\" \"n1 < n\" \"n2 < n\"\n    unfolding stepst_def by (auto elim!: stepsc_stepsn)\n  show ?thesis\n  proof (cases \"n1 \\<ge> n2\")\n    case True\n    from stepsn_extend[OF *(2,1) this] \\<open>n1 < _\\<close> \\<open>n2 < _\\<close> \\<open>P pc'' = _\\<close> show ?thesis\n      unfolding stepst_def by (auto intro: stepsn_stepsc)\n  next\n    case False\n    with stepsn_extend[OF *(1,2)] \\<open>n1 < _\\<close> \\<open>n2 < _\\<close> \\<open>P pc'' = _\\<close> show ?thesis\n      unfolding stepst_def by (auto intro: stepsn_stepsc dest!: stepsn_halt)\n  qed\nqed\n\nlemma conv_P_conj_block'[intro]:\n  \"is_conj_block' (conv_P P) pc pc'\" if \"is_conj_block' P pc pc'\"\n  using that\n  apply induction\n    apply (rule is_conj_block'.intros(1))\n     apply (simp; fail)\n    apply (simp; fail)\n   apply (rule is_conj_block'.intros(2))\n       apply (simp; fail)\n      apply (frule is_conj_block'_pc_mono; force dest: is_conj_block'_len_prog)\n     apply (frule is_conj_block'_pc_mono; force dest: is_conj_block'_len_prog)\n    apply (frule is_conj_block'_pc_mono; force dest: is_conj_block'_len_prog)\n   apply (simp; fail)\n  apply (rule is_conj_block'.intros(3))\n       apply (simp; fail)\n      apply (frule is_conj_block'_pc_mono; force dest: is_conj_block'_len_prog)\n     apply (frule is_conj_block'_pc_mono; force dest: is_conj_block'_len_prog)\n    apply (frule is_conj_block'_pc_mono; force dest: is_conj_block'_len_prog)\n   apply (frule is_conj_block'_pc_mono; force dest: is_conj_block'_len_prog)\n  apply (simp; fail)\n  done\n\nlemma conv_P_conj_block[intro]:\n  \"is_conj_block (conv_P P) pc pc'\" if \"is_conj_block P pc pc'\"\n  using that[unfolded is_conj_block_def]\n  apply safe\n  by (frule is_conj_block'_pc_mono; force dest: is_conj_block'_len_prog simp: is_conj_block_def)+\n\ncontext\n  fixes P :: \"int instrc option list\"\n    and pc_s :: addr\n    and n :: nat\nbegin\n\nprivate abbreviation \"prog i \\<equiv> if i < length P then P ! i else None\"\n\nlemma stepst_conv_P:\n  \"stepst (\\<lambda> i. if i < length (conv_P P) then conv_P P ! i else None) n u s s'\" if\n  \"stepst (conv_prog prog) n u s s'\" using that unfolding stepst_def\n  apply safe\n  subgoal for pc a aa ab b z\n    apply rotate_tac\n    by (induction \"conv_prog prog\" n u s \"(pc, a, aa, ab, b)\" rule: stepsc.induct)\n      (auto split: if_split_asm)\n  by (auto split: if_split_asm)\n\nlemma is_conj:\n  fixes u :: \"nat \\<Rightarrow> real\"\n  defines \"S \\<equiv> steps_approx n P pc_s\"\n  defines \"pc_c \\<equiv> Min {pc. \\<exists> ac. pc \\<in> S \\<and> P ! pc = Some (CEXP ac)}\"\n  assumes \"is_conj_block P pc_c (Max S)\"\n    and \"stepst (conv_prog prog) n u (pc_s, st, s, f, rs) (pc_t, st_t, s_t, True, rs_t)\"\n    and \"stepsc (conv_prog prog) n u (pc_s, st, s, f, rs) (pc', st', s', f', rs')\"\n    and \"P ! pc' = Some (CEXP ac)\" \"pc' < length P\"\n  shows \"(u \\<turnstile>\\<^sub>a conv_ac ac) \\<and> pc_t = Max S\"\nproof -\n  from stepst_stepc_extend[OF assms(4,5)] have *:\n    \"stepst (conv_prog prog) n u (pc', st', s', f', rs') (pc_t, st_t, s_t, True, rs_t)\" .\n  from \\<open>stepsc _ _ _ _ _\\<close> \\<open>P ! pc' = _\\<close> \\<open>pc' < _\\<close> have \"pc_c \\<le> pc'\" \"pc' \\<le> Max S\"\n    unfolding pc_c_def S_def by (auto intro: stepsc_steps_approx Min_le Max_ge)\n  from is_conj_block_decomp[OF assms(3) \\<open>P ! pc' = _\\<close> this] have\n    \"is_conj_block P pc' (Max S)\" .\n  then have \"is_conj_block (conv_P P) pc' (Max S)\" by auto\n  from is_conj_block_is_conj[OF this _ stepst_conv_P[OF *]] \\<open>P ! pc' = _\\<close> \\<open>pc' < _\\<close>\n    show ?thesis\n    by auto\nqed\n\nlemma is_conj':\n  fixes u :: \"nat \\<Rightarrow> real\"\n  defines \"S \\<equiv> steps_approx n P pc_s\"\n  assumes \"{pc. \\<exists> ac. pc \\<in> S \\<and> P ! pc = Some (CEXP ac)} = {}\"\n    and \"stepsc (conv_prog prog) n u (pc_s, st, s, f, rs) (pc', st', s', f', rs')\"\n    and \"P ! pc' = Some (CEXP ac)\" \"pc' < length P\"\n  shows False\n  using stepsc_steps_approx[OF assms(3,5)] assms(4) assms(2) unfolding S_def by auto\n\nterm is_conj_block\n\ndefinition\n\"check_conj_block pc pc' \\<equiv>\n   (case P ! pc of Some (CEXP ac) \\<Rightarrow> True | _ \\<Rightarrow> False) \\<and> check_conj_block' P (pc + 1) = Some pc'\n   \\<or> (case P ! pc of Some (CEXP ac) \\<Rightarrow> True | _ \\<Rightarrow> False) \\<and> P ! (pc + 1) = Some (INSTR instr.AND)\n      \\<and> check_conj_block' P (pc + 2) = Some pc'\"\n\nlemma check_conj_block:\n  \"check_conj_block pc pc' \\<Longrightarrow> is_conj_block P pc pc'\"\n  unfolding is_conj_block_alt_def check_conj_block_def\n  by (auto dest!: check_conj_block' simp del: check_conj_block'.simps)\n\ndefinition\n  \"conjunction_check \\<equiv>\n    let S = steps_approx n P pc_s; S' = {pc. \\<exists> ac. pc \\<in> S \\<and> P ! pc = Some (CEXP ac)} in\n      S' = {} \\<or> check_conj_block (Min S') (Max S)\n  \"\n\nlemma conjunction_check_alt_def[code]:\n  \"conjunction_check =\n    (\n     let\n        S = steps_approx n P pc_s;\n        S' = {pc. pc \\<in> S \\<and> (case P ! pc of Some (CEXP ac) \\<Rightarrow> True | _ \\<Rightarrow> False)}\n      in\n        S' = {} \\<or> check_conj_block (Min S') (Max S)\n    )\n  \"\nproof -\n  let ?S = \"steps_approx n P pc_s\"\n  have \"\n    {pc. pc \\<in> ?S \\<and> (case P ! pc of Some (CEXP ac) \\<Rightarrow> True | _ \\<Rightarrow> False)}\n  = {pc. \\<exists> ac. pc \\<in> ?S \\<and> P ! pc = Some (CEXP ac)}\n  \" by safe (auto split: option.splits instrc.splits)\n  show ?thesis unfolding conjunction_check_def Let_def \\<open>_ = _\\<close> ..\nqed\n\nlemma conjunction_check:\n  fixes u :: \"nat \\<Rightarrow> real\"\n  assumes \"conjunction_check\"\n    and \"stepst (conv_prog prog) n u (pc_s, st, s, f, rs) (pc_t, st_t, s_t, True, rs_t)\"\n    and \"stepsc (conv_prog prog) n u (pc_s, st, s, f, rs) (pc', st', s', f', rs')\"\n    and \"P ! pc' = Some (CEXP ac)\" \"pc' < length P\"\n  shows \"u \\<turnstile>\\<^sub>a conv_ac ac\"\n  using assms\n  unfolding conjunction_check_def Let_def\n  apply -\n  apply (erule disjE)\n   apply (drule is_conj'; simp)\n    apply (drule check_conj_block)\n  apply (subst is_conj; simp)\n  done\n\nend (* End of context for fixed program *)\n\nend (* Theory *)", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Uppaal_Networks/Program_Analysis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544335934766, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.3223680268951223}}
{"text": "theory SumRandom_Value\n  imports SumRandom_Abstractions\n\nbegin\n\n\ncontext SumRandom begin\n\nsection random_with_seed\n\ndefinition rand_with_seed_v :: \"(funtyp, vtyp) vval \\<Rightarrow> (funtyp, vtyp) vval \\<Rightarrow> bool\"\n  where\n  \"rand_with_seed_v x y = \n      (\\<exists>s s'. x = VAbstract (VSeed s) \\<and> \n              y = VAbstract (VSeed s'))\" \n\nlemma rand_with_seed_v_rename_monoexpr_correct:\n  \"\\<lbrakk>rand_with_seed_v (val.rename_val rename' (val.monoval v)) v'; \n    val.proc_env_matches \\<xi>\\<^sub>v \\<Xi>'; \n    proc_ctx_wellformed \\<Xi>'\\<rbrakk> \\<Longrightarrow> \n     v' = val.rename_val rename' (val.monoval v') \\<and> \n    rand_with_seed_v v v'\"\n  by (clarsimp simp: rand_with_seed_v_def) \n     (case_tac v; clarsimp)\n\nlemma rand_with_seed_v_preservation:\n  \"\\<lbrakk>val.vval_typing \\<Xi>' v t; rand_with_seed_v v v'\\<rbrakk>\n    \\<Longrightarrow> val.vval_typing \\<Xi>' v' t\"\n  by (fastforce elim: val.vval_typing.cases \n                intro: val.v_t_abstract \n                simp: rand_with_seed_v_def seed_abs_typing_v_def) \n\nend (* of context *)\n\nend", "meta": {"author": "amblafont", "repo": "dargent-examples", "sha": "dbcfdd6573c088f65d4dade1b351b3bb2bc073e7", "save_path": "github-repos/isabelle/amblafont-dargent-examples", "path": "github-repos/isabelle/amblafont-dargent-examples/dargent-examples-dbcfdd6573c088f65d4dade1b351b3bb2bc073e7/sum-random/manual/SumRandom_Value.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544210587586, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.3223680211164069}}
{"text": "(*  Title:      HOL/Auth/n_moesi_lemma_inv__2_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_moesi Protocol Case Study*} \n\ntheory n_moesi_lemma_inv__2_on_rules imports n_moesi_lemma_on_inv__2\nbegin\nsection{*All lemmas on causal relation between inv__2*}\nlemma lemma_inv__2_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__2  p__Inv0 p__Inv2)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rule_t1  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rule_t2 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rul_t3 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rul_t4 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rul_t5 N i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rule_t1  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rule_t1Vsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rule_t2 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rule_t2Vsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rul_t3 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rul_t3Vsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rul_t4 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rul_t4Vsinv__2) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rul_t5 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rul_t5Vsinv__2) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/moesi/n_moesi_lemma_inv__2_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544210587585, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.3223680211164069}}
{"text": "section \\<open>Semantics of SM\\<close>\ntheory SM_Semantics\nimports SM_State SM_Cfg Gen_Scheduler\nbegin\n\n  section \\<open>Evaluation of Expressions\\<close>\n  subsection \\<open>Basic operations\\<close>\n  text \\<open>Attention: Silently overflows, using 2's complement.\n    This should match Java-semantics. In C, signed overflow is undefined!\\<close>\n  primrec eval_bin_op :: \"bin_op \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> val\" where\n    \"eval_bin_op bo_plus v1 v2 = v1+v2\"\n  | \"eval_bin_op bo_minus v1 v2 = v1-v2\"\n  | \"eval_bin_op bo_mul v1 v2 = v1*v2\"\n  | \"eval_bin_op bo_div v1 v2 = v1 sdiv v2\"\n  | \"eval_bin_op bo_mod v1 v2 = v1 smod v2\"\n  | \"eval_bin_op bo_less v1 v2 = val_of_bool (v1 < v2)\"\n  | \"eval_bin_op bo_less_eq v1 v2 = val_of_bool (v1 \\<le> v2)\"\n  | \"eval_bin_op bo_eq v1 v2 = val_of_bool (v1 = v2)\"\n  | \"eval_bin_op bo_and v1 v2 = v1 AND v2\"\n  | \"eval_bin_op bo_or v1 v2 = v1 OR v2\"\n  | \"eval_bin_op bo_xor v1 v2 = v1 XOR v2\"\n\n  primrec eval_un_op :: \"un_op \\<Rightarrow> val \\<Rightarrow> val\" where\n    \"eval_un_op uo_minus v = -v\"  \\<comment> \\<open>Attention: Silently overflows. @{term \"-min_int = min_int\"}!\\<close>\n  | \"eval_un_op uo_not v = NOT v\"\n  \n  subsection \\<open>Expressions\\<close>\n  abbreviation exists_var :: \"valuation \\<Rightarrow> ident \\<Rightarrow> bool\" where\n    \"exists_var s x \\<equiv> x \\<in> dom s\"\n\n  abbreviation update_var :: \"ident \\<Rightarrow> val \\<Rightarrow> valuation \\<Rightarrow> valuation\" where\n    \"update_var x v s \\<equiv> s(x\\<mapsto>v)\"\n\n  fun eval_exp :: \"exp \\<Rightarrow> focused_state \\<rightharpoonup> val\" where\n    \"eval_exp (e_var x) (ls,gs) = do {\n      let lv = local_state.variables ls; let gv = global_state.variables gs;\n      case lv x of\n        Some v \\<Rightarrow> Some v\n      | None \\<Rightarrow> (case gv x of\n          Some v \\<Rightarrow> Some v\n        | None \\<Rightarrow> None)\n    }\"\n  | \"eval_exp (e_localvar x) (ls,gs) = local_state.variables ls x\"\n  | \"eval_exp (e_globalvar x) (ls,gs) = global_state.variables gs x\"\n  | \"eval_exp (e_const n) fs = do {\n      assert_option (n\\<ge>min_signed \\<and> n\\<le>max_signed);\n      Some (signed_of_int n)\n    }\"\n  | \"eval_exp (e_bin bop e1 e2) fs = do {\n      v1\\<leftarrow>eval_exp e1 fs;\n      v2\\<leftarrow>eval_exp e2 fs;\n      Some (eval_bin_op bop v1 v2)\n      }\"\n  | \"eval_exp (e_un uop e) fs = do {\n      v\\<leftarrow>eval_exp e fs;\n      Some (eval_un_op uop v)\n      }\"\n\n  subsection \\<open>Local Actions\\<close>\n\n  text \\<open>Enabledness and effects of actions\\<close>\n  primrec la_en :: \"focused_state \\<Rightarrow> action \\<rightharpoonup> bool\" where\n    \"la_en fs (AAssign c _ _) = do { v \\<leftarrow> eval_exp c fs; Some (bool_of_val v)}\"\n  | \"la_en fs (AAssign_local c _ _) = do { v \\<leftarrow> eval_exp c fs; Some (bool_of_val v)}\"\n  | \"la_en fs (AAssign_global c _ _) = do { v \\<leftarrow> eval_exp c fs; Some (bool_of_val v)}\"\n  | \"la_en fs (ATest e) = do {\n      v \\<leftarrow> eval_exp e fs;\n      Some (bool_of_val v)}\"\n  | \"la_en _ (ASkip) = Some True\"\n\n  text \\<open>Extension (for run, handshake): Let action have scheduler effect\\<close>\n  fun la_ex :: \"focused_state \\<Rightarrow> action \\<rightharpoonup> focused_state\" where\n    \"la_ex (ls,gs) (AAssign c x e) = do {\n      u \\<leftarrow> eval_exp c (ls,gs);\n      assert_option (bool_of_val u);\n      v \\<leftarrow> eval_exp e (ls,gs);\n      if exists_var (local_state.variables ls) x then do {\n        let ls = local_state.variables_update (update_var x v) ls;\n        Some (ls,gs)\n      } else do {\n        assert_option (exists_var (global_state.variables gs) x);\n        let gs = global_state.variables_update (update_var x v) gs;\n        Some (ls,gs)\n      }\n    }\"\n  | \"la_ex (ls,gs) (AAssign_local c x e) = do {\n      u \\<leftarrow> eval_exp c (ls,gs);\n      assert_option (bool_of_val u);\n      v \\<leftarrow> eval_exp e (ls,gs);\n      assert_option (exists_var (local_state.variables ls) x);\n      let ls = local_state.variables_update (update_var x v) ls;\n      Some (ls,gs)\n    }\"\n  | \"la_ex (ls,gs) (AAssign_global c x e) = do {\n      u \\<leftarrow> eval_exp c (ls,gs);\n      assert_option (bool_of_val u);\n      v \\<leftarrow> eval_exp e (ls,gs);\n      assert_option (exists_var (global_state.variables gs) x);\n      let gs = global_state.variables_update (update_var x v) gs;\n      Some (ls,gs)\n    }\"\n  | \"la_ex fs (ATest e) = do {\n      v \\<leftarrow> eval_exp e fs;\n      assert_option (bool_of_val v); \n      Some fs\n    }\"\n  | \"la_ex fs ASkip = Some fs\"\n\n\n  subsection \"Scheduling\"\n  type_synonym local_config = \"(cmd,local_state) local_config\"\n  type_synonym global_config = \"(cmd,local_state,global_state) global_config\"\n  \n  interpretation li: Gen_Scheduler cfg la_en la_ex .\n\n  subsection \\<open>Initial State\\<close>\n  definition init_valuation :: \"var_decl list \\<Rightarrow> valuation\" where\n    \"init_valuation vd x \\<equiv> if x \\<in> set vd then Some 0 else None\"\n\n  lemma init_valuation_eq_Some[simp]: \"init_valuation vd x = Some v \\<longleftrightarrow> x\\<in>set vd \\<and> v=0\"  \n    unfolding init_valuation_def by auto\n\n  lemma init_valuation_eq_None[simp]: \"init_valuation vd x = None \\<longleftrightarrow> x\\<notin>set vd\"  \n    unfolding init_valuation_def by auto\n\n  definition init_pc :: \"proc_decl \\<Rightarrow> local_config\" where\n    \"init_pc pd \\<equiv> \\<lparr>\n      local_config.command = proc_decl.body pd,\n      local_config.state = \\<lparr>\n        local_state.variables = init_valuation (proc_decl.local_vars pd)\n      \\<rparr>\n    \\<rparr>\"\n\n  definition init_gc :: \"program \\<Rightarrow> global_config\" where\n    \"init_gc prog \\<equiv> \\<lparr>\n      global_config.processes = mset (map init_pc (program.processes prog)),\n      global_config.state = \\<lparr>\n        global_state.variables = init_valuation (program.global_vars prog)\n      \\<rparr>\n    \\<rparr>\"\n\n  subsection \"Semantics Reference Point\"\n  \n  interpretation li: Gen_Scheduler_linit cfg la_en la_ex \"{init_gc prog}\" global_config.state\n    for prog .\n  \n  abbreviation \"ref_is_run \\<equiv> li.sa.is_run\"\n  abbreviation \"ref_accept \\<equiv> li.sa.accept\"\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/RefPoint/SM_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544085240401, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.3223680153376914}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |                    May 2005               |\n            |                   June 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2017         |\n            |                  April 2018  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_T_law_rep_par\nimports CSP_T_law_alpha_par CSP_T_op_rep_par\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(*****************************************************************\n\n         1. associativity of [||]:I\n         2. commutativity of [||]:I\n         3. \n         4. \n\n *****************************************************************)\n\n(*****************************************************\n   replace an index set with another equal index set\n *****************************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspT_Rep_parallel_index_eq:\n   \"[| finite I1 ;\n       EX f. I2 = f ` I1 & inj_on f I1 &\n             (ALL i:I1. PXf2 (f i) = PXf1 i) |]\n    ==> [||]:I1 PXf1 =T[M,M] [||]:I2 PXf2\"\napply (simp add: cspT_semantics)\n\napply (case_tac \"I1 = {}\")\napply (simp)\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)\n apply (elim conjE exE)\n   apply (simp add: in_traces_par)\n(* not necessary for Isabelle 2017\n apply (subgoal_tac \"Union (snd ` PXf2 ` f ` I1) = Union (snd ` PXf1 ` I1)\")\n apply (simp)\n apply (simp add: Union_index_fun)\n*)\n\n (* => *)\n apply (rule)\n apply (elim conjE exE)\n  apply (simp add: in_traces_par)\n(* not necessary for Isabelle 2017\n apply (subgoal_tac \"Union (snd ` PXf2 ` f ` I1) = Union (snd ` PXf1 ` I1)\")\n apply (simp)\n apply (simp add: Union_index_fun)\n*)\ndone\n\n(*********************************************************\n                [||]:I PXf ==> [||] PXs\n *********************************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspT_Index_to_Inductive_parallel:\n  \"[| finite I ; Is isListOf I |] ==>\n   [||]:I PXf =T[M,M] [||] (map PXf Is)\"\napply (simp add: cspT_semantics)\n\napply (case_tac \"I = {}\")\napply (simp)\n\napply (case_tac \"map PXf Is = []\")\napply (simp)\napply (rule order_antisym)\n\n (* <= *)\n apply (rule)\n apply (simp add: in_traces_Rep_parallel)\n apply (simp add: in_traces_Inductive_parallel_nth)\n apply (simp add: isListOf_set_eq)\n apply (intro allI impI)\n apply (elim conjE exE)\n apply (drule_tac x=\"Is!i\" in bspec)\n apply (simp add: isListOf_nth_in_index)\n apply (simp)\n\n (* => *)\n apply (rule)\n apply (simp add: in_traces_Rep_parallel)\n apply (simp add: in_traces_Inductive_parallel_nth)\n apply (simp add: isListOf_set_eq)\n apply (intro ballI)\n apply (elim conjE)\n apply (erule isListOf_index_to_nthE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (elim exE conjE)\n apply (drule_tac x=\"n\" in spec, simp)\ndone\n\n(************************************\n |       [||]:I PXf and SKIP        |\n ************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspT_SKIP_Rep_parallel_right:\n  \"finite I ==>\n   (([||]:I PXf) |[Union (snd `  PXf ` I), {}]| SKIP) =T[M,M]\n   ([||]:I PXf)\"\napply (case_tac \"I={}\")\napply (simp add: cspT_SKIP_Alpha_parallel)\n\napply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_traces_par)\n\n apply (intro ballI)\n apply (elim conjE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_traces_par in_traces)\n apply (simp add: rest_tr_empty)\n\n apply (intro ballI)\n apply (elim conjE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (force)\ndone\n\n(************************************\n |        SKIP and [||]:I PXf       |\n ************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\n\nlemma cspT_SKIP_Rep_parallel_left:\n  \"finite I ==>\n   (SKIP |[{}, Union (snd ` PXf ` I)]| ([||]:I PXf)) =T[M,M]\n   ([||]:I PXf)\"\n  apply (subgoal_tac \n    \"(SKIP |[{}, Union (snd ` PXf ` I)]| ([||]:I PXf)) =T[M,M]\n     (([||]:I PXf) |[Union (snd ` PXf ` I), {}]| SKIP)\")\napply (rule cspT_trans)\n(* modified for Isabelle 2017 *)\n  apply (simp del: UN_simps SUP_image)\n  apply (simp del: UN_simps SUP_image add: cspT_SKIP_Rep_parallel_right)\napply (simp add: cspT_Alpha_parallel_commut)\ndone\n\n(*** left and right ***)\n\nlemmas cspT_SKIP_Rep_parallel = cspT_SKIP_Rep_parallel_left\n                                  cspT_SKIP_Rep_parallel_right\n\n(************************************\n |          associativity           |\n ************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspT_Rep_parallel_assoc:\n \"[| I1 Int I2 = {} ; finite I1 ; finite I2 |] ==>\n  [||]:(I1 Un I2) PXf =T[M,M]\n  [||]:I1 PXf |[Union (snd ` PXf ` I1), Union (snd ` PXf ` I2)]| [||]:I2 PXf\"\n\n  apply (case_tac \"I1 = {}\")\n   apply (case_tac \"I2 = {}\")\n    apply (rule cspT_sym)\n    apply (simp add: cspT_SKIP_Alpha_parallel)\n\n   apply (rule cspT_sym)\n(* for Isabelle 2017 *)\n   apply (simp del: UN_simps SUP_image add: cspT_SKIP_Rep_parallel)\n\n  apply (case_tac \"I2 = {}\")\n   apply (rule cspT_sym)\n(* for Isabelle 2017 *)\n   apply (simp del: UN_simps SUP_image add: cspT_SKIP_Rep_parallel)\n  apply (simp add: cspT_semantics)\napply (rule order_antisym)\n\n (* => *)\n apply (rule)\n(* for Isabelle 2017 *)\n apply (simp del: UN_simps SUP_image add: in_traces_par)\n apply (simp add: Union_snd_Un)\n apply (elim conjE)\n apply (rule conjI)\n\n  apply (intro ballI)\n  apply (drule_tac x=\"i\" in bspec, simp)\n  apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I1)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n  apply (force)\n\n  apply (intro ballI)\n  apply (drule_tac x=\"i\" in bspec, simp)\n  apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I2)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n  apply (force)\n\n (* <= *)\n apply (rule)\n(* for Isabelle 2017 *)\n apply (simp del: UN_simps SUP_image add: in_traces_par)\n apply (simp add: Union_snd_Un)\n apply (elim conjE)\n\n apply (intro ballI)\n apply (simp)\n apply (erule disjE)\n\n  apply (drule_tac x=\"i\" in bspec, simp)\n  apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I1)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n  apply (force)\n\n  apply (drule_tac x=\"i\" in bspec, simp)\n  apply (subgoal_tac \"snd (PXf i) <= Union (snd ` PXf ` I2)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n  apply (force)\ndone\n\n(************************************\n |             induct               |\n ************************************)\n\n(*------------------*\n |     csp law      |\n |   (derivable)    |\n *------------------*)\n\nlemma cspT_Rep_parallel_induct:\n \"[| finite I ; i ~: I |] ==>\n  [||]:(insert i I) PXf =T[M,M]\n  fst (PXf i) |[snd (PXf i), Union (snd ` PXf ` I)]| [||]:I PXf\"\napply (insert cspT_Rep_parallel_assoc[of \"{i}\" I PXf M])\napply (simp add: Rep_parallel_one)\napply (rule cspT_trans)\napply (simp)\n\napply (insert cspT_Alpha_parallel_assoc\n  [of \"fst (PXf i)\" \"snd (PXf i)\" \"{}\" \"SKIP\" \"Union (snd ` PXf ` I)\" \"[||]:I PXf\" M])\napply (rule cspT_trans)\napply (simp)\n\n  apply (rule cspT_decompo_Alpha_parallel)\n(* for Isabelle 2017 *)\napply (simp_all)\napply (simp add: cspT_SKIP_Rep_parallel[simplified])\ndone\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(*\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\nend\n\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/CSP_T_law_rep_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.5544704649604274, "lm_q1q2_score": 0.32231538690869244}}
{"text": "(*  Title:      ZF/Induct/Datatypes.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1994  University of Cambridge\n*)\n\nsection \\<open>Sample datatype definitions\\<close>\n\ntheory Datatypes imports ZF begin\n\nsubsection \\<open>A type with four constructors\\<close>\n\ntext \\<open>\n  It has four contructors, of arities 0--3, and two parameters \\<open>A\\<close> and \\<open>B\\<close>.\n\\<close>\n\nconsts\n  data :: \"[i, i] => i\"\n\ndatatype \"data(A, B)\" =\n    Con0\n  | Con1 (\"a \\<in> A\")\n  | Con2 (\"a \\<in> A\", \"b \\<in> B\")\n  | Con3 (\"a \\<in> A\", \"b \\<in> B\", \"d \\<in> data(A, B)\")\n\nlemma data_unfold: \"data(A, B) = ({0} + A) + (A \\<times> B + A \\<times> B \\<times> data(A, B))\"\n  by (fast intro!: data.intros [unfolded data.con_defs]\n    elim: data.cases [unfolded data.con_defs])\n\ntext \\<open>\n  \\medskip Lemmas to justify using @{term data} in other recursive\n  type definitions.\n\\<close>\n\nlemma data_mono: \"[| A \\<subseteq> C; B \\<subseteq> D |] ==> data(A, B) \\<subseteq> data(C, D)\"\n  apply (unfold data.defs)\n  apply (rule lfp_mono)\n   apply (rule data.bnd_mono)+\n  apply (rule univ_mono Un_mono basic_monos | assumption)+\n  done\n\nlemma data_univ: \"data(univ(A), univ(A)) \\<subseteq> univ(A)\"\n  apply (unfold data.defs data.con_defs)\n  apply (rule lfp_lowerbound)\n   apply (rule_tac [2] subset_trans [OF A_subset_univ Un_upper1, THEN univ_mono])\n  apply (fast intro!: zero_in_univ Inl_in_univ Inr_in_univ Pair_in_univ)\n  done\n\nlemma data_subset_univ:\n    \"[| A \\<subseteq> univ(C); B \\<subseteq> univ(C) |] ==> data(A, B) \\<subseteq> univ(C)\"\n  by (rule subset_trans [OF data_mono data_univ])\n\n\nsubsection \\<open>Example of a big enumeration type\\<close>\n\ntext \\<open>\n  Can go up to at least 100 constructors, but it takes nearly 7\n  minutes \\dots\\ (back in 1994 that is).\n\\<close>\n\nconsts\n  enum :: i\n\ndatatype enum =\n    C00 | C01 | C02 | C03 | C04 | C05 | C06 | C07 | C08 | C09\n  | C10 | C11 | C12 | C13 | C14 | C15 | C16 | C17 | C18 | C19\n  | C20 | C21 | C22 | C23 | C24 | C25 | C26 | C27 | C28 | C29\n  | C30 | C31 | C32 | C33 | C34 | C35 | C36 | C37 | C38 | C39\n  | C40 | C41 | C42 | C43 | C44 | C45 | C46 | C47 | C48 | C49\n  | C50 | C51 | C52 | C53 | C54 | C55 | C56 | C57 | C58 | C59\n\nend\n", "meta": {"author": "alexkrauss", "repo": "isabelle-zf-experiments", "sha": "6477db2ffcd2bf71287168d8061c218b29436e5b", "save_path": "github-repos/isabelle/alexkrauss-isabelle-zf-experiments", "path": "github-repos/isabelle/alexkrauss-isabelle-zf-experiments/isabelle-zf-experiments-6477db2ffcd2bf71287168d8061c218b29436e5b/src/Induct/Datatypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410572017153, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.32231162895246496}}
{"text": "section \\<open> Separation Logic \\<close>\n\ntheory utp_mem_seplog\n  imports utp_mem_aseplog utp_mem_prog\nbegin\n\ndefinition heaplet :: \"(addr, 's) uexpr \\<Rightarrow> ('a::{countable,infinite}, 's) uexpr \\<Rightarrow> 's mpred\" (infix \"\\<^bold>\\<mapsto>\" 70) where\n[upred_defs]: \"v \\<^bold>\\<mapsto> e = (dom\\<^sub>u(&hp) =\\<^sub>u {v \\<oplus>\\<^sub>p str}\\<^sub>u \\<and> &hp(v \\<oplus>\\<^sub>p str)\\<^sub>a =\\<^sub>u uop to_nat_bij (e \\<oplus>\\<^sub>p str))\"\n\nabbreviation heaplet_min :: \"(addr, 's) uexpr \\<Rightarrow> ('a::{countable,infinite}, 's) uexpr \\<Rightarrow> 's mpred\" (infix \"\\<^bold>\\<hookrightarrow>\" 70) where\n\"v \\<^bold>\\<hookrightarrow> e \\<equiv> v \\<^bold>\\<mapsto> e \\<^bold>* true\"\n\nabbreviation heaplet_ex :: \"(addr, 's) uexpr \\<Rightarrow> 's mpred\" (\"_ \\<^bold>\\<mapsto> -\" [69] 70) where\n\"e \\<^bold>\\<mapsto> - \\<equiv> (\\<^bold>\\<exists> v::nat \\<bullet> e \\<^bold>\\<mapsto> \\<guillemotleft>v\\<guillemotright>)\"\n\nlemma local_wrt_heap_lookup: \n  \"\\<lbrakk> vwb_lens x; x \\<sharp> e; str:x \\<sharp> p \\<rbrakk> \\<Longrightarrow> local_wrt p (x := *e)\"\n  apply (rel_simp)\n  apply (rename_tac q st hp0 hp1)\n  apply (rule_tac x=\"hp0\" in exI)\n  apply (auto)\n  done\n\nsubsection \\<open> Separation Logic Laws \\<close>\n\nlemma allocation_noninterfering_local:\n  \"{emp}v := alloc(e){&v \\<^bold>\\<mapsto> e}\\<^sub>D\"\n  by (rel_auto)\n\nlemma allocation_noninterfering_global:\n  \"\\<lbrakk> vwb_lens x; str:x \\<sharp> p \\<rbrakk> \\<Longrightarrow> {p}x := alloc(e){p \\<^bold>* &x \\<^bold>\\<mapsto> e}\\<^sub>D\"\n  apply (rel_simp)\n  apply (rename_tac ok hp st ok' l)\n  apply (rule_tac x=\"hp\" in exI)\n  apply (rule_tac x=\"bot(l \\<mapsto> to_nat_bij (\\<lbrakk>e\\<rbrakk>\\<^sub>e (put\\<^bsub>x\\<^esub> st l)))\\<^sub>f\" in exI)\n  apply (simp add: ffun_indep_compat)\n  done\n\nlemma mutation_local: \"{e \\<^bold>\\<mapsto> -} *e := v {e \\<^bold>\\<mapsto> v}\\<^sub>D\"\n  by (rel_auto)\n\nlemma mutation_global: \"{p \\<^bold>* e \\<^bold>\\<mapsto> -} *e := v {p \\<^bold>* e \\<^bold>\\<mapsto> v}\\<^sub>D\"\n  apply (rel_simp)\n  apply (rename_tac st ok' a b x)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"b(\\<lbrakk>e\\<rbrakk>\\<^sub>e st \\<mapsto> to_nat_bij (\\<lbrakk>v\\<rbrakk>\\<^sub>e st))\\<^sub>f\" in exI)\n  apply (auto simp add: compatible_ffun_def compatible_pfun_def)\n  oops\n\nlemma deallocation_local:\n  \"{e \\<^bold>\\<mapsto> -} dealloc(e) {emp}\\<^sub>D\"\n  by (rel_auto)\n\nlemma deallocation_global:\n  \"{r \\<^bold>* e \\<^bold>\\<mapsto> -} dealloc(e) {r}\\<^sub>D\"\n  apply (rel_simp)\n  apply (rename_tac ok st ok' a b x)\n  apply (subgoal_tac \"fdom(a) \\<lhd>\\<^sub>f b = fdom(a) \\<lhd>\\<^sub>f (fdom(b) \\<lhd>\\<^sub>f b)\")\n   apply (simp add: compatible_ffun_def)\n  oops\n\nlemma lookup_global:\n  \"\\<lbrakk> vwb_lens x; x \\<sharp> e; x \\<sharp> v; str:x \\<sharp> r \\<rbrakk> \\<Longrightarrow> \n    {r \\<^bold>* e \\<^bold>\\<mapsto> v} x := *e {r \\<^bold>* (&str:x =\\<^sub>u (v \\<oplus>\\<^sub>p str) \\<and> e \\<^bold>\\<mapsto> v)}\\<^sub>D\"\n  by (rel_auto)\n  \nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/memory/utp_mem_seplog.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.322311622524577}}
{"text": "theory Repetition\n  imports BigStepSimple\nbegin\n\nsubsection \\<open>Alternative rule for repetition\\<close>\n\ntheorem Valid_frame:\n  assumes \"\\<Turnstile> {\\<lambda>s tr. P s \\<and> tr = []} c {\\<lambda>s tr. Q s \\<and> R tr}\"\n  shows \"\\<Turnstile> {\\<lambda>s tr. P s \\<and> R' tr} c {\\<lambda>s tr. Q s \\<and> (R' @\\<^sub>t R) tr}\"\n  using assms unfolding Valid_def\n  by (auto simp add: join_assn_def)\n\ntheorem Valid_loop2:\n  assumes \"\\<And>a tr1 tr2. Q a tr1 \\<Longrightarrow> P (f a) tr2 \\<Longrightarrow> P a (tr1 @ tr2)\"\n    and \"\\<And>a. \\<Turnstile> {\\<lambda>s tr. R a s \\<and> tr = []} c {\\<lambda>s tr. R (f a) s \\<and> Q a tr}\"\n  shows \"\\<Turnstile> {\\<lambda>s tr. \\<exists>b. R b s \\<and> (P b @- P a) tr} c {\\<lambda>s tr. \\<exists>b. R b s \\<and> (P b @- P a) tr}\"\n  apply (rule Valid_ex_pre)\n  subgoal for b\n    apply (rule Valid_ex_post) apply (rule exI[where x=\"f b\"])\n    apply (rule Valid_strengthen_post)\n     prefer 2 apply (rule Valid_frame[OF assms(2)])\n    apply (auto simp add: entails_def)\n    using assms(1) by (auto simp add: join_assn_def magic_wand_assn_def)\n  done\n\ntheorem Valid_loop3:\n  assumes \"\\<And>a. P a []\"\n  assumes \"\\<And>a tr1 tr2. Q a tr1 \\<Longrightarrow> P (f a) tr2 \\<Longrightarrow> P a (tr1 @ tr2)\"\n    and \"\\<And>a. \\<Turnstile> {\\<lambda>s tr. R a s \\<and> tr = []} c {\\<lambda>s tr. R (f a) s \\<and> Q a tr}\"\n  shows \"\\<Turnstile> {\\<lambda>s tr. R a s \\<and> tr = []} Rep c {\\<lambda>s tr. \\<exists>b. R b s \\<and> P a tr}\"\n  apply (rule Valid_weaken_pre)\n  prefer 2 apply (rule Valid_strengthen_post)\n    prefer 2 apply (rule Valid_rep[where P=\"\\<lambda>s tr. \\<exists>b. R b s \\<and> (P b @- P a) tr\"])\n    apply (rule Valid_loop2[of Q P f])\n  using assms apply auto\n  using assms(1) apply (auto simp add: entails_def magic_wand_assn_def)\n  by fastforce\n\n\nend\n", "meta": {"author": "bzhan", "repo": "mars", "sha": "d10e489a8ddf128a4cbac13291efdece458d732d", "save_path": "github-repos/isabelle/bzhan-mars", "path": "github-repos/isabelle/bzhan-mars/mars-d10e489a8ddf128a4cbac13291efdece458d732d/lunarlander_sl/Repetition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.32226613094138096}}
{"text": "(*******************************************************************************\n\n  Project: Development of Security Protocols by Refinement\n\n  Module:   Key_establish/m1_kerberos.thy (Isabelle/HOL 2016)\n  ID:       $Id: m1_kerberos.thy 133856 2017-03-20 18:05:54Z csprenge $\n  Author:   Ivano Somaini, ETH Zurich <somainii@student.ethz.ch>\n            Christoph Sprenger, ETH Zurich <sprenger@inf.ethz.ch>\n\n  Key distribution protocols\n  Abstract version of Kerberos protocol with server-authentication and\n  mutual initiator and responder authentication.\n\n  Copyright (c) 2009-2016 Ivano Somaini, Christoph Sprenger\n  Licence: LGPL\n\n*******************************************************************************)\n\nsection \\<open>Abstract Kerberos core protocol (L1)\\<close>\n\ntheory m1_kerberos imports m1_keydist_iirn\nbegin\n\ntext \\<open>We augment the basic abstract key distribution model such that \nthe server sends a timestamp along with the session key. We use a cache to \nguard against replay attacks and timestamp validity checks to ensure recentness\nof the session key. \n\nWe establish three refinements for this model, namely that this model refines\n\\begin{enumerate}\n\\item the authenticated key distribution model \\<open>m1_keydist_iirn\\<close>, \n\n\\item the injective agreement model \\<open>a0i\\<close>, instantiated such that \nthe responder agrees with the initiator on the session key, its timestamp\nand the initiator's authenticator timestamp.\n\n\\item the injective agreement model \\<open>a0i\\<close>, instantiated such that \nthe initiator agrees with the responder on the session key, its timestamp\nand the initiator's authenticator timestamp.\n\\end{enumerate}\n\\<close>\n\n(******************************************************************************)\nsubsection \\<open>State\\<close>\n(******************************************************************************)\n\ntext \\<open>We extend the basic key distribution by adding timestamps. \nWe add a clock variable modeling the current time and an authenticator\nreplay cache recording triples @{term \"(A, Kab, Ta)\"} of agents, session keys,\nand authenticator timestamps. The inclusion of the session key avoids false\nreplay rejections for different keys with identical authenticator timestamps.\n\nThe frames, runs, and observations remain the same as in the previous model, \nbut we will use the @{typ \"nat list\"}'s to store timestamps. \n\\<close>\n\ntype_synonym\n  time = \"nat\"                     \\<comment> \\<open>for clock and timestamps\\<close>\n\nconsts\n  Ls :: \"time\"                     \\<comment> \\<open>life time for session keys\\<close>\n  La :: \"time\"                     \\<comment> \\<open>life time for authenticators\\<close>\n\n\ntext \\<open>State and observations\\<close>\n\nrecord\n  m1_state = \"m1r_state\" +\n    leak :: \"(key \\<times> agent \\<times> agent \\<times> nonce \\<times> time) set\"   \\<comment> \\<open>key leaked plus context\\<close>\n    clk :: \"time\" \n    cache :: \"(agent \\<times> key \\<times> time) set\" \n\ntype_synonym m1_obs = \"m1_state\"\n\ntype_synonym 'x m1_pred = \"'x m1_state_scheme set\"\ntype_synonym 'x m1_trans = \"('x m1_state_scheme \\<times> 'x m1_state_scheme) set\"\n\nconsts\n  END :: \"atom\"                    \\<comment> \\<open>run end marker (for initiator)\\<close>\n\n\n(******************************************************************************)\nsubsection \\<open>Events\\<close>\n(******************************************************************************)\n\ndefinition         \\<comment> \\<open>by @{term \"A\"}, refines @{term \"m1x_step1\"}\\<close>\n  m1_step1 :: \"[rid_t, agent, agent, nonce] \\<Rightarrow> 'x m1_trans\"\nwhere\n  \"m1_step1 \\<equiv> m1a_step1\"\n\ndefinition       \\<comment> \\<open>by @{term \"B\"}, refines @{term \"m1x_step2\"}\\<close>\n  m1_step2 :: \"[rid_t, agent, agent] \\<Rightarrow> 'x m1_trans\"\nwhere\n  \"m1_step2 \\<equiv> m1a_step2\"\n\ndefinition       \\<comment> \\<open>by @{term \"Server\"}, refines @{term m1x_step3}\\<close>\n  m1_step3 :: \"[rid_t, agent, agent, key, nonce, time] \\<Rightarrow> 'x m1_trans\"\nwhere\n  \"m1_step3 Rs A B Kab Na Ts \\<equiv> {(s, s').\n     \\<comment> \\<open>new guards:\\<close>\n     Ts = clk s \\<and>                      \\<comment> \\<open>fresh timestamp\\<close>\n\n     \\<comment> \\<open>rest as before:\\<close>\n     (s, s') \\<in> m1a_step3 Rs A B Kab Na [aNum Ts]\n  }\"\n\ndefinition         \\<comment> \\<open>by @{text \"A\"}, refines @{term m1x_step5}\\<close>\n  m1_step4 :: \"[rid_t, agent, agent, nonce, key, time, time] \\<Rightarrow> 'x m1_trans\"\nwhere\n  \"m1_step4 Ra A B Na Kab Ts Ta \\<equiv> {(s, s').\n     \\<comment> \\<open>previous guards:\\<close>\n     runs s Ra = Some (Init, [A, B], []) \\<and>\n     (Kab \\<notin> Domain (leak s) \\<longrightarrow> (Kab, A) \\<in> azC (runs s)) \\<and>   \\<comment> \\<open>authorization guard\\<close>\n     Na = Ra$na \\<and>                                     \\<comment> \\<open>fix parameter\\<close>\n\n     \\<comment> \\<open>guard for agreement with server on \\<open>(Kab, B, Na, isl)\\<close>,\\<close>\n     \\<comment> \\<open>where \\<open>isl = take is_len nla\\<close>; injectiveness by including \\<open>Na\\<close>\\<close>\n     (A \\<notin> bad \\<longrightarrow> (\\<exists>Rs. Kab = sesK (Rs$sk) \\<and>\n        runs s Rs = Some (Serv, [A, B], [aNon Na, aNum Ts]))) \\<and>\n\n     \\<comment> \\<open>new guards:\\<close>\n     Ta = clk s \\<and>                     \\<comment> \\<open>fresh timestamp\\<close>\n     clk s < Ts + Ls \\<and>                \\<comment> \\<open>ensure session key recentness\\<close>\n\n     \\<comment> \\<open>actions:\\<close>\n     s' = s\\<lparr> runs := (runs s)(Ra \\<mapsto> (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta])) \\<rparr>\n  }\"\n\ndefinition         \\<comment> \\<open>by @{term \"B\"}, refines @{term m1x_step4}\\<close>\n  m1_step5 :: \"[rid_t, agent, agent, key, time, time] \\<Rightarrow> 'x m1_trans\"\nwhere\n  \"m1_step5 Rb A B Kab Ts Ta \\<equiv> {(s, s'). \n     \\<comment> \\<open>previous guards:\\<close>\n     runs s Rb = Some (Resp, [A, B], []) \\<and> \n     (Kab \\<notin> Domain (leak s) \\<longrightarrow> (Kab, B) \\<in> azC (runs s)) \\<and>  \\<comment> \\<open>authorization guard\\<close>\n\n     \\<comment> \\<open>guard for showing agreement with server on \\<open>(Kab, A, rsl)\\<close>,\\<close>\n     \\<comment> \\<open>where \\<open>rsl = take rs_len nlb\\<close>; this agreement is non-injective\\<close>\n     (B \\<notin> bad \\<longrightarrow> (\\<exists>Rs Na. Kab = sesK (Rs$sk) \\<and>\n        runs s Rs = Some (Serv, [A, B], [aNon Na, aNum Ts]))) \\<and>\n\n     \\<comment> \\<open>new guards:\\<close>\n     \\<comment> \\<open>guard for showing agreement with initiator \\<open>A\\<close> on \\<open>(Kab, Ts, Ta)\\<close>\\<close>\n     (A \\<notin> bad \\<longrightarrow> B \\<notin> bad \\<longrightarrow> \n       (\\<exists>Ra nl. runs s Ra = Some (Init, [A, B], aKey Kab # aNum Ts # aNum Ta # nl))) \\<and>\n\n     \\<comment> \\<open>ensure recentness of session key\\<close>\n     clk s < Ts + Ls \\<and>\n\n     \\<comment> \\<open>check validity of authenticator and prevent its replay\\<close>\n     \\<comment> \\<open>'replays' with fresh authenticator ok!\\<close>\n     clk s < Ta + La \\<and> \n     (B, Kab, Ta) \\<notin> cache s \\<and> \n\n     \\<comment> \\<open>actions:\\<close>\n     s' = s\\<lparr>\n       runs := (runs s)(Rb \\<mapsto> (Resp, [A, B], [aKey Kab, aNum Ts, aNum Ta])),\n       cache := insert (B, Kab, Ta) (cache s) \n     \\<rparr>\n  }\"\n\ndefinition         \\<comment> \\<open>by @{term \"A\"}, refines @{term skip}\\<close>\n  m1_step6 :: \"[rid_t, agent, agent, nonce, key, time, time] \\<Rightarrow> 'x m1_trans\"\nwhere\n  \"m1_step6 Ra A B Na Kab Ts Ta \\<equiv> {(s, s').\n     runs s Ra = Some (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta]) \\<and>  \\<comment> \\<open>key recv'd before\\<close>\n     Na = Ra$na \\<and>                                                     \\<comment> \\<open>fix parameter\\<close>\n\n     \\<comment> \\<open>check key's freshness [NEW]\\<close>\n     \\<comment> \\<open>\\<open>clk s < Ts + Ls \\<and>\\<close>\\<close>\n\n     \\<comment> \\<open>guard for showing agreement with \\<open>B\\<close> on \\<open>Kab\\<close>, \\<open>Ts\\<close>, and \\<open>Ta\\<close>\\<close>\n     (A \\<notin> bad \\<longrightarrow> B \\<notin> bad \\<longrightarrow> \n       (\\<exists>Rb. runs s Rb = Some (Resp, [A, B], [aKey Kab, aNum Ts, aNum Ta]))) \\<and> \n\n     \\<comment> \\<open>actions: (redundant) update local state marks successful termination\\<close>\n     s' = s\\<lparr>\n       runs := (runs s)(Ra \\<mapsto> (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta, END])) \n     \\<rparr>\n  }\"\n\ndefinition         \\<comment> \\<open>by attacker, refines @{term m1a_leak}\\<close>\n  m1_leak :: \"[rid_t, agent, agent, nonce, time] \\<Rightarrow> 'x m1_trans\"\nwhere\n  \"m1_leak Rs A B Na Ts \\<equiv> {(s, s1).\n    \\<comment> \\<open>guards:\\<close>\n    runs s Rs = Some (Serv, [A, B], [aNon Na, aNum Ts]) \\<and> \n    (clk s \\<ge> Ts + Ls) \\<and>             \\<comment> \\<open>only compromise 'old' session keys\\<close>\n\n    \\<comment> \\<open>actions:\\<close>\n    \\<comment> \\<open>record session key as leaked;\\<close>\n    s1 = s\\<lparr> leak := insert (sesK (Rs$sk), A, B, Na, Ts) (leak s) \\<rparr> \n  }\"\n\n\ntext \\<open>Clock tick event\\<close>\n\ndefinition     \\<comment> \\<open>refines @{term skip}\\<close>\n  m1_tick :: \"time \\<Rightarrow> 'x m1_trans\"\nwhere\n  \"m1_tick T \\<equiv> {(s, s').\n     s' = s\\<lparr> clk := clk s + T \\<rparr> \n  }\"\n\n\ntext \\<open>Purge event: purge cache of expired timestamps\\<close>\n\ndefinition     \\<comment> \\<open>refines @{term skip}\\<close>\n  m1_purge :: \"agent \\<Rightarrow> 'x m1_trans\"\nwhere\n  \"m1_purge A \\<equiv> {(s, s').\n     s' = s\\<lparr> \n       cache := cache s - {(A, K, T) | A K T. \n         (A, K, T) \\<in> cache s \\<and> T + La \\<le> clk s\n       } \n     \\<rparr> \n  }\"\n\n\n(******************************************************************************)\nsubsection \\<open>Specification\\<close>\n(******************************************************************************)\n\ndefinition\n  m1_init :: \"m1_state set\"\nwhere\n  \"m1_init \\<equiv> { \\<lparr> runs = Map.empty, leak = corrKey \\<times> {undefined}, clk = 0, cache = {} \\<rparr> }\" \n\ndefinition \n  m1_trans :: \"'x m1_trans\" where\n  \"m1_trans \\<equiv> (\\<Union>A B Ra Rb Rs Na Kab Ts Ta T.\n        m1_step1 Ra A B Na \\<union>\n        m1_step2 Rb A B \\<union>\n        m1_step3 Rs A B Kab Na Ts \\<union>\n        m1_step4 Ra A B Na Kab Ts Ta \\<union>\n        m1_step5 Rb A B Kab Ts Ta \\<union>\n        m1_step6 Ra A B Na Kab Ts Ta \\<union> \n        m1_leak Rs A B Na Ts \\<union>\n        m1_tick T \\<union>\n        m1_purge A \\<union> \n        Id\n  )\"\n\ndefinition \n  m1 :: \"(m1_state, m1_obs) spec\" where\n  \"m1 \\<equiv> \\<lparr>\n      init = m1_init,\n      trans = m1_trans,\n      obs = id\n  \\<rparr>\" \n\nlemmas m1_loc_defs = \n  m1_def m1_init_def m1_trans_def\n  m1_step1_def m1_step2_def m1_step3_def m1_step4_def m1_step5_def \n  m1_step6_def m1_leak_def m1_purge_def m1_tick_def\n\nlemmas m1_defs = m1_loc_defs m1a_defs\n\nlemma m1_obs_id [simp]: \"obs m1 = id\"\nby (simp add: m1_def)\n\n\n(******************************************************************************)\nsubsection \\<open>Invariants\\<close>\n(******************************************************************************)\n\nsubsubsection \\<open>inv0: Finite domain\\<close>\n(*inv**************************************************************************)\n\ntext \\<open>There are only finitely many runs. This is needed to establish\nthe responder/initiator agreement.\\<close>\n\ndefinition \n  m1_inv0_fin :: \"'x m1_pred\"\nwhere\n  \"m1_inv0_fin \\<equiv> {s. finite (dom (runs s))}\"\n\nlemmas m1_inv0_finI = m1_inv0_fin_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv0_finE [elim] = m1_inv0_fin_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv0_finD = m1_inv0_fin_def [THEN setc_def_to_dest, rule_format]\n\ntext \\<open>Invariance proofs.\\<close>\n\nlemma PO_m1_inv0_fin_init [iff]:\n  \"init m1 \\<subseteq> m1_inv0_fin\"\nby (auto simp add: m1_defs intro!: m1_inv0_finI)\n\nlemma PO_m1_inv0_fin_trans [iff]:\n  \"{m1_inv0_fin} trans m1 {> m1_inv0_fin}\"\nby (auto simp add: PO_hoare_defs m1_defs intro!: m1_inv0_finI)\n\nlemma PO_m1_inv0_fin [iff]: \"reach m1 \\<subseteq> m1_inv0_fin\"\nby (rule inv_rule_incr, auto del: subsetI)\n\n\nsubsubsection \\<open>inv1: Caching invariant for responder\\<close>\n(*inv**************************************************************************)\n\ndefinition \n  m1_inv1r_cache :: \"'x m1_pred\"\nwhere\n  \"m1_inv1r_cache \\<equiv> {s. \\<forall>Rb A B Kab Ts Ta nl.\n     runs s Rb = Some (Resp, [A, B], aKey Kab # aNum Ts # aNum Ta # nl) \\<longrightarrow> \n     clk s < Ta + La \\<longrightarrow>\n       (B, Kab, Ta) \\<in> cache s\n  }\"\n\nlemmas m1_inv1r_cacheI = m1_inv1r_cache_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv1r_cacheE [elim] = m1_inv1r_cache_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv1r_cacheD = m1_inv1r_cache_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ntext \\<open>Invariance proof\\<close>\n\nlemma PO_m1_inv1r_cache_init [iff]:\n  \"init m1 \\<subseteq> m1_inv1r_cache\"\nby (auto simp add: m1_defs intro!: m1_inv1r_cacheI)\n\nlemma PO_m1_inv1r_cache_trans [iff]:\n  \"{m1_inv1r_cache} trans m1 {> m1_inv1r_cache}\"\napply (auto simp add: PO_hoare_defs m1_defs intro!: m1_inv1r_cacheI\n            dest: m1_inv1r_cacheD)\napply (auto dest: m1_inv1r_cacheD)\ndone\n\nlemma PO_m1_inv1r_cache [iff]: \"reach m1 \\<subseteq> m1_inv1r_cache\"\nby (rule inv_rule_basic) (auto del: subsetI)\n\n\n(******************************************************************************)\nsubsection \\<open>Refinement of \\<open>m1a\\<close>\\<close>\n(******************************************************************************)\n\nsubsubsection \\<open>Simulation relation\\<close>\n(******************************************************************************)\n\ntext \\<open>The abstraction removes all but the first freshness\nidentifiers (corresponding to \\<open>Kab\\<close> and \\<open>Ts\\<close>) from the \ninitiator and responder frames and leaves the server's freshness ids untouched.\n\\<close>\n\noverloading is_len' \\<equiv> \"is_len\" rs_len' \\<equiv> \"rs_len\" begin\ndefinition is_len_def [simp]: \"is_len' \\<equiv> 1::nat\"\ndefinition rs_len_def [simp]: \"rs_len' \\<equiv> 1::nat\"\nend\n\nfun \n  rm1a1 :: \"role_t \\<Rightarrow> atom list \\<Rightarrow> atom list\"\nwhere\n  \"rm1a1 Init = take (Suc is_len)\"       \\<comment> \\<open>take \\<open>Kab\\<close>, \\<open>Ts\\<close>; drop \\<open>Ta\\<close>\\<close>\n| \"rm1a1 Resp = take (Suc rs_len)\"       \\<comment> \\<open>take \\<open>Kab\\<close>, \\<open>Ts\\<close>; drop \\<open>Ta\\<close>\\<close>\n| \"rm1a1 Serv = id\"                      \\<comment> \\<open>take \\<open>Na\\<close>, \\<open>Ts\\<close>\\<close>\n\nabbreviation \n  runs1a1 :: \"runs_t \\<Rightarrow> runs_t\" where\n  \"runs1a1 \\<equiv> map_runs rm1a1\" \n\nlemma knC_runs1a1 [simp]:\n  \"knC (runs1a1 runz) = knC runz\"\napply (auto simp add: map_runs_def elim!: knC.cases)\napply (rename_tac b, case_tac b, auto)\napply (rename_tac b, case_tac b, auto)\napply (rule knC_init, auto simp add: map_runs_def)\napply (rule knC_resp, auto simp add: map_runs_def)\napply (rule_tac knC_serv, auto simp add: map_runs_def)\ndone\n\ntext \\<open>med1a1: The mediator function maps a concrete observation (i.e., run) \nto an abstract one.\\<close>\n\ntext \\<open>R1a1: The simulation relation is defined in terms of the mediator\nfunction.\\<close>\n\ndefinition\n  med1a1 :: \"m1_obs \\<Rightarrow> m1a_obs\" where\n  \"med1a1 s \\<equiv> \\<lparr> runs = runs1a1 (runs s), m1x_state.leak = Domain (leak s) \\<rparr>\"\n   \ndefinition\n  R1a1 :: \"(m1a_state \\<times> m1_state) set\" where\n  \"R1a1 \\<equiv> {(s, t). s = med1a1 t}\"\n\nlemmas R1a1_defs = R1a1_def med1a1_def \n\n\nsubsubsection \\<open>Refinement proof\\<close>\n(******************************************************************************)\n\nlemma PO_m1_step1_refines_m1a_step1:\n  \"{R1a1} \n     (m1a_step1 Ra A B Na), (m1_step1 Ra A B Na) \n   {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs)\n\nlemma PO_m1_step2_refines_m1a_step2:\n  \"{R1a1} \n     (m1a_step2 Rb A B), (m1_step2 Rb A B) \n   {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs)\n\nlemma PO_m1_step3_refines_m1a_step3:\n  \"{R1a1} \n     (m1a_step3 Rs A B Kab Na [aNum Ts]), (m1_step3 Rs A B Kab Na Ts)\n   {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs)\n\nlemma PO_m1_step4_refines_m1a_step4:\n  \"{R1a1} \n     (m1a_step4 Ra A B Na Kab [aNum Ts]), (m1_step4 Ra A B Na Kab Ts Ta) \n   {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs map_runs_def)\n\nlemma PO_m1_step5_refines_m1a_step5:\n  \"{R1a1} \n     (m1a_step5 Rb A B Kab [aNum Ts]), (m1_step5 Rb A B Kab Ts Ta) \n   {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs map_runs_def)\n\nlemma PO_m1_step6_refines_m1a_skip:\n  \"{R1a1} \n     Id, (m1_step6 Ra A B Na Kab Ts Ta)\n   {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs map_runs_def)\n\n\n\nlemma PO_m1_tick_refines_m1a_skip:\n  \"{R1a1} \n     Id, (m1_tick T) \n   {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs map_runs_def)\n\nlemma PO_m1_purge_refines_m1a_skip:\n  \"{R1a1} \n     Id, (m1_purge A) \n   {> R1a1}\"\nby (auto simp add: PO_rhoare_defs R1a1_defs m1_defs map_runs_def)\n\ntext \\<open>All together now...\\<close>\n\nlemmas PO_m1_trans_refines_m1a_trans = \n  PO_m1_step1_refines_m1a_step1 PO_m1_step2_refines_m1a_step2\n  PO_m1_step3_refines_m1a_step3 PO_m1_step4_refines_m1a_step4\n  PO_m1_step5_refines_m1a_step5 PO_m1_step6_refines_m1a_skip \n  PO_m1_leak_refines_m1a_leak PO_m1_tick_refines_m1a_skip \n  PO_m1_purge_refines_m1a_skip\n\nlemma PO_m1_refines_init_m1a [iff]:\n  \"init m1 \\<subseteq>  R1a1``(init m1a)\"\nby (auto simp add: R1a1_defs m1_defs intro!: s0g_secrecyI)\n\nlemma PO_m1_refines_trans_m1a [iff]:\n  \"{R1a1} \n     (trans m1a), (trans m1) \n   {> R1a1}\"\napply (auto simp add: m1_def m1_trans_def m1a_def m1a_trans_def\n         intro!: PO_m1_trans_refines_m1a_trans)\napply (force intro!: PO_m1_trans_refines_m1a_trans)+\ndone\n\ntext \\<open>Observation consistency.\\<close>\n\nlemma obs_consistent_med1a1 [iff]: \n  \"obs_consistent R1a1 med1a1 m1a m1\"\nby (auto simp add: obs_consistent_def R1a1_def m1a_def m1_def)\n\n\ntext \\<open>Refinement result.\\<close>\n\nlemma PO_m1_refines_m1a [iff]: \n  \"refines R1a1 med1a1 m1a m1\"\nby (rule Refinement_basic) (auto del: subsetI)\n\nlemma  m1_implements_m1a [iff]: \"implements med1a1 m1a m1\"\nby (rule refinement_soundness) (fast)\n\n\nsubsubsection \\<open>inv (inherited): Secrecy\\<close>\n(*invh*************************************************************************)\n\ntext \\<open>Secrecy, as external and internal invariant\\<close>\n\ndefinition \n  m1_secrecy :: \"'x m1_pred\" where\n  \"m1_secrecy \\<equiv> {s. knC (runs s) \\<subseteq> azC (runs s) \\<union> Domain (leak s) \\<times> UNIV}\"\n\nlemmas m1_secrecyI = m1_secrecy_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_secrecyE [elim] = m1_secrecy_def [THEN setc_def_to_elim, rule_format]\n\nlemma PO_m1_obs_secrecy [iff]: \"oreach m1 \\<subseteq> m1_secrecy\"\napply (rule_tac Q=m1x_secrecy in external_invariant_translation)\napply (auto del: subsetI)\napply (fastforce simp add: med1a1_def intro!: m1_secrecyI)\ndone\n\nlemma PO_m1_secrecy [iff]: \"reach m1 \\<subseteq> m1_secrecy\"\nby (rule external_to_internal_invariant) (auto del: subsetI)\n\n\nsubsubsection \\<open>inv (inherited): Responder auth server.\\<close>\n(*invh*************************************************************************)\n\ndefinition \n  m1_inv2r_serv :: \"'x m1r_pred\"\nwhere\n  \"m1_inv2r_serv \\<equiv> {s. \\<forall>A B Rb Kab Ts nlb.\n     B \\<notin> bad \\<longrightarrow> \n     runs s Rb = Some (Resp, [A, B], aKey Kab # aNum Ts # nlb) \\<longrightarrow>\n       (\\<exists>Rs Na. Kab = sesK (Rs$sk) \\<and> \n          runs s Rs = Some (Serv, [A, B], [aNon Na, aNum Ts]))\n  }\"\n\nlemmas m1_inv2r_servI = m1_inv2r_serv_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv2r_servE [elim] = m1_inv2r_serv_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv2r_servD = m1_inv2r_serv_def [THEN setc_def_to_dest, rule_format, rotated -1]\n\n\ntext \\<open>Proof of invariance.\\<close>\n\nlemma PO_m1_inv2r_serv [iff]: \"reach m1 \\<subseteq> m1_inv2r_serv\"\napply (rule_tac Sa=m1a and Pa=m1a_inv2r_serv \n       and Qa=m1a_inv2r_serv and Q=m1_inv2r_serv \n       in internal_invariant_translation)\napply (auto del: subsetI)\n\\<comment> \\<open>1 subgoal\\<close>\napply (auto simp add: vimage_def intro!: m1_inv2r_servI)\napply (simp add: m1a_inv2r_serv_def med1a1_def)\napply (rename_tac x A B Rb Kab Ts nlb)\napply (drule_tac x=A in spec)\napply (drule_tac x=B in spec, clarsimp)\napply (drule_tac x=Rb in spec)\napply (drule_tac x=Kab in spec)\napply (drule_tac x=\"[aNum Ts]\" in spec)\napply (auto simp add: map_runs_def) \ndone\n\n\nsubsubsection \\<open>inv (inherited): Initiator auth server.\\<close>\n(*invh*************************************************************************)\n\ntext \\<open>Simplified version of invariant \\<open>m1a_inv2i_serv\\<close>.\\<close>\n\ndefinition \n  m1_inv2i_serv :: \"'x m1r_pred\"\nwhere\n  \"m1_inv2i_serv \\<equiv> {s. \\<forall>A B Ra Kab Ts nla.\n     A \\<notin> bad \\<longrightarrow> \n     runs s Ra = Some (Init, [A, B], aKey Kab # aNum Ts # nla) \\<longrightarrow>\n       (\\<exists>Rs. Kab = sesK (Rs$sk) \\<and>\n         runs s Rs = Some (Serv, [A, B],  [aNon (Ra$na), aNum Ts]))\n  }\"\n\nlemmas m1_inv2i_servI = m1_inv2i_serv_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv2i_servE [elim] = m1_inv2i_serv_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv2i_servD = m1_inv2i_serv_def [THEN setc_def_to_dest, rule_format, rotated -1]\n\n\ntext \\<open>Proof of invariance.\\<close>\n\nlemma PO_m1_inv2i_serv [iff]: \"reach m1 \\<subseteq> m1_inv2i_serv\"\napply (rule_tac Pa=m1a_inv2i_serv and Qa=m1a_inv2i_serv and Q=m1_inv2i_serv\n       in internal_invariant_translation)\napply (auto del: subsetI)\n\\<comment> \\<open>1 subgoal\\<close>\napply (auto simp add: m1a_inv2i_serv_def med1a1_def vimage_def intro!: m1_inv2i_servI)\napply (rename_tac x A B Ra Kab Ts nla)\napply (drule_tac x=A in spec, clarsimp)\napply (drule_tac x=B in spec) \napply (drule_tac x=Ra in spec) \napply (drule_tac x=Kab in spec) \napply (drule_tac x=\"[aNum Ts]\" in spec)\napply (auto simp add: map_runs_def)\ndone\n\ndeclare PO_m1_inv2i_serv [THEN subsetD, intro]\n\n\nsubsubsection \\<open>inv (inherited): Initiator key freshness\\<close>\n(*invh*************************************************************************)\n\ndefinition \n  m1_inv1_ifresh :: \"'x m1_pred\"\nwhere\n  \"m1_inv1_ifresh \\<equiv> {s. \\<forall>A A' B B' Ra Ra' Kab nl nl'.\n     runs s Ra  = Some (Init, [A,  B],  aKey Kab # nl) \\<longrightarrow>\n     runs s Ra' = Some (Init, [A', B'], aKey Kab # nl') \\<longrightarrow>\n     A \\<notin> bad \\<longrightarrow> B \\<notin> bad \\<longrightarrow> Kab \\<notin> Domain (leak s) \\<longrightarrow>\n       Ra = Ra'\n  }\"\n\nlemmas m1_inv1_ifreshI = m1_inv1_ifresh_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv1_ifreshE [elim] = m1_inv1_ifresh_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv1_ifreshD = m1_inv1_ifresh_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\nlemma PO_m1_ifresh [iff]: \"reach m1 \\<subseteq> m1_inv1_ifresh\"\napply (rule_tac Pa=m1a_inv1_ifresh and Qa=m1a_inv1_ifresh and Q=m1_inv1_ifresh\n       in internal_invariant_translation)\napply (auto del: subsetI)\napply (auto simp add: med1a1_def map_runs_def vimage_def m1_inv1_ifresh_def)\ndone\n\n\n(******************************************************************************)\nsubsection \\<open>Refinement of \\<open>a0i\\<close> for responder/initiator\\<close>\n(******************************************************************************)\n\ntext \\<open>The responder injectively agrees with the initiator on @{term \"Kab\"},\n@{term \"Ts\"}, and @{term \"Ta\"}.\\<close>\n\n\nsubsubsection \\<open>Simulation relation\\<close>\n(******************************************************************************)\n\ntext \\<open>We define two auxiliary functions to reconstruct the signals of the\ninitial model from completed initiator and responder runs.\\<close>\n\ntype_synonym\n  risig = \"key \\<times> time \\<times> time\"\n\nabbreviation\n  ri_running :: \"[runs_t, agent, agent, key, time, time] \\<Rightarrow> rid_t set\" \nwhere\n  \"ri_running runz A B Kab Ts Ta \\<equiv> {Ra. \\<exists>nl. \n     runz Ra = Some (Init, [A, B], aKey Kab # aNum Ts # aNum Ta # nl)\n  }\"\n\nabbreviation\n  ri_commit :: \"[runs_t, agent, agent, key, time, time] \\<Rightarrow> rid_t set\" \nwhere\n  \"ri_commit runz A B Kab Ts Ta \\<equiv> {Rb. \\<exists>nl. \n     runz Rb = Some (Resp, [A, B], aKey Kab # aNum Ts # aNum Ta # nl)\n  }\"\n\nfun\n  ri_runs2sigs :: \"runs_t \\<Rightarrow> risig signal \\<Rightarrow> nat\"\nwhere\n  \"ri_runs2sigs runz (Running [B, A] (Kab, Ts, Ta)) = \n     card (ri_running runz A B Kab Ts Ta)\"\n\n| \"ri_runs2sigs runz (Commit [B, A] (Kab, Ts, Ta)) = \n     card (ri_commit runz A B Kab Ts Ta)\"\n\n| \"ri_runs2sigs runz _ = 0\"\n\n\ntext \\<open>Simulation relation and mediator function. We map completed initiator \nand responder runs to commit and running signals, respectively.\\<close>\n\ndefinition \n  med_a0iim1_ri :: \"m1_obs \\<Rightarrow> risig a0i_obs\" where\n  \"med_a0iim1_ri o1 \\<equiv> \\<lparr> signals = ri_runs2sigs (runs o1), corrupted = {} \\<rparr>\"\n\ndefinition\n  R_a0iim1_ri :: \"(risig a0i_state \\<times> m1_state) set\" where\n  \"R_a0iim1_ri \\<equiv> {(s, t). signals s = ri_runs2sigs (runs t) \\<and> corrupted s = {} }\"\n\nlemmas R_a0iim1_ri_defs = R_a0iim1_ri_def med_a0iim1_ri_def \n\n\nsubsubsection \\<open>Lemmas about the auxiliary functions\\<close>\n(******************************************************************************)\n\ntext \\<open>Other lemmas\\<close>\n\nlemma ri_runs2sigs_empty [simp]: \n  \"runz = Map.empty \\<Longrightarrow> ri_runs2sigs runz = (\\<lambda>s. 0)\"\nby (rule ext, erule rev_mp) \n   (rule ri_runs2sigs.induct, auto) \n\nlemma finite_ri_running [simp, intro]:\n  \"finite (dom runz) \\<Longrightarrow> finite (ri_running runz A B Kab Ts Ta)\"\nby (auto intro: finite_subset dest: dom_lemmas)\n\nlemma finite_ri_commit [simp, intro]:\n  \"finite (dom runz) \\<Longrightarrow> finite (ri_commit runz A B Kab Ts Ta)\"\nby (auto intro: finite_subset dest: dom_lemmas)\n\n\ntext \\<open>Update lemmas\\<close>\n\nlemma ri_runs2sigs_upd_init_none [simp]:\n  \"\\<lbrakk> Na \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> ri_runs2sigs (runz(Na \\<mapsto> (Init, [A, B], []))) = ri_runs2sigs runz\"\nby (rule ext, erule rev_mp, rule ri_runs2sigs.induct) \n   (auto dest: dom_lemmas)\n\nlemma ri_runs2sigs_upd_resp_none [simp]:\n  \"\\<lbrakk> Rb \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> ri_runs2sigs (runz(Rb \\<mapsto> (Resp, [A, B], []))) = ri_runs2sigs runz\"\nby (rule ext, erule rev_mp, rule ri_runs2sigs.induct)\n   (auto dest: dom_lemmas)\n\nlemma ri_runs2sigs_upd_serv [simp]:\n  \"\\<lbrakk> Rs \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> ri_runs2sigs (runz(Rs \\<mapsto> (Serv, [A, B], [aNon Na, aNum Ts]))) \n      = ri_runs2sigs runz\"\nby (rule ext, erule rev_mp, rule ri_runs2sigs.induct)\n   (auto dest: dom_lemmas)\n\nlemma ri_runs2sigs_upd_init_some [simp]:\n  \"\\<lbrakk> runz Ra = Some (Init, [A, B], []); finite (dom runz) \\<rbrakk>\n  \\<Longrightarrow> ri_runs2sigs (runz(Ra \\<mapsto> (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta]))) =\n     (ri_runs2sigs runz)(\n       Running [B, A] (Kab, Ts, Ta) := \n         Suc (card (ri_running runz A B Kab Ts Ta)))\"\napply (rule ext, (erule rev_mp)+)\napply (rule ri_runs2sigs.induct, auto) \n\\<comment> \\<open>1 subgoal\\<close>\napply (rename_tac runz)\napply (rule_tac s=\"card (insert Ra (ri_running runz A B Kab Ts Ta))\"\n       in trans, fast, auto)\ndone\n\nlemma ri_runs2sigs_upd_resp_some [simp]:\n  \"\\<lbrakk> runz Rb = Some (Resp, [A, B], []); finite (dom runz) \\<rbrakk>\n  \\<Longrightarrow> ri_runs2sigs (runz(Rb \\<mapsto> (Resp, [A, B], [aKey Kab, aNum Ts, aNum Ta]))) =\n     (ri_runs2sigs runz)(\n        Commit [B, A] (Kab, Ts, Ta) := \n          Suc (card (ri_commit runz A B Kab Ts Ta)))\"\napply (rule ext, (erule rev_mp)+)\napply (rule ri_runs2sigs.induct, auto)\n\\<comment> \\<open>1 subgoal\\<close>\napply (rename_tac runz)\napply (rule_tac s=\"card (insert Rb (ri_commit runz A B Kab Ts Ta))\"\n       in trans, fast, auto)\ndone\n\nlemma ri_runs2sigs_upd_init_some2 [simp]:\n  \"\\<lbrakk> runz Ra = Some (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta]) \\<rbrakk>\n  \\<Longrightarrow> ri_runs2sigs (runz(Ra \\<mapsto> (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta, END]))) =\n     ri_runs2sigs runz\"\nby (rule ext, erule rev_mp, rule ri_runs2sigs.induct)\n   (auto dest: dom_lemmas)\n\n\nsubsubsection \\<open>Refinement proof\\<close>\n(******************************************************************************)\n\nlemma PO_m1_step1_refines_a0_ri_skip:\n  \"{R_a0iim1_ri} \n     Id, (m1_step1 Ra A B Na) \n   {> R_a0iim1_ri}\"\nby (auto simp add: PO_rhoare_defs R_a0iim1_ri_defs m1_defs)\n\nlemma PO_m1_step2_refines_a0_ri_skip:\n  \"{R_a0iim1_ri} \n     Id, (m1_step2 Rb A B) \n   {> R_a0iim1_ri}\"\nby (auto simp add: PO_rhoare_defs R_a0iim1_ri_defs m1_defs)\n\nlemma PO_m1_step3_refines_a0_ri_skip:\n  \"{R_a0iim1_ri} \n     Id, (m1_step3 Rs A B Kab Na Ts) \n   {> R_a0iim1_ri}\"\nby (auto simp add: PO_rhoare_defs R_a0iim1_ri_defs m1_defs)\n\nlemma PO_m1_step4_refines_a0_ri_running:\n  \"{R_a0iim1_ri \\<inter> UNIV \\<times> m1_inv0_fin} \n     (a0i_running [B, A] (Kab, Ts, Ta)), (m1_step4 Ra A B Na Kab Ts Ta) \n   {> R_a0iim1_ri}\"\nby (auto simp add: PO_rhoare_defs R_a0iim1_ri_defs a0i_defs m1_defs)\n\n\n\nlemma PO_m1_step6_refines_a0_ri_skip:\n  \"{R_a0iim1_ri} \n     Id, (m1_step6 Ra A B Na Kab Ts Ta) \n   {> R_a0iim1_ri}\"\nby (auto simp add: PO_rhoare_defs R_a0iim1_ri_defs m1_defs)\n\nlemma PO_m1_leak_refines_a0_ri_skip:\n  \"{R_a0iim1_ri} \n     Id, (m1_leak Rs A B Na Ts) \n   {> R_a0iim1_ri}\"\nby (auto simp add: PO_rhoare_defs R_a0iim1_ri_defs a0i_defs m1_defs)\n\nlemma PO_m1_tick_refines_a0_ri_skip:\n  \"{R_a0iim1_ri}\n     Id, (m1_tick T)\n   {> R_a0iim1_ri}\"\nby (auto simp add: PO_rhoare_defs R_a0iim1_ri_defs m1_defs)\n\nlemma PO_m1_purge_refines_a0_ri_skip:\n  \"{R_a0iim1_ri}\n     Id, (m1_purge A)\n   {> R_a0iim1_ri}\"\nby (auto simp add: PO_rhoare_defs R_a0iim1_ri_defs m1_defs)\n\ntext \\<open>All together now...\\<close>\n\nlemmas PO_m1_trans_refines_a0_ri_trans = \n  PO_m1_step1_refines_a0_ri_skip  PO_m1_step2_refines_a0_ri_skip\n  PO_m1_step3_refines_a0_ri_skip  PO_m1_step4_refines_a0_ri_running\n  PO_m1_step5_refines_a0_ri_commit PO_m1_step6_refines_a0_ri_skip \n  PO_m1_leak_refines_a0_ri_skip PO_m1_tick_refines_a0_ri_skip \n  PO_m1_purge_refines_a0_ri_skip\n\nlemma PO_m1_refines_init_a0_ri [iff]:\n  \"init m1 \\<subseteq>  R_a0iim1_ri``(init a0i)\"\nby (auto simp add: R_a0iim1_ri_defs a0i_defs m1_defs\n         intro!: exI [where x=\"\\<lparr>signals = \\<lambda>s. 0, corrupted = {} \\<rparr>\"])\n\nlemma PO_m1_refines_trans_a0_ri [iff]:\n  \"{R_a0iim1_ri \\<inter> a0i_inv1_iagree \\<times> (m1_inv1r_cache \\<inter> m1_inv0_fin)} \n     (trans a0i), (trans m1) \n   {> R_a0iim1_ri}\"\nby (force simp add: m1_def m1_trans_def a0i_def a0i_trans_def\n          intro!: PO_m1_trans_refines_a0_ri_trans)\n\n\nlemma obs_consistent_med_a0iim1_ri [iff]: \n  \"obs_consistent \n     (R_a0iim1_ri \\<inter> a0i_inv1_iagree \\<times> (m1_inv1r_cache \\<inter> m1_inv0_fin))\n     med_a0iim1_ri a0i m1\"\nby (auto simp add: obs_consistent_def R_a0iim1_ri_def med_a0iim1_ri_def \n                   a0i_def m1_def)\n\n\ntext \\<open>Refinement result.\\<close>\n\nlemma PO_m1_refines_a0ii_ri [iff]: \n  \"refines \n     (R_a0iim1_ri \\<inter> a0i_inv1_iagree \\<times> (m1_inv1r_cache \\<inter> m1_inv0_fin))\n     med_a0iim1_ri a0i m1\"\nby (rule Refinement_using_invariants) (auto)\n\nlemma  m1_implements_a0ii_ri: \"implements med_a0iim1_ri a0i m1\"\nby (rule refinement_soundness) (fast)\n\n\nsubsubsection \\<open>inv3 (inherited): Responder and initiator\\<close>\n(*invh*************************************************************************)\n\ntext \\<open>This is a translation of the agreement property to Level 1. It\nfollows from the refinement and is needed to prove inv4 below.\\<close>\n\ndefinition \n  m1_inv3r_init :: \"'x m1_pred\"\nwhere\n  \"m1_inv3r_init \\<equiv> {s. \\<forall>A B Rb Kab Ts Ta nlb.\n     B \\<notin> bad \\<longrightarrow> A \\<notin> bad \\<longrightarrow> Kab \\<notin> Domain (leak s) \\<longrightarrow>\n     runs s Rb = Some (Resp, [A, B], aKey Kab # aNum Ts # aNum Ta # nlb) \\<longrightarrow>\n       (\\<exists>Ra nla. \n        runs s Ra = Some (Init, [A, B], aKey Kab # aNum Ts # aNum Ta # nla))\n  }\"\n\nlemmas m1_inv3r_initI = m1_inv3r_init_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv3r_initE [elim] = m1_inv3r_init_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv3r_initD = m1_inv3r_init_def [THEN setc_def_to_dest, rule_format, rotated -1]\n\n\ntext \\<open>Invariance proof.\\<close>\n\nlemma PO_m1_inv3r_init [iff]: \"reach m1 \\<subseteq> m1_inv3r_init\"\napply (rule INV_from_Refinement_basic [OF PO_m1_refines_a0ii_ri])\napply (auto simp add: R_a0iim1_ri_def a0i_inv1_iagree_def\n            intro!:  m1_inv3r_initI)\n\\<comment> \\<open>1 subgoal\\<close>\napply (rename_tac s A B Rb Kab Ts Ta nlb a)\napply (drule_tac x=\"[B, A]\" in spec, clarsimp)\napply (drule_tac x=\"Kab\" in spec)\napply (drule_tac x=\"Ts\" in spec)\napply (drule_tac x=\"Ta\" in spec)\napply (subgoal_tac \"card (ri_commit (runs s) A B Kab Ts Ta) > 0\", auto) \ndone\n\n\nsubsubsection \\<open>inv4: Key freshness for responder\\<close>\n(*inv*************************************************************************)\n\ndefinition \n  m1_inv4_rfresh :: \"'x m1_pred\"\nwhere\n  \"m1_inv4_rfresh \\<equiv> {s. \\<forall>Rb1 Rb2 A1 A2 B1 B2 Kab Ts1 Ts2 Ta1 Ta2.\n     runs s Rb1 = Some (Resp, [A1, B1], [aKey Kab, aNum Ts1, aNum Ta1]) \\<longrightarrow> \n     runs s Rb2 = Some (Resp, [A2, B2], [aKey Kab, aNum Ts2, aNum Ta2]) \\<longrightarrow> \n     B1 \\<notin> bad \\<longrightarrow> A1 \\<notin> bad \\<longrightarrow> Kab \\<notin> Domain (leak s) \\<longrightarrow>\n       Rb1 = Rb2\n  }\"\n\nlemmas m1_inv4_rfreshI = m1_inv4_rfresh_def [THEN setc_def_to_intro, rule_format]\nlemmas m1_inv4_rfreshE [elim] = m1_inv4_rfresh_def [THEN setc_def_to_elim, rule_format]\nlemmas m1_inv4_rfreshD = m1_inv4_rfresh_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\ntext \\<open>Proof of key freshness for responder. All cases except step5 are straightforward.\\<close>\n\nlemma PO_m1_inv4_rfresh_step5:\n  \"{m1_inv4_rfresh \\<inter> m1_inv3r_init \\<inter> m1_inv2r_serv \\<inter> m1_inv1r_cache \\<inter>\n    m1_secrecy \\<inter> m1_inv1_ifresh} \n     (m1_step5 Rb A B Kab Ts Ta)\n   {> m1_inv4_rfresh}\"\napply (auto simp add: PO_hoare_defs m1_defs intro!: m1_inv4_rfreshI)\napply (auto dest: m1_inv4_rfreshD)\napply (auto dest: m1_inv2r_servD) \n\n\\<comment> \\<open>5 subgoals\\<close>\n  apply (drule m1_inv2r_servD, auto) \n  apply (elim azC.cases, auto)\n\n  apply (drule m1_inv2r_servD, auto)\n  apply (elim azC.cases, auto)\n\n  apply (drule m1_inv2r_servD, auto)\n  apply (elim azC.cases, auto)\n\n  apply (rename_tac Rb2 A2 B2 Ts2 Ta2 s Rs Na Ra nl)\n  apply (case_tac \"B2 \\<in> bad\")\n    apply (thin_tac \"(sesK (Rs$sk), B) \\<in> azC (runs s)\")\n    apply (subgoal_tac \"(sesK (Rs$sk), B2) \\<in> azC (runs s)\")\n    apply (erule azC.cases, auto)\n    apply (erule m1_secrecyE, auto) \n\n    apply (case_tac \"A2 \\<in> bad\", auto dest: m1_inv2r_servD)\n    apply (frule m1_inv3r_initD, auto)\n    apply (rename_tac Raa nla, subgoal_tac \"Raa = Ra\", auto)    \\<comment> \\<open>uses cache invariant\\<close>\n\n  apply (frule m1_inv3r_initD, auto)\n  apply (rename_tac Raa nla, subgoal_tac \"Raa = Ra\", auto)      \\<comment> \\<open>uses cache invariant\\<close>\ndone\n\nlemmas PO_m1_inv4_rfresh_step5_lemmas = \n  PO_m1_inv4_rfresh_step5\n\nlemma PO_m1_inv4_rfresh_init [iff]:\n  \"init m1 \\<subseteq> m1_inv4_rfresh\"\nby (auto simp add: m1_defs intro!: m1_inv4_rfreshI)\n\nlemma PO_m1_inv4_rfresh_trans [iff]:\n  \"{m1_inv4_rfresh \\<inter> m1_inv3r_init \\<inter> m1_inv2r_serv \\<inter> m1_inv1r_cache \\<inter>\n    m1_secrecy \\<inter> m1_inv1_ifresh} \n      trans m1 \n   {> m1_inv4_rfresh}\"\nby (auto simp add: m1_def m1_trans_def intro!: PO_m1_inv4_rfresh_step5_lemmas)\n   (auto simp add: PO_hoare_defs m1_defs intro!: m1_inv4_rfreshI dest: m1_inv4_rfreshD)\n\n\nlemma PO_m1_inv4_rfresh [iff]: \"reach m1 \\<subseteq> m1_inv4_rfresh\"\napply (rule_tac \n         J=\"m1_inv3r_init \\<inter> m1_inv2r_serv \\<inter> m1_inv1r_cache \\<inter> m1_secrecy \\<inter> m1_inv1_ifresh\" \n       in inv_rule_incr) \napply (auto simp add: Int_assoc del: subsetI)\ndone\n\nlemma PO_m1_obs_inv4_rfresh [iff]: \"oreach m1 \\<subseteq> m1_inv4_rfresh\"\nby (rule external_from_internal_invariant)\n   (auto del: subsetI)\n\n\n(******************************************************************************)\nsubsection \\<open>Refinement of \\<open>a0i\\<close> for initiator/responder\\<close>\n(******************************************************************************)\n\ntext \\<open>The initiator injectively agrees with the responder on \\<open>Kab\\<close>,\n\\<open>Ts\\<close>, and \\<open>Ta\\<close>.\\<close>\n\n\nsubsubsection \\<open>Simulation relation\\<close>\n(******************************************************************************)\n\ntext \\<open>We define two auxiliary functions to reconstruct the signals of the\ninitial model from completed initiator and responder runs.\\<close>\n\ntype_synonym\n  irsig = \"key \\<times> time \\<times> time\"\n\nabbreviation\n  ir_running :: \"[runs_t, agent, agent, key, time, time] \\<Rightarrow> rid_t set\" \nwhere\n  \"ir_running runz A B Kab Ts Ta \\<equiv> {Rb. \\<exists>nl. \n     runz Rb = Some (Resp, [A, B], aKey Kab # aNum Ts # aNum Ta # nl)\n  }\"\n\nabbreviation\n  ir_commit :: \"[runs_t, agent, agent, key, time, time] \\<Rightarrow> rid_t set\" \nwhere\n  \"ir_commit runz A B Kab Ts Ta \\<equiv> {Ra. \\<exists>nl. \n     runz Ra = Some (Init, [A, B], aKey Kab # aNum Ts # aNum Ta # END # nl)\n  }\"\n\nfun\n  ir_runs2sigs :: \"runs_t \\<Rightarrow> risig signal \\<Rightarrow> nat\"\nwhere\n \"ir_runs2sigs runz (Running [A, B] (Kab, Ts, Ta)) = \n     card (ir_running runz A B Kab Ts Ta)\"\n\n| \"ir_runs2sigs runz (Commit [A, B] (Kab, Ts, Ta)) = \n     card (ir_commit runz A B Kab Ts Ta)\"\n\n| \"ir_runs2sigs runz _ = 0\"\n\n\ntext \\<open>Simulation relation and mediator function. We map completed initiator \nand responder runs to commit and running signals, respectively.\\<close>\n\ndefinition \n  med_a0iim1_ir :: \"m1_obs \\<Rightarrow> irsig a0i_obs\" where\n  \"med_a0iim1_ir o1 \\<equiv> \\<lparr> signals = ir_runs2sigs (runs o1), corrupted = {} \\<rparr>\"\n\ndefinition\n  R_a0iim1_ir :: \"(irsig a0i_state \\<times> m1_state) set\" where\n  \"R_a0iim1_ir \\<equiv> {(s, t). signals s = ir_runs2sigs (runs t) \\<and> corrupted s = {} }\"\n\nlemmas R_a0iim1_ir_defs = R_a0iim1_ir_def med_a0iim1_ir_def\n\n\nsubsubsection \\<open>Lemmas about the auxiliary functions\\<close>\n(******************************************************************************)\n\nlemma ir_runs2sigs_empty [simp]: \n  \"runz = Map.empty \\<Longrightarrow> ir_runs2sigs runz = (\\<lambda>s. 0)\"\nby (rule ext, erule rev_mp) \n   (rule ir_runs2sigs.induct, auto)\n\n(* already proven higher up:\nlemma ir_running_finite [simp, intro]:\n  \"finite (dom runz) \\<Longrightarrow> finite (ir_running runz A B Kab Ts Ta)\"\nby (auto intro: finite_subset dest: dom_lemmas) \n*)\n\nlemma ir_commit_finite [simp, intro]:\n  \"finite (dom runz) \\<Longrightarrow> finite (ir_commit runz A B Kab Ts Ta)\"\nby (auto intro: finite_subset dest: dom_lemmas)\n\n\ntext \\<open>Update lemmas\\<close>\n\nlemma ir_runs2sigs_upd_init_none [simp]:\n  \"\\<lbrakk> Ra \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> ir_runs2sigs (runz(Ra \\<mapsto> (Init, [A, B], []))) = ir_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n   (rule ir_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma ir_runs2sigs_upd_resp_none [simp]:\n  \"\\<lbrakk> Rb \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> ir_runs2sigs (runz(Rb \\<mapsto> (Resp, [A, B], []))) = ir_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n   (rule ir_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma ir_runs2sigs_upd_serv [simp]:\n  \"\\<lbrakk> Rs \\<notin> dom (runs y) \\<rbrakk>\n  \\<Longrightarrow> ir_runs2sigs (runs y(Rs \\<mapsto> (Serv, [A, B], [aNon Na, aNum Ts]))) \n      = ir_runs2sigs (runs y)\"\nby (rule ext, erule rev_mp) \n   (rule ir_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma ir_runs2sigs_upd_init_some [simp]:\n  \"\\<lbrakk> runz Ra = Some (Init, [A, B], []) \\<rbrakk>\n  \\<Longrightarrow> ir_runs2sigs (runz(Ra \\<mapsto> (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta]))) =\n     ir_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n   (rule ir_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma ir_runs2sigs_upd_resp_some_raw:\n  assumes\n    \"runz Rb = Some (Resp, [A, B], [])\" \n    \"finite (dom runz)\"\n  shows\n    \"ir_runs2sigs (runz(Rb \\<mapsto> (Resp, [A, B], [aKey Kab, aNum Ts, aNum Ta]))) s =\n     ((ir_runs2sigs runz)(\n       Running [A, B] (Kab, Ts, Ta) := \n         Suc (card (ir_running runz A B Kab Ts Ta)))) s\"\n  using assms\nproof (induct rule: ir_runs2sigs.induct) \n  case (1 runz A B Kab Ts Ta) note H = this\n    hence \"Rb \\<notin> ir_running runz A B Kab Ts Ta\" by auto\n    moreover\n    with H have\n      \"card (insert Rb (ir_running runz A B Kab Ts Ta)) \n       = Suc (card (ir_running runz A B Kab Ts Ta))\" by auto\n  ultimately show ?case by (auto elim: subst)\nqed (auto)\n\nlemma ir_runs2sigs_upd_resp_some [simp]:\n  \"\\<lbrakk> runz Rb = Some (Resp, [A, B], []); finite (dom runz) \\<rbrakk>\n  \\<Longrightarrow> ir_runs2sigs (runz(Rb \\<mapsto> (Resp, [A, B], [aKey Kab, aNum Ts, aNum Ta]))) =\n     (ir_runs2sigs runz)(\n       Running [A, B] (Kab, Ts, Ta) := \n         Suc (card (ir_running runz A B Kab Ts Ta)))\"\nby (intro ext ir_runs2sigs_upd_resp_some_raw)\n\nlemma ir_runs2sigs_upd_init_some2_raw:\n  assumes \n    \"runz Ra = Some (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta])\" \n    \"finite (dom runz)\" \n  shows\n    \"ir_runs2sigs (runz(Ra \\<mapsto> (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta, END]))) s =\n     ((ir_runs2sigs runz)(\n        Commit [A, B] (Kab, Ts, Ta) := \n          Suc (card (ir_commit runz A B Kab Ts Ta)))) s\"\n  using assms\nproof (induct runz s rule: ir_runs2sigs.induct)\n  case (2 runz A B Kab Ts Ta) note H = this \n    from H have \"Ra \\<notin> ir_commit runz A B Kab Ts Ta\" by auto\n    moreover\n    with H have \n      \"card (insert Ra (ir_commit runz A B Kab Ts Ta)) \n       = Suc (card (ir_commit runz A B Kab Ts Ta))\" \n    by (auto)\n    ultimately show ?case by (auto elim: subst)\nqed (auto)\n\nlemma ir_runs2sigs_upd_init_some2 [simp]:\n  \"\\<lbrakk> runz Na = Some (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta]); finite (dom runz) \\<rbrakk>\n  \\<Longrightarrow> ir_runs2sigs (runz(Na \\<mapsto> (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta, END]))) =\n     (ir_runs2sigs runz)(\n        Commit [A, B] (Kab, Ts, Ta) := \n          Suc (card (ir_commit runz A B Kab Ts Ta)))\"\nby (intro ir_runs2sigs_upd_init_some2_raw ext)\n\n\nsubsubsection \\<open>Refinement proof\\<close>\n(******************************************************************************)\n\nlemma PO_m1_step1_refines_ir_a0ii_skip:\n  \"{R_a0iim1_ir} \n     Id, (m1_step1 Ra A B Na) \n   {> R_a0iim1_ir}\"\nby (simp add: PO_rhoare_defs R_a0iim1_ir_defs m1_defs, safe, auto)\n\nlemma PO_m1_step2_refines_ir_a0ii_skip:\n  \"{R_a0iim1_ir} \n     Id, (m1_step2 Rb A B) \n   {> R_a0iim1_ir}\"\nby (simp add: PO_rhoare_defs R_a0iim1_ir_defs m1_defs, safe, auto)\n\nlemma PO_m1_step3_refines_ir_a0ii_skip:\n  \"{R_a0iim1_ir} \n     Id, (m1_step3 Rs A B Kab Na Ts) \n   {> R_a0iim1_ir}\"\nby (simp add: PO_rhoare_defs R_a0iim1_ir_defs a0i_defs m1_defs, safe, auto)\n\nlemma PO_m1_step4_refines_ir_a0ii_skip:\n  \"{R_a0iim1_ir} \n     Id, (m1_step4 Ra A B Na Kab Ts Ta) \n   {> R_a0iim1_ir}\"\nby (simp add: PO_rhoare_defs R_a0iim1_ir_defs m1_defs, safe, auto)\n\nlemma PO_m1_step5_refines_ir_a0ii_running:\n  \"{R_a0iim1_ir \\<inter> UNIV \\<times> m1_inv0_fin} \n     (a0i_running [A, B] (Kab, Ts, Ta)), (m1_step5 Rb A B Kab Ts Ta) \n   {> R_a0iim1_ir}\"\nby (simp add: PO_rhoare_defs R_a0iim1_ir_defs a0i_defs m1_defs, safe, auto)\n\nlemma PO_m1_step6_refines_ir_a0ii_commit:\n  \"{R_a0iim1_ir \\<inter> UNIV \\<times> m1_inv0_fin} \n     (a0n_commit [A, B] (Kab, Ts, Ta)), (m1_step6 Ra A B Na Kab Ts Ta) \n   {> R_a0iim1_ir}\"\nby (simp add: PO_rhoare_defs R_a0iim1_ir_defs a0n_defs m1_defs, safe, auto)\n\n\n\nlemma PO_m1_tick_refines_ir_a0ii_skip:\n  \"{R_a0iim1_ir}\n     Id, (m1_tick T)\n   {> R_a0iim1_ir}\"\nby (simp add: PO_rhoare_defs R_a0iim1_ir_defs m1_defs, safe, auto)\n\nlemma PO_m1_purge_refines_ir_a0ii_skip:\n  \"{R_a0iim1_ir}\n     Id, (m1_purge A)\n   {> R_a0iim1_ir}\"\nby (simp add: PO_rhoare_defs R_a0iim1_ir_defs m1_defs, safe, auto)\n\ntext \\<open>All together now...\\<close>\n\nlemmas PO_m1_trans_refines_ir_a0ii_trans = \n  PO_m1_step1_refines_ir_a0ii_skip  PO_m1_step2_refines_ir_a0ii_skip\n  PO_m1_step3_refines_ir_a0ii_skip  PO_m1_step4_refines_ir_a0ii_skip\n  PO_m1_step5_refines_ir_a0ii_running PO_m1_step6_refines_ir_a0ii_commit\n  PO_m1_leak_refines_ir_a0ii_skip PO_m1_tick_refines_ir_a0ii_skip \n  PO_m1_purge_refines_ir_a0ii_skip\n\nlemma PO_m1_refines_init_ir_a0ii [iff]:\n  \"init m1 \\<subseteq>  R_a0iim1_ir``(init a0n)\"\nby (auto simp add: R_a0iim1_ir_defs a0n_defs m1_defs\n         intro!: exI [where x=\"\\<lparr>signals = \\<lambda>s. 0, corrupted = {}\\<rparr>\"])\n\nlemma PO_m1_refines_trans_ir_a0ii [iff]:\n  \"{R_a0iim1_ir \\<inter> UNIV \\<times> m1_inv0_fin} \n     (trans a0n), (trans m1) \n   {> R_a0iim1_ir}\"\nby (auto simp add: m1_def m1_trans_def a0n_def a0n_trans_def\n         intro!: PO_m1_trans_refines_ir_a0ii_trans)\n\n\ntext \\<open>Observation consistency.\\<close>\n\nlemma obs_consistent_med_a0iim1_ir [iff]: \n  \"obs_consistent \n     (R_a0iim1_ir \\<inter> UNIV \\<times> m1_inv0_fin) \n     med_a0iim1_ir a0n m1\"\nby (auto simp add: obs_consistent_def R_a0iim1_ir_def med_a0iim1_ir_def \n                   a0n_def m1_def)\n\n\ntext \\<open>Refinement result.\\<close>\n\nlemma PO_m1_refines_a0ii_ir [iff]: \n  \"refines (R_a0iim1_ir \\<inter> UNIV \\<times> m1_inv0_fin) \n     med_a0iim1_ir a0n m1\"\nby (rule Refinement_using_invariants) (auto) \n\nlemma  m1_implements_a0ii_ir: \"implements med_a0iim1_ir a0n m1\"\nby (rule refinement_soundness) (fast)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m1_kerberos.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3222661238298851}}
{"text": "theory Approx_Beta\n  imports DBM_Zone_Semantics Regions_Beta Closure\nbegin\n\nchapter \\<open>Correctness of \\<open>\\<beta>\\<close>-approximation from \\<open>\\<alpha>\\<close>-regions\\<close>\n\ntext \\<open>Instantiating real\\<close>\n\ninstantiation real :: linordered_ab_monoid_add\nbegin\n\ndefinition\n  neutral_real: \"\\<one> = (0 :: real)\"\n\ninstance by standard (auto simp: neutral_real)\n\nend\n\ntext \\<open>Merging the locales for the two types of regions\\<close>\n\nlocale Regions =\n  fixes X and k :: \"'c \\<Rightarrow> nat\" and v :: \"'c \\<Rightarrow> nat\" and n :: nat and not_in_X\n  assumes finite: \"finite X\"\n  assumes clock_numbering: \"clock_numbering' v n\" \"\\<forall>k\\<le>n. k > 0 \\<longrightarrow> (\\<exists>c \\<in> X. v c = k)\"\n                           \"\\<forall> c \\<in> X. v c \\<le> n\"\n  assumes not_in_X: \"not_in_X \\<notin> X\"\n  assumes non_empty: \"X \\<noteq> {}\"\nbegin\n\ndefinition \\<R>_def:  \"\\<R> \\<equiv> {Regions.region X I r | I r. Regions.valid_region X k I r}\"\ndefinition \\<R>\\<^sub>\\<beta>_def: \"\\<R>\\<^sub>\\<beta> \\<equiv> {Regions_Beta.region X I J r | I J r. Regions_Beta.valid_region X k I J r}\"\ndefinition V_def:  \"V \\<equiv> {v . \\<forall> x \\<in> X. v x \\<ge> 0}\"\n\nsublocale alpha_interp: AlphaClosure X k \\<R> V by (unfold_locales) (auto simp: finite \\<R>_def V_def)\n\nsublocale beta_interp: Beta_Regions' X k \\<R>\\<^sub>\\<beta> V v n not_in_X\nusing finite non_empty clock_numbering not_in_X by (unfold_locales) (auto simp: \\<R>\\<^sub>\\<beta>_def V_def)\n\nabbreviation \"Approx\\<^sub>\\<beta> \\<equiv> beta_interp.Approx\\<^sub>\\<beta>\"\n\nsection \\<open>Preparing Bouyer's Theorem\\<close>\n\nlemma region_dbm:\n  assumes \"R \\<in> \\<R>\"\n  defines \"v' \\<equiv> \\<lambda> i. THE c. c \\<in> X \\<and> v c = i\"\n  obtains M\n  where\"[M]\\<^bsub>v,n\\<^esub> = R\"\n  and \"\\<forall> i \\<le> n. \\<forall> j \\<le> n. M i 0 = \\<infinity> \\<and> j > 0 \\<and> i \\<noteq> j\\<longrightarrow> M i j = \\<infinity> \\<and> M j i = \\<infinity>\"\n  and \"\\<forall> i \\<le> n. M i i = Le 0\"\n  and \"\\<forall> i \\<le> n. \\<forall> j \\<le> n. i > 0 \\<and> j > 0 \\<and> M i 0 \\<noteq> \\<infinity> \\<and> M j 0 \\<noteq> \\<infinity> \\<longrightarrow> (\\<exists> d :: int.\n        (- k (v' j) \\<le> d \\<and> d \\<le> k (v' i) \\<and> M i j = Le d \\<and> M j i = Le (-d))\n      \\<or> (- k (v' j) \\<le> d - 1 \\<and> d \\<le> k (v' i) \\<and> M i j = Lt d \\<and> M j i = Lt (-d + 1)))\"\n  and \"\\<forall> i \\<le> n. i > 0 \\<and> M i 0 \\<noteq> \\<infinity> \\<longrightarrow>\n        (\\<exists> d :: int. d \\<le> k (v' i) \\<and> d \\<ge> 0\n          \\<and> (M i 0 = Le d \\<and> M 0 i = Le (-d) \\<or> M i 0 = Lt d \\<and> M 0 i = Lt (-d + 1)))\"\n  and \"\\<forall> i \\<le> n. i > 0 \\<longrightarrow> (\\<exists> d :: int. - k (v' i) \\<le> d \\<and> d \\<le> 0 \\<and> (M 0 i = Le d \\<or> M 0 i = Lt d))\"\n  and \"\\<forall> i. \\<forall> j. M i j \\<noteq> \\<infinity> \\<longrightarrow> get_const (M i j) \\<in> \\<int>\"\n  and \"\\<forall> i \\<le> n. \\<forall> j \\<le> n. M i j \\<noteq> \\<infinity> \\<and> i > 0 \\<and> j > 0 \\<longrightarrow>\n      (\\<exists> d:: int. (M i j = Le d \\<or> M i j = Lt d) \\<and> (- k (v' j)) \\<le> d \\<and> d \\<le> k (v' i))\"\nproof -\n  from assms obtain I r where R: \"R = region X I r\" \"valid_region X k I r\" unfolding \\<R>_def by blast\n  let ?X\\<^sub>0 = \"{x \\<in> X. \\<exists>d. I x = Regions.intv.Intv d}\"\n  define f where \"f x = (if isIntv (I x) then Lt (intv_const (I x) + 1)\n                 else if isConst (I x) then Le (intv_const (I x))\n                 else \\<infinity>)\" for x\n  define g where \"g x = (if isIntv (I x) then Lt (- intv_const (I x))\n                 else if isConst (I x) then Le (- intv_const (I x))\n                 else Lt (- k x))\" for x\n  define h where \"h x y = (if isIntv (I x) \\<and> isIntv (I y) then\n                      if (y, x) \\<in> r \\<and> (x, y) \\<notin> r then Lt (int (intv_const (I x)) - intv_const (I y) + 1)\n                      else if (x, y) \\<in> r \\<and> (y, x) \\<notin> r then Lt (int (intv_const (I x)) - intv_const (I y))\n                      else Le (int (intv_const (I x)) - intv_const (I y))\n                   else if isConst (I x) \\<and> isConst (I y) then Le (int (intv_const (I x)) - intv_const (I y))\n                   else if isIntv (I x) \\<and> isConst (I y) then Lt (int (intv_const (I x)) + 1 - intv_const (I y))\n                   else if isConst (I x) \\<and> isIntv (I y) then Lt (int (intv_const (I x)) - intv_const (I y))\n                   else \\<infinity>)\" for x y\n  let ?M = \"\\<lambda> i j. if i = 0 then if j = 0 then Le 0 else g (v' j)\n                   else if j = 0 then f (v' i) else if i = j then Le 0 else h (v' i) (v' j)\"\n  have \"[?M]\\<^bsub>v,n\\<^esub> \\<subseteq> R\"\n  proof\n    fix u assume u: \"u \\<in> [?M]\\<^bsub>v,n\\<^esub>\"\n    show \"u \\<in> R\" unfolding R\n    proof (standard, goal_cases)\n      case 1\n      show ?case\n      proof\n        fix c assume c: \"c \\<in> X\"\n        with clock_numbering have c2: \"v c \\<le> n\" \"v c > 0\" \"v' (v c) = c\" unfolding v'_def by auto\n        with u have \"dbm_entry_val u None (Some c) (g c)\"\n        unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n        then show \"0 \\<le> u c\" by (cases \"isIntv (I c)\"; cases \"isConst (I c)\") (auto simp: g_def)\n      qed\n    next\n      case 2\n      show ?case\n      proof\n        fix c assume c: \"c \\<in> X\"\n        with clock_numbering have c2: \"v c \\<le> n\" \"v c > 0\" \"v' (v c) = c\" unfolding v'_def by auto\n        with u have *: \"dbm_entry_val u None (Some c) (g c)\" \"dbm_entry_val u (Some c) None (f c)\"\n        unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n        show \"intv_elem c u (I c)\"\n        proof (cases \"I c\")\n          case (Const d)\n          then have \"\\<not> isIntv (I c)\" \"isConst (I c)\" by auto\n          with * Const show ?thesis unfolding g_def f_def using Const by auto\n        next\n          case (Intv d)\n          then have \"isIntv (I c)\" \"\\<not> isConst (I c)\" by auto\n          with * Intv show ?thesis unfolding g_def f_def by auto\n        next\n          case (Greater d)\n          then have \"\\<not> isIntv (I c)\" \"\\<not> isConst (I c)\" by auto\n          with * Greater R(2) c show ?thesis unfolding g_def f_def by fastforce\n        qed\n      qed\n    next\n      show \"?X\\<^sub>0 = ?X\\<^sub>0\" ..\n      show \"\\<forall>x \\<in> ?X\\<^sub>0. \\<forall> y \\<in> ?X\\<^sub>0. (x, y) \\<in> r \\<longleftrightarrow> frac (u x) \\<le> frac (u y)\"\n      proof (standard, standard)\n        fix x y assume A: \"x \\<in> ?X\\<^sub>0\" \"y \\<in> ?X\\<^sub>0\"\n        show \"(x, y) \\<in> r \\<longleftrightarrow> frac (u x) \\<le> frac (u y)\"\n        proof (cases \"x = y\")\n          case True\n          have \"refl_on ?X\\<^sub>0 r\" using R(2) by auto\n          with A True show ?thesis unfolding refl_on_def by auto\n        next\n          case False\n          from A obtain d d' where AA:\n            \"I x = Intv d\" \"I y = Intv d'\" \"isIntv (I x)\" \"isIntv (I y)\" \"\\<not> isConst (I x)\" \"\\<not> isConst (I y)\"\n          by auto\n          from A False clock_numbering have B:\n            \"v x \\<le> n\" \"v x > 0\" \"v' (v x) = x\" \"v y \\<le> n\" \"v y > 0\" \"v' (v y) = y\" \"v x \\<noteq> v y\"\n          unfolding v'_def by auto\n          with u have *: \n            \"dbm_entry_val u (Some x) (Some y) (h x y)\" \"dbm_entry_val u (Some y) (Some x) (h y x)\"\n            \"dbm_entry_val u None (Some x) (g x)\" \"dbm_entry_val u (Some x) None (f x)\"\n            \"dbm_entry_val u None (Some y) (g y)\" \"dbm_entry_val u (Some y) None (f y)\"\n          unfolding DBM_zone_repr_def DBM_val_bounded_def by force+\n          show \"(x, y) \\<in> r \\<longleftrightarrow> frac (u x) \\<le> frac (u y)\"\n          proof\n            assume C: \"(x, y) \\<in> r\"\n            show \"frac (u x) \\<le> frac (u y)\"\n            proof (cases \"(y, x) \\<in> r\")\n              case False\n              with * AA C have **:\n                \"u x - u y < int d - d'\"\n                \"d < u x\" \"u x < d + 1\" \"d' < u y\" \"u y < d' + 1\"\n              unfolding f_def g_def h_def by auto\n              from nat_intv_frac_decomp[OF **(2,3)] nat_intv_frac_decomp[OF **(4,5)] **(1) show\n                \"frac (u x) \\<le> frac (u y)\"\n              by simp\n            next\n              case True\n              with * AA C have **:\n                \"u x - u y \\<le> int d - d'\"\n                \"d < u x\" \"u x < d + 1\" \"d' < u y\" \"u y < d' + 1\"\n              unfolding f_def g_def h_def by auto\n              from nat_intv_frac_decomp[OF **(2,3)] nat_intv_frac_decomp[OF **(4,5)] **(1) show\n                \"frac (u x) \\<le> frac (u y)\"\n              by simp\n            qed\n          next\n            assume \"frac (u x) \\<le> frac (u y)\"\n            show \"(x, y) \\<in> r\"\n            proof (rule ccontr)\n              assume C: \"(x,y) \\<notin> r\"\n              moreover from R(2) have \"total_on ?X\\<^sub>0 r\" by auto\n              ultimately have \"(y, x) \\<in> r\" using False A unfolding total_on_def by auto\n              with *(2-) AA C have **:\n                \"u y - u x < int d' - d\"\n                \"d < u x\" \"u x < d + 1\" \"d' < u y\" \"u y < d' + 1\"\n              unfolding f_def g_def h_def by auto\n              from nat_intv_frac_decomp[OF **(2,3)] nat_intv_frac_decomp[OF **(4,5)] **(1) have\n                \"frac (u y) < frac (u x)\"\n              by simp\n              with \\<open>frac _ \\<le> _\\<close> show False by auto\n            qed\n          qed\n        qed\n      qed\n    qed\n  qed\n  moreover have \"R \\<subseteq> [?M]\\<^bsub>v,n\\<^esub>\"\n  proof\n    fix u assume u: \"u \\<in> R\"\n    show \"u \\<in> [?M]\\<^bsub>v,n\\<^esub>\" unfolding DBM_zone_repr_def DBM_val_bounded_def\n    proof (safe, goal_cases)\n      case 1 then show ?case by auto\n    next\n      case (2 c)\n      with clock_numbering have \"c \\<in> X\" by metis\n      with clock_numbering have *: \"c \\<in> X\" \"v c > 0\" \"v' (v c) = c\" unfolding v'_def by auto\n      with R u have \"intv_elem c u (I c)\" \"valid_intv (k c) (I c)\" by auto\n      then have \"dbm_entry_val u None (Some c) (g c)\" unfolding g_def by (cases \"I c\") auto\n      with * show ?case by auto\n    next\n      case (3 c)\n      with clock_numbering have \"c \\<in> X\" by metis\n      with clock_numbering have *: \"c \\<in> X\" \"v c > 0\" \"v' (v c) = c\" unfolding v'_def by auto\n      with R u have \"intv_elem c u (I c)\" \"valid_intv (k c) (I c)\" by auto\n      then have \"dbm_entry_val u (Some c) None (f c)\" unfolding f_def by (cases \"I c\") auto\n      with * show ?case by auto\n    next\n      case (4 c1 c2)\n      with clock_numbering have \"c1 \\<in> X\" \"c2 \\<in> X\" by metis+\n      with clock_numbering have *:\n        \"c1 \\<in> X\" \"v c1 > 0\" \"v' (v c1) = c1\" \"c2 \\<in> X\" \"v c2 > 0\" \"v' (v c2) = c2\"\n      unfolding v'_def by auto\n      with R u have\n        \"intv_elem c1 u (I c1)\" \"valid_intv (k c1) (I c1)\"\n        \"intv_elem c2 u (I c2)\" \"valid_intv (k c2) (I c2)\"\n      by auto\n      then have \"dbm_entry_val u (Some c1) (Some c2) (h c1 c2)\" unfolding h_def\n      proof(cases \"I c1\", cases \"I c2\", fastforce+, cases \"I c2\", fastforce, goal_cases)\n      case (1 d d')\n        then show ?case\n        proof (cases \"(c2, c1) \\<in> r\", goal_cases)\n          case 1\n          show ?case\n          proof (cases \"(c1, c2) \\<in> r\")\n            case True\n            with 1 *(1,4) R(1) u have \"frac (u c1) = frac (u c2)\" by auto\n            with 1 have \"u c1 - u c2 = real d - d'\" by (fastforce dest: nat_intv_frac_decomp)\n            with 1 show ?thesis by auto\n          next\n            case False with 1 show ?thesis by auto\n          qed\n        next\n          case 2\n          show ?case\n          proof (cases \"c1 = c2\")\n            case True then show ?thesis by auto\n          next\n            case False\n            with 2 R(2) *(1,4) have \"(c1, c2) \\<in> r\" by (fastforce simp: total_on_def)\n            with 2 *(1,4) R(1) u have \"frac (u c1) < frac (u c2)\" by auto\n            with 2 have \"u c1 - u c2 < real d - d'\" by (fastforce dest: nat_intv_frac_decomp)\n            with 2 show ?thesis by auto\n          qed\n        qed\n      qed fastforce+\n      then show ?case\n      proof (cases \"v c1 = v c2\", goal_cases)\n        case True with * clock_numbering have \"c1 = c2\" by auto\n        then show ?thesis by auto\n      next\n        case 2 with * show ?case by auto\n      qed\n    qed\n  qed\n  ultimately have \"[?M]\\<^bsub>v,n\\<^esub> = R\" by blast\n  moreover have \"\\<forall> i \\<le> n. \\<forall> j \\<le> n. ?M i 0 = \\<infinity> \\<and> j > 0 \\<and> i \\<noteq> j \\<longrightarrow> ?M i j = \\<infinity> \\<and> ?M j i = \\<infinity>\"\n  unfolding f_def h_def by auto\n  moreover have \"\\<forall> i \\<le> n. ?M i i = Le 0\" by auto\n  moreover\n  { fix i j assume A: \"i \\<le> n\" \"j \\<le> n\" \"i > 0\" \"j > 0\" \"?M i 0 \\<noteq> \\<infinity>\" \"?M j 0 \\<noteq> \\<infinity>\"\n    with clock_numbering(2) obtain c1 c2 where B: \"v c1 = i\" \"v c2 = j\" \"c1 \\<in> X\" \"c2 \\<in> X\" by meson\n    with clock_numbering(1) A have C: \"v' i = c1\" \"v' j = c2\" unfolding v'_def by force+\n    from R(2) B have valid: \"valid_intv (k c1) (I c1)\" \"valid_intv (k c2) (I c2)\" by auto\n    have \"\\<exists> d :: int. (- k (v' j) \\<le> d \\<and> d \\<le> k (v' i) \\<and> ?M i j = Le d \\<and> ?M j i = Le (-d)\n      \\<or> (- k (v' j) \\<le> d - 1 \\<and> d \\<le> k (v' i) \\<and> ?M i j = Lt d \\<and> ?M j i = Lt (-d + 1)))\"\n    proof (cases \"i = j\")\n      case True\n      then show ?thesis by auto\n    next\n      case False\n      then show ?thesis\n      proof (cases \"I c1\", goal_cases)\n        case 1\n        then show ?case\n        proof (cases \"I c2\")\n          case Const\n          let ?d = \"int (intv_const (I c1)) - int (intv_const (I c2))\"\n          from Const 1 have \"isConst (I c1)\" \"isConst (I c2)\" by auto\n          with A(1-4) C valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n        next\n          case Intv\n          let ?d = \"int(intv_const (I c1)) - int (intv_const (I c2))\"\n          from Intv 1 have \"isConst (I c1)\" \"isIntv (I c2)\" by auto\n          with A(1-4) C valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n        next\n          case Greater\n          then have \"\\<not> isIntv (I c2)\" \"\\<not> isConst (I c2)\" by auto\n          with A 1(1) C have False unfolding f_def by simp\n          then show ?thesis by fast\n        qed\n      next\n        case 2\n        then show ?case\n        proof (cases \"I c2\")\n          case Const\n          let ?d = \"int (intv_const (I c1)) + 1 - int (intv_const (I c2))\"\n          from Const 2 have \"isIntv (I c1)\" \"isConst (I c2)\" by auto\n          with A(1-4) C valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n        next\n          case Intv\n          with 2 have *: \"isIntv (I c1)\" \"isIntv (I c2)\" by auto\n          from Intv A(1-4) C show ?thesis apply simp\n          proof (standard, goal_cases)\n            case 1\n            show ?case\n            proof (cases \"(c2, c1) \\<in> r\")\n              case True\n              note T = this\n              show ?thesis\n              proof (cases \"(c1, c2) \\<in> r\")\n                case True\n                let ?d = \"int (intv_const (I c1)) - int (intv_const (I c2))\"\n                from True T * valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n              next\n                case False\n                let ?d = \"int (intv_const (I c1)) - int (intv_const (I c2)) + 1\"\n                from False T * valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n              qed\n            next\n              case False\n              let ?d = \"int (intv_const (I c1)) - int (intv_const (I c2))\"\n              from False * valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n            qed\n          qed\n        next\n          case Greater\n          then have \"\\<not> isIntv (I c2)\" \"\\<not> isConst (I c2)\" by auto\n          with A 2(1) C have False unfolding f_def by simp\n          then show ?thesis by fast\n        qed\n      next\n        case 3\n        then have \"\\<not> isIntv (I c1)\" \"\\<not> isConst (I c1)\" by auto\n        with A 3(1) C have False unfolding f_def by simp\n        then show ?thesis by fast\n      qed\n    qed\n  }\n  moreover\n  { fix i assume A: \"i \\<le> n\" \"i > 0\" \"?M i 0 \\<noteq> \\<infinity>\"\n    with clock_numbering(2) obtain c1 where B: \"v c1 = i\" \"c1 \\<in> X\" by meson\n    with clock_numbering(1) A have C: \"v' i = c1\" unfolding v'_def by force+\n    from R(2) B have valid: \"valid_intv (k c1) (I c1)\" by auto\n    have \"\\<exists> d :: int. d \\<le> k (v' i) \\<and> d \\<ge> 0\n      \\<and> (?M i 0 = Le d \\<and> ?M 0 i = Le (-d) \\<or> ?M i 0 = Lt d \\<and> ?M 0 i = Lt (-d + 1))\"\n    proof (cases \"i = 0\")\n      case True\n      then show ?thesis by auto\n    next\n      case False\n      then show ?thesis\n      proof (cases \"I c1\", goal_cases)\n        case 1\n        let ?d = \"int (intv_const (I c1))\"\n        from 1 have \"isConst (I c1)\" \"\\<not> isIntv (I c1)\" by auto\n        with A C valid show ?thesis unfolding f_def g_def by (intro exI[where x = ?d]) auto\n      next\n        case 2\n        let ?d = \"int (intv_const (I c1)) + 1\"\n        from 2 have \"isIntv(I c1)\" \"\\<not> isConst (I c1)\" by auto\n        with A C valid show ?thesis unfolding f_def g_def by (intro exI[where x = ?d]) auto\n      next\n        case 3\n        then have \"\\<not> isIntv (I c1)\" \"\\<not> isConst (I c1)\" by auto\n        with A 3(1) C have False unfolding f_def by simp\n        then show ?thesis by fast\n      qed\n    qed\n  }\n  moreover\n  { fix i assume A: \"i \\<le> n\" \"i > 0\"\n    with clock_numbering(2) obtain c1 where B: \"v c1 = i\" \"c1 \\<in> X\" by meson\n    with clock_numbering(1) A have C: \"v' i = c1\" unfolding v'_def by force+\n    from R(2) B have valid: \"valid_intv (k c1) (I c1)\" by auto\n    have \"\\<exists> d :: int. - k (v' i) \\<le> d \\<and> d \\<le> 0 \\<and> (?M 0 i = Le d \\<or> ?M 0 i = Lt d)\"\n    proof (cases \"i = 0\")\n      case True\n      then show ?thesis by auto\n    next\n      case False\n      then show ?thesis\n      proof (cases \"I c1\", goal_cases)\n        case 1\n        let ?d = \"- int (intv_const (I c1))\"\n        from 1 have \"isConst (I c1)\" \"\\<not> isIntv (I c1)\" by auto\n        with A C valid show ?thesis unfolding f_def g_def by (intro exI[where x = ?d]) auto\n      next\n        case 2\n        let ?d = \"- int (intv_const (I c1))\"\n        from 2 have \"isIntv(I c1)\" \"\\<not> isConst (I c1)\" by auto\n        with A C valid show ?thesis unfolding f_def g_def by (intro exI[where x = ?d]) auto\n      next\n        case 3\n        let ?d = \"- (k c1)\"\n        from 3 have \"\\<not> isIntv (I c1)\" \"\\<not> isConst (I c1)\" by auto\n        with A C show ?thesis unfolding g_def by (intro exI[where x = ?d]) auto\n      qed\n    qed\n  }\n  moreover have \"\\<forall> i. \\<forall> j. ?M i j \\<noteq> \\<infinity> \\<longrightarrow> get_const (?M i j) \\<in> \\<int>\" unfolding f_def g_def h_def by auto\n  moreover have \"\\<forall> i \\<le> n. \\<forall> j \\<le> n. i > 0 \\<and> j > 0 \\<and> ?M i j \\<noteq> \\<infinity>\n    \\<longrightarrow> (\\<exists> d:: int. (?M i j = Le d \\<or> ?M i j = Lt d) \\<and> (- k (v' j)) \\<le> d \\<and> d \\<le> k (v' i))\"\n  proof (auto, goal_cases)\n    case A: (1 i j)\n    with clock_numbering(2) obtain c1 c2 where B: \"v c1 = i\" \"c1 \\<in> X\" \"v c2 = j\" \"c2 \\<in> X\" by meson\n    with clock_numbering(1) A have C: \"v' i = c1\" \"v' j = c2\" unfolding v'_def by force+\n    from R(2) B have valid: \"valid_intv (k c1) (I c1)\" \"valid_intv (k c2) (I c2)\" by auto\n    with A B C show ?case\n    proof (simp, goal_cases)\n      case 1\n      show ?case\n      proof (cases \"I c1\", goal_cases)\n        case 1\n        then show ?case\n        proof (cases \"I c2\")\n          case Const\n          let ?d = \"int (intv_const (I c1)) - int (intv_const (I c2))\"\n          from Const 1 have \"isConst (I c1)\" \"isConst (I c2)\" by auto\n          with A(1-4) C valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n        next\n          case Intv\n          let ?d = \"int(intv_const (I c1)) - int (intv_const (I c2))\"\n          from Intv 1 have \"isConst (I c1)\" \"isIntv (I c2)\" by auto\n          with A(1-4) C valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n        next\n          case Greater\n          then have \"\\<not> isIntv (I c2)\" \"\\<not> isConst (I c2)\" by auto\n          with A 1(1) C show ?thesis unfolding h_def by simp\n        qed\n      next\n        case 2\n        then show ?case\n        proof (cases \"I c2\")\n          case Const\n          let ?d = \"int (intv_const (I c1)) + 1 - int (intv_const (I c2))\"\n          from Const 2 have \"isIntv (I c1)\" \"isConst (I c2)\" by auto\n          with A(1-4) C valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n        next\n          case Intv\n          with 2 have *: \"isIntv (I c1)\" \"isIntv (I c2)\" by auto\n          from Intv A(1-4) C show ?thesis\n          proof goal_cases\n            case 1\n            show ?case\n            proof (cases \"(c2, c1) \\<in> r\")\n              case True\n              note T = this\n              show ?thesis\n              proof (cases \"(c1, c2) \\<in> r\")\n                case True\n                let ?d = \"int (intv_const (I c1)) - int (intv_const (I c2))\"\n                from True T * valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n              next\n                case False\n                let ?d = \"int (intv_const (I c1)) - int (intv_const (I c2)) + 1\"\n                from False T * valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n              qed\n            next\n              case False\n              let ?d = \"int (intv_const (I c1)) - int (intv_const (I c2))\"\n              from False * valid show ?thesis unfolding h_def by (intro exI[where x = ?d]) auto\n            qed\n          qed\n        next\n          case Greater\n          then have \"\\<not> isIntv (I c2)\" \"\\<not> isConst (I c2)\" by auto\n          with A 2(1) C show ?thesis unfolding h_def by simp\n        qed\n      next\n        case 3\n        then have \"\\<not> isIntv (I c1)\" \"\\<not> isConst (I c1)\" by auto\n        with A 3(1) C show ?thesis unfolding h_def by simp\n      qed\n    qed\n  qed\n  moreover show ?thesis\n    apply (rule that)\n           apply (rule calculation(1))\n          apply (rule calculation(2))\n         apply (rule calculation(3))\n        apply (blast intro: calculation)+\n     apply (rule calculation(7))\n    using calculation(8) apply blast\n  done\nqed\n\nlemma len_inf_elem:\n  \"(a, b) \\<in> set (arcs i j xs) \\<Longrightarrow> M a b = \\<infinity> \\<Longrightarrow> len M i j xs = \\<infinity>\"\napply (induction rule: arcs.induct)\n  apply (auto simp: mult)\n  apply (rename_tac a' b' x xs)\n  apply (case_tac \"M a' x\")\nby auto\n\nlemma dbm_add_strict_right_mono_neutral: \"a < Le d \\<Longrightarrow> a + Le (-d) < Le 0\"\nunfolding less mult by (cases a) (auto elim!: dbm_lt.cases)\n\nlemma dbm_lt_not_inf_less[intro]: \"A \\<noteq> \\<infinity> \\<Longrightarrow> A \\<prec> \\<infinity>\" by (cases A) auto\n\nlemma add_inf[simp]:\n  \"a + \\<infinity> = \\<infinity>\" \"\\<infinity> + a = \\<infinity>\"\nunfolding mult by (cases a) auto\n\nlemma inf_lt[simp,dest!]:\n  \"\\<infinity> < x \\<Longrightarrow> False\"\nby (cases x) (auto simp: less)\n\nlemma zone_diag_lt:\n  assumes \"a \\<le> n\" \"b \\<le> n\" and C: \"v c1 = a\" \"v c2 = b\" and not0: \"a > 0\" \"b > 0\"\n  shows \"[(\\<lambda> i j. if i = a \\<and> j = b then Lt d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. u c1 - u c2 < d}\"\nunfolding DBM_zone_repr_def DBM_val_bounded_def\nproof (standard, goal_cases)\n  case 1\n  then show ?case using \\<open>a \\<le> n\\<close> \\<open>b \\<le> n\\<close> C by fastforce\nnext\n  case 2\n  then show ?case\n  proof (safe, goal_cases)\n    case 1 from not0 show ?case unfolding dbm_le_def by auto\n  next\n    case 2 with not0 show ?case by auto\n  next\n    case 3 with not0 show ?case by auto\n  next\n    case (4 u' y z)\n    show ?case\n    proof (cases \"v y = a \\<and> v z = b\")\n      case True\n      with 4 clock_numbering C \\<open>a \\<le> n\\<close> \\<open>b \\<le> n\\<close> have \"u' y - u' z < d\" by metis\n      with True show ?thesis by auto\n    next\n      case False then show ?thesis by auto\n    qed\n  qed\nqed\n\nlemma zone_diag_le:\n  assumes \"a \\<le> n\" \"b \\<le> n\" and C: \"v c1 = a\" \"v c2 = b\" and not0: \"a > 0\" \"b > 0\"\n  shows \"[(\\<lambda> i j. if i = a \\<and> j = b then Le d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. u c1 - u c2 \\<le> d}\"\nunfolding DBM_zone_repr_def DBM_val_bounded_def\nproof (rule, goal_cases)\n  case 1\n  then show ?case using \\<open>a \\<le> n\\<close> \\<open>b \\<le> n\\<close> C by fastforce\nnext\n  case 2\n  then show ?case\n  proof (safe, goal_cases)\n    case 1 from not0 show ?case unfolding dbm_le_def by auto\n  next\n    case 2 with not0 show ?case by auto\n  next\n    case 3 with not0 show ?case by auto\n  next\n    case (4 u' y z)\n    show ?case\n    proof (cases \"v y = a \\<and> v z = b\")\n      case True\n      with 4 clock_numbering C \\<open>a \\<le> n\\<close> \\<open>b \\<le> n\\<close> have \"u' y - u' z \\<le> d\" by metis\n      with True show ?thesis by auto\n    next\n      case False then show ?thesis by auto\n    qed\n  qed\nqed\n\nlemma zone_diag_lt_2:\n  assumes \"a \\<le> n\" and C: \"v c = a\" and not0: \"a > 0\"\n  shows \"[(\\<lambda> i j. if i = a \\<and> j = 0 then Lt d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. u c < d}\"\nunfolding DBM_zone_repr_def DBM_val_bounded_def\nproof (rule, goal_cases)\n  case 1\n  then show ?case using \\<open>a \\<le> n\\<close> C by fastforce\nnext\n  case 2\n  then show ?case\n  proof (safe, goal_cases)\n    case 1 from not0 show ?case unfolding dbm_le_def by auto\n  next\n    case 2 with not0 show ?case by auto\n  next\n    case (3 u c)\n    show ?case\n    proof (cases \"v c = a\")\n      case False then show ?thesis by auto\n    next\n      case True\n      with 3 clock_numbering C \\<open>a \\<le> n\\<close> have \"u c < d\" by metis\n      with C show ?thesis by auto\n    qed\n  next\n    case (4 u' y z)\n    from clock_numbering(1) have \"0 < v z\" by auto\n    then show ?case by auto\n  qed\nqed\n\nlemma zone_diag_le_2:\n  assumes \"a \\<le> n\" and C: \"v c = a\" and not0: \"a > 0\"\n  shows \"[(\\<lambda> i j. if i = a \\<and> j = 0 then Le d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. u c \\<le> d}\"\nunfolding DBM_zone_repr_def DBM_val_bounded_def\nproof (rule, goal_cases)\n  case 1\n  then show ?case using \\<open>a \\<le> n\\<close> C by fastforce\nnext\n  case 2\n  then show ?case\n  proof (safe, goal_cases)\n    case 1 from not0 show ?case unfolding dbm_le_def by auto\n  next\n    case 2 with not0 show ?case by auto\n  next\n    case (3 u c)\n    show ?case\n    proof (cases \"v c = a\")\n      case False then show ?thesis by auto\n    next\n      case True\n      with 3 clock_numbering C \\<open>a \\<le> n\\<close> have \"u c \\<le> d\" by metis\n      with C show ?thesis by auto\n    qed\n  next\n    case (4 u' y z)\n    from clock_numbering(1) have \"0 < v z\" by auto\n    then show ?case by auto\n  qed\nqed\n\nlemma zone_diag_lt_3:\n  assumes \"a \\<le> n\" and C: \"v c = a\" and not0: \"a > 0\"\n  shows \"[(\\<lambda> i j. if i = 0 \\<and> j = a then Lt d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. - u c < d}\"\nunfolding DBM_zone_repr_def DBM_val_bounded_def\nproof (rule, goal_cases)\n  case 1\n  then show ?case using \\<open>a \\<le> n\\<close> C by fastforce\nnext\n  case 2\n  then show ?case\n  proof (safe, goal_cases)\n    case 1 from not0 show ?case unfolding dbm_le_def by auto\n  next\n    case (2 u c)\n    show ?case\n    proof (cases \"v c = a\", goal_cases)\n      case False then show ?thesis by auto\n    next\n      case True\n      with 2 clock_numbering C \\<open>a \\<le> n\\<close> have \"- u c < d\" by metis\n      with C show ?thesis by auto\n    qed\n  next\n    case (3 u) with not0 show ?case by auto\n  next\n    case (4 u' y z)\n    from clock_numbering(1) have \"0 < v y\" by auto\n    then show ?case by auto\n  qed\nqed\n\nlemma len_int_closed:\n  \"\\<forall> i j. (M i j :: real) \\<in> \\<int> \\<Longrightarrow> len M i j xs \\<in> \\<int>\"\nby (induction xs arbitrary: i) auto\n\nlemma get_const_distr:\n  \"a \\<noteq> \\<infinity> \\<Longrightarrow> b \\<noteq> \\<infinity> \\<Longrightarrow> get_const (a + b) = get_const a + get_const b\"\nby (cases a) (cases b, auto simp: mult)+\n\nlemma len_int_dbm_closed:\n  \"\\<forall> (i, j) \\<in> set (arcs i j xs). (get_const (M i j) :: real) \\<in> \\<int> \\<and> M i j \\<noteq> \\<infinity>\n  \\<Longrightarrow> get_const (len M i j xs) \\<in> \\<int> \\<and> len M i j xs \\<noteq> \\<infinity>\"\nby (induction xs arbitrary: i) (auto simp: get_const_distr, simp add: dbm_add_not_inf mult)\n\nlemma zone_diag_le_3:\n  assumes \"a \\<le> n\" and C: \"v c = a\" and not0: \"a > 0\"\n  shows \"[(\\<lambda> i j. if i = 0 \\<and> j = a then Le d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. - u c \\<le> d}\"\nunfolding DBM_zone_repr_def DBM_val_bounded_def\nproof (rule, goal_cases)\n  case 1\n  then show ?case using \\<open>a \\<le> n\\<close> C by fastforce\nnext\n  case 2\n  then show ?case\n  proof (safe, goal_cases)\n    case 1 from not0 show ?case unfolding dbm_le_def by auto\n  next\n    case (2 u c)\n    show ?case\n    proof (cases \"v c = a\")\n      case False then show ?thesis by auto\n    next\n      case True\n      with 2 clock_numbering C \\<open>a \\<le> n\\<close> have \"- u c \\<le> d\" by metis\n      with C show ?thesis by auto\n    qed\n  next\n    case (3 u) with not0 show ?case by auto\n  next\n    case (4 u' y z)\n    from clock_numbering(1) have \"0 < v y\" by auto\n    then show ?case by auto\n  qed\nqed\n\nlemma dbm_lt':\n  assumes \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> V\" \"M a b \\<le> Lt d\" \"a \\<le> n\" \"b \\<le> n\" \"v c1 = a\" \"v c2 = b\" \"a > 0\" \"b > 0\"\n  shows \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 - u c2 < d}\"\nproof -\n  from assms have \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> [(\\<lambda> i j. if i = a \\<and> j = b then Lt d else \\<infinity>)]\\<^bsub>v,n\\<^esub>\"\n    apply safe\n    apply (rule DBM_le_subset)\n  unfolding less_eq dbm_le_def by auto\n  moreover from zone_diag_lt[OF \\<open>a \\<le> n\\<close> \\<open>b \\<le> n\\<close> assms(5-)]\n  have \"[(\\<lambda> i j. if i = a \\<and> j = b then Lt d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. u c1 - u c2 < d}\" by blast\n  moreover from assms have \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> V\" by auto\n  ultimately show ?thesis by auto\nqed\n\nlemma dbm_lt'2:\n  assumes \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> V\" \"M a 0 \\<le> Lt d\" \"a \\<le> n\" \"v c1 = a\" \"a > 0\"\n  shows \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 < d}\"\nproof -\n  from assms(2) have \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> [(\\<lambda> i j. if i = a \\<and> j = 0 then Lt d else \\<infinity>)]\\<^bsub>v,n\\<^esub>\"\n    apply safe\n    apply (rule DBM_le_subset)\n  unfolding less_eq dbm_le_def by auto\n  moreover from zone_diag_lt_2[OF \\<open>a \\<le> n\\<close> assms(4,5)]\n  have \"[(\\<lambda> i j. if i = a \\<and> j = 0 then Lt d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. u c1 < d}\" by blast\n  ultimately show ?thesis using assms(1) by auto\nqed\n\nlemma dbm_lt'3:\n  assumes \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> V\" \"M 0 a \\<le> Lt d\" \"a \\<le> n\" \"v c1 = a\" \"a > 0\"\n  shows \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. - u c1 < d}\"\nproof -\n  from assms(2) have \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> [(\\<lambda> i j. if i = 0 \\<and> j = a then Lt d else \\<infinity>)]\\<^bsub>v,n\\<^esub>\"\n    apply safe\n    apply (rule DBM_le_subset)\n  unfolding less_eq dbm_le_def by auto\n  moreover from zone_diag_lt_3[OF \\<open>a \\<le> n\\<close> assms(4,5)]\n  have \"[(\\<lambda> i j. if i = 0 \\<and> j = a then Lt d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. - u c1 < d}\" by blast\n  ultimately show ?thesis using assms(1) by auto\nqed\n\nlemma dbm_le':\n  assumes \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> V\" \"M a b \\<le> Le d\" \"a \\<le> n\" \"b \\<le> n\" \"v c1 = a\" \"v c2 = b\" \"a > 0\" \"b > 0\"\n  shows \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 - u c2 \\<le> d}\"\nproof -\n  from assms have \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> [(\\<lambda> i j. if i = a \\<and> j = b then Le d else \\<infinity>)]\\<^bsub>v,n\\<^esub>\"\n    apply safe\n    apply (rule DBM_le_subset)\n  unfolding less_eq dbm_le_def by auto\n  moreover from zone_diag_le[OF \\<open>a \\<le> n\\<close> \\<open>b \\<le> n\\<close> assms(5-)]\n  have \"[(\\<lambda> i j. if i = a \\<and> j = b then Le d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. u c1 - u c2 \\<le> d}\" by blast\n  moreover from assms have \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> V\" by auto\n  ultimately show ?thesis by auto\nqed\n\nlemma dbm_le'2:\n  assumes \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> V\" \"M a 0 \\<le> Le d\" \"a \\<le> n\" \"v c1 = a\" \"a > 0\"\n  shows \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 \\<le> d}\"\nproof -\n  from assms(2) have \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> [(\\<lambda> i j. if i = a \\<and> j = 0 then Le d else \\<infinity>)]\\<^bsub>v,n\\<^esub>\"\n    apply safe\n    apply (rule DBM_le_subset)\n  unfolding less_eq dbm_le_def by auto\n  moreover from zone_diag_le_2[OF \\<open>a \\<le> n\\<close> assms(4,5)]\n  have \"[(\\<lambda> i j. if i = a \\<and> j = 0 then Le d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. u c1 \\<le> d}\" by blast\n  ultimately show ?thesis using assms(1) by auto\nqed\n\nlemma dbm_le'3:\n  assumes \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> V\" \"M 0 a \\<le> Le d\" \"a \\<le> n\" \"v c1 = a\" \"a > 0\"\n  shows \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. - u c1 \\<le> d}\"\nproof -\n  from assms(2) have \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> [(\\<lambda> i j. if i = 0 \\<and> j = a then Le d else \\<infinity>)]\\<^bsub>v,n\\<^esub>\"\n    apply safe\n    apply (rule DBM_le_subset)\n  unfolding less_eq dbm_le_def by auto\n  moreover from zone_diag_le_3[OF \\<open>a \\<le> n\\<close> assms(4,5)]\n  have \"[(\\<lambda> i j. if i = 0 \\<and> j = a then Le d else \\<infinity>)]\\<^bsub>v,n\\<^esub> = {u. - u c1 \\<le> d}\" by blast\n  ultimately show ?thesis using assms(1) by auto\nqed\n\nlemma int_zone_dbm:\n  assumes \"\\<forall> (_,d) \\<in> collect_clock_pairs cc. d \\<in> \\<int>\" \"\\<forall> c \\<in> collect_clks cc. v c \\<le> n\"\n  obtains M where \"{u. u \\<turnstile> cc} = [M]\\<^bsub>v,n\\<^esub>\" and \"dbm_int M n\"\nusing int_zone_dbm[OF _ assms] clock_numbering(1) by auto\n\nlemma non_empty_dbm_diag_set':\n  assumes \"clock_numbering' v n\" \"\\<forall>i\\<le>n. \\<forall>j\\<le>n. M i j \\<noteq> \\<infinity> \\<longrightarrow> get_const (M i j) \\<in> \\<int>\"\n          \"[M]\\<^bsub>v,n\\<^esub> \\<noteq> {}\"\n  obtains M' where \"[M]\\<^bsub>v,n\\<^esub> = [M']\\<^bsub>v,n\\<^esub> \\<and> (\\<forall>i\\<le>n. \\<forall>j\\<le>n. M' i j \\<noteq> \\<infinity> \\<longrightarrow> get_const (M' i j) \\<in> \\<int>)\n    \\<and> (\\<forall> i \\<le> n. M' i i = \\<one>)\"\nproof -\n  let ?M = \"\\<lambda>i j. if i = j then \\<one> else M i j\"\n  from non_empty_dbm_diag_set[OF assms(1,3)] have \"[M]\\<^bsub>v,n\\<^esub> = [?M]\\<^bsub>v,n\\<^esub>\" by auto\n  moreover from assms(2) have \"\\<forall>i\\<le>n. \\<forall>j\\<le>n. ?M i j \\<noteq> \\<infinity> \\<longrightarrow> get_const (?M i j) \\<in> \\<int>\"\n  unfolding neutral by auto\n  moreover have \"\\<forall> i \\<le> n. ?M i i = \\<one>\" by auto\n  ultimately show ?thesis by (auto intro: that)\nqed\n\nlemma dbm_entry_int:\n  \"x \\<noteq> \\<infinity> \\<Longrightarrow> get_const x \\<in> \\<int> \\<Longrightarrow> \\<exists> d :: int. x = Le d \\<or> x = Lt d\"\napply (cases x) using Ints_cases by auto\n\nabbreviation \"vabstr \\<equiv> beta_interp.vabstr\"\n\n\nsection \\<open>Bouyer's Main Theorem\\<close>\n\ntheorem region_zone_intersect_empty_approx_correct:\n  assumes \"R \\<in> \\<R>\" \"Z \\<subseteq> V\" \"R \\<inter> Z = {}\" \"vabstr Z M\"\n  shows \"R \\<inter> Approx\\<^sub>\\<beta> Z = {}\"\nproof -\n  define v' where \"v' i = (THE c. c \\<in> X \\<and> v c = i)\" for i\n  from region_dbm[OF assms(1)] obtain M\\<^sub>R where M\\<^sub>R:\n    \"[M\\<^sub>R]\\<^bsub>v,n\\<^esub> = R\" \"\\<forall>i\\<le>n. \\<forall>j\\<le>n. M\\<^sub>R i 0 = \\<infinity> \\<and> 0 < j \\<and> i \\<noteq> j \\<longrightarrow> M\\<^sub>R i j = \\<infinity> \\<and> M\\<^sub>R j i = \\<infinity>\"\n    \"\\<forall>i\\<le>n. M\\<^sub>R i i = Le 0\"\n    \"\\<forall>i\\<le>n. \\<forall>j\\<le>n. 0 < i \\<and> 0 < j \\<and> M\\<^sub>R i 0 \\<noteq> \\<infinity> \\<and> M\\<^sub>R j 0 \\<noteq> \\<infinity> \\<longrightarrow>\n     (\\<exists>d. - int (k (THE c. c \\<in> X \\<and> v c = j)) \\<le> d \\<and> d \\<le> int (k (THE c. c \\<in> X \\<and> v c = i))\n          \\<and> M\\<^sub>R i j = Le d \\<and> M\\<^sub>R j i = Le (real_of_int (- d))\n        \\<or> - int (k (THE c. c \\<in> X \\<and> v c = j)) \\<le> d - 1 \\<and> d \\<le> int (k (THE c. c \\<in> X \\<and> v c = i))\n          \\<and> M\\<^sub>R i j = Lt d \\<and> M\\<^sub>R j i = Lt (real_of_int (- d + 1)))\"\n    \"\\<forall>i\\<le>n. 0 < i \\<and> M\\<^sub>R i 0 \\<noteq> \\<infinity> \\<longrightarrow> (\\<exists>d\\<le>int (k (THE c. c \\<in> X \\<and> v c = i)). d \\<ge> 0 \\<and>\n      (M\\<^sub>R i 0 = Le d \\<and> M\\<^sub>R 0 i = Le (real_of_int (- d)) \\<or> M\\<^sub>R i 0 = Lt d \\<and> M\\<^sub>R 0 i = Lt (real_of_int (- d + 1))))\"\n    \"\\<forall>i\\<le>n. 0 < i \\<longrightarrow> (\\<exists>d\\<ge>- int (k (THE c. c \\<in> X \\<and> v c = i)). d \\<le> 0 \\<and> (M\\<^sub>R 0 i = Le d \\<or> M\\<^sub>R 0 i = Lt d))\"\n    \"\\<forall>i j. M\\<^sub>R i j \\<noteq> \\<infinity> \\<longrightarrow> get_const (M\\<^sub>R i j) \\<in> \\<int>\"\n    \"\\<forall>i\\<le>n. \\<forall>j\\<le>n. M\\<^sub>R i j \\<noteq> \\<infinity> \\<and> 0 < i \\<and> 0 < j \\<longrightarrow> (\\<exists>d. (M\\<^sub>R i j = Le d \\<or> M\\<^sub>R i j = Lt d)\n        \\<and> - int (k (THE c. c \\<in> X \\<and> v c = j)) \\<le> d \\<and> d \\<le> int (k (THE c. c \\<in> X \\<and> v c = i)))\"\n  .\n  show ?thesis\n  proof (cases \"R = {}\")\n    case True then show ?thesis by auto\n  next\n    case False\n    from clock_numbering(2) have cn_weak: \"\\<forall>k\\<le>n. 0 < k \\<longrightarrow> (\\<exists> c. v c = k)\" by auto\n    \n    show ?thesis\n    proof (cases \"Z = {}\")\n      case True\n      then show ?thesis using beta_interp.apx_empty by blast\n    next\n      case False\n      from assms(4) have\n        \"Z = [M]\\<^bsub>v,n\\<^esub>\" \"\\<forall> i\\<le>n. \\<forall> j\\<le>n. M i j \\<noteq> \\<infinity> \\<longrightarrow> get_const (M i j) \\<in> \\<int>\"\n      by auto\n      from this(1) non_empty_dbm_diag_set'[OF clock_numbering(1) this(2)] \\<open>Z \\<noteq> {}\\<close> obtain M where M:\n        \"Z = [M]\\<^bsub>v,n\\<^esub> \\<and> (\\<forall>i\\<le>n. \\<forall>j\\<le>n. M i j \\<noteq> \\<infinity> \\<longrightarrow> get_const (M i j) \\<in> \\<int>) \\<and> (\\<forall>i\\<le>n. M i i = \\<one>)\"\n      by auto\n      with not_empty_cyc_free[OF cn_weak] False have \"cyc_free M n\" by auto\n      then have \"cycle_free M n\" using cycle_free_diag_equiv by auto\n      from M have \"Z = [FW M n]\\<^bsub>v,n\\<^esub>\" unfolding neutral by (auto intro!: FW_zone_equiv[OF cn_weak])\n      moreover from fw_canonical[OF \\<open>cycle_free M _\\<close>] M have \"canonical (FW M n) n\" unfolding neutral by auto\n      moreover from FW_int_preservation M have\n        \"\\<forall>i\\<le>n. \\<forall>j\\<le>n. FW M n i j \\<noteq> \\<infinity> \\<longrightarrow> get_const (FW M n i j) \\<in> \\<int>\"\n      by auto\n      ultimately obtain M where M:\n        \"[M]\\<^bsub>v,n\\<^esub> = Z\" \"canonical M n\" \"\\<forall>i\\<le>n. \\<forall>j\\<le>n. M i j \\<noteq> \\<infinity> \\<longrightarrow> get_const (M i j) \\<in> \\<int>\"\n      by blast\n      let ?M = \"\\<lambda> i j. min (M i j) (M\\<^sub>R i j)\"\n      from M(1) M\\<^sub>R(1) assms have \"[M]\\<^bsub>v,n\\<^esub> \\<inter> [M\\<^sub>R]\\<^bsub>v,n\\<^esub> = {}\" by auto\n      moreover from DBM_le_subset[folded less_eq, of n ?M M] have \"[?M]\\<^bsub>v,n\\<^esub> \\<subseteq> [M]\\<^bsub>v,n\\<^esub>\" by auto\n      moreover from DBM_le_subset[folded less_eq, of n ?M M\\<^sub>R] have \"[?M]\\<^bsub>v,n\\<^esub> \\<subseteq> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\" by auto\n      ultimately have \"[?M]\\<^bsub>v,n\\<^esub> = {}\" by blast\n      then have \"\\<not> cyc_free ?M n\" using cyc_free_not_empty[of n ?M v] clock_numbering(1) by auto\n      then obtain i xs where xs: \"i \\<le> n\" \"set xs \\<subseteq> {0..n}\" \"len ?M i i xs < \\<one>\" by auto\n      from this(1,2) canonical_shorten_rotate_neg_cycle[OF M(2) this(2,1,3)] obtain i ys where ys:\n        \"len ?M i i ys < \\<one>\"\n        \"set ys \\<subseteq> {0..n}\" \"successive (\\<lambda>(a, b). ?M a b = M a b) (arcs i i ys)\" \"i \\<le> n\"\n        and distinct: \"distinct ys\" \"i \\<notin> set ys\"\n        and cycle_closes: \"ys \\<noteq> [] \\<longrightarrow> ?M i (hd ys) \\<noteq> M i (hd ys) \\<or> ?M (last ys) i \\<noteq> M (last ys) i\"\n      by fastforce\n      \n      have one_M_aux:\n        \"len ?M i j ys = len M\\<^sub>R i j ys\" if \"\\<forall> (a,b) \\<in> set (arcs i j ys). M a b \\<ge> M\\<^sub>R a b\" for j\n      using that by (induction ys arbitrary: i) (auto simp: min_def)\n      have one_M: \"\\<exists> (a,b) \\<in> set (arcs i i ys). M a b < M\\<^sub>R a b\"\n      proof (rule ccontr, goal_cases)\n        case 1\n        then have \"\\<forall>(a, b)\\<in>set (arcs i i ys). M\\<^sub>R a b \\<le> M a b\" by auto\n        from one_M_aux[OF this] have \"len ?M i i ys = len M\\<^sub>R i i ys\" .\n        with Nil ys(1) xs(3) have \"len M\\<^sub>R i i ys < \\<one>\" by simp\n        from DBM_val_bounded_neg_cycle[OF _ \\<open>i \\<le> n\\<close> \\<open>set ys \\<subseteq> _\\<close> this cn_weak]\n        have \"[M\\<^sub>R]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\n        with \\<open>R \\<noteq> {}\\<close> M\\<^sub>R(1) show False by auto\n      qed\n      have one_M_R_aux:\n        \"len ?M i j ys = len M i j ys\" if \"\\<forall> (a,b) \\<in> set (arcs i j ys). M a b \\<le> M\\<^sub>R a b\" for j\n      using that by (induction ys arbitrary: i) (auto simp: min_def)\n      have one_M_R: \"\\<exists> (a,b) \\<in> set (arcs i i ys). M a b > M\\<^sub>R a b\"\n      proof (rule ccontr, goal_cases)\n        case 1\n        then have \"\\<forall>(a, b)\\<in>set (arcs i i ys). M\\<^sub>R a b \\<ge> M a b\" by auto\n        from one_M_R_aux[OF this] have \"len ?M i i ys = len M i i ys\" .\n        with Nil ys(1) xs(3) have \"len M i i ys < \\<one>\" by simp\n        from DBM_val_bounded_neg_cycle[OF _ \\<open>i \\<le> n\\<close> \\<open>set ys \\<subseteq> _\\<close> this cn_weak]\n        have \"[M]\\<^bsub>v,n\\<^esub> = {}\" unfolding DBM_zone_repr_def by auto\n        with \\<open>Z \\<noteq> {}\\<close> M(1) show False by auto\n      qed\n      \n      have 0: \"(0,0) \\<notin> set (arcs i i ys)\"\n      proof (cases \"ys = []\")\n        case False with distinct show ?thesis using arcs_distinct1 by blast \n      next\n        case True with ys(1) have \"?M i i < \\<one>\" by auto\n        then have \"M i i < \\<one> \\<or> M\\<^sub>R i i < \\<one>\" by (simp add: min_less_iff_disj)\n        from one_M one_M_R True show ?thesis by auto\n      qed\n      \n      { fix a b assume A: \"(a,b) \\<in> set (arcs i i ys)\"\n        assume not0: \"a > 0\"\n        from aux1[OF ys(4,4,2) A] have C2: \"a \\<le> n\" by auto\n        then obtain c1 where C: \"v c1 = a\" \"c1 \\<in> X\"\n        using clock_numbering(2) not0 unfolding v'_def by meson\n        then have \"v' a = c1\" using clock_numbering C2 not0 unfolding v'_def by fastforce\n        with C C2 have \"\\<exists> c \\<in> X. v c = a \\<and> v' a = c\" \"a \\<le> n\" by auto\n      } note clock_dest_1 = this\n      { fix a b assume A: \"(a,b) \\<in> set (arcs i i ys)\"\n        assume not0: \"b > 0\"\n        from aux1[OF ys(4,4,2) A] have C2: \"b \\<le> n\" by auto\n        then obtain c2 where C: \"v c2 = b\" \"c2 \\<in> X\"\n        using clock_numbering(2) not0 unfolding v'_def by meson\n        then have \"v' b = c2\" using clock_numbering C2 not0 unfolding v'_def by fastforce\n        with C C2 have \"\\<exists> c \\<in> X. v c = b \\<and> v' b = c\" \"b \\<le> n\" by auto\n      } note clock_dest_2 = this\n      have clock_dest:\n        \"\\<And> a b. (a,b) \\<in> set (arcs i i ys) \\<Longrightarrow> a > 0 \\<Longrightarrow> b > 0 \\<Longrightarrow>\n          \\<exists> c1 \\<in> X. \\<exists> c2 \\<in> X. v c1 = a \\<and> v c2 = b \\<and> v' a = c1 \\<and> v' b = c2 &&& a \\<le> n &&& b \\<le> n\"\n      using clock_dest_1 clock_dest_2 by (auto) presburger\n      \n      { fix a assume A: \"(a,0) \\<in> set (arcs i i ys)\"\n        assume not0: \"a > 0\"\n        assume bounded: \"M\\<^sub>R a 0 \\<noteq> \\<infinity>\" \n        assume lt: \"M a 0 < M\\<^sub>R a 0\"\n        from clock_dest_1[OF A not0] obtain c1 where C:\n          \"v c1 = a\" \"c1 \\<in> X\" \"v' a = c1\" and C2: \"a \\<le> n\"\n        by blast\n        from C2 not0 bounded M\\<^sub>R(5) obtain d :: int where *:\n          \"d \\<le> int (k (v' a))\"\n          \"M\\<^sub>R a 0 = Le d \\<and> M\\<^sub>R 0 a = Le (- d) \\<or> M\\<^sub>R a 0 = Lt d \\<and> M\\<^sub>R 0 a = Lt (- d + 1)\"\n        unfolding v'_def by auto\n        with C have **: \"d \\<le> int (k c1)\" by auto\n        from *(2) have ?thesis\n        proof (standard, goal_cases)\n          case 1\n          with lt have \"M a 0 < Le d\" by auto\n          then have \"M a 0 \\<le> Lt d\" unfolding less less_eq dbm_le_def by (fastforce elim!: dbm_lt.cases)\n          from dbm_lt'2[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 < d}\"\n          by auto\n          from beta_interp.\\<beta>_boundedness_lt'[OF ** C(2) this] have\n            \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 < d}\"\n          .\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u (Some c1) None (M\\<^sub>R a 0)\" \"dbm_entry_val u None (Some c1) (M\\<^sub>R 0 a)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            then have \"u c1 = d\" using 1 by auto\n            then have \"u \\<notin> {u \\<in> V. u c1 < d}\" by auto\n          }\n          ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n        next\n          case 2\n          from 2 lt have \"M a 0 \\<noteq> \\<infinity>\" by auto\n          with dbm_entry_int[OF this] M(3) \\<open>a \\<le> n\\<close>\n          obtain d' :: int where d': \"M a 0 = Le d' \\<or> M a 0 = Lt d'\" by auto\n          then have \"M a 0 \\<le> Le (d - 1)\" using lt 2\n          apply (auto simp: less_eq dbm_le_def less)\n           apply (cases rule: dbm_lt.cases)\n                 apply auto\n          apply rule\n          apply (cases rule: dbm_lt.cases)\n          by auto\n          with lt have \"M a 0 \\<le> Le (d - 1)\" by auto\n          from dbm_le'2[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 \\<le> d - 1}\"\n          by auto\n          from beta_interp.\\<beta>_boundedness_le'[OF _ C(2) this] ** have\n            \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 \\<le> d - 1}\"\n          by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u None (Some c1) (M\\<^sub>R 0 a)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            then have \"u c1 > d - 1\" using 2 by auto\n            then have \"u \\<notin> {u \\<in> V. u c1 \\<le> d - 1}\" by auto\n          }\n          ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n        qed\n      } note bounded_zero_1 = this\n      \n      { fix a assume A: \"(0,a) \\<in> set (arcs i i ys)\"\n        assume not0: \"a > 0\"\n        assume bounded: \"M\\<^sub>R a 0 \\<noteq> \\<infinity>\" \n        assume lt: \"M 0 a < M\\<^sub>R 0 a\"\n        from clock_dest_2[OF A not0] obtain c1 where C:\n          \"v c1 = a\" \"c1 \\<in> X\" \"v' a = c1\" and C2: \"a \\<le> n\"\n        by blast\n        from C2 not0 bounded M\\<^sub>R(5) obtain d :: int where *:\n          \"d \\<le> int (k (v' a))\"\n          \"M\\<^sub>R a 0 = Le d \\<and> M\\<^sub>R 0 a = Le (- d) \\<or> M\\<^sub>R a 0 = Lt d \\<and> M\\<^sub>R 0 a = Lt (- d + 1)\"\n        unfolding v'_def by auto\n        with C have **: \"- int (k c1) \\<le> - d\" by auto\n        from *(2) have ?thesis\n        proof (standard, goal_cases)\n          case 1\n          with lt have \"M 0 a < Le (-d)\" by auto\n          then have \"M 0 a \\<le> Lt (-d)\" unfolding less less_eq dbm_le_def by (fastforce elim!: dbm_lt.cases)\n          from dbm_lt'3[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. d < u c1}\"\n          by auto\n          from beta_interp.\\<beta>_boundedness_gt'[OF _ C(2) this] ** have\n            \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. - u c1 < -d}\"\n          by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u (Some c1) None (M\\<^sub>R a 0)\" \"dbm_entry_val u None (Some c1) (M\\<^sub>R 0 a)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            with 1 have \"u \\<notin> {u \\<in> V. - u c1 < -d}\" by auto\n          }\n          ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n        next\n          case 2\n          from 2 lt have \"M 0 a \\<noteq> \\<infinity>\" by auto\n          with dbm_entry_int[OF this] M(3) \\<open>a \\<le> n\\<close>\n          obtain d' :: int where d': \"M 0 a = Le d' \\<or> M 0 a = Lt d'\" by auto\n          then have \"M 0 a \\<le> Le (-d)\" using lt 2\n            apply (auto simp: less_eq dbm_le_def less)\n             apply (cases rule: dbm_lt.cases)\n                    apply auto\n             apply rule\n             apply (metis get_const.simps(2) 2 of_int_less_iff of_int_minus zless_add1_eq)\n            apply (cases rule: dbm_lt.cases)\n            apply auto\n            apply (rule dbm_lt.intros(5))\n          by (simp add: int_lt_Suc_le)\n          from dbm_le'3[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. d \\<le> u c1}\"\n          by auto\n          from beta_interp.\\<beta>_boundedness_ge'[OF _ C(2) this] ** have\n            \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. - u c1 \\<le> -d}\"\n          by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u (Some c1) None (M\\<^sub>R a 0)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            with 2 have \"u \\<notin> {u \\<in> V. - u c1 \\<le> -d}\" by auto\n          }\n          ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n        qed\n      } note bounded_zero_2 = this\n      \n      { fix a b c c1 c2 assume A: \"(a,b) \\<in> set (arcs i i ys)\"\n        assume not0: \"a > 0\" \"b > 0\"\n        assume lt: \"M a b = Lt c\"\n        assume neg: \"M a b + M\\<^sub>R b a < \\<one>\"\n        assume C: \"v c1 = a\" \"v c2 = b\" \"c1 \\<in> X\" \"c2 \\<in> X\" and C2: \"a \\<le> n\" \"b \\<le> n\"\n        assume valid: \"-k c2 \\<le> -get_const (M\\<^sub>R b a)\" \"-get_const (M\\<^sub>R b a) \\<le> k c1\"\n        from neg have \"M\\<^sub>R b a \\<noteq> \\<infinity>\" by auto\n        then obtain d where *: \"M\\<^sub>R b a = Le d \\<or> M\\<^sub>R b a = Lt d\" by (cases \"M\\<^sub>R b a\", auto)+\n        with M\\<^sub>R(7) \\<open>_ _ _ \\<noteq> \\<infinity>\\<close> have \"d \\<in> \\<int>\" by fastforce\n        with * obtain d :: int where *: \"M\\<^sub>R b a = Le d \\<or> M\\<^sub>R b a = Lt d\" using Ints_cases by auto \n        with valid have valid: \"- k c2 \\<le> -d\" \"-d \\<le> k c1\" by auto\n        from * neg lt have \"M a b \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n        by (auto elim!: dbm_lt.cases)\n        from dbm_lt'[OF assms(2)[folded M(1)] this C2 C(1,2) not0] have\n          \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 - u c2 < - d}\"\n        .\n        from beta_interp.\\<beta>_boundedness_diag_lt'[OF valid C(3,4) this] have\n          \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 - u c2 < -d}\"\n        .\n        moreover\n        { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n          with C C2 have\n            \"dbm_entry_val u (Some c2) (Some c1) (M\\<^sub>R b a)\"\n          unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n          with * have \"u \\<notin> {u \\<in> V. u c1 - u c2 < -d}\" by auto\n        }\n        ultimately have ?thesis using M\\<^sub>R(1) M(1) by auto\n      } note neg_sum_lt = this\n\n      { fix a b assume A: \"(a,b) \\<in> set (arcs i i ys)\"\n        assume not0: \"a > 0\" \"b > 0\"\n        assume neg: \"M a b + M\\<^sub>R b a < \\<one>\"\n        from clock_dest[OF A not0] obtain c1 c2 where\n          C: \"v c1 = a\" \"v c2 = b\" \"c1 \\<in> X\" \"c2 \\<in> X\" and C2: \"a \\<le> n\" \"b \\<le> n\"\n        by blast\n        then have C3: \"v' a = c1\" \"v' b = c2\" unfolding v'_def using clock_numbering(1) by auto\n        from neg have inf: \"M a b \\<noteq> \\<infinity>\" \"M\\<^sub>R b a \\<noteq> \\<infinity>\" by auto\n        from M\\<^sub>R(8) inf not0 C(3,4) C2 C3 obtain d :: int where d:\n          \"M\\<^sub>R b a = Le d \\<or> M\\<^sub>R b a = Lt d\" \"- int (k c1) \\<le> d\" \"d \\<le> int (k c2)\"\n        unfolding v'_def by auto\n        from inf obtain c where c: \"M a b = Le c \\<or> M a b = Lt c\" by (cases \"M a b\") auto\n        { assume **: \"M a b \\<le> Lt (-d)\"\n          from dbm_lt'[OF assms(2)[folded M(1)] this C2 C(1,2) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 - u c2 < (- d)}\"\n          .\n          from beta_interp.\\<beta>_boundedness_diag_lt'[OF _ _ C(3,4) this] d have\n            \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 - u c2 < -d}\"\n          by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u (Some c2) (Some c1) (M\\<^sub>R b a)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            with d have \"u \\<notin> {u \\<in> V. u c1 - u c2 < -d}\" by auto\n          }\n          ultimately have ?thesis using M\\<^sub>R(1) M(1) by auto\n        } note aux = this\n        from c have ?thesis\n        proof (standard, goal_cases)\n          case 2\n          with neg d have \"M a b \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n          by (auto elim!: dbm_lt.cases)\n          with aux show ?thesis .\n        next\n          case 1\n          note A = this\n          from d(1) show ?thesis\n          proof (standard, goal_cases)\n            case 1\n            with A neg d have \"M a b \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            with aux show ?thesis .\n          next\n            case 2\n            with A neg d have \"M a b \\<le> Le (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            from dbm_le'[OF assms(2)[folded M(1)] this C2 C(1,2) not0] have\n              \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 - u c2 \\<le> - d}\"\n            .\n            from beta_interp.\\<beta>_boundedness_diag_le'[OF _ _ C(3,4) this] d have\n              \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 - u c2 \\<le> -d}\"\n            by auto\n            moreover\n            { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n              with C C2 have\n                \"dbm_entry_val u (Some c2) (Some c1) (M\\<^sub>R b a)\"\n              unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n              with A 2 have \"u \\<notin> {u \\<in> V. u c1 - u c2 \\<le> -d}\" by auto\n            }\n            ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n          qed\n        qed\n      } note neg_sum_1 = this\n\n      { fix a b assume A: \"(a,0) \\<in> set (arcs i i ys)\"\n        assume not0: \"a > 0\"\n        assume neg: \"M a 0 + M\\<^sub>R 0 a < \\<one>\"\n        from clock_dest_1[OF A not0] obtain c1 where C: \"v c1 = a\" \"c1 \\<in> X\" and C2: \"a \\<le> n\" by blast\n        with clock_numbering(1) have C3: \"v' a = c1\" unfolding v'_def by auto\n        from neg have inf: \"M a 0 \\<noteq> \\<infinity>\" \"M\\<^sub>R 0 a \\<noteq> \\<infinity>\" by auto\n        from M\\<^sub>R(6) not0 C2 C3 obtain d :: int where d:\n          \"M\\<^sub>R 0 a = Le d \\<or> M\\<^sub>R 0 a = Lt d\" \"- int (k c1) \\<le> d\" \"d \\<le> 0\"\n        unfolding v'_def by auto\n        from inf obtain c where c: \"M a 0 = Le c \\<or> M a 0 = Lt c\" by (cases \"M a 0\") auto\n        { assume \"M a 0 \\<le> Lt (-d)\"\n          from dbm_lt'2[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 < - d}\"\n          .\n          from beta_interp.\\<beta>_boundedness_lt'[OF _ C(2) this] d have\n            \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 < -d}\"\n          by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u None (Some c1) (M\\<^sub>R 0 a)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            with d have \"u \\<notin> {u \\<in> V. u c1 < -d}\" by auto\n          }\n          ultimately have ?thesis using M\\<^sub>R(1) M(1) by auto\n        } note aux = this\n        from c have ?thesis\n        proof (standard, goal_cases)\n          case 2\n          with neg d have \"M a 0 \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n          by (auto elim!: dbm_lt.cases)\n          with aux show ?thesis .\n        next\n          case 1\n          note A = this\n          from d(1) show ?thesis\n          proof (standard, goal_cases)\n            case 1\n            with A neg d have \"M a 0 \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            with aux show ?thesis .\n          next\n            case 2\n            with A neg d have \"M a 0 \\<le> Le (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            from dbm_le'2[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n              \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 \\<le> - d}\"\n            .\n            from beta_interp.\\<beta>_boundedness_le'[OF _ C(2) this] d have\n              \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 \\<le> -d}\"\n            by auto\n            moreover\n            { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n              with C C2 have\n                \"dbm_entry_val u None (Some c1) (M\\<^sub>R 0 a)\"\n              unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n              with A 2 have \"u \\<notin> {u \\<in> V. u c1 \\<le> -d}\" by auto\n            }\n            ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n          qed\n        qed\n      } note neg_sum_1' = this\n\n      { fix a b assume A: \"(0,b) \\<in> set (arcs i i ys)\"\n        assume not0: \"b > 0\"\n        assume neg: \"M 0 b + M\\<^sub>R b 0 < \\<one>\"\n        from clock_dest_2[OF A not0] obtain c2 where\n          C:  \"v c2 = b\" \"c2 \\<in> X\" and C2: \"b \\<le> n\"\n        by blast\n        with clock_numbering(1) have C3: \"v' b = c2\" unfolding v'_def by auto\n        from neg have \"M 0 b \\<noteq> \\<infinity>\" \"M\\<^sub>R b 0 \\<noteq> \\<infinity>\" by auto\n        with M\\<^sub>R(5) not0 C2 C3 obtain d :: int where d:\n          \"M\\<^sub>R b 0 = Le d \\<or> M\\<^sub>R b 0 = Lt d\" \"d \\<le> k c2\" \n        unfolding v'_def by fastforce\n        from \\<open>M 0 b \\<noteq> \\<infinity>\\<close> obtain c where c: \"M 0 b = Le c \\<or> M 0 b = Lt c\" by (cases \"M 0 b\") auto\n        { assume \"M 0 b \\<le> Lt (-d)\"\n          from dbm_lt'3[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c2 > d}\"\n          by simp\n          from beta_interp.\\<beta>_boundedness_gt'[OF _ C(2) this] d have\n            \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. - u c2 < -d}\"\n          by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u (Some c2) None (M\\<^sub>R b 0)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            with d have \"u \\<notin> {u \\<in> V. - u c2 < -d}\" by auto\n          }\n          ultimately have ?thesis using M\\<^sub>R(1) M(1) by auto\n        } note aux = this\n        from c have ?thesis\n        proof (standard, goal_cases)\n          case 2\n          with neg d have \"M 0 b \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n          by (auto elim!: dbm_lt.cases)\n          with aux show ?thesis .\n        next\n          case A: 1\n          from d(1) show ?thesis\n          proof (standard, goal_cases)\n            case 1\n            with A neg have \"M 0 b \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            with aux show ?thesis .\n          next\n            case 2\n            with A neg c have \"M 0 b \\<le> Le (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            from dbm_le'3[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n              \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c2 \\<ge> d}\"\n            by simp\n            from beta_interp.\\<beta>_boundedness_ge'[OF _ C(2) this] d(2) have\n              \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. - u c2 \\<le> -d}\"\n            by auto\n            moreover\n            { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n              with C C2 have\n                \"dbm_entry_val u (Some c2) None (M\\<^sub>R b 0)\"\n              unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n              with A 2 have \"u \\<notin> {u \\<in> V. - u c2 \\<le> -d}\" by auto\n            }\n            ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n          qed\n        qed\n      } note neg_sum_1'' = this\n\n      { fix a b assume A: \"(a,b) \\<in> set (arcs i i ys)\"\n        assume not0: \"b > 0\" \"a > 0\"\n        assume neg: \"M\\<^sub>R a b + M b a < \\<one>\"\n        from clock_dest[OF A not0(2,1)] obtain c1 c2 where\n          C: \"v c1 = a\" \"v c2 = b\" \"c1 \\<in> X\" \"c2 \\<in> X\" and C2: \"a \\<le> n\" \"b \\<le> n\"\n        by blast\n        then have C3: \"v' a = c1\" \"v' b = c2\" unfolding v'_def using clock_numbering(1) by auto\n        from neg have inf: \"M b a \\<noteq> \\<infinity>\" \"M\\<^sub>R a b \\<noteq> \\<infinity>\" by auto\n        with M\\<^sub>R(8) not0 C(3,4) C2 C3 obtain d :: int where d:\n          \"M\\<^sub>R a b = Le d \\<or> M\\<^sub>R a b = Lt d\" \"d \\<ge> -int (k c2)\" \"d \\<le> int (k c1)\" \n        unfolding v'_def by blast\n        from inf obtain c where c: \"M b a = Le c \\<or> M b a = Lt c\" by (cases \"M b a\") auto\n        { assume \"M b a \\<le> Lt (-d)\"\n          from dbm_lt'[OF assms(2)[folded M(1)] this C2(2,1) C(2,1) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c2 - u c1 < - d}\"\n          .\n          from beta_interp.\\<beta>_boundedness_diag_lt'[OF _ _ C(4,3) this] d\n          have \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c2 - u c1 < -d}\" by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u (Some c1) (Some c2) (M\\<^sub>R a b)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            with d have \"u \\<notin> {u \\<in> V. u c2 - u c1 < -d}\" by auto\n          }\n          ultimately have ?thesis using M\\<^sub>R(1) M(1) by auto\n        } note aux = this\n        from c have ?thesis\n        proof (standard, goal_cases)\n          case 2\n          with neg d have \"M b a \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n          by (auto elim!: dbm_lt.cases)\n          with aux show ?thesis .\n        next\n          case A: 1\n          from d(1) show ?thesis\n          proof (standard, goal_cases)\n            case 1\n            with A neg d have \"M b a \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            with aux show ?thesis .\n          next\n            case 2\n            with A neg d have \"M b a \\<le> Le (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            from dbm_le'[OF assms(2)[folded M(1)] this C2(2,1) C(2,1) not0] have\n              \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c2 - u c1 \\<le> - d}\"\n            .\n            from beta_interp.\\<beta>_boundedness_diag_le'[OF _ _ C(4,3) this] d\n            have \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c2 - u c1 \\<le> -d}\" by auto\n            moreover\n            { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n              with C C2 have\n                \"dbm_entry_val u (Some c1) (Some c2) (M\\<^sub>R a b)\"\n              unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n              with A 2 have \"u \\<notin> {u \\<in> V. u c2 - u c1 \\<le> -d}\" by auto\n            }\n            ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n          qed\n        qed\n      } note neg_sum_2 = this\n\n      { fix a b assume A: \"(a,0) \\<in> set (arcs i i ys)\"\n        assume not0: \"a > 0\"\n        assume neg: \"M\\<^sub>R a 0 + M 0 a < \\<one>\"\n        from clock_dest_1[OF A not0] obtain c1 where C: \"v c1 = a\" \"c1 \\<in> X\" and C2: \"a \\<le> n\" by blast\n        with clock_numbering(1) have C3: \"v' a = c1\" unfolding v'_def by auto\n        from neg have inf: \"M 0 a \\<noteq> \\<infinity>\" \"M\\<^sub>R a 0 \\<noteq> \\<infinity>\" by auto\n        with M\\<^sub>R(5) not0 C2 C3 obtain d :: int where d:\n          \"M\\<^sub>R a 0 = Le d \\<or> M\\<^sub>R a 0 = Lt d\" \"d \\<le> int (k c1)\" \"d \\<ge> 0\"\n        unfolding v'_def by auto\n        from inf obtain c where c: \"M 0 a = Le c \\<or> M 0 a = Lt c\" by (cases \"M 0 a\") auto\n        { assume \"M 0 a \\<le> Lt (-d)\"\n          from dbm_lt'3[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 > d}\"\n          by simp\n          from beta_interp.\\<beta>_boundedness_gt'[OF _ C(2) this] d have\n            \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 > d}\"\n          by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u (Some c1) None (M\\<^sub>R a 0)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            with d have \"u \\<notin> {u \\<in> V. u c1 > d}\" by auto\n          }\n          ultimately have ?thesis using M\\<^sub>R(1) M(1) by auto\n        } note aux = this\n        from c have ?thesis\n        proof (standard, goal_cases)\n          case 2\n          with neg d have \"M 0 a \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n          by (auto elim!: dbm_lt.cases)\n          with aux show ?thesis .\n        next\n          case A: 1\n          from d(1) show ?thesis\n          proof (standard, goal_cases)\n            case 1\n            with A neg d have \"M 0 a \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            with aux show ?thesis .\n          next\n            case 2\n            with A neg d have \"M 0 a \\<le> Le (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            from dbm_le'3[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n              \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 \\<ge> d}\"\n            by simp\n            from beta_interp.\\<beta>_boundedness_ge'[OF _ C(2) this] d have\n              \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 \\<ge> d}\"\n            by auto\n            moreover\n            { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n              with C C2 have\n                \"dbm_entry_val u (Some c1) None (M\\<^sub>R a 0)\"\n              unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n              with A 2 have \"u \\<notin> {u \\<in> V. u c1 \\<ge> d}\" by auto\n            }\n            ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n          qed\n        qed\n      } note neg_sum_2' = this\n\n      { fix a b assume A: \"(0,b) \\<in> set (arcs i i ys)\"\n        assume not0: \"b > 0\"\n        assume neg: \"M\\<^sub>R 0 b + M b 0 < \\<one>\"\n        from clock_dest_2[OF A not0] obtain c2 where\n          C:  \"v c2 = b\" \"c2 \\<in> X\" and C2: \"b \\<le> n\"\n        by blast\n        with clock_numbering(1) have C3: \"v' b = c2\" unfolding v'_def by auto\n        from neg have \"M b 0 \\<noteq> \\<infinity>\" \"M\\<^sub>R 0 b \\<noteq> \\<infinity>\" by auto\n        with M\\<^sub>R(6) not0 C2 C3 obtain d :: int where d:\n          \"M\\<^sub>R 0 b = Le d \\<or> M\\<^sub>R 0 b = Lt d\" \"-d \\<le> k c2\" \n        unfolding v'_def by fastforce\n        from \\<open>M b 0 \\<noteq> \\<infinity>\\<close> obtain c where c: \"M b 0 = Le c \\<or> M b 0 = Lt c\" by (cases \"M b 0\") auto\n        { assume \"M b 0 \\<le> Lt (-d)\"\n          from dbm_lt'2[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c2 < - d}\"\n          by simp\n          from beta_interp.\\<beta>_boundedness_lt'[OF _ C(2) this] d have\n            \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c2 < -d}\"\n          by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u None (Some c2) (M\\<^sub>R 0 b)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            with d have \"u \\<notin> {u \\<in> V. u c2 < -d}\" by auto\n          }\n          ultimately have ?thesis using M\\<^sub>R(1) M(1) by auto\n        } note aux = this\n        from c have ?thesis\n        proof (standard, goal_cases)\n          case 2\n          with neg d have \"M b 0 \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n          by (auto elim!: dbm_lt.cases)\n          with aux show ?thesis .\n        next\n          case 1\n          note A = this\n          from d(1) show ?thesis\n          proof (standard, goal_cases)\n            case 1\n            with A neg have \"M b 0 \\<le> Lt (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            with aux show ?thesis .\n          next\n            case 2\n            with A neg c have \"M b 0 \\<le> Le (-d)\" unfolding less_eq dbm_le_def mult neutral less\n            by (auto elim!: dbm_lt.cases)\n            from dbm_le'2[OF assms(2)[folded M(1)] this C2 C(1) not0] have\n              \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c2 \\<le> - d}\"\n            by simp\n            from beta_interp.\\<beta>_boundedness_le'[OF _ C(2) this] d(2) have\n              \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c2 \\<le> -d}\"\n            by auto\n            moreover\n            { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n              with C C2 have\n                \"dbm_entry_val u None (Some c2) (M\\<^sub>R 0 b)\"\n              unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n              with A 2 have \"u \\<notin> {u \\<in> V. u c2 \\<le> -d}\" by auto\n            }\n            ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n          qed\n        qed\n      } note neg_sum_2'' = this\n\n      { fix a b assume A: \"(a,b) \\<in> set (arcs i i ys)\"\n        assume not0: \"a > 0\" \"b > 0\"\n        assume bounded: \"M\\<^sub>R a 0 \\<noteq> \\<infinity>\" \"M\\<^sub>R b 0 \\<noteq> \\<infinity>\"\n        assume lt: \"M a b < M\\<^sub>R a b\"\n        from clock_dest[OF A not0] obtain c1 c2 where\n          C: \"v c1 = a\" \"v c2 = b\" \"c1 \\<in> X\" \"c2 \\<in> X\" and C2: \"a \\<le> n\" \"b \\<le> n\"\n        by blast\n        from C C2 clock_numbering(1,3) have C3: \"v' b = c2\" \"v' a = c1\" unfolding v'_def by blast+\n        with C C2 not0 bounded M\\<^sub>R(4) obtain d :: int where *:\n          \"- int (k c2) \\<le> d \\<and> d \\<le> int (k c1) \\<and> M\\<^sub>R a b = Le d \\<and> M\\<^sub>R b a = Le (- d)\n         \\<or> - int (k c2) \\<le> d - 1 \\<and> d \\<le> int (k c1) \\<and> M\\<^sub>R a b = Lt d \\<and> M\\<^sub>R b a = Lt (- d + 1)\"\n        unfolding v'_def by force\n        from * have ?thesis\n        proof (standard, goal_cases)\n          case 1\n          with lt have \"M a b < Le d\" by auto\n          then have \"M a b \\<le> Lt d\" unfolding less less_eq dbm_le_def by (fastforce elim!: dbm_lt.cases)\n          from dbm_lt'[OF assms(2)[folded M(1)] this C2 C(1,2) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 - u c2 < d}\"\n          .\n          from beta_interp.\\<beta>_boundedness_diag_lt'[OF _ _ C(3,4) this] 1\n          have \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 - u c2 < d}\" by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u (Some c1) (Some c2) (M\\<^sub>R a b)\" \"dbm_entry_val u (Some c2) (Some c1) (M\\<^sub>R b a)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            with 1 have \"u \\<notin> {u \\<in> V. u c1 - u c2 < d}\" by auto\n          }\n          ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n        next\n          case 2\n          with lt have \"M a b \\<noteq> \\<infinity>\" by auto\n          with dbm_entry_int[OF this] M(3) \\<open>a \\<le> n\\<close> \\<open>b \\<le> n\\<close>\n          obtain d' :: int where d': \"M a b = Le d' \\<or> M a b = Lt d'\" by auto\n          then have \"M a b \\<le> Le (d - 1)\" using lt 2\n           apply (auto simp: less_eq dbm_le_def less)\n            apply (cases rule: dbm_lt.cases)\n                 apply auto\n           apply (rule dbm_lt.intros)\n           apply (cases rule: dbm_lt.cases)\n          by auto\n          with lt have \"M a b \\<le> Le (d - 1)\" by auto\n          from dbm_le'[OF assms(2)[folded M(1)] this C2 C(1,2) not0] have\n            \"[M]\\<^bsub>v,n\\<^esub> \\<subseteq> {u \\<in> V. u c1 - u c2 \\<le> d - 1}\"\n          .\n          from beta_interp.\\<beta>_boundedness_diag_le'[OF _ _ C(3,4) this] 2\n          have \"Approx\\<^sub>\\<beta> ([M]\\<^bsub>v,n\\<^esub>) \\<subseteq> {u \\<in> V. u c1 - u c2 \\<le> d - 1}\" by auto\n          moreover\n          { fix u assume u: \"u \\<in> [M\\<^sub>R]\\<^bsub>v,n\\<^esub>\"\n            with C C2 have\n              \"dbm_entry_val u (Some c2) (Some c1) (M\\<^sub>R b a)\"\n            unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n            with 2 have \"u \\<notin> {u \\<in> V. u c1 - u c2 \\<le> d - 1}\" by auto\n          }\n          ultimately show ?thesis using M\\<^sub>R(1) M(1) by auto\n        qed\n      } note bounded = this\n\n      { assume not_bounded: \"\\<forall> (a,b) \\<in> set (arcs i i ys). M a b < M\\<^sub>R a b \\<longrightarrow> M\\<^sub>R a 0 = \\<infinity> \\<or> M\\<^sub>R b 0 = \\<infinity>\"\n        have \"\\<exists> y z zs. set zs \\<union> {0, y, z} = set (i # ys) \\<and> len ?M 0 0 (y # z # zs) < Le 0 \\<and> \n                    (\\<forall> (a,b) \\<in> set (arcs 0 0 (y # z # zs)). M a b < M\\<^sub>R a b \\<longrightarrow> a = y \\<and> b = z)\n                    \\<and> M y z < M\\<^sub>R y z \\<and> distinct (0 # y # z # zs) \\<or> ?thesis\"\n        proof (cases ys)\n          case Nil\n          show ?thesis\n          proof (cases \"M i i < M\\<^sub>R i i\")\n            case True\n            then have \"?M i i = M i i\" by (simp add: min.strict_order_iff)\n            with Nil ys(1) xs(3) have *: \"M i i < \\<one>\" by simp\n            with neg_cycle_empty[OF cn_weak _ \\<open>i \\<le> n\\<close>, of \"[]\" M] have \"[M]\\<^bsub>v,n\\<^esub> = {}\" by auto\n            with \\<open>Z \\<noteq> {}\\<close> M(1) show ?thesis by auto\n          next\n            case False\n            then have \"?M i i = M\\<^sub>R i i\" by (simp add: min_absorb2) \n            with Nil ys(1) xs(3) have \"M\\<^sub>R i i < \\<one>\" by simp\n            with neg_cycle_empty[OF cn_weak _ \\<open>i \\<le> n\\<close>, of \"[]\" M\\<^sub>R] have \"[M\\<^sub>R]\\<^bsub>v,n\\<^esub> = {}\" by auto\n            with \\<open>R \\<noteq> {}\\<close> M\\<^sub>R(1) show ?thesis by auto\n          qed\n        next\n          case (Cons w ws)\n          note ws = this\n          show ?thesis\n          proof (cases ws)\n            case Nil\n            with ws ys xs(3) have *:\n              \"?M i w + ?M w i < \\<one>\" \"?M w i = M w i \\<longrightarrow> ?M i w \\<noteq> M i w\" \"(i, w) \\<in> set (arcs i i ys)\"\n            by auto\n            have \"R \\<inter> Approx\\<^sub>\\<beta> Z = {}\"\n            proof (cases \"?M w i = M w i\")\n              case True\n              with *(2) have \"?M i w = M\\<^sub>R i w\" unfolding min_def by auto\n              with *(1) True have neg: \"M\\<^sub>R i w + M w i < \\<one>\" by auto\n              show ?thesis\n              proof (cases \"i = 0\")\n                case True\n                show ?thesis\n                proof (cases \"w = 0\")\n                  case True with 0 \\<open>i = 0\\<close> *(3) show ?thesis by auto\n                next\n                  case False with \\<open>i = 0\\<close> neg_sum_2'' *(3) neg show ?thesis by blast\n                qed\n              next\n                case False\n                show ?thesis\n                proof (cases \"w = 0\")\n                  case True with \\<open>i \\<noteq> 0\\<close> neg_sum_2' *(3) neg show ?thesis by blast\n                next\n                  case False with \\<open>i \\<noteq> 0\\<close> neg_sum_2 *(3) neg show ?thesis by blast\n                qed\n              qed\n            next\n              case False\n              have \"M\\<^sub>R w i < M w i\"\n              proof (rule ccontr, goal_cases)\n                case 1\n                then have \"M\\<^sub>R w i \\<ge> M w i\" by auto\n                with False show False unfolding min_def by auto\n              qed\n              with one_M ws Nil have \"M i w < M\\<^sub>R i w\" by auto\n              then have \"?M i w = M i w\" unfolding min_def by auto\n              moreover from False *(2) have \"?M w i = M\\<^sub>R w i\" unfolding min_def by auto\n              ultimately have neg: \"M i w + M\\<^sub>R w i < \\<one>\" using *(1) by auto\n              show ?thesis\n              proof (cases \"i = 0\")\n                case True\n                show ?thesis\n                proof (cases \"w = 0\")\n                  case True with 0 \\<open>i = 0\\<close> *(3) show ?thesis by auto\n                next\n                  case False with \\<open>i = 0\\<close> neg_sum_1'' *(3) neg show ?thesis by blast\n                qed\n              next\n                case False\n                show ?thesis\n                proof (cases \"w = 0\")\n                  case True with \\<open>i \\<noteq> 0\\<close> neg_sum_1' *(3) neg show ?thesis by blast\n                next\n                  case False with \\<open>i \\<noteq> 0\\<close> neg_sum_1 *(3) neg show ?thesis by blast\n                qed\n              qed\n            qed\n            then show ?thesis by simp\n          next\n            case zs: (Cons z zs)\n            from one_M obtain a b where *:\n              \"(a,b) \\<in> set (arcs i i ys)\" \"M a b < M\\<^sub>R a b\"\n            by fastforce\n            from cycle_rotate_3'[OF _ *(1) ys(3)] ws cycle_closes obtain ws' where ws':\n              \"len ?M i i ys = len ?M a a (b # ws')\" \"set (a # b # ws') = set (i # ys)\"\n              \"1 + length ws' = length ys\" \"set (arcs i i ys) = set (arcs a a (b # ws'))\"\n              and successive: \"successive (\\<lambda>(a, b). ?M a b = M a b) (arcs a a (b # ws') @ [(a, b)])\"\n            by blast\n            from successive have successive_arcs:\n              \"successive (\\<lambda>(a, b). ?M a b = M a b) (arcs a b (b # ws' @ [a]))\"\n            using arcs_decomp_tail by auto\n            from ws'(4) one_M_R *(2) obtain c d where **:\n              \"(c,d) \\<in> set (arcs a a (b # ws'))\" \"M c d > M\\<^sub>R c d\" \"(a,b) \\<noteq> (c,d)\"\n            by fastforce\n            from card_distinct[of \"a # b # ws'\"] distinct_card[of \"i # ys\"] ws'(2,3) distinct\n            have distinct: \"distinct (a # b # ws')\" by simp\n            from ws zs ws'(3) have \"ws' \\<noteq> []\" by auto\n            then obtain z zs where z: \"ws' = zs @ [z]\" by (metis append_butlast_last_id)\n            then have \"b # ws' = (b # zs) @ [z]\" by simp\n            with len_decomp[OF this, of ?M a a] arcs_decomp_tail have rotated:\n              \"len ?M a a (b # ws') = len ?M z z (a # b # zs)\"\n              \"set (arcs a a (b # ws')) = set (arcs z z (a # b # zs))\"\n            by (auto simp add: comm)\n            from ys(1) xs(3) ws'(1) have \"len ?M a a (b # ws') < \\<one>\" by auto\n            from ws'(2) ys(2) \\<open>i \\<le> n\\<close> z have n_bounds: \"a \\<le> n\" \"b \\<le> n\" \"set ws' \\<subseteq> {0..n}\" \"z \\<le> n\" by auto\n            from * have a_b: \"?M a b = M a b\" by (simp add: min.strict_order_iff)\n            from successive successive_split[of _ \"arcs a z (b # zs)\" \"[(z,a), (a,b)]\"]\n            have first: \"successive (\\<lambda>(a, b). ?M a b = M a b) (arcs a z (b # zs))\" and\n                 last_two: \"successive (\\<lambda>(a, b). ?M a b = M a b) [(z, a), (a, b)]\"\n            using arcs_decomp_tail z by auto\n            from * not_bounded have not_bounded': \"M\\<^sub>R a 0 = \\<infinity> \\<or> M\\<^sub>R b 0 = \\<infinity>\" by auto\n            from this(1) have \"z = 0\"\n            proof\n              assume inf: \"M\\<^sub>R b 0 = \\<infinity>\"\n              from a_b successive obtain z where z: \"(b,z) \\<in> set (arcs b a ws')\" \"?M b z \\<noteq> M b z\"\n              by (cases ws') auto\n              then have \"?M b z = M\\<^sub>R b z\" by (meson min_def)\n              from arcs_distinct2[OF _ _ _ _ z(1)] distinct have \"b \\<noteq> z\" by auto\n              from z n_bounds have \"z \\<le> n\"\n                apply (induction ws' arbitrary: b)\n                 apply auto[]\n                 apply (rename_tac ws' b)\n                apply (case_tac ws')\n                 apply auto\n              done\n              have \"M\\<^sub>R b z = \\<infinity>\"\n              proof (cases \"z = 0\")\n                case True\n                with inf show ?thesis by auto\n              next\n                case False\n                with inf M\\<^sub>R(2) \\<open>b \\<noteq> z\\<close> \\<open>z \\<le> n\\<close> \\<open>b \\<le> n\\<close> show ?thesis by blast\n              qed\n              with \\<open>?M b z = M\\<^sub>R b z\\<close> have \"len ?M b a ws' = \\<infinity>\" by (auto intro: len_inf_elem[OF z(1)])\n              then have \"\\<infinity> = len ?M a a (b # ws')\" by simp\n              with \\<open>len ?M a a _ < \\<one>\\<close> show ?thesis by auto\n            next\n              assume inf: \"M\\<^sub>R a 0 = \\<infinity>\"\n              show \"z = 0\"\n              proof (rule ccontr)\n                assume \"z \\<noteq> 0\"\n                with last_two a_b have \"?M z a = M\\<^sub>R z a\" by (auto simp: min_def)\n                from distinct z have \"a \\<noteq> z\" by auto\n                with \\<open>z \\<noteq> 0\\<close> \\<open>a \\<le> n\\<close> \\<open>z \\<le> n\\<close> M\\<^sub>R(2) inf have \"M\\<^sub>R z a = \\<infinity>\" by blast\n                with \\<open>?M z a = M\\<^sub>R z a\\<close> have \"len ?M z z (a # b # zs) = \\<infinity>\" by (auto intro: len_inf_elem)\n                with \\<open>len ?M a a _ < \\<one>\\<close> rotated show False by auto\n              qed\n            qed\n            { fix c d assume A: \"(c, d) \\<in> set (arcs 0 0 (a # b # zs))\" \"M c d < M\\<^sub>R c d\"\n              then have *: \"?M c d = M c d\" by (simp add: min.strict_order_iff)\n              from rotated(2) A \\<open>z = 0\\<close> not_bounded ws'(4) have **: \"M\\<^sub>R c 0 = \\<infinity> \\<or> M\\<^sub>R d 0 = \\<infinity>\" by auto\n              { assume inf: \"M\\<^sub>R c 0 = \\<infinity>\"\n                fix x assume x: \"(x, c) \\<in> set (arcs a 0 (b # zs))\" \"?M x c \\<noteq> M x c\"\n                from x(2) have \"?M x c = M\\<^sub>R x c\" unfolding min_def by auto\n                from arcs_elem[OF x(1)] z \\<open>z = 0\\<close> have\n                  \"x \\<in> set (a # b # ws')\" \"c \\<in> set (a # b # ws')\"\n                by auto\n                with n_bounds have \"x \\<le> n\" \"c \\<le> n\" by auto\n                have \"x = 0\"\n                proof (rule ccontr)\n                  assume \"x \\<noteq> 0\"\n                  from distinct z arcs_distinct1[OF _ _ _ _ x(1)] \\<open>z = 0\\<close>have \"x \\<noteq> c\" by auto\n                  with \\<open>x \\<noteq> 0\\<close> \\<open>c \\<le> n\\<close> \\<open>x \\<le> n\\<close> M\\<^sub>R(2) inf have \"M\\<^sub>R x c = \\<infinity>\" by blast\n                  with \\<open>?M x c = M\\<^sub>R x c\\<close> have\n                    \"len ?M a 0 (b # zs) = \\<infinity>\"\n                  by (fastforce intro: len_inf_elem[OF x(1)])\n                  with \\<open>z = 0\\<close> have \"len ?M z z (a # b # zs) = \\<infinity>\" by auto\n                  with \\<open>len ?M a a _ < \\<one>\\<close> rotated show False by auto\n                qed\n                with arcs_distinct_dest1[OF _ x(1), of z] z distinct x \\<open>z = 0\\<close> have False by auto\n              } note c_0_inf = this\n              have \"a = c \\<and> b = d\"\n              proof (cases \"(c, d) = (0, a)\")\n                case True\n                with last_two \\<open>z = 0\\<close> * a_b have False by auto\n                then show ?thesis by simp\n              next\n                case False\n                show ?thesis\n                proof (rule ccontr, goal_cases)\n                  case 1\n                  with False A(1) have ***: \"(c, d) \\<in> set (arcs b 0 zs)\" by auto\n                  from successive z \\<open>z = 0\\<close> have\n                    \"successive (\\<lambda>(a, b). ?M a b = M a b) ([(a, b)] @ arcs b 0 zs @ [(0, a), (a, b)])\"\n                  by (simp add: arcs_decomp)\n                  then have ****: \"successive (\\<lambda>(a, b). ?M a b = M a b) (arcs b 0 zs)\"\n                  using successive_split[of _ \"[(a, b)]\" \"arcs b 0 zs @ [(0, a), (a, b)]\"]\n                        successive_split[of _ \"arcs b 0 zs\" \"[(0, a), (a, b)]\"]\n                  by auto\n                  from successive_predecessor[OF *** _ this] successive z\n                  obtain x where x: \"(x, c) \\<in> set (arcs a 0 (b # zs))\" \"?M x c \\<noteq> M x c\"\n                  proof (cases \"c = b\")\n                    case False\n                    then have \"zs \\<noteq> []\" using *** by auto\n                    from successive_predecessor[OF *** False **** _ this] * obtain x where x:\n                      \"(zs = [c] \\<and> x = b \\<or> (\\<exists>ys. zs = c # d # ys \\<and> x = b)\n                        \\<or> (\\<exists>ys. zs = ys @ [x, c] \\<and> d = 0) \\<or> (\\<exists>ys ws. zs = ys @ x # c # d # ws))\"\n                      \"?M x c \\<noteq> M x c\"\n                    by blast+\n                    from this(1) have \"(x, c) \\<in> set (arcs a 0 (b # zs))\" using arcs_decomp by auto\n                    with x(2) show ?thesis by (auto intro: that)\n                  next\n                    case True\n                    have ****: \"successive (\\<lambda>(a, b). ?M a b = M a b) (arcs a 0 (b # zs))\"\n                    using first \\<open>z = 0\\<close> arcs_decomp successive_arcs z by auto \n                    show ?thesis\n                    proof (cases zs)\n                      case Nil\n                      with **** True *** * show ?thesis by (auto intro: that)\n                    next\n                      case (Cons u us)\n                      with *** True distinct z \\<open>z = 0\\<close> have \"distinct (b # u # us @ [0])\" by auto\n                      from arcs_distinct_fix[OF this] *** True Cons have \"d = u\" by auto\n                      with **** * Cons True show ?thesis by (auto intro: that)\n                    qed\n                  qed\n                  show False\n                  proof (cases \"d = 0\")\n                    case True\n                    from ** show False\n                    proof\n                      assume \"M\\<^sub>R c 0 = \\<infinity>\" from c_0_inf[OF this x] show False .\n                    next\n                      assume \"M\\<^sub>R d 0 = \\<infinity>\" with \\<open>d = 0\\<close> M\\<^sub>R(3) show False by auto\n                    qed\n                  next\n                    case False with *** have \"zs \\<noteq> []\" by auto\n                    from successive_successor[OF \\<open>(c,d) \\<in> set (arcs b 0 zs)\\<close> False **** _ this] *\n                    obtain e where\n                      \"(zs = [d] \\<and> e = 0 \\<or> (\\<exists>ys. zs = d # e # ys) \\<or> (\\<exists>ys. zs = ys @ [c, d] \\<and> e = 0)\n                        \\<or> (\\<exists>ys ws. zs = ys @ c # d # e # ws))\" \"?M d e \\<noteq> M d e\"\n                    by blast\n                    then have e: \"(d, e) \\<in> set (arcs b 0 zs)\" \"?M d e \\<noteq> M d e\" using arcs_decomp by auto\n                    from ** show False\n                    proof\n                      assume inf: \"M\\<^sub>R d 0 = \\<infinity>\"\n                      from e have \"?M d e = M\\<^sub>R d e\" by (meson min_def)\n                      from arcs_distinct2[OF _ _ _ _ e(1)] z \\<open>z = 0\\<close> distinct have \"d \\<noteq> e\" by auto\n                      from z n_bounds have \"set zs \\<subseteq> {0..n}\" by auto\n                      with e have \"e \\<le> n\"\n                        apply (induction zs arbitrary: d)\n                         apply auto\n                        apply (case_tac zs)\n                         apply auto\n                      done\n                      from n_bounds z arcs_elem(2)[OF A(1)] have \"d \\<le> n\" by auto\n                      have \"M\\<^sub>R d e = \\<infinity>\"\n                      proof (cases \"e = 0\")\n                        case True\n                        with inf show ?thesis by auto\n                      next\n                        case False\n                        with inf M\\<^sub>R(2) \\<open>d \\<noteq> e\\<close> \\<open>e \\<le> n\\<close> \\<open>d \\<le> n\\<close> show ?thesis by blast\n                      qed\n                      with \\<open>?M d e = M\\<^sub>R d e\\<close> have \"len ?M b 0 zs = \\<infinity>\" by (auto intro: len_inf_elem[OF e(1)])\n                      with \\<open>z = 0\\<close> rotated have \"\\<infinity> = len ?M a a (b # ws')\" by simp\n                      with \\<open>len ?M a a _ < \\<one>\\<close> show ?thesis by auto\n                    next\n                      assume \"M\\<^sub>R c 0 = \\<infinity>\" from c_0_inf[OF this x] show False .\n                    qed\n                  qed\n                qed\n              qed\n            }\n            then have \"\\<forall>(c, d)\\<in>set (arcs 0 0 (a # b # zs)). M c d < M\\<^sub>R c d \\<longrightarrow> c = a \\<and> d = b\"\n            by blast\n            moreover from ys(1) xs(3) have \"len ?M i i ys < Le 0\" unfolding neutral by auto\n            moreover with rotated ws'(1) have \"len ?M z z (a # b # zs) < Le 0\" by auto\n            moreover from \\<open>z = 0\\<close> z ws'(2) have \"set zs \\<union> {0, a, b} = set (i # ys)\" by auto\n            moreover from \\<open>z = 0\\<close> distinct z have \"distinct (0 # a # b # zs)\" by auto\n            ultimately show ?thesis using \\<open>z = 0\\<close> \\<open>M a b < M\\<^sub>R a b\\<close> by blast\n          qed\n        qed note * = this\n        { assume \"\\<not> ?thesis\"\n          with * obtain y z zs where *:\n            \"set zs \\<union> {0, y, z} = set (i # ys)\" \"len ?M 0 0 (y # z # zs) < Le 0\"\n            \"\\<forall>(a, b)\\<in>set (arcs 0 0 (y # z # zs)). M a b < M\\<^sub>R a b \\<longrightarrow> a = y \\<and> b = z\" \"M y z < M\\<^sub>R y z\"\n            and distinct': \"distinct (0 # y # z # zs)\"\n          by blast\n          then have \"y \\<noteq> 0\" \"z \\<noteq> 0\" by auto\n          let ?r = \"len M\\<^sub>R z 0 zs\"\n          have \"\\<forall>(a, b)\\<in>set (arcs z 0 zs). ?M a b = M\\<^sub>R a b\"\n          proof (safe, goal_cases)\n            case A: (1 a b)\n            have \"M\\<^sub>R a b \\<le> M a b\"\n            proof (rule ccontr, goal_cases)\n              case 1\n              with *(3) A have \"a = y\" \"b = z\" by auto\n              with A distinct' arcs_distinct3[OF _ A, of y] show False by auto\n            qed\n            then show ?case by (simp add: min_def)\n          qed\n          then have r: \"len ?M z 0 zs = ?r\" by (induction zs arbitrary: z) auto\n          with *(2) have **: \"?M 0 y + (?M y z + ?r) < Le 0\" by simp\n          from M\\<^sub>R(1) \\<open>R \\<noteq> {}\\<close> obtain u where u: \"DBM_val_bounded v u M\\<^sub>R n\"\n          unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n          from *(1) \\<open>i \\<le> n\\<close> \\<open>set ys \\<subseteq> _\\<close> have \"y \\<le> n\" \"z \\<le> n\" by fastforce+\n          from *(1) ys(2,4) have \"set zs \\<subseteq> {0 ..n}\" by auto\n          from \\<open>y \\<le> n\\<close> \\<open>z \\<le> n\\<close> clock_numbering(2) \\<open>y \\<noteq> 0\\<close> \\<open>z \\<noteq> 0\\<close> obtain c1 c2 where C:\n            \"c1 \\<in> X\" \"c2 \\<in> X\" \"v c1 = y\" \"v c2 = z\"\n          by blast+\n          with clock_numbering(1,3) have C2: \"v' y = c1\" \"v' z = c2\" unfolding v'_def by auto\n          with C have \"v (v' z) = z\" by auto\n          with DBM_val_bounded_len'1[OF u, of zs \"v' z\"] have \"dbm_entry_val u (Some (v' z)) None ?r\"\n          using \\<open>z \\<le> n\\<close> clock_numbering(2) \\<open>set zs \\<subseteq> _\\<close> distinct' by force\n          from len_inf_elem ** have tl_not_inf: \"\\<forall>(a, b)\\<in>set (arcs z 0 zs). M\\<^sub>R a b \\<noteq> \\<infinity>\" by fastforce\n          with M\\<^sub>R(7) len_int_dbm_closed have \"get_const ?r \\<in> \\<int> \\<and> ?r \\<noteq> \\<infinity>\" by blast\n          then obtain r :: int where r': \"?r = Le r \\<or> ?r = Lt r\" using Ints_cases by (cases ?r) auto\n          from r' \\<open>dbm_entry_val _ _ _ _\\<close> C C2 have le: \"u (v' z) \\<le> r\" by fastforce\n          from arcs_ex_head obtain z' where \"(z, z') \\<in> set (arcs z 0 zs)\" by blast\n          then have z':\n            \"(z, z') \\<in> set (arcs 0 0 (y # z # zs))\" \"(z, z') \\<in> set (arcs z 0 zs)\"\n          by auto\n          have \"M\\<^sub>R z 0 \\<noteq> \\<infinity>\"\n          proof (rule ccontr, goal_cases)\n            case 1\n            then have inf: \"M\\<^sub>R z 0 = \\<infinity>\" by auto\n            have \"M\\<^sub>R z z' = \\<infinity>\"\n            proof (cases \"z' = 0\")\n              case True\n              with 1 show ?thesis by auto\n            next\n              case False\n              from arcs_elem[OF z'(1)] *(1) \\<open>i \\<le> n\\<close> \\<open>set ys \\<subseteq> _\\<close> have \"z' \\<le> n\" by fastforce\n              moreover from distinct' *(1) arcs_distinct1[OF _ _ _ _ z'(1)] have \"z \\<noteq> z'\" by auto\n              ultimately show ?thesis using M\\<^sub>R(2) \\<open>z \\<le> n\\<close> False inf by blast\n            qed\n            with tl_not_inf z'(2) show False by auto\n          qed\n          with M\\<^sub>R(5) \\<open>z \\<noteq> 0\\<close> \\<open>z \\<le> n\\<close> obtain d :: int where d:\n            \"M\\<^sub>R z 0 = Le d \\<and> M\\<^sub>R 0 z = Le (-d) \\<or> M\\<^sub>R z 0 = Lt d \\<and> M\\<^sub>R 0 z = Lt (-d + 1)\"\n            \"d \\<le> k (v' z)\" \"0 \\<le> d\"\n          unfolding v'_def by auto\n          text \\<open>Needs property that len of integral dbm entries is integral and definition of \\<open>M_R\\<close>\\<close>\n          from this (1) have rr: \"?r \\<ge> M\\<^sub>R z 0\"\n          proof (standard, goal_cases)\n            case A: 1\n            with u \\<open>z \\<le> n\\<close> C C2 have *: \"- u (v' z) \\<le> -d\" unfolding DBM_val_bounded_def by fastforce\n            from r' show ?case\n            proof (standard, goal_cases)\n              case 1\n              with le * A show ?case unfolding less_eq dbm_le_def by fastforce\n            next\n              case 2\n              with \\<open>dbm_entry_val _ _ _ _\\<close> C C2 have \"u (v' z) < r\" by fastforce\n              with * have \"r > d\" by auto\n              with A 2 show ?case unfolding less_eq dbm_le_def by fastforce\n            qed\n          next\n            case A: 2\n            with u \\<open>z \\<le> n\\<close> C C2 have *: \"- u (v' z) < -d + 1\" unfolding DBM_val_bounded_def by fastforce\n            from r' show ?case\n            proof (standard, goal_cases)\n              case 1\n              with le * A show ?case unfolding less_eq dbm_le_def by fastforce\n            next\n              case 2\n              with \\<open>dbm_entry_val _ _ _ _\\<close> C C2 have \"u (v' z) \\<le> r\" by fastforce\n              with * have \"r \\<ge> d\" by auto\n              with A 2 show ?case unfolding less_eq dbm_le_def by fastforce\n            qed\n          qed\n          with *(3) \\<open>y \\<noteq> 0\\<close> have \"M 0 y \\<ge> M\\<^sub>R 0 y\" by fastforce\n          then have \"?M 0 y = M\\<^sub>R 0 y\" by (simp add: min.absorb2)\n          moreover from *(4) have \"?M y z = M y z\" unfolding min_def by auto\n          ultimately have **: \"M\\<^sub>R 0 y + (M y z + M\\<^sub>R z 0) < Le 0\"\n          using ** add_mono_right[OF add_mono_right[OF rr], of \"M\\<^sub>R 0 y\" \"M y z\"] by simp\n          from ** have not_inf: \"M\\<^sub>R 0 y \\<noteq> \\<infinity>\" \"M y z \\<noteq> \\<infinity>\" \"M\\<^sub>R z 0 \\<noteq> \\<infinity>\" by auto\n          from M\\<^sub>R(6) \\<open>y \\<noteq> 0\\<close> \\<open>y \\<le> n\\<close> obtain c :: int where c:\n            \"M\\<^sub>R 0 y = Le c \\<or> M\\<^sub>R 0 y = Lt c\" \"- k (v' y) \\<le> c\" \"c \\<le> 0\"\n          unfolding v'_def by auto\n          have ?thesis\n          proof (cases \"M\\<^sub>R 0 y + M\\<^sub>R z 0 = Lt (c + d)\")\n            case True\n            from ** have \"(M\\<^sub>R 0 y + M\\<^sub>R z 0) + M y z < Le 0\" using comm assoc by metis\n            with True have **: \"Lt (c + d) + M y z < Le 0\" by simp\n            then have \"M y z \\<le> Le (- (c + d))\" unfolding less less_eq dbm_le_def mult\n            by (cases \"M y z\") (fastforce elim!: dbm_lt.cases)+\n            from dbm_le'[OF assms(2)[folded M(1)] this \\<open>y \\<le> n\\<close> \\<open>z \\<le> n\\<close> C(3,4)] \\<open>y \\<noteq> 0\\<close> \\<open>z \\<noteq> 0\\<close> M\n            have subs: \"Z \\<subseteq> {u \\<in> V. u c1 - u c2 \\<le> - (c + d)}\" by blast\n            with c d have \"- k (v' z) \\<le> - (c + d)\" \"- (c + d) \\<le> k (v' y)\" by auto\n            with beta_interp.\\<beta>_boundedness_diag_le'[OF _ _ C(1,2) subs] C2 have \n              \"Approx\\<^sub>\\<beta> Z \\<subseteq> {u \\<in> V. u c1 - u c2 \\<le> - (c + d)}\"\n            by auto\n            moreover\n            { fix u assume u: \"u \\<in> R\"\n              with C \\<open>y \\<le> n\\<close> \\<open>z \\<le> n\\<close> M\\<^sub>R(1) have\n                \"dbm_entry_val u (Some c2) None (M\\<^sub>R z 0)\" \"dbm_entry_val u None (Some c1) (M\\<^sub>R 0 y)\"\n              unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n              with True c d(1) have \"u \\<notin> {u \\<in> V. u c1 - u c2 \\<le> - (c + d)}\" unfolding mult by auto\n            }\n            ultimately show ?thesis by blast\n          next\n            case False\n            with c d have \"M\\<^sub>R 0 y + M\\<^sub>R z 0 = Le (c + d)\" unfolding mult by fastforce\n            moreover from ** have \"(M\\<^sub>R 0 y + M\\<^sub>R z 0) + M y z < Le 0\" using comm assoc by metis\n            ultimately have **: \"Le (c + d) + M y z < Le 0\" by simp\n            then have \"M y z \\<le> Lt (- (c + d))\" unfolding less less_eq dbm_le_def mult\n            by (cases \"M y z\") (fastforce elim!: dbm_lt.cases)+\n            from dbm_lt'[OF assms(2)[folded M(1)] this \\<open>y \\<le> n\\<close> \\<open>z \\<le> n\\<close> C(3,4)] \\<open>y \\<noteq> 0\\<close> \\<open>z \\<noteq> 0\\<close> M\n            have subs: \"Z \\<subseteq> {u \\<in> V. u c1 - u c2 < - (c + d)}\" by auto\n            from c d(2-) C2 have \"- k c2 \\<le> - (c + d)\" \"- (c + d) \\<le> k c1\" by auto\n            from beta_interp.\\<beta>_boundedness_diag_lt'[OF this C(1,2) subs] have \n              \"Approx\\<^sub>\\<beta> Z \\<subseteq> {u \\<in> V. u c1 - u c2 < - (c + d)}\"\n            .\n            moreover\n            { fix u assume u: \"u \\<in> R\"\n              with C \\<open>y \\<le> n\\<close> \\<open>z \\<le> n\\<close> M\\<^sub>R(1) have\n                \"dbm_entry_val u (Some c2) None (M\\<^sub>R z 0)\" \"dbm_entry_val u None (Some c1) (M\\<^sub>R 0 y)\"\n              unfolding DBM_zone_repr_def DBM_val_bounded_def by auto\n              with c d(1) have \"u \\<notin> {u \\<in> V. u c1 - u c2 < - (c + d)}\" by auto\n            }\n            ultimately show ?thesis by auto\n          qed\n        } then have ?thesis by auto\n      }\n      with bounded 0 bounded_zero_1 bounded_zero_2 show ?thesis by blast\n    qed\n  qed\nqed\n\n\nsection \\<open>Nice Corollaries of Bouyer's Theorem\\<close>\n\nlemma \\<R>_V: \"\\<Union> \\<R> = V\" unfolding V_def \\<R>_def using region_cover[of X _ k] by auto\n\nlemma regions_beta_V: \"R \\<in> \\<R>\\<^sub>\\<beta> \\<Longrightarrow> R \\<subseteq> V\" unfolding V_def \\<R>\\<^sub>\\<beta>_def by auto\n\nlemma apx_V: \"Z \\<subseteq> V \\<Longrightarrow> Approx\\<^sub>\\<beta> Z \\<subseteq> V\"\nproof (goal_cases)\n  case 1\n  from beta_interp.apx_in[OF 1] obtain U where \"Approx\\<^sub>\\<beta> Z = \\<Union>U\" \"U \\<subseteq> \\<R>\\<^sub>\\<beta>\" by auto\n  with regions_beta_V show ?thesis by auto\nqed\n\ncorollary approx_\\<beta>_closure_\\<alpha>:\n  assumes \"Z \\<subseteq> V\" \"vabstr Z M\"\n  shows \"Approx\\<^sub>\\<beta> Z \\<subseteq> Closure\\<^sub>\\<alpha> Z\"\nproof -\n  note T = region_zone_intersect_empty_approx_correct[OF _ assms(1) _ assms(2-)]\n  have \"- \\<Union>{R \\<in> \\<R>. R \\<inter> Z \\<noteq> {}} = \\<Union>{R \\<in> \\<R>. R \\<inter> Z = {}} \\<union> - V\"\n  proof (safe, goal_cases)\n    case 1 with \\<R>_V show False by fast\n  next\n    case 2 then show ?case using alpha_interp.valid_regions_distinct_spec by fastforce\n  next\n    case 3 then show ?case using \\<R>_V unfolding V_def by blast\n  qed\n  with T apx_V[OF assms(1)] have \"Approx\\<^sub>\\<beta> Z \\<inter> - \\<Union>{R \\<in> \\<R>. R \\<inter> Z \\<noteq> {}} = {}\" by auto\n  then show ?thesis unfolding alpha_interp.cla_def by blast\nqed\n\ndefinition \"V' \\<equiv> {Z. Z \\<subseteq> V \\<and> (\\<exists> M. vabstr Z M)}\"\n\ncorollary approx_\\<beta>_closure_\\<alpha>': \"Z \\<in> V' \\<Longrightarrow> Approx\\<^sub>\\<beta> Z \\<subseteq> Closure\\<^sub>\\<alpha> Z\"\nusing approx_\\<beta>_closure_\\<alpha> unfolding V'_def by auto\n\ntext \\<open>We could prove this more directly too (without using \\<open>Closure\\<^sub>\\<alpha> Z\\<close>), obviously\\<close>\nlemma apx_empty_iff:\n  assumes \"Z \\<subseteq> V\" \"vabstr Z M\"\n  shows \"Z = {} \\<longleftrightarrow> Approx\\<^sub>\\<beta> Z = {}\"\nusing alpha_interp.cla_empty_iff[OF assms(1)] approx_\\<beta>_closure_\\<alpha>[OF assms] beta_interp.apx_subset\nby auto\n\nlemma apx_empty_iff':\n  assumes \"Z \\<in> V'\" shows \"Z = {} \\<longleftrightarrow> Approx\\<^sub>\\<beta> Z = {}\"\nusing apx_empty_iff assms unfolding V'_def by force\n\nlemma apx_V':\n  assumes \"Z \\<subseteq> V\" shows \"Approx\\<^sub>\\<beta> Z \\<in> V'\"\nproof (cases \"Z = {}\")\n  case True\n  with beta_interp.apx_empty beta_interp.empty_zone_dbm show ?thesis unfolding V'_def neutral by auto\nnext\n  case False\n  then have non_empty: \"Approx\\<^sub>\\<beta> Z \\<noteq> {}\" using beta_interp.apx_subset by blast\n  from beta_interp.apx_in[OF assms] obtain U M where *:\n    \"Approx\\<^sub>\\<beta> Z = \\<Union>U\" \"U \\<subseteq> \\<R>\\<^sub>\\<beta>\" \"Z \\<subseteq> Approx\\<^sub>\\<beta> Z\" \"vabstr (Approx\\<^sub>\\<beta> Z) M\"\n  by blast\n  moreover from * beta_interp.\\<R>_union have \"\\<Union> U \\<subseteq> V\" by blast\n  ultimately show ?thesis using *(1,4) unfolding V'_def by auto\nqed\n\nsection \\<open>A New Zone Semantics Abstracting with \\<open>Approx\\<^sub>\\<beta>\\<close>\\<close>\n\nlemma step_z_V':\n  assumes \"A \\<turnstile> \\<langle>l,Z\\<rangle> \\<leadsto> \\<langle>l',Z'\\<rangle>\" \"valid_abstraction A X k\" \"\\<forall>c\\<in>clk_set A. v c \\<le> n\" \"Z \\<in> V'\"\n  shows \"Z' \\<in> V'\"\nproof -\n  from assms(3) clock_numbering have numbering: \"global_clock_numbering A v n\" by metis\n  from assms(4) obtain M where M:\n    \"Z \\<subseteq> V\" \"Z = [M]\\<^bsub>v,n\\<^esub>\" \"dbm_int M n\"\n  unfolding V'_def by auto\n  from alpha_interp.step_z_V[OF assms(1) M(1)] M(2) assms(1) step_z_dbm_DBM[OF _ numbering]\n       step_z_dbm_preserves_int[OF _ numbering assms(2) M(3)]\n  obtain M' where M': \"Z' \\<subseteq> V\" \"Z' = [M']\\<^bsub>v,n\\<^esub>\" \"dbm_int M' n\" by metis\n  then show ?thesis unfolding V'_def by blast\nqed\n\nlemma steps_z_V':\n  \"A \\<turnstile> \\<langle>l,Z\\<rangle> \\<leadsto>* \\<langle>l',Z'\\<rangle> \\<Longrightarrow> valid_abstraction A X k \\<Longrightarrow> \\<forall>c\\<in>clk_set A. v c \\<le> n \\<Longrightarrow> Z \\<in> V' \\<Longrightarrow> Z' \\<in> V'\"\nby (induction rule: steps_z.induct) (auto intro: step_z_V')\n\n\nsubsection \\<open>Single Step\\<close>\n\ninductive step_z_beta ::\n  \"('a, 'c, t, 's) ta \\<Rightarrow> 's \\<Rightarrow> ('c, t) zone \\<Rightarrow> 's \\<Rightarrow> ('c, t) zone \\<Rightarrow> bool\"\n(\"_ \\<turnstile> \\<langle>_, _\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>_, _\\<rangle>\" [61,61,61] 61)\nwhere\n  step_beta: \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto> \\<langle>l', Z'\\<rangle> \\<Longrightarrow> A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>l', Approx\\<^sub>\\<beta> Z'\\<rangle>\"\n\ninductive_cases[elim!]: \"A \\<turnstile> \\<langle>l, u\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>l',u'\\<rangle>\"\n\ndeclare step_z_beta.intros[intro]\n\nlemma step_z_alpha_sound:\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>l',Z'\\<rangle> \\<Longrightarrow> valid_abstraction A X k \\<Longrightarrow> \\<forall>c\\<in>clk_set A. v c \\<le> n \\<Longrightarrow> Z \\<in> V' \\<Longrightarrow> Z' \\<noteq> {}\n  \\<Longrightarrow> \\<exists> Z''. A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto> \\<langle>l',Z''\\<rangle> \\<and> Z'' \\<noteq> {}\"\n apply (induction rule: step_z_beta.induct)\n apply (frule step_z_V')\n    apply assumption+\n apply (rotate_tac 4)\n apply (drule apx_empty_iff')\nby blast\n\nlemma step_z_alpha_complete:\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto> \\<langle>l',Z'\\<rangle> \\<Longrightarrow> valid_abstraction A X k \\<Longrightarrow> \\<forall>c\\<in>clk_set A. v c \\<le> n \\<Longrightarrow> Z \\<in> V' \\<Longrightarrow> Z' \\<noteq> {}\n  \\<Longrightarrow> \\<exists> Z''. A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>l', Z''\\<rangle> \\<and> Z'' \\<noteq> {}\"\n apply (frule step_z_V')\n    apply assumption+\n apply (rotate_tac 4)\n apply (drule apx_empty_iff')\nby blast\n\nsubsection \\<open>Multi step\\<close>\n\ninductive\n  steps_z_beta :: \"('a, 'c, t, 's) ta \\<Rightarrow> 's \\<Rightarrow> ('c, t) zone \\<Rightarrow> 's \\<Rightarrow> ('c, t) zone \\<Rightarrow> bool\"\n(\"_ \\<turnstile> \\<langle>_, _\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>_, _\\<rangle>\" [61,61,61] 61)\nwhere\n  refl: \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l, Z\\<rangle>\" |\n  step: \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l', Z'\\<rangle> \\<Longrightarrow> A \\<turnstile> \\<langle>l', Z'\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>l'', Z''\\<rangle> \\<Longrightarrow> A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l'', Z''\\<rangle>\"\n\ndeclare steps_z_beta.intros[intro]\n\nlemma V'_V: \"Z \\<in> V' \\<Longrightarrow> Z \\<subseteq> V\" unfolding V'_def by auto\n\nlemma steps_z_beta_V':\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l', Z'\\<rangle> \\<Longrightarrow> valid_abstraction A X k \\<Longrightarrow>\\<forall>c\\<in>clk_set A. v c \\<le> n \\<Longrightarrow> Z \\<in> V' \\<Longrightarrow> Z' \\<in> V'\"\nproof (induction rule: steps_z_beta.induct)\n  case refl then show ?case by fast\nnext\n  case (step A l Z l' Z' l'' Z'')\n  from this(2) obtain Z''' where Z''': \"A \\<turnstile> \\<langle>l', Z'\\<rangle> \\<leadsto> \\<langle>l'',Z'''\\<rangle>\" \"Z'' = Approx\\<^sub>\\<beta> Z'''\" by auto\n  from step_z_V'[OF this(1)] step have \"Z''' \\<in> V'\" by auto\n  from apx_V'[OF V'_V, OF this] Z'''(2) show ?case by auto\nqed\n\nlemma alpha_beta_step:\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>l', Z'\\<rangle> \\<Longrightarrow> valid_abstraction A X k \\<Longrightarrow> \\<forall>c\\<in>clk_set A. v c \\<le> n \\<Longrightarrow> Z \\<in> V'\n  \\<Longrightarrow> \\<exists> Z''. A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<alpha> \\<langle>l', Z''\\<rangle> \\<and> Z' \\<subseteq> Z''\"\n  apply (induction rule: step_z_beta.induct)\n  apply (frule step_z_V')\n    apply assumption+\n  apply (rotate_tac 4)\n  apply (drule approx_\\<beta>_closure_\\<alpha>')\n  apply auto\ndone \n\nsubsubsection \\<open>Soundness\\<close>\n\nlemma alpha_beta_step':\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>l', Z'\\<rangle> \\<Longrightarrow> valid_abstraction A X k \\<Longrightarrow> \\<forall>c\\<in>clk_set A. v c \\<le> n \\<Longrightarrow> Z \\<in> V' \\<Longrightarrow> W \\<subseteq> V\n  \\<Longrightarrow> Z \\<subseteq> W \\<Longrightarrow> \\<exists> W'. A \\<turnstile> \\<langle>l, W\\<rangle> \\<leadsto>\\<^sub>\\<alpha> \\<langle>l', W'\\<rangle> \\<and> Z' \\<subseteq> W'\"\nproof (induction rule: step_z_beta.induct)\n  case (step_beta A l Z l' Z')\n  from alpha_interp.step_z_mono[OF step_beta(1,6)] obtain W' where W':\n    \"A \\<turnstile> \\<langle>l, W\\<rangle> \\<leadsto> \\<langle>l',W'\\<rangle>\" \"Z' \\<subseteq> W'\"\n  by blast\n  from approx_\\<beta>_closure_\\<alpha>'[OF step_z_V'[OF step_beta(1-4)]]\n       alpha_interp.cla_mono[OF this(2)] this(1)\n  show ?case by auto\nqed\n\nlemma alpha_beta_steps:\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l', Z'\\<rangle> \\<Longrightarrow> valid_abstraction A X k \\<Longrightarrow> \\<forall>c\\<in>clk_set A. v c \\<le> n \\<Longrightarrow> Z \\<in> V'\n  \\<Longrightarrow> \\<exists> Z''. A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<alpha>* \\<langle>l', Z''\\<rangle> \\<and> Z' \\<subseteq> Z''\"\nproof (induction rule: steps_z_beta.induct)\n  case refl then show ?case by auto\nnext\n  case (step A l Z l' Z' l'' Z'')\n  then obtain Z''' where *: \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<alpha>* \\<langle>l',Z'''\\<rangle>\" \"Z' \\<subseteq> Z'''\" by auto\n  from alpha_beta_step'[OF step.hyps(2) step.prems(1,2) steps_z_beta_V'[OF step.hyps(1) step.prems]\n                        alpha_interp.steps_z_alpha_V[OF this(1) V'_V] this(2)] step.prems\n  obtain W' where \"A \\<turnstile> \\<langle>l', Z'''\\<rangle> \\<leadsto>\\<^sub>\\<alpha> \\<langle>l'',W'\\<rangle>\" \"Z'' \\<subseteq> W'\" by blast\n  with * show ?case by auto\nqed\n\ncorollary steps_z_beta_sound:\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l', Z'\\<rangle> \\<Longrightarrow> \\<forall>c\\<in>clk_set A. v c \\<le> n \\<Longrightarrow> valid_abstraction A X k \\<Longrightarrow> Z \\<in> V' \\<Longrightarrow> Z' \\<noteq> {}\n  \\<Longrightarrow> \\<exists> Z''. A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>* \\<langle>l', Z''\\<rangle> \\<and> Z'' \\<noteq> {}\"\nproof (goal_cases)\n  case 1\n  then have \"Z \\<subseteq> V\" unfolding V'_def by auto\n  from alpha_beta_steps[OF 1(1,3,2,4)] obtain Z''' where *:\n    \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<alpha>* \\<langle>l',Z'''\\<rangle>\" \"Z' \\<subseteq> Z'''\"\n    by blast\n  from alpha_interp.steps_z_alpha_closure_involutive[OF *(1) 1(3) \\<open>Z \\<subseteq> V\\<close>] obtain Z'' where\n    Z'': \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>* \\<langle>l',Z''\\<rangle>\" \"Closure\\<^sub>\\<alpha> Z''' \\<subseteq> Closure\\<^sub>\\<alpha> Z''\" \"Z'' \\<subseteq> Z'''\"\n    by blast\n  with alpha_interp.closure_subs[OF alpha_interp.steps_z_alpha_V[OF *(1) \\<open>Z \\<subseteq> V\\<close>]] 1(5)\n    alpha_interp.cla_empty_iff[OF alpha_interp.steps_z_V, OF this(1) \\<open>Z \\<subseteq> V\\<close>] *(2)\n  have \"Z'' \\<noteq> {}\" by auto\n  with Z'' show ?thesis by auto\nqed\n\nsubsubsection \\<open>Completeness\\<close>\n\nlemma apx_mono:\n  \"Z' \\<subseteq> V \\<Longrightarrow> Z \\<subseteq> Z' \\<Longrightarrow> Approx\\<^sub>\\<beta> Z \\<subseteq> Approx\\<^sub>\\<beta> Z'\"\nproof (goal_cases)\n  case 1\n  with beta_interp.apx_in have\n    \"Approx\\<^sub>\\<beta> Z' \\<in> {S. \\<exists>U M. S = \\<Union>U \\<and> U \\<subseteq> \\<R>\\<^sub>\\<beta> \\<and> Z' \\<subseteq> S \\<and> beta_interp.vabstr S M\n                      \\<and> beta_interp.normalized M}\"\n  by auto\n  with 1 obtain U M where\n    \"Approx\\<^sub>\\<beta> Z' = \\<Union>U\" \"U \\<subseteq> \\<R>\\<^sub>\\<beta>\" \"Z \\<subseteq> Approx\\<^sub>\\<beta> Z'\" \"beta_interp.vabstr (Approx\\<^sub>\\<beta> Z') M\"\n    \"beta_interp.normalized M\"\n  by auto\n  with beta_interp.apx_min show ?thesis by auto\nqed\n\nlemma step_z_beta_mono:\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>l', Z'\\<rangle> \\<Longrightarrow> Z \\<subseteq> W \\<Longrightarrow> W \\<subseteq> V \\<Longrightarrow> \\<exists> W'. A \\<turnstile> \\<langle>l, W\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>l', W'\\<rangle> \\<and> Z' \\<subseteq> W'\"\nproof (goal_cases)\n  case 1\n  then obtain Z'' where *: \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto> \\<langle>l',Z''\\<rangle>\" \"Z' = Approx\\<^sub>\\<beta> Z''\" by auto\n  from alpha_interp.step_z_mono[OF this(1) 1(2)] obtain W' where\n    \"A \\<turnstile> \\<langle>l, W\\<rangle> \\<leadsto> \\<langle>l',W'\\<rangle>\" \"Z'' \\<subseteq> W'\"\n  by auto\n  moreover with *(2) apx_mono[OF alpha_interp.step_z_V] \\<open>W \\<subseteq> V\\<close> have\n    \"Z' \\<subseteq> Approx\\<^sub>\\<beta> W'\"\n  by metis\n  ultimately show ?case by blast\nqed\n\nlemma steps_z_beta_V: \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l', Z'\\<rangle> \\<Longrightarrow> Z \\<subseteq> V \\<Longrightarrow> Z' \\<subseteq> V\"\nproof (induction rule: steps_z_beta.induct)\n  case refl then show ?case by blast\nnext\n  case (step A l Z l' Z' l'' Z'')\n  then obtain Z''' where \"A \\<turnstile> \\<langle>l', Z'\\<rangle> \\<leadsto> \\<langle>l'',Z'''\\<rangle>\" \"Z'' = Approx\\<^sub>\\<beta> Z'''\" by auto\n  with alpha_interp.step_z_V[OF this(1)] apx_V step(3,4) show \"Z'' \\<subseteq> V\" by auto\nqed\n\nlemma steps_z_beta_mono:\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l', Z'\\<rangle> \\<Longrightarrow> Z \\<subseteq> W \\<Longrightarrow> W \\<subseteq> V \\<Longrightarrow> \\<exists> W'. A \\<turnstile> \\<langle>l, W\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l', W'\\<rangle> \\<and> Z' \\<subseteq> W'\"\nproof (induction rule: steps_z_beta.induct)\n  case refl then show ?case by auto\nnext\n  case (step A l Z l' Z' l'' Z'')\n  then obtain W' where \"A \\<turnstile> \\<langle>l, W\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l',W'\\<rangle>\" \"Z' \\<subseteq> W'\" by auto\n  with step_z_beta_mono[OF step(2) this(2) steps_z_beta_V[OF this(1) step(5)]] show ?case by blast\nqed\n\nlemma steps_z_beta_alt:\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta> \\<langle>l', Z'\\<rangle> \\<Longrightarrow> A \\<turnstile> \\<langle>l', Z'\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l'', Z''\\<rangle> \\<Longrightarrow> A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l'', Z''\\<rangle>\"\nby (rotate_tac, induction rule: steps_z_beta.induct) blast+\n\nlemma steps_z_beta_complete:\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>* \\<langle>l', Z'\\<rangle> \\<Longrightarrow> valid_abstraction A X k \\<Longrightarrow> Z \\<subseteq> V\n  \\<Longrightarrow> \\<exists> Z''. A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l',Z''\\<rangle> \\<and> Z' \\<subseteq> Z''\"\nproof (induction rule: steps_z.induct)\n  case refl with apx_empty_iff show ?case by blast\nnext\n  case (step A l Z l' Z' l'' Z'')\n  with alpha_interp.step_z_V[OF this(1,5)] obtain Z''' where\n    \"A \\<turnstile> \\<langle>l', Z'\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l'',Z'''\\<rangle>\" \"Z'' \\<subseteq> Z'''\"\n  by blast\n  with steps_z_beta_mono[OF this(1) beta_interp.apx_subset apx_V[OF alpha_interp.step_z_V[OF step(1,5)]]]\n  obtain W' where \"A \\<turnstile> \\<langle>l', Approx\\<^sub>\\<beta> Z'\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l'', W'\\<rangle>\" \" Z'' \\<subseteq> W'\" by auto\n  moreover with step(1) have \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l'',W'\\<rangle>\" by (auto intro: steps_z_beta_alt)\n  ultimately show ?case by auto\nqed\n\nlemma steps_z_beta_complete':\n  \"A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>* \\<langle>l',Z'\\<rangle> \\<Longrightarrow> valid_abstraction A X k \\<Longrightarrow> Z \\<subseteq> V \\<Longrightarrow> Z' \\<noteq> {}\n  \\<Longrightarrow> \\<exists> Z''. A \\<turnstile> \\<langle>l, Z\\<rangle> \\<leadsto>\\<^sub>\\<beta>* \\<langle>l',Z''\\<rangle> \\<and> Z'' \\<noteq> {}\"\nusing steps_z_beta_complete by fast\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Timed_Automata/Approx_Beta.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.32226611671838923}}
{"text": "subsection \\<open>Preconditions and invariants for the atomic step \\label{sect:step_invariants}\\<close>\n\ntheory Step_invariants\n  imports Step\nbegin\n\ntext \\<open>The dynamic/implementation policies have to be compatible with the static configuration.\\<close>\n\ndefinition \"sp_subset s \\<equiv>\n   (\\<forall> p1 p2 . sp_impl_subj_subj s p1 p2 \\<longrightarrow> Policy.sp_spec_subj_subj p1 p2)\n   \\<and> (\\<forall> p1 p2 m. sp_impl_subj_obj s p1 p2 m \\<longrightarrow> Policy.sp_spec_subj_obj p1 p2 m)\"\n\ntext \\<open>The following predicate expresses the precondition for the atomic step. The precondition depends on the type of the atomic action.\\<close>\n(*\n[SK_IPC dir PREP partner page,SK_IPC dir WAIT partner page,SK_IPC dir (BUF page') partner page]\n*)\ndefinition atomic_step_precondition :: \"state_t \\<Rightarrow> thread_id_t \\<Rightarrow> int_point_t \\<Rightarrow> bool\" where\n  \"atomic_step_precondition s tid ipt \\<equiv>\n    case ipt of\n       SK_IPC dir WAIT partner page \\<Rightarrow>\n         \\<comment> \\<open>the thread managed it past PREP stage\\<close>\n         ipc_precondition tid dir partner page s\n     | SK_IPC dir (BUF page') partner page \\<Rightarrow>\n         \\<comment> \\<open>both the calling thread and its communication partner managed it past PREP and WAIT stages\\<close>\n         ipc_precondition tid dir partner page s\n         \\<and> ipc_precondition partner (opposite_ipc_direction dir) tid page' s\n     | SK_EV_SIGNAL EV_SIGNAL_FINISH partner \\<Rightarrow>\n        ev_signal_precondition tid partner s \n     | _ \\<Rightarrow>\n         \\<comment> \\<open>No precondition for other interrupt points.\\<close>\n         True\"\n\ntext \\<open>The invariant to be preserved by the atomic step function. The invariant is independent from the type of the atomic action.\\<close>\n\ndefinition atomic_step_invariant :: \"state_t \\<Rightarrow> bool\" where\n  \"atomic_step_invariant s \\<equiv>\n     sp_subset s\"\n\nsubsubsection \\<open>Atomic steps of SK\\_IPC preserve invariants\\<close>\n\n\nlemma set_object_value_invariant:\n  shows \"atomic_step_invariant s = atomic_step_invariant (set_object_value ob va s)\"\nproof -\n  show ?thesis\n    unfolding atomic_step_invariant_def atomic_step_precondition_def ipc_precondition_def\n      sp_subset_def set_object_value_def Let_def\n    by (simp split: int_point_t.splits ipc_stage_t.splits ipc_direction_t.splits)\nqed\n\n\n\nlemma atomic_ipc_preserves_invariants:\n  fixes s :: state_t\n    and tid :: thread_id_t\n  assumes \"atomic_step_invariant s\"\n  shows \"atomic_step_invariant (atomic_step_ipc tid dir stage partner page s)\"\nproof -\n  show ?thesis\n    proof (cases stage)\n    case PREP\n      from this assms show ?thesis\n        unfolding atomic_step_ipc_def atomic_step_invariant_def by auto\n    next\n    case WAIT\n      from this assms show ?thesis\n        unfolding atomic_step_ipc_def atomic_step_invariant_def by auto\n    next\n    case BUF\n      show ?thesis\n        using assms BUF set_object_value_invariant\n        unfolding atomic_step_ipc_def\n        by (simp split: ipc_direction_t.splits)\n    qed\nqed\n\nlemma atomic_ev_wait_one_preserves_invariants:\n  fixes s :: state_t\n    and tid :: thread_id_t\n  assumes \"atomic_step_invariant s\"\n  shows \"atomic_step_invariant (atomic_step_ev_wait_one tid s)\"\n  proof -\n   from assms show ?thesis\n   unfolding atomic_step_ev_wait_one_def atomic_step_invariant_def sp_subset_def\n   by auto  \n qed\n\nlemma atomic_ev_wait_all_preserves_invariants:\n  fixes s :: state_t\n    and tid :: thread_id_t\n  assumes \"atomic_step_invariant s\"\n  shows \"atomic_step_invariant (atomic_step_ev_wait_all tid s)\"\n  proof -\n   from assms show ?thesis\n   unfolding atomic_step_ev_wait_all_def atomic_step_invariant_def sp_subset_def\n   by auto  \n qed\n\nlemma atomic_ev_signal_preserves_invariants:\n  fixes s :: state_t\n    and tid :: thread_id_t\n  assumes \"atomic_step_invariant s\"\n  shows \"atomic_step_invariant (atomic_step_ev_signal tid  partner s)\"\n  proof -\n   from assms show ?thesis\n   unfolding atomic_step_ev_signal_def atomic_step_invariant_def sp_subset_def\n   by auto  \n qed\n\nsubsubsection \\<open>Summary theorems on atomic step invariants\\<close>\n\ntext \\<open>Now we are ready to show that an atomic step from the current interrupt point\n        in any thread preserves invariants.\\<close>\n\ntheorem atomic_step_preserves_invariants:\n  fixes s :: state_t\n    and tid :: thread_id_t\n  assumes \"atomic_step_invariant s\"\n  shows \"atomic_step_invariant (atomic_step s a)\"\nproof (cases a)\n  case SK_IPC \n    then show ?thesis unfolding atomic_step_def\n    using assms atomic_ipc_preserves_invariants\n    by simp\n  next  case (SK_EV_WAIT ev_wait_stage consume)\n    then show ?thesis \n    proof (cases consume)\n     case EV_CONSUME_ALL\n      then show ?thesis unfolding atomic_step_def\n      using SK_EV_WAIT assms atomic_ev_wait_all_preserves_invariants\n      by (simp split: ev_wait_stage_t.splits)\n     next case EV_CONSUME_ONE\n      then show ?thesis unfolding atomic_step_def\n      using SK_EV_WAIT assms atomic_ev_wait_one_preserves_invariants\n      by (simp split: ev_wait_stage_t.splits)\n    qed\n  next case SK_EV_SIGNAL\n   then show ?thesis unfolding atomic_step_def\n   using assms atomic_ev_signal_preserves_invariants  \n   by (simp add: ev_signal_stage_t.splits)\n  next case NONE\n   then show ?thesis unfolding atomic_step_def\n   using assms\n   by auto  \nqed\n\ntext \\<open>Finally, the invariants do not depend on the current thread. That is, \nthe context switch preserves the invariants, and an atomic step that is \nnot a context switch does not change the current thread.\\<close>\n\ntheorem cswitch_preserves_invariants:\n  fixes s :: state_t\n    and new_current :: thread_id_t\n  assumes \"atomic_step_invariant s\"\n  shows \"atomic_step_invariant (s \\<lparr> current := new_current \\<rparr>)\"\nproof -\n  let ?s1 = \"s \\<lparr> current := new_current \\<rparr>\"\n  have \"sp_subset s = sp_subset ?s1\"\n    unfolding sp_subset_def by auto\n  from assms this show ?thesis\n    unfolding atomic_step_invariant_def by metis\nqed\n\ntheorem atomic_step_does_not_change_current_thread:\n  shows \"current (atomic_step s ipt) = current s\"\nproof -\n  show ?thesis\n    unfolding atomic_step_def\n          and atomic_step_ipc_def\n          and set_object_value_def Let_def\n          and atomic_step_ev_wait_one_def atomic_step_ev_wait_all_def\n          and atomic_step_ev_signal_def\n    by (simp split: int_point_t.splits ipc_stage_t.splits ipc_direction_t.splits \n                        ev_consume_t.splits ev_wait_stage_t.splits ev_signal_stage_t.splits)\nqed\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CISC-Kernel/step/Step_invariants.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.32226611671838923}}
{"text": "theory Abstract_Reachability_Analysis\n  imports\n  Abstract_Rigorous_Numerics\n  Affine_Arithmetic.Affine_Arithmetic\n  \"../Refinement/Refine_String\"\n  \"../Refinement/Refine_Folds\"\n  Ordinary_Differential_Equations.Flow\n  Runge_Kutta\nbegin\n\n\nsubsection \\<open>Misc\\<close>\n\nlemma nth_concat_exists:\n  \"\\<exists>k j. concat xs ! i = xs ! k ! j \\<and> k < length xs \\<and> j < length (xs ! k)\"\n  if \"i < length (concat xs)\"\n  using that\nproof (induction xs arbitrary: i)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons xs xss)\n  from Cons.prems consider \"i < length xs\"\n    | \"i \\<ge> length xs\" \"i < length xs + length (concat xss)\"\n    by (cases \"i < length xs\") auto\n  then show ?case\n  proof cases\n    case 1\n    then show ?thesis\n      by (force simp: nth_append intro: exI[where x=i] exI[where x=0])\n  next\n    case 2\n    then have \"i - length xs < length (concat xss)\" by arith\n    with Cons.IH[of \"i - length xs\"]\n    obtain k j where\n      \"concat xss ! (i - length xs) = xss ! k ! j\" \"k < length xss\" \"j < length (xss ! k)\"\n      by auto\n    then show ?thesis\n      using 2\n      by (fastforce simp: nth_append nth_Cons split: nat.splits\n          intro: exI[where x=j] exI[where x=\"k + 1\"])\n  qed\nqed\n\nlemma nth_concatE:\n  assumes \"i < length (concat xs)\"\n  obtains k j where \"concat xs ! i = xs ! k ! j\" \"k < length xs\" \"j < length (xs ! k)\"\n  apply atomize_elim\n  using assms nth_concat_exists by blast\n\nlemma max_Var_floatariths_concat:\n  \"max_Var_floatariths (concat xs) \\<le> k\"\n  if \"\\<And>x. x \\<in> set xs \\<Longrightarrow> max_Var_floatariths x \\<le> k\"\n  using that max_Var_floatarith_le_max_Var_floatariths_nthI\n  by (fastforce simp: in_set_conv_nth intro!: max_Var_floatariths_leI\n      elim!: nth_concatE)\n\nlemma max_Var_floatariths_list_update:\n  \"max_Var_floatariths (xs[xa := y]) \\<le> k\"\n  if \"max_Var_floatariths (xs) \\<le> k\"\n  and \"max_Var_floatarith y \\<le> k\"\n  by (metis neq_le_trans linorder_le_cases list_update_beyond\n      max_Var_floatariths_list_updateI that)\n\nlemma max_Var_floatarith_0[simp]: \"max_Var_floatarith 0 = 0\"\n  and max_Var_floatarith_1[simp]: \"max_Var_floatarith 1 = 0\"\n  by (auto simp: zero_floatarith_def one_floatarith_def)\n\nlemma list_set_rel_br: \"\\<langle>Id\\<rangle>list_set_rel = br set distinct\"\n  by (auto simp: list_set_rel_def)\n\nlemma\n  br_list_relD:\n  shows \"(x, y) \\<in> \\<langle>br a i\\<rangle>list_set_rel \\<Longrightarrow> y = a ` set x \\<and> list_all i x\"\n  apply (auto simp: list_set_rel_def br_def list_rel_def)\n  subgoal premises prems for s t\n    using prems\n    by (induction arbitrary: y rule: list.rel_induct) auto\n  subgoal premises prems for s t\n    using prems\n    by (induction arbitrary: y rule: list.rel_induct) auto\n  subgoal premises prems for s\n    using prems\n    by (induction arbitrary: y rule: list.rel_induct) auto\n  done\n\nlemma sctn_rel_br: \"\\<langle>br a I\\<rangle>sctn_rel = br (\\<lambda>x. case x of Sctn n p \\<Rightarrow> Sctn (a n) p) (\\<lambda>x. I (normal x))\"\n  apply (auto simp: sctn_rel_def br_def in_rel_def[abs_def] split: sctn.splits)\n  subgoal for b x1 x2 by (cases b) auto\n  subgoal for a b by (cases a; cases b) auto\n  done\n\nlemma br_list_rel: \"\\<langle>br a I\\<rangle>list_rel = br (map a) (list_all I)\"\n  by (fastforce simp: list_rel_def br_def list_all2_iff Ball_def in_set_zip list_all_length\n      intro!: nth_equalityI)\n\nlemma list_set_rel_brp: \"\\<langle>br a I\\<rangle>list_set_rel = br (\\<lambda>xs. a ` set xs) (\\<lambda>xs. list_all I xs \\<and> distinct (map a xs))\"\n  unfolding list_set_rel_def br_list_rel br_chain o_def o_def\n  by (auto)\n\n\ndeclare INF_cong_simp [cong] SUP_cong_simp [cong] image_cong_simp [cong del]\n\ncontext auto_ll_on_open begin\n\ndefinition \"stable_on CX trap \\<longleftrightarrow>\n  (\\<forall>t x0. flow0 x0 t \\<in> trap \\<longrightarrow> t \\<in> existence_ivl0 x0 \\<longrightarrow> t > 0 \\<longrightarrow>\n    (\\<forall>s\\<in>{0<..t}. flow0 x0 s \\<in> CX) \\<longrightarrow> x0 \\<in> trap)\"\n\nlemma stable_onD:\n  \"\\<And>t x0. flow0 x0 t \\<in> trap \\<Longrightarrow> t \\<in> existence_ivl0 x0 \\<Longrightarrow> t > 0 \\<Longrightarrow>\n      (\\<And>s. 0 < s \\<Longrightarrow> s \\<le> t \\<Longrightarrow> flow0 x0 s \\<in> CX) \\<Longrightarrow>\n      x0 \\<in> trap\"\n  if \"stable_on CX trap\"\n  using that by (auto simp: stable_on_def)\n\nlemma nonneg_interval_mem_existence_ivlI[intro]:\\<comment> \\<open>TODO: move!\\<close>\n  \"0 \\<le> t1 \\<Longrightarrow> t1 \\<le> t2 \\<Longrightarrow> t2 \\<in> existence_ivl0 x0 \\<Longrightarrow> {t1..t2} \\<subseteq> existence_ivl0 x0\"\n  \"t1 \\<le> t2 \\<Longrightarrow> t2 \\<le> 0 \\<Longrightarrow> t1 \\<in> existence_ivl0 x0 \\<Longrightarrow> {t1..t2} \\<subseteq> existence_ivl0 x0\"\n  \"t1 \\<le> 0 \\<Longrightarrow> 0 \\<le> t2 \\<Longrightarrow> t1 \\<in> existence_ivl0 x0 \\<Longrightarrow> t2 \\<in> existence_ivl0 x0 \\<Longrightarrow> {t1..t2} \\<subseteq> existence_ivl0 x0\"\n    apply auto\n  apply (drule ivl_subset_existence_ivl) apply auto\n  apply (drule ivl_subset_existence_ivl') apply auto\n  apply (drule segment_subset_existence_ivl, assumption)\n  apply (auto simp: closed_segment_eq_real_ivl)\n  done\n\nlemma interval_subset_existence_ivl:\n  \"t \\<in> existence_ivl0 x0 \\<Longrightarrow> s \\<in> existence_ivl0 x0 \\<Longrightarrow> t \\<le> s \\<Longrightarrow> {t .. s} \\<subseteq> existence_ivl0 x0\"\n  using segment_subset_existence_ivl[of s x0 t]\n  by (auto simp: closed_segment_eq_real_ivl)\n\nend\n\nlemma(in c1_on_open_euclidean) diff_existence_ivl_iff[simp]:\\<comment> \\<open>TODO: move!, also to @{term auto_ll_on_open}\\<close>\n  \"t2 - t1 \\<in> existence_ivl0 (flow0 x0 t1) \\<longleftrightarrow> t2 \\<in> existence_ivl0 x0\"\n  if \"t1 \\<le> t2\" \"t1 \\<in> existence_ivl0 x0\"\n  apply auto\n   apply (drule existence_ivl_trans[OF that(2)])\n   apply (auto intro!: diff_existence_ivl_trans that)\n  done\n\nlemma (in auto_ll_on_open) flow_trans':\n  \"flow0 (flow0 x0 t1) t2 = flow0 x0 (t1 + t2)\"\n  if \"t1 \\<in> existence_ivl0 x0\" \"t1 + t2 \\<in> existence_ivl0 x0\"\n  apply (subst flow_trans)\n  using that\n  by (auto intro!: existence_ivl_trans')\n\ncontext auto_ll_on_open begin\n\ndefinition \"flowpipe0 X0 hl hu CX X1 \\<longleftrightarrow> 0 \\<le> hl \\<and> hl \\<le> hu \\<and> X0 \\<subseteq> X \\<and> CX \\<subseteq> X \\<and> X1 \\<subseteq> X \\<and>\n  (\\<forall>(x0) \\<in> X0. \\<forall>h \\<in> {hl .. hu}. h \\<in> existence_ivl0 x0 \\<and> (flow0 x0 h) \\<in> X1 \\<and> (\\<forall>h' \\<in> {0 .. h}. (flow0 x0 h') \\<in> CX))\"\n\nlemma flowpipe0D:\n  assumes \"flowpipe0 X0 hl hu CX X1\"\n  shows flowpipe0_safeD: \"X0 \\<union> CX \\<union> X1 \\<subseteq> X\"\n    and flowpipe0_nonneg: \"0 \\<le> hl\" \"hl \\<le> hu\"\n    and flowpipe0_exivl: \"hl \\<le> h \\<Longrightarrow> h \\<le> hu \\<Longrightarrow> (x0) \\<in> X0 \\<Longrightarrow> h \\<in> existence_ivl0 x0\"\n    and flowpipe0_discrete: \"hl \\<le> h \\<Longrightarrow> h \\<le> hu \\<Longrightarrow> (x0) \\<in> X0 \\<Longrightarrow> (flow0 x0 h) \\<in> X1\"\n    and flowpipe0_cont: \"hl \\<le> h \\<Longrightarrow> h \\<le> hu \\<Longrightarrow> (x0) \\<in> X0 \\<Longrightarrow> 0 \\<le> h' \\<Longrightarrow> h' \\<le> h \\<Longrightarrow> (flow0 x0 h') \\<in> CX\"\n  using assms\n  by (auto simp: flowpipe0_def)\n\nlemma flowpipe0_source_subset: \"flowpipe0 X0 hl hu CX X1 \\<Longrightarrow> X0 \\<subseteq> CX\"\n  apply (auto dest: bspec[where x=hl] bspec[where x=0] simp: flowpipe0_def)\n  apply (drule bspec)\n   apply (assumption)\n  apply (drule bspec[where x=hl])\n   apply auto\n  apply (drule bspec[where x=0])\n  by (auto simp: flow_initial_time_if)\n\nend\n\nsubsection \\<open>Options\\<close>\n\ndefinition [refine_vcg_def]: \"precision_spec = SPEC (\\<lambda>prec::nat. True)\"\ndefinition [refine_vcg_def]: \"adaptive_atol_spec = SPEC (\\<lambda>x::real. True)\"\ndefinition [refine_vcg_def]: \"adaptive_rtol_spec = SPEC (\\<lambda>x::real. True)\"\ndefinition [refine_vcg_def]: \"method_spec = SPEC (\\<lambda>m::nat. True)\"\ndefinition [refine_vcg_def]: \"start_stepsize_spec = SPEC (\\<lambda>x::real. x > 0)\"\ndefinition [refine_vcg_def]: \"iterations_spec = SPEC (\\<lambda>n::nat. True)\"\ndefinition [refine_vcg_def]: \"halve_stepsizes_spec = SPEC (\\<lambda>n::nat. True)\"\ndefinition [refine_vcg_def]: \"widening_mod_spec = SPEC (\\<lambda>n::nat. True)\"\ndefinition [refine_vcg_def]: \"rk2_param_spec = SPEC (\\<lambda>r::real. 0 < r \\<and> r \\<le> 1)\"\n\ntypedef ode_ops = \"{(ode_e::floatarith list, safe_form::form).\n  open_form safe_form \\<and>\n  max_Var_floatariths ode_e \\<le> length ode_e \\<and>\n  max_Var_form safe_form \\<le> length ode_e}\" \\<comment> \\<open>ode on open domain, welldefined\\<close>\n  by (auto intro!: exI[where x=\"[floatarith.Num 0]\"]\n      exI[where x=\"Less (floatarith.Num 0) (floatarith.Num 1)\"])\nsetup_lifting type_definition_ode_ops\n\nlift_definition ode_expression::\"ode_ops \\<Rightarrow> floatarith list\" is fst .\nlift_definition safe_form_expr::\"ode_ops \\<Rightarrow> form\" is snd .\n    \\<comment> \\<open>TODO: should better called it domain of definition of ODE,\n                its main use is to exclude e.g. division by zero on the rhs.\\<close>\n\nlemma open_form_ode_op[intro, simp]: \"open_form (safe_form_expr odo)\"\n  and max_Var_ode_expression: \"max_Var_floatariths (ode_expression odo) \\<le> length (ode_expression odo)\"\n  and max_Var_form_safe_form_expr: \"max_Var_form (safe_form_expr odo) \\<le> length (ode_expression odo)\"\n  by (transfer, auto)+\n\nlift_definition (code_dt) mk_ode_ops::\"floatarith list \\<Rightarrow> form \\<Rightarrow> ode_ops option\" is\n  \"\\<lambda>ode_e safe_form.\n    if (open_form safe_form \\<and> max_Var_floatariths ode_e \\<le> length ode_e \\<and> max_Var_form safe_form \\<le> length ode_e)\n    then Some (ode_e, safe_form) else None\"\n  by (auto simp:)\n\nlemma\n  assumes \"mk_ode_ops e s = Some odo\"\n  shows ode_expression_mk_ode_ops: \"ode_expression odo = e\"\n    and safe_form_expr_mk_ode_ops: \"safe_form_expr odo = s\"\n  using assms\n  by (transfer, simp split: if_splits prod.splits)+\n\nlocale ode_operations = fixes ode_ops::ode_ops begin\n\ndefinition \"ode_e = ode_expression ode_ops\"\ndefinition \"safe_form = safe_form_expr ode_ops\"\n\ndefinition ode::\"'a \\<Rightarrow> 'a::executable_euclidean_space\"\n  where \"ode x = eucl_of_list (interpret_floatariths ode_e (list_of_eucl x))\"\n\ndefinition \"ode_d_expr_nth N n i =\n    FDERIV_floatarith\n     (FDERIV_n_floatarith (ode_e  ! i) [0..<N] (map floatarith.Var [N..<2 * N]) n) [0..<N]\n         (map floatarith.Var [2 * N..<3 * N])\"\n\ndefinition \"ode_d_expr N n =\n    (FDERIV_floatariths\n      (FDERIV_n_floatariths ode_e [0..<N] (map floatarith.Var [N..<2 * N]) n)\n      [0..<N]\n      (map floatarith.Var [2 * N..< 3 * N]))\"\n\ndefinition ode_d_raw::\"nat \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a::executable_euclidean_space\"\n  where \"ode_d_raw n x dn d =\n    eucl_of_list (interpret_floatariths (ode_d_expr DIM('a) n) (list_of_eucl x @ list_of_eucl dn @ list_of_eucl d))\"\n\ndefinition \"ode_fa_nth xs i = subst_floatarith (\\<lambda>i. xs ! i) (ode_e ! i)\"\n\ndefinition \"ode_fa xs = map (subst_floatarith (\\<lambda>i. xs ! i)) ode_e\"\n\ndefinition \"ode_d_fa_nth n xs ds i = subst_floatarith (\\<lambda>i. (xs@ds@ds) ! i) (ode_d_expr_nth (length xs) n i)\"\n\ndefinition \"ode_d_fa n xs ds = map (subst_floatarith (\\<lambda>i. (xs@ds@ds) ! i)) (ode_d_expr (length xs) n)\"\n\ndefinition safe::\"'a::executable_euclidean_space \\<Rightarrow> bool\"\n  where \"safe x \\<longleftrightarrow>\n    length ode_e = DIM('a) \\<and>\n    max_Var_floatariths ode_e \\<le> DIM('a) \\<and>\n    open_form safe_form \\<and>\n    max_Var_form safe_form \\<le> DIM('a) \\<and>\n    interpret_form safe_form (list_of_eucl x) \\<and>\n    isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl x)\"\n\ndefinition \"Csafe = Collect safe\"\n\ndefinition \"euler_incr_fas_nth X0 h CX i = X0 ! i + h * (ode_fa_nth CX i)\"\n\ndefinition \"euler_incr_fas X0 h CX = map (euler_incr_fas_nth X0 h CX) [0..<length X0]\"\n\ndefinition \"euler_err_fas_nth X0 h CX i = ((h ^\\<^sub>e 2) / floatarith.Num 2) * ode_d_fa_nth 0 CX (ode_fa CX) i\"\n\ndefinition \"euler_err_fas X0 h CX = map (euler_err_fas_nth X0 h CX) [0..<length X0]\"\n\ndefinition \"euler_fas X0 h CX =\n  map (\\<lambda>i. (euler_incr_fas_nth X0 h X0 i + euler_err_fas_nth X0 h CX i)) [0..<length X0] @\n  euler_err_fas X0 h CX\"\n\ndefinition \"rk2_fas_err_nth rkp x0 h cx s2 i =\n  ((((h ^\\<^sub>e 3 / 6) *\n        (ode_d_fa_nth 1 cx (ode_fa cx) i +\n         ode_d_fa_nth 0 cx (ode_d_fa 0 cx (ode_fa cx)) i)))\n      - ((h ^\\<^sub>e 3 * rkp / 4) *\n          ode_d_fa_nth 1 (euler_incr_fas x0 (s2 * h * rkp) x0) (ode_fa x0) i))\"\n\ndefinition \"rk2_fas_err rkp x0 h cx s2 = map (rk2_fas_err_nth rkp x0 h cx s2) [0..<length x0]\"\n\ndefinition \"rk2_fas rkp x0 h cx s2 =\n  (map (\\<lambda>i.\n      ((x0 ! i +\n        h * ((1 - (1 / (rkp * 2))) * ode_fa_nth x0 i +\n          (1 / (rkp * 2)) * ode_fa_nth (euler_incr_fas x0 (h * rkp) x0) i))\n      + rk2_fas_err_nth rkp x0 h cx s2 i)) [0..<length x0]) @ rk2_fas_err rkp x0 h cx s2\"\n\n\nlemma ode_d_expr_nth: \"i < length ode_e \\<Longrightarrow> ode_d_expr_nth N n i = ode_d_expr N n ! i \"\n  by (auto simp: ode_d_expr_nth_def ode_d_expr_def\n      FDERIV_n_floatariths_nth)\n\nlemma length_ode_d_expr[simp]: \"length (ode_d_expr f n) = length ode_e\"\n  by (induction n) (auto simp: ode_d_expr_def FDERIV_n_floatariths_def)\n\nlemma ode_fa_nth: \"i < length ode_e \\<Longrightarrow> ode_fa xs ! i = ode_fa_nth xs i\"\n  by (auto simp: ode_fa_nth_def ode_fa_def)\n\nlemma ode_d_fa_nth: \"i < length ode_e \\<Longrightarrow> ode_d_fa_nth n xs ds i = ode_d_fa n xs ds ! i\"\n  by (auto simp: ode_d_fa_def ode_d_fa_nth_def ode_d_expr_nth)\n\nlemma length_ode_d_fa[simp]: \"length (ode_d_fa n xs ds) = length ode_e\"\n  by (auto simp: ode_d_fa_def FDERIV_n_floatariths_def)\n\nlemma length_rk2_fas_err[simp]: \"length (rk2_fas_err rkp x0 h cx s2) = length x0\"\n  by (simp add: rk2_fas_err_def)\n\nlemma length_euler_incr_fas[simp]: \"length (euler_incr_fas X0 h CX) = length X0\"\n  by (auto simp: euler_incr_fas_def)\n\nlemma length_euler_err_fas[simp]: \"length (euler_err_fas X0 h CX) = length X0\"\n  by (auto simp: euler_err_fas_def)\n\nlemma length_euler_floatarith[simp]: \"length (euler_fas X0 h CX) = 2 * length X0\"\n  by (auto simp: euler_fas_def)\n\nlemma length_rk2_fas[simp]: \"length (rk2_fas rkp x0 h cx s2) = 2 * length x0\"\n  by (simp add: rk2_fas_def)\n\nlemma open_safe: \"open Csafe\"\nproof -\n  have leq: \"list_updates [0..<DIM('a)] (list_of_eucl x) (replicate DIM('a) 0) = list_of_eucl x\" for x::'a\n    by (auto intro!: nth_equalityI simp: list_updates_nth)\n  have \"(Csafe::'a set) =\n    (if length ode_e = DIM('a) \\<and> max_Var_floatariths ode_e \\<le> DIM('a) \\<and> max_Var_form safe_form \\<le> DIM('a) \\<and> open_form safe_form then\n      {x. interpret_form safe_form (list_of_eucl x)} \\<inter>\n      {x. isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl x)}\n    else {})\"\n    by (auto simp: Csafe_def safe_def)\n  also have \"open \\<dots>\"\n    apply (auto intro!: open_Int)\n    subgoal premises prems using open_form[OF prems(4), where 'a='a, of \"[0..<DIM('a)]\" \"replicate (DIM('a)) 0\"]\n      by (auto simp: leq)\n    subgoal\n      apply (rule isFDERIV_open)\n      apply (rule order_trans)\n      apply assumption\n      apply arith\n      done\n    done\n  finally show ?thesis .\nqed\n\nlemma safeD:\n  fixes x::\"'a::executable_euclidean_space\"\n  assumes \"x \\<in> Csafe\"\n  shows \"interpret_form safe_form (list_of_eucl x)\"\n    and safe_isFDERIV: \"isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl x)\"\n  using assms\n  by (auto simp: Csafe_def safe_def)\n\nlemma\n  fixes x::\"'a::executable_euclidean_space\"\n  shows safe_max_Var: \"x \\<in> Csafe \\<Longrightarrow> max_Var_floatariths ode_e \\<le> DIM('a)\"\n    and safe_length: \"x \\<in> Csafe \\<Longrightarrow> length ode_e = DIM('a)\"\n    and safe_max_Var_form: \"x \\<in> Csafe \\<Longrightarrow> max_Var_form safe_form \\<le> DIM('a)\"\n  by (auto simp: safe_def Csafe_def)\n\nlemma safe_isFDERIV_append:\n  fixes x::\"'a::executable_euclidean_space\"\n  shows \"x \\<in> Csafe \\<Longrightarrow> isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl x @ xs)\"\n  apply (rule isFDERIV_max_Var_congI)\n   apply (rule safe_isFDERIV)\n   apply assumption\n  using safe_max_Var[of x]\n  by (auto simp: nth_append)\n\nlemma ode_d_raw_0:\n  assumes \"x \\<in> Csafe\"\n  shows \"(ode has_derivative ode_d_raw 0 x d) (at x)\"\n  using assms safe_max_Var[OF assms] safe_length[OF assms]\n  unfolding ode_def ode_d_raw_def ode_d_expr_def\n  apply (intro interpret_floatarith_FDERIV_floatariths[THEN has_derivative_eq_rhs])\n     apply (auto simp: isFDERIV_def FDERIV_n_floatariths_def safe_max_Var nth_append\n      max_Var_floatariths_Max Csafe_def safe_def\n      intro!: arg_cong[where f=eucl_of_list] ext interpret_floatariths_FDERIV_floatariths_cong\n        freshs_floatariths_max_Var_floatarithsI \n        max_Var_floatarith_le_max_Var_floatariths[le])\n  apply (rule interpret_floatariths_max_Var_cong)\n  apply (auto simp: max_Var_floatariths_Max Max_gr_iff nth_append\n      dest!: less_le_trans[OF _ max_Var_floatarith_DERIV_floatarith])\n   apply (drule max_Var_floatariths_lessI) apply simp\n  apply (auto dest!: less_le_trans[OF _ safe_max_Var[OF assms]])\n   apply (drule max_Var_floatariths_lessI) apply simp\n  apply (auto dest!: less_le_trans[OF _ safe_max_Var[OF assms]])\n  done\n\nlemma not_fresh_odeD: \"x \\<in> Csafe \\<Longrightarrow> \\<not>fresh_floatariths ode_e i \\<Longrightarrow> i < DIM('a)\" for x::\"'a::executable_euclidean_space\"\n  using fresh_floatariths_max_Var[of ode_e i] safe_max_Var[of x] by arith\n\nlemma safe_isnFDERIV:\n  fixes x::\"'a::executable_euclidean_space\"\n  assumes \"x \\<in> Csafe\"\n  shows \"isnFDERIV DIM('a) ode_e [0..<DIM('a)] [DIM('a)..<2 * DIM('a)] (list_of_eucl x @ ys) n\"\n  apply (rule isFDERIV_imp_isnFDERIV)\n     apply (rule isFDERIV_max_Var_congI)\n      apply (rule safe_isFDERIV[OF assms])\n  using safe_max_Var[OF assms] safe_length[OF assms]\n  by (auto simp: nth_append)\n\nlemma safe_isnFDERIVI:\n  assumes \"(eucl_of_list xs::'a::executable_euclidean_space) \\<in> Csafe\"\n  assumes [simp]: \"length xs = DIM('a)\" \"length ds = DIM('a)\"\n  shows \"isnFDERIV DIM('a) ode_e [0..<DIM('a)] [DIM('a)..<2 * DIM('a)] (xs@ds) n\"\nproof -\n  have \"isnFDERIV DIM('a) ode_e [0..<DIM('a)] [DIM('a)..<2 * DIM('a)] (list_of_eucl (eucl_of_list xs::'a)@ds) n\"\n    by (rule safe_isnFDERIV; fact)\n  also\n  have \"list_of_eucl (eucl_of_list xs::'a) = xs\"\n    by (auto intro!: nth_equalityI)\n  finally show ?thesis .\nqed\n\nlemma dest_Num_eq_Some_iff[simp]: \"dest_Num_fa fa = (Some x) \\<longleftrightarrow> fa = floatarith.Num x\"\n  by (cases fa) auto\n\nlemma ode_d_raw_Suc:\n  includes floatarith_notation\n  assumes \"x \\<in> Csafe\"\n  shows \"((\\<lambda>x. ode_d_raw n x d d) has_derivative ode_d_raw (Suc n) x d) (at x)\"\nproof -\n  let ?shift = \"\\<lambda>x. floatarith.Var (if 2 * DIM('a) \\<le> x \\<and> x < 3 * DIM('a) then x - DIM('a) else x)\"\n  have subst_ode_e[simp]: \"map (subst_floatarith ?shift) ode_e = ode_e\"\n    apply (auto intro!: nth_equalityI)\n    apply (rule subst_floatarith_Var_max_Var_floatarith)\n    by (auto dest!: max_Var_floatariths_lessI\n        less_le_trans[OF _ safe_max_Var[OF assms]])\n  have map_shift[simp]:\n    \"(map ?shift [DIM('a)..<2 * DIM('a)]) = (map floatarith.Var [DIM('a)..<2 * DIM('a)])\"\n    \"(map ?shift [2 * DIM('a)..<3 * DIM('a)]) =\n        (map floatarith.Var [DIM('a)..<2 * DIM('a)])\"\n    by (auto intro!: nth_equalityI)\n\n  show ?thesis\n    unfolding ode_def ode_d_raw_def ode_d_expr_def\n    apply (rule interpret_floatarith_FDERIV_floatariths_append[THEN has_derivative_eq_rhs])\n    subgoal\n    proof -\n      let ?shift = \"\\<lambda>x. if 2 * DIM('a) \\<le> x \\<and> x < 3 * DIM('a) then x - DIM('a) else x\"\n      have mv: \"max_Var_floatariths\n          (FDERIV_floatariths (FDERIV_n_floatariths ode_e [0..<DIM('a)] (map floatarith.Var [DIM('a)..<2 * DIM('a)]) n)\n          [0..<DIM('a)] (map floatarith.Var [2 * DIM('a)..<3 * DIM('a)])) \\<le> 3 * DIM('a)\"\n        and mv2: \"max_Var_floatariths\n              (FDERIV_floatariths (FDERIV_n_floatariths ode_e [0..<DIM('a)] (map floatarith.Var [DIM('a)..<2 * DIM('a)]) n)\n                [0..<DIM('a)] (map floatarith.Var [DIM('a)..<2 * DIM('a)])) \\<le> 2 * DIM('a)\"\n        by (auto intro!:\n            max_Var_floatarith_FDERIV_floatariths[le]\n            max_Var_floatarith_FDERIV_n_floatariths[le]\n            safe_max_Var[OF assms, le])\n      have eq: \"(map (subst_floatarith (\\<lambda>i. floatarith.Var (if 2 * DIM('a) \\<le> i \\<and> i < 3 * DIM('a) then i - DIM('a) else i)))\n       ((FDERIV_floatariths (FDERIV_n_floatariths ode_e [0..<DIM('a)] (map floatarith.Var [DIM('a)..<2 * DIM('a)]) n)\n         [0..<DIM('a)] (map floatarith.Var [2 * DIM('a)..<3 * DIM('a)])))) =\n      (FDERIV_floatariths (FDERIV_n_floatariths ode_e [0..<DIM('a)] (map floatarith.Var [DIM('a)..<2 * DIM('a)]) n)\n          [0..<DIM('a)] (map floatarith.Var [DIM('a)..<2 * DIM('a)]))\"\n        apply (rule nth_equalityI)\n         apply auto defer\n        apply (subst subst_floatarith_Var_FDERIV_floatarith[where 'a='a], force, force, force)\n        apply (subst subst_floatarith_Var_FDERIV_n_nth[where 'a='a], force, force, force, force)\n        by (simp add: o_def)\n      show ?thesis\n        apply (subst isFDERIV_subst_Var_floatarith[symmetric, where s=\"?shift\"])\n        subgoal by (auto intro!: mv[le] max_Var_floatariths_fold_const_fa[le])\n        subgoal by (auto simp: nth_append)\n        subgoal by (auto intro!: mv[le])\n        subgoal\n        proof -\n          have \"isnFDERIV DIM('a) ode_e [0..<DIM('a)] [DIM('a)..<2*DIM('a)] (list_of_eucl x @ list_of_eucl d) (Suc (Suc n))\"\n            apply (rule safe_isnFDERIVI)\n            using assms\n            by auto\n          from this[simplified, THEN conjunct1]\n          show ?thesis\n            unfolding eq isnFDERIV.simps\n            apply (rule isFDERIV_max_Var_congI)\n            apply (frule less_le_trans[OF _ mv2])\n            apply (auto simp: nth_append)\n            done\n        qed\n        done\n    qed\n    subgoal\n      by (auto intro!: safe_max_Var[OF assms, le]\n          max_Var_floatarith_FDERIV_floatariths[le]\n          max_Var_floatarith_FDERIV_n_floatariths[le])\n    subgoal using safe_length assms by simp\n    subgoal\n      apply (auto simp add: nth_append\n          intro!: ext arg_cong[where f=eucl_of_list] interpret_floatariths_FDERIV_floatariths_cong\n          freshs_floatariths_max_Var_floatarithsI\n          safe_max_Var[OF assms, le]\n          max_Var_floatarith_FDERIV_floatariths[le]\n          max_Var_floatarith_FDERIV_n_floatariths[le])\n      apply (rule nth_equalityI)\n       apply auto\n      subgoal premises prems for h i j\n      proof -\n        have *: \"(list_of_eucl x @ list_of_eucl d @ list_of_eucl d @ list_of_eucl h) =\n        (map (\\<lambda>i. interpret_floatarith (?shift i)\n             (list_of_eucl x @ list_of_eucl d @ list_of_eucl d @ list_of_eucl h)) [0..<4 * DIM('a)])\"\n          by (auto intro!: nth_equalityI simp: nth_append)\n        have mv_le: \"max_Var_floatarith\n                (DERIV_floatarith j\n                  (FDERIV_floatarith\n                    (FDERIV_n_floatariths ode_e [0..<DIM('a)] (map floatarith.Var [DIM('a)..<2 * DIM('a)]) n ! i)\n                    [0..<DIM('a)] (map floatarith.Var [DIM('a)..<2 * DIM('a)]))) \\<le>\n                2 * DIM('a)\"\n          \"max_Var_floatarith\n     (DERIV_floatarith j\n       (FDERIV_floatarith (FDERIV_n_floatariths ode_e [0..<DIM('a)] (map floatarith.Var [DIM('a)..<2 * DIM('a)]) n ! i)\n         [0..<DIM('a)] (map floatarith.Var [2 * DIM('a)..<3 * DIM('a)])))\n      \\<le> 3 * DIM('a)\"\n          by (auto intro!: prems\n              safe_max_Var[OF assms, le]\n              max_Var_floatarith_le_max_Var_floatariths_nth[le]\n              max_Var_floatarith_DERIV_floatarith[le]\n              max_Var_floatarith_FDERIV_floatarith[le]\n              max_Var_floatarith_FDERIV_n_floatariths[le])\n        show ?thesis\n          apply (subst *)\n          apply (subst interpret_floatarith_subst_floatarith[symmetric])\n           apply (auto intro!: prems mv_le[le])\n          apply (subst subst_floatarith_Var_DERIV_floatarith, use prems in force)\n          apply (subst subst_floatarith_Var_FDERIV_floatarith[where 'a='a], force, force, force)\n          apply (subst subst_floatarith_Var_FDERIV_n_nth[where 'a='a], force, force, force, use prems in force)\n          apply (auto simp: o_def prems nth_append intro!: interpret_floatarith_max_Var_cong\n              dest!: less_le_trans[OF _ mv_le(1)])\n          done\n      qed\n      done\n    done\nqed\n\nlift_definition ode_d::\"nat \\<Rightarrow> 'a::executable_euclidean_space \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow>\\<^sub>L 'a\" is\n  \"\\<lambda>n x dn d. if x \\<in> Csafe\n    then ode_d_raw n x dn d\n    else 0\"\n  subgoal for n x dn\n    apply (cases n)\n    subgoal\n      by (cases \"x \\<in> Csafe\")\n       (auto intro: has_derivative_bounded_linear[OF ode_d_raw_0])\n    subgoal for n'\n      apply (cases \"x \\<in> Csafe\")\n      subgoal\n        apply (simp del: isnFDERIV.simps)\n        apply (rule has_derivative_bounded_linear)\n        apply (rule ode_d_raw_Suc)\n        apply assumption\n        done\n      subgoal by (simp del: isnFDERIV.simps)\n      done\n    done\n  done\n\ndefinition \"ode_d1 x = ode_d 0 x 0\"\n\nlemma ode_has_derivative:\n  assumes \"isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl x)\"\n  assumes \"(x::'a::executable_euclidean_space) \\<in> Csafe\"\n  shows \"(ode has_derivative ode_d1 x) (at x)\"\nproof -\n  from assms(1) have *: \"x \\<in> Csafe \\<Longrightarrow> isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl x @ list_of_eucl (0::'a))\"\n    apply (rule isFDERIV_max_Var_congI)\n    using safe_max_Var[of x]\n    by (auto simp: nth_append)\n  show ?thesis\n    unfolding ode_d1_def\n    apply (transfer fixing: x)\n    apply (rule ode_d_raw_0[THEN has_derivative_eq_rhs])\n    by (auto intro!: * assms)\nqed\n\nlemma ode_has_derivative_safeI:\n  assumes \"x \\<in> Csafe\"\n  shows \"(ode has_derivative ode_d1 x) (at x)\"\n  using assms\n  by (auto simp: safe_def Csafe_def intro!: ode_has_derivative)\n\nlemma ode_d1_eq: \"ode_d1 x = ode_d 0 x j\"\n  unfolding ode_d1_def\nproof (transfer fixing: x j, rule ext, cases \"x \\<in> Csafe\", clarsimp_all, goal_cases)\n  case (1 d)\n  have \"isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl x @ list_of_eucl (0::'a)) =\n    isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl x @ list_of_eucl j)\"\n    by (rule isFDERIV_max_Var_cong)\n       (auto dest!: less_le_trans[OF _ safe_max_Var[OF 1]] simp: nth_append)\n  moreover\n  have \"interpret_floatariths (FDERIV_floatariths ode_e [0..<DIM('a)] (map floatarith.Var [2 * DIM('a)..<3 * DIM('a)]))\n     (list_of_eucl x @ list_of_eucl (0::'a) @ list_of_eucl d) =\n    interpret_floatariths (FDERIV_floatariths ode_e [0..<DIM('a)] (map floatarith.Var [2 * DIM('a)..<3 * DIM('a)]))\n     (list_of_eucl x @ list_of_eucl j @ list_of_eucl d)\"\n    using 1\n    by (intro interpret_floatariths_fresh_cong)\n      (auto dest!: not_fresh_FDERIV_floatariths not_fresh_odeD\n        simp: nth_append)\n  ultimately show ?case\n    by (auto simp: ode_d_raw_def ode_d_expr_def)\nqed\n\nlemma eventually_Collect_open:\n  assumes \"P x\" \"open (Collect P)\"\n  shows \"eventually P (at x)\"\n  using assms(1) assms(2) eventually_at_topological by blast\n\nlemma ode_d_has_derivative:\n  assumes \"x \\<in> Csafe\"\n  shows \"((\\<lambda>x. ode_d n x d d) has_derivative ode_d (Suc n) x d) (at x)\"\n  apply (transfer fixing: n d x)\n  using assms\n  apply (simp del: isnFDERIV.simps)\n  apply (rule if_eventually_has_derivative)\n  subgoal by (rule ode_d_raw_Suc)\n  subgoal\n    by (rule eventually_Collect_open)\n      (auto simp: safe_max_Var[OF assms] open_safe intro!: safe_max_Var[OF assms, le])\n  subgoal by (simp add: isnFDERIV.simps)\n  subgoal by simp\n  done\n\nlemma ode_d1_has_derivative:\n  assumes \"x \\<in> Csafe\"\n  shows \"(ode_d1 has_derivative ode_d (Suc 0) x) (at x)\"\nproof (rule blinfun_has_derivative_componentwiseI[THEN has_derivative_eq_rhs])\n  fix i::'a assume \"i \\<in> Basis\"\n  show \"((\\<lambda>x. blinfun_apply (ode_d1 x) i) has_derivative ode_d (Suc 0) x i) (at x)\"\n    unfolding ode_d1_eq[of _ i]\n    apply (rule ode_d_has_derivative)\n    apply fact\n    done\nnext\n  show \"(\\<lambda>xa. \\<Sum>i\\<in>Basis. blinfun_scaleR (blinfun_inner_left i) (blinfun_apply (ode_d (Suc 0) x i) xa)) = ode_d (Suc 0) x\"\n    apply (rule ext)\n    apply (auto intro!: ext euclidean_eqI[where 'a='a] blinfun_euclidean_eqI\n        simp: blinfun.bilinear_simps inner_sum_left inner_Basis if_distrib if_distribR\n        sum.delta' cong: if_cong)\n    apply (rule arg_cong[where f=\"\\<lambda>x. x \\<bullet> b\" for b])\n  proof goal_cases\n    case (1 j i b)\n    from eventually_isFDERIV[where params=Nil, simplified, OF safe_isFDERIV[OF assms] order_trans[OF safe_max_Var[of x]]]\n    have \"\\<forall>\\<^sub>F x in at x. isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl x)\"\n      by (auto simp: assms)\n    then obtain S where S: \"x \\<in> S\" \"open S\" \"S \\<subseteq> Csafe\"\n      and \"\\<And>xa. xa \\<in> S \\<Longrightarrow> xa \\<noteq> x \\<Longrightarrow> isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl xa)\"\n      using assms open_safe safe_isFDERIV by auto\n    then have S_FDERIV: \"\\<And>s. s \\<in> S \\<Longrightarrow>\n      isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl s)\"\n      using safe_isFDERIV[OF assms]\n      by auto\n    interpret second_derivative_on_open \"ode\" ode_d1 \"ode_d (Suc 0) x\" x S\n    proof standard\n      fix a assume \"a \\<in> S\"\n      with S have \"a \\<in> Csafe\" by auto\n      from S_FDERIV[OF \\<open>a \\<in> S\\<close>]\n      have \"isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl a)\" by simp\n      then have \"isFDERIV DIM('a) [0..<DIM('a)] ode_e (list_of_eucl a)\"\n        apply (rule isFDERIV_max_Var_congI)\n        using safe_max_Var[of x]\n        by (auto simp: nth_append)\n      then show \"(ode has_derivative blinfun_apply (ode_d1 a)) (at a)\"\n        using \\<open>a \\<in> Csafe\\<close>\n        by (rule ode_has_derivative)\n    next\n      fix i\n      interpret linear \"ode_d (Suc 0) x\"\n      proof\n        fix y z\n        have 1: \"((\\<lambda>x. ode_d 0 x (y + z) (y + z)) has_derivative ode_d (Suc 0) x (y + z)) (at x)\"\n          apply (rule ode_d_has_derivative)\n          apply (rule assms)\n          done\n        have *: \"ode_d 0 x (y + z) (y + z) = ode_d 0 x y y + ode_d 0 x z z\" for x\n          by (auto simp: blinfun.bilinear_simps ode_d1_eq[symmetric])\n        have 2: \"((\\<lambda>x. ode_d 0 x (y + z) (y + z)) has_derivative\n            ode_d (Suc 0) x y + ode_d (Suc 0) x z) (at x)\"\n          apply (subst *)\n          apply (rule derivative_eq_intros)\n            apply (rule ode_d_has_derivative)\n            apply fact\n           apply (rule ode_d_has_derivative)\n           apply fact\n          apply (auto simp: blinfun.bilinear_simps)\n          done\n        from has_derivative_unique[OF 1 2]\n        show \"ode_d (Suc 0) x (y + z) = ode_d (Suc 0) x y + ode_d (Suc 0) x z\"\n          by (auto intro!: blinfun_eqI)\n      next\n        fix r y\n        have 1: \"((\\<lambda>x. ode_d 0 x (r *\\<^sub>R y) (r *\\<^sub>R y)) has_derivative ode_d (Suc 0) x (r *\\<^sub>R y)) (at x)\"\n          by (rule ode_d_has_derivative; fact)\n        have *: \"ode_d 0 x (r *\\<^sub>R y) (r *\\<^sub>R y) = r *\\<^sub>R ode_d 0 x y y\" for x\n          by (auto simp: blinfun.bilinear_simps ode_d1_eq[symmetric])\n        have 2: \"((\\<lambda>x. ode_d 0 x (r *\\<^sub>R y) (r *\\<^sub>R y)) has_derivative\n            r *\\<^sub>R ode_d (Suc 0) x y) (at x)\"\n          apply (subst *)\n          apply (rule derivative_eq_intros)\n          apply (rule ode_d_has_derivative; fact)\n          apply (auto simp: blinfun.bilinear_simps)\n          done\n        from has_derivative_unique[OF 1 2]\n        show \"(ode_d (Suc 0) x (r *\\<^sub>R y)) = (r *\\<^sub>R ode_d (Suc 0) x y)\"\n          by (auto intro!: blinfun_eqI)\n      qed\n      show \"((\\<lambda>x. blinfun_apply (ode_d1 x) i) has_derivative blinfun_apply (ode_d (Suc 0) x i))\n          (at x)\"\n        apply (subst euclidean_representation[of i, symmetric])\n        apply (subst (2) euclidean_representation[of i, symmetric])\n        apply (auto simp: blinfun.bilinear_simps)\n        apply (rule derivative_eq_intros)\n         apply (rule derivative_eq_intros)\n          apply (subst_tac j = i in ode_d1_eq)\n          apply (rule ode_d_has_derivative)\n          apply (rule assms)\n        apply force\n        apply (auto simp: blinfun.bilinear_simps[symmetric]\n            intro!: ext euclidean_eqI[where 'a='a] blinfun_euclidean_eqI)\n        apply (rule arg_cong[where f=\"\\<lambda>x. x \\<bullet> b\" for b])\n        by (auto simp: sum scaleR)\n    next\n      show \"x \\<in> S\" \"open S\" by fact+\n    qed\n    show ?case\n      by (rule symmetric_second_derivative) fact\n  qed\nqed\n\nlemma ode_d1_has_derivative_safeI:\n  assumes \"x \\<in> Csafe\"\n  shows \"(ode_d1 has_derivative ode_d (Suc 0) x) (at x)\"\n  apply (rule ode_d1_has_derivative)\n  using assms by (auto simp: safe_def)\n\nsublocale c1_on_open_euclidean ode ode_d1 Csafe\n  by unfold_locales\n    (auto simp: continuous_on_eq_continuous_within at_within_open[OF _ open_safe]\n      intro!: derivative_eq_intros  continuous_at_imp_continuous_on open_safe\n        ode_has_derivative_safeI continuous_blinfun_componentwiseI\n        has_derivative_continuous ode_d1_has_derivative_safeI)\n\ndefinition ivlflows ::\n    \"'a::executable_euclidean_space sctn set\n     \\<Rightarrow> (('a \\<times> 'a \\<Rightarrow>\\<^sub>L 'a) set\n         \\<Rightarrow> ('a \\<times> 'a \\<Rightarrow>\\<^sub>L 'a) set \\<times> ('a \\<times> 'a \\<Rightarrow>\\<^sub>L 'a) set)\n        \\<Rightarrow> ('a \\<times> 'a \\<Rightarrow>\\<^sub>L 'a) set \\<Rightarrow> 'a sctn \\<Rightarrow> bool\"\nwhere \"ivlflows stops stopcont trap rsctn =\n  (\\<forall>ivl. ivl \\<subseteq> \\<Union>(plane_of ` stops) \\<times> UNIV \\<longrightarrow>\n      ivl \\<subseteq> (snd (stopcont ivl)) \\<and>\n      fst (stopcont ivl) \\<subseteq> snd (stopcont ivl) \\<and>\n      (fst (stopcont ivl)) \\<subseteq> sbelow_halfspace rsctn \\<times> UNIV \\<and>\n      (snd (stopcont ivl)) \\<subseteq> sbelow_halfspace rsctn \\<times> UNIV \\<and>\n      flowsto (ivl) {0..} ((snd (stopcont ivl))) ((fst (stopcont ivl)) \\<union> trap))\"\n\nlift_definition ode_d2::\"'a::executable_euclidean_space \\<Rightarrow> 'a \\<Rightarrow>\\<^sub>L 'a \\<Rightarrow>\\<^sub>L 'a\" is \"\\<lambda>x.\n  if x \\<in> Csafe then ode_d 1 x else (\\<lambda>_. 0)\"\n  by (auto intro!: has_derivative_bounded_linear ode_d1_has_derivative)\n\ndefinition ode_na::\"real \\<times> _ \\<Rightarrow> _\" where \"ode_na = (\\<lambda>a. ode (snd a))\"\n\ndefinition ode_d_na::\"real \\<times> _ \\<Rightarrow> (real \\<times> _) \\<Rightarrow>\\<^sub>L _\" where \"ode_d_na = (\\<lambda>tx. ode_d1 (snd tx) o\\<^sub>L snd_blinfun)\"\ndefinition ode_d2_na::\"real \\<times> _ \\<Rightarrow> (real \\<times> _) \\<Rightarrow>\\<^sub>L (real \\<times> _) \\<Rightarrow>\\<^sub>L _\" where\n  \"ode_d2_na = (\\<lambda>tx. flip_blinfun (flip_blinfun (ode_d2 (snd tx) o\\<^sub>L snd_blinfun) o\\<^sub>L snd_blinfun))\"\n\ndefinition \"euler_incr_fas' D = (map fold_const_fa (euler_incr_fas (map floatarith.Var [0..<D]) (floatarith.Var (D))\n      (map floatarith.Var [Suc D..<Suc (2*D)])))\"\ndefinition \"euler_fas' D = (map fold_const_fa (euler_fas  (map floatarith.Var [0..<D])\n    (floatarith.Var (2*D)) (map floatarith.Var [D..<2*D])))\"\ndefinition \"rk2_fas' D = (map fold_const_fa (rk2_fas\n    (floatarith.Var (2*D))\n    (map floatarith.Var [0..<D])\n    (floatarith.Var (2*D+1))\n    (map floatarith.Var [D..<2*D])\n    (floatarith.Var (2*D+2))))\"\nlemma [autoref_rules]: \"(euler_incr_fas', euler_incr_fas') \\<in> nat_rel \\<rightarrow> fas_rel\"\n  \"(euler_fas', euler_fas') \\<in> nat_rel \\<rightarrow> fas_rel\"\n  \"(rk2_fas', rk2_fas') \\<in> nat_rel \\<rightarrow> fas_rel\"\n  by auto\n\ndefinition \"solve_poincare_fas n =\n  (let D = length ode_e in\n  map floatarith.Var [0..<D] @ concat (map (\\<lambda>i \\<comment> \\<open>(row)\\<close>. map (\\<lambda>j \\<comment> \\<open>(column)\\<close>.\n    (if i \\<noteq> n then floatarith.Var (D + i * D + j) - (floatarith.Var(D + n * D + j) * (ode_e ! i) / (ode_e ! n))\n    else 0)\n  ) [0..<D]) [0..<D]))\"\n\nend\n\ndefinition \"nonempty X \\<longleftrightarrow> X \\<noteq> {}\"\n\ndefinition pad_zeroes :: \"nat \\<Rightarrow> real list set \\<Rightarrow> real list set\"\n  where [simp]: \"pad_zeroes n X = (\\<lambda>xs. xs @ replicate n (0::real)) ` X\"\n\nlocale approximate_sets_ode = approximate_sets where ops = ops + ode_operations\n  where ode_ops = ode_ops\n  for ops:: \"'b approximate_set_ops\"\n    and ode_ops::\"ode_ops\"\nbegin\n\ndefinition \"D = (length ode_e)\"\ndefinition \"ode_slp = slp_of_fas ode_e\"\ndefinition \"euler_slp = slp_of_fas (euler_fas' D)\"\ndefinition \"euler_incr_slp = slp_of_fas (euler_incr_fas' D)\"\ndefinition \"rk2_slp = slp_of_fas (rk2_fas' D)\"\ndefinition \"solve_poincare_slp = map (\\<lambda>i. slp_of_fas (map fold_const_fa (solve_poincare_fas i))) [0..<D]\"\n\ndefinition safe_set\n  where \"safe_set (X::'a::executable_euclidean_space set) = do {\n    b1 \\<leftarrow> approx_form_spec safe_form (list_of_eucl ` X);\n    b2 \\<leftarrow> isFDERIV_spec D [0..<D] ode_e (list_of_eucl ` X);\n    RETURN (b1 \\<and> b2)\n  }\"\n\ndefinition \"wd TYPE('a::executable_euclidean_space) \\<longleftrightarrow> length ode_e = DIM('a)\"\n  \\<comment> \\<open>TODO: should be renamed\\<close>\n\nlemma open_safe_form[intro, simp]: \"open_form safe_form\"\n  by (auto simp: safe_form_def)\n\nlemma max_Var_floatariths_ode_e_le: \"max_Var_floatariths ode_e \\<le> D\"\n  and max_Var_form_safe_form_le: \"max_Var_form safe_form \\<le> D\"\n  using max_Var_ode_expression[of ode_ops] max_Var_form_safe_form_expr[of ode_ops]\n  by (auto simp: ode_e_def safe_form_def D_def)\n\nlemma wdD:\n  assumes \"wd TYPE('a::executable_euclidean_space)\"\n  shows \"length ode_e = DIM('a)\" \"max_Var_floatariths ode_e \\<le> DIM('a)\"\n    \"max_Var_form safe_form \\<le> DIM('a)\"\n    \"ode_e \\<noteq> []\" \"D = DIM('a)\"\n  using assms max_Var_floatariths_ode_e_le max_Var_form_safe_form_le\n  by (auto simp: wd_def D_def safe_form_def ode_e_def)\n\ndefinition \"mk_safe (X::'a::executable_euclidean_space set) = do {\n    ASSERT (wd TYPE('a));\n    s \\<leftarrow> safe_set (X:::appr_rel::'a set);\n    if s then RETURN (X:::appr_rel) else SUCCEED\n  }\"\n\ndefinition\n  \"mk_safe_coll X = do {\n      XS \\<leftarrow> (sets_of_coll X);\n      FORWEAK XS (RETURN op_empty_coll)\n        (\\<lambda>x. do {\n          s \\<leftarrow> mk_safe (x);\n          RETURN (mk_coll s)\n        })\n        (\\<lambda>b c. RETURN (b \\<union> c))\n    }\"\n\ndefinition ode_set::\"'a::executable_euclidean_space set \\<Rightarrow> 'a set nres\" where \"ode_set X = do {\n  _ \\<leftarrow> mk_safe X;\n  approx_slp_appr ode_e ode_slp (list_of_eucl ` (X))\n  }\"\n\ndefinition\n  \"Picard_step X0 t0 h X = SPEC (\\<lambda>R.\n    case R of\n      Some R \\<Rightarrow>\n        nonempty R \\<and> compact R \\<and> (R \\<subseteq> Csafe) \\<and>\n        (\\<forall>x0 \\<in> X0. \\<forall>h'\\<in>{t0 .. t0 + h}. \\<forall>phi\\<in>cfuncset t0 h' X.\n          x0 + integral {t0 .. h'} (\\<lambda>t. ode (phi t)) \\<in> R)\n      | None \\<Rightarrow> True)\"\n\nlemmas [refine_vcg_def] = approx_form_spec_def isFDERIV_spec_def\n\nlemma safe_set_spec[THEN order.trans, refine_vcg]:\n  assumes \"wd TYPE('a::executable_euclidean_space)\"\n  shows \"safe_set X \\<le> SPEC (\\<lambda>r. r \\<longrightarrow> (X::'a set) \\<subseteq> Csafe)\"\n  unfolding safe_set_def\n  by (refine_vcg) (auto simp del: isnFDERIV.simps simp add: Csafe_def safe_def replicate_eq_list_of_eucl_zero wdD[OF \\<open>wd _\\<close>])\n\n\ndefinition Picard_step_ivl :: \"'a::executable_euclidean_space set \\<Rightarrow> real \\<Rightarrow> real \\<Rightarrow> 'a set \\<Rightarrow> 'a set option nres\" where\n  \"Picard_step_ivl X0 t0 h X = do {\n    ASSERT (0 \\<le> h);\n    ASSERT (wd TYPE('a));\n    let H = lv_ivl [0] [h];\n    let D = DIM('a);\n    let env = concat ` listset [list_of_eucl ` X0, H, list_of_eucl ` X];\n    env \\<leftarrow> approx_slp_spec (euler_incr_fas' D) D euler_incr_slp env;\n    (case env of\n      Some env \\<Rightarrow>\n        do {\n          (l, u) \\<leftarrow> op_ivl_rep_of_set ((eucl_of_list ` env::'a set));\n          ASSERT (l \\<le> u);\n          r \\<leftarrow> mk_safe ({l .. u}:::appr_rel);\n          RETURN (Some (r:::appr_rel))\n        }\n    | None \\<Rightarrow> RETURN None)\n  }\"\n\ndefinition \"do_widening_spec (i::nat) = SPEC (\\<lambda>b::bool. True)\"\n\nprimrec P_iter::\"'a::executable_euclidean_space set \\<Rightarrow> real \\<Rightarrow> nat \\<Rightarrow> ('a) set \\<Rightarrow> ('a) set option nres\" where\n  \"P_iter X0 h 0 X = do {\n    let _ = trace_set (ST ''P_iter failed (0)'') (Some (X));\n    RETURN None\n  }\"\n| \"P_iter X0 h (Suc i) X = do {\n    ASSERT (0 \\<le> h);\n    (l, u) \\<leftarrow> op_ivl_rep_of_set (X);\n    ASSERT (l \\<le> u);\n    ivl \\<leftarrow> mk_safe ({l .. u}:::appr_rel);\n    X' \\<leftarrow> Picard_step_ivl X0 0 h ivl;\n    (case X' of\n      Some X' \\<Rightarrow> do {\n        (l', u') \\<leftarrow> op_ivl_rep_of_set (X');\n        do_widening \\<leftarrow> do_widening_spec i;\n        let l' = inf l' l - (if do_widening then abs (l' - l) else 0);\n        let u' = sup u' u + (if do_widening then abs (u' - u) else 0);\n        ASSERT (l' \\<le> u');\n        ivl' \\<leftarrow> mk_safe {l' .. u'};\n        if (l \\<le> l' \\<and> u' \\<le> u) then RETURN (Some ivl)\n        else P_iter X0 h i ivl'\n      }\n    | None \\<Rightarrow> do {\n        let _ = trace_set (ST ''P_iter failed (Picard_step)'') (Some (X));\n        RETURN None\n      }\n    )\n  }\"\n\n\ncontext fixes m::\"('a::executable_euclidean_space set \\<Rightarrow> real \\<Rightarrow> real \\<Rightarrow> 'a set \\<Rightarrow> ('a set \\<times> 'c) option nres)\"\nbegin\n\nprimrec cert_stepsize::\n  \"'a set \\<Rightarrow> real \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> (real \\<times> 'a set \\<times> 'a set \\<times> 'c) nres\"\nwhere\n  \"cert_stepsize X0 h n 0 = do { let _ = trace_set (ST ''cert_stepsize failed'') (Some (X0)); SUCCEED}\"\n| \"cert_stepsize X0 h n (Suc i) = do {\n    (l, u) \\<leftarrow> op_ivl_rep_of_set (X0);\n    ASSERT (0 \\<le> h);\n    ASSERT (l \\<le> u);\n    ivl \\<leftarrow> mk_safe {l .. u};\n    ASSERT (ivl \\<noteq> {});\n    X' \\<leftarrow> P_iter X0 h n ivl;\n    case X' of Some X' \\<Rightarrow>\n      do {\n        r1 \\<leftarrow> m X0 h h X';\n        r2 \\<leftarrow> m X0 0 h X';\n        (case (r1, r2) of\n          (Some (res, err), Some (res_ivl, _)) \\<Rightarrow>\n            do {\n              _ \\<leftarrow> mk_safe res;\n              _ \\<leftarrow> mk_safe res_ivl;\n              RETURN (h, res, res_ivl, err)\n            }\n        | _ \\<Rightarrow>\n            do {\n              let _ = trace_set (ST ''cert_stepsize method failed'') (Some (X'));\n              cert_stepsize X0 (h / 2) n i\n            }\n       )\n      }\n    | None \\<Rightarrow> cert_stepsize X0 (h / 2) n i\n    }\"\nend\n\ndefinition \"one_step_method m \\<longleftrightarrow> (\\<forall>X0 CX hl hu. m X0 hl hu CX \\<le>\n    SPEC (\\<lambda>r. case r of None \\<Rightarrow> True | Some (res, err) \\<Rightarrow> nonempty res \\<and>\n      (\\<forall>x0 \\<in> X0. \\<forall>h \\<in> {hl .. hu}. x0 \\<in> Csafe \\<longrightarrow> h \\<ge> 0 \\<longrightarrow> h \\<in> existence_ivl0 x0 \\<longrightarrow>\n      (\\<forall>h' \\<in> {0 .. h}. flow0 x0 h' \\<in> CX) \\<longrightarrow> x0 + h *\\<^sub>R ode x0 \\<in> CX \\<longrightarrow> flow0 x0 h \\<in> res)))\"\n\ndefinition \"one_step X0 h m = do {\n  CHECKs ''one_step nonneg'' (0 < h);\n  its \\<leftarrow> iterations_spec;\n  halvs \\<leftarrow> halve_stepsizes_spec;\n  (h, res, res_ivl, err) \\<leftarrow> cert_stepsize m X0 h its halvs;\n  ASSERT (0 < h);\n  RETURN (h, err, res_ivl, res)\n  }\"\n\ndefinition [refine_vcg_def]: \"default_reduce_argument_spec = SPEC (\\<lambda>x::unit. True)\"\n\ndefinition \"euler_step X0 h = one_step X0 h (\\<lambda>X0 hl hu CX.\n   do {\n    let H = lv_ivl [min hl hu] [max hl hu];\n    _ \\<leftarrow> mk_safe CX;\n    let env = concat ` listset [list_of_eucl ` X0, list_of_eucl ` CX, H];\n    env \\<leftarrow> approx_slp_spec (euler_fas' DIM('a)) (2 * DIM('a)) euler_slp env;\n    case env of None \\<Rightarrow> RETURN None\n    | Some env \\<Rightarrow> do {\n      let res' = take DIM('a) ` env;\n      ASSERT (env_len res' DIM('a));\n      let res = (eucl_of_list ` res');\n      ASSUME (ncc res);\n      let err' = drop DIM('a) ` take (DIM('a) * 2) ` env;\n      ASSERT (env_len err' DIM('a));\n      let err = (eucl_of_list ` err'::'a::executable_euclidean_space set);\n      ra \\<leftarrow> default_reduce_argument_spec;\n      res \\<leftarrow> reduce_spec ra res;\n      ASSUME (ncc res);\n      s \\<leftarrow> safe_set res;\n      if s then\n      do {\n        res \\<leftarrow> mk_safe res;\n        RETURN (Some (res::'a set, err))\n      } else RETURN None\n    }\n  })\"\n\ndefinition \"rk2_step X0 h = one_step X0 h (\\<lambda>X0 hl hu CX.\n  do {\n    let H = lv_ivl [min hl hu] [max hl hu];\n    rps \\<leftarrow> rk2_param_spec;\n    let rkp = lv_ivl [rps] [rps];\n    let s2 = lv_ivl [0] [1];\n    _ \\<leftarrow> mk_safe CX;\n    ASSUME (ncc CX);\n    let env = concat ` listset [list_of_eucl ` X0, list_of_eucl ` CX, rkp, H, s2];\n    env \\<leftarrow> approx_slp_spec (rk2_fas' DIM('a)) (2 * DIM('a)) rk2_slp env;\n    case env of None \\<Rightarrow> RETURN None\n    | Some env \\<Rightarrow> do {\n      let res' = take DIM('a) ` env;\n      ASSERT (env_len res' DIM('a));\n      let res = (eucl_of_list ` res'::'a::executable_euclidean_space set);\n      ASSUME (ncc res);\n      let err' = drop DIM('a) ` take (DIM('a) * 2) ` env;\n      ASSERT (env_len err' DIM('a));\n      let err = (eucl_of_list ` err'::'a set);\n      ra \\<leftarrow> default_reduce_argument_spec;\n      res \\<leftarrow> reduce_spec ra res;\n      ASSUME (ncc res);\n      s \\<leftarrow> safe_set res;\n      if s then\n      do {\n        res \\<leftarrow> mk_safe res;\n        RETURN (Some (res, err))\n      } else RETURN None\n    }\n  })\"\n\ndefinition \"choose_step X0 h = do {\n  mid \\<leftarrow> method_spec;\n  (if mid = 2 then rk2_step X0 h else euler_step X0 h)\n}\"\n\ndefinition \"ode_e' = (ode_e @\n  mmult_fa D D D (concat (map (\\<lambda>j. map (\\<lambda>i.\n      (FDERIV_floatarith (ode_e ! j) [0..<D] ((replicate D 0)[i := 1]))) [0..<D]) [0..<D]))\n    (map floatarith.Var [D..<D + D*D]))\"\n\ndefinition \"transversal_directions f =\n  do {\n    (I, S) \\<leftarrow> op_ivl_rep_of_set f;\n    RETURN (sum_list (map (\\<lambda>b. (if I \\<bullet> b \\<le> 0 then if S \\<bullet> b \\<le> 0 then S \\<bullet> b else 0 else if S \\<bullet> b \\<ge> 0 then I \\<bullet> b else 0) *\\<^sub>R b)\n      (Basis_list::'a::executable_euclidean_space list)))\n  }\"\n\ndefinition \"intersects_sctns X' sctns = do {\n    ASSUME (finite sctns);\n    FOREACH\\<^bsup>\\<lambda>sctns' b. \\<not>b \\<longrightarrow> X' \\<inter> \\<Union>(plane_of ` (sctns - sctns')) = {}\\<^esup> sctns\n          (\\<lambda>sctn b. do {b' \\<leftarrow> op_intersects ( X') sctn; RETURN (b \\<or> b')}) False\n   }\"\n\ndefinition \"trace_sets s X = do {\n    XS \\<leftarrow> sets_of_coll (X:::clw_rel (appr_rel)); FORWEAK XS (RETURN ()) (\\<lambda>X. RETURN (trace_set s (Some X))) (\\<lambda>_ _. RETURN ())\n  }\"\n\ndefinition \"print_sets s X = do {\n    XS \\<leftarrow> sets_of_coll (X:::clw_rel (appr_rel)); FORWEAK XS (RETURN ()) (\\<lambda>X. RETURN (print_set s (X))) (\\<lambda>_ _. RETURN ())\n  }\"\n\ndefinition \"intersects_sctns_spec_clw R sctns = do {\n    Rs \\<leftarrow> sets_of_coll ((R:::clw_rel appr_rel):::clw_rel(appr_rel));\n    FORWEAK Rs (RETURN False) (\\<lambda>R. intersects_sctns R sctns) (\\<lambda>a b. RETURN (a \\<or> b))\n  }\"\n\ndefinition [simp]: \"nonneg_reals = ({0..}::real set)\"\ndefinition [simp]: \"pos_reals = ({0<..}::real set)\"\n\ndefinition \"nonzero_component s X n = do {\n    I \\<leftarrow> Inf_inner X n;\n    S \\<leftarrow> Sup_inner X n;\n    CHECKs s (I > 0 \\<or> S < 0)\n  }\"\n\ndefinition \"disjoints_spec X Y = do {\n    Xi \\<leftarrow> ivls_of_sets X;\n    IS \\<leftarrow> inter_overappr (Xi:::clw_rel lvivl_rel) (Y:::clw_rel lvivl_rel);\n    RETURN (is_empty IS)\n  }\"\n\ndefinition subset_spec_plane :: \"'a::executable_euclidean_space set \\<Rightarrow> 'a sctn \\<Rightarrow> bool nres\" where\n\"subset_spec_plane X sctn = do {\n    CHECKs ''subset_spec_plane: not in Basis'' (abs (normal sctn) \\<in> set Basis_list);\n    (i, s) \\<leftarrow> ivl_rep X;\n    RETURN (i \\<bullet> normal sctn = pstn sctn \\<and> s \\<bullet> normal sctn = pstn sctn)\n  }\"\n\ndefinition \"op_eventually_within_sctn X sctn S = do {\n    (l, u) \\<leftarrow> ivl_rep S;\n    (xl, xu) \\<leftarrow> op_ivl_rep_of_set X;\n    CHECKs (ST ''op_eventually_within_sctn: empty ivl'') (l \\<le> u);\n    CHECKs (ST ''op_eventually_within_sctn: not in Basis'') (abs (normal sctn) \\<in> set Basis_list);\n    b \\<leftarrow> subset_spec_plane S sctn;\n    CHECKs (ST ''op_eventually_within_sctn: subset_spec_plane 1'') b;\n    b \\<leftarrow> subset_spec_plane ({xl .. xu}:::lvivl_rel) sctn;\n    CHECKs (ST ''op_eventually_within_sctn: subset_spec_plane 2'') b;\n    RETURN (b \\<and> (\\<forall>i \\<in> set Basis_list - {abs (normal sctn)}. l \\<bullet> i < xl \\<bullet> i \\<and> xu \\<bullet> i < u \\<bullet> i))\n  }\"\n\ndefinition [simp]: \"uninfo X = X\"\n\ndefinition [simp]: \"op_subset_ivl a b \\<longleftrightarrow> a \\<subseteq> b\"\n\ndefinition [simp]: \"op_eq_ivl a b \\<longleftrightarrow> a = b\"\n\nabbreviation \"iplane_rel \\<equiv> \\<lambda>A. \\<langle>A, \\<langle>lv_rel\\<rangle>plane_rel\\<rangle>inter_rel\"\nabbreviation \"isbelow_rel \\<equiv> \\<lambda>A. \\<langle>A, \\<langle>lv_rel\\<rangle>sbelow_rel\\<rangle>inter_rel\"\nabbreviation \"isbelows_rel \\<equiv> \\<lambda>A. \\<langle>A, \\<langle>lv_rel\\<rangle>sbelows_rel\\<rangle>inter_rel\"\n\ndefinition [refine_vcg_def]: \"get_plane X = SPEC (\\<lambda>sctn. X = plane_of sctn)\"\n\ndefinition \"tolerate_error Y E =\n  do {\n    (ei, es) \\<leftarrow> op_ivl_rep_of_set (E);\n    (yi, ys) \\<leftarrow> op_ivl_rep_of_set (Y);\n    let ea = sup (abs ei) (abs es);\n    let ya = sup (abs yi) (abs ys);\n    rtol \\<leftarrow> adaptive_rtol_spec;\n    atol \\<leftarrow> adaptive_atol_spec;\n    let errtol = sup (rtol *\\<^sub>R ya) (atol *\\<^sub>R sum_list Basis_list);\n    RETURN (ea \\<le> errtol, infnorm ea)\n  }\"\n\ndefinition \"adapt_stepsize_fa rtol m e h' =\n  floatarith.Num (float_of h') *\n  floatarith.Powr (floatarith.Num (float_of (rtol)) / floatarith.Num (float_of e))\n    (inverse (floatarith.Num (float_of (real_of_nat m) + 1)))\"\n\nend\n\n\ntext \\<open>With ODE operations for variational equation\\<close>\n\nlocale approximate_sets_ode' = approximate_sets_ode\\<comment> \\<open>TODO: this prevents infinite chain of interpretations (?!)\\<close>\n  where ops = ops\n    and ode_ops = ode_ops\n  for ops :: \"'b approximate_set_ops\"\n    and ode_ops\nbegin\n\nlift_definition var_ode_ops::ode_ops is \"(ode_e', safe_form)\"\n  using max_Var_floatariths_ode_e_le max_Var_form_safe_form_le\n  by (auto simp: ode_e'_def D_def length_concat o_def sum_list_triv\n      intro!: max_Var_floatariths_mmult_fa[le] max_Var_floatariths_concat max_Var_floatariths_mapI\n      max_Var_floatarith_FDERIV_floatarith[le] max_Var_floatariths_list_update\n      max_Var_floatariths_replicateI\n      max_Var_floatarith_le_max_Var_floatariths_nth[le])\n\nsublocale var: approximate_sets_ode where ode_ops = var_ode_ops\n  by unfold_locales\n\nend\n\nlifting_update ode_ops.lifting\nlifting_forget ode_ops.lifting\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Ordinary_Differential_Equations/Numerics/Abstract_Reachability_Analysis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073802837478, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.32216101371683825}}
{"text": "(* \n   Title: Psi-calculi   \n   Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Chain\n  imports Nominal\nbegin\n\nlemma pt_set_nil: \n  fixes Xs :: \"'a set\"\n  assumes pt: \"pt TYPE('a) TYPE ('x)\"\n  and     at: \"at TYPE('x)\"\n\n  shows \"([]::'x prm)\\<bullet>Xs = Xs\"\nby(auto simp add: perm_set_def pt1[OF pt])\n\nlemma pt_set_append: \n  fixes pi1 :: \"'x prm\"\n  and   pi2 :: \"'x prm\"\n  and   Xs  :: \"'a set\"\n  assumes pt: \"pt TYPE('a) TYPE ('x)\"\n  and     at: \"at TYPE('x)\"\n\n  shows \"(pi1@pi2)\\<bullet>Xs = pi1\\<bullet>(pi2\\<bullet>Xs)\"\nby(auto simp add: perm_set_def pt2[OF pt])\n\nlemma pt_set_prm_eq: \n  fixes pi1 :: \"'x prm\"\n  and   pi2 :: \"'x prm\"\n  and   Xs  :: \"'a set\"\n  assumes pt: \"pt TYPE('a) TYPE ('x)\"\n  and     at: \"at TYPE('x)\"\n\n  shows \"pi1 \\<triangleq> pi2  \\<Longrightarrow> pi1\\<bullet>Xs = pi2\\<bullet>Xs\"\nby(auto simp add: perm_set_def pt3[OF pt])\n\nlemma pt_set_inst:\n  assumes pt: \"pt TYPE('a) TYPE ('x)\"\n  and     at: \"at TYPE('x)\"\n\n  shows \"pt TYPE('a set) TYPE('x)\"\napply(simp add: pt_def pt_set_nil[OF pt, OF at] pt_set_append[OF pt, OF at])\napply(clarify)\nby(rule pt_set_prm_eq[OF pt, OF at])\n\nlemma pt_ball_eqvt:\n  fixes pi :: \"'a prm\"\n  and   Xs :: \"'b set\"\n  and   P :: \"'b \\<Rightarrow> bool\"\n\n  assumes pt: \"pt TYPE('b) TYPE('a)\"\n  and     at: \"at TYPE('a)\"\n\n  shows \"(pi \\<bullet> (\\<forall>x \\<in> Xs. P x)) = (\\<forall>x \\<in> (pi \\<bullet> Xs). pi \\<bullet> P (rev pi \\<bullet> x))\"\napply(auto simp add: perm_bool)\napply(drule_tac pi=\"rev pi\" in pt_set_bij2[OF pt, OF at])\napply(simp add: pt_rev_pi[OF pt_set_inst[OF pt, OF at], OF at])\napply(drule_tac pi=\"pi\" in pt_set_bij2[OF pt, OF at])\napply(erule_tac x=\"pi \\<bullet> x\" in ballE)\napply(simp add: pt_rev_pi[OF pt, OF at])\nby simp\n\nlemma perm_cart_prod:\n  fixes Xs :: \"'b set\"\n  and   Ys :: \"'c set\"\n  and   p  :: \"'a prm\"\n\n  assumes pt1: \"pt TYPE('b) TYPE('a)\"\n  and     pt2: \"pt TYPE('c) TYPE('a)\"\n  and     at:  \"at TYPE('a)\"\n\n  shows \"(p \\<bullet> (Xs \\<times> Ys)) = (((p \\<bullet> Xs) \\<times> (p \\<bullet> Ys))::(('b \\<times> 'c) set))\"\nby(auto simp add: perm_set_def)\n\nlemma supp_member:\n  fixes Xs :: \"'b set\"\n  and   x  :: 'a\n\n  assumes pt: \"pt TYPE('b) TYPE('a)\"\n  and     at: \"at TYPE('a)\"\n  and     fs: \"fs TYPE('b) TYPE('a)\"\n  and     \"finite Xs\"\n  and     \"x \\<in> ((supp Xs)::'a set)\"\n\n  obtains X where \"(X::'b) \\<in> Xs\" and \"x \\<in> supp X\"\nproof -\n  from `finite Xs` `x \\<in> supp Xs` have \"\\<exists>X::'b. (X \\<in> Xs) \\<and> (x \\<in> (supp X))\"\n  proof(induct rule: finite_induct)\n    case empty\n    from `x \\<in> ((supp {})::'a set)` have False\n      by(simp add: supp_set_empty)\n    thus ?case by simp\n  next\n    case(insert y Xs)\n    show ?case\n    proof(case_tac \"x \\<in> supp y\")\n      assume \"x \\<in> supp y\"\n      thus ?case by force\n    next\n      assume \"x \\<notin> supp y\"\n      with `x \\<in> supp(insert y Xs)` have \"x \\<in> supp Xs\"\n        by(simp add: supp_fin_insert[OF pt, OF at, OF fs, OF `finite Xs`])\n      with `x \\<in> supp Xs \\<Longrightarrow> \\<exists>X. X \\<in> Xs \\<and> x \\<in> supp X`\n      show ?case by force\n    qed\n  qed\n  with `\\<And>X. \\<lbrakk>X \\<in> Xs; x \\<in> supp X\\<rbrakk> \\<Longrightarrow> thesis`\n  show ?thesis by blast\nqed\n\nlemma supp_cart_prod_empty[simp]:\n  fixes Xs :: \"'b set\"\n\n  shows \"supp (Xs \\<times> {}) = ({}::'a set)\"\n  and   \"supp ({} \\<times> Xs) = ({}::'a set)\"\nby(auto simp add: supp_set_empty)\n\nlemma supp_cart_prod:\n  fixes Xs :: \"'b set\"\n  and   Ys :: \"'c set\"\n\n  assumes pt1: \"pt TYPE('b) TYPE('a)\"\n  and     pt2: \"pt TYPE('c) TYPE('a)\"\n  and     fs1: \"fs TYPE('b) TYPE('a)\"\n  and     fs2: \"fs TYPE('c) TYPE('a)\"\n  and     at:  \"at TYPE('a)\"\n  and     f1:  \"finite Xs\"\n  and     f2:  \"finite Ys\"\n  and     a:   \"Xs \\<noteq> {}\"\n  and     b:   \"Ys \\<noteq> {}\"\n\n  shows \"((supp (Xs \\<times> Ys))::'a set) = ((supp Xs) \\<union> (supp Ys))\"\nproof -\n  from f1 f2 have f3: \"finite(Xs \\<times> Ys)\" by simp\n  show ?thesis\n    apply(simp add: supp_of_fin_sets[OF pt_prod_inst[OF pt1, OF pt2], OF at, OF fs_prod_inst[OF fs1, OF fs2], OF f3] supp_prod)\n    apply(rule equalityI)\n    using Union_included_in_supp[OF pt1, OF at, OF fs1, OF f1] Union_included_in_supp[OF pt2, OF at, OF fs2, OF f2]\n    apply(force simp add: supp_prod)\n    using a b\n    apply(auto simp add: supp_prod)\n    using supp_member[OF pt1, OF at, OF fs1, OF f1]\n    apply blast\n    using supp_member[OF pt2, OF at, OF fs2, OF f2]\n    by blast\nqed\n\nlemma fresh_cart_prod:\n  fixes x  :: 'a\n  and   Xs :: \"'b set\"\n  and   Ys :: \"'c set\"\n\n  assumes pt1: \"pt TYPE('b) TYPE('a)\"\n  and     pt2: \"pt TYPE('c) TYPE('a)\"\n  and     fs1: \"fs TYPE('b) TYPE('a)\"\n  and     fs2: \"fs TYPE('c) TYPE('a)\"\n  and     at:  \"at TYPE('a)\"\n  and     f1:  \"finite Xs\"\n  and     f2:  \"finite Ys\"\n  and     a:   \"Xs \\<noteq> {}\"\n  and     b:   \"Ys \\<noteq> {}\"\n\n  shows \"(x \\<sharp> (Xs \\<times> Ys)) = (x \\<sharp> Xs \\<and> x \\<sharp> Ys)\"\nusing assms\nby(simp add: supp_cart_prod fresh_def)\n\nlemma fresh_star_cart_prod:\n  fixes Zs   :: \"'a set\"\n  and   xvec :: \"'a list\"\n  and   Xs   :: \"'b set\"\n  and   Ys   :: \"'c set\"\n\n  assumes pt1: \"pt TYPE('b) TYPE('a)\"\n  and     pt2: \"pt TYPE('c) TYPE('a)\"\n  and     fs1: \"fs TYPE('b) TYPE('a)\"\n  and     fs2: \"fs TYPE('c) TYPE('a)\"\n  and     at:  \"at TYPE('a)\"\n  and     f1:  \"finite Xs\"\n  and     f2:  \"finite Ys\"\n  and     a:   \"Xs \\<noteq> {}\"\n  and     b:   \"Ys \\<noteq> {}\"\n\n  shows \"(Zs \\<sharp>* (Xs \\<times> Ys)) = (Zs \\<sharp>* Xs \\<and> Zs \\<sharp>* Ys)\"\n  and   \"(xvec \\<sharp>* (Xs \\<times> Ys)) = (xvec \\<sharp>* Xs \\<and> xvec \\<sharp>* Ys)\"\nusing assms\nby(force simp add: fresh_cart_prod fresh_star_def)+\n\nlemma permCommute:\n  fixes p  :: \"'a prm\"\n  and   q  :: \"'a prm\"\n  and   P  :: 'x\n  and   Xs :: \"'a set\"\n  and   Ys :: \"'a set\"\n\n  assumes pt: \"pt TYPE('x) TYPE('a)\"\n  and     at: \"at TYPE('a)\"\n  and     a: \"(set p) \\<subseteq> Xs \\<times> Ys\"\n  and     b: \"Xs \\<sharp>* q\"\n  and     c: \"Ys \\<sharp>* q\"\n\n  shows \"p \\<bullet> q \\<bullet> P = q \\<bullet> p \\<bullet> P\"\nproof -\n  have \"p \\<bullet> q \\<bullet> P = (p \\<bullet> q) \\<bullet> p \\<bullet> P\"\n    by(rule pt_perm_compose[OF pt, OF at])\n  moreover from at have \"pt TYPE('a) TYPE('a)\"\n    by(rule at_pt_inst)\n  hence \"pt TYPE(('a \\<times> 'a) list) TYPE('a)\"\n    by(force intro: pt_prod_inst pt_list_inst)\n  hence \"p \\<bullet> q = q\" using at a b c\n    by(rule pt_freshs_freshs)\n  ultimately show ?thesis by simp\nqed\n\n\ndefinition\n  distinctPerm :: \"'a prm \\<Rightarrow> bool\" where\n  \"distinctPerm p \\<equiv> distinct((map fst p)@(map snd p))\"\n\nlemma at_set_avoiding_aux':\n  fixes Xs::\"'a set\"\n  and   As::\"'a set\"\n  assumes at: \"at TYPE('a)\"\n  and     a: \"finite Xs\"\n  and     b: \"Xs \\<subseteq> As\"\n  and     c: \"finite As\"\n  and     d: \"finite ((supp c)::'a set)\"\n  shows \"\\<exists>(Ys::'a set) (pi::'a prm). Ys\\<sharp>*c \\<and> Ys \\<inter> As = {} \\<and> (pi\\<bullet>Xs=Ys) \\<and> \n          set pi \\<subseteq> Xs \\<times> Ys \\<and> finite Ys \\<and> (distinctPerm pi)\"\nusing a b c\nproof (induct)\n  case empty\n  have \"({}::'a set)\\<sharp>*c\" by (simp add: fresh_star_def)\n  moreover\n  have \"({}::'a set) \\<inter> As = {}\" by simp\n  moreover\n  have \"([]::'a prm)\\<bullet>{} = ({}::'a set)\"\n    by(rule pt1) (metis Nominal.pt_set_inst at at_pt_inst)\n  moreover\n  have \"set ([]::'a prm) \\<subseteq> {} \\<times> {}\" by simp\n  moreover \n  have \"finite ({}::'a set)\" by simp\n  moreover have \"distinctPerm([]::'a prm)\"\n    by(simp add: distinctPerm_def)\n  ultimately show ?case by blast\nnext\n  case (insert x Xs)\n  then have ih: \"\\<exists>Ys pi. Ys\\<sharp>*c \\<and> Ys \\<inter> As = {} \\<and> pi\\<bullet>Xs = Ys \\<and> set pi \\<subseteq> Xs \\<times> Ys \\<and> finite Ys \\<and> distinctPerm pi\" by simp\n  then obtain Ys pi where a1: \"Ys\\<sharp>*c\" and a2: \"Ys \\<inter> As = {}\" and a3: \"(pi::'a prm)\\<bullet>Xs = Ys\" and \n                          a4: \"set pi \\<subseteq> Xs \\<times> Ys\" and a5: \"finite Ys\" \n                      and a6: \"distinctPerm pi\" by blast\n  have b: \"x\\<notin>Xs\" by fact\n  have d1: \"finite As\" by fact\n  have d2: \"finite Xs\" by fact\n  have d3: \"insert x Xs \\<subseteq> As\" by fact\n  have d4: \"finite((supp pi)::'a set)\"\n    by(induct pi)\n      (auto simp add: supp_list_nil supp_prod at_fin_set_supp[OF at]\n                      supp_list_cons at_supp[OF at])\n  have \"\\<exists>y::'a. y\\<sharp>(c,x,Ys,As,pi)\" using d d1 a5 d4\n    by (rule_tac at_exists_fresh'[OF at])\n       (simp add: supp_prod at_supp[OF at] at_fin_set_supp[OF at])\n  then obtain y::\"'a\" where  e: \"y\\<sharp>(c,x,Ys,As,pi)\" by blast\n  have \"({y}\\<union>Ys)\\<sharp>*c\" using a1 e by (simp add: fresh_star_def)\n  moreover\n  have \"({y}\\<union>Ys)\\<inter>As = {}\" using a2 d1 e by (simp add: fresh_prod at_fin_set_fresh[OF at])\n  moreover\n  have \"(((pi\\<bullet>x,y)#pi)\\<bullet>(insert x Xs)) = {y}\\<union>Ys\"\n  proof -\n    have eq: \"[(pi\\<bullet>x,y)]\\<bullet>Ys = Ys\" \n    proof -\n      have \"(pi\\<bullet>x)\\<sharp>Ys\" using a3[symmetric] b d2\n        by(simp add: pt_fresh_bij[OF pt_set_inst, OF at_pt_inst[OF at], OF at, OF at]\n                     at_fin_set_fresh[OF at d2])\n      moreover\n      have \"y\\<sharp>Ys\" using e by simp\n      ultimately show \"[(pi\\<bullet>x,y)]\\<bullet>Ys = Ys\" \n        by (simp add: pt_fresh_fresh[OF pt_set_inst, OF at_pt_inst[OF at], OF at, OF at])\n    qed\n    have \"(((pi\\<bullet>x,y)#pi)\\<bullet>({x}\\<union>Xs)) = ([(pi\\<bullet>x,y)]\\<bullet>(pi\\<bullet>({x}\\<union>Xs)))\"\n      by (simp add: pt2[symmetric, OF pt_set_inst, OF at_pt_inst[OF at], OF at])\n    also have \"\\<dots> = {y}\\<union>([(pi\\<bullet>x,y)]\\<bullet>(pi\\<bullet>Xs))\" \n      by (simp only: union_eqvt perm_set_def at_calc[OF at])(auto)\n    also have \"\\<dots> = {y}\\<union>([(pi\\<bullet>x,y)]\\<bullet>Ys)\" using a3 by simp\n    also have \"\\<dots> = {y}\\<union>Ys\" using eq by simp\n    finally show \"(((pi\\<bullet>x,y)#pi)\\<bullet>(insert x Xs)) = {y}\\<union>Ys\" by auto\n  qed\n  moreover\n  have \"pi\\<bullet>x=x\" using a4 b a2 a3 d3 by (rule_tac at_prm_fresh2[OF at]) (auto)\n  then have \"set ((pi\\<bullet>x,y)#pi) \\<subseteq> (insert x Xs) \\<times> ({y}\\<union>Ys)\" using a4 by auto\n  moreover \n  have \"finite ({y}\\<union>Ys)\" using a5 by simp\n  moreover from `Ys \\<inter> As = {}` `(insert x Xs) \\<subseteq> As` `finite Ys` have \"x \\<notin> Ys\"\n    by(auto simp add: fresh_def at_fin_set_supp[OF at])\n  with a6 `pi \\<bullet> x = x` `x \\<notin> Xs` `(set pi) \\<subseteq> Xs \\<times> Ys` e have \"distinctPerm((pi \\<bullet> x, y)#pi)\"\n    apply(auto simp add: distinctPerm_def fresh_prod at_fresh[OF at])\n    proof -\n      fix a b\n      assume \"b \\<sharp> pi\" and \"(a, b) \\<in> set pi\"\n      thus False\n        by(induct pi)\n          (auto simp add: supp_list_cons supp_prod at_supp[OF at] fresh_list_cons fresh_prod at_fresh[OF at])\n    next\n      fix a b\n      assume \"a \\<sharp> pi\" and \"(a, b) \\<in> set pi\"\n      thus False\n        by(induct pi)\n          (auto simp add: supp_list_cons supp_prod at_supp[OF at] fresh_list_cons fresh_prod at_fresh[OF at])\n    qed\n  ultimately \n  show ?case by blast\nqed\n\nlemma at_set_avoiding:\n  fixes Xs::\"'a set\"\n  assumes at: \"at TYPE('a)\"\n  and     a: \"finite Xs\"\n  and     b: \"finite ((supp c)::'a set)\"\n  obtains pi::\"'a prm\" where \"(pi \\<bullet> Xs) \\<sharp>* c\" and \"set pi \\<subseteq> Xs \\<times> (pi \\<bullet> Xs)\" and \"distinctPerm pi\"\n  using a b\n  by (frule_tac As=\"Xs\" in at_set_avoiding_aux'[OF at]) auto\n\nlemma pt_swap:\n  fixes x :: 'a\n  and a :: 'x\n  and b :: 'x\n\n  assumes pt: \"pt TYPE('a) TYPE('x)\"\n  and     at: \"at TYPE('x)\"\n\n  shows \"[(a, b)] \\<bullet> x = [(b, a)] \\<bullet> x\"\nproof -\n  show ?thesis by(simp add: pt3[OF pt] at_ds5[OF at])\nqed\n\n\natom_decl name\n\nlemma supp_subset:\n  fixes Xs :: \"'a::fs_name set\"\n  and   Ys :: \"'a::fs_name set\"\n\n  assumes \"Xs \\<subseteq> Ys\"\n  and     \"finite Xs\"\n  and     \"finite Ys\"\n\n  shows \"(supp Xs) \\<subseteq> ((supp Ys)::name set)\"\nproof(rule subsetI)\n  fix x\n  assume \"x \\<in> ((supp Xs)::name set)\"\n  with `finite Xs` obtain X where \"X \\<in> Xs\" and \"x \\<in> supp X\"\n    by(rule supp_member[OF pt_name_inst, OF at_name_inst, OF fs_name_inst])\n  from `X \\<in> Xs` `Xs \\<subseteq> Ys` have \"X \\<in> Ys\" by auto\n  with `finite Ys` `x \\<in> supp X` show \"x \\<in> supp Ys\"\n    by(induct rule: finite_induct)\n      (auto simp add: supp_fin_insert[OF pt_name_inst, OF at_name_inst, OF fs_name_inst])\nqed\n\nabbreviation mem_def :: \"'a \\<Rightarrow> 'a list \\<Rightarrow> bool\" (\"_ mem _\" [80, 80] 80)  where\n  \"x mem xs \\<equiv> x \\<in> set xs\"\n\nlemma memFresh:\n  fixes x :: name\n  and   p :: \"'a::fs_name\"\n  and   l :: \"('a::fs_name) list\"\n\n  assumes \"x \\<sharp> l\"\n  and     \"p mem l\"\n  \n  shows \"x \\<sharp> p\"\nusing assms\nby(induct l, auto simp add: fresh_list_cons)\n\nlemma memFreshChain:\n  fixes xvec :: \"name list\"\n  and   p    :: \"'a::fs_name\"\n  and   l    :: \"'a::fs_name list\"\n  and   Xs   :: \"name set\"\n\n  assumes \"p mem l\"\n  \n  shows \"xvec \\<sharp>* l \\<Longrightarrow> xvec \\<sharp>* p\"\n  and   \"Xs \\<sharp>* l \\<Longrightarrow> Xs \\<sharp>* p\"\nusing assms\nby(auto simp add: fresh_star_def intro: memFresh)\n\nlemma fresh_star_list_append[simp]:\n  fixes A :: \"name list\"\n  and   B :: \"name list\"\n  and   C :: \"name list\"\n\n  shows \"(A \\<sharp>* (B @ C)) = ((A \\<sharp>* B) \\<and> (A \\<sharp>* C))\"\nby(auto simp add: fresh_star_def fresh_list_append)\n\nlemma unionSimps[simp]:\n  fixes Xs :: \"name set\"\n  and   Ys :: \"name set\"\n  and   C  :: \"'a::fs_name\"\n\n  shows \"((Xs \\<union> Ys) \\<sharp>* C) = ((Xs \\<sharp>* C) \\<and> (Ys \\<sharp>* C))\"\nby(auto simp add: fresh_star_def)\n\nlemma substFreshAux[simp]:\n  fixes C    :: \"'a::fs_name\"\n  and   xvec :: \"name list\"\n\n  shows \"xvec \\<sharp>* (supp C - set xvec)\"\nby(auto simp add: fresh_star_def fresh_def at_fin_set_supp[OF at_name_inst] fs_name1)\n\nlemma fresh_star_perm_app[simp]:\n  fixes Xs :: \"name set\"\n  and   xvec :: \"name list\"\n  and   p  :: \"name prm\"\n  and   C  :: \"'d::fs_name\"\n\n  shows \"\\<lbrakk>Xs \\<sharp>* p; Xs \\<sharp>* C\\<rbrakk> \\<Longrightarrow> Xs \\<sharp>* (p \\<bullet> C)\"\n  and   \"\\<lbrakk>xvec \\<sharp>* p; xvec \\<sharp>* C\\<rbrakk> \\<Longrightarrow> xvec \\<sharp>* (p \\<bullet> C)\"\nby(auto simp add: fresh_star_def fresh_perm_app)\n\nlemma freshSets[simp]:\n  fixes x    :: name\n  and   y    :: name\n  and   xvec :: \"name list\"\n  and   X    :: \"name set\"\n  and   C    :: 'a\n\n  shows \"([]::name list) \\<sharp>* C\"\n  and   \"([]::name list) \\<sharp>* [y].C\"\n  and   \"({}::name set) \\<sharp>* C\"\n  and   \"({}::name set) \\<sharp>* [y].C\"\n  and   \"((x#xvec) \\<sharp>* C) = (x \\<sharp> C \\<and> xvec \\<sharp>* C)\"\n  and   \"((x#xvec) \\<sharp>* ([y].C)) = (x \\<sharp> ([y].C) \\<and> xvec \\<sharp>* ([y].C))\"\n  and   \"((insert x X) \\<sharp>* C) = (x \\<sharp> C \\<and> X \\<sharp>* C)\"\n  and   \"((insert x X) \\<sharp>* ([y].C)) = (x \\<sharp> ([y].C) \\<and> X \\<sharp>* ([y].C))\"\nby(auto simp add: fresh_star_def)\n\nlemma freshStarAtom[simp]: \"(xvec::name list) \\<sharp>* (x::name) = x \\<sharp> xvec\"\nby(induct xvec)\n  (auto simp add: fresh_list_nil fresh_list_cons fresh_atm)\n\nlemma name_list_set_fresh[simp]:\n  fixes xvec :: \"name list\"\n  and   x    :: \"'a::fs_name\"\n\n  shows \"(set xvec) \\<sharp>* x = xvec \\<sharp>* x\"\nby(auto simp add: fresh_star_def)\n\nlemma name_list_supp:\n  fixes xvec :: \"name list\"\n\n  shows \"set xvec = supp xvec\"\nproof -\n  have \"set xvec = supp(set xvec)\"\n    by(simp add: at_fin_set_supp[OF at_name_inst])\n  moreover have \"\\<dots> = supp xvec\"\n    by(simp add: pt_list_set_supp[OF pt_name_inst, OF at_name_inst, OF fs_name_inst])\n  ultimately show ?thesis\n    by simp\nqed\n\nlemma abs_fresh_list_star:\n  fixes xvec :: \"name list\"\n  and   a    :: name\n  and   P    :: \"'a::fs_name\"\n\n  shows \"(xvec \\<sharp>* [a].P) = ((set xvec) - {a}) \\<sharp>* P\"\nby(induct xvec) (auto simp add: fresh_star_def abs_fresh)\n\nlemma abs_fresh_set_star:\n  fixes X :: \"name set\"\n  and   a :: name\n  and   P :: \"'a::fs_name\"\n\n  shows \"(X \\<sharp>* [a].P) = (X - {a}) \\<sharp>* P\"\nby(auto simp add: fresh_star_def abs_fresh)\n\nlemmas abs_fresh_star = abs_fresh_list_star abs_fresh_set_star\n\nlemma abs_fresh_list_star'[simp]:\n  fixes xvec :: \"name list\"\n  and   a    :: name\n  and   P    :: \"'a::fs_name\"\n\n  assumes \"a \\<sharp> xvec\"\n\n  shows \"xvec \\<sharp>* [a].P = xvec \\<sharp>* P\"\nusing assms\nby(induct xvec) (auto simp add: abs_fresh fresh_list_cons fresh_atm)\n\nlemma freshChainSym[simp]:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  \n  shows   \"xvec \\<sharp>* yvec = yvec \\<sharp>* xvec\"\nusing assms\nby(auto simp add: fresh_star_def fresh_def name_list_supp)\n\nlemmas [eqvt] = perm_cart_prod[OF pt_name_inst, OF pt_name_inst, OF at_name_inst]\n\nlemma name_set_avoiding:\n  fixes c :: \"'a::fs_name\"\n  and   X :: \"name set\"\n  \n  assumes \"finite X\"\n  and     \"\\<And>pi::name prm. \\<lbrakk>(pi \\<bullet> X) \\<sharp>* c; distinctPerm pi; set pi \\<subseteq> X \\<times> (pi \\<bullet> X)\\<rbrakk> \\<Longrightarrow> thesis\"\n\n  shows thesis\nusing assms\nby(rule_tac c=c in at_set_avoiding[OF at_name_inst]) (simp_all add: fs_name1)\n\nlemmas simps[simp] = fresh_atm fresh_prod\n                     pt3[OF pt_name_inst, OF at_ds1, OF at_name_inst]\n                     pt_fresh_fresh[OF pt_name_inst, OF at_name_inst]\n                     pt_rev_pi[OF pt_name_inst, OF at_name_inst]\n                     pt_pi_rev[OF pt_name_inst, OF at_name_inst]\n\nlemmas name_supp_cart_prod = supp_cart_prod[OF pt_name_inst, OF pt_name_inst, OF fs_name_inst, OF fs_name_inst, OF at_name_inst]\nlemmas name_fresh_cart_prod = fresh_cart_prod[OF pt_name_inst, OF pt_name_inst, OF fs_name_inst, OF fs_name_inst, OF at_name_inst]\nlemmas name_fresh_star_cart_prod = fresh_star_cart_prod[OF pt_name_inst, OF pt_name_inst, OF fs_name_inst, OF fs_name_inst, OF at_name_inst]\n\n\nlemmas name_swap_bij[simp] = pt_swap_bij[OF pt_name_inst, OF at_name_inst]\nlemmas name_swap = pt_swap[OF pt_name_inst, OF at_name_inst]\nlemmas name_set_fresh_fresh[simp] = pt_freshs_freshs[OF pt_name_inst, OF at_name_inst]\nlemmas list_fresh[simp] = fresh_list_nil fresh_list_cons fresh_list_append\n\ndefinition  eqvt :: \"'a::fs_name set \\<Rightarrow> bool\" where\n                  \"eqvt X \\<equiv> \\<forall>x \\<in> X. \\<forall>p::name prm. p \\<bullet> x \\<in> X\"\n\nlemma eqvtUnion[intro]:\n  fixes Rel  :: \"('d::fs_name) set\"\n  and   Rel' :: \"'d set\"\n\n  assumes EqvtRel:  \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"eqvt (Rel \\<union> Rel')\"\nusing assms\nby(force simp add: eqvt_def)\n\nlemma eqvtPerm[simp]: \n  fixes X :: \"('d::fs_name) set\"\n  and   x :: name\n  and   y :: name\n\n  assumes \"eqvt X\"\n\n  shows \"([(x, y)] \\<bullet> X) = X\"\nusing assms\napply(auto simp add: eqvt_def)\napply(erule_tac x=\"[(x, y)] \\<bullet> xa\" in ballE)\napply(erule_tac x=\"[(x, y)]\" in allE)\napply simp\napply(drule_tac pi=\"[(x, y)]\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply simp\napply(erule_tac x=xa in ballE)\napply(erule_tac x=\"[(x, y)]\" in allE)\napply(drule_tac pi=\"[(x, y)]\" and x=\"[(x, y)] \\<bullet> xa\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply simp\nby simp\n\nlemma eqvtI:\n  fixes X :: \"'d::fs_name set\"\n  and   x :: 'd\n  and   p :: \"name prm\"\n  \n  assumes \"eqvt X\"\n  and     \"x \\<in> X\"\n \n  shows \"(p \\<bullet> x) \\<in> X\"\nusing assms\nby(unfold eqvt_def) auto\n\nlemma fresh_star_list_nil[simp]:\n  fixes xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n  \n  shows \"xvec \\<sharp>* []\"\n  and   \"Xs \\<sharp>* []\"\nby(auto simp add: fresh_star_def)\n\nlemma fresh_star_list_cons[simp]:\n  fixes xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n  and   x    :: \"'a::fs_name\"\n  and   xs   :: \"'a list\"\n\n  shows \"(xvec \\<sharp>* (x#xs)) = ((xvec \\<sharp>* x) \\<and> xvec \\<sharp>* xs)\"\n  and   \"(Xs \\<sharp>* (x#xs)) = ((Xs \\<sharp>* x) \\<and> (Xs \\<sharp>* xs))\"\nby(auto simp add: fresh_star_def)\n\nlemma freshStarPair[simp]:\n  fixes X    :: \"name set\"\n  and   xvec :: \"name list\"\n  and   x    :: \"'a::fs_name\"\n  and   y    :: \"'b::fs_name\"\n\n  shows \"(X \\<sharp>* (x, y)) = (X \\<sharp>* x \\<and> X \\<sharp>* y)\"\n  and   \"(xvec \\<sharp>* (x, y)) = (xvec \\<sharp>* x \\<and> xvec \\<sharp>* y)\"\nby(auto simp add: fresh_star_def)\nlemma name_list_avoiding:\n  fixes c    :: \"'a::fs_name\"\n  and   xvec :: \"name list\"\n  \n  assumes \"\\<And>pi::name prm. \\<lbrakk>(pi \\<bullet> xvec) \\<sharp>* c; distinctPerm pi; set pi \\<subseteq> (set xvec) \\<times> (set (pi \\<bullet> xvec))\\<rbrakk> \\<Longrightarrow> thesis\"\n\n  shows thesis\nproof -\n  have \"finite(set xvec)\" by simp\n  thus ?thesis using assms\n    by(rule name_set_avoiding) (auto simp add: eqvts fresh_star_def)\nqed\n\nlemma distinctPermSimps[simp]:\n  fixes p :: \"name prm\"\n  and   a :: name\n  and   b :: name\n\n  shows \"distinctPerm([]::name prm)\"\n  and   \"(distinctPerm((a, b)#p)) = (distinctPerm p \\<and> a \\<noteq> b \\<and> a \\<sharp> p \\<and> b \\<sharp> p)\"\napply(simp add: distinctPerm_def)\napply(induct p)\napply(unfold distinctPerm_def)\napply(clarsimp)\napply(rule iffI, erule iffE)\nby(clarsimp)+\n\nlemma map_eqvt[eqvt]:\n  fixes p   :: \"name prm\"\n  and   lst :: \"'a::pt_name list\"\n\n  shows \"(p \\<bullet> (map f lst)) = map (p \\<bullet> f) (p \\<bullet> lst)\"\napply(induct lst, auto) \nby(simp add: pt_fun_app_eq[OF pt_name_inst, OF at_name_inst])\n\nlemma consPerm:\n  fixes x :: name\n  and   y :: name\n  and   p :: \"name prm\"\n  and   C :: \"'a::pt_name\"\n\n  shows \"((x, y)#p) \\<bullet> C = [(x, y)] \\<bullet> p \\<bullet> C\"\nby(simp add: pt2[OF pt_name_inst, THEN sym])\n\nsimproc_setup consPerm (\"((x, y)#p) \\<bullet> C\") = {*\n  fn _ => fn _ => fn ct => \n     case term_of ct of \n        Const (@{const_name perm}, _ ) $ (Const (@{const_name Cons}, _) $ _ $ p) $ _ =>\n              (case p of Const (@{const_name Nil}, _) => NONE\n                       | _ => SOME(mk_meta_eq @{thm consPerm})) \n      | _ => NONE\n*}\n\nlemma distinctEqvt[eqvt]:\n  fixes p  :: \"name prm\"\n  and   xs :: \"'a::pt_name list\"\n\n  shows \"(p \\<bullet> (distinct xs)) = distinct (p \\<bullet> xs)\"\nby(induct xs) (auto simp add: eqvts)\n\nlemma distinctClosed[simp]:\n  fixes p  :: \"name prm\"\n  and   xs :: \"'a::pt_name list\"\n\n  shows \"distinct (p \\<bullet> xs) = distinct xs\"\napply(induct xs)\napply(auto simp add: eqvts)\napply(drule_tac pi=p in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(simp add: eqvts)\napply(drule_tac pi=\"rev p\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\nby(simp add: eqvts)\n\nlemma lengthEqvt[eqvt]:\n  fixes p  :: \"name prm\"\n  and   xs :: \"'a::pt_name list\"\n  \n  shows \"p \\<bullet> (length xs) = length (p \\<bullet> xs)\"\nby(induct xs) (auto simp add: eqvts)\n\nlemma lengthClosed[simp]:\n  fixes p  :: \"name prm\"\n  and   xs :: \"'a::pt_name list\"\n  \n  shows \"length (p \\<bullet> xs) = length xs\"\nby(induct xs) (auto simp add: eqvts)\n\nlemma subsetEqvt[eqvt]:\n  fixes p :: \"name prm\"\n  and   S :: \"('a::pt_name) set\"\n  and   T :: \"('a::pt_name) set\"\n\n  shows \"(p \\<bullet> (S \\<subseteq> T)) = ((p \\<bullet> S) \\<subseteq> (p \\<bullet> T))\"\nby(rule pt_subseteq_eqvt[OF pt_name_inst, OF at_name_inst])\n\nlemma subsetClosed[simp]:\n  fixes p :: \"name prm\"\n  and   S :: \"('a::pt_name) set\"\n  and   T :: \"('a::pt_name) set\"\n\n  shows \"((p \\<bullet> S) \\<subseteq> (p \\<bullet> T)) = (S \\<subseteq> T)\"\napply auto\napply(drule_tac pi=p in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply(insert pt_set_bij[OF pt_name_inst, OF at_name_inst])\napply auto\napply(drule_tac pi=\"rev p\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply auto\napply(subgoal_tac \"rev p \\<bullet> x \\<in> T\")\napply auto\napply(drule_tac pi=\"p\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\napply auto\napply(drule_tac pi=\"p\" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])\nby auto\n\n\n\n  shows \"(set (p \\<bullet> xvec) \\<subseteq> supp (p \\<bullet> P)) = (set xvec \\<subseteq> supp P)\"\nby(simp add: eqvts[THEN sym])\n\nlemma memEqvt[eqvt]:\n  fixes p  :: \"name prm\"\n  and   x  :: \"'a::pt_name\"\n  and   xs :: \"('a::pt_name) list\"\n\n  shows \"(p \\<bullet> (x mem xs)) = ((p \\<bullet> x) mem (p \\<bullet> xs))\"\nby(induct xs)\n  (auto simp add: pt_bij[OF pt_name_inst, OF at_name_inst] eqvts)\n\nlemma memClosed[simp]:\n  fixes p  :: \"name prm\"\n  and   x  :: \"'a::pt_name\"\n  and   xs :: \"('a::pt_name) list\"\n\n  shows \"(p \\<bullet> x) mem (p \\<bullet> xs) = (x mem xs)\"\nproof -\n  have \"x mem xs = p \\<bullet> (x mem xs)\"\n    by(case_tac \"x mem xs\") auto\n  thus ?thesis by(simp add: eqvts)\nqed\n\nlemma memClosed'[simp]:\n  fixes p  :: \"name prm\"\n  and   x  :: \"'a::pt_name\"\n  and   y  :: \"'b::pt_name\"\n  and   xs :: \"('a \\<times>  'b) list\" \n\n  shows \"((p \\<bullet> x, p \\<bullet> y) mem (p \\<bullet> xs)) = ((x, y) mem xs)\"\napply(subgoal_tac \"((x, y) mem xs) = (p \\<bullet> (x, y)) mem (p \\<bullet> xs)\")\napply force\nby(force simp del: eqvts)\n\n\nlemma freshPerm:\n  fixes x :: name\n  and   p :: \"name prm\"\n\n  assumes \"x \\<sharp> p\"\n\n  shows \"p \\<bullet> x = x\"\nusing assms\napply(rule_tac pt_pi_fresh_fresh[OF pt_name_inst, OF at_name_inst])\nby(induct p, auto simp add: fresh_list_cons fresh_prod)\n\nlemma freshChainPermSimp:\n  fixes xvec :: \"name list\"\n  and   p    :: \"name prm\"\n\n  assumes \"xvec \\<sharp>* p\"\n\n  shows \"p \\<bullet> xvec = xvec\"\n  and   \"rev p \\<bullet> xvec = xvec\"\nusing assms\nby(induct xvec) (auto simp add: freshPerm pt_bij1[OF pt_name_inst, OF at_name_inst, THEN sym])\n\nlemma freshChainAppend[simp]:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   C    :: \"'a::fs_name\"\n  \n  shows \"(xvec@yvec) \\<sharp>* C = ((xvec \\<sharp>* C) \\<and> (yvec \\<sharp>* C))\"\nby(force simp add: fresh_star_def)\n\nlemma subsetFresh:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   C    :: \"'d::fs_name\"\n\n  assumes \"set xvec \\<subseteq> set yvec\"\n  and     \"yvec \\<sharp>* C\"\n\n  shows \"xvec \\<sharp>* C\"\nusing assms\nby(auto simp add: fresh_star_def)\n\nlemma distinctPermCancel[simp]:\n  fixes p :: \"name prm\"\n  and   T :: \"'a::pt_name\"\n\n  assumes \"distinctPerm p\"\n\n  shows \"(p \\<bullet> (p \\<bullet> T)) = T\"\nusing assms\nproof(induct p)\n  case Nil\n  show ?case by simp\nnext\n  case(Cons a p)\n  thus ?case\n  proof(case_tac a, auto)\n    fix a b\n    assume \"(a::name) \\<sharp> (p::name prm)\" \"b \\<sharp> p\" \"p \\<bullet> p \\<bullet> T = T\" \"a \\<noteq> b\"\n    thus \"[(a, b)] \\<bullet> p \\<bullet> [(a, b)] \\<bullet> p \\<bullet> T = T\"\n      by(subst pt_perm_compose[OF pt_name_inst, OF at_name_inst]) simp\n  qed\nqed\n\nfun composePerm :: \"name list \\<Rightarrow> name list \\<Rightarrow> name prm\"\nwhere\n  Base:  \"composePerm [] [] = []\"\n| Step:  \"composePerm (x#xs) (y#ys) = (x, y)#(composePerm xs ys)\"\n| Empty: \"composePerm _ _= []\"\n\nlemma composePermInduct[consumes 1, case_names cBase cStep]:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   P    :: \"name list \\<Rightarrow> name list \\<Rightarrow> bool\"\n\n  assumes L: \"length xvec = length yvec\"\n  and     rBase: \"P [] []\"\n  and     rStep: \"\\<And>x xvec y yvec. \\<lbrakk>length xvec = length yvec; P xvec yvec\\<rbrakk> \\<Longrightarrow> P (x # xvec) (y # yvec)\"\n\n  shows \"P xvec yvec\"\nusing assms\nby(induct rule: composePerm.induct) auto\n\nlemma composePermEqvt[eqvt]:\n  fixes p    :: \"name prm\"\n  and   xvec :: \"name list\"\n  and   yvec :: \"name list\"\n\n  shows \"(p \\<bullet> (composePerm xvec yvec)) = composePerm (p \\<bullet> xvec) (p \\<bullet> yvec)\"\nby(induct xvec yvec rule: composePerm.induct) auto\n\nabbreviation\n  composePermJudge (\"[_ _] \\<bullet>\\<^sub>v _\" [80, 80, 80] 80) where \"[xvec yvec] \\<bullet>\\<^sub>v p \\<equiv> (composePerm xvec yvec) \\<bullet> p\"\n\nabbreviation\n  composePermInvJudge (\"[_ _]\\<^sup>- \\<bullet>\\<^sub>v _\" [80, 80, 80] 80) where \"[xvec yvec]\\<^sup>- \\<bullet>\\<^sub>v p \\<equiv> (rev (composePerm xvec yvec)) \\<bullet> p\"\n\nlemma permChainSimps[simp]:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   perm :: \"name prm\"\n  and   p    :: \"'a::pt_name\"\n\n  shows \"((composePerm xvec yvec) @ perm) \\<bullet> p = [xvec yvec] \\<bullet>\\<^sub>v (perm \\<bullet> p)\"\nby(simp add: pt2[OF pt_name_inst])\n\nlemma permChainEqvt[eqvt]:\n  fixes p    :: \"name prm\"\n  and   xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   x    :: \"'a::pt_name\"\n\n  shows \"(p \\<bullet> ([xvec yvec] \\<bullet>\\<^sub>v x)) = [(p \\<bullet> xvec) (p \\<bullet> yvec)] \\<bullet>\\<^sub>v (p \\<bullet> x)\"\n  and   \"(p \\<bullet> ([xvec yvec]\\<^sup>- \\<bullet>\\<^sub>v x)) = [(p \\<bullet> xvec) (p \\<bullet> yvec)]\\<^sup>- \\<bullet>\\<^sub>v (p \\<bullet> x)\"\nby(subst pt_perm_compose[OF pt_name_inst, OF at_name_inst], simp add: eqvts rev_eqvt)+\n\nlemma permChainBij:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   p    :: \"'a::pt_name\"\n  and   q    :: \"'a::pt_name\"\n\n  assumes \"length xvec = length yvec\"\n\n  shows \"(([xvec yvec] \\<bullet>\\<^sub>v p) = ([xvec yvec] \\<bullet>\\<^sub>v q)) = (p = q)\"\n  and   \"(([xvec yvec]\\<^sup>- \\<bullet>\\<^sub>v p) = ([xvec yvec]\\<^sup>- \\<bullet>\\<^sub>v q)) = (p = q)\"\nusing assms\nby(induct rule: composePermInduct)\n  (auto simp add: pt_bij[OF pt_name_inst, OF at_name_inst])\n\nlemma permChainAppend:\n  fixes xvec1 :: \"name list\"\n  and   yvec1 :: \"name list\"\n  and   xvec2 :: \"name list\"\n  and   yvec2 :: \"name list\"\n  and   p     :: \"'a::pt_name\"\n  \n  assumes \"length xvec1 = length yvec1\"\n\n  shows \"([(xvec1@xvec2) (yvec1@yvec2)] \\<bullet>\\<^sub>v p) = [xvec1 yvec1] \\<bullet>\\<^sub>v [xvec2 yvec2] \\<bullet>\\<^sub>v p\"\n  and   \"([(xvec1@xvec2) (yvec1@yvec2)]\\<^sup>- \\<bullet>\\<^sub>v p) = [xvec2 yvec2]\\<^sup>- \\<bullet>\\<^sub>v [xvec1 yvec1]\\<^sup>- \\<bullet>\\<^sub>v p\"\nusing assms\nby(induct arbitrary: p rule: composePermInduct, auto) (simp add: pt2[OF pt_name_inst])\n\nlemma calcChainAtom:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   x    :: name\n\n  assumes \"length xvec = length yvec\"\n  and     \"x \\<sharp> xvec\"\n  and     \"x \\<sharp> yvec\"\n\n  shows \"[xvec yvec] \\<bullet>\\<^sub>v x = x\"\nusing assms\nby(induct rule: composePermInduct, auto)\n\nlemma calcChainAtomRev:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   x    :: name\n\n  assumes \"length xvec = length yvec\"\n  and     \"x \\<sharp> xvec\"\n  and     \"x \\<sharp> yvec\"\n\n  shows \"[xvec yvec]\\<^sup>- \\<bullet>\\<^sub>v x = x\"\nusing assms\nby(induct rule: composePermInduct, auto)\n  (auto simp add: pt2[OF pt_name_inst] fresh_list_cons calc_atm)\n\nlemma permChainFresh[simp]:\n  fixes x    :: name\n  and   xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   p    :: \"'a::pt_name\"\n\n  assumes \"x \\<sharp> xvec\"\n  and     \"x \\<sharp> yvec\"\n  and     \"length xvec = length yvec\"\n\n  shows \"x \\<sharp> [xvec yvec] \\<bullet>\\<^sub>v p = x \\<sharp> p\"\n  and   \"x \\<sharp> [xvec yvec]\\<^sup>- \\<bullet>\\<^sub>v p = x \\<sharp> p\"\nusing assms\nby(auto simp add: fresh_left calcChainAtomRev calcChainAtom)\n\nlemma chainFreshFresh:\n  fixes x    :: name\n  and   y    :: name\n  and   xvec :: \"name list\"\n  and   p    :: \"'a::pt_name\"\n\n  assumes \"x \\<sharp> xvec\"\n  and     \"y \\<sharp> xvec\"\n\n  shows \"xvec \\<sharp>* ([(x, y)] \\<bullet> p) = (xvec \\<sharp>* p)\"\nusing assms\nby(induct xvec) (auto simp add: fresh_list_cons fresh_left)\n\nlemma permChainFreshFresh:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   p    :: \"'a::pt_name\"\n\n  assumes \"xvec \\<sharp>* p\"\n  and     \"yvec \\<sharp>* p\"\n  and     \"length xvec = length yvec\"\n\n  shows \"[xvec yvec] \\<bullet>\\<^sub>v p = p\"\n  and   \"[xvec yvec]\\<^sup>- \\<bullet>\\<^sub>v p = p\"\nusing assms\nby(induct rule: composePerm.induct, auto) (simp add: pt2[OF pt_name_inst])\n\nlemma setFresh[simp]:\n  fixes x    :: name\n  and   xvec :: \"name list\"\n\n  shows \"x \\<notin> set xvec = x \\<sharp> xvec\"\nby(simp add: name_list_supp fresh_def)\n  \nlemma calcChain:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  \n  assumes \"yvec \\<sharp>* xvec\"\n  and     \"length xvec = length yvec\"\n  and     \"distinct xvec\"\n  and     \"distinct yvec\"\n\n  shows \"[xvec yvec] \\<bullet>\\<^sub>v xvec = yvec\"\nusing assms\nby(induct xvec yvec rule: composePerm.induct, auto)\n  (subst consPerm, simp add: calcChainAtom calc_atm name_list_supp fresh_def[symmetric])+\n\nlemma freshChainPerm:\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   x    :: name\n  and   C    :: \"'a::pt_name\"\n\n  assumes \"length xvec = length yvec\"\n  and     \"yvec \\<sharp>* C\"\n  and     \"xvec \\<sharp>* yvec\"\n  and     \"x mem xvec\"\n  and     \"distinct yvec\"\n\n  shows \"x \\<sharp> [xvec yvec] \\<bullet>\\<^sub>v C\"\nusing assms\nproof(induct rule: composePermInduct)\n  case cBase\n  have \"x mem []\" by fact\n  hence False by simp\n  thus ?case by simp\nnext\n  case(cStep x' xvec y yvec)\n  have \"(y # yvec) \\<sharp>* C\" by fact\n  hence yFreshC: \"y \\<sharp> C\" and yvecFreshp: \"yvec \\<sharp>* C\" by simp+\n  have \"(x' # xvec) \\<sharp>* (y # yvec)\" by fact\n  hence x'ineqy: \"x' \\<noteq> y\" and xvecFreshyvec: \"xvec \\<sharp>* yvec\"\n    and x'Freshyvec: \"x' \\<sharp> yvec\" and yFreshxvec: \"y \\<sharp> xvec\"\n    by(auto simp add: fresh_list_cons)\n  have \"distinct (y#yvec)\" by fact\n  hence yFreshyvec: \"y \\<sharp> yvec\" and yvecDist: \"distinct yvec\"\n    by simp+\n  have L: \"length xvec = length yvec\" by fact\n  have \"x \\<sharp> [(x', y)] \\<bullet> [xvec yvec] \\<bullet>\\<^sub>v C\"\n  proof(case_tac \"x = x'\")\n    assume xeqx': \"x = x'\"\n    moreover from yFreshxvec yFreshyvec yFreshC L have \"y \\<sharp> [xvec yvec] \\<bullet>\\<^sub>v C\"\n      by simp\n    hence \"([(x, y)] \\<bullet> y) \\<sharp> [(x, y)] \\<bullet> [xvec yvec] \\<bullet>\\<^sub>v C\"\n      by(rule pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n    with x'ineqy xeqx' show ?thesis by(simp add: calc_atm)\n  next\n    assume xineqx': \"x \\<noteq> x'\"\n    have \"x mem (x' # xvec)\" by fact\n    with xineqx' have xmemxvec: \"x mem xvec\" by simp\n    moreover have \"\\<lbrakk>yvec \\<sharp>* C; xvec \\<sharp>* yvec; x mem xvec; distinct yvec\\<rbrakk> \\<Longrightarrow> x \\<sharp> [xvec yvec] \\<bullet>\\<^sub>v C\" by fact\n    ultimately have \"x \\<sharp> [xvec yvec] \\<bullet>\\<^sub>v C\" using yvecFreshp xvecFreshyvec yvecDist\n      by simp\n    hence \"([(x', y)] \\<bullet> x) \\<sharp> [(x', y)] \\<bullet> [xvec yvec] \\<bullet>\\<^sub>v C\"\n      by(rule pt_fresh_bij1[OF pt_name_inst, OF at_name_inst])\n    moreover from xmemxvec yFreshxvec have \"x \\<noteq> y\"\n      by(induct xvec) (auto simp add: fresh_list_cons)\n    ultimately show ?thesis using xineqx' x'ineqy by(simp add: calc_atm)\n  qed\n  thus ?case by simp\nqed\n\nlemma memFreshSimp[simp]:\n  fixes y    :: name\n  and   yvec :: \"name list\"\n\n  shows \"(\\<not>(y mem yvec)) = y \\<sharp> yvec\"\nby(induct yvec)\n  (auto simp add: fresh_list_nil fresh_list_cons)\n\nlemma freshChainPerm':\n  fixes xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   p    :: \"'a::pt_name\"\n\n  assumes \"length xvec = length yvec\"\n  and     \"yvec \\<sharp>* p\"\n  and     \"xvec \\<sharp>* yvec\"\n  and     \"distinct yvec\"\n\n  shows \"xvec \\<sharp>* ([xvec yvec] \\<bullet>\\<^sub>v p)\"\nusing assms\nproof(induct rule: composePermInduct)\n  case cBase\n  show ?case by simp\nnext\n  case(cStep x xvec y yvec)\n  have \"(y # yvec) \\<sharp>* p\" by fact\n  hence yFreshp: \"y \\<sharp> p\" and yvecFreshp: \"yvec \\<sharp>* p\"\n    by simp+\n  moreover have \"(x # xvec) \\<sharp>* (y # yvec)\" by fact\n  hence xineqy: \"x \\<noteq> y\" and xvecFreshyvec: \"xvec \\<sharp>* yvec\"\n    and xFreshyvec: \"x \\<sharp> yvec\" and yFreshxvec: \"y \\<sharp> xvec\"\n    by(auto simp add: fresh_list_cons)\n  have \"distinct (y # yvec)\" by fact\n  hence yFreshyvec: \"y \\<sharp> yvec\" and yvecDist: \"distinct yvec\"\n    by simp+\n  have L: \"length xvec = length yvec\" by fact\n  have \"\\<lbrakk>yvec \\<sharp>* p; xvec \\<sharp>* yvec; distinct yvec\\<rbrakk> \\<Longrightarrow> xvec \\<sharp>* ([xvec yvec] \\<bullet>\\<^sub>v p)\" by fact\n  with yvecFreshp xvecFreshyvec yvecDist have IH: \"xvec \\<sharp>* ([xvec yvec] \\<bullet>\\<^sub>v p)\" by simp\n  show ?case\n  proof(auto)\n    from L yFreshp yvecFreshp xineqy xvecFreshyvec yvecDist yFreshyvec yFreshxvec xFreshyvec\n    have \"x \\<sharp> [(x # xvec) (y # yvec)] \\<bullet>\\<^sub>v p\"\n      by(rule_tac freshChainPerm) (auto simp add: fresh_list_cons)\n    thus \"x \\<sharp> [(x, y)] \\<bullet> [xvec yvec] \\<bullet>\\<^sub>v p\" by simp\n  next\n    show \"xvec \\<sharp>* ([(x, y)] \\<bullet> [xvec yvec] \\<bullet>\\<^sub>v p)\"\n    proof(case_tac \"x mem xvec\")\n      assume \"x mem xvec\"\n      with L yvecFreshp xvecFreshyvec yvecDist xFreshyvec\n      have\"x \\<sharp> [xvec yvec] \\<bullet>\\<^sub>v p\"\n        by(rule_tac freshChainPerm) (auto simp add: fresh_list_cons)\n      moreover from yFreshxvec yFreshyvec yFreshp L\n      have \"y \\<sharp> [xvec yvec] \\<bullet>\\<^sub>v p\" by simp\n      ultimately show ?thesis using IH\n        by(subst consPerm) (simp add: perm_fresh_fresh)\n    next\n      assume \"\\<not>(x mem xvec)\"\n      hence xFreshxvec: \"x \\<sharp> xvec\" by simp\n      from IH have \"([(x, y)] \\<bullet> xvec) \\<sharp>* ([(x, y)] \\<bullet> [xvec yvec] \\<bullet>\\<^sub>v p)\"\n        by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with xFreshxvec yFreshxvec show ?thesis by simp\n    qed\n  qed\nqed\n\nlemma permSym:\n  fixes x    :: name\n  and   y    :: name\n  and   xvec :: \"name list\"\n  and   yvec :: \"name list\"\n  and   p    :: \"'a::pt_name\"\n  \n  assumes \"x \\<sharp> xvec\"\n  and     \"x \\<sharp> yvec\"\n  and     \"y \\<sharp> xvec\"\n  and     \"y \\<sharp> yvec\"\n  and     \"length xvec = length yvec\"\n\n  shows \"([(x, y)] \\<bullet> [xvec yvec] \\<bullet>\\<^sub>v p) = [xvec yvec] \\<bullet>\\<^sub>v [(x, y)] \\<bullet> p\"\nusing assms\napply(induct rule: composePerm.induct, auto)\nby(subst pt_perm_compose[OF pt_name_inst, OF at_name_inst]) simp\n\nlemma distinctPermClosed[simp]:\n  fixes p :: \"name prm\"\n  and   q :: \"name prm\"\n\n  assumes \"distinctPerm p\"\n\n  shows \"distinctPerm(q \\<bullet> p)\"\nusing assms\nby(induct p) (auto simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst] dest: pt_bij4[OF pt_name_inst, OF at_name_inst])\n\nlemma freshStarSimps:\n  fixes x  :: name\n  and   Xs :: \"name set\"\n  and   Ys :: \"name set\"\n  and   C  :: \"'a::fs_name\"\n  and   p  :: \"name prm\"\n  \n  assumes \"set p \\<subseteq> Xs \\<times> Ys\"\n  and     \"Xs \\<sharp>* x\"\n  and     \"Ys \\<sharp>* x\"\n\n  shows \"x \\<sharp> (p \\<bullet> C) = x \\<sharp> C\"\nusing assms\nby(subst  pt_fresh_bij[OF pt_name_inst, OF at_name_inst, symmetric, of _ C p]) simp\n\nlemma freshStarChainSimps:\n  fixes xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n  and   Ys   :: \"name set\"\n  and   C    :: \"'a::fs_name\"\n  and   p    :: \"name prm\"\n\n  assumes \"set p \\<subseteq> Xs \\<times> Ys\"\n  and     \"Xs \\<sharp>* xvec\"\n  and     \"Ys \\<sharp>* xvec\"\n\n  shows   \"xvec \\<sharp>* (p \\<bullet> C) = xvec \\<sharp>* C\"\nusing assms\nby(induct xvec) (auto simp add: freshStarSimps)\n\nlemma permStarFresh:\n  fixes xvec :: \"name list\"\n  and   p    :: \"name prm\"\n  and   T    :: \"'a::pt_name\"\n\n  assumes \"xvec \\<sharp>* p\"\n\n  shows \"xvec \\<sharp>* (p \\<bullet> T) = xvec \\<sharp>* T\"\nusing assms\nby(induct p) (auto simp add: chainFreshFresh)\n\nlemma swapStarFresh:\n  fixes x :: name\n  and   p :: \"name prm\"\n  and   T :: \"'a::pt_name\"\n\n  assumes \"x \\<sharp> p\"\n\n  shows \"x \\<sharp> (p \\<bullet> T) = x \\<sharp> T\"\nproof -\n  from assms have \"[x] \\<sharp>* (p \\<bullet> T) = [x] \\<sharp>* T\"\n    by(rule_tac permStarFresh) auto\n  thus ?thesis by simp\nqed\n\nlemmas freshChainSimps = freshStarSimps freshStarChainSimps permStarFresh swapStarFresh chainFreshFresh freshPerm subsetFresh\n\nlemma freshAlphaPerm:\n  fixes xvec :: \"name list\"\n  and   Xs   :: \"name set\"\n  and   Ys   :: \"name set\"\n  and   p    :: \"name prm\"\n\n  assumes S: \"set p \\<subseteq> Xs \\<times> Ys\"\n  and     \"Xs \\<sharp>* xvec\"\n  and     \"Ys \\<sharp>* xvec\"\n\n  shows \"xvec \\<sharp>* p\"\nusing assms\napply(induct p)\nby auto (simp add: fresh_star_def fresh_def name_list_supp supp_list_nil)+\n\nlemma freshAlphaSwap:\n  fixes x  :: name\n  and   Xs :: \"name set\"\n  and   Ys :: \"name set\"\n  and   p  :: \"name prm\"\n\n  assumes S: \"set p \\<subseteq> Xs \\<times> Ys\"\n  and     \"Xs \\<sharp>* x\"\n  and     \"Ys \\<sharp>* x\"\n\n  shows \"x \\<sharp> p\"\nproof -\n  from assms have \"[x] \\<sharp>* p\" \n    apply(rule_tac freshAlphaPerm)\n    apply assumption\n    by auto\n  thus ?thesis by simp\nqed\n\nlemma setToListFresh[simp]:\n  fixes xvec :: \"name list\"\n  and   C    :: \"'a::fs_name\"\n  and   yvec :: \"name list\"\n  and   Xs   :: \"name set\"\n  and   x    :: name\n\n  shows \"xvec \\<sharp>* (set yvec) = xvec \\<sharp>* yvec\"\n  and   \"Xs \\<sharp>* (set yvec) = Xs \\<sharp>* yvec\"\n  and   \"x \\<sharp> (set yvec) = x \\<sharp> yvec\"\n  and   \"set xvec \\<sharp>* Xs = xvec \\<sharp>* Xs\"\nby(auto simp add: fresh_star_def name_list_supp fresh_def fs_name1 at_fin_set_supp[OF at_name_inst])\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Psi_Calculi/Chain.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.32216100508746953}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * Facts about recursive functions with measure parameter.\n * Any recursive functions from AutoCorres are monotonic in the measure,\n * which allows us to use the \"measure_call\" mechanism for calling them.\n *)\ntheory MonadMono\nimports\n  NonDetMonadEx\n  \"../../lib/Monad_WP/OptionMonadWP\"\nbegin\n\n(*\n * Call function f by returning all of its possible results.\n * The call succeeds if any measure value succeeds.\n *)\ndefinition \"measure_call f \\<equiv>\n    \\<lambda>s. ({(r', s'). \\<exists>m. (r', s') \\<in> fst (f m s)}, \\<forall>m. snd (f m s))\"\n\n(*\n * monad_mono gives preconditions for functions so that measure_call will\n * return meaningful results.\n *\n * The preconditions are:\n *\n * - If the measure is increased, the function never returns fewer\n *   results. (Monotonicity condition)\n *\n * - If the function succeeds with some measure, it will not fail with\n *   a larger measure, and will return exactly the same results.\n *\n * The monotonicity condition is technically not needed, but all our\n * functions satisfy it anyway and it makes intermediate proofs easier.\n *)\ndefinition \"monad_mono f \\<equiv>\n     (\\<forall>(x :: nat) y s. x < y \\<longrightarrow>\n         (fst (f x s) \\<subseteq> fst (f y s) \\<and>\n          (\\<not> snd (f x s) \\<longrightarrow> \\<not> snd (f y s) \\<and> fst (f x s) = fst (f y s))))\"\n\n(* Basic monad_mono lemmas *)\nlemma monad_mono_incl: \"\\<lbrakk> monad_mono f; \\<not> snd (f m s) \\<rbrakk> \\<Longrightarrow> fst (f m' s) \\<subseteq> fst (f m s)\"\n  using less_linear[where x = m and y = m']\n  by (auto simp: monad_mono_def)\n\n(* wp rules for function calls *)\nlemma call_all_valid [wp]:\n    \"\\<lbrakk> \\<forall> m. valid P (x m) Q; monad_mono x \\<rbrakk> \\<Longrightarrow> valid P (measure_call x) Q\"\n  apply (clarsimp simp: valid_def measure_call_def monad_mono_def)\n  by blast\n\nlemma call_all_validNF [wp]:\n    \"\\<lbrakk>  validNF P (x m) Q; monad_mono x \\<rbrakk> \\<Longrightarrow> validNF P (measure_call x) Q\"\n  apply (clarsimp simp: measure_call_def validNF_def valid_def no_fail_def)\n  apply (metis in_mono split_conv monad_mono_incl)\n  done\n\n(* Alternative definition of monad_mono, suitable for induction *)\ndefinition \"monad_mono_step f m \\<equiv>\n  (\\<forall>s. fst (f m s) \\<subseteq> fst (f (Suc m) s) \\<and>\n       (\\<not> snd (f m s) \\<longrightarrow> \\<not> snd (f (Suc m) s) \\<and> fst (f m s) = fst (f (Suc m) s)))\"\n\nlemma monad_mono_alt_def: \"monad_mono f = (\\<forall>m. monad_mono_step f m)\"\n  apply (rule iffI)\n   apply (fastforce simp: monad_mono_def monad_mono_step_def)\n  apply (unfold monad_mono_def monad_mono_step_def)\n  apply clarify\n  apply (subst (asm) atomize_all[symmetric])+\n  proof -\n    fix x y :: nat\n    fix s\n    assume suc: \"\\<And>m s. fst (f m s) \\<subseteq> fst (f (Suc m) s) \\<and>\n              (\\<not> snd (f m s) \\<longrightarrow> \\<not> snd (f (Suc m) s) \\<and> fst (f m s) = fst (f (Suc m) s))\"\n       and less: \"x < y\"\n    thus \"fst (f x s) \\<subseteq> fst (f y s) \\<and>\n          (\\<not> snd (f x s) \\<longrightarrow> \\<not> snd (f y s) \\<and> fst (f x s) = fst (f y s))\"\n      apply (induct x)\n       apply (induct y)\n        apply blast\n       apply blast\n      (* induct bureaucracy... *)\n      proof -\n        fix x :: nat\n        assume less: \"Suc x < y\"\n        thus \"fst (f (Suc x) s) \\<subseteq> fst (f y s) \\<and>\n           (\\<not> snd (f (Suc x) s) \\<longrightarrow> \\<not> snd (f y s) \\<and> fst (f (Suc x) s) = fst (f y s))\"\n          apply (induct y)\n           apply blast\n          apply (case_tac \"Suc x < y\")\n           using suc apply blast\n          apply (case_tac \"Suc x = y\")\n           using suc apply blast\n          apply simp\n          done\n       qed\n  qed\n\nlemmas monad_mono_step = iffD2[OF monad_mono_alt_def, rule_format]\n\nlemma monad_mono_step_const: \"monad_mono_step (\\<lambda>_. f) m\"\n  by (simp add: monad_mono_step_def)\n\n(* nondet_monad rules *)\nlemma monad_mono_step_in_monad:\n  \"\\<lbrakk> monad_mono_step f m; (r', s') \\<in> fst (f m s) \\<rbrakk> \\<Longrightarrow> (r', s') \\<in> fst (f (Suc m) s)\"\n  apply (clarsimp simp: monad_mono_step_def)\n  apply blast\n  done\n\nlemma monad_mono_step_snd_monad:\n  \"\\<lbrakk> monad_mono_step f m; \\<not> snd (f m s) \\<rbrakk> \\<Longrightarrow> \\<not> snd (f (Suc m) s)\"\n  by (clarsimp simp: monad_mono_step_def)\n\nlemma monad_mono_step_bexI:\n  \"\\<lbrakk> monad_mono_step f m; (r', s') \\<in> fst (f m s); P r' s' \\<rbrakk> \\<Longrightarrow> \\<exists>(r', s') \\<in> fst (f (Suc m) s). P r' s'\"\n  apply (drule (1) monad_mono_step_in_monad)\n  apply force\n  done\n\nlemma monad_mono_stepI [intro]:\n  \"\\<lbrakk> \\<And>s r' s'. (r', s') \\<in> fst (f m s) \\<Longrightarrow> (r', s') \\<in> fst (f (Suc m) s);\n     \\<And>s. \\<not> snd (f m s) \\<Longrightarrow> \\<not> snd (f (Suc m) s);\n     \\<And>s r' s'. \\<lbrakk> \\<not> snd (f m s); \\<not> snd (f (Suc m) s); (r', s') \\<in> fst (f (Suc m) s) \\<rbrakk>\n                \\<Longrightarrow> (r', s') \\<in> fst (f m s)\n   \\<rbrakk> \\<Longrightarrow> monad_mono_step f m\"\n  apply (clarsimp simp: monad_mono_step_def)\n  apply fast\n  done\n\nlemma monad_mono_step_bind:\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. (f m) >>= (g m)) m\"\n  apply atomize\n  apply rule\n    apply (monad_eq)\n    apply (metis monad_mono_step_in_monad)\n   apply (monad_eq simp: Ball_def)\n   apply (metis monad_mono_step_def)\n  apply (monad_eq simp: Ball_def)\n  apply (unfold monad_mono_step_def)\n  apply blast\n  done\n\nlemma monad_mono_step_bindE:\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. (f m) >>=E (g m)) m\"\n  apply (unfold bindE_def)\n  apply (rule monad_mono_step_bind)\n   apply simp\n  apply (monad_eq simp: monad_mono_step_def NonDetMonad.lift_def\n      split: sum.splits)\n  done\n\nlemma monad_mono_step_liftE:\n  \"monad_mono_step f m \\<Longrightarrow> monad_mono_step (\\<lambda>m. liftE (f m)) m\"\n  apply (unfold liftE_def)\n  apply (erule monad_mono_step_bind)\n  apply (rule monad_mono_step_const)\n  done\n\nlemma monad_mono_step_handleE':\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. f m <handle2> g m) m\"\n  apply atomize\n  apply rule\n    apply (monad_eq)\n    apply (metis monad_mono_step_in_monad)\n   apply (monad_eq simp: Ball_def)\n   apply (metis monad_mono_step_def)\n  apply (monad_eq simp: Ball_def)\n  apply (fastforce simp: monad_mono_step_def)\n  done\n\nlemma monad_mono_step_handleE:\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. f m <handle> g m) m\"\n  by (simp add: handleE_def monad_mono_step_handleE')\n\nlemma monad_mono_step_condition:\n  \"\\<lbrakk> monad_mono_step f m; monad_mono_step g m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. condition C (f m) (g m)) m\"\n  apply rule\n    apply (monad_eq simp: monad_mono_step_def, blast)+\n  done\n\nlemma fst_whileLoop_is_exs_valid:\n  \"((a, b) \\<in> fst (whileLoop C B i s)) = \\<lbrace> \\<lambda>s'. s' = s \\<rbrace> whileLoop C B i \\<exists>\\<lbrace> \\<lambda>rv s. rv = a \\<and> s = b \\<rbrace>\"\n  by (clarsimp simp: exs_valid_def Bex_def)\n\nlemma not_snd_whileLoop_is_validNF:\n  \"(\\<not> snd (whileLoop C B i s)) = \\<lbrace> \\<lambda>s'. s' = s \\<rbrace> whileLoop C B i \\<lbrace> \\<lambda>_ _. True \\<rbrace>!\"\n  by (clarsimp simp: validNF_alt_def)\n\nlemma monad_mono_step_whileLoop:\n  assumes body_mono: \"\\<And>x. monad_mono_step (\\<lambda>m. B m x) m\"\n  shows \"monad_mono_step (\\<lambda>m. whileLoop C (B m) i) m\"\nproof -\n  {\n    fix a b s\n    have \"(a, b) \\<in> fst (whileLoop C (B m) i s) \\<Longrightarrow>\n             (a, b) \\<in> fst (whileLoop C (B (Suc m)) i s)\"\n      apply (clarsimp simp: fst_whileLoop_is_exs_valid)\n      apply (subst (asm) exs_valid_whileLoop_complete [symmetric])\n      apply (erule exE | erule conjE)+\n      apply (rule_tac T=T and R=R in exs_valid_whileLoop)\n         apply clarsimp\n        apply (cut_tac x=r in body_mono)\n        apply (clarsimp simp: monad_mono_step_def exs_valid_def split_def)\n        apply blast\n       apply simp\n      apply blast\n      done\n  }\n  note A = this\n\n  {\n    fix a b s\n    have \"\\<lbrakk> \\<not> snd (whileLoop C (B m) i s);\n                  (a, b) \\<in> fst (whileLoop C (B (Suc m)) i s) \\<rbrakk>\n              \\<Longrightarrow> (a, b) \\<in> fst (whileLoop C (B m) i s)\"\n      apply (clarsimp simp: fst_whileLoop_is_exs_valid)\n      apply (subst (asm) exs_valid_whileLoop_complete [symmetric])\n      apply (subst (asm) not_snd_whileLoop_complete)\n      apply (erule exE | erule conjE)+\n      apply (rule_tac T=\"\\<lambda>r s. T r s \\<and> I r s\" and R=Ra in exs_valid_whileLoop)\n         apply simp\n        apply (cut_tac x=r in body_mono)\n        apply (clarsimp simp: monad_mono_step_def exs_valid_def split_def Bex_def)\n        apply metis\n       apply simp\n      apply (clarsimp simp: exs_valid_def Bex_def)\n      done\n  }\n  note B = this\n\n  {\n    fix i s\n    have \"\\<lbrakk>\\<not> snd (whileLoop C (B m) i s) \\<rbrakk> \\<Longrightarrow>\n                  \\<not> snd (whileLoop C (B (Suc m)) i s)\"\n      apply (subst (asm) not_snd_whileLoop_complete)\n      apply (erule exE | erule conjE)+\n      apply (rule_tac I=\"I\" and R=R in not_snd_whileLoop)\n        apply clarsimp\n       apply (cut_tac x=r in body_mono)\n       apply (clarsimp simp: monad_mono_step_def validNF_alt_def)\n       apply blast\n      apply simp\n      done\n  }\n  note C = this\n\n  show ?thesis\n    apply (clarsimp simp: monad_mono_step_def)\n    apply (metis prod.exhaust subsetI subset_antisym A B C)\n    done\nqed\n\nlemma monad_mono_step_whileLoopE:\n  \"\\<lbrakk> \\<And>x. monad_mono_step (\\<lambda>m. B m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. whileLoopE C (B m) i) m\"\n  apply (unfold whileLoopE_def)\n  apply (subgoal_tac \"\\<And>x. monad_mono_step (\\<lambda>m. lift (B m) x) m\")\n  apply (erule monad_mono_step_whileLoop)\n  apply (unfold lift_def)\n  apply rule\n    apply (clarsimp split: prod.splits sum.splits)\n    apply (fastforce dest: monad_mono_step_in_monad)\n   apply (clarsimp split: prod.splits sum.splits simp: monad_mono_step_def)+\n  done\n\n\n(* measure_call for the option monad. *)\ndefinition \"measure_ocall f \\<equiv> \\<lambda>s. f (SOME m. f m s \\<noteq> None) s\"\n\ndefinition \"option_monad_mono f \\<equiv>\n  \\<forall>(x :: nat) y s. x < y \\<longrightarrow>\n    (case f y s of None \\<Rightarrow> f x s = None\n                 | Some r \\<Rightarrow> f x s = None \\<or> f x s = Some r)\"\n\nlemma option_monad_mono_eq:\n  \"(\\<And>m. f m = gets_the (f' m)) \\<Longrightarrow> monad_mono f = option_monad_mono f'\"\n  apply (clarsimp simp: monad_mono_def option_monad_mono_def gets_the_def\n    gets_def get_def assert_opt_def return_def fail_def bind_def' split: option.splits)\n  apply (rule iff_allI iff_impI)+\n  apply (rule_tac t = \"\\<forall>r. f' x s = Some r \\<longrightarrow> (\\<exists>r'. f' y s = Some r') \\<and> (\\<forall>r'. f' y s = Some r' \\<longrightarrow> r = r')\"\n              and s = \"\\<forall>r. f' x s = Some r \\<longrightarrow> f' y s = Some r\" in subst)\n   apply (force intro: iff_allI iff_impI)\n  apply (rule iffI)\n   apply (metis (hide_lams, no_types) option.exhaust)\n  apply force\n  done\n\nlemma measure_ocall_ovalid [wp]:\n    \"\\<lbrakk> \\<forall> m. ovalid P (x m) Q; option_monad_mono x \\<rbrakk> \\<Longrightarrow> ovalid P (measure_ocall x) Q\"\n  by (clarsimp simp: ovalid_def measure_ocall_def option_monad_mono_def)\n\nlemma measure_ocall_ovalidNF [wp]:\n    \"\\<lbrakk> ovalidNF P (x m) Q; option_monad_mono x \\<rbrakk> \\<Longrightarrow> ovalidNF P (measure_ocall x) Q\"\n  apply (clarsimp simp: measure_ocall_def option_monad_mono_def ovalidNF_def)\n  apply (rule_tac a = m in someI2)\n   apply simp\n  apply (metis (lifting, full_types) linorder_neqE_nat option.distinct(1) option.simps(5))\n  done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/autocorres/MonadMono.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.32216100508746953}}
{"text": "(*  Title:       CoreC++\n    Author:      Daniel Wasserrab\n    Maintainer:  Daniel Wasserrab <wasserra at fmi.uni-passau.de>\n*)\n\n\nheader {* \\isaheader{Definition of Subobjects} *}\n\ntheory SubObj\nimports ClassRel\nbegin\n\n\nsection {* General definitions *}\n\ntype_synonym\n  subobj = \"cname  \\<times> path\"\n\ndefinition mdc :: \"subobj \\<Rightarrow> cname\" where\n  \"mdc S = fst S\"\n\ndefinition ldc :: \"subobj \\<Rightarrow> cname\" where\n  \"ldc S = last (snd S)\"\n\n\nlemma mdc_tuple [simp]: \"mdc (C,Cs) = C\"\nby(simp add:mdc_def)\n\nlemma ldc_tuple [simp]: \"ldc (C,Cs) = last Cs\"\nby(simp add:ldc_def)\n\n\nsection {* Subobjects according to Rossie-Friedman *}\n\nfun is_subobj :: \"prog \\<Rightarrow> subobj \\<Rightarrow> bool\" -- \"legal subobject to class hierarchie\" where\n  \"is_subobj P (C, []) \\<longleftrightarrow> False\"\n| \"is_subobj P (C, [D]) \\<longleftrightarrow> (is_class P C \\<and> C = D) \n                                \\<or> (\\<exists> X. P \\<turnstile> C \\<preceq>\\<^sup>* X \\<and> P \\<turnstile> X \\<prec>\\<^sub>S D)\"\n| \"is_subobj P (C, D # E # Xs) = (let Ys=butlast (D # E # Xs); \n                                      Y=last (D # E # Xs); \n                                      X=last Ys \n                                in is_subobj P (C, Ys) \\<and> P \\<turnstile> X \\<prec>\\<^sub>R Y)\"\n\nlemma subobj_aux_rev:\nassumes 1:\"is_subobj P ((C,C'#rev Cs@[C'']))\"\nshows \"is_subobj P ((C,C'#rev Cs))\"\nproof -\n  obtain Cs' where Cs':\"Cs' = rev Cs\" by simp\n  hence rev:\"Cs'@[C''] = rev Cs@[C'']\" by simp\n  from this obtain D Ds where DDs:\"Cs'@[C''] = D#Ds\" by (cases Cs') auto\n  with 1 rev have subo:\"is_subobj P ((C,C'#D#Ds))\" by simp\n  from DDs have \"butlast (C'#D#Ds) = C'#Cs'\" by (cases Cs') auto\n  with subo have \"is_subobj P ((C,C'#Cs'))\" by simp\n  with Cs' show ?thesis by simp\nqed\n\n\n\nlemma subobj_aux:\nassumes 1:\"is_subobj P ((C,C'#Cs@[C'']))\"\nshows \"is_subobj P ((C,C'#Cs))\"\nproof -\n  from 1 obtain Cs' where Cs':\"Cs' = rev Cs\" by simp\n  with 1 have \"is_subobj P ((C,C'#rev Cs'@[C'']))\" by simp\n  hence \"is_subobj P ((C,C'#rev Cs'))\" by (rule subobj_aux_rev)\n  with Cs' show ?thesis by simp\nqed\n\n\n\nlemma isSubobj_isClass:\nassumes 1:\"is_subobj P (R)\"\nshows \"is_class P (mdc R)\"\n\nproof -\n  obtain C' Cs' where R:\"R = (C',Cs')\" by(cases R) auto\n  with 1 have ne:\"Cs' \\<noteq> []\" by (cases Cs') auto\n  from this obtain C'' Cs'' where C''Cs'':\"Cs' = C''#Cs''\" by (cases Cs') auto\n  from this obtain Ds where \"Ds = rev Cs''\" by simp\n  with 1 R C''Cs'' have subo1:\"is_subobj P ((C',C''#rev Ds))\" by simp\n  with R show ?thesis\n    by (induct Ds,auto simp:mdc_def split:split_if_asm dest:subobj_aux,\n      auto elim:converse_rtranclE dest!:subclsS_subcls1 elim:subcls1_class)\nqed\n\n\n\n\nlemma isSubobjs_subclsR_rev:\nassumes 1:\"is_subobj P ((C,Cs@[D,D']@(rev Cs')))\"\nshows \"P \\<turnstile> D \\<prec>\\<^sub>R D'\"\nusing 1\nproof (induct Cs')\n  case Nil\n  from this obtain Cs' X Y Xs where Cs'1:\"Cs' = Cs@[D,D']\" \n    and \"X = hd(Cs@[D,D'])\" and \"Y = hd(tl(Cs@[D,D']))\"\n    and \"Xs =  tl(tl(Cs@[D,D']))\" by simp\n  hence Cs'2:\"Cs' = X#Y#Xs\" by (cases Cs) auto\n  from Cs'1 have last:\"last Cs' = D'\" by simp\n  from Cs'1 have butlast:\"last(butlast Cs') = D\" by (simp add:butlast_tail)\n  from Nil Cs'1 Cs'2 have \"is_subobj P ((C,X#Y#Xs))\" by simp\n  with last butlast Cs'2 show ?case by simp\nnext\n  case (Cons C'' Cs'')\n  have IH:\"is_subobj P ( (C, Cs @ [D, D'] @ rev Cs'')) \\<Longrightarrow> P \\<turnstile> D \\<prec>\\<^sub>R D'\" by fact\n  from Cons obtain Cs' X Y Xs where Cs'1:\"Cs' = Cs@[D,D']@(rev (C''#Cs''))\" \n    and \"X = hd(Cs@[D,D']@(rev (C''#Cs'')))\" \n    and \"Y = hd(tl(Cs@[D,D']@(rev (C''#Cs''))))\"\n    and \"Xs =  tl(tl(Cs@[D,D']@(rev (C''#Cs''))))\" by simp\n  hence Cs'2:\"Cs' = X#Y#Xs\" by (cases Cs) auto\n  from Cons Cs'1 Cs'2 have \"is_subobj P ((C,X#Y#Xs))\" by simp\n  hence sub:\"is_subobj P ((C,butlast (X#Y#Xs)))\" by simp\n  from Cs'1 obtain E Es where Cs'3:\"Cs' = Es@[E]\" by (cases Cs') auto\n  with Cs'1 have butlast:\"Es = Cs@[D,D']@(rev Cs'')\" by simp\n  from Cs'3 have \"butlast Cs' = Es\" by simp\n  with butlast have \"butlast Cs' = Cs@[D,D']@(rev Cs'')\" by simp\n  with Cs'2 sub have \"is_subobj P ((C,Cs@[D,D']@(rev Cs'')))\"\n    by simp\n  with IH show ?case by simp\nqed\n\n\n\nlemma isSubobjs_subclsR:\nassumes 1:\"is_subobj P ((C,Cs@[D,D']@Cs'))\"\nshows \"P \\<turnstile> D \\<prec>\\<^sub>R D'\"\n\nproof -\n  from 1 obtain Cs'' where \"Cs'' = rev Cs'\" by simp\n  with 1 have \"is_subobj P ((C,Cs@[D,D']@(rev Cs'')))\" by simp\n  thus ?thesis by (rule isSubobjs_subclsR_rev)\nqed\n\n\n\n\nlemma mdc_leq_ldc_aux:\nassumes 1:\"is_subobj P ((C,C'#rev Cs'))\"\nshows \"P \\<turnstile> C \\<preceq>\\<^sup>* last (C'#rev Cs')\"\nusing 1\nproof (induct Cs')\n  case Nil\n  from 1 have \"is_class P C\"\n    by (drule_tac R=\"(C,C'#rev Cs')\" in isSubobj_isClass, simp add:mdc_def)\n  with Nil show ?case\n    proof (cases \"C=C'\")\n      case True\n      thus ?thesis by simp\n    next\n      case False\n      with Nil show ?thesis \n        by (auto dest!:subclsS_subcls1)\n    qed\n  next\n    case (Cons C'' Cs'')\n    have IH:\"is_subobj P ( (C, C' # rev Cs'')) \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* last (C' # rev Cs'')\"\n      and subo:\"is_subobj P ( (C, C' # rev (C'' # Cs'')))\" by fact+\n    hence \"is_subobj P ( (C, C' # rev Cs''))\" by (simp add:subobj_aux_rev)\n    with IH have rel:\"P \\<turnstile> C \\<preceq>\\<^sup>* last (C' # rev Cs'')\" by simp\n    from subo obtain D Ds where DDs:\"C' # rev Cs'' = Ds@[D]\"\n      by (cases Cs'') auto\n    hence \" C' # rev (C'' # Cs'') = Ds@[D,C'']\" by simp\n    with subo have \"is_subobj P ((C,Ds@[D,C'']))\" by (cases Ds) auto\n    hence \"P \\<turnstile> D \\<prec>\\<^sub>R C''\" by (rule_tac Cs'=\"[]\" in isSubobjs_subclsR) simp\n    hence rel1:\"P \\<turnstile> D \\<prec>\\<^sup>1 C''\" by (rule subclsR_subcls1)\n    from DDs have \"D = last (C' # rev Cs'')\" by simp\n    with rel1 have lastrel1:\"P \\<turnstile> last (C' # rev Cs'') \\<prec>\\<^sup>1 C''\" by simp\n    with rel have \"P \\<turnstile> C \\<preceq>\\<^sup>* C''\"\n      by(rule_tac b=\"last (C' # rev Cs'')\" in rtrancl_into_rtrancl) simp\n    thus ?case by simp\nqed\n\n\n\nlemma mdc_leq_ldc:\nassumes 1:\"is_subobj P (R)\"\nshows \"P \\<turnstile> mdc R \\<preceq>\\<^sup>* ldc R\"\n\nproof -\n  from 1 obtain C Cs where R:\"R = (C,Cs)\" by (cases R) auto\n  with 1 have ne:\"Cs \\<noteq> []\" by (cases Cs) auto\n  from this obtain C' Cs' where Cs:\"Cs = C'#Cs'\" by (cases Cs) auto\n  from this obtain Cs'' where Cs':\"Cs'' = rev Cs'\" by simp\n  with R Cs 1 have \"is_subobj P ((C,C'#rev Cs''))\" by simp\n  hence rel:\"P \\<turnstile> C \\<preceq>\\<^sup>* last (C'#rev Cs'')\" by (rule mdc_leq_ldc_aux)\n  from R Cs Cs' have ldc:\"last (C'#rev Cs'') = ldc R\" by(simp add:ldc_def)\n  from R have \"mdc R = C\" by(simp add:mdc_def)\n  with ldc rel show ?thesis by simp\nqed\n\n\n\ntext{* Next three lemmas show subobject property as presented in literature *}\n\nlemma class_isSubobj:\n  \"is_class P C \\<Longrightarrow> is_subobj P ((C,[C]))\"\nby simp\n\n\nlemma repSubobj_isSubobj:\nassumes 1:\"is_subobj P ((C,Xs@[X]))\" and 2:\"P \\<turnstile> X \\<prec>\\<^sub>R Y\"\nshows \"is_subobj P ((C,Xs@[X,Y]))\"\n\nusing 1\nproof -\n  obtain Cs D E Cs' where Cs1:\"Cs = Xs@[X,Y]\" and  \"D = hd(Xs@[X,Y])\"\n    and \"E = hd(tl(Xs@[X,Y]))\" and \"Cs' = tl(tl(Xs@[X,Y]))\"by simp\n  hence Cs2:\"Cs = D#E#Cs'\" by (cases Xs) auto\n  with 1 Cs1 have subobj_butlast:\"is_subobj P ((C,butlast(D#E#Cs')))\" \n    by (simp add:butlast_tail)\n  with 2 Cs1 Cs2 have \"P \\<turnstile> (last(butlast(D#E#Cs'))) \\<prec>\\<^sub>R last(D#E#Cs')\"\n    by (simp add:butlast_tail)\n  with subobj_butlast have \"is_subobj P ((C,(D#E#Cs')))\" by simp\n  with Cs1 Cs2 show ?thesis by simp\nqed\n\n\n\nlemma shSubobj_isSubobj:\nassumes 1:  \"is_subobj P ((C,Xs@[X]))\" and 2:\"P \\<turnstile> X \\<prec>\\<^sub>S Y\"\nshows \"is_subobj P ((C,[Y]))\"\n\nusing 1\nproof -\n  from 1 have classC:\"is_class P C\" \n    by (drule_tac R=\"(C,Xs@[X])\" in isSubobj_isClass, simp add:mdc_def)\n  from 1 have \"P \\<turnstile> C \\<preceq>\\<^sup>* X\" \n    by (drule_tac R=\"(C,Xs@[X])\" in mdc_leq_ldc, simp add:mdc_def ldc_def)\n  with classC 2 show ?thesis by fastforce\nqed\n\n\n\ntext{* Auxiliary lemmas *}\n\n\nlemma build_rec_isSubobj_rev:\nassumes 1:\"is_subobj P ((D,D#rev Cs))\" and 2:\" P \\<turnstile> C \\<prec>\\<^sub>R D\"\nshows \"is_subobj P ((C,C#D#rev Cs))\"\nusing 1\nproof (induct Cs)\n  case Nil\n  from 2 have \"is_class P C\" by (auto dest:subclsRD simp add:is_class_def)\n  with 1 2 show ?case by simp\nnext\n  case (Cons C' Cs')\n  have suboD:\"is_subobj P ((D,D#rev (C'#Cs')))\" \n    and IH:\"is_subobj P ((D,D#rev Cs')) \\<Longrightarrow> is_subobj P ((C,C#D#rev Cs'))\" by fact+\n  obtain E Es where E:\"E = hd (rev (C'#Cs'))\" and Es:\"Es = tl (rev (C'#Cs'))\"\n    by simp\n  with E have E_Es:\"rev (C'#Cs') = E#Es\" by simp\n  with E Es have butlast:\"butlast (D#E#Es) = D#rev Cs'\" by simp\n  from E_Es suboD have suboDE:\"is_subobj P ((D,D#E#Es))\" by simp\n  hence \"is_subobj P ((D,butlast (D#E#Es)))\" by simp\n  with butlast have \"is_subobj P ((D,D#rev Cs'))\" by simp\n  with IH have suboCD:\"is_subobj P ( (C, C#D#rev Cs'))\" by simp\n  from suboDE obtain Xs X Y Xs' where Xs':\"Xs' = D#E#Es\"\n    and bb:\"Xs = butlast (butlast (D#E#Es))\" \n    and lb:\"X = last(butlast (D#E#Es))\" and l:\"Y = last (D#E#Es)\" by simp\n  from this obtain Xs'' where Xs'':\"Xs'' = Xs@[X]\" by simp\n  with bb lb have \"Xs'' = butlast (D#E#Es)\" by simp\n  with l have \"D#E#Es = Xs''@[Y]\" by simp\n  with Xs'' have \"D#E#Es = Xs@[X]@[Y]\" by simp\n  with suboDE have \"is_subobj P ((D,Xs@[X,Y]))\" by simp\n  hence subR:\"P \\<turnstile> X \\<prec>\\<^sub>R Y\"  by(rule_tac Cs=\"Xs\" and Cs'=\"[]\" in isSubobjs_subclsR) simp\n  from E_Es Es have \"last (D#E#Es) = C'\" by simp\n  with subR lb l butlast have \"P \\<turnstile> last(D#rev Cs') \\<prec>\\<^sub>R C'\"\n    by (auto split:split_if_asm)\n  with suboCD show ?case by simp\nqed\n\n\n\nlemma build_rec_isSubobj:\nassumes 1:\"is_subobj P ((D,D#Cs))\" and 2:\" P \\<turnstile> C \\<prec>\\<^sub>R D\" \nshows \"is_subobj P ((C,C#D#Cs))\"\n\nproof -\n  obtain Cs' where Cs':\"Cs' = rev Cs\" by simp\n  with 1 have \"is_subobj P ((D,D#rev Cs'))\" by simp\n  with 2 have \"is_subobj P ((C,C#D#rev Cs'))\" \n    by - (rule build_rec_isSubobj_rev) \n  with Cs' show ?thesis by simp\nqed\n\n\n\n\n\nlemma isSubobj_isSubobj_isSubobj_rev:\nassumes 1:\"is_subobj P ((C,[D]))\" and 2:\"is_subobj P ((D,D#(rev Cs)))\" \nshows \"is_subobj P ((C,D#(rev Cs)))\"\nusing 2\nproof (induct Cs)\n case Nil\n with 1 show ?case by simp\nnext\n  case (Cons C' Cs')\n  have IH:\"is_subobj P ((D,D#rev Cs')) \\<Longrightarrow> is_subobj P ((C,D#rev Cs'))\"\n    and \"is_subobj P ((D,D#rev (C'#Cs')))\" by fact+\n  hence suboD:\"is_subobj P ((D,D#rev Cs'@[C']))\" by simp\n  hence \"is_subobj P ((D,D#rev Cs'))\" by (rule subobj_aux_rev)\n  with IH have suboC:\"is_subobj P ((C,D#rev Cs'))\" by simp\n  obtain C'' where C'':\"C'' = last(D#rev Cs')\" by simp\n  hence butlast:\"D#rev Cs' = butlast(D#rev Cs')@[C'']\" by simp\n  hence butlast2:\"D#rev Cs'@[C'] = butlast(D#rev Cs')@[C'']@[C']\" by simp\n  with suboD have \"is_subobj P ((D,butlast(D#rev Cs')@[C'']@[C']))\"\n    by simp\n  with C'' have subR:\"P \\<turnstile> C'' \\<prec>\\<^sub>R C'\"\n    by (rule_tac Cs=\"butlast(D#rev Cs')\" and Cs'=\"[]\" in isSubobjs_subclsR)simp\n  with C'' suboC butlast have \"is_subobj P ((C,butlast(D#rev Cs')@[C'']@[C']))\"\n    by (auto intro:repSubobj_isSubobj simp del:butlast.simps)\n  with butlast2 have \"is_subobj P ((C,D#rev Cs'@[C']))\"\n    by (cases Cs')auto\n  thus ?case by simp\nqed\n\n\nlemma isSubobj_isSubobj_isSubobj:\nassumes 1:\"is_subobj P ((C,[D]))\" and 2:\"is_subobj P ((D,D#Cs))\" \nshows \"is_subobj P ((C,D#Cs))\"\n\nproof -\n  obtain Cs' where Cs':\"Cs' = rev Cs\" by simp\n  with 2 have \"is_subobj P ((D,D#rev Cs'))\" by simp\n  with 1 have \"is_subobj P ((C,D#rev Cs'))\"\n  by - (rule isSubobj_isSubobj_isSubobj_rev)\nwith Cs' show ?thesis by simp\nqed\n\n\n\nsection {* Subobject handling and lemmas *}\n\ntext{* Subobjects consisting of repeated inheritance relations only: *}\n\ninductive Subobjs\\<^sub>R :: \"prog \\<Rightarrow> cname \\<Rightarrow> path \\<Rightarrow> bool\" for P :: prog\nwhere\n  SubobjsR_Base: \"is_class P C \\<Longrightarrow> Subobjs\\<^sub>R P C [C]\"\n| SubobjsR_Rep: \"\\<lbrakk>P \\<turnstile> C \\<prec>\\<^sub>R D; Subobjs\\<^sub>R P D Cs\\<rbrakk> \\<Longrightarrow> Subobjs\\<^sub>R P C (C # Cs)\"\n\ntext{* All subobjects: *}\n\ninductive Subobjs :: \"prog \\<Rightarrow> cname \\<Rightarrow> path \\<Rightarrow> bool\" for P :: prog\nwhere\n  Subobjs_Rep: \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> Subobjs P C Cs\"\n| Subobjs_Sh: \"\\<lbrakk>P \\<turnstile> C \\<preceq>\\<^sup>* C'; P \\<turnstile> C' \\<prec>\\<^sub>S D; Subobjs\\<^sub>R P D Cs\\<rbrakk>\n             \\<Longrightarrow> Subobjs P C Cs\"\n\n\nlemma Subobjs_Base:\"is_class P C \\<Longrightarrow> Subobjs P C [C]\"\nby (fastforce intro:Subobjs_Rep SubobjsR_Base)\n\nlemma SubobjsR_nonempty: \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> Cs \\<noteq> []\"\nby (induct rule: Subobjs\\<^sub>R.induct, simp_all)\n\nlemma Subobjs_nonempty: \"Subobjs P C Cs \\<Longrightarrow> Cs \\<noteq> []\"\nby (erule Subobjs.induct)(erule SubobjsR_nonempty)+\n\n\nlemma hd_SubobjsR:\n  \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> \\<exists>Cs'. Cs = C#Cs'\"\nby(erule Subobjs\\<^sub>R.induct,simp+)\n\n\nlemma SubobjsR_subclassRep: \n  \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> (C,last Cs) \\<in> (subclsR P)\\<^sup>*\"\n\napply(erule Subobjs\\<^sub>R.induct)\n apply simp\napply(simp add: SubobjsR_nonempty)\ndone\n\n\nlemma SubobjsR_subclass: \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* last Cs\"\n\napply(erule Subobjs\\<^sub>R.induct)\n apply simp\napply(simp add: SubobjsR_nonempty)\napply(blast intro:subclsR_subcls1 rtrancl_trans)\ndone\n\n\nlemma Subobjs_subclass: \"Subobjs P C Cs \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* last Cs\"\n\napply(erule Subobjs.induct)\n apply(erule SubobjsR_subclass)\napply(erule rtrancl_trans)\napply(blast intro:subclsS_subcls1 SubobjsR_subclass rtrancl_trans)\ndone\n\n\n\n\nlemma Subobjs_notSubobjsR:\n  \"\\<lbrakk>Subobjs P C Cs; \\<not> Subobjs\\<^sub>R P C Cs\\<rbrakk>\n\\<Longrightarrow> \\<exists>C' D. P \\<turnstile> C \\<preceq>\\<^sup>* C' \\<and> P \\<turnstile> C' \\<prec>\\<^sub>S D \\<and> Subobjs\\<^sub>R P D Cs\"\napply (induct rule: Subobjs.induct)\n apply clarsimp\napply fastforce\ndone\n\n\n\n\n\nlemma Subobjs_Subobjs:\"Subobjs P C (Cs@ C'#Cs') \\<Longrightarrow> Subobjs P C' (C'#Cs')\"\n  \n  apply -\n  apply (drule Subobjs.cases)\n  apply auto\n   apply (subgoal_tac \"C = hd(Cs @ C' # Cs')\")\n    apply (fastforce intro:SubobjsR_Subobjs)\n   apply (fastforce dest:hd_SubobjsR)\n  apply (subgoal_tac \"D = hd(Cs @ C' # Cs')\")\n   apply (fastforce intro:SubobjsR_Subobjs)\n  apply (fastforce dest:hd_SubobjsR)\n  done\n  \n\n\nlemma SubobjsR_isClass:\nassumes subo:\"Subobjs\\<^sub>R P C Cs\"\nshows \"is_class P C\"\n\nusing subo\nproof (induct rule:Subobjs\\<^sub>R.induct)\n  case SubobjsR_Base thus ?case by assumption\nnext\n  case SubobjsR_Rep thus ?case by (fastforce intro:subclsR_subcls1 subcls1_class)\nqed\n\n\nlemma Subobjs_isClass:\nassumes subo:\"Subobjs P C Cs\"\nshows \"is_class P C\"\n\nusing subo\nproof (induct rule:Subobjs.induct)\n  case Subobjs_Rep thus ?case by (rule SubobjsR_isClass)\nnext\n  case (Subobjs_Sh C C' D Cs)\n  have leq:\"P \\<turnstile> C \\<preceq>\\<^sup>* C'\" and leqS:\"P \\<turnstile> C' \\<prec>\\<^sub>S D\" by fact+\n  hence \"(C,D) \\<in> (subcls1 P)\\<^sup>+\" by (fastforce intro:rtrancl_into_trancl1 subclsS_subcls1)\n  thus ?case by (induct rule:trancl_induct, fastforce intro:subcls1_class)\nqed\n\n\nlemma Subobjs_subclsR:\nassumes subo:\"Subobjs P C (Cs@[D,D']@Cs')\"\nshows \"P \\<turnstile> D \\<prec>\\<^sub>R D'\"\n\nusing subo\nproof -\n  from subo have \"Subobjs P D (D#D'#Cs')\" by -(rule Subobjs_Subobjs,simp)\n  then obtain C' where subo':\"Subobjs\\<^sub>R P C' (D#D'#Cs')\"\n    by (induct rule:Subobjs.induct,blast+)\n  hence \"C' = D\" by -(drule hd_SubobjsR,simp)\n  with subo' have \"Subobjs\\<^sub>R P D (D#D'#Cs')\" by simp\n  thus ?thesis by (fastforce elim:Subobjs\\<^sub>R.cases dest:hd_SubobjsR)\nqed\n\n\n\n\nlemma assumes subo:\"Subobjs\\<^sub>R P (hd Cs) (Cs@[D])\" and notempty:\"Cs \\<noteq> []\"\n  shows butlast_Subobjs_Rep:\"Subobjs\\<^sub>R P (hd Cs) Cs\"\nusing subo notempty\nproof (induct Cs)\n  case Nil thus ?case by simp\nnext\n  case (Cons C' Cs')\n  have subo:\"Subobjs\\<^sub>R P (hd(C'#Cs')) ((C'#Cs')@[D])\"\n    and IH:\"\\<lbrakk>Subobjs\\<^sub>R P (hd Cs') (Cs'@[D]); Cs' \\<noteq> []\\<rbrakk> \\<Longrightarrow> Subobjs\\<^sub>R P (hd Cs') Cs'\" by fact+\n  from subo have subo':\"Subobjs\\<^sub>R P C' (C'#Cs'@[D])\" by simp\n  show ?case\n  proof (cases \"Cs' = []\")\n    case True\n    with subo' have \"Subobjs\\<^sub>R P C' [C',D]\" by simp\n    hence \"is_class P C'\" by(rule SubobjsR_isClass)\n    hence \"Subobjs\\<^sub>R P C' [C']\" by (rule SubobjsR_Base)\n    with True show ?thesis by simp\n  next\n    case False\n    with subo' obtain D' where subo'':\"Subobjs\\<^sub>R P D' (Cs'@[D])\"\n      and subR:\"P \\<turnstile> C' \\<prec>\\<^sub>R D'\"\n      by (auto elim:Subobjs\\<^sub>R.cases)\n    from False subo'' have hd:\"D' = hd Cs'\"\n      by (induct Cs',auto dest:hd_SubobjsR)\n    with subo'' False IH have \"Subobjs\\<^sub>R P (hd Cs') Cs'\" by simp \n    with subR hd have \"Subobjs\\<^sub>R P C' (C'#Cs')\" by (fastforce intro:SubobjsR_Rep)\n    thus ?thesis by simp\n  qed\nqed\n\n\n\nlemma assumes subo:\"Subobjs P C (Cs@[D])\" and notempty:\"Cs \\<noteq> []\"\n  shows butlast_Subobjs:\"Subobjs P C Cs\"\n\nusing subo\nproof (rule Subobjs.cases,auto)\n  assume suboR:\"Subobjs\\<^sub>R P C (Cs@[D])\" and \"Subobjs P C (Cs@[D])\"\n  from suboR notempty have hd:\"C = hd Cs\"\n    by (induct Cs,auto dest:hd_SubobjsR)\n  with suboR notempty have \"Subobjs\\<^sub>R P (hd Cs) Cs\"\n    by(fastforce intro:butlast_Subobjs_Rep)\n  with hd show \"Subobjs P C Cs\" by (fastforce intro:Subobjs_Rep)\nnext\n  fix C' D' assume leq:\"P \\<turnstile> C \\<preceq>\\<^sup>* C'\" and subS:\"P \\<turnstile> C' \\<prec>\\<^sub>S D'\"\n  and suboR:\"Subobjs\\<^sub>R P D' (Cs@[D])\" and \"Subobjs P C (Cs@[D])\"\n  from suboR notempty have hd:\"D' = hd Cs\"\n    by (induct Cs,auto dest:hd_SubobjsR)\n  with suboR notempty have \"Subobjs\\<^sub>R P (hd Cs) Cs\"\n    by(fastforce intro:butlast_Subobjs_Rep)\n  with hd leq subS show \"Subobjs P C Cs\"\n    by(fastforce intro:Subobjs_Sh)\nqed\n\n\n\n\nlemma assumes subo:\"Subobjs P C (Cs@(rev Cs'))\" and notempty:\"Cs \\<noteq> []\"\n  shows rev_appendSubobj:\"Subobjs P C Cs\"\nusing subo\nproof(induct Cs')\n  case Nil thus ?case by simp\nnext\n  case (Cons D Ds)\n  have subo':\"Subobjs P C (Cs@rev(D#Ds))\"\n    and IH:\"Subobjs P C (Cs@rev Ds) \\<Longrightarrow> Subobjs P C Cs\" by fact+\n  from notempty subo' have \"Subobjs P C (Cs@rev Ds)\"\n    by (fastforce intro:butlast_Subobjs)\n  with IH show ?case by simp\nqed\n\n\n\nlemma appendSubobj:\nassumes subo:\"Subobjs P C (Cs@Cs')\" and notempty:\"Cs \\<noteq> []\"\nshows \"Subobjs P C Cs\"\n\nproof -\n  obtain Cs'' where Cs'':\"Cs'' = rev Cs'\" by simp\n  with subo have \"Subobjs P C (Cs@(rev Cs''))\" by simp\n  with notempty show ?thesis by - (rule rev_appendSubobj)\nqed\n\n\n\n\nlemma SubobjsR_isSubobj:\n  \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> is_subobj P ((C,Cs))\"\nby(erule Subobjs\\<^sub>R.induct,simp,\n  auto dest:hd_SubobjsR intro:build_rec_isSubobj)\n\nlemma leq_SubobjsR_isSubobj:\n  \"\\<lbrakk>P \\<turnstile> C \\<preceq>\\<^sup>* C'; P \\<turnstile> C' \\<prec>\\<^sub>S D; Subobjs\\<^sub>R P D Cs\\<rbrakk> \n\\<Longrightarrow> is_subobj P ((C,Cs))\"\n\napply (subgoal_tac \"is_subobj P ((C,[D]))\")\n apply (frule hd_SubobjsR)\n apply (drule SubobjsR_isSubobj)\n apply (erule exE)\n apply (simp del: is_subobj.simps)\n apply (erule isSubobj_isSubobj_isSubobj)\n apply simp\napply auto\ndone\n\n\nlemma Subobjs_isSubobj:\n  \"Subobjs P C Cs \\<Longrightarrow> is_subobj P ((C,Cs))\"\nby (auto elim:Subobjs.induct SubobjsR_isSubobj \n  simp add:leq_SubobjsR_isSubobj)\n\n\n\nsection {* Paths *}\n\n\nsubsection {* Appending paths *}\n\ntext{* Avoided name clash by calling one path Path. *}\n\ndefinition path_via :: \"prog \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> path \\<Rightarrow> bool\" (\"_ \\<turnstile> Path _ to _ via _ \" [51,51,51,51] 50) where\n  \"P \\<turnstile> Path C to D via Cs \\<equiv> Subobjs P C Cs \\<and> last Cs = D\"\n\ndefinition path_unique :: \"prog \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> bool\" (\"_ \\<turnstile> Path _ to _ unique\" [51,51,51] 50) where\n  \"P \\<turnstile> Path C to D unique \\<equiv> \\<exists>!Cs. Subobjs P C Cs \\<and> last Cs = D\"\n\ndefinition appendPath :: \"path \\<Rightarrow> path \\<Rightarrow> path\" (infixr \"@\\<^sub>p\" 65) where\n  \"Cs @\\<^sub>p Cs' \\<equiv> if (last Cs = hd Cs') then Cs @ (tl Cs') else Cs'\"\n\n\nlemma appendPath_last: \"Cs \\<noteq> [] \\<Longrightarrow> last Cs = last (Cs'@\\<^sub>pCs)\"\nby(auto simp:appendPath_def last_append)(cases Cs, simp_all)+\n\n\n\ninductive\n  casts_to :: \"prog \\<Rightarrow> ty \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ casts _ to _ \" [51,51,51,51] 50)\n  for P :: prog\nwhere\n\n  casts_prim: \"\\<forall>C. T \\<noteq> Class C \\<Longrightarrow> P \\<turnstile> T casts v to v\"\n\n| casts_null: \"P \\<turnstile> Class C casts Null to Null\"\n\n| casts_ref: \"\\<lbrakk> P \\<turnstile> Path last Cs to C via Cs'; Ds = Cs@\\<^sub>pCs' \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> Class C casts Ref(a,Cs) to Ref(a,Ds)\"\n\n\ninductive\n  Casts_to :: \"prog \\<Rightarrow> ty list \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ Casts _ to _ \" [51,51,51,51] 50)\n  for P :: prog\nwhere\n\n  Casts_Nil: \"P \\<turnstile> [] Casts [] to []\"\n\n| Casts_Cons: \"\\<lbrakk> P \\<turnstile> T casts v to v'; P \\<turnstile> Ts Casts vs to vs' \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> (T#Ts) Casts (v#vs) to (v'#vs')\"\n\n\n\nlemma length_Casts_vs:\n  \"P \\<turnstile> Ts Casts vs to vs' \\<Longrightarrow> length Ts = length vs\"\nby (induct rule:Casts_to.induct,simp_all)\n\nlemma length_Casts_vs':\n  \"P \\<turnstile> Ts Casts vs to vs' \\<Longrightarrow> length Ts = length vs'\"\nby (induct rule:Casts_to.induct,simp_all)\n\n\n\nsubsection {* The relation on paths *}\n\ninductive_set\n  leq_path1 :: \"prog \\<Rightarrow> cname \\<Rightarrow> (path \\<times> path) set\"\n  and leq_path1' :: \"prog \\<Rightarrow> cname \\<Rightarrow> [path, path] \\<Rightarrow> bool\" (\"_,_ \\<turnstile> _ \\<sqsubset>\\<^sup>1 _\" [71,71,71] 70)\n  for P :: prog and C :: cname\nwhere\n  \"P,C \\<turnstile> Cs \\<sqsubset>\\<^sup>1 Ds \\<equiv> (Cs,Ds) \\<in> leq_path1 P C\"\n| leq_pathRep: \"\\<lbrakk> Subobjs P C Cs; Subobjs P C Ds; Cs = butlast Ds\\<rbrakk>\n  \\<Longrightarrow> P,C \\<turnstile> Cs \\<sqsubset>\\<^sup>1 Ds\"\n| leq_pathSh:  \"\\<lbrakk> Subobjs P C Cs; P \\<turnstile> last Cs \\<prec>\\<^sub>S D \\<rbrakk>\n  \\<Longrightarrow> P,C \\<turnstile> Cs \\<sqsubset>\\<^sup>1 [D]\"\n\nabbreviation\n  leq_path :: \"prog \\<Rightarrow> cname \\<Rightarrow> [path, path] \\<Rightarrow> bool\" (\"_,_ \\<turnstile> _ \\<sqsubseteq> _\"  [71,71,71] 70) where\n  \"P,C \\<turnstile> Cs \\<sqsubseteq> Ds \\<equiv> (Cs,Ds) \\<in> (leq_path1 P C)\\<^sup>*\"\n\n\nlemma leq_path_rep:\n  \"\\<lbrakk> Subobjs P C (Cs@[C']); Subobjs P C (Cs@[C',C''])\\<rbrakk> \n\\<Longrightarrow> P,C \\<turnstile> (Cs@[C']) \\<sqsubset>\\<^sup>1 (Cs@[C',C''])\"\nby(rule leq_pathRep,simp_all add:butlast_tail)\n\nlemma leq_path_sh:\n  \"\\<lbrakk> Subobjs P C (Cs@[C']); P \\<turnstile> C' \\<prec>\\<^sub>S C''\\<rbrakk> \n\\<Longrightarrow> P,C \\<turnstile> (Cs@[C']) \\<sqsubset>\\<^sup>1 [C'']\"\nby(erule leq_pathSh)simp\n\n\n\n\nsection{* Member lookups *}\n\ndefinition FieldDecls :: \"prog \\<Rightarrow> cname \\<Rightarrow> vname \\<Rightarrow> (path \\<times> ty) set\" where\n  \"FieldDecls P C F \\<equiv> \n   {(Cs,T). Subobjs P C Cs \\<and> (\\<exists>Bs fs ms. class P (last Cs) = Some(Bs,fs,ms)\n                                    \\<and> map_of fs F = Some T)}\"\n\ndefinition LeastFieldDecl  :: \"prog \\<Rightarrow> cname \\<Rightarrow> vname \\<Rightarrow> ty \\<Rightarrow> path \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ has least _:_ via _\" [51,0,0,0,51] 50) where\n  \"P \\<turnstile> C has least F:T via Cs \\<equiv>\n   (Cs,T) \\<in> FieldDecls P C F \\<and>\n   (\\<forall>(Cs',T') \\<in> FieldDecls P C F. P,C \\<turnstile> Cs \\<sqsubseteq> Cs')\"\n\ndefinition MethodDefs :: \"prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> (path \\<times> method)set\" where\n  \"MethodDefs P C M \\<equiv>\n   {(Cs,mthd). Subobjs P C Cs \\<and> (\\<exists>Bs fs ms. class P (last Cs) = Some(Bs,fs,ms)\n                                    \\<and> map_of ms M = Some mthd)}\"\n\n  -- \"needed for well formed criterion\"\ndefinition HasMethodDef :: \"prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> method \\<Rightarrow> path \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ has _ = _ via _\" [51,0,0,0,51] 50) where\n  \"P \\<turnstile> C has M = mthd via Cs \\<equiv> (Cs,mthd) \\<in> MethodDefs P C M\"\n\ndefinition LeastMethodDef :: \"prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> method \\<Rightarrow> path \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ has least _ = _ via _\" [51,0,0,0,51] 50) where\n  \"P \\<turnstile> C has least M = mthd via Cs \\<equiv>\n   (Cs,mthd) \\<in> MethodDefs P C M \\<and>\n   (\\<forall>(Cs',mthd') \\<in> MethodDefs P C M. P,C \\<turnstile> Cs \\<sqsubseteq> Cs')\"\n\ndefinition MinimalMethodDefs :: \"prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> (path \\<times> method)set\" where\n  \"MinimalMethodDefs P C M \\<equiv> \n      {(Cs,mthd). (Cs,mthd) \\<in> MethodDefs P C M \\<and> \n         (\\<forall>(Cs',mthd')\\<in> MethodDefs P C M. P,C \\<turnstile> Cs' \\<sqsubseteq> Cs \\<longrightarrow> Cs' = Cs)}\"\n\ndefinition OverriderMethodDefs :: \"prog \\<Rightarrow> subobj \\<Rightarrow> mname \\<Rightarrow> (path \\<times> method)set\" where\n  \"OverriderMethodDefs P R M \\<equiv>\n      {(Cs,mthd). \\<exists>Cs' mthd'. P \\<turnstile> (ldc R) has least M = mthd' via Cs' \\<and>\n                      (Cs,mthd) \\<in> MinimalMethodDefs P (mdc R) M \\<and> \n                      P,mdc R \\<turnstile> Cs \\<sqsubseteq> (snd R)@\\<^sub>pCs'}\"\n\ndefinition FinalOverriderMethodDef :: \"prog \\<Rightarrow> subobj \\<Rightarrow> mname \\<Rightarrow> method \\<Rightarrow> path \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ has overrider _ = _ via _\" [51,0,0,0,51] 50) where\n  \"P \\<turnstile> R has overrider M = mthd via Cs \\<equiv> \n      (Cs,mthd) \\<in> OverriderMethodDefs P R M \\<and> \n      card(OverriderMethodDefs P R M) = 1\"\n      (*(\\<forall>(Cs',mthd') \\<in> OverriderMethodDefs P R M. Cs = Cs' \\<and> mthd = mthd')\"*)\n\n\ninductive\n  SelectMethodDef :: \"prog \\<Rightarrow> cname \\<Rightarrow> path \\<Rightarrow> mname \\<Rightarrow> method \\<Rightarrow> path \\<Rightarrow> bool\"\n     (\"_ \\<turnstile> '(_,_') selects _ = _ via _\" [51,0,0,0,0,51] 50)\n  for P :: prog\nwhere\n\n  dyn_unique:\n    \"P \\<turnstile> C has least M = mthd via Cs' \\<Longrightarrow> P \\<turnstile> (C,Cs) selects M = mthd via Cs'\"\n\n| dyn_ambiguous:\n    \"\\<lbrakk>\\<forall>mthd Cs'. \\<not> P \\<turnstile> C has least M = mthd via Cs'; \n      P \\<turnstile> (C,Cs) has overrider M = mthd via Cs'\\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> (C,Cs) selects M = mthd via Cs'\"\n\n\n\nlemma sees_fields_fun:\n  \"(Cs,T) \\<in> FieldDecls P C F \\<Longrightarrow> (Cs,T') \\<in> FieldDecls P C F \\<Longrightarrow> T = T'\"\nby(fastforce simp:FieldDecls_def)\n\nlemma sees_field_fun:\n  \"\\<lbrakk>P \\<turnstile> C has least F:T via Cs; P \\<turnstile> C has least F:T' via Cs\\<rbrakk>\n  \\<Longrightarrow> T = T'\"\nby (fastforce simp:LeastFieldDecl_def dest:sees_fields_fun)\n\n\nlemma has_least_method_has_method:\n  \"P \\<turnstile> C has least M = mthd via Cs \\<Longrightarrow> P \\<turnstile> C has M = mthd via Cs\"\nby (simp add:LeastMethodDef_def HasMethodDef_def)\n\n\nlemma visible_methods_exist:\n  \"(Cs,mthd) \\<in> MethodDefs P C M \\<Longrightarrow>\n  (\\<exists>Bs fs ms. class P (last Cs) = Some(Bs,fs,ms) \\<and> map_of ms M = Some mthd)\"\nby(auto simp:MethodDefs_def)\n\n\nlemma sees_methods_fun:\n  \"(Cs,mthd) \\<in> MethodDefs P C M \\<Longrightarrow> (Cs,mthd') \\<in> MethodDefs P C M \\<Longrightarrow> mthd = mthd'\"\nby(fastforce simp:MethodDefs_def)\n\nlemma sees_method_fun:\n  \"\\<lbrakk>P \\<turnstile> C has least M = mthd via Cs; P \\<turnstile> C has least M = mthd' via Cs\\<rbrakk>\n  \\<Longrightarrow> mthd = mthd'\"\nby (fastforce simp:LeastMethodDef_def dest:sees_methods_fun)\n\n\nlemma overrider_method_fun:\nassumes overrider:\"P \\<turnstile> (C,Cs) has overrider M = mthd via Cs'\"\n  and overrider':\"P \\<turnstile> (C,Cs) has overrider M = mthd' via Cs''\"\nshows \"mthd = mthd' \\<and> Cs' = Cs''\"\nproof -\n  from overrider' have omd:\"(Cs'',mthd') \\<in> OverriderMethodDefs P (C,Cs) M\"\n    by(simp_all add:FinalOverriderMethodDef_def)\n  from overrider have \"(Cs',mthd) \\<in> OverriderMethodDefs P (C,Cs) M\"\n    and \"card(OverriderMethodDefs P (C,Cs) M) = 1\" \n    by(simp_all add:FinalOverriderMethodDef_def)\n  hence \"\\<forall>(Ds,mthd'') \\<in> OverriderMethodDefs P (C,Cs) M. (Cs',mthd) = (Ds,mthd'')\"\n    by(fastforce simp:card_Suc_eq)\n  with omd show ?thesis by fastforce\nqed\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/CoreC++/SubObj.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.32216100508746953}}
{"text": "theory Denotational\n  imports \"Abstract-Denotational-Props\" \"Value-Nominal\"\nbegin\n\ntext {*\nThis is the actual denotational semantics as found in \\cite{launchbury}.\n*}\n\ninterpretation semantic_domain Fn Fn_project \"\\<Lambda> x. x\".\n\nabbreviation ESem_syn'' (\"\\<lbrakk> _ \\<rbrakk>\\<^bsub>_\\<^esub>\"  [60,60] 60) where \"\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>\\<^esub> \\<equiv> ESem e \\<cdot> \\<rho>\"\nabbreviation EvalHeapSem_syn''  (\"\\<^bold>\\<lbrakk> _ \\<^bold>\\<rbrakk>\\<^bsub>_\\<^esub>\"  [0,0] 110)  where \"\\<^bold>\\<lbrakk>\\<Gamma>\\<^bold>\\<rbrakk>\\<^bsub>\\<rho>\\<^esub> \\<equiv> evalHeap \\<Gamma> (\\<lambda> e. \\<lbrakk>e\\<rbrakk>\\<^bsub>\\<rho>\\<^esub>)\"\nabbreviation HSem_syn' (\"\\<lbrace>_\\<rbrace>_\"  [60,60] 60) where \"\\<lbrace>\\<Gamma>\\<rbrace>\\<rho> \\<equiv> HSem \\<Gamma> \\<cdot> \\<rho>\"\nabbreviation HSem_bot  (\"\\<lbrace>_\\<rbrace>\"  [60] 60) where \"\\<lbrace>\\<Gamma>\\<rbrace> \\<equiv> \\<lbrace>\\<Gamma>\\<rbrace>\\<bottom>\"\n\nlemma ESem_simps_as_defined:\n  \"\\<lbrakk> Lam [x]. e \\<rbrakk>\\<^bsub>\\<rho>\\<^esub> =  Fn\\<cdot>(\\<Lambda> v. \\<lbrakk> e \\<rbrakk>\\<^bsub>(\\<rho> f|` (fv (Lam [x].e)))(x := v)\\<^esub>)\"\n  \"\\<lbrakk> App e x \\<rbrakk>\\<^bsub>\\<rho>\\<^esub>    =  \\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>\\<^esub> \\<down>Fn \\<rho> x\"\n  \"\\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<rho>\\<^esub>      =  \\<rho>  x\"\n  \"\\<lbrakk> Let as body \\<rbrakk>\\<^bsub>\\<rho>\\<^esub> = \\<lbrakk>body\\<rbrakk>\\<^bsub>\\<lbrace>as\\<rbrace>(\\<rho> f|` fv (Let as body))\\<^esub>\"\n  by (simp_all del: ESem_Lam ESem_Let add: ESem.simps(1,4) )\n\nlemma ESem_simps:\n  \"\\<lbrakk> Lam [x]. e \\<rbrakk>\\<^bsub>\\<rho>\\<^esub> =  Fn\\<cdot>(\\<Lambda> v. \\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>(x := v)\\<^esub>)\"\n  \"\\<lbrakk> App e x \\<rbrakk>\\<^bsub>\\<rho>\\<^esub>    =  \\<lbrakk> e \\<rbrakk>\\<^bsub>\\<rho>\\<^esub> \\<down>Fn \\<rho> x\"\n  \"\\<lbrakk> Var x \\<rbrakk>\\<^bsub>\\<rho>\\<^esub>      =  \\<rho>  x\"\n  \"\\<lbrakk> Let as body \\<rbrakk>\\<^bsub>\\<rho>\\<^esub> = \\<lbrakk>body\\<rbrakk>\\<^bsub>\\<lbrace>as\\<rbrace>\\<rho>\\<^esub>\"\n  by simp_all\n(*<*)\n\ntext {*\nExcluded from the document, as these are unused in the current development.\n*}\n\nsubsubsection {* Replacing subexpressions by variables *}\n\nlemma HSem_subst_var_app:\n  assumes fresh: \"atom n \\<sharp> x\"\n  shows \"\\<lbrace>(x, App (Var n) y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho> = \\<lbrace>(x, App e y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho> \"\nproof(rule HSem_subst_expr)\n  from fresh have [simp]: \"n \\<noteq> x\" by (simp add: fresh_at_base)\n  have ne: \"(n,e) \\<in> set ((x, App e y) # (n, e) # \\<Gamma>)\" by simp\n\n  have \"\\<lbrakk> Var n \\<rbrakk>\\<^bsub>\\<lbrace>(x, App e y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub> = (\\<lbrace>(x, App e y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>) n\"\n    by simp\n  also have \"... = \\<lbrakk> e \\<rbrakk>\\<^bsub>(\\<lbrace>(x, App e y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>)\\<^esub>\"\n    by (subst HSem_eq, simp)\n  finally\n  show \"\\<lbrakk> App (Var n) y \\<rbrakk>\\<^bsub>\\<lbrace>(x, App e y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> \\<lbrakk> App e y \\<rbrakk>\\<^bsub>\\<lbrace>(x, App e y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub>\"\n    by simp\n\n have \"\\<lbrakk> Var n \\<rbrakk>\\<^bsub>\\<lbrace>(x, App (Var n) y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub> = (\\<lbrace>(x, App (Var n) y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>) n\"\n    by simp\n  also have \"... = \\<lbrakk> e \\<rbrakk>\\<^bsub>(\\<lbrace>(x, App (Var n) y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>)\\<^esub>\"\n    by (subst HSem_eq, simp)\n  finally\n  show \"\\<lbrakk> App e y \\<rbrakk>\\<^bsub>\\<lbrace>(x, App (Var n) y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> \\<lbrakk> App (Var n) y \\<rbrakk>\\<^bsub>\\<lbrace>(x, App (Var n) y) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub>\"\n    by simp\nqed\n\nlemma HSem_subst_var_var:\n  assumes fresh: \"atom n \\<sharp> x\"\n  shows \"\\<lbrace>(x, Var n) # (n, e) # \\<Gamma>\\<rbrace>\\<rho> = \\<lbrace>(x, e) # (n, e) # \\<Gamma>\\<rbrace>\\<rho> \"\nproof(rule HSem_subst_expr)\n  from fresh have [simp]: \"n \\<noteq> x\" by (simp add: fresh_at_base)\n  have ne: \"(n,e) \\<in> set ((x, e) # (n, e) # \\<Gamma>)\" by simp\n\n  have \"\\<lbrakk> Var n \\<rbrakk>\\<^bsub>\\<lbrace>(x, e) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub> = (\\<lbrace>(x, e) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>) n\"\n    by simp\n  also have \"... = \\<lbrakk> e \\<rbrakk>\\<^bsub>(\\<lbrace>(x, e) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>)\\<^esub>\"\n    by (subst HSem_eq, simp)\n  finally\n  show \"\\<lbrakk> Var n \\<rbrakk>\\<^bsub>\\<lbrace>(x, e) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> \\<lbrakk> e \\<rbrakk>\\<^bsub>\\<lbrace>(x, e) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub>\"\n    by simp\n\n  have \"\\<lbrakk> Var n \\<rbrakk>\\<^bsub>\\<lbrace>(x, Var n) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub> = (\\<lbrace>(x, Var n) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>) n\"\n    by simp\n  also have \"... = \\<lbrakk> e \\<rbrakk>\\<^bsub>(\\<lbrace>(x, Var n) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>)\\<^esub>\"\n    by (subst HSem_eq, simp)\n  finally\n  show \"\\<lbrakk> e \\<rbrakk>\\<^bsub>\\<lbrace>(x, Var n) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub> \\<sqsubseteq> \\<lbrakk> Var n \\<rbrakk>\\<^bsub>\\<lbrace>(x, Var n) # (n, e) # \\<Gamma>\\<rbrace>\\<rho>\\<^esub>\"\n    by simp\nqed\n(*>*)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Launchbury/Denotational.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.32216100508746953}}
{"text": "(*<*) theory Failure imports RealRandVar begin (*>*)\n\ntext{*\nDefining Lebesgue integration can be quite involved, judging by the\nprocess in \\ref{sec:stepwise-approach} that imitates Bauer's way\n\\cite{Bauer}.  So it is quite tempting to try cutting a corner. The\nfollowing two alternative approaches back up my experience that this\nalmost never pays in formalization. The theory that seems most complex\nat first sight is often the one that is closest to formal reasoning\nand deliberately avoids ``hand-waving''.\n\n\n\\subsection{A closed expression}\n\\label{sec:closed-expression}\n\n  In contrast, Billingsley's definition \\cite[p.~172]{Billingsley86} is\n  strikingly short. For nonnegative measurable functions $f$:\n\n  \\begin{quote}\n  \n  $\\int f d\\mu = \\mathit{sup} \\sum_i \\big[ \\mathit{inf}_{\\omega \\in A_i} f(w) \\big] \\mu(A_i).$\n  \n  The supremum here extends over all finite decompositions $\\{A_i\\}$ of\n  $\\Omega$ into $\\mathcal{F}$-sets.\\footnote{The $\\mathcal{F}$-sets are just the measurable sets of a measure\n  space.}\n\n  \\end{quote}\n  \n  Like the definition, the proofs of the essential properties are also\n  rather\n  short, about three pages in the textbook for almost all the theorems\n  in \\ref{sec:stepwise-approach}; and a proof of uniqueness is obsolete\n  for a closed expression like this. Therefore, I found this approach\n  quite tempting. It turns out, however, that it is unfortunately not\n  well suited for formalization, at least with the background we use.\n  \n  A complication shared by all possible styles of definition is the lack\n  of infinite values in our theory, combined with the lack of partial\n  functions in HOL. Like the sum operator in\n  \\ref{sec:measure-spaces}, the integral has to be defined\n  indirectly. The classical way to do this employs predicates, invoking @{text \\<epsilon>}\n  to choose the value that satisfies the condition:\n\n  @{text \"\\<integral> f dM \\<equiv> (\\<epsilon> i. is_integral M f i)\"}\n\n  To sensibly apply this principle, the predicate has to be @{text\n  \\<epsilon>}-free to supply the information if the integral is\n  defined or not. Now the above definition contains up to three additional\n  @{text \\<epsilon>} when formalized naively in HOL, namely in the supremum,\n  infimum and sum operators. The sum is over a finite set, so it can\n  be replaced by a total function. For nonnegative functions, the\n  infimum can also be shown to exist everywhere, but, like the\n  supremum,  must\n  itself be replaced by a predicate. \n\n  Also note that predicates require a proof of uniqueness, thus losing\n  the prime advantage of a closed formula anyway. In this case,\n  uniqueness can be reduced to uniqueness of the supremum/infimum. The\n  problem is that neither suprema nor infima come predefined in\n  Isabelle/Isar as of yet. It is an easy task to make up for this ---\n  and I did --- but a much harder one to establish all the properties\n  needed for reasoning with the defined entities.\n\n  A lot of such reasoning is necessary to deduce from the above definition\n  (or a formal version of it, as just outlined) the basic behavior of\n  integration, which includes additivity, monotonicity and especially the\n  integral of simple functions. It turns out that the brevity of the\n  proofs in the textbook stems from a severely informal style that\n  assumes ample background knowledge. Formalizing all this knowledge\n  started to become overwhelming when the idea of a contrarian approach\n  emerged.   \n\n  \\subsection{A one-step inductive definition}\n  \\label{sec:one-step}\n  \n  This idea was sparked by the following note: ``(\\ldots) the integral\n  is uniquely determined by certain simple properties it is natural to\n  require of it'' \\cite[p.~175]{Billingsley86}. Billingsley goes on\n  discussing exactly those properties that are so hard to derive\n  from his definition. So why not simply define integration using\n  these properties? That is the gist of an inductive set definition, like\n  the one we have seen in \\ref{sec:sigma}. This time a functional operator is\n  to be defined, but it can be represented as a set of pairs, where\n  the first component is the function and the second its integral.\n  To cut a long story short, here is the definition. *}\n\ninductive_set\n  integral_set:: \"('a set set * ('a set \\<Rightarrow> real)) \\<Rightarrow> (('a \\<Rightarrow> real) * real) set\"\n  for M :: \"'a set set * ('a set \\<Rightarrow> real)\"\n  where\n    char: \"\\<lbrakk>f = \\<chi> A; A \\<in> measurable_sets M\\<rbrakk> \\<Longrightarrow> (f,measure M A) \\<in> integral_set M\"\n  | add: \"\\<lbrakk>f = (\\<lambda>w. g w + h w); (g,x) \\<in> integral_set M; (h,y) \\<in> integral_set M\\<rbrakk> \n    \\<Longrightarrow> (f,(x + y)) \\<in> integral_set M\"\n  | times: \"\\<lbrakk>f = (\\<lambda>w. a*g w); (g,x) \\<in> integral_set M\\<rbrakk> \\<Longrightarrow> (f,a*x) \\<in> integral_set M\"\n  | mon_conv: \"\\<lbrakk>u\\<up>f; \\<And>n. (u n, x n) \\<in> integral_set M; x\\<up>y\\<rbrakk> \n    \\<Longrightarrow> (f,y) \\<in> integral_set M\"\n\n  text {*The technique is also encountered in the @{text\n    \"Finite_Set\"} theory from the Isabelle library. It is used there\n    to define the @{text setsum} function, which calculates a sum\n    indexed over a finite set and is employed in\n    \\ref{sec:stepwise-approach}. The definition here is much more\n    intricate though. \n\n    An obvious advantage of this approach is that almost all\n    important properties are gained without effort. The\n    introduction rule @{text mon_conv} corresponds to what is known as\n    the Monotone Convergence Theorem in scientific literature; negative functions are also provided for via\n    the @{text times} rule. \n    To be precise,\n    there is exactly one important theorem missing ---\n    uniqueness. That is, every function appears in at most one pair. \n    \n    From uniqueness together with the introduction rules, all the\n    other statements about integration, monotonicity for example,\n    could be derived. On the other hand, monotonicity implies\n    uniqueness. Much to my regret, none of these two could be proven.\n    The proof would basically amount to a double induction to show\n    that an integral gained via one rule is the same when derived by\n    another. A lot of effort was spent trying to strengthen the\n    induction hypothesis or reduce the goal to a simpler case. All of\n    this was in vain though, and it seems that the hypothesis would\n    have to be strengthened as far as to include the concept of\n    integration in the first place, which in a way defeats the\n    advantages of the approach. *}\n    \n\n  (*<*)end  (*>*)\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Integration/Failure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.32216100508746953}}
{"text": "(*  Title:      HOL/MicroJava/BV/JVM.thy\n\n    Author:     Tobias Nipkow, Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nheader {* \\isaheader{LBV for the JVM}\\label{sec:JVM} *}\n\ntheory LBVJVM\nimports\n  \"../DFA/Abstract_BV\"\n  TF_JVM\nbegin\n\ntype_synonym prog_cert = \"cname \\<Rightarrow> mname \\<Rightarrow> ty\\<^sub>i' err list\"\n\ndefinition check_cert :: \"'addr jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> bool\"\nwhere\n  \"check_cert P mxs mxl n cert \\<equiv> check_types P mxs mxl cert \\<and> size cert = n+1 \\<and>\n                                 (\\<forall>i<n. cert!i \\<noteq> Err) \\<and> cert!n = OK None\"\n\ndefinition lbvjvm :: \"'addr jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> \n             ty\\<^sub>i' err list \\<Rightarrow> 'addr instr list \\<Rightarrow> ty\\<^sub>i' err \\<Rightarrow> ty\\<^sub>i' err\"\nwhere\n  \"lbvjvm P mxs maxr T\\<^sub>r et cert bs \\<equiv>\n  wtl_inst_list bs cert (JVM_SemiType.sup P mxs maxr) (JVM_SemiType.le P mxs maxr) Err (OK None) (exec P mxs T\\<^sub>r et bs) 0\"\n\ndefinition wt_lbv :: \"'addr jvm_prog \\<Rightarrow> cname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n             ex_table \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> 'addr instr list \\<Rightarrow> bool\"\nwhere\n  \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 et cert ins \\<equiv>\n   check_cert P mxs (1+size Ts+mxl\\<^sub>0) (size ins) cert \\<and>\n   0 < size ins \\<and> \n   (let start  = Some ([],(OK (Class C))#((map OK Ts))@(replicate mxl\\<^sub>0 Err));\n        result = lbvjvm P mxs (1+size Ts+mxl\\<^sub>0) T\\<^sub>r et cert ins (OK start)\n    in result \\<noteq> Err)\"\n\ndefinition wt_jvm_prog_lbv :: \"'addr jvm_prog \\<Rightarrow> prog_cert \\<Rightarrow> bool\"\nwhere\n  \"wt_jvm_prog_lbv P cert \\<equiv>\n  wf_prog (\\<lambda>P C (mn,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,b,et)). wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 et (cert C mn) b) P\"\n\ndefinition mk_cert :: \"'addr jvm_prog \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> 'addr instr list \n              \\<Rightarrow> ty\\<^sub>m \\<Rightarrow> ty\\<^sub>i' err list\"\nwhere\n  \"mk_cert P mxs T\\<^sub>r et bs phi \\<equiv> make_cert (exec P mxs T\\<^sub>r et bs) (map OK phi) (OK None)\"\n\ndefinition prg_cert :: \"'addr jvm_prog \\<Rightarrow> ty\\<^sub>P \\<Rightarrow> prog_cert\"\nwhere\n  \"prg_cert P phi C mn \\<equiv> let (C,Ts,T\\<^sub>r,meth) = method P C mn; (mxs,mxl\\<^sub>0,ins,et) = the meth\n                         in  mk_cert P mxs T\\<^sub>r et ins (phi C mn)\"\n   \nlemma check_certD [intro?]:\n  \"check_cert P mxs mxl n cert \\<Longrightarrow> cert_ok cert n Err (OK None) (states P mxs mxl)\"\n  by (unfold cert_ok_def check_cert_def check_types_def) auto\n\n\nlemma (in start_context) wt_lbv_wt_step:\n  assumes lbv: \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"\n  shows \"\\<exists>\\<tau>s \\<in> list (size is) A. wt_step r Err step \\<tau>s \\<and> OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\"\n(*<*)\nproof -\n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover note bounded_step\n  moreover from lbv have \"cert_ok cert (size is) Err (OK None) A\"\n    by (unfold wt_lbv_def) (auto dest: check_certD)\n  moreover note exec_pres_type\n  moreover\n  from lbv \n  have \"wtl_inst_list is cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (simp add: wt_lbv_def lbvjvm_def step_def_exec [symmetric])    \n  moreover note first_in_A\n  moreover from lbv have \"0 < size is\" by (simp add: wt_lbv_def)\n  ultimately show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])\nqed\n(*>*)\n\n\nlemma (in start_context) wt_lbv_wt_method:\n  assumes lbv: \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"  \n  shows \"\\<exists>\\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n(*<*)\nproof -\n  from lbv have l: \"is \\<noteq> []\" by (simp add: wt_lbv_def)\n  moreover\n  from wf lbv C Ts obtain \\<tau>s where \n    list:  \"\\<tau>s \\<in> list (size is) A\" and\n    step:  \"wt_step r Err step \\<tau>s\" and    \n    start: \"OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\" \n    by (blast dest: wt_lbv_wt_step)\n  from list have [simp]: \"size \\<tau>s = size is\" by simp\n  have \"size (map ok_val \\<tau>s) = size is\" by simp  \n  moreover from l have 0: \"0 < size \\<tau>s\" by simp\n  with step obtain \\<tau>s0 where \"\\<tau>s!0 = OK \\<tau>s0\"\n    by (unfold wt_step_def) blast\n  with start 0 have \"wt_start P C Ts mxl\\<^sub>0 (map ok_val \\<tau>s)\"\n    by (simp add: wt_start_def JVM_le_Err_conv lesub_def Err.le_def)    \n  moreover {\n    from list have \"check_types P mxs mxl \\<tau>s\" by (simp add: check_types_def)\n    also from step  have \"\\<forall>x \\<in> set \\<tau>s. x \\<noteq> Err\" \n      by (auto simp add: all_set_conv_all_nth wt_step_def)    \n    hence [symmetric]: \"map OK (map ok_val \\<tau>s) = \\<tau>s\"\n      by (auto intro!: map_idI)\n    finally have \"check_types P mxs mxl (map OK (map ok_val \\<tau>s))\" .\n  }\n  moreover {  \n    note bounded_step\n    moreover from list have \"set \\<tau>s \\<subseteq> A\" by simp\n    moreover from step have \"wt_err_step (sup_state_opt P) step \\<tau>s\"\n      by (simp add: wt_err_step_def JVM_le_Err_conv)\n    ultimately have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\<tau>s)\"\n      by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def states_def)\n  }    \n  ultimately have \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\<tau>s)\"\n    by (simp add: wt_method_def2 check_types_def del: map_map)\n  thus ?thesis ..\nqed\n(*>*)\n\n  \nlemma (in start_context) wt_method_wt_lbv:\n  assumes wt: \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\" \n  defines [simp]: \"cert \\<equiv> mk_cert P mxs T\\<^sub>r xt is \\<tau>s\"\n  \n  shows \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\" \n(*<*)\nproof -\n  let ?\\<tau>s  = \"map OK \\<tau>s\"\n  let ?cert = \"make_cert step ?\\<tau>s (OK None)\"\n\n  from wt obtain \n    0:        \"0 < size is\" and\n    size:     \"size is = size ?\\<tau>s\" and\n    ck_types: \"check_types P mxs mxl ?\\<tau>s\" and\n    wt_start: \"wt_start P C Ts mxl\\<^sub>0 \\<tau>s\" and\n    app_eff:  \"wt_app_eff (sup_state_opt P) app eff \\<tau>s\"\n    by (force simp add: wt_method_def2 check_types_def) \n  \n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover from wf have \"mono r step (size is) A\" by (rule step_mono)\n  hence \"mono r step (size ?\\<tau>s) A\" by (simp add: size)\n  moreover from exec_pres_type \n  have \"pres_type step (size ?\\<tau>s) A\" by (simp add: size) \n  moreover\n  from ck_types have \\<tau>s_in_A: \"set ?\\<tau>s \\<subseteq> A\" by (simp add: check_types_def)\n  hence \"\\<forall>pc. pc < size ?\\<tau>s \\<longrightarrow> ?\\<tau>s!pc \\<in> A \\<and> ?\\<tau>s!pc \\<noteq> Err\" by auto\n  moreover from bounded_step \n  have \"bounded step (size ?\\<tau>s)\" by (simp add: size)\n  moreover have \"OK None \\<noteq> Err\" by simp\n  moreover from bounded_step size \\<tau>s_in_A app_eff\n  have \"wt_err_step (sup_state_opt P) step ?\\<tau>s\"\n    by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def states_def)    \n  hence \"wt_step r Err step ?\\<tau>s\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  moreover\n  from 0 size have \"0 < size \\<tau>s\" by auto\n  hence \"?\\<tau>s!0 = OK (\\<tau>s!0)\" by simp\n  with wt_start have \"OK first \\<sqsubseteq>\\<^sub>r ?\\<tau>s!0\"\n    by (clarsimp simp add: wt_start_def lesub_def Err.le_def JVM_le_Err_conv)\n  moreover note first_in_A\n  moreover have \"OK first \\<noteq> Err\" by simp\n  moreover note size \n  ultimately\n  have \"wtl_inst_list is ?cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])\n  moreover from 0 size have \"\\<tau>s \\<noteq> []\" by auto\n  moreover from ck_types have \"check_types P mxs mxl ?cert\"\n    by (auto simp add: make_cert_def check_types_def JVM_states_unfold)\n  moreover note 0 size\n  ultimately show ?thesis \n    by (simp add: wt_lbv_def lbvjvm_def mk_cert_def step_def_exec [symmetric]\n                  check_cert_def make_cert_def nth_append)\nqed  \n(*>*)\n\n\ntheorem jvm_lbv_correct:\n  \"wt_jvm_prog_lbv P Cert \\<Longrightarrow> wf_jvm_prog P\"\n(*<*)\nproof -  \n  let ?\\<Phi> = \"\\<lambda>C mn. let (C,Ts,T\\<^sub>r,meth) = method P C mn; (mxs,mxl\\<^sub>0,is,xt) = the meth in \n              SOME \\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n    \n  assume wt: \"wt_jvm_prog_lbv P Cert\"\n  hence \"wf_jvm_prog\\<^bsub>?\\<Phi>\\<^esub> P\"\n    apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def) \n    apply (erule wf_prog_lift)\n    apply(auto intro: someI_ex[OF start_context.wt_lbv_wt_method [OF start_context.intro]])\n    done\n  thus ?thesis by (unfold wf_jvm_prog_def) blast\nqed\n(*>*)\n\ntheorem jvm_lbv_complete:\n  assumes wt: \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\" \n  shows \"wt_jvm_prog_lbv P (prg_cert P \\<Phi>)\"\n(*<*)\n  using wt\n  apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def)\n  apply (erule wf_prog_lift)\n  apply (auto simp add: prg_cert_def \n              intro!: start_context.wt_method_wt_lbv start_context.intro)\n  done\n(*>*)\n\nend  \n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/BV/LBVJVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.3220556577548419}}
{"text": "theory EventSystemWatchdog\n  imports EventSystemExBase\nbegin\n\nsubsection \\<open>Implementations of basic operations\\<close>\n\ndefinition get_chain_pos :: \"nat \\<Rightarrow> (watchdog_chain, event, nat) event_monad\" where\n  \"get_chain_pos i = (\n     get \\<bind>\n     (\\<lambda>st. return (snd (st ! i))))\"\n\ntheorem get_chain_pos_rule [wp]:\n  \"\\<lbrace> \\<lambda>s e. Q (snd (s ! i)) s e \\<rbrace>\n    get_chain_pos i\n   \\<lbrace> Q \\<rbrace>!\"\n  unfolding get_chain_pos_def by wp\n\ndefinition get_chain_pos_id :: \"nat \\<Rightarrow> (watchdog_chain, event, task_id) event_monad\" where\n  \"get_chain_pos_id i = (\n     get \\<bind>\n     (\\<lambda>st. return (fst (st ! i))))\"\n\ntheorem get_chain_pos_id_rule [wp]:\n  \"\\<lbrace> \\<lambda>s e. Q (fst (s ! i)) s e \\<rbrace>\n    get_chain_pos_id i\n   \\<lbrace> Q \\<rbrace>!\"\n  unfolding get_chain_pos_id_def by wp\n\ndefinition get_chain_length :: \"(watchdog_chain, event, nat) event_monad\" where\n  \"get_chain_length = (\n     get \\<bind>\n     (\\<lambda>st. return (length st)))\"\n\ntheorem get_chain_length_rule [wp]:\n  \"\\<lbrace> \\<lambda>s e. Q (length s) s e \\<rbrace>\n     get_chain_length\n   \\<lbrace> Q \\<rbrace>!\"\n  unfolding get_chain_length_def by wp\n\ndefinition set_chain_pos :: \"nat \\<Rightarrow> nat \\<Rightarrow> (watchdog_chain, event, unit) event_monad\" where\n  \"set_chain_pos i k = (\n     modify (\\<lambda>es. es[i := (fst (es ! i), k)]))\"\n\ntheorem set_chain_pos_rule [wp]:\n  \"\\<lbrace> \\<lambda>s e. Q () (s[i := (fst (s ! i), k)]) e \\<rbrace>\n    set_chain_pos i k\n   \\<lbrace> Q \\<rbrace>!\"\n  unfolding set_chain_pos_def by wp\n\ndefinition insert_chain_pos :: \"nat \\<Rightarrow> task_id \\<Rightarrow> nat \\<Rightarrow> (watchdog_chain, event, unit) event_monad\" where\n  \"insert_chain_pos i evt_id n = (\n    modify (\\<lambda>es. (take i es) @ [(evt_id, n)] @ drop i es))\"\n\ntheorem insert_chain_pos_rule [wp]:\n  \"\\<lbrace> \\<lambda>s e. Q () (take i s @ [(evt_id, n)] @ drop i s) e \\<rbrace>\n    insert_chain_pos i evt_id n\n   \\<lbrace> Q \\<rbrace>!\"\n  unfolding insert_chain_pos_def by wp\n\ndefinition remove_first :: \"(watchdog_chain, event, unit) event_monad\" where\n  \"remove_first = modify (\\<lambda>es. tl es)\"\n\ntheorem remove_first_rule [wp]:\n  \"\\<lbrace> \\<lambda>s e. Q () (tl s) e \\<rbrace>\n     remove_first\n   \\<lbrace> Q \\<rbrace>!\"\n  unfolding remove_first_def by wp\n\nsubsection \\<open>Imperative version of watchdog_add\\<close>\n\ntext \\<open>\n  While loop keeps track of current position in the list and remaining ticks.\n\\<close>\ndefinition watchdog_add_impl' :: \"task_id \\<Rightarrow> nat \\<Rightarrow> (watchdog_chain, event, nat \\<times> nat) event_monad\" where\n  \"watchdog_add_impl' evt_id n = whileLoop (\\<lambda>r s. snd r > 0) (\\<lambda>r.\n     get_chain_length \\<bind> (\\<lambda>len.\n     if fst r \\<ge> len then\n       insert_chain_pos (fst r) evt_id (snd r) \\<bind> (\\<lambda>_.\n       return (fst r + 1, 0))   \\<comment> \\<open>Add at end\\<close>\n     else\n       get_chain_pos (fst r) \\<bind> (\\<lambda>w.\n       (if snd r > w then\n          return (fst r + 1, snd r - w)  \\<comment> \\<open>Add at later iteration\\<close>\n        else\n          set_chain_pos (fst r) (w - snd r) \\<bind> (\\<lambda>_.\n          insert_chain_pos (fst r) evt_id (snd r) \\<bind> (\\<lambda>_.\n          return (fst r + 1, 0))))))) (0, n)\"  \\<comment> \\<open>Add at current iteration\\<close>\n\ndefinition watchdog_add_impl :: \"task_id \\<Rightarrow> nat \\<Rightarrow> (watchdog_chain, event, unit) event_monad\" where\n  \"watchdog_add_impl evt_id n = (watchdog_add_impl' evt_id n) \\<bind> (\\<lambda>_. return ())\"\n\n\ntext \\<open>Functional array implementation of watchdog_add.\n\n  The parameters are:\n  evt_id - ID of event to be added\n  n - initial amount of ticks\n  s - current state of watchdog chain\n  i - number of iterations of execute\n\n  Returns pair of remaining amount of ticks and state of watchdog chain after i iterations\n\\<close>\nfun watchdog_add_fun :: \"task_id \\<Rightarrow> nat \\<Rightarrow> watchdog_chain \\<Rightarrow> nat \\<Rightarrow> nat \\<times> watchdog_chain\" where\n  \"watchdog_add_fun evt_id n s 0 = (n, s)\"\n| \"watchdog_add_fun evt_id n s (Suc i) = (\n    let (n', s') = watchdog_add_fun evt_id n s i in\n      if n' = 0 then\n        (n', s')  \\<comment> \\<open>Imperative code should have terminated\\<close>\n      else if i \\<ge> length s' then\n        (0, s' @ [(evt_id, n')])  \\<comment> \\<open>Add at the end\\<close>\n      else if n' > snd (s' ! i) then\n        (n' - snd (s' ! i), s')  \\<comment> \\<open>Add at later iteration\\<close>\n      else\n        (0, take i s' @ [(evt_id, n')] @ drop i (s'[i := (fst (s' ! i), snd (s' ! i) - n')])))\"  \\<comment> \\<open>Add at current iteration\\<close>\n\nlemma watchdog_add_fun_correct:\n  \"(n > watchdog_total_upto s i \\<longrightarrow> i \\<le> length s \\<longrightarrow>\n     watchdog_add_fun evt_id n s i = (n - watchdog_total_upto s i, s)) \\<and>  \\<comment> \\<open>not inserting at step i\\<close>\n   (n > watchdog_total_upto s (length s) \\<longrightarrow> i = Suc (length s) \\<longrightarrow>\n     watchdog_add_fun evt_id n s i = (0, s @ [(evt_id, n - watchdog_total_upto s (length s))])) \\<and>  \\<comment> \\<open>inserting at the end\\<close>\n   (n > 0 \\<longrightarrow> n \\<le> watchdog_total_upto s i \\<longrightarrow> i \\<le> length s \\<longrightarrow> i = Suc (watchdog_add_pos s n) \\<longrightarrow>\n     watchdog_add_fun evt_id n s i = (0,\n       take (i - 1) s @ [(evt_id, n - watchdog_total_upto s (i - 1))] @\n       drop (i - 1) (s[i - 1 := (fst (s ! (i - 1)), snd (s ! (i - 1)) - (n - watchdog_total_upto s (i - 1)))])))\"  \\<comment> \\<open>inserting at middle\\<close>\nproof (induct i arbitrary: n s)\n  case 0\n  then show ?case by auto\nnext\n  case (Suc i)\n  have s1: \"watchdog_add_fun evt_id n s (Suc i) = (n - watchdog_total_upto s (Suc i), s)\"\n    if \"n > watchdog_total_upto s (Suc i)\" \"Suc i \\<le> length s\"\n  proof -\n    let ?n' = \"fst (watchdog_add_fun evt_id n s i)\"\n    let ?s' = \"snd (watchdog_add_fun evt_id n s i)\"\n    have a1: \"n > watchdog_total_upto s i\"\n      using that by (auto simp add: watchdog_total_upto_Suc)\n    have a2: \"?n' = n - watchdog_total_upto s i\"\n      using Suc a1 that(2) by auto\n    have a3: \"?n' \\<noteq> 0\"\n      using a1 a2 by auto\n    have a4: \"?s' = s\"\n      using a1 Suc that(2) by auto\n    have a5: \"\\<not>i \\<ge> length ?s'\"\n      using a4 that(2) by auto\n    have a6: \"?n' > snd (?s' ! i)\"\n      using that(1) a2 a4 a5 by (auto simp add: watchdog_total_upto_Suc) \n    show ?thesis\n      apply (auto simp add: a3 a5 a6 case_prod_beta)\n      using a5 \n      unfolding a2 a4 \n      by (auto simp add: watchdog_total_upto_Suc)\n  qed\n  have s2: \"watchdog_add_fun evt_id n s (Suc i) = (0, s @ [(evt_id, n - watchdog_total_upto s (length s))])\"\n    if \"n > watchdog_total_upto s (length s)\" \"Suc i = Suc (length s)\"\n  proof -\n    let ?n' = \"fst (watchdog_add_fun evt_id n s i)\"\n    let ?s' = \"snd (watchdog_add_fun evt_id n s i)\"\n    have a1: \"n > watchdog_total_upto s i\"\n      using that by auto\n    have a2: \"i \\<le> length s \\<longrightarrow> ?n' = n - watchdog_total_upto s i\"\n      using a1 Suc by auto\n    have a3: \"i \\<le> length s \\<longrightarrow> ?s' = s\"\n      using a1 Suc by auto\n    show ?thesis\n    proof (cases \"?n' = 0\")\n      case True\n      have b1: \"i > length s\"\n        using a1 a2 True by auto\n      show ?thesis\n        using b1 that(2) by auto\n    next\n      case False\n      have b1: \"?s' = s\"\n        using a3 that(2) by auto\n      have b2: \"i \\<ge> length ?s'\"\n        using b1 that(2) by auto\n      have b3: \"?n' = n - watchdog_total_upto s i\"\n        using that(2) a2 by auto\n      show ?thesis\n        apply (auto simp add: case_prod_beta \\<open>?n' \\<noteq> 0\\<close> b2)\n        unfolding b3 b1 using that(2) by auto\n    qed\n  qed\n  have s3: \"watchdog_add_fun evt_id n s (Suc i) = (0,\n              take i s @ [(evt_id, n - watchdog_total_upto s i)] @\n              drop i (s[i := (fst (s ! i), snd (s ! i) - (n - watchdog_total_upto s i))]))\"\n    if assum_s3: \"n > 0\" \"n \\<le> watchdog_total_upto s (Suc i)\" \"Suc i \\<le> length s\"\n                 \"Suc i = Suc (watchdog_add_pos s n)\"\n  proof -\n    let ?n' = \"fst (watchdog_add_fun evt_id n s i)\"\n    let ?s' = \"snd (watchdog_add_fun evt_id n s i)\"\n    have \"i = watchdog_add_pos s n\"\n      using assum_s3(4) by auto\n    then have \"i \\<le> length s\"\n      using watchdog_add_pos_prop1 by auto\n    have a1a: \"watchdog_total_upto s i < n\"\n      by (metis (full_types) Suc_inject le_neq_implies_less that(1) that(4)\n             watchdog_add_pos_prop1 watchdog_add_pos_prop2 watchdog_add_pos_prop3)\n    have a1b: \"i < length s\"\n      using that(3) by auto\n    have a2: \"?n' = n - watchdog_total_upto s i\"\n      using a1a a1b Suc by auto\n    have a3: \"?s' = s\"\n      using a1a a1b Suc by auto\n    have a4: \"?n' \\<noteq> 0\"\n      using a2 a1a by auto\n    have a5: \"\\<not>i \\<ge> length ?s'\"\n      using a3 a1b by auto\n    have a6: \"\\<not>?n' > snd (?s' ! i)\"\n      unfolding a2 a3 using assum_s3(2) a3 a5\n      by (auto simp add: watchdog_total_upto_Suc)\n    show ?thesis\n      apply (auto simp add: case_prod_beta a4 a5 a6)\n      unfolding a2 a3 by auto\n  qed\n  show ?case\n    using s1 s2 s3 by auto\nqed\n\nlemma watchdog_add_fun_prop1:\n  assumes \"n > 0\"\n    and \"i = Suc (watchdog_add_pos s0 n)\"\n  shows \"fst (watchdog_add_fun evt_id n s0 i) = 0\"\nproof -\n  have a1: \"(n > watchdog_total_upto s0 (length s0) \\<and> i = Suc (length s0)) \\<or>\n        (n \\<le> watchdog_total_upto s0 i \\<and> i \\<le> length s0)\"\n    using watchdog_add_fun_range2 assms(1-2) by auto\n  have a2: ?thesis\n    if \"n > watchdog_total_upto s0 (length s0)\" \"i = Suc (length s0)\"\n    using watchdog_add_fun_correct[of s0 i n evt_id] that by auto\n  have a3: ?thesis\n    if \"n \\<le> watchdog_total_upto s0 i\" \"i \\<le> length s0\"\n    using watchdog_add_fun_correct[of s0 i n evt_id] assms(1,2) that by auto\n  show ?thesis\n    using a1 a2 a3 by auto\nqed\n\nlemma watchdog_add_fun_prop2:\n  assumes \"n > 0\"\n    and \"i < Suc (watchdog_add_pos s0 n)\"\n  shows \"fst (watchdog_add_fun evt_id n s0 i) > 0\"\nproof -\n  have a1: \"watchdog_total_upto s0 i < n \\<and> i \\<le> length s0\"\n    using watchdog_add_fun_range assms by auto\n  then have a2: \"watchdog_add_fun evt_id n s0 i = (n - watchdog_total_upto s0 i, s0)\"\n    using watchdog_add_fun_correct by auto\n  show ?thesis\n    using a1 a2 by auto\nqed\n\nlemma watchdog_add_impl_rule':\n  assumes \"n > 0\"\n  shows\n    \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = e0 \\<rbrace>\n      watchdog_add_impl' evt_id n\n     \\<lbrace> \\<lambda>r s es. fst r = Suc (watchdog_add_pos s0 n) \\<and> s = snd (watchdog_add_fun evt_id n s0 (fst r)) \\<and> es = e0 \\<rbrace>!\"\n  unfolding watchdog_add_impl'_def\n  apply (rule validNF_whileLoop[where I=\"\\<lambda>r s e. watchdog_add_fun evt_id n s0 (fst r) = (snd r, s) \\<and>\n                                                 fst r \\<le> Suc (watchdog_add_pos s0 n) \\<and> e = e0\" and\n                                      R=\"measure (\\<lambda>(r,s). Suc (watchdog_add_pos s0 n) - fst r)\"])\n  subgoal for s es\n    by auto\n  subgoal for r s0'\n    apply wp\n    apply auto\n    using assms watchdog_add_fun_prop1[of n \"fst r\" s0 evt_id]\n     apply fastforce\n    by (metis assms diff_less_mono fst_conv le_SucE lessI neq0_conv watchdog_add_fun_prop1)\n  subgoal\n    by (rule wf_measure)\n  subgoal for r s es\n    apply auto\n    by (metis assms fst_conv le_neq_implies_less less_numeral_extra(3) watchdog_add_fun_prop2)\n  done\n\nlemma watchdog_add_fun_correct2:\n  assumes \"n > 0\"\n  shows \"snd (watchdog_add_fun evt_id n s (Suc (watchdog_add_pos s n))) = Watchdog.watchdog_add evt_id n s\"\nproof -\n  let ?i=\"watchdog_add_pos s n\"\n  have a1: \"(n > watchdog_total_upto s (length s) \\<and> ?i = length s) \\<or>\n        (n \\<le> watchdog_total_upto s (Suc ?i) \\<and> n > watchdog_total_upto s ?i \\<and> Suc ?i \\<le> length s)\"\n    using watchdog_add_fun_range2[OF assms] by auto\n  have a2: ?thesis if \"n > watchdog_total_upto s (length s)\" \"?i = length s\"\n    using watchdog_add_fun_correct[of s \"Suc ?i\" n evt_id] watchdog_add_prop1 that by auto\n  have a3: ?thesis if \"n \\<le> watchdog_total_upto s (Suc ?i)\" \"n > watchdog_total_upto s ?i\" \"Suc ?i \\<le> length s\"\n    using watchdog_add_fun_correct[of s \"Suc ?i\" n evt_id] watchdog_add_prop2 that by auto\n  show ?thesis\n    using a1 a2 a3 by blast\nqed\n\nlemma watchdog_add_impl_rule2':\n  assumes \"n > 0\"\n  shows\n    \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = e0 \\<rbrace>\n      watchdog_add_impl' evt_id n\n     \\<lbrace> \\<lambda>r s es. s = Watchdog.watchdog_add evt_id n s0 \\<and> es = e0 \\<rbrace>!\"\n  apply (rule validNF_strengthen_post[OF watchdog_add_impl_rule'])\n  using watchdog_add_fun_correct2 assms by auto\n\nlemma watchdog_add_impl_rule2:\n  assumes \"n > 0\"\n  shows\n    \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = e0 \\<rbrace>\n      watchdog_add_impl evt_id n\n     \\<lbrace> \\<lambda>_ s es. s = Watchdog.watchdog_add evt_id n s0 \\<and> es = e0 \\<rbrace>!\"\n  unfolding watchdog_add_impl_def\n  apply wp apply (rule watchdog_add_impl_rule2')\n  using assms apply auto by wp\n\nsubsection \\<open>Imperative version of watchdog_tick\\<close>\n\ndefinition decr_head_impl :: \"nat \\<Rightarrow> (watchdog_chain, event, unit) event_monad\" where\n  \"decr_head_impl n = (\n     get_chain_pos 0 \\<bind> (\\<lambda>k.\n     set_chain_pos 0 (k - n) \\<bind> (\\<lambda>_.\n     return ())))\"\n\ntheorem decr_head_impl_rule:\n  \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = e0 \\<rbrace>\n     decr_head_impl n\n   \\<lbrace> \\<lambda>r s es. s = decr_head n s0 \\<and> es = e0 \\<rbrace>!\"\n  unfolding decr_head_impl_def\n  apply wp\n  apply (cases s0) by auto\n\ntext \\<open>\n  While loop keeps track of whether to continue iteration.\n\\<close>\ndefinition extract_zero_impl :: \"(watchdog_chain, event, bool) event_monad\" where\n  \"extract_zero_impl = whileLoop (\\<lambda>k s. k) (\\<lambda>k.\n     get_chain_length \\<bind> (\\<lambda>len.\n     if len = 0 then\n       return False\n     else\n       get_chain_pos 0 \\<bind> (\\<lambda>k.\n       if k = 0 then\n         get_chain_pos_id 0 \\<bind> (\\<lambda>evt_id.\n         signal (DISPATCH evt_id) \\<bind> (\\<lambda>_.\n         remove_first \\<bind> (\\<lambda>_.\n         return True)))\n       else\n         return False))) True\"\n\ntext \\<open>Functional array implementation of extract_zero\\<close>\nfun extract_zero_fun :: \"watchdog_chain \\<Rightarrow> nat \\<Rightarrow> event list \\<times> bool \\<times> watchdog_chain\" where\n  \"extract_zero_fun s 0 = ([], True, s)\"\n| \"extract_zero_fun s (Suc i) = (\n    let (es, r, s') = extract_zero_fun s i in\n      if \\<not>r then\n        (es, r, s')\n      else case s' of\n             [] \\<Rightarrow> (es, False, s')\n           | p # s2 \\<Rightarrow> if snd p = 0 then (es @ [DISPATCH (fst p)], True, s2)\n                       else (es, False, s'))\"\n\nlemma extract_zero_fun_prop1:\n  \"extract_zero_fun s0 i = (e, True, s) \\<Longrightarrow> s = drop i s0 \\<and> i \\<le> count_zero s0\"\nproof (induction i arbitrary: s0 e s)\n  case 0\n  then show ?case by auto\nnext\n  case (Suc i)\n  show ?case\n  proof (cases \"extract_zero_fun s0 i\")\n    case (fields es r s')\n    show ?thesis\n    proof (cases \"r = True\")\n      case True\n      have a1: \"s' = drop i s0 \\<and> i \\<le> count_zero s0\"\n        using Suc(1)[OF fields[unfolded True]] by auto\n      show ?thesis\n      proof (cases s')\n        case Nil\n        then show ?thesis\n          using Suc(2) fields True by auto\n      next\n        case (Cons p s2)\n        show ?thesis\n          using Suc(2) apply (auto simp add: fields True Cons)\n          subgoal apply (cases \"snd p = 0\") apply auto\n            using Cons a1 by (metis Cons_nth_drop_Suc length_Cons length_drop list.inject zero_less_Suc zero_less_diff)\n          subgoal apply (cases \"snd p = 0\")\n             apply auto using Cons a1\n            by (metis Cons_nth_drop_Suc Suc_leI count_zero_iff2 le_neq_implies_less length_Cons\n                      length_drop nth_Cons_0 zero_less_Suc zero_less_diff)\n          done\n      qed\n    next\n      case False\n      then show ?thesis\n        using Suc(2) by (auto simp add: fields)\n    qed\n  qed\nqed\n\nlemma extract_zero_fun_prop2:\n  \"i \\<le> count_zero s0 \\<Longrightarrow> extract_zero_fun s0 i = (map (\\<lambda>p. DISPATCH (fst p)) (take i s0), True, drop i s0)\"\nproof (induction i)\n  case 0\n  then show ?case by auto\nnext\n  case (Suc i)\n  have a1: \"extract_zero_fun s0 i = (map (\\<lambda>p. DISPATCH (fst p)) (take i s0), True, drop i s0)\"\n    using Suc by auto\n  have a2: \"i < count_zero s0\"\n    using Suc by auto\n  have a3: \"i < length s0\" \"snd (s0 ! i) = 0\"\n    using count_zero_iff a2 by auto\n  have a4: \"drop i s0 \\<noteq> []\" \"snd ((drop i s0) ! 0) = 0\"\n    using a3 by auto\n  have a5: \"take (Suc i) s0 = take i s0 @ [s0 ! i]\"\n    by (simp add: a3(1) take_Suc_conv_app_nth)\n  show ?case\n    apply (auto simp add: a1) apply (cases \"drop i s0\")\n    subgoal using a4 by auto\n    subgoal for p s2\n      apply (auto simp add: a4 a5 nth_via_drop)\n      apply (simp add: a3(1) drop_Suc_nth)\n      using a4(2) by auto\n    done\nqed\n\nlemma extract_zero_fun_prop3:\n  \"extract_zero_fun s0 (Suc (count_zero s0)) =\n   (map (\\<lambda>p. DISPATCH (fst p)) (take (count_zero s0) s0), False, drop (count_zero s0) s0)\"\nproof -\n  let ?i=\"count_zero s0\"\n  have a1: \"extract_zero_fun s0 ?i = (map (\\<lambda>p. DISPATCH (fst p)) (take ?i s0), True, drop ?i s0)\"\n    using extract_zero_fun_prop2 by auto\n  have a2: \"?i = length s0 \\<or> snd (s0 ! ?i) \\<noteq> 0\"\n    using count_zero_iff2 by auto\n  show ?thesis\n    apply (auto simp add: a1)\n    apply (cases \"drop ?i s0\") apply auto\n    using a2 nth_via_drop by fastforce\nqed\n\nlemma extract_zero_impl_rule:\n  \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = [] \\<rbrace>\n    extract_zero_impl\n   \\<lbrace> \\<lambda>r s es. \\<not>r \\<and> extract_zero_fun s0 (Suc (count_zero s0)) = (es, r, s) \\<rbrace>!\"\n  unfolding extract_zero_impl_def\n  apply (rule validNF_whileLoop[where\n          I=\"\\<lambda>r s es. \\<exists>i. i \\<le> Suc (count_zero s0) \\<and> extract_zero_fun s0 i = (es, r, s)\" and\n          R=\"measure (\\<lambda>(r,s). length s + (if r then 1 else 0))\"])\n  subgoal\n    apply (rule exI[where x=0]) by auto\n  subgoal for r s0'\n    apply wp\n    subgoal for s e apply auto\n      subgoal for i\n        apply (rule exI[where x=\"Suc i\"])\n        apply auto\n        by (auto simp add: extract_zero_fun_prop1)\n      subgoal for i\n        apply (rule exI[where x=\"Suc i\"])\n        apply (auto simp add: extract_zero_fun_prop1)\n        apply (cases s) by auto\n      subgoal for i\n        apply (rule exI[where x=\"Suc i\"])\n        apply (auto simp add: extract_zero_fun_prop1)\n        apply (cases s) by auto\n      done\n    done\n  subgoal\n    by (rule wf_measure)\n  subgoal for r s es\n    using extract_zero_fun_prop2 le_Suc_eq by fastforce\n  done\n\nlemma extract_zero_fun_correct:\n  \"extract_zero_fun s0 (Suc (count_zero s0)) =\n   (map DISPATCH (fst (extract_zero s0)), False, snd (extract_zero s0))\"\n  unfolding extract_zero_fun_prop3 extract_zero_array by auto\n\nlemma extract_zero_impl_rule2:\n  \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = [] \\<rbrace>\n    extract_zero_impl\n   \\<lbrace> \\<lambda>r s es. \\<not>r \\<and> s = snd (extract_zero s0) \\<and> es = map DISPATCH (fst (extract_zero s0)) \\<rbrace>!\"\n  apply (rule validNF_strengthen_post[OF extract_zero_impl_rule])\n  using extract_zero_fun_correct by auto\n\ndefinition watchdog_tick_impl :: \"(watchdog_chain, event, unit) event_monad\" where\n  \"watchdog_tick_impl = (\n    decr_head_impl 1 \\<bind> (\\<lambda>_.\n    extract_zero_impl \\<bind> (\\<lambda>_. return ())))\"\n\nlemma watchdog_tick_impl_rule:\n  \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = [] \\<rbrace>\n     watchdog_tick_impl\n   \\<lbrace> \\<lambda>_ s es. s = snd (Watchdog.watchdog_tick s0) \\<and>\n              es = map DISPATCH (fst (Watchdog.watchdog_tick s0)) \\<rbrace>!\"\n  unfolding watchdog_tick_impl_def\n  apply wp\n    apply (rule decr_head_impl_rule)\n   apply (rule validNF_strengthen_post)\n  apply (rule validNF_bind)\n     apply (rule extract_zero_impl_rule2)\n  apply (rule validNF_weaken_pre)\n     apply (rule validNF_return)\n  by (auto simp add: Watchdog.watchdog_tick_def)\n\nsubsection \\<open>Imperative version of watchdog_remove\\<close>\n\ntext \\<open>Imperative code\\<close>\ndefinition find_chain_pos_impl :: \"task_id \\<Rightarrow> (watchdog_chain, event, bool \\<times> nat) event_monad\" where\n  \"find_chain_pos_impl evt_id = whileLoop (\\<lambda>r s. (snd r < length s \\<and> fst r = False)) (\\<lambda>r.\n     get_chain_pos_id (snd r) \\<bind> (\\<lambda>w. \n     if evt_id = w then\n       return (True, snd r + 1)\n     else\n       return (False, snd r + 1))) (False, 0)\"\n\ntext \\<open>Corresponding functional code\\<close>\nfun find_chain_pos_fun :: \"task_id \\<Rightarrow> watchdog_chain \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"find_chain_pos_fun evt_id s 0 = False\"\n| \"find_chain_pos_fun evt_id s (Suc i) = (\n    let b' = find_chain_pos_fun evt_id s i in\n      if b' \\<or> i \\<ge> length s then\n        b'    \\<comment> \\<open>Imperative code should have terminated\\<close>\n      else if fst (s ! i) = evt_id then\n        True  \\<comment> \\<open>Found at other position\\<close>\n      else\n        False)\"   \\<comment> \\<open>Repeat the iteration\\<close>\n\nlemma find_chain_pos_Suc:\n  \"n < length s0 \\<Longrightarrow>\n   find_chain_pos_fun evt_id s0 n = False \\<and> evt_id \\<noteq> fst (s0 ! n) \\<longleftrightarrow>\n   find_chain_pos_fun evt_id s0 (Suc n) = False\"\n  by (induction n, auto)\n\nlemma find_chain_pos_evtid:\n  \"n \\<le> length s0 \\<Longrightarrow>\n   find_chain_pos_fun evt_id s0 n = False \\<longleftrightarrow> (\\<forall>i < n. evt_id \\<noteq> fst (s0 ! i))\"\nproof (induct n arbitrary: s0)\n  case 0\n  then show ?case by auto\nnext\n  case (Suc n)\n  show ?case\n  proof (cases s0)\n    case Nil\n    then show ?thesis\n      using Suc.prems(1) by auto\n  next\n    case (Cons s es)\n    show ?thesis\n      using Suc.hyps less_Suc_eq local.Suc(2) by auto\n  qed\nqed\n\nlemma find_chain_some_n:\n  assumes \"n < length s0\"\n    shows \"watchdog_remove_pos evt_id s0 = Some n \\<longleftrightarrow> \n    (evt_id = fst (s0 ! n) \\<and> find_chain_pos_fun evt_id s0 (n) = False)\"\n  using assms find_chain_pos_evtid watchdog_remove_pos_evtid2 by auto\n\nlemma find_chain_some_nSuc:\n  \"watchdog_remove_pos evt_id s0 = Some n \\<longleftrightarrow>\n   (find_chain_pos_fun evt_id s0 (Suc n) = True \\<and> find_chain_pos_fun evt_id s0 (n) = False)\"\nproof (induct n)\n  case 0\n  then show ?case apply auto\n     apply (simp add: find_chain_some_n)\n    by (simp add: find_chain_some_n)\nnext\n  case (Suc n)\n  then show ?case \n  proof -\n    have \"(watchdog_remove_pos evt_id s0 = Some (Suc n)) = (evt_id = fst (s0 ! Suc n) \\<and> Suc n < length s0 \\<and> \n      \\<not> find_chain_pos_fun evt_id s0 (Suc n))\"\n      by (metis find_chain_some_n watchdog_remove_pos_le)\n    then show ?thesis\n      using not_le by force\n  qed\nqed\n\nlemma find_chain_some_snd:\n  \"watchdog_remove_pos evt_id s0 = Some n \\<Longrightarrow> i \\<le> Suc n \\<Longrightarrow> find_chain_pos_fun evt_id s0 i \\<Longrightarrow> i = Suc n\"\nproof (induct n)\n  case 0\n  then show ?case \n    using le_eq_less_or_eq by fastforce\nnext\n  case (Suc n)\n  then show ?case \n    by (metis find_chain_pos_fun.simps(2) find_chain_some_nSuc le_Suc_eq nat_induct_at_least)\nqed\n\nlemma find_chain_pos_impl_rule:\n  \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = e0 \\<rbrace>\n    find_chain_pos_impl evt_id\n   \\<lbrace> \\<lambda>r s es. (case watchdog_remove_pos evt_id s0 of\n                 None \\<Rightarrow> fst r = False \\<and> snd r = length s0\n               | Some i \\<Rightarrow> fst r = True \\<and> snd r = Suc i) \\<and>\n              s = s0 \\<and> es = e0 \\<rbrace>!\"\n  unfolding find_chain_pos_impl_def\n  apply (rule validNF_whileLoop[where I=\"\\<lambda>r s e. find_chain_pos_fun evt_id s0 (snd r) = fst r \\<and>\n                                                 (case watchdog_remove_pos evt_id s0 of\n                                                    None \\<Rightarrow> snd r \\<le> length s0\n                                                  | Some i \\<Rightarrow> snd r \\<le> Suc i) \\<and> s = s0 \\<and> e = e0\" and\n                                      R=\"measure (\\<lambda>(r,s). length s0 - snd r)\"])\n  subgoal for s es\n    apply (cases \"watchdog_remove_pos evt_id s0\") by auto\n  subgoal for r0 s0\n    apply wp subgoal for s e\n      apply (cases \"watchdog_remove_pos evt_id s0\") apply auto\n      apply (metis find_chain_some_nSuc le_SucE)\n      using find_chain_some_nSuc le_Suc_eq by auto\n    done\n  subgoal\n    apply (cases \"watchdog_remove_pos evt_id s0\") by auto\n  subgoal for r s e\n    apply (cases \"watchdog_remove_pos evt_id s0\") apply auto\n    apply (metis find_chain_pos_fun.simps(1) find_chain_some_nSuc option.simps(3) zero_induct)\n    apply (metis find_chain_pos_fun.simps(1) find_chain_some_nSuc option.simps(3) zero_induct)\n    apply (metis (full_types) find_chain_pos_fun.simps(1) find_chain_some_nSuc option.distinct(1) zero_induct)\n    apply (simp add: find_chain_some_snd)\n    apply (metis (mono_tags, hide_lams) Suc_leI find_chain_some_nSuc le_antisym not_less order_trans watchdog_remove_pos_le)\n    using watchdog_remove_pos_le apply fastforce\n    by (simp add: find_chain_some_snd)\ndone\n\ndefinition remove_chain_pos_impl :: \"nat \\<Rightarrow> (watchdog_chain, event, unit) event_monad\" where\n  \"remove_chain_pos_impl i = (\n    get_chain_length \\<bind> (\\<lambda>len.\n    if i \\<ge> len then\n      return ()\n    else if i = len - 1 then\n        modify (\\<lambda>es. take i es) \\<bind> (\\<lambda>_.\n        return ())\n    else\n      get_chain_pos i \\<bind> (\\<lambda>n.\n      get_chain_pos (i + 1) \\<bind> (\\<lambda>k.\n      modify (\\<lambda>es. (take i es) @ (drop (i + 1) es)) \\<bind> (\\<lambda>_.\n      set_chain_pos i (n + k) \\<bind> (\\<lambda>_.\n      return ()))))))\"\n\ntheorem remove_chain_pos_impl_rule:\n \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = e0 \\<rbrace>\n       remove_chain_pos_impl n\n     \\<lbrace> \\<lambda>r s es. s = remove_chain_pos_fun n s0 \\<and> es = e0 \\<rbrace>!\"\n  unfolding remove_chain_pos_impl_def\n  apply wp\n  apply (cases s0) apply auto\n     apply (simp add: remove_chain_pos_fun_def)\n  using remove_chain_pos_prop1 apply auto\n  using remove_chain_pos_prop2 \n    apply (simp add: remove_chain_pos_fun_def) \n   apply (simp add: remove_chain_pos_prop1)\n  by (simp add: remove_chain_pos_prop2)\n\ndefinition watchdog_remove_impl :: \"task_id \\<Rightarrow> (watchdog_chain, event, unit) event_monad\" where\n  \"watchdog_remove_impl evt_id = (\n    find_chain_pos_impl evt_id \\<bind> (\\<lambda>r.\n    if fst r then\n      remove_chain_pos_impl (snd r - 1)\n    else return ()))\"\n\nlemma watchdog_remove_impl_rule':\n  \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = e0 \\<rbrace>\n    watchdog_remove_impl evt_id\n   \\<lbrace> \\<lambda>r s es. s = watchdog_remove2 evt_id s0 \\<and> es = e0 \\<rbrace>!\"\n  unfolding watchdog_remove_impl_def\n  apply (rule validNF_bind)\n   apply (rule find_chain_pos_impl_rule)\n  subgoal for r\n  proof (cases \"watchdog_remove_pos evt_id s0\")\n    case None\n    then show ?thesis\n      apply auto\n      subgoal apply (rule validNF_weaken_pre)\n        unfolding remove_chain_pos_impl_def apply wp by auto\n      subgoal\n        apply wp\n        by (auto simp add: watchdog_remove2_def)\n      done\n  next\n    case (Some n)\n    then show ?thesis\n      apply auto\n      subgoal\n        apply (subst validNF_conj_pre) apply auto\n        apply (rule validNF_strengthen_post)\n         apply (rule remove_chain_pos_impl_rule)\n        by (auto simp add: watchdog_remove2_def)\n      subgoal apply (rule validNF_weaken_pre)\n        unfolding remove_chain_pos_impl_def apply wp by auto\n      done\n  qed\n  done\n\nlemma watchdog_remove_impl_rule:\n  \"\\<lbrace> \\<lambda>s es. s = s0 \\<and> es = e0 \\<rbrace>\n    watchdog_remove_impl evt_id\n   \\<lbrace> \\<lambda>r s es. s = watchdog_remove evt_id s0 \\<and> es = e0 \\<rbrace>!\"\n  using watchdog_remove_impl_rule' watchdog_remove2_correct \n  by auto\n\nsubsection \\<open>Refinement proofs for watchdog\\<close>\n\ntype_synonym astate_watchdog =\n  \"task_id \\<Rightarrow> nat option\"\n\ndefinition rel_watchdog :: \"astate_watchdog \\<Rightarrow> watchdog_chain \\<Rightarrow> bool\" where\n  \"rel_watchdog as cs \\<longleftrightarrow> valid_watchdog cs \\<and> as = event_time cs\"\n\ntheorem watchdog_add_rule':\n  assumes \"0 < n\"\n    and \"as evt_id = None\"\n  shows\n  \"\\<lbrace> \\<lambda>cs es. \\<exists>cs'. rel_watchdog as cs' \\<and> cs = cs' \\<and> es = e0 \\<rbrace>\n     watchdog_add_impl evt_id n\n   \\<lbrace> \\<lambda>_ cs es. rel_watchdog (as(evt_id \\<mapsto> n)) cs \\<and> es = e0 \\<rbrace>!\"\n  apply (rule validNF_ex_pre)\n  subgoal for cs'\n    apply (subst validNF_conj_pre)\n    apply auto\n    apply (rule validNF_strengthen_post)\n    apply (rule watchdog_add_impl_rule2[OF assms(1)])\n    apply (auto simp add: rel_watchdog_def)\n    apply (rule watchdog_add_valid) using assms apply auto\n    apply (subst watchdog_add_full[OF _ assms(1)])\n    using assms(2) by auto\n  done\n\ntheorem watchdog_add_rule:\n  assumes \"n > 0\"\n    and \"as evt_id = None\"\n  shows\n  \"\\<lbrace> \\<lambda>cs es. rel_watchdog as cs \\<and> nil\\<^sub>e es \\<rbrace>\n     watchdog_add_impl evt_id n\n   \\<lbrace> \\<lambda>_ cs es. rel_watchdog (as(evt_id \\<mapsto> n)) cs \\<and> nil\\<^sub>e es \\<rbrace>!\"\n  apply (rule validNF_weaken_pre)\n  unfolding nil_event_def\n   apply (rule watchdog_add_rule')\n  by (auto simp add: assms)\n\n\ndefinition spec_watchdog_tick :: \"astate_watchdog \\<Rightarrow> astate_watchdog\" where\n  \"spec_watchdog_tick as =\n    (\\<lambda>ev. case as ev of None \\<Rightarrow> None\n                       | Some n \\<Rightarrow> if n > 1 then Some (n - 1) else None)\"\n\ndefinition spec_watchdog_tick_ev :: \"astate_watchdog \\<Rightarrow> task_id set\" where\n  \"spec_watchdog_tick_ev as = {ev. as ev = Some 1}\"\n\ntheorem watchdog_tick_full:\n  assumes \"rel_watchdog as cs\"\n  shows \"set (fst (watchdog_tick cs)) = spec_watchdog_tick_ev as\"\n        \"rel_watchdog (spec_watchdog_tick as) (snd (watchdog_tick cs))\"\nproof -\n  have valid: \"valid_watchdog cs\"\n    using assms unfolding rel_watchdog_def by auto\n  have a: \"evt_id \\<in> set (fst (watchdog_tick cs)) \\<longleftrightarrow> evt_id \\<in> spec_watchdog_tick_ev as\" for evt_id\n    apply (cases \"event_time cs evt_id = None\")\n    using assms apply (auto simp add: watchdog_tick_None spec_watchdog_tick_ev_def rel_watchdog_def)[1]\n    apply (cases \"event_time cs evt_id = Some 0\")\n    apply (auto simp add: watchdog_tick_triv[OF valid])[1]\n    apply (cases \"event_time cs evt_id = Some 1\")\n    using assms apply (auto simp add: watchdog_tick1 spec_watchdog_tick_ev_def rel_watchdog_def)[1]\n    using assms by (auto simp add: watchdog_tick2[OF valid] spec_watchdog_tick_ev_def rel_watchdog_def)\n  show \"rel_watchdog (spec_watchdog_tick as) (snd (watchdog_tick cs))\"\n    apply (auto simp add: rel_watchdog_def)\n    apply (rule watchdog_tick_valid[OF valid])\n    apply (rule ext) subgoal for evt_id\n      apply (cases \"event_time cs evt_id = None\")\n      subgoal\n        apply (auto simp add: watchdog_tick_None spec_watchdog_tick_def rel_watchdog_def)\n        apply (cases \"as evt_id\") using assms rel_watchdog_def by auto\n      apply (cases \"event_time cs evt_id = Some 0\")\n      subgoal by (auto simp add: watchdog_tick_triv[OF valid])[1]\n      apply (cases \"event_time cs evt_id = Some 1\")\n      subgoal\n        apply (auto simp add: watchdog_tick1[OF valid] spec_watchdog_tick_def)\n        apply (cases \"as evt_id\") using assms rel_watchdog_def by auto\n      apply (auto simp add: watchdog_tick2[OF valid] spec_watchdog_tick_def)\n      apply (cases \"as evt_id\") using assms rel_watchdog_def by auto\n    done\n  show \"set (fst (watchdog_tick cs)) = spec_watchdog_tick_ev as\"\n    using a by auto\nqed\n\nlemma watchdog_tick_event_distinct:\n  assumes \"rel_watchdog as cs\"\n  shows \"distinct (map DISPATCH (fst (watchdog_tick cs)))\"\nproof -\n  have a: \"distinct (fst (watchdog_tick cs))\"\n    unfolding watchdog_tick_def\n    apply (rule watchdog_tick_distinct)\n    using assms(1) unfolding rel_watchdog_def valid_watchdog_def\n    using decr_head_atmost_one by auto\n  have b: \"distinct es \\<Longrightarrow> distinct (map DISPATCH es)\" for es\n    apply (induction es) by auto\n  show ?thesis\n    using a b by auto\nqed\n\ntheorem watchdog_tick_rule':\n  \"\\<lbrace> \\<lambda>cs es. \\<exists>cs'. rel_watchdog as cs' \\<and> cs = cs' \\<and> es = [] \\<rbrace>\n     watchdog_tick_impl\n   \\<lbrace> \\<lambda>_ cs es. rel_watchdog (spec_watchdog_tick as) cs \\<and>\n               distinct es \\<and>\n               set es = DISPATCH ` (spec_watchdog_tick_ev as) \\<rbrace>!\"\n  apply (rule validNF_ex_pre)\n  subgoal for cs'\n    apply (subst validNF_conj_pre)\n    apply auto\n    apply (rule validNF_strengthen_post)\n     apply (rule watchdog_tick_impl_rule)\n    apply (rule conjI)\n    by (auto simp add: watchdog_tick_full watchdog_tick_event_distinct)\n  done\n\ntheorem watchdog_tick_rule:\n  \"\\<lbrace> \\<lambda>cs es. rel_watchdog as cs \\<and> nil\\<^sub>e es \\<rbrace>\n     watchdog_tick_impl\n   \\<lbrace> \\<lambda>_ cs es. rel_watchdog (spec_watchdog_tick as) cs \\<and>\n               distinct es \\<and>\n               set es = DISPATCH ` (spec_watchdog_tick_ev as) \\<rbrace>!\"\n  apply (rule validNF_weaken_pre) unfolding nil_event_def\n  apply (rule watchdog_tick_rule')\n  by auto\n\ntheorem watchdog_remove_full:\n  assumes \"rel_watchdog as cs\"\n  shows \"rel_watchdog (as(evt_id := None)) (watchdog_remove evt_id cs)\"\nproof -\n  have valid: \"valid_watchdog cs\"\n    using assms unfolding rel_watchdog_def by auto\n  show ?thesis\n    apply (auto simp add: rel_watchdog_def)\n    apply (rule watchdog_remove_valid[OF valid])\n    apply (rule ext) subgoal for evt_id'\n      apply (cases \"evt_id = evt_id'\")\n      subgoal apply auto apply (subst watchdog_remove_prop1')\n        using assms by (auto simp add: valid_watchdog_def rel_watchdog_def)\n      apply auto apply (subst watchdog_remove_prop2')\n      using assms by (auto simp add: rel_watchdog_def)\n    done\nqed\n\ntheorem watchdog_remove_rule':\n  \"\\<lbrace> \\<lambda>cs es. \\<exists>cs'. rel_watchdog as cs' \\<and> cs = cs' \\<and> es = e0 \\<rbrace>\n     watchdog_remove_impl evt_id\n   \\<lbrace> \\<lambda>_ cs es. rel_watchdog (as(evt_id := None)) cs \\<and> es = e0 \\<rbrace>!\"\n  apply (rule validNF_ex_pre)\n  subgoal for cs'\n    apply (subst validNF_conj_pre)\n    apply auto\n    apply (rule validNF_strengthen_post)\n     apply (rule watchdog_remove_impl_rule)\n    apply auto\n    apply (rule watchdog_remove_full)\n    by (auto simp add: watchdog_remove_valid)\n  done\n\ntheorem watchdog_remove_rule:\n  \"\\<lbrace> \\<lambda>cs es. rel_watchdog as cs \\<and> nil\\<^sub>e es \\<rbrace>\n     watchdog_remove_impl evt_id\n   \\<lbrace> \\<lambda>_ cs es. rel_watchdog (as(evt_id := None)) cs \\<and> nil\\<^sub>e es \\<rbrace>!\"\n  apply (rule validNF_weaken_pre) unfolding nil_event_def\n   apply (rule watchdog_remove_rule')\n  by auto\n\nend\n", "meta": {"author": "bzhan", "repo": "EventSystem", "sha": "3499867fd8fbf9b8d6acf80a0791f279b553ce15", "save_path": "github-repos/isabelle/bzhan-EventSystem", "path": "github-repos/isabelle/bzhan-EventSystem/EventSystem-3499867fd8fbf9b8d6acf80a0791f279b553ce15/EventSystemWatchdog.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6926419704455589, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.3220103404593004}}
{"text": "section \\<open> Reactive Programs \\<close>\n\ntheory utp_rea_prog\n  imports utp_rea_cond \"Shallow-Expressions.Shallow_Expressions\" \"Optics.Optics\" \"UTP2.utp\" \"UTP2.utp_pred\" \nbegin\n\nsubsection \\<open> Stateful reactive alphabet \\<close>\n\ntext \\<open> @{term R3} as presented in the UTP book and related publications is not sensitive to state, \n  although reactive programs often need this property. Thus is is necessary to use a modification \n  of @{term R3} from Butterfield et al.~\\cite{BGW09} that explicitly states that intermediate\n  waiting states do not propagate final state variables. In order to do this we need an additional\n  observational variable that capture the program state that we call $st$. Upon this foundation,\n  we can define operators for reactive programs~\\cite{Foster17c}. \\<close>\n\n(* Changes from UTP1: renamed to reflect the 'rea' naming convention and line up with lemmata. *)\nalphabet ('t, 's) srea_vars = \"'t::trace rea_vars\" +\n  st :: 's\n\n(* TODO(@MattWindsor91): do we need the type synonyms and translations? *)\n\ntype_synonym ('s,'t,'\\<alpha>) rsp = \"('t, 's, '\\<alpha>) srea_vars_scheme\" \\<comment> \\<open> Reactive state predicate \\<close>\ntype_synonym ('s,'t,'\\<alpha>,'\\<beta>) rel_rsp  = \"(('s,'t,'\\<alpha>) rsp, ('s,'t,'\\<beta>) rsp) urel\" \\<comment> \\<open> Relation on the above \\<close>\ntype_synonym ('s,'t,'\\<alpha>) hrel_rsp  = \"('s,'t,'\\<alpha>,'\\<alpha>) rel_rsp\" \\<comment> \\<open> Homogeneous relation on the above \\<close>\ntype_synonym ('s,'t) rdes = \"('s,'t,unit) hrel_rsp\" \\<comment> \\<open> Reactive design? \\<close>\n\n(* Needed to have a bidirectional mapping on the shorthands.\n   TODO(@MattWindsor91): should these be called srea etc.? *)\ntranslations\n  (type) \"('s,'t,'\\<alpha>) rsp\" <= (type) \"('t, ('s, '\\<alpha>) srea_vars_ext) rp\"\n  (type) \"('s,'t,'\\<alpha>) rsp\" <= (type) \"('t, ('s, '\\<alpha>) srea_vars_scheme) rp\"\n  (type) \"('s,'t,unit) rsp\" <= (type) \"('t, 's srea_vars) rp\"\n  (type) \"('s,'t,'\\<alpha>,'\\<beta>) rel_rsp\" <= (type) \"(('s,'t,'\\<alpha>) rsp, ('s1,'t1,'\\<beta>) rsp) urel\"\n  (type) \"('s,'t,'\\<alpha>) hrel_rsp\"  <= (type) \"(('s, 't, '\\<alpha>) rsp, ('s1,'t1,'\\<alpha>1) rsp) urel\" (* ? *)\n  (type) \"('s,'t) rdes\" <= (type) \"('s, 't, unit) hrel_rsp\"\n\ntext \\<open> Shorthand for the non-control alphabet of a stateful reactive process. \\<close>\n\nnotation srea_vars.more\\<^sub>L (\"\\<^bold>v\\<^sub>S\")\n\nsyntax\n  \"_svid_srea_alpha\"  :: \"svid\" (\"\\<^bold>v\\<^sub>S\")\n\ntranslations\n  \"_svid_srea_alpha\" => \"CONST srea_vars.more\\<^sub>L\"\n\ntext \\<open> As a stateful reactive process adds 'st' to the alphabet of a reactive process, we can\n  consider the continuation of its reactive alphabet as the sum of 'st' and the continuation of the\nstateful reactive alphabet. \\<close>\nlemma rea_lens_equiv_st_rest: \"\\<^bold>v\\<^sub>R \\<approx>\\<^sub>L st +\\<^sub>L \\<^bold>v\\<^sub>S\"\n  by simp\n\ntext \\<open> Pairing the reactive stateful alphabet with its control variables forms a bijective lens. \\<close>\nlemma srea_lens_bij: \"bij_lens (ok +\\<^sub>L wait +\\<^sub>L tr +\\<^sub>L st +\\<^sub>L \\<^bold>v\\<^sub>S)\"\nproof -\n  have \"ok +\\<^sub>L wait +\\<^sub>L tr +\\<^sub>L st +\\<^sub>L \\<^bold>v\\<^sub>S \\<approx>\\<^sub>L ok +\\<^sub>L wait +\\<^sub>L tr +\\<^sub>L \\<^bold>v\\<^sub>R\"\n    by (auto intro!:lens_plus_cong, rule lens_equiv_sym, simp add: rea_lens_equiv_st_rest)\n  also have \"... \\<approx>\\<^sub>L 1\\<^sub>L\"\n    using bij_lens_equiv_id[of \"ok +\\<^sub>L wait +\\<^sub>L tr +\\<^sub>L \\<^bold>v\\<^sub>R\"]\n      by (simp add: rea_lens_bij)\n  finally show ?thesis\n    by (simp add: bij_lens_equiv_id)\nqed\n\nlemma st_qual_alpha (*[alpha]*): \"x ;\\<^sub>L fst\\<^sub>L ;\\<^sub>L st \\<times>\\<^sub>L st = ((st\\<^sup><):x)\\<^sub>v\"\nproof -\n  have \"x ;\\<^sub>L fst\\<^sub>L ;\\<^sub>L st \\<times>\\<^sub>L st = x ;\\<^sub>L fst\\<^sub>L ;\\<^sub>L (st ;\\<^sub>L fst\\<^sub>L +\\<^sub>L st ;\\<^sub>L snd\\<^sub>L)\"\n    by (simp add: prod_as_plus)\n  also have \"\\<dots> =  x ;\\<^sub>L (fst\\<^sub>L ;\\<^sub>L (st ;\\<^sub>L fst\\<^sub>L +\\<^sub>L st ;\\<^sub>L snd\\<^sub>L))\" by (simp add: lens_comp_assoc)\n  also have \"\\<dots> = x ;\\<^sub>L (st ;\\<^sub>L fst\\<^sub>L)\" by (simp add: comp_wb_lens fst_lens_plus)\n  also have \"\\<dots> = ((st\\<^sup><):x)\\<^sub>v\" by (simp add: ns_alpha_def) \n  finally show ?thesis .\nqed\n\nlemma unrest_st'_neg_RC [unrest]:\n  assumes \"P is RR\" \"P is RC\"\n  shows \"$st\\<^sup>> \\<sharp> P\"\nproof -\n  have \"P = (\\<not>\\<^sub>r (\\<not>\\<^sub>r P))\"\n    by (simp add: closure rpred assms)\n  also have \"... = (\\<not>\\<^sub>r (\\<not>\\<^sub>r P) ;; true\\<^sub>r)\"\n    by (metis Healthy_if RC1_def RC_implies_RC1 assms(2) calculation)\n  finally have \"P = ...\" .\n  moreover have \"$st\\<^sup>> \\<sharp> ...\"\n    by pred_auto\n  ultimately show \"$st\\<^sup>> \\<sharp> P\"\n    by simp\nqed\n\nlemma ex_st'_RR_closed [closure]: \n  assumes \"P is RR\"\n  shows \"(\\<Sqinter> s. P\\<lbrakk>\\<guillemotleft>s\\<guillemotright>/st\\<^sup>>\\<rbrakk>) is RR\"\nproof -\n  have 1: \"$ok\\<^sup>< \\<sharp> P\" \"$ok\\<^sup>> \\<sharp> P\" \"$wait\\<^sup>< \\<sharp> P\" \"$wait\\<^sup>> \\<sharp> P\"\n    using assms RR_unrests by blast+\n  have 2: \"$ok\\<^sup>< \\<sharp> (\\<Sqinter> s. P\\<lbrakk>\\<guillemotleft>s\\<guillemotright>/st\\<^sup>>\\<rbrakk>)\" \"$ok\\<^sup>> \\<sharp> (\\<Sqinter> s. P\\<lbrakk>\\<guillemotleft>s\\<guillemotright>/st\\<^sup>>\\<rbrakk>)\" \"$wait\\<^sup>< \\<sharp> (\\<Sqinter> s. P\\<lbrakk>\\<guillemotleft>s\\<guillemotright>/st\\<^sup>>\\<rbrakk>)\" \"$wait\\<^sup>> \\<sharp> (\\<Sqinter> s. P\\<lbrakk>\\<guillemotleft>s\\<guillemotright>/st\\<^sup>>\\<rbrakk>)\"\n    by (simp_all add: unrest 1)\n  have 3: \"P = R2(P)\"\n    by (simp add: assms Healthy_if RR_implies_R2)\n  have 4: \"(\\<Sqinter> s. P\\<lbrakk>\\<guillemotleft>s\\<guillemotright>/st\\<^sup>>\\<rbrakk>) is R2\"\n    by (subst 3; pred_auto)\n  from 2 4 show ?thesis\n    using RR_R2_intro by blast\nqed\n\nlemma unrest_st'_R4 [unrest]:\n  \"$st\\<^sup>> \\<sharp> P \\<Longrightarrow> $st\\<^sup>> \\<sharp> R4(P)\"\n  by pred_auto\n\nlemma unrest_st'_R5 [unrest]:\n  \"$st\\<^sup>> \\<sharp> P \\<Longrightarrow> $st\\<^sup>> \\<sharp> R5(P)\"\n  by pred_auto\n\nsubsection \\<open> State Lifting \\<close>\n\n(* TODO: can we write this type better? *)\nabbreviation lift_srea :: \"('c \\<times> 'f \\<Rightarrow> 'g) \\<Rightarrow> ('a::trace, 'b, 'c) srea_vars_scheme \\<times> ('d::trace, 'e, 'f) srea_vars_scheme \\<Rightarrow> 'g\" (\"\\<lceil>_\\<rceil>\\<^sub>S\") where\n\"\\<lceil>P\\<rceil>\\<^sub>S \\<equiv> P \\<up> (\\<^bold>v\\<^sub>S\\<^sup>2)\"\n\nterm lift_state_rel\n\n(* \"('s, 't, '\\<alpha>, '\\<beta>) rel_rsp \\<Rightarrow> ('\\<alpha>, '\\<beta>) urel\" *)\nabbreviation drop_state_rel :: \"(('d::trace, 'e, 'a) srea_vars_scheme \\<times> ('f::trace, 'g, 'b) srea_vars_scheme \\<Rightarrow> 'c) \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 'c\" (\"\\<lfloor>_\\<rfloor>\\<^sub>S\")\nwhere \"\\<lfloor>P\\<rfloor>\\<^sub>S \\<equiv> P \\<down> (\\<^bold>v\\<^sub>S\\<^sup>2)\"\n\nabbreviation lift_state_pre (\"\\<lceil>_\\<rceil>\\<^sub>S\\<^sub><\")\n  where \"\\<lceil>p\\<rceil>\\<^sub>S\\<^sub>< \\<equiv> \\<lceil>p\\<^sup><\\<rceil>\\<^sub>S\"\n\nabbreviation drop_state_pre (\"\\<lfloor>_\\<rfloor>\\<^sub>S\\<^sub><\")\nwhere \"\\<lfloor>p\\<rfloor>\\<^sub>S\\<^sub>< \\<equiv> (\\<lfloor>p\\<rfloor>\\<^sub>S)\\<^sub><\"\n\nabbreviation lift_state_post (\"\\<lceil>_\\<rceil>\\<^sub>S\\<^sub>>\")\nwhere \"\\<lceil>p\\<rceil>\\<^sub>S\\<^sub>> \\<equiv> \\<lceil>p\\<^sup>>\\<rceil>\\<^sub>S\"\n\nabbreviation drop_state_post (\"\\<lfloor>_\\<rfloor>\\<^sub>S\\<^sub>>\")\nwhere \"\\<lfloor>p\\<rfloor>\\<^sub>S\\<^sub>> \\<equiv> (\\<lfloor>p\\<rfloor>\\<^sub>S)\\<^sub>>\"\n\nlemma st_unrest_state_pre [unrest]: \"(unrest \\<top>\\<^sub>S s) \\<Longrightarrow> $st\\<^sup>< \\<sharp> \\<lceil>s\\<rceil>\\<^sub>S\\<^sub><\"\n  by pred_auto\n\nlemma st'_unrest_st_lift_pred [unrest]:\n  \"$st\\<^sup>> \\<sharp> \\<lceil>a\\<rceil>\\<^sub>S\\<^sub><\"\n  by pred_auto\n\nlemma out_alpha_unrest_st_lift_pre [unrest]:\n  \"out\\<alpha> \\<sharp> \\<lceil>a\\<rceil>\\<^sub>S\\<^sub><\"\n  by pred_auto\n\nlemma R1_st'_unrest [unrest]: \"$st\\<^sup>> \\<sharp> P \\<Longrightarrow> $st\\<^sup>> \\<sharp> R1(P)\"\n  by pred_auto\n\nlemma R2c_st'_unrest [unrest]: \"$st\\<^sup>> \\<sharp> P \\<Longrightarrow> $st\\<^sup>> \\<sharp> R2c(P)\"\n  by pred_auto\n\nlemma unrest_st_rea_rename [unrest]: \n  \"$st\\<^sup>< \\<sharp> P \\<Longrightarrow> $st\\<^sup>< \\<sharp> P\\<lparr>f\\<rparr>\\<^sub>r\"\n  \"$st\\<^sup>> \\<sharp> P \\<Longrightarrow> $st\\<^sup>> \\<sharp> P\\<lparr>f\\<rparr>\\<^sub>r\" \n  by (pred_auto, blast)+\n\nlemma st_lift_R1_true_right: \"(\\<lceil>b\\<rceil>\\<^sub>S\\<^sub>< ;; R1(true)) = \\<lceil>b\\<rceil>\\<^sub>S\\<^sub><\"\n  by pred_auto\n\nlemma R2c_lift_state_pre: \"R2c(\\<lceil>b\\<rceil>\\<^sub>S\\<^sub><) = \\<lceil>b\\<rceil>\\<^sub>S\\<^sub><\"\n  by pred_auto\n\nsubsection \\<open> Reactive Program Operators \\<close>\n\nsubsubsection \\<open> State Substitution \\<close>\n\ntext \\<open> Lifting substitutions on the reactive state \\<close>\n\n(* TODO(@MattWindsor91): should this (and the others) be going to [rel], or somewhere else? *)\n\ntext \\<open> The following two functions lift a predicate substitution to a relational one. \\<close>\n\nabbreviation usubst_rel_lift :: \"'\\<alpha> subst \\<Rightarrow> ('\\<alpha> \\<times> '\\<beta>) subst\" (\"\\<lceil>_\\<rceil>\\<^sub>s\") where\n\"\\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<equiv> subst_aext \\<sigma> fst\\<^sub>L\"\n\nabbreviation usubst_rel_drop :: \"('\\<alpha> \\<times> '\\<alpha>) subst \\<Rightarrow> '\\<alpha> subst\" (\"\\<lfloor>_\\<rfloor>\\<^sub>s\") where\n\"\\<lfloor>\\<sigma>\\<rfloor>\\<^sub>s \\<equiv> subst_ares \\<sigma> fst\\<^sub>L\"\n\n(* TODO(@MattWindsor91) *)\n(* :: \"'s subst \\<Rightarrow> (('s,'t::trace,'\\<alpha>) rsp \\<times> ('s,'t,'\\<beta>) rsp) subst\" *)\ndefinition subst_st_lift  (\"\\<lceil>_\\<rceil>\\<^sub>S\\<^sub>\\<sigma>\") where\n[pred]: \"\\<lceil>\\<sigma>\\<rceil>\\<^sub>S\\<^sub>\\<sigma> = \\<lceil>\\<sigma> \\<up>\\<^sub>s st\\<rceil>\\<^sub>s\"\n\nexpr_constructor subst_st_lift\n(*  \\<lceil>subst_aext \\<sigma> st\\<rceil>\\<^sub>S\\<^sub><\" *)\n\n(*  :: \"'s subst \\<Rightarrow> ('s,'t::trace,'\\<alpha>,'\\<beta>) rel_rsp \\<Rightarrow> ('s, 't, '\\<alpha>, '\\<beta>) rel_rsp\" *)\nabbreviation st_subst (infixr \"\\<dagger>\\<^sub>S\" 80) where\n\"\\<sigma> \\<dagger>\\<^sub>S P \\<equiv> \\<lceil>\\<sigma>\\<rceil>\\<^sub>S\\<^sub>\\<sigma> \\<dagger> P\"\n\ntranslations\n  \"\\<sigma> \\<dagger>\\<^sub>S P\" <= \"\\<lceil>\\<sigma> \\<up> st\\<rceil>\\<^sub>S \\<dagger> P\"\n  \"\\<sigma> \\<dagger>\\<^sub>S P\" <= \"\\<lceil>\\<sigma>\\<rceil>\\<^sub>S\\<^sub>\\<sigma> \\<dagger> P\"\n\nexpr_constructor st_subst\n\nlemma st_lift_lemma:\n  \"\\<lceil>\\<sigma>\\<rceil>\\<^sub>S\\<^sub>\\<sigma> = (subst_aext \\<sigma> (fst\\<^sub>L ;\\<^sub>L (st \\<times>\\<^sub>L st)))\"\n  by pred_auto\n\n(*\nlemma unrest_st_lift [unrest]:\n  fixes x :: \"'a \\<Longrightarrow> ('s, 't::trace, '\\<alpha>) rsp \\<times> ('s, 't, '\\<alpha>) rsp\"\n  assumes \"x \\<bowtie> (st)\\<^sub>v\"\n  shows \"x \\<sharp>\\<^sub>s \\<lceil>\\<sigma>\\<rceil>\\<^sub>S\\<^sub>\\<sigma>\" (is \"?P\")\n  by (simp add: st_lift_lemma)\n     (metis assms in_var_def in_var_prod_lens lens_comp_left_id st_vwb_lens unrest_subst_alpha_ext vwb_lens_wb)\n*)\n\nlemma id_st_subst [usubst]: \n  \"\\<lceil>[\\<leadsto>]\\<rceil>\\<^sub>S\\<^sub>\\<sigma> = [\\<leadsto>]\"\n  by pred_auto\n\nlemma st_subst_comp [usubst]:\n  \"\\<lceil>\\<sigma>\\<rceil>\\<^sub>S\\<^sub>\\<sigma> \\<circ>\\<^sub>s \\<lceil>\\<rho>\\<rceil>\\<^sub>S\\<^sub>\\<sigma> = \\<lceil>\\<sigma> \\<circ>\\<^sub>s \\<rho>\\<rceil>\\<^sub>S\\<^sub>\\<sigma>\"\n  by pred_auto\n\ndefinition lift_cond_srea (\"\\<lceil>_\\<rceil>\\<^sub>S\\<^sub>\\<leftarrow>\") where\n[pred]: \"\\<lceil>b\\<rceil>\\<^sub>S\\<^sub>\\<leftarrow> = \\<lceil>b\\<rceil>\\<^sub>S\\<^sub><\"\n\nexpr_constructor lift_cond_srea\n\nlemma unrest_lift_cond_srea [unrest]:\n  \"x \\<sharp> \\<lceil>b\\<rceil>\\<^sub>S\\<^sub>< \\<Longrightarrow> x \\<sharp> \\<lceil>b\\<rceil>\\<^sub>S\\<^sub>\\<leftarrow>\"\n  by (simp add: lift_cond_srea_def)\n\nlemma st_subst_RR_closed [closure]:\n  assumes \"P is RR\"\n  shows \"\\<lceil>\\<sigma>\\<rceil>\\<^sub>S\\<^sub>\\<sigma> \\<dagger> P is RR\"\nproof -\n  have \"RR(\\<lceil>\\<sigma>\\<rceil>\\<^sub>S\\<^sub>\\<sigma> \\<dagger> RR(P)) = \\<lceil>\\<sigma>\\<rceil>\\<^sub>S\\<^sub>\\<sigma> \\<dagger> RR(P)\"\n    by pred_auto\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n\ndeclare [[show_types]]\n\n(* TODO: why doesn't this proof work? *)\nlemma subst_lift_cond_srea [usubst]: \"\\<sigma> \\<dagger>\\<^sub>S \\<lceil>P\\<rceil>\\<^sub>S\\<^sub>\\<leftarrow> = \\<lceil>\\<sigma> \\<dagger> P\\<rceil>\\<^sub>S\\<^sub>\\<leftarrow>\"\n  apply pred_auto\n  oops\n\nlemma st_subst_rea_not [usubst]: \"\\<sigma> \\<dagger>\\<^sub>S (\\<not>\\<^sub>r P) = (\\<not>\\<^sub>r \\<sigma> \\<dagger>\\<^sub>S P)\"\n  by pred_auto\n\nlemma st_subst_seq [usubst]: \"\\<sigma> \\<dagger>\\<^sub>S (P ;; Q) = \\<sigma> \\<dagger>\\<^sub>S P ;; Q\"\n  by pred_auto\n\nlemma st_subst_RC_closed [closure]:\n  assumes \"P is RC\"\n  shows \"\\<sigma> \\<dagger>\\<^sub>S P is RC\"\n  apply (rule RC_intro, simp add: closure assms)\n  apply (simp add: st_subst_rea_not[THEN sym] st_subst_seq[THEN sym])\n  apply (metis Healthy_if RC1_def RC_implies_RC1 assms)\n  done\n\nsubsubsection \\<open> Assignment \\<close>\n\ntext \\<open> An assignment in the stateful reactive \\<close>\n\n(* :: \"(('s, 's) psubst) \\<Rightarrow> ('s, 't::trace, '\\<alpha>) hrel_rsp\"  *)\ndefinition rea_assigns (\"\\<langle>_\\<rangle>\\<^sub>r\") where\n[pred]: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>r = ((tr\\<^sup>< = tr\\<^sup>>)\\<^sub>e \\<and> \\<lceil>\\<langle>\\<sigma>\\<rangle>\\<^sub>a\\<rceil>\\<^sub>S \\<and> (\\<^bold>v\\<^sub>S\\<^sup>< = \\<^bold>v\\<^sub>S\\<^sup>>)\\<^sub>e)\"\n\n(*\nconsts\n  rea_assigns :: \"('a, 'b) psubst \\<Rightarrow> 'p\" (\"\\<langle>_\\<rangle>\\<^sub>a\")\n*)\n\nexpr_constructor rea_assigns\n\n(* New definition of _rea_assign following UTP.utp_rel_syntax *)\nsyntax\n  \"_rea_assign\" :: \"svid \\<Rightarrow> logic \\<Rightarrow> logic\" (infix \":=\\<^sub>r\" 61)\n\ntranslations\n  \"_rea_assign x e\" == \"CONST rea_assigns (CONST subst_upd (CONST subst_id) x (e)\\<^sub>e)\"\n  \"_rea_assign (_svid_tuple (_of_svid_list (x +\\<^sub>L y))) e\" <= \"_rea_assign (x +\\<^sub>L y) e\" \n(* Old UTP1 definition\nsyntax\n  \"_assign_rea\" :: \"svids \\<Rightarrow> uexprs \\<Rightarrow> logic\"  (\"'(_') :=\\<^sub>r '(_')\")  \n  \"_assign_rea\" :: \"svids \\<Rightarrow> uexprs \\<Rightarrow> logic\"  (infixr \":=\\<^sub>r\" 62)\n\ntranslations\n  \"_assign_rea xs vs\" => \"CONST rea_assigns (_mk_msubst (CONST Substitutions.subst_id) xs vs)\"\n  \"_assign_rea x v\" <= \"CONST rea_assigns (CONST subst_upd (id\\<^sub>s) x v)\"\n  \"_assign_rea x v\" <= \"_assign_rea (_spvar x) v\"\n  \"x,y :=\\<^sub>r u,v\" <= \"CONST rea_assigns (CONST subst_upd (CONST subst_upd (Substitutions.subst_id) (CONST var x) u) (CONST var y) v)\"\n*)\n\nlemma rea_assigns_RR_closed [closure]: \n  \"\\<langle>\\<sigma>\\<rangle>\\<^sub>r is RR\"\n  apply pred_auto using minus_zero_eq by auto\n\n(* TODO(@MattWindsor91) *)\nlemma st_subst_assigns_rea [usubst]:\n  \"\\<sigma> \\<dagger>\\<^sub>S \\<langle>\\<rho>\\<rangle>\\<^sub>r = \\<langle>\\<rho> \\<circ>\\<^sub>s \\<sigma>\\<rangle>\\<^sub>r\"\n  apply pred_auto\n  oops\n\nlemma st_subst_rea_skip [usubst]:\n  \"\\<sigma> \\<dagger>\\<^sub>S II\\<^sub>r = \\<langle>\\<sigma>\\<rangle>\\<^sub>r\"\n  oops\n\n(* TODO(@MattWindsor91): needs RR *)\n(*\nlemma rea_assigns_comp [rpred]:\n  assumes \"P is RR\"\n  shows \"\\<langle>\\<sigma>\\<rangle>\\<^sub>r ;; P = \\<sigma> \\<dagger>\\<^sub>S P\"\nproof -\n  have \"\\<langle>\\<sigma>\\<rangle>\\<^sub>r ;; (RR P) = \\<sigma> \\<dagger>\\<^sub>S (RR P)\"\n    apply pred_auto\n    sledgehammer\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n*)\n\n(* TODO(@MattWindsor91) *)\nlemma rea_assigns_rename [rpred]:\n  \"renamer f \\<Longrightarrow> \\<langle>\\<sigma>\\<rangle>\\<^sub>r\\<lparr>f\\<rparr>\\<^sub>r = \\<langle>\\<sigma>\\<rangle>\\<^sub>r\"\n  using minus_zero_eq by pred_auto\n\nlemma st_subst_RR [closure]:\n  assumes \"P is RR\"\n  shows \"(\\<sigma> \\<dagger>\\<^sub>S P) is RR\"\nproof -\n  have \"(\\<sigma> \\<dagger>\\<^sub>S RR(P)) is RR\"\n    by pred_auto\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\n(*\nlemma rea_assigns_st_subst [usubst]:\n  \"\\<lceil>\\<sigma> \\<up>\\<^sub>s st\\<rceil>\\<^sub>s \\<dagger> \\<langle>\\<rho>\\<rangle>\\<^sub>r = \\<langle>\\<rho> \\<circ>\\<^sub>s \\<sigma>\\<rangle>\\<^sub>r\"\n  by pred_auto\n*)\n\nsubsubsection \\<open> Conditional \\<close>\n\ntext \\<open> We guard the reactive conditional condition so that it can't be simplified by alphabet\n  laws unless explicitly simplified. \\<close>\n\n(* TODO(@MattWindsor91) *)\n(*  ::\n  \"('s,'t::trace,'\\<alpha>,'\\<beta>) rel_rsp \\<Rightarrow>\n  's pred \\<Rightarrow>\n  ('s,'t,'\\<alpha>,'\\<beta>) rel_rsp \\<Rightarrow>\n  ('s,'t,'\\<alpha>,'\\<beta>) rel_rsp\" where *)\n\nabbreviation cond_srea where\n\"cond_srea P b Q \\<equiv> P \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>S\\<^sub>\\<leftarrow> \\<triangleright> Q\"\n\nsyntax\n  \"_cond_srea\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"(3_ \\<triangleleft> _ \\<triangleright>\\<^sub>R/ _)\" [52,0,53] 52)\n\ntranslations\n  \"_cond_srea P b Q\" == \"CONST cond_srea P b Q\"\n\nexpr_constructor cond_srea\n\nlemma st_cond_assigns [rpred]:\n  \"\\<langle>\\<sigma>\\<rangle>\\<^sub>r \\<triangleleft> b \\<triangleright>\\<^sub>R \\<langle>\\<rho>\\<rangle>\\<^sub>r = \\<langle>\\<sigma> \\<triangleleft> b \\<triangleright> \\<rho>\\<rangle>\\<^sub>r\"\n  apply pred_auto\n  oops\n\nlemma cond_srea_RR_closed [closure]:\n  assumes \"P is RR\" \"Q is RR\"\n  shows \"P \\<triangleleft> b \\<triangleright>\\<^sub>R Q is RR\"\nproof -\n  have \"RR(RR(P) \\<triangleleft> b \\<triangleright>\\<^sub>R RR(Q)) = RR(P) \\<triangleleft> b \\<triangleright>\\<^sub>R RR(Q)\"\n    by pred_auto\n  thus ?thesis\n    by (metis Healthy_def' assms(1) assms(2))\nqed\n\n(*\nlemma cond_srea_RC1_closed:\n  assumes \"P is RC1\" \"Q is RC1\"\n  shows \"P \\<triangleleft> b \\<triangleright>\\<^sub>R Q is RC1\"\nproof -\n  have \"RC1(RC1(P) \\<triangleleft> b \\<triangleright>\\<^sub>R RC1(Q)) = RC1(P) \\<triangleleft> b \\<triangleright>\\<^sub>R RC1(Q)\"\n    using dual_order.trans by pred_auto\n  thus ?thesis\n    by (metis Healthy_def' assms)\nqed\n\nlemma cond_srea_RC_closed [closure]:\n  assumes \"P is RC\" \"Q is RC\"\n  shows \"P \\<triangleleft> b \\<triangleright>\\<^sub>R Q is RC\"\n  by (rule RC_intro', simp_all add: closure cond_srea_RC1_closed RC_implies_RC1 assms)\n*)\n\nlemma R4_cond [rpred]: \"R4(P \\<triangleleft> b \\<triangleright>\\<^sub>R Q) = ((R4(P)) \\<triangleleft> b \\<triangleright>\\<^sub>R (R4(Q)))\"\n  by pred_auto\n\nlemma R5_cond [rpred]: \"R5(P \\<triangleleft> b \\<triangleright>\\<^sub>R Q) = (R5(P) \\<triangleleft> b \\<triangleright>\\<^sub>R R5(Q))\"\n  by pred_auto\n\nlemma rea_rename_cond [rpred]: \"(P \\<triangleleft> b \\<triangleright>\\<^sub>R Q)\\<lparr>f\\<rparr>\\<^sub>r = P\\<lparr>f\\<rparr>\\<^sub>r \\<triangleleft> b \\<triangleright>\\<^sub>R Q\\<lparr>f\\<rparr>\\<^sub>r\"\n  by (pred_auto; metis)\n  \nsubsubsection \\<open> Assumptions \\<close>\n\n(* :: \"'s pred \\<Rightarrow> ('s, 't::trace, '\\<alpha>) hrel_rsp\" *)\ndefinition rea_assume (\"[_]\\<^sup>\\<top>\\<^sub>r\") where\n[pred]: \"[b]\\<^sup>\\<top>\\<^sub>r = (II\\<^sub>r \\<triangleleft> b \\<triangleright>\\<^sub>R false)\"\n\nexpr_constructor rea_assume\n\nlemma rea_assume_RR [closure]: \"[b]\\<^sup>\\<top>\\<^sub>r is RR\"\n  by (simp add: rea_assume_def closure)\n\nlemma rea_assume_false [rpred]: \"[false]\\<^sup>\\<top>\\<^sub>r = false\"\n  by pred_auto\n\nlemma rea_assume_true [rpred]: \"[true]\\<^sup>\\<top>\\<^sub>r = II\\<^sub>r\"\n  by pred_auto\n\nlemma rea_assume_comp [rpred]: \"[b]\\<^sup>\\<top>\\<^sub>r ;; [c]\\<^sup>\\<top>\\<^sub>r = [b \\<and> c]\\<^sup>\\<top>\\<^sub>r\"\n  by pred_auto\n\nsubsubsection \\<open> State Abstraction \\<close>\n\ntext \\<open> We introduce state abstraction by creating some lens functors that allow us to lift\n  a lens on the state-space to one on the whole stateful reactive alphabet. \\<close>\n\ndefinition lmap\\<^sub>R :: \"('a \\<Longrightarrow> 'b) \\<Rightarrow> ('t::trace, 'a) rp \\<Longrightarrow> ('t, 'b) rp\" where\n[lens_defs]: \"lmap\\<^sub>R = lmap[rea_vars]\"\n\ntext \\<open> This construction lens is useful for conversion between a record and its product representation;\n  it would be helpful if this could be automatically generated. \\<close>\n\n(* TODO(@MattWindsor91): doesn't type correctly *)\ndefinition rsp_make_lens :: \"('\\<sigma>, '\\<tau>::trace, '\\<alpha>) rsp \\<Longrightarrow> bool \\<times> bool \\<times> '\\<tau> \\<times> '\\<sigma> \\<times> '\\<alpha>\" where\n[lens_defs]: \"rsp_make_lens = \\<lparr> lens_get = \\<lambda> (ok, wait, tr, st, more). \\<lparr> ok\\<^sub>v = ok, wait\\<^sub>v = wait, tr\\<^sub>v = tr, st\\<^sub>v = st, \\<dots> = more \\<rparr>\n                              , lens_put = (\\<lambda> s v. (ok\\<^sub>v v, wait\\<^sub>v v, tr\\<^sub>v v, st\\<^sub>v v, more v)) \\<rparr>\"\n\nlemma rsp_make_lens_alt: \"rsp_make_lens = inv\\<^sub>L (ok +\\<^sub>L wait +\\<^sub>L tr +\\<^sub>L st +\\<^sub>L srea_vars.more\\<^sub>L)\"\n  by (auto simp add: lens_defs)\n\nlemma make_lens_bij [simp]: \"bij_lens rsp_make_lens\"\n  by (unfold_locales, simp_all add: lens_defs prod.case_eq_if)\n\ntext \\<open> The following is an intuitive definition of the @{term st} functorial lens, which\n  frames all the state space excluding @{term st}, to which another lens @{term l} is\n  applied. We do this by splitting the state space into a product, including the application\n  of @{term l} to @{term st}, and then invert the product creation lens to reconstruct\n  the reactive state space. \\<close>\n\ndefinition map_st_lens ::\n  \"('\\<sigma> \\<Longrightarrow> '\\<psi>) \\<Rightarrow>\n   (('\\<sigma>, '\\<tau>::trace, '\\<alpha>) rsp \\<Longrightarrow> ('\\<psi>, '\\<tau>::trace, '\\<alpha>) rsp)\" (\"map'_st\\<^sub>L\") where\n\"map_st_lens l = inv\\<^sub>L (ok +\\<^sub>L wait +\\<^sub>L tr +\\<^sub>L st +\\<^sub>L \\<^bold>v\\<^sub>S) ;\\<^sub>L \n                 (ok +\\<^sub>L wait +\\<^sub>L tr +\\<^sub>L (l ;\\<^sub>L st) +\\<^sub>L \\<^bold>v\\<^sub>S)\"\n\ntext \\<open> The above definition is intuitive, but unhelpful in proof automaton. Consequently,\n  we the following optimised definition below. \\<close>\n\nlemma map_st_lens_alt_def [lens_defs]:\n  \"map_st_lens l = \\<lparr> lens_get = \\<lambda> s. \\<lparr> ok\\<^sub>v = ok\\<^sub>v s, wait\\<^sub>v = wait\\<^sub>v s, tr\\<^sub>v = tr\\<^sub>v s, st\\<^sub>v = get\\<^bsub>l\\<^esub> (st\\<^sub>v s), \\<dots> = more s \\<rparr>\n                  , lens_put = \\<lambda> s v. \\<lparr> ok\\<^sub>v = ok\\<^sub>v v, wait\\<^sub>v = wait\\<^sub>v v, tr\\<^sub>v = tr\\<^sub>v v, st\\<^sub>v = put\\<^bsub>l\\<^esub> (st\\<^sub>v s) (st\\<^sub>v v), \\<dots> = more v \\<rparr> \\<rparr>\"\n  by (auto simp add: map_st_lens_def lens_defs fun_eq_iff)\n\n(* TODO(@MattWindsor91): missing def *)\n(*\nlemma map_st_vwb [simp]: \"vwb_lens X \\<Longrightarrow> vwb_lens (map_st\\<^sub>L X)\"\n  apply (simp add: map_st_lens_def rsp_make_lens_alt[THEN sym])\n*)\n\nlemma map_st_lens_indep_st [simp]: \n  \"a \\<bowtie> x \\<Longrightarrow> map_st\\<^sub>L a \\<bowtie> x ;\\<^sub>L st\"\n  by (rule lens_indep.intro, simp_all add: lens_defs lens_indep_comm lens_indep.lens_put_irr2)\n\nlemma map_st_lens_indep_st' [simp]: \n  \"x \\<bowtie> a \\<Longrightarrow> map_st\\<^sub>L a \\<bowtie> x ;\\<^sub>L st\"\n  by (rule lens_indep.intro, simp_all add: lens_defs lens_indep_comm lens_indep.lens_put_irr2)\n\nsyntax\n  \"_map_st_lens\" :: \"logic \\<Rightarrow> salpha\" (\"map'_st\\<^sub>L[_]\")\n\ntranslations\n  \"_map_st_lens a\" => \"CONST map_st_lens a\"\n\nabbreviation \"abs_st\\<^sub>L \\<equiv> (map_st\\<^sub>L 0\\<^sub>L) \\<times>\\<^sub>L (map_st\\<^sub>L 0\\<^sub>L)\"\n\n(* TODO(@MattWindsor91): abbreviation being dropped *)\nabbreviation abs_st (\"\\<langle>_\\<rangle>\\<^sub>S\") where\n\"abs_st P \\<equiv> P \\<down> abs_st\\<^sub>L\"\n\n(* TODO(@MattWindsor91) *)\n(*\nlemma rea_impl_aext_st [alpha]:\n  \"(P \\<Rightarrow>\\<^sub>r Q) \\<oplus>\\<^sub>r map_st\\<^sub>L[a] = (P \\<oplus>\\<^sub>r map_st\\<^sub>L[a] \\<Rightarrow>\\<^sub>r Q \\<oplus>\\<^sub>r map_st\\<^sub>L[a])\"\n  by (rel_auto)\n*)\n\n(*  [alpha] *)\nlemma rea_true_ext_st: \n  \"true\\<^sub>r \\<up> abs_st\\<^sub>L = true\\<^sub>r\"\n  by pred_auto\n\nsubsubsection \\<open> Reactive Frames and Extensions \\<close>\n\n(* TODO(@MattWindsor91) *)\n(*\ndefinition rea_frame :: \"('\\<alpha> \\<Longrightarrow> '\\<beta>) \\<Rightarrow> ('\\<beta>, 't::trace, 'r) hrel_rsp \\<Rightarrow> ('\\<beta>, 't, 'r) hrel_rsp\" where\n[rel]: \"rea_frame x P = frame (ok +\\<^sub>L wait +\\<^sub>L tr +\\<^sub>L (x ;\\<^sub>L st) +\\<^sub>L \\<^bold>v\\<^sub>S) P\"\n\ndefinition rea_frame_ext :: \"('\\<alpha> \\<Longrightarrow> '\\<beta>) \\<Rightarrow> ('\\<alpha>, 't::trace, 'r) hrel_rsp \\<Rightarrow> ('\\<beta>, 't, 'r) hrel_rsp\" where\n[rel]: \"rea_frame_ext a P = rea_frame a (P \\<oplus>\\<^sub>r map_st\\<^sub>L[a])\"\n\nsyntax\n  \"_rea_frame\"     :: \"salpha \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_:[_]\\<^sub>r\" [99,0] 100)\n  \"_rea_frame_ext\" :: \"salpha \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_:[_]\\<^sub>r\\<^sup>+\" [99,0] 100)\n\ntranslations\n  \"_rea_frame x P\" => \"CONST rea_frame x P\"\n  \"_rea_frame (_salphaset (_salphamk x)) P\" <= \"CONST rea_frame x P\"\n  \"_rea_frame_ext x P\" => \"CONST rea_frame_ext x P\"\n  \"_rea_frame_ext (_salphaset (_salphamk x)) P\" <= \"CONST rea_frame_ext x P\"\n\nlemma rea_frame_R1_closed [closure]: \n  assumes \"P is R1\"\n  shows \"x:[P]\\<^sub>r is R1\"\nproof -\n  have \"R1(x:[R1 P]\\<^sub>r) = x:[R1 P]\\<^sub>r\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_if Healthy_intro assms)\nqed\n\nlemma rea_frame_R2_closed [closure]: \n  assumes \"P is R2\"\n  shows \"x:[P]\\<^sub>r is R2\"\nproof -\n  have \"R2(x:[R2 P]\\<^sub>r) = x:[R2 P]\\<^sub>r\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_if Healthy_intro assms)\nqed\n\nlemma rea_frame_RR_closed [closure]: \n  assumes \"P is RR\"\n  shows \"x:[P]\\<^sub>r is RR\"\nproof -\n  have \"RR(x:[RR P]\\<^sub>r) = x:[RR P]\\<^sub>r\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_if Healthy_intro assms)\nqed\n\nlemma rea_aext_R1 [closure]:\n  assumes \"P is R1\"\n  shows \"rel_aext P (map_st\\<^sub>L x) is R1\"\nproof -\n  have \"rel_aext (R1 P) (map_st\\<^sub>L x) is R1\"\n    by (rel_auto)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma rea_aext_R2 [closure]:\n  assumes \"P is R2\"\n  shows \"rel_aext P (map_st\\<^sub>L x) is R2\"\nproof -\n  have \"rel_aext (R2 P) (map_st\\<^sub>L x) is R2\"\n    by (rel_auto)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma rea_aext_RR [closure]:\n  assumes \"P is RR\"\n  shows \"rel_aext P (map_st\\<^sub>L x) is RR\"\nproof -\n  have \"rel_aext (RR P) (map_st\\<^sub>L x) is RR\"\n    by (rel_auto)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma true_rea_map_st [alpha]: \"(R1 true \\<oplus>\\<^sub>r map_st\\<^sub>L[a]) = R1 true\"\n  by (rel_auto)\n\nlemma rea_frame_ext_R1_closed [closure]:\n  \"P is R1 \\<Longrightarrow> x:[P]\\<^sub>r\\<^sup>+ is R1\"\n  by (simp add: rea_frame_ext_def closure)\n\nlemma rea_frame_ext_R2_closed [closure]:\n  \"P is R2 \\<Longrightarrow> x:[P]\\<^sub>r\\<^sup>+ is R2\"\n  by (simp add: rea_frame_ext_def closure)\n\nlemma rea_frame_ext_RR_closed [closure]:\n  \"P is RR \\<Longrightarrow> x:[P]\\<^sub>r\\<^sup>+ is RR\"\n  by (simp add: rea_frame_ext_def closure)\n\nlemma rel_aext_st_Instant_closed [closure]:\n  \"P is Instant \\<Longrightarrow> rel_aext P (map_st\\<^sub>L x) is Instant\"\n  by (rel_auto)\n\nlemma rea_frame_ext_false [frame]:\n  \"x:[false]\\<^sub>r\\<^sup>+ = false\"\n  by (rel_auto)\n  \nlemma rea_frame_ext_skip [frame]:\n  \"vwb_lens x \\<Longrightarrow> x:[II\\<^sub>r]\\<^sub>r\\<^sup>+ = II\\<^sub>r\"\n  by (rel_auto)\n\nlemma rea_frame_ext_assigns [frame]:\n  \"vwb_lens x \\<Longrightarrow> x:[\\<langle>\\<sigma>\\<rangle>\\<^sub>r]\\<^sub>r\\<^sup>+ = \\<langle>\\<sigma> \\<up> x\\<rangle>\\<^sub>r\"\n  by (rel_auto)\n\nlemma rea_frame_ext_cond [frame]:\n  \"x:[P \\<triangleleft> b \\<triangleright>\\<^sub>R Q]\\<^sub>r\\<^sup>+ = x:[P]\\<^sub>r\\<^sup>+ \\<triangleleft> (b \\<oplus>\\<^sub>p x) \\<triangleright>\\<^sub>R x:[Q]\\<^sub>r\\<^sup>+\"\n  by (rel_auto)\n    \nlemma rea_frame_ext_seq [frame]:\n  \"vwb_lens x \\<Longrightarrow> x:[P ;; Q]\\<^sub>r\\<^sup>+ = x:[P]\\<^sub>r\\<^sup>+ ;; x:[Q]\\<^sub>r\\<^sup>+\"\n  apply (simp add: rea_frame_ext_def rea_frame_def alpha frame)\n  apply (subst frame_seq)\n     apply (simp_all add: plus_vwb_lens closure)\n   apply (rel_auto)+\n  done\n\nlemma rea_frame_ext_subst_indep [usubst]:\n  assumes \"x \\<bowtie> y\" \"\\<Sigma> \\<sharp> v\" \"P is RR\"\n  shows \"\\<sigma>(y \\<mapsto>\\<^sub>s v) \\<dagger>\\<^sub>S x:[P]\\<^sub>r\\<^sup>+ = (\\<sigma> \\<dagger>\\<^sub>S x:[P]\\<^sub>r\\<^sup>+) ;; y :=\\<^sub>r v\"\nproof -\n  from assms(1-2) have \"\\<sigma>(y \\<mapsto>\\<^sub>s v) \\<dagger>\\<^sub>S x:[RR P]\\<^sub>r\\<^sup>+ = (\\<sigma> \\<dagger>\\<^sub>S x:[RR P]\\<^sub>r\\<^sup>+) ;; y :=\\<^sub>r v\"\n    by (rel_auto, (metis (no_types, lifting) lens_indep.lens_put_comm lens_indep_get)+)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma rea_frame_ext_subst_within [usubst]:\n  assumes \"vwb_lens x\" \"vwb_lens y\" \"\\<Sigma> \\<sharp> v\" \"P is RR\"\n  shows \"\\<sigma>(x:y \\<mapsto>\\<^sub>s v) \\<dagger>\\<^sub>S x:[P]\\<^sub>r\\<^sup>+ = (\\<sigma> \\<dagger>\\<^sub>S x:[y :=\\<^sub>r (v \\<restriction>\\<^sub>e x) ;; P]\\<^sub>r\\<^sup>+)\"\nproof -\n  from assms(1,3) have \"\\<sigma>(x:y \\<mapsto>\\<^sub>s v) \\<dagger>\\<^sub>S x:[RR P]\\<^sub>r\\<^sup>+ = (\\<sigma> \\<dagger>\\<^sub>S x:[y :=\\<^sub>r (v \\<restriction>\\<^sub>e x) ;; RR(P)]\\<^sub>r\\<^sup>+)\"\n    by (rel_auto, metis+)\n  thus ?thesis\n    by (simp add: assms Healthy_if)\nqed\n\nlemma rea_frame_ext_UINF_ind [frame]:\n  \"a:[\\<Sqinter> x \\<bullet> P x]\\<^sub>r\\<^sup>+ = (\\<Sqinter> x \\<bullet> a:[P x]\\<^sub>r\\<^sup>+)\"\n  by (rel_auto)\n\nlemma rea_frame_ext_UINF_mem [frame]: \n  \"a:[\\<Sqinter> x\\<in>A \\<bullet> P x]\\<^sub>r\\<^sup>+ = (\\<Sqinter> x\\<in>A \\<bullet> a:[P x]\\<^sub>r\\<^sup>+)\"\n  by (rel_auto)\n*)\n\nsubsection \\<open> Stateful Reactive specifications \\<close>\n\n(* TODO(@MattWindsor91) *)\n(* :: \"'s hrel \\<Rightarrow> ('s, 't::trace, '\\<alpha>, '\\<beta>) rel_rsp\" *)\ndefinition rea_st_rel (\"[_]\\<^sub>S\") where\n[pred]: \"rea_st_rel b = (\\<lceil>(b)\\<^sub>e\\<rceil>\\<^sub>S \\<and> (tr\\<^sup>> = tr\\<^sup><)\\<^sub>e)\"\n\n(*  :: \"'s hrel \\<Rightarrow> ('s, 't::trace, '\\<alpha>, '\\<beta>) rel_rsp\" *)\ndefinition rea_st_rel'(\"[_]\\<^sub>S''\") where\n[pred]: \"rea_st_rel' b = R1(\\<lceil>b\\<rceil>\\<^sub>S)\"\n\n(*  :: \"'s pred \\<Rightarrow> ('s, 't::trace, '\\<alpha>, '\\<beta>) rel_rsp\" *)\ndefinition rea_st_cond (\"[_]\\<^sub>S\\<^sub><\") where\n[pred]: \"rea_st_cond b = R1(\\<lceil>b\\<rceil>\\<^sub>S\\<^sub><)\"\n\n(*  :: \"'s upred \\<Rightarrow> ('s, 't::trace, '\\<alpha>, '\\<beta>) rel_rsp\" *)\ndefinition rea_st_post (\"[_]\\<^sub>S\\<^sub>>\") where\n[pred]: \"rea_st_post b = R1(\\<lceil>b\\<rceil>\\<^sub>S\\<^sub>>)\"\n\n(*\nlemma lift_state_pre_unrest [unrest]: \"x \\<bowtie> (st\\<^sup><)\\<^sub>v \\<Longrightarrow> $x \\<sharp> \\<lceil>P\\<rceil>\\<^sub>S\\<^sub><\"\n  apply (pred_auto, simp add: lens_indep_def)\n  oops\n\nlemma rea_st_rel_unrest [unrest]:\n  \"\\<lbrakk> x \\<bowtie> (tr\\<^sup><)\\<^sub>v; x \\<bowtie> (tr\\<^sup>>)\\<^sub>v; x \\<bowtie> (st\\<^sup><)\\<^sub>v; x \\<bowtie> (st\\<^sup>>)\\<^sub>v \\<rbrakk> \\<Longrightarrow> $x \\<sharp> [P]\\<^sub>S\\<^sub><\"\n  by (simp add: rea_st_cond_def R1_def unrest lens_indep_sym)\n\nlemma rea_st_cond_unrest [unrest]:\n  \"\\<lbrakk> x \\<bowtie> (tr\\<^sup><)\\<^sub>v; x \\<bowtie> (tr\\<^sup>>)\\<^sub>v; x \\<bowtie> (st\\<^sup><)\\<^sub>v \\<rbrakk> \\<Longrightarrow> $x \\<sharp> [P]\\<^sub>S\\<^sub><\"\n  by (simp add: add: rea_st_cond_def R1_def unrest lens_indep_sym)\n*)\n\nlemma subst_st_cond [usubst]: \"\\<lceil>\\<sigma>\\<rceil>\\<^sub>S\\<^sub>\\<sigma> \\<dagger> [P]\\<^sub>S\\<^sub>< = [\\<sigma> \\<dagger> P]\\<^sub>S\\<^sub><\"\n  apply pred_auto\n  oops\n\nlemma rea_st_cond_R1 [closure]: \"[b]\\<^sub>S\\<^sub>< is R1\"\n  by pred_auto\n\nlemma rea_st_cond_R2c [closure]: \"[b]\\<^sub>S\\<^sub>< is R2c\"\n  by pred_auto\n\nlemma rea_st_rel_RR [closure]: \"[P]\\<^sub>S is RR\"\n  using minus_zero_eq by pred_auto\n\nlemma rea_st_rel'_RR [closure]: \"[P]\\<^sub>S' is RR\"\n  by pred_auto\n\nlemma rea_st_post_RR [closure]: \"[b]\\<^sub>S\\<^sub>> is RR\"\n  by pred_auto\n\n(*\nlemma st_subst_rel [usubst]:\n  \"\\<sigma> \\<dagger>\\<^sub>S [P]\\<^sub>S = [\\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> P]\\<^sub>S\"\n  by pred_auto\n*)\n\n(*\nlemma st_rel_cond [rpred]:\n  \"[P \\<triangleleft> b \\<triangleright>\\<^sub>r Q]\\<^sub>S = [P]\\<^sub>S \\<triangleleft> b \\<triangleright>\\<^sub>R [Q]\\<^sub>S\"\n  by (rel_auto)\n*) \n  \nlemma st_rel_false [rpred]: \"[false]\\<^sub>S = false\"\n  by pred_auto\n\n(* TODO: This is currently false, meaning something\n   is wrong in a definition *)\n(*\nlemma st_rel_skip [rpred]: \n  \"[II]\\<^sub>S = (II\\<^sub>r :: ('s, 't::trace) rdes)\"\n  by pred_auto\n*)\n\nlemma st_rel_seq [rpred]:\n  \"[P ;; Q]\\<^sub>S = [P]\\<^sub>S ;; [Q]\\<^sub>S\"\n  by pred_auto\n  \nlemma st_rel_conj [rpred]:\n  \"([P]\\<^sub>S \\<and> [Q]\\<^sub>S) = [P \\<and> Q]\\<^sub>S\"\n   by pred_auto\n\nlemma st_cond_disj [rpred]: \n  \"([P]\\<^sub>S\\<^sub>< \\<or> [Q]\\<^sub>S\\<^sub><) = [P \\<or> Q]\\<^sub>S\\<^sub><\"\n  by pred_auto\n\nlemma rea_st_cond_RR [closure]: \"[b]\\<^sub>S\\<^sub>< is RR\"\n  by (rule RR_intro, simp_all add: unrest closure; pred_auto)\n\nlemma rea_st_cond_RC [closure]: \"[b]\\<^sub>S\\<^sub>< is RC\"\n  by (rule RC_intro, simp add: closure, pred_auto)\n    \nlemma rea_st_cond_true [rpred]: \"[true]\\<^sub>S\\<^sub>< = true\\<^sub>r\"\n  by pred_auto\n\nlemma rea_st_cond_false [rpred]: \"[false]\\<^sub>S\\<^sub>< = false\"\n  by pred_auto\n    \nlemma st_cond_not [rpred]: \"(\\<not>\\<^sub>r [P]\\<^sub>S\\<^sub><) = [\\<not> P]\\<^sub>S\\<^sub><\"\n  by pred_auto\n\nlemma st_cond_conj [rpred]: \"([P]\\<^sub>S\\<^sub>< \\<and> [Q]\\<^sub>S\\<^sub><) = [P \\<and> Q]\\<^sub>S\\<^sub><\"\n  by pred_auto\n    \nlemma st_rel_assigns [rpred]:\n  \"[\\<langle>\\<sigma>\\<rangle>\\<^sub>a]\\<^sub>S = (\\<langle>\\<sigma>\\<rangle>\\<^sub>r :: ('\\<alpha>, 't::trace) rdes)\"\n  by pred_auto\n\nlemma cond_st_distr: \"(P \\<triangleleft> b \\<triangleright>\\<^sub>R Q) ;; R = (P ;; R \\<triangleleft> b \\<triangleright>\\<^sub>R Q ;; R)\"\n  by (pred_auto; blast)\n        \nlemma cond_st_miracle [rpred]: \"P is R1 \\<Longrightarrow> P \\<triangleleft> b \\<triangleright>\\<^sub>R false = ([b]\\<^sub>S\\<^sub>< \\<and> P)\"\n  by (pred_auto; blast)\n\nlemma cond_st_true [rpred]: \"P \\<triangleleft> true \\<triangleright>\\<^sub>R Q = P\"\n  by pred_auto\n    \nlemma cond_st_false [rpred]: \"P \\<triangleleft> false \\<triangleright>\\<^sub>R Q = Q\"\n  by pred_auto\n    \nlemma st_cond_true_or [rpred]: \"P is R1 \\<Longrightarrow> (R1 true \\<triangleleft> b \\<triangleright>\\<^sub>R P) = ([b]\\<^sub>S\\<^sub>< \\<or> P)\"  \nby (pred_auto; blast)\n    \nlemma st_cond_left_impl_RC_closed [closure]:\n  \"P is RC \\<Longrightarrow> ([b]\\<^sub>S\\<^sub>< \\<longrightarrow>\\<^sub>r P) is RC\"\n  by (simp add: rea_impl_def rpred closure)\n\nend", "meta": {"author": "isabelle-utp", "repo": "UTP-Reactive", "sha": "d09fc006152794f02cfb5871060658b93757836b", "save_path": "github-repos/isabelle/isabelle-utp-UTP-Reactive", "path": "github-repos/isabelle/isabelle-utp-UTP-Reactive/UTP-Reactive-d09fc006152794f02cfb5871060658b93757836b/utp_rea_prog.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381667555713, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.32196816377828635}}
{"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(GD_GPL)\n *)\n\ntheory Example\nimports System_S\nbegin\n\ndefinition \"id0 \\<equiv> 0\"\ndefinition  \"id1 \\<equiv> 1\"\ndefinition  \"id2 \\<equiv> 2\"\n\ndefinition \"e0 \\<equiv> Entity {\\<lparr> target = id1, rights = {Store}\\<rparr>}\"\ndefinition \"e1 \\<equiv> Entity {\\<lparr> target = id2, rights = {Grant}\\<rparr>}\"\ndefinition \"e2 \\<equiv> Entity {}\"\n\nlemmas id_defs = id0_def id1_def id2_def\nlemmas entity_defs = e0_def e1_def e2_def\n\ndefinition example_state :: \"state\" where\n\"example_state \\<equiv> [0 \\<mapsto> e0, 1 \\<mapsto> e1, 2 \\<mapsto> e2] \"\n\nlemma de0:\n  \"direct_caps_of example_state id0 =\n   {\\<lparr> target = id1, rights = {Store}\\<rparr>}\"\n  by (simp add: direct_caps_of_def example_state_def\n                id_defs entity_defs\n         split: option.splits)\n\nlemma de1:\n  \"direct_caps_of example_state id1 =\n   {\\<lparr> target = id2, rights = {Grant}\\<rparr>}\"\n  by (simp add: direct_caps_of_def example_state_def\n                id_defs entity_defs \n         split: option.splits)\n\nlemma de2: \"direct_caps_of example_state id2 = {}\"\n  by (simp add: direct_caps_of_def example_state_def\n                id_defs entity_defs\n         split: option.splits)\n\n\nlemma scd:\n  \"store_connected_direct example_state = {(id0,id1)}\"\n  by (auto simp: store_connected_direct_def direct_caps_of_def\n                 example_state_def id_defs entity_defs\n          split: if_split_asm option.splits\n           cong: conj_cong)\n\nlemma sc:\n  \"store_connected example_state = {(id0,id1)} \\<union> Id\"\n  apply simp\n  apply (rule equalityI)\n  apply (insert scd)\n   apply (simp add: store_connected_def)\n   apply clarsimp\n   apply (erule converse_rtranclE)\n    apply simp\n   apply clarsimp\n   apply (erule rtranclE)\n    apply simp\n   apply clarsimp\n  apply (fastforce simp: store_connected_def)\n  done\n\nlemma sc': \"store_connected example_state = Id \\<union> {(0,1)}\"\n  by (clarsimp simp: sc id_defs)\n\nlemma ce0:\n  \"caps_of example_state id0 =\n   {\\<lparr>target = id1, rights = {Store}\\<rparr>,\n    \\<lparr>target = id2, rights = {Grant}\\<rparr>}\"\n  by (fastforce simp: caps_of_def sc Collect_disj_eq de0 de1)\n\nlemma ce1:\n  \"caps_of example_state id1 =\n   {\\<lparr> target = id2, rights = {Grant}\\<rparr>}\"\n  apply (clarsimp simp: caps_of_def sc Collect_disj_eq de0 de1)\n  apply (simp add: id0_def id1_def)\n  done\n\nlemma ce2: \"caps_of example_state id2 = {}\"\n  apply (simp add: caps_of_def sc)\n  apply (rule allI)\n  apply (rule conjI)\n   apply (simp add: id0_def id2_def)\n  apply (simp add: de2)\n  done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/spec/take-grant/Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5888891307678319, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.32196815507983}}
{"text": "(*  Title:      Uint16.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nchapter \\<open>Unsigned words of 16 bits\\<close>\n\ntheory Uint16 imports\n  Code_Target_Word_Base\nbegin\n\ntext \\<open>\n  Restriction for ML code generation:\n  This theory assumes that the ML system provides a Word16\n  implementation (mlton does, but PolyML 5.5 does not).\n  Therefore, the code setup lives in the target \\<open>SML_word\\<close>\n  rather than \\<open>SML\\<close>.  This ensures that code generation still\n  works as long as \\<open>uint16\\<close> is not involved.\n  For the target \\<open>SML\\<close> itself, no special code generation \n  for this type is set up. Nevertheless, it should work by emulation via @{typ \"16 word\"} \n  if the theory \\<open>Code_Target_Bits_Int\\<close> is imported.\n\n  Restriction for OCaml code generation:\n  OCaml does not provide an int16 type, so no special code generation \n  for this type is set up.\n\\<close>\n\ndeclare prod.Quotient[transfer_rule]\n\nsection \\<open>Type definition and primitive operations\\<close>\n\ntypedef uint16 = \"UNIV :: 16 word set\" ..\n\nsetup_lifting type_definition_uint16\n\ntext \\<open>Use an abstract type for code generation to disable pattern matching on @{term Abs_uint16}.\\<close>\ndeclare Rep_uint16_inverse[code abstype]\n\ndeclare Quotient_uint16[transfer_rule]\n\ninstantiation uint16 :: \"{neg_numeral, modulo, comm_monoid_mult, comm_ring}\" begin\nlift_definition zero_uint16 :: uint16 is \"0\" .\nlift_definition one_uint16 :: uint16 is \"1\" .\nlift_definition plus_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"(+)\" .\nlift_definition minus_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"(-)\" .\nlift_definition uminus_uint16 :: \"uint16 \\<Rightarrow> uint16\" is uminus .\nlift_definition times_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"(*)\" .\nlift_definition divide_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"(div)\" .\nlift_definition modulo_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"(mod)\" .\ninstance by standard (transfer, simp add: algebra_simps)+\nend\n\ninstantiation uint16 :: linorder begin\nlift_definition less_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"(<)\" .\nlift_definition less_eq_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"(\\<le>)\" .\ninstance by standard (transfer, simp add: less_le_not_le linear)+\nend\n\nlemmas [code] = less_uint16.rep_eq less_eq_uint16.rep_eq\n\ninstantiation uint16 :: bit_operations begin\nlift_definition bitNOT_uint16 :: \"uint16 \\<Rightarrow> uint16\" is bitNOT .\nlift_definition bitAND_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitAND .\nlift_definition bitOR_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitOR .\nlift_definition bitXOR_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitXOR .\nlift_definition test_bit_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> bool\" is test_bit .\nlift_definition set_bit_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> bool \\<Rightarrow> uint16\" is set_bit .\nlift_definition lsb_uint16 :: \"uint16 \\<Rightarrow> bool\" is lsb .\nlift_definition shiftl_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is shiftl .\nlift_definition shiftr_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is shiftr .\nlift_definition msb_uint16 :: \"uint16 \\<Rightarrow> bool\" is msb .\ninstance ..\nend\n\ninstantiation uint16 :: bit_comprehension begin\nlift_definition set_bits_uint16 :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> uint16\" is \"set_bits\" .\ninstance ..\nend\n\nlemmas [code] = test_bit_uint16.rep_eq lsb_uint16.rep_eq msb_uint16.rep_eq\n\ninstantiation uint16 :: equal begin\nlift_definition equal_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"equal_class.equal\" .\ninstance by standard (transfer, simp add: equal_eq)\nend\n\nlemmas [code] = equal_uint16.rep_eq\n\ninstantiation uint16 :: size begin\nlift_definition size_uint16 :: \"uint16 \\<Rightarrow> nat\" is \"size\" .\ninstance ..\nend\n\nlemmas [code] = size_uint16.rep_eq\n\nlift_definition sshiftr_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" (infixl \">>>\" 55) is sshiftr .\n\nlift_definition uint16_of_int :: \"int \\<Rightarrow> uint16\" is \"word_of_int\" .\n\ndefinition uint16_of_nat :: \"nat \\<Rightarrow> uint16\"\nwhere \"uint16_of_nat = uint16_of_int \\<circ> int\"\n\nlift_definition int_of_uint16 :: \"uint16 \\<Rightarrow> int\" is \"uint\" .\nlift_definition nat_of_uint16 :: \"uint16 \\<Rightarrow> nat\" is \"unat\" .\n\ndefinition integer_of_uint16 :: \"uint16 \\<Rightarrow> integer\"\nwhere \"integer_of_uint16 = integer_of_int o int_of_uint16\"\n\ntext \\<open>Use pretty numerals from integer for pretty printing\\<close>\n\ncontext includes integer.lifting begin\n\nlift_definition Uint16 :: \"integer \\<Rightarrow> uint16\" is \"word_of_int\" .\n\nlemma Rep_uint16_numeral [simp]: \"Rep_uint16 (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint16_def Abs_uint16_inverse numeral.simps plus_uint16_def)\n\nlemma Rep_uint16_neg_numeral [simp]: \"Rep_uint16 (- numeral n) = - numeral n\"\nby(simp only: uminus_uint16_def)(simp add: Abs_uint16_inverse)\n\nlemma numeral_uint16_transfer [transfer_rule]:\n  \"(rel_fun (=) cr_uint16) numeral numeral\"\nby(auto simp add: cr_uint16_def)\n\nlemma numeral_uint16 [code_unfold]: \"numeral n = Uint16 (numeral n)\"\nby transfer simp\n\nlemma neg_numeral_uint16 [code_unfold]: \"- numeral n = Uint16 (- numeral n)\"\nby transfer(simp add: cr_uint16_def)\n\nend\n\nlemma Abs_uint16_numeral [code_post]: \"Abs_uint16 (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint16_def numeral.simps plus_uint16_def Abs_uint16_inverse)\n\nlemma Abs_uint16_0 [code_post]: \"Abs_uint16 0 = 0\"\nby(simp add: zero_uint16_def)\n\nlemma Abs_uint16_1 [code_post]: \"Abs_uint16 1 = 1\"\nby(simp add: one_uint16_def)\n\nsection \\<open>Code setup\\<close>\n\ncode_printing code_module Uint16 \\<rightharpoonup> (SML_word)\n\\<open>(* Test that words can handle numbers between 0 and 15 *)\nval _ = if 4 <= Word.wordSize then () else raise (Fail (\"wordSize less than 4\"));\n\nstructure Uint16 : sig\n  val set_bit : Word16.word -> IntInf.int -> bool -> Word16.word\n  val shiftl : Word16.word -> IntInf.int -> Word16.word\n  val shiftr : Word16.word -> IntInf.int -> Word16.word\n  val shiftr_signed : Word16.word -> IntInf.int -> Word16.word\n  val test_bit : Word16.word -> IntInf.int -> bool\nend = struct\n\nfun set_bit x n b =\n  let val mask = Word16.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))\n  in if b then Word16.orb (x, mask)\n     else Word16.andb (x, Word16.notb mask)\n  end\n\nfun shiftl x n =\n  Word16.<< (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr x n =\n  Word16.>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr_signed x n =\n  Word16.~>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun test_bit x n =\n  Word16.andb (x, Word16.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))) <> Word16.fromInt 0\n\nend; (* struct Uint16 *)\\<close>\ncode_reserved SML_word Uint16\n\ncode_printing code_module Uint16 \\<rightharpoonup> (Haskell)\n \\<open>module Uint16(Int16, Word16) where\n\n  import Data.Int(Int16)\n  import Data.Word(Word16)\\<close>\ncode_reserved Haskell Uint16\n\ntext \\<open>Scala provides unsigned 16-bit numbers as Char.\\<close>\n\ncode_printing code_module Uint16 \\<rightharpoonup> (Scala)\n\\<open>object Uint16 {\n\ndef set_bit(x: scala.Char, n: BigInt, b: Boolean) : scala.Char =\n  if (b)\n    (x | (1.toChar << n.intValue)).toChar\n  else\n    (x & (1.toChar << n.intValue).unary_~).toChar\n\ndef shiftl(x: scala.Char, n: BigInt) : scala.Char = (x << n.intValue).toChar\n\ndef shiftr(x: scala.Char, n: BigInt) : scala.Char = (x >>> n.intValue).toChar\n\ndef shiftr_signed(x: scala.Char, n: BigInt) : scala.Char = (x.toShort >> n.intValue).toChar\n\ndef test_bit(x: scala.Char, n: BigInt) : Boolean = (x & (1.toChar << n.intValue)) != 0\n\n} /* object Uint16 */\\<close>\ncode_reserved Scala Uint16\n\ntext \\<open>\n  Avoid @{term Abs_uint16} in generated code, use @{term Rep_uint16'} instead. \n  The symbolic implementations for code\\_simp use @{term Rep_uint16}.\n\n  The new destructor @{term Rep_uint16'} is executable.\n  As the simplifier is given the [code abstract] equations literally, \n  we cannot implement @{term Rep_uint16} directly, because that makes code\\_simp loop.\n\n  If code generation raises Match, some equation probably contains @{term Rep_uint16} \n  ([code abstract] equations for @{typ uint16} may use @{term Rep_uint16} because\n  these instances will be folded away.)\n\n  To convert @{typ \"16 word\"} values into @{typ uint16}, use @{term \"Abs_uint16'\"}.\n\\<close>\n\ndefinition Rep_uint16' where [simp]: \"Rep_uint16' = Rep_uint16\"\n\nlemma Rep_uint16'_transfer [transfer_rule]:\n  \"rel_fun cr_uint16 (=) (\\<lambda>x. x) Rep_uint16'\"\nunfolding Rep_uint16'_def by(rule uint16.rep_transfer)\n\n\n\nlift_definition Abs_uint16' :: \"16 word \\<Rightarrow> uint16\" is \"\\<lambda>x :: 16 word. x\" .\n\nlemma Abs_uint16'_code [code]:\n  \"Abs_uint16' x = Uint16 (integer_of_int (uint x))\"\nincluding integer.lifting by transfer simp\n\ndeclare [[code drop: \"term_of_class.term_of :: uint16 \\<Rightarrow> _\"]]\n\nlemma term_of_uint16_code [code]:\n  defines \"TR \\<equiv> typerep.Typerep\" and \"bit0 \\<equiv> STR ''Numeral_Type.bit0''\" shows\n  \"term_of_class.term_of x = \n   Code_Evaluation.App (Code_Evaluation.Const (STR ''Uint16.uint16.Abs_uint16'') (TR (STR ''fun'') [TR (STR ''Word.word'') [TR bit0 [TR bit0 [TR bit0 [TR bit0 [TR (STR ''Numeral_Type.num1'') []]]]]], TR (STR ''Uint16.uint16'') []]))\n       (term_of_class.term_of (Rep_uint16' x))\"\nby(simp add: term_of_anything)\n\nlemma Uin16_code [code abstract]: \"Rep_uint16 (Uint16 i) = word_of_int (int_of_integer_symbolic i)\"\nunfolding Uint16_def int_of_integer_symbolic_def by(simp add: Abs_uint16_inverse)\n\ncode_printing\n  type_constructor uint16 \\<rightharpoonup>\n  (SML_word) \"Word16.word\" and\n  (Haskell) \"Uint16.Word16\" and\n  (Scala) \"scala.Char\"\n| constant Uint16 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLargeInt (IntInf.toLarge _)\" and\n  (Haskell) \"(Prelude.fromInteger _ :: Uint16.Word16)\" and\n  (Haskell_Quickcheck) \"(Prelude.fromInteger (Prelude.toInteger _) :: Uint16.Word16)\" and\n  (Scala) \"_.charValue\"\n| constant \"0 :: uint16\" \\<rightharpoonup>\n  (SML_word) \"(Word16.fromInt 0)\" and\n  (Haskell) \"(0 :: Uint16.Word16)\" and\n  (Scala) \"0\"\n| constant \"1 :: uint16\" \\<rightharpoonup>\n  (SML_word) \"(Word16.fromInt 1)\" and\n  (Haskell) \"(1 :: Uint16.Word16)\" and\n  (Scala) \"1\"\n| constant \"plus :: uint16 \\<Rightarrow> _ \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.+ ((_), (_))\" and\n  (Haskell) infixl 6 \"+\" and\n  (Scala) \"(_ +/ _).toChar\"\n| constant \"uminus :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.~\" and\n  (Haskell) \"negate\" and\n  (Scala) \"(- _).toChar\"\n| constant \"minus :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.- ((_), (_))\" and\n  (Haskell) infixl 6 \"-\" and\n  (Scala) \"(_ -/ _).toChar\"\n| constant \"times :: uint16 \\<Rightarrow> _ \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.* ((_), (_))\" and\n  (Haskell) infixl 7 \"*\" and\n  (Scala) \"(_ */ _).toChar\"\n| constant \"HOL.equal :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"!((_ : Word16.word) = _)\" and\n  (Haskell) infix 4 \"==\" and\n  (Scala) infixl 5 \"==\"\n| class_instance uint16 :: equal \\<rightharpoonup> (Haskell) -\n| constant \"less_eq :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"Word16.<= ((_), (_))\" and\n  (Haskell) infix 4 \"<=\" and\n  (Scala) infixl 4 \"<=\"\n| constant \"less :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"Word16.< ((_), (_))\" and\n  (Haskell) infix 4 \"<\" and\n  (Scala) infixl 4 \"<\"\n| constant \"bitNOT :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.notb\" and\n  (Haskell) \"Data'_Bits.complement\" and\n  (Scala) \"_.unary'_~.toChar\"\n| constant \"bitAND :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.andb ((_),/ (_))\" and\n  (Haskell) infixl 7 \"Data_Bits..&.\" and\n  (Scala) \"(_ & _).toChar\"\n| constant \"bitOR :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.orb ((_),/ (_))\" and\n  (Haskell) infixl 5 \"Data_Bits..|.\" and\n  (Scala) \"(_ | _).toChar\"\n| constant \"bitXOR :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.xorb ((_),/ (_))\" and\n  (Haskell) \"Data'_Bits.xor\" and\n  (Scala) \"(_ ^ _).toChar\"\n\ndefinition uint16_div :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" \nwhere \"uint16_div x y = (if y = 0 then undefined ((div) :: uint16 \\<Rightarrow> _) x (0 :: uint16) else x div y)\"\n\ndefinition uint16_mod :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" \nwhere \"uint16_mod x y = (if y = 0 then undefined ((mod) :: uint16 \\<Rightarrow> _) x (0 :: uint16) else x mod y)\"\n\ncontext includes undefined_transfer begin\n\nlemma div_uint16_code [code]: \"x div y = (if y = 0 then 0 else uint16_div x y)\"\nunfolding uint16_div_def by transfer (simp add: word_div_def)\n\nlemma mod_uint16_code [code]: \"x mod y = (if y = 0 then x else uint16_mod x y)\"\nunfolding uint16_mod_def by transfer (simp add: word_mod_def)\n\nlemma uint16_div_code [code abstract]:\n  \"Rep_uint16 (uint16_div x y) =\n  (if y = 0 then Rep_uint16 (undefined ((div) :: uint16 \\<Rightarrow> _) x (0 :: uint16)) else Rep_uint16 x div Rep_uint16 y)\"\nunfolding uint16_div_def by transfer simp\n\nlemma uint16_mod_code [code abstract]:\n  \"Rep_uint16 (uint16_mod x y) =\n  (if y = 0 then Rep_uint16 (undefined ((mod) :: uint16 \\<Rightarrow> _) x (0 :: uint16)) else Rep_uint16 x mod Rep_uint16 y)\"\nunfolding uint16_mod_def by transfer simp\n\nend\n\ncode_printing constant uint16_div \\<rightharpoonup>\n  (SML_word) \"Word16.div ((_), (_))\" and\n  (Haskell) \"Prelude.div\" and\n  (Scala) \"(_ '/ _).toChar\"\n| constant uint16_mod \\<rightharpoonup>\n  (SML_word) \"Word16.mod ((_), (_))\" and\n  (Haskell) \"Prelude.mod\" and\n  (Scala) \"(_ % _).toChar\"\n\ndefinition uint16_test_bit :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> bool\"\nwhere [code del]:\n  \"uint16_test_bit x n =\n  (if n < 0 \\<or> 15 < n then undefined (test_bit :: uint16 \\<Rightarrow> _) x n\n   else x !! (nat_of_integer n))\"\n\nlemma test_bit_uint16_code [code]:\n  \"test_bit x n \\<longleftrightarrow> n < 16 \\<and> uint16_test_bit x (integer_of_nat n)\"\nunfolding uint16_test_bit_def including undefined_transfer integer.lifting \nby transfer(auto cong: conj_cong dest: test_bit_size simp add: word_size)\n\nlemma uint16_test_bit_code [code]:\n  \"uint16_test_bit w n =\n  (if n < 0 \\<or> 15 < n then undefined (test_bit :: uint16 \\<Rightarrow> _) w n else Rep_uint16 w !! nat_of_integer n)\"\nunfolding uint16_test_bit_def by(simp add: test_bit_uint16.rep_eq)\n\ncode_printing constant uint16_test_bit \\<rightharpoonup>\n  (SML_word) \"Uint16.test'_bit\" and\n  (Haskell) \"Data'_Bits.testBitBounded\" and\n  (Scala) \"Uint16.test'_bit\"\n\ndefinition uint16_set_bit :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> bool \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_set_bit x n b =\n  (if n < 0 \\<or> 15 < n then undefined (set_bit :: uint16 \\<Rightarrow> _) x n b\n   else set_bit x (nat_of_integer n) b)\"\n\nlemma set_bit_uint16_code [code]:\n  \"set_bit x n b = (if n < 16 then uint16_set_bit x (integer_of_nat n) b else x)\"\nincluding undefined_transfer integer.lifting unfolding uint16_set_bit_def\nby(transfer)(auto cong: conj_cong simp add: not_less set_bit_beyond word_size)\n\nlemma uint16_set_bit_code [code abstract]:\n  \"Rep_uint16 (uint16_set_bit w n b) = \n  (if n < 0 \\<or> 15 < n then Rep_uint16 (undefined (set_bit :: uint16 \\<Rightarrow> _) w n b)\n   else set_bit (Rep_uint16 w) (nat_of_integer n) b)\"\nincluding undefined_transfer unfolding uint16_set_bit_def by transfer simp\n\ncode_printing constant uint16_set_bit \\<rightharpoonup>\n  (SML_word) \"Uint16.set'_bit\" and\n  (Haskell) \"Data'_Bits.setBitBounded\" and\n  (Scala) \"Uint16.set'_bit\"\n\nlift_definition uint16_set_bits :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is set_bits_aux .\n\nlemma uint16_set_bits_code [code]:\n  \"uint16_set_bits f w n =\n  (if n = 0 then w \n   else let n' = n - 1 in uint16_set_bits f ((w << 1) OR (if f n' then 1 else 0)) n')\"\nby(transfer fixing: n)(cases n, simp_all)\n\nlemma set_bits_uint16 [code]:\n  \"(BITS n. f n) = uint16_set_bits f 0 16\"\nby transfer(simp add: set_bits_conv_set_bits_aux)\n\n\nlemma lsb_code [code]: fixes x :: uint16 shows \"lsb x = x !! 0\"\nby transfer(simp add: word_lsb_def word_test_bit_def)\n\n\ndefinition uint16_shiftl :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_shiftl x n = (if n < 0 \\<or> 16 \\<le> n then undefined (shiftl :: uint16 \\<Rightarrow> _) x n else x << (nat_of_integer n))\"\n\nlemma shiftl_uint16_code [code]: \"x << n = (if n < 16 then uint16_shiftl x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_shiftl_def\nby transfer(simp add: not_less shiftl_zero_size word_size)\n\nlemma uint16_shiftl_code [code abstract]:\n  \"Rep_uint16 (uint16_shiftl w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined (shiftl :: uint16 \\<Rightarrow> _) w n)\n   else Rep_uint16 w << nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_shiftl_def by transfer simp\n\ncode_printing constant uint16_shiftl \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftl\" and\n  (Haskell) \"Data'_Bits.shiftlBounded\" and\n  (Scala) \"Uint16.shiftl\"\n\ndefinition uint16_shiftr :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_shiftr x n = (if n < 0 \\<or> 16 \\<le> n then undefined (shiftr :: uint16 \\<Rightarrow> _) x n else x >> (nat_of_integer n))\"\n\nlemma shiftr_uint16_code [code]: \"x >> n = (if n < 16 then uint16_shiftr x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_shiftr_def\nby transfer(simp add: not_less shiftr_zero_size word_size)\n\nlemma uint16_shiftr_code [code abstract]:\n  \"Rep_uint16 (uint16_shiftr w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined (shiftr :: uint16 \\<Rightarrow> _) w n)\n   else Rep_uint16 w >> nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_shiftr_def by transfer simp\n\ncode_printing constant uint16_shiftr \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftr\" and\n  (Haskell) \"Data'_Bits.shiftrBounded\" and\n  (Scala) \"Uint16.shiftr\"\n\ndefinition uint16_sshiftr :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_sshiftr x n =\n  (if n < 0 \\<or> 16 \\<le> n then undefined sshiftr_uint16 x n else sshiftr_uint16 x (nat_of_integer n))\"\n\nlemma sshiftr_beyond: fixes x :: \"'a :: len word\" shows\n  \"size x \\<le> n \\<Longrightarrow> x >>> n = (if x !! (size x - 1) then -1 else 0)\"\nby(rule word_eqI)(simp add: nth_sshiftr word_size)\n\nlemma sshiftr_uint16_code [code]:\n  \"x >>> n = \n  (if n < 16 then uint16_sshiftr x (integer_of_nat n) else if x !! 15 then -1 else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_sshiftr_def\nby transfer (simp add: not_less sshiftr_beyond word_size)\n\nlemma uint16_sshiftr_code [code abstract]:\n  \"Rep_uint16 (uint16_sshiftr w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined sshiftr_uint16 w n)\n   else Rep_uint16 w >>> nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_sshiftr_def by transfer simp\n\ncode_printing constant uint16_sshiftr \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftr'_signed\" and\n  (Haskell) \n    \"(Prelude.fromInteger (Prelude.toInteger (Data'_Bits.shiftrBounded (Prelude.fromInteger (Prelude.toInteger _) :: Uint16.Int16) _)) :: Uint16.Word16)\" and\n  (Scala) \"Uint16.shiftr'_signed\"\n\nlemma uint16_msb_test_bit: \"msb x \\<longleftrightarrow> (x :: uint16) !! 15\"\nby transfer(simp add: msb_nth)\n\nlemma msb_uint16_code [code]: \"msb x \\<longleftrightarrow> uint16_test_bit x 15\"\nby(simp add: uint16_test_bit_def uint16_msb_test_bit)\n\nlemma uint16_of_int_code [code]: \"uint16_of_int i = Uint16 (integer_of_int i)\"\nincluding integer.lifting by transfer simp\n\nlemma int_of_uint16_code [code]:\n  \"int_of_uint16 x = int_of_integer (integer_of_uint16 x)\"\nby(simp add: integer_of_uint16_def)\n\nlemma nat_of_uint16_code [code]:\n  \"nat_of_uint16 x = nat_of_integer (integer_of_uint16 x)\"\nunfolding integer_of_uint16_def including integer.lifting by transfer (simp add: unat_def)\n\nlemma integer_of_uint16_code [code]:\n  \"integer_of_uint16 n = integer_of_int (uint (Rep_uint16' n))\"\nunfolding integer_of_uint16_def by transfer auto\n\ncode_printing\n  constant \"integer_of_uint16\" \\<rightharpoonup>\n  (SML_word) \"Word16.toInt _ : IntInf.int\" and\n  (Haskell) \"Prelude.toInteger\" and\n  (Scala) \"BigInt\"\n\nsection \\<open>Quickcheck setup\\<close>\n\ndefinition uint16_of_natural :: \"natural \\<Rightarrow> uint16\"\nwhere \"uint16_of_natural x \\<equiv> Uint16 (integer_of_natural x)\"\n\ninstantiation uint16 :: \"{random, exhaustive, full_exhaustive}\" begin\ndefinition \"random_uint16 \\<equiv> qc_random_cnv uint16_of_natural\"\ndefinition \"exhaustive_uint16 \\<equiv> qc_exhaustive_cnv uint16_of_natural\"\ndefinition \"full_exhaustive_uint16 \\<equiv> qc_full_exhaustive_cnv uint16_of_natural\"\ninstance ..\nend\n\ninstantiation uint16 :: narrowing begin\n\ninterpretation quickcheck_narrowing_samples\n  \"\\<lambda>i. let x = Uint16 i in (x, 0xFFFF - x)\" \"0\"\n  \"Typerep.Typerep (STR ''Uint16.uint16'') []\" .\n\ndefinition \"narrowing_uint16 d = qc_narrowing_drawn_from (narrowing_samples d) d\"\ndeclare [[code drop: \"partial_term_of :: uint16 itself \\<Rightarrow> _\"]]\nlemmas partial_term_of_uint16 [code] = partial_term_of_code\n\ninstance ..\nend\n\nno_notation sshiftr_uint16 (infixl \">>>\" 55)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Native_Word/Uint16.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3219494999607148}}
{"text": "section\\<open>LTL for EFSMs\\<close>\ntext\\<open>This theory builds off the \\texttt{Linear\\_Temporal\\_Logic\\_on\\_Streams} theory from the HOL\nlibrary and defines functions to ease the expression of LTL properties over EFSMs. Since the LTL\noperators effectively act over traces of models we must find a way to express models as streams.\\<close>\n\ntheory EFSM_LTL\nimports \"Extended_Finite_State_Machines-devel.EFSM\" \"HOL-Library.Linear_Temporal_Logic_on_Streams\"\nbegin\n\ntext_raw\\<open>\\snip{statedef}{1}{2}{%\\<close>\nrecord state =\n  statename :: \"nat option\"\n  datastate :: registers\n  action :: action\n  \"output\" :: outputs\ntext_raw\\<open>}%endsnip\\<close>\n\ntext_raw\\<open>\\snip{whitebox}{1}{2}{%\\<close>\ntype_synonym whitebox_trace = \"state stream\"\ntext_raw\\<open>}%endsnip\\<close>\n\ntype_synonym property = \"whitebox_trace \\<Rightarrow> bool\"\n\nabbreviation label :: \"state \\<Rightarrow> String.literal\" where\n  \"label s \\<equiv> fst (action s)\"\n\nabbreviation inputs :: \"state \\<Rightarrow> value list\" where\n  \"inputs s \\<equiv> snd (action s)\"\n\ntext_raw\\<open>\\snip{ltlStep}{1}{2}{%\\<close>\nfun ltl_step :: \"transition_matrix \\<Rightarrow> cfstate option \\<Rightarrow> registers \\<Rightarrow> action \\<Rightarrow> (nat option \\<times> outputs \\<times> registers)\" where\n  \"ltl_step _ None r _ = (None, [], r)\" |\n  \"ltl_step e (Some s) r (l, i) = (let possibilities = possible_steps e s r l i in\n                   if possibilities = {||} then (None, [], r)\n                   else\n                     let (s', t) = Eps (\\<lambda>x. x |\\<in>| possibilities) in\n                     (Some s', (evaluate_outputs t i r), (evaluate_updates t i r))\n                  )\"\ntext_raw\\<open>}%endsnip\\<close>\n\nlemma ltl_step_singleton:\n\"\\<exists>t. possible_steps e n r (fst v) (snd v) = {|(aa, t)|} \\<and> evaluate_outputs t (snd v) r  = b \\<and> evaluate_updates t (snd v) r = c\\<Longrightarrow>\nltl_step e (Some n) r v = (Some aa, b, c)\"\n  apply (cases v)\n  by auto\n\nlemma ltl_step_none: \"possible_steps e s r a b = {||} \\<Longrightarrow> ltl_step e (Some s) r (a, b) = (None, [], r)\"\n  by simp\n\nlemma ltl_step_none_2: \"possible_steps e s r (fst ie) (snd ie) = {||} \\<Longrightarrow> ltl_step e (Some s) r ie = (None, [], r)\"\n  by (metis ltl_step_none prod.exhaust_sel)\n\nlemma ltl_step_alt: \"ltl_step e (Some s) r t = (\n  let possibilities = possible_steps e s r (fst t) (snd t) in\n  if possibilities = {||} then\n    (None, [], r)\n  else\n  let (s', t') = Eps (\\<lambda>x. x |\\<in>| possibilities) in\n  (Some s', (apply_outputs (Outputs t') (join_ir (snd t) r)), (apply_updates (Updates t') (join_ir (snd t) r) r))\n)\"\n  by (case_tac t, simp add: Let_def)\n\nlemma ltl_step_some:\n  assumes \"possible_steps e s r l i = {|(s', t)|}\"\n      and \"evaluate_outputs t i r = p\"\n      and \"evaluate_updates t i r = r'\"\n    shows \"ltl_step e (Some s) r (l, i) = (Some s', p, r')\"\n  by (simp add: assms)\n\nlemma ltl_step_cases:\n  assumes invalid: \"P (None, [], r)\"\n      and valid: \"\\<forall>(s', t) |\\<in>| (possible_steps e s r l i). P (Some s', (evaluate_outputs t i r), (evaluate_updates t i r))\"\n    shows \"P (ltl_step e (Some s) r (l, i))\"\n  apply simp\n  apply (case_tac \"possible_steps e s r l i\")\n   apply (simp add: invalid)\n  apply simp\n  subgoal for x S'\n    apply (case_tac \"SOME xa. xa = x \\<or> xa |\\<in>| S'\")\n    apply simp\n    apply (insert assms(2))\n    apply (simp add: fBall_def Ball_def fmember_def)\n    by (metis (mono_tags, lifting) fst_conv prod.case_eq_if snd_conv someI_ex)\n  done\n\ntext\\<open>The \\texttt{make\\_full\\_observation} function behaves similarly to \\texttt{observe\\_execution}\nfrom the \\texttt{EFSM} theory. The main difference in behaviour is what is recorded. While the\nobserve execution function simply observes an execution of the EFSM to produce the corresponding\noutput for each action, the intention here is to record every detail of execution, including the\nvalues of internal variables.\n\nThinking of each action as a step forward in time, there are five components which characterise\na given point in the execution of an EFSM. At each point, the model has a current control state and\ndata state. Each action has a label and some input parameters, and its execution may produce\nsome observableoutput. It is therefore sufficient to provide a stream of 5-tuples containing the\ncurrent control state, data state, the label and inputs of the action, and computed output. The\nmake full observation function can then be defined as in Figure 9.1, with an additional\nfunction watch defined on top of this which starts the make full observation off in the\ninitial control state with the empty data state.\n\nCareful inspection of the definition reveals another way that \\texttt{make\\_full\\_observation}\ndiffers from \\texttt{observe\\_execution}. Rather than taking a cfstate, it takes a cfstate option.\nThe reason for this is that we need to make our EFSM models complete. That is, we need them to be\nable to respond to every action from every state like a DFA. If a model does not recognise a given\naction in a given state, we cannot simply stop processing because we are working with necessarily\ninfinite traces. Since these traces are generated by observing action sequences, the make full\nobservation function must keep processing whether there is a viable transition or not.\n\nTo support this, the make full observation adds an implicit ``sink state'' to every EFSM it\nprocesses by lifting control flow state indices from \\texttt{nat} to \\texttt{nat option} such that\nstate $n$ is seen as state \\texttt{Some} $n$. The control flow state \\texttt{None} represents a sink\nstate. If a model is unable to recognise a particular action from its current state, it moves into\nthe \\texttt{None} state. From here, the behaviour is constant for the rest of the time --- the\ncontrol flow state remains None; the data state does not change, and no output is produced.\\<close>\n\ntext_raw\\<open>\\snip{makeFullObservation}{1}{2}{%\\<close>\nprimcorec make_full_observation :: \"transition_matrix \\<Rightarrow> cfstate option \\<Rightarrow> registers \\<Rightarrow> outputs \\<Rightarrow> action stream \\<Rightarrow> whitebox_trace\" where\n  \"make_full_observation e s d p i = (\n    let (s', o', d') = ltl_step e s d (shd i) in\n    \\<lparr>statename = s, datastate = d, action=(shd i), output = p\\<rparr>##(make_full_observation e s' d' o' (stl i))\n  )\"\ntext_raw\\<open>}%endsnip\\<close>\n\ntext_raw\\<open>\\snip{watch}{1}{2}{%\\<close>\nabbreviation watch :: \"transition_matrix \\<Rightarrow> action stream \\<Rightarrow> whitebox_trace\" where\n  \"watch e i \\<equiv> (make_full_observation e (Some 0) <> [] i)\"\ntext_raw\\<open>}%endsnip\\<close>\n\nsubsection\\<open>Expressing Properties\\<close>\ntext\\<open>In order to simplify the expression and understanding of properties, this theory defines a\nnumber of named functions which can be used to express certain properties of EFSMs.\\<close>\n\nsubsubsection\\<open>State Equality\\<close>\ntext\\<open>The \\textsc{state\\_eq} takes a cfstate option representing a control flow state index and\nreturns true if this is the control flow state at the head of the full observation.\\<close>\n\nabbreviation state_eq :: \"cfstate option \\<Rightarrow> whitebox_trace \\<Rightarrow> bool\" where\n  \"state_eq v s \\<equiv> statename (shd s) = v\"\n\nlemma state_eq_holds: \"state_eq s = holds (\\<lambda>x. statename x = s)\"\n  apply (rule ext)\n  by (simp add: holds_def)\n\nlemma state_eq_None_not_Some: \"state_eq None s \\<Longrightarrow> \\<not> state_eq (Some n) s\"\n  by simp\n\nsubsubsection\\<open>Label Equality\\<close>\ntext\\<open>The \\textsc{label\\_eq} function takes a string and returns true if this is equal to the label\nat the head of the full observation.\\<close>\n\nabbreviation \"label_eq v s \\<equiv> fst (action (shd s)) = (String.implode v)\"\n\nlemma watch_label: \"label_eq l (watch e t) = (fst (shd t) = String.implode l)\"\n  by (simp add: )\n\nsubsubsection\\<open>Input Equality\\<close>\ntext\\<open>The \\textsc{input\\_eq} function takes a value list and returns true if this is equal to the\ninput at the head of the full observation.\\<close>\n\nabbreviation \"input_eq v s \\<equiv> inputs (shd s) = v\"\n\nsubsubsection\\<open>Action Equality\\<close>\ntext\\<open>The \\textsc{action\\_eq} function takes a (label, value list) pair and returns true if this is\nequal to the action at the head of the full observation. This effectively combines\n\\texttt{label\\_eq} and \\texttt{input\\_eq} into one function.\\<close>\n\nabbreviation \"action_eq e \\<equiv> label_eq (fst e) aand input_eq (snd e)\"\n\nsubsubsection\\<open>Output Equality\\<close>\ntext\\<open>The \\textsc{output\\_eq} function takes a takes a value option list and returns true if this is\nequal to the output at the head of the full observation.\\<close>\n\nabbreviation \"output_eq v s \\<equiv> output (shd s) = v\"\n\ntext_raw\\<open>\\snip{ltlVName}{1}{2}{%\\<close>\ndatatype ltl_vname = Ip nat | Op nat | Rg nat\ntext_raw\\<open>}%endsnip\\<close>\n\nsubsubsection\\<open>Checking Arbitrary Expressions\\<close>\ntext\\<open>The \\textsc{check\\_exp} function takes a guard expression and returns true if the guard\nexpression evaluates to true in the given state.\\<close>\n\ntype_synonym ltl_gexp = \"ltl_vname gexp\"\n\ndefinition join_iro :: \"value list \\<Rightarrow> registers \\<Rightarrow> outputs \\<Rightarrow> ltl_vname datastate\" where\n  \"join_iro i r p = (\\<lambda>x. case x of\n    Rg n \\<Rightarrow> r $ n |\n    Ip n \\<Rightarrow> Some (i ! n) |\n    Op n \\<Rightarrow> p ! n\n  )\"\n\nlemma join_iro_R [simp]: \"join_iro i r p (Rg n) = r $ n\"\n  by (simp add: join_iro_def)\n\nabbreviation \"check_exp g s \\<equiv> (gval g (join_iro (snd (action (shd s))) (datastate (shd s)) (output (shd s))) = trilean.true)\"\n\nlemma alw_ev: \"alw f = not (ev (\\<lambda>s. \\<not>f s))\"\n  by simp\n\nlemma alw_state_eq_smap:\n  \"alw (state_eq s) ss = alw (\\<lambda>ss. shd ss = s) (smap statename ss)\"\n  apply standard\n   apply (simp add: alw_iff_sdrop )\n  by (simp add: alw_mono alw_smap )\n\nsubsection\\<open>Sink State\\<close>\ntext\\<open>Once the sink state is entered, it cannot be left and there are no outputs or updates\nhenceforth.\\<close>\n\nlemma shd_state_is_none: \"(state_eq None) (make_full_observation e None r p t)\"\n  by (simp add: )\n\nlemma unfold_observe_none: \"make_full_observation e None d p t = (\\<lparr>statename = None, datastate = d, action=(shd t), output = p\\<rparr>##(make_full_observation e None d [] (stl t)))\"\n  by (simp add: stream.expand)\n\nlemma once_none_always_none_aux:\n  assumes \"\\<exists> p r i. j = (make_full_observation e None r p) i\"\n  shows \"alw (state_eq None) j\"\n  using assms apply coinduct\n  apply simp\n  by fastforce\n\nlemma once_none_always_none: \"alw (state_eq None) (make_full_observation e None r p t)\"\n  using once_none_always_none_aux by blast\n\nlemma once_none_nxt_always_none: \"alw (nxt (state_eq None)) (make_full_observation e None r p t)\"\n  using once_none_always_none\n  by (simp add: alw_iff_sdrop del: sdrop.simps)\n\nlemma snth_sconst: \"(\\<forall>i. s !! i = h) = (s = sconst h)\"\n  by (auto simp add: sconst_alt sset_range)\n\nlemma alw_sconst: \"(alw (\\<lambda>xs. shd xs = h) t) = (t = sconst h)\"\n  by (simp add: snth_sconst[symmetric] alw_iff_sdrop)\n\nlemma smap_statename_None: \"smap statename (make_full_observation e None r p i) = sconst None\"\n  by (meson EFSM_LTL.alw_sconst alw_state_eq_smap once_none_always_none)\n\nlemma alw_not_some: \"alw (\\<lambda>xs. statename (shd xs) \\<noteq> Some s) (make_full_observation e None r p t)\"\n  by (metis (mono_tags, lifting) alw_mono once_none_always_none option.distinct(1) )\n\nlemma state_none: \"((state_eq None) impl nxt (state_eq None)) (make_full_observation e s r p t)\"\n  by (simp add: )\n\nlemma state_none_2:\n  \"(state_eq None) (make_full_observation e s r p t) \\<Longrightarrow>\n   (state_eq None) (make_full_observation e s r p (stl t))\"\n  by (simp add: )\n\nlemma no_output_none_aux:\n  assumes \"\\<exists> p r i. j = (make_full_observation e None r []) i\"\n  shows \"alw (output_eq []) j\"\n  using assms apply coinduct\n  apply simp\n  by fastforce\n\nlemma no_output_none: \"nxt (alw (output_eq [])) (make_full_observation e None r p t)\"\n  using no_output_none_aux by auto\n\nlemma nxt_alw: \"nxt (alw P) s \\<Longrightarrow> alw (nxt P) s\"\n  by (simp add: alw_iff_sdrop)\n\nlemma no_output_none_nxt: \"alw (nxt (output_eq [])) (make_full_observation e None r p t)\"\n  using nxt_alw no_output_none by blast\n\nlemma no_output_none_if_empty: \"alw (output_eq []) (make_full_observation e None r [] t)\"\n  by (metis (mono_tags, lifting) alw_nxt make_full_observation.simps(1) no_output_none state.select_convs(4))\n\nlemma no_updates_none_aux:\n  assumes \"\\<exists> p i. j = (make_full_observation e None r p) i\"\n  shows \"alw (\\<lambda>x. datastate (shd x) = r) j\"\n  using assms apply coinduct\n  by fastforce\n\nlemma no_updates_none: \"alw (\\<lambda>x. datastate (shd x) = r) (make_full_observation e None r p t)\"\n  using no_updates_none_aux by blast\n\nlemma action_components: \"(label_eq l aand input_eq i) s = (action (shd s) = (String.implode l, i))\"\n  by (metis fst_conv prod.collapse snd_conv)\n\nend\n", "meta": {"author": "logicalhacking", "repo": "Extended_Finite_State_Machines", "sha": "3a7a6daf2cfc4f155a2ce259c255cf8f322f6268", "save_path": "github-repos/isabelle/logicalhacking-Extended_Finite_State_Machines", "path": "github-repos/isabelle/logicalhacking-Extended_Finite_State_Machines/Extended_Finite_State_Machines-3a7a6daf2cfc4f155a2ce259c255cf8f322f6268/Extended_Finite_State_Machines/EFSM_LTL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.3219494999607148}}
{"text": "(*  Title:      JinjaThreads/MM/JMM_Type.thy\n    Author:     Andreas Lochbihler\n*)\n\nheader {* \\isaheader{JMM heap implementation 1} *}\n\ntheory JMM_Type\nimports \n  \"../Common/ExternalCallWF\"\n  \"../Common/ConformThreaded\"\n  JMM_Heap\nbegin\n\nsection {* Definitions *}\n\ntext {*\n  The JMM heap only stores type information.\n*}\n\ntype_synonym 'addr JMM_heap = \"'addr \\<rightharpoonup> htype\"\n\ntranslations (type) \"'addr JMM_heap\" <= (type) \"'addr \\<Rightarrow> htype option\"\n\nabbreviation jmm_empty :: \"'addr JMM_heap\" where \"jmm_empty == Map.empty\"\n\ndefinition jmm_allocate :: \"'addr JMM_heap \\<Rightarrow> htype \\<Rightarrow> ('addr JMM_heap \\<times> 'addr) set\"\nwhere \"jmm_allocate h hT = (\\<lambda>a. (h(a \\<mapsto> hT), a)) ` {a. h a = None}\"\n\ndefinition jmm_typeof_addr :: \"'addr JMM_heap \\<Rightarrow> 'addr \\<rightharpoonup> htype\"\nwhere \"jmm_typeof_addr h = h\"\n\ndefinition jmm_heap_read :: \"'addr JMM_heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> bool\"\nwhere \"jmm_heap_read h a ad v = True\"\n\ninductive jmm_heap_write :: \"'addr JMM_heap \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr val \\<Rightarrow> 'addr JMM_heap \\<Rightarrow> bool\"\nwhere \"jmm_heap_write h a ad v h\"\n\ndefinition jmm_hconf :: \"'m prog \\<Rightarrow> 'addr JMM_heap \\<Rightarrow> bool\" (\"_ \\<turnstile>jmm _ \\<surd>\" [51,51] 50)\nwhere \"P \\<turnstile>jmm h \\<surd> \\<longleftrightarrow> ty_of_htype ` ran h \\<subseteq> {T. is_type P T}\"\n\ndefinition jmm_allocated :: \"'addr JMM_heap \\<Rightarrow> 'addr set\"\nwhere \"jmm_allocated h = dom (jmm_typeof_addr h)\"\n\ndefinition jmm_spurious_wakeups :: bool\nwhere \"jmm_spurious_wakeups = True\"\n\nlemmas jmm_heap_ops_defs =\n  jmm_allocate_def jmm_typeof_addr_def \n  jmm_heap_read_def jmm_heap_write_def\n  jmm_allocated_def jmm_spurious_wakeups_def\n\ntype_synonym 'addr thread_id = \"'addr\"\n\nabbreviation (input) addr2thread_id :: \"'addr \\<Rightarrow> 'addr thread_id\"\nwhere \"addr2thread_id \\<equiv> \\<lambda>x. x\"\n\nabbreviation (input) thread_id2addr :: \"'addr thread_id \\<Rightarrow> 'addr\"\nwhere \"thread_id2addr \\<equiv> \\<lambda>x. x\"\n\ninterpretation jmm!: heap_base\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write \n.\n\nnotation jmm.hext  (\"_ \\<unlhd>jmm _\" [51,51] 50)\nnotation jmm.conf (\"_,_ \\<turnstile>jmm _ :\\<le> _\"  [51,51,51,51] 50)\nnotation jmm.addr_loc_type (\"_,_ \\<turnstile>jmm _@_ : _\" [50, 50, 50, 50, 50] 51)\nnotation jmm.confs (\"_,_ \\<turnstile>jmm _ [:\\<le>] _\"  [51,51,51,51] 50)\nnotation jmm.tconf (\"_,_ \\<turnstile>jmm _ \\<surd>t\" [51,51,51] 50)\n\ntext {* Now a variation of the JMM with a different read operation that permits to read only type-conformant values *}\n\ninterpretation jmm'!: heap_base\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write\n  for P .\n\nnotation jmm'.hext (\"_ \\<unlhd>jmm' _\" [51,51] 50)\nnotation jmm'.conf (\"_,_ \\<turnstile>jmm' _ :\\<le> _\"  [51,51,51,51] 50)\nnotation jmm'.addr_loc_type (\"_,_ \\<turnstile>jmm' _@_ : _\" [50, 50, 50, 50, 50] 51)\nnotation jmm'.confs (\"_,_ \\<turnstile>jmm' _ [:\\<le>] _\"  [51,51,51,51] 50)\nnotation jmm'.tconf (\"_,_ \\<turnstile>jmm' _ \\<surd>t\" [51,51,51] 50)\n\nsection {* Heap locale interpretations *}\n\nsubsection {* Locale @{text heap} *}\n\nlemma jmm_heap: \"heap addr2thread_id thread_id2addr jmm_allocate jmm_typeof_addr jmm_heap_write P\"\nproof\n  fix h' a h hT\n  assume \"(h', a) \\<in> jmm_allocate h hT\"\n  thus \"jmm_typeof_addr h' a = \\<lfloor>hT\\<rfloor>\"\n    by(auto simp add: jmm_heap_ops_defs)\nnext\n  fix h' :: \"('addr :: addr) JMM_heap\" and h hT a\n  assume \"(h', a) \\<in> jmm_allocate h hT\"\n  thus \"h \\<unlhd>jmm h'\"\n    by(fastforce simp add: jmm_heap_ops_defs intro: jmm.hextI)\nnext\n  fix h a al v and h' :: \"('addr :: addr) JMM_heap\"\n  assume \"jmm_heap_write h a al v h'\"\n  thus \"h \\<unlhd>jmm h'\" by cases auto\nqed simp\n\ninterpretation jmm!: heap\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write\n  P\n  for P\nby(rule jmm_heap)\n\ndeclare jmm.typeof_addr_thread_id2_addr_addr2thread_id [simp del]\n\nlemmas jmm'_heap = jmm_heap\n\ninterpretation jmm'!: heap\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write\n  P\n  for P\nby(rule jmm'_heap)\n\ndeclare jmm'.typeof_addr_thread_id2_addr_addr2thread_id [simp del]\n\nsubsection {* Locale @{text \"heap_conf\"} *}\n\ninterpretation jmm!: heap_conf_base\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write \"jmm_hconf P\"\n  P\n  for P .\n\nabbreviation (input) jmm'_hconf :: \"'m prog \\<Rightarrow> 'addr JMM_heap \\<Rightarrow> bool\" (\"_ \\<turnstile>jmm' _ \\<surd>\" [51,51] 50)\nwhere \"jmm'_hconf == jmm_hconf\"\n\ninterpretation jmm'!: heap_conf_base\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write \"jmm'_hconf P\"\n  P\n  for P .\n\nabbreviation jmm_heap_read_typeable :: \"('addr :: addr) itself \\<Rightarrow> 'm prog \\<Rightarrow> bool\"\nwhere \"jmm_heap_read_typeable tytok P \\<equiv> jmm.heap_read_typeable (jmm_hconf P :: 'addr JMM_heap \\<Rightarrow> bool) P\"\n\nabbreviation jmm'_heap_read_typeable :: \"('addr :: addr) itself \\<Rightarrow> 'm prog \\<Rightarrow> bool\"\nwhere \"jmm'_heap_read_typeable tytok P \\<equiv> jmm'.heap_read_typeable TYPE('m) P (jmm_hconf P :: 'addr JMM_heap \\<Rightarrow> bool) P\"\n\nlemma jmm_heap_read_typeable: \"jmm_heap_read_typeable tytok P\"\nby(rule jmm.heap_read_typeableI)(simp add: jmm_heap_read_def)\n\nlemma jmm'_heap_read_typeable: \"jmm'_heap_read_typeable tytok P\"\nby(rule jmm'.heap_read_typeableI)(auto simp add: jmm.heap_read_typed_def jmm_heap_read_def dest: jmm'.addr_loc_type_fun)\n\nlemma jmm_heap_conf:\n  \"heap_conf addr2thread_id thread_id2addr jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_write (jmm_hconf P) P\"\nproof\n  show \"P \\<turnstile>jmm jmm_empty \\<surd>\"\n    by(simp add: jmm_hconf_def)\nnext\n  fix h a hT\n  assume \"jmm_typeof_addr h a = \\<lfloor>hT\\<rfloor>\" \"P \\<turnstile>jmm h \\<surd>\"\n  thus \"is_htype P hT\" by(auto simp add: jmm_hconf_def jmm_heap_ops_defs intro: ranI)\nnext\n  fix h' h hT a\n  assume \"(h', a) \\<in> jmm_allocate h hT\" \"P \\<turnstile>jmm h \\<surd>\" \"is_htype P hT\"\n  thus \"P \\<turnstile>jmm h' \\<surd>\"\n    by(fastforce simp add: jmm_hconf_def jmm_heap_ops_defs ran_def split: split_if_asm)\nnext\n  fix h a al v h' T\n  assume \"jmm_heap_write h a al v h'\" \"P \\<turnstile>jmm h \\<surd>\"\n    and \"jmm.addr_loc_type P h a al T\" and \"P,h \\<turnstile>jmm v :\\<le> T\"\n  thus \"P \\<turnstile>jmm h' \\<surd>\" by(cases) simp\nqed\n\ninterpretation jmm!: heap_conf\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write \"jmm_hconf P\"\n  P\n  for P\nby(rule jmm_heap_conf)\n\nlemmas jmm'_heap_conf = jmm_heap_conf\n\ninterpretation jmm'!: heap_conf\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write \"jmm'_hconf P\"\n  P\n  for P\nby(rule jmm'_heap_conf)\n\nsubsection {* Locale @{text heap_progress} *}\n\nlemma jmm_heap_progress:\n  \"heap_progress addr2thread_id thread_id2addr jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write (jmm_hconf P) P\"\nproof\n  fix h a al T\n  assume \"P \\<turnstile>jmm h \\<surd>\"\n    and al: \"jmm.addr_loc_type P h a al T\"\n  show \"\\<exists>v. jmm_heap_read h a al v \\<and> P,h \\<turnstile>jmm v :\\<le> T\"\n    using jmm.defval_conf[of P h T] unfolding jmm_heap_ops_defs by blast\nnext\n  fix h a al T v\n  assume \"jmm.addr_loc_type P h a al T\"\n  show \"\\<exists>h'. jmm_heap_write h a al v h'\"\n    by(auto intro: jmm_heap_write.intros)\nqed\n\ninterpretation jmm!: heap_progress\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write \"jmm_hconf P\"\n  P\n  for P\nby(rule jmm_heap_progress)\n\nlemma jmm'_heap_progress:\n  \"heap_progress addr2thread_id thread_id2addr jmm_empty jmm_allocate jmm_typeof_addr (jmm.heap_read_typed P) jmm_heap_write (jmm'_hconf P) P\"\nproof\n  fix h a al T\n  assume \"P \\<turnstile>jmm' h \\<surd>\"\n    and al: \"jmm'.addr_loc_type P h a al T\"\n  thus \"\\<exists>v. jmm.heap_read_typed P h a al v \\<and> P,h \\<turnstile>jmm' v :\\<le> T\"\n    unfolding jmm.heap_read_typed_def jmm_heap_read_def\n    by(auto dest: jmm'.addr_loc_type_fun intro: jmm'.defval_conf)\nnext\n  fix h a al T v\n  assume \"jmm'.addr_loc_type P h a al T\"\n    and \"P,h \\<turnstile>jmm' v :\\<le> T\"\n  thus \"\\<exists>h'. jmm_heap_write h a al v h'\"\n    by(auto intro: jmm_heap_write.intros)\nqed\n\ninterpretation jmm'!: heap_progress\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write \"jmm'_hconf P\"\n  P\n  for P\nby(rule jmm'_heap_progress)\n\nsubsection {* Locale @{text heap_conf_read} *}\n\nlemma jmm'_heap_conf_read:\n  \"heap_conf_read addr2thread_id thread_id2addr jmm_empty jmm_allocate jmm_typeof_addr (jmm.heap_read_typed P) jmm_heap_write (jmm'_hconf P) P\"\nby(rule jmm.heap_conf_read_heap_read_typed)\n\ninterpretation jmm'!: heap_conf_read\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write \"jmm'_hconf P\"\n  P\n  for P\nby(rule jmm'_heap_conf_read)\n\ninterpretation jmm'!: heap_typesafe\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write \"jmm'_hconf P\"\n  P\n  for P\n..\n\nsubsection {* Locale @{text allocated_heap} *}\n\nlemma jmm_allocated_heap: \n  \"allocated_heap addr2thread_id thread_id2addr jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_write jmm_allocated P\"\nproof\n  show \"jmm_allocated jmm_empty = {}\" by(auto simp add: jmm_heap_ops_defs)\nnext\n  fix h' a h hT\n  assume \"(h', a) \\<in> jmm_allocate h hT\"\n  thus \"jmm_allocated h' = insert a (jmm_allocated h) \\<and> a \\<notin> jmm_allocated h\"\n    by(auto simp add: jmm_heap_ops_defs split: split_if_asm)\nnext\n  fix h a al v h'\n  assume \"jmm_heap_write h a al v h'\"\n  thus \"jmm_allocated h' = jmm_allocated h\" by cases simp\nqed\n\ninterpretation jmm!: allocated_heap\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr jmm_heap_read jmm_heap_write\n  jmm_allocated\n  P\n  for P\nby(rule jmm_allocated_heap)\n\nlemmas jmm'_allocated_heap = jmm_allocated_heap\n\ninterpretation jmm'!: allocated_heap\n  addr2thread_id thread_id2addr\n  jmm_spurious_wakeups\n  jmm_empty jmm_allocate jmm_typeof_addr \"jmm.heap_read_typed P\" jmm_heap_write\n  jmm_allocated\n  P\n  for P\nby(rule jmm'_allocated_heap)\n\nsubsection {* Syntax translations *}\n\nnotation jmm'.external_WT' (\"_,_ \\<turnstile>jmm' (_\\<bullet>_'(_')) : _\" [50,0,0,0,50] 60)\n\nabbreviation jmm'_red_external :: \n  \"'m prog \\<Rightarrow> 'addr thread_id \\<Rightarrow> 'addr JMM_heap \\<Rightarrow> 'addr \\<Rightarrow> mname \\<Rightarrow> 'addr val list\n  \\<Rightarrow> ('addr :: addr, 'addr thread_id, 'addr JMM_heap) external_thread_action \n  \\<Rightarrow> 'addr extCallRet \\<Rightarrow> 'addr JMM_heap \\<Rightarrow> bool\"\nwhere \"jmm'_red_external P \\<equiv> jmm'.red_external (TYPE('m)) P P\"\n\nabbreviation jmm'_red_external_syntax :: \n  \"'m prog \\<Rightarrow> 'addr thread_id \\<Rightarrow> 'addr \\<Rightarrow> mname \\<Rightarrow> 'addr val list \\<Rightarrow> 'addr JMM_heap\n  \\<Rightarrow> ('addr :: addr, 'addr thread_id, 'addr JMM_heap) external_thread_action \n  \\<Rightarrow> 'addr extCallRet \\<Rightarrow> 'addr JMM_heap \\<Rightarrow> bool\"\n  (\"_,_ \\<turnstile>jmm' (\\<langle>(_\\<bullet>_'(_')),/_\\<rangle>) -_\\<rightarrow>ext (\\<langle>(_),/(_)\\<rangle>)\" [50, 0, 0, 0, 0, 0, 0, 0, 0] 51)\nwhere\n  \"P,t \\<turnstile>jmm' \\<langle>a\\<bullet>M(vs), h\\<rangle> -ta\\<rightarrow>ext \\<langle>va, h'\\<rangle> \\<equiv> jmm'_red_external P t h a M vs ta va h'\"\n\nabbreviation jmm'_red_external_aggr :: \n  \"'m prog \\<Rightarrow> 'addr thread_id \\<Rightarrow> 'addr \\<Rightarrow> mname \\<Rightarrow> 'addr val list \\<Rightarrow> 'addr JMM_heap \n    \\<Rightarrow> (('addr :: addr, 'addr thread_id, 'addr JMM_heap) external_thread_action \\<times> 'addr extCallRet \\<times> 'addr JMM_heap) set\"\nwhere \"jmm'_red_external_aggr P \\<equiv> jmm'.red_external_aggr TYPE('m) P P\"\n\nabbreviation jmm'_heap_copy_loc :: \n  \"'m prog \\<Rightarrow> 'addr \\<Rightarrow> 'addr \\<Rightarrow> addr_loc \\<Rightarrow> 'addr JMM_heap\n  \\<Rightarrow> ('addr :: addr, 'addr thread_id) obs_event list \\<Rightarrow> 'addr JMM_heap \\<Rightarrow> bool\"\nwhere \"jmm'_heap_copy_loc \\<equiv> jmm'.heap_copy_loc TYPE('m)\"\n\nabbreviation jmm'_heap_copies :: \n  \"'m prog \\<Rightarrow> 'addr \\<Rightarrow> 'addr \\<Rightarrow> addr_loc list \\<Rightarrow> 'addr JMM_heap\n  \\<Rightarrow> ('addr :: addr, 'addr thread_id) obs_event list \\<Rightarrow> 'addr JMM_heap \\<Rightarrow> bool\"\nwhere \"jmm'_heap_copies \\<equiv> jmm'.heap_copies TYPE('m)\"\n\nabbreviation jmm'_heap_clone ::\n  \"'m prog \\<Rightarrow> 'addr JMM_heap \\<Rightarrow> 'addr \\<Rightarrow> 'addr JMM_heap\n  \\<Rightarrow> (('addr :: addr, 'addr thread_id) obs_event list \\<times> 'addr) option \\<Rightarrow> bool\"\nwhere \"jmm'_heap_clone P \\<equiv> jmm'.heap_clone TYPE('m) P P\"\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/MM/JMM_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.32165324685182645}}
{"text": "theory ResMapValid\n  imports GenSubEnv NormEnv ResMapDisj\nbegin\n \ndefinition super_drop_use_env where\n  \"super_drop_use_env r_s = (\\<lambda> x. if r_s x = OwnPerm then NoPerm else r_s x)\"  \n  \nlemma self_sdrop_leq_use_env: \"leq_use_env (super_drop_use_env r_s) r_s\"  \n  apply (simp add: super_drop_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n    \nlemma sdrop_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (super_drop_use_env r_x) r_s\"    \n  apply (rule_tac r_sb=\"r_x\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac self_sdrop_leq_use_env)\n  done\n    \nlemma diff_sdrop_leq_use_env: \"leq_use_env (diff_use_env r_s r_s) (super_drop_use_env r_s)\"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: super_drop_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n  \n\n  \n  (* basically, we want a static way of describing a recursive structure that will be maintained inductively and wont have any unpleasant\n      properties (cyclic dependencies, etc). *)\n    \n    \n  (*\ndefinition valid_use_env where\n  \"valid_use_env s rs_map r_s r_x = (sub_use_env s r_c \\<and> leq_use_env r_s r_c \\<and> (\\<forall> x. r_s x \\<noteq> NoPerm \\<longrightarrow>\n    leq_use_env (lookup_res rs_map x) r_s \\<and> disj_use_env (lookup_res rs_map x) r_x\n  ))\"*)\n  \ndefinition valid_use_entry where\n  \"valid_use_entry r_c r_s r_x = (leq_use_env r_x r_c \\<and> strong_disj_use_env r_x r_s)\"\n\ndefinition valid_use_env where\n  \"valid_use_env s rs_map r_c r_s = (sub_use_env s r_c \\<and> leq_use_env r_s r_c \\<and>\n    (\\<forall> x. r_c x \\<noteq> NoPerm \\<longrightarrow> valid_use_entry r_c r_s (lookup_res rs_map x)))\"\n  \n\n\n    (* - valid res map lemmas *)  \n    (*\nlemma add_valid_res_map_rev: \"\\<lbrakk> valid_res_map s (add_mem rs_map x v); fresh_var s x \\<rbrakk> \\<Longrightarrow> valid_res_map s rs_map\"\n  apply (simp add: valid_res_map_def)\n  apply (auto)\n    apply (simp add: disj_res_map_def)\n    apply (auto)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (erule_tac x=\"y\" in allE)\n    apply (auto)\n    apply (case_tac \"x = xa\")\n     apply (auto)\n     apply (case_tac \"x = y\")\n      apply (auto)\n     apply (simp add: add_mem_def)\n    apply (simp add: lookup_res_def)\n    apply (simp add: add_mem_def)\n    apply (case_tac \"x = xa\")\n     apply (auto)\n     apply (case_tac \"x = y\")\n    apply (auto)\n  \n  apply (induct rs_map arbitrary: x v)\n   apply (simp add: valid_res_map_def)\n   apply (auto)\n    apply (simp add: disj_res_map_def)\n    apply (simp add: lookup_res_def)\n    apply (auto)\n    apply (rule_tac empty_strong_disj_use_env1)\n   apply (simp add: sub_res_map_def)\n  apply (simp add: add_mem_def)\n  apply (simp add: valid_res_map_def)\n  apply (auto)\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x1\" and r_s=\"x2\" in disj_add_res_map)\n    \n  done*)\n    (*\nlemma add_valid_res_map: \"\\<lbrakk> valid_res_map s rs_map \\<rbrakk> \\<Longrightarrow> valid_res_map (add_mem s x v) rs_map\"    \n  apply (simp add: valid_res_map_def)\n  apply (auto)\n   apply (simp add: sub_res_map_def)\n   apply (simp add: add_mem_def)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (rule_tac add_sub_use_env)\n  apply (auto)\n  done\n \nlemma add_set_valid_res_map: \"\\<lbrakk> valid_res_map s rs_map; sep_res_map r_s rs_map; sub_use_env s r_s \\<rbrakk> \\<Longrightarrow> valid_res_map (add_mem s x v) (set_res_map rs_map x r_s)\"    \n  apply (simp add: valid_res_map_def)\n  apply (auto)\n     apply (simp add: set_res_map_def)\n     apply (simp add: disj_res_map_def)\n     apply (auto)\n     apply (simp add: sep_res_map_def)\n    apply (simp add: sep_res_map_def)\n    apply (rule_tac comm_strong_disj_use_env)\n    apply (simp)\n   apply (simp add: sub_res_map_def)\n   apply (simp add: add_mem_def)\n   apply (auto)\n   apply (simp add: set_res_map_def)\n  apply (simp add: sub_res_map_def)\n  apply (simp add: set_res_map_def)\n  apply (auto)\n   apply (rule_tac add_sub_use_env)\n   apply (simp)\n  apply (rule_tac add_sub_use_env)\n  apply (simp)\n  done    *)\n(*\nlemma add_rem_valid_res_map: \"\\<lbrakk> valid_res_map (add_mem s x v) rs_map \\<rbrakk> \\<Longrightarrow> valid_res_map s (rem_res_map rs_map x)\"        \n  apply (simp add: valid_res_map_def)\n  apply (auto)\n    apply (rule_tac disj_rem_res_map)\n    apply (simp)\n   apply (rule_tac add_rem_sub_res_map)\n   apply (simp)\n  apply (simp add: rem_res_map_def)\n  apply (simp add: set_res_map_def)\n  apply (auto)\n   apply (rule_tac empty_sub_use_env)\n  *)\n(*\nlemma valid_lookup_res_map: \"\\<lbrakk> valid_res_map s rs_map; lookup_mem rs_map x = Some (r_s, rs_map') \\<rbrakk> \\<Longrightarrow> scope_use_env rs_map' r_s\"  \n  apply (induct rs_map)\n   apply (auto)\n  apply (simp add: valid_res_map_def)    *)\n    \n    (* valid use env lemmas *)\n    \nlemma contain_valid_use_env: \"\\<lbrakk> contain_env s' s; valid_use_env s rs_map r_c r_s \\<rbrakk> \\<Longrightarrow> valid_use_env s' rs_map r_c r_s\"    \n  apply (simp add: valid_use_env_def)\n  apply (simp add: sub_use_env_def)\n  apply (simp add: contain_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"s x\")\n   apply (auto)\n  done\n    \n    (* ######### NRES map validity *)\n  \ndefinition valid_nres_map where\n  \"valid_nres_map s s_map = (full_nres_map s s_map \\<and> disj_nres_map s_map \\<and> sub_nres_map s s_map)\"\n    \ndefinition valid_exp_use_env where\n  \"valid_exp_use_env s s_map r_s = (sub_use_env s r_s \\<and> sep_nres_map r_s s_map)\"\n  \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/ResMapValid.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494678483918, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.321566680866586}}
{"text": "theory LLVM_Memory_RS\nimports \n  \"../basic/LLVM_Basic_Main\"\n  Sep_Value_RS \n  Sep_Array_Block_RS\nbegin\n  \n  interpretation ab: array_block2 \"STATIC_ERROR ''''\" MEM_ERROR \"vload MEM_ERROR::_ \\<Rightarrow> (llvm_primval val,_,_,_,_) M\" \"vstore MEM_ERROR\" \"checked_gep MEM_ERROR\" val_\\<alpha> vpto_assn \"\\<lambda>v. v\\<in>range val_\\<alpha>\"\n    apply unfold_locales\n    apply (rule vload_rule)\n    apply (rule vstore_rule)\n    apply (rule vpto_assn_notZ)\n    apply auto []\n    apply (simp; rule vpto_assn_this)\n    apply auto []\n    done\n  \n  \n  datatype llvm_amemory = LLVM_AMEMORY (the_amemory: \"(nat \\<Rightarrow> (nat \\<Rightarrow> llvm_primval aval) \\<times> int tsa_opt)\")\n  \n  instantiation llvm_amemory :: unique_zero_sep_algebra begin\n    definition \"sep_disj_llvm_amemory a b \\<equiv> the_amemory a ## the_amemory b\"\n    definition \"plus_llvm_amemory a b \\<equiv> LLVM_AMEMORY (the_amemory a + the_amemory b)\"\n    definition \"zero_llvm_amemory \\<equiv> LLVM_AMEMORY 0\"\n  \n    instance\n      apply standard\n      unfolding sep_disj_llvm_amemory_def plus_llvm_amemory_def zero_llvm_amemory_def\n      apply (auto simp: sep_algebra_simps llvm_amemory.expand)\n      done\n      \n  end    \n  \n  type_synonym llvm_assn = \"llvm_amemory \\<Rightarrow> bool\"\n  \n  definition \"llvm_\\<alpha> \\<equiv> LLVM_AMEMORY o ab.ba.\\<alpha> o llvm_memory.the_memory\"\n  definition \"llvm_pto x p \\<equiv> (ab.ba.pto (llvm_val.the_val x) (llvm_ptr.the_ptr p)) o llvm_amemory.the_amemory\"\n  (*definition \"llvm_is_base_ptr p \\<equiv> ab.is_base_ptr (llvm_ptr.the_ptr p)\"*)\n  \n  definition \"llvm_malloc_tag n p \\<equiv> ab.ba.tag n (llvm_ptr.the_ptr p) o llvm_amemory.the_amemory\"\n  \n  instantiation llvm_ptr :: addr_algebra begin\n    definition \"abase_llvm_ptr = abase o llvm_ptr.the_ptr\"\n    definition \"acompat_llvm_ptr a b \\<equiv> acompat (llvm_ptr.the_ptr a) (llvm_ptr.the_ptr b)\"\n    definition \"adiff_llvm_ptr a b \\<equiv> adiff (llvm_ptr.the_ptr a) (llvm_ptr.the_ptr b)\"\n    definition \"aidx_llvm_ptr a i \\<equiv> LLVM_PTR ((llvm_ptr.the_ptr a) +\\<^sub>a i)\"\n    \n    instance\n      apply standard\n      unfolding abase_llvm_ptr_def acompat_llvm_ptr_def adiff_llvm_ptr_def aidx_llvm_ptr_def\n      apply (intro part_equivpI sympI transpI)\n      apply (metis ab.block_ptr_imp_abase ab.is_block_ptr_simps(2) acompat_refl llvm_ptr.sel)\n      apply (auto intro: acompat_trans simp: acompat_dom)\n      done\n  end\n  \n  \n  (*\n  definition \"llvm_idx_ptr p i \\<equiv> LLVM_PTR (ab.idx_ptr (llvm_ptr.the_ptr p) i)\"\n  definition \"llvm_is_arr_ptr p \\<equiv> ab.is_arr_ptr (llvm_ptr.the_ptr p)\"\n  \n  lemma llvm_idx_ptr_add[simp]: \"llvm_idx_ptr (llvm_idx_ptr p i) j = llvm_idx_ptr p (i+j)\"\n    by (cases p) (auto simp: llvm_idx_ptr_def)\n  \n  lemma llvm_is_arr_ptr_idx[simp]: \"llvm_is_arr_ptr (llvm_idx_ptr p i) \\<longleftrightarrow> llvm_is_arr_ptr p\"\n    by (cases p) (auto simp: llvm_idx_ptr_def llvm_is_arr_ptr_def)\n  *)  \n    \n  \n  lemma xfer_htriple: \n    assumes \"notime.htriple ab.ba.\\<alpha> P c Q\"\n    assumes \"P' = P o llvm_amemory.the_amemory\"\n    assumes \"c' = llvm_zoom_base \\<alpha> c\"\n    assumes \"\\<And>r. Q' (\\<alpha> r) = Q r o llvm_amemory.the_amemory\"\n    shows \"notime.htriple llvm_\\<alpha> P' c' Q'\"\n    using assms unfolding notime.htriple_alt llvm_zoom_base_def llvm_\\<alpha>_def wpn_def\n    apply (clarsimp simp: run_simps)\n  proof goal_cases\n    case A: (1 p s f)\n    \n    \n    \n    find_theorems llvm_memory.the_memory\\<^sub>L\n    \n    from \\<open>p##f\\<close> \\<open>LLVM_AMEMORY (ab.ba.\\<alpha> (get' llvm_memory.the_memory\\<^sub>L s)) = p + f\\<close>\n    have \"llvm_amemory.the_amemory p ## llvm_amemory.the_amemory f\"\n      and \"ab.ba.\\<alpha> (get' llvm_memory.the_memory\\<^sub>L s) = llvm_amemory.the_amemory p + llvm_amemory.the_amemory f\"\n      by (auto simp: sep_disj_llvm_amemory_def plus_llvm_amemory_def)\n    \n    from A(1)[rule_format] show ?case\n      apply (rule mwp_cons)\n      apply (intro conjI; fact)\n      apply (clarsimp_all simp: run_simps)\n      by (metis (full_types) assms(4) comp_apply llvm_amemory.sel plus_llvm_amemory_def sep_disj_llvm_amemory_def)\n    \n  qed  \n    \n    \n  \n  \n  lemma llvm_load_rule[vcg_rules]: \"notime.htriple llvm_\\<alpha> (llvm_pto x p) (llvm_load p) (\\<lambda>r. \\<up>(r=x) ** llvm_pto x p)\"\n    apply (rule xfer_htriple[OF ab.ba.load_rule])\n    unfolding llvm_pto_def llvm_load_def\n    apply simp\n    apply simp\n    apply (rule ext)\n    apply (auto simp: sep_algebra_simps pred_lift_extract_simps)\n    done\n\n  lemma llvm_store_unchecked_rule[vcg_rules]: \"notime.htriple llvm_\\<alpha> (llvm_pto xx p) (llvm_store_unchecked x p) (\\<lambda>_. llvm_pto x p)\"\n    apply (rule xfer_htriple[OF ab.ba.store_rule])\n    unfolding llvm_pto_def llvm_store_unchecked_def\n    apply simp\n    apply simp\n    apply (rule ext)\n    apply (auto simp: sep_algebra_simps pred_lift_extract_simps)\n    done\n\n    \n  lemma llvm_store_rule[vcg_rules]: \"llvm_vstruct x = llvm_vstruct xx \n    \\<Longrightarrow> notime.htriple llvm_\\<alpha> (llvm_pto xx p) (llvm_store x p) (\\<lambda>_. llvm_pto x p)\"\n    unfolding llvm_store_def\n    by vcg\n    \n    \n  lemma the_amemoryZ[simp]: \"the_amemory 0 = 0\" by (auto simp: zero_llvm_amemory_def)\n\n  lemma the_amemoryZ_iff[simp]: \"the_amemory x = 0 \\<longleftrightarrow> x=0\" \n    by (auto simp: zero_llvm_amemory_def llvm_amemory.expand)\n    \n    \n  lemma xfer_sep_conj1: \"((\\<lambda>x. a (the_amemory x)) ** (\\<lambda>x. b (the_amemory x))) = (a**b) o the_amemory\"  \n    apply (rule ext)\n    apply (auto 3 3 simp: sep_conj_def sep_disj_llvm_amemory_def plus_llvm_amemory_def)\n    by (metis (full_types) llvm_amemory.exhaust_sel llvm_amemory.sel)\n\n  lemma xfer_sep_conj2: \"((a o the_amemory) ** (b o the_amemory)) = (a**b) o the_amemory\"  \n    using xfer_sep_conj1 unfolding comp_def .\n\n  lemmas xfer_sep_conj = xfer_sep_conj1 xfer_sep_conj2\n            \n  lemma xfer_sep_list_conj1: \"(\\<And>*map (\\<lambda>x. f x o the_amemory) l) = (\\<And>*map f l) o the_amemory\"  \n    apply (induction l)\n    apply auto\n    by (auto simp: sep_algebra_simps xfer_sep_conj)\n\n  lemma xfer_sep_list_conj2: \"(\\<And>*map (\\<lambda>x s. f x (the_amemory s)) l) = (\\<And>*map f l) o the_amemory\"  \n    using xfer_sep_list_conj1 unfolding comp_def .\n      \n  lemmas xfer_sep_list_conj = xfer_sep_list_conj1 xfer_sep_list_conj2  \n\n  lemma xfer_sep_set_img1: \"(\\<Union>*x\\<in>I. f x o the_amemory) = (\\<Union>*x\\<in>I. f x) o the_amemory\"  \n  proof (cases \"finite I\")  \n    case True then show ?thesis\n      by (induction) (auto del: ext intro!: ext simp: sep_algebra_simps xfer_sep_conj)\n  qed auto   \n\n  lemma xfer_sep_set_img2: \"(\\<Union>*x\\<in>I. (\\<lambda>s. f x (the_amemory s))) = (\\<Union>*x\\<in>I. f x) o the_amemory\"  \n    using xfer_sep_set_img1 unfolding comp_def .\n      \n  lemmas xfer_sep_set_img = xfer_sep_set_img1 xfer_sep_set_img2  \n  \n      \n  lemma llvm_allocn_rule[vcg_rules]: \n    \"notime.htriple llvm_\\<alpha> \n      \\<box> \n      (llvm_allocn v n) \n      (\\<lambda>r. (\\<Union>*i\\<in>{0..<int n}. llvm_pto v (r +\\<^sub>a i)) \n        ** llvm_malloc_tag (int n) r ** \\<up>(abase r))\"  \n    apply (rule xfer_htriple[OF ab.ba_allocn_rule])\n    unfolding llvm_pto_def llvm_allocn_def llvm_malloc_tag_def abase_llvm_ptr_def aidx_llvm_ptr_def\n    apply (rule ext) apply (auto simp: sep_algebra_simps) []\n    apply simp\n    apply (rule ext)\n    apply (auto simp: sep_algebra_simps pred_lift_extract_simps xfer_sep_set_img xfer_sep_conj)\n    done\n            \n    \n    \n  lemma llvm_free_rule[vcg_rules]:\n    \"notime.htriple llvm_\\<alpha> \n      ((\\<Union>*i\\<in>{0..<n}. EXS v. llvm_pto v (p +\\<^sub>a i)) \n        ** llvm_malloc_tag n p)\n      (llvm_free p)\n      (\\<lambda>_. \\<box>)\"  \n    apply (rule xfer_htriple[OF ab.ba_freen_rule[where p=\"llvm_ptr.the_ptr p\" and n=n], where \\<alpha>=id])\n    apply (cases p; simp add: )\n    \n    unfolding llvm_pto_def llvm_free_def llvm_malloc_tag_def aidx_llvm_ptr_def\n    apply (auto simp: sep_algebra_simps)\n    apply (subst xfer_sep_set_img xfer_sep_conj)+\n    apply (cases p; simp)\n    by (metis llvm_val.sel)\n  \n  lemma llvm_checked_idx_ptr_rule[vcg_rules]:\n    \"abase p \\<Longrightarrow>\n      notime.htriple llvm_\\<alpha>\n        (llvm_pto v (p +\\<^sub>a i))\n        (llvm_checked_idx_ptr p i)\n        (\\<lambda>r. \\<up>(r= p +\\<^sub>a i) ** llvm_pto v (p +\\<^sub>a i))\n    \"\n    \n    supply R=xfer_htriple[OF ab.checked_idx_ptr_rule[where p=\"llvm_ptr.the_ptr p\" and i=i and xx=\"llvm_val.the_val v\"], where \\<alpha>=LLVM_PTR]\n    apply (rule R)\n    unfolding llvm_checked_idx_ptr_def llvm_pto_def abase_llvm_ptr_def aidx_llvm_ptr_def\n    apply (auto simp: xfer_sep_conj sep_algebra_simps pred_lift_extract_simps)\n    done\n    \n  \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm_time", "sha": "42dd7f59998d76047bb4b6bce76d8f67b53a08b6", "save_path": "github-repos/isabelle/lammich-isabelle_llvm_time", "path": "github-repos/isabelle/lammich-isabelle_llvm_time/isabelle_llvm_time-42dd7f59998d76047bb4b6bce76d8f67b53a08b6/thys/vcg/LLVM_Memory_RS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7154239957834733, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.3215062742244401}}
{"text": "(* \n    This file is a part of IsarMathLib - \n    a library of formalized mathematics written for Isabelle/Isar.\n\n    Copyright (C) 2023  Daniel de la Concepcion\n\n    This program is free software; Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,\nINCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\nPARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,\nINDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE, DATA, OR PROFITS OR\nBUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\nSTRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE\nUSE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\nsection \\<open>Rings - Zariski Topology - maps\\<close>\n\ntheory Ring_Zariski_ZF_3 imports Ring_Zariski_ZF Ring_ZF_3 Topology_ZF_2\n\nbegin\n\nlemma (in ring_homo) spectrum_surj:\n  defines \"g \\<equiv> \\<lambda>u\\<in>target_ring.Spec. f-``u\"\n  assumes \"f\\<in>surj(R,S)\"\n  shows \"g: target_ring.Spec \\<rightarrow> V(ker)\"\nproof-\n  have \"g: target_ring.Spec \\<rightarrow> {f-``u. u\\<in>target_ring.Spec}\" using lam_funtype\n    unfolding g_def by auto moreover\n  {\n    fix t assume \"t\\<in>{f-``u. u\\<in>target_ring.Spec}\"\n    then obtain u where u:\"u:target_ring.Spec\" \"t=f-``u\" by auto\n    from u(1) have u2:\"u\\<triangleleft>\\<^sub>pR\\<^sub>t\" unfolding target_ring.Spec_def by auto\n    then have \"(f-``u)\\<triangleleft>\\<^sub>pR\\<^sub>o\" using preimage_prime_ideal_surj\n      assms(2) by auto moreover\n    then have \"f-``u \\<in> origin_ring.ideals\"\n      unfolding origin_ring.primeIdeal_def\n      using origin_ring.ideal_dest_subset by auto\n    ultimately have \"f-``u \\<in> origin_ring.Spec\" unfolding origin_ring.Spec_def\n      by auto\n    moreover from u2 have \"\\<zero>\\<^sub>S \\<in> u\" unfolding\n      target_ring.primeIdeal_def using target_ring.ideal_dest_zero\n      by auto\n    then have \"{\\<zero>\\<^sub>S} \\<subseteq> u\" by auto\n    then have \"f-``{\\<zero>\\<^sub>S} \\<subseteq> f-``u\" by auto\n    moreover have \"f-``u \\<subseteq> R\" using func1_1_L15[OF\n      surj_is_fun[OF assms(2)]] by auto\n    ultimately have \"f-``u \\<in> origin_ring.closeBasic(f-``{\\<zero>\\<^sub>S})\"\n      using origin_ring.closeBasic_def[of \"f-``{\\<zero>\\<^sub>S}\"]\n      by force\n    with u(2) have \"t\\<in>origin_ring.closeBasic(f-``{\\<zero>\\<^sub>S})\" by auto\n  }\n  then have \"{f-``u. u\\<in>target_ring.Spec} \\<subseteq> origin_ring.closeBasic(f-``{\\<zero>\\<^sub>S})\" by auto\n  ultimately show ?thesis using func1_1_L1B by auto\nqed\n\nlemma (in ring_homo) spectrum_surj_bij:\n  defines \"g \\<equiv> \\<lambda>u\\<in>target_ring.Spec. f-``u\"\n  assumes \"f\\<in>surj(R,S)\"\n  shows \"g\\<in>bij(target_ring.Spec, V(ker))\"\nproof-\n  {\n    fix s t assume st:\"s\\<in>target_ring.Spec\" \"t\\<in>target_ring.Spec\"\n      \"g`s = g`t\"\n    then have \"f-``s = f-``t\" using beta unfolding g_def by auto\n    then have \"f``(f-``s) = f``(f-``t)\" by auto\n    moreover from st(1,2) have \"s \\<subseteq> S\" \"t \\<subseteq>S\"\n      unfolding target_ring.Spec_def origin_ring.Spec_def\n      by auto\n    moreover note assms(2) st(1,2)\n    ultimately have \"s=t\" using surj_image_vimage\n      unfolding target_ring.Spec_def origin_ring.Spec_def \n      by auto\n  }\n  then have \"g\\<in>inj(target_ring.Spec, origin_ring.closeBasic(f-``{\\<zero>\\<^sub>S}))\"\n    unfolding inj_def using spectrum_surj assms(2) unfolding g_def by auto\n  moreover\n  {\n    fix t assume t:\"t\\<in>origin_ring.closeBasic(f-``{\\<zero>\\<^sub>S})\"\n    then have tt:\"t\\<in>origin_ring.Spec\" \"f-``{\\<zero>\\<^sub>S} \\<subseteq> t\"\n      using origin_ring.closeBasic_def func1_1_L6A[OF surj_is_fun]\n      assms(2) by auto\n    {\n      fix y assume y:\"y\\<in>f-``(f``t)\"\n      then have y:\"y\\<in>R\" \"f`y\\<in>f``t\" using func1_1_L15\n        surj_is_fun[OF assms(2)] by auto\n      from y(2) obtain x where x:\"x\\<in>t\" \"f`y = f`x\"\n        using func_imagedef[OF surj_is_fun]\n        assms(2) tt(1) unfolding origin_ring.Spec_def by auto\n      from x(2) have \"(f`y)\\<rs>\\<^sub>S(f`x) = (f`x)\\<rs>\\<^sub>S(f`x)\" by auto\n      then have \"(f`y)\\<rs>\\<^sub>S(f`x) = \\<zero>\\<^sub>S\" using target_ring.Ring_ZF_1_L3(7)\n        apply_type[OF surj_is_fun] assms(2) x(1) tt(1)\n        unfolding origin_ring.Spec_def by auto\n      then have \"f`(y\\<rs>\\<^sub>Rx) = \\<zero>\\<^sub>S\" using homomor_dest_subs\n        x(1) tt(1) y(1) unfolding origin_ring.Spec_def by auto moreover\n      from x(1) tt(1) have \"x\\<in>R\" unfolding origin_ring.Spec_def by auto\n      with y(1) have \"y\\<rs>\\<^sub>Rx \\<in>R\" using origin_ring.Ring_ZF_1_L4(2) by auto\n      ultimately have \"y\\<rs>\\<^sub>Rx \\<in> f-``{\\<zero>\\<^sub>S}\" using func1_1_L15\n        surj_is_fun[OF assms(2)] by auto\n      then have \"y\\<rs>\\<^sub>Rx \\<in>t\" using tt(2) by auto moreover\n      have \"t\\<triangleleft>R\\<^sub>o\" using tt(1) unfolding origin_ring.Spec_def by auto\n      ultimately have \"x\\<ra>\\<^sub>R(y\\<rs>\\<^sub>Rx) \\<in>t\" using x(1)\n        origin_ring.ideal_dest_sum by auto\n      then have \"y\\<in>t\" using origin_ring.Ring_ZF_2_L1A(5)\n        y(1) \\<open>x\\<in>R\\<close> by auto\n    }\n    then have \"f-``(f``t) = t\" using func1_1_L9[of f R S t]\n      surj_is_fun[OF assms(2)] tt(1) unfolding origin_ring.Spec_def\n      by auto moreover\n    then have \"(f``t)\\<triangleleft>\\<^sub>pR\\<^sub>t\" using prime_ideal_quot_3[of \"f``t\"]\n      assms(2) tt(1) unfolding origin_ring.Spec_def\n      using image_ideal_surj[of t] origin_ring.primeIdeal_def[of t]\n      by auto\n    then have \"(f``t)\\<triangleleft>\\<^sub>pR\\<^sub>t\" \"(f``t)\\<triangleleft>R\\<^sub>t\"\n      using target_ring.primeIdeal_def[of \"f``t\"]\n      by auto\n    then have \"(f``t):target_ring.Spec\"\n      unfolding target_ring.Spec_def using target_ring.ideal_dest_subset\n      by auto moreover\n    then have \"f-``(f``t) = g`(f``t)\" unfolding g_def\n      using beta by auto\n    ultimately have \"g`(f``t) = t\" \"(f``t):target_ring.Spec\" by auto\n    then have \"\\<exists>p\\<in>target_ring.Spec. g`p = t\" by auto\n  }\n  ultimately show \"g:bij(target_ring.Spec, V(ker))\"\n    unfolding bij_def surj_def inj_def by auto\nqed\n\ndefinition (in ring_homo) top_origin (\"\\<tau>\\<^sub>o\") where\n  \"top_origin \\<equiv> {origin_ring.openBasic(J) . J \\<in> origin_ring.ideals}\"\n  \ndefinition (in ring_homo) top_target (\"\\<tau>\\<^sub>t\") where\n  \"top_target \\<equiv> {target_ring.openBasic(J) . J \\<in> target_ring.ideals}\"\n\ndefinition (in ring_homo) spec_cont where\n \"spec_cont(h) \\<equiv> IsContinuous(\\<tau>\\<^sub>t, \\<tau>\\<^sub>o, h)\"\n\nlemma (in ring_homo) spectrum_surj_cont:\n  defines \"g \\<equiv> \\<lambda>u\\<in>target_ring.Spec. f-``u\"\n  assumes \"f\\<in>surj(R,S)\"\n  shows \"IsContinuous(\\<tau>\\<^sub>t, \\<tau>\\<^sub>o {restricted to}(V(ker)), g)\"\n  unfolding IsContinuous_def top_target_def RestrictedTo_def top_origin_def\nproof(safe)\n  fix x assume ass:\"x\\<triangleleft>R\\<^sub>o\" \"x \\<subseteq> R\"\n  have \"origin_ring.openBasic(x) = {u\\<in>origin_ring.Spec. \\<not>(x \\<subseteq> u)}\"\n    unfolding origin_ring.openBasic_def[OF ass(2)] by auto\n  have \"g-``(origin_ring.openBasic(x)) = {t\\<in>target_ring.Spec. g`t \\<in> origin_ring.openBasic(x)}\" \n    using spectrum_surj assms(2) unfolding g_def\n    using func1_1_L15 by auto\n  then have G:\"g-``(origin_ring.openBasic(x)) = {t\\<in>target_ring.Spec. f-``t \\<in> origin_ring.openBasic(x)}\"\n    using beta unfolding g_def by auto\n  have \"(f``x)\\<triangleleft>R\\<^sub>t\" using image_ideal_surj assms(2) ass(1) by auto\n  then have H:\"f``x\\<in>target_ring.ideals\" using\n    target_ring.ideal_dest_subset by auto\n  then have F:\"target_ring.openBasic(f``x) = {t\\<in>target_ring.Spec. \\<not>(f``x \\<subseteq> t)}\"\n    using target_ring.openBasic_def by auto\n  {\n    fix s assume \"s\\<in>{t\\<in>target_ring.Spec. f-``t \\<in> origin_ring.openBasic(x)}\"\n    then have s:\"s\\<in>target_ring.Spec\" \"f-``s \\<in> origin_ring.openBasic(x)\"\n      by auto\n    from this(2) have E:\"f-``s \\<in>origin_ring.Spec\" \"\\<not>(x \\<subseteq> f-``s)\"\n      using origin_ring.openBasic_def ass(1) origin_ring.ideal_dest_subset\n      by auto\n    {\n      assume \"f``x \\<subseteq> s\"\n      then have \"f-``(f``x) \\<subseteq> f-``s\" by auto\n      then have \"x \\<subseteq> f-``s\" using func1_1_L9[OF surj_is_fun]\n        assms(2) ass(1) origin_ring.ideal_dest_subset by force\n      with E(2) have False by auto\n    }\n    then have \"\\<not>(f``x \\<subseteq> s)\" by auto\n    with s(1) have \"s\\<in>{t\\<in>target_ring.Spec. \\<not>(f``x \\<subseteq> t)}\"\n      by auto\n  }\n  then have \"{t \\<in> target_ring.Spec . f -`` t \\<in> origin_ring.openBasic(x)} \\<subseteq> {t\\<in>target_ring.Spec. \\<not>(f``x \\<subseteq> t)}\"\n    by auto moreover\n  {\n    fix s assume \"s\\<in>{t\\<in>target_ring.Spec. \\<not>(f``x \\<subseteq> t)}\"\n    then have s:\"s\\<in>target_ring.Spec\" \"\\<not>(f``x \\<subseteq> s)\" by auto\n    have \"origin_ring.openBasic(x) = {t\\<in>origin_ring.Spec. \\<not>(x \\<subseteq> t)}\"\n      using origin_ring.openBasic_def ass(1) origin_ring.ideal_dest_subset\n      by auto\n    {\n      assume \"x \\<subseteq> f-``s\"\n      then have \"f``x \\<subseteq> f``(f-``s)\" by auto\n      then have \"f``x \\<subseteq> s\" using surj_image_vimage\n        assms(2) s(1) unfolding target_ring.Spec_def\n          target_ring.primeIdeal_def target_ring.ideal_dest_subset\n        by auto\n      with s(2) have False by auto\n    }\n    then have \"\\<not>(x \\<subseteq> f-``s)\" by auto\n    moreover\n    from s(1) have \"(f-``s) \\<triangleleft>\\<^sub>pR\\<^sub>o\" unfolding target_ring.Spec_def\n      using preimage_prime_ideal_surj assms(2) by auto\n    then have \"(f-``s)\\<in>origin_ring.Spec\" unfolding origin_ring.Spec_def\n      origin_ring.primeIdeal_def using origin_ring.ideal_dest_subset\n      by auto\n    ultimately have \"f-``s\\<in>origin_ring.openBasic(x)\"\n      using origin_ring.openBasic_def ass(1)\n      origin_ring.ideal_dest_subset by auto\n    then have \"s\\<in>{t \\<in> target_ring.Spec . f -`` t \\<in> origin_ring.openBasic(x)}\"\n      using s(1) by auto\n  }\n  then have \"{t \\<in> target_ring.Spec . \\<not> f `` x \\<subseteq> t} \\<subseteq> {t \\<in> target_ring.Spec . f -`` t \\<in> origin_ring.openBasic(x)}\"\n    by auto\n  ultimately have \"{t \\<in> target_ring.Spec . \\<not> f `` x \\<subseteq> t} = {t \\<in> target_ring.Spec . f -`` t \\<in> origin_ring.openBasic(x)}\"\n    by auto\n  with F have \"target_ring.openBasic(f``x) = {t \\<in> target_ring.Spec . f -`` t \\<in> origin_ring.openBasic(x)}\"\n    by auto\n  with G have T:\"target_ring.openBasic(f``x) = g-`` origin_ring.openBasic(x)\" by auto\n  have \"g-``(origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S})) = {t\\<in>target_ring.Spec. g`t \\<in> origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S})}\" \n    using spectrum_surj assms(2) unfolding g_def\n    using func1_1_L15 by auto\n  then have \"g-``(origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S})) = {t\\<in>target_ring.Spec. f-``t \\<in> origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S})}\" \n    using beta unfolding g_def by auto\n  then have E:\"g-``(origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S})) = {t\\<in>target_ring.Spec. f-``t \\<in> {q\\<in>origin_ring.Spec. (f -`` {\\<zero>\\<^sub>S}) \\<subseteq> q}}\" \n    unfolding origin_ring.closeBasic_def[OF func1_1_L3[OF surj_is_fun[OF assms(2)]]] by auto\n  {\n    fix s assume s:\"s\\<in>target_ring.openBasic(f``x)\"\n    with E have ss:\"s\\<in>target_ring.Spec\" \"\\<not>(f``x \\<subseteq> s)\" \n      using target_ring.openBasic_def func1_1_L6(2) surj_is_fun[OF assms(2)] by auto\n    from this(1) have \"g`s \\<in> origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S})\" using spectrum_surj[OF assms(2)]\n      apply_type[of g target_ring.Spec \"\\<lambda>u. origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S})\"] unfolding g_def\n      by auto\n    with ss(1) have \"f-``s \\<in> origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S})\" using beta\n      unfolding g_def by auto\n    moreover \n    from ss(1) have \"s\\<triangleleft>R\\<^sub>t\" unfolding target_ring.Spec_def\n      target_ring.primeIdeal_def by auto\n    then have \"\\<zero>\\<^sub>S \\<in>s\" using target_ring.ideal_dest_zero by auto\n    then have \"{\\<zero>\\<^sub>S} \\<subseteq> s\" by auto\n    then have \"f-``{\\<zero>\\<^sub>S} \\<subseteq> f-``s\" by auto\n    moreover\n    have \"f-``{\\<zero>\\<^sub>S} \\<subseteq> R\" using func1_1_L15[OF\n      surj_is_fun[OF assms(2)], of \"{\\<zero>\\<^sub>S}\"] by auto\n    ultimately have \"f-``s \\<in> {q\\<in>origin_ring.Spec. (f -`` {\\<zero>\\<^sub>S}) \\<subseteq> q}\"\n      using origin_ring.closeBasic_def by auto\n    then have \"s\\<in>{t\\<in>target_ring.Spec. f-``t \\<in> {q\\<in>origin_ring.Spec. (f -`` {\\<zero>\\<^sub>S}) \\<subseteq> q}}\"\n      using ss(1) by auto\n    then have \"s\\<in>g-``(origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S}))\" using E by auto\n  }\n  then have \"target_ring.openBasic(f``x) \\<subseteq> g-``(origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S}))\" by auto\n  then have \"g-``(origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S}))\\<inter>target_ring.openBasic(f``x) = target_ring.openBasic(f``x)\"\n    by auto\n  with T have \"g-``(origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S})) \\<inter> g -`` origin_ring.openBasic(x) = target_ring.openBasic(f``x)\"\n    by auto moreover\n  have \"g-``(origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S})) \\<inter> g -`` origin_ring.openBasic(x) =\n    g-``(origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S}) \\<inter> origin_ring.openBasic(x))\"\n    using invim_inter_inter_invim[OF spectrum_surj[OF assms(2)]]\n    unfolding g_def by auto\n  ultimately have \"g -``\n       (origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S}) \\<inter>\n        origin_ring.openBasic(x)) = target_ring.openBasic(f``x)\"\n    by auto\n  with H show \"g -``\n       (origin_ring.closeBasic(f -`` {\\<zero>\\<^sub>S}) \\<inter>\n        origin_ring.openBasic(x)) \\<in>\n           RepFun(target_ring.ideals, target_ring.openBasic)\"\n    by auto\nqed\n\nlemma (in ring_homo) spectrum_surj_open:\n  defines \"g \\<equiv> \\<lambda>u\\<in>target_ring.Spec. f-``u\"\n  assumes \"f\\<in>surj(R,S)\"\n  shows \"\\<forall>U\\<in>\\<tau>\\<^sub>t. g``U \\<in> \\<tau>\\<^sub>o {restricted to} V(ker)\"\nproof\n  fix U assume U:\"U\\<in>\\<tau>\\<^sub>t\"\n  then obtain I where I:\"I\\<triangleleft>R\\<^sub>t\" \"I\\<subseteq>S\" \n    \"U=target_ring.openBasic(I)\" unfolding top_target_def\n    by auto\n  from I(3) have sub:\"U \\<subseteq> target_ring.Spec\" \n    using target_ring.openBasic_def[OF I(2)] by auto\n  {\n    fix t assume t:\"t\\<in>g``U\"\n    then obtain u where u:\"u\\<in>U\" \"t=g`u\"\n      using func_imagedef spectrum_surj[OF assms(2)] sub\n      unfolding g_def by auto\n    then have t:\"t=f-``u\" using beta sub unfolding g_def by auto\n    with sub u(1) have \"t\\<triangleleft>\\<^sub>pR\\<^sub>o\" unfolding target_ring.Spec_def\n      using preimage_prime_ideal_surj[OF _ assms(2), of u]\n      by auto\n    then have p:\"t\\<in>origin_ring.Spec\" unfolding origin_ring.Spec_def\n      unfolding origin_ring.primeIdeal_def\n      using origin_ring.ideal_dest_subset by auto\n    from u(1) I(2,3) have Iu:\"\\<not> (I \\<subseteq> u)\" using target_ring.openBasic_def\n      by auto\n    {\n      assume \"f-``I \\<subseteq> t\"\n      then have \"f``(f-``I) \\<subseteq> f``t\" by auto\n      then have \"I \\<subseteq> f``t\" using surj_image_vimage[OF assms(2)] I(2) by auto\n      with t have \"I \\<subseteq> f``(f-``u)\" by auto\n      moreover from u(1) sub have \"u \\<subseteq> S\"\n        unfolding target_ring.Spec_def by auto\n      ultimately have \"I \\<subseteq> u\" using surj_image_vimage[OF assms(2)]\n        by auto\n      with Iu have False by auto\n    }\n    then have \"\\<not>(f-``I \\<subseteq> t)\" by auto\n    with p have \"t\\<in>origin_ring.openBasic(f-``I)\"\n      using origin_ring.openBasic_def func1_1_L6A[OF surj_is_fun]\n      assms(2) by auto\n  }\n  then have \"g``U \\<subseteq> origin_ring.openBasic(f-``I)\" by auto moreover\n  {\n    fix t assume t:\"t\\<in>origin_ring.openBasic(f-``I)\" \"t\\<in>V(ker)\"\n    have \"f-``I \\<subseteq> R\" using func1_1_L6A[OF surj_is_fun]\n      assms(2) by auto\n    with t have p:\"t\\<in>origin_ring.Spec\" \"\\<not>(f-``I \\<subseteq> t)\"\n      using origin_ring.openBasic_def by auto\n    from t(2) have kt:\"ker \\<subseteq> t\" using origin_ring.closeBasic_def[OF\n      func1_1_L3[OF fun]] by auto\n    {\n      fix x assume \"x\\<in>f-``(f``t)\"\n      then have t:\"f`x\\<in>f``t\" \"x\\<in>R\" using func1_1_L15\n        surj_is_fun[OF assms(2)] by auto\n      then obtain s where s:\"f`x = f`s\" \"s\\<in>t\" using\n        func_imagedef[OF surj_is_fun[OF assms(2)]]\n        p(1) unfolding origin_ring.Spec_def by auto\n      from s(2) have ss:\"s\\<in>R\" using p(1) \n        unfolding origin_ring.Spec_def by auto\n      from s(1) have \"(f`x) \\<rs>\\<^sub>S (f`s) = \\<zero>\\<^sub>S\" using\n        target_ring.Ring_ZF_1_L3(7)[OF apply_type[OF \n            surj_is_fun[OF assms(2)]\n        t(2)]] by auto\n      then have \"f`(x\\<rs>\\<^sub>Rs) = \\<zero>\\<^sub>S\" using homomor_dest_subs\n        t(2) ss by auto moreover\n      from t(2) ss have \"x\\<rs>\\<^sub>Rs \\<in>R\" using origin_ring.Ring_ZF_1_L4(2) by auto\n      ultimately have \"x\\<rs>\\<^sub>Rs \\<in> f-``{\\<zero>\\<^sub>S}\" using func1_1_L15\n        surj_is_fun[OF assms(2)] by auto\n      then have \"x\\<rs>\\<^sub>Rs \\<in> t\" using kt by auto\n      then have \"s\\<ra>\\<^sub>R(x\\<rs>\\<^sub>Rs) \\<in> t\" \n        using origin_ring.ideal_dest_sum\n        s(2) p(1) unfolding origin_ring.Spec_def by auto\n      then have \"x\\<in>t\" using origin_ring.Ring_ZF_2_L1A(5)\n        ss t(2) by auto\n    }\n    then have eq:\"f-``(f``t) = t\"\n      using func1_1_L9[OF surj_is_fun[OF assms(2)]\n      origin_ring.ideal_dest_subset[of t]] p(1) unfolding origin_ring.Spec_def\n      origin_ring.primeIdeal_def by auto\n    then have \"(f `` t)\\<triangleleft>R\\<^sub>t \\<Longrightarrow> (f``t)\\<triangleleft>\\<^sub>pR\\<^sub>t\"\n      using prime_ideal_quot_3[of \"f``t\"] assms(2)\n      p(1) unfolding origin_ring.Spec_def by auto\n    then have id:\"(f``t)\\<triangleleft>\\<^sub>pR\\<^sub>t\" \"(f `` t)\\<triangleleft>R\\<^sub>t\" using image_ideal_surj\n      p(1) assms(2) unfolding origin_ring.Spec_def by auto\n    {\n      assume \"I \\<subseteq> f``t\"\n      then have \"f-``I \\<subseteq> f-``(f``t)\" by auto\n      with eq have \"f-``I \\<subseteq> t\" by auto\n      with p(2) have False by auto\n    }\n    then have \"\\<not>(I \\<subseteq> f``t)\" by auto\n    then have \"f``t\\<in>target_ring.openBasic(I)\"\n      using id target_ring.ideal_dest_subset unfolding target_ring.openBasic_def[OF I(2)]\n      target_ring.Spec_def by auto\n    then have q:\"f``t \\<in>U\" using I(3) by auto\n    then have q2:\"f``t\\<in>target_ring.Spec\" using sub by auto\n    from q have \"g`(f``t) \\<in>g``U\" using func1_1_L15D[OF bij_is_fun\n      [OF spectrum_surj_bij[OF assms(2)]], of \"f``t\" U]\n      unfolding g_def using sub by auto\n    then have \"f-``(f``t) \\<in> g``U\" using beta[of \"f``t\"\n      target_ring.Spec \"\\<lambda>o. f-``o\"] q2\n      unfolding g_def by auto\n    with eq have \"t\\<in>g``U\" by auto\n  }\n  then have \"V(ker)\\<inter>D(f -`` I) \\<subseteq> g``U\" by auto\n  ultimately\n  have \"V(ker)\\<inter>D(f -`` I) = g``U\"\n    using func1_1_L6(2)[OF bij_is_fun[OF\n    spectrum_surj_bij[OF assms(2)]],of U] \n    unfolding g_def by blast\n  moreover\n  have \"D(f -`` I) \\<in>\\<tau>\\<^sub>o\" unfolding top_origin_def\n    using preimage_ideal(1)[OF I(1)]\n      origin_ring.ideal_dest_subset by auto\n  then have \"V(ker)\\<inter>D(f -`` I) \\<in> {V(ker) \\<inter> A . A \\<in> \\<tau>\\<^sub>o}\"\n    by auto\n  ultimately show \"g``U:  \\<tau>\\<^sub>o{restricted to}V(ker)\"\n    unfolding RestrictedTo_def by auto\nqed\n\ntext\\<open>A quotient ring has an spectrum homeomorphic\nto a closed subspace of the spectrum of the base ring.\nSpecifically, the close subspace associated to the\nideal by which we quotient.\\<close>\n\ncorollary (in ring_homo) surj_homeomorphism:\n  assumes \"f\\<in>surj(R,S)\"\n  defines \"g \\<equiv> \\<lambda>u\\<in>target_ring.Spec. f -`` u\"\n  shows \"IsAhomeomorphism(\\<tau>\\<^sub>t, \\<tau>\\<^sub>o{restricted to}V(ker), g)\"\nproof-\n  have \"\\<Union>(\\<tau>\\<^sub>o{restricted to}V(ker)) = origin_ring.Spec \\<inter> V(ker)\" unfolding\n    top_origin_def RestrictedTo_def using origin_ring.total_spec\n    by auto\n  then have \"\\<Union>(\\<tau>\\<^sub>o{restricted to}V(ker)) = V(ker)\"\n    using origin_ring.closeBasic_def[OF func1_1_L3[OF fun,\n    of \"{\\<zero>\\<^sub>S}\"]] by auto moreover\n  have \"\\<Union>\\<tau>\\<^sub>t = target_ring.Spec\" unfolding top_target_def\n    using target_ring.total_spec by auto\n  ultimately show ?thesis using bij_cont_open_homeo[of g \\<tau>\\<^sub>t \"\\<tau>\\<^sub>o{restricted to}V(ker)\"]\n    spectrum_surj_bij[OF assms(1)] spectrum_surj_open[OF assms(1)]\n    spectrum_surj_cont[OF assms(1)]\n    unfolding g_def by auto\nqed\n  \nend\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/Ring_Zariski_ZF_3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331606115021, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3214674658313222}}
{"text": "(*:maxLineLen=78:*)\n\ntheory HOL_Specific\n  imports\n    Main\n    \"HOL-Library.Old_Datatype\"\n    \"HOL-Library.Old_Recdef\"\n    \"HOL-Library.Adhoc_Overloading\"\n    \"HOL-Library.Dlist\"\n    \"HOL-Library.FSet\"\n    Base\nbegin\n\n\nchapter \\<open>Higher-Order Logic\\<close>\n\ntext \\<open>\n  Isabelle/HOL is based on Higher-Order Logic, a polymorphic version of\n  Church's Simple Theory of Types. HOL can be best understood as a\n  simply-typed version of classical set theory. The logic was first\n  implemented in Gordon's HOL system @{cite \"mgordon-hol\"}. It extends\n  Church's original logic @{cite \"church40\"} by explicit type variables (naive\n  polymorphism) and a sound axiomatization scheme for new types based on\n  subsets of existing types.\n\n  Andrews's book @{cite andrews86} is a full description of the original\n  Church-style higher-order logic, with proofs of correctness and completeness\n  wrt.\\ certain set-theoretic interpretations. The particular extensions of\n  Gordon-style HOL are explained semantically in two chapters of the 1993 HOL\n  book @{cite pitts93}.\n\n  Experience with HOL over decades has demonstrated that higher-order logic is\n  widely applicable in many areas of mathematics and computer science. In a\n  sense, Higher-Order Logic is simpler than First-Order Logic, because there\n  are fewer restrictions and special cases. Note that HOL is \\<^emph>\\<open>weaker\\<close> than\n  FOL with axioms for ZF set theory, which is traditionally considered the\n  standard foundation of regular mathematics, but for most applications this\n  does not matter. If you prefer ML to Lisp, you will probably prefer HOL to\n  ZF.\n\n  \\<^medskip> The syntax of HOL follows \\<open>\\<lambda>\\<close>-calculus and functional programming.\n  Function application is curried. To apply the function \\<open>f\\<close> of type \\<open>\\<tau>\\<^sub>1 \\<Rightarrow>\n  \\<tau>\\<^sub>2 \\<Rightarrow> \\<tau>\\<^sub>3\\<close> to the arguments \\<open>a\\<close> and \\<open>b\\<close> in HOL, you simply write \\<open>f a b\\<close> (as\n  in ML or Haskell). There is no ``apply'' operator; the existing application\n  of the Pure \\<open>\\<lambda>\\<close>-calculus is re-used. Note that in HOL \\<open>f (a, b)\\<close> means ``\\<open>f\\<close>\n  applied to the pair \\<open>(a, b)\\<close> (which is notation for \\<open>Pair a b\\<close>). The latter\n  typically introduces extra formal efforts that can be avoided by currying\n  functions by default. Explicit tuples are as infrequent in HOL\n  formalizations as in good ML or Haskell programs.\n\n  \\<^medskip> Isabelle/HOL has a distinct feel, compared to other object-logics like\n  Isabelle/ZF. It identifies object-level types with meta-level types, taking\n  advantage of the default type-inference mechanism of Isabelle/Pure. HOL\n  fully identifies object-level functions with meta-level functions, with\n  native abstraction and application.\n\n  These identifications allow Isabelle to support HOL particularly nicely, but\n  they also mean that HOL requires some sophistication from the user. In\n  particular, an understanding of Hindley-Milner type-inference with\n  type-classes, which are both used extensively in the standard libraries and\n  applications.\n\\<close>\n\n\nchapter \\<open>Derived specification elements\\<close>\n\nsection \\<open>Inductive and coinductive definitions \\label{sec:hol-inductive}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"inductive\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"inductive_set\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"coinductive\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"coinductive_set\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def \"print_inductives\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{attribute_def (HOL) mono} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  An \\<^emph>\\<open>inductive definition\\<close> specifies the least predicate or set \\<open>R\\<close> closed\n  under given rules: applying a rule to elements of \\<open>R\\<close> yields a result within\n  \\<open>R\\<close>. For example, a structural operational semantics is an inductive\n  definition of an evaluation relation.\n\n  Dually, a \\<^emph>\\<open>coinductive definition\\<close> specifies the greatest predicate or set\n  \\<open>R\\<close> that is consistent with given rules: every element of \\<open>R\\<close> can be seen as\n  arising by applying a rule to elements of \\<open>R\\<close>. An important example is using\n  bisimulation relations to formalise equivalence of processes and infinite\n  data structures.\n\n  Both inductive and coinductive definitions are based on the Knaster-Tarski\n  fixed-point theorem for complete lattices. The collection of introduction\n  rules given by the user determines a functor on subsets of set-theoretic\n  relations. The required monotonicity of the recursion scheme is proven as a\n  prerequisite to the fixed-point definition and the resulting consequences.\n  This works by pushing inclusion through logical connectives and any other\n  operator that might be wrapped around recursive occurrences of the defined\n  relation: there must be a monotonicity theorem of the form \\<open>A \\<le> B \\<Longrightarrow> \\<M> A \\<le> \\<M>\n  B\\<close>, for each premise \\<open>\\<M> R t\\<close> in an introduction rule. The default rule\n  declarations of Isabelle/HOL already take care of most common situations.\n\n  \\<^rail>\\<open>\n    (@@{command (HOL) inductive} | @@{command (HOL) inductive_set} |\n      @@{command (HOL) coinductive} | @@{command (HOL) coinductive_set})\n      @{syntax vars} @{syntax for_fixes} \\<newline>\n      (@'where' @{syntax multi_specs})? (@'monos' @{syntax thms})?\n    ;\n    @@{command print_inductives} ('!'?)\n    ;\n    @@{attribute (HOL) mono} (() | 'add' | 'del')\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"inductive\"} and @{command (HOL) \"coinductive\"} define\n  (co)inductive predicates from the introduction rules.\n\n  The propositions given as \\<open>clauses\\<close> in the @{keyword \"where\"} part are\n  either rules of the usual \\<open>\\<And>/\\<Longrightarrow>\\<close> format (with arbitrary nesting), or\n  equalities using \\<open>\\<equiv>\\<close>. The latter specifies extra-logical abbreviations in\n  the sense of @{command_ref abbreviation}. Introducing abstract syntax\n  simultaneously with the actual introduction rules is occasionally useful for\n  complex specifications.\n\n  The optional @{keyword \"for\"} part contains a list of parameters of the\n  (co)inductive predicates that remain fixed throughout the definition, in\n  contrast to arguments of the relation that may vary in each occurrence\n  within the given \\<open>clauses\\<close>.\n\n  The optional @{keyword \"monos\"} declaration contains additional\n  \\<^emph>\\<open>monotonicity theorems\\<close>, which are required for each operator applied to a\n  recursive set in the introduction rules.\n\n  \\<^descr> @{command (HOL) \"inductive_set\"} and @{command (HOL) \"coinductive_set\"}\n  are wrappers for to the previous commands for native HOL predicates. This\n  allows to define (co)inductive sets, where multiple arguments are simulated\n  via tuples.\n\n  \\<^descr> @{command \"print_inductives\"} prints (co)inductive definitions and\n  monotonicity rules; the ``\\<open>!\\<close>'' option indicates extra verbosity.\n\n  \\<^descr> @{attribute (HOL) mono} declares monotonicity rules in the context. These\n  rule are involved in the automated monotonicity proof of the above inductive\n  and coinductive definitions.\n\\<close>\n\n\nsubsection \\<open>Derived rules\\<close>\n\ntext \\<open>\n  A (co)inductive definition of \\<open>R\\<close> provides the following main theorems:\n\n  \\<^descr> \\<open>R.intros\\<close> is the list of introduction rules as proven theorems, for the\n  recursive predicates (or sets). The rules are also available individually,\n  using the names given them in the theory file;\n\n  \\<^descr> \\<open>R.cases\\<close> is the case analysis (or elimination) rule;\n\n  \\<^descr> \\<open>R.induct\\<close> or \\<open>R.coinduct\\<close> is the (co)induction rule;\n\n  \\<^descr> \\<open>R.simps\\<close> is the equation unrolling the fixpoint of the predicate one\n  step.\n\n\n  When several predicates \\<open>R\\<^sub>1, \\<dots>, R\\<^sub>n\\<close> are defined simultaneously, the list\n  of introduction rules is called \\<open>R\\<^sub>1_\\<dots>_R\\<^sub>n.intros\\<close>, the case analysis rules\n  are called \\<open>R\\<^sub>1.cases, \\<dots>, R\\<^sub>n.cases\\<close>, and the list of mutual induction rules\n  is called \\<open>R\\<^sub>1_\\<dots>_R\\<^sub>n.inducts\\<close>.\n\\<close>\n\n\nsubsection \\<open>Monotonicity theorems\\<close>\n\ntext \\<open>\n  The context maintains a default set of theorems that are used in\n  monotonicity proofs. New rules can be declared via the @{attribute (HOL)\n  mono} attribute. See the main Isabelle/HOL sources for some examples. The\n  general format of such monotonicity theorems is as follows:\n\n  \\<^item> Theorems of the form \\<open>A \\<le> B \\<Longrightarrow> \\<M> A \\<le> \\<M> B\\<close>, for proving monotonicity of\n  inductive definitions whose introduction rules have premises involving terms\n  such as \\<open>\\<M> R t\\<close>.\n\n  \\<^item> Monotonicity theorems for logical operators, which are of the general form\n  \\<open>(\\<dots> \\<longrightarrow> \\<dots>) \\<Longrightarrow> \\<dots> (\\<dots> \\<longrightarrow> \\<dots>) \\<Longrightarrow> \\<dots> \\<longrightarrow> \\<dots>\\<close>. For example, in the case of the operator \\<open>\\<or>\\<close>,\n  the corresponding theorem is\n  \\[\n  \\infer{\\<open>P\\<^sub>1 \\<or> P\\<^sub>2 \\<longrightarrow> Q\\<^sub>1 \\<or> Q\\<^sub>2\\<close>}{\\<open>P\\<^sub>1 \\<longrightarrow> Q\\<^sub>1\\<close> & \\<open>P\\<^sub>2 \\<longrightarrow> Q\\<^sub>2\\<close>}\n  \\]\n\n  \\<^item> De Morgan style equations for reasoning about the ``polarity'' of\n  expressions, e.g.\n  \\[\n  \\<^prop>\\<open>\\<not> \\<not> P \\<longleftrightarrow> P\\<close> \\qquad\\qquad\n  \\<^prop>\\<open>\\<not> (P \\<and> Q) \\<longleftrightarrow> \\<not> P \\<or> \\<not> Q\\<close>\n  \\]\n\n  \\<^item> Equations for reducing complex operators to more primitive ones whose\n  monotonicity can easily be proved, e.g.\n  \\[\n  \\<^prop>\\<open>(P \\<longrightarrow> Q) \\<longleftrightarrow> \\<not> P \\<or> Q\\<close> \\qquad\\qquad\n  \\<^prop>\\<open>Ball A P \\<equiv> \\<forall>x. x \\<in> A \\<longrightarrow> P x\\<close>\n  \\]\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>The finite powerset operator can be defined inductively like this:\\<close>\n\n(*<*)experiment begin(*>*)\ninductive_set Fin :: \"'a set \\<Rightarrow> 'a set set\" for A :: \"'a set\"\nwhere\n  empty: \"{} \\<in> Fin A\"\n| insert: \"a \\<in> A \\<Longrightarrow> B \\<in> Fin A \\<Longrightarrow> insert a B \\<in> Fin A\"\n\ntext \\<open>The accessible part of a relation is defined as follows:\\<close>\n\ninductive acc :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  for r :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\"  (infix \"\\<prec>\" 50)\nwhere acc: \"(\\<And>y. y \\<prec> x \\<Longrightarrow> acc r y) \\<Longrightarrow> acc r x\"\n(*<*)end(*>*)\n\ntext \\<open>\n  Common logical connectives can be easily characterized as non-recursive\n  inductive definitions with parameters, but without arguments.\n\\<close>\n\n(*<*)experiment begin(*>*)\ninductive AND for A B :: bool\nwhere \"A \\<Longrightarrow> B \\<Longrightarrow> AND A B\"\n\ninductive OR for A B :: bool\nwhere \"A \\<Longrightarrow> OR A B\"\n  | \"B \\<Longrightarrow> OR A B\"\n\ninductive EXISTS for B :: \"'a \\<Rightarrow> bool\"\nwhere \"B a \\<Longrightarrow> EXISTS B\"\n(*<*)end(*>*)\n\ntext \\<open>\n  Here the \\<open>cases\\<close> or \\<open>induct\\<close> rules produced by the @{command inductive}\n  package coincide with the expected elimination rules for Natural Deduction.\n  Already in the original article by Gerhard Gentzen @{cite \"Gentzen:1935\"}\n  there is a hint that each connective can be characterized by its\n  introductions, and the elimination can be constructed systematically.\n\\<close>\n\n\nsection \\<open>Recursive functions \\label{sec:recursion}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"primrec\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"fun\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"function\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close> \\\\\n    @{command_def (HOL) \"termination\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close> \\\\\n    @{command_def (HOL) \"fun_cases\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) primrec} @{syntax specification}\n    ;\n    (@@{command (HOL) fun} | @@{command (HOL) function}) opts? @{syntax specification}\n    ;\n    opts: '(' (('sequential' | 'domintros') + ',') ')'\n    ;\n    @@{command (HOL) termination} @{syntax term}?\n    ;\n    @@{command (HOL) fun_cases} (@{syntax thmdecl}? @{syntax prop} + @'and')\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"primrec\"} defines primitive recursive functions over\n  datatypes (see also @{command_ref (HOL) datatype}). The given \\<open>equations\\<close>\n  specify reduction rules that are produced by instantiating the generic\n  combinator for primitive recursion that is available for each datatype.\n\n  Each equation needs to be of the form:\n\n  @{text [display] \"f x\\<^sub>1 \\<dots> x\\<^sub>m (C y\\<^sub>1 \\<dots> y\\<^sub>k) z\\<^sub>1 \\<dots> z\\<^sub>n = rhs\"}\n\n  such that \\<open>C\\<close> is a datatype constructor, \\<open>rhs\\<close> contains only the free\n  variables on the left-hand side (or from the context), and all recursive\n  occurrences of \\<open>f\\<close> in \\<open>rhs\\<close> are of the form \\<open>f \\<dots> y\\<^sub>i \\<dots>\\<close> for some \\<open>i\\<close>. At\n  most one reduction rule for each constructor can be given. The order does\n  not matter. For missing constructors, the function is defined to return a\n  default value, but this equation is made difficult to access for users.\n\n  The reduction rules are declared as @{attribute simp} by default, which\n  enables standard proof methods like @{method simp} and @{method auto} to\n  normalize expressions of \\<open>f\\<close> applied to datatype constructions, by\n  simulating symbolic computation via rewriting.\n\n  \\<^descr> @{command (HOL) \"function\"} defines functions by general wellfounded\n  recursion. A detailed description with examples can be found in @{cite\n  \"isabelle-function\"}. The function is specified by a set of (possibly\n  conditional) recursive equations with arbitrary pattern matching. The\n  command generates proof obligations for the completeness and the\n  compatibility of patterns.\n\n  The defined function is considered partial, and the resulting simplification\n  rules (named \\<open>f.psimps\\<close>) and induction rule (named \\<open>f.pinduct\\<close>) are guarded\n  by a generated domain predicate \\<open>f_dom\\<close>. The @{command (HOL) \"termination\"}\n  command can then be used to establish that the function is total.\n\n  \\<^descr> @{command (HOL) \"fun\"} is a shorthand notation for ``@{command (HOL)\n  \"function\"}~\\<open>(sequential)\\<close>'', followed by automated proof attempts regarding\n  pattern matching and termination. See @{cite \"isabelle-function\"} for\n  further details.\n\n  \\<^descr> @{command (HOL) \"termination\"}~\\<open>f\\<close> commences a termination proof for the\n  previously defined function \\<open>f\\<close>. If this is omitted, the command refers to\n  the most recent function definition. After the proof is closed, the\n  recursive equations and the induction principle is established.\n\n  \\<^descr> @{command (HOL) \"fun_cases\"} generates specialized elimination rules for\n  function equations. It expects one or more function equations and produces\n  rules that eliminate the given equalities, following the cases given in the\n  function definition.\n\n\n  Recursive definitions introduced by the @{command (HOL) \"function\"} command\n  accommodate reasoning by induction (cf.\\ @{method induct}): rule \\<open>f.induct\\<close>\n  refers to a specific induction rule, with parameters named according to the\n  user-specified equations. Cases are numbered starting from 1. For @{command\n  (HOL) \"primrec\"}, the induction principle coincides with structural\n  recursion on the datatype where the recursion is carried out.\n\n  The equations provided by these packages may be referred later as theorem\n  list \\<open>f.simps\\<close>, where \\<open>f\\<close> is the (collective) name of the functions defined.\n  Individual equations may be named explicitly as well.\n\n  The @{command (HOL) \"function\"} command accepts the following options.\n\n  \\<^descr> \\<open>sequential\\<close> enables a preprocessor which disambiguates overlapping\n  patterns by making them mutually disjoint. Earlier equations take precedence\n  over later ones. This allows to give the specification in a format very\n  similar to functional programming. Note that the resulting simplification\n  and induction rules correspond to the transformed specification, not the one\n  given originally. This usually means that each equation given by the user\n  may result in several theorems. Also note that this automatic transformation\n  only works for ML-style datatype patterns.\n\n  \\<^descr> \\<open>domintros\\<close> enables the automated generation of introduction rules for the\n  domain predicate. While mostly not needed, they can be helpful in some\n  proofs about partial functions.\n\\<close>\n\n\nsubsubsection \\<open>Example: evaluation of expressions\\<close>\n\ntext \\<open>\n  Subsequently, we define mutual datatypes for arithmetic and boolean\n  expressions, and use @{command primrec} for evaluation functions that follow\n  the same recursive structure.\n\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype 'a aexp =\n    IF \"'a bexp\"  \"'a aexp\"  \"'a aexp\"\n  | Sum \"'a aexp\"  \"'a aexp\"\n  | Diff \"'a aexp\"  \"'a aexp\"\n  | Var 'a\n  | Num nat\nand 'a bexp =\n    Less \"'a aexp\"  \"'a aexp\"\n  | And \"'a bexp\"  \"'a bexp\"\n  | Neg \"'a bexp\"\n\ntext \\<open>\\<^medskip> Evaluation of arithmetic and boolean expressions\\<close>\n\nprimrec evala :: \"('a \\<Rightarrow> nat) \\<Rightarrow> 'a aexp \\<Rightarrow> nat\"\n  and evalb :: \"('a \\<Rightarrow> nat) \\<Rightarrow> 'a bexp \\<Rightarrow> bool\"\nwhere\n  \"evala env (IF b a1 a2) = (if evalb env b then evala env a1 else evala env a2)\"\n| \"evala env (Sum a1 a2) = evala env a1 + evala env a2\"\n| \"evala env (Diff a1 a2) = evala env a1 - evala env a2\"\n| \"evala env (Var v) = env v\"\n| \"evala env (Num n) = n\"\n| \"evalb env (Less a1 a2) = (evala env a1 < evala env a2)\"\n| \"evalb env (And b1 b2) = (evalb env b1 \\<and> evalb env b2)\"\n| \"evalb env (Neg b) = (\\<not> evalb env b)\"\n\ntext \\<open>\n  Since the value of an expression depends on the value of its variables, the\n  functions \\<^const>\\<open>evala\\<close> and \\<^const>\\<open>evalb\\<close> take an additional parameter, an\n  \\<^emph>\\<open>environment\\<close> that maps variables to their values.\n\n  \\<^medskip>\n  Substitution on expressions can be defined similarly. The mapping \\<open>f\\<close> of\n  type \\<^typ>\\<open>'a \\<Rightarrow> 'a aexp\\<close> given as a parameter is lifted canonically on the\n  types \\<^typ>\\<open>'a aexp\\<close> and \\<^typ>\\<open>'a bexp\\<close>, respectively.\n\\<close>\n\nprimrec substa :: \"('a \\<Rightarrow> 'b aexp) \\<Rightarrow> 'a aexp \\<Rightarrow> 'b aexp\"\n  and substb :: \"('a \\<Rightarrow> 'b aexp) \\<Rightarrow> 'a bexp \\<Rightarrow> 'b bexp\"\nwhere\n  \"substa f (IF b a1 a2) = IF (substb f b) (substa f a1) (substa f a2)\"\n| \"substa f (Sum a1 a2) = Sum (substa f a1) (substa f a2)\"\n| \"substa f (Diff a1 a2) = Diff (substa f a1) (substa f a2)\"\n| \"substa f (Var v) = f v\"\n| \"substa f (Num n) = Num n\"\n| \"substb f (Less a1 a2) = Less (substa f a1) (substa f a2)\"\n| \"substb f (And b1 b2) = And (substb f b1) (substb f b2)\"\n| \"substb f (Neg b) = Neg (substb f b)\"\n\ntext \\<open>\n  In textbooks about semantics one often finds substitution theorems, which\n  express the relationship between substitution and evaluation. For \\<^typ>\\<open>'a\n  aexp\\<close> and \\<^typ>\\<open>'a bexp\\<close>, we can prove such a theorem by mutual\n  induction, followed by simplification.\n\\<close>\n\nlemma subst_one:\n  \"evala env (substa (Var (v := a')) a) = evala (env (v := evala env a')) a\"\n  \"evalb env (substb (Var (v := a')) b) = evalb (env (v := evala env a')) b\"\n  by (induct a and b) simp_all\n\nlemma subst_all:\n  \"evala env (substa s a) = evala (\\<lambda>x. evala env (s x)) a\"\n  \"evalb env (substb s b) = evalb (\\<lambda>x. evala env (s x)) b\"\n  by (induct a and b) simp_all\n(*<*)end(*>*)\n\n\nsubsubsection \\<open>Example: a substitution function for terms\\<close>\n\ntext \\<open>Functions on datatypes with nested recursion are also defined\n  by mutual primitive recursion.\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype ('a, 'b) \"term\" = Var 'a | App 'b \"('a, 'b) term list\"\n\ntext \\<open>\n  A substitution function on type \\<^typ>\\<open>('a, 'b) term\\<close> can be defined as\n  follows, by working simultaneously on \\<^typ>\\<open>('a, 'b) term list\\<close>:\n\\<close>\n\nprimrec subst_term :: \"('a \\<Rightarrow> ('a, 'b) term) \\<Rightarrow> ('a, 'b) term \\<Rightarrow> ('a, 'b) term\" and\n  subst_term_list :: \"('a \\<Rightarrow> ('a, 'b) term) \\<Rightarrow> ('a, 'b) term list \\<Rightarrow> ('a, 'b) term list\"\nwhere\n  \"subst_term f (Var a) = f a\"\n| \"subst_term f (App b ts) = App b (subst_term_list f ts)\"\n| \"subst_term_list f [] = []\"\n| \"subst_term_list f (t # ts) = subst_term f t # subst_term_list f ts\"\n\ntext \\<open>\n  The recursion scheme follows the structure of the unfolded definition of\n  type \\<^typ>\\<open>('a, 'b) term\\<close>. To prove properties of this substitution\n  function, mutual induction is needed:\n\\<close>\n\nlemma \"subst_term (subst_term f1 \\<circ> f2) t =\n    subst_term f1 (subst_term f2 t)\" and\n  \"subst_term_list (subst_term f1 \\<circ> f2) ts =\n    subst_term_list f1 (subst_term_list f2 ts)\"\n  by (induct t and ts rule: subst_term.induct subst_term_list.induct) simp_all\n(*<*)end(*>*)\n\n\nsubsubsection \\<open>Example: a map function for infinitely branching trees\\<close>\n\ntext \\<open>Defining functions on infinitely branching datatypes by primitive\n  recursion is just as easy.\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype 'a tree = Atom 'a | Branch \"nat \\<Rightarrow> 'a tree\"\n\nprimrec map_tree :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a tree \\<Rightarrow> 'b tree\"\nwhere\n  \"map_tree f (Atom a) = Atom (f a)\"\n| \"map_tree f (Branch ts) = Branch (\\<lambda>x. map_tree f (ts x))\"\n\ntext \\<open>\n  Note that all occurrences of functions such as \\<open>ts\\<close> above must be applied to\n  an argument. In particular, \\<^term>\\<open>map_tree f \\<circ> ts\\<close> is not allowed here.\n\n  \\<^medskip>\n  Here is a simple composition lemma for \\<^term>\\<open>map_tree\\<close>:\n\\<close>\n\nlemma \"map_tree g (map_tree f t) = map_tree (g \\<circ> f) t\"\n  by (induct t) simp_all\n(*<*)end(*>*)\n\n\nsubsection \\<open>Proof methods related to recursive definitions\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) pat_completeness} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) relation} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) lexicographic_order} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) size_change} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) termination_simp} & : & \\<open>attribute\\<close> \\\\\n    @{method_def (HOL) induction_schema} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) relation} @{syntax term}\n    ;\n    @@{method (HOL) lexicographic_order} (@{syntax clasimpmod} * )\n    ;\n    @@{method (HOL) size_change} ( orders (@{syntax clasimpmod} * ) )\n    ;\n    @@{method (HOL) induction_schema}\n    ;\n    orders: ( 'max' | 'min' | 'ms' ) *\n  \\<close>\n\n  \\<^descr> @{method (HOL) pat_completeness} is a specialized method to solve goals\n  regarding the completeness of pattern matching, as required by the @{command\n  (HOL) \"function\"} package (cf.\\ @{cite \"isabelle-function\"}).\n\n  \\<^descr> @{method (HOL) relation}~\\<open>R\\<close> introduces a termination proof using the\n  relation \\<open>R\\<close>. The resulting proof state will contain goals expressing that\n  \\<open>R\\<close> is wellfounded, and that the arguments of recursive calls decrease with\n  respect to \\<open>R\\<close>. Usually, this method is used as the initial proof step of\n  manual termination proofs.\n\n  \\<^descr> @{method (HOL) \"lexicographic_order\"} attempts a fully automated\n  termination proof by searching for a lexicographic combination of size\n  measures on the arguments of the function. The method accepts the same\n  arguments as the @{method auto} method, which it uses internally to prove\n  local descents. The @{syntax clasimpmod} modifiers are accepted (as for\n  @{method auto}).\n\n  In case of failure, extensive information is printed, which can help to\n  analyse the situation (cf.\\ @{cite \"isabelle-function\"}).\n\n  \\<^descr> @{method (HOL) \"size_change\"} also works on termination goals, using a\n  variation of the size-change principle, together with a graph decomposition\n  technique (see @{cite krauss_phd} for details). Three kinds of orders are\n  used internally: \\<open>max\\<close>, \\<open>min\\<close>, and \\<open>ms\\<close> (multiset), which is only available\n  when the theory \\<open>Multiset\\<close> is loaded. When no order kinds are given, they\n  are tried in order. The search for a termination proof uses SAT solving\n  internally.\n\n  For local descent proofs, the @{syntax clasimpmod} modifiers are accepted\n  (as for @{method auto}).\n\n  \\<^descr> @{attribute (HOL) termination_simp} declares extra rules for the\n  simplifier, when invoked in termination proofs. This can be useful, e.g.,\n  for special rules involving size estimations.\n\n  \\<^descr> @{method (HOL) induction_schema} derives user-specified induction rules\n  from well-founded induction and completeness of patterns. This factors out\n  some operations that are done internally by the function package and makes\n  them available separately. See \\<^file>\\<open>~~/src/HOL/Examples/Induction_Schema.thy\\<close> for\n  examples.\n\\<close>\n\n\nsubsection \\<open>Functions with explicit partiality\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"partial_function\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{attribute_def (HOL) \"partial_function_mono\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) partial_function} '(' @{syntax name} ')'\n      @{syntax specification}\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"partial_function\"}~\\<open>(mode)\\<close> defines recursive functions\n  based on fixpoints in complete partial orders. No termination proof is\n  required from the user or constructed internally. Instead, the possibility\n  of non-termination is modelled explicitly in the result type, which contains\n  an explicit bottom element.\n\n  Pattern matching and mutual recursion are currently not supported. Thus, the\n  specification consists of a single function described by a single recursive\n  equation.\n\n  There are no fixed syntactic restrictions on the body of the function, but\n  the induced functional must be provably monotonic wrt.\\ the underlying\n  order. The monotonicity proof is performed internally, and the definition is\n  rejected when it fails. The proof can be influenced by declaring hints using\n  the @{attribute (HOL) partial_function_mono} attribute.\n\n  The mandatory \\<open>mode\\<close> argument specifies the mode of operation of the\n  command, which directly corresponds to a complete partial order on the\n  result type. By default, the following modes are defined:\n\n    \\<^descr> \\<open>option\\<close> defines functions that map into the \\<^type>\\<open>option\\<close> type. Here,\n    the value \\<^term>\\<open>None\\<close> is used to model a non-terminating computation.\n    Monotonicity requires that if \\<^term>\\<open>None\\<close> is returned by a recursive\n    call, then the overall result must also be \\<^term>\\<open>None\\<close>. This is best\n    achieved through the use of the monadic operator \\<^const>\\<open>Option.bind\\<close>.\n\n    \\<^descr> \\<open>tailrec\\<close> defines functions with an arbitrary result type and uses the\n    slightly degenerated partial order where \\<^term>\\<open>undefined\\<close> is the bottom\n    element. Now, monotonicity requires that if \\<^term>\\<open>undefined\\<close> is returned\n    by a recursive call, then the overall result must also be \\<^term>\\<open>undefined\\<close>. In practice, this is only satisfied when each recursive call\n    is a tail call, whose result is directly returned. Thus, this mode of\n    operation allows the definition of arbitrary tail-recursive functions.\n\n  Experienced users may define new modes by instantiating the locale \\<^const>\\<open>partial_function_definitions\\<close> appropriately.\n\n  \\<^descr> @{attribute (HOL) partial_function_mono} declares rules for use in the\n  internal monotonicity proofs of partial function definitions.\n\\<close>\n\n\nsubsection \\<open>Old-style recursive function definitions (TFL)\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"recdef\"} & : & \\<open>theory \\<rightarrow> theory)\\<close> \\\\\n  \\end{matharray}\n\n  The old TFL command @{command (HOL) \"recdef\"} for defining recursive is\n  mostly obsolete; @{command (HOL) \"function\"} or @{command (HOL) \"fun\"}\n  should be used instead.\n\n  \\<^rail>\\<open>\n    @@{command (HOL) recdef} ('(' @'permissive' ')')? \\<newline>\n      @{syntax name} @{syntax term} (@{syntax prop} +) hints?\n    ;\n    hints: '(' @'hints' ( recdefmod * ) ')'\n    ;\n    recdefmod: (('recdef_simp' | 'recdef_cong' | 'recdef_wf')\n      (() | 'add' | 'del') ':' @{syntax thms}) | @{syntax clasimpmod}\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"recdef\"} defines general well-founded recursive functions\n  (using the TFL package). The ``\\<open>(permissive)\\<close>'' option tells TFL to recover\n  from failed proof attempts, returning unfinished results. The \\<open>recdef_simp\\<close>,\n  \\<open>recdef_cong\\<close>, and \\<open>recdef_wf\\<close> hints refer to auxiliary rules to be used in\n  the internal automated proof process of TFL. Additional @{syntax clasimpmod}\n  declarations may be given to tune the context of the Simplifier (cf.\\\n  \\secref{sec:simplifier}) and Classical reasoner (cf.\\\n  \\secref{sec:classical}).\n\n\n  \\<^medskip>\n  Hints for @{command (HOL) \"recdef\"} may be also declared globally, using the\n  following attributes.\n\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) recdef_simp} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) recdef_cong} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) recdef_wf} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    (@@{attribute (HOL) recdef_simp} | @@{attribute (HOL) recdef_cong} |\n      @@{attribute (HOL) recdef_wf}) (() | 'add' | 'del')\n  \\<close>\n\\<close>\n\n\nsection \\<open>Adhoc overloading of constants\\<close>\n\ntext \\<open>\n  \\begin{tabular}{rcll}\n  @{command_def \"adhoc_overloading\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  @{command_def \"no_adhoc_overloading\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  @{attribute_def \"show_variants\"} & : & \\<open>attribute\\<close> & default \\<open>false\\<close> \\\\\n  \\end{tabular}\n\n  \\<^medskip>\n  Adhoc overloading allows to overload a constant depending on its type.\n  Typically this involves the introduction of an uninterpreted constant (used\n  for input and output) and the addition of some variants (used internally).\n  For examples see \\<^file>\\<open>~~/src/HOL/Examples/Adhoc_Overloading_Examples.thy\\<close> and\n  \\<^file>\\<open>~~/src/HOL/Library/Monad_Syntax.thy\\<close>.\n\n  \\<^rail>\\<open>\n    (@@{command adhoc_overloading} | @@{command no_adhoc_overloading})\n      (@{syntax name} (@{syntax term} + ) + @'and')\n  \\<close>\n\n  \\<^descr> @{command \"adhoc_overloading\"}~\\<open>c v\\<^sub>1 ... v\\<^sub>n\\<close> associates variants with an\n  existing constant.\n\n  \\<^descr> @{command \"no_adhoc_overloading\"} is similar to @{command\n  \"adhoc_overloading\"}, but removes the specified variants from the present\n  context.\n\n  \\<^descr> @{attribute \"show_variants\"} controls printing of variants of overloaded\n  constants. If enabled, the internally used variants are printed instead of\n  their respective overloaded constants. This is occasionally useful to check\n  whether the system agrees with a user's expectations about derived variants.\n\\<close>\n\n\nsection \\<open>Definition by specification \\label{sec:hol-specification}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"specification\"} & : & \\<open>theory \\<rightarrow> proof(prove)\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) specification} '(' (decl +) ')' \\<newline>\n      (@{syntax thmdecl}? @{syntax prop} +)\n    ;\n    decl: (@{syntax name} ':')? @{syntax term} ('(' @'overloaded' ')')?\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"specification\"}~\\<open>decls \\<phi>\\<close> sets up a goal stating the\n  existence of terms with the properties specified to hold for the constants\n  given in \\<open>decls\\<close>. After finishing the proof, the theory will be augmented\n  with definitions for the given constants, as well as with theorems stating\n  the properties for these constants.\n\n  \\<open>decl\\<close> declares a constant to be defined by the specification given. The\n  definition for the constant \\<open>c\\<close> is bound to the name \\<open>c_def\\<close> unless a\n  theorem name is given in the declaration. Overloaded constants should be\n  declared as such.\n\\<close>\n\n\nsection \\<open>Old-style datatypes \\label{sec:hol-datatype}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"old_rep_datatype\"} & : & \\<open>theory \\<rightarrow> proof(prove)\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) old_rep_datatype} ('(' (@{syntax name} +) ')')? (@{syntax term} +)\n    ;\n\n    spec: @{syntax typespec_sorts} @{syntax mixfix}? '=' (cons + '|')\n    ;\n    cons: @{syntax name} (@{syntax type} * ) @{syntax mixfix}?\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"old_rep_datatype\"} represents existing types as\n  old-style datatypes.\n\n\n  These commands are mostly obsolete; @{command (HOL) \"datatype\"} should be\n  used instead.\n\n  See @{cite \"isabelle-datatypes\"} for more details on datatypes. Apart from\n  proper proof methods for case analysis and induction, there are also\n  emulations of ML tactics @{method (HOL) case_tac} and @{method (HOL)\n  induct_tac} available, see \\secref{sec:hol-induct-tac}; these admit to refer\n  directly to the internal structure of subgoals (including internally bound\n  parameters).\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>\n  We define a type of finite sequences, with slightly different names than the\n  existing \\<^typ>\\<open>'a list\\<close> that is already in \\<^theory>\\<open>Main\\<close>:\n\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype 'a seq = Empty | Seq 'a \"'a seq\"\n\ntext \\<open>We can now prove some simple lemma by structural induction:\\<close>\n\nlemma \"Seq x xs \\<noteq> xs\"\nproof (induct xs arbitrary: x)\n  case Empty\n  txt \\<open>This case can be proved using the simplifier: the freeness\n    properties of the datatype are already declared as @{attribute\n    simp} rules.\\<close>\n  show \"Seq x Empty \\<noteq> Empty\"\n    by simp\nnext\n  case (Seq y ys)\n  txt \\<open>The step case is proved similarly.\\<close>\n  show \"Seq x (Seq y ys) \\<noteq> Seq y ys\"\n    using \\<open>Seq y ys \\<noteq> ys\\<close> by simp\nqed\n\ntext \\<open>Here is a more succinct version of the same proof:\\<close>\n\nlemma \"Seq x xs \\<noteq> xs\"\n  by (induct xs arbitrary: x) simp_all\n(*<*)end(*>*)\n\n\nsection \\<open>Records \\label{sec:hol-record}\\<close>\n\ntext \\<open>\n  In principle, records merely generalize the concept of tuples, where\n  components may be addressed by labels instead of just position. The logical\n  infrastructure of records in Isabelle/HOL is slightly more advanced, though,\n  supporting truly extensible record schemes. This admits operations that are\n  polymorphic with respect to record extension, yielding ``object-oriented''\n  effects like (single) inheritance. See also @{cite \"NaraschewskiW-TPHOLs98\"}\n  for more details on object-oriented verification and record subtyping in\n  HOL.\n\\<close>\n\n\nsubsection \\<open>Basic concepts\\<close>\n\ntext \\<open>\n  Isabelle/HOL supports both \\<^emph>\\<open>fixed\\<close> and \\<^emph>\\<open>schematic\\<close> records at the level of\n  terms and types. The notation is as follows:\n\n  \\begin{center}\n  \\begin{tabular}{l|l|l}\n    & record terms & record types \\\\ \\hline\n    fixed & \\<open>\\<lparr>x = a, y = b\\<rparr>\\<close> & \\<open>\\<lparr>x :: A, y :: B\\<rparr>\\<close> \\\\\n    schematic & \\<open>\\<lparr>x = a, y = b, \\<dots> = m\\<rparr>\\<close> &\n      \\<open>\\<lparr>x :: A, y :: B, \\<dots> :: M\\<rparr>\\<close> \\\\\n  \\end{tabular}\n  \\end{center}\n\n  The ASCII representation of \\<open>\\<lparr>x = a\\<rparr>\\<close> is \\<open>(| x = a |)\\<close>.\n\n  A fixed record \\<open>\\<lparr>x = a, y = b\\<rparr>\\<close> has field \\<open>x\\<close> of value \\<open>a\\<close> and field \\<open>y\\<close> of\n  value \\<open>b\\<close>. The corresponding type is \\<open>\\<lparr>x :: A, y :: B\\<rparr>\\<close>, assuming that \\<open>a ::\n  A\\<close> and \\<open>b :: B\\<close>.\n\n  A record scheme like \\<open>\\<lparr>x = a, y = b, \\<dots> = m\\<rparr>\\<close> contains fields \\<open>x\\<close> and \\<open>y\\<close> as\n  before, but also possibly further fields as indicated by the ``\\<open>\\<dots>\\<close>''\n  notation (which is actually part of the syntax). The improper field ``\\<open>\\<dots>\\<close>''\n  of a record scheme is called the \\<^emph>\\<open>more part\\<close>. Logically it is just a free\n  variable, which is occasionally referred to as ``row variable'' in the\n  literature. The more part of a record scheme may be instantiated by zero or\n  more further components. For example, the previous scheme may get\n  instantiated to \\<open>\\<lparr>x = a, y = b, z = c, \\<dots> = m'\\<rparr>\\<close>, where \\<open>m'\\<close> refers to a\n  different more part. Fixed records are special instances of record schemes,\n  where ``\\<open>\\<dots>\\<close>'' is properly terminated by the \\<open>() :: unit\\<close> element. In fact,\n  \\<open>\\<lparr>x = a, y = b\\<rparr>\\<close> is just an abbreviation for \\<open>\\<lparr>x = a, y = b, \\<dots> = ()\\<rparr>\\<close>.\n\n  \\<^medskip>\n  Two key observations make extensible records in a simply typed language like\n  HOL work out:\n\n  \\<^enum> the more part is internalized, as a free term or type variable,\n\n  \\<^enum> field names are externalized, they cannot be accessed within the logic as\n  first-class values.\n\n\n  \\<^medskip>\n  In Isabelle/HOL record types have to be defined explicitly, fixing their\n  field names and types, and their (optional) parent record. Afterwards,\n  records may be formed using above syntax, while obeying the canonical order\n  of fields as given by their declaration. The record package provides several\n  standard operations like selectors and updates. The common setup for various\n  generic proof tools enable succinct reasoning patterns. See also the\n  Isabelle/HOL tutorial @{cite \"isabelle-hol-book\"} for further instructions\n  on using records in practice.\n\\<close>\n\n\nsubsection \\<open>Record specifications\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"record\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"print_record\"} & : & \\<open>context \\<rightarrow>\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) record} @{syntax \"overloaded\"}? @{syntax typespec_sorts} '=' \\<newline>\n      (@{syntax type} '+')? (constdecl +)\n    ;\n    constdecl: @{syntax name} '::' @{syntax type} @{syntax mixfix}?\n    ;\n    @@{command (HOL) print_record} modes? @{syntax typespec_sorts}\n    ;\n    modes: '(' (@{syntax name} +) ')'\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"record\"}~\\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t = \\<tau> + c\\<^sub>1 :: \\<sigma>\\<^sub>1 \\<dots> c\\<^sub>n :: \\<sigma>\\<^sub>n\\<close>\n  defines extensible record type \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close>, derived from the optional\n  parent record \\<open>\\<tau>\\<close> by adding new field components \\<open>c\\<^sub>i :: \\<sigma>\\<^sub>i\\<close> etc.\n\n  The type variables of \\<open>\\<tau>\\<close> and \\<open>\\<sigma>\\<^sub>i\\<close> need to be covered by the (distinct)\n  parameters \\<open>\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m\\<close>. Type constructor \\<open>t\\<close> has to be new, while \\<open>\\<tau>\\<close>\n  needs to specify an instance of an existing record type. At least one new\n  field \\<open>c\\<^sub>i\\<close> has to be specified. Basically, field names need to belong to a\n  unique record. This is not a real restriction in practice, since fields are\n  qualified by the record name internally.\n\n  The parent record specification \\<open>\\<tau>\\<close> is optional; if omitted \\<open>t\\<close> becomes a\n  root record. The hierarchy of all records declared within a theory context\n  forms a forest structure, i.e.\\ a set of trees starting with a root record\n  each. There is no way to merge multiple parent records!\n\n  For convenience, \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close> is made a type abbreviation for the fixed\n  record type \\<open>\\<lparr>c\\<^sub>1 :: \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n\\<rparr>\\<close>, likewise is \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m, \\<zeta>)\n  t_scheme\\<close> made an abbreviation for \\<open>\\<lparr>c\\<^sub>1 :: \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n, \\<dots> :: \\<zeta>\\<rparr>\\<close>.\n\n  \\<^descr> @{command (HOL) \"print_record\"}~\\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close> prints the definition of\n  record \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close>. Optionally \\<open>modes\\<close> can be specified, which are\n  appended to the current print mode; see \\secref{sec:print-modes}.\n\\<close>\n\n\nsubsection \\<open>Record operations\\<close>\n\ntext \\<open>\n  Any record definition of the form presented above produces certain standard\n  operations. Selectors and updates are provided for any field, including the\n  improper one ``\\<open>more\\<close>''. There are also cumulative record constructor\n  functions. To simplify the presentation below, we assume for now that \\<open>(\\<alpha>\\<^sub>1,\n  \\<dots>, \\<alpha>\\<^sub>m) t\\<close> is a root record with fields \\<open>c\\<^sub>1 :: \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n\\<close>.\n\n  \\<^medskip>\n  \\<^bold>\\<open>Selectors\\<close> and \\<^bold>\\<open>updates\\<close> are available for any\n  field (including ``\\<open>more\\<close>''):\n\n  \\begin{matharray}{lll}\n    \\<open>c\\<^sub>i\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<sigma>\\<^sub>i\\<close> \\\\\n    \\<open>c\\<^sub>i_update\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>i \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\\<close> \\\\\n  \\end{matharray}\n\n  There is special syntax for application of updates: \\<open>r\\<lparr>x := a\\<rparr>\\<close> abbreviates\n  term \\<open>x_update a r\\<close>. Further notation for repeated updates is also\n  available: \\<open>r\\<lparr>x := a\\<rparr>\\<lparr>y := b\\<rparr>\\<lparr>z := c\\<rparr>\\<close> may be written \\<open>r\\<lparr>x := a, y := b, z\n  := c\\<rparr>\\<close>. Note that because of postfix notation the order of fields shown here\n  is reverse than in the actual term. Since repeated updates are just function\n  applications, fields may be freely permuted in \\<open>\\<lparr>x := a, y := b, z := c\\<rparr>\\<close>,\n  as far as logical equality is concerned. Thus commutativity of independent\n  updates can be proven within the logic for any two fields, but not as a\n  general theorem.\n\n  \\<^medskip>\n  The \\<^bold>\\<open>make\\<close> operation provides a cumulative record constructor function:\n\n  \\begin{matharray}{lll}\n    \\<open>t.make\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n  \\end{matharray}\n\n  \\<^medskip>\n  We now reconsider the case of non-root records, which are derived of some\n  parent. In general, the latter may depend on another parent as well,\n  resulting in a list of \\<^emph>\\<open>ancestor records\\<close>. Appending the lists of fields of\n  all ancestors results in a certain field prefix. The record package\n  automatically takes care of this by lifting operations over this context of\n  ancestor fields. Assuming that \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close> has ancestor fields \\<open>b\\<^sub>1 ::\n  \\<rho>\\<^sub>1, \\<dots>, b\\<^sub>k :: \\<rho>\\<^sub>k\\<close>, the above record operations will get the following\n  types:\n\n  \\<^medskip>\n  \\begin{tabular}{lll}\n    \\<open>c\\<^sub>i\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<sigma>\\<^sub>i\\<close> \\\\\n    \\<open>c\\<^sub>i_update\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>i \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\\<close> \\\\\n    \\<open>t.make\\<close> & \\<open>::\\<close> & \\<open>\\<rho>\\<^sub>1 \\<Rightarrow> \\<dots> \\<rho>\\<^sub>k \\<Rightarrow> \\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n  \\end{tabular}\n  \\<^medskip>\n\n  Some further operations address the extension aspect of a derived record\n  scheme specifically: \\<open>t.fields\\<close> produces a record fragment consisting of\n  exactly the new fields introduced here (the result may serve as a more part\n  elsewhere); \\<open>t.extend\\<close> takes a fixed record and adds a given more part;\n  \\<open>t.truncate\\<close> restricts a record scheme to a fixed record.\n\n  \\<^medskip>\n  \\begin{tabular}{lll}\n    \\<open>t.fields\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n    \\<open>t.extend\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr> \\<Rightarrow>\n      \\<zeta> \\<Rightarrow> \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\\<close> \\\\\n    \\<open>t.truncate\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n  \\end{tabular}\n  \\<^medskip>\n\n  Note that \\<open>t.make\\<close> and \\<open>t.fields\\<close> coincide for root records.\n\\<close>\n\n\nsubsection \\<open>Derived rules and proof tools\\<close>\n\ntext \\<open>\n  The record package proves several results internally, declaring these facts\n  to appropriate proof tools. This enables users to reason about record\n  structures quite conveniently. Assume that \\<open>t\\<close> is a record type as specified\n  above.\n\n  \\<^enum> Standard conversions for selectors or updates applied to record\n  constructor terms are made part of the default Simplifier context; thus\n  proofs by reduction of basic operations merely require the @{method simp}\n  method without further arguments. These rules are available as \\<open>t.simps\\<close>,\n  too.\n\n  \\<^enum> Selectors applied to updated records are automatically reduced by an\n  internal simplification procedure, which is also part of the standard\n  Simplifier setup.\n\n  \\<^enum> Inject equations of a form analogous to \\<^prop>\\<open>(x, y) = (x', y') \\<equiv> x = x'\n  \\<and> y = y'\\<close> are declared to the Simplifier and Classical Reasoner as\n  @{attribute iff} rules. These rules are available as \\<open>t.iffs\\<close>.\n\n  \\<^enum> The introduction rule for record equality analogous to \\<open>x r = x r' \\<Longrightarrow> y r =\n  y r' \\<dots> \\<Longrightarrow> r = r'\\<close> is declared to the Simplifier, and as the basic rule\n  context as ``@{attribute intro}\\<open>?\\<close>''. The rule is called \\<open>t.equality\\<close>.\n\n  \\<^enum> Representations of arbitrary record expressions as canonical constructor\n  terms are provided both in @{method cases} and @{method induct} format (cf.\\\n  the generic proof methods of the same name, \\secref{sec:cases-induct}).\n  Several variations are available, for fixed records, record schemes, more\n  parts etc.\n\n  The generic proof methods are sufficiently smart to pick the most sensible\n  rule according to the type of the indicated record expression: users just\n  need to apply something like ``\\<open>(cases r)\\<close>'' to a certain proof problem.\n\n  \\<^enum> The derived record operations \\<open>t.make\\<close>, \\<open>t.fields\\<close>, \\<open>t.extend\\<close>,\n  \\<open>t.truncate\\<close> are \\<^emph>\\<open>not\\<close> treated automatically, but usually need to be\n  expanded by hand, using the collective fact \\<open>t.defs\\<close>.\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>See \\<^file>\\<open>~~/src/HOL/Examples/Records.thy\\<close>, for example.\\<close>\n\n\nsection \\<open>Semantic subtype definitions \\label{sec:hol-typedef}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"typedef\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close> \\\\\n  \\end{matharray}\n\n  A type definition identifies a new type with a non-empty subset of an\n  existing type. More precisely, the new type is defined by exhibiting an\n  existing type \\<open>\\<tau>\\<close>, a set \\<open>A :: \\<tau> set\\<close>, and proving \\<^prop>\\<open>\\<exists>x. x \\<in> A\\<close>. Thus\n  \\<open>A\\<close> is a non-empty subset of \\<open>\\<tau>\\<close>, and the new type denotes this subset. New\n  functions are postulated that establish an isomorphism between the new type\n  and the subset. In general, the type \\<open>\\<tau>\\<close> may involve type variables \\<open>\\<alpha>\\<^sub>1, \\<dots>,\n  \\<alpha>\\<^sub>n\\<close> which means that the type definition produces a type constructor \\<open>(\\<alpha>\\<^sub>1,\n  \\<dots>, \\<alpha>\\<^sub>n) t\\<close> depending on those type arguments.\n\n  \\<^rail>\\<open>\n    @@{command (HOL) typedef} @{syntax \"overloaded\"}? abs_type '=' rep_set\n    ;\n    @{syntax_def \"overloaded\"}: ('(' @'overloaded' ')')\n    ;\n    abs_type: @{syntax typespec_sorts} @{syntax mixfix}?\n    ;\n    rep_set: @{syntax term} (@'morphisms' @{syntax name} @{syntax name})?\n  \\<close>\n\n  To understand the concept of type definition better, we need to recount its\n  somewhat complex history. The HOL logic goes back to the ``Simple Theory of\n  Types'' (STT) of A. Church @{cite \"church40\"}, which is further explained in\n  the book by P. Andrews @{cite \"andrews86\"}. The overview article by W.\n  Farmer @{cite \"Farmer:2008\"} points out the ``seven virtues'' of this\n  relatively simple family of logics. STT has only ground types, without\n  polymorphism and without type definitions.\n\n  \\<^medskip>\n  M. Gordon @{cite \"Gordon:1985:HOL\"} augmented Church's STT by adding\n  schematic polymorphism (type variables and type constructors) and a facility\n  to introduce new types as semantic subtypes from existing types. This\n  genuine extension of the logic was explained semantically by A. Pitts in the\n  book of the original Cambridge HOL88 system @{cite \"pitts93\"}. Type\n  definitions work in this setting, because the general model-theory of STT is\n  restricted to models that ensure that the universe of type interpretations\n  is closed by forming subsets (via predicates taken from the logic).\n\n  \\<^medskip>\n  Isabelle/HOL goes beyond Gordon-style HOL by admitting overloaded constant\n  definitions @{cite \"Wenzel:1997:TPHOL\" and \"Haftmann-Wenzel:2006:classes\"},\n  which are actually a concept of Isabelle/Pure and do not depend on\n  particular set-theoretic semantics of HOL. Over many years, there was no\n  formal checking of semantic type definitions in Isabelle/HOL versus\n  syntactic constant definitions in Isabelle/Pure. So the @{command typedef}\n  command was described as ``axiomatic'' in the sense of\n  \\secref{sec:axiomatizations}, only with some local checks of the given type\n  and its representing set.\n\n  Recent clarification of overloading in the HOL logic proper @{cite\n  \"Kuncar-Popescu:2015\"} demonstrates how the dissimilar concepts of constant\n  definitions versus type definitions may be understood uniformly. This\n  requires an interpretation of Isabelle/HOL that substantially reforms the\n  set-theoretic model of A. Pitts @{cite \"pitts93\"}, by taking a schematic\n  view on polymorphism and interpreting only ground types in the set-theoretic\n  sense of HOL88. Moreover, type-constructors may be explicitly overloaded,\n  e.g.\\ by making the subset depend on type-class parameters (cf.\\\n  \\secref{sec:class}). This is semantically like a dependent type: the meaning\n  relies on the operations provided by different type-class instances.\n\n  \\<^descr> @{command (HOL) \"typedef\"}~\\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n) t = A\\<close> defines a new type \\<open>(\\<alpha>\\<^sub>1,\n  \\<dots>, \\<alpha>\\<^sub>n) t\\<close> from the set \\<open>A\\<close> over an existing type. The set \\<open>A\\<close> may contain\n  type variables \\<open>\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n\\<close> as specified on the LHS, but no term variables.\n  Non-emptiness of \\<open>A\\<close> needs to be proven on the spot, in order to turn the\n  internal conditional characterization into usable theorems.\n\n  The ``\\<open>(overloaded)\\<close>'' option allows the @{command \"typedef\"} specification\n  to depend on constants that are not (yet) specified and thus left open as\n  parameters, e.g.\\ type-class parameters.\n\n  Within a local theory specification, the newly introduced type constructor\n  cannot depend on parameters or assumptions of the context: this is\n  syntactically impossible in HOL. The non-emptiness proof may formally depend\n  on local assumptions, but this has little practical relevance.\n\n  For @{command (HOL) \"typedef\"}~\\<open>t = A\\<close> the newly introduced type \\<open>t\\<close> is\n  accompanied by a pair of morphisms to relate it to the representing set over\n  the old type. By default, the injection from type to set is called \\<open>Rep_t\\<close>\n  and its inverse \\<open>Abs_t\\<close>: An explicit @{keyword (HOL) \"morphisms\"}\n  specification allows to provide alternative names.\n\n  The logical characterization of @{command typedef} uses the predicate of\n  locale \\<^const>\\<open>type_definition\\<close> that is defined in Isabelle/HOL. Various\n  basic consequences of that are instantiated accordingly, re-using the locale\n  facts with names derived from the new type constructor. Thus the generic\n  theorem @{thm type_definition.Rep} is turned into the specific \\<open>Rep_t\\<close>, for\n  example.\n\n  Theorems @{thm type_definition.Rep}, @{thm type_definition.Rep_inverse}, and\n  @{thm type_definition.Abs_inverse} provide the most basic characterization\n  as a corresponding injection/surjection pair (in both directions). The\n  derived rules @{thm type_definition.Rep_inject} and @{thm\n  type_definition.Abs_inject} provide a more convenient version of\n  injectivity, suitable for automated proof tools (e.g.\\ in declarations\n  involving @{attribute simp} or @{attribute iff}). Furthermore, the rules\n  @{thm type_definition.Rep_cases}~/ @{thm type_definition.Rep_induct}, and\n  @{thm type_definition.Abs_cases}~/ @{thm type_definition.Abs_induct} provide\n  alternative views on surjectivity. These rules are already declared as set\n  or type rules for the generic @{method cases} and @{method induct} methods,\n  respectively.\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>\n  The following trivial example pulls a three-element type into existence\n  within the formal logical environment of Isabelle/HOL.\\<close>\n\n(*<*)experiment begin(*>*)\ntypedef three = \"{(True, True), (True, False), (False, True)}\"\n  by blast\n\ndefinition \"One = Abs_three (True, True)\"\ndefinition \"Two = Abs_three (True, False)\"\ndefinition \"Three = Abs_three (False, True)\"\n\nlemma three_distinct: \"One \\<noteq> Two\"  \"One \\<noteq> Three\"  \"Two \\<noteq> Three\"\n  by (simp_all add: One_def Two_def Three_def Abs_three_inject)\n\nlemma three_cases:\n  fixes x :: three obtains \"x = One\" | \"x = Two\" | \"x = Three\"\n  by (cases x) (auto simp: One_def Two_def Three_def Abs_three_inject)\n(*<*)end(*>*)\n\ntext \\<open>Note that such trivial constructions are better done with\n  derived specification mechanisms such as @{command datatype}:\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype three = One | Two | Three\n(*<*)end(*>*)\n\ntext \\<open>This avoids re-doing basic definitions and proofs from the\n  primitive @{command typedef} above.\\<close>\n\n\n\nsection \\<open>Functorial structure of types\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"functor\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) functor} (@{syntax name} ':')? @{syntax term}\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"functor\"}~\\<open>prefix: m\\<close> allows to prove and register\n  properties about the functorial structure of type constructors. These\n  properties then can be used by other packages to deal with those type\n  constructors in certain type constructions. Characteristic theorems are\n  noted in the current local theory. By default, they are prefixed with the\n  base name of the type constructor, an explicit prefix can be given\n  alternatively.\n\n  The given term \\<open>m\\<close> is considered as \\<^emph>\\<open>mapper\\<close> for the corresponding type\n  constructor and must conform to the following type pattern:\n\n  \\begin{matharray}{lll}\n    \\<open>m\\<close> & \\<open>::\\<close> &\n      \\<open>\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>k \\<Rightarrow> (\\<^vec>\\<alpha>\\<^sub>n) t \\<Rightarrow> (\\<^vec>\\<beta>\\<^sub>n) t\\<close> \\\\\n  \\end{matharray}\n\n  where \\<open>t\\<close> is the type constructor, \\<open>\\<^vec>\\<alpha>\\<^sub>n\\<close> and \\<open>\\<^vec>\\<beta>\\<^sub>n\\<close> are\n  distinct type variables free in the local theory and \\<open>\\<sigma>\\<^sub>1\\<close>, \\ldots, \\<open>\\<sigma>\\<^sub>k\\<close> is\n  a subsequence of \\<open>\\<alpha>\\<^sub>1 \\<Rightarrow> \\<beta>\\<^sub>1\\<close>, \\<open>\\<beta>\\<^sub>1 \\<Rightarrow> \\<alpha>\\<^sub>1\\<close>, \\ldots, \\<open>\\<alpha>\\<^sub>n \\<Rightarrow> \\<beta>\\<^sub>n\\<close>, \\<open>\\<beta>\\<^sub>n \\<Rightarrow> \\<alpha>\\<^sub>n\\<close>.\n\\<close>\n\n\nsection \\<open>Quotient types with lifting and transfer\\<close>\n\ntext \\<open>\n  The quotient package defines a new quotient type given a raw type and a\n  partial equivalence relation (\\secref{sec:quotient-type}). The package also\n  historically includes automation for transporting definitions and theorems\n  (\\secref{sec:old-quotient}), but most of this automation was superseded by\n  the Lifting (\\secref{sec:lifting}) and Transfer (\\secref{sec:transfer})\n  packages.\n\\<close>\n\n\nsubsection \\<open>Quotient type definition \\label{sec:quotient-type}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"quotient_type\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) quotient_type} @{syntax \"overloaded\"}? \\<newline>\n      @{syntax typespec} @{syntax mixfix}? '=' quot_type \\<newline>\n      quot_morphisms? quot_parametric?\n    ;\n    quot_type: @{syntax type} '/' ('partial' ':')? @{syntax term}\n    ;\n    quot_morphisms: @'morphisms' @{syntax name} @{syntax name}\n    ;\n    quot_parametric: @'parametric' @{syntax thm}\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"quotient_type\"} defines a new quotient type \\<open>\\<tau>\\<close>. The\n  injection from a quotient type to a raw type is called \\<open>rep_\\<tau>\\<close>, its inverse\n  \\<open>abs_\\<tau>\\<close> unless explicit @{keyword (HOL) \"morphisms\"} specification provides\n  alternative names. @{command (HOL) \"quotient_type\"} requires the user to\n  prove that the relation is an equivalence relation (predicate \\<open>equivp\\<close>),\n  unless the user specifies explicitly \\<open>partial\\<close> in which case the obligation\n  is \\<open>part_equivp\\<close>. A quotient defined with \\<open>partial\\<close> is weaker in the sense\n  that less things can be proved automatically.\n\n  The command internally proves a Quotient theorem and sets up the Lifting\n  package by the command @{command (HOL) setup_lifting}. Thus the Lifting and\n  Transfer packages can be used also with quotient types defined by @{command\n  (HOL) \"quotient_type\"} without any extra set-up. The parametricity theorem\n  for the equivalence relation R can be provided as an extra argument of the\n  command and is passed to the corresponding internal call of @{command (HOL)\n  setup_lifting}. This theorem allows the Lifting package to generate a\n  stronger transfer rule for equality.\n\\<close>\n\n\nsubsection \\<open>Lifting package \\label{sec:lifting}\\<close>\n\ntext \\<open>\n  The Lifting package allows users to lift terms of the raw type to the\n  abstract type, which is a necessary step in building a library for an\n  abstract type. Lifting defines a new constant by combining coercion\n  functions (\\<^term>\\<open>Abs\\<close> and \\<^term>\\<open>Rep\\<close>) with the raw term. It also proves an\n  appropriate transfer rule for the Transfer (\\secref{sec:transfer}) package\n  and, if possible, an equation for the code generator.\n\n  The Lifting package provides two main commands: @{command (HOL)\n  \"setup_lifting\"} for initializing the package to work with a new type, and\n  @{command (HOL) \"lift_definition\"} for lifting constants. The Lifting\n  package works with all four kinds of type abstraction: type copies,\n  subtypes, total quotients and partial quotients.\n\n  Theoretical background can be found in @{cite\n  \"Huffman-Kuncar:2013:lifting_transfer\"}.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"setup_lifting\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close>\\\\\n    @{command_def (HOL) \"lift_definition\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\\\\\n    @{command_def (HOL) \"lifting_forget\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close>\\\\\n    @{command_def (HOL) \"lifting_update\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close>\\\\\n    @{command_def (HOL) \"print_quot_maps\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{command_def (HOL) \"print_quotients\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{attribute_def (HOL) \"quot_map\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_eq_onp\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_mono\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_distr\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_del\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"lifting_restore\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) setup_lifting} @{syntax thm} @{syntax thm}? \\<newline>\n      (@'parametric' @{syntax thm})?\n    ;\n    @@{command (HOL) lift_definition} ('(' 'code_dt' ')')? \\<newline>\n      @{syntax name} '::' @{syntax type} @{syntax mixfix}? 'is' @{syntax term} \\<newline>\n      (@'parametric' (@{syntax thm}+))?\n    ;\n    @@{command (HOL) lifting_forget} @{syntax name}\n    ;\n    @@{command (HOL) lifting_update} @{syntax name}\n    ;\n    @@{attribute (HOL) lifting_restore}\n      @{syntax thm} (@{syntax thm} @{syntax thm})?\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"setup_lifting\"} Sets up the Lifting package to work with\n  a user-defined type. The command supports two modes.\n\n    \\<^enum> The first one is a low-level mode when the user must provide as a first\n    argument of @{command (HOL) \"setup_lifting\"} a quotient theorem \\<^term>\\<open>Quotient R Abs Rep T\\<close>. The package configures a transfer rule for\n    equality, a domain transfer rules and sets up the @{command_def (HOL)\n    \"lift_definition\"} command to work with the abstract type. An optional\n    theorem \\<^term>\\<open>reflp R\\<close>, which certifies that the equivalence relation R\n    is total, can be provided as a second argument. This allows the package to\n    generate stronger transfer rules. And finally, the parametricity theorem\n    for \\<^term>\\<open>R\\<close> can be provided as a third argument. This allows the package\n    to generate a stronger transfer rule for equality.\n\n    Users generally will not prove the \\<open>Quotient\\<close> theorem manually for new\n    types, as special commands exist to automate the process.\n\n    \\<^enum> When a new subtype is defined by @{command (HOL) typedef}, @{command\n    (HOL) \"lift_definition\"} can be used in its second mode, where only the\n    \\<^term>\\<open>type_definition\\<close> theorem \\<^term>\\<open>type_definition Rep Abs A\\<close> is\n    used as an argument of the command. The command internally proves the\n    corresponding \\<^term>\\<open>Quotient\\<close> theorem and registers it with @{command\n    (HOL) setup_lifting} using its first mode.\n\n  For quotients, the command @{command (HOL) quotient_type} can be used. The\n  command defines a new quotient type and similarly to the previous case, the\n  corresponding Quotient theorem is proved and registered by @{command (HOL)\n  setup_lifting}.\n\n  \\<^medskip>\n  The command @{command (HOL) \"setup_lifting\"} also sets up the code generator\n  for the new type. Later on, when a new constant is defined by @{command\n  (HOL) \"lift_definition\"}, the Lifting package proves and registers a code\n  equation (if there is one) for the new constant.\n\n  \\<^descr> @{command (HOL) \"lift_definition\"} \\<open>f :: \\<tau>\\<close> @{keyword (HOL) \"is\"} \\<open>t\\<close>\n  Defines a new function \\<open>f\\<close> with an abstract type \\<open>\\<tau>\\<close> in terms of a\n  corresponding operation \\<open>t\\<close> on a representation type. More formally, if \\<open>t\n  :: \\<sigma>\\<close>, then the command builds a term \\<open>F\\<close> as a corresponding combination of\n  abstraction and representation functions such that \\<open>F :: \\<sigma> \\<Rightarrow> \\<tau>\\<close> and defines\n  \\<open>f \\<equiv> F t\\<close>. The term \\<open>t\\<close> does not have to be necessarily a constant but it\n  can be any term.\n\n  The command opens a proof and the user must discharge a respectfulness proof\n  obligation. For a type copy, i.e.\\ a typedef with \\<open>UNIV\\<close>, the obligation is\n  discharged automatically. The proof goal is presented in a user-friendly,\n  readable form. A respectfulness theorem in the standard format \\<open>f.rsp\\<close> and a\n  transfer rule \\<open>f.transfer\\<close> for the Transfer package are generated by the\n  package.\n\n  The user can specify a parametricity theorems for \\<open>t\\<close> after the keyword\n  @{keyword \"parametric\"}, which allows the command to generate parametric\n  transfer rules for \\<open>f\\<close>.\n\n  For each constant defined through trivial quotients (type copies or\n  subtypes) \\<open>f.rep_eq\\<close> is generated. The equation is a code certificate that\n  defines \\<open>f\\<close> using the representation function.\n\n  For each constant \\<open>f.abs_eq\\<close> is generated. The equation is unconditional for\n  total quotients. The equation defines \\<open>f\\<close> using the abstraction function.\n\n  \\<^medskip>\n  Integration with [@{attribute code} abstract]: For subtypes (e.g.\\\n  corresponding to a datatype invariant, such as \\<^typ>\\<open>'a dlist\\<close>), @{command\n  (HOL) \"lift_definition\"} uses a code certificate theorem \\<open>f.rep_eq\\<close> as a\n  code equation. Because of the limitation of the code generator, \\<open>f.rep_eq\\<close>\n  cannot be used as a code equation if the subtype occurs inside the result\n  type rather than at the top level (e.g.\\ function returning \\<^typ>\\<open>'a dlist\n  option\\<close> vs. \\<^typ>\\<open>'a dlist\\<close>).\n\n  In this case, an extension of @{command (HOL) \"lift_definition\"} can be\n  invoked by specifying the flag \\<open>code_dt\\<close>. This extension enables code\n  execution through series of internal type and lifting definitions if the\n  return type \\<open>\\<tau>\\<close> meets the following inductive conditions:\n\n    \\<^descr> \\<open>\\<tau>\\<close> is a type variable\n\n    \\<^descr> \\<open>\\<tau> = \\<tau>\\<^sub>1 \\<dots> \\<tau>\\<^sub>n \\<kappa>\\<close>, where \\<open>\\<kappa>\\<close> is an abstract type constructor and \\<open>\\<tau>\\<^sub>1 \\<dots>\n    \\<tau>\\<^sub>n\\<close> do not contain abstract types (i.e.\\ \\<^typ>\\<open>int dlist\\<close> is allowed\n    whereas \\<^typ>\\<open>int dlist dlist\\<close> not)\n\n    \\<^descr> \\<open>\\<tau> = \\<tau>\\<^sub>1 \\<dots> \\<tau>\\<^sub>n \\<kappa>\\<close>, \\<open>\\<kappa>\\<close> is a type constructor that was defined as a\n    (co)datatype whose constructor argument types do not contain either\n    non-free datatypes or the function type.\n\n  Integration with [@{attribute code} equation]: For total quotients,\n  @{command (HOL) \"lift_definition\"} uses \\<open>f.abs_eq\\<close> as a code equation.\n\n  \\<^descr> @{command (HOL) lifting_forget} and @{command (HOL) lifting_update} These\n  two commands serve for storing and deleting the set-up of the Lifting\n  package and corresponding transfer rules defined by this package. This is\n  useful for hiding of type construction details of an abstract type when the\n  construction is finished but it still allows additions to this construction\n  when this is later necessary.\n\n  Whenever the Lifting package is set up with a new abstract type \\<open>\\<tau>\\<close> by\n  @{command_def (HOL) \"lift_definition\"}, the package defines a new bundle\n  that is called \\<open>\\<tau>.lifting\\<close>. This bundle already includes set-up for the\n  Lifting package. The new transfer rules introduced by @{command (HOL)\n  \"lift_definition\"} can be stored in the bundle by the command @{command\n  (HOL) \"lifting_update\"} \\<open>\\<tau>.lifting\\<close>.\n\n  The command @{command (HOL) \"lifting_forget\"} \\<open>\\<tau>.lifting\\<close> deletes set-up of\n  the Lifting package for \\<open>\\<tau>\\<close> and deletes all the transfer rules that were\n  introduced by @{command (HOL) \"lift_definition\"} using \\<open>\\<tau>\\<close> as an abstract\n  type.\n\n  The stored set-up in a bundle can be reintroduced by the Isar commands for\n  including a bundle (@{command \"include\"}, @{keyword \"includes\"} and\n  @{command \"including\"}).\n\n  \\<^descr> @{command (HOL) \"print_quot_maps\"} prints stored quotient map theorems.\n\n  \\<^descr> @{command (HOL) \"print_quotients\"} prints stored quotient theorems.\n\n  \\<^descr> @{attribute (HOL) quot_map} registers a quotient map theorem, a theorem\n  showing how to ``lift'' quotients over type constructors. E.g.\\ \\<^term>\\<open>Quotient R Abs Rep T \\<Longrightarrow> Quotient (rel_set R) (image Abs) (image Rep)\n  (rel_set T)\\<close>. For examples see \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or\n  \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property is proved automatically if the\n  involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) relator_eq_onp} registers a theorem that shows that a\n  relator applied to an equality restricted by a predicate \\<^term>\\<open>P\\<close> (i.e.\\\n  \\<^term>\\<open>eq_onp P\\<close>) is equal to a predicator applied to the \\<^term>\\<open>P\\<close>. The\n  combinator \\<^const>\\<open>eq_onp\\<close> is used for internal encoding of proper subtypes.\n  Such theorems allows the package to hide \\<open>eq_onp\\<close> from a user in a\n  user-readable form of a respectfulness theorem. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) \"relator_mono\"} registers a property describing a\n  monotonicity of a relator. E.g.\\ \\<^prop>\\<open>A \\<le> B \\<Longrightarrow> rel_set A \\<le> rel_set B\\<close>.\n  This property is needed for proving a stronger transfer rule in\n  @{command_def (HOL) \"lift_definition\"} when a parametricity theorem for the\n  raw term is specified and also for the reflexivity prover. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) \"relator_distr\"} registers a property describing a\n  distributivity of the relation composition and a relator. E.g.\\ \\<open>rel_set R\n  \\<circ>\\<circ> rel_set S = rel_set (R \\<circ>\\<circ> S)\\<close>. This property is needed for proving a\n  stronger transfer rule in @{command_def (HOL) \"lift_definition\"} when a\n  parametricity theorem for the raw term is specified. When this equality does\n  not hold unconditionally (e.g.\\ for the function type), the user can\n  specified each direction separately and also register multiple theorems with\n  different set of assumptions. This attribute can be used only after the\n  monotonicity property was already registered by @{attribute (HOL)\n  \"relator_mono\"}. For examples see \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or\n  \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property is proved automatically if the\n  involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) quot_del} deletes a corresponding Quotient theorem from\n  the Lifting infrastructure and thus de-register the corresponding quotient.\n  This effectively causes that @{command (HOL) lift_definition} will not do\n  any lifting for the corresponding type. This attribute is rather used for\n  low-level manipulation with set-up of the Lifting package because @{command\n  (HOL) lifting_forget} is preferred for normal usage.\n\n  \\<^descr> @{attribute (HOL) lifting_restore} \\<open>Quotient_thm pcr_def pcr_cr_eq_thm\\<close>\n  registers the Quotient theorem \\<open>Quotient_thm\\<close> in the Lifting infrastructure\n  and thus sets up lifting for an abstract type \\<open>\\<tau>\\<close> (that is defined by\n  \\<open>Quotient_thm\\<close>). Optional theorems \\<open>pcr_def\\<close> and \\<open>pcr_cr_eq_thm\\<close> can be\n  specified to register the parametrized correspondence relation for \\<open>\\<tau>\\<close>.\n  E.g.\\ for \\<^typ>\\<open>'a dlist\\<close>, \\<open>pcr_def\\<close> is \\<open>pcr_dlist A \\<equiv> list_all2 A \\<circ>\\<circ>\n  cr_dlist\\<close> and \\<open>pcr_cr_eq_thm\\<close> is \\<open>pcr_dlist (=) = (=)\\<close>. This attribute\n  is rather used for low-level manipulation with set-up of the Lifting package\n  because using of the bundle \\<open>\\<tau>.lifting\\<close> together with the commands @{command\n  (HOL) lifting_forget} and @{command (HOL) lifting_update} is preferred for\n  normal usage.\n\n  \\<^descr> Integration with the BNF package @{cite \"isabelle-datatypes\"}: As already\n  mentioned, the theorems that are registered by the following attributes are\n  proved and registered automatically if the involved type is BNF without dead\n  variables: @{attribute (HOL) quot_map}, @{attribute (HOL) relator_eq_onp},\n  @{attribute (HOL) \"relator_mono\"}, @{attribute (HOL) \"relator_distr\"}. Also\n  the definition of a relator and predicator is provided automatically.\n  Moreover, if the BNF represents a datatype, simplification rules for a\n  predicator are again proved automatically.\n\\<close>\n\n\nsubsection \\<open>Transfer package \\label{sec:transfer}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"transfer\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer'\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_prover\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) \"Transfer.transferred\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"untransferred\"} & : & \\<open>attribute\\<close> \\\\\n    @{method_def (HOL) \"transfer_start\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_prover_start\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_step\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_end\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_prover_end\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) \"transfer_rule\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"transfer_domain_rule\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_eq\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_domain\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^descr> @{method (HOL) \"transfer\"} method replaces the current subgoal with a\n  logically equivalent one that uses different types and constants. The\n  replacement of types and constants is guided by the database of transfer\n  rules. Goals are generalized over all free variables by default; this is\n  necessary for variables whose types change, but can be overridden for\n  specific variables with e.g. \\<open>transfer fixing: x y z\\<close>.\n\n  \\<^descr> @{method (HOL) \"transfer'\"} is a variant of @{method (HOL) transfer} that\n  allows replacing a subgoal with one that is logically stronger (rather than\n  equivalent). For example, a subgoal involving equality on a quotient type\n  could be replaced with a subgoal involving equality (instead of the\n  corresponding equivalence relation) on the underlying raw type.\n\n  \\<^descr> @{method (HOL) \"transfer_prover\"} method assists with proving a transfer\n  rule for a new constant, provided the constant is defined in terms of other\n  constants that already have transfer rules. It should be applied after\n  unfolding the constant definitions.\n\n  \\<^descr> @{method (HOL) \"transfer_start\"}, @{method (HOL) \"transfer_step\"},\n  @{method (HOL) \"transfer_end\"}, @{method (HOL) \"transfer_prover_start\"} and\n  @{method (HOL) \"transfer_prover_end\"} methods are meant to be used for\n  debugging of @{method (HOL) \"transfer\"} and @{method (HOL)\n  \"transfer_prover\"}, which we can decompose as follows: @{method (HOL)\n  \"transfer\"} = (@{method (HOL) \"transfer_start\"}, @{method (HOL)\n  \"transfer_step\"}+, @{method (HOL) \"transfer_end\"}) and @{method (HOL)\n  \"transfer_prover\"} = (@{method (HOL) \"transfer_prover_start\"}, @{method\n  (HOL) \"transfer_step\"}+, @{method (HOL) \"transfer_prover_end\"}). For usage\n  examples see \\<^file>\\<open>~~/src/HOL/ex/Transfer_Debug.thy\\<close>.\n\n  \\<^descr> @{attribute (HOL) \"untransferred\"} proves the same equivalent theorem as\n  @{method (HOL) \"transfer\"} internally does.\n\n  \\<^descr> @{attribute (HOL) Transfer.transferred} works in the opposite direction\n  than @{method (HOL) \"transfer'\"}. E.g.\\ given the transfer relation \\<open>ZN x n\n  \\<equiv> (x = int n)\\<close>, corresponding transfer rules and the theorem \\<open>\\<forall>x::int \\<in>\n  {0..}. x < x + 1\\<close>, the attribute would prove \\<open>\\<forall>n::nat. n < n + 1\\<close>. The\n  attribute is still in experimental phase of development.\n\n  \\<^descr> @{attribute (HOL) \"transfer_rule\"} attribute maintains a collection of\n  transfer rules, which relate constants at two different types. Typical\n  transfer rules may relate different type instances of the same polymorphic\n  constant, or they may relate an operation on a raw type to a corresponding\n  operation on an abstract type (quotient or subtype). For example:\n\n    \\<open>((A ===> B) ===> list_all2 A ===> list_all2 B) map map\\<close> \\\\\n    \\<open>(cr_int ===> cr_int ===> cr_int) (\\<lambda>(x,y) (u,v). (x+u, y+v)) plus\\<close>\n\n  Lemmas involving predicates on relations can also be registered using the\n  same attribute. For example:\n\n    \\<open>bi_unique A \\<Longrightarrow> (list_all2 A ===> (=)) distinct distinct\\<close> \\\\\n    \\<open>\\<lbrakk>bi_unique A; bi_unique B\\<rbrakk> \\<Longrightarrow> bi_unique (rel_prod A B)\\<close>\n\n  Preservation of predicates on relations (\\<open>bi_unique, bi_total, right_unique,\n  right_total, left_unique, left_total\\<close>) with the respect to a relator is\n  proved automatically if the involved type is BNF @{cite\n  \"isabelle-datatypes\"} without dead variables.\n\n  \\<^descr> @{attribute (HOL) \"transfer_domain_rule\"} attribute maintains a collection\n  of rules, which specify a domain of a transfer relation by a predicate.\n  E.g.\\ given the transfer relation \\<open>ZN x n \\<equiv> (x = int n)\\<close>, one can register\n  the following transfer domain rule: \\<open>Domainp ZN = (\\<lambda>x. x \\<ge> 0)\\<close>. The rules\n  allow the package to produce more readable transferred goals, e.g.\\ when\n  quantifiers are transferred.\n\n  \\<^descr> @{attribute (HOL) relator_eq} attribute collects identity laws for\n  relators of various type constructors, e.g. \\<^term>\\<open>rel_set (=) = (=)\\<close>.\n  The @{method (HOL) transfer} method uses these lemmas to infer\n  transfer rules for non-polymorphic constants on the fly. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute_def (HOL) \"relator_domain\"} attribute collects rules\n  describing domains of relators by predicators. E.g.\\ \\<^term>\\<open>Domainp\n  (rel_set T) = (\\<lambda>A. Ball A (Domainp T))\\<close>. This allows the package to lift\n  transfer domain rules through type constructors. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n\n  Theoretical background can be found in @{cite\n  \"Huffman-Kuncar:2013:lifting_transfer\"}.\n\\<close>\n\n\nsubsection \\<open>Old-style definitions for quotient types \\label{sec:old-quotient}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"quotient_definition\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\\\\\n    @{command_def (HOL) \"print_quotmapsQ3\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{command_def (HOL) \"print_quotientsQ3\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{command_def (HOL) \"print_quotconsts\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{method_def (HOL) \"lifting\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"lifting_setup\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"descending\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"descending_setup\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"partiality_descending\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"partiality_descending_setup\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"regularize\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"injection\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"cleaning\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) \"quot_thm\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_lifted\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_respect\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_preserve\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) quotient_definition} constdecl? @{syntax thmdecl}? \\<newline>\n    @{syntax term} 'is' @{syntax term}\n    ;\n    constdecl: @{syntax name} ('::' @{syntax type})? @{syntax mixfix}?\n    ;\n    @@{method (HOL) lifting} @{syntax thms}?\n    ;\n    @@{method (HOL) lifting_setup} @{syntax thms}?\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"quotient_definition\"} defines a constant on the quotient\n  type.\n\n  \\<^descr> @{command (HOL) \"print_quotmapsQ3\"} prints quotient map functions.\n\n  \\<^descr> @{command (HOL) \"print_quotientsQ3\"} prints quotients.\n\n  \\<^descr> @{command (HOL) \"print_quotconsts\"} prints quotient constants.\n\n  \\<^descr> @{method (HOL) \"lifting\"} and @{method (HOL) \"lifting_setup\"} methods\n  match the current goal with the given raw theorem to be lifted producing\n  three new subgoals: regularization, injection and cleaning subgoals.\n  @{method (HOL) \"lifting\"} tries to apply the heuristics for automatically\n  solving these three subgoals and leaves only the subgoals unsolved by the\n  heuristics to the user as opposed to @{method (HOL) \"lifting_setup\"} which\n  leaves the three subgoals unsolved.\n\n  \\<^descr> @{method (HOL) \"descending\"} and @{method (HOL) \"descending_setup\"} try to\n  guess a raw statement that would lift to the current subgoal. Such statement\n  is assumed as a new subgoal and @{method (HOL) \"descending\"} continues in\n  the same way as @{method (HOL) \"lifting\"} does. @{method (HOL) \"descending\"}\n  tries to solve the arising regularization, injection and cleaning subgoals\n  with the analogous method @{method (HOL) \"descending_setup\"} which leaves\n  the four unsolved subgoals.\n\n  \\<^descr> @{method (HOL) \"partiality_descending\"} finds the regularized theorem that\n  would lift to the current subgoal, lifts it and leaves as a subgoal. This\n  method can be used with partial equivalence quotients where the non\n  regularized statements would not be true. @{method (HOL)\n  \"partiality_descending_setup\"} leaves the injection and cleaning subgoals\n  unchanged.\n\n  \\<^descr> @{method (HOL) \"regularize\"} applies the regularization heuristics to the\n  current subgoal.\n\n  \\<^descr> @{method (HOL) \"injection\"} applies the injection heuristics to the\n  current goal using the stored quotient respectfulness theorems.\n\n  \\<^descr> @{method (HOL) \"cleaning\"} applies the injection cleaning heuristics to\n  the current subgoal using the stored quotient preservation theorems.\n\n  \\<^descr> @{attribute (HOL) quot_lifted} attribute tries to automatically transport\n  the theorem to the quotient type. The attribute uses all the defined\n  quotients types and quotient constants often producing undesired results or\n  theorems that cannot be lifted.\n\n  \\<^descr> @{attribute (HOL) quot_respect} and @{attribute (HOL) quot_preserve}\n  attributes declare a theorem as a respectfulness and preservation theorem\n  respectively. These are stored in the local theory store and used by the\n  @{method (HOL) \"injection\"} and @{method (HOL) \"cleaning\"} methods\n  respectively.\n\n  \\<^descr> @{attribute (HOL) quot_thm} declares that a certain theorem is a quotient\n  extension theorem. Quotient extension theorems allow for quotienting inside\n  container types. Given a polymorphic type that serves as a container, a map\n  function defined for this container using @{command (HOL) \"functor\"} and a\n  relation map defined for for the container type, the quotient extension\n  theorem should be \\<^term>\\<open>Quotient3 R Abs Rep \\<Longrightarrow> Quotient3 (rel_map R) (map\n  Abs) (map Rep)\\<close>. Quotient extension theorems are stored in a database and\n  are used all the steps of lifting theorems.\n\\<close>\n\n\nchapter \\<open>Proof tools\\<close>\n\nsection \\<open>Proving propositions\\<close>\n\ntext \\<open>\n  In addition to the standard proof methods, a number of diagnosis tools\n  search for proofs and provide an Isar proof snippet on success. These tools\n  are available via the following commands.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"solve_direct\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"try\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"try0\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"sledgehammer\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"sledgehammer_params\"} & : & \\<open>theory \\<rightarrow> theory\\<close>\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) try}\n    ;\n\n    @@{command (HOL) try0} ( ( ( 'simp' | 'intro' | 'elim' | 'dest' ) ':' @{syntax thms} ) + ) ?\n      @{syntax nat}?\n    ;\n\n    @@{command (HOL) sledgehammer} ( '[' args ']' )? facts? @{syntax nat}?\n    ;\n\n    @@{command (HOL) sledgehammer_params} ( ( '[' args ']' ) ? )\n    ;\n    args: ( @{syntax name} '=' value + ',' )\n    ;\n    facts: '(' ( ( ( ( 'add' | 'del' ) ':' ) ? @{syntax thms} ) + ) ? ')'\n  \\<close> % FIXME check args \"value\"\n\n  \\<^descr> @{command (HOL) \"solve_direct\"} checks whether the current subgoals can be\n  solved directly by an existing theorem. Duplicate lemmas can be detected in\n  this way.\n\n  \\<^descr> @{command (HOL) \"try0\"} attempts to prove a subgoal using a combination of\n  standard proof methods (@{method auto}, @{method simp}, @{method blast},\n  etc.). Additional facts supplied via \\<open>simp:\\<close>, \\<open>intro:\\<close>, \\<open>elim:\\<close>, and \\<open>dest:\\<close>\n  are passed to the appropriate proof methods.\n\n  \\<^descr> @{command (HOL) \"try\"} attempts to prove or disprove a subgoal using a\n  combination of provers and disprovers (@{command (HOL) \"solve_direct\"},\n  @{command (HOL) \"quickcheck\"}, @{command (HOL) \"try0\"}, @{command (HOL)\n  \"sledgehammer\"}, @{command (HOL) \"nitpick\"}).\n\n  \\<^descr> @{command (HOL) \"sledgehammer\"} attempts to prove a subgoal using external\n  automatic provers (resolution provers and SMT solvers). See the Sledgehammer\n  manual @{cite \"isabelle-sledgehammer\"} for details.\n\n  \\<^descr> @{command (HOL) \"sledgehammer_params\"} changes @{command (HOL)\n  \"sledgehammer\"} configuration options persistently.\n\\<close>\n\n\nsection \\<open>Checking and refuting propositions\\<close>\n\ntext \\<open>\n  Identifying incorrect propositions usually involves evaluation of particular\n  assignments and systematic counterexample search. This is supported by the\n  following commands.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"value\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"values\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"quickcheck\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"nitpick\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"quickcheck_params\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"nitpick_params\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"quickcheck_generator\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"find_unused_assms\"} & : & \\<open>context \\<rightarrow>\\<close>\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) value} ( '[' @{syntax name} ']' )? modes? @{syntax term}\n    ;\n\n    @@{command (HOL) values} modes? @{syntax nat}? @{syntax term}\n    ;\n\n    (@@{command (HOL) quickcheck} | @@{command (HOL) nitpick})\n      ( '[' args ']' )? @{syntax nat}?\n    ;\n\n    (@@{command (HOL) quickcheck_params} |\n      @@{command (HOL) nitpick_params}) ( '[' args ']' )?\n    ;\n\n    @@{command (HOL) quickcheck_generator} @{syntax name} \\<newline>\n      'operations:' ( @{syntax term} +)\n    ;\n\n    @@{command (HOL) find_unused_assms} @{syntax name}?\n    ;\n    modes: '(' (@{syntax name} +) ')'\n    ;\n    args: ( @{syntax name} '=' value + ',' )\n  \\<close> % FIXME check \"value\"\n\n  \\<^descr> @{command (HOL) \"value\"}~\\<open>t\\<close> evaluates and prints a term; optionally\n  \\<open>modes\\<close> can be specified, which are appended to the current print mode; see\n  \\secref{sec:print-modes}. Evaluation is tried first using ML, falling back\n  to normalization by evaluation if this fails. Alternatively a specific\n  evaluator can be selected using square brackets; typical evaluators use the\n  current set of code equations to normalize and include \\<open>simp\\<close> for fully\n  symbolic evaluation using the simplifier, \\<open>nbe\\<close> for \\<^emph>\\<open>normalization by\n  evaluation\\<close> and \\<^emph>\\<open>code\\<close> for code generation in SML.\n\n  \\<^descr> @{command (HOL) \"values\"}~\\<open>t\\<close> enumerates a set comprehension by evaluation\n  and prints its values up to the given number of solutions; optionally\n  \\<open>modes\\<close> can be specified, which are appended to the current print mode; see\n  \\secref{sec:print-modes}.\n\n  \\<^descr> @{command (HOL) \"quickcheck\"} tests the current goal for counterexamples\n  using a series of assignments for its free variables; by default the first\n  subgoal is tested, an other can be selected explicitly using an optional\n  goal index. Assignments can be chosen exhausting the search space up to a\n  given size, or using a fixed number of random assignments in the search\n  space, or exploring the search space symbolically using narrowing. By\n  default, quickcheck uses exhaustive testing. A number of configuration\n  options are supported for @{command (HOL) \"quickcheck\"}, notably:\n\n    \\<^descr>[\\<open>tester\\<close>] specifies which testing approach to apply. There are three\n    testers, \\<open>exhaustive\\<close>, \\<open>random\\<close>, and \\<open>narrowing\\<close>. An unknown configuration\n    option is treated as an argument to tester, making \\<open>tester =\\<close> optional.\n    When multiple testers are given, these are applied in parallel. If no\n    tester is specified, quickcheck uses the testers that are set active,\n    i.e.\\ configurations @{attribute quickcheck_exhaustive_active},\n    @{attribute quickcheck_random_active}, @{attribute\n    quickcheck_narrowing_active} are set to true.\n\n    \\<^descr>[\\<open>size\\<close>] specifies the maximum size of the search space for assignment\n    values.\n\n    \\<^descr>[\\<open>genuine_only\\<close>] sets quickcheck only to return genuine counterexample,\n    but not potentially spurious counterexamples due to underspecified\n    functions.\n\n    \\<^descr>[\\<open>abort_potential\\<close>] sets quickcheck to abort once it found a potentially\n    spurious counterexample and to not continue to search for a further\n    genuine counterexample. For this option to be effective, the\n    \\<open>genuine_only\\<close> option must be set to false.\n\n    \\<^descr>[\\<open>eval\\<close>] takes a term or a list of terms and evaluates these terms under\n    the variable assignment found by quickcheck. This option is currently only\n    supported by the default (exhaustive) tester.\n\n    \\<^descr>[\\<open>iterations\\<close>] sets how many sets of assignments are generated for each\n    particular size.\n\n    \\<^descr>[\\<open>no_assms\\<close>] specifies whether assumptions in structured proofs should be\n    ignored.\n\n    \\<^descr>[\\<open>locale\\<close>] specifies how to process conjectures in a locale context,\n    i.e.\\ they can be interpreted or expanded. The option is a\n    whitespace-separated list of the two words \\<open>interpret\\<close> and \\<open>expand\\<close>. The\n    list determines the order they are employed. The default setting is to\n    first use interpretations and then test the expanded conjecture. The\n    option is only provided as attribute declaration, but not as parameter to\n    the command.\n\n    \\<^descr>[\\<open>timeout\\<close>] sets the time limit in seconds.\n\n    \\<^descr>[\\<open>default_type\\<close>] sets the type(s) generally used to instantiate type\n    variables.\n\n    \\<^descr>[\\<open>report\\<close>] if set quickcheck reports how many tests fulfilled the\n    preconditions.\n\n    \\<^descr>[\\<open>use_subtype\\<close>] if set quickcheck automatically lifts conjectures to\n    registered subtypes if possible, and tests the lifted conjecture.\n\n    \\<^descr>[\\<open>quiet\\<close>] if set quickcheck does not output anything while testing.\n\n    \\<^descr>[\\<open>verbose\\<close>] if set quickcheck informs about the current size and\n    cardinality while testing.\n\n    \\<^descr>[\\<open>expect\\<close>] can be used to check if the user's expectation was met\n    (\\<open>no_expectation\\<close>, \\<open>no_counterexample\\<close>, or \\<open>counterexample\\<close>).\n\n  These option can be given within square brackets.\n\n  Using the following type classes, the testers generate values and convert\n  them back into Isabelle terms for displaying counterexamples.\n\n    \\<^descr>[\\<open>exhaustive\\<close>] The parameters of the type classes \\<^class>\\<open>exhaustive\\<close> and\n    \\<^class>\\<open>full_exhaustive\\<close> implement the testing. They take a testing\n    function as a parameter, which takes a value of type \\<^typ>\\<open>'a\\<close> and\n    optionally produces a counterexample, and a size parameter for the test\n    values. In \\<^class>\\<open>full_exhaustive\\<close>, the testing function parameter\n    additionally expects a lazy term reconstruction in the type \\<^typ>\\<open>Code_Evaluation.term\\<close> of the tested value.\n\n    The canonical implementation for \\<open>exhaustive\\<close> testers calls the given\n    testing function on all values up to the given size and stops as soon as a\n    counterexample is found.\n\n    \\<^descr>[\\<open>random\\<close>] The operation \\<^const>\\<open>Quickcheck_Random.random\\<close> of the type\n    class \\<^class>\\<open>random\\<close> generates a pseudo-random value of the given size\n    and a lazy term reconstruction of the value in the type \\<^typ>\\<open>Code_Evaluation.term\\<close>. A pseudo-randomness generator is defined in theory\n    \\<^theory>\\<open>HOL.Random\\<close>.\n\n    \\<^descr>[\\<open>narrowing\\<close>] implements Haskell's Lazy Smallcheck @{cite\n    \"runciman-naylor-lindblad\"} using the type classes \\<^class>\\<open>narrowing\\<close> and\n    \\<^class>\\<open>partial_term_of\\<close>. Variables in the current goal are initially\n    represented as symbolic variables. If the execution of the goal tries to\n    evaluate one of them, the test engine replaces it with refinements\n    provided by \\<^const>\\<open>narrowing\\<close>. Narrowing views every value as a\n    sum-of-products which is expressed using the operations \\<^const>\\<open>Quickcheck_Narrowing.cons\\<close> (embedding a value), \\<^const>\\<open>Quickcheck_Narrowing.apply\\<close> (product) and \\<^const>\\<open>Quickcheck_Narrowing.sum\\<close> (sum). The refinement should enable further\n    evaluation of the goal.\n\n    For example, \\<^const>\\<open>narrowing\\<close> for the list type \\<^typ>\\<open>'a :: narrowing list\\<close>\n    can be recursively defined as\n    \\<^term>\\<open>Quickcheck_Narrowing.sum (Quickcheck_Narrowing.cons [])\n              (Quickcheck_Narrowing.apply\n                (Quickcheck_Narrowing.apply\n                  (Quickcheck_Narrowing.cons (#))\n                  narrowing)\n                narrowing)\\<close>.\n    If a symbolic variable of type \\<^typ>\\<open>_ list\\<close> is evaluated, it is\n    replaced by (i)~the empty list \\<^term>\\<open>[]\\<close> and (ii)~by a non-empty list\n    whose head and tail can then be recursively refined if needed.\n\n    To reconstruct counterexamples, the operation \\<^const>\\<open>partial_term_of\\<close>\n    transforms \\<open>narrowing\\<close>'s deep representation of terms to the type \\<^typ>\\<open>Code_Evaluation.term\\<close>. The deep representation models symbolic variables\n    as \\<^const>\\<open>Quickcheck_Narrowing.Narrowing_variable\\<close>, which are normally\n    converted to \\<^const>\\<open>Code_Evaluation.Free\\<close>, and refined values as \\<^term>\\<open>Quickcheck_Narrowing.Narrowing_constructor i args\\<close>, where \\<^term>\\<open>i ::\n    integer\\<close> denotes the index in the sum of refinements. In the above\n    example for lists, \\<^term>\\<open>0\\<close> corresponds to \\<^term>\\<open>[]\\<close> and \\<^term>\\<open>1\\<close>\n    to \\<^term>\\<open>(#)\\<close>.\n\n    The command @{command (HOL) \"code_datatype\"} sets up \\<^const>\\<open>partial_term_of\\<close> such that the \\<^term>\\<open>i\\<close>-th refinement is interpreted as\n    the \\<^term>\\<open>i\\<close>-th constructor, but it does not ensures consistency with\n    \\<^const>\\<open>narrowing\\<close>.\n\n  \\<^descr> @{command (HOL) \"quickcheck_params\"} changes @{command (HOL) \"quickcheck\"}\n  configuration options persistently.\n\n  \\<^descr> @{command (HOL) \"quickcheck_generator\"} creates random and exhaustive\n  value generators for a given type and operations. It generates values by\n  using the operations as if they were constructors of that type.\n\n  \\<^descr> @{command (HOL) \"nitpick\"} tests the current goal for counterexamples\n  using a reduction to first-order relational logic. See the Nitpick manual\n  @{cite \"isabelle-nitpick\"} for details.\n\n  \\<^descr> @{command (HOL) \"nitpick_params\"} changes @{command (HOL) \"nitpick\"}\n  configuration options persistently.\n\n  \\<^descr> @{command (HOL) \"find_unused_assms\"} finds potentially superfluous\n  assumptions in theorems using quickcheck. It takes the theory name to be\n  checked for superfluous assumptions as optional argument. If not provided,\n  it checks the current theory. Options to the internal quickcheck invocations\n  can be changed with common configuration declarations.\n\\<close>\n\n\nsection \\<open>Coercive subtyping\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) coercion} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_delete} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_enabled} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_map} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_args} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  Coercive subtyping allows the user to omit explicit type conversions, also\n  called \\<^emph>\\<open>coercions\\<close>. Type inference will add them as necessary when parsing\n  a term. See @{cite \"traytel-berghofer-nipkow-2011\"} for details.\n\n  \\<^rail>\\<open>\n    @@{attribute (HOL) coercion} (@{syntax term})\n    ;\n    @@{attribute (HOL) coercion_delete} (@{syntax term})\n    ;\n    @@{attribute (HOL) coercion_map} (@{syntax term})\n    ;\n    @@{attribute (HOL) coercion_args} (@{syntax const}) (('+' | '0' | '-')+)\n  \\<close>\n\n  \\<^descr> @{attribute (HOL) \"coercion\"}~\\<open>f\\<close> registers a new coercion function \\<open>f ::\n  \\<sigma>\\<^sub>1 \\<Rightarrow> \\<sigma>\\<^sub>2\\<close> where \\<open>\\<sigma>\\<^sub>1\\<close> and \\<open>\\<sigma>\\<^sub>2\\<close> are type constructors without arguments.\n  Coercions are composed by the inference algorithm if needed. Note that the\n  type inference algorithm is complete only if the registered coercions form a\n  lattice.\n\n  \\<^descr> @{attribute (HOL) \"coercion_delete\"}~\\<open>f\\<close> deletes a preceding declaration\n  (using @{attribute (HOL) \"coercion\"}) of the function \\<open>f :: \\<sigma>\\<^sub>1 \\<Rightarrow> \\<sigma>\\<^sub>2\\<close> as a\n  coercion.\n\n  \\<^descr> @{attribute (HOL) \"coercion_map\"}~\\<open>map\\<close> registers a new map function to\n  lift coercions through type constructors. The function \\<open>map\\<close> must conform to\n  the following type pattern\n\n  \\begin{matharray}{lll}\n    \\<open>map\\<close> & \\<open>::\\<close> &\n      \\<open>f\\<^sub>1 \\<Rightarrow> \\<dots> \\<Rightarrow> f\\<^sub>n \\<Rightarrow> (\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n) t \\<Rightarrow> (\\<beta>\\<^sub>1, \\<dots>, \\<beta>\\<^sub>n) t\\<close> \\\\\n  \\end{matharray}\n\n  where \\<open>t\\<close> is a type constructor and \\<open>f\\<^sub>i\\<close> is of type \\<open>\\<alpha>\\<^sub>i \\<Rightarrow> \\<beta>\\<^sub>i\\<close> or \\<open>\\<beta>\\<^sub>i \\<Rightarrow>\n  \\<alpha>\\<^sub>i\\<close>. Registering a map function overwrites any existing map function for\n  this particular type constructor.\n\n  \\<^descr> @{attribute (HOL) \"coercion_args\"} can be used to disallow coercions to be\n  inserted in certain positions in a term. For example, given the constant \\<open>c\n  :: \\<sigma>\\<^sub>1 \\<Rightarrow> \\<sigma>\\<^sub>2 \\<Rightarrow> \\<sigma>\\<^sub>3 \\<Rightarrow> \\<sigma>\\<^sub>4\\<close> and the list of policies \\<open>- + 0\\<close> as arguments,\n  coercions will not be inserted in the first argument of \\<open>c\\<close> (policy \\<open>-\\<close>);\n  they may be inserted in the second argument (policy \\<open>+\\<close>) even if the\n  constant \\<open>c\\<close> itself is in a position where coercions are disallowed; the\n  third argument inherits the allowance of coercsion insertion from the\n  position of the constant \\<open>c\\<close> (policy \\<open>0\\<close>). The standard usage of policies is\n  the definition of syntatic constructs (usually extralogical, i.e., processed\n  and stripped during type inference), that should not be destroyed by the\n  insertion of coercions (see, for example, the setup for the case syntax in\n  \\<^theory>\\<open>HOL.Ctr_Sugar\\<close>).\n\n  \\<^descr> @{attribute (HOL) \"coercion_enabled\"} enables the coercion inference\n  algorithm.\n\\<close>\n\n\nsection \\<open>Arithmetic proof support\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) arith} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) arith} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) linarith_split} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^descr> @{method (HOL) arith} decides linear arithmetic problems (on types \\<open>nat\\<close>,\n  \\<open>int\\<close>, \\<open>real\\<close>). Any current facts are inserted into the goal before running\n  the procedure.\n\n  \\<^descr> @{attribute (HOL) arith} declares facts that are supplied to the\n  arithmetic provers implicitly.\n\n  \\<^descr> @{attribute (HOL) linarith_split} attribute declares case split rules to be\n  expanded before @{method (HOL) arith} is invoked.\n\n\n  Note that a simpler (but faster) arithmetic prover is already invoked by the\n  Simplifier.\n\\<close>\n\n\nsection \\<open>Intuitionistic proof search\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) iprover} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) iprover} (@{syntax rulemod} *)\n  \\<close>\n\n  \\<^descr> @{method (HOL) iprover} performs intuitionistic proof search, depending on\n  specifically declared rules from the context, or given as explicit\n  arguments. Chained facts are inserted into the goal before commencing proof\n  search.\n\n  Rules need to be classified as @{attribute (Pure) intro}, @{attribute (Pure)\n  elim}, or @{attribute (Pure) dest}; here the ``\\<open>!\\<close>'' indicator refers to\n  ``safe'' rules, which may be applied aggressively (without considering\n  back-tracking later). Rules declared with ``\\<open>?\\<close>'' are ignored in proof\n  search (the single-step @{method (Pure) rule} method still observes these).\n  An explicit weight annotation may be given as well; otherwise the number of\n  rule premises will be taken into account here.\n\\<close>\n\n\nsection \\<open>Model Elimination and Resolution\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"meson\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"metis\"} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) meson} @{syntax thms}?\n    ;\n    @@{method (HOL) metis}\n      ('(' ('partial_types' | 'full_types' | 'no_types' | @{syntax name}) ')')?\n      @{syntax thms}?\n  \\<close>\n\n  \\<^descr> @{method (HOL) meson} implements Loveland's model elimination procedure\n  @{cite \"loveland-78\"}. See \\<^file>\\<open>~~/src/HOL/ex/Meson_Test.thy\\<close> for examples.\n\n  \\<^descr> @{method (HOL) metis} combines ordered resolution and ordered\n  paramodulation to find first-order (or mildly higher-order) proofs. The\n  first optional argument specifies a type encoding; see the Sledgehammer\n  manual @{cite \"isabelle-sledgehammer\"} for details. The directory\n  \\<^dir>\\<open>~~/src/HOL/Metis_Examples\\<close> contains several small theories developed to a\n  large extent using @{method (HOL) metis}.\n\\<close>\n\n\nsection \\<open>Algebraic reasoning via Gröbner bases\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"algebra\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) algebra} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) algebra}\n      ('add' ':' @{syntax thms})?\n      ('del' ':' @{syntax thms})?\n    ;\n    @@{attribute (HOL) algebra} (() | 'add' | 'del')\n  \\<close>\n\n  \\<^descr> @{method (HOL) algebra} performs algebraic reasoning via Gröbner bases,\n  see also @{cite \"Chaieb-Wenzel:2007\"} and @{cite \\<open>\\S3.2\\<close> \"Chaieb-thesis\"}.\n  The method handles deals with two main classes of problems:\n\n    \\<^enum> Universal problems over multivariate polynomials in a\n    (semi)-ring/field/idom; the capabilities of the method are augmented\n    according to properties of these structures. For this problem class the\n    method is only complete for algebraically closed fields, since the\n    underlying method is based on Hilbert's Nullstellensatz, where the\n    equivalence only holds for algebraically closed fields.\n\n    The problems can contain equations \\<open>p = 0\\<close> or inequations \\<open>q \\<noteq> 0\\<close> anywhere\n    within a universal problem statement.\n\n    \\<^enum> All-exists problems of the following restricted (but useful) form:\n\n    @{text [display] \"\\<forall>x\\<^sub>1 \\<dots> x\\<^sub>n.\n      e\\<^sub>1(x\\<^sub>1, \\<dots>, x\\<^sub>n) = 0 \\<and> \\<dots> \\<and> e\\<^sub>m(x\\<^sub>1, \\<dots>, x\\<^sub>n) = 0 \\<longrightarrow>\n      (\\<exists>y\\<^sub>1 \\<dots> y\\<^sub>k.\n        p\\<^sub>1\\<^sub>1(x\\<^sub>1, \\<dots> ,x\\<^sub>n) * y\\<^sub>1 + \\<dots> + p\\<^sub>1\\<^sub>k(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>k = 0 \\<and>\n        \\<dots> \\<and>\n        p\\<^sub>t\\<^sub>1(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>1 + \\<dots> + p\\<^sub>t\\<^sub>k(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>k = 0)\"}\n\n    Here \\<open>e\\<^sub>1, \\<dots>, e\\<^sub>n\\<close> and the \\<open>p\\<^sub>i\\<^sub>j\\<close> are multivariate polynomials only in\n    the variables mentioned as arguments.\n\n  The proof method is preceded by a simplification step, which may be modified\n  by using the form \\<open>(algebra add: ths\\<^sub>1 del: ths\\<^sub>2)\\<close>. This acts like\n  declarations for the Simplifier (\\secref{sec:simplifier}) on a private\n  simpset for this tool.\n\n  \\<^descr> @{attribute algebra} (as attribute) manages the default collection of\n  pre-simplification rules of the above proof method.\n\\<close>\n\n\nsubsubsection \\<open>Example\\<close>\n\ntext \\<open>\n  The subsequent example is from geometry: collinearity is invariant by\n  rotation.\n\\<close>\n\n(*<*)experiment begin(*>*)\ntype_synonym point = \"int \\<times> int\"\n\nfun collinear :: \"point \\<Rightarrow> point \\<Rightarrow> point \\<Rightarrow> bool\" where\n  \"collinear (Ax, Ay) (Bx, By) (Cx, Cy) \\<longleftrightarrow>\n    (Ax - Bx) * (By - Cy) = (Ay - By) * (Bx - Cx)\"\n\nlemma collinear_inv_rotation:\n  assumes \"collinear (Ax, Ay) (Bx, By) (Cx, Cy)\" and \"c\\<^sup>2 + s\\<^sup>2 = 1\"\n  shows \"collinear (Ax * c - Ay * s, Ay * c + Ax * s)\n    (Bx * c - By * s, By * c + Bx * s) (Cx * c - Cy * s, Cy * c + Cx * s)\"\n  using assms by (algebra add: collinear.simps)\n(*<*)end(*>*)\n\ntext \\<open>\n  See also \\<^file>\\<open>~~/src/HOL/Examples/Groebner_Examples.thy\\<close>.\n\\<close>\n\n\nsection \\<open>Coherent Logic\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"coherent\"} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) coherent} @{syntax thms}?\n  \\<close>\n\n  \\<^descr> @{method (HOL) coherent} solves problems of \\<^emph>\\<open>Coherent Logic\\<close> @{cite\n  \"Bezem-Coquand:2005\"}, which covers applications in confluence theory,\n  lattice theory and projective geometry. See \\<^file>\\<open>~~/src/HOL/Examples/Coherent.thy\\<close>\n  for some examples.\n\\<close>\n\n\nsection \\<open>Unstructured case analysis and induction \\label{sec:hol-induct-tac}\\<close>\n\ntext \\<open>\n  The following tools of Isabelle/HOL support cases analysis and induction in\n  unstructured tactic scripts; see also \\secref{sec:cases-induct} for proper\n  Isar versions of similar ideas.\n\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) case_tac}\\<open>\\<^sup>*\\<close> & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) induct_tac}\\<open>\\<^sup>*\\<close> & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) ind_cases}\\<open>\\<^sup>*\\<close> & : & \\<open>method\\<close> \\\\\n    @{command_def (HOL) \"inductive_cases\"}\\<open>\\<^sup>*\\<close> & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) case_tac} @{syntax goal_spec}? @{syntax term} rule?\n    ;\n    @@{method (HOL) induct_tac} @{syntax goal_spec}? (@{syntax insts} * @'and') rule?\n    ;\n    @@{method (HOL) ind_cases} (@{syntax prop}+) @{syntax for_fixes}\n    ;\n    @@{command (HOL) inductive_cases} (@{syntax thmdecl}? (@{syntax prop}+) + @'and')\n    ;\n    rule: 'rule' ':' @{syntax thm}\n  \\<close>\n\n  \\<^descr> @{method (HOL) case_tac} and @{method (HOL) induct_tac} admit to reason\n  about inductive types. Rules are selected according to the declarations by\n  the @{attribute cases} and @{attribute induct} attributes, cf.\\\n  \\secref{sec:cases-induct}. The @{command (HOL) datatype} package already\n  takes care of this.\n\n  These unstructured tactics feature both goal addressing and dynamic\n  instantiation. Note that named rule cases are \\<^emph>\\<open>not\\<close> provided as would be by\n  the proper @{method cases} and @{method induct} proof methods (see\n  \\secref{sec:cases-induct}). Unlike the @{method induct} method, @{method\n  induct_tac} does not handle structured rule statements, only the compact\n  object-logic conclusion of the subgoal being addressed.\n\n  \\<^descr> @{method (HOL) ind_cases} and @{command (HOL) \"inductive_cases\"} provide\n  an interface to the internal \\<^ML_text>\\<open>mk_cases\\<close> operation. Rules are\n  simplified in an unrestricted forward manner.\n\n  While @{method (HOL) ind_cases} is a proof method to apply the result\n  immediately as elimination rules, @{command (HOL) \"inductive_cases\"}\n  provides case split theorems at the theory level for later use. The\n  @{keyword \"for\"} argument of the @{method (HOL) ind_cases} method allows to\n  specify a list of variables that should be generalized before applying the\n  resulting rule.\n\\<close>\n\n\nsection \\<open>Adhoc tuples\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) split_format}\\<open>\\<^sup>*\\<close> & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{attribute (HOL) split_format} ('(' 'complete' ')')?\n  \\<close>\n\n  \\<^descr> @{attribute (HOL) split_format}\\ \\<open>(complete)\\<close> causes arguments in function\n  applications to be represented canonically according to their tuple type\n  structure.\n\n  Note that this operation tends to invent funny names for new local\n  parameters introduced.\n\\<close>\n\n\nchapter \\<open>Executable code \\label{ch:export-code}\\<close>\n\ntext \\<open>\n  For validation purposes, it is often useful to \\<^emph>\\<open>execute\\<close> specifications. In\n  principle, execution could be simulated by Isabelle's inference kernel, i.e.\n  by a combination of resolution and simplification. Unfortunately, this\n  approach is rather inefficient. A more efficient way of executing\n  specifications is to translate them into a functional programming language\n  such as ML.\n\n  Isabelle provides a generic framework to support code generation from\n  executable specifications. Isabelle/HOL instantiates these mechanisms in a\n  way that is amenable to end-user applications. Code can be generated for\n  functional programs (including overloading using type classes) targeting SML\n  @{cite SML}, OCaml @{cite OCaml}, Haskell @{cite \"haskell-revised-report\"}\n  and Scala @{cite \"scala-overview-tech-report\"}. Conceptually, code\n  generation is split up in three steps: \\<^emph>\\<open>selection\\<close> of code theorems,\n  \\<^emph>\\<open>translation\\<close> into an abstract executable view and \\<^emph>\\<open>serialization\\<close> to a\n  specific \\<^emph>\\<open>target language\\<close>. Inductive specifications can be executed using\n  the predicate compiler which operates within HOL. See @{cite\n  \"isabelle-codegen\"} for an introduction.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"export_code\"}\\<open>\\<^sup>*\\<close> & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{attribute_def (HOL) code} & : & \\<open>attribute\\<close> \\\\\n    @{command_def (HOL) \"code_datatype\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"print_codesetup\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{attribute_def (HOL) code_unfold} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) code_post} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) code_abbrev} & : & \\<open>attribute\\<close> \\\\\n    @{command_def (HOL) \"print_codeproc\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"code_thms\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"code_deps\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"code_reserved\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_printing\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_identifier\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_monad\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_reflect\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_pred\"} & : & \\<open>theory \\<rightarrow> proof(prove)\\<close> \\\\\n    @{attribute_def (HOL) code_timing} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) code_simp_trace} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) code_runtime_trace} & : & \\<open>attribute\\<close>\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) export_code} @'open'? \\<newline> (const_expr+) (export_target*)\n    ;\n    export_target:\n      @'in' target (@'module_name' @{syntax name})? \\<newline>\n      (@'file_prefix' @{syntax path})? ('(' args ')')?\n    ;\n    target: 'SML' | 'OCaml' | 'Haskell' | 'Scala' | 'Eval'\n    ;\n    const_expr: (const | 'name._' | '_')\n    ;\n    const: @{syntax term}\n    ;\n    type_constructor: @{syntax name}\n    ;\n    class: @{syntax name}\n    ;\n    path: @{syntax embedded}\n    ;\n    @@{attribute (HOL) code} ('equation' | 'nbe' | 'abstype' | 'abstract'\n      | 'del' | 'drop:' (const+) | 'abort:' (const+))?\n    ;\n    @@{command (HOL) code_datatype} (const+)\n    ;\n    @@{attribute (HOL) code_unfold} 'del'?\n    ;\n    @@{attribute (HOL) code_post} 'del'?\n    ;\n    @@{attribute (HOL) code_abbrev} 'del'?\n    ;\n    @@{command (HOL) code_thms} (const_expr+)\n    ;\n    @@{command (HOL) code_deps} (const_expr+)\n    ;\n    @@{command (HOL) code_reserved} target (@{syntax string}+)\n    ;\n    symbol_const: @'constant' const\n    ;\n    symbol_type_constructor: @'type_constructor' type_constructor\n    ;\n    symbol_class: @'type_class' class\n    ;\n    symbol_class_relation: @'class_relation' class ('<' | '\\<subseteq>') class\n    ;\n    symbol_class_instance: @'class_instance' type_constructor @'::' class\n    ;\n    symbol_module: @'code_module' name\n    ;\n    syntax: @{syntax string} | (@'infix' | @'infixl' | @'infixr')\n      @{syntax nat} @{syntax string}\n    ;\n    printing_const: symbol_const ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' syntax ? + @'and')\n    ;\n    printing_type_constructor: symbol_type_constructor ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' syntax ? + @'and')\n    ;\n    printing_class: symbol_class ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' @{syntax string} ? + @'and')\n    ;\n    printing_class_relation: symbol_class_relation ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' @{syntax string} ? + @'and')\n    ;\n    printing_class_instance: symbol_class_instance ('\\<rightharpoonup>'| '=>') \\<newline>\n      ('(' target ')' '-' ? + @'and')\n    ;\n    printing_module: symbol_module ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' (@{syntax string} for_symbol?)? + @'and')\n    ;\n    for_symbol:\n      @'for'\n        ((symbol_const | symbol_typeconstructor |\n          symbol_class | symbol_class_relation | symbol_class_instance)+)\n    ;\n    @@{command (HOL) code_printing} ((printing_const | printing_type_constructor\n      | printing_class | printing_class_relation | printing_class_instance\n      | printing_module) + '|')\n    ;\n    @@{command (HOL) code_identifier} ((symbol_const | symbol_type_constructor\n      | symbol_class | symbol_class_relation | symbol_class_instance\n      | symbol_module ) ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' @{syntax string} ? + @'and') + '|')\n    ;\n    @@{command (HOL) code_monad} const const target\n    ;\n    @@{command (HOL) code_reflect} @{syntax string} \\<newline>\n      (@'datatypes' (@{syntax string} '=' ('_' | (@{syntax string} + '|') + @'and')))? \\<newline>\n      (@'functions' (@{syntax string} +))? (@'file_prefix' @{syntax path})?\n    ;\n    @@{command (HOL) code_pred} \\<newline> ('(' @'modes' ':' modedecl ')')? \\<newline> const\n    ;\n    modedecl: (modes | ((const ':' modes) \\<newline>\n      (@'and' ((const ':' modes @'and')+))?))\n    ;\n    modes: mode @'as' const\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"export_code\"} generates code for a given list of\n  constants in the specified target language(s). If no serialization\n  instruction is given, only abstract code is generated internally.\n\n  Constants may be specified by giving them literally, referring to all\n  executable constants within a certain theory by giving \\<open>name._\\<close>, or\n  referring to \\<^emph>\\<open>all\\<close> executable constants currently available by giving \\<open>_\\<close>.\n\n  By default, exported identifiers are minimized per module. This can be\n  suppressed by prepending @{keyword \"open\"} before the list of constants.\n\n  By default, for each involved theory one corresponding name space module is\n  generated. Alternatively, a module name may be specified after the @{keyword\n  \"module_name\"} keyword; then \\<^emph>\\<open>all\\<close> code is placed in this module.\n\n  Generated code is output as logical files within the theory context, as well\n  as session exports that can be retrieved using @{tool_ref export}, or @{tool\n  build} with option \\<^verbatim>\\<open>-e\\<close> and suitable \\isakeyword{export\\_files}\n  specifications in the session \\<^verbatim>\\<open>ROOT\\<close> entry. All files have a common\n  directory prefix: the long theory name plus ``\\<^verbatim>\\<open>code\\<close>''. The actual file\n  name is determined by the target language together with an optional\n  \\<^theory_text>\\<open>file_prefix\\<close> (the default is ``\\<^verbatim>\\<open>export\\<close>'' with a consecutive number\n  within the current theory). For \\<open>SML\\<close>, \\<open>OCaml\\<close> and \\<open>Scala\\<close>, the file prefix\n  becomes a plain file with extension (e.g.\\ ``\\<^verbatim>\\<open>.ML\\<close>'' for SML). For\n  \\<open>Haskell\\<close> the file prefix becomes a directory that is populated with a\n  separate file for each module (with extension ``\\<^verbatim>\\<open>.hs\\<close>'').\n\n  Serializers take an optional list of arguments in parentheses.\n\n      \\<^item> For \\<^emph>\\<open>Haskell\\<close> a module name prefix may be given using the ``\\<open>root:\\<close>''\n      argument; ``\\<open>string_classes\\<close>'' adds a ``\\<^verbatim>\\<open>deriving (Read, Show)\\<close>'' clause \n      to each appropriate datatype declaration.\n\n      \\<^item> For \\<^emph>\\<open>Scala\\<close>, ``\\<open>case_insensitive\\<close>'' avoids name clashes on\n      case-insensitive file systems.\n\n  \\<^descr> @{attribute (HOL) code} declares code equations for code generation.\n\n  Variant \\<open>code equation\\<close> declares a conventional equation as code equation.\n\n  Variants \\<open>code abstype\\<close> and \\<open>code abstract\\<close> declare abstract datatype\n  certificates or code equations on abstract datatype representations\n  respectively.\n\n  Vanilla \\<open>code\\<close> falls back to \\<open>code equation\\<close> or \\<open>code abstract\\<close>\n  depending on the syntactic shape of the underlying equation.\n\n  Variant \\<open>code del\\<close> deselects a code equation for code generation.\n\n  Variant \\<open>code nbe\\<close> accepts also non-left-linear equations for\n  \\<^emph>\\<open>normalization by evaluation\\<close> only.\n\n  Variants \\<open>code drop:\\<close> and \\<open>code abort:\\<close> take a list of constants as arguments\n  and drop all code equations declared for them. In the case of \\<open>abort\\<close>,\n  these constants if needed are implemented by program abort\n  (exception).\n\n  Packages declaring code equations usually provide a reasonable default\n  setup.\n\n  \\<^descr> @{command (HOL) \"code_datatype\"} specifies a constructor set for a logical\n  type.\n\n  \\<^descr> @{command (HOL) \"print_codesetup\"} gives an overview on selected code\n  equations and code generator datatypes.\n\n  \\<^descr> @{attribute (HOL) code_unfold} declares (or with option ``\\<open>del\\<close>'' removes)\n  theorems which during preprocessing are applied as rewrite rules to any code\n  equation or evaluation input.\n\n  \\<^descr> @{attribute (HOL) code_post} declares (or with option ``\\<open>del\\<close>'' removes)\n  theorems which are applied as rewrite rules to any result of an evaluation.\n\n  \\<^descr> @{attribute (HOL) code_abbrev} declares (or with option ``\\<open>del\\<close>'' removes)\n  equations which are applied as rewrite rules to any result of an evaluation\n  and symmetrically during preprocessing to any code equation or evaluation\n  input.\n\n  \\<^descr> @{command (HOL) \"print_codeproc\"} prints the setup of the code generator\n  preprocessor.\n\n  \\<^descr> @{command (HOL) \"code_thms\"} prints a list of theorems representing the\n  corresponding program containing all given constants after preprocessing.\n\n  \\<^descr> @{command (HOL) \"code_deps\"} visualizes dependencies of theorems\n  representing the corresponding program containing all given constants after\n  preprocessing.\n\n  \\<^descr> @{command (HOL) \"code_reserved\"} declares a list of names as reserved for\n  a given target, preventing it to be shadowed by any generated code.\n\n  \\<^descr> @{command (HOL) \"code_printing\"} associates a series of symbols\n  (constants, type constructors, classes, class relations, instances, module\n  names) with target-specific serializations; omitting a serialization deletes\n  an existing serialization.\n\n  \\<^descr> @{command (HOL) \"code_monad\"} provides an auxiliary mechanism to generate\n  monadic code for Haskell.\n\n  \\<^descr> @{command (HOL) \"code_identifier\"} associates a a series of symbols\n  (constants, type constructors, classes, class relations, instances, module\n  names) with target-specific hints how these symbols shall be named. These\n  hints gain precedence over names for symbols with no hints at all.\n  Conflicting hints are subject to name disambiguation. \\<^emph>\\<open>Warning:\\<close> It is at\n  the discretion of the user to ensure that name prefixes of identifiers in\n  compound statements like type classes or datatypes are still the same.\n\n  \\<^descr> @{command (HOL) \"code_reflect\"} without a ``\\<^theory_text>\\<open>file_prefix\\<close>'' argument\n  compiles code into the system runtime environment and modifies the code\n  generator setup that future invocations of system runtime code generation\n  referring to one of the ``\\<open>datatypes\\<close>'' or ``\\<open>functions\\<close>'' entities use\n  these precompiled entities. With a ``\\<^theory_text>\\<open>file_prefix\\<close>'' argument, the\n  corresponding code is generated/exported to the specified file (as for\n  \\<^theory_text>\\<open>export_code\\<close>) without modifying the code generator setup.\n\n  \\<^descr> @{command (HOL) \"code_pred\"} creates code equations for a predicate given\n  a set of introduction rules. Optional mode annotations determine which\n  arguments are supposed to be input or output. If alternative introduction\n  rules are declared, one must prove a corresponding elimination rule.\n\n  \\<^descr> @{attribute (HOL) \"code_timing\"} scrapes timing samples from different\n  stages of the code generator.\n\n  \\<^descr> @{attribute (HOL) \"code_simp_trace\"} traces the simplifier when it is\n  used with code equations.\n\n  \\<^descr> @{attribute (HOL) \"code_runtime_trace\"} traces ML code generated\n  dynamically for execution.\n\\<close>\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/Doc/Isar_Ref/HOL_Specific.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331606115021, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3214674658313222}}
{"text": "section\\<open>Main definitions of the development\\label{sec:main-definitions}\\<close>\n\ntheory Definitions_Main\n  imports\n    Absolute_Versions\nbegin\n\ntext\\<open>This theory gathers the main definitions of the\n\\<^session>\\<open>Transitive_Models\\<close> session and the present one.\n\nIt might be considered as the bare minimum reading requisite to\ntrust that our development indeed formalizes the theory of\nforcing. This should be mathematically clear since this is the\nonly known method for obtaining proper extensions of ctms while\npreserving the ordinals.\n\nThe main theorem of this session and all of its relevant definitions\nappear in Section~\\ref{sec:def-main-forcing}. The reader trusting\nall the libraries on which our development is based, might jump\ndirectly to Section~\\ref{sec:relative-arith}, which treats relative\ncardinal arithmetic as implemented in\n\\<^session>\\<open>Transitive_Models\\<close>. But in case one wants to dive deeper, the\nfollowing sections treat some basic concepts of the ZF logic\n(Section~\\ref{sec:def-main-ZF}) and in the\nZF-Constructible library (Section~\\ref{sec:def-main-relative})\non which our definitions are built.\n\\<close>\n\ndeclare [[show_question_marks=false]]\n\nsubsection\\<open>ZF\\label{sec:def-main-ZF}\\<close>\n\ntext\\<open>For the basic logic ZF we restrict ourselves to just a few\nconcepts.\\<close>\n\nthm bij_def[unfolded inj_def surj_def]\ntext\\<open>@{thm [display] bij_def[unfolded inj_def surj_def]}\\<close>\n(*\nbij(A, B) \\<equiv>\n  {f \\<in> A \\<rightarrow> B . \\<forall>w\\<in>A. \\<forall>x\\<in>A. f ` w = f ` x \\<longrightarrow> w = x} \\<inter>\n  {f \\<in> A \\<rightarrow> B . \\<forall>y\\<in>B. \\<exists>x\\<in>A. f ` x = y}\n*)\n\nthm eqpoll_def\ntext\\<open>@{thm [display] eqpoll_def}\\<close>\n(*\n  A \\<approx> B \\<equiv> \\<exists>f. f \\<in> bij(A, B)\n*)\n\nthm Transset_def\ntext\\<open>@{thm [display] Transset_def}\\<close>\n(*\n  Transset(i) \\<equiv> \\<forall>x\\<in>i. x \\<subseteq> i\n*)\n\nthm Ord_def\ntext\\<open>@{thm [display] Ord_def}\\<close>\n(*\n  Ord(i) \\<equiv> Transset(i) \\<and> (\\<forall>x\\<in>i. Transset(x))\n*)\n\nthm lt_def le_iff\ntext\\<open>@{thm [display] lt_def le_iff}\\<close>\n(*\n  i < j \\<equiv> i \\<in> j \\<and> Ord(j)\n  i \\<le> j \\<longleftrightarrow> i < j \\<or> i = j \\<and> Ord(j)\n*)\n\ntext\\<open>With the concepts of empty set and successor in place,\\<close>\nlemma empty_def': \"\\<forall>x. x \\<notin> 0\" by simp\nlemma succ_def': \"succ(i) = i \\<union> {i}\" by blast\n\ntext\\<open>we can define the set of natural numbers \\<^term>\\<open>\\<omega>\\<close>. In the\nsources, it is  defined as a fixpoint, but here we just write\nits characterization as the first limit ordinal.\\<close>\nthm Limit_nat[unfolded Limit_def] nat_le_Limit[unfolded Limit_def]\ntext\\<open>@{thm [display] Limit_nat[unfolded Limit_def]\n nat_le_Limit[unfolded Limit_def]}\\<close>\n(*\n  Ord(\\<omega>) \\<and> 0 < \\<omega> \\<and> (\\<forall>y. y < \\<omega> \\<longrightarrow> succ(y) < \\<omega>)\n  Ord(i) \\<and> 0 < i \\<and> (\\<forall>y. y < i \\<longrightarrow> succ(y) < i) \\<Longrightarrow> \\<omega> \\<le> i\n*)\n\ntext\\<open>Then, addition and predecessor on \\<^term>\\<open>\\<omega>\\<close> are inductively\ncharacterized as follows:\\<close>\nthm add_0_right add_succ_right pred_0 pred_succ_eq\ntext\\<open>@{thm [display] add_succ_right add_0_right pred_0 pred_succ_eq}\\<close>\n(*\n  m \\<in> \\<omega> \\<Longrightarrow> m +\\<^sub>\\<omega> 0 = m\n  m +\\<^sub>\\<omega> succ(n) = succ(m +\\<^sub>\\<omega> n)\n\n  pred(0) = 0\n  pred(succ(y)) = y\n*)\n\ntext\\<open>Lists on a set \\<^term>\\<open>A\\<close> can be characterized by being\nrecursively generated from the empty list \\<^term>\\<open>[]\\<close> and the\noperation \\<^term>\\<open>Cons\\<close> that adds a new element to the left end;\nthe induction theorem for them shows that the characterization is\n“complete”.\\<close>\n\nthm Nil Cons list.induct\ntext\\<open>@{thm [display] Nil Cons list.induct }\\<close>\n(*\n  [] \\<in> list(A)\n  a \\<in> A \\<Longrightarrow> l \\<in> list(A) \\<Longrightarrow> Cons(a, l) \\<in> list(A)\n  x \\<in> list(A) \\<Longrightarrow>\n  P([]) \\<Longrightarrow> (\\<And>a l. a \\<in> A \\<Longrightarrow> l \\<in> list(A) \\<Longrightarrow> P(l) \\<Longrightarrow> P(Cons(a, l))) \\<Longrightarrow> P(x)\n*)\n\ntext\\<open>Length, concatenation, and \\<^term>\\<open>n\\<close>th element of lists are\nrecursively characterized as follows.\\<close>\nthm length.simps app.simps nth_0 nth_Cons\ntext\\<open>@{thm [display] length.simps app.simps nth_0 nth_Cons}\\<close>\n(*\n  length([]) = 0\n  length(Cons(a, l)) = succ(length(l))\n\n  [] @ ys = ys\n  Cons(a, l) @ ys = Cons(a, l @ ys)\n\n  nth(0, Cons(a, l)) = a\n  n \\<in> \\<omega> \\<Longrightarrow> nth(succ(n), Cons(a, l)) = nth(n, l)\n*)\ntext\\<open>We have the usual Haskell-like notation for iterated applications\nof \\<^term>\\<open>Cons\\<close>:\\<close>\nlemma Cons_app: \"[a,b,c] = Cons(a,Cons(b,Cons(c,[])))\" ..\n\ntext\\<open>Relative quantifiers restrict the range of the bound variable to a\nclass \\<^term>\\<open>M\\<close> of type \\<^typ>\\<open>i\\<Rightarrow>o\\<close>; that is, a truth-valued function with\nset arguments.\\<close>\nlemma \"\\<forall>x[M]. P(x) \\<equiv> \\<forall>x. M(x) \\<longrightarrow> P(x)\"\n      \"\\<exists>x[M]. P(x) \\<equiv> \\<exists>x. M(x) \\<and> P(x)\"\n  unfolding rall_def rex_def .\n\ntext\\<open>Finally, a set can be viewed (“cast”) as a class using the\nfollowing function of type \\<^typ>\\<open>i\\<Rightarrow>(i\\<Rightarrow>o)\\<close>.\\<close>\nthm setclass_iff\ntext\\<open>@{thm [display] setclass_iff}\\<close>\n(*\n  (##A)(x) \\<longleftrightarrow> x \\<in> A\n*)\n\nsubsection\\<open>Relative concepts\\label{sec:def-main-relative}\\<close>\ntext\\<open>A list of relative concepts (mostly from the ZF-Constructible\n    library) follows next.\\<close>\n\nthm big_union_def\ntext\\<open>@{thm [display] big_union_def}\\<close>\n(*\n  big_union(M, A, z) \\<equiv> \\<forall>x[M]. x \\<in> z \\<longleftrightarrow> (\\<exists>y[M]. y \\<in> A \\<and> x \\<in> y)\n*)\n\nthm upair_def\ntext\\<open>@{thm [display] upair_def}\\<close>\n(*\n  upair(M, a, b, z) \\<equiv> a \\<in> z \\<and> b \\<in> z \\<and> (\\<forall>x[M]. x \\<in> z \\<longrightarrow> x = a \\<or> x = b)\n*)\n\nthm pair_def\ntext\\<open>@{thm [display] pair_def}\\<close>\n(*\n  pair(M, a, b, z) \\<equiv> \\<exists>x[M]. upair(M, a, a, x) \\<and>\n                        (\\<exists>y[M]. upair(M, a, b, y) \\<and> upair(M, x, y, z))\n*)\n\nthm successor_def[unfolded is_cons_def union_def]\ntext\\<open>@{thm [display] successor_def[unfolded is_cons_def union_def]}\\<close>\n(*\n  successor(M, a, z) \\<equiv> \\<exists>x[M]. upair(M, a, a, x) \\<and> (\\<forall>xa[M]. xa \\<in> z \\<longleftrightarrow> xa \\<in> x \\<or> xa \\<in> a)\n*)\n\nthm empty_def\ntext\\<open>@{thm [display] empty_def}\\<close>\n(*\n  empty(M, z) \\<equiv> \\<forall>x[M]. x \\<notin> z\n*)\n\nthm transitive_set_def[unfolded subset_def]\ntext\\<open>@{thm [display] transitive_set_def[unfolded subset_def]}\\<close>\n(*\n  transitive_set(M, a) \\<equiv> \\<forall>x[M]. x \\<in> a \\<longrightarrow> (\\<forall>xa[M]. xa \\<in> x \\<longrightarrow> xa \\<in> a)\n*)\n\n\nthm ordinal_def\ntext\\<open>@{thm [display] ordinal_def}\\<close>\n(*\n  ordinal(M, a) \\<equiv> transitive_set(M, a) \\<and> (\\<forall>x[M]. x \\<in> a \\<longrightarrow>\n                                              transitive_set(M, x))\n*)\n\nthm image_def\ntext\\<open>@{thm [display] image_def}\\<close>\n(*\n  image(M, r, A, z) \\<equiv> \\<forall>y[M]. y \\<in> z \\<longleftrightarrow>\n                (\\<exists>w[M]. w \\<in> r \\<and> (\\<exists>x[M]. x \\<in> A \\<and> pair(M, x, y, w)))\n*)\n\nthm fun_apply_def\ntext\\<open>@{thm [display] fun_apply_def}\\<close>\n(*\n  fun_apply(M, f, x, y) \\<equiv> \\<exists>xs[M]. \\<exists>fxs[M]. upair(M, x, x, xs) \\<and>\n                       image(M, f, xs, fxs) \\<and> big_union(M, fxs, y)\n*)\n\nthm is_function_def\ntext\\<open>@{thm [display] is_function_def}\\<close>\n(*\n  is_function(M, r) \\<equiv> \\<forall>x[M]. \\<forall>y[M]. \\<forall>y'[M]. \\<forall>p[M]. \\<forall>p'[M].\n       pair(M, x, y, p) \\<longrightarrow> pair(M, x, y', p') \\<longrightarrow> p \\<in> r \\<longrightarrow> p' \\<in> r \\<longrightarrow> y = y'\n*)\n\nthm is_relation_def\ntext\\<open>@{thm [display] is_relation_def}\\<close>\n(*\n  is_relation(M, r) \\<equiv> \\<forall>z[M]. z \\<in> r \\<longrightarrow> (\\<exists>x[M]. \\<exists>y[M]. pair(M, x, y, z))\n*)\n\nthm is_domain_def\ntext\\<open>@{thm [display] is_domain_def}\\<close>\n(*\n  is_domain(M, r, z) \\<equiv> \\<forall>x[M]. x \\<in> z \\<longleftrightarrow>\n                        (\\<exists>w[M]. w \\<in> r \\<and> (\\<exists>y[M]. pair(M, x, y, w)))\n*)\n\nthm typed_function_def\ntext\\<open>@{thm [display] typed_function_def}\\<close>\n(*\n  typed_function(M, A, B, r) \\<equiv> is_function(M, r) \\<and> is_relation(M, r) \\<and>\n                                is_domain(M, r, A) \\<and>\n            (\\<forall>u[M]. u \\<in> r \\<longrightarrow> (\\<forall>x[M]. \\<forall>y[M]. pair(M, x, y, u) \\<longrightarrow> y \\<in> B))\n*)\n\nthm is_function_space_def[unfolded is_funspace_def]\n  function_space_rel_def surjection_def\ntext\\<open>@{thm [display] is_function_space_def[unfolded is_funspace_def]\n  function_space_rel_def surjection_def}\\<close>\n(*\n  is_function_space(M, A, B, fs) \\<equiv>\n  M(fs) \\<and> (\\<forall>f[M]. f \\<in> fs \\<longleftrightarrow> typed_function(M, A, B, f))\n\n  A \\<rightarrow>\\<^bsup>M\\<^esup> B \\<equiv> THE d. is_function_space(M, A, B, d)\n\n  surjection(M, A, B, f) \\<equiv>\n  typed_function(M, A, B, f) \\<and>\n  (\\<forall>y[M]. y \\<in> B \\<longrightarrow> (\\<exists>x[M]. x \\<in> A \\<and> is_apply(M, f, x, y)))\n*)\n\n\ntext\\<open>Relative version of the $\\ZFC$ axioms\\<close>\nthm extensionality_def\ntext\\<open>@{thm [display] extensionality_def}\\<close>\n(*\n  extensionality(M) \\<equiv> \\<forall>x[M]. \\<forall>y[M]. (\\<forall>z[M]. z \\<in> x \\<longleftrightarrow> z \\<in> y) \\<longrightarrow> x = y\n*)\n\nthm foundation_ax_def\ntext\\<open>@{thm [display] foundation_ax_def}\\<close>\n(*\n  foundation_ax(M) \\<equiv> \\<forall>x[M]. (\\<exists>y[M]. y \\<in> x) \\<longrightarrow> (\\<exists>y[M]. y \\<in> x \\<and> \\<not> (\\<exists>z[M]. z \\<in> x \\<and> z \\<in> y))\n*)\n\nthm upair_ax_def\ntext\\<open>@{thm [display] upair_ax_def}\\<close>\n(*\n  upair_ax(M) \\<equiv> \\<forall>x[M]. \\<forall>y[M]. \\<exists>z[M]. upair(M, x, y, z)\n*)\n\nthm Union_ax_def\ntext\\<open>@{thm [display] Union_ax_def}\\<close>\n(*\n  Union_ax(M) \\<equiv> \\<forall>x[M]. \\<exists>z[M]. \\<forall>xa[M]. xa \\<in> z \\<longleftrightarrow> (\\<exists>y[M]. y \\<in> x \\<and> xa \\<in> y)\n*)\n\nthm power_ax_def[unfolded powerset_def subset_def]\ntext\\<open>@{thm [display] power_ax_def[unfolded powerset_def subset_def]}\\<close>\n(*\n  power_ax(M) \\<equiv> \\<forall>x[M]. \\<exists>z[M]. \\<forall>xa[M]. xa \\<in> z \\<longleftrightarrow> (\\<forall>xb[M]. xb \\<in> xa \\<longrightarrow> xb \\<in> x)\n*)\n\nthm infinity_ax_def\ntext\\<open>@{thm [display] infinity_ax_def}\\<close>\n(*\n  infinity_ax(M) \\<equiv> \\<exists>I[M]. (\\<exists>z[M]. empty(M, z) \\<and> z \\<in> I) \\<and> (\\<forall>y[M]. y \\<in> I \\<longrightarrow>\n                        (\\<exists>sy[M]. successor(M, y, sy) \\<and> sy \\<in> I))\n*)\n\nthm choice_ax_def\ntext\\<open>@{thm [display] choice_ax_def}\\<close>\n(*\n  choice_ax(M) \\<equiv> \\<forall>x[M]. \\<exists>a[M]. \\<exists>f[M]. ordinal(M, a) \\<and> surjection(M, a, x, f)\n*)\n\nthm separation_def\ntext\\<open>@{thm [display] separation_def}\\<close>\n(*\n  separation(M, P) \\<equiv> \\<forall>z[M]. \\<exists>y[M]. \\<forall>x[M]. x \\<in> y \\<longleftrightarrow> x \\<in> z \\<and> P(x)\n*)\n\nthm univalent_def\ntext\\<open>@{thm [display] univalent_def}\\<close>\n(*\n  univalent(M, A, P) \\<equiv> \\<forall>x[M]. x \\<in> A \\<longrightarrow>\n                          (\\<forall>y[M]. \\<forall>z[M]. P(x, y) \\<and> P(x, z) \\<longrightarrow> y = z)\n*)\n\nthm strong_replacement_def\ntext\\<open>@{thm [display] strong_replacement_def}\\<close>\n(*\n  strong_replacement(M, P) \\<equiv> \\<forall>A[M]. univalent(M, A, P) \\<longrightarrow>\n       (\\<exists>Y[M]. \\<forall>b[M]. b \\<in> Y \\<longleftrightarrow> (\\<exists>x[M]. x \\<in> A \\<and> P(x, b)))\n*)\n\ntext\\<open>Internalized formulas\\<close>\n\ntext\\<open>“Codes” for formulas (as sets) are constructed from natural\nnumbers using \\<^term>\\<open>Member\\<close>, \\<^term>\\<open>Equal\\<close>, \\<^term>\\<open>Nand\\<close>,\nand \\<^term>\\<open>Forall\\<close>.\\<close>\n\nthm Member Equal Nand Forall formula.induct\ntext\\<open>@{thm [display] Member Equal Nand Forall formula.induct}\\<close>\n(*\n  x \\<in> \\<omega> \\<Longrightarrow> y \\<in> \\<omega> \\<Longrightarrow> \\<cdot>x \\<in> y\\<cdot> \\<in> formula\n  x \\<in> \\<omega> \\<Longrightarrow> y \\<in> \\<omega> \\<Longrightarrow> \\<cdot>x = y\\<cdot> \\<in> formula\n  p \\<in> formula \\<Longrightarrow> q \\<in> formula \\<Longrightarrow> \\<cdot>\\<not>(p \\<and> q)\\<cdot> \\<in> formula\n  p \\<in> formula \\<Longrightarrow> (\\<forall>p) \\<in> formula\n\n  x \\<in> formula \\<Longrightarrow>\n  (\\<And>x y. x \\<in> \\<omega> \\<Longrightarrow> y \\<in> \\<omega> \\<Longrightarrow> P(\\<cdot>x \\<in> y\\<cdot>)) \\<Longrightarrow>\n  (\\<And>x y. x \\<in> \\<omega> \\<Longrightarrow> y \\<in> \\<omega> \\<Longrightarrow> P(\\<cdot>x = y\\<cdot>)) \\<Longrightarrow>\n  (\\<And>p q. p \\<in> formula \\<Longrightarrow> P(p) \\<Longrightarrow> q \\<in> formula \\<Longrightarrow> P(q) \\<Longrightarrow> P(\\<cdot>\\<not>(p \\<and> q)\\<cdot>)) \\<Longrightarrow>\n  (\\<And>p. p \\<in> formula \\<Longrightarrow> P(p) \\<Longrightarrow> P((\\<forall>p))) \\<Longrightarrow> P(x)\n*)\n\ntext\\<open>Definitions for the other connectives and the internal existential\nquantifier are also provided. For instance, negation:\\<close>\nthm Neg_def\ntext\\<open>@{thm [display] Neg_def}\\<close>\n(*\n  \\<cdot>\\<not>p\\<cdot> \\<equiv> \\<cdot>\\<not>(p \\<and> p)\\<cdot>\n*)\n\nthm arity.simps\ntext\\<open>@{thm [display] arity.simps}\\<close>\n(*\n  arity(\\<cdot>x \\<in> y\\<cdot>) = succ(x) \\<union> succ(y)\n  arity(\\<cdot>x = y\\<cdot>) = succ(x) \\<union> succ(y)\n  arity(\\<cdot>\\<not>(p \\<and> q)\\<cdot>) = arity(p) \\<union> arity(q)\n  arity((\\<forall>p)) = pred(arity(p))\n*)\n\ntext\\<open>We have the satisfaction relation between $\\in$-models and\n    first order formulas (given a “environment” list representing\n    the assignment of free variables),\\<close>\nthm mem_iff_sats equal_iff_sats sats_Nand_iff sats_Forall_iff\ntext\\<open>@{thm [display] mem_iff_sats equal_iff_sats sats_Nand_iff sats_Forall_iff}\\<close>\n(*\n  nth(i, env) = x \\<Longrightarrow> nth(j, env) = y \\<Longrightarrow> env \\<in> list(A) \\<Longrightarrow> x \\<in> y \\<longleftrightarrow> A, env \\<Turnstile> \\<cdot>i \\<in> j\\<cdot>\n  nth(i, env) = x \\<Longrightarrow> nth(j, env) = y \\<Longrightarrow> env \\<in> list(A) \\<Longrightarrow> x = y \\<longleftrightarrow> A, env \\<Turnstile> \\<cdot>i = j\\<cdot>\n  env \\<in> list(A) \\<Longrightarrow> (A, env \\<Turnstile> \\<cdot>\\<not>(p \\<and> q)\\<cdot>) \\<longleftrightarrow> \\<not> ((A, env \\<Turnstile> p) \\<and> (A, env \\<Turnstile> q))\n  env \\<in> list(A) \\<Longrightarrow> (A, env \\<Turnstile> (\\<cdot>\\<forall>p\\<cdot>)) \\<longleftrightarrow> (\\<forall>x\\<in>A. A, Cons(x, env) \\<Turnstile> p)*)\n\ntext\\<open>as well as the satisfaction of an arbitrary set of sentences.\\<close>\nthm satT_def\ntext\\<open>@{thm [display] satT_def}\\<close>\n(*\n  A \\<Turnstile> \\<Phi>  \\<equiv>  \\<forall>\\<phi>\\<in>\\<Phi>. A, [] \\<Turnstile> \\<phi>\n*)\n\ntext\\<open>The internalized (viz. as elements of the set \\<^term>\\<open>formula\\<close>)\n    version of the axioms follow next.\\<close>\n\nthm ZF_union_iff_sats ZF_power_iff_sats ZF_pairing_iff_sats\n  ZF_foundation_iff_sats ZF_extensionality_iff_sats\n  ZF_infinity_iff_sats sats_ZF_separation_fm_iff\n  sats_ZF_replacement_fm_iff ZF_choice_iff_sats\ntext\\<open>@{thm [display] ZF_union_iff_sats ZF_power_iff_sats\n  ZF_pairing_iff_sats\n  ZF_foundation_iff_sats ZF_extensionality_iff_sats\n  ZF_infinity_iff_sats sats_ZF_separation_fm_iff\n  sats_ZF_replacement_fm_iff ZF_choice_iff_sats}\\<close>\n(*\n  Union_ax(##A) \\<longleftrightarrow> A, [] \\<Turnstile> \\<cdot>Union Ax\\<cdot>\n  power_ax(##A) \\<longleftrightarrow> A, [] \\<Turnstile> \\<cdot>Powerset Ax\\<cdot>\n  upair_ax(##A) \\<longleftrightarrow> A, [] \\<Turnstile> \\<cdot>Pairing\\<cdot>\n  foundation_ax(##A) \\<longleftrightarrow> A, [] \\<Turnstile> \\<cdot>Foundation\\<cdot>\n  extensionality(##A) \\<longleftrightarrow> A, [] \\<Turnstile> \\<cdot>Extensionality\\<cdot>\n  infinity_ax(##A) \\<longleftrightarrow> A, [] \\<Turnstile> \\<cdot>Infinity\\<cdot>\n\n  \\<phi> \\<in> formula \\<Longrightarrow>\n  (M, [] \\<Turnstile> \\<cdot>Separation(\\<phi>)\\<cdot>) \\<longleftrightarrow>\n  (\\<forall>env\\<in>list(M).\n      arity(\\<phi>) \\<le> 1 +\\<^sub>\\<omega> length(env) \\<longrightarrow> separation(##M, \\<lambda>x. M, [x] @ env \\<Turnstile> \\<phi>))\n\n  \\<phi> \\<in> formula \\<Longrightarrow>\n  (M, [] \\<Turnstile> \\<cdot>Replacement(\\<phi>)\\<cdot>) \\<longleftrightarrow> (\\<forall>env. replacement_assm(M, env, \\<phi>))\n\n  choice_ax(##A) \\<longleftrightarrow> A, [] \\<Turnstile> \\<cdot>AC\\<cdot>\n*)\n\ntext\\<open>Above, we use the following:\\<close>\n\nthm replacement_assm_def\ntext\\<open>@{thm [display] replacement_assm_def}\\<close>\n(*\nreplacement_assm(M, env, \\<phi>) \\<equiv>\n\\<phi> \\<in> formula \\<longrightarrow>\nenv \\<in> list(M) \\<longrightarrow>\narity(\\<phi>) \\<le> 2 +\\<^sub>\\<omega> length(env) \\<longrightarrow>\nstrong_replacement(##M, \\<lambda>x y. M, [x, y] @ env \\<Turnstile> \\<phi>\n*)\n\ntext\\<open>Finally, the axiom sets are defined as follows.\\<close>\n\nthm ZF_fin_def ZF_schemes_def Zermelo_fms_def ZC_def ZF_def ZFC_def\ntext\\<open>@{thm [display] ZF_fin_def ZF_schemes_def Zermelo_fms_def ZC_def ZF_def\n  ZFC_def}\\<close>\n(*\n  ZF_fin \\<equiv> {\\<cdot>Extensionality\\<cdot>, \\<cdot>Foundation\\<cdot>, \\<cdot>Pairing\\<cdot>, \\<cdot>Union Ax\\<cdot>, \\<cdot>Infinity\\<cdot>, \\<cdot>Powerset Ax\\<cdot>}\n  ZF_schemes \\<equiv> {\\<cdot>Separation(p)\\<cdot> . p \\<in> formula} \\<union> {\\<cdot>Replacement(p)\\<cdot> . p \\<in> formula}\n  \\<cdot>Z\\<cdot> \\<equiv> ZF_fin \\<union> {\\<cdot>Separation(p)\\<cdot> . p \\<in> formula}\n  ZC \\<equiv> \\<cdot>Z\\<cdot> \\<union> {\\<cdot>AC\\<cdot>}\n  ZF \\<equiv> ZF_schemes \\<union> ZF_fin\n  ZFC \\<equiv> ZF \\<union> {\\<cdot>AC\\<cdot>}\n*)\n\nsubsection\\<open>Relativization of infinitary arithmetic\\label{sec:relative-arith}\\<close>\n\ntext\\<open>In order to state the defining property of the relative\n    equipotence relation, we work under the assumptions of the\n    locale \\<^term>\\<open>M_cardinals\\<close>. They comprise a finite set\n    of instances of Separation and Replacement to prove\n    closure properties of the transitive class \\<^term>\\<open>M\\<close>.\\<close>\n\nlemma (in M_cardinals) eqpoll_def':\n  assumes \"M(A)\" \"M(B)\" shows \"A \\<approx>\\<^bsup>M\\<^esup> B \\<longleftrightarrow> (\\<exists>f[M]. f \\<in> bij(A,B))\"\n  using assms unfolding eqpoll_rel_def by auto\n\ntext\\<open>Below, $\\mu$ denotes the minimum operator on the ordinals.\\<close>\nlemma cardinalities_defs:\n  fixes M::\"i\\<Rightarrow>o\"\n  shows\n    \"|A|\\<^bsup>M\\<^esup> \\<equiv> \\<mu> i. M(i) \\<and> i \\<approx>\\<^bsup>M\\<^esup> A\"\n    \"Card\\<^bsup>M\\<^esup>(\\<alpha>) \\<equiv> \\<alpha> = |\\<alpha>|\\<^bsup>M\\<^esup>\"\n    \"\\<kappa>\\<^bsup>\\<up>\\<nu>,M\\<^esup> \\<equiv> |\\<nu> \\<rightarrow>\\<^bsup>M\\<^esup> \\<kappa>|\\<^bsup>M\\<^esup>\"\n    \"(\\<kappa>\\<^sup>+)\\<^bsup>M\\<^esup> \\<equiv> \\<mu> x. M(x) \\<and> Card\\<^bsup>M\\<^esup>(x) \\<and> \\<kappa> < x\"\n  unfolding cardinal_rel_def cexp_rel_def\n    csucc_rel_def Card_rel_def .\n\ncontext M_aleph\nbegin\n\ntext\\<open>Analogous to the previous Lemma @{thm [source] eqpoll_def'}, we are now under\n    the assumptions of the locale \\<^term>\\<open>M_aleph\\<close>. The axiom instances\n    included are sufficient to state and prove the defining\n    properties of the relativized \\<^term>\\<open>Aleph\\<close> function\n    (in particular, the required ability to perform transfinite recursions).\\<close>\n\nthm Aleph_rel_zero Aleph_rel_succ Aleph_rel_limit\ntext\\<open>@{thm [display] Aleph_rel_zero Aleph_rel_succ Aleph_rel_limit}\\<close>\n(*\n  \\<aleph>\\<^bsub>0\\<^esub>\\<^bsup>M\\<^esup> = \\<omega>\n  Ord(\\<alpha>) \\<Longrightarrow> M(\\<alpha>) \\<Longrightarrow> \\<aleph>\\<^bsub>succ(\\<alpha>)\\<^esub>\\<^bsup>M\\<^esup> = (\\<aleph>\\<^bsub>\\<alpha>\\<^esub>\\<^bsup>M\\<^esup>\\<^sup>+)\\<^bsup>M\\<^esup>\n  Limit(\\<alpha>) \\<Longrightarrow> M(\\<alpha>) \\<Longrightarrow> \\<aleph>\\<^bsub>\\<alpha>\\<^esub>\\<^bsup>M\\<^esup> = (\\<Union>j\\<in>\\<alpha>. \\<aleph>\\<^bsub>j\\<^esub>\\<^bsup>M\\<^esup>)\n*)\n\nend \\<comment> \\<open>\\<^locale>\\<open>M_aleph\\<close>\\<close>\n\nlemma ContHyp_rel_def':\n  fixes N::\"i\\<Rightarrow>o\"\n  shows\n    \"CH\\<^bsup>N\\<^esup> \\<equiv> \\<aleph>\\<^bsub>1\\<^esub>\\<^bsup>N\\<^esup> = 2\\<^bsup>\\<up>\\<aleph>\\<^bsub>0\\<^esub>\\<^bsup>N\\<^esup>,N\\<^esup>\"\n  unfolding ContHyp_rel_def .\n\ntext\\<open>Under appropriate hypotheses (this time, from the locale \\<^term>\\<open>M_ZF_library\\<close>),\n   \\<^term>\\<open>CH\\<^bsup>M\\<^esup>\\<close> is equivalent to its fully relational version \\<^term>\\<open>is_ContHyp\\<close>.\n    As a sanity check, we see that if the transitive class is indeed \\<^term>\\<open>\\<V>\\<close>,\n    we recover the original $\\CH$.\\<close>\n\nthm M_ZF_library.is_ContHyp_iff is_ContHyp_iff_CH[unfolded ContHyp_def]\ntext\\<open>@{thm [display] M_ZF_library.is_ContHyp_iff\n    is_ContHyp_iff_CH[unfolded ContHyp_def]}\\<close>\n(*\n  M_ZF_library(M) \\<Longrightarrow> is_ContHyp(M) \\<longleftrightarrow> CH\\<^bsup>M\\<^esup>\n  is_ContHyp(\\<V>) \\<longleftrightarrow> \\<aleph>\\<^bsub>1\\<^esub> = 2\\<^bsup>\\<up>\\<aleph>\\<^bsub>0\\<^esub>\\<^esup>\n*)\n\ntext\\<open>In turn, the fully relational version evaluated on a nonempty\n    transitive \\<^term>\\<open>A\\<close> is equivalent to the satisfaction of the\n    first-order formula \\<^term>\\<open>\\<cdot>CH\\<cdot>\\<close>.\\<close>\nthm is_ContHyp_iff_sats\ntext\\<open>@{thm [display] is_ContHyp_iff_sats}\\<close>\n(*\n  env \\<in> list(A) \\<Longrightarrow> 0 \\<in> A \\<Longrightarrow> is_ContHyp(##A) \\<longleftrightarrow> A, env \\<Turnstile> \\<cdot>CH\\<cdot>\n*)\n\n\nsubsection\\<open>Forcing \\label{sec:def-main-forcing}\\<close>\n\ntext\\<open>Our first milestone was to obtain a proper extension using forcing.\nIts original proof didn't required the previous developments involving\nthe relativization of material on cardinal arithmetic. Now it is\nderived from a stronger result, namely @{thm [source] extensions_of_ctms}\nbelow.\\<close>\n\nthm extensions_of_ctms_ZF\ntext\\<open>@{thm [display] extensions_of_ctms_ZF}\\<close>\n(*\n  M \\<approx> \\<omega> \\<Longrightarrow>\n  Transset(M) \\<Longrightarrow>\n  M \\<Turnstile> ZF \\<Longrightarrow>\n  \\<exists>N. M \\<subseteq> N \\<and> N \\<approx> \\<omega> \\<and> Transset(N) \\<and> N \\<Turnstile> ZF \\<and> M \\<noteq> N \\<and>\n    (\\<forall>\\<alpha>. Ord(\\<alpha>) \\<longrightarrow> \\<alpha> \\<in> M \\<longleftrightarrow> \\<alpha> \\<in> N) \\<and> ((M, [] \\<Turnstile> \\<cdot>AC\\<cdot>) \\<longrightarrow> N \\<Turnstile> ZFC)\n*)\n\ntext\\<open>We can finally state our main results, namely, the existence of models\nfor $\\ZFC + \\CH$ and $\\ZFC + \\neg\\CH$ under the assumption of a ctm of $\\ZFC$.\\<close>\n\nthm ctm_ZFC_imp_ctm_not_CH\ntext\\<open>@{thm [display] ctm_ZFC_imp_ctm_not_CH}\\<close>\n(*\n  M \\<approx> \\<omega> \\<Longrightarrow>\n  Transset(M) \\<Longrightarrow>\n  M \\<Turnstile> ZFC \\<Longrightarrow>\n  \\<exists>N. M \\<subseteq> N \\<and>\n    N \\<approx> \\<omega> \\<and> Transset(N) \\<and> N \\<Turnstile> ZFC \\<union> {\\<cdot>\\<not>\\<cdot>CH\\<cdot>\\<cdot>} \\<and>\n    (\\<forall>\\<alpha>. Ord(\\<alpha>) \\<longrightarrow> \\<alpha> \\<in> M \\<longleftrightarrow> \\<alpha> \\<in> N)\n*)\n\nthm ctm_ZFC_imp_ctm_CH\ntext\\<open>@{thm [display] ctm_ZFC_imp_ctm_CH}\\<close>\n(*\n  M \\<approx> \\<omega> \\<Longrightarrow>\n  Transset(M) \\<Longrightarrow>\n  M \\<Turnstile> ZFC \\<Longrightarrow>\n  \\<exists>N. M \\<subseteq> N \\<and>\n      N \\<approx> \\<omega> \\<and>\n      Transset(N) \\<and> N \\<Turnstile> ZFC \\<union> {\\<cdot>CH\\<cdot>} \\<and> (\\<forall>\\<alpha>. Ord(\\<alpha>) \\<longrightarrow> \\<alpha> \\<in> M \\<longleftrightarrow> \\<alpha> \\<in> N)\n*)\n\ntext\\<open>These results can be strengthened by enumerating six finite sets of\nreplacement instances which are sufficient to develop forcing and for\nthe construction of the aforementioned models: \\<^term>\\<open>instances1_fms\\<close>\nthrough \\<^term>\\<open>instances3_fms\\<close>, \\<^term>\\<open>instances_ground_fms\\<close>, and\n\\<^term>\\<open>instances_ground_notCH_fms\\<close>,\nwhich are then collected into the $31$-element set \\<^term>\\<open>overhead_notCH\\<close>.\nFor example, we have:\\<close>\n\nthm instances1_fms_def\ntext\\<open>@{thm [display] instances1_fms_def}\\<close>\n(*\ninstances1_fms \\<equiv>\n{ eclose_closed_fm, eclose_abs_fm,\n  wfrec_rank_fm, transrec_VFrom_fm }\n*)\n\nthm overhead_def overhead_notCH_def\ntext\\<open>@{thm [display] overhead_def overhead_notCH_def overhead_CH_def}\\<close>\n(*\n  overhead \\<equiv> instances1_fms \\<union> instances_ground_fms\n\n  overhead_notCH \\<equiv> overhead \\<union>\n    instances2_fms \\<union> instances3_fms \\<union> instances_ground_notCH_fms\n*)\n\ntext\\<open>One further instance is needed to force $\\CH$, with a total count\nof $32$ instances:\\<close>\nthm overhead_CH_def\ntext\\<open>@{thm [display] overhead_CH_def}\\<close>\n(*\n  overhead_CH \\<equiv> overhead_notCH \\<union> {dc_abs_fm}\n*)\n\nthm extensions_of_ctms\ntext\\<open>@{thm [display] extensions_of_ctms}\\<close>\n(*\nM \\<approx> \\<omega> \\<Longrightarrow>\nTransset(M) \\<Longrightarrow>\nM \\<Turnstile> \\<cdot>Z\\<cdot> \\<union> {\\<cdot>Replacement(p)\\<cdot> . p \\<in> overhead} \\<Longrightarrow>\n\\<Phi> \\<subseteq> formula \\<Longrightarrow>\nM \\<Turnstile> {\\<cdot>Replacement(ground_repl_fm(\\<phi>))\\<cdot> . \\<phi> \\<in> \\<Phi>} \\<Longrightarrow>\n\\<exists>N. M \\<subseteq> N \\<and>\n    N \\<approx> \\<omega> \\<and>\n    Transset(N) \\<and>\n    M \\<noteq> N \\<and>\n    (\\<forall>\\<alpha>. Ord(\\<alpha>) \\<longrightarrow> \\<alpha> \\<in> M \\<longleftrightarrow> \\<alpha> \\<in> N) \\<and>\n    ((M, [] \\<Turnstile> \\<cdot>AC\\<cdot>) \\<longrightarrow> N, [] \\<Turnstile> \\<cdot>AC\\<cdot>) \\<and> N \\<Turnstile> \\<cdot>Z\\<cdot> \\<union> {\\<cdot>Replacement(\\<phi>)\\<cdot> . \\<phi> \\<in> \\<Phi>}\n*)\n\nthm ctm_of_not_CH\ntext\\<open>@{thm [display] ctm_of_not_CH}\\<close>\n(*\nM \\<approx> \\<omega> \\<Longrightarrow>\nTransset(M) \\<Longrightarrow>\nM \\<Turnstile> ZC \\<union> {\\<cdot>Replacement(p)\\<cdot> . p \\<in> overhead_notCH} \\<Longrightarrow>\n\\<Phi> \\<subseteq> formula \\<Longrightarrow>\nM \\<Turnstile> {\\<cdot>Replacement(ground_repl_fm(\\<phi>))\\<cdot> . \\<phi> \\<in> \\<Phi>} \\<Longrightarrow>\n\\<exists>N. M \\<subseteq> N \\<and>\n    N \\<approx> \\<omega> \\<and>\n    Transset(N) \\<and>\n    N \\<Turnstile> ZC \\<union> {\\<cdot>\\<not>\\<cdot>CH\\<cdot>\\<cdot>} \\<union> {\\<cdot>Replacement(\\<phi>)\\<cdot> . \\<phi> \\<in> \\<Phi>} \\<and>\n    (\\<forall>\\<alpha>. Ord(\\<alpha>) \\<longrightarrow> \\<alpha> \\<in> M \\<longleftrightarrow> \\<alpha> \\<in> N)\n*)\n\nthm ctm_of_CH\ntext\\<open>@{thm [display] ctm_of_CH}\\<close>\n(*\nM \\<approx> \\<omega> \\<Longrightarrow>\nTransset(M) \\<Longrightarrow>\nM \\<Turnstile> ZC \\<union> {\\<cdot>Replacement(p)\\<cdot> . p \\<in> overhead_CH} \\<Longrightarrow>\n\\<Phi> \\<subseteq> formula \\<Longrightarrow>\nM \\<Turnstile> {\\<cdot>Replacement(ground_repl_fm(\\<phi>))\\<cdot> . \\<phi> \\<in> \\<Phi>} \\<Longrightarrow>\n\\<exists>N. M \\<subseteq> N \\<and>\n    N \\<approx> \\<omega> \\<and>\n    Transset(N) \\<and>\n    N \\<Turnstile> ZC \\<union> {\\<cdot>CH\\<cdot>} \\<union> {\\<cdot>Replacement(\\<phi>)\\<cdot> . \\<phi> \\<in> \\<Phi>} \\<and>\n    (\\<forall>\\<alpha>. Ord(\\<alpha>) \\<longrightarrow> \\<alpha> \\<in> M \\<longleftrightarrow> \\<alpha> \\<in> N)\n*)\n\ntext\\<open>In the above three statements, the function \\<^term>\\<open>ground_repl_fm\\<close>\ntakes an element \\<^term>\\<open>\\<phi>\\<close> of \\<^term>\\<open>formula\\<close> and returns the\nreplacement instance in the ground model that produces the\n\\<^term>\\<open>\\<phi>\\<close>-replacement instance in the generic extension. The next\nresult is stated in the context \\<^locale>\\<open>G_generic1\\<close>, which assumes\nthe existence of a generic filter.\\<close>\n\ncontext G_generic1\nbegin\n\nthm sats_ground_repl_fm_imp_sats_ZF_replacement_fm\ntext\\<open>@{thm [display] sats_ground_repl_fm_imp_sats_ZF_replacement_fm}\\<close>\n(*\n  \\<phi> \\<in> formula \\<Longrightarrow>\n  M, [] \\<Turnstile> \\<cdot>Replacement(ground_repl_fm(\\<phi>))\\<cdot> \\<Longrightarrow> M[G], [] \\<Turnstile> \\<cdot>Replacement(\\<phi>)\\<cdot>\n*)\n\nend \\<comment> \\<open>\\<^locale>\\<open>G_generic1\\<close>\\<close>\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Independence_CH/Definitions_Main.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832058771036, "lm_q2_score": 0.5964331462646255, "lm_q1q2_score": 0.32146744926507526}}
{"text": "(*  Title:      MultiASP.thy\n    Author:     Ludovic Henrio and Florian Kammuller\n                2014\n\n    Note:       Multi-active object formalisation\n*)\n\nheader {* Syntax and Semantics *}\n\ntheory MultiASP imports Main begin\n\nsubsection{*Preliminaries*}\n\ndefinition\n  remove_from_map :: \"('a ~=> 'b) => 'a  => ('a ~=> 'b)\"  (infixl \"|``\"  110) where\n  \"m|``x = m|`(dom m - {x})\"\n\nsubsection {* Syntax *}\ntype_synonym ItfName = string\ndatatype VarName = This | Id string\ntype_synonym ClassName = string\ntype_synonym MethodName = string\n\ntype_synonym ActName = nat\ntype_synonym FutName = nat\ntype_synonym Location = nat\n\ndatatype Signature = Method Interface MethodName \"(Interface * VarName) list\" \n  (* signature = Method returnType MethodName (list of parameters)*)\nand Interface = Itf ItfName \"Signature list\"\n  (*interface = Itf Itfname (list of method signatures)*)\n\ndatatype Value = null | ASPInt nat | ASPBool bool (* static values *)\n                | ActRef ActName (* runtime values *)\n                | ObjRef Location\ntype_synonym  Object = \"VarName~=>Value\"\n\ndatatype Storable = Obj Object | FutRef FutName | StoredVal Value\n\ndatatype Expression = Val Value\n             | Var VarName\n             | Plus Expression Expression (\"_+\\<^sub>A_\" [120,120] 200) \n             | And Expression Expression (\"_&\\<^sub>A_\" [100,100] 300) \n             \ndatatype Rhs = Expr Expression\n             | Call Expression MethodName \"Expression list\" (\"_.\\<^sub>A_(_)\" [440,0,50] 500) (*e.m(e list) *)\n             | New ClassName \"Expression list\" (\"new _(_)\" [300,0] 500) (*new C(e list) *)\n             | NewActive ClassName \"Expression list\" (\"newActive _(_)\" [300,0] 500) (*newActive C(e list) *)\n             | Hole (* runtime term *)\n\ndatatype Statement = Skip \n|  Assign VarName Rhs  (infix \"=\\<^sub>A\"  400) (*x=z*)\n| Return Expression (\"return _\" [300] 300)(*return E *)\n| If Expression Statement Statement (\"IF _ THEN _ ELSE _ \" [300,0,0] 300)(*if E then s else s *)\n| Seq Statement Statement (infix \";;\"  100)\n\nprimrec RedContext:: \"Statement\\<Rightarrow> Statement \\<times>Statement\" (* returns basic instruction,context , i.e. the rest of the sequence*)\nwhere\n  \"RedContext Skip = (Skip,Skip)\" |\n  \"RedContext (x=\\<^sub>Az) =  ((x=\\<^sub>Az),Skip)\" |\n  \"RedContext (return e) =  (return e,Skip)\" |\n  \"RedContext (IF e THEN s ELSE s') =  (IF e THEN s ELSE s',Skip)\" |\n  \"RedContext ( s ;; s') =  (fst (RedContext s),(snd (RedContext s);;s'))\"\n\nabbreviation BuildContext::\"Statement\\<Rightarrow>Statement\\<Rightarrow> Statement \\<times>Statement\" (\"_[[_]]\" [300, 0] 300)\nwhere \"BuildContext R s \\<equiv> (s,R)\"\n\ndatatype Method = Signature  \"(Interface * VarName) list\" Statement\n(*signature (local variables) body*)\n\ndatatype Class = ASPclass ClassName \"(Interface * VarName) list\" \"Interface list\" \n                                   \"(Interface * VarName) list\" \"Method list\"\n             (*ASPClass name (class parameters) (implemented interfaces) (state variables) (list of method bodies) *)\n\ndatatype Program = Prog \"Interface set\" \"Class set\" \"(Interface * VarName) list\" Statement\n\ntype_synonym EContext = \"(VarName~=>Value) * Statement\" (*execution contet = local variables and statement *)\ntype_synonym Request = \"FutName * MethodName * (Value list)\"\ntype_synonym Store = \"Location~=>Storable\"\n\n(*datatype Process = Proc Request \"Context list\" *)\n\ndatatype ActiveObject = AO Location Store \"Request~=>(EContext list)\" \"Request list\"\n    (* active object location , store, task list, request queue*)\n\ndatatype FutValue = Undefined | FutVal Value  Store\n\ndatatype Configuration = Cn \"ActName~=>ActiveObject\" \"FutName~=>FutValue\"\n\nsubsection {*finite configuration *}\n\ndefinition finite_Store :: \"Store \\<Rightarrow> bool\"\n  where\n    \"finite_Store \\<sigma> \\<equiv> (finite (dom \\<sigma>) \\<and> (\\<forall> loc obj. (\\<sigma>(loc)=Some (Obj obj)\\<longrightarrow> finite (dom obj))))\"\n\ndefinition finite_Processes :: \"(Request~=>(EContext list)) \\<Rightarrow> bool\"\n  where\n    \"finite_Processes (processMap) \\<equiv> finite (dom (processMap)) \\<and>\n       (\\<forall> contList\\<in>(ran(processMap)). \\<forall>cont\\<in> set contList. finite (dom(fst(cont))))\"\n\nprimrec finite_Configuration :: \"Configuration => bool\"\n  where\n \" finite_Configuration (Cn AOs Futures) =\n      (finite (dom AOs) \\<and> finite (dom Futures) \\<and> \n    (\\<forall> futVal\\<in>(ran Futures). \\<forall> v \\<sigma>. (futVal =FutVal v \\<sigma> \\<longrightarrow> finite_Store \\<sigma>)) \\<and> (*NB: Undefined futures are finite*)\n    (\\<forall> ao\\<in>(ran AOs). \\<forall> l \\<sigma> P Q. ao = AO l \\<sigma> P Q \\<longrightarrow> finite_Store \\<sigma> \\<and> finite_Processes P))\"\ndeclare MultiASP.finite_Configuration.simps[simp del]\n\nsubsection {* serialization and location renaming *}\n\ninductive serialize :: \"Value \\<Rightarrow> Store \\<Rightarrow> Store \\<Rightarrow> bool\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (Obj obj) \\<and> (\\<forall> v\\<in> ran(obj). \\<exists>\\<sigma>''. (serialize v \\<sigma> \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>'))\n     \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (FutRef f)  \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (StoredVal v)  \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n     \"(serialize (ActRef f) \\<sigma> \\<sigma>')\" |\n     \"serialize (null) \\<sigma> \\<sigma>' \" | \n     \"serialize (ASPInt n) \\<sigma> \\<sigma>'\" | \n     \"serialize (ASPBool b) \\<sigma> \\<sigma>'\"\n\nprimrec subst_Value :: \" Value \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Value\"\nwhere\n  \"subst_Value (ObjRef l) \\<psi> = ObjRef (\\<psi>(l))\" |\n  \"subst_Value (ActRef a) \\<psi> = ActRef a\" |\n  \"subst_Value (null) \\<psi> = null\" |\n  \"subst_Value (ASPInt i) \\<psi> = ASPInt i\" |\n  \"subst_Value (ASPBool b) \\<psi> = ASPBool b\"\n\ndefinition check_subst :: \"Store \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Store \\<Rightarrow> bool\"\nwhere\n  \"check_subst  \\<sigma> \\<psi> \\<sigma>' \\<equiv>\n    ( inj \\<psi> \\<and> dom \\<sigma>' =  \\<psi> ` (dom(\\<sigma>)) \n    \\<and> (\\<forall> obj l . (\\<sigma>(l) = Some (Obj obj)  \n      \\<longrightarrow> (\\<exists> obj'. (\\<sigma>'(\\<psi>(l)) = Some (Obj obj') \\<and> (\\<forall> x  v. obj(x) = Some v \\<longrightarrow> obj'(x)=Some (subst_Value v \\<psi>)))))\n    \\<and>   (\\<forall> f l . (\\<sigma>(l) = Some (FutRef f) \\<longrightarrow> \\<sigma>'(\\<psi>(l)) =Some (FutRef f)))\n    \\<and>   (\\<forall> v l . (\\<sigma>(l) = Some (StoredVal v) \\<longrightarrow> \n      \\<sigma>'(\\<psi>(l)) = Some (StoredVal (subst_Value v \\<psi>))))))\"\n\ndefinition serialize_and_rename :: \"Value \\<Rightarrow> Store \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> bool\"\n where \"serialize_and_rename v \\<sigma> v' \\<sigma>'  \\<equiv> (\\<exists>\\<psi> \\<sigma>''. serialize  v \\<sigma> \\<sigma>'' \\<and>check_subst \\<sigma>'' \\<psi> \\<sigma>'\\<and>v'=subst_Value v \\<psi>)\"\n\ndefinition serialize_and_rename_list :: \"Value list \\<Rightarrow> Store \\<Rightarrow> Value list \\<Rightarrow> Store \\<Rightarrow> bool\"\n where \"serialize_and_rename_list vl \\<sigma> vl' \\<sigma>'  \\<equiv> \n              (length vl=length vl' \\<and>\n              (\\<exists>\\<psi> \\<sigma>''. (\\<forall> i<length vl. serialize  (vl!i) \\<sigma> \\<sigma>''\\<and>vl'!i=subst_Value (vl!i) \\<psi>) \\<and>check_subst \\<sigma>'' \\<psi> \\<sigma>'))\"\n\n(*locale Generic_Functions = *)\n\n(* semantics parameterized by compatibility and binder function*)\naxiomatization \n  Compatible :: \"(Request * Request) set\"\nand\n  Bind:: \"Object\\<Rightarrow>MethodName\\<Rightarrow>Value list\\<Rightarrow> EContext \"\nand\n  fields:: \"ClassName \\<Rightarrow>VarName list\"\nand \n  params:: \"ClassName \\<Rightarrow>VarName list\"\nwhere\n  symmetric_compatible: \"sym Compatible\"\n\nlemma COMP[rule_format]: \"\\<forall>x y. (x,y)\\<in>Compatible\\<longrightarrow>(y,x)\\<in>Compatible\"\napply (fold sym_def)\napply (rule symmetric_compatible)\ndone\n\nsection{*SOS*}\n\n(*datatype EvaluatedExpr = Undefined | EVal Value | EObj Object | EFutRef FutName*)\n\ninductive_set EvalValue:: \"(Value \\<times> Store \\<times> Value) set\"\nwhere\n  \"(null, \\<sigma>,  null)\\<in>EvalValue\" |\n  \"(ASPInt i, \\<sigma>,  (ASPInt i) )\\<in>EvalValue\" |\n  \"(ASPBool b, \\<sigma>,  (ASPBool b) )\\<in>EvalValue\" |\n  \"(ActRef \\<alpha>, \\<sigma>,  (ActRef \\<alpha>) )\\<in>EvalValue\" |\n  \"\\<sigma>(l) = Some (FutRef f) \\<Longrightarrow>(ObjRef l, \\<sigma>, ObjRef l)\\<in>EvalValue\" |\n  \"\\<sigma>(l) = Some (Obj obj) \\<Longrightarrow>(ObjRef l, \\<sigma>, ObjRef l)\\<in>EvalValue\" |\n  \"\\<lbrakk>\\<sigma>(l) = Some (StoredVal v);(v,\\<sigma>,ee)\\<in> EvalValue\\<rbrakk> \\<Longrightarrow>(ObjRef l, \\<sigma>, ee)\\<in>EvalValue\" \n\nlemma EvalValue_is_deterministic[rule_format,intro]: \"(e,\\<sigma>,v)\\<in>EvalValue \\<longrightarrow>(e,\\<sigma>,v')\\<in>EvalValue \\<longrightarrow>v=v'\"\napply (rule impI)\napply (erule EvalValue.induct)\napply auto\napply (erule EvalValue.cases,simp+)+\ndone\n\ninductive_set EvalExpr:: \"(Expression \\<times> (VarName~=>Value)\\<times>Store \\<times> Value) set\"\n where\n   \"(v,\\<sigma>,ev)\\<in>EvalValue \\<Longrightarrow>(Val v,  locs, \\<sigma>, ev)\\<in>EvalExpr\" |\n   \"\\<lbrakk>locs(x)=Some v;(v,\\<sigma>,ev)\\<in>EvalValue\\<rbrakk> \\<Longrightarrow>(Var x,  locs, \\<sigma>, ev)\\<in>EvalExpr\" |\n   \"\\<lbrakk>locs(x)=None;locs(This)=Some (ObjRef or); (\\<sigma>(or))=Some (Obj ob);\n     ob(x) = Some v;(v,\\<sigma>,ev)\\<in>EvalValue\\<rbrakk> \n                      \\<Longrightarrow>(Var x,  locs, \\<sigma>, ev)\\<in>EvalExpr\" |\n   \"\\<lbrakk>(e,locs,\\<sigma>,ASPInt i)\\<in>EvalExpr;(e',locs,\\<sigma>, ASPInt i')\\<in>EvalExpr\\<rbrakk> \n                      \\<Longrightarrow>(e +\\<^sub>A e',  locs, \\<sigma>, ASPInt (i+i'))\\<in>EvalExpr\" |\n   \"\\<lbrakk>(e,locs,\\<sigma>,ASPBool b)\\<in>EvalExpr;(e',locs,\\<sigma>,ASPBool b')\\<in>EvalExpr\\<rbrakk> \n                      \\<Longrightarrow>(e &\\<^sub>A e',  locs, \\<sigma>, ASPBool (b\\<and>b'))\\<in>EvalExpr\"\n\nlemma EvalExpr_is_deterministic[rule_format,intro]: \n      \" (e,locs,\\<sigma>,v)\\<in>EvalExpr \\<longrightarrow> (\\<forall> v'. (e,locs,\\<sigma>,v')\\<in>EvalExpr \\<longrightarrow>v=v')\"\napply (rule impI)\napply (erule EvalExpr.induct)\napply auto\napply (erule EvalExpr.cases,auto)\napply (erule EvalExpr.cases,auto)\napply (erule EvalExpr.cases,auto)\napply (erule_tac ?a1.0=\"e+\\<^sub>Ae'\"  in EvalExpr.cases,auto)\napply (erule_tac ?a1.0=\"e&\\<^sub>Ae'\"  in EvalExpr.cases,auto)\ndone\n\nthm EvalExpr_is_deterministic\n\ninductive reduction :: \"[Configuration, Configuration] => bool\"  (infixl \"\\<leadsto>\" 50)\n  where\n    Serve [simp, intro!]: \n      \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks (Rq@R#Rq')) ; R=(f,m,vl); \n        \\<forall> Q\\<in>dom(Tasks). (R,Q)\\<in>Compatible;\\<forall> Q\\<in>set Rq. (R,Q)\\<in>Compatible; \n         (\\<sigma> l_\\<alpha>) = Some (Obj obj);\n        Bind obj m vl = (locs,s); locs'=locs(This\\<mapsto>ObjRef l_\\<alpha>);\n        Activities'=Activities(\\<alpha>\\<mapsto> (AO l_\\<alpha> \\<sigma> (Tasks(R\\<mapsto>[(locs',s)])) (Rq@Rq')))\\<rbrakk> \n          \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\" |\n\n    AssignLocal  [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       Tasks Q = Some ((locs,S)#TL); RedContext S = R[[(x=\\<^sub>AExpr e)]];\n       x\\<in>dom locs ; (e, locs, \\<sigma>,v)\\<in>EvalExpr;\n       Activities'=Activities(\\<alpha>\\<mapsto> (AO l_\\<alpha> \\<sigma> (Tasks(Q\\<mapsto>((locs(x\\<mapsto>v),R)#TL))) Rq)) \n      \\<rbrakk> \n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\" |\n\n    AssignField  [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       Tasks Q = Some ((locs,S)#TL); RedContext S = R[[(x=\\<^sub>AExpr e)]];\n       x\\<notin>dom locs ;locs(This) = Some (ObjRef l);\\<sigma>(l) = Some (Obj obj);x\\<in>dom(obj);  (e, locs, \\<sigma>,v)\\<in>EvalExpr;\n       \\<sigma>'=\\<sigma>(l\\<mapsto>Obj (obj(x\\<mapsto>v)));\n       Activities'=Activities(\\<alpha>\\<mapsto> (AO l_\\<alpha> \\<sigma>' (Tasks(Q\\<mapsto>((locs,R)#TL))) Rq)) \n      \\<rbrakk> \n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\" |\n\n     New  [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       Tasks Q = Some ((locs,S)#TL);RedContext S = R[[x=\\<^sub>Anew C(el)]];\n       fields(C)=field_list; params(C)=param_list; l\\<notin>dom \\<sigma>; \n       length param_list = length el;length param_list = length value_list; \n       \\<forall> i<length value_list . (el!i,locs,\\<sigma>,value_list!i)\\<in>EvalExpr ;\n       \\<sigma>'=\\<sigma>(l\\<mapsto> Obj (  (map_of (zip field_list (replicate (length field_list) null)))\n                    ++ (map_of (zip param_list value_list)) )) ;\n       Activities'=Activities(\\<alpha>\\<mapsto> (AO l_\\<alpha> \\<sigma>' (Tasks(Q\\<mapsto>((locs,(x=\\<^sub>AExpr (Val (ObjRef l));;R))#TL))) Rq)) \n      \\<rbrakk>  \n      (* new term to evaluate is artificially complex because obj ref has to be encapsulated in a value and an expression*)\n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\" |\n\n     NewActive  [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       Tasks Q = Some ((locs,S)#TL); RedContext S = R[[x=\\<^sub>AnewActive C(el)]];\n       fields(C)=field_list; params(C)=param_list; \\<gamma>\\<notin>dom Activities; \n       length param_list = length el;length param_list = length value_list; \n       \\<forall> i<length value_list . ((el!i,locs,\\<sigma>,value_list!i)\\<in>EvalExpr \\<and> serialize (value_list!i) \\<sigma> \\<sigma>\\<^sub>0) ;\n       l\\<notin>dom \\<sigma>\\<^sub>0;\n       \\<sigma>'=\\<sigma>\\<^sub>0(l\\<mapsto> Obj (  (map_of (zip field_list (replicate (length field_list) null)))\n                    ++ (map_of (zip param_list value_list)) )) ;\n       Activities'=Activities(\\<alpha>\\<mapsto> (AO l_\\<alpha> \\<sigma> (Tasks(Q\\<mapsto>((locs,(x=\\<^sub>AExpr (Val (ActRef \\<gamma>)));;R)#TL))) Rq))\n                             (\\<gamma>\\<mapsto> (AO l \\<sigma>' empty [])) \n       (* new term to evaluate is artificially complex because obj ref has to be encapsulated in a value and an expression*)\n     \\<rbrakk>   \n        \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\" |\n\n   InvkActive  [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       (Activities \\<beta>) = Some (AO l\\<^sub>\\<beta> \\<sigma>\\<^sub>\\<beta> Tasks\\<^sub>\\<beta> Rq\\<^sub>\\<beta>); \n       Tasks Q = Some ((locs,S)#TL);RedContext S = R[[x=\\<^sub>A(e.\\<^sub>Am(el))]];\n       (e,locs,\\<sigma>,ActRef \\<beta>)\\<in>EvalExpr;\n       f\\<notin>dom Futures;      l\\<notin>dom \\<sigma>;\n       length value_list = length el; \n       \\<forall> i<length value_list . ((el!i,locs,\\<sigma>,value_list!i)\\<in>EvalExpr) ;\n       serialize_and_rename_list value_list \\<sigma> value_list' \\<sigma>\\<^sub>P; dom \\<sigma>\\<^sub>P\\<inter>dom \\<sigma>\\<^sub>\\<beta>={};  \n       \\<sigma>'=\\<sigma>\\<^sub>\\<beta> ++ \\<sigma>\\<^sub>P;\n       Activities'=Activities(\\<alpha>\\<mapsto> AO l_\\<alpha> (\\<sigma>(l\\<mapsto>FutRef f)) (Tasks(Q\\<mapsto>((locs,x=\\<^sub>AExpr (Val (ObjRef l));;R)#TL))) Rq)\n                             (\\<beta>\\<mapsto> AO l\\<^sub>\\<beta> \\<sigma>' Tasks\\<^sub>\\<beta> (Rq\\<^sub>\\<beta>@[(f,m,value_list')]) ) \n      \\<rbrakk>  \n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' (Futures(f\\<mapsto>Undefined))\" |\n\n   InvkPassive  [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       Tasks Q = Some ((locs,S)#TL); RedContext S = R[[x=\\<^sub>Ae.\\<^sub>Am(el)]];\n       (e,locs,\\<sigma>,ObjRef l)\\<in>EvalExpr;\n         (\\<sigma> l) = Some (Obj obj);\n       length vl = length el; \\<forall> i<length vl . ((el!i,locs,\\<sigma>,vl!i)\\<in>EvalExpr) ;\n        Bind obj m vl = (locs,s); locs'=locs(This\\<mapsto>ObjRef l);\n       Activities'=Activities(\\<alpha>\\<mapsto> AO l_\\<alpha> \\<sigma> (Tasks(Q\\<mapsto>((locs',s)#(locs,x=\\<^sub>AHole;;R)#TL))) Rq) \n      \\<rbrakk>  \n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\" |\n\n   ReturnLocal  [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       Tasks Q = Some ((locs',S)#(locs,x=\\<^sub>AHole;;R)#TL); RedContext S = R[[return e]];\n       (e,locs,\\<sigma>,v)\\<in>EvalExpr;\n       Activities'=Activities(\\<alpha>\\<mapsto> AO l_\\<alpha> \\<sigma> \n                              (Tasks(Q\\<mapsto>((locs,x=\\<^sub>AExpr (Val v);;R)#TL))) Rq) \n      \\<rbrakk>  \n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\" |\n\n   ReturnRequest [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       Tasks Q = Some [(locs',S)]; RedContext S = R[[return e]];\n       Q=(f,m,vl);\n       (e,locs,\\<sigma>,v)\\<in>EvalExpr;  serialize v \\<sigma> \\<sigma>\\<^sub>f;\n       Activities'=Activities(\\<alpha>\\<mapsto> AO l_\\<alpha> \\<sigma> (Tasks|``Q) Rq) \n      \\<rbrakk>  \n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' (Futures(f\\<mapsto>FutVal v \\<sigma>\\<^sub>f))\" |\n\n    UpdateFuture [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       (\\<sigma> l) = Some (FutRef f);  (Futures f) = Some (FutVal v \\<sigma>\\<^sub>f); \n       check_subst \\<sigma>\\<^sub>f \\<psi> \\<sigma>\\<^sub>r; v'=subst_Value v \\<psi>; (dom \\<sigma>\\<^sub>r)\\<inter>(dom \\<sigma>)= {};\n       \\<sigma>'=(\\<sigma>++\\<sigma>\\<^sub>r)(l\\<mapsto>StoredVal v'); Activities'=Activities(\\<alpha>\\<mapsto> AO l_\\<alpha> \\<sigma>' Tasks Rq) \n      \\<rbrakk>  \n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\"   |\n\n    IfThenElseTrue [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       Tasks Q = Some ((locs,S)#TL);RedContext S = R[[IF e THEN s\\<^sub>t ELSE s\\<^sub>e]];\n       (e,locs,\\<sigma>,ASPBool True)\\<in>EvalExpr;\n       Activities'=Activities(\\<alpha>\\<mapsto> (AO l_\\<alpha> \\<sigma> (Tasks(Q\\<mapsto>((locs,s\\<^sub>t;;R)#TL))) Rq))\n   \\<rbrakk>  \n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\"  |\n    IfThenElseFalse [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       Tasks Q = Some ((locs,S)#TL);RedContext S = R[[IF e THEN s\\<^sub>t ELSE s\\<^sub>e]];\n       (e,locs,\\<sigma>,ASPBoolFalse)\\<in>EvalExpr;\n       Activities'=Activities(\\<alpha>\\<mapsto> (AO l_\\<alpha> \\<sigma> (Tasks(Q\\<mapsto>((locs,s\\<^sub>e;;R)#TL))) Rq))\n   \\<rbrakk>  \n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\"  |\n\n    Skip [simp, intro!]: \n     \"\\<lbrakk>(Activities \\<alpha>) = Some (AO l_\\<alpha> \\<sigma> Tasks Rq); \n       Tasks Q = Some ((locs,S)#TL);RedContext S = R[[Skip]];R\\<noteq>Skip;\n       Activities'=Activities(\\<alpha>\\<mapsto> (AO l_\\<alpha> \\<sigma> (Tasks(Q\\<mapsto>((locs,R)#TL))) Rq))\n   \\<rbrakk>  \n      \\<Longrightarrow> Cn Activities Futures \\<leadsto>Cn Activities' Futures\"  \n      \n(*     upd  [simp, intro!]: \"l : dom f \\<Longrightarrow>\\<leadsto> \n                         Upd (Obj f T) l a \\<rightarrow>\\<^sub>\\<beta>  Obj (f (l \\<mapsto> a)) T\" |\n    sel  [simp, intro!]: \"s \\<rightarrow>\\<^sub>\\<beta> t \\<Longrightarrow> Call s l u \\<rightarrow>\\<^sub>\\<beta>  Call t l u\" |\n    selR [simp, intro!]: \"u \\<rightarrow>\\<^sub>\\<beta> t \\<Longrightarrow> Call s l u \\<rightarrow>\\<^sub>\\<beta>  Call s l t\" |\n    updL [simp, intro!]: \"s \\<rightarrow>\\<^sub>\\<beta> t \\<Longrightarrow> Upd s l u \\<rightarrow>\\<^sub>\\<beta> Upd t l u\" |\n    updR [simp, intro!]: \"s \\<rightarrow>\\<^sub>\\<beta> t \\<Longrightarrow> Upd u l s \\<rightarrow>\\<^sub>\\<beta> Upd u l t\" |\n    obj [simp, intro!]: \"\\<lbrakk> s \\<rightarrow>\\<^sub>\\<beta> t; l: dom f \\<rbrakk> \\<Longrightarrow> Obj (f (l \\<mapsto> s)) T \\<rightarrow>\\<^sub>\\<beta> Obj (f (l \\<mapsto> t)) T\" |\n  act [simp, intro!]: \"s \\<rightarrow>\\<^sub>\\<beta> t \\<Longrightarrow> Active s \\<rightarrow>\\<^sub>\\<beta> Active t\"    \nabbreviation\n  beta_reds :: \"[dB, dB] => bool\"  (infixl \"->>\" 50) where\n  \"s ->> t == beta^** s t\"\n\nnotation (latex)\n  beta_reds  (infixl \"\\<rightarrow>\\<^sub>\\<beta>\\<^sup>*\" 50)\n*)\n\nabbreviation InitialConfiguration:: \"(VarName list) \\<Rightarrow>Statement \\<Rightarrow> Configuration\"\nwhere\n  \"InitialConfiguration vl s \\<equiv> Cn (empty(0\\<mapsto>(AO 0 (empty(0\\<mapsto>Obj empty)) \n                  (empty((0,''m'',[])\\<mapsto>[((map_of (zip vl (replicate (length vl) null))),s)])) []))) empty\"\n\n\n\n\ninductive Comp2 :: \"(Request * Request) \\<Rightarrow>bool\"\n where\n  symmetric_compatible: \" Comp2 (x,y) \\<Longrightarrow>Comp2 (y,x) \"\n\nend\n", "meta": {"author": "lhenrio", "repo": "MultiASP-Isabelle", "sha": "2cc5a5ef4cb6499311e429d98e18991fcb9f88d0", "save_path": "github-repos/isabelle/lhenrio-MultiASP-Isabelle", "path": "github-repos/isabelle/lhenrio-MultiASP-Isabelle/MultiASP-Isabelle-2cc5a5ef4cb6499311e429d98e18991fcb9f88d0/MultiASP/MultiASPBeforestatementList.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710085, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.321382703275402}}
{"text": "(*  Title:      HOL/UNITY/Comp/TimerArray.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1998  University of Cambridge\n\nA trivial example of reasoning about an array of processes\n*)\n\ntheory TimerArray imports \"../UNITY_Main\" begin\n\ntype_synonym 'a state = \"nat * 'a\"   (*second component allows new variables*)\n\ndefinition count :: \"'a state => nat\"\n  where \"count s = fst s\"\n  \ndefinition decr  :: \"('a state * 'a state) set\"\n  where \"decr = (UN n uu. {((Suc n, uu), (n,uu))})\"\n  \ndefinition Timer :: \"'a state program\"\n  where \"Timer = mk_total_program (UNIV, {decr}, UNIV)\"\n\n\ndeclare Timer_def [THEN def_prg_Init, simp]\n\ndeclare count_def [simp] decr_def [simp]\n\n(*Demonstrates induction, but not used in the following proof*)\nlemma Timer_leadsTo_zero: \"Timer \\<in> UNIV leadsTo {s. count s = 0}\"\napply (rule_tac f = count in lessThan_induct, simp)\napply (case_tac \"m\")\n apply (force intro!: subset_imp_leadsTo)\napply (unfold Timer_def, ensures_tac \"decr\")\ndone\n\nlemma Timer_preserves_snd [iff]: \"Timer \\<in> preserves snd\"\napply (rule preservesI)\napply (unfold Timer_def, safety)\ndone\n\n\ndeclare PLam_stable [simp]\n\nlemma TimerArray_leadsTo_zero:\n     \"finite I  \n      \\<Longrightarrow> (plam i: I. Timer) \\<in> UNIV leadsTo {(s,uu). \\<forall>i\\<in>I. s i = 0}\"\napply (erule_tac A'1 = \"\\<lambda>i. lift_set i ({0} \\<times> UNIV)\" \n       in finite_stable_completion [THEN leadsTo_weaken])\napply auto\n(*Safety property, already reduced to the single Timer case*)\n prefer 2\n apply (simp add: Timer_def, safety) \n(*Progress property for the array of Timers*)\napply (rule_tac f = \"sub i o fst\" in lessThan_induct)\napply (case_tac \"m\")\n(*Annoying need to massage the conditions to have the form (... \\<times> UNIV)*)\napply (auto intro: subset_imp_leadsTo \n        simp add: insert_absorb \n                  lift_set_Un_distrib [symmetric] lessThan_Suc [symmetric] \n               Times_Un_distrib1 [symmetric] Times_Diff_distrib1 [symmetric])\napply (rename_tac \"n\")\napply (rule PLam_leadsTo_Basis)\napply (auto simp add: lessThan_Suc [symmetric])\napply (unfold Timer_def mk_total_program_def, safety) \napply (rule_tac act = decr in totalize_transientI, auto)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/UNITY/Comp/TimerArray.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521105, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3213686986682998}}
{"text": "(*  Title:       ONode_Lifting.thy\n    License:     BSD 2-Clause. See LICENSE.\n    Author:      Timothy Bourke\n*)\n\nsection \"Lifting rules for (open) nodes\"\n\ntheory ONode_Lifting\nimports AWN OAWN_SOS OInvariants\nbegin\n\nlemma node_net_state':\n  assumes \"s \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n    shows \"\\<exists>\\<sigma> \\<zeta> R. s = (\\<sigma>, NodeS i \\<zeta> R)\"\n  using assms proof induction\n    fix s\n    assume \"s \\<in> init (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n    then obtain \\<sigma> \\<zeta> where \"s = (\\<sigma>, NodeS i \\<zeta> R\\<^sub>i)\"\n      by (auto simp: onode_comps)\n    thus \"\\<exists>\\<sigma> \\<zeta> R. s = (\\<sigma>, NodeS i \\<zeta> R)\" by auto\n  next\n    fix s a \\<sigma>'\n    assume rt: \"s \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and ih: \"\\<exists>\\<sigma> \\<zeta> R. s = (\\<sigma>, NodeS i \\<zeta> R)\"\n       and \"U (fst s) \\<sigma>'\"\n    then obtain \\<sigma> \\<zeta> R\n      where \"(\\<sigma>, NodeS i \\<zeta> R)  \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n        and \"U \\<sigma> \\<sigma>'\" and \"snd s = NodeS i \\<zeta> R\" by auto\n    from this(1-2)\n      have \"(\\<sigma>', NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n        by - (erule(1) oreachable_other')\n    with \\<open>snd s = NodeS i \\<zeta> R\\<close> show \"\\<exists>\\<sigma> \\<zeta> R. (\\<sigma>', snd s) = (\\<sigma>, NodeS i \\<zeta> R)\" by simp\n  next\n    fix s a s'\n    assume rt: \"s \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and ih: \"\\<exists>\\<sigma> \\<zeta> R. s = (\\<sigma>, NodeS i \\<zeta> R)\"\n       and tr: \"(s, a, s') \\<in> trans (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"S (fst s) (fst s') a\"\n     from ih obtain \\<sigma> \\<zeta> R where \"s = (\\<sigma>, NodeS i \\<zeta> R)\" by auto\n     with tr have \"((\\<sigma>, NodeS i \\<zeta> R), a, s') \\<in> onode_sos (trans T)\"\n       by (simp add: onode_comps)\n     then obtain \\<sigma>' \\<zeta>' R' where \"s' = (\\<sigma>', NodeS i \\<zeta>' R')\"\n       using onode_sos_dest_is_net_state' by metis\n     with tr \\<open>s = (\\<sigma>, NodeS i \\<zeta> R)\\<close> show \"\\<exists>\\<sigma> \\<zeta> R. s' = (\\<sigma>, NodeS i \\<zeta> R)\"\n       by simp\n  qed\n\nlemma node_net_state:\n  assumes \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n    shows \"\\<exists>\\<zeta> R. s = NodeS i \\<zeta> R\"\n  using assms\n  by (metis Pair_inject node_net_state')\n\nlemma node_net_state_trans [elim]:\n  assumes sor: \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      and str: \"((\\<sigma>, s), a, (\\<sigma>', s')) \\<in> trans (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n  obtains \\<zeta> R \\<zeta>' R'\n    where \"s = NodeS i \\<zeta> R\"\n      and \"s' = NodeS i \\<zeta>' R'\"\n  proof -\n    assume *: \"\\<And>\\<zeta> R \\<zeta>' R'. s = NodeS i \\<zeta> R \\<Longrightarrow> s' = NodeS i \\<zeta>' R' \\<Longrightarrow> thesis\"\n    from sor obtain \\<zeta> R where \"s = NodeS i \\<zeta> R\"\n      by (metis node_net_state)\n    moreover with str obtain \\<zeta>' R' where \"s' = NodeS i \\<zeta>' R'\"\n      by (simp only: onode_comps)\n         (metis onode_sos_dest_is_net_state'')\n    ultimately show thesis by (rule *)\n  qed\n\nlemma nodemap_induct' [consumes, case_names init other local]:\n  assumes \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      and init: \"\\<And>\\<sigma> \\<zeta>. (\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i) \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) \\<Longrightarrow> P (\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i)\"\n      and other: \"\\<And>\\<sigma> \\<zeta> R \\<sigma>' a.\n                  \\<lbrakk> (\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U;\n                    U \\<sigma> \\<sigma>'; P (\\<sigma>, NodeS ii \\<zeta> R) \\<rbrakk> \\<Longrightarrow> P (\\<sigma>', NodeS ii \\<zeta> R)\"\n      and local: \"\\<And>\\<sigma> \\<zeta> R \\<sigma>' \\<zeta>' R' a.\n                  \\<lbrakk> (\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U;\n                    ((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o);\n                    S \\<sigma> \\<sigma>' a; P (\\<sigma>, NodeS ii \\<zeta> R) \\<rbrakk> \\<Longrightarrow> P (\\<sigma>', NodeS ii \\<zeta>' R')\"\n    shows \"P (\\<sigma>, NodeS ii \\<zeta> R)\"\n  using assms(1) proof induction\n    fix s\n    assume \"s \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n    hence \"s \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      by (rule oreachable_init)\n    with \\<open>s \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\\<close> obtain \\<sigma> \\<zeta> where \"s = (\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i)\"\n      by (simp add: onode_comps) metis\n    with \\<open>s \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\\<close> and init show \"P s\" by simp\n  next\n    fix s a \\<sigma>'\n    assume sr: \"s \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and \"U (fst s) \\<sigma>'\"\n       and \"P s\"\n    from sr obtain \\<sigma> \\<zeta> R where \"s = (\\<sigma>, NodeS ii \\<zeta> R)\"\n      using node_net_state' by metis\n    with sr \\<open>U (fst s) \\<sigma>'\\<close> \\<open>P s\\<close> show \"P (\\<sigma>', snd s)\"\n    by simp (metis other)\n  next\n    fix s a s'\n    assume sr: \"s \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and tr: \"(s, a, s') \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"S (fst s) (fst s') a\"\n       and \"P s\"\n    from this(1-3) have \"s' \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      by - (erule(2) oreachable_local)\n    then obtain \\<sigma>' \\<zeta>' R' where [simp]: \"s' = (\\<sigma>', NodeS ii \\<zeta>' R')\"\n      using node_net_state' by metis\n    from sr and \\<open>P s\\<close> obtain \\<sigma> \\<zeta> R\n      where [simp]: \"s = (\\<sigma>, NodeS ii \\<zeta> R)\"\n        and A1: \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n        and A4: \"P (\\<sigma>, NodeS ii \\<zeta> R)\"\n      using node_net_state' by metis\n    with tr and \\<open>S (fst s) (fst s') a\\<close>\n      have A2: \"((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and A3: \"S \\<sigma> \\<sigma>' a\" by simp_all\n    from A1 A2 A3 A4 have \"P (\\<sigma>', NodeS ii \\<zeta>' R')\" by (rule local)\n    thus \"P s'\" by simp\n  qed\n\nlemma nodemap_induct [consumes, case_names init step]:\n  assumes \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      and init: \"\\<And>\\<sigma> \\<zeta>. (\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i) \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) \\<Longrightarrow> P \\<sigma> \\<zeta> R\\<^sub>i\"\n      and other: \"\\<And>\\<sigma> \\<zeta> R \\<sigma>' a.\n                  \\<lbrakk> (\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U;\n                    U \\<sigma> \\<sigma>'; P \\<sigma> \\<zeta> R \\<rbrakk> \\<Longrightarrow> P \\<sigma>' \\<zeta> R\"\n      and local: \"\\<And>\\<sigma> \\<zeta> R \\<sigma>' \\<zeta>' R' a.\n                  \\<lbrakk> (\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U;\n                    ((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o);\n                    S \\<sigma> \\<sigma>' a; P \\<sigma> \\<zeta> R \\<rbrakk> \\<Longrightarrow> P \\<sigma>' \\<zeta>' R'\"\n    shows \"P \\<sigma> \\<zeta> R\"\n  using assms(1) proof (induction \"(\\<sigma>, NodeS ii \\<zeta> R)\" arbitrary: \\<sigma> \\<zeta> R)\n    fix \\<sigma> \\<zeta> R\n    assume a1: \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n    hence \"R = R\\<^sub>i\" by (simp add: init_onode_comp)\n    with a1 have \"(\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i) \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\" by simp\n    with init and \\<open>R = R\\<^sub>i\\<close> show \"P \\<sigma> \\<zeta> R\" by simp\n  next\n    fix st a \\<sigma>' \\<zeta>' R'\n    assume \"st \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and tr: \"(st, a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"S (fst st) (fst (\\<sigma>', NodeS ii \\<zeta>' R')) a\"\n       and IH: \"\\<And>\\<sigma> \\<zeta> R. st = (\\<sigma>, NodeS ii \\<zeta> R) \\<Longrightarrow> P \\<sigma> \\<zeta> R\"\n    from this(1) obtain \\<sigma> \\<zeta> R where \"st = (\\<sigma>, NodeS ii \\<zeta> R)\"\n                                and \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      by (metis node_net_state')\n    note this(2)\n    moreover from tr and \\<open>st = (\\<sigma>, NodeS ii \\<zeta> R)\\<close>\n      have \"((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\" by simp\n    moreover from \\<open>S (fst st) (fst (\\<sigma>', NodeS ii \\<zeta>' R')) a\\<close> and \\<open>st = (\\<sigma>, NodeS ii \\<zeta> R)\\<close>\n      have \"S \\<sigma> \\<sigma>' a\" by simp\n    moreover from IH and \\<open>st = (\\<sigma>, NodeS ii \\<zeta> R)\\<close> have \"P \\<sigma> \\<zeta> R\" .\n    ultimately show \"P \\<sigma>' \\<zeta>' R'\" by (rule local)\n  next\n    fix st \\<sigma>' \\<zeta> R\n    assume \"st \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and \"U (fst st) \\<sigma>'\"\n       and \"snd st = NodeS ii \\<zeta> R\"\n       and IH: \"\\<And>\\<sigma> \\<zeta> R. st = (\\<sigma>, NodeS ii \\<zeta> R) \\<Longrightarrow> P \\<sigma> \\<zeta> R\"\n    from this(1,3) obtain \\<sigma> where \"st = (\\<sigma>, NodeS ii \\<zeta> R)\"\n                              and \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n      by (metis surjective_pairing)\n    note this(2)\n    moreover from \\<open>U (fst st) \\<sigma>'\\<close> and \\<open>st = (\\<sigma>, NodeS ii \\<zeta> R)\\<close> have \"U \\<sigma> \\<sigma>'\" by simp\n    moreover from IH and \\<open>st = (\\<sigma>, NodeS ii \\<zeta> R)\\<close> have \"P \\<sigma> \\<zeta> R\" .\n    ultimately show \"P \\<sigma>' \\<zeta> R\" by (rule other)\n  qed\n\nlemma node_addressD [dest, simp]:\n  assumes \"(\\<sigma>, NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n    shows \"i = ii\"\n  using assms by (clarsimp dest!: node_net_state')\n\nlemma node_proc_reachable [dest]:\n  assumes \"(\\<sigma>, NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\n                                         (otherwith S {ii} (oarrivemsg I)) (other U {ii})\"\n      and sgivesu: \"\\<And>\\<xi> \\<xi>'. S \\<xi> \\<xi>' \\<Longrightarrow> U \\<xi> \\<xi>'\"\n    shows \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n  proof -\n    from assms(1) have \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\n                                             (otherwith S {ii} (oarrivemsg I)) (other U {ii})\"\n      by - (frule node_addressD, simp)\n    thus ?thesis\n    proof (induction rule: nodemap_induct)\n      fix \\<sigma> \\<zeta>\n      assume \"(\\<sigma>, NodeS ii \\<zeta> R\\<^sub>i) \\<in> init (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n      hence \"(\\<sigma>, \\<zeta>) \\<in> init T\" by (auto simp: onode_comps)\n      thus \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n        by (rule oreachable_init)\n    next\n      fix \\<sigma> \\<zeta> R \\<sigma>' \\<zeta>' R' a\n      assume \"other U {ii} \\<sigma> \\<sigma>'\"\n         and \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n      thus \"(\\<sigma>', \\<zeta>) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n        by - (rule oreachable_other')\n    next\n      fix \\<sigma> \\<zeta> R \\<sigma>' \\<zeta>' R' a\n      assume rs: \"(\\<sigma>, NodeS ii \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\n                                         (otherwith S {ii} (oarrivemsg I)) (other U {ii})\"\n         and tr: \"((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> trans (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n         and ow: \"otherwith S {ii} (oarrivemsg I) \\<sigma> \\<sigma>' a\"\n         and ih: \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n\n      from ow have *: \"\\<sigma>' ii = \\<sigma> ii \\<Longrightarrow> other U {ii} \\<sigma> \\<sigma>'\"\n        by (clarsimp elim!: otherwithE) (rule otherI, simp_all, metis sgivesu)\n      from tr have \"((\\<sigma>, NodeS ii \\<zeta> R), a, (\\<sigma>', NodeS ii \\<zeta>' R')) \\<in> onode_sos (trans T)\"\n        by (simp add: onode_comps)\n      thus \"(\\<sigma>', \\<zeta>') \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n      proof cases\n        case onode_bcast\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_gcast\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_ucast\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_notucast\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_deliver\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_tau\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case onode_receive\n        with ih and ow show ?thesis\n          by (auto elim!: oreachable_local' otherwithE)\n      next\n        case (onode_arrive m)\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_connect1\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_connect2\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_connect_other\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_disconnect1\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_disconnect2\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      next\n        case onode_disconnect_other\n        hence \"\\<zeta>' = \\<zeta>\" and \"\\<sigma>' ii = \\<sigma> ii\" by auto\n        from this(2) have \"other U {ii} \\<sigma> \\<sigma>'\" by (rule *)\n        with ih and \\<open>\\<zeta>' = \\<zeta>\\<close> show ?thesis by auto\n      qed\n    qed\n  qed\n\nlemma node_proc_reachable_statelessassm [dest]:\n  assumes \"(\\<sigma>, NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\n                                         (otherwith (\\<lambda>_ _. True) {ii} (oarrivemsg I))\n                                         (other (\\<lambda>_ _. True) {ii})\"\n    shows \"(\\<sigma>, \\<zeta>) \\<in> oreachable T\n                               (otherwith (\\<lambda>_ _. True) {ii} (orecvmsg I)) (other (\\<lambda>_ _. True) {ii})\"\n  using assms\n  by (rule node_proc_reachable) simp_all\n\nlemma node_lift:\n  assumes \"T \\<Turnstile> (otherwith S {ii} (orecvmsg I), other U {ii} \\<rightarrow>) global P\"\n      and \"\\<And>\\<xi> \\<xi>'. S \\<xi> \\<xi>' \\<Longrightarrow> U \\<xi> \\<xi>'\"\n    shows \"\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile> (otherwith S {ii} (oarrivemsg I), other U {ii} \\<rightarrow>) global P\"\n  proof (rule oinvariant_oreachableI)\n    fix \\<sigma> \\<zeta>\n    assume \"(\\<sigma>, \\<zeta>) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o) (otherwith S {ii} (oarrivemsg I)) (other U {ii})\"\n    moreover then obtain i s R where \"\\<zeta> = NodeS i s R\"\n      by (metis node_net_state)\n    ultimately have \"(\\<sigma>, NodeS i s R) \\<in> oreachable (\\<langle>ii : T : R\\<^sub>i\\<rangle>\\<^sub>o)\n                                                   (otherwith S {ii} (oarrivemsg I)) (other U {ii})\"\n      by simp\n    hence \"(\\<sigma>, s) \\<in> oreachable T (otherwith S {ii} (orecvmsg I)) (other U {ii})\"\n      by - (erule node_proc_reachable, erule assms(2))\n    with assms(1) show \"global P (\\<sigma>, \\<zeta>)\"\n      by (metis fst_conv globalsimp oinvariantD)\n  qed\n\nlemma node_lift_step [intro]:\n  assumes pinv: \"T \\<Turnstile>\\<^sub>A (otherwith S {i} (orecvmsg I), other U {i} \\<rightarrow>) globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q \\<sigma> \\<sigma>')\"\n      and other: \"\\<And>\\<sigma> \\<sigma>'. other U {i} \\<sigma> \\<sigma>' \\<Longrightarrow> Q \\<sigma> \\<sigma>'\"\n      and sgivesu: \"\\<And>\\<xi> \\<xi>'. S \\<xi> \\<xi>' \\<Longrightarrow> U \\<xi> \\<xi>'\"\n    shows \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (otherwith S {i} (oarrivemsg I), other U {i} \\<rightarrow>)\n                            globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q \\<sigma> \\<sigma>')\"\n    (is \"_ \\<Turnstile>\\<^sub>A (?S, ?U \\<rightarrow>) _\")\n  proof (rule ostep_invariantI, simp)\n    fix \\<sigma> s a \\<sigma>' s'\n    assume rs: \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) ?S ?U\"\n       and tr: \"((\\<sigma>, s), a, (\\<sigma>', s')) \\<in> trans (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and ow: \"?S \\<sigma> \\<sigma>' a\"\n    from ow have *: \"\\<sigma>' i = \\<sigma> i \\<Longrightarrow> other U {i} \\<sigma> \\<sigma>'\"\n      by (clarsimp elim!: otherwithE) (rule otherI, simp_all, metis sgivesu)\n    from rs tr obtain \\<zeta> R\n      where [simp]: \"s = NodeS i \\<zeta> R\"\n        and \"(\\<sigma>, NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) ?S ?U\"\n      by (metis node_net_state)\n    from this(2) have or: \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {i} (orecvmsg I)) ?U\"\n      by (rule node_proc_reachable [OF _ assms(3)])\n    from tr have \"((\\<sigma>, NodeS i \\<zeta> R), a, (\\<sigma>', s')) \\<in> onode_sos (trans T)\"\n      by (simp add: onode_comps)\n    thus \"Q \\<sigma> \\<sigma>'\"\n    proof cases\n      fix m \\<zeta>'\n      assume \"a = R:*cast(m)\"\n         and tr': \"((\\<sigma>, \\<zeta>), broadcast m, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (broadcast m)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix D m \\<zeta>'\n      assume \"a = (R \\<inter> D):*cast(m)\"\n         and tr': \"((\\<sigma>, \\<zeta>), groupcast D m, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (groupcast D m)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix d m \\<zeta>'\n      assume \"a = {d}:*cast(m)\"\n         and tr': \"((\\<sigma>, \\<zeta>), unicast d m, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (unicast d m)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix d \\<zeta>'\n      assume \"a = \\<tau>\"\n         and tr': \"((\\<sigma>, \\<zeta>), \\<not>unicast d, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (\\<not>unicast d)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix d \\<zeta>'\n      assume \"a = i:deliver(d)\"\n         and tr': \"((\\<sigma>, \\<zeta>), deliver d, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (deliver d)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix \\<zeta>'\n      assume \"a = \\<tau>\"\n         and tr': \"((\\<sigma>, \\<zeta>), \\<tau>, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' \\<tau>\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix m \\<zeta>'\n      assume \"a = {i}\\<not>{}:arrive(m)\"\n         and tr': \"((\\<sigma>, \\<zeta>), receive m, (\\<sigma>', \\<zeta>')) \\<in> trans T\"\n      from this(1) and \\<open>?S \\<sigma> \\<sigma>' a\\<close> have \"otherwith S {i} (orecvmsg I) \\<sigma> \\<sigma>' (receive m)\"\n        by (auto elim!: otherwithE)\n      with or tr' show ?thesis by (rule ostep_invariantD [OF pinv, simplified])\n    next\n      fix m\n      assume \"a = {}\\<not>{i}:arrive(m)\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i'\n      assume \"a = connect(i, i')\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i'\n      assume \"a = connect(i', i)\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i' i''\n      assume \"a = connect(i', i'')\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i'\n      assume \"a = disconnect(i, i')\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i'\n      assume \"a = disconnect(i', i)\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    next\n      fix i' i''\n      assume \"a = disconnect(i', i'')\"\n         and \"\\<sigma>' i = \\<sigma> i\"\n      from this(2) have \"other U {i} \\<sigma> \\<sigma>'\" by (rule *)\n      thus ?thesis by (rule other)\n    qed\n  qed\n\nlemma node_lift_step_statelessassm [intro]:\n  assumes \"T \\<Turnstile>\\<^sub>A (\\<lambda>\\<sigma> _. orecvmsg I \\<sigma>, other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                       globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q (\\<sigma> i) (\\<sigma>' i))\"\n      and \"\\<And>\\<xi>. Q \\<xi> \\<xi>\"\n    shows \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (\\<lambda>\\<sigma> _. oarrivemsg I \\<sigma>, other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                            globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q (\\<sigma> i) (\\<sigma>' i))\"\n  proof -\n    from assms(1)\n      have \"T \\<Turnstile>\\<^sub>A (otherwith (\\<lambda>_ _. True) {i} (orecvmsg I), other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                  globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q (\\<sigma> i) (\\<sigma>' i))\"\n        by rule auto\n    with assms(2) have \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (otherwith (\\<lambda>_ _. True) {i} (oarrivemsg I),\n                                          other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                                         globala (\\<lambda>(\\<sigma>, _, \\<sigma>'). Q (\\<sigma> i) (\\<sigma>' i))\"\n      by - (rule node_lift_step, auto)\n    thus ?thesis by rule auto\n  qed\n\nlemma node_lift_anycast [intro]:\n  assumes pinv: \"T \\<Turnstile>\\<^sub>A (otherwith S {i} (orecvmsg I), other U {i} \\<rightarrow>)\n                       globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). anycast (Q \\<sigma> \\<sigma>') a)\"\n      and \"\\<And>\\<xi> \\<xi>'. S \\<xi> \\<xi>' \\<Longrightarrow> U \\<xi> \\<xi>'\"\n    shows \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (otherwith S {i} (oarrivemsg I), other U {i} \\<rightarrow>)\n                            globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). castmsg (Q \\<sigma> \\<sigma>') a)\"\n    (is \"_ \\<Turnstile>\\<^sub>A (?S, ?U \\<rightarrow>) _\")\n  proof (rule ostep_invariantI, simp)\n    fix \\<sigma> s a \\<sigma>' s'\n    assume rs: \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) ?S ?U\"\n       and tr: \"((\\<sigma>, s), a, (\\<sigma>', s')) \\<in> trans (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"?S \\<sigma> \\<sigma>' a\"\n    from this(1-2) obtain \\<zeta> R\n      where [simp]: \"s = NodeS i \\<zeta> R\"\n        and \"(\\<sigma>, NodeS i \\<zeta> R) \\<in> oreachable (\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o) ?S ?U\"\n      by (metis node_net_state)\n    from this(2) have \"(\\<sigma>, \\<zeta>) \\<in> oreachable T (otherwith S {i} (orecvmsg I)) ?U\"\n      by (rule node_proc_reachable [OF _ assms(2)])\n    moreover from tr have \"((\\<sigma>, NodeS i \\<zeta> R), a, (\\<sigma>', s')) \\<in> onode_sos (trans T)\"\n      by (simp add: onode_comps)\n    ultimately show \"castmsg (Q \\<sigma> \\<sigma>') a\" using \\<open>?S \\<sigma> \\<sigma>' a\\<close>\n      by - (erule onode_sos.cases, auto elim!: otherwithE dest!: ostep_invariantD [OF pinv])\n  qed\n\nlemma node_lift_anycast_statelessassm [intro]:\n  assumes pinv: \"T \\<Turnstile>\\<^sub>A (\\<lambda>\\<sigma> _. orecvmsg I \\<sigma>, other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                       globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). anycast (Q \\<sigma> \\<sigma>') a)\"\n    shows \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (\\<lambda>\\<sigma> _. oarrivemsg I \\<sigma>, other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                            globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). castmsg (Q \\<sigma> \\<sigma>') a)\"\n    (is \"_ \\<Turnstile>\\<^sub>A (?S, _ \\<rightarrow>) _\")\n  proof -\n    from assms(1)\n      have \"T \\<Turnstile>\\<^sub>A (otherwith (\\<lambda>_ _. True) {i} (orecvmsg I), other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                  globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). anycast (Q \\<sigma> \\<sigma>') a)\"\n        by rule auto\n    hence \"\\<langle>i : T : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (otherwith (\\<lambda>_ _. True) {i} (oarrivemsg I), other (\\<lambda>_ _. True) {i} \\<rightarrow>)\n                            globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). castmsg (Q \\<sigma> \\<sigma>') a)\"\n      by (rule node_lift_anycast) simp_all\n    thus ?thesis\n      by rule auto\n  qed\n\nlemma node_local_deliver:\n  \"\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (S, U \\<rightarrow>) globala (\\<lambda>(_, a, _). \\<forall>j. j\\<noteq>i \\<longrightarrow> (\\<forall>d. a \\<noteq> j:deliver(d)))\"\n  proof (rule ostep_invariantI, simp)\n    fix \\<sigma> s a \\<sigma>' s'\n    assume 1: \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and 2: \"((\\<sigma>, s), a, (\\<sigma>', s')) \\<in> trans (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"S \\<sigma> \\<sigma>' a\"\n    moreover from 1 2 obtain \\<zeta> R \\<zeta>' R' where \"s = NodeS i \\<zeta> R\" and \"s' = NodeS i \\<zeta>' R'\" ..\n    ultimately show \"\\<forall>j. j\\<noteq>i \\<longrightarrow> (\\<forall>d. a \\<noteq> j:deliver(d))\"\n      by (cases a) (auto simp add: onode_comps)\n  qed\n\nlemma node_tau_deliver_unchanged:\n  \"\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o \\<Turnstile>\\<^sub>A (S, U \\<rightarrow>) globala (\\<lambda>(\\<sigma>, a, \\<sigma>'). a = \\<tau> \\<or> (\\<exists>i d. a = i:deliver(d))\n                                                     \\<longrightarrow> (\\<forall>j. j\\<noteq>i \\<longrightarrow> \\<sigma>' j = \\<sigma> j))\"\n  proof (rule ostep_invariantI, clarsimp simp only: globalasimp snd_conv fst_conv)\n    fix \\<sigma> s a \\<sigma>' s' j\n    assume 1: \"(\\<sigma>, s) \\<in> oreachable (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o) S U\"\n       and 2: \"((\\<sigma>, s), a, (\\<sigma>', s')) \\<in> trans (\\<langle>i : \\<zeta>\\<^sub>i : R\\<^sub>i\\<rangle>\\<^sub>o)\"\n       and \"S \\<sigma> \\<sigma>' a\"\n       and \"a = \\<tau> \\<or> (\\<exists>i d. a = i:deliver(d))\"\n       and \"j \\<noteq> i\"\n    moreover from 1 2 obtain \\<zeta> R \\<zeta>' R' where \"s = NodeS i \\<zeta> R\" and \"s' = NodeS i \\<zeta>' R'\" ..\n    ultimately show \"\\<sigma>' j = \\<sigma> j\"\n      by (cases a) (auto simp del: step_node_tau simp add: onode_comps)\n  qed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AWN/ONode_Lifting.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984434543458, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.32115985681955334}}
{"text": "(*  Title:      JinjaThreads/JVM/JVMExceptions.thy\n    Author:     Gerwin Klein, Martin Strecker, Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Exception handling in the JVM} *}\n\ntheory JVMExceptions\nimports\n  JVMInstructions\nbegin\n\nabbreviation Any :: \"cname option\"\nwhere \"Any \\<equiv> None\"\n\ndefinition matches_ex_entry :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> pc \\<Rightarrow> ex_entry \\<Rightarrow> bool\"\nwhere\n \"matches_ex_entry P C pc xcp \\<equiv>\n                 let (s, e, C', h, d) = xcp in\n                 s \\<le> pc \\<and> pc < e \\<and> (case C' of None \\<Rightarrow> True | \\<lfloor>C''\\<rfloor> \\<Rightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* C'')\"\n\n\nprimrec\n  match_ex_table :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> pc \\<Rightarrow> ex_table \\<Rightarrow> (pc \\<times> nat) option\"\nwhere\n  \"match_ex_table P C pc []     = None\"\n| \"match_ex_table P C pc (e#es) = (if matches_ex_entry P C pc e\n                                   then Some (snd(snd(snd e)))\n                                   else match_ex_table P C pc es)\"\n\nabbreviation ex_table_of :: \"'addr jvm_prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> ex_table\"\nwhere \"ex_table_of P C M == snd (snd (snd (the (snd (snd (snd(method P C M)))))))\"\n\nlemma match_ex_table_SomeD:\n  \"match_ex_table P C pc xt = Some (pc',d') \\<Longrightarrow> \n  \\<exists>(f,t,D,h,d) \\<in> set xt. matches_ex_entry P C pc (f,t,D,h,d) \\<and> h = pc' \\<and> d=d'\"\n  by (induct xt) (auto split: split_if_asm)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/JVM/JVMExceptions.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6791786991753929, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.32103654877276777}}
{"text": "section \\<open>Priority Search Trees on top of RBTs\\<close>\n\ntheory PST_RBT\nimports\n  \"HOL-Data_Structures.Cmp\"\n  \"HOL-Data_Structures.Isin2\"\n  \"HOL-Data_Structures.Lookup2\"\n  PST_General\nbegin\n  \ntext \\<open>\nWe obtain a priority search map based on red-black trees via the \ngeneral priority search tree augmentation.\n\nThis theory has been derived from the standard Isabelle implementation of red \nblack trees in @{session \"HOL-Data_Structures\"}.\n\\<close>\n\nsubsection \\<open>Definitions\\<close>\n\nsubsubsection \\<open>The Code\\<close>\n\ndatatype tcolor = Red | Black\n\ntype_synonym ('k,'p) rbth = \"(('k\\<times>'p) \\<times> (tcolor \\<times> ('k \\<times> 'p))) tree\"\n\nabbreviation R where \"R mkp l a r \\<equiv> Node l (a, Red,mkp) r\"\nabbreviation B where \"B mkp l a r \\<equiv> Node l (a, Black,mkp) r\"\n\nabbreviation \"mkR \\<equiv> mkNode Red\"\nabbreviation \"mkB \\<equiv> mkNode Black\"\n\nfun baliL :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k\\<times>'p \\<Rightarrow> ('k,'p) rbth \\<Rightarrow> ('k,'p) rbth\" \n  where\n  \"baliL (R _ (R _ t1 a1 t2) a2 t3) a3 t4 = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\"\n| \"baliL (R _ t1 a1 (R _ t2 a2 t3)) a3 t4 = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\"\n| \"baliL t1 a t2 = mkB t1 a t2\"\n\nfun baliR :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k\\<times>'p \\<Rightarrow> ('k,'p) rbth \\<Rightarrow> ('k,'p) rbth\" \n  where\n\"baliR t1 a1 (R _ (R _ t2 a2 t3) a3 t4) = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\" |\n\"baliR t1 a1 (R _ t2 a2 (R _ t3 a3 t4)) = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\" |\n\"baliR t1 a t2 = mkB t1 a t2\"\n\nfun paint :: \"tcolor \\<Rightarrow> ('k,'p::linorder) rbth \\<Rightarrow> ('k,'p::linorder) rbth\" where\n\"paint c Leaf = Leaf\" |\n\"paint c (Node l (a, (_,mkp)) r) = Node l (a, (c,mkp)) r\"\n\nfun baldL :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k \\<times> 'p \\<Rightarrow> ('k,'p::linorder) rbth \n    \\<Rightarrow> ('k,'p::linorder) rbth\" \nwhere\n\"baldL (R _ t1 x t2) y t3 = mkR (mkB t1 x t2) y t3\" |\n\"baldL bl x (B _ t1 y t2) = baliR bl x (mkR t1 y t2)\" |\n\"baldL bl x (R _ (B _ t1 y t2) z t3) \n  = mkR (mkB bl x t1) y (baliR t2 z (paint Red t3))\" |\n\"baldL t1 x t2 = mkR t1 x t2\"\n\nfun baldR :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k \\<times> 'p \\<Rightarrow> ('k,'p::linorder) rbth \n    \\<Rightarrow> ('k,'p::linorder) rbth\" \nwhere\n\"baldR t1 x (R _ t2 y t3) = mkR t1 x (mkB t2 y t3)\" |\n\"baldR (B _ t1 x t2) y t3 = baliL (mkR t1 x t2) y t3\" |\n\"baldR (R _ t1 x (B _ t2 y t3)) z t4 \n  = mkR (baliL (paint Red t1) x t2) y (mkB t3 z t4)\" |\n\"baldR t1 x t2 = mkR t1 x t2\"\n\nfun combine :: \"('k,'p::linorder) rbth \\<Rightarrow> ('k,'p::linorder) rbth \n    \\<Rightarrow> ('k,'p::linorder) rbth\" \nwhere\n\"combine Leaf t = t\" |\n\"combine t Leaf = t\" |\n\"combine (R _ t1 a t2) (R _ t3 c t4) =\n  (case combine t2 t3 of\n     R _ u2 b u3 \\<Rightarrow> (mkR (mkR t1 a u2) b (mkR u3 c t4)) |\n     t23 \\<Rightarrow> mkR t1 a (mkR t23 c t4))\" |\n\"combine (B _ t1 a t2) (B _ t3 c t4) =\n  (case combine t2 t3 of\n     R _ t2' b t3' \\<Rightarrow> mkR (mkB t1 a t2') b (mkB t3' c t4) |\n     t23 \\<Rightarrow> baldL t1 a (mkB t23 c t4))\" |\n\"combine t1 (R _ t2 a t3) = mkR (combine t1 t2) a t3\" |\n\"combine (R _ t1 a t2) t3 = mkR t1 a (combine t2 t3)\"\n\nfun color :: \"('k,'p) rbth \\<Rightarrow> tcolor\" where\n\"color Leaf = Black\" |\n\"color (Node _ (_, (c,_)) _) = c\"\n\n\nfun upd :: \"'a::linorder \\<Rightarrow> 'b::linorder \\<Rightarrow> ('a,'b) rbth \\<Rightarrow> ('a,'b) rbth\" where\n\"upd x y Leaf = mkR Leaf (x,y) Leaf\" |\n\"upd x y (B _ l (a,b) r) = (case cmp x a of\n  LT \\<Rightarrow> baliL (upd x y l) (a,b) r |\n  GT \\<Rightarrow> baliR l (a,b) (upd x y r) |\n  EQ \\<Rightarrow> mkB l (x,y) r)\" |\n\"upd x y (R _ l (a,b) r) = (case cmp x a of\n  LT \\<Rightarrow> mkR (upd x y l) (a,b) r |\n  GT \\<Rightarrow> mkR l (a,b) (upd x y r) |\n  EQ \\<Rightarrow> mkR l (x,y) r)\"\n\ndefinition update :: \"'a::linorder \\<Rightarrow> 'b::linorder \\<Rightarrow> ('a,'b) rbth \\<Rightarrow> ('a,'b) rbth\" \nwhere\n\"update x y t = paint Black (upd x y t)\"\n\n\nfun del :: \"'a::linorder \\<Rightarrow> ('a,'b::linorder)rbth \\<Rightarrow> ('a,'b)rbth\" where\n\"del x Leaf = Leaf\" |\n\"del x (Node l ((a,b), (c,_)) r) = (case cmp x a of\n     LT \\<Rightarrow> if l \\<noteq> Leaf \\<and> color l = Black\n           then baldL (del x l) (a,b) r else mkR (del x l) (a,b) r |\n     GT \\<Rightarrow> if r \\<noteq> Leaf\\<and> color r = Black\n           then baldR l (a,b) (del x r) else mkR l (a,b) (del x r) |\n  EQ \\<Rightarrow> combine l r)\"\n\ndefinition delete :: \"'a::linorder \\<Rightarrow> ('a,'b::linorder) rbth \\<Rightarrow> ('a,'b) rbth\" where\n\"delete x t = paint Black (del x t)\"\n\n\nsubsubsection \\<open>Invariants\\<close>\n\nfun bheight :: \"('k,'p) rbth \\<Rightarrow> nat\" where\n\"bheight Leaf = 0\" |\n\"bheight (Node l (x, (c,_)) r) = (if c = Black then bheight l + 1 else bheight l)\"\n\nfun invc :: \"('k,'p) rbth \\<Rightarrow> bool\" where\n\"invc Leaf = True\" |\n\"invc (Node l (a, (c,_)) r) =\n  (invc l \\<and> invc r \\<and> (c = Red \\<longrightarrow> color l = Black \\<and> color r = Black))\"\n\nfun invc2 :: \"('k,'p) rbth \\<Rightarrow> bool\" \\<comment> \\<open>Weaker version\\<close> where\n\"invc2 Leaf = True\" |\n\"invc2 (Node l (a, _) r) = (invc l \\<and> invc r)\"\n\nfun invh :: \"('k,'p) rbth \\<Rightarrow> bool\" where\n\"invh Leaf = True\" |\n\"invh (Node l (x, _) r) = (invh l \\<and> invh r \\<and> bheight l = bheight r)\"\n\ndefinition rbt :: \"('k,'p::linorder) rbth \\<Rightarrow> bool\" where\n\"rbt t = (invc t \\<and> invh t \\<and> invpst t \\<and> color t = Black)\"\n\n\nsubsection \\<open>Functional Correctness\\<close>\n\nlemma inorder_paint[simp]: \"inorder(paint c t) = inorder t\"\nby(cases t) (auto)\n\nlemma inorder_mkNode[simp]:\n  \"inorder (mkNode c l a r) = inorder l @ a # inorder r\"\nby (auto simp: mkNode_def)\n\n\nlemma inorder_baliL[simp]:\n  \"inorder(baliL l a r) = inorder l @ a # inorder r\"\nby(cases \"(l,a,r)\" rule: baliL.cases) (auto)\n\nlemma inorder_baliR[simp]:\n  \"inorder(baliR l a r) = inorder l @ a # inorder r\"\nby(cases \"(l,a,r)\" rule: baliR.cases) (auto)\n\n\nlemma inorder_baldL[simp]:\n  \"inorder(baldL l a r) = inorder l @ a # inorder r\"\nby (cases \"(l,a,r)\" rule: baldL.cases) auto\n\nlemma inorder_baldR[simp]:\n  \"inorder(baldR l a r) = inorder l @ a # inorder r\"\nby(cases \"(l,a,r)\" rule: baldR.cases) auto\n\nlemma inorder_combine[simp]:\n  \"inorder(combine l r) = inorder l @ inorder r\"\nby (induction l r rule: combine.induct) (auto split: tree.split tcolor.split)\n\nlemma inorder_upd:\n  \"sorted1(inorder t) \\<Longrightarrow> inorder(upd x y t) = upd_list x y (inorder t)\"\nby(induction x y t rule: upd.induct)\n  (auto simp: upd_list_simps)\n\nlemma inorder_update:\n  \"sorted1(inorder t) \\<Longrightarrow> inorder(update x y t) = upd_list x y (inorder t)\"\nby(simp add: update_def inorder_upd)\n\nlemma inorder_del:\n \"sorted1(inorder t) \\<Longrightarrow>  inorder(del x t) = del_list x (inorder t)\"\nby(induction x t rule: del.induct)\n  (auto simp: del_list_simps)\n\nlemma inorder_delete:\n  \"sorted1(inorder t) \\<Longrightarrow> inorder(delete x t) = del_list x (inorder t)\"\nby(simp add: delete_def inorder_del)\n\n\nsubsection \\<open>Invariant Preservation\\<close>\n\nlemma color_paint_Black: \"color (paint Black t) = Black\"\nby (cases t) auto\n\ntheorem rbt_Leaf: \"rbt Leaf\"\nby (simp add: rbt_def)\n\nlemma invc2I: \"invc t \\<Longrightarrow> invc2 t\"\nby (cases t rule: invc.cases) simp+\n\nlemma paint_invc2: \"invc2 t \\<Longrightarrow> invc2 (paint c t)\"\nby (cases t) auto\n\nlemma invc_paint_Black: \"invc2 t \\<Longrightarrow> invc (paint Black t)\"\nby (cases t) auto\n\nlemma invh_paint: \"invh t \\<Longrightarrow> invh (paint c t)\"\nby (cases t) auto\n\nlemma invc_mkRB[simp]:\n  \"invc (mkR l a r) \\<longleftrightarrow> invc l \\<and> invc r \\<and> color l = Black \\<and> color r = Black\"\n  \"invc (mkB l a r) \\<longleftrightarrow> invc l \\<and> invc r\"\nby (simp_all add: mkNode_def)\n\nlemma color_mkNode[simp]: \"color (mkNode c l a r) = c\"\nby (simp_all add: mkNode_def)\n\n\nsubsubsection \\<open>Update\\<close>\n\nlemma invc_baliL:\n  \"\\<lbrakk>invc2 l; invc r\\<rbrakk> \\<Longrightarrow> invc (baliL l a r)\"\nby (induct l a r rule: baliL.induct) auto\n\nlemma invc_baliR:\n  \"\\<lbrakk>invc l; invc2 r\\<rbrakk> \\<Longrightarrow> invc (baliR l a r)\"\nby (induct l a r rule: baliR.induct) auto\n\nlemma bheight_mkRB[simp]:\n  \"bheight (mkR l a r) = bheight l\"\n  \"bheight (mkB l a r) = Suc (bheight l)\"\n  by (simp_all add: mkNode_def)\n\nlemma bheight_baliL:\n  \"bheight l = bheight r \\<Longrightarrow> bheight (baliL l a r) = Suc (bheight l)\"\nby (induct l a r rule: baliL.induct) auto\n\nlemma bheight_baliR:\n  \"bheight l = bheight r \\<Longrightarrow> bheight (baliR l a r) = Suc (bheight l)\"\nby (induct l a r rule: baliR.induct) auto\n\nlemma invh_mkNode[simp]:\n  \"invh (mkNode c l a r) \\<longleftrightarrow> invh l \\<and> invh r \\<and> bheight l = bheight r\"\nby (simp add: mkNode_def)\n\nlemma invh_baliL:\n  \"\\<lbrakk> invh l; invh r; bheight l = bheight r \\<rbrakk> \\<Longrightarrow> invh (baliL l a r)\"\nby (induct l a r rule: baliL.induct) auto\n\nlemma invh_baliR:\n  \"\\<lbrakk> invh l; invh r; bheight l = bheight r \\<rbrakk> \\<Longrightarrow> invh (baliR l a r)\"\nby (induct l a r rule: baliR.induct) auto\n\n\nlemma invc_upd: assumes \"invc t\"\n  shows \"color t = Black \\<Longrightarrow> invc (upd x y t)\" \"invc2 (upd x y t)\"\nusing assms\nby (induct x y t rule: upd.induct) \n   (auto simp: invc_baliL invc_baliR invc2I mkNode_def)\n\nlemma invh_upd: assumes \"invh t\"\n  shows \"invh (upd x y t)\" \"bheight (upd x y t) = bheight t\"\nusing assms\nby(induct x y t rule: upd.induct)\n  (auto simp: invh_baliL invh_baliR bheight_baliL bheight_baliR)\n\n\nlemma invpst_paint[simp]: \"invpst (paint c t) = invpst t\"\nby (cases \"(c,t)\" rule: paint.cases) auto\n\nlemma invpst_baliR: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baliR l a r)\"\nby (cases \"(l,a,r)\" rule: baliR.cases) auto\n\nlemma invpst_baliL: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baliL l a r)\"\nby (cases \"(l,a,r)\" rule: baliL.cases) auto\n\nlemma invpst_upd: \"invpst t \\<Longrightarrow> invpst (upd x y t)\"\nby (induct x y t rule: upd.induct) (auto simp: invpst_baliR invpst_baliL)\n\n\ntheorem rbt_update: \"rbt t \\<Longrightarrow> rbt (update x y t)\"\nby (simp add: invc_upd(2) invh_upd(1) color_paint_Black invc_paint_Black \n  invh_paint rbt_def update_def invpst_upd)\n\n\nsubsubsection \\<open>Delete\\<close>\n\nlemma bheight_paint_Red:\n  \"color t = Black \\<Longrightarrow> bheight (paint Red t) = bheight t - 1\"\nby (cases t) auto\n\nlemma invh_baldL_invc:\n  \"\\<lbrakk> invh l;  invh r;  bheight l + 1 = bheight r;  invc r \\<rbrakk>\n   \\<Longrightarrow> invh (baldL l a r) \\<and> bheight (baldL l a r) = bheight l + 1\"\nby (induct l a r rule: baldL.induct)\n   (auto simp: invh_baliR invh_paint bheight_baliR bheight_paint_Red)\n\nlemma invh_baldL_Black:\n  \"\\<lbrakk> invh l;  invh r;  bheight l + 1 = bheight r;  color r = Black \\<rbrakk>\n   \\<Longrightarrow> invh (baldL l a r) \\<and> bheight (baldL l a r) = bheight r\"\nby (induct l a r rule: baldL.induct) (auto simp add: invh_baliR bheight_baliR)\n\nlemma invc_baldL: \"\\<lbrakk>invc2 l; invc r; color r = Black\\<rbrakk> \\<Longrightarrow> invc (baldL l a r)\"\nby (induct l a r rule: baldL.induct) (auto simp: invc_baliR invc2I mkNode_def)\n\nlemma invc2_baldL: \"\\<lbrakk> invc2 l; invc r \\<rbrakk> \\<Longrightarrow> invc2 (baldL l a r)\"\nby (induct l a r rule: baldL.induct) \n   (auto simp: invc_baliR paint_invc2 invc2I mkNode_def)\n\nlemma invh_baldR_invc:\n  \"\\<lbrakk> invh l;  invh r;  bheight l = bheight r + 1;  invc l \\<rbrakk>\n  \\<Longrightarrow> invh (baldR l a r) \\<and> bheight (baldR l a r) = bheight l\"\nby(induct l a r rule: baldR.induct)\n  (auto simp: invh_baliL bheight_baliL invh_paint bheight_paint_Red)\n\nlemma invc_baldR: \"\\<lbrakk>invc a; invc2 b; color a = Black\\<rbrakk> \\<Longrightarrow> invc (baldR a x b)\"\nby (induct a x b rule: baldR.induct) (simp_all add: invc_baliL mkNode_def)\n\nlemma invc2_baldR: \"\\<lbrakk> invc l; invc2 r \\<rbrakk> \\<Longrightarrow>invc2 (baldR l x r)\"\nby (induct l x r rule: baldR.induct) \n   (auto simp: invc_baliL paint_invc2 invc2I mkNode_def)\n\nlemma invh_combine:\n  \"\\<lbrakk> invh l; invh r; bheight l = bheight r \\<rbrakk>\n  \\<Longrightarrow> invh (combine l r) \\<and> bheight (combine l r) = bheight l\"\nby (induct l r rule: combine.induct)\n   (auto simp: invh_baldL_Black split: tree.splits tcolor.splits)\n\nlemma invc_combine:\n  assumes \"invc l\" \"invc r\"\n  shows \"color l = Black \\<Longrightarrow> color r = Black \\<Longrightarrow> invc (combine l r)\"\n         \"invc2 (combine l r)\"\nusing assms\nby (induct l r rule: combine.induct)\n   (auto simp: invc_baldL invc2I mkNode_def split: tree.splits tcolor.splits)\n\nlemma neq_LeafD: \"t \\<noteq> Leaf \\<Longrightarrow> \\<exists>l x c r. t = Node l (x,c) r\"\nby(cases t) auto\n\nlemma del_invc_invh: \"invh t \\<Longrightarrow> invc t \\<Longrightarrow> invh (del x t) \\<and>\n   (color t = Red \\<and> bheight (del x t) = bheight t \\<and> invc (del x t) \\<or>\n    color t = Black \\<and> bheight (del x t) = bheight t - 1 \\<and> invc2 (del x t))\"\nproof (induct x t rule: del.induct)\ncase (2 x _ y _ c)\n  have \"x = y \\<or> x < y \\<or> x > y\" by auto\n  thus ?case proof (elim disjE)\n    assume \"x = y\"\n    with 2 show ?thesis\n    by (cases c) (simp_all add: invh_combine invc_combine)\n  next\n    assume \"x < y\"\n    with 2 show ?thesis\n      by(cases c)\n        (auto \n          simp: invh_baldL_invc invc_baldL invc2_baldL mkNode_def \n          dest: neq_LeafD)\n  next\n    assume \"y < x\"\n    with 2 show ?thesis\n      by(cases c)\n        (auto \n          simp: invh_baldR_invc invc_baldR invc2_baldR mkNode_def \n          dest: neq_LeafD)\n  qed\nqed auto\n\nlemma invpst_baldR: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baldR l a r)\"\nby (cases \"(l,a,r)\" rule: baldR.cases) (auto simp: invpst_baliL)\n\nlemma invpst_baldL: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baldL l a r)\"\nby (cases \"(l,a,r)\" rule: baldL.cases) (auto simp: invpst_baliR)\n\nlemma invpst_combine: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (combine l r)\"\nby(induction l r rule: combine.induct)\n  (auto split: tree.splits tcolor.splits simp: invpst_baldR invpst_baldL)\n\nlemma invpst_del: \"invpst t \\<Longrightarrow> invpst (del x t)\"\nby(induct x t rule: del.induct)\n  (auto simp: invpst_baldR invpst_baldL invpst_combine)\n\ntheorem rbt_delete: \"rbt t \\<Longrightarrow> rbt (delete k t)\"\napply (clarsimp simp: delete_def rbt_def)\napply (frule (1) del_invc_invh[where x=k])\napply (auto simp: invc_paint_Black invh_paint color_paint_Black invpst_del)\ndone\n\nlemma rbt_getmin_ismin: \n  \"rbt t \\<Longrightarrow> t\\<noteq>Leaf \\<Longrightarrow> is_min2 (pst_getmin t) (set_tree t)\"\nunfolding rbt_def by (simp add: pst_getmin_ismin)\n\ndefinition \"rbt_is_empty t \\<equiv> t = Leaf\"\n\nlemma rbt_is_empty: \"rbt_is_empty t \\<longleftrightarrow> inorder t = []\"\nby (cases t) (auto simp: rbt_is_empty_def)\n\ndefinition empty where \"empty = Leaf\"\n\n\nsubsection \\<open>Overall Correctness\\<close>\n\ninterpretation PM: PrioMap_by_Ordered\nwhere empty = empty and lookup = lookup and update = update and delete = delete\nand inorder = inorder and inv = \"rbt\" and is_empty = rbt_is_empty \nand getmin = pst_getmin\napply standard\napply (auto simp: lookup_map_of inorder_update inorder_delete rbt_update \n                  rbt_delete rbt_Leaf rbt_is_empty empty_def \n            dest: rbt_getmin_ismin)\ndone\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Priority_Search_Trees/PST_RBT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370308082623217, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3210037551005115}}
{"text": "theory Utilities_Ext\n  imports \n    Utilities\n    Extended_Assertion\nbegin \n\ncontext rbt_impl\nbegin\n\ndeclare ll_matches_rbt.simps[simp]\n\nlemma matches_rbt_correct [vcg_rules]:\n  \"\n  llvm_htriple\n  (rbt_assn_ext t {} ti)\n  (ll_matches_rbt pat ti)\n  (\\<lambda>r. rbt_assn_ext t {} ti ** \\<upharpoonleft>bool.assn (matches_rbt pat (rbt_of t)) r)\n\"\nproof(induction pat arbitrary: t ti)\n  case RP_Var\n  then show ?case\n    apply vcg\n    apply (subst Hack_1) (*!FIX!*)\n    apply vcg\n    done\nnext\n  case RP_Empty\n  then show ?case\n    apply vcg\n    apply (subst Hack_1) (*!FIX!*)\n    apply vcg_compat\n    apply isep_extract_pure\n    apply (simp add: bool_assn_pure_eq)\n    apply auto[]\n    apply (sepwith \\<open>auto elim: rbt_of.elims\\<close>)+\n    done\nnext\n  case (RP_Branch x1 pat1 pat2)\n  note [vcg_rules] = RP_Branch\n\n  show \"?case\"\n    apply vcg\n    subgoal\n      apply (subst Hack_1) (*!FIX!*)\n      apply (simp add: bool_assn_pure_eq)\n      apply vcg\n      done\n    subgoal\n      apply vcg\n        apply (all \\<open>subst Hack_1\\<close>)\n        apply vcg\n      done\n    done\nqed\n\ndeclare ll_matches_rbt.simps[simp del]\n\ndefinition \"ctx (P::bool) \\<equiv> \\<up>P\"\n\nlemma sep_context_pureI [fri_red_rules]: \n  \"B \\<Longrightarrow> is_sep_red (\\<up>B) \\<box> \\<box> (ctx B)\"\n  unfolding ctx_def\n  apply (rule is_sep_redI)\n  by (simp add: pure_true_conv)\n\nlemma ctx_is_pure [simp]: \"sep_is_pure_assn (ctx X)\" \n  unfolding ctx_def\n  by simp\n\nlemma ctx_pure_part [simp]: \"pure_part (ctx X) = X\" \n  unfolding ctx_def\n  by simp\n\nend\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Utilities_Ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370308082623216, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.32100375510051143}}
{"text": "theory javabip\n  imports Main \"/Volumes/Setup/Isabelle/Isabelle-Code/August/libs_functions\"\nbegin\n\n\n(*\nvalue \"concat (mk_pair_4 test_synchron)\"\nvalue \"(mk_pair_4 (make_betaSet_3 test_triggers))\"\nvalue \"(mk_pair_4 test_synchron)\"\nvalue \"concat (mk_pair_4 test_synchron)\"\n\nvalue \"(mk_pair_4 test_triggers)\"\nvalue \"(mk_pair_4_no_product test_triggers)\"\nvalue \"(mk_Trigger_list (mk_pair_4_no_product test_triggers))\"\nvalue \"(mk_Trigger_list (mk_pair_4_no_product test_synchron))\"\nvalue \"List.product (mk_Trigger_list (mk_pair_4 test_synchron)) (mk_Trigger_list (mk_pair_4_no_product test_triggers))\"\n\nvalue \"mk_pair_4_no_product test_synchron\"\nvalue \"List.product (mk_Trigger_list (mk_pair_4_no_product test_synchron)) (mk_Trigger_list (mk_pair_4_no_product test_triggers))\"\nvalue \"List.product ((mk_pair_4_no_product test_synchron)) (mk_Trigger_list (mk_pair_4_no_product test_triggers))\"\n\ndefinition JavaBIP_Connector :: \"((string \\<times> string) list list \\<times> (string \\<times> string) list list) list\"\n  where\n\"JavaBIP_Connector = List.product (mk_Trigger_list (mk_pair_4_no_product test_synchron)) (mk_Trigger_list (mk_pair_4_no_product test_triggers))\"\n*)\nvalue \"List.product ((mk_pair_4_no_product test_synchron)) (mk_Trigger_list (mk_pair_4 test_triggers))\"\n\ndefinition JavaBIP_Connector_1 :: \"((string \\<times> string) list list \\<times> (string \\<times> string) list list) list\"\n  where\n\"JavaBIP_Connector_1 = List.product ((mk_pair_4_no_product test_synchron)) (mk_Trigger_list (mk_pair_4_no_product test_triggers))\"\n\nvalue \"(mk_pair_4_no_product test_synchron)\"\nvalue \"(mk_Trigger_list (mk_pair_4_no_product test_triggers))\"\n\n(*JavaBIP connector 2*)\nfun mk_jvb :: \"'a list \\<Rightarrow> 'b \\<Rightarrow> ('a \\<times> 'b) list\" where\n\"mk_jvb [] y = []\"|\n\"mk_jvb (x#xs) y = [(Pair x) y] @ mk_jvb xs y\"\n\nvalue \"mk_jvb (mk_pair_4_no_product test_synchron) (mk_Trigger_list (mk_pair_4_no_product test_triggers))\"\n\ndefinition JavaBIP_Connector_2 :: \"((string \\<times> string) list list \\<times> (string \\<times> string) list list list) list\"\n  where\n\"JavaBIP_Connector_2 = mk_jvb (mk_pair_4_no_product test_synchron) (mk_Trigger_list (mk_pair_4_no_product test_triggers))\"\n\nvalue \"JavaBIP_Connector_2\"\n\nvalue \"mk_Trigger_list (mk_pair_4_no_product test_triggers)\"\n\nvalue \"product_lists (mk_Trigger_list (mk_pair_4_no_product test_triggers))\"\n(*\nvalue \"JavaBIP_Connector\"\nvalue \"\\<exists>connector \\<in>set JavaBIP_Connector.\\<forall>sync\\<in>set (fst connector).\\<forall>s_elm\\<in>set(sync).(P (fst s_elm) (snd s_elm) \\<longrightarrow> (\\<exists>trig\\<in>set(snd connector).\\<forall>t_elm\\<in>set(trig). Q (fst t_elm) (snd t_elm) \\<and> (\\<forall>h \\<in> set (lookup_3 (fst t_elm) test_triggers) - {snd t_elm}. \\<not>Q (fst t_elm) h) \n\\<and> (\\<forall>s_elm_1\\<in>set(sync)-{s_elm}. P (fst s_elm_1) (snd s_elm_1)\n    \\<and> (\\<forall>l \\<in> set (lookup_3 (fst s_elm_1) test_synchron) - {snd s_elm_1}. \\<not>P (fst s_elm_1) l))\n)\n)\"\n\nvalue \"\\<exists>connector \\<in>set JavaBIP_Connector.\\<forall>sync\\<in>set (fst connector).\\<exists>s_elm\\<in>set(sync).(P (fst s_elm) (snd s_elm) \\<longrightarrow> (\\<exists>trig\\<in>set(snd connector).\\<forall>t_elm\\<in>set(trig). Q (fst t_elm) (snd t_elm) \n  \\<and> (\\<forall>h \\<in> set (lookup_3 (fst t_elm) test_triggers) - {snd t_elm}. \\<not>Q (fst t_elm) h) \n  \\<and> (\n    (\\<forall>s_elm_1\\<in>set(sync)-{s_elm}. P (fst s_elm_1) (snd s_elm_1)\n    \\<and> (\\<forall>l \\<in> set (lookup_3 (fst s_elm_1) test_synchron) - {snd s_elm_1}. \\<not>P (fst s_elm_1) l))\n    \n    )\n)\n)\"\n*)\n(*---- JavaBIP Connector 3*)\nvalue \"mk_jvb (mk_pair_4_no_product test_synchron) (product_lists (mk_Trigger_list (mk_pair_4_no_product test_triggers)))\"\ndefinition JavaBIP_Connector_3 :: \"((string \\<times> string) list list \\<times> (string \\<times> string) list list list) list\"\n  where\n\"JavaBIP_Connector_3 = mk_jvb (mk_pair_4_no_product test_synchron) (product_lists (mk_Trigger_list (mk_pair_4_no_product test_triggers)))\"\n\nvalue \"JavaBIP_Connector_3\"\n\n(*----------*)\nvalue \"JavaBIP_Connector_1\"\n\n(*REQUIRE*)\nvalue \"\\<exists>connector\\<in>set JavaBIP_Connector_1.\\<forall>sync\\<in>set (fst connector).\\<forall>s_elm\\<in>set sync. (\nP (fst s_elm) (snd s_elm) \\<longrightarrow> \n    ((\\<exists>trig\\<in>set(snd connector).\\<forall>t_elm\\<in>set trig. (\n      Q (fst t_elm) (snd t_elm) \n      \\<and> (\\<forall>h \\<in> set (lookup_3 (fst t_elm) test_triggers) - {snd t_elm}. \\<not>Q (fst t_elm) h)))\n      \\<and> (\\<forall>sync_1\\<in>set(fst connector)-{sync}.\\<exists>s_elm_1\\<in>set(sync_1). P (fst s_elm_1) (snd s_elm_1)\n      \\<and> (\\<forall>l \\<in> set (lookup_3 (fst s_elm_1) test_synchron) - {snd s_elm_1}. \\<not>P (fst s_elm_1) l))\n    )\n)\"\n\n\n(*Accepts*)\nvalue \"(\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<exists>l \\<in> set (snd t).\\<forall>l1 \\<in> set (snd t) - {l}. \\<not> P (fst t) l1) \n\\<and> (\\<forall>i \\<in> set test_triggers. \\<forall>v \\<in> set i. \\<forall>k \\<in> set v. \\<exists>h \\<in> set (snd k).\\<forall>h1 \\<in> set (snd k) - {h}. \\<not> Q (fst k) h1)\"\n\n(*JavaBIP*)\nvalue \"((\\<exists>connector\\<in>set JavaBIP_Connector_1.\\<exists>sync\\<in>set (fst connector).\\<forall>s_elm\\<in>set sync. (\nP (fst s_elm) (snd s_elm) \\<longrightarrow> \n    ((\\<exists>trig\\<in>set(snd connector).\\<forall>t_elm\\<in>set trig. (\n      Q (fst t_elm) (snd t_elm) \n      \\<and> (\\<forall>h \\<in> set (lookup_3 (fst t_elm) test_triggers) - {snd t_elm}. \\<not>Q (fst t_elm) h)))\n      \\<and> (\\<forall>sync_1\\<in>set(fst connector)-{sync}.\\<exists>s_elm_1\\<in>set(sync_1). P (fst s_elm_1) (snd s_elm_1)\n      \\<and> (\\<forall>l \\<in> set (lookup_3 (fst s_elm_1) test_synchron) - {snd s_elm_1}. \\<not>P (fst s_elm_1) l))\n    )\n))\n\\<and> (\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<exists>l \\<in> set (snd t).\\<forall>l1 \\<in> set (snd t) - {l}. \\<not> P (fst t) l1) \n\\<and> (\\<forall>i \\<in> set test_triggers. \\<forall>v \\<in> set i. \\<forall>k \\<in> set v. \\<exists>h \\<in> set (snd k).\\<forall>h1 \\<in> set (snd k) - {h}. \\<not> Q (fst k) h1))\"\n\n(*----- JavaBIP_Connector_2 -----*)\nvalue \"JavaBIP_Connector_2\"\nvalue \"(\\<forall>connector\\<in>set JavaBIP_Connector_2.\\<exists>trig_list\\<in>set(snd connector).\\<exists>trig\\<in>set trig_list. \\<forall>t_elm\\<in>set trig. (Q (fst t_elm) (snd t_elm)\n\\<and> (\\<forall>h \\<in> set (lookup_3 (fst t_elm) test_triggers) - {snd t_elm}. \\<not>Q (fst t_elm) h)))\"\n(*Requires*)\nvalue \"\\<forall>connector\\<in>set JavaBIP_Connector_2.\\<forall>sync_list\\<in>set (fst connector).\\<forall>sync\\<in>set sync_list. (P (fst sync) (snd sync) \\<longrightarrow> \n      ((\\<exists>trig_list\\<in>set(snd connector).\\<exists>trig\\<in>set trig_list. \\<forall>t_elm\\<in>set trig. (Q (fst t_elm) (snd t_elm)\n      \\<and> (\\<forall>h \\<in> set (lookup_3 (fst t_elm) test_triggers) - {snd t_elm}. \\<not>Q (fst t_elm) h)))\n      \\<and> (\\<forall>sync_1\\<in>set(fst connector)-{sync_list}.\\<exists>s_elm_1\\<in>set(sync_1). P (fst s_elm_1) (snd s_elm_1)\n      \\<and> (\\<forall>l \\<in> set (lookup_3 (fst s_elm_1) test_synchron) - {snd s_elm_1}. \\<not>P (fst s_elm_1) l))\n    )\n)\"\n\n(*JavaBIP*)\nvalue \"((\\<forall>connector\\<in>set JavaBIP_Connector_2.\\<forall>sync_list\\<in>set (fst connector).\\<forall>sync\\<in>set sync_list. (P (fst sync) (snd sync) \\<longrightarrow> \n      ((\\<exists>trig_list\\<in>set(snd connector).\\<exists>trig\\<in>set trig_list. \\<forall>t_elm\\<in>set trig. (Q (fst t_elm) (snd t_elm)\n      \\<and> (\\<forall>h \\<in> set (lookup_3 (fst t_elm) test_triggers) - {snd t_elm}. \\<not>Q (fst t_elm) h)))\n      \\<and> (\\<forall>sync_1\\<in>set(fst connector)-{sync_list}.\\<exists>s_elm_1\\<in>set(sync_1). P (fst s_elm_1) (snd s_elm_1)\n      \\<and> (\\<forall>l \\<in> set (lookup_3 (fst s_elm_1) test_synchron) - {snd s_elm_1}. \\<not>P (fst s_elm_1) l))\n    )\n))\n\\<and> (\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<forall>l \\<in> set (snd t).(P (fst t) l \\<longrightarrow> (\\<forall>l1 \\<in> set (snd t) - {l}. \\<not>P (fst t) l1)))\n\\<and> (\\<forall>i \\<in> set test_triggers. \\<forall>v \\<in> set i. \\<forall>k \\<in> set v. \\<forall>h \\<in> set (snd k).(Q (fst k) h \\<longrightarrow> (\\<forall>h1 \\<in> set (snd k) - {h}. \\<not>Q (fst k) h1))))\n\"\n\n(*Accepts*)\nvalue \"\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<forall>l \\<in> set (snd t).(P (fst t) l \\<longrightarrow> (\\<forall>l1 \\<in> set (snd t) - {l}. P (fst t) l1))\"\nvalue \"(\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<exists>l \\<in> set (snd t).\\<forall>l1 \\<in> set (snd t) - {l}. \\<not> P (fst t) l1)\"\nvalue \"\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<forall>l \\<in> set (snd t).\\<forall>l1 \\<in> set (snd t) - {l}.(P (fst t) l \\<longrightarrow> \\<not>P (fst t) l1)\"\nvalue \"(\\<forall>i \\<in> set test_triggers. \\<forall>v \\<in> set i. \\<forall>k \\<in> set v. \\<forall>h \\<in> set (snd k).(Q (fst k) h \\<longrightarrow> (\\<forall>h1 \\<in> set (snd k) - {h}. \\<not>Q (fst k) h1)))\"\n\nlemma test_accepts_0: \"\n\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<forall>l \\<in> set (snd t).(P (fst t) l \\<longrightarrow> (\\<forall>l1 \\<in> set (snd t) - {l}. P (fst t) l1)) \\<Longrightarrow>\n(\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<exists>l \\<in> set (snd t).\\<forall>l1 \\<in> set (snd t) - {l}. \\<not> P (fst t) l1)\n\"\n\nlemma test_accepts: \"((\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<exists>l \\<in> set (snd t).\\<forall>l1 \\<in> set (snd t) - {l}. \\<not> P (fst t) l1))\n\\<Longrightarrow>\n(\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<forall>l \\<in> set (snd t).(P (fst t) l \\<longrightarrow> (\\<forall>l1 \\<in> set (snd t) - {l}. P (fst t) l1)))\n\"\n\n\nend\n(*----old------*)\n(*\nvalue \"List.product [[(''3b1'', ''1'')]] [[(''3b2'', ''1''), (''3b2'', ''2'')]]\"\nfun make_javaBIP :: \"'a list \\<Rightarrow> 'b list \\<Rightarrow> ('a * 'b list) list\"\n  where\n\"make_javaBIP [] _ = []\" |\n\"make_javaBIP (x#xs) ys = [(Pair x) ys] @ make_javaBIP xs ys\"\n\nvalue \"make_javaBIP (concat (mk_pair_4 test_synchron)) (mk_pair_4 (make_betaSet_3 test_triggers))\"\n\ndefinition JavaBIP_Connector :: \"((string \\<times> string) list \\<times> (string \\<times> string) list list list) list\" where\n\"JavaBIP_Connector = make_javaBIP (concat (mk_pair_4 test_synchron)) (mk_pair_4 (make_betaSet_3 test_triggers))\"\n\ndefinition BIP_Connector :: \"((string \\<times> string) list \\<times> (string \\<times> string) list list) list\" where\n\"BIP_Connector = List.product (concat (mk_pair_4 test_synchron)) (mk_pair_4 (make_betaSet_3 test_triggers))\"\n\nvalue \"(Pair [(''4'', ''1'')]) (mk_pair_4 (make_betaSet_3 test_triggers))\"\nvalue \"JavaBIP_Connector\"\n\n(*require code*)\nvalue \"\\<forall>connector\\<in>set JavaBIP_Connector.\\<forall>sync\\<in> set (fst connector). (P (fst sync) (snd sync) \\<longrightarrow> \n  (\\<exists>bet \\<in> set (snd connector). \n    (\\<exists>bet1\\<in> set bet.\\<forall>elm \\<in> set (bet1).(Q (fst elm) (snd elm) \\<and> (\\<forall>h \\<in> set (lookup_3 (fst elm) test_triggers) - {snd elm}. \\<not>Q (fst elm) h))) \n    \\<and> (\\<forall>sync1\\<in> set (fst connector) - {sync}. P (fst sync1) (snd sync1) \\<and> (\\<forall>l \\<in> set (lookup_3 (fst sync1) test_synchron)-{snd sync1}.\\<not>P (fst sync1) l))\n  )\n)\"\n\n(*accept code*)\nvalue \"(\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<exists>l \\<in> set (snd t).\\<forall>l1 \\<in> set (snd t) - {l}. \\<not> P (fst t) l1) \n\\<and> (\\<forall>i \\<in> set test_triggers. \\<forall>v \\<in> set i. \\<forall>k \\<in> set v. \\<exists>h \\<in> set (snd k).\\<forall>h1 \\<in> set (snd k) - {h}. \\<not> Q (fst k) h1)\"\n\n(*JavaBIP code*)\nvalue \"((\\<forall>connector\\<in>set JavaBIP_Connector.\\<forall>sync\\<in> set (fst connector). (P (fst sync) (snd sync) \\<longrightarrow> \n  (\\<exists>bet \\<in> set (snd connector). \n    (\\<exists>bet1\\<in> set bet.\\<forall>elm \\<in> set (bet1).(Q (fst elm) (snd elm) \\<and> (\\<forall>h \\<in> set (lookup_3 (fst elm) test_triggers) - {snd elm}. \\<not>Q (fst elm) h))) \n    \\<and> (\\<forall>sync1\\<in> set (fst connector) - {sync}. P (fst sync1) (snd sync1) \\<and> (\\<forall>l \\<in> set (lookup_3 (fst sync1) test_synchron)-{snd sync1}.\\<not>P (fst sync1) l))\n  )\n))\n\\<and> (\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<exists>l \\<in> set (snd t).\\<forall>l1 \\<in> set (snd t) - {l}. \\<not> P (fst t) l1) \n\\<and> (\\<forall>i \\<in> set test_triggers. \\<forall>v \\<in> set i. \\<forall>k \\<in> set v. \\<exists>h \\<in> set (snd k).\\<forall>h1 \\<in> set (snd k) - {h}. \\<not> Q (fst k) h1))\n\"\n\nlemma compare: \"((\\<forall>connector\\<in>set JavaBIP_Connector.\\<forall>sync\\<in> set (fst connector). (P (fst sync) (snd sync) \\<longrightarrow> \n  (\\<exists>bet \\<in> set (snd connector). \n    (\\<exists>bet1\\<in> set bet.\\<forall>elm \\<in> set (bet1).(Q (fst elm) (snd elm) \\<and> (\\<forall>h \\<in> set (lookup_3 (fst elm) test_triggers) - {snd elm}. \\<not>Q (fst elm) h))) \n    \\<and> (\\<forall>sync1\\<in> set (fst connector) - {sync}. P (fst sync1) (snd sync1) \\<and> (\\<forall>l \\<in> set (lookup_3 (fst sync1) test_synchron)-{snd sync1}.\\<not>P (fst sync1) l))\n  )\n))\n\\<and> (\\<forall>j \\<in> set test_synchron. \\<forall>u \\<in> set j. \\<forall>t \\<in> set u. \\<exists>l \\<in> set (snd t).\\<forall>l1 \\<in> set (snd t) - {l}. \\<not> P (fst t) l1) \n\\<and> (\\<forall>i \\<in> set test_triggers. \\<forall>v \\<in> set i. \\<forall>k \\<in> set v. \\<exists>h \\<in> set (snd k).\\<forall>h1 \\<in> set (snd k) - {h}. \\<not> Q (fst k) h1)) \\<Longrightarrow>\n(\\<exists>connector\\<in>set BIP_Connector.\\<exists>sync\\<in>set (fst connector).(P (fst sync) (snd sync) \\<longrightarrow> (\\<exists>trig\\<in>set (snd connector).\\<forall>elm\\<in>set trig. Q (fst elm) (snd elm)) \n  \\<and> (\\<forall>sync1\\<in>set (fst connector) - {sync}. P (fst sync1) (snd sync1))\n  \\<and> (\\<forall>rs \\<in> remaining_pairs (all_pairs test_synchron) (fst connector). \\<not>P (fst rs) (snd rs))\n  \\<and> (\\<forall>rt \\<in> remaining_pairs (all_pairs test_triggers) (concat (snd connector)). \\<not>Q (fst rt) (snd rt))\n))\n\"\n  sledgehammer\n*)\nend", "meta": {"author": "TrinhLK", "repo": "Isabelle-Code", "sha": "6eb41d730967df6b4dca606376a6825d16968c20", "save_path": "github-repos/isabelle/TrinhLK-Isabelle-Code", "path": "github-repos/isabelle/TrinhLK-Isabelle-Code/Isabelle-Code-6eb41d730967df6b4dca606376a6825d16968c20/August/javabip.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.32100374815570765}}
{"text": "section \\<open>Implementation of Heaps by Arrays\\<close>\ntheory IICF_Impl_Heapmap\nimports \n  IICF_Abs_Heapmap \n  \"../IICF_Array\" \n  \"../IICF_Array_List\" \n  \"../IICF_Array_Map_Total\" \n  \"../IICF_Indexed_Array_List\"\nbegin\n    \n  locale hm_impl = hmstruct prio for prio :: \"'e \\<Rightarrow> 'p::linorder\" +\n    fixes prio_assn :: \"'p \\<Rightarrow> 'pi::llvm_rep \\<Rightarrow> assn\"\n      and elem_assn :: \"'e \\<Rightarrow> 'ei::llvm_rep \\<Rightarrow> assn\"\n      and prio_impl le_prio_impl lt_prio_impl\n      and ltype :: \"'l::len2 itself\"\n    assumes prio_is_pure[safe_constraint_rules]: \"is_pure prio_assn\"\n    assumes elem_is_pure[safe_constraint_rules]: \"is_pure elem_assn\"  \n    assumes prio_impl_refine[sepref_fr_rules]: \"(prio_impl, RETURN o prio)\\<in>elem_assn\\<^sup>k \\<rightarrow>\\<^sub>a prio_assn\"\n    assumes le_prio_impl_refine[sepref_fr_rules]: \n      \"(uncurry le_prio_impl, uncurry (RETURN oo (\\<le>))) \\<in> prio_assn\\<^sup>k *\\<^sub>a prio_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n    assumes lt_prio_impl_refine[sepref_fr_rules]: \n      \"(uncurry lt_prio_impl, uncurry (RETURN oo (<))) \\<in> prio_assn\\<^sup>k *\\<^sub>a prio_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n      \n  begin\n\n    context\n      fixes N :: nat\n    begin\n    abbreviation \"idx_assn \\<equiv> snatb_assn' TYPE('l) N\"\n    abbreviation \"idx1_assn \\<equiv> snatb_assn' TYPE('l) (Suc N)\"\n\n    sepref_register prio\n\n    sepref_register \"(\\<le>) :: 'p \\<Rightarrow> 'p \\<Rightarrow> bool\"\n    sepref_register \"(<) :: 'p \\<Rightarrow> 'p \\<Rightarrow> bool\"\n    \n    lemmas [sepref_frame_free_rules] = \n      mk_free_is_pure[OF prio_is_pure]\n      mk_free_is_pure[OF elem_is_pure]\n    \n    definition \"hm2_assn \\<equiv> b_assn (ial_assn' TYPE('l) N \\<times>\\<^sub>a amt_assn elem_assn N) (\\<lambda>_. 4<LENGTH('l) \\<and> N<max_snat LENGTH('l))\"\n      \n    lemma hm2_assn_rdomp_boundsI: \"rdomp (hm2_assn) (ag, bq) \\<Longrightarrow> 4<LENGTH('l) \\<and> N<max_snat LENGTH('l)\"\n      unfolding hm2_assn_def by auto\n    \n    \n    find_theorems amt_assn\n    \n    sepref_definition hm_append_impl is \"uncurry2 hm_append_op\"\n      :: \"hm2_assn\\<^sup>d*\\<^sub>aidx_assn\\<^sup>k*\\<^sub>aelem_assn\\<^sup>k \\<rightarrow>\\<^sub>a hm2_assn\"\n      apply (rule hfref_with_rdomI)\n      unfolding hm_append_op_def hm2_assn_def\n      by sepref\n      \n    lemmas [sepref_fr_rules] = hm_append_impl.refine\n      \n    sepref_definition hm_length_impl is \"RETURN o hm_length\" :: \"hm2_assn\\<^sup>k \\<rightarrow>\\<^sub>a snatb_assn' TYPE('l) (N+1)\"\n      apply (rule hfref_with_rdomI)\n      unfolding hm_length_def hm2_assn_def\n      by sepref\n      \n    lemmas [sepref_fr_rules] = hm_length_impl.refine\n      \n    term hm2_assn  \n    sepref_register hm_key_of_op  \n    sepref_definition hm_key_of_impl is \"uncurry hm_key_of_op\" :: \"hm2_assn\\<^sup>k *\\<^sub>a idx1_assn\\<^sup>d \\<rightarrow>\\<^sub>a idx_assn\"\n      apply (rule hfref_with_rdomI)\n      unfolding hm_key_of_op_def hm2_assn_def\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n    lemmas [sepref_fr_rules] = hm_key_of_impl.refine\n      \n    (* Optimization *)\n    definition \"hm_the_lookup_op' k hm \\<equiv> do {\n      let (pq,ml) = hm;\n      v \\<leftarrow> mop_map_the_lookup k ml;\n      RETURN v\n    }\"\n    lemma hm_the_lookup_op'_refine: \n      \"(hm_the_lookup_op', hm_the_lookup_op) \\<in> nat_rel \\<rightarrow> Id \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"\n      apply (intro fun_relI nres_relI)\n      unfolding hm_the_lookup_op'_def hm_the_lookup_op_def\n      apply refine_vcg\n      apply (auto)\n      apply (auto simp: heapmap_\\<alpha>_def hmr_invar_def restrict_map_def split: if_split_asm)\n      done\n\n    sepref_definition hm_the_lookup_impl is \"uncurry hm_the_lookup_op'\" :: \"idx_assn\\<^sup>k*\\<^sub>ahm2_assn\\<^sup>k \\<rightarrow>\\<^sub>a elem_assn\"\n      apply (rule hfref_with_rdomI)\n      unfolding hm_the_lookup_op'_def hm2_assn_def Let_def\n      by sepref\n    lemmas hm_the_lookup_impl_refine[sepref_fr_rules] \n      = hm_the_lookup_impl.refine[FCOMP hm_the_lookup_op'_refine]\n\n    sepref_definition hm_val_of_impl is \"uncurry hm_val_of_op\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx1_assn\\<^sup>k \\<rightarrow>\\<^sub>a elem_assn\"  \n      unfolding hm_val_of_op_def\n      by sepref\n    lemmas [sepref_fr_rules] = hm_val_of_impl.refine\n      \n    sepref_register hm_prio_of_op\n    sepref_definition hm_prio_of_impl is \"uncurry (PR_CONST hm_prio_of_op)\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx1_assn\\<^sup>k \\<rightarrow>\\<^sub>a prio_assn\"  \n      unfolding hm_prio_of_op_def PR_CONST_def\n      by sepref\n    lemmas [sepref_fr_rules] = hm_prio_of_impl.refine\n      \n    definition \"parent_valid h i \\<equiv> hm_valid h (h.parent i)\"\n    definition \"parent_valid' h i \\<equiv> i>(1::nat)\"\n    \n    lemma valid_parent_pat[def_pat_rules]: \"hm_valid$h$(h.parent$i) \\<equiv> parent_valid$h$i\"\n      unfolding parent_valid_def autoref_tag_defs by simp\n    \n    lemma parent_valid'_refine: \"(uncurry parent_valid',uncurry parent_valid) \\<in> [\\<lambda>(h,i). hm_valid h i]\\<^sub>f Id\\<times>\\<^sub>rId\\<rightarrow>Id\"\n      apply rule\n      unfolding hm_valid_def parent_valid_def parent_valid'_def hm_length_def h.parent_def \n      by auto\n    \n    sepref_definition parent_valid_impl is \"uncurry (RETURN oo parent_valid')\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx1_assn\\<^sup>d \\<rightarrow>\\<^sub>a bool1_assn\" \n      unfolding parent_valid'_def\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n    lemmas [sepref_fr_rules] = parent_valid_impl.refine[FCOMP parent_valid'_refine]\n    \n    sepref_definition hm_exch_impl is \"uncurry2 hm_exch_op\" :: \"hm2_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>d \\<rightarrow>\\<^sub>a hm2_assn\"\n      apply (rule hfref_with_rdomI)\n      unfolding hm_exch_op_def hm2_assn_def\n      apply (annot_snat_const \"TYPE('l)\")\n      supply [simp] = hm_valid_def\n      by sepref\n    lemmas [sepref_fr_rules] = hm_exch_impl.refine\n    \n    sepref_definition parent_impl is \"RETURN o h.parent\" :: \"[\\<lambda>_. 4<LENGTH('l)]\\<^sub>aidx1_assn\\<^sup>d \\<rightarrow> idx1_assn\"\n      unfolding h.parent_def\n      apply (rule hfref_bassn_resI)\n      subgoal by auto\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n      \n    lemmas [sepref_fr_rules] = parent_impl.refine    \n    \n    find_theorems hm_swim_op\n    sepref_register h.parent hm_exch_op\n    \n    (* TODO: Very specialized workaround lemma, to work around invalid-recombination\n      problem for case that B is pure. DUP in IICF_Heap_Impl.thy\n    *)    \n    lemma workaround_invalid_recombine_pure3: \"is_pure B \\<Longrightarrow> hn_ctxt (invalid_assn A \\<times>\\<^sub>a invalid_assn B) ax px \\<turnstile> hn_invalid (A \\<times>\\<^sub>a B) ax px\"\n      unfolding hn_ctxt_def invalid_assn_def prod_assn_def entails_def\n      by (auto split: prod.split elim!: is_pureE \n        simp: sep_algebra_simps pure_part_pure_conj_eq)\n      argo\n    \n    find_theorems is_pure b_assn  \n    \n    sepref_register hm_swim_op\n    sepref_definition hm_swim_impl is \"uncurry (PR_CONST hm_swim_op)\" :: \"hm2_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>k \\<rightarrow>\\<^sub>a hm2_assn\"\n      unfolding hm_swim_op_def PR_CONST_def\n      (* TODO: Workaround/Hack *)\n      supply X[sepref_frame_match_rules] = workaround_invalid_recombine_pure3[where B=\"snatb_assn _\", simplified]\n      supply [simp] = hm2_assn_rdomp_boundsI\n      by sepref\n    lemmas [sepref_fr_rules] = hm_swim_impl.refine\n    \n    sepref_register hm_insert_op\n    sepref_definition hm_insert_impl is \"uncurry2 (PR_CONST hm_insert_op)\" \n      :: \"idx_assn\\<^sup>k*\\<^sub>aelem_assn\\<^sup>k*\\<^sub>ahm2_assn\\<^sup>d \\<rightarrow>\\<^sub>a hm2_assn\"\n      unfolding hm_insert_op_def PR_CONST_def\n      by sepref\n    lemmas [sepref_fr_rules] = hm_insert_impl.refine\n    \n    lemma rewr_2kleN: \"2*k \\<le> n \\<longleftrightarrow> k \\<le> n div 2\" for k :: nat by auto\n      \n    sepref_definition hm_has_child_impl is \"uncurry (RETURN oo hm_has_child_op)\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx1_assn\\<^sup>d \\<rightarrow>\\<^sub>a bool1_assn\"\n      unfolding hm_has_child_op_def\n      apply (rewrite rewr_2kleN)\n      supply [simp,dest] = hm2_assn_rdomp_boundsI\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n      \n    lemmas [sepref_fr_rules] = hm_has_child_impl.refine    \n\n    sepref_definition hm_left_child_impl is \"RETURN o hm_left_child_op\" :: \"[\\<lambda>i. 2*i\\<le>N \\<and> N<max_snat LENGTH('l) \\<and> 4<LENGTH('l)]\\<^sub>a idx1_assn\\<^sup>d \\<rightarrow> idx1_assn\"\n      unfolding hm_left_child_op_def\n      apply (rule hfref_bassn_resI)\n      subgoal by auto\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n    lemmas [sepref_fr_rules] = hm_left_child_impl.refine  \n\n    lemma rewr_kp1len: \"k+1 \\<le> n \\<longleftrightarrow> k<(n::nat)\" by auto\n    \n    sepref_definition hm_has_next_child_impl is \"uncurry (RETURN oo hm_has_next_child_op)\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx1_assn\\<^sup>d \\<rightarrow>\\<^sub>a bool1_assn\"\n      unfolding hm_has_next_child_op_def\n      apply (rewrite rewr_kp1len)\n      by sepref\n    lemmas [sepref_fr_rules] = hm_has_next_child_impl.refine    \n\n    sepref_definition hm_next_child_impl is \"RETURN o hm_next_child_op\" :: \"[\\<lambda>i. i<N \\<and> N<max_snat LENGTH('l) \\<and> 4<LENGTH('l)]\\<^sub>a idx1_assn\\<^sup>d \\<rightarrow> idx1_assn\"\n      unfolding hm_next_child_op_def\n      apply (rule hfref_bassn_resI)\n      subgoal by auto\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n    lemmas [sepref_fr_rules] = hm_next_child_impl.refine  \n    \n    \n    lemma sink_sepref_aux2: \"\\<lbrakk>hm_has_child_op (ag, bq) a2'; rdomp hm2_assn (ag, bq)\\<rbrakk>\n       \\<Longrightarrow> 2 * a2' \\<le> N\"   \n      unfolding hm_has_child_op_def hm2_assn_def hm_length_def \n      by sepref_bounds\n       \n    lemma sink_sepref_aux3: \"\\<lbrakk>hm_has_next_child_op (ag, bq) i; rdomp hm2_assn (ag, bq)\\<rbrakk> \\<Longrightarrow> i<N\" \n      unfolding hm_has_next_child_op_def hm2_assn_def hm_length_def \n      by sepref_bounds\n       \n    sepref_register hm_sink_op\n    sepref_definition hm_sink_impl is \"uncurry (PR_CONST hm_sink_op)\" :: \"hm2_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>k \\<rightarrow>\\<^sub>a hm2_assn\"\n      unfolding hm_sink_op_def PR_CONST_def\n      supply [simp] = hm_length_def\n      supply [simp] = sink_sepref_aux2 sink_sepref_aux3\n      supply X[sepref_frame_match_rules] = workaround_invalid_recombine_pure3[where B=\"snatb_assn _\", simplified]\n      supply [simp,dest] = hm2_assn_rdomp_boundsI\n      by sepref\n    lemmas [sepref_fr_rules] = hm_sink_impl.refine\n      \n    sepref_register hm_repair_op  \n    sepref_definition hm_repair_impl is \"uncurry (PR_CONST hm_repair_op)\" :: \"hm2_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>k \\<rightarrow>\\<^sub>a hm2_assn\"\n      unfolding hm_repair_op_def PR_CONST_def\n      by sepref\n    lemmas [sepref_fr_rules] = hm_repair_impl.refine\n      \n    sepref_definition hm_is_empty_impl is \"hm_is_empty_op\" :: \"hm2_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n      unfolding hm_is_empty_op_def\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n    \n    (* Cannot do lookup, unless we have option type! \n      \\<rightarrow> Do contains_key and the_lookup instead!\n    sepref_definition hm_lookup_impl is \"uncurry hm_lookup\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx_assn\\<^sup>k \\<rightarrow>\\<^sub>a elem_assn\"\n    *)  \n      \n    sepref_register hm_contains_key_op\n    sepref_definition hm_contains_key_impl is \"uncurry (PR_CONST hm_contains_key_op)\" :: \"idx_assn\\<^sup>k *\\<^sub>a hm2_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n      apply (rule hfref_with_rdomI)\n      unfolding hm_contains_key_op_def hm2_assn_def PR_CONST_def\n      by sepref\n    lemmas [sepref_fr_rules] = hm_contains_key_impl.refine  \n      \n    lemma hm_index_impl_aux1: \"\\<lbrakk>b \\<in> set a1'; rdomp (ial_assn N) a1'; N<max_snat LENGTH('l)\\<rbrakk>\n       \\<Longrightarrow> Suc (index a1' b) < max_snat LENGTH('l)\"  \n      apply sepref_bounds\n      by (meson index_less less_trans_Suc)\n      \n    sepref_definition hm_index_impl is \"uncurry hm_index_op\" :: \"hm2_assn\\<^sup>k*\\<^sub>aidx_assn\\<^sup>d\\<rightarrow>\\<^sub>aidx1_assn\"\n      unfolding hm_index_op_def hm2_assn_def\n      apply (rule hfref_bassn_resI)\n      subgoal \n        apply (clarsimp simp: uncurry_def) \n        apply refine_vcg \n        apply sepref_bounds\n        by (auto simp: heapmap_\\<alpha>_def restrict_map_eq)\n      supply [simp] = heapmap_\\<alpha>_def restrict_map_eq hm_index_impl_aux1\n      apply (rule hfref_with_rdomI)\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n    lemmas [sepref_fr_rules] = hm_index_impl.refine  \n      \n    term hm_update_op\n    sepref_definition hm_update_impl is \"uncurry2 hm_update_op\" :: \"hm2_assn\\<^sup>d*\\<^sub>aidx1_assn\\<^sup>d*\\<^sub>aelem_assn\\<^sup>k \\<rightarrow>\\<^sub>a hm2_assn\"\n      unfolding hm_update_op_def hm2_assn_def\n      apply (rule hfref_with_rdomI)\n      supply [simp] = hm_valid_def\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n    lemmas [sepref_fr_rules] = hm_update_impl.refine\n    \n    sepref_register hm_decrease_key_op\n    sepref_definition hm_decrease_key_impl is \"uncurry2 (PR_CONST hm_decrease_key_op)\" :: \"idx_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>k *\\<^sub>a hm2_assn\\<^sup>d \\<rightarrow>\\<^sub>a hm2_assn \"\n      unfolding hm_decrease_key_op_def PR_CONST_def\n      by sepref\n    lemmas [sepref_fr_rules] = hm_decrease_key_impl.refine\n          \n    sepref_register hm_increase_key_op\n    sepref_definition hm_increase_key_impl is \"uncurry2 (PR_CONST hm_increase_key_op)\" :: \"idx_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>k *\\<^sub>a hm2_assn\\<^sup>d \\<rightarrow>\\<^sub>a hm2_assn \"\n      unfolding hm_increase_key_op_def PR_CONST_def\n      by sepref\n    lemmas [sepref_fr_rules] = hm_increase_key_impl.refine\n\n    sepref_register hm_change_key_op\n    sepref_definition hm_change_key_impl is \"uncurry2 (PR_CONST hm_change_key_op)\" :: \"idx_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>k *\\<^sub>a hm2_assn\\<^sup>d \\<rightarrow>\\<^sub>a hm2_assn \"\n      unfolding hm_change_key_op_def PR_CONST_def\n      by sepref\n    lemmas [sepref_fr_rules] = hm_change_key_impl.refine\n        \n    sepref_register hm_set_op\n    sepref_definition hm_set_impl is \"uncurry2 (PR_CONST hm_set_op)\" :: \"idx_assn\\<^sup>k*\\<^sub>aelem_assn\\<^sup>k*\\<^sub>ahm2_assn\\<^sup>d \\<rightarrow>\\<^sub>a hm2_assn\"\n      unfolding hm_set_op_def PR_CONST_def\n      by sepref\n    lemmas [sepref_fr_rules] = hm_set_impl.refine\n          \n    sepref_register hm_butlast_op  \n    sepref_definition hm_butlast_impl is \"hm_butlast_op\" :: \"hm2_assn\\<^sup>d \\<rightarrow>\\<^sub>a hm2_assn\"\n      unfolding hm_butlast_op_def hm2_assn_def\n      apply (rule hfref_with_rdomI)\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n    lemmas [sepref_fr_rules] = hm_butlast_impl.refine      \n      \n    lemma hm_pop_min_impl_aux1: \n      \"\\<lbrakk>hm_valid (pq, m) (Suc 0); rdomp hm2_assn (pq, m)\\<rbrakk> \\<Longrightarrow> 0<N\"\n      unfolding hm2_assn_def hm_valid_def hm_length_def\n      by (cases pq; sepref_bounds)\n      \n    sepref_register hm_pop_min_op\n    sepref_definition hm_pop_min_impl is \"PR_CONST hm_pop_min_op\" :: \"hm2_assn\\<^sup>d \\<rightarrow>\\<^sub>a (idx_assn \\<times>\\<^sub>a elem_assn) \\<times>\\<^sub>a hm2_assn\"\n      unfolding hm_pop_min_op_def PR_CONST_def\n      supply [simp] = hm_pop_min_impl_aux1\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n    lemmas [sepref_fr_rules] = hm_pop_min_impl.refine      \n    \n    sepref_register hm_remove_op \n    sepref_definition hm_remove_impl is \"uncurry (PR_CONST hm_remove_op)\" :: \"idx_assn\\<^sup>k *\\<^sub>a hm2_assn\\<^sup>d \\<rightarrow>\\<^sub>a hm2_assn\"\n      unfolding hm_remove_op_def PR_CONST_def\n      (* TODO Hack/Workaround: Prevents b_assn to be degraded when comparing.\n        Deeper problem to fix: Do not degrade b_assn, even if operation is on basic assn!\n      *)\n      apply (rewrite at \"if \\<hole>\\<noteq>_ then _ else _\" fold_COPY)\n      by sepref\n    lemmas [sepref_fr_rules] = hm_remove_impl.refine\n    \n    sepref_register hm_peek_min_op\n    sepref_definition hm_peek_min_impl is \"hm_peek_min_op\" :: \"hm2_assn\\<^sup>k \\<rightarrow>\\<^sub>a idx_assn\\<times>\\<^sub>aelem_assn\"\n      unfolding hm_peek_min_op_def hm_kv_of_op_def\n      supply [simp] = hm_pop_min_impl_aux1\n      apply (annot_snat_const \"TYPE('l)\")\n      by sepref\n    lemmas [sepref_fr_rules] = hm_peek_min_impl.refine\n\n    end\n    \n    \n    sepref_decl_op hm_empty: \"\\<lambda>_::nat. op_map_empty\" :: \"nat_rel \\<rightarrow> \\<langle>K,V\\<rangle>map_rel\" .\n    \n    context fixes N :: nat begin\n      sepref_decl_op hm_empty_fixed: \"op_hm_empty N\" :: \"\\<langle>K,V\\<rangle>map_rel\" .\n    end\n    \n\n    lemma fold_custom_hm_empty:\n      \"Map.empty = op_hm_empty N\"\n      \"RETURN Map.empty = mop_hm_empty N\"\n      \"mop_map_empty = mop_hm_empty N\"\n      by auto\n    \n\n    lemma fold_custom_hm_empty_fixed:\n      \"Map.empty = op_hm_empty_fixed N\"\n      \"RETURN Map.empty = mop_hm_empty_fixed N\"\n      \"mop_map_empty = mop_hm_empty_fixed N\"\n      by auto\n      \n      \n    term hm_empty_op   \n    \n    definition \"hm_empty_op' N \\<equiv> do { m\\<leftarrow>mop_amt_empty N; RETURN (op_ial_empty N,m) }\"\n    \n    lemma hm_empty_op_N: \"hm_empty_op' N = hm_empty_op\"\n      by (auto simp: hm_empty_op_def hm_empty_op'_def)\n\n    lemma hm_empty_op'_aref: \"(hm_empty_op', mop_hm_empty) \\<in> nat_rel \\<rightarrow> \\<langle>heapmap_rel\\<rangle>nres_rel\"  \n      using hm_empty_op_aref by (auto simp: hm_empty_op_N)\n          \n      \n    sepref_definition hm_empty_impl is \"hm_empty_op'\" :: \"[\\<lambda>_. 4<LENGTH('l)]\\<^sub>a\\<^sub>d (snat_assn' TYPE('l))\\<^sup>k \\<rightarrow> (\\<lambda>N _. hm2_assn N)\"\n      unfolding hm_empty_op_def hm_empty_op'_def hm2_assn_def\n      apply (rule hfref_with_rdomI)\n      by sepref\n      \n    definition \"hm12_assn N \\<equiv> hrr_comp nat_rel (\\<lambda>N _. hm2_assn N) (\\<lambda>_. heapmap_rel) N ()\"\n    \n    lemma hm12_assn_fold': \"hr_comp (hm2_assn N) heapmap_rel = hm12_assn N\"\n      unfolding hm12_assn_def\n      by auto\n      \n    lemma hm12_assn_fold'': \"hrr_comp nat_rel (\\<lambda>N _. hm2_assn N) (\\<lambda>_. heapmap_rel) = (\\<lambda>N _. hm12_assn N)\"  \n      unfolding hm12_assn_def\n      by auto\n    \n    context \n      notes [fcomp_norm_unfold] = hm12_assn_def[symmetric] hm12_assn_fold' hm12_assn_fold''\n    begin\n    \n      lemmas hm_empty_ref12 = hm_empty_impl.refine[FCOMP hm_empty_op'_aref]\n      lemmas hm_insert_ref12 = hm_insert_impl.refine[unfolded PR_CONST_def, FCOMP hm_insert_op_aref]\n      lemmas hm_is_empty_ref12 = hm_is_empty_impl.refine[FCOMP hm_is_empty_op_aref]\n      lemmas hm_the_lookup_ref12 = hm_the_lookup_impl_refine[FCOMP hm_the_lookup_op_aref]\n      lemmas hm_contains_key_ref12 = hm_contains_key_impl.refine[unfolded PR_CONST_def, FCOMP hm_contains_key_op_aref]\n      lemmas hm_decrease_key_ref12 = hm_decrease_key_impl.refine[unfolded PR_CONST_def, FCOMP hm_decrease_key_op_aref]\n      lemmas hm_increase_key_ref12 = hm_increase_key_impl.refine[unfolded PR_CONST_def, FCOMP hm_increase_key_op_aref]\n      lemmas hm_change_key_ref12 = hm_change_key_impl.refine[unfolded PR_CONST_def, FCOMP hm_change_key_op_aref]\n      lemmas hm_set_ref12 = hm_set_impl.refine[unfolded PR_CONST_def, FCOMP hm_set_op_aref]\n      lemmas hm_pop_min_ref12 = hm_pop_min_impl.refine[unfolded PR_CONST_def, FCOMP hm_pop_min_op_aref]\n      lemmas hm_remove_ref12 = hm_remove_impl.refine[unfolded PR_CONST_def, FCOMP hm_remove_op_aref]\n      lemmas hm_peek_min_ref12 = hm_peek_min_impl.refine[FCOMP hm_peek_min_op_aref]\n            \n    end\n\n    definition \"hm_assn N \\<equiv> hr_comp (hm12_assn N) (\\<langle>nat_rel, Id\\<rangle>map_rel)\"\n    \n    lemma hm_assn_fold': \"hrr_comp nat_rel (\\<lambda>N _. hm12_assn N) (\\<lambda>x. \\<langle>nat_rel, Id\\<rangle>map_rel) = (\\<lambda>N _. hm_assn N)\"\n      by (auto simp: hm_assn_def fun_eq_iff)\n    \n    context\n      notes [fcomp_norm_unfold] = hm_assn_def[symmetric] hm_assn_fold'\n    begin\n      (*lemmas hm_empty_hnr = hm_empty_ref12[FCOMP mop_hm_empty_fref]*)\n      \n      sepref_decl_impl (ismop) hm_empty_ref12 \n        uses mop_hm_empty.fref[where K=Id and V=Id] fixes 'l by parametricity simp\n      \n      context \n        fixes N :: nat and Ni :: \"'l word\"\n        assumes Ni_ref: \"(Ni,N)\\<in>snat_rel' TYPE('l)\"\n      begin  \n        lemma hm_empty_fixed_ref: \n          \"(uncurry0 (hm_empty_impl Ni), uncurry0 (PR_CONST (mop_hm_empty_fixed N))) \\<in> [\\<lambda>_. 4 < LENGTH('l)]\\<^sub>a unit_assn\\<^sup>k \\<rightarrow> hm12_assn N\"\n          apply rule\n          apply (drule hfrefD[OF hm_empty_ref12, of N Ni])\n          using Ni_ref\n          by (simp add: pure_def)\n      \n        sepref_decl_impl (ismop,no_register) hm_empty_fixed: hm_empty_fixed_ref\n          uses mop_hm_empty_fixed.fref[where K=Id and V=Id] fixes 'l by parametricity simp\n          \n      end\n        \n      sepref_decl_impl (ismop) hm_insert_ref12 uses mop_map_update_new.fref[where K=Id and V=Id] .\n      sepref_decl_impl (ismop) hm_is_empty_ref12 uses mop_map_is_empty.fref[where K=Id and V=Id] .\n      sepref_decl_impl (ismop) hm_the_lookup_ref12 uses mop_map_the_lookup.fref[where K=Id and V=Id] .\n      sepref_decl_impl (ismop) hm_contains_key_ref12 uses mop_map_contains_key.fref[where K=Id and V=Id] .\n      sepref_decl_impl (ismop) hm_decrease_key_ref12 uses mop_pm_decrease_key.fref[where K=Id and V=Id] .\n      sepref_decl_impl (ismop) hm_increase_key_ref12 uses mop_pm_increase_key.fref[where K=Id and V=Id] .\n      sepref_decl_impl (ismop) hm_change_key_ref12 uses mop_map_update_ex.fref[where K=Id and V=Id] .\n      sepref_decl_impl (ismop) hm_set_ref12 uses mop_map_update.fref[where K=Id and V=Id] .\n      sepref_decl_impl (ismop) hm_pop_min_ref12 uses mop_pm_pop_min.fref[where K=Id and V=Id] .\n      sepref_decl_impl (ismop) hm_remove_ref12 uses mop_map_delete_ex.fref[where K=Id and V=Id] .\n      sepref_decl_impl (ismop) hm_peek_min_ref12 uses mop_pm_peek_min.fref[where K=Id and V=Id] .\n    end    \n        \n  end      \n\n    \n  global_interpretation \n    HM: hm_impl id \"snat_assn' TYPE('l)\" \"snat_assn' TYPE('l)\" return ll_icmp_sle ll_icmp_slt \"TYPE('l::len2)\" \n    defines \n           hm_empty_impl = HM.hm_empty_impl\n       and hm_append_impl = HM.hm_append_impl\n       and hm_insert_impl = HM.hm_insert_impl\n       and hm_length_impl = HM.hm_length_impl\n       and hm_swim_impl = HM.hm_swim_impl\n       and hm_sink_impl = HM.hm_sink_impl\n       and hm_is_empty_impl = HM.hm_is_empty_impl\n       and hm_the_lookup_impl = HM.hm_the_lookup_impl\n       and hm_contains_key_impl = HM.hm_contains_key_impl\n       and hm_decrease_key_impl = HM.hm_decrease_key_impl\n       and hm_increase_key_impl = HM.hm_increase_key_impl\n       and hm_change_key_impl = HM.hm_change_key_impl\n       and hm_parent_impl = HM.parent_impl\n       and hm_parent_valid_impl = HM.parent_valid_impl\n       and hm_next_child_impl = HM.hm_next_child_impl\n       and hm_has_next_child_impl = HM.hm_has_next_child_impl\n       and hm_left_child_impl = HM.hm_left_child_impl\n       and hm_has_child_impl = HM.hm_has_child_impl\n       and hm_repair_impl = HM.hm_repair_impl\n       and hm_set_impl = HM.hm_set_impl\n       and hm_pop_min_impl = HM.hm_pop_min_impl\n       and hm_remove_impl = HM.hm_remove_impl\n       and hm_peek_min_impl = HM.hm_peek_min_impl\n       \n       and hm_exch_impl = HM.hm_exch_impl\n       and hm_update_impl = HM.hm_update_impl\n       and hm_index_impl = HM.hm_index_impl\n       and hm_prio_of_impl = HM.hm_prio_of_impl\n       and hm_val_of_impl = HM.hm_val_of_impl\n       and hm_key_of_impl = HM.hm_key_of_impl\n       and hm_butlast_impl = HM.hm_butlast_impl\n    \n    \n    apply unfold_locales\n    apply (rule pure_pure)\n    apply sepref\n    apply sepref\n    apply sepref\n    done\n    \n  type_synonym 'l heapmap = \"'l ial \\<times> 'l word amt\"  \n\n  abbreviation hm_assn' where \"hm_assn' TYPE('l::len2) \\<equiv> HM.hm_assn :: _ \\<Rightarrow> _ \\<Rightarrow> 'l heapmap \\<Rightarrow> _\"\n  \n  \n  schematic_goal [sepref_frame_free_rules]: \"MK_FREE (HM.hm_assn N) (?fr)\"\n    unfolding HM.hm_assn_def HM.hm12_assn_def HM.hm2_assn_def\n    by sepref_dbg_side_keep\n    \n  term  HM.hm_assn\n    \n  lemma hm_assn_intf[intf_of_assn]: \n    \"intf_of_assn (HM.hm_assn N) (TYPE((nat,nat)i_map))\"\n    by simp\n    \n  lemmas [llvm_code,llvm_inline] = \n    HM.hm_append_impl_def\n    HM.hm_is_empty_impl_def\n    HM.hm_length_impl_def\n    HM.hm_the_lookup_impl_def\n    HM.hm_contains_key_impl_def\n    HM.parent_impl_def\n    HM.parent_valid_impl_def\n    HM.hm_prio_of_impl_def\n    HM.hm_val_of_impl_def\n    HM.hm_key_of_impl_def\n    HM.hm_next_child_impl_def\n    HM.hm_has_next_child_impl_def\n    HM.hm_left_child_impl_def\n    HM.hm_has_child_impl_def\n    HM.hm_butlast_impl_def\n\n    \n  lemmas [llvm_code] = \n    HM.hm_insert_impl_def\n    HM.hm_decrease_key_impl_def\n    HM.hm_increase_key_impl_def\n    HM.hm_change_key_impl_def\n    HM.hm_swim_impl_def\n    HM.hm_sink_impl_def\n    HM.hm_exch_impl_def\n    HM.hm_update_impl_def\n    HM.hm_index_impl_def\n    HM.hm_repair_impl_def\n    HM.hm_set_impl_def\n    HM.hm_pop_min_impl_def\n    HM.hm_remove_impl_def\n    HM.hm_peek_min_impl_def\n    HM.hm_empty_impl_def\n    \n\n  term HM.hm_prio_of_impl  \n  thm HM.hm_prio_of_impl_def\n    \n    \n  export_llvm\n    \"hm_empty_impl :: _ \\<Rightarrow> 32 heapmap llM\"\n    \"hm_append_impl:: _ \\<Rightarrow> 32 word \\<Rightarrow> _\"\n    \"hm_is_empty_impl :: 32 heapmap \\<Rightarrow> _\"\n    \"hm_the_lookup_impl :: _ \\<Rightarrow> 32 heapmap \\<Rightarrow> _\"\n    \"hm_contains_key_impl :: _ \\<Rightarrow> 32 heapmap \\<Rightarrow> _\"\n    \"hm_decrease_key_impl :: _ \\<Rightarrow> _ \\<Rightarrow> 32 heapmap \\<Rightarrow> _\"\n    \"hm_increase_key_impl :: _ \\<Rightarrow> _ \\<Rightarrow> 32 heapmap \\<Rightarrow> _\"\n    \"hm_change_key_impl :: _ \\<Rightarrow> _ \\<Rightarrow> 32 heapmap \\<Rightarrow> _\"\n    \"hm_set_impl :: _ \\<Rightarrow> _ \\<Rightarrow> 32 heapmap \\<Rightarrow> _\"\n    \"hm_pop_min_impl :: 32 heapmap \\<Rightarrow> _\"\n    \"hm_remove_impl :: _ \\<Rightarrow> 32 heapmap \\<Rightarrow> _\"\n    \"hm_peek_min_impl :: 32 heapmap \\<Rightarrow> _\"\n    file \"heapmap.ll\"\n    \n    \n\n  context \n    fixes N Ni\n    assumes NiREF: \"(Ni,N)\\<in>snat_rel' TYPE(32)\"\n    notes [sepref_fr_rules] = HM.hm_empty_fixed_hnr_mop[OF NiREF]\n    \n    (*notes [sepref_import_param] = NiREF\n    notes [[sepref_register_adhoc N]]\n    *)\n  begin\n  \n    definition \"snatb (x::nat) \\<equiv> x\"\n    lemma snatb_hnr: \"(return,RETURN o snatb) \\<in> [\\<lambda>x. x<N]\\<^sub>a snat_assn\\<^sup>k \\<rightarrow> snatb_assn N\"\n      unfolding snatb_def\n      by sepref_to_hoare vcg\n  \n    definition \"heapmap_test \\<equiv> do {\n      ASSERT (42<N);\n      m \\<leftarrow> HM.mop_hm_empty_fixed N;\n      m \\<leftarrow> mop_map_update (snatb 7)  (snatb 3) m;\n      m \\<leftarrow> mop_map_update (snatb 6)  (snatb 2) m;\n      m \\<leftarrow> mop_map_update (snatb 16) (snatb 1) m;\n      (k,v) \\<leftarrow> mop_pm_peek_min id m;\n      RETURN k\n    }\"\n  \n    sepref_definition heapmap_test_impl_aux is \"uncurry0 heapmap_test\" :: \"unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a snat_assn' TYPE(32)\"\n      unfolding heapmap_test_def\n      supply [sepref_fr_rules] = snatb_hnr\n      apply (annot_snat_const \"TYPE(32)\")\n      by sepref\n      \n  end\n\n  concrete_definition heapmap_test_impl is heapmap_test_impl_aux_def\n  declare heapmap_test_impl_def[llvm_code]\n  \n  export_llvm heapmap_test_impl\n  \n  lemma \"(heapmap_test_impl_aux, heapmap_test) \\<in> snat_assn\\<^sup>k \\<rightarrow>\\<^sub>a snat_assn\"\n    apply rule\n    apply (rule hn_refine_preI)\n    using heapmap_test_impl_aux.refine[to_hnr]\n    by (simp add: pure_def pred_lift_extract_simps sep_algebra_simps)\n    \nend    \n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/sepref/IICF/Impl/Heaps/IICF_Impl_Heapmap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.32100374121090364}}
{"text": "chapter \\<open>Reasoning Processes in IDE-CP - Part I\\<close>\n\ntext \\<open>The part includes small process that can be built without infrastructure of\n  IDE-CP, and declarations of other large process.\\<close>\n\ntheory IDE_CP_Reasoning1\n  imports Spec_Framework\nbegin\n\nsection \\<open>Annotations Guiding the Reasoning\\<close>\n\nsubsection \\<open>General Tags\\<close>\n\nconsts SOURCE :: mode\n       TARGET :: mode\n       ABNORMAL :: mode\n\nsubsection \\<open>Small Annotations\\<close>\n\nsubsubsection \\<open>Matches\\<close>\n\ndefinition Assertion_Matches :: \\<open>'a set \\<Rightarrow> 'a set \\<Rightarrow> 'a set\\<close> (infixl \"<matches>\" 18)\n  where \\<open>(S <matches> pattern) = S\\<close>\n\ntext \\<open>The annotation marking on a target \\<^term>\\<open>Y <matches> A\\<close> in a ToA or a view shift\n  restricts that the source have to first match pattern \\<open>A\\<close>.\\<close>\n\nlemma [\\<phi>reason 2000]:\n  \\<open>Matches X A \\<Longrightarrow> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y \\<a>\\<n>\\<d> P \\<Longrightarrow> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> (Y <matches> A) \\<a>\\<n>\\<d> P\\<close>\n  unfolding Assertion_Matches_def .\n\nlemma [\\<phi>reason 2000]:\n  \\<open>Matches X A \\<Longrightarrow> X \\<s>\\<h>\\<i>\\<f>\\<t>\\<s> Y \\<a>\\<n>\\<d> P \\<Longrightarrow> X \\<s>\\<h>\\<i>\\<f>\\<t>\\<s> (Y <matches> A) \\<a>\\<n>\\<d> P\\<close>\n  unfolding Assertion_Matches_def .\n\nsubsubsection \\<open>Useless Tag\\<close>\n\ndefinition USELESS :: \\<open>bool \\<Rightarrow> bool\\<close> where \\<open>USELESS x = x\\<close>\n\n\n\ntext \\<open>Simplification plays an important role in the programming in IDE_CP.\n  We use it to simplify the specification and evaluate the abstract state.\n\n  It is powerful as a transformation preserving all information,\n  but sometimes we expect the transformation is weaker and unequal by disposing\n  some useless information that we do not need.\n  For example, we want to rewrite \\<^term>\\<open>x \\<Ztypecolon> T\\<close> to \\<^term>\\<open>y \\<Ztypecolon> U\\<close> but the rewrite may be held\n  only with an additional proposition \\<^term>\\<open>Useless\\<close> which is useless for us,\n  \\[ \\<^prop>\\<open>x \\<Ztypecolon> T \\<equiv> y \\<Ztypecolon> U \\<s>\\<u>\\<b>\\<j> Useless\\<close> \\]\n  In cases like this, we can wrap the useless proposition by tag \\<open>\\<open>USELESS\\<close>\\<close>,\n  as \\<^prop>\\<open>x \\<Ztypecolon> T \\<equiv> y \\<Ztypecolon> U \\<s>\\<u>\\<b>\\<j> USELESS Useless\\<close>. The equality is still held because\n  \\<^prop>\\<open>USELESS P \\<equiv> P\\<close>, but IDE-CP is configured to drop the \\<^prop>\\<open>Useless\\<close>\n  so the work space will not be polluted by helpless propositions.\n\\<close>\n\nsubsubsection \\<open>Structural Morphism\\<close>\n\n(*TODO: explain*)\n\ndefinition SMorphism :: \\<open>'a \\<Rightarrow> 'a\\<close> (\"SMORPH _\" [17] 16)\n  where [iff]: \\<open>SMorphism X = X\\<close>\n\ndefinition Morphism :: \\<open>mode \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> bool\\<close>\n  where \\<open>Morphism _ R Q = (R \\<longrightarrow> Q)\\<close>\n\nconsts morphism_mode :: mode\n\nabbreviation Automatic_Morphism :: \\<open>bool \\<Rightarrow> bool \\<Rightarrow> bool\\<close> where \\<open>Automatic_Morphism \\<equiv> Morphism MODE_AUTO\\<close>\n\ntext \\<open>\nNote, the argument here means any \\<phi>-Type in the pre-condition, not necessary argument value.\n\n  If in a procedure or an implication rule or a view shift rule,\n  there is an argument where the procedure or the rule retains its structure,\n  this argument can be marked by \\<^term>\\<open>SMORPH arg\\<close>.\n\n  Recall when applying the procedure or the rule, the reasoner extracts \\<^term>\\<open>arg\\<close> from the\n    current \\<phi>-BI specification \\<^term>\\<open>X\\<close> of the current sequent.\n  This extraction may break \\<^term>\\<open>X\\<close> especially when the \\<^term>\\<open>arg\\<close> to be extracted is\n    scattered and embedded in multiple \\<phi>-Types in \\<^term>\\<open>X\\<close>.\n  For example, extract \\<^term>\\<open>(x1, y2) \\<Ztypecolon> (A1 * B2)\\<close> from\n    \\<^term>\\<open>((x1, x2) \\<Ztypecolon> (A1 * A2)) * ((y1, (y2, y3)) \\<Ztypecolon> (B1 * (B2 * B3)))\\<close>.\n  After the application, the following sequent will have broken structures because\n    the original structure of \\<^term>\\<open>X\\<close> is destroyed in order to extract \\<^term>\\<open>arg\\<close>.\n  However, the structure of the new \\<^term>\\<open>arg'\\<close> may not changes.\n  If so, by reversing the extraction, it is possible to recovery the original structure of \\<^term>\\<open>X\\<close>,\n    only with changed value of the corresponding part of \\<^term>\\<open>arg\\<close> in \\<^term>\\<open>X\\<close>.\n\n  The system supports multiple arguments to be marked by \\<^term>\\<open>SMORPH arg\\<close>.\n  And the system applies the reverse morphism in the correct order.\n  A requirement is,\n  those structural-retained argument should locate at the end of the procedure's or the rule's\n    argument list. Or else, because the reasoner does not record the extraction morphism of\n    arguments not marked by \\<^term>\\<open>SMORPH arg\\<close>, those arguments which occur after the\n    structural-retained arguments change the \\<phi>-BI specification by their extraction\n    causing the recorded morphism of previous \\<^term>\\<open>SMORPH arg\\<close> mismatch the current\n    \\<phi>-BI specification and so possibly not able to be applied any more.\n\\<close>\n\ndeclare [[\\<phi>reason_default_pattern\n      \\<open>?X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?Y \\<a>\\<n>\\<d> Automatic_Morphism _ _ \\<and> _\\<close> \\<Rightarrow>\n      \\<open>?X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?Y \\<a>\\<n>\\<d> Automatic_Morphism _ _ \\<and> _\\<close>    (110)\n  and \\<open>?X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> _ *  \\<blangle> ?Y \\<brangle> \\<a>\\<n>\\<d> Automatic_Morphism _ _ \\<and> _\\<close> \\<Rightarrow>\n      \\<open>?X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> _ *  \\<blangle> ?Y \\<brangle> \\<a>\\<n>\\<d> Automatic_Morphism _ _ \\<and> _\\<close>    (120)\n]]\n\n\nsection \\<open>Normalization of Assertions\\<close>\n\nconsts assertion_simps :: \\<open>mode \\<Rightarrow> mode\\<close>\n\nML \\<open>\nstructure Assertion_SS = Simpset (\n  val initial_ss = Simpset_Configure.Minimal_SS\n  val binding = \\<^binding>\\<open>assertion_simps\\<close>\n  val comment = \"Simplification rules normalizing an assertion. \\\n                       \\It is applied before ToSA process.\"\n)\n\nstructure Assertion_SS_Source = Simpset (\n  val initial_ss = Simpset_Configure.Empty_SS\n  val binding = \\<^binding>\\<open>assertion_simps_source\\<close>\n  val comment = \"Simp rules normalizing particularly source part of an assertion.\"\n)\n\nstructure Assertion_SS_Target = Simpset (\n  val initial_ss = Simpset_Configure.Empty_SS\n  val binding = \\<^binding>\\<open>assertion_simps_target\\<close>\n  val comment = \"Simp rules normalizing particularly target part of an assertion.\"\n)\n\nstructure Assertion_SS_Abnormal = Simpset (\n  val initial_ss = Simpset_Configure.Empty_SS\n  val binding = \\<^binding>\\<open>assertion_simps_abnormal\\<close>\n  val comment = \"Simp rules normalizing particularly the abnormal spec of a triple.\"\n)\n\\<close>\n\n\\<phi>reasoner_ML assertion_simp_source 1300\n  (\\<open>Simplify (assertion_simps SOURCE) ?X' ?X\\<close>)\n  = \\<open>PLPR_Simplifier.simplifier_by_ss' NONE (fn ctxt =>\n      Raw_Simplifier.merge_ss (Assertion_SS.get' ctxt, Assertion_SS_Source.get' ctxt))\\<close>\n\n\\<phi>reasoner_ML assertion_simp_target 1300\n  (\\<open>Simplify (assertion_simps TARGET) ?X' ?X\\<close>)\n  = \\<open>PLPR_Simplifier.simplifier_by_ss' NONE (fn ctxt =>\n      Raw_Simplifier.merge_ss (Assertion_SS.get' ctxt, Assertion_SS_Target.get' ctxt))\\<close>\n\n\\<phi>reasoner_ML assertion_simp_abnormal 1300\n  (\\<open>Simplify (assertion_simps ABNORMAL) ?X' ?X\\<close>)\n  = \\<open>PLPR_Simplifier.simplifier_by_ss' NONE (fn ctxt =>\n      Raw_Simplifier.merge_ss (Assertion_SS.get' ctxt, Assertion_SS_Abnormal.get' ctxt))\\<close>\n\n\\<phi>reasoner_ML assertion_simp 1200\n  (\\<open>Premise (assertion_simps _) _\\<close> | \\<open>Simplify (assertion_simps ?ANY) ?X' ?X\\<close>\n     )\n  = \\<open>PLPR_Simplifier.simplifier_by_ss' NONE Assertion_SS.get'\\<close>\n\nlemmas [assertion_simps] =\n  mult_zero_right[where 'a=\\<open>'a::sep_magma set\\<close>] mult_zero_left[where 'a=\\<open>'a::sep_magma set\\<close>]\n  mult_1_right[where 'a=\\<open>'a::sep_magma_1 set\\<close>]\n  mult_1_left[where 'a=\\<open>'a::sep_magma_1 set\\<close>]\n  add_0_right[where 'a=\\<open>'a::sep_magma set\\<close>] add_0_left[where 'a=\\<open>'a::sep_magma set\\<close>]\n  zero_fun[where 'a=\\<open>'a::sep_magma set\\<close>] zero_fun_def[symmetric, where 'b=\\<open>'a::sep_magma set\\<close>]\n  plus_fun[where 'a=\\<open>'a::sep_magma set\\<close>]\n  Subjection_Zero ExSet_simps distrib_right[where 'a=\\<open>'a::sep_semigroup set\\<close>]\n  mult.assoc[symmetric, where 'a=\\<open>'a::sep_semigroup set\\<close>]\n  \\<phi>V_simps\n\nlemmas [assertion_simps_source] = ExSet_times_left ExSet_times_right\n\nsection \\<open>Small Reasoning Process\\<close>\n\nsubsubsection \\<open>Semantic Expansion of \\<phi>-Types\\<close>\n\nconsts MODE_\\<phi>EXPN :: mode \\<comment> \\<open>relating to named_theorems \\<open>\\<phi>expn\\<close>\\<close>\n\nabbreviation \\<phi>expn_Premise (\"<\\<phi>expn> _\" [26] 26) where \\<open>\\<phi>expn_Premise \\<equiv> Premise MODE_\\<phi>EXPN\\<close>\n\n\\<phi>reasoner \\<phi>expn_Premise 10 (\\<open><\\<phi>expn> ?P\\<close>)\n  = (rule Premise_I; simp add: \\<phi>expns)\n\ntext \\<open>Antecedent \\<^prop>\\<open><\\<phi>expn> P\\<close> indicates the reasoner solving the premise \\<^prop>\\<open>P\\<close> using\n  simplification rules of \\<open>\\<phi>expns\\<close>.\\<close>\n\nsubsubsection \\<open>Name tag by type\\<close>\n\n(*TODO: elaborate this*)\n\ndatatype ('x, 'name) named (infix \"<named>\" 30) = tag 'x\n\nsyntax \"__named__\" :: \\<open>logic \\<Rightarrow> tuple_args \\<Rightarrow> logic\\<close> (infix \"<<named>>\" 25)\n\n\nML_file \\<open>library/syntax/name_by_type.ML\\<close>\n\ntext \\<open>It is a tool to annotate names on a term, e.g. \\<^term>\\<open>x <<named>> a, b\\<close>.\n  The name tag is useful in lambda abstraction (including quantification) because the\n  name of an abstraction variable is not preserved in many transformation especially\n  simplifications. The name can be useful in the deductive programming, e.g. universally\n  quantified variables in a sub-procedure like\n  \\[ \\<open>\\<forall>x y. proc f \\<lbrace> VAL x \\<Ztypecolon> T\\<heavy_comma> VAL y \\<Ztypecolon> U \\<longmapsto> any \\<rbrace> \\<Longrightarrow> any'\\<close> \\]\n  When starting to write the sub-procedure f by command \\<open>\\<medium_left_bracket>\\<close>, \\<phi>-system fixes variables x and y\n    with the name of x and y. The name of x and y then are significant for programming.\n  To preserve the name, we use \\<^typ>\\<open>'any <named> '\\<phi>name_x \\<times> '\\<phi>name_y\\<close>,\n    \\<^prop>\\<open>\\<forall>(x :: 'any <named> '\\<phi>name_x). sth\\<close>.\n  We use free type variable to annotate it because it is most stable. No transformation\n    changes the name of a free type variable.\n\n  This feature is mostly used in \\<^emph>\\<open>Expansion of Quantification\\<close> given in the immediate subsection.\n  Therefore we put this part in the subsection of reasoning jobs, though itself is not related to\n  any reasoning work.\n\\<close>\n\nlemma named_forall: \"All P \\<longleftrightarrow> (\\<forall>x. P (tag x))\" by (metis named.exhaust)\nlemma named_exists: \"Ex P \\<longleftrightarrow> (\\<exists>x. P (tag x))\" by (metis named.exhaust)\nlemma [simp]: \"tag (case x of tag x \\<Rightarrow> x) = x\" by (cases x) simp\nlemma named_All: \"(\\<And>x. PROP P x) \\<equiv> (\\<And>x. PROP P (tag x))\"\nproof fix x assume \"(\\<And>x. PROP P x)\" then show \"PROP P (tag x)\" .\nnext fix x :: \"'a <named> 'b\" assume \"(\\<And>x. PROP P (tag x))\" from \\<open>PROP P (tag (case x of tag x \\<Rightarrow> x))\\<close> show \"PROP P x\" by simp\nqed\n\nlemma named_ExSet: \"(ExSet T) = (\\<exists>*c. T (tag c) )\" by (auto simp add: named_exists \\<phi>expns)\n\n\nsubsubsection \\<open>Expansion of Quantification\\<close>\n\ndefinition \\<open>eoq__fst = fst\\<close>\ndefinition \\<open>eoq__snd = snd\\<close>\n\nnamed_theorems named_expansion \\<open>Rewriting rules expanding named quantification.\\<close>\n\nlemma eoq__fst[unfolded atomize_eq[symmetric], named_expansion]:\n        \\<open>eoq__fst (x,y) = x\\<close> unfolding eoq__fst_def by simp\nlemma eoq__snd[unfolded atomize_eq[symmetric], named_expansion]:\n        \\<open>eoq__snd (x,y) = y\\<close> unfolding eoq__snd_def by simp\n\nlemmas [unfolded atomize_eq[symmetric], named_expansion] =\n  Product_Type.prod.case named.case id_apply\n\nML_file  \"./library/tools/quant_expansion.ML\"\n\nhide_fact  eoq__fst eoq__snd\nhide_const eoq__fst eoq__snd\n\nsimproc_setup named_forall_expansion (\"All (P :: 'a <named> 'names \\<Rightarrow> bool)\") =\n  \\<open>K (QuantExpansion.simproc_of\n          (fn Type(\\<^type_name>\\<open>\\<phi>arg\\<close>, _) => QuantExpansion.forall_expansion_arg_encoding\n            | _ => QuantExpansion.forall_expansion))\\<close>\n\nsimproc_setup named_ex_expansion (\"Ex (P :: 'a <named> 'names \\<Rightarrow> bool)\") =\n  \\<open>K (QuantExpansion.simproc_of\n          (fn Type(\\<^type_name>\\<open>\\<phi>arg\\<close>, _) => QuantExpansion.exists_expansion_arg_encoding\n            | _ => QuantExpansion.exists_expansion))\\<close>\n\nsimproc_setup named_exSet_expansion (\"ExSet (P :: 'a <named> 'names \\<Rightarrow> 'b set)\") =\n  \\<open>K (QuantExpansion.simproc_of (K QuantExpansion.ExNu_expansion))\\<close>\n\nsimproc_setup named_metaAll_expansion (\"Pure.all (P :: 'a <named> 'names \\<Rightarrow> prop)\") =\n  \\<open>K (QuantExpansion.simproc_of\n          (fn Type(\\<^type_name>\\<open>\\<phi>arg\\<close>, _) => QuantExpansion.meta_All_expansion_arg_encoding\n            | _ => QuantExpansion.meta_All_expansion))\\<close>\n\n(*TODO: merge to procedure 1*)\nML_file \"./library/syntax/procedure3.ML\"\n\n\nsubsubsection \\<open>Rename \\<lambda>-Abstraction\\<close>\n\ndefinition rename_abstraction :: \\<open>'\\<phi>name_name itself \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> bool\\<close>\n  where \\<open>rename_abstraction name origin_abs named_abs \\<longleftrightarrow> (origin_abs = named_abs)\\<close>\n\nlemma rename_abstraction:\n  \\<open>rename_abstraction name X X\\<close>\n  unfolding rename_abstraction_def ..\n\n\\<phi>reasoner_ML rename_abstraction 1100 (\\<open>rename_abstraction TYPE(?'name) ?Y ?Y'\\<close>) =\n\\<open>fn (ctxt, sequent) =>\n  case Thm.major_prem_of sequent\n    of \\<^const>\\<open>Trueprop\\<close> $ (Const (\\<^const_name>\\<open>rename_abstraction\\<close>, _)\n                $ (Const (\\<^const_name>\\<open>Pure.type\\<close>, Type(\\<^type_name>\\<open>itself\\<close>, [name'])))\n                $ Abs(_,ty,body)\n                $ Var Y'') =>\n      let\n        val name = case Phi_Syntax.dest_name_tylabels name'\n                     of [x] => x\n                      | _ => raise TYPE (\"only one name is expected\", [name'], [])\n        val Y' = Abs(name, ty, body) |> Thm.cterm_of ctxt\n        val sequent = @{thm rename_abstraction} RS Thm.instantiate (TVars.empty, Vars.make [(Y'',Y')]) sequent\n      in\n        Seq.single (ctxt, sequent)\n      end\n     | term => raise THM (\"Bad shape of rename_abstraction antecedent\", 0, [sequent])\n\\<close>\n\n\nsubsubsection \\<open>\\<lambda>-Abstraction Tag\\<close>\n\ndefinition \"lambda_abstraction\" :: \" 'a \\<Rightarrow> 'b \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> bool \"\n  where \"lambda_abstraction x Y Y' \\<longleftrightarrow> Y' x = Y\"\n\nlemma lambda_abstraction: \"lambda_abstraction x (Y' x) Y'\"\n  unfolding lambda_abstraction_def ..\n\nlemma [\\<phi>reason 1200 for \\<open>lambda_abstraction (?x,?y) ?fx ?f\\<close>]:\n  \\<open> lambda_abstraction y fx f1\n\\<Longrightarrow> lambda_abstraction x f1 f2\n\\<Longrightarrow> lambda_abstraction (x,y) fx (case_prod f2)\\<close>\n  unfolding lambda_abstraction_def by simp\n\n\\<phi>reasoner_ML lambda_abstraction 1100 (\"lambda_abstraction ?x ?Y ?Y'\") = \\<open>fn (ctxt, sequent) =>\n  let\n    val (Vs, _, \\<^const>\\<open>Trueprop\\<close> $ (Const (\\<^const_name>\\<open>lambda_abstraction\\<close>, _) $ x $ Y $ _))\n      = Phi_Help.leading_antecedent (Thm.prop_of sequent)\n    val Y' = Abs(\"\", fastype_of x, abstract_over (x, Y))\n    val idx = Thm.maxidx_of sequent\n    val vars = map Var (List.tabulate (length Vs, (fn i => (\"v\", i+idx))) ~~ map snd Vs)\n    fun subst X = Term.subst_bounds (vars, X)\n    val rule = Drule.infer_instantiate ctxt\n                  (map (apsnd (Thm.cterm_of ctxt)) [((\"x\",0), subst x), ((\"Y'\",0),subst Y')])\n                  @{thm lambda_abstraction}\n  in\n    Seq.single (ctxt, rule RS sequent)\n  end\n\\<close>\n\nlemma [\\<phi>reason 1200 for \\<open>lambda_abstraction (tag ?x) ?fx ?f\\<close>]:\n  \\<open> lambda_abstraction x fx f\n\\<Longrightarrow> rename_abstraction TYPE('name) f f'\n\\<Longrightarrow> lambda_abstraction (tag x :: 'any <named> 'name) fx (case_named f')\\<close>\n  unfolding lambda_abstraction_def rename_abstraction_def by simp\n\n\nsubsubsection \\<open>Introduce Frame Variable\\<close>\n\nnamed_theorems frame_var_rewrs \\<open>Rewriting rules to normalize after inserting the frame variable\\<close>\n\ndeclare mult.assoc[symmetric, frame_var_rewrs]\n  Subjection_times[frame_var_rewrs]\n  ExSet_times_right[frame_var_rewrs]\n\nconsts frame_var_rewrs :: mode\n\n\\<phi>reasoner_ML Subty_Simplify 2000 (\\<open>Simplify frame_var_rewrs ?x ?y\\<close>)\n  = \\<open>PLPR_Simplifier.simplifier_only NONE (fn ctxt =>\n          Named_Theorems.get ctxt \\<^named_theorems>\\<open>frame_var_rewrs\\<close>)\\<close>\n\ndefinition \\<phi>IntroFrameVar :: \"'a::sep_magma_1 set \\<Rightarrow> 'a set \\<Rightarrow> 'a set \\<Rightarrow> 'a set \\<Rightarrow> 'a set \\<Rightarrow> bool\"\n  where \"\\<phi>IntroFrameVar R S' S T' T \\<longleftrightarrow> S' = (R * S) \\<and> T' = R * T \"\n\ndefinition \\<phi>IntroFrameVar' ::\n  \"assn \\<Rightarrow> assn \\<Rightarrow> assn \\<Rightarrow> ('ret \\<Rightarrow> assn) \\<Rightarrow> ('ret \\<Rightarrow> assn) \\<Rightarrow> ('ex \\<Rightarrow> assn) \\<Rightarrow> ('ex \\<Rightarrow> assn) \\<Rightarrow> bool\"\n  where \"\\<phi>IntroFrameVar' R S' S T' T E' E \\<longleftrightarrow> S' = (R * S) \\<and> T' = (\\<lambda>ret. R * T ret) \\<and> E' = (\\<lambda>ex. R * E ex) \"\n\ndefinition TAIL :: \\<open>assn \\<Rightarrow> assn\\<close> where \\<open>TAIL S = S\\<close>\n\ntext \\<open>Antecedent \\<^schematic_prop>\\<open>\\<phi>IntroFrameVar ?R ?S' S ?T' T\\<close> appends a frame variable\n  \\<^schematic_term>\\<open>?R\\<close> to the source MTF \\<^term>\\<open>S\\<close> if the items in \\<^term>\\<open>S\\<close> do not have an ending\n  frame variable already nor the ending item is not tagged by \\<open>TAIL\\<close>.\n  If so, the reasoner returns \\<open>?S' := ?R * S\\<close> for a schematic \\<open>?R\\<close>,\n  or else, the \\<open>S\\<close> is returned unchanged \\<open>?S' := ?S\\<close>.\n  \\<open>\\<phi>IntroFrameVar'\\<close> is similar.\n\n  Tag \\<open>TAIL\\<close> is meaningful only when it tags the last item of a \\<open>\\<^emph>\\<close>-sequence.\n  It has a meaning of `the remaining everything' like, the target (RHS) item tagged by this\n  means the item matches the whole remaining part of the source (LHS) part.\n  \\<open>TAIL\\<close> also means, the tagged item is at the end and has a sense of ending, so no further\n  padding is required (e.g. padding-of-void during ToSA reasoning).\n\\<close>\n\nlemma \\<phi>IntroFrameVar_No:\n  \"\\<phi>IntroFrameVar 1 S S T T\"\n  unfolding \\<phi>IntroFrameVar_def by simp\n\nlemma \\<phi>IntroFrameVar'_No:\n  \"\\<phi>IntroFrameVar' 1 S S T T E E\"\n  unfolding \\<phi>IntroFrameVar'_def by simp\n\nlemma \\<phi>IntroFrameVar_Yes:\n  \"\\<phi>IntroFrameVar R (R * \\<blangle> S \\<brangle>) S (R * T) T\"\n  unfolding \\<phi>IntroFrameVar_def FOCUS_TAG_def by blast\n\nlemma \\<phi>IntroFrameVar'_Yes:\n  \" \\<phi>IntroFrameVar' R (R * \\<blangle> S \\<brangle>) S (\\<lambda>ret. R * T ret) T (\\<lambda>ex. R * E ex) E\"\n  unfolding \\<phi>IntroFrameVar'_def FOCUS_TAG_def by blast\n\n(*TODO*)\n\\<phi>reasoner_ML \\<phi>IntroFrameVar 1000 (\"\\<phi>IntroFrameVar ?R ?S' ?S ?T' ?T\") =\n\\<open>fn (ctxt, sequent) =>\n  let\n    val (Const (\\<^const_name>\\<open>\\<phi>IntroFrameVar\\<close>, _) $ _ $ _ $ S $ _ $ _) =\n        Thm.major_prem_of sequent |> HOLogic.dest_Trueprop\n    val tail = hd (Phi_Syntax.strip_separations S)\n    fun suppressed (Var _) = true\n      | suppressed (\\<^const>\\<open>TAIL\\<close> $ _) = true\n      | suppressed _ = false\n  in\n    if suppressed tail (* andalso fastype_of tail = \\<^typ>\\<open>assn\\<close> *)\n    then Seq.single (ctxt, @{thm \\<phi>IntroFrameVar_No}  RS sequent)\n    else Seq.single (ctxt, @{thm \\<phi>IntroFrameVar_Yes} RS sequent)\n  end\\<close>\n\n\\<phi>reasoner_ML \\<phi>IntroFrameVar' 1000 (\"\\<phi>IntroFrameVar' ?R ?S' ?S ?T' ?T ?E' ?E\") =\n\\<open>fn (ctxt, sequent) =>\n  let\n    val (Const (\\<^const_name>\\<open>\\<phi>IntroFrameVar'\\<close>, _) $ _ $ _ $ S $ _ $ _ $ _ $ _) =\n        Thm.major_prem_of sequent |> HOLogic.dest_Trueprop\n    val tail = hd (Phi_Syntax.strip_separations S)\n    fun suppressed (Var _) = true\n      | suppressed (\\<^const>\\<open>TAIL\\<close> $ _) = true\n      | suppressed _ = false\n  in\n    if suppressed tail andalso fastype_of tail = \\<^typ>\\<open>assn\\<close>\n    then Seq.single (ctxt, @{thm \\<phi>IntroFrameVar'_No}  RS sequent)\n    else Seq.single (ctxt, @{thm \\<phi>IntroFrameVar'_Yes} RS sequent)\n  end\\<close>\n\n\nsubsection \\<open>Embedded Reasoning\\<close>\n\ndefinition Embedded_Reasoning :: \\<open>bool \\<Rightarrow> bool\\<close> where \\<open>Embedded_Reasoning X \\<longleftrightarrow> X\\<close>\n\ntext \\<open>Annotate a boolean assertion in a proof obligation is actually an embedded reasoning\nantecedent.\\<close>\n\nsubsubsection \\<open>Implementation\\<close>\n\ndefinition Pass_Embedded_Reasoning :: \\<open>bool \\<Rightarrow> bool\\<close>\n  where \\<open>Pass_Embedded_Reasoning X \\<longleftrightarrow> X\\<close>\n\ndefinition Pass_Embedded_Reasoning' :: \\<open>bool \\<Rightarrow> bool \\<Rightarrow> bool\\<close>\n  where \\<open>Pass_Embedded_Reasoning' IN OUT \\<longleftrightarrow> (OUT \\<longleftrightarrow> IN)\\<close>\n\ndeclare [[\\<phi>reason_default_pattern\n      \\<open>Pass_Embedded_Reasoning' ?X _\\<close> \\<Rightarrow> \\<open>Pass_Embedded_Reasoning' ?X _\\<close> (100)\n]]\n\nlemma [\\<phi>reason 1000]:\n  \\<open> Pass_Embedded_Reasoning' X Y\n\\<Longrightarrow> \\<p>\\<r>\\<e>\\<m>\\<i>\\<s>\\<e> Y\n\\<Longrightarrow> Pass_Embedded_Reasoning X\\<close>\n  unfolding Pass_Embedded_Reasoning_def Pass_Embedded_Reasoning'_def Premise_def\n  by blast\n\nlemma [\\<phi>reason 1110]:\n  \\<open> R\n\\<Longrightarrow> Pass_Embedded_Reasoning' X Y\n\\<Longrightarrow> Pass_Embedded_Reasoning' (Embedded_Reasoning R \\<and> X) Y\\<close>\n  unfolding Pass_Embedded_Reasoning'_def Embedded_Reasoning_def by blast\n\nlemma [\\<phi>reason 1100]:\n  \\<open> Pass_Embedded_Reasoning' X Y\n\\<Longrightarrow> Pass_Embedded_Reasoning' (P \\<and> X) (P \\<and> Y)\\<close>\n  unfolding Pass_Embedded_Reasoning'_def by blast\n\nlemma [\\<phi>reason 1010]:\n  \\<open> R\n\\<Longrightarrow> Pass_Embedded_Reasoning' (Embedded_Reasoning R) True \\<close>\n  unfolding Pass_Embedded_Reasoning'_def Embedded_Reasoning_def by blast\n\nlemma [\\<phi>reason 1000]:\n  \\<open> Pass_Embedded_Reasoning' P P \\<close>\n  unfolding Pass_Embedded_Reasoning'_def by blast\n\n\nsubsection \\<open>Semantic Type of Multiple Values\\<close>\n\nlemma [\\<phi>reason 1200 for \\<open>\\<phi>_Have_Types (\\<lambda>vs. ?R vs\\<heavy_comma> ?x \\<Ztypecolon> \\<v>\\<a>\\<l>[\\<phi>V_fst vs] ?T) _\\<close>]:\n  \\<open> \\<phi>SemType (x \\<Ztypecolon> T) TY\n\\<Longrightarrow> \\<phi>_Have_Types (\\<lambda>vs. R vs) TYs\n\\<Longrightarrow> \\<phi>_Have_Types (\\<lambda>vs. R (\\<phi>V_snd vs)\\<heavy_comma> x \\<Ztypecolon> \\<v>\\<a>\\<l>[\\<phi>V_fst vs] T) (TY#TYs)\\<close>\n  unfolding \\<phi>_Have_Types_def Well_Typed_Vals_def \\<phi>arg_forall \\<phi>SemType_def subset_iff\n  by (clarsimp simp add: to_vals_prod_def to_vals_VAL_def Val_inhabited_rewr)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<phi>SemType (x \\<Ztypecolon> T) TY\n\\<Longrightarrow> \\<phi>_Have_Types (\\<lambda>vs. R\\<heavy_comma> x \\<Ztypecolon> \\<v>\\<a>\\<l>[vs] T) [TY]\\<close>\n  unfolding \\<phi>_Have_Types_def Well_Typed_Vals_def \\<phi>arg_forall \\<phi>SemType_def subset_iff\n  by (clarsimp simp add: to_vals_prod_def to_vals_VAL_def Val_inhabited_rewr)\n\nlemma [\\<phi>reason 1200]:\n  \\<open> \\<phi>_Have_Types R TYs\n\\<Longrightarrow> \\<phi>_Have_Types (\\<lambda>vs. R vs\\<heavy_comma> S) TYs\\<close>\n  unfolding \\<phi>_Have_Types_def Well_Typed_Vals_def by clarsimp\n\nlemma [\\<phi>reason 2000]:\n  \\<open> \\<phi>_Have_Types (\\<lambda>_::unit \\<phi>arg. Void) []\\<close>\n  unfolding \\<phi>_Have_Types_def Well_Typed_Vals_def to_vals_unit_def by clarsimp\n\nlemma [\\<phi>reason 1020 except \\<open>\\<phi>_Have_Types (\\<lambda>vs. ?A vs\\<heavy_comma> ?B vs) _\\<close>]:\n  \\<open> \\<phi>_Have_Types (\\<lambda>vs. Void\\<heavy_comma> R vs) TYs\n\\<Longrightarrow> \\<phi>_Have_Types R TYs\\<close>\n  unfolding \\<phi>_Have_Types_def Well_Typed_Vals_def by clarsimp\n\nlemma [\\<phi>reason 1000]:\n  \\<open> FAIL TEXT(\\<open>Fail to infer the semantic type of\\<close> R)\n\\<Longrightarrow> \\<phi>_Have_Types R TYs\\<close>\n  unfolding \\<phi>_Have_Types_def Well_Typed_Vals_def by clarsimp\n\n\n\n\nsection \\<open>Declaration of Large Processes\\<close>\n\nsubsection \\<open>Transformation of State Abstraction (ToSA)\\<close>\n\ntext \\<open>\n  Supporting implication \\<open>X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y @action ToSA\\<close> only,\n  ToSA is a reasoning process of Transformation of Abstraction (ToA) for\n  assertions of (fictional) computation state.\n\\<close>\n\nconsts ToSA' :: \\<open>bool \\<comment> \\<open>whether to reason deeper transformation for each desired \\<phi>-type\n                          by invoking more time-consuming reasoning process,\n                          or just apply unification to match the desired.\\<close>\n              \\<Rightarrow> mode\\<close>\n\ntext \\<open>The boolean flag indicates whether to reason the transformation of \\<phi>-types in depth.\nFor \\<open>X\\<^sub>1 * \\<cdots> * X\\<^sub>n \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Y\\<^sub>1 * \\<cdots> * Y\\<^sub>m @action ToSA' ?flag\\<close>,\n\n\\<^item> If the flag is turned on, for every desired \\<phi>-Type \\<^term>\\<open>Y\\<^sub>i\\<close>, the reasoner\n  infers in depth whether some source \\<phi>-Type \\<^term>\\<open>X\\<^sub>j\\<close> can be transformed into \\<^term>\\<open>Y\\<^sub>i\\<close>,\n  by invoking any configured reasoning rules bound on the type of \\<^term>\\<open>Y\\<^sub>i\\<close>.\n\n\\<^item> If the flag is turned off, such in-depth inference is not applied, so the\n  reasoning succeeds only if for every desired \\<phi>-Type \\<^term>\\<open>Y\\<^sub>i\\<close> there is another\n  \\<^term>\\<open>X\\<^sub>j\\<close> that unifies \\<^term>\\<open>Y\\<^sub>i\\<close>.\n\nThe the flag is turned off, obviously the performance can be improved a lot though\nthe reasoning is weaker.\n\\<close>\n\nabbreviation \\<open>ToSA \\<equiv> ToSA' True\\<close>\n\nlemma [\\<phi>reason 3000 for \\<open>?X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?X' \\<a>\\<n>\\<d> ?P @action ToSA' ?mode\\<close>]:\n  \\<open>X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X @action ToSA' mode\\<close>\n  unfolding Action_Tag_def using implies_refl .\n\n\n\nsubsection \\<open>Removing Values\\<close>\n\ndefinition \\<open>Remove_Values (Input::assn) (Output::assn) \\<longleftrightarrow> (Input \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Output)\\<close>\n\ntext \\<open>The process \\<^prop>\\<open>Remove_Values Input Output\\<close> removes value assertions \\<open>x \\<Ztypecolon> \\<v>\\<a>\\<l> T\\<close>\n  from the assertion \\<open>Input\\<close>. Bounded values such the return value of a procedure are not removed.\\<close>\n\n\nsubsection \\<open>Collects all Values in an Assertion / from the State Sequent\\<close>\n\nconsts collect_clean_value :: \\<open>bool \\<Rightarrow> action\\<close>\n\nlemma apply_collect_clean_value:\n  \\<open> S \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> S' \\<a>\\<n>\\<d> V @action collect_clean_value WHETHER_CLEAN\n\\<Longrightarrow> S \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> S' \\<a>\\<n>\\<d> V\\<close>\n  unfolding Action_Tag_def .\n\nlemma [\\<phi>reason 1200 for \\<open>?S \\<heavy_comma> ?x \\<Ztypecolon> \\<v>\\<a>\\<l>[?v] ?T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?S' \\<a>\\<n>\\<d> ?V @action collect_clean_value True\\<close>]:\n  \\<open> S \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> S' \\<a>\\<n>\\<d> V @action collect_clean_value True\n\\<Longrightarrow> S \\<heavy_comma> x \\<Ztypecolon> \\<v>\\<a>\\<l>[v] T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> S' \\<a>\\<n>\\<d> \\<phi>arg.dest v \\<in> (x \\<Ztypecolon> T) \\<and> V @action collect_clean_value True\\<close>\n  unfolding Action_Tag_def Imply_def by (clarsimp simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1200 for \\<open>?S \\<heavy_comma> ?x \\<Ztypecolon> \\<v>\\<a>\\<l>[?v] ?T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?S' \\<a>\\<n>\\<d> ?V @action collect_clean_value False\\<close>]:\n  \\<open> S \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> S' \\<a>\\<n>\\<d> V @action collect_clean_value False\n\\<Longrightarrow> S \\<heavy_comma> x \\<Ztypecolon> \\<v>\\<a>\\<l>[v] T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> S' \\<heavy_comma> x \\<Ztypecolon> \\<v>\\<a>\\<l>[v] T \\<a>\\<n>\\<d> \\<phi>arg.dest v \\<in> (x \\<Ztypecolon> T) \\<and> V\n    @action collect_clean_value False\\<close>\n  unfolding Action_Tag_def Imply_def by (clarsimp simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1100 for \\<open>?S\\<heavy_comma> ?X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?S' \\<a>\\<n>\\<d> ?V @action collect_clean_value ?CLEAN\\<close>]:\n  \\<open> S \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> S' \\<a>\\<n>\\<d> V @action collect_clean_value CLEAN\n\\<Longrightarrow> S\\<heavy_comma> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> S'\\<heavy_comma> X \\<a>\\<n>\\<d> V @action collect_clean_value CLEAN\\<close>\n  unfolding Action_Tag_def using implies_right_prod .\n\nlemma [\\<phi>reason 1050 for \\<open>?x \\<Ztypecolon> \\<v>\\<a>\\<l>[?v] ?T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?S' \\<a>\\<n>\\<d> ?V @action collect_clean_value True\\<close>]:\n  \\<open> x \\<Ztypecolon> \\<v>\\<a>\\<l>[v] T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> Void \\<a>\\<n>\\<d> \\<phi>arg.dest v \\<in> (x \\<Ztypecolon> T) \\<and> True\n    @action collect_clean_value True\\<close>\n  unfolding Action_Tag_def Imply_def by (clarsimp simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1050 for \\<open>?x \\<Ztypecolon> \\<v>\\<a>\\<l>[?v] ?T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?S' \\<a>\\<n>\\<d> ?V @action collect_clean_value False\\<close>]:\n  \\<open> x \\<Ztypecolon> \\<v>\\<a>\\<l>[v] T \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> x \\<Ztypecolon> \\<v>\\<a>\\<l>[v] T \\<a>\\<n>\\<d> \\<phi>arg.dest v \\<in> (x \\<Ztypecolon> T) \\<and> True\n    @action collect_clean_value False\\<close>\n  unfolding Action_Tag_def Imply_def by (clarsimp simp add: \\<phi>expns)\n\nlemma [\\<phi>reason 1000 for \\<open>?S \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> ?S' \\<a>\\<n>\\<d> ?V @action collect_clean_value ?clean\\<close>]:\n  \\<open> X \\<i>\\<m>\\<p>\\<l>\\<i>\\<e>\\<s> X \\<a>\\<n>\\<d> True @action collect_clean_value clean\\<close>\n  unfolding Action_Tag_def using implies_refl .\n\nend\n", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_System/IDE_CP_Reasoning1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.3209524351177543}}
{"text": "theory tp89\nimports Main \"~~/src/HOL/Library/Code_Target_Nat\" \nbegin\n\n\n\n\n\n(*\ntransid\nc identifie un client\nm identifie un marchand\ni numéro de transaction entre c et m\n\nam transaction montant retenu pour la transaction\n\nClient \\<longrightarrow> Marchand\nPay (c,m,i) am \\<longrightarrow> c accepte de payer le montant am à m pour la transaction id\n\nMarchand \\<longrightarrow> Client\nAck (c,m,i) am \\<longrightarrow> m demande un montant am au client c pour la transaction id\nCancel (c,m,i) \\<longrightarrow> m annule toutes les transactions pour transaction id \n\nle marchand doit diminuer am\nle client doit augmenter am\n*)\ntype_synonym transid= \"nat*nat*nat\"\n\ndatatype message= \n  Pay transid nat  \n| Ack transid nat\n| Cancel transid\n\ndatatype etatTrans=\n  Encours\n| Ok\n| Abort\n\ndatatype SomeTrans =\n  None\n| Integer nat\n\ndatatype SomeEtat =\n  Nothing\n| Etat  etatTrans\ntype_synonym transaction= \"transid * nat\"\n\n\n(* transid * am marchand * am client * etat  *)\n\ntype_synonym ligneBdd = \"(transid * SomeTrans *SomeTrans * etatTrans )\"\n\ntype_synonym transBdd =\"ligneBdd list\"\n\n(* select dans la bdd, l'etat de la transi*)\nfun selectEtat ::\"transid \\<Rightarrow> transBdd \\<Rightarrow> SomeEtat \"\nwhere\n \"selectEtat _ [] = Nothing\"\n|\"selectEtat id1 ((id2::transid,sm2,sc2,etat2)#xs) =( if(id1=id2) then (Etat etat2)  else selectEtat id1 xs )\"\n\n(* select dans la bdd de la proposition du marchand*)\nfun selectMarch ::\"transid \\<Rightarrow> transBdd \\<Rightarrow> SomeTrans \"\nwhere\n \"selectMarch _ [] = None\"\n|\"selectMarch id1 ((id2::transid,sm2,sc2,etat2)#xs) =( if(id1=id2) then sm2  else selectMarch id1 xs )\"\n\n(* select dans la bdd de la proposition du client*)\nfun selectClient ::\"transid \\<Rightarrow> transBdd \\<Rightarrow> SomeTrans\"\nwhere\n \"selectClient _ [] = None\"\n|\"selectClient id1 ((id2::transid,sm2,sc2,etat2)#xs) =( if(id1=id2) then sc2  else selectClient id1 xs )\"\n\n\n\n\n\n\n\nfun updateLignePay :: \"  nat \\<Rightarrow> ligneBdd \\<Rightarrow>  ligneBdd\"\nwhere\n \"updateLignePay _ ((x2::transid),m2,c2,Abort) =  ((x2::transid),m2,c2,Abort)\"\n|\"updateLignePay v1 ((x2::transid),Integer m2,None,Encours) = (if (v1\\<ge>m2) then  ((x2::transid),Integer m2, Integer v1,Ok) else  ((x2::transid),Integer m2,Integer v1,Encours) )\"\n|\"updateLignePay v1 ((x2::transid),Integer m2,Integer v2,Encours) = (if (v1>v2) then  (if(v1\\<ge>m2) then  ((x2::transid),Integer m2,Integer v1,Ok)  else  ((x2::transid),Integer m2,Integer v1,Encours)) else ( ((x2::transid),Integer m2,Integer v2,Encours)))\"\n|\"updateLignePay _ ((x2::transid),m2,c2,Ok) = ((x2::transid),m2,c2,Ok)\"\n|\"updateLignePay v1 (v,None, None, Encours) =  (v,None, Integer v1, Encours)\"\n|\"updateLignePay v1 (v,None, Integer v2, Encours) = (if (v1>v2) then (v,None, Integer v1, Encours)  else (v,None, Integer v2, Encours)) \"\n\nfun updatePay:: \"(transid * nat) \\<Rightarrow> transBdd \\<Rightarrow>  transBdd\"\nwhere\n \"updatePay ((x1::transid),c1) [] = [((x1::transid),None,Integer c1,Encours)] \"\n|\"updatePay ((x1::transid),c1) (((x2::transid),m2,c2,e2)#xs)= (if (x2=x1) then (updateLignePay  (c1) ((x2::transid),m2,c2,e2)  )#xs  else (((x2::transid),m2,c2,e2)#(updatePay ((x1::transid),c1) xs ))  )\"\n\n\nfun updateLigneAck :: \"nat \\<Rightarrow> ligneBdd \\<Rightarrow>  ligneBdd\"\nwhere\n \"updateLigneAck _ ((x2::transid),m2,c2,Abort) =  ((x2::transid),m2,c2,Abort)\"\n|\"updateLigneAck m1 ((x2::transid),Integer m2,None,Encours) = (if (m1\\<le>m2) then  ((x2::transid),Integer m1, None,Encours) else  ((x2::transid),Integer m2,None,Encours) )\"\n|\"updateLigneAck m1 ((x2::transid),Integer m2,Integer v2,Encours) = (if (m1\\<le>m2) then  (if(m1\\<le>v2) then  ((x2::transid),Integer m1,Integer v2,Ok)  else  ((x2::transid),Integer m1,Integer v2,Encours)) else ( ((x2::transid),Integer m2,Integer v2,Encours)))\"\n|\"updateLigneAck _ ((x2::transid),m2,c2,Ok) = ((x2::transid),m2,c2,Ok)\"\n|\"updateLigneAck m1 (v,None, None, Encours) =  (v,Integer m1,None, Encours)\"\n|\"updateLigneAck m1 (v,None, Integer v2, Encours) = (if (m1\\<le>v2) then (v,Integer m1, Integer v2, Ok)  else (v, Integer m1,Integer v2, Encours)) \"\n\nfun updateAck:: \"(transid * nat) \\<Rightarrow> transBdd \\<Rightarrow>  transBdd\"\nwhere\n \"updateAck ((x1::transid),c1) [] = [((x1::transid),Integer c1,None,Encours)] \"\n|\"updateAck ((x1::transid),c1) (((x2::transid),m2,c2,e2)#xs)= (if (x2=x1) then (updateLigneAck  (c1) ((x2::transid),m2,c2,e2)  )#xs  else (((x2::transid),m2,c2,e2)#(updateAck ((x1::transid),c1) xs ))  )\"\n\nfun updateLigneCancel :: \" ligneBdd \\<Rightarrow>  ligneBdd\"\nwhere\n \"updateLigneCancel  ((x2::transid),m2,c2,e2) =  ((x2::transid),m2,c2,Abort)\"\n\nfun updateCancel:: \"transid \\<Rightarrow> transBdd \\<Rightarrow>  transBdd\"\nwhere\n \"updateCancel (x1::transid) [] = [((x1::transid),None,None,Abort)] \"\n|\"updateCancel (x1::transid) (((x2::transid),m2,c2,e2)#xs)= (if (x2=x1) then (updateLigneCancel  ((x2::transid),m2,c2,e2)  )#xs  else (((x2::transid),m2,c2,e2)#(updateCancel ((x1::transid)) xs ))  )\"\n\n\nfun traiterMessage ::\"message \\<Rightarrow> transBdd \\<Rightarrow> transBdd \"\nwhere\n \"traiterMessage ( Pay transid am) tb = (if(am>0) then updatePay (transid, am) tb else tb)\" \n|\"traiterMessage ( Ack transid am) tb = (if(am\\<ge>0) then  updateAck (transid, am) tb else tb)\"\n|\"traiterMessage ( Cancel transid) tb = updateCancel transid tb \"\n\nfun export:: \"transBdd \\<Rightarrow> transaction list\"\nwhere\n \"export [] = []\"\n|\"export  (((x2::transid),m2,Integer c2,e2)#xs) = (if (e2=Ok) then (x2,c2)#(export xs ) else(export xs ) )\"\n|\"export  (((x2::transid),m2,c2,e2)#xs) = (export xs )\"\n\nfun traiMessList:: \"message list \\<Rightarrow> transBdd \\<Rightarrow> transBdd\"\nwhere\n \"traiMessList [] tb = tb\"\n|\"traiMessList (v # va) tb =traiMessList va (traiterMessage v tb) \"\n\nfun traiterMessageList:: \"message list \\<Rightarrow> transBdd\"\nwhere\n \"traiterMessageList ml = traiMessList ml []\"\n\n\n\nlemma lem1:\"( (List.member  (export  (traiterMessageList lm)) (a,b)) \\<longrightarrow> (b>0))\"\napply (induct lm)\napply auto\napply (simp add: member_rec(2))\noops\n\n\n\n\n\n\noops\n\nlemma lem3:\"(selectEtat a  (traiterMessage (Cancel  a) (traiterMessageList lm))) = Etat Abort\"\n\napply (induct lm)\napply auto\n\noops\n\nlemma lem4:\"(List.member (export (traiterMessage (Cancel  a) (traiterMessageList lm))) (a,b)) = False\"\napply (induct lm)\napply auto\napply (simp add: member_rec(2))\n\noops\n\n\nlemma lem5:\"pc\\<ge>pm \\<and> pc>0 \\<and>  \\<not>(List.member  lm (Cancel a )) \\<longrightarrow> (\\<exists> pc. List.member (export (traiterMessage (Pay a pc)  (traiterMessage (Ack  a pm) (traiterMessageList lm)))) (a,pc))\"\napply (induct lm)\napply auto\napply (metis gr_implies_not0 member_rec(1))\napply (simp add: member_rec(1))\n\noops\n\nlemma lem6:\"(selectEtat a (traiterMessageList lm) = Etat Ok) \\<longrightarrow>(\\<exists> pc pm.(List.member lm (Ack a pm)) \\<and> (List.member lm (Pay a pc)) \\<and> pc \\<ge> pm) \"\napply (induct lm)\napply auto\n\n\noops\n\nlemma lem71:\"( selectClient a  (traiterMessageList lm)) = Integer pm \\<and> pm> mo \\<longrightarrow> ( selectClient a (traiterMessage (Pay  a mo)  (traiterMessageList lm))) = Integer pm \"\n\noops\n\n\nlemma lem72:\"( selectMarch a  (traiterMessageList lm)) = Integer pm \\<and> pm < mo \\<longrightarrow> ( selectMarch a (traiterMessage (Ack  a mo) (traiterMessageList lm))) = Integer pm \"\n\noops\n\nlemma lem81:\"(selectEtat a (traiterMessageList lm) = Etat Ok) \\<and> (selectClient a (traiterMessage (Pay  a pm) (traiterMessageList lm)) = Integer pm) \\<longrightarrow> (selectClient a (traiterMessage (Pay  a autre) (traiterMessageList lm)) = Integer pm)\"\n\noops\n\nlemma lem82:\"(selectEtat a (traiterMessageList lm) = Etat Ok) \\<and> (selectMarch a (traiterMessageList lm) = Integer pm) \\<longrightarrow> (selectMarch a  (traiterMessage (Ack  a autre) (traiterMessageList lm)) = Integer pm)\"\n\noops\n\nlemma lem9:\"(selectEtat a (traiterMessageList lm) = Etat Ok) \\<and> (selectMarch a (traiterMessageList lm) = Integer pm) \\<and>  (selectClient a  (traiterMessageList lm) = Integer pc) \\<longrightarrow> (List.member (export (traiterMessageList lm)) (a,pc)) \"\noops\n\n(* ----- Exportation en Scala (Isabelle 2014) -------*)\n\n(* Directive d'exportation *)\nexport_code export traiterMessage in Scala\n\n\nend\n\n", "meta": {"author": "Kwodhan", "repo": "M1ACF", "sha": "2a75392e3cdbc45c797f2e0fc2320e5f2335ccf2", "save_path": "github-repos/isabelle/Kwodhan-M1ACF", "path": "github-repos/isabelle/Kwodhan-M1ACF/M1ACF-2a75392e3cdbc45c797f2e0fc2320e5f2335ccf2/tp89.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018545, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3209524278953049}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Strong_Early_Sim_Pres\n  imports Strong_Early_Sim\nbegin\n\nlemma tauPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   Rel  :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"\\<tau>.(P) \\<leadsto>[Rel] \\<tau>.(Q)\"\nproof(induct rule: simCases)\n  case(Bound a y Q')\n  have \"\\<tau>.(Q) \\<longmapsto> a<\\<nu>y> \\<prec> Q'\" by fact\n  hence False by(induct rule: tauCases', auto)\n  thus ?case by simp\nnext\n  case(Free \\<alpha> Q')\n  have \"\\<tau>.(Q) \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n  thus \"\\<exists>P'. \\<tau>.(P) \\<longmapsto> \\<alpha>  \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  proof(induct rule: tauCases', auto simp add: pi.inject residual.inject)\n    have \"\\<tau>.(P) \\<longmapsto> \\<tau> \\<prec> P\" by(rule TransitionsEarly.Tau)\n    with PRelQ show \"\\<exists>P'. \\<tau>.(P) \\<longmapsto> \\<tau> \\<prec> P' \\<and> (P', Q) \\<in> Rel\" by blast\n  qed\nqed\n\n\nlemma inputPres:\n  fixes P    :: pi\n  and   x    :: name\n  and   Q    :: pi\n  and   a    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"\\<forall>y. (P[x::=y], Q[x::=y]) \\<in> Rel\"\n  and     Eqvt: \"eqvt Rel\"\n\n  shows \"a<x>.P \\<leadsto>[Rel] a<x>.Q\"\nusing Eqvt\nproof(induct rule: simCasesCont[where C=\"(x, a, P, Q)\"])\n  case(Bound b y Q')\n  from `y \\<sharp> (x, a, P, Q)` have \"y \\<noteq> x\" \"y \\<noteq> a\" \"y \\<sharp> P\" \"y \\<sharp> Q\" by simp+\n  from `a<x>.Q \\<longmapsto>b<\\<nu>y> \\<prec> Q'` `y \\<noteq> a` `y \\<noteq> x` `y \\<sharp> Q` show ?case\n    by(erule_tac inputCases') auto\nnext\n  case(Free \\<alpha> Q')\n  from `a<x>.Q \\<longmapsto> \\<alpha> \\<prec> Q'`\n  show ?case\n  proof(induct rule: inputCases)\n    case(cInput u)\n    have \"a<x>.P \\<longmapsto>a<u> \\<prec> P[x::=u]\" by(rule Input)\n    moreover from PRelQ have \"(P[x::=u], Q[x::=u]) \\<in> Rel\" by auto\n    ultimately show ?case by blast\n  qed\nqed\n\nlemma outputPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"a{b}.P \\<leadsto>[Rel] a{b}.Q\"\nproof(induct rule: simCases)\n  case(Bound c y Q')\n  have \"a{b}.Q \\<longmapsto> c<\\<nu>y> \\<prec> Q'\" by fact\n  hence False by(induct rule: outputCases', auto)\n  thus \"\\<exists>P'. a{b}.P \\<longmapsto> c<\\<nu>y> \\<prec> P' \\<and> (P', Q') \\<in> Rel\" by simp\nnext\n  case(Free \\<alpha> Q')\n  have \"a{b}.Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n  thus \"\\<exists>P'. a{b}.P \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  proof(induct rule: outputCases', auto simp add: pi.inject residual.inject)\n    have \"a{b}.P \\<longmapsto> a[b] \\<prec> P\" by(rule TransitionsEarly.Output)\n    with PRelQ show \"\\<exists>P'. a{b}.P \\<longmapsto> a[b] \\<prec> P' \\<and> (P', Q) \\<in> Rel\" by blast\n  qed\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto>[Rel] Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  shows \"[a\\<frown>b]P \\<leadsto>[Rel'] [a\\<frown>b]Q\"\nproof(induct rule: simCases)\n  case(Bound c y Q')\n  have \"(y::name) \\<sharp> [a\\<frown>b]P\" by fact\n  hence yFreshP: \"y \\<sharp> P\" by simp\n  have \"[a\\<frown>b]Q \\<longmapsto> c<\\<nu>y> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case Match\n    have \"Q \\<longmapsto>c<\\<nu>y> \\<prec> Q'\" by fact\n    with PSimQ yFreshP obtain P' where PTrans: \"P \\<longmapsto>c<\\<nu>y> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" \n      by(blast dest: elim)\n    \n    from PTrans have \"[a\\<frown>a]P \\<longmapsto> c<\\<nu>y> \\<prec> P'\" by(rule Early_Semantics.Match)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nnext\n  case(Free \\<alpha> Q')\n  assume \"[a\\<frown>b]Q \\<longmapsto> \\<alpha> \\<prec> Q'\"\n  thus ?case\n  proof(induct rule: matchCases)\n    case Match\n    have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<longmapsto> \\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" \n      by(blast dest: elim)\n\n    from PTrans have \"[a\\<frown>a]P \\<longmapsto>\\<alpha> \\<prec> P'\" by(rule TransitionsEarly.Match)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nqed\n\nlemma mismatchPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto>[Rel] Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"[a\\<noteq>b]P \\<leadsto>[Rel'] [a\\<noteq>b]Q\"\nproof(cases \"a = b\")\n  assume \"a = b\"\n  thus ?thesis\n    by(auto simp add: strongSimEarly_def)\nnext\n  assume aineqb: \"a \\<noteq> b\"\n  show ?thesis\n  proof(induct rule: simCases)\n    case(Bound c x Q')\n    have \"x \\<sharp> [a\\<noteq>b]P\" by fact\n    hence xFreshP: \"x \\<sharp> P\" by simp\n    have \"[a\\<noteq>b]Q \\<longmapsto> c<\\<nu>x> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case Mismatch\n      have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n      with PSimQ xFreshP obtain P' where PTrans: \"P \\<longmapsto>c<\\<nu>x> \\<prec> P'\"\n                                     and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: elim)\n\n      from PTrans aineqb have \"[a\\<noteq>b]P \\<longmapsto> c<\\<nu>x> \\<prec> P'\" by(rule Early_Semantics.Mismatch)\n      moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n      ultimately show ?case by blast\n    qed\n  next\n    case(Free \\<alpha> Q')\n    have \"[a\\<noteq>b]Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case Mismatch\n      have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n      with PSimQ obtain P' where PTrans: \"P \\<longmapsto> \\<alpha> \\<prec> P'\"\n                             and PRel: \"(P', Q') \\<in> Rel\"\n          by(blast dest: elim)\n      from PTrans `a \\<noteq> b` have \"[a\\<noteq>b]P \\<longmapsto>\\<alpha> \\<prec> P'\" by(rule TransitionsEarly.Mismatch)\n      with RelRel' PRel show ?case by blast\n    qed\n  qed\nqed\n\nlemma sumPres:\n  fixes P     :: pi\n  and   Q     :: pi\n  and   R     :: pi\n  and   Rel   :: \"(pi \\<times> pi) set\"\n  and   Rel'  :: \"(pi \\<times> pi) set\"\n\n  assumes \"P \\<leadsto>[Rel] Q\"\n  and     C1: \"Id \\<subseteq> Rel'\"\n  and     \"Rel \\<subseteq> Rel'\"\n\n  shows \"P \\<oplus> R \\<leadsto>[Rel'] Q \\<oplus> R\"\nproof(induct rule: simCases)\n  case(Bound a y Q')\n  have \"y \\<sharp> P \\<oplus> R\" by fact\n  hence \"(y::name) \\<sharp> P\" and  \"y \\<sharp> R\" by simp+\n  from `Q \\<oplus> R \\<longmapsto>a<\\<nu>y> \\<prec> Q'` show ?case\n  proof(induct rule: sumCases)\n    case Sum1\n    from `P \\<leadsto>[Rel] Q` `Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'` `y \\<sharp> P` obtain P' where PTrans: \"P \\<longmapsto>a<\\<nu>y> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" \n      by(blast dest: elim)\n    \n    from PTrans have \"P \\<oplus> R \\<longmapsto>a<\\<nu>y> \\<prec> P'\" by(rule Early_Semantics.Sum1)\n    moreover from P'RelQ' `Rel \\<subseteq> Rel'` have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  next\n    case Sum2\n    from `R \\<longmapsto>a<\\<nu>y> \\<prec> Q'` have \"P \\<oplus> R \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by(rule Early_Semantics.Sum2)\n    moreover from C1 have \"(Q', Q') \\<in> Rel'\" by auto\n    ultimately show ?case by blast\n  qed\nnext\n  case(Free \\<alpha> Q')\n  from `Q \\<oplus> R \\<longmapsto>\\<alpha> \\<prec> Q'` show \"\\<exists>P'. P \\<oplus> R \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel'\"\n  proof(induct rule: sumCases)\n    case Sum1\n    have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    with `P \\<leadsto>[Rel] Q` obtain P' where PTrans: \"P \\<longmapsto>\\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" \n      by(blast dest: elim)\n\n    from PTrans have \"P \\<oplus> R \\<longmapsto>\\<alpha> \\<prec> P'\" by(rule TransitionsEarly.Sum1)\n    moreover from P'RelQ' `Rel \\<subseteq> Rel'` have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  next\n    case Sum2\n    from `R \\<longmapsto>\\<alpha> \\<prec> Q'` have \"P \\<oplus> R \\<longmapsto>\\<alpha> \\<prec> Q'\" by(rule TransitionsEarly.Sum2)\n    moreover from C1 have \"(Q', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nqed\n\nlemma parCompose:\n  fixes P     :: pi\n  and   Q     :: pi\n  and   R     :: pi\n  and   T     :: pi\n  and   Rel   :: \"(pi \\<times> pi) set\"\n  and   Rel'  :: \"(pi \\<times> pi) set\"\n  and   Rel'' :: \"(pi \\<times> pi) set\"\n  \n  assumes PSimQ:    \"P \\<leadsto>[Rel] Q\"\n  and     RSimT:    \"R \\<leadsto>[Rel'] S\"\n  and     PRelQ:    \"(P, Q) \\<in> Rel\"\n  and     RRel'T:   \"(R, S) \\<in> Rel'\"\n  and     Par:      \"\\<And>P' Q' R' S'. \\<lbrakk>(P', Q') \\<in> Rel; (R', S') \\<in> Rel'\\<rbrakk> \\<Longrightarrow> (P' \\<parallel> R', Q' \\<parallel> S') \\<in> Rel''\"\n  and     Res:      \"\\<And>S T x. (S, T) \\<in> Rel'' \\<Longrightarrow> (<\\<nu>x>S, <\\<nu>x>T) \\<in> Rel''\"\n\n  shows \"P \\<parallel> R \\<leadsto>[Rel''] Q \\<parallel> S\"\nproof(induct rule: simCases)\n  case(Bound a x Q')\n  have \"x \\<sharp> P \\<parallel> R\" by fact\n  hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n  have \"Q \\<parallel> S \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: parCasesB)\n    case(cPar1 Q')\n    have \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact      \n    with PSimQ xFreshP obtain P' where PTrans:\"P \\<longmapsto> a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" \n      by(blast dest: elim)\n\n    from PTrans xFreshR have \"P \\<parallel> R \\<longmapsto> a<\\<nu>x> \\<prec> (P' \\<parallel> R)\" by(rule Early_Semantics.Par1B)\n    moreover from P'RelQ' RRel'T have \"(P' \\<parallel> R, Q' \\<parallel> S) \\<in> Rel''\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cPar2 S')\n    have \"S \\<longmapsto> a<\\<nu>x> \\<prec> S'\" by fact\n    with RSimT xFreshR obtain R' where RTrans:\"R \\<longmapsto> a<\\<nu>x> \\<prec> R'\" and R'Rel'T': \"(R', S') \\<in>  Rel'\" \n      by(blast dest: elim)\n\n    from RTrans xFreshP have ParTrans: \"P \\<parallel> R \\<longmapsto> a<\\<nu>x> \\<prec> (P \\<parallel> R')\" by(rule Early_Semantics.Par2B)\n    moreover from PRelQ R'Rel'T' have \"(P \\<parallel> R', Q \\<parallel>  S') \\<in> Rel''\" by(rule Par)\n    ultimately show ?case by blast\n  qed\nnext\n  case(Free \\<alpha> QT')\n  have \"Q \\<parallel> S \\<longmapsto> \\<alpha> \\<prec> QT'\" by fact\n  thus ?case\n  proof(induct rule: parCasesF[of _ _ _ _ _ \"(P, R)\"])\n    case(cPar1 Q')\n    have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<longmapsto> \\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\" \n      by(blast dest: elim)\n\n    from PTrans have \"P \\<parallel> R \\<longmapsto> \\<alpha> \\<prec> P' \\<parallel> R\" by(rule Early_Semantics.Par1F)\n    moreover from PRel RRel'T have \"(P' \\<parallel> R, Q' \\<parallel> S) \\<in> Rel''\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cPar2 S')\n    have \"S \\<longmapsto> \\<alpha> \\<prec> S'\" by fact\n    with RSimT obtain R' where RTrans: \"R \\<longmapsto> \\<alpha> \\<prec> R'\" and RRel: \"(R', S') \\<in> Rel'\" \n      by(blast dest: elim)\n\n    from RTrans have \"P \\<parallel> R \\<longmapsto> \\<alpha> \\<prec> P \\<parallel> R'\" by(rule Early_Semantics.Par2F)\n    moreover from PRelQ RRel have \"(P \\<parallel> R', Q \\<parallel> S') \\<in> Rel''\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cComm1 Q' S' a b)\n    have \"Q \\<longmapsto> a<b> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<longmapsto>a<b> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: elim)\n    \n    have \"S \\<longmapsto> a[b] \\<prec> S'\" by fact\n    with RSimT obtain R' where RTrans: \"R \\<longmapsto>a[b] \\<prec> R'\" and RRel: \"(R', S') \\<in> Rel'\"\n      by(blast dest: elim)\n    \n    from PTrans RTrans have \"P \\<parallel> R \\<longmapsto> \\<tau> \\<prec> P' \\<parallel> R'\" by(rule Early_Semantics.Comm1)\n    moreover from P'RelQ' RRel have \"(P' \\<parallel> R', Q' \\<parallel> S') \\<in> Rel''\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cComm2 Q' S' a b)\n    have \"Q \\<longmapsto> (OutputR a b) \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<longmapsto>a[b] \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\" \n      by(blast dest: elim)\n    \n    have \"S \\<longmapsto> a<b> \\<prec> S'\" by fact\n    with RSimT obtain R' where RTrans: \"R \\<longmapsto>a<b> \\<prec> R'\" and R'Rel'T': \"(R', S') \\<in> Rel'\"\n      by(blast dest: elim)\n    \n    from PTrans RTrans have \"P \\<parallel> R \\<longmapsto> \\<tau> \\<prec> P' \\<parallel> R'\" by(rule Early_Semantics.Comm2)\n    moreover from PRel R'Rel'T' have \"(P' \\<parallel> R', Q' \\<parallel> S') \\<in> Rel''\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cClose1 Q' S' a x)\n    have \"x \\<sharp> (P, R)\" by fact\n    hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n\n    have \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<longmapsto>a<x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: elim)\n    \n    have \"S \\<longmapsto> a<\\<nu>x> \\<prec> S'\" by fact\n    with RSimT xFreshR obtain R' where RTrans: \"R \\<longmapsto>a<\\<nu>x> \\<prec> R'\" and R'Rel'T': \"(R', S') \\<in> Rel'\"\n      by(blast dest: elim)\n    \n    from PTrans RTrans xFreshP have \"P \\<parallel> R \\<longmapsto> \\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n      by(rule Early_Semantics.Close1)\n    moreover from P'RelQ' R'Rel'T' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> S')) \\<in> Rel''\"\n      by(blast intro: Par Res)\n    ultimately show ?case by blast\n  next\n    case(cClose2 Q' S' a x)\n    have \"x \\<sharp> (P, R)\" by fact\n    hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n\n    have \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P' where PTrans: \"P \\<longmapsto>a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" \n      by(blast dest: elim)\n    \n    have \"S \\<longmapsto> a<x> \\<prec> S'\" by fact\n    with RSimT obtain R' where RTrans: \"R \\<longmapsto>a<x> \\<prec> R'\" and R'Rel'T': \"(R', S') \\<in> Rel'\" \n      by(blast dest: elim)\n    \n    from PTrans RTrans xFreshR have \"P \\<parallel> R \\<longmapsto> \\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n      by(rule Early_Semantics.Close2)\n    moreover from P'RelQ' R'Rel'T' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> S')) \\<in> Rel''\"\n      by(blast intro: Par Res)\n    ultimately show ?case by blast\n  qed\nqed\n\nlemma parPres:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   R   :: pi\n  and   a   :: name\n  and   b   :: name\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n  \n  assumes PSimQ:    \"P \\<leadsto>[Rel] Q\"\n  and     PRelQ:    \"(P, Q) \\<in> Rel\"\n  and     Par:      \"\\<And>S T U. (S, T) \\<in> Rel \\<Longrightarrow> (S \\<parallel> U, T \\<parallel> U) \\<in> Rel'\"\n  and     Res:      \"\\<And>S T x. (S, T) \\<in> Rel' \\<Longrightarrow> (<\\<nu>x>S, <\\<nu>x>T) \\<in> Rel'\"\n\n  shows \"P \\<parallel> R \\<leadsto>[Rel'] Q \\<parallel> R\"\nproof -\n  note PSimQ \n  moreover have RSimR: \"R \\<leadsto>[Id] R\" by(auto intro: reflexive)\n  moreover note PRelQ moreover have \"(R, R) \\<in> Id\" by auto\n  moreover from Par have \"\\<And>P Q R T. \\<lbrakk>(P, Q) \\<in> Rel; (R, T) \\<in> Id\\<rbrakk> \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> T) \\<in> Rel'\"\n    by auto\n  ultimately show ?thesis using Res by(rule parCompose)\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto>[Rel] Q\"\n  and     ResSet: \"\\<And>(R::pi) (S::pi) (y::name). (R, S) \\<in> Rel \\<Longrightarrow> (<\\<nu>y>R, <\\<nu>y>S) \\<in> Rel'\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     EqvtRel: \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"<\\<nu>x>P \\<leadsto>[Rel'] <\\<nu>x>Q\"\nproof -\n  from EqvtRel' show ?thesis\n  proof(induct rule: simCasesCont[where C = \"(P, x)\"])\n    case(Bound a y Q')\n    have Trans: \"<\\<nu>x>Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n    have \"y \\<sharp> (P, x)\" by fact\n    hence yineqx: \"y \\<noteq> x\" and yFreshP: \"y \\<sharp> (P::pi)\" by simp+\n    from Trans yineqx show ?case\n    proof(induct rule: resCasesB)\n      case(Open Q')\n      have QTrans: \"Q \\<longmapsto>(a::name)[x] \\<prec> Q'\" by fact\n      with PSimQ obtain P' where PTrans: \"P \\<longmapsto> a[x] \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" \n        by(blast dest: elim)\n\n      have \"<\\<nu>x>P \\<longmapsto>a<\\<nu>y> \\<prec> ([(y, x)] \\<bullet> P')\"\n      proof -\n        have aineqx: \"a \\<noteq> x\" by fact\n        with PTrans have \"<\\<nu>x>P \\<longmapsto>a<\\<nu>x> \\<prec> P'\" by(rule TransitionsEarly.Open)\n        moreover have \"a<\\<nu>x> \\<prec> P' = a<\\<nu>y> \\<prec> ([(y, x)] \\<bullet> P')\" \n        proof -\n          from PTrans yFreshP have yFreshP': \"y \\<sharp> P'\" by(force intro: freshTransition)\n          thus ?thesis by(simp add: alphaBoundOutput name_swap)\n        qed\n        ultimately show ?thesis by simp\n      qed\n      moreover from EqvtRel P'RelQ' RelRel' have \"([(y, x)] \\<bullet> P', [(y, x)] \\<bullet> Q') \\<in> Rel'\" \n        by(blast intro: eqvtRelI)\n      ultimately show ?case by blast\n    next\n      case(Res Q')\n      have QTrans: \"Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n\n      with PSimQ yFreshP obtain P' where PTrans: \"P \\<longmapsto>a<\\<nu>y> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: elim)\n\n      have xineqa: \"x \\<noteq> a\" by fact\n      with PTrans yineqx have ResTrans: \"<\\<nu>x>P \\<longmapsto>a<\\<nu>y> \\<prec> (<\\<nu>x>P')\"\n        by(blast intro: ResB)\n      moreover from P'RelQ' have \"((<\\<nu>x>P'), (<\\<nu>x>Q')) \\<in> Rel'\"\n        by(rule ResSet)\n\n      ultimately show \"\\<exists>P'. <\\<nu>x>P \\<longmapsto> a<\\<nu>y> \\<prec> P' \\<and> (P', (<\\<nu>x>Q')) \\<in> Rel'\" by blast\n    qed\n  next\n    case(Free \\<alpha> Q')\n    have Trans: \"<\\<nu>x>Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    have \"\\<exists>c::name. c \\<sharp> (P, Q, Q', \\<alpha>)\" by(blast intro: name_exists_fresh)\n    then obtain c::name where cFreshQ: \"c \\<sharp> Q\" and cFreshAlpha: \"c \\<sharp> \\<alpha>\" and cFreshQ': \"c \\<sharp> Q'\" and cFreshP: \"c \\<sharp> P\"\n      by(force simp add: fresh_prod)\n    from cFreshP have \"<\\<nu>x>P = <\\<nu>c>([(x, c)] \\<bullet> P)\" by(simp add: alphaRes)\n    moreover have \"\\<exists>P'.<\\<nu>c>([(x, c)] \\<bullet> P) \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel'\"\n    proof -\n      from Trans cFreshQ have \"<\\<nu>c>([(x, c)] \\<bullet> Q) \\<longmapsto>\\<alpha> \\<prec> Q'\" by(simp add: alphaRes)\n      moreover from EqvtRel PSimQ have \"([(x, c)] \\<bullet> P) \\<leadsto>[Rel] ([(x, c)] \\<bullet> Q)\"\n        by(blast intro: eqvtI)\n      ultimately show ?thesis using cFreshAlpha\n        apply -\n        apply(erule resCasesF)\n        apply auto\n        by(blast intro: ResF ResSet dest: elim)\n    qed\n\n    ultimately show \"\\<exists>P'.<\\<nu>x>P \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel'\" by auto\n  qed\nqed\n\nlemma resChainI:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   lst :: \"name list\"\n\n  assumes eqvtRel: \"eqvt Rel\"\n  and     Res:     \"\\<And>R S x. (R, S) \\<in> Rel \\<Longrightarrow> (<\\<nu>x>R, <\\<nu>x>S) \\<in> Rel\"\n  and     PRelQ:   \"P \\<leadsto>[Rel] Q\"\n\n  shows \"(resChain lst) P \\<leadsto>[Rel] (resChain lst) Q\"\nproof -\n  show ?thesis\n  proof(induct lst) (* Base case *)\n    from PRelQ show \"resChain [] P \\<leadsto>[Rel] resChain [] Q\" by simp\n  next (* Inductive step *)\n    fix a lst\n    assume IH: \"(resChain lst P) \\<leadsto>[Rel] (resChain lst Q)\"\n    moreover from Res have \"\\<And>P Q a. (P, Q) \\<in> Rel \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> Rel\"\n      by simp\n    moreover have \"Rel \\<subseteq> Rel\" by simp\n    ultimately have \"<\\<nu>a>(resChain lst P) \\<leadsto>[Rel] <\\<nu>a>(resChain lst Q)\" using eqvtRel\n      by(rule_tac resPres)\n    thus \"resChain (a # lst) P \\<leadsto>[Rel] resChain (a # lst) Q\"\n      by simp\n  qed\nqed\n\n\n\n  shows \"!P \\<leadsto>[bangRel Rel] !Q\"\nproof -\n  let ?Sim = \"\\<lambda>P Rs. (\\<forall>a x Q'. Rs = a<\\<nu>x> \\<prec> Q' \\<longrightarrow> x \\<sharp> P \\<longrightarrow> (\\<exists>P'. P \\<longmapsto>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> bangRel Rel)) \\<and>\n                     (\\<forall>\\<alpha> Q'. Rs = \\<alpha> \\<prec> Q' \\<longrightarrow> (\\<exists>P'. P \\<longmapsto>\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> bangRel Rel))\"\n  from eqvtRel have EqvtBangRel: \"eqvt(bangRel Rel)\" by(rule eqvtBangRel)\n\n  {\n    fix Pa Rs\n    assume \"!Q \\<longmapsto> Rs\" and \"(Pa, !Q) \\<in> bangRel Rel\"\n    hence \"?Sim Pa Rs\" using PRelQ\n    proof(nominal_induct avoiding: Pa P rule: bangInduct)\n      case(Par1B a x Q' Pa P)\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> Pa\" by fact+\n      thus \"?Sim Pa (a<\\<nu>x> \\<prec> (Q' \\<parallel> !Q))\"\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" by fact\n        have PBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        show ?case \n        proof(auto simp add: residual.inject alpha')\n          from PRelQ have \"P \\<leadsto>[Rel] Q\" by(rule Sim)\n\n          with QTrans xFreshP obtain P' where PTrans: \"P \\<longmapsto> a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: elim)\n\n          from PTrans xFreshR have \"P \\<parallel> R \\<longmapsto> a<\\<nu>x> \\<prec> (P' \\<parallel> R)\"\n            by(force intro: Early_Semantics.Par1B)\n          moreover from P'RelQ' PBRQ have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel\" by(rule Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<longmapsto>a<\\<nu>x> \\<prec> P' \\<and> (P', Q' \\<parallel> !Q) \\<in> bangRel Rel\" by blast\n        next\n          fix y\n          assume \"(y::name) \\<sharp> Q'\" and \"y \\<sharp> P\" and \"y \\<sharp> R\" and \"y \\<sharp> Q\"\n          from QTrans `y \\<sharp> Q'` have \"Q \\<longmapsto>a<\\<nu>y> \\<prec> ([(x, y)] \\<bullet> Q')\"\n            by(simp add: alphaBoundOutput)\n          moreover from PRelQ have \"P \\<leadsto>[Rel] Q\" by(rule Sim)\n          ultimately obtain P' where PTrans: \"P \\<longmapsto>a<\\<nu>y> \\<prec> P'\" and P'RelQ': \"(P', [(x, y)] \\<bullet> Q') \\<in> Rel\"\n            using `y \\<sharp> P`\n            by(blast dest: elim)\n          from PTrans `y \\<sharp> R` have \"P \\<parallel> R \\<longmapsto>a<\\<nu>y> \\<prec> (P' \\<parallel> R)\" by(force intro: Early_Semantics.Par1B)\n          moreover from P'RelQ' PBRQ have \"(P' \\<parallel> R, ([(x, y)] \\<bullet> Q') \\<parallel> !Q) \\<in> bangRel Rel\" by(rule Rel.BRPar)\n          with `x \\<sharp> Q` `y \\<sharp> Q` have \"(P' \\<parallel> R, ([(y, x)] \\<bullet> Q') \\<parallel> !([(y, x)] \\<bullet> Q)) \\<in> bangRel Rel\"\n            by(simp add: name_fresh_fresh name_swap)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<longmapsto>a<\\<nu>y> \\<prec> P' \\<and> (P', ([(y, x)] \\<bullet> Q') \\<parallel> !([(y, x)] \\<bullet> Q)) \\<in> bangRel Rel\"\n            by blast\n        qed\n      qed\n    next\n      case(Par1F \\<alpha> Q' Pa P)\n      have QTrans: \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and BR: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto>[Rel] Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<longmapsto> \\<alpha> \\<prec> P'\" and RRel: \"(P', Q') \\<in> Rel\"\n            by(blast dest: elim)\n          \n          from PTrans have \"P \\<parallel> R \\<longmapsto> \\<alpha> \\<prec> P' \\<parallel> R\" by(rule TransitionsEarly.Par1F)\n          moreover from RRel BR have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel\" by(rule Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', Q' \\<parallel> !Q) \\<in> bangRel Rel\" by blast\n        qed\n      qed\n    next\n      case(Par2B a x Q' Pa P)\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa (a<\\<nu>x> \\<prec> Q')\" by simp\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> Pa\" by fact+\n      thus \"?Sim Pa (a<\\<nu>x> \\<prec> (Q \\<parallel> Q'))\"\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n\n        from EqvtBangRel show \"?Sim (P \\<parallel> R) (a<\\<nu>x> \\<prec> (Q \\<parallel> Q'))\"\n        proof(auto simp add: residual.inject alpha')\n          from RBRQ have \"?Sim R (a<\\<nu>x> \\<prec> Q')\" by(rule IH)\n          with xFreshR obtain R' where RTrans: \"R \\<longmapsto> a<\\<nu>x> \\<prec> R'\" and R'BRQ': \"(R', Q') \\<in> (bangRel Rel)\"\n            by(metis elim)\n          from RTrans xFreshP have \"P \\<parallel> R \\<longmapsto> a<\\<nu>x> \\<prec> (P \\<parallel> R')\" by(auto intro: Early_Semantics.Par2B)\n          moreover from PRelQ R'BRQ' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> (bangRel Rel)\" by(rule Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<longmapsto> a<\\<nu>x> \\<prec> P' \\<and> (P', Q \\<parallel> Q') \\<in> bangRel Rel\" by blast\n        next\n          fix y\n          assume \"(y::name) \\<sharp> Q\" and \"y \\<sharp> Q'\" and \"y \\<sharp> P\" and \"y \\<sharp> R\"\n          from RBRQ have \"?Sim R (a<\\<nu>x> \\<prec> Q')\" by(rule IH)\n          with `y \\<sharp> Q'` have \"?Sim R (a<\\<nu>y> \\<prec> ([(x, y)] \\<bullet> Q'))\" by(simp add: alphaBoundOutput)\n          with `y \\<sharp> R` obtain R' where RTrans: \"R \\<longmapsto> a<\\<nu>y> \\<prec> R'\" and R'BRQ': \"(R', ([(x, y)] \\<bullet> Q')) \\<in> (bangRel Rel)\"\n            by(metis elim)\n          from RTrans `y \\<sharp> P` have \"P \\<parallel> R \\<longmapsto> a<\\<nu>y> \\<prec> (P \\<parallel> R')\" by(auto intro: Early_Semantics.Par2B)\n          moreover from PRelQ R'BRQ' have \"(P \\<parallel> R', Q \\<parallel> ([(x, y)] \\<bullet> Q')) \\<in> (bangRel Rel)\" by(rule Rel.BRPar)\n          with `y \\<sharp> Q` `x \\<sharp> Q` have \"(P \\<parallel> R', ([(y, x)] \\<bullet> Q) \\<parallel> ([(y, x)] \\<bullet> Q')) \\<in> (bangRel Rel)\"\n            by(simp add: name_swap name_fresh_fresh)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<longmapsto> a<\\<nu>y> \\<prec> P' \\<and> (P', ([(y, x)] \\<bullet> Q) \\<parallel> ([(y, x)] \\<bullet> Q')) \\<in> bangRel Rel\" by blast\n        qed\n      qed\n    next\n      case(Par2F \\<alpha> Q' Pa P)\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa (\\<alpha> \\<prec> Q')\" by simp\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from RBRQ IH have \"\\<exists>R'. R \\<longmapsto> \\<alpha> \\<prec> R' \\<and> (R', Q') \\<in> bangRel Rel\"\n            by(metis elim)\n          then obtain R' where RTrans: \"R \\<longmapsto> \\<alpha> \\<prec> R'\" and R'RelQ': \"(R', Q') \\<in> bangRel Rel\"\n            by blast\n\n          from RTrans have \"P \\<parallel> R \\<longmapsto> \\<alpha> \\<prec> P \\<parallel> R'\" by(rule TransitionsEarly.Par2F)\n          moreover from PRelQ R'RelQ' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> bangRel Rel\" by(rule Rel.BRPar)\n          ultimately show \" \\<exists>P'. P \\<parallel> R \\<longmapsto> \\<alpha> \\<prec> P' \\<and> (P', Q \\<parallel> Q') \\<in> bangRel Rel\" by blast\n        qed\n      qed\n    next\n      case(Comm1 a Q' b Q'' Pa P)\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa (a[b] \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto>a<b> \\<prec> Q'\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto>[Rel] Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<longmapsto> a<b> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: elim)\n          \n          from IH RBRQ have RTrans: \"\\<exists>R'. R \\<longmapsto> a[b] \\<prec> R' \\<and> (R', Q'') \\<in> bangRel Rel\"\n            by(metis elim)\n          then obtain R' where RTrans: \"R \\<longmapsto> a[b] \\<prec> R'\" and R'RelQ'': \"(R', Q'') \\<in> bangRel Rel\"\n            by blast\n          \n          from PTrans RTrans have \"P \\<parallel> R \\<longmapsto>\\<tau> \\<prec> P' \\<parallel> R'\" by(rule TransitionsEarly.Comm1)\n          moreover from P'RelQ' R'RelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q'') \\<in> bangRel Rel\" by(rule Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<longmapsto> \\<tau> \\<prec> P' \\<and> (P', Q' \\<parallel> Q'') \\<in> bangRel Rel\" by blast\n        qed\n      qed\n    next\n      case(Comm2 a b Q' Q'')\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa (a<b> \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto> a[b] \\<prec> Q'\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto>[Rel] Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<longmapsto> a[b] \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: elim)\n\n          from IH RBRQ have RTrans: \"\\<exists>R'. R \\<longmapsto> a<b> \\<prec> R' \\<and> (R', Q'') \\<in> bangRel Rel\"\n            by(metis elim)\n          then obtain R' where RTrans: \"R \\<longmapsto> a<b> \\<prec> R'\" and R'RelQ'': \"(R', Q'') \\<in> bangRel Rel\"\n            by blast\n\n          from PTrans RTrans have \"P \\<parallel> R \\<longmapsto> \\<tau> \\<prec> P' \\<parallel> R'\" by(rule TransitionsEarly.Comm2)\n          moreover from P'RelQ' R'RelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q'') \\<in> bangRel Rel\" by(rule Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<longmapsto> \\<tau> \\<prec> P' \\<and> (P', Q' \\<parallel> Q'') \\<in> bangRel Rel\" by blast\n        qed\n      qed\n    next\n      case(Close1 a x Q' Q'' Pa P)\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<longrightarrow> ?Sim Pa (a<\\<nu>x> \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n      have xFreshQ: \"x \\<sharp> Q\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      moreover have xFreshPa: \"x \\<sharp> Pa\" by fact\n      ultimately show ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto>[Rel] Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' where PTrans: \"P \\<longmapsto>a<x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n             by(blast dest: elim)\n\n           from RBRQ xFreshR IH have \"\\<exists>R'. R \\<longmapsto>a<\\<nu>x> \\<prec> R' \\<and> (R', Q'') \\<in> bangRel Rel\"\n             by(metis elim)\n           then obtain R' where RTrans: \"R \\<longmapsto>a<\\<nu>x> \\<prec> R'\" and R'RelQ'': \"(R', Q'') \\<in> bangRel Rel\"\n             by blast\n\n           from PTrans RTrans xFreshP have \"P \\<parallel> R \\<longmapsto>\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n             by(rule Early_Semantics.Close1)     \n           moreover from P'RelQ' R'RelQ'' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> bangRel Rel\"\n             by(force intro: Rel.BRPar BRRes)\n           ultimately show \"\\<exists>P'. P \\<parallel> R \\<longmapsto> \\<tau> \\<prec> P' \\<and> (P', <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> bangRel Rel\" by blast\n         qed\n      qed\n    next\n      case(Close2 a x Q' Q'' Pa P)\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa (a<x> \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n      have xFreshQ: \"x \\<sharp> Q\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> Pa\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto>[Rel] Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' where PTrans: \"P \\<longmapsto>a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: elim)\n\n          from RBRQ IH have \"\\<exists>R'.  R \\<longmapsto>a<x> \\<prec> R' \\<and> (R', Q'') \\<in> bangRel Rel\"\n            by auto\n          then obtain R' where RTrans: \"R \\<longmapsto> a<x> \\<prec> R'\" and R'RelQ'': \"(R', Q'') \\<in> bangRel Rel\"\n            by blast\n\n          from PTrans RTrans xFreshR have \"P \\<parallel> R \\<longmapsto> \\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n            by(rule Early_Semantics.Close2)      \n          moreover from P'RelQ' R'RelQ'' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> bangRel Rel\"\n            by(force intro: Rel.BRPar BRRes)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<longmapsto> \\<tau> \\<prec> P' \\<and> (P', <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> bangRel Rel\" by blast\n        qed\n      qed\n    next\n      case(Bang Rs Pa P)\n      hence IH: \"\\<And>Pa. (Pa, Q \\<parallel> !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa Rs\" by simp\n      have \"(Pa, !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRBangCases)\n        case(BRBang P)\n        have PRelQ: \"(P, Q) \\<in> Rel\" by fact\n        hence \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n        with PRelQ have \"(P \\<parallel> !P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by(rule BRPar)\n        with IH have \"?Sim (P \\<parallel> !P) Rs\" by simp\n        thus ?case by(force intro: TransitionsEarly.Bang)\n      qed\n    qed\n  }\n\n  moreover from PRelQ have \"(!P, !Q) \\<in> bangRel Rel\" by(rule BRBang) \n  ultimately show ?thesis by(auto simp add: strongSimEarly_def)\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Strong_Early_Sim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.32081425095402993}}
{"text": "theory GeneralOntology imports ValueOntology (*Benzm.,Fuenmayor&Lomfeld, 2020*)               \nbegin (**General/Upper Ontology**)\n\n(*kinds of situations*)\nconsts Animals::\"\\<sigma>\"         (*appropriation of animals in general*)\nconsts WildAnimals::\"\\<sigma>\"     (*appropriation of wild animals*)\nconsts DomesticAnimals::\"\\<sigma>\" (*appropriation of domestic animals*)\nconsts FoxHunting::\"\\<sigma>\"      (*hunting (appropriation) of foxes*)\nconsts ParrotCapture::\"\\<sigma>\"   (*capture (appropriation) of a parrot*)\n\n(*world knowledge: meaning postulates for kinds of situations*)\naxiomatization where \nW1: \"WildAnimals \\<subseteq> Animals\" and\nW2: \"FoxHunting \\<subseteq> WildAnimals\" and\nW3: \"DomesticAnimals \\<subseteq> Animals\" and\nW4: \"ParrotCapture \\<subseteq> DomesticAnimals\"\n\n(*(abstract) example legal corpus and implications for value preferences*)\naxiomatization where \nS2: \"\\<lfloor>WildAnimals     \\<^bold>\\<rightarrow> (x\\<inverse>\\<down>WILL \\<^bold>\\<prec> x\\<down>STAB)\\<rfloor>\" and        (*specialization*)\nS3: \"\\<lfloor>DomesticAnimals \\<^bold>\\<rightarrow> (x\\<inverse>\\<down>STAB \\<^bold>\\<prec> (x\\<down>RELI \\<^bold>\\<and> x\\<down>WILL))\\<rfloor>\" (*specialization*)\n\n(*explore implicit legal knowledge*)\nlemma \"\\<lfloor>FoxHunting \\<^bold>\\<rightarrow> (x\\<inverse>\\<down>WILL \\<^bold>\\<prec> x\\<down>STAB)\\<rfloor>\" using S2 W2 by blast\nlemma \"\\<lfloor>DomesticAnimals \\<^bold>\\<rightarrow> (x\\<inverse>\\<down>WILL \\<^bold>\\<prec> x\\<down>STAB)\\<rfloor>\" nitpick oops (*Countermodel*)\n\nlemma True nitpick[satisfy] oops (*satisfiable, axioms are consistent*)\nend\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/Preference-Logics/vanBenthemEtAl2009/OLD/GeneralOntology.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3208142509540299}}
{"text": "theory \"CoCallGraph-Nominal\"\nimports CoCallGraph \"../Launchbury/Nominal-HOLCF\"\nbegin\n\ninstantiation CoCalls :: pt\nbegin\n  lift_definition permute_CoCalls :: \"perm \\<Rightarrow> CoCalls \\<Rightarrow> CoCalls\" is \"permute\"\n    by (auto intro!: symI elim: symE simp add: mem_permute_set)\ninstance\n  apply standard\n  apply (transfer, simp)+\n  done\nend\n\ninstance CoCalls :: cont_pt\n  apply standard\n  apply (rule contI2)\n  apply (rule monofunI)\n  apply transfer\n  apply (metis (full_types) True_eqvt subset_eqvt)\n  apply (thin_tac \"chain _\")+\n  apply transfer\n  apply simp\n  done\n\nlemmas lub_eqvt[OF exists_lub, simp, eqvt]\n\nlemma cc_restr_perm:\n  fixes G :: CoCalls\n  assumes \"supp p \\<sharp>* S\" and [simp]: \"finite S\"\n  shows \"cc_restr S (p \\<bullet> G) = cc_restr S G\"\n  using assms\n  apply -\n  apply transfer\n  apply (auto simp add: mem_permute_set)\n  apply (subst (asm) perm_supp_eq, simp add: supp_minus_perm, metis (full_types) fresh_def fresh_star_def supp_set_elem_finite)+\n  apply assumption\n  apply (subst perm_supp_eq, simp add: supp_minus_perm, metis (full_types) fresh_def fresh_star_def supp_set_elem_finite)+\n  apply assumption\n  done\n\n\n\nlemma inCC_eqvt[eqvt]: \"\\<pi> \\<bullet> (x--y\\<in>G) = (\\<pi>\\<bullet>x)--(\\<pi>\\<bullet>y)\\<in>(\\<pi>\\<bullet>G)\"\n  by transfer auto\nlemma cc_restr_eqvt[eqvt]: \"\\<pi> \\<bullet> cc_restr S G = cc_restr (\\<pi> \\<bullet> S) (\\<pi> \\<bullet> G)\"\n  by transfer (perm_simp, rule)\nlemma ccProd_eqvt[eqvt]: \"\\<pi> \\<bullet> ccProd S S' = ccProd (\\<pi> \\<bullet> S) (\\<pi> \\<bullet>  S')\" \n  by transfer (perm_simp, rule)\nlemma ccSquare_eqvt[eqvt]: \"\\<pi> \\<bullet> ccSquare S = ccSquare (\\<pi> \\<bullet> S)\"\n  unfolding ccSquare_def\n  by perm_simp rule\nlemma ccNeighbors_eqvt[eqvt]: \"\\<pi> \\<bullet> ccNeighbors S G = ccNeighbors (\\<pi> \\<bullet> S) (\\<pi> \\<bullet> G)\"\n  by transfer (perm_simp, rule)\n\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/CoCallGraph-Nominal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3208142509540299}}
{"text": "section \\<open>Infrastructures\\<close>\ntext \\<open>The Isabelle Infrastructure framework supports the representation of infrastructures \nas graphs with actors and policies attached to nodes. These infrastructures \nare the {\\it states} of the Kripke structure. \nThe transition between states is triggered by non-parametrized\nactions @{text \\<open>get, move, eval, put\\<close>} executed by actors. \nActors are given by an abstract type @{text \\<open>actor\\<close>} and a function \n@{text \\<open>Actor\\<close>} that creates elements of that type from identities \n(of type @{text \\<open>string\\<close>}). Policies are given by pairs of predicates \n(conditions) and sets of (enabled) actions.\\<close>\nsubsection \\<open>Actors, actions, and data labels\\<close>\ntheory Infrastructure\n  imports AT \nbegin\ndatatype action = get | move | eval | put\n\ntypedecl actor \ntype_synonym identity = string\nconsts Actor :: \"string \\<Rightarrow> actor\"\ntype_synonym policy = \"((actor \\<Rightarrow> bool) * action set)\"\n\ndefinition ID :: \"[actor, string] \\<Rightarrow> bool\"\n  where \"ID a s \\<equiv> (a = Actor s)\"\ntext \\<open>The Decentralised Label Model (DLM) \\cite{ml:98} introduced the idea to\nlabel data by owners and readers. We pick up this idea and formalize\na new type to encode the owner and the set of readers as a pair.\nThe first element is the owner of a data item, the second one is the\nset of all actors that may access the data item.\nThis enables the unique security \nlabelling of data within the system additionally taking the ownership into \naccount.\\<close>\ntype_synonym data = nat  \ntype_synonym dlm = \"actor * actor set\"\n\nsubsection \\<open>Infrastructure graphs and policies\\<close>\ntext\\<open>Actors are contained in an infrastructure graph. An @{text \\<open>igraph\\<close>} contains\na set of location pairs representing the topology of the infrastructure\nas a graph of nodes and a list of actor identities associated to each node \n(location) in the graph.\nAlso an @{text \\<open>igraph\\<close>} associates actors to a pair of string sets by\na pair-valued function whose first range component is a set describing\nthe credentials in the possession of an actor and the second component\nis a set defining the roles the actor can take on. More importantly in this \ncontext, an  @{text \\<open>igraph\\<close>} assigns locations to a pair of a string that defines\nthe state of the component and an element of type @{text \\<open>(dlm * data) set\\<close>}. This\nset of labelled data may represent a condition on that data.\nCorresponding projection functions for each of these components of an \n@{text \\<open>igraph\\<close>} are provided; they are named @{text \\<open>gra\\<close>} for the actual set of pairs of\nlocations, @{text \\<open>agra\\<close>} for the actor map, @{text \\<open>cgra\\<close>} for the credentials,\nand @{text \\<open>lgra\\<close>} for the state of a location and the data at that location.\\<close>\ndatatype location = Location nat\n  datatype igraph = Lgraph \"(location * location)set\" \"location \\<Rightarrow> identity set\"\n                           \"actor \\<Rightarrow> (string set * string set)\"  \n                           \"location \\<Rightarrow> string * (dlm * data) set\"\ndatatype infrastructure = \n         Infrastructure \"igraph\" \n                        \"[igraph, location] \\<Rightarrow> policy set\" \n                       \nprimrec loc :: \"location \\<Rightarrow> nat\"\nwhere  \"loc(Location n) = n\"\nprimrec gra :: \"igraph \\<Rightarrow> (location * location)set\"\nwhere  \"gra(Lgraph g a c l) = g\"\nprimrec agra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> identity set)\"\nwhere  \"agra(Lgraph g a c l) = a\"\nprimrec cgra :: \"igraph \\<Rightarrow> (actor \\<Rightarrow> string set * string set)\"\nwhere  \"cgra(Lgraph g a c l) = c\"\nprimrec lgra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> string * (dlm * data) set)\"\nwhere  \"lgra(Lgraph g a c l) = l\"\n\ndefinition nodes :: \"igraph \\<Rightarrow> location set\" \nwhere \"nodes g == { x. (? y. ((x,y): gra g) | ((y,x): gra g))}\"\n\ndefinition actors_graph :: \"igraph \\<Rightarrow> identity set\"  \nwhere  \"actors_graph g == {x. ? y. y : nodes g \\<and> x \\<in> (agra g y)}\"\n\ntext \\<open>There are projection functions text{@ \\<open>graphI\\<close>} and text{@ \\<open>delta\\<close>} when applied\nto an infrastructure return the graph and the policy, respectively. Other projections\nare introduced for the labels, the credential, and roles and to express their meaning.\\<close>\nprimrec graphI :: \"infrastructure \\<Rightarrow> igraph\"\nwhere \"graphI (Infrastructure g d) = g\"\nprimrec delta :: \"[infrastructure, igraph, location] \\<Rightarrow> policy set\"\nwhere \"delta (Infrastructure g d) = d\"\nprimrec tspace :: \"[infrastructure, actor ] \\<Rightarrow> string set * string set\"\n  where \"tspace (Infrastructure g d) = cgra g\"\nprimrec lspace :: \"[infrastructure, location ] \\<Rightarrow> string * (dlm * data)set\"\nwhere \"lspace (Infrastructure g d) = lgra g\"\n\ndefinition credentials :: \"string set * string set \\<Rightarrow> string set\"\n  where  \"credentials lxl \\<equiv> (fst lxl)\"\ndefinition has :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"has G ac \\<equiv> snd ac \\<in> credentials(cgra G (fst ac))\"\ndefinition roles :: \"string set * string set \\<Rightarrow> string set\"\n  where  \"roles lxl \\<equiv> (snd lxl)\"\ndefinition role :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"role G ac \\<equiv> snd ac \\<in> roles(cgra G (fst ac))\"\ndefinition isin :: \"[igraph,location, string] \\<Rightarrow> bool\" \n  where \"isin G l s \\<equiv> s = fst (lgra G l)\"\n\ntext \\<open>Predicates and projections for the labels to encode their meaning.\\<close>\ndefinition owner :: \"dlm * data \\<Rightarrow> actor\" where \"owner d \\<equiv> fst(fst d)\"\ndefinition owns :: \"[igraph, location, actor, dlm * data] \\<Rightarrow> bool\"\n  where \"owns G l a d \\<equiv> owner d = a\"\ndefinition readers :: \"dlm * data \\<Rightarrow> actor set\"\n  where \"readers d \\<equiv> snd (fst d)\"\n\ntext \\<open>The predicate @{text \\<open>has_access\\<close>} is true for owners or readers.\\<close> \ndefinition has_access :: \"[igraph, location, actor, dlm * data] \\<Rightarrow> bool\"    \nwhere \"has_access G l a d \\<equiv> owns G l a d \\<or> a \\<in> readers d\"\n\n(*\ntext \\<open>Actors can delete data.\\<close>\ndefinition actor_can_delete ::   \"[infrastructure, actor, location] \\<Rightarrow> bool\"\nwhere actor_can_delete_def: \"actor_can_delete I h l \\<equiv>  \n                   (\\<forall> as n. ((h, as), n) \\<notin> (snd (lgra (graphI I) l)))\"\n*)\ntext \\<open>We define a type of functions that preserves the security labeling and a \n   corresponding function application  operator.\\<close>  \ntypedef label_fun = \"{f :: dlm * data \\<Rightarrow> dlm * data. \n                        \\<forall> x:: dlm * data. fst x = fst (f x)}\"  \n  by (fastforce)\n\ndefinition secure_process :: \"label_fun \\<Rightarrow> dlm * data \\<Rightarrow> dlm * data\" (infixr \"\\<Updown>\" 50)\n  where \"f  \\<Updown> d \\<equiv> (Rep_label_fun f) d\" \n\n(* This part is relevant to model Insiders but is not needed for Infrastructures.\n\ndatatype psy_states = happy | depressed | disgruntled | angry | stressed\ndatatype motivations = financial | political | revenge | curious | competitive_advantage | power | peer_recognition\n\ndatatype actor_state = Actor_state \"psy_states\" \"motivations set\"\nprimrec motivation :: \"actor_state \\<Rightarrow> motivations set\" \nwhere \"motivation  (Actor_state p m) =  m\"\nprimrec psy_state :: \"actor_state \\<Rightarrow> psy_states\" \nwhere \"psy_state  (Actor_state p m) = p\"\n\ndefinition tipping_point :: \"actor_state \\<Rightarrow> bool\" where\n  \"tipping_point a \\<equiv> ((motivation a \\<noteq> {}) \\<and> (happy \\<noteq> psy_state a))\"\n\nconsts astate :: \"identity \\<Rightarrow> actor_state\"\n\n(* Two versions of an impersonation predicate \"a can act as b\". \n   The first one is stronger and allows substitution of the insider in any context; \n   the second one is parameterized over a context predicate to describe this.   *)\ndefinition UasI ::  \"[identity, identity] \\<Rightarrow> bool \" \nwhere \"UasI a b \\<equiv> (Actor a = Actor b) \\<and> (\\<forall> x y. x \\<noteq> a \\<and> y \\<noteq> a \\<and> Actor x = Actor y \\<longrightarrow> x = y)\"\n\ndefinition UasI' ::  \"[actor => bool, identity, identity] \\<Rightarrow> bool \" \nwhere \"UasI' P a b \\<equiv> P (Actor b) \\<longrightarrow> P (Actor a)\"\n\ndefinition Insider :: \"[identity, identity set] \\<Rightarrow> bool\" \nwhere \"Insider a C \\<equiv> (tipping_point (astate a) \\<longrightarrow> (\\<forall> b\\<in>C. UasI a b))\"\n\ndefinition Insider' :: \"[actor \\<Rightarrow> bool, identity, identity set] \\<Rightarrow> bool\" \nwhere \"Insider' P a C \\<equiv> (tipping_point (astate a) \\<longrightarrow> (\\<forall> b\\<in>C. UasI' P a b \\<and> inj_on Actor C))\"\n*)\n\ntext \\<open>The predicate atI -- mixfix syntax @{text \\<open>@\\<^bsub>G\\<^esub>\\<close>} -- expresses that an actor (identity) \n      is at a certain location in an igraph.\\<close>\ndefinition atI :: \"[identity, igraph, location] \\<Rightarrow> bool\" (\"_ @\\<^bsub>(_)\\<^esub> _\" 50)\nwhere \"a @\\<^bsub>G\\<^esub> l \\<equiv> a \\<in> (agra G l)\"\n\ntext \\<open>Policies specify the expected behaviour of actors of an infrastructure. \nThey are defined by the @{text \\<open>enables\\<close>} predicate:\nan actor @{text \\<open>h\\<close>} is enabled to perform an action @{text \\<open>a\\<close>} \nin infrastructure @{text \\<open>I\\<close>}, at location @{text \\<open>l\\<close>}\nif there exists a pair @{text \\<open>(p,e)\\<close>} in the local policy of @{text \\<open>l\\<close>}\n(@{text \\<open>delta I l\\<close>} projects to the local policy) such that the action \n@{text \\<open>a\\<close>} is a member of the action set @{text \\<open>e\\<close>} and the policy \npredicate @{text \\<open>p\\<close>} holds for actor @{text \\<open>h\\<close>}.\\<close>\ndefinition enables :: \"[infrastructure, location, actor, action] \\<Rightarrow> bool\"\nwhere\n\"enables I l a a' \\<equiv>  (\\<exists> (p,e) \\<in> delta I (graphI I) l. a' \\<in> e \\<and> p a)\"\n\ntext \\<open>The behaviour is the good behaviour, i.e. everything allowed by the policy of infrastructure I.\\<close>\ndefinition behaviour :: \"infrastructure \\<Rightarrow> (location * actor * action)set\"\nwhere \"behaviour I \\<equiv> {(t,a,a'). enables I t a a'}\"\n\ntext \\<open>The misbehaviour is the complement of the behaviour of an infrastructure I.\\<close>\ndefinition misbehaviour :: \"infrastructure \\<Rightarrow> (location * actor * action)set\"\nwhere \"misbehaviour I \\<equiv> -(behaviour I)\"\n\nsubsection \"State transition on infrastructures\"\ntext \\<open>The state transition defines how actors may act on infrastructures through actions\n    within the boundaries of the policy. It is given as an inductive definition over the \n    states which are infrastructures.  This state transition relation is dependent on actions but also on\n    enabledness and the current state of the infrastructure.\n\n    First we introduce some auxiliary functions dealing\n    with repetitions in lists and actors moving in an igraph.\\<close>\nprimrec jonce :: \"['a, 'a list] \\<Rightarrow> bool\"\nwhere\njonce_nil: \"jonce a [] = False\" |\njonce_cons: \"jonce a (x#ls) = (if x = a then (a \\<notin> (set ls)) else jonce a ls)\"\n(*\nprimrec nodup :: \"['a, 'a list] \\<Rightarrow> bool\"\n  where \n    nodup_nil: \"nodup a [] = True\" |\n    nodup_step: \"nodup a (x # ls) = (if x = a then (a \\<notin> (set ls)) else nodup a ls)\"\n*)\ndefinition move_graph_a :: \"[identity, location, location, igraph] \\<Rightarrow> igraph\"\nwhere \"move_graph_a n l l' g \\<equiv> Lgraph (gra g) \n                    (if n \\<in> ((agra g) l) &  n \\<notin> ((agra g) l') then \n                     ((agra g)(l := (agra g l) - {n}))(l' := (insert n (agra g l')))\n                     else (agra g))(cgra g)(lgra g)\"\n\ninductive state_transition_in :: \"[infrastructure, infrastructure] \\<Rightarrow> bool\" (\"(_ \\<rightarrow>\\<^sub>n _)\" 50)\nwhere\n  move: \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; l \\<in> nodes G; l' \\<in> nodes G;\n          (a) \\<in> actors_graph(graphI I); enables I l' (Actor a) move;\n         I' = Infrastructure (move_graph_a a l l' (graphI I))(delta I) \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\" \n| get : \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; a' @\\<^bsub>G\\<^esub> l; has G (Actor a, z);\n        enables I l (Actor a) get;\n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)\n                           ((cgra G)(Actor a' := \n                                (insert z (fst(cgra G (Actor a'))), snd(cgra G (Actor a')))))\n                           (lgra G))\n                   (delta I)\n         \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| get_data : \"G = graphI I \\<Longrightarrow> a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n        enables I l' (Actor a) get \\<Longrightarrow> \n       ((Actor a', as), n) \\<in> snd (lgra G l') \\<Longrightarrow> Actor a \\<in> as \\<Longrightarrow> \n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := (fst (lgra G l), \n                                   snd (lgra G l)  \\<union> {((Actor a', as), n)}))))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| process : \"G = graphI I \\<Longrightarrow> a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n        enables I l (Actor a) eval \\<Longrightarrow> \n       ((Actor a', as), n) \\<in> snd (lgra G l) \\<Longrightarrow> Actor a \\<in> as \\<Longrightarrow>\n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := (fst (lgra G l), \n                    snd (lgra G l)  - {((Actor a', as), n)}\n                    \\<union> {(f :: label_fun) \\<Updown> ((Actor a', as), n)}))))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"  \n| del_data : \"G = graphI I \\<Longrightarrow> a \\<in> actors G \\<Longrightarrow> l \\<in> nodes G \\<Longrightarrow>\n       ((Actor a, as), n) \\<in> snd (lgra G l) \\<Longrightarrow> \n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := (fst (lgra G l), snd (lgra G l) - {((Actor a, as), n)}))))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| put : \"G = graphI I \\<Longrightarrow> a @\\<^bsub>G\\<^esub> l \\<Longrightarrow> enables I l (Actor a) put \\<Longrightarrow>\n        I' = Infrastructure \n                  (Lgraph (gra G)(agra G)(cgra G)\n                          ((lgra G)(l := (s, snd (lgra G l) \\<union> {((Actor a, as), n)}))))\n                   (delta I)\n          \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n\ntext \\<open>Note that the type infrastructure can now be instantiated to the axiomatic type class \n      @{text\\<open>state\\<close>} which enables the use of the underlying Kripke structures and CTL.\\<close>\ninstantiation \"infrastructure\" :: state\nbegin\ndefinition \n   state_transition_infra_def: \"(i \\<rightarrow>\\<^sub>i i') =  (i \\<rightarrow>\\<^sub>n (i' :: infrastructure))\"\n\ninstance\n  by (rule MC.class.MC.state.of_class.intro)\n\ndefinition state_transition_in_refl (\"(_ \\<rightarrow>\\<^sub>n* _)\" 50)\nwhere \"s \\<rightarrow>\\<^sub>n* s' \\<equiv> ((s,s') \\<in> {(x,y). state_transition_in x y}\\<^sup>*)\"\n\nend\n      \nlemma move_graph_eq: \"move_graph_a a l l g = g\"  \n  by (simp add: move_graph_a_def, case_tac g, force)\n     \nend\n\n  ", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Attack_Trees/Infrastructure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.32062225838908404}}
{"text": "theory WTLemma\n  imports GenSubEnv WellTypedExp PermEnvMisc AltNormEnv \nbegin\n    \n    (* \n      ####################################\n        P2. general well-typed lemmas\n      ####################################\n    *)\n\nlemma well_typed_perm_leq: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> leq_use_env r_s2 r_s1\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n      apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name delta x) tau_x) r_ex)\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (simp)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac diff_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n       apply (auto)\n    apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n     apply (auto)\n   apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (simp)\n  apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n   apply (auto)\n  apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n   apply (auto)\n  apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n   apply (rule_tac self_diff_leq_use_env)\n  apply (simp)\n  done\n\nlemma well_typed_perm_leqx: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> leq_use_env rx r_s2\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n       apply (auto)\n    (* if case *)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (auto)\n  done\n\nlemma well_typed_spec_perm_leq: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> leq_perm (r_s2 x) (r_s1 x)\"\n  apply (cut_tac ?r_s2.0=\"r_s2\" and ?r_s1.0=\"r_s1\" in well_typed_perm_leq)\n   apply (auto)\n  apply (simp add: leq_use_env_def)\n  done       \n  \n    (* \n      ####################################\n        P3. well-typed free var lemmas\n      ####################################\n    *)\n    \nlemma well_typed_fv_env_use: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; x \\<in> free_vars e \\<rbrakk> \\<Longrightarrow> env (Var x) \\<noteq> None\"\n  (*apply (simp add: env_gen_use_def)*)\n  apply (induction e arbitrary: env tau r_s1 r_s2 rx)\n        apply (auto)\n   apply (case_tac xa)\n    apply (auto)\n  apply (case_tac \"\\<exists> y. add_env env (Var x1a) t1 (Var x) = Some y\")\n   apply (simp add: add_env_def)\n  apply (auto)\n  done\n    \nlemma well_typed_rv_env_use: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; x \\<in> ref_vars e \\<rbrakk> \\<Longrightarrow> env (Loc x) \\<noteq> None\"\n  (*apply (simp add: env_gen_use_def)*)\n  apply (induction e arbitrary: env tau r_s1 r_s2 rx)\n        apply (auto)\n   apply (case_tac xa)\n    apply (auto)\n  apply (case_tac \"\\<exists> y. add_env env (Var x1a) t1 (Loc x) = Some y\")\n   apply (simp add: add_env_def)\n   apply (auto)\n  done    \n\nlemma well_typed_no_npv_use: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; r_s1 x = NoPerm \\<rbrakk> \\<Longrightarrow> x \\<notin> non_prim_vars env delta e\"\n  apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n       apply (auto)\n    (* const + op case *)\n        apply (simp add: non_prim_vars_def)\n       apply (simp add: non_prim_vars_def)\n    (* var case. *)\n      apply (cut_tac r_x=\"ereq_use_env (owner_name delta xa) tau_x\" and r_s=\"r_s1\" in leq_use_none)\n        apply (auto)\n      apply (case_tac \"x \\<noteq> owner_name delta xa\")\n       apply (simp add: non_prim_vars_def)\n      apply (cut_tac x=\"x\" and tau=\"tau_x\" in ereq_use_none)\n       apply (auto)\n      apply (simp add: non_prim_vars_def)\n      apply (simp add: non_prim_entry_def)\n    (* pair case 1 *)\n     apply (case_tac \"x \\<notin> res_vars delta (PairExp e1 e2)\")\n      apply (simp add: non_prim_vars_def)\n     apply (auto)\n      apply (simp add: non_prim_vars_def)\n    (* pair case 2 *)\n     apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (simp add: non_prim_vars_def)\n    (* if case 1 *)\n    apply (case_tac \"x \\<notin> res_vars delta (IfExp e1 e2 e3)\")\n     apply (simp add: non_prim_vars_def)\n    apply (auto)\n      apply (case_tac \"x \\<notin> non_prim_vars env delta e1\")\n      apply (simp add: non_prim_vars_def)\n      apply (auto)\n    (* if case 2 *)\n     apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (case_tac \"x \\<notin> non_prim_vars env delta e2\")\n      apply (simp add: non_prim_vars_def)\n     apply (auto)\n    (* if case 3 *)\n     apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n    apply (case_tac \"x \\<notin> non_prim_vars env delta e3\")\n     apply (simp add: non_prim_vars_def)\n    apply (auto)\n    (* lambda case *)\n    apply (case_tac \"x \\<noteq> Var x1a\")\n     apply (auto)\n    apply (cut_tac r_x=\"rxa\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n      apply (auto)\n    apply (cut_tac r_s=\"rxa\" and y=\"Var x1a\" and r=\"r\" and x=\"x\" in add_use_none_rev)\n      apply (auto)\n    apply (case_tac \"x \\<notin> non_prim_vars (add_env env (Var x1a) t1) delta e\")\n     apply (simp add: non_prim_vars_def)\n     apply (auto)\n    apply (case_tac \"\\<not> non_prim_entry (add_env env (Var x1a) t1) x\")\n      apply (simp add: non_prim_entry_def)\n      apply (simp add: add_env_def)\n      apply (auto)\n   apply (simp add: non_prim_vars_def)\n    (* app case 1 *)\n  apply (case_tac \"x \\<notin> res_vars delta (AppExp e1 e2)\")\n   apply (simp add: non_prim_vars_def)\n  apply (auto)\n   apply (case_tac \"x \\<notin> non_prim_vars env delta e1\")\n    apply (simp add: non_prim_vars_def)\n   apply (auto)\n    (* app case 2 *)\n  apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"x\" in leq_use_none)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (case_tac \"x \\<notin> non_prim_vars env delta e2\")\n   apply (simp add: non_prim_vars_def)\n  apply (auto)\n  done\n    \nlemma well_typed_aff_fv_own: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; x \\<in> res_vars delta e; env x = Some t; req_type t = Aff \\<rbrakk> \\<Longrightarrow> r_s1 x = OwnPerm\"    \n  apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n       apply (auto)\n    (* var case *)\n       apply (case_tac \"ereq_use_env x t x \\<noteq> OwnPerm\")\n        apply (simp add: ereq_use_env_def)\n        apply (simp add: end_req_perm_def)\n        apply (simp add: one_use_env_def)\n       apply (cut_tac r_x=\"ereq_use_env x t\" and r_s=\"r_s1\" and x=\"x\" in leq_use_own)\n         apply (auto)\n    (* pair case 2 *)\n      apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n       apply (auto)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    (* if case 2 *)\n     apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n      apply (auto)\n     apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n     apply (auto)\n    (* if case 3 *)\n    apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n     apply (auto)\n    apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n    apply (auto)\n    (* lambda case *)\n   apply (rule_tac r_x=\"rxa\" in leq_use_own)\n    apply (auto)\n   apply (case_tac \"\\<not> add_use_env rxa (Var x1a) r x = OwnPerm\")\n    apply (auto)\n    apply (case_tac \"\\<not> add_env env (Var x1a) t1 x = Some t\")\n     apply (simp add: add_env_def)\n    apply (auto)\n   apply (simp add: add_use_env_def)\n    (* app case *)\n  apply (rule_tac r_x = \"r_s2a\" in leq_use_own)\n   apply (auto)\n  apply (rule_tac e=\"e1\" in well_typed_perm_leq)\n  apply (auto)\n  done\n\n    (* \n      ####################################\n        P4. well-typed manipulation for type environments\n      ####################################\n    *)\n\nlemma well_typed_add_vars: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; x \\<notin> free_vars e \\<rbrakk> \\<Longrightarrow> well_typed (add_env env (Var x) t) delta r_s1 e tau r_s2 rx\"       \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n        apply (simp add: add_env_def)\n        apply (case_tac xa)\n         apply (auto)\n       apply (simp add: add_env_def)\n       apply (case_tac xa)\n        apply (auto)\n    (* pair case *)\n      apply (rule_tac x=\"r_s2a\" in exI)\n      apply (rule_tac x=\"r_s3\" in exI)\n      apply (rule_tac x=\"rx1\" in exI)\n      apply (auto)\n      apply (rule_tac x=\"rx2\" in exI)\n      apply (auto)\n    (* if case *)\n     apply (rule_tac x=\"rx'\" in exI)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)    \n    (* lambda case 1 *)\n    apply (rule_tac x=\"rxa\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"r_end\" in exI)\n    apply (rule_tac x=\"r_s'\" in exI)\n    apply (case_tac \"x = x1a\")\n     apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t\" and t'=\"t1\" in double_add_env)\n     apply (auto)\n    apply (cut_tac env=\"env\" and x=\"Var x1a\" and y=\"Var x\" and t=\"t\" and t'=\"t1\" in almost_comm_add_env)\n     apply (auto)\n    (* lambda case 2 *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_end\" in exI)\n   apply (rule_tac x=\"r_s'\" in exI)\n   apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t\" and t'=\"t1\" in double_add_env)\n   apply (auto)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  done    \n\nlemma well_typed_rem_vars: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; x \\<notin> free_vars e \\<rbrakk> \\<Longrightarrow> well_typed (rem_env env (Var x)) delta r_s1 e tau r_s2 rx\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n        apply (simp add: rem_env_def)\n        apply (case_tac xa)\n         apply (auto)\n       apply (simp add: rem_env_def)\n       apply (case_tac xa)\n        apply (auto)\n    (* pair case *)\n      apply (rule_tac x=\"r_s2a\" in exI)\n      apply (rule_tac x=\"r_s3\" in exI)\n      apply (rule_tac x=\"rx1\" in exI)\n      apply (auto)\n      apply (rule_tac x=\"rx2\" in exI)\n      apply (auto)\n    (* if case *)\n     apply (rule_tac x=\"rx'\" in exI)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n    (* lambda case 1 *)\n    apply (rule_tac x=\"rxa\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"r_end\" in exI)\n    apply (rule_tac x=\"r_s'\" in exI)\n    apply (case_tac \"x = x1a\")\n     apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t1\" in partial_add_rem_env)\n    apply (auto)\n    apply (cut_tac env=\"env\" and x=\"Var x\" and y=\"Var x1a\" and t=\"t1\" in almost_comm_add_rem_env)\n     apply (auto)\n    (* lambda case 2 *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_end\" in exI)\n   apply (rule_tac x=\"r_s'\" in exI)\n   apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t1\" in partial_add_rem_env)\n   apply (auto)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  done   \n    \nlemma well_typed_add_varsx: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; env x = None \\<rbrakk> \\<Longrightarrow> well_typed (add_env env x t) delta r_s1 e tau r_s2 rx\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n       apply (simp add: add_env_def)\n       apply (case_tac xa)\n        apply (auto)\n      apply (simp add: add_env_def)\n      apply (case_tac xa)\n       apply (auto)\n    (* pair case *)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx1\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx2\" in exI)\n    apply (auto)\n    (* lambda case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_end\" in exI)\n   apply (rule_tac x=\"r_s'\" in exI)\n   apply (case_tac \"x = Var x1a\")\n    apply (cut_tac env=\"env\" and x=\"x\" and t=\"t\" and t'=\"t1\" in double_add_env)\n    apply (auto)\n   apply (cut_tac env=\"env\" and x=\"Var x1a\" and y=\"x\" and t=\"t\" and t'=\"t1\" in almost_comm_add_env)\n    apply (auto)\n   apply (simp add: add_env_def)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  done\n    \n(*\nlemma well_typed_add_vars2: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; x \\<notin> ref_vars e \\<rbrakk> \\<Longrightarrow> well_typed (add_env env (Loc x) t) delta r_s1 e tau r_s2 rx\"       \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n        apply (simp add: add_env_def)\n        apply (case_tac xa)\n         apply (auto)\n       apply (simp add: add_env_def)\n       apply (case_tac xa)\n        apply (auto)\n    (* pair case *)\n      apply (rule_tac x=\"r_s2a\" in exI)\n      apply (rule_tac x=\"r_s3\" in exI)\n      apply (rule_tac x=\"rx1\" in exI)\n      apply (auto)\n      apply (rule_tac x=\"rx2\" in exI)\n      apply (auto)\n    (* if case *)\n     apply (rule_tac x=\"rx'\" in exI)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)    \n    (* lambda case *)\n    apply (rule_tac x=\"rxa\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"r_end\" in exI)\n    apply (rule_tac x=\"r_s'\" in exI)\n    apply (cut_tac env=\"env\" and x=\"Var x1a\" and y=\"Loc x\" and t=\"t\" and t'=\"t1\" in almost_comm_add_env)\n     apply (auto)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  done*)\n\nlemma well_typed_add_vars_rev: \"\\<lbrakk> well_typed (add_env env (Var x) t) delta r_s1 e tau r_s2 rx; x \\<notin> free_vars e \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau r_s2 rx\"\n  apply (cut_tac env=\"add_env env (Var x) t\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and x=\"x\" in well_typed_rem_vars)\n    apply (auto)\n  apply (case_tac \"env (Var x) = None\")\n   apply (auto)\n   apply (cut_tac env=\"env\" and x=\"Var x\" and t=\"t\" in cancel_rem_add_env)\n    apply (auto)\n  apply (rule_tac t=\"well_typed env delta r_s1 e tau r_s2 rx\" and s=\"well_typed (add_env (rem_env env (Var x)) (Var x) y) delta r_s1 e tau r_s2 rx\" in subst)\n   apply (cut_tac env=\"env\" and x=\"Var x\" and y=\"y\" in cancel_add_rem_env)\n    apply (auto)\n  apply (rule_tac well_typed_add_vars)\n   apply (cut_tac env=\"env\" and x=\"Var x\" and y=\"t\" in partial_rem_add_env)\n   apply (auto)\n  done\n\nlemma well_typed_contain_env: \"\\<lbrakk> contain_env env env'; well_typed env' delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau r_s2 rx\"    \n  apply (induct e arbitrary: env env' r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n       apply (simp add: contain_env_def)\n       apply (erule_tac x=\"res_name x\" in allE)\n       apply (auto)\n      apply (simp add: contain_env_def)\n      apply (erule_tac x=\"owner_name delta x\" in allE)\n      apply (auto)\n    (* pair case *)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx1\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx2\" in exI)\n    apply (auto)\n    (* lam case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_end\" in exI)\n   apply (rule_tac x=\"r_s'\" in exI)\n   apply (cut_tac r_s=\"env\" and r_x=\"env'\" and x=\"Var x1a\" and t=\"t1\" in dist_add_contain_env)\n    apply (auto)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  done\n    \n    (* \n      ####################################\n        P5. well-typed manipulation for start permissions\n      ####################################\n    *)    \n    \nlemma well_typed_comp_start_perm: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> well_typed env delta (comp_use_env r_s1 r_ex) e tau r_s2 rx\"\n  apply (induction e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const, op, var case 1 *)\n         apply (rule_tac comp_leq_use_env1)\n         apply (simp)\n        apply (rule_tac comp_leq_use_env1)\n        apply (simp)\n       apply (rule_tac comp_leq_use_env1)\n       apply (simp)\n    (* var case 2 *)\n      apply (rule_tac x=\"r_exa\" in exI)\n      apply (auto)\n       apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name delta x) tau_x) r_exa)\" in trans_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (rule_tac self_comp_leq_use_env1)\n       apply (auto)\n      apply (rule_tac comp_leq_use_env1)\n      apply (simp)\n    (* pair case *)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"r_exa\" in exI)\n     apply (auto)\n     apply (rule_tac comp_leq_use_env1)\n     apply (simp)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (auto)\n    (* lambda case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n    apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n     apply (rule_tac comp_leq_use_env1)\n     apply (rule_tac id_leq_use_env)\n    apply (simp)\n   apply (rule_tac x=\"r_exa\" in exI)\n   apply (auto)\n    apply (rule_tac r_sb=\"diff_use_env r_s1 r_exa\" in trans_leq_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (rule_tac self_comp_leq_use_env1)\n    apply (simp)\n   apply (rule_tac comp_leq_use_env1)\n   apply (simp)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"r_exa\" in exI)\n  apply (auto)\n  apply (rule_tac comp_leq_use_env1)\n  apply (simp)\n  done\n  \nlemma well_typed_comp_start_perm2: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> well_typed env delta (comp_use_env r_ex r_s1) e tau r_s2 rx\"\n  apply (cut_tac r_s=\"r_ex\" and r_x=\"r_s1\" in comm_comp_use_env)\n  apply (auto)\n  apply (rule_tac well_typed_comp_start_perm)\n  apply (auto)\n  done    \n    \nlemma well_typed_incr_start_perm: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; leq_use_env r_s1 r_c \\<rbrakk> \\<Longrightarrow> well_typed env delta r_c e tau r_s2 rx\"\n  apply (cut_tac r_s=\"r_c\" and r_x=\"r_s1\" in cancel_comp_use_env2)\n   apply (auto)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and r_ex=\"r_c\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" in well_typed_comp_start_perm2)\n   apply (auto)\n  done\n    \n    (* \n      ####################################\n        P6. well-typed manipulation for sweeping changes\n      ####################################\n    *)        \n    \n    (* - diff perm lemmas *)\n    \nlemma wtdp_start_perm_req: \"\\<lbrakk> y \\<notin> own_env_vars r_x; leq_use_env (req_use_env y tau) r_s1 \\<rbrakk>\n       \\<Longrightarrow> leq_use_env (req_use_env y tau) (diff_use_env r_s1 r_x)\"        \n  apply (rule_tac r_s=\"r_s1\" in req_leq_use_env)\n   apply (simp)\n  apply (cut_tac r_s=\"r_s1\" and x=\"y\" and r_x=\"r_x\" in diff_use_eq)\n   apply (auto)\n  apply (simp add: own_env_vars_def)\n  done\n\nlemma weak_diff_req_use_env: \"weak_use_env (diff_use_env (req_use_env x tau) (req_use_env x tau))\"\n  apply (simp add: diff_use_env_def)\n  apply (simp add: weak_use_env_def)\n  apply (auto)\n  apply (case_tac \"req_use_env x tau xa\")\n    apply (auto)\n  done\n  \nlemma wtdp_disj_req_use_env2: \"\\<lbrakk> r_x x \\<noteq> OwnPerm \\<rbrakk> \\<Longrightarrow> disj_use_env r_x (diff_use_env (req_use_env x tau) (req_use_env x tau))\"\n  apply (cut_tac x=\"x\" and tau=\"tau\" in weak_diff_req_use_env)\n  apply (simp add: disj_use_env_def)\n  apply (auto)\n   apply (simp add: mini_disj_use_env_def)\n   apply (auto)\n   apply (rule_tac r_s=\"req_use_env x tau\" in leq_use_none)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (rule_tac req_use_none_alt)\n   apply (auto)\n  apply (simp add: mini_disj_use_env_def)\n  apply (auto)\n  apply (simp add: weak_use_env_def)\n  done\n    \nlemma wtdp_end_req: \"\\<lbrakk> non_prim_vars env delta e \\<inter> own_env_vars r_x = {}; x \\<in> res_vars delta e; env x = Some tau;\n  r_x x = OwnPerm \\<rbrakk> \\<Longrightarrow> end_req_perm tau = NoPerm\" \n  apply (case_tac \"x \\<in> non_prim_vars env delta e\")\n   apply (simp add: own_env_vars_def)\n   apply (auto)\n  apply (case_tac \"req_type tau \\<noteq> Prim\")\n   apply (simp add: non_prim_vars_def)\n   apply (simp add: non_prim_entry_def)\n  apply (simp add: end_req_perm_def)\n  done\n    \nlemma well_typed_diff_perms: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; non_prim_vars env delta e \\<inter> own_env_vars r_x = {} \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta (diff_use_env r_s1 r_x) e tau (diff_use_env r_s2 r_x) (diff_use_env rx r_x)\"\n  apply (induction e arbitrary: env r_s1 tau r_s2 rx r_x)\n       apply (auto)\n    (* const case *)\n          apply (rule_tac dist_diff_leq_use_env)\n          apply (simp)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (simp)\n    (* op case *)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (simp)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (simp)\n    (* var case p1. manipulation to show that x1a exists in r_s2 *)\n      apply (rule_tac mini_disj_diff_leq_use_env2)\n       apply (simp)\n      apply (simp add: ereq_use_env_def)\n      apply (simp add: mini_disj_use_env_def)\n      apply (simp add: one_use_env_def)\n      apply (auto)\n      apply (rule_tac env=\"env\" and e=\"VarExp x\" and r_x=\"r_x\" and x=\"owner_name delta x\" in wtdp_end_req)\n          apply (auto)\n    (* var case p2 *)\n     apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n     apply (auto)\n        apply (rule_tac rhs_fold_dcl_use_env)\n        apply (rule_tac rhs_flip_use_env)\n        apply (rule_tac rhs_pull_comp_use_env)\n        apply (cut_tac r_ex=\"r_ex\" and r_x=\"r_x\" in sum_comp_diff_use_env)\n        apply (auto)\n        apply (rule_tac rhs_unroll_dcl_use_env)\n        apply (rule_tac rhs_unroll_dcl_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (rule_tac rhs_fold_dcl_use_env)\n        apply (simp)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (simp)\n    (* - use disjointess of r_x from (req x tau) to remove - r_x *)\n     apply (rule_tac disj_diff_leq_use_env)\n      apply (simp add: ereq_use_env_def)\n      apply (simp add: disj_use_env_def)\n      apply (auto)\n       apply (rule_tac one_mini_disj_use_env1)\n       apply (auto)\n       apply (rule_tac env=\"env\" and e=\"VarExp x\" and r_x=\"r_x\" and x=\"owner_name delta x\" in wtdp_end_req)\n           apply (auto)\n      apply (rule_tac one_mini_disj_use_env2)\n      apply (auto)\n      apply (simp add: comp_use_env_def)\n      apply (simp add: one_use_env_def)\n    (* - through a slightly more involved process we can also remove it from the left *)\n     apply (rule_tac lhs_unroll_dcl_use_env)\n     apply (rule_tac r_sb=\"diff_use_env (diff_use_env (ereq_use_env (owner_name delta x) tau_x) (ereq_use_env (owner_name delta x) tau_x)) r_ex\" in trans_leq_use_env)\n       apply (rule_tac lhs_fold_dcl_use_env)\n       apply (simp)\n      apply (rule_tac lhs_ddl_use_env)\n      apply (rule_tac comm_disj_use_env)\n      apply (simp add: ereq_use_env_def)\n      apply (simp add: disj_use_env_def)\n      apply (auto)\n       apply (rule_tac one_mini_disj_use_env1)\n       apply (auto)\n       apply (rule_tac env=\"env\" and e=\"VarExp x\" and r_x=\"r_x\" and x=\"owner_name delta x\" in wtdp_end_req)\n          apply (auto)\n     apply (rule_tac one_mini_disj_use_env2)\n     apply (auto)\n      apply (simp add: one_use_env_def)\n    (* pair case *)\n     apply (rule_tac x=\"diff_use_env r_s2a r_x\" in exI)\n     apply (rule_tac x=\"diff_use_env r_s3 r_x\" in exI)\n     apply (rule_tac x=\"diff_use_env rx1 r_x\" in exI)\n     apply (auto)\n      apply (case_tac \"\\<not> non_prim_vars env delta e1 \\<inter> own_env_vars r_x = {}\")\n       apply (simp add: non_prim_vars_def)\n       apply (auto)\n     apply (rule_tac x=\"diff_use_env rx2 r_x\" in exI)\n     apply (auto)\n           apply (case_tac \"\\<not> non_prim_vars env delta e2 \\<inter> own_env_vars r_x = {}\")\n            apply (simp add: non_prim_vars_def)\n            apply (auto)\n          (*apply (rule_tac aff_diff_use_env)\n          apply (simp)*)\n          apply (rule_tac t=\"lift_use_env (diff_use_env rx1 r_x) r\" and s=\"diff_use_env (lift_use_env rx1 r) r_x\" in subst)\n           apply (rule_tac lift_diff_use_env)\n          apply (rule_tac dist_diff_leq_use_env)\n          apply (simp)\n         apply (rule_tac t=\"lift_use_env (diff_use_env rx2 r_x) r\" and s=\"diff_use_env (lift_use_env rx2 r) r_x\" in subst)\n          apply (rule_tac lift_diff_use_env)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (simp)\n      apply (rule_tac r_s=\"lift_use_env rx1 r\" in disj_leq_use_env1)\n       apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n        apply (simp)\n       apply (rule_tac dist_lift_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (rule_tac dist_lift_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n     apply (auto)\n        apply (rule_tac t=\"diff_use_env (diff_use_env r_s3 r_x) (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env r_s3 r_ex) r_x\" in subst)\n         apply (rule_tac dist_sq_diff_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (simp)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (simp)\n     apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n      apply (simp add: pair_req_def)\n      apply (auto)\n      apply (rule_tac leq_empty_use_env)     \n     apply (simp add: pair_req_def)\n     apply (rule_tac t=\"lift_use_env (diff_use_env rx1 r_x) r\" and s=\"diff_use_env (lift_use_env rx1 r) r_x\" in subst)\n      apply (rule_tac lift_diff_use_env)\n     apply (rule_tac t=\"lift_use_env (diff_use_env rx2 r_x) r\" and s=\"diff_use_env (lift_use_env rx2 r) r_x\" in subst)\n      apply (rule_tac lift_diff_use_env)\n     apply (simp add: dist_diff_comp_use_env)\n     apply (rule_tac t=\"diff_use_env (diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_x)\n        (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex) r_x\" in subst)\n      apply (rule_tac dist_sq_diff_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (simp)\n    (* if case *)\n    apply (rule_tac x=\"diff_use_env rx' r_x\" in exI)\n    apply (rule_tac x=\"diff_use_env r_s2a r_x\" in exI)\n    apply (auto)\n     apply (case_tac \"\\<not> non_prim_vars env delta e1 \\<inter> own_env_vars r_x = {}\")\n      apply (simp add: non_prim_vars_def)\n      apply (auto)\n    apply (rule_tac x=\"diff_use_env rx1 r_x\" in exI)\n    apply (auto)\n     apply (case_tac \"\\<not> non_prim_vars env delta e2 \\<inter> own_env_vars r_x = {}\")\n      apply (simp add: non_prim_vars_def)\n      apply (auto)\n    apply (rule_tac x=\"diff_use_env rx2 r_x\" in exI)\n    apply (auto)\n     apply (case_tac \"\\<not> non_prim_vars env delta e3 \\<inter> own_env_vars r_x = {}\")\n      apply (simp add: non_prim_vars_def)\n      apply (auto)\n    apply (simp add: dist_diff_comp_use_env)\n    (* lambda case *)\n   apply (rule_tac x=\"diff_use_env rxa r_x\" in exI)\n   apply (auto)\n      apply (rule_tac x=\"diff_use_env r_end (rem_use_env r_x (Var x1a))\" in exI)\n      apply (rule_tac x=\"diff_use_env r_s' (rem_use_env r_x (Var x1a))\" in exI)\n      apply (cut_tac r_s=\"rxa\" and x=\"Var x1a\" and r=\"r\" and r_x=\"r_x\" in diff_add_rem_use_env)\n      apply (auto)\n      apply (case_tac \"\\<not> non_prim_vars (add_env env (Var x1a) t1) delta e \\<inter> own_env_vars (rem_use_env r_x (Var x1a)) = {}\")\n       apply (auto)\n      apply (simp add: rem_use_env_def)\n      apply (simp add: own_env_vars_def)\n      apply (case_tac \"x = Var x1a\")\n       apply (auto)\n      apply (simp add: non_prim_vars_def)\n      apply (simp add: non_prim_entry_def)\n      apply (simp add: add_env_def)\n      apply (auto)\n     apply (rule_tac aff_diff_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env)\n    apply (simp)\n   apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n   apply (auto)\n    (* - proving bounds *)\n      apply (rule_tac t=\"diff_use_env (diff_use_env r_s1 r_x) (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env r_s1 r_ex) r_x\" in subst)\n       apply (cut_tac r_s=\"r_s1\" and r_x=\"r_ex\" and r_ex=\"r_x\" in dist_sq_diff_use_env)\n       apply (auto)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (simp)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env)\n    apply (simp)\n   apply (rule_tac t=\"diff_use_env (diff_use_env rxa r_x) (diff_use_env r_ex r_x)\" and s=\"diff_use_env (diff_use_env rxa r_ex) r_x\" in subst)\n    apply (cut_tac r_s=\"rxa\" and r_x=\"r_ex\" and r_ex=\"r_x\" in dist_sq_diff_use_env)\n    apply (auto)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (simp)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"diff_use_env r_s2a r_x\" in exI)\n  apply (rule_tac x=\"diff_use_env rx1 r_x\" in exI)\n  apply (auto)\n   apply (case_tac \"\\<not> non_prim_vars env delta e1 \\<inter> own_env_vars r_x = {}\")\n    apply (simp add: non_prim_vars_def)\n    apply (auto)\n  apply (rule_tac x=\"diff_use_env rx2 r_x\" in exI)\n  apply (rule_tac x=\"diff_use_env r_s3 r_x\" in exI)\n  apply (auto)\n   apply (case_tac \"\\<not> non_prim_vars env delta e2 \\<inter> own_env_vars r_x = {}\")\n    apply (simp add: non_prim_vars_def)\n    apply (auto)\n    (* - reusable substitutions *)\n  apply (case_tac \"\\<not> lift_use_env (diff_use_env rx2 r_x) r = diff_use_env (lift_use_env rx2 r) r_x\")\n   apply (cut_tac r_s=\"rx2\" and r=\"r\" and r_x=\"r_x\" in lift_diff_use_env)\n   apply (simp)\n    (* - last instantiation *)\n  apply (rule_tac x=\"diff_use_env r_ex r_x\" in exI)\n  apply (auto)\n    (* - prove the bound for r_s2 *)\n        apply (rule_tac rhs_fold_dcl_use_env)\n        apply (rule_tac rhs_flip_use_env)\n        apply (rule_tac rhs_unroll_dcl_use_env)\n        apply (rule_tac rhs_diff_leq_use_env)\n        apply (rule_tac r_sb=\"diff_use_env (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) r_x\" in trans_leq_use_env)\n         apply (rule_tac lhs_fold_dcl_use_env)\n         apply (rule_tac lhs_flip_use_env)\n         apply (rule_tac lhs_unroll_dcl_use_env)\n         apply (rule_tac unroll_dcl_use_env)\n         apply (rule_tac dist_diff_leq_use_env_gen)\n          apply (rule_tac dist_diff_leq_use_env_gen)\n           apply (rule_tac self_diff_leq_use_env)\n          apply (rule_tac dist_comp_leq_use_env)\n           apply (rule_tac comp_leq_use_env1)\n           apply (rule_tac self_diff_leq_use_env)\n          apply (rule_tac comp_leq_use_env2)\n          apply (rule_tac self_diff_leq_use_env)\n         apply (rule_tac self_diff_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (simp)\n    (* - prove lift safety *)\n    (* - prove rx1 + rx2 is subtractable *)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_x\" in trans_leq_use_env)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (rule_tac self_comp_leq_use_env1)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env2)\n    (* - prove disjointedness *)\n     apply (rule_tac r_s=\"rx1\" in disj_leq_use_env1)\n      apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n       apply (simp)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (rule_tac self_diff_leq_use_env)\n    apply (rule_tac dist_diff_leq_use_env)\n    apply (simp)\n    (* - prove r_ex bound *)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (simp)\n    (* - prove the bound for rx *)\n  apply (simp add: app_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac t=\"comp_use_env (diff_use_env rx1 r_x) (diff_use_env rx2 r_x)\" and s=\"diff_use_env (comp_use_env rx1 rx2) r_x\" in subst)\n   apply (simp add: dist_diff_comp_use_env) \n  apply (rule_tac t=\"comp_use_env (diff_use_env rx1 r_x) (diff_use_env (lift_use_env rx2 r) r_x)\" and\n      s=\"diff_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_x\" in subst)\n   apply (simp add: dist_diff_comp_use_env)\n  apply (rule_tac t=\"comp_use_env (diff_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_x) (diff_use_env r_ex r_x)\" and\n      s=\"diff_use_env (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex) r_x\" in subst)\n   apply (simp add: dist_diff_comp_use_env)\n  apply (rule_tac t=\"diff_use_env (diff_use_env (comp_use_env rx1 rx2) r_x) (diff_use_env (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex) r_x)\" and\n      s=\"diff_use_env (diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) r_x\" in subst)\n   apply (rule_tac dist_sq_diff_use_env)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (simp)\n  done \n\nlemma well_typed_disj_diff_perms: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; mini_disj_use_env r_ex r_s1 \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta (diff_use_env r_s1 r_ex) e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex)\"    \n  apply (rule_tac well_typed_diff_perms)\n   apply (simp)\n  apply (auto)\n  apply (case_tac \"r_s1 x = NoPerm\")\n   apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and x=\"x\" in well_typed_no_npv_use)\n     apply (auto)\n  apply (simp add: own_env_vars_def)\n  apply (simp add: mini_disj_use_env_def)\n  done \n\nlemma well_typed_rem_perms: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; x \\<notin> non_prim_vars env delta e \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta (rem_use_env r_s1 x) e tau (rem_use_env r_s2 x) (rem_use_env rx x)\"  \n  apply (cut_tac r_s=\"r_s1\" and x=\"x\" in diff_rem_use_env)\n  apply (cut_tac r_s=\"r_s2\" and x=\"x\" in diff_rem_use_env)\n  apply (cut_tac r_s=\"rx\" and x=\"x\" in diff_rem_use_env)\n  apply (auto)\n  apply (rule_tac well_typed_diff_perms)\n   apply (auto)\n  apply (simp add: one_use_env_def)\n  apply (simp add: own_env_vars_def)\n  apply (case_tac \"x = xa\")\n   apply (auto)\n  done\n\nlemma well_typed_add_perms_rev: \"\\<lbrakk> well_typed env delta (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r') (add_use_env rx x r3);\n  r_s1 x = NoPerm; r_s2 x = NoPerm; rx x = NoPerm; x \\<notin> non_prim_vars env delta e \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau r_s2 rx\"\n  apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in cancel_rem_add_use_env)\n   apply (auto)\n  apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r'\" in cancel_rem_add_use_env)\n   apply (auto)\n  apply (cut_tac r_s=\"rx\" and x=\"x\" and r=\"r3\" in cancel_rem_add_use_env)\n   apply (auto)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"add_use_env r_s1 x r\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"add_use_env r_s2 x r'\" and rx=\"add_use_env rx x r3\" and x=\"x\" in well_typed_rem_perms)\n    apply (auto)\n  done\n\nlemma wtapr_ex: \"\\<lbrakk>leq_use_env rxa (add_use_env r_s1 x r);\n     leq_use_env r_s2 (diff_use_env (add_use_env r_s1 x r) r_ex); leq_use_env rx r_s2; leq_use_env r_ex (add_use_env r_s1 x r);\n     leq_use_env (diff_use_env rxa r_ex) rx\\<rbrakk>\n    \\<Longrightarrow> \\<exists>r_ex. leq_use_env (rem_use_env r_s2 x) (diff_use_env r_s1 r_ex) \\<and>\n               leq_use_env (rem_use_env rx x) (rem_use_env r_s2 x) \\<and>\n               leq_use_env r_ex r_s1 \\<and> leq_use_env (diff_use_env (rem_use_env rxa x) r_ex) (rem_use_env rx x)\"  \n  apply (rule_tac x=\"rem_use_env r_ex x\" in exI)\n  apply (auto)\n     apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n     apply (rule_tac r_sb=\"add_use_env (diff_use_env r_s1 r_ex) x r\" in trans_leq_use_env)\n      apply (rule_tac dist_add_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env_gen)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac self_rem_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env (add_use_env r_s1 x r) r_ex\" in trans_leq_use_env)\n      apply (rule_tac add_diff_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_rem_leq_use_env)\n    apply (simp)\n   apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n   apply (simp)\n  apply (rule_tac t=\"diff_use_env (rem_use_env rxa x) (rem_use_env r_ex x)\" and s=\"rem_use_env (diff_use_env rxa r_ex) x\" in subst)\n   apply (rule_tac dist_diff_rem_use_env)\n  apply (rule_tac dist_rem_leq_use_env)\n  apply (simp)  \n  done\n\nlemma wtapr_helper: \"\\<lbrakk>\\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env delta (add_use_env r_s1 (Var x1a) r) e tau r_s2 rx; Var x1a \\<notin> res_vars delta e\\<rbrakk>\n           \\<Longrightarrow> well_typed env delta r_s1 e tau (rem_use_env r_s2 (Var x1a)) (rem_use_env rx (Var x1a));\n        well_typed (add_env env (Var x1a) t1) delta (add_use_env rxa (Var x1a) ra) e t2 r_s' r_end; aff_use_env rxa a;\n        leq_use_env rxa (add_use_env r_s1 (Var x1a) r); leq_use_env r_s2 (diff_use_env (add_use_env r_s1 (Var x1a) r) r_ex); leq_use_env rx r_s2;\n        leq_use_env r_ex (add_use_env r_s1 (Var x1a) r); leq_use_env (diff_use_env rxa r_ex) rx; x = Var x1a\\<rbrakk>\n       \\<Longrightarrow> \\<exists>rxa. (\\<exists>r_end r_s'. well_typed (add_env env (Var x1a) t1) delta (add_use_env rxa (Var x1a) ra) e t2 r_s' r_end) \\<and>\n                 aff_use_env rxa a \\<and>\n                 leq_use_env rxa r_s1 \\<and>\n                 (\\<exists>r_ex. leq_use_env (rem_use_env r_s2 (Var x1a)) (diff_use_env r_s1 r_ex) \\<and>\n                         leq_use_env (rem_use_env rx (Var x1a)) (rem_use_env r_s2 (Var x1a)) \\<and>\n                         leq_use_env r_ex r_s1 \\<and> leq_use_env (diff_use_env rxa r_ex) (rem_use_env rx (Var x1a)))\"\n  apply (rule_tac x=\"rem_use_env rxa x\" in exI)\n  apply (auto)\n     apply (rule_tac t=\"add_use_env (rem_use_env rxa (Var x1a)) (Var x1a) ra\" and s=\"add_use_env rxa (Var x1a) ra\" in subst)\n      apply (rule_tac partial_add_rem_use_env)\n     apply (auto)\n    apply (rule_tac aff_rem_use_env)\n    apply (simp)\n   apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n   apply (simp)\n  apply (rule_tac wtapr_ex)\n  apply (auto)\n  done\n    \nlemma well_typed_add_perms_rev2: \"\\<lbrakk> well_typed env delta (add_use_env r_s1 x r) e tau r_s2 rx; x \\<notin> res_vars delta e \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta r_s1 e tau (rem_use_env r_s2 x) (rem_use_env rx x)\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const + op cases *)\n            apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n            apply (auto)\n           apply (rule_tac dist_rem_leq_use_env)\n           apply (auto)\n          apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n          apply (auto)\n         apply (rule_tac dist_rem_leq_use_env)\n         apply (auto)\n    (* var cases *)\n        apply (rule_tac r_sb=\"rem_use_env (ereq_use_env (owner_name delta xa) tau_x) x\" in trans_leq_use_env)\n         apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n         apply (auto)\n        apply (rule_tac rhs_rem_leq_use_env)\n         apply (simp add: ereq_use_env_def)\n         apply (simp add: one_use_env_def)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac x=\"rem_use_env r_ex x\" in exI)\n       apply (auto)\n          apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n          apply (rule_tac r_sb=\"add_use_env (diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name delta xa) tau_x) r_ex)) x r\" in trans_leq_use_env)\n           apply (rule_tac dist_add_leq_use_env)\n           apply (rule_tac dist_diff_leq_use_env_gen)\n            apply (rule_tac id_leq_use_env)\n           apply (rule_tac dist_comp_leq_use_env)\n            apply (rule_tac self_comp_leq_use_env1)\n           apply (rule_tac comp_leq_use_env2)\n           apply (rule_tac self_rem_leq_use_env)\n          apply (rule_tac r_sb=\"diff_use_env (add_use_env r_s1 x r) (comp_use_env (ereq_use_env (owner_name delta xa) tau_x) r_ex)\" in trans_leq_use_env)\n           apply (rule_tac add_diff_leq_use_env)\n          apply (simp)\n         apply (rule_tac dist_rem_leq_use_env)\n         apply (simp)\n        apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n        apply (auto)\n       apply (rule_tac r_sb=\"rem_use_env (diff_use_env (ereq_use_env (owner_name delta xa) tau_x) (comp_use_env (ereq_use_env (owner_name delta xa) tau_x) r_ex)) x\" in trans_leq_use_env)\n        apply (rule_tac dist_rem_leq_use_env)\n        apply (simp)\n       apply (simp add: dist_diff_rem_use_env)\n       apply (rule_tac dist_diff_leq_use_env_gen)\n        apply (rule_tac rhs_rem_leq_use_env)\n         apply (simp add: ereq_use_env_def)\n         apply (simp add: one_use_env_def)\n        apply (rule_tac id_leq_use_env)\n       apply (simp add: dist_rem_comp_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac comp_leq_use_env1)\n        apply (rule_tac self_rem_leq_use_env)\n       apply (rule_tac self_comp_leq_use_env2)\n    (* pair case *)\n      apply (rule_tac x=\"rem_use_env r_s2a x\" in exI)\n      apply (rule_tac x=\"rem_use_env r_s3 x\" in exI)\n      apply (rule_tac x=\"rem_use_env rx1 x\" in exI)\n      apply (auto)\n      apply (rule_tac x=\"rem_use_env rx2 x\" in exI)\n      apply (auto)\n            apply (rule_tac well_typed_rem_perms)\n             apply (simp_all)\n            apply (simp add: non_prim_vars_def)\n           apply (simp add: lift_rem_use_env)\n           apply (rule_tac dist_rem_leq_use_env)\n           apply (simp)\n          apply (simp add: lift_rem_use_env)\n          apply (rule_tac dist_rem_leq_use_env)\n          apply (simp)(*\n         apply (rule_tac safe_lift_rem_use_env)\n         apply (simp)\n        apply (rule_tac safe_lift_rem_use_env)\n        apply (simp)*)\n       apply (simp add: lift_rem_use_env)\n       apply (rule_tac r_s=\"lift_use_env rx1 ra\" in disj_leq_use_env1)\n        apply (rule_tac r_s=\"lift_use_env rx2 ra\" in disj_leq_use_env2)\n         apply (simp)\n        apply (rule_tac self_rem_leq_use_env)\n       apply (rule_tac self_rem_leq_use_env)\n      apply (rule_tac x=\"rem_use_env r_ex x\" in exI)\n      apply (auto)\n         apply (rule_tac t=\"diff_use_env (rem_use_env r_s3 x) (rem_use_env r_ex x)\" and s=\"rem_use_env (diff_use_env r_s3 r_ex) x\" in subst)\n          apply (rule_tac dist_diff_rem_use_env)\n         apply (rule_tac dist_rem_leq_use_env)\n         apply (simp)\n        apply (rule_tac dist_rem_leq_use_env)\n        apply (simp)\n       apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n       apply (auto)\n      apply (case_tac \"req_type (PairTy t1 t2 ra) = Prim\")\n       apply (simp add: pair_req_def)\n       apply (rule_tac leq_empty_use_env)\n      apply (simp add: pair_req_def)\n      apply (rule_tac r_sb=\"rem_use_env (diff_use_env (comp_use_env (lift_use_env rx1 ra) (lift_use_env rx2 ra)) r_ex) x\" in trans_leq_use_env)\n       apply (rule_tac dist_rem_leq_use_env)\n       apply (simp)\n      apply (simp add: dist_diff_rem_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (simp add: dist_rem_comp_use_env)\n      apply (simp add: lift_rem_use_env)\n      apply (rule_tac id_leq_use_env)\n    (* if case *)\n     apply (rule_tac x=\"rem_use_env rx' x\" in exI)\n     apply (rule_tac x=\"rem_use_env r_s2a x\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rem_use_env rx1 x\" in exI)\n     apply (auto)\n      apply (rule_tac well_typed_rem_perms)\n       apply (simp)\n      apply (simp add: non_prim_vars_def)\n     apply (rule_tac x=\"rem_use_env rx2 x\" in exI)\n     apply (auto)\n      apply (rule_tac well_typed_rem_perms)\n       apply (simp)\n      apply (simp add: non_prim_vars_def)\n     apply (simp add: dist_rem_comp_use_env)\n    (* lam case 1. x \\<noteq> x1a *)\n    apply (case_tac \"x \\<noteq> Var x1a\")\n     apply (auto)\n     apply (rule_tac x=\"rem_use_env rxa x\" in exI)\n     apply (auto)\n        apply (rule_tac t=\"add_use_env (rem_use_env rxa x) (Var x1a) ra\" and s=\"rem_use_env (add_use_env rxa (Var x1a) ra) x\" in subst)\n         apply (rule_tac almost_comm_rem_add_use_env)\n         apply (auto)\n        apply (rule_tac x=\"rem_use_env r_end x\" in exI)\n        apply (rule_tac x=\"rem_use_env r_s' x\" in exI)\n        apply (rule_tac well_typed_rem_perms)\n         apply (auto)\n        apply (simp add: non_prim_vars_def)\n       apply (rule_tac aff_rem_use_env)\n       apply (simp)\n      apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n      apply (simp) \n     apply (rule_tac wtapr_ex)\n         apply (auto)\n    (* lam case 1b / 2. x = x1a *)\n    apply (rule_tac wtapr_helper)\n           apply (auto)\n   apply (rule_tac wtapr_helper)\n          apply (auto)\n    (* app case. *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"ra\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"rem_use_env r_s2a x\" in exI)\n  apply (rule_tac x=\"rem_use_env rx1 x\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rem_use_env rx2 x\" in exI)\n  apply (rule_tac x=\"rem_use_env r_s3 x\" in exI)\n  apply (auto)\n   apply (rule_tac well_typed_rem_perms)\n    apply (auto)\n   apply (simp add: non_prim_vars_def)\n  apply (rule_tac x=\"rem_use_env r_ex x\" in exI)\n  apply (auto)\n        apply (rule_tac r_sb=\"rem_use_env (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_ex)) x\" in trans_leq_use_env)\n         apply (simp add: dist_diff_rem_use_env)\n         apply (rule_tac dist_diff_leq_use_env_gen)\n          apply (rule_tac id_leq_use_env)\n         apply (simp add: dist_rem_comp_use_env)\n         apply (simp add: lift_rem_use_env)\n         apply (rule_tac id_leq_use_env)\n        apply (rule_tac dist_rem_leq_use_env)\n        apply (simp)(*\n       apply (rule_tac safe_lift_rem_use_env)\n       apply (simp)*)\n      apply (simp add: lift_rem_use_env)\n      apply (rule_tac r_sb=\"rem_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) x\" in trans_leq_use_env)\n       apply (rule_tac dist_rem_leq_use_env)\n       apply (simp)\n      apply (simp add: dist_rem_comp_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (simp add: lift_rem_use_env)\n     apply (rule_tac r_s=\"rx1\" in disj_leq_use_env1)\n      apply (rule_tac r_s=\"lift_use_env rx2 ra\" in disj_leq_use_env2)\n       apply (simp)\n      apply (rule_tac self_rem_leq_use_env)\n     apply (rule_tac self_rem_leq_use_env)\n    apply (rule_tac dist_rem_leq_use_env)\n    apply (simp)\n   apply (rule_tac r=\"r\" in rem_add_leq_use_env)\n   apply (simp)\n  apply (simp add: app_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac r_sb=\"rem_use_env (diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_ex)) x\" in trans_leq_use_env)\n   apply (rule_tac dist_rem_leq_use_env)\n   apply (simp)\n  apply (simp add: dist_diff_rem_use_env)\n  apply (simp add: lift_rem_use_env)\n  apply (simp add: dist_rem_comp_use_env)\n  apply (rule_tac id_leq_use_env)\n  done        \n    \n    (* \n      ####################################\n        P7. well-typed manipulation for permission changes\n      ####################################\n    *)    \n\nlemma well_typed_comp_perms_gen: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; mini_disj_use_env r_s1 r_ex \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta (comp_use_env r_s1 r_ex) e tau (comp_use_env r_s2 r_ex) rx\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n       apply (auto)\n    (* const case *)\n           apply (rule_tac dist_comp_leq_use_env)\n            apply (rule_tac comp_leq_use_env1)\n            apply (simp)\n           apply (rule_tac comp_leq_use_env2)\n           apply (rule_tac id_leq_use_env)\n          apply (rule_tac comp_leq_use_env1)\n          apply (simp)\n    (* op case *)\n         apply (rule_tac dist_comp_leq_use_env)\n          apply (rule_tac comp_leq_use_env1)\n          apply (simp)\n         apply (rule_tac comp_leq_use_env2)\n         apply (rule_tac id_leq_use_env)\n        apply (rule_tac comp_leq_use_env1)\n        apply (simp)\n    (* var case *)\n       apply (rule_tac comp_leq_use_env1)\n       apply (simp)\n      apply (rule_tac x=\"r_exa\" in exI)\n      apply (auto)\n    (* - first half of end permission bounds check *)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name delta x) tau_x) r_exa)\" in trans_leq_use_env)\n          apply (rule_tac dist_diff_leq_use_env)\n          apply (rule_tac self_comp_leq_use_env1)\n         apply (simp)\n    (* - second half of end permission bounds check *)\n        apply (rule_tac rhs_dist_dcl_use_env)\n        apply (rule_tac comp_leq_use_env2)\n        apply (rule_tac mini_disj_diff_leq_use_env)\n         apply (rule_tac id_leq_use_env)\n        apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n         apply (simp)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (auto)\n    (* - various bounds checks *)\n       apply (rule_tac comp_leq_use_env1)\n       apply (simp)\n      apply (rule_tac comp_leq_use_env1)\n      apply (simp)\n    (* pair case *)\n     apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n     apply (rule_tac x=\"comp_use_env r_s3 r_ex\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n        apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and r_ex=\"r_ex\" in mini_disj_leq_use_env1)\n          apply (simp)\n         apply (rule_tac well_typed_perm_leq)\n         apply (auto)\n       apply (rule_tac comp_leq_use_env1)\n       apply (simp)\n      apply (rule_tac comp_leq_use_env1)\n      apply (simp)\n     apply (rule_tac x=\"r_exa\" in exI)\n     apply (auto)\n       apply (rule_tac rhs_dist_dcl_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac comp_leq_use_env1)\n        apply (simp)\n       apply (rule_tac comp_leq_use_env2)\n       apply (rule_tac mini_disj_diff_leq_use_env)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n        apply (simp_all)\n      apply (rule_tac comp_leq_use_env1)\n      apply (simp)\n     apply (rule_tac comp_leq_use_env1)\n     apply (simp)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n    apply (auto)\n    apply (cut_tac r_s=\"r_s1\" and r_x=\"r_s2a\" and r_ex=\"r_ex\" in mini_disj_leq_use_env1)\n      apply (simp)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (rule_tac x=\"rx1\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx2\" in exI)\n    apply (auto)\n    (* lambda case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n    apply (rule_tac comp_leq_use_env1)\n    apply (simp)\n   apply (rule_tac x=\"r_exa\" in exI)\n   apply (auto)\n     apply (rule_tac rhs_dist_dcl_use_env)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac comp_leq_use_env1)\n      apply (simp)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac mini_disj_diff_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n      apply (auto)\n    apply (rule_tac comp_leq_use_env1)\n    apply (simp)\n   apply (rule_tac comp_leq_use_env1)\n   apply (simp)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"comp_use_env r_s2a r_ex\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"comp_use_env r_s3 r_ex\" in exI)\n  apply (auto)\n   apply (cut_tac r_s=\"r_s1\" and r_x=\"r_s2a\" and r_ex=\"r_ex\" in mini_disj_leq_use_env1)\n     apply (simp)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (cut_tac r_sa=\"r_s1\" and r_sb=\"r_s2a\" and r_sc=\"r_s3\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (rule_tac x=\"r_exa\" in exI)\n  apply (auto)\n    (* - first half of end permissions bounds check *)\n     apply (rule_tac rhs_dist_dcl_use_env)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac comp_leq_use_env1)\n      apply (simp)\n    (* - second half of end permissions bounds check *)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac mini_disj_diff_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in mini_disj_leq_use_env1)\n      apply (simp)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (auto)\n    (* - final bounds checks *)\n    apply (rule_tac comp_leq_use_env1)\n    apply (simp)\n   apply (rule_tac comp_leq_use_env1)\n   apply (simp)\n  apply (rule_tac comp_leq_use_env1)\n  apply (simp)\n  done    \n \nlemma well_typed_comp_perms: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; disj_use_env r_s1 r_ex \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta (comp_use_env r_s1 r_ex) e tau (comp_use_env r_s2 r_ex) rx\"\n  apply (rule_tac well_typed_comp_perms_gen)\n   apply (simp)\n  apply (simp add: disj_use_env_def)\n  done\n\nlemma well_typed_comp_perms2: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; disj_use_env r_s1 r_ex \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta (comp_use_env r_ex r_s1) e tau (comp_use_env r_ex r_s2) rx\"    \n  apply (cut_tac r_s=\"r_ex\" and r_x=\"r_s1\" in comm_comp_use_env)  \n  apply (cut_tac r_s=\"r_ex\" and r_x=\"r_s2\" in comm_comp_use_env)\n  apply (auto)\n  apply (rule_tac well_typed_comp_perms)\n   apply (auto)\n  done           \n    \nlemma well_typed_add_perms: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; x \\<notin> non_prim_vars env delta e; r = OwnPerm; rx x = NoPerm \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r) rx\"\n  apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n  apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n  apply (cut_tac r_s=\"rx\" and x=\"x\" in ignore_rem_use_env)\n   apply (simp)\n  apply (cut_tac r_s=\"rem_use_env r_s1 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n   apply (auto)\n  apply (cut_tac r_s=\"rem_use_env r_s2 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n    apply (auto)\n  apply (rule_tac well_typed_comp_perms)\n   apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and x=\"x\" in well_typed_rem_perms)\n     apply (auto)\n  apply (rule_tac disj_one_use_env)\n  apply (simp add: rem_use_env_def)\n  done    \n  \nlemma well_typed_incr_simul_perm: \"\\<lbrakk> leq_use_env r_s r_c; well_typed env delta r_s e tau r_s rx \\<rbrakk> \\<Longrightarrow> well_typed env delta r_c e tau r_c rx\"\n  apply (rule_tac t=\"r_c\" and s=\"comp_use_env r_s (diff_use_env r_c r_s)\" in subst)\n   apply (rule_tac msum_diff_comp_use_env)\n   apply (simp)\n  apply (rule_tac well_typed_comp_perms_gen)\n   apply (simp)\n  apply (rule_tac mini_disj_diff_use_env)\n  done    \n    \nlemma well_typed_lift_perms: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> well_typed env delta (lift_use_env r_s1 r) e tau (lift_use_env r_s2 r) rx\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)  \n        apply (auto)\n    (* const + op cases *)\n           apply (rule_tac dist_lift_leq_use_env)\n           apply (simp)\n          apply (rule_tac lift_leq_use_env)\n          apply (simp)\n         apply (rule_tac dist_lift_leq_use_env)\n         apply (simp)\n        apply (rule_tac lift_leq_use_env)\n        apply (simp)\n    (* var cases *)\n       apply (rule_tac lift_leq_use_env)\n       apply (simp)\n      apply (rule_tac x=\"r_ex\" in exI)\n      apply (auto)\n        apply (cut_tac r_s=\"r_s1\" and r_x=\"comp_use_env (ereq_use_env (owner_name delta x) tau_x) r_ex\" and r=\"r\" in lift_diff_use_env)\n        apply (auto)\n        apply (rule_tac dist_lift_leq_use_env)\n        apply (simp)\n       apply (rule_tac lift_leq_use_env)\n       apply (simp)\n      apply (rule_tac lift_leq_use_env)\n      apply (simp)\n    (* pair case *)\n     apply (rule_tac x=\"lift_use_env r_s2a r\" in exI)\n     apply (rule_tac x=\"lift_use_env r_s3 r\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n       apply (rule_tac lift_leq_use_env)\n       apply (simp)\n      apply (rule_tac lift_leq_use_env)\n      apply (simp)\n     apply (rule_tac x=\"r_ex\" in exI)\n     apply (auto)\n       apply (cut_tac r_s=\"r_s3\" and r_x=\"r_ex\" and r=\"r\" in lift_diff_use_env)\n       apply (simp)\n       apply (rule_tac dist_lift_leq_use_env)\n       apply (simp)\n      apply (rule_tac lift_leq_use_env)\n      apply (simp)\n     apply (rule_tac lift_leq_use_env)\n     apply (simp)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"lift_use_env r_s2a r\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx1\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx2\" in exI)\n    apply (auto)\n    (* lam case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n    apply (rule_tac lift_leq_use_env)\n    apply (simp)\n   apply (rule_tac x=\"r_ex\" in exI)\n   apply (auto)\n     apply (cut_tac r_s=\"r_s1\" and r_x=\"r_ex\" and r=\"r\" in lift_diff_use_env)\n     apply (auto)\n     apply (rule_tac dist_lift_leq_use_env)\n     apply (simp)\n    apply (rule_tac lift_leq_use_env)\n    apply (simp)\n   apply (rule_tac lift_leq_use_env)\n   apply (simp)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"ra\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"lift_use_env r_s2a r\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"lift_use_env r_s3 r\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"r_ex\" in exI)\n  apply (auto)\n     apply (cut_tac r_s=\"r_s3\" and r_x=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_ex\" and r=\"r\" in lift_diff_use_env)\n     apply (auto)\n     apply (rule_tac dist_lift_leq_use_env)\n     apply (simp)\n    apply (rule_tac lift_leq_use_env)\n    apply (simp)\n   apply (rule_tac lift_leq_use_env)\n   apply (simp)\n  apply (rule_tac lift_leq_use_env)\n  apply (simp)\n  done    \n    \n    (* \n      ####################################\n        P8. well-typed manipulation for end permissions\n      ####################################\n    *)    \n    \nlemma wtdep_diff_use_env: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_xa) \\<rbrakk> \\<Longrightarrow> diff_use_env r_x r_ex = diff_use_env r_x (comp_use_env (diff_use_env r_ex r_xa) r_xa)\"    \n  apply (case_tac \"\\<forall> x. diff_use_env r_x r_ex x = diff_use_env r_x (comp_use_env (diff_use_env r_ex r_xa) r_xa) x\")\n   apply (auto)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: comp_use_env_def)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_xa x\")\n    apply (auto)\n    apply (case_tac \"r_ex x\")\n      apply (auto)\n   apply (case_tac \"r_ex x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  done\n\nlemma wtdep_strong_use_vars: \"\\<lbrakk> well_typed env delta (diff_use_env r_s1 r_x) e tau r_s2 rx; strong_use_env r_x \\<rbrakk> \\<Longrightarrow> non_prim_vars env delta e \\<inter> own_env_vars r_x = {}\"    \n  apply (auto)\n  apply (case_tac \"r_x x \\<noteq> NoPerm\")\n   apply (case_tac \"r_x x\")\n     apply (auto)\n    apply (simp add: strong_use_env_def)\n   apply (cut_tac r_s=\"r_s1\" and r_ex=\"r_x\" and x=\"x\" in diff_use_none_ex)\n    apply (auto)\n   apply (cut_tac x=\"x\" and e=\"e\" and env=\"env\" and ?r_s1.0=\"diff_use_env r_s1 r_x\" in well_typed_no_npv_use)\n     apply (auto)\n  apply (simp add: own_env_vars_def)\n  done\n  \n    \nlemma well_typed_break: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau (norm_use_env r_s1 r_s2) rx\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const case *)\n          apply (rule_tac self_norm_leq_use_env)\n         apply (rule_tac rhs_norm_leq_use_env)\n          apply (auto)\n    (* op case *)\n        apply (rule_tac self_norm_leq_use_env)\n       apply (rule_tac rhs_norm_leq_use_env)\n        apply (auto)\n    (* var case *)\n      apply (rule_tac x=\"r_ex\" in exI)\n      apply (auto)\n       apply (rule_tac diff_norm_leq_use_env)\n       apply (simp)\n      apply (rule_tac rhs_norm_leq_use_env)\n       apply (simp)\n      apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name delta x) tau_x) r_ex)\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (auto)\n    (* pair case *)\n     apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac x=\"norm_use_env r_s1 r_s2a\" in exI)\n     apply (rule_tac x=\"norm_use_env r_s1 r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n        apply (rule_tac t=\"norm_use_env r_s1 r_s3\" and s=\"norm_use_env (norm_use_env r_s1 r_s2a) r_s3\" in subst)\n         apply (rule_tac sub_norm_use_env)\n         apply (rule_tac well_typed_perm_leq)\n         apply (auto)\n        apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in well_typed_incr_start_perm)\n          apply (auto)\n        apply (rule_tac rhs_self_norm_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n       apply (rule_tac rhs_norm_leq_use_env)\n        apply (auto)\n      apply (rule_tac rhs_norm_leq_use_env)\n       apply (auto)\n     apply (rule_tac x=\"r_ex\" in exI)\n     apply (auto)\n      apply (rule_tac spec_norm_leq_use_env)\n      apply (simp)\n     apply (rule_tac rhs_norm_leq_use_env)\n      apply (simp)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac diff_leq_use_env)\n     apply (auto)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"norm_use_env r_s1 r_s2a\" in exI)\n    apply (auto)\n    (* - common substitution *)\n    apply (cut_tac ?r_s1.0=\"r_s2a\" and ?r_s2.0=\"r_s2\" in well_typed_perm_leq)\n     apply (auto)\n    apply (rule_tac t=\"norm_use_env r_s1 r_s2\" and s=\"norm_use_env (norm_use_env r_s1 r_s2a) r_s2\" in subst)\n     apply (rule_tac sub_norm_use_env)\n     apply (simp)\n    (* - rx1 *)\n    apply (rule_tac x=\"rx1\" in exI)\n    apply (auto)\n     apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s2\" and rx=\"rx1\" in well_typed_incr_start_perm)\n       apply (auto)\n     apply (rule_tac rhs_self_norm_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* - rx2 *)\n    apply (rule_tac x=\"rx2\" in exI)\n    apply (auto)\n    apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e3\" and ?r_s2.0=\"r_s2\" and rx=\"rx2\" in well_typed_incr_start_perm)\n      apply (auto)\n    apply (rule_tac rhs_self_norm_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n    (* lam case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_ex\" in exI)\n   apply (auto)\n    apply (rule_tac diff_norm_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_norm_leq_use_env)\n    apply (auto)\n   apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (auto)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"norm_use_env r_s1 r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"norm_use_env r_s1 r_s3\" in exI)\n  apply (cut_tac ?r_s1.0=\"r_s2a\" and ?r_s2.0=\"r_s3\" in well_typed_perm_leq)\n   apply (auto)\n   apply (rule_tac t=\"norm_use_env r_s1 r_s3\" and s=\"norm_use_env (norm_use_env r_s1 r_s2a) r_s3\" in subst)\n    apply (rule_tac sub_norm_use_env)\n    apply (simp)\n   apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"norm_use_env r_s1 r_s2a\" and e=\"e2\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in well_typed_incr_start_perm)\n     apply (auto)\n   apply (rule_tac rhs_self_norm_leq_use_env)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (rule_tac x=\"r_ex\" in exI)\n  apply (auto)\n    apply (rule_tac spec_norm_leq_use_env)\n    apply (simp)\n   apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n    apply (rule_tac rhs_self_norm_leq_use_env)\n    apply (auto)\n  apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n   apply (rule_tac rhs_self_norm_leq_use_env)\n   apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n    apply (auto)\n  apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n   apply (rule_tac self_diff_leq_use_env)\n  apply (simp)\n  done\n    \n    (* when we perform substitution, we need to be able to stop \"requiring\" permissions. the\n    intuition behind this lemma is that we no longer need a permission if we simply remove it from\n    the list of permissions in the environment. *)    \n\nlemma well_typed_diff_end_perm: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; leq_use_env r_ex r_s1 \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex)\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx r_ex)\n        apply (auto)\n    (* const case + op case are trivial since they never require permissions *)\n          apply (rule_tac diff_leq_use_env)\n          apply (simp)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (simp)\n        apply (rule_tac diff_leq_use_env)\n        apply (simp)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (simp)\n    (* var case *)\n      apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n      apply (auto)\n         apply (rule_tac rhs_unroll_dcl_use_env)\n         apply (rule_tac rhs_unroll_dcl_use_env)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (rule_tac rhs_fold_dcl_use_env)\n         apply (simp)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (simp)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (auto)\n      apply (rule_tac lhs_unroll_dcl_use_env)\n      apply (rule_tac lhs_unroll_dcl_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (rule_tac lhs_fold_dcl_use_env)\n      apply (simp)\n    (* pair case *)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n     apply (auto)\n        apply (rule_tac rhs_unroll_dcl_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (simp)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (simp_all)\n     apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n      apply (simp add: pair_req_def)\n      apply (rule_tac leq_empty_use_env)\n     apply (simp add: pair_req_def)\n     apply (rule_tac lhs_unroll_dcl_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (simp)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e1\" and ?r_s2.0=\"r_s2a\" in well_typed_break)\n     apply (auto)\n    apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in ex_norm_use_env)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* - setup r_s2 \\<le> r_s1 - r_exa *)\n    apply (cut_tac r_sc=\"r_s2\" and r_sb=\"r_s2a\" and r_sa=\"norm_use_env r_s1 r_s2a\" in trans_leq_use_env)\n      apply (rule_tac rhs_self_norm_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* - prelim for both inductions *)\n    apply (case_tac \"diff_use_env r_s2 (comp_use_env (diff_use_env r_ex r_exa) r_exa) \\<noteq> diff_use_env (diff_use_env r_s2 (diff_use_env r_ex r_exa)) r_exa\")\n     apply (cut_tac r_s=\"r_s2\" and r_x=\"diff_use_env r_ex r_exa\" and r_ex=\"r_exa\" in diff_comp_use_env)\n     apply (auto)\n    apply (cut_tac r_sc=\"diff_use_env r_ex r_exa\" and r_sb=\"r_ex\" and r_sa=\"r_s1\" in trans_leq_use_env)\n      apply (simp)\n     apply (rule_tac self_diff_leq_use_env)\n    (* - first induction *)\n    apply (rule_tac x=\"diff_use_env r_s1 r_exa\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"diff_use_env rx1 r_ex\" in exI)\n    apply (auto)\n    apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n     apply (auto)\n    apply (cut_tac r_x=\"rx1\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n      apply (auto)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac well_typed_perm_leqx)\n      apply (auto)\n     apply (rule_tac t=\"diff_use_env rx1 (comp_use_env (diff_use_env r_ex r_exa) r_exa)\" and s=\"diff_use_env (diff_use_env rx1 (diff_use_env r_ex r_exa)) r_exa\" in subst)\n      apply (rule_tac diff_comp_use_env)\n     apply (rule_tac well_typed_diff_perms)\n      apply (auto)\n      apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"r_s1\" and e=\"e2\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx1\" in well_typed_incr_start_perm)\n        apply (auto)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    (* - lemma to prove non-prim x is not in e2 *)\n     apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx1\" and e=\"e2\" and r_x=\"r_exa\" in wtdep_strong_use_vars)\n       apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n        apply (auto)\n     apply (rule_tac r_sb=\"norm_use_env r_s1 r_s2a\" in trans_leq_use_env)\n      apply (simp)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac rhs_self_norm_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* - second induction *)\n    apply (rule_tac x=\"diff_use_env rx2 r_ex\" in exI)\n    apply (auto)\n     apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n      apply (auto)\n     apply (cut_tac r_x=\"rx2\" and r_s=\"r_s1\" and r_xa=\"r_exa\" and r_ex=\"r_ex\" in wtdep_diff_use_env)\n      apply (auto)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac well_typed_perm_leqx)\n      apply (auto)\n     apply (rule_tac t=\"diff_use_env rx2 (comp_use_env (diff_use_env r_ex r_exa) r_exa)\" and s=\"diff_use_env (diff_use_env rx2 (diff_use_env r_ex r_exa)) r_exa\" in subst)\n      apply (rule_tac diff_comp_use_env)\n     apply (rule_tac well_typed_diff_perms)\n      apply (auto)\n      apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and r_c=\"r_s1\" and e=\"e3\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx2\" in well_typed_incr_start_perm)\n        apply (auto)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    (* - lemma to prove non-prim x is not in e3 *)\n     apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx2\" and e=\"e3\" and r_x=\"r_exa\" in wtdep_strong_use_vars)\n       apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n        apply (auto)\n     apply (rule_tac r_sb=\"norm_use_env r_s1 r_s2a\" in trans_leq_use_env)\n      apply (simp)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac rhs_self_norm_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* - final equality *)\n    apply (simp add: dist_diff_comp_use_env)\n    (* the lambda case allows us to select any r_s2 + rx as long as they match. *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n   apply (auto)\n      apply (rule_tac r_sb=\"diff_use_env (diff_use_env r_s1 r_exa) r_ex\" in trans_leq_use_env)\n       apply (rule_tac diff_comp_leq_use_env1)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (simp)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (simp_all)\n   apply (rule_tac lhs_unroll_dcl_use_env)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (simp)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"comp_use_env r_exa r_ex\" in exI)\n  apply (auto)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (rule_tac rhs_fold_dcl_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env)\n    apply (simp)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (simp_all)\n  apply (simp add: app_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac lhs_fold_dcl_use_env)\n  apply (simp)\n  done\n\nlemma well_typed_rem_end_perm: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; r_s1 x = OwnPerm \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau (rem_use_env r_s2 x) (rem_use_env rx x)\"  \n  apply (cut_tac r_s=\"r_s2\" and x=\"x\" in diff_rem_use_env)\n  apply (cut_tac r_s=\"rx\" and x=\"x\" in diff_rem_use_env)\n  apply (auto)\n  apply (rule_tac well_typed_diff_end_perm)\n   apply (auto)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: one_use_env_def)\n  done \n    \nlemma well_typed_decr_end_perm: \"\\<lbrakk> well_typed env delta r_s1 e tau r_c rx; leq_use_env r_s2 r_c; leq_use_env rx r_s2 \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau r_s2 rx\"    \n  apply (induction e arbitrary: env r_s1 tau rx)\n        apply (auto)\n        apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n         apply (auto)\n       apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n        apply (auto)\n      apply (rule_tac x=\"r_ex\" in exI)\n      apply (auto)\n      apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n       apply (auto)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"r_ex\" in exI)\n     apply (auto)\n     apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n      apply (simp_all)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx1\" in exI)\n    apply (auto)\n     apply (cut_tac r_sa=\"r_s2\" and r_sb=\"comp_use_env rx1 rx2\" and r_sc=\"rx1\" in trans_leq_use_env)\n       apply (auto)\n     apply (rule_tac comp_leq_use_env1)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac x=\"rx2\" in exI)\n    apply (auto)\n    apply (cut_tac r_sa=\"r_s2\" and r_sb=\"comp_use_env rx1 rx2\" and r_sc=\"rx2\" in trans_leq_use_env)\n      apply (auto)\n    apply (rule_tac comp_leq_use_env2)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_ex\" in exI)\n   apply (auto)\n   apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n    apply (auto)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"r_ex\" in exI)\n  apply (auto)\n  apply (rule_tac r_sb=\"r_c\" in trans_leq_use_env)\n   apply (auto)\n  done\n  \nlemma well_typed_diff_decr_end_perm: \"\\<lbrakk> well_typed env delta r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex');\n    leq_use_env r_ex' r_ex; leq_use_env r_ex r_s1 \\<rbrakk> \\<Longrightarrow>    \n    well_typed env delta r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex)\"\n  apply (case_tac \"well_typed env delta r_s1 e tau (diff_use_env r_s2 r_ex) (diff_use_env rx r_ex) =\n    well_typed env delta r_s1 e tau (diff_use_env (diff_use_env r_s2 r_ex) r_ex) (diff_use_env (diff_use_env rx r_ex') r_ex)\")\n   apply (simp)\n   apply (rule_tac well_typed_diff_end_perm)\n    apply (auto)\n  apply (cut_tac r_s=\"r_s2\" and r_x=\"r_ex\" in double_diff_use_env)\n  apply (cut_tac r_s=\"rx\" and r_x=\"r_ex'\" and r_c=\"r_ex\" in cancel_diff_use_env)\n   apply (auto)\n  done    \n\nlemma well_typed_diff_decr_end_perm_gen: \"\\<lbrakk> well_typed env delta r_s1 e tau (diff_use_env r_s2 r_exb) (diff_use_env rx r_exb);\n  leq_use_env r_exb r_exa; leq_use_env r_exa r_s1 \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau (diff_use_env r_s2 r_exa) (diff_use_env rx r_exa)\"    \n  apply (cut_tac r_s=\"r_s2\" and r_x=\"r_exb\" and r_c=\"r_exa\" in cancel_diff_use_env)\n   apply (auto)\n  apply (cut_tac r_s=\"rx\" and r_x=\"r_exb\" and r_c=\"r_exa\" in cancel_diff_use_env)\n   apply (auto)\n  apply (rule_tac well_typed_diff_end_perm)\n   apply (auto)\n  done    \n    \n    (* \n      ####################################\n        P9. well-typed manipulation for requirements\n      ####################################\n    *)\n\nlemma well_typed_comp_req1: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; leq_use_env r_ex r_s2 \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta r_s1 e tau r_s2 (comp_use_env r_ex rx)\"\n  apply (induct e arbitrary: env r_s1 tau r_s2 rx r_ex)\n        apply (auto)\n    (* const + op case *)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (auto)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (auto)\n    (* var cases *)\n      apply (rule_tac x=\"r_exa\" in exI)\n      apply (auto)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (auto)\n      apply (rule_tac comp_leq_use_env2)\n      apply (simp)\n    (* pair case *)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"r_exa\" in exI)\n     apply (auto)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (simp_all)\n     apply (rule_tac comp_leq_use_env2)\n     apply (simp)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"comp_use_env r_ex rx1\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx2\" in exI)\n    apply (auto)\n    apply (rule_tac assoc_comp_use_env)\n    (* lambda case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_exa\" in exI)\n   apply (auto)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (auto)\n   apply (rule_tac comp_leq_use_env2)\n   apply (simp)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"r_exa\" in exI)\n  apply (auto)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (auto)\n  apply (rule_tac comp_leq_use_env2)\n  apply (simp)\n  done\n    \nlemma well_typed_comp_req2: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; leq_use_env r_ex r_s2 \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta r_s1 e tau r_s2 (comp_use_env rx r_ex)\"\n  apply (cut_tac r_s=\"rx\" and r_x=\"r_ex\" in comm_comp_use_env)\n  apply (auto)\n  apply (rule_tac well_typed_comp_req1)\n   apply (auto)\n  done\n\nlemma well_typed_incr_req: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; leq_use_env rx rc; leq_use_env rc r_s2 \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau r_s2 rc\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n      apply (rule_tac x=\"r_ex\" in exI)\n      apply (auto)\n      apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n       apply (auto)\n    (* pair case *)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"r_ex\" in exI)\n     apply (auto)\n     apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n      apply (auto)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rc\" in exI)\n    apply (auto)\n     apply (cut_tac r_sc=\"rx1\" and r_sb=\"comp_use_env rx1 rx2\" and r_sa=\"rc\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac self_comp_leq_use_env1)\n     apply (simp)\n    apply (rule_tac x=\"rc\" in exI)\n    apply (auto)\n     apply (cut_tac r_sc=\"rx2\" and r_sb=\"comp_use_env rx1 rx2\" and r_sa=\"rc\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac self_comp_leq_use_env2)\n     apply (simp)\n    apply (case_tac \"\\<forall> x. rc x = comp_use_env rc rc x\")\n     apply (auto)\n    apply (simp add: comp_use_env_def)\n    apply (case_tac \"rc x\")\n      apply (auto)\n    (* lam case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_ex\" in exI)\n   apply (auto)\n   apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n    apply (auto)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"r_ex\" in exI)\n  apply (auto)\n  apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n   apply (auto)\n  done    \n\nlemma well_typed_simul_end_perm: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; leq_use_env r_c r_s2;\n  leq_use_env rc r_c; leq_use_env rx rc \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau r_c rc\"\n  apply (rule_tac rx=\"rx\" in well_typed_incr_req)\n    apply (rule_tac r_c=\"r_s2\" in well_typed_decr_end_perm)\n      apply (auto)\n  apply (rule_tac r_sb=\"rc\" in trans_leq_use_env)\n   apply (auto)\n  done    \n    \n    \nlemma well_typed_add_permsx: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; x \\<notin> non_prim_vars env delta e \\<rbrakk> \\<Longrightarrow>\n  well_typed env delta (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r) (add_use_env rx x r)\"  \n  apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n  apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)  \n  apply (cut_tac r_s=\"rx\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)  \n  apply (simp)\n  apply (cut_tac r_s=\"rem_use_env r_s1 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n   apply (auto)\n   apply (simp add: rem_use_env_def)\n  apply (cut_tac r_s=\"rem_use_env r_s2 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n   apply (auto)\n   apply (simp add: rem_use_env_def)\n  apply (cut_tac r_s=\"rem_use_env rx x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n   apply (auto)\n   apply (simp add: rem_use_env_def)\n  apply (rule_tac well_typed_comp_req2)\n   apply (rule_tac well_typed_comp_perms)\n    apply (rule_tac well_typed_rem_perms)\n     apply (auto)\n   apply (simp add: disj_use_env_def)\n   apply (simp add: mini_disj_use_env_def)\n   apply (simp add: one_use_env_def)\n   apply (simp add: rem_use_env_def)\n  apply (rule_tac self_comp_leq_use_env2)\n  done\n    \n    (* \n      ####################################\n        P10. well-typed manipulation involving lifts\n      ####################################\n    *)     \n\nlemma well_typed_lift_req: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx; leq_use_env (lift_use_env rx r) r_s2 \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau r_s2 (lift_use_env rx r)\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n      apply (rule_tac x=\"r_ex\" in exI)\n      apply (auto)\n      apply (rule_tac lift_leq_use_env)\n      apply (simp)\n    (* pair case *)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"r_ex\" in exI)\n     apply (auto)\n     apply (rule_tac lift_leq_use_env)\n     apply (simp)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"lift_use_env rx1 r\" in exI)\n    apply (auto)\n     apply (cut_tac r_sc=\"lift_use_env rx1 r\" and r_sb=\"lift_use_env (comp_use_env rx1 rx2) r\" and r_sa=\"r_s2\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_lift_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env1)\n     apply (auto)\n    apply (rule_tac x=\"lift_use_env rx2 r\" in exI)\n    apply (auto)\n     apply (cut_tac r_sc=\"lift_use_env rx2 r\" and r_sb=\"lift_use_env (comp_use_env rx1 rx2) r\" and r_sa=\"r_s2\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_lift_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env2)\n     apply (auto)\n    apply (rule_tac lift_comp_use_env)\n    (* lam case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_ex\" in exI)\n   apply (auto)\n   apply (rule_tac lift_leq_use_env)\n   apply (simp)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"ra\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"r_ex\" in exI)\n  apply (auto)\n  apply (rule_tac lift_leq_use_env)\n  apply (auto)\n  done    \n  \nlemma well_typed_lift_all_perms: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> well_typed env delta (lift_use_env r_s1 r) e tau (lift_use_env r_s2 r) (lift_use_env rx r)\"\n  apply (rule_tac well_typed_lift_req)\n   apply (rule_tac well_typed_lift_perms)\n   apply (simp)\n  apply (rule_tac dist_lift_leq_use_env)\n  apply (rule_tac well_typed_perm_leqx)\n  apply (auto)\n  done\n    \nend", "meta": {"author": "dcco", "repo": "perm_lang_thesis", "sha": "81661c97a0c43701c9ec0a75074d9553b2dd0263", "save_path": "github-repos/isabelle/dcco-perm_lang_thesis", "path": "github-repos/isabelle/dcco-perm_lang_thesis/perm_lang_thesis-81661c97a0c43701c9ec0a75074d9553b2dd0263/isa_code/WTLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.32062225838908404}}
{"text": "(*  Title:      JinjaDCI/Common/Decl.thy\n\n    Author:     David von Oheimb, Susannah Mansky\n    Copyright   1999 Technische Universitaet Muenchen, 2019-20 UIUC\n\n    Based on the Jinja theory Common/Decl.thy by David von Oheimb\n*)\n\nsection \\<open> Class Declarations and Programs \\<close>\n\ntheory Decl imports Type begin\n\ntype_synonym \n  fdecl    = \"vname \\<times> staticb \\<times> ty\"        \\<comment> \\<open>field declaration\\<close>\ntype_synonym\n  'm mdecl = \"mname \\<times> staticb \\<times> ty list \\<times> ty \\<times> 'm\"     \\<comment> \\<open>method = name, static flag, arg.\\ types, return type, body\\<close>\ntype_synonym\n  'm \"class\" = \"cname \\<times> fdecl list \\<times> 'm mdecl list\"       \\<comment> \\<open>class = superclass, fields, methods\\<close>\ntype_synonym\n  'm cdecl = \"cname \\<times> 'm class\"  \\<comment> \\<open>class declaration\\<close>\ntype_synonym\n  'm prog  = \"'m cdecl list\"     \\<comment> \\<open>program\\<close>\n\n(* replaced all fname, mname, cname in below with `char list' so that\n pretty printing works   -SM *)\n(*<*)\ntranslations\n  (type) \"fdecl\"   <= (type) \"char list \\<times> staticb \\<times> ty\"\n  (type) \"'c mdecl\" <= (type) \"char list \\<times> staticb \\<times> ty list \\<times> ty \\<times> 'c\"\n  (type) \"'c class\" <= (type) \"char list \\<times> fdecl list \\<times> ('c mdecl) list\"\n  (type) \"'c cdecl\" <= (type) \"char list \\<times> ('c class)\"\n  (type) \"'c prog\" <= (type) \"('c cdecl) list\"\n(*>*)\n\ndefinition \"class\" :: \"'m prog \\<Rightarrow> cname \\<rightharpoonup> 'm class\"\nwhere\n  \"class  \\<equiv>  map_of\"\n\n(* Not difficult to prove, but useful for directing particular sequences of equality -SM *)\nlemma class_cons: \"\\<lbrakk> C \\<noteq> fst x \\<rbrakk> \\<Longrightarrow> class (x # P) C = class P C\"\n by (simp add: class_def)\n\ndefinition is_class :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> bool\"\nwhere\n  \"is_class P C  \\<equiv>  class P C \\<noteq> None\"\n\nlemma finite_is_class: \"finite {C. is_class P C}\"\n(*<*)\napply (unfold is_class_def class_def)\napply (fold dom_def)\napply (rule finite_dom_map_of)\ndone\n(*>*)\n\ndefinition is_type :: \"'m prog \\<Rightarrow> ty \\<Rightarrow> bool\"\nwhere\n  \"is_type P T  \\<equiv>\n  (case T of Void \\<Rightarrow> True | Boolean \\<Rightarrow> True | Integer \\<Rightarrow> True | NT \\<Rightarrow> True\n   | Class C \\<Rightarrow> is_class P C)\"\n\nlemma is_type_simps [simp]:\n  \"is_type P Void \\<and> is_type P Boolean \\<and> is_type P Integer \\<and>\n  is_type P NT \\<and> is_type P (Class C) = is_class P C\"\n(*<*)by(simp add:is_type_def)(*>*)\n\n\nabbreviation\n  \"types P == Collect (is_type P)\"\n\nlemma class_exists_equiv:\n \"(\\<exists>x. fst x = cn \\<and> x \\<in> set P) = (class P cn \\<noteq> None)\"\napply (rule iffI)\n\\<comment> \\<open> @{text \\<Rightarrow>} \\<close>\napply (simp, simp only: class_def)\nusing weak_map_of_SomeI apply fastforce\n\\<comment> \\<open> @{text \\<Leftarrow>} \\<close>\napply (simp add: class_def)\napply (meson map_of_SomeD)\ndone\n\nlemma class_exists_equiv2:\n \"(\\<exists>x. fst x = cn \\<and> x \\<in> set (P1 @ P2)) = (class P1 cn \\<noteq> None \\<or> class P2 cn \\<noteq> None)\"\nby (simp only: class_exists_equiv [where P = \"P1@P2\"], simp add: class_def)\n\nend\n", "meta": {"author": "susannahej", "repo": "jinja-dci", "sha": "0969fa2c5966204b326395763d7a375e7dc6badf", "save_path": "github-repos/isabelle/susannahej-jinja-dci", "path": "github-repos/isabelle/susannahej-jinja-dci/jinja-dci-0969fa2c5966204b326395763d7a375e7dc6badf/Common/Decl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548511303338, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3205891298705353}}
{"text": "(*  Title:      HOL/Auth/OtwayRees_Bad.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n*)\n\n\nsection\\<open>The Otway-Rees Protocol: The Faulty BAN Version\\<close>\n\ntheory OtwayRees_Bad imports Public begin\n\ntext\\<open>The FAULTY version omitting encryption of Nonce NB, as suggested on \npage 247 of\n  Burrows, Abadi and Needham (1988).  A Logic of Authentication.\n  Proc. Royal Soc. 426\n\nThis file illustrates the consequences of such errors.  We can still prove\nimpressive-looking properties such as \\<open>Spy_not_see_encrypted_key\\<close>, yet\nthe protocol is open to a middleperson attack.  Attempting to prove some key\nlemmas indicates the possibility of this attack.\\<close>\n\ninductive_set otway :: \"event list set\"\n  where\n   Nil: \\<comment> \\<open>The empty trace\\<close>\n        \"[] \\<in> otway\"\n\n | Fake: \\<comment> \\<open>The Spy may say anything he can say.  The sender field is correct,\n            but agents don't use that information.\\<close>\n         \"[| evsf \\<in> otway;  X \\<in> synth (analz (knows Spy evsf)) |]\n          ==> Says Spy B X  # evsf \\<in> otway\"\n\n        \n | Reception: \\<comment> \\<open>A message that has been sent can be received by the\n                  intended recipient.\\<close>\n              \"[| evsr \\<in> otway;  Says A B X \\<in>set evsr |]\n               ==> Gets B X # evsr \\<in> otway\"\n\n | OR1:  \\<comment> \\<open>Alice initiates a protocol run\\<close>\n         \"[| evs1 \\<in> otway;  Nonce NA \\<notin> used evs1 |]\n          ==> Says A B \\<lbrace>Nonce NA, Agent A, Agent B,\n                         Crypt (shrK A) \\<lbrace>Nonce NA, Agent A, Agent B\\<rbrace>\\<rbrace>\n                 # evs1 \\<in> otway\"\n\n | OR2:  \\<comment> \\<open>Bob's response to Alice's message.\n             This variant of the protocol does NOT encrypt NB.\\<close>\n         \"[| evs2 \\<in> otway;  Nonce NB \\<notin> used evs2;\n             Gets B \\<lbrace>Nonce NA, Agent A, Agent B, X\\<rbrace> \\<in> set evs2 |]\n          ==> Says B Server\n                  \\<lbrace>Nonce NA, Agent A, Agent B, X, Nonce NB,\n                    Crypt (shrK B) \\<lbrace>Nonce NA, Agent A, Agent B\\<rbrace>\\<rbrace>\n                 # evs2 \\<in> otway\"\n\n | OR3:  \\<comment> \\<open>The Server receives Bob's message and checks that the three NAs\n           match.  Then he sends a new session key to Bob with a packet for\n           forwarding to Alice.\\<close>\n         \"[| evs3 \\<in> otway;  Key KAB \\<notin> used evs3;\n             Gets Server\n                  \\<lbrace>Nonce NA, Agent A, Agent B,\n                    Crypt (shrK A) \\<lbrace>Nonce NA, Agent A, Agent B\\<rbrace>,\n                    Nonce NB,\n                    Crypt (shrK B) \\<lbrace>Nonce NA, Agent A, Agent B\\<rbrace>\\<rbrace>\n               \\<in> set evs3 |]\n          ==> Says Server B\n                  \\<lbrace>Nonce NA,\n                    Crypt (shrK A) \\<lbrace>Nonce NA, Key KAB\\<rbrace>,\n                    Crypt (shrK B) \\<lbrace>Nonce NB, Key KAB\\<rbrace>\\<rbrace>\n                 # evs3 \\<in> otway\"\n\n | OR4:  \\<comment> \\<open>Bob receives the Server's (?) message and compares the Nonces with\n             those in the message he previously sent the Server.\n             Need \\<^term>\\<open>B \\<noteq> Server\\<close> because we allow messages to self.\\<close>\n         \"[| evs4 \\<in> otway;  B \\<noteq> Server;\n             Says B Server \\<lbrace>Nonce NA, Agent A, Agent B, X', Nonce NB,\n                             Crypt (shrK B) \\<lbrace>Nonce NA, Agent A, Agent B\\<rbrace>\\<rbrace>\n               \\<in> set evs4;\n             Gets B \\<lbrace>Nonce NA, X, Crypt (shrK B) \\<lbrace>Nonce NB, Key K\\<rbrace>\\<rbrace>\n               \\<in> set evs4 |]\n          ==> Says B A \\<lbrace>Nonce NA, X\\<rbrace> # evs4 \\<in> otway\"\n\n | Oops: \\<comment> \\<open>This message models possible leaks of session keys.  The nonces\n             identify the protocol run.\\<close>\n         \"[| evso \\<in> otway;\n             Says Server B \\<lbrace>Nonce NA, X, Crypt (shrK B) \\<lbrace>Nonce NB, Key K\\<rbrace>\\<rbrace>\n               \\<in> set evso |]\n          ==> Notes Spy \\<lbrace>Nonce NA, Nonce NB, Key K\\<rbrace> # evso \\<in> otway\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body  [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\n\ntext\\<open>A \"possibility property\": there are traces that reach the end\\<close>\nlemma \"[| B \\<noteq> Server; Key K \\<notin> used [] |]\n      ==> \\<exists>NA. \\<exists>evs \\<in> otway.\n            Says B A \\<lbrace>Nonce NA, Crypt (shrK A) \\<lbrace>Nonce NA, Key K\\<rbrace>\\<rbrace>\n              \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] otway.Nil\n                    [THEN otway.OR1, THEN otway.Reception,\n                     THEN otway.OR2, THEN otway.Reception,\n                     THEN otway.OR3, THEN otway.Reception, THEN otway.OR4])\napply (possibility, simp add: used_Cons) \ndone\n\nlemma Gets_imp_Says [dest!]:\n     \"[| Gets B X \\<in> set evs; evs \\<in> otway |] ==> \\<exists>A. Says A B X \\<in> set evs\"\napply (erule rev_mp)\napply (erule otway.induct, auto)\ndone\n\n\nsubsection\\<open>For reasoning about the encrypted portion of messages\\<close>\n\nlemma OR2_analz_knows_Spy:\n     \"[| Gets B \\<lbrace>N, Agent A, Agent B, X\\<rbrace> \\<in> set evs;  evs \\<in> otway |]\n      ==> X \\<in> analz (knows Spy evs)\"\nby blast\n\nlemma OR4_analz_knows_Spy:\n     \"[| Gets B \\<lbrace>N, X, Crypt (shrK B) X'\\<rbrace> \\<in> set evs;  evs \\<in> otway |]\n      ==> X \\<in> analz (knows Spy evs)\"\nby blast\n\nlemma Oops_parts_knows_Spy:\n     \"Says Server B \\<lbrace>NA, X, Crypt K' \\<lbrace>NB,K\\<rbrace>\\<rbrace> \\<in> set evs\n      ==> K \\<in> parts (knows Spy evs)\"\nby blast\n\ntext\\<open>Forwarding lemma: see comments in OtwayRees.thy\\<close>\nlemmas OR2_parts_knows_Spy =\n    OR2_analz_knows_Spy [THEN analz_into_parts]\n\n\ntext\\<open>Theorems of the form \\<^term>\\<open>X \\<notin> parts (spies evs)\\<close> imply that\nNOBODY sends messages containing X!\\<close>\n\ntext\\<open>Spy never sees a good agent's shared key!\\<close>\nlemma Spy_see_shrK [simp]:\n     \"evs \\<in> otway ==> (Key (shrK A) \\<in> parts (knows Spy evs)) = (A \\<in> bad)\"\nby (erule otway.induct, force,\n    drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\n\n\nlemma Spy_analz_shrK [simp]:\n     \"evs \\<in> otway ==> (Key (shrK A) \\<in> analz (knows Spy evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"[|Key (shrK A) \\<in> parts (knows Spy evs);  evs \\<in> otway|] ==> A \\<in> bad\"\nby (blast dest: Spy_see_shrK)\n\n\nsubsection\\<open>Proofs involving analz\\<close>\n\ntext\\<open>Describes the form of K and NA when the Server sends this message.  Also\n  for Oops case.\\<close>\nlemma Says_Server_message_form:\n     \"[| Says Server B \\<lbrace>NA, X, Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n         evs \\<in> otway |]\n      ==> K \\<notin> range shrK \\<and> (\\<exists>i. NA = Nonce i) \\<and> (\\<exists>j. NB = Nonce j)\"\napply (erule rev_mp)\napply (erule otway.induct, simp_all)\ndone\n\n\n(****\n The following is to prove theorems of the form\n\n  Key K \\<in> analz (insert (Key KAB) (knows Spy evs)) ==>\n  Key K \\<in> analz (knows Spy evs)\n\n A more general formula must be proved inductively.\n****)\n\n\ntext\\<open>Session keys are not used to encrypt other session keys\\<close>\n\ntext\\<open>The equality makes the induction hypothesis easier to apply\\<close>\nlemma analz_image_freshK [rule_format]:\n \"evs \\<in> otway ==>\n   \\<forall>K KK. KK \\<subseteq> -(range shrK) \\<longrightarrow>\n          (Key K \\<in> analz (Key`KK \\<union> (knows Spy evs))) =\n          (K \\<in> KK | Key K \\<in> analz (knows Spy evs))\"\napply (erule otway.induct)\napply (frule_tac [8] Says_Server_message_form)\napply (drule_tac [7] OR4_analz_knows_Spy)\napply (drule_tac [5] OR2_analz_knows_Spy, analz_freshK, spy_analz, auto) \ndone\n\nlemma analz_insert_freshK:\n  \"[| evs \\<in> otway;  KAB \\<notin> range shrK |] ==>\n      (Key K \\<in> analz (insert (Key KAB) (knows Spy evs))) =\n      (K = KAB | Key K \\<in> analz (knows Spy evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\n\ntext\\<open>The Key K uniquely identifies the Server's  message.\\<close>\nlemma unique_session_keys:\n     \"[| Says Server B \\<lbrace>NA, X, Crypt (shrK B) \\<lbrace>NB, K\\<rbrace>\\<rbrace>   \\<in> set evs;\n         Says Server B' \\<lbrace>NA',X',Crypt (shrK B') \\<lbrace>NB',K\\<rbrace>\\<rbrace> \\<in> set evs;\n         evs \\<in> otway |] ==> X=X' \\<and> B=B' \\<and> NA=NA' \\<and> NB=NB'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule otway.induct, simp_all)\napply blast+  \\<comment> \\<open>OR3 and OR4\\<close>\ndone\n\n\ntext\\<open>Crucial secrecy property: Spy does not see the keys sent in msg OR3\n    Does not in itself guarantee security: an attack could violate\n    the premises, e.g. by having \\<^term>\\<open>A=Spy\\<close>\\<close>\nlemma secrecy_lemma:\n \"[| A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway |]\n  ==> Says Server B\n        \\<lbrace>NA, Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n          Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs \\<longrightarrow>\n      Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs \\<longrightarrow>\n      Key K \\<notin> analz (knows Spy evs)\"\napply (erule otway.induct, force)\napply (frule_tac [7] Says_Server_message_form)\napply (drule_tac [6] OR4_analz_knows_Spy)\napply (drule_tac [4] OR2_analz_knows_Spy)\napply (simp_all add: analz_insert_eq analz_insert_freshK pushes)\napply spy_analz  \\<comment> \\<open>Fake\\<close>\napply (blast dest: unique_session_keys)+  \\<comment> \\<open>OR3, OR4, Oops\\<close>\ndone\n\n\nlemma Spy_not_see_encrypted_key:\n     \"[| Says Server B\n          \\<lbrace>NA, Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n                Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n         Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway |]\n      ==> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest: Says_Server_message_form secrecy_lemma)\n\n\nsubsection\\<open>Attempting to prove stronger properties\\<close>\n\ntext\\<open>Only OR1 can have caused such a part of a message to appear. The premise\n  \\<^term>\\<open>A \\<noteq> B\\<close> prevents OR2's similar-looking cryptogram from being picked \n  up. Original Otway-Rees doesn't need it.\\<close>\nlemma Crypt_imp_OR1 [rule_format]:\n     \"[| A \\<notin> bad;  A \\<noteq> B;  evs \\<in> otway |]\n      ==> Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace> \\<in> parts (knows Spy evs) \\<longrightarrow>\n          Says A B \\<lbrace>NA, Agent A, Agent B,\n                     Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace>\\<rbrace>  \\<in> set evs\"\nby (erule otway.induct, force,\n    drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\n\n\ntext\\<open>Crucial property: If the encrypted message appears, and A has used NA\n  to start a run, then it originated with the Server!\n  The premise \\<^term>\\<open>A \\<noteq> B\\<close> allows use of \\<open>Crypt_imp_OR1\\<close>\\<close>\ntext\\<open>Only it is FALSE.  Somebody could make a fake message to Server\n          substituting some other nonce NA' for NB.\\<close>\nlemma \"[| A \\<notin> bad;  A \\<noteq> B;  evs \\<in> otway |]\n       ==> Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace> \\<in> parts (knows Spy evs) \\<longrightarrow>\n           Says A B \\<lbrace>NA, Agent A, Agent B,\n                      Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace>\\<rbrace>\n            \\<in> set evs \\<longrightarrow>\n           (\\<exists>B NB. Says Server B\n                \\<lbrace>NA,\n                  Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n                  Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs)\"\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all)\napply blast  \\<comment> \\<open>Fake\\<close>\napply blast  \\<comment> \\<open>OR1: it cannot be a new Nonce, contradiction.\\<close>\ntxt\\<open>OR3 and OR4\\<close>\napply (simp_all add: ex_disj_distrib)\n prefer 2 apply (blast intro!: Crypt_imp_OR1)  \\<comment> \\<open>OR4\\<close>\ntxt\\<open>OR3\\<close>\napply clarify\n(*The hypotheses at this point suggest an attack in which nonce NB is used\n  in two different roles:\n          Gets Server\n           \\<lbrace>Nonce NA, Agent Aa, Agent A,\n             Crypt (shrK Aa) \\<lbrace>Nonce NA, Agent Aa, Agent A\\<rbrace>, Nonce NB,\n             Crypt (shrK A) \\<lbrace>Nonce NA, Agent Aa, Agent A\\<rbrace>\\<rbrace>\n          \\<in> set evs3\n          Says A B\n           \\<lbrace>Nonce NB, Agent A, Agent B,\n             Crypt (shrK A) \\<lbrace>Nonce NB, Agent A, Agent B\\<rbrace>\\<rbrace>\n          \\<in> set evs3;\n*)\n\n\n(*Thus the key property A_can_trust probably fails too.*)\noops\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Auth/OtwayRees_Bad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3204308301020879}}
{"text": "theory Unused \nimports CValue  \"HOLCF-Meet-Classes\" \"AList-Utils\" Terms\nbegin\n\nnominal_primrec isLam :: \"exp \\<Rightarrow> bool\" where\n  \"isLam (Var x) = False\" |\n  \"isLam (Lam [x]. e) = True\" |\n  \"isLam (App e x) = False\" |\n  \"isLam (Let as e) = False\"\n  unfolding isLam_graph_aux_def eqvt_def\n  apply simp\n  apply simp\n  apply (metis exp_assn.exhaust(1))\n  apply auto\n  done\ntermination (eqvt) by lexicographic_order\n\n\nlemma change_Lam_Variable:\n  assumes \"atom y' \\<sharp> e'\" and \"atom y' \\<sharp> y\"\n  shows   \"Lam [y]. e' =  Lam [y']. ((y \\<leftrightarrow> y') \\<bullet> e')\"\nproof-\n  from assms\n  have \"(y \\<leftrightarrow> y') \\<bullet> (Lam [y]. e') = Lam [y]. e'\"\n    by -(rule flip_fresh_fresh, (simp add: fresh_Pair)+)\n  moreover\n  have \"(y \\<leftrightarrow> y') \\<bullet> (Lam [y]. e') = Lam [y']. ((y \\<leftrightarrow> y') \\<bullet> e')\"\n    by simp\n  ultimately\n  show \"Lam [y]. e' =  Lam [y']. ((y \\<leftrightarrow> y') \\<bullet> e')\" by (simp add: fresh_Pair)\nqed\n\nlemma isLam_subst[simp]: \"isLam e[x::=y] = isLam e\"\n  by (nominal_induct e avoiding: x y rule:exp_assn.strong_induct(1))\n     (auto simp add: fresh_star_Pair)\n\n\nlemma the_map_of_snd:\n  \"x\\<in> domA \\<Gamma> \\<Longrightarrow> the (map_of \\<Gamma> x) \\<in> snd ` set \\<Gamma>\"\n  by (induct \\<Gamma>, auto)\n\nlemma delete_no_there:\n  \"x \\<notin> domA \\<Gamma> \\<Longrightarrow> delete x \\<Gamma> = \\<Gamma>\"\n  by (induct \\<Gamma>, auto)\n\n\nfixrec CValue'_meet :: \"CValue' \\<rightarrow> CValue' \\<rightarrow> CValue'\"\n  where \"CValue'_meet\\<cdot>(CFn\\<cdot>f)\\<cdot>(CFn\\<cdot>g) = CFn \\<cdot>(\\<Lambda> x r. CValue'_meet \\<cdot> (f\\<cdot>x\\<cdot>r) \\<cdot> (g\\<cdot>x\\<cdot>r))\"\n  \n\n\nlemma CValue'_meet_is_meet: \"(z \\<sqsubseteq> CValue'_meet\\<cdot>x\\<cdot>y) = (z \\<sqsubseteq> x \\<and> z \\<sqsubseteq> y)\"\nproof (induct z rule:CValue'.take_induct)\n  fix n\n  show \"(CValue'_take n\\<cdot>z \\<sqsubseteq> CValue'_meet\\<cdot>x\\<cdot>y) = (CValue'_take n\\<cdot>z \\<sqsubseteq> x \\<and> CValue'_take n\\<cdot>z \\<sqsubseteq> y)\"\n  proof (induct n arbitrary: z x y rule:nat_induct)\n    case 0 thus ?case by auto\n    next\n    case (Suc n z x y) thus ?case\n      apply -\n      apply (cases z, simp)\n      apply (cases x, simp)\n      apply (cases y, simp)\n      apply (fastforce simp add: cfun_below_iff)\n      done\n  qed\nqed auto\n\ninstance CValue' :: Finite_Meet_cpo\n  apply default\n  using CValue'_meet_is_meet\n  apply blast\n  done\n\ninstance CValue' :: cont_binary_meet\nproof\n  have [simp]:\"\\<And> x y. x \\<sqinter> y = CValue'_meet\\<cdot>x\\<cdot>y\"\n    using CValue'_meet_is_meet\n    by (blast intro: is_meetI)\n  case goal1 thus ?case\n    by (simp add: ch2ch_Rep_cfunR contlub_cfun_arg contlub_cfun_fun)\nqed\n\n\nsubsubsection {* Instance for @{type u} *}\n\ninstantiation \"u\" :: (cont_pt) pt\nbegin\n  definition \"p \\<bullet> (x :: 'a\\<^sub>\\<bottom>) = fup\\<cdot>(\\<Lambda> x. up\\<cdot>(p \\<bullet> x))\\<cdot>x\"\n\n  instance\n  apply(default)\n  apply (simp add: permute_u_def eta_cfun)\n  apply (case_tac x)\n  apply (simp add: permute_u_def cfun_eqI minus_add)\n  apply (simp add: permute_u_def cfun_eqI minus_add)\n  done\nend\n\nlemma permute_u_eq: \"permute p = (\\<lambda> u. fup\\<cdot>(\\<Lambda> x. up\\<cdot>(p \\<bullet> x))\\<cdot>u)\"\n  by (rule, auto simp add: permute_u_def)\n\ninstance \"u\" :: (cont_pt) cont_pt\n  by default (subst permute_u_eq, simp)\n\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/Unused.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.32043082260878164}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Late_Comp\n  imports Weak_Early_Cong Weak_Late_Cong Strong_Early_Late_Comp\nbegin\n\n(*************** Transitions *********************)\n\nabbreviation earlyTauChain_judge (\"_ \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e _\" [80, 80] 80) where \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e Q \\<equiv> Early_Tau_Chain.tauChain P Q\"\nabbreviation lateTauChain_judge (\"_ \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l _\" [80, 80] 80) where \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l Q \\<equiv> Late_Tau_Chain.tauChain_judge P Q\"\n\n(************** Tau Chains *******************)\n\nlemma lateEarlyTauChain:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l Q\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e Q\"\nusing assms\nproof(induct rule: Late_Tau_Chain.tauChainInduct)\n  case id\n  show ?case by simp\nnext\n  case(ih P' P'')\n  have \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'\" by fact\n  moreover have \"P' \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P''\"\n  proof -\n    have \"P' \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P''\" by fact\n    thus ?thesis by(rule lateEarlyTau)\n  qed\n  ultimately show ?case by blast\nqed\n\nlemma earlyLateTauChain:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e Q\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l Q\"\nusing assms\nproof(induct rule: Early_Tau_Chain.tauChainInduct)\n  case id\n  show ?case by simp\nnext\n  case(ih P' P'')\n  have \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'\" by fact\n  moreover have \"P' \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P''\"\n  proof -\n    have \"P' \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P''\" by fact\n    thus ?thesis by(rule earlyLateTau)\n  qed\n  ultimately show ?case by blast\nqed\n\nlemma tauChainEq:\n  fixes P :: pi\n  and   Q :: pi\n\n  shows \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l Q = P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e Q\"\nby(blast intro: lateEarlyTauChain earlyLateTauChain)\n\n(***************** Step semantics ****************)\n  \nlemma lateEarlyStepOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>l(a[b] \\<prec>\\<^sub>l P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>e(a[b] \\<prec>\\<^sub>e P')\"\nproof -\n  from assms obtain P'' P''' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'''\"\n                               and P'''Trans: \"P''' \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P''\"\n                               and P''Chain: \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'\"\n    by(blast dest: Weak_Late_Step_Semantics.transitionE)\n\n  from PChain have \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'''\" by(rule lateEarlyTauChain)\n  moreover from P'''Trans have \"P''' \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P''\" by(rule lateEarlyOutput)\n  moreover from P''Chain have \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'\" by(rule lateEarlyTauChain)\n  ultimately show ?thesis by(rule Weak_Early_Step_Semantics.transitionI)\nqed\n  \nlemma earlyLateStepOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>e(a[b] \\<prec>\\<^sub>e P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>l(a[b] \\<prec>\\<^sub>l P')\"\nproof -\n  from assms obtain P'' P''' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'''\"\n                               and P'''Trans: \"P''' \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P''\"\n                               and P''Chain: \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'\"\n    by(blast dest: Weak_Early_Step_Semantics.transitionE)\n\n  from PChain have \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'''\" by(rule earlyLateTauChain)\n  moreover from P'''Trans have \"P''' \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P''\" by(rule earlyLateOutput)\n  moreover from P''Chain have \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'\" by(rule earlyLateTauChain)\n  ultimately show ?thesis by(rule Weak_Late_Step_Semantics.transitionI)\nqed\n  \nlemma stepOutputEq:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  shows \"P \\<Longrightarrow>\\<^sub>e(a[b] \\<prec>\\<^sub>e P') = P \\<Longrightarrow>\\<^sub>l(a[b] \\<prec>\\<^sub>l P')\"\nby(auto intro: lateEarlyStepOutput earlyLateStepOutput)\n\nlemma lateEarlyStepBoundOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>l(a<\\<nu>x> \\<prec>\\<^sub>l P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>e(a<\\<nu>x> \\<prec>\\<^sub>e P')\"\nproof -\n  have Goal: \"\\<And>P a x P'. \\<lbrakk>P \\<Longrightarrow>\\<^sub>l(a<\\<nu>x> \\<prec>\\<^sub>l P'); x \\<sharp> P\\<rbrakk> \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>e(a<\\<nu>x> \\<prec>\\<^sub>e P')\"\n  proof -\n    fix P a x P'\n    assume \"P \\<Longrightarrow>\\<^sub>l(a<\\<nu>x> \\<prec>\\<^sub>l P')\" and \"x \\<sharp> P\"\n    then obtain P'' P''' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'''\"\n                           and P'''Trans: \"P''' \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P''\"\n                           and P''Chain: \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'\"\n      by(blast dest: Weak_Late_Step_Semantics.transitionE)\n\n    from PChain have \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'''\" by(rule lateEarlyTauChain)\n    moreover from P'''Trans have \"P''' \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P''\" by(rule lateEarlyBoundOutput)\n    moreover from P''Chain have \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'\" by(rule lateEarlyTauChain)\n    ultimately show \"P \\<Longrightarrow>\\<^sub>e(a<\\<nu>x> \\<prec>\\<^sub>e P')\" by(rule Weak_Early_Step_Semantics.transitionI)\n  qed\n  have \"\\<exists>c::name. c \\<sharp> (P, P')\" by(blast intro: name_exists_fresh)\n  then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshP': \"c \\<sharp> P'\"\n    by(force simp add: fresh_prod)\n  from assms cFreshP' have \"P \\<Longrightarrow>\\<^sub>la<\\<nu>c> \\<prec>\\<^sub>l ([(x, c)] \\<bullet> P')\" by(simp add: alphaBoundResidual)\n  hence \"P \\<Longrightarrow>\\<^sub>ea<\\<nu>c> \\<prec>\\<^sub>e ([(x, c)] \\<bullet> P')\" using cFreshP by(rule Goal)\n  with cFreshP' show ?thesis by(simp add: alphaBoundOutput)\nqed\n  \nlemma earlyLateStepBoundOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>e(a<\\<nu>x> \\<prec>\\<^sub>e P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>l(a<\\<nu>x> \\<prec>\\<^sub>l P')\"\nproof -\n  have Goal: \"\\<And>P a x P'. \\<lbrakk>P \\<Longrightarrow>\\<^sub>e(a<\\<nu>x> \\<prec>\\<^sub>e P'); x \\<sharp> P\\<rbrakk> \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>l(a<\\<nu>x> \\<prec>\\<^sub>l P')\"\n  proof -\n    fix P a x P'\n    assume \"P \\<Longrightarrow>\\<^sub>e(a<\\<nu>x> \\<prec>\\<^sub>e P')\" and \"x \\<sharp> P\"\n    then obtain P'' P''' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'''\"\n                           and P'''Trans: \"P''' \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P''\"\n                           and P''Chain: \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'\"\n      by(blast dest: Weak_Early_Step_Semantics.transitionE)\n\n    from PChain have \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'''\" by(rule earlyLateTauChain)\n    moreover from P'''Trans have \"P''' \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P''\" by(rule earlyLateBoundOutput)\n    moreover from P''Chain have \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'\" by(rule earlyLateTauChain)\n    ultimately show \"P \\<Longrightarrow>\\<^sub>l(a<\\<nu>x> \\<prec>\\<^sub>l P')\" by(rule Weak_Late_Step_Semantics.transitionI)\n  qed\n  have \"\\<exists>c::name. c \\<sharp> (P, P')\" by(blast intro: name_exists_fresh)\n  then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshP': \"c \\<sharp> P'\"\n    by(force simp add: fresh_prod)\n  from assms cFreshP' have \"P \\<Longrightarrow>\\<^sub>ea<\\<nu>c> \\<prec>\\<^sub>e ([(x, c)] \\<bullet> P')\" by(simp add: alphaBoundOutput)\n  hence \"P \\<Longrightarrow>\\<^sub>la<\\<nu>c> \\<prec>\\<^sub>l ([(x, c)] \\<bullet> P')\" using cFreshP by(rule Goal)\n  with cFreshP' show ?thesis by(simp add: alphaBoundResidual)\nqed\n  \nlemma stepBoundOutputEq:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n\n  shows \"P \\<Longrightarrow>\\<^sub>e(a<\\<nu>x> \\<prec>\\<^sub>e P') = P \\<Longrightarrow>\\<^sub>l(a<\\<nu>x> \\<prec>\\<^sub>l P')\"\nby(auto intro: lateEarlyStepBoundOutput earlyLateStepBoundOutput)\n\nlemma earlyLateStepInput:\n  fixes P  :: pi\n  and   a  :: name\n  and   u  :: name\n  and   P' :: pi\n  and   C  :: \"'a::fs_name\"\n\n  assumes \"P \\<Longrightarrow>\\<^sub>e(a<u> \\<prec>\\<^sub>e P')\"\n\n  shows \"\\<exists>P'' x. P \\<Longrightarrow>\\<^sub>lu in P'' \\<rightarrow>a<x> \\<prec> P' \\<and> x \\<sharp> C\"\nproof -\n  from assms obtain P'' P''' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'''\"\n                              and P'''Trans: \"P''' \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e P''\"\n                              and P''Chain: \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'\"\n    by(blast dest: Weak_Early_Step_Semantics.transitionE)\n\n  from PChain have \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'''\" by(rule earlyLateTauChain)\n  moreover from P'''Trans obtain P'''' x where P'''Trans: \"P''' \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l P''''\" \n                                           and P''eqP'''': \"P'' = P''''[x::=u]\"\n                                           and xFreshC: \"x \\<sharp> C\"\n    by(blast dest: earlyLateInput)\n  moreover from P''Chain have \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'\" by(rule earlyLateTauChain)\n  ultimately show \"\\<exists>P'' x. P \\<Longrightarrow>\\<^sub>lu in P'' \\<rightarrow> a<x> \\<prec> P' \\<and> x \\<sharp> C\"\n    by(blast intro: Weak_Late_Step_Semantics.transitionI)\nqed\n  \nlemma lateEarlyStepInput:\n  fixes P   :: pi\n  and   u   :: name\n  and   P'' :: pi\n  and   a   :: name\n  and   x   :: name\n  and   P'  :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>lu in P'' \\<rightarrow> a<x> \\<prec> P'\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>e(a<u> \\<prec>\\<^sub>e P')\"\nproof -\n  from assms obtain P''' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'''\"\n                           and P'''Trans: \"P''' \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l P''\"\n                           and P''Chain: \"P''[x::=u] \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'\"\n    by(blast dest: Weak_Late_Step_Semantics.transitionE)\n\n  from PChain have \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'''\" by(rule lateEarlyTauChain)\n  moreover from P'''Trans have \"P''' \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e P''[x::=u]\" by(rule lateEarlyInput)\n  moreover from P''Chain have \"P''[x::=u] \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'\" by(rule lateEarlyTauChain)\n  ultimately show \"P \\<Longrightarrow>\\<^sub>e(a<u> \\<prec>\\<^sub>e P')\" by(rule Weak_Early_Step_Semantics.transitionI)\nqed\n\nlemma lateEarlyStepTau:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>l(\\<tau> \\<prec>\\<^sub>l P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>e(\\<tau> \\<prec>\\<^sub>e P')\"\nproof -\n  from assms obtain P'' P''' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'''\"\n                               and P'''Trans: \"P''' \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P''\"\n                               and P''Chain: \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'\"\n    by(blast dest: Weak_Late_Step_Semantics.transitionE)\n\n  from PChain have \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'''\" by(rule lateEarlyTauChain)\n  moreover from P'''Trans have \"P''' \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P''\" by(rule lateEarlyTau)\n  moreover from P''Chain have \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'\" by(rule lateEarlyTauChain)\n  ultimately show ?thesis by(rule Weak_Early_Step_Semantics.transitionI)\nqed\n\nlemma earlyLateStepTau:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>e(\\<tau> \\<prec>\\<^sub>e P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>l(\\<tau> \\<prec>\\<^sub>l P')\"\nproof -\n  from assms obtain P'' P''' where PChain: \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'''\"\n                               and P'''Trans: \"P''' \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P''\"\n                               and P''Chain: \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>e P'\"\n    by(blast dest: Weak_Early_Step_Semantics.transitionE)\n\n  from PChain have \"P \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'''\" by(rule earlyLateTauChain)\n  moreover from P'''Trans have \"P''' \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P''\" by(rule earlyLateTau)\n  moreover from P''Chain have \"P'' \\<Longrightarrow>\\<^sub>\\<tau>\\<^sub>l P'\" by(rule earlyLateTauChain)\n  ultimately show ?thesis by(rule Weak_Late_Step_Semantics.transitionI)\nqed\n\nlemma stepTauEq:\n  fixes P  :: pi\n  and   P' :: pi\n  \n  shows \"P \\<Longrightarrow>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P' = P \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\"\nby(blast intro: earlyLateStepTau lateEarlyStepTau)\n\n(****************** Weak Semantics *************)\n\nlemma lateEarlyOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^(a[b] \\<prec>\\<^sub>l P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^(a[b] \\<prec>\\<^sub>e P')\"\nproof -\n  from assms have \"P \\<Longrightarrow>\\<^sub>l(a[b] \\<prec>\\<^sub>l P')\"\n    by(simp add: Weak_Late_Semantics.weakTransition_def Late_Semantics.residual.inject)\n  hence \"P \\<Longrightarrow>\\<^sub>e(a[b] \\<prec>\\<^sub>e P')\" by(rule lateEarlyStepOutput)\n  thus ?thesis\n    by(simp add: Weak_Early_Semantics.weakTransition_def Early_Semantics.residual.inject)\nqed\n  \nlemma earlyLateOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^(a[b] \\<prec>\\<^sub>e P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^(a[b] \\<prec>\\<^sub>l P')\"\nproof -\n  from assms have \"P \\<Longrightarrow>\\<^sub>e(a[b] \\<prec>\\<^sub>e P')\"\n    by(simp add: Weak_Early_Semantics.weakTransition_def Early_Semantics.residual.inject)\n  hence \"P \\<Longrightarrow>\\<^sub>l(a[b] \\<prec>\\<^sub>l P')\" by(rule earlyLateStepOutput)\n  thus ?thesis\n    by(simp add: Weak_Late_Semantics.weakTransition_def Late_Semantics.residual.inject)\nqed\n\nlemma outputEq:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  shows \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^(a[b] \\<prec>\\<^sub>e P') = P \\<Longrightarrow>\\<^sub>l\\<^sup>^(a[b] \\<prec>\\<^sub>l P')\"\nby(auto intro: lateEarlyOutput earlyLateOutput)\n\nlemma lateEarlyBoundOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^(a<\\<nu>x> \\<prec>\\<^sub>l P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^(a<\\<nu>x> \\<prec>\\<^sub>e P')\"\nproof -\n  from assms have \"P \\<Longrightarrow>\\<^sub>l(a<\\<nu>x> \\<prec>\\<^sub>l P')\"\n    by(simp add: Weak_Late_Semantics.weakTransition_def Late_Semantics.residual.inject)\n  hence \"P \\<Longrightarrow>\\<^sub>e(a<\\<nu>x> \\<prec>\\<^sub>e P')\" by(rule lateEarlyStepBoundOutput)\n  thus ?thesis\n    by(simp add: Weak_Early_Semantics.weakTransition_def Early_Semantics.residual.inject)\nqed\n  \nlemma earlyLateBoundOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^(a<\\<nu>x> \\<prec>\\<^sub>e P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^(a<\\<nu>x> \\<prec>\\<^sub>l P')\"\nproof -\n  from assms have \"P \\<Longrightarrow>\\<^sub>e(a<\\<nu>x> \\<prec>\\<^sub>e P')\"\n    by(simp add: Weak_Early_Semantics.weakTransition_def Early_Semantics.residual.inject)\n  hence \"P \\<Longrightarrow>\\<^sub>l(a<\\<nu>x> \\<prec>\\<^sub>l P')\" by(rule earlyLateStepBoundOutput)\n  thus ?thesis\n    by(simp add: Weak_Late_Semantics.weakTransition_def Late_Semantics.residual.inject)\nqed\n\nlemma boundOutputEq:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  shows \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^(a<\\<nu>x> \\<prec>\\<^sub>e P') = P \\<Longrightarrow>\\<^sub>l\\<^sup>^(a<\\<nu>x> \\<prec>\\<^sub>l P')\"\nby(auto intro: lateEarlyBoundOutput earlyLateBoundOutput)\n\nlemma earlyLateInput:\n  fixes P  :: pi\n  and   a  :: name\n  and   u  :: name\n  and   P' :: pi\n  and   C  :: \"'a::fs_name\"\n\n  assumes \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^(a<u> \\<prec>\\<^sub>e P')\"\n\n  shows \"\\<exists>P'' x. P \\<Longrightarrow>\\<^sub>lu in P'' \\<rightarrow>a<x> \\<prec> P' \\<and> x \\<sharp> C\"\nproof -\n  from assms have \"P \\<Longrightarrow>\\<^sub>e(a<u> \\<prec>\\<^sub>e P')\"\n    by(simp add: Weak_Early_Semantics.weakTransition_def Early_Semantics.residual.inject)\n  thus ?thesis by(rule earlyLateStepInput)\nqed\n  \nlemma lateEarlyInput:\n  fixes P   :: pi\n  and   u   :: name\n  and   P'' :: pi\n  and   a   :: name\n  and   x   :: name\n  and   P'  :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>lu in P'' \\<rightarrow> a<x> \\<prec> P'\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^(a<u> \\<prec>\\<^sub>e P')\"\nproof -\n  from assms have \"P \\<Longrightarrow>\\<^sub>e(a<u> \\<prec>\\<^sub>e P')\" by(rule lateEarlyStepInput)\n  thus ?thesis by(simp add: Weak_Early_Semantics.weakTransition_def Early_Semantics.residual.inject)\nqed\n\nlemma lateEarlyTau:\n  fixes P  :: pi\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^(\\<tau> \\<prec>\\<^sub>l P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^(\\<tau> \\<prec>\\<^sub>e P')\"\nproof -\n  from assms show ?thesis\n  proof(induct rule: Weak_Late_Semantics.transitionCases)\n    case Stay\n    thus ?case\n      by(auto simp add: Late_Semantics.residual.inject Weak_Early_Semantics.weakTransition_def)\n  next\n    case Step\n    have \"P \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\" by fact\n    hence \"P \\<Longrightarrow>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by(rule lateEarlyStepTau)\n    thus ?case by(simp add: Weak_Early_Semantics.weakTransition_def)\n  qed\nqed\n\nlemma earlyLateTau:\n  fixes P  :: pi\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^(\\<tau> \\<prec>\\<^sub>e P')\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^(\\<tau> \\<prec>\\<^sub>l P')\"\nproof -\n  from assms show ?thesis\n  proof(induct rule: Weak_Early_Semantics.transitionCases)\n    case Stay\n    thus ?case\n      by(auto simp add: Early_Semantics.residual.inject Weak_Late_Semantics.weakTransition_def)\n  next\n    case Step\n    have \"P \\<Longrightarrow>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by fact\n    hence \"P \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\" by(rule earlyLateStepTau)\n    thus ?case by(simp add: Weak_Late_Semantics.weakTransition_def)\n  qed\nqed\n\nlemma tauEq:\n  fixes P  :: pi\n  and   P' :: pi\n  \n  shows \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^\\<tau> \\<prec>\\<^sub>e P' = P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec>\\<^sub>l P'\"\nby(blast intro: earlyLateTau lateEarlyTau)\n\n(****************** Weak Simulation ******************)\n\nabbreviation weakSimStepLate_judge (\"_ \\<leadsto>\\<^sub>l<_> _\" [80, 80, 80] 80) where \"P \\<leadsto>\\<^sub>l<Rel> Q \\<equiv> Weak_Late_Step_Sim.weakStepSim P Rel Q\"\nabbreviation weakSimStepEarly_judge (\"_ \\<leadsto>\\<^sub>e<_> _\" [80, 80, 80] 80) where \"P \\<leadsto>\\<^sub>e<Rel> Q \\<equiv> Weak_Early_Step_Sim.weakStepSimulation P Rel Q\"\nabbreviation weakSimLate_judge (\"_ \\<leadsto>\\<^sub>l\\<^sup>^<_> _\" [80, 80, 80] 80) where \"P \\<leadsto>\\<^sub>l\\<^sup>^<Rel> Q \\<equiv> Weak_Late_Sim.weakSimulation P Rel Q\"\nabbreviation weakSimEarly_judge (\"_ \\<leadsto>\\<^sub>e\\<^sup>^<_> _\" [80, 80, 80] 80) where \"P \\<leadsto>\\<^sub>e\\<^sup>^<Rel> Q \\<equiv> Weak_Early_Sim.weakSimulation P Rel Q\"\n\nlemma lateEarlyStepSim:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto>\\<^sub>l<Rel> Q\"\n\n  shows \"P \\<leadsto>\\<^sub>e<Rel> Q\"\nproof(induct rule: Weak_Early_Step_Sim.simCases)\n  case(Bound Q' a x)\n  have \"Q \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e Q'\" by fact\n  hence \"Q \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l Q'\" by(rule Strong_Early_Late_Comp.earlyLateBoundOutput)\n  moreover have \"x \\<sharp> P\" by fact\n  ultimately obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" using PSimQ\n    by(blast dest: Weak_Late_Step_Sim.simE)\n  from PTrans have \"P \\<Longrightarrow>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P'\" by(rule lateEarlyStepBoundOutput)\n  with P'RelQ' show ?case by blast\nnext\n  case(Free Q' \\<alpha>)\n  have \"Q \\<longmapsto>\\<^sub>e Early_Semantics.residual.FreeR \\<alpha> Q'\" by fact\n  thus ?case\n  proof(cases \\<alpha>, auto)\n    fix a u\n    assume \"Q \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e Q'\"\n    then obtain Q'' x where QTrans: \"Q \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l Q''\" and Q'eqQ'': \"Q' = Q''[x::=u]\"\n                        and xFreshP: \"x \\<sharp> P\"\n      by(blast dest: Strong_Early_Late_Comp.earlyLateInput[of _ _ _ _ P])\n    from PSimQ QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P'' \\<rightarrow> a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q''[x::=u]) \\<in> Rel\"\n      by(blast dest: Weak_Late_Step_Sim.simE)\n    from PTrans have \"P \\<Longrightarrow>\\<^sub>ea<u> \\<prec>\\<^sub>e P'\" by(rule lateEarlyStepInput)\n    with P'RelQ' Q'eqQ'' show \"\\<exists>P'. P \\<Longrightarrow>\\<^sub>ea<u> \\<prec>\\<^sub>e P' \\<and> (P', Q') \\<in> Rel\" by blast\n  next\n    fix a b\n    assume \"Q \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e Q'\"\n    hence \"Q \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l Q'\" by(rule Strong_Early_Late_Comp.earlyLateOutput)\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la[b] \\<prec>\\<^sub>l P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: Weak_Late_Step_Sim.simE)\n    from PTrans have \"P \\<Longrightarrow>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\" by(rule lateEarlyStepOutput)\n    with P'RelQ' show \"\\<exists>P'. P \\<Longrightarrow>\\<^sub>ea[b] \\<prec>\\<^sub>e P' \\<and> (P', Q') \\<in> Rel\"  by blast\n  next\n    assume \"Q \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e Q'\"\n    hence \"Q \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l Q'\" by(rule Strong_Early_Late_Comp.earlyLateTau)\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: Weak_Late_Step_Sim.simE)\n    from PTrans have \"P \\<Longrightarrow>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by(rule lateEarlyStepTau)\n    with P'RelQ' show \"\\<exists>P'. P \\<Longrightarrow>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P' \\<and> (P', Q') \\<in> Rel\"  by blast\n  qed\nqed\n\nlemma lateEarlySim:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto>\\<^sub>l\\<^sup>^<Rel> Q\"\n\n  shows \"P \\<leadsto>\\<^sub>e\\<^sup>^<Rel> Q\"\nproof(induct rule: Weak_Early_Sim.simCases)\n  case(Bound Q' a x)\n  have \"Q \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e Q'\" by fact\n  hence \"Q \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l Q'\" by(rule Strong_Early_Late_Comp.earlyLateBoundOutput)\n  moreover have \"x \\<sharp> P\" by fact\n  ultimately obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec>\\<^sub>l P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" using PSimQ\n    by(blast dest: Weak_Late_Sim.simE)\n  from PTrans have \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^a<\\<nu>x> \\<prec>\\<^sub>e P'\" by(rule lateEarlyBoundOutput)\n  with P'RelQ' show ?case by blast\nnext\n  case(Free Q' \\<alpha>)\n  have \"Q \\<longmapsto>\\<^sub>e Early_Semantics.residual.FreeR \\<alpha> Q'\" by fact\n  thus ?case\n  proof(cases \\<alpha>, auto)\n    fix a u\n    assume \"Q \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e Q'\"\n    then obtain Q'' x where QTrans: \"Q \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l Q''\" and Q'eqQ'': \"Q' = Q''[x::=u]\"\n                        and xFreshP: \"x \\<sharp> P\"\n      by(blast dest: Strong_Early_Late_Comp.earlyLateInput[of _ _ _ _ P])\n    from PSimQ QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P'' \\<rightarrow> a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q''[x::=u]) \\<in> Rel\"\n      by(blast dest: Weak_Late_Sim.simE)\n    from PTrans have \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^a<u> \\<prec>\\<^sub>e P'\" by(rule lateEarlyInput)\n    with P'RelQ' Q'eqQ'' show \"\\<exists>P'. P \\<Longrightarrow>\\<^sub>e\\<^sup>^a<u> \\<prec>\\<^sub>e P' \\<and> (P', Q') \\<in> Rel\" by blast\n  next\n    fix a b\n    assume \"Q \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e Q'\"\n    hence \"Q \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l Q'\" by(rule Strong_Early_Late_Comp.earlyLateOutput)\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a[b] \\<prec>\\<^sub>l P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: Weak_Late_Sim.simE)\n    from PTrans have \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^a[b] \\<prec>\\<^sub>e P'\" by(rule lateEarlyOutput)\n    with P'RelQ' show \"\\<exists>P'. P \\<Longrightarrow>\\<^sub>e\\<^sup>^a[b] \\<prec>\\<^sub>e P' \\<and> (P', Q') \\<in> Rel\"  by blast\n  next\n    assume \"Q \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e Q'\"\n    hence \"Q \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l Q'\" by(rule Strong_Early_Late_Comp.earlyLateTau)\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec>\\<^sub>l P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: Weak_Late_Sim.simE)\n    from PTrans have \"P \\<Longrightarrow>\\<^sub>e\\<^sup>^\\<tau> \\<prec>\\<^sub>e P'\" by(rule lateEarlyTau)\n    with P'RelQ' show \"\\<exists>P'. P \\<Longrightarrow>\\<^sub>e\\<^sup>^\\<tau> \\<prec>\\<^sub>e P' \\<and> (P', Q') \\<in> Rel\"  by blast\n  qed\nqed\n\n(*************** Bisimulation ***************)\n\nabbreviation weakBisimLate_judge (infixl \"\\<approx>\\<^sub>l\" 80) where \"P \\<approx>\\<^sub>l Q \\<equiv> (P, Q) \\<in> Weak_Late_Bisim.weakBisim\"\nabbreviation weakBisimEarly_judge (infixl \"\\<approx>\\<^sub>e\" 80) where \"P \\<approx>\\<^sub>e Q \\<equiv> (P, Q) \\<in> Weak_Early_Bisim.weakBisim\"\nabbreviation weakCongLate_judge (infixl \"\\<simeq>\\<^sub>l\" 80) where \"P \\<simeq>\\<^sub>l Q \\<equiv> (P, Q) \\<in> Weak_Late_Cong.congruence\"\nabbreviation weakCongEarly_judge (infixl \"\\<simeq>\\<^sub>e\" 80) where \"P \\<simeq>\\<^sub>e Q \\<equiv> (P, Q) \\<in> Weak_Early_Cong.congruence\"\n\nlemma lateEarlyBisim:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<approx>\\<^sub>l Q\"\n\n  shows \"P \\<approx>\\<^sub>e Q\"\nproof -\n  from assms show ?thesis\n  by(coinduct rule: Weak_Early_Bisim.weak_coinduct,\n     auto dest: Weak_Late_Bisim.unfoldE intro: lateEarlySim)\nqed\n\nlemma lateEarlyCong:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<simeq>\\<^sub>l Q\"\n\n  shows \"P \\<simeq>\\<^sub>e Q\"\nproof -\n  from lateEarlyBisim have \"\\<And>P Q. P \\<leadsto>\\<^sub>l<(Weak_Late_Bisim.weakBisim)> Q \\<Longrightarrow> P \\<leadsto>\\<^sub>l<(Weak_Early_Bisim.weakBisim)> Q\"\n    by(auto intro: Weak_Late_Step_Sim.monotonic)\n  with assms show ?thesis\n    by(auto simp add: Weak_Late_Cong.congruence_def Weak_Early_Cong.congruence_def intro: lateEarlyStepSim)\nqed\n\nabbreviation weakLateBisimSubst_judge (infixl \"\\<approx>\\<^sup>s\\<^sub>l\" 80) where \"P \\<approx>\\<^sup>s\\<^sub>l Q \\<equiv> (P, Q) \\<in> (substClosed Weak_Late_Bisim.weakBisim)\"\nabbreviation weakEarlyBisimSubst_judge (infixl \"\\<approx>\\<^sup>s\\<^sub>e\" 80) where \"P \\<approx>\\<^sup>s\\<^sub>e Q \\<equiv> (P, Q) \\<in> (substClosed Weak_Early_Bisim.weakBisim)\"\n\nabbreviation weakLateCongSubst_judge (infixl \"\\<simeq>\\<^sup>s\\<^sub>l\" 80) where \"P \\<simeq>\\<^sup>s\\<^sub>l Q \\<equiv> (P, Q) \\<in> (substClosed Weak_Late_Cong.congruence)\"\nabbreviation weakEarlyTongSubst_judge (infixl \"\\<simeq>\\<^sup>s\\<^sub>e\" 80) where \"P \\<simeq>\\<^sup>s\\<^sub>e Q \\<equiv> (P, Q) \\<in> (substClosed Weak_Early_Cong.congruence)\"\n\nlemma lateEarlyBisimSubst:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<approx>\\<^sup>s\\<^sub>l Q\"\n\n  shows \"P \\<approx>\\<^sup>s\\<^sub>e Q\"\nusing assms\nby(auto simp add: substClosed_def intro: lateEarlyBisim)\n\nlemma lateEarlyBisimSubst:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<simeq>\\<^sup>s\\<^sub>l Q\"\n\n  shows \"P \\<simeq>\\<^sup>s\\<^sub>e Q\"\nusing assms\nby(auto simp add: substClosed_def intro: lateEarlyCong)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Early_Late_Comp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3203981380944565}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory Addr_Type\nimports \"~~/src/HOL/Word/Word\"\nbegin\n\ntype_synonym addr_bitsize = \"64\"\ntype_synonym addr = \"addr_bitsize word\"\ndefinition addr_bitsize :: nat where \"addr_bitsize \\<equiv> 64\"\ndefinition addr_align :: nat where \"addr_align \\<equiv> 3\"\ndeclare addr_align_def[simp]\n\ndefinition addr_card :: nat where\n  \"addr_card \\<equiv> card (UNIV::addr set)\"\n\n\n\ndeclare addr_bitsize_def[simp]\n\nlemma addr_card:\n  \"addr_card = 2^addr_bitsize\"\n  by (simp add: addr_card_def card_word)\n\nlemma len_of_addr_card:\n  \"2 ^ len_of TYPE(addr_bitsize) = addr_card\"\n  by (simp add: addr_card)\n\nlemma of_nat_addr_card [simp]:\n  \"of_nat addr_card = (0::addr)\"\n  by (simp add: addr_card)\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/c-parser/umm_heap/X64/Addr_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3203981380944565}}
{"text": "(*  Title:      Native_Cast.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nchapter {* Conversions between unsigned words and between char *}\n\ntheory Native_Cast imports\n  \"HOL-Library.Code_Char\"\n  Uint8\n  Uint16\n  Uint32\n  Uint64\nbegin\n\ntext {* Auxiliary stuff *}\n\ncontext includes lifting_syntax\nbegin\n\nlemma char_of_integer_transfer [transfer_rule]:\n  \"(pcr_integer ===> op =) (\\<lambda>n. char_of_nat (nat n)) char_of_integer\"\nby(simp add: integer.pcr_cr_eq cr_integer_def rel_fun_def char_of_integer_def nat_of_integer_def)\n\nlemma integer_of_char_transfer [transfer_rule]:\n  \"(op = ===> pcr_integer) (\\<lambda>n. int (nat_of_char n)) integer_of_char\"\nby(simp add: integer.pcr_cr_eq cr_integer_def rel_fun_def integer_of_char_def)\n\nend\n\nlemma integer_of_char_char_of_integer [simp]:\n  \"0 \\<le> x \\<Longrightarrow> integer_of_char (char_of_integer x) = x mod 256\"\nunfolding integer_of_char_def char_of_integer_def o_apply nat_of_char_of_nat\nincluding integer.lifting by transfer(auto dest: nat_mod_distrib[of _ 256, symmetric])\n\nlemma char_of_integer_integer_of_char [simp]:\n  \"char_of_integer (integer_of_char x) = x\"\nby(simp add: integer_of_char_def char_of_integer_def)\n\nlemma int_lt_numeral [simp]: \"int x < numeral n \\<longleftrightarrow> x < numeral n\"\nby (metis nat_numeral zless_nat_eq_int_zless)\n\nlemma int_of_integer_ge_0: \"0 \\<le> int_of_integer x \\<longleftrightarrow> 0 \\<le> x\"\nincluding integer.lifting by transfer simp\n\nlemma integer_of_char_ge_0 [simp]: \"0 \\<le> integer_of_char x\"\nincluding integer.lifting by transfer simp\n\n\nsection {* Conversions between @{typ uint8} and @{typ char} *}\n\ndefinition uint8_of_char :: \"char \\<Rightarrow> uint8\"\nwhere \"uint8_of_char = Uint8 \\<circ> integer_of_char\"\n\ndefinition char_of_uint8 :: \"uint8 \\<Rightarrow> char\"\nwhere \"char_of_uint8 = char_of_integer \\<circ> integer_of_int \\<circ> uint \\<circ> Rep_uint8'\"\n\nlemma uint8_of_char_char_of_uint8 [simp]:\n  \"uint8_of_char (char_of_uint8 x) = x\"\napply(simp add: uint8_of_char_def char_of_uint8_def)\nincluding integer.lifting apply transfer\napply(simp add: mod_pos_pos_trivial uint_bounded[where ?'a=8, simplified])\ndone\n\nlemma char_of_uint8_uint8_of_char [simp]:\n  \"char_of_uint8 (uint8_of_char x) = x\"\nproof -\n  have \"char_of_uint8 (uint8_of_char x) = \n    char_of_integer (of_int (int_of_integer (integer_of_char x) mod 256))\"\n    by(simp add: uint8_of_char_def char_of_uint8_def Uint8.rep_eq uint_word_of_int)\n  also { have \"int_of_integer (integer_of_char x) < 256\"\n      including integer.lifting by transfer(simp add: nat_of_char_less_256) }\n  hence \"\\<dots> = x\"\n    by(simp add: semiring_numeral_div_class.mod_less int_of_integer_ge_0)\n  finally show ?thesis .\nqed\n\ncode_printing code_module Native_Casts \\<rightharpoonup> (Haskell)\n{*import qualified Data.Char;\n\nord :: Char -> Int;\nord = Data.Char.ord;\n\nchr :: Int -> Char;\nchr = Data.Char.chr;\n*}\ncode_reserved Haskell Native_Casts\n\ncode_printing constant uint8_of_char \\<rightharpoonup>\n  (SML) \"Word8.fromInt (Char.ord _)\" and\n  (Haskell) \"(Prelude.fromIntegral (Native'_Casts.ord _) :: Uint8.Word8)\" and\n  (Scala) \"_.toByte\"\n| constant char_of_uint8 \\<rightharpoonup>\n  (SML) \"Char.chr (Word8.toInt _)\" and\n  (Haskell) \"Native'_Casts.chr (Prelude.fromIntegral _)\" and\n  (Scala) \"((_).toInt & 0xFF).toChar\"\n\nsection {* Conversion between native words *}\n\nlift_definition uint8_of_uint16 :: \"uint16 \\<Rightarrow> uint8\" is ucast .\nlift_definition uint8_of_uint32 :: \"uint32 \\<Rightarrow> uint8\" is ucast .\nlift_definition uint8_of_uint64 :: \"uint64 \\<Rightarrow> uint8\" is ucast .\n\nlift_definition uint16_of_uint8 :: \"uint8 \\<Rightarrow> uint16\" is ucast .\nlift_definition uint16_of_uint32 :: \"uint32 \\<Rightarrow> uint16\" is ucast .\nlift_definition uint16_of_uint64 :: \"uint64 \\<Rightarrow> uint16\" is ucast .\n\nlift_definition uint32_of_uint8 :: \"uint8 \\<Rightarrow> uint32\" is ucast .\nlift_definition uint32_of_uint16 :: \"uint16 \\<Rightarrow> uint32\" is ucast .\nlift_definition uint32_of_uint64 :: \"uint64 \\<Rightarrow> uint32\" is ucast .\n\nlift_definition uint64_of_uint8 :: \"uint8 \\<Rightarrow> uint64\" is ucast .\nlift_definition uint64_of_uint16 :: \"uint16 \\<Rightarrow> uint64\" is ucast .\nlift_definition uint64_of_uint32 :: \"uint32 \\<Rightarrow> uint64\" is ucast .\n\ndefinition mask where \"mask = (0xFFFFFFFF :: integer)\"\nexport_code mask in OCaml\n\ncode_printing\n  constant uint8_of_uint16 \\<rightharpoonup>\n  (SML_word) \"Word8.fromLarge (Word16.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint8.Word8)\" and\n  (Scala) \"_.toByte\"\n| constant uint8_of_uint32 \\<rightharpoonup>\n  (SML) \"Word8.fromLarge (Word32.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint8.Word8)\" and\n  (Scala) \"_.toByte\"\n| constant uint8_of_uint64 \\<rightharpoonup>\n  (SML) \"Word8.fromLarge (Uint64.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint8.Word8)\" and\n  (Scala) \"_.toByte\"\n| constant uint16_of_uint8 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLarge (Word8.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint16.Word16)\" and\n  (Scala) \"((_).toInt & 0xFF).toChar\"\n| constant uint16_of_uint32 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLarge (Word32.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint16.Word16)\" and\n  (Scala) \"_.toChar\"\n| constant uint16_of_uint64 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLarge (Uint64.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint16.Word16)\" and\n  (Scala) \"_.toChar\"\n| constant uint32_of_uint8 \\<rightharpoonup>\n  (SML) \"Word32.fromLarge (Word8.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint32.Word32)\" and\n  (Scala) \"((_).toInt & 0xFF)\"\n| constant uint32_of_uint16 \\<rightharpoonup>\n  (SML_word) \"Word32.fromLarge (Word16.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint32.Word32)\" and\n  (Scala) \"(_).toInt\"\n| constant uint32_of_uint64 \\<rightharpoonup>\n  (SML_word) \"Word32.fromLarge (Uint64.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint32.Word32)\" and\n  (Scala) \"(_).toInt\" and\n  (OCaml) \"Int64.to'_int32\"\n| constant uint64_of_uint8 \\<rightharpoonup>\n  (SML_word) \"Word64.fromLarge (Word8.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint64.Word64)\" and\n  (Scala) \"((_).toLong & 0xFF)\"\n| constant uint64_of_uint16 \\<rightharpoonup>\n  (SML_word) \"Word64.fromLarge (Word16.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint64.Word64)\" and\n  (Scala) \"_.toLong\"\n| constant uint64_of_uint32 \\<rightharpoonup>\n  (SML_word) \"Word64.fromLarge (Word32.toLarge _)\" and\n  (Haskell) \"(Prelude.fromIntegral _ :: Uint64.Word64)\" and\n  (Scala) \"((_).toLong & 0xFFFFFFFFL)\" and\n  (OCaml) \"Int64.logand (Int64.of'_int32 _) (Int64.of'_string \\\"4294967295\\\")\"\n\ntext {* \n  Use @{const Abs_uint8'} etc. instead of @{const Rep_uint8} in code equations\n  for conversion functions to avoid exceptions during code generation when the\n  target language provides only some of the uint types.\n*}\n\nlemma uint8_of_uint16_code [code]:\n  \"uint8_of_uint16 x = Abs_uint8' (ucast (Rep_uint16' x))\"\nby transfer simp\n\nlemma uint8_of_uint32_code [code]:\n  \"uint8_of_uint32 x = Abs_uint8' (ucast (Rep_uint32' x))\"\nby transfer simp\n\nlemma uint8_of_uint64_code [code]:\n  \"uint8_of_uint64 x = Abs_uint8' (ucast (Rep_uint64' x))\"\nby transfer simp\n\nlemma uint16_of_uint8_code [code]:\n  \"uint16_of_uint8 x = Abs_uint16' (ucast (Rep_uint8' x))\"\nby transfer simp\n\nlemma uint16_of_uint32_code [code]:\n  \"uint16_of_uint32 x = Abs_uint16' (ucast (Rep_uint32' x))\"\nby transfer simp\n\nlemma uint16_of_uint64_code [code]:\n  \"uint16_of_uint64 x = Abs_uint16' (ucast (Rep_uint64' x))\"\nby transfer simp\n\nlemma uint32_of_uint8_code [code]:\n  \"uint32_of_uint8 x = Abs_uint32' (ucast (Rep_uint8' x))\"\nby transfer simp\n\nlemma uint32_of_uint16_code [code]:\n  \"uint32_of_uint16 x = Abs_uint32' (ucast (Rep_uint16' x))\"\nby transfer simp\n\nlemma uint32_of_uint64_code [code]:\n  \"uint32_of_uint64 x = Abs_uint32' (ucast (Rep_uint64' x))\"\nby transfer simp\n\nlemma uint64_of_uint8_code [code]:\n  \"uint64_of_uint8 x = Abs_uint64' (ucast (Rep_uint8' x))\"\nby transfer simp\n\nlemma uint64_of_uint16_code [code]:\n  \"uint64_of_uint16 x = Abs_uint64' (ucast (Rep_uint16' x))\"\nby transfer simp\n\nlemma uint64_of_uint32_code [code]:\n  \"uint64_of_uint32 x = Abs_uint64' (ucast (Rep_uint32' x))\"\nby transfer simp\n\nend\n", "meta": {"author": "PLSysSec", "repo": "ct-wasm-proofs", "sha": "3fa5c38ecda3d05c351096ba5e6d7ba1df793c21", "save_path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs", "path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs/ct-wasm-proofs-3fa5c38ecda3d05c351096ba5e6d7ba1df793c21/CT-WASM_model/AFP/Native_Word/Native_Cast.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241632752915, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3203981309544686}}
{"text": "(* Author: Peter Lammich *)\nchapter \\<open>Parsing\\<close>\nsection \\<open>Parser Combinators\\<close>\n\ntheory Parser_Combinator\nimports\n  \"HOL-Library.Monad_Syntax\"\n  \"HOL-Library.Char_ord\"\n  \"HOL-Library.Code_Target_Nat\"\n  \"Certification_Monads.Error_Monad\"\n  Error_Monad_Add\n  \"Show.Show\"\n  \"HOL-Library.Rewrite\"\nbegin\n\n  (**\n    Parser Combinators, based on Sternagel et Thiemann's Parser_Monad, with the following additional features/differences:\n\n    * Setup for the function package, to handle recursion\n      parser uses fuel to ensure termination.\n    * Uses (unit \\<Rightarrow> shows) for error messages instead of String (lazy computation of messages, more comfortable due to shows)\n    * Everything defined over generic token type\n    * Some fancy combinators\n        a \\<parallel> b    choice, type a = type b\n        --[f]    sequential composition, combine results with f\n        --       = --[Pair]\n        --*      seq, ignore right result\n        *--      seq, ignore left result\n\n    TODO/FIXME\n\n    * Currently, the bind and repeat operation dynamically check whether input is consumed and then fail.\n      At least for bind (no input is generated), we could try to encode this information into the parser's type.\n      However, interplay with function package is not clear at this point :(\n      Possible solution: Fixed-point based recursion combinator and partial_function. We could then do totality proof afterwards.\n\n\n  *)\n\n\nsubsection \\<open>Type Definitions\\<close>\n\ndatatype 'a len_list = LL (ll_fuel: nat) (ll_list: \"'a list\")\ndefinition \"ll_from_list l \\<equiv> LL (length l) l\"\n\nlemma [measure_function]: \"is_measure ll_fuel\" by rule\n\ntext \\<open>\n  A parser takes a list of tokes and returns either an error message or\n  a result together with the remaining tokens.\n\\<close>\n\ntype_synonym\n  ('t, 'a) parser = \"'t len_list \\<Rightarrow> (unit \\<Rightarrow> shows) + ('a \\<times> 't len_list)\"\n\ntext \\<open>A \\emph{consuming parser} (cparser for short) consumes at least one token of input.\\<close>\ndefinition is_cparser :: \"('t,'a) parser \\<Rightarrow> bool\"\nwhere\n  \"is_cparser p \\<longleftrightarrow> (\\<forall>l l' x. p l = Inr (x,l') \\<longrightarrow> ll_fuel l' < ll_fuel l)\"\n\nlemma is_cparserI:\n  assumes \"\\<And>l l' x. p l = Inr (x, l') \\<Longrightarrow> ll_fuel l' < ll_fuel l\"\n  shows \"is_cparser p\"\n  using assms unfolding is_cparser_def by blast\n\nlemma is_cparserE:\n  assumes \"is_cparser p\"\n    and \"(\\<And>l l' x. p l = Inr (x, l') \\<Longrightarrow> ll_fuel l' < ll_fuel l) \\<Longrightarrow> P\"\n  shows \"P\"\n  using assms by (auto simp: is_cparser_def; blast)\n\nlemma is_cparser_length[simp, dest]:\n  assumes \"p l = Inr (x, l')\" and \"is_cparser p\"\n  shows \"ll_fuel l' < ll_fuel l\"\n  using assms by (blast elim: is_cparserE)\n\ntext \\<open>Used by fundef congruence rules\\<close>\ndefinition \"PCONG_INR x ts' \\<equiv> Inr (x,ts')\"\n\nlemma PCONG_EQ_D[dest!]:\n  assumes \"p l = PCONG_INR x l'\"\n  assumes \"is_cparser p\"\n  shows \"ll_fuel l' < ll_fuel l\"\n  using assms unfolding PCONG_INR_def by auto\n\nnamed_theorems parser_rules\n\nlemmas parser0_rules = disjI1 disjI2 allI impI conjI\n\nthm disjI2 asm_rl\n\n\nML \\<open>\n  structure Parser_Combinator = struct\n\n    val cfg_simproc = Attrib.setup_config_bool @{binding parser_simproc} (K true)\n\n    val cfg_debug = Attrib.setup_config_bool @{binding parser_debug} (K false)\n\n    fun trace_tac ctxt msg = if Config.get ctxt cfg_debug then print_tac ctxt msg else all_tac\n    fun trace_tac' ctxt msg i =\n      if Config.get ctxt cfg_debug then\n        print_tac ctxt (msg ^ \" on subgoal \" ^ Int.toString i)\n      else all_tac\n\n    fun prove_cparser_step_tac ctxt =\n      let\n        val p_rls = Named_Theorems.get ctxt @{named_theorems parser_rules}\n      in\n        trace_tac' ctxt \"prove_cparser_step\" THEN'\n        (\n          resolve_tac ctxt (@{thms parser0_rules} @ p_rls)\n          ORELSE' SOLVED' (asm_simp_tac ctxt)\n        )\n      end\n\n\n    fun prove_cparser_tac ctxt =\n      trace_tac ctxt \"prove_cparser\" THEN\n      DEPTH_SOLVE (FIRSTGOAL (prove_cparser_step_tac ctxt))\n\n    fun add_cparser_def def_thm context = let\n      val ctxt = Context.proof_of context\n      val orig_ctxt = ctxt\n\n      val ctxt = Config.put cfg_simproc false ctxt\n\n      val (def_thm, ctxt) = yield_singleton (apfst snd oo Variable.import true) def_thm ctxt\n\n      val lhs = def_thm\n        |> Local_Defs.meta_rewrite_rule ctxt\n        |> (fst o Logic.dest_equals o Thm.prop_of)\n\n      val T = fastype_of lhs\n      val cp_stmt =\n           Const (@{const_name is_cparser}, T --> HOLogic.boolT)$lhs\n        |> HOLogic.mk_Trueprop\n\n      fun is_cparser_free (@{const Trueprop} $ (Const (@{const_name is_cparser},_) $ Free _)) = true\n        | is_cparser_free _ = false\n\n      fun is_goal_ok st =\n        Thm.prop_of st |> Logic.strip_imp_prems\n        |> map (Logic.strip_assums_concl)\n        |> forall is_cparser_free\n\n      val cp_thm =\n        cp_stmt |> Thm.cterm_of ctxt\n        |> Goal.init\n        |> SINGLE (\n            unfold_tac ctxt [def_thm] THEN\n            trace_tac ctxt \"cparser def proof\" THEN\n            DEPTH_FIRST is_goal_ok (\n              FIRSTGOAL (prove_cparser_step_tac ctxt)\n            )\n          )\n\n      val cp_thm = case cp_thm of\n        NONE => error \"Could not prove any is_cparser theorem: Empty result sequence\"\n      | SOME thm =>\n          Goal.conclude thm\n\n\n      val cp_thm =\n           singleton (Variable.export ctxt orig_ctxt) cp_thm\n        |> Drule.zero_var_indexes\n\n      (*\n      val cp_thm =\n        Goal.prove ctxt [] [] cp_stmt (fn {context, ...} => tac context)\n      |> singleton (Variable.export ctxt orig_ctxt)\n      *)\n\n      val context = Named_Theorems.add_thm @{named_theorems parser_rules} cp_thm context\n    in\n      context\n    end\n  end\n\\<close>\n\n\nattribute_setup consuming = \\<open>\n  Scan.succeed (Thm.declaration_attribute (Parser_Combinator.add_cparser_def))\n\\<close>\n\nsimproc_setup is_cparser_prover (\"is_cparser p\") = \\<open>fn _ => fn ctxt => fn ct =>\n  if Config.get ctxt Parser_Combinator.cfg_simproc then\n    let\n      open Parser_Combinator\n      val t = Thm.term_of ct\n      val stmt = Logic.mk_equals (t,@{term True})\n\n      val _ = if Config.get ctxt cfg_debug then\n          (Pretty.block [Pretty.str \"is_cparser simproc invoked on: \", Syntax.pretty_term ctxt t, Pretty.fbrk, Syntax.pretty_term ctxt stmt]) |> Pretty.string_of |> tracing\n        else ()\n\n      val ctxt = Config.put Parser_Combinator.cfg_simproc false ctxt\n\n      val othm = try (Goal.prove ctxt [] [] stmt) (fn {context=ctxt, ...} =>\n        FIRSTGOAL (resolve_tac ctxt @{thms HOL.Eq_TrueI})\n        THEN TRY (Parser_Combinator.prove_cparser_tac ctxt)\n      )\n\n      val _ =\n        if Config.get ctxt cfg_debug andalso is_none othm then\n          (Pretty.block [Pretty.str \"is_cparser simproc failed on: \", Syntax.pretty_term ctxt t, Pretty.fbrk, Syntax.pretty_term ctxt stmt]) |> Pretty.string_of |> tracing\n        else ()\n\n      (*\n      val _ = case othm of\n        NONE => (Pretty.block [Pretty.str \"is_cparser simproc failed on: \", Syntax.pretty_term ctxt t, Pretty.fbrk, Syntax.pretty_term ctxt stmt]) |> Pretty.string_of |> warning\n     | SOME _ => ();\n      *)\n    in\n      othm\n    end\n  else\n    NONE\n\\<close>\n\ntext \\<open>Wrapping a parser to dynamically assert that it consumes tokens.\\<close>\ndefinition ensure_cparser :: \"('t,'a) parser \\<Rightarrow> ('t,'a) parser\" where\n  \"ensure_cparser p \\<equiv> \\<lambda>ts. do {\n    (x, ts') \\<leftarrow> p ts;\n    if (ll_fuel ts' < ll_fuel ts) then Error_Monad.return (x,ts')\n    else Error_Monad.error (\\<lambda>_. shows ''Dynamic parser check failed'')\n  }\"\n\nlemma ensure_cparser_cparser[parser_rules]: \"is_cparser (ensure_cparser p)\"\n  apply (rule is_cparserI)\n  unfolding ensure_cparser_def\n  by (auto simp: Error_Monad.bind_def split: sum.splits if_splits)\n\nlemma ensure_cparser_cong[fundef_cong]:\n  assumes \"l=l'\"\n  assumes \"p l = p' l'\"\n  shows \"ensure_cparser p l = ensure_cparser p' l'\"\n  using assms by (auto simp: ensure_cparser_def)\n\n\nabbreviation bnf_eq :: \"('t,'a) parser \\<Rightarrow> ('t,'a) parser \\<Rightarrow> prop\" (infix \"::=\" 2) where\n  \"bnf_eq p1 p2 \\<equiv> (\\<And>l. p1 l = p2 l)\"\n\n\n\nsubsection \\<open>Monad-Setup for Parsers\\<close>\n\ndefinition return :: \"'a \\<Rightarrow> ('t, 'a) parser\"\nwhere\n  \"return x = (\\<lambda>ts. Error_Monad.return (x, ts))\"\n\ndefinition error_aux :: \"(unit \\<Rightarrow> shows) \\<Rightarrow> ('t, 'a) parser\"\nwhere\n  \"error_aux e = (\\<lambda>_. Error_Monad.error e)\"\n\nabbreviation error where \"error s \\<equiv> error_aux (ERR s)\"\nabbreviation \"error_str s \\<equiv> error_aux (ERRS s)\"\n\ndefinition update_error :: \"('t,'a) parser \\<Rightarrow> (shows \\<Rightarrow> shows) \\<Rightarrow> ('t,'a) parser\"\n  where \"update_error m f l \\<equiv> m l <+? (\\<lambda>e _. f (e ()))\"\n\ndefinition ensure_parser :: \"('t,'a) parser \\<Rightarrow> ('t,'a) parser\" where\n  \"ensure_parser p \\<equiv> \\<lambda>ts. do {\n    (x, ts') \\<leftarrow> p ts;\n    if (ll_fuel ts' \\<le> ll_fuel ts) then Error_Monad.return (x,ts')\n    else Error_Monad.error (ERRS ''Dynamic parser check failed'')\n  }\"\n\ndefinition bind :: \"('t, 'a) parser \\<Rightarrow> ('a \\<Rightarrow> ('t, 'b) parser) \\<Rightarrow> ('t, 'b) parser\"\nwhere\n  \"bind m f \\<equiv> \\<lambda>ts. do {\n    (x, ts) \\<leftarrow> ensure_parser m ts;\n    ensure_parser (f x) ts\n  }\"\n\ndefinition get :: \"('t,'t) parser\" where\n  \"get ll \\<equiv> case ll of LL (Suc n) (x#xs) \\<Rightarrow> Error_Monad.return (x,LL n xs) | _ \\<Rightarrow> (Error_Monad.error (\\<lambda>_. shows_string ''Expecting more input''))\"\n\ndefinition get_tokens :: \"('t,'t list) parser\" where\n  \"get_tokens \\<equiv> \\<lambda>ll. Error_Monad.return (ll_list ll,ll)\"\n\nadhoc_overloading\n      Monad_Syntax.bind bind\n  and Error_Syntax.update_error update_error\n\n(* TODO: Specialize to parser type? *)\nlemma let_cong' [fundef_cong]:\n  \"M = N \\<Longrightarrow> l=l' \\<Longrightarrow> (\\<And>x. x = N \\<Longrightarrow> f x l' = g x l') \\<Longrightarrow> Let M f l = Let N g l'\"\n  unfolding Let_def by blast\n\nlemma if_cong' [fundef_cong]:\n  assumes \"b = c\"\n    and \"l=l'\"\n    and \"c \\<Longrightarrow> x l' = u l'\"\n    and \"\\<not> c \\<Longrightarrow> y l' = v l'\"\n  shows \"(if b then x else y) l = (if c then u else v) l'\"\n  using assms by simp\n\nlemma split_cong' [fundef_cong]:\n  \"l=l' \\<Longrightarrow> (\\<And>x y. (x, y) = q \\<Longrightarrow> f x y l' = g x y l' ) \\<Longrightarrow> p = q \\<Longrightarrow> case_prod f p l = case_prod g q l'\"\n  by (auto simp: split_def)\n\n\n\nlemma is_cparser_bind[parser_rules]:\n  assumes \"is_cparser p \\<or> (\\<forall>x. is_cparser (q x))\"\n  shows \"is_cparser (p \\<bind> q)\"\n  apply (rule is_cparserI)\n  using assms unfolding is_cparser_def bind_def Error_Monad.bind_def ensure_parser_def\n  by (fastforce split: sum.splits if_splits)\n\nlemma return_eq[simp]: \"return x l = Inr y \\<longleftrightarrow> y=(x,l)\"\n  unfolding return_def by auto\n\n\nlemma is_cparser_error[parser_rules]: \"is_cparser (error_aux e)\"\n  by (auto simp: error_aux_def intro: is_cparserI)\n\nlemma is_cparser_get[parser_rules]:\n  \"is_cparser get\"\n  apply (rule is_cparserI)\n  apply (auto simp: get_def split: len_list.splits nat.splits list.splits)\n  done\n\nlemma monad_laws[simp]:\n  \"bind m return = ensure_parser m\"\n  \"bind (return x) f = ensure_parser (f x)\"\n  \"bind (bind m f) g = bind m (\\<lambda>x. bind (f x) g)\"\n  \"ensure_parser (ensure_parser m) = ensure_parser m\"\n  \"bind (ensure_parser m) f = bind m f\"\n  \"bind m (\\<lambda>x. ensure_parser (f x)) = bind m f\"\n  unfolding bind_def return_def ensure_parser_def Error_Monad.bind_def\n  by (auto split: if_splits sum.splits prod.splits intro!: ext)\n\nsubsection \\<open>More Combinators\\<close>\n\nterm \"shows\"\n\n\ndefinition err_expecting_aux :: \"(unit \\<Rightarrow> shows) \\<Rightarrow> ('t::show, 'a) parser\"\nwhere\n  \"err_expecting_aux msg = do { ts \\<leftarrow> get_tokens; error\n    (shows_string ''expecting '' o msg () o shows_string '', but found: '' o shows_quote (shows (take 100 ts)))}\"\n\nabbreviation err_expecting :: \"shows \\<Rightarrow> ('t::show, 'a) parser\"\nwhere\n  \"err_expecting msg \\<equiv> err_expecting_aux (\\<lambda>_. msg)\"\n\nabbreviation \"err_expecting_str msg \\<equiv> err_expecting (shows_string msg)\"\n\ndefinition \"eoi \\<equiv> do {\n  tks \\<leftarrow> get_tokens; if tks=[] then return () else err_expecting_str ''end of input'' }\"\n\n\ndefinition alt :: \"(_,'a) parser \\<Rightarrow> (_,'b) parser \\<Rightarrow> (_,'a+'b) parser\" where\n  \"alt p1 p2 l \\<equiv> try   do { (r,l) \\<leftarrow> p1 l; Error_Monad.return (Inl r, l) }\n                 catch (\\<lambda>e1. (try do { (r,l) \\<leftarrow> p2 l; Error_Monad.return (Inr r, l) }\n                 catch (\\<lambda>e2. Error_Monad.error (\\<lambda>_. e1 () o shows ''\\<newline>  | '' o e2 ()))))\"\n\nfun sum_join where\n  \"sum_join (Inl x) = x\" | \"sum_join (Inr x) = x\"\n\nabbreviation alt' :: \"(_,'a) parser \\<Rightarrow> (_,'a) parser \\<Rightarrow> (_,'a) parser\" (infixr \"\\<parallel>\" 53)\n  where \"alt' p q \\<equiv> alt p q \\<bind> return o sum_join\"\n\nabbreviation gseq :: \"('t,'a) parser \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> 'c) \\<Rightarrow> ('t,'b) parser \\<Rightarrow> ('t,'c) parser\" (\"_--[_]_\" [61,0,60] 60)\n  where \"gseq p f q \\<equiv> p \\<bind> (\\<lambda>a. q \\<bind> (\\<lambda>b. return (f a b)))\" (* TODO/FIXME: Do-notation and abbreviation generate additional type vars here *)\n\nabbreviation seq :: \"('t,'a) parser \\<Rightarrow> ('t,'b) parser \\<Rightarrow> ('t,'a\\<times>'b) parser\" (infixr \"--\" 60)\n  where \"seq p q \\<equiv> p --[Pair] q\"\n\nabbreviation seq_ignore_left :: \"('t,'a) parser \\<Rightarrow> ('t,'b) parser \\<Rightarrow> ('t,'b) parser\" (infixr \"*--\" 60)\n  where \"p *-- q \\<equiv> p --[\\<lambda>_ x. x] q\"\n\nabbreviation seq_ignore_right :: \"('t,'a) parser \\<Rightarrow> ('t,'b) parser \\<Rightarrow> ('t,'a) parser\" (infixr \"--*\" 60)\n  where \"p --* q \\<equiv> p --[\\<lambda>x _. x] q\"\n\nabbreviation map_result :: \"('t,'a) parser \\<Rightarrow> ('a\\<Rightarrow>'b) \\<Rightarrow> ('t,'b) parser\" (infixr \"with\" 54)\n  where \"p with f \\<equiv> p \\<bind> return o f\"\n\ndefinition \"exactly ts \\<equiv> foldr (\\<lambda>t p. do { x\\<leftarrow>get; if x=t then p \\<bind> return o (#) x else error id}) ts (return [])\n    \\<parallel> err_expecting (shows_string ''Exactly '' o shows ts)\"\n\ndeclare err_expecting_aux_def[consuming]\n\nlemma alt_is_cparser[parser_rules]:\n  \"is_cparser p \\<Longrightarrow> is_cparser q \\<Longrightarrow> is_cparser (alt p q)\"\n  apply (rule is_cparserI)\n  unfolding alt_def\n  by (auto simp: Error_Monad.bind_def split: sum.splits)\n\nlemma alt_cong[fundef_cong]:\n  \"\\<lbrakk> l=l'; p1 l = p1' l'; \\<And>e. p1' l' = Inl e \\<Longrightarrow> p2 l = p2' l' \\<rbrakk> \\<Longrightarrow> alt p1 p2 l = alt p1' p2' l'\"\n  unfolding alt_def by (auto split: sum.splits simp: Error_Monad.bind_def)\n\nlemma [parser_rules]: \"ts\\<noteq>[] \\<Longrightarrow> is_cparser (exactly ts)\"\n  by (cases ts) (auto simp: exactly_def intro: parser_rules)\n\n\nabbreviation optional :: \"'a \\<Rightarrow> ('t,'a) parser \\<Rightarrow> ('t,'a) parser\" where\n  \"optional dflt p \\<equiv> p \\<parallel> return dflt\"\n\nterm \"a\\<^sup>*\"\n\nabbreviation maybe :: \"('t,'a) parser \\<Rightarrow> ('t,'a option) parser\" (\"(_?)\" [1000] 999)\n  where \"p? \\<equiv> p with Some \\<parallel> return None\"\n\n\nsubsubsection \\<open>Repeat\\<close>\n\nfun repeat :: \"('t,'a) parser \\<Rightarrow> ('t,'a list) parser\" where\n  \"repeat p ::= optional [] (ensure_cparser p --[(#)] repeat p)\"\n\nabbreviation \"repeat1 p \\<equiv> p --[(#)] repeat p\"\n\n\ndeclare repeat.simps[simp del]\n\nlemma repeat_cong[fundef_cong]:\n  assumes \"\\<And>nts. \\<lbrakk> ll_fuel nts \\<le> ll_fuel l' \\<rbrakk> \\<Longrightarrow> p (nts) = p' (nts)\"\n  assumes \"l=l'\"\n  shows \"repeat p l = repeat p' l'\"\n  using assms(1)\n  unfolding \\<open>l=l'\\<close>\n  apply (induction p l' rule: repeat.induct)\n  apply (rewrite in \"_=\\<hole>\" repeat.simps)\n  apply (rewrite in \"\\<hole>=_\" repeat.simps)\n  apply (intro alt_cong bind_cong)\n  apply (auto simp: ensure_cparser_def PCONG_INR_def)\n  done\n\nsubsubsection \\<open>Left and Right Associative Chaining\\<close>\ntext \\<open>Parse a sequence of \\<open>A\\<close> separated by \\<open>F\\<close>,\n  and then fold the sequence with the results of \\<open>F\\<close>,\n  either left or right associative.\n\n  Example: Assume we have the input \\<open>x\\<^sub>1 o\\<^sub>1 \\<dots> o\\<^sub>n\\<^sub>-\\<^sub>1 x\\<^sub>n\\<close>,\n    and the result of parsing the \\<open>x\\<close> with \\<open>A\\<close> and the \\<open>o\\<close> with \\<open>F\\<close>\n    are \\<open>a\\<^sub>i\\<close> and \\<open>+\\<^sub>i\\<close>.\n    Then, \\<open>chainL1\\<close> returns \\<open>(\\<dots>((a\\<^sub>1 +\\<^sub>1 a\\<^sub>2) +\\<^sub>2 a\\<^sub>3) +\\<^sub>3 \\<dots>) \\<close>\n    and \\<open>chainR1\\<close> returns \\<open>a\\<^sub>1 +\\<^sub>1 (a\\<^sub>2 +\\<^sub>2 (a\\<^sub>3 +\\<^sub>3 \\<dots>)\\<dots>) \\<close>\n\\<close>\ncontext\n  fixes A :: \"('t,'a) parser\"\n  fixes F :: \"('t,'a\\<Rightarrow>'a\\<Rightarrow>'a) parser\"\nbegin\n  definition chainL1 :: \"('t,'a) parser\" where\n    \"chainL1 \\<equiv> do {\n      x \\<leftarrow> A;\n      xs \\<leftarrow> repeat (F --[\\<lambda>f b a. f a b] A);\n      return (foldl (\\<lambda>a f. f a) x xs)\n    }\"\n\n  qualified fun fold_shiftr :: \"('a \\<Rightarrow> (('a\\<Rightarrow>'a\\<Rightarrow>'a)\\<times>'a) list \\<Rightarrow> 'a)\" where\n    \"fold_shiftr a [] = a\"\n  | \"fold_shiftr a ((f,b)#xs) = f a (fold_shiftr b xs)\"\n\n  definition chainR1 :: \"('t,'a) parser\" where\n    \"chainR1 \\<equiv> do {\n      x \\<leftarrow> A;\n      xs \\<leftarrow> repeat (F -- A);\n      return (fold_shiftr x xs)\n    } \"\n\nend\n\n\nlemma chainL1_cong[fundef_cong]:\n  assumes \"\\<And>l2. ll_fuel l2 \\<le> ll_fuel l' \\<Longrightarrow> A l2 = A' l2\"\n  assumes \"\\<And>l2. ll_fuel l2 \\<le> ll_fuel l' \\<Longrightarrow> F l2 = F' l2\"\n  assumes \"l=l'\"\n  shows \"chainL1 A F l = chainL1 A' F' l'\"\n  unfolding chainL1_def\n  apply (intro bind_cong repeat_cong assms order_refl)\n  by auto\n\nlemma chainR1_cong[fundef_cong]:\n  assumes \"\\<And>l2. ll_fuel l2 \\<le> ll_fuel l' \\<Longrightarrow> A l2 = A' l2\"\n  assumes \"\\<And>l2. ll_fuel l2 \\<le> ll_fuel l' \\<Longrightarrow> F l2 = F' l2\"\n  assumes \"l=l'\"\n  shows \"chainR1 A F l = chainR1 A' F' l'\"\n  unfolding chainR1_def\n  apply (intro bind_cong repeat_cong assms order_refl)\n  by auto\n\n\n\n\nsubsection \\<open>Lexing Utilities\\<close>\n\ndefinition tk_with_prop' :: \"shows \\<Rightarrow> ('t::show \\<Rightarrow> bool) \\<Rightarrow> ('t,'t) parser\" where\n  [consuming]: \"tk_with_prop' errmsg \\<Phi> \\<equiv> do {\n    x\\<leftarrow>get;\n    if \\<Phi> x then return x\n    else err_expecting errmsg\n  }\"\n\nabbreviation tk_with_prop :: \"('t::show \\<Rightarrow> bool) \\<Rightarrow> ('t,'t) parser\" where\n  \"tk_with_prop \\<equiv> tk_with_prop' id\"\n\ndefinition range :: \"'t::{linorder,show} \\<Rightarrow> 't \\<Rightarrow> ('t,'t) parser\" where\n  [consuming]: \"range a b \\<equiv> do {\n    x\\<leftarrow>get;\n    if a\\<le>x \\<and> x\\<le>b then return x\n    else err_expecting (shows_string ''Token in range '' o shows a o shows_string '' - '' o shows b) }\"\n\ndefinition any :: \"'t::show list \\<Rightarrow> ('t,'t) parser\" where\n  [consuming]: \"any ts \\<equiv> do { t\\<leftarrow>get; if t\\<in>set ts then return t else err_expecting (shows_string ''One of '' o shows ts) }\"\n\ndefinition \"gen_token ws p \\<equiv> ws *-- p\"\n\nlemma [parser_rules]: \"is_cparser p \\<Longrightarrow> is_cparser (gen_token ws p)\"\n  unfolding gen_token_def by simp\n\nsubsubsection \\<open>Characters\\<close>\nabbreviation (input) \"char_tab \\<equiv> CHR 0x09\"\nabbreviation (input) \"char_carriage_return \\<equiv> CHR 0x0D\"\nabbreviation (input) \"char_wspace \\<equiv> [CHR '' '', CHR ''\\<newline>'', char_tab, char_carriage_return]\"\n\ntext \\<open>Some standard idioms\\<close>\ndefinition [consuming]: \"lx_lowercase \\<equiv> (range CHR ''a'' CHR ''z'' )\"\ndefinition [consuming]: \"lx_uppercase \\<equiv> (range CHR ''A'' CHR ''Z'' )\"\ndefinition [consuming]: \"lx_alpha \\<equiv> (lx_lowercase \\<parallel> lx_uppercase)\"\ndefinition [consuming]: \"lx_digit \\<equiv> (range CHR ''0'' CHR ''9'' )\"\nabbreviation \"lx_alphanum \\<equiv> lx_alpha \\<parallel> lx_digit\"\n\nsubsection \\<open>Code Generator Setup\\<close>\ndeclare monad_laws[code_unfold]\nlemma bind_return_o_unfold[code_unfold]: \"(m \\<bind> return o f) = do { x\\<leftarrow>m; return (f x)}\" by (auto simp: o_def)\ndeclare split[code_unfold] (* TODO: Should this be code_unfold by default? *)\n\n\nsubsection \\<open>Utilities for Parsing\\<close>\n\ntext \\<open>Project out remainder token sequence\\<close>\nfun show_pres where\n  \"show_pres (Inr (ll,_)) = Inr ll\"\n| \"show_pres (Inl e) = Inl e\"\n\ntext \\<open>Parse complete input, parameterized by parser for trailing whitespace\\<close>\ndefinition \"parse_all ws p \\<equiv> show_pres o (p --* ws --* eoi) o ll_from_list o String.explode\"\n\ndefinition \"parse_all_implode ws p s \\<equiv> parse_all ws p s <+? (\\<lambda>msg. String.implode (msg () ''''))\"\n\ndefinition \"parse_all_implode_nows p s \\<equiv> parse_all_implode (return ()) p s\"\n\n\nML \\<open>\n  (* Read file to string *)\n  fun file_to_string name = let\n    val f = TextIO.openIn name\n    val s = TextIO.inputAll f\n    val _ = TextIO.closeIn f\n  in s end\n\\<close>\n\n\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Parsing/Parser_Combinator.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185498374789, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.32037699047283136}}
{"text": "header {* Additions to Imperative/HOL *}\ntheory Imperative_HOL_Add\nimports \"~~/src/HOL/Imperative_HOL/Imperative_HOL\" \nbegin \n\ntext {* This theory loads the Imperative HOL framework and provides \n        some additional lemmas needed for the separation logic framework. *} \n\ntext {* Arrays and references can also be stored on the heap *}\ninstance array :: (type) heap ..\ninstance ref :: (type) heap ..\n\ntext {* Characters can be stored on the heap *}\ninstantiation char :: heap begin\n  instance ..\nend\n\n\ntext {* A stronger elimination rule for @{text ref} *}\n\nlemma effect_ref[effect_elims]:\n  assumes \"effect (ref (x::('a::heap))) h h' r\"\n  obtains \"r = fst (Ref.alloc x h)\"\n  and \"h' = snd (Ref.alloc x h)\"\n  using assms\n  unfolding effect_def\nproof -\n  case goal1\n  from goal1(2) have \"r = fst (Ref.alloc x h)\" \"h' = snd (Ref.alloc x h)\" \n    by (auto simp add: execute_simps)\n  from goal1(1)[OF this] show ?thesis by simp\nqed\n\n\ntext {* Some lemmas about the evaluation of the limit for modifications on \n  a heap *}\n\nlemma lim_Ref_alloc[simp]: \"lim (snd (Ref.alloc x h)) = Suc (lim h)\"\n  unfolding Ref.alloc_def\n  by (simp add: Let_def)\n\nlemma lim_Array_alloc[simp]: \"lim (snd (Array.alloc x h)) = Suc (lim h)\"\n  unfolding Array.alloc_def Array.set_def\n  by (simp add: Let_def)\n\n\nlemma lim_Array_set[simp]: \"lim (Array.set a xs h) = lim h\"\n  unfolding Array.set_def\n  by (simp add: Let_def)\n\nthm Array.update_def\nlemma lim_Array_update[simp]: \"lim (Array.update a i x h) = lim h\"\n  unfolding Array.update_def\n  by (simp add: Let_def)\n\n\ntext {* Simplification rules for the addresses of new allocated arrays and\n  references *}\n\nlemma addr_of_ref_alloc[simp]:\n  \"addr_of_ref (fst (Ref.alloc x h)) = lim h\"\n  unfolding Ref.alloc_def\n  by (simp add: Let_def)\n\nlemma addr_of_array_alloc[simp]:\n  \"addr_of_array (fst (Array.alloc x h)) = lim h\"\n  unfolding Array.alloc_def\n  by (simp add: Let_def)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Separation_Logic_Imperative_HOL/Tools/Imperative_HOL_Add.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.32037698218554034}}
{"text": "text \\<open>\nThere is a bug.\nIn detail, see the comment of fun pr_term_from.\n\\<close>\n\ntheory Subgoal\n  imports Kernel\nbegin\n\nsection \\<open>type_synonyms\\<close>\n(*todo*)\n(*make be more modular*)\n\ntype_synonym \"prop\" = type\n\ntype_synonym \"subgoal\" = \"prop list \\<times> prop\"\ndefinition assms_of :: \"subgoal \\<Rightarrow> prop list\" where \"assms_of = fst\"\ndefinition thesis_of :: \"subgoal \\<Rightarrow> prop\" where \"thesis_of = snd\"\n\ndatatype inf_rule =\n  Assume type |\n  Imp_I type |\n  Imp_E\n\n\\<comment> \\<open>derivation tree as inf_rule list\\<close>\n(*fixme*)\ntype_synonym deriv_tree = \"inf_rule list\"\n\ntype_synonym pr_state = \"subgoal list \\<times> deriv_tree\"\ndefinition subgoals_of :: \"pr_state \\<Rightarrow> subgoal list\" where \"subgoals_of = fst\"\ndefinition deriv_tree_of :: \"pr_state \\<Rightarrow> deriv_tree\" where \"deriv_tree_of = snd\"\n\n\nsection \\<open>proof term constructor\\<close>\ndefinition fresh_var :: \"(type \\<Rightarrow> name list) \\<Rightarrow> name\" where\n  \"fresh_var e = (SOME n. \\<forall>T. n \\<notin> set (e T))\"\n\n\\<comment> \\<open>construct proof term from derivation tree\\<close>\n\\<comment> \\<open>pr_term_from accumulator_term type_env_as_type_to_nat_list_fun deriv_tree \\<Rightarrow> pr_term\\<close>\n(*fixme*)\ntext \\<open>\nThere is a bug.\nIf a variable occurs some times,\nthen this fun can't create the proof term correctly.\ne.g., I can't prove S = \\<lambda>x y z. x z (y z): (a \\<rightarrow> b \\<rightarrow> c) \\<rightarrow> (a \\<rightarrow> b) \\<rightarrow> a \\<rightarrow> c,\nwhile I can prove \\<lambda>x y z w. x z (y w): (a \\<rightarrow> b \\<rightarrow> c) \\<rightarrow> (a \\<rightarrow> b) \\<rightarrow> a \\<rightarrow> a \\<rightarrow> c.\n\\<close>\nfun pr_term_from :: \"Kernel.term option list \\<Rightarrow> (type \\<Rightarrow> name list) \\<Rightarrow> deriv_tree \\<Rightarrow> Kernel.term option list\" where\n  \"pr_term_from ts _ [] = ts\" |\n  \"pr_term_from ts e (r # rs) = (case r of\n    Assume T \\<Rightarrow> let v = fresh_var e in\n      pr_term_from (assume v T # ts) (e(T := v # e T)) rs |\n    Imp_I T \\<Rightarrow> (case e T of\n      [] \\<Rightarrow> pr_term_from (imp_i (fresh_var e) T (hd ts) # tl ts) e rs |\n      n # ns \\<Rightarrow> pr_term_from (imp_i n T (hd ts) # tl ts) (e(T := ns)) rs) |\n    Imp_E \\<Rightarrow> (case ts of\n      t2 # t1 # ts \\<Rightarrow> pr_term_from (imp_e t1 t2 # ts) e rs))\"\n(*printable version*)\n(*\nfun pr_term_from :: \"term option list \\<Rightarrow> (type \\<Rightarrow> name list) \\<Rightarrow> deriv_tree \\<Rightarrow> name \\<Rightarrow> term option list\" where\n  \"pr_term_from ts _ [] _ = ts\" |\n  \"pr_term_from ts e (r # rs) i = (case r of\n    Assume T \\<Rightarrow> let v = i in\n      pr_term_from (mk_var v T # ts) (e(T := v # e T)) rs (next i) |\n    Imp_I T \\<Rightarrow> (case e T of\n      [] \\<Rightarrow> pr_term_from (mk_abs i T (hd ts) # tl ts) e rs (next i) |\n      n # ns \\<Rightarrow> pr_term_from (mk_abs n T (hd ts) # tl ts) (e(T := ns)) rs i) |\n    Imp_E \\<Rightarrow> (case ts of\n      t2 # t1 # ts \\<Rightarrow> pr_term_from (mk_app t1 t2 # ts) e rs i))\"\n*)\n\n\nsection \\<open>method\\<close>\ndatatype method =\n  Assumption |\n  Rule_Imp_I |\n  Rule_Imp_E \"prop\"\n(*future work*)\n(*\ncreating a new rule from theorem\ntype_synonym method = \"subgoal \\<Rightarrow> subgoal list\"\ndefinition \"rule\" :: \"prop \\<Rightarrow> method\" where\ndefinition inf_rule_from :: \"method \\<Rightarrow> inf_rule\" where\n  \"inf_rule_from m = (if m = rule_impI then\n    )\"\n*)\n\n\nsection \\<open>interaction\\<close>\ndefinition \"lemma\" :: \"prop \\<Rightarrow> pr_state\" where\n  \"lemma T = ([([], T)], [])\"\ndefinition \"apply\" :: \"pr_state \\<Rightarrow> method \\<Rightarrow> pr_state\" (infixl \"apply\" 500) where\n  \"ps apply m = (case subgoals_of ps of sg # sgs \\<Rightarrow> (case m of\n    Assumption \\<Rightarrow> if thesis_of sg \\<in> set (assms_of sg) then (sgs, (Assume (thesis_of sg)) # deriv_tree_of ps) else undefined |\n    Rule_Imp_I \\<Rightarrow> (case thesis_of sg of Fun T1 T2 \\<Rightarrow> ((T1 # assms_of sg, T2) # sgs, Imp_I T1 # deriv_tree_of ps)) |\n    Rule_Imp_E P \\<Rightarrow> ((assms_of sg, Fun P (thesis_of sg)) # (assms_of sg, P) # sgs, Imp_E # deriv_tree_of ps)))\"\ndefinition \"done\" :: \"pr_state \\<Rightarrow> prop \\<times> Kernel.term\" (\"_ done\" 400) where\n  \"ps done = (case pr_term_from [] (\\<lambda>T. []) (deriv_tree_of ps) of [t] \\<Rightarrow> print t)\"\n(*printable version*)\n(*\ndefinition \"done\" :: \"pr_state \\<Rightarrow> prop \\<times> term\" (\"_ done\" 400) where\n  \"ps done = (case pr_term_from [] (\\<lambda>T. []) (deriv_tree_of ps) X of [t] \\<Rightarrow> print t)\"\n*)\n\n\nsection \\<open>test\\<close>\n(*test*)\n(*printable version*)\n(*\nvalue \"\nlemma (''a'':* \\<rightarrow>> ''a'':* )\n  apply Rule_Imp_I\n  apply Assumption\n  done\n\"\nvalue \"\nlemma ((''a'':* \\<rightarrow>> ''b'':* \\<rightarrow>> ''c'':* ) \\<rightarrow>> (''a'':* \\<rightarrow>> ''b'':* ) \\<rightarrow>> ''a'':* \\<rightarrow>> ''c'':* )\n  apply Rule_Imp_I\n  apply Rule_Imp_I\n  apply Rule_Imp_I\n  apply (Rule_Imp_E (''b'':* ))\n  apply (Rule_Imp_E (''a'':* ))\n  apply Assumption\n  apply Assumption\n  apply (Rule_Imp_E (''a'':* ))\n  apply Assumption\n  apply Assumption\n  done\n\"\n*)\n\n\n(*future work*)\n(*\ntheorem soundness: \"\\<exists>ms. ((foldl (apply) (lemma l) ms) done) = (T, t) \\<Longrightarrow> l = T \\<and> T = type_of t \\<and> well_typed t\"\n  sorry\n(*inductive provable*)\ntheorem completeness: \"True\" ..\n*)\n\nend", "meta": {"author": "mayet-layla", "repo": "itp-kernel-isa", "sha": "16d250c8aabf17607f33ebbf15dad31b6d2780bb", "save_path": "github-repos/isabelle/mayet-layla-itp-kernel-isa", "path": "github-repos/isabelle/mayet-layla-itp-kernel-isa/itp-kernel-isa-16d250c8aabf17607f33ebbf15dad31b6d2780bb/Subgoal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961013, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3203769821855403}}
{"text": "theory Soundness\n  imports Typing Semantics Typing_Lemmas\nbegin\n\nno_notation Set.member  (\"(_/ : _)\" [51, 51] 50)\n\ndeclare term.fv_defs[simp]\ndeclare \\<tau>.fv_defs[simp]\n\ntheorem progress: \"\\<lbrakk> \\<Gamma> , \\<Delta> \\<turnstile> e : \\<tau> ; \\<nexists>x \\<sigma>. BVar x \\<sigma> \\<in> \\<Gamma> \\<rbrakk> \\<Longrightarrow> is_value e \\<or> (\\<exists>e'. e \\<longrightarrow> e')\"\nproof (induction \\<Gamma> \\<Delta> e \\<tau> rule: Tm.induct)\n  case (Tm_App \\<Gamma> \\<Delta> e1 \\<tau>1 \\<tau>2 e2)\n  from Tm_App(3)[OF Tm_App(5)] show ?case\n  proof (elim disjE)\n    assume \"is_value e1\"\n    then show ?thesis using ST_Beta Tm_App(1) fun_ty_val is_value.simps(4) by blast\n  next\n    assume \"\\<exists>e1'. Step e1 e1'\"\n    then obtain e1' where \"Step e1 e1'\" by blast\n    then have \"Step (App e1 e2) (App e1' e2)\" by (rule ST_App)\n    then show ?thesis by blast\n  qed\nnext\n  case (Tm_Let e1 \\<tau>1 x e2 \\<tau>2)\n  then show ?case using ST_Let by blast\nnext\n  case (Tm_TAbs a k \\<Gamma> \\<Delta> e \\<sigma>)\n  then show ?case using ST_TAbs by fastforce\nnext\n  case (Tm_TApp \\<Gamma> \\<Delta> e a k \\<sigma> \\<tau>)\n  from Tm_TApp(3)[OF Tm_TApp(4)] show ?case\n  proof (elim disjE)\n    assume \"is_value e\"\n    then show ?thesis by (metis ST_TBeta Tm_TApp.hyps(1) forall_ty_val head_ctor.simps(5) head_ctor_is_value is_value.simps(3))\n  next\n    assume \"\\<exists>e'. Step e e'\"\n    then show ?thesis using ST_TApp by fast\n  qed\nqed auto\n\nlemma weaken_isin: \"\\<lbrakk> bndr \\<in> (\\<Gamma> @ \\<Gamma>') ; \\<Delta> \\<turnstile> \\<Gamma> @ xs @ \\<Gamma>' \\<rbrakk> \\<Longrightarrow> bndr \\<in> (\\<Gamma> @ xs @ \\<Gamma>')\"\nproof (induction \\<Gamma> arbitrary: bndr \\<Gamma>' xs)\n  case Nil\n  then show ?case by (cases bndr rule: binder.exhaust) (auto simp: isin_subset)\nnext\n  case (Cons b \\<Gamma>)\n  have 1: \"\\<Delta> \\<turnstile> \\<Gamma> @ xs @ \\<Gamma>'\" using Cons(3) Ctx.cases by auto\n  then show ?case\n  proof (cases b rule: binder.exhaust)\n    case (BVar x \\<tau>)\n    then show ?thesis using 1 Cons by (cases bndr rule: binder.exhaust) auto\n  next\n    case (BTyVar a k)\n    then show ?thesis using 1 Cons by (cases bndr rule: binder.exhaust) auto\n  qed\nqed\n\nlemma weaken_ty: \"\\<lbrakk> \\<Gamma> @ \\<Gamma>' , \\<Delta>  \\<turnstile>\\<^sub>t\\<^sub>y \\<tau> : k ; \\<Delta> \\<turnstile> \\<Gamma> @ xs @ \\<Gamma>' \\<rbrakk> \\<Longrightarrow> \\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau> : k\"\nproof (nominal_induct \\<tau> avoiding: \\<Gamma> \\<Gamma>' xs k rule: \\<tau>.strong_induct)\n  case (TyVar x)\n  have 1: \"BTyVar x k \\<in> (\\<Gamma> @ \\<Gamma>')\" by (cases rule: Ty.cases[OF TyVar(1)]) auto\n  show ?case by (rule Ty_Var[OF TyVar(2) weaken_isin[OF 1 TyVar(2)]])\nnext\n  case (TyData T)\n  then have \"AxData T k \\<in> set \\<Delta>\" by blast\n  then show ?case by (rule Ty_Data[OF TyData(2)])\nnext\n  case TyArrow\n  then have \"k = (\\<star> \\<rightarrow> \\<star> \\<rightarrow> \\<star>)\" by blast\n  then show ?case using Ty_Arrow[OF TyArrow(2)] by argo\nnext\n  case (TyApp \\<tau>1 \\<tau>2)\n  then obtain k1 where P: \"\\<Gamma> @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>1 : k1 \\<rightarrow> k\" \"\\<Gamma> @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>2 : k1\" by blast\n  have 2: \"\\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>1 : k1 \\<rightarrow> k\" by (rule TyApp(1)[OF P(1) TyApp(4)])\n  have 3: \"\\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>2 : k1\" by (rule TyApp(2)[OF P(2) TyApp(4)])\n  show ?case by (rule Ty_App[OF 2 3])\nnext\n  case (TyForall a k1 \\<sigma>)\n  have P: \"(BTyVar a k1 # \\<Gamma>) @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : \\<star>\" \"k = \\<star>\" using Ty_Forall_Inv[OF TyForall(6)] TyForall(1,2) fresh_append by auto\n  have 1: \"atom a \\<sharp> \\<Gamma> @ xs @ \\<Gamma>'\" using TyForall(1-3) fresh_append by blast\n  have 2: \"\\<Delta> \\<turnstile> (BTyVar a k1 # \\<Gamma>) @ xs @ \\<Gamma>'\" using Ctx_TyVar[OF TyForall(7) 1] by simp\n  have 3: \"BTyVar a k1 # \\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : \\<star>\" using TyForall(5)[OF P(1) 2] by simp\n  show ?case using Ty_Forall[OF 3] P(2) by simp\nqed\n\nlemma weaken_axioms_ty: \"\\<lbrakk> \\<Gamma> , \\<Delta>' @ \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau> : k ; \\<Delta>' @ xs @ \\<Delta> \\<turnstile> \\<Gamma> \\<rbrakk> \\<Longrightarrow> \\<Gamma> ,  \\<Delta>' @ xs @ \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau> : k\"\nproof (nominal_induct \\<tau> avoiding: \\<Delta> \\<Delta>' k xs \\<Gamma> rule: \\<tau>.strong_induct)\n  case (TyApp \\<tau>1 \\<tau>2)\n  then show ?case using Ty_App by blast\nnext\n  case (TyForall a k1 \\<sigma>)\n  have P: \"BTyVar a k1 # \\<Gamma> , \\<Delta>' @ \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : \\<star>\" \"k = \\<star>\" using Ty_Forall_Inv[OF TyForall(7,5)] by auto\n  have 1: \"BTyVar a k1 # \\<Gamma> , \\<Delta>' @ xs @ \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : \\<star>\" by (rule TyForall(6)[OF P(1) Ctx_TyVar[OF TyForall(8,5)]])\n  show ?case using Ty_Forall[OF 1] P(2) by argo\nqed (auto intro: Ty_intros)\n\nlemma weaken_tm: \"\\<lbrakk> \\<Gamma> @ \\<Gamma>' , \\<Delta> \\<turnstile> e : \\<tau> ; \\<Delta> \\<turnstile> \\<Gamma> @ xs @ \\<Gamma>' \\<rbrakk> \\<Longrightarrow> \\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile> e : \\<tau>\"\nproof (nominal_induct e avoiding: \\<Gamma> \\<Gamma>' xs \\<tau> rule: term.strong_induct)\n  case (Var x)\n  then have 1: \"BVar x \\<tau> \\<in> (\\<Gamma> @ \\<Gamma>')\" by (cases rule: Tm.cases[OF Var(1)]) auto\n  have 2: \"BVar x \\<tau> \\<in> (\\<Gamma> @ xs @ \\<Gamma>')\" by (rule weaken_isin[OF 1 Var(2)])\n  show ?case by (rule Tm_Var[OF Var(2) 2])\nnext\n  case (App e1 e2)\n  then obtain \\<tau>1 where P: \"\\<Gamma> @ \\<Gamma>' , \\<Delta> \\<turnstile> e1 : \\<tau>1 \\<rightarrow> \\<tau>\" \"\\<Gamma> @ \\<Gamma>' , \\<Delta> \\<turnstile> e2 : \\<tau>1\" by blast\n  have 1: \"\\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile> e1 : \\<tau>1 \\<rightarrow> \\<tau>\" by (rule App(1)[OF P(1) App(4)])\n  have 2: \"\\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile> e2 : \\<tau>1\" by (rule App(2)[OF P(2) App(4)])\n  show ?case by (rule Tm_App[OF 1 2])\nnext\n  case (TApp e \\<sigma>)\n  then obtain a k \\<sigma>1 where P: \"\\<Gamma> @ \\<Gamma>' , \\<Delta> \\<turnstile> e : \\<forall> a:k. \\<sigma>1\" \"\\<Gamma> @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : k\" \"\\<tau> = \\<sigma>1[\\<sigma>/a]\" by blast\n  have 1: \"\\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile> e : \\<forall> a:k. \\<sigma>1\" by (rule TApp(1)[OF P(1) TApp(3)])\n  have 2: \"\\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : k\" by (rule weaken_ty[OF P(2) TApp(3)])\n  show ?case using Tm_TApp[OF 1 2] P(3) by simp\nnext\n  case (Ctor D)\n  then have \"AxCtor D \\<tau> \\<in> set \\<Delta>\" by blast\n  then show ?case by (rule Tm_Ctor[OF Ctor(2)])\nnext\n  case (Lam x \\<tau>1 e)\n  have 1: \"atom x \\<sharp> \\<Gamma> @ \\<Gamma>'\" using fresh_append Lam(1,2) by blast\n  obtain \\<tau>2 where P: \"(BVar x \\<tau>1 # \\<Gamma>) @ \\<Gamma>' , \\<Delta> \\<turnstile> e : \\<tau>2\" \"\\<tau> = (\\<tau>1 \\<rightarrow> \\<tau>2)\" using T_Abs_Inv[OF Lam(6) 1] by auto\n  have 2: \"\\<Gamma> @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>1 : \\<star>\" using P(1) context_valid(2) by fastforce\n  have 3: \"\\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>1 : \\<star>\" by (rule weaken_ty[OF 2 Lam(7)])\n  have 4: \"atom x \\<sharp> \\<Gamma> @ xs @ \\<Gamma>'\" using fresh_append Lam(1-3) by blast\n  have 5: \"\\<Delta> \\<turnstile> (BVar x \\<tau>1 # \\<Gamma>) @ xs @ \\<Gamma>'\" using Ctx_Var[OF 3 4] by simp\n  have 6: \"BVar x \\<tau>1 # \\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile> e : \\<tau>2\" using Lam(5)[OF P(1) 5] by simp\n  show ?case using Tm_Abs[OF 6] P(2) by simp\nnext\n  case (TyLam a k e)\n  have 1: \"atom a \\<sharp> \\<Gamma> @ \\<Gamma>'\" using fresh_append TyLam(1,2) by blast\n  obtain \\<sigma> where P: \"(BTyVar a k # \\<Gamma>) @ \\<Gamma>' , \\<Delta> \\<turnstile> e : \\<sigma>\" \"\\<tau> = (\\<forall> a : k . \\<sigma>)\" using T_AbsT_Inv[OF TyLam(6) 1 TyLam(4)] by auto\n  have 2: \"atom a \\<sharp> \\<Gamma> @ xs @ \\<Gamma>'\" using fresh_append TyLam(1-3) by blast\n  have 3: \"\\<Delta> \\<turnstile> (BTyVar a k # \\<Gamma>) @ xs @ \\<Gamma>'\" using Ctx_TyVar[OF TyLam(7) 2] by simp\n  have 4: \"BTyVar a k # \\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile> e : \\<sigma>\" using TyLam(5)[OF P(1) 3] by simp\n  show ?case using Tm_TAbs[OF 4] P(2) by simp\nnext\n  case (Let x \\<tau>1 e1 e2)\n  have 1: \"atom x \\<sharp> \\<Gamma> @ \\<Gamma>'\" using fresh_append Let(1,2) by blast\n  have P: \"\\<Gamma> @ \\<Gamma>' , \\<Delta> \\<turnstile> e1 : \\<tau>1\" \"(BVar x \\<tau>1 # \\<Gamma>) @ \\<Gamma>' , \\<Delta> \\<turnstile> e2 : \\<tau>\" using T_Let_Inv[OF Let(7) 1] by auto\n  have 2: \"\\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile> e1 : \\<tau>1\" by (rule Let(5)[OF P(1) Let(8)])\n  have 3: \"\\<Gamma> @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>1 : \\<star>\" using P(2) context_valid(2) by fastforce\n  have 4: \"\\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>1 : \\<star>\" by (rule weaken_ty[OF 3 Let(8)])\n  have 5: \"atom x \\<sharp> \\<Gamma> @ xs @ \\<Gamma>'\" using fresh_append Let(1-3) by blast\n  have 6: \"\\<Delta> \\<turnstile> (BVar x \\<tau>1 # \\<Gamma>) @ xs @ \\<Gamma>'\" using Ctx_Var[OF 4 5] by simp\n  have 7: \"BVar x \\<tau>1 # \\<Gamma> @ xs @ \\<Gamma>' , \\<Delta> \\<turnstile> e2 : \\<tau>\" using Let(6)[OF P(2) 6] by simp\n  show ?case by (rule Tm_Let[OF 2 7])\nqed\nlemmas weaken = weaken_isin weaken_ty weaken_tm weaken_axioms_ty\n\nlemma strengthen_aux:\n  shows \"(\\<Delta> \\<turnstile> (\\<Gamma>' @ BVar x \\<tau> # \\<Gamma>) \\<longrightarrow> \\<Delta> \\<turnstile> (\\<Gamma>' @ \\<Gamma>))\"\n  and \"(\\<Gamma>' @ BVar x \\<tau> # \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : k \\<longrightarrow> \\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : k)\"\nproof (induction rule: Ctx_Ty_induct_split)\n  case (Ctx_TyVar \\<Gamma>' b k2)\n  then show ?case by (metis Ctx.simps append_Cons fresh_Cons fresh_append)\nnext\n  case (Ctx_Var \\<Gamma>' \\<tau> x)\n  then show ?case by (metis Ctx.simps append_Cons fresh_Cons fresh_append)\nnext\n  case (Ty_Var \\<Gamma>' b k2)\n  then show ?case using Ax_Ctx_Ty.Ty_Var isin_superset_tyvar by blast\nqed (auto intro: Ty_intros)\n\ncorollary strengthen_context: \"\\<Delta> \\<turnstile> \\<Gamma>' @ BVar x \\<tau> # \\<Gamma> \\<Longrightarrow> \\<Delta> \\<turnstile> \\<Gamma>' @ \\<Gamma>\"\n  using strengthen_aux context_split_valid by blast\ncorollary strengthen_ty: \"\\<Gamma>' @ BVar x \\<tau> # \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : k \\<Longrightarrow> \\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : k\"\n  using strengthen_aux context_split_valid context_valid(1) by blast\nlemmas strengthen = strengthen_context strengthen_ty\n\nlemma type_substitution_aux:\n  assumes \"\\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : k\"\n  shows \"(\\<Delta> \\<turnstile> (\\<Gamma>' @ BTyVar a k # \\<Gamma>) \\<longrightarrow> \\<Delta> \\<turnstile> (subst_context \\<Gamma>' \\<sigma> a @ \\<Gamma>))\"\n    and \"(\\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau> : k2 \\<longrightarrow> subst_context \\<Gamma>' \\<sigma> a @ \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y subst_type \\<tau> \\<sigma> a : k2)\"\nproof (induction rule: Ctx_Ty_induct_split)\n  case Ctx_Empty\n  then show ?case using context_valid(1)[OF assms] by simp\nnext\n  case (Ctx_TyVar \\<Gamma>' b k2)\n  then have \"atom b \\<sharp> \\<sigma>\" using assms fresh_Cons fresh_append fresh_in_context_ty by blast\n  then have 1: \"atom b \\<sharp> \\<Gamma>'[\\<sigma>/a] @ \\<Gamma>\" by (meson Ctx_TyVar(3) fresh_Cons fresh_append fresh_subst_context_tyvar)\n  show ?case using Ax_Ctx_Ty.Ctx_TyVar[OF Ctx_TyVar(2) 1] assms by auto\nnext\n  case (Ctx_Var \\<Gamma>' \\<tau> x)\n  have 1: \"atom x \\<sharp> \\<Gamma>'[\\<sigma>/a] @ \\<Gamma>\" by (meson Ctx_Var(3) fresh_Cons fresh_append fresh_subst_context_var)\n  show ?case using Ax_Ctx_Ty.Ctx_Var[OF Ctx_Var(2) 1] by simp\nnext\n  case (Ty_Var \\<Gamma>' b k2)\n  then show ?case\n    proof (cases \"b = a\")\n    case True\n    then have \"k = k2\" using isin_same(1) Ty_Var by blast\n    then have \"\\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y (TyVar b)[\\<sigma>/a] : k2\" using True assms(1) by simp\n    then show ?thesis using weaken_ty[of \"[]\"] Ty_Var(2) by auto\n  next\n    case False\n    have 1: \"BTyVar b k2 \\<in> (\\<Gamma>'[\\<sigma>/a] @ \\<Gamma>)\" by (rule isin_subst_tyvar[OF Ty_Var(3,1) False])\n    show ?thesis using Ax_Ctx_Ty.Ty_Var[OF Ty_Var(2) 1] False by simp\n  qed\nnext\n  case (Ty_Forall \\<Gamma>' b k2 \\<sigma>')\n  have 1: \"a \\<noteq> b\" by (metis CtxE(1) Ty_Forall(1) binder.fresh(2) context_valid_ty fresh_Cons fresh_append fresh_at_base(2))\n  then have 2: \"BTyVar b k2 # \\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma>'[\\<sigma>/a] : \\<star>\" using Ty_Forall(2) by simp\n  show \"\\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y (\\<forall> b : k2 . \\<sigma>')[\\<sigma>/a] : \\<star>\" using Ax_Ctx_Ty.Ty_Forall[OF 2]\n    by (metis \"1\" \"2\" CtxE(1) assms atom_eq_iff context_valid_ty fresh_Pair fresh_append fresh_at_base(2) fresh_in_context_ty subst_type.simps(5))\nqed (auto intro: Ty_intros)\n\ncorollary type_substitution_context: \"\\<lbrakk> \\<Delta> \\<turnstile> \\<Gamma>' @ BTyVar a k # \\<Gamma> ; \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : k \\<rbrakk> \\<Longrightarrow> \\<Delta> \\<turnstile> \\<Gamma>'[\\<sigma>/a] @ \\<Gamma>\"\n  using type_substitution_aux by blast\ncorollary type_substitution_ty: \"\\<lbrakk> \\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau> : k2 ; \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : k \\<rbrakk> \\<Longrightarrow> \\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>[\\<sigma>/a] : k2\"\n  using type_substitution_aux by blast\n\nlemma typing_regularity: \"\\<Gamma> , \\<Delta> \\<turnstile> e : \\<tau> \\<Longrightarrow> \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau> : \\<star>\"\nproof (induction \\<Gamma> \\<Delta> e \\<tau> rule: Tm.induct)\n  case (Tm_Var \\<Delta> \\<Gamma> x \\<tau>)\n  then obtain \\<Gamma>1 \\<Gamma>2 where 1: \"\\<Gamma> = \\<Gamma>1 @ BVar x \\<tau> # \\<Gamma>2\" using isin_split by blast\n  then have \"\\<Gamma>2 , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau> : \\<star>\" using context_regularity Tm_Var(1) by blast\n  then show ?case using weaken_ty[of \"[]\" \\<Gamma>2 \\<Delta> \\<tau> \\<star> \"\\<Gamma>1 @ [BVar x \\<tau>]\"] Tm_Var(1) 1 by simp\nnext\n  case (Tm_Abs x \\<tau>1 \\<Gamma> \\<Delta> e \\<tau>2)\n  have 1: \"\\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>1 : \\<star>\" using context_regularity context_valid(1)[OF Tm_Abs(2)] by blast\n  have 2: \"\\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>2 : \\<star>\" using strengthen_ty[of \"[]\"] Tm_Abs(2) by force\n  have 3: \"\\<Delta> \\<turnstile> \\<Gamma>\" by (rule context_valid(1)[OF 1])\n  show ?case by (rule Ty_App[OF Ty_App[OF Ty_Arrow[OF 3] 1] 2])\nnext\n  case (Tm_TApp \\<Gamma> \\<Delta> e a k \\<sigma> \\<tau>)\n  obtain a' \\<sigma>' where P: \"(\\<forall> a:k. \\<sigma>) = (\\<forall> a':k. \\<sigma>')\" \"BTyVar a' k # \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma>' : \\<star>\" by (cases rule: Ty.cases[OF Tm_TApp(3)]) auto\n  have \"\\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma>'[\\<tau>/a'] : \\<star>\" using type_substitution_ty[of \"[]\", OF _ Tm_TApp(2)] P by auto\n  then show ?case using P(1) subst_type_same by auto\nnext\n  case (Tm_Ctor \\<Delta> \\<Gamma> D \\<tau>)\n  from Tm_Ctor(1) have 1: \"\\<turnstile> \\<Delta>\" by (rule axioms_valid(1))\n  then obtain \\<Delta>1 \\<Delta>2 where 2: \"\\<Delta> = \\<Delta>1 @ AxCtor D \\<tau> # \\<Delta>2\" using axiom_isin_split[OF Tm_Ctor(2) 1] by blast\n  then have \"[] , \\<Delta>2 \\<turnstile>\\<^sub>t\\<^sub>y \\<tau> : \\<star>\" using axioms_regularity 1 by blast\n  then have \"[] , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau> : \\<star>\" using weaken(4)[of \"[]\" \"[]\" \\<Delta>2 \\<tau> \\<star> \"\\<Delta>1 @ [AxCtor D \\<tau>]\"] 1 2 Ctx_Empty by simp\n  then show ?case using weaken(2)[of \"[]\" \"[]\"] Tm_Ctor(1) by simp\nnext\n  case (Tm_Let \\<Gamma> e1 \\<tau>1 x e2 \\<tau>2)\n  then show ?case using strengthen_ty[of \"[]\"] by force\nqed (auto intro: Ty_intros)\n\nlemma isin_subst_var: \"\\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> Var x : \\<tau> \\<Longrightarrow> BVar x \\<tau>[\\<sigma>/a] \\<in> (\\<Gamma>'[\\<sigma>/a] @ \\<Gamma>)\"\nproof (induction \\<Gamma>')\n  case Nil\n  then have \"atom a \\<sharp> \\<tau>\" by (metis CtxE(1) TmE(1) Tm_Var append_eq_Cons_conv fresh_in_context_ty isin.simps(3) typing_regularity)\n  then show ?case using Nil.prems fresh_subst_type_same by auto\nnext\n  case (Cons bndr \\<Gamma>')\n  then show ?case using Tm_Var by (cases bndr rule: binder.exhaust) auto\nqed\n\nlemma type_substitution_term: \"\\<lbrakk> \\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> e : \\<tau> ; \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<sigma> : k \\<rbrakk> \\<Longrightarrow> \\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile> e[\\<sigma>/a] : \\<tau>[\\<sigma>/a]\"\nproof (nominal_induct e avoiding: \\<tau> a \\<sigma> \\<Gamma>' \\<Gamma> rule: term.strong_induct)\n  case (Var x)\n  then have P: \"\\<Delta> \\<turnstile> \\<Gamma>' @ BTyVar a k # \\<Gamma>\" \"BVar x \\<tau> \\<in> (\\<Gamma>' @ BTyVar a k # \\<Gamma>)\" by auto\n  have 1: \"\\<Delta> \\<turnstile> \\<Gamma>'[\\<sigma>/a] @ \\<Gamma>\" by (rule type_substitution_context[OF P(1) Var(2)])\n  then show ?case using Tm_Var[OF 1] Var isin_subst_var by auto\nnext\n  case (App e1 e2)\n  then obtain \\<tau>1 where P: \"\\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> e1 : \\<tau>1 \\<rightarrow> \\<tau>\" \"\\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> e2 : \\<tau>1\" by blast\n  have 1: \"\\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile> e1[\\<sigma>/a] : \\<tau>1[\\<sigma>/a] \\<rightarrow> \\<tau>[\\<sigma>/a]\" using App(1)[OF P(1) App(4)] by simp\n  have 2: \"\\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile> e2[\\<sigma>/a] : \\<tau>1[\\<sigma>/a]\" by (rule App(2)[OF P(2) App(4)])\n  show ?case using Tm_App[OF 1 2] by simp\nnext\n  case (TApp e \\<tau>2)\n  obtain b k2 \\<sigma>' where P: \"\\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> e : (\\<forall> b:k2. \\<sigma>')\" \"\\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>2 : k2\" \"\\<tau> = \\<sigma>'[\\<tau>2/b]\" by (cases rule: Tm.cases[OF TApp(2)]) auto\n  obtain c::tyvar where \"atom c \\<sharp> (a, b, \\<Gamma>, \\<Gamma>', \\<sigma>, \\<sigma>', \\<tau>2)\" using obtain_fresh by blast\n  then have c: \"atom c \\<sharp> \\<sigma>'\" \"atom c \\<sharp> \\<sigma>\" \"atom c \\<sharp> a\" by auto\n  obtain \\<sigma>2 where 1: \"(\\<forall> b:k2. \\<sigma>') = (\\<forall> c:k2. \\<sigma>2)\" using Abs_lst_rename[OF c(1)] by auto\n  then have 2: \"\\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> e : (\\<forall> c:k2. \\<sigma>2)\" using P(1) by argo\n  have 3: \"\\<tau> = \\<sigma>2[\\<tau>2/c]\" using subst_type_same 1 P(3) by simp\n  have 4: \"\\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile> e[\\<sigma>/a] : (\\<forall> c : k2 . \\<sigma>2[\\<sigma>/a])\" using TApp(1)[OF 2 TApp(3)] c(2,3) by simp\n  have 5: \"\\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>2[\\<sigma>/a] : k2\" by (rule type_substitution_ty[OF P(2) TApp(3)])\n  show ?case using Tm_TApp[OF 4 5] subst_subst(2)[of c a \\<sigma> \\<sigma>2 \\<tau>2] 3 c(2,3) by simp\nnext\n  case (Ctor D)\n  then have 1: \"AxCtor D \\<tau> \\<in> set \\<Delta>\" by blast\n  have 2: \"\\<Delta> \\<turnstile> \\<Gamma>'[\\<sigma>/a] @ \\<Gamma>\" by (rule type_substitution_context[OF context_valid(2)[OF Ctor(1)] Ctor(2)])\n  have 3: \"\\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile> Ctor D : \\<tau>\" by (rule Tm_Ctor[OF 2 1])\n  have \"atom a \\<sharp> \\<tau>\" using fresh_in_axioms[OF axioms_valid(1)[OF 2]] 1 by (metis axiom.fresh(2) fresh_Cons fresh_append split_list)\n  then show ?case using 3 fresh_subst_same(2) by simp\nnext\n  case (Lam x \\<tau>1 e)\n  have 1: \"atom x \\<sharp> \\<Gamma>' @ BTyVar a k # \\<Gamma>\" using fresh_Cons fresh_append Lam(2,4,5) by force\n  obtain \\<tau>2 where P: \"BVar x \\<tau>1 # \\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> e : \\<tau>2\" \"\\<tau> = (\\<tau>1 \\<rightarrow> \\<tau>2)\" by (rule T_Abs_Inv[OF Lam.prems(1) 1])\n  then have 2: \"BVar x \\<tau>1[\\<sigma>/a] # \\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile> e[\\<sigma>/a] : \\<tau>2[\\<sigma>/a]\" using Lam(6)[of \"BVar x \\<tau>1 # \\<Gamma>'\"] Lam(8) by simp\n  show ?case using Tm_Abs[OF 2] P(2) by simp\nnext\n  case (TyLam b k2 \\<sigma>2)\n  have 1: \"atom b \\<sharp> \\<Gamma>' @ BTyVar a k # \\<Gamma>\" using fresh_Cons fresh_append TyLam(2,4,5) by force\n  obtain \\<sigma>'::\\<tau> where P: \"BTyVar b k2 # \\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> \\<sigma>2 : \\<sigma>'\" \"\\<tau> = (\\<forall> b : k2 . \\<sigma>')\" by (rule T_AbsT_Inv[OF TyLam.prems(1) 1 TyLam(1)])\n  then have 2: \"BTyVar b k2 # \\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile> \\<sigma>2[\\<sigma>/a] : \\<sigma>'[\\<sigma>/a]\" using TyLam(6)[of \"BTyVar b k2 # \\<Gamma>'\"] TyLam(2,8) by force\n  show ?case using Tm_TAbs[OF 2] TyLam(2,3) P(2) by simp\nnext\n  case (Let x \\<tau>1 e1 e2)\n  have 1: \"atom x \\<sharp> \\<Gamma>' @ BTyVar a k # \\<Gamma>\" using fresh_Cons fresh_append Let(2,4,5) by force\n  have 2: \"\\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> e1 : \\<tau>1\" \"BVar x \\<tau>1 # \\<Gamma>' @ BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> e2 : \\<tau>\" using T_Let_Inv[OF Let.prems(1) 1] by auto\n  have 3: \"\\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile> e1[\\<sigma>/a] : \\<tau>1[\\<sigma>/a]\" by (rule Let(6)[OF 2(1) Let.prems(2)])\n  have 4: \"BVar x \\<tau>1[\\<sigma>/a] # \\<Gamma>'[\\<sigma>/a] @ \\<Gamma> , \\<Delta> \\<turnstile> e2[\\<sigma>/a] : \\<tau>[\\<sigma>/a]\" using Let(7)[of \"BVar x \\<tau>1 # \\<Gamma>'\"] 2(2) Let.prems(2) by simp\n  show ?case using Tm_Let[OF 3 4] by simp\nqed\nlemmas type_substitution = type_substitution_context type_substitution_ty type_substitution_term\n\nlemma substitution: \"\\<lbrakk> \\<Gamma>' @ BVar x \\<sigma> # \\<Gamma> , \\<Delta> \\<turnstile> e : \\<tau> ; \\<Gamma> , \\<Delta> \\<turnstile> e' : \\<sigma> \\<rbrakk> \\<Longrightarrow> \\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile> e[e'/x] : \\<tau>\"\nproof (nominal_induct e avoiding: \\<tau> \\<Gamma>' x \\<Gamma> e' \\<sigma> rule: term.strong_induct)\n  case (Var y)\n  then have P: \"\\<Delta> \\<turnstile> \\<Gamma>' @ BVar x \\<sigma> # \\<Gamma>\" \"BVar y \\<tau> \\<in> (\\<Gamma>' @ BVar x \\<sigma> # \\<Gamma>)\" by auto\n  have 1: \"\\<Delta> \\<turnstile> \\<Gamma>' @ \\<Gamma>\" by (rule strengthen(1)[OF P(1)])\n  show ?case\n  proof (cases \"x = y\")\n    case True\n    then have \"\\<tau> = \\<sigma>\" using isin_same(2) P by blast\n    then have \"\\<Gamma> , \\<Delta> \\<turnstile> (Var y)[e'/x] : \\<tau>\" using Var(2) True by simp\n    then show ?thesis using weaken_tm[of \"[]\"] 1 by auto\n  next\n    case False\n    then have \"BVar y \\<tau> \\<in> (\\<Gamma>' @ \\<Gamma>)\" using isin_superset(2)[OF P(2,1)] by simp\n    then show ?thesis using Tm_Var[OF 1] False by simp\n  qed\nnext\n  case (App e1 e2)\n  then obtain \\<tau>1 where P: \"\\<Gamma>' @ BVar x \\<sigma> # \\<Gamma> , \\<Delta> \\<turnstile> e1 : \\<tau>1 \\<rightarrow> \\<tau>\" \"\\<Gamma>' @ BVar x \\<sigma> # \\<Gamma> , \\<Delta> \\<turnstile> e2 : \\<tau>1\" by auto\n  have 1: \"\\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile> e1[e'/x] : \\<tau>1 \\<rightarrow> \\<tau>\" by (rule App(1)[OF P(1) App(4)])\n  have 2: \"\\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile> e2[e'/x] : \\<tau>1\" by (rule App(2)[OF P(2) App(4)])\n  show ?case using Tm_App[OF 1 2] by simp\nnext\n  case (TApp e \\<tau>1)\n  obtain a k \\<sigma>' where P: \"\\<Gamma>' @ BVar x \\<sigma> # \\<Gamma> , \\<Delta> \\<turnstile> e : \\<forall> a:k. \\<sigma>'\" \"\\<Gamma>' @ BVar x \\<sigma> # \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>1 : k\" \"\\<tau> = \\<sigma>'[\\<tau>1/a]\" by (cases rule: Tm.cases[OF TApp(2)]) auto\n  have 1: \"\\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile> e[e'/x] : \\<forall> a : k . \\<sigma>'\" by (rule TApp(1)[OF P(1) TApp(3)])\n  have 2: \"\\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile>\\<^sub>t\\<^sub>y \\<tau>1 : k\" by (rule strengthen(2)[OF P(2)])\n  show ?case using Tm_TApp[OF 1 2] P(3) by simp\nnext\n  case (Ctor D)\n  then have 1: \"AxCtor D \\<tau> \\<in> set \\<Delta>\" by blast\n  have 2: \"\\<Delta> \\<turnstile> \\<Gamma>' @ \\<Gamma>\" by (rule strengthen(1)[OF context_valid(2)[OF Ctor(1)]])\n  show ?case using Tm_Ctor[OF 2 1] by simp\nnext\n  case (Lam y \\<tau>1 e)\n  have 1: \"atom y \\<sharp> \\<Gamma>' @ BVar x \\<sigma> # \\<Gamma>\" using Lam(2-4) fresh_Cons fresh_append by force\n  obtain \\<tau>2 where P: \"BVar y \\<tau>1 # \\<Gamma>' @ BVar x \\<sigma> # \\<Gamma> , \\<Delta> \\<turnstile> e : \\<tau>2\" \"\\<tau> = (\\<tau>1 \\<rightarrow> \\<tau>2)\" by (rule T_Abs_Inv[OF Lam.prems(1) 1])\n  have 2: \"BVar y \\<tau>1 # \\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile> e[e'/x] : \\<tau>2\" using Lam(7)[of \"BVar y \\<tau>1 # \\<Gamma>'\"] P(1) Lam.prems(2) by simp\n  show ?case using Tm_Abs[OF 2] P(2) Lam(3,5) by simp\nnext\n  case (TyLam a k e)\n  have 1: \"atom a \\<sharp> \\<Gamma>' @ BVar x \\<sigma> # \\<Gamma>\" using TyLam(2,4,6) fresh_Cons fresh_append by force\n  obtain \\<sigma>' where P: \"BTyVar a k # \\<Gamma>' @ BVar x \\<sigma> # \\<Gamma> , \\<Delta> \\<turnstile> e : \\<sigma>'\" \"\\<tau> = (\\<forall> a : k . \\<sigma>')\" by (rule T_AbsT_Inv[OF TyLam.prems(1) 1 TyLam(1)])\n  have 2: \"BTyVar a k # \\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile> e[e'/x] : \\<sigma>'\" using TyLam(7)[of \"BTyVar a k # \\<Gamma>'\"] TyLam.prems(2) P(1) by simp\n  show ?case using Tm_TAbs[OF 2] P(2) TyLam(5) by simp\nnext\n  case (Let y \\<tau>1 e1 e2)\n  have 1: \"atom y \\<sharp> \\<Gamma>' @ BVar x \\<sigma> # \\<Gamma>\" using Let(2-4,6) fresh_Cons fresh_append by force\n  have P: \"\\<Gamma>' @ BVar x \\<sigma> # \\<Gamma> , \\<Delta> \\<turnstile> e1 : \\<tau>1\" \"BVar y \\<tau>1 # \\<Gamma>' @ BVar x \\<sigma> # \\<Gamma> , \\<Delta> \\<turnstile> e2 : \\<tau>\" using T_Let_Inv[OF Let.prems(1) 1] by auto\n  have 2: \"\\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile> e1[e'/x] : \\<tau>1\" by (rule Let(7)[OF P(1) Let.prems(2)])\n  have 3: \"BVar y \\<tau>1 # \\<Gamma>' @ \\<Gamma> , \\<Delta> \\<turnstile> e2[e'/x] : \\<tau>\" using Let(8)[of \"BVar y \\<tau>1 # \\<Gamma>'\"] P(2) Let.prems(2) by simp\n  show ?case using Tm_Let[OF 2 3] Let(3,5) by simp\nqed\n\ntheorem preservation:\n  fixes e e'::\"term\" and \\<Gamma>::\\<Gamma>\n  assumes \"\\<Gamma> , \\<Delta> \\<turnstile> e : \\<tau>\" \"e \\<longrightarrow> e'\" \"\\<nexists>x \\<tau>. BVar x \\<tau> \\<in> \\<Gamma>\"\n  shows \"\\<Gamma> , \\<Delta> \\<turnstile> e' : \\<tau>\"\nusing assms beta_nf_def value_beta_nf proof (nominal_induct \\<Gamma> \\<Delta> e \\<tau> arbitrary: e' rule: Tm.strong_induct)\n  case (Tm_App \\<Gamma> \\<Delta> e1 \\<tau>1 \\<tau>2 e2)\n  from Tm_App(5) show ?case\n  proof cases\n    case (ST_Beta x \\<tau> e)\n    then have \"\\<tau>1 = \\<tau>\" using Tm_App(1) fun_ty_val by fastforce\n    obtain x' e2' where P: \"BVar x' \\<tau>1 # \\<Gamma> , \\<Delta> \\<turnstile> e2' : \\<tau>2\" \"(\\<lambda>x:\\<tau>1. e) = (\\<lambda>x':\\<tau>1. e2')\" \"atom x' \\<sharp> (x, e)\" using T_Abs_Inv_2 Tm_App(1) ST_Beta(1) by (metis \\<tau>.eq_iff(4))\n    have 1: \"\\<Gamma> , \\<Delta> \\<turnstile> e2'[e2/x'] : \\<tau>2\" using substitution[of \"[]\"] Tm_App(3) P(1) by simp\n    have \"e2'[e2/x'] = e[e2/x]\" using subst_same(1)[of x e x' e2'] P(2) by simp\n    then show ?thesis using ST_Beta(2) 1 by argo\n  next\n    case (ST_App e2')\n    then show ?thesis using Tm.Tm_App Tm_App(2,3,6) beta_nf_def value_beta_nf by blast\n  qed\nnext\n  case (Tm_TAbs a k \\<Gamma> \\<Delta> e \\<sigma>)\n  from Tm_TAbs(3) show ?case\n  proof cases\n    case (ST_TAbs e2 e2' b)\n    obtain c::tyvar where \"atom c \\<sharp> (a, e, b, e2, e', e2', \\<sigma>, \\<Gamma>)\" by (rule obtain_fresh)\n    then have c: \"atom c \\<sharp> a\"  \"atom c \\<sharp> e\" \"atom c \\<sharp> b\" \"atom c \\<sharp> e2\" \"atom c \\<sharp> e'\" \"atom c \\<sharp> e2'\" \"atom c \\<sharp> \\<sigma>\" \"atom c \\<sharp> \\<Gamma>\" by auto\n    then obtain e3 where 1: \"[[atom b]]lst. e2 = [[atom c]]lst. e3\" by (metis Abs_lst_rename)\n    then have 2: \"e3 = (b \\<leftrightarrow> c) \\<bullet> e2\" using Abs_rename_body by blast\n    from 1 have 3: \"e = (c \\<leftrightarrow> a) \\<bullet> e3\" using ST_TAbs(1) Abs_rename_body[of c e3 a e] by argo\n    from ST_TAbs(3) have \"e3 \\<longrightarrow> (b \\<leftrightarrow> c) \\<bullet> e2'\" using 2 Step.eqvt by blast\n    then have 4: \"e \\<longrightarrow> (c \\<leftrightarrow> a) \\<bullet> (b \\<leftrightarrow> c) \\<bullet> e2'\" using 3 Step.eqvt by blast\n    then have 5: \"BTyVar a k # \\<Gamma> , \\<Delta> \\<turnstile> (c \\<leftrightarrow> a) \\<bullet> (b \\<leftrightarrow> c) \\<bullet> e2' : \\<sigma>\" using Tm_TAbs(2,4) beta_nf_def value_beta_nf by simp\n    have \"BTyVar c k # \\<Gamma> , \\<Delta> \\<turnstile> (b \\<leftrightarrow> c) \\<bullet> e2' : (a \\<leftrightarrow> c) \\<bullet> \\<sigma>\" using Tm_eqvt_tyvar[OF 5 c(8)] flip_commute permute_flip_cancel by simp\n    then have 6: \"\\<Gamma> , \\<Delta> \\<turnstile> \\<Lambda> c : k . (b \\<leftrightarrow> c) \\<bullet> e2' : \\<forall> c : k . (a \\<leftrightarrow> c) \\<bullet> \\<sigma>\" by (rule Tm.Tm_TAbs)\n    have 7: \"(\\<Lambda> c : k . (b \\<leftrightarrow> c) \\<bullet> e2') = (\\<Lambda> b : k . e2')\" using Abs_lst_rename c(6) by fastforce\n    have 8: \"(\\<forall> c : k . (a \\<leftrightarrow> c) \\<bullet> \\<sigma>) = (\\<forall> a : k . \\<sigma>)\" using Abs_lst_rename c(7) by fastforce\n    show ?thesis using 6 7 8 ST_TAbs(2) by argo\n  qed\nnext\n  case (Tm_TApp \\<Gamma> \\<Delta> e a k \\<sigma> \\<tau>)\n  from Tm_TApp(4) show ?case\n  proof cases\n    case (ST_TBeta e2 b k2)\n    obtain c::tyvar where \"atom c \\<sharp> (a, b, e2, \\<sigma>, \\<Gamma>)\" using obtain_fresh by blast\n    then have c: \"atom c \\<sharp> a\" \"atom c \\<sharp> b\" \"atom c \\<sharp> e2\" \"atom c \\<sharp> \\<sigma>\" \"atom c \\<sharp> \\<Gamma>\" by auto\n    obtain \\<sigma>2 where c1: \"(\\<forall> a:k. \\<sigma>) = (\\<forall> c:k. \\<sigma>2)\" using Abs_lst_rename[OF c(4)] by auto\n    have same: \"k = k2\" using Tm_TApp.hyps(1) forall_ty_val local.ST_TBeta(1) local.ST_TBeta(3) by fastforce\n    obtain e2' where c2: \"(\\<Lambda> b:k2. e2) = (\\<Lambda> c:k. e2')\" using Abs_lst_rename[OF c(3)] same by auto\n    have 1: \"\\<Gamma> , \\<Delta> \\<turnstile> (\\<Lambda> c:k. e2') : \\<forall> c:k. \\<sigma>2\" using Tm_TApp(1) ST_TBeta(1) c2 c1 by simp\n    have 2: \"BTyVar c k # \\<Gamma> , \\<Delta> \\<turnstile> e2' : \\<sigma>2\"\n    proof (cases rule: Tm.cases[OF 1])\n      case (4 d _ _ _ e \\<sigma>)\n      have x1: \"(d \\<leftrightarrow> c) \\<bullet> e = e2'\" using Abs_rename_body[of d e c e2'] 4(3) by simp\n      have x2: \"(d \\<leftrightarrow> c) \\<bullet> \\<sigma> = \\<sigma>2\" using Abs_rename_body[of d \\<sigma> c \\<sigma>2] 4(4) by simp\n      have \"(d \\<leftrightarrow> c) \\<bullet> (BTyVar d k # \\<Gamma> , \\<Delta> \\<turnstile> e : \\<sigma>)\" using 4 by auto\n      then have x3: \"((d \\<leftrightarrow> c) \\<bullet> BTyVar d k) # ((d \\<leftrightarrow> c) \\<bullet> \\<Gamma>) , (d \\<leftrightarrow> c) \\<bullet> \\<Delta> \\<turnstile> e2' : \\<sigma>2\" using x1 x2 Tm.eqvt by auto\n      have \"atom d \\<sharp> \\<Gamma>\" using 4(1,5) context_valid_tm by blast\n      then have x4: \"(d \\<leftrightarrow> c) \\<bullet> \\<Gamma> = \\<Gamma>\" using c(5) flip_fresh_fresh by blast\n      have x5: \"(d \\<leftrightarrow> c) \\<bullet> \\<Delta> = \\<Delta>\" using fresh_in_axioms flip_fresh_fresh axioms_valid(3)[OF 1] by blast\n      from x3 x4 x5 have \"((d \\<leftrightarrow> c) \\<bullet> BTyVar d k) # \\<Gamma> , \\<Delta> \\<turnstile> e2' : \\<sigma>2\" by argo\n      then show ?thesis by (simp add: flip_fresh_fresh)\n    qed auto\n    then show ?thesis\n      by (metis Tm_TApp.hyps(3) \\<tau>.eq_iff(5) append_Nil c1 c2 local.ST_TBeta(2) subst_context.simps(1) subst_term_type_same subst_type_same term.eq_iff(6) type_substitution(3))\n  next\n    case (ST_TApp e2)\n    then show ?thesis using Tm.Tm_TApp Tm_TApp(2,3,5) beta_nf_def value_beta_nf by blast\n  qed\nnext\n  case (Tm_Let e1 \\<tau>1 x e2 \\<tau>2)\n  from Tm_Let(5) show ?case\n  proof cases\n    case (ST_Let x e2)\n    then show ?thesis by (metis Tm_Let(1,3) append_self_conv2 subst_term_same substitution)\n  qed\nqed auto\n\nlemma multi_preservation: \"\\<lbrakk> e \\<longrightarrow>* e' ; [] , \\<Delta> \\<turnstile> e : \\<tau> \\<rbrakk> \\<Longrightarrow> [] , \\<Delta> \\<turnstile> e' : \\<tau>\"\n  by (induction e e' rule: Steps.induct) (auto simp: preservation)\n\ncorollary soundness: \"\\<lbrakk> [] , \\<Delta> \\<turnstile> e : \\<tau> ; e \\<longrightarrow>* e' \\<rbrakk> \\<Longrightarrow> \\<not>(stuck e')\"\n  unfolding stuck_def beta_nf_def\n  using progress multi_preservation isin.simps(1) by blast\n\nend\n", "meta": {"author": "jvanbruegge", "repo": "isabelle-lambda-calculus", "sha": "41fba58ed18fcb494b6b7abb6c8641a63002a1d5", "save_path": "github-repos/isabelle/jvanbruegge-isabelle-lambda-calculus", "path": "github-repos/isabelle/jvanbruegge-isabelle-lambda-calculus/isabelle-lambda-calculus-41fba58ed18fcb494b6b7abb6c8641a63002a1d5/Soundness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3203577695925053}}
{"text": "(*****************************************************************************\n * Featherweight-OCL --- A Formal Semantics for UML-OCL Version OCL 2.5\n *                       for the OMG Standard.\n *                       http://www.brucker.ch/projects/hol-testgen/\n *\n * UML_Bag.thy --- Library definitions.\n * This file is part of HOL-TestGen.\n *\n * Copyright (c) 2012-2015 Université Paris-Saclay, Univ. Paris-Sud, France\n *               2013-2015 IRT SystemX, France\n *\n * All rights reserved.\n *\n * Redistribution and use in source and binary forms, with or without\n * modification, are permitted provided that the following conditions are\n * met:\n *\n *     * Redistributions of source code must retain the above copyright\n *       notice, this list of conditions and the following disclaimer.\n *\n *     * Redistributions in binary form must reproduce the above\n *       copyright notice, this list of conditions and the following\n *       disclaimer in the documentation and/or other materials provided\n *       with the distribution.\n *\n *     * Neither the name of the copyright holders nor the names of its\n *       contributors may be used to endorse or promote products derived\n *       from this software without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n * \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n ******************************************************************************)\n\n\ntheory  UML_Bag\nimports \"../basic_types/UML_Void\"\n        \"../basic_types/UML_Boolean\"\n        \"../basic_types/UML_Integer\"\n        \"../basic_types/UML_String\"\n        \"../basic_types/UML_Real\"\nbegin\n\nno_notation None (\"\\<bottom>\")\nsection\\<open>Collection Type Bag: Operations\\<close>\n\ndefinition \"Rep_Bag_base' x = {(x0, y). y < \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil> x0 }\"\ndefinition \"Rep_Bag_base x \\<tau> = {(x0, y). y < \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (x \\<tau>)\\<rceil>\\<rceil> x0 }\"\ndefinition \"Rep_Set_base x \\<tau> = fst ` {(x0, y). y < \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (x \\<tau>)\\<rceil>\\<rceil> x0 }\"\n\ndefinition ApproxEq (infixl \"\\<cong>\" 30)\nwhere     \"X \\<cong> Y \\<equiv>  \\<lambda> \\<tau>. \\<lfloor>\\<lfloor>Rep_Set_base X \\<tau> = Rep_Set_base Y \\<tau> \\<rfloor>\\<rfloor>\"\n\n\nsubsection\\<open>As a Motivation for the (infinite) Type Construction: Type-Extensions as Bags \n             \\label{sec:type-extensions}\\<close>\n\ntext\\<open>Our notion of typed bag goes beyond the usual notion of a finite executable bag and\nis powerful enough to capture \\emph{the extension of a type} in UML and OCL. This means\nwe can have in Featherweight OCL Bags containing all possible elements of a type, not only\nthose (finite) ones representable in a state. This holds for base types as well as class types,\nalthough the notion for class-types --- involving object id's not occurring in a state ---\nrequires some care.\n\nIn a world with @{term invalid} and @{term null}, there are two notions extensions possible:\n\\begin{enumerate}\n\\item the bag of all \\emph{defined} values of a type @{term T}\n      (for which we will introduce the constant  @{term T})\n\\item the bag of all \\emph{valid} values of a type @{term T}, so including @{term null}\n      (for which we will introduce the constant  @{term T\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l}).\n\\end{enumerate}\n\\<close>\n\ntext\\<open>We define the bag extensions for the base type @{term Integer} as follows:\\<close>\ndefinition Integer :: \"('\\<AA>,Integer\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag\"\nwhere     \"Integer \\<equiv> (\\<lambda> \\<tau>. (Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e o Some o Some)  (\\<lambda> None \\<Rightarrow> 0 | Some None \\<Rightarrow> 0 | _ \\<Rightarrow> 1))\"\n\ndefinition Integer\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l :: \"('\\<AA>,Integer\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag\"\nwhere     \"Integer\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l \\<equiv> (\\<lambda> \\<tau>. (Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e o Some o Some)  (\\<lambda> None \\<Rightarrow> 0 | _ \\<Rightarrow> 1))\"\n\nlemma Integer_defined : \"\\<delta> Integer = true\"\napply(rule ext, auto simp: Integer_def defined_def false_def true_def\n                           bot_fun_def null_fun_def null_option_def)\nby(simp_all add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject bot_option_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_option_def)\n\nlemma Integer\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_defined : \"\\<delta> Integer\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l = true\"\napply(rule ext, auto simp: Integer\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_def defined_def false_def true_def\n                           bot_fun_def null_fun_def null_option_def)\nby(simp_all add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject bot_option_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_option_def)\n\ntext\\<open>This allows the theorems:\n\n      \\<open>\\<tau> \\<Turnstile> \\<delta> x  \\<Longrightarrow> \\<tau> \\<Turnstile> (Integer->includes\\<^sub>B\\<^sub>a\\<^sub>g(x))\\<close>\n      \\<open>\\<tau> \\<Turnstile> \\<delta> x  \\<Longrightarrow> \\<tau> \\<Turnstile> Integer  \\<triangleq> (Integer->including\\<^sub>B\\<^sub>a\\<^sub>g(x))\\<close>\n\nand\n\n      \\<open>\\<tau> \\<Turnstile> \\<upsilon> x  \\<Longrightarrow> \\<tau> \\<Turnstile> (Integer\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l->includes\\<^sub>B\\<^sub>a\\<^sub>g(x))\\<close>\n      \\<open>\\<tau> \\<Turnstile> \\<upsilon> x  \\<Longrightarrow> \\<tau> \\<Turnstile> Integer\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l  \\<triangleq> (Integer\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l->including\\<^sub>B\\<^sub>a\\<^sub>g(x))\\<close>\n\nwhich characterize the infiniteness of these bags by a recursive property on these bags.\n\\<close>\n\ntext\\<open>In the same spirit, we proceed similarly for the remaining base types:\\<close>\n\ndefinition Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l :: \"('\\<AA>,Void\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag\"\nwhere     \"Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l \\<equiv> (\\<lambda> \\<tau>. (Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e o Some o Some) (\\<lambda> x. if x = Abs_Void\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (Some None) then 1 else 0))\"\n\ndefinition Void\\<^sub>e\\<^sub>m\\<^sub>p\\<^sub>t\\<^sub>y :: \"('\\<AA>,Void\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag\"\nwhere     \"Void\\<^sub>e\\<^sub>m\\<^sub>p\\<^sub>t\\<^sub>y \\<equiv> (\\<lambda> \\<tau>. (Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e o Some o Some) (\\<lambda>_. 0))\"\n\nlemma Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_defined : \"\\<delta> Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l = true\"\napply(rule ext, auto simp: Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_def defined_def false_def true_def\n                           bot_fun_def null_fun_def null_option_def\n                           bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)\nby((subst (asm) Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject, auto simp add: bot_option_def null_option_def bot_Void_def),\n   (subst (asm) Abs_Void\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject, auto simp add: bot_option_def null_option_def))+\n\nlemma Void\\<^sub>e\\<^sub>m\\<^sub>p\\<^sub>t\\<^sub>y_defined : \"\\<delta> Void\\<^sub>e\\<^sub>m\\<^sub>p\\<^sub>t\\<^sub>y = true\"\napply(rule ext, auto simp: Void\\<^sub>e\\<^sub>m\\<^sub>p\\<^sub>t\\<^sub>y_def defined_def false_def true_def\n                           bot_fun_def null_fun_def null_option_def\n                           bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)\nby((subst (asm) Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject, auto simp add: bot_option_def null_option_def bot_Void_def))+\n\nlemma assumes \"\\<tau> \\<Turnstile> \\<delta> (V :: ('\\<AA>,Void\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag)\"\n      shows   \"\\<tau> \\<Turnstile> V \\<cong> Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l \\<or> \\<tau> \\<Turnstile> V \\<cong> Void\\<^sub>e\\<^sub>m\\<^sub>p\\<^sub>t\\<^sub>y\"\nproof -\n  have A:\"\\<And>x y. x \\<noteq> {} \\<Longrightarrow> \\<exists>y. y\\<in> x\"\n  by (metis all_not_in_conv)\nshow \"?thesis\"\n  apply(case_tac \"V \\<tau>\")\n  proof - fix y show \"V \\<tau> = Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e y \\<Longrightarrow>\n                      y \\<in> {X. X = \\<bottom> \\<or> X = null \\<or> \\<lceil>\\<lceil>X\\<rceil>\\<rceil> \\<bottom> = 0} \\<Longrightarrow>\n                      \\<tau> \\<Turnstile> V \\<cong> Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l \\<or> \\<tau> \\<Turnstile> V \\<cong> Void\\<^sub>e\\<^sub>m\\<^sub>p\\<^sub>t\\<^sub>y\"\n  apply(insert assms, case_tac y, simp add: bot_option_def, simp add: bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def foundation16)\n  apply(simp add: bot_option_def null_option_def)\n  apply(erule disjE, metis OclValid_def defined_def foundation2 null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_fun_def true_def)\n  proof - fix a show \"V \\<tau> = Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>a\\<rfloor> \\<Longrightarrow> \\<lceil>a\\<rceil> \\<bottom> = 0 \\<Longrightarrow> \\<tau> \\<Turnstile> V \\<cong> Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l \\<or> \\<tau> \\<Turnstile> V \\<cong> Void\\<^sub>e\\<^sub>m\\<^sub>p\\<^sub>t\\<^sub>y\"\n  apply(case_tac a, simp, insert assms, metis OclValid_def foundation16 null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def true_def)\n  apply(simp)\n  proof - fix aa show \" V \\<tau> = Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor>aa\\<rfloor>\\<rfloor> \\<Longrightarrow> aa \\<bottom> = 0 \\<Longrightarrow> \\<tau> \\<Turnstile> V \\<cong> Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l \\<or> \\<tau> \\<Turnstile> V \\<cong> Void\\<^sub>e\\<^sub>m\\<^sub>p\\<^sub>t\\<^sub>y\"\n  apply(case_tac \"aa (Abs_Void\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>None\\<rfloor>) = 0\",\n        rule disjI2,\n        insert assms,\n        simp add: Void\\<^sub>e\\<^sub>m\\<^sub>p\\<^sub>t\\<^sub>y_def OclValid_def ApproxEq_def Rep_Set_base_def true_def Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse image_def)\n  apply(intro allI)\n  proof - fix x fix b show \" V \\<tau> = Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor>aa\\<rfloor>\\<rfloor> \\<Longrightarrow> aa \\<bottom> = 0 \\<Longrightarrow> aa (Abs_Void\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>None\\<rfloor>) = 0 \\<Longrightarrow> (\\<delta> V) \\<tau> = \\<lfloor>\\<lfloor>True\\<rfloor>\\<rfloor> \\<Longrightarrow> \\<not> b < aa x\"\n    apply (case_tac x, auto)\n     apply (simp add: bot_Void_def bot_option_def)\n    apply (simp add: bot_option_def null_option_def)\n  done\n  apply_end(simp+, rule disjI1)\n  show \"V \\<tau> = Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor>aa\\<rfloor>\\<rfloor> \\<Longrightarrow> aa \\<bottom> = 0 \\<Longrightarrow> 0 < aa (Abs_Void\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>None\\<rfloor>) \\<Longrightarrow> \\<tau> \\<Turnstile> \\<delta> V \\<Longrightarrow> \\<tau> \\<Turnstile> V \\<cong> Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l\"\n  apply(simp add: Void\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_def OclValid_def ApproxEq_def Rep_Set_base_def true_def Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse image_def,\n        subst Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse, simp)\n  using bot_Void_def apply auto[1]\n  apply(simp)\n  apply(rule equalityI, rule subsetI, simp)\n   proof - fix x show \"V \\<tau> = Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor>aa\\<rfloor>\\<rfloor> \\<Longrightarrow>\n            aa \\<bottom> = 0 \\<Longrightarrow> 0 < aa (Abs_Void\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>None\\<rfloor>) \\<Longrightarrow> (\\<delta> V) \\<tau> = \\<lfloor>\\<lfloor>True\\<rfloor>\\<rfloor> \\<Longrightarrow> \\<exists>b. b < aa x \\<Longrightarrow> x = Abs_Void\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>None\\<rfloor>\"\n   apply( case_tac x, auto)\n    apply (simp add: bot_Void_def bot_option_def)\n   by (simp add: bot_option_def null_option_def)\n  qed ((simp add: bot_Void_def bot_option_def)+, blast)\nqed qed qed qed qed\n\ndefinition Boolean :: \"('\\<AA>,Boolean\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag\"\nwhere     \"Boolean \\<equiv> (\\<lambda> \\<tau>. (Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e o Some o Some)  (\\<lambda> None \\<Rightarrow> 0 | Some None \\<Rightarrow> 0 | _ \\<Rightarrow> 1))\"\n\ndefinition Boolean\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l :: \"('\\<AA>,Boolean\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag\"\nwhere     \"Boolean\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l \\<equiv> (\\<lambda> \\<tau>. (Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e o Some o Some)  (\\<lambda> None \\<Rightarrow> 0 | _ \\<Rightarrow> 1))\"\n\nlemma Boolean_defined : \"\\<delta> Boolean = true\"\napply(rule ext, auto simp: Boolean_def defined_def false_def true_def\n                           bot_fun_def null_fun_def null_option_def)\nby(simp_all add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject bot_option_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_option_def)\n\nlemma Boolean\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_defined : \"\\<delta> Boolean\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l = true\"\napply(rule ext, auto simp: Boolean\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_def defined_def false_def true_def\n                           bot_fun_def null_fun_def null_option_def)\nby(simp_all add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject bot_option_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_option_def)\n\ndefinition String :: \"('\\<AA>,String\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag\"\nwhere     \"String \\<equiv> (\\<lambda> \\<tau>. (Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e o Some o Some)  (\\<lambda> None \\<Rightarrow> 0 | Some None \\<Rightarrow> 0 | _ \\<Rightarrow> 1))\"\n\ndefinition String\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l :: \"('\\<AA>,String\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag\"\nwhere     \"String\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l \\<equiv> (\\<lambda> \\<tau>. (Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e o Some o Some)  (\\<lambda> None \\<Rightarrow> 0 | _ \\<Rightarrow> 1))\"\n\nlemma String_defined : \"\\<delta> String = true\"\napply(rule ext, auto simp: String_def defined_def false_def true_def\n                           bot_fun_def null_fun_def null_option_def)\nby(simp_all add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject bot_option_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_option_def)\n\nlemma String\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_defined : \"\\<delta> String\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l = true\"\napply(rule ext, auto simp: String\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_def defined_def false_def true_def\n                           bot_fun_def null_fun_def null_option_def)\nby(simp_all add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject bot_option_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_option_def)\n\ndefinition Real :: \"('\\<AA>,Real\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag\"\nwhere     \"Real \\<equiv> (\\<lambda> \\<tau>. (Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e o Some o Some)  (\\<lambda> None \\<Rightarrow> 0 | Some None \\<Rightarrow> 0 | _ \\<Rightarrow> 1))\"\n\ndefinition Real\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l :: \"('\\<AA>,Real\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) Bag\"\nwhere     \"Real\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l \\<equiv> (\\<lambda> \\<tau>. (Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e o Some o Some)  (\\<lambda> None \\<Rightarrow> 0 | _ \\<Rightarrow> 1))\"\n\nlemma Real_defined : \"\\<delta> Real = true\"\napply(rule ext, auto simp: Real_def defined_def false_def true_def\n                           bot_fun_def null_fun_def null_option_def)\nby(simp_all add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject bot_option_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_option_def)\n\nlemma Real\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_defined : \"\\<delta> Real\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l = true\"\napply(rule ext, auto simp: Real\\<^sub>n\\<^sub>u\\<^sub>l\\<^sub>l_def defined_def false_def true_def\n                           bot_fun_def null_fun_def null_option_def)\nby(simp_all add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject bot_option_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_option_def)\n\nsubsection\\<open>Basic Properties of the Bag Type\\<close>\n\ntext\\<open>Every element in a defined bag is valid.\\<close>\n\nlemma Bag_inv_lemma: \"\\<tau> \\<Turnstile> (\\<delta> X) \\<Longrightarrow> \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\<tau>)\\<rceil>\\<rceil> bot = 0\"\napply(insert Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e [of \"X \\<tau>\"], simp)\napply(auto simp: OclValid_def defined_def false_def true_def cp_def\n                 bot_fun_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_fun_def\n           split:if_split_asm)\n apply(erule contrapos_pp [of \"Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\<tau>) = bot\"])\n apply(subst Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject[symmetric], rule Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e, simp)\n apply(simp add: Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def bot_option_def)\napply(erule contrapos_pp [of \"Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\<tau>) = null\"])\napply(subst Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject[symmetric], rule Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e, simp)\napply(simp add: Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse  null_option_def)\nby (simp add: bot_option_def)\n\nlemma Bag_inv_lemma' :\n assumes x_def : \"\\<tau> \\<Turnstile> \\<delta> X\"\n     and e_mem : \"\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (X \\<tau>)\\<rceil>\\<rceil> e \\<ge> 1\"\n   shows \"\\<tau> \\<Turnstile> \\<upsilon> (\\<lambda>_. e)\"\napply(case_tac \"e = bot\", insert assms, drule Bag_inv_lemma, simp)\nby (simp add: foundation18')\n\nlemma abs_rep_simp' :\n assumes S_all_def : \"\\<tau> \\<Turnstile> \\<delta> S\"\n   shows \"Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor>\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (S \\<tau>)\\<rceil>\\<rceil>\\<rfloor>\\<rfloor> = S \\<tau>\"\nproof -\n have discr_eq_false_true : \"\\<And>\\<tau>. (false \\<tau> = true \\<tau>) = False\" by(simp add: false_def true_def)\n show ?thesis\n  apply(insert S_all_def, simp add: OclValid_def defined_def)\n  apply(rule mp[OF Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_induct[where P = \"\\<lambda>S. (if S = \\<bottom> \\<tau> \\<or> S = null \\<tau>\n                                                    then false \\<tau> else true \\<tau>) = true \\<tau> \\<longrightarrow>\n                                                   Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor>\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e S\\<rceil>\\<rceil>\\<rfloor>\\<rfloor> = S\"]],\n        rename_tac S')\n   apply(simp add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse discr_eq_false_true)\n   apply(case_tac S') apply(simp add: bot_fun_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)+\n   apply(rename_tac S'', case_tac S'') apply(simp add: null_fun_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)+\n done\nqed\n\nlemma invalid_bag_OclNot_defined [simp,code_unfold]:\"\\<delta>(invalid::('\\<AA>,'\\<alpha>::null) Bag) = false\" by simp\nlemma null_bag_OclNot_defined [simp,code_unfold]:\"\\<delta>(null::('\\<AA>,'\\<alpha>::null) Bag) = false\"\nby(simp add: defined_def null_fun_def)\nlemma invalid_bag_valid [simp,code_unfold]:\"\\<upsilon>(invalid::('\\<AA>,'\\<alpha>::null) Bag) = false\"\nby simp\nlemma null_bag_valid [simp,code_unfold]:\"\\<upsilon>(null::('\\<AA>,'\\<alpha>::null) Bag) = true\"\napply(simp add: valid_def null_fun_def bot_fun_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)\napply(subst Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject,simp_all add: null_option_def bot_option_def)\ndone\n\ntext\\<open>... which means that we can have a type \\<open>('\\<AA>,('\\<AA>,('\\<AA>) Integer) Bag) Bag\\<close>\ncorresponding exactly to Bag(Bag(Integer)) in OCL notation. Note that the parameter\n\\<open>'\\<AA>\\<close> still refers to the object universe; making the OCL semantics entirely parametric\nin the object universe makes it possible to study (and prove) its properties\nindependently from a concrete class diagram.\\<close>\n\nsubsection\\<open>Definition: Strict Equality \\label{sec:bag-strict-equality}\\<close>\n\ntext\\<open>After the part of foundational operations on bags, we detail here equality on bags.\nStrong equality is inherited from the OCL core, but we have to consider\nthe case of the strict equality. We decide to overload strict equality in the\nsame way we do for other value's in OCL:\\<close>\n\noverloading StrictRefEq \\<equiv> \"StrictRefEq :: [('\\<AA>,'\\<alpha>::null)Bag,('\\<AA>,'\\<alpha>::null)Bag] \\<Rightarrow> ('\\<AA>)Boolean\"\nbegin\n  definition StrictRefEq\\<^sub>B\\<^sub>a\\<^sub>g :\n    \"(x::('\\<AA>,'\\<alpha>::null)Bag) \\<doteq> y \\<equiv> \\<lambda> \\<tau>. if (\\<upsilon> x) \\<tau> = true \\<tau> \\<and> (\\<upsilon> y) \\<tau> = true \\<tau>\n                                       then (x \\<triangleq> y)\\<tau>\n                                       else invalid \\<tau>\"\nend\n\ntext\\<open>One might object here that for the case of objects, this is an empty definition.\nThe answer is no, we will restrain later on states and objects such that any object\nhas its oid stored inside the object (so the ref, under which an object can be referenced\nin the store will represented in the object itself). For such well-formed stores that satisfy\nthis invariant (the WFF-invariant), the referential equality and the\nstrong equality---and therefore the strict equality on bags in the sense above---coincides.\\<close>\n\ntext\\<open>Property proof in terms of @{term \"profile_bin\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>o\\<^sub>n\\<^sub>g\\<^sub>E\\<^sub>q_\\<^sub>v_\\<^sub>v\"}\\<close>\ninterpretation  StrictRefEq\\<^sub>B\\<^sub>a\\<^sub>g : profile_bin\\<^sub>S\\<^sub>t\\<^sub>r\\<^sub>o\\<^sub>n\\<^sub>g\\<^sub>E\\<^sub>q_\\<^sub>v_\\<^sub>v \"\\<lambda> x y. (x::('\\<AA>,'\\<alpha>::null)Bag) \\<doteq> y\" \n         by unfold_locales (auto simp:  StrictRefEq\\<^sub>B\\<^sub>a\\<^sub>g)\n\n\n\nsubsection\\<open>Constants: mtBag\\<close>\ndefinition mtBag::\"('\\<AA>,'\\<alpha>::null) Bag\"  (\"Bag{}\")\nwhere     \"Bag{} \\<equiv> (\\<lambda> \\<tau>.  Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor>\\<lambda>_. 0::nat\\<rfloor>\\<rfloor> )\"\n\n\nlemma mtBag_defined[simp,code_unfold]:\"\\<delta>(Bag{}) = true\"\napply(rule ext, auto simp: mtBag_def defined_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def\n                           bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def bot_fun_def null_fun_def)\nby(simp_all add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject bot_option_def null_option_def)\n\nlemma mtBag_valid[simp,code_unfold]:\"\\<upsilon>(Bag{}) = true\"\napply(rule ext,auto simp: mtBag_def valid_def\n                          bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def bot_fun_def null_fun_def)\nby(simp_all add: Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject bot_option_def null_option_def)\n\nlemma mtBag_rep_bag: \"\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (Bag{} \\<tau>)\\<rceil>\\<rceil> = (\\<lambda> _. 0)\"\n apply(simp add: mtBag_def, subst Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse)\nby(simp add: bot_option_def)+\n\ntext_raw\\<open>\\isatagafp\\<close>\n\n\n\n\ntext\\<open>Note that the collection types in OCL allow for null to be included;\n  however, there is the null-collection into which inclusion yields invalid.\\<close>\n\ntext_raw\\<open>\\endisatagafp\\<close>\n\nsubsection\\<open>Definition: Including\\<close>\n\ndefinition OclIncluding   :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<alpha>) val] \\<Rightarrow> ('\\<AA>,'\\<alpha>) Bag\"\nwhere     \"OclIncluding x y = (\\<lambda> \\<tau>. if (\\<delta> x) \\<tau> = true \\<tau> \\<and> (\\<upsilon> y) \\<tau> = true \\<tau>\n                                    then Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor> \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e(x \\<tau>)\\<rceil>\\<rceil> \n                                                      ((y \\<tau>):=\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e(x \\<tau>)\\<rceil>\\<rceil>(y \\<tau>)+1) \n                                                    \\<rfloor>\\<rfloor>\n                                    else invalid \\<tau> )\"\nnotation   OclIncluding   (\"_->including\\<^sub>B\\<^sub>a\\<^sub>g'(_')\")\n\ninterpretation OclIncluding : profile_bin\\<^sub>d_\\<^sub>v OclIncluding \"\\<lambda>x y. Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e\\<lfloor>\\<lfloor>\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil> \n                                                      (y := \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil> y + 1)\\<rfloor>\\<rfloor>\"\nproof -  \n   let ?X = \"\\<lambda>x y. \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e(x)\\<rceil>\\<rceil> ((y):=\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e(x)\\<rceil>\\<rceil>( y )+1)\"\n   show \"profile_bin\\<^sub>d_\\<^sub>v OclIncluding (\\<lambda>x y. Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor> ?X x y \\<rfloor>\\<rfloor>)\"\n         apply unfold_locales  \n          apply(auto simp:OclIncluding_def bot_option_def null_option_def \n                                           bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)\n          by(subst (asm) Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject, simp_all,\n             metis (mono_tags, lifting) Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse bot_option_def mem_Collect_eq null_option_def,\n             simp add: bot_option_def null_option_def)+\nqed\n\nsyntax\n  \"_OclFinbag\" :: \"args => ('\\<AA>,'a::null) Bag\"    (\"Bag{(_)}\")\ntranslations\n  \"Bag{x, xs}\" == \"CONST OclIncluding (Bag{xs}) x\"\n  \"Bag{x}\"     == \"CONST OclIncluding (Bag{}) x \"\n\n\nsubsection\\<open>Definition: Excluding\\<close>\n\ndefinition OclExcluding   :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<alpha>) val] \\<Rightarrow> ('\\<AA>,'\\<alpha>) Bag\"\nwhere     \"OclExcluding x y = (\\<lambda> \\<tau>.  if (\\<delta> x) \\<tau> = true \\<tau> \\<and> (\\<upsilon> y) \\<tau> = true \\<tau>\n                                     then Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor> \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (x \\<tau>)\\<rceil>\\<rceil> ((y \\<tau>):=0::nat) \\<rfloor>\\<rfloor>\n                                     else invalid \\<tau> )\"\nnotation   OclExcluding   (\"_->excluding\\<^sub>B\\<^sub>a\\<^sub>g'(_')\")\n\ninterpretation OclExcluding: profile_bin\\<^sub>d_\\<^sub>v OclExcluding  \n                            \"\\<lambda>x y. Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor>\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e(x)\\<rceil>\\<rceil>(y:=0::nat)\\<rfloor>\\<rfloor>\"\nproof -\n    show \"profile_bin\\<^sub>d_\\<^sub>v OclExcluding (\\<lambda>x y. Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor>\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil>(y := 0)\\<rfloor>\\<rfloor>)\"\n         apply unfold_locales  \n         apply(auto simp:OclExcluding_def bot_option_def null_option_def  \n                         null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)\n         by(subst (asm) Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject,\n               simp_all add: bot_option_def null_option_def,\n               metis (mono_tags, lifting) Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse bot_option_def\n                                          mem_Collect_eq null_option_def)+\nqed\n\nsubsection\\<open>Definition: Includes\\<close>\n\ndefinition OclIncludes   :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<alpha>) val] \\<Rightarrow> '\\<AA> Boolean\"\nwhere     \"OclIncludes x y = (\\<lambda> \\<tau>.   if (\\<delta> x) \\<tau> = true \\<tau> \\<and> (\\<upsilon> y) \\<tau> = true \\<tau>\n                                     then \\<lfloor>\\<lfloor> \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (x \\<tau>)\\<rceil>\\<rceil> (y \\<tau>) > 0 \\<rfloor>\\<rfloor>\n                                     else \\<bottom>  )\"\nnotation   OclIncludes    (\"_->includes\\<^sub>B\\<^sub>a\\<^sub>g'(_')\" (*[66,65]65*))\n\ninterpretation OclIncludes : profile_bin\\<^sub>d_\\<^sub>v OclIncludes \"\\<lambda>x y. \\<lfloor>\\<lfloor> \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil> y > 0 \\<rfloor>\\<rfloor>\"\nby(unfold_locales, auto simp:OclIncludes_def bot_option_def null_option_def invalid_def)\n\nsubsection\\<open>Definition: Excludes\\<close>\n\ndefinition OclExcludes   :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<alpha>) val] \\<Rightarrow> '\\<AA> Boolean\"\nwhere     \"OclExcludes x y = (not(OclIncludes x y))\"\nnotation   OclExcludes    (\"_->excludes\\<^sub>B\\<^sub>a\\<^sub>g'(_')\" (*[66,65]65*))\n\ntext\\<open>The case of the size definition is somewhat special, we admit\nexplicitly in Featherweight OCL the possibility of infinite bags. For\nthe size definition, this requires an extra condition that assures\nthat the cardinality of the bag is actually a defined integer.\\<close>\n\ninterpretation OclExcludes : profile_bin\\<^sub>d_\\<^sub>v OclExcludes \"\\<lambda>x y. \\<lfloor>\\<lfloor> \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil> y \\<le> 0 \\<rfloor>\\<rfloor>\"\nby(unfold_locales, auto simp:OclExcludes_def OclIncludes_def OclNot_def bot_option_def null_option_def invalid_def)\n\nsubsection\\<open>Definition: Size\\<close>\n\ndefinition OclSize     :: \"('\\<AA>,'\\<alpha>::null)Bag \\<Rightarrow> '\\<AA> Integer\"\nwhere     \"OclSize x = (\\<lambda> \\<tau>. if (\\<delta> x) \\<tau> = true \\<tau> \\<and> finite (Rep_Bag_base x \\<tau>)\n                             then \\<lfloor>\\<lfloor> int (card (Rep_Bag_base x \\<tau>)) \\<rfloor>\\<rfloor>\n                             else \\<bottom> )\"\nnotation  (* standard ascii syntax *)\n           OclSize        (\"_->size\\<^sub>B\\<^sub>a\\<^sub>g'(')\" (*[66]*))\n\ntext\\<open>The following definition follows the requirement of the\nstandard to treat null as neutral element of bags. It is\na well-documented exception from the general strictness\nrule and the rule that the distinguished argument self should\nbe non-null.\\<close>\n\n(*TODO Locale - Equivalent*)  \n\n\nsubsection\\<open>Definition: IsEmpty\\<close>\n\ndefinition OclIsEmpty   :: \"('\\<AA>,'\\<alpha>::null) Bag \\<Rightarrow> '\\<AA> Boolean\"\nwhere     \"OclIsEmpty x =  ((\\<upsilon> x and not (\\<delta> x)) or ((OclSize x) \\<doteq> \\<zero>))\"\nnotation   OclIsEmpty     (\"_->isEmpty\\<^sub>B\\<^sub>a\\<^sub>g'(')\" (*[66]*))\n\n(*TODO Locale - Equivalent*)  \n\nsubsection\\<open>Definition: NotEmpty\\<close>\n\ndefinition OclNotEmpty   :: \"('\\<AA>,'\\<alpha>::null) Bag \\<Rightarrow> '\\<AA> Boolean\"\nwhere     \"OclNotEmpty x =  not(OclIsEmpty x)\"\nnotation   OclNotEmpty    (\"_->notEmpty\\<^sub>B\\<^sub>a\\<^sub>g'(')\" (*[66]*))\n\n(*TODO Locale - Equivalent*)  \n\nsubsection\\<open>Definition: Any\\<close>\n\n(* Slight breach of naming convention in order to avoid naming conflict on constant.*)\ndefinition OclANY   :: \"[('\\<AA>,'\\<alpha>::null) Bag] \\<Rightarrow> ('\\<AA>,'\\<alpha>) val\"\nwhere     \"OclANY x = (\\<lambda> \\<tau>. if (\\<upsilon> x) \\<tau> = true \\<tau>\n                            then if (\\<delta> x and OclNotEmpty x) \\<tau> = true \\<tau>\n                                 then SOME y. y \\<in> (Rep_Set_base x \\<tau>)\n                                 else null \\<tau>\n                            else \\<bottom> )\"\nnotation   OclANY   (\"_->any\\<^sub>B\\<^sub>a\\<^sub>g'(')\")\n\n(*TODO Locale - Equivalent*)  \n\n(* actually, this definition covers only: X->any\\<^sub>B\\<^sub>a\\<^sub>g(true) of the standard, which foresees\na (totally correct) high-level definition\nsource->any\\<^sub>B\\<^sub>a\\<^sub>g(iterator | body) =\nsource->select(iterator | body)->asSequence()->first(). Since we don't have sequences,\nwe have to go for a direct---restricted---definition. *)\n\nsubsection\\<open>Definition: Forall\\<close>\n\ntext\\<open>The definition of OclForall mimics the one of @{term \"OclAnd\"}:\nOclForall is not a strict operation.\\<close>\ndefinition OclForall     :: \"[('\\<AA>,'\\<alpha>::null)Bag,('\\<AA>,'\\<alpha>)val\\<Rightarrow>('\\<AA>)Boolean] \\<Rightarrow> '\\<AA> Boolean\"\nwhere     \"OclForall S P = (\\<lambda> \\<tau>. if (\\<delta> S) \\<tau> = true \\<tau>\n                                 then if (\\<exists>x\\<in>Rep_Set_base S \\<tau>. P (\\<lambda>_. x) \\<tau> = false \\<tau>)\n                                      then false \\<tau>\n                                      else if (\\<exists>x\\<in>Rep_Set_base S \\<tau>. P (\\<lambda>_. x) \\<tau> = invalid \\<tau>)\n                                           then invalid \\<tau>\n                                           else if (\\<exists>x\\<in>Rep_Set_base S \\<tau>. P (\\<lambda>_. x) \\<tau> = null \\<tau>)\n                                                then null \\<tau>\n                                                else true \\<tau>\n                                 else \\<bottom>)\"\nsyntax\n  \"_OclForallBag\" :: \"[('\\<AA>,'\\<alpha>::null) Bag,id,('\\<AA>)Boolean] \\<Rightarrow> '\\<AA> Boolean\"    (\"(_)->forAll\\<^sub>B\\<^sub>a\\<^sub>g'(_|_')\")\ntranslations\n  \"X->forAll\\<^sub>B\\<^sub>a\\<^sub>g(x | P)\" == \"CONST UML_Bag.OclForall X (%x. P)\"\n\n(*TODO Locale - Equivalent*)  \n\nsubsection\\<open>Definition: Exists\\<close>\n  \ntext\\<open>Like OclForall, OclExists is also not strict.\\<close>\ndefinition OclExists     :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<alpha>)val\\<Rightarrow>('\\<AA>)Boolean] \\<Rightarrow> '\\<AA> Boolean\"\nwhere     \"OclExists S P = not(UML_Bag.OclForall S (\\<lambda> X. not (P X)))\"\n\nsyntax\n  \"_OclExistBag\" :: \"[('\\<AA>,'\\<alpha>::null) Bag,id,('\\<AA>)Boolean] \\<Rightarrow> '\\<AA> Boolean\"    (\"(_)->exists\\<^sub>B\\<^sub>a\\<^sub>g'(_|_')\")\ntranslations\n  \"X->exists\\<^sub>B\\<^sub>a\\<^sub>g(x | P)\" == \"CONST UML_Bag.OclExists X (%x. P)\"\n\n(*TODO Locale - Equivalent*)  \n  \nsubsection\\<open>Definition: Iterate\\<close>\n\ndefinition OclIterate :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<beta>::null)val,\n                           ('\\<AA>,'\\<alpha>)val\\<Rightarrow>('\\<AA>,'\\<beta>)val\\<Rightarrow>('\\<AA>,'\\<beta>)val] \\<Rightarrow> ('\\<AA>,'\\<beta>)val\"\nwhere     \"OclIterate S A F = (\\<lambda> \\<tau>. if (\\<delta> S) \\<tau> = true \\<tau> \\<and> (\\<upsilon> A) \\<tau> = true \\<tau> \\<and> finite (Rep_Bag_base S \\<tau>)\n                                    then Finite_Set.fold (F o (\\<lambda>a \\<tau>. a) o fst) A (Rep_Bag_base S \\<tau>) \\<tau>\n                                    else \\<bottom>)\"\nsyntax\n  \"_OclIterateBag\"  :: \"[('\\<AA>,'\\<alpha>::null) Bag, idt, idt, '\\<alpha>, '\\<beta>] => ('\\<AA>,'\\<gamma>)val\"\n                        (\"_ ->iterate\\<^sub>B\\<^sub>a\\<^sub>g'(_;_=_ | _')\" (*[71,100,70]50*))\ntranslations\n  \"X->iterate\\<^sub>B\\<^sub>a\\<^sub>g(a; x = A | P)\" == \"CONST OclIterate X A (%a. (% x. P))\"\n\n(*TODO Locale - Equivalent*)  \n\nsubsection\\<open>Definition: Select\\<close>\n  \n  \ndefinition OclSelect :: \"[('\\<AA>,'\\<alpha>::null)Bag,('\\<AA>,'\\<alpha>)val\\<Rightarrow>('\\<AA>)Boolean] \\<Rightarrow> ('\\<AA>,'\\<alpha>)Bag\"\nwhere \"OclSelect S P = (\\<lambda>\\<tau>. if (\\<delta> S) \\<tau> = true \\<tau>\n                              then if (\\<exists>x\\<in>Rep_Set_base S \\<tau>. P(\\<lambda> _. x) \\<tau> = invalid \\<tau>)\n                                   then invalid \\<tau>\n                                   else Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor>\\<lambda>x. \n                                          let n = \\<lceil>\\<lceil> Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (S \\<tau>) \\<rceil>\\<rceil> x in\n                                          if n = 0 | P (\\<lambda>_. x) \\<tau> = false \\<tau> then\n                                            0\n                                          else\n                                            n\\<rfloor>\\<rfloor>\n                              else invalid \\<tau>)\"\nsyntax\n  \"_OclSelectBag\" :: \"[('\\<AA>,'\\<alpha>::null) Bag,id,('\\<AA>)Boolean] \\<Rightarrow> '\\<AA> Boolean\"    (\"(_)->select\\<^sub>B\\<^sub>a\\<^sub>g'(_|_')\")\ntranslations\n  \"X->select\\<^sub>B\\<^sub>a\\<^sub>g(x | P)\" == \"CONST OclSelect X (% x. P)\"\n\n(*TODO Locale - Equivalent*)  \n\nsubsection\\<open>Definition: Reject\\<close>\n\ndefinition OclReject :: \"[('\\<AA>,'\\<alpha>::null)Bag,('\\<AA>,'\\<alpha>)val\\<Rightarrow>('\\<AA>)Boolean] \\<Rightarrow> ('\\<AA>,'\\<alpha>::null)Bag\"\nwhere \"OclReject S P = OclSelect S (not o P)\"\nsyntax\n  \"_OclRejectBag\" :: \"[('\\<AA>,'\\<alpha>::null) Bag,id,('\\<AA>)Boolean] \\<Rightarrow> '\\<AA> Boolean\"    (\"(_)->reject\\<^sub>B\\<^sub>a\\<^sub>g'(_|_')\")\ntranslations\n  \"X->reject\\<^sub>B\\<^sub>a\\<^sub>g(x | P)\" == \"CONST OclReject X (% x. P)\"\n\n(*TODO Locale - Equivalent*)  \n\nsubsection\\<open>Definition: IncludesAll\\<close>\n\ndefinition OclIncludesAll   :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<alpha>) Bag] \\<Rightarrow> '\\<AA> Boolean\"\nwhere     \"OclIncludesAll x y = (\\<lambda> \\<tau>.   if (\\<delta> x) \\<tau> = true \\<tau> \\<and> (\\<delta> y) \\<tau> = true \\<tau>\n                                        then \\<lfloor>\\<lfloor>Rep_Bag_base y \\<tau> \\<subseteq> Rep_Bag_base x \\<tau> \\<rfloor>\\<rfloor>\n                                        else \\<bottom>  )\"\nnotation   OclIncludesAll (\"_->includesAll\\<^sub>B\\<^sub>a\\<^sub>g'(_')\" (*[66,65]65*))\n\ninterpretation OclIncludesAll : profile_bin\\<^sub>d_\\<^sub>d OclIncludesAll \"\\<lambda>x y. \\<lfloor>\\<lfloor>Rep_Bag_base' y \\<subseteq> Rep_Bag_base' x \\<rfloor>\\<rfloor>\"\nby(unfold_locales, auto simp:OclIncludesAll_def bot_option_def null_option_def invalid_def\n                             Rep_Bag_base_def Rep_Bag_base'_def)\n\nsubsection\\<open>Definition: ExcludesAll\\<close>\n\ndefinition OclExcludesAll   :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<alpha>) Bag] \\<Rightarrow> '\\<AA> Boolean\"\nwhere     \"OclExcludesAll x y = (\\<lambda> \\<tau>.   if (\\<delta> x) \\<tau> = true \\<tau> \\<and> (\\<delta> y) \\<tau> = true \\<tau>\n                                        then \\<lfloor>\\<lfloor>Rep_Bag_base y \\<tau> \\<inter> Rep_Bag_base x \\<tau> = {} \\<rfloor>\\<rfloor>\n                                        else \\<bottom>  )\"\nnotation  OclExcludesAll (\"_->excludesAll\\<^sub>B\\<^sub>a\\<^sub>g'(_')\" (*[66,65]65*))\n\ninterpretation OclExcludesAll : profile_bin\\<^sub>d_\\<^sub>d OclExcludesAll \"\\<lambda>x y. \\<lfloor>\\<lfloor>Rep_Bag_base' y \\<inter> Rep_Bag_base' x = {} \\<rfloor>\\<rfloor>\"\nby(unfold_locales, auto simp:OclExcludesAll_def bot_option_def null_option_def invalid_def\n                             Rep_Bag_base_def Rep_Bag_base'_def)\n\nsubsection\\<open>Definition: Union\\<close>\n\ndefinition OclUnion   :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<alpha>) Bag] \\<Rightarrow> ('\\<AA>,'\\<alpha>) Bag\"\nwhere     \"OclUnion x y = (\\<lambda> \\<tau>. if (\\<delta> x) \\<tau> = true \\<tau> \\<and> (\\<delta> y) \\<tau> = true \\<tau>\n                                then Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor> \\<lambda> X. \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (x \\<tau>)\\<rceil>\\<rceil> X + \n                                                       \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (y \\<tau>)\\<rceil>\\<rceil> X\\<rfloor>\\<rfloor>\n                                else invalid \\<tau> )\"\nnotation   OclUnion       (\"_->union\\<^sub>B\\<^sub>a\\<^sub>g'(_')\"          (*[66,65]65*))\n\ninterpretation OclUnion : \n               profile_bin\\<^sub>d_\\<^sub>d OclUnion \"\\<lambda>x y. Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor> \\<lambda> X. \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil> X + \n                                                                \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e y\\<rceil>\\<rceil> X\\<rfloor>\\<rfloor>\"\nproof -  \n   show \"profile_bin\\<^sub>d_\\<^sub>d OclUnion (\\<lambda>x y. Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor> \\<lambda> X. \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil> X + \\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e y\\<rceil>\\<rceil> X\\<rfloor>\\<rfloor>)\"\n   apply unfold_locales \n   apply(auto simp:OclUnion_def bot_option_def null_option_def \n                   null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)\n   by(subst (asm) Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject,\n      simp_all add: bot_option_def null_option_def, \n      metis (mono_tags, lifting) Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse bot_option_def mem_Collect_eq\n                                 null_option_def)+\nqed\n\nsubsection\\<open>Definition: Intersection\\<close>\n\ndefinition OclIntersection   :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<alpha>) Bag] \\<Rightarrow> ('\\<AA>,'\\<alpha>) Bag\"\nwhere     \"OclIntersection x y = (\\<lambda> \\<tau>.  if (\\<delta> x) \\<tau> = true \\<tau> \\<and> (\\<delta> y) \\<tau> = true \\<tau>\n                                        then Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e\\<lfloor>\\<lfloor> \\<lambda> X. min (\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (x \\<tau>)\\<rceil>\\<rceil> X) \n                                                       (\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (y \\<tau>)\\<rceil>\\<rceil> X)\\<rfloor>\\<rfloor>\n                                        else \\<bottom>  )\"\nnotation   OclIntersection(\"_->intersection\\<^sub>B\\<^sub>a\\<^sub>g'(_')\"   (*[71,70]70*))\n\ninterpretation OclIntersection : \n               profile_bin\\<^sub>d_\\<^sub>d OclIntersection \"\\<lambda>x y. Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor> \\<lambda> X. min (\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil> X) \n                                                                (\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e y\\<rceil>\\<rceil> X)\\<rfloor>\\<rfloor>\"\nproof -  \n   show \"profile_bin\\<^sub>d_\\<^sub>d OclIntersection (\\<lambda>x y. Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e \\<lfloor>\\<lfloor> \\<lambda> X. min (\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil> X) \n                                                                (\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e y\\<rceil>\\<rceil> X)\\<rfloor>\\<rfloor>)\"\n   apply unfold_locales \n   apply(auto simp:OclIntersection_def bot_option_def null_option_def \n                   null_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def bot_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def invalid_def)\n   by(subst (asm) Abs_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject,\n      simp_all add: bot_option_def null_option_def, \n      metis (mono_tags, lifting) Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inverse bot_option_def mem_Collect_eq min_0R\n                                 null_option_def)+\nqed\n\nsubsection\\<open>Definition: Count\\<close>\n\ndefinition OclCount   :: \"[('\\<AA>,'\\<alpha>::null) Bag,('\\<AA>,'\\<alpha>) val] \\<Rightarrow> ('\\<AA>) Integer\"\nwhere     \"OclCount x y = (\\<lambda> \\<tau>. if (\\<delta> x) \\<tau> = true \\<tau> \\<and> (\\<delta> y) \\<tau> = true \\<tau>\n                             then  \\<lfloor>\\<lfloor>int(\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e (x \\<tau>)\\<rceil>\\<rceil> (y \\<tau>))\\<rfloor>\\<rfloor> \n                             else invalid \\<tau> )\"\nnotation   OclCount (\"_->count\\<^sub>B\\<^sub>a\\<^sub>g'(_')\"  (*[66,65]65*))\n\ninterpretation OclCount : profile_bin\\<^sub>d_\\<^sub>d OclCount \"\\<lambda>x y. \\<lfloor>\\<lfloor>int(\\<lceil>\\<lceil>Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e x\\<rceil>\\<rceil> y)\\<rfloor>\\<rfloor>\"\nby(unfold_locales, auto simp:OclCount_def bot_option_def null_option_def)\n\nsubsection\\<open>Definition (future operators)\\<close>\n\nconsts (* abstract bag collection operations *)\n    OclSum         :: \" ('\\<AA>,'\\<alpha>::null) Bag \\<Rightarrow> '\\<AA> Integer\"\n  \nnotation  OclSum         (\"_->sum\\<^sub>B\\<^sub>a\\<^sub>g'(')\" (*[66]*))\n\nsubsection\\<open>Logical Properties\\<close>\n\ntext\\<open>OclIncluding\\<close>\n\nlemma OclIncluding_valid_args_valid:\n\"(\\<tau> \\<Turnstile> \\<upsilon>(X->including\\<^sub>B\\<^sub>a\\<^sub>g(x))) = ((\\<tau> \\<Turnstile>(\\<delta> X)) \\<and> (\\<tau> \\<Turnstile>(\\<upsilon> x)))\"\nby (metis (hide_lams, no_types) OclIncluding.def_valid_then_def OclIncluding.defined_args_valid)\n\nlemma OclIncluding_valid_args_valid''[simp,code_unfold]:\n\"\\<upsilon>(X->including\\<^sub>B\\<^sub>a\\<^sub>g(x)) = ((\\<delta> X) and (\\<upsilon> x))\"\nby (simp add: OclIncluding.def_valid_then_def)\n\ntext\\<open>etc. etc.\\<close>\ntext_raw\\<open>\\isatagafp\\<close> \n\ntext\\<open>OclExcluding\\<close>\n\nlemma OclExcluding_valid_args_valid:\n\"(\\<tau> \\<Turnstile> \\<upsilon>(X->excluding\\<^sub>B\\<^sub>a\\<^sub>g(x))) = ((\\<tau> \\<Turnstile>(\\<delta> X)) \\<and> (\\<tau> \\<Turnstile>(\\<upsilon> x)))\"\nby (metis OclExcluding.def_valid_then_def OclExcluding.defined_args_valid)\n\nlemma OclExcluding_valid_args_valid''[simp,code_unfold]:\n\"\\<upsilon>(X->excluding\\<^sub>B\\<^sub>a\\<^sub>g(x)) = ((\\<delta> X) and (\\<upsilon> x))\"\nby (simp add: OclExcluding.def_valid_then_def)\n\ntext\\<open>OclIncludes\\<close>\n\nlemma OclIncludes_valid_args_valid:\n\"(\\<tau> \\<Turnstile> \\<upsilon>(X->includes\\<^sub>B\\<^sub>a\\<^sub>g(x))) = ((\\<tau> \\<Turnstile>(\\<delta> X)) \\<and> (\\<tau> \\<Turnstile>(\\<upsilon> x)))\"\nby (simp add: OclIncludes.def_valid_then_def foundation10')\n\n\n\ntext\\<open>OclExcludes\\<close>\n\nlemma OclExcludes_valid_args_valid:\n\"(\\<tau> \\<Turnstile> \\<upsilon>(X->excludes\\<^sub>B\\<^sub>a\\<^sub>g(x))) = ((\\<tau> \\<Turnstile>(\\<delta> X)) \\<and> (\\<tau> \\<Turnstile>(\\<upsilon> x)))\"\nby (simp add: OclExcludes.def_valid_then_def foundation10')\n\nlemma OclExcludes_valid_args_valid''[simp,code_unfold]:\n\"\\<upsilon>(X->excludes\\<^sub>B\\<^sub>a\\<^sub>g(x)) = ((\\<delta> X) and (\\<upsilon> x))\"\nby (simp add: OclExcludes.def_valid_then_def)\n\ntext\\<open>OclSize\\<close>\n\nlemma OclSize_defined_args_valid: \"\\<tau> \\<Turnstile> \\<delta> (X->size\\<^sub>B\\<^sub>a\\<^sub>g()) \\<Longrightarrow> \\<tau> \\<Turnstile> \\<delta> X\"\nby(auto simp: OclSize_def OclValid_def true_def valid_def false_def StrongEq_def\n              defined_def invalid_def bot_fun_def null_fun_def\n        split: bool.split_asm HOL.if_split_asm option.split)\n\nlemma OclSize_infinite:\nassumes non_finite:\"\\<tau> \\<Turnstile> not(\\<delta>(S->size\\<^sub>B\\<^sub>a\\<^sub>g()))\"\nshows   \"(\\<tau> \\<Turnstile> not(\\<delta>(S))) \\<or> \\<not> finite (Rep_Bag_base S \\<tau>)\"\napply(insert non_finite, simp)\napply(rule impI)\napply(simp add: OclSize_def OclValid_def defined_def bot_fun_def null_fun_def bot_option_def null_option_def\n           split: if_split_asm)\ndone\n\nlemma \"\\<tau> \\<Turnstile> \\<delta> X \\<Longrightarrow> \\<not> finite (Rep_Bag_base X \\<tau>) \\<Longrightarrow> \\<not> \\<tau> \\<Turnstile> \\<delta> (X->size\\<^sub>B\\<^sub>a\\<^sub>g())\"\nby(simp add: OclSize_def OclValid_def defined_def bot_fun_def false_def true_def)\n\nlemma size_defined:\n assumes X_finite: \"\\<And>\\<tau>. finite (Rep_Bag_base X \\<tau>)\"\n shows \"\\<delta> (X->size\\<^sub>B\\<^sub>a\\<^sub>g()) = \\<delta> X\"\n apply(rule ext, simp add: cp_defined[of \"X->size\\<^sub>B\\<^sub>a\\<^sub>g()\"] OclSize_def)\n apply(simp add: defined_def bot_option_def bot_fun_def null_option_def null_fun_def X_finite)\ndone\n\nlemma size_defined':\n assumes X_finite: \"finite (Rep_Bag_base X \\<tau>)\"\n shows \"(\\<tau> \\<Turnstile> \\<delta> (X->size\\<^sub>B\\<^sub>a\\<^sub>g())) = (\\<tau> \\<Turnstile> \\<delta> X)\"\n apply(simp add: cp_defined[of \"X->size\\<^sub>B\\<^sub>a\\<^sub>g()\"] OclSize_def OclValid_def)\n apply(simp add: defined_def bot_option_def bot_fun_def null_option_def null_fun_def X_finite)\ndone\n\ntext\\<open>OclIsEmpty\\<close>\n\nlemma OclIsEmpty_defined_args_valid:\"\\<tau> \\<Turnstile> \\<delta> (X->isEmpty\\<^sub>B\\<^sub>a\\<^sub>g()) \\<Longrightarrow> \\<tau> \\<Turnstile> \\<upsilon> X\"\n  apply(auto simp: OclIsEmpty_def OclValid_def defined_def valid_def false_def true_def\n                   bot_fun_def null_fun_def OclAnd_def OclOr_def OclNot_def\n             split: if_split_asm)\n  apply(case_tac \"(X->size\\<^sub>B\\<^sub>a\\<^sub>g() \\<doteq> \\<zero>) \\<tau>\", simp add: bot_option_def, simp, rename_tac x)\n  apply(case_tac x, simp add: null_option_def bot_option_def, simp)\n  apply(simp add: OclSize_def StrictRefEq\\<^sub>I\\<^sub>n\\<^sub>t\\<^sub>e\\<^sub>g\\<^sub>e\\<^sub>r valid_def)\nby (metis (hide_lams, no_types)\n           bot_fun_def OclValid_def defined_def foundation2 invalid_def)\n\nlemma \"\\<tau> \\<Turnstile> \\<delta> (null->isEmpty\\<^sub>B\\<^sub>a\\<^sub>g())\"\nby(auto simp: OclIsEmpty_def OclValid_def defined_def valid_def false_def true_def\n              bot_fun_def null_fun_def OclAnd_def OclOr_def OclNot_def null_is_valid\n        split: if_split_asm)\n\nlemma OclIsEmpty_infinite: \"\\<tau> \\<Turnstile> \\<delta> X \\<Longrightarrow> \\<not> finite (Rep_Bag_base X \\<tau>) \\<Longrightarrow> \\<not> \\<tau> \\<Turnstile> \\<delta> (X->isEmpty\\<^sub>B\\<^sub>a\\<^sub>g())\"\n  apply(auto simp: OclIsEmpty_def OclValid_def defined_def valid_def false_def true_def\n                   bot_fun_def null_fun_def OclAnd_def OclOr_def OclNot_def\n             split: if_split_asm)\n  apply(case_tac \"(X->size\\<^sub>B\\<^sub>a\\<^sub>g() \\<doteq> \\<zero>) \\<tau>\", simp add: bot_option_def, simp, rename_tac x)\n  apply(case_tac x, simp add: null_option_def bot_option_def, simp)\nby(simp add: OclSize_def StrictRefEq\\<^sub>I\\<^sub>n\\<^sub>t\\<^sub>e\\<^sub>g\\<^sub>e\\<^sub>r valid_def bot_fun_def false_def true_def invalid_def)\n\ntext\\<open>OclNotEmpty\\<close>\n\nlemma OclNotEmpty_defined_args_valid:\"\\<tau> \\<Turnstile> \\<delta> (X->notEmpty\\<^sub>B\\<^sub>a\\<^sub>g()) \\<Longrightarrow> \\<tau> \\<Turnstile> \\<upsilon> X\"\nby (metis (hide_lams, no_types) OclNotEmpty_def OclNot_defargs OclNot_not foundation6 foundation9\n                                OclIsEmpty_defined_args_valid)\n\nlemma \"\\<tau> \\<Turnstile> \\<delta> (null->notEmpty\\<^sub>B\\<^sub>a\\<^sub>g())\"\nby (metis (hide_lams, no_types) OclNotEmpty_def OclAnd_false1 OclAnd_idem OclIsEmpty_def\n                                OclNot3 OclNot4 OclOr_def defined2 defined4 transform1 valid2)\n\nlemma OclNotEmpty_infinite: \"\\<tau> \\<Turnstile> \\<delta> X \\<Longrightarrow> \\<not> finite (Rep_Bag_base X \\<tau>) \\<Longrightarrow> \\<not> \\<tau> \\<Turnstile> \\<delta> (X->notEmpty\\<^sub>B\\<^sub>a\\<^sub>g())\"\n apply(simp add: OclNotEmpty_def)\n apply(drule OclIsEmpty_infinite, simp)\nby (metis OclNot_defargs OclNot_not foundation6 foundation9)\n\n\n\nlemma OclNotEmpty_has_elt' : \"\\<tau> \\<Turnstile> \\<delta> X \\<Longrightarrow>\n                          \\<tau> \\<Turnstile> X->notEmpty\\<^sub>B\\<^sub>a\\<^sub>g() \\<Longrightarrow>\n                          \\<exists>e. e \\<in> (Rep_Set_base X \\<tau>)\"\n apply(drule OclNotEmpty_has_elt, simp)\nby(simp add: Rep_Bag_base_def Rep_Set_base_def image_def)\n\ntext\\<open>OclANY\\<close>\n\nlemma OclANY_defined_args_valid: \"\\<tau> \\<Turnstile> \\<delta> (X->any\\<^sub>B\\<^sub>a\\<^sub>g()) \\<Longrightarrow> \\<tau> \\<Turnstile> \\<delta> X\"\nby(auto simp: OclANY_def OclValid_def true_def valid_def false_def StrongEq_def\n              defined_def invalid_def bot_fun_def null_fun_def OclAnd_def\n        split: bool.split_asm HOL.if_split_asm option.split)\n\nlemma \"\\<tau> \\<Turnstile> \\<delta> X \\<Longrightarrow> \\<tau> \\<Turnstile> X->isEmpty\\<^sub>B\\<^sub>a\\<^sub>g() \\<Longrightarrow> \\<not> \\<tau> \\<Turnstile> \\<delta> (X->any\\<^sub>B\\<^sub>a\\<^sub>g())\"\n apply(simp add: OclANY_def OclValid_def)\n apply(subst cp_defined, subst cp_OclAnd, simp add: OclNotEmpty_def, subst (1 2) cp_OclNot,\n       simp add: cp_OclNot[symmetric] cp_OclAnd[symmetric] cp_defined[symmetric],\n       simp add: false_def true_def)\nby(drule foundation20[simplified OclValid_def true_def], simp)\n\nlemma OclANY_valid_args_valid:\n\"(\\<tau> \\<Turnstile> \\<upsilon>(X->any\\<^sub>B\\<^sub>a\\<^sub>g())) = (\\<tau> \\<Turnstile> \\<upsilon> X)\"\nproof -\n have A: \"(\\<tau> \\<Turnstile> \\<upsilon>(X->any\\<^sub>B\\<^sub>a\\<^sub>g())) \\<Longrightarrow> ((\\<tau> \\<Turnstile>(\\<upsilon> X)))\"\n          by(auto simp: OclANY_def OclValid_def true_def valid_def false_def StrongEq_def\n                        defined_def invalid_def bot_fun_def null_fun_def\n                  split: bool.split_asm HOL.if_split_asm option.split)\n have B: \"(\\<tau> \\<Turnstile>(\\<upsilon> X)) \\<Longrightarrow> (\\<tau> \\<Turnstile> \\<upsilon>(X->any\\<^sub>B\\<^sub>a\\<^sub>g()))\"\n           apply(auto simp: OclANY_def OclValid_def true_def false_def StrongEq_def\n                            defined_def invalid_def valid_def bot_fun_def null_fun_def\n                            bot_option_def null_option_def null_is_valid\n                            OclAnd_def\n                      split: bool.split_asm HOL.if_split_asm option.split)\n           apply(frule Bag_inv_lemma[OF foundation16[THEN iffD2], OF conjI], simp)\n           apply(subgoal_tac \"(\\<delta> X) \\<tau> = true \\<tau>\")\n            prefer 2\n            apply (metis (hide_lams, no_types) OclValid_def foundation16)\n           apply(simp add: true_def,\n                 drule OclNotEmpty_has_elt'[simplified OclValid_def true_def], simp)\n           apply(erule exE,\n                 rule someI2[where Q = \"\\<lambda>x. x \\<noteq> \\<bottom>\" and P = \"\\<lambda>y. y \\<in> (Rep_Set_base X \\<tau>)\",\n                             simplified not_def, THEN mp], simp, auto)\n          by(simp add: Rep_Set_base_def image_def)\n show ?thesis by(auto dest:A intro:B)\nqed\n\nlemma OclANY_valid_args_valid''[simp,code_unfold]:\n\"\\<upsilon>(X->any\\<^sub>B\\<^sub>a\\<^sub>g()) = (\\<upsilon> X)\"\nby(auto intro!: OclANY_valid_args_valid transform2_rev)\n\n(* and higher order ones : forall, exists, iterate, select, reject... *)\ntext_raw\\<open>\\endisatagafp\\<close> \n\nsubsection\\<open>Execution Laws with Invalid or Null or Infinite Set as Argument\\<close>\n\ntext\\<open>OclIncluding\\<close> (* properties already generated by the corresponding locale *)\n\ntext\\<open>OclExcluding\\<close> (* properties already generated by the corresponding locale *)\n\ntext\\<open>OclIncludes\\<close> (* properties already generated by the corresponding locale *)\n\ntext\\<open>OclExcludes\\<close> (* properties already generated by the corresponding locale *)\n\ntext\\<open>OclSize\\<close>\n\nlemma OclSize_invalid[simp,code_unfold]:\"(invalid->size\\<^sub>B\\<^sub>a\\<^sub>g()) = invalid\"\nby(simp add: bot_fun_def OclSize_def invalid_def defined_def valid_def false_def true_def)\n\nlemma OclSize_null[simp,code_unfold]:\"(null->size\\<^sub>B\\<^sub>a\\<^sub>g()) = invalid\"\nby(rule ext,\n   simp add: bot_fun_def null_fun_def null_is_valid OclSize_def\n             invalid_def defined_def valid_def false_def true_def)\n\ntext\\<open>OclIsEmpty\\<close>\n\nlemma OclIsEmpty_invalid[simp,code_unfold]:\"(invalid->isEmpty\\<^sub>B\\<^sub>a\\<^sub>g()) = invalid\"\nby(simp add: OclIsEmpty_def)\n\nlemma OclIsEmpty_null[simp,code_unfold]:\"(null->isEmpty\\<^sub>B\\<^sub>a\\<^sub>g()) = true\"\nby(simp add: OclIsEmpty_def)\n\ntext\\<open>OclNotEmpty\\<close>\n\nlemma OclNotEmpty_invalid[simp,code_unfold]:\"(invalid->notEmpty\\<^sub>B\\<^sub>a\\<^sub>g()) = invalid\"\nby(simp add: OclNotEmpty_def)\n\nlemma OclNotEmpty_null[simp,code_unfold]:\"(null->notEmpty\\<^sub>B\\<^sub>a\\<^sub>g()) = false\"\nby(simp add: OclNotEmpty_def)\n\ntext\\<open>OclANY\\<close>\n\nlemma OclANY_invalid[simp,code_unfold]:\"(invalid->any\\<^sub>B\\<^sub>a\\<^sub>g()) = invalid\"\nby(simp add: bot_fun_def OclANY_def invalid_def defined_def valid_def false_def true_def)\n\nlemma OclANY_null[simp,code_unfold]:\"(null->any\\<^sub>B\\<^sub>a\\<^sub>g()) = null\"\nby(simp add: OclANY_def false_def true_def)\n\ntext\\<open>OclForall\\<close>\n\nlemma OclForall_invalid[simp,code_unfold]:\"invalid->forAll\\<^sub>B\\<^sub>a\\<^sub>g(a| P a) = invalid\"\nby(simp add: bot_fun_def invalid_def OclForall_def defined_def valid_def false_def true_def)\n\nlemma OclForall_null[simp,code_unfold]:\"null->forAll\\<^sub>B\\<^sub>a\\<^sub>g(a | P a) = invalid\"\nby(simp add: bot_fun_def invalid_def OclForall_def defined_def valid_def false_def true_def)\n\ntext\\<open>OclExists\\<close>\n\nlemma OclExists_invalid[simp,code_unfold]:\"invalid->exists\\<^sub>B\\<^sub>a\\<^sub>g(a| P a) = invalid\"\nby(simp add: OclExists_def)\n\nlemma OclExists_null[simp,code_unfold]:\"null->exists\\<^sub>B\\<^sub>a\\<^sub>g(a | P a) = invalid\"\nby(simp add: OclExists_def)\n\ntext\\<open>OclIterate\\<close>\n\nlemma OclIterate_invalid[simp,code_unfold]:\"invalid->iterate\\<^sub>B\\<^sub>a\\<^sub>g(a; x = A | P a x) = invalid\"\nby(simp add: bot_fun_def invalid_def OclIterate_def defined_def valid_def false_def true_def)\n\nlemma OclIterate_null[simp,code_unfold]:\"null->iterate\\<^sub>B\\<^sub>a\\<^sub>g(a; x = A | P a x) = invalid\"\nby(simp add: bot_fun_def invalid_def OclIterate_def defined_def valid_def false_def true_def)\n\n\nlemma OclIterate_invalid_args[simp,code_unfold]:\"S->iterate\\<^sub>B\\<^sub>a\\<^sub>g(a; x = invalid | P a x) = invalid\"\nby(simp add: bot_fun_def invalid_def OclIterate_def defined_def valid_def false_def true_def)\n\ntext\\<open>An open question is this ...\\<close>\nlemma (*OclIterate_null_args[simp,code_unfold]:*) \"S->iterate\\<^sub>B\\<^sub>a\\<^sub>g(a; x = null | P a x) = invalid\"\noops\n(* In the definition above, this does not hold in general.\n       And I believe, this is how it should be ... *)\n\nlemma OclIterate_infinite:\nassumes non_finite: \"\\<tau> \\<Turnstile> not(\\<delta>(S->size\\<^sub>B\\<^sub>a\\<^sub>g()))\"\nshows \"(OclIterate S A F) \\<tau> = invalid \\<tau>\"\napply(insert non_finite [THEN OclSize_infinite])\napply(subst (asm) foundation9, simp)\nby(metis OclIterate_def OclValid_def invalid_def)\n\ntext\\<open>OclSelect\\<close>\n\n\n\nlemma OclSelect_null[simp,code_unfold]:\"null->select\\<^sub>B\\<^sub>a\\<^sub>g(a | P a) = invalid\"\nby(simp add: bot_fun_def invalid_def OclSelect_def defined_def valid_def false_def true_def)\n\ntext\\<open>OclReject\\<close>\n\nlemma OclReject_invalid[simp,code_unfold]:\"invalid->reject\\<^sub>B\\<^sub>a\\<^sub>g(a | P a) = invalid\"\nby(simp add: OclReject_def)\n\nlemma OclReject_null[simp,code_unfold]:\"null->reject\\<^sub>B\\<^sub>a\\<^sub>g(a | P a) = invalid\"\nby(simp add: OclReject_def)\n\ntext_raw\\<open>\\isatagafp\\<close>\n\nsubsubsection\\<open>Context Passing\\<close>\n\nlemma cp_OclIncludes1:\n\"(X->includes\\<^sub>B\\<^sub>a\\<^sub>g(x)) \\<tau> = (X->includes\\<^sub>B\\<^sub>a\\<^sub>g(\\<lambda> _. x \\<tau>)) \\<tau>\"\nby(auto simp: OclIncludes_def StrongEq_def invalid_def\n                 cp_defined[symmetric] cp_valid[symmetric])\n\nlemma cp_OclSize: \"X->size\\<^sub>B\\<^sub>a\\<^sub>g() \\<tau> = ((\\<lambda>_. X \\<tau>)->size\\<^sub>B\\<^sub>a\\<^sub>g()) \\<tau>\"\nby(simp add: OclSize_def cp_defined[symmetric] Rep_Bag_base_def)\n\nlemma cp_OclIsEmpty: \"X->isEmpty\\<^sub>B\\<^sub>a\\<^sub>g() \\<tau> = ((\\<lambda>_. X \\<tau>)->isEmpty\\<^sub>B\\<^sub>a\\<^sub>g()) \\<tau>\"\n apply(simp only: OclIsEmpty_def)\n apply(subst (2) cp_OclOr,\n       subst cp_OclAnd,\n       subst cp_OclNot,\n       subst StrictRefEq\\<^sub>I\\<^sub>n\\<^sub>t\\<^sub>e\\<^sub>g\\<^sub>e\\<^sub>r.cp0)\nby(simp add: cp_defined[symmetric] cp_valid[symmetric] StrictRefEq\\<^sub>I\\<^sub>n\\<^sub>t\\<^sub>e\\<^sub>g\\<^sub>e\\<^sub>r.cp0[symmetric]\n             cp_OclSize[symmetric] cp_OclNot[symmetric] cp_OclAnd[symmetric] cp_OclOr[symmetric])\n\nlemma cp_OclNotEmpty: \"X->notEmpty\\<^sub>B\\<^sub>a\\<^sub>g() \\<tau> = ((\\<lambda>_. X \\<tau>)->notEmpty\\<^sub>B\\<^sub>a\\<^sub>g()) \\<tau>\"\n apply(simp only: OclNotEmpty_def)\n apply(subst (2) cp_OclNot)\nby(simp add: cp_OclNot[symmetric] cp_OclIsEmpty[symmetric])\n\nlemma cp_OclANY: \"X->any\\<^sub>B\\<^sub>a\\<^sub>g() \\<tau> = ((\\<lambda>_. X \\<tau>)->any\\<^sub>B\\<^sub>a\\<^sub>g()) \\<tau>\"\n apply(simp only: OclANY_def)\n apply(subst (2) cp_OclAnd)\nby(simp only: cp_OclAnd[symmetric] cp_defined[symmetric] cp_valid[symmetric]\n              cp_OclNotEmpty[symmetric] Rep_Set_base_def)\n\nlemma cp_OclForall:\n\"(S->forAll\\<^sub>B\\<^sub>a\\<^sub>g(x | P x)) \\<tau> = ((\\<lambda> _. S \\<tau>)->forAll\\<^sub>B\\<^sub>a\\<^sub>g(x | P (\\<lambda> _. x \\<tau>))) \\<tau>\"\nby(auto simp add: OclForall_def cp_defined[symmetric] Rep_Set_base_def)\n\n(* first-order version !*)\nlemma cp_OclForall1 [simp,intro!]:\n\"cp S \\<Longrightarrow> cp (\\<lambda>X. ((S X)->forAll\\<^sub>B\\<^sub>a\\<^sub>g(x | P x)))\"\napply(simp add: cp_def)\napply(erule exE, rule exI, intro allI)\napply(erule_tac x=X in allE)\nby(subst cp_OclForall, simp)\n\nlemma (*cp_OclForall2 [simp,intro!]:*)\n\"cp (\\<lambda>X St x. P (\\<lambda>\\<tau>. x) X St) \\<Longrightarrow> cp S \\<Longrightarrow> cp (\\<lambda>X. (S X)->forAll\\<^sub>B\\<^sub>a\\<^sub>g(x|P x X)) \"\napply(simp only: cp_def)\noops\n\nlemma (*cp_OclForall:*)\n\"cp S \\<Longrightarrow>\n (\\<And> x. cp(P x)) \\<Longrightarrow>\n cp(\\<lambda>X. ((S X)->forAll\\<^sub>B\\<^sub>a\\<^sub>g(x | P x X)))\"\noops\n\nlemma cp_OclExists:\n\"(S->exists\\<^sub>B\\<^sub>a\\<^sub>g(x | P x)) \\<tau> = ((\\<lambda> _. S \\<tau>)->exists\\<^sub>B\\<^sub>a\\<^sub>g(x | P (\\<lambda> _. x \\<tau>))) \\<tau>\"\nby(simp add: OclExists_def OclNot_def, subst cp_OclForall, simp)\n\n(* first-order version !*)\nlemma cp_OclExists1 [simp,intro!]:\n\"cp S \\<Longrightarrow> cp (\\<lambda>X. ((S X)->exists\\<^sub>B\\<^sub>a\\<^sub>g(x | P x)))\"\napply(simp add: cp_def)\napply(erule exE, rule exI, intro allI)\napply(erule_tac x=X in allE)\nby(subst cp_OclExists,simp)\n\nlemma cp_OclIterate: \n     \"(X->iterate\\<^sub>B\\<^sub>a\\<^sub>g(a; x = A | P a x)) \\<tau> =\n                ((\\<lambda> _. X \\<tau>)->iterate\\<^sub>B\\<^sub>a\\<^sub>g(a; x = A | P a x)) \\<tau>\"\nby(simp add: OclIterate_def cp_defined[symmetric] Rep_Bag_base_def)\n\nlemma cp_OclSelect: \"(X->select\\<^sub>B\\<^sub>a\\<^sub>g(a | P a)) \\<tau> =\n                ((\\<lambda> _. X \\<tau>)->select\\<^sub>B\\<^sub>a\\<^sub>g(a | P a)) \\<tau>\"\nby(simp add: OclSelect_def cp_defined[symmetric] Rep_Set_base_def)\n\nlemma cp_OclReject: \"(X->reject\\<^sub>B\\<^sub>a\\<^sub>g(a | P a)) \\<tau> = ((\\<lambda> _. X \\<tau>)->reject\\<^sub>B\\<^sub>a\\<^sub>g(a | P a)) \\<tau>\"\nby(simp add: OclReject_def, subst cp_OclSelect, simp)\n\nlemmas cp_intro''\\<^sub>B\\<^sub>a\\<^sub>g[intro!,simp,code_unfold] =\n       cp_OclSize      [THEN allI[THEN allI[THEN cpI1], of \"OclSize\"]]\n       cp_OclIsEmpty   [THEN allI[THEN allI[THEN cpI1], of \"OclIsEmpty\"]]\n       cp_OclNotEmpty  [THEN allI[THEN allI[THEN cpI1], of \"OclNotEmpty\"]]\n       cp_OclANY       [THEN allI[THEN allI[THEN cpI1], of \"OclANY\"]]\n\nsubsubsection\\<open>Const\\<close>\n\nlemma const_OclIncluding[simp,code_unfold] :\n assumes const_x : \"const x\"\n     and const_S : \"const S\"\n   shows  \"const (S->including\\<^sub>B\\<^sub>a\\<^sub>g(x))\"\n   proof -\n     have A:\"\\<And>\\<tau> \\<tau>'. \\<not> (\\<tau> \\<Turnstile> \\<upsilon> x) \\<Longrightarrow> (S->including\\<^sub>B\\<^sub>a\\<^sub>g(x) \\<tau>) = (S->including\\<^sub>B\\<^sub>a\\<^sub>g(x) \\<tau>')\"\n            apply(simp add: foundation18)\n            apply(erule const_subst[OF const_x const_invalid],simp_all)\n            by(rule const_charn[OF const_invalid])\n     have B: \"\\<And> \\<tau> \\<tau>'. \\<not> (\\<tau> \\<Turnstile> \\<delta> S) \\<Longrightarrow> (S->including\\<^sub>B\\<^sub>a\\<^sub>g(x) \\<tau>) = (S->including\\<^sub>B\\<^sub>a\\<^sub>g(x) \\<tau>')\"\n            apply(simp add: foundation16', elim disjE)\n            apply(erule const_subst[OF const_S const_invalid],simp_all)\n            apply(rule const_charn[OF const_invalid])\n            apply(erule const_subst[OF const_S const_null],simp_all)\n            by(rule const_charn[OF const_invalid])\n     show ?thesis\n       apply(simp only: const_def,intro allI, rename_tac \\<tau> \\<tau>')\n       apply(case_tac \"\\<not> (\\<tau> \\<Turnstile> \\<upsilon> x)\", simp add: A)\n       apply(case_tac \"\\<not> (\\<tau> \\<Turnstile> \\<delta> S)\", simp_all add: B)\n       apply(frule_tac \\<tau>'1= \\<tau>' in  const_OclValid2[OF const_x, THEN iffD1])\n       apply(frule_tac \\<tau>'1= \\<tau>' in  const_OclValid1[OF const_S, THEN iffD1])\n       apply(simp add: OclIncluding_def OclValid_def)\n       apply(subst (1 2) const_charn[OF const_x])\n       apply(subst (1 2) const_charn[OF const_S])\n       by simp\nqed\ntext_raw\\<open>\\endisatagafp\\<close>\n\nsubsection\\<open>Test Statements\\<close>\n\n(*Assert   \"(\\<tau> \\<Turnstile> (Bag{\\<lambda>_. \\<lfloor>\\<lfloor>x\\<rfloor>\\<rfloor>} \\<doteq> Bag{\\<lambda>_. \\<lfloor>\\<lfloor>x\\<rfloor>\\<rfloor>}))\"\nAssert   \"(\\<tau> \\<Turnstile> (Bag{\\<lambda>_. \\<lfloor>x\\<rfloor>} \\<doteq> Bag{\\<lambda>_. \\<lfloor>x\\<rfloor>}))\"*)\n\ninstantiation Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e  :: (equal)equal\nbegin\n  definition \"HOL.equal k l \\<longleftrightarrow>  (k::('a::equal)Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) =  l\"\n  instance   by standard (rule equal_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_def)\nend\n\nlemma equal_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_code [code]:\n  \"HOL.equal k (l::('a::{equal,null})Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e) \\<longleftrightarrow> Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e k = Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e l\"\n  by (auto simp add: equal Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e.Rep_Bag\\<^sub>b\\<^sub>a\\<^sub>s\\<^sub>e_inject)\n\nAssert   \"\\<tau> \\<Turnstile> (Bag{} \\<doteq> Bag{})\" \n\n(*\nAssert   \"\\<tau> \\<Turnstile> not(Bag{\\<one>,\\<one>}      \\<triangleq> Bag{\\<one>})\" \nAssert   \"\\<tau> \\<Turnstile> (Bag{\\<one>,\\<two>}         \\<triangleq> Bag{\\<two>,\\<one>}\" \nAssert   \"\\<tau> \\<Turnstile> (Bag{\\<one>,null}      \\<triangleq> Bag{null,\\<one>}\" \nAssert   \"\\<tau> \\<Turnstile> (Bag{\\<one>,invalid,\\<two>} \\<triangleq> invalid)\"\nAssert   \"\\<tau> \\<Turnstile> (Bag{\\<one>,\\<two>}->including\\<^sub>B\\<^sub>a\\<^sub>g(null) \\<triangleq> Bag{\\<one>,\\<two>,null})\"\n*)\n\n(* > *)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Featherweight_OCL/collection_types/UML_Bag.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.5, "lm_q1q2_score": 0.320317927419949}}
{"text": "(*  File:       Elect_Composition_Ref.thy\n    Copyright   2023  Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\<open>creator \"Valentin Springsklee, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\ntheory Elect_Composition_Ref\n  imports \"Basic_Modules/Elect_Module_Ref\"\n          \"Verified_Voting_Rule_Construction.Elect_Composition\"\n          Sequential_Composition_Ref\nbegin\n\ndefinition elector_opt :: \"('a Electoral_Module) \\<Rightarrow> \n  'a set \\<Rightarrow> 'a Profile \\<Rightarrow> 'a Result nres\" where\n    \"elector_opt m A p \\<equiv> do { \n      let (e, r, d) = m A p;\n      RETURN (e \\<union> d,r,{}) }\"\n\nlemma elector_opt_correct: \n  fixes m :: \"'a Electoral_Module\"\nshows \"(uncurry (elector_opt (m)), uncurry (RETURN oo (elector m))) \\<in>\n  [\\<lambda> (A, p). finite_profile A p]\\<^sub>f (\\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>\\<langle>Id \\<times>\\<^sub>r Id\\<rangle>set_rel\\<rangle>list_rel) \\<rightarrow> \n  \\<langle>\\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>Id\\<rangle>set_rel\\<rangle>nres_rel\"\n  unfolding elector_opt_def\n  apply (intro frefI nres_relI) apply clarsimp\n   apply (refine_vcg)\n  by auto\n\nlemma elector_opt_eq:\n  shows \"elector_opt \\<equiv> (RETURN \\<circ>\\<circ>\\<circ> (elector))\"\n  unfolding elector_opt_def elector.simps seqcomp_alt_eq[symmetric]\n  sequential_composition'.simps comp_apply\n  apply auto\n  by (simp add: case_prod_beta')\n  \n\n(*lemma elector_opt_correct_nres: \n  fixes m_opt :: \"('a set \\<Rightarrow> 'a Profile \\<Rightarrow> 'a Result nres)\"\nfixes m :: \"'a Electoral_Module\"\nassumes em_m: \"electoral_module m\" \nassumes mref: \"(uncurry m_opt, uncurry (RETURN oo m)) \\<in>  \n  [\\<lambda> (A, p). finite_profile A p]\\<^sub>f (\\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>\\<langle>Id \\<times>\\<^sub>r Id\\<rangle>set_rel\\<rangle>list_rel) \\<rightarrow> \n   \\<langle>\\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>Id\\<rangle>set_rel\\<rangle>nres_rel\"\nshows \"(uncurry (elector_opt (m)), uncurry ((elector m))) \\<in>\n  [\\<lambda> (A, p). finite_profile A p]\\<^sub>f (\\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>\\<langle>Id \\<times>\\<^sub>r Id\\<rangle>set_rel\\<rangle>list_rel) \\<rightarrow> \n  \\<langle>\\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r \\<langle>Id\\<rangle>set_rel\\<rangle>nres_rel\"\n  unfolding elector_opt_def\n  apply (intro frefI nres_relI) apply clarsimp\nproof (rename_tac A p, refine_vcg, unfold SPEC_eq_is_RETURN)\n  fix A :: \"'a set\"\n  fix p :: \"'a Profile\"\n  assume fina: \"finite A\"\n  assume prof: \"profile A p\"\n  have mret: \"m_opt A p \\<le> RETURN (m A p)\"\n     using mref[THEN frefD, THEN nres_relD] fina prof\n     by clarsimp\n  thus \" m_opt A p\n           \\<le> SPEC (\\<lambda>x. (case x of (e, r, d) \\<Rightarrow> RETURN (e \\<union> d, r, {}))\n                        \\<le> RETURN (elect m A p \\<union> defer m A p, reject m A p, {}))\"\n    by (simp add: case_prod_beta' order_trans)\nqed*)\n\nlocale Elector_Impl =\n  fixes m :: \"'a::{default, heap, hashable} Electoral_Module\"\n  fixes m_sep :: \"'a::{default, heap, hashable} Electoral_Module_Sep\"\n  assumes em_m: \"electoral_module m\" \n  assumes m_sep_correct: \"(uncurry m_sep, uncurry (RETURN oo m)) \\<in> elec_mod_seprel id_assn\"\nbegin\n   \n  lemma this_loc: \"Elector_Impl m m_sep \" by unfold_locales\n\n  sepref_register m\n\n  declare m_sep_correct[sepref_fr_rules]\n\nschematic_goal elector_sepimpl:\n  \"(uncurry ?f2, uncurry (elector_opt m)) \\<in> elec_mod_seprel id_assn\"\n  unfolding elector_opt_def hs.fold_custom_empty\n  by sepref\n\nconcrete_definition elector_sep_uc uses Elector_Impl.elector_sepimpl\n  prepare_code_thms elector_sep_uc_def\nlemmas  elector_sep_ucp_refine = elector_sep_uc.refine[OF this_loc]\n\nschematic_goal elector_sep_curried:\n \"?curried = curry (elector_sep_uc m_sep)\" by auto\n\nconcrete_definition (in -) elector_sep uses Elector_Impl.elector_sep_curried\n\n  theorem seqcomp_sep_correct:\n  shows \"(uncurry (elector_sep m_sep), uncurry (RETURN oo (elector m))) \\<in> elec_mod_seprel id_assn\"\n    using elector_sep_ucp_refine[FCOMP elector_opt_correct]\n    unfolding elector_sep_def\n    by (simp)\n\nend\n\nend", "meta": {"author": "SpringVaS", "repo": "RefinementOfVotingRules", "sha": "a01e44b062fb43e172dff81cffbf941856c977d8", "save_path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules", "path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules/RefinementOfVotingRules-a01e44b062fb43e172dff81cffbf941856c977d8/theories/Compositional_Structures/Elect_Composition_Ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6406358411176238, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3203179205588119}}
{"text": "theory Prelude_Ord\nimports \"$HETS_LIB/Isabelle/MainHC\"\nuses \"$HETS_LIB/Isabelle/prelude\"\nbegin\n\nML \"Header.initialize\n    [\\\"IOE01\\\", \\\"IOE02\\\", \\\"IOE03\\\", \\\"IOE07\\\", \\\"IOE08\\\", \\\"IOE09\\\",\n     \\\"LeTAsymmetry\\\", \\\"LeqFDef\\\", \\\"LeqReflexivity\\\",\n     \\\"LeqTTransitive\\\", \\\"LeqTTotal\\\", \\\"GeIrreflexivity\\\",\n     \\\"GeTAsymmetry\\\", \\\"GeTTransitive\\\", \\\"GeTTotal\\\",\n     \\\"GeqReflexivity\\\", \\\"GeqTTransitive\\\", \\\"GeqTTotal\\\",\n     \\\"EqFSOrdRel\\\", \\\"EqFOrdRel\\\", \\\"LeTGeTRel\\\", \\\"LeTGeqFRel\\\",\n     \\\"GeTLeqFRel\\\", \\\"MaxSym\\\", \\\"MinSym\\\", \\\"TO1\\\", \\\"TO2\\\", \\\"TO3\\\",\n     \\\"TO4\\\", \\\"TO5\\\", \\\"TO6\\\", \\\"TO7\\\", \\\"IOO16\\\", \\\"IOO17\\\",\n     \\\"IOO18\\\", \\\"IOO19\\\", \\\"IOO20\\\", \\\"IOO21\\\", \\\"IOO22\\\", \\\"IOO23\\\",\n     \\\"IOO24\\\", \\\"IOO25\\\", \\\"IOO26\\\", \\\"IOO27\\\", \\\"IOO28\\\", \\\"IOO29\\\",\n     \\\"IOO30\\\", \\\"IOO31\\\", \\\"IOO32\\\", \\\"IOO33\\\", \\\"IBO6\\\", \\\"IBO7\\\",\n     \\\"IBO8\\\", \\\"IBO9\\\", \\\"IBO10\\\", \\\"IBO11\\\", \\\"IBO12\\\", \\\"IUO01\\\",\n     \\\"IUO02\\\", \\\"IUO03\\\", \\\"IUO04\\\", \\\"IUO05\\\", \\\"IUO06\\\", \\\"IUO07\\\",\n     \\\"NotFalse\\\", \\\"NotTrue\\\", \\\"AndDef1\\\", \\\"AndDef2\\\", \\\"AndDef3\\\",\n     \\\"AndDef4\\\", \\\"OrDef\\\", \\\"OtherwiseDef\\\", \\\"NotTrue1\\\",\n     \\\"NotFalse2\\\", \\\"TB1\\\", \\\"EqualTDef\\\", \\\"SymDef\\\", \\\"EqualSym\\\",\n     \\\"EqualReflex\\\", \\\"EqualTransT\\\", \\\"DiffDef\\\", \\\"DiffTDef\\\",\n     \\\"DiffFDef\\\", \\\"TE1\\\", \\\"TE2\\\", \\\"TE3\\\", \\\"TE4\\\", \\\"IBE1\\\",\n     \\\"IBE2\\\", \\\"IBE3\\\", \\\"IBE4\\\", \\\"IBE5\\\", \\\"IBE6\\\", \\\"IBE7\\\",\n     \\\"IBE8\\\", \\\"IUE1\\\", \\\"IUE2\\\", \\\"IOE04\\\", \\\"IOE05\\\", \\\"IOE06\\\",\n     \\\"LeIrreflexivity\\\", \\\"LeTTransitive\\\", \\\"LeTTotal\\\", \\\"LeqDef\\\",\n     \\\"GeDef\\\", \\\"GeqTDef\\\", \\\"EqTSOrdRel\\\", \\\"EqTOrdRel\\\",\n     \\\"LeqTGetTRel\\\", \\\"GeTLeTRel\\\", \\\"GeqTLeqTRel\\\", \\\"LeTGeFEqFRel\\\",\n     \\\"LeqTGeFRel\\\", \\\"GeTLeFEqFRel\\\", \\\"GeqTLeFRel\\\", \\\"LeLtDef\\\",\n     \\\"LeEqDef\\\", \\\"LeGtDef\\\", \\\"LqLtDef\\\", \\\"LqEqDef\\\", \\\"LqGtDef\\\",\n     \\\"GeLtDef\\\", \\\"GeEqDef\\\", \\\"GeGtDef\\\", \\\"GqLtDef\\\", \\\"GqEqDef\\\",\n     \\\"GqGtDef\\\", \\\"MaxYDef\\\", \\\"MaxXDef\\\", \\\"MinXDef\\\", \\\"MinYDef\\\",\n     \\\"IOO13\\\", \\\"IOO14\\\", \\\"IOO15\\\", \\\"IBO5\\\"]\"\n\ntypedecl Nat\ntypedecl Unit\n\ndatatype Bool = X_False (\"False''\") | X_True (\"True''\")\ndatatype Ordering = EQ | GT | LT\n\nconsts\nNot__X :: \"Bool => Bool\" (\"(Not''/ _)\" [56] 56)\nX__XAmpXAmp__X :: \"Bool => Bool => Bool\" (\"(_/ &&/ _)\" [54,54] 52)\nX__XEqXEq__X :: \"'a => 'a => Bool\" (\"(_/ ==''/ _)\" [54,54] 52)\nX__XGtXEq__X :: \"'a => 'a => Bool\" (\"(_/ >=''/ _)\" [54,54] 52)\nX__XGt__X :: \"'a => 'a => Bool\" (\"(_/ >''/ _)\" [54,54] 52)\nX__XLtXEq__X :: \"'a => 'a => Bool\" (\"(_/ <=''/ _)\" [54,54] 52)\nX__XLt__X :: \"'a => 'a => Bool\" (\"(_/ <''/ _)\" [54,54] 52)\nX__XSlashXEq__X :: \"'a => 'a => Bool\" (\"(_/ '/=/ _)\" [54,54] 52)\nX__XVBarXVBar__X :: \"Bool => Bool => Bool\" (\"(_/ ||/ _)\" [54,54] 52)\nX_max :: \"'a => 'a => 'a\"\nX_min :: \"'a => 'a => 'a\"\ncompare :: \"'a => 'a => Ordering\"\notherwiseH :: \"Bool\"\n\ninstance Bool:: type ..\ninstance Nat:: type ..\ninstance Ordering:: type ..\ninstance Unit:: type ..\n\naxioms\nNotFalse [rule_format] : \"Not' False' = True'\"\n\nNotTrue [rule_format] : \"Not' True' = False'\"\n\nAndDef1 [rule_format] : \"False' && False' = False'\"\n\nAndDef2 [rule_format] : \"False' && True' = False'\"\n\nAndDef3 [rule_format] : \"True' && False' = False'\"\n\nAndDef4 [rule_format] : \"True' && True' = True'\"\n\nOrDef [rule_format] :\n\"ALL x. ALL y. x || y = Not' (Not' x && Not' y)\"\n\nOtherwiseDef [rule_format] : \"otherwiseH = True'\"\n\nNotTrue1 [rule_format] : \"ALL x. Not' x = True' = (x = False')\"\n\nNotFalse2 [rule_format] : \"ALL x. Not' x = False' = (x = True')\"\n\nTB1 [rule_format] : \"~ True' = False'\"\n\nEqualTDef [rule_format] : \"ALL x. ALL y. x = y --> x ==' y = True'\"\n\nSymDef [rule_format] : \"ALL x. ALL y. x ==' y = y ==' x\"\n\nEqualSym [rule_format] : \"ALL x. ALL y. x ==' y = y ==' x\"\n\nEqualReflex [rule_format] : \"ALL x. x ==' x = True'\"\n\nEqualTransT [rule_format] :\n\"ALL x.\n ALL y.\n ALL z. x ==' y = True' & y ==' z = True' --> x ==' z = True'\"\n\nDiffDef [rule_format] : \"ALL x. ALL y. x /= y = Not' (x ==' y)\"\n\nDiffTDef [rule_format] :\n\"ALL x. ALL y. x /= y = True' = (Not' (x ==' y) = True')\"\n\nDiffFDef [rule_format] :\n\"ALL x. ALL y. x /= y = False' = (x ==' y = True')\"\n\nTE1 [rule_format] : \"ALL x. ALL y. x ==' y = False' --> ~ x = y\"\n\nTE2 [rule_format] :\n\"ALL x. ALL y. Not' (x ==' y) = True' = (x ==' y = False')\"\n\nTE3 [rule_format] :\n\"ALL x. ALL y. Not' (x ==' y) = False' = (x ==' y = True')\"\n\nTE4 [rule_format] :\n\"ALL x. ALL y. (~ x ==' y = True') = (x ==' y = False')\"\n\nIBE1 [rule_format] : \"True' ==' True' = True'\"\n\nIBE2 [rule_format] : \"False' ==' False' = True'\"\n\nIBE3 [rule_format] : \"True' ==' False' = False'\"\n\nIBE4 [rule_format] : \"False' ==' True' = False'\"\n\nIBE5 [rule_format] : \"True' /= False' = True'\"\n\nIBE6 [rule_format] : \"False' /= True' = True'\"\n\nIBE7 [rule_format] : \"Not' (True' ==' False') = True'\"\n\nIBE8 [rule_format] : \"Not' Not' (True' ==' False') = False'\"\n\nIUE1 [rule_format] : \"() ==' () = True'\"\n\nIUE2 [rule_format] : \"() /= () = False'\"\n\nIOE04 [rule_format] : \"LT ==' EQ = False'\"\n\nIOE05 [rule_format] : \"LT ==' GT = False'\"\n\nIOE06 [rule_format] : \"EQ ==' GT = False'\"\n\nLeIrreflexivity [rule_format] : \"ALL x. x <' x = False'\"\n\nLeTTransitive [rule_format] :\n\"ALL x.\n ALL y. ALL z. x <' y = True' & y <' z = True' --> x <' z = True'\"\n\nLeTTotal [rule_format] :\n\"ALL x. ALL y. (x <' y = True' | y <' x = True') | x ==' y = True'\"\n\nLeqDef [rule_format] :\n\"ALL x. ALL y. x <=' y = (x <' y) || (x ==' y)\"\n\nGeDef [rule_format] : \"ALL x. ALL y. x >' y = y <' x\"\n\nGeqTDef [rule_format] :\n\"ALL x. ALL y. x >=' y = (x >' y) || (x ==' y)\"\n\nEqTSOrdRel [rule_format] :\n\"ALL x. ALL y. x ==' y = Not' (x <' y) && Not' (x >' y)\"\n\nEqTOrdRel [rule_format] :\n\"ALL x. ALL y. x ==' y = (x <=' y) && (x >=' y)\"\n\nLeqTGetTRel [rule_format] : \"ALL x. ALL y. x <=' y = y >=' x\"\n\nGeTLeTRel [rule_format] : \"ALL x. ALL y. x >' y = y <' x\"\n\nGeqTLeqTRel [rule_format] : \"ALL x. ALL y. x >=' y = y <=' x\"\n\nLeTGeFEqFRel [rule_format] :\n\"ALL x. ALL y. x <' y = Not' (x >' y) && Not' (x ==' y)\"\n\nLeqTGeFRel [rule_format] : \"ALL x. ALL y. x <=' y = Not' (x >' y)\"\n\nGeTLeFEqFRel [rule_format] :\n\"ALL x. ALL y. x >' y = Not' (x <' y) && Not' (x ==' y)\"\n\nGeqTLeFRel [rule_format] : \"ALL x. ALL y. x >=' y = Not' (x <' y)\"\n\nLeLtDef [rule_format] :\n\"ALL x.\n ALL y. compare x y = LT = (x <' y = True' & x ==' y = False')\"\n\nLeEqDef [rule_format] :\n\"ALL x.\n ALL y. compare x y = EQ = (x <' y = False' & y <' x = False')\"\n\nLeGtDef [rule_format] :\n\"ALL x.\n ALL y. compare x y = GT = (x >' y = True' & x ==' y = False')\"\n\nLqLtDef [rule_format] :\n\"ALL x.\n ALL y. (compare x y = LT | compare x y = EQ) = (x <=' y = True')\"\n\nLqEqDef [rule_format] :\n\"ALL x.\n ALL y. compare x y = EQ = (x <=' y = True' & y <=' x = True')\"\n\nLqGtDef [rule_format] :\n\"ALL x. ALL y. compare x y = GT = (x <=' y = False')\"\n\nGeLtDef [rule_format] :\n\"ALL x.\n ALL y. compare x y = LT = (x >' y = False' & x ==' y = False')\"\n\nGeEqDef [rule_format] :\n\"ALL x.\n ALL y. compare x y = EQ = (x >' y = False' & y >' x = False')\"\n\nGeGtDef [rule_format] :\n\"ALL x.\n ALL y. compare x y = GT = (x >' y = True' & x ==' y = False')\"\n\nGqLtDef [rule_format] :\n\"ALL x. ALL y. compare x y = LT = (x >=' y = False')\"\n\nGqEqDef [rule_format] :\n\"ALL x.\n ALL y. compare x y = EQ = (x >=' y = True' & y >=' x = True')\"\n\nGqGtDef [rule_format] :\n\"ALL x.\n ALL y. (compare x y = GT | compare x y = EQ) = (x >=' y = True')\"\n\nMaxYDef [rule_format] :\n\"ALL x. ALL y. X_max x y = y = (x <=' y = True')\"\n\nMaxXDef [rule_format] :\n\"ALL x. ALL y. X_max x y = x = (x >' y = True')\"\n\nMinXDef [rule_format] :\n\"ALL x. ALL y. X_min x y = x = (x <=' y = True')\"\n\nMinYDef [rule_format] :\n\"ALL x. ALL y. X_min x y = y = (x >' y = True')\"\n\nIOO13 [rule_format] : \"LT <' EQ = True'\"\n\nIOO14 [rule_format] : \"EQ <' GT = True'\"\n\nIOO15 [rule_format] : \"LT <' GT = True'\"\n\nIBO5 [rule_format] : \"False' <' True' = True'\"\n\ndeclare NotFalse [simp]\ndeclare NotTrue [simp]\ndeclare AndDef1 [simp]\ndeclare AndDef2 [simp]\ndeclare AndDef3 [simp]\ndeclare AndDef4 [simp]\ndeclare EqualReflex [simp]\ndeclare IBE1 [simp]\ndeclare IBE2 [simp]\ndeclare IBE3 [simp]\ndeclare IBE4 [simp]\ndeclare IBE5 [simp]\ndeclare IBE6 [simp]\ndeclare IBE7 [simp]\ndeclare IBE8 [simp]\ndeclare IOE04 [simp]\ndeclare IOE05 [simp]\ndeclare IOE06 [simp]\ndeclare LeIrreflexivity [simp]\ndeclare IOO13 [simp]\ndeclare IOO14 [simp]\ndeclare IOO15 [simp]\ndeclare IBO5 [simp]\n\ntheorem IOE01 : \"LT ==' LT = True'\"\nby auto\n\nML \"Header.record \\\"IOE01\\\"\"\n\ntheorem IOE02 : \"EQ ==' EQ = True'\"\nby auto\n\nML \"Header.record \\\"IOE02\\\"\"\n\ntheorem IOE03 : \"GT ==' GT = True'\"\nby auto\n\nML \"Header.record \\\"IOE03\\\"\"\n\ntheorem IOE07 : \"LT /= EQ = True'\"\napply(simp add: DiffDef)\ndone\n\nML \"Header.record \\\"IOE07\\\"\"\n\ntheorem IOE08 : \"LT /= GT = True'\"\napply(simp add: DiffDef)\ndone\n\nML \"Header.record \\\"IOE08\\\"\"\n\ntheorem IOE09 : \"EQ /= GT = True'\"\napply(simp add: DiffDef)\ndone\n\nML \"Header.record \\\"IOE09\\\"\"\n\ntheorem LeTAsymmetry :\n\"ALL x. ALL y. x <' y = True' --> y <' x = False'\"\napply(auto)\napply(simp add: LeTGeFEqFRel)\napply(case_tac \"x >' y\")\napply(case_tac \"x ==' y\")\napply(auto)\napply(case_tac \"y >' x\")\napply(case_tac \"y ==' x\")\napply(auto)\napply(simp add: EqTOrdRel)\napply(\n\nML \"Header.record \\\"LeTAsymmetry\\\"\"\n\ntheorem LeqFDef :\n\"ALL x. ALL y. Not' (x <=' y) = Not' (x <' y) && Not' (x ==' y)\"\nby auto\n\nML \"Header.record \\\"LeqFDef\\\"\"\n\ntheorem LeqReflexivity : \"ALL x. x <=' x = True'\"\nby auto\n\nML \"Header.record \\\"LeqReflexivity\\\"\"\n\ntheorem LeqTTransitive :\n\"ALL x.\n ALL y.\n ALL z. x <=' y = True' & y <=' z = True' --> x <=' z = True'\"\nby auto\n\nML \"Header.record \\\"LeqTTransitive\\\"\"\n\ntheorem LeqTTotal :\n\"ALL x. ALL y. (x <=' y) && (y <=' x) = x ==' y\"\nby auto\n\nML \"Header.record \\\"LeqTTotal\\\"\"\n\ntheorem GeIrreflexivity : \"ALL x. x >' x = False'\"\nby auto\n\nML \"Header.record \\\"GeIrreflexivity\\\"\"\n\ntheorem GeTAsymmetry :\n\"ALL x. ALL y. x >' y = True' --> y >' x = False'\"\nby auto\n\nML \"Header.record \\\"GeTAsymmetry\\\"\"\n\ntheorem GeTTransitive :\n\"ALL x.\n ALL y. ALL z. x >' y = True' & y >' z = True' --> x >' z = True'\"\nby auto\n\nML \"Header.record \\\"GeTTransitive\\\"\"\n\ntheorem GeTTotal :\n\"ALL x. ALL y. (x >' y = True' | y >' x = True') | x ==' y = True'\"\nby auto\n\nML \"Header.record \\\"GeTTotal\\\"\"\n\ntheorem GeqReflexivity : \"ALL x. x >=' x = True'\"\nby auto\n\nML \"Header.record \\\"GeqReflexivity\\\"\"\n\ntheorem GeqTTransitive :\n\"ALL x.\n ALL y.\n ALL z. x >=' y = True' & y >=' z = True' --> x >=' z = True'\"\nby auto\n\nML \"Header.record \\\"GeqTTransitive\\\"\"\n\ntheorem GeqTTotal :\n\"ALL x. ALL y. (x >=' y) && (y >=' x) = x ==' y\"\nby auto\n\nML \"Header.record \\\"GeqTTotal\\\"\"\n\ntheorem EqFSOrdRel :\n\"ALL x. ALL y. Not' (x ==' y) = (x <' y) || (x >' y)\"\nby auto\n\nML \"Header.record \\\"EqFSOrdRel\\\"\"\n\ntheorem EqFOrdRel :\n\"ALL x. ALL y. Not' (x ==' y) = (x <=' y) || (x >=' y)\"\nby auto\n\nML \"Header.record \\\"EqFOrdRel\\\"\"\n\ntheorem LeTGeTRel : \"ALL x. ALL y. x <' y = y >' x\"\nby auto\n\nML \"Header.record \\\"LeTGeTRel\\\"\"\n\ntheorem LeTGeqFRel : \"ALL x. ALL y. x <' y = Not' (x >=' y)\"\nby auto\n\nML \"Header.record \\\"LeTGeqFRel\\\"\"\n\ntheorem GeTLeqFRel : \"ALL x. ALL y. x >' y = Not' (x <=' y)\"\nby auto\n\nML \"Header.record \\\"GeTLeqFRel\\\"\"\n\ntheorem MaxSym : \"ALL x. ALL y. X_max x y = X_max y x\"\nby auto\n\nML \"Header.record \\\"MaxSym\\\"\"\n\ntheorem MinSym : \"ALL x. ALL y. X_min x y = X_min y x\"\nby auto\n\nML \"Header.record \\\"MinSym\\\"\"\n\ntheorem TO1 :\n\"ALL x.\n ALL y. (x ==' y = True' | x <' y = True') = (x <=' y = True')\"\nby auto\n\nML \"Header.record \\\"TO1\\\"\"\n\ntheorem TO2 : \"ALL x. ALL y. x ==' y = True' --> x <' y = False'\"\nby auto\n\nML \"Header.record \\\"TO2\\\"\"\n\ntheorem TO3 :\n\"ALL x. ALL y. Not' Not' (x <' y) = True' | Not' (x <' y) = True'\"\nby auto\n\nML \"Header.record \\\"TO3\\\"\"\n\ntheorem TO4 :\n\"ALL x. ALL y. x <' y = True' --> Not' (x ==' y) = True'\"\nby auto\n\nML \"Header.record \\\"TO4\\\"\"\n\ntheorem TO5 :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n (x <' y = True' & y <' z = True') & z <' w = True' -->\n x <' w = True'\"\napply(auto)\nthm LeTTransitive\napply(rule_tac x=\"x\" and y=\"y\" and z =\"w\" in LeTTransitive)\napply(rule conjI)\napply(assumption)\napply(rule_tac x=\"y\" and y=\"z\" and z =\"w\" in LeTTransitive)\napply(rule conjI)\napply(assumption)\napply(assumption)\ndone\n\nML \"Header.record \\\"TO5\\\"\"\n\ntheorem TO6 :\n\"ALL x. ALL z. z <' x = True' --> Not' (x <' z) = True'\"\nby auto\n\nML \"Header.record \\\"TO6\\\"\"\n\ntheorem TO7 : \"ALL x. ALL y. x <' y = True' = (y >' x = True')\"\nby auto\n\nML \"Header.record \\\"TO7\\\"\"\n\ntheorem IOO16 : \"LT <=' EQ = True'\"\nby auto\n\nML \"Header.record \\\"IOO16\\\"\"\n\ntheorem IOO17 : \"EQ <=' GT = True'\"\nby auto\n\nML \"Header.record \\\"IOO17\\\"\"\n\ntheorem IOO18 : \"LT <=' GT = True'\"\nby auto\n\nML \"Header.record \\\"IOO18\\\"\"\n\ntheorem IOO19 : \"EQ >=' LT = True'\"\nby auto\n\nML \"Header.record \\\"IOO19\\\"\"\n\ntheorem IOO20 : \"GT >=' EQ = True'\"\nby auto\n\nML \"Header.record \\\"IOO20\\\"\"\n\ntheorem IOO21 : \"GT >=' LT = True'\"\nby auto\n\nML \"Header.record \\\"IOO21\\\"\"\n\ntheorem IOO22 : \"EQ >' LT = True'\"\nby auto\n\nML \"Header.record \\\"IOO22\\\"\"\n\ntheorem IOO23 : \"GT >' EQ = True'\"\nby auto\n\nML \"Header.record \\\"IOO23\\\"\"\n\ntheorem IOO24 : \"GT >' LT = True'\"\nby auto\n\nML \"Header.record \\\"IOO24\\\"\"\n\ntheorem IOO25 : \"X_max LT EQ = EQ\"\nby auto\n\nML \"Header.record \\\"IOO25\\\"\"\n\ntheorem IOO26 : \"X_max EQ GT = GT\"\nby auto\n\nML \"Header.record \\\"IOO26\\\"\"\n\ntheorem IOO27 : \"X_max LT GT = GT\"\nby auto\n\nML \"Header.record \\\"IOO27\\\"\"\n\ntheorem IOO28 : \"X_min LT EQ = LT\"\nby auto\n\nML \"Header.record \\\"IOO28\\\"\"\n\ntheorem IOO29 : \"X_min EQ GT = EQ\"\nby auto\n\nML \"Header.record \\\"IOO29\\\"\"\n\ntheorem IOO30 : \"X_min LT GT = LT\"\nby auto\n\nML \"Header.record \\\"IOO30\\\"\"\n\ntheorem IOO31 : \"compare LT LT = EQ\"\nby auto\n\nML \"Header.record \\\"IOO31\\\"\"\n\ntheorem IOO32 : \"compare EQ EQ = EQ\"\nby auto\n\nML \"Header.record \\\"IOO32\\\"\"\n\ntheorem IOO33 : \"compare GT GT = EQ\"\nby auto\n\nML \"Header.record \\\"IOO33\\\"\"\n\ntheorem IBO6 : \"False' >=' True' = False'\"\nby auto\n\nML \"Header.record \\\"IBO6\\\"\"\n\ntheorem IBO7 : \"True' >=' False' = True'\"\nby auto\n\nML \"Header.record \\\"IBO7\\\"\"\n\ntheorem IBO8 : \"True' <' False' = False'\"\nby auto\n\nML \"Header.record \\\"IBO8\\\"\"\n\ntheorem IBO9 : \"X_max False' True' = True'\"\nby auto\n\nML \"Header.record \\\"IBO9\\\"\"\n\ntheorem IBO10 : \"X_min False' True' = False'\"\nby auto\n\nML \"Header.record \\\"IBO10\\\"\"\n\ntheorem IBO11 : \"compare True' True' = EQ\"\nby auto\n\nML \"Header.record \\\"IBO11\\\"\"\n\ntheorem IBO12 : \"compare False' False' = EQ\"\nby auto\n\nML \"Header.record \\\"IBO12\\\"\"\n\ntheorem IUO01 : \"() <=' () = True'\"\nby auto\n\nML \"Header.record \\\"IUO01\\\"\"\n\ntheorem IUO02 : \"() <' () = False'\"\nby auto\n\nML \"Header.record \\\"IUO02\\\"\"\n\ntheorem IUO03 : \"() >=' () = True'\"\nby auto\n\nML \"Header.record \\\"IUO03\\\"\"\n\ntheorem IUO04 : \"() >' () = False'\"\nby auto\n\nML \"Header.record \\\"IUO04\\\"\"\n\ntheorem IUO05 : \"() = ()\"\nby auto\n\nML \"Header.record \\\"IUO05\\\"\"\n\ntheorem IUO06 : \"() = ()\"\nby auto\n\nML \"Header.record \\\"IUO06\\\"\"\n\ntheorem IUO07 : \"compare () () = EQ\"\napply(simp add: LeEqDef)\ndone\n\nML \"Header.record \\\"IUO07\\\"\"\n\nend\n", "meta": {"author": "glaubersp", "repo": "HasCASL-Library_Source", "sha": "be605b06acfc124d8e88829cc931a1148ea30460", "save_path": "github-repos/isabelle/glaubersp-HasCASL-Library_Source", "path": "github-repos/isabelle/glaubersp-HasCASL-Library_Source/HasCASL-Library_Source-be605b06acfc124d8e88829cc931a1148ea30460/Prelude.old/Prelude_Ord.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3202041236470688}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      VcgEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer\nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\<open>Examples using the Verification Environment\\<close>\n\ntheory VcgEx imports \"../HeapList\" \"../Vcg\" begin\n\ntext \\<open>Some examples, especially the single-step Isar proofs are taken from\n\\texttt{HOL/Isar\\_examples/HoareEx.thy}.\n\\<close>\n\nsubsection \\<open>State Spaces\\<close>\n\ntext \\<open>\n First of all we provide a store of program variables that\n occur in the programs considered later.  Slightly unexpected\n things may happen when attempting to work with undeclared variables.\n\\<close>\n\nrecord 'g vars = \"'g state\" +\n  A_' :: nat\n  I_' :: nat\n  M_' :: nat\n  N_' :: nat\n  R_' :: nat\n  S_' :: nat\n  B_' :: bool\n  Arr_' :: \"nat list\"\n  Abr_':: string\n\n\n\ntext \\<open>We decorate the state components in the record with the suffix \\<open>_'\\<close>,\nto avoid cluttering the namespace with the simple names that could no longer\nbe used for logical variables otherwise.\n\\<close>\n\ntext \\<open>We will first consider programs without procedures, later on\nwe will regard procedures without global variables and finally we\nwill get the full pictures: mutually recursive procedures with global\nvariables (including heap).\n\\<close>\n\nsubsection \\<open>Basic Examples\\<close>\n\ntext \\<open>\n We look at few trivialities involving assignment and sequential\n composition, in order to get an idea of how to work with our\n formulation of Hoare Logic.\n\\<close>\n\ntext \\<open>\n Using the basic rule directly is a bit cumbersome.\n\\<close>\n\nlemma \"\\<Gamma>\\<turnstile> {|\\<acute>N = 5|} \\<acute>N :== 2 * \\<acute>N {|\\<acute>N = 10|}\"\n  apply (rule HoarePartial.Basic)  apply simp\n  done\n\ntext \\<open>\n If we refer to components (variables) of the state-space of the program\n we always mark these with \\<open>\\<acute>\\<close>. It is the acute-symbol and is present on\n most keyboards. So all program variables are marked with the acute and all\n logical variables are not.\n The assertions of the Hoare tuple are\n ordinary Isabelle sets. As we usually want to refer to the state space\n in the assertions, we provide special brackets for them. They can be written\n as {\\verb+{| |}+} in ASCII or \\<open>\\<lbrace> \\<rbrace>\\<close> with symbols. Internally\n marking variables has two effects. First of all we refer to the implicit\n state and secondary we get rid of the suffix \\<open>_'\\<close>.\n So the assertion @{term \"{|\\<acute>N = 5|}\"} internally gets expanded to\n \\<open>{s. N_' s = 5}\\<close> written in ordinary set comprehension notation of\n Isabelle. It describes the set of states where the \\<open>N_'\\<close> component\n is equal to \\<open>5\\<close>.\n\\<close>\n\n\ntext \\<open>\n Certainly we want the state modification already done, e.g.\\ by\n simplification.  The \\<open>vcg\\<close> method performs the basic state\n update for us; we may apply the Simplifier afterwards to achieve\n ``obvious'' consequences as well.\n\\<close>\n\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \\<acute>N :== 10 \\<lbrace>\\<acute>N = 10\\<rbrace>\"\n  by vcg\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>2 * \\<acute>N = 10\\<rbrace> \\<acute>N :== 2 * \\<acute>N \\<lbrace>\\<acute>N = 10\\<rbrace>\"\n  by vcg\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = 5\\<rbrace> \\<acute>N :== 2 * \\<acute>N \\<lbrace>\\<acute>N = 10\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N + 1 = a + 1\\<rbrace> \\<acute>N :== \\<acute>N + 1 \\<lbrace>\\<acute>N = a + 1\\<rbrace>\"\n  by vcg\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = a\\<rbrace> \\<acute>N :== \\<acute>N + 1 \\<lbrace>\\<acute>N = a + 1\\<rbrace>\"\n  by vcg\n\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>a = a \\<and> b = b\\<rbrace> \\<acute>M :== a;; \\<acute>N :== b \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\"\n  by vcg\n\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \\<acute>M :== a;; \\<acute>N :== b \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\"\n  by vcg\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\n                \\<acute>I :== \\<acute>M;; \\<acute>M :== \\<acute>N;; \\<acute>N :== \\<acute>I\n              \\<lbrace>\\<acute>M = b \\<and> \\<acute>N = a\\<rbrace>\"\n  by vcg\n\ntext \\<open>\nWe can also perform verification conditions generation step by step by using\nthe \\<open>vcg_step\\<close> method.\n\\<close>\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = a \\<and> \\<acute>N = b\\<rbrace>\n               \\<acute>I :== \\<acute>M;; \\<acute>M :== \\<acute>N;; \\<acute>N :== \\<acute>I\n              \\<lbrace>\\<acute>M = b \\<and> \\<acute>N = a\\<rbrace>\"\n  apply vcg_step\n  apply vcg_step\n  apply vcg_step\n  apply vcg_step\n  done\n\ntext \\<open>\n It is important to note that statements like the following one can\n only be proven for each individual program variable.  Due to the\n extra-logical nature of record fields, we cannot formulate a theorem\n relating record selectors and updates schematically.\n\\<close>\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = a\\<rbrace> \\<acute>N :== \\<acute>N \\<lbrace>\\<acute>N = a\\<rbrace>\"\n  by vcg\n\n\n(*\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>x = a\\<rbrace> \\<acute>x :== \\<acute>x \\<lbrace>\\<acute>x = a\\<rbrace>\"\n  apply (rule HoarePartial.Basic)\n  -- {* We can't proof this since we don't know what @{text \"x_'_update\"} is. *}\n  oops\n *)\nlemma \"\\<Gamma>\\<turnstile>{s. x_' s = a} (Basic (\\<lambda>s. x_'_update (x_' s) s)) {s. x_' s = a}\"\n  oops\n\n\ntext \\<open>\n In the following assignments we make use of the consequence rule in\n order to achieve the intended precondition.  Certainly, the\n \\<open>vcg\\<close> method is able to handle this case, too.\n\\<close>\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\nproof -\n  have \"\\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>M + 1 \\<noteq> \\<acute>N\\<rbrace>\"\n    by auto\n  also have \"\\<Gamma>\\<turnstile> \\<dots> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\n    by vcg\n  finally show ?thesis .\nqed\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\nproof -\n  have \"\\<And>m n::nat. m = n \\<longrightarrow> m + 1 \\<noteq> n\"\n      \\<comment> \\<open>inclusion of assertions expressed in ``pure'' logic,\\<close>\n      \\<comment> \\<open>without mentioning the state space\\<close>\n    by simp\n  also have \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M + 1 \\<noteq> \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\n    by vcg\n  finally show ?thesis .\nqed\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = \\<acute>N\\<rbrace> \\<acute>M :== \\<acute>M + 1 \\<lbrace>\\<acute>M \\<noteq> \\<acute>N\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\nsubsection \\<open>Multiplication by Addition\\<close>\n\ntext \\<open>\n We now do some basic examples of actual \\texttt{WHILE} programs.\n This one is a loop for calculating the product of two natural\n numbers, by iterated addition.  We first give detailed structured\n proof based on single-step Hoare rules.\n\\<close>\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n      WHILE \\<acute>M \\<noteq> a\n      DO \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 OD\n      \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\nproof -\n  let \"\\<Gamma>\\<turnstile> _ ?while _\" = ?thesis\n  let \"\\<lbrace>\\<acute>?inv\\<rbrace>\" = \"\\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\"\n\n  have \"\\<lbrace>\\<acute>M = 0 & \\<acute>S = 0\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>?inv\\<rbrace>\" by auto\n  also have \"\\<Gamma>\\<turnstile> \\<dots> ?while \\<lbrace>\\<acute>?inv \\<and> \\<not> (\\<acute>M \\<noteq> a)\\<rbrace>\"\n  proof\n    let ?c = \"\\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1\"\n    have \"\\<lbrace>\\<acute>?inv \\<and> \\<acute>M \\<noteq> a\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>S + b = (\\<acute>M + 1) * b\\<rbrace>\"\n      by auto\n    also have \"\\<Gamma>\\<turnstile> \\<dots> ?c \\<lbrace>\\<acute>?inv\\<rbrace>\" by vcg\n    finally show \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>?inv \\<and> \\<acute>M \\<noteq> a\\<rbrace> ?c \\<lbrace>\\<acute>?inv\\<rbrace>\" .\n  qed\n  also have \"\\<lbrace>\\<acute>?inv \\<and> \\<not> (\\<acute>M \\<noteq> a)\\<rbrace> \\<subseteq> \\<lbrace>\\<acute>S = a * b\\<rbrace>\" by auto\n  finally show ?thesis by blast\nqed\n\n\ntext \\<open>\n The subsequent version of the proof applies the \\<open>vcg\\<close> method\n to reduce the Hoare statement to a purely logical problem that can be\n solved fully automatically.  Note that we have to specify the\n \\texttt{WHILE} loop invariant in the original statement.\n\\<close>\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          WHILE \\<acute>M \\<noteq> a\n          INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n          DO \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 OD\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\n  apply vcg\n  apply auto\n  done\n\ntext \\<open>Here some examples of ``breaking'' out of a loop\\<close>\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          TRY\n            WHILE True\n            INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n            DO IF \\<acute>M = a THEN THROW ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1 FI OD\n          CATCH\n            SKIP\n          END\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          TRY\n            WHILE True\n            INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n            DO IF \\<acute>M = a THEN \\<acute>Abr :== ''Break'';;THROW\n               ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1\n               FI\n            OD\n          CATCH\n            IF \\<acute>Abr = ''Break'' THEN SKIP ELSE Throw FI\n          END\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\n\ntext \\<open>Some more syntactic sugar, the label statement \\<open>\\<dots> \\<bullet> \\<dots>\\<close> as shorthand\nfor the \\<open>TRY-CATCH\\<close> above, and the \\<open>RAISE\\<close> for an state-update followed\nby a \\<open>THROW\\<close>.\n\\<close>\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          \\<lbrace>\\<acute>Abr = ''Break''\\<rbrace>\\<bullet> WHILE True INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n           DO IF \\<acute>M = a THEN RAISE \\<acute>Abr :== ''Break''\n              ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1\n              FI\n           OD\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          TRY\n            WHILE True\n            INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n            DO IF \\<acute>M = a THEN RAISE \\<acute>Abr :== ''Break''\n               ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1\n               FI\n            OD\n          CATCH\n            IF \\<acute>Abr = ''Break'' THEN SKIP ELSE Throw FI\n          END\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>\n          \\<lbrace>\\<acute>Abr = ''Break''\\<rbrace> \\<bullet> WHILE True\n          INV \\<lbrace>\\<acute>S = \\<acute>M * b\\<rbrace>\n          DO IF \\<acute>M = a THEN RAISE \\<acute>Abr :== ''Break''\n               ELSE \\<acute>S :== \\<acute>S + b;; \\<acute>M :== \\<acute>M + 1\n               FI\n          OD\n          \\<lbrace>\\<acute>S = a * b\\<rbrace>\"\napply vcg\napply auto\ndone\n\ntext \\<open>Blocks\\<close>\n\nlemma  \"\\<Gamma>\\<turnstile>\\<lbrace>\\<acute>I = i\\<rbrace> LOC \\<acute>I;; \\<acute>I :== 2  COL \\<lbrace>\\<acute>I \\<le> i\\<rbrace>\"\n  apply vcg\n  by simp\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n\\<rbrace> LOC \\<acute>N :== 10;; \\<acute>N :== \\<acute>N + 2 COL \\<lbrace>\\<acute>N = n\\<rbrace>\"\n  by vcg\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n\\<rbrace> LOC \\<acute>N :== 10, \\<acute>M;; \\<acute>N :== \\<acute>N + 2 COL \\<lbrace>\\<acute>N = n\\<rbrace>\"\n  by vcg\n\n\nsubsection \\<open>Summing Natural Numbers\\<close>\n\ntext \\<open>\n We verify an imperative program to sum natural numbers up to a given\n limit.  First some functional definition for proper specification of\n the problem.\n\\<close>\n\nprimrec\n  sum :: \"(nat => nat) => nat => nat\"\nwhere\n  \"sum f 0 = 0\"\n| \"sum f (Suc n) = f n + sum f n\"\n\nsyntax\n  \"_sum\" :: \"idt => nat => nat => nat\"\n    (\"SUMM _<_. _\" [0, 0, 10] 10)\ntranslations\n  \"SUMM j<k. b\" == \"CONST sum (\\<lambda>j. b) k\"\n\ntext \\<open>\n The following proof is quite explicit in the individual steps taken,\n with the \\<open>vcg\\<close> method only applied locally to take care of\n assignment and sequential composition.  Note that we express\n intermediate proof obligation in pure logic, without referring to the\n state space.\n\\<close>\n\ntheorem \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n           \\<acute>S :== 0;; \\<acute>I :== 1;;\n           WHILE \\<acute>I \\<noteq> n\n           DO\n             \\<acute>S :== \\<acute>S + \\<acute>I;;\n             \\<acute>I :== \\<acute>I + 1\n           OD\n           \\<lbrace>\\<acute>S = (SUMM j<n. j)\\<rbrace>\"\n  (is \"\\<Gamma>\\<turnstile> _ (_;; ?while) _\")\nproof -\n  let ?sum = \"\\<lambda>k. SUMM j<k. j\"\n  let ?inv = \"\\<lambda>s i. s = ?sum i\"\n\n  have \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace> \\<acute>S :== 0;; \\<acute>I :== 1 \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\"\n  proof -\n    have \"True \\<longrightarrow> 0 = ?sum 1\"\n      by simp\n    also have \"\\<Gamma>\\<turnstile> \\<lbrace>\\<dots>\\<rbrace> \\<acute>S :== 0;; \\<acute>I :== 1 \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\"\n      by vcg\n    finally show ?thesis .\n  qed\n  also have \"\\<Gamma>\\<turnstile> \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace> ?while \\<lbrace>?inv \\<acute>S \\<acute>I \\<and> \\<not> \\<acute>I \\<noteq> n\\<rbrace>\"\n  proof\n    let ?body = \"\\<acute>S :== \\<acute>S + \\<acute>I;; \\<acute>I :== \\<acute>I + 1\"\n    have \"\\<And>s i. ?inv s i \\<and> i \\<noteq> n \\<longrightarrow>  ?inv (s + i) (i + 1)\"\n      by simp\n    also have \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>S + \\<acute>I = ?sum (\\<acute>I + 1)\\<rbrace> ?body \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\"\n      by vcg\n    finally show \"\\<Gamma>\\<turnstile> \\<lbrace>?inv \\<acute>S \\<acute>I \\<and> \\<acute>I \\<noteq> n\\<rbrace> ?body \\<lbrace>?inv \\<acute>S \\<acute>I\\<rbrace>\" .\n  qed\n  also have \"\\<And>s i. s = ?sum i \\<and> \\<not> i \\<noteq> n \\<longrightarrow> s = ?sum n\"\n    by simp\n  finally show ?thesis .\nqed\n\ntext \\<open>\n The next version uses the \\<open>vcg\\<close> method, while still explaining\n the resulting proof obligations in an abstract, structured manner.\n\\<close>\n\ntheorem \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n           \\<acute>S :== 0;; \\<acute>I :== 1;;\n           WHILE \\<acute>I \\<noteq> n\n           INV \\<lbrace>\\<acute>S = (SUMM j<\\<acute>I. j)\\<rbrace>\n           DO\n             \\<acute>S :== \\<acute>S + \\<acute>I;;\n             \\<acute>I :== \\<acute>I + 1\n           OD\n          \\<lbrace>\\<acute>S = (SUMM j<n. j)\\<rbrace>\"\nproof -\n  let ?sum = \"\\<lambda>k. SUMM j<k. j\"\n  let ?inv = \"\\<lambda>s i. s = ?sum i\"\n\n  show ?thesis\n  proof vcg\n    show \"?inv 0 1\" by simp\n  next\n    fix i s assume \"?inv s i\" \"i \\<noteq> n\"\n    thus \"?inv (s + i) (i + 1)\" by simp\n  next\n    fix i s assume x: \"?inv s i\" \"\\<not> i \\<noteq> n\"\n    thus \"s = ?sum n\" by simp\n  qed\nqed\n\ntext \\<open>\n Certainly, this proof may be done fully automatically as well, provided\n that the invariant is given beforehand.\n\\<close>\n\ntheorem \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n           \\<acute>S :== 0;; \\<acute>I :== 1;;\n           WHILE \\<acute>I \\<noteq> n\n           INV \\<lbrace>\\<acute>S = (SUMM j<\\<acute>I. j)\\<rbrace>\n           DO\n             \\<acute>S :== \\<acute>S + \\<acute>I;;\n             \\<acute>I :== \\<acute>I + 1\n           OD\n           \\<lbrace>\\<acute>S = (SUMM j<n. j)\\<rbrace>\"\n  apply vcg\n  apply auto\n  done\n\nsubsection \\<open>SWITCH\\<close>\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = 5\\<rbrace> SWITCH \\<acute>B\n                        {True} \\<Rightarrow> \\<acute>N :== 6\n                      | {False} \\<Rightarrow> \\<acute>N :== 7\n                     END\n          \\<lbrace>\\<acute>N > 5\\<rbrace>\"\napply vcg\napply simp\ndone\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = 5\\<rbrace> SWITCH \\<acute>N\n                        {v. v < 5} \\<Rightarrow> \\<acute>N :== 6\n                      | {v. v \\<ge> 5} \\<Rightarrow> \\<acute>N :== 7\n                     END\n          \\<lbrace>\\<acute>N > 5\\<rbrace>\"\napply vcg\napply simp\ndone\n\nsubsection \\<open>(Mutually) Recursive Procedures\\<close>\n\nsubsubsection \\<open>Factorial\\<close>\n\ntext \\<open>We want to define a procedure for the factorial. We first\ndefine a HOL functions that calculates it to specify the procedure later on.\n\\<close>\n\nprimrec fac:: \"nat \\<Rightarrow> nat\"\nwhere\n\"fac 0 = 1\" |\n\"fac (Suc n) = (Suc n) * fac n\"\n\nlemma fac_simp [simp]: \"0 < i \\<Longrightarrow>  fac i = i * fac (i - 1)\"\n  by (cases i) simp_all\n\ntext \\<open>Now we define the procedure\\<close>\n\nprocedures\n  Fac (N|R) = \"IF \\<acute>N = 0 THEN \\<acute>R :== 1\n                       ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);;\n                            \\<acute>R :== \\<acute>N * \\<acute>R\n                       FI\"\n\n\n\ntext \\<open>A procedure is given by the signature of the procedure\nfollowed by the procedure body.\nThe signature consists of the name of the procedure and a list of\nparameters. The parameters in front of the pipe \\<open>|\\<close> are value parameters\nand behind the pipe are the result parameters. Value parameters model call by value\nsemantics. The value of a result parameter at the end of the procedure is passed back\nto the caller.\n\\<close>\n\n\n\ntext \\<open>\nBehind the scenes the \\<open>procedures\\<close> command provides us convenient syntax\nfor procedure calls, defines a constant for the procedure body\n(named @{term \"Fac_body\"}) and creates some locales. The purpose of locales\nis to set up logical contexts to support modular reasoning.\nA locale is named \\<open>Fac_impl\\<close> and extends the \\<open>hoare\\<close> locale\nwith a theorem @{term \"\\<Gamma> ''Fac'' = Fac_body\"} that simply states how the\nprocedure is defined in the procedure context. Check out the locales.\nThe purpose of the locales is to give us easy means to setup the context\nin which we will prove programs correct.\nIn these locales the procedure context @{term \"\\<Gamma>\"} is fixed.\nSo always use this letter in procedure\nspecifications. This is crucial, if we later on prove some tuples under the\nassumption of some procedure specifications.\n\\<close>\n\nthm Fac_body.Fac_body_def\nprint_locale Fac_impl\n\ntext \\<open>\nTo see how a call is syntactically translated you can switch off the\nprinting translation via the configuration option \\<open>hoare_use_call_tr'\\<close>\n\\<close>\n\ncontext Fac_impl\nbegin\ntext \\<open>\n@{term \"CALL Fac(\\<acute>N,\\<acute>M)\"} is internally:\n\\<close>\ndeclare [[hoare_use_call_tr' = false]]\ntext \\<open>\n@{term \"CALL Fac(\\<acute>N,\\<acute>M)\"}\n\\<close>\nterm \"CALL Fac(\\<acute>N,\\<acute>M)\"\ndeclare [[hoare_use_call_tr' = true]]\nend\n\ntext \\<open>\nNow let us prove that @{term \"Fac\"} meets its specification.\n\\<close>\n\ntext \\<open>\nProcedure specifications are ordinary Hoare tuples. We use the parameterless\ncall for the specification; \\<open>\\<acute>R :== PROC Fac(\\<acute>N)\\<close> is syntactic sugar\nfor \\<open>Call ''Fac''\\<close>. This emphasises that the specification\ndescribes the internal behaviour of the procedure, whereas parameter passing\ncorresponds to the procedure call.\n\\<close>\n\n\nlemma (in Fac_impl)\n  shows \"\\<forall>n. \\<Gamma>,\\<Theta>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace>  PROC Fac(\\<acute>N,\\<acute>R) \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply vcg\n  apply simp\n  done\n\n\ntext \\<open>\nSince the factorial was implemented recursively,\nthe main ingredient of this proof is, to assume that the specification holds for\nthe recursive call of @{term Fac} and prove the body correct.\nThe assumption for recursive calls is added to the context by\nthe rule @{thm [source] HoarePartial.ProcRec1}\n(also derived from general rule for mutually recursive procedures):\n@{thm [display] HoarePartial.ProcRec1 [no_vars]}\nThe verification condition generator will infer the specification out of the\ncontext when it encounters a recursive call of the factorial.\n\\<close>\n\ntext \\<open>We can also step through verification condition generation. When\nthe verification condition generator encounters a procedure call it tries to\nuse the rule \\<open>ProcSpec\\<close>. To be successful there must be a specification\nof the procedure in the context.\n\\<close>\n\nlemma (in Fac_impl)\n  shows \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply vcg_step\n  apply   vcg_step\n  apply  vcg_step\n  apply vcg_step\n  apply vcg_step\n  apply simp\n  done\n\n\ntext \\<open>Here some Isar style version of the proof\\<close>\nlemma (in Fac_impl)\n  shows \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\nproof (hoare_rule HoarePartial.ProcRec1)\n  have Fac_spec: \"\\<forall>n. \\<Gamma>,(\\<Union>n. {(\\<lbrace>\\<acute>N=n\\<rbrace>, Fac_'proc, \\<lbrace>\\<acute>R = fac n\\<rbrace>,{})})\n                       \\<turnstile> \\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\n    apply (rule allI)\n    apply (rule hoarep.Asm)\n    by auto\n  show \"\\<forall>n. \\<Gamma>,(\\<Union>n. {(\\<lbrace>\\<acute>N=n\\<rbrace>, Fac_'proc, \\<lbrace>\\<acute>R = fac n\\<rbrace>,{})})\n            \\<turnstile> \\<lbrace>\\<acute>N=n\\<rbrace> IF \\<acute>N = 0 THEN \\<acute>R :== 1\n            ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);; \\<acute>R :== \\<acute>N * \\<acute>R FI \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\n    apply vcg\n    apply simp\n    done\nqed\n\ntext \\<open>To avoid retyping of potentially large pre and postconditions in\nthe previous proof we can use the casual term abbreviations of the Isar\nlanguage.\n\\<close>\n\nlemma (in Fac_impl)\n  shows \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\n  (is \"\\<forall>n. \\<Gamma>\\<turnstile>(?Pre n) ?Fac (?Post n)\")\nproof (hoare_rule HoarePartial.ProcRec1)\n  have Fac_spec: \"\\<forall>n. \\<Gamma>,(\\<Union>n. {(?Pre n, Fac_'proc, ?Post n,{})})\n                       \\<turnstile>(?Pre n) ?Fac (?Post n)\"\n    apply (rule allI)\n    apply (rule hoarep.Asm)\n    by auto\n  show \"\\<forall>n. \\<Gamma>,(\\<Union>n. {(?Pre n, Fac_'proc, ?Post n,{})})\n            \\<turnstile> (?Pre n) IF \\<acute>N = 0 THEN \\<acute>R :== 1\n            ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);; \\<acute>R :== \\<acute>N * \\<acute>R FI (?Post n)\"\n    apply vcg\n    apply simp\n    done\nqed\n\ntext \\<open>The previous proof pattern has still some kind of inconvenience.\nThe augmented context is always printed in the proof state. That can\nmess up the state, especially if we have large specifications. This may\nbe annoying if we want to develop single step or structured proofs. In this\ncase it can be a good idea to introduce a new variable for the augmented\ncontext.\n\\<close>\n\nlemma (in Fac_impl) Fac_spec:\n  shows \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>R :== PROC Fac(\\<acute>N) \\<lbrace>\\<acute>R = fac n\\<rbrace>\"\n  (is \"\\<forall>n. \\<Gamma>\\<turnstile>(?Pre n) ?Fac (?Post n)\")\nproof (hoare_rule HoarePartial.ProcRec1)\n  define \\<Theta>' where \"\\<Theta>' = (\\<Union>n. {(?Pre n, Fac_'proc, ?Post n,{}::('a, 'b) vars_scheme set)})\"\n  have Fac_spec: \"\\<forall>n. \\<Gamma>,\\<Theta>'\\<turnstile>(?Pre n) ?Fac (?Post n)\"\n    by (unfold \\<Theta>'_def, rule allI, rule hoarep.Asm) auto\n  txt \\<open>We have to name the fact \\<open>Fac_spec\\<close>, so that the vcg can\n   use the specification for the recursive call, since it cannot infer it\n   from the opaque @{term \"\\<Theta>'\"}.\\<close>\n  show \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>'\\<turnstile> (?Pre \\<sigma>) IF \\<acute>N = 0 THEN \\<acute>R :== 1\n            ELSE \\<acute>R :== CALL Fac(\\<acute>N - 1);; \\<acute>R :== \\<acute>N * \\<acute>R FI (?Post \\<sigma>)\"\n    apply vcg\n    apply simp\n    done\nqed\n\ntext \\<open>There are different rules available to prove procedure calls,\ndepending on the kind of postcondition and whether or not the\nprocedure is recursive or even mutually recursive.\nSee for example @{thm [source] HoarePartial.ProcRec1},\n@{thm [source] HoarePartial.ProcNoRec1}.\nThey are all derived from the most general rule\n@{thm [source] HoarePartial.ProcRec}.\nAll of them have some side-condition concerning definedness of the procedure.\nThey can be\nsolved in a uniform fashion. Thats why we have created the method\n\\<open>hoare_rule\\<close>, which behaves like the method \\<open>rule\\<close> but automatically\ntries to solve the side-conditions.\n\\<close>\n\nsubsubsection \\<open>Odd and Even\\<close>\n\ntext \\<open>Odd and even are defined mutually recursive here. In the\n\\<open>procedures\\<close> command we conjoin both definitions with \\<open>and\\<close>.\n\\<close>\n\nprocedures\n odd(N | A) = \"IF \\<acute>N=0 THEN \\<acute>A:==0\n                     ELSE IF \\<acute>N=1 THEN CALL even (\\<acute>N - 1,\\<acute>A)\n                          ELSE CALL odd (\\<acute>N - 2,\\<acute>A)\n                          FI\n                     FI\"\n\n\nand\n  even(N | A) = \"IF \\<acute>N=0 THEN \\<acute>A:==1\n                        ELSE IF \\<acute>N=1 THEN CALL odd (\\<acute>N - 1,\\<acute>A)\n                             ELSE CALL even (\\<acute>N - 2,\\<acute>A)\n                             FI\n                        FI\"\n\nprint_theorems\nthm odd_body.odd_body_def\nthm even_body.even_body_def\nprint_locale odd_even_clique\n\n\ntext \\<open>To prove the procedure calls to @{term \"odd\"} respectively\n@{term \"even\"} correct we first derive a rule to justify that we\ncan assume both specifications to verify the bodies. This rule can\nbe derived from the general @{thm [source] HoarePartial.ProcRec} rule. An ML function does\nthis work:\n\\<close>\n\nML \\<open>ML_Thms.bind_thm (\"ProcRec2\", Hoare.gen_proc_rec @{context} Hoare.Partial 2)\\<close>\n\n\nlemma (in odd_even_clique)\n  shows odd_spec: \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>A :== PROC odd(\\<acute>N)\n                  \\<lbrace>(\\<exists>b. n = 2 * b + \\<acute>A) \\<and> \\<acute>A < 2 \\<rbrace>\" (is ?P1)\n   and even_spec: \"\\<forall>n. \\<Gamma>\\<turnstile>\\<lbrace>\\<acute>N=n\\<rbrace> \\<acute>A :== PROC even(\\<acute>N)\n                  \\<lbrace>(\\<exists>b. n + 1 = 2 * b + \\<acute>A) \\<and> \\<acute>A < 2 \\<rbrace>\" (is ?P2)\nproof -\n  have \"?P1 \\<and> ?P2\"\n    apply (hoare_rule ProcRec2)\n    apply  vcg\n    apply  clarsimp\n    apply  (rule_tac x=\"b + 1\" in exI)\n    apply  arith\n    apply vcg\n    apply clarsimp\n    apply arith\n    done\n  thus \"?P1\" \"?P2\"\n    by iprover+\nqed\n\nsubsection \\<open>Expressions With Side Effects\\<close>\n\n\ntext \\<open>\\texttt{R := N++ + M++}\\<close>\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n  \\<acute>N \\<ggreater> n. \\<acute>N :== \\<acute>N + 1 \\<ggreater>\n  \\<acute>M \\<ggreater> m. \\<acute>M :== \\<acute>M + 1 \\<ggreater>\n  \\<acute>R :== n + m\n  \\<lbrace>\\<acute>R = \\<acute>N + \\<acute>M - 2\\<rbrace>\"\napply vcg\napply simp\ndone\n\ntext \\<open>\\texttt{R := Fac (N) + Fac (M)}\\<close>\nlemma (in Fac_impl) shows\n  \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n  CALL Fac(\\<acute>N) \\<ggreater> n. CALL Fac(\\<acute>M) \\<ggreater> m.\n  \\<acute>R :== n + m\n  \\<lbrace>\\<acute>R = fac \\<acute>N + fac \\<acute>M\\<rbrace>\"\napply vcg\ndone\n\n\ntext \\<open>\\texttt{ R := (Fac(Fac (N)))}\\<close>\nlemma (in Fac_impl) shows\n  \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>\n  CALL Fac(\\<acute>N) \\<ggreater> n. CALL Fac(n) \\<ggreater> m.\n  \\<acute>R :== m\n  \\<lbrace>\\<acute>R = fac (fac \\<acute>N)\\<rbrace>\"\napply vcg\ndone\n\n\nsubsection \\<open>Global Variables and Heap\\<close>\n\n\ntext \\<open>\nNow we define and verify some procedures on heap-lists. We consider\nlist structures consisting of two fields, a content element @{term \"cont\"} and\na reference to the next list element @{term \"next\"}. We model this by the\nfollowing state space where every field has its own heap.\n\\<close>\n\nrecord globals_list =\n  next_' :: \"ref \\<Rightarrow> ref\"\n  cont_' :: \"ref \\<Rightarrow> nat\"\n\nrecord 'g list_vars = \"'g state\" +\n  p_'    :: \"ref\"\n  q_'    :: \"ref\"\n  r_'    :: \"ref\"\n  root_' :: \"ref\"\n  tmp_'  :: \"ref\"\n\ntext \\<open>Updates to global components inside a procedure will\nalways be propagated to the caller. This is implicitly done by the\nparameter passing syntax translations. The record containing the global variables must begin with the prefix \"globals\".\n\\<close>\n\ntext \\<open>We first define an append function on lists. It takes two\nreferences as parameters. It appends the list referred to by the first\nparameter with the list referred to by the second parameter, and returns\nthe result right into the first parameter.\n\\<close>\n\nprocedures\n  append(p,q|p) =\n    \"IF \\<acute>p=Null THEN \\<acute>p :== \\<acute>q ELSE \\<acute>p \\<rightarrow>\\<acute>next:== CALL append(\\<acute>p\\<rightarrow>\\<acute>next,\\<acute>q) FI\"\n\n(*\n  append_spec:\n   \"\\<forall>\\<sigma> Ps Qs.\n     \\<Gamma>\\<turnstile> \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<and>  List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {}\\<rbrace>\n           \\<acute>p :== PROC append(\\<acute>p,\\<acute>q)\n         \\<lbrace>List \\<acute>p \\<acute>next (Ps@Qs) \\<and> (\\<forall>x. x\\<notin>set Ps \\<longrightarrow> \\<acute>next x = \\<^bsup>\\<sigma>\\<^esup>next x)\\<rbrace>\"\n\n  append_modifies:\n   \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC append(\\<acute>p,\\<acute>q){t. t may_only_modify_globals \\<sigma> in [next]}\"\n*)\n\ncontext append_impl\nbegin\ndeclare [[hoare_use_call_tr' = false]]\nterm \"CALL append(\\<acute>p,\\<acute>q,\\<acute>p\\<rightarrow>\\<acute>next)\"\ndeclare [[hoare_use_call_tr' = true]]\nend\ntext \\<open>Below we give two specifications this time.\nOne captures the functional behaviour and focuses on the\nentities that are potentially modified by the procedure, the other one\nis a pure frame condition.\nThe list in the modifies clause has to list all global state components that\nmay be changed by the procedure. Note that we know from the modifies clause\nthat the @{term cont} parts of the lists will not be changed. Also a small\nside note on the syntax. We use ordinary brackets in the postcondition\nof the modifies clause, and also the state components do not carry the\nacute, because we explicitly note the state @{term t} here.\n\nThe functional specification now introduces two logical variables besides the\nstate space variable @{term \"\\<sigma>\"}, namely @{term \"Ps\"} and @{term \"Qs\"}.\nThey are universally quantified and range over both the pre and the postcondition, so\nthat we are able to properly instantiate the specification\nduring the proofs. The syntax \\<open>\\<lbrace>\\<sigma>. \\<dots>\\<rbrace>\\<close> is a shorthand to fix the current\nstate: \\<open>{s. \\<sigma> = s \\<dots>}\\<close>.\n\\<close>\n\nlemma (in append_impl) append_spec:\n  shows \"\\<forall>\\<sigma> Ps Qs. \\<Gamma>\\<turnstile>\n            \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<and>  List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {}\\<rbrace>\n                \\<acute>p :== PROC append(\\<acute>p,\\<acute>q)\n            \\<lbrace>List \\<acute>p \\<acute>next (Ps@Qs) \\<and> (\\<forall>x. x\\<notin>set Ps \\<longrightarrow> \\<acute>next x = \\<^bsup>\\<sigma>\\<^esup>next x)\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply vcg\n  apply fastforce\n  done\n\n\ntext \\<open>The modifies clause is equal to a proper record update specification\nof the following form.\n\\<close>\n\n\nlemma \"{t. t may_only_modify_globals Z in [next]}\n       =\n       {t. \\<exists>next. globals t=next_'_update (\\<lambda>_. next) (globals Z)}\"\n  apply (unfold mex_def meq_def)\n  apply (simp)\n  done\n\ntext \\<open>If the verification condition generator works on a procedure call\nit checks whether it can find a modified clause in the context. If one\nis present the procedure call is simplified before the Hoare rule\n@{thm [source] HoarePartial.ProcSpec} is applied. Simplification of the procedure call means,\nthat the ``copy back'' of the global components is simplified. Only those\ncomponents that occur in the modifies clause will actually be copied back.\nThis simplification is justified by the rule @{thm [source] HoarePartial.ProcModifyReturn}.\nSo after this simplification all global components that do not appear in\nthe modifies clause will be treated as local variables.\n\\<close>\n\ntext \\<open>You can study the effect of the modifies clause on the following two\nexamples, where we want to prove that @{term \"append\"} does not change\nthe @{term \"cont\"} part of the heap.\n\\<close>\n\nlemma (in append_impl)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>p=Null \\<and> \\<acute>cont=c\\<rbrace> \\<acute>p :== CALL append(\\<acute>p,Null) \\<lbrace>\\<acute>cont=c\\<rbrace>\"\n  apply vcg\n  oops\n\ntext \\<open>To prove the frame condition,\nwe have to tell the verification condition generator to use only the\nmodifies clauses and not to search for functional specifications by\nthe parameter \\<open>spec=modifies\\<close> It will also try to solve the\nverification conditions automatically.\n\\<close>\n\nlemma (in append_impl) append_modifies:\n  shows\n   \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC append(\\<acute>p,\\<acute>q){t. t may_only_modify_globals \\<sigma> in [next]}\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply (vcg spec=modifies)\n  done\n\n\nlemma (in append_impl)\n  shows \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>p=Null \\<and> \\<acute>cont=c\\<rbrace> \\<acute>p\\<rightarrow>\\<acute>next :== CALL append(\\<acute>p,Null) \\<lbrace>\\<acute>cont=c\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\ntext \\<open>\nOf course we could add the modifies clause to the functional specification as\nwell. But separating both has the advantage that we split up the verification\nwork. We can make use of the modifies clause before we apply the\nfunctional specification in a fully automatic fashion.\n\\<close>\n\n\ntext \\<open>To verify the body of @{term \"append\"} we do not need the modifies\nclause, since the specification does not talk about @{term \"cont\"} at all, and\nwe don't access @{term \"cont\"} inside the body. This may be different for\nmore complex procedures.\n\\<close>\n\ntext \\<open>\nTo prove that a procedure respects the modifies clause, we only need\nthe modifies clauses of the procedures called in the body. We do not need\nthe functional specifications. So we can always prove the modifies\nclause without functional specifications, but me may need the modifies\nclause to prove the functional specifications.\n\\<close>\n\n\n\n\n\n\n\n\nsubsubsection \\<open>Insertion Sort\\<close>\n\nprimrec sorted:: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a list  \\<Rightarrow> bool\"\nwhere\n\"sorted le [] = True\" |\n\"sorted le (x#xs) = ((\\<forall>y\\<in>set xs. le x y) \\<and> sorted le xs)\"\n\n\n\nprocedures\n  insert(r,p | p) =\n    \"IF \\<acute>r=Null THEN SKIP\n     ELSE IF \\<acute>p=Null THEN \\<acute>p :== \\<acute>r;; \\<acute>p\\<rightarrow>\\<acute>next :== Null\n          ELSE IF \\<acute>r\\<rightarrow>\\<acute>cont \\<le> \\<acute>p\\<rightarrow>\\<acute>cont\n               THEN \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>p;; \\<acute>p:==\\<acute>r\n               ELSE \\<acute>p\\<rightarrow>\\<acute>next :== CALL insert(\\<acute>r,\\<acute>p\\<rightarrow>\\<acute>next)\n               FI\n          FI\n     FI\"\n\n\ntext \\<open>\nIn the postcondition of the functional specification there is a small but\nimportant subtlety. Whenever we talk about the @{term \"cont\"} part we refer to\nthe one of the pre-state, even in the conclusion of the implication.\nThe reason is, that we have separated out, that @{term \"cont\"} is not modified\nby the procedure, to the modifies clause. So whenever we talk about unmodified\nparts in the postcondition we have to use the pre-state part, or explicitly\nstate an equality in the postcondition.\nThe reason is simple. If the postcondition would talk about \\<open>\\<acute>cont\\<close>\ninstead of \\<open>\\<^bsup>\\<sigma>\\<^esup>cont\\<close>, we get a new instance of \\<open>cont\\<close> during\nverification and the postcondition would only state something about this\nnew instance. But as the verification condition generator uses the\nmodifies clause the caller of \\<open>insert\\<close> instead still has the\nold \\<open>cont\\<close> after the call. Thats the very reason for the modifies clause.\nSo the caller and the specification will simply talk about two different things,\nwithout being able to relate them (unless an explicit equality is added to\nthe specification).\n\\<close>\n\nlemma (in insert_impl) insert_modifies:\n  \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC insert(\\<acute>r,\\<acute>p){t. t may_only_modify_globals \\<sigma> in [next]}\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\n\nlemma (in insert_impl) insert_spec:\n    \"\\<forall>\\<sigma> Ps . \\<Gamma>\\<turnstile> \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<and> sorted (\\<le>) (map \\<acute>cont Ps) \\<and>\n                  \\<acute>r \\<noteq> Null \\<and> \\<acute>r \\<notin> set Ps\\<rbrace>\n         \\<acute>p :== PROC insert(\\<acute>r,\\<acute>p)\n   \\<lbrace>\\<exists>Qs. List \\<acute>p \\<acute>next Qs \\<and> sorted (\\<le>) (map \\<^bsup>\\<sigma>\\<^esup>cont  Qs) \\<and>\n           set Qs = insert \\<^bsup>\\<sigma>\\<^esup>r (set Ps) \\<and>\n           (\\<forall>x. x \\<notin> set Qs \\<longrightarrow> \\<acute>next x = \\<^bsup>\\<sigma>\\<^esup>next x)\\<rbrace>\"\n\napply (hoare_rule HoarePartial.ProcRec1)\napply vcg\napply (intro conjI impI)\napply    fastforce\napply   fastforce\napply  fastforce\napply (clarsimp)\napply force\ndone\n\nprocedures\n  insertSort(p | p) =\n    \"\\<acute>r:==Null;;\n     WHILE (\\<acute>p \\<noteq> Null) DO\n       \\<acute>q :== \\<acute>p;;\n       \\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;;\n       \\<acute>r :== CALL insert(\\<acute>q,\\<acute>r)\n     OD;;\n     \\<acute>p:==\\<acute>r\"\n\n\n\n\nlemma (in insertSort_impl) insertSort_modifies:\n  shows\n   \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>p :== PROC insertSort(\\<acute>p)\n              {t. t may_only_modify_globals \\<sigma> in [next]}\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\n\ntext \\<open>Insertion sort is not implemented recursively here but with a while\nloop. Note that the while loop is not annotated with an invariant in the\nprocedure definition. The invariant only comes into play during verification.\nTherefore we will annotate the body during the proof with the\nrule @{thm [source] HoarePartial.annotateI}.\n\\<close>\n\n\nlemma (in insertSort_impl) insertSort_body_spec:\n  shows \"\\<forall>\\<sigma> Ps. \\<Gamma>,\\<Theta>\\<turnstile> \\<lbrace>\\<sigma>. List \\<acute>p \\<acute>next Ps \\<rbrace>\n              \\<acute>p :== PROC insertSort(\\<acute>p)\n          \\<lbrace>\\<exists>Qs. List \\<acute>p \\<acute>next Qs \\<and> sorted (\\<le>) (map \\<^bsup>\\<sigma>\\<^esup>cont Qs) \\<and>\n           set Qs = set Ps\\<rbrace>\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply (hoare_rule anno=\n         \"\\<acute>r :== Null;;\n         WHILE \\<acute>p \\<noteq> Null\n         INV \\<lbrace>\\<exists>Qs Rs. List \\<acute>p \\<acute>next Qs \\<and> List \\<acute>r \\<acute>next Rs \\<and>\n                  set Qs \\<inter> set Rs = {} \\<and>\n                  sorted (\\<le>) (map \\<acute>cont Rs) \\<and> set Qs \\<union> set Rs = set Ps \\<and>\n                  \\<acute>cont = \\<^bsup>\\<sigma>\\<^esup>cont \\<rbrace>\n          DO \\<acute>q :== \\<acute>p;; \\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;; \\<acute>r :== CALL insert(\\<acute>q,\\<acute>r) OD;;\n          \\<acute>p :== \\<acute>r\" in HoarePartial.annotateI)\n  apply vcg\n  apply   fastforce\n  prefer 2\n  apply  fastforce\n  apply (clarsimp)\n  apply (rule_tac x=ps in exI)\n  apply (intro conjI)\n  apply    (rule heap_eq_ListI1)\n  apply     assumption\n  apply    clarsimp\n  apply    (subgoal_tac \"x\\<noteq>p \\<and> x \\<notin> set Rs\")\n  apply     auto\n  done\n\nsubsubsection \"Memory Allocation and Deallocation\"\n\ntext \\<open>The basic idea of memory management is to keep a list of allocated\nreferences in the state space. Allocation of a new reference adds a\nnew reference to the list deallocation removes a reference. Moreover\nwe keep a counter \"free\" for the free memory.\n\\<close>\n\nrecord globals_list_alloc = globals_list +\n  alloc_'::\"ref list\"\n  free_'::nat\n\nrecord 'g list_vars' = \"'g list_vars\" +\n  i_'::nat\n  first_'::ref\n\n\ndefinition \"sz = (2::nat)\"\n\ntext \\<open>Restrict locale \\<open>hoare\\<close> to the required type.\\<close>\n\nlocale hoare_ex =\n  hoare \\<Gamma> for \\<Gamma> :: \"'c \\<rightharpoonup> (('a globals_list_alloc_scheme, 'b) list_vars'_scheme, 'c, 'd) com\"\n\nlemma (in hoare_ex)\n  \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>i = 0 \\<and> \\<acute>first = Null \\<and> n*sz \\<le> \\<acute>free\\<rbrace>\n       WHILE \\<acute>i < n\n       INV \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next Ps \\<and> length Ps = \\<acute>i \\<and> \\<acute>i \\<le> n \\<and>\n             set Ps \\<subseteq> set \\<acute>alloc \\<and> (n - \\<acute>i)*sz \\<le> \\<acute>free\\<rbrace>\n       DO\n         \\<acute>p :== NEW sz [\\<acute>cont:==0,\\<acute>next:== Null];;\n         \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>first;;\n         \\<acute>first :== \\<acute>p;;\n         \\<acute>i :== \\<acute>i+ 1\n       OD\n       \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next  Ps \\<and> length Ps = n \\<and> set Ps \\<subseteq> set \\<acute>alloc\\<rbrace>\"\n\napply (vcg)\napply   simp\napply  clarsimp\napply  (rule conjI)\napply   clarsimp\napply   (rule_tac x=\"new (set alloc)#Ps\" in exI)\napply   clarsimp\napply   (rule conjI)\napply    fastforce\napply   (simp add: sz_def)\napply  (simp add: sz_def)\napply fastforce\ndone\n\n\nlemma (in hoare_ex)\n  \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>i = 0 \\<and> \\<acute>first = Null \\<and> n*sz \\<le> \\<acute>free\\<rbrace>\n       WHILE \\<acute>i < n\n       INV \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next Ps \\<and> length Ps = \\<acute>i \\<and> \\<acute>i \\<le> n \\<and>\n             set Ps \\<subseteq> set \\<acute>alloc \\<and> (n - \\<acute>i)*sz \\<le> \\<acute>free\\<rbrace>\n       DO\n         \\<acute>p :== NNEW sz [\\<acute>cont:==0,\\<acute>next:== Null];;\n         \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>first;;\n         \\<acute>first :== \\<acute>p;;\n         \\<acute>i :== \\<acute>i+ 1\n       OD\n       \\<lbrace>\\<exists>Ps. List \\<acute>first \\<acute>next  Ps \\<and> length Ps = n \\<and> set Ps \\<subseteq> set \\<acute>alloc\\<rbrace>\"\n\napply (vcg)\napply   simp\napply  clarsimp\napply  (rule conjI)\napply   clarsimp\napply   (rule_tac x=\"new (set alloc)#Ps\" in exI)\napply   clarsimp\napply   (rule conjI)\napply    fastforce\napply   (simp add: sz_def)\napply  (simp add: sz_def)\napply fastforce\ndone\n\nsubsection \\<open>Fault Avoiding Semantics\\<close>\n\ntext \\<open>\nIf we want to ensure that no runtime errors occur we can insert guards into\nthe code. We will not be able to prove any nontrivial Hoare triple\nabout code with guards, if we cannot show that the guards will never fail.\nA trivial hoare triple is one with an empty precondition.\n\\<close>\n\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>True\\<rbrace>  \\<lbrace>\\<acute>p\\<noteq>Null\\<rbrace>\\<longmapsto> \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>p \\<lbrace>True\\<rbrace>\"\napply vcg\noops\n\nlemma \"\\<Gamma>\\<turnstile> {}  \\<lbrace>\\<acute>p\\<noteq>Null\\<rbrace>\\<longmapsto> \\<acute>p\\<rightarrow>\\<acute>next :== \\<acute>p \\<lbrace>True\\<rbrace>\"\napply vcg\ndone\n\ntext \\<open>Let us consider this small program that reverts a list. At\nfirst without guards.\n\\<close>\nlemma (in hoare_ex) rev_strip:\n  \"\\<Gamma>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and>\n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;;\n     \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;;\n     \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;;\n     \\<acute>q :== \\<acute>r OD\n  \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps\\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\napply (vcg)\napply fastforce+\ndone\n\ntext \\<open>If we want to ensure that we do not dereference @{term \"Null\"} or\naccess unallocated memory, we have to add some guards.\n\\<close>\n\nlocale hoare_ex_guard =\n  hoare \\<Gamma> for \\<Gamma> :: \"'c \\<rightharpoonup> (('a globals_list_alloc_scheme, 'b) list_vars'_scheme, 'c, bool) com\"\n\nlemma\n  (in hoare_ex_guard)\n  \"\\<Gamma>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and>\n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;;\n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;;\n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;;\n     \\<acute>q :== \\<acute>r OD\n \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\napply (vcg)\napply fastforce+\ndone\n\n\ntext \\<open>We can also just prove that no faults will occur, by giving the\ntrivial postcondition.\n\\<close>\nlemma (in hoare_ex_guard) rev_noFault:\n  \"\\<Gamma>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and>\n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;;\n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;;\n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;;\n     \\<acute>q :== \\<acute>r OD\n  UNIV,UNIV\"\napply (vcg)\napply fastforce+\ndone\n\nlemma (in hoare_ex_guard) rev_moduloGuards:\n  \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and>\n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;;\n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<surd> \\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;;\n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<surd> \\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;;\n     \\<acute>q :== \\<acute>r OD\n \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\napply vcg\napply fastforce+\ndone\n\n\n\n\nlemma CombineStrip':\n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c' Q,A\"\n  assumes deriv_strip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n  assumes c'': \"c''= mark_guards False (strip_guards (-F) c')\"\n  assumes c: \"c = mark_guards False c'\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof -\n  from deriv_strip [simplified c'']\n  have \"\\<Gamma>,\\<Theta>\\<turnstile> P (strip_guards (- F) c') UNIV,UNIV\"\n    by (rule HoarePartialProps.MarkGuardsD)\n  with deriv\n  have \"\\<Gamma>,\\<Theta>\\<turnstile> P c' Q,A\"\n    by (rule HoarePartialProps.CombineStrip)\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile> P mark_guards False c' Q,A\"\n    by (rule HoarePartialProps.MarkGuardsI)\n  thus ?thesis\n    by (simp add: c)\nqed\n\n\ntext \\<open>We can then combine the prove that no fault will occur with the\nfunctional proof of the programme without guards to get the full prove by\nthe rule @{thm HoarePartialProps.CombineStrip}\n\\<close>\n\n\nlemma\n  (in hoare_ex_guard)\n  \"\\<Gamma>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps \\<and> List \\<acute>q \\<acute>next Qs \\<and> set Ps \\<inter> set Qs = {} \\<and>\n       set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  WHILE \\<acute>p \\<noteq> Null\n  INV \\<lbrace>\\<exists>ps qs. List \\<acute>p \\<acute>next  ps \\<and> List \\<acute>q \\<acute>next qs \\<and> set ps \\<inter> set qs = {} \\<and>\n               rev ps @ qs = rev Ps @ Qs \\<and>\n               set ps \\<subseteq> set \\<acute>alloc \\<and> set qs \\<subseteq> set \\<acute>alloc\\<rbrace>\n  DO \\<acute>r :== \\<acute>p;;\n     \\<lbrace>\\<acute>p\\<noteq>Null \\<and> \\<acute>p\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow> \\<acute>next;;\n     \\<lbrace>\\<acute>r\\<noteq>Null \\<and> \\<acute>r\\<in>set \\<acute>alloc\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>q;;\n     \\<acute>q :== \\<acute>r OD\n \\<lbrace>List \\<acute>q \\<acute>next (rev Ps @ Qs) \\<and> set Ps \\<subseteq> set \\<acute>alloc \\<and> set Qs \\<subseteq> set \\<acute>alloc\\<rbrace>\"\n\napply (rule CombineStrip' [OF rev_moduloGuards rev_noFault])\napply  simp\napply simp\ndone\n\n\ntext \\<open>In the previous example the effort to split up the prove did not\nreally pay off. But when we think of programs with a lot of guards and\ncomplicated specifications it may be better to first focus on a prove without\nthe messy guards. Maybe it is possible to automate the no fault proofs so\nthat it suffices to focus on the stripped program.\n\\<close>\n\n\ntext \\<open>\nThe purpose of guards is to watch for faults that can occur during\nevaluation of expressions. In the example before we watched for null pointer\ndereferencing or memory faults. We can also look for array index bounds or\ndivision by zero. As the condition of a while loop is evaluated in each\niteration we cannot just add a guard before the while loop. Instead we need\na special guard for the condition.\nExample: @{term \"WHILE  \\<lbrace>\\<acute>p\\<noteq>Null\\<rbrace>\\<longmapsto> \\<acute>p\\<rightarrow>\\<acute>next\\<noteq>Null DO SKIP OD\"}\n\\<close>\n\nsubsection \\<open>Circular Lists\\<close>\ndefinition\n  distPath :: \"ref \\<Rightarrow> (ref \\<Rightarrow> ref) \\<Rightarrow> ref \\<Rightarrow> ref list \\<Rightarrow> bool\" where\n  \"distPath x next y as = (Path x next y as  \\<and>  distinct as)\"\n\nlemma neq_dP: \"\\<lbrakk>p \\<noteq> q; Path p h q Ps; distinct Ps\\<rbrakk> \\<Longrightarrow>\n \\<exists>Qs. p\\<noteq>Null \\<and> Ps = p#Qs \\<and> p \\<notin> set Qs\"\nby (cases Ps, auto)\n\nlemma circular_list_rev_I:\n  \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>root = r \\<and>  distPath \\<acute>root \\<acute>next \\<acute>root (r#Ps)\\<rbrace>\n   \\<acute>p :== \\<acute>root;; \\<acute>q :== \\<acute>root\\<rightarrow>\\<acute>next;;\n  WHILE \\<acute>q \\<noteq> \\<acute>root\n  INV \\<lbrace>\\<exists> ps qs. distPath \\<acute>p \\<acute>next \\<acute>root ps  \\<and> distPath \\<acute>q \\<acute>next \\<acute>root qs \\<and>\n             \\<acute>root = r \\<and> r\\<noteq>Null \\<and> r \\<notin> set Ps  \\<and> set ps \\<inter> set qs = {} \\<and>\n             Ps = (rev ps) @ qs \\<rbrace>\n  DO \\<acute>tmp :== \\<acute>q;; \\<acute>q :== \\<acute>q\\<rightarrow>\\<acute>next;; \\<acute>tmp\\<rightarrow>\\<acute>next :== \\<acute>p;; \\<acute>p:==\\<acute>tmp OD;;\n  \\<acute>root\\<rightarrow>\\<acute>next :== \\<acute>p\n  \\<lbrace>\\<acute>root = r \\<and> distPath \\<acute>root \\<acute>next \\<acute>root (r#rev Ps)\\<rbrace>\"\napply (simp only:distPath_def)\napply vcg\napply   (rule_tac x=\"[]\" in exI)\napply   fastforce\napply  clarsimp\napply  (drule (2) neq_dP)\napply  (rule_tac x=\"q # ps\" in exI)\napply  clarsimp\napply fastforce\ndone\n\n\n\nlemma path_is_list:\"\\<And>a next b. \\<lbrakk>Path b next a Ps ; a \\<notin> set Ps; a\\<noteq>Null\\<rbrakk>\n\\<Longrightarrow> List b (next(a := Null)) (Ps @ [a])\"\napply (induct Ps)\napply (auto simp add:fun_upd_apply)\ndone\n\ntext \\<open>\nThe simple algorithm for acyclic list reversal, with modified\nannotations, works for cyclic lists as well.:\n\\<close>\n\nlemma circular_list_rev_II:\n \"\\<Gamma>\\<turnstile>\n \\<lbrace>\\<acute>p = r \\<and> distPath \\<acute>p \\<acute>next \\<acute>p (r#Ps)\\<rbrace>\n\\<acute>q:==Null;;\nWHILE \\<acute>p \\<noteq> Null\nINV\n \\<lbrace> ((\\<acute>q = Null) \\<longrightarrow> (\\<exists>ps. distPath \\<acute>p \\<acute>next r ps  \\<and>  ps = r#Ps)) \\<and>\n  ((\\<acute>q \\<noteq> Null) \\<longrightarrow> (\\<exists>ps qs. distPath \\<acute>q \\<acute>next r qs  \\<and> List \\<acute>p \\<acute>next ps  \\<and>\n                   set ps \\<inter> set qs = {} \\<and> rev qs @ ps = Ps@[r])) \\<and>\n  \\<not> (\\<acute>p = Null \\<and> \\<acute>q = Null \\<and> r = Null )\n   \\<rbrace>\nDO\n  \\<acute>tmp :== \\<acute>p;; \\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;; \\<acute>tmp\\<rightarrow>\\<acute>next :== \\<acute>q;; \\<acute>q:==\\<acute>tmp\nOD\n \\<lbrace>\\<acute>q = r \\<and> distPath \\<acute>q \\<acute>next \\<acute>q (r # rev Ps)\\<rbrace>\"\n\napply (simp only:distPath_def)\napply vcg\napply   clarsimp\napply  clarsimp\napply  (case_tac \"(q = Null)\")\napply   (fastforce intro: path_is_list)\napply  clarify\napply  (rule_tac x=\"psa\" in exI)\napply  (rule_tac x=\" p # qs\" in exI)\napply  force\napply fastforce\ndone\n\ntext\\<open>Although the above algorithm is more succinct, its invariant\nlooks more involved. The reason for the case distinction on @{term q}\nis due to the fact that during execution, the pointer variables can\npoint to either cyclic or acyclic structures.\n\\<close>\n\ntext \\<open>\nWhen working on lists, its sometimes better to remove\n@{thm[source] fun_upd_apply} from the simpset, and instead include @{thm[source] fun_upd_same} and @{thm[source] fun_upd_other} to\nthe simpset\n\\<close>\n\n(*\ndeclare fun_upd_apply[simp del]fun_upd_same[simp] fun_upd_other[simp]\n*)\n\n\nlemma \"\\<Gamma>\\<turnstile> {\\<sigma>}\n            \\<acute>I :== \\<acute>M;;\n            ANNO \\<tau>. \\<lbrace>\\<tau>. \\<acute>I = \\<^bsup>\\<sigma>\\<^esup>M\\<rbrace>\n                      \\<acute>M :== \\<acute>N;; \\<acute>N :== \\<acute>I\n                    \\<lbrace>\\<acute>M = \\<^bsup>\\<tau>\\<^esup>N \\<and> \\<acute>N = \\<^bsup>\\<tau>\\<^esup>I\\<rbrace>\n            \\<lbrace>\\<acute>M = \\<^bsup>\\<sigma>\\<^esup>N \\<and> \\<acute>N = \\<^bsup>\\<sigma>\\<^esup>M\\<rbrace>\"\napply vcg\napply auto\ndone\n\n\nlemma \"\\<Gamma>\\<turnstile> ({\\<sigma>} \\<inter> \\<lbrace>\\<acute>M = 0 \\<and> \\<acute>S = 0\\<rbrace>)\n      (ANNO \\<tau>. ({\\<tau>} \\<inter> \\<lbrace>\\<acute>A=\\<^bsup>\\<sigma>\\<^esup>A \\<and> \\<acute>I=\\<^bsup>\\<sigma>\\<^esup>I \\<and> \\<acute>M=0 \\<and> \\<acute>S=0\\<rbrace>)\n      WHILE \\<acute>M \\<noteq> \\<acute>A\n      INV \\<lbrace>\\<acute>S = \\<acute>M * \\<acute>I \\<and> \\<acute>A=\\<^bsup>\\<tau>\\<^esup>A \\<and> \\<acute>I=\\<^bsup>\\<tau>\\<^esup>I\\<rbrace>\n      DO \\<acute>S :== \\<acute>S + \\<acute>I;; \\<acute>M :== \\<acute>M + 1 OD\n      \\<lbrace>\\<acute>S = \\<^bsup>\\<tau>\\<^esup>A * \\<^bsup>\\<tau>\\<^esup>I\\<rbrace>)\n      \\<lbrace>\\<acute>S = \\<^bsup>\\<sigma>\\<^esup>A * \\<^bsup>\\<sigma>\\<^esup>I\\<rbrace>\"\napply vcg_step\napply vcg_step\napply simp\napply vcg_step\napply vcg_step\napply simp\napply vcg\napply simp\napply simp\napply vcg_step\napply auto\ndone\n\ntext \\<open>Instead of annotations one can also directly use previously proven lemmas.\\<close>\nlemma foo_lemma: \"\\<forall>n m. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n \\<and> \\<acute>M = m\\<rbrace> \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n                     \\<lbrace>\\<acute>N = n + 1 \\<and> \\<acute>M = m + 1\\<rbrace>\"\n  by vcg\n\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n \\<and> \\<acute>M = m\\<rbrace> LEMMA foo_lemma\n                               \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n                             END;;\n                             \\<acute>N :== \\<acute>N + 1\n           \\<lbrace>\\<acute>N = n + 2 \\<and> \\<acute>M = m + 1\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n \\<and> \\<acute>M = m\\<rbrace>\n           LEMMA foo_lemma\n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n           END;;\n           LEMMA foo_lemma\n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n           END\n           \\<lbrace>\\<acute>N = n + 2 \\<and> \\<acute>M = m + 2\\<rbrace>\"\n  apply vcg\n  apply simp\n  done\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>N = n \\<and> \\<acute>M = m\\<rbrace>\n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1;;\n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n           \\<lbrace>\\<acute>N = n + 2 \\<and> \\<acute>M = m + 2\\<rbrace>\"\n  apply (hoare_rule anno=\n          \"LEMMA foo_lemma\n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n           END;;\n           LEMMA foo_lemma\n              \\<acute>N :== \\<acute>N + 1;; \\<acute>M :== \\<acute>M + 1\n           END\"\n          in HoarePartial.annotate_normI)\n  apply vcg\n  apply simp\n  done\n\ntext \\<open>Just some test on marked, guards\\<close>\nlemma \"\\<Gamma>\\<turnstile>\\<lbrace>True\\<rbrace> WHILE \\<lbrace>P \\<acute>N \\<rbrace>\\<surd>, \\<lbrace>Q \\<acute>M\\<rbrace>#, \\<lbrace>R \\<acute>N\\<rbrace>\\<longmapsto> \\<acute>N < \\<acute>M\n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace> DO\n                    \\<acute>N :== \\<acute>M\n                  OD\n           \\<lbrace>hard\\<rbrace>\"\napply vcg\noops\n\nlemma \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>True\\<rbrace> WHILE \\<lbrace>P \\<acute>N \\<rbrace>\\<surd>, \\<lbrace>Q \\<acute>M\\<rbrace>#, \\<lbrace>R \\<acute>N\\<rbrace>\\<longmapsto> \\<acute>N < \\<acute>M\n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace> DO\n                    \\<acute>N :== \\<acute>M\n                  OD\n           \\<lbrace>hard\\<rbrace>\"\napply vcg\noops\n\n\n\nterm \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>True\\<rbrace> WHILE\\<^sub>g  \\<acute>N < \\<acute>Arr!i\n                    FIX Z.\n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace>\n\n                  DO\n                    \\<acute>N :== \\<acute>M\n                  OD\n           \\<lbrace>hard\\<rbrace>\"\n\nlemma \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>True\\<rbrace> WHILE\\<^sub>g  \\<acute>N < \\<acute>Arr!i\n                    FIX Z.\n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace>\n                    VAR arbitrary\n                  DO\n                    \\<acute>N :== \\<acute>M\n                  OD\n           \\<lbrace>hard\\<rbrace>\"\napply vcg\noops\n\nlemma \"\\<Gamma>\\<turnstile>\\<^bsub>/{True}\\<^esub> \\<lbrace>True\\<rbrace> WHILE \\<lbrace>P \\<acute>N \\<rbrace>\\<surd>, \\<lbrace>Q \\<acute>M\\<rbrace>#, \\<lbrace>R \\<acute>N\\<rbrace>\\<longmapsto> \\<acute>N < \\<acute>M\n                    FIX Z.\n                    INV \\<lbrace>\\<acute>N < 2\\<rbrace>\n                    VAR arbitrary\n                  DO\n                    \\<acute>N :== \\<acute>M\n                  OD\n           \\<lbrace>hard\\<rbrace>\"\napply vcg\noops\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/c-parser/Simpl/ex/VcgEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3202041236470688}}
{"text": "(*\n  File:   SDS_Impossibility.thy\n  Author: Manuel Eberl <manuel@pruvisto.org>\n\n  The proof that there exists no anonymous and neutral SDS for at least \n  four voters and alternatives that satisfies SD-Efficiency and \n  SD-Strategy-Proofness.\n*)\n\nsection \\<open>Incompatibility of SD-Efficiency and SD-Strategy-Proofness\\<close>\n\ntheory SDS_Impossibility\nimports\n  Randomised_Social_Choice.SDS_Automation\n  Randomised_Social_Choice.Randomised_Social_Choice\nbegin\n\nsubsection \\<open>Preliminary Definitions\\<close>\n\nlocale sds_impossibility = \n  anonymous_sds agents alts sds +\n  neutral_sds agents alts sds +\n  sd_efficient_sds agents alts sds +\n  strategyproof_sds agents alts sds\n  for agents :: \"'agent set\" and alts :: \"'alt set\" and sds +\n  assumes agents_ge_4: \"card agents \\<ge> 4\"\n      and alts_ge_4:   \"card alts \\<ge> 4\"\n\nlocale sds_impossibility_4_4 = sds_impossibility agents alts sds\n  for agents :: \"'agent set\" and alts :: \"'alt set\" and sds +\n  fixes A1 A2 A3 A4 :: 'agent and a b c d :: 'alt\n  assumes distinct_agents: \"distinct [A1, A2, A3, A4]\"\n      and distinct_alts: \"distinct [a, b, c, d]\"\n      and agents: \"agents = {A1, A2, A3, A4}\"\n      and alts:   \"alts   = {a, b, c, d}\"\nbegin\n\nlemma an_sds: \"an_sds agents alts sds\" by unfold_locales\nlemma ex_post_efficient_sds: \"ex_post_efficient_sds agents alts sds\" by unfold_locales\nlemma sd_efficient_sds: \"sd_efficient_sds agents alts sds\" by unfold_locales\nlemma strategyproof_an_sds: \"strategyproof_an_sds agents alts sds\" by unfold_locales\n\nlemma distinct_agents' [simp]: \n  \"A1 \\<noteq> A2\" \"A1 \\<noteq> A3\" \"A1 \\<noteq> A4\" \"A2 \\<noteq> A1\" \"A2 \\<noteq> A3\" \"A2 \\<noteq> A4\" \n  \"A3 \\<noteq> A1\" \"A3 \\<noteq> A2\" \"A3 \\<noteq> A4\" \"A4 \\<noteq> A1\" \"A4 \\<noteq> A2\" \"A4 \\<noteq> A3\"\n  using distinct_agents by auto\n  \nlemma distinct_alts' [simp]:\n  \"a \\<noteq> b\" \"a \\<noteq> c\" \"a \\<noteq> d\" \"b \\<noteq> a\" \"b \\<noteq> c\" \"b \\<noteq> d\" \n  \"c \\<noteq> a\" \"c \\<noteq> b\" \"c \\<noteq> d\" \"d \\<noteq> a\" \"d \\<noteq> b\" \"d \\<noteq> c\"\n  using distinct_alts by auto\n\nlemma card_agents [simp]: \"card agents = 4\" and card_alts [simp]: \"card alts = 4\"\n  using distinct_agents distinct_alts by (simp_all add: agents alts)\n\nlemma in_agents [simp]: \"A1 \\<in> agents\" \"A2 \\<in> agents\" \"A3 \\<in> agents\" \"A4 \\<in> agents\"\n  by (simp_all add: agents)\n\nlemma in_alts [simp]: \"a \\<in> alts\" \"b \\<in> alts\" \"c \\<in> alts\" \"d \\<in> alts\"\n  by (simp_all add: alts)\n  \nlemma agent_iff: \"x \\<in> agents \\<longleftrightarrow> x \\<in> {A1, A2, A3, A4}\"\n                 \"(\\<forall>x\\<in>agents. P x) \\<longleftrightarrow> P A1 \\<and> P A2 \\<and> P A3 \\<and> P A4\"\n                 \"(\\<exists>x\\<in>agents. P x) \\<longleftrightarrow> P A1 \\<or> P A2 \\<or> P A3 \\<or> P A4\"\n  by (auto simp add: agents)\n\nlemma alt_iff: \"x \\<in> alts \\<longleftrightarrow> x \\<in> {a,b,c,d}\"\n               \"(\\<forall>x\\<in>alts. P x) \\<longleftrightarrow> P a \\<and> P b \\<and> P c \\<and> P d\"\n               \"(\\<exists>x\\<in>alts. P x) \\<longleftrightarrow> P a \\<or> P b \\<or> P c \\<or> P d\"\n  by (auto simp add: alts)\n\n\n\n\nsubsection \\<open>Definition of Preference Profiles and Fact Gathering\\<close>\n\npreference_profile \n  agents: agents\n  alts:   alts\nwhere R1  = A1: [c, d], [a, b]    A2: [b, d], a, c      A3: a, b, [c, d]      A4: [a, c], [b, d]\n  and R2  = A1: [a, c], [b, d]    A2: [c, d], a, b      A3: [b, d], a, c      A4: a, b, [c, d]\n  and R3  = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: d, [a, b], c      A4: c, a, [b, d]\n  and R4  = A1: [a, b], [c, d]    A2: [a, d], [b, c]    A3: c, [a, b], d      A4: d, c, [a, b]\n  and R5  = A1: [c, d], [a, b]    A2: [a, b], [c, d]    A3: [a, c], d, b      A4: d, [a, b], c\n  and R6  = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], [b, d]    A4: d, b, a, c\n  and R7  = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: a, c, d, b        A4: d, [a, b], c\n  and R8  = A1: [a, b], [c, d]    A2: [a, c], [b, d]    A3: d, [a, b], c      A4: d, c, [a, b]\n  and R9  = A1: [a, b], [c, d]    A2: [a, d], c, b      A3: d, c, [a, b]      A4: [a, b, c], d\n  and R10 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], d, b      A4: [b, d], a, c\n  and R11 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: d, [a, b], c      A4: c, a, b, d\n  and R12 = A1: [c, d], [a, b]    A2: [a, b], [c, d]    A3: [a, c], d, b      A4: [a, b, d], c\n  and R13 = A1: [a, c], [b, d]    A2: [c, d], a, b      A3: [b, d], a, c      A4: a, b, d, c\n  and R14 = A1: [a, b], [c, d]    A2: d, c, [a, b]      A3: [a, b, c], d      A4: a, d, c, b\n  and R15 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [b, d], a, c      A4: a, c, d, b\n  and R16 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: a, c, d, b        A4: [a, b, d], c\n  and R17 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], [b, d]    A4: d, [a, b], c\n  and R18 = A1: [a, b], [c, d]    A2: [a, d], [b, c]    A3: [a, b, c], d      A4: d, c, [a, b]\n  and R19 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [b, d], a, c      A4: [a, c], [b, d]\n  and R20 = A1: [b, d], a, c      A2: b, a, [c, d]      A3: a, c, [b, d]      A4: d, c, [a, b]\n  and R21 = A1: [a, d], c, b      A2: d, c, [a, b]      A3: c, [a, b], d      A4: a, b, [c, d]\n  and R22 = A1: [a, c], d, b      A2: d, c, [a, b]      A3: d, [a, b], c      A4: a, b, [c, d]\n  and R23 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: [a, c], [b, d]    A4: [a, b, d], c\n  and R24 = A1: [c, d], [a, b]    A2: d, b, a, c        A3: c, a, [b, d]      A4: b, a, [c, d]\n  and R25 = A1: [c, d], [a, b]    A2: [b, d], a, c      A3: a, b, [c, d]      A4: a, c, [b, d]\n  and R26 = A1: [b, d], [a, c]    A2: [c, d], [a, b]    A3: a, b, [c, d]      A4: a, c, [b, d]\n  and R27 = A1: [a, b], [c, d]    A2: [b, d], a, c      A3: [a, c], [b, d]    A4: [c, d], a, b\n  and R28 = A1: [c, d], a, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: a, c, [b, d]\n  and R29 = A1: [a, c], d, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: d, c, [a, b]\n  and R30 = A1: [a, d], c, b      A2: d, c, [a, b]      A3: c, [a, b], d      A4: [a, b], d, c\n  and R31 = A1: [b, d], a, c      A2: [a, c], d, b      A3: c, d, [a, b]      A4: [a, b], c, d\n  and R32 = A1: [a, c], d, b      A2: d, c, [a, b]      A3: d, [a, b], c      A4: [a, b], d, c\n  and R33 = A1: [c, d], [a, b]    A2: [a, c], d, b      A3: a, b, [c, d]      A4: d, [a, b], c\n  and R34 = A1: [a, b], [c, d]    A2: a, c, d, b        A3: b, [a, d], c      A4: c, d, [a, b]\n  and R35 = A1: [a, d], c, b      A2: a, b, [c, d]      A3: [a, b, c], d      A4: d, c, [a, b]\n  and R36 = A1: [c, d], [a, b]    A2: [a, c], d, b      A3: [b, d], a, c      A4: a, b, [c, d]\n  and R37 = A1: [a, c], [b, d]    A2: [b, d], [a, c]    A3: a, b, [c, d]      A4: c, d, [a, b]\n  and R38 = A1: [c, d], a, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: [a, c], b, d\n  and R39 = A1: [a, c], d, b      A2: [b, d], a, c      A3: a, b, [c, d]      A4: [c, d], a, b\n  and R40 = A1: [a, d], c, b      A2: [a, b], c, d      A3: [a, b, c], d      A4: d, c, [a, b]\n  and R41 = A1: [a, d], c, b      A2: [a, b], d, c      A3: [a, b, c], d      A4: d, c, [a, b]\n  and R42 = A1: [c, d], [a, b]    A2: [a, b], [c, d]    A3: d, b, a, c        A4: c, a, [b, d]\n  and R43 = A1: [a, b], [c, d]    A2: [c, d], [a, b]    A3: d, [a, b], c      A4: a, [c, d], b\n  and R44 = A1: [c, d], [a, b]    A2: [a, c], d, b      A3: [a, b], d, c      A4: [a, b, d], c\n  and R45 = A1: [a, c], d, b      A2: [b, d], a, c      A3: [a, b], c, d      A4: [c, d], b, a\n  and R46 = A1: [b, d], a, c      A2: d, c, [a, b]      A3: [a, c], [b, d]    A4: b, a, [c, d]\n  and R47 = A1: [a, b], [c, d]    A2: [a, d], c, b      A3: d, c, [a, b]      A4: c, [a, b], d\n  by (simp_all add: agents alts)\n\nderive_orbit_equations (an_sds)\n  R10 R26 R27 R28 R29 R43 R45\n  by simp_all\n\nprove_inefficient_supports (ex_post_efficient_sds sd_efficient_sds)\n  R3 [b] and R4 [b] and R5 [b] and R7 [b] and R8 [b] and\n  R9 [b] and R11 [b] and R12 [b] and R14 [b] and R16 [b] and\n  R17 [b] and R18 [b] and R21 [b] and R22 [b] and R23 [b] and\n  R30 [b] and R32 [b] and R33 [b] and R35 [b] and R40 [b] and\n  R41 [b] and R43 [b] and R44 [b] and R47 [b] and\n  R10 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R15 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R19 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R25 [b, c] witness: [c: 0, d: 1 / 2, a: 1 / 2, b: 0] and\n  R26 [c, b] witness: [b: 0, d: 1 / 2, a: 1 / 2, c: 0] and\n  R27 [c, b] witness: [a: 1 / 2, b: 0, c: 0, d: 1 / 2] and\n  R28 [b, c] witness: [c: 0, d: 1 / 2, a: 1 / 2, b: 0] and\n  R29 [b, c] witness: [a: 1 / 2, c: 0, d: 1 / 2, b: 0] and\n  R39 [b, c] witness: [a: 1 / 2, c: 0, d: 1 / 2, b: 0]\n  by (simp_all add: agent_iff alt_iff)\n\nderive_strategyproofness_conditions (strategyproof_an_sds)\n  distance: 2\n  R1 R2 R3 R4 R5 R6 R7 R8 R9 R10 R11 R12 R13 R14 R15 R16 R17 R18 R19 R20\n  R21 R22 R23 R24 R25 R26 R27 R28 R29 R30 R31 R32 R33 R34 R35 R36 R37 R38 R39 R40\n  R41 R42 R43 R44 R45 R46 R47\n  by (simp_all add: agent_iff alt_iff)\n\nlemma lottery_conditions:\n  assumes \"is_pref_profile R\"\n  shows   \"pmf (sds R) a \\<ge> 0\" \"pmf (sds R) b \\<ge> 0\" \"pmf (sds R) c \\<ge> 0\" \"pmf (sds R) d \\<ge> 0\"\n          \"pmf (sds R) a + pmf (sds R) b + pmf (sds R) c + pmf (sds R) d = 1\"\n  using lottery_prob_alts[OF sds_wf[OF assms]]\n  by (simp_all add: alts pmf_nonneg measure_measure_pmf_finite)\n\n\nsubsection \\<open>Main Proof\\<close>\n\nlemma R45 [simp]: \"pmf (sds R45) a = 1/4\" \"pmf (sds R45) b = 1/4\" \n           \"pmf (sds R45) c = 1/4\" \"pmf (sds R45) d = 1/4\"\n  using R45.orbits lottery_conditions[OF R45.wf] by simp_all\n\nlemma R10_bc [simp]: \"pmf (sds R10) b = 0\" \"pmf (sds R10) c = 0\"\n  using R10.support R10.orbits by auto\n\nlemma R10_ad [simp]: \"pmf (sds R10) a = 1/2\" \"pmf (sds R10) d = 1/2\"\n  using lottery_conditions[OF R10.wf] R10_bc R10.orbits by simp_all\n\n\nlemma R26_bc [simp]: \"pmf (sds R26) b = 0\" \"pmf (sds R26) c = 0\"\n  using R26.support R26.orbits by auto\n\nlemma R26_d [simp]: \"pmf (sds R26) d = 1 - pmf (sds R26) a\"\n  using lottery_conditions[OF R26.wf] R26_bc by simp\n\n\nlemma R27_bc [simp]: \"pmf (sds R27) b = 0\" \"pmf (sds R27) c = 0\"\n  using R27.support R27.orbits by auto\n\nlemma R27_d [simp]: \"pmf (sds R27) d = 1 - pmf (sds R27) a\"\n  using lottery_conditions[OF R27.wf] R27_bc by simp\n\n\nlemma R28_bc [simp]: \"pmf (sds R28) b = 0\" \"pmf (sds R28) c = 0\"\n  using R28.support R28.orbits by auto\n\nlemma R28_d [simp]: \"pmf (sds R28) d = 1 - pmf (sds R28) a\"\n  using lottery_conditions[OF R28.wf] R28_bc by simp\n\n\n\n\nlemma R29_ac [simp]: \"pmf (sds R29) a = 1/2\" \"pmf (sds R29) d = 1/2\"\n  using lottery_conditions[OF R29.wf] R29_bc R29.orbits by simp_all\n\n\nlemmas R43_bc [simp] = R43.support\n\nlemma R43_ad [simp]: \"pmf (sds R43) a = 1/2\" \"pmf (sds R43) d = 1/2\"\n  using lottery_conditions[OF R43.wf] R43_bc R43.orbits by simp_all\n\n\nlemma R39_b [simp]: \"pmf (sds R39) b = 0\"\nproof -\n  {\n    assume [simp]: \"pmf (sds R39) c = 0\"\n    with R29_R39.strategyproofness(1)\n      have \"pmf (sds R39) d \\<le> 1/2\" by auto\n    with R39_R29.strategyproofness(1) lottery_conditions[OF R39.wf] \n      have \"pmf (sds R39) b = 0\" by auto\n  }\n  with R39.support show ?thesis by blast\nqed\n\nlemma R36_a [simp]: \"pmf (sds R36) a = 1/2\" and R36_b [simp]: \"pmf (sds R36) b = 0\"\nproof -\n  from R10_R36.strategyproofness(1) lottery_conditions[OF R36.wf] \n    have \"pmf (sds R36) a + pmf (sds R36) b \\<le> 1/2\" by auto\n  with R36_R10.strategyproofness(1) lottery_conditions[OF R36.wf]\n    show \"pmf (sds R36) a = 1/2\" \"pmf (sds R36) b = 0\" by auto\nqed\n\nlemma R36_d [simp]: \"pmf (sds R36) d = 1/2 - pmf (sds R36) c\"\n  using lottery_conditions[OF R36.wf] by simp\n\nlemma R39_a [simp]: \"pmf (sds R39) a = 1/2\"\nproof -\n  from R36_R39.strategyproofness(1) lottery_conditions[OF R39.wf]\n    have \"pmf (sds R39) a \\<ge> 1/2\" by auto\n  with R39_R36.strategyproofness(1) lottery_conditions[OF R39.wf]\n    show ?thesis by auto\nqed\n\nlemma R39_d [simp]: \"pmf (sds R39) d = 1/2 - pmf (sds R39) c\"\n  using lottery_conditions[OF R39.wf] by simp\n\n\n\nlemmas R12_b [simp] = R12.support\n\nlemma R12_c [simp]: \"pmf (sds R12) c = 0\"\n  using R12_R10.strategyproofness(1) lottery_conditions[OF R12.wf] \n  by (auto simp del: pmf_nonneg)\n  \n\nlemma R12_d [simp]: \"pmf (sds R12) d = 1 - pmf (sds R12) a\"\n  using lottery_conditions[OF R12.wf] by simp\n\nlemma R12_a_ge_one_half: \"pmf (sds R12) a \\<ge> 1/2\"\n  using R10_R12.strategyproofness(1) lottery_conditions[OF R12.wf]\n  by auto\n\n\nlemma R44 [simp]: \n  \"pmf (sds R44) a = pmf (sds R12) a\" \"pmf (sds R44) d = 1 - pmf (sds R12) a\"\n  \"pmf (sds R44) b = 0\" \"pmf (sds R44) c = 0\"\nproof -\n  from R12_R44.strategyproofness(1) R44.support have \"pmf (sds R44) a \\<le> pmf (sds R12) a\" by simp\n  with R44_R12.strategyproofness(1) R44.support lottery_conditions[OF R44.wf]\n    show \"pmf (sds R44) a = pmf (sds R12) a\" \"pmf (sds R44) c = 0\"\n         \"pmf (sds R44) d = 1 - pmf (sds R12) a\" by (auto simp del: pmf_nonneg)\nqed (insert R44.support, simp_all)\n\nlemma R9_a [simp]: \"pmf (sds R9) a = pmf (sds R35) a\"\nproof -\n  from R9_R35.strategyproofness(1) R35.support R9.support \n    have \"pmf (sds R35) a \\<le> pmf (sds R9) a\" by simp\n  with R35_R9.strategyproofness(1) R9.support R35.support show ?thesis by simp\nqed\n\nlemma R18_c [simp]: \"pmf (sds R18) c = pmf (sds R9) c\"\nproof -\n  from R18_R9.strategyproofness(1) R18.support R9.support\n    have \"pmf (sds R18) d + pmf (sds R18) a \\<ge> pmf (sds R9) d + pmf (sds R9) a\" by auto\n  with R9_R18.strategyproofness(1) R18.support R9.support\n        lottery_conditions[OF R9.wf] lottery_conditions[OF R18.wf]\n    show ?thesis by auto\nqed\n\nlemma R5_d_ge_one_half: \"pmf (sds R5) d \\<ge> 1/2\"\n  using R5_R10.strategyproofness(1) R5.support lottery_conditions[OF R5.wf] by auto\n\nlemma R7 [simp]: \"pmf (sds R7) a = 1/2\" \"pmf (sds R7) b = 0\" \"pmf (sds R7) c = 0\" \"pmf (sds R7) d = 1/2\"\nproof -\n  from R5_d_ge_one_half have \"1/2 \\<le> pmf (sds R5) d\" by simp\n  also from R5_R17.strategyproofness(1) R17.support lottery_conditions[OF R5.wf] lottery_conditions[OF R17.wf] \n    have \"\\<dots> \\<le> pmf (sds R17) d\" by (auto simp del: pmf_nonneg)\n  also from R17_R7.strategyproofness(1) lottery_conditions[OF R7.wf] lottery_conditions[OF R17.wf] R7.support\n    have \"pmf (sds R17) d \\<le> pmf (sds R7) d\" by (auto simp del: pmf_nonneg)\n  finally have \"pmf (sds R7) d \\<ge> 1/2\" .\n  with R7_R43.strategyproofness(1) lottery_conditions[OF R7.wf] R7.support\n    show \"pmf (sds R7) a = 1/2\" \"pmf (sds R7) b = 0\" \"pmf (sds R7) c = 0\" \"pmf (sds R7) d = 1/2\"\n    by auto\nqed\n\nlemma R5 [simp]: \"pmf (sds R5) a = 1/2\" \"pmf (sds R5) b = 0\" \"pmf (sds R5) c = 0\" \"pmf (sds R5) d = 1/2\"\nproof -\n  from R5_R7.strategyproofness(1) lottery_conditions[OF R5.wf] R5.support \n    have \"pmf (sds R5) d \\<le> 1/2\" by auto\n  with R5_d_ge_one_half show d: \"pmf (sds R5) d = 1 / 2\" by simp\n  with R5_R10.strategyproofness(1) lottery_conditions[OF R5.wf] R5.support\n    show \"pmf (sds R5) c = 0\" \"pmf (sds R5) a = 1/2\" by simp_all\nqed (simp_all add: R5.support)\n\nlemma R15 [simp]: \"pmf (sds R15) a = 1/2\" \"pmf (sds R15) b = 0\" \"pmf (sds R15) c = 0\" \"pmf (sds R15) d = 1/2\"\nproof -\n  {\n    assume \"pmf (sds R15) b = 0\"\n    with R10_R15.strategyproofness(1) lottery_conditions[OF R15.wf]\n      have \"pmf (sds R15) a + pmf (sds R15) c \\<le> 1/2\" by auto\n    with R15_R10.strategyproofness(1) lottery_conditions[OF R15.wf] \n      have \"pmf (sds R15) c = 0\" by auto\n  }\n  with R15.support show [simp]: \"pmf (sds R15) c = 0\" by blast\n  with R15_R5.strategyproofness(1) lottery_conditions[OF R15.wf] \n    have \"pmf (sds R15) a \\<ge> 1/2\" by auto\n  moreover from R15_R7.strategyproofness(1) lottery_conditions[OF R15.wf]\n    have \"pmf (sds R15) b + pmf (sds R15) d \\<ge> 1/2\" by auto\n  ultimately show \"pmf (sds R15) a = 1/2\" using lottery_conditions[OF R15.wf] by auto\n  with R15_R5.strategyproofness(1) lottery_conditions[OF R15.wf]\n    show \"pmf (sds R15) d = 1/2\" \"pmf (sds R15) b = 0\" by auto\nqed\n\nlemma R13_aux: \"pmf (sds R13) b = 0\" \"pmf (sds R13) c = 0\" \"pmf (sds R13) d = 1 - pmf (sds R13) a\"\n  and R27_R13 [simp]: \"pmf (sds R27) a = pmf (sds R13) a\" \n  using R27_R13.strategyproofness(1) R13_R27.strategyproofness(1) lottery_conditions[OF R13.wf] by auto\n\nlemma R13 [simp]: \"pmf (sds R13) a = 1/2\" \"pmf (sds R13) b = 0\" \"pmf (sds R13) c = 0\" \"pmf (sds R13) d = 1/2\"\n  using R15_R13.strategyproofness(1) R13_R15.strategyproofness(1) R13_aux by simp_all\n\nlemma R27 [simp]: \"pmf (sds R27) a = 1/2\" \"pmf (sds R27) b = 0\" \"pmf (sds R27) c = 0\" \"pmf (sds R27) d = 1/2\"\n  by simp_all\n\nlemma R19 [simp]: \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) b = 0\" \"pmf (sds R19) c = 0\" \"pmf (sds R19) d = 1/2\"\nproof -\n  have \"pmf (sds R19) a = 1/2 \\<and> pmf (sds R19) b = 0 \\<and> pmf (sds R19) c = 0 \\<and> pmf (sds R19) d = 1/2\"\n  proof (rule disjE[OF R19.support]; safe)\n    assume [simp]: \"pmf (sds R19) b = 0\"\n    from R10_R19.strategyproofness(1) lottery_conditions[OF R19.wf] \n      have \"pmf (sds R19) a + pmf (sds R19) c \\<le> 1/2\" by auto\n    moreover from R19_R10.strategyproofness(1) \n      have \"pmf (sds R19) a + pmf (sds R19) c \\<ge> 1/2\" by simp\n    ultimately show \"pmf (sds R19) d = 1/2\" using lottery_conditions[OF R19.wf] by simp\n    with R27_R19.strategyproofness(1) lottery_conditions[OF R19.wf] \n      show \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) c = 0\" by auto\n  next\n    assume [simp]: \"pmf (sds R19) c = 0\"\n    from R19_R10.strategyproofness(1) have \"pmf (sds R19) a \\<ge> 1/2\" by auto\n    moreover from R19_R27.strategyproofness(1) have \"pmf (sds R19) d \\<ge> 1/2\" by auto\n    ultimately show \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) d = 1/2\" \"pmf (sds R19) b = 0\"\n      using lottery_conditions[OF R19.wf] by (auto simp del: pmf_nonneg)\n  qed\n  thus \"pmf (sds R19) a = 1/2\" \"pmf (sds R19) b = 0\" \"pmf (sds R19) c = 0\" \"pmf (sds R19) d = 1/2\" \n    by blast+\nqed\n\nlemma R1 [simp]: \"pmf (sds R1) a = 1/2\" \"pmf (sds R1) b = 0\"\nproof -\n  from R19_R1.strategyproofness(1) lottery_conditions[OF R1.wf]\n    have \"pmf (sds R1) a + pmf (sds R1) b \\<le> 1/2\" by simp\n  with R1_R19.strategyproofness(1) lottery_conditions[OF R1.wf]\n    show \"pmf (sds R1) a = 1/2\" \"pmf (sds R1) b = 0\" by auto\nqed\n\nlemma R22 [simp]: \"pmf (sds R22) a = 1/2\" \"pmf (sds R22) b = 0\" \"pmf (sds R22) c = 0\" \"pmf (sds R22) d = 1/2\"\nproof -\n  from R33_R5.strategyproofness(1) R33.support\n    have \"1/2 \\<le> pmf (sds R33) a\" by auto\n  also from R33_R22.strategyproofness(1) R22.support R33.support \n    lottery_conditions[OF R22.wf] lottery_conditions[OF R33.wf]\n    have \"\\<dots> \\<le> pmf (sds R22) a\" by simp\n  finally show \"pmf (sds R22) a = 1/2\" \"pmf (sds R22) b = 0\" \"pmf (sds R22) c = 0\" \"pmf (sds R22) d = 1/2\"\n    using R22_R29.strategyproofness(1) lottery_conditions[OF R22.wf] by (auto simp del: pmf_nonneg)\nqed\n\nlemma R28 [simp]: \"pmf (sds R28) a = 1/2\" \"pmf (sds R28) b = 0\" \"pmf (sds R28) c = 0\" \"pmf (sds R28) d = 1/2\"\nproof -\n  have \"pmf (sds R28) a \\<le> pmf (sds R32) d\"\n    using R32_R28.strategyproofness(1) lottery_conditions[OF R32.wf] by auto\n  hence R32_d: \"pmf (sds R32) d = pmf (sds R28) a\"\n    using R28_R32.strategyproofness(1) lottery_conditions[OF R32.wf] by auto\n\n  from R22_R32.strategyproofness(1) lottery_conditions[OF R32.wf] R32.support \n    have \"pmf (sds R32) a \\<le> 1/2\" by auto\n  with R32_R22.strategyproofness(1) lottery_conditions[OF R32.wf] R32.support \n    show \"pmf (sds R28) a = 1/2\" \"pmf (sds R28) b = 0\" \"pmf (sds R28) c = 0\" \"pmf (sds R28) d = 1/2\"\n    by (auto simp: R32_d simp del: pmf_nonneg)\nqed\n\nlemma R39 [simp]: \"pmf (sds R39) a = 1/2\" \"pmf (sds R39) b = 0\" \"pmf (sds R39) c = 0\" \"pmf (sds R39) d = 1/2\"\nproof -\n  from R28_R39.strategyproofness(1) show \"pmf (sds R39) c = 0\" by simp\n  thus \"pmf (sds R39) a = 1/2\" \"pmf (sds R39) b = 0\" \"pmf (sds R39) d = 1/2\"\n    by simp_all\nqed\n\nlemma R2 [simp]: \"pmf (sds R2) a = 1/2\" \"pmf (sds R2) b = 0\" \"pmf (sds R2) c = 0\" \"pmf (sds R2) d = 1/2\"\nproof -\n  from R1_R2.strategyproofness(1) R2_R1.strategyproofness(1) lottery_conditions[OF R2.wf] lottery_conditions[OF R1.wf]\n    have \"pmf (sds R2) a = 1/2\" \"pmf (sds R2) c + pmf (sds R2) d = 1/2\" \n    by (auto simp: algebra_simps simp del: pmf_nonneg)\n  with R39_R2.strategyproofness(1) lottery_conditions[OF R2.wf]\n    show \"pmf (sds R2) a = 1/2\" \"pmf (sds R2) b = 0\" \"pmf (sds R2) c = 0\" \"pmf (sds R2) d = 1/2\"\n    by auto\nqed\n\nlemma R42 [simp]: \"pmf (sds R42) a = 0\" \"pmf (sds R42) b = 0\" \"pmf (sds R42) c = 1/2\" \"pmf (sds R42) d = 1/2\"\nproof -\n  from R17_R5.strategyproofness(1) lottery_conditions[OF R17.wf] R17.support \n    have \"pmf (sds R17) d \\<le> 1/2\" by auto\n  moreover from R5_R17.strategyproofness(1) R17.support lottery_conditions[OF R17.wf] \n    have \"pmf (sds R17) d \\<ge> 1/2\" by auto\n  ultimately have R17_d: \"pmf (sds R17) d = 1/2\" by simp\n\n  from R6_R42.strategyproofness(1) \n    have \"pmf (sds R42) a + pmf (sds R42) c \\<le> pmf (sds R6) a + pmf (sds R6) c\" by simp\n  also from R6_R19.strategyproofness(1) lottery_conditions[OF R6.wf] \n    have \"pmf (sds R6) a + pmf (sds R6) c \\<le> 1/2\" by (auto simp del: pmf_nonneg)\n  finally have \"pmf (sds R42) a + pmf (sds R42) c \\<le> 1 / 2\" .\n  moreover from R17_R11.strategyproofness(1) R11.support R17.support\n       lottery_conditions[OF R11.wf] lottery_conditions[OF R17.wf]\n    have \"pmf (sds R11) d \\<ge> 1/2\" by (auto simp: R17_d)\n  ultimately have \"pmf (sds R42) a + pmf (sds R42) c \\<le> pmf (sds R11) d\" by simp\n  with R42_R11.strategyproofness(1) R11.support\n    have E: \"pmf (sds R11) d \\<le> pmf (sds R42) c\" by auto\n  with \\<open>pmf (sds R11) d \\<ge> 1/2\\<close> have \"pmf (sds R42) c \\<ge> 1/2\" by simp\n  moreover from R17_R3.strategyproofness(1) R3.support R17.support\n       lottery_conditions[OF R17.wf] lottery_conditions[OF R3.wf] \n    have \"pmf (sds R3) d \\<ge> 1/2\" by (auto simp: R17_d)\n  ultimately show \"pmf (sds R42) a = 0\" \"pmf (sds R42) b = 0\" \"pmf (sds R42) c = 1/2\" \"pmf (sds R42) d = 1/2\"\n    using R42_R3.strategyproofness(1) lottery_conditions[OF R3.wf] lottery_conditions[OF R42.wf]\n    by linarith+\nqed\n\nlemma R37 [simp]: \"pmf (sds R37) a = 1/2\" \"pmf (sds R37) b = 0\" \"pmf (sds R37) c = 1/2\" \"pmf (sds R37) d = 0\"\nproof -\n  from R37_R42.strategyproofness(1) lottery_conditions[OF R37.wf]\n    have \"pmf (sds R37) a = 1/2 \\<or> pmf (sds R37) a + pmf (sds R37) b > 1/2\"\n    by (auto simp del: pmf_nonneg)\n  moreover from R37_R42.strategyproofness(2) lottery_conditions[OF R37.wf]\n    have \"pmf (sds R37) c = 1/2 \\<or> pmf (sds R37) c + pmf (sds R37) d > 1/2\" \n    by (auto simp del: pmf_nonneg)\n  ultimately show \"pmf (sds R37) a = 1/2\" \"pmf (sds R37) b = 0\" \"pmf (sds R37) c = 1/2\" \"pmf (sds R37) d = 0\"\n    using lottery_conditions[OF R37.wf] by (auto simp del: pmf_nonneg)\nqed\n\nlemma R24 [simp]: \"pmf (sds R24) a = 0\" \"pmf (sds R24) b = 0\" \"pmf (sds R24) d = 1 - pmf (sds R24) c\"\n  using R42_R24.strategyproofness(1) lottery_conditions[OF R24.wf] by (auto simp del: pmf_nonneg)\n\nlemma R34 [simp]:\n  \"pmf (sds R34) a = 1 - pmf (sds R24) c\" \"pmf (sds R34) b = pmf (sds R24) c\"\n  \"pmf (sds R34) c = 0\" \"pmf (sds R34) d = 0\"\nproof -\n  from R24_R34.strategyproofness(1) lottery_conditions[OF R34.wf] \n    have \"pmf (sds R34) b \\<le> pmf (sds R24) c\" by (auto simp del: pmf_nonneg)\n  moreover from R34_R24.strategyproofness(1) lottery_conditions[OF R34.wf] \n    have \"pmf (sds R34) b \\<ge> pmf (sds R24) c\" by auto\n  ultimately show bc: \"pmf (sds R34) b = pmf (sds R24) c\" by simp\n  from R34_R24.strategyproofness(1) bc lottery_conditions[OF R34.wf] \n    show \"pmf (sds R34) c = 0\" by auto\n  moreover from R24_R34.strategyproofness(1) bc show \"pmf (sds R34) d = 0\" by simp\n  ultimately show \"pmf (sds R34) a = 1 - pmf (sds R24) c\"\n    using bc lottery_conditions[OF R34.wf] by auto\nqed\n\nlemma R14 [simp]: \"pmf (sds R14) b = 0\" \"pmf (sds R14) d = 0\" \"pmf (sds R14) c = 1 - pmf (sds R14) a\"\n  using R14_R34.strategyproofness(1) R14.support lottery_conditions[OF R14.wf] \n  by (auto simp del: pmf_nonneg)\n\nlemma R46 [simp]: \"pmf (sds R46) a = 0\" \"pmf (sds R46) c = 0\" \"pmf (sds R46) d = 1 - pmf (sds R46) b\"\n  using R46_R37.strategyproofness(1) lottery_conditions[OF R46.wf] by auto\n\nlemma R20 [simp]: \"pmf (sds R20) a = 0\" \"pmf (sds R20) c = 0\" \"pmf (sds R20) d = 1 - pmf (sds R20) b\" \n  using R46_R20.strategyproofness(1) lottery_conditions[OF R20.wf] by (auto simp del: pmf_nonneg)\n\nlemma R21 [simp]: \"pmf (sds R21) d = 1 - pmf (sds R21) a\" \"pmf (sds R21) b = 0\" \"pmf (sds R21) c = 0\"\n  using R20_R21.strategyproofness(1) lottery_conditions[OF R21.wf] by auto\n\n\nlemma R16_R12: \"pmf (sds R16) c + pmf (sds R16) a \\<le> pmf (sds R12) a\"\n  using R12_R16.strategyproofness(1) R16.support lottery_conditions[OF R16.wf] by auto\n\nlemma R16 [simp]: \"pmf (sds R16) b = 0\" \"pmf (sds R16) c = 0\" \"pmf (sds R16) d = 1 - pmf (sds R16) a\"\nproof -\n  from R16_R12 have \"pmf (sds R16) c + pmf (sds R16) a \\<le> pmf (sds R12) a\" by simp\n  also from R44_R40.strategyproofness(1) lottery_conditions[OF R40.wf] R40.support\n    have \"pmf (sds R12) a \\<le> pmf (sds R40) a\" by auto\n  also from R9_R40.strategyproofness(1) R9.support R40.support \n    have \"pmf (sds R40) a \\<le> pmf (sds R9) a\" by auto\n  finally have \"pmf (sds R16) c + pmf (sds R16) a \\<le> pmf (sds R9) a\" by simp\n  moreover from R14_R16.strategyproofness(1) R16.support lottery_conditions[OF R16.wf] \n    have \"pmf (sds R16) a \\<ge> pmf (sds R14) a\" by auto\n  ultimately have \"pmf (sds R16) c \\<le> pmf (sds R9) a - pmf (sds R14) a\" by simp\n  also from R14_R9.strategyproofness(1) R9.support lottery_conditions[OF R9.wf]\n    have \"pmf (sds R9) a - pmf (sds R14) a \\<le> 0\" by (auto simp del: pmf_nonneg)\n  finally show \"pmf (sds R16) b = 0\" \"pmf (sds R16) c = 0\" \"pmf (sds R16) d = 1 - pmf (sds R16) a\"\n    using lottery_conditions[OF R16.wf] R16.support by auto\nqed\n\nlemma R12_R14: \"pmf (sds R14) a \\<le> pmf (sds R12) a\"\n  using R14_R16.strategyproofness(1) R16_R12 by auto\n\nlemma R12_a [simp]: \"pmf (sds R12) a = pmf (sds R9) a\"\nproof -\n  from R44_R40.strategyproofness(1) R40.support lottery_conditions[OF R40.wf] \n    have \"pmf (sds R12) a \\<le> pmf (sds R40) a\" by auto\n  also from R9_R40.strategyproofness(1) R9.support R40.support \n    have \"pmf (sds R40) a \\<le> pmf (sds R9) a\" by auto\n  finally have B: \"pmf (sds R12) a \\<le> pmf (sds R9) a\" by simp\n  moreover from R14_R9.strategyproofness(1) lottery_conditions[OF R9.wf] R9.support \n    have \"pmf (sds R9) a \\<le> pmf (sds R14) a\" by (auto simp del: pmf_nonneg)\n  with R12_R14 have \"pmf (sds R9) a \\<le> pmf (sds R12) a\" by simp\n  ultimately show \"pmf (sds R12) a = pmf (sds R9) a\" by simp\nqed\n\nlemma R9 [simp]: \"pmf (sds R9) b = 0\" \"pmf (sds R9) d = 0\" \"pmf (sds R14) a = pmf (sds R35) a\" \"pmf (sds R9) c = 1 - pmf (sds R35) a\"\n  using R12_R14 R14_R9.strategyproofness(1) lottery_conditions[OF R9.wf] R9.support\n  by auto\n\nlemma R23 [simp]: \"pmf (sds R23) b = 0\" \"pmf (sds R23) c = 0\" \"pmf (sds R23) d = 1 - pmf (sds R23) a\"\n  using R23_R19.strategyproofness(1) lottery_conditions[OF R23.wf] R23.support \n  by (auto simp del: pmf_nonneg)\n\nlemma R35 [simp]: \"pmf (sds R35) a = pmf (sds R21) a\" \"pmf (sds R35) b = 0\" \"pmf (sds R35) c = 0\" \"pmf (sds R35) d = 1 - pmf (sds R21) a\"\nproof -\n  from R35_R21.strategyproofness(1) R35.support\n    have \"pmf (sds R21) a \\<le> pmf (sds R35) a + pmf (sds R35) c\" by auto\n  with R21_R35.strategyproofness(1) R35.support lottery_conditions[OF R35.wf]\n    show \"pmf (sds R35) a = pmf (sds R21) a\" \"pmf (sds R35) b = 0\" \n         \"pmf (sds R35) c = 0\" \"pmf (sds R35) d = 1 - pmf (sds R21) a\" by simp_all\nqed\n\nlemma R18 [simp]: \"pmf (sds R18) a = pmf (sds R14) a\" \"pmf (sds R18) b = 0\"\n                  \"pmf (sds R18) d = 0\" \"pmf (sds R18) c = 1 - pmf (sds R14) a\"\nproof -\n from R23_R12.strategyproofness(1)\n    have R21_R23: \"pmf (sds R21) a \\<le> pmf (sds R23) a\" by simp\n\n  from R23_R18.strategyproofness(1) \n    have \"pmf (sds R18) d \\<le> pmf (sds R21) a - pmf (sds R23) a\" by simp\n  also from R21_R23 have \"\\<dots> \\<le> 0\" by simp\n  finally show \"pmf (sds R18) d = 0\" by simp\n  with lottery_conditions[OF R18.wf] R18.support\n    show \"pmf (sds R18) a = pmf (sds R14) a\"\n         \"pmf (sds R18) c = 1 - pmf (sds R14) a\" by auto\nqed (insert R18.support, simp_all)\n\nlemma R4 [simp]: \"pmf (sds R4) a = pmf (sds R21) a\" \"pmf (sds R4) b = 0\"\n                 \"pmf (sds R4) c = 1 - pmf (sds R4) a\" \"pmf (sds R4) d = 0\"\nproof -\n  from R30_R21.strategyproofness(1) R30.support lottery_conditions[OF R30.wf] \n    have \"pmf (sds R4) c + pmf (sds R21) a \\<le> pmf (sds R4) c + pmf (sds R30) a\" by auto\n  also {\n    have \"pmf (sds R30) a \\<le> pmf (sds R47) a\"\n      using R47_R30.strategyproofness(1) R30.support R47.support \n             lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf] by auto\n    moreover from R4_R47.strategyproofness(1) R4.support R47.support\n           lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf]\n      have \"pmf (sds R4) c \\<le> pmf (sds R47) c\" by simp\n    ultimately have \"pmf (sds R4) c + pmf (sds R30) a \\<le> 1 - pmf (sds R47) d\" \n      using lottery_conditions[OF R47.wf] R47.support by simp\n  }\n  finally have \"pmf (sds R4) c + pmf (sds R14) a \\<le> 1\"\n    using lottery_conditions[OF R47.wf] by (auto simp del: pmf_nonneg)\n  with R4_R18.strategyproofness(1) lottery_conditions[OF R4.wf] R4.support\n    show \"pmf (sds R4) a = pmf (sds R21) a\" \"pmf (sds R4) b = 0\"\n         \"pmf (sds R4) c = 1 - pmf (sds R4) a\" \"pmf (sds R4) d = 0\" by auto\nqed\n\nlemma R8_d [simp]: \"pmf (sds R8) d = 1 - pmf (sds R8) a\"\n  and R8_c [simp]: \"pmf (sds R8) c = 0\"\n  and R26_a [simp]: \"pmf (sds R26) a = 1 - pmf (sds R8) a\"\nproof -\n  from R8_R26.strategyproofness(2) R8.support lottery_conditions[OF R8.wf] \n    have \"pmf (sds R26) a \\<le> pmf (sds R8) d\" by auto\n  with R26_R8.strategyproofness(2) R8.support lottery_conditions[OF R8.wf] \n    have \"pmf (sds R26) a = pmf (sds R8) d\" by auto\n  with R8_R26.strategyproofness(2) R8.support lottery_conditions[OF R8.wf]\n    show \"pmf (sds R8) c = 0\" \"pmf (sds R8) d = 1 - pmf (sds R8) a\" \n         \"pmf (sds R26) a = 1 - pmf (sds R8) a\" by (auto simp del: pmf_nonneg)\nqed\n\nlemma R21_R47: \"pmf (sds R21) d \\<le> pmf (sds R47) c\"\n  using R4_R47.strategyproofness(1) R4.support R47.support\n         lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf] \n  by auto\n\nlemma R30 [simp]: \"pmf (sds R30) a = pmf (sds R47) a\" \"pmf (sds R30) b = 0\" \n  \"pmf (sds R30) c = 0\" \"pmf (sds R30) d = 1 - pmf (sds R47) a\"\nproof -\n  have A: \"pmf (sds R30) a \\<le> pmf (sds R47) a\"\n    using R47_R30.strategyproofness(1) R30.support R47.support \n           lottery_conditions[OF R4.wf] lottery_conditions[OF R47.wf] by auto\n  with R21_R47 R30_R21.strategyproofness(1) \n    lottery_conditions[OF R30.wf] lottery_conditions[OF R47.wf]\n    show \"pmf (sds R30) a = pmf (sds R47) a\" \"pmf (sds R30) b = 0\" \n         \"pmf (sds R30) c = 0\" \"pmf (sds R30) d = 1 - pmf (sds R47) a\"\n      by (auto simp: R30.support R47.support simp del: pmf_nonneg) (* tricky step! *)\nqed\n\nlemma R31_c_ge_one_half: \"pmf (sds R31) c \\<ge> 1/2\"\nproof -\n  from R25.support have \"pmf (sds R25) a \\<ge> 1/2\"\n  proof\n    assume \"pmf (sds R25) c = 0\"\n    with R25_R36.strategyproofness(1) lottery_conditions[OF R36.wf]\n       show \"pmf (sds R25) a \\<ge> 1/2\" by (auto simp del: pmf_nonneg)\n  next\n    assume [simp]: \"pmf (sds R25) b = 0\"\n    from R36_R25.strategyproofness(1) lottery_conditions[OF R25.wf]\n      have \"pmf (sds R25) c + pmf (sds R25) a \\<le> pmf (sds R36) c + 1 / 2\" by auto\n    with R25_R36.strategyproofness(1) show \"pmf (sds R25) a \\<ge> 1/2\" by auto\n  qed\n  hence \"pmf (sds R26) a \\<ge> 1/2\"\n    using R25_R26.strategyproofness(1) lottery_conditions[OF R25.wf] by (auto simp del: pmf_nonneg)\n  with lottery_conditions[OF R47.wf]\n    have \"1/2 \\<le> pmf (sds R26) a + pmf (sds R47) d\" by (simp del: pmf_nonneg)\n  also have \"\\<dots> = 1 - pmf (sds R8) a + pmf (sds R47) d\" by simp\n  also from R4_R8.strategyproofness(1) \n    have \"1 - pmf (sds R8) a \\<le> pmf (sds R21) d\" by auto\n  also note R21_R47\n  also from R30_R41.strategyproofness(1) R41.support \n            lottery_conditions[OF R41.wf] lottery_conditions[OF R47.wf] \n    have \"pmf (sds R47) c + pmf (sds R47) d \\<le> pmf (sds R41) d\" by (auto simp del: pmf_nonneg)\n  also from R41_R31.strategyproofness(1) R41.support lottery_conditions[OF R31.wf] \n       lottery_conditions[OF R41.wf]  \n    have \"pmf (sds R41) d \\<le> pmf (sds R31) c\" by auto\n  finally show \"pmf (sds R31) c \\<ge> 1/2\" by simp\nqed\n\nlemma R31: \"pmf (sds R31) a = 0\" \"pmf (sds R31) c = 1/2\" \"pmf (sds R31) b + pmf (sds R31) d = 1/2\"\nproof -\n  from R2_R38.strategyproofness(1) lottery_conditions[OF R38.wf] \n    have A: \"pmf (sds R38) b + pmf (sds R38) d \\<ge> 1/2\" by auto\n  with R31_c_ge_one_half R31_R38.strategyproofness(1) \n        lottery_conditions[OF R31.wf] lottery_conditions[OF R38.wf]\n  have \"pmf (sds R38) b + pmf (sds R38) d = pmf (sds R31) d + pmf (sds R31) b\" by auto\n  with R31_c_ge_one_half A lottery_conditions[OF R31.wf] lottery_conditions[OF R38.wf]\n    show \"pmf (sds R31) a = 0\" \"pmf (sds R31) c = 1/2\" \"pmf (sds R31) b + pmf (sds R31) d = 1/2\"\n    by linarith+\nqed\n\nlemma absurd: False\n  using R31 R45_R31.strategyproofness(2) by simp\n\n\n(* TODO (Re-)move *)\n(* This is just to output a list of all the Strategy-Proofness conditions used in the proof *)\n(*\nML_val \\<open>\nlet\nval thms = @{thms\nR1_R2.strategyproofness(1)\nR1_R19.strategyproofness(1)\nR2_R1.strategyproofness(1)\nR2_R38.strategyproofness(1)\nR4_R8.strategyproofness(1)\nR4_R18.strategyproofness(1)\nR4_R47.strategyproofness(1)\nR5_R7.strategyproofness(1)\nR5_R10.strategyproofness(1)\nR5_R17.strategyproofness(1)\nR6_R19.strategyproofness(1)\nR6_R42.strategyproofness(1)\nR7_R43.strategyproofness(1)\nR8_R26.strategyproofness(2)\nR9_R18.strategyproofness(1)\nR9_R35.strategyproofness(1)\nR9_R40.strategyproofness(1)\nR10_R12.strategyproofness(1)\nR10_R15.strategyproofness(1)\nR10_R19.strategyproofness(1)\nR10_R36.strategyproofness(1)\nR12_R10.strategyproofness(1)\nR12_R16.strategyproofness(1)\nR12_R44.strategyproofness(1)\nR13_R15.strategyproofness(1)\nR13_R27.strategyproofness(1)\nR14_R9.strategyproofness(1)\nR14_R16.strategyproofness(1)\nR14_R34.strategyproofness(1)\nR15_R5.strategyproofness(1)\nR15_R7.strategyproofness(1)\nR15_R10.strategyproofness(1)\nR15_R13.strategyproofness(1)\nR17_R3.strategyproofness(1)\nR17_R5.strategyproofness(1)\nR17_R7.strategyproofness(1)\nR17_R11.strategyproofness(1)\nR18_R9.strategyproofness(1)\nR19_R1.strategyproofness(1)\nR19_R10.strategyproofness(1)\nR19_R27.strategyproofness(1)\nR20_R21.strategyproofness(1)\nR21_R35.strategyproofness(1)\nR22_R29.strategyproofness(1)\nR22_R32.strategyproofness(1)\nR23_R12.strategyproofness(1)\nR23_R18.strategyproofness(1)\nR23_R19.strategyproofness(1)\nR24_R34.strategyproofness(1)\nR25_R26.strategyproofness(1)\nR25_R36.strategyproofness(1)\nR26_R8.strategyproofness(2)\nR27_R13.strategyproofness(1)\nR27_R19.strategyproofness(1)\nR28_R32.strategyproofness(1)\nR28_R39.strategyproofness(1)\nR29_R39.strategyproofness(1)\nR30_R21.strategyproofness(1)\nR30_R41.strategyproofness(1)\nR31_R38.strategyproofness(1)\nR32_R22.strategyproofness(1)\nR32_R28.strategyproofness(1)\nR33_R5.strategyproofness(1)\nR33_R22.strategyproofness(1)\nR34_R24.strategyproofness(1)\nR35_R9.strategyproofness(1)\nR35_R21.strategyproofness(1)\nR36_R10.strategyproofness(1)\nR36_R25.strategyproofness(1)\nR36_R39.strategyproofness(1)\nR37_R42.strategyproofness(1)\nR37_R42.strategyproofness(2)\nR39_R2.strategyproofness(1)\nR39_R29.strategyproofness(1)\nR39_R36.strategyproofness(1)\nR41_R31.strategyproofness(1)\nR42_R3.strategyproofness(1)\nR42_R11.strategyproofness(1)\nR42_R24.strategyproofness(1)\nR44_R12.strategyproofness(1)\nR44_R40.strategyproofness(1)\nR45_R31.strategyproofness(2)\nR46_R20.strategyproofness(1)\nR46_R37.strategyproofness(1)\nR47_R30.strategyproofness(1)\n};\nin\n thms\n |> map (Pretty.quote o Pretty.str o Pretty.unformatted_string_of o Syntax.pretty_term @{context} o Thm.prop_of)\n |> Pretty.list \"[\" \"]\"\n |> (fn x => Pretty.block [Pretty.str \"thms = \", x])\n |> Pretty.string_of\n |> writeln\nend\n\\<close>*)\n\nend\n\n\nsubsection \\<open>Lifting to more than 4 agents and alternatives\\<close>\n\n(* TODO: Move? *)\nlemma finite_list':\n  assumes \"finite A\"\n  obtains xs where \"A = set xs\" \"distinct xs\" \"length xs = card A\"\nproof -\n  from assms obtain xs where \"set xs = A\" using finite_list by blast\n  thus ?thesis using distinct_card[of \"remdups xs\"]\n    by (intro that[of \"remdups xs\"]) simp_all\nqed\n\nlemma finite_list_subset:\n  assumes \"finite A\" \"card A \\<ge> n\"\n  obtains xs where \"set xs \\<subseteq> A\" \"distinct xs\" \"length xs = n\"\nproof -\n  obtain xs where \"A = set xs\" \"distinct xs\" \"length xs = card A\"\n    using finite_list'[OF assms(1)] by blast\n  with assms show ?thesis\n    by (intro that[of \"take n xs\"]) (simp_all add: set_take_subset)\nqed\n\nlemma card_ge_4E:\n  assumes \"finite A\" \"card A \\<ge> 4\"\n  obtains a b c d where \"distinct [a,b,c,d]\" \"{a,b,c,d} \\<subseteq> A\"\nproof -\n  from assms obtain xs where xs: \"set xs \\<subseteq> A\" \"distinct xs\" \"length xs = 4\"\n    by (rule finite_list_subset)\n  then obtain a b c d where \"xs = [a, b, c, d]\" \n    by (auto simp: eval_nat_numeral length_Suc_conv)\n  with xs show ?thesis by (intro that[of a b c d]) simp_all\nqed\n\n\ncontext sds_impossibility\nbegin\n\nlemma absurd: False\nproof -\n  from card_ge_4E[OF finite_agents agents_ge_4]\n  obtain A1 A2 A3 A4 where agents: \"distinct [A1, A2, A3, A4]\" \"{A1, A2, A3, A4} \\<subseteq> agents\" .\n  from card_ge_4E[OF finite_alts alts_ge_4]\n  obtain a b c d where alts: \"distinct [a, b, c, d]\" \"{a, b, c, d} \\<subseteq> alts\" .\n  define agents' alts' where \"agents' = {A1,A2,A3,A4}\" and \"alts' = {a,b,c,d}\"\n  from agents alts \n    interpret sds_lowering_anonymous_neutral_sdeff_stratproof agents alts sds agents' alts'\n    unfolding agents'_def alts'_def by unfold_locales simp_all\n  from agents alts \n    interpret sds_impossibility_4_4 agents' alts' lowered A1 A2 A3 A4 a b c d\n    by unfold_locales (simp_all add: agents'_def alts'_def)\n  from absurd show False .\nqed\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/SDS_Impossibility/SDS_Impossibility.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.32020412364706874}}
{"text": "theory SchleierNichtwissen\nimports BeispielPerson Handlung Maxime Swap\nbegin\n\nsection\\<open>Schleier des Nichtwissens\\<close>\ntext\\<open>In diesem Abschnitt werden wir,\nbasierend auf der Idee von Rawls Schleier des Nitchwissens,\ndefinieren, was eine wohlgeformte Handlungsabsicht und eine wohlgeformte Maxime sind.\\<close>\n\n\ntext\\<open>\nRawls' Schleier des Nichtwissens \\<^url>\\<open>https://de.wikipedia.org/wiki/Schleier_des_Nichtwissens\\<close>\nist ein fiktives Modell, in der Personen\n>>über die zukünftige Gesellschaftsordnung entscheiden können,\naber selbst nicht wissen,\nan welcher Stelle dieser Ordnung sie sich später befinden werden,\nalso unter einem „Schleier des Nichtwissens“ stehen.<< Quote wikipedia\n\n\nWir bedienen uns bei der Idee dieses Modells um gültige Handlungsabsichten und Maximen\nzu definieren.\nHandlungsabsichten und Maximen sind nur gültig, wenn darin keine Personen hardgecoded werden.\n\nBeispielsweise ist folgende Handlungsabsicht ungültig:\n\\<^term>\\<open>\\<lambda>ich welt. if ich = Alice then Do_A welt else Do_B welt\\<close>\n\nHandlungsabsichten und Maximen müssen immer generisch geschrieben werden,\nso dass die handelnden und betroffenen Personen niemals anhand ihres Namens ausgewählt werden.\n\nunser Modell von Handlungsabsichten und Maximen stellt beispielsweise die\nhandelnde Person als Parameter bereit.\nFolgendes ist also eine gültige Handlung:\n\\<^term>\\<open>\\<lambda>ich welt. ModifiziereWelt welt ich\\<close>\n\nAuch ist es erlaubt, Personen in einer Handlungsabsicht oder Maxime nur anhand ihrer\nEigenschaften in der Welt auszuwählen.\nFolgendes wäre eine wohlgeformte Handlung, wenn auch eine moralisch fragwürdige:\n\\<^term>\\<open>\\<lambda>ich welt. enteignen ` {opfer. besitz opfer > besitz ich}\\<close>\n\nUm diese Idee von wohlgeformten Handlungsabsichten und Maximen zu formalisieren bedienen\nwir uns der Idee des Schleiers des Nichtwissens.\nWir sagen, dass Handlungsabsichten wohlgeformt sind, wenn die Handlungsabsicht gleich bleibt,\nwenn man sowohl die handelnde Person austauscht,\nals auch alle weltlichen Eigenschaften dieser Person.\nAnders ausgedrückt: Wohlgeformte Handlungsabsichten und Maximen sind solche,\nbei denen bei der Definition noch nicht feststeht, auf we sie später zutreffen.\n\\<close>\n\ntext\\<open>Für jede Welt muss eine Welt-Personen Swap (wps) Funktion bereit gestellt werden,\ndie alle Weltlichen Eigenschaften von 2 Personen vertauscht:\\<close>\ntype_synonym ('person, 'welt) wp_swap = \\<open>'person \\<Rightarrow> 'person \\<Rightarrow> 'welt \\<Rightarrow> 'welt\\<close>\n\ntext\\<open>Ein jeder \\<^typ>\\<open>('person, 'welt) wp_swap\\<close> sollte mindestens folgendes erfüllen:\\<close>\ndefinition wps_id :: \\<open>('person, 'welt) wp_swap \\<Rightarrow> 'welt \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>wps_id wps welt \\<equiv> \\<forall>p1 p2. wps p2 p1 (wps p1 p2 welt) = welt\\<close>\n\n\ntext_raw\\<open>\n\\begin{equation*}\n\\begin{tikzcd}[column sep=14em, row sep=huge]\n\\textit{welt}\n  \\arrow[red, d, \"\\textit{wps}\\ \\textit{p1}\\ \\textit{p2}\" near start]\n  \\arrow[blue, r, \"\\textit{handeln}\\ \\textit{p1}\"]\n& \\textit{welt'} \\\\\n\\textit{alternativ-welt}\n  \\arrow[red, r, \"\\textit{handeln}\\ \\textit{p2}\"]\n& \\textit{alternativ-welt'}\n  \\arrow[red, u, \"\\textit{wps}\\ \\textit{p1}\\ \\textit{p2}\" near start]\n\\end{tikzcd}\n\\end{equation*}\n\\<close>\n\nsubsection\\<open>Wohlgeformte Handlungsabsicht\\<close>\ntext\\<open>Wir sagen, eine Handlungsabsicht ist wohlgeformt,\ngenau dann wenn sie obiges kommutatives Diagramm erfüllt,\nd.h. wenn folgendes equivalent ist\n  \\<^item> handeln in einer Welt.\n  \\<^item> zwei Personen in einer Welt zu vertauschen, in der veränderten Welt zu handeln,\n    und die beiden Personen wieder zurück tauschen.\\<close>\n\nfun wohlgeformte_handlungsabsicht\n  :: \\<open>('person, 'welt) wp_swap \\<Rightarrow> 'welt \\<Rightarrow> ('person, 'welt) handlungsabsicht \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>wohlgeformte_handlungsabsicht wps welt (Handlungsabsicht h) =\n   (\\<forall>p1 p2. h p1 welt = map_option (wps p2 p1) (h p2 (wps p1 p2 welt)))\\<close>\n\n(*<*)\ndeclare wohlgeformte_handlungsabsicht.simps[simp del]\n\nlemma wohlgeformte_handlungsabsicht_ausfuehrbar:\n  \\<open>wohlgeformte_handlungsabsicht wps welt ha \\<Longrightarrow>\n        \\<forall>p1 p2. ausfuehrbar p1 welt ha \\<longleftrightarrow> ausfuehrbar p2 (wps p1 p2 welt) ha\\<close>\n  apply(cases \\<open>ha\\<close>, simp add: wohlgeformte_handlungsabsicht.simps)\n  by (metis ausfuehrbar.simps option.map_disc_iff)\n\n\n(*rueckrichtung gilt nicht*)\nlemma wohlgeformte_handlungsabsicht_mit_wpsid:\n  \\<open>wohlgeformte_handlungsabsicht wps welt ha \\<Longrightarrow>\n   wps_id wps welt \\<Longrightarrow>\n    \\<forall>p1 p2. handeln p1 welt ha =\n            map_handlung (wps p2 p1) (handeln p2 (wps p1 p2 welt) ha)\\<close>\n  apply(cases \\<open>ha\\<close>, simp add: wohlgeformte_handlungsabsicht.simps)\n  apply(simp add: handeln_def nachher_handeln.simps)\n  apply(safe)\n   apply(simp add: wps_id_def; fail)\n  apply(erule_tac x=\\<open>p1\\<close> in allE)\n  apply(erule_tac x=\\<open>p2\\<close> in allE)\n  apply(simp)\n  apply(simp split: option.split)\n  apply(simp add: wps_id_def)\n  done\n(*>*)\n\n\n(*TODO: gilt die rueckrichting?*)\ntext\\<open>Folgende Folgerung erklärt die Definition vermutlich besser:\\<close>\nlemma wohlgeformte_handlungsabsicht_wpsid_imp_handeln:\n  \\<open>wohlgeformte_handlungsabsicht wps welt ha \\<Longrightarrow> wps_id wps welt \\<Longrightarrow>\n    (\\<forall>p1 p2. handeln p1 welt ha =\n                Handlung welt\n                        (wps p2 p1 (nachher_handeln p2 (wps p1 p2 welt) ha)))\\<close>\n  apply(drule(1) wohlgeformte_handlungsabsicht_mit_wpsid)\n  apply(cases \\<open>ha\\<close>, simp add: wohlgeformte_handlungsabsicht.simps handeln_def)\n  done\n(*TODO: das sollte ein Homomorphismus sein.*)\n\ntext\\<open>Folgendes Lemma erlaubt es uns das kommutative Diagramm auch leicht anders zu zeichnen.\\<close>\nlemma wohlgeformte_handlungsabsicht_wpsid_wpssym_komm:\n  assumes wpsid: \\<open>\\<forall>welt. wps_id wps welt\\<close>\n    and wps_sym: \\<open>\\<forall>welt. wps p1 p2 welt = wps p2 p1 welt\\<close>\n  shows \\<open>wohlgeformte_handlungsabsicht wps (wps p1 p2 welt) ha \\<Longrightarrow>\n    handeln p1 (wps p1 p2 welt) ha =\n            map_handlung (wps p1 p2) (handeln p2 welt ha)\\<close>\n  apply(drule wohlgeformte_handlungsabsicht_mit_wpsid)\n  subgoal using wpsid by simp\n  apply(erule_tac x=\\<open>p1\\<close> in allE)\n  apply(erule_tac x=\\<open>p2\\<close> in allE)\n  apply(subgoal_tac \\<open>wps p1 p2 (wps p1 p2 welt) = welt\\<close>)\n   prefer 2\n   apply (metis wps_id_def wps_sym wpsid)\n  apply(simp add: )\n  apply(subgoal_tac \\<open>wps p2 p1 = wps p1 p2\\<close>)\n   prefer 2 using wps_sym apply presburger\n  by simp\n\n  text_raw\\<open>\n\\begin{equation*}\n\\begin{tikzcd}[column sep=14em, row sep=huge]\n\\textit{welt}\n  \\arrow[blue, d, \"\\textit{wps}\\ \\textit{p1}\\ \\textit{p2}\" near start]\n  \\arrow[red, r, \"\\textit{handeln}\\ \\textit{p2}\"]\n& \\textit{welt'} \n  \\arrow[red, d, \"\\textit{wps}\\ \\textit{p1}\\ \\textit{p2}\" near start]\\\\\n\\textit{alternativ-welt}\n  \\arrow[blue, r, \"\\textit{handeln}\\ \\textit{p1}\"]\n& \\textit{alternativ-welt'}\n\\end{tikzcd}\n\\end{equation*}\n\\<close>\n\n(*<*)\nlemma wfh_handeln_imp_wpsid:\n  \\<open>(\\<forall>p1 p2. handeln p1 welt ha =\n            map_handlung (wps p2 p1) (handeln p2 (wps p1 p2 welt) ha)) \\<Longrightarrow>\n  wps_id wps welt\\<close>\n  by(cases \\<open>ha\\<close>, simp add: wps_id_def handeln_def)\n\nlemma wohlgeformte_handlungsabsicht_wpsid_simp:\n  \\<open>wohlgeformte_handlungsabsicht wps welt ha \\<and> wps_id wps welt\n  \\<longleftrightarrow>\n      (\\<forall>p1 p2. ausfuehrbar p1 welt ha \\<longleftrightarrow> ausfuehrbar p2 (wps p1 p2 welt) ha)\n      \\<and> (\\<forall>p1 p2. handeln p1 welt ha =\n                 map_handlung (wps p2 p1) (handeln p2 (wps p1 p2 welt) ha))\\<close>\n  apply(rule iffI)\n  using wohlgeformte_handlungsabsicht_ausfuehrbar wohlgeformte_handlungsabsicht_mit_wpsid apply fast\n  apply(rule conjI)\n   prefer 2 using wfh_handeln_imp_wpsid apply fast\n  apply(cases \\<open>ha\\<close>, simp add: wohlgeformte_handlungsabsicht.simps handeln_def nachher_handeln.simps)\n  apply(intro allI, rename_tac h p1 p2)\n  apply(case_tac \\<open>h p2 (wps p1 p2 welt)\\<close>)\n   apply(simp)\n   apply (metis ausfuehrbar.simps)\n  apply(simp add: ausfuehrbar.simps)\n  apply(clarsimp)\n  apply(erule_tac x=\\<open>p1\\<close> in allE)\n  apply(erule_tac x=\\<open>p1\\<close> in allE)\n  apply(erule_tac x=\\<open>p2\\<close> in allE)\n  apply(erule_tac x=\\<open>p2\\<close> in allE)\n  apply(simp split: option.split_asm)\n  done\n\nlemma wohlgeformte_handlungsabsicht_ifI:\n  \\<open>wohlgeformte_handlungsabsicht wps welt (Handlungsabsicht h1) \\<Longrightarrow>\n   wohlgeformte_handlungsabsicht wps welt (Handlungsabsicht h2) \\<Longrightarrow>\n   (\\<And>p1 p2. P p1 welt \\<longleftrightarrow> P p2 (wps p1 p2 welt)) \\<Longrightarrow>\n   wohlgeformte_handlungsabsicht wps welt\n      (Handlungsabsicht (\\<lambda>ich welt. if P ich welt then h1 ich welt else h2 ich welt))\\<close>\n  by(simp add: wohlgeformte_handlungsabsicht.simps)\n(*>*)\n\n\ntext\\<open>In einigen späteren Beispielen möchten wir zeigen, dass bestimmte Handlungsabsichten\nnicht wohlgeformt sind.\\<close>\nfun wohlgeformte_handlungsabsicht_gegenbeispiel\n  :: \\<open>('person, 'welt) wp_swap \\<Rightarrow> 'welt \\<Rightarrow> ('person, 'welt) handlungsabsicht \\<Rightarrow> 'person \\<Rightarrow> 'person \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>wohlgeformte_handlungsabsicht_gegenbeispiel wps welt (Handlungsabsicht h) taeter opfer \\<longleftrightarrow>\n  h taeter welt \\<noteq> map_option (wps opfer taeter) (h opfer (wps taeter opfer welt))\\<close>\n\nlemma\n  \\<open>\\<exists>p1 p2. wohlgeformte_handlungsabsicht_gegenbeispiel wps welt ha p1 p2 \\<longleftrightarrow>\n        \\<not>wohlgeformte_handlungsabsicht wps welt ha\\<close>\n  apply(cases \\<open>ha\\<close>, simp add: wohlgeformte_handlungsabsicht.simps)\n  by blast\n\n\n\n\n(*<*)\ntext\\<open>Assume we have a compound datatype, consisting of the parts selected by \\<^term>\\<open>sel\\<close>\nand the parts selected by \\<^term>\\<open>sel_other\\<close>.\nTogether, they build the complete datatype.\nBut we can reason about \\<^const>\\<open>map_option\\<close> equivalence in isolation.\\<close>\nlemma datatype_split_map_option_equal:\n  \\<open>map_option sel w1 = map_option sel w2 \\<Longrightarrow>\n   (\\<And> w. makeZ (sel w) (sel_other w) = w) \\<Longrightarrow>\n   map_option sel_other w1 = map_option sel_other w2 \\<Longrightarrow>\n  w1 = w2\\<close>\n  by (metis (no_types, lifting) None_eq_map_option_iff option.exhaust_sel option.map_sel)\n\ntext\\<open>Assume we have a compound complex world \\<^typ>\\<open>'zw\\<close>.\nAssume we have a simpler sub-world \\<^typ>\\<open>'w\\<close>.\nAssume we have a Handlungsabsicht in this simpler sub-world \\<^term_type>\\<open>ha :: 'person \\<Rightarrow> 'w \\<Rightarrow> 'w option\\<close>\nwhich only modifies the sub-world.\nThen we can lift \\<^const>\\<open>wohlgeformte_handlungsabsicht\\<close> from the sub-world to the compound world.\n\n\\<^term>\\<open>makeZ\\<close> is basically the constructor which combines the simpler sub-world with other stuff\nto the complicated compound world.\n\nThe \\<^term_type>\\<open>sel :: 'zw \\<Rightarrow> 'w\\<close> selects the parts of the compound world which are modified.\nThe \\<^term_type>\\<open>sel_other :: 'zw \\<Rightarrow> 'a\\<close> selects the parts of the compound world which are not modified.\\<close>\n  lemma wfh_generalize_worldI:\n  fixes wps :: \\<open>('person, 'w) wp_swap\\<close> \\<comment>\\<open>swap in the simple world\\<close>\n    and zwps :: \\<open>('person, 'zw) wp_swap\\<close> \\<comment>\\<open>swap in the compound world\\<close>\n    and welt :: \\<open>'w\\<close> \\<comment>\\<open>the simple world\\<close>\n    and zwelt :: \\<open>'zw\\<close> \\<comment>\\<open>the compound world\\<close>\n    and ha :: \\<open>'person \\<Rightarrow> 'w \\<Rightarrow> 'w option\\<close>\n    and sel :: \\<open>'zw \\<Rightarrow> 'w\\<close> \\<comment>\\<open>selects the parts from the compound wold which are modified.\\<close>\n    and makeZ :: \\<open>'w \\<Rightarrow> 'other \\<Rightarrow> 'zw\\<close> \\<comment>\\<open>builds the compound world from the simple world and other stuff\\<close>\n  assumes wf_ha: \\<open>wohlgeformte_handlungsabsicht wps welt (Handlungsabsicht ha)\\<close>\n  and     sel_welt: \\<open>sel zwelt = welt\\<close>\n  and     sel_wps: \\<open>\\<And>p1 p2 zw. wps p1 p2 (sel zw) = sel (zwps p1 p2 zw)\\<close>\n  and     sel_ha: \\<open>\\<And>p zw. ha p (sel zw) = map_option sel (zha p zw)\\<close>\n  and     make_whole: \\<open>\\<And> w. makeZ (sel w) (sel_other w) = w\\<close>\n\n  and not_touches_other:\n      \\<open>\\<And>p welt welt'. zha p welt = Some welt' \\<Longrightarrow> sel_other welt' = sel_other welt\\<close>\n  and iff_None: \\<open>\\<And>p1 p2 welt. zha p1 welt = None \\<longleftrightarrow> zha p2 (zwps p1 p2 welt) = None\\<close>\n  and makeZ_pullout:\n    \\<open>\\<And>p1 p2 a b. makeZ (sel (zwps p2 p1 a)) (sel_other (zwps p2 p1 b)) = zwps p2 p1 (makeZ (sel a) (sel_other b))\\<close>\n  and wpsid: \\<open>\\<And> welt p1 p2. zwps p2 p1 (zwps p1 p2 welt) = welt\\<close>\n  and wps_sym: \\<open>\\<And>welt p1 p2. zwps p1 p2 welt = zwps p2 p1 welt\\<close>\n\n  shows\n    \\<open>wohlgeformte_handlungsabsicht zwps zwelt (Handlungsabsicht zha)\\<close>\nproof -         \n  from wf_ha sel_welt sel_wps sel_ha have wohlgeformt_sel:\n    \\<open>map_option sel (zha p1 zwelt) = map_option sel (map_option (zwps p2 p1) (zha p2 (zwps p1 p2 zwelt)))\\<close>\n    for p1 p2\n    apply(simp add: wohlgeformte_handlungsabsicht.simps)\n    apply(clarsimp)\n    apply(erule_tac x=\\<open>p1\\<close> in allE)\n    apply(erule_tac x=\\<open>p2\\<close> in allE)\n    apply(simp add: option.map_comp)\n    apply(subgoal_tac \\<open>wps p2 p1 \\<circ> sel = sel \\<circ> zwps p2 p1\\<close>)\n     prefer 2\n     apply fastforce\n    apply(simp)\n    done\n\n  have wohlgeformt_sel_on_wps_zwelt:\n    \\<open>map_option sel (zha p2 (zwps p1 p2 zwelt)) =\n      map_option sel (map_option (zwps p1 p2) (zha p1 (zwps p2 p1 (zwps p1 p2 zwelt))))\\<close>\n    for p2 p1\n    using wohlgeformt_sel[of \\<open>p1\\<close> \\<open>p2\\<close>]\n    apply(simp add: wpsid)\n    apply(cases \\<open>zha p1 zwelt\\<close>)\n     apply(simp; fail)\n    apply(cases \\<open>zha p2 (zwps p1 p2 zwelt)\\<close>)\n     apply(simp; fail)\n    apply(simp)\n    by (metis wpsid sel_wps)\n\n  from wps_sym have not_touches_other_wps:\n    \\<open>zha p2 (zwps p1 p2 welt) = Some welt'\n                          \\<Longrightarrow> sel_other welt' = sel_other (zwps p2 p1 welt)\\<close>\n    for p1 p2 welt welt'\n    using not_touches_other[of \\<open>p2\\<close> \\<open>(zwps p1 p2 welt)\\<close>] by simp\n\n  have wpsid': \\<open>zwps p2 p1 (zwps p2 p1 w) = w\\<close> for w p1 p2\n    using wps_sym wpsid by simp\n\n  have sel_wps_propagate:\n    \\<open>zha p2 (zwps p1 p2 zwelt) = Some welt'\n      \\<Longrightarrow> sel welt' = sel (the (map_option (zwps p2 p1) (zha p1 zwelt)))\\<close>\n    for welt' p1  p2\n    using wohlgeformt_sel_on_wps_zwelt[of \\<open>p2\\<close> \\<open>p1\\<close>]\n    apply(simp add: wpsid)\n    apply(case_tac \\<open>zha p1 zwelt\\<close>)\n     apply(simp; fail)\n    apply(simp)\n    using wps_sym by presburger\n\n  have sel_other_makeZ:\n    \\<open>zha p1 zwelt = Some welt' \\<Longrightarrow>\n       sel_other zwelt = sel_other (makeZ (sel welt') (sel_other zwelt))\\<close>\n    for welt' p1\n    apply -\n    apply(drule not_touches_other[symmetric])\n    using make_whole[of \\<open>welt'\\<close>] by simp\n\n  have wohlgeformt_sel_other:\n    \\<open>map_option sel_other (zha p1 zwelt) =\n                 map_option sel_other (map_option (zwps p2 p1) (zha p2 (zwps p1 p2 zwelt)))\\<close>\n    for p1 p2\n  proof -\n    let \\<open>?w\\<close>=\\<open>zha p2 (zwps p1 p2 zwelt)\\<close>\n    let \\<open>?ignoreMe\\<close>=\\<open>case ?w of Some w \\<Rightarrow> sel w\\<close>\n  \n    have ignoreMe: \\<open>?w \\<noteq> None \\<Longrightarrow> makeZ ?ignoreMe (sel_other (the ?w)) = the ?w\\<close>\n      apply (cases \\<open>?w\\<close>)\n       apply(simp; fail)\n      apply(simp)\n      using make_whole by simp\n  \n    have shuffle_sel:\n      \\<open>map_option (sel_other \\<circ> zwps p2 p1) ?w =\n        map_option (sel_other \\<circ> zwps p2 p1 \\<circ> (\\<lambda>other. makeZ ?ignoreMe other) \\<circ> sel_other) ?w\\<close>\n      for p1 p2\n      apply(cases \\<open>?w\\<close>)\n       apply(simp; fail)\n      apply(simp)\n      using ignoreMe by simp\n\n    show \\<open>?thesis\\<close>\n    apply(cases \\<open>zha p1 zwelt\\<close>)\n     apply(simp)\n     using iff_None apply blast\n    apply(simp add: not_touches_other[of \\<open>p1\\<close>])\n     apply(simp add: option.map_comp)\n    apply(subst shuffle_sel)\n    apply(case_tac \\<open>zha p2 (zwps p1 p2 zwelt)\\<close>)\n     apply(simp)\n     using iff_None apply force\n    apply(simp)\n    apply(frule not_touches_other_wps, simp)\n    apply(simp add: sel_wps_propagate)\n    apply(simp add: makeZ_pullout)\n    apply(simp add: wpsid')\n     using sel_other_makeZ by simp\n qed\n\n  from datatype_split_map_option_equal[OF wohlgeformt_sel make_whole wohlgeformt_sel_other] make_whole have\n    \\<open>(zha p1 zwelt) = (map_option (zwps p2 p1) (zha p2 (zwps p1 p2 zwelt)))\\<close>\n    for p1 p2\n    by simp\n  then show \\<open>?thesis\\<close>\n  by(simp add: wohlgeformte_handlungsabsicht.simps )\nqed\n\n(*TODO: can we derive wfh_generalize_world_ConstrI from wfh_generalize_worldI?*)\nthm wfh_generalize_worldI[where makeZ=\\<open>\\<lambda>w other. C w\\<close> and sel=\\<open>\\<lambda>zw. (inv C) zw\\<close>\n                                and zha=\\<open>zha\\<close> and zwelt=\\<open>C welt\\<close> and zwps=\\<open>zwps\\<close>]\nlemma \\<open>inj C \\<Longrightarrow> inv C (C welt) = welt\\<close> by(simp)\n\ntext\\<open>Wenn sich eine einfache Welt \\<^typ>\\<open>'w\\<close> in eine komplexere Welt \\<^typ>\\<open>'zw\\<close> übersetzen lässt,\n(wobei die Übersetzung hier \\<^term>\\<open>C::'w \\<Rightarrow> 'zw\\<close> ist),\ndann kann auch \\<^const>\\<open>wohlgeformte_handlungsabsicht\\<close> mit übersetzt werden.\n\nThis is basically @{thm wfh_generalize_worldI}, but instead of \\<^term>\\<open>sel\\<close>,\nwe have the opposite: Constructor \\<^term>\\<open>C\\<close>.\\<close>\nlemma wfh_generalize_world_ConstrI:\n  fixes wps :: \\<open>('person, 'w) wp_swap\\<close>\n    and welt :: \\<open>'w\\<close>\n    and ha :: \\<open>'person \\<Rightarrow> 'w \\<Rightarrow> 'w option\\<close>\n    and C :: \\<open>'w \\<Rightarrow> 'zw\\<close>\n  shows\n\\<open>wohlgeformte_handlungsabsicht wps welt (Handlungsabsicht (ha)) \\<Longrightarrow>\n  zwelt = C welt \\<Longrightarrow>\n  (\\<And>p1 p2 w. zwps p1 p2 (C w) = C (wps p1 p2 w)) \\<Longrightarrow>\n  (\\<And>p w. zha p (C w) =  map_option C (ha p w)) \\<Longrightarrow>\nwohlgeformte_handlungsabsicht zwps zwelt (Handlungsabsicht (zha))\\<close>\n  apply(simp)\n  apply(simp add: wohlgeformte_handlungsabsicht.simps)\n  apply(clarsimp)\n  apply(erule_tac x=\\<open>p1\\<close> in allE)\n  apply(erule_tac x=\\<open>p2\\<close> in allE)\n  apply(simp)\n  apply(simp add: option.map_comp)\n  apply(simp add: comp_def)\n  done\n(*>*)\n\n\nsubsection\\<open>Spezialfall: Maxime und Handlungsabsichten haben nette Eigenschaften\\<close>\ntext\\<open>Dieses Kapitel darf gerne übersprungen werden,\nda der Spezialfall nur in bestimmten Beweisen interessant wird.\\<close>\n\ntext\\<open>Nach der gleichen Argumentation müssten Maxime und Handlungsabsicht so generisch sein,\ndass sie in allen Welten zum gleichen Ergebnis kommen.\nDies gilt jedoch nicht immer.\nWenn dieser Sonderfall eintritt sagen wir, Maxime und Handlungsabsicht generalisieren.\\<close>\ndefinition maxime_und_handlungsabsicht_generalisieren\n  :: \\<open>('person, 'welt) wp_swap \\<Rightarrow> 'welt \\<Rightarrow> \n      ('person, 'welt) maxime \\<Rightarrow> ('person, 'welt) handlungsabsicht \\<Rightarrow> 'person \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>maxime_und_handlungsabsicht_generalisieren wps welt m ha p =\n    (\\<forall>p1 p2. (ausfuehrbar p welt ha \\<and> ausfuehrbar p (wps p1 p2 welt) ha)\n              \\<longrightarrow> okay m p (handeln p welt ha) \\<longleftrightarrow> okay m p (handeln p (wps p1 p2 welt) ha))\\<close>\ntext\\<open>Die Vorbedingungen in obiger Definition,\nnämlich dass die Handlungsabsicht \\<^const>\\<open>ausfuehrbar\\<close> ist,\nist nötig, um z.B. Handlungsabsichten wie das Stehlen zu ermöglichen;\njedoch gibt es beim Stehlen genau den pathologischen Grenzfall von-sich-selbst Stehlen,\nwelcher in einer No-Op endet und das Ergebnis damit nicht moralisch falsch ist.\nDurch die Einschränkung auf \\<^const>\\<open>ausfuehrbar\\<close> Fälle lassen sich solche pathologischen Grenzfälle\nausklammern.\\<close>\n\ntext\\<open>Für eine gegebene Maxime schließt die Forderung\n\\<^const>\\<open>maxime_und_handlungsabsicht_generalisieren\\<close> leider einige Handlungen aus.\nBeispiel:\nIn einer Welt besitzt \\<^const>\\<open>Alice\\<close> 2 und \\<^const>\\<open>Eve\\<close> hat 1 Schulden.\nDie Maxime ist, dass Individuen gerne keinen Besitz verlieren.\nDie Handlung sei ein globaler reset, bei dem jeden ein Besitz von 0 zugeordnet wird.\nLeider generalisiert diese Handlung nicht, da \\<^const>\\<open>Eve\\<close> die Handlung gut findet,\n\\<^const>\\<open>Alice\\<close> allerdings nicht.\n\\<close>\nbeispiel\n   \\<open>\\<not> maxime_und_handlungsabsicht_generalisieren\n      swap\n      ((\\<lambda>x. 0)(Alice := (2::int), Eve := - 1))\n      (Maxime (\\<lambda>ich h. (vorher h) ich \\<le> (nachher h) ich))\n      (Handlungsabsicht (\\<lambda>ich w. Some (\\<lambda>_. 0)))\n      Eve\\<close>\n  apply(simp add: maxime_und_handlungsabsicht_generalisieren_def )\n  apply(simp add: ist_noop_def fun_eq_iff handeln_def nachher_handeln.simps)\n  by(code_simp)\n\n(*<*)\nlemma maxime_und_handlungsabsicht_generalisieren_MaximeConj:\n  \\<open>maxime_und_handlungsabsicht_generalisieren wps welt m1 ha p\n    \\<and> maxime_und_handlungsabsicht_generalisieren wps welt m2 ha p\n  \\<Longrightarrow>maxime_und_handlungsabsicht_generalisieren wps welt (MaximeConj m1 m2) ha p\\<close>\n  apply(simp add: maxime_und_handlungsabsicht_generalisieren_def okay_MaximeConj)\n  apply(clarsimp)\n  done\n\n(*there is an \\<and> in there, not an \\<or>*)\nlemma maxime_und_handlungsabsicht_generalisieren_MaximeDisj_Conj:\n  \\<open>maxime_und_handlungsabsicht_generalisieren wps welt m1 ha p\n    \\<and> maxime_und_handlungsabsicht_generalisieren wps welt m2 ha p\n    \\<Longrightarrow> maxime_und_handlungsabsicht_generalisieren wps welt (MaximeDisj m1 m2) ha p\\<close>\n  apply(simp add: maxime_und_handlungsabsicht_generalisieren_def okay_MaximeDisj)\n  apply(clarsimp)\n  done\n(*>*)\n  \n  \n\n\ntext\\<open>Die Maxime und \\<^typ>\\<open>('person, 'welt) wp_swap\\<close> können einige Eigenschaften erfüllen.\n\nWir kürzen das ab mit \\<^term>\\<open>wpsm :: ('person, 'welt) wp_swap\\<close>: Welt Person Swap Maxime.\\<close>\n\ntext\\<open>Die Person für die Maxime ausgewertet wird und swappen der Personen in der Welt\nkann equivalent sein:\\<close>\ndefinition wpsm_kommutiert\n  :: \\<open>('person, 'welt) maxime \\<Rightarrow> ('person, 'welt) wp_swap \\<Rightarrow> 'welt \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>wpsm_kommutiert m wps welt \\<equiv>\n  \\<forall> p1 p2 ha.\n    okay m p2 (handeln p1 (wps p1 p2 welt) ha)\n    \\<longleftrightarrow>\n    okay m p1 (Handlung welt (wps p1 p2 (nachher_handeln p1 (wps p2 p1 welt) ha)))\\<close>\n\n(*<*)\nlemma wpsm_kommutiert_handlung_raw:\n  \\<open>wpsm_kommutiert m wps welt =\n  (\\<forall> p1 p2 ha.\n    okay m p2 (Handlung (wps p1 p2 welt) (nachher_handeln p1 (wps p1 p2 welt) ha))\n    \\<longleftrightarrow>\n    okay m p1 (Handlung welt (wps p1 p2 (nachher_handeln p1 (wps p2 p1 welt) ha))))\\<close>\n  apply(simp add: wpsm_kommutiert_def)\n  apply(rule iffI)\n   apply(intro allI)\n   apply(erule_tac x=\\<open>p1\\<close> in allE)\n   apply(erule_tac x=\\<open>p2\\<close> in allE)\n   apply(erule_tac x=\\<open>ha\\<close> in allE)\n   apply(simp add: nachher_handeln.simps handeln_def; fail)\n  apply(intro allI)\n  apply(case_tac \\<open>ha\\<close>)\n  apply(simp add: handeln_def)\n  done\n\n\nlemma wpsm_kommutiert_unfold_handlungsabsicht:\n  \\<open>wpsm_kommutiert m wps welt =\n  (\\<forall> p1 p2 ha.\n    okay m p2 (handeln p1 (wps p1 p2 welt) ha)\n    \\<longleftrightarrow>\n    okay m p1 (handeln p1 welt (Handlungsabsicht (\\<lambda>p w. Some (wps p1 p2 (nachher_handeln p (wps p2 p1 w) ha)))))\n  )\\<close>\n  apply(simp add: wpsm_kommutiert_handlung_raw)\n  by (simp add: handeln_def nachher_handeln.simps)\n(*>*)\n\ntext\\<open>Wenn sowohl eine \\<^const>\\<open>wohlgeformte_handlungsabsicht\\<close> vorliegt,\nals auch \\<^const>\\<open>wpsm_kommutiert\\<close>,\ndann erhalten wir ein sehr intuitives Ergebnis,\nwelches besagt, dass ich handelnde Person und Person für die die Maxime gelten soll\nvertauschen kann.\\<close>\nlemma wfh_wpsm_kommutiert_simp:\n  assumes wpsid: \\<open>wps_id wps welt\\<close>\n  shows \\<open>wohlgeformte_handlungsabsicht wps welt ha \\<Longrightarrow>\n  wpsm_kommutiert m wps welt \\<Longrightarrow>\n    okay m p2 (handeln p1 (wps p1 p2 welt) ha)\n    \\<longleftrightarrow>\n    okay m p1 (handeln p2 welt ha)\\<close>\n  apply(cases \\<open>ha\\<close>, simp)\n  apply(simp add: wpsm_kommutiert_def)\n  apply(drule wohlgeformte_handlungsabsicht_wpsid_imp_handeln[OF _ wpsid])\n  by simp\n\ntext\\<open>Die Rückrichtung gilt auch,\naber da wir das für alle Handlungsabsichten in der Annahme brauchen,\nist das eher weniger hilfreich.\\<close>\nlemma wfh_kommutiert_wpsm:\n  assumes wpsid: \\<open>wps_id wps welt\\<close>\n  shows \n  \\<open>\\<forall>ha. wohlgeformte_handlungsabsicht wps welt ha \\<and>\n       (\\<forall>p1 p2. okay m p2 (handeln p1 (wps p1 p2 welt) ha)\n           \\<longleftrightarrow>\n           okay m p1 (handeln p2 welt ha)) \\<Longrightarrow>\n    wpsm_kommutiert m wps welt\\<close>\n  apply(simp add: wpsm_kommutiert_def)\n  apply(intro allI, rename_tac p1 p2 ha)\n  apply(erule_tac x=\\<open>ha\\<close> in allE)\n  apply(case_tac \\<open>ha\\<close>, simp)\n  apply(erule conjE)\n  apply(drule wohlgeformte_handlungsabsicht_wpsid_imp_handeln[OF _ wpsid])\n  by simp\n\n(*<*)\nlemma wpsm_kommutiert_map_handlung:\n  assumes wpsid: \\<open>wps_id wps welt\\<close>\n    and wps_sym: \\<open>wps p1 p2 welt = wps p2 p1 welt\\<close>\n  shows \\<open>wpsm_kommutiert m wps (wps p1 p2 welt) \\<Longrightarrow>\n    okay m p1 (map_handlung (wps p1 p2) (handeln p1 welt ha))\n    \\<longleftrightarrow>\n    okay m p2 (handeln p1 welt ha)\\<close>\n  apply(cases \\<open>ha\\<close>, simp)\n  apply(simp add: wpsm_kommutiert_def)\n  apply(erule_tac x=\\<open>p1\\<close> in allE)\n  apply(erule_tac x=\\<open>p2\\<close> in allE)\n  apply(simp add: handeln_def wpsid[simplified wps_id_def])\n  by (metis wps_id_def wps_sym wpsid)\n(*>*)\n\n\nsubsection\\<open>Wohlgeformte Maxime\\<close>\ntext\\<open>Nach dem gleichen Konzept nach dem wir die \\<^const>\\<open>wohlgeformte_handlungsabsicht\\<close>\ndefiniert haben,\ndefinieren wir, was es bedeutet für eine Maxime wohlgeformt zu sein.\\<close>\n\n(*Eigentlich sollte das fuer alle Handlungen gelten, aber wenn ich ausfuehrbaren code will\nhabe ich ein Problem, dass Handlungen nicht enumerable sind.*)\ndefinition wohlgeformte_maxime_auf\n  :: \\<open>'welt handlung \\<Rightarrow> ('person, 'welt) wp_swap \\<Rightarrow> ('person, 'welt) maxime \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>wohlgeformte_maxime_auf h wps m \\<equiv>\n    \\<forall>p1 p2. okay m p1 h \\<longleftrightarrow> okay m p2 (map_handlung (wps p1 p2) h)\\<close>\n\ntext\\<open>Eigentlich sollte eine Maxime wohlgeformte sein für alle Handlungen.\nJedoch definieren wir hier eine restriktive Version \\<^const>\\<open>wohlgeformte_maxime_auf\\<close> welche\nnur auf einer Handlung wohlgeformt ist.\nDer Grund ist leider ein Implementierungsdetail.\nDa wir ausführbaren Code wollen und Handlungen normalerweise nicht vollständig\naufzählbar sind, werden wir auch den kategorischen Imperativ auf eine endliche Menge\nvon Handlungsabsichten beschränken.\nDie eigentlich schönere (jedoch schwer zu beweisende) Forderung lautet:\\<close>\n\ndefinition wohlgeformte_maxime\n  :: \\<open>('person, 'welt) wp_swap \\<Rightarrow> ('person, 'welt) maxime \\<Rightarrow> bool\\<close>\nwhere\n  \\<open>wohlgeformte_maxime wps m \\<equiv>\n    \\<forall>h. wohlgeformte_maxime_auf h wps m\\<close>\n\n\ntext\\<open>Beispiel:\\<close>\nbeispiel \\<open>wohlgeformte_maxime swap (Maxime (\\<lambda>ich h. (vorher h) ich \\<le> (nachher h) ich))\\<close>\n  apply(simp add: wohlgeformte_maxime_def wohlgeformte_maxime_auf_def)\n  apply(intro allI, case_tac \\<open>h\\<close>, simp)\n  by (metis swap_a swap_symmetric)\n  \n\n(*\naus wpsm_kommutiert koennen wir FAST wohlgeformte_maxime_auf ableiten.\nLeider muss pX=p2.\nlemma\n  assumes wpsid: \\<open>wps_id wps welt\\<close>\n    and wps_sym: \\<open>\\<forall>p1 p2. wps p1 p2 = wps p2 p1\\<close>\n  shows \\<open>(\\<forall>p1 p2::'person. wpsm_kommutiert m wps (wps p1 p2 welt)) \\<Longrightarrow>\n    wohlgeformte_maxime_auf (handeln (pX::'person) welt ha) wps m\\<close>\n  apply(simp add: wohlgeformte_maxime_auf_def)\n  apply(clarsimp)\n  apply(erule_tac x=p2 in allE)\n  apply(erule_tac x=p1 in allE)\n  apply(subgoal_tac \"wps p2 p1 welt = wps p1 p2 welt\")\n  prefer 2 subgoal using wps_sym by simp\n  apply(drule(1) wpsm_kommutiert_map_handlung[OF wpsid, where ha=ha])\n  apply(case_tac \"pX=p2\")\n   apply(simp add: wps_sym; fail)\n  apply(simp)\n  oops\n*)\n\n(*<*)\nsubsection\\<open>Generische Lemmata\\<close>\n\nlemma ist_noop_map_handlung_wpsid:\n  assumes strong_wps_id:\n        \\<open>\\<forall>p1 p2 welt. wps p1 p2 (wps p1 p2 welt) = welt\\<close>\n  shows \\<open>ist_noop (map_handlung (wps p1 p2) h) \\<longleftrightarrow> ist_noop h\\<close>\n  apply(cases \\<open>h\\<close>, rename_tac vor nach, simp add: ist_noop_def)\n  using strong_wps_id by metis\n\nlemma ist_noop_wps:\n  assumes wfh: \\<open>wohlgeformte_handlungsabsicht wps welt ha\\<close>\n  and wps_id: \\<open>wps_id wps welt\\<close>\n  and strong_wps_id: \\<open>\\<forall>p1 p2 welt. wps p1 p2 (wps p1 p2 welt) = welt\\<close>\n  shows \\<open>ist_noop (handeln p2 (wps ich p2 welt) ha) \\<longleftrightarrow> ist_noop (handeln ich welt ha)\\<close>\nproof -\n  from wps_id have weak_wps_sym: \\<open>\\<forall>p1 p2. wps p1 p2 welt = wps p2 p1 welt\\<close> by (metis strong_wps_id wps_id_def)\n  from wohlgeformte_handlungsabsicht_wpsid_imp_handeln[OF wfh wps_id]\n  have \\<open>ist_noop (handeln ich welt ha)\n        = ist_noop (Handlung welt (wps p2 ich (nachher_handeln p2 (wps ich p2 welt) ha)))\\<close>\n    by simp\n  also have \\<open>\\<dots> = ist_noop (Handlung (wps ich p2 welt) (nachher_handeln p2 (wps ich p2 welt) ha))\\<close>\n    apply(simp add: ist_noop_def)\n    using strong_wps_id weak_wps_sym by metis\n  finally have \\<open>ist_noop (handeln ich welt ha)\n    = ist_noop (Handlung (wps ich p2 welt) (nachher_handeln p2 (wps ich p2 welt) ha))\\<close> .\n  thus \\<open>?thesis\\<close>\n    by(simp add: handeln_def wps_id[simplified wps_id_def])\nqed\n\n\n(*>*)\n\nend", "meta": {"author": "diekmann", "repo": "kant", "sha": "fd8cd77b199114d0a8f6b5ad5e0c63a2c4a88902", "save_path": "github-repos/isabelle/diekmann-kant", "path": "github-repos/isabelle/diekmann-kant/kant-fd8cd77b199114d0a8f6b5ad5e0c63a2c4a88902/Formal/SchleierNichtwissen.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5774953651858117, "lm_q1q2_score": 0.32020412364706874}}
{"text": "(*:maxLineLen=78:*)\n\ntheory HOL_Specific\n  imports\n    Main\n    \"HOL-Library.Old_Datatype\"\n    \"HOL-Library.Old_Recdef\"\n    \"HOL-Library.Adhoc_Overloading\"\n    \"HOL-Library.Dlist\"\n    \"HOL-Library.FSet\"\n    Base\nbegin\n\n\nchapter \\<open>Higher-Order Logic\\<close>\n\ntext \\<open>\n  Isabelle/HOL is based on Higher-Order Logic, a polymorphic version of\n  Church's Simple Theory of Types. HOL can be best understood as a\n  simply-typed version of classical set theory. The logic was first\n  implemented in Gordon's HOL system \\<^cite>\\<open>\"mgordon-hol\"\\<close>. It extends\n  Church's original logic \\<^cite>\\<open>\"church40\"\\<close> by explicit type variables (naive\n  polymorphism) and a sound axiomatization scheme for new types based on\n  subsets of existing types.\n\n  Andrews's book \\<^cite>\\<open>andrews86\\<close> is a full description of the original\n  Church-style higher-order logic, with proofs of correctness and completeness\n  wrt.\\ certain set-theoretic interpretations. The particular extensions of\n  Gordon-style HOL are explained semantically in two chapters of the 1993 HOL\n  book \\<^cite>\\<open>pitts93\\<close>.\n\n  Experience with HOL over decades has demonstrated that higher-order logic is\n  widely applicable in many areas of mathematics and computer science. In a\n  sense, Higher-Order Logic is simpler than First-Order Logic, because there\n  are fewer restrictions and special cases. Note that HOL is \\<^emph>\\<open>weaker\\<close> than\n  FOL with axioms for ZF set theory, which is traditionally considered the\n  standard foundation of regular mathematics, but for most applications this\n  does not matter. If you prefer ML to Lisp, you will probably prefer HOL to\n  ZF.\n\n  \\<^medskip> The syntax of HOL follows \\<open>\\<lambda>\\<close>-calculus and functional programming.\n  Function application is curried. To apply the function \\<open>f\\<close> of type \\<open>\\<tau>\\<^sub>1 \\<Rightarrow>\n  \\<tau>\\<^sub>2 \\<Rightarrow> \\<tau>\\<^sub>3\\<close> to the arguments \\<open>a\\<close> and \\<open>b\\<close> in HOL, you simply write \\<open>f a b\\<close> (as\n  in ML or Haskell). There is no ``apply'' operator; the existing application\n  of the Pure \\<open>\\<lambda>\\<close>-calculus is re-used. Note that in HOL \\<open>f (a, b)\\<close> means ``\\<open>f\\<close>\n  applied to the pair \\<open>(a, b)\\<close> (which is notation for \\<open>Pair a b\\<close>). The latter\n  typically introduces extra formal efforts that can be avoided by currying\n  functions by default. Explicit tuples are as infrequent in HOL\n  formalizations as in good ML or Haskell programs.\n\n  \\<^medskip> Isabelle/HOL has a distinct feel, compared to other object-logics like\n  Isabelle/ZF. It identifies object-level types with meta-level types, taking\n  advantage of the default type-inference mechanism of Isabelle/Pure. HOL\n  fully identifies object-level functions with meta-level functions, with\n  native abstraction and application.\n\n  These identifications allow Isabelle to support HOL particularly nicely, but\n  they also mean that HOL requires some sophistication from the user. In\n  particular, an understanding of Hindley-Milner type-inference with\n  type-classes, which are both used extensively in the standard libraries and\n  applications.\n\\<close>\n\n\nchapter \\<open>Derived specification elements\\<close>\n\nsection \\<open>Inductive and coinductive definitions \\label{sec:hol-inductive}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"inductive\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"inductive_set\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"coinductive\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"coinductive_set\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def \"print_inductives\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{attribute_def (HOL) mono} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  An \\<^emph>\\<open>inductive definition\\<close> specifies the least predicate or set \\<open>R\\<close> closed\n  under given rules: applying a rule to elements of \\<open>R\\<close> yields a result within\n  \\<open>R\\<close>. For example, a structural operational semantics is an inductive\n  definition of an evaluation relation.\n\n  Dually, a \\<^emph>\\<open>coinductive definition\\<close> specifies the greatest predicate or set\n  \\<open>R\\<close> that is consistent with given rules: every element of \\<open>R\\<close> can be seen as\n  arising by applying a rule to elements of \\<open>R\\<close>. An important example is using\n  bisimulation relations to formalise equivalence of processes and infinite\n  data structures.\n\n  Both inductive and coinductive definitions are based on the Knaster-Tarski\n  fixed-point theorem for complete lattices. The collection of introduction\n  rules given by the user determines a functor on subsets of set-theoretic\n  relations. The required monotonicity of the recursion scheme is proven as a\n  prerequisite to the fixed-point definition and the resulting consequences.\n  This works by pushing inclusion through logical connectives and any other\n  operator that might be wrapped around recursive occurrences of the defined\n  relation: there must be a monotonicity theorem of the form \\<open>A \\<le> B \\<Longrightarrow> \\<M> A \\<le> \\<M>\n  B\\<close>, for each premise \\<open>\\<M> R t\\<close> in an introduction rule. The default rule\n  declarations of Isabelle/HOL already take care of most common situations.\n\n  \\<^rail>\\<open>\n    (@@{command (HOL) inductive} | @@{command (HOL) inductive_set} |\n      @@{command (HOL) coinductive} | @@{command (HOL) coinductive_set})\n      @{syntax vars} @{syntax for_fixes} \\<newline>\n      (@'where' @{syntax multi_specs})? (@'monos' @{syntax thms})?\n    ;\n    @@{command print_inductives} ('!'?)\n    ;\n    @@{attribute (HOL) mono} (() | 'add' | 'del')\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"inductive\"} and @{command (HOL) \"coinductive\"} define\n  (co)inductive predicates from the introduction rules.\n\n  The propositions given as \\<open>clauses\\<close> in the @{keyword \"where\"} part are\n  either rules of the usual \\<open>\\<And>/\\<Longrightarrow>\\<close> format (with arbitrary nesting), or\n  equalities using \\<open>\\<equiv>\\<close>. The latter specifies extra-logical abbreviations in\n  the sense of @{command_ref abbreviation}. Introducing abstract syntax\n  simultaneously with the actual introduction rules is occasionally useful for\n  complex specifications.\n\n  The optional @{keyword \"for\"} part contains a list of parameters of the\n  (co)inductive predicates that remain fixed throughout the definition, in\n  contrast to arguments of the relation that may vary in each occurrence\n  within the given \\<open>clauses\\<close>.\n\n  The optional @{keyword \"monos\"} declaration contains additional\n  \\<^emph>\\<open>monotonicity theorems\\<close>, which are required for each operator applied to a\n  recursive set in the introduction rules.\n\n  \\<^descr> @{command (HOL) \"inductive_set\"} and @{command (HOL) \"coinductive_set\"}\n  are wrappers for to the previous commands for native HOL predicates. This\n  allows to define (co)inductive sets, where multiple arguments are simulated\n  via tuples.\n\n  \\<^descr> @{command \"print_inductives\"} prints (co)inductive definitions and\n  monotonicity rules; the ``\\<open>!\\<close>'' option indicates extra verbosity.\n\n  \\<^descr> @{attribute (HOL) mono} declares monotonicity rules in the context. These\n  rule are involved in the automated monotonicity proof of the above inductive\n  and coinductive definitions.\n\\<close>\n\n\nsubsection \\<open>Derived rules\\<close>\n\ntext \\<open>\n  A (co)inductive definition of \\<open>R\\<close> provides the following main theorems:\n\n  \\<^descr> \\<open>R.intros\\<close> is the list of introduction rules as proven theorems, for the\n  recursive predicates (or sets). The rules are also available individually,\n  using the names given them in the theory file;\n\n  \\<^descr> \\<open>R.cases\\<close> is the case analysis (or elimination) rule;\n\n  \\<^descr> \\<open>R.induct\\<close> or \\<open>R.coinduct\\<close> is the (co)induction rule;\n\n  \\<^descr> \\<open>R.simps\\<close> is the equation unrolling the fixpoint of the predicate one\n  step.\n\n\n  When several predicates \\<open>R\\<^sub>1, \\<dots>, R\\<^sub>n\\<close> are defined simultaneously, the list\n  of introduction rules is called \\<open>R\\<^sub>1_\\<dots>_R\\<^sub>n.intros\\<close>, the case analysis rules\n  are called \\<open>R\\<^sub>1.cases, \\<dots>, R\\<^sub>n.cases\\<close>, and the list of mutual induction rules\n  is called \\<open>R\\<^sub>1_\\<dots>_R\\<^sub>n.inducts\\<close>.\n\\<close>\n\n\nsubsection \\<open>Monotonicity theorems\\<close>\n\ntext \\<open>\n  The context maintains a default set of theorems that are used in\n  monotonicity proofs. New rules can be declared via the @{attribute (HOL)\n  mono} attribute. See the main Isabelle/HOL sources for some examples. The\n  general format of such monotonicity theorems is as follows:\n\n  \\<^item> Theorems of the form \\<open>A \\<le> B \\<Longrightarrow> \\<M> A \\<le> \\<M> B\\<close>, for proving monotonicity of\n  inductive definitions whose introduction rules have premises involving terms\n  such as \\<open>\\<M> R t\\<close>.\n\n  \\<^item> Monotonicity theorems for logical operators, which are of the general form\n  \\<open>(\\<dots> \\<longrightarrow> \\<dots>) \\<Longrightarrow> \\<dots> (\\<dots> \\<longrightarrow> \\<dots>) \\<Longrightarrow> \\<dots> \\<longrightarrow> \\<dots>\\<close>. For example, in the case of the operator \\<open>\\<or>\\<close>,\n  the corresponding theorem is\n  \\[\n  \\infer{\\<open>P\\<^sub>1 \\<or> P\\<^sub>2 \\<longrightarrow> Q\\<^sub>1 \\<or> Q\\<^sub>2\\<close>}{\\<open>P\\<^sub>1 \\<longrightarrow> Q\\<^sub>1\\<close> & \\<open>P\\<^sub>2 \\<longrightarrow> Q\\<^sub>2\\<close>}\n  \\]\n\n  \\<^item> De Morgan style equations for reasoning about the ``polarity'' of\n  expressions, e.g.\n  \\[\n  \\<^prop>\\<open>\\<not> \\<not> P \\<longleftrightarrow> P\\<close> \\qquad\\qquad\n  \\<^prop>\\<open>\\<not> (P \\<and> Q) \\<longleftrightarrow> \\<not> P \\<or> \\<not> Q\\<close>\n  \\]\n\n  \\<^item> Equations for reducing complex operators to more primitive ones whose\n  monotonicity can easily be proved, e.g.\n  \\[\n  \\<^prop>\\<open>(P \\<longrightarrow> Q) \\<longleftrightarrow> \\<not> P \\<or> Q\\<close> \\qquad\\qquad\n  \\<^prop>\\<open>Ball A P \\<equiv> \\<forall>x. x \\<in> A \\<longrightarrow> P x\\<close>\n  \\]\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>The finite powerset operator can be defined inductively like this:\\<close>\n\n(*<*)experiment begin(*>*)\ninductive_set Fin :: \"'a set \\<Rightarrow> 'a set set\" for A :: \"'a set\"\nwhere\n  empty: \"{} \\<in> Fin A\"\n| insert: \"a \\<in> A \\<Longrightarrow> B \\<in> Fin A \\<Longrightarrow> insert a B \\<in> Fin A\"\n\ntext \\<open>The accessible part of a relation is defined as follows:\\<close>\n\ninductive acc :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  for r :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\"  (infix \"\\<prec>\" 50)\nwhere acc: \"(\\<And>y. y \\<prec> x \\<Longrightarrow> acc r y) \\<Longrightarrow> acc r x\"\n(*<*)end(*>*)\n\ntext \\<open>\n  Common logical connectives can be easily characterized as non-recursive\n  inductive definitions with parameters, but without arguments.\n\\<close>\n\n(*<*)experiment begin(*>*)\ninductive AND for A B :: bool\nwhere \"A \\<Longrightarrow> B \\<Longrightarrow> AND A B\"\n\ninductive OR for A B :: bool\nwhere \"A \\<Longrightarrow> OR A B\"\n  | \"B \\<Longrightarrow> OR A B\"\n\ninductive EXISTS for B :: \"'a \\<Rightarrow> bool\"\nwhere \"B a \\<Longrightarrow> EXISTS B\"\n(*<*)end(*>*)\n\ntext \\<open>\n  Here the \\<open>cases\\<close> or \\<open>induct\\<close> rules produced by the @{command inductive}\n  package coincide with the expected elimination rules for Natural Deduction.\n  Already in the original article by Gerhard Gentzen \\<^cite>\\<open>\"Gentzen:1935\"\\<close>\n  there is a hint that each connective can be characterized by its\n  introductions, and the elimination can be constructed systematically.\n\\<close>\n\n\nsection \\<open>Recursive functions \\label{sec:recursion}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"primrec\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"fun\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"function\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close> \\\\\n    @{command_def (HOL) \"termination\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close> \\\\\n    @{command_def (HOL) \"fun_cases\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) primrec} @{syntax specification}\n    ;\n    (@@{command (HOL) fun} | @@{command (HOL) function}) opts? @{syntax specification}\n    ;\n    opts: '(' (('sequential' | 'domintros') + ',') ')'\n    ;\n    @@{command (HOL) termination} @{syntax term}?\n    ;\n    @@{command (HOL) fun_cases} (@{syntax thmdecl}? @{syntax prop} + @'and')\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"primrec\"} defines primitive recursive functions over\n  datatypes (see also @{command_ref (HOL) datatype}). The given \\<open>equations\\<close>\n  specify reduction rules that are produced by instantiating the generic\n  combinator for primitive recursion that is available for each datatype.\n\n  Each equation needs to be of the form:\n\n  @{text [display] \"f x\\<^sub>1 \\<dots> x\\<^sub>m (C y\\<^sub>1 \\<dots> y\\<^sub>k) z\\<^sub>1 \\<dots> z\\<^sub>n = rhs\"}\n\n  such that \\<open>C\\<close> is a datatype constructor, \\<open>rhs\\<close> contains only the free\n  variables on the left-hand side (or from the context), and all recursive\n  occurrences of \\<open>f\\<close> in \\<open>rhs\\<close> are of the form \\<open>f \\<dots> y\\<^sub>i \\<dots>\\<close> for some \\<open>i\\<close>. At\n  most one reduction rule for each constructor can be given. The order does\n  not matter. For missing constructors, the function is defined to return a\n  default value, but this equation is made difficult to access for users.\n\n  The reduction rules are declared as @{attribute simp} by default, which\n  enables standard proof methods like @{method simp} and @{method auto} to\n  normalize expressions of \\<open>f\\<close> applied to datatype constructions, by\n  simulating symbolic computation via rewriting.\n\n  \\<^descr> @{command (HOL) \"function\"} defines functions by general wellfounded\n  recursion. A detailed description with examples can be found in \\<^cite>\\<open>\"isabelle-function\"\\<close>. The function is specified by a set of (possibly\n  conditional) recursive equations with arbitrary pattern matching. The\n  command generates proof obligations for the completeness and the\n  compatibility of patterns.\n\n  The defined function is considered partial, and the resulting simplification\n  rules (named \\<open>f.psimps\\<close>) and induction rule (named \\<open>f.pinduct\\<close>) are guarded\n  by a generated domain predicate \\<open>f_dom\\<close>. The @{command (HOL) \"termination\"}\n  command can then be used to establish that the function is total.\n\n  \\<^descr> @{command (HOL) \"fun\"} is a shorthand notation for ``@{command (HOL)\n  \"function\"}~\\<open>(sequential)\\<close>'', followed by automated proof attempts regarding\n  pattern matching and termination. See \\<^cite>\\<open>\"isabelle-function\"\\<close> for\n  further details.\n\n  \\<^descr> @{command (HOL) \"termination\"}~\\<open>f\\<close> commences a termination proof for the\n  previously defined function \\<open>f\\<close>. If this is omitted, the command refers to\n  the most recent function definition. After the proof is closed, the\n  recursive equations and the induction principle is established.\n\n  \\<^descr> @{command (HOL) \"fun_cases\"} generates specialized elimination rules for\n  function equations. It expects one or more function equations and produces\n  rules that eliminate the given equalities, following the cases given in the\n  function definition.\n\n\n  Recursive definitions introduced by the @{command (HOL) \"function\"} command\n  accommodate reasoning by induction (cf.\\ @{method induct}): rule \\<open>f.induct\\<close>\n  refers to a specific induction rule, with parameters named according to the\n  user-specified equations. Cases are numbered starting from 1. For @{command\n  (HOL) \"primrec\"}, the induction principle coincides with structural\n  recursion on the datatype where the recursion is carried out.\n\n  The equations provided by these packages may be referred later as theorem\n  list \\<open>f.simps\\<close>, where \\<open>f\\<close> is the (collective) name of the functions defined.\n  Individual equations may be named explicitly as well.\n\n  The @{command (HOL) \"function\"} command accepts the following options.\n\n  \\<^descr> \\<open>sequential\\<close> enables a preprocessor which disambiguates overlapping\n  patterns by making them mutually disjoint. Earlier equations take precedence\n  over later ones. This allows to give the specification in a format very\n  similar to functional programming. Note that the resulting simplification\n  and induction rules correspond to the transformed specification, not the one\n  given originally. This usually means that each equation given by the user\n  may result in several theorems. Also note that this automatic transformation\n  only works for ML-style datatype patterns.\n\n  \\<^descr> \\<open>domintros\\<close> enables the automated generation of introduction rules for the\n  domain predicate. While mostly not needed, they can be helpful in some\n  proofs about partial functions.\n\\<close>\n\n\nsubsubsection \\<open>Example: evaluation of expressions\\<close>\n\ntext \\<open>\n  Subsequently, we define mutual datatypes for arithmetic and boolean\n  expressions, and use @{command primrec} for evaluation functions that follow\n  the same recursive structure.\n\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype 'a aexp =\n    IF \"'a bexp\"  \"'a aexp\"  \"'a aexp\"\n  | Sum \"'a aexp\"  \"'a aexp\"\n  | Diff \"'a aexp\"  \"'a aexp\"\n  | Var 'a\n  | Num nat\nand 'a bexp =\n    Less \"'a aexp\"  \"'a aexp\"\n  | And \"'a bexp\"  \"'a bexp\"\n  | Neg \"'a bexp\"\n\ntext \\<open>\\<^medskip> Evaluation of arithmetic and boolean expressions\\<close>\n\nprimrec evala :: \"('a \\<Rightarrow> nat) \\<Rightarrow> 'a aexp \\<Rightarrow> nat\"\n  and evalb :: \"('a \\<Rightarrow> nat) \\<Rightarrow> 'a bexp \\<Rightarrow> bool\"\nwhere\n  \"evala env (IF b a1 a2) = (if evalb env b then evala env a1 else evala env a2)\"\n| \"evala env (Sum a1 a2) = evala env a1 + evala env a2\"\n| \"evala env (Diff a1 a2) = evala env a1 - evala env a2\"\n| \"evala env (Var v) = env v\"\n| \"evala env (Num n) = n\"\n| \"evalb env (Less a1 a2) = (evala env a1 < evala env a2)\"\n| \"evalb env (And b1 b2) = (evalb env b1 \\<and> evalb env b2)\"\n| \"evalb env (Neg b) = (\\<not> evalb env b)\"\n\ntext \\<open>\n  Since the value of an expression depends on the value of its variables, the\n  functions \\<^const>\\<open>evala\\<close> and \\<^const>\\<open>evalb\\<close> take an additional parameter, an\n  \\<^emph>\\<open>environment\\<close> that maps variables to their values.\n\n  \\<^medskip>\n  Substitution on expressions can be defined similarly. The mapping \\<open>f\\<close> of\n  type \\<^typ>\\<open>'a \\<Rightarrow> 'a aexp\\<close> given as a parameter is lifted canonically on the\n  types \\<^typ>\\<open>'a aexp\\<close> and \\<^typ>\\<open>'a bexp\\<close>, respectively.\n\\<close>\n\nprimrec substa :: \"('a \\<Rightarrow> 'b aexp) \\<Rightarrow> 'a aexp \\<Rightarrow> 'b aexp\"\n  and substb :: \"('a \\<Rightarrow> 'b aexp) \\<Rightarrow> 'a bexp \\<Rightarrow> 'b bexp\"\nwhere\n  \"substa f (IF b a1 a2) = IF (substb f b) (substa f a1) (substa f a2)\"\n| \"substa f (Sum a1 a2) = Sum (substa f a1) (substa f a2)\"\n| \"substa f (Diff a1 a2) = Diff (substa f a1) (substa f a2)\"\n| \"substa f (Var v) = f v\"\n| \"substa f (Num n) = Num n\"\n| \"substb f (Less a1 a2) = Less (substa f a1) (substa f a2)\"\n| \"substb f (And b1 b2) = And (substb f b1) (substb f b2)\"\n| \"substb f (Neg b) = Neg (substb f b)\"\n\ntext \\<open>\n  In textbooks about semantics one often finds substitution theorems, which\n  express the relationship between substitution and evaluation. For \\<^typ>\\<open>'a\n  aexp\\<close> and \\<^typ>\\<open>'a bexp\\<close>, we can prove such a theorem by mutual\n  induction, followed by simplification.\n\\<close>\n\nlemma subst_one:\n  \"evala env (substa (Var (v := a')) a) = evala (env (v := evala env a')) a\"\n  \"evalb env (substb (Var (v := a')) b) = evalb (env (v := evala env a')) b\"\n  by (induct a and b) simp_all\n\nlemma subst_all:\n  \"evala env (substa s a) = evala (\\<lambda>x. evala env (s x)) a\"\n  \"evalb env (substb s b) = evalb (\\<lambda>x. evala env (s x)) b\"\n  by (induct a and b) simp_all\n(*<*)end(*>*)\n\n\nsubsubsection \\<open>Example: a substitution function for terms\\<close>\n\ntext \\<open>Functions on datatypes with nested recursion are also defined\n  by mutual primitive recursion.\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype ('a, 'b) \"term\" = Var 'a | App 'b \"('a, 'b) term list\"\n\ntext \\<open>\n  A substitution function on type \\<^typ>\\<open>('a, 'b) term\\<close> can be defined as\n  follows, by working simultaneously on \\<^typ>\\<open>('a, 'b) term list\\<close>:\n\\<close>\n\nprimrec subst_term :: \"('a \\<Rightarrow> ('a, 'b) term) \\<Rightarrow> ('a, 'b) term \\<Rightarrow> ('a, 'b) term\" and\n  subst_term_list :: \"('a \\<Rightarrow> ('a, 'b) term) \\<Rightarrow> ('a, 'b) term list \\<Rightarrow> ('a, 'b) term list\"\nwhere\n  \"subst_term f (Var a) = f a\"\n| \"subst_term f (App b ts) = App b (subst_term_list f ts)\"\n| \"subst_term_list f [] = []\"\n| \"subst_term_list f (t # ts) = subst_term f t # subst_term_list f ts\"\n\ntext \\<open>\n  The recursion scheme follows the structure of the unfolded definition of\n  type \\<^typ>\\<open>('a, 'b) term\\<close>. To prove properties of this substitution\n  function, mutual induction is needed:\n\\<close>\n\nlemma \"subst_term (subst_term f1 \\<circ> f2) t =\n    subst_term f1 (subst_term f2 t)\" and\n  \"subst_term_list (subst_term f1 \\<circ> f2) ts =\n    subst_term_list f1 (subst_term_list f2 ts)\"\n  by (induct t and ts rule: subst_term.induct subst_term_list.induct) simp_all\n(*<*)end(*>*)\n\n\nsubsubsection \\<open>Example: a map function for infinitely branching trees\\<close>\n\ntext \\<open>Defining functions on infinitely branching datatypes by primitive\n  recursion is just as easy.\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype 'a tree = Atom 'a | Branch \"nat \\<Rightarrow> 'a tree\"\n\nprimrec map_tree :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a tree \\<Rightarrow> 'b tree\"\nwhere\n  \"map_tree f (Atom a) = Atom (f a)\"\n| \"map_tree f (Branch ts) = Branch (\\<lambda>x. map_tree f (ts x))\"\n\ntext \\<open>\n  Note that all occurrences of functions such as \\<open>ts\\<close> above must be applied to\n  an argument. In particular, \\<^term>\\<open>map_tree f \\<circ> ts\\<close> is not allowed here.\n\n  \\<^medskip>\n  Here is a simple composition lemma for \\<^term>\\<open>map_tree\\<close>:\n\\<close>\n\nlemma \"map_tree g (map_tree f t) = map_tree (g \\<circ> f) t\"\n  by (induct t) simp_all\n(*<*)end(*>*)\n\n\nsubsection \\<open>Proof methods related to recursive definitions\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) pat_completeness} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) relation} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) lexicographic_order} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) size_change} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) termination_simp} & : & \\<open>attribute\\<close> \\\\\n    @{method_def (HOL) induction_schema} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) relation} @{syntax term}\n    ;\n    @@{method (HOL) lexicographic_order} (@{syntax clasimpmod} * )\n    ;\n    @@{method (HOL) size_change} ( orders (@{syntax clasimpmod} * ) )\n    ;\n    @@{method (HOL) induction_schema}\n    ;\n    orders: ( 'max' | 'min' | 'ms' ) *\n  \\<close>\n\n  \\<^descr> @{method (HOL) pat_completeness} is a specialized method to solve goals\n  regarding the completeness of pattern matching, as required by the @{command\n  (HOL) \"function\"} package (cf.\\ \\<^cite>\\<open>\"isabelle-function\"\\<close>).\n\n  \\<^descr> @{method (HOL) relation}~\\<open>R\\<close> introduces a termination proof using the\n  relation \\<open>R\\<close>. The resulting proof state will contain goals expressing that\n  \\<open>R\\<close> is wellfounded, and that the arguments of recursive calls decrease with\n  respect to \\<open>R\\<close>. Usually, this method is used as the initial proof step of\n  manual termination proofs.\n\n  \\<^descr> @{method (HOL) \"lexicographic_order\"} attempts a fully automated\n  termination proof by searching for a lexicographic combination of size\n  measures on the arguments of the function. The method accepts the same\n  arguments as the @{method auto} method, which it uses internally to prove\n  local descents. The @{syntax clasimpmod} modifiers are accepted (as for\n  @{method auto}).\n\n  In case of failure, extensive information is printed, which can help to\n  analyse the situation (cf.\\ \\<^cite>\\<open>\"isabelle-function\"\\<close>).\n\n  \\<^descr> @{method (HOL) \"size_change\"} also works on termination goals, using a\n  variation of the size-change principle, together with a graph decomposition\n  technique (see \\<^cite>\\<open>krauss_phd\\<close> for details). Three kinds of orders are\n  used internally: \\<open>max\\<close>, \\<open>min\\<close>, and \\<open>ms\\<close> (multiset), which is only available\n  when the theory \\<open>Multiset\\<close> is loaded. When no order kinds are given, they\n  are tried in order. The search for a termination proof uses SAT solving\n  internally.\n\n  For local descent proofs, the @{syntax clasimpmod} modifiers are accepted\n  (as for @{method auto}).\n\n  \\<^descr> @{attribute (HOL) termination_simp} declares extra rules for the\n  simplifier, when invoked in termination proofs. This can be useful, e.g.,\n  for special rules involving size estimations.\n\n  \\<^descr> @{method (HOL) induction_schema} derives user-specified induction rules\n  from well-founded induction and completeness of patterns. This factors out\n  some operations that are done internally by the function package and makes\n  them available separately. See \\<^file>\\<open>~~/src/HOL/Examples/Induction_Schema.thy\\<close> for\n  examples.\n\\<close>\n\n\nsubsection \\<open>Functions with explicit partiality\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"partial_function\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{attribute_def (HOL) \"partial_function_mono\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) partial_function} '(' @{syntax name} ')'\n      @{syntax specification}\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"partial_function\"}~\\<open>(mode)\\<close> defines recursive functions\n  based on fixpoints in complete partial orders. No termination proof is\n  required from the user or constructed internally. Instead, the possibility\n  of non-termination is modelled explicitly in the result type, which contains\n  an explicit bottom element.\n\n  Pattern matching and mutual recursion are currently not supported. Thus, the\n  specification consists of a single function described by a single recursive\n  equation.\n\n  There are no fixed syntactic restrictions on the body of the function, but\n  the induced functional must be provably monotonic wrt.\\ the underlying\n  order. The monotonicity proof is performed internally, and the definition is\n  rejected when it fails. The proof can be influenced by declaring hints using\n  the @{attribute (HOL) partial_function_mono} attribute.\n\n  The mandatory \\<open>mode\\<close> argument specifies the mode of operation of the\n  command, which directly corresponds to a complete partial order on the\n  result type. By default, the following modes are defined:\n\n    \\<^descr> \\<open>option\\<close> defines functions that map into the \\<^type>\\<open>option\\<close> type. Here,\n    the value \\<^term>\\<open>None\\<close> is used to model a non-terminating computation.\n    Monotonicity requires that if \\<^term>\\<open>None\\<close> is returned by a recursive\n    call, then the overall result must also be \\<^term>\\<open>None\\<close>. This is best\n    achieved through the use of the monadic operator \\<^const>\\<open>Option.bind\\<close>.\n\n    \\<^descr> \\<open>tailrec\\<close> defines functions with an arbitrary result type and uses the\n    slightly degenerated partial order where \\<^term>\\<open>undefined\\<close> is the bottom\n    element. Now, monotonicity requires that if \\<^term>\\<open>undefined\\<close> is returned\n    by a recursive call, then the overall result must also be \\<^term>\\<open>undefined\\<close>. In practice, this is only satisfied when each recursive call\n    is a tail call, whose result is directly returned. Thus, this mode of\n    operation allows the definition of arbitrary tail-recursive functions.\n\n  Experienced users may define new modes by instantiating the locale \\<^const>\\<open>partial_function_definitions\\<close> appropriately.\n\n  \\<^descr> @{attribute (HOL) partial_function_mono} declares rules for use in the\n  internal monotonicity proofs of partial function definitions.\n\\<close>\n\n\nsubsection \\<open>Old-style recursive function definitions (TFL)\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"recdef\"} & : & \\<open>theory \\<rightarrow> theory)\\<close> \\\\\n  \\end{matharray}\n\n  The old TFL command @{command (HOL) \"recdef\"} for defining recursive is\n  mostly obsolete; @{command (HOL) \"function\"} or @{command (HOL) \"fun\"}\n  should be used instead.\n\n  \\<^rail>\\<open>\n    @@{command (HOL) recdef} ('(' @'permissive' ')')? \\<newline>\n      @{syntax name} @{syntax term} (@{syntax prop} +) hints?\n    ;\n    hints: '(' @'hints' ( recdefmod * ) ')'\n    ;\n    recdefmod: (('recdef_simp' | 'recdef_cong' | 'recdef_wf')\n      (() | 'add' | 'del') ':' @{syntax thms}) | @{syntax clasimpmod}\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"recdef\"} defines general well-founded recursive functions\n  (using the TFL package). The ``\\<open>(permissive)\\<close>'' option tells TFL to recover\n  from failed proof attempts, returning unfinished results. The \\<open>recdef_simp\\<close>,\n  \\<open>recdef_cong\\<close>, and \\<open>recdef_wf\\<close> hints refer to auxiliary rules to be used in\n  the internal automated proof process of TFL. Additional @{syntax clasimpmod}\n  declarations may be given to tune the context of the Simplifier (cf.\\\n  \\secref{sec:simplifier}) and Classical reasoner (cf.\\\n  \\secref{sec:classical}).\n\n\n  \\<^medskip>\n  Hints for @{command (HOL) \"recdef\"} may be also declared globally, using the\n  following attributes.\n\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) recdef_simp} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) recdef_cong} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) recdef_wf} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    (@@{attribute (HOL) recdef_simp} | @@{attribute (HOL) recdef_cong} |\n      @@{attribute (HOL) recdef_wf}) (() | 'add' | 'del')\n  \\<close>\n\\<close>\n\n\nsection \\<open>Adhoc overloading of constants\\<close>\n\ntext \\<open>\n  \\begin{tabular}{rcll}\n  @{command_def \"adhoc_overloading\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  @{command_def \"no_adhoc_overloading\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  @{attribute_def \"show_variants\"} & : & \\<open>attribute\\<close> & default \\<open>false\\<close> \\\\\n  \\end{tabular}\n\n  \\<^medskip>\n  Adhoc overloading allows to overload a constant depending on its type.\n  Typically this involves the introduction of an uninterpreted constant (used\n  for input and output) and the addition of some variants (used internally).\n  For examples see \\<^file>\\<open>~~/src/HOL/Examples/Adhoc_Overloading_Examples.thy\\<close> and\n  \\<^file>\\<open>~~/src/HOL/Library/Monad_Syntax.thy\\<close>.\n\n  \\<^rail>\\<open>\n    (@@{command adhoc_overloading} | @@{command no_adhoc_overloading})\n      (@{syntax name} (@{syntax term} + ) + @'and')\n  \\<close>\n\n  \\<^descr> @{command \"adhoc_overloading\"}~\\<open>c v\\<^sub>1 ... v\\<^sub>n\\<close> associates variants with an\n  existing constant.\n\n  \\<^descr> @{command \"no_adhoc_overloading\"} is similar to @{command\n  \"adhoc_overloading\"}, but removes the specified variants from the present\n  context.\n\n  \\<^descr> @{attribute \"show_variants\"} controls printing of variants of overloaded\n  constants. If enabled, the internally used variants are printed instead of\n  their respective overloaded constants. This is occasionally useful to check\n  whether the system agrees with a user's expectations about derived variants.\n\\<close>\n\n\nsection \\<open>Definition by specification \\label{sec:hol-specification}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"specification\"} & : & \\<open>theory \\<rightarrow> proof(prove)\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) specification} '(' (decl +) ')' \\<newline>\n      (@{syntax thmdecl}? @{syntax prop} +)\n    ;\n    decl: (@{syntax name} ':')? @{syntax term} ('(' @'overloaded' ')')?\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"specification\"}~\\<open>decls \\<phi>\\<close> sets up a goal stating the\n  existence of terms with the properties specified to hold for the constants\n  given in \\<open>decls\\<close>. After finishing the proof, the theory will be augmented\n  with definitions for the given constants, as well as with theorems stating\n  the properties for these constants.\n\n  \\<open>decl\\<close> declares a constant to be defined by the specification given. The\n  definition for the constant \\<open>c\\<close> is bound to the name \\<open>c_def\\<close> unless a\n  theorem name is given in the declaration. Overloaded constants should be\n  declared as such.\n\\<close>\n\n\nsection \\<open>Old-style datatypes \\label{sec:hol-datatype}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"old_rep_datatype\"} & : & \\<open>theory \\<rightarrow> proof(prove)\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) old_rep_datatype} ('(' (@{syntax name} +) ')')? (@{syntax term} +)\n    ;\n\n    spec: @{syntax typespec_sorts} @{syntax mixfix}? '=' (cons + '|')\n    ;\n    cons: @{syntax name} (@{syntax type} * ) @{syntax mixfix}?\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"old_rep_datatype\"} represents existing types as\n  old-style datatypes.\n\n\n  These commands are mostly obsolete; @{command (HOL) \"datatype\"} should be\n  used instead.\n\n  See \\<^cite>\\<open>\"isabelle-datatypes\"\\<close> for more details on datatypes. Apart from\n  proper proof methods for case analysis and induction, there are also\n  emulations of ML tactics @{method (HOL) case_tac} and @{method (HOL)\n  induct_tac} available, see \\secref{sec:hol-induct-tac}; these admit to refer\n  directly to the internal structure of subgoals (including internally bound\n  parameters).\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>\n  We define a type of finite sequences, with slightly different names than the\n  existing \\<^typ>\\<open>'a list\\<close> that is already in \\<^theory>\\<open>Main\\<close>:\n\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype 'a seq = Empty | Seq 'a \"'a seq\"\n\ntext \\<open>We can now prove some simple lemma by structural induction:\\<close>\n\nlemma \"Seq x xs \\<noteq> xs\"\nproof (induct xs arbitrary: x)\n  case Empty\n  txt \\<open>This case can be proved using the simplifier: the freeness\n    properties of the datatype are already declared as @{attribute\n    simp} rules.\\<close>\n  show \"Seq x Empty \\<noteq> Empty\"\n    by simp\nnext\n  case (Seq y ys)\n  txt \\<open>The step case is proved similarly.\\<close>\n  show \"Seq x (Seq y ys) \\<noteq> Seq y ys\"\n    using \\<open>Seq y ys \\<noteq> ys\\<close> by simp\nqed\n\ntext \\<open>Here is a more succinct version of the same proof:\\<close>\n\nlemma \"Seq x xs \\<noteq> xs\"\n  by (induct xs arbitrary: x) simp_all\n(*<*)end(*>*)\n\n\nsection \\<open>Records \\label{sec:hol-record}\\<close>\n\ntext \\<open>\n  In principle, records merely generalize the concept of tuples, where\n  components may be addressed by labels instead of just position. The logical\n  infrastructure of records in Isabelle/HOL is slightly more advanced, though,\n  supporting truly extensible record schemes. This admits operations that are\n  polymorphic with respect to record extension, yielding ``object-oriented''\n  effects like (single) inheritance. See also \\<^cite>\\<open>\"NaraschewskiW-TPHOLs98\"\\<close>\n  for more details on object-oriented verification and record subtyping in\n  HOL.\n\\<close>\n\n\nsubsection \\<open>Basic concepts\\<close>\n\ntext \\<open>\n  Isabelle/HOL supports both \\<^emph>\\<open>fixed\\<close> and \\<^emph>\\<open>schematic\\<close> records at the level of\n  terms and types. The notation is as follows:\n\n  \\begin{center}\n  \\begin{tabular}{l|l|l}\n    & record terms & record types \\\\ \\hline\n    fixed & \\<open>\\<lparr>x = a, y = b\\<rparr>\\<close> & \\<open>\\<lparr>x :: A, y :: B\\<rparr>\\<close> \\\\\n    schematic & \\<open>\\<lparr>x = a, y = b, \\<dots> = m\\<rparr>\\<close> &\n      \\<open>\\<lparr>x :: A, y :: B, \\<dots> :: M\\<rparr>\\<close> \\\\\n  \\end{tabular}\n  \\end{center}\n\n  The ASCII representation of \\<open>\\<lparr>x = a\\<rparr>\\<close> is \\<open>(| x = a |)\\<close>.\n\n  A fixed record \\<open>\\<lparr>x = a, y = b\\<rparr>\\<close> has field \\<open>x\\<close> of value \\<open>a\\<close> and field \\<open>y\\<close> of\n  value \\<open>b\\<close>. The corresponding type is \\<open>\\<lparr>x :: A, y :: B\\<rparr>\\<close>, assuming that \\<open>a ::\n  A\\<close> and \\<open>b :: B\\<close>.\n\n  A record scheme like \\<open>\\<lparr>x = a, y = b, \\<dots> = m\\<rparr>\\<close> contains fields \\<open>x\\<close> and \\<open>y\\<close> as\n  before, but also possibly further fields as indicated by the ``\\<open>\\<dots>\\<close>''\n  notation (which is actually part of the syntax). The improper field ``\\<open>\\<dots>\\<close>''\n  of a record scheme is called the \\<^emph>\\<open>more part\\<close>. Logically it is just a free\n  variable, which is occasionally referred to as ``row variable'' in the\n  literature. The more part of a record scheme may be instantiated by zero or\n  more further components. For example, the previous scheme may get\n  instantiated to \\<open>\\<lparr>x = a, y = b, z = c, \\<dots> = m'\\<rparr>\\<close>, where \\<open>m'\\<close> refers to a\n  different more part. Fixed records are special instances of record schemes,\n  where ``\\<open>\\<dots>\\<close>'' is properly terminated by the \\<open>() :: unit\\<close> element. In fact,\n  \\<open>\\<lparr>x = a, y = b\\<rparr>\\<close> is just an abbreviation for \\<open>\\<lparr>x = a, y = b, \\<dots> = ()\\<rparr>\\<close>.\n\n  \\<^medskip>\n  Two key observations make extensible records in a simply typed language like\n  HOL work out:\n\n  \\<^enum> the more part is internalized, as a free term or type variable,\n\n  \\<^enum> field names are externalized, they cannot be accessed within the logic as\n  first-class values.\n\n\n  \\<^medskip>\n  In Isabelle/HOL record types have to be defined explicitly, fixing their\n  field names and types, and their (optional) parent record. Afterwards,\n  records may be formed using above syntax, while obeying the canonical order\n  of fields as given by their declaration. The record package provides several\n  standard operations like selectors and updates. The common setup for various\n  generic proof tools enable succinct reasoning patterns. See also the\n  Isabelle/HOL tutorial \\<^cite>\\<open>\"isabelle-hol-book\"\\<close> for further instructions\n  on using records in practice.\n\\<close>\n\n\nsubsection \\<open>Record specifications\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"record\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"print_record\"} & : & \\<open>context \\<rightarrow>\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) record} @{syntax \"overloaded\"}? @{syntax typespec_sorts} '=' \\<newline>\n      (@{syntax type} '+')? (constdecl +)\n    ;\n    constdecl: @{syntax name} '::' @{syntax type} @{syntax mixfix}?\n    ;\n    @@{command (HOL) print_record} modes? @{syntax typespec_sorts}\n    ;\n    modes: '(' (@{syntax name} +) ')'\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"record\"}~\\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t = \\<tau> + c\\<^sub>1 :: \\<sigma>\\<^sub>1 \\<dots> c\\<^sub>n :: \\<sigma>\\<^sub>n\\<close>\n  defines extensible record type \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close>, derived from the optional\n  parent record \\<open>\\<tau>\\<close> by adding new field components \\<open>c\\<^sub>i :: \\<sigma>\\<^sub>i\\<close> etc.\n\n  The type variables of \\<open>\\<tau>\\<close> and \\<open>\\<sigma>\\<^sub>i\\<close> need to be covered by the (distinct)\n  parameters \\<open>\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m\\<close>. Type constructor \\<open>t\\<close> has to be new, while \\<open>\\<tau>\\<close>\n  needs to specify an instance of an existing record type. At least one new\n  field \\<open>c\\<^sub>i\\<close> has to be specified. Basically, field names need to belong to a\n  unique record. This is not a real restriction in practice, since fields are\n  qualified by the record name internally.\n\n  The parent record specification \\<open>\\<tau>\\<close> is optional; if omitted \\<open>t\\<close> becomes a\n  root record. The hierarchy of all records declared within a theory context\n  forms a forest structure, i.e.\\ a set of trees starting with a root record\n  each. There is no way to merge multiple parent records!\n\n  For convenience, \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close> is made a type abbreviation for the fixed\n  record type \\<open>\\<lparr>c\\<^sub>1 :: \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n\\<rparr>\\<close>, likewise is \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m, \\<zeta>)\n  t_scheme\\<close> made an abbreviation for \\<open>\\<lparr>c\\<^sub>1 :: \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n, \\<dots> :: \\<zeta>\\<rparr>\\<close>.\n\n  \\<^descr> @{command (HOL) \"print_record\"}~\\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close> prints the definition of\n  record \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close>. Optionally \\<open>modes\\<close> can be specified, which are\n  appended to the current print mode; see \\secref{sec:print-modes}.\n\\<close>\n\n\nsubsection \\<open>Record operations\\<close>\n\ntext \\<open>\n  Any record definition of the form presented above produces certain standard\n  operations. Selectors and updates are provided for any field, including the\n  improper one ``\\<open>more\\<close>''. There are also cumulative record constructor\n  functions. To simplify the presentation below, we assume for now that \\<open>(\\<alpha>\\<^sub>1,\n  \\<dots>, \\<alpha>\\<^sub>m) t\\<close> is a root record with fields \\<open>c\\<^sub>1 :: \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n\\<close>.\n\n  \\<^medskip>\n  \\<^bold>\\<open>Selectors\\<close> and \\<^bold>\\<open>updates\\<close> are available for any\n  field (including ``\\<open>more\\<close>''):\n\n  \\begin{matharray}{lll}\n    \\<open>c\\<^sub>i\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<sigma>\\<^sub>i\\<close> \\\\\n    \\<open>c\\<^sub>i_update\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>i \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\\<close> \\\\\n  \\end{matharray}\n\n  There is special syntax for application of updates: \\<open>r\\<lparr>x := a\\<rparr>\\<close> abbreviates\n  term \\<open>x_update a r\\<close>. Further notation for repeated updates is also\n  available: \\<open>r\\<lparr>x := a\\<rparr>\\<lparr>y := b\\<rparr>\\<lparr>z := c\\<rparr>\\<close> may be written \\<open>r\\<lparr>x := a, y := b, z\n  := c\\<rparr>\\<close>. Note that because of postfix notation the order of fields shown here\n  is reverse than in the actual term. Since repeated updates are just function\n  applications, fields may be freely permuted in \\<open>\\<lparr>x := a, y := b, z := c\\<rparr>\\<close>,\n  as far as logical equality is concerned. Thus commutativity of independent\n  updates can be proven within the logic for any two fields, but not as a\n  general theorem.\n\n  \\<^medskip>\n  The \\<^bold>\\<open>make\\<close> operation provides a cumulative record constructor function:\n\n  \\begin{matharray}{lll}\n    \\<open>t.make\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n  \\end{matharray}\n\n  \\<^medskip>\n  We now reconsider the case of non-root records, which are derived of some\n  parent. In general, the latter may depend on another parent as well,\n  resulting in a list of \\<^emph>\\<open>ancestor records\\<close>. Appending the lists of fields of\n  all ancestors results in a certain field prefix. The record package\n  automatically takes care of this by lifting operations over this context of\n  ancestor fields. Assuming that \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close> has ancestor fields \\<open>b\\<^sub>1 ::\n  \\<rho>\\<^sub>1, \\<dots>, b\\<^sub>k :: \\<rho>\\<^sub>k\\<close>, the above record operations will get the following\n  types:\n\n  \\<^medskip>\n  \\begin{tabular}{lll}\n    \\<open>c\\<^sub>i\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<sigma>\\<^sub>i\\<close> \\\\\n    \\<open>c\\<^sub>i_update\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>i \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\\<close> \\\\\n    \\<open>t.make\\<close> & \\<open>::\\<close> & \\<open>\\<rho>\\<^sub>1 \\<Rightarrow> \\<dots> \\<rho>\\<^sub>k \\<Rightarrow> \\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n  \\end{tabular}\n  \\<^medskip>\n\n  Some further operations address the extension aspect of a derived record\n  scheme specifically: \\<open>t.fields\\<close> produces a record fragment consisting of\n  exactly the new fields introduced here (the result may serve as a more part\n  elsewhere); \\<open>t.extend\\<close> takes a fixed record and adds a given more part;\n  \\<open>t.truncate\\<close> restricts a record scheme to a fixed record.\n\n  \\<^medskip>\n  \\begin{tabular}{lll}\n    \\<open>t.fields\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n    \\<open>t.extend\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr> \\<Rightarrow>\n      \\<zeta> \\<Rightarrow> \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\\<close> \\\\\n    \\<open>t.truncate\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n  \\end{tabular}\n  \\<^medskip>\n\n  Note that \\<open>t.make\\<close> and \\<open>t.fields\\<close> coincide for root records.\n\\<close>\n\n\nsubsection \\<open>Derived rules and proof tools\\<close>\n\ntext \\<open>\n  The record package proves several results internally, declaring these facts\n  to appropriate proof tools. This enables users to reason about record\n  structures quite conveniently. Assume that \\<open>t\\<close> is a record type as specified\n  above.\n\n  \\<^enum> Standard conversions for selectors or updates applied to record\n  constructor terms are made part of the default Simplifier context; thus\n  proofs by reduction of basic operations merely require the @{method simp}\n  method without further arguments. These rules are available as \\<open>t.simps\\<close>,\n  too.\n\n  \\<^enum> Selectors applied to updated records are automatically reduced by an\n  internal simplification procedure, which is also part of the standard\n  Simplifier setup.\n\n  \\<^enum> Inject equations of a form analogous to \\<^prop>\\<open>(x, y) = (x', y') \\<equiv> x = x'\n  \\<and> y = y'\\<close> are declared to the Simplifier and Classical Reasoner as\n  @{attribute iff} rules. These rules are available as \\<open>t.iffs\\<close>.\n\n  \\<^enum> The introduction rule for record equality analogous to \\<open>x r = x r' \\<Longrightarrow> y r =\n  y r' \\<dots> \\<Longrightarrow> r = r'\\<close> is declared to the Simplifier, and as the basic rule\n  context as ``@{attribute intro}\\<open>?\\<close>''. The rule is called \\<open>t.equality\\<close>.\n\n  \\<^enum> Representations of arbitrary record expressions as canonical constructor\n  terms are provided both in @{method cases} and @{method induct} format (cf.\\\n  the generic proof methods of the same name, \\secref{sec:cases-induct}).\n  Several variations are available, for fixed records, record schemes, more\n  parts etc.\n\n  The generic proof methods are sufficiently smart to pick the most sensible\n  rule according to the type of the indicated record expression: users just\n  need to apply something like ``\\<open>(cases r)\\<close>'' to a certain proof problem.\n\n  \\<^enum> The derived record operations \\<open>t.make\\<close>, \\<open>t.fields\\<close>, \\<open>t.extend\\<close>,\n  \\<open>t.truncate\\<close> are \\<^emph>\\<open>not\\<close> treated automatically, but usually need to be\n  expanded by hand, using the collective fact \\<open>t.defs\\<close>.\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>See \\<^file>\\<open>~~/src/HOL/Examples/Records.thy\\<close>, for example.\\<close>\n\n\nsection \\<open>Semantic subtype definitions \\label{sec:hol-typedef}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"typedef\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close> \\\\\n  \\end{matharray}\n\n  A type definition identifies a new type with a non-empty subset of an\n  existing type. More precisely, the new type is defined by exhibiting an\n  existing type \\<open>\\<tau>\\<close>, a set \\<open>A :: \\<tau> set\\<close>, and proving \\<^prop>\\<open>\\<exists>x. x \\<in> A\\<close>. Thus\n  \\<open>A\\<close> is a non-empty subset of \\<open>\\<tau>\\<close>, and the new type denotes this subset. New\n  functions are postulated that establish an isomorphism between the new type\n  and the subset. In general, the type \\<open>\\<tau>\\<close> may involve type variables \\<open>\\<alpha>\\<^sub>1, \\<dots>,\n  \\<alpha>\\<^sub>n\\<close> which means that the type definition produces a type constructor \\<open>(\\<alpha>\\<^sub>1,\n  \\<dots>, \\<alpha>\\<^sub>n) t\\<close> depending on those type arguments.\n\n  \\<^rail>\\<open>\n    @@{command (HOL) typedef} @{syntax \"overloaded\"}? abs_type '=' rep_set\n    ;\n    @{syntax_def \"overloaded\"}: ('(' @'overloaded' ')')\n    ;\n    abs_type: @{syntax typespec_sorts} @{syntax mixfix}?\n    ;\n    rep_set: @{syntax term} (@'morphisms' @{syntax name} @{syntax name})?\n  \\<close>\n\n  To understand the concept of type definition better, we need to recount its\n  somewhat complex history. The HOL logic goes back to the ``Simple Theory of\n  Types'' (STT) of A. Church \\<^cite>\\<open>\"church40\"\\<close>, which is further explained in\n  the book by P. Andrews \\<^cite>\\<open>\"andrews86\"\\<close>. The overview article by W.\n  Farmer \\<^cite>\\<open>\"Farmer:2008\"\\<close> points out the ``seven virtues'' of this\n  relatively simple family of logics. STT has only ground types, without\n  polymorphism and without type definitions.\n\n  \\<^medskip>\n  M. Gordon \\<^cite>\\<open>\"Gordon:1985:HOL\"\\<close> augmented Church's STT by adding\n  schematic polymorphism (type variables and type constructors) and a facility\n  to introduce new types as semantic subtypes from existing types. This\n  genuine extension of the logic was explained semantically by A. Pitts in the\n  book of the original Cambridge HOL88 system \\<^cite>\\<open>\"pitts93\"\\<close>. Type\n  definitions work in this setting, because the general model-theory of STT is\n  restricted to models that ensure that the universe of type interpretations\n  is closed by forming subsets (via predicates taken from the logic).\n\n  \\<^medskip>\n  Isabelle/HOL goes beyond Gordon-style HOL by admitting overloaded constant\n  definitions \\<^cite>\\<open>\"Wenzel:1997:TPHOL\" and \"Haftmann-Wenzel:2006:classes\"\\<close>,\n  which are actually a concept of Isabelle/Pure and do not depend on\n  particular set-theoretic semantics of HOL. Over many years, there was no\n  formal checking of semantic type definitions in Isabelle/HOL versus\n  syntactic constant definitions in Isabelle/Pure. So the @{command typedef}\n  command was described as ``axiomatic'' in the sense of\n  \\secref{sec:axiomatizations}, only with some local checks of the given type\n  and its representing set.\n\n  Recent clarification of overloading in the HOL logic proper \\<^cite>\\<open>\"Kuncar-Popescu:2015\"\\<close> demonstrates how the dissimilar concepts of constant\n  definitions versus type definitions may be understood uniformly. This\n  requires an interpretation of Isabelle/HOL that substantially reforms the\n  set-theoretic model of A. Pitts \\<^cite>\\<open>\"pitts93\"\\<close>, by taking a schematic\n  view on polymorphism and interpreting only ground types in the set-theoretic\n  sense of HOL88. Moreover, type-constructors may be explicitly overloaded,\n  e.g.\\ by making the subset depend on type-class parameters (cf.\\\n  \\secref{sec:class}). This is semantically like a dependent type: the meaning\n  relies on the operations provided by different type-class instances.\n\n  \\<^descr> @{command (HOL) \"typedef\"}~\\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n) t = A\\<close> defines a new type \\<open>(\\<alpha>\\<^sub>1,\n  \\<dots>, \\<alpha>\\<^sub>n) t\\<close> from the set \\<open>A\\<close> over an existing type. The set \\<open>A\\<close> may contain\n  type variables \\<open>\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n\\<close> as specified on the LHS, but no term variables.\n  Non-emptiness of \\<open>A\\<close> needs to be proven on the spot, in order to turn the\n  internal conditional characterization into usable theorems.\n\n  The ``\\<open>(overloaded)\\<close>'' option allows the @{command \"typedef\"} specification\n  to depend on constants that are not (yet) specified and thus left open as\n  parameters, e.g.\\ type-class parameters.\n\n  Within a local theory specification, the newly introduced type constructor\n  cannot depend on parameters or assumptions of the context: this is\n  syntactically impossible in HOL. The non-emptiness proof may formally depend\n  on local assumptions, but this has little practical relevance.\n\n  For @{command (HOL) \"typedef\"}~\\<open>t = A\\<close> the newly introduced type \\<open>t\\<close> is\n  accompanied by a pair of morphisms to relate it to the representing set over\n  the old type. By default, the injection from type to set is called \\<open>Rep_t\\<close>\n  and its inverse \\<open>Abs_t\\<close>: An explicit @{keyword (HOL) \"morphisms\"}\n  specification allows to provide alternative names.\n\n  The logical characterization of @{command typedef} uses the predicate of\n  locale \\<^const>\\<open>type_definition\\<close> that is defined in Isabelle/HOL. Various\n  basic consequences of that are instantiated accordingly, re-using the locale\n  facts with names derived from the new type constructor. Thus the generic\n  theorem @{thm type_definition.Rep} is turned into the specific \\<open>Rep_t\\<close>, for\n  example.\n\n  Theorems @{thm type_definition.Rep}, @{thm type_definition.Rep_inverse}, and\n  @{thm type_definition.Abs_inverse} provide the most basic characterization\n  as a corresponding injection/surjection pair (in both directions). The\n  derived rules @{thm type_definition.Rep_inject} and @{thm\n  type_definition.Abs_inject} provide a more convenient version of\n  injectivity, suitable for automated proof tools (e.g.\\ in declarations\n  involving @{attribute simp} or @{attribute iff}). Furthermore, the rules\n  @{thm type_definition.Rep_cases}~/ @{thm type_definition.Rep_induct}, and\n  @{thm type_definition.Abs_cases}~/ @{thm type_definition.Abs_induct} provide\n  alternative views on surjectivity. These rules are already declared as set\n  or type rules for the generic @{method cases} and @{method induct} methods,\n  respectively.\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>\n  The following trivial example pulls a three-element type into existence\n  within the formal logical environment of Isabelle/HOL.\\<close>\n\n(*<*)experiment begin(*>*)\ntypedef three = \"{(True, True), (True, False), (False, True)}\"\n  by blast\n\ndefinition \"One = Abs_three (True, True)\"\ndefinition \"Two = Abs_three (True, False)\"\ndefinition \"Three = Abs_three (False, True)\"\n\nlemma three_distinct: \"One \\<noteq> Two\"  \"One \\<noteq> Three\"  \"Two \\<noteq> Three\"\n  by (simp_all add: One_def Two_def Three_def Abs_three_inject)\n\nlemma three_cases:\n  fixes x :: three obtains \"x = One\" | \"x = Two\" | \"x = Three\"\n  by (cases x) (auto simp: One_def Two_def Three_def Abs_three_inject)\n(*<*)end(*>*)\n\ntext \\<open>Note that such trivial constructions are better done with\n  derived specification mechanisms such as @{command datatype}:\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype three = One | Two | Three\n(*<*)end(*>*)\n\ntext \\<open>This avoids re-doing basic definitions and proofs from the\n  primitive @{command typedef} above.\\<close>\n\n\n\nsection \\<open>Functorial structure of types\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"functor\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) functor} (@{syntax name} ':')? @{syntax term}\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"functor\"}~\\<open>prefix: m\\<close> allows to prove and register\n  properties about the functorial structure of type constructors. These\n  properties then can be used by other packages to deal with those type\n  constructors in certain type constructions. Characteristic theorems are\n  noted in the current local theory. By default, they are prefixed with the\n  base name of the type constructor, an explicit prefix can be given\n  alternatively.\n\n  The given term \\<open>m\\<close> is considered as \\<^emph>\\<open>mapper\\<close> for the corresponding type\n  constructor and must conform to the following type pattern:\n\n  \\begin{matharray}{lll}\n    \\<open>m\\<close> & \\<open>::\\<close> &\n      \\<open>\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>k \\<Rightarrow> (\\<^vec>\\<alpha>\\<^sub>n) t \\<Rightarrow> (\\<^vec>\\<beta>\\<^sub>n) t\\<close> \\\\\n  \\end{matharray}\n\n  where \\<open>t\\<close> is the type constructor, \\<open>\\<^vec>\\<alpha>\\<^sub>n\\<close> and \\<open>\\<^vec>\\<beta>\\<^sub>n\\<close> are\n  distinct type variables free in the local theory and \\<open>\\<sigma>\\<^sub>1\\<close>, \\ldots, \\<open>\\<sigma>\\<^sub>k\\<close> is\n  a subsequence of \\<open>\\<alpha>\\<^sub>1 \\<Rightarrow> \\<beta>\\<^sub>1\\<close>, \\<open>\\<beta>\\<^sub>1 \\<Rightarrow> \\<alpha>\\<^sub>1\\<close>, \\ldots, \\<open>\\<alpha>\\<^sub>n \\<Rightarrow> \\<beta>\\<^sub>n\\<close>, \\<open>\\<beta>\\<^sub>n \\<Rightarrow> \\<alpha>\\<^sub>n\\<close>.\n\\<close>\n\n\nsection \\<open>Quotient types with lifting and transfer\\<close>\n\ntext \\<open>\n  The quotient package defines a new quotient type given a raw type and a\n  partial equivalence relation (\\secref{sec:quotient-type}). The package also\n  historically includes automation for transporting definitions and theorems\n  (\\secref{sec:old-quotient}), but most of this automation was superseded by\n  the Lifting (\\secref{sec:lifting}) and Transfer (\\secref{sec:transfer})\n  packages.\n\\<close>\n\n\nsubsection \\<open>Quotient type definition \\label{sec:quotient-type}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"quotient_type\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) quotient_type} @{syntax \"overloaded\"}? \\<newline>\n      @{syntax typespec} @{syntax mixfix}? '=' quot_type \\<newline>\n      quot_morphisms? quot_parametric?\n    ;\n    quot_type: @{syntax type} '/' ('partial' ':')? @{syntax term}\n    ;\n    quot_morphisms: @'morphisms' @{syntax name} @{syntax name}\n    ;\n    quot_parametric: @'parametric' @{syntax thm}\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"quotient_type\"} defines a new quotient type \\<open>\\<tau>\\<close>. The\n  injection from a quotient type to a raw type is called \\<open>rep_\\<tau>\\<close>, its inverse\n  \\<open>abs_\\<tau>\\<close> unless explicit @{keyword (HOL) \"morphisms\"} specification provides\n  alternative names. @{command (HOL) \"quotient_type\"} requires the user to\n  prove that the relation is an equivalence relation (predicate \\<open>equivp\\<close>),\n  unless the user specifies explicitly \\<open>partial\\<close> in which case the obligation\n  is \\<open>part_equivp\\<close>. A quotient defined with \\<open>partial\\<close> is weaker in the sense\n  that less things can be proved automatically.\n\n  The command internally proves a Quotient theorem and sets up the Lifting\n  package by the command @{command (HOL) setup_lifting}. Thus the Lifting and\n  Transfer packages can be used also with quotient types defined by @{command\n  (HOL) \"quotient_type\"} without any extra set-up. The parametricity theorem\n  for the equivalence relation R can be provided as an extra argument of the\n  command and is passed to the corresponding internal call of @{command (HOL)\n  setup_lifting}. This theorem allows the Lifting package to generate a\n  stronger transfer rule for equality.\n\\<close>\n\n\nsubsection \\<open>Lifting package \\label{sec:lifting}\\<close>\n\ntext \\<open>\n  The Lifting package allows users to lift terms of the raw type to the\n  abstract type, which is a necessary step in building a library for an\n  abstract type. Lifting defines a new constant by combining coercion\n  functions (\\<^term>\\<open>Abs\\<close> and \\<^term>\\<open>Rep\\<close>) with the raw term. It also proves an\n  appropriate transfer rule for the Transfer (\\secref{sec:transfer}) package\n  and, if possible, an equation for the code generator.\n\n  The Lifting package provides two main commands: @{command (HOL)\n  \"setup_lifting\"} for initializing the package to work with a new type, and\n  @{command (HOL) \"lift_definition\"} for lifting constants. The Lifting\n  package works with all four kinds of type abstraction: type copies,\n  subtypes, total quotients and partial quotients.\n\n  Theoretical background can be found in \\<^cite>\\<open>\"Huffman-Kuncar:2013:lifting_transfer\"\\<close>.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"setup_lifting\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close>\\\\\n    @{command_def (HOL) \"lift_definition\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\\\\\n    @{command_def (HOL) \"lifting_forget\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close>\\\\\n    @{command_def (HOL) \"lifting_update\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close>\\\\\n    @{command_def (HOL) \"print_quot_maps\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{command_def (HOL) \"print_quotients\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{attribute_def (HOL) \"quot_map\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_eq_onp\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_mono\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_distr\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_del\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"lifting_restore\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) setup_lifting} @{syntax thm} @{syntax thm}? \\<newline>\n      (@'parametric' @{syntax thm})?\n    ;\n    @@{command (HOL) lift_definition} ('(' 'code_dt' ')')? \\<newline>\n      @{syntax name} '::' @{syntax type} @{syntax mixfix}? 'is' @{syntax term} \\<newline>\n      (@'parametric' (@{syntax thm}+))?\n    ;\n    @@{command (HOL) lifting_forget} @{syntax name}\n    ;\n    @@{command (HOL) lifting_update} @{syntax name}\n    ;\n    @@{attribute (HOL) lifting_restore}\n      @{syntax thm} (@{syntax thm} @{syntax thm})?\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"setup_lifting\"} Sets up the Lifting package to work with\n  a user-defined type. The command supports two modes.\n\n    \\<^enum> The first one is a low-level mode when the user must provide as a first\n    argument of @{command (HOL) \"setup_lifting\"} a quotient theorem \\<^term>\\<open>Quotient R Abs Rep T\\<close>. The package configures a transfer rule for\n    equality, a domain transfer rules and sets up the @{command_def (HOL)\n    \"lift_definition\"} command to work with the abstract type. An optional\n    theorem \\<^term>\\<open>reflp R\\<close>, which certifies that the equivalence relation R\n    is total, can be provided as a second argument. This allows the package to\n    generate stronger transfer rules. And finally, the parametricity theorem\n    for \\<^term>\\<open>R\\<close> can be provided as a third argument. This allows the package\n    to generate a stronger transfer rule for equality.\n\n    Users generally will not prove the \\<open>Quotient\\<close> theorem manually for new\n    types, as special commands exist to automate the process.\n\n    \\<^enum> When a new subtype is defined by @{command (HOL) typedef}, @{command\n    (HOL) \"lift_definition\"} can be used in its second mode, where only the\n    \\<^term>\\<open>type_definition\\<close> theorem \\<^term>\\<open>type_definition Rep Abs A\\<close> is\n    used as an argument of the command. The command internally proves the\n    corresponding \\<^term>\\<open>Quotient\\<close> theorem and registers it with @{command\n    (HOL) setup_lifting} using its first mode.\n\n  For quotients, the command @{command (HOL) quotient_type} can be used. The\n  command defines a new quotient type and similarly to the previous case, the\n  corresponding Quotient theorem is proved and registered by @{command (HOL)\n  setup_lifting}.\n\n  \\<^medskip>\n  The command @{command (HOL) \"setup_lifting\"} also sets up the code generator\n  for the new type. Later on, when a new constant is defined by @{command\n  (HOL) \"lift_definition\"}, the Lifting package proves and registers a code\n  equation (if there is one) for the new constant.\n\n  \\<^descr> @{command (HOL) \"lift_definition\"} \\<open>f :: \\<tau>\\<close> @{keyword (HOL) \"is\"} \\<open>t\\<close>\n  Defines a new function \\<open>f\\<close> with an abstract type \\<open>\\<tau>\\<close> in terms of a\n  corresponding operation \\<open>t\\<close> on a representation type. More formally, if \\<open>t\n  :: \\<sigma>\\<close>, then the command builds a term \\<open>F\\<close> as a corresponding combination of\n  abstraction and representation functions such that \\<open>F :: \\<sigma> \\<Rightarrow> \\<tau>\\<close> and defines\n  \\<open>f \\<equiv> F t\\<close>. The term \\<open>t\\<close> does not have to be necessarily a constant but it\n  can be any term.\n\n  The command opens a proof and the user must discharge a respectfulness proof\n  obligation. For a type copy, i.e.\\ a typedef with \\<open>UNIV\\<close>, the obligation is\n  discharged automatically. The proof goal is presented in a user-friendly,\n  readable form. A respectfulness theorem in the standard format \\<open>f.rsp\\<close> and a\n  transfer rule \\<open>f.transfer\\<close> for the Transfer package are generated by the\n  package.\n\n  The user can specify a parametricity theorems for \\<open>t\\<close> after the keyword\n  @{keyword \"parametric\"}, which allows the command to generate parametric\n  transfer rules for \\<open>f\\<close>.\n\n  For each constant defined through trivial quotients (type copies or\n  subtypes) \\<open>f.rep_eq\\<close> is generated. The equation is a code certificate that\n  defines \\<open>f\\<close> using the representation function.\n\n  For each constant \\<open>f.abs_eq\\<close> is generated. The equation is unconditional for\n  total quotients. The equation defines \\<open>f\\<close> using the abstraction function.\n\n  \\<^medskip>\n  Integration with [@{attribute code} abstract]: For subtypes (e.g.\\\n  corresponding to a datatype invariant, such as \\<^typ>\\<open>'a dlist\\<close>), @{command\n  (HOL) \"lift_definition\"} uses a code certificate theorem \\<open>f.rep_eq\\<close> as a\n  code equation. Because of the limitation of the code generator, \\<open>f.rep_eq\\<close>\n  cannot be used as a code equation if the subtype occurs inside the result\n  type rather than at the top level (e.g.\\ function returning \\<^typ>\\<open>'a dlist\n  option\\<close> vs. \\<^typ>\\<open>'a dlist\\<close>).\n\n  In this case, an extension of @{command (HOL) \"lift_definition\"} can be\n  invoked by specifying the flag \\<open>code_dt\\<close>. This extension enables code\n  execution through series of internal type and lifting definitions if the\n  return type \\<open>\\<tau>\\<close> meets the following inductive conditions:\n\n    \\<^descr> \\<open>\\<tau>\\<close> is a type variable\n\n    \\<^descr> \\<open>\\<tau> = \\<tau>\\<^sub>1 \\<dots> \\<tau>\\<^sub>n \\<kappa>\\<close>, where \\<open>\\<kappa>\\<close> is an abstract type constructor and \\<open>\\<tau>\\<^sub>1 \\<dots>\n    \\<tau>\\<^sub>n\\<close> do not contain abstract types (i.e.\\ \\<^typ>\\<open>int dlist\\<close> is allowed\n    whereas \\<^typ>\\<open>int dlist dlist\\<close> not)\n\n    \\<^descr> \\<open>\\<tau> = \\<tau>\\<^sub>1 \\<dots> \\<tau>\\<^sub>n \\<kappa>\\<close>, \\<open>\\<kappa>\\<close> is a type constructor that was defined as a\n    (co)datatype whose constructor argument types do not contain either\n    non-free datatypes or the function type.\n\n  Integration with [@{attribute code} equation]: For total quotients,\n  @{command (HOL) \"lift_definition\"} uses \\<open>f.abs_eq\\<close> as a code equation.\n\n  \\<^descr> @{command (HOL) lifting_forget} and @{command (HOL) lifting_update} These\n  two commands serve for storing and deleting the set-up of the Lifting\n  package and corresponding transfer rules defined by this package. This is\n  useful for hiding of type construction details of an abstract type when the\n  construction is finished but it still allows additions to this construction\n  when this is later necessary.\n\n  Whenever the Lifting package is set up with a new abstract type \\<open>\\<tau>\\<close> by\n  @{command_def (HOL) \"lift_definition\"}, the package defines a new bundle\n  that is called \\<open>\\<tau>.lifting\\<close>. This bundle already includes set-up for the\n  Lifting package. The new transfer rules introduced by @{command (HOL)\n  \"lift_definition\"} can be stored in the bundle by the command @{command\n  (HOL) \"lifting_update\"} \\<open>\\<tau>.lifting\\<close>.\n\n  The command @{command (HOL) \"lifting_forget\"} \\<open>\\<tau>.lifting\\<close> deletes set-up of\n  the Lifting package for \\<open>\\<tau>\\<close> and deletes all the transfer rules that were\n  introduced by @{command (HOL) \"lift_definition\"} using \\<open>\\<tau>\\<close> as an abstract\n  type.\n\n  The stored set-up in a bundle can be reintroduced by the Isar commands for\n  including a bundle (@{command \"include\"}, @{keyword \"includes\"} and\n  @{command \"including\"}).\n\n  \\<^descr> @{command (HOL) \"print_quot_maps\"} prints stored quotient map theorems.\n\n  \\<^descr> @{command (HOL) \"print_quotients\"} prints stored quotient theorems.\n\n  \\<^descr> @{attribute (HOL) quot_map} registers a quotient map theorem, a theorem\n  showing how to ``lift'' quotients over type constructors. E.g.\\ \\<^term>\\<open>Quotient R Abs Rep T \\<Longrightarrow> Quotient (rel_set R) (image Abs) (image Rep)\n  (rel_set T)\\<close>. For examples see \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or\n  \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property is proved automatically if the\n  involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) relator_eq_onp} registers a theorem that shows that a\n  relator applied to an equality restricted by a predicate \\<^term>\\<open>P\\<close> (i.e.\\\n  \\<^term>\\<open>eq_onp P\\<close>) is equal to a predicator applied to the \\<^term>\\<open>P\\<close>. The\n  combinator \\<^const>\\<open>eq_onp\\<close> is used for internal encoding of proper subtypes.\n  Such theorems allows the package to hide \\<open>eq_onp\\<close> from a user in a\n  user-readable form of a respectfulness theorem. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) \"relator_mono\"} registers a property describing a\n  monotonicity of a relator. E.g.\\ \\<^prop>\\<open>A \\<le> B \\<Longrightarrow> rel_set A \\<le> rel_set B\\<close>.\n  This property is needed for proving a stronger transfer rule in\n  @{command_def (HOL) \"lift_definition\"} when a parametricity theorem for the\n  raw term is specified and also for the reflexivity prover. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) \"relator_distr\"} registers a property describing a\n  distributivity of the relation composition and a relator. E.g.\\ \\<open>rel_set R\n  \\<circ>\\<circ> rel_set S = rel_set (R \\<circ>\\<circ> S)\\<close>. This property is needed for proving a\n  stronger transfer rule in @{command_def (HOL) \"lift_definition\"} when a\n  parametricity theorem for the raw term is specified. When this equality does\n  not hold unconditionally (e.g.\\ for the function type), the user can\n  specified each direction separately and also register multiple theorems with\n  different set of assumptions. This attribute can be used only after the\n  monotonicity property was already registered by @{attribute (HOL)\n  \"relator_mono\"}. For examples see \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or\n  \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property is proved automatically if the\n  involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) quot_del} deletes a corresponding Quotient theorem from\n  the Lifting infrastructure and thus de-register the corresponding quotient.\n  This effectively causes that @{command (HOL) lift_definition} will not do\n  any lifting for the corresponding type. This attribute is rather used for\n  low-level manipulation with set-up of the Lifting package because @{command\n  (HOL) lifting_forget} is preferred for normal usage.\n\n  \\<^descr> @{attribute (HOL) lifting_restore} \\<open>Quotient_thm pcr_def pcr_cr_eq_thm\\<close>\n  registers the Quotient theorem \\<open>Quotient_thm\\<close> in the Lifting infrastructure\n  and thus sets up lifting for an abstract type \\<open>\\<tau>\\<close> (that is defined by\n  \\<open>Quotient_thm\\<close>). Optional theorems \\<open>pcr_def\\<close> and \\<open>pcr_cr_eq_thm\\<close> can be\n  specified to register the parametrized correspondence relation for \\<open>\\<tau>\\<close>.\n  E.g.\\ for \\<^typ>\\<open>'a dlist\\<close>, \\<open>pcr_def\\<close> is \\<open>pcr_dlist A \\<equiv> list_all2 A \\<circ>\\<circ>\n  cr_dlist\\<close> and \\<open>pcr_cr_eq_thm\\<close> is \\<open>pcr_dlist (=) = (=)\\<close>. This attribute\n  is rather used for low-level manipulation with set-up of the Lifting package\n  because using of the bundle \\<open>\\<tau>.lifting\\<close> together with the commands @{command\n  (HOL) lifting_forget} and @{command (HOL) lifting_update} is preferred for\n  normal usage.\n\n  \\<^descr> Integration with the BNF package \\<^cite>\\<open>\"isabelle-datatypes\"\\<close>: As already\n  mentioned, the theorems that are registered by the following attributes are\n  proved and registered automatically if the involved type is BNF without dead\n  variables: @{attribute (HOL) quot_map}, @{attribute (HOL) relator_eq_onp},\n  @{attribute (HOL) \"relator_mono\"}, @{attribute (HOL) \"relator_distr\"}. Also\n  the definition of a relator and predicator is provided automatically.\n  Moreover, if the BNF represents a datatype, simplification rules for a\n  predicator are again proved automatically.\n\\<close>\n\n\nsubsection \\<open>Transfer package \\label{sec:transfer}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"transfer\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer'\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_prover\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) \"Transfer.transferred\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"untransferred\"} & : & \\<open>attribute\\<close> \\\\\n    @{method_def (HOL) \"transfer_start\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_prover_start\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_step\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_end\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_prover_end\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) \"transfer_rule\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"transfer_domain_rule\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_eq\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_domain\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^descr> @{method (HOL) \"transfer\"} method replaces the current subgoal with a\n  logically equivalent one that uses different types and constants. The\n  replacement of types and constants is guided by the database of transfer\n  rules. Goals are generalized over all free variables by default; this is\n  necessary for variables whose types change, but can be overridden for\n  specific variables with e.g. \\<open>transfer fixing: x y z\\<close>.\n\n  \\<^descr> @{method (HOL) \"transfer'\"} is a variant of @{method (HOL) transfer} that\n  allows replacing a subgoal with one that is logically stronger (rather than\n  equivalent). For example, a subgoal involving equality on a quotient type\n  could be replaced with a subgoal involving equality (instead of the\n  corresponding equivalence relation) on the underlying raw type.\n\n  \\<^descr> @{method (HOL) \"transfer_prover\"} method assists with proving a transfer\n  rule for a new constant, provided the constant is defined in terms of other\n  constants that already have transfer rules. It should be applied after\n  unfolding the constant definitions.\n\n  \\<^descr> @{method (HOL) \"transfer_start\"}, @{method (HOL) \"transfer_step\"},\n  @{method (HOL) \"transfer_end\"}, @{method (HOL) \"transfer_prover_start\"} and\n  @{method (HOL) \"transfer_prover_end\"} methods are meant to be used for\n  debugging of @{method (HOL) \"transfer\"} and @{method (HOL)\n  \"transfer_prover\"}, which we can decompose as follows: @{method (HOL)\n  \"transfer\"} = (@{method (HOL) \"transfer_start\"}, @{method (HOL)\n  \"transfer_step\"}+, @{method (HOL) \"transfer_end\"}) and @{method (HOL)\n  \"transfer_prover\"} = (@{method (HOL) \"transfer_prover_start\"}, @{method\n  (HOL) \"transfer_step\"}+, @{method (HOL) \"transfer_prover_end\"}). For usage\n  examples see \\<^file>\\<open>~~/src/HOL/ex/Transfer_Debug.thy\\<close>.\n\n  \\<^descr> @{attribute (HOL) \"untransferred\"} proves the same equivalent theorem as\n  @{method (HOL) \"transfer\"} internally does.\n\n  \\<^descr> @{attribute (HOL) Transfer.transferred} works in the opposite direction\n  than @{method (HOL) \"transfer'\"}. E.g.\\ given the transfer relation \\<open>ZN x n\n  \\<equiv> (x = int n)\\<close>, corresponding transfer rules and the theorem \\<open>\\<forall>x::int \\<in>\n  {0..}. x < x + 1\\<close>, the attribute would prove \\<open>\\<forall>n::nat. n < n + 1\\<close>. The\n  attribute is still in experimental phase of development.\n\n  \\<^descr> @{attribute (HOL) \"transfer_rule\"} attribute maintains a collection of\n  transfer rules, which relate constants at two different types. Typical\n  transfer rules may relate different type instances of the same polymorphic\n  constant, or they may relate an operation on a raw type to a corresponding\n  operation on an abstract type (quotient or subtype). For example:\n\n    \\<open>((A ===> B) ===> list_all2 A ===> list_all2 B) map map\\<close> \\\\\n    \\<open>(cr_int ===> cr_int ===> cr_int) (\\<lambda>(x,y) (u,v). (x+u, y+v)) plus\\<close>\n\n  Lemmas involving predicates on relations can also be registered using the\n  same attribute. For example:\n\n    \\<open>bi_unique A \\<Longrightarrow> (list_all2 A ===> (=)) distinct distinct\\<close> \\\\\n    \\<open>\\<lbrakk>bi_unique A; bi_unique B\\<rbrakk> \\<Longrightarrow> bi_unique (rel_prod A B)\\<close>\n\n  Preservation of predicates on relations (\\<open>bi_unique, bi_total, right_unique,\n  right_total, left_unique, left_total\\<close>) with the respect to a relator is\n  proved automatically if the involved type is BNF \\<^cite>\\<open>\"isabelle-datatypes\"\\<close> without dead variables.\n\n  \\<^descr> @{attribute (HOL) \"transfer_domain_rule\"} attribute maintains a collection\n  of rules, which specify a domain of a transfer relation by a predicate.\n  E.g.\\ given the transfer relation \\<open>ZN x n \\<equiv> (x = int n)\\<close>, one can register\n  the following transfer domain rule: \\<open>Domainp ZN = (\\<lambda>x. x \\<ge> 0)\\<close>. The rules\n  allow the package to produce more readable transferred goals, e.g.\\ when\n  quantifiers are transferred.\n\n  \\<^descr> @{attribute (HOL) relator_eq} attribute collects identity laws for\n  relators of various type constructors, e.g. \\<^term>\\<open>rel_set (=) = (=)\\<close>.\n  The @{method (HOL) transfer} method uses these lemmas to infer\n  transfer rules for non-polymorphic constants on the fly. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute_def (HOL) \"relator_domain\"} attribute collects rules\n  describing domains of relators by predicators. E.g.\\ \\<^term>\\<open>Domainp\n  (rel_set T) = (\\<lambda>A. Ball A (Domainp T))\\<close>. This allows the package to lift\n  transfer domain rules through type constructors. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n\n  Theoretical background can be found in \\<^cite>\\<open>\"Huffman-Kuncar:2013:lifting_transfer\"\\<close>.\n\\<close>\n\n\nsubsection \\<open>Old-style definitions for quotient types \\label{sec:old-quotient}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"quotient_definition\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\\\\\n    @{command_def (HOL) \"print_quotmapsQ3\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{command_def (HOL) \"print_quotientsQ3\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{command_def (HOL) \"print_quotconsts\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{method_def (HOL) \"lifting\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"lifting_setup\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"descending\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"descending_setup\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"partiality_descending\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"partiality_descending_setup\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"regularize\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"injection\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"cleaning\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) \"quot_thm\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_lifted\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_respect\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_preserve\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) quotient_definition} constdecl? @{syntax thmdecl}? \\<newline>\n    @{syntax term} 'is' @{syntax term}\n    ;\n    constdecl: @{syntax name} ('::' @{syntax type})? @{syntax mixfix}?\n    ;\n    @@{method (HOL) lifting} @{syntax thms}?\n    ;\n    @@{method (HOL) lifting_setup} @{syntax thms}?\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"quotient_definition\"} defines a constant on the quotient\n  type.\n\n  \\<^descr> @{command (HOL) \"print_quotmapsQ3\"} prints quotient map functions.\n\n  \\<^descr> @{command (HOL) \"print_quotientsQ3\"} prints quotients.\n\n  \\<^descr> @{command (HOL) \"print_quotconsts\"} prints quotient constants.\n\n  \\<^descr> @{method (HOL) \"lifting\"} and @{method (HOL) \"lifting_setup\"} methods\n  match the current goal with the given raw theorem to be lifted producing\n  three new subgoals: regularization, injection and cleaning subgoals.\n  @{method (HOL) \"lifting\"} tries to apply the heuristics for automatically\n  solving these three subgoals and leaves only the subgoals unsolved by the\n  heuristics to the user as opposed to @{method (HOL) \"lifting_setup\"} which\n  leaves the three subgoals unsolved.\n\n  \\<^descr> @{method (HOL) \"descending\"} and @{method (HOL) \"descending_setup\"} try to\n  guess a raw statement that would lift to the current subgoal. Such statement\n  is assumed as a new subgoal and @{method (HOL) \"descending\"} continues in\n  the same way as @{method (HOL) \"lifting\"} does. @{method (HOL) \"descending\"}\n  tries to solve the arising regularization, injection and cleaning subgoals\n  with the analogous method @{method (HOL) \"descending_setup\"} which leaves\n  the four unsolved subgoals.\n\n  \\<^descr> @{method (HOL) \"partiality_descending\"} finds the regularized theorem that\n  would lift to the current subgoal, lifts it and leaves as a subgoal. This\n  method can be used with partial equivalence quotients where the non\n  regularized statements would not be true. @{method (HOL)\n  \"partiality_descending_setup\"} leaves the injection and cleaning subgoals\n  unchanged.\n\n  \\<^descr> @{method (HOL) \"regularize\"} applies the regularization heuristics to the\n  current subgoal.\n\n  \\<^descr> @{method (HOL) \"injection\"} applies the injection heuristics to the\n  current goal using the stored quotient respectfulness theorems.\n\n  \\<^descr> @{method (HOL) \"cleaning\"} applies the injection cleaning heuristics to\n  the current subgoal using the stored quotient preservation theorems.\n\n  \\<^descr> @{attribute (HOL) quot_lifted} attribute tries to automatically transport\n  the theorem to the quotient type. The attribute uses all the defined\n  quotients types and quotient constants often producing undesired results or\n  theorems that cannot be lifted.\n\n  \\<^descr> @{attribute (HOL) quot_respect} and @{attribute (HOL) quot_preserve}\n  attributes declare a theorem as a respectfulness and preservation theorem\n  respectively. These are stored in the local theory store and used by the\n  @{method (HOL) \"injection\"} and @{method (HOL) \"cleaning\"} methods\n  respectively.\n\n  \\<^descr> @{attribute (HOL) quot_thm} declares that a certain theorem is a quotient\n  extension theorem. Quotient extension theorems allow for quotienting inside\n  container types. Given a polymorphic type that serves as a container, a map\n  function defined for this container using @{command (HOL) \"functor\"} and a\n  relation map defined for for the container type, the quotient extension\n  theorem should be \\<^term>\\<open>Quotient3 R Abs Rep \\<Longrightarrow> Quotient3 (rel_map R) (map\n  Abs) (map Rep)\\<close>. Quotient extension theorems are stored in a database and\n  are used all the steps of lifting theorems.\n\\<close>\n\n\nchapter \\<open>Proof tools\\<close>\n\nsection \\<open>Proving propositions\\<close>\n\ntext \\<open>\n  In addition to the standard proof methods, a number of diagnosis tools\n  search for proofs and provide an Isar proof snippet on success. These tools\n  are available via the following commands.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"solve_direct\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"try\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"try0\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"sledgehammer\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"sledgehammer_params\"} & : & \\<open>theory \\<rightarrow> theory\\<close>\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) try}\n    ;\n\n    @@{command (HOL) try0} ( ( ( 'simp' | 'intro' | 'elim' | 'dest' ) ':' @{syntax thms} ) + ) ?\n      @{syntax nat}?\n    ;\n\n    @@{command (HOL) sledgehammer} ( '[' args ']' )? facts? @{syntax nat}?\n    ;\n\n    @@{command (HOL) sledgehammer_params} ( ( '[' args ']' ) ? )\n    ;\n    args: ( @{syntax name} '=' value + ',' )\n    ;\n    facts: '(' ( ( ( ( 'add' | 'del' ) ':' ) ? @{syntax thms} ) + ) ? ')'\n  \\<close> % FIXME check args \"value\"\n\n  \\<^descr> @{command (HOL) \"solve_direct\"} checks whether the current subgoals can be\n  solved directly by an existing theorem. Duplicate lemmas can be detected in\n  this way.\n\n  \\<^descr> @{command (HOL) \"try0\"} attempts to prove a subgoal using a combination of\n  standard proof methods (@{method auto}, @{method simp}, @{method blast},\n  etc.). Additional facts supplied via \\<open>simp:\\<close>, \\<open>intro:\\<close>, \\<open>elim:\\<close>, and \\<open>dest:\\<close>\n  are passed to the appropriate proof methods.\n\n  \\<^descr> @{command (HOL) \"try\"} attempts to prove or disprove a subgoal using a\n  combination of provers and disprovers (@{command (HOL) \"solve_direct\"},\n  @{command (HOL) \"quickcheck\"}, @{command (HOL) \"try0\"}, @{command (HOL)\n  \"sledgehammer\"}, @{command (HOL) \"nitpick\"}).\n\n  \\<^descr> @{command (HOL) \"sledgehammer\"} attempts to prove a subgoal using external\n  automatic provers (resolution provers and SMT solvers). See the Sledgehammer\n  manual \\<^cite>\\<open>\"isabelle-sledgehammer\"\\<close> for details.\n\n  \\<^descr> @{command (HOL) \"sledgehammer_params\"} changes @{command (HOL)\n  \"sledgehammer\"} configuration options persistently.\n\\<close>\n\n\nsection \\<open>Checking and refuting propositions\\<close>\n\ntext \\<open>\n  Identifying incorrect propositions usually involves evaluation of particular\n  assignments and systematic counterexample search. This is supported by the\n  following commands.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"value\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"values\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"quickcheck\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"nitpick\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"quickcheck_params\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"nitpick_params\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"quickcheck_generator\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"find_unused_assms\"} & : & \\<open>context \\<rightarrow>\\<close>\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) value} ( '[' @{syntax name} ']' )? modes? @{syntax term}\n    ;\n\n    @@{command (HOL) values} modes? @{syntax nat}? @{syntax term}\n    ;\n\n    (@@{command (HOL) quickcheck} | @@{command (HOL) nitpick})\n      ( '[' args ']' )? @{syntax nat}?\n    ;\n\n    (@@{command (HOL) quickcheck_params} |\n      @@{command (HOL) nitpick_params}) ( '[' args ']' )?\n    ;\n\n    @@{command (HOL) quickcheck_generator} @{syntax name} \\<newline>\n      'operations:' ( @{syntax term} +)\n    ;\n\n    @@{command (HOL) find_unused_assms} @{syntax name}?\n    ;\n    modes: '(' (@{syntax name} +) ')'\n    ;\n    args: ( @{syntax name} '=' value + ',' )\n  \\<close> % FIXME check \"value\"\n\n  \\<^descr> @{command (HOL) \"value\"}~\\<open>t\\<close> evaluates and prints a term; optionally\n  \\<open>modes\\<close> can be specified, which are appended to the current print mode; see\n  \\secref{sec:print-modes}. Evaluation is tried first using ML, falling back\n  to normalization by evaluation if this fails. Alternatively a specific\n  evaluator can be selected using square brackets; typical evaluators use the\n  current set of code equations to normalize and include \\<open>simp\\<close> for fully\n  symbolic evaluation using the simplifier, \\<open>nbe\\<close> for \\<^emph>\\<open>normalization by\n  evaluation\\<close> and \\<^emph>\\<open>code\\<close> for code generation in SML.\n\n  \\<^descr> @{command (HOL) \"values\"}~\\<open>t\\<close> enumerates a set comprehension by evaluation\n  and prints its values up to the given number of solutions; optionally\n  \\<open>modes\\<close> can be specified, which are appended to the current print mode; see\n  \\secref{sec:print-modes}.\n\n  \\<^descr> @{command (HOL) \"quickcheck\"} tests the current goal for counterexamples\n  using a series of assignments for its free variables; by default the first\n  subgoal is tested, an other can be selected explicitly using an optional\n  goal index. Assignments can be chosen exhausting the search space up to a\n  given size, or using a fixed number of random assignments in the search\n  space, or exploring the search space symbolically using narrowing. By\n  default, quickcheck uses exhaustive testing. A number of configuration\n  options are supported for @{command (HOL) \"quickcheck\"}, notably:\n\n    \\<^descr>[\\<open>tester\\<close>] specifies which testing approach to apply. There are three\n    testers, \\<open>exhaustive\\<close>, \\<open>random\\<close>, and \\<open>narrowing\\<close>. An unknown configuration\n    option is treated as an argument to tester, making \\<open>tester =\\<close> optional.\n    When multiple testers are given, these are applied in parallel. If no\n    tester is specified, quickcheck uses the testers that are set active,\n    i.e.\\ configurations @{attribute quickcheck_exhaustive_active},\n    @{attribute quickcheck_random_active}, @{attribute\n    quickcheck_narrowing_active} are set to true.\n\n    \\<^descr>[\\<open>size\\<close>] specifies the maximum size of the search space for assignment\n    values.\n\n    \\<^descr>[\\<open>genuine_only\\<close>] sets quickcheck only to return genuine counterexample,\n    but not potentially spurious counterexamples due to underspecified\n    functions.\n\n    \\<^descr>[\\<open>abort_potential\\<close>] sets quickcheck to abort once it found a potentially\n    spurious counterexample and to not continue to search for a further\n    genuine counterexample. For this option to be effective, the\n    \\<open>genuine_only\\<close> option must be set to false.\n\n    \\<^descr>[\\<open>eval\\<close>] takes a term or a list of terms and evaluates these terms under\n    the variable assignment found by quickcheck. This option is currently only\n    supported by the default (exhaustive) tester.\n\n    \\<^descr>[\\<open>iterations\\<close>] sets how many sets of assignments are generated for each\n    particular size.\n\n    \\<^descr>[\\<open>no_assms\\<close>] specifies whether assumptions in structured proofs should be\n    ignored.\n\n    \\<^descr>[\\<open>locale\\<close>] specifies how to process conjectures in a locale context,\n    i.e.\\ they can be interpreted or expanded. The option is a\n    whitespace-separated list of the two words \\<open>interpret\\<close> and \\<open>expand\\<close>. The\n    list determines the order they are employed. The default setting is to\n    first use interpretations and then test the expanded conjecture. The\n    option is only provided as attribute declaration, but not as parameter to\n    the command.\n\n    \\<^descr>[\\<open>timeout\\<close>] sets the time limit in seconds.\n\n    \\<^descr>[\\<open>default_type\\<close>] sets the type(s) generally used to instantiate type\n    variables.\n\n    \\<^descr>[\\<open>report\\<close>] if set quickcheck reports how many tests fulfilled the\n    preconditions.\n\n    \\<^descr>[\\<open>use_subtype\\<close>] if set quickcheck automatically lifts conjectures to\n    registered subtypes if possible, and tests the lifted conjecture.\n\n    \\<^descr>[\\<open>quiet\\<close>] if set quickcheck does not output anything while testing.\n\n    \\<^descr>[\\<open>verbose\\<close>] if set quickcheck informs about the current size and\n    cardinality while testing.\n\n    \\<^descr>[\\<open>expect\\<close>] can be used to check if the user's expectation was met\n    (\\<open>no_expectation\\<close>, \\<open>no_counterexample\\<close>, or \\<open>counterexample\\<close>).\n\n  These option can be given within square brackets.\n\n  Using the following type classes, the testers generate values and convert\n  them back into Isabelle terms for displaying counterexamples.\n\n    \\<^descr>[\\<open>exhaustive\\<close>] The parameters of the type classes \\<^class>\\<open>exhaustive\\<close> and\n    \\<^class>\\<open>full_exhaustive\\<close> implement the testing. They take a testing\n    function as a parameter, which takes a value of type \\<^typ>\\<open>'a\\<close> and\n    optionally produces a counterexample, and a size parameter for the test\n    values. In \\<^class>\\<open>full_exhaustive\\<close>, the testing function parameter\n    additionally expects a lazy term reconstruction in the type \\<^typ>\\<open>Code_Evaluation.term\\<close> of the tested value.\n\n    The canonical implementation for \\<open>exhaustive\\<close> testers calls the given\n    testing function on all values up to the given size and stops as soon as a\n    counterexample is found.\n\n    \\<^descr>[\\<open>random\\<close>] The operation \\<^const>\\<open>Quickcheck_Random.random\\<close> of the type\n    class \\<^class>\\<open>random\\<close> generates a pseudo-random value of the given size\n    and a lazy term reconstruction of the value in the type \\<^typ>\\<open>Code_Evaluation.term\\<close>. A pseudo-randomness generator is defined in theory\n    \\<^theory>\\<open>HOL.Random\\<close>.\n\n    \\<^descr>[\\<open>narrowing\\<close>] implements Haskell's Lazy Smallcheck \\<^cite>\\<open>\"runciman-naylor-lindblad\"\\<close> using the type classes \\<^class>\\<open>narrowing\\<close> and\n    \\<^class>\\<open>partial_term_of\\<close>. Variables in the current goal are initially\n    represented as symbolic variables. If the execution of the goal tries to\n    evaluate one of them, the test engine replaces it with refinements\n    provided by \\<^const>\\<open>narrowing\\<close>. Narrowing views every value as a\n    sum-of-products which is expressed using the operations \\<^const>\\<open>Quickcheck_Narrowing.cons\\<close> (embedding a value), \\<^const>\\<open>Quickcheck_Narrowing.apply\\<close> (product) and \\<^const>\\<open>Quickcheck_Narrowing.sum\\<close> (sum). The refinement should enable further\n    evaluation of the goal.\n\n    For example, \\<^const>\\<open>narrowing\\<close> for the list type \\<^typ>\\<open>'a :: narrowing list\\<close>\n    can be recursively defined as\n    \\<^term>\\<open>Quickcheck_Narrowing.sum (Quickcheck_Narrowing.cons [])\n              (Quickcheck_Narrowing.apply\n                (Quickcheck_Narrowing.apply\n                  (Quickcheck_Narrowing.cons (#))\n                  narrowing)\n                narrowing)\\<close>.\n    If a symbolic variable of type \\<^typ>\\<open>_ list\\<close> is evaluated, it is\n    replaced by (i)~the empty list \\<^term>\\<open>[]\\<close> and (ii)~by a non-empty list\n    whose head and tail can then be recursively refined if needed.\n\n    To reconstruct counterexamples, the operation \\<^const>\\<open>partial_term_of\\<close>\n    transforms \\<open>narrowing\\<close>'s deep representation of terms to the type \\<^typ>\\<open>Code_Evaluation.term\\<close>. The deep representation models symbolic variables\n    as \\<^const>\\<open>Quickcheck_Narrowing.Narrowing_variable\\<close>, which are normally\n    converted to \\<^const>\\<open>Code_Evaluation.Free\\<close>, and refined values as \\<^term>\\<open>Quickcheck_Narrowing.Narrowing_constructor i args\\<close>, where \\<^term>\\<open>i ::\n    integer\\<close> denotes the index in the sum of refinements. In the above\n    example for lists, \\<^term>\\<open>0\\<close> corresponds to \\<^term>\\<open>[]\\<close> and \\<^term>\\<open>1\\<close>\n    to \\<^term>\\<open>(#)\\<close>.\n\n    The command @{command (HOL) \"code_datatype\"} sets up \\<^const>\\<open>partial_term_of\\<close> such that the \\<^term>\\<open>i\\<close>-th refinement is interpreted as\n    the \\<^term>\\<open>i\\<close>-th constructor, but it does not ensures consistency with\n    \\<^const>\\<open>narrowing\\<close>.\n\n  \\<^descr> @{command (HOL) \"quickcheck_params\"} changes @{command (HOL) \"quickcheck\"}\n  configuration options persistently.\n\n  \\<^descr> @{command (HOL) \"quickcheck_generator\"} creates random and exhaustive\n  value generators for a given type and operations. It generates values by\n  using the operations as if they were constructors of that type.\n\n  \\<^descr> @{command (HOL) \"nitpick\"} tests the current goal for counterexamples\n  using a reduction to first-order relational logic. See the Nitpick manual\n  \\<^cite>\\<open>\"isabelle-nitpick\"\\<close> for details.\n\n  \\<^descr> @{command (HOL) \"nitpick_params\"} changes @{command (HOL) \"nitpick\"}\n  configuration options persistently.\n\n  \\<^descr> @{command (HOL) \"find_unused_assms\"} finds potentially superfluous\n  assumptions in theorems using quickcheck. It takes the theory name to be\n  checked for superfluous assumptions as optional argument. If not provided,\n  it checks the current theory. Options to the internal quickcheck invocations\n  can be changed with common configuration declarations.\n\\<close>\n\n\nsection \\<open>Coercive subtyping\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) coercion} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_delete} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_enabled} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_map} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_args} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  Coercive subtyping allows the user to omit explicit type conversions, also\n  called \\<^emph>\\<open>coercions\\<close>. Type inference will add them as necessary when parsing\n  a term. See \\<^cite>\\<open>\"traytel-berghofer-nipkow-2011\"\\<close> for details.\n\n  \\<^rail>\\<open>\n    @@{attribute (HOL) coercion} (@{syntax term})\n    ;\n    @@{attribute (HOL) coercion_delete} (@{syntax term})\n    ;\n    @@{attribute (HOL) coercion_map} (@{syntax term})\n    ;\n    @@{attribute (HOL) coercion_args} (@{syntax const}) (('+' | '0' | '-')+)\n  \\<close>\n\n  \\<^descr> @{attribute (HOL) \"coercion\"}~\\<open>f\\<close> registers a new coercion function \\<open>f ::\n  \\<sigma>\\<^sub>1 \\<Rightarrow> \\<sigma>\\<^sub>2\\<close> where \\<open>\\<sigma>\\<^sub>1\\<close> and \\<open>\\<sigma>\\<^sub>2\\<close> are type constructors without arguments.\n  Coercions are composed by the inference algorithm if needed. Note that the\n  type inference algorithm is complete only if the registered coercions form a\n  lattice.\n\n  \\<^descr> @{attribute (HOL) \"coercion_delete\"}~\\<open>f\\<close> deletes a preceding declaration\n  (using @{attribute (HOL) \"coercion\"}) of the function \\<open>f :: \\<sigma>\\<^sub>1 \\<Rightarrow> \\<sigma>\\<^sub>2\\<close> as a\n  coercion.\n\n  \\<^descr> @{attribute (HOL) \"coercion_map\"}~\\<open>map\\<close> registers a new map function to\n  lift coercions through type constructors. The function \\<open>map\\<close> must conform to\n  the following type pattern\n\n  \\begin{matharray}{lll}\n    \\<open>map\\<close> & \\<open>::\\<close> &\n      \\<open>f\\<^sub>1 \\<Rightarrow> \\<dots> \\<Rightarrow> f\\<^sub>n \\<Rightarrow> (\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n) t \\<Rightarrow> (\\<beta>\\<^sub>1, \\<dots>, \\<beta>\\<^sub>n) t\\<close> \\\\\n  \\end{matharray}\n\n  where \\<open>t\\<close> is a type constructor and \\<open>f\\<^sub>i\\<close> is of type \\<open>\\<alpha>\\<^sub>i \\<Rightarrow> \\<beta>\\<^sub>i\\<close> or \\<open>\\<beta>\\<^sub>i \\<Rightarrow>\n  \\<alpha>\\<^sub>i\\<close>. Registering a map function overwrites any existing map function for\n  this particular type constructor.\n\n  \\<^descr> @{attribute (HOL) \"coercion_args\"} can be used to disallow coercions to be\n  inserted in certain positions in a term. For example, given the constant \\<open>c\n  :: \\<sigma>\\<^sub>1 \\<Rightarrow> \\<sigma>\\<^sub>2 \\<Rightarrow> \\<sigma>\\<^sub>3 \\<Rightarrow> \\<sigma>\\<^sub>4\\<close> and the list of policies \\<open>- + 0\\<close> as arguments,\n  coercions will not be inserted in the first argument of \\<open>c\\<close> (policy \\<open>-\\<close>);\n  they may be inserted in the second argument (policy \\<open>+\\<close>) even if the\n  constant \\<open>c\\<close> itself is in a position where coercions are disallowed; the\n  third argument inherits the allowance of coercsion insertion from the\n  position of the constant \\<open>c\\<close> (policy \\<open>0\\<close>). The standard usage of policies is\n  the definition of syntatic constructs (usually extralogical, i.e., processed\n  and stripped during type inference), that should not be destroyed by the\n  insertion of coercions (see, for example, the setup for the case syntax in\n  \\<^theory>\\<open>HOL.Ctr_Sugar\\<close>).\n\n  \\<^descr> @{attribute (HOL) \"coercion_enabled\"} enables the coercion inference\n  algorithm.\n\\<close>\n\n\nsection \\<open>Arithmetic proof support\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) arith} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) arith} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) linarith_split} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^descr> @{method (HOL) arith} decides linear arithmetic problems (on types \\<open>nat\\<close>,\n  \\<open>int\\<close>, \\<open>real\\<close>). Any current facts are inserted into the goal before running\n  the procedure.\n\n  \\<^descr> @{attribute (HOL) arith} declares facts that are supplied to the\n  arithmetic provers implicitly.\n\n  \\<^descr> @{attribute (HOL) linarith_split} attribute declares case split rules to be\n  expanded before @{method (HOL) arith} is invoked.\n\n\n  Note that a simpler (but faster) arithmetic prover is already invoked by the\n  Simplifier.\n\\<close>\n\n\nsection \\<open>Intuitionistic proof search\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) iprover} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) iprover} (@{syntax rulemod} *)\n  \\<close>\n\n  \\<^descr> @{method (HOL) iprover} performs intuitionistic proof search, depending on\n  specifically declared rules from the context, or given as explicit\n  arguments. Chained facts are inserted into the goal before commencing proof\n  search.\n\n  Rules need to be classified as @{attribute (Pure) intro}, @{attribute (Pure)\n  elim}, or @{attribute (Pure) dest}; here the ``\\<open>!\\<close>'' indicator refers to\n  ``safe'' rules, which may be applied aggressively (without considering\n  back-tracking later). Rules declared with ``\\<open>?\\<close>'' are ignored in proof\n  search (the single-step @{method (Pure) rule} method still observes these).\n  An explicit weight annotation may be given as well; otherwise the number of\n  rule premises will be taken into account here.\n\\<close>\n\n\nsection \\<open>Model Elimination and Resolution\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"meson\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"metis\"} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) meson} @{syntax thms}?\n    ;\n    @@{method (HOL) metis}\n      ('(' ('partial_types' | 'full_types' | 'no_types' | @{syntax name}) ')')?\n      @{syntax thms}?\n  \\<close>\n\n  \\<^descr> @{method (HOL) meson} implements Loveland's model elimination procedure\n  \\<^cite>\\<open>\"loveland-78\"\\<close>. See \\<^file>\\<open>~~/src/HOL/ex/Meson_Test.thy\\<close> for examples.\n\n  \\<^descr> @{method (HOL) metis} combines ordered resolution and ordered\n  paramodulation to find first-order (or mildly higher-order) proofs. The\n  first optional argument specifies a type encoding; see the Sledgehammer\n  manual \\<^cite>\\<open>\"isabelle-sledgehammer\"\\<close> for details. The directory\n  \\<^dir>\\<open>~~/src/HOL/Metis_Examples\\<close> contains several small theories developed to a\n  large extent using @{method (HOL) metis}.\n\\<close>\n\n\nsection \\<open>Algebraic reasoning via Gröbner bases\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"algebra\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) algebra} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) algebra}\n      ('add' ':' @{syntax thms})?\n      ('del' ':' @{syntax thms})?\n    ;\n    @@{attribute (HOL) algebra} (() | 'add' | 'del')\n  \\<close>\n\n  \\<^descr> @{method (HOL) algebra} performs algebraic reasoning via Gröbner bases,\n  see also \\<^cite>\\<open>\"Chaieb-Wenzel:2007\"\\<close> and \\<^cite>\\<open>\\<open>\\S3.2\\<close> in \"Chaieb-thesis\"\\<close>.\n  The method handles deals with two main classes of problems:\n\n    \\<^enum> Universal problems over multivariate polynomials in a\n    (semi)-ring/field/idom; the capabilities of the method are augmented\n    according to properties of these structures. For this problem class the\n    method is only complete for algebraically closed fields, since the\n    underlying method is based on Hilbert's Nullstellensatz, where the\n    equivalence only holds for algebraically closed fields.\n\n    The problems can contain equations \\<open>p = 0\\<close> or inequations \\<open>q \\<noteq> 0\\<close> anywhere\n    within a universal problem statement.\n\n    \\<^enum> All-exists problems of the following restricted (but useful) form:\n\n    @{text [display] \"\\<forall>x\\<^sub>1 \\<dots> x\\<^sub>n.\n      e\\<^sub>1(x\\<^sub>1, \\<dots>, x\\<^sub>n) = 0 \\<and> \\<dots> \\<and> e\\<^sub>m(x\\<^sub>1, \\<dots>, x\\<^sub>n) = 0 \\<longrightarrow>\n      (\\<exists>y\\<^sub>1 \\<dots> y\\<^sub>k.\n        p\\<^sub>1\\<^sub>1(x\\<^sub>1, \\<dots> ,x\\<^sub>n) * y\\<^sub>1 + \\<dots> + p\\<^sub>1\\<^sub>k(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>k = 0 \\<and>\n        \\<dots> \\<and>\n        p\\<^sub>t\\<^sub>1(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>1 + \\<dots> + p\\<^sub>t\\<^sub>k(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>k = 0)\"}\n\n    Here \\<open>e\\<^sub>1, \\<dots>, e\\<^sub>n\\<close> and the \\<open>p\\<^sub>i\\<^sub>j\\<close> are multivariate polynomials only in\n    the variables mentioned as arguments.\n\n  The proof method is preceded by a simplification step, which may be modified\n  by using the form \\<open>(algebra add: ths\\<^sub>1 del: ths\\<^sub>2)\\<close>. This acts like\n  declarations for the Simplifier (\\secref{sec:simplifier}) on a private\n  simpset for this tool.\n\n  \\<^descr> @{attribute algebra} (as attribute) manages the default collection of\n  pre-simplification rules of the above proof method.\n\\<close>\n\n\nsubsubsection \\<open>Example\\<close>\n\ntext \\<open>\n  The subsequent example is from geometry: collinearity is invariant by\n  rotation.\n\\<close>\n\n(*<*)experiment begin(*>*)\ntype_synonym point = \"int \\<times> int\"\n\nfun collinear :: \"point \\<Rightarrow> point \\<Rightarrow> point \\<Rightarrow> bool\" where\n  \"collinear (Ax, Ay) (Bx, By) (Cx, Cy) \\<longleftrightarrow>\n    (Ax - Bx) * (By - Cy) = (Ay - By) * (Bx - Cx)\"\n\nlemma collinear_inv_rotation:\n  assumes \"collinear (Ax, Ay) (Bx, By) (Cx, Cy)\" and \"c\\<^sup>2 + s\\<^sup>2 = 1\"\n  shows \"collinear (Ax * c - Ay * s, Ay * c + Ax * s)\n    (Bx * c - By * s, By * c + Bx * s) (Cx * c - Cy * s, Cy * c + Cx * s)\"\n  using assms by (algebra add: collinear.simps)\n(*<*)end(*>*)\n\ntext \\<open>\n  See also \\<^file>\\<open>~~/src/HOL/Examples/Groebner_Examples.thy\\<close>.\n\\<close>\n\n\nsection \\<open>Coherent Logic\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"coherent\"} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) coherent} @{syntax thms}?\n  \\<close>\n\n  \\<^descr> @{method (HOL) coherent} solves problems of \\<^emph>\\<open>Coherent Logic\\<close> \\<^cite>\\<open>\"Bezem-Coquand:2005\"\\<close>, which covers applications in confluence theory,\n  lattice theory and projective geometry. See \\<^file>\\<open>~~/src/HOL/Examples/Coherent.thy\\<close>\n  for some examples.\n\\<close>\n\n\nsection \\<open>Unstructured case analysis and induction \\label{sec:hol-induct-tac}\\<close>\n\ntext \\<open>\n  The following tools of Isabelle/HOL support cases analysis and induction in\n  unstructured tactic scripts; see also \\secref{sec:cases-induct} for proper\n  Isar versions of similar ideas.\n\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) case_tac}\\<open>\\<^sup>*\\<close> & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) induct_tac}\\<open>\\<^sup>*\\<close> & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) ind_cases}\\<open>\\<^sup>*\\<close> & : & \\<open>method\\<close> \\\\\n    @{command_def (HOL) \"inductive_cases\"}\\<open>\\<^sup>*\\<close> & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{method (HOL) case_tac} @{syntax goal_spec}? @{syntax term} rule?\n    ;\n    @@{method (HOL) induct_tac} @{syntax goal_spec}? (@{syntax insts} * @'and') rule?\n    ;\n    @@{method (HOL) ind_cases} (@{syntax prop}+) @{syntax for_fixes}\n    ;\n    @@{command (HOL) inductive_cases} (@{syntax thmdecl}? (@{syntax prop}+) + @'and')\n    ;\n    rule: 'rule' ':' @{syntax thm}\n  \\<close>\n\n  \\<^descr> @{method (HOL) case_tac} and @{method (HOL) induct_tac} admit to reason\n  about inductive types. Rules are selected according to the declarations by\n  the @{attribute cases} and @{attribute induct} attributes, cf.\\\n  \\secref{sec:cases-induct}. The @{command (HOL) datatype} package already\n  takes care of this.\n\n  These unstructured tactics feature both goal addressing and dynamic\n  instantiation. Note that named rule cases are \\<^emph>\\<open>not\\<close> provided as would be by\n  the proper @{method cases} and @{method induct} proof methods (see\n  \\secref{sec:cases-induct}). Unlike the @{method induct} method, @{method\n  induct_tac} does not handle structured rule statements, only the compact\n  object-logic conclusion of the subgoal being addressed.\n\n  \\<^descr> @{method (HOL) ind_cases} and @{command (HOL) \"inductive_cases\"} provide\n  an interface to the internal \\<^ML_text>\\<open>mk_cases\\<close> operation. Rules are\n  simplified in an unrestricted forward manner.\n\n  While @{method (HOL) ind_cases} is a proof method to apply the result\n  immediately as elimination rules, @{command (HOL) \"inductive_cases\"}\n  provides case split theorems at the theory level for later use. The\n  @{keyword \"for\"} argument of the @{method (HOL) ind_cases} method allows to\n  specify a list of variables that should be generalized before applying the\n  resulting rule.\n\\<close>\n\n\nsection \\<open>Adhoc tuples\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) split_format}\\<open>\\<^sup>*\\<close> & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{attribute (HOL) split_format} ('(' 'complete' ')')?\n  \\<close>\n\n  \\<^descr> @{attribute (HOL) split_format}\\ \\<open>(complete)\\<close> causes arguments in function\n  applications to be represented canonically according to their tuple type\n  structure.\n\n  Note that this operation tends to invent funny names for new local\n  parameters introduced.\n\\<close>\n\n\nchapter \\<open>Executable code \\label{ch:export-code}\\<close>\n\ntext \\<open>\n  For validation purposes, it is often useful to \\<^emph>\\<open>execute\\<close> specifications. In\n  principle, execution could be simulated by Isabelle's inference kernel, i.e.\n  by a combination of resolution and simplification. Unfortunately, this\n  approach is rather inefficient. A more efficient way of executing\n  specifications is to translate them into a functional programming language\n  such as ML.\n\n  Isabelle provides a generic framework to support code generation from\n  executable specifications. Isabelle/HOL instantiates these mechanisms in a\n  way that is amenable to end-user applications. Code can be generated for\n  functional programs (including overloading using type classes) targeting SML\n  \\<^cite>\\<open>SML\\<close>, OCaml \\<^cite>\\<open>OCaml\\<close>, Haskell \\<^cite>\\<open>\"haskell-revised-report\"\\<close>\n  and Scala \\<^cite>\\<open>\"scala-overview-tech-report\"\\<close>. Conceptually, code\n  generation is split up in three steps: \\<^emph>\\<open>selection\\<close> of code theorems,\n  \\<^emph>\\<open>translation\\<close> into an abstract executable view and \\<^emph>\\<open>serialization\\<close> to a\n  specific \\<^emph>\\<open>target language\\<close>. Inductive specifications can be executed using\n  the predicate compiler which operates within HOL. See \\<^cite>\\<open>\"isabelle-codegen\"\\<close> for an introduction.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"export_code\"}\\<open>\\<^sup>*\\<close> & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{attribute_def (HOL) code} & : & \\<open>attribute\\<close> \\\\\n    @{command_def (HOL) \"code_datatype\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"print_codesetup\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{attribute_def (HOL) code_unfold} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) code_post} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) code_abbrev} & : & \\<open>attribute\\<close> \\\\\n    @{command_def (HOL) \"print_codeproc\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"code_thms\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"code_deps\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"code_reserved\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_printing\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_identifier\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_monad\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_reflect\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_pred\"} & : & \\<open>theory \\<rightarrow> proof(prove)\\<close> \\\\\n    @{attribute_def (HOL) code_timing} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) code_simp_trace} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) code_runtime_trace} & : & \\<open>attribute\\<close>\n  \\end{matharray}\n\n  \\<^rail>\\<open>\n    @@{command (HOL) export_code} @'open'? \\<newline> (const_expr+) (export_target*)\n    ;\n    export_target:\n      @'in' target (@'module_name' @{syntax name})? \\<newline>\n      (@'file_prefix' @{syntax path})? ('(' args ')')?\n    ;\n    target: 'SML' | 'OCaml' | 'Haskell' | 'Scala' | 'Eval'\n    ;\n    const_expr: (const | 'name._' | '_')\n    ;\n    const: @{syntax term}\n    ;\n    type_constructor: @{syntax name}\n    ;\n    class: @{syntax name}\n    ;\n    path: @{syntax embedded}\n    ;\n    @@{attribute (HOL) code} ('equation' | 'nbe' | 'abstype' | 'abstract'\n      | 'del' | 'drop:' (const+) | 'abort:' (const+))?\n    ;\n    @@{command (HOL) code_datatype} (const+)\n    ;\n    @@{attribute (HOL) code_unfold} 'del'?\n    ;\n    @@{attribute (HOL) code_post} 'del'?\n    ;\n    @@{attribute (HOL) code_abbrev} 'del'?\n    ;\n    @@{command (HOL) code_thms} (const_expr+)\n    ;\n    @@{command (HOL) code_deps} (const_expr+)\n    ;\n    @@{command (HOL) code_reserved} target (@{syntax string}+)\n    ;\n    symbol_const: @'constant' const\n    ;\n    symbol_type_constructor: @'type_constructor' type_constructor\n    ;\n    symbol_class: @'type_class' class\n    ;\n    symbol_class_relation: @'class_relation' class ('<' | '\\<subseteq>') class\n    ;\n    symbol_class_instance: @'class_instance' type_constructor @'::' class\n    ;\n    symbol_module: @'code_module' name\n    ;\n    syntax: @{syntax string} | (@'infix' | @'infixl' | @'infixr')\n      @{syntax nat} @{syntax string}\n    ;\n    printing_const: symbol_const ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' syntax ? + @'and')\n    ;\n    printing_type_constructor: symbol_type_constructor ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' syntax ? + @'and')\n    ;\n    printing_class: symbol_class ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' @{syntax string} ? + @'and')\n    ;\n    printing_class_relation: symbol_class_relation ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' @{syntax string} ? + @'and')\n    ;\n    printing_class_instance: symbol_class_instance ('\\<rightharpoonup>'| '=>') \\<newline>\n      ('(' target ')' '-' ? + @'and')\n    ;\n    printing_module: symbol_module ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' (@{syntax string} for_symbol?)? + @'and')\n    ;\n    for_symbol:\n      @'for'\n        ((symbol_const | symbol_typeconstructor |\n          symbol_class | symbol_class_relation | symbol_class_instance)+)\n    ;\n    @@{command (HOL) code_printing} ((printing_const | printing_type_constructor\n      | printing_class | printing_class_relation | printing_class_instance\n      | printing_module) + '|')\n    ;\n    @@{command (HOL) code_identifier} ((symbol_const | symbol_type_constructor\n      | symbol_class | symbol_class_relation | symbol_class_instance\n      | symbol_module ) ('\\<rightharpoonup>' | '=>') \\<newline>\n      ('(' target ')' @{syntax string} ? + @'and') + '|')\n    ;\n    @@{command (HOL) code_monad} const const target\n    ;\n    @@{command (HOL) code_reflect} @{syntax string} \\<newline>\n      (@'datatypes' (@{syntax string} '=' ('_' | (@{syntax string} + '|') + @'and')))? \\<newline>\n      (@'functions' (@{syntax string} +))? (@'file_prefix' @{syntax path})?\n    ;\n    @@{command (HOL) code_pred} \\<newline> ('(' @'modes' ':' modedecl ')')? \\<newline> const\n    ;\n    modedecl: (modes | ((const ':' modes) \\<newline>\n      (@'and' ((const ':' modes @'and')+))?))\n    ;\n    modes: mode @'as' const\n  \\<close>\n\n  \\<^descr> @{command (HOL) \"export_code\"} generates code for a given list of\n  constants in the specified target language(s). If no serialization\n  instruction is given, only abstract code is generated internally.\n\n  Constants may be specified by giving them literally, referring to all\n  executable constants within a certain theory by giving \\<open>name._\\<close>, or\n  referring to \\<^emph>\\<open>all\\<close> executable constants currently available by giving \\<open>_\\<close>.\n\n  By default, exported identifiers are minimized per module. This can be\n  suppressed by prepending @{keyword \"open\"} before the list of constants.\n\n  By default, for each involved theory one corresponding name space module is\n  generated. Alternatively, a module name may be specified after the @{keyword\n  \"module_name\"} keyword; then \\<^emph>\\<open>all\\<close> code is placed in this module.\n\n  Generated code is output as logical files within the theory context, as well\n  as session exports that can be retrieved using @{tool_ref export}, or @{tool\n  build} with option \\<^verbatim>\\<open>-e\\<close> and suitable \\isakeyword{export\\_files}\n  specifications in the session \\<^verbatim>\\<open>ROOT\\<close> entry. All files have a common\n  directory prefix: the long theory name plus ``\\<^verbatim>\\<open>code\\<close>''. The actual file\n  name is determined by the target language together with an optional\n  \\<^theory_text>\\<open>file_prefix\\<close> (the default is ``\\<^verbatim>\\<open>export\\<close>'' with a consecutive number\n  within the current theory). For \\<open>SML\\<close>, \\<open>OCaml\\<close> and \\<open>Scala\\<close>, the file prefix\n  becomes a plain file with extension (e.g.\\ ``\\<^verbatim>\\<open>.ML\\<close>'' for SML). For\n  \\<open>Haskell\\<close> the file prefix becomes a directory that is populated with a\n  separate file for each module (with extension ``\\<^verbatim>\\<open>.hs\\<close>'').\n\n  Serializers take an optional list of arguments in parentheses.\n\n      \\<^item> For \\<^emph>\\<open>Haskell\\<close> a module name prefix may be given using the ``\\<open>root:\\<close>''\n      argument; ``\\<open>string_classes\\<close>'' adds a ``\\<^verbatim>\\<open>deriving (Read, Show)\\<close>'' clause \n      to each appropriate datatype declaration.\n\n      \\<^item> For \\<^emph>\\<open>Scala\\<close>, ``\\<open>case_insensitive\\<close>'' avoids name clashes on\n      case-insensitive file systems.\n\n  \\<^descr> @{attribute (HOL) code} declares code equations for code generation.\n\n  Variant \\<open>code equation\\<close> declares a conventional equation as code equation.\n\n  Variants \\<open>code abstype\\<close> and \\<open>code abstract\\<close> declare abstract datatype\n  certificates or code equations on abstract datatype representations\n  respectively.\n\n  Vanilla \\<open>code\\<close> falls back to \\<open>code equation\\<close> or \\<open>code abstract\\<close>\n  depending on the syntactic shape of the underlying equation.\n\n  Variant \\<open>code del\\<close> deselects a code equation for code generation.\n\n  Variant \\<open>code nbe\\<close> accepts also non-left-linear equations for\n  \\<^emph>\\<open>normalization by evaluation\\<close> only.\n\n  Variants \\<open>code drop:\\<close> and \\<open>code abort:\\<close> take a list of constants as arguments\n  and drop all code equations declared for them. In the case of \\<open>abort\\<close>,\n  these constants if needed are implemented by program abort\n  (exception).\n\n  Packages declaring code equations usually provide a reasonable default\n  setup.\n\n  \\<^descr> @{command (HOL) \"code_datatype\"} specifies a constructor set for a logical\n  type.\n\n  \\<^descr> @{command (HOL) \"print_codesetup\"} gives an overview on selected code\n  equations and code generator datatypes.\n\n  \\<^descr> @{attribute (HOL) code_unfold} declares (or with option ``\\<open>del\\<close>'' removes)\n  theorems which during preprocessing are applied as rewrite rules to any code\n  equation or evaluation input.\n\n  \\<^descr> @{attribute (HOL) code_post} declares (or with option ``\\<open>del\\<close>'' removes)\n  theorems which are applied as rewrite rules to any result of an evaluation.\n\n  \\<^descr> @{attribute (HOL) code_abbrev} declares (or with option ``\\<open>del\\<close>'' removes)\n  equations which are applied as rewrite rules to any result of an evaluation\n  and symmetrically during preprocessing to any code equation or evaluation\n  input.\n\n  \\<^descr> @{command (HOL) \"print_codeproc\"} prints the setup of the code generator\n  preprocessor.\n\n  \\<^descr> @{command (HOL) \"code_thms\"} prints a list of theorems representing the\n  corresponding program containing all given constants after preprocessing.\n\n  \\<^descr> @{command (HOL) \"code_deps\"} visualizes dependencies of theorems\n  representing the corresponding program containing all given constants after\n  preprocessing.\n\n  \\<^descr> @{command (HOL) \"code_reserved\"} declares a list of names as reserved for\n  a given target, preventing it to be shadowed by any generated code.\n\n  \\<^descr> @{command (HOL) \"code_printing\"} associates a series of symbols\n  (constants, type constructors, classes, class relations, instances, module\n  names) with target-specific serializations; omitting a serialization deletes\n  an existing serialization.\n\n  \\<^descr> @{command (HOL) \"code_monad\"} provides an auxiliary mechanism to generate\n  monadic code for Haskell.\n\n  \\<^descr> @{command (HOL) \"code_identifier\"} associates a a series of symbols\n  (constants, type constructors, classes, class relations, instances, module\n  names) with target-specific hints how these symbols shall be named. These\n  hints gain precedence over names for symbols with no hints at all.\n  Conflicting hints are subject to name disambiguation. \\<^emph>\\<open>Warning:\\<close> It is at\n  the discretion of the user to ensure that name prefixes of identifiers in\n  compound statements like type classes or datatypes are still the same.\n\n  \\<^descr> @{command (HOL) \"code_reflect\"} without a ``\\<^theory_text>\\<open>file_prefix\\<close>'' argument\n  compiles code into the system runtime environment and modifies the code\n  generator setup that future invocations of system runtime code generation\n  referring to one of the ``\\<open>datatypes\\<close>'' or ``\\<open>functions\\<close>'' entities use\n  these precompiled entities. With a ``\\<^theory_text>\\<open>file_prefix\\<close>'' argument, the\n  corresponding code is generated/exported to the specified file (as for\n  \\<^theory_text>\\<open>export_code\\<close>) without modifying the code generator setup.\n\n  \\<^descr> @{command (HOL) \"code_pred\"} creates code equations for a predicate given\n  a set of introduction rules. Optional mode annotations determine which\n  arguments are supposed to be input or output. If alternative introduction\n  rules are declared, one must prove a corresponding elimination rule.\n\n  \\<^descr> @{attribute (HOL) \"code_timing\"} scrapes timing samples from different\n  stages of the code generator.\n\n  \\<^descr> @{attribute (HOL) \"code_simp_trace\"} traces the simplifier when it is\n  used with code equations.\n\n  \\<^descr> @{attribute (HOL) \"code_runtime_trace\"} traces ML code generated\n  dynamically for execution.\n\\<close>\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/Doc/Isar_Ref/HOL_Specific.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.32020411558329187}}
{"text": "theory flash106Bra  imports flash106Rev\n \n  begin\nlemma onInv106:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv106 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv106 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv106 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash106Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702880639792, "lm_q2_score": 0.44167300566462553, "lm_q1q2_score": 0.32015563884620063}}
{"text": "theory flash112Bra  imports flash112Rev\n \n  begin\nlemma onInv112:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv112 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv112 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv112 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash112Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7185944046238981, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.3201550309741239}}
{"text": "theory utp_hyprog_ex\n  imports utp_hyprog\nbegin\n\ntype_synonym gravs = \"(real^3, unit) hybs_scheme\"\n\nabbreviation h :: \"real \\<Longrightarrow> real^3\" where \"h \\<equiv> \\<Pi>[0]\"\nabbreviation v :: \"real \\<Longrightarrow> real^3\" where \"v \\<equiv> \\<Pi>[Suc 0]\"\nabbreviation t :: \"real \\<Longrightarrow> real^3\" where \"t \\<equiv> \\<Pi>[Suc (Suc 0)]\"\n\nlemma dInv_grav_ex:\n  \"\\<lbrace>[&\\<^bold>c:v <\\<^sub>P 0 \\<and>\\<^sub>P &\\<^bold>c:h \\<le>\\<^sub>P 2]\\<^sub>P\\<rbrace>ode [h \\<mapsto>\\<^sub>s &v, v \\<mapsto>\\<^sub>s -9.81, t \\<mapsto>\\<^sub>s \\<guillemotleft>1\\<guillemotright>] true\\<lbrace>[&\\<^bold>c:v <\\<^sub>P 0 \\<and>\\<^sub>P &\\<^bold>c:h \\<le>\\<^sub>P 2]\\<^sub>P\\<rbrace>\\<^sub>u\"\n  apply (rule dCut_split)\n   apply (rule dInv)\n    apply (simp add: closure)\n   apply (simp add: closure uderiv usubst fode_def mkuexpr alpha)\n   apply (rel_auto)\n  apply (simp)\n  apply (rule dInv)\n   apply (simp add: closure)\n  apply (simp add: closure uderiv usubst fode_def mkuexpr alpha hyprop_pred_def)\n  apply (rel_simp')\n  done   \n\nabbreviation \"g \\<equiv> (981 / 10\\<^sup>2)\"\n\nabbreviation \n  \"BBall \\<equiv> (\\<langle>der(h) = v, der(v) = -g, der(t) = 1 | (&h \\<ge>\\<^sub>u 0)\\<rangle> ;;\n            (if (&h =\\<^sub>u 0 \\<and> &t >\\<^sub>u 0)\n              then v := (-0.8 * &v) ;; t := 0 \n              else II fi))\\<^sup>\\<star>\"\n\nlemma \"\\<lbrace>[&v\\<^sup>2 \\<le>\\<^sub>P 2*\\<guillemotleft>g\\<guillemotright>*(\\<guillemotleft>H\\<guillemotright>-&h) \\<and>\\<^sub>P 0 \\<le>\\<^sub>P \\<guillemotleft>H\\<guillemotright>]\\<^sub>P\\<rbrace> BBall \\<lbrace>[&v\\<^sup>2 \\<le>\\<^sub>P 2*\\<guillemotleft>g\\<guillemotright>*(\\<guillemotleft>H\\<guillemotright>-&h) \\<and>\\<^sub>P 0 \\<le>\\<^sub>P \\<guillemotleft>H\\<guillemotright>]\\<^sub>P\\<rbrace>\\<^sub>u\"\n  apply (rule iter_hoare_r)\n  apply (rule seq_hoare_invariant)\n    apply (simp add: hyprop_pred_def usubst unrest)\n   apply (rel_simp)\n  oops\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/hyprog/utp_hyprog_ex.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7122321842389469, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.3200718976257304}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory WordAbs\nimports \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"word_abs.c\"\ninstall_C_file \"word_abs.c\"\nautocorres\n  [ (* signed_word_abs is implicit; these are the functions that would be abstracted: *)\n    (*signed_word_abs =\n        S_add_S S_sub_S S_mul_S S_div_S S_mod_S neg_S\n        S_and_S S_or_S S_xor_S not_S\n        U_shiftl_U_abs_S U_shiftr_U_abs_S U_shiftl_S_abs_S U_shiftr_S_abs_S\n        S_shiftl_U_abs_S S_shiftr_U_abs_S S_shiftl_S_abs_S S_shiftr_S_abs_S\n        U_shiftl_U_abs_US U_shiftr_U_abs_US U_shiftl_S_abs_US U_shiftr_S_abs_US\n        S_shiftl_U_abs_US S_shiftr_U_abs_US S_shiftl_S_abs_US S_shiftr_S_abs_US\n  ,*) no_signed_word_abs =\n        U_shiftl_U_no_abs U_shiftr_U_no_abs U_shiftl_S_no_abs U_shiftr_S_no_abs\n        S_shiftl_U_no_abs S_shiftr_U_no_abs S_shiftl_S_no_abs S_shiftr_S_no_abs\n        U_shiftl_U_abs_U U_shiftr_U_abs_U U_shiftl_S_abs_U U_shiftr_S_abs_U\n        S_shiftl_U_abs_U S_shiftr_U_abs_U S_shiftl_S_abs_U S_shiftr_S_abs_U\n  , unsigned_word_abs =\n        ver366\n        U_add_U U_sub_U U_mul_U U_div_U U_mod_U neg_U\n        U_and_U U_or_U U_xor_U not_U\n        U_shiftl_U_abs_U U_shiftr_U_abs_U U_shiftl_S_abs_U U_shiftr_S_abs_U\n        S_shiftl_U_abs_U S_shiftr_U_abs_U S_shiftl_S_abs_U S_shiftr_S_abs_U\n        U_shiftl_U_abs_US U_shiftr_U_abs_US U_shiftl_S_abs_US U_shiftr_S_abs_US\n        S_shiftl_U_abs_US S_shiftr_U_abs_US S_shiftl_S_abs_US S_shiftr_S_abs_US\n  , ts_rules = nondet\n] \"word_abs.c\"\n\ncontext word_abs begin\n\nlemma \"\\<lbrace> P \\<rbrace> ver366' 0 \\<lbrace> \\<lambda>v s. v = 0 \\<and> P s \\<rbrace>\"\n  by (wpsimp simp: ver366'_def)\nlemma \"\\<lbrace> P \\<rbrace> ver366' UINT_MAX \\<lbrace> \\<lambda>v s. v = UINT_MAX-1 \\<and> P s \\<rbrace>\"\n  by (wpsimp simp: ver366'_def UINT_MAX_def)\n\nsection \\<open>Arithmetic ops\\<close>\nthm S_add_S'_def S_sub_S'_def S_mul_S'_def S_div_S'_def S_mod_S'_def neg_S'_def\n    U_add_U'_def U_sub_U'_def U_mul_U'_def U_div_U'_def U_mod_U'_def neg_U'_def\n\nlemma \"x + y < INT_MIN \\<or> x + y > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_add_S' (x::int) (y::int))\"\n  by (monad_eq simp: S_add_S'_def no_fail_def INT_MIN_def INT_MAX_def)\nlemma \"\\<lbrace>\\<lambda>s. INT_MIN \\<le> x + y \\<and> x + y \\<le> INT_MAX \\<and> P s\\<rbrace>\n         S_add_S' (x::int) (y::int)\n       \\<lbrace>\\<lambda>r s. r = x + y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: S_add_S'_def INT_MIN_def INT_MAX_def)\nlemma \"x - y < INT_MIN \\<or> x - y > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_sub_S' (x::int) (y::int))\"\n  by (monad_eq simp: S_sub_S'_def no_fail_def INT_MIN_def INT_MAX_def)\nlemma \"\\<lbrace>\\<lambda>s. INT_MIN \\<le> x - y \\<and> x - y \\<le> INT_MAX \\<and> P s\\<rbrace>\n         S_sub_S' (x::int) (y::int)\n       \\<lbrace>\\<lambda>r s. r = x - y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: S_sub_S'_def INT_MIN_def INT_MAX_def)\nlemma \"x * y < INT_MIN \\<or> x * y > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_mul_S' (x::int) (y::int))\"\n  by (monad_eq simp: S_mul_S'_def no_fail_def INT_MIN_def INT_MAX_def)\nlemma \"\\<lbrace>\\<lambda>s. INT_MIN \\<le> x * y \\<and> x * y \\<le> INT_MAX \\<and> P s\\<rbrace>\n         S_mul_S' (x::int) (y::int)\n       \\<lbrace>\\<lambda>r s. r = x * y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: S_mul_S'_def INT_MIN_def INT_MAX_def)\nlemma \"y = 0 \\<or> x sdiv y < INT_MIN \\<or> x sdiv y > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_div_S' (x::int) (y::int))\"\n  by (monad_eq simp: S_div_S'_def no_fail_def INT_MIN_def INT_MAX_def)\nlemma \"\\<lbrace>\\<lambda>s. y \\<noteq> 0 \\<and> INT_MIN \\<le> x sdiv y \\<and> x sdiv y \\<le> INT_MAX \\<and> P s\\<rbrace>\n         S_div_S' (x::int) (y::int)\n       \\<lbrace>\\<lambda>r s. r = x sdiv y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: S_div_S'_def INT_MIN_def INT_MAX_def)\nlemma \"y = 0 \\<or> x smod y < INT_MIN \\<or> x smod y > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_mod_S' (x::int) (y::int))\"\n  by (monad_eq simp: S_mod_S'_def no_fail_def INT_MIN_def INT_MAX_def)\nlemma \"\\<lbrace>\\<lambda>s. y \\<noteq> 0 \\<and> INT_MIN \\<le> x smod y \\<and> x smod y \\<le> INT_MAX \\<and> P s\\<rbrace>\n         S_mod_S' (x::int) (y::int)\n       \\<lbrace>\\<lambda>r s. r = x smod y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: S_mod_S'_def INT_MIN_def INT_MAX_def)\nlemma \"x \\<le> INT_MIN \\<or> x > -INT_MIN \\<Longrightarrow> \\<not> no_fail \\<top> (neg_S' (x::int))\"\n  by (monad_eq simp: neg_S'_def no_fail_def INT_MIN_def)\nlemma \"\\<lbrace>\\<lambda>s. INT_MIN < x \\<and> x \\<le> -INT_MIN \\<and> P s\\<rbrace> neg_S' (x::int) \\<lbrace>\\<lambda>r s. r = -x \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: neg_S'_def INT_MIN_def)\n\nlemma \"x + y > UINT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (U_add_U' (x::nat) (y::nat))\"\n  by (monad_eq simp: U_add_U'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. x + y \\<le> UINT_MAX \\<and> P s\\<rbrace>\n         U_add_U' (x::nat) (y::nat)\n       \\<lbrace>\\<lambda>r s. r = x + y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: U_add_U'_def UINT_MAX_def)\nlemma \"x < y \\<Longrightarrow> \\<not> no_fail \\<top> (U_sub_U' (x::nat) (y::nat))\"\n  by (monad_eq simp: U_sub_U'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. x \\<ge> y \\<and> P s\\<rbrace>\n         U_sub_U' (x::nat) (y::nat)\n       \\<lbrace>\\<lambda>r s. r = x - y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: U_sub_U'_def)\nlemma \"x * y > UINT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (U_mul_U' (x::nat) (y::nat))\"\n  by (monad_eq simp: U_mul_U'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. x * y \\<le> UINT_MAX \\<and> P s\\<rbrace>\n         U_mul_U' (x::nat) (y::nat)\n       \\<lbrace>\\<lambda>r s. r = x * y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: U_mul_U'_def UINT_MAX_def)\nlemma \"y = 0 \\<Longrightarrow> \\<not> no_fail \\<top> (U_div_U' (x::nat) (y::nat))\"\n  by (monad_eq simp: U_div_U'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. y \\<noteq> 0 \\<and> P s\\<rbrace>\n         U_div_U' (x::nat) (y::nat)\n       \\<lbrace>\\<lambda>r s. r = x div y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: U_div_U'_def UINT_MAX_def)\nlemma \"y = 0 \\<Longrightarrow> \\<not> no_fail \\<top> (U_mod_U' (x::nat) (y::nat))\"\n  by (monad_eq simp: U_mod_U'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. y \\<noteq> 0 \\<and> P s\\<rbrace>\n         U_mod_U' (x::nat) (y::nat)\n       \\<lbrace>\\<lambda>r s. r = x mod y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: U_mod_U'_def UINT_MAX_def)\nlemma \"\\<lbrace>P\\<rbrace> neg_U' (x::nat) \\<lbrace>\\<lambda>r s. r = (if x = 0 then 0 else Suc UINT_MAX - x) \\<and> P s\\<rbrace>!\"\n  unfolding neg_U'_def by (wp, simp)\n\n\nsection \\<open>Bitwise ops\\<close>\n\nthm S_and_S'_def S_or_S'_def S_xor_S'_def not_S'_def\n    U_and_U'_def U_or_U'_def U_xor_U'_def not_U'_def\n\nlemma \"\\<lbrace>P\\<rbrace> S_and_S' (x::int) (y::int) \\<lbrace>\\<lambda>r s. r = x AND y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: S_and_S'_def)\nlemma \"\\<lbrace>P\\<rbrace> S_or_S' (x::int) (y::int) \\<lbrace>\\<lambda>r s. r = x OR y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: S_or_S'_def)\nlemma \"\\<lbrace>P\\<rbrace> S_xor_S' (x::int) (y::int) \\<lbrace>\\<lambda>r s. r = x XOR y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: S_xor_S'_def)\nlemma \"\\<lbrace>P\\<rbrace> not_S' (x::int) \\<lbrace>\\<lambda>r s. r = NOT x \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: not_S'_def)\n\nlemma \"\\<lbrace>P\\<rbrace> U_and_U' (x::nat) (y::nat) \\<lbrace>\\<lambda>r s. r = x AND y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: U_and_U'_def)\nlemma \"\\<lbrace>P\\<rbrace> U_or_U' (x::nat) (y::nat) \\<lbrace>\\<lambda>r s. r = x OR y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: U_or_U'_def)\nlemma \"\\<lbrace>P\\<rbrace> U_xor_U' (x::nat) (y::nat) \\<lbrace>\\<lambda>r s. r = x XOR y \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: U_xor_U'_def)\nlemma \"\\<lbrace>P\\<rbrace> not_U' (x::nat) \\<lbrace>\\<lambda>r s. r = UINT_MAX - x \\<and> P s\\<rbrace>!\"\n  by (wpsimp simp: not_U'_def)\n\n\nsection \\<open>Left shifts\\<close>\n\nthm U_shiftl_U_abs_US'_def U_shiftr_U_abs_US'_def U_shiftl_S_abs_US'_def U_shiftr_S_abs_US'_def\n    S_shiftl_U_abs_US'_def S_shiftr_U_abs_US'_def S_shiftl_S_abs_US'_def S_shiftr_S_abs_US'_def\nthm U_shiftl_U_abs_U'_def U_shiftr_U_abs_U'_def U_shiftl_S_abs_U'_def U_shiftr_S_abs_U'_def\n    S_shiftl_U_abs_U'_def S_shiftr_U_abs_U'_def S_shiftl_S_abs_U'_def S_shiftr_S_abs_U'_def\nthm U_shiftl_U_abs_S'_def U_shiftr_U_abs_S'_def U_shiftl_S_abs_S'_def U_shiftr_S_abs_S'_def\n    S_shiftl_U_abs_S'_def S_shiftr_U_abs_S'_def S_shiftl_S_abs_S'_def S_shiftr_S_abs_S'_def\nthm U_shiftl_U_no_abs'_def U_shiftr_U_no_abs'_def U_shiftl_S_no_abs'_def U_shiftr_S_no_abs'_def\n    S_shiftl_U_no_abs'_def S_shiftr_U_no_abs'_def S_shiftl_S_no_abs'_def S_shiftr_S_no_abs'_def\n\nsubsection \\<open>@{text U_shiftl_U}\\<close>\n\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_U_abs_US' (x :: nat) (n :: nat))\"\n  by (monad_eq simp: U_shiftl_U_abs_US'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. n < 32 \\<and> x << n \\<le> UINT_MAX\\<rbrace>\n         U_shiftl_U_abs_US' (x::nat) (n::nat)\n       \\<lbrace>\\<lambda>r s. r = x << n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftl_U_abs_US'_def UINT_MAX_def)\n\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_U_abs_U' (x :: nat) (n :: nat))\"\n  by (monad_eq simp: U_shiftl_U_abs_U'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. n < 32 \\<and> x << n \\<le> UINT_MAX\\<rbrace>\n         U_shiftl_U_abs_U' (x::nat) (n::nat)\n       \\<lbrace>\\<lambda>r s. r = x << n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftl_U_abs_U'_def UINT_MAX_def)\n\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_U_abs_S' (x :: word32) (n :: word32))\"\n  by (monad_eq simp: U_shiftl_U_abs_S'_def no_fail_def word_le_not_less)\nlemma \"\\<lbrace>\\<lambda>s. n < 32\\<rbrace>\n         U_shiftl_U_abs_S' (x::word32) (n::word32)\n       \\<lbrace>\\<lambda>r s. r = x << unat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftl_U_abs_S'_def)\n\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_U_no_abs' (x :: word32) (n :: word32))\"\n  by (monad_eq simp: U_shiftl_U_no_abs'_def no_fail_def word_le_not_less)\nlemma \"\\<lbrace>\\<lambda>s. n < 32\\<rbrace>\n         U_shiftl_U_no_abs' (x::word32) (n::word32)\n       \\<lbrace>\\<lambda>r s. r = x << unat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftl_U_no_abs'_def)\n\nsubsection \\<open>@{text U_shiftl_S}\\<close>\n\nlemma \"n < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_S_abs_US' (x :: nat) (n :: int))\"\n  by (monad_eq simp: U_shiftl_S_abs_US'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_S_abs_US' (x :: nat) (n :: int))\"\n  by (monad_eq simp: U_shiftl_S_abs_US'_def no_fail_def)\nlemma \"x << nat n > UINT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_S_abs_US' (x :: nat) (n :: int))\"\n  by (monad_eq simp: U_shiftl_S_abs_US'_def no_fail_def UINT_MAX_def)\nlemma \"\\<lbrace>\\<lambda>s. 0 \\<le> n \\<and> n < 32 \\<and> x << nat n \\<le> UINT_MAX\\<rbrace>\n         U_shiftl_S_abs_US' (x::nat) (n::int)\n       \\<lbrace>\\<lambda>r s. r = x << nat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftl_S_abs_US'_def UINT_MAX_def)\n\nlemma \"n <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_S_abs_U' (x :: nat) (n :: sword32))\"\n  by (monad_eq simp: U_shiftl_S_abs_U'_def no_fail_def word_sless_alt word_sle_def)\nlemma \"32 <=s n \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_S_abs_U' (x :: nat) (n :: sword32))\"\n  by (monad_eq simp: U_shiftl_S_abs_U'_def no_fail_def word_sless_alt word_sle_def)\nlemma \"x << unat n > UINT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_S_abs_U' (x :: nat) (n :: sword32))\"\n  by (monad_eq simp: U_shiftl_S_abs_U'_def no_fail_def\n                     word_sless_alt word_sle_def nat_sint UINT_MAX_def)\nlemma \"\\<lbrace>\\<lambda>s. 0 <=s n \\<and> n <s 32 \\<and> x << unat n \\<le> UINT_MAX\\<rbrace>\n         U_shiftl_S_abs_U' (x::nat) (n::sword32)\n       \\<lbrace>\\<lambda>r s. r = x << unat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftl_S_abs_U'_def UINT_MAX_def nat_sint word_sle_def word_sless_alt)\n\nlemma \"n < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_S_abs_S' (x :: word32) (n :: int))\"\n  by (monad_eq simp: U_shiftl_S_abs_S'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_S_abs_S' (x :: word32) (n :: int))\"\n  by (monad_eq simp: U_shiftl_S_abs_S'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. 0 \\<le> n \\<and> n < 32\\<rbrace>\n         U_shiftl_S_abs_S' (x::word32) (n::int)\n       \\<lbrace>\\<lambda>r s. r = x << nat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftl_S_abs_S'_def unat_of_int)\n\nlemma \"n <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_S_no_abs' (x :: word32) (n :: sword32))\"\n  by (monad_eq simp: U_shiftl_S_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"32 <=s n \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftl_S_no_abs' (x :: word32) (n :: sword32))\"\n  by (monad_eq simp: U_shiftl_S_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"\\<lbrace>\\<lambda>s. 0 <=s n \\<and> n <s 32\\<rbrace>\n         U_shiftl_S_no_abs' (x :: word32) (n :: sword32)\n       \\<lbrace>\\<lambda>r s. r = x << unat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftl_S_no_abs'_def UINT_MAX_def)\n\nsubsection \\<open>@{text S_shiftl_U}\\<close>\n\nlemma \"x < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_abs_US' (x :: int) (n :: nat))\"\n  by (monad_eq simp: S_shiftl_U_abs_US'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_abs_US' (x :: int) (n :: nat))\"\n  by (monad_eq simp: S_shiftl_U_abs_US'_def no_fail_def)\nlemma \"x << n > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_abs_US' (x :: int) (n :: nat))\"\n  by (monad_eq simp: S_shiftl_U_abs_US'_def no_fail_def INT_MAX_def)\nlemma \"\\<lbrace>\\<lambda>s. n < 32 \\<and> 0 \\<le> x \\<and> x << n \\<le> INT_MAX\\<rbrace>\n         S_shiftl_U_abs_US' (x::int) (n::nat)\n       \\<lbrace>\\<lambda>r s. r = x << n\\<rbrace>!\"\n  apply (wpsimp simp: S_shiftl_U_abs_US'_def INT_MAX_def shiftl_int_def)\n  apply (subst unat_of_int)\n    apply simp\n   apply (drule le_less_trans[where x=\"x*2^n\" and z=\"2^32\"])\n    apply simp\n   apply (subst mult_less_cancel_left_pos[where c=\"2^n\", symmetric])\n    apply simp\n   apply (subst (asm) mult.commute)\n   apply (erule less_le_trans)\n   apply simp\n  apply (simp flip: nat_mult_distrib nat_power_eq nat_numeral)\n  done\n\nlemma \"x <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_abs_U' (x :: sword32) (n :: nat))\"\n  by (monad_eq simp: S_shiftl_U_abs_U'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_abs_U' (x :: sword32) (n :: nat))\"\n  apply (monad_eq simp: S_shiftl_U_abs_U'_def no_fail_def)\n  oops \\<comment> \\<open>C parser issue: Jira VER-509\\<close>\nlemma \"sint x << n > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_abs_U' (x :: sword32) (n :: nat))\"\n  supply Word.of_nat_unat[simp del]\n  by (monad_eq simp: S_shiftl_U_abs_U'_def no_fail_def shiftl_int_def shiftl_def INT_MAX_def\n                     nat_int_comparison(2) int_unat_nonneg)\n\nlemma \"\\<lbrace>\\<lambda>s. n < 32 \\<and> 0 <=s x \\<and> sint x << n \\<le> INT_MAX\\<rbrace>\n         S_shiftl_U_abs_U' (x::sword32) (n::nat)\n       \\<lbrace>\\<lambda>r s. r = x << n\\<rbrace>!\"\n  supply Word.of_nat_unat[simp del]\n  by (wpsimp simp: S_shiftl_U_abs_U'_def INT_MAX_def shiftl_int_def shiftl_def\n                   nat_int_comparison(2) int_unat_nonneg)\n\nlemma \"x < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_abs_S' (x :: int) (n :: word32))\"\n  by (monad_eq simp: S_shiftl_U_abs_S'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_abs_S' (x :: int) (n :: word32))\"\n  by (monad_eq simp: S_shiftl_U_abs_S'_def no_fail_def word_le_nat_alt)\nlemma \"x << unat n > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_abs_S' (x :: int) (n :: word32))\"\n  by (monad_eq simp: S_shiftl_U_abs_S'_def no_fail_def INT_MAX_def)\nlemma \"\\<lbrace>\\<lambda>s. n < 32 \\<and> 0 \\<le> x \\<and> x << unat n \\<le> INT_MAX\\<rbrace>\n         S_shiftl_U_abs_S' (x::int) (n::word32)\n       \\<lbrace>\\<lambda>r s. r = x << unat n\\<rbrace>!\"\n  apply (wpsimp simp: S_shiftl_U_abs_S'_def INT_MAX_def shiftl_nat_def shiftl_int_def shiftl_def\n                      word_less_nat_alt)\n  apply (subst unat_of_int)\n    apply simp\n   apply (drule le_less_trans[where x=\"x*2^unat n\" and z=\"2^32\"])\n    apply simp\n   apply simp\n   apply (subst mult_less_cancel_left_pos[where c=\"2^unat n\", symmetric])\n    apply simp\n   apply (subst (asm) mult.commute)\n   apply (erule less_le_trans)\n   apply simp\n  apply (simp flip: nat_mult_distrib nat_power_eq nat_numeral)\n  done\n\nlemma \"x <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_no_abs' (x :: sword32) (n :: word32))\"\n  by (monad_eq simp: S_shiftl_U_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_no_abs' (x :: sword32) (n :: word32))\"\n  apply (monad_eq simp: S_shiftl_U_no_abs'_def no_fail_def)\n  oops \\<comment> \\<open>C parser issue: Jira VER-509\\<close>\nlemma \"sint x << unat n > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_U_no_abs' (x :: sword32) (n :: word32))\"\n  supply Word.of_nat_unat[simp del]\n  by (monad_eq simp: S_shiftl_U_no_abs'_def no_fail_def shiftl_int_def shiftl_def INT_MAX_def\n                     nat_int_comparison(2) int_unat_nonneg)\nlemma \"\\<lbrace>\\<lambda>s. n < 32 \\<and> 0 <=s x \\<and> sint x << unat n \\<le> INT_MAX\\<rbrace>\n         S_shiftl_U_no_abs' (x::sword32) (n::word32)\n       \\<lbrace>\\<lambda>r s. r = x << unat n\\<rbrace>!\"\n  supply Word.of_nat_unat[simp del]\n  by (wpsimp simp: S_shiftl_U_no_abs'_def INT_MAX_def shiftl_int_def shiftl_def\n                   nat_int_comparison(2) int_unat_nonneg)\n\nsubsection \\<open>@{text S_shiftl_S}\\<close>\n\nlemma \"x < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_US' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftl_S_abs_US'_def no_fail_def)\nlemma \"n < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_US' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftl_S_abs_US'_def no_fail_def)\nlemma \"x << nat n > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_US' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftl_S_abs_US'_def no_fail_def INT_MAX_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_US' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftl_S_abs_US'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. 0 \\<le> n \\<and> n < 32 \\<and> 0 \\<le> x \\<and> x << nat n \\<le> INT_MAX\\<rbrace>\n         S_shiftl_S_abs_US' (x::int) (n::int)\n       \\<lbrace>\\<lambda>r s. r = x << nat n\\<rbrace>!\"\n  apply (wpsimp simp: S_shiftl_S_abs_US'_def INT_MAX_def shiftl_nat_def shiftl_int_def shiftl_def)\n  apply (subst unat_of_int)\n    apply simp\n   apply simp\n   apply (drule le_less_trans[where x=\"x*2^nat n\" and z=\"2^32\"])\n    apply simp\n   apply (subst mult_less_cancel_left_pos[where c=\"2^nat n\", symmetric])\n    apply simp\n   apply (subst (asm) mult.commute)\n   apply (erule less_le_trans)\n   apply simp\n  apply (subst unat_of_int)\n    apply simp\n   apply simp\n  apply (simp flip: nat_mult_distrib nat_power_eq nat_numeral)\n  done\n\nlemma \"x <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_U' (x :: sword32) (n :: sword32))\"\n  by (monad_eq simp: S_shiftl_S_abs_U'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"n <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_U' (x :: sword32) (n :: sword32))\"\n  by (monad_eq simp: S_shiftl_S_abs_U'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"32 <=s n \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_U' (x :: sword32) (n :: sword32))\"\n  apply (monad_eq simp: S_shiftl_S_abs_U'_def no_fail_def word_sle_def word_sless_alt)\n  oops \\<comment> \\<open>C parser issue: Jira VER-509\\<close>\nlemma \"sint x << unat n > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_U' (x :: sword32) (n :: sword32))\"\n  supply Word.of_nat_unat[simp del]\n  by (monad_eq simp: S_shiftl_S_abs_U'_def no_fail_def shiftl_int_def shiftl_def INT_MAX_def\n                     nat_int_comparison(2) int_unat_nonneg)\nlemma \"\\<lbrace>\\<lambda>s. 0 <=s n \\<and> n <s 32 \\<and> 0 <=s x \\<and> sint x << unat n \\<le> INT_MAX\\<rbrace>\n         S_shiftl_S_abs_U' (x::sword32) (n::sword32)\n       \\<lbrace>\\<lambda>r s. r = x << unat n\\<rbrace>!\"\n  supply Word.of_nat_unat[simp del]\n  by (wpsimp simp: S_shiftl_S_abs_U'_def INT_MAX_def shiftl_int_def shiftl_def\n                   nat_int_comparison(2) int_unat_nonneg)\n\nlemma \"x < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_S' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftl_S_abs_S'_def no_fail_def)\nlemma \"n < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_S' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftl_S_abs_S'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_S' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftl_S_abs_S'_def no_fail_def)\nlemma \"x << nat n > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_abs_S' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftl_S_abs_S'_def no_fail_def INT_MAX_def)\nlemma \"\\<lbrace>\\<lambda>s. 0 \\<le> n \\<and> n < 32 \\<and> 0 \\<le> x \\<and> x << nat n \\<le> INT_MAX\\<rbrace>\n         S_shiftl_S_abs_S' (x::int) (n::int)\n       \\<lbrace>\\<lambda>r s. r = x << nat n\\<rbrace>!\"\n  apply (wpsimp simp: S_shiftl_S_abs_S'_def INT_MAX_def shiftl_nat_def shiftl_int_def shiftl_def)\n  apply (subst unat_of_int)\n    apply simp\n   apply (drule le_less_trans[where x=\"x*2^nat n\" and z=\"2^32\"])\n    apply simp\n   apply (subst mult_less_cancel_left_pos[where c=\"2^nat n\", symmetric])\n    apply simp\n   apply (subst (asm) mult.commute)\n   apply (erule less_le_trans)\n   apply simp\n  apply (simp add: unat_of_int_32)\n  apply (simp flip: nat_mult_distrib nat_power_eq nat_numeral)\n  done\n\nlemma \"x <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_no_abs' (x :: sword32) (n :: sword32))\"\n  by (monad_eq simp: S_shiftl_S_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"n <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_no_abs' (x :: sword32) (n :: sword32))\"\n  by (monad_eq simp: S_shiftl_S_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"32 <=s n \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_no_abs' (x :: sword32) (n :: sword32))\"\n  apply (monad_eq simp: S_shiftl_S_no_abs'_def no_fail_def)\n  oops \\<comment> \\<open>C parser issue: Jira VER-509\\<close>\nlemma \"sint x << unat n > INT_MAX \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftl_S_no_abs' (x :: sword32) (n :: sword32))\"\n  supply Word.of_nat_unat[simp del]\n  by (monad_eq simp: S_shiftl_S_no_abs'_def no_fail_def shiftl_int_def shiftl_def INT_MAX_def\n                     nat_int_comparison(2) int_unat_nonneg)\nlemma \"\\<lbrace>\\<lambda>s. 0 <=s n \\<and> n <s 32 \\<and> 0 <=s x \\<and> sint x << unat n \\<le> INT_MAX\\<rbrace>\n         S_shiftl_S_no_abs' (x::sword32) (n::sword32)\n       \\<lbrace>\\<lambda>r s. r = x << unat n\\<rbrace>!\"\n  supply Word.of_nat_unat[simp del]\n  by (wpsimp simp: S_shiftl_S_no_abs'_def INT_MAX_def shiftl_int_def shiftl_def\n                   nat_int_comparison(2) int_unat_nonneg)\n\n\nsection \\<open>Right shifts\\<close>\n\nsubsection \\<open>@{text U_shiftr_U}\\<close>\n\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_U_abs_US' (x :: nat) (n :: nat))\"\n  by (monad_eq simp: U_shiftr_U_abs_US'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. n < 32\\<rbrace> U_shiftr_U_abs_US' (x::nat) (n::nat) \\<lbrace>\\<lambda>r s. r = x >> n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftr_U_abs_US'_def)\n\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_U_abs_U' (x :: nat) (n :: nat))\"\n  by (monad_eq simp: U_shiftr_U_abs_U'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. n < 32\\<rbrace> U_shiftr_U_abs_U' (x::nat) (n::nat) \\<lbrace>\\<lambda>r s. r = x >> n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftr_U_abs_U'_def)\n\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_U_abs_S' (x :: word32) (n :: word32))\"\n  by (monad_eq simp: U_shiftr_U_abs_S'_def no_fail_def word_le_not_less)\nlemma \"\\<lbrace>\\<lambda>s. n < 32\\<rbrace> U_shiftr_U_abs_S' (x::word32) (n::word32) \\<lbrace>\\<lambda>r s. r = x >> unat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftr_U_abs_S'_def)\n\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_U_no_abs' (x :: word32) (n :: word32))\"\n  by (monad_eq simp: U_shiftr_U_no_abs'_def no_fail_def word_le_not_less)\nlemma \"\\<lbrace>\\<lambda>s. n < 32\\<rbrace> U_shiftr_U_no_abs' (x::word32) (n::word32) \\<lbrace>\\<lambda>r s. r = x >> unat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftr_U_no_abs'_def)\n\nsubsection \\<open>@{text U_shiftr_S}\\<close>\n\nlemma \"n < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_S_abs_US' (x :: nat) (n :: int))\"\n  by (monad_eq simp: U_shiftr_S_abs_US'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_S_abs_US' (x :: nat) (n :: int))\"\n  by (monad_eq simp: U_shiftr_S_abs_US'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. 0 \\<le> n \\<and> n < 32\\<rbrace> U_shiftr_S_abs_US' (x::nat) (n::int) \\<lbrace>\\<lambda>r s. r = x >> nat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftr_S_abs_US'_def)\n\nlemma \"n <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_S_abs_U' (x :: nat) (n :: sword32))\"\n  by (monad_eq simp: U_shiftr_S_abs_U'_def no_fail_def word_sless_alt word_sle_def)\nlemma \"32 <=s n \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_S_abs_U' (x :: nat) (n :: sword32))\"\n  by (monad_eq simp: U_shiftr_S_abs_U'_def no_fail_def word_sless_alt word_sle_def)\nlemma \"\\<lbrace>\\<lambda>s. 0 <=s n \\<and> n <s 32\\<rbrace> U_shiftr_S_abs_U' (x::nat) (n::sword32) \\<lbrace>\\<lambda>r s. r = x >> unat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftr_S_abs_U'_def nat_sint word_sle_def word_sless_alt)\n\nlemma \"n < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_S_abs_S' (x :: word32) (n :: int))\"\n  by (monad_eq simp: U_shiftr_S_abs_S'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_S_abs_S' (x :: word32) (n :: int))\"\n  by (monad_eq simp: U_shiftr_S_abs_S'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. 0 \\<le> n \\<and> n < 32\\<rbrace> U_shiftr_S_abs_S' (x::word32) (n::int) \\<lbrace>\\<lambda>r s. r = x >> nat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftr_S_abs_S'_def unat_of_int)\n\nlemma \"n <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_S_no_abs' (x :: word32) (n :: sword32))\"\n  by (monad_eq simp: U_shiftr_S_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"32 <=s n \\<Longrightarrow> \\<not> no_fail \\<top> (U_shiftr_S_no_abs' (x :: word32) (n :: sword32))\"\n  by (monad_eq simp: U_shiftr_S_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"\\<lbrace>\\<lambda>s. 0 <=s n \\<and> n <s 32\\<rbrace> U_shiftr_S_no_abs' (x :: word32) (n :: sword32) \\<lbrace>\\<lambda>r s. r = x >> unat n\\<rbrace>!\"\n  by (wpsimp simp: U_shiftr_S_no_abs'_def)\n\nsubsection \\<open>@{text S_shiftr_U}\\<close>\n\nlemma \"x < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_U_abs_US' (x :: int) (n :: nat))\"\n  by (monad_eq simp: S_shiftr_U_abs_US'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_U_abs_US' (x :: int) (n :: nat))\"\n  by (monad_eq simp: S_shiftr_U_abs_US'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. n < 32 \\<and> 0 \\<le> x\\<rbrace> S_shiftr_U_abs_US' (x::int) (n::nat) \\<lbrace>\\<lambda>r s. r = x >> n\\<rbrace>!\"\n  by (wpsimp simp: S_shiftr_U_abs_US'_def)\n\nlemma \"x <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_U_abs_U' (x :: sword32) (n :: nat))\"\n  by (monad_eq simp: S_shiftr_U_abs_U'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_U_abs_U' (x :: sword32) (n :: nat))\"\n  by (monad_eq simp: S_shiftr_U_abs_U'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. n < 32 \\<and> 0 <=s x\\<rbrace> S_shiftr_U_abs_U' (x::sword32) (n::nat) \\<lbrace>\\<lambda>r s. r = x >> n\\<rbrace>!\"\n  by (wpsimp simp: S_shiftr_U_abs_U'_def)\n\nlemma \"x < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_U_abs_S' (x :: int) (n :: word32))\"\n  by (monad_eq simp: S_shiftr_U_abs_S'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_U_abs_S' (x :: int) (n :: word32))\"\n  by (monad_eq simp: S_shiftr_U_abs_S'_def no_fail_def word_le_nat_alt)\nlemma \"\\<lbrace>\\<lambda>s. n < 32 \\<and> 0 \\<le> x\\<rbrace> S_shiftr_U_abs_S' (x::int) (n::word32) \\<lbrace>\\<lambda>r s. r = x >> unat n\\<rbrace>!\"\n  by (wpsimp simp: S_shiftr_U_abs_S'_def word_less_nat_alt)\n\nlemma \"x <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_U_no_abs' (x :: sword32) (n :: word32))\"\n  by (monad_eq simp: S_shiftr_U_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_U_no_abs' (x :: sword32) (n :: word32))\"\n  by (monad_eq simp: S_shiftr_U_no_abs'_def no_fail_def word_le_not_less)\nlemma \"\\<lbrace>\\<lambda>s. n < 32 \\<and> 0 <=s x\\<rbrace> S_shiftr_U_no_abs' (x::sword32) (n::word32) \\<lbrace>\\<lambda>r s. r = x >> unat n\\<rbrace>!\"\n  by (wpsimp simp: S_shiftr_U_no_abs'_def)\n\nsubsection \\<open>@{text S_shiftr_S}\\<close>\n\nlemma \"x < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_abs_US' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftr_S_abs_US'_def no_fail_def)\nlemma \"n < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_abs_US' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftr_S_abs_US'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_abs_US' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftr_S_abs_US'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. 0 \\<le> n \\<and> n < 32 \\<and> 0 \\<le> x\\<rbrace> S_shiftr_S_abs_US' (x::int) (n::int) \\<lbrace>\\<lambda>r s. r = x >> nat n\\<rbrace>!\"\n  by (wpsimp simp: S_shiftr_S_abs_US'_def)\n\nlemma \"x <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_abs_U' (x :: sword32) (n :: sword32))\"\n  by (monad_eq simp: S_shiftr_S_abs_U'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"n <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_abs_U' (x :: sword32) (n :: sword32))\"\n  by (monad_eq simp: S_shiftr_S_abs_U'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"32 <=s n \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_abs_U' (x :: sword32) (n :: sword32))\"\n  by (monad_eq simp: S_shiftr_S_abs_U'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"\\<lbrace>\\<lambda>s. 0 <=s n \\<and> n <s 32 \\<and> 0 <=s x\\<rbrace>\n         S_shiftr_S_abs_U' (x::sword32) (n::sword32)\n       \\<lbrace>\\<lambda>r s. r = x >> unat n\\<rbrace>!\"\n  by (wpsimp simp: S_shiftr_S_abs_U'_def)\n\nlemma \"x < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_abs_S' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftr_S_abs_S'_def no_fail_def)\nlemma \"n < 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_abs_S' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftr_S_abs_S'_def no_fail_def)\nlemma \"n \\<ge> 32 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_abs_S' (x :: int) (n :: int))\"\n  by (monad_eq simp: S_shiftr_S_abs_S'_def no_fail_def)\nlemma \"\\<lbrace>\\<lambda>s. 0 \\<le> n \\<and> n < 32 \\<and> 0 \\<le> x\\<rbrace>\n         S_shiftr_S_abs_S' (x::int) (n::int)\n       \\<lbrace>\\<lambda>r s. r = x >> nat n\\<rbrace>!\"\n  by (wpsimp simp: S_shiftr_S_abs_S'_def)\n\nlemma \"x <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_no_abs' (x :: sword32) (n :: sword32))\"\n  by (monad_eq simp: S_shiftr_S_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"n <s 0 \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_no_abs' (x :: sword32) (n :: sword32))\"\n  by (monad_eq simp: S_shiftr_S_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"32 <=s n \\<Longrightarrow> \\<not> no_fail \\<top> (S_shiftr_S_no_abs' (x :: sword32) (n :: sword32))\"\n  by (monad_eq simp: S_shiftr_S_no_abs'_def no_fail_def word_sle_def word_sless_alt)\nlemma \"\\<lbrace>\\<lambda>s. 0 <=s n \\<and> n <s 32 \\<and> 0 <=s x\\<rbrace>\n         S_shiftr_S_no_abs' (x::sword32) (n::sword32)\n       \\<lbrace>\\<lambda>r s. r = x >> unat n\\<rbrace>!\"\n  by (wpsimp simp: S_shiftr_S_no_abs'_def)\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/tests/examples/WordAbs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.32006976331715836}}
{"text": "theory TreeLanguagesSimple\n  imports Main \"$ISABELLE_HOME/src/HOL/Library/FSet\" \"$ISABELLE_HOME/src/HOL/Orderings\" CombinatoricsBackground BasicLemmas\nbegin\n  \n  \n  (* ============================================= *)\nsection \"Path Set Approximators\"\n  \n  \nlemma singletonLanguage:\n  shows \"tree \\<in>  \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule \\<Longrightarrow> (finsert tree fempty) \\<in> \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\"\n  by (simp add: forest_language_for_rule_def language_for_rule_def) \n    \nlemma treeSatisfiesSomeRule :\n  shows \"\\<exists> rule . tree \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule\"\nproof (simp add : language_for_rule_def tree_for_rule_def)\n  show \"\\<exists>rule. root tree = symbol rule \\<and> evaluation (\\<A> i) |`| childrenSet tree = states rule\"\n    by (metis rule.select_convs(1) rule.select_convs(2)) \nqed\n  \n  \n  \n    \nlemma rootOfV :\n  fixes path ruleSeq \\<ii> \\<alpha>\n  assumes a1 : \"(( (down (hd path))) \\<in> ( \\<V>\\<^sub>\\<tau> \\<ii> (hd ruleSeq)  )   ) \"\n  assumes a2 : \"symbol (hd ruleSeq) = \\<alpha>\"\n  shows \"root (down (hd path)) = \\<alpha>\"\nproof -\n  def t == \"(down (hd path))\"\n  then show \"root (down (hd path)) = \\<alpha>\" using a2 t_def a1 t_def \\<V>\\<^sub>\\<tau>_def by blast\nqed\n  \n  \nlemma languagesSatisfyV :\n  assumes \"tree \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule\" \n  shows \"tree \\<in> \\<V>\\<^sub>\\<tau> i rule\" \nproof (simp add :\\<V>\\<^sub>\\<tau>_def)\n  from assms have n67543e5 : \"root tree = symbol rule\" using language_for_rule_def  tree_for_rule_def by blast\n  have n67543e5b : \"(\\<delta>\\<^sub>\\<tau> tree \\<in> upwardClosure (\\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> (Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule))) \\<or> \\<delta>\\<^sub>\\<tau> tree \\<in> \\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> {t. \\<N> < height t})\"\n  proof -\n    have \"height tree \\<le> \\<N> \\<or> \\<N> < height tree\" by auto\n    hence \"tree \\<in> {t. \\<N> < height t} \\<or> tree \\<in> Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule)\" using Z_def assms by fastforce\n    hence \"\\<delta>\\<^sub>\\<tau> tree \\<in> \\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> (Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule)) \\<or> \\<delta>\\<^sub>\\<tau> tree \\<in> \\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> {t. \\<N> < height t}\" by auto\n    then show \"\\<delta>\\<^sub>\\<tau> tree \\<in> upwardClosure (\\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> (Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule))) \\<or> \\<delta>\\<^sub>\\<tau> tree \\<in> \\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> {t. \\<N> < height t}\" using upwardClosure_def by auto\n  qed\n  have \"\\<And>x. x \\<in>necess (\\<A> i) \\<I> rule \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> tree \\<in> \\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> (existential_satisfaction_set x)\"\n  proof -\n    fix x\n    assume \"x\\<in>necess (\\<A> i) \\<I> rule\"\n    hence \"x \\<in> op \\<bullet> (symbol rule) ` {I \\<in> \\<I>. \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule \\<subseteq> existential_satisfaction_set (symbol rule \\<bullet> I)}\" using necess_def by blast\n    then obtain I where \"I \\<in> \\<I>\" and \"\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule \\<subseteq> existential_satisfaction_set (symbol rule \\<bullet> I)\" and \"x = (symbol rule) \\<bullet> I\" by blast\n    hence \"\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule \\<subseteq> existential_satisfaction_set x\" by auto\n    hence \"tree \\<in> existential_satisfaction_set x\" using assms by auto\n    then show \"\\<delta>\\<^sub>\\<tau> tree \\<in> \\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> (existential_satisfaction_set x)\" by auto\n  qed\n  then show \"root tree = symbol rule \\<and>\n    (\\<delta>\\<^sub>\\<tau> tree \\<in> upwardClosure (\\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> (Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule))) \\<or> \\<delta>\\<^sub>\\<tau> tree \\<in> \\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> {t. \\<N> < height t}) \\<and> (\\<forall>x\\<in>necess (\\<A> i) \\<I> rule. \\<delta>\\<^sub>\\<tau> tree \\<in> \\<delta>\\<^sub>\\<tau>\\<^sub>\\<lambda> (existential_satisfaction_set x))\" using n67543e5 n67543e5b by auto\nqed\n  \n  \n  \nlemma gInFPre : \n  assumes \"\\<And> \\<R>  r i. (r |\\<in>| \\<R> i \\<Longrightarrow> (r |\\<in>| rule_set (\\<A> i)))\"\n  shows \"\\<And> (\\<R> :: ot \\<Rightarrow> (stt,abc) rule fset) x . x \\<in> ((\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (((\\<R>) i)))))) \\<Longrightarrow> (fset x) \\<subseteq> (\\<P>\\<^sub>1 \\<R> i)\"\nproof (simp add : \\<P>\\<^sub>1_def satisfiesApproximatorForRuleSet_def)\n  \n  have  \"\\<And>\\<R> x tree p. x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \\<Longrightarrow> tree |\\<in>| x \\<Longrightarrow>  p \\<in>pathsInTree tree \\<Longrightarrow> pathSatisfiesApproximatorForRuleSet p (\\<R> i) i\"\n  proof -\n    fix p\n    show \"\\<And>\\<R> x tree. x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \\<Longrightarrow> tree |\\<in>| x \\<Longrightarrow>  p \\<in>pathsInTree tree \\<Longrightarrow> pathSatisfiesApproximatorForRuleSet p (\\<R> i) i\"\n    proof (induct p)\n      case Nil\n      then show ?case using noEmptyPaths  pathsInTree_def by auto\n    next\n      case (Cons a p)\n      fix x\n      assume n7546 : \"x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)\"\n      hence n764354 : \" \\<forall>tr. tr |\\<in>| x \\<longrightarrow> (\\<exists>lang. lang |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \\<and> (\\<exists>subforest. tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| x \\<and> subforest \\<in> lang))\" using biguplusForests_def by blast\n          \n      fix tree\n      assume n54766 : \" tree |\\<in>| x \"\n      from n764354 n54766 obtain subforest rule where \"tree |\\<in>| subforest\" and \"subforest |\\<subseteq>| x\" and \"subforest \\<in> \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\" and n654654 :  \"rule |\\<in>| \\<R> i\" by blast\n      hence n875654 : \"tree \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule\"            by (simp add: forest_language_for_rule_def language_for_rule_def) \n      hence n65897 : \"tree \\<in> \\<V>\\<^sub>\\<tau> i rule\"  using languagesSatisfyV by auto\n          \n          \n          \n      assume \"(Cons a p) \\<in>pathsInTree tree\"\n      hence n67587 : \"isAPathp (Cons a p)\" and \"(\\<exists>e1 tail. (Cons a p) = e1 # tail \\<and> down e1 = tree)\" using pathsInTree_def by auto\n      hence n5457 : \"down a = tree\" by auto\n          \n      show \"pathSatisfiesApproximatorForRuleSet (Cons a p) (\\<R> i) i\"\n      proof (simp add : pathSatisfiesApproximatorForRuleSet_def)\n        \n        have \"\\<exists>r. hd r = rule \\<and> pathFitsListAndListIsARun i (a # p) r\"\n        proof (rule disjE)\n          from n67587 show  \"((\\<exists>node. (Cons a p) = [node]) \\<or> (\\<exists>path e2. (Cons a p) = e2 # path \\<and> isAPathp path \\<and> (\\<exists>e1 tail. path = e1 # tail \\<and> immediatelyDominates e2 e1)))\" using isAPathp.simps by blast\n          have a1 : \"labelOfNode a = symbol rule\" using n875654 language_for_rule_def tree_for_rule_def\n            using labelOfNode_def n5457 rootRule by fastforce \n          from assms n654654 have a2 : \"rule |\\<in>| rule_set (\\<A> i)\" by auto\n          from n5457 n875654 have a3 : \"down a \\<in> \\<V>\\<^sub>\\<tau> i rule\" using languagesSatisfyV by auto\n              \n              \n          {\n            assume n764544 : \"(\\<exists>path e2. (Cons a p) = e2 # path \\<and> isAPathp path \\<and> (\\<exists>e1 tail. path = e1 # tail \\<and> immediatelyDominates e2 e1))\"\n            hence n764654 : \"isAPathp p\" by blast\n            from n764544 obtain e1 tail where n65798 : \"p = e1#tail\" and n454576 : \"immediatelyDominates a e1\" by auto\n            from immediatelyDominates_def have n754654 : \"down e1 |\\<in>| childrenSet tree\" using n5457 n454576 by auto\n            from language_for_rule_def n875654 have \"tree_for_rule (\\<A> i) rule tree\" by auto\n            hence \"(evaluation (\\<A> i) |`| childrenSet tree = states rule)\" using tree_for_rule_def by metis\n            then obtain state where n6564387 : \"evaluation (\\<A> i) (down e1) = state\" and n545877 : \"state |\\<in>| states rule\" using n754654 by blast\n            obtain ruleDown where n754655 : \" (down e1) \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) ruleDown\" using treeSatisfiesSomeRule by auto\n            def forestDown == \"(finsert (down e1) fempty)\"\n            have n75456 : \"forestDown \\<in> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) ruleDown)\" using n754655 forestDown_def using singletonLanguage by auto\n            def \\<R>Down == \"\\<lambda> (i :: ot). (finsert ruleDown fempty)\"\n            from \\<R>Down_def n75456 biguplusForests_def have n5487 : \"forestDown \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R>Down i)\" by auto\n            have n568 : \" p \\<in> pathsInTree (down e1)\" \n            proof (simp add : pathsInTree_def)\n              from n65798 have \"(( p = e1#tail) \\<and> down e1 = down e1)\" by auto\n              hence \"(\\<exists>e1a. (\\<exists>tail. p = e1a # tail) \\<and> down e1a = down e1)\" by auto\n              then show \"isAPathp p \\<and> (\\<exists>e1a. (\\<exists>tail. p = e1a # tail) \\<and> down e1a = down e1)\" using n764654 by auto\n            qed\n            from Cons.hyps have \"forestDown \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R>Down i) \\<Longrightarrow> (down e1) |\\<in>| forestDown \\<Longrightarrow> p \\<in> pathsInTree (down e1) \\<Longrightarrow> pathSatisfiesApproximatorForRuleSet p (\\<R>Down i) i\" by auto\n            hence n753545 :  \"pathSatisfiesApproximatorForRuleSet p (\\<R>Down i) i\" using n568 n5487 forestDown_def by auto\n            from n753545 pathSatisfiesApproximatorForRuleSet_def obtain r rTail where n646785687 : \"hd r |\\<in>| (\\<R>Down i) \\<and> pathFitsListAndListIsARun i p r\" by metis\n            from n646785687  have \"hd r |\\<in>| (\\<R>Down i)\" by auto\n            hence n65t6988 : \"hd r = ruleDown\" using \\<R>Down_def by auto\n            from n65798 pathFitsListAndListIsARun.simps n646785687 obtain rHead rTail where n75465 : \"r = rHead#rTail\"\n              by (metis hd_Cons_tl) \n            hence n6587 : \"rHead = hd r\" using n646785687 by auto\n                \n            from n65t6988  n6587  have n65687 : \"ruleDown = rHead\" by auto\n                \n            have y1 : \"hd (rule#r) = rule\" by auto\n            have y2 : \"pathFitsListAndListIsARun i (a # p) (rule#r)\"\n            proof (simp add : pathFitsListAndListIsARun.simps(3))\n              from n5457 a3 rootOfV labelOfNode_def have x1 : \"labelOfNode a = symbol rule\"   using a1 by blast \n              have x2 : \"rule |\\<in>| rule_set (\\<A> i)\" using assms n654654 by auto\n              from n65897 n5457 have x3 : \"down a \\<in> \\<V>\\<^sub>\\<tau> i rule\" by auto\n              from n646785687 have x4 : \" pathFitsListAndListIsARun i p r\" by blast\n                  \n                  \n              from  n6564387 have   \"evaluation (\\<A> i) (down e1) = state\" by auto\n              from  n545877 have   \"state |\\<in>| states rule\" by blast\n              from n754655 have \" (down e1) \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) ruleDown\" by auto\n                  \n                  \n              from n75456  have n767097 : \"forestDown \\<in> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) ruleDown)\" by auto\n              from n6564387 have n6545787 : \"evaluation (\\<A> i) (down e1) = state\" by auto\n              from n754655 n767097 n6545787 evaluation_def language_for_rule_def tree_for_rule_def have \" tree_for_rule (\\<A> i) ruleDown (down e1)\" by auto\n              hence n653545 : \"evaluation (\\<A> i) |`| childrenSet  (down e1) = states ruleDown\" using tree_for_rule_def by metis\n                  have n65764 : \"(down e1) = (NODE (root (down e1)) (childrenSet  (down e1)))\"\n                    by (metis (no_types) childrenSet.cases childrenSet.simps root.simps) \n                  \n                  \n                  from n6545787 language_for_rule_def have \"evaluation (\\<A> i) (down e1) = state\" by auto\n                  hence n5t45789 : \"state = (((transition (\\<A> i)) (fimage (evaluation (\\<A> i)) (childrenSet  (down e1)))) (root (down e1)))\" using n65764 evaluation.simps by metis\n                   from n653545   have n54458797 : \"(states ruleDown) = (fimage (evaluation (\\<A> i)) (childrenSet  (down e1)))\"  by auto\n                      \n                       have n5865654 : \"(root (down e1)) = (symbol ruleDown)\" using n754655 language_for_rule_def tree_for_rule_def by blast\n                       \n              from n54458797 n5t45789 n5865654 have \"(transition (\\<A> i) (states ruleDown) (symbol ruleDown) = state)\"  by auto\n                  \n              have x5 : \"(\\<forall>h. (\\<exists>t. r = h # t) \\<longrightarrow> transition (\\<A> i) (states h) (symbol h) |\\<in>| states rule)\"\n                using \\<open>transition (\\<A> i) (states ruleDown) (symbol ruleDown) = state\\<close> n545877 n65t6988 by auto \n                  \n              from x1 x2 x3 x4 x5 show \"labelOfNode a = symbol rule \\<and> rule |\\<in>| rule_set (\\<A> i) \\<and> down a \\<in> \\<V>\\<^sub>\\<tau> i rule \\<and> pathFitsListAndListIsARun i p r \\<and> (\\<forall>h. (\\<exists>t. r = h # t) \\<longrightarrow> transition (\\<A> i) (states h) (symbol h) |\\<in>| states rule) \" by auto\n            qed\n            from y1 y2  show \"\\<exists>r. hd r = rule \\<and> pathFitsListAndListIsARun i (a # p) r\" by blast\n          }\n            \n            \n          {\n            assume \"(\\<exists>node. (Cons a p) = [node])\"\n            hence n543 : \"p = []\" by auto\n            def r == \"[rule]\"\n            then have n764 : \"hd r = rule\" by auto\n            have \"pathFitsListAndListIsARun i [a] r\" using a1 a2 a3 r_def pathFitsListAndListIsARun.simps by blast\n            then show \"\\<exists>r. hd r = rule \\<and> pathFitsListAndListIsARun i (a # p) r\" using n764 n543 by auto\n          } \n        qed\n        then show \"\\<exists>r. hd r |\\<in>| \\<R> i \\<and> pathFitsListAndListIsARun i (a # p) r\" using n654654 by auto\n      qed\n    qed\n  qed\n  hence \"\\<And>\\<R> x tree p. x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \\<Longrightarrow> tree |\\<in>| x \\<Longrightarrow>  p \\<in>pathsInTree tree \\<Longrightarrow> pathSatisfiesApproximatorForRuleSet p (\\<R> i) i\" by auto\n  hence  \"\\<And>\\<R> x tree. x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \\<Longrightarrow> tree |\\<in>| x \\<Longrightarrow> tree \\<in> {tr. \\<forall>p\\<in>pathsInTree tr. pathSatisfiesApproximatorForRuleSet p (\\<R> i) i}\" by auto\n  hence  \"\\<And>\\<R> x tree. x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \\<Longrightarrow> tree \\<in> (fset x) \\<Longrightarrow> tree \\<in> {tr. \\<forall>p\\<in>pathsInTree tr. pathSatisfiesApproximatorForRuleSet p (\\<R> i) i}\" using notin_fset\n  proof -\n    fix \\<R> :: \"ot \\<Rightarrow> (stt, abc) rule fset\" and x :: \"abc tree fset\" and tree :: \"abc tree\"\n    assume a1: \"tree \\<in> fset x\"\n    assume a2: \"x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)\"\n    assume \"\\<And>x \\<R> tree. \\<lbrakk>x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i); tree |\\<in>| x\\<rbrakk> \\<Longrightarrow> tree \\<in> {tr. \\<forall>p\\<in>pathsInTree tr. pathSatisfiesApproximatorForRuleSet p (\\<R> i) i}\"\n    then show \"tree \\<in> {t. \\<forall>ns\\<in>pathsInTree t. pathSatisfiesApproximatorForRuleSet ns (\\<R> i) i}\"    using a2 a1 by (meson notin_fset)\n  qed \n    hence  \"\\<And>\\<R> x . x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \\<Longrightarrow> (\\<And> tree . tree \\<in> (fset x) \\<Longrightarrow> tree \\<in> {tr. \\<forall>p\\<in>pathsInTree tr. pathSatisfiesApproximatorForRuleSet p (\\<R> i) i})\" by auto\n  then show \"\\<And>\\<R> x. x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \\<Longrightarrow> (fset x \\<subseteq> {tr. \\<forall>p\\<in>pathsInTree tr. pathSatisfiesApproximatorForRuleSet p (\\<R> i) i})\" by auto\nqed\n  \n  \n  \n  \n  \nlemma noEmptyForests0 :\n  assumes \"forest \\<in> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> automaton s\"\n  shows \"forest \\<noteq> {||}\"\n  proof -\n    have \"\\<exists> tree . tree |\\<in>| forest\" using assms(1) by (simp add: forest_language_for_state_def) \n        then show ?thesis by auto\n  qed\n    \n  \n                  \nlemma noEmptyForests :\n  assumes \"l |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`|stateset)\"\n  assumes \"forest \\<in> l\"\n  shows \"forest \\<noteq> {||}\"\n  using noEmptyForests0\n  using assms(1) assms(2) by fastforce \n\n    \n  \nlemma singletonPathsMeansSingletonTree :\n  fixes forest \\<alpha>\n  assumes n75478 : \"\\<And>tree path . tree \\<in> (fset forest) \\<Longrightarrow> (path |\\<in>| (\\<Pi> tree)) \\<Longrightarrow> path = [\\<alpha>]\"\n  shows \"\\<And>tree . tree \\<in> (fset forest) \\<Longrightarrow> tree = (NODE \\<alpha> fempty)\"\nproof -\n  fix tree\n  assume n75687 :  \"tree \\<in> (fset forest)\"\n  obtain root children where n54668978 : \"tree = (NODE root children)\" using tree.exhaust by auto\n  then have n6587 : \" (\\<Pi> (NODE root children)) |\\<subseteq>| (finsert [\\<alpha>] fempty)\" using n75478  n75687          using \\<ff>_def n75687 by force \n  from pathAlternateDef have n54647 : \"(\\<Pi> (NODE root children)) = (\\<lambda> x. (root#x)) |`| (\\<Union>| (\\<Pi> |`| children) |\\<union>| {|[]|})\" by auto\n  from n6587 have n656587 : \"(\\<Pi> (NODE root children)) |\\<subseteq>| (\\<lambda> x. (root#x)) |`| ({|[]|})\" by auto\n  have n6445877 : \"(\\<lambda> x. (root#x)) |`| ({|[]|}) = (finsert [root] fempty)\" by simp\n  hence n76535 : \"(finsert [root] fempty) |\\<subseteq>| (finsert [\\<alpha>] fempty)\" using n6587  n656587 by auto\n  hence n7698 :  \"root = \\<alpha>\" by auto\n  hence \" (\\<lambda> x. (\\<alpha>#x)) |`| (\\<Union>| (\\<Pi> |`| children) |\\<union>| {|[]|}) |\\<subseteq>| (finsert [\\<alpha>] fempty)\" using n76535 n6445877 n54647 n656587 by auto\n  hence \"(\\<Union>| (\\<Pi> |`| children) |\\<union>| {|[]|}) = {|[]|}\" by auto\n  hence \"(\\<Union>| (\\<Pi> |`| children)) |\\<union>| {|[]|} = {|[]|}\" by auto\n  hence \"(\\<Union>| (\\<Pi> |`| children)) |\\<subseteq>| {|[]|}\" by auto\n  hence \"\\<And>path . path |\\<in>| (\\<Union>| (\\<Pi> |`| children)) \\<Longrightarrow> path = []\" by auto\n  hence \"\\<And> childrenpath path . childrenpath |\\<in>| (\\<Pi> |`| children) \\<Longrightarrow> path |\\<in>| childrenpath \\<Longrightarrow> path = []\" by auto\n  hence \"\\<And> path child. child |\\<in>| children \\<Longrightarrow> path |\\<in>| \\<Pi> child \\<Longrightarrow> path = []\" by auto\n  hence \"\\<And>  child. child |\\<in>| children \\<Longrightarrow> False\" using rootIsPath2 by auto\n  hence \"children = fempty\" by auto\n  then show \"tree = (NODE \\<alpha> fempty)\" using n7698 n54668978 by auto\nqed\n  \n  \n    \n    (* ========================================================================================== *)\n    \nfun childrenPathsetsAreSubsets :: \"abc node list \\<Rightarrow> abc node list \\<Rightarrow> bool\" where\n  \"childrenPathsetsAreSubsets [] [] = True\"\n| \"childrenPathsetsAreSubsets [] (a#b) = False\"\n| \"childrenPathsetsAreSubsets (a#b) [] = False\"\n| \"childrenPathsetsAreSubsets (a#b) (c#d) = ((childrenPathsetsAreSubsets b d) \n                                               \\<and> ( labelOfNode a = labelOfNode c  )\n                                               \\<and> (\\<Pi> (down a) |\\<subseteq>| \\<Pi> (down c))\n                                                )\"\n  \n  \nlemma childrenWithSymbolIdempotent :  \n  \"\\<And> (symbol :: abc) . ((childrenWithSymbol symbol (childrenWithSymbol symbol z)) = (childrenWithSymbol symbol z))\"\nproof -\n  fix symbola :: abc\n  obtain ff :: \"abc tree fset \\<Rightarrow> abc tree \\<Rightarrow> abc tree fset\" where\n    f1: \"\\<forall>x0 x1. (\\<exists>v2. x0 = finsert x1 v2 \\<and> x1 |\\<notin>| v2) = (x0 = finsert x1 (ff x0 x1) \\<and> x1 |\\<notin>| ff x0 x1)\"\n    by moura\n  obtain tt :: \"abc tree fset \\<Rightarrow> abc tree fset \\<Rightarrow> abc tree\" where\n    \"\\<forall>x0 x1. (\\<exists>v2. v2 |\\<in>| x1 \\<and> v2 |\\<notin>| x0) = (tt x0 x1 |\\<in>| x1 \\<and> tt x0 x1 |\\<notin>| x0)\"\n    by moura\n  then have \"\\<forall>f fa. tt fa f |\\<in>| f \\<and> tt fa f |\\<notin>| fa \\<or> f |\\<subseteq>| fa\"\n    by blast\n  moreover\n  { assume \"tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}) |\\<notin>| inf_fset2 (ff z (tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}))) {t. root t = symbola}\"\n    moreover\n    { assume \"inf_fset2 (ff z (tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}))) {t. root t = symbola} \\<noteq> inf_fset2 z {t. root t = symbola}\"\n      moreover\n      { assume \"z \\<noteq> finsert (tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola})) (ff z (tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}))) \\<or> tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}) |\\<in>| ff z (tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}))\"\n        then have \"tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}) |\\<notin>| inf_fset2 z {t. root t = symbola} \\<or> tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}) |\\<in>| inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}\"\n          using f1 by (meson finterD1 set_finsert) }\n      ultimately have \"tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}) |\\<notin>| inf_fset2 z {t. root t = symbola} \\<or> tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}) |\\<in>| inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}\"\n        by (metis childrenWithSymbol_def finterI finter_finsert_left_ifffempty) }\n    ultimately have \"tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}) |\\<notin>| inf_fset2 z {t. root t = symbola} \\<or> tt (inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}) (inf_fset2 z {t. root t = symbola}) |\\<in>| inf_fset2 (childrenWithSymbol symbola z) {t. root t = symbola}\"\n      by metis }\n  ultimately show \"childrenWithSymbol symbola (childrenWithSymbol symbola z) = childrenWithSymbol symbola z\"\n    using f1 by (metis childrenWithSymbol_def finterD1 fset_eq_fsubset set_finsert)\nqed\n  \nlemma psiPathsMonotonic :\n  assumes \"a |\\<subseteq>| b\"\n  shows \"pathsInForest (psiF a) |\\<subseteq>| pathsInForest (psiF b)\"\n  by (metis (mono_tags, lifting) assms fsubsetD fsubsetI pathsTreeForest psiPreservesPaths) \n    \nlemma psiTreeForestMonotonic :\n  fixes a :: \"abc tree\"\n  fixes t :: \"abc tree\"\n  fixes symbol :: abc\n  assumes \"a |\\<in>| (childrenWithSymbol symbol z)\"\n  assumes \"t = psi (NODE symbol (\\<Union>| (childrenSet |`| (childrenWithSymbol symbol z))))\"\n  shows \"\\<delta>\\<^sub>\\<tau> a |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t\"\nproof -\n  have \"(finsert a fempty) |\\<subseteq>| (childrenWithSymbol symbol z)\" using assms(1)    by simp \n  have \"pathsInForest (finsert a fempty) = \\<delta>\\<^sub>\\<tau> a\"    by (simp add: pathsSingeton) \n  have a1 : \"root |`| (childrenWithSymbol symbol z) = (finsert symbol fempty)\" \n  proof (simp add : childrenWithSymbol_def)\n    show \"root |`| inf_fset2 z {child1. root child1 = symbol} = {|symbol|}\"\n    proof\n      show \" root |`| inf_fset2 z {child1. root child1 = symbol} |\\<subseteq>| {|symbol|}\"\n        by (metis (mono_tags, lifting) Int_iff fimage_fsubsetI finsertCI inf_fset2.rep_eq mem_Collect_eq notin_fset) \n      show \"{|symbol|} |\\<subseteq>| root |`| inf_fset2 z {child1. root child1 = symbol} \" using assms(1)\n        by (metis Collect_cong \\<open>root |`| inf_fset2 z {child1. root child1 = symbol} |\\<subseteq>| {|symbol|}\\<close> childrenWithSymbol_def fempty_is_fimage finsert_not_fempty fsubset_fsingletonD mk_disjoint_finsert) \n    qed\n  qed\n  have \"(finsert t fempty) = psiF (childrenWithSymbol symbol z)\" \n  proof (simp add : psiF_def  assms(2))\n    have \"((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 (childrenWithSymbol symbol z))))) \\<circ> root) |`| childrenWithSymbol symbol z =\n((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 (childrenWithSymbol symbol z))))) |`| (root) |`| childrenWithSymbol symbol z)\" by auto \n    hence \"((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 (childrenWithSymbol symbol z))))) \\<circ> root) |`| childrenWithSymbol symbol z =\n((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 (childrenWithSymbol symbol z))))) |`| (finsert symbol fempty))\" using a1 by auto\n    have \"((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 (childrenWithSymbol symbol z))))) |`| (finsert symbol fempty))\n          = {|psi (NODE symbol (\\<Union>| (childrenSet |`| childrenWithSymbol symbol z)))|}\" using childrenWithSymbolIdempotent by auto\n    then show \"{|psi (NODE symbol (\\<Union>| (childrenSet |`| childrenWithSymbol symbol z)))|} =\n    ((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 (childrenWithSymbol symbol z))))) \\<circ> root) |`| childrenWithSymbol symbol z\" using a1\n      by (simp add: \\<open>((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 (childrenWithSymbol symbol z))))) \\<circ> root) |`| childrenWithSymbol symbol z = (\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 (childrenWithSymbol symbol z))))) |`| {|symbol|}\\<close>) \n  qed\n  have \"pathsInForest (finsert t fempty) = \\<delta>\\<^sub>\\<tau> t\" by (simp add: pathsSingeton) \n  show \"\\<delta>\\<^sub>\\<tau> a |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t \" using psiPathsMonotonic\n    using \\<open>\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> {|a|} = \\<delta>\\<^sub>\\<tau> a\\<close> \\<open>\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> {|t|} = \\<delta>\\<^sub>\\<tau> t\\<close> \\<open>{|a|} |\\<subseteq>| childrenWithSymbol symbol z\\<close> \\<open>{|t|} = \\<Psi>\\<^sub>\\<phi> (childrenWithSymbol symbol z)\\<close> psiPreservesPaths by auto \nqed\n  \n    \n  \n  \n  \nlemma psiSubsetsLemma2 :\n  fixes p\n  shows \"\\<And> t x z . t |\\<in>| x \\<Longrightarrow> p \\<in> (pathsInTree t) \\<Longrightarrow> x = psiF z \\<Longrightarrow> (\\<exists>t2 p2.(t2 |\\<in>| z \\<and> childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree t2))\"\nproof (induct p)\n  case Nil\n  hence \"False\" using  noEmptyPaths pathsInTree_def   by (simp add: pathsInTree_def) \n  then show ?case by auto\nnext\n  case (Cons a p)\n  from Cons.prems(2) have a1 : \"(isAPathp (a # p))\" using pathsInTree_def by blast\n  from Cons.prems(2) have n654654 : \"(( down a = t))\" using pathsInTree_def by blast\n  have n14558 : \"p = [] \\<Longrightarrow> (\\<exists> witnessTree . witnessTree |\\<in>| z \\<and> root witnessTree = root t \\<and> \\<delta>\\<^sub>\\<tau> witnessTree |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t)\"\n  proof -\n    assume \"p = []\"\n    have nu674543 : \"down a |\\<in>| psiF z\" using Cons.prems(1)    Cons.prems(3) n654654 by auto\n    from psiF_def have n865654 : \"psiF z = (\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 z)))) |`| root |`| z \" by auto\n    then obtain symbol where n76454 : \"down a = psi (NODE symbol (\\<Union>| (childrenSet |`| childrenWithSymbol symbol z)))\" and \"symbol |\\<in>| (root |`| z)\" using nu674543 by auto\n    then obtain witnessTree where n864653 : \"witnessTree |\\<in>| z\" and n864543 : \"root witnessTree = symbol\" by auto\n    hence n875653 : \"witnessTree |\\<in>| childrenWithSymbol symbol z\" using childrenWithSymbol_def   by (simp add: childrenWithSymbol_def finterI) \n    from n654654  n864543 n76454 root.simps  have \"(root witnessTree = root t)\"      by (simp add: n654654 psiRoot) \n    have \"t = psi (NODE symbol (\\<Union>| (childrenSet |`| childrenWithSymbol symbol z)))\" using n76454 n654654 by auto\n    have \"\\<delta>\\<^sub>\\<tau> witnessTree |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t\" using psiTreeForestMonotonic\n      using \\<open>t = psi (NODE symbol (\\<Union>| (childrenSet |`| childrenWithSymbol symbol z)))\\<close> n875653 by blast \n    have \"witnessTree |\\<in>| z \\<and> root witnessTree = root t \\<and> \\<delta>\\<^sub>\\<tau> witnessTree |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t\"\n      by (simp add: \\<open>\\<delta>\\<^sub>\\<tau> witnessTree |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t\\<close> \\<open>root witnessTree = root t\\<close> n864653) \n    then show \"(\\<exists> witnessTree . witnessTree |\\<in>| z \\<and> root witnessTree = root t \\<and> \\<delta>\\<^sub>\\<tau> witnessTree |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t)\" by auto\n  qed\n  from a1 isAPath.simps isAPathp_isAPath_eq have \"((\\<exists>node. (a # p) = [node]) \\<or> (\\<exists>path e2. (a # p) = e2 # path \\<and> path \\<in> isAPath \\<and> (\\<exists>e1 tail. path = e1 # tail \\<and> immediatelyDominates e2 e1)))\"  by metis\n  hence \"p = [] \\<or> ( (p \\<in> isAPath \\<and> (\\<exists>e1 tail. p = e1 # tail \\<and> immediatelyDominates a e1)))\" by blast\n  hence \"p = [] \\<or> ( (p \\<in> isAPath \\<and> (\\<exists>e1 tail. p = e1 # tail \\<and>  ((down e1) |\\<in>| (childrenSet (down a))) )))\" using immediatelyDominates_def by auto\n  then obtain e1 tail where \"p \\<noteq> [] \\<Longrightarrow> ( p = e1 # tail \\<and> ((down e1) |\\<in>| (childrenSet (down a))))\" by auto\n  hence ny54r654 : \"p \\<noteq> [] \\<Longrightarrow> ( p = e1 # tail \\<and> ((down e1) |\\<in>| (childrenSet t)))\" using n654654 by auto\n  from Cons.prems(3) psiF_def have \"x = (\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 z)))) |`| root |`| z \" by auto\n  hence n65464 : \"x = (\\<lambda>symbol2.  (NODE symbol2 (psiF (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 z))))) |`| root |`| z \" using psiDef psiF_def    by (smt fset.map_cong0) \n  from Cons.prems(1) n65464 obtain tree where n76798798 : \"t = (NODE (root tree) (psiF (\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z))))\" by auto\n  hence n54564 : \"childrenSet t = ((psiF (\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z))))\" by simp\n  hence \"p \\<noteq> [] \\<Longrightarrow> (down e1) |\\<in>| ((psiF (\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z))))\" using ny54r654 n54564 by auto\n  def downT == \"(down e1)\"\n  def downX == \"childrenSet t\"\n  def downZ == \"(\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z))\"\n  have a1 : \"p \\<noteq> [] \\<Longrightarrow> downT |\\<in>| downX\"\n    using downT_def downX_def ny54r654 by auto \n  have a2 : \"p \\<noteq> [] \\<Longrightarrow> p \\<in> pathsInTree downT\"\n    by (smt Cons.prems(2) downT_def isAPathp.simps list.sel(3) mem_Collect_eq ny54r654 pathsInTree_def) \n  have a3 : \"p \\<noteq> [] \\<Longrightarrow> downX = \\<Psi>\\<^sub>\\<phi> downZ\"\n    by (simp add: downX_def downZ_def n54564) \n  from a1 a2 a3 Cons.hyps obtain t2 p2 where n76565 : \"p \\<noteq> [] \\<Longrightarrow> (t2 |\\<in>| downZ \\<and> childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree t2)\" and ny54543 : \"p = [] \\<Longrightarrow> p2 = []\"  by meson \n  hence n65654654 :  \"p \\<noteq> [] \\<Longrightarrow> p2 \\<in> pathsInTree t2\" by auto\n  hence n6576 : \"p \\<noteq> [] \\<Longrightarrow> p2 \\<noteq>[] \\<Longrightarrow> p2 \\<in> isAPath\" using pathsInTree_def isAPath.simps isAPathp_isAPath_eq\n  proof -\n    assume \"p \\<noteq> []\"\n    then have \"isAPathp p2\"\n      using n65654654 pathsInTree_def by fastforce\n    then show ?thesis\n      by (metis (lifting) isAPathp_isAPath_eq)\n  qed \n  from n65654654 pathsInTree_def have ny5543 : \"p \\<noteq> [] \\<Longrightarrow> (\\<exists>e1 tail. p2 = e1 # tail \\<and> down e1 = t2)\" by auto\n  from downZ_def n76565 n14558 obtain elementOfZ where n65463 : \"p \\<noteq> [] \\<Longrightarrow> t2 |\\<in>| childrenSet elementOfZ\" and n6545876 : \"p \\<noteq> [] \\<Longrightarrow> elementOfZ |\\<in>|  childrenWithSymbol (root tree) z\" \n    and n47885787 : \"p = [] \\<Longrightarrow>( elementOfZ |\\<in>| z \\<and> root elementOfZ = root t \\<and> \\<delta>\\<^sub>\\<tau> elementOfZ |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t)\"    using Cons.prems(1) \\<open>x = (\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 z)))) |`| root |`| z\\<close> by auto \n  hence ny654653 : \" p \\<noteq> [] \\<Longrightarrow> elementOfZ |\\<in>| z\" using childrenWithSymbol_def    by (metis finterD1)\n  def newT2 == \"elementOfZ\"\n  obtain newNode where nu65654 : \"down (newNode :: abc node) = elementOfZ\"  using nodeExists by auto\n  def newP2 == \"newNode#p2\"\n  from newT2_def ny654653 n47885787 have \"newT2 |\\<in>| z\" by auto\n  have \"childrenPathsetsAreSubsets newP2 (Cons a p)\"\n  proof (simp add : newP2_def)\n    show \"childrenPathsetsAreSubsets p2 p \\<and> labelOfNode newNode = labelOfNode a \\<and> \\<delta>\\<^sub>\\<tau> (down newNode) |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (down a)\"\n    proof\n      from n76565 show \"childrenPathsetsAreSubsets p2 p\" using ny54543 childrenPathsetsAreSubsets.simps(1) by metis\n      show \" labelOfNode newNode = labelOfNode a \\<and> \\<delta>\\<^sub>\\<tau> (down newNode) |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (down a) \" \n      proof (simp add : labelOfNode_def nu65654 n654654)\n        from n6545876 have ny765876 : \"p \\<noteq> [] \\<Longrightarrow> elementOfZ |\\<in>|  childrenWithSymbol (root tree) z\" by auto\n        from n76798798 have \"t = (NODE (root tree) (psiF (\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z))))\" by auto\n        hence a1 : \"root tree = root t\" by auto\n        from ny765876 childrenWithSymbol_def have a2 : \"p \\<noteq> [] \\<Longrightarrow> root elementOfZ = root tree\" \n        proof (simp add :childrenWithSymbol_def)\n          show \"p \\<noteq> [] \\<Longrightarrow> elementOfZ |\\<in>| inf_fset2 z {child1. root child1 = root tree} \\<Longrightarrow> root elementOfZ = root tree\"\n            by (metis IntD2 inf_fset2.rep_eq mem_Collect_eq notin_fset)\n        qed\n        from a1 a2 have n76987 : \"p \\<noteq> [] \\<Longrightarrow> root elementOfZ = root t\" by auto\n        from ny765876   have \"p \\<noteq> [] \\<Longrightarrow>  \\<delta>\\<^sub>\\<tau> elementOfZ |\\<subseteq>| pathsInForest (childrenWithSymbol (root tree) z)\" using pathsInForest_def by auto\n        from n76798798  have \"t = (NODE (root tree) (psiF (\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z))))\" by auto\n        hence \"\\<delta>\\<^sub>\\<tau> t = fimage (\\<lambda> tail.((root tree)#tail)) ((\\<Union>| (fimage \\<Pi> (psiF (\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z))))) |\\<union>|  (finsert [] {||}))\" using pathAlternateDef by auto\n        hence \"\\<delta>\\<^sub>\\<tau> t = fimage (\\<lambda> tail.((root tree)#tail)) (pathsInForest ( ((((psiF (\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z))))))) |\\<union>|  (finsert [] {||}))\" using pathsInForest_def by auto\n        hence n76798 : \"\\<delta>\\<^sub>\\<tau> t = fimage (\\<lambda> tail.((root tree)#tail)) (pathsInForest (\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z)) |\\<union>|  (finsert [] {||}))\" using psiPreservesPaths by auto\n        obtain rootE childrenE where ny56ty8 : \"elementOfZ = (NODE rootE childrenE)\"          using tree.exhaust by auto \n        hence ny687 : \"\\<delta>\\<^sub>\\<tau> elementOfZ = fimage (\\<lambda> tail.((rootE)#tail)) (((\\<Union>| (fimage \\<Pi> childrenE)) |\\<union>|  (finsert [] {||})))\" using pathAlternateDef by auto\n        from n76987  ny56ty8 have \"p \\<noteq> [] \\<Longrightarrow> rootE = root tree\" using root.simps          using a1 by auto \n        hence \"p \\<noteq> [] \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> elementOfZ = fimage (\\<lambda> tail.((root tree)#tail)) (((\\<Union>| (fimage \\<Pi> childrenE)) |\\<union>|  (finsert [] {||})))\"  using ny687 by auto\n        hence n54576 : \"p \\<noteq> [] \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> elementOfZ = fimage (\\<lambda> tail.((root tree)#tail)) ((pathsInForest (( childrenE))) |\\<union>|  (finsert [] {||}))\"  using pathsInForest_def by auto\n        have ny568767 : \"childrenE = childrenSet elementOfZ\" using ny56ty8          by simp \n        have \"p \\<noteq> [] \\<Longrightarrow> elementOfZ |\\<in>| childrenWithSymbol (root tree) z\"          by (simp add: ny765876) \n        hence \"p \\<noteq> [] \\<Longrightarrow>  childrenE |\\<subseteq>| \\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z)\" using ny568767          by (simp add: ffUnion_upper) \n        hence \"p \\<noteq> [] \\<Longrightarrow>  ((pathsInForest (( childrenE))) |\\<subseteq>| (pathsInForest (\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z))))\"          by (simp add: fimage_mono pathsInForest_def) \n        hence \"p \\<noteq> [] \\<Longrightarrow>((pathsInForest (( childrenE))) |\\<union>|  (finsert [] {||})) |\\<subseteq>| (pathsInForest (\\<Union>| (childrenSet |`| childrenWithSymbol (root tree) z)) |\\<union>|  (finsert [] {||}))\"         by auto \n        hence \"p \\<noteq> [] \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> elementOfZ  |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t\" using n76798 n54576 by auto\n        have \"pathsInForest (childrenWithSymbol (root tree) z) = \\<Union>| (\\<Pi> |`| (childrenWithSymbol (root tree) z))\" using pathsInForest_def by auto\n        have \"\\<And> root children . \\<Pi> (NODE root children) = fimage (\\<lambda> tail.((root)#tail)) ((\\<Union>| (fimage \\<Pi> children))|\\<union>| {|[]|})\" using pathAlternateDef by auto\n        have \"p \\<noteq> [] \\<Longrightarrow> (root elementOfZ = root t \\<and> \\<delta>\\<^sub>\\<tau> elementOfZ |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t)\"\n          by (simp add: \\<open>p \\<noteq> [] \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> elementOfZ |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t\\<close> n76987) \n        then show \"(root elementOfZ = root t \\<and> \\<delta>\\<^sub>\\<tau> elementOfZ |\\<subseteq>| \\<delta>\\<^sub>\\<tau> t)\" using n47885787 by auto\n      qed\n    qed\n  qed\n  have \"newP2 \\<in> pathsInTree newT2\"\n  proof (simp add : pathsInTree_def isAPathp_isAPath_eq  )\n    from nu65654 n65463 have nt43543 : \"p \\<noteq> [] \\<Longrightarrow> t2 |\\<in>| (childrenSet (down newNode))\" by auto\n    hence \"p \\<noteq> [] \\<Longrightarrow> ((p2 = []) \\<or> ((\\<exists>e1 tail. p2 = e1 # tail \\<and> (down e1) |\\<in>| (childrenSet (down newNode))) ))\" using ny5543 by auto\n    hence \"((p2 = []) \\<or> ((\\<exists>e1 tail. p2 = e1 # tail \\<and> (down e1) |\\<in>| (childrenSet (down newNode))) ))\" using ny54543 by auto\n    hence \" ((p2 = []) \\<or> ((\\<exists>e1 tail. p2 = e1 # tail \\<and> immediatelyDominates newNode e1)))\" using immediatelyDominates_def by auto\n    hence \" ((p2 = []) \\<or> (p2 \\<in> isAPath \\<and> (\\<exists>e1 tail. p2 = e1 # tail \\<and> immediatelyDominates newNode e1)))\" using n6576  using \\<open>childrenPathsetsAreSubsets newP2 (a # p)\\<close> childrenPathsetsAreSubsets.simps(3) childrenPathsetsAreSubsets.simps(4) newP2_def by blast \n    hence \" ((p2 = []) \\<or> (\\<exists>path e2. newNode#p2 = e2 # path \\<and> p2 \\<in> isAPath \\<and> (\\<exists>e1 tail. p2 = e1 # tail \\<and> immediatelyDominates newNode e1)))\" by auto\n    hence \" ((p2 = []) \\<or> (\\<exists>path e2. newNode#p2 = e2 # path \\<and> path \\<in> isAPath \\<and> (\\<exists>e1 tail. path = e1 # tail \\<and> immediatelyDominates e2 e1)))\" by auto\n    hence \" ((\\<exists>node. newNode#p2 = [node]) \\<or> (\\<exists>path e2. newNode#p2 = e2 # path \\<and> path \\<in> isAPath \\<and> (\\<exists>e1 tail. path = e1 # tail \\<and> immediatelyDominates e2 e1)))\" by auto\n    hence \" ((\\<exists>node. newP2 = [node]) \\<or> (\\<exists>path e2. newP2 = e2 # path \\<and> path \\<in> isAPath \\<and> (\\<exists>e1 tail. path = e1 # tail \\<and> immediatelyDominates e2 e1)))\" by (simp add :newP2_def)\n    hence n6546767 : \" newP2 \\<in> isAPath\" using isAPath.simps by metis\n    from newP2_def newT2_def nu65654 have \"((newP2 = newNode#p2) \\<and> down newNode = newT2)\" by auto\n    hence n5476678 : \"(\\<exists>e1. (\\<exists>tail. newP2 = e1 # tail) \\<and> down e1 = newT2)\" by auto\n    from n6546767 n5476678 show \"newP2 \\<in> isAPath \\<and> (\\<exists>e1. (\\<exists>tail. newP2 = e1 # tail) \\<and> down e1 = newT2)\" by auto\n  qed\n  def child == \"down e1\"\n  have \"t |\\<in>| x \\<Longrightarrow> p \\<in> pathsInTree t \\<Longrightarrow> x = \\<Psi>\\<^sub>\\<phi> z \\<Longrightarrow> \\<exists>t2 p2. t2 |\\<in>| z \\<and> childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree t2\"\n    using Cons.hyps by blast\n  then show ?case\n    using \\<open>childrenPathsetsAreSubsets newP2 (a # p)\\<close> \\<open>newP2 \\<in> pathsInTree newT2\\<close> \\<open>newT2 |\\<in>| z\\<close> by auto \nqed\n  \n  \n    \n  \n  (* =================================================== *)\n  \n  (* In this section, the goal is to show g \\<subseteq> f  *)\n  \nlemma subsetsRunsLemma :\n  fixes \\<ii> p2 \n  shows \"\\<And> r p. childrenPathsetsAreSubsets p2 p \\<Longrightarrow> (pathFitsListAndListIsARun \\<ii> p2 r) \\<Longrightarrow>pathFitsListAndListIsARun \\<ii> p r\"\nproof (induct p2)\n  case Nil\n  assume \"childrenPathsetsAreSubsets [] p\"\n  then have a1 : \"p = []\" using list.exhaust    using childrenPathsetsAreSubsets.elims(2) by auto  \n  assume \"pathFitsListAndListIsARun \\<ii> [] r\"\n  then have a2 : \"r = []\" using pathFitsListAndListIsARun.simps by (metis list.exhaust)       \n  then show ?case using a1 a2 by simp\nnext\n  case (Cons a p2)\n  assume b1 : \"\\<And> r p.(childrenPathsetsAreSubsets p2 p \\<Longrightarrow> pathFitsListAndListIsARun \\<ii> p2 r \\<Longrightarrow> pathFitsListAndListIsARun \\<ii> p r)\"\n  assume b2 : \"childrenPathsetsAreSubsets (a # p2) p\"\n  assume b3 : \"pathFitsListAndListIsARun \\<ii> (a # p2) r\"\n    \n    \n  have y1 : \"r = (hd r)#(tl r)\"\n    by (metis b3 list.exhaust_sel nonMatching) \n  have \"p = (hd p)#(tl p)\" using b2\n    using childrenPathsetsAreSubsets.simps(3) list.exhaust_sel by blast \n      \n  from b2 have c1 : \"childrenPathsetsAreSubsets  p2 (tl p)\"\n    by (metis \\<open>p = hd p # tl p\\<close> childrenPathsetsAreSubsets.simps(4)) \n  from b3 have c2 : \"pathFitsListAndListIsARun \\<ii> p2 (tl r)\"\n    by (metis \\<open>r = hd r # tl r\\<close> pathFitsListAndListIsARun.simps(2)) \n  from b1 c1 c2 have \"pathFitsListAndListIsARun \\<ii> (tl p) (tl r)\" by auto\n  from b3 pathFitsListAndListIsARun.simps have \"(labelOfNode a = symbol (hd r))\" by (metis hd_Cons_tl) \n  from b3 pathFitsListAndListIsARun.simps have \"((hd r) |\\<in>| rule_set (\\<A> \\<ii>))\" by (metis hd_Cons_tl)\n  from b3 pathFitsListAndListIsARun.simps   have \" (( (down a)) \\<in> ( \\<V>\\<^sub>\\<tau> \\<ii> (hd r)  )   )\" by (metis hd_Cons_tl)\n  from b3 pathFitsListAndListIsARun.simps   have \" (pathFitsListAndListIsARun \\<ii> p2 (tl r))\" by (metis hd_Cons_tl)\n  from b3 pathFitsListAndListIsARun.simps   have \" (\\<forall> h.\\<forall> t.((tl r) = (h#t) \\<longrightarrow>  (        (((transition (\\<A> \\<ii>) (states h) (symbol h) )  |\\<in>| states (hd r)) )        )))\" by (metis hd_Cons_tl)\n  from b2 have u1 :  \"( labelOfNode a = labelOfNode (hd p)  )\n                                               \\<and> (\\<Pi> (down a) |\\<subseteq>| \\<Pi> (down (hd p)))\n                                                \"\n    by (metis \\<open>p = hd p # tl p\\<close> childrenPathsetsAreSubsets.simps(4)) \n  have \"(labelOfNode (hd p) = symbol (hd r))\"\n    using \\<open>labelOfNode a = labelOfNode (hd p) \\<and> \\<delta>\\<^sub>\\<tau> (down a) |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (down (hd p))\\<close> \\<open>labelOfNode a = symbol (hd r)\\<close> by auto \n      \n  have \" (( (down (hd p))) \\<in> ( \\<V>\\<^sub>\\<tau> \\<ii> (hd r)  )   )\"\n  proof -\n    have \" (( (down a)) \\<in> ( \\<V>\\<^sub>\\<tau> \\<ii> (hd r)  )   )\"\n      by (simp add: \\<open>down a \\<in> \\<V>\\<^sub>\\<tau> \\<ii> (hd r)\\<close>)\n        \n    then have u2 : \"(root (( (down a))) = (symbol (hd r))) \\<and> \\<Pi> (( (down a))) \\<in> ((upwardClosure (image \\<Pi> (((Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) (hd r))))))) \n                                 \\<union> (image \\<Pi> {t . height t > \\<N>})) \n                              \\<inter> (\\<Inter>I \\<in> (necess (\\<A> \\<ii>) \\<I> (hd r)) . (image \\<Pi> (existential_satisfaction_set I)   ))\"\n      using \\<V>\\<^sub>\\<tau>_def by blast\n    then have v1 : \"(root (( (down (hd p)))) = (symbol (hd r)))\"\n      by (metis \\<open>labelOfNode (hd p) = symbol (hd r)\\<close> labelOfNode_def)\n    from u1 have u3 : \"(\\<Pi> (down a) |\\<subseteq>| \\<Pi> (down (hd p)))\" by auto\n    then show \" (( (down (hd p))) \\<in> ( \\<V>\\<^sub>\\<tau> \\<ii> (hd r)  )   )\" using vUpwardsClosedLemma v1\n      by (metis (mono_tags, lifting) \\<V>\\<^sub>\\<tau>_def mem_Collect_eq u2)\n  qed\n  have \" (pathFitsListAndListIsARun \\<ii> (tl p) (tl r))\"\n    by (simp add: \\<open>pathFitsListAndListIsARun \\<ii> (tl p) (tl r)\\<close>) \n  then show \"pathFitsListAndListIsARun \\<ii> p r\" using pathFitsListAndListIsARun.simps\n    by (metis \\<open>\\<forall>h t. tl r = h # t \\<longrightarrow> transition (\\<A> \\<ii>) (states h) (symbol h) |\\<in>| states (hd r)\\<close> \\<open>down (hd p) \\<in> \\<V>\\<^sub>\\<tau> \\<ii> (hd r)\\<close> \\<open>hd r |\\<in>| rule_set (\\<A> \\<ii>)\\<close> \\<open>labelOfNode (hd p) = symbol (hd r)\\<close> \\<open>p = hd p # tl p\\<close> \\<open>r = hd r # tl r\\<close>) \nqed\n  \nlemma subsetsApproxPathsLemma:\n  fixes \\<ii> p2 p \\<R>\n  shows \"childrenPathsetsAreSubsets p2 p \\<Longrightarrow> pathSatisfiesApproximatorForRuleSet p2 (\\<R> \\<ii>) \\<ii> \\<Longrightarrow> pathSatisfiesApproximatorForRuleSet p (\\<R> \\<ii>) \\<ii>\"\nproof -\n  assume a2 : \"childrenPathsetsAreSubsets p2 p\"\n  assume a3 : \" pathSatisfiesApproximatorForRuleSet p2 (\\<R> \\<ii>) \\<ii>\"\n  from a3 pathSatisfiesApproximatorForRuleSet_def obtain r where a10 : \"((hd r |\\<in>| (\\<R> \\<ii>)) \\<and>\n                      (pathFitsListAndListIsARun \\<ii> p2 r))\" by blast\n  then have \"pathFitsListAndListIsARun \\<ii> p r\" using subsetsRunsLemma a2 by auto\n  then show \"pathSatisfiesApproximatorForRuleSet p (\\<R> \\<ii>) \\<ii>\" using pathSatisfiesApproximatorForRuleSet_def a10 by blast\nqed\n  \n  \n  \n  \n(*lemma psiAndApproxGeneral :\n  fixes \\<ii> x p\n  assumes \"f \\<in> (\\<P>\\<^sub>1 \\<R> \\<ii>)\"\n  shows \"psi f \\<in> (\\<P>\\<^sub>1 \\<R> \\<ii>)\"\nproof -\n  from assms satisfiesApproximatorForRuleSet_def \\<P>\\<^sub>1_def have a2 : \"(\\<And> p . p \\<in> (pathsInTree f) \\<Longrightarrow>\n             pathSatisfiesApproximatorForRuleSet p (\\<R> \\<ii>) \\<ii>)\" by blast\n  have \"(\\<And> p . p \\<in> (pathsInTree (psi f)) \\<Longrightarrow>\n             pathSatisfiesApproximatorForRuleSet p (\\<R> \\<ii>) \\<ii>)\"\n  proof -\n    fix p\n    assume a1 : \"p \\<in> (pathsInTree (psi f))\"\n    from psiSubsetsLemma a1 obtain p2 where a4 : \"childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree f\" by blast\n    from a4 a2 subsetsApproxPathsLemma show \"pathSatisfiesApproximatorForRuleSet p (\\<R> \\<ii>) \\<ii>\" by auto\n  qed\n  then show \"psi f \\<in> (\\<P>\\<^sub>1 \\<R> \\<ii>)\" using satisfiesApproximatorForRuleSet_def \\<P>\\<^sub>1_def by blast\nqed*)\n  \n  \n  \n    \n  \n  \nlemma gInF : \n  fixes \\<R> :: \"ot \\<Rightarrow> (stt,abc) rule fset\"\n  fixes n\n    assumes \"\\<And> \\<R>  r i. (r |\\<in>| \\<R> i \\<Longrightarrow> (r |\\<in>| rule_set (\\<A> i)))\"\n  shows \"\\<Union>| (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2))))) |\\<subseteq>| (\\<ff> n  \\<R>)\"\n\nproof\n  fix x\n  assume b0 : \"x |\\<in>| \\<Union>| (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2)))))\"\n  from b0 obtain y where b1 : \"x |\\<in>| y\" and b2 : \"y |\\<in>|  (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2)))))\" by (meson ffUnionLemma)\n  from b2 have b3 : \"heightForestBounded y n\" using \\<Z>\\<^sub>\\<phi>_def heightForestBounded_def by (metis (mono_tags, lifting) finterD1 mem_Collect_eq notin_fset restrictionIsFiniteForests) \nfrom b2 have  b4 : \"y \\<in> (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2))))\" using \\<Z>\\<^sub>\\<phi>_def  by (metis (no_types, lifting) IntD2 inf_fset2.rep_eq notin_fset)\n  from \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho>_def b4 \n  have b6 : \"y \\<in> (\\<Psi>\\<^sub>\\<phi> ` ((\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| (((\\<R>) \\<aa>\\<^sub>1)))))))\n                       \\<inter> (\\<Psi>\\<^sub>\\<phi> ` ((\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| (((\\<R>) \\<aa>\\<^sub>2)))))))\" by metis                      \n  from aut_def b6 have c10 : \"\\<And> \\<ii>. y \\<in> (\\<Psi>\\<^sub>\\<phi> ` ((\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (((\\<R>) \\<ii>)))))))\" by (metis (full_types) IntE \\<A>.cases)\n  have \"\\<And>i . fset y \\<subseteq> (\\<P>\\<^sub>1 \\<R> i)\"\n  proof -\n    fix i\n    from c10 obtain originalForest where niu64534 : \"originalForest \\<in> (\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (((\\<R>) i)))))\" and n6587 : \"y = \\<Psi>\\<^sub>\\<phi> originalForest\" by blast\n    from gInFPre niu64534 assms have n754654 : \"fset originalForest \\<subseteq> (\\<P>\\<^sub>1 \\<R> i)\" by auto\n    have \"fset (\\<Psi>\\<^sub>\\<phi> originalForest) \\<subseteq> (\\<P>\\<^sub>1 \\<R> i)\"\n    proof (simp add : \\<P>\\<^sub>1_def satisfiesApproximatorForRuleSet_def)\n      have \"\\<And>tree . tree |\\<in>| (\\<Psi>\\<^sub>\\<phi> originalForest) \\<Longrightarrow> (\\<And> p. p \\<in>pathsInTree tree \\<Longrightarrow> pathSatisfiesApproximatorForRuleSet p (\\<R> i) i)\"\n      proof -\n        fix tree\n        assume n1 : \"tree |\\<in>| (\\<Psi>\\<^sub>\\<phi> originalForest)\"\n        fix p\n        assume n2 : \"p \\<in>pathsInTree tree\"\n        from n1 n2 psiSubsetsLemma2 obtain t2 p2 where n3 : \"((t2 |\\<in>| originalForest \\<and> childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree t2))\" by blast\n        from n3 n754654 have n5346 : \"t2 \\<in> (\\<P>\\<^sub>1 \\<R> i)\" using notin_fset by fastforce\n        from n5346 \\<P>\\<^sub>1_def satisfiesApproximatorForRuleSet_def n3 show \"pathSatisfiesApproximatorForRuleSet p (\\<R> i) i\"     using subsetsApproxPathsLemma by auto \n      qed\n      hence \"\\<And>tree . tree \\<in> fset (\\<Psi>\\<^sub>\\<phi> originalForest) \\<Longrightarrow> (\\<forall>p\\<in>pathsInTree tree. pathSatisfiesApproximatorForRuleSet p (\\<R> i) i)\" using notin_fset by metis\n      then show \"fset (\\<Psi>\\<^sub>\\<phi> originalForest) \\<subseteq> {tr. \\<forall>p\\<in>pathsInTree tr. pathSatisfiesApproximatorForRuleSet p (\\<R> i) i}\" by auto\n    qed                    \n    then show \"fset y \\<subseteq> (\\<P>\\<^sub>1 \\<R> i)\" using n6587 by auto\n  qed\n  hence \"\\<And>i . x \\<in> (\\<P>\\<^sub>1 \\<R> i)\" using b1 notin_fset by fastforce\n  hence n654e76 : \"x \\<in> \\<P> \\<R>\" using \\<P>\\<^sub>1_def \\<P>_def by blast\n      \n  from b2 b1 \\<Z>\\<^sub>\\<phi>_def restrictionIsFiniteForests have \"height x \\<le> n\"    using b3 heightForestBounded_def by auto \n  then show \"x |\\<in>| (\\<ff> n  \\<R>)\" using \\<ff>_def \\<Z>\\<^sub>\\<tau>_def restrictionIsFinite restrictionIsFinite2 notin_fset n654e76        by (simp add: finterI) \nqed\n  \n      \n  \n  \n    (* ========================================================================================== *)\nlemma langRuleToState:\n  fixes rule :: \"(stt,abc) rule\"\n  assumes   \"  state = transition (\\<A> i) (states rule) (symbol rule)\"\n  assumes \" x \\<in> \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\" \n  shows \"x \\<in> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) state\"\nproof (simp add: forest_language_for_state_def)\n  show \"(\\<forall>tree. tree |\\<in>| x \\<longrightarrow> evaluation (\\<A> i) tree = state) \\<and> (\\<exists>tree. tree |\\<in>| x)\"\n  proof\n    show  \"\\<forall> tree.(tree|\\<in>|x \\<longrightarrow> evaluation (\\<A> i) tree = state)\"\n    proof \n      fix tree\n      show \"tree|\\<in>|x \\<longrightarrow> evaluation (\\<A> i) tree = state\"\n      proof\n        assume \"tree|\\<in>|x\"\n        then have \"tree_for_rule (\\<A> i) rule tree\" using  forest_language_for_rule_def assms(2) by auto\n        then have \"((root tree = symbol rule) \\<and> ((fimage (((evaluation (\\<A> i)))) (childrenSet tree)) = states rule))\" using tree_for_rule_def by metis\n        then   have n768 : \"(fimage (evaluation (\\<A> i)) (childrenSet tree)) = (states rule)\" and ny568 : \"(root tree = symbol rule)\" by auto\n        show \"evaluation (\\<A> i) tree = state\" \n        proof (simp add: evaluation_def) \n          have \"(((transition (\\<A> i)) (fimage (evaluation (\\<A> i)) (childrenSet tree))) ( symbol rule)) = state\" using n768 assms(1) by auto\n          then  have \"(((transition (\\<A> i)) (fimage (evaluation (\\<A> i)) (childrenSet tree))) ( symbol rule)) = state\" using n768 assms(1) by auto\n          then  have \"(((transition (\\<A> i)) (fimage (evaluation (\\<A> i)) (childrenSet tree))) ( root tree)) = state\" using n768 assms(1)ny568 by auto\n          then show \"rec_tree (\\<lambda>symbol1 fset2 automaton. transition automaton ((\\<lambda>uu. \\<pi>\\<^sup>2 uu automaton) |`| fset2) symbol1) tree (\\<A> i) = state\" using   childrenSet.elims root.elims evaluation_def by (metis evaluation.simps root.simps)\n        qed\n      qed\n    qed\n    show \"(\\<exists> tree. tree |\\<in>| x)\" using forest_language_for_rule_def assms(2) by auto\n  qed\nqed\n  \n  \n    \n      \nlemma psiRulesStatesLemma21 :\n  assumes allRulesAreInRuleSet : \"\\<And>rule . rule |\\<in>| rule_set (\\<A> i)\"\n  shows \"  (\\<Uplus> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`|  (stateSetFromRuleSet (\\<W> n k \\<R> i)))) = (\\<Uplus> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((\\<Union>| (rulesForState i |`| (stateSetFromRuleSet (\\<W> n k \\<R> i))))))) \"\nproof\n  show \"\\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<W> n k \\<R> i)) \\<subseteq> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i)))\"\n  proof \n    fix x\n    assume n798 : \"x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<W> n k \\<R> i))\"\n      \n      \n    have \"(\\<And>tr . tr |\\<in>| x \\<Longrightarrow> (\\<exists> lang . lang |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i))) \\<and> (\\<exists> (subforest ) . (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| x \\<and> subforest \\<in> lang))))\"\n    proof -\n      fix tree\n      assume \"tree|\\<in>|x\"\n      then obtain state where n76689 : \"tree \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<sigma> (\\<A> i) state\" and \"state |\\<in>| stateSetFromRuleSet (\\<W> n k \\<R> i)\" using n798 biguplusForests_def     by (smt fimageE forest_language_for_state_def language_for_state_def mem_Collect_eq)  \n          \n      from n76689 have n655t898 : \"(((transition (\\<A> i)) (fimage (evaluation (\\<A> i)) (childrenSet tree))) (root tree)) = state\" using evaluation_def  childrenSet.simps evaluation.simps root.elims\n      proof -\n        have f1: \"evaluation (\\<A> i) tree = state\"\n          using language_for_state_def n76689 by force\n        have \"\\<forall>t. \\<exists>f. NODE (root t::abc) f = t\"\n          by (metis (full_types) root.elims)\n        then obtain ff :: \"abc tree \\<Rightarrow> abc tree fset\" where\n          f2: \"\\<And>t. NODE (root t) (ff t) = t\"\n          by moura\n        then have \"evaluation (\\<A> i) (NODE (root tree) (ff tree)) = state\"\n          using f1 by (metis (lifting))\n        then show ?thesis\n          using f2 by (metis childrenSet.simps evaluation.simps)\n      qed \n      obtain rule  where n78789 : \"states (rule :: (stt,abc) rule) = (fimage (evaluation (\\<A> i)) (childrenSet tree))\" and n5498 : \"symbol rule = root tree\"        by (meson rule.select_convs(1) rule.select_convs(2)) \n      then have n766798 : \"tree \\<in>  \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule\" using language_for_rule_def tree_for_rule_def  using n655t898 by (simp add: language_for_rule_def tree_for_rule_def) \n          \n      have \"rule |\\<in>| (rule_set (\\<A> i))\" using allRulesAreInRuleSet by auto\n      then have \"rule |\\<in>| (ffilter (\\<lambda>r. transition (\\<A> i) (states r) (symbol r) = state) (rule_set (\\<A> i)))\" using n655t898 n78789 n5498 by simp\n      then have \"rule |\\<in>| (rulesForState i state)\"  using rulesForState_def by auto\n      def lang == \"\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\"\n      have \"rule |\\<in>| (\\<Union>|  (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i)))\" using \\<open>rule |\\<in>| rulesForState i state\\<close> \\<open>state |\\<in>| stateSetFromRuleSet (\\<W> n k \\<R> i)\\<close> by auto \n      def subforest == \"(finsert tree fempty)\"\n      have \"lang |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i)))\" using \\<open>rule |\\<in>| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i))\\<close> lang_def by auto \n      have \"(tree |\\<in>| subforest)\" by (simp add: subforest_def) \n      have \"subforest |\\<subseteq>| x\" by (simp add: \\<open>tree |\\<in>| x\\<close> subforest_def) \n      have \"subforest \\<in> lang\"  using lang_def subforest_def n766798 singletonLanguage by auto \n      have \"(lang |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i))) \\<and> ( (tree |\\<in>| subforest \\<and> subforest |\\<subseteq>| x \\<and> subforest \\<in> lang)))\"\n        by (simp add: \\<open>lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i))\\<close> \\<open>subforest \\<in> lang\\<close> \\<open>subforest |\\<subseteq>| x\\<close> \\<open>tree |\\<in>| subforest\\<close>) \n      then   show \"(\\<exists> lang . lang |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i))) \\<and> (\\<exists> (subforest ) . (tree |\\<in>| subforest \\<and> subforest |\\<subseteq>| x \\<and> subforest \\<in> lang)))\" by auto\n    qed\n    then show \"x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i))) \" using biguplusForests_def by blast \n  qed\n    \n  show \"\\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i))) \\<subseteq> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<W> n k \\<R> i))\"\n  proof\n    fix x\n    assume n65y87 : \" x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i)))\"\n      \n    have \"(\\<And> (tr ) . tr |\\<in>| x \\<longrightarrow> (\\<exists> lang . lang |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<W> n k \\<R> i)) \\<and> (\\<exists> (subforest) . (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| x \\<and> subforest \\<in> lang)))) \"\n    proof\n      fix tr\n      assume n5488976 : \" tr |\\<in>| x\"\n      from n65y87 n5488976 biguplusForests_def  have \"((\\<exists> lang . lang |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i))) \\<and> (\\<exists> (subforest) . (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| x \\<and> subforest \\<in> lang)))) \" by (simp add: biguplusForests_def) \n      then obtain rule lang subforest where n798776 : \"lang = \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\" and n767897 : \"rule |\\<in>| (\\<Union>| (rulesForState i |`| stateSetFromRuleSet (\\<W> n k \\<R> i)))\" and \"tr |\\<in>| subforest\" and  \"subforest |\\<subseteq>| x\" and n767987 : \"subforest \\<in> lang\" by blast\n       def state == \"transition (\\<A> i) (states rule) (symbol rule)\"\n      then have \"rule |\\<in>| rulesForState i state\" using rulesForState_def  using n767897 by auto \n      then have n6587 : \"state |\\<in>| stateSetFromRuleSet (\\<W> n k \\<R> i)\" using    n767897 by (simp add: fimageE rulesForState_def) \n      def lang2 == \"\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) state\"\n      have \"lang2 |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<W> n k \\<R> i))\" using lang2_def n6587 fimageI by auto\n      from n767987 state_def lang2_def forest_language_for_rule_def forest_language_for_state_def evaluation_def tree_for_rule_def n798776 langRuleToState have \"subforest \\<in> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) state\" by auto\n      then have \"( lang2 |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<W> n k \\<R> i)) \\<and> ( (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| x \\<and> subforest \\<in> lang2)))\"\n        using \\<open>lang2 |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<W> n k \\<R> i)\\<close> \\<open>subforest |\\<subseteq>| x\\<close> \\<open>tr |\\<in>| subforest\\<close> lang2_def by auto \n      then show \"(\\<exists> lang . lang |\\<in>| (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<W> n k \\<R> i)) \\<and> (\\<exists> (subforest) . (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| x \\<and> subforest \\<in> lang)))\" by auto\n    qed\n    then show \" x \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<W> n k \\<R> i))\" using biguplusForests_def by blast\n  qed\nqed\n  \n    \n    \n    \n    \n    \nlemma psiRulesStatesLemma2:\n  assumes allRulesAreInRuleSet : \"\\<And>i rule . rule |\\<in>| rule_set (\\<A> i)\"\n  shows \"\\<And>i . ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`|  (stateSetFromRuleSet (\\<W> n k \\<R> i))))))) = (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((\\<Union>| (rulesForState i |`| (stateSetFromRuleSet (\\<W> n k \\<R> i))))))))) \"\n  using psiRulesStatesLemma21 assms by auto\n \n    \n\n    \nlemma psiRulesStatesLemma1:\n  fixes \\<R>\n  fixes \\<alpha>\n  assumes \"\\<And> \\<ii> rule . rule |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow> symbol rule = \\<alpha>\"\n  assumes \"\\<And>i. \\<exists> rule . rule |\\<in>| \\<R> i\"\n  shows \" ((\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2))))) =\n(  factorByRootSymbolF \\<alpha> ) `   (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2) ))\"\nproof \n  show \"\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2))) \\<subseteq> op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" \n  proof\n    fix x\n    assume n678 : \"x \\<in> \\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))\"\n    then have \"x \\<in> (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))\"  using \\<Z>\\<^sub>\\<phi>\\<^sub>F_subset by blast \n    then have \"\\<And> i . x \\<in> ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i)))))))\" using dist_intersectionLanguageOplus_def  by (metis (full_types) IntE aut_def ot.exhaust)\n    then have \"\\<And>i . \\<exists> original . x = \\<Psi>\\<^sub>\\<phi> original \\<and> original \\<in> (\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i))))\"              by blast\n    then have \"\\<And>i . \\<exists> original . x = \\<Psi>\\<^sub>\\<phi> original \\<and> original \\<in> (\\<Uplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i)))) \\<and>(\\<forall> lang. lang |\\<in>| (( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i)))) \\<longrightarrow> (\\<exists> subforest . (subforest \\<in> lang \\<and> subforest |\\<subseteq>| original)))\" using bigoplusForests_def by blast\n    then have n6587a : \"\\<And>i . \\<exists> original . x = \\<Psi>\\<^sub>\\<phi> original \\<and> original \\<in> (\\<Uplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i)))) \\<and> (\\<forall> state. (state |\\<in>| stateSetFromRuleSet (\\<R> i)) \\<longrightarrow> (\\<exists> subforest . (subforest \\<in> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) state) \\<and> subforest |\\<subseteq>| original)))\" using bigoplusForests_def          by (metis (no_types, hide_lams) fimage_eqI) \n    def isGoodOriginal == \"\\<lambda> i original . x = \\<Psi>\\<^sub>\\<phi> original \\<and> original \\<in> (\\<Uplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i)))) \\<and> (\\<forall> state. (state |\\<in>| stateSetFromRuleSet (\\<R> i)) \\<longrightarrow> (\\<exists> subforest . (subforest \\<in> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) state) \\<and> subforest |\\<subseteq>| original)))\"\n    from n6587a isGoodOriginal_def have n576897 : \"\\<And>i . \\<exists> original .(isGoodOriginal i original)\" by auto\n    def originals == \"\\<lambda> i. (SOME original.   (isGoodOriginal i original))\"\n    from n576897 originals_def  have n5687 : \"\\<And>i . (isGoodOriginal i (originals i))\"  by (simp add: someI_ex)\n    from n5687 isGoodOriginal_def have n6587 : \"\\<And>i . x = \\<Psi>\\<^sub>\\<phi> (originals i) \\<and> (originals i) \\<in> (\\<Uplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i)))) \\<and> (\\<forall> state. (state |\\<in>| stateSetFromRuleSet (\\<R> i)) \\<longrightarrow> (\\<exists> subforest . (subforest \\<in> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) state) \\<and> subforest |\\<subseteq>| (originals i))))\" by auto\n    show \" x \\<in> op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\"\n    proof -\n      have n7687 : \"\\<And> i rule . rule |\\<in>| (\\<R> i) \\<Longrightarrow> (NODE \\<alpha> (ffilter (\\<lambda> (tree :: abc tree). (\\<exists> state. state |\\<in>| ( states rule) \\<and> evaluation (\\<A> i) tree = state)) (originals i))) \\<in> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule)\"\n      proof -\n        fix i\n        def original == \"(originals i)\"\n        from original_def n6587 have n766897 : \"x = \\<Psi>\\<^sub>\\<phi> original \\<and> original \\<in> (\\<Uplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i)))) \\<and> (\\<forall> state. (state |\\<in>| stateSetFromRuleSet (\\<R> i)) \\<longrightarrow> (\\<exists> subforest . (subforest \\<in> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) state) \\<and> subforest |\\<subseteq>| original)))\" by blast\n        hence n1 : \"x = \\<Psi>\\<^sub>\\<phi> original\" and n2 : \"original \\<in> (\\<Uplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i))))\" and n3 : \"(\\<forall> state. (state |\\<in>| stateSetFromRuleSet (\\<R> i)) \\<longrightarrow> (\\<exists> subforest . (subforest \\<in> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) state) \\<and> subforest |\\<subseteq>| original)))\" by auto\n        fix rule\n        assume n7687 : \"rule |\\<in>| (\\<R> i)\"\n        def treesForStates  == \"ffilter (\\<lambda> (tree :: abc tree). (\\<exists> state. state |\\<in>| ( states rule) \\<and> evaluation (\\<A> i) tree = state)) original\"\n        def newTree == \"(NODE \\<alpha> treesForStates)\"\n        have \"newTree \\<in> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule)\" using treesForStates_def newTree_def\n        proof (simp add:  language_for_rule_def)\n          show \" tree_for_rule (\\<A> i) rule (NODE \\<alpha> (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>|  states rule) original))\"\n          proof (simp add : tree_for_rule_def)\n            show \"\\<alpha> = symbol rule \\<and> evaluation (\\<A> i) |`| ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>|  states rule) original = states rule\"\n            proof\n              show \"\\<alpha> = symbol rule\" using assms(1) n7687 by auto\n              show \" evaluation (\\<A> i) |`| ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>|  states rule) original = states rule\" \n              proof\n                show \"states rule |\\<subseteq>| evaluation (\\<A> i) |`| ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>|  states rule) original\" \n                proof\n                  fix x\n                  assume \"x |\\<in>| states rule\"\n                  then have \"x |\\<in>| stateSetFromRuleSet (\\<R> i)\" using stateSetFromRuleSet_def n7687\n                  proof -\n                    have \"states rule |\\<in>| states |`| \\<R> i\"   using n7687 by blast\n                    then have \"x |\\<in>| \\<Union>| (states |`| \\<R> i)\"   using \\<open>x |\\<in>| states rule\\<close> by blast\n                    then show ?thesis  by (metis stateSetFromRuleSet_def)\n                  qed \n                  then obtain subforest where n7y687 : \"subforest \\<in> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) x) \\<and> subforest |\\<subseteq>| original\"   using n3 by auto\n                  then obtain tree where nu668i7 : \"tree |\\<in>| subforest\" using forest_language_for_state_def                          by fastforce \n                  then have \"evaluation (\\<A> i) tree = x\" using n7y687 forest_language_for_state_def                             by (simp add: forest_language_for_state_def)   \n                  then show \"x |\\<in>| evaluation (\\<A> i) |`| ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) original\" using n7y687                                using \\<open>x |\\<in>| states rule\\<close> nu668i7 by auto \n                qed\n                show \"evaluation (\\<A> i) |`| ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>|  states rule) original |\\<subseteq>| states rule\" by auto\n              qed\n            qed\n          qed\n        qed\n        then   show \"NODE \\<alpha> (ffilter (\\<lambda>tree. \\<exists>state. state |\\<in>| states rule \\<and> evaluation (\\<A> i) tree = state) original) \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule\"  using newTree_def treesForStates_def by auto\n      qed\n      def newForests == \"(\\<lambda> i . ( \\<lambda> rule. (NODE \\<alpha> (ffilter (\\<lambda> (tree :: abc tree). (\\<exists> state. state |\\<in>| ( states rule) \\<and> evaluation (\\<A> i) tree = state)) (originals i)))) |`| (\\<R> i))\"\n      have n6568i7 : \"\\<And>i . (newForests i) \\<in> ( (((\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho>  (\\<A> i) ) |`| (\\<R> i)))))) \"\n      proof (simp add : bigoplusForests_def)\n        fix i\n        show \"(newForests i) \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \\<and> (\\<forall>lang. lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i \\<longrightarrow> (\\<exists>subforest. subforest \\<in> lang \\<and> subforest |\\<subseteq>| (newForests i)))\"\n        proof\n          show \"(newForests i) \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)\" \n          proof (simp add : biguplusForests_def)\n            show \" \\<forall>tr. tr |\\<in>| (newForests i) \\<longrightarrow> (\\<exists>lang. lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i \\<and> (\\<exists>subforest. tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| (newForests i) \\<and> subforest \\<in> lang))\"\n            proof\n              fix tr\n              show \"tr |\\<in>| (newForests i) \\<longrightarrow> (\\<exists>lang. lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i \\<and> (\\<exists>subforest. tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| (newForests i) \\<and> subforest \\<in> lang))\"\n              proof\n                assume \"tr |\\<in>| (newForests i)\" \n                from newForests_def obtain rule where \"rule |\\<in>| (\\<R> i)\" and n7897 : \"tr = (NODE \\<alpha> (ffilter (\\<lambda> (tree :: abc tree). (\\<exists> state. state |\\<in>| ( states rule) \\<and> evaluation (\\<A> i) tree = state)) (originals i)))\"\n                  using \\<open>tr |\\<in>| (newForests i)\\<close> by blast \n                def lang == \"\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\"\n                then have \"lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i\"\n                  by (simp add: \\<open>rule |\\<in>| \\<R> i\\<close>) \n                def subforest == \"finsert tr fempty\"\n                from subforest_def have \"tr |\\<in>| subforest\"\n                  by auto \n                from subforest_def newForests_def   have \"subforest |\\<subseteq>| (newForests i)\"\n                  using \\<open>tr |\\<in>| (newForests i)\\<close> by blast \n                from subforest_def n7687 lang_def n7897 have \"subforest \\<in> lang\"\n                  by (simp add: \\<open>rule |\\<in>| \\<R> i\\<close> singletonLanguage) \n                then show \"(\\<exists>lang. lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i \\<and> (\\<exists>subforest. tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| (newForests i) \\<and> subforest \\<in> lang))\"\n                  using \\<open>lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i\\<close> \\<open>subforest |\\<subseteq>| (newForests i)\\<close> \\<open>tr |\\<in>| subforest\\<close> by blast \n              qed\n            qed\n          qed\n          show \" \\<forall>lang. lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i \\<longrightarrow> (\\<exists>subforest. subforest \\<in> lang \\<and> subforest |\\<subseteq>| (newForests i))\"\n          proof\n            fix lang\n            show \"lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i \\<longrightarrow> (\\<exists>subforest. subforest \\<in> lang \\<and> subforest |\\<subseteq>| (newForests i))\"\n            proof\n              assume \"lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i\"\n              then obtain rule where n7656876 : \"rule |\\<in>| \\<R> i\" and \"lang = \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\" by auto\n              show \"\\<exists>subforest. subforest \\<in> lang \\<and> subforest |\\<subseteq>| (newForests i)\"\n              proof -\n                def subforest == \"(finsert (NODE \\<alpha> (ffilter (\\<lambda> (tree :: abc tree). (\\<exists> state. state |\\<in>| ( states rule) \\<and> evaluation (\\<A> i) tree = state)) (originals i))) fempty) \"\n                have \"subforest \\<in> lang \\<and> subforest |\\<subseteq>| (newForests i)\"\n                proof\n                  show \"subforest \\<in> lang\"\n                    using \\<open>\\<And>rule. rule |\\<in>| \\<R> i \\<Longrightarrow> NODE \\<alpha> (ffilter (\\<lambda>tree. \\<exists>state. state |\\<in>| states rule \\<and> evaluation (\\<A> i) tree = state) (originals i)) \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) rule\\<close> \\<open>lang = \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\\<close> \\<open>rule |\\<in>| \\<R> i\\<close> singletonLanguage subforest_def by auto \n                  show \"subforest |\\<subseteq>| (newForests i)\" \n                  proof\n                    fix x\n                    assume \"x |\\<in>| subforest\"\n                    then have \"x = (NODE \\<alpha> (ffilter (\\<lambda> (tree :: abc tree). (\\<exists> state. state |\\<in>| ( states rule) \\<and> evaluation (\\<A> i) tree = state)) (originals i)))\" using subforest_def                            by blast \n                    then show \"x |\\<in>| (newForests i)\" using  newForests_def n7656876 by auto\n                  qed\n                qed\n                then show \"\\<exists>subforest. subforest \\<in> lang \\<and> subforest |\\<subseteq>| (newForests i)\" by auto\n              qed\n            qed\n          qed\n        qed\n      qed\n      then have \"\\<And>i . ((\\<lambda> rule. (NODE \\<alpha> (ffilter (\\<lambda> (tree :: abc tree). (\\<exists> state. state |\\<in>| ( states rule) \\<and> evaluation (\\<A> i) tree = state)) (originals i)))) |`| (\\<R> i)) \\<in> ( (((\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho>  (\\<A> i) ) |`| (\\<R> i)))))) \" \n        using newForests_def by auto\n      have n65987 : \"\\<And>i . psiF (newForests i) = (finsert (NODE \\<alpha> x) fempty)\"\n      proof -\n        fix i\n        from n6587 have n6545877 : \"x = \\<Psi>\\<^sub>\\<phi> (originals i)\" by auto\n        from n6587 have \"(originals i) \\<in> (\\<Uplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i))))\" by auto\n        from n6587 have \"(\\<forall> state. (state |\\<in>| stateSetFromRuleSet (\\<R> i)) \\<longrightarrow> (\\<exists> subforest . (subforest \\<in> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) state) \\<and> subforest |\\<subseteq>| (originals i))))\" by auto\n            \n        from n6545877 psiF_def have   n767897 :    \"x = fimage (\\<lambda> symbol2 .\n                              psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 (originals i))))\n                                  )\n                              )\n                              (fimage root (originals i))\" by auto\n        \n        from n6545877 have \"x = fimage (\\<lambda> symbol2 .\n                              psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 (originals i))))\n                                  )\n                              )\n                              (fimage root (originals i))\" using psiF_def by auto\n        then have \"(finsert (NODE \\<alpha> x) fempty) = (finsert (NODE \\<alpha> (fimage (\\<lambda> symbol2 .\n                              psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 (originals i))))\n                                  )\n                              )\n                              (fimage root (originals i)))) fempty)\" by auto\n        have n6768998 : \"psiF (newForests i) = fimage (\\<lambda> symbol2 .\n                              psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 (newForests i))))\n                                  )\n                              )\n                              (fimage root (newForests i))\" using psiF_def  by auto\n        have n6557 : \"\\<And> tr . tr |\\<in>| (newForests i) \\<Longrightarrow> root tr = \\<alpha>\" using newForests_def by auto\n        have n5445786 : \" (fimage root (newForests i)) = (finsert \\<alpha> fempty)\" proof\n          \n          from n6557 show \" root |`| (newForests i) |\\<subseteq>| {|\\<alpha>|}\" by auto\n          have \"\\<exists> tr . tr |\\<in>| (newForests i) \\<and> root tr = \\<alpha>\" \n          proof (simp add : newForests_def)\n            have \"\\<exists> rule . rule |\\<in>| \\<R> i\" using assms(2) by auto\n            then show \"\\<exists>tr. tr |\\<in>| (\\<lambda>rule. NODE \\<alpha> (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) (originals i))) |`| \\<R> i \\<and> root tr = \\<alpha>\" by auto\n          qed\n          then show \" {|\\<alpha>|} |\\<subseteq>| root |`| (newForests i)\" by auto\n        qed\n        from n6768998 n5445786 have \"psiF (newForests i) = (finsert (psi (NODE \\<alpha> (\\<Union>| (fimage childrenSet (childrenWithSymbol \\<alpha> (newForests i)))))) fempty)\" by auto\n        have n65876 :  \"(childrenWithSymbol \\<alpha> (newForests i)) = (newForests i)\" \n        proof (simp add : childrenWithSymbol_def)\n          show \"inf_fset2 (newForests i) {child1. root child1 = \\<alpha>} = (newForests i)\"\n          proof\n            show \"inf_fset2 (newForests i) {child1. root child1 = \\<alpha>} |\\<subseteq>| (newForests i)\"\n              by (simp add: finter_lower1) \n            show \"(newForests i) |\\<subseteq>| inf_fset2 (newForests i) {child1. root child1 = \\<alpha>} \" using n6557\n              by (simp add: finterI fsubsetI) \n          qed\n        qed\n        have n65787 : \"\\<Union>| (fimage childrenSet (newForests i)) = (originals i)\"\n        proof (simp add : newForests_def)\n          show \"\\<Union>| ((childrenSet \\<circ> (\\<lambda>rule. NODE \\<alpha> (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) (originals i)))) |`| \\<R> i) = (originals i)\"\n          proof \n            show \" \\<Union>| ((childrenSet \\<circ> (\\<lambda>rule. NODE \\<alpha> (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) (originals i)))) |`| \\<R> i) |\\<subseteq>| (originals i)\"\n            proof\n              show \"\\<And>x. x |\\<in>| \\<Union>| ((childrenSet \\<circ> (\\<lambda>rule. NODE \\<alpha> (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) (originals i)))) |`| \\<R> i) \\<Longrightarrow> x |\\<in>| originals i\"\n              proof -\n                fix x\n                assume \"x |\\<in>| \\<Union>| ((childrenSet \\<circ> (\\<lambda>rule. NODE \\<alpha> (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) (originals i)))) |`| \\<R> i)\"\n                then obtain rule where \"rule |\\<in>| \\<R> i\" and \"x |\\<in>| ((childrenSet \\<circ> (\\<lambda>rule. NODE \\<alpha> (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) (originals i))))) rule\" by auto\n                then have \"x |\\<in>| ((childrenSet(  (NODE \\<alpha> (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) (originals i))))))\" by auto\n                then have \"x |\\<in>|                (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) (originals i))\" by auto\n                then show \"x |\\<in>| originals i\" by auto\n                qed\n              qed\n            show \" (originals i) |\\<subseteq>| \\<Union>| ((childrenSet \\<circ> (\\<lambda>rule. NODE \\<alpha> (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) (originals i)))) |`| \\<R> i)\" \n            proof\n              fix x\n              assume n6787 : \"x |\\<in>| (originals i)\"\n              show \" x |\\<in>| \\<Union>| ((childrenSet \\<circ> (\\<lambda>rule. NODE \\<alpha> (ffilter (\\<lambda>tree. evaluation (\\<A> i) tree |\\<in>| states rule) (originals i)))) |`| \\<R> i) \"\n              proof                    (simp add : ffUnionLemma)\n                \n                show \"x |\\<in>| (originals i) \\<and> fBex (\\<R> i) (\\<lambda>rule. evaluation (\\<A> i) x |\\<in>| states rule)\"\n                proof              \n                  from n6787 show \"x |\\<in>| (originals i)\" by auto\n                  from n6587 have \" (originals i) \\<in> (\\<Uplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i))))\" by auto \n                  hence \"\\<exists> lang . lang |\\<in>| ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i))) \\<and> (\\<exists> (subforest ) . (x |\\<in>| subforest \\<and> subforest |\\<subseteq>| (originals i) \\<and> subforest \\<in> lang))\" using n6787 biguplusForests_def by blast\n                  then obtain lang where n76767987 : \" lang |\\<in>| ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`| (stateSetFromRuleSet (\\<R> i))) \\<and> (\\<exists> (subforest ) . (x |\\<in>| subforest \\<and> subforest |\\<subseteq>| (originals i) \\<and> subforest \\<in> lang))\" by auto\n                  then obtain rule state where \"lang = \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) state\" and \"state |\\<in>| states rule\" and \"rule |\\<in>| (\\<R> i)\" using stateSetFromRuleSet_def\n                    by (metis (no_types, lifting) fimageE n67789564) \n                  hence \"evaluation (\\<A> i) x = state\" using forest_language_for_state_def n76767987   by (smt mem_Collect_eq) \n                  then show \"fBex (\\<R> i) (\\<lambda>rule. evaluation (\\<A> i) x |\\<in>| states rule)\"    using \\<open>rule |\\<in>| \\<R> i\\<close> \\<open>state |\\<in>| states rule\\<close> by auto \n                qed\n              qed\n            qed\n          qed\n        qed\n        have \"(psi (NODE \\<alpha> (originals i))) = (NODE \\<alpha> (fimage (\\<lambda> symbol2 .\n                              psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 (originals i))))\n                                  )\n                              )\n                              (fimage root (originals i))))\" using psiDef          by blast \n        hence \"(psi (NODE \\<alpha> (\\<Union>| (fimage childrenSet (newForests i))))) = (NODE \\<alpha> (fimage (\\<lambda> symbol2 .\n                              psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 (originals i))))\n                                  )\n                              )\n                              (fimage root (originals i))))\" using n65787 by auto\n        hence \"(psi (NODE \\<alpha> (\\<Union>| (fimage childrenSet (childrenWithSymbol \\<alpha>  (newForests i)))))) = (NODE \\<alpha> (fimage (\\<lambda> symbol2 .\n                              psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 (originals i))))\n                                  )\n                              )\n                              (fimage root (originals i))))\" using n65876 by auto\n        hence \"(finsert (psi (NODE \\<alpha> (\\<Union>| (fimage childrenSet (childrenWithSymbol \\<alpha>  (newForests i)))))) fempty) = (finsert (NODE \\<alpha> (fimage (\\<lambda> symbol2 .\n                              psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 (originals i))))\n                                  )\n                              )\n                              (fimage root (originals i)))) fempty)\" by auto\n        then show \"psiF (newForests i) = (finsert (NODE \\<alpha> x) fempty)\"  by (simp add: \\<open>\\<Psi>\\<^sub>\\<phi> (newForests i) = {|psi (NODE \\<alpha> (\\<Union>| (childrenSet |`| childrenWithSymbol \\<alpha> (newForests i))))|}\\<close> n767897)  \n      qed\n      then have \"\\<And>i .x = \\<alpha> \\<diamondop> \\<Psi>\\<^sub>\\<phi> (newForests i)\"\n      proof (simp add : factorByRootSymbolF_lemma)\n        have \"fset x = {t. ((t |\\<in>| x))}\"\n        proof\n          show \"fset x \\<subseteq> {t. t |\\<in>| x}\" using notin_fset\n            by fastforce \n          show \"{t. t |\\<in>| x} \\<subseteq> fset x\"  using notin_fset\n            by fastforce\n        qed\n          \n        hence \"fset x = {t. ((root (NODE \\<alpha> x) = \\<alpha> \\<and> t |\\<in>| childrenSet (NODE \\<alpha> x)))}\" using root.simps childrenSet.simps by auto\n        hence \"fset x = {t. (\\<exists>tree. tree = (NODE \\<alpha> x) \\<and> (root tree = \\<alpha> \\<and> t |\\<in>| childrenSet tree))}\" by auto\n        hence \"fset x = {t. (\\<exists>tree. tree |\\<in>| {|NODE \\<alpha> x|} \\<and> (root tree = \\<alpha> \\<and> t |\\<in>| childrenSet tree))}\" by auto\n            \n        then show \"x = \\<alpha> \\<diamondop> {|NODE \\<alpha> x|}\" using factorByRootSymbolF_lemma factorByRootSymbol_def by auto\n      qed\n        \n        \n      have \"{|NODE \\<alpha> x|} \\<in> \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\"\n      proof (simp add : \\<Z>\\<^sub>\\<phi>\\<Z>\\<^sub>\\<phi>\\<^sub>Flemma \\<Z>\\<^sub>\\<phi>_def notin_fset)\n        have \"{|NODE \\<alpha> x|} \\<in> fset (boundedForests (Suc n))\" \n        proof (simp add : restrictionIsFiniteForests)\n          have \"\\<And> tr . tr |\\<in>| x \\<Longrightarrow> height tr \\<le> n\"\n            using \\<Z>\\<^sub>\\<phi>\\<^sub>F_def n678 by auto \n          then show \"maxFset (height |`| x) \\<le> n\"     by (metis (mono_tags, lifting) fimageE finiteMaxExists(2) finiteMaxExists(3) le_0_eq nat_le_linear) \n          then have \"{|NODE \\<alpha> x|} |\\<in>| (boundedForests (Suc n))\" using heightSingleton by auto\n          have \"{|NODE \\<alpha> x|} \\<in> (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" \n          proof (simp add : dist_intersectionLanguageOplusRules_def)\n            show \"{|NODE \\<alpha> x|} \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1 |`| \\<R> \\<aa>\\<^sub>1) \\<and> {|NODE \\<alpha> x|} \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2 |`| \\<R> \\<aa>\\<^sub>2)\"\n            proof\n              have n65576 : \"\\<And>i . ( {|NODE \\<alpha> x|} \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i))\"\n              proof \n                fix i\n                from n65987 show \"{|NODE \\<alpha> x|} = \\<Psi>\\<^sub>\\<phi> (newForests i)\" by auto\n                show \"(newForests i) \\<in> \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)\"  by (simp add: n6568i7) \n              qed\n              from n65576  show \"{|NODE \\<alpha> x|} \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1 |`| \\<R> \\<aa>\\<^sub>1)\"                by (metis aut_def)  \n              from n65576 show \"{|NODE \\<alpha> x|} \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2 |`| \\<R> \\<aa>\\<^sub>2)\"                  by (metis aut_def)\n            qed\n          qed\n        qed\n        show \"{|NODE \\<alpha> x|} \\<in> fset (inf_fset2 (boundedForests (Suc n)) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))\"\n          by (metis (no_types, lifting) IntI \\<open>\\<And>i. (\\<lambda>rule. NODE \\<alpha> (ffilter (\\<lambda>tree. \\<exists>state. state |\\<in>| states rule \\<and> evaluation (\\<A> i) tree = state) (originals i))) |`| \\<R> i \\<in> \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)\\<close> \\<open>{|NODE \\<alpha> x|} \\<in> fset (boundedForests (Suc n))\\<close> aut_def dist_intersectionLanguageOplusRules_def finterI image_eqI n65987 newForests_def notin_fset) \n      qed\n        \n      have \" x = \\<alpha> \\<diamondop> {|NODE \\<alpha> x|}\"\n      proof -\n        have n7656876 : \"\\<And>a. ((a |\\<in>| \\<alpha> \\<diamondop> {|NODE \\<alpha> x|}) = (a \\<in> factorByRootSymbol \\<alpha> (fset {|NODE \\<alpha> x|})))\" using factorByRootSymbolF_lemma by auto\n        have a1 : \"(NODE \\<alpha> x) \\<in> (fset {|NODE \\<alpha> x|})\" by auto\n        have a2 : \"root (NODE \\<alpha> x) = \\<alpha>\" by auto\n        have a3 : \"x = (childrenSet (NODE \\<alpha> x))\" by auto\n        from a1 a2 a3 have \"\\<And>a. ((a |\\<in>| x) = (a \\<in> factorByRootSymbol \\<alpha> (fset {|NODE \\<alpha> x|})))\" using factorByRootSymbol_def by auto\n        then show \" x = \\<alpha> \\<diamondop> {|NODE \\<alpha> x|}\" using n7656876 by auto\n      qed\n      show \"x \\<in> op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" using \\<open>x = \\<alpha> \\<diamondop> {|NODE \\<alpha> x|}\\<close> \\<open>{|NODE \\<alpha> x|} \\<in> \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\\<close> by auto\n    qed\n      \n  qed\n  show \"op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)) \\<subseteq> \\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))\" \n  proof \n    show \"\\<And>x. x \\<in> op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)) \\<Longrightarrow> x \\<in> \\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))\"\n    proof -\n      fix x\n      assume \"x \\<in> op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\"\n      then obtain forest where n75656876 : \"forest \\<in> \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" and n5466876 : \"x = \\<alpha> \\<diamondop> forest\" by auto\n      hence n6578i7 : \"fset x = {t. (\\<exists>tree. tree  |\\<in>| forest \\<and> (root tree = \\<alpha> \\<and> t |\\<in>| childrenSet tree))}\"   by (smt Collect_cong factorByRootSymbolF_lemma(2) factorByRootSymbol_def notin_fset)  \n          \n      show \"x \\<in> \\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))\" \n      proof (simp add : \\<Z>\\<^sub>\\<phi>\\<Z>\\<^sub>\\<phi>\\<^sub>Flemma \\<Z>\\<^sub>\\<phi>_def notin_fset)\n        \n        have u1 : \"x |\\<in>| (boundedForests n)\"\n        proof -\n          have \"\\<And>tr . tr |\\<in>| x \\<Longrightarrow> height tr \\<le> n\"\n          proof -\n            fix tr\n            assume \"tr |\\<in>| x\"\n            then obtain t where \"(\\<exists>tree. tree  |\\<in>| forest \\<and> (root tree = \\<alpha> \\<and> t |\\<in>| childrenSet tree))\" using n6578i7 notin_fset  by (smt bot_fset.rep_eq empty_Collect_eq fempty_iff) \n            then obtain tree where \"tree  |\\<in>| forest\" and n76576 : \"tr |\\<in>| childrenSet tree\"\n              using \\<open>tr |\\<in>| x\\<close> \\<open>x = \\<alpha> \\<diamondop> forest\\<close> factorByRootSymbolF_lemma(1) factorByRootSymbolF_lemma(2) n6578i7 by blast \n            then have \"height tree \\<le> Suc n\" using n75656876 \\<Z>\\<^sub>\\<phi>\\<Z>\\<^sub>\\<phi>\\<^sub>Flemma \\<Z>\\<^sub>\\<phi>_def restrictionIsFiniteForests\n            proof -\n              show ?thesis using \\<Z>\\<^sub>\\<phi>\\<^sub>F_def \\<open>tree |\\<in>| forest\\<close> n75656876 by force\n            qed \n            then show \"height tr \\<le> n\" using n76576\n              by (meson heightOfChild leD leI less_trans_Suc) \n          qed\n          then have \"x \\<in> (fset (boundedForests n))\"           using     restrictionIsFiniteForests by blast\n          then show \"x |\\<in>| (boundedForests n)\"           using  notin_fset by fastforce\n        qed\n          \n        have u2 : \"x \\<in> (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))\" \n        proof (simp add : dist_intersectionLanguageOplus_def)\n          have \"\\<And>i . x \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i))\"\n          proof -\n            fix i\n            show \"x \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i))\"\n            proof\n              \n              def originalForest == \"SOME originalForest. forest = \\<Psi>\\<^sub>\\<phi> originalForest \\<and> originalForest \\<in> (\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (\\<R> i)))\"\n                \n                \n              from n75656876 have \"forest \\<in> \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" by auto\n              then have  \"forest \\<in> (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\"\n                using \\<Z>\\<^sub>\\<phi>\\<^sub>F_subset by blast \n              then have \"forest \\<in> ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| (\\<R> \\<aa>\\<^sub>1)))) \n                            \\<inter> (\\<Psi>\\<^sub>\\<phi> ` (\\<Oplus> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| (\\<R> \\<aa>\\<^sub>2))))))\"      using dist_intersectionLanguageOplusRules_def by auto\n              then have \"forest \\<in> ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (\\<R> i))))))\"\n                by (metis (full_types) Int_iff aut_def ot.exhaust) \n              then have n65876 : \"\\<exists> originalForest. forest = \\<Psi>\\<^sub>\\<phi> originalForest \\<and> originalForest \\<in> (\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (\\<R> i)))\" by auto\n              have  n656987 :  \"forest = \\<Psi>\\<^sub>\\<phi> originalForest \\<and> originalForest \\<in> (\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (\\<R> i)))\" \n              proof (simp add : originalForest_def someI_ex)\n                from n65876 show \"forest = \\<Psi>\\<^sub>\\<phi> (SOME originalForest. forest = \\<Psi>\\<^sub>\\<phi> originalForest \\<and> originalForest \\<in> \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)) \\<and>\n    (SOME originalForest. forest = \\<Psi>\\<^sub>\\<phi> originalForest \\<and> originalForest \\<in> \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)) \\<in> \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)\"\n                  by (metis (mono_tags, lifting) someI_ex) \n              qed\n              then have \"forest = \\<Psi>\\<^sub>\\<phi> originalForest\" and n7687 : \"originalForest \\<in> (\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (\\<R> i)))\" using originalForest_def by auto\n                  \n                  \n              from n5466876 have  \"x = \\<alpha> \\<diamondop> forest\" by auto\n              from n6578i7 have \"fset x = {t. (\\<exists>tree. tree  |\\<in>| forest \\<and> (root tree = \\<alpha> \\<and> t |\\<in>| childrenSet tree))}\"  by auto\n                  \n                  \n              def childrenInTheOriginalForest == \"\\<Union>| (childrenSet |`| originalForest)\"\n              show \"x = \\<Psi>\\<^sub>\\<phi> childrenInTheOriginalForest\"\n              proof -\n                from n5466876 have  \"x = \\<alpha> \\<diamondop> forest\" by auto\n                from n6578i7 have \"fset x = {t. (\\<exists>tree. tree  |\\<in>| forest \\<and> (root tree = \\<alpha> \\<and> t |\\<in>| childrenSet tree))}\"  by auto\n                from n656987 have  \"forest = \\<Psi>\\<^sub>\\<phi> originalForest \\<and> originalForest \\<in> (\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (\\<R> i)))\"  by auto\n                    \n                from n5466876 n656987 have n6556897 : \"x = \\<alpha> \\<diamondop> ( \\<Psi>\\<^sub>\\<phi> originalForest)\" by auto\n                    \n                from psiF_def  \n                have n76897 : \"\\<Psi>\\<^sub>\\<phi> childrenInTheOriginalForest\n                    = (\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 childrenInTheOriginalForest)))) |`| root |`| childrenInTheOriginalForest\" by auto\n                \n                \n                from n6556897 psiF_def have n6556897a :                      \"x = \\<alpha> \\<diamondop> (((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 originalForest)))) |`| root |`| originalForest))\"                by (simp add: psiF_def)\n                have n76867 : \"\\<And> x . x |\\<in>| originalForest \\<Longrightarrow> root x = \\<alpha>\"\n                proof -\n                  fix x\n                  assume n768643547 : \" x |\\<in>| originalForest\"\n                  from n7687 have \"originalForest \\<in> (\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (\\<R> i)))\" by auto\n                  then show \"root x = \\<alpha>\" using assms(1)  n768643547 using fixOplusRulesRoot by auto\n                qed\n                  \n                  from assms(2) have n76987987 :  \"\\<exists> rule. rule |\\<in>| \\<R> i\" by auto\n                  \n                from n7687 have \"originalForest \\<in> \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)\" by auto\n                    \n                then have n65687 : \"\\<exists> z . z |\\<in>| originalForest\" using bigoplusForests_def biguplusForests_def forest_language_for_rule_def n76987987\n                  by (smt fimage_eqI fsubsetI fsubset_antisym mem_Collect_eq)\n                  \n                  from n76867 n65687 have n76867a : \"root |`| originalForest = (finsert \\<alpha> fempty)\" by auto\n                      \n                  have  n65786 :  \"(\\<Union>| (childrenSet |`| childrenWithSymbol \\<alpha> originalForest)) = childrenInTheOriginalForest\" \n                  proof (simp add : childrenInTheOriginalForest_def)\n                    have \"childrenWithSymbol \\<alpha> originalForest = originalForest\"\n                    proof (simp add : childrenWithSymbol_def)\n                      show \"inf_fset2 originalForest {child1. root child1 = \\<alpha>} = originalForest\" using n76867    by (simp add: fequalityI finterI finter_lower1 fsubsetI) \n                    qed\n                    then show \"\\<Union>| (childrenSet |`| childrenWithSymbol \\<alpha> originalForest) = \\<Union>| (childrenSet |`| originalForest)\" by simp\n                  qed\n                    \n                    \n                from factorPsiLemma  have n65876 : \"\\<And>children . (\\<alpha> \\<diamondop> (finsert ((psi (NODE \\<alpha> children))) fempty)) = \\<Psi>\\<^sub>\\<phi> children\" by auto\n                    \n                from n65786   n65876 have   \"\\<alpha> \\<diamondop> (finsert ((psi (NODE \\<alpha> (\\<Union>| (childrenSet |`| childrenWithSymbol \\<alpha> originalForest))))) fempty) = \\<Psi>\\<^sub>\\<phi> childrenInTheOriginalForest\" by auto\n                then have   \"\\<alpha> \\<diamondop> (((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 originalForest)))) |`| (finsert \\<alpha> fempty))) = \\<Psi>\\<^sub>\\<phi> childrenInTheOriginalForest\" by auto\n                hence n659878 : \"\\<alpha> \\<diamondop> (((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 originalForest)))) |`| root |`| originalForest)) = \\<Psi>\\<^sub>\\<phi> childrenInTheOriginalForest\" using n76867a by auto\n                have \"\\<Psi>\\<^sub>\\<phi> childrenInTheOriginalForest                  = \\<alpha> \\<diamondop> ( \\<Psi>\\<^sub>\\<phi> originalForest)\"                using n6556897 n6556897a n659878 by auto\n                then show \"x = \\<Psi>\\<^sub>\\<phi> childrenInTheOriginalForest\" using n76897 n6556897 by auto\n              qed\n                \n              show \"childrenInTheOriginalForest \\<in> \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i))\" \n              proof (simp add : bigoplusForests_def)\n                show \"childrenInTheOriginalForest \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i)) \\<and> (\\<forall>lang. lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i) \\<longrightarrow> (\\<exists>subforest. subforest \\<in> lang \\<and> subforest |\\<subseteq>| childrenInTheOriginalForest))\"\n                proof\n                  show \"childrenInTheOriginalForest \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i))\" \n                  proof (simp add : childrenInTheOriginalForest_def)\n                    \n                    have \"(\\<And> (tr ) . tr |\\<in>| (\\<Union>| (childrenSet |`| originalForest)) \\<Longrightarrow> (\\<exists> lang . lang |\\<in>|  (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i)) \\<and> (\\<exists> (subforest ) . (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>|  (\\<Union>| (childrenSet |`| originalForest)) \\<and> subforest \\<in> lang))))\"\n                    proof -\n                      fix tr\n                      assume n7567987 : \" tr |\\<in>| \\<Union>| (childrenSet |`| originalForest)\"\n                      then obtain tree where n654786 : \"tr |\\<in>| childrenSet tree\" and n742687 : \"tree |\\<in>| originalForest\" by auto\n                      from n7687 have \" originalForest \\<in> \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \" by auto\n                      then have \"originalForest \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i) \" using bigoplusForests_def by auto\n                      then obtain lang subforest where \"lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i\" and n76864 : \" (tree |\\<in>| subforest \\<and> subforest |\\<subseteq>| originalForest \\<and> subforest \\<in> lang)\"  using n742687 biguplusForests_def by (smt mem_Collect_eq) \n                      then obtain rule where n645687 : \"rule |\\<in>| \\<R> i\" and n6568io7 : \"lang = \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\" by auto\n                      from forest_language_for_rule_def n76864 n742687 n6568io7 have \"tree_for_rule (\\<A> i) rule tree\" by auto\n                      then obtain state where \"state = (evaluation  (\\<A> i)) tr\" and n656987 : \"state |\\<in>| states rule\" using tree_for_rule_def n654786\n                        by (metis fimage_eqI) \n                          then have \"tr \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<sigma> (\\<A> i) state\"\n                            by (simp add: language_for_state_def) \n                          then have n65587 : \"(finsert tr fempty) \\<in> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) state\" using singletonRuleLang by auto\n                          def subforest == \"(finsert tr fempty)\"\n                            \n                          def lang == \"\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) state\"\n                            \n                          \n                          have \" lang |\\<in>|  (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i)) \\<and>  (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>|  (\\<Union>| (childrenSet |`| originalForest)) \\<and> subforest \\<in> lang)\"\n                          proof\n                            have \"state |\\<in>| stateSetFromRuleSet (\\<R> i)\" using n656987  n645687  by (simp add:stateRuleSet)\n                            then show \"lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i)\" using lang_def by auto\n                            show \"tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| \\<Union>| (childrenSet |`| originalForest) \\<and> subforest \\<in> lang\"\n                            proof\n                              show \"tr |\\<in>| subforest\" using subforest_def by auto\n                              show \"subforest |\\<subseteq>| \\<Union>| (childrenSet |`| originalForest) \\<and> subforest \\<in> lang\"\n                              proof\n                                show \"subforest |\\<subseteq>| \\<Union>| (childrenSet |`| originalForest)\" using subforest_def n7567987\n                                  by simp\n                                show \"subforest \\<in> lang\" using n65587 subforest_def lang_def by auto\n                              qed\n                            qed\n                          qed\n                          then show \"(\\<exists> lang . lang |\\<in>|  (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i)) \\<and> (\\<exists> (subforest ) . (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>|  (\\<Union>| (childrenSet |`| originalForest)) \\<and> subforest \\<in> lang)))\" by auto\n                        qed\n                        then show \"\\<Union>| (childrenSet |`| originalForest) \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i))\" using biguplusForests_def by blast                            \n                      qed\n                      show \"\\<forall>lang. lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i) \\<longrightarrow> (\\<exists>subforest. subforest \\<in> lang \\<and> subforest |\\<subseteq>| childrenInTheOriginalForest)\"\n                      proof\n                        show \"\\<And>lang. lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i) \\<longrightarrow> (\\<exists>subforest. subforest \\<in> lang \\<and> subforest |\\<subseteq>| childrenInTheOriginalForest)\"\n                        proof\n                          show \"\\<And>lang. lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i) \\<Longrightarrow> \\<exists>subforest. subforest \\<in> lang \\<and> subforest |\\<subseteq>| childrenInTheOriginalForest\"\n                          proof -\n                            fix lang\n                            assume n767987 : \" lang |\\<in>| \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<R> i)\"\n                              def state == \"SOME state . (lang = \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) state \\<and> state |\\<in>| stateSetFromRuleSet (\\<R> i))\"\n                            then have lang_def : \"lang = \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) state \\<and> state |\\<in>| stateSetFromRuleSet (\\<R> i)\" using n767987\n                              by (smt fimageE someI_ex) \n                            then have \"state |\\<in>|  \\<Union>| (states |`|  (\\<R> i))\" by (simp add : stateSetFromRuleSet_def)\n                            then obtain rule  where n6897 :  \"state |\\<in>| states rule\" and \"rule |\\<in>|  (\\<R> i)\" by auto\n                                \n                            from n7687 have \"originalForest \\<in> (\\<Oplus> ( (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (\\<R> i)))\" by auto\n                            then obtain subforest where nb5456897 : \" (subforest \\<in> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) rule \\<and> subforest |\\<subseteq>| originalForest)\" using bigoplusForests_def\n                              by (smt \\<open>rule |\\<in>| \\<R> i\\<close> fimage_eqI mem_Collect_eq) \n                            hence \"subforest \\<in> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) rule\" by auto\n                            then obtain tree where n7656876 : \"tree |\\<in>| subforest\" and \"tree_for_rule (\\<A> i) rule tree\" using forest_language_for_rule_def\n                              by (smt mem_Collect_eq) \n                            then obtain child where n6756987 : \"child |\\<in>| childrenSet tree\" and n657987 : \"evaluation (\\<A> i) child = state\" using n6897 tree_for_rule_def\n                              by (metis fimageE)\n                            then have \"child |\\<in>| childrenInTheOriginalForest\" using childrenInTheOriginalForest_def n7656876 nb5456897\n                              using fset_rev_mp by blast\n                            from n657987 language_for_state_def have n6587 : \"child \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<sigma> (\\<A> i) state\" by (simp add : language_for_state_def)\n                            def subforest2 == \"(finsert child fempty)\"\n                            have \"subforest2 \\<in> lang\" using lang_def subforest2_def n6587\n                              by (simp add: singletonRuleLang) \n                            have \"subforest2 |\\<subseteq>| childrenInTheOriginalForest\" using subforest2_def  n6756987 n6756987 n7656876 childrenInTheOriginalForest_def\n                              using \\<open>child |\\<in>| childrenInTheOriginalForest\\<close> by auto\n                            have \"subforest2 \\<in> lang \\<and> subforest2 |\\<subseteq>| childrenInTheOriginalForest\"\n                              by (simp add: \\<open>subforest2 \\<in> lang\\<close> \\<open>subforest2 |\\<subseteq>| childrenInTheOriginalForest\\<close>)  \n                            then show \"\\<exists>subforest. subforest \\<in> lang \\<and> subforest |\\<subseteq>| childrenInTheOriginalForest\"  by auto\n                            qed\n                          qed\n                        qed\n                  qed\n                qed\n            qed\n          qed\n          then show \"x \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) \\<and> x \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Oplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2))\" using \\<A>.simps\n            by metis \n        qed\n        from u1 u2 show \"x \\<in> fset (inf_fset2 (boundedForests n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2))))\" using notin_fset\n          by fastforce \n      qed\n    qed\n  qed\nqed\n  \nlemma pathsTreeForestLang :\n  \"\\<Pi>\\<^sub>\\<phi> language = \\<Pi>\\<^sub>\\<tau> (\\<Union>x\\<in>language. fset x)\" \nproof (simp add : pathsForForestLanguage_def pathsForTreeLanguage_def pathsInForest_def)\n  show \"{p. \\<exists>t\\<in>language. fBex t (\\<lambda>x. p |\\<in>| \\<Pi> x)} = {p. \\<exists>y\\<in>language. \\<exists>t\\<in>fset y. p |\\<in>| \\<Pi> t}\"\n  proof\n    show \"{p. \\<exists>t\\<in>language. fBex t (\\<lambda>x. p |\\<in>| \\<Pi> x)} \\<subseteq> {p. \\<exists>y\\<in>language. \\<exists>t\\<in>fset y. p |\\<in>| \\<Pi> t}\" by (smt Collect_mono fBexE notin_fset) \n    show \"{p. \\<exists>y\\<in>language. \\<exists>t\\<in>fset y. p |\\<in>| \\<Pi> t} \\<subseteq> {p. \\<exists>t\\<in>language. fBex t (\\<lambda>x. p |\\<in>| \\<Pi> x)}\" by (smt Collect_mono fBexI notin_fset) \n  qed\nqed\n  \n  \n  \n  \nlemma pathsFactor : \n  assumes \"tree |\\<in>| forest\"\n  assumes \"forest \\<in> language\"\n  assumes \"\\<And> forest . forest \\<in> language \\<Longrightarrow> (\\<And>tr . tr \\<in> (fset forest) \\<Longrightarrow> root tr = \\<alpha>)\"\n  shows \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<phi> (op \\<diamondop> \\<alpha> ` language) \\<union> {[]}) = \\<Pi>\\<^sub>\\<phi> (language)\" \nproof -\n  from factorAndPrefix have \"\\<And>witness trrlanguage.((\\<And>tr . tr \\<in> trrlanguage \\<Longrightarrow> root tr = \\<alpha>) \\<Longrightarrow>witness \\<in> trrlanguage \\<Longrightarrow> \\<alpha> \\<bullet> \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> trrlanguage) \\<union> {[\\<alpha>]} = \\<Pi>\\<^sub>\\<tau> trrlanguage)\" by auto\n  def trrlanguage == \"\\<Union> (fset ` language)\"\n  hence \"tree \\<in> trrlanguage\" using assms notin_fset  by (metis UN_I) \n  hence \"\\<alpha> \\<bullet> \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> trrlanguage) \\<union> {[\\<alpha>]} = \\<Pi>\\<^sub>\\<tau> trrlanguage\" using assms(2) factorAndPrefix trrlanguage_def UN_I  by (smt Union_iff assms(3) bex_imageD) \n  have n6556877 : \"\\<And>p t.  (fBex (\\<alpha> \\<diamondop> t) (\\<lambda>x. p |\\<in>| \\<delta>\\<^sub>\\<tau> x)) = (\\<exists> tree . (tree |\\<in>| \\<alpha> \\<diamondop> t \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> tree))\" using fBexE fBexI by auto\n  have \"\\<Pi>\\<^sub>\\<phi> (op \\<diamondop> \\<alpha> ` language) = \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> trrlanguage)\" \n  proof (simp add : trrlanguage_def pathsForForestLanguage_def pathsForTreeLanguage_def pathsInForest_def factorByRootSymbol_def n6556877 factorByRootSymbolF_lemma(1) factorByRootSymbol_def)\n    show \"{p. \\<exists>t\\<in>language. \\<exists>tree. (\\<exists>treea\\<in>fset t. root treea = \\<alpha> \\<and> tree |\\<in>| childrenSet treea) \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> tree} = {p. \\<exists>t. (\\<exists>y\\<in>language. \\<exists>tree\\<in>fset y. root tree = \\<alpha> \\<and> t |\\<in>| childrenSet tree) \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> t} \" by auto\n  qed\n  have \"\\<Pi>\\<^sub>\\<phi> (language) = \\<Pi>\\<^sub>\\<tau> trrlanguage\" \n  proof (simp add : trrlanguage_def)\n    from pathsTreeForestLang show \"\\<Pi>\\<^sub>\\<phi> language = \\<Pi>\\<^sub>\\<tau> (\\<Union>x\\<in>language. fset x)\" by auto\n  qed\n  show \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<phi> (op \\<diamondop> \\<alpha> ` language) \\<union> {[]}) = \\<Pi>\\<^sub>\\<phi> (language)\"   using \\<open>\\<Pi>\\<^sub>\\<phi> (op \\<diamondop> \\<alpha> ` language) = \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> trrlanguage)\\<close> \\<open>\\<Pi>\\<^sub>\\<phi> language = \\<Pi>\\<^sub>\\<tau> trrlanguage\\<close> \\<open>\\<alpha> \\<bullet> \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> trrlanguage) \\<union> {[\\<alpha>]} = \\<Pi>\\<^sub>\\<tau> trrlanguage\\<close> unionAppend by auto\nqed\n  \n      \n    \nlemma emptyPathsLanguage :\n  assumes \"\\<And>x . (x \\<in> language) \\<Longrightarrow> x = {||}\"\n  shows \"(\\<Pi>\\<^sub>\\<phi> (language)) = {}\" \n    proof (simp add :pathsForForestLanguage_def)\n      from assms have \"\\<And>x. \\<And>t . t\\<in>language \\<Longrightarrow> x |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> t \\<Longrightarrow>  x |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> {||}\" by auto\n      hence  \"\\<And>x. \\<And>t . t\\<in>language \\<Longrightarrow> x |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> t \\<Longrightarrow>  x |\\<in>| {||}\" using pathsInForest_def by fastforce\n      then show \"\\<forall>x. \\<forall>t\\<in>language. x |\\<notin>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> t\" by auto\n    qed\n  \n      \nlemma psiRulesStatesLemma:              \n  fixes \\<R>\n  fixes \\<alpha>\n  assumes \"\\<And> \\<ii> rule . rule |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow> symbol rule = \\<alpha>\"\n  assumes \"(\\<And>i. \\<exists>rule. rule |\\<in>| \\<R> i)\"\n  assumes a1 : \"\\<exists> forest . (forest \\<in> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))) \\<and> forest \\<noteq> fempty)\"\n    (* assumes a1 : \"\\<exists> forest. forest \\<in> \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)) \\<and> forest \\<noteq> {||}\" *)\n  shows \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))) \\<union> {[]}) =\n    \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2) ))\"\nproof -\n  from psiRulesStatesLemma1 assms have n6545765 : \" \\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2))) = op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)) \" by auto\n  then have \"\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))) = \\<Pi>\\<^sub>\\<phi> (op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))) \" by auto\n  then have n659878 : \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))) \\<union> {[]}) = \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<phi> (op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))) \\<union> {[]})\" by auto\n  have a2 : \"(\\<And>forest tr. forest \\<in> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))) \\<Longrightarrow> tr \\<in> fset forest \\<Longrightarrow> root tr = \\<alpha>)\"\n  proof -\n    fix forest tr\n    assume \"forest \\<in> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))\"\n    hence \"forest \\<in> (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\"     by (simp add :\\<Z>\\<^sub>\\<phi>\\<^sub>F_def)\n    then show \"tr \\<in> fset forest \\<Longrightarrow> root tr = \\<alpha>\" using assms(1) oplusRoots      by blast \n  qed\n  from a1 obtain forest where n975653 : \"forest \\<in> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))) \\<and> forest \\<noteq> fempty\" by auto\n  from n6545765 have n76465578 : \"(\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))) = op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" by auto\n  hence \"forest \\<in> op \\<diamondop> \\<alpha> ` \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" using n975653 by auto\n  then obtain forest2 where n864654 : \"forest = \\<alpha>  \\<diamondop> forest2\" and n76454 : \"forest2 \\<in> \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" by auto\n  from n975653 have n8764654 :  \"forest \\<noteq> fempty\" by auto\n  hence \"forest2 \\<noteq> fempty\" using n864654 factorByRootSymbolF_lemma factorByRootSymbol_def factorByRootSymbolF_def  by (smt bot_fset.rep_eq empty_Collect_eq fempty_iff fset_inverse set_to_fset_def) \n  then have ny5r876 : \"forest2 \\<in> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))) \\<and> forest2 \\<noteq> {||}\" using n76454 by auto\n  then obtain tree where nu6453 :\"tree |\\<in>| forest2\" by auto\n  from n8764654 obtain tree2 where n862356 : \"tree2 |\\<in>| forest\" by auto\n  from a2 pathsFactor nu6453 ny5r876 have \n    \" \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<phi> (op \\<diamondop> \\<alpha> ` (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))) \\<union> {[]}) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))\"\n    by auto\n  hence \" \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<phi> ((\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2))))) \\<union> {[]}) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))\" using n76465578 by auto\n  then show \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<R> \\<aa>\\<^sub>2)))) \\<union> {[]}) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))\" by auto\nqed\n  \n  \n    \n    (* ======================================= MAIN LEMMA =========================================== *)\n    \n    \n  \nlemma wMonotonic:\n  shows \"\\<And>i. \\<W> n (Suc y) \\<R> i |\\<subseteq>| \\<W> n y \\<R> i\"\n  by (metis \\<W>.simps(2) caseDistinction.elims fminus_iff fsubsetI)\n    \n    \nlemma\n  assumes \"pathFitsListAndListIsARun \\<ii> p r\"\n  assumes \"r \\<noteq> []\"\n  shows \"hd r |\\<in>| rule_set (\\<A> \\<ii>)\"\n  by (metis assms(1) assms(2) hd_Cons_tl pathFitsListAndListIsARun.simps(2) pathFitsListAndListIsARun.simps(4))\n    \n    \n    \nlemma piUnionLemma:\n  fixes n l\n  shows \" \\<Pi>\\<^sub>\\<tau>\\<^sub>F ( \\<Union>| (\\<Z>\\<^sub>\\<phi> n l)) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n l)\"\n  by (simp add: aux50)\n    \n\n    \n\n  \nlemma notation_lemma1 :\n  fixes Sa1 Sa2 n\n  shows \" (\\<Pi>\\<^sub>\\<phi> ((fset (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))))) = (\\<Pi>\\<^sub>\\<delta> (fset (\\<Z>\\<^sub>\\<delta> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2))))\"\nproof -\n  from pathsForForestLanguage_def have b1 : \" (\\<Pi>\\<^sub>\\<phi> ((fset (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))))) = {p . (\\<exists> t \\<in> ((fset (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)))) . p |\\<in>| pathsInForest t)}\" by auto\n  have b2 : \"(\\<Pi>\\<^sub>\\<delta> (fset (\\<Z>\\<^sub>\\<delta> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2)))) = \\<Union> (fset ` (fset (\\<Z>\\<^sub>\\<delta> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2))))\" by auto\n  have b3 : \"\\<Union> (fset ` (fset (\\<Z>\\<^sub>\\<delta> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2)))) = {p . (\\<exists> t \\<in> (fset (\\<Z>\\<^sub>\\<delta> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2))) . p |\\<in>| t)}\" by (smt Collect_cong Sup_set_def ffUnion.rep_eq ffUnionI ffUnionLemma mem_Collect_eq notin_fset) \n  have b4 : \"\\<And>p . (\\<exists> t \\<in> ((fset (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)))) . p |\\<in>| pathsInForest t) = (\\<exists> t \\<in> (fset (\\<Z>\\<^sub>\\<delta> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2))) . p |\\<in>| t)\" \n  proof -\n    fix p\n    show \"(\\<exists> t \\<in> ((fset (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)))) . p |\\<in>| pathsInForest t) = (\\<exists> t \\<in> (fset (\\<Z>\\<^sub>\\<delta> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2))) . p |\\<in>| t)\" \n    proof (simp add : \\<Z>\\<^sub>\\<delta>_def \\<Z>\\<^sub>\\<phi>_def)\n      show \"(\\<exists>t\\<in>fset (inf_fset2 (boundedForests n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)). p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> t) = (\\<exists>x\\<in>fset (inf_fset2 (boundedForests n) {f. \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<in> \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2}). p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x)\"\n      proof\n        have \"\\<And>t. t \\<in> (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)  \\<Longrightarrow> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> t \\<in> \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2\" using psiDeltaPsi by blast\n        then have \"\\<And>t . t\\<in>fset (inf_fset2 (boundedForests n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)) \\<Longrightarrow> t \\<in> fset (inf_fset2 (boundedForests n) {f. \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<in> \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2})\"          using inf_fset2.rep_eq by fastforce\n        then show \"\\<exists>t\\<in>fset (inf_fset2 (boundedForests n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)). p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> t \\<Longrightarrow> \\<exists>x\\<in>fset (inf_fset2 (boundedForests n) {f. \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<in> \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2}). p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x\"          by blast\n        show \"\\<exists>x\\<in>fset (inf_fset2 (boundedForests n) {f. \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<in> \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2}). p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x \\<Longrightarrow> \\<exists>t\\<in>fset (inf_fset2 (boundedForests n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)). p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> t\" \n        proof (simp add : \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>_def \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta>_def)\n          show \"\\<exists>x\\<in>fset (inf_fset2 (boundedForests n) {f. \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<in> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1) |`| Sa1) \\<and> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<in> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2) |`| Sa2)}). p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x \\<Longrightarrow>\n    \\<exists>t\\<in>fset (inf_fset2 (boundedForests n) (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1) \\<inter> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))). p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> t\"\n          proof -\n            assume \"\\<exists>x\\<in>fset (inf_fset2 (boundedForests n) {f. \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<in> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1) |`| Sa1) \\<and> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<in> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2) |`| Sa2)}). p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x\"\n            then obtain x where y1 : \"x |\\<in>| boundedForests n\" and y2 : \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x \\<in> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1) |`| Sa1)\" and y3 : \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x \\<in> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2) |`| Sa2)\" and y4 : \"p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x\"                by (metis (mono_tags, lifting) IntD2 finterD1 inf_fset2.rep_eq mem_Collect_eq notin_fset) \n                \n            from y2  have \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x \\<in> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| ( \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1))\" by auto\n            hence \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> ( \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1))\" using nu67543433 by blast\n            then obtain oldPsi1 where y12 : \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> oldPsi1\" and y10 : \"oldPsi1 \\<in> (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> ( \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1))\" by auto\n            from y3  have \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x \\<in> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| ( \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))\" by auto\n            hence \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> ( \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))\" using nu67543433 by blast\n            then obtain oldPsi2 where y13 : \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> x = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> oldPsi2\" and y11 : \"oldPsi2 \\<in> (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> ( \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))\" by auto\n            from y10 y11 y12 y13 psiOnlyDependsOnPath have n764543 : \"oldPsi1 = oldPsi2\"                  by (metis imageE psiOnlyDependsOnPath1) \n            from y12  y1 heightBoundedPaths have \"oldPsi1 |\\<in>| boundedForests n\" by blast\n            from y10 n764543 y11 have \"oldPsi1 \\<in> (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1)) \\<inter> (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))\" by blast\n            from y4  y12   have \"p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> oldPsi1\" by auto\n            have \" oldPsi1\\<in>fset (inf_fset2 (boundedForests n) (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1) \\<inter> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))) \\<and> p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> oldPsi1\"                      by (metis (no_types, lifting) \\<open>oldPsi1 \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1) \\<inter> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2)\\<close> \\<open>oldPsi1 |\\<in>| boundedForests n\\<close> \\<open>p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> oldPsi1\\<close> finterI n764543 notin_fset) \n            then show \" \\<exists>t\\<in>fset (inf_fset2 (boundedForests n) (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1) \\<inter> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))). p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> t\" by auto\n          qed\n        qed\n      qed\n    qed\n  qed\n  from b1  b3 b4 show \" (\\<Pi>\\<^sub>\\<phi> ((fset (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))))) = (\\<Pi>\\<^sub>\\<delta> (fset (\\<Z>\\<^sub>\\<delta> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2))))\" by auto\nqed\n  \n  \n  \ndefinition rootNode where \"rootNode tree = (SOME node . up node = PLACEHOLDER \\<and> down node = tree )\"  \n  \n  \nlemma hasRoot:\n  fixes tree\n  shows \"up (rootNode tree) = PLACEHOLDER \\<and> down (rootNode tree) = tree\"\n  by (metis (mono_tags, lifting) node.select_convs(1) node.select_convs(2) node.surjective rootNode_def someI)\n    \nlemma hasRoot2:\n  fixes tree\n  shows \"isNodeIn (rootNode tree) tree \\<and> isRootNode (rootNode tree)\"\n  by (simp add: hasRoot isNodeIn_def isRootNode_def)\n    \n    \nfun nodeListForPath :: \"abc list \\<Rightarrow> abc tree \\<Rightarrow> abc node list\" where\n  \"nodeListForPath [] tr = []\"\n| \"nodeListForPath [a] tr = [rootNode tr]\" \n| \"nodeListForPath (a#(b#c)) tr = (rootNode tr)#(nodeListForPath (b#c) (SOME x. (x |\\<in>| childrenSet tr \\<and> (b#c) |\\<in>| \\<Pi> x) ))\" \n  \nfun nodeListFitsPath :: \"abc list \\<Rightarrow> abc node list \\<Rightarrow> bool\" where\n  \"nodeListFitsPath [] [] = True\"\n| \"nodeListFitsPath (a#b) (c#d) = ((a = root ((down c))) \\<and> nodeListFitsPath b d)\"\n| \"nodeListFitsPath [] (c#d) = False\"\n| \"nodeListFitsPath (a#b) [] = False\"\n  \nlemma childPath :\n  assumes a1: \"p |\\<in>| \\<delta>\\<^sub>\\<tau> (NODE parent children)\"\n  shows \"p = [parent] \\<or> (\\<exists>child.(\\<exists>childPath.(child |\\<in>| children \\<and> p = parent#childPath \\<and> childPath |\\<in>| \\<Pi> child)))\"\n  using assms by auto\n    \n    \nlemma zInP :\n  assumes \"tr |\\<in>| \\<ff> (n) \\<R>\"\n  shows \"tr \\<in> \\<P> \\<R>\"\n  using  \\<ff>_def\n  by (metis assms(1)  zIntersectLemma) \n    \n    \nlemma pRoot : \n  assumes \"\\<And> \\<ii> rule .(rule |\\<in>| \\<R> \\<ii> \\<Longrightarrow> symbol rule = \\<alpha>)\"\n  assumes \"tr \\<in> \\<P> \\<R>\"\n  shows \"root tr = \\<alpha>\"  \n  using \\<P>_def satisfiesApproximatorForRuleSet_def pathSatisfiesApproximatorForRuleSet_def pathsInTree_def\nproof -\n  obtain nns :: \"abc tree \\<Rightarrow> abc node list\" and nn :: \"abc tree \\<Rightarrow> abc node\" where\n    f1: \"isAPathp (nns tr) \\<and> nns tr = [nn tr] \\<and> down (nn tr) = tr \\<and> nns tr \\<in> pathsInTree tr\"\n    using theSingletonPathExists by moura\n  then have f2: \"pathSatisfiesApproximatorForRuleSet [nn tr] (\\<R> elem_11) elem_11\"\n    using \\<P>_def assms(2) satisfiesApproximatorForRuleSet_def by force\n  obtain rrs :: \"ot \\<Rightarrow> (stt, abc) rule fset \\<Rightarrow> abc node list \\<Rightarrow> (stt, abc) rule list\" where\n    \"\\<forall>x0 x1 x2. (\\<exists>v3. hd v3 |\\<in>| x1 \\<and> pathFitsListAndListIsARun x0 x2 v3) = (hd (rrs x0 x1 x2) |\\<in>| x1 \\<and> pathFitsListAndListIsARun x0 x2 (rrs x0 x1 x2))\"\n    by moura\n  then have f3: \"(\\<not> pathSatisfiesApproximatorForRuleSet [nn tr] (\\<R> elem_11) elem_11 \\<or> hd (rrs elem_11 (\\<R> elem_11) [nn tr]) |\\<in>| \\<R> elem_11 \\<and> pathFitsListAndListIsARun elem_11 [nn tr] (rrs elem_11 (\\<R> elem_11) [nn tr])) \\<and> (pathSatisfiesApproximatorForRuleSet [nn tr] (\\<R> elem_11) elem_11 \\<or> (\\<forall>rs. hd rs |\\<notin>| \\<R> elem_11 \\<or> \\<not> pathFitsListAndListIsARun elem_11 [nn tr] rs))\"\n    using pathSatisfiesApproximatorForRuleSet_def by auto\n  then have \"pathFitsListAndListIsARun elem_11 [nn tr] (hd (rrs elem_11 (\\<R> elem_11) [nn tr]) # tl (rrs elem_11 (\\<R> elem_11) [nn tr]))\"\n    using f2 by (metis (no_types) hd_Cons_tl nonMatching)\n  then show ?thesis\n    using f3 f2 f1 by (metis (no_types) assms(1) labelOfNode_def pathFitsListAndListIsARun.simps(2))\nqed\n  \n  \nlemma fRoot :\n  assumes \"\\<And> \\<ii> rule . rule |\\<in>| \\<R> \\<ii> \\<Longrightarrow> symbol rule = \\<alpha>\"\n  assumes \"tr |\\<in>| \\<ff> (n) \\<R>\"\n  shows \"root tr = \\<alpha>\"\n  using pRoot \\<ff>_def\n  by (metis assms(1) assms(2) zInP)\n    \n    \n    (* To each path (as a sequence of symbols) corresponds a sequence of nodes *)\nlemma nodeListForPathExists :\n  fixes tr\n  shows \"\\<And>p . p |\\<in>| \\<Pi> tr \\<Longrightarrow> (nodeListFitsPath p (nodeListForPath p tr) \\<and> (nodeListForPath p tr) \\<in> (pathsInTree tr))\"\nproof (induct tr)\n  fix parent children p\n  assume a4 : \"(\\<And>x2aa p. x2aa \\<in> fset children \\<Longrightarrow> p |\\<in>| \\<delta>\\<^sub>\\<tau> x2aa \\<Longrightarrow> (nodeListFitsPath p (nodeListForPath p x2aa) \\<and> nodeListForPath p x2aa \\<in> pathsInTree x2aa))\"\n  assume m1 : \"p |\\<in>| \\<delta>\\<^sub>\\<tau> (NODE parent children)\"\n  from m1 have a9 : \"p |\\<in>| fimage (append [parent]) ((\\<Union>| (fimage \\<Pi> children)) |\\<union>|  (finsert [] {||}))\" by auto\n  then obtain tail where n570 : \"p = parent#tail\" and n571 : \"tail |\\<in>| ((\\<Union>| (fimage \\<Pi> children)) |\\<union>|  (finsert [] {||}))\"          using childPath m1 by blast \n  show \"(nodeListFitsPath p (nodeListForPath p (NODE parent children)) \\<and> nodeListForPath p (NODE parent children) \\<in> pathsInTree (NODE parent children))\"\n  proof (rule disjE)\n    show \"tail = [] \\<or> tail \\<noteq> []\" by auto\n    show \"tail = [] \\<Longrightarrow> (nodeListFitsPath p (nodeListForPath p (NODE parent children)) \\<and> nodeListForPath p (NODE parent children) \\<in> pathsInTree (NODE parent children))\"          by (simp add: hasRoot isAPathp.intros(1) n570 pathsInTree_def)\n    show \"tail \\<noteq> [] \\<Longrightarrow> (nodeListFitsPath p (nodeListForPath p (NODE parent children)) \\<and> nodeListForPath p (NODE parent children) \\<in> pathsInTree (NODE parent children))\"\n    proof \n      assume n658 : \"tail \\<noteq> []\"\n      from a9 n658 n570 n571 obtain child childPath where a1 : \"child |\\<in>| children\" and a2 : \"p = parent#childPath\" and a3 : \"childPath |\\<in>| \\<Pi> child\"      by auto\n      from a2 n570 have n572 : \"childPath = tail\" by auto\n      then obtain tail1 tail2 where n578 : \"childPath = tail1#tail2\" using n658              using a3 noEmptyPathsInPi by blast \n      from a1 a2 a3 a4 have q1 : \"nodeListFitsPath childPath (nodeListForPath childPath child)\" by (meson notin_fset) \n      have \"parent = root (down (rootNode (NODE parent children)))\" by (simp add: hasRoot)\n      have n1 : \"nodeListForPath (parent#(tail1#tail2)) (NODE parent children) = (nodeListForPath (parent#(tail1#tail2)) (NODE parent children))\" by auto\n      have n2 : \"(\\<And> P. \\<And>tr. (parent#(tail1#tail2)) = [] \\<Longrightarrow> (NODE parent children) = tr \\<Longrightarrow> (nodeListForPath (parent#(tail1#tail2)) (NODE parent children)) = [] \\<Longrightarrow> P)\" by auto\n      have n3 : \" \\<And>P.  (\\<And>a tr. (parent#(tail1#tail2)) = [a] \\<Longrightarrow> (NODE parent children) = tr \\<Longrightarrow> (nodeListForPath (parent#(tail1#tail2)) (NODE parent children)) = [rootNode tr] \\<Longrightarrow> P)\" by auto\n      from n1 n2 n3 nodeListForPath.elims   have n4 : \"(\\<And>a b c tr. (parent#(tail1#tail2)) = a # b # c \\<Longrightarrow> (NODE parent children) = tr \\<Longrightarrow> (nodeListForPath (parent#(tail1#tail2)) (NODE parent children)) = rootNode tr # nodeListForPath (b # c) (SOME x. x |\\<in>| childrenSet tr \\<and> b # c |\\<in>| \\<delta>\\<^sub>\\<tau> x))\" by auto\n      then  have p1 : \"(nodeListForPath (parent#(tail1#tail2)) (NODE parent children)) = (rootNode (NODE parent children))#(nodeListForPath (tail1#tail2) (SOME x. (x |\\<in>| childrenSet (NODE parent children) \\<and> (tail1#tail2) |\\<in>| \\<Pi> x) ))\"      by simp \n      then            have   \"(nodeListForPath (parent#childPath) (NODE parent children)) = (rootNode (NODE parent children))#(nodeListForPath childPath (SOME x. (x |\\<in>| childrenSet (NODE parent children) \\<and> childPath |\\<in>| \\<Pi> x) ))\"       using n578 by auto \n      then have a14 : \"(nodeListForPath p (NODE parent children)) = (rootNode (NODE parent children))#(nodeListForPath childPath (SOME x. (x |\\<in>| childrenSet (NODE parent children) \\<and> childPath |\\<in>| \\<Pi> x) ))\" using a2 by auto\n      def child2 == \"(SOME x. (x |\\<in>| childrenSet (NODE parent children) \\<and> childPath |\\<in>| \\<Pi> x))\"\n      from a1 have a11 : \"child |\\<in>| childrenSet (NODE parent children)\" by auto\n      have a12 : \"(child2 |\\<in>| childrenSet (NODE parent children) \\<and> childPath |\\<in>| \\<Pi> child2)\" using child2_def a11 a3 by (metis (mono_tags, lifting) childrenSet.simps someI_ex)\n      from a4 a12 have a13 : \"nodeListFitsPath childPath (nodeListForPath childPath child2)\" using childrenSet.simps notin_fset by fastforce\n      from a13 have \"((parent = root ((down (rootNode (NODE parent children))))) \\<and> nodeListFitsPath childPath (nodeListForPath childPath child2))\" by (simp add: \\<open>parent = root (down (rootNode (NODE parent children)))\\<close>)\n      then show \"nodeListFitsPath p (nodeListForPath p (NODE parent children))\" using a2 nodeListFitsPath.simps a14 using child2_def by auto \n      from a1 a2 a3 a4 have q2 : \"(nodeListForPath childPath child) \\<in> pathsInTree child\" by (meson notin_fset)\n      then have b6756 : \"isAPathp (nodeListForPath childPath child)\" using pathsInTree_def by blast\n      obtain e1 e2 where b10 : \"e1#e2 =(nodeListForPath childPath child2)\"        by (metis (mono_tags, lifting) a12 a4 childrenSet.simps noEmptyPathsInTree nodeListForPath.elims notin_fset)\n      then   have b11 : \"down e1 = child2\"     by (metis (no_types, lifting) hasRoot list.distinct(1) list.sel(1) nodeListForPath.elims)\n      from b10 b11 a12 have \"(\\<exists>e1.\\<exists>tail.((nodeListForPath childPath child2) = (e1#tail)) \\<and> (immediatelyDominates (rootNode (NODE parent children)) e1))\"    by (metis hasRoot immediatelyDominates_def) \n      then have e1 :  \"(isAPathp (nodeListForPath p (NODE parent children)))\" using a14 b6756 isAPathp.simps    by (smt a12 a4 child2_def childrenSet.simps hasRoot immediatelyDominates_def mem_Collect_eq notin_fset pathsInTree_def)\n      from down_def hasRoot  have n765 : \"down (rootNode (NODE parent children)) = (NODE parent children)\" by blast\n      from a14 n765 have e2 : \" (( \\<exists>e1.\\<exists>tail.((nodeListForPath p (NODE parent children)) = (e1#tail) \\<and> down e1 = (NODE parent children))))\" by blast\n      from e1 e2 pathsInTree_def show \"nodeListForPath p (NODE parent children) \\<in> pathsInTree (NODE parent children)\" by auto\n    qed\n  qed\nqed\n  \n  \nlemma nodeListFitsTree :\n  fixes tr\n  shows \"\\<And>p . p |\\<in>| \\<Pi> tr \\<Longrightarrow> (nodeListForPath p tr) \\<in> (pathsInTree tr)\"\n  using nodeListForPathExists by auto\n    \n    \ndefinition RByCase where\n  \"RByCase \\<ii> a b \\<ii>2 = caseDistinction (\\<ii> = \\<ii>2) a b\"\n  \n  \n  \n  \n  (* =================================================== *)\n  \n  (* Here, the goal is to show the difficult direction for depth < N *)\n  \nlemma existsWitnessTree2 :\n  fixes \\<ii> tr\n  shows \"\\<And>p   . \\<And> nodeList . \\<And> run. \n           nodeList \\<noteq> [] \\<Longrightarrow>\n           down (hd nodeList) = tr \\<Longrightarrow> \n           isAPathp nodeList \n \\<Longrightarrow> (pathFitsListAndListIsARun \\<ii> nodeList run)\n \\<Longrightarrow> nodeListFitsPath p nodeList           \n\\<Longrightarrow> height tr \\<le> \\<N>\n \\<Longrightarrow> \\<exists> witness . \n (witness \\<in> ((((((\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>))  (hd run))))))\n  \\<and> \\<delta>\\<^sub>\\<tau> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> tr\n  \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> witness)\"\nproof (induct tr)\n  show \"\\<And>x1a x2a p nodeList run.\n       (\\<And>x2aa p nodeList run.\n           x2aa \\<in> fset x2a \\<Longrightarrow>\n           nodeList \\<noteq> [] \\<Longrightarrow>\n           down (hd nodeList) = x2aa \\<Longrightarrow> \n           isAPathp nodeList \\<Longrightarrow>\n           pathFitsListAndListIsARun \\<ii> nodeList run \\<Longrightarrow>\n           nodeListFitsPath p nodeList \\<Longrightarrow>\n           height x2aa \\<le> \\<N> ==>\n           \\<exists>witness. witness \\<in>   (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>)  (hd ( run)) ) \\<and> \\<delta>\\<^sub>\\<tau> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> x2aa \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> witness) \\<Longrightarrow>\n       nodeList \\<noteq> [] \\<Longrightarrow>\n       down (hd nodeList) = (NODE x1a x2a) \\<Longrightarrow> \n       isAPathp nodeList \\<Longrightarrow>\n       pathFitsListAndListIsARun \\<ii> nodeList run \\<Longrightarrow>\n       nodeListFitsPath p nodeList \\<Longrightarrow>\nheight (NODE x1a x2a) \\<le> \\<N> \\<Longrightarrow>\n       \\<exists>witness. witness \\<in>   (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) (hd ( run))) \\<and> \\<delta>\\<^sub>\\<tau> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE x1a x2a) \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> witness\"\n  proof -\n    fix parent children p  run\n    fix nodeList :: \"(abc node list)\"\n    assume a1 : \"(\\<And>x2aa p nodeList run.\n           x2aa \\<in> fset children \\<Longrightarrow>\n            nodeList \\<noteq> [] \\<Longrightarrow>\n           down (hd nodeList) = x2aa \\<Longrightarrow> \n           isAPathp nodeList \\<Longrightarrow>\n           pathFitsListAndListIsARun \\<ii> nodeList run \\<Longrightarrow>\n           nodeListFitsPath p nodeList \\<Longrightarrow>\nheight x2aa \\<le> \\<N> \\<Longrightarrow>\n           \\<exists>witness. witness \\<in>  (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>)  (hd ( run))) \\<and>  \\<delta>\\<^sub>\\<tau> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> x2aa \\<and> p |\\<in>|  \\<delta>\\<^sub>\\<tau> witness)\"\n    assume a100 : \"nodeList \\<noteq> []\"\n    assume a2 : \"down (hd nodeList) = (NODE parent children)\"\n    assume a2b : \"isAPathp nodeList\"\n    assume a3 : \"pathFitsListAndListIsARun \\<ii> nodeList run\"\n    assume a4 : \"nodeListFitsPath p nodeList\"\n    assume a67 : \"height (NODE parent children) \\<le> \\<N>\"\n      \n      \n    def nodesTail == \"tl nodeList\"\n    obtain nodesRoot where b100 : \"nodeList = nodesRoot#nodesTail\" using a2b isAPathp.simps by (metis a100 list.collapse nodesTail_def tl_Nil)  \n    from b100 have v100 :  \"nodesRoot = hd nodeList\" by auto\n    obtain runHead runTail where b109 : \"run = runHead#runTail\"\n      by (metis a3 b100 hd_Cons_tl pathFitsListAndListIsARun.simps(3)) \n    obtain pHead pTail where b101 : \"p = pHead#pTail\"\n      using a4 b100 nodeListFitsPath.elims(2) by blast\n    from a100 nodesTail_def  have b102 : \"nodeList \\<noteq> []\" by simp\n    def child2 == \"(( (down (hd nodesTail))))\"\n    have b103 : \"nodesTail \\<noteq> [] \\<Longrightarrow> child2 \\<in> fset children\"\n    proof -\n      from a2 v100 a2b isAPath.simps b100  have \"nodesTail \\<noteq> [] \\<Longrightarrow>(immediatelyDominates nodesRoot (hd nodesTail))\"        by (metis isAPathp.simps list.sel(1) list.sel(3)) \n      then have \"nodesTail \\<noteq> [] \\<Longrightarrow> ((down (hd nodesTail)) |\\<in>| (childrenSet (down nodesRoot)))\" using immediatelyDominates_def by auto\n      then show \"nodesTail \\<noteq> [] \\<Longrightarrow> child2 \\<in> fset children\" using child2_def a2 b100 using childrenSet.simps list.sel(1) notin_fset by force \n    qed\n    have b104 : \"down (hd nodesTail) = child2\" using child2_def by auto \n    from a2b nodesTail_def have b104a : \"nodesTail \\<noteq> [] \\<Longrightarrow> isAPathp nodesTail\"       by (metis isAPathp.simps list.sel(3))   (* not actually true, since the first element is not a root. have to relax this and define something that only requires immediatelyDominates *)\n    have b105 : \"pathFitsListAndListIsARun \\<ii> nodesTail runTail\" using a3 b100 b109 pathFitsListAndListIsARun.simps by simp\n    have b106 : \"nodeListFitsPath pTail nodesTail\" using a4 b100 b101 nodeListFitsPath.simps(2) by simp\n    from a67 b103 have b1156 : \"nodesTail \\<noteq> [] \\<Longrightarrow> height child2 \\<le> \\<N>\" using childDepth      by (meson dual_order.trans less_imp_le_nat notin_fset) \n    from a1 b103 b104 b104a b105 b106 b1156 obtain downWitness where b120 :\n      \"nodesTail \\<noteq> [] \\<Longrightarrow> downWitness \\<in>   (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>)  (hd ( runTail))) \\<and> \\<delta>\\<^sub>\\<tau> downWitness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> child2 \\<and> pTail |\\<in>| \\<delta>\\<^sub>\\<tau> downWitness\" by blast\n    from pathFitsListAndListIsARun.simps(2) a3 b100 b109 have  b110 : \"(( (labelOfNode nodesRoot = symbol runHead)\n                                      \\<and> (runHead |\\<in>| rule_set (\\<A> \\<ii>))\n                                      \\<and> (( (down nodesRoot)) \\<in> ( \\<V>\\<^sub>\\<tau> \\<ii> runHead  )   )    )\n                                      \\<and> (pathFitsListAndListIsARun \\<ii> nodesTail runTail)\n                                      \\<and> (\\<forall> h.\\<forall> t.(runTail = (h#t) \\<longrightarrow>  (        (((transition (\\<A> \\<ii>) (states h) (symbol h) )  |\\<in>| states runHead) )        )))        \n                                      )\"  by metis\n    from \\<V>\\<^sub>\\<tau>_def b110 have b111 : \"(root (down nodesRoot) = (symbol runHead))\" and b112 : \"\\<Pi> (down nodesRoot) \\<in> ((upwardClosure (image \\<Pi> (((Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) runHead)))))) \n                                 \\<union> (image \\<Pi> {t . height t > \\<N>})) \n                              \\<inter> (\\<Inter>I \\<in> (necess (\\<A> \\<ii>) \\<I> runHead) . (image \\<Pi> (existential_satisfaction_set I)   ))\" by auto\n    from b112 have b113 : \"\\<Pi> (down nodesRoot) \\<in> ((upwardClosure (image \\<Pi> (((Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) runHead)))))) \n                                 \\<union> (image \\<Pi> {t . height t > \\<N>}))\" by auto\n    from a2 b100 have \"down nodesRoot = (NODE parent children)\" by auto\n    then have b114 : \"height (down nodesRoot) \\<le> \\<N>\" using  a67 by simp\n    then have \"(down nodesRoot) \\<notin> ({t . height t > \\<N>})\" by auto\n    then  have b643 : \"\\<Pi> (down nodesRoot) \\<notin> (image \\<Pi> {t . height t > \\<N>})\" using heightOnlyDependsOnPaths        by auto \n    from b113 b643 have b115 : \"\\<Pi> (down nodesRoot) \\<in> ((upwardClosure (image \\<Pi> (((Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) runHead)))))))\" by blast\n    then obtain mirrorPaths where b115a : \"mirrorPaths \\<in> (image \\<Pi> (((Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) runHead))))) \\<and> fset (\\<Pi> (down nodesRoot)) \\<supseteq> fset mirrorPaths\" using upwardClosure_def by (smt mem_Collect_eq)  \n    from b115a obtain mirror where b116 : \"\\<Pi> mirror |\\<subseteq>| \\<Pi> (down nodesRoot)\" and b117 : \"mirror \\<in> (Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) runHead))\" by (metis imageE less_eq_fset.rep_eq)\n    from b110 have b130 : \"labelOfNode nodesRoot = symbol runHead\" by auto\n    from b117 Z_def have b131 : \"mirror \\<in> ((\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) runHead))\" by auto\n    from b130 b131 have \"labelOfNode nodesRoot = root mirror\" by (simp add: language_for_rule_def mem_Collect_eq tree_for_rule_def) \n    def newWitness == \"NODE parent (finsert downWitness  (childrenSet mirror) ) \"\n    have \"nodesTail \\<noteq> [] \\<Longrightarrow>newWitness \\<in>  (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>)  runHead )\"\n    proof -\n      from  b117  have \"mirror \\<in> (Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) runHead))\" by auto\n      then have \"mirror \\<in> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) runHead)\" by (simp add: Z_def mem_Collect_eq) \n      from b120 have \"nodesTail \\<noteq> [] \\<Longrightarrow>downWitness \\<in>  \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) (hd ( runTail))\" by auto\n      obtain h t where y100 : \"nodesTail \\<noteq> [] \\<Longrightarrow>runTail = (h#t)\" by (metis b102 b110 list.exhaust pathFitsListAndListIsARun.simps(3)) \n      then have \"nodesTail \\<noteq> [] \\<Longrightarrow>(        (((transition (\\<A> \\<ii>) (states h) (symbol h) )  |\\<in>| states runHead) )        )\" using b110 by auto\n      have c1 : \"nodesTail \\<noteq> [] \\<Longrightarrow>((root newWitness = symbol runHead))\"\n      proof -\n        from newWitness_def have r3 : \"root newWitness = parent\" by (simp add: root.simps)\n        from a2 have r1 : \"down (hd nodeList) = (NODE parent children)\" by auto\n        from a3 have r2 : \"pathFitsListAndListIsARun \\<ii> nodeList run\" by auto\n        from a3 pathFitsListAndListIsARun.simps b100 b109 have r4 : \"(labelOfNode (hd nodeList) = symbol runHead)\" by auto\n        from r3 r1 labelOfNode_def show \"root newWitness = symbol runHead\" by (metis r4 root.simps)\n      qed\n      have c2 : \"nodesTail \\<noteq> [] \\<Longrightarrow>((fimage (((evaluation (\\<A> \\<ii>)))) (childrenSet newWitness)) = states (runHead))\"\n      proof -\n        from b117 Z_def have \"mirror \\<in> ((\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) runHead))\" by auto\n        from b131 have b399 : \"((fimage (((evaluation (\\<A> \\<ii>)))) (childrenSet mirror)) = states (runHead))\" by (simp add: language_for_rule_def mem_Collect_eq tree_for_rule_def)\n        from b120 have b400 : \"nodesTail \\<noteq> [] \\<Longrightarrow>downWitness \\<in>   (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>)  (hd ( runTail)))\" by auto\n        from a3 pathFitsListAndListIsARun.simps b100 b109 \n        have b401 : \"(\\<forall> h.\\<forall> t.(runTail = (h#t) \\<longrightarrow>  (        (((transition (\\<A> \\<ii>) (states h) (symbol h) )  |\\<in>| states runHead) )        ))) \" by simp \n        then have b402  : \"nodesTail \\<noteq> [] \\<Longrightarrow>(        (((transition (\\<A> \\<ii>) (states (hd ( runTail))) (symbol (hd ( runTail))) )  |\\<in>| states ( ( runHead))) )        )\"   using y100 by simp\n        from b400 have b403 : \"nodesTail \\<noteq> [] \\<Longrightarrow>(root downWitness) = (symbol (hd ( runTail)))\" by (simp add: language_for_rule_def mem_Collect_eq tree_for_rule_def)\n        from b400 have b404 : \"nodesTail \\<noteq> [] \\<Longrightarrow>(states (hd ( runTail))) = (fimage (evaluation (\\<A> \\<ii>)) (childrenSet downWitness ))\" by (simp add: language_for_rule_def mem_Collect_eq tree_for_rule_def)\n        from b402 b403 b404 have \"nodesTail \\<noteq> [] \\<Longrightarrow>(((transition (\\<A> \\<ii>)) (fimage (evaluation (\\<A> \\<ii>)) (childrenSet downWitness ))) (root downWitness)) |\\<in>| states (runHead)\" by simp\n        then have b405 : \"nodesTail \\<noteq> [] \\<Longrightarrow>evaluation (\\<A> \\<ii>) downWitness |\\<in>| states (runHead)\" using evaluation_def \\<Pi>.simps childrenSet.simps evaluation.simps root.simps\n          by (metis childrenSet.cases) \n        from b399 b405 newWitness_def show \"nodesTail \\<noteq> [] \\<Longrightarrow>((fimage (((evaluation (\\<A> \\<ii>)))) (childrenSet newWitness)) = states (runHead))\" using childrenSet.simps fimageE fimage_finsert finsert_fimage by auto \n      qed\n      from c1 c2 have \"nodesTail \\<noteq> [] \\<Longrightarrow> ((root newWitness = symbol runHead) \\<and> ((fimage (((evaluation (\\<A> \\<ii>)))) (childrenSet newWitness)) = states (runHead)))\" by auto\n      then have \"nodesTail \\<noteq> [] \\<Longrightarrow>(tree_for_rule (\\<A> \\<ii>) runHead newWitness)\" using tree_for_rule_def by auto\n      then show \"nodesTail \\<noteq> [] \\<Longrightarrow>newWitness \\<in>  (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>)  runHead )\" by (simp add: language_for_rule_def)\n    qed\n    have \"nodesTail \\<noteq> [] \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> newWitness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE parent children)\"\n    proof -\n      have b130 : \"\\<delta>\\<^sub>\\<tau> newWitness = fimage (append [parent]) ((\\<Union>| (fimage \\<Pi> (finsert downWitness  (childrenSet mirror) ))) |\\<union>|  (finsert [] {||})) \" by (simp add: newWitness_def)\n      have b131 : \"\\<delta>\\<^sub>\\<tau> (NODE parent children) = fimage (append [parent]) ((\\<Union>| (fimage \\<Pi> children)) |\\<union>|  (finsert [] {||}))\" by (simp add: newWitness_def)\n      from b120 have b500 : \"nodesTail \\<noteq> [] \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> downWitness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> child2\" by auto\n      from b103 b500 have b118 : \"nodesTail \\<noteq> [] \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> downWitness |\\<subseteq>| (\\<Union>| (fimage \\<Pi> children))\" by (metis ffUnion_upper fimage_eqI inf.orderE le_infI2 notin_fset)\n      from b116 have  \"\\<Pi> mirror |\\<subseteq>| \\<Pi> (down nodesRoot)\" by auto\n      have b117 : \"\\<And> mirrorChild . mirrorChild |\\<in>|  (childrenSet mirror) \\<Longrightarrow> (\\<delta>\\<^sub>\\<tau>  mirrorChild) |\\<subseteq>| (\\<Union>| (fimage \\<Pi> children)) |\\<union>|  (finsert [] {||})\"\n      proof -\n        fix mirrorChild\n        assume \"mirrorChild |\\<in>|  (childrenSet mirror)\"\n        show \"(\\<delta>\\<^sub>\\<tau>  mirrorChild) |\\<subseteq>| (\\<Union>| (fimage \\<Pi> children)) |\\<union>|  (finsert [] {||})\"\n        proof\n          fix q\n          assume \"q |\\<in>| (\\<delta>\\<^sub>\\<tau>  mirrorChild)\"\n          then have \"(root mirror)#q |\\<in>| \\<Pi> mirror\" using \\<Pi>.simps \\<open>mirrorChild |\\<in>| childrenSet mirror\\<close> childrenSet.simps paths_def root.simps            by (metis root.elims) \n          then have \"(root mirror)#q |\\<in>| \\<Pi> (down nodesRoot)\" using b116 by auto\n          then have \"q \\<noteq> [] \\<Longrightarrow> \\<exists> nchild . nchild |\\<in>| childrenSet (down nodesRoot) \\<and> q |\\<in>| \\<Pi> nchild\" using pathsOfChildren list.exhaust            by (smt list.inject) \n          then show \"q |\\<in>| \\<Union>| (\\<delta>\\<^sub>\\<tau> |`| children) |\\<union>|  (finsert [] {||})\" using a2 b100 by auto \n        qed\n      qed\n      from b117 b118  have b119 : \"nodesTail \\<noteq> [] \\<Longrightarrow> (\\<Union>| (fimage \\<Pi> (finsert downWitness  (childrenSet mirror) )))|\\<subseteq>| (\\<Union>| (fimage \\<Pi> children)) |\\<union>|  (finsert [] {||})\" \n        using fPowI ffUnion_Pow_eq ffUnion_mono fimage_fsubsetI finsertE        by (smt ffUnionI finsert_absorb fsubset_finsert funion_finsert_right sup_bot.right_neutral) \n      from b130 b131 show \"nodesTail \\<noteq> [] \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> newWitness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE parent children)\" using fimage_mono \n      proof -\n        assume \"nodesTail \\<noteq> []\"\n        hence b130i : \"(\\<Union>| (fimage \\<Pi> (finsert downWitness  (childrenSet mirror) )))|\\<subseteq>| (\\<Union>| (fimage \\<Pi> children)) |\\<union>|  (finsert [] {||})\" using b119 by auto\n        then have b130l : \"fimage (append [parent]) ((\\<Union>| (fimage \\<Pi> (finsert downWitness  (childrenSet mirror) ))) |\\<union>|  (finsert [] {||})) |\\<subseteq>| fimage (append [parent]) ((\\<Union>| (fimage \\<Pi> children)) |\\<union>|  (finsert [] {||}))\" by auto\n        from b130 have b130h : \"\\<delta>\\<^sub>\\<tau> newWitness = fimage (append [parent]) ((\\<Union>| (fimage \\<Pi> (finsert downWitness  (childrenSet mirror) ))) |\\<union>|  (finsert [] {||})) \" by auto\n        hence \"\\<delta>\\<^sub>\\<tau> newWitness |\\<subseteq>| fimage (append [parent]) ((\\<Union>| (fimage \\<Pi> children)) |\\<union>|  (finsert [] {||}))\"          using b130l by auto \n        then show \"\\<delta>\\<^sub>\\<tau> newWitness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE parent children)\" using \\<Pi>.simps by auto\n      qed\n    qed\n    have \" nodesTail \\<noteq> [] \\<Longrightarrow>p |\\<in>| \\<delta>\\<^sub>\\<tau> newWitness\" using a2 a4 b100 b101 b120 newWitness_def by auto \n    have \" nodesTail \\<noteq> [] \\<Longrightarrow> (newWitness \\<in>  (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>)  runHead) \\<and> \\<delta>\\<^sub>\\<tau> newWitness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE parent children) \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> newWitness)\" using \n        \\<open>nodesTail \\<noteq> [] \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> newWitness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE parent children)\\<close> \\<open> nodesTail \\<noteq> [] \\<Longrightarrow>newWitness \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) runHead\\<close> \\<open> nodesTail \\<noteq> [] \\<Longrightarrow>p |\\<in>| \\<delta>\\<^sub>\\<tau> newWitness\\<close> by auto \n    then have k99 : \" nodesTail \\<noteq> [] \\<Longrightarrow> \\<exists>witness. witness \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) (hd run) \\<and> \\<delta>\\<^sub>\\<tau> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE parent children) \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> witness\" using b109 by auto\n    have k98 : \" nodesTail = [] \\<Longrightarrow> \\<exists>witness. witness \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) (hd run) \\<and> \\<delta>\\<^sub>\\<tau> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE parent children) \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> witness\"\n    proof -\n      assume k100 : \" nodesTail = []\"\n      from b117 b109 have \"mirror \\<in> (Z \\<N> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) (hd run)))\" by auto\n      then have q1 : \"mirror \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) (hd run)\" using Z_def by blast\n      from b116  a2 b100 v100 have q2 : \"\\<delta>\\<^sub>\\<tau> mirror |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE parent children)\"  by metis\n      from b106 have b106b : \"nodeListFitsPath pTail nodesTail\" by auto\n      then have b150 : \"pTail = []\" using k100  nodeListFitsPath.elims(2) by blast \n      have q3 : \"p |\\<in>| \\<delta>\\<^sub>\\<tau> mirror\"\n      proof -\n        from b101 b150 have b152 : \"p = [pHead]\" by auto\n        from a4 nodeListFitsPath.simps(2) b100 b101 have b160 : \"pHead = (root (down nodesRoot))\" by auto\n        then have b161 : \"pHead = (root (down (hd nodeList)))\" using b100 by auto\n        from a2 b161 root.simps have b151 : \"pHead = parent\" by auto \n        from q1 root.simps have b154 : \" (root mirror = symbol  (hd run))\"\n          using \\<open>labelOfNode nodesRoot = root mirror\\<close> b109 b130 by auto   \n        have u7687 :  \"symbol  (hd run) = parent\"\n          using \\<open>labelOfNode nodesRoot = root mirror\\<close> b111 b130 b151 b154 b160 by auto         \n        from b154 b151 b152 u7687 have b153 : \"[parent] |\\<in>| \\<delta>\\<^sub>\\<tau> mirror\" using \\<Pi>.simps root.elims\n        proof -\n          from b154 b151 b152 u7687 have \"parent = root mirror\" by auto\n          then show \"[parent] |\\<in>| \\<delta>\\<^sub>\\<tau> mirror\" using rootIsPath root.simps                by (metis childrenSet.cases)  \n        qed\n        from b151 b153 b152 show  \"p |\\<in>| \\<delta>\\<^sub>\\<tau> mirror\" by auto\n      qed\n      from q1 q2 q3 show \"\\<exists>witness. witness \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) (hd run) \\<and> \\<delta>\\<^sub>\\<tau> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE parent children) \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> witness\" by auto \n    qed\n    have k97 : \" nodesTail = [] \\<or>  nodesTail \\<noteq> []\" by auto\n    from k99 k98 k97 show \"\\<exists>witness. witness \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>) (hd run) \\<and> \\<delta>\\<^sub>\\<tau> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> (NODE parent children) \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> witness\" by auto\n  qed\nqed\n  \n  \nlemma pathsForestTree:\n  fixes t\n  shows \"\\<Union>| (\\<Pi> |`| (finsert t {||})) =  \\<Pi> t\"\n  using fimageE ffUnion_upper by auto\n    \n    \nlemma treeInForestLang :\n  assumes \"f \\<in> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>)  rule\"\n  defines \"forest == (finsert f {||})\"\n  shows \"forest \\<in> \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) rule\"\nproof -\n  have \"tree_for_rule (\\<A> \\<ii>) rule f\" using assms language_for_rule_def by auto\n  have a1 : \"(\\<forall>tree.(tree|\\<in>|forest \\<longrightarrow>  tree_for_rule (\\<A> \\<ii>) rule tree))\" by (simp add: \\<open>tree_for_rule (\\<A> \\<ii>) rule f\\<close> forest_def)\n  from forest_language_for_rule_def a1 show \"forest \\<in> \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) rule\"\n    by (simp add: forest_language_for_rule_def finsertI1 forest_def) \nqed\n  \nlemma inUplus :\n  fixes l L f\n  assumes \"l |\\<in>| L\"\n  assumes \"f \\<in> l\"\n  shows \"f \\<in> \\<Uplus> L\"\n  using assms(1) assms(2) biguplusForests_def by blast\n    \n    \nlemma inUplusRules :\n  assumes \"r |\\<in>| \\<R> \\<ii>\"\n  assumes \"f \\<in> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) r)\"\n  shows \"f \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) |`| (\\<R> \\<ii>))\"\n  using inUplus assms by auto\n    \n    \nlemma existsWitnessTree :\n  fixes \\<ii> f\n  assumes \"height f \\<le> \\<N>\"\n  shows \"\\<And> \\<R> .  \\<And> p . (  p |\\<in>| \\<Pi> f \\<Longrightarrow>\n                        f |\\<in>| (\\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>1 \\<R> \\<ii>)) \\<Longrightarrow>\n                         (\\<exists> witness .(witness \\<in> (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>)))))) \\<and>  pathsInForest witness  |\\<subseteq>| \\<Pi> f \\<and> p |\\<in>| pathsInForest witness)))\"\nproof -\n  fix p \\<R>\n  assume \"p |\\<in>| \\<Pi> f\"\n  def nodes == \"(nodeListForPath p f)\"\n  have \"nodeListFitsPath p nodes\" by (simp add: \\<open>p |\\<in>| \\<delta>\\<^sub>\\<tau> f\\<close> nodeListForPathExists nodes_def)\n  have \"nodes \\<in> (pathsInTree f)\"\n    by (simp add: \\<open>p |\\<in>| \\<delta>\\<^sub>\\<tau> f\\<close> nodeListFitsTree nodes_def)\n  assume \"f |\\<in>| (\\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>1 \\<R> \\<ii>))\"\n  have \"pathSatisfiesApproximatorForRuleSet nodes (\\<R> \\<ii>) \\<ii>\" by (metis \\<P>\\<^sub>1_def \\<open>f |\\<in>| \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>1 \\<R> \\<ii>)\\<close> \\<open>nodes \\<in> pathsInTree f\\<close> mem_Collect_eq satisfiesApproximatorForRuleSet_def zIntersectLemma)\n  obtain run where o3 : \"(hd run |\\<in>| (\\<R> \\<ii>)) \\<and>\n                      (pathFitsListAndListIsARun \\<ii> nodes run)\" using \\<open>pathSatisfiesApproximatorForRuleSet nodes (\\<R> \\<ii>) \\<ii>\\<close> pathSatisfiesApproximatorForRuleSet_def by auto\n  have h657 : \"isAPathp nodes\" using \\<open>nodes \\<in> pathsInTree f\\<close> pathsInTree_def by auto\n  have \"down (hd nodes) = f\" by (metis (no_types, lifting) \\<open>nodes \\<in> pathsInTree f\\<close> hasRoot list.sel(1) noEmptyPathsInTree nodeListForPath.elims nodes_def)\n  from h657 isAPath.simps have \"nodes \\<noteq> []\"    using isAPath_def by blast \n  then have o1 : \" \\<exists> witness . \n (witness \\<in> ((((((\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>))  (hd run))))))\n  \\<and> \\<delta>\\<^sub>\\<tau> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> f\n  \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> witness)\" using \\<open>down (hd nodes) = f\\<close> \\<open>hd run |\\<in>| \\<R> \\<ii> \\<and> pathFitsListAndListIsARun \\<ii> nodes run\\<close> \\<open>isAPathp nodes\\<close> \\<open>nodeListFitsPath p nodes\\<close> existsWitnessTree2 assms by auto \n  show \"\\<exists>witness. witness \\<in>  \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) |`| \\<R> \\<ii>) \\<and> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> f \\<and> p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witness\"\n  proof -\n    from o1 obtain witness where o2 : \"(witness \\<in> ((((((\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> \\<ii>))  (hd run)))))) \\<and> \\<delta>\\<^sub>\\<tau> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> f  \\<and> p |\\<in>| \\<delta>\\<^sub>\\<tau> witness)\" by auto\n    define witnessForest where \"witnessForest == (finsert witness {||})\"\n    from o2 o3 treeInForestLang have \"witnessForest \\<in> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) (hd run))\" using witnessForest_def by auto \n    then have \"witnessForest \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) |`| \\<R> \\<ii>)\" using o3 inUplusRules by auto\n    have \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest =  \\<delta>\\<^sub>\\<tau> witness\"\n    proof -\n      have \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest = \\<Union>| (\\<Pi> |`| (finsert witness {||}))\"\n        by (simp add: pathsInForest_def witnessForest_def) \n      then show \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest =  \\<delta>\\<^sub>\\<tau> witness\" using pathsForestTree by auto \n    qed\n    from o2 witnessForest_def have \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest |\\<subseteq>| \\<delta>\\<^sub>\\<tau> f\" using \\<open>\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest = \\<delta>\\<^sub>\\<tau> witness\\<close> by auto\n    from o2 witnessForest_def have \"p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest\" using \\<open>\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest = \\<delta>\\<^sub>\\<tau> witness\\<close> by auto\n    show \"\\<exists>witness. witness \\<in>  \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) |`| \\<R> \\<ii>) \\<and> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witness |\\<subseteq>| \\<delta>\\<^sub>\\<tau> f \\<and> p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witness\" using \\<open>\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest |\\<subseteq>| \\<delta>\\<^sub>\\<tau> f\\<close> \\<open>p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest\\<close> \\<open>witnessForest \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) |`| \\<R> \\<ii>)\\<close> by auto\n  qed\nqed\n  \nlemma smallerThanN :\n  fixes \\<ii> f\n  assumes \"n \\<le> \\<N>\"\n  shows \"\\<And> \\<R> .   (  \n                        f |\\<in>| (\\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>1 \\<R> \\<ii>)) \\<Longrightarrow>\n                        \\<Pi> f \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>)))))))\"\nproof -\n  fix \\<R>\n  assume a2 : \"f |\\<in>| (\\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>1 \\<R> \\<ii>))\"\n  have \"height f \\<le> \\<N>\" by (smt Z_def \\<Z>\\<tau>_lemma \\<open>f |\\<in>| \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>1 \\<R> \\<ii>)\\<close> assms dual_order.trans fmember.rep_eq mem_Collect_eq)\n  then have a1: \"\\<And> p . (  p |\\<in>| \\<Pi> f \\<Longrightarrow>\n                        f |\\<in>| (\\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>1 \\<R> \\<ii>)) \\<Longrightarrow>\n                         (\\<exists> witness .(witness \\<in> (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>)))))) \\<and>  pathsInForest witness  |\\<subseteq>| \\<Pi> f \\<and> p |\\<in>| pathsInForest witness)))\" using existsWitnessTree by auto\n  def collectWitnesses == \"\\<lambda> p .  (SOME witness .(witness \\<in> (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>)))))) \\<and>  pathsInForest witness  |\\<subseteq>| \\<Pi> f \\<and> p |\\<in>| pathsInForest witness))\"\n  from a1 collectWitnesses_def a2 someI have \n    a3 : \"\\<And> p . (  p |\\<in>| \\<Pi> f \\<Longrightarrow> ((collectWitnesses p) \\<in> (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>)))))) \\<and>  pathsInForest (collectWitnesses p)  |\\<subseteq>| \\<Pi> f \\<and> p |\\<in>| pathsInForest (collectWitnesses p)))\" by (metis (mono_tags, lifting))   \n  def witnessForest == \"\\<Union>| (collectWitnesses |`| (\\<Pi> f))\"\n  have \"\\<Pi> f = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest\"\n  proof \n    show \"\\<delta>\\<^sub>\\<tau> f |\\<subseteq>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest\"\n    proof \n      fix p\n      assume \"p|\\<in>| \\<delta>\\<^sub>\\<tau> f\"\n      then have \" p |\\<in>| pathsInForest (collectWitnesses p)\" using a3 by auto\n      then have \"p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (\\<Union>| (collectWitnesses |`| (\\<Pi> f)))\" by (smt \\<open>p |\\<in>| \\<delta>\\<^sub>\\<tau> f\\<close> ffUnionI ffUnionLemma ffUnion_Pow_eq ffsubset_Pow_Union fimageE fimage_finsert finsert_fsubset mk_disjoint_finsert pathsInForest_def)\n      then show \"p |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest\" using witnessForest_def by auto\n    qed\n    show \" \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest |\\<subseteq>| \\<delta>\\<^sub>\\<tau> f\"\n    proof -\n      from witnessForest_def have  \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (\\<Union>| (collectWitnesses |`| (\\<Pi> f)))\" by auto\n      from a3 have \"\\<And> f2 . f2 |\\<in>| ((collectWitnesses |`| (\\<Pi> f))) \\<Longrightarrow> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f2 |\\<subseteq>| \\<delta>\\<^sub>\\<tau> f\" using fimageE by auto\n      have a4 : \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest = \\<Union>| (\\<Pi> |`| witnessForest)\" by (simp add: pathsInForest_def) \n      from witnessForest_def have \"\\<And> f2 . f2 |\\<in>| witnessForest \\<Longrightarrow> (\\<exists> p2 . p2 |\\<in>| (\\<Pi> f) \\<and> f2 |\\<in>| (collectWitnesses p2))\" using ffUnionLemma fimageE by auto\n          \n      then have \"\\<And> f2 . f2 |\\<in>| witnessForest \\<Longrightarrow> (\\<exists> p2 . p2 |\\<in>| (\\<Pi> f) \\<and> \\<Pi> f2 |\\<subseteq>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (collectWitnesses p2))\" using pathsInForest_def by fastforce\n      then have \"\\<And> f2 . f2 |\\<in>| witnessForest \\<Longrightarrow> (\\<Pi> f2 |\\<subseteq>| \\<Pi> f)\" using a3 by fastforce\n      then show \" \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest |\\<subseteq>| \\<delta>\\<^sub>\\<tau> f\" using a4 pathsInForest_def using fPowI ffUnion_Pow_eq ffUnion_mono fimage_fsubsetI by fastforce\n    qed\n  qed\n  have \"witnessForest \\<in> (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>))))))\"\n  proof -\n    from a3 have  \"\\<And> p . (  p |\\<in>| \\<Pi> f \\<Longrightarrow> ((collectWitnesses p) \\<in> (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>))))))))\" by auto\n    then show \"witnessForest \\<in> (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>))))))\" using biguplusForests_def      by (smt ffUnionI ffUnionLemma fimageE fset_rev_mp fsubsetI mem_Collect_eq witnessForest_def) \n  qed\n  show \"\\<delta>\\<^sub>\\<tau> f \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) |`| \\<R> \\<ii>)\" using \\<open>\\<delta>\\<^sub>\\<tau> f = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> witnessForest\\<close> \\<open>witnessForest \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) |`| \\<R> \\<ii>)\\<close> by auto \nqed\n  \n  (* ============================================== *)\n  \n  \nlemma differentPZLemma:\n  shows \"UNION (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2) fset =  \\<Pi>\\<^sub>\\<phi> ((\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))\"\nproof -\n  from \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta>_def have \"UNION (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2) fset = UNION (\\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1) |`| Sa1) \\<inter> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2) |`| Sa2)) fset\" by auto\n  from \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>_def have a1 : \"\\<Pi>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2) = \\<Pi>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1) \\<inter> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))\" by auto\n  have \"\\<And> k .\\<Pi>\\<^sub>\\<phi> (k) = UNION (\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> `(k)) fset\" using pathsArbitraryUnionLemma    by auto  \n  hence \"\\<And> k l .\\<Pi>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<phi> ` k \\<inter> \\<Psi>\\<^sub>\\<phi> ` l) = UNION (\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> `(\\<Psi>\\<^sub>\\<phi> ` k \\<inter> \\<Psi>\\<^sub>\\<phi> ` l)) fset\" by auto\n  then have \"\\<Pi>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2) = UNION (\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1) \\<inter> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))) fset\" using a1 by auto\n  have \"(\\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1) |`| Sa1) \\<inter> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2) |`| Sa2)) = (\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1) \\<inter> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2)))\" using \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta>_def \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>_def psiDeltaPsi by presburger \n  show ?thesis    using \\<open>UNION (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2) fset = UNION (\\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1) |`| Sa1) \\<inter> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2) |`| Sa2)) fset\\<close> \\<open>\\<Pi>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2) = UNION (\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1) \\<inter> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))) fset\\<close> \\<open>\\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1) |`| Sa1) \\<inter> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> \\<circ> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2) |`| Sa2) = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1 |`| Sa1) \\<inter> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2 |`| Sa2))\\<close> by presburger \nqed\n  \n  \nlemma nodeListForPath_lemma :\n  fixes p f\n  assumes \"p |\\<in>| \\<delta>\\<^sub>\\<tau> f\"\n  defines \"nodeList \\<equiv> nodeListForPath p f\"\n  shows \"nodeList \\<in> (pathsInTree f)\"\n  by (simp add: assms(1) nodeListFitsTree nodeList_def)\n    \n    \n    \n    (* =================================================== *)\n    \n    (* Here, the goal is to show the difficult direction for depth > N (the Main Lemma from the writeup) *)\n    \n    \nlemma emptyPathNotInI :\n  assumes \"    I \\<in> \\<I>\"\n  shows \"[] \\<notin> I\"\nproof -\n  from assms obtain language1 language2 where \"I = ((\\<Pi>\\<^sub>\\<phi> language1)) -(\\<Pi>\\<^sub>\\<delta>  language2)\" using \\<I>_def\n    by (smt image_iff mem_Collect_eq) \n  from pathsForForestLanguage_def pathsInForest_def \\<Pi>.simps have \"[] \\<notin> \\<Pi>\\<^sub>\\<phi> language1\"\n  proof -\n    obtain tt :: \"abc tree fset \\<Rightarrow> abc list \\<Rightarrow> abc tree\" where\n      \"\\<forall>as f. (as |\\<notin>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<or> tt f as |\\<in>| f \\<and> as |\\<in>| \\<delta>\\<^sub>\\<tau> (tt f as)) \\<and> (as |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<or> (\\<forall>t. t |\\<notin>| f \\<or> as |\\<notin>| \\<delta>\\<^sub>\\<tau> t))\"\n      by (metis pathsTreeForest)\n    then have \"\\<nexists>f. f \\<in> language1 \\<and> [] |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f\"\n      by (meson list.distinct(1) noEmptyPathsInPi)\n    then show ?thesis\n      using pathsForForestLanguage_def by auto\n  qed\n  then show ?thesis        using \\<open>I = \\<Pi>\\<^sub>\\<phi> language1 - UNION language2 fset\\<close> by auto \nqed\n  \n  \n  \nlemma finiteMonotoneStationary :\n  fixes w\n  assumes \"\\<And> n . w (Suc n) |\\<subseteq>| w n\"\n  shows \"\\<exists>n.(\\<forall>k0. (n \\<le> k0 \\<longrightarrow> w k0 = w (Suc k0)))\"\nproof \n  def disappearing == \"\\<lambda> z. (\\<exists> n0. z |\\<notin>| w n0)\"\n  def disappearingElements == \"ffilter disappearing (w 0)\"\n  def disappearsAt == \"\\<lambda> z.(SOME n0. z |\\<notin>| w n0)\"\n    \n  have n655876 :  \"\\<And> n1 n2 . n1 \\<ge> n2 \\<Longrightarrow> w n1 |\\<subseteq>| w n2\"\n  proof -\n    fix n1 n2\n    show  \"n1 \\<ge> n2 \\<Longrightarrow> w n1 |\\<subseteq>| w n2\"\n    proof (induct \"n1\")\n      case 0\n      then have \"n2 = 0\" by arith\n      then have \"w 0 = w n2\" by auto\n      then have \"w 0 |\\<subseteq>| w n2\" by auto\n      then show ?case by auto\n    next\n      case (Suc n1)\n      assume n6y76897 : \"n2 \\<le> Suc n1\"\n      show ?case \n      proof (rule disjE)\n        from n6y76897 show \"n1  \\<ge> n2 \\<or> Suc n1 = n2\"  by arith\n        show \"n1  \\<ge> n2 \\<Longrightarrow> w (Suc n1) |\\<subseteq>| w n2 \" using assms Suc.hyps by auto\n        show \"Suc n1 = n2 \\<Longrightarrow> w (Suc n1) |\\<subseteq>| w n2 \"  by auto\n      qed\n    qed\n  qed\n    \n  have n675687 : \"\\<And>z . disappearing z \\<Longrightarrow> (\\<And> n . n \\<ge> (disappearsAt z) \\<Longrightarrow> z |\\<notin>| (w n))\"\n  proof -\n    fix z\n    assume \"disappearing z\"\n    then obtain n0 where \"z |\\<notin>| w n0\" using disappearing_def by auto\n    hence n5r87 :  \"z |\\<notin>| w (disappearsAt z)\" using disappearsAt_def someI_ex by metis\n    fix n\n    show \"n \\<ge> (disappearsAt z) \\<Longrightarrow> z |\\<notin>| (w n)\"\n    proof (induct \"n\" arbitrary: ks rule: less_induct)\n      case (less x)\n      then show ?case using n5r87 n655876 by blast \n    qed\n  qed\n    \n  def n == \"maxFset (disappearsAt |`| (ffilter disappearing (w 0)))\"\n  show \"(\\<forall>k0. (n \\<le> k0 \\<longrightarrow> w k0 = w (Suc k0)))\"\n  proof\n    fix k0\n    show \" n \\<le> k0 \\<longrightarrow> w k0 = w (Suc k0)\"\n    proof\n      assume n7575 : \" n \\<le> k0\"\n      show \" w k0 = w (Suc k0)\"\n      proof (rule ccontr)\n        assume \"w k0 \\<noteq> w (Suc k0)\"\n        then obtain differing where n54877 : \"differing |\\<in>| w k0\" and n76686 : \"differing |\\<notin>| w (Suc k0)\" using assms\n          by blast \n        then have \"differing |\\<in>| w 0\" using n655876\n          by blast \n        then have ny7656876 :  \"differing |\\<in>| (ffilter disappearing (w 0))\" using n76686 disappearing_def by auto\n        then have \"differing |\\<notin>| w (disappearsAt differing)\" using n675687 by simp\n        then have \"differing |\\<notin>| w n\" using n_def ny7656876\n          by (simp add: finiteMaxExists(1) n675687) \n        then have \"differing |\\<notin>| w k0 \" using n7575 n655876 by auto\n        then show \"False\" using n54877 by auto\n      qed\n    qed\n  qed\nqed\n  \n  \n    \n    \nlemma core_main_lemma :\n  fixes l\n  fixes \\<R>\n  fixes n\n  fixes j          \n  fixes \\<alpha>\n    assumes allRulesArePresent : \"(\\<And>i rule. rule |\\<in>| rule_set (\\<A> i))\"\n  assumes   rulesLangsNonempty : \"\\<And> \\<R> i r . (r |\\<in>| rule_set (\\<A> i) \\<Longrightarrow>  ((\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) r)  \\<noteq> {}))\"\n  assumes \"\\<And> r i. r |\\<in>| \\<R> i \\<Longrightarrow> (r |\\<in>| rule_set (\\<A> i) \\<and> symbol r = \\<alpha>)\"\n  assumes statesLanguagesNonempty : \"\\<And> \\<ii> r. r |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow>   (\\<And> s . s |\\<in>| (states r) \\<Longrightarrow> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>) s)  \\<noteq> {}))\"\n  assumes alphaIsTransition : \"\\<And> \\<ii> rule . rule |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow> symbol rule = \\<alpha>\"\n  assumes fNotEmpty : \"fset (\\<ff> (Suc n)  \\<R>) \\<noteq> {}\"\n  assumes outerHypothesis : \"\\<And> rs2. (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> n  rs2))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n rs2))\"\n  assumes inStateSet : \"\\<And> \\<ii>. \\<And> r . \\<And> s . r |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> s |\\<in>| state_set (\\<A> \\<ii>)\"\n  assumes nAssum : \"Suc n > \\<N>\"\n  shows \"(\\<exists> k. (\\<ff>\\<^sub>1 n k \\<R>) = {||}) \\<or> (\\<exists>k . ( \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[]}) =  \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((  \\<gg> (Suc n) \\<R>))))\"\nand \"\\<And> k . (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\"\nproof -\n(*  show \"(\\<exists> k. (\\<ff>\\<^sub>1 n k \\<R>) = {||}) \\<or> (\\<not>(\\<exists> k. (\\<ff>\\<^sub>1 n k \\<R>) = {||}))\" by auto*)\n\n(*  show \"(\\<exists> k. (\\<ff>\\<^sub>1 n k \\<R>) = {||}) \\<Longrightarrow> ((\\<exists> k. (\\<ff>\\<^sub>1 n k \\<R>) = {||}) \\<or> (\\<exists>k . ( \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[]}) =  \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((  \\<gg> (Suc n) \\<R>)) \\<and> (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>)))\" by auto*)\n      \n\n      \n  \n  have wSymbol : \"\\<And> k \\<ii> rule . rule |\\<in>| ((\\<W> n k \\<R>) \\<ii>) \\<Longrightarrow> symbol rule = \\<alpha>\" using alphaIsTransition\n    by (meson fset_rev_mp wInR)\n      \n  have firstGoal : \"\\<And>k. (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\" (* (a) *)\n    and secondGoal : \"\\<And>k.(\\<ff>\\<^sub>1 n (Suc k) \\<R>) = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>))\" (* (b) *)\n    and fourthGoal : \"\\<And>k.(\\<exists> e . k = Suc e) \\<Longrightarrow> (thereIsAnUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))) \\<Longrightarrow>\n          \\<exists>I\\<in>\\<I>.  (\\<V>\\<^sub>\\<tau> (\\<pi>\\<^sup>1 (chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))))   (\\<pi>\\<^sup>2 (  chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))    ))) \\<Turnstile> (\\<alpha> \\<bullet> I) \n                  \\<and> I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) = {}\" (* (d) *)\n    and seventhGoal : \"\\<And>k.(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2)))))\"\n  proof -\n    fix k\n    show secondGoal : \"\\<And>k . (\\<ff>\\<^sub>1 n (Suc k) \\<R>) = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>))\"\n    proof -\n      fix k\n      show  \"(\\<ff>\\<^sub>1 n (Suc k) \\<R>) = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>))\"\n      proof (induct \"k\" arbitrary: ks rule: less_induct)\n        fix k\n        assume hyp2a1 : \"(\\<And> y. y < k \\<Longrightarrow>  \\<ff>\\<^sub>1 n (Suc y) \\<R> = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n y \\<R>)))\"\n        have b64 : \"(\\<ff>\\<^sub>1 n (Suc k) \\<R>) = inf_fset2 (\\<ff>\\<^sub>1 n k \\<R>)  (\\<P>\\<^sub>\\<sigma> (\\<W> n (k) \\<R>))\" by auto\n            \n        show \"(\\<ff>\\<^sub>1 n (Suc k) \\<R>) = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>))\"\n        proof (rule disjE)\n          show \"k = 0 \\<or> k > 0\" by auto\n          {\n            assume \"k > 0\"\n            then obtain e where b65 : \"k = Suc e\"          using gr0_implies_Suc by blast \n            from hyp2a1 b65 have b67 : \"(\\<ff>\\<^sub>1 n k \\<R>) = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n e \\<R>))\" by blast\n            have b66 : \"\\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>)) |\\<subseteq>| \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n e \\<R>))\" by (metis \\<P>\\<sigma>_mono \\<ff>\\<^sub>1.simps(1) b65 fbBoundedDepth finter_mono wMonotonic zIntersectLemmaFin) \n            have b68 : \"(\\<ff>\\<^sub>1 n (Suc k) \\<R>) = (\\<ff>\\<^sub>1 n k \\<R>) |\\<inter>| (\\<Z>\\<^sub>\\<tau> n  (\\<P>\\<^sub>\\<sigma> (\\<W> n (k) \\<R>)))\"\n            proof -\n              have q91 : \"(\\<ff>\\<^sub>1 n k \\<R>) |\\<subseteq>| \\<Z>\\<^sub>\\<tau> n UNIV\" by (simp add: fbBoundedDepth) \n              from zIntersectLemmaFin have q92 : \"(\\<Z>\\<^sub>\\<tau> n  (\\<P>\\<^sub>\\<sigma> (\\<W> n (k) \\<R>))) = inf_fset2 (\\<Z>\\<^sub>\\<tau> n UNIV) (\\<P>\\<^sub>\\<sigma> (\\<W> n (k) \\<R>))\" by metis \n              from q91 q92 show \"(\\<ff>\\<^sub>1 n (Suc k) \\<R>) = (\\<ff>\\<^sub>1 n k \\<R>) |\\<inter>| (\\<Z>\\<^sub>\\<tau> n  (\\<P>\\<^sub>\\<sigma> (\\<W> n (k) \\<R>)))\" by (metis b64 finter_assoc inf_absorb1) \n            qed\n            have b69 : \"(\\<Z>\\<^sub>\\<tau> n  (\\<P>\\<^sub>\\<sigma> (\\<W> n (k) \\<R>))) |\\<subseteq>| (\\<ff>\\<^sub>1 n k \\<R>) \" by (simp add: b66 b67) \n            show \"(\\<ff>\\<^sub>1 n (Suc k) \\<R>) = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>))\" using b66 b67 b68 inf.absorb_iff2 by auto \n          }\n          {\n            assume b62 : \"k=0\"\n            have b63 : \"\\<ff>\\<^sub>1 n (Suc 0) \\<R> = inf_fset2 (\\<ff>\\<^sub>1 n 0 \\<R>)  (\\<P>\\<^sub>\\<sigma> (\\<W> n (0) \\<R>))\" by simp\n            have b64 : \"(\\<ff>\\<^sub>1 n 0 \\<R>) = \\<Z>\\<^sub>\\<tau> n UNIV\" by simp\n            from b63 b64          have \"\\<ff>\\<^sub>1 n (Suc 0) \\<R> =  (\\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n (0) \\<R>)))\"            by (metis zIntersectLemmaFin) \n            then show \"(\\<ff>\\<^sub>1 n (Suc k) \\<R>) = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>))\" using b62 by auto\n          }\n        qed\n      qed\n    qed\n      \n      \n      (* Here, the outer induction hypothesis is used *)\n    show seventhGoal : \"\\<And>k.(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2)))))\"\n    proof -\n      fix k\n      show \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2)))))\"\n      proof -\n        from secondGoal have \"\\<And> k0. k0 \\<le> Suc k \\<Longrightarrow> (\\<ff>\\<^sub>1 n (Suc k) \\<R>) = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>))\" by auto\n        def downRules == \"\\<lambda> \\<ii> . (\\<Union>| (rulesForState \\<ii> |`| (stateSetFromRuleSet (\\<W> n k \\<R> \\<ii>))))\"\n          \n        have m330 : \"\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>) = (\\<P> downRules)\"\n        proof -\n          from satisfiesApproximatorForStatesFromRuleSet_def \\<P>\\<^sub>\\<sigma>_def have m340 : \n            \"\\<And> tr . tr \\<in> \\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>) = (\\<forall>\\<ii>.((\\<forall> p \\<in> (pathsInTree tr) . \n             pathSatisfiesApproximatorForStateFromRuleSet p (\\<W> n k \\<R> \\<ii>) \\<ii>)))\" by blast\n          from satisfiesApproximatorForRuleSet_def  \\<P>_def have m341 :\n            \"\\<And> tr . tr \\<in> \\<P> downRules = (\\<forall>\\<ii>.((\\<forall> p \\<in> (pathsInTree tr) . \n             pathSatisfiesApproximatorForRuleSet  p (downRules \\<ii>) \\<ii>)))\" by blast\n          from pathSatisfiesApproximatorForRuleSet_def have m349 : \"\\<And> \\<ii> p tr. (pathSatisfiesApproximatorForRuleSet  p (downRules \\<ii>) \\<ii> =  (\\<exists> r  . (hd r |\\<in>| (downRules \\<ii>)) \\<and>\n                      (pathFitsListAndListIsARun \\<ii> p r)))\" by blast\n          from pathSatisfiesApproximatorForStateFromRuleSet_def have m350 : \"\\<And> \\<ii> tr p.(pathSatisfiesApproximatorForStateFromRuleSet p (\\<W> n k \\<R> \\<ii>) \\<ii> = \n                (\\<exists> r  . \\<exists>rule. rule |\\<in>| ((\\<W> n k \\<R> \\<ii>)) \\<and> ((stateFromRule  \\<ii> (hd r)) |\\<in>| (states rule)) \\<and>\n                      (pathFitsListAndListIsARun \\<ii> p r)))\" by (metis notin_fset) \n          have m351 : \"\\<And> \\<ii> p tr r. ((pathFitsListAndListIsARun \\<ii> p r) \\<Longrightarrow> (p = [] \\<or> ((hd r |\\<in>| (downRules \\<ii>))) = ( \\<exists>rule. rule |\\<in>| (\\<W> n k \\<R> \\<ii>) \\<and> ((stateFromRule  \\<ii> (hd r)) |\\<in>| (states rule))     )))\"\n          proof -\n            fix \\<ii> p tr r\n            assume g372 : \"(pathFitsListAndListIsARun \\<ii> p r)\"\n            from downRules_def ffUnionLemma have u10 : \"(((hd r |\\<in>| (downRules \\<ii>))) = (\\<exists>state .(state |\\<in>|  (stateSetFromRuleSet (\\<W> n k \\<R> \\<ii>)) \\<and> (hd r) |\\<in>| (rulesForState \\<ii> state))))\" using ffUnionI fimageE fimage_eqI by auto\n            have u11 : \"\\<And> state . ( (state |\\<in>|  (stateSetFromRuleSet (\\<W> n k \\<R> \\<ii>))  = (\\<exists>rule.(rule |\\<in>| (\\<W> n k \\<R> \\<ii>) \\<and> state |\\<in>| states rule))))\"\n            proof\n              from stateSetFromRuleSet_def fimageE  ffUnionLemma  \n              show \"\\<And>state. state |\\<in>| stateSetFromRuleSet (\\<W> n k \\<R> \\<ii>) \\<Longrightarrow> \\<exists>rule. rule |\\<in>| \\<W> n k \\<R> \\<ii> \\<and> state |\\<in>| states rule\" by metis\n              from stateSetFromRuleSet_def ffUnionI  fimage_eqI    \n              show \"\\<And>state. \\<exists>rule. rule |\\<in>| \\<W> n k \\<R> \\<ii> \\<and> state |\\<in>| states rule \\<Longrightarrow> state |\\<in>| stateSetFromRuleSet (\\<W> n k \\<R> \\<ii>)\" by metis\n            qed\n            from rulesForState_def \n            have u12: \"\\<And> state. ((hd r) |\\<in>| (rulesForState \\<ii> state) = ((hd r) |\\<in>| (rule_set (\\<A> \\<ii>)) \\<and> transition (\\<A> \\<ii>) (states (hd r)) (symbol (hd r)) = state))\" by (simp add: ffmember_filter)\n            from u11 have u21 : \"(\\<exists>state .(state |\\<in>|  (stateSetFromRuleSet (\\<W> n k \\<R> \\<ii>)) \\<and> (hd r) |\\<in>| (rulesForState \\<ii> state))) \n           =  (\\<exists>state .((\\<exists>rule.(rule |\\<in>| (\\<W> n k \\<R> \\<ii>) \\<and> state |\\<in>| states rule)) \\<and> (hd r) |\\<in>| (rulesForState \\<ii> state)))  \" by auto\n            from u12 u21 have u22 : \"(\\<exists>state .(state |\\<in>|  (stateSetFromRuleSet (\\<W> n k \\<R> \\<ii>)) \\<and> (hd r) |\\<in>| (rulesForState \\<ii> state))) \n          =  (\\<exists>state .((\\<exists>rule.(rule |\\<in>| (\\<W> n k \\<R> \\<ii>) \\<and> state |\\<in>| states rule)) \\<and> ((hd r) |\\<in>| (rule_set (\\<A> \\<ii>)) \\<and> transition (\\<A> \\<ii>) (states (hd r)) (symbol (hd r)) = state)))\" by auto\n            from u22 u10 have u23 : \"(hd r |\\<in>| (downRules \\<ii>))\n          =  (\\<exists>state .((\\<exists>rule.(rule |\\<in>| (\\<W> n k \\<R> \\<ii>) \\<and> state |\\<in>| states rule)) \\<and> ((hd r) |\\<in>| (rule_set (\\<A> \\<ii>)) \\<and> transition (\\<A> \\<ii>) (states (hd r)) (symbol (hd r)) = state)))\" by auto\n            from u23 have u24 : \"(hd r |\\<in>| (downRules \\<ii>))\n          =  (((\\<exists>rule.(rule |\\<in>| (\\<W> n k \\<R> \\<ii>) \n                       \\<and> (transition (\\<A> \\<ii>) (states (hd r)) (symbol (hd r))) |\\<in>| states rule)) \n                \\<and> ((hd r) |\\<in>| (rule_set (\\<A> \\<ii>)))))\" by auto\n            from g372 hd_Cons_tl pathFitsListAndListIsARun.simps(2) pathFitsListAndListIsARun.simps(3) have u25 : \"((hd r) |\\<in>| (rule_set (\\<A> \\<ii>))) \\<or> p = []\" by (metis)\n            from u24 u25 have u1 : \"p = [] \\<or> (((hd r |\\<in>| (downRules \\<ii>))) = ( \\<exists>rule . (rule |\\<in>| (\\<W> n k \\<R> \\<ii>) \\<and> (transition (\\<A> \\<ii>) (states ((hd r))) (symbol ((hd r))))  |\\<in>| (states rule)  )))\" by metis \n            from stateFromRule_def have u2 : \" ((stateFromRule  \\<ii> (hd r))  = (transition (\\<A> \\<ii>) (states ((hd r))) (symbol ((hd r)))))\" by metis\n            from u1 u2 show \"(p = [] \\<or> (((hd r |\\<in>| (downRules \\<ii>))) =  ( \\<exists>rule . rule |\\<in>| (\\<W> n k \\<R> \\<ii>) \\<and> ((stateFromRule  \\<ii> (hd r)) |\\<in>| (states rule))     )))\" by metis\n          qed\n          have m355 : \"\\<And> \\<ii> p tr. (p = [] \\<or> pathSatisfiesApproximatorForRuleSet  p (downRules \\<ii>) \\<ii> = pathSatisfiesApproximatorForStateFromRuleSet p (\\<W> n k \\<R> \\<ii>) \\<ii> )\"\n          proof -\n            fix \\<ii> p tr\n            from m351  have m94268 : \"\\<And> r  . (p \\<noteq> [] \\<Longrightarrow> (((hd r |\\<in>| (downRules \\<ii>)) \\<and> (pathFitsListAndListIsARun \\<ii> p r))\n                      = (\\<exists>rule. rule |\\<in>| ((\\<W> n k \\<R> \\<ii>)) \\<and> ((stateFromRule  \\<ii> (hd r)) |\\<in>| (states rule)) \\<and>\n                         (pathFitsListAndListIsARun \\<ii> p r))))\" by metis\n            from m94268 show \"(p = [] \\<or> pathSatisfiesApproximatorForRuleSet  p (downRules \\<ii>) \\<ii> = pathSatisfiesApproximatorForStateFromRuleSet p (\\<W> n k \\<R> \\<ii>) \\<ii> )\" using m349 m350 by metis \n          qed\n          from m340 m341 m355 noEmptyPathsInTree have \"\\<And> tr . tr \\<in> \\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>) =  (tr \\<in> \\<P> downRules)\" by metis\n          then show \"\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>) = (\\<P> downRules)\" by auto\n        qed\n        from m330 \\<ff>_def have \"\\<ff> n downRules = \\<Z>\\<^sub>\\<tau> n ( (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>)))\" by simp\n        from m330 \\<ff>_def outerHypothesis have \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Z>\\<^sub>\\<tau> n ( (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>))))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n downRules))\" by auto\n        from \\<gg>_def have \"\\<gg> n downRules = \\<Union>| (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((downRules) \\<aa>\\<^sub>1))((((downRules) \\<aa>\\<^sub>2)))))\" by auto\n        from \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>_def have d544 : \"(\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2))) \n                                = ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>1) |`|  (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1)))))) \n                                    \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> \\<A>\\<^sub>2) |`|  (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2))))))))\" by auto\n        from \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho>_def have d545 : \"(\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((downRules) \\<aa>\\<^sub>1))((((downRules) \\<aa>\\<^sub>2)))) =  \n                                    (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| (downRules \\<aa>\\<^sub>1))))) \n                                              \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| (downRules \\<aa>\\<^sub>2)))))\" by auto\n        have j3653 : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n downRules)) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2))))\"\n        proof -\n          from psiRulesStatesLemma2 allRulesArePresent\n          have \"\\<And>i . ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`|  (stateSetFromRuleSet (\\<W> n k \\<R> i))))))) = (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((\\<Union>| (rulesForState i |`| (stateSetFromRuleSet (\\<W> n k \\<R> i))))))))) \" \n            by auto\n          then have \"\\<And>i . ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i)) |`|  (stateSetFromRuleSet (\\<W> n k \\<R> i))))))) = (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (downRules i))))) \" using downRules_def by auto\n          then have \"\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((downRules) \\<aa>\\<^sub>1))((((downRules) \\<aa>\\<^sub>2))) = \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2))\" using aut_def d544 d545 by metis \n          then have f654 : \"\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((downRules) \\<aa>\\<^sub>1))((((downRules) \\<aa>\\<^sub>2))))) =   \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2))))\" by auto\n          from piUnionLemma have \"\\<And>l. \\<Pi>\\<^sub>\\<tau>\\<^sub>F ( \\<Union>| (\\<Z>\\<^sub>\\<phi> n l)) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n l)\" by auto\n          then show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n downRules)) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2))))\" using f654 \\<gg>_def piUnionLemma by auto\n        qed\n        from piFset have f388525 : \"\\<And>l. \\<Pi>\\<^sub>\\<tau>\\<^sub>F l = (fset (\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> l))\" by auto\n        have f472763 : \"(fset (\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ((\\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>)))))) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2))))\"\n        proof -   \n          from outerHypothesis have j3652 : \"\\<And> rs2. (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> n  rs2))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n rs2))\" by auto (* this is a general fact for depth n, the previous iteration of the outer induction *)\n          then have j3654 : \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> n  downRules))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n downRules))\" by auto\n          then have j3655 : \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> n  downRules))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Union>| (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((downRules) \\<aa>\\<^sub>1))((((downRules) \\<aa>\\<^sub>2))))))\" using \\<gg>_def by auto\n          from j3653 have  \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n downRules)) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2))))\" by auto\n          from j3654 j3653 have j3657 : \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> n  downRules))) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2))))\" by auto\n              \n          from f388525 have j3658 : \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Z>\\<^sub>\\<tau> n (\\<P> downRules)) = (fset (\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ((\\<Z>\\<^sub>\\<tau> n (\\<P> downRules))))))\" by auto\n          from \\<ff>_def j3658 j3657 j3653 have \"(fset (\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ((\\<Z>\\<^sub>\\<tau> n (\\<P> downRules))))) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2))))\"  by auto\n          then  show ?thesis using m330 by auto\n        qed\n        from secondGoal have \"(\\<ff>\\<^sub>1 n (Suc k) \\<R>) = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>))\" by auto\n        then have \"(fset (\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ((\\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n k \\<R>)))))) = (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)))\" using f388525 by auto\n        then show \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n k \\<R> \\<aa>\\<^sub>2)))))\" using f472763 by auto\n      qed\n    qed\n      \n      \n    show fourth: \"\\<And>k.(\\<exists> e . k = Suc e) \\<Longrightarrow> (thereIsAnUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))) \\<Longrightarrow>\n          \\<exists>I\\<in>\\<I>.  (\\<V>\\<^sub>\\<tau> (\\<pi>\\<^sup>1 (chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))))   (\\<pi>\\<^sup>2 (  chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))    ))) \\<Turnstile> (\\<alpha> \\<bullet> I) \n                  \\<and> I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) = {}\"\n    proof -\n      fix k\n      show \"(\\<exists> e . k = Suc e) \\<Longrightarrow> (thereIsAnUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))) \\<Longrightarrow>\n          \\<exists>I\\<in>\\<I>.  (\\<V>\\<^sub>\\<tau> (\\<pi>\\<^sup>1 (chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))))   (\\<pi>\\<^sup>2 (  chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))    ))) \\<Turnstile> (\\<alpha> \\<bullet> I) \n                  \\<and> I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) = {}\"\n      proof -\n        assume kIsSuccessor : \"(\\<exists> e . k = Suc e)\"\n        have \"\\<And> e . ((k = Suc e) \\<Longrightarrow> (thereIsAnUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))) \\<Longrightarrow>\n          \\<exists>I\\<in>\\<I>.  (\\<V>\\<^sub>\\<tau> (\\<pi>\\<^sup>1 (chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))))   (\\<pi>\\<^sup>2 (  chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))    ))) \\<Turnstile> (\\<alpha> \\<bullet> I) \n                  \\<and> I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) = {})\"\n        proof -\n          fix e\n          assume kIsSucE : \"k = Suc e\"\n          show \"thereIsAnUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)) \\<Longrightarrow>\n         \\<exists>I\\<in>\\<I>. \\<V>\\<^sub>\\<tau> (\\<pi>\\<^sup>1 (chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)))) (\\<pi>\\<^sup>2 (chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)))) \\<Turnstile> \\<alpha> \\<bullet> I \\<and> I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>) = {}\"\n          proof -\n            (* we know k is a successor, f1(0) is not interesting *)\n            \n            from kIsSucE have b5392 : \"e \\<le> k\" by arith\n            from b5392 seventhGoal stateSetFromRuleSet_def kIsSucE  have usedHyp : \n              \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>))) \n         = \\<Pi>\\<^sub>\\<phi> ((\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (\\<Union>| (states |`| \\<W> n e \\<R> \\<aa>\\<^sub>1)) (\\<Union>| (states |`| \\<W> n e \\<R> \\<aa>\\<^sub>2)))))\" by metis\n            assume 0 : \"thereIsAnUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))\"\n            def chosen == \"chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))\"\n            def chosenSide == \"\\<pi>\\<^sup>1 chosen\"\n            def chosenRule == \"\\<pi>\\<^sup>2 chosen\"\n              \n            have r483 : \"chosenRule |\\<in>| ((\\<W> n k \\<R>) chosenSide)\" \n              and y71 : \"\\<not> (realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> chosenSide) chosenRule) (\\<alpha> \\<bullet> ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>))) \\<union> {[]})))\"\n            proof -\n              from chosen_def chosenUnrealizedRule_def have u2 : \"chosen = (SOME x. x \\<in> (unrealizedRules (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))))\" by auto\n              from 0 thereIsAnUnrealizedRule_def u2 someI have u4 : \"chosen \\<in> (unrealizedRules (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>))))\" by fast\n              from u4 unrealizedRules_def  have u5a: \"(\\<pi>\\<^sup>2 chosen) |\\<in>| ((\\<W> n k \\<R>) (\\<pi>\\<^sup>1 chosen)) \" by auto\n              have n76587 : \"symbol (\\<pi>\\<^sup>2 chosen) = \\<alpha>\" using wSymbol u5a by auto\n              from u5a u4 unrealizedRules_def  n76587\n              have u5: \"(\\<pi>\\<^sup>2 chosen) |\\<in>| ((\\<W> n k \\<R>) (\\<pi>\\<^sup>1 chosen)) \n                 \\<and> (\\<not> (realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> (\\<pi>\\<^sup>1 chosen)) (\\<pi>\\<^sup>2 chosen)) (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[]}))))\" by auto  \n              from u5 chosenSide_def chosenRule_def show  \"chosenRule |\\<in>| ((\\<W> n k \\<R>) chosenSide)\" by auto\n              from u5 chosenSide_def chosenRule_def show  \"\\<not> realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> chosenSide) chosenRule) (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>) \\<union> {[]}))\" by metis\n            qed\n              \n            from r483 wInR alphaIsTransition have v60 : \"symbol chosenRule = \\<alpha>\" by blast\n            from v60 realized_rule_state_reverse   have n6556787 : \" (\\<And>state. state |\\<in>| states chosenRule \\<Longrightarrow> realizedIn (\\<L>\\<^sub>\\<tau>\\<^sub>\\<sigma> (\\<A> chosenSide) state) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>))) \\<Longrightarrow> realizedIn (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> chosenSide) chosenRule) (\\<alpha> \\<bullet> ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[]}))\" by auto\n            from y71 have \"\\<not> (realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> chosenSide) chosenRule) (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>))\\<union> {[]})))\" by metis\n            then have b6567 : \"\\<not> (realizedIn (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> chosenSide) chosenRule) (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[]})))\" using realizedForestTreeRule by auto\n                \n            have \"\\<not> (realizedIn (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> chosenSide) chosenRule) (\\<alpha> \\<bullet> ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[]})))\"\n            proof \n              assume \"(realizedIn (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> chosenSide) chosenRule) (\\<alpha> \\<bullet> ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[]})))\"\n              then obtain g where b657 : \"((g \\<in> (\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> chosenSide) chosenRule)))\" and b54465 : \"(fset (\\<Pi> g) \\<subseteq> (\\<alpha> \\<bullet> ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[]})))\" using realizedIn_def by metis\n              from b6567 realizedIn_def b657 have \"\\<not> ((fset (\\<Pi> g) \\<subseteq> (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[]}  ))))\" by metis\n              then  show \"False\"                      using b54465 by auto\n            qed\n            then obtain badState where b100 : \"badState |\\<in>| states chosenRule\" and b1pre : \"\\<not> (realizedIn (\\<L>\\<^sub>\\<tau>\\<^sub>\\<sigma> (\\<A> chosenSide) badState) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)))\" using n6556787                  by auto \n                \n            from b1pre have b1 : \"\\<not> (realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> chosenSide) badState) ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))))\"              by (simp add: realizedForestTreeState) \n                \n            def Sa1 == \"\\<Union>| (states |`| ( (\\<W> n e \\<R> \\<aa>\\<^sub>1)))\"\n            def Sa2 == \"\\<Union>| (states |`| ( (\\<W> n e \\<R> \\<aa>\\<^sub>2)))\"\n              \n            from r483 wInR have b334 : \"chosenRule |\\<in>| \\<R> chosenSide\" by blast\n            from wInR b100  inStateSet have y85 : \"badState |\\<in>| state_set (\\<A> chosenSide)\"\n              using b334 by auto \n            from wInR Sa1_def inStateSet have y86 : \"Sa1 |\\<subseteq>| state_set \\<A>\\<^sub>1\"      by fastforce\n            from wInR Sa2_def inStateSet have y87 : \"Sa2 |\\<subseteq>| state_set \\<A>\\<^sub>2\"  by fastforce\n                \n                \n            from usedHyp Sa1_def Sa2_def have y73 : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) = \\<Pi>\\<^sub>\\<phi> ((\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)))\" by metis\n                 \n                (* it is enough to know that f1 n k R is a saturation for *some* rule set, it is not important what this rule set is *) \n            from    y85 y86 y87 existsUniformConstant constantIsSuitableForAllStates_def rulesLangsNonempty have y88 : \"constantIsSuitableForStates chosenSide badState Sa1 Sa2 \\<N>\" by metis\n            from y88 constantIsSuitableForStates_def obtain I where y82 : \"I \\<in> \\<I>\" and invokeLemma2 : \"((\\<forall> n . ((Suc n > \\<N>) \\<longrightarrow> ((\\<not>(realizedIn \n                                                           (\\<L>\\<^sub>\\<tau>\\<^sub>\\<sigma> (\\<A> chosenSide) badState)  \n                                                           (\\<Pi>\\<^sub>\\<delta> (fset (\\<Z>\\<^sub>\\<delta> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2) )))\n                                                     ) )\n                                                     \\<longrightarrow> ( ( ( (\\<L>\\<^sub>\\<tau>\\<^sub>\\<sigma> (\\<A> chosenSide) badState) \\<Turnstile> I)\n                                                                       \\<and> ((I \\<inter> \\<Pi>\\<^sub>\\<delta> ((  \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2  ))) = {})\n                                                                      )\n                                                               )\n                                                          )\n                                            )))\" by metis\n            \n            then have \"\\<not> realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> chosenSide) badState) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>))\" using \\<Z>\\<tau>_lemma   b1 y73  realizedForestTreeState realizedForestTreeRule \\<Z>\\<^sub>\\<phi>\\<^sub>F_def by auto\n            then have r105 : \"\\<not> realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> chosenSide) badState) (\\<Pi>\\<^sub>\\<phi> ((\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))))\" using \\<Z>\\<tau>_lemma   b1 y73  realizedForestTreeState realizedForestTreeRule \\<Z>\\<^sub>\\<phi>\\<^sub>F_def by auto\n            then have y75 : \"\\<not> (realizedIn (\\<L>\\<^sub>\\<tau>\\<^sub>\\<sigma> (\\<A> chosenSide) badState) (\\<Pi>\\<^sub>\\<phi> ((fset (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))))))\" using \\<Z>\\<tau>_lemma   b1 y73  realizedForestTreeState realizedForestTreeRule \\<Z>\\<^sub>\\<phi>\\<^sub>F_def by (simp add: \\<Z>\\<^sub>\\<phi>\\<Z>\\<^sub>\\<phi>\\<^sub>Flemma)\n            from y75 notation_lemma1 have r106 : \"\\<not> realizedIn (\\<L>\\<^sub>\\<tau>\\<^sub>\\<sigma> (\\<A> chosenSide) badState) (\\<Pi>\\<^sub>\\<delta> (fset (\\<Z>\\<^sub>\\<delta> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2))))\" by metis\n            from r106 invokeLemma2 nAssum y75 nAssum            have y76 : \"( ( ( (\\<L>\\<^sub>\\<tau>\\<^sub>\\<sigma> (\\<A> chosenSide) badState) \\<Turnstile> I))) \\<and> ((I \\<inter> \\<Pi>\\<^sub>\\<delta> ((  \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2  )))= {}) \" by metis\n                \n            have y81 : \"I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) = {}\"\n            proof -\n              have y8085 : \"UNION (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2) fset = \\<Pi>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)\" using differentPZLemma \\<Z>\\<tau>_lemma \\<Z>\\<^sub>\\<phi>\\<^sub>F_def by auto\n              from \\<Z>\\<^sub>\\<phi>\\<^sub>F_subset   y76 Int_absorb2 Int_empty_right inf_sup_aci(3) pathsForestLangMonotone \n              have y870 : \"I \\<inter> \\<Pi>\\<^sub>\\<delta> (  (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>\\<^sub>\\<delta> Sa1 Sa2)) = {}\" by metis\n              then have \"I \\<inter> \\<Pi>\\<^sub>\\<phi> (( (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))) = {}\" using y8085 by auto\n              then have y80 : \"I \\<inter> \\<Pi>\\<^sub>\\<phi> ((\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))) = {}\" using \\<Z>\\<tau>_lemma \\<Z>\\<^sub>\\<phi>\\<^sub>F_def pathsForestLangMonotone\n              proof -\n                obtain aas :: \"abc list set \\<Rightarrow> abc list set \\<Rightarrow> abc list\" where\n                  \"\\<forall>x0 x1. (\\<exists>v2. v2 \\<in> x1 \\<and> (\\<exists>v3. v3 \\<in> x0 \\<and> v2 = v3)) = (aas x0 x1 \\<in> x1 \\<and> (\\<exists>v3. v3 \\<in> x0 \\<and> aas x0 x1 = v3))\"\n                  by moura\n                then obtain aasa :: \"abc list set \\<Rightarrow> abc list set \\<Rightarrow> abc list\" where\n                  f1: \"\\<forall>A Aa. (A \\<inter> Aa \\<noteq> {} \\<or> (\\<forall>as. as \\<notin> A \\<or> (\\<forall>asa. asa \\<notin> Aa \\<or> as \\<noteq> asa))) \\<and> (A \\<inter> Aa = {} \\<or> aas Aa A \\<in> A \\<and> aasa Aa A \\<in> Aa \\<and> aas Aa A = aasa Aa A)\"\n                  by moura\n                then have \"aas (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))) I \\<notin> I \\<or> aasa (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))) I \\<notin> \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2)) \\<or> aas (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))) I \\<noteq> aasa (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2))) I\"\n                  by (meson \\<Z>\\<^sub>\\<phi>\\<^sub>F_subset \\<open>I \\<inter> \\<Pi>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> Sa1 Sa2) = {}\\<close> pathsForestLangMonotone rev_subsetD)\n                then show ?thesis\n                  using f1 by meson\n              qed (*     by (metis (no_types, lifting) IntD2 \\<Z>\\<^sub>\\<phi>\\<^sub>F_subset disjoint_iff_not_equal inf.orderE) *)\n              from y80 y73 show \"I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) = {}\" by simp\n            qed\n              \n            from b334 alphaIsTransition have b333 : \"symbol chosenRule = \\<alpha>\" by metis\n                \n            from y76 \\<V>\\<^sub>\\<tau>_def have z2 : \"(\\<V>\\<^sub>\\<tau> chosenSide chosenRule) \\<Turnstile> (\\<alpha> \\<bullet> I)\"  (* TODO can this replace the rootOfV lemma? *)\n            proof -\n              from b333 entails_def y76 b100 have y91 : \"\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> chosenSide) chosenRule \\<subseteq> existential_satisfaction_set (\\<alpha> \\<bullet> I)\"                using entailsStateRule by fastforce \n              from necess_def have  \"necess (\\<A> chosenSide) \\<I> chosenRule = op \\<bullet> (symbol chosenRule) ` {i \\<in> \\<I> . \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> chosenSide) chosenRule \\<subseteq> existential_satisfaction_set (symbol chosenRule \\<bullet> i)}\" by metis\n              then have h655 : \"necess (\\<A> chosenSide) \\<I> chosenRule = op \\<bullet> \\<alpha> ` {i \\<in> \\<I>. \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho>  (\\<A> chosenSide) chosenRule \\<subseteq> existential_satisfaction_set (\\<alpha> \\<bullet> i)}\" using b333 by metis\n              from y82 y91 have y94 : \"(\\<alpha> \\<bullet> I) \\<in> (necess (\\<A> chosenSide) \\<I> chosenRule)\" using h655 by blast\n              have y96 : \"\\<V>\\<^sub>\\<tau> chosenSide chosenRule \\<subseteq> existential_satisfaction_set (\\<alpha> \\<bullet> I)\"\n              proof\n                fix tr\n                assume y92 : \"tr \\<in> \\<V>\\<^sub>\\<tau> chosenSide chosenRule\"\n                from y92 \\<V>\\<^sub>\\<tau>_def y94 have y95 : \"\\<Pi> tr \\<in>  (image \\<Pi> (existential_satisfaction_set (\\<alpha> \\<bullet> I))   )\" by auto\n                from y95 lemmaPathExistence show  \"tr \\<in> existential_satisfaction_set (\\<alpha> \\<bullet> I)\" by auto\n              qed\n              from entails_def y96 show \"entails (\\<V>\\<^sub>\\<tau> chosenSide chosenRule) (\\<alpha> \\<bullet> I)\" by auto\n            qed\n            from y81 z2 y82 chosenSide_def chosenRule_def chosen_def show \"\n           \\<exists>I\\<in>\\<I>. \\<V>\\<^sub>\\<tau> (\\<pi>\\<^sup>1 (chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)))) (\\<pi>\\<^sup>2 (chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)))) \\<Turnstile> \\<alpha> \\<bullet> I \\<and> I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>) = {}\" by auto\n          qed\n        qed\n        then show \"(\\<exists> e . k = Suc e) \\<Longrightarrow> (thereIsAnUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))) \\<Longrightarrow>\n          \\<exists>I\\<in>\\<I>.  (\\<V>\\<^sub>\\<tau> (\\<pi>\\<^sup>1 (chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))))   (\\<pi>\\<^sup>2 (  chosenUnrealizedRule (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))    ))) \\<Turnstile> (\\<alpha> \\<bullet> I) \n                  \\<and> I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) = {}\" by auto\n      qed         \n    qed\n      \n    show firstGoalInner : \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\" (* (a) *)\n    proof (induct \"k\" arbitrary: ks rule: less_induct)\n      fix k\n      assume hyp1 : \"(\\<And> y. y < k \\<Longrightarrow> (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n y \\<R>) \"\n        \n      have firstForZero : \"k = 0 \\<Longrightarrow> (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\"\n      proof -\n        assume b1 : \"k = 0\"\n        from factoredFInFa0 alphaIsTransition have b3 : \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n 0 \\<R>\" by auto\n        from b1 b3 show \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\" by simp\n      qed\n        \n      show first : \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\"\n      proof (rule disjE)\n        show \"k = 0 \\<or> (\\<exists>q . (k = Suc q))\" by arith\n        from firstForZero show \"k = 0 \\<Longrightarrow> (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\" by auto\n        show \"(\\<exists>e . (k = Suc e)) \\<Longrightarrow> (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\"\n        proof -\n          assume i500 : \"(\\<exists>e . (k = Suc e))\"\n          from i500 obtain e where i501 : \"k = Suc e\" by auto\n          from hyp1  have previousFirst : \"(\\<And> k0. (k0 < k \\<Longrightarrow> ((\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k0 \\<R>)))\" using antisym_conv2 by auto\n          from fourth have fourthInFifth : \"(\\<And> y.  (\\<exists>e. y = Suc e) \\<Longrightarrow>\n               thereIsAnUnrealizedRule (\\<W> n y \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n y \\<R>))) \\<Longrightarrow>\n               \\<exists>I\\<in>\\<I>. (\\<V>\\<^sub>\\<tau> (\\<pi>\\<^sup>1 (chosenUnrealizedRule (\\<W> n y \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n y \\<R>)))))\n                                    (\\<pi>\\<^sup>2 (chosenUnrealizedRule (\\<W> n y \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n y \\<R>))))))\n                          \\<Turnstile> (\\<alpha> \\<bullet> I) \\<and>\n                          I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n y \\<R>)) = {})\" using less_Suc_eq by auto\n          show \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\"\n          proof (rule disjE)\n            show \"e = 0 \\<or> e > 0\" by auto\n                \n            show \"e = 0 \\<Longrightarrow> \\<alpha> \\<diamondop> \\<ff> (Suc n) \\<R> |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\" \n            proof -\n              assume b655687 : \"e = 0\"\n              have \"(\\<ff>\\<^sub>1 n 0 \\<R>) = \\<Z>\\<^sub>\\<tau> n UNIV\" by simp\n              have \"\\<ff>\\<^sub>1 n (Suc 0) \\<R> = \\<Z>\\<^sub>\\<tau> n  (\\<P>\\<^sub>\\<sigma> (\\<W> n 0 \\<R>))\"                  using secondGoal by metis\n              have \"(\\<W> n 0 \\<R>) = ((\\<R> ))\" by auto\n              then have \"\\<Z>\\<^sub>\\<tau> n  (\\<P>\\<^sub>\\<sigma> (\\<W> n 0 \\<R>)) = \\<Z>\\<^sub>\\<tau> n  (\\<P>\\<^sub>\\<sigma> \\<R>)\" by auto\n              have \"\\<alpha> \\<diamondop> \\<ff> (Suc n) \\<R>|\\<subseteq>| \\<Z>\\<^sub>\\<tau> n  (\\<P>\\<^sub>\\<sigma> \\<R>)\" \n              proof \n                fix x\n                assume \"x |\\<in>| \\<alpha> \\<diamondop> \\<ff> (Suc n) \\<R>\"\n                then obtain tr where n54576 : \"tr |\\<in>| \\<ff> (Suc n) \\<R>\" and n67568 : \"x |\\<in>| childrenSet tr\"  using  factorByRootSymbolF_lemma factorByRootSymbol_def                  using notin_fset by fastforce\n                then have \"tr \\<in> \\<P> \\<R>\"                  using zInP by auto\n                then have \"x \\<in> \\<P>\\<^sub>\\<sigma> \\<R>\" using n67568  approxForRuleAndChildrenStates by auto\n                then show \"x |\\<in>| \\<Z>\\<^sub>\\<tau> n  (\\<P>\\<^sub>\\<sigma> \\<R>)\" using n67568 n54576                      by (metis \\<open>\\<ff>\\<^sub>1 n 0 \\<R> = \\<Z>\\<^sub>\\<tau> n UNIV\\<close> \\<open>x |\\<in>| \\<alpha> \\<diamondop> \\<ff> (Suc n) \\<R>\\<close> fset_mp hyp1 i500 zIntersectLemma zero_less_Suc)\n              qed\n              then have \"\\<alpha> \\<diamondop> \\<ff> (Suc n) \\<R> |\\<subseteq>| \\<ff>\\<^sub>1 n 1 \\<R>\"                using \\<open>\\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n 0 \\<R>)) = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> \\<R>)\\<close> \\<open>\\<ff>\\<^sub>1 n (Suc 0) \\<R> = \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n 0 \\<R>))\\<close> by auto \n              then show \"\\<alpha> \\<diamondop> \\<ff> (Suc n) \\<R> |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\" using b655687 i501 by auto\n            qed\n            show \"0 < e \\<Longrightarrow> \\<alpha> \\<diamondop> \\<ff> (Suc n) \\<R> |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\"\n            proof -\n              assume h65678 : \"0 < e\"\n              then obtain e2 where i509 : \"e = Suc e2\"                  by (metis Suc_pred) \n              have \"thereIsAnUnrealizedRule  (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>))) \\<or> (\\<not> (thereIsAnUnrealizedRule  (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)))))\" by auto\n              show \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\"\n              proof (rule ccontr)\n                assume \"\\<not> ((\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>)\"\n                then obtain t where b574 : \"t |\\<in>| ((\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)))\" and b575 : \"t |\\<notin>| \\<ff>\\<^sub>1 n k \\<R>\" by blast\n                then have b576 : \"t |\\<in>| \\<ff>\\<^sub>1 n e \\<R>\" using previousFirst i501 by blast\n                from secondGoal b576 i509 have \"t |\\<in>| \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n e2 \\<R>))\" by metis\n                from secondGoal b575 i501 have b6545 : \"t |\\<notin>| \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n e \\<R>))\" by metis\n                from b574 have r400 : \" (t |\\<in>| (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)))\" by auto\n                from r400 factorByRootSymbolF_lemma factorByRootSymbol_def \n                obtain p2 where r401 : \"(p2 |\\<in>| ((\\<ff> (Suc n)  \\<R>)))\" and r402 : \"t |\\<in>| childrenSet p2\" using mem_Collect_eq notin_fset by fastforce  (* p2 = t0 *)\n                from r401 r400 fSupportsRules satisfiesApproximatorForRuleSet_def \n                have s502 : \"\\<forall> i . (\\<forall> pi \\<in> (pathsInTree p2) . pathSatisfiesApproximatorForRuleSet pi  (\\<R> i ) i)\" by metis (* g *)\n                    \n                    (* h *)\n                from satisfiesApproximatorForStatesFromRuleSet_def  b6545 \\<P>\\<^sub>\\<sigma>_def\n                have s507 : \"\\<exists> i . (\\<exists> pi \\<in> (pathsInTree t) . \\<not> pathSatisfiesApproximatorForStateFromRuleSet pi  ((\\<W> n e \\<R>) i) i)\" by (smt \\<open>t |\\<in>| \\<Z>\\<^sub>\\<tau> n (\\<P>\\<^sub>\\<sigma> (\\<W> n e2 \\<R>))\\<close> mem_Collect_eq zIntersectLemma)  \n                from s507 obtain i where s8375 : \"(\\<exists> pi \\<in> (pathsInTree t) . \\<not> pathSatisfiesApproximatorForStateFromRuleSet pi  ((\\<W> n e \\<R>) i) i)\" by auto (* h *)\n                    \n                    (* i *)\n                from s8375 s507 r402 approximatorChildren have r405 : \"\\<exists> pi \\<in> (pathsInTree p2) . (\\<not> pathSatisfiesApproximatorForRuleSet pi  ((\\<W> n e \\<R>) i) i)\" by metis\n                from s502 s507 r405 obtain pi (* i *)\n                  where g200 : \"pi \\<in> (pathsInTree p2)\" \n                    and s510 : \"pathSatisfiesApproximatorForRuleSet pi (\\<R> i ) i\" \n                    and s511 : \"\\<not> pathSatisfiesApproximatorForRuleSet pi  ((\\<W> n e \\<R>) i) i\" by metis (* i *)\n                    \n                    (* j *)\n                from s510 pathSatisfiesApproximatorForRuleSet_def have s512 : \"(\\<exists> r  . (hd r |\\<in>| (\\<R> i)) \\<and> (pathFitsListAndListIsARun i pi r))\" by metis\n                    \n                    \n                from s511 pathSatisfiesApproximatorForRuleSet_def have s513 : \"\\<not> (\\<exists> r  . (hd r |\\<in>| ((\\<W> n e \\<R>) i)) \\<and> (pathFitsListAndListIsARun i pi r))\" by metis\n                from s512 s513 obtain run where s514 : \"(hd run |\\<in>| (\\<R> i))\" and  s515 : \"(pathFitsListAndListIsARun i pi run)\" and s516 : \"(hd run |\\<notin>| ((\\<W> n e \\<R>) i))\" by metis\n                def r0 == \"hd run\" (* rho *)\n                  \n                  (* k *)\n                from r0_def s514 s516 have z220 : \"r0 |\\<in>| (\\<R> i) |-| ((\\<W> n e \\<R>) i)\" by (simp add: fminusI) \n                    \n                    (* l *)\n                    (* now we have an evil path and an evil rule *)\n                from r0_def s514 s516 ruleWentMissing obtain k0 \n                  where i1 : \"k0 < e\"\n                    and i2 : \"r0 |\\<in>| ((\\<W> n k0 \\<R>) i)\" \n                    and i3 : \"\\<not> (r0 |\\<in>| ((\\<W> n (Suc k0) \\<R>) i))\" \n                    and i10 : \"chosenUnrealizedRule (\\<W> n k0 \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>))) = (i,r0)\" \n                    and i11 : \"(i,r0) \\<in> (unrealizedRules (\\<W> n k0 \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>))))\"\n                  by metis\n                from i10 have i20 : \"i = (\\<pi>\\<^sup>1 (chosenUnrealizedRule (\\<W> n k0 \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)))))\" by (simp add: fst_conv)\n                from i10 have i21 : \"r0 = (\\<pi>\\<^sup>2 (chosenUnrealizedRule (\\<W> n k0 \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)))))\" by (simp add: snd_conv)\n                    \n                    (* recall the fourth goal *)\n                from  i11 have k0IsSuccessor : \"\\<exists>e. k0 = Suc e\"\n                proof -\n                  have j4657 : \"k0 = 0 \\<Longrightarrow> (\\<ff>\\<^sub>1 n k0 \\<R>) = \\<Z>\\<^sub>\\<tau> n UNIV\" by simp\n                  from realizedInUniv nAssum   rulesLangsNonempty have j4658 : \"\\<And> r \\<ii>. r |\\<in>| rule_set (\\<A> \\<ii>) \\<Longrightarrow> symbol r = \\<alpha> \\<Longrightarrow> ((realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) r) (\\<alpha>  \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Z>\\<^sub>\\<tau> n UNIV) \\<union> {[]}))))\" by auto \n                  from s514 r0_def have j4659 : \"r0 |\\<in>| rule_set (\\<A> i) \\<and> symbol r0 = \\<alpha>\" using assms by metis\n                  have \"k0 = 0 \\<Longrightarrow> (i,r0) \\<notin> (unrealizedRules (\\<W> n k0 \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>))))\"\n                  proof -\n                    from j4658 j4659 j4657 have \"k0 = 0 \\<Longrightarrow> ((realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) r0) (\\<alpha>  \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)) \\<union> {[]}))))\"  by metis\n                    then show \"k0 = 0 \\<Longrightarrow> (i,r0) \\<notin> (unrealizedRules (\\<W> n k0 \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>))))\" using unrealizedRules_def j4659 by blast\n                  qed\n                  then have \"k0 = 0 \\<Longrightarrow> False\" using i11 by arith\n                  then show \"\\<exists>e. k0 = Suc e\" by arith\n                qed\n                  \n                  (* n *)\n                from fourthInFifth i20 i21 k0IsSuccessor have i3 : \"(thereIsAnUnrealizedRule (\\<W> n k0 \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)))) \\<Longrightarrow>\n                                                       \\<exists>I\\<in>\\<I>. (\\<V>\\<^sub>\\<tau> i r0) \\<Turnstile> (\\<alpha> \\<bullet> I) \\<and> I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)) = {}\"\n                  by metis\n                    (* check its conditions *)\n                then have i2630 : \n                  \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k0) \\<R>)) \n                           = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n k0 \\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<W> n k0 \\<R> \\<aa>\\<^sub>2)))))\" using i1 seventhGoal by metis\n                from i2630 stateSetFromRuleSet_def have i4a : \n                  \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k0) \\<R>)) \n                            = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (\\<Union>| (states |`| \\<W> n k0 \\<R> \\<aa>\\<^sub>1))\n                                              (\\<Union>| (states |`| \\<W> n k0 \\<R> \\<aa>\\<^sub>2)))))\" by metis\n                  \n                from aux50 i4a have i4 :\n                  \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k0) \\<R>)) \n                            = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<Union>| (\\<Z>\\<^sub>\\<phi> n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (\\<Union>| (states |`| \\<W> n k0 \\<R> \\<aa>\\<^sub>1))\n                                                   (\\<Union>| (states |`| \\<W> n k0 \\<R> \\<aa>\\<^sub>2)))))))\" by metis                \n                  (* now have concluded existence of I *)\n                from thereIsAnUnrealizedRule_def i11 i3 i4 obtain I \n                  where j300 : \"I \\<in> \\<I>\" \n                    and j301 : \"(\\<V>\\<^sub>\\<tau> i r0) \\<Turnstile> (\\<alpha> \\<bullet> I)\" \n                    and j302 : \"I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)) = {}\" by auto\n                    (* done with n *)      \n                    \n                    (* now we need to get the contradiction *)\n                    (* show that \\<ff> entails I from j300, j301 *)\n                from pathsInTree_def s511 g200 have s506 : \"pi \\<noteq> []\" using list.distinct(1) mem_Collect_eq by blast  \n                have s507 : \"run \\<noteq> []\" by (metis neq_Nil_conv nonMatching s506 s515)\n                def a == \"hd pi\"\n                from r0_def have \"r0 = hd run\" by auto\n                from s506 s507 a_def have s509 : \"(( (down a)) \\<in> ( \\<V>\\<^sub>\\<tau> i r0  )   )\"\n                proof -                                 \n                  from s515 have y600 : \"(pathFitsListAndListIsARun i pi run)\" by auto\n                  from a_def s506 obtain b where c605 : \"pi = (a#b)\" by (metis list.collapse) \n                  from s507 obtain c d where y601 : \"run = (c#d)\" by (metis neq_Nil_conv)\n                  from y601 r0_def have c602 : \"c = r0\" by (simp add: list.sel(1)) \n                  from c605 r0_def a_def pathFitsListAndListIsARunImpliesV s515 s506 s507 c602 show \"(( (down a)) \\<in> ( \\<V>\\<^sub>\\<tau> i r0  )   ) \" by metis\n                qed\n                from \\<V>\\<^sub>\\<tau>_def s509 have s510 : \"(((down a)) \\<in> ( \\<V>\\<^sub>\\<tau> i r0  )   )\" using mem_Collect_eq by auto \n                from s514 z220 r0_def have s508 : \"(hd run) |\\<in>| (\\<R> i |-| ((\\<W> n e \\<R>) i))\" by simp \n                    (* t is a tree that should represent ONE child of something in \\<gg> *)\n                have s511 : \"(down a) = p2\"\n                proof -\n                  from pathsInTree_def g200 show u600 : \"(down a = p2)\"\n                  proof -\n                    have \"isAPathp pi \\<and> (\\<exists>n ns. pi = n # ns \\<and> down n = p2)\" (*isNodeIn n p2 \\<and> isRootNode n)\"*)\n                      using g200 pathsInTree_def by auto\n                    then show ?thesis\n                      using a_def by force\n                  qed\n                qed\n                from s510 s511 have s513 : \"p2 \\<in> ( \\<V>\\<^sub>\\<tau> i r0  )\" by metis\n                from s513 j301 entails_altdef r401 pathsIntersectionLangTree have i22 : \"(\\<alpha> \\<bullet> I) \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>)) \\<noteq> {}\" by (metis r401) \n                from i1 i501 have i1b :  \"k0 \\<le> k\" by arith\n                    (* show that \\<ff> does not entail I from j302 *)\n                from  i1b i1 previousFirst factorByRootSymbolF_lemma fset_rev_mp notin_fset subsetI \n                have  hypFaOverF : \"(\\<alpha> \\<diamondop> ( (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| ( (\\<ff>\\<^sub>1 n k0 \\<R>)))\" by (simp add: i501 less_SucI)\n                have i11 : \"(\\<alpha> \\<bullet> I) \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>)) = {}\"\n                proof (rule ccontr)\n                  assume j310 : \"\\<not> ((\\<alpha> \\<bullet> I) \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>)) = {})\"\n                  from j310 obtain pi0 where j311 : \"pi0 \\<in> (\\<alpha> \\<bullet> I)\" and j312 : \"pi0 \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))\" by blast\n                  from prefixLetter_def j311 obtain tail where j313 : \"pi0 = \\<alpha>#tail\" by blast\n                  from j311 j313 have j315 : \"tail \\<in> I\" using imageE list.inject prefixLetter_def by auto \n                  then have h65787 : \"tail \\<noteq> []\" using j300 emptyPathNotInI by auto\n                  from j302 have t500 : \"I \\<inter> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)) = {}\" by metis\n                  have t316 : \"pi0 \\<notin> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))\"\n                  proof -\n                    from hypFaOverF have t504 : \"(\\<alpha> \\<diamondop> ((\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| ((\\<ff>\\<^sub>1 n k0 \\<R>)))\" by auto\n                    from j313 j312 pathsOfFactorDown h65787 have j314 : \"tail \\<in> \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> (fset (\\<ff> (Suc n)  \\<R>)))\"\n                    proof -\n                      have \"hd tail # tl tail = tail\"                        by (meson h65787 hd_Cons_tl)\n                      then show ?thesis                        by (metis (full_types) j312 j313 pathsOfFactorDown)\n                    qed\n                    have pathsIneq : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>)) \\<subseteq> (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)) \\<union> {[]} ))\" \n                    proof\n                      fix x\n                      assume h653 : \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))\"\n                      from alphaIsTransition fRoot have u6598 : \"\\<And> tr . tr |\\<in>| ((\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> root tr = \\<alpha>\" by metis\n                      have \"\\<exists> tail. x = \\<alpha>#tail\" proof -\n                        from h653 pathsForTreeLanguage_def have \"x \\<in> {p . (\\<exists> t \\<in>  (fset ((\\<ff> (Suc n)  \\<R>))) . p |\\<in>| \\<Pi> t)}\" by auto\n                        then  obtain y where n100 : \"x |\\<in>| \\<Pi> y\" and n101 : \"y \\<in> (fset (\\<ff> (Suc n)  \\<R>))\" by blast\n                        from u6598 n101 have \"root y = \\<alpha>\"\n                          by (meson notin_fset) \n                        then show \"\\<exists> tail. x = \\<alpha>#tail\" using  \\<Pi>.simps n100 root.simps                          using noEmptyPathsInPi by fastforce\n                      qed\n                      then obtain tail where h654 : \"x = \\<alpha>#tail\" by blast\n                      from h653 h654 have h655 : \"tail \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) \\<union> {[]}\"                        using factorByRootSymbolF_lemma(2) pathsOfFactorDown                        by (metis IntI empty_iff j314 j315 less_eq_fset.rep_eq pathsTreeLangMonotone subsetCE t500 t504) \n                      from i501 i1 hyp1 have \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k0 \\<R> \" by auto\n                      then have \"tail \\<in> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>))) \\<union> {[]}\" using  h655 less_eq_fset.rep_eq pathsTreeLangMonotone subsetCE                        by (metis UnCI UnE)\n                      then have \"\\<alpha>#tail \\<in> (\\<alpha> \\<bullet> ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>))) \\<union> {[]} ))\" using prefixLetter_def by blast\n                      then show \"x \\<in> (\\<alpha> \\<bullet> ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)))\\<union> {[]}))\" using h654 by metis\n                    qed\n                    from t500 j315 have t2832 : \"tail \\<notin> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>))\" by blast\n                    then have n64768 : \"\\<alpha>#tail \\<notin> (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>))))\" using imageE list.inject prefixLetter_def by auto\n                    have  \"\\<alpha>#tail \\<notin> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))\" \n                    proof (rule ccontr)\n                      assume k556i87 : \"\\<not> (\\<alpha>#tail \\<notin> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>)))\" \n                      hence \"\\<alpha>#tail \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))\" by auto\n                      hence \"\\<alpha>#tail \\<in>(\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)) \\<union> {[]} ))\" using pathsIneq                            by auto\n                      hence \"tail \\<in> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>)) \\<union> {[]} )\" using prefixLetter_def                        by auto \n                      hence \"\\<alpha>#tail \\<in>(\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k0 \\<R>))))\"                            by (simp add: h65787 t2832) \n                      then show \"False\" using n64768 by auto\n                    qed\n                    then show \"pi0 \\<notin> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))\" using j313 by metis\n                  qed\n                  from j312 t316 show \"False\" by metis\n                qed\n                  (* get contradiction *)\n                from fNotEmpty have i21 : \"fset (\\<ff> (Suc n)  \\<R>) \\<noteq> {}\" by auto\n                from i11 i22 show \"False\" by auto\n              qed\n            qed\n          qed\n        qed   \n      qed\n    qed\n  qed\n    \n    \n    \n    (*    \n    have \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n (Suc e) \\<R>\"\n    proof -\n      from hyp1 hyp5 lessI i501 have c1 : \"\\<And> l . (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>2 n (Suc e) l \\<R>\" by metis\n      have c3 : \"\\<not> ((\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n (Suc e) \\<R>) \\<Longrightarrow> False\"\n      proof -\n        assume d1 : \"\\<not> ((\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n (Suc e) \\<R>)\"\n        from d1 have d2 : \"\\<exists> q . q |\\<in>| (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) \\<and> (\\<not> (q |\\<in>| \\<ff>\\<^sub>1 n (Suc e) \\<R>))\" by auto\n        from d2 obtain q where d2b : \"q |\\<in>| (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) \\<and> (\\<not> (q |\\<in>| \\<ff>\\<^sub>1 n (Suc e) \\<R>))\" by metis\n        from fInterToSets faInFb fa_def2 d2b  nat_le_linear have d3 : \"\\<exists> j. q |\\<in>| (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) \\<and> (\\<not> (q |\\<in>| \\<ff>\\<^sub>2 n (Suc e) j \\<R>))\"  proof -\n           (*from fInterToSets have d21 : \"fset (fInter (\\<lambda>j.(\\<ff>\\<^sub>2 n (Suc e) j \\<R>))) = (\\<Inter> j. fset (\\<ff>\\<^sub>2 n (Suc e) j \\<R>))\" by metis*)\n           from fa_def2 fInterToSets have d22 : \"fset (\\<ff>\\<^sub>1 n (Suc e) \\<R>) = (\\<Inter> j. fset (\\<ff>\\<^sub>2 n (Suc e) j \\<R>))\" by metis\n           from d2b have d20 : \"(\\<not> (q |\\<in>| \\<ff>\\<^sub>1 n (Suc e) \\<R>))\" by metis\n           (*from d20 d22 have d23 : \"\\<exists> j. (\\<not> (q \\<in> fset (\\<ff>\\<^sub>2 n (Suc e) j \\<R>)))\" by (simp add: INT_I notin_fset)*)\n           from d20 d22  have d24 : \"\\<exists> j.(\\<not> (q |\\<in>| \\<ff>\\<^sub>2 n (Suc e) j \\<R>))\" by (simp add: notin_fset)\n           from d2b d24 show \"\\<exists> j. q |\\<in>| (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) \\<and> (\\<not> (q |\\<in>| \\<ff>\\<^sub>2 n (Suc e) j \\<R>))\" by metis\n        qed\n        from c1 d3 show \"False\" by blast\n      qed\n      \n      from c3 i501 show \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n (Suc e) \\<R>\" by auto\n     qed\n    then show \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\" using i501 by auto\n    qed\n   (* ------------------------------------- *)\n  qed\n   *)\n    \n    \n  have toShowMain : \"(\\<not>(\\<exists> k. (\\<ff>\\<^sub>1 n k \\<R>) = {||})) \\<Longrightarrow> (\\<And>k. \n  (\\<And>k0. k0 \\<ge> k  \\<Longrightarrow> (\\<W> n (Suc k0) \\<R>) = (\\<W> n k0 \\<R>)    ) \\<Longrightarrow>\n       (\\<alpha> \\<bullet> (( \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc (Suc k)) \\<R>)) \\<union> {[]})) =  \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>))))\"\n  proof -\n    \n    fix k\n    assume \"(\\<not>(\\<exists> k. (\\<ff>\\<^sub>1 n k \\<R>) = {||}))\"\n    hence f1NeverEmpty : \"\\<And>k . (\\<ff>\\<^sub>1 n k \\<R>) \\<noteq> {||}\" by auto\n        \n      (* Other inclusion: from first goal *)\n    from firstGoal have from_first : \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| (\\<ff>\\<^sub>1 n (Suc k) \\<R>)\" by metis\n        (* One inclusion: calculation *)\n    assume h65 : \"(\\<And>k0. k0 \\<ge> k  \\<Longrightarrow> (\\<W> n (Suc k0) \\<R>) = (\\<W> n k0 \\<R>)    )\"\n    have \"Suc k \\<ge> k\" by arith \n    then have f3951 : \"(\\<W> n k \\<R>) = (\\<W> n (Suc k) \\<R>)\" and f3952 : \"(\\<W> n (Suc k) \\<R>) = (\\<W> n (Suc (Suc k)) \\<R>)\" using h65 by auto\n        \n    from f3951 wStationaryLemma have f1 : \"\\<not> (thereIsAnUnrealizedRule  (\\<W> n k \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>))))\" by auto\n    from f3952 wStationaryLemma have f1b : \"\\<not> (thereIsAnUnrealizedRule  (\\<W> n (Suc k) \\<R>) (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>))))\"  by blast\n        \n    show \"(\\<alpha> \\<bullet> ( \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc (Suc k)) \\<R>))\\<union> {[]}) =  \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>)))\"\n    proof\n      from f3951 secondGoal have f1HasNotChangedAnyMore : \"(\\<ff>\\<^sub>1 n (Suc (Suc k)) \\<R>) = (\\<ff>\\<^sub>1 n (Suc k) \\<R>)\" by metis\n      from f3952 secondGoal have f1HasNotChangedAnyMore2 : \"(\\<ff>\\<^sub>1 n (Suc (Suc (Suc k))) \\<R>) = (\\<ff>\\<^sub>1 n (Suc (Suc k)) \\<R>)\" by metis\n          \n      have h76568 : \"\\<And> \\<ii> r . r |\\<in>| ((\\<W> n (Suc k) \\<R>) \\<ii>) \\<Longrightarrow> symbol r = \\<alpha>\" using wSymbol by blast\n      from f1b thereIsAnUnrealizedRule_def unrealizedRules_def h76568\n      have f2 : \"\\<not> (\\<exists> \\<ii>. (\\<exists> r . ( r |\\<in>| ((\\<W> n (Suc k) \\<R>) \\<ii>) \\<and> (\\<not> (realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) r) (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)) \\<union> {[]})))))))\" by blast \n      from f2 have f3 : \"\\<And> \\<ii>. \\<And> r. (r |\\<in>| ((\\<W> n (Suc k) \\<R>) \\<ii>) \\<Longrightarrow> (realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) r) (\\<alpha> \\<bullet> ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)) \\<union> {[]})))))\" by metis\n          \n          \n      have allRealized : \"\\<And> \\<ii>. \\<And> state. (state |\\<in>| (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<ii>)) \\<Longrightarrow> (realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>) state) ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>))))))\" \n      proof -\n        fix \\<ii>\n        fix state\n        assume y1 : \"state |\\<in>| (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<ii>))\"\n        from fimageE stateSetFromRuleSet_def y1 ffUnionLemma obtain r where f6 : \"r |\\<in>| \\<W> n (Suc k) \\<R> \\<ii>\" and f7 : \"state |\\<in>| states r\" by metis\n        from f6 wSymbol have u765676 : \"symbol r = \\<alpha>\" by blast\n        from realizedForestTreeState  realizedForestTreeRule  realized_rule_state  f3 f6 f7 f7 u765676 show \"(realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>) state) ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)) )))\" by metis\n      qed\n        \n      def pifan == \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc ( k)) \\<R>))\"\n        \n      have b5392 : \"k \\<le> k\" by arith\n      from seventhGoal pifan_def f3951\n      have y300 : \"pifan = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2))))\" by metis\n          (* here apply the realization lemma *)\n      from allRealized realizationLemma dist_intersectionLanguageOplus_def \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>_def have q2 : \n        \"pifan = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2))))\"\n      proof -\n        def S1 == \" ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<aa>\\<^sub>1)) |`| (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1))))\"\n        def S2 == \" ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<aa>\\<^sub>2)) |`| (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2))))\"\n        from stateLanguagesClosedArbitraryOplus S1_def have y5555 : \"\\<forall>l . l |\\<in>| S1 \\<longrightarrow> closedUnderArbitraryPlus (l)\" using fimageE by blast \n        from stateLanguagesClosedArbitraryOplus S2_def have y5556 : \"\\<forall>l . l |\\<in>| S2 \\<longrightarrow> closedUnderArbitraryPlus (l)\" using fimageE by blast \n        def fTree == \"\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n ( ((\\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> ( S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> ( S2))))))\"\n        from fTree_def y300 S1_def S2_def \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>_def \\<A>.simps have fTreePi : \"fTree = pifan\"\n        proof -\n          from S1_def S2_def \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma>_def aut_def have b380 : \"(( \\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> (S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> `  (\\<Uplus> (S2)))) \n                          = (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2)))\"  by metis\n          from b380 fTree_def y300 show ?thesis by metis\n        qed\n        have realizedDistr : \"\\<And> x z.(realizedInForest x z \\<Longrightarrow> realizedInForest (distEquivalenceClassForests x) z)\" by (metis (mono_tags, lifting) distEquivalenceClassForests_def mem_Collect_eq realizedInForest_def) \n            \n        from fimageE  allRealized pifan_def\n        have allRealizedPi2 : \"\\<And> \\<ii> l. (l |\\<in>| ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>)) |`| (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<ii>)))) \n                                                     \\<Longrightarrow> (realizedInForest l pifan))\" by metis\n        have caseOt : \"(\\<And> \\<ii>. (\\<ii> = \\<aa>\\<^sub>1 \\<or> \\<ii> = \\<aa>\\<^sub>2))\" using \\<A>.cases by auto\n        from realizedDistr allRealizedPi2 S1_def S2_def have y5551 : \"\\<And> l. (l |\\<in>| (S1) \\<Longrightarrow> realizedInForest l  pifan)\" using fimageE by blast \n        from realizedDistr allRealizedPi2 S1_def S2_def have  y5561 : \"\\<And> l. (l |\\<in>| (S2) \\<Longrightarrow> realizedInForest l pifan)\" using fimageE by blast \n        from y5551 y5561 fTreePi have y5551a : \"\\<And> l. (l |\\<in>| (S1) \\<Longrightarrow> realizedInForest l fTree)\" and y5561a : \"\\<And> l. (l |\\<in>| (S2) \\<Longrightarrow> realizedInForest l fTree)\" by auto \n        \n        from statesLanguagesNonempty S1_def S2_def wInR stateSetFromRuleSet_def  have h6588 : \"\\<And> r \\<ii> s. r |\\<in>| (\\<W> n (Suc k) \\<R> \\<ii>)  \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>) s \\<noteq> {}\" by blast\n            \n        have nonempty500 : \"(\\<forall>l. l |\\<in>| S1 \\<longrightarrow> l \\<noteq> {}) \\<and>  ( \\<forall>l. l |\\<in>| S2 \\<longrightarrow> l \\<noteq> {})\"\n        proof \n          have n567687 : \"\\<And> s l. (s = S1 \\<or> s=S2) \\<Longrightarrow> l |\\<in>| s \\<longrightarrow> l \\<noteq> {}\"\n          proof \n            fix s l\n            assume a90 : \"(l :: abc tree fset set) |\\<in>| s\"\n            assume a91 : \"s = S1 \\<or> s=S2\"\n            then obtain i where \"s = \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| stateSetFromRuleSet (\\<W> n (Suc k) \\<R> i)\" using S1_def S2_def                  by blast\n            hence \"s = \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) |`| (\\<Union>| (states |`| (\\<W> n (Suc k) \\<R> i)))\" using stateSetFromRuleSet_def by metis\n            then obtain state where a94 : \"l = \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) state\" and \"state |\\<in>| (\\<Union>| (states |`| (\\<W> n (Suc k) \\<R> i)))\" using a90 by blast\n            then obtain rule where a93 : \"state |\\<in>| states rule\" and a92 : \"rule |\\<in>| (\\<W> n (Suc k) \\<R> i)\"                    by auto \n            from h6588  show \"l \\<noteq> {}\"                  using    a92 a93 a94              by blast \n          qed\n          from n567687 show \"\\<forall>l. l |\\<in>| S1 \\<longrightarrow> l \\<noteq> {}\" by auto\n          from n567687 show \"\\<forall>l. l |\\<in>| S2 \\<longrightarrow> l \\<noteq> {}\" by auto\n        qed\n          \n          \n        have noEmptyForests1 : \"(\\<And>l forest. l |\\<in>| S1 \\<Longrightarrow> forest \\<in> l \\<Longrightarrow> forest \\<noteq> {||}) \" using S1_def noEmptyForests by metis\n    have noEmptyForests2 : \"(\\<And>l forest. l |\\<in>| S2 \\<Longrightarrow> forest \\<in> l \\<Longrightarrow> forest \\<noteq> {||})\" using S2_def noEmptyForests by metis\n          \n        from realizationLemma  y5555 y5556 nonempty500 noEmptyForests1 noEmptyForests2\n        have u702 : \"(\\<And> l. l |\\<in>| S1 \\<Longrightarrow> realizedInForest l (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n ((\\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> ( S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> ( S2))))))) \\<Longrightarrow>\n                         (\\<And> l. l |\\<in>| S2 \\<Longrightarrow> realizedInForest l (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n ((\\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> ( S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> ( S2))))))) \\<Longrightarrow>\n                           \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n ((\\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> ( S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> ( S2))))) \n                           = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n ((\\<Psi>\\<^sub>\\<phi> ` (\\<Oplus> ( S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> ` (\\<Oplus> ( S2)))))\" by blast\n        from fTreePi fTree_def nonempty500 u702 y5555 y5556 y5551a y5561a S1_def S2_def fTreePi fTree_def \n        have y5571 : \"fTree = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n ((\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> ( S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> ( S2)))))\" by metis\n        from  fTreePi  y5571\n        have y5572 : \"pifan =  \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n ((\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> ( S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> ( S2)))))\" by metis\n        from aut_def dist_intersectionLanguageOplus_def \n        have y5573 : \"\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2)) \n                        =  (\\<Psi>\\<^sub>\\<phi> ` (\\<Oplus> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<aa>\\<^sub>1)) |`| (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1))))) \n                         \\<inter> (\\<Psi>\\<^sub>\\<phi> `((\\<Oplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<aa>\\<^sub>2)) |`| (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2)))))))\" by metis\n        from y5572 y5573 S1_def S2_def show ?thesis by metis\n      qed\n      have \"\\<And>i. (\\<W> n (Suc k) \\<R> i) |\\<subseteq>| (\\<R> i)\" using wInR by blast \n          \n          \n      from f1NeverEmpty  obtain tree where n654765 : \"tree |\\<in>| (\\<ff>\\<^sub>1 n (Suc (Suc ( k))) \\<R>)\" by blast\n          \n          \n      have \"tree = (NODE (root tree) (childrenSet tree))\"\n        by (metis childrenSet.elims root.simps) \n      hence \"[root tree] |\\<in>| \\<Pi> tree\" using rootIsPath by metis\n      hence \"[root tree] \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n (Suc (Suc ( k))) \\<R>)\" using n654765 pathsForTreeLanguage_def\n        by (metis (mono_tags, lifting) mem_Collect_eq notin_fset) \n      hence \"[root tree] \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n (Suc ( ( k))) \\<R>)\" using  \\<ff>\\<^sub>1.simps(2)            using f1HasNotChangedAnyMore by auto \n      hence n655876 : \"[root tree] \\<in> pifan\" using pifan_def by auto\n      hence \"[root tree] \\<in> \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2))))\"    using q2 by auto\n      then obtain forest where n76443544 : \"forest \\<in> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2))))\" \n        and n654654 : \"[root tree] |\\<in>|  pathsInForest forest\" using pathsForForestLanguage_def by blast\n      from n654654 have \"\\<exists> tree . tree |\\<in>| forest\" using pathsInForest_def ffUnionLemma\n        by (metis pathsTreeForest) \n      hence n443876545 : \"\\<exists> forest . (forest \\<in> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2)))) \\<and> forest \\<noteq> fempty)\" using n76443544 by auto\n      have \"(\\<And>\\<ii> rule. rule |\\<in>| (\\<W> n (Suc k) \\<R> \\<ii>) \\<Longrightarrow> symbol rule = \\<alpha>)\" using wSymbol  by blast\n          \n      have n764654 :  \"pathsInTree tree \\<noteq> {}\" using theSingletonPathExists by blast\n          \n      from n654765 \\<ff>\\<^sub>1.simps  have \"tree |\\<in>|  inf_fset2 (\\<ff>\\<^sub>1 n (Suc k) \\<R>) (\\<P>\\<^sub>\\<sigma> (\\<W> n (Suc k) \\<R>)) \" by auto\n      hence  \"tree \\<in>  (\\<P>\\<^sub>\\<sigma> (\\<W> n (Suc k) \\<R>)) \"            by (metis Int_iff inf_fset2.rep_eq notin_fset) \n      hence \"\\<And> \\<ii> . (\\<forall> p \\<in> (pathsInTree tree) . \n             pathSatisfiesApproximatorForStateFromRuleSet p ((\\<W> n (Suc k) \\<R>) \\<ii>) \\<ii>)\" using \\<P>\\<^sub>\\<sigma>_def satisfiesApproximatorForStatesFromRuleSet_def by blast\n      hence \"\\<And> \\<ii> . (pathsInTree tree = {} \\<or> (\\<exists>rule. rule |\\<in>| (\\<W> n (Suc k) \\<R> \\<ii>)))\" using pathSatisfiesApproximatorForStateFromRuleSet_def\n      proof -\n        fix \\<ii> :: ot\n        assume \"\\<And>\\<ii>. \\<forall>p\\<in>pathsInTree tree. pathSatisfiesApproximatorForStateFromRuleSet p (\\<W> n (Suc k) \\<R> \\<ii>) \\<ii>\"\n        then show \"pathsInTree tree = {} \\<or> (\\<exists>r. r |\\<in>| \\<W> n (Suc k) \\<R> \\<ii>)\"\n          by (meson notin_fset pathSatisfiesApproximatorForStateFromRuleSet_def theSingletonPathExists)\n      qed\n      hence nuy53676 : \"\\<And> \\<ii> . (\\<exists>rule. rule |\\<in>| (\\<W> n (Suc k) \\<R> \\<ii>))\" using n764654 by auto\n          \n          \n          \n      from psiRulesStatesLemma nuy53676 have \"(\\<And>\\<ii> rule. rule |\\<in>| (\\<W> n (Suc k) \\<R> \\<ii>) \\<Longrightarrow> symbol rule = \\<alpha>) \\<Longrightarrow>\n  (\\<And>i. \\<exists>rule. rule |\\<in>| (\\<W> n (Suc k) \\<R> i)) \\<Longrightarrow>\n  \\<exists>forest. forest \\<in> \\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1) (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2)) \\<and> forest \\<noteq> {||} \\<Longrightarrow>\n  \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1)) (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2)))) \\<union> {[]}) = \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1) (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2)))\"\n        using n443876545 by blast \n      \n      \n      \n              \n      have psiRulesStates : \n        \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<sigma> (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>1))   (stateSetFromRuleSet (\\<W> n (Suc k) \\<R> \\<aa>\\<^sub>2))))   \\<union> {[]})\n              = (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) ((\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>1))((((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>2)))))))\" using wSymbol psiRulesStatesLemma f1NeverEmpty q2 n443876545\n        by (meson nuy53676)\n        \n          \n          \n      from q2 psiRulesStates      have q1 : \"\\<alpha> \\<bullet>  (pifan\\<union> {[]}) = (\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) ((\\<Psi>\\<^sub>\\<Oplus>\\<^sub>\\<rho> (((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>1))((((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>2)))))))\" by metis\n          \n          \n          \n          \n      from paths_monoForest q1 z_mono uplusInOplus \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho>_def dist_intersectionLanguageOplusRules_def \n      have q3 : \"\\<alpha> \\<bullet>  (pifan\\<union> {[]}) \\<subseteq> \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) ((\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>1))((((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>2))))))\"\n      proof -\n        from uplusInOplus \n        have q851 : \"((\\<Psi>\\<^sub>\\<phi> ` ((\\<Oplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| ((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>1) ))))) \\<inter> (\\<Psi>\\<^sub>\\<phi> ` (\\<Oplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| ((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>2)))))) \n                          \\<subseteq> ((\\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| ((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>1) )))) \\<inter> (\\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| ((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>2))))))\" by auto\n        from q851 \\<Z>\\<^sub>\\<phi>\\<^sub>F_mono q1 \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho>_def dist_intersectionLanguageOplusRules_def paths_monoForest\n        show \"\\<alpha> \\<bullet>  (pifan\\<union> {[]}) \\<subseteq> \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) ((\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>1))((((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>2))))))\" by metis\n      qed\n      from q3 w_mono intersectMono z_mono paths_monoForest \n      have q4 : \"\\<alpha> \\<bullet>  (pifan\\<union> {[]}) \\<subseteq> \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) ((\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2))))))\"\n      proof -\n        from intersectMono w_mono \n        have q150 : \"\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>1))((((\\<W> n (Suc k) \\<R>) \\<aa>\\<^sub>2))) \\<subseteq> \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2)))\" by metis\n        from q3 q150 paths_monoForest \\<Z>\\<^sub>\\<phi>\\<^sub>F_mono subset_trans        show \"\\<alpha> \\<bullet> (pifan\\<union> {[]}) \\<subseteq> \\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F (Suc n) ((\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2))))))\"          by smt \n      qed\n      from \\<gg>_def pathsForestsTrees \n      have q5 : \"(\\<Pi>\\<^sub>\\<phi> (fset (\\<Z>\\<^sub>\\<phi> (Suc n) ((\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2)))))))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>))\" by metis\n      from q4 q5 pifan_def \\<Z>\\<^sub>\\<phi>\\<^sub>F_def       have \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>))\\<union> {[]}) \\<subseteq> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>))\"        by (simp add: \\<Z>\\<^sub>\\<phi>\\<Z>\\<^sub>\\<phi>\\<^sub>Flemma) \n      then show \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc (Suc k)) \\<R>))\\<union> {[]}) \\<subseteq> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>))\" using f1HasNotChangedAnyMore by metis\n      have b604 : \"\\<And> trel . trel \\<in> (fset (\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> root trel = \\<alpha>\"\n      proof -\n        fix trel\n        assume q8124: \"trel \\<in> (fset (\\<ff> (Suc n)  \\<R>))\"\n        have h672 : \"\\<forall>\\<ii>. satisfiesApproximatorForRuleSet trel (\\<R> \\<ii>) \\<ii>\"\n        proof -\n          from \\<ff>_def have q8125 : \"\\<ff> (Suc n) \\<R> = \\<Z>\\<^sub>\\<tau> (Suc n) (\\<P> \\<R>)\" by auto\n          from q8124 q8125 have q8126 : \"trel |\\<in>| \\<Z>\\<^sub>\\<tau> (Suc n) (\\<P> \\<R>)\" by (simp add: fmember.rep_eq)\n          from \\<Z>\\<tau>_subset \\<Z>\\<tau>_lemma Z_def q8126 notin_fset have 8127 : \"trel \\<in> \\<P> \\<R>\" using subsetCE            by metis\n          from \\<P>_def 8127 show \"\\<forall>\\<ii>. satisfiesApproximatorForRuleSet trel (\\<R> \\<ii>) \\<ii>\" by simp\n        qed\n        from theSingletonPathExists obtain path node where h673 : \"path \\<in> pathsInTree trel\" and h674 : \"path = [node]\" and h675 : \"down node = trel\" by metis\n        show \"root trel = \\<alpha>\" proof -\n          fix \\<ii>\n          from h672 h673 satisfiesApproximatorForRuleSet_def have h676 : \"pathSatisfiesApproximatorForRuleSet path (\\<R> \\<ii>) \\<ii>\" by metis\n          from h676 pathSatisfiesApproximatorForRuleSet_def obtain ruleSeq where t3285 : \"hd ruleSeq |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> path ruleSeq\" by auto\n          from t3285 pathFitsListAndListIsARunImpliesV h674 have h679 : \"(( (down (hd path))) \\<in> ( \\<V>\\<^sub>\\<tau> \\<ii> (hd ruleSeq)  )   ) \" by blast\n          from h679 alphaIsTransition rootOfV t3285 have h680 : \"root (down (hd path)) = \\<alpha>\" by metis\n          from h674 have h681 : \"hd path = node\" by (simp add: list.sel(1)) \n          from h675 h680 h681 show \"root trel = \\<alpha>\" by metis \n        qed\n      qed\n      show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>)) \\<subseteq> \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc (Suc k)) \\<R>))\\<union> {[]})\"\n      proof -\n        from \\<gg>_def paths_monoTree gInF FSet.less_eq_fset.rep_eq \n        have q21 : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>)) \\<subseteq> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((((\\<ff> (Suc n)  \\<R>))))\"\n          by (simp add: less_eq_fset.rep_eq pathsTreeLangMonotone allRulesArePresent) \n        have q24 : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (((\\<ff> (Suc n)  \\<R>))) \\<subseteq> \\<alpha> \\<bullet>  ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)))\\<union> {[]})\"\n        proof -\n          from from_first have b600 :  \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| (\\<ff>\\<^sub>1 n (Suc k) \\<R>)\" by auto\n          from b600 \n          have b601 : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>))) \\<subseteq> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)))\" by (simp add: less_eq_fset.rep_eq pathsTreeLangMonotone)\n          then have \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)))\\<union> {[]} \\<subseteq> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>)))\\<union> {[]}\" by blast\n          then\n          have b602 : \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)))\\<union> {[]}) \\<subseteq> \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>))\\<union> {[]})\"  using prefixLetterMono by simp\n          from  b604 factorAndPrefix         have \"\\<And>witness . witness \\<in>( fset (((\\<ff> (Suc n)  \\<R>)))) \\<Longrightarrow> \\<alpha> \\<bullet> \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> (fset ((\\<ff> (Suc n)  \\<R>)))) \\<union> {[\\<alpha>]} = \\<Pi>\\<^sub>\\<tau> (fset ((\\<ff> (Suc n)  \\<R>)))\" by auto\n          then have \"\\<alpha> \\<bullet> \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> (fset ((\\<ff> (Suc n)  \\<R>)))) \\<union> {[\\<alpha>]} = \\<Pi>\\<^sub>\\<tau> (fset ((\\<ff> (Suc n)  \\<R>)))\"                using fNotEmpty by auto\n          then have  b603 : \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>  (\\<alpha> \\<diamondop>\\<tau>\\<lambda> (fset (\\<ff> (Suc n)  \\<R>)))\\<union> {[]}) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (((\\<ff> (Suc n)  \\<R>)))\" using unionAppend by auto\n          from b603 factorByRootSymbolF_lemma b602 show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (((\\<ff> (Suc n)  \\<R>))) \\<subseteq> \\<alpha> \\<bullet>  (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n (Suc k) \\<R>))\\<union> {[]})\" by metis\n        qed\n        from q24 q21 f1HasNotChangedAnyMore show ?thesis by auto\n      qed\n    qed\n  qed\n    \n    (* show that W becomes stationary because it is finite and monotone *)\n  def tempw == \"\\<lambda> i. (\\<lambda> k0 . \\<W> n k0 \\<R> i)\"\n  from finiteMonotoneStationary wMonotonic have h6577 : \"\\<And>i. ((\\<And>n. tempw i (Suc n) |\\<subseteq>| tempw i n) \\<Longrightarrow> \\<exists>k.(\\<forall>k0. (k0 \\<ge> k  \\<longrightarrow> (tempw i k0)  = tempw i (Suc k0) )))\" by blast\n  from h6577 tempw_def wMonotonic tempw_def have h657876 : \"\\<And>i. (\\<exists>k.(\\<forall>k0. (k0 \\<ge> k  \\<longrightarrow> (tempw i k0)  = tempw i (Suc k0) )))\" by blast\n  then have \"\\<exists> k. \\<forall> i. ((\\<forall>k0. (k0 \\<ge> k  \\<longrightarrow> (tempw i k0)  = tempw i (Suc k0) )))\"\n  proof -\n    from h657876 obtain k1 where k1a : \"((\\<forall>k0. (k0 \\<ge> k1  \\<longrightarrow> (tempw \\<aa>\\<^sub>1 k0)  = tempw \\<aa>\\<^sub>1 (Suc k0) )))\" by blast\n    from h657876 obtain k2 where k2a : \"((\\<forall>k0. (k0 \\<ge> k2  \\<longrightarrow> (tempw \\<aa>\\<^sub>2 k0)  = tempw \\<aa>\\<^sub>2 (Suc k0) )))\" by blast    \n    obtain kmax where k3a : \"kmax > k1\" and k3b : \"kmax > k2\"          using less_add_Suc1 less_add_Suc2 by blast \n    from k1a k3a have k4a : \"((\\<forall>k0. (k0 \\<ge> kmax  \\<longrightarrow> (tempw \\<aa>\\<^sub>1 k0)  = tempw \\<aa>\\<^sub>1 (Suc k0) )))\"          by (meson less_le less_le_trans)\n    from k2a k3b have k5a : \"((\\<forall>k0. (k0 \\<ge> kmax  \\<longrightarrow> (tempw \\<aa>\\<^sub>2 k0)  = tempw \\<aa>\\<^sub>2 (Suc k0) )))\"  by (meson less_le less_le_trans)\n    from k4a k5a have \"\\<forall> i. ((\\<forall>k0. (k0 \\<ge> kmax  \\<longrightarrow> (tempw i k0)  = tempw i (Suc k0) )))\"          by (metis \\<A>.cases) \n    then show \"\\<exists> k. \\<forall> i. ((\\<forall>k0. (k0 \\<ge> k  \\<longrightarrow> (tempw i k0)  = tempw i (Suc k0) )))\" by auto\n  qed\n  then have n764654 : \"\\<exists>k.(\\<forall>k0. (k \\<le> k0 \\<longrightarrow> \\<W> n (Suc k0) \\<R> = \\<W> n k0 \\<R>))\" using tempw_def by blast\n      \n      \n  show \"(\\<exists>k. \\<ff>\\<^sub>1 n k \\<R> = {||}) \\<or> (\\<exists>k. \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>) \\<union> {[]}) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>))\" using n764654 toShowMain firstGoal by blast\n  show \"\\<And>k. \\<alpha> \\<diamondop> \\<ff> (Suc n) \\<R> |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R> \" using n764654 toShowMain firstGoal by blast\nqed\n  \n  \n  \n  \n  \n  \n  \nlemma core_main_lemma2 :\n  fixes l\n  fixes \\<R>\n  fixes n\n  fixes j                   \n  fixes \\<alpha> \n    assumes allRulesArePresent : \"(\\<And>i rule. rule |\\<in>| rule_set (\\<A> i))\"\n  assumes \"\\<And> r i. r |\\<in>| \\<R> i \\<Longrightarrow> (r |\\<in>| rule_set (\\<A> i) \\<and> symbol r = \\<alpha>)\"\n    \n  assumes statesLanguagesNonempty : \"\\<And> \\<ii> r. r |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow>   (\\<And> s . s |\\<in>| (states r) \\<Longrightarrow> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>) s)  \\<noteq> {}))\"\n  assumes alphaIsTransition : \"\\<And> \\<ii> rule . rule |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow> symbol rule = \\<alpha>\"\n  assumes fNotEmpty : \"fset (\\<ff> (Suc n)  \\<R>) \\<noteq> {}\"\n    \n  assumes outerHypothesis : \"\\<And> rs2. (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> n  rs2))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n rs2))\"\n  assumes inStateSet : \"\\<And> \\<ii>. \\<And> r . \\<And> s . r |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> s |\\<in>| state_set (\\<A> \\<ii>)\"\n  assumes nAssum : \"Suc n > \\<N>\"\n  assumes    rulesLangsNonempty : \"\\<And> \\<R> i r . (r |\\<in>| rule_set (\\<A> i) \\<Longrightarrow>  ((\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) r)  \\<noteq> {}))\"\n  shows \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>))\"\nproof (rule disjE)\n  have a2 : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>)) \\<subseteq> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n)  \\<R>)\"    by (metis assms \\<gg>_def gInF less_eq_fset.rep_eq pathsTreeLangMonotone)\n  have b689 : \"(\\<And>tr. tr |\\<in>| (\\<ff> (Suc n) \\<R>) \\<Longrightarrow> root tr = \\<alpha>)\"    using alphaIsTransition fRoot by meson\n  from factorAndPrefix fNotEmpty have m70 : \"\\<And>witness. (\\<And>tr. tr \\<in> (fset (\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> root tr = \\<alpha>) \\<Longrightarrow>  \\<alpha> \\<bullet> \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> (fset (\\<ff> (Suc n)  \\<R>))) \\<union> {[\\<alpha>]} = \\<Pi>\\<^sub>\\<tau> (fset (\\<ff> (Suc n)  \\<R>))\" by blast\n        from  factorAndPrefix b689 factorByRootSymbolF_lemma(2) less_eq_fset.rep_eq notin_fset pathsTreeLangMonotone prefixLetterMono   have m71 : \"(\\<And>tr. tr \\<in> (fset (\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> root tr = \\<alpha>)\"     by fastforce\n  from m70 m71 have m72 : \"\\<alpha> \\<bullet> \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> (fset (\\<ff> (Suc n)  \\<R>))) \\<union> {[\\<alpha>]} = \\<Pi>\\<^sub>\\<tau> (fset (\\<ff> (Suc n)  \\<R>))\" by auto\n      \n  from core_main_lemma show \"(\\<exists>k. \\<ff>\\<^sub>1 n k \\<R> = {||}) \\<or> (\\<exists>k . ( \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>))\\<union> {[]}) =  \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((  \\<gg> (Suc n) \\<R>))))\" using assms by auto\n  from core_main_lemma have secondPart : \"\\<And> k . (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\" using assms by auto\n      \n  {\n    assume n764654 : \"(\\<exists>k. \\<ff>\\<^sub>1 n k \\<R> = {||})\"\n    hence n764654 : \"(\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) = {||}\"  using secondPart by blast\n    from fNotEmpty have \"(\\<ff> (Suc n)  \\<R>) \\<noteq> fempty\" by auto\n    then obtain tree where n76465 : \"tree |\\<in>| (\\<ff> (Suc n)  \\<R>)\" and n65786 : \"root tree = \\<alpha>\" using b689          by auto \n    from b689 have \"\\<alpha> \\<bullet> \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> (fset (\\<ff> (Suc n)  \\<R>))) \\<union> {[\\<alpha>]} = \\<Pi>\\<^sub>\\<tau> (fset (\\<ff> (Suc n)  \\<R>))\" using m70 notin_fset by metis\n        \n    from n764654 have \"(\\<alpha> \\<diamondop>\\<tau>\\<lambda> (fset (\\<ff> (Suc n)  \\<R>))) = {}\" using factorByRootSymbolF_lemma by blast\n    hence \"\\<alpha> \\<bullet> \\<Pi>\\<^sub>\\<tau> (\\<alpha> \\<diamondop>\\<tau>\\<lambda> (fset (\\<ff> (Suc n)  \\<R>))) = {}\" using prefixLetter_def pathsForTreeLanguage_def\n    proof -\n      show ?thesis\n        by (simp add: \\<open>\\<alpha> \\<diamondop>\\<tau>\\<lambda> fset (\\<ff> (Suc n) \\<R>) = {}\\<close> pathsForTreeLanguage_def prefixLetter_def)\n    qed\n    hence n764654 : \"\\<Pi>\\<^sub>\\<tau> (fset (\\<ff> (Suc n)  \\<R>)) = {[\\<alpha>]}\" using m72 by auto\n    hence n656897 : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>)) \\<subseteq>  {[\\<alpha>]}\" using a2 by blast\n        \n        \n    from n764654 have n75478 : \"\\<And>tree path . tree \\<in> (fset (\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> (path |\\<in>| (\\<Pi> tree)) \\<Longrightarrow> path = [\\<alpha>]\" using pathsForTreeLanguage_def by blast\n    hence \"\\<And>tree path . tree \\<in> (fset (\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> (path |\\<in>| (\\<Pi> tree)) \\<Longrightarrow> length path = length [\\<alpha>] \" by auto\n    hence \"\\<And>tree path . tree \\<in> (fset (\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> (path |\\<in>| (\\<Pi> tree)) \\<Longrightarrow> length path = 1 \" by auto\n    hence \"\\<And>tree path . tree \\<in> (fset (\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> (path |\\<in>| (\\<Pi> tree)) \\<Longrightarrow> length path \\<le> 1 \" by auto\n    hence \"\\<And>tree .  tree \\<in> (fset (\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> height tree \\<le> 1\" using heightOnlyDependsOnPaths finiteMaxExists  by (metis One_nat_def fimageE le_SucI le_zero_eq) \n    hence n7656897 :  \"\\<And>tree .  tree \\<in> (fset (\\<Z>\\<^sub>\\<tau> (Suc n)(\\<P> \\<R>))) \\<Longrightarrow> height tree \\<le> 1\"  using \\<ff>_def by auto\n    hence \"\\<And>tree .  tree \\<in> (fset (\\<Z>\\<^sub>\\<tau> (Suc n)(\\<P> \\<R>))) \\<Longrightarrow> tree \\<in> (\\<P> \\<R>)\" using \\<Z>\\<^sub>\\<tau>_def notin_fset    by (metis \\<ff>_def zInP)\n    hence \"\\<And>tree i .  tree \\<in> (fset (\\<Z>\\<^sub>\\<tau> (Suc n)(\\<P> \\<R>))) \\<Longrightarrow> tree \\<in> (\\<P>\\<^sub>1 \\<R> i)\" using \\<P>_def \\<P>\\<^sub>1_def by auto\n    hence n6587 : \"\\<And>tree i .  tree \\<in> (fset (\\<Z>\\<^sub>\\<tau> (Suc n)(\\<P> \\<R>))) \\<Longrightarrow> tree |\\<in>| \\<Z>\\<^sub>\\<tau> 1 (\\<P>\\<^sub>1 \\<R> i)\" using \\<Z>\\<^sub>\\<tau>_def  n7656897          by (simp add: finterI restrictionIsFinite2) \n        \n    have n76875654 : \"tree \\<in> (fset (\\<ff> (Suc n)  \\<R>))\" using n76465 notin_fset by metis\n    from n65786 tree.exhaust root.simps obtain children where n7565687 : \"tree = (NODE \\<alpha> children)\"      by metis \n    from n7565687 rootIsPath  have n65687 : \"[\\<alpha>] |\\<in>| \\<delta>\\<^sub>\\<tau> tree\" by auto\n    from n75478 n65687 n76875654 have n65t687543 : \"\\<delta>\\<^sub>\\<tau> tree = (finsert [\\<alpha>] fempty)\"          by blast  \n    have n76867 : \" tree \\<in> (fset (\\<Z>\\<^sub>\\<tau> (Suc n)(\\<P> \\<R>)))\" using n76465 \\<ff>_def notin_fset by metis\n    have n678y77 : \"\\<And>path . path |\\<in>|  (finsert [\\<alpha>] fempty)  \\<Longrightarrow> length path \\<le> 1 \"        by simp \n    hence n678y77b : \"\\<And>path . path |\\<in>|  (finsert [\\<alpha>] fempty)  \\<Longrightarrow> length path \\<le> (Suc n) \"              by simp \n        \n    have n657988 : \"1 \\<le> \\<N>\" using existsUniformConstant assms by auto\n    from smallerThanN n657988 have \"\\<And> f \\<ii> \\<R> .  f |\\<in>| \\<Z>\\<^sub>\\<tau> 1 (\\<P>\\<^sub>1 \\<R> \\<ii>) \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> f \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>) |`| \\<R> \\<ii>)\" by auto\n    hence \"\\<And>tree i . tree \\<in> (fset (\\<Z>\\<^sub>\\<tau> (Suc n)(\\<P> \\<R>))) \\<Longrightarrow> \\<delta>\\<^sub>\\<tau> tree \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)\" using n6587 by auto\n    hence \"\\<And> i . \\<delta>\\<^sub>\\<tau> tree \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)\" using n76867 by auto       \n    hence \"\\<And> i . (\\<exists> z . (z \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)) \\<and> \\<delta>\\<^sub>\\<tau> tree = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> z)\" using n76867          using n65687 by fastforce \n    hence \"\\<And> i . (\\<exists> z . (z \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)) \\<and> (finsert [\\<alpha>] fempty) = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> z)\" using n65t687543 by auto\n    hence \"\\<And> i . (\\<exists> z . (z \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)) \\<and> (finsert [\\<alpha>] fempty) = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> z \\<and> (\\<forall> path. path |\\<in>|  \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> z \\<longrightarrow> length path \\<le>(Suc n)))\" using n678y77b by metis\n    hence \"\\<And> i . (\\<exists> z . (\\<Psi>\\<^sub>\\<phi> z \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)) \\<and> (finsert [\\<alpha>] fempty) = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> z \\<and> (\\<forall> path. path |\\<in>|  \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> z \\<longrightarrow> length path \\<le>(Suc n)))\"    by blast\n    hence \"\\<And> i . (\\<exists> z . (\\<Psi>\\<^sub>\\<phi> z \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)) \\<and> (finsert [\\<alpha>] fempty) = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<phi> z) \\<and> (\\<forall> path. path |\\<in>|  \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<phi> z) \\<longrightarrow> length path \\<le>(Suc n)))\"    using psiPreservesPaths by auto\n    hence n7y5e3543 : \"\\<And> i . (\\<exists> z . (z \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)) \\<and> (finsert [\\<alpha>] fempty) = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (z) \\<and> (\\<forall> path. path |\\<in>|  \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (z) \\<longrightarrow> length path \\<le>(Suc n)))\"  by blast\n        \n    def z0 == \"\\<Psi>\\<^sub>\\<phi> (finsert tree fempty)\" \n    hence \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> z0 = \\<delta>\\<^sub>\\<tau> tree\"        by (simp add: pathsSingeton psiPreservesPaths) \n    hence n8u6354 : \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> z0 = (finsert [\\<alpha>] fempty)\"   using n65t687543 by auto\n        \n    hence \"\\<And> i . (\\<exists> z . (z \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)) \\<and> (finsert [\\<alpha>] fempty) = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (z) \\<and> z = z0 \\<and> (\\<forall> path. path |\\<in>|  \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (z) \\<longrightarrow> length path \\<le>(Suc n)))\"       using n7y5e3543 psiOnlyDependsOnPath      by (metis image_iff psiPreservesPaths z0_def) \n        \n    hence n754654 : \"\\<And> i . ((z0 \\<in> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) |`| \\<R> i)) \\<and> (finsert [\\<alpha>] fempty) = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (z0) \\<and> (\\<forall> path. path |\\<in>|  \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (z0) \\<longrightarrow> length path \\<le>(Suc n)))\"   by blast\n    hence n867454 : \"z0 \\<in> \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)\" using \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho>_def          by (metis Int_iff aut_def) \n    from n754654  have   \"(\\<And> path. path |\\<in>|  \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (z0) \\<Longrightarrow> length path \\<le>(Suc n))\" by auto\n    hence   \"(\\<And> tree. tree |\\<in>|   (z0) \\<Longrightarrow> height tree \\<le>(Suc n))\" using heightOnlyDependsOnPaths finiteMaxExists  by (metis (no_types, lifting) fimageE less_Suc_eq_le pathsTreeForest zero_less_Suc) \n    hence n5487 : \" (z0)  \\<in> {f. \\<forall>t. t |\\<in>| f \\<longrightarrow> height t \\<le> (Suc n)}\" by auto \n    from n867454 n5487 \\<Z>\\<^sub>\\<phi>_def have n754543 : \"z0 |\\<in>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))\"      by (smt Collect_cong finterI notin_fset restrictionIsFiniteForests)  \n        \n    have n65354 : \"[\\<alpha>] |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> z0\" using n8u6354 by auto\n        \n    have \"[\\<alpha>] \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))))\" using n754543 n65354 pathsForTreeLanguage_def ffUnionLemma notin_fset        by (smt pathsTreeForest piFset) \n    hence    \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>)) =  {[\\<alpha>]}\" using n656897 \\<gg>_def by auto\n    then show \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>))\" using n764654 by auto\n        \n      \n      }\n      \n  {\n    assume \"(\\<exists>k . ( \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>))\\<union> {[]}) =  \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((  \\<gg> (Suc n) \\<R>))))\"\n    then obtain k where a1 : \"( \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>))\\<union> {[]}) =  \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((  \\<gg> (Suc n) \\<R>)) \\<and> (\\<alpha> \\<diamondop> (\\<ff> (Suc n)  \\<R>)) |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>)\" using secondPart by auto\n        \n    from a1 have \"\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>) \\<union> {[]}) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\" by auto\n    from a1 have a1b : \"\\<alpha> \\<diamondop> \\<ff> (Suc n) \\<R> |\\<subseteq>| \\<ff>\\<^sub>1 n k \\<R>\" by auto\n    from m72 a1b factorByRootSymbolF_lemma have \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n)  \\<R>) \\<subseteq> \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[\\<alpha>]}\" by  (metis Un_mono Un_upper1 insert_is_Un less_eq_fset.rep_eq pathsTreeLangMonotone prefixLetterMono) \n    then have \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n)  \\<R>) \\<subseteq> \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff>\\<^sub>1 n k \\<R>) \\<union> {[]})\" using unionAppend by auto\n    then have  a3 : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n)  \\<R>) \\<subseteq> ( \\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff>\\<^sub>1 n k \\<R>)) \\<union> {[]}))\"  by auto\n    show \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>))\" using a1 a2 a3    by auto \n  }\nqed\n  \n  \n  \n  \n  \n  \nlemma core_main_lemma4 :\n  fixes l\n  fixes \\<R>\n  fixes n\n  fixes j\n    assumes allRulesArePresent : \"(\\<And>i rule. rule |\\<in>| rule_set (\\<A> i))\"\n  assumes \"\\<And> r i. r |\\<in>| \\<R> i \\<Longrightarrow> (r |\\<in>| rule_set (\\<A> i))\"\n    \n  assumes statesLanguagesNonempty : \"\\<And> \\<ii> r. r |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow>   (\\<And> s . s |\\<in>| (states r) \\<Longrightarrow> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>) s)  \\<noteq> {}))\"\n  assumes fNotEmpty : \"fset (\\<ff> (Suc n)  \\<R>) \\<noteq> {}\"\n    \n  assumes outerHypothesis : \"\\<And> rs2. (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> n  rs2))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n rs2))\"\n  assumes inStateSet : \"\\<And> \\<ii>. \\<And> r . \\<And> s . r |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> s |\\<in>| state_set (\\<A> \\<ii>)\"\n  assumes nAssum : \"Suc n > \\<N>\"\n  assumes    rulesLangsNonempty : \"\\<And> \\<R> i r . (r |\\<in>| rule_set (\\<A> i) \\<Longrightarrow>  ((\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) r)  \\<noteq> {}))\"\n  shows \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>))\"\nproof -\n  def rulesPerAlpha == \"(\\<lambda> \\<alpha>. (\\<lambda>\\<ii>. (ffilter (\\<lambda>rule. symbol rule = \\<alpha>) (\\<R> \\<ii>))))\"\n  from rulesPerAlpha_def have b1 : \"\\<And> \\<alpha> \\<ii>.(rulesPerAlpha \\<alpha> \\<ii> |\\<subseteq>| (\\<R> \\<ii>))\" using ffmember_filter fsubsetI by fastforce\n  from b1 statesLanguagesNonempty have alpha_statesLanguagesNonempty : \"\\<And> \\<alpha> \\<ii> r. r |\\<in>| (rulesPerAlpha \\<alpha> \\<ii>) \\<Longrightarrow>   (\\<And> s . s |\\<in>| (states r) \\<Longrightarrow> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>) s)  \\<noteq> {}))\" by blast\n  from b1 inStateSet have alpha_inStateSet : \"\\<And> \\<ii> \\<alpha>. \\<And> r . \\<And> s . r |\\<in>| (rulesPerAlpha \\<alpha> \\<ii>) \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> s |\\<in>| state_set (\\<A> \\<ii>)\" by blast\n  def occurringAlphas == \"ffilter (\\<lambda> \\<alpha> . fset (\\<ff> (Suc n)  (rulesPerAlpha \\<alpha>)) \\<noteq> {}) (fimage symbol (\\<R> \\<aa>\\<^sub>1) |\\<union>| fimage symbol (\\<R> \\<aa>\\<^sub>2))\"\n  from occurringAlphas_def have alpha_fNotEmpty : \"\\<forall> \\<alpha> . \\<alpha> |\\<in>| occurringAlphas \\<longrightarrow> fset (\\<ff> (Suc n)  (rulesPerAlpha \\<alpha>)) \\<noteq> {}\" by (simp add: ffmember_filter)\n  def gAlpha == \"\\<lambda> \\<alpha> . (((\\<gg> (Suc n) (rulesPerAlpha \\<alpha>))))\"\n    \n    (* apply main lemma for each \\<alpha> individually *)\n  have u1 : \"\\<And> \\<alpha> . \\<alpha> |\\<in>| occurringAlphas \\<Longrightarrow> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  (rulesPerAlpha \\<alpha>)))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((gAlpha \\<alpha>))\"\n  proof -\n    fix \\<alpha>\n    assume \"\\<alpha> |\\<in>| occurringAlphas\"\n    define Ra where z1 : \"Ra = (rulesPerAlpha \\<alpha>)\"\n    from rulesPerAlpha_def z1 have z2 : \"\\<And>i r . r |\\<in>| Ra i \\<Longrightarrow> symbol r = \\<alpha> \\<and> r |\\<in>| \\<R> i\" by simp\n    from z1 z2 have rulesInAA : \"\\<And> r i. r |\\<in>| Ra i \\<Longrightarrow> (r |\\<in>| rule_set (\\<A> i) \\<and> symbol r = \\<alpha>)\"  using assms(1) by auto\n    have statesLanguagesNonemptyA : \"\\<And> \\<ii> r. r |\\<in>| (Ra \\<ii>) \\<Longrightarrow>   (\\<And> s . s |\\<in>| (states r) \\<Longrightarrow> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>) s)  \\<noteq> {}))\" using assms z2  by blast\n    have alphaIsTransitionA : \"\\<And> \\<ii> rule . rule |\\<in>| (Ra \\<ii>) \\<Longrightarrow> symbol rule = \\<alpha>\" using assms z2  by simp\n    have fNotEmptyA : \"fset (\\<ff> (Suc n)  Ra) \\<noteq> {}\" using assms z2  by (simp add: \\<open>\\<alpha> |\\<in>| occurringAlphas\\<close> alpha_fNotEmpty z1)\n    have outerHypothesisA : \"\\<And> rs2. (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> n  rs2))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n rs2))\" using assms z2 by auto\n    have inStateSetA : \"\\<And> \\<ii>. \\<And> r . \\<And> s . r |\\<in>| (Ra \\<ii>) \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> s |\\<in>| state_set (\\<A> \\<ii>)\" using assms z2 by blast\n    from core_main_lemma2 show \" \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) (rulesPerAlpha \\<alpha>)) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (gAlpha \\<alpha>)\"    \n      using fNotEmptyA gAlpha_def inStateSetA nAssum  outerHypothesisA rulesInAA statesLanguagesNonemptyA z1 rulesLangsNonempty allRulesArePresent by auto\n  qed\n    \n  have u2 : \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))) = Union (image (\\<lambda> \\<alpha> . (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  (rulesPerAlpha \\<alpha>))))) (fset occurringAlphas))\"\n  proof\n    show \"\\<Union>((\\<lambda>\\<alpha>. \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n) (rulesPerAlpha \\<alpha>)))) ` fset occurringAlphas) \\<subseteq> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n) \\<R>))\"\n    proof\n      fix x\n      assume y1 : \"x \\<in> \\<Union>((\\<lambda>\\<alpha>. \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n) (rulesPerAlpha \\<alpha>)))) ` fset occurringAlphas)\"\n      from y1 obtain \\<alpha> where y2 : \"\\<alpha> \\<in> (fset occurringAlphas)\" and y3 : \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n) (rulesPerAlpha \\<alpha>)))\" by blast\n      have \"\\<And>i . (rulesPerAlpha \\<alpha> i) |\\<subseteq>| \\<R> i\"        by (simp add: b1)\n      then have \"\\<P> (rulesPerAlpha \\<alpha>) \\<subseteq> \\<P> \\<R>\" using \\<P>_def satisfiesApproximatorForRuleSet_def pathSatisfiesApproximatorForRuleSet_def            by fastforce    \n      then have y4 : \"(\\<ff> (Suc n) (rulesPerAlpha \\<alpha>)) |\\<subseteq>| (\\<ff> (Suc n)  \\<R>)\" using \\<ff>_def   by (metis fsubsetI subsetCE zIntersectLemma) \n      from y3 y4 show \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n) \\<R>))\" by (simp add: less_eq_fset.rep_eq pathsTreeLangMonotone rev_subsetD)\n    qed\n    show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n) \\<R>)) \\<subseteq> \\<Union>((\\<lambda>\\<alpha>. \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n) (rulesPerAlpha \\<alpha>)))) ` fset occurringAlphas)\"\n    proof \n      fix p\n      assume \"p \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>)\"\n      then obtain tr where w1 : \"p |\\<in>| \\<Pi> tr\" and w2 : \"height tr \\<le> (Suc n)\" and w3 : \"tr \\<in> \\<P> \\<R>\" using pathsForTreeLanguage_def \\<ff>_def zIntersectLemma        by (smt Z_def \\<Z>\\<tau>_lemma mem_Collect_eq) \n      then have w4 : \"\\<And>\\<ii>.(\\<forall> p \\<in> (pathsInTree tr) .           (\\<exists> r  . (hd r |\\<in>| (\\<R> \\<ii>)) \\<and>                      (pathFitsListAndListIsARun \\<ii> p r)))\" using \\<P>_def w3 satisfiesApproximatorForRuleSet_def pathSatisfiesApproximatorForRuleSet_def by auto\n      def \\<alpha> == \"root tr\"\n      have k76y78 : \"((\\<And> \\<ii>.(\\<And> p . p \\<in> (pathsInTree tr) \\<Longrightarrow>    (\\<exists> r  . (hd r |\\<in>| ((rulesPerAlpha \\<alpha>) \\<ii>)) \\<and> (pathFitsListAndListIsARun \\<ii> p r)))))\"\n      proof -\n        fix \\<ii> p\n        assume f1 : \"p \\<in> (pathsInTree tr)\"\n        from w4 f1 obtain r where \"(hd r |\\<in>| (\\<R> \\<ii>)) \\<and> (pathFitsListAndListIsARun \\<ii> p r)\" by blast\n        then have w5 : \"p = (hd p)#(tl p) \\<Longrightarrow> (( (labelOfNode (hd p) = symbol (hd r))                                      \\<and> ( (hd r) |\\<in>| rule_set (\\<A> \\<ii>))))\" using pathFitsListAndListIsARun.simps                by (metis hd_Cons_tl)\n        then have w6 : \"\\<alpha> = (labelOfNode (hd p))\"\n        proof -\n          have \"isAPathp p \\<and> (\\<exists>n ns. p = n # ns \\<and> down n = tr)\"\n            using f1 pathsInTree_def by auto\n          then show ?thesis\n            by (metis (no_types) \\<alpha>_def labelOfNode_def list.sel(1))\n        qed\n        have \"symbol (hd r) = \\<alpha>\"                    by (metis f1 hd_Cons_tl noEmptyPathsInTree w5 w6)\n        then have \"hd r |\\<in>| ((rulesPerAlpha \\<alpha>) \\<ii>)\"                    by (simp add: \\<open>hd r |\\<in>| \\<R> \\<ii> \\<and> pathFitsListAndListIsARun \\<ii> p r\\<close> rulesPerAlpha_def)\n        then show \"(\\<exists> r  . (hd r |\\<in>| ((rulesPerAlpha \\<alpha>) \\<ii>)) \\<and> (pathFitsListAndListIsARun \\<ii> p r))\"                    using \\<open>hd r |\\<in>| \\<R> \\<ii> \\<and> pathFitsListAndListIsARun \\<ii> p r\\<close> by auto    \n      qed\n      from k76y78 have n76 : \"tr \\<in> \\<P> (rulesPerAlpha \\<alpha>)\" using \\<P>_def satisfiesApproximatorForRuleSet_def pathSatisfiesApproximatorForRuleSet_def by auto\n      then have \"tr |\\<in>| (\\<ff> (Suc n) (rulesPerAlpha \\<alpha>))\" using w2 \\<ff>_def        by (simp add: Z_def \\<Z>\\<tau>_lemma fmember.rep_eq) \n      then have n476 : \"p \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) (rulesPerAlpha \\<alpha>))\" using w1 pathsForTreeLanguage_def      by (metis (mono_tags, lifting) mem_Collect_eq notin_fset)   \n      from pRoot have j677 : \"\\<And> \\<ii> r. (r |\\<in>|  (rulesPerAlpha \\<alpha>) \\<ii> \\<Longrightarrow> symbol r = \\<alpha>) \\<Longrightarrow> root tr = \\<alpha>\" using n76        by (simp add: \\<alpha>_def)\n      have \"\\<exists> p .  p \\<in> (pathsInTree tr)\"        using nodeListFitsTree w1 by auto \n      then have \"\\<And> \\<ii>.  (\\<exists> r. (r |\\<in>|  (rulesPerAlpha \\<alpha>) \\<ii>))\" using k76y78 by blast\n      then have j54t68 : \"\\<And> \\<ii>.  (\\<exists> r. (r |\\<in>|  (rulesPerAlpha \\<alpha>) \\<ii> \\<and> symbol r = \\<alpha>))\" using rulesPerAlpha_def by auto\n      from j54t68 rulesPerAlpha_def  \\<alpha>_def n76 have \"\\<And> \\<ii> . (\\<exists> r. (r |\\<in>| (rulesPerAlpha \\<alpha>) \\<ii> \\<and> symbol r = \\<alpha>)  \\<and> root tr = \\<alpha>)\"           by blast         \n      then have \"\\<And> \\<ii> . (\\<exists> r. (r |\\<in>| (\\<R>) \\<ii>   \\<and> root tr = symbol r))\"              using b1 by blast \n      then have q76 : \"root tr |\\<in>| (fimage symbol (\\<R> \\<aa>\\<^sub>1) |\\<union>| fimage symbol (\\<R> \\<aa>\\<^sub>2))\"       by fastforce \n      from n76 \\<alpha>_def have q77 : \"fset (\\<ff> (Suc n) (rulesPerAlpha (root tr))) \\<noteq> {}\"      by (metis \\<open>tr |\\<in>| \\<ff> (Suc n) (rulesPerAlpha \\<alpha>)\\<close> bot_fset.rep_eq fempty_iff notin_fset) \n      from q76 q77 have e1 : \"\\<alpha> |\\<in>| occurringAlphas\" using occurringAlphas_def      by (simp add: \\<alpha>_def) \n      then show \"p \\<in> \\<Union>((\\<lambda>\\<alpha>. \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n) (rulesPerAlpha \\<alpha>)))) ` fset occurringAlphas)\" using e1   n476       by (meson UN_iff fmember.rep_eq) \n    qed\n  qed\n    \n  have u3 : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>)) =  Union (image (\\<lambda> \\<alpha> .  ( \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((gAlpha \\<alpha>))))  (fset occurringAlphas)   )\"\n  proof\n    show \"\\<Union>((\\<lambda>\\<alpha>. \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((gAlpha \\<alpha>))) ` fset occurringAlphas) \\<subseteq> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>))\"\n    proof\n      fix x\n      assume y1 : \"x \\<in> \\<Union>((\\<lambda>\\<alpha>. \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((gAlpha \\<alpha>))) ` fset occurringAlphas)\"\n      from y1 obtain \\<alpha> where y2 : \"\\<alpha> \\<in> (fset occurringAlphas)\" and y3 : \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((gAlpha \\<alpha>))\" by blast\n      from b1 intersectMono gAlpha_def \\<gg>_def have y4 : \"(gAlpha \\<alpha>) |\\<subseteq>| (\\<gg> (Suc n) \\<R>)\" by (simp add: \\<Z>\\<^sub>\\<phi>_mono)\n      from y3 y4 show \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>))\" by (simp add: less_eq_fset.rep_eq pathsTreeLangMonotone rev_subsetD)\n    qed\n    show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>)) \\<subseteq> \\<Union>((\\<lambda>\\<alpha>. \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((gAlpha \\<alpha>))) ` fset occurringAlphas)\"\n    proof -\n      have n767988 : \"((\\<gg> (Suc n) \\<R>)) |\\<subseteq>| \\<Union>|((\\<lambda>\\<alpha>. ((gAlpha \\<alpha>))) |`|  occurringAlphas)\"\n      proof \n        fix x\n        assume n675987 : \" x |\\<in>| \\<gg> (Suc n) \\<R>\"\n        then have \"x |\\<in>| \\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2)))))\" using \\<gg>_def by auto\n        then obtain y where q1 : \"x |\\<in>| y\" and q2 : \"y |\\<in>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2)))))\"  by auto \n        then have \"height x \\<le> Suc n\" using q1 q2\n        proof -\n          have \"x \\<in> Z (Suc n) (\\<P> \\<R>)\"            by (metis (no_types) assms \\<Z>\\<tau>_lemma \\<ff>_def \\<open>x |\\<in>| \\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))\\<close> fmember.rep_eq gInF less_eq_fset.rep_eq subsetCE)\n          then show ?thesis            using Z_def by blast\n        qed \n        from q2 have n766 : \"y \\<in> (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2))))\"\n        proof -\n          have \"\\<forall>f F Fa. (f::abc tree fset) \\<notin> F \\<inter> Fa \\<or> f \\<in> Fa\"            by (metis IntD2)\n          then show ?thesis            by (metis (no_types) \\<Z>\\<^sub>\\<phi>_def fmember.rep_eq inf_fset2.rep_eq q2)\n        qed \n        def \\<alpha> == \"root x\"\n          \n        have n64r57689 :  \"\\<alpha> |\\<in>| occurringAlphas\"\n        proof -\n          from \\<alpha>_def have n766897 : \"\\<alpha> = root x\" by auto\n          from occurringAlphas_def have \"occurringAlphas = ( ffilter (\\<lambda> \\<alpha> . fset (\\<ff> (Suc n)  (rulesPerAlpha \\<alpha>)) \\<noteq> {}) (fimage symbol (\\<R> \\<aa>\\<^sub>1) |\\<union>| fimage symbol (\\<R> \\<aa>\\<^sub>2)))\" by auto\n          from n675987 have \" x |\\<in>| \\<gg> (Suc n) \\<R>\" by auto\n          then have n754654 : \" x |\\<in>| \\<ff> (Suc n) \\<R>\" by (meson assms \\<open>x |\\<in>| \\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))\\<close> fset_rev_mp gInF)\n          from u2 have \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))) = Union (image (\\<lambda> \\<alpha> . (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  (rulesPerAlpha \\<alpha>))))) (fset occurringAlphas))\" by auto\n          from n766897 have \"[\\<alpha>] |\\<in>| \\<Pi> x\"     by (metis root.simps rootIsPath tree.exhaust) \n          hence n645787 : \"root x = \\<alpha>\"                by (simp add: n766897) \n          from n754654 \\<ff>_def \\<Z>\\<^sub>\\<tau>_def have n6756988 : \"x \\<in> \\<P> \\<R>\"                by (simp add: zInP)\n          have n6545877 : \"x \\<in> \\<P> (rulesPerAlpha \\<alpha>) \\<and> (\\<forall> \\<ii> . \\<alpha> |\\<in>| fimage symbol (\\<R> \\<ii>))\"\n          proof -\n            from n6756988 have n6576 : \" \\<And> \\<ii>. satisfiesApproximatorForRuleSet x (\\<R> \\<ii>) \\<ii>\" using \\<P>_def by auto\n            from satisfiesApproximatorForRuleSet_def n6576 have n6478 : \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> pathSatisfiesApproximatorForRuleSet p (\\<R> \\<ii>) \\<ii>\" by auto\n            from pathSatisfiesApproximatorForRuleSet_def n6478 have  \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> (\\<exists> r.  hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r)\" by auto\n            hence \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> (\\<exists> r.  hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r)\" by auto\n            hence \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> (\\<exists> r.  (p \\<noteq> []) \\<and> hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r)\"  using pathsInTree_def by auto\n            hence \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> (\\<exists> r phead ptail.  (p = phead#ptail) \\<and> hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r)\"  using list.exhaust by metis\n            hence \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> (\\<exists> r phead ptail rhead rtail. (r = rhead#rtail) \\<and> (p = phead#ptail) \\<and> hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r)\" \n              using pathFitsListAndListIsARun.cases                by (metis hd_Cons_tl pathFitsListAndListIsARun.simps(3))  \n            hence \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> (\\<exists> r phead ptail rtail. (r = (hd r)#rtail) \\<and> (p = phead#ptail) \\<and> hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r)\"     using list.inject hd_Cons_tl\n              by (metis list.simps(3))\n            hence \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> (\\<exists> r phead ptail rtail. (r = (hd r)#rtail) \\<and> (p = phead#ptail) \\<and> hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r \\<and> labelOfNode phead = symbol (hd r))\" \n              using pathFitsListAndListIsARun.simps(2)  by metis\n            hence \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> (\\<exists> r phead ptail rtail. (r = (hd r)#rtail) \\<and> (p = phead#ptail) \\<and> hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r \\<and> (down phead) = x \\<and> (labelOfNode phead = symbol (hd r)))\"    \n              using pathsInTree_def by fastforce\n            hence \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> (\\<exists> r phead ptail rtail. (r = (hd r)#rtail) \\<and> (p = phead#ptail) \\<and> hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r \\<and> (down phead) = x \\<and> (\\<alpha> = symbol (hd r)))\"\n              using n645787 labelOfNode_def\n              by (metis n766897) \n            hence \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> (\\<exists> r phead ptail rtail. ((hd r |\\<in>| rulesPerAlpha \\<alpha> \\<ii>) \\<and> (hd r |\\<in>| (\\<R> \\<ii>) ) \\<and> (r = (hd r)#rtail) \\<and> (p = phead#ptail) \\<and> hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r \\<and> (down phead) = x \\<and> (\\<alpha> = symbol (hd r))))\"\n              using rulesPerAlpha_def by fastforce\n            hence n764654 : \"\\<And>\\<ii> p . p\\<in>pathsInTree x \\<Longrightarrow> \n((pathSatisfiesApproximatorForRuleSet p (rulesPerAlpha \\<alpha> \\<ii>) \\<ii>) \\<and> (\\<exists> r phead ptail rtail. ((hd r |\\<in>| rulesPerAlpha \\<alpha> \\<ii>) \\<and> (r = (hd r)#rtail) \\<and> (p = phead#ptail) \\<and> hd r |\\<in>| (\\<R> \\<ii>) \\<and> pathFitsListAndListIsARun \\<ii> p r \\<and> (down phead) = x \\<and> (\\<alpha> = symbol (hd r)))))\"                      \n              using pathSatisfiesApproximatorForRuleSet_def by fastforce\n            hence \"\\<And>\\<ii> . satisfiesApproximatorForRuleSet x (rulesPerAlpha \\<alpha> \\<ii>) \\<ii>\" using satisfiesApproximatorForRuleSet_def by blast\n            hence n76454 : \"x \\<in> \\<P> (rulesPerAlpha \\<alpha>)\" using \\<P>_def by simp\n            obtain path where n654e53 : \"path \\<in> pathsInTree x\"            using theSingletonPathExists by auto \n            hence \"\\<And>\\<ii> . (\\<exists> rule . symbol rule = \\<alpha> \\<and> rule |\\<in>| (\\<R> \\<ii>))\" using n764654 by fastforce\n            hence \"(\\<forall> \\<ii> . \\<alpha> |\\<in>| fimage symbol (\\<R> \\<ii>))\" by blast\n            then show \"x \\<in> \\<P> (rulesPerAlpha \\<alpha>) \\<and> (\\<forall> \\<ii> . \\<alpha> |\\<in>| fimage symbol (\\<R> \\<ii>))\" using n76454 by auto\n          qed\n          hence n564rt8i7 : \"\\<alpha> |\\<in>| (fimage symbol (\\<R> \\<aa>\\<^sub>1) |\\<union>| fimage symbol (\\<R> \\<aa>\\<^sub>2))\" by auto\n              \n          from n754654 \\<ff>_def restrictionIsFinite restrictionIsFinite2 \\<Z>\\<^sub>\\<tau>_def have \"height x \\<le> Suc n\"            by (simp add: \\<open>height x \\<le> Suc n\\<close>) \n              \n              from n6545877 \\<ff>_def restrictionIsFinite restrictionIsFinite2 \\<Z>\\<^sub>\\<tau>_def have n656988 : \"x |\\<in>| (\\<ff> (Suc n)  (rulesPerAlpha \\<alpha>))\"\n                by (metis n754654 zIntersectLemma) \n                  \n            from occurringAlphas_def show \"\\<alpha> |\\<in>| occurringAlphas\"  using n656988 n564rt8i7\n              by (metis (mono_tags, lifting) bot_fset.rep_eq fempty_iff ffmember_filter notin_fset) \n          qed\n            \n                \n          \n        have \"\\<And> i . ({|x|} \\<in> \\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`|  ((rulesPerAlpha \\<alpha>) i)))))\"\n        proof -\n          fix i\n          from n766 obtain z1 z2 where q10 : \"y = \\<Psi>\\<^sub>\\<phi> z1\" and q11 : \"y = \\<Psi>\\<^sub>\\<phi> z2\" and q12 : \"z1 \\<in> (\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| ((\\<R>) \\<aa>\\<^sub>1))))\" and q13 : \"z2 \\<in> (\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| ((\\<R>) \\<aa>\\<^sub>2))))\" using \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho>_def by blast\n          from n766 obtain zi where q10 : \"y = \\<Psi>\\<^sub>\\<phi> zi\" and q12 : \"zi \\<in> (\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((\\<R>) i))))\" using \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho>_def \\<A>.simps by (metis (full_types) \\<open>\\<And>thesis. (\\<And>z1 z2. \\<lbrakk>y = \\<Psi>\\<^sub>\\<phi> z1; y = \\<Psi>\\<^sub>\\<phi> z2; z1 \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1 |`| \\<R> \\<aa>\\<^sub>1); z2 \\<in> \\<Uplus> (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2 |`| \\<R> \\<aa>\\<^sub>2)\\<rbrakk> \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close> ot.exhaust)\n              \n          from q1 have n76898 : \"x |\\<in>| y\" by auto\n          from   q10 have n767988 : \"y = \\<Psi>\\<^sub>\\<phi> zi\" by auto\n          from q12 have nu6568 :  \"zi \\<in> (\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((\\<R>) i))))\" by auto\n          from psiF_def    have \"\\<Psi>\\<^sub>\\<phi> zi = fimage (\\<lambda> symbol2 . psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 zi)))))(fimage root zi)\" by auto\n          then obtain symbol2 where \"symbol2 |\\<in>| fimage root zi\" and n76y8 : \"x = psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 zi))))\"  using q1 q10 by fastforce \n          from n76y8 have \"symbol2 = root x\" using psiRoot root.simps         by (simp add: psiRoot) \n          then have n767988 : \"symbol2 = \\<alpha>\" using \\<alpha>_def by auto\n          def childrenForTheSymbol == \"(\\<Union>| (fimage childrenSet (childrenWithSymbol \\<alpha> zi)))\"\n          hence b76986 : \"x = psi (NODE symbol2 childrenForTheSymbol)\" using n767988 n76y8 by auto\n          from nu6568 biguplusForests_def    have n767898 : \"(\\<And> tr . tr |\\<in>| zi \\<Longrightarrow> (\\<exists> lang . lang |\\<in>| ( (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((\\<R>) i))  )) \\<and> (\\<exists> (subforest) . (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| zi \\<and> subforest \\<in> lang)))) \" by blast\n          def originalForest == \"ffilter (\\<lambda> tree . root tree = \\<alpha>) zi\"\n          have \"originalForest \\<noteq> {||}\" \n          proof \n            assume \"originalForest = {||}\" \n            then have \"\\<And>tr . tr |\\<in>| zi \\<Longrightarrow> root tr \\<noteq> \\<alpha>\" using originalForest_def by auto\n            then have \"\\<And>tr . tr |\\<in>| y \\<Longrightarrow> root tr \\<noteq> \\<alpha>\" using n767988 psiDef   using \\<open>symbol2 |\\<in>| root |`| zi\\<close> by fastforce \n            then show \"False\" using \\<alpha>_def n76898 by auto\n          qed\n          have n879698 : \"{|x|} = \\<Psi>\\<^sub>\\<phi> originalForest\"\n          proof -\n            from originalForest_def have \"originalForest = ffilter (\\<lambda> tree . root tree = \\<alpha>) zi\" by auto\n            from b76986  have \"x = psi (NODE symbol2 childrenForTheSymbol)\" by auto\n            from psiF_def have n767987 : \"\\<Psi>\\<^sub>\\<phi> originalForest = fimage (\\<lambda> symbol2 . psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 originalForest)))) ) (fimage root originalForest)\" by auto\n            from originalForest_def   have n655687 : \"(fimage root originalForest) |\\<subseteq>| {|\\<alpha>|}\"               using fimage_fsubsetI by auto \n            from n767987 n655687 have n65787 : \"\\<Psi>\\<^sub>\\<phi> originalForest |\\<subseteq>|  (finsert ( psi (NODE \\<alpha> (\\<Union>| (fimage childrenSet (childrenWithSymbol \\<alpha> originalForest)))   )) fempty)\"              by blast \n            then have n656899 : \"\\<Psi>\\<^sub>\\<phi> originalForest = (finsert ( psi (NODE \\<alpha> (\\<Union>| (fimage childrenSet (childrenWithSymbol \\<alpha> originalForest)))   )) fempty)\" using n65787 using fsubset_fsingletonD n767987 using \\<open>originalForest \\<noteq> {||}\\<close> by fastforce \n            have \"psi (NODE \\<alpha> (\\<Union>| (fimage childrenSet (childrenWithSymbol \\<alpha> originalForest)))   ) = x\"\n            proof -\n              from b76986    have \"x = psi (NODE symbol2 childrenForTheSymbol)\" by auto\n              then have \"x = NODE symbol2 (fimage (\\<lambda> symbol2 .psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 childrenForTheSymbol)))))(fimage root childrenForTheSymbol))\" \n                using psiDef by blast\n              then have \"x = NODE \\<alpha> (fimage (\\<lambda> symbol2 . psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 childrenForTheSymbol)))))(fimage root childrenForTheSymbol))\" \n                using n767988 by auto\n              def childrenSelected == \"(\\<Union>| (fimage childrenSet (childrenWithSymbol \\<alpha> originalForest)))\"\n              have \"psi (NODE \\<alpha>  childrenSelected  ) = NODE \\<alpha> (fimage (\\<lambda> symbol2 .psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 childrenSelected)))))(fimage root childrenSelected))\" \n                using psiDef childrenSelected_def by blast\n              have \"childrenWithSymbol \\<alpha> originalForest = childrenWithSymbol \\<alpha> zi\"\n              proof\n                show \"childrenWithSymbol \\<alpha> originalForest |\\<subseteq>| childrenWithSymbol \\<alpha> zi\" using originalForest_def childrenWithSymbol_def          by (metis ffmember_filter finterD1 finterI fsubsetI mem_Collect_eq) \n                show \"childrenWithSymbol \\<alpha> zi |\\<subseteq>| childrenWithSymbol \\<alpha> originalForest\"  \n                proof \n                  fix x\n                  assume \"x |\\<in>| childrenWithSymbol \\<alpha> zi\"\n                  then have \"x |\\<in>| inf_fset2 zi {child1. root child1 = \\<alpha>}\" using childrenWithSymbol_def                         by (simp add: childrenWithSymbol_def) \n                  then show \"x |\\<in>| childrenWithSymbol \\<alpha> originalForest\"  using childrenWithSymbol_def    originalForest_def by (metis Int_iff ffmember_filter finterD1 inf_fset2.rep_eq mem_Collect_eq notin_fset) \n                qed      \n              qed\n              then have \"childrenSelected = childrenForTheSymbol\" using childrenSelected_def childrenForTheSymbol_def originalForest_def childrenWithSymbol_def by auto\n              then have \"((fimage (\\<lambda> symbol2 .   psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 childrenSelected)))))(fimage root childrenSelected))) = ((fimage (\\<lambda> symbol2 .psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 childrenForTheSymbol))))) (fimage root childrenForTheSymbol)))\" by auto\n              then show \"psi (NODE \\<alpha> (\\<Union>| (fimage childrenSet (childrenWithSymbol \\<alpha> originalForest)))   ) = x\"                     using \\<open>psi (NODE \\<alpha> childrenSelected) = NODE \\<alpha> ((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 childrenSelected)))) |`| root |`| childrenSelected)\\<close> \\<open>x = NODE \\<alpha> ((\\<lambda>symbol2. psi (NODE symbol2 (\\<Union>| (childrenSet |`| childrenWithSymbol symbol2 childrenForTheSymbol)))) |`| root |`| childrenForTheSymbol)\\<close> childrenSelected_def by auto \n            qed\n            then show \"{|x|} = \\<Psi>\\<^sub>\\<phi> originalForest\"                     by (simp add: n656899) \n          qed\n          from n767898 originalForest_def have  \"(\\<And> tr . tr |\\<in>| originalForest \\<Longrightarrow> (\\<exists> lang . lang |\\<in>| ( (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((rulesPerAlpha \\<alpha>) i))  )) \\<and> (\\<exists> (subforest) . (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| originalForest \\<and> subforest \\<in> lang)))) \"\n          proof -\n            fix tr\n            assume n756988 : \"tr |\\<in>| originalForest\"\n            then have n76y8o7 : \"tr |\\<in>| zi\" using originalForest_def\n              by auto \n            from n767898 n767898 obtain lang subforest where n7686789 : \"lang |\\<in>| ( (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((\\<R>) i))  ))\" and n76809 : \"tr |\\<in>| subforest\"  and n6577 : \"subforest |\\<subseteq>| zi\" and  n65709 : \"subforest \\<in> lang\" by (meson n76y8o7) \n                \n            def newSubforest == \"originalForest |\\<inter>| subforest\"\n            from n76809 newSubforest_def n756988 have y62 : \"tr |\\<in>| newSubforest\" by auto\n            from n6577  newSubforest_def  have \"newSubforest |\\<subseteq>| zi\" by auto\n            from n7686789 n65709 forest_language_for_rule_def obtain rule where n76798 : \"rule |\\<in>| ((\\<R>) i)\" and \"\\<And> tree.(tree|\\<in>|subforest \\<longrightarrow>  tree_for_rule (\\<A> i) rule tree) \\<and> (\\<exists> tree. tree |\\<in>| subforest)\" and n76988 : \"lang = \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\" by blast\n            then have \"tree_for_rule (\\<A> i) rule tr\" using n76809 by auto\n            then have \"root tr = symbol rule\" using tree_for_rule_def by auto\n            then have n76698 : \"symbol rule = \\<alpha>\" using originalForest_def n756988 by auto\n            then have n75656988 : \"rule |\\<in>| ((rulesPerAlpha \\<alpha>) i)\" using n76798 rulesPerAlpha_def by auto \n            from n76698  n76988 n75656988 rulesPerAlpha_def have y60 : \"lang |\\<in>| ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((rulesPerAlpha \\<alpha>) i))\" by auto\n            have  y61 :\"newSubforest \\<in> lang\" \n            proof -\n              from n76988 have n76988 : \"lang = \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\" by auto\n              have \"(\\<forall>tree.(tree|\\<in>|newSubforest \\<longrightarrow>  tree_for_rule (\\<A> i) rule tree)) \\<and> (\\<exists> tree. tree |\\<in>| newSubforest)\" using  y62 newSubforest_def n76988 n65709 using \\<open>\\<And>tree. (tree |\\<in>| subforest \\<longrightarrow> tree_for_rule (\\<A> i) rule tree) \\<and> (\\<exists>tree. tree |\\<in>| subforest)\\<close> by auto\n              then have \"newSubforest \\<in> \\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) rule\" using forest_language_for_rule_def by auto\n              then show \"newSubforest \\<in> lang\"  using n76988 by auto\n            qed\n            from y60 y61 y62 newSubforest_def have \"lang |\\<in>| ( (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((rulesPerAlpha \\<alpha>) i))  ))\" and \"tr |\\<in>| newSubforest\" and \"newSubforest |\\<subseteq>| originalForest\" and \"newSubforest \\<in> lang\" by auto\n            then show \"(\\<exists> lang . lang |\\<in>| ( (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| ((rulesPerAlpha \\<alpha>) i))  )) \\<and> (\\<exists> (subforest) . (tr |\\<in>| subforest \\<and> subforest |\\<subseteq>| originalForest \\<and> subforest \\<in> lang)))\"       by blast \n          qed\n          then show \"{|x|} \\<in> \\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`|  ((rulesPerAlpha \\<alpha>) i))))\" using n879698 biguplusForests_def by auto\n        qed\n        then have nu676798 : \"{|x|} \\<in> (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> ((((rulesPerAlpha \\<alpha>)) \\<aa>\\<^sub>1))(((((rulesPerAlpha \\<alpha>)) \\<aa>\\<^sub>2))))\" using \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho>_def  by (metis (full_types) IntI \\<A>.simps(1) \\<A>.simps(2)) \n            \n        have \"x |\\<in>| bounded (Suc n)\" by (simp add: \\<open>height x \\<le> Suc n\\<close> restrictionIsFinite2)\n            \n        have \"\\<And>y . y |\\<in>| {|x|} \\<Longrightarrow> height y \\<le> Suc n\" using fsingletonD restrictionIsFinite notin_fset  using \\<open>height x \\<le> Suc n\\<close> by blast \n        then have \"{|x|} \\<in> (fset (boundedForests (Suc n)))\" using restrictionIsFiniteForests by blast\n        then have \"{|x|} |\\<in>| boundedForests (Suc n)\" using notin_fset by fastforce\n        then have n76689u : \"{|x|} |\\<in>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((((rulesPerAlpha \\<alpha>)) \\<aa>\\<^sub>1)))((((rulesPerAlpha \\<alpha>) \\<aa>\\<^sub>2)))))\" using nu676798 \\<Z>\\<^sub>\\<phi>_def by blast\n        from n64r57689 show \"x |\\<in>| \\<Union>| (gAlpha |`| occurringAlphas)\" using n76689u gAlpha_def using \\<gg>_def by auto \n      qed\n        \n      show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>) \\<subseteq> (\\<Union>\\<alpha>\\<in>fset occurringAlphas. \\<Pi>\\<^sub>\\<tau>\\<^sub>F (gAlpha \\<alpha>))\" \n      proof\n        fix x\n        assume n768 :  \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\"\n        from n767988 have \"((\\<gg> (Suc n) \\<R>)) |\\<subseteq>| \\<Union>|((\\<lambda>\\<alpha>. ((gAlpha \\<alpha>))) |`|  occurringAlphas)\" by auto\n        then have \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Union>|((\\<lambda>\\<alpha>. ((gAlpha \\<alpha>))) |`|  occurringAlphas))\" using n768  by (meson less_eq_fset.rep_eq pathsTreeLangMonotone subsetCE) \n        then obtain \\<alpha> where \"\\<alpha> |\\<in>| occurringAlphas\" and \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (((gAlpha \\<alpha>)))\"\n        proof -\n          assume a1: \"\\<And>\\<alpha>. \\<lbrakk>\\<alpha> |\\<in>| occurringAlphas; x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (gAlpha \\<alpha>)\\<rbrakk> \\<Longrightarrow> thesis\"\n          have f2: \"x |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (\\<Union>| (gAlpha |`| occurringAlphas))\"\n            using \\<open>x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Union>| (gAlpha |`| occurringAlphas))\\<close> notin_fset piFset by fastforce\n          obtain tt :: \"abc tree fset \\<Rightarrow> abc list \\<Rightarrow> abc tree\" where\n            f3: \"\\<forall>as f. (as |\\<notin>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<or> tt f as |\\<in>| f \\<and> as |\\<in>| \\<delta>\\<^sub>\\<tau> (tt f as)) \\<and> (as |\\<in>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> f \\<or> (\\<forall>t. t |\\<notin>| f \\<or> as |\\<notin>| \\<delta>\\<^sub>\\<tau> t))\"\n            by (metis pathsTreeForest)\n          obtain aa :: \"(abc \\<Rightarrow> bool) \\<Rightarrow> abc fset \\<Rightarrow> abc\" where\n            f4: \"\\<forall>x0 x1. (\\<exists>v2. v2 |\\<in>| x1 \\<and> x0 v2) = (aa x0 x1 |\\<in>| x1 \\<and> x0 (aa x0 x1))\"\n            by moura\n          obtain ff :: \"abc tree fset fset \\<Rightarrow> abc tree \\<Rightarrow> abc tree fset\" where\n            \"\\<forall>x0 x1. (\\<exists>v2. v2 |\\<in>| x0 \\<and> x1 |\\<in>| v2) = (ff x0 x1 |\\<in>| x0 \\<and> x1 |\\<in>| ff x0 x1)\"\n            by moura\n          then have f5: \"\\<forall>t f. t |\\<notin>| \\<Union>| f \\<or> ff f t |\\<in>| f \\<and> t |\\<in>| ff f t\"\n            by (meson ffUnionLemma)\n          then have \"fBex occurringAlphas (\\<lambda>a. ff (gAlpha |`| occurringAlphas) (tt (\\<Union>| (gAlpha |`| occurringAlphas)) x) = gAlpha a)\"\n            using f3 f2 by (metis (no_types) fimage_iff)\n          then have f6: \"aa (\\<lambda>a. ff (gAlpha |`| occurringAlphas) (tt (\\<Union>| (gAlpha |`| occurringAlphas)) x) = gAlpha a) occurringAlphas |\\<in>| occurringAlphas \\<and> ff (gAlpha |`| occurringAlphas) (tt (\\<Union>| (gAlpha |`| occurringAlphas)) x) = gAlpha (aa (\\<lambda>a. ff (gAlpha |`| occurringAlphas) (tt (\\<Union>| (gAlpha |`| occurringAlphas)) x) = gAlpha a) occurringAlphas)\"\n            using f4 by (meson fBexE)\n          then have \"tt (\\<Union>| (gAlpha |`| occurringAlphas)) x |\\<in>| gAlpha (aa (\\<lambda>a. ff (gAlpha |`| occurringAlphas) (tt (\\<Union>| (gAlpha |`| occurringAlphas)) x) = gAlpha a) occurringAlphas)\"\n            using f5 f3 f2 by presburger\n          then show ?thesis\n            using f6 f3 f2 a1 by (metis (no_types) notin_fset piFset)\n        qed\n        then show \"x \\<in> (\\<Union>\\<alpha>\\<in>fset occurringAlphas. \\<Pi>\\<^sub>\\<tau>\\<^sub>F (gAlpha \\<alpha>))\" by (meson UN_iff notin_fset) \n      qed\n    qed\n  qed\n   from u1 u2 u3 show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\" using notin_fset by fastforce\nqed\n\n\n  \nlemma core_main_lemma_conclusion :\n  fixes l\n  fixes \\<R>\n  fixes n\n  fixes j\n  assumes \"\\<And> \\<R>  r i. (r |\\<in>| \\<R> i \\<Longrightarrow> (r |\\<in>| rule_set (\\<A> i)))\"\n  assumes statesLanguagesNonempty : \"\\<And> \\<R> i r . (r |\\<in>| (\\<R> i) \\<Longrightarrow>  (\\<And> s . (s |\\<in>| (states r) \\<Longrightarrow> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> i) s)  \\<noteq> {}))))\"\n  assumes inStateSet : \"\\<And> \\<R> \\<ii> r  s . (r |\\<in>| (\\<R> \\<ii>) \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> s |\\<in>| state_set (\\<A> \\<ii>))\"\n  assumes    rulesLangsNonempty : \"\\<And> \\<R> i r . (r |\\<in>| rule_set (\\<A> i) \\<Longrightarrow>  ((\\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) r)  \\<noteq> {}))\"\n    assumes allRulesArePresent : \"(\\<And>i rule. rule |\\<in>| rule_set (\\<A> i))\"\n  shows \"\\<And>\\<R> . ((\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> n  \\<R>))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> n \\<R>)))\"\nproof (induct n)\n  case 0\n  have \"\\<And>\\<R>. (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> 0  \\<R>))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> 0 \\<R>))\"\n  proof -\n    fix \\<R>\n    have \"\\<And> tr . \\<exists>z . height tr = Suc z\" \n    proof -\n      fix tr\n      show \"\\<exists>z . height tr = Suc z\"\n      proof (induct tr)\n        case (NODE x1a x2a)\n        from height_def obtain val where \"height (NODE x1a x2a) = 1 + val\"            by simp\n        then show ?case by auto\n      qed\n    qed\n    then have h7656787  : \"\\<And>x y. x |\\<notin>| \\<Z>\\<^sub>\\<tau> 0 y\" using \\<Z>\\<tau>_lemma Z_def        by (metis (no_types, lifting) le_0_eq mem_Collect_eq notin_fset old.nat.distinct(2))\n    then  have n655676 : \"(\\<ff> 0  \\<R>) = {||}\" \n    proof -\n      assume \"\\<And>x y. x |\\<notin>| \\<Z>\\<^sub>\\<tau> 0 y\"\n      then show \"\\<ff> 0 \\<R> = {||}\"\n        using \\<ff>_def by blast\n    qed\n    from h7656787 have  n76587 : \"(\\<gg> 0 \\<R>) = {||}\" using \\<gg>_def  by (metis assms \\<P>_def \\<ff>_def all_not_fin_conv antisym_conv fsubsetI gInF) \n    from n655676 have a1 : \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> 0  \\<R>))) = {}\" using pathsForTreeLanguage_def        by auto\n    from n76587 have a2 : \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> 0 \\<R>)) = {}\"  using pathsForTreeLanguage_def       by auto\n    from a1 a2 show \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> 0  \\<R>))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> 0 \\<R>))\" by blast\n  qed\n  then show ?case by auto\nnext\n  case (Suc n)\n  show ?case\n  proof (rule disjE)\n    show \"fset (\\<ff> (Suc n)  \\<R>) \\<noteq> {} \\<or>fset (\\<ff> (Suc n)  \\<R>) = {} \" by auto\n    show \"fset (\\<ff> (Suc n) \\<R>) = {} \\<Longrightarrow> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\"\n    proof -\n      assume n76a5677 : \"fset (\\<ff> (Suc n) \\<R>) = {}\"\n      then have n654588 :  \"fset (\\<gg> (Suc n) \\<R>) = {}\" using \\<P>_def \\<ff>_def all_not_fin_conv antisym_conv fsubsetI gInF  \\<gg>_def          by (metis assms bot.extremum_uniqueI less_eq_fset.rep_eq) \n      from n76a5677   have a1 : \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))) = {}\" using pathsForTreeLanguage_def        by auto\n      from n654588   have a2 : \"(\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n)  \\<R>))) = {}\" using pathsForTreeLanguage_def        by auto\n      from a1 a2 show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\" by auto\n    qed\n    show \"fset (\\<ff> (Suc n) \\<R>) \\<noteq> {} \\<Longrightarrow> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\"\n    proof (rule disjE)\n      show \"Suc n > \\<N> \\<or> Suc n \\<le> \\<N>\" by linarith\n      assume n655688 : \"fset (\\<ff> (Suc n) \\<R>) \\<noteq> {}\"\n      {\n        assume n54764 : \"Suc n > \\<N>\"\n        have \"    (\\<And>\\<ii> r s. r |\\<in>| \\<R> \\<ii> \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>) s \\<noteq> {}) \\<Longrightarrow>     (\\<And>rs2. \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> n rs2) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> n rs2)) \\<Longrightarrow> (\\<And>\\<ii> r s. r |\\<in>| \\<R> \\<ii> \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> s |\\<in>| state_set (\\<A> \\<ii>)) \\<Longrightarrow> \\<N> < Suc n \\<Longrightarrow> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\"            using core_main_lemma4 n655688 assms   Suc.hyps  by auto\n        hence \"    (\\<And>\\<ii> r s. r |\\<in>| \\<R> \\<ii> \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> \\<L>\\<^sub>\\<phi>\\<^sub>\\<sigma> (\\<A> \\<ii>) s \\<noteq> {}) \\<Longrightarrow>      (\\<And>\\<ii> r s. r |\\<in>| \\<R> \\<ii> \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> s |\\<in>| state_set (\\<A> \\<ii>))  \\<Longrightarrow> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\"            using assms  n54764 Suc.hyps   by auto\n        hence \"      (\\<And>\\<ii> r s. r |\\<in>| \\<R> \\<ii> \\<Longrightarrow> s |\\<in>| states r \\<Longrightarrow> s |\\<in>| state_set (\\<A> \\<ii>))  \\<Longrightarrow> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\"            using assms(2)      by fastforce\n        then show \" \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\"            using assms(3)     by fastforce\n      }\n      {\n        assume n7568 : \"Suc n \\<le> \\<N> \"\n        show \"((\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  \\<R>))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<gg> (Suc n) \\<R>)))\" \n        proof\n          from smallerThanN n7568 have n546687 : \"\\<And>f \\<ii>. (                          f |\\<in>| (\\<Z>\\<^sub>\\<tau> (Suc n) (\\<P>\\<^sub>1 \\<R> \\<ii>)) \\<Longrightarrow>                        \\<Pi> f \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>)))))))\" by auto\n          then show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) \\<subseteq> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\"                   \n          proof -\n            have \"\\<And>x . x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) \\<Longrightarrow> x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\" \n            proof -\n              fix x\n              assume \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>)\"\n              then obtain tr where n7896 : \"tr |\\<in>| (\\<ff> (Suc n) \\<R>)\" and n6578 : \"x |\\<in>| \\<Pi> tr\" using pathsForTreeLanguage_def                      by (metis notin_fset pathsTreeForest piFset)\n              then have n5787 : \"\\<And>  \\<ii> . tr |\\<in>| (\\<Z>\\<^sub>\\<tau> (Suc n) (\\<P>\\<^sub>1 \\<R> \\<ii>))\" using \\<ff>_def \\<P>_def\n              proof -\n                fix \\<ii> :: ot\n                have \"tr \\<in> {t. \\<forall>z. satisfiesApproximatorForRuleSet t (\\<R> z) z}\"                          by (metis (no_types) \\<P>_def \\<ff>_def \\<open>tr |\\<in>| \\<ff> (Suc n) \\<R>\\<close> zIntersectLemma)\n                then have \"tr \\<in> {t. satisfiesApproximatorForRuleSet t (\\<R> \\<ii>) \\<ii>}\"                          by blast\n                then show \"tr |\\<in>| \\<Z>\\<^sub>\\<tau> (Suc n) (\\<P>\\<^sub>1 \\<R> \\<ii>)\"                          by (metis (no_types) \\<P>\\<^sub>1_def \\<ff>_def \\<open>tr |\\<in>| \\<ff> (Suc n) \\<R>\\<close> zIntersectLemma)\n              qed \n              then have n548761 : \"\\<And>  \\<ii>. \\<Pi> tr \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>))))))\"  using n546687                          by simp\n                  \n              have n5458779 : \"\\<And>  \\<ii>. \\<Pi> tr \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> `( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>)))))))\"  \n              proof -\n                fix \\<ii>\n                from n548761  have \"\\<Pi> tr \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>))))))\" by auto\n                then obtain otherForest where \"otherForest \\<in> (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>))))))\" and n65787 : \"\\<Pi> tr = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> otherForest\"                              by blast \n                then have \"\\<Psi>\\<^sub>\\<phi> otherForest \\<in> ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>)))))))\" by auto\n                then have \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<phi> otherForest) \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> `( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>)))))))\" by auto\n                then show \"\\<Pi> tr \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> `( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (\\<R> \\<ii>)))))))\" using n65787 psiPreservesPaths by auto \n              qed\n              from n548761  have r1 : \"\\<Pi> tr \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<aa>\\<^sub>1)) |`| (\\<R> \\<aa>\\<^sub>1))))))\" by blast\n              from n548761  have r2 : \"\\<Pi> tr \\<in> \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> ` (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<aa>\\<^sub>2)) |`| (\\<R> \\<aa>\\<^sub>2))))))\"  by blast\n              from r1 obtain otherForest1 where s1 : \"otherForest1 \\<in> (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<aa>\\<^sub>1)) |`| (\\<R> \\<aa>\\<^sub>1))))))\" and n657871 : \"\\<Pi> tr = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> otherForest1\"                              by blast \n              from r2 obtain otherForest2 where s2 : \"otherForest2 \\<in> (((\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<aa>\\<^sub>2)) |`| (\\<R> \\<aa>\\<^sub>2))))))\" and n657872 : \"\\<Pi> tr = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> otherForest2\"                              by blast \n              from n657871 n657872 have \"\\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> otherForest1 = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> otherForest2\" by auto\n              then have n237678 : \"\\<Psi>\\<^sub>\\<phi> otherForest1 = \\<Psi>\\<^sub>\\<phi> otherForest2\" using psiOnlyDependsOnPath by blast\n              from s1 n237678 have t1 : \"\\<Psi>\\<^sub>\\<phi> otherForest1 \\<in> ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<aa>\\<^sub>1)) |`| (\\<R> \\<aa>\\<^sub>1)))))))\" by auto\n              from s2 n237678 have t2 : \"\\<Psi>\\<^sub>\\<phi> otherForest1 \\<in> ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<aa>\\<^sub>2)) |`| (\\<R> \\<aa>\\<^sub>2)))))))\" by auto\n              have n65897764 : \"\\<Pi> tr = \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<phi> otherForest1)\"  by (simp add: n657871 psiPreservesPaths) \n              from t1 t2 have n5458098 : \"\\<Psi>\\<^sub>\\<phi> otherForest1 \\<in> ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<aa>\\<^sub>1)) |`| (\\<R> \\<aa>\\<^sub>1))))))) \\<inter> ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<aa>\\<^sub>2)) |`| (\\<R> \\<aa>\\<^sub>2)))))))\" by auto\n              from n7896  \\<ff>_def \\<Z>\\<tau>_lemma Z_def notin_fset have \"tr \\<in> Z (Suc n) (\\<P> \\<R>)\"                                               by metis\n              then  have n5434679 : \"height tr \\<le> Suc n\" using Z_def by blast\n              have \"\\<And> tree . tree |\\<in>| \\<Psi>\\<^sub>\\<phi> otherForest1 \\<Longrightarrow> height tree \\<le> Suc n\"\n              proof -\n                fix tree\n                assume \"tree |\\<in>| \\<Psi>\\<^sub>\\<phi> otherForest1\"\n                then  have \"\\<Pi> tree |\\<subseteq>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<phi> otherForest1)\"                        by (meson fsubsetI pathsTreeForest)\n                then have \"\\<Pi> tree |\\<subseteq>| \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> (\\<Psi>\\<^sub>\\<phi> otherForest1)\" using n65897764 by auto\n                then have \"\\<Pi> tree |\\<subseteq>| \\<Pi> tr\" using n657871  n65897764 by auto\n                then show \"height tree  \\<le> Suc n\" using n5434679 heightOnlyDependsOnPaths                            by (metis dual_order.trans fimage_mono maxMonotonic) \n              qed\n              then have n656798 : \"\\<Psi>\\<^sub>\\<phi> otherForest1 |\\<in>| (((\\<Z>\\<^sub>\\<phi> (Suc n) ((((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<aa>\\<^sub>1)) |`| (\\<R> \\<aa>\\<^sub>1)))))))\\<inter> ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<aa>\\<^sub>2)) |`| (\\<R> \\<aa>\\<^sub>2)))))))))))\"\n              proof -\n                assume \"\\<And>tree. tree |\\<in>| \\<Psi>\\<^sub>\\<phi> otherForest1 \\<Longrightarrow> height tree \\<le> Suc n\"\n                then have \"\\<Psi>\\<^sub>\\<phi> otherForest1 \\<in> fset (boundedForests (Suc n))\"                        by (simp add: restrictionIsFiniteForests)\n                then have \"\\<Psi>\\<^sub>\\<phi> otherForest1 |\\<in>| boundedForests (Suc n)\"                        by (meson notin_fset)\n                then show ?thesis                        using \\<Z>\\<^sub>\\<phi>_def n5458098 by blast\n              qed \n              then have n656798b : \"\\<Psi>\\<^sub>\\<phi> otherForest1 |\\<subseteq>| \\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| (\\<R> \\<aa>\\<^sub>1)))))        \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| (\\<R> \\<aa>\\<^sub>2))))))))\"      by auto\n              then have n656798c : \"(\\<Pi> |`|  (\\<Psi>\\<^sub>\\<phi> otherForest1)) |\\<subseteq>| (\\<Pi> |`|  (\\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| (\\<R> \\<aa>\\<^sub>1)))))       \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| (\\<R> \\<aa>\\<^sub>2))))))))))\" by auto\n              from n6578  n657871 pathsTreeForest obtain tree3 where ni866 : \"x |\\<in>| \\<Pi> tree3\" and \"tree3 |\\<in>| (\\<Psi>\\<^sub>\\<phi> otherForest1)\"                          by (metis n65897764)\n              then have n65898 : \"\\<Pi> tree3 |\\<in>| (\\<Pi> |`|  (\\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| (\\<R> \\<aa>\\<^sub>1)))))       \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| (\\<R> \\<aa>\\<^sub>2))))))))))\" using n656798c                          by blast \n              from \\<gg>_def \\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho>_def have n54643 : \" \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>) =  \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| (\\<R> \\<aa>\\<^sub>1)))))    \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| (\\<R> \\<aa>\\<^sub>2)))))))))\" by auto\n              from n65898 ni866 pathsForTreeLanguage_def have \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) ( ((\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>1) |`| (\\<R> \\<aa>\\<^sub>1)))))      \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> \\<A>\\<^sub>2) |`| (\\<R> \\<aa>\\<^sub>2)))))))))\"     by (metis (mono_tags, lifting) \\<open>tree3 |\\<in>| \\<Psi>\\<^sub>\\<phi> otherForest1\\<close> less_eq_fset.rep_eq mem_Collect_eq n656798b notin_fset subsetCE)\n              then show \"x \\<in> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\" using n54643 by auto\n            qed\n            then show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>) \\<subseteq> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>)\"    by auto\n          qed\n          show \"\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<gg> (Suc n) \\<R>) \\<subseteq> \\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<ff> (Suc n) \\<R>)\"                    by (metis assms \\<gg>_def gInF less_eq_fset.rep_eq pathsTreeLangMonotone) \n        qed\n      }\n    qed\n  qed\nqed\n  \n    \nend\n  \n    \n  (*\n  (* maybe showing this here is easier after all ... *)\n  \n  from UnionPathsInOut psiPiIntersection have n649853 : \"\\<Pi>\\<^sub>\\<phi> ( (\\<Z>\\<^sub>\\<phi>\\<^sub>F n ((\\<Psi>\\<^sub>\\<phi> ` (\\<Uplus> (S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Uplus> (S2)))))) = \\<Pi>\\<^sub>\\<delta> (fset (\\<Z>\\<^sub>\\<delta> n (( (\\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1))) \\<inter> ((\\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2))))))\" sorry\n      \n  from assms(1) have  \"\\<And> l . l |\\<in>| ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<Longrightarrow> closedUnderPlusD (l)\" using closedAndP by auto\n  from assms(2) have  \"\\<And> l . l |\\<in>| ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2) \\<Longrightarrow> closedUnderPlusD (l)\" using closedAndP by auto\n  from assms(3)  have \"\\<And>l . l |\\<in>| ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<Longrightarrow> l \\<noteq> {}\" by blast\n  from assms(4) have \"\\<And>l . l |\\<in>| ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2) \\<Longrightarrow> l \\<noteq> {}\"\n    by blast \n  from assms(6)  have \"\\<And> l. (l |\\<in>| (((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1)) \\<Longrightarrow> realizedInD l \\<ff>)\" using realizedInD_def realizedInForest_def\n    by (metis (no_types, lifting) fimageE image_eqI) \n  from assms(7)  have \"\\<And> l. (l |\\<in>| (((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2)) \\<Longrightarrow> realizedInD l \\<ff>)\" using realizedInD_def realizedInForest_def\n    by (metis (no_types, lifting) fimageE image_eqI) \n      \n  from realizationLemmaD have \" (\\<And>l. l |\\<in>| ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<Longrightarrow> closedUnderPlusD l) \\<Longrightarrow>\n  (\\<And>l. l |\\<in>| ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2) \\<Longrightarrow> closedUnderPlusD l) \\<Longrightarrow>\n  (\\<And>l. l |\\<in>| ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<Longrightarrow> l \\<noteq> {}) \\<Longrightarrow>\n  (\\<And>l. l |\\<in>| ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2) \\<Longrightarrow> l \\<noteq> {}) \\<Longrightarrow>\n  (\\<And>l. l |\\<in>| ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<Longrightarrow> realizedInD l (UNION (fset (\\<Z>\\<^sub>\\<delta> n (\\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<inter> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2)))) fset)) \\<Longrightarrow>\n  (\\<And>l. l |\\<in>| ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2) \\<Longrightarrow> realizedInD l (UNION (fset (\\<Z>\\<^sub>\\<delta> n (\\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<inter> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2)))) fset)) \\<Longrightarrow> \nUNION (fset (\\<Z>\\<^sub>\\<delta> n (\\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<inter> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2)))) fset = UNION (fset (\\<Z>\\<^sub>\\<delta> n (\\<Oplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<inter> \\<Oplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2)))) fset \" by auto\n  hence \"UNION (fset (\\<Z>\\<^sub>\\<delta> n (\\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<inter> \\<Uplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2)))) fset = UNION (fset (\\<Z>\\<^sub>\\<delta> n (\\<Oplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1) \\<inter> \\<Oplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2)))) fset\"\n    using \\<open>\\<And>l. l |\\<in>| op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> |`| S1 \\<Longrightarrow> closedUnderPlusD l\\<close> \\<open>\\<And>l. l |\\<in>| op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> |`| S1 \\<Longrightarrow> l \\<noteq> {}\\<close> \\<open>\\<And>l. l |\\<in>| op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> |`| S1 \\<Longrightarrow> realizedInD l \\<ff>\\<close> \\<open>\\<And>l. l |\\<in>| op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> |`| S2 \\<Longrightarrow> closedUnderPlusD l\\<close> \\<open>\\<And>l. l |\\<in>| op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> |`| S2 \\<Longrightarrow> l \\<noteq> {}\\<close> \\<open>\\<And>l. l |\\<in>| op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> |`| S2 \\<Longrightarrow> realizedInD l \\<ff>\\<close> \\<open>\\<Pi>\\<^sub>\\<phi> (\\<Z>\\<^sub>\\<phi>\\<^sub>F n (\\<Psi>\\<^sub>\\<phi> ` \\<Uplus> S1 \\<inter> \\<Psi>\\<^sub>\\<phi> ` \\<Uplus> S2)) = UNION (fset (\\<Z>\\<^sub>\\<delta> n (\\<Uplus>\\<^sub>\\<delta> (op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> |`| S1) \\<inter> \\<Uplus>\\<^sub>\\<delta> (op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi> |`| S2)))) fset\\<close> local.\\<ff>_def by auto \n  hence nu6453 : \"\\<ff> = \\<Pi>\\<^sub>\\<delta> (fset (\\<Z>\\<^sub>\\<delta> n (( (\\<Oplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1))) \\<inter> ((\\<Oplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2))))))\" using assms(5) n649853 by auto\n      \n  have \"\\<Pi>\\<^sub>\\<delta> (fset (\\<Z>\\<^sub>\\<delta> n (( (\\<Oplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S1))) \\<inter> ((\\<Oplus>\\<^sub>\\<delta> ((op ` \\<Pi>\\<^sub>\\<iota>\\<^sub>\\<phi>) |`| S2)))))) = \\<Pi>\\<^sub>\\<phi> ( (\\<Z>\\<^sub>\\<phi>\\<^sub>F n ((\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> (S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> (S2))))))\" sorry\n  then show   \"\\<ff> = \\<Pi>\\<^sub>\\<phi> ( (\\<Z>\\<^sub>\\<phi>\\<^sub>F n ((\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> (S1))) \\<inter> (\\<Psi>\\<^sub>\\<phi> `(\\<Oplus> (S2))))))\" using nu6453 by auto\nqed\n  *)\n    \n  \n  \n(*lemma realizationLemmaD :\n  fixes S1\n  fixes S2\n  fixes n\n    fixes \\<ff>\n  assumes \"\\<And>l . l |\\<in>| S1 \\<Longrightarrow> closedUnderPlusD (l)\"\n  assumes \"\\<And>l . l|\\<in>| S2 \\<Longrightarrow> closedUnderPlusD (l)\"\n  assumes \"\\<And>l . l |\\<in>| S1 \\<Longrightarrow> l \\<noteq> {}\"\n  assumes \"\\<And>l . l |\\<in>| S2 \\<Longrightarrow> l \\<noteq> {}\"\n  defines \"\\<ff> == \\<Pi>\\<^sub>\\<delta> (fset (\\<Z>\\<^sub>\\<delta> n (( (\\<Uplus>\\<^sub>\\<delta> (S1))) \\<inter> ((\\<Uplus>\\<^sub>\\<delta> (S2))))))\"\n  assumes \"\\<And> l. (l |\\<in>| (S1) \\<Longrightarrow> realizedInD l \\<ff>)\"\n  assumes \"\\<And> l. (l |\\<in>| (S2) \\<Longrightarrow> realizedInD l \\<ff>)\"\n  shows \"\\<ff> = \\<Pi>\\<^sub>\\<delta> (fset ( (\\<Z>\\<^sub>\\<delta> n (((\\<Oplus>\\<^sub>\\<delta> (S1))) \\<inter> ((\\<Oplus>\\<^sub>\\<delta> (S2)))))))\"\n  sorry*)\n  \n  (*\nlemma NGreaterZero :\n  assumes \"(\\<And>\\<R> i r. r |\\<in>| rule_set (\\<A> i) \\<Longrightarrow> \\<L>\\<^sub>\\<tau>\\<^sub>\\<rho> (\\<A> i) r \\<noteq> {})\"\n  shows \"1 \\<le> \\<N>\"\nproof (rule ccontr)\n  assume \"\\<not> 1 \\<le> \\<N>\"\n  hence n765465 : \"\\<N> = 0\" by arith\n      \n  from assms existsUniformConstant have n65476 : \"realizesUniv \\<N>\" by auto\n  from realizesUniv_def n65476 have \"(\\<And>i \\<alpha> r n2. \\<N> < Suc n2 \\<longrightarrow> r |\\<in>| rule_set (\\<A> i) \\<longrightarrow> symbol r = \\<alpha> \\<longrightarrow> realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) r) (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Z>\\<^sub>\\<tau> n2 UNIV) \\<union> {[]})))\" by auto\n  hence \"(\\<And>i \\<alpha> r n2. 0 < Suc n2 \\<longrightarrow> r |\\<in>| rule_set (\\<A> i) \\<longrightarrow> symbol r = \\<alpha> \\<longrightarrow> realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) r) (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Z>\\<^sub>\\<tau> n2 UNIV) \\<union> {[]})))\" using n765465 by auto\n  hence \"(\\<And>i \\<alpha> r n2.  r |\\<in>| rule_set (\\<A> i) \\<longrightarrow> symbol r = \\<alpha> \\<longrightarrow> realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) r) (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Z>\\<^sub>\\<tau> n2 UNIV) \\<union> {[]})))\" by auto\n  hence \"(\\<And>i \\<alpha> r.  r |\\<in>| rule_set (\\<A> i) \\<longrightarrow> symbol r = \\<alpha> \\<longrightarrow> realizedInForest (\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i) r) (\\<alpha> \\<bullet> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F (\\<Z>\\<^sub>\\<tau> 0 UNIV) \\<union> {[]})))\" by auto\n      \n      obtain  \\<alpha> where \"( \\<alpha> :: abc) =  \\<alpha>\" by auto\n  obtain state where \"(state :: stt) = state\" by auto\n  then obtain stateset where \"state |\\<in>| stateset\" by auto\n  then obtain rule where \"symbol (rule :: (stt,abc) rule) =  \\<alpha>\" and \"states rule = stateset\"        by (meson rule.select_convs(1) rule.select_convs(2)) \n      *)\n      \n  \n  (*proof\n fix x\n assume b1 : \"x |\\<in>| \\<Z>\\<^sub>\\<tau> n (intersectionLanguageRules (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\"\n from zIntersectLemma b1 have b2 : \"x |\\<in>| \\<Z>\\<^sub>\\<tau> n UNIV \\<and> x \\<in> (intersectionLanguageRules (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" by metis\n from b2 intersectionLanguageRules_def \\<A>.simps have b4 : \"\\<And> i. x \\<in> (\\<Uplus> ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> i)) |`| (\\<R> i)))\" by (metis (full_types) IntE \\<A>.cases)\n from b4 have b5 : \"\\<And> i.   satisfiesApproximatorForRuleSet x (\\<R> i) i\" sorry\n from \\<ff>_def have b3 : \"\\<ff> n \\<R> = \\<Z>\\<^sub>\\<tau> n (\\<P> \\<R>)\" by auto\n from b3 b5 zIntersectLemma show \"x |\\<in>| (\\<ff> n \\<R>)\" using b2 \\<P>_def mem_Collect_eq by blast\nqed*)\n  \n(*lemma gInFD : \n  fixes \\<R>\n  fixes n\n  shows \" ( (\\<Z>\\<^sub>\\<delta> n (\\<delta>\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (((\\<R>) \\<aa>\\<^sub>1))((((\\<R>) \\<aa>\\<^sub>2)))))) |\\<subseteq>| \\<Pi> |`| (\\<ff> n  \\<R>)\"\n  sorry*)\n    \n(*        \n        \n    have n65897 : \" tree \\<in> (fset (\\<Z>\\<^sub>\\<tau> (Suc n)(\\<P> \\<R>)))\"  using n76465          by (simp add: \\<ff>_def fmember.rep_eq)\n    hence \"height tree \\<le> 1\" using n7656897  by auto\n        \n        \n    from  n65897 have \" tree \\<in> (((\\<P> \\<R>)))\" using \\<Z>\\<^sub>\\<tau>_def notin_fset sorry\n        \n    from singletonPathsMeansSingletonTree have \"(\\<And>tree path. tree \\<in> fset (\\<ff> (Suc n)  \\<R>) \\<Longrightarrow> path |\\<in>| \\<Pi> tree \\<Longrightarrow> path = [\\<alpha>])\n\\<Longrightarrow> (\\<And> tree. tree \\<in> fset (\\<ff> (Suc n)  \\<R>) \\<Longrightarrow> tree = NODE \\<alpha> {||})\" by metis\n    hence \"(\\<And> tree. tree \\<in> fset (\\<ff> (Suc n)  \\<R>) \\<Longrightarrow> tree = NODE \\<alpha> {||})\" using n75478 by auto\n        \n      \n        \n        \n        \n        have \"tree \\<in> (fset (\\<Z>\\<^sub>\\<tau> (1)(\\<P> \\<R>)))\" using n76465          by (simp add: \\<ff>_def fmember.rep_eq)\n        \n        hence \"\\<And>tree .  tree \\<in> (fset (\\<Z>\\<^sub>\\<tau> (Suc n)(\\<P> \\<R>))) \\<Longrightarrow> tree \\<in> (fset (\\<Z>\\<^sub>\\<tau> (1)(\\<P> \\<R>)))\"  using \\<Z>\\<^sub>\\<tau>_def restrictionIsFinite2 restrictionIsFinite          by (simp add: inf_fset2.rep_eq) \n         \n            \n        \n            from n656897 have \"\\<And>tree path . tree \\<in> (fset ((\\<gg> (Suc n) \\<R>))) \\<Longrightarrow> (path |\\<in>| (\\<Pi> tree)) \\<Longrightarrow> path = [\\<alpha>]\" using pathsForTreeLanguage_def by blast\n    hence \"\\<And>tree path . tree \\<in> (fset (\\<gg> (Suc n)  \\<R>)) \\<Longrightarrow> (path |\\<in>| (\\<Pi> tree)) \\<Longrightarrow> length path = length [\\<alpha>] \" by auto\n    hence \"\\<And>tree path . tree \\<in> (fset (\\<gg> (Suc n)  \\<R>)) \\<Longrightarrow> (path |\\<in>| (\\<Pi> tree)) \\<Longrightarrow> length path = 1 \" by auto\n    hence \"\\<And>tree path . tree \\<in> (fset (\\<gg> (Suc n)  \\<R>)) \\<Longrightarrow> (path |\\<in>| (\\<Pi> tree)) \\<Longrightarrow> length path \\<le> 1 \" by auto\n    hence \"\\<And>tree .  tree \\<in> (fset (\\<gg> (Suc n)  \\<R>)) \\<Longrightarrow> height tree \\<le> 1\" using heightOnlyDependsOnPaths finiteMaxExists  by (metis One_nat_def fimageE le_SucI le_zero_eq) \n    hence n65875 :  \"\\<And>tree .  tree \\<in> (fset (\\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))))) \\<Longrightarrow> height tree \\<le> 1\"  using \\<gg>_def by auto\n        \n    hence \"\\<And>tree .  tree \\<in> (fset (\\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))))) \\<Longrightarrow> tree \\<in> (fset (\\<Union>| (\\<Z>\\<^sub>\\<phi> 1 (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))))\" \n    proof -\n      fix tree\n      assume \"tree \\<in> (fset (\\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))))\"\n      obtain forest where n7646 : \"forest |\\<in>| \\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" and n6754656 : \"tree |\\<in>| forest\" using notin_fset ffUnionLemma\n        by (metis \\<open>tree \\<in> fset (\\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))))\\<close>) \n      from n7646 have \"\\<And>tree . tree |\\<in>| forest \\<Longrightarrow> tree |\\<in>| (\\<Union>| (\\<Z>\\<^sub>\\<phi> (Suc n) (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))))\" using ffUnionLemma by blast\n      hence n65687 : \"\\<And> tree . tree |\\<in>| forest \\<Longrightarrow> height tree \\<le> 1\" using n65875 notin_fset            by fastforce \n      from n7646 \\<Z>\\<^sub>\\<phi>_def   have n6587 :  \"forest \\<in>  (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" sorry\n      \n          \n      from n65687 restrictionIsFiniteForests notin_fset have n6587b : \"forest |\\<in>| boundedForests 1\" sorry\n      from n6587 n6587b have \"forest |\\<in>| \\<Z>\\<^sub>\\<phi> 1 (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2))\" using \\<Z>\\<^sub>\\<phi>_def by auto \n      hence \"tree |\\<in>| \\<Union>| (\\<Z>\\<^sub>\\<phi> 1 (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))\" using n6754656 by auto\n      then show \"tree \\<in> (fset (\\<Union>| (\\<Z>\\<^sub>\\<phi> 1 (\\<Psi>\\<^sub>\\<Sigma>\\<^sub>\\<rho> (\\<R> \\<aa>\\<^sub>1) (\\<R> \\<aa>\\<^sub>2)))))\"  using notin_fset by metis\n    qed\n        \n        \n      \n      \n        hence n7546 : \"\\<And>tree  . tree \\<in> (fset (\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> (\\<Pi> tree) |\\<subseteq>| (finsert [\\<alpha>] fempty)\"         by auto \n    hence \"(\\<Pi> tree) |\\<subseteq>| (finsert [\\<alpha>] fempty)\"  using n76465 notin_fset by metis\n    have n7464 : \"\\<And> children root. (NODE root children) \\<in> (fset (\\<ff> (Suc n)  \\<R>)) \\<Longrightarrow> (\\<Pi> (NODE root children)) |\\<subseteq>| (finsert [\\<alpha>] fempty)\"      using n7546 by blast \n        \n    have \"(fset (\\<ff> (Suc n)  \\<R>)) = {(NODE \\<alpha> fempty)}\" \n    proof \n      show \"fset (\\<ff> (Suc n) \\<R>) \\<subseteq> {NODE \\<alpha> {||}}\"\n      proof \n        fix x\n        assume n75687 : \" x \\<in> fset (\\<ff> (Suc n) \\<R>)\"\n        obtain root children where \"x = (NODE root children)\" using tree.exhaust by auto\n        then have n6587 : \" (\\<Pi> (NODE root children)) |\\<subseteq>| (finsert [\\<alpha>] fempty)\" using n75687  n7464 by auto\n        from pathAlternateDef have n54647 : \"(\\<Pi> (NODE root children)) = (\\<lambda> x. (root#x)) |`| (\\<Union>| (\\<Pi> |`| children) |\\<union>| {|[]|})\" by auto\n        from n6587 have n656587 : \"(\\<Pi> (NODE root children)) |\\<subseteq>| (\\<lambda> x. (root#x)) |`| ({|[]|})\" by auto\n        have n6445877 : \"(\\<lambda> x. (root#x)) |`| ({|[]|}) = (finsert [root] fempty)\" by simp\n        hence n76535 : \"(finsert [root] fempty) |\\<subseteq>| (finsert [\\<alpha>] fempty)\" using n6587  n656587 by auto\n        hence \"root = \\<alpha>\" by auto\n        hence \" (\\<lambda> x. (\\<alpha>#x)) |`| (\\<Union>| (\\<Pi> |`| children) |\\<union>| {|[]|}) |\\<subseteq>| (finsert [\\<alpha>] fempty)\" using n76535 n6445877 n54647 n656587 by auto\n        hence \"(\\<Union>| (\\<Pi> |`| children) |\\<union>| {|[]|}) = {|[]|}\" by auto\n        \n          \n        \n        \n        \n        *)\n        \n  \n  \n(*\nlemma psiSubsetsLemma :\n  fixes z\n  shows \"\\<And> p x . (p \\<in> (pathsInTree x) \\<Longrightarrow> x = psi z \\<Longrightarrow> (\\<exists>p2.(childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree z)))\"\nproof -\n  fix p\n  fix x :: \"abc tree\"\n  assume \"p \\<in> (pathsInTree x)\"\n  def forest == \"(finsert x fempty)\"\n  def originalForest == \"(finsert z fempty)\"\n    assume \" x = psi z\"\n    hence \"forest = psiF originalForest\" using forest_def originalForest_def psiF_def sorry\n        \n    show \"(\\<exists>p2.(childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree z))\" sorry\n  qed\n  *)\n    \n    \n    \n    \n    (*proof (induct z)\n  case (NODE x1a x2a)\n  fix p\n  fix x\n  assume a1 : \"(\\<And>x2aa p x. x2aa \\<in> fset x2a \\<Longrightarrow> p \\<in> pathsInTree x \\<Longrightarrow> x = psi x2aa \\<Longrightarrow> \\<exists>p2. childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree x2aa)\"\n    assume a2 : \"x = psi (NODE x1a x2a)\"\n  assume a3 : \" p \\<in> pathsInTree x\"\n  \n    \n  from a2  have a10 : \"x\n      = NODE x1a (fimage (\\<lambda> symbol2 .\n                              psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 x2a)))\n                                  )\n                              )\n                              (fimage root x2a)\n                     )\"\n    by (metis psi.simps)\n      from a3 have a11 : \"(isAPathp p) \\<and> (( \\<exists>e1.\\<exists>tail.(p = (e1#tail) \\<and> (isNodeIn e1 x) \\<and> (isRootNode e1)        )      ))\"\n        by (simp add: pathsInTree_def)\n    (* also here, for induction should not take isAPathp but instead something that doesn't check whether the first element is a root *)\n      obtain child where q1 : \"child |\\<in>| x2a\" and \"(tl p) \\<in>  pathsInTree child\" sorry\n      define childRoot where q2 : \"childRoot = (root child)\"\n        define psiChild where q3 : \"psiChild = psi (NODE childRoot (\\<Union>| (fimage childrenSet (childrenWithSymbol childRoot x2a))))\"\n        from a10 q1 q2 q3 have \"psiChild  |\\<in>| (childrenSet x)\" by (metis (no_types, lifting) childrenSet.simps fimage_eqI)\n            \n            \n      obtain p2 :: \"abc node list\" where \"childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree psiChild\" sorry\n          \n          \n      obtain newNode :: \"abc node\" where \"down newNode = (z :: abc tree)\" sorry (* TODO redefine node so that context is not used anymore. not really useful, since context is never used. \"node = a tree\" is totally adequate *)\n      define newPath where q4 : \"newPath = newNode#p2\"\n        \n      from a11  have \"down (hd p) = x\" using isNodeIn_def isRootNode_def by force \n      have \"labelOfNode newNode = x1a\" sorry\n      from a11 have \"x1a = labelOfNode (hd p)  \" sorry\n      have \"\\<Pi> z |\\<subseteq>| \\<Pi> x\" sorry\n      then have \"(\\<Pi> (down newNode) |\\<subseteq>| \\<Pi> (down (hd p)))\" by (simp add: \\<open>down (hd p) = x\\<close> \\<open>down newNode = z\\<close>)\n  then show ?case sorry\nqed\n   \n   \nproof -\n{ (* do induction along the height of z *)\nfix x1a x2a p x\nassume b7 : \"x = psi (NODE (x1a :: abc) x2a)\"\nassume b10 : \"(\\<And> x2aa p x. height x2aa < height (NODE x1a x2a)  \\<Longrightarrow> p \\<in> pathsInTree x \\<Longrightarrow> x = psi x2aa \\<Longrightarrow> \\<exists>p2. childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree x2aa)\"\nassume b2 : \"(p :: abc node list) \\<in> pathsInTree x\"\n\n\nfrom b2 pathsInTree_def obtain e1 tail where b3 : \"(isAPathp p)\" and b4 : \" p = (e1#tail)\" and b5 : \"isNodeIn e1 x\" and b6 : \"(isRootNode e1)\" by blast\ndef head == \"(| up = PLACEHOLDER, down = (NODE x1a x2a) |)\"\nhave \"\\<exists>p2. childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree (NODE x1a x2a)\" proof (rule disjE)\nshow \"tail = [] \\<or> tail \\<noteq> []\" by blast\n{ assume c3 : \"tail=[]\"\n  def p2 == \"head#[]\"\n  show \"\\<exists>p2. (childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree (NODE x1a x2a))\" sorry\n  }\n{ assume c3 : \"tail \\<noteq> []\"\n  \n  from b7 have \"x = NODE x1a (fimage (\\<lambda> symbol2 .\n                              psi (NODE symbol2 (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol2 x2a)))\n                                  )\n                              )\n                              (fimage root x2a)\n                     )\" by (metis fimage_cong psi.simps) \n  from c3 obtain tailHead tailTail where c4 : \"tail = tailHead#tailTail\" using list.exhaust by blast\n  \n  obtain symbol where \"(childrenWithSymbol symbol x2a) \\<noteq> fempty\" sorry\n  def symbolTree == \"(NODE symbol (\\<Union>| (fimage childrenSet (childrenWithSymbol symbol x2a))))\"\n  from b2 c4 obtain symbol :: \"abc\" where c5 : \"tail \\<in> pathsInTree ( psi symbolTree)\" sorry\n  have c6 : \"height symbolTree < height (NODE x1a x2a)\" sorry\n  from c5 c6 b10 obtain p2Down where c11 : \"childrenPathsetsAreSubsets p2Down tail \\<and> p2Down \\<in> pathsInTree symbolTree\" by blast\n  obtain childInSymbolTree where c12 : \"childInSymbolTree |\\<in>| (childrenWithSymbol symbol x2a)\" and c13 : \"p2Down \\<in> pathsInTree childInSymbolTree\" sorry\n  from c12 have \"childInSymbolTree |\\<in>| x2a\" sorry\n  def p2 == \"head#p2Down\"\n  have \"(childrenPathsetsAreSubsets p2 p)\" sorry\n  have \"(p2 \\<in> pathsInTree (NODE x1a x2a))\" sorry\n  show \"\\<exists>p2. (childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree (NODE x1a x2a))\" sorry\n  }\n\nqed\n}\nshow \"\\<And> p x. p \\<in> pathsInTree x \\<Longrightarrow> x = psi z \\<Longrightarrow> \\<exists>p2. childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree z \" sorry\nqed\n  *)\n    \n      \n          \n          \n      (*\n   \n  have c3 : \"\\<And> \\<ii> x p . p \\<in> (pathsInTree x) \\<Longrightarrow> x|\\<in>| y \\<Longrightarrow>  (( (\\<exists> r  . (hd r |\\<in>| (\\<R> \\<ii>)) \\<and> (pathFitsListAndListIsARun \\<ii> p r))  ))\" \n  proof -\n    fix  \\<ii>  p\n    fix x :: \"abc tree\"\n      (*\n    from c10 obtain forest where \"y = \\<Psi>\\<^sub>\\<phi> forest\" and \"forest \\<in> ((\\<Union>| ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (((\\<R>) \\<ii>))))))\" by auto\n        *)\n    assume n76988 : \"p \\<in> (pathsInTree x)\"\n    assume \"x|\\<in>| y\"\n    from psiSubsetsLemma n76988 have \"\\<And> p x z . p \\<in> pathsInTree x \\<Longrightarrow> x = psi z \\<Longrightarrow> \\<exists>p2. (childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree z)\" by auto\n    then have n8798 : \"\\<And>  z .  x = psi z \\<Longrightarrow> \\<exists>p2. childrenPathsetsAreSubsets p2 p \\<and> p2 \\<in> pathsInTree z\" using n76988 by auto\n        \n        \n      obtain forest where n6567 : \"{|x|} = psiF forest\" and \"forest \\<in> ((\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (((\\<R>) \\<ii>))))))\" sorry\n          \n   (*   from n8798 n6567 obtain p2 where \"childrenPathsetsAreSubsets p2 p\" and \"p2 \\<in> pathsInTree tree\" by auto*)\n          \n      \n    show \"\\<exists>r. hd r |\\<in>| \\<R> \\<ii> \\<and> pathFitsListAndListIsARun \\<ii> p r \" sorry\n  qed\n    \n    \n   \n    \n    (*\n  from c10 have c3 : \"\\<And> \\<ii> x p . p \\<in> (pathsInTree x) \\<Longrightarrow> x|\\<in>| y \\<Longrightarrow>  ((\\<exists> forest . (y = \\<Psi>\\<^sub>\\<phi> forest \\<and> forest \\<in> ((\\<Uplus> ( ((\\<L>\\<^sub>\\<phi>\\<^sub>\\<rho> (\\<A> \\<ii>)) |`| (((\\<R>) \\<ii>)))))))))\" using psiSubsetsLemma *)\n    \n    \n  from c3 pathSatisfiesApproximatorForRuleSet_def have c2 : \"\\<And> \\<ii> x p . p \\<in> (pathsInTree x) \\<Longrightarrow> x|\\<in>| y \\<Longrightarrow>  pathSatisfiesApproximatorForRuleSet p (\\<R> \\<ii>) \\<ii>\" by metis\n  from satisfiesApproximatorForRuleSet_def c2 have c1 : \"\\<And> \\<ii> x. x |\\<in>| y \\<Longrightarrow> satisfiesApproximatorForRuleSet x (\\<R> \\<ii>) \\<ii>\" by metis\n  from c1 b1 \\<P>_def have c11 : \"x \\<in> (\\<P> \\<R>)\" by auto\n  from c11 b3 b1 \\<ff>_def heightForestBounded_def \\<Z>\\<^sub>\\<tau>_def show \"x |\\<in>| (\\<ff> n \\<R>)\" by (simp add: finterI restrictionIsFinite2) \nqed\n  *)\n\n                (*\n                \n                \n            from pathFitsListAndListIsARun.simps n5466897 n544877 obtain head tail where n64r77 : \"r = head#tail\"                      by (metis hd_Cons_tl) \n            from pathFitsListAndListIsARun.simps(2) n5466897 n64r77 n6577988 have n53467 : \"labelOfNode pathHead = symbol head\" by auto\n            from n6577988   n654e53 pathsInTree_def have \"down pathHead = x\" by fastforce\n            hence \"labelOfNode pathHead = root x\" using   labelOfNode_def  by auto\n            hence \"labelOfNode pathHead = \\<alpha>\" using n645787 by auto\n            hence \"symbol head = \\<alpha>\" using n53467 by auto\n            then show \"\\<alpha> |\\<in>| fimage symbol (\\<R> \\<ii>)\" using n53456877          using n64r77 by auto *)\n                \n                  (*\n                  \n          obtain path where n654e53 : \"path \\<in> pathsInTree x\"            using theSingletonPathExists by auto \n          hence n544877 : \"path \\<noteq> []\" using pathsInTree_def                   by blast \n          from satisfiesApproximatorForRuleSet_def n654e53 n6576 have n5466 : \"\\<And> \\<ii>. pathSatisfiesApproximatorForRuleSet path  (\\<R> \\<ii>) \\<ii>\" by auto*)\n              (*\n              \n              \n              \n          have \"\\<And>\\<ii> . \\<alpha> |\\<in>| fimage symbol (\\<R> \\<ii>)\"\n          proof -\n            fix \\<ii>\n            from pathSatisfiesApproximatorForRuleSet_def n5466 obtain r where n53456877 : \" hd r |\\<in>| (\\<R> \\<ii>)\" and n5466897 : \" pathFitsListAndListIsARun \\<ii> path r\" by blast\n            from n544877 obtain pathHead pathTail where n6577988 : \"path = pathHead#pathTail\"                      by (metis hd_Cons_tl) \n            from pathFitsListAndListIsARun.simps n5466897 n544877 obtain head tail where n64r77 : \"r = head#tail\"                      by (metis hd_Cons_tl) \n            from pathFitsListAndListIsARun.simps(2) n5466897 n64r77 n6577988 have n53467 : \"labelOfNode pathHead = symbol head\" by auto\n            from n6577988   n654e53 pathsInTree_def have \"down pathHead = x\" by fastforce\n            hence \"labelOfNode pathHead = root x\" using   labelOfNode_def  by auto\n            hence \"labelOfNode pathHead = \\<alpha>\" using n645787 by auto\n            hence \"symbol head = \\<alpha>\" using n53467 by auto\n            then show \"\\<alpha> |\\<in>| fimage symbol (\\<R> \\<ii>)\" using n53456877          using n64r77 by auto \n          qed\n            \n        qed\n          \n            \n(*            hence \"\\<alpha> |\\<in>| (fimage symbol (\\<R> \\<aa>\\<^sub>1) |\\<union>| fimage symbol (\\<R> \\<aa>\\<^sub>2))\" by auto*)\n                \n                \n            have \"fset (\\<ff> (Suc n)  (rulesPerAlpha \\<alpha>)) \\<noteq> {}\" sorry \n                \n                (* have u1 : \"\\<And> \\<alpha> . \\<alpha> |\\<in>| occurringAlphas \\<Longrightarrow> (\\<Pi>\\<^sub>\\<tau>\\<^sub>F ((\\<ff> (Suc n)  (rulesPerAlpha \\<alpha>)))) = \\<Pi>\\<^sub>\\<tau>\\<^sub>F ((gAlpha \\<alpha>))\" *)\n                \n            show \"False\" sorry\n          qed*)", "meta": {"author": "m-hahn", "repo": "lics2018-wreath-products", "sha": "e730a7ff0863abab1a82d3f37f44cec4b952cb5b", "save_path": "github-repos/isabelle/m-hahn-lics2018-wreath-products", "path": "github-repos/isabelle/m-hahn-lics2018-wreath-products/lics2018-wreath-products-e730a7ff0863abab1a82d3f37f44cec4b952cb5b/Isabelle/TreeLanguagesSimple.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.32006976331715836}}
{"text": "theory AutoCorres_Misc imports\n  \"../l4v/lib/OptionMonadWP\"\nbegin\n\nsection \\<open>Auxilliary Lemmas for Autocorres\\<close>\n\nsubsection \\<open>Option monad\\<close>\n\ndefinition owhile_inv :: \"('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> ('s,'a) lookup) \\<Rightarrow> 'a \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> 'a rel \\<Rightarrow> ('s,'a) lookup\"   where\n \"owhile_inv c b a I R \\<equiv> owhile c b a\"\n\nlemma owhile_unfold: \"owhile C B r s = ocondition (C r) (B r |>> owhile C B) (oreturn r) s\"\n  by (auto simp: ocondition_def obind_def oreturn_def owhile_def option_while_simps split: option.split)\n\nlemma ovalidNF_owhile:\n  assumes \"\\<And>s. P r s \\<Longrightarrow> I r s\"\n    and \"\\<And>r s. ovalidNF (\\<lambda>s'. I r s' \\<and> C r s' \\<and> s' = s) (B r) (\\<lambda>r' s'. I r' s' \\<and> (r', r) \\<in> R)\"\n    and \"wf R\"\n    and \"\\<And>r s. I r s \\<Longrightarrow> \\<not> C r s \\<Longrightarrow> Q r s\"\n  shows \"ovalidNF (P r) (OptionMonad.owhile C B r) Q\"\n  unfolding ovalidNF_def\nproof (intro allI impI)\n  fix s assume \"P r s\"\n  then have \"I r s\" by fact\n  moreover note \\<open>wf R\\<close>\n  moreover have \"\\<And>r r'. I r s \\<Longrightarrow> C r s \\<Longrightarrow> B r s = Some r' \\<Longrightarrow> (r', r) \\<in> R\"\n    using assms(2) unfolding ovalidNF_def by fastforce\n  moreover have \"\\<And>r r'. I r s \\<Longrightarrow> C r s \\<Longrightarrow> B r s = Some r' \\<Longrightarrow> I r' s\"\n    using assms(2) unfolding ovalidNF_def by blast\n  moreover have \"\\<And>r. I r s \\<Longrightarrow> C r s \\<Longrightarrow> B r s = None \\<Longrightarrow>\n      None \\<noteq> None \\<and> (\\<forall>r'. None = Some r' \\<longrightarrow> Q r' s)\"\n    using assms(2) unfolding ovalidNF_def by blast\n  moreover have \"\\<And>r. I r s \\<Longrightarrow> \\<not> C r s \\<Longrightarrow> Some r \\<noteq> None \\<and> (\\<forall>r'. Some r = Some r' \\<longrightarrow> Q r' s)\"\n    using assms(4) unfolding ovalidNF_def by blast\n  ultimately\n  show \"owhile C B r s \\<noteq> None \\<and> (\\<forall>r'. owhile C B r s = Some r' \\<longrightarrow> Q r' s)\"\n    by (rule owhile_rule[where I=I])\nqed\n\n\n\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Planarity_Certificates/Verification/AutoCorres_Misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.32000976579500295}}
{"text": "(*  Title:      HOL/MicroJava/Comp/AuxLemmas.thy\n    Author:     Martin Strecker\n*)\n\n\n(* Auxiliary Lemmas *)\n\ntheory AuxLemmas\nimports \"../J/JBasis\"\nbegin\n\n(**********************************************************************)\n(* List.thy *)\n(**********************************************************************)\n\n\n\nlemma app_nth_greater_len [simp]:\n  \"length pre \\<le> ind \\<Longrightarrow> (pre @ a # post) ! (Suc ind) = (pre @ post) ! ind\"\n  apply (induct pre arbitrary: ind)\n   apply clarsimp\n  apply (case_tac ind)\n   apply auto\n  done\n\nlemma length_takeWhile: \"v \\<in> set xs \\<Longrightarrow> length (takeWhile (\\<lambda>z. z \\<noteq> v) xs) < length xs\"\n  by (induct xs) auto\n\nlemma nth_length_takeWhile [simp]: \n  \"v \\<in> set xs \\<Longrightarrow> xs ! (length (takeWhile (%z. z~=v) xs)) = v\"\n  by (induct xs) auto\n\n\nlemma map_list_update [simp]:\n  \"\\<lbrakk> x \\<in> set xs; distinct xs\\<rbrakk> \\<Longrightarrow> \n  (map f xs) [length (takeWhile (\\<lambda>z. z \\<noteq> x) xs) := v] = map (f(x:=v)) xs\"\n  apply (induct xs)\n   apply simp\n  apply (rename_tac a xs)\n  apply (case_tac \"x=a\")\n   apply auto\n  done\n\n\n(**********************************************************************)\n(* Product_Type.thy *)\n(**********************************************************************)\n\n\nlemma split_compose: \n  \"(case_prod f) \\<circ> (\\<lambda> (a,b). ((fa a), (fb b))) = (\\<lambda> (a,b). (f (fa a) (fb b)))\"\n  by (simp add: split_def o_def)\n\nlemma split_iter:\n  \"(\\<lambda> (a,b,c). ((g1 a), (g2 b), (g3 c))) = (\\<lambda> (a,p). ((g1 a), (\\<lambda> (b, c). ((g2 b), (g3 c))) p))\"\n  by (simp add: split_def o_def)\n\n\n(**********************************************************************)\n(* Set.thy *)\n(**********************************************************************)\n\nlemma singleton_in_set: \"A = {a} \\<Longrightarrow> a \\<in> A\" by simp\n\n(**********************************************************************)\n(* Map.thy *)\n(**********************************************************************)\n\nlemma the_map_upd: \"(the \\<circ> f(x\\<mapsto>v)) = (the \\<circ> f)(x:=v)\"\n  by (simp add: fun_eq_iff)\n\nlemma map_of_in_set: \n  \"(map_of xs x = None) = (x \\<notin> set (map fst xs))\"\n  by (induct xs, auto)\n\nlemma map_map_upd [simp]: \n  \"y \\<notin> set xs \\<Longrightarrow> map (the \\<circ> f(y\\<mapsto>v)) xs = map (the \\<circ> f) xs\"\n  by (simp add: the_map_upd)\n\nlemma map_map_upds [simp]: \n  \"(\\<forall>y\\<in>set ys. y \\<notin> set xs) \\<Longrightarrow> map (the \\<circ> f(ys[\\<mapsto>]vs)) xs = map (the \\<circ> f) xs\"\n  by (induct xs arbitrary: f vs) auto\n\nlemma map_upds_distinct [simp]: \n  \"distinct ys \\<Longrightarrow> length ys = length vs \\<Longrightarrow> map (the \\<circ> f(ys[\\<mapsto>]vs)) ys = vs\"\n  apply (induct ys arbitrary: f vs)\n   apply simp\n  apply (case_tac vs)\n   apply simp_all\n  done\n\nlemma map_of_map_as_map_upd:\n  \"distinct (map f zs) \\<Longrightarrow> map_of (map (\\<lambda> p. (f p, g p)) zs) = Map.empty (map f zs [\\<mapsto>] map g zs)\"\n  by (induct zs) auto\n\n(* In analogy to Map.map_of_SomeD *)\nlemma map_upds_SomeD: \n  \"(m(xs[\\<mapsto>]ys)) k = Some y \\<Longrightarrow> k \\<in> (set xs) \\<or> (m k = Some y)\"\n  apply (induct xs arbitrary: m ys)\n   apply simp\n  apply (case_tac ys)\n   apply fastforce+\n  done\n\nlemma map_of_upds_SomeD: \"((map_of m) (xs[\\<mapsto>]ys)) k = Some y \n  \\<Longrightarrow> k \\<in> (set (xs @ map fst m))\"\n  by (auto dest: map_upds_SomeD map_of_SomeD fst_in_set_lemma)\n\nlemma map_of_map_prop:\n  \"\\<lbrakk>map_of (map f xs) k = Some v; \\<forall>x \\<in> set xs. P1 x; \\<forall>x. P1 x \\<longrightarrow> P2 (f x)\\<rbrakk> \\<Longrightarrow> P2 (k, v)\"\n  by (induct xs) (auto split: if_split_asm)\n\nlemma map_of_map2: \"\\<forall>x \\<in> set xs. (fst (f x)) = (fst x) \\<Longrightarrow>\n  map_of (map f xs) a = map_option (\\<lambda> b. (snd (f (a, b)))) (map_of xs a)\"\n  by (induct xs, auto)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/MicroJava/Comp/AuxLemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3200097657950029}}
{"text": "theory Small_Step_7p10\nimports \nStar\nBig_Step_7p10\n\nbegin\n\nsubsection \"The transition relation\"\n\ninductive\n  small_step :: \"com * state \\<Rightarrow> com * state \\<Rightarrow> bool\" (infix \"\\<rightarrow>\" 55)\nwhere\nAssign:  \"(x ::= a, s) \\<rightarrow> (SKIP, s(x := aval a s))\" |\n\nSeq1:    \"(SKIP;;c\\<^sub>2,s) \\<rightarrow> (c\\<^sub>2,s)\" |\nSeq1a:   \"(THROW;;c\\<^sub>2,s) \\<rightarrow> (THROW, s)\" |\nSeq2:    \"(c\\<^sub>1,s) \\<rightarrow> (c\\<^sub>1',s') \\<Longrightarrow> (c\\<^sub>1;;c\\<^sub>2,s) \\<rightarrow> (c\\<^sub>1';;c\\<^sub>2,s')\" |\n\nIfTrue:  \"bval b s \\<Longrightarrow> (IF b THEN c\\<^sub>1 ELSE c\\<^sub>2,s) \\<rightarrow> (c\\<^sub>1,s)\" |\nIfFalse: \"\\<not>bval b s \\<Longrightarrow> (IF b THEN c\\<^sub>1 ELSE c\\<^sub>2,s) \\<rightarrow> (c\\<^sub>2,s)\" |\n\nWhile:   \"(WHILE b DO c,s) \\<rightarrow>\n            (IF b THEN c;; WHILE b DO c ELSE SKIP,s)\" |\nTry1:    \"c\\<^sub>1 \\<noteq> THROW \\<Longrightarrow> (TRY c\\<^sub>1 CATCH c\\<^sub>2, s) \\<rightarrow> (c\\<^sub>1,s)\" |\nTry2:    \"(TRY THROW CATCH c\\<^sub>2, s) \\<rightarrow> (c\\<^sub>2, s)\"\n\nabbreviation\n  small_steps :: \"com * state \\<Rightarrow> com * state \\<Rightarrow> bool\" (infix \"\\<rightarrow>*\" 55)\nwhere \"x \\<rightarrow>* y == star small_step x y\"\n\ncode_pred small_step .\n \nlemmas small_step_induct = small_step.induct[split_format(complete)]\n\ndeclare small_step.intros[simp,intro]\n\ntext{* Rule inversion: *}\n\ninductive_cases SkipE[elim!]: \"(SKIP,s) \\<rightarrow> ct\"\nthm SkipE\ninductive_cases ThrowE[elim!]: \"(THROW, s) \\<rightarrow> ct\"\nthm ThrowE\ninductive_cases AssignE[elim!]: \"(x::=a,s) \\<rightarrow> ct\"\nthm AssignE\ninductive_cases SeqE[elim]: \"(c1;;c2,s) \\<rightarrow> ct\"\nthm SeqE\ninductive_cases IfE[elim!]: \"(IF b THEN c1 ELSE c2,s) \\<rightarrow> ct\"\nthm IfE\ninductive_cases WhileE[elim]: \"(WHILE b DO c, s) \\<rightarrow> ct\"\nthm WhileE\ninductive_cases TryE[elim!]: \"(TRY c\\<^sub>1 CATCH c\\<^sub>2, s) \\<rightarrow> ct\"\nthm TryE\n  \n(* Lemma 7.11 IMP is deterministic *)  \nlemma \"cs \\<rightarrow> cs' \\<Longrightarrow> cs \\<rightarrow> cs'' \\<Longrightarrow> cs'' = cs'\"\n  apply (induction cs' arbitrary: cs'' rule: small_step.induct)\n          apply blast+\n  done\n\n(* Lemma 7.13 *)\nlemma star_seq2: \"(c1, s1) \\<rightarrow>* (c, s2) \\<Longrightarrow> (c1;;c2, s1) \\<rightarrow>* (c;; c2, s2)\"\nproof (induction \"(c1,s1)\" \"(c,s2)\" arbitrary: c1 s1 c s2  rule: star.induct)\n  case (refl)\n  then show ?case by simp\nnext\n  case (step y)\n  obtain c1' s1' where a: \"y = (c1', s1')\" by fastforce   \n  have star: \"(c1';;c2, s1') \\<rightarrow>* (c;;c2, s2)\" using step.hyps(3) a by blast\n  have first: \"(c1;; c2, s1) \\<rightarrow> (c1';;c2, s1')\" using step.hyps(1) a  by blast\n  thus ?case using first star step.hyps by (simp add: star.step)\nqed\n\n(* I was having trouble with proving   \n     obtain c1' s1' where a: \"y = (c1', s1')\" \n  It is equivalent to the following. If you can prove that\n  you can prove the \"obtain\" *)\n \nlemma \"\\<And>thesis. (\\<And>c1' s1'. y = (c1', s1') \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\"\nproof -\n  fix thesis\n  assume [intro]: \"\\<And>c1' s1'. y = (c1', s1') \\<Longrightarrow> thesis\"\n  then show thesis by fastforce\nqed \n  \n(* Lemma 7.12 *)\nlemma big_step_imp_small_step: \"cs \\<Rightarrow> (s, t) \\<Longrightarrow> s = SKIP \\<or> s = THROW \\<Longrightarrow>  cs \\<rightarrow>* (s, t)\"\nproof (induction rule: big_step.induct)\n  case (Seq1 c\\<^sub>1 s\\<^sub>1 s\\<^sub>2 c\\<^sub>2 x s\\<^sub>3)\n  then show ?case by (blast intro: star.step star_seq2 star_trans)\nnext\n  case (Seq2 c\\<^sub>1 s\\<^sub>1 s\\<^sub>2 c\\<^sub>2)\n  then show ?case by (blast intro: star_seq2 star_trans)\nnext\n  case (IfTrue b s c\\<^sub>1 x t c\\<^sub>2)\n  then have \"(c\\<^sub>1,s) \\<rightarrow>* (x, t)\" by blast\n  moreover have \"(IF b THEN c\\<^sub>1 ELSE c\\<^sub>2, s) \\<rightarrow> (c\\<^sub>1, s)\" using IfTrue.hyps by blast\n  ultimately show ?case using IfTrue.IH by (blast intro: star.step)\nnext\n  case (IfFalse b s c\\<^sub>2 x t c\\<^sub>1)\n  then have \"(c\\<^sub>2,s) \\<rightarrow>* (x, t)\" by blast\n  moreover have \"(IF b THEN c\\<^sub>1 ELSE c\\<^sub>2, s) \\<rightarrow> (c\\<^sub>2, s)\" using IfFalse.hyps by blast\n  ultimately show ?case using IfFalse.IH by (blast intro: star.step)\nnext\n  case (WhileFalse b s c)\n  then have a: \"(WHILE b DO c,s) \\<rightarrow>\n            (IF b THEN (c;; WHILE b DO c) ELSE SKIP,s)\" by blast\n  then have \"(IF b THEN (c;; WHILE b DO c) ELSE SKIP,s) \\<rightarrow>* (SKIP,s)\" using WhileFalse.hyps by blast \n  then show \"(WHILE b DO c, s) \\<rightarrow>* (SKIP, s)\" using a by (blast intro: star.step)\nnext\n  case (WhileTrue1 b s\\<^sub>1 c s\\<^sub>2 x s\\<^sub>3)\n  let ?w = \"WHILE b DO c\"\n  let ?if = \"IF b THEN c;; ?w ELSE SKIP\"\n  have 0: \"(c, s\\<^sub>1) \\<rightarrow>* (SKIP, s\\<^sub>2)\" using WhileTrue1.IH WhileTrue1.prems(1) by blast\n  have 1: \"(?w, s\\<^sub>1) \\<rightarrow>* (?if, s\\<^sub>1)\" by blast\n  have 2: \"(?if, s\\<^sub>1) \\<rightarrow>* (c;;?w, s\\<^sub>1)\" using WhileTrue1(1) by blast\n  have 3: \"(c;;?w, s\\<^sub>1) \\<rightarrow>* (SKIP;;?w, s\\<^sub>2)\" using 0 WhileTrue1.IH(1) by (simp add: star_seq2)\n  have 4: \"(SKIP;;?w, s\\<^sub>2) \\<rightarrow>* (?w, s\\<^sub>2)\" by simp \n  then have \"(?w, s\\<^sub>1) \\<rightarrow>* (?w, s\\<^sub>2)\" using 1 2 3 4 by (blast intro: star_trans)\n  then show ?case using WhileTrue1.IH WhileTrue1.prems(1) by (blast intro: star_trans)\nnext\n  case (WhileTrue2 b s\\<^sub>1 c s\\<^sub>2)\n  let ?w = \"WHILE b DO c\"\n  let ?if = \"IF b THEN c;;?w ELSE SKIP\"\n  have 0: \"(c, s\\<^sub>1) \\<rightarrow>* (THROW, s\\<^sub>2)\" using WhileTrue2.prems WhileTrue2.IH by blast\n  have 1: \"(?w, s\\<^sub>1) \\<rightarrow>* (?if, s\\<^sub>1)\" using WhileTrue2 by blast\n  have 2: \"(?if, s\\<^sub>1) \\<rightarrow>* (c;;?w, s\\<^sub>1)\" using WhileTrue2.hyps(1) by blast\n  (* FIXME *)\n  have 3: \"(c;;?w, s\\<^sub>1) \\<rightarrow>* (THROW, s\\<^sub>2)\" using 0\n    by (meson Seq1a WhileTrue2.IH star_seq2 star_step1 star_trans)\n  then show ?case using 1 2 3 WhileTrue2.IH by (blast intro: star_trans)\nnext\n  case (Try1 c\\<^sub>1 s x t c\\<^sub>2)\n  then show ?case by (meson small_step.Try1 star.simps)\nnext\n  case (Try2 c\\<^sub>2 s x t)\n  then show ?case by (meson small_step.Try2 star.simps)\nqed blast+\n\nlemma big_step_imp_small_step_SKIP: \"cs \\<Rightarrow> (SKIP, t) \\<Longrightarrow> cs \\<rightarrow>* (SKIP, t)\"\n  by (auto simp: big_step_imp_small_step)\n  \nlemma big_step_imp_small_step_THROW: \"cs \\<Rightarrow> (THROW, t) \\<Longrightarrow> cs \\<rightarrow>* (THROW, t)\"\n  by (auto simp: big_step_imp_small_step)\n\n(* I could have got an even smaller proof for the WhileTrue cases above if I'd have proved this \n   I could then have got \n     assume w: \"(?w,s') \\<rightarrow>* (SKIP,t)\"\n     assume c: \"(c,s) \\<rightarrow>* (SKIP,s')\"\n     have new_3: \"(c;; ?w,s) \\<rightarrow>* (SKIP,t)\" by(rule seq_comp[OF c w])\n\n     Then I could have used 1 2 and new_3\n\n*)\nlemma seq_comp: \"\\<lbrakk> (c\\<^sub>1, s\\<^sub>1) \\<rightarrow>* (SKIP, s\\<^sub>2); (c\\<^sub>2, s\\<^sub>2) \\<rightarrow>* (SKIP, s\\<^sub>3) \\<rbrakk> \\<Longrightarrow> (c\\<^sub>1;;c\\<^sub>2, s\\<^sub>1) \\<rightarrow>* (SKIP, s\\<^sub>3)\"\n  by (blast intro: star_seq2 star_trans)\n    \n(* Lemma 7.15 *)\nlemma small_big_comp: \"\\<lbrakk> cs \\<rightarrow> cs'; cs' \\<Rightarrow> (x,t) \\<rbrakk> \\<Longrightarrow> cs \\<Rightarrow> (x,t)\"    \n  apply  (induction arbitrary: x t rule: small_step.induct)\n    apply auto\ndone\n   \n(* Lemma 7.14 *)\n\n(* The induction here was interesting because we didn't have to use \"arbitrary\" in\nproof (induction \"cs\" \"(SKIP, t)\" rule: star.induct *)\nlemma small_step_imp_big_step_SKIP: \"cs \\<rightarrow>* (SKIP, t) \\<Longrightarrow> cs \\<Rightarrow> (SKIP, t)\"\nproof (induction \"cs\" \"(SKIP, t)\" rule: star.induct)\n  case refl\n  then show ?case by blast\nnext\n  case (step cs cs')\n  assume \"cs \\<rightarrow> cs'\"\n     and \"cs' \\<Rightarrow> (SKIP,t)\"\n  thus ?case by (rule small_big_comp)\nqed\n\nlemma small_step_imp_big_step_THROW: \"cs \\<rightarrow>* (THROW, t) \\<Longrightarrow> cs \\<Rightarrow> (THROW, t)\"  \nproof (induction \"cs\" \"(THROW, t)\" rule: star.induct)\n  case refl\n  then show ?case by blast\nnext\n  case (step cs cs')\n  assume \"cs \\<rightarrow> cs'\"\n     and \"cs' \\<Rightarrow> (THROW, t)\"\n  thus ?case by (rule small_big_comp)\nqed\n  \n  \n(* The textbook got us to prove \"(c,s) \\<Rightarrow> t \\<longleftrightarrow> (c,s) \\<rightarrow>* (SKIP, t)\" \n   which ended up meaning that the proof for 7.18 did not go through easily.\n   The form below, using \"cs\" insteand of \"(c,s)\" is the same as the form for \n   final_iff_SKIP\n *)\n\n(* Lemma 7.16 *)\nlemma big_iff_small_SKIP: \"cs \\<Rightarrow> (SKIP, t) \\<longleftrightarrow> cs \\<rightarrow>* (SKIP, t)\"  \nproof\n  show \"cs \\<Rightarrow> (SKIP, t) \\<Longrightarrow> cs \\<rightarrow>* (SKIP, t)\" by (rule big_step_imp_small_step_SKIP)\nnext\n  show \"cs \\<rightarrow>* (SKIP, t) \\<Longrightarrow> cs \\<Rightarrow> (SKIP, t)\" by (rule small_step_imp_big_step_SKIP)\nqed\n\nlemma big_iff_small_THROW: \"cs \\<Rightarrow> (THROW, t) \\<longleftrightarrow> cs \\<rightarrow>* (THROW, t)\"\nproof\n  show \"cs \\<Rightarrow> (THROW, t) \\<Longrightarrow> cs \\<rightarrow>* (THROW, t)\" by (rule big_step_imp_small_step_THROW)\nnext\n  show \"cs \\<rightarrow>* (THROW, t) \\<Longrightarrow> cs \\<Rightarrow> (THROW, t)\" by (rule small_step_imp_big_step_THROW)\nqed\n\nlemma big_iff_small: \"x = SKIP \\<or> x = THROW \\<Longrightarrow> (cs \\<Rightarrow> (x,t) \\<longleftrightarrow> cs \\<rightarrow>* (x,t))\"  \nproof cases\n  assume \"x = THROW\"\n  then show ?thesis using big_iff_small_THROW by blast\nnext\n  assume \"x \\<noteq> THROW\"\n     and \"x = SKIP \\<or> x = THROW\"\n  then show ?thesis using big_iff_small_SKIP by blast\nqed\n  \n  \ndefinition final :: \"com \\<times> state \\<Rightarrow> bool\" where  \n  \"final cs \\<longleftrightarrow> \\<not>(\\<exists>cs'. cs \\<rightarrow> cs')\"\n\n(* Lemma 7.17 *)\nlemma final_iff_SKIP_or_THROW: \"final (c,s) = (c = SKIP \\<or> c = THROW)\"\nproof\n  show \"c = SKIP \\<or> c = THROW \\<Longrightarrow> final (c, s)\" by (auto simp: final_def)\nnext\n  show \"final (c, s) \\<Longrightarrow> c = SKIP \\<or> c = THROW\" \n    apply (simp add: final_def)\n    apply (induction c rule: com.induct)\n        apply blast+\n    done\nqed\n\n(* Lemma 7.18 *)  \nlemma \"(\\<exists>cs'. cs \\<Rightarrow> cs') \\<longleftrightarrow> (\\<exists>cs'. cs \\<rightarrow>* cs' \\<and> final cs')\"\n  apply (simp add: final_iff_SKIP_or_THROW)\n  apply (metis big_iff_small big_step_to_SKIP_or_THROW surj_pair)\n  done\n  \nend\n  \n  \n  \n  ", "meta": {"author": "sseefried", "repo": "concrete-semantics-solutions", "sha": "ca562994bc36b2d9c9e6047bf481056e0be7bbcd", "save_path": "github-repos/isabelle/sseefried-concrete-semantics-solutions", "path": "github-repos/isabelle/sseefried-concrete-semantics-solutions/concrete-semantics-solutions-ca562994bc36b2d9c9e6047bf481056e0be7bbcd/Small_Step_7p10.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.31989712377313917}}
{"text": "theory SE_Monad\nimports Main Option_Monad Lenses\nbegin\n  text \\<open>State exception monad, without state type change\\<close>\n  type_synonym ('a,'s) se = \"'s \\<rightharpoonup> ('a \\<times> 's)\"\n\n  (* return = RNormal, throw = Abrupt o Some   *)\n\n  definition sreturn :: \"'a \\<Rightarrow> ('a,'s) se\" where \"sreturn x s \\<equiv> Some (x,s)\"\n  definition sfail :: \"('a,'s) se\" where \"sfail s \\<equiv> None\"\n  definition sbind :: \"('a,'s) se \\<Rightarrow> ('a \\<Rightarrow> ('b,'s) se) \\<Rightarrow> ('b,'s) se\" where\n    \"sbind m f s \\<equiv> case m s of Some (x,s) \\<Rightarrow> f x s | _ \\<Rightarrow> None\"\n\n  definition sget :: \"('s,'s) se\" where \"sget s \\<equiv> Some (s,s)\"\n  definition sput :: \"'s \\<Rightarrow> (unit,'s) se\" where \"sput s' s \\<equiv> Some ((),s')\"\n\n  (* adhoc_overloading bind sbind *)\n\n\n  abbreviation (do_notation) bind_doE where \"bind_doE \\<equiv> sbind\"\n\n  subsection \\<open>Syntax Magic\\<close>\n  notation (input) sbind (infixr \"\\<bind>\" 54)\n  notation (output) bind_doE (infixr \"\\<bind>\" 54)\n\n\n  nonterminal doE_binds and doE_bind\n  syntax\n    \"_doE_block\" :: \"doE_binds \\<Rightarrow> 'a\" (\"doE {//(2  _)//}\" [12] 62)\n    \"_doE_bind\"  :: \"[pttrn, 'a] \\<Rightarrow> doE_bind\" (\"(2_ \\<leftarrow>/ _)\" 13)\n    \"_doE_let\" :: \"[pttrn, 'a] \\<Rightarrow> doE_bind\" (\"(2let _ =/ _)\" [1000, 13] 13)\n    \"_doE_then\" :: \"'a \\<Rightarrow> doE_bind\" (\"_\" [14] 13)\n    \"_doE_final\" :: \"'a \\<Rightarrow> doE_binds\" (\"_\")\n    \"_doE_cons\" :: \"[doE_bind, doE_binds] \\<Rightarrow> doE_binds\" (\"_;//_\" [13, 12] 12)\n    \"_thenM\" :: \"['a, 'b] \\<Rightarrow> 'c\" (infixr \"\\<then>\" 54)\n\n  syntax (ASCII)\n    \"_doE_bind\" :: \"[pttrn, 'a] \\<Rightarrow> doE_bind\" (\"(2_ <-/ _)\" 13)\n    \"_thenM\" :: \"['a, 'b] \\<Rightarrow> 'c\" (infixr \">>\" 54)\n\n  translations\n    \"_doE_block (_doE_cons (_doE_then t) (_doE_final e))\"\n      \\<rightleftharpoons> \"CONST bind_doE t (\\<lambda>_. e)\"\n    \"_doE_block (_doE_cons (_doE_bind p t) (_doE_final e))\"\n      \\<rightleftharpoons> \"CONST bind_doE t (\\<lambda>p. e)\"\n    \"_doE_block (_doE_cons (_doE_let p t) bs)\"\n      \\<rightleftharpoons> \"let p = t in _doE_block bs\"\n    \"_doE_block (_doE_cons b (_doE_cons c cs))\"\n      \\<rightleftharpoons> \"_doE_block (_doE_cons b (_doE_final (_doE_block (_doE_cons c cs))))\"\n    \"_doE_cons (_doE_let p t) (_doE_final s)\"\n      \\<rightleftharpoons> \"_doE_final (let p = t in s)\"\n    \"_doE_block (_doE_final e)\" \\<rightharpoonup> \"e\"\n    \"(m \\<then> n)\" \\<rightharpoonup> \"(CONST bind_doE m (\\<lambda>_. n))\"\n\n\n\n\n  lemma xrm_monad_laws[simp]:\n    \"doE {x \\<leftarrow> sreturn y; f x} = f y\"\n    \"doE {x \\<leftarrow> m; sreturn x} = m\"\n    \"doE {x\\<leftarrow>(doE {y\\<leftarrow>m; f y}); g x } = doE {y\\<leftarrow>m; x\\<leftarrow>f y; g x}\"\n\n    \"doE {sfail; m} = sfail\"\n    \"doE {_\\<leftarrow>m; sfail} = sfail\"\n\n    \"doE {s\\<leftarrow>sget; sput s} = sreturn ()\"\n    \"doE {sput s1; sput s2} = sput s2\"\n    \"doE {sput s; sget} = doE {sput s; sreturn s}\"\n\n    unfolding sreturn_def sbind_def sfail_def sget_def sput_def\n    by (auto split: option.splits)\n\n\n  lemma sbind_split: \"P (sbind m f s) \\<longleftrightarrow> (m s = None \\<longrightarrow> P None) \\<and> (\\<forall>r s'. m s = Some (r,s') \\<longrightarrow> P (f r s'))\"\n    by (auto simp: sbind_def split: option.split)\n\n  lemma sbind_split_asm: \"P (sbind m f s)\n    \\<longleftrightarrow> \\<not> ((m s = None \\<and> \\<not> P None) \\<or> (\\<exists>r s'. m s = Some (r,s') \\<and> \\<not> P (f r s')))\"\n    by (auto simp: sbind_def split: option.split)\n\n  lemmas sbind_splits = sbind_split sbind_split_asm\n\n\n\n\n  definition se_ord :: \"('a,'s) se \\<Rightarrow> _\" where \"se_ord \\<equiv> fun_ord (flat_ord None)\"\n  definition se_lub :: \"('a,'s) se set \\<Rightarrow> _\" where \"se_lub \\<equiv> fun_lub (flat_lub None)\"\n\n  abbreviation \"mono_se \\<equiv> monotone (fun_ord se_ord) se_ord\"\n\n  interpretation se_monad: partial_function_definitions se_ord se_lub\n    unfolding se_ord_def se_lub_def\n    apply (rule partial_function_lift)\n    by standard\n\n  declaration \\<open>Partial_Function.init \"se_monad\" @{term se_monad.fixp_fun}\n    @{term se_monad.mono_body} @{thm se_monad.fixp_rule_uc} @{thm se_monad.fixp_induct_uc}\n    ( (*SOME @{thm fixp_induct_option}*) NONE )\\<close> (* TODO: Induction rule! *)\n\n\n  lemma sebind_mono[partial_function_mono]:\n    assumes mf: \"mono_se B\" and mg: \"\\<And>y. mono_se (\\<lambda>f. C y f)\"\n    shows \"mono_se (\\<lambda>f. sbind (B f) (\\<lambda>y. C y f))\"\n    apply (rule monotoneI)\n    using monotoneD[OF mf] monotoneD[OF mg]\n    unfolding se_ord_def flat_ord_def fun_ord_def\n    apply (auto split: sbind_splits dest: )\n    apply (metis option.simps(3))\n    by (metis fst_conv option.sel option.simps(3) snd_conv)\n\n\n\n\n\n  definition \"sassert \\<Phi> \\<equiv> if \\<Phi> then sreturn () else sfail\"\n\n  lemma xassert_simps[simp]:\n    \"sassert True = sreturn ()\"\n    \"sassert False = sfail\"\n    by (auto simp: sassert_def)\n\n  lemma sfail_eq_conv[simp]:\n    \"sfail s = None\"\n    by (auto simp: sfail_def)\n\n  lemma sreturn_eq_conv[simp]:\n    \"sreturn x s = Some (x,s)\"\n    by (auto simp: sreturn_def)\n\n  lemma sget_eq_conv[simp]:\n    \"sget s = Some (s,s)\"\n    by (auto simp: sget_def)\n\n  lemma xput_eq_conv[simp]:\n    \"sput s ss = Some ((),s)\"\n    by (auto simp: sput_def)\n\n  lemma sassert_eq_conv[simp]:\n    \"sassert \\<Phi> s = Some us \\<longleftrightarrow> us=((),s) \\<and> \\<Phi>\"\n    \"sassert \\<Phi> s = None \\<longleftrightarrow> \\<not>\\<Phi>\"\n    by (auto simp: sassert_def)\n\n\n\n  definition wps :: \"('a,'s) se \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> 's \\<Rightarrow> bool\" where\n    \"wps c Q s = (case c s of Some (x,s) \\<Rightarrow> Q x s | None \\<Rightarrow> False)\"\n\n  named_theorems wps_iffs \\<open>Equality laws for weakest precondition (also used to generate intro-rules)\\<close>\n  named_theorems wps_simps \\<open>Equality laws for weakest precondition\\<close>\n  named_theorems wps_intros \\<open>Introduction rules for weakest precondition\\<close>\n\n  local_setup \\<open>\n    let\n      fun get_wps_eqs ctxt =\n          Named_Theorems.get ctxt @{named_theorems wps_iffs}\n        @ Named_Theorems.get ctxt @{named_theorems wps_simps}\n\n      fun get_wps_rls ctxt =\n          Named_Theorems.get ctxt @{named_theorems wps_intros}\n        @ map (fn thm => thm RS @{thm iffD2}) (Named_Theorems.get ctxt @{named_theorems wps_iffs})\n    in\n      I\n      #> Local_Theory.add_thms_dynamic (@{binding wps_rls}, get_wps_rls o Context.proof_of)\n      #> Local_Theory.add_thms_dynamic (@{binding wps_eqs}, get_wps_eqs o Context.proof_of)\n    end\n  \\<close>\n\n\n  lemma wps_basic_eq[wps_iffs]:\n    \"\\<And>Q E x s. wps (sreturn x) Q s = Q x s\"\n    \"\\<And>Q E s. wps (sfail) Q s = False\"\n    \"\\<And>Q E s. wps (sget) Q s = Q s s\"\n    \"\\<And>Q E r s. wps (sput r) Q s = Q () r\"\n    \"\\<And>m f Q E s. wps (doE {x\\<leftarrow>m; f x}) Q s = wps m (\\<lambda>x. wps (f x) Q) s\"\n    unfolding wps_def\n    by (auto split: sbind_splits option.splits)\n\n  lemma wps_assert_eq[wps_iffs]:\n    \"wps (sassert \\<Phi>) Q s \\<longleftrightarrow> \\<Phi> \\<and> Q () s\"\n    unfolding wps_def by (auto split: option.splits)\n\n  lemma\n    wps_if_eq[wps_simps]: \"wps (if b then t else e) Q s = (if b then wps t Q s else wps e Q s)\"\n    and wps_ifI[wps_intros]: \"\\<lbrakk> b \\<Longrightarrow> wps t Q s; \\<not>b \\<Longrightarrow> wps e Q s \\<rbrakk> \\<Longrightarrow> wps (if b then t else e) Q s\"\n    and wps_if_eq': \"wps (if b then t else e) Q = (if b then wps t Q else wps e Q)\"\n    by auto\n\n  lemma wps_mono': \"Q\\<le>Q' \\<Longrightarrow> wps c Q \\<le> wps c Q'\"\n    unfolding wps_def by (auto split: option.splits)\n\n  lemma wps_mono:\n    assumes \"wps c Q s\"\n    assumes \"\\<And>r s. Q r s \\<Longrightarrow> Q' r s\"\n    shows \"wps c Q' s\"\n    using wps_mono'[of Q Q' c] assms\n    by (auto)\n\n\n  definition sexec :: \"('a,'s) se \\<Rightarrow> 's \\<Rightarrow> ('a\\<times>'s,'t) se\" where\n    \"sexec f s \\<equiv> case f s of Some (a,s) \\<Rightarrow> sreturn (a,s) | None \\<Rightarrow> sfail\"\n\n  lemma wps_sexec_eq[wps_iffs]:\n    \"wps (sexec f s) Q t = wps f (\\<lambda>a s. Q (a,s) t) s\"\n    by (auto simp: sexec_def wps_def split: option.splits)\n\n  definition lift :: \"'a option \\<Rightarrow> ('a,'s) se\" where\n    \"lift m \\<equiv> case m of None \\<Rightarrow> sfail | Some x \\<Rightarrow> sreturn x\"\n\n  definition use :: \"('a \\<Longrightarrow> 's) \\<Rightarrow> ('a,'s) se\" where\n    \"use L \\<equiv> doE { s \\<leftarrow> sget; r\\<leftarrow>lift (get L s); sreturn r }\"\n\n  definition modify :: \"('a \\<Longrightarrow> 's) \\<Rightarrow> ('a \\<Rightarrow> 'a) \\<Rightarrow> (unit,'s) se\"\n    (infix \"%=\" 50) where\n    \"L %= f \\<equiv> doE { s \\<leftarrow> sget; x \\<leftarrow> lift (get L s); s \\<leftarrow> lift (put L (f x) s); sput s }\"\n\n  definition modifyM :: \"('a \\<Longrightarrow> 's) \\<Rightarrow> ('a \\<Rightarrow> ('a,'s) se) \\<Rightarrow> (unit,'s) se\"\n    (infix \"%^=\" 50) where\n    \"L %^= f \\<equiv> doE {\n      s \\<leftarrow> sget;\n      x \\<leftarrow> lift (get L s);\n      x \\<leftarrow> f x;\n      s \\<leftarrow> lift (put L x s);\n      sput s\n    }\"\n\n  definition assign :: \"('a \\<Longrightarrow> 's) \\<Rightarrow> 'a \\<Rightarrow> (unit,'s) se\"\n    (infix \"::=\" 50) where\n    \"L ::= x \\<equiv> doE { s \\<leftarrow> sget; s \\<leftarrow> lift (put L x s); sput s }\"\n\n  definition assignM (infix \"::^=\" 50) where\n    \"L ::^= x \\<equiv> doE { x\\<leftarrow>x; L ::= x }\"\n\n\n  schematic_goal [simp]: \"(lift f) s = ?s\"\n    unfolding lift_def by simp\n\n  schematic_goal [simp]: \"(use L) s = ?s\"\n    unfolding use_def by simp\n\n  schematic_goal [simp]: \"(x%=f) s = ?s\"\n    unfolding modify_def by simp\n\n  schematic_goal [simp]: \"(x%^=f) s = ?s\"\n    unfolding modifyM_def by simp\n\n  schematic_goal [simp]: \"(x::=v) s = ?s\"\n    unfolding assign_def by simp\n\n  schematic_goal [simp]: \"(x::^=m) s = ?s\"\n    unfolding assignM_def by simp\n\n  lemma wps_use_eq:\n    assumes \"lens L\"\n    assumes \"pre_get L s\"\n    shows \"wps (use L) Q s \\<longleftrightarrow> Q (get' L s) s\"\n    using assms by (auto simp: wps_def split: sbind_splits option.splits)\n\n  lemma wps_upd_eq:\n    assumes \"lens L\"\n    assumes \"pre_get L s\"\n    shows \"wps (L %= f) Q s \\<longleftrightarrow> Q () (put' L (f (get' L s)) s)\"\n    using assms by (auto simp: wps_def split: sbind_splits option.splits)\n\n  lemma wps_assign_eq:\n    assumes \"lens L\"\n    assumes \"pre_put L s\"\n    shows \"wps (L ::= x) Q s \\<longleftrightarrow> Q () (put' L x s)\"\n    using assms by (auto simp: wps_def split: sbind_splits option.splits)\n\n\n\n  abbreviation lens_comp_bwd (infixr \"\\<bullet>\" 90) where \"a\\<bullet>b \\<equiv> b;\\<^sub>La\"\n  abbreviation idx_lens_comp (\"_[_]\\<^sub>L\" [100,100] 100) where \"l[i]\\<^sub>L \\<equiv> l \\<bullet> idx\\<^sub>L i\"\n  abbreviation fun_lens_comp (\"_'(_')\\<^sub>L\" [100,100] 100) where \"f(x)\\<^sub>L \\<equiv> f \\<bullet> fun\\<^sub>L x\"\n\n\n\n\n\n\n  section \\<open>Tests and Examples\\<close>\n\n\n  context begin\n\n    private definition \"test1 \\<equiv> doE {\n      let x = id\\<^sub>L;\n      let i = 2;\n      idx\\<^sub>L i \\<bullet>fst\\<^sub>L ::= 41;\n      x[i]\\<^sub>L\\<bullet>fst\\<^sub>L ::= 42;\n      l \\<leftarrow> use x;\n      sreturn (l!i)\n    }\"\n\n    private lemma \"test1 = doE {\n      t \\<leftarrow> use (id\\<^sub>L[2]\\<^sub>L);\n      id\\<^sub>L[2]\\<^sub>L\\<bullet>fst\\<^sub>L ::= 42;\n      sreturn (42, snd t)\n    }\"\n      apply (rule ext)\n      by (auto simp: test1_def split: sbind_splits option.splits)\n\n    value \"test1 [(1::nat,2::nat),(n,4),(5,6)]\"\n    qualified definition \"Monad3_test_foo n \\<equiv>\n      test1 [(1::nat,2::nat),(n,4),(5,6)]\"\n\n    code_thms SE_Monad.Monad3_test_foo\n    value [simp] \"Monad3_test_foo 3\"\n\n    export_code SE_Monad.Monad3_test_foo checking SML\n\n    ML_val \\<open>\n      @{code SE_Monad.Monad3_test_foo} (@{code nat_of_integer} 2)\n    \\<close>\n\n    term \"f(x)\\<^sub>L \\<bullet> the\\<^sub>L\"\n\n    private definition \"test2 \\<equiv> doE {\n      let db=id\\<^sub>L;\n      db(''Hello'')\\<^sub>L\\<bullet>the\\<^sub>L\\<bullet>snd\\<^sub>L %= (+) (5::nat);\n      db(''Hello'')\\<^sub>L\\<bullet>the\\<^sub>L\\<bullet>fst\\<^sub>L ::= (''World'');\n\n      r \\<leftarrow> use (db(''Hello'')\\<^sub>L \\<bullet> the\\<^sub>L   );\n      sreturn r\n    }\"\n\n    value \"test2 [''Hello'' \\<mapsto> (''x'',3::nat)]\"\n\n    private definition \"test3 \\<equiv> doE {\n      let db=id\\<^sub>L;\n      db(''Hello'')\\<^sub>L\\<bullet>crov\\<^sub>L ::= ''World'';\n      r \\<leftarrow> use (db(''Hello'')\\<^sub>L \\<bullet> the\\<^sub>L );\n      sreturn r\n    }\"\n\n    value \"test3 Map.empty\"\n    (* the.snd.lookup(\"Hello\")   *)\n\n    value \"get' (the\\<^sub>L \\<bullet> snd\\<^sub>L \\<bullet> fun\\<^sub>L ''Hello'') (test3 Map.empty)\"\n\n\n    private datatype 'a test = A (xcord: nat) (ycord: 'a) | B (name: string) | C bool bool int\n\n    private define_lenses test\n\n    value [code] \"put' ycord\\<^sub>L ''bar'' (A 3 ''foo'')\"\n  end\n\n\n\n\n\n\n\nend\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/tacas2020_artifact/isabelle/Monads/SE_Monad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.31989712377313917}}
{"text": "section {*I\\_cfgLM*}\ntheory\n  I_cfgLM\n\nimports\n  I_cfg_base\n\nbegin\n\ndefinition cfgLM_step_relation :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('nonterminal, 'event) cfg_configuration\n  \\<Rightarrow> ('nonterminal, 'event) cfg_step_label\n  \\<Rightarrow> ('nonterminal, 'event) cfg_configuration\n  \\<Rightarrow> bool\"\n  where\n    \"cfgLM_step_relation M c1 p c2 \\<equiv>\n  p \\<in> cfg_productions M\n  \\<and> (\\<exists>l r.\n      cfg_conf c1 = l @ teA (prod_lhs p) # r\n      \\<and> cfg_conf c2 = l @ prod_rhs p @ r\n      \\<and> setA l = {})\"\n\nlemma cfgLM_inst_AX_step_relation_preserves_belongs: \"\n  (\\<forall>M. valid_cfg M \\<longrightarrow> (\\<forall>c1 e c2. cfgLM_step_relation M c1 e c2 \\<longrightarrow> c1 \\<in> cfg_configurations M \\<longrightarrow> e \\<in> cfg_step_labels M \\<and> c2 \\<in> cfg_configurations M))\"\n  apply(rule allI)\n  apply(rename_tac M)(*strict*)\n  apply(rule impI)+\n  apply(rule allI)+\n  apply(rename_tac M c1 e c2)(*strict*)\n  apply(rule impI)+\n  apply(simp add: cfg_configurations_def cfgLM_step_relation_def cfg_step_labels_def)\n  apply(case_tac c2)\n  apply(rename_tac M c1 e c2 cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M e l r)(*strict*)\n  apply(simp only: setAConcat concat_asso setBConcat)\n  apply(clarsimp)\n  apply(simp add: valid_cfg_def)\n  done\n\nlemma cfgLM_step_relation_both_sides_context: \"\n  setA left = {}\n  \\<Longrightarrow> \\<forall>a e b. cfgLM_step_relation G a e b \\<longrightarrow> cfgLM_step_relation G \\<lparr>cfg_conf = left @ cfg_conf a @ right\\<rparr> e \\<lparr>cfg_conf = left @ cfg_conf b @ right\\<rparr>\"\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac a e b l r)(*strict*)\n  apply(rule_tac\n      x=\"left@l\"\n      in exI)\n  apply(rule_tac\n      x=\"r@right\"\n      in exI)\n  apply(clarsimp)\n  apply(simp (no_asm) only: setAConcat concat_asso)\n  apply(force)\n  done\n\nlemma CFGLM_alt_case: \"\n  cfgLM_step_relation G \\<lparr>cfg_conf = w1 @ w2\\<rparr> e \\<lparr>cfg_conf = c\\<rparr>\n  \\<Longrightarrow> \\<not> (\\<exists>c'. cfgLM_step_relation G \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> c' @ w2 = c)\n  \\<Longrightarrow> \\<exists>c'. cfgLM_step_relation G \\<lparr>cfg_conf = w2\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> w1 @ c' = c\"\n  apply(clarsimp)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac l r)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac l r prod_lhsa prod_rhsa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac l r prod_lhs prod_rhs)(*strict*)\n  apply(rename_tac A w)\n  apply(rename_tac l r A w)(*strict*)\n  apply(thin_tac \"\\<lparr>prod_lhs = A, prod_rhs = w\\<rparr> \\<in> cfg_productions G\")\n  apply(subgoal_tac \"prefix w1 l \\<or> prefix l w1\")\n   apply(rename_tac l r A w)(*strict*)\n   prefer 2\n   apply(rule mutual_prefix_prefix)\n   apply(blast)\n  apply(rename_tac l r A w)(*strict*)\n  apply(simp add: prefix_def)\n  apply(auto)\n   apply(rename_tac r A w c)(*strict*)\n   apply(rule_tac\n      x = \"c\"\n      in exI)\n   apply(rule_tac\n      x = \"r\"\n      in exI)\n   apply(clarsimp)\n   apply(rename_tac A w c)(*strict*)\n   apply(simp only: setAConcat concat_asso)\n   apply(force)\n  apply(rename_tac l r A w c)(*strict*)\n  apply(case_tac c)\n   apply(rename_tac l r A w c)(*strict*)\n   apply(force)\n  apply(rename_tac l r A w c a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac l A w list)(*strict*)\n  apply(erule_tac\n      x=\"l @ w @ list\"\n      in allE)\n  apply(clarsimp)\n  done\n\nlemma CFGLM_no_step_without_nonterms: \"\n  setA (cfg_conf ca) = {}\n  \\<Longrightarrow> \\<forall>e c'. \\<not> cfgLM_step_relation G' ca e c'\"\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac e c' l r)(*strict*)\n  apply(simp only: setAConcat concat_asso)\n  apply(force)\n  done\n\nlemma supCFGLMhasAllStepsOfsub: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfg_sub G1 G2\n  \\<Longrightarrow> cfgLM_step_relation G1 c1 e c2\n  \\<Longrightarrow> cfgLM_step_relation G2 c1 e c2\"\n  apply(simp add: cfgLM_step_relation_def)\n  apply(auto)\n  apply(rename_tac l r)(*strict*)\n  apply(simp add: cfg_sub_def)\n  apply(auto)\n  done\n\nlemma cfgLM_step_relation_contextOK1: \"\n  valid_cfg G\n  \\<Longrightarrow> \\<forall>a e b. cfgLM_step_relation G a e b \\<longrightarrow> cfgLM_step_relation G \\<lparr>cfg_conf = cfg_conf a@w1\\<rparr> e \\<lparr>cfg_conf = cfg_conf b@w1\\<rparr>\"\n  apply(simp add: cfgLM_step_relation_def)\n  apply(auto)\n  apply(rename_tac a e b l r)(*strict*)\n  apply(rule_tac\n      x=\"l\"\n      in exI)\n  apply(rule_tac\n      x=\"r@w1\"\n      in exI)\n  apply(auto)\n  done\n\ninterpretation \"cfgLM\" : loc_cfg_0\n  (* TSstructure *)\n  \"valid_cfg\"\n  (* configurations *)\n  \"cfg_configurations\"\n  (* initial_configurations *)\n  \"cfg_initial_configurations\"\n  (* step_labels *)\n  \"cfg_step_labels\"\n  (* step_relation *)\n  \"cfgLM_step_relation\"\n  (* effects *)\n  \"cfg_effects\"\n  (* marking_condition *)\n  \"cfg_marking_condition\"\n  (* marked_effect *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect *)\n  \"cfg_unmarked_effect\"\n  (* destinations *)\n  \"cfg_destination\"\n  (* get_destinations *)\n  \"cfg_get_destinations\"\n  apply(simp add: LOCALE_DEFS_ALL LOCALE_DEFS_cfg)\n  apply(simp add: cfgBASE_inst_AX_initial_configuration_belongs cfgLM_inst_AX_step_relation_preserves_belongs )\n  done\n\nlemma CFGLM_derivation_initial_pos0: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation_initial G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G)]\\<rparr>)\"\n  apply(simp add: cfgLM.derivation_initial_def)\n  apply(case_tac \"d 0\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b)(*strict*)\n  apply(simp add: cfg_initial_configurations_def)\n  done\n\nlemma CFGLM_derivationCanBeDecomposed2: \"\n  cfgLM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1@w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w'\\<rparr>}\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> \\<exists>d1 d2 w1' w2' n1 n2. cfgLM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgLM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1'@w2'=w' \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=n\"\n  apply(subgoal_tac \" \\<forall>n. \\<forall>d w1 w2 w'. cfgLM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w'\\<rparr>} \\<and> maximum_of_domain d n \\<longrightarrow> (\\<exists>d1 d2 w1' w2' n1 n2. cfgLM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgLM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1' @ w2' = w' \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=n)\")\n   apply(blast)\n  apply(thin_tac \"cfgLM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w'\\<rparr>}\")\n  apply(thin_tac \"maximum_of_domain d n\")\n  apply(rule allI)\n  apply(rename_tac n)(*strict*)\n  apply(induct_tac n)\n   apply(rename_tac n)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2 w')(*strict*)\n   apply(case_tac \"w1@w2\\<noteq>w'\")\n    apply(rename_tac d w1 w2 w')(*strict*)\n    apply(subgoal_tac \"0\\<noteq>(0::nat)\")\n     apply(rename_tac d w1 w2 w')(*strict*)\n     apply(force)\n    apply(rename_tac d w1 w2 w')(*strict*)\n    apply(rule cfgLM.modifying_derivation_is_not_empty)\n      apply(rename_tac d w1 w2 w')(*strict*)\n      apply(blast)\n     apply(rename_tac d w1 w2 w')(*strict*)\n     apply(force)\n    apply(rename_tac d w1 w2 w')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d w1 w2 w')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2)(*strict*)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = w1\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = w2\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x=\"w1\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2)(*strict*)\n    apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n    apply(clarsimp)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 n xa)(*strict*)\n     apply(rule cfgLM.der1_is_derivation)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 n xa)(*strict*)\n     apply(simp add: der1_def)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 n xa)(*strict*)\n     apply(rule cfgLM.der1_is_derivation)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(simp add: der1_def)\n   apply(rename_tac d w1 w2)(*strict*)\n   apply(rule_tac\n      x=\"w2\"\n      in exI)\n   apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule cfgLM.der1_is_derivation)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule cfgLM.der1_is_derivation)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(simp add: der1_def)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule der1_maximum_of_domain)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule der1_maximum_of_domain)\n  apply(rename_tac n na)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(subgoal_tac \"\\<exists>x \\<in> {pair None \\<lparr>cfg_conf = w1@w2\\<rparr>}. d 0 = Some x\")\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   prefer 2\n   apply(rule cfgLM.derivation_from_starts_from)\n   apply(rule cfgLM.from_to_is_from)\n   apply(blast)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc 0) = Some (pair (Some e) c)\")\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   prefer 2\n   apply(rule cfgLM.some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac na d w1 w2 w')(*strict*)\n     apply(rule cfgLM.from_to_is_der)\n     apply(blast)\n    apply(rename_tac na d w1 w2 w')(*strict*)\n    apply(blast)\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   apply(arith)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(subgoal_tac \"\\<exists>e. d (Suc na) = Some (pair e \\<lparr>cfg_conf=w'\\<rparr>)\")\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   prefer 2\n   apply(rule cfgLM.reachesToAtMaxDom)\n    apply(rename_tac na d w1 w2 w')(*strict*)\n    apply(rule cfgLM.from_to_is_to)\n    apply(blast)\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 w' e ea c)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac na d w1 w2 w' e ea c cfg_conf)(*strict*)\n  apply(rename_tac cv)\n  apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n  apply(erule_tac\n      x=\"derivation_drop d (Suc 0)\"\n      in allE)\n  apply(case_tac \"\\<exists>c'. cfgLM_step_relation G \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> c' @ w2 = cv\")\n   apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"\\<exists>c'. cfgLM_step_relation G \\<lparr>cfg_conf = w2\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> w1 @ c' = cv\")\n    apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n    prefer 2\n    apply(rule CFGLM_alt_case)\n     apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n     apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_def)\n     apply(clarsimp)\n     apply(rename_tac na d w1 w2 w' e ea cv)(*strict*)\n     apply(erule_tac\n      x=\"Suc 0\"\n      in allE)\n     apply(clarsimp)\n    apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n    apply(force)\n   apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n   apply(thin_tac \"\\<not> (\\<exists>c'. cfgLM_step_relation G \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> c' @ w2 = cv)\")\n   apply(clarsimp)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(erule_tac\n      x=\"w1\"\n      in allE)\n   apply(erule_tac\n      x=\"c'\"\n      in allE)\n   apply(erule_tac\n      x=\"w'\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(rule conjI)\n     apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n     apply(rule_tac\n      m = \"na\"\n      in cfgLM.derivation_drop_preserves_derivation_from_to2)\n        apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n        apply(blast)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(rule_tac\n      s = \"Suc na\"\n      in ssubst)\n        apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n        apply(arith)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(blast)\n      apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n      apply(blast)\n     apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n     apply(clarsimp)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(rule derivation_drop_preserves_generates_maximum_of_domain)\n    apply(blast)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac\n      x=\"d1\"\n      in exI)\n   apply(rule_tac\n      x = \"derivation_append (der2 \\<lparr>cfg_conf = w2\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr>) d2 (Suc 0)\"\n      in exI)\n   apply(rule_tac\n      x=\"w1'\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac\n      x=\"w2'\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n    apply(clarsimp)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(rule cfgLM.derivation_append_preserves_derivation)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgLM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(force)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(simp add: der2_def)\n     apply(case_tac \"d2 0\")\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(simp add: derivation_append_def der2_def)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(rule cfgLM.derivation_append_preserves_derivation)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgLM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(force)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(simp add: der2_def)\n     apply(case_tac \"d2 0\")\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule_tac\n      x=\"Suc nb\"\n      in exI)\n    apply(simp add: derivation_append_def der2_def)\n    apply(clarsimp)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n1\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"Suc n2\"\n      and s=\"Suc 0+n2\"\n      in ssubst)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac concat_has_max_dom)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(rule der2_maximum_of_domain)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(force)\n  apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n  apply(erule_tac\n      x=\"c'\"\n      in allE)\n  apply(erule_tac\n      x=\"w2\"\n      in allE)\n  apply(erule_tac\n      x=\"w'\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(rule_tac\n      m = \"na\"\n      in cfgLM.derivation_drop_preserves_derivation_from_to2)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(blast)\n      apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n      apply(rule_tac\n      s = \"Suc na\"\n      in ssubst)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(arith)\n      apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n      apply(blast)\n     apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n     apply(blast)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(rule derivation_drop_preserves_generates_maximum_of_domain)\n   apply(blast)\n  apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      x = \"derivation_append (der2 \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> ) d1 (Suc 0)\"\n      in exI)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      x=\"d2\"\n      in exI)\n  apply(rule_tac\n      x=\"w1'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac\n      dJ = \"\\<lparr>cfg_conf=c'\\<rparr>\"\n      in cfgLM.concatIsFromTo)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n      apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n      apply(clarsimp)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgLM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(simp add: der2_def)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgLM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule_tac\n      x=\"Suc 0\"\n      in exI)\n      apply(simp add: der2_def)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n     apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(rule der2_maximum_of_domain)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(force)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      x=\"w2'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(force)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"Suc n1\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"Suc n1\"\n      and s=\"Suc 0+n1\"\n      in ssubst)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac concat_has_max_dom)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule der2_maximum_of_domain)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(force)\n  done\n\nlemma CFGLM_Nonblockingness_to_elimination: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> cfgLM.derivation_initial G d\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf=w1@w2@w3\\<rparr>)\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> cfgLM.Nonblockingness_branching G\n  \\<Longrightarrow> \\<exists>d' n' w e. maximum_of_domain d' n' \\<and> cfgLM.derivation G d' \\<and> cfgLM.belongs G d' \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=w2\\<rparr>) \\<and> d' n' = Some (pair e \\<lparr>cfg_conf=w\\<rparr>) \\<and> setA w = {}\"\n  apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n   prefer 2\n   apply(rule cfgLM.some_position_has_details_at_0)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: cfgLM.Nonblockingness_branching_def)\n  apply(erule_tac\n      x=\"d\"\n      in allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"n\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac c dc x)(*strict*)\n  apply(simp add: derivation_append_fit_def)\n  apply(subgoal_tac \"\\<exists>c. dc 0 = Some (pair None c)\")\n   apply(rename_tac c dc x)(*strict*)\n   prefer 2\n   apply(rule cfgLM.some_position_has_details_at_0)\n   apply(force)\n  apply(rename_tac c dc x)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<lparr>cfg_conf = w1 @ w2 @ w3\\<rparr> \\<in> cfg_configurations G\")\n   apply(rename_tac c dc x)(*strict*)\n   prefer 2\n   apply(simp add: cfgLM.belongs_def)\n   apply(erule_tac\n      x=\"n\"\n      and P=\"\\<lambda>i. case d i of None \\<Rightarrow> True | Some (pair e c) \\<Rightarrow> (case e of None \\<Rightarrow> True | Some e' \\<Rightarrow> e' \\<in> cfg_step_labels G) \\<and> c \\<in> cfg_configurations G\"\n      in allE)\n   apply(rename_tac c dc x)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c dc x)(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea ca)(*strict*)\n  apply(case_tac \"i<n\")\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d i = Some (pair e c)\")\n    apply(rename_tac c dc x i ea ca)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"G\"\n      in cfgLM.some_position_has_details_before_max_dom)\n      apply(rename_tac c dc x i ea ca)(*strict*)\n      apply(blast)\n     apply(rename_tac c dc x i ea ca)(*strict*)\n     apply(blast)\n    apply(rename_tac c dc x i ea ca)(*strict*)\n    apply(arith)\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n   apply(simp add: cfg_marking_configuration_def)\n   apply(clarsimp)\n   apply(rule_tac\n      m=\"i\"\n      in cfgLM.noDeadEndBeforeMaxDom)\n       apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n       apply(force)\n      apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n      apply(force)\n     apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n     apply(force)\n    apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n    apply(force)\n   apply(rename_tac c dc x i ea ca eaa cb)(*strict*)\n   apply(simp add: derivation_append_def)\n   apply(clarsimp)\n   apply(rename_tac c dc x i ea ca e2 c2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac c dc x i ea ca e2 c2 l r)(*strict*)\n   apply(subgoal_tac \"prod_lhs e2 \\<in> setA (l @ teA (prod_lhs e2) # r)\")\n    apply(rename_tac c dc x i ea ca e2 c2 l r)(*strict*)\n    apply(force)\n   apply(rename_tac c dc x i ea ca e2 c2 l r)(*strict*)\n   apply(rule elemInsetA)\n  apply(rename_tac c dc x i ea ca)(*strict*)\n  apply(case_tac \"i=n\")\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(rule_tac\n      x = \"der1 \\<lparr>cfg_conf = w2\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x = \"0\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac c dc x i ea ca)(*strict*)\n    apply(simp add: der1_maximum_of_domain)\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac c dc x i ea ca)(*strict*)\n    apply(rule cfgLM.der1_is_derivation)\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac c dc x i ea ca)(*strict*)\n    apply(rule cfgLM.der1_belongs)\n    apply(simp add: cfg_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac c dc x ea ca)(*strict*)\n    apply(simp only: setAConcat setBConcat concat_asso)\n    apply(force)\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c dc x ea ca)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac c dc x ea ca)(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac c dc x ea ca)(*strict*)\n   apply(simp add: der1_def)\n   apply(simp add: cfg_marking_configuration_def derivation_append_def)\n   apply(clarsimp)\n   apply(rename_tac c dc x)(*strict*)\n   apply(simp only: setAConcat concat_asso)\n   apply(force)\n  apply(rename_tac c dc x i ea ca)(*strict*)\n  apply(subgoal_tac \"i>n\")\n   apply(rename_tac c dc x i ea ca)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac c dc x i ea ca)(*strict*)\n  apply(thin_tac \"i\\<noteq>n\")\n  apply(thin_tac \"\\<not>i<n\")\n  apply(case_tac ca)\n  apply(rename_tac c dc x i ea ca cfg_conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea cfg_conf)(*strict*)\n  apply(rename_tac w')\n  apply(rename_tac c dc x i ea w')(*strict*)\n  apply(subgoal_tac \"maximum_of_domain dc (i-n)\")\n   apply(rename_tac c dc x i ea w')(*strict*)\n   prefer 2\n   apply(simp add: maximum_of_domain_def)\n   apply(simp add: derivation_append_def)\n   apply(simp add: cfg_marking_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac c dc x i ea w' y)(*strict*)\n   apply(case_tac \"dc (Suc (i-n))\")\n    apply(rename_tac c dc x i ea w' y)(*strict*)\n    apply(force)\n   apply(rename_tac c dc x i ea w' y a)(*strict*)\n   apply(subgoal_tac \"\\<forall>e c'. \\<not> cfgLM_step_relation G \\<lparr>cfg_conf = w'\\<rparr> e c'\")\n    apply(rename_tac c dc x i ea w' y a)(*strict*)\n    prefer 2\n    apply(rule CFGLM_no_step_without_nonterms)\n    apply(force)\n   apply(rename_tac c dc x i ea w' y a)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. dc (Suc (i - n)) = Some (pair (Some e) c)\")\n    apply(rename_tac c dc x i ea w' y a)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc(i-n)\"\n      in cfgLM.pre_some_position_is_some_position_prime)\n       apply(rename_tac c dc x i ea w' y a)(*strict*)\n       apply(force)\n      apply(rename_tac c dc x i ea w' y a)(*strict*)\n      apply(force)\n     apply(rename_tac c dc x i ea w' y a)(*strict*)\n     apply(force)\n    apply(rename_tac c dc x i ea w' y a)(*strict*)\n    apply(force)\n   apply(rename_tac c dc x i ea w' y a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n   apply(subgoal_tac \"cfgLM_step_relation G \\<lparr>cfg_conf = w'\\<rparr> eaa ca\")\n    apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"dc\"\n      and n=\"(i-n)\"\n      in cfgLM.position_change_due_to_step_relation)\n      apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n      apply(blast)\n     apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n     apply(blast)\n    apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n    apply(blast)\n   apply(rename_tac c dc x i ea w' y eaa ca)(*strict*)\n   apply(erule_tac\n      x=\"eaa\"\n      in allE)\n   apply(erule_tac\n      x=\"ca\"\n      in allE)\n   apply(force)\n  apply(rename_tac c dc x i ea w')(*strict*)\n  apply(subgoal_tac \"\\<exists>d1 d2 w1' w2' n1 n2. cfgLM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgLM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2@w3\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1'@w2'=w' \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=(i-n)\")\n   apply(rename_tac c dc x i ea w')(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"dc\"\n      in CFGLM_derivationCanBeDecomposed2)\n    apply(rename_tac c dc x i ea w')(*strict*)\n    apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n    apply(rule_tac\n      x=\"i-n\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac c dc x i ea w')(*strict*)\n     apply(simp add: maximum_of_domain_def)\n    apply(rename_tac c dc x i ea w')(*strict*)\n    apply(rule_tac\n      x=\"pair ea \\<lparr>cfg_conf=w'\\<rparr>\"\n      in exI)\n    apply(clarsimp)\n    apply(simp add: derivation_append_def)\n   apply(rename_tac c dc x i ea w')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c dc x i ea w')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(thin_tac \"cfgLM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>}\")\n  apply(rename_tac c dc x i ea d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rename_tac w' n1 n')\n  apply(rename_tac c dc x i ea d1 d2 w1' w' n1 n')(*strict*)\n  apply(subgoal_tac \"\\<exists>d1 d2 w1' w2' n1 n2. cfgLM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgLM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w3\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1'@w2'=w' \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=n'\")\n   apply(rename_tac c dc x i ea d1 d2 w1' w' n1 n')(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d2\"\n      in CFGLM_derivationCanBeDecomposed2)\n    apply(rename_tac c dc x i ea d1 d2 w1' w' n1 n')(*strict*)\n    apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n   apply(rename_tac c dc x i ea d1 d2 w1' w' n1 n')(*strict*)\n   apply(force)\n  apply(rename_tac c dc x i ea d1 d2 w1' w' n1 n')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2)(*strict*)\n  apply(thin_tac \"cfgLM.derivation_from_to G d2a {pair None \\<lparr>cfg_conf = w3\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>}\")\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2)(*strict*)\n  apply(thin_tac \"cfgLM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2 @ w3\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'nonterminal @ w2'\\<rparr>}\")\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2)(*strict*)\n  apply(rule_tac\n      x=\"d1a\"\n      in exI)\n  apply(rule_tac\n      x=\"n1a\"\n      in exI)\n  apply(clarsimp)\n  apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n  apply(case_tac \"d1a 0\")\n   apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n   apply(rule cfgLM.derivation_belongs)\n      apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n      apply(force)\n     apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n     apply(force)\n    apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n    apply(simp add: cfg_configurations_def)\n    apply(simp only: setAConcat setBConcat concat_asso)\n    apply(force)\n   apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n   apply(force)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n  apply(rule_tac\n      x=\"w1'nonterminal\"\n      in exI)\n  apply(simp add: cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(simp only: setAConcat setBConcat concat_asso)\n  apply(clarsimp)\n  apply(subgoal_tac \"na=n1a\")\n   apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n   apply(force)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n  apply(rule_tac\n      d=\"d1a\"\n      in cfgLM.maximum_of_domainUnique)\n    apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n    apply(force)\n   apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n   apply(force)\n  apply(rename_tac c dc x i ea d1 d2 w1' n1 d1a d2a w1'nonterminal w2' n1a n2 na xa)(*strict*)\n  apply(simp add: maximum_of_domain_def)\n  done\n\nlemma cfgLM_step_relation_contextOK2: \"\n  valid_cfg G\n  \\<Longrightarrow> setA w2 = {}\n  \\<Longrightarrow> \\<forall>a e b. cfgLM_step_relation G a e b \\<longrightarrow> cfgLM_step_relation G \\<lparr>cfg_conf = w2@cfg_conf a\\<rparr> e \\<lparr>cfg_conf = w2@cfg_conf b\\<rparr>\"\n  apply(simp add: cfgLM_step_relation_def)\n  apply(auto)\n  apply(rename_tac a e b l r)(*strict*)\n  apply(rule_tac\n      x=\"w2@l\"\n      in exI)\n  apply(rule_tac\n      x=\"r\"\n      in exI)\n  apply(auto)\n  apply(rename_tac a e b l r x)(*strict*)\n  apply(simp only: setAConcat concat_asso)\n  apply(clarsimp)\n  done\n\nlemma cfgLM_concatExtendIsFromToBoth: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>}\n  \\<Longrightarrow> cfgLM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>}\n  \\<Longrightarrow> setA w1' = {}\n  \\<Longrightarrow> maximum_of_domain d1 m1\n  \\<Longrightarrow> maximum_of_domain d2 m2\n  \\<Longrightarrow> cfgLM.derivation_from_to G (derivation_append (derivation_map d1 (\\<lambda>v. \\<lparr>cfg_conf = (cfg_conf v) @ w2\\<rparr>)) (derivation_map d2 (\\<lambda>v. \\<lparr>cfg_conf = w1' @ (cfg_conf v)\\<rparr>)) m1) {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1' @ w2'\\<rparr>}\"\n  apply(subgoal_tac \"\\<exists>e1 e2. d1 0 =Some (pair None \\<lparr>cfg_conf=w1\\<rparr>) \\<and> d1 m1 =Some (pair e1 \\<lparr>cfg_conf=w1'\\<rparr>) \\<and> d2 0 =Some (pair None \\<lparr>cfg_conf=w2\\<rparr>) \\<and> d2 m2 =Some (pair e2 \\<lparr>cfg_conf=w2'\\<rparr>)\")\n   prefer 2\n   apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_to_def cfgLM.derivation_from_def)\n   apply(clarsimp)\n   apply(rename_tac n na xa xaa)(*strict*)\n   apply(case_tac \"d1 0\")\n    apply(rename_tac n na xa xaa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n na xa xaa a)(*strict*)\n   apply(case_tac \"d2 0\")\n    apply(rename_tac n na xa xaa a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n na xa xaa a aa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n na xa xaa)(*strict*)\n   apply(subgoal_tac \"n=m1\")\n    apply(rename_tac n na xa xaa)(*strict*)\n    apply(subgoal_tac \"na=m2\")\n     apply(rename_tac n na xa xaa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac n na xa xaa)(*strict*)\n    apply(rule_tac\n      d=\"d2\"\n      in cfgLM.maximum_of_domainUnique)\n      apply(rename_tac n na xa xaa)(*strict*)\n      apply(force)\n     apply(rename_tac n na xa xaa)(*strict*)\n     apply(force)\n    apply(rename_tac n na xa xaa)(*strict*)\n    apply(simp add: maximum_of_domain_def)\n   apply(rename_tac n na xa xaa)(*strict*)\n   apply(rule_tac\n      d=\"d1\"\n      in cfgLM.maximum_of_domainUnique)\n     apply(rename_tac n na xa xaa)(*strict*)\n     apply(force)\n    apply(rename_tac n na xa xaa)(*strict*)\n    apply(force)\n   apply(rename_tac n na xa xaa)(*strict*)\n   apply(simp add: maximum_of_domain_def)\n  apply(subgoal_tac \"cfgLM.derivation G (derivation_map d1 (\\<lambda>v. \\<lparr>cfg_conf = cfg_conf v @ w2\\<rparr>))\")\n   prefer 2\n   apply(rule cfgLM.derivation_map_preserves_derivation2)\n    apply(rule cfgLM.from_to_is_der)\n    apply(force)\n   apply(rule cfgLM_step_relation_contextOK1)\n   apply(clarsimp)\n  apply(subgoal_tac \"cfgLM.derivation G (derivation_map d2 (\\<lambda>v. \\<lparr>cfg_conf = w1' @ cfg_conf v\\<rparr>))\")\n   prefer 2\n   apply(rule cfgLM.derivation_map_preserves_derivation2)\n    apply(rule cfgLM.from_to_is_der)\n    apply(force)\n   apply(rule cfgLM_step_relation_contextOK2)\n    apply(clarsimp)\n   apply(force)\n  apply(rule_tac\n      dJ=\"\\<lparr>cfg_conf=w1'@w2\\<rparr>\"\n      in cfgLM.concatIsFromTo)\n     apply(simp add: cfgLM.derivation_from_to_def)\n     apply(simp add: cfgLM.derivation_from_def)\n     apply(simp add: cfgLM.derivation_to_def)\n     apply(simp add: derivation_map_def)\n     apply(rule_tac\n      x=\"m1\"\n      in exI)\n     apply(clarsimp)\n     apply(rename_tac n na e1 xa xaa e2)(*strict*)\n     apply(simp add: maximum_of_domain_def)\n    apply(simp add: cfgLM.derivation_from_to_def)\n    apply(simp add: cfgLM.derivation_from_def)\n    apply(simp add: cfgLM.derivation_to_def)\n    apply(simp add: derivation_map_def)\n    apply(rule_tac\n      x=\"m2\"\n      in exI)\n    apply(clarsimp)\n    apply(rename_tac n na e1 xa xaa e2)(*strict*)\n    apply(simp add: maximum_of_domain_def)\n   apply(rule derivation_map_preserves_maximum_of_domain)\n   apply(blast)\n  apply(rule derivation_map_preserves_maximum_of_domain)\n  apply(blast)\n  done\n\nlemma StepPreciseLM: \"\n  valid_cfg G\n  \\<Longrightarrow> setA w1={}\n  \\<Longrightarrow> cfgLM_step_relation G \\<lparr>cfg_conf = w1 @ [teA A] @ w2 \\<rparr> e \\<lparr>cfg_conf = w1 @ w @ w2\\<rparr>\n  \\<Longrightarrow> e=\\<lparr>prod_lhs=A, prod_rhs=w\\<rparr>\"\n  apply(simp add: cfgLM_step_relation_def)\n  apply(auto)\n  apply(rename_tac l r)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac l r prod_lhsa prod_rhsa)(*strict*)\n  apply(subgoal_tac \"w1=l\")\n   apply(rename_tac l r prod_lhsa prod_rhsa)(*strict*)\n   apply(auto)\n  apply(rename_tac l r prod_lhs prod_rhs)(*strict*)\n  apply(rule terminalHeadEquals1)\n    apply(rename_tac l r prod_lhs prod_rhs)(*strict*)\n    apply(blast)\n   apply(rename_tac l r prod_lhs prod_rhs)(*strict*)\n   apply(blast)\n  apply(rename_tac l r prod_lhs prod_rhs)(*strict*)\n  apply(clarsimp)\n  apply(blast)\n  done\n\nlemma cfgLM_inst_AX_marking_condition_implies_existence_of_effect: \"\n  \\<forall>M. valid_cfg M \\<longrightarrow> (\\<forall>f. cfgLM.derivation_initial M f \\<longrightarrow> cfg_marking_condition M f \\<longrightarrow> cfg_marked_effect M f \\<noteq> {})\"\n  apply(simp add: cfg_marking_condition_def cfg_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M f i e c)(*strict*)\n  apply(simp add: cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"filterB (cfg_conf c)\"\n      in exI)\n  apply(rule_tac\n      x=\"e\"\n      in exI)\n  apply(rule_tac\n      x=\"c\"\n      in exI)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac M f i e c)(*strict*)\n   apply(force)\n  apply(rename_tac M f i e c)(*strict*)\n  apply(rule liftBDeConv2)\n  apply(force)\n  done\n\nlemma cfgLM_inst_AX_string_state_increases: \"\n   \\<forall>G. valid_cfg G \\<longrightarrow>\n        (\\<forall>c1. c1 \\<in> cfg_configurations G \\<longrightarrow>\n              (\\<forall>e c2. cfgLM_step_relation G c1 e c2 \\<longrightarrow>\n                      (\\<exists>w. cfg_get_history c1 @ w = cfg_get_history c2)))\"\n  apply(simp add: cfg_get_history_def maxTermPrefix_def cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac M c1 e c2 l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac M c1 e c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M c1 e l r)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac M c1 e l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M e l r)(*strict*)\n  apply(subgoal_tac \"\\<exists>w1 w2. liftB w1 @ w2 = l \\<and> (case w2 of teB b#list \\<Rightarrow> False | _ \\<Rightarrow> True)\")\n   apply(rename_tac M e l r)(*strict*)\n   prefer 2\n   apply(rule maxSplit)\n  apply(rename_tac M e l r)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M e r w1 w2)(*strict*)\n  apply(subgoal_tac \"\\<exists>w1 w2. liftB w1 @ w2 = (prod_rhs e@r) \\<and> (case w2 of teB b#list \\<Rightarrow> False | _ \\<Rightarrow> True)\")\n   apply(rename_tac M e r w1 w2)(*strict*)\n   prefer 2\n   apply(rule maxSplit)\n  apply(rename_tac M e r w1 w2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M e r w1 w2 w1a w2a)(*strict*)\n  apply(rule_tac\n      t=\"(THE y. (\\<exists>w. liftB y @ w = liftB w1 @ w2 @ teA (prod_lhs e) # r) \\<and> (\\<forall>w. liftB y @ w = liftB w1 @ w2 @ teA (prod_lhs e) # r \\<longrightarrow> (case w of [] \\<Rightarrow> True | teA A # y \\<Rightarrow> True | teB X # y \\<Rightarrow> False)))\"\n      and s=\"w1\"\n      in ssubst)\n   apply(rename_tac M e r w1 w2 w1a w2a)(*strict*)\n   apply(case_tac w2)\n    apply(rename_tac M e r w1 w2 w1a w2a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac M e r w1 w1a w2a)(*strict*)\n    apply(rule maximal_terminal_prefix_THE)\n     apply(rename_tac M e r w1 w1a w2a)(*strict*)\n     apply(rule setA_liftB)\n    apply(rename_tac M e r w1 w1a w2a)(*strict*)\n    apply(rule sym)\n    apply(rule liftBDeConv1)\n   apply(rename_tac M e r w1 w2 w1a w2a a list)(*strict*)\n   apply(case_tac a)\n    apply(rename_tac M e r w1 w2 w1a w2a a list aa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n    apply(rule maximal_terminal_prefix_THE)\n     apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n     apply(rule setA_liftB)\n    apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n    apply(rule sym)\n    apply(rule liftBDeConv1)\n   apply(rename_tac M e r w1 w2 w1a w2a a list b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac M e r w1 w2 w1a w2a)(*strict*)\n  apply(case_tac w2)\n   apply(rename_tac M e r w1 w2 w1a w2a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M e r w1 w1a w2a)(*strict*)\n   apply(rule_tac\n      t=\"(THE y. (\\<exists>w. liftB y @ w = liftB w1 @ prod_rhs e @ r) \\<and> (\\<forall>w. liftB y @ w = liftB w1 @ prod_rhs e @ r \\<longrightarrow> (case w of [] \\<Rightarrow> True | teA A # y \\<Rightarrow> True | teB X # y \\<Rightarrow> False)))\"\n      and s=\"w1@w1a\"\n      in ssubst)\n    apply(rename_tac M e r w1 w1a w2a)(*strict*)\n    apply(case_tac w2a)\n     apply(rename_tac M e r w1 w1a w2a)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac M e r w1 w1a)(*strict*)\n     apply(rule_tac\n      t=\"prod_rhs e @ r\"\n      and s=\"liftB w1a\"\n      in ssubst)\n      apply(rename_tac M e r w1 w1a)(*strict*)\n      apply(force)\n     apply(rename_tac M e r w1 w1a)(*strict*)\n     apply(rule maximal_terminal_prefix_THE_prime)\n      apply(rename_tac M e r w1 w1a)(*strict*)\n      apply(thin_tac \"liftB w1a = prod_rhs e @ r\")\n      apply(simp only: setAConcat concat_asso setBConcat)\n      apply(clarsimp)\n      apply(rename_tac M e w1 w1a)(*strict*)\n      apply(rule setA_liftB)\n     apply(rename_tac M e r w1 w1a)(*strict*)\n     apply(rule_tac\n      t=\"filterB (liftB w1 @ liftB w1a)\"\n      and s=\"filterB (liftB w1) @ (filterB (liftB w1a))\"\n      in ssubst)\n      apply(rename_tac M e r w1 w1a)(*strict*)\n      apply(rule filterB_commutes_over_concat)\n     apply(rename_tac M e r w1 w1a)(*strict*)\n     apply(rule_tac\n      t=\"filterB (liftB w1)\"\n      and s=\"w1\"\n      in ssubst)\n      apply(rename_tac M e r w1 w1a)(*strict*)\n      apply(rule liftBDeConv1)\n     apply(rename_tac M e r w1 w1a)(*strict*)\n     apply(rule_tac\n      t=\"filterB (liftB w1a)\"\n      and s=\"w1a\"\n      in ssubst)\n      apply(rename_tac M e r w1 w1a)(*strict*)\n      apply(rule liftBDeConv1)\n     apply(rename_tac M e r w1 w1a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac M e r w1 w1a w2a a list)(*strict*)\n    apply(case_tac a)\n     apply(rename_tac M e r w1 w1a w2a a list aa)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac M e r w1 w1a list aa)(*strict*)\n     apply(rule_tac\n      t=\"prod_rhs e @ r\"\n      and s=\"liftB w1a @ teA aa # list\"\n      in ssubst)\n      apply(rename_tac M e r w1 w1a list aa)(*strict*)\n      apply(force)\n     apply(rename_tac M e r w1 w1a list aa)(*strict*)\n     apply(thin_tac \"liftB w1a @ teA aa # list=prod_rhs e@r\")\n     apply(rule_tac\n      t=\"liftB w1 @ liftB w1a @ teA aa # list\"\n      and s=\"(liftB w1 @ liftB w1a) @ teA aa # list\"\n      in ssubst)\n      apply(rename_tac M e r w1 w1a list aa)(*strict*)\n      apply(force)\n     apply(rename_tac M e r w1 w1a list aa)(*strict*)\n     apply(rule_tac\n      t=\"liftB w1 @ liftB w1a\"\n      and s=\"liftB (w1@w1a)\"\n      in ssubst)\n      apply(rename_tac M e r w1 w1a list aa)(*strict*)\n      apply(rule sym)\n      apply(rule liftB_commutes_over_concat)\n     apply(rename_tac M e r w1 w1a list aa)(*strict*)\n     apply(rule maximal_terminal_prefix_THE)\n      apply(rename_tac M e r w1 w1a list aa)(*strict*)\n      apply(rule setA_liftB)\n     apply(rename_tac M e r w1 w1a list aa)(*strict*)\n     apply(rule sym)\n     apply(rule liftBDeConv1)\n    apply(rename_tac M e r w1 w1a w2a a list b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac M e r w1 w1a w2a)(*strict*)\n   apply(force)\n  apply(rename_tac M e r w1 w2 w1a w2a a list)(*strict*)\n  apply(case_tac a)\n   apply(rename_tac M e r w1 w2 w1a w2a a list aa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n   apply(rule_tac\n      t=\"(THE y. (\\<exists>w. liftB y @ w = liftB w1 @ teA aa # list @ prod_rhs e @ r) \\<and> (\\<forall>w. liftB y @ w = liftB w1 @ teA aa # list @ prod_rhs e @ r \\<longrightarrow> (case w of [] \\<Rightarrow> True | teA A # y \\<Rightarrow> True | teB X # y \\<Rightarrow> False)))\"\n      and s=\"w1\"\n      in ssubst)\n    apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n    apply(rule maximal_terminal_prefix_THE)\n     apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n     apply(rule setA_liftB)\n    apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n    apply(rule sym)\n    apply(rule liftBDeConv1)\n   apply(rename_tac M e r w1 w1a w2a list aa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac M e r w1 w2 w1a w2a a list b)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma cfgLM_staysInSigma: \"\n  valid_cfg G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> cfgLM_step_relation G \\<lparr>cfg_conf=w\\<rparr> e \\<lparr>cfg_conf=w'\\<rparr>\n  \\<Longrightarrow> e \\<in> cfg_productions G\n  \\<Longrightarrow> setB w' \\<subseteq> cfg_events G\"\n  apply(simp add: cfgLM_step_relation_def)\n  apply(auto)\n  apply(rename_tac x l r)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac x l r prod_lhsa prod_rhsa)(*strict*)\n  apply(auto)\n  apply(rename_tac x l r prod_lhs prod_rhs)(*strict*)\n  apply(simp add: valid_cfg_def)\n  apply(rename_tac x l r prod_lhsa prod_rhsa)(*strict*)\n  apply(auto)\n  apply(erule_tac\n      x=\"\\<lparr>prod_lhs = prod_lhsa, prod_rhs = prod_rhsa\\<rparr>\"\n      in ballE)\n   apply(rename_tac x l r prod_lhsa prod_rhsa)(*strict*)\n   apply(auto)\n  apply(rename_tac x l r prod_lhs prod_rhs)(*strict*)\n  apply(rename_tac A w)\n  apply(rename_tac x l r A w)(*strict*)\n  apply(rule_tac\n      A=\"setB (l @ w @ r)\"\n      in set_mp)\n   apply(rename_tac x l r A w)(*strict*)\n   apply(rule_tac\n      s=\"setB l \\<union> setB w \\<union> setB r\"\n      and t=\"setB (l @ w @ r)\"\n      in ssubst)\n    apply(rename_tac x l r A w)(*strict*)\n    apply(simp (no_asm) only: setBConcat concat_asso)\n   apply(rename_tac x l r A w)(*strict*)\n   apply(clarsimp)\n   defer\n   apply(clarsimp)\n  apply(rename_tac x l r A w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x l r A w)(*strict*)\n   apply(simp only: setBConcat concat_asso)\n   apply(rule_tac\n      B=\"setB l \\<union> setB (teA A # r)\"\n      in subset_trans)\n    apply(rename_tac x l r A w)(*strict*)\n    apply(blast)\n   apply(rename_tac x l r A w)(*strict*)\n   apply(blast)\n  apply(rename_tac x l r A w)(*strict*)\n  apply(subgoal_tac \"setB (l @ [teA A] @ r) \\<subseteq> cfg_events G\")\n   apply(rename_tac x l r A w)(*strict*)\n   apply(simp only: setBConcat concat_asso)\n   apply(rule_tac\n      B=\"setB l \\<union> setB [teA A] \\<union> setB r\"\n      in subset_trans)\n    apply(rename_tac x l r A w)(*strict*)\n    apply(blast)\n   apply(rename_tac x l r A w)(*strict*)\n   apply(blast)\n  apply(rename_tac x l r A w)(*strict*)\n  apply(auto)\n  done\n\nlemma cfgLM_CFGStepNonTermBehaviour: \"\n  cfgLM_step_relation G \\<lparr>cfg_conf = w1\\<rparr> \\<lparr>prod_lhs=A, prod_rhs=w\\<rparr> \\<lparr>cfg_conf = w2\\<rparr>\n  \\<Longrightarrow> setA w2 \\<subseteq> setA w1 \\<union> setA w\"\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp del: subsetI)\n  apply(rename_tac l r)(*strict*)\n  apply(rule_tac\n      t=\"teA A#r\"\n      and s=\"[teA A]@r\"\n      in ssubst)\n   apply(rename_tac l r)(*strict*)\n   apply(force)\n  apply(rename_tac l r)(*strict*)\n  apply(simp only: setAConcat concat_asso)\n  apply(force)\n  done\n\nlemma cfgLM_staysInAlpha2: \"\n  valid_cfg G\n  \\<Longrightarrow> setA w \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d i = Some (pair e1 \\<lparr>cfg_conf=w\\<rparr>)\n  \\<Longrightarrow> d (i+j) = Some (pair e2 \\<lparr>cfg_conf=w'\\<rparr>)\n  \\<Longrightarrow> setB w' \\<subseteq> cfg_events G \\<and> setA w' \\<subseteq> cfg_nonterminals G\"\n  apply(subgoal_tac \" \\<forall>e2 w'. d (i+j)=Some (pair e2 \\<lparr>cfg_conf=w'\\<rparr>) \\<longrightarrow> (setA w' \\<subseteq> cfg_nonterminals G \\<and> setB w' \\<subseteq> cfg_events G) \")\n   apply(clarsimp)\n  apply(rule_tac\n      m=\"i\"\n      and n=\"j\"\n      in cfgLM.property_preseved_under_steps_is_invariant2)\n      apply(blast)+\n     apply(clarsimp)\n    apply(arith)\n   apply(arith)\n  apply(rule allI)\n  apply(rename_tac ia)(*strict*)\n  apply(rule impI)\n  apply(erule conjE)+\n  apply(rule allI)+\n  apply(rename_tac ia e2a w'nonterminal)(*strict*)\n  apply(rule impI)\n  apply(subgoal_tac \"\\<exists>e. Some e=e2a\")\n   apply(rename_tac ia e2a w'nonterminal)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d ia = Some (pair e c)\")\n    apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc ia\"\n      in cfgLM.pre_some_position_is_some_position)\n      apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n      apply(blast)\n     apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n     apply(blast)\n    apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n    apply(force)\n   apply(rename_tac ia e2a w'nonterminal e)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac ia e2a w'nonterminal e ea c)(*strict*)\n   apply(case_tac c)\n   apply(rename_tac ia e2a w'nonterminal e ea c cfg_conf)(*strict*)\n   apply(rename_tac cw)\n   apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n   apply(erule_tac\n      x=\"ea\"\n      in allE)\n   apply(erule_tac\n      x=\"cw\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n    apply(blast)\n   apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n   apply(erule conjE)+\n   apply(subgoal_tac \"cfgLM_step_relation G \\<lparr>cfg_conf = cw\\<rparr> e \\<lparr>cfg_conf = w'nonterminal\\<rparr>\")\n    apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n     prefer 2\n     apply(rule_tac\n      w=\"cw\"\n      and e=\"e\"\n      in cfgLM_staysInSigma)\n        apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n        apply(blast)\n       apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n       apply(blast)\n      apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n      apply(blast)\n     apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n     apply(simp add: cfgLM_step_relation_def)\n    apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n    prefer 2\n    apply(rule cfgLM.position_change_due_to_step_relation)\n      apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n      apply(blast)+\n   apply(rename_tac ia e2a w'nonterminal e ea c cw)(*strict*)\n   apply(case_tac e)\n   apply(rename_tac ia e2a w'nonterminal e ea c cw prod_lhs prod_rhs)(*strict*)\n   apply(clarsimp del: subsetI)\n   apply(rename_tac ia w'nonterminal ea cw prod_lhs prod_rhs)(*strict*)\n   apply(rename_tac Ax wx)\n   apply(rename_tac ia w'nonterminal ea cw Ax wx)(*strict*)\n   apply(rule_tac\n      B=\"setA cw \\<union> setA wx\"\n      in subset_trans)\n    apply(rename_tac ia w'nonterminal ea cw Ax wx)(*strict*)\n    apply(rule cfgLM_CFGStepNonTermBehaviour)\n    apply(blast)\n   apply(rename_tac ia w'nonterminal ea cw Ax wx)(*strict*)\n   apply(clarsimp del: subsetI)\n   apply(rule_tac\n      a=\"Ax\"\n      in prod_rhs_in_nonterms)\n    apply(rename_tac ia w'nonterminal ea cw Ax wx)(*strict*)\n    apply(blast)+\n   apply(rename_tac ia w'nonterminal ea cw Ax wx)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n  apply(rename_tac ia e2a w'nonterminal)(*strict*)\n  apply(case_tac e2a)\n   apply(rename_tac ia e2a w'nonterminal)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ia w'nonterminal)(*strict*)\n   apply(rule cfgLM.derivation_Always_PreEdge_prime)\n    apply(rename_tac ia w'nonterminal)(*strict*)\n    apply(blast)+\n  done\n\nlemma cfgLM_staysInSigma2: \"\n  valid_cfg G\n  \\<Longrightarrow> setA w \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d i = Some (pair e1 \\<lparr>cfg_conf=w\\<rparr>)\n  \\<Longrightarrow> d (i+j) = Some (pair e2 \\<lparr>cfg_conf=w'\\<rparr>)\n  \\<Longrightarrow> setB w' \\<subseteq> cfg_events G\"\n  apply(subgoal_tac \"setB w' \\<subseteq> cfg_events G \\<and> setA w' \\<subseteq> cfg_nonterminals G\")\n   apply(force)\n  apply(rule cfgLM_staysInAlpha2)\n       apply(force)+\n  done\n\nlemma cfgLM_inst_lang_sound: \"\n  (\\<forall>M. valid_cfg M \\<longrightarrow> cfgLM.unmarked_language M \\<subseteq> cfg_effects M)\"\n  apply(simp add: cfg_effects_def cfgLM.unmarked_language_def cfg_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M x xa d e c i z)(*strict*)\n  apply(simp add: cfgLM.derivation_initial_def)\n  apply(case_tac \"d 0\")\n   apply(rename_tac M x xa d e c i z)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac M x xa d e c i z a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac M x xa d e c i z a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M x xa d e c i z b)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac M x xa d e c i z b cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M x xa d e i z b)(*strict*)\n  apply(rule_tac\n      A=\"setB (liftB x @ z)\"\n      in set_mp)\n   apply(rename_tac M x xa d e i z b)(*strict*)\n   prefer 2\n   apply(simp only: concat_asso setBConcat)\n   apply(rule_tac\n      t=\"setB (liftB x)\"\n      and s=\"set x\"\n      in subst)\n    apply(rename_tac M x xa d e i z b)(*strict*)\n    apply(rule liftB_BiElem)\n   apply(rename_tac M x xa d e i z b)(*strict*)\n   apply(force)\n  apply(rename_tac M x xa d e i z b)(*strict*)\n  apply(simp add: cfg_initial_configurations_def)\n  apply(rule_tac\n      j=\"i\"\n      and w=\"[teA (cfg_initial M)]\"\n      in cfgLM_staysInSigma2)\n       apply(rename_tac M x xa d e i z b)(*strict*)\n       apply(force)\n      apply(rename_tac M x xa d e i z b)(*strict*)\n      apply(simp add: valid_cfg_def)\n     apply(rename_tac M x xa d e i z b)(*strict*)\n     apply(force)\n    apply(rename_tac M x xa d e i z b)(*strict*)\n    apply(force)\n   apply(rename_tac M x xa d e i z b)(*strict*)\n   apply(force)\n  apply(rename_tac M x xa d e i z b)(*strict*)\n  apply(force)\n  done\n\nlemma cfgLM_inst_ATS_axioms: \"\n  ATS_Language_axioms valid_cfg cfg_initial_configurations\n     cfgLM_step_relation cfg_effects cfg_marking_condition cfg_marked_effect\n     cfg_unmarked_effect\"\n  apply(simp add: ATS_Language_axioms_def)\n  apply(simp add: cfgBASE_inst_AX_effect_inclusion1 cfgLM_inst_AX_unmarked_effect_persists cfgLM_inst_lang_sound cfgLM_inst_AX_marking_condition_implies_existence_of_effect )\n  done\n\nlemma cfgLM_inst_ATS_String_State_Modification_axioms: \"\n  ATS_String_State_Modification_axioms valid_cfg cfg_configurations cfgLM_step_relation False cfg_get_history\"\n  apply(simp add: ATS_String_State_Modification_axioms_def)\n  apply(rule cfgLM_inst_AX_string_state_increases)\n  done\n\ninterpretation \"cfgLM\" : loc_cfg_1\n  (* TSstructure *)\n  \"valid_cfg\"\n  (* configurations *)\n  \"cfg_configurations\"\n  (* initial_configurations *)\n  \"cfg_initial_configurations\"\n  (* step_labels *)\n  \"cfg_step_labels\"\n  (* step_relation *)\n  \"cfgLM_step_relation\"\n  (* effects *)\n  \"cfg_effects\"\n  (* marking_condition *)\n  \"cfg_marking_condition\"\n  (* marked_effect *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect *)\n  \"cfg_unmarked_effect\"\n  (* destinations *)\n  \"cfg_destination\"\n  (* get_destinations *)\n  \"cfg_get_destinations\"\n  (* decreasing *)\n  \"False\"\n  (* string_state *)\n  \"cfg_get_history\"\n  apply(simp add: LOCALE_DEFS_ALL LOCALE_DEFS_cfg)\n  apply(simp add: cfgBASE_inst_AX_initial_configuration_belongs cfgLM_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: cfgLM_inst_ATS_String_State_Modification_axioms cfgLM_inst_ATS_axioms )\n  done\n\nlemma cfglm_earliest_word_generated_position: \"\n  cfgLM.derivation G d\n  \\<Longrightarrow> d 0 = Some (pair None c)\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf=w@v\\<rparr>)\n  \\<Longrightarrow> P = (\\<lambda>c. \\<exists>z. w@z=cfg_conf c)\n  \\<Longrightarrow> \\<exists>k\\<le>n. (\\<forall>i<k. \\<not> (case d i of None \\<Rightarrow> False | Some (pair e c) \\<Rightarrow> P c)) \\<and>\n                  (case d k of None \\<Rightarrow> False | Some (pair e c) \\<Rightarrow> P c)\"\n  apply(rule cfgLM.existence_of_earliest_satisfaction_point)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma CFGLM_Nonblockingness2: \"\n  valid_cfg G\n  \\<Longrightarrow> Nonblockingness2 (cfgLM.unmarked_language G) (cfgLM.marked_language G)\"\n  apply(simp add: Nonblockingness2_def)\n  apply(simp add: cfgLM.marked_language_def cfgLM.unmarked_language_def prefix_closure_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac x d c)(*strict*)\n  apply(simp add: cfg_marked_effect_def cfg_marking_condition_def cfg_initial_configurations_def cfg_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac x d c e i ca ea cb ia)(*strict*)\n  apply(case_tac cb)\n  apply(rename_tac x d c e i ca ea cb ia cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d c e i ca ea ia cfg_confa)(*strict*)\n  apply(simp add: cfgLM.derivation_initial_def)\n  apply(case_tac \"d 0\")\n   apply(rename_tac x d c e i ca ea ia cfg_confa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x d c e i ca ea ia cfg_confa a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac x d c e i ca ea ia cfg_confa a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n  apply(subgoal_tac \"\\<exists>k\\<le>ia. (\\<forall>i<k. \\<not> (case d i of None \\<Rightarrow> False | Some (pair e c) \\<Rightarrow> (\\<lambda>c. \\<exists>z. (liftB x)@z=cfg_conf c) c)) \\<and> (case d k of None \\<Rightarrow> False | Some (pair e c) \\<Rightarrow> (\\<lambda>c. \\<exists>z. (liftB x)@z=cfg_conf c) c)\")\n   apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n   prefer 2\n   apply(rule_tac\n      e=\"e\"\n      and w=\"liftB x\"\n      and v=\"liftB c\"\n      in cfglm_earliest_word_generated_position)\n      apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n      apply(force)\n     apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n     apply(force)\n    apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n    apply(clarsimp)\n    apply(case_tac ca)\n    apply(rename_tac x d c e i ca ea ia cfg_confa b cfg_confaa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x d c e i ea ia cfg_conf b)(*strict*)\n    apply(rule liftB_commutes_over_concat)\n   apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n   apply(force)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b k)(*strict*)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(clarsimp)\n  apply(case_tac \"d k\")\n   apply(rename_tac x d c e i ca ea ia cfg_confa b k)(*strict*)\n   apply(force)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b k a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b k a option ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b k option ba z)(*strict*)\n  apply(rule_tac\n      x=\"option\"\n      in exI)\n  apply(rule_tac\n      x=\"ba\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac x d c e i ca ea ia cfg_confa b k option ba z)(*strict*)\n   apply(rule_tac\n      x=\"k\"\n      in exI)\n   apply(force)\n  apply(rename_tac x d c e i ca ea ia cfg_confa b k option ba z)(*strict*)\n  apply(force)\n  done\n\nlemma cfgLM_inst_Nonblockingness2: \"\n  \\<forall>M. valid_cfg M \\<longrightarrow> Nonblockingness2 (cfgLM.unmarked_language M) (cfgLM.marked_language M)\"\n  apply(rule allI)\n  apply(rename_tac M)(*strict*)\n  apply(clarsimp)\n  apply(rule CFGLM_Nonblockingness2)\n  apply(force)\n  done\n\nlemma cfglm_terminals_at_beginning_are_never_modified: \"\n  cfgLM.derivation G d\n  \\<Longrightarrow> maximum_of_domain d (m + n)\n  \\<Longrightarrow> d m = Some (pair e1 \\<lparr>cfg_conf = (liftB b) @ w\\<rparr>)\n  \\<Longrightarrow> m \\<le> x\n  \\<Longrightarrow> x \\<le> m + n\n  \\<Longrightarrow> \\<exists>e w. d x = Some (pair e \\<lparr>cfg_conf = (liftB b) @ w\\<rparr>)\"\n  apply(rule cfgLM.property_preseved_under_steps_is_invariant2)\n      apply(blast)+\n  apply(auto)\n  apply(rename_tac i e wa)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n   apply(rename_tac i e wa)(*strict*)\n   apply(clarsimp, case_tac c)\n   apply(rename_tac i e wa ea c cfg_conf)(*strict*)\n   apply(subgoal_tac \"cfgLM_step_relation G \\<lparr>cfg_conf = (liftB b) @ wa\\<rparr> ea c\")\n    apply(rename_tac i e wa ea c cfg_conf)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(auto)\n    apply(rename_tac i e wa ea l r)(*strict*)\n    apply(case_tac l)\n     apply(rename_tac i e wa ea l r)(*strict*)\n     apply(auto)\n     apply(rename_tac i e wa ea r)(*strict*)\n     apply(case_tac b)\n      apply(rename_tac i e wa ea r)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac i e wa ea r a list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac i e wa ea r a list)(*strict*)\n    defer\n    apply(rename_tac i e wa ea cfg_conf)(*strict*)\n    apply(rule cfgLM.position_change_due_to_step_relation)\n      apply(rename_tac i e wa ea cfg_conf)(*strict*)\n      apply(blast)+\n   apply(rename_tac i e wa)(*strict*)\n   apply(rule cfgLM.some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac i e wa)(*strict*)\n     apply(blast)+\n   apply(rename_tac i e wa)(*strict*)\n   apply(arith)\n  apply(rename_tac i e wa ea r a list)(*strict*)\n  apply(subgoal_tac \"prefix (liftB b) (a#list) \\<or> prefix (a#list) (liftB b)\")\n   apply(rename_tac i e wa ea r a list)(*strict*)\n   prefer 2\n   apply(rule_tac\n      b=\"wa\"\n      and d=\"teA (prod_lhs ea) # r\"\n      in mutual_prefix_prefix)\n   apply(force)\n  apply(rename_tac i e wa ea r a list)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac i e wa ea r a list)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   apply(rule_tac\n      t=\"a # list @ prod_rhs ea @ r\"\n      and s=\"(a # list) @ prod_rhs ea @ r\"\n      in ssubst)\n    apply(rename_tac i e wa ea r a list c)(*strict*)\n    apply(force)\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   apply(rule_tac\n      t=\"a#list\"\n      and s=\"liftB b @ c\"\n      in ssubst)\n    apply(rename_tac i e wa ea r a list c)(*strict*)\n    apply(force)\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   apply(simp (no_asm_use))\n  apply(rename_tac i e wa ea r a list)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac i e wa ea r a list c)(*strict*)\n  apply(subgoal_tac \"(a # list @ c) @ wa = a # list @ teA (prod_lhs ea) # r\")\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   prefer 2\n   apply(simp (no_asm_simp))\n  apply(rename_tac i e wa ea r a list c)(*strict*)\n  apply(subgoal_tac \"c @ wa = teA (prod_lhs ea) # r\")\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   prefer 2\n   apply(simp (no_asm_use))\n  apply(rename_tac i e wa ea r a list c)(*strict*)\n  apply(case_tac c)\n   apply(rename_tac i e wa ea r a list c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i e ea r a list)(*strict*)\n   apply(rule_tac\n      x=\"prod_rhs ea @ r\"\n      in exI)\n   apply(simp (no_asm_simp))\n  apply(rename_tac i e wa ea r a list c aa lista)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i e wa ea a list lista)(*strict*)\n  apply(rule_tac\n      w=\"a # list @ teA (prod_lhs ea) # lista\"\n      and v=\"liftB b\"\n      in unequal_setA)\n   apply(rename_tac i e wa ea a list lista)(*strict*)\n   apply(force)\n  apply(rename_tac i e wa ea a list lista)(*strict*)\n  apply(rule_tac\n      t=\"setA (liftB b)\"\n      and s=\"{}\"\n      in ssubst)\n   apply(rename_tac i e wa ea a list lista)(*strict*)\n   apply(rule setA_liftB)\n  apply(rename_tac i e wa ea a list lista)(*strict*)\n  apply(rule_tac\n      t=\"a # list @ teA (prod_lhs ea) # lista\"\n      and s=\"[a] @ list @ [teA (prod_lhs ea)] @ lista\"\n      in ssubst)\n   apply(rename_tac i e wa ea a list lista)(*strict*)\n   apply(force)\n  apply(rename_tac i e wa ea a list lista)(*strict*)\n  apply(simp (no_asm) only: setAConcat concat_asso)\n  apply(force)\n  done\n\nlemma cfgLM_inst_Nonblockingness_branching_correspond1: \"\n  (\\<forall>M. valid_cfg M \\<longrightarrow> cfgLM.Nonblockingness_branching M \\<longrightarrow> nonblockingness_language (cfgLM.unmarked_language M) (cfgLM.marked_language M))\"\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: cfgLM.Nonblockingness_branching_def)\n  apply(simp add: nonblockingness_language_def cfgLM.unmarked_language_def prefix_closure_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac M xa d)(*strict*)\n  apply(subgoal_tac \"cfgLM.belongs M d\")\n   apply(rename_tac M xa d)(*strict*)\n   prefer 2\n   apply(rule cfgLM.derivation_initial_belongs)\n    apply(rename_tac M xa d)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d)(*strict*)\n   apply(force)\n  apply(rename_tac M xa d)(*strict*)\n  apply(subgoal_tac \"\\<exists>v. v \\<in> cfgLM.marked_language M \\<and> (\\<exists>c. xa @ c = v)\")\n   apply(rename_tac M xa d)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac M xa d)(*strict*)\n  apply(simp add: cfg_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z)(*strict*)\n  apply(erule_tac\n      x=\"derivation_take d i\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M xa d e c i z)(*strict*)\n   apply(rename_tac M xa d e c i z)(*strict*)\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac M xa d e c i z)(*strict*)\n    apply(rule cfgLM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac M xa d e c i z)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac M xa d e c i z)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac M xa d e c i z)(*strict*)\n   apply(rename_tac M xa d e c i z)(*strict*)\n   apply(rule maximum_of_domain_derivation_take)\n   apply(force)\n  apply(rename_tac M xa d e c i z)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. dc 0 = Some (pair None c)\")\n   apply(rename_tac M xa d e c i z dc x)(*strict*)\n   prefer 2\n   apply(rule cfgLM.some_position_has_details_at_0)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x ca)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. d 0 = Some (pair None c)\")\n   apply(rename_tac M xa d e c i z dc x ca)(*strict*)\n   prefer 2\n   apply(rule cfgLM.some_position_has_details_at_0)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n  apply(subgoal_tac \"cfgLM.derivation M (derivation_append (derivation_take d i) dc i)\")\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   prefer 2\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(rule cfgLM.derivation_append_preserves_derivation)\n     apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n     apply(rule cfgLM.derivation_take_preserves_derivation)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   apply(simp add: derivation_take_def)\n   apply(simp add: derivation_append_fit_def)\n  apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n  apply(subgoal_tac \"maximum_of_domain (derivation_append (derivation_take d i) dc i) (i + x)\")\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   prefer 2\n   apply(rule concat_has_max_dom)\n    apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n    apply(rule maximum_of_domain_derivation_take)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. (derivation_append (derivation_take d i) dc i) (i+x) = Some (pair e c)\")\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   prefer 2\n   apply(rule_tac\n      n=\"i+x\"\n      in cfgLM.some_position_has_details_before_max_dom)\n     apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x ca cb)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x ca cb ea cc)(*strict*)\n  apply(case_tac cc)\n  apply(rename_tac M xa d e c i z dc x ca cb ea cc cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x ca cb ea cfg_confa)(*strict*)\n  apply(rename_tac w)\n  apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n  apply(rule_tac\n      x=\"filterB w\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n   apply(simp add: cfgLM.marked_language_def)\n   apply(rule_tac\n      x=\"derivation_append (derivation_take d i) dc i\"\n      in exI)\n   apply(clarsimp)\n   apply(rule context_conjI)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n    apply(rule cfgLM.derivation_append_preserves_derivation_initial)\n      apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n      apply(force)\n     apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n     apply(rule cfgLM.derivation_take_preserves_derivation_initial)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n   apply(simp add: cfg_marked_effect_def)\n   apply(rule_tac\n      x=\"ea\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>cfg_conf = w\\<rparr>\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: cfg_marking_condition_def)\n   apply(clarsimp)\n   apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n   apply(simp add: cfg_marking_configuration_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"ia=i+x\")\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"derivation_append (derivation_take d i) dc i\"\n      in cfgLM.maximum_of_domainUnique)\n      apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n      apply(force)\n     apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n    apply(simp add: maximum_of_domain_def)\n    apply(case_tac \"derivation_append (derivation_take d i) dc i (Suc ia) = None\")\n     apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. (derivation_append (derivation_take d i) dc i) ia = Some (pair e1 c1) \\<and> (derivation_append (derivation_take d i) dc i) (Suc ia) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation M c1 e2 c2\")\n     apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc ia\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n       apply(simp add: cfgLM.derivation_initial_def)\n      apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n      apply(force)\n     apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc y ya)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc ya e2 c2)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc ya e2 c2 l r)(*strict*)\n    apply(subgoal_tac \"prod_lhs e2 \\<in> setA (l @ teA (prod_lhs e2) # r)\")\n     apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc ya e2 c2 l r)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc ya e2 c2 l r)(*strict*)\n    apply(simp only: setAConcat concat_asso setBConcat)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb ea w ia eb cc)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M xa d e c i z dc x ca cb w eb)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac M xa d e c i z dc x ca cb w eb)(*strict*)\n    apply(rule_tac\n      x=\"i+x\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac M xa d e c i z dc x ca cb w eb)(*strict*)\n   apply(rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n  apply(subgoal_tac \"\\<exists>e w. (derivation_append (derivation_take d i) dc i) (i+x) = Some (pair e \\<lparr>cfg_conf = (liftB xa) @ w\\<rparr>)\")\n   apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n   prefer 2\n   apply(rule cfglm_terminals_at_beginning_are_never_modified)\n       apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n       apply(force)\n      apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n      apply(force)\n     apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n     apply(simp add: derivation_append_def derivation_take_def derivation_append_fit_def)\n     apply(clarsimp)\n     apply(rename_tac M xa d e i z dc x ca cb ea w)(*strict*)\n     apply(case_tac ca)\n     apply(rename_tac M xa d e i z dc x ca cb ea w cfg_confa)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac M xa d e i z dc x cb ea w)(*strict*)\n     apply(force)\n    apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n    apply(force)\n   apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n   apply(force)\n  apply(rename_tac M xa d e c i z dc x ca cb ea w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M xa d e c i z dc x ca cb ea wa)(*strict*)\n  apply(rule_tac\n      x=\"filterB wa\"\n      in exI)\n  apply(rule_tac\n      t=\"filterB (liftB xa @ wa)\"\n      and s=\"filterB (liftB xa) @ filterB wa\"\n      in ssubst)\n   apply(rename_tac M xa d e c i z dc x ca cb ea wa)(*strict*)\n   apply(rule filterB_commutes_over_concat)\n  apply(rename_tac M xa d e c i z dc x ca cb ea wa)(*strict*)\n  apply(clarsimp)\n  apply(rule sym)\n  apply(rule liftBDeConv1)\n  done\n\nlemma cfgLM_inst_lang_finite: \"\n  (\\<forall>G. valid_cfg G \\<longrightarrow> cfgLM.finite_marked_language G = cfgLM.marked_language G)\"\n  apply(clarsimp)\n  apply(rename_tac G)(*strict*)\n  apply(rule order_antisym)\n   apply(rename_tac G)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G x)(*strict*)\n   apply(simp add: cfgLM.marked_language_def cfgLM.finite_marked_language_def)\n   apply(clarsimp)\n   apply(rename_tac G x d xa)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: cfgLM.derivation_initial_def)\n  apply(rename_tac G)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G x)(*strict*)\n  apply(simp add: cfgLM.marked_language_def cfgLM.finite_marked_language_def)\n  apply(clarsimp)\n  apply(rename_tac G x d)(*strict*)\n  apply(simp add: cfg_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G x d e c i)(*strict*)\n  apply(rule_tac\n      x=\"derivation_take d i\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac G x d e c i)(*strict*)\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac G x d e c i)(*strict*)\n    apply(rule cfgLM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac G x d e c i)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac G x d e c i)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac G x d e c i)(*strict*)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac G x d e c i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G x d e c i ea ca ia)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G x d e c i ea ca ia)(*strict*)\n   apply(simp add: cfg_marking_condition_def)\n   apply(clarsimp)\n   apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(simp add: derivation_take_def)\n   apply(simp add: cfg_marking_configuration_def)\n   apply(clarsimp)\n   apply(case_tac \"ia \\<le> i\")\n    apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n    prefer 2\n    apply(clarsimp)\n   apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n   apply(clarsimp)\n   apply(rule cfgLM.belongs_configurations)\n    apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n    apply(rule cfgLM.derivation_initial_belongs)\n     apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n     apply(force)\n    apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n    apply(force)\n   apply(rename_tac G x d e c i ea ca ia ib eb cb)(*strict*)\n   apply(force)\n  apply(rename_tac G x d e c i ea ca ia)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(rule maximum_of_domain_derivation_take)\n  apply(force)\n  done\n\nlemma cfgLM_inst_AX_unmarked_language_finite: \"\n  (\\<forall>G. valid_cfg G \\<longrightarrow> cfgLM.finite_unmarked_language G = cfgLM.unmarked_language G)\"\n  apply(clarsimp)\n  apply(rename_tac G)(*strict*)\n  apply(rule order_antisym)\n   apply(rename_tac G)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G x)(*strict*)\n   apply(simp add: cfgLM.unmarked_language_def cfgLM.finite_unmarked_language_def)\n   apply(clarsimp)\n   apply(rename_tac G x d xa)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: cfgLM.derivation_initial_def)\n  apply(rename_tac G)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G x)(*strict*)\n  apply(simp add: cfgLM.unmarked_language_def cfgLM.finite_unmarked_language_def)\n  apply(clarsimp)\n  apply(rename_tac G x d)(*strict*)\n  apply(simp add: cfg_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G x d e c i z)(*strict*)\n  apply(rule_tac\n      x=\"derivation_take d i\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac G x d e c i z)(*strict*)\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac G x d e c i z)(*strict*)\n    apply(rule cfgLM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac G x d e c i z)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac G x d e c i z)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac G x d e c i z)(*strict*)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac G x d e c i z)(*strict*)\n    apply(rule_tac\n      x=\"i\"\n      in exI)\n    apply(simp add: derivation_take_def)\n   apply(rename_tac G x d e c i z)(*strict*)\n   apply(force)\n  apply(rename_tac G x d e c i z)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(rule maximum_of_domain_derivation_take)\n  apply(force)\n  done\n\nlemma cfgLM_inst_ATS_Language_by_Finite_Derivations_axioms: \"\n  ATS_Language_by_Finite_Derivations_axioms valid_cfg\n     cfg_initial_configurations cfgLM_step_relation cfg_marking_condition\n     cfg_marked_effect cfg_unmarked_effect\"\n  apply(simp add: ATS_Language_by_Finite_Derivations_axioms_def)\n  apply(rule conjI)\n   apply (metis cfgLM_inst_lang_finite)\n  apply (metis cfgLM_inst_AX_unmarked_language_finite)\n  done\n\nlemma cfgLM_inst_BF_Bra_OpLa_axioms: \"\n  BF_Bra_OpLa_axioms valid_cfg cfg_configurations\n     cfg_initial_configurations cfg_step_labels cfgLM_step_relation\n     cfg_marking_condition cfg_marked_effect cfg_unmarked_effect\"\n  apply(simp add: BF_Bra_OpLa_axioms_def)\n  apply (metis cfgLM_inst_Nonblockingness_branching_correspond1)\n  done\n\nlemma cfgLM_inst_AX_marked_configuration_effect_coincides_with_marked_effect: \"\n(\\<forall>G. valid_cfg G \\<longrightarrow>\n         (\\<forall>d. ATS.derivation_initial cfg_initial_configurations\n               cfgLM_step_relation G d \\<longrightarrow>\n              cfg_marked_effect G d =\n              \\<Union>{cfg_marked_configuration_effect G c |c.\n                 (\\<exists>i e. d i = Some (pair e c)) \\<and>\n                 c \\<in> cfg_marking_configuration G}))\"\n  apply(clarsimp)\n  apply(rename_tac G d)(*strict*)\n  apply(simp add: cfg_marked_effect_def cfg_marking_configuration_def cfg_marked_configuration_effect_def)\n  apply(rule antisym)\n   apply(rename_tac G d)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G d x e c i)(*strict*)\n   apply(rule_tac\n      x=\"{x}\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac G d x e c i)(*strict*)\n    apply(rule antisym)\n     apply(rename_tac G d x e c i)(*strict*)\n     apply(force)\n    apply(rename_tac G d x e c i)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G d x e c i xa)(*strict*)\n    apply (metis liftB_inj)\n   apply(rename_tac G d x e c i)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac G d x e c i)(*strict*)\n    apply(force)\n   apply(rename_tac G d x e c i)(*strict*)\n   apply(rule cfgLM.belongs_configurations)\n    apply(rename_tac G d x e c i)(*strict*)\n    apply(rule cfgLM.derivation_initial_belongs)\n     apply(rename_tac G d x e c i)(*strict*)\n     apply(force)\n    apply(rename_tac G d x e c i)(*strict*)\n    apply(force)\n   apply(rename_tac G d x e c i)(*strict*)\n   apply(force)\n  apply(rename_tac G d)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G d x c i e)(*strict*)\n  apply(rule_tac\n      x=\"e\"\n      in exI)\n  apply(rule_tac\n      x=\"c\"\n      in exI)\n  apply(force)\n  done\n\nlemma cfgLM_inst_AX_unmarked_configuration_effect_coincides_with_unmarked_effect: \"\n (\\<forall>G. valid_cfg G \\<longrightarrow>\n         (\\<forall>d. ATS.derivation_initial cfg_initial_configurations\n               cfgLM_step_relation G d \\<longrightarrow>\n              cfg_unmarked_effect G d =\n              \\<Union>{cfg_unmarked_configuration_effect G c |c.\n                 \\<exists>i e. d i = Some (pair e c)}))\"\n  apply(clarsimp)\n  apply(rename_tac G d)(*strict*)\n  apply(simp add: cfg_unmarked_effect_def)\n  apply(rule antisym)\n   apply(rename_tac G d)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G d x e c i z)(*strict*)\n   apply(rule_tac\n      x=\"cfg_unmarked_configuration_effect G c\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac G d x e c i z)(*strict*)\n    apply(rule_tac\n      x=\"c\"\n      in exI)\n    apply(force)\n   apply(rename_tac G d x e c i z)(*strict*)\n   apply(simp add: cfg_unmarked_configuration_effect_def)\n   apply(rule_tac\n      x=\"z\"\n      in exI)\n   apply(force)\n  apply(rename_tac G d)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G d x c i e)(*strict*)\n  apply(rule_tac\n      x=\"e\"\n      in exI)\n  apply(rule_tac\n      x=\"c\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G d x c i e)(*strict*)\n   apply(force)\n  apply(rename_tac G d x c i e)(*strict*)\n  apply(simp add: cfg_unmarked_configuration_effect_def)\n  apply(force)\n  done\n\ninterpretation \"cfgLM\" : loc_cfg_2\n  (* TSstructure *)\n  \"valid_cfg\"\n  (* configurations *)\n  \"cfg_configurations\"\n  (* initial_configurations *)\n  \"cfg_initial_configurations\"\n  (* step_labels *)\n  \"cfg_step_labels\"\n  (* step_relation *)\n  \"cfgLM_step_relation\"\n  (* effects *)\n  \"cfg_effects\"\n  (* marking_condition *)\n  \"cfg_marking_condition\"\n  (* marked_effect *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect *)\n  \"cfg_unmarked_effect\"\n  (* destinations *)\n  \"cfg_destination\"\n  (* get_destinations *)\n  \"cfg_get_destinations\"\n  (* decreasing *)\n  \"False\"\n  (* string_state *)\n  \"cfg_get_history\"\n  apply(simp add: LOCALE_DEFS_ALL LOCALE_DEFS_cfg)\n  apply(simp add: cfgBASE_inst_AX_initial_configuration_belongs cfgLM_inst_AX_step_relation_preserves_belongs )\n  apply(simp add: cfgLM_inst_ATS_String_State_Modification_axioms cfgLM_inst_ATS_axioms cfgLM_inst_ATS_Language_by_Finite_Derivations_axioms cfgLM_inst_BF_Bra_OpLa_axioms )\n  done\n\nlemma cfgLM_inst_Nonblockingness_branching_correspond2d: \"\n  valid_cfg M\n  \\<Longrightarrow> cfgLM.is_forward_deterministic M\n  \\<Longrightarrow> nonblockingness_language (cfgLM.unmarked_language M) (cfgLM.marked_language M)\n  \\<Longrightarrow> cfgLM.Nonblockingness_branching M\"\n  apply(simp add: nonblockingness_language_def)\n  apply(simp add: cfgLM.Nonblockingness_branching_def)\n  apply(clarsimp)\n  apply(rename_tac dh n)(*strict*)\n  apply(case_tac \"dh n\")\n   apply(rename_tac dh n)(*strict*)\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac dh n a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac dh n a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n option b)(*strict*)\n  apply(case_tac b)\n  apply(rename_tac dh n option b cfg_conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n option cfg_conf)(*strict*)\n  apply(rename_tac e w)\n  apply(rename_tac dh n e w)(*strict*)\n  apply(subgoal_tac \"\\<exists>v. (maxTermPrefix w)@v \\<in> cfgLM.marked_language M\")\n   apply(rename_tac dh n e w)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"(maxTermPrefix w) \\<in> (prefix_closure (cfgLM.marked_language M))\")\n    apply(rename_tac dh n e w)(*strict*)\n    apply(simp add: prefix_closure_def prefix_def)\n    apply(force)\n   apply(rename_tac dh n e w)(*strict*)\n   apply(subgoal_tac \"(maxTermPrefix w) \\<in> cfgLM.unmarked_language M\")\n    apply(rename_tac dh n e w)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w)(*strict*)\n   apply(simp add: cfgLM.unmarked_language_def)\n   apply(rule_tac\n      x=\"dh\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac dh n e w)(*strict*)\n    prefer 2\n    apply(simp add: cfgLM.derivation_initial_def)\n   apply(rename_tac dh n e w)(*strict*)\n   apply(simp add: cfg_unmarked_effect_def)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>cfg_conf=w\\<rparr>\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac dh n e w)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w)(*strict*)\n   apply(rule maxTermPrefix_prefix)\n  apply(rename_tac dh n e w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v)(*strict*)\n  apply(thin_tac \" cfgLM.unmarked_language M \\<subseteq> (prefix_closure (cfgLM.marked_language M))\")\n  apply(simp add: cfgLM.marked_language_def)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d)(*strict*)\n  apply(simp add: cfg_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i)(*strict*)\n  apply(simp add: cfgLM.derivation_initial_def)\n  apply(clarsimp)\n  apply(case_tac \"d 0\")\n   apply(rename_tac dh n e w v d ea c i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"dh 0\")\n   apply(rename_tac dh n e w v d ea c i a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i a aa)(*strict*)\n  apply(clarsimp)\n  apply(case_tac aa)\n  apply(rename_tac dh n e w v d ea c i a aa option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i a b)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac dh n e w v d ea c i a b option ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i b ba)(*strict*)\n  apply(simp add: cfg_initial_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea c i)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac dh n e w v d ea c i cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"n\\<le>i\")\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(case_tac \"n>i\")\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"dh i = d i\")\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. dh i = Some (pair e1 c1) \\<and> dh (Suc i) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation M c1 e2 c2\")\n      apply(rename_tac dh n e w v d ea i)(*strict*)\n      prefer 2\n      apply(rule_tac\n      m=\"n\"\n      in cfgLM.step_detail_before_some_position)\n        apply(rename_tac dh n e w v d ea i)(*strict*)\n        apply(simp add: cfgLM.derivation_initial_def)\n       apply(rename_tac dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac dh n e w v d ea i e2 c2)(*strict*)\n     apply(simp add: cfgLM_step_relation_def)\n     apply(clarsimp)\n     apply(rename_tac dh n e w v d ea i e2 c2 l r)(*strict*)\n     apply(simp only: setAConcat concat_asso setBConcat)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(rule sym)\n    apply(rule_tac\n      n=\"i\"\n      and m=\"n\"\n      and ?d1.0=\"d\"\n      and ?d2.0=\"dh\"\n      and x=\"0\"\n      and y=\"0\"\n      in cfgLM.is_forward_deterministic_derivations_coincide)\n             apply(rename_tac dh n e w v d ea i)(*strict*)\n             apply(force)\n            apply(rename_tac dh n e w v d ea i)(*strict*)\n            apply(force)\n           apply(rename_tac dh n e w v d ea i)(*strict*)\n           apply(force)\n          apply(rename_tac dh n e w v d ea i)(*strict*)\n          apply(force)\n         apply(rename_tac dh n e w v d ea i)(*strict*)\n         apply(force)\n        apply(rename_tac dh n e w v d ea i)(*strict*)\n        apply(force)\n       apply(rename_tac dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(rule_tac\n      x=\"derivation_drop (derivation_take d i) n\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(rule_tac\n      m=\"i-n\"\n      in cfgLM.derivation_drop_preserves_derivation_prime)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(rule cfgLM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d n = Some (pair e c)\")\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"i\"\n      in cfgLM.pre_some_position_is_some_position)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(blast)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(blast)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(rule_tac cfgLM.derivation_drop_preserves_belongs)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(rule cfgLM.derivation_take_preserves_derivation)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(rule_tac cfgLM.derivation_take_preserves_belongs)\n    apply(rule cfgLM.derivation_initial_belongs)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(simp add: cfgLM.derivation_initial_def)\n    apply(simp add: cfg_initial_configurations_def)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(simp add: derivation_take_def)\n   apply(force)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(rule_tac\n      x=\"i-n\"\n      in exI)\n   apply(simp add: maximum_of_domain_def derivation_drop_def derivation_take_def)\n   apply(clarsimp)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"dh n = d n\")\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(rule sym)\n   apply(rule_tac\n      n=\"n\"\n      and m=\"n\"\n      and ?d1.0=\"d\"\n      and ?d2.0=\"dh\"\n      and x=\"0\"\n      and y=\"0\"\n      in cfgLM.is_forward_deterministic_derivations_coincide)\n            apply(rename_tac dh n e w v d ea i)(*strict*)\n            apply(force)\n           apply(rename_tac dh n e w v d ea i)(*strict*)\n           apply(force)\n          apply(rename_tac dh n e w v d ea i)(*strict*)\n          apply(force)\n         apply(rename_tac dh n e w v d ea i)(*strict*)\n         apply(force)\n        apply(rename_tac dh n e w v d ea i)(*strict*)\n        apply(force)\n       apply(rename_tac dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac dh n e w v d ea i)(*strict*)\n   apply(simp add: derivation_append_fit_def derivation_drop_def derivation_take_def)\n  apply(rename_tac dh n e w v d ea i)(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n  apply(simp add: cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"i=ia\")\n   apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n   prefer 2\n   apply(case_tac \"i=ia\")\n    apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n   apply(case_tac \"i<ia\")\n    apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> d (Suc i) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation M c1 e2 c2\")\n     apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"ia\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n       apply(simp add: cfgLM.derivation_initial_def)\n      apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n      apply(force)\n     apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac dh n e w v d ea i ia eb c e2 c2)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac dh n e w v d ea i ia eb c e2 c2 l r)(*strict*)\n    apply(simp only: setAConcat concat_asso setBConcat)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d ia = Some (pair e1 c1) \\<and> d (Suc ia) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation M c1 e2 c2\")\n    apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"i\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n      apply(simp add: cfgLM.derivation_initial_def)\n     apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n     apply(force)\n    apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n    apply(force)\n   apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac dh n e w v d ea i ia eb c e2 c2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac dh n e w v d ea i ia eb c e2 c2 l r)(*strict*)\n   apply(simp only: setAConcat concat_asso setBConcat)\n   apply(force)\n  apply(rename_tac dh n e w v d ea i ia eb c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dh n e w v d ea ia)(*strict*)\n  apply(rule_tac\n      x=\"ia\"\n      in exI)\n  apply(simp add: derivation_append_def derivation_drop_def derivation_take_def)\n  apply(clarsimp)\n  done\n\nlemma cfgLM_inst_BF_Bra_DetR_LaOp_axioms: \"\n  BF_Bra_DetR_LaOp_axioms valid_cfg cfg_configurations\n     cfg_initial_configurations cfg_step_labels cfgLM_step_relation\n     cfg_marking_condition cfg_marked_effect cfg_unmarked_effect\"\n  apply(simp add: BF_Bra_DetR_LaOp_axioms_def)\n  apply(clarsimp)\n  apply(rename_tac M)(*strict*)\n  apply(simp add: nonblockingness_language_def)\n  apply(simp add: cfgLM.Nonblockingness_branching_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n)(*strict*)\n  apply(case_tac \"dh n\")\n   apply(rename_tac M dh n)(*strict*)\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac M dh n a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac M dh n a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n option b)(*strict*)\n  apply(case_tac b)\n  apply(rename_tac M dh n option b cfg_conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n option cfg_conf)(*strict*)\n  apply(rename_tac e w)\n  apply(rename_tac M dh n e w)(*strict*)\n  apply(subgoal_tac \"\\<exists>v. (maxTermPrefix w)@v \\<in> cfgLM.marked_language M\")\n   apply(rename_tac M dh n e w)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"(maxTermPrefix w) \\<in> (prefix_closure (cfgLM.marked_language M))\")\n    apply(rename_tac M dh n e w)(*strict*)\n    apply(simp add: prefix_closure_def prefix_def)\n    apply(force)\n   apply(rename_tac M dh n e w)(*strict*)\n   apply(subgoal_tac \"(maxTermPrefix w) \\<in> cfgLM.unmarked_language M\")\n    apply(rename_tac M dh n e w)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w)(*strict*)\n   apply(simp add: cfgLM.unmarked_language_def)\n   apply(rule_tac\n      x=\"dh\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac M dh n e w)(*strict*)\n    prefer 2\n    apply(simp add: cfgLM.derivation_initial_def)\n   apply(rename_tac M dh n e w)(*strict*)\n   apply(simp add: cfg_unmarked_effect_def)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>cfg_conf=w\\<rparr>\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac M dh n e w)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w)(*strict*)\n   apply(rule maxTermPrefix_prefix)\n  apply(rename_tac M dh n e w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v)(*strict*)\n  apply(thin_tac \" cfgLM.unmarked_language M \\<subseteq> (prefix_closure (cfgLM.marked_language M))\")\n  apply(simp add: cfgLM.marked_language_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d)(*strict*)\n  apply(simp add: cfg_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i)(*strict*)\n  apply(subgoal_tac \"case dh 0 of None \\<Rightarrow> False | Some (pair a b) \\<Rightarrow> b \\<in> cfg_initial_configurations M \\<and> a = None\")\n   apply(rename_tac M dh n e w v d ea c i)(*strict*)\n   prefer 2\n   apply(simp add: cfgLM.derivation_initial_def)\n  apply(rename_tac M dh n e w v d ea c i)(*strict*)\n  apply(subgoal_tac \"case_option False (case_derivation_configuration (\\<lambda>a b. b \\<in> cfg_initial_configurations M \\<and> a = None)) (d 0)\")\n   apply(rename_tac M dh n e w v d ea c i)(*strict*)\n   prefer 2\n   apply(simp add: cfgLM.derivation_initial_def)\n  apply(rename_tac M dh n e w v d ea c i)(*strict*)\n  apply(case_tac \"d 0\")\n   apply(rename_tac M dh n e w v d ea c i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"dh 0\")\n   apply(rename_tac M dh n e w v d ea c i a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i a aa)(*strict*)\n  apply(clarsimp)\n  apply(case_tac aa)\n  apply(rename_tac M dh n e w v d ea c i a aa option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i a b)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac M dh n e w v d ea c i a b option ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i b ba)(*strict*)\n  apply(simp add: cfg_initial_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea c i)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac M dh n e w v d ea c i cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"n\\<le>i\")\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(case_tac \"n>i\")\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"dh i = d i\")\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. dh i = Some (pair e1 c1) \\<and> dh (Suc i) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation M c1 e2 c2\")\n      apply(rename_tac M dh n e w v d ea i)(*strict*)\n      prefer 2\n      apply(rule_tac\n      m=\"n\"\n      in cfgLM.step_detail_before_some_position)\n        apply(rename_tac M dh n e w v d ea i)(*strict*)\n        apply(simp add: cfgLM.derivation_initial_def)\n       apply(rename_tac M dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac M dh n e w v d ea i e2 c2)(*strict*)\n     apply(simp add: cfgLM_step_relation_def)\n     apply(clarsimp)\n     apply(rename_tac M dh n e w v d ea i e2 c2 l r)(*strict*)\n     apply(simp only: setAConcat concat_asso setBConcat)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(rule sym)\n    apply(rule_tac\n      n=\"i\"\n      and m=\"n\"\n      and ?d1.0=\"d\"\n      and ?d2.0=\"dh\"\n      and x=\"0\"\n      and y=\"0\"\n      in cfgLM.is_forward_deterministic_accessible_derivations_coincide)\n             apply(rename_tac M dh n e w v d ea i)(*strict*)\n             apply(force)\n            apply(rename_tac M dh n e w v d ea i)(*strict*)\n            apply(force)\n           apply(rename_tac M dh n e w v d ea i)(*strict*)\n           apply(force)\n          apply(rename_tac M dh n e w v d ea i)(*strict*)\n          apply(force)\n         apply(rename_tac M dh n e w v d ea i)(*strict*)\n         apply(force)\n        apply(rename_tac M dh n e w v d ea i)(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(rule_tac\n      x=\"derivation_drop (derivation_take d i) n\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(rule_tac\n      m=\"i-n\"\n      in cfgLM.derivation_drop_preserves_derivation_prime)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(rule cfgLM.derivation_take_preserves_derivation)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d n = Some (pair e c)\")\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"i\"\n      in cfgLM.pre_some_position_is_some_position)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(blast)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(blast)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(rule_tac cfgLM.derivation_drop_preserves_belongs)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(rule cfgLM.derivation_take_preserves_derivation)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(rule_tac cfgLM.derivation_take_preserves_belongs)\n    apply(rule cfgLM.derivation_initial_belongs)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(simp add: cfgLM.derivation_initial_def)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(simp add: cfg_initial_configurations_def)\n   apply(simp add: derivation_take_def)\n   apply(force)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(rule_tac\n      x=\"i-n\"\n      in exI)\n   apply(simp add: maximum_of_domain_def derivation_drop_def derivation_take_def)\n   apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(subgoal_tac \"dh n = d n\")\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   prefer 2\n   apply(rule sym)\n   apply(rule_tac\n      n=\"n\"\n      and m=\"n\"\n      and ?d1.0=\"d\"\n      and ?d2.0=\"dh\"\n      and x=\"0\"\n      and y=\"0\"\n      in cfgLM.is_forward_deterministic_accessible_derivations_coincide)\n            apply(rename_tac M dh n e w v d ea i)(*strict*)\n            apply(force)\n           apply(rename_tac M dh n e w v d ea i)(*strict*)\n           apply(force)\n          apply(rename_tac M dh n e w v d ea i)(*strict*)\n          apply(force)\n         apply(rename_tac M dh n e w v d ea i)(*strict*)\n         apply(force)\n        apply(rename_tac M dh n e w v d ea i)(*strict*)\n        apply(force)\n       apply(rename_tac M dh n e w v d ea i)(*strict*)\n       apply(force)\n      apply(rename_tac M dh n e w v d ea i)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e w v d ea i)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(force)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac M dh n e w v d ea i)(*strict*)\n   apply(simp add: derivation_append_fit_def derivation_drop_def derivation_take_def)\n  apply(rename_tac M dh n e w v d ea i)(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n  apply(simp add: cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"i=ia\")\n   apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n   prefer 2\n   apply(case_tac \"i=ia\")\n    apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n   apply(case_tac \"i<ia\")\n    apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> d (Suc i) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation M c1 e2 c2\")\n     apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"ia\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n       apply(simp add: cfgLM.derivation_initial_def)\n      apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n      apply(force)\n     apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac M dh n e w v d ea i ia eb c e2 c2)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac M dh n e w v d ea i ia eb c e2 c2 l r)(*strict*)\n    apply(simp only: setAConcat concat_asso setBConcat)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d ia = Some (pair e1 c1) \\<and> d (Suc ia) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation M c1 e2 c2\")\n    apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"i\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n      apply(simp add: cfgLM.derivation_initial_def)\n     apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n     apply(force)\n    apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n    apply(force)\n   apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac M dh n e w v d ea i ia eb c e2 c2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac M dh n e w v d ea i ia eb c e2 c2 l r)(*strict*)\n   apply(simp only: setAConcat concat_asso setBConcat)\n   apply(force)\n  apply(rename_tac M dh n e w v d ea i ia eb c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac M dh n e w v d ea ia)(*strict*)\n  apply(rule_tac\n      x=\"ia\"\n      in exI)\n  apply(simp add: derivation_append_def derivation_drop_def derivation_take_def)\n  apply(clarsimp)\n  done\n\ninterpretation \"cfgLM\" : loc_cfg_3\n  (* TSstructure *)\n  \"valid_cfg\"\n  (* configurations *)\n  \"cfg_configurations\"\n  (* initial_configurations *)\n  \"cfg_initial_configurations\"\n  (* step_labels *)\n  \"cfg_step_labels\"\n  (* step_relation *)\n  \"cfgLM_step_relation\"\n  (* effects *)\n  \"cfg_effects\"\n  (* marking_condition *)\n  \"cfg_marking_condition\"\n  (* marked_effect *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect *)\n  \"cfg_unmarked_effect\"\n  (* destinations *)\n  \"cfg_destination\"\n  (* get_destinations *)\n  \"cfg_get_destinations\"\n  (* decreasing *)\n  \"False\"\n  (* string_state *)\n  \"cfg_get_history\"\n  apply(simp add: LOCALE_DEFS_ALL LOCALE_DEFS_cfg)\n  apply(simp add: cfgBASE_inst_AX_initial_configuration_belongs cfgLM_inst_AX_step_relation_preserves_belongs cfgLM_inst_ATS_String_State_Modification_axioms cfgLM_inst_ATS_axioms cfgLM_inst_ATS_Language_by_Finite_Derivations_axioms cfgLM_inst_BF_Bra_OpLa_axioms cfgLM_inst_BF_Bra_DetR_LaOp_axioms )\n  done\n\nlemma CFGLM0_is_forward_target_deterministic: \"\n  valid_cfg M\n  \\<Longrightarrow> cfgLM.is_forward_target_deterministic M\"\n  apply(simp add: cfgLM.is_forward_target_deterministic_def)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac c c1 c2 e l r la ra)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac c c1 c2 e l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c1 c2 e l r la ra)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac c1 c2 e l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c2 e l r la ra)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac c2 e l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac e l r la ra)(*strict*)\n  apply(subgoal_tac \"l=la\")\n   apply(rename_tac e l r la ra)(*strict*)\n   apply(force)\n  apply(rename_tac e l r la ra)(*strict*)\n  apply(case_tac e)\n  apply(rename_tac e l r la ra prod_lhsa prod_rhs)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac l r la ra prod_lhs prod_rhs)(*strict*)\n  apply(rename_tac w v)\n  apply(rename_tac l r la ra w v)(*strict*)\n  apply(thin_tac \"valid_cfg M\")\n  apply(thin_tac \"\\<lparr>prod_lhs = w, prod_rhs = v\\<rparr> \\<in> cfg_productions M\")\n  apply(rule sym)\n  apply(rule terminalHeadEquals1)\n    apply(rename_tac l r la ra w v)(*strict*)\n    apply(force)\n   apply(rename_tac l r la ra w v)(*strict*)\n   apply(force)\n  apply(rename_tac l r la ra w v)(*strict*)\n  apply(force)\n  done\n\nlemma CFGLM_Nonblockingness_is_lang_notempty: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.Nonblockingness_branching G\n  \\<Longrightarrow> cfgLM.marked_language G \\<noteq> {}\"\n  apply(simp add: cfgLM.marked_language_def cfgLM.Nonblockingness_branching_def)\n  apply(erule_tac\n      x=\"der1 \\<lparr>cfg_conf = [teA (cfg_initial G)]\\<rparr>\"\n      in allE)\n  apply(erule impE)\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(rule conjI)\n    apply(simp add: cfgLM.der1_is_derivation)\n   apply(simp add: der1_def)\n   apply(simp add: cfg_initial_configurations_def)\n   apply(simp add: cfg_configurations_def)\n   apply(rule cfg_initial_in_nonterms)\n   apply(force)\n  apply(erule_tac\n      x=\"0\"\n      in allE)\n  apply(erule impE)\n   apply(rule der1_maximum_of_domain)\n  apply(clarsimp)\n  apply(rename_tac dc n')(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac dc n' i e c)(*strict*)\n  apply(simp add: cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(simp add: cfg_marked_effect_def)\n  apply(case_tac c)\n  apply(rename_tac dc n' i e c cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac dc n' i e cfg_confa)(*strict*)\n  apply(rename_tac x)\n  apply(rename_tac dc n' i e x)(*strict*)\n  apply(rule_tac\n      x=\"filterB x\"\n      in exI)\n  apply(rule_tac\n      x=\"derivation_append (der1 \\<lparr>cfg_conf = [teA (cfg_initial G)]\\<rparr>) dc 0\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac dc n' i e x)(*strict*)\n   apply(rule cfgLM.derivation_append_preserves_derivation)\n     apply(rename_tac dc n' i e x)(*strict*)\n     apply(rule cfgLM.der1_is_derivation)\n    apply(rename_tac dc n' i e x)(*strict*)\n    apply(force)\n   apply(rename_tac dc n' i e x)(*strict*)\n   apply(simp add: der1_def)\n   apply(case_tac \"dc 0\")\n    apply(rename_tac dc n' i e x)(*strict*)\n    apply(clarsimp)\n    apply(simp add: cfgLM.derivation_def)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n   apply(rename_tac dc n' i e x a)(*strict*)\n   apply(case_tac \"dc 0\")\n    apply(rename_tac dc n' i e x a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac dc n' i e x a aa)(*strict*)\n   apply(simp add: cfgLM.derivation_def)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac dc n' i e x a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac dc n' i e x a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac dc n' i e x option b)(*strict*)\n   apply(case_tac option)\n    apply(rename_tac dc n' i e x option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac dc n' i e x b)(*strict*)\n    apply(simp add: derivation_append_fit_def)\n   apply(rename_tac dc n' i e x option b a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac dc n' i e x)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac dc n' i e x)(*strict*)\n   apply(simp add: derivation_append_def)\n   apply(case_tac i)\n    apply(rename_tac dc n' i e x)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac dc n' e x)(*strict*)\n    apply(rule_tac\n      x=\"e\"\n      in exI)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"\\<lparr>cfg_conf=x\\<rparr>\"\n      in exI)\n    apply(clarsimp)\n    apply(rule conjI)\n     apply(rename_tac dc n' e x)(*strict*)\n     apply(rule_tac\n      x=\"0\"\n      in exI)\n     apply(clarsimp)\n    apply(rename_tac dc n' e x)(*strict*)\n    apply(rule liftBDeConv2)\n    apply(force)\n   apply(rename_tac dc n' i e x nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac dc n' e x nat)(*strict*)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>cfg_conf=x\\<rparr>\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac dc n' e x nat)(*strict*)\n    apply(rule_tac\n      x=\"Suc nat\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac dc n' e x nat)(*strict*)\n   apply(rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac dc n' i e x)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac dc n' i e x)(*strict*)\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac dc n' i e x)(*strict*)\n    apply(rule cfgLM.derivation_append_preserves_derivation)\n      apply(rename_tac dc n' i e x)(*strict*)\n      apply(rule cfgLM.der1_is_derivation)\n     apply(rename_tac dc n' i e x)(*strict*)\n     apply(force)\n    apply(rename_tac dc n' i e x)(*strict*)\n    apply(simp add: der1_def)\n    apply(case_tac \"dc 0\")\n     apply(rename_tac dc n' i e x)(*strict*)\n     apply(clarsimp)\n     apply(simp add: cfgLM.derivation_def)\n     apply(erule_tac\n      x=\"0\"\n      in allE)\n     apply(clarsimp)\n    apply(rename_tac dc n' i e x a)(*strict*)\n    apply(case_tac \"dc 0\")\n     apply(rename_tac dc n' i e x a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac dc n' i e x a aa)(*strict*)\n    apply(simp add: cfgLM.derivation_def)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n    apply(rename_tac dc n' i e x a)(*strict*)\n    apply(case_tac a)\n    apply(rename_tac dc n' i e x a option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac dc n' i e x option b)(*strict*)\n    apply(case_tac option)\n     apply(rename_tac dc n' i e x option b)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac dc n' i e x b)(*strict*)\n     apply(simp add: derivation_append_fit_def)\n    apply(rename_tac dc n' i e x option b a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac dc n' i e x)(*strict*)\n   apply(simp add: derivation_append_def der1_def)\n   apply(simp add: cfg_initial_configurations_def)\n   apply(simp add: cfg_configurations_def)\n   apply(rule cfg_initial_in_nonterms)\n   apply(force)\n  apply(rename_tac dc n' i e x)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(clarsimp)\n  done\n\nlemma cfgLM_no_step_without_nonterms: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> setA (cfg_conf c) = {}\n  \\<Longrightarrow> d (Suc n) = None\"\n  apply(case_tac \"d (Suc n)\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac option b)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> d (Suc n) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   apply(rename_tac option b)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc n\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac option b)(*strict*)\n     apply(force)\n    apply(rename_tac option b)(*strict*)\n    apply(force)\n   apply(rename_tac option b)(*strict*)\n   apply(force)\n  apply(rename_tac option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b e2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac b e2 l r)(*strict*)\n  apply(simp only: setAConcat concat_asso)\n  apply(force)\n  done\n\ninterpretation \"cfgLM_cfgLM_ATS_Bisimulation_Configuration_Weak\" : ATS_Bisimulation_Configuration_Weak\n  (* TSstructure1 *)\n  \"valid_cfg\"\n  (* configurations1 *)\n  \"cfg_configurations\"\n  (* initial_configurations1 *)\n  \"cfg_initial_configurations\"\n  (* step_labels1 *)\n  \"cfg_step_labels\"\n  (* step_relation1 *)\n  \"cfgLM_step_relation\"\n  (* effects1 *)\n  \"cfg_effects\"\n  (* marking_condition1 *)\n  \"cfg_marking_condition\"\n  (* marked_effect1 *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect1 *)\n  \"cfg_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_cfg\"\n  (* configurations2 *)\n  \"cfg_configurations\"\n  (* initial_configurations2 *)\n  \"cfg_initial_configurations\"\n  (* step_labels2 *)\n  \"cfg_step_labels\"\n  (* step_relation2 *)\n  \"cfgLM_step_relation\"\n  (* effects2 *)\n  \"cfg_effects\"\n  (* marking_condition2 *)\n  \"cfg_marking_condition\"\n  (* marked_effect2 *)\n  \"cfg_marked_effect\"\n  (* unmarked_effect2 *)\n  \"cfg_unmarked_effect\"\n  apply(simp add: LOCALE_DEFS_ALL LOCALE_DEFS_cfg ATS_Bisimulation_Configuration_Weak_def)\n  apply(simp add: cfgBASE_inst_AX_initial_configuration_belongs cfgLM_inst_AX_step_relation_preserves_belongs cfgLM_inst_ATS_String_State_Modification_axioms cfgLM_inst_ATS_axioms )\n  done\n\nlemma cfgLM_inst_accept: \"\n  (\\<forall>G d. cfgLM.derivation_initial G d \\<longrightarrow> cfg_marking_condition G d = (\\<exists>i e c. d i = Some (pair e c) \\<and> c \\<in> cfg_marking_configuration G))\"\n  apply(clarsimp)\n  apply(rename_tac G d)(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  done\n\ndefinition cfgLM_accessible_productions :: \"\n  ('nonterminal, 'event)cfg\n  \\<Rightarrow> ('nonterminal, 'event)cfg_step_label set\"\n  where\n    \"cfgLM_accessible_productions G \\<equiv>\n  {p \\<in> cfg_productions G.\n    dest_production p \\<in> cfgLM.get_accessible_destinations G}\"\n\ndefinition cfgLM_required_productions :: \"\n  ('nonterminal, 'event)cfg\n  \\<Rightarrow> ('nonterminal, 'event)cfg_step_label set\"\n  where\n    \"cfgLM_required_productions G \\<equiv>\n  {p \\<in> cfg_productions G.\n    \\<exists>d n c.\n      cfgLM.derivation_initial G d\n      \\<and> d n = Some (pair (Some p) c)\n      \\<and> cfg_marking_condition G d}\"\n\nlemma only_extension_by_one: \"\n  valid_cfg G\n  \\<Longrightarrow> (\\<forall>p\\<in> cfg_productions G. \\<exists>w v. prod_rhs p=liftB w@liftA v \\<and> length w\\<le>Suc 0)\n  \\<Longrightarrow> c1 \\<in> cfg_configurations G\n  \\<Longrightarrow> cfg_conf c1=liftB w@liftA v\n  \\<Longrightarrow> cfgLM_step_relation G c1 p c2\n  \\<Longrightarrow> length(maxTermPrefix (cfg_conf c2))\\<le>Suc(length(maxTermPrefix (cfg_conf c1)))\"\n  apply(simp add: cfgLM_step_relation_def)\n  apply(erule_tac\n      x=\"p\"\n      in ballE)\n   prefer 2\n   apply(force)\n  apply(case_tac c1)\n  apply(rename_tac cfg_confa)(*strict*)\n  apply(case_tac p)\n  apply(rename_tac cfg_confa prod_lhsa prod_rhsa)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac cfg_confa prod_lhsa prod_rhsa cfg_confaa)(*strict*)\n  apply(rename_tac w1 A r w2)\n  apply(rename_tac w1 A r w2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A wa l ra va)(*strict*)\n  apply(subgoal_tac \"\\<exists>w. liftB w = l\")\n   apply(rename_tac A wa l ra va)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n   apply(rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac A wa l ra va)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A wa ra va waa)(*strict*)\n  apply(subgoal_tac \"w=waa\")\n   apply(rename_tac A wa ra va waa)(*strict*)\n   prefer 2\n   apply(rule equal_left_liftB)\n   apply(force)\n  apply(rename_tac A wa ra va waa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A wa ra va)(*strict*)\n  apply(case_tac v)\n   apply(rename_tac A wa ra va)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac A wa ra va a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A wa v list)(*strict*)\n  apply(subgoal_tac \"maxTermPrefix (liftB w @ teA A # liftA list) = w\")\n   apply(rename_tac A wa v list)(*strict*)\n   prefer 2\n   apply (metis maxTermPrefix_mixed_string)\n  apply(rename_tac A wa v list)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"maxTermPrefix (liftB w @ liftB wa @ liftA v @ liftA list) = w@wa\")\n   apply(rename_tac A wa v list)(*strict*)\n   prefer 2\n   apply (metis (erased, hide_lams) liftA.simps(1) liftA.simps(2) append_Cons append_Nil maxTermPrefix_mixed_string maxTermPrefix_shift maxTermPrefix_term_string neq_Nil_conv)\n  apply(rename_tac A wa v list)(*strict*)\n  apply(case_tac wa)\n   apply(rename_tac A wa v list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac A wa v list a lista)(*strict*)\n  apply(force)\n  done\n\ndefinition cfgLM_accessible_nonterminals :: \"\n  ('nonterminal,'event) cfg\n  \\<Rightarrow> 'nonterminal set\"\n  where\n    \"cfgLM_accessible_nonterminals G \\<equiv>\n  {A \\<in> cfg_nonterminals G.\n    \\<exists>d n c.\n      cfgLM.derivation_initial G d\n      \\<and> get_configuration (d n) = Some c\n      \\<and> (\\<exists>w1 w2. cfg_conf c = liftB w1 @ teA A # w2)}\"\n\ndefinition cfgLM_Nonblockingness_nonterminals :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> 'nonterminal set\"\n  where\n    \"cfgLM_Nonblockingness_nonterminals G \\<equiv>\n  {A \\<in> cfg_nonterminals G.\n    \\<exists>d n e w'.\n      cfgLM.derivation G d\n      \\<and> d 0 = Some (pair None \\<lparr>cfg_conf = [teA A]\\<rparr>)\n      \\<and> d n = Some (pair e \\<lparr>cfg_conf = w'\\<rparr>)\n      \\<and> setA w' = {}}\"\n\nlemma cfgLM_Nonblockingness_branching_implies_cfgLM_accessible_nonterminals_contained_in_cfgLM_Nonblockingness_nonterminals: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.Nonblockingness_branching G\n  \\<Longrightarrow> cfgLM_accessible_nonterminals G \\<subseteq> cfgLM_Nonblockingness_nonterminals G\"\n  apply(simp add: cfgLM_accessible_nonterminals_def)\n  apply(clarsimp)\n  apply(rename_tac x d n c w1 w2)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac x d n c w1 w2 cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d n w1 w2)(*strict*)\n  apply(thin_tac \"x \\<in> cfg_nonterminals G\")\n  apply(case_tac \"d n\")\n   apply(rename_tac x d n w1 w2)(*strict*)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac x d n w1 w2 a)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(case_tac a)\n  apply(rename_tac x d n w1 w2 a option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d n w1 w2 option)(*strict*)\n  apply(rename_tac e)\n  apply(rename_tac x d n w1 w2 e)(*strict*)\n  apply(subgoal_tac \"\\<exists>d. cfgLM.derivation_initial G d \\<and> maximum_of_domain d n \\<and> d n = Some (pair e \\<lparr>cfg_conf = liftB w1 @ teA x # w2\\<rparr>)\")\n   apply(rename_tac x d n w1 w2 e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"derivation_take d n\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac x d n w1 w2 e)(*strict*)\n    apply (metis cfgLM.derivation_take_preserves_derivation_initial)\n   apply(rename_tac x d n w1 w2 e)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac x d n w1 w2 e)(*strict*)\n    apply (metis maximum_of_domain_derivation_take not_None_eq)\n   apply(rename_tac x d n w1 w2 e)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac x d n w1 w2 e)(*strict*)\n  apply(thin_tac \"cfgLM.derivation_initial G d\")\n  apply(thin_tac \"d n = Some (pair e \\<lparr>cfg_conf = liftB w1 @ teA x # w2\\<rparr>)\")\n  apply(clarsimp)\n  apply(rename_tac x n w1 w2 e d)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac x n w1 w2 e d)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      and ?w1.0=\"liftB w1\"\n      and ?w2.0=\"[teA x]\"\n      and ?w3.0=\"w2\"\n      in CFGLM_Nonblockingness_to_elimination)\n         apply(rename_tac x n w1 w2 e d)(*strict*)\n         apply(force)\n        apply(rename_tac x n w1 w2 e d)(*strict*)\n        apply(simp add: cfgLM.derivation_initial_def)\n       apply(rename_tac x n w1 w2 e d)(*strict*)\n       apply(rule cfgLM.derivation_initial_belongs)\n        apply(rename_tac x n w1 w2 e d)(*strict*)\n        apply(force)\n       apply(rename_tac x n w1 w2 e d)(*strict*)\n       apply(force)\n      apply(rename_tac x n w1 w2 e d)(*strict*)\n      apply(force)\n     apply(rename_tac x n w1 w2 e d)(*strict*)\n     apply(force)\n    apply(rename_tac x n w1 w2 e d)(*strict*)\n    apply(force)\n   apply(rename_tac x n w1 w2 e d)(*strict*)\n   apply(force)\n  apply(rename_tac x n w1 w2 e d)(*strict*)\n  apply(thin_tac \"cfgLM.Nonblockingness_branching G\")\n  apply(thin_tac \"maximum_of_domain d n\")\n  apply(thin_tac \"cfgLM.derivation_initial G d\")\n  apply(thin_tac \"d n = Some (pair e \\<lparr>cfg_conf = liftB w1 @ teA x # w2\\<rparr>)\")\n  apply(clarsimp)\n  apply(rename_tac x d' n' w e)(*strict*)\n  apply(simp add: cfgLM_Nonblockingness_nonterminals_def)\n  apply(rule conjI)\n   apply(rename_tac x d' n' w e)(*strict*)\n   apply(subgoal_tac \"\\<lparr>cfg_conf = [teA x]\\<rparr> \\<in> cfg_configurations G\")\n    apply(rename_tac x d' n' w e)(*strict*)\n    apply(simp add: cfg_configurations_def)\n   apply(rename_tac x d' n' w e)(*strict*)\n   apply (metis cfgLM.belongs_configurations)\n  apply(rename_tac x d' n' w e)(*strict*)\n  apply(rule_tac\n      x=\"d'\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"n'\"\n      in exI)\n  apply(clarsimp)\n  done\n\nlemma cfgLM_Nonblockingness_branching_implies_FB_iterated_elimination: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.Nonblockingness_branching G\n  \\<Longrightarrow> cfgLM.derivation_initial G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> cfg_conf c = w1 @ teA x # w2\n  \\<Longrightarrow> \\<exists>d. cfgLM.derivation_initial G d \\<and>\n  (\\<exists>n c. get_configuration (d n) = Some c \\<and>\n  (\\<exists>w1 w2. cfg_conf c = liftB w1 @ teA x # w2))\"\n  apply(induct \"length (filterA w1)\" arbitrary: w1 d n e c)\n   apply(rename_tac w1 d n e c)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac w1 d n e c)(*strict*)\n    apply(force)\n   apply(rename_tac w1 d n e c)(*strict*)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(subgoal_tac \"\\<exists>w. liftB w = w1\")\n    apply(rename_tac w1 d n e c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB w1\"\n      in exI)\n    apply(rule liftBDeConv2)\n    apply(rule filterA_setA)\n    apply(force)\n   apply(rename_tac w1 d n e c)(*strict*)\n   apply(force)\n  apply(rename_tac xa w1 d n e c)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac xa w1 d n e c cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa w1 d n e)(*strict*)\n  apply(subgoal_tac \"\\<exists>wx1 A wx2. w1 = liftB wx1 @[teA A]@ wx2\")\n   apply(rename_tac xa w1 d n e)(*strict*)\n   prefer 2\n   apply(rule filterA_gt_0_then_lm_nontelminal)\n   apply(force)\n  apply(rename_tac xa w1 d n e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n  apply(subgoal_tac \"A \\<in> cfgLM_Nonblockingness_nonterminals G\")\n   apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      A=\"cfgLM_accessible_nonterminals G\"\n      in set_mp)\n    apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n    apply(rule cfgLM_Nonblockingness_branching_implies_cfgLM_accessible_nonterminals_contained_in_cfgLM_Nonblockingness_nonterminals)\n     apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n     apply(force)\n    apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n    apply(force)\n   apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n   apply(simp add: cfgLM_accessible_nonterminals_def)\n   apply(subgoal_tac \"\\<lparr>cfg_conf = liftB wx1 @ teA A # wx2 @ teA x # w2\\<rparr> \\<in> cfg_configurations G\")\n    apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n    prefer 2\n    apply (rule cfgLM.belongs_configurations)\n     apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n     apply(rule cfgLM.derivation_initial_belongs)\n      apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n      apply(force)\n     apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n     apply(force)\n    apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n    apply(force)\n   apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n    apply(simp add: cfg_configurations_def)\n    apply(simp add: setAConcat)\n   apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(rule_tac\n      x=\"wx1\"\n      in exI)\n   apply(force)\n  apply(rename_tac xa d n e wx1 A wx2)(*strict*)\n  apply(simp add: cfgLM_Nonblockingness_nonterminals_def)\n  apply(clarsimp)\n  apply(rename_tac xa d n e wx1 A wx2 da na ea w')(*strict*)\n  apply(subgoal_tac \"\\<exists>w. liftB w = w'\")\n   apply(rename_tac xa d n e wx1 A wx2 da na ea w')(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB w'\"\n      in exI)\n   apply(rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac xa d n e wx1 A wx2 da na ea w')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa d n e wx1 A wx2 da na ea w)(*strict*)\n  apply(thin_tac \"setA (liftB w) = {}\")\n  apply(case_tac na)\n   apply(rename_tac xa d n e wx1 A wx2 da na ea w)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac xa d n e wx1 A wx2 da w)(*strict*)\n   apply(case_tac w)\n    apply(rename_tac xa d n e wx1 A wx2 da w)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac xa d n e wx1 A wx2 da w a list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac xa d n e wx1 A wx2 da na ea w nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa d n e wx1 A wx2 da ea w nat)(*strict*)\n  apply(rename_tac na)\n  apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n  apply(subgoal_tac \"\\<exists>d n e c. cfgLM.derivation_initial G d \\<and> d n = Some (pair e c) \\<and> cfg_conf c = liftB wx1 @ liftB w @ wx2 @ teA x # w2\")\n   apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"derivation_append d (derivation_map da (\\<lambda>c. \\<lparr>cfg_conf=liftB wx1@(cfg_conf c)@wx2 @ teA x # w2\\<rparr>)) n\"\n      in exI)\n   apply(rule_tac\n      x=\"n+Suc na\"\n      in exI)\n   apply(rule_tac\n      x=\"ea\"\n      in exI)\n   apply(rule_tac\n      x=\"\\<lparr>cfg_conf=liftB wx1@(liftB w)@wx2 @ teA x # w2\\<rparr>\"\n      in exI)\n   apply(clarsimp)\n   apply(rule context_conjI)\n    apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n    apply(rule cfgLM.derivation_append_preserves_derivation_initial)\n      apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n      apply(force)\n     apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n     apply(force)\n    apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n    apply(rule cfgLM.derivation_append_preserves_derivation)\n      apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n      apply(simp add: cfgLM.derivation_initial_def)\n     apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n     apply(rule cfgLM.derivation_map_preserves_derivation)\n       apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n       apply(force)\n      apply(rename_tac xa d n e wx1 A wx2 da ea w na i eb c)(*strict*)\n      apply(force)\n     apply(rename_tac xa d n e wx1 A wx2 da ea w na c1 eb c2)(*strict*)\n     apply(simp add: cfgLM_step_relation_def)\n     apply(clarsimp)\n     apply(rename_tac xa d n e wx1 A wx2 da ea w na c1 eb c2 l r)(*strict*)\n     apply(rule_tac\n      x=\"liftB wx1 @ l\"\n      in exI)\n     apply(clarsimp)\n     apply(simp add: setAConcat)\n     apply(rule setA_liftB)\n    apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n    apply(clarsimp)\n    apply(simp add: derivation_map_def)\n   apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n   apply(simp add: derivation_append_def derivation_map_def)\n  apply(rename_tac xa d n e wx1 A wx2 da ea w na)(*strict*)\n  apply(thin_tac \"da 0 = Some (pair None \\<lparr>cfg_conf = [teA A]\\<rparr>)\")\n  apply(thin_tac \"A \\<in> cfg_nonterminals G\")\n  apply(thin_tac \"cfgLM.derivation_initial G d\")\n  apply(thin_tac \"cfgLM.Nonblockingness_branching G\")\n  apply(thin_tac \"d n = Some (pair e \\<lparr>cfg_conf = liftB wx1 @ teA A # wx2 @ teA x # w2\\<rparr>)\")\n  apply(thin_tac \"cfgLM.derivation G da\")\n  apply(thin_tac \"da (Suc na) = Some (pair ea \\<lparr>cfg_conf = liftB w\\<rparr>)\")\n  apply(clarsimp)\n  apply(rename_tac xa wx1 A wx2 w d n e c)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac xa wx1 A wx2 w d n e c cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa wx1 A wx2 w d n e)(*strict*)\n  apply(simp add: filterA_commutes_over_concat filterA_liftB)\n  apply(rename_tac xa wx1 wx2 w d n e)(*strict*)\n  apply(erule_tac\n      x=\"liftB wx1 @ liftB w @ wx2\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac wx1 wx2 w d n e)(*strict*)\n  apply(erule_tac\n      x=\"d\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"n\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"e\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"\\<lparr>cfg_conf = liftB wx1 @ liftB w @ wx2 @ teA x # w2\\<rparr>\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(simp add: filterA_commutes_over_concat filterA_liftB)\n  done\n\nlemma cfgLM_no_nonterminal_at_end_in_marking_condition: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> cfg_marking_condition G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> cfg_conf c=w\n  \\<Longrightarrow> setA w={}\"\n  apply(simp add: cfg_marking_condition_def cfg_marking_configuration_def)\n  apply(clarsimp)\n  apply(rename_tac i ea ca)(*strict*)\n  apply(case_tac \"i=n\")\n   apply(rename_tac i ea ca)(*strict*)\n   apply(force)\n  apply(rename_tac i ea ca)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i ea ca)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      and n=\"i\"\n      and m=\"n\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i ea ca)(*strict*)\n     apply(force)\n    apply(rename_tac i ea ca)(*strict*)\n    apply(force)\n   apply(rename_tac i ea ca)(*strict*)\n   apply (metis (mono_tags) cfgLM.allPreMaxDomSome_prime le_antisym not_less_eq_eq option.distinct(1))\n  apply(rename_tac i ea ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i ea ca e2 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i ea ca e2 c2 l r)(*strict*)\n  apply(case_tac ca)\n  apply(rename_tac i ea ca e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i ea e2 c2 l r)(*strict*)\n  apply (metis elemInsetA empty_iff)\n  done\n\ndefinition cfgLM_accessible_nonterminals_ALT :: \"\n  ('nonterminal,'event) cfg\n  \\<Rightarrow> 'nonterminal set\"\n  where\n    \"cfgLM_accessible_nonterminals_ALT G \\<equiv>\n  {A. \\<exists>d n e w1 w2.\n      cfgLM.derivation_initial G d\n      \\<and> d n = Some (pair e \\<lparr>cfg_conf = liftB w1 @ teA A # w2 \\<rparr>)}\"\n\nlemma cfgLM_accessible_nonterminals_ALT_vs_cfgLM_accessible_nonterminals: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM_accessible_nonterminals_ALT G = cfgLM_accessible_nonterminals G\"\n  apply(simp add: cfgLM_accessible_nonterminals_ALT_def cfgLM_accessible_nonterminals_def)\n  apply(rule antisym)\n   apply(clarsimp)\n   apply(rename_tac x d n e w1 w2)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac x d n e w1 w2)(*strict*)\n    prefer 2\n    apply(rule cfgLM.belongs_configurations)\n     apply(rename_tac x d n e w1 w2)(*strict*)\n     apply(rule cfgLM.derivation_initial_belongs)\n      apply(rename_tac x d n e w1 w2)(*strict*)\n      apply(force)\n     apply(rename_tac x d n e w1 w2)(*strict*)\n     apply(force)\n    apply(rename_tac x d n e w1 w2)(*strict*)\n    apply(force)\n   apply(rename_tac x d n e w1 w2)(*strict*)\n   apply(simp add: cfg_configurations_def setAConcat)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(force)\n  apply(simp add: get_configuration_def)\n  apply(clarsimp)\n  apply(rename_tac x d n c w1 w2)(*strict*)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"n\"\n      in exI)\n  apply(case_tac \"d n\")\n   apply(rename_tac x d n c w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac x d n c w1 w2 a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac x d n c w1 w2 a option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d n c w1 w2 option)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac x d n c w1 w2 option cfg_confa)(*strict*)\n  apply(force)\n  done\n\ndefinition cfgLM_Nonblockingness_nonterminals_ALT :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> 'nonterminal set\"\n  where\n    \"cfgLM_Nonblockingness_nonterminals_ALT G \\<equiv>\n  {A \\<in> cfg_nonterminals G.\n    \\<exists>d n e w.\n      cfgLM.derivation G d\n      \\<and> d 0 = Some (pair None \\<lparr>cfg_conf = [teA A]\\<rparr>)\n      \\<and> d n = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>)}\"\n\nlemma cfgLM_Nonblockingness_nonterminals_ALT_vs_cfgLM_Nonblockingness_nonterminals: \"\n  cfgLM_Nonblockingness_nonterminals_ALT G = cfgLM_Nonblockingness_nonterminals G\"\n  apply(rule antisym)\n   apply(simp add: cfgLM_Nonblockingness_nonterminals_ALT_def cfgLM_Nonblockingness_nonterminals_def)\n   apply(clarsimp)\n   apply(rename_tac x d n e w)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n   apply(rule setA_liftB)\n  apply(simp add: cfgLM_Nonblockingness_nonterminals_ALT_def cfgLM_Nonblockingness_nonterminals_def)\n  apply(clarsimp)\n  apply(rename_tac x d n e w')(*strict*)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"n\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"filterB w'\"\n      in exI)\n  apply (metis liftBDeConv2)\n  done\n\nlemma CFGLM_derivationCanBeDecomposed2_with_labels: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w'\\<rparr>}\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> \\<exists>d1 d2 w1' w2' n1 n2. cfgLM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgLM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1' @ w2' = w' \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1 + n2 = n \\<and> set (get_labels d n) = set (get_labels d1 n1) \\<union>set (get_labels d2 n2)\"\n  apply(subgoal_tac \" \\<forall>n. \\<forall>d w1 w2 w'. cfgLM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w'\\<rparr>} \\<and> maximum_of_domain d n \\<longrightarrow> (\\<exists>d1 d2 w1' w2' n1 n2. cfgLM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgLM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1' @ w2' = w' \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=n \\<and> set(get_labels d n)=set(get_labels d1 n1)\\<union>set(get_labels d2 n2))\")\n   apply(blast)\n  apply(thin_tac \"cfgLM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w'\\<rparr>}\")\n  apply(thin_tac \"maximum_of_domain d n\")\n  apply(rule allI)\n  apply(rename_tac n)(*strict*)\n  apply(induct_tac n)\n   apply(rename_tac n)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2 w')(*strict*)\n   apply(case_tac \"w1@w2\\<noteq>w'\")\n    apply(rename_tac d w1 w2 w')(*strict*)\n    apply(subgoal_tac \"0\\<noteq>(0::nat)\")\n     apply(rename_tac d w1 w2 w')(*strict*)\n     apply(force)\n    apply(rename_tac d w1 w2 w')(*strict*)\n    apply(rule cfgLM.modifying_derivation_is_not_empty)\n      apply(rename_tac d w1 w2 w')(*strict*)\n      apply(blast)\n     apply(rename_tac d w1 w2 w')(*strict*)\n     apply(force)\n    apply(rename_tac d w1 w2 w')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d w1 w2 w')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2)(*strict*)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = w1\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = w2\\<rparr>\"\n      in exI)\n   apply(rule_tac\n      x=\"w1\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2)(*strict*)\n    apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n    apply(clarsimp)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 n xa)(*strict*)\n     apply(rule cfgLM.der1_is_derivation)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 n xa)(*strict*)\n     apply(simp add: der1_def)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 n xa)(*strict*)\n     apply(rule cfgLM.der1_is_derivation)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(simp add: der1_def)\n   apply(rename_tac d w1 w2)(*strict*)\n   apply(rule_tac\n      x=\"w2\"\n      in exI)\n   apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule cfgLM.der1_is_derivation)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule cfgLM.der1_is_derivation)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(simp add: der1_def)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule der1_maximum_of_domain)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule der1_maximum_of_domain)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(rule_tac\n      t=\"nat_seq (Suc 0) 0\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(rule nat_seqEmpty)\n    apply(force)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(clarsimp)\n\n  apply(rename_tac n na)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(subgoal_tac \"\\<exists>x \\<in> {pair None \\<lparr>cfg_conf = w1@w2\\<rparr>}. d 0 = Some x\")\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   prefer 2\n   apply(rule cfgLM.derivation_from_starts_from)\n   apply(rule cfgLM.from_to_is_from)\n   apply(blast)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc 0) = Some (pair (Some e) c)\")\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   prefer 2\n   apply(rule cfgLM.some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac na d w1 w2 w')(*strict*)\n     apply(rule cfgLM.from_to_is_der)\n     apply(blast)\n    apply(rename_tac na d w1 w2 w')(*strict*)\n    apply(blast)\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   apply(arith)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(subgoal_tac \"\\<exists>e. d (Suc na) = Some (pair e \\<lparr>cfg_conf=w'\\<rparr>)\")\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   prefer 2\n   apply(rule cfgLM.reachesToAtMaxDom)\n    apply(rename_tac na d w1 w2 w')(*strict*)\n    apply(rule cfgLM.from_to_is_to)\n    apply(blast)\n   apply(rename_tac na d w1 w2 w')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac na d w1 w2 w')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 w' e ea c)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac na d w1 w2 w' e ea c cfg_conf)(*strict*)\n  apply(rename_tac cv)\n  apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n  apply(erule_tac\n      x=\"derivation_drop d (Suc 0)\"\n      in allE)\n  apply(case_tac \"\\<exists>c'. cfgLM_step_relation G \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> c' @ w2 = cv\")\n   apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"\\<exists>c'. cfgLM_step_relation G \\<lparr>cfg_conf = w2\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> w1 @ c' = cv\")\n    apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n    prefer 2\n    apply(rule CFGLM_alt_case)\n     apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n     apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_def)\n     apply(clarsimp)\n     apply(rename_tac na d w1 w2 w' e ea cv)(*strict*)\n     apply(erule_tac\n      x=\"Suc 0\"\n      in allE)\n     apply(clarsimp)\n    apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n    apply(force)\n   apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n   apply(thin_tac \"\\<not> (\\<exists>c'. cfgLM_step_relation G \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> \\<and> c' @ w2 = cv)\")\n   apply(clarsimp)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(erule_tac\n      x=\"w1\"\n      in allE)\n   apply(erule_tac\n      x=\"c'\"\n      in allE)\n   apply(erule_tac\n      x=\"w'\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(rule conjI)\n     apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n     apply(rule_tac\n      m = \"na\"\n      in cfgLM.derivation_drop_preserves_derivation_from_to2)\n        apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n        apply(blast)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(rule_tac\n      s = \"Suc na\"\n      in ssubst)\n        apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n        apply(arith)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(blast)\n      apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n      apply(blast)\n     apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n     apply(clarsimp)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(rule derivation_drop_preserves_generates_maximum_of_domain)\n    apply(blast)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac\n      x=\"d1\"\n      in exI)\n   apply(rule_tac\n      x = \"derivation_append (der2 \\<lparr>cfg_conf = w2\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr>) d2 (Suc 0)\"\n      in exI)\n   apply(rule_tac\n      x=\"w1'\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac\n      x=\"w2'\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n    apply(clarsimp)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(rule cfgLM.derivation_append_preserves_derivation)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgLM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(force)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(simp add: der2_def)\n     apply(case_tac \"d2 0\")\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(simp add: derivation_append_def der2_def)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(rule cfgLM.derivation_append_preserves_derivation)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgLM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(force)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n     apply(simp add: der2_def)\n     apply(case_tac \"d2 0\")\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n    apply(rule_tac\n      x=\"Suc nb\"\n      in exI)\n    apply(simp add: derivation_append_def der2_def)\n    apply(clarsimp)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n1\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"Suc n2\"\n      and s=\"Suc 0+n2\"\n      in ssubst)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(rule_tac concat_has_max_dom)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n     apply(rule der2_maximum_of_domain)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d (Suc 0) = Some (pair (Some e) c)\")\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      t=\"get_labels d (Suc (n1 + n2))\"\n      and s=\"Some e#get_labels (derivation_drop d (Suc 0)) ((n1 + n2))\"\n      in ssubst)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n     prefer 2\n     apply(clarsimp)\n     apply(rule_tac\n      t=\"get_labels (derivation_append (der2 \\<lparr>cfg_conf = w2\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr>) d2 (Suc 0)) (Suc n2)\"\n      and s=\" Some e# get_labels d2 n2 \"\n      in ssubst)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n     apply(rule get_labels_der2_decompose)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(rule get_labels_derivation_drop_decompose)\n    apply(force)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(force)\n  apply(rename_tac na d w1 w2 w' e ea c cv)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n  apply(erule_tac\n      x=\"c'\"\n      in allE)\n  apply(erule_tac\n      x=\"w2\"\n      in allE)\n  apply(erule_tac\n      x=\"w'\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(rule_tac\n      m = \"na\"\n      in cfgLM.derivation_drop_preserves_derivation_from_to2)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(blast)\n      apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n      apply(rule_tac\n      s = \"Suc na\"\n      in ssubst)\n       apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n       apply(arith)\n      apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n      apply(blast)\n     apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n     apply(blast)\n    apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n   apply(rule derivation_drop_preserves_generates_maximum_of_domain)\n   apply(blast)\n  apply(rename_tac na d w1 w2 w' e ea c')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      x = \"derivation_append (der2 \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr> ) d1 (Suc 0)\"\n      in exI)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      x=\"d2\"\n      in exI)\n  apply(rule_tac\n      x=\"w1'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac\n      dJ = \"\\<lparr>cfg_conf=c'\\<rparr>\"\n      in cfgLM.concatIsFromTo)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n      apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n      apply(clarsimp)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgLM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(simp add: der2_def)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n       apply(rule cfgLM.der2_is_derivation)\n       apply(force)\n      apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2 n xa na nb xaa xab)(*strict*)\n      apply(rule_tac\n      x=\"Suc 0\"\n      in exI)\n      apply(simp add: der2_def)\n     apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n     apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(rule der2_maximum_of_domain)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(force)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      x=\"w2'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(force)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"Suc n1\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"Suc n1\"\n      and s=\"Suc 0+n1\"\n      in ssubst)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac concat_has_max_dom)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(rule der2_maximum_of_domain)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(force)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      t=\"get_labels d (Suc (n1 + n2))\"\n      and s=\"Some e#get_labels (derivation_drop d (Suc 0)) ((n1 + n2))\"\n      in ssubst)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule get_labels_derivation_drop_decompose)\n   apply(force)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(rule_tac\n      t=\"get_labels (derivation_append (der2 \\<lparr>cfg_conf = w1\\<rparr> e \\<lparr>cfg_conf = c'\\<rparr>) d1 (Suc 0)) (Suc 0+n1)\"\n      and s=\" Some e# get_labels d1 n1 \"\n      in ssubst)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule_tac\n      t=\"Suc 0+n1\"\n      and s=\"Suc n1\"\n      in ssubst)\n    apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n   apply(rule get_labels_der2_decompose)\n  apply(rename_tac d w1 w2 e ea c' d1 d2 w1' w2' n1 n2)(*strict*)\n  apply(force)\n  done\n\nlemma cfgLM_accessible_productions_vs_cfgLM_required_productions2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM_accessible_productions G \\<supseteq> cfgLM_required_productions G\"\n  apply(simp add: cfgLM_accessible_productions_def cfgLM_required_productions_def)\n  apply(clarsimp)\n  apply(rename_tac x d n c)(*strict*)\n  apply(simp add: cfgLM.get_accessible_destinations_def)\n  apply(simp add: cfg_get_destinations_def)\n  apply(simp add: cfg_destination_def)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"n\"\n      in exI)\n  apply(clarsimp)\n  done\n\nlemma earlist_occurence_of_nonterminal: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation_initial G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> cfg_conf (the (get_configuration (d n))) = w1 @ [teA x] @ w2\n  \\<Longrightarrow> \\<exists>m\\<le>n. \\<exists>w1. cfg_conf (the (get_configuration (d m))) = w1 @ [teA x] @ w2 \\<and> (\\<forall>k<m. \\<not>(\\<exists>w1. cfg_conf (the (get_configuration (d k))) = w1 @ [teA x] @ w2))\"\n  apply(subgoal_tac \"\\<exists>k\\<le>n. (\\<forall>i<k. \\<not>(\\<lambda>n. (case d n of None \\<Rightarrow> False| Some (pair e c) \\<Rightarrow> SSP c)) i) & ((\\<lambda>n. (case d n of None \\<Rightarrow> False| Some (pair e c) \\<Rightarrow> SSP c)))k\" for SSP)\n   prefer 2\n   apply(rule_tac\n      P=\"\\<lambda>c. \\<exists>w1. cfg_conf c = w1 @ [teA x] @ w2\"\n      in cfgLM.existence_of_earliest_satisfaction_point)\n     apply(rule cfgLM.derivation_initial_is_derivation)\n     apply(force)\n    apply(force)\n   apply(rule_tac\n      x=\"w1\"\n      in exI)\n   apply(simp add: get_configuration_def)\n  apply(clarsimp)\n  apply(rename_tac k)(*strict*)\n  apply(rule_tac\n      x=\"k\"\n      in exI)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac k)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(case_tac \"d k\")\n    apply(rename_tac k)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac k a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac k a option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac k)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ka w1a)(*strict*)\n  apply(case_tac \"k=ka\")\n   apply(rename_tac k ka w1a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac k ka w1a)(*strict*)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"ka\"\n      in allE)\n  apply(clarsimp)\n  apply(case_tac \"d k\")\n   apply(rename_tac k ka w1a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac k ka w1a a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac k ka w1a a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ka w1a option b w1aa)(*strict*)\n  apply(case_tac \"d ka\")\n   apply(rename_tac k ka w1a option b w1aa)(*strict*)\n   apply(clarsimp)\n   apply (metis cfgLM.derivationNoFromNone2 cfgLM.derivation_initial_is_derivation not_None_eq)\n  apply(rename_tac k ka w1a option b w1aa a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac k ka w1a option b w1aa a optiona ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac k ka w1a option b w1aa optiona ba)(*strict*)\n  apply(simp add: get_configuration_def)\n  done\n\nlemma CFGLM_CFGAC_has_cfgSTD_accessible_productions: \"\n  valid_cfg G\n  \\<Longrightarrow> N = cfgLM_accessible_nonterminals G\n  \\<Longrightarrow> P = {p \\<in> cfg_productions G. prod_lhs p \\<in> N}\n  \\<Longrightarrow> P = cfgLM_accessible_productions G\"\n  apply(simp add: cfgLM_accessible_productions_def cfgLM_accessible_nonterminals_def cfgLM.get_accessible_destinations_def)\n  apply(clarsimp)\n  apply(rule order_antisym)\n   apply(clarsimp)\n   apply(rename_tac x d n c w1 w2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac x d n c w1 w2)(*strict*)\n    apply(simp add: cfg_destination_def)\n   apply(rename_tac x d n c w1 w2)(*strict*)\n   apply(case_tac \"d n\")\n    apply(rename_tac x d n c w1 w2)(*strict*)\n    apply(simp add: get_configuration_def)\n   apply(rename_tac x d n c w1 w2 a)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac x d n c w1 w2 a option b)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac x d n c w1 w2 option)(*strict*)\n   apply(rename_tac e)\n   apply(rename_tac x d n c w1 w2 e)(*strict*)\n   apply(case_tac c)\n   apply(rename_tac x d n c w1 w2 e cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x d n w1 w2 e)(*strict*)\n   apply(rule_tac\n      x=\"derivation_append d (der2 \\<lparr>cfg_conf = liftB w1 @ teA (prod_lhs x) # w2\\<rparr> x \\<lparr>cfg_conf = liftB w1 @ (prod_rhs x) @ w2\\<rparr>) n\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac x d n w1 w2 e)(*strict*)\n    apply(rule cfgLM.derivation_append_preserves_derivation_initial)\n      apply(rename_tac x d n w1 w2 e)(*strict*)\n      apply(force)\n     apply(rename_tac x d n w1 w2 e)(*strict*)\n     apply(force)\n    apply(rename_tac x d n w1 w2 e)(*strict*)\n    apply(rule cfgLM.derivation_append_preserves_derivation)\n      apply(rename_tac x d n w1 w2 e)(*strict*)\n      apply(simp add: cfgLM.derivation_initial_def)\n     apply(rename_tac x d n w1 w2 e)(*strict*)\n     apply(rule cfgLM.der2_is_derivation)\n     apply(simp add: cfgLM_step_relation_def)\n     apply(rule_tac\n      x=\"liftB w1\"\n      in exI)\n     apply(clarsimp)\n     apply (metis setA_liftB)\n    apply(rename_tac x d n w1 w2 e)(*strict*)\n    apply(simp add: der2_def)\n   apply(rename_tac x d n w1 w2 e)(*strict*)\n   apply(rule_tac\n      x=\"Suc n\"\n      in exI)\n   apply(simp add: der2_def derivation_append_def)\n   apply(simp add: setAConcat cfg_get_destinations_def)\n  apply(clarsimp)\n  apply(rename_tac x d i e c)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x d i e c)(*strict*)\n   apply(simp add: valid_cfg_def)\n  apply(rename_tac x d i e c)(*strict*)\n  apply(simp add: cfg_destination_def cfg_get_destinations_def)\n  apply(erule disjE)\n   apply(rename_tac x d i e c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x d i e c)(*strict*)\n  apply(case_tac e)\n   apply(rename_tac x d i e c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x d i e c a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d i c a)(*strict*)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(clarsimp)\n  apply(simp add: get_configuration_def)\n  apply(case_tac i)\n   apply(rename_tac d i c a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d c a)(*strict*)\n   apply(subgoal_tac \"False\")\n    apply(rename_tac d c a)(*strict*)\n    apply(force)\n   apply(rename_tac d c a)(*strict*)\n   apply (metis cfgLM.derivation_initial_is_derivation cfgLM.initialNotEdgeSome_prime)\n  apply(rename_tac d i c a nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d c a nat)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> d (Suc nat) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   apply(rename_tac d c a nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac d c a nat)(*strict*)\n     apply(rule cfgLM.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac d c a nat)(*strict*)\n    apply(force)\n   apply(rename_tac d c a nat)(*strict*)\n   apply(force)\n  apply(rename_tac d c a nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d c a nat e1 c1)(*strict*)\n  apply(rule_tac\n      x=\"nat\"\n      in exI)\n  apply(clarsimp)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac d c a nat e1 c1 l r)(*strict*)\n  apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n  apply(rule_tac\n      x=\"r\"\n      in exI)\n  apply(clarsimp)\n  apply (metis liftBDeConv2)\n  done\n\nlemma cfg_sub_preserves_cfgLM_derivation: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G' d\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgLM.derivation G d\"\n  apply(simp (no_asm) add: cfgLM.derivation_def cfgLM.derivation_initial_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: cfgLM.derivation_def cfgLM.derivation_initial_def)\n   apply(case_tac \"d 0\")\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n   apply(rename_tac nat a)(*strict*)\n   prefer 2\n   apply(rule cfgLM.step_detail_before_some_position)\n     apply(rename_tac nat a)(*strict*)\n     apply(simp add: cfgLM.derivation_initial_def)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(force)\n  apply(rename_tac nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(simp add: cfg_sub_def)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n  apply(force)\n  done\n\nlemma cfg_sub_preserves_cfgLM_derivation_initial: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation_initial G' d\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgLM.derivation_initial G d\"\n  apply(rule cfgLM.derivation_initialI)\n   apply(simp (no_asm) add: cfgLM.derivation_def cfgLM.derivation_initial_def)\n   apply(clarsimp)\n   apply(rename_tac i)(*strict*)\n   apply(case_tac i)\n    apply(rename_tac i)(*strict*)\n    apply(clarsimp)\n    apply(simp add: cfgLM.derivation_def cfgLM.derivation_initial_def)\n    apply(clarsimp)\n    apply(case_tac \"d 0\")\n     apply(clarsimp)\n    apply(rename_tac a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac a option b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat)(*strict*)\n   apply(case_tac \"d (Suc nat)\")\n    apply(rename_tac nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac nat a)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n    apply(rename_tac nat a)(*strict*)\n    prefer 2\n    apply(rule cfgLM.step_detail_before_some_position)\n      apply(rename_tac nat a)(*strict*)\n      apply(simp add: cfgLM.derivation_initial_def)\n      apply(force)\n     apply(rename_tac nat a)(*strict*)\n     apply(force)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(simp add: cfg_sub_def)\n   apply(clarsimp)\n   apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n   apply(force)\n  apply(simp add: cfgLM.derivation_def cfgLM.derivation_initial_def)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def cfg_sub_def)\n  apply(force)\n  done\n\nlemma cfg_sub_preserves_derivation_initial_contra: \"\n  valid_cfg G\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgLM.derivation_initial G d\n  \\<Longrightarrow> (\\<forall>i e c. d i = Some (pair e c) \\<longrightarrow> set (option_to_list e) \\<subseteq> cfg_productions G' \\<and> c \\<in> cfg_configurations G')\n  \\<Longrightarrow> cfgLM.derivation_initial G' d\"\n  apply(rule cfgLM.derivation_initialI)\n   apply(simp add: cfgLM.derivation_def)\n   apply(clarsimp)\n   apply(rename_tac i)(*strict*)\n   apply(case_tac i)\n    apply(rename_tac i)(*strict*)\n    apply(clarsimp)\n    apply(case_tac \"d 0\")\n     apply(clarsimp)\n     apply(simp add: cfgLM.derivation_initial_def)\n    apply(rename_tac a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac a option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac option b)(*strict*)\n    apply(simp add: cfgLM.derivation_initial_def)\n   apply(rename_tac i nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat)(*strict*)\n   apply(case_tac \"d (Suc nat)\")\n    apply(rename_tac nat)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac nat a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat option b)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac nat option b)(*strict*)\n    prefer 2\n    apply(rule_tac\n      G=\"G\"\n      and d=\"d\"\n      and n=\"nat\"\n      and m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac nat option b)(*strict*)\n      apply(simp add: cfgLM.derivation_initial_def)\n     apply(rename_tac nat option b)(*strict*)\n     apply(force)\n    apply(rename_tac nat option b)(*strict*)\n    apply(force)\n   apply(rename_tac nat option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat b e1 e2 c1)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(clarsimp)\n   apply(rename_tac nat b e1 e2 c1 l r)(*strict*)\n   apply(erule_tac\n      x=\"Suc nat\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: option_to_list_def)\n  apply(simp add: cfgLM.derivation_initial_def cfg_initial_configurations_def valid_cfg_def cfg_sub_def cfg_configurations_def get_configuration_def cfg_initial_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: cfgLM.derivation_initial_def cfg_initial_configurations_def valid_cfg_def cfg_sub_def cfg_configurations_def get_configuration_def cfg_initial_configurations_def)\n  done\n\nlemma cfg_sub_preserves_derivation_initial_contra2: \"\n  valid_cfg G\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgLM.derivation_initial G d\n  \\<Longrightarrow> \\<forall>e c c'. e \\<in> cfg_productions G \\<and> c \\<in> cfg_configurations G' \\<and> cfgLM_step_relation G c e c' \\<longrightarrow> c' \\<in> cfg_configurations G' \\<and> e \\<in> cfg_productions G'\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> set (option_to_list e) \\<subseteq> cfg_productions G' \\<and> c \\<in> cfg_configurations G'\"\n  apply(induct i arbitrary: e c)\n   apply(rename_tac e c)(*strict*)\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(clarsimp)\n   apply(rename_tac c)(*strict*)\n   apply(simp add: option_to_list_def)\n   apply(simp add: cfg_initial_configurations_def cfg_configurations_def valid_cfg_def cfg_sub_def)\n  apply(rename_tac i e c)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac i e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      and d=\"d\"\n      and n=\"i\"\n      and m=\"Suc i\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i e c)(*strict*)\n     apply(simp add: cfgLM.derivation_initial_def)\n    apply(rename_tac i e c)(*strict*)\n    apply(force)\n   apply(rename_tac i e c)(*strict*)\n   apply(force)\n  apply(rename_tac i e c)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in meta_allE)\n  apply(clarify)\n  apply(erule_tac\n      x=\"c1\"\n      in meta_allE)\n  apply(erule meta_impE)\n   apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i e c e1 e2 c1 c2)(*strict*)\n  apply(erule_tac\n      x=\"e2\"\n      in allE)\n  apply(erule_tac\n      x=\"c1\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac i c e1 e2 c1)(*strict*)\n  apply(erule_tac\n      x=\"c\"\n      in allE)\n  apply(clarsimp)\n  apply(simp add: cfgLM_step_relation_def option_to_list_def)\n  done\n\nlemma cfgLM_initial_marking_derivations_equal_implies_marked_language_equal: \"\n  valid_cfg Gi\n  \\<Longrightarrow> valid_cfg Go\n  \\<Longrightarrow> cfgLM.initial_marking_derivations Go = cfgLM.initial_marking_derivations Gi\n  \\<Longrightarrow> cfgLM.marked_language Go = cfgLM.marked_language Gi\"\n  apply(simp add: cfgLM.marked_language_def)\n  apply(rule antisym)\n   apply(clarsimp)\n   apply(rule_tac x=\"d\" in exI)\n   apply(subgoal_tac \"d \\<in> ATS_Language0.initial_marking_derivations cfg_initial_configurations\n            cfgLM_step_relation cfg_marking_condition Gi\")\n    prefer 2\n    apply(rule_tac A=\"ATS_Language0.initial_marking_derivations cfg_initial_configurations\n            cfgLM_step_relation cfg_marking_condition Go\" in set_mp)\n     apply(force)\n    apply(simp add: cfgLM.initial_marking_derivations_def)\n    apply(force)\n   apply(simp add: cfgLM.initial_marking_derivations_def)\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(simp add: cfg_marked_effect_def)\n  apply(clarsimp)\n  apply(rule_tac x=\"d\" in exI)\n  apply(subgoal_tac \"d \\<in> ATS_Language0.initial_marking_derivations cfg_initial_configurations\n            cfgLM_step_relation cfg_marking_condition Go\")\n   prefer 2\n   apply(rule_tac A=\"ATS_Language0.initial_marking_derivations cfg_initial_configurations\n            cfgLM_step_relation cfg_marking_condition Gi\" in set_mp)\n    apply(force)\n   apply(simp add: cfgLM.initial_marking_derivations_def)\n  apply(thin_tac \"ATS_Language0.initial_marking_derivations cfg_initial_configurations\n            cfgLM_step_relation cfg_marking_condition Go =\n           ATS_Language0.initial_marking_derivations cfg_initial_configurations\n            cfgLM_step_relation cfg_marking_condition Gi\")\n  apply(simp add: cfgLM.initial_marking_derivations_def)\n  apply(simp add: cfgLM.derivation_initial_def)\n  apply(simp add: cfg_marked_effect_def)\n  done\n\nlemma cfg_sub_preserves_derivationLM: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G' d\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgLM.derivation G d\"\n  apply(simp (no_asm) add: cfgLM.derivation_def cfgLM.derivation_initial_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: cfgLM.derivation_def cfgLM.derivation_initial_def)\n   apply(case_tac \"d 0\")\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n   apply(rename_tac nat a)(*strict*)\n   prefer 2\n   apply(rule cfgLM.step_detail_before_some_position)\n     apply(rename_tac nat a)(*strict*)\n     apply(simp add: cfgLM.derivation_initial_def)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(force)\n  apply(rename_tac nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(simp add: cfg_sub_def)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n  apply(force)\n  done\n\nlemma cfg_sub_preserves_derivation_initialLM: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation_initial G' d\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgLM.derivation_initial G d\"\n  apply(rule cfgLM.derivation_initialI)\n   apply(simp (no_asm) add: cfgLM.derivation_def cfgLM.derivation_initial_def)\n   apply(clarsimp)\n   apply(rename_tac i)(*strict*)\n   apply(case_tac i)\n    apply(rename_tac i)(*strict*)\n    apply(clarsimp)\n    apply(simp add: cfgLM.derivation_def cfgLM.derivation_initial_def)\n    apply(clarsimp)\n    apply(case_tac \"d 0\")\n     apply(clarsimp)\n    apply(rename_tac a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac a option b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat)(*strict*)\n   apply(case_tac \"d (Suc nat)\")\n    apply(rename_tac nat)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac nat a)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation SSG c1 e2 c2\" for SSd SSn SSG)\n    apply(rename_tac nat a)(*strict*)\n    prefer 2\n    apply(rule cfgLM.step_detail_before_some_position)\n      apply(rename_tac nat a)(*strict*)\n      apply(simp add: cfgLM.derivation_initial_def)\n      apply(force)\n     apply(rename_tac nat a)(*strict*)\n     apply(force)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(simp add: cfg_sub_def)\n   apply(clarsimp)\n   apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n   apply(force)\n  apply(simp add: cfgLM.derivation_def cfgLM.derivation_initial_def)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: cfg_initial_configurations_def get_configuration_def cfg_configurations_def cfg_sub_def)\n  apply(force)\n  done\n\nlemma cfg_sub_preserves_cfgLM_accessible_nonterminals: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfg_sub G1 G2\n  \\<Longrightarrow> cfgLM_accessible_nonterminals G1 \\<subseteq> cfgLM_accessible_nonterminals G2\"\n  apply(simp add: cfgLM_accessible_nonterminals_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(simp add: cfg_sub_def)\n   apply(force)\n  apply(rule_tac x=\"d\" in exI)\n  apply(rule conjI)\n   apply(rule cfg_sub_preserves_derivation_initialLM)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\ndefinition cfgLM_language_relevant_nonterminals :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> 'nonterminal set\"\n  where\n    \"cfgLM_language_relevant_nonterminals G \\<equiv>\n  {A | A d n e c.\n  cfgLM.derivation_initial G d\n  \\<and> cfg_marking_condition G d\n  \\<and> d n = Some (pair e c)\n  \\<and> A \\<in> setA (cfg_conf c)}\"\n\nlemma cfg_sub_cfgLM_language_relevant_nonterminals_hlp1: \"\nvalid_cfg G \\<Longrightarrow>\n          valid_cfg G' \\<Longrightarrow>\n          cfg_sub G' G \\<Longrightarrow>\n          cfgLM_language_relevant_nonterminals G' \\<subseteq>\n          cfgLM_language_relevant_nonterminals G\"\n  apply(clarsimp)\n  apply(simp add: cfgLM_language_relevant_nonterminals_def)\n  apply(clarsimp)\n  apply(rule_tac x=\"d\" in exI)\n  apply(rule context_conjI)\n   apply (metis cfg_sub_preserves_derivation_initialLM)\n  apply(rule context_conjI)\n   apply (metis Int_iff cfgLM.derivation_initial_configurations cfg_marking_condition_def cfg_marking_configuration_def)\n  apply(rule_tac x=\"n\" in exI)\n  apply(clarsimp)\n  done\n\nlemma cfgLM_maximum_of_domain_by_nonterminal_free: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf = liftB v\\<rparr>)\n  \\<Longrightarrow> maximum_of_domain d n\"\n  apply(simp add: maximum_of_domain_def)\n  apply(case_tac \"d (Suc n)\")\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac n=\"n\" and m=\"Suc n\" in cfgLM.step_detail_before_some_position)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply (metis liftB_with_nonterminal_inside)\n  done\n\nlemma cfg_sub_preserves_marked_language_cfgLM: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfg_sub G1 G2\n  \\<Longrightarrow> cfgLM.marked_language G1 \\<subseteq> cfgLM.marked_language G2\"\n  apply(simp add: cfgLM.marked_language_def)\n  apply(clarsimp)\n  apply(rename_tac x d)(*strict*)\n  apply(rule_tac x=\"d\" in exI)\n  apply(rule conjI)\n   apply(rename_tac x d)(*strict*)\n   apply(rule cfg_sub_preserves_derivation_initialLM)\n     apply(rename_tac x d)(*strict*)\n     apply(force)\n    apply(rename_tac x d)(*strict*)\n    apply(force)\n   apply(rename_tac x d)(*strict*)\n   apply(force)\n  apply(rename_tac x d)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x d)(*strict*)\n   apply(simp add: cfg_marked_effect_def)\n  apply(rename_tac x d)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x d)(*strict*)\n   apply(rule cfg_sub_preserves_derivationLM)\n     apply(rename_tac x d)(*strict*)\n     apply(force)\n    apply(rename_tac x d)(*strict*)\n    apply(force)\n   apply(rename_tac x d)(*strict*)\n   apply(force)\n  apply(rename_tac x d)(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac x d i e c)(*strict*)\n  apply(rule_tac x=\"i\" in exI)\n  apply(clarsimp)\n  apply(simp add: cfg_marking_configuration_def cfg_sub_def cfg_configurations_def)\n  apply(force)\n  done\n\nlemma cfg_sub_preserves_derivation_reverse: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfg_sub G1 G2\n  \\<Longrightarrow> cfgLM.derivation G2 d\n  \\<Longrightarrow> (\\<forall>i e c. d i = Some (pair e c) \\<longrightarrow> setA (cfg_conf c) \\<subseteq> cfg_nonterminals G1)\n  \\<Longrightarrow> (cfg_productions G1 = {p\\<in> cfg_productions G2. prod_lhs p \\<in> cfg_nonterminals G1 \\<and> setA (prod_rhs p) \\<subseteq> cfg_nonterminals G1})\n  \\<Longrightarrow> cfgLM.derivation G1 d\"\n  apply(simp (no_asm) add: cfgLM.derivation_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: cfgLM.derivation_def)\n   apply(erule_tac x=\"0\" in allE)\n   apply(clarsimp)\n  apply(rename_tac i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat a)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac nat a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\" and\n      n=\"nat\" and\n      m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac nat a)(*strict*)\n     apply(force)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(force)\n  apply(rename_tac nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2 l r)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac nat e1 e2 c1 c2 l r cfg_confa)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac nat e1 e2 c1 c2 l r cfg_confa cfg_confaa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 l r)(*strict*)\n  apply(simp add: valid_cfg_def)\n  apply(erule_tac x=\"nat\" in allE')\n  apply(erule_tac x=\"Suc nat\" in allE)\n  apply(clarsimp)\n  apply(simp add: setAConcat)\n  done\n\nlemma cfg_sub_preserves_derivation_initial_reverse: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfg_sub G1 G2\n  \\<Longrightarrow> cfgLM.derivation_initial G2 d\n  \\<Longrightarrow> (\\<forall>i e c. d i = Some (pair e c) \\<longrightarrow> setA (cfg_conf c) \\<subseteq> cfg_nonterminals G1)\n  \\<Longrightarrow> (cfg_productions G1 = {p\\<in> cfg_productions G2. prod_lhs p \\<in> cfg_nonterminals G1 \\<and> setA (prod_rhs p) \\<subseteq> cfg_nonterminals G1})\n  \\<Longrightarrow> cfgLM.derivation_initial G1 d\"\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac ?G1.0=\"G1\" and ?G2.0=\"G2\" in cfg_sub_preserves_derivation_reverse)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(simp add: cfgLM.derivation_initial_def)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(simp add: cfgLM.derivation_initial_def)\n  apply(case_tac \"d 0\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option conf)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac conf)(*strict*)\n  apply(simp add: cfg_initial_configurations_def cfg_configurations_def valid_cfg_def cfg_sub_def)\n  done\n\nlemma cfg_sub_preserves_marked_language_reverse: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfg_sub G1 G2\n  \\<Longrightarrow> cfg_events G1 = cfg_events G2\n  \\<Longrightarrow> (\\<forall>d. cfgLM.derivation_initial G2 d \\<longrightarrow> cfg_marking_condition G2 d \\<longrightarrow> cfgLM.derivation_initial G1 d)\n  \\<Longrightarrow> cfgLM.marked_language G2 \\<subseteq> cfgLM.marked_language G1\"\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(simp add: cfgLM.marked_language_def)\n  apply(clarsimp)\n  apply(rename_tac x d)(*strict*)\n  apply(rule_tac x=\"d\" in exI)\n  apply(erule_tac x=\"d\" in allE)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac x d)(*strict*)\n   apply(simp add: cfg_marked_effect_def)\n  apply(rename_tac x d)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x d)(*strict*)\n   apply(simp add: cfgLM.derivation_initial_def)\n  apply(rename_tac x d)(*strict*)\n  apply(simp add: cfg_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac x d i e c)(*strict*)\n  apply(rule_tac x=\"i\" in exI)\n  apply(clarsimp)\n  apply(simp add: cfg_marked_effect_def cfg_marking_configuration_def valid_cfg_def cfg_sub_def cfg_configurations_def)\n  apply(clarsimp)\n  done\n\nlemma cfg_sub_equal_marked_language: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfg_sub G1 G2\n  \\<Longrightarrow> cfg_events G1 = cfg_events G2\n  \\<Longrightarrow> (\\<forall>d. cfgLM.derivation_initial G2 d \\<longrightarrow> cfg_marking_condition G2 d \\<longrightarrow> cfgLM.derivation_initial G1 d)\n  \\<Longrightarrow> cfgLM.marked_language G1 = cfgLM.marked_language G2\"\n  apply(rule antisym)\n   prefer 2\n   apply(rule cfg_sub_preserves_marked_language_reverse)\n       prefer 3\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule cfg_sub_preserves_marked_language_cfgLM)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma cfgLM_no_step_without_nonterms_maximum_of_domain: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> setA (cfg_conf c) = {}\n  \\<Longrightarrow> maximum_of_domain d n\"\n  apply(simp add: maximum_of_domain_def)\n  apply(rule cfgLM_no_step_without_nonterms)\n     apply(force)+\n  done\n\nlemma last_head_occurence_of_nonterminal: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation_initial G d\n  \\<Longrightarrow> d i = Some (pair e \\<lparr>cfg_conf=l@[teA A]@r\\<rparr>)\n  \\<Longrightarrow> d j = Some (pair ej \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<Longrightarrow> \\<exists>k ek ck s \\<alpha>.\n          i \\<le> k \\<and>\n          k < j \\<and>\n          d k = Some (pair ek ck) \\<and> cfg_conf ck = liftB \\<alpha> @ teA A # s\"\n  apply(subgoal_tac \"maximum_of_domain d j\")\n   prefer 2\n   apply(rule cfgLM_no_step_without_nonterms_maximum_of_domain)\n      apply(force)\n     apply(simp add: cfgLM.derivation_initial_def)\n    apply(force)\n   apply(clarsimp)\n   apply(rule setA_liftB)\n  apply(subgoal_tac \"i<j\")\n   prefer 2\n   apply(case_tac \"i<j\")\n    apply(force)\n   apply(case_tac \"i=j\")\n    apply(clarsimp)\n    apply (metis liftBSplit list.distinct(1) maxTermPrefix_drop_tail maxTermPrefix_term_string self_append_conv)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac\n      n=\"j\"\n      and m=\"i\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rule_tac d=\"d\" in cfgLM.derivation_initial_is_derivation)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(clarsimp)\n   apply(rename_tac e2 c2)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac e2 c2)(*strict*)\n    prefer 2\n    apply(rule_tac n=\"j\" in cfgLM_no_step_without_nonterms)\n       apply(rename_tac e2 c2)(*strict*)\n       apply(force)\n      apply(rename_tac e2 c2)(*strict*)\n      apply(simp add: cfgLM.derivation_initial_def)\n      apply(force)\n     apply(rename_tac e2 c2)(*strict*)\n     apply(force)\n    apply(rename_tac e2 c2)(*strict*)\n    apply(clarsimp)\n    apply(rule setA_liftB)\n   apply(rename_tac e2 c2)(*strict*)\n   apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac P=\"%n. \\<exists>e c w1 w2. d (j-n) = Some (pair e c) \\<and> A \\<in> setA (cfg_conf c)\" and n=\"j-i\" in ex_least_nat_le_prime)\n   apply(clarsimp)\n   apply(simp add: setAConcat)\n  apply(clarsimp)\n  apply(rename_tac k ea c)(*strict*)\n  apply(case_tac k)\n   apply(rename_tac k ea c)(*strict*)\n   apply(clarsimp)\n   apply (metis setA_liftB_empty empty_iff)\n  apply(rename_tac k ea c nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ea c nat)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac ea c nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      n=\"j-Suc nat\"\n      and m=\"j\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac ea c nat)(*strict*)\n     apply(rule_tac d=\"d\" in cfgLM.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac ea c nat)(*strict*)\n    apply(force)\n   apply(rename_tac ea c nat)(*strict*)\n   apply(force)\n  apply(rename_tac ea c nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ea c nat e2 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(erule_tac x=\"nat\" in allE)\n  apply(clarsimp)\n  apply(rename_tac ea c nat e2 c2 la ra)(*strict*)\n  apply(rule_tac x=\"j-Suc nat\" in exI)\n  apply(clarsimp)\n  apply(case_tac c)\n  apply(rename_tac ea c nat e2 c2 la ra cfg_confa)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac ea c nat e2 c2 la ra cfg_confa cfg_confaa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ea nat e2 la ra)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac ea nat e2 la ra)(*strict*)\n   apply(force)\n  apply(rename_tac ea nat e2 la ra)(*strict*)\n  apply(subgoal_tac \"\\<exists>w. liftB w= la\")\n   apply(rename_tac ea nat e2 la ra)(*strict*)\n   prefer 2\n   apply(rule_tac x=\"filterB la\" in exI)\n   apply(rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac ea nat e2 la ra)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac ea nat e2 ra wa)(*strict*)\n  apply(simp add: setAConcat)\n  apply(rule_tac x=\"ra\" in exI)\n  apply(rule_tac x=\"wa\" in exI)\n  apply(clarsimp)\n  apply(subgoal_tac \"Suc (j - Suc nat) = j-nat\")\n   apply(rename_tac ea nat e2 ra wa)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac ea nat e2 ra wa)(*strict*)\n  apply(clarsimp)\n  apply(simp add: setAConcat)\n  done\n\nlemma cfg_cfgLM_initial_marking_derivations_subset_implies_cfgLM_language_relevant_nonterminals_subset: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfgLM.initial_marking_derivations G2 \\<subseteq> cfgLM.initial_marking_derivations G1\n  \\<Longrightarrow> cfgLM_language_relevant_nonterminals G2 \\<subseteq> cfgLM_language_relevant_nonterminals G1\"\n  apply(simp add: cfgLM_language_relevant_nonterminals_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"d \\<in> ATS_Language0.initial_marking_derivations cfg_initial_configurations\n           cfgLM_step_relation cfg_marking_condition G1\")\n   prefer 2\n   apply(rule_tac A=\"ATS_Language0.initial_marking_derivations cfg_initial_configurations\n           cfgLM_step_relation cfg_marking_condition G2\" in set_mp)\n    apply(force)\n   apply(simp add: cfgLM.initial_marking_derivations_def)\n  apply(thin_tac \"ATS_Language0.initial_marking_derivations cfg_initial_configurations\n        cfgLM_step_relation cfg_marking_condition G2\n       \\<subseteq> ATS_Language0.initial_marking_derivations cfg_initial_configurations\n           cfgLM_step_relation cfg_marking_condition G1\")\n  apply(rule_tac x=\"d\" in exI)\n  apply(simp add: cfgLM.initial_marking_derivations_def)\n  apply(rule_tac x=\"n\" in exI)\n  apply(clarsimp)\n  done\n\nlemma cfg_cfgLM_initial_marking_derivations_equal_implies_cfgLM_language_relevant_nonterminals_equal: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfgLM.initial_marking_derivations G2 = cfgLM.initial_marking_derivations G1\n  \\<Longrightarrow> cfgLM_language_relevant_nonterminals G2 = cfgLM_language_relevant_nonterminals G1\"\n  apply(rule antisym)\n   apply(rule cfg_cfgLM_initial_marking_derivations_subset_implies_cfgLM_language_relevant_nonterminals_subset)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule cfg_cfgLM_initial_marking_derivations_subset_implies_cfgLM_language_relevant_nonterminals_subset)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\ndefinition cfgLM_language_relevant_productions :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('nonterminal, 'event) cfg_step_label set\"\n  where\n    \"cfgLM_language_relevant_productions G \\<equiv>\n  {e | d n e c.\n  cfgLM.derivation_initial G d\n  \\<and> cfg_marking_condition G d\n  \\<and> d n = Some (pair (Some e) c)}\"\n\nlemma cfg_cfgLM_initial_marking_derivations_subset_implies_cfgLM_language_relevant_productions_subset: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfgLM.initial_marking_derivations G2 \\<subseteq> cfgLM.initial_marking_derivations G1\n  \\<Longrightarrow> cfgLM_language_relevant_productions G2 \\<subseteq> cfgLM_language_relevant_productions G1\"\n  apply(simp add: cfgLM_language_relevant_productions_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"d \\<in> ATS_Language0.initial_marking_derivations cfg_initial_configurations\n           cfgLM_step_relation cfg_marking_condition G1\")\n   prefer 2\n   apply(rule_tac A=\"ATS_Language0.initial_marking_derivations cfg_initial_configurations\n           cfgLM_step_relation cfg_marking_condition G2\" in set_mp)\n    apply(force)\n   apply(simp add: cfgLM.initial_marking_derivations_def)\n  apply(thin_tac \"ATS_Language0.initial_marking_derivations cfg_initial_configurations\n        cfgLM_step_relation cfg_marking_condition G2\n       \\<subseteq> ATS_Language0.initial_marking_derivations cfg_initial_configurations\n           cfgLM_step_relation cfg_marking_condition G1\")\n  apply(rule_tac x=\"d\" in exI)\n  apply(simp add: cfgLM.initial_marking_derivations_def)\n  apply(rule_tac x=\"n\" in exI)\n  apply(clarsimp)\n  done\n\nlemma cfg_cfgLM_initial_marking_derivations_equal_implies_cfgLM_language_relevant_productions_equal: \"\n  valid_cfg G1\n  \\<Longrightarrow> valid_cfg G2\n  \\<Longrightarrow> cfgLM.initial_marking_derivations G2 = cfgLM.initial_marking_derivations G1\n  \\<Longrightarrow> cfgLM_language_relevant_productions G2 = cfgLM_language_relevant_productions G1\"\n  apply(rule antisym)\n   apply(rule cfg_cfgLM_initial_marking_derivations_subset_implies_cfgLM_language_relevant_productions_subset)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule cfg_cfgLM_initial_marking_derivations_subset_implies_cfgLM_language_relevant_productions_subset)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma cfgLM_accessible_nonterminals_lhs_makes_prod_cfgLM_accessible_productions: \"\n  valid_cfg G\n  \\<Longrightarrow> p \\<in> cfg_productions G\n  \\<Longrightarrow> prod_lhs p \\<in> cfgLM_accessible_nonterminals G\n  \\<Longrightarrow> p \\<in> cfgLM_accessible_productions G\"\n  apply(simp add: cfgLM_accessible_productions_def cfgLM_accessible_nonterminals_def)\n  apply(clarsimp)\n  apply(rename_tac d n c w1 w2)(*strict*)\n  apply(simp add: cfgLM.get_accessible_destinations_def cfg_destination_def cfg_get_destinations_def)\n  apply(simp add: get_configuration_def)\n  apply(case_tac \"d n\")\n   apply(rename_tac d n c w1 w2)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d n c w1 w2 a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac d n c w1 w2 a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d n c w1 w2 option)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac d n c w1 w2 option cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d n w1 w2 option)(*strict*)\n  apply(rule_tac\n      x=\"derivation_append d (der2 \\<lparr>cfg_conf = liftB w1 @ teA (prod_lhs p) # w2\\<rparr> p \\<lparr>cfg_conf = liftB w1 @ (prod_rhs p) @ w2\\<rparr>) n\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d n w1 w2 option)(*strict*)\n   apply(rule cfgLM.derivation_append_preserves_derivation_initial)\n     apply(rename_tac d n w1 w2 option)(*strict*)\n     apply(force)\n    apply(rename_tac d n w1 w2 option)(*strict*)\n    apply(force)\n   apply(rename_tac d n w1 w2 option)(*strict*)\n   apply(rule cfgLM.derivation_append_preserves_derivation)\n     apply(rename_tac d n w1 w2 option)(*strict*)\n     apply(rule cfgLM.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac d n w1 w2 option)(*strict*)\n    apply(rule cfgLM.der2_is_derivation)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(rule_tac\n      x=\"liftB w1\"\n      in exI)\n    apply(rule_tac\n      x=\"w2\"\n      in exI)\n    apply(clarsimp)\n    apply (metis setA_liftB)\n   apply(rename_tac d n w1 w2 option)(*strict*)\n   apply(clarsimp)\n   apply(simp add: der2_def)\n  apply(rename_tac d n w1 w2 option)(*strict*)\n  apply(rule_tac\n      x=\"Suc n\"\n      in exI)\n  apply(rule_tac\n      x=\"Some p\"\n      in exI)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der2_def)\n  done\n\nlemma CFGLM_composition_of_two_derivation_with_context: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d1\n  \\<Longrightarrow> d1 0 = Some (pair None c1)\n  \\<Longrightarrow> d1 n1 = Some (pair e1 c1')\n  \\<Longrightarrow> cfgLM.derivation G d2\n  \\<Longrightarrow> d2 0 = Some (pair None c2)\n  \\<Longrightarrow> d2 n2 = Some (pair e2 c2')\n  \\<Longrightarrow> setA (cfg_conf c1') = {}\n  \\<Longrightarrow> \\<exists>d e.\n  cfgLM.derivation G d\n  \\<and> d 0 = Some (pair None \\<lparr>cfg_conf=(liftB x1)@(cfg_conf c1)@(liftB x2)@(cfg_conf c2)@y\\<rparr>)\n  \\<and> d (n1+n2) = Some (pair e \\<lparr>cfg_conf=(liftB x1)@(cfg_conf c1')@(liftB x2)@(cfg_conf c2')@y\\<rparr>)\"\n  apply(rule_tac\n      x=\"\\<lambda>n. if (n\\<le>n1) then Some (pair ((get_label(d1 n))) \\<lparr>cfg_conf=(liftB x1)@(cfg_conf(the(get_configuration(d1 n))))@(liftB x2)@(cfg_conf c2)@y\\<rparr>) else (if (n\\<le>n1+n2) then Some (pair ((get_label(d2 ((n-n1))))) \\<lparr>cfg_conf=(liftB x1)@(cfg_conf c1')@(liftB x2)@(cfg_conf(the(get_configuration(d2((n-n1))))))@y\\<rparr>) else None)\"\n      in exI)\n  apply(simp (no_asm) add: cfgLM.derivation_def)\n  apply(case_tac n2)\n   apply(clarsimp)\n   apply(rule conjI)\n    prefer 2\n    apply(simp add: get_label_def get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac i)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac i)(*strict*)\n    apply(clarsimp)\n    apply(case_tac i)\n     apply(rename_tac i)(*strict*)\n     apply(clarsimp)\n     apply(simp add: get_label_def get_configuration_def)\n    apply(rename_tac i nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac nat)(*strict*)\n    apply(simp add: get_label_def get_configuration_def)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 nat = Some (pair e1 c1) \\<and> d1 (Suc nat) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n     apply(rename_tac nat)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"n1\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac nat)(*strict*)\n       apply(force)\n      apply(rename_tac nat)(*strict*)\n      apply(force)\n     apply(rename_tac nat)(*strict*)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac nat e1a e2 c1a c2)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac nat e1a e2 c1a c2 l r)(*strict*)\n    apply(case_tac c2)\n    apply(rename_tac nat e1a e2 c1a c2 l r cfg_confa)(*strict*)\n    apply(case_tac c1a)\n    apply(rename_tac nat e1a e2 c1a c2 l r cfg_confa cfg_confaa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac nat e1a e2 l r)(*strict*)\n    apply(simp add: get_label_def get_configuration_def)\n    apply(rule_tac\n      x=\"liftB x1 @ l\"\n      in exI)\n    apply(clarsimp)\n    apply(simp add: setAConcat)\n    apply (metis setA_liftB)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(case_tac i)\n    apply(rename_tac i)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(simp add: get_label_def get_configuration_def)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat i)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac nat i)(*strict*)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac nat i)(*strict*)\n    apply(clarsimp)\n    apply(case_tac i)\n     apply(rename_tac nat i)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac nat)(*strict*)\n     apply(simp add: get_label_def get_configuration_def)\n    apply(rename_tac nat i nata)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac nat nata)(*strict*)\n    apply(simp add: get_label_def get_configuration_def)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 nata = Some (pair e1 c1) \\<and> d1 (Suc nata) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n     apply(rename_tac nat nata)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"n1\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac nat nata)(*strict*)\n       apply(force)\n      apply(rename_tac nat nata)(*strict*)\n      apply(force)\n     apply(rename_tac nat nata)(*strict*)\n     apply(force)\n    apply(rename_tac nat nata)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac nat nata e1a e2a c1a c2a)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac nat nata e1a e2a c1a c2a l r)(*strict*)\n    apply(case_tac c1a)\n    apply(rename_tac nat nata e1a e2a c1a c2a l r cfg_confa)(*strict*)\n    apply(case_tac c2a)\n    apply(rename_tac nat nata e1a e2a c1a c2a l r cfg_confa cfg_confaa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac nat nata e1a e2a l r)(*strict*)\n    apply(simp add: get_label_def get_configuration_def)\n    apply(rule_tac\n      x=\"liftB x1 @ l\"\n      in exI)\n    apply(clarsimp)\n    apply(simp add: setAConcat)\n    apply (metis setA_liftB)\n   apply(rename_tac nat i)(*strict*)\n   apply(clarsimp)\n   apply(case_tac i)\n    apply(rename_tac nat i)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac nat i nata)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat nata)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac nat nata)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"nata=n1\")\n     apply(rename_tac nat nata)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac nat nata)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac nat)(*strict*)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 0 = Some (pair e1 c1) \\<and> d2 (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n     apply(rename_tac nat)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac nat)(*strict*)\n       apply(force)\n      apply(rename_tac nat)(*strict*)\n      apply(force)\n     apply(rename_tac nat)(*strict*)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac nat e2a c2a)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(simp add: get_label_def get_configuration_def)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac nat e2a c2a l r)(*strict*)\n    apply(rule_tac\n      x=\"liftB x1 @ cfg_conf c1' @ liftB x2 @ l\"\n      in exI)\n    apply(clarsimp)\n    apply(simp add: setAConcat)\n    apply(rule conjI)\n     apply(rename_tac nat e2a c2a l r)(*strict*)\n     apply (metis setA_liftB)\n    apply(rename_tac nat e2a c2a l r)(*strict*)\n    apply (metis setA_liftB)\n   apply(rename_tac nat nata)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 (nata-n1) = Some (pair e1 c1) \\<and> d2 (Suc (nata-n1)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n    apply(rename_tac nat nata)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac nat nata)(*strict*)\n      apply(force)\n     apply(rename_tac nat nata)(*strict*)\n     apply(force)\n    apply(rename_tac nat nata)(*strict*)\n    apply(force)\n   apply(rename_tac nat nata)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat nata e1a e2a c1a c2a)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(simp add: get_label_def get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac nat nata e1a e2a c1a c2a l r)(*strict*)\n   apply(case_tac c1a)\n   apply(rename_tac nat nata e1a e2a c1a c2a l r cfg_confa)(*strict*)\n   apply(case_tac c2a)\n   apply(rename_tac nat nata e1a e2a c1a c2a l r cfg_confa cfg_confaa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac nat nata e1a e2a l r)(*strict*)\n   apply(subgoal_tac \"Suc (nata - n1)=Suc nata-n1\")\n    apply(rename_tac nat nata e1a e2a l r)(*strict*)\n    apply(clarsimp)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(simp add: get_label_def get_configuration_def)\n    apply(rule_tac\n      x=\"liftB x1 @ cfg_conf c1' @ liftB x2 @ l\"\n      in exI)\n    apply(clarsimp)\n    apply(simp add: setAConcat)\n    apply(rule conjI)\n     apply(rename_tac nat nata e1a e2a l r)(*strict*)\n     apply (metis setA_liftB)\n    apply(rename_tac nat nata e1a e2a l r)(*strict*)\n    apply (metis setA_liftB)\n   apply(rename_tac nat nata e1a e2a l r)(*strict*)\n   apply(force)\n  apply(rename_tac nat i)(*strict*)\n  apply(clarsimp)\n  apply(case_tac i)\n   apply(rename_tac nat i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat i nata)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma CFGLM_terminals_stay_at_front: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e1 c1)\n  \\<Longrightarrow> d (n+m) = Some (pair e2 c2)\n  \\<Longrightarrow> cfg_conf c1=liftB w@v\n  \\<Longrightarrow> \\<exists>v. cfg_conf c2=liftB w@v\"\n  apply(induct m arbitrary: e2 c2)\n   apply(rename_tac e2 c2)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac m e2 c2)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d (n+m) = Some (pair e1 c1) \\<and> d (Suc (n+m)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   apply(rename_tac m e2 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc (n+m)\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac m e2 c2)(*strict*)\n     apply(force)\n    apply(rename_tac m e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac m e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac m e2 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac m c2 e1a e2a c1a)(*strict*)\n  apply(erule_tac\n      x=\"e1a\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"c1a\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac m c2 e1a e2a c1a va)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac m c2 e1a e2a c1a va l r)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac m c2 e1a e2a c1a va l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac m c2 e1a e2a c1 va l r)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac m c2 e1a e2a c1 va l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac m c2 e1a e2a va l r)(*strict*)\n  apply(subgoal_tac \"\\<exists>v0. liftB v0=l\")\n   apply(rename_tac m c2 e1a e2a va l r)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n   apply (rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac m c2 e1a e2a va l r)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac m c2 e1a e2a va r v0)(*strict*)\n  apply(thin_tac \"setA (liftB v0) = {}\")\n  apply(subgoal_tac \"prefix w v0\")\n   apply(rename_tac m c2 e1a e2a va r v0)(*strict*)\n   prefer 2\n   apply (metis maxTermPrefix_drop_tail maxTermPrefix_shift maxTermPrefix_term_string prefix_append)\n  apply(rename_tac m c2 e1a e2a va r v0)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac m c2 e1a e2a va r c)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac m c2 e1a e2a va r c cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac m e1a e2a va r c)(*strict*)\n  apply(simp add: liftB_commutes_over_concat)\n  done\n\nlemma empty_start_then_cfgLM_derivation_is_empty: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = []\\<rparr>)\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> n=0\"\n  apply(case_tac n)\n   apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> d (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac nat)(*strict*)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(force)\n   apply(rename_tac nat)(*strict*)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e2 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  done\n\nlemma cfgLM_no_step_without_nontermsX: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> setA (cfg_conf c)={}\n  \\<Longrightarrow> d (n+m) \\<noteq> None\n  \\<Longrightarrow> m=0\"\n  apply(case_tac m)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> d (Suc n) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+m\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac nat)(*strict*)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(force)\n   apply(rename_tac nat)(*strict*)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat y e2 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac nat y e2 c2 l r)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac nat y e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat y e2 c2 l r)(*strict*)\n  apply (metis elemInsetA emptyE)\n  done\n\nlemma cfgLM_terminal_preserved: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> setB (cfg_conf c1)\\<noteq>{}\n  \\<Longrightarrow> d n = Some (pair e1 c1)\n  \\<Longrightarrow> d (n+m) = Some (pair e2 c2)\n  \\<Longrightarrow> setB (cfg_conf c2)\\<noteq>{}\"\n  apply(induct m arbitrary: e2 c2)\n   apply(rename_tac e2 c2)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac m e2 c2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d (n+m) = Some (pair e1 c1) \\<and> d (Suc (n+m)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   apply(rename_tac m e2 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc (n+m)\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac m e2 c2)(*strict*)\n     apply(force)\n    apply(rename_tac m e2 c2)(*strict*)\n    apply(force)\n   apply(rename_tac m e2 c2)(*strict*)\n   apply(force)\n  apply(rename_tac m e2 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac m c2 e1a e2a c1a)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac m c2 e1a e2a c1a l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac m c2 e1a e2a c1a l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac m e1a e2a c1a l r)(*strict*)\n  apply(case_tac c1a)\n  apply(rename_tac m e1a e2a c1a l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac m e1a e2a l r)(*strict*)\n  apply(erule_tac\n      x=\"e1a\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"\\<lparr>cfg_conf = l @ teA (prod_lhs e2a) # r\\<rparr>\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(simp add: setBConcat)\n  done\n\nlemma cfgLM_terminal_preserved2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e1 c)\n  \\<Longrightarrow> d (n+m) = Some (pair e2 \\<lparr>cfg_conf=[]\\<rparr>)\n  \\<Longrightarrow> setB (cfg_conf c)={}\"\n  apply(case_tac \"setB (cfg_conf c)={}\")\n   apply(force)\n  apply(subgoal_tac \"False\")\n   apply(force)\n  apply(subgoal_tac \"setB (cfg_conf \\<lparr>cfg_conf=[]\\<rparr>)\\<noteq>{}\")\n   apply(force)\n  apply(rule cfgLM_terminal_preserved)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma cfgLM_terminals_preserved: \"\n  valid_cfg G'\n  \\<Longrightarrow> cfgLM.derivation G' dc\n  \\<Longrightarrow> dc 0 = Some (pair None c1)\n  \\<Longrightarrow> dc nc = Some (pair ec c2)\n  \\<Longrightarrow> setB (cfg_conf c1) \\<subseteq> setB (cfg_conf c2)\"\n  apply(induct nc arbitrary: ec c2)\n   apply(rename_tac ec c2)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nc ec c2)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. dc nc = Some (pair e1 c1) \\<and> dc (Suc nc) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G' c1 e2 c2\")\n   apply(rename_tac nc ec c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nc\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac nc ec c2)(*strict*)\n     apply(force)\n    apply(rename_tac nc ec c2)(*strict*)\n    apply(force)\n   apply(rename_tac nc ec c2)(*strict*)\n   apply(force)\n  apply(rename_tac nc ec c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nc c2 x e1 e2 c1a)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac nc c2 x e1 e2 c1a l r)(*strict*)\n  apply(case_tac c1a)\n  apply(rename_tac nc c2 x e1 e2 c1a l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nc c2 x e1 e2 l r)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac nc c2 x e1 e2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(case_tac c2)\n  apply(rename_tac nc c2 x e1 e2 l r cfg_confa cfg_confaa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nc x e1 e2 l r cfg_confa)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"\\<lparr>cfg_conf = l @ teA (prod_lhs e2) # r\\<rparr>\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac nc x e1 e2 l r cfg_conf)(*strict*)\n  apply(rule_tac\n      A=\"setB cfg_conf\"\n      in set_mp)\n   apply(rename_tac nc x e1 e2 l r cfg_conf)(*strict*)\n   apply(simp add: setBConcat)\n   apply(force)\n  apply(rename_tac nc x e1 e2 l r cfg_conf)(*strict*)\n  apply(simp add: setBConcat)\n  done\n\nlemma cfgLM_no_terminals_at_beginning: \"\n  valid_cfg G'\n  \\<Longrightarrow> cfgLM.derivation G' dc\n  \\<Longrightarrow> dc 0 = Some (pair None \\<lparr>cfg_conf = c\\<rparr>)\n  \\<Longrightarrow> dc nc = Some (pair ec \\<lparr>cfg_conf = []\\<rparr>)\n  \\<Longrightarrow> setB c = {}\"\n  apply(subgoal_tac \"setB (cfg_conf \\<lparr>cfg_conf=c\\<rparr>) \\<subseteq> setB (cfg_conf \\<lparr>cfg_conf = []\\<rparr>)\")\n   apply(force)\n  apply(rule cfgLM_terminals_preserved)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\ndefinition CFGlmEliminators :: \"('a,'b) cfg \\<Rightarrow> ('a,'b)DT_two_elements option \\<Rightarrow> ('a,'b)cfg_step_label list set\" where\n  \"CFGlmEliminators G \\<alpha> \\<equiv> {\\<pi>. \\<exists>d n e w.\n  cfgLM.derivation G d\n  \\<and> cfgLM.belongs G d\n  \\<and> d 0 = Some (pair None \\<lparr>cfg_conf=(option_to_list \\<alpha>)\\<rparr>)\n  \\<and> d n = Some (pair e \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<and> \\<pi>=map the (get_labels d n)}\"\n\nfunction (domintros) CFGlm2rm :: \"('a,'b) cfg \\<Rightarrow> ('a,'b)cfg_step_label list \\<Rightarrow> ('a,'b)cfg_step_label list\" where\n  \"CFGlm2rm G [] = []\"\n| \"CFGlm2rm G (r#\\<pi>') = (\n  let \\<pi>s=SOME \\<pi>s.\n  (foldl ((@)) [] \\<pi>s) = \\<pi>'\n  \\<and> (length \\<pi>s) = (length (prod_rhs r))\n  \\<and> (\\<forall>i<length \\<pi>s. (\\<pi>s!i) \\<in> CFGlmEliminators G (Some((prod_rhs r)!i)))\n  in\n  r#(foldl ((@)) [] (map (\\<lambda>x. CFGlm2rm G x) (rev \\<pi>s)))\n  )\"\n  by pat_completeness auto\n\nlemma lemma_4_6_existence: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = foldl (@) [] \\<alpha>\\<rparr>)\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>)\n  \\<Longrightarrow> \\<pi>=map the (get_labels d n)\n  \\<Longrightarrow> \\<exists>\\<pi>s ws.\n  foldl (@) [] \\<pi>s = \\<pi>\n  \\<and> length \\<pi>s = length \\<alpha>\n  \\<and> foldl (@) [] ws = w\n  \\<and> length ws = length \\<alpha>\n  \\<and> (\\<forall>i<length \\<pi>s. \\<exists>d' n' e'.\n  cfgLM.derivation G d'\n  \\<and> cfgLM.belongs G d'\n  \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=\\<alpha>!i\\<rparr>)\n  \\<and> d' n' = Some (pair e' \\<lparr>cfg_conf=liftB (ws!i)\\<rparr>)\n  \\<and> \\<pi>s!i = map the (get_labels d' n'))\"\n  apply(induct n arbitrary: d \\<pi> \\<alpha> w e)\n   apply(rename_tac d \\<pi> \\<alpha> w e)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d \\<alpha> w)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(subgoal_tac \"nat_seq (Suc 0) 0=[]\")\n    apply(rename_tac d \\<alpha> w)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"map (\\<lambda>x. []) \\<alpha>\"\n      in exI)\n    apply(rule context_conjI)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(rule foldl_empty)\n     apply(rename_tac d \\<alpha> w a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d \\<alpha> w)(*strict*)\n    apply(rule context_conjI)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(simp add: get_label_def)\n    apply(rename_tac d \\<alpha> w)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"map filterB \\<alpha>\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(rule liftB_inj)\n     apply(rule sym)\n     apply(rule_tac\n      t=\"liftB w\"\n      and s=\"foldl (@) [] \\<alpha>\"\n      in ssubst)\n      apply(rename_tac d \\<alpha> w)(*strict*)\n      apply(force)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(rule_tac\n      t=\"liftB (foldl (@) [] (map filterB \\<alpha>))\"\n      and s=\"(foldl (@) [] (map liftB (map filterB \\<alpha>)))\"\n      in ssubst)\n      apply(rename_tac d \\<alpha> w)(*strict*)\n      apply(rule distrib_liftB_foldl)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(clarsimp)\n     apply(rule_tac\n      t=\"(map (liftB \\<circ> filterB) \\<alpha>)\"\n      and s=\"\\<alpha>\"\n      in ssubst)\n      apply(rename_tac d \\<alpha> w)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply(rule listEqI)\n      apply(rename_tac d \\<alpha> w)(*strict*)\n      apply (metis length_map)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"setA (\\<alpha>!i)={}\")\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply (metis liftBDeConv2)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule order_antisym)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule_tac\n      B=\"setA (liftB w)\"\n      in subset_trans)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      prefer 2\n      apply(simp (no_asm))\n      apply(rule setA_liftB)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(subgoal_tac \"set(\\<alpha>!i)\\<subseteq> set(liftB w)\")\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(rule set_subset_to_setA_subset)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule_tac\n      t=\"liftB w\"\n      and s=\"foldl (@) [] \\<alpha>\"\n      in ssubst)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule set_nth_foldl)\n     apply(force)\n    apply(rename_tac d \\<alpha> w)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w)(*strict*)\n     apply (metis length_map)\n    apply(rename_tac d \\<alpha> w)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d \\<alpha> w i)(*strict*)\n    apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf=\\<alpha>!i\\<rparr>\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule cfgLM.der1_is_derivation)\n    apply(rename_tac d \\<alpha> w i)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule cfgLM.der1_belongs)\n     apply(subgoal_tac \"\\<lparr>cfg_conf = foldl (@) [] \\<alpha>\\<rparr> \\<in> cfg_configurations G\")\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(simp add: cfg_configurations_def)\n      apply(rule conjI)\n       apply(rename_tac d \\<alpha> w i)(*strict*)\n       apply(rule_tac\n      B=\"setA (foldl (@) [] \\<alpha>)\"\n      in subset_trans)\n        apply(rename_tac d \\<alpha> w i)(*strict*)\n        apply(rule set_subset_to_setA_subset)\n        apply(rule set_nth_foldl)\n        apply(force)\n       apply(rename_tac d \\<alpha> w i)(*strict*)\n       apply(force)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(rule_tac\n      B=\"setB (foldl (@) [] \\<alpha>)\"\n      in subset_trans)\n       apply(rename_tac d \\<alpha> w i)(*strict*)\n       apply(rule set_subset_to_setB_subset)\n       apply(rule set_nth_foldl)\n       apply(force)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule cfgLM.belongs_configurations)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(force)\n    apply(rename_tac d \\<alpha> w i)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(simp add: der1_def)\n    apply(rename_tac d \\<alpha> w i)(*strict*)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule_tac\n      x=\"None\"\n      in exI)\n     apply(simp add: der1_def)\n     apply(subgoal_tac \"setA (\\<alpha>!i) = {}\")\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply (metis liftBDeConv2)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule order_antisym)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule_tac\n      B=\"setA (foldl (@) [] \\<alpha>)\"\n      in subset_trans)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(rule set_subset_to_setA_subset)\n      apply(rule set_nth_foldl)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply(rule_tac\n      t=\"foldl (@) [] \\<alpha>\"\n      and s=\"liftB w\"\n      in ssubst)\n      apply(rename_tac d \\<alpha> w i)(*strict*)\n      apply(force)\n     apply(rename_tac d \\<alpha> w i)(*strict*)\n     apply (metis setA_liftB empty_subsetI)\n    apply(rename_tac d \\<alpha> w i)(*strict*)\n    apply (metis)\n   apply(rename_tac d \\<alpha> w)(*strict*)\n   apply (metis nat_seqEmpty zero_less_Suc)\n  apply(rename_tac n d \\<pi> \\<alpha> w e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> d (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   apply(rename_tac n d \\<alpha> w e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc n\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac n d \\<alpha> w e)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> w e)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> w e)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e e2 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e e2 c2 l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac n d \\<alpha> w e e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e e2 l r)(*strict*)\n  apply(subgoal_tac \"\\<exists>n l1 l2 r1 r2. n<length \\<alpha> \\<and>l1=foldl (@) [] (take n \\<alpha>) \\<and> l1@l2=l \\<and> r1=foldl (@) [] (drop (Suc n) \\<alpha>) \\<and> r=r2@r1 \\<and> \\<alpha>!n=l2@[teA(prod_lhs e2)]@r2\")\n   apply(rename_tac n d \\<alpha> w e e2 l r)(*strict*)\n   prefer 2\n   apply(rule single_element_in_some_slice)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 l r)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(erule_tac\n      x=\"derivation_drop d (Suc 0)\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"map the (get_labels (derivation_drop d (Suc 0)) n)\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"(take na \\<alpha>)@[l2 @ prod_rhs e2 @ r2]@(drop (Suc na) \\<alpha>)\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"w\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"(case n of 0 \\<Rightarrow> None | Suc n \\<Rightarrow> e)\"\n      in meta_allE)\n  apply(erule meta_impE)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(rule cfgLM.derivation_drop_preserves_derivation_prime)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(rule cfgLM.derivation_drop_preserves_belongs)\n     apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(subgoal_tac \"foldl (@) [] (take na \\<alpha> @ [l2 @ prod_rhs e2 @ r2] @ drop (Suc na) \\<alpha>)=foldl (@) [] (take na \\<alpha>) @ l2 @ prod_rhs e2 @ r2 @ foldl (@) [] (drop (Suc na) \\<alpha>)\")\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"foldl (@) [] (take na \\<alpha> @ [l2 @ prod_rhs e2 @ r2] @ drop (Suc na) \\<alpha>)\"\n      and s=\" (foldl (@) [] (take na \\<alpha>))@(foldl (@) [] ([l2 @ prod_rhs e2@ r2] @ drop (Suc na) \\<alpha>))\"\n      in ssubst)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n    apply(rule foldl_distrib_append)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(rule_tac\n      t=\"foldl (@) [] ([l2 @ prod_rhs e2 @ r2] @ drop (Suc na) \\<alpha>)\"\n      and s=\"(foldl (@) [] ([l2 @ prod_rhs e2 @ r2]))@(foldl (@) [] (drop (Suc na) \\<alpha>))\"\n      in ssubst)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n    apply(rule foldl_distrib_append)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(simp add: derivation_drop_def)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(clarsimp)\n  apply(erule meta_impE)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n   apply(simp add: derivation_drop_def)\n   apply(case_tac n)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 nat)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2 nat)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2)(*strict*)\n  apply(erule exE)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n  apply(rule_tac\n      x=\"(take na \\<pi>s @ [e2#(\\<pi>s!na)] @ drop (Suc na) \\<pi>s)\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n   apply(rule_tac\n      t=\"foldl (@) [] (take na \\<pi>s @ [e2 # \\<pi>s ! na] @ drop (Suc na) \\<pi>s)\"\n      and s=\"e2#(foldl (@) [] \\<pi>s)\"\n      in ssubst)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n    prefer 2\n    apply(rule_tac\n      t=\"foldl (@) [] \\<pi>s\"\n      and s=\"map the (get_labels (derivation_drop d (Suc 0)) n)\"\n      in ssubst)\n     apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n    apply(simp (no_asm) add: get_labels_def)\n    apply(rule listEqI)\n     apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n     apply (metis gr0I list.size(3) nat_seqEmpty nat_seq_length_Suc0 zero_less_Suc)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s i)(*strict*)\n    apply(simp (no_asm))\n    apply(rule impI)\n    apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) (Suc n)) ! i\"\n      and s=\"(the \\<circ> (\\<lambda>i. get_label (d i))) ((nat_seq (Suc 0) (Suc n)) ! i)\"\n      in ssubst)\n     apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s i)(*strict*)\n     apply(rule nth_map)\n     apply (metis gr0I length_0_conv nat_seqEmpty nat_seq_length_Suc0 zero_less_Suc)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s i)(*strict*)\n    apply(case_tac i)\n     apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s i)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n     apply(subgoal_tac \"nat_seq (Suc 0) (Suc n) = Suc 0 # (nat_seq (Suc (Suc 0)) (Suc n))\")\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n      apply(clarsimp)\n      apply(simp add: get_label_def)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n     apply (metis less_eq_Suc_le_raw nat_seq_pullout zero_less_Suc)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s i nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s nat ws)(*strict*)\n    apply(subgoal_tac \"nat_seq (Suc 0) (Suc n) ! Suc nat = (Suc 0)+(Suc nat)\")\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s nat ws)(*strict*)\n     prefer 2\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s nat ws)(*strict*)\n      apply(force)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s nat ws)(*strict*)\n     apply (metis Suc_leI diff_Suc_Suc less_zeroE list.size(3) minus_nat.diff_0 nat_seqEmpty nat_seq_length_Suc0 not_less_eq)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s nat ws)(*strict*)\n    apply(subgoal_tac \"nat_seq (Suc 0) n ! nat = (Suc 0)+nat\")\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s nat ws)(*strict*)\n     prefer 2\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s nat ws)(*strict*)\n      apply (metis Suc_leI gr0I lessI list.size(3) nat_seqEmpty not_less0)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s nat ws)(*strict*)\n     apply (metis Nat.add_0_right Suc_leI add_Suc_right add_leD2 gr0I le_diff_conv2 length_0_conv nat_seqEmpty nat_seq_length_Suc0 zero_less_Suc)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s nat ws)(*strict*)\n    apply(clarsimp)\n    apply(simp add: derivation_drop_def)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n   apply(rule empty_foldl_ignore)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n   apply(rule foldl_empty)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s a)(*strict*)\n   apply(case_tac a)\n    apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s a)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s a aa list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s aa list ws)(*strict*)\n   apply(subgoal_tac \"\\<exists>na'<(length(take na \\<pi>s)). aa#list=(take na \\<pi>s)!na'\")\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s aa list ws)(*strict*)\n    prefer 2\n    apply (metis in_set_conv_nth)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s aa list ws)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s aa list ws na')(*strict*)\n   apply(erule_tac\n      x=\"na'\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' n' e' z zs)(*strict*)\n   apply(case_tac n')\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' n' e' z zs)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' z zs)(*strict*)\n    apply(simp add: get_labels_def)\n    apply(clarsimp)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' za zsa)(*strict*)\n    apply (metis lessI list.simps(2) nat_seqEmpty)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' n' e' z zs nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d' 0 = Some (pair e1 c1) \\<and> d' (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat)(*strict*)\n      apply(force)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n   apply(subgoal_tac \"prod_lhs e2a \\<in> setA (foldl (@) [] (take na \\<alpha>) @ l2)\")\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n    apply(subgoal_tac \"prod_lhs e2a \\<notin>setA (foldl (@) [] (take na \\<alpha>) @ l2)\")\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n    apply(rule_tac\n      t=\"setA (foldl (@) [] (take na \\<alpha>) @ l2)\"\n      and s=\"{}\"\n      in ssubst)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n   apply(rule_tac\n      A=\"setA (foldl (@) [] (take na \\<alpha>))\"\n      in set_mp)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n    apply (metis setA_Concat2 subset_iff_psubset_eq)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n   apply(subgoal_tac \"teA (prod_lhs e2a) \\<in> set (foldl (@) [] (take na \\<alpha>))\")\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n    apply (metis setA_set_not)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n   apply(rule_tac\n      A=\"set ((take na \\<alpha>)!na')\"\n      in set_mp)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n    apply(rule set_nth_foldl)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n   apply(rule_tac\n      t=\"take na \\<alpha> ! na'\"\n      and s=\"(take na \\<alpha> @ (l2 @ prod_rhs e2 @ r2) # drop (Suc na) \\<alpha>) ! na'\"\n      in ssubst)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n    apply(rule nth_appendX)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws na' d' e' z zs nat e2a c2 l r)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s)(*strict*)\n  apply(clarify)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(rule_tac\n      x=\"ws\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(subgoal_tac \"min (length \\<alpha>) na = na\")\n   apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   prefer 2\n   apply(rule Orderings.min_absorb2)\n   apply(force)\n  apply(rename_tac n d \\<alpha> w e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(subgoal_tac \"(Suc (length \\<alpha> - Suc 0)) = length \\<alpha>\")\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i)(*strict*)\n  apply(thin_tac \"min (length \\<alpha>) na = na\")\n  apply(thin_tac \"Suc (length \\<alpha> - Suc 0) = length \\<alpha>\")\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n  apply(case_tac \"i=na\")\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"d'\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply (metis nth_list_update_neq upd_conv_take_nth_drop)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(rule_tac\n      x=\"n'\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"(take na \\<pi>s @ (e2 # \\<pi>s ! na) # drop (Suc na) \\<pi>s) ! i\"\n      and s=\"\\<pi>s!i\"\n      in ssubst)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n    apply (metis nth_list_update_neq upd_conv_take_nth_drop)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws i d' n' e')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule_tac\n      x=\"derivation_append (der2 \\<lparr>cfg_conf = l2 @ teA (prod_lhs e2) # r2\\<rparr> e2 \\<lparr>cfg_conf = l2 @ prod_rhs e2 @ r2\\<rparr>) d' (Suc 0)\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(rule cfgLM.derivation_append_preserves_derivation)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(rule cfgLM.der2_is_derivation)\n     apply(simp add: cfgLM_step_relation_def)\n     apply(rule_tac\n      x=\"l2\"\n      in exI)\n     apply(rule_tac\n      x=\"r2\"\n      in exI)\n     apply(clarsimp)\n     apply(simp add: setAConcat)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(simp add: der2_def)\n   apply(rule hlp1)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(rule cfgLM.derivation_belongs)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n      apply(force)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(simp add: derivation_append_def der2_def)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(rule_tac\n      s=\"\\<alpha> ! na\"\n      in ssubst)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(subgoal_tac \"\\<lparr>cfg_conf = foldl (@) [] \\<alpha>\\<rparr> \\<in> cfg_configurations G\")\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(subgoal_tac \"set (\\<alpha>!na) \\<subseteq> set (foldl (@) [] \\<alpha>)\")\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n      apply(subgoal_tac \"setA (\\<alpha>!na) \\<subseteq> setA (foldl (@) [] \\<alpha>)\")\n       apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n       apply(subgoal_tac \"setB (\\<alpha>!na) \\<subseteq> setB (foldl (@) [] \\<alpha>)\")\n        apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n        apply(simp add: cfg_configurations_def)\n        apply(force)\n       apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n       apply(rule set_subset_to_setB_subset)\n       apply(force)\n      apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n      apply(rule set_subset_to_setA_subset)\n      apply(force)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(rule set_nth_foldl)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(rule cfgLM.belongs_configurations)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n     apply(force)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule_tac\n      x=\"Suc n'\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(rule_tac\n      x=\"if n'=0 then Some e2 else e'\"\n      in exI)\n   apply(simp add: derivation_append_def der2_def)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d')(*strict*)\n   apply(rule hlp1)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule_tac\n      t=\"(take na \\<pi>s @ (e2 # map the (get_labels d' n')) # drop (Suc na) \\<pi>s) ! na\"\n      and s=\"e2 # map the (get_labels d' n')\"\n      in ssubst)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(rule sym)\n   apply(rule hlp1)\n   apply(force)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n  apply(rule listEqI)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_labels_def)\n   apply (metis list.size(3) nat_seqEmpty nat_seq_length_Suc0 neq0_conv zero_less_Suc)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' i)(*strict*)\n  apply(clarsimp)\n  apply(case_tac i)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply(simp add: get_labels_def)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc n')=Suc 0#(nat_seq (Suc (Suc 0)) (Suc n'))\")\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n    apply(clarsimp)\n    apply(simp add: get_label_def derivation_append_def der2_def)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e')(*strict*)\n   apply (metis less_eq_Suc_le_raw nat_seq_pullout zero_less_Suc)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(rule_tac\n      t=\"nat_seq (Suc 0) n' ! nat\"\n      and s=\"Suc 0+nat\"\n      in ssubst)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n    apply(case_tac n')\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' nat)(*strict*)\n     apply (metis less_zeroE list.size(3) nat_seqEmpty zero_less_Suc)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat nata)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n   apply (metis Suc_le_mono Suc_pred gr_implies_not0 length_0_conv less_eq_Suc_le_raw nat_seqEmpty nat_seq_length_Suc0 not_less_eq)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"nat_seq (Suc 0) (Suc n') ! (Suc nat) = (Suc 0)+(Suc nat)\")\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n    apply(force)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n   apply(clarsimp)\n   apply (metis gr_implies_not0 length_0_conv less_eq_Suc_le_raw nat_seqEmpty nat_seq_length_Suc0 not_less_eq)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"map (\\<lambda>a. the (get_label (derivation_append (der2 \\<lparr>cfg_conf = l2 @ teA (prod_lhs e2) # r2\\<rparr> e2 \\<lparr>cfg_conf = l2 @ prod_rhs e2 @ r2\\<rparr>) d' (Suc 0) a))) (nat_seq (Suc 0) (Suc n')) ! Suc nat\"\n      and s=\" (\\<lambda>a. the (get_label (derivation_append (der2 \\<lparr>cfg_conf = l2 @ teA (prod_lhs e2) # r2\\<rparr> e2 \\<lparr>cfg_conf = l2 @ prod_rhs e2 @ r2\\<rparr>) d' (Suc 0) a))) ((nat_seq (Suc 0) (Suc n')) ! Suc nat)\"\n      in ssubst)\n   apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n   apply(rule nth_map)\n   apply (metis Suc_less_eq length_0_conv nat_seqEmpty nat_seq_length_Suc0 neq0_conv zero_less_Suc)\n  apply(rename_tac n d \\<alpha> e e2 na l2 r2 \\<pi>s ws d' n' e' nat)(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_label_def derivation_append_def der2_def)\n  done\n\nlemma equal_labels_implies_equal_cfgLMderivation: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d'\n  \\<Longrightarrow> cfgLM.derivation G d'a\n  \\<Longrightarrow> d' 0 = d'a 0\n  \\<Longrightarrow> i\\<le>n\n  \\<Longrightarrow> d' (n+m1) \\<noteq> None\n  \\<Longrightarrow> d'a (n+m2) \\<noteq> None\n  \\<Longrightarrow> map the (get_labels d' (n+m1)) @ c = map the (get_labels d'a (n + m2))\n  \\<Longrightarrow> d' i = d'a i\"\n  apply(induct i)\n   apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d' i = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+m1\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i y ya)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d'a i = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+m2\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r la ra)(*strict*)\n  apply(case_tac c2a)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a l r la ra)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c2 e2a l r la ra)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac i y ya e1 e2 c2 e2a l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(subgoal_tac \"e2=e2a\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n   apply(subgoal_tac \"l=la\")\n    apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n   apply(subgoal_tac \"\\<exists>l'. liftB l' = l\")\n    apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n    apply (metis liftBDeConv2)\n   apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i y ya e1 e2a r la ra l')(*strict*)\n   apply(thin_tac \"setA (liftB l') = {}\")\n   apply(subgoal_tac \"\\<exists>la'. liftB la' = la\")\n    apply(rename_tac i y ya e1 e2a r la ra l')(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB la\"\n      in exI)\n    apply (metis liftBDeConv2)\n   apply(rename_tac i y ya e1 e2a r la ra l')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i y ya e1 e2a r ra l' la')(*strict*)\n   apply(thin_tac \"setA (liftB la') = {}\")\n   apply(rule terminalHeadEquals1)\n     apply(rename_tac i y ya e1 e2a r ra l' la')(*strict*)\n     apply (metis setA_liftB)\n    apply(rename_tac i y ya e1 e2a r ra l' la')(*strict*)\n    apply (metis setA_liftB)\n   apply(rename_tac i y ya e1 e2a r ra l' la')(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(subgoal_tac \"(map the (get_labels d' (n + m1)) @ c)!i = (map the (get_labels d'a (n + m2)))!i\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(thin_tac \"map the (get_labels d' (n + m1)) @ c = map the (get_labels d'a (n + m2))\")\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (n + m1)) = (n+m1) + 1 - (Suc 0)\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (n + m2)) = (n+m2) + 1 - (Suc 0)\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"(map (the \\<circ> (\\<lambda>i. get_label (d' i))) (nat_seq (Suc 0) (n + m1)) @ c) ! i = (map (the \\<circ> (\\<lambda>i. get_label (d' i))) (nat_seq (Suc 0) (n + m1))) ! i\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule sym)\n   apply(rule nth_appendX)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"nat_seq (Suc 0) (n + m1) ! i = (Suc 0)+i\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(subgoal_tac \"nat_seq (Suc 0) (n + m2) ! i = (Suc 0)+i\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_label_def)\n  done\n\nlemma lemma_4_6_uniqueness_hlp2: \"\n  (\\<And>y. y < x \\<Longrightarrow> x1 ! y = x2 ! y \\<and> y1 ! y = y2 ! y)\n  \\<Longrightarrow> valid_cfg G\\<Longrightarrow> cfgLM.derivation G d\\<Longrightarrow>\n         cfgLM.belongs G d\\<Longrightarrow>\n         d 0 = Some (pair None \\<lparr>cfg_conf = foldl (@) [] \\<alpha>\\<rparr>)\\<Longrightarrow>\n         d n = Some (pair e \\<lparr>cfg_conf = liftB (foldl (@) [] y1)\\<rparr>)\\<Longrightarrow> x < length \\<alpha>\\<Longrightarrow>\n         foldl (@) [] x1 = map the (get_labels d n)\\<Longrightarrow>\n         foldl (@) [] x2 = map the (get_labels d n)\\<Longrightarrow> length x1 = length \\<alpha>\\<Longrightarrow>\n         length x2 = length \\<alpha>\\<Longrightarrow> foldl (@) [] y2 = foldl (@) [] y1\\<Longrightarrow>\n         length y1 = length \\<alpha>\\<Longrightarrow>\n         \\<forall>i<length \\<alpha>.\n            \\<exists>d'. cfgLM.derivation G d' \\<and>\n                 cfgLM.belongs G d' \\<and>\n                 d' 0 = Some (pair None \\<lparr>cfg_conf = \\<alpha> ! i\\<rparr>) \\<and>\n                 (\\<exists>n'. (\\<exists>e'. d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (y1 ! i)\\<rparr>)) \\<and>\n                       x1 ! i = map the (get_labels d' n'))\\<Longrightarrow>\n         length y2 = length \\<alpha>\\<Longrightarrow>\n         \\<forall>i<length \\<alpha>.\n            \\<exists>d'. cfgLM.derivation G d' \\<and>\n                 cfgLM.belongs G d' \\<and>\n                 d' 0 = Some (pair None \\<lparr>cfg_conf = \\<alpha> ! i\\<rparr>) \\<and>\n                 (\\<exists>n'. (\\<exists>e'. d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (y2 ! i)\\<rparr>)) \\<and>\n                       x2 ! i = map the (get_labels d' n'))\\<Longrightarrow>\n         (x1 ! x) \\<sqsubseteq> (x2 ! x)\n        \\<Longrightarrow> x1 ! x = x2 ! x \\<and> y1 ! x = y2 ! x\"\n  apply(rule context_conjI)\n   apply(erule_tac\n      x=\"x\"\n      in allE)+\n   apply(clarsimp)\n   apply(rename_tac d' d'a n' n'a e' e'a)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac d' d'a n' n'a e' e'a c)(*strict*)\n   apply(subgoal_tac \"c=[]\")\n    apply(rename_tac d' d'a n' n'a e' e'a c)(*strict*)\n    apply(force)\n   apply(rename_tac d' d'a n' n'a e' e'a c)(*strict*)\n   apply(case_tac n')\n    apply(rename_tac d' d'a n' n'a e' e'a c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d' d'a n'a e'a c)(*strict*)\n    apply(case_tac n'a)\n     apply(rename_tac d' d'a n'a e'a c)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac d' d'a c)(*strict*)\n     apply(simp add: get_labels_def)\n     apply(subgoal_tac \"nat_seq (Suc 0) 0=[]\")\n      apply(rename_tac d' d'a c)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac d' d'a c)(*strict*)\n     apply (metis nat_seqEmpty zero_less_Suc)\n    apply(rename_tac d' d'a n'a e'a c nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d' d'a e'a c nat)(*strict*)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d'a 0 = Some (pair e1 c1) \\<and> d'a (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n     apply(rename_tac d' d'a e'a c nat)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac d' d'a e'a c nat)(*strict*)\n       apply(force)\n      apply(rename_tac d' d'a e'a c nat)(*strict*)\n      apply(force)\n     apply(rename_tac d' d'a e'a c nat)(*strict*)\n     apply(force)\n    apply(rename_tac d' d'a e'a c nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d' d'a e'a c nat e2 c2)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac d' d'a e'a c nat e2 c2 l r)(*strict*)\n    apply (metis setA_liftB all_not_in_conv elemInsetA)\n   apply(rename_tac d' d'a n' n'a e' e'a c nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d' d'a n'a e' e'a c nat)(*strict*)\n   apply(case_tac n'a)\n    apply(rename_tac d' d'a n'a e' e'a c nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d' d'a e' c nat)(*strict*)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d' 0 = Some (pair e1 c1) \\<and> d' (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n     apply(rename_tac d' d'a e' c nat)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac d' d'a e' c nat)(*strict*)\n       apply(force)\n      apply(rename_tac d' d'a e' c nat)(*strict*)\n      apply(force)\n     apply(rename_tac d' d'a e' c nat)(*strict*)\n     apply(force)\n    apply(rename_tac d' d'a e' c nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d' d'a e' c nat e2 c2)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac d' d'a e' c nat e2 c2 l r)(*strict*)\n    apply (metis setA_liftB all_not_in_conv elemInsetA)\n   apply(rename_tac d' d'a n'a e' e'a c nat nata)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d' d'a e' e'a c nat nata)(*strict*)\n   apply(rename_tac n' n'a)\n   apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n   apply(subgoal_tac \"n'+length c=n'a\")\n    apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n    prefer 2\n    apply(simp add: get_labels_def)\n    apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc n')) = (Suc n') + 1 - (Suc 0)\")\n     apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n     prefer 2\n     apply(rule nat_seq_length_prime)\n    apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n    apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc n'a)) = (Suc n'a) + 1 - (Suc 0)\")\n     apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n     prefer 2\n     apply(rule nat_seq_length_prime)\n    apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n    apply(subgoal_tac \"Suc n'+length c=Suc n'a\")\n     apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n     apply(force)\n    apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n    apply(rule_tac\n      t=\"Suc n'\"\n      and s=\"length(map (the \\<circ> (\\<lambda>i. get_label (d' i))) (nat_seq (Suc 0) (Suc n')))\"\n      in ssubst)\n     apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n     apply(force)\n    apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n    apply(rule_tac\n      t=\"Suc n'a\"\n      and s=\"length(map (the \\<circ> (\\<lambda>i. get_label (d'a i))) (nat_seq (Suc 0) (Suc n'a)))\"\n      in ssubst)\n     apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n     apply(force)\n    apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n    apply(rule_tac\n      t=\"length (map (the \\<circ> (\\<lambda>i. get_label (d' i))) (nat_seq (Suc 0) (Suc n'))) + length c\"\n      and s=\"length(map (the \\<circ> (\\<lambda>i. get_label (d' i))) (nat_seq (Suc 0) (Suc n')) @ c)\"\n      in ssubst)\n     apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n     apply (metis One_nat_def length_append)\n    apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n    apply(force)\n   apply(rename_tac d' d'a e' e'a c n' n'a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d' d'a e' e'a c n')(*strict*)\n   apply(subgoal_tac \"\\<forall>i\\<le>Suc n'. d' i = d'a i\")\n    apply(rename_tac d' d'a e' e'a c n')(*strict*)\n    apply(erule_tac\n      x=\"Suc n'\"\n      in allE)\n    apply(clarsimp)\n    apply(case_tac c)\n     apply(rename_tac d' d'a e' e'a c n')(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d' d'a e' e'a c n' a list)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d' d'a e' e'a n' a list)(*strict*)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d'a (Suc n') = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n     apply(rename_tac d' d'a e' e'a n' a list)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"(Suc (Suc (n' + length list)))\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac d' d'a e' e'a n' a list)(*strict*)\n       apply(force)\n      apply(rename_tac d' d'a e' e'a n' a list)(*strict*)\n      apply(force)\n     apply(rename_tac d' d'a e' e'a n' a list)(*strict*)\n     apply(force)\n    apply(rename_tac d' d'a e' e'a n' a list)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d' d'a e' e'a n' a list e2 c2)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac d' d'a e' e'a n' a list e2 c2 l r)(*strict*)\n    apply (metis setA_liftB all_not_in_conv elemInsetA)\n   apply(rename_tac d' d'a e' e'a c n')(*strict*)\n   apply(rule allI)\n   apply(rename_tac d' d'a e' e'a c n' i)(*strict*)\n   apply(rule impI)\n   apply(rule_tac ?m1.0=\"0\" and ?m2.0=\"length c\" in equal_labels_implies_equal_cfgLMderivation )\n          apply(rename_tac d' d'a e' e'a c n' i)(*strict*)\n          apply(force)\n         apply(rename_tac d' d'a e' e'a c n' i)(*strict*)\n         apply(force)\n        apply(rename_tac d' d'a e' e'a c n' i)(*strict*)\n        apply(force)\n       apply(rename_tac d' d'a e' e'a c n' i)(*strict*)\n       apply(force)\n      apply(rename_tac d' d'a e' e'a c n' i)(*strict*)\n      apply(force)\n     apply(rename_tac d' d'a e' e'a c n' i)(*strict*)\n     apply(force)\n    apply(rename_tac d' d'a e' e'a c n' i)(*strict*)\n    apply(force)\n   apply(rename_tac d' d'a e' e'a c n' i)(*strict*)\n   apply(force)\n  apply(clarsimp)\n  apply(thin_tac \"(x2 ! x) \\<sqsubseteq> (x2 ! x)\")\n  apply(erule_tac\n      x=\"x\"\n      in allE)+\n  apply(clarsimp)\n  apply(rename_tac d' d'a n' n'a e' e'a)(*strict*)\n  apply(subgoal_tac \"n'=n'a\")\n   apply(rename_tac d' d'a n' n'a e' e'a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d' d'a n'a e' e'a)(*strict*)\n   apply(case_tac n'a)\n    apply(rename_tac d' d'a n'a e' e'a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d' d'a)(*strict*)\n    apply(rule liftB_inj)\n    apply(force)\n   apply(rename_tac d' d'a n'a e' e'a nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d' d'a e' e'a nat)(*strict*)\n   apply(subgoal_tac \"\\<forall>i\\<le>Suc nat. d' i = d'a i\")\n    apply(rename_tac d' d'a e' e'a nat)(*strict*)\n    apply(erule_tac\n      x=\"Suc nat\"\n      in allE)\n    apply(clarsimp)\n    apply(rename_tac d' d'a e' nat)(*strict*)\n    apply(rule liftB_inj)\n    apply(rule sym)\n    apply(force)\n   apply(rename_tac d' d'a e' e'a nat)(*strict*)\n   apply(rule allI)\n   apply(rename_tac d' d'a e' e'a nat i)(*strict*)\n   apply(rule impI)\n   apply(rule_tac ?m1.0=\"0\" and ?m2.0=\"0\" in equal_labels_implies_equal_cfgLMderivation )\n          apply(rename_tac d' d'a e' e'a nat i)(*strict*)\n          apply(force)\n         apply(rename_tac d' d'a e' e'a nat i)(*strict*)\n         apply(force)\n        apply(rename_tac d' d'a e' e'a nat i)(*strict*)\n        apply(force)\n       apply(rename_tac d' d'a e' e'a nat i)(*strict*)\n       apply(force)\n      apply(rename_tac d' d'a e' e'a nat i)(*strict*)\n      apply(force)\n     apply(rename_tac d' d'a e' e'a nat i)(*strict*)\n     apply(force)\n    apply(rename_tac d' d'a e' e'a nat i)(*strict*)\n    apply(force)\n   apply(rename_tac d' d'a e' e'a nat i)(*strict*)\n   apply(force)\n  apply(rename_tac d' d'a n' n'a e' e'a)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n'a) = (n'a) + 1 - (Suc 0)\")\n   apply(rename_tac d' d'a n' n'a e' e'a)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac d' d'a n' n'a e' e'a)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n') = (n') + 1 - (Suc 0)\")\n   apply(rename_tac d' d'a n' n'a e' e'a)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac d' d'a n' n'a e' e'a)(*strict*)\n  apply(clarsimp)\n  apply (metis length_map)\n  done\n\nlemma lemma_4_6_uniqueness_hlp1: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = foldl (@) [] \\<alpha>\\<rparr>)\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>)\n  \\<Longrightarrow> \\<pi>=map the (get_labels d n)\n  \\<Longrightarrow> foldl (@) [] x1 = \\<pi> \\<and>\n        length x1 = length \\<alpha> \\<and>\n        foldl (@) [] y1 = w \\<and>\n        length y1 = length \\<alpha> \\<and>\n        (\\<forall>i<length x1.\n            \\<exists>d' n' e'.\n               cfgLM.derivation G d' \\<and>\n               cfgLM.belongs G d' \\<and>\n               d' 0 = Some (pair None \\<lparr>cfg_conf = \\<alpha> ! i\\<rparr>) \\<and>\n               d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (y1 ! i)\\<rparr>) \\<and>\n               x1 ! i = map the (get_labels d' n'))\n  \\<Longrightarrow>\n        foldl (@) [] x2 = \\<pi> \\<and>\n        length x2 = length \\<alpha> \\<and>\n        foldl (@) [] y2 = w \\<and>\n        length y2 = length \\<alpha> \\<and>\n        (\\<forall>i<length x2.\n            \\<exists>d' n' e'.\n               cfgLM.derivation G d' \\<and>\n               cfgLM.belongs G d' \\<and>\n               d' 0 = Some (pair None \\<lparr>cfg_conf = \\<alpha> ! i\\<rparr>) \\<and>\n               d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (y2 ! i)\\<rparr>) \\<and>\n               x2 ! i = map the (get_labels d' n'))\n  \\<Longrightarrow> i < length \\<alpha>\n  \\<Longrightarrow> x1 ! i = x2 ! i \\<and> y1 ! i = y2 ! i\"\n  apply(induct i rule: less_induct)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"prefix (x1!x) (x2!x) \\<or> prefix (x2!x) (x1!x)\")\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(rule_tac\n      b=\"foldl (@) [] (drop (Suc x) x1)\"\n      and d=\"foldl (@) [] (drop (Suc x) x2)\"\n      in mutual_prefix_prefix)\n   apply(rule_tac\n      w=\"foldl (@) [] (take x x1)\"\n      in append_linj)\n   apply(rule_tac\n      t=\"foldl (@) [] (take x x1) @ x2 ! x @ foldl (@) [] (drop (Suc x) x2)\"\n      and s=\"foldl (@) [] (take x x2) @ x2 ! x @ foldl (@) [] (drop (Suc x) x2)\"\n      in ssubst)\n    apply(rename_tac x)(*strict*)\n    apply(simp (no_asm))\n    apply(rule foldl_equal)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x y)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(rule_tac\n      t=\"foldl (@) [] (take x x1) @ x1 ! x @ foldl (@) [] (drop (Suc x) x1)\"\n      and s=\"foldl (@) [] x1\"\n      in ssubst)\n    apply(rename_tac x)(*strict*)\n    apply(rule foldl_decomp)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(rule_tac\n      t=\"foldl (@) [] (take x x2) @ x2 ! x @ foldl (@) [] (drop (Suc x) x2)\"\n      and s=\"foldl (@) [] x2\"\n      in ssubst)\n    apply(rename_tac x)(*strict*)\n    apply(rule foldl_decomp)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x)(*strict*)\n   apply(rule lemma_4_6_uniqueness_hlp2)\n                   apply(rename_tac x y)(*strict*)\n                   apply(force)\n                  apply(rename_tac x)(*strict*)\n                  apply(force)\n                 apply(rename_tac x)(*strict*)\n                 apply(force)\n                apply(rename_tac x)(*strict*)\n                apply(force)\n               apply(rename_tac x)(*strict*)\n               apply(force)\n              apply(rename_tac x)(*strict*)\n              apply(force)\n             apply(rename_tac x)(*strict*)\n             apply(force)\n            apply(rename_tac x)(*strict*)\n            apply(force)\n           apply(rename_tac x)(*strict*)\n           apply(force)\n          apply(rename_tac x)(*strict*)\n          apply(force)\n         apply(rename_tac x)(*strict*)\n         apply(force)\n        apply(rename_tac x)(*strict*)\n        apply(force)\n       apply(rename_tac x)(*strict*)\n       apply(force)\n      apply(rename_tac x)(*strict*)\n      apply(force)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(subgoal_tac \"x2 ! x = x1 ! x \\<and> y2 ! x = y1 ! x\")\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(rule lemma_4_6_uniqueness_hlp2)\n                  apply(rename_tac x y)(*strict*)\n                  apply(force)\n                 apply(rename_tac x)(*strict*)\n                 apply(force)\n                apply(rename_tac x)(*strict*)\n                apply(force)\n               apply(rename_tac x)(*strict*)\n               apply(force)\n              apply(rename_tac x)(*strict*)\n              apply(force)\n             apply(rename_tac x)(*strict*)\n             apply(force)\n            apply(rename_tac x)(*strict*)\n            apply(force)\n           apply(rename_tac x)(*strict*)\n           apply(force)\n          apply(rename_tac x)(*strict*)\n          apply(force)\n         apply(rename_tac x)(*strict*)\n         apply(force)\n        apply(rename_tac x)(*strict*)\n        apply(force)\n       apply(rename_tac x)(*strict*)\n       apply(force)\n      apply(rename_tac x)(*strict*)\n      apply(force)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(force)\n  done\n\nlemma lemma_4_6_uniqueness: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = foldl (@) [] \\<alpha>\\<rparr>)\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>)\n  \\<Longrightarrow> \\<pi>=map the (get_labels d n)\n  \\<Longrightarrow> foldl (@) [] x1 = \\<pi> \\<and>\n        length x1 = length \\<alpha> \\<and>\n        foldl (@) [] y1 = w \\<and>\n        length y1 = length \\<alpha> \\<and>\n        (\\<forall>i<length x1.\n            \\<exists>d' n' e'.\n               cfgLM.derivation G d' \\<and>\n               cfgLM.belongs G d' \\<and>\n               d' 0 = Some (pair None \\<lparr>cfg_conf = \\<alpha> ! i\\<rparr>) \\<and>\n               d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (y1 ! i)\\<rparr>) \\<and>\n               x1 ! i = map the (get_labels d' n'))\n  \\<Longrightarrow>\n        foldl (@) [] x2 = \\<pi> \\<and>\n        length x2 = length \\<alpha> \\<and>\n        foldl (@) [] y2 = w \\<and>\n        length y2 = length \\<alpha> \\<and>\n        (\\<forall>i<length x2.\n            \\<exists>d' n' e'.\n               cfgLM.derivation G d' \\<and>\n               cfgLM.belongs G d' \\<and>\n               d' 0 = Some (pair None \\<lparr>cfg_conf = \\<alpha> ! i\\<rparr>) \\<and>\n               d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (y2 ! i)\\<rparr>) \\<and>\n               x2 ! i = map the (get_labels d' n'))\n  \\<Longrightarrow> x1 = x2 \\<and> y1 = y2\"\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<forall>i<(length \\<alpha>). x1!i = x2!i \\<and> y1!i=y2!i\")\n   apply(rule conjI)\n    apply(rule listEqI)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(clarsimp)\n   apply(rule listEqI)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rule allI)\n  apply(rename_tac i)(*strict*)\n  apply(rule impI)\n  apply(rule lemma_4_6_uniqueness_hlp1)\n          apply(rename_tac i)(*strict*)\n          apply(force)+\n  done\n\nlemma lemma_4_6: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = foldl (@) [] \\<alpha>\\<rparr>)\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>)\n  \\<Longrightarrow> \\<pi>=map the (get_labels d n)\n  \\<Longrightarrow> \\<exists>!\\<pi>s. \\<exists>!ws.\n  foldl (@) [] \\<pi>s = \\<pi>\n  \\<and> length \\<pi>s = length \\<alpha>\n  \\<and> foldl (@) [] ws = w\n  \\<and> length ws = length \\<alpha>\n  \\<and> (\\<forall>i<length \\<pi>s. \\<exists>d' n' e'.\n  cfgLM.derivation G d'\n  \\<and> cfgLM.belongs G d'\n  \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=\\<alpha>!i\\<rparr>)\n  \\<and> d' n' = Some (pair e' \\<lparr>cfg_conf=liftB (ws!i)\\<rparr>)\n  \\<and> \\<pi>s!i = map the (get_labels d' n'))\"\n  apply(rule ex_ex1I_double)\n   apply(rule lemma_4_6_existence)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rename_tac x1 y1 x2 y2)(*strict*)\n  apply(rule lemma_4_6_uniqueness)\n         apply(rename_tac x1 y1 x2 y2)(*strict*)\n         apply(force)+\n  done\n\nlemma lemma_4_8_hlp: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = Xseq\\<rparr>)\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>)\n  \\<Longrightarrow> \\<pi>=map the (get_labels d n)\n  \\<Longrightarrow> \\<exists>!\\<pi>s. \\<exists>!ws.\n  foldl (@) [] \\<pi>s = \\<pi>\n  \\<and> length \\<pi>s = length Xseq\n  \\<and> foldl (@) [] ws = w\n  \\<and> length ws = length Xseq\n  \\<and> (\\<forall>i<length \\<pi>s. \\<exists>d' n' e'.\n  cfgLM.derivation G d'\n  \\<and> cfgLM.belongs G d'\n  \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=[Xseq!i]\\<rparr>)\n  \\<and> d' n' = Some (pair e' \\<lparr>cfg_conf=liftB (ws!i)\\<rparr>)\n  \\<and> \\<pi>s!i = map the (get_labels d' n'))\"\n  apply(subgoal_tac \"\\<exists>!\\<pi>s. \\<exists>!ws. foldl (@) [] \\<pi>s = \\<pi> \\<and> length \\<pi>s = length (map (\\<lambda>x. [x]) Xseq) \\<and> foldl (@) [] ws = w \\<and> length ws = length (map (\\<lambda>x. [x]) Xseq) \\<and> (\\<forall>i<length \\<pi>s. \\<exists>d' n' e'. cfgLM.derivation G d' \\<and> cfgLM.belongs G d' \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=(map (\\<lambda>x. [x]) Xseq)!i\\<rparr>) \\<and> d' n' = Some (pair e' \\<lparr>cfg_conf=liftB (ws!i)\\<rparr>) \\<and> \\<pi>s!i = map the (get_labels d' n'))\")\n   prefer 2\n   apply(rule lemma_4_6)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(clarsimp)\n     apply (metis split_string_into_single_item_strings)\n    apply(force)\n   apply(force)\n  apply(rule_tac\n      P=\"\\<lambda>\\<pi>s ws. foldl (@) [] \\<pi>s = \\<pi> \\<and> length \\<pi>s = length (map (\\<lambda>x. [x]) Xseq) \\<and> foldl (@) [] ws = w \\<and> length ws = length (map (\\<lambda>x. [x]) Xseq) \\<and> (\\<forall>i<length \\<pi>s. \\<exists>d' n' e'. cfgLM.derivation G d' \\<and> cfgLM.belongs G d' \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf = map (\\<lambda>x. [x]) Xseq ! i\\<rparr>) \\<and> d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (ws ! i)\\<rparr>) \\<and> \\<pi>s ! i = map the (get_labels d' n'))\"\n      in ex1_eq)\n   apply(force)\n  apply(thin_tac \"\\<exists>!\\<pi>s. \\<exists>!ws. foldl (@) [] \\<pi>s = \\<pi> \\<and> length \\<pi>s = length (map (\\<lambda>x. [x]) Xseq) \\<and> foldl (@) [] ws = w \\<and> length ws = length (map (\\<lambda>x. [x]) Xseq) \\<and> (\\<forall>i<length \\<pi>s. \\<exists>d' n' e'. cfgLM.derivation G d' \\<and> cfgLM.belongs G d' \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf = map (\\<lambda>x. [x]) Xseq ! i\\<rparr>) \\<and> d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (ws ! i)\\<rparr>) \\<and> \\<pi>s ! i = map the (get_labels d' n'))\")\n  apply(clarsimp)\n  apply(rename_tac x y)(*strict*)\n  apply(rule order_antisym)\n   apply(rename_tac x y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x y)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma lemma_4_8: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = [A]\\<rparr>)\n  \\<Longrightarrow> d (Suc 0) = Some (pair (Some r) \\<lparr>cfg_conf = Xseq\\<rparr>)\n  \\<Longrightarrow> d (Suc n) = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>)\n  \\<Longrightarrow> r#\\<pi>=map the (get_labels d (Suc n))\n  \\<Longrightarrow> \\<exists>!\\<pi>s. \\<exists>!ws.\n  foldl (@) [] \\<pi>s = \\<pi>\n  \\<and> length \\<pi>s = length Xseq\n  \\<and> foldl (@) [] ws = w\n  \\<and> length ws = length Xseq\n  \\<and> (\\<forall>i<length \\<pi>s. \\<exists>d' n' e'.\n  cfgLM.derivation G d'\n  \\<and> cfgLM.belongs G d'\n  \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=[Xseq!i]\\<rparr>)\n  \\<and> d' n' = Some (pair e' \\<lparr>cfg_conf=liftB (ws!i)\\<rparr>)\n  \\<and> \\<pi>s!i = map the (get_labels d' n'))\"\n  apply(rule_tac\n      e=\"if n=0 then None else e\"\n      and n=\"n\"\n      and d=\"derivation_drop d (Suc 0)\"\n      in lemma_4_8_hlp)\n       apply(force)\n      apply(rule cfgLM.derivation_drop_preserves_derivation_prime)\n       apply(force)\n      apply(force)\n     apply(rule cfgLM.derivation_drop_preserves_belongs)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(simp add: derivation_drop_def)\n   apply(simp add: derivation_drop_def)\n   apply(force)\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"nat_seq (Suc 0) (Suc n) = Suc 0 # (nat_seq (Suc (Suc 0)) (Suc n))\")\n   apply(clarsimp)\n   apply(rule listEqI)\n    apply(clarsimp)\n    apply (metis length_Cons lessI nat_seqEmpty nat_seq_length_Suc0 not_gr_zero old.nat.inject zero_less_Suc)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"length (nat_seq (Suc (Suc 0)) (Suc n)) = (Suc n) + 1 - (Suc (Suc 0))\")\n    apply(rename_tac i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (derivation_drop d (Suc 0) i))) (nat_seq (Suc 0) n) ! i\"\n      and s=\" (the \\<circ> (\\<lambda>i. get_label (derivation_drop d (Suc 0) i))) ((nat_seq (Suc 0) n) ! i)\"\n      in ssubst)\n    apply(rename_tac i)(*strict*)\n    apply(rule nth_map)\n    apply (metis Suc_less_SucD gr_implies_not0 list.size(3) nat_seqEmpty nat_seq_length_Suc0 not_less_eq)\n   apply(rename_tac i)(*strict*)\n   apply(rule_tac\n      t=\"nat_seq (Suc 0) n ! i\"\n      and s=\"Suc 0 + i\"\n      in ssubst)\n    apply(rename_tac i)(*strict*)\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(rule_tac\n      t=\"nat_seq (Suc (Suc 0)) (Suc n) ! i\"\n      and s=\"(Suc (Suc 0))+i\"\n      in ssubst)\n    apply(rename_tac i)(*strict*)\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_drop_def)\n  apply (metis less_eq_Suc_le_raw nat_seq_pullout zero_less_Suc)\n  done\n\nlemma CFGlm2rm_terminates: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf=[A]\\<rparr>)\n  \\<Longrightarrow> d (Suc 0) = Some (pair e \\<lparr>cfg_conf=Xseq\\<rparr>)\n  \\<Longrightarrow> d (Suc n) = Some (pair e' \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<Longrightarrow> \\<pi>=map the (get_labels d (Suc n))\n  \\<Longrightarrow> CFGlm2rm_dom (G,\\<pi>)\"\n  apply(induct n arbitrary: d A e e' c \\<pi> Xseq w e' rule: less_induct)\n  apply(rename_tac x d A e e' \\<pi> Xseq w)(*strict*)\n  apply(case_tac x)\n   apply(rename_tac x d A e e' \\<pi> Xseq w)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d A e' w)(*strict*)\n   apply(thin_tac \"\\<And>y d A e e' \\<pi> Xseq w. False \\<Longrightarrow> cfgLM.derivation G d \\<Longrightarrow> cfgLM.belongs G d \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = [A]\\<rparr>) \\<Longrightarrow> d (Suc 0) = Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>) \\<Longrightarrow> d (Suc y) = Some (pair e' \\<lparr>cfg_conf = liftB w\\<rparr>) \\<Longrightarrow> \\<pi> = map the (get_labels d (Suc y)) \\<Longrightarrow> CFGlm2rm_dom (G, map the (get_labels d (Suc y)))\")\n   apply(rename_tac d A e' w)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc 0)=[Suc 0]\")\n    apply(rename_tac d A e' w)(*strict*)\n    apply(clarsimp)\n    apply(rule CFGlm2rm.domintros)\n    apply(rename_tac d A e' w xa)(*strict*)\n    apply(subgoal_tac \"xa \\<in> set(map (\\<lambda>x. []) w)\")\n     apply(rename_tac d A e' w xa)(*strict*)\n     prefer 2\n     apply(rule_tac\n      t=\"map (\\<lambda>x. []) w\"\n      and s=\"SOME \\<pi>s. foldl (@) [] \\<pi>s = [] \\<and> length \\<pi>s = length (prod_rhs (the (get_label (Some (pair e' \\<lparr>cfg_conf = liftB w\\<rparr>))))) \\<and> (\\<forall>i<length \\<pi>s. \\<pi>s ! i \\<in> CFGlmEliminators G (Some (prod_rhs (the (get_label (Some (pair e' \\<lparr>cfg_conf = liftB w\\<rparr>)))) ! i)))\"\n      in ssubst)\n      apply(rename_tac d A e' w xa)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac d A e' w xa)(*strict*)\n     prefer 2\n     apply(rename_tac d A e' w xa)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac d A e' w x)(*strict*)\n     apply(rule CFGlm2rm.domintros)\n    apply(rename_tac d A e' w xa)(*strict*)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> d (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n     apply(rename_tac d A e' w xa)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc 0\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac d A e' w xa)(*strict*)\n       apply(force)\n      apply(rename_tac d A e' w xa)(*strict*)\n      apply(force)\n     apply(rename_tac d A e' w xa)(*strict*)\n     apply(force)\n    apply(rename_tac d A e' w xa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d A w xa e2)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac d A w xa e2 l r)(*strict*)\n    apply(case_tac l)\n     apply(rename_tac d A w xa e2 l r)(*strict*)\n     prefer 2\n     apply(rename_tac d A w xa e2 l r a list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d A w xa e2 l r)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d w xa e2)(*strict*)\n    apply(rule_tac\n      a=\"map (\\<lambda>x. []) w\"\n      in someI2)\n     apply(rename_tac d w xa e2)(*strict*)\n     apply(clarsimp)\n     apply(rule context_conjI)\n      apply(rename_tac d w xa e2)(*strict*)\n      apply(rule foldl_empty)\n      apply(rename_tac d w xa e2 a)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac d w xa e2)(*strict*)\n     apply(rule context_conjI)\n      apply(rename_tac d w xa e2)(*strict*)\n      apply(simp add: get_label_def)\n      apply (metis liftB_reflects_length)\n     apply(rename_tac d w xa e2)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac d w xa e2 i)(*strict*)\n     apply(simp add: get_label_def)\n     apply(simp add: CFGlmEliminators_def)\n     apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf=[prod_rhs e2 ! i]\\<rparr>\"\n      in exI)\n     apply(rule conjI)\n      apply(rename_tac d w xa e2 i)(*strict*)\n      apply(rule cfgLM.der1_is_derivation)\n     apply(rename_tac d w xa e2 i)(*strict*)\n     apply(rule conjI)\n      apply(rename_tac d w xa e2 i)(*strict*)\n      apply(rule cfgLM.der1_belongs)\n      apply(simp add: valid_cfg_def)\n      apply(clarsimp)\n      apply(erule_tac\n      x=\"e2\"\n      in ballE)\n       apply(rename_tac d w xa e2 i)(*strict*)\n       prefer 2\n       apply(force)\n      apply(rename_tac d w xa e2 i)(*strict*)\n      apply(clarsimp)\n      apply(simp add: cfg_configurations_def)\n      apply(case_tac \"prod_rhs e2!i\")\n       apply(rename_tac d w xa e2 i a)(*strict*)\n       apply(clarsimp)\n       apply (metis setA_liftB setA_set_not liftB_reflects_length emptyE nth_mem)\n      apply(rename_tac d w xa e2 i b)(*strict*)\n      apply(clarsimp)\n      apply (metis setB_set_not liftB_reflects_length nth_mem set_setB_liftB subsetE)\n     apply(rename_tac d w xa e2 i)(*strict*)\n     apply(rule conjI)\n      apply(rename_tac d w xa e2 i)(*strict*)\n      apply(simp add: der1_def)\n      apply(simp add: option_to_list_def)\n     apply(rename_tac d w xa e2 i)(*strict*)\n     apply(rule_tac\n      x=\"0\"\n      in exI)\n     apply(rule conjI)\n      apply(rename_tac d w xa e2 i)(*strict*)\n      apply(rule_tac\n      x=\"None\"\n      in exI)\n      apply(rule_tac\n      x=\"[w!i]\"\n      in exI)\n      apply(simp add: der1_def)\n      apply(rule_tac\n      t=\"teB (w!i)\"\n      and s=\"(liftB w)!i\"\n      in ssubst)\n       apply(rename_tac d w xa e2 i)(*strict*)\n       apply(rule teB_nth_liftB)\n       apply(force)\n      apply(rename_tac d w xa e2 i)(*strict*)\n      apply(force)\n     apply(rename_tac d w xa e2 i)(*strict*)\n     apply(simp add: get_labels_def)\n     apply (metis nat_seqEmpty zero_less_Suc)\n    apply(rename_tac d w xa e2 x)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d w xa e2 x)(*strict*)\n    apply(rule listEqI)\n     apply(rename_tac d w xa e2 x)(*strict*)\n     apply(clarsimp)\n     apply(simp add: get_label_def)\n     apply (metis liftB_reflects_length)\n    apply(rename_tac d w xa e2 x i)(*strict*)\n    apply(clarsimp)\n    apply(simp add: get_label_def)\n    apply(rule_tac\n      t=\"map (\\<lambda>x. []) w ! i\"\n      and s=\"(\\<lambda>x. []) (w ! i)\"\n      in ssubst)\n     apply(rename_tac d w xa e2 x i)(*strict*)\n     apply(rule nth_map)\n     apply (metis liftB_reflects_length)\n    apply(rename_tac d w xa e2 x i)(*strict*)\n    apply(rule sym)\n    apply(rule foldl_empty2)\n     apply(rename_tac d w xa e2 x i)(*strict*)\n     apply(force)\n    apply(rename_tac d w xa e2 x i)(*strict*)\n    apply (metis liftB_reflects_length)\n   apply(rename_tac d A e' w)(*strict*)\n   apply (metis natUptTo_n_n)\n  apply(rename_tac x d A e e' \\<pi> Xseq w nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d A e e' Xseq w nat)(*strict*)\n  apply(rename_tac n)\n  apply(rename_tac d A e e' Xseq w n)(*strict*)\n  apply(case_tac \"map the (get_labels d (Suc (Suc n)))\")\n   apply(rename_tac d A e e' Xseq w n)(*strict*)\n   apply(clarsimp)\n   apply(rule CFGlm2rm.domintros)\n  apply(rename_tac d A e e' Xseq w n a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d A e e' Xseq w n z zs)(*strict*)\n  apply(rule CFGlm2rm.domintros)\n  apply(rename_tac d A e e' Xseq w n z zs xa)(*strict*)\n  apply(subgoal_tac \"map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (Suc (Suc n))) = z # zs\")\n   apply(rename_tac d A e e' Xseq w n z zs xa)(*strict*)\n   prefer 2\n   apply(simp add: get_labels_def)\n  apply(rename_tac d A e e' Xseq w n z zs xa)(*strict*)\n  apply(thin_tac \"get_labels d (Suc (Suc n)) = z # zs\")\n  apply(subgoal_tac \"nat_seq (Suc 0) (Suc (Suc n)) = Suc 0 # nat_seq (Suc (Suc 0)) (Suc (Suc n))\")\n   apply(rename_tac d A e e' Xseq w n z zs xa)(*strict*)\n   prefer 2\n   apply (metis less_eq_Suc_le_raw nat_seq_pullout zero_less_Suc)\n  apply(rename_tac d A e e' Xseq w n z zs xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n  apply(thin_tac \"nat_seq (Suc 0) (Suc (Suc n)) = Suc 0 # nat_seq (Suc (Suc 0)) (Suc (Suc n))\")\n  apply(subgoal_tac \"\\<exists>\\<pi>s. \\<pi>s=(SOME \\<pi>s. foldl (@) [] \\<pi>s = map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc (Suc 0)) (Suc (Suc n))) \\<and> length \\<pi>s = length (prod_rhs (the (get_label (Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>))))) \\<and> (\\<forall>i<length \\<pi>s. \\<pi>s ! i \\<in> CFGlmEliminators G (Some (prod_rhs (the (get_label (Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>)))) ! i)))) \\<and> (foldl (@) [] \\<pi>s = map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc (Suc 0)) (Suc (Suc n))) \\<and> length \\<pi>s = length (prod_rhs (the (get_label (Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>))))) \\<and> (\\<forall>i<length \\<pi>s. \\<pi>s ! i \\<in> CFGlmEliminators G (Some (prod_rhs (the (get_label (Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>)))) ! i))))\")\n   apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n   apply(erule exE)\n   apply(rename_tac d A e e' Xseq w n xa \\<pi>s)(*strict*)\n   apply(erule conjE)+\n   apply(subgoal_tac \"xa \\<in> set \\<pi>s\")\n    apply(rename_tac d A e e' Xseq w n xa \\<pi>s)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac d A e e' Xseq w n xa \\<pi>s)(*strict*)\n   apply(thin_tac \"xa \\<in> set (SOME \\<pi>s. foldl (@) [] \\<pi>s = map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc (Suc 0)) (Suc (Suc n))) \\<and> length \\<pi>s = length (prod_rhs (the (get_label (Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>))))) \\<and> (\\<forall>i<length \\<pi>s. \\<pi>s ! i \\<in> CFGlmEliminators G (Some (prod_rhs (the (get_label (Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>)))) ! i))))\")\n   apply(rename_tac d A e e' Xseq w n xa \\<pi>s)(*strict*)\n   apply(thin_tac \"\\<pi>s = (SOME \\<pi>s. foldl (@) [] \\<pi>s = map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc (Suc 0)) (Suc (Suc n))) \\<and> length \\<pi>s = length (prod_rhs (the (get_label (Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>))))) \\<and> (\\<forall>i<length \\<pi>s. \\<pi>s ! i \\<in> CFGlmEliminators G (Some (prod_rhs (the (get_label (Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>)))) ! i))))\")\n   apply(rename_tac d A e e' Xseq w n xa \\<pi>s)(*strict*)\n   apply(subgoal_tac \"\\<exists>j<length \\<pi>s. \\<pi>s!j=xa\")\n    apply(rename_tac d A e e' Xseq w n xa \\<pi>s)(*strict*)\n    prefer 2\n    apply (metis in_set_conv_nth)\n   apply(rename_tac d A e e' Xseq w n xa \\<pi>s)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d A e e' Xseq w n \\<pi>s j)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> d (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n    apply(rename_tac d A e e' Xseq w n \\<pi>s j)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc 0\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac d A e e' Xseq w n \\<pi>s j)(*strict*)\n      apply(force)\n     apply(rename_tac d A e e' Xseq w n \\<pi>s j)(*strict*)\n     apply(force)\n    apply(rename_tac d A e e' Xseq w n \\<pi>s j)(*strict*)\n    apply(force)\n   apply(rename_tac d A e e' Xseq w n \\<pi>s j)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d A e' Xseq w n \\<pi>s j e2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac d A e' w n \\<pi>s j e2 l r)(*strict*)\n   apply(case_tac l)\n    apply(rename_tac d A e' w n \\<pi>s j e2 l r)(*strict*)\n    prefer 2\n    apply(rename_tac d A e' w n \\<pi>s j e2 l r a list)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d A e' w n \\<pi>s j e2 l r)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d e' w n \\<pi>s j e2)(*strict*)\n   apply(simp add: get_label_def)\n   apply(case_tac \"\\<pi>s!j\")\n    apply(rename_tac d e' w n \\<pi>s j e2)(*strict*)\n    apply(clarsimp)\n    apply(rule CFGlm2rm.domintros)\n   apply(rename_tac d e' w n \\<pi>s j e2 a list)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"j\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: CFGlmEliminators_def)\n   apply(clarsimp)\n   apply(rename_tac d e' w n \\<pi>s j e2 da na e z wa zs)(*strict*)\n   apply(subgoal_tac \"map (\\<lambda>i. get_label (da i)) (nat_seq (Suc 0) na) = z # zs\")\n    apply(rename_tac d e' w n \\<pi>s j e2 da na e z wa zs)(*strict*)\n    prefer 2\n    apply(simp add: get_labels_def)\n   apply(rename_tac d e' w n \\<pi>s j e2 da na e z wa zs)(*strict*)\n   apply(thin_tac \"get_labels da na = z # zs\")\n   apply(case_tac na)\n    apply(rename_tac d e' w n \\<pi>s j e2 da na e z wa zs)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d e' w n \\<pi>s j e2 da wa za zsa)(*strict*)\n    apply(subgoal_tac \"nat_seq (Suc 0) 0=[]\")\n     apply(rename_tac d e' w n \\<pi>s j e2 da wa za zsa)(*strict*)\n     apply(force)\n    apply(rename_tac d e' w n \\<pi>s j e2 da wa za zsa)(*strict*)\n    apply (metis list.simps(2) nat_seqEmpty zero_less_Suc)\n   apply(rename_tac d e' w n \\<pi>s j e2 da na e z wa zs nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d e' w n \\<pi>s j e2 da e wa nat za zsa)(*strict*)\n   apply(rename_tac n za zsa)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n za zsa)(*strict*)\n   apply(erule_tac\n      x=\"n\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"da\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"prod_rhs e2 ! j\"\n      in meta_allE)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc n) = Suc 0 # (nat_seq (Suc (Suc 0)) (Suc n))\")\n    apply(rename_tac d e' w na \\<pi>s j e2 da e wa n za zsa)(*strict*)\n    prefer 2\n    apply (metis less_eq_Suc_le_raw nat_seq_pullout zero_less_Suc)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n za zsa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n)(*strict*)\n   apply(thin_tac \"nat_seq (Suc 0) (Suc n) = Suc 0 # nat_seq (Suc (Suc 0)) (Suc n)\")\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. da 0 = Some (pair e1 c1) \\<and> da (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n    apply(rename_tac d e' w na \\<pi>s j e2 da e wa n)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc n\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac d e' w na \\<pi>s j e2 da e wa n)(*strict*)\n      apply(force)\n     apply(rename_tac d e' w na \\<pi>s j e2 da e wa n)(*strict*)\n     apply(force)\n    apply(rename_tac d e' w na \\<pi>s j e2 da e wa n)(*strict*)\n    apply(force)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a c2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a c2 l r)(*strict*)\n   apply(simp add: option_to_list_def)\n   apply(case_tac l)\n    apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a c2 l r)(*strict*)\n    prefer 2\n    apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a c2 l r a list)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a c2 l r)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a c2)(*strict*)\n   apply(case_tac c2)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a c2 cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n   apply(erule_tac\n      x=\"Some e2a\"\n      in meta_allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"e\"\n      in meta_allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"map the (get_labels da (Suc n))\"\n      in meta_allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"prod_rhs e2a\"\n      in meta_allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"wa\"\n      in meta_allE)\n   apply(clarsimp)\n   apply(erule meta_impE)\n    apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n    apply(subgoal_tac \"the (get_label (Some (pair (Some e2a) \\<lparr>cfg_conf = prod_rhs e2a\\<rparr>)))=e2a\")\n     apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n     prefer 2\n     apply(simp add: get_label_def)\n    apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n    apply(clarsimp)\n    apply(thin_tac \"the (get_label (Some (pair (Some e2a) \\<lparr>cfg_conf = prod_rhs e2a\\<rparr>))) = e2a\")\n    apply(subgoal_tac \"foldl ((+)) 0 (map length \\<pi>s) = length (foldl (@) [] \\<pi>s)\")\n     apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n     apply(subgoal_tac \"length (\\<pi>s!j) \\<le> length (foldl (@) [] \\<pi>s)\")\n      apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n      apply(subgoal_tac \"length (\\<pi>s!j) = Suc n\")\n       apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n       prefer 2\n       apply(subgoal_tac \"length (nat_seq (Suc (Suc 0)) (Suc n)) = (Suc n) + 1 - (Suc (Suc 0))\")\n        apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n        prefer 2\n        apply(rule nat_seq_length_prime)\n       apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n       apply(rule_tac\n      t=\"\\<pi>s!j\"\n      and s=\"e2a # map (the \\<circ> (\\<lambda>i. get_label (da i))) (nat_seq (Suc (Suc 0)) (Suc n))\"\n      in ssubst)\n        apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n        apply(force)\n       apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n       apply (metis One_nat_def Suc_eq_plus1 diff_Suc_1 diff_Suc_Suc length_map list.size(4) nat_seq_length_prime)\n      apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n      apply(subgoal_tac \"Suc n < Suc(Suc na)\")\n       apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n       apply(force)\n      apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n      apply(rule_tac\n      t=\"Suc n\"\n      and s=\"length (\\<pi>s ! j)\"\n      in ssubst)\n       apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n       apply(force)\n      apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n      apply(rule_tac\n      t=\"Suc na\"\n      and s=\"length(foldl (@) [] \\<pi>s)\"\n      in ssubst)\n       apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n       apply(rule_tac\n      t=\"foldl (@) [] \\<pi>s\"\n      and s=\"map (the \\<circ> (\\<lambda>i. case_option None (case_derivation_configuration (\\<lambda>e c. e)) (d i))) (nat_seq (Suc (Suc 0)) (Suc (Suc na)))\"\n      in ssubst)\n        apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n        apply(force)\n       apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n       apply(rule sym)\n       apply(rule_tac\n      t=\"length (map (the \\<circ> (\\<lambda>i. case_option None (case_derivation_configuration (\\<lambda>e c. e)) (d i))) (nat_seq (Suc (Suc 0)) (Suc (Suc na))))\"\n      and s=\"length (nat_seq (Suc (Suc 0)) (Suc (Suc na)))\"\n      in ssubst)\n        apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n        apply(force)\n       apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n       apply(subgoal_tac \"length (nat_seq (Suc (Suc 0)) (Suc (Suc na))) = (Suc (Suc na)) + 1 - (Suc (Suc 0))\")\n        apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n        prefer 2\n        apply(rule nat_seq_length_prime)\n       apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n       apply(force)\n      apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n      apply(force)\n     apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n     apply(rule length_shorter_than_in_composition)\n     apply(force)\n    apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n    apply(rule distrib_add_apppend_with_map)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc n) = Suc 0 # (nat_seq (Suc (Suc 0)) (Suc n))\")\n    apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n    prefer 2\n    apply (metis less_eq_Suc_le_raw nat_seq_pullout zero_less_Suc)\n   apply(rename_tac d e' w na \\<pi>s j e2 da e wa n e2a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n  apply(rule someI_existence)\n  apply(thin_tac \"\\<And>y d A e e' \\<pi> Xseq w. y < Suc n \\<Longrightarrow> cfgLM.derivation G d \\<Longrightarrow> cfgLM.belongs G d \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = [A]\\<rparr>) \\<Longrightarrow> d (Suc 0) = Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>) \\<Longrightarrow> d (Suc y) = Some (pair e' \\<lparr>cfg_conf = liftB w\\<rparr>) \\<Longrightarrow> \\<pi> = map the (get_labels d (Suc y)) \\<Longrightarrow> CFGlm2rm_dom (G, map the (get_labels d (Suc y)))\")\n  apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n  apply(thin_tac \"xa \\<in> set (SOME \\<pi>s. foldl (@) [] \\<pi>s = map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc (Suc 0)) (Suc (Suc n))) \\<and> length \\<pi>s = length (prod_rhs (the (get_label (Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>))))) \\<and> (\\<forall>i<length \\<pi>s. \\<pi>s ! i \\<in> CFGlmEliminators G (Some (prod_rhs (the (get_label (Some (pair e \\<lparr>cfg_conf = Xseq\\<rparr>)))) ! i))))\")\n  apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n  apply(subgoal_tac \"\\<exists>r. e=Some r\")\n   apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> d (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n    apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc (Suc n)\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n      apply(force)\n     apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n     apply(force)\n    apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n    apply(force)\n   apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d A e e' Xseq w n xa)(*strict*)\n  apply(erule exE)\n  apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n  apply(subgoal_tac \"r # tl (map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) (Suc (Suc n)))) = map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) (Suc (Suc n)))\")\n   apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n   prefer 2\n   apply(rule listEqI)\n    apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d A e' Xseq w n r)(*strict*)\n    apply (metis diff_Suc_Suc less_Suc_eq_0_disj minus_nat.diff_0 nat_seq_length_Suc0)\n   apply(rename_tac d A e e' Xseq w n xa r i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d A e' Xseq w n r i)(*strict*)\n   apply(case_tac i)\n    apply(rename_tac d A e' Xseq w n r i)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d A e' Xseq w n r)(*strict*)\n    apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) (Suc (Suc n))) ! 0\"\n      and s=\" (the \\<circ> (\\<lambda>i. get_label (d i))) ((nat_seq (Suc 0) (Suc (Suc n))) ! 0)\"\n      in ssubst)\n     apply(rename_tac d A e' Xseq w n r)(*strict*)\n     apply(rule nth_map)\n     apply (metis Zero_not_Suc nat_seq_length_Suc0 neq0_conv)\n    apply(rename_tac d A e' Xseq w n r)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      t=\"nat_seq (Suc 0) (Suc (Suc n)) ! 0\"\n      and s=\"(Suc 0) + 0\"\n      in ssubst)\n     apply(rename_tac d A e' Xseq w n r)(*strict*)\n     apply (simp add: nat_seq_nth_compute)\n    apply(rename_tac d A e' Xseq w n r)(*strict*)\n    apply(simp add: get_label_def)\n   apply(rename_tac d A e' Xseq w n r i nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d A e' Xseq w n r nat)(*strict*)\n   apply(rule_tac\n      t=\"tl (map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) (Suc (Suc n)))) ! nat\"\n      and s=\" (map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) (Suc (Suc n)))) ! (Suc nat)\"\n      in ssubst)\n    apply(rename_tac d A e' Xseq w n r nat)(*strict*)\n    apply(rule tl_nth_shift)\n    apply(force)\n   apply(rename_tac d A e' Xseq w n r nat)(*strict*)\n   apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) (Suc (Suc n))) ! Suc nat\"\n      and s=\" (the \\<circ> (\\<lambda>i. get_label (d i))) ((nat_seq (Suc 0) (Suc (Suc n))) ! Suc nat)\"\n      in ssubst)\n    apply(rename_tac d A e' Xseq w n r nat)(*strict*)\n    apply(rule nth_map)\n    apply(force)\n   apply(rename_tac d A e' Xseq w n r nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n  apply(subgoal_tac \"\\<exists>!\\<pi>s. \\<exists>!ws. foldl (@) [] \\<pi>s = SSrenPI \\<and> length \\<pi>s = length SSXseq \\<and> foldl (@) [] ws = SSw \\<and> length ws = length SSXseq \\<and> (\\<forall>i<length \\<pi>s. \\<exists>d' n' e'. cfgLM.derivation SSG d' \\<and> cfgLM.belongs SSG d' \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf = [SSXseq ! i]\\<rparr>) \\<and> d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (ws ! i)\\<rparr>) \\<and> \\<pi>s ! i = map the (get_labels d' n'))\" for SSrenPI SSw SSG SSXseq)\n   apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n   prefer 2\n   apply(rule_tac\n      \\<pi>=\"tl(map the (get_labels d (Suc (Suc n))))\"\n      in lemma_4_8)\n         apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n         apply(force)\n        apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n        apply(force)\n       apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n       apply(force)\n      apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n      apply(force)\n     apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n     apply(force)\n    apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n    apply(force)\n   apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n   apply(simp add: get_labels_def)\n  apply(rename_tac d A e e' Xseq w n xa r)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n  apply(rule_tac\n      x=\"\\<pi>s\"\n      in exI)\n  apply(thin_tac \"\\<forall>y y'. (\\<exists>!wsa. foldl (@) [] y = tl (map the (get_labels d (Suc (Suc n)))) \\<and> length y = length Xseq \\<and> foldl (@) [] wsa = foldl (@) [] ws \\<and> length wsa = length Xseq \\<and> (\\<forall>i<length y. \\<exists>d'. cfgLM.derivation G d' \\<and> cfgLM.belongs G d' \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf = [Xseq ! i]\\<rparr>) \\<and> (\\<exists>n'. (\\<exists>e'. d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (wsa ! i)\\<rparr>)) \\<and> y ! i = map the (get_labels d' n')))) \\<and> (\\<exists>!wsa. foldl (@) [] y' = tl (map the (get_labels d (Suc (Suc n)))) \\<and> length y' = length Xseq \\<and> foldl (@) [] wsa = foldl (@) [] ws \\<and> length wsa = length Xseq \\<and> (\\<forall>i<length y'. \\<exists>d'. cfgLM.derivation G d' \\<and> cfgLM.belongs G d' \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf = [Xseq ! i]\\<rparr>) \\<and> (\\<exists>n'. (\\<exists>e'. d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (wsa ! i)\\<rparr>)) \\<and> y' ! i = map the (get_labels d' n')))) \\<longrightarrow> y = y'\")\n  apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n  apply(thin_tac \"\\<forall>y y'. foldl (@) [] y = foldl (@) [] ws \\<and> length y = length Xseq \\<and> (\\<forall>i<length Xseq. \\<exists>d'. cfgLM.derivation G d' \\<and> cfgLM.belongs G d' \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf = [Xseq ! i]\\<rparr>) \\<and> (\\<exists>n'. (\\<exists>e'. d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (y ! i)\\<rparr>)) \\<and> \\<pi>s ! i = map the (get_labels d' n'))) \\<and> foldl (@) [] y' = foldl (@) [] ws \\<and> length y' = length Xseq \\<and> (\\<forall>i<length Xseq. \\<exists>d'. cfgLM.derivation G d' \\<and> cfgLM.belongs G d' \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf = [Xseq ! i]\\<rparr>) \\<and> (\\<exists>n'. (\\<exists>e'. d' n' = Some (pair e' \\<lparr>cfg_conf = liftB (y' ! i)\\<rparr>)) \\<and> \\<pi>s ! i = map the (get_labels d' n'))) \\<longrightarrow> y = y'\")\n  apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc (Suc 0)) (Suc(Suc n))) = (Suc(Suc n)) + 1 - (Suc (Suc 0))\")\n   apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc(Suc n))) = (Suc(Suc n)) + 1 - (Suc 0)\")\n   apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(rule listEqI)\n    apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n    apply(rule_tac\n      t=\"length (map (the \\<circ> (\\<lambda>i. get_label (d i))) zs)\"\n      and s=\"length zs\"\n      in ssubst)\n     apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n     apply (metis length_map)\n    apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n    apply(rule_tac\n      t=\"length (map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc (Suc 0)) (Suc (Suc n))))\"\n      and s=\"length (nat_seq (Suc (Suc 0)) (Suc (Suc n)))\"\n      in ssubst)\n     apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n     apply (metis length_map)\n    apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n    apply(force)\n   apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"nat_seq (Suc (Suc 0)) (Suc (Suc n)) ! i\"\n      and s=\"Suc(Suc 0)+i\"\n      in ssubst)\n    apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n     apply(force)\n    apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n    apply(force)\n   apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc (Suc n)) = Suc 0 # nat_seq (Suc (Suc 0)) (Suc (Suc n))\")\n    apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d A e' Xseq n \\<pi>s ws i)(*strict*)\n    apply(rule_tac\n      t=\"nat_seq (Suc (Suc 0)) (Suc (Suc n)) ! i\"\n      and s=\"Suc(Suc 0)+i\"\n      in ssubst)\n     apply(rename_tac d A e' Xseq n \\<pi>s ws i)(*strict*)\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac d A e' Xseq n \\<pi>s ws i)(*strict*)\n      apply(force)\n     apply(rename_tac d A e' Xseq n \\<pi>s ws i)(*strict*)\n     apply(force)\n    apply(rename_tac d A e' Xseq n \\<pi>s ws i)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n   apply (metis less_eq_Suc_le_raw nat_seq_pullout zero_less_Suc)\n  apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc (Suc n)) = Suc 0 # nat_seq (Suc (Suc 0)) (Suc (Suc n))\")\n    apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n    prefer 2\n    apply (metis less_eq_Suc_le_raw nat_seq_pullout zero_less_Suc)\n   apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n   apply(simp add: get_label_def)\n   apply(clarsimp)\n   apply(rename_tac d A e' Xseq n \\<pi>s ws)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> d (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n    apply(rename_tac d A e' Xseq n \\<pi>s ws)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc 0\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac d A e' Xseq n \\<pi>s ws)(*strict*)\n      apply(force)\n     apply(rename_tac d A e' Xseq n \\<pi>s ws)(*strict*)\n     apply(force)\n    apply(rename_tac d A e' Xseq n \\<pi>s ws)(*strict*)\n    apply(force)\n   apply(rename_tac d A e' Xseq n \\<pi>s ws)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d A e' Xseq n \\<pi>s ws e2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac d A e' n \\<pi>s ws e2 l r)(*strict*)\n   apply(case_tac l)\n    apply(rename_tac d A e' n \\<pi>s ws e2 l r)(*strict*)\n    apply(force)\n   apply(rename_tac d A e' n \\<pi>s ws e2 l r a list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d A e' Xseq n \\<pi>s ws z zs)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n  apply(simp add: CFGlmEliminators_def)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> d (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc 0\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n     apply(force)\n    apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n    apply(force)\n   apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n   apply(force)\n  apply(rename_tac d A e' Xseq n \\<pi>s ws z zs i)(*strict*)\n  apply(clarsimp)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac d A e' n \\<pi>s ws z zs i l r)(*strict*)\n  apply(case_tac l)\n   apply(rename_tac d A e' n \\<pi>s ws z zs i l r)(*strict*)\n   prefer 2\n   apply(rename_tac d A e' n \\<pi>s ws z zs i l r a list)(*strict*)\n   apply(force)\n  apply(rename_tac d A e' n \\<pi>s ws z zs i l r)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d e' n \\<pi>s ws z zs i)(*strict*)\n  apply(subgoal_tac \"nat_seq (Suc 0) (Suc (Suc n)) = Suc 0 # nat_seq (Suc (Suc 0)) (Suc (Suc n))\")\n   apply(rename_tac d e' n \\<pi>s ws z zs i)(*strict*)\n   prefer 2\n   apply (metis less_eq_Suc_le_raw nat_seq_pullout zero_less_Suc)\n  apply(rename_tac d e' n \\<pi>s ws z zs i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d e' n \\<pi>s ws i)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac d e' n \\<pi>s ws i d' n' e'a)(*strict*)\n  apply(rule_tac\n      x=\"d'\"\n      in exI)\n  apply(clarsimp)\n  apply(simp add: option_to_list_def)\n  apply(rule_tac\n      x=\"n'\"\n      in exI)\n  apply(clarsimp)\n  apply(force)\n  done\n\nlemma existence_of_elimination_string_list: \"\n  valid_cfg G\n  \\<Longrightarrow> length \\<pi>s=length w\n  \\<Longrightarrow> \\<forall>i<length \\<pi>s. \\<pi>s ! i \\<in> CFGlmEliminators G (Some (w ! i))\n  \\<Longrightarrow> \\<exists>ws. length \\<pi>s = length ws \\<and>\n               (\\<forall>k<length \\<pi>s.\n                   \\<exists>d n e.\n                      cfgLM.derivation G d \\<and>\n                      cfgLM.belongs G d \\<and>\n                      d 0 =\n                      Some (pair None\n                             \\<lparr>cfg_conf = option_to_list (Some (w ! k))\\<rparr>) \\<and>\n                      d n = Some (pair e \\<lparr>cfg_conf = liftB (ws ! k)\\<rparr>) \\<and>\n                      \\<pi>s ! k = map the (get_labels d n))\"\n  apply(induct w arbitrary: \\<pi>s)\n   apply(rename_tac \\<pi>s)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac a w \\<pi>s)(*strict*)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"drop (Suc 0) \\<pi>s\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule meta_impE)\n   apply(rename_tac a w \\<pi>s)(*strict*)\n   apply(force)\n  apply(rename_tac a w \\<pi>s)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a w \\<pi>s ws)(*strict*)\n  apply(erule_tac\n      x=\"0\"\n      and P=\"\\<lambda>x. x < Suc (length ws) \\<longrightarrow> \\<pi>s ! x \\<in> CFGlmEliminators G (Some ((a # w) ! x))\"\n      in allE)\n  apply(clarsimp)\n  apply(simp add: CFGlmEliminators_def)\n  apply(clarsimp)\n  apply(rename_tac a w \\<pi>s ws d n e wa)(*strict*)\n  apply(rule_tac\n      x=\"wa#ws\"\n      in exI)\n  apply(clarsimp)\n  apply(rename_tac a w \\<pi>s ws d n e wa k)(*strict*)\n  apply(case_tac k)\n   apply(rename_tac a w \\<pi>s ws d n e wa k)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac a w \\<pi>s ws d n e wa)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n  apply(rename_tac a w \\<pi>s ws d n e wa k nat)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma unique_elimination: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>)\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = v\\<rparr>)\n  \\<Longrightarrow> foldl (@) [] \\<pi>s = map (\\<lambda>a. the (get_label (d a))) (nat_seq (Suc 0) n)\n  \\<Longrightarrow> length \\<pi>s = length ws\n  \\<Longrightarrow> length v = length ws\n  \\<Longrightarrow> \\<forall>k<length ws.\n           \\<exists>d. cfgLM.derivation G d \\<and>\n               cfgLM.belongs G d \\<and>\n               d 0 = Some (pair None \\<lparr>cfg_conf = option_to_list (Some (v ! k))\\<rparr>) \\<and>\n               (\\<exists>n. (\\<exists>e. d n = Some (pair e \\<lparr>cfg_conf = liftB (ws ! k)\\<rparr>)) \\<and>\n                    \\<pi>s ! k = map the (get_labels d n))\n  \\<Longrightarrow> foldl (@) [] ws = w\"\n  apply(induct v arbitrary: d n e w \\<pi>s ws)\n   apply(rename_tac d n e w \\<pi>s ws)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d n e w)(*strict*)\n   apply(case_tac n)\n    apply(rename_tac d n e w)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d w)(*strict*)\n    apply(rule liftB_inj)\n    apply(force)\n   apply(rename_tac d n e w nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d e w nat)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> d (Suc 0) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n    apply(rename_tac d e w nat)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac d e w nat)(*strict*)\n      apply(force)\n     apply(rename_tac d e w nat)(*strict*)\n     apply(force)\n    apply(rename_tac d e w nat)(*strict*)\n    apply(force)\n   apply(rename_tac d e w nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d e w nat e2 c2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n  apply(rename_tac a v d n e w \\<pi>s ws)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>d. cfgLM.derivation G d \\<and> cfgLM.belongs G d \\<and> d 0 = Some (pair None \\<lparr>cfg_conf = option_to_list (Some ((a # v) ! 0))\\<rparr>) \\<and> (\\<exists>n. (\\<exists>e. d n = Some (pair e \\<lparr>cfg_conf = liftB (ws ! 0)\\<rparr>)) \\<and> \\<pi>s ! 0 = map the (get_labels d n))\")\n   apply(rename_tac a v d n e w \\<pi>s ws)(*strict*)\n   prefer 2\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(force)\n  apply(rename_tac a v d n e w \\<pi>s ws)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n  apply(subgoal_tac \"na\\<le>n\")\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   prefer 2\n   apply(simp add: get_labels_def)\n   apply(rule_tac\n      t=\"na\"\n      and s=\"length(\\<pi>s!0)\"\n      in ssubst)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(rule_tac\n      t=\"\\<pi>s!0\"\n      and s=\"map (the \\<circ> (\\<lambda>i. get_label (da i))) (nat_seq (Suc 0) na)\"\n      in ssubst)\n     apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(subgoal_tac \"length (nat_seq (Suc 0) na) = SSn + 1 - SSi\" for SSn SSi)\n     apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n     prefer 2\n     apply(rule nat_seq_length_prime)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   apply(rule_tac\n      t=\"n\"\n      and s=\"length(foldl (@) [] \\<pi>s)\"\n      in ssubst)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(rule_tac\n      t=\"foldl (@) [] \\<pi>s\"\n      and s=\"map (\\<lambda>a. the (get_label (d a))) (nat_seq (Suc 0) n)\"\n      in ssubst)\n     apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSn + 1 - SSi\" for SSn SSi)\n     apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n     prefer 2\n     apply(rule nat_seq_length_prime)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   apply (metis length_shorter_than_in_composition zero_less_Suc)\n  apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n  apply(subgoal_tac \"derivation_map da (\\<lambda>x. \\<lparr>cfg_conf = (cfg_conf x)@v\\<rparr>) na = d na\")\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   prefer 2\n   apply(rule_tac\n      c=\"foldl (@) [] (drop (Suc 0) \\<pi>s)\"\n      and d'a=\"d\"\n      and i=\"na\"\n      and n=\"na\"\n      and ?m1.0=\"0\"\n      and ?m2.0=\"n-na\"\n      in equal_labels_implies_equal_cfgLMderivation)\n          apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n          apply(force)\n         apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n         apply(rule cfgLM.derivation_map_preserves_derivation2)\n          apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n          apply(force)\n         apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n         apply(clarsimp)\n         apply(rename_tac a v d n e w \\<pi>s ws da na ea aa eb b)(*strict*)\n         apply(simp add: cfgLM_step_relation_def)\n         apply(clarsimp)\n         apply(rename_tac a v d n e w \\<pi>s ws da na ea aa eb b l r)(*strict*)\n         apply(rule_tac\n      x=\"l\"\n      in exI)\n         apply(clarsimp)\n        apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n        apply(force)\n       apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n       apply(simp add: derivation_map_def)\n       apply(simp add: option_to_list_def)\n      apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n     apply(simp add: derivation_map_def)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   apply(rule_tac\n      t=\"na+(n-na)\"\n      and s=\"n\"\n      in ssubst)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"get_labels (derivation_map da (\\<lambda>x. \\<lparr>cfg_conf = cfg_conf x @ v\\<rparr>)) na\"\n      and s=\"get_labels da na\"\n      in ssubst)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(simp add: get_labels_def)\n    apply(clarsimp)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea x)(*strict*)\n    apply(simp add: derivation_map_def)\n    apply(case_tac \"da x\")\n     apply(rename_tac a v d n e w \\<pi>s ws da na ea x)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea x aa)(*strict*)\n    apply(clarsimp)\n    apply(case_tac aa)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea x aa option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea x option b)(*strict*)\n    apply(simp add: get_label_def)\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   apply(rule_tac\n      t=\"map the (get_labels da na)\"\n      and s=\"\\<pi>s!0\"\n      in ssubst)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   apply(rule_tac\n      t=\"\\<pi>s ! 0 @ foldl (@) [] (drop (Suc 0) \\<pi>s)\"\n      and s=\"foldl (@) [] \\<pi>s\"\n      in ssubst)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(case_tac \"\\<pi>s\")\n     apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea aa list)(*strict*)\n    apply (metis append_Nil drop_0 drop_Suc_Cons foldl_Nil foldl_decomp length_greater_0_conv list.simps(3) nth_Cons_0 take_0)\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   apply(simp add: get_labels_def)\n  apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n  apply(subgoal_tac \"prefix (ws!0) w\")\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"\\<exists>v. cfg_conf \\<lparr>cfg_conf = liftB w\\<rparr> = liftB (ws!0) @ v\")\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    prefer 2\n    apply(rule_tac\n      v=\"v\"\n      and d=\"d\"\n      and n=\"na\"\n      and m=\"n-na\"\n      in CFGLM_terminals_stay_at_front)\n        apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n        apply(force)\n       apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n       apply(force)\n      apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n      apply(simp add: derivation_map_def)\n      apply(rule sym)\n      apply(force)\n     apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n     apply(clarsimp)\n     apply(force)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea va)(*strict*)\n   apply(rule_tac\n      x=\"filterB va\"\n      in exI)\n   apply(rule liftB_inj)\n   apply(thin_tac \"\\<And>d n e w \\<pi>s ws. cfgLM.derivation G d \\<Longrightarrow> cfgLM.belongs G d \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf = liftB w\\<rparr>) \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = v\\<rparr>) \\<Longrightarrow> foldl (@) [] \\<pi>s = map (\\<lambda>a. the (get_label (d a))) (nat_seq (Suc 0) n) \\<Longrightarrow> length \\<pi>s = length ws \\<Longrightarrow> length v = length ws \\<Longrightarrow> \\<forall>k<length ws. \\<exists>d. cfgLM.derivation G d \\<and> cfgLM.belongs G d \\<and> d 0 = Some (pair None \\<lparr>cfg_conf = option_to_list (Some (v ! k))\\<rparr>) \\<and> (\\<exists>n. (\\<exists>e. d n = Some (pair e \\<lparr>cfg_conf = liftB (ws ! k)\\<rparr>)) \\<and> \\<pi>s ! k = map the (get_labels d n)) \\<Longrightarrow> foldl (@) [] ws = w\")\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea va)(*strict*)\n   apply(simp add: liftB_commutes_over_concat)\n   apply(rule_tac\n      t=\"liftB (filterB va)\"\n      and s=\"va\"\n      in ssubst)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea va)(*strict*)\n    apply(subgoal_tac \"setA va={}\")\n     apply(rename_tac a v d n e w \\<pi>s ws da na ea va)(*strict*)\n     apply (metis liftBDeConv2)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea va)(*strict*)\n    apply(rule_tac\n      a=\"liftB (ws ! 0)\"\n      and c=\"[]\"\n      in setA_append)\n    apply(rule_tac\n      t=\"liftB (ws ! 0) @ va @ []\"\n      and s=\"liftB w\"\n      in ssubst)\n     apply(rename_tac a v d n e w \\<pi>s ws da na ea va)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e w \\<pi>s ws da na ea va)(*strict*)\n    apply(rule setA_liftB)\n   apply(rename_tac a v d n e w \\<pi>s ws da na ea va)(*strict*)\n   apply(force)\n  apply(rename_tac a v d n e w \\<pi>s ws da na ea)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n  apply(erule_tac\n      x=\"derivation_map (derivation_drop d na) (\\<lambda>x. \\<lparr>cfg_conf=drop(length(ws!0))(cfg_conf x)\\<rparr>)\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"n-na\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"if n-na=0 then None else e\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"c\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"tl \\<pi>s\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"tl ws\"\n      in meta_allE)\n  apply(subgoal_tac \"cfgLM.derivation G (derivation_map (derivation_drop d na) (\\<lambda>x. \\<lparr>cfg_conf = drop (length (ws ! 0)) (cfg_conf x)\\<rparr>))\")\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n   apply(erule meta_impE)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      P=\"\\<lambda>x. prefix (liftB(ws!0)) (cfg_conf x)\"\n      in cfgLM.derivation_map_preserves_derivation)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n     apply(rule_tac\n      m=\"n-na\"\n      in cfgLM.derivation_drop_preserves_derivation_prime)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c i eb ca)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c i eb ca)(*strict*)\n    apply(subgoal_tac \"\\<exists>v. cfg_conf ca = liftB (ws!0) @ v\")\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c ca i eb)(*strict*)\n     prefer 2\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c i eb ca)(*strict*)\n     apply(rule_tac\n      ?e2.0=\"if i=0 then ea else eb\"\n      and d=\"d\"\n      and n=\"na\"\n      and m=\"i\"\n      in CFGLM_terminals_stay_at_front)\n         apply(rename_tac a v d n e \\<pi>s ws da na ea c i eb ca)(*strict*)\n         apply(force)\n        apply(rename_tac a v d n e \\<pi>s ws da na ea c i eb ca)(*strict*)\n        apply(force)\n       apply(rename_tac a v d n e \\<pi>s ws da na ea c i eb ca)(*strict*)\n       apply(simp add: derivation_map_def)\n       apply(rule sym)\n       apply(force)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c i eb ca)(*strict*)\n      apply(simp add: derivation_drop_def)\n      apply(case_tac i)\n       apply(rename_tac a v d n e \\<pi>s ws da na ea c i eb ca)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca)(*strict*)\n       apply(simp add: derivation_map_def)\n       apply(case_tac \"d na\")\n        apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca)(*strict*)\n        apply(force)\n       apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca)(*strict*)\n       apply(clarsimp)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c ca eb nat)(*strict*)\n      apply(rule_tac\n      t=\"na+nat\"\n      and s=\"nat+na\"\n      in ssubst)\n       apply(rename_tac a v d n e \\<pi>s ws da na ea c ca eb nat)(*strict*)\n       apply(force)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c ca eb nat)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c ca i eb)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c ca i eb)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c ca i eb va)(*strict*)\n    apply(simp add: prefix_def)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c aa eb b)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c aa eb b ca cb)(*strict*)\n   apply(case_tac aa)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c aa eb b ca cb cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb b ca cb)(*strict*)\n   apply(case_tac b)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb b ca cb cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb)(*strict*)\n   apply(rule_tac\n      t=\"length (ws!0)\"\n      and s=\"length(liftB(ws!0))\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb)(*strict*)\n    apply(simp add: liftB_reflects_length)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb)(*strict*)\n   apply(rule_tac\n      t=\"length (liftB (ws ! 0)) - length (liftB (ws ! 0))\"\n      and s=\"0\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb)(*strict*)\n   apply(rule_tac\n      t=\"drop (length (liftB (ws ! 0))) (liftB (ws ! 0))\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb)(*strict*)\n   apply(clarsimp)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r)(*strict*)\n   apply(subgoal_tac \"prefix (liftB (ws ! 0)) l \\<or> prefix l (liftB (ws ! 0))\")\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r)(*strict*)\n    prefer 2\n    apply(rule mutual_prefix_prefix)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r)(*strict*)\n    apply(simp add: prefix_def)\n    apply(clarsimp)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb r cc)(*strict*)\n    apply(rule_tac\n      x=\"cc\"\n      in exI)\n    apply(clarsimp)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb cc)(*strict*)\n    apply(simp add: setAConcat)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r)(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r cc)(*strict*)\n   apply(case_tac cc)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r cc)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb r)(*strict*)\n    apply(rule_tac\n      x=\"[]\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r cc aa list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r aa list)(*strict*)\n   apply(subgoal_tac \"False\")\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r aa list)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r aa list)(*strict*)\n   apply(subgoal_tac \"aa=teA (prod_lhs eb)\")\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r aa list)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r list)(*strict*)\n    apply(subgoal_tac \"setA (liftB (ws ! 0)) = {}\")\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r list)(*strict*)\n     apply(subgoal_tac \"prod_lhs eb \\<in> setA (liftB (ws ! 0))\")\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r list)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r list)(*strict*)\n     apply(rule_tac\n      t=\"liftB (ws ! 0)\"\n      and s=\"l @ teA (prod_lhs eb) # list\"\n      in ssubst)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r list)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r list)(*strict*)\n     apply(simp (no_asm) add: setAConcat)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r list)(*strict*)\n    apply(rule setA_liftB)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r aa list)(*strict*)\n   apply(subgoal_tac \"[aa]=[teA (prod_lhs eb)]\")\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r aa list)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca cb l r aa list)(*strict*)\n   apply (metis append_Cons concat_asso nth_append_length)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d na = Some(pair e c)\")\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n\"\n      in cfgLM.pre_some_position_is_some_position)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n   apply(force)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca)(*strict*)\n  apply(subgoal_tac \"\\<exists>v. cfg_conf ca = liftB (ws!0) @ v\")\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca)(*strict*)\n   prefer 2\n   apply(simp add: derivation_map_def)\n   apply(clarsimp)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(rule cfgLM.derivation_belongs)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply(simp add: derivation_map_def derivation_drop_def)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(rule_tac\n      t=\"length (ws!0)\"\n      and s=\"length(liftB(ws!0))\"\n      in ssubst)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply (simp add: liftB_reflects_length)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(rule_tac\n      t=\"length (liftB (ws ! 0)) - length (liftB (ws ! 0))\"\n      and s=\"0\"\n      in ssubst)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(rule_tac\n      t=\"drop (length (liftB (ws ! 0))) (liftB (ws ! 0))\"\n      and s=\"[]\"\n      in ssubst)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"ca \\<in> cfg_configurations G\")\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply(simp add: cfg_configurations_def)\n     apply(clarsimp)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb va)(*strict*)\n     apply(rule conjI)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb va)(*strict*)\n      apply(rule_tac\n      B=\"setA (liftB (ws ! 0) @ va)\"\n      in subset_trans)\n       apply(rename_tac a v d n e \\<pi>s ws da na ea c eb va)(*strict*)\n       apply(simp add: setAConcat)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb va)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb va)(*strict*)\n     apply(rule_tac\n      B=\"setB (liftB (ws ! 0) @ va)\"\n      in subset_trans)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb va)(*strict*)\n      apply(simp add: setBConcat)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb va)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(rule cfgLM.belongs_configurations)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(force)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(simp add: derivation_map_def derivation_drop_def)\n   apply(rule_tac\n      t=\"length (ws!0)\"\n      and s=\"length(liftB(ws!0))\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply (simp add: liftB_reflects_length)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(rule_tac\n      t=\"length (liftB (ws ! 0)) - length (liftB (ws ! 0))\"\n      and s=\"0\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(rule_tac\n      t=\"drop (length (liftB (ws ! 0))) (liftB (ws ! 0))\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac a d n e \\<pi>s ws da na c eb va)(*strict*)\n   apply(case_tac \"n=na\")\n    apply(rename_tac a d n e \\<pi>s ws da na c eb va)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac a d e \\<pi>s ws da na c va)(*strict*)\n    apply(simp add: liftB_commutes_over_concat)\n   apply(rename_tac a d n e \\<pi>s ws da na c eb va)(*strict*)\n   apply(clarsimp)\n   apply(simp add: liftB_commutes_over_concat)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(simp add: derivation_map_def derivation_drop_def)\n   apply(rule_tac\n      t=\"length (ws!0)\"\n      and s=\"length(liftB(ws!0))\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply (simp add: liftB_reflects_length)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(rule_tac\n      t=\"length (liftB (ws ! 0)) - length (liftB (ws ! 0))\"\n      and s=\"0\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(rule_tac\n      t=\"drop (length (liftB (ws ! 0))) (liftB (ws ! 0))\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(rule_tac\n      w=\"\\<pi>s!0\"\n      in append_linj)\n   apply(rule_tac\n      t=\"\\<pi>s ! 0 @ foldl (@) [] (tl \\<pi>s)\"\n      and s=\"foldl (@) [] \\<pi>s\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(case_tac \\<pi>s)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va aa list)(*strict*)\n    apply(rule foldl_head2)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(rule_tac\n      t=\"\\<pi>s!0\"\n      and s=\"map the (get_labels da na)\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(rule_tac\n      t=\"foldl (@) [] \\<pi>s\"\n      and s=\"map (\\<lambda>a. the (get_label (d a))) (nat_seq (Suc 0) n)\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(simp (no_asm) add: get_labels_def)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSm + 1 - SSn\" for SSm SSn)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) na) = SSm + 1 - SSn\" for SSm SSn)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) (n-na)) = SSm + 1 - SSn\" for SSm SSn)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(rule listEqI)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(rule_tac\n      t=\"length (map (\\<lambda>a. the (get_label (d a))) (nat_seq (Suc 0) n))\"\n      and s=\"length ((nat_seq (Suc 0) n))\"\n      in ssubst)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply (metis length_map )\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(rule_tac\n      t=\"length (map (the \\<circ> (\\<lambda>i. get_label (da i))) (nat_seq (Suc 0) na) @ map (\\<lambda>a. the (get_label (derivation_map (derivation_drop d na) (\\<lambda>x. \\<lparr>cfg_conf = drop (length (ws ! 0)) (cfg_conf x)\\<rparr>) a))) (nat_seq (Suc 0) (n - na)))\"\n      and s=\"length (map (the \\<circ> (\\<lambda>i. get_label (da i))) (nat_seq (Suc 0) na))+length(map (\\<lambda>a. the (get_label (derivation_map (derivation_drop d na) (\\<lambda>x. \\<lparr>cfg_conf = drop (length (ws ! 0)) (cfg_conf x)\\<rparr>) a))) (nat_seq (Suc 0) (n - na)))\"\n      in ssubst)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply (metis length_append )\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(rule_tac\n      t=\"length (map (the \\<circ> (\\<lambda>i. get_label (da i))) (nat_seq (Suc 0) na))\"\n      and s=\"length (nat_seq (Suc 0) na)\"\n      in ssubst)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply (metis length_map )\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(rule_tac\n      t=\"length (map (\\<lambda>a. the (get_label (derivation_map (derivation_drop d na) (\\<lambda>x. \\<lparr>cfg_conf = drop (length (ws ! 0)) (cfg_conf x)\\<rparr>) a))) (nat_seq (Suc 0) (n - na)))\"\n      and s=\"length ((nat_seq (Suc 0) (n - na)))\"\n      in ssubst)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n     apply (metis length_map)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"nat_seq (Suc 0) n ! i\"\n      and s=\"SSn + SSi\" for SSn SSi\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"i<na\")\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply(rule_tac\n      t=\"(map (\\<lambda>a. the (get_label (da a))) (nat_seq (Suc 0) na) @ map (\\<lambda>a. the (get_label (derivation_map (derivation_drop d na) (\\<lambda>x. \\<lparr>cfg_conf = drop (length (ws ! 0)) (cfg_conf x)\\<rparr>) a))) (nat_seq (Suc 0) (n - na))) ! i\"\n      and s=\"(map (\\<lambda>a. the (get_label (da a))) (nat_seq (Suc 0) na)) ! i\"\n      in ssubst)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(rule nth_append_1)\n     apply(rule_tac\n      t=\"length (map (\\<lambda>a. the (get_label (da a))) (nat_seq (Suc 0) na))\"\n      and s=\"length ((nat_seq (Suc 0) na))\"\n      in ssubst)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n      apply (metis length_map)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      t=\"nat_seq (Suc 0) na ! i\"\n      and s=\"SSn + SSi\" for SSn SSi\n      in ssubst)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"derivation_map da (\\<lambda>x. \\<lparr>cfg_conf = (cfg_conf x)@v\\<rparr>) (Suc i) = d (Suc i)\")\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     prefer 2\n     apply(rule_tac\n      c=\"foldl (@) [] (drop (Suc 0) \\<pi>s)\"\n      and d'a=\"d\"\n      and i=\"Suc i\"\n      and n=\"na\"\n      and ?m1.0=\"0\"\n      and ?m2.0=\"n-na\"\n      in equal_labels_implies_equal_cfgLMderivation)\n            apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n            apply(force)\n           apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n           apply(rule cfgLM.derivation_map_preserves_derivation2)\n            apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n            apply(force)\n           apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n           apply(clarsimp)\n           apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i aa ec b)(*strict*)\n           apply(simp add: cfgLM_step_relation_def)\n           apply(clarsimp)\n           apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i aa ec b l r)(*strict*)\n           apply(rule_tac\n      x=\"l\"\n      in exI)\n           apply(clarsimp)\n          apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n          apply(force)\n         apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n         apply(simp add: derivation_map_def)\n         apply(simp add: option_to_list_def)\n        apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n        apply(force)\n       apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n       apply(simp add: derivation_map_def)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(rule_tac\n      t=\"na+(n-na)\"\n      and s=\"n\"\n      in ssubst)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(clarsimp)\n     apply(rule_tac\n      t=\"get_labels (derivation_map da (\\<lambda>x. \\<lparr>cfg_conf = cfg_conf x @ v\\<rparr>)) na\"\n      and s=\"get_labels da na\"\n      in ssubst)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n      apply(simp add: get_labels_def)\n      apply(clarsimp)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i x)(*strict*)\n      apply(simp add: derivation_map_def)\n      apply(case_tac \"da x\")\n       apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i x)(*strict*)\n       apply(clarsimp)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i x aa)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac a d n e \\<pi>s ws da na c eb va i x aa)(*strict*)\n      apply(case_tac aa)\n      apply(rename_tac a d n e \\<pi>s ws da na c eb va i x aa option b)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac a d n e \\<pi>s ws da na c eb va i x option b)(*strict*)\n      apply(simp add: get_label_def)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(rule_tac\n      t=\"map the (get_labels da na)\"\n      and s=\"\\<pi>s!0\"\n      in ssubst)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n      apply(force)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(rule_tac\n      t=\"\\<pi>s ! 0 @ foldl (@) [] (drop (Suc 0) \\<pi>s)\"\n      and s=\"foldl (@) [] \\<pi>s\"\n      in ssubst)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n      apply(case_tac \"\\<pi>s\")\n       apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n       apply(force)\n      apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i aa list)(*strict*)\n      apply (metis append_Nil drop_0 drop_Suc_Cons foldl_Nil foldl_decomp length_greater_0_conv list.simps(3) nth_Cons_0 take_0)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(simp add: get_labels_def)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply(simp add: derivation_map_def)\n    apply(case_tac \"da (Suc i)\")\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i aa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac a d n e \\<pi>s ws da na c eb va i aa)(*strict*)\n    apply(case_tac aa)\n    apply(rename_tac a d n e \\<pi>s ws da na c eb va i aa option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac a d n e \\<pi>s ws da na c eb va i option b)(*strict*)\n    apply(simp add: get_label_def)\n    apply(case_tac \"d (Suc i)\")\n     apply(rename_tac a d n e \\<pi>s ws da na c eb va i option b)(*strict*)\n     apply(force)\n    apply(rename_tac a d n e \\<pi>s ws da na c eb va i option b aa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n   apply(rule_tac\n      t=\"(map (\\<lambda>a. the (get_label (da a))) (nat_seq (Suc 0) na) @ map (\\<lambda>a. the (get_label (derivation_map (derivation_drop d na) (\\<lambda>x. \\<lparr>cfg_conf = drop (length (ws ! 0)) (cfg_conf x)\\<rparr>) a))) (nat_seq (Suc 0) (n - na))) ! i\"\n      and s=\"(map (\\<lambda>a. the (get_label (derivation_map (derivation_drop d na) (\\<lambda>x. \\<lparr>cfg_conf = drop (length (ws ! 0)) (cfg_conf x)\\<rparr>) a))) (nat_seq (Suc 0) (n - na))) ! (i-(length(map (\\<lambda>a. the (get_label (da a))) (nat_seq (Suc 0) na))))\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply(rule nth_append_2)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n   apply(rule_tac\n      t=\"length (map (\\<lambda>a. the (get_label (da a))) (nat_seq (Suc 0) na))\"\n      and s=\"na\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply (metis length_map)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n   apply(simp)\n   apply(rule_tac\n      t=\"nat_seq (Suc 0) (n-na) ! (i-na)\"\n      and s=\"SSn + SSi\" for SSn SSi\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_map_def derivation_drop_def)\n   apply(case_tac \"d(Suc i)\")\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va i aa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac a d n e \\<pi>s ws da na c eb va i aa)(*strict*)\n   apply(simp add: get_label_def)\n   apply(case_tac aa)\n   apply(rename_tac a d n e \\<pi>s ws da na c eb va i aa option b)(*strict*)\n   apply(force)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(force)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k)(*strict*)\n   apply(erule_tac\n      x=\"Suc k\"\n      in allE)\n   apply(clarsimp)\n   apply(erule impE)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec)(*strict*)\n   apply(rule_tac\n      x=\"db\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"nb\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec)(*strict*)\n    apply(case_tac ws)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec aa list)(*strict*)\n    apply(rule_tac\n      t=\"ws\"\n      and s=\"aa#list\"\n      in ssubst)\n     apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec aa list)(*strict*)\n     apply(force)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec aa list)(*strict*)\n    apply(simp (no_asm))\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec)(*strict*)\n   apply(rule_tac\n      t=\"map the (get_labels db nb)\"\n      and s=\"\\<pi>s ! Suc k\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec)(*strict*)\n   apply(case_tac \\<pi>s)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec aa list)(*strict*)\n   apply(rule_tac\n      t=\"\\<pi>s\"\n      and s=\"aa#list\"\n      in ssubst)\n    apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec aa list)(*strict*)\n    apply(force)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va k db nb ec aa list)(*strict*)\n   apply(simp (no_asm))\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n  apply(rule_tac\n      t=\"c\"\n      and s=\"foldl (@) [] (tl ws)\"\n      in ssubst)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(force)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n  apply(rule sym)\n  apply(case_tac ws)\n   apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va)(*strict*)\n   apply(force)\n  apply(rename_tac a v d n e \\<pi>s ws da na ea c eb ca va aa list)(*strict*)\n  apply(rule foldl_head2)\n  apply(force)\n  done\n\nlemma cfgLM_no_step_from_no_nonterminal: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> setA (cfg_conf c) = {}\n  \\<Longrightarrow> x>n\n  \\<Longrightarrow> d x = None\"\n  apply(case_tac \"d x\")\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"d (Suc n) \\<noteq> None\")\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule_tac n=\"x\" in cfgLM.derivationNoFromNone2_prime)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(case_tac \"Suc n=x\")\n    apply(rename_tac a)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> SSd (Suc SSi) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSi)\n     apply(rename_tac a)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc n\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac a)(*strict*)\n       apply(force)\n      apply(rename_tac a)(*strict*)\n      apply(force)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac e2 c2)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(case_tac c)\n    apply(rename_tac e2 c2 cfg_confa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac e2 c2 l r)(*strict*)\n    apply(case_tac c2)\n    apply(rename_tac e2 c2 l r cfg_confa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac e2 l r)(*strict*)\n    apply (metis cfg_configuration.simps(1) cfgLM_no_step_without_nonterms not_None_eq)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> SSd (Suc SSi) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSi)\n   apply(rename_tac a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc n\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac a)(*strict*)\n     apply(force)\n    apply(rename_tac a)(*strict*)\n    apply(force)\n   apply(rename_tac a)(*strict*)\n   apply(force)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a e2 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(case_tac c)\n  apply(rename_tac a e2 c2 cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a e2 c2 l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac a e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a e2 l r)(*strict*)\n  apply (metis cfg_configuration.simps(1) cfgLM_no_step_without_nonterms not_None_eq)\n  done\n\ndefinition CFGlm_unambiguous :: \"('a,'b) cfg \\<Rightarrow> bool\" where\n  \"CFGlm_unambiguous G \\<equiv> (\\<forall>d1 d2 n1 n2 e1 e2 w.\n  cfgLM.derivation_initial G d1\n  \\<longrightarrow> cfgLM.derivation_initial G d2\n  \\<longrightarrow> d1 n1 = Some (pair e1 \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<longrightarrow> d2 n2 = Some (pair e2 \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<longrightarrow> d1 = d2)\"\n\nlemma cfgLM_edges_unique_wrt_conf_sequence: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation_initial G d1\n  \\<Longrightarrow> cfgLM.derivation_initial G d2\n  \\<Longrightarrow> d1 n \\<noteq> None\n  \\<Longrightarrow> d2 n \\<noteq> None\n  \\<Longrightarrow> (\\<forall>i\\<le>n. cfg_conf(the(get_configuration(d1 (n - i)))) = cfg_conf(the(get_configuration(d2 (n - i)))))\n  \\<Longrightarrow> i\\<le>n\n  \\<Longrightarrow> d1 i=d2 i\"\n  apply(induct i)\n   apply(clarsimp)\n   apply(rename_tac y ya)(*strict*)\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(clarsimp)\n   apply(case_tac \"d1 0\")\n    apply(rename_tac y ya)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y ya a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac y ya a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y ya b)(*strict*)\n   apply(case_tac \"d2 0\")\n    apply(rename_tac y ya b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y ya b a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac y ya b a option ba)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y ya b ba)(*strict*)\n   apply(simp add: cfg_initial_configurations_def)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya)(*strict*)\n  apply(subgoal_tac \"\\<exists>m. Suc i+m=n\")\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"n-Suc i\"\n      in exI)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya m)(*strict*)\n  apply(erule_tac\n      x=\"m\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac i y ya m)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya m)(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_configuration_def)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 i = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i y ya m)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc(i+m)\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i y ya m)(*strict*)\n     apply(rule cfgLM.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac i y ya m)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya m)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya m)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya m e1 e2 c1 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i y ya m e1 e2 c1 c2 l r)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 i = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i y ya m e1 e2 c1 c2 l r)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc(i+m)\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i y ya m e1 e2 c1 c2 l r)(*strict*)\n     apply(rule cfgLM.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac i y ya m e1 e2 c1 c2 l r)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya m e1 e2 c1 c2 l r)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya m e1 e2 c1 c2 l r)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya m e1 e2 c1 c2 l r e2a c2a)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i y ya m e1 e2 c1 c2 l r e2a c2a la ra)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac i y ya m e1 e2 c1 c2 l r e2a c2a la ra prod_lhsa prod_rhsa)(*strict*)\n  apply(case_tac e2a)\n  apply(rename_tac i y ya m e1 e2 c1 c2 l r e2a c2a la ra prod_lhsa prod_rhsa prod_lhsaa prod_rhsaa)(*strict*)\n  apply(rename_tac C1 r1 C2 r2)\n  apply(rename_tac i y ya m e1 e2 c1 c2 l r e2a c2a la ra C1 r1 C2 r2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya m e1 c1 c2 l r c2a la ra C1 r1 C2 r2)(*strict*)\n  apply(subgoal_tac \"\\<exists>l'. liftB l' = l\")\n   apply(rename_tac i y ya m e1 c1 c2 l r c2a la ra C1 r1 C2 r2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n   apply (metis liftBDeConv2)\n  apply(rename_tac i y ya m e1 c1 c2 l r c2a la ra C1 r1 C2 r2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya m e1 c1 c2 r c2a la ra C1 r1 C2 r2 l')(*strict*)\n  apply(thin_tac \"setA (liftB l') = {}\")\n  apply(subgoal_tac \"\\<exists>la'. liftB la' = la\")\n   apply(rename_tac i y ya m e1 c1 c2 r c2a la ra C1 r1 C2 r2 l')(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB la\"\n      in exI)\n   apply (metis liftBDeConv2)\n  apply(rename_tac i y ya m e1 c1 c2 r c2a la ra C1 r1 C2 r2 l')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya m e1 c1 c2 r c2a ra C1 r1 C2 r2 l' la')(*strict*)\n  apply(thin_tac \"setA (liftB la') = {}\")\n  apply(subgoal_tac \"l'=la'\")\n   apply(rename_tac i y ya m e1 c1 c2 r c2a ra C1 r1 C2 r2 l' la')(*strict*)\n   prefer 2\n   apply(rule identical_temrinal_maximal_prefix) \n   apply(force)\n  apply(rename_tac i y ya m e1 c1 c2 r c2a ra C1 r1 C2 r2 l' la')(*strict*)\n  apply(clarsimp)\n  done\n\nlemma equal_eliminators_hlp2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d1\n  \\<Longrightarrow> cfgLM.derivation G d2\n  \\<Longrightarrow> d1 0 = d2 0\n  \\<Longrightarrow> d1 (n+x1) \\<noteq> None\n  \\<Longrightarrow> d2 (n+x2) \\<noteq> None\n  \\<Longrightarrow> get_labels d1 n = get_labels d2 n\n  \\<Longrightarrow> i\\<le>n\n  \\<Longrightarrow> d1 i = d2 i\"\n  apply(induct i)\n   apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 i = Some (pair e1 c1) \\<and> d1 (Suc i) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+x1\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i y ya)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 i = Some (pair e1 c1) \\<and> d2 (Suc i) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+x2\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i y ya)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a c1 c2 c2a)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n  apply(case_tac c2a)\n  apply(rename_tac i y ya e1 e2 e2a c1 c2 c2a l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a c1 c2 l r la ra)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac i y ya e1 e2 e2a c1 c2 l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a c2 l r la ra)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac i y ya e1 e2 e2a c2 l r la ra cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(subgoal_tac \"(get_labels d1 n)!i = (get_labels d2 n)!i\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(thin_tac \"get_labels d1 n = get_labels d2 n\")\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSn + 1 - SSi\" for SSn SSi)\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(subgoal_tac \"(\\<lambda>i. get_label (d1 i)) ((nat_seq (Suc 0) n) ! i) = (\\<lambda>i. get_label (d2 i)) ((nat_seq (Suc 0) n) ! i)\")\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"get_label (d1 (nat_seq (Suc 0) n ! i))\"\n      and s=\"map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) n) ! i\"\n      in subst)\n    apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n    apply(rule nth_map)\n    apply(force)\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   apply(rule_tac\n      t=\"get_label (d2 (nat_seq (Suc 0) n ! i))\"\n      and s=\"map (\\<lambda>i. get_label (d2 i)) (nat_seq (Suc 0) n) ! i\"\n      in subst)\n    apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n    apply(rule nth_map)\n    apply(force)\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_label_def)\n  apply(subgoal_tac \"nat_seq (Suc 0) n ! i = (SSn)+(SSi)\" for SSn SSi)\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n  apply(subgoal_tac \"l=la\")\n   apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n  apply (metis Cons_eq_appendI append_Nil terminalHeadEquals1)\n  done\n\nlemma cfgLM_equal_labels_imply_equal_positions: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d1\n  \\<Longrightarrow> cfgLM.derivation G d2\n  \\<Longrightarrow> d1 0 = d2 0\n  \\<Longrightarrow> get_labels d1 n = get_labels d2 n\n  \\<Longrightarrow> i\\<le>n\n  \\<Longrightarrow> d1 (n+m1) \\<noteq> None\n  \\<Longrightarrow> d2 (n+m2) \\<noteq> None\n  \\<Longrightarrow> d1 i = d2 i\"\n  apply(induct i)\n   apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya)(*strict*)\n  apply(subgoal_tac \"get_labels d1 n ! i = get_labels d2 n !i\")\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n) = n + 1 - Suc 0\")\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac i y ya)(*strict*)\n  apply(subgoal_tac \"(\\<lambda>i. get_label (d1 i)) ((nat_seq (Suc 0) n) ! i) = (\\<lambda>i. get_label (d2 i)) ((nat_seq (Suc 0) n) ! i)\")\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"get_label (d1 (nat_seq (Suc 0) n ! i))\"\n      and s=\"map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) n) ! i\"\n      in subst)\n    apply(rename_tac i y ya)(*strict*)\n    apply(rule nth_map)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(rule_tac\n      t=\"get_label (d2 (nat_seq (Suc 0) n ! i))\"\n      and s=\"map (\\<lambda>i. get_label (d2 i)) (nat_seq (Suc 0) n) ! i\"\n      in subst)\n    apply(rename_tac i y ya)(*strict*)\n    apply(rule nth_map)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i y ya)(*strict*)\n  apply(subgoal_tac \"nat_seq (Suc 0) n ! i = (SSn)+(SSi)\" for SSn SSi)\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac i y ya)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 i = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+m1\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i y ya)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 i = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n+m2\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r la ra)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r la ra cfg_confa)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r la ra cfg_confa cfg_confaa)(*strict*)\n  apply(case_tac c2a)\n  apply(rename_tac i y ya e1 e2 c1 c2 e2a c2a l r la ra cfg_confa cfg_confaa cfg_confb)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2 e2a l r la ra)(*strict*)\n  apply(simp add: get_label_def)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n  apply(subgoal_tac \"l=la\")\n   apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i y ya e1 e2a l r la ra)(*strict*)\n  apply (metis Cons_eq_appendI append_Nil terminalHeadEquals1)\n  done\n\nlemma cfgLM_unique_terminal_configurations1: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e1 \\<lparr>cfg_conf=liftB w1\\<rparr>)\n  \\<Longrightarrow> d m = Some (pair e2 \\<lparr>cfg_conf=liftB w2\\<rparr>)\n  \\<Longrightarrow> n<m\n  \\<Longrightarrow> Q\"\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   prefer 2\n   apply(rule_tac\n      m=\"m\"\n      in cfgLM.step_detail_before_some_position)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac e2a c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac e2a c2 l r)(*strict*)\n  apply (metis suffixes_setA_1 suffixes_intro1 setA_liftB all_not_in_conv emptyE)\n  done\n\nlemma cfgLM_unique_terminal_configurations: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e1 \\<lparr>cfg_conf=liftB w1\\<rparr>)\n  \\<Longrightarrow> d m = Some (pair e2 \\<lparr>cfg_conf=liftB w2\\<rparr>)\n  \\<Longrightarrow> n=m\"\n  apply(case_tac \"n<m\")\n   apply(rule_tac\n      n=\"n\"\n      and m=\"m\"\n      in cfgLM_unique_terminal_configurations1)\n       apply(force)+\n  apply(case_tac \"m<n\")\n   apply(rule_tac\n      n=\"m\"\n      and m=\"n\"\n      in cfgLM_unique_terminal_configurations1)\n       apply(force)+\n  done\n\nlemma cfgLM_equal_positions_when_same_productions: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d1\n  \\<Longrightarrow> cfgLM.derivation G d2\n  \\<Longrightarrow> d1 0 = d2 0\n  \\<Longrightarrow> d1 n2 \\<noteq> None\n  \\<Longrightarrow> d2 n2 \\<noteq> None\n  \\<Longrightarrow> map the (get_labels d1 n2) = map the (get_labels d2 n2)\n  \\<Longrightarrow> x \\<le> n2\n  \\<Longrightarrow> d1 x = d2 x\"\n  apply(induct x)\n   apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x y ya)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 x = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac x y ya)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n2\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac x y ya)(*strict*)\n     apply(simp add: cfgLM.derivation_initial_def)\n    apply(rename_tac x y ya)(*strict*)\n    apply(force)\n   apply(rename_tac x y ya)(*strict*)\n   apply(force)\n  apply(rename_tac x y ya)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 x = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac x y ya)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n2\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac x y ya)(*strict*)\n     apply(simp add: cfgLM.derivation_initial_def)\n    apply(rename_tac x y ya)(*strict*)\n    apply(force)\n   apply(rename_tac x y ya)(*strict*)\n   apply(force)\n  apply(rename_tac x y ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n   prefer 2\n   apply(clarsimp)\n   apply(rename_tac x y ya e1 e2a c1 c2 c2a l r la ra)(*strict*)\n   apply(case_tac c2a)\n   apply(rename_tac x y ya e1 e2a c1 c2 c2a l r la ra cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x y ya e1 e2a c1 c2 l r la ra)(*strict*)\n   apply(case_tac c2)\n   apply(rename_tac x y ya e1 e2a c1 c2 l r la ra cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x y ya e1 e2a c1 l r la ra)(*strict*)\n   apply(subgoal_tac \"l=la\")\n    apply(rename_tac x y ya e1 e2a c1 l r la ra)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x y ya e1 e2a c1 l r la ra)(*strict*)\n   apply(subgoal_tac \"\\<exists>l'. liftB l' = la\")\n    apply(rename_tac x y ya e1 e2a c1 l r la ra)(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB la\"\n      in exI)\n    apply (rule liftBDeConv2)\n    apply(force)\n   apply(rename_tac x y ya e1 e2a c1 l r la ra)(*strict*)\n   apply(subgoal_tac \"\\<exists>l'. liftB l' = l\")\n    apply(rename_tac x y ya e1 e2a c1 l r la ra)(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n    apply (rule liftBDeConv2)\n    apply(force)\n   apply(rename_tac x y ya e1 e2a c1 l r la ra)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x y ya e1 e2a c1 r ra l' l'a)(*strict*)\n   apply (metis maximalPrefixB_prefix2_prime)\n  apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n2) = n2 + 1 - Suc 0\")\n   apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n  apply(subgoal_tac \"nat_seq (Suc 0) n2 ! x = (SSn)+(SSi)\" for SSn SSi)\n   apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n    apply(force)\n   apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n   apply(force)\n  apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n  apply(rule_tac\n      t=\"e2\"\n      and s=\"(map the (get_labels d1 n2))!x\"\n      in ssubst)\n   apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"e2a\"\n      and s=\"(map the (get_labels d2 n2))!x\"\n      in ssubst)\n    apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (d2 i))) (nat_seq (Suc 0) n2) ! x\"\n      and s=\" (the \\<circ> (\\<lambda>i. get_label (d2 i))) ((nat_seq (Suc 0) n2) ! x) \"\n      in ssubst)\n    apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n    apply(rule nth_map)\n    apply(force)\n   apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n   apply(simp add: get_label_def)\n  apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (d1 i))) (nat_seq (Suc 0) n2) ! x\"\n      and s=\" (the \\<circ> (\\<lambda>i. get_label (d1 i))) ((nat_seq (Suc 0) n2) ! x) \"\n      in ssubst)\n   apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n   apply(rule nth_map)\n   apply(force)\n  apply(rename_tac x y ya e1 e2 e2a c1 c2 c2a l r la ra)(*strict*)\n  apply(simp add: get_label_def)\n  done\n\nlemma cfgLM_get_labels_eq_implies_equal_hlp: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation_initial G d1\n  \\<Longrightarrow> cfgLM.derivation_initial G d2\n  \\<Longrightarrow> d1 n = Some (pair e1 c1)\n  \\<Longrightarrow> d2 n = Some (pair e2 c2)\n  \\<Longrightarrow> get_labels d1 n = get_labels d2 n\n  \\<Longrightarrow> i\\<le>n\n  \\<Longrightarrow> d1 i = d2 i\"\n  apply(induct i arbitrary: e1 e2 c1 c2)\n   apply(rename_tac e1 e2 c1 c2)(*strict*)\n   apply(clarsimp)\n   apply(simp add: cfgLM.derivation_initial_def)\n   apply(clarsimp)\n   apply(case_tac \"d1 0\")\n    apply(rename_tac e1 e2 c1 c2)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac e1 e2 c1 c2 a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 b)(*strict*)\n   apply(case_tac \"d2 0\")\n    apply(rename_tac e1 e2 c1 c2 b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 b a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac e1 e2 c1 c2 b a option ba)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 b ba)(*strict*)\n   apply(simp add: cfg_initial_configurations_def)\n  apply(rename_tac i e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 i = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i e1 e2 c1 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i e1 e2 c1 c2)(*strict*)\n     apply(rule cfgLM.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac i e1 e2 c1 c2)(*strict*)\n    apply(force)\n   apply(rename_tac i e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac i e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in meta_allE)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 i = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"n\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n     apply(rule cfgLM.derivation_initial_is_derivation)\n     apply(force)\n    apply(rename_tac i e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n    apply(force)\n   apply(rename_tac i e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n   apply(force)\n  apply(rename_tac i e1 e2 c1 c2 e1a e2a c1a c2a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i e1 e2 c1 c2 e1a e2a c1a c2a e1b c2b)(*strict*)\n  apply(erule_tac\n      x=\"e2\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"c1\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"c2\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac i e1 e2 c1 c2 e1a e2a c1a c2a e1b c2b)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(erule_tac\n      x=\"Suc i\"\n      in ballE)\n   apply(rename_tac i e1 e2 c1 c2 e1a e2a c1a c2a e1b c2b)(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_label_def)\n   apply(clarsimp)\n   apply(rename_tac i e1 e2 c1 c2 e1a c1a c2a e1b c2b)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac i e1 e2 c1 c2 e1a c1a c2a e1b c2b l r la ra)(*strict*)\n   apply(case_tac c2b)\n   apply(rename_tac i e1 e2 c1 c2 e1a c1a c2a e1b c2b l r la ra cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i e1 e2 c1 c2 e1a c1a c2a e1b l r la ra)(*strict*)\n   apply(case_tac c2a)\n   apply(rename_tac i e1 e2 c1 c2 c2a e1b e2b c1b l r la ra cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i e1 e2 c1 c2 e1b e2b c1b l r la ra)(*strict*)\n   apply(case_tac c1b)\n   apply(rename_tac i e1 e2 c1 c2 e1b e2b c1b l r la ra cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i e1 e2 c1 c2 e1b e2b l r la ra)(*strict*)\n   apply(subgoal_tac \"\\<exists>l'. liftB l' = l\")\n    apply(rename_tac i e1 e2 c1 c2 e1b e2b l r la ra)(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n    apply (rule liftBDeConv2)\n    apply(force)\n   apply(rename_tac i e1 e2 c1 c2 e1b e2b l r la ra)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i e1 e2 c1 c2 e1b e2b r la ra l')(*strict*)\n   apply(subgoal_tac \"\\<exists>l'. liftB l' = e1b\")\n    apply(rename_tac i e1 e2 c1 c2 e1b e2b r la ra l')(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB e1b\"\n      in exI)\n    apply (rule liftBDeConv2)\n    apply(force)\n   apply(rename_tac i e1 e2 c1 c2 e1b e2b r la ra l')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i e1 e2 c1 c2 e1b e2b r ra l' l'a)(*strict*)\n   apply(simp add: simpY)\n   apply(subgoal_tac \"l'a=l'\")\n    apply(rename_tac i e1 e2 c1 c2 e1b e2b r ra l' l'a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i e1 e2 c1 c2 e1b e2b r ra l' l'a)(*strict*)\n   apply (metis maxTermPrefix_mixed_string maxTermPrefix_shift)\n  apply(rename_tac i e1 e2 c1 c2 e2a c2a e1b e2b c1b c2b)(*strict*)\n  apply(subgoal_tac \"Suc i \\<in> set (nat_seq (Suc 0) n)\")\n   apply(rename_tac i e1 e2 c1 c2 e2a c2a e1b e2b c1b c2b)(*strict*)\n   apply(force)\n  apply(rename_tac i e1 e2 c1 c2 e2a c2a e1b e2b c1b c2b)(*strict*)\n  apply(rule nat_seq_interval)\n   apply(rename_tac i e1 e2 c1 c2 e2a c2a e1b e2b c1b c2b)(*strict*)\n   apply(force)\n  apply(rename_tac i e1 e2 c1 c2 e2a c2a e1b e2b c1b c2b)(*strict*)\n  apply(force)\n  done\n\nlemma cfgLM_get_labels_eq_implies_equal: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation_initial G d1\n  \\<Longrightarrow> cfgLM.derivation_initial G d2\n  \\<Longrightarrow> d1 n1 = Some (pair e1 \\<lparr>cfg_conf=liftB w1\\<rparr>)\n  \\<Longrightarrow> d2 n2 = Some (pair e2 \\<lparr>cfg_conf=liftB w2\\<rparr>)\n  \\<Longrightarrow> get_labels d1 n1 = get_labels d2 n2\n  \\<Longrightarrow> d1 = d2\"\n  apply(subgoal_tac \"n1=n2 \\<and> (\\<forall>i\\<le>n1. d1 i = d2 i)\")\n   apply(clarsimp)\n   apply(rule ext)\n   apply(rename_tac x)(*strict*)\n   apply(case_tac \"x\\<le>n2\")\n    apply(rename_tac x)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(subgoal_tac \"x>n2\")\n    apply(rename_tac x)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(subgoal_tac \"d1 x = None\")\n    apply(rename_tac x)(*strict*)\n    apply(subgoal_tac \"d2 x = None\")\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(case_tac \"d2 x\")\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x a)(*strict*)\n    apply(subgoal_tac \"x-n2 = 0\")\n     apply(rename_tac x a)(*strict*)\n     prefer 2\n     apply(rule_tac\n      d=\"d2\"\n      and n=\"n2\"\n      in cfgLM_no_step_without_nontermsX)\n         apply(rename_tac x a)(*strict*)\n         apply(force)\n        apply(rename_tac x a)(*strict*)\n        apply(simp add: cfgLM.derivation_initial_def)\n       apply(rename_tac x a)(*strict*)\n       apply(force)\n      apply(rename_tac x a)(*strict*)\n      apply(clarsimp)\n      apply(simp add: simpY)\n     apply(rename_tac x a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(case_tac \"d1 x\")\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x a)(*strict*)\n   apply(subgoal_tac \"x-n2 = 0\")\n    apply(rename_tac x a)(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"d1\"\n      and n=\"n2\"\n      in cfgLM_no_step_without_nontermsX)\n        apply(rename_tac x a)(*strict*)\n        apply(force)\n       apply(rename_tac x a)(*strict*)\n       apply(simp add: cfgLM.derivation_initial_def)\n      apply(rename_tac x a)(*strict*)\n      apply(force)\n     apply(rename_tac x a)(*strict*)\n     apply(clarsimp)\n     apply(simp add: simpY)\n    apply(rename_tac x a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x a)(*strict*)\n   apply(clarsimp)\n  apply(subgoal_tac \"n1=n2\")\n   apply(clarsimp)\n   apply(rename_tac i)(*strict*)\n   apply(rule cfgLM_get_labels_eq_implies_equal_hlp)\n         apply(rename_tac i)(*strict*)\n         apply(force)+\n  apply (metis get_labels_length)\n  done\n\nlemma cfgLM_no_position_beyond_liftB_configuration: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d n = Some (pair e c)\n  \\<Longrightarrow> d m = Some (pair e' \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<Longrightarrow> n\\<le>m\"\n  apply(case_tac \"n\\<le>m\")\n   apply(force)\n  apply(subgoal_tac \"n>m\")\n   prefer 2\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d m = Some (pair e1 c1) \\<and> d (Suc m) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n   prefer 2\n   apply(rule_tac\n      m=\"n\"\n      in cfgLM.step_detail_before_some_position)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac e2 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac e2 c2 l r)(*strict*)\n  apply (metis setA_liftB elemInsetA ex_in_conv)\n  done\n\nlemma cfgLM_left_context_can_be_dropped: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf=liftB w @ v0\\<rparr>)\n  \\<Longrightarrow> d n = Some (pair e \\<lparr>cfg_conf=liftB w @ v1\\<rparr>)\n  \\<Longrightarrow> \\<exists>d'.\n  cfgLM.derivation G d'\n  \\<and> get_labels d' n = get_labels d n\n  \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf=v0\\<rparr>)\n  \\<and> d' n = Some (pair e \\<lparr>cfg_conf=v1\\<rparr>)\"\n  apply(induct n arbitrary: d e v1)\n   apply(rename_tac d e v1)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d)(*strict*)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = v0\\<rparr>\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d)(*strict*)\n    apply(rule cfgLM.der1_is_derivation)\n   apply(rename_tac d)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d)(*strict*)\n    apply(rule_tac\n      t=\"get_labels (der1 \\<lparr>cfg_conf = v0\\<rparr>) 0\"\n      and s=\"[]\"\n      in ssubst)\n     apply(rename_tac d)(*strict*)\n     apply (metis get_labelsEmpty)\n    apply(rename_tac d)(*strict*)\n    apply(rule sym)\n    apply (metis get_labelsEmpty)\n   apply(rename_tac d)(*strict*)\n   apply(simp add: der1_def)\n  apply(rename_tac n d e v1)(*strict*)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"derivation_take d n\"\n      in meta_allE)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d n = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac n d e v1)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc n\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac n d e v1)(*strict*)\n     apply(force)\n    apply(rename_tac n d e v1)(*strict*)\n    apply(force)\n   apply(rename_tac n d e v1)(*strict*)\n   apply(force)\n  apply(rename_tac n d e v1)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d v1 e1 e2 c1)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac n d v1 e1 e2 c1 l r)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac n d v1 e1 e2 c1 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d v1 e1 e2 l r)(*strict*)\n  apply(subgoal_tac \"\\<exists>l'. liftB l' = l\")\n   apply(rename_tac n d v1 e1 e2 l r)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n   apply (rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac n d v1 e1 e2 l r)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d v1 e1 e2 r l')(*strict*)\n  apply(thin_tac \"setA (liftB l') = {}\")\n  apply(case_tac e2)\n  apply(rename_tac n d v1 e1 e2 r l' prod_lhsa prod_rhsa)(*strict*)\n  apply(rename_tac B v)\n  apply(rename_tac n d v1 e1 e2 r l' B v)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d v1 e1 r l' B v)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in meta_allE)\n  apply(subgoal_tac \"\\<exists>v. cfg_conf SSc2 = liftB SSw @ v\" for SSc2 SSw)\n   apply(rename_tac n d v1 e1 r l' B v)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      and w=\"w\"\n      and n=\"0\"\n      and m=\"n\"\n      in CFGLM_terminals_stay_at_front)\n       apply(rename_tac n d v1 e1 r l' B v)(*strict*)\n       prefer 2\n       apply(force)\n      apply(rename_tac n d v1 e1 r l' B v)(*strict*)\n      apply(force)\n     apply(rename_tac n d v1 e1 r l' B v)(*strict*)\n     apply(force)\n    apply(rename_tac n d v1 e1 r l' B v)(*strict*)\n    apply(force)\n   apply(rename_tac n d v1 e1 r l' B v)(*strict*)\n   apply(force)\n  apply(rename_tac n d v1 e1 r l' B v)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d v1 e1 r l' B v va)(*strict*)\n  apply(subgoal_tac \"prefix w l'\")\n   apply(rename_tac n d v1 e1 r l' B v va)(*strict*)\n   prefer 2\n   apply (metis maximalPrefixB_prefix maximalPrefixB_prefix2_prime)\n  apply(rename_tac n d v1 e1 r l' B v va)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac n d v1 e1 r B v va c)(*strict*)\n  apply(simp add: simpY)\n  apply(erule_tac\n      x=\"va\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac n d e1 r B v c)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac n d e1 r B v c)(*strict*)\n   apply(rule cfgLM.derivation_take_preserves_derivation)\n   apply(force)\n  apply(rename_tac n d e1 r B v c)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac n d e1 r B v c)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac n d e1 r B v c)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac n d e1 r B v c)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac n d e1 r B v c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(rule_tac\n      x=\"derivation_append d' (der2 \\<lparr>cfg_conf = liftB c @ teA B # r\\<rparr> \\<lparr>prod_lhs = B, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB c @ v @ r\\<rparr>) n\"\n      in exI)\n  apply(rule context_conjI)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   apply(rule cfgLM.derivation_append_preserves_derivation)\n     apply(rename_tac n d e1 r B v c d')(*strict*)\n     apply(force)\n    apply(rename_tac n d e1 r B v c d')(*strict*)\n    apply(rule cfgLM.der2_is_derivation)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(rule_tac\n      x=\"liftB c\"\n      in exI)\n    apply(clarsimp)\n    apply(simp add: simpY)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   apply(clarsimp)\n   apply(simp add: der2_def)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   prefer 2\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(rule_tac\n      t=\"Suc n\"\n      and s=\"n+Suc 0\"\n      in ssubst)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   apply(force)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(rule_tac\n      t=\"get_labels (derivation_append d' (der2 \\<lparr>cfg_conf = liftB c @ teA B # r\\<rparr> \\<lparr>prod_lhs = B, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB c @ v @ r\\<rparr>) n) (n + Suc 0)\"\n      and s=\"get_labels d' n @ (get_labels (der2 \\<lparr>cfg_conf = liftB c @ teA B # r\\<rparr> \\<lparr>prod_lhs = B, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB c @ v @ r\\<rparr>) (Suc 0))\"\n      in ssubst)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   apply(rule cfgLM.get_labels_concat2)\n       apply(rename_tac n d e1 r B v c d')(*strict*)\n       apply(force)\n      apply(rename_tac n d e1 r B v c d')(*strict*)\n      apply(force)\n     apply(rename_tac n d e1 r B v c d')(*strict*)\n     apply(rule cfgLM.der2_is_derivation)\n     apply(simp add: cfgLM_step_relation_def)\n     apply(rule_tac\n      x=\"liftB c\"\n      in exI)\n     apply(clarsimp)\n     apply(simp add: simpY)\n    apply(rename_tac n d e1 r B v c d')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   apply(simp add: der2_def)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(rule_tac\n      t=\"get_labels (der2 \\<lparr>cfg_conf = liftB c @ teA B # r\\<rparr> \\<lparr>prod_lhs = B, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB c @ v @ r\\<rparr>) (Suc 0)\"\n      and s=\"[Some \\<lparr>prod_lhs = B, prod_rhs = v\\<rparr>]\"\n      in ssubst)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   apply(rule der2_get_labels)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc n)) = SSn + 1 - SSi\" for SSn SSi)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSn + 1 - SSi\" for SSn SSi)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(clarsimp)\n  apply(rule listEqI)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   apply(force)\n  apply(rename_tac n d e1 r B v c d' i)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"i<n\")\n   apply(rename_tac n d e1 r B v c d' i)(*strict*)\n   apply(rule_tac\n      t=\"(map (\\<lambda>i. get_label (derivation_take d n i)) (nat_seq (Suc 0) n) @ [Some \\<lparr>prod_lhs = B, prod_rhs = v\\<rparr>]) ! i\"\n      and s=\"(map (\\<lambda>i. get_label (derivation_take d n i)) (nat_seq (Suc 0) n)) ! i\"\n      in ssubst)\n    apply(rename_tac n d e1 r B v c d' i)(*strict*)\n    apply(rule nth_append_1)\n    apply(force)\n   apply(rename_tac n d e1 r B v c d' i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_take_def)\n   apply(subgoal_tac \"nat_seq (Suc 0) n ! i = (SSn)+(SSi)\" for SSn SSi)\n    apply(rename_tac n d e1 r B v c d' i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac n d e1 r B v c d' i)(*strict*)\n     apply(force)\n    apply(rename_tac n d e1 r B v c d' i)(*strict*)\n    apply(force)\n   apply(rename_tac n d e1 r B v c d' i)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc n) ! i = (SSn)+(SSi)\" for SSn SSi)\n    apply(rename_tac n d e1 r B v c d' i)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac n d e1 r B v c d' i)(*strict*)\n     apply(force)\n    apply(rename_tac n d e1 r B v c d' i)(*strict*)\n    apply(force)\n   apply(rename_tac n d e1 r B v c d' i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n d e1 r B v c d' i)(*strict*)\n  apply(subgoal_tac \"i=n\")\n   apply(rename_tac n d e1 r B v c d' i)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac n d e1 r B v c d' i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(rule_tac\n      t=\"(map (\\<lambda>i. get_label (derivation_take d n i)) (nat_seq (Suc 0) n) @ [Some \\<lparr>prod_lhs = B, prod_rhs = v\\<rparr>]) ! n\"\n      and s=\"[Some \\<lparr>prod_lhs = B, prod_rhs = v\\<rparr>] ! (n-length (map (\\<lambda>i. get_label (derivation_take d n i)) (nat_seq (Suc 0) n)))\"\n      in ssubst)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   apply(rule nth_append_2)\n   apply(force)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_label_def)\n  apply(subgoal_tac \"nat_seq (Suc 0) (Suc n) ! n = (SSn)+(SSi)\" for SSn SSi)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac n d e1 r B v c d')(*strict*)\n    apply(force)\n   apply(rename_tac n d e1 r B v c d')(*strict*)\n   apply(force)\n  apply(rename_tac n d e1 r B v c d')(*strict*)\n  apply(clarsimp)\n  done\n\nlemma cfgLM_drop_first_production: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> d (Suc 0) = Some (pair (Some e1) c1)\n  \\<Longrightarrow> Some e1#(get_labels (derivation_drop d (Suc 0)) n) = get_labels d (Suc n)\"\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"nat_seq (Suc 0) (Suc n) = [Suc 0]@(nat_seq (Suc (Suc 0)) (Suc n))\")\n   prefer 2\n   apply(rule nat_seq_drop_first)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSn + 1 - SSi\" for SSn SSi)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(subgoal_tac \"length (nat_seq (Suc (Suc 0)) (Suc n)) = SSn + 1 - SSi\" for SSn SSi)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rule conjI)\n   apply(simp add: get_label_def)\n  apply(rule listEqI)\n   apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"nat_seq (Suc 0) n ! i = (SSn)+(SSi)\" for SSn SSi)\n   apply(rename_tac i)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(force)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"nat_seq (Suc (Suc 0)) (Suc n) ! i = (SSn)+(SSi)\" for SSn SSi)\n   apply(rename_tac i)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(force)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_drop_def get_label_def)\n  done\n\nlemma cfg_sub_preserves_cfgLM_belongs: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G' d\n  \\<Longrightarrow> cfgLM.belongs G' d\n  \\<Longrightarrow> cfg_sub G' G\n  \\<Longrightarrow> cfgLM.belongs G d\"\n  apply(simp add: cfgLM.belongs_def cfg_sub_def)\n  apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(case_tac \"d i\")\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac i a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i option b)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac i option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i b)(*strict*)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(simp add: cfg_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac i c)(*strict*)\n   apply(force)\n  apply(rename_tac i option b a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i b a)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in allE)\n  apply(clarsimp)\n  apply(simp add: cfg_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac i a c)(*strict*)\n  apply(simp add: cfg_step_labels_def)\n  apply(force)\n  done\n\nlemma cfgLM_drop_leading_terminals: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf=liftB w@w'\\<rparr>)\n  \\<Longrightarrow> d n \\<noteq> None\n  \\<Longrightarrow>\n  (\\<forall>i\\<le>n. prefix(liftB w)(cfg_conf(the(get_configuration(d i)))))\n  \\<and> cfgLM.derivation G (derivation_map d (\\<lambda>v. \\<lparr>cfg_conf = drop (length w) (cfg_conf v)\\<rparr>))\n  \\<and> cfgLM.belongs G (derivation_map d (\\<lambda>v. \\<lparr>cfg_conf = drop (length w) (cfg_conf v)\\<rparr>))\"\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac y i)(*strict*)\n   apply(subgoal_tac \"\\<exists>e c. d i = Some (pair e c)\")\n    apply(rename_tac y i)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"n\"\n      in cfgLM.pre_some_position_is_some_position)\n      apply(rename_tac y i)(*strict*)\n      apply(force)\n     apply(rename_tac y i)(*strict*)\n     apply(force)\n    apply(rename_tac y i)(*strict*)\n    apply(force)\n   apply(rename_tac y i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y i e c)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(case_tac c)\n   apply(rename_tac y i e c cfg_confa)(*strict*)\n   apply(rename_tac v)\n   apply(rename_tac y i e c v)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y i e v)(*strict*)\n   apply(subgoal_tac \"\\<exists>v. cfg_conf SSc2 = liftB SSw @ v\" for SSc2 SSw)\n    apply(rename_tac y i e v)(*strict*)\n    prefer 2\n    apply(rule_tac\n      G=\"G\"\n      and d=\"d\"\n      and n=\"0\"\n      and m=\"i\"\n      in CFGLM_terminals_stay_at_front)\n        apply(rename_tac y i e v)(*strict*)\n        apply(force)\n       apply(rename_tac y i e v)(*strict*)\n       apply(force)\n      apply(rename_tac y i e v)(*strict*)\n      apply(force)\n     apply(rename_tac y i e v)(*strict*)\n     apply(force)\n    apply(rename_tac y i e v)(*strict*)\n    apply(clarsimp)\n    apply(force)\n   apply(rename_tac y i e v)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y i e va)(*strict*)\n   apply(simp add: prefix_def)\n  apply(rule context_conjI)\n   apply(rule_tac\n      P=\"\\<lambda>c. take (length w) (cfg_conf c) = liftB w\"\n      in cfgLM.derivation_map_preserves_derivation)\n     apply(force)\n    apply(rename_tac i e c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac i e c y)(*strict*)\n    apply(case_tac c)\n    apply(rename_tac i e c y cfg_confa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac i e cfg_conf y)(*strict*)\n    apply(rename_tac i e v y)(*strict*)\n    apply(subgoal_tac \"\\<exists>v. cfg_conf SSc2 = liftB SSw @ v\" for SSc2 SSw)\n     apply(rename_tac y i e v)(*strict*)\n     prefer 2\n     apply(rename_tac i e v y)(*strict*)\n     apply(rule_tac\n      G=\"G\"\n      and d=\"d\"\n      and n=\"0\"\n      and m=\"i\"\n      in CFGLM_terminals_stay_at_front)\n         apply(rename_tac y i e v)(*strict*)\n         apply(force)\n        apply(rename_tac y i e v)(*strict*)\n        apply(force)\n       apply(rename_tac y i e v)(*strict*)\n       apply(force)\n      apply(rename_tac y i e v)(*strict*)\n      apply(force)\n     apply(rename_tac y i e v)(*strict*)\n     apply(clarsimp)\n     apply(force)\n    apply(rename_tac y i e v)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac y i e va)(*strict*)\n    apply (metis liftB_reflects_length append_Nil2 diff_self_eq_0 le_refl take_0 take_liftB take_all)\n   apply(rename_tac c1 e c2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y a e b)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac y a e b l r)(*strict*)\n   apply(case_tac \"length w-length l\")\n    apply(rename_tac y a e b l r)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"drop (length w) l\"\n      in exI)\n    apply(clarsimp)\n    apply (metis setADropIndexSubset2 subset_empty)\n   apply(rename_tac y a e b l r nat)(*strict*)\n   apply(clarsimp)\n   apply(case_tac b)\n   apply(rename_tac y a e b l r nat option conf)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y a e l r nat option conf)(*strict*)\n   apply(case_tac a)\n   apply(rename_tac y a e l r nat option conf prod_lhsa prod_rhsa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y e l r nat option conf prod_lhs prod_rhs)(*strict*)\n   apply(rename_tac y e l r nat option conf prod_lhs prod_rhs)\n   apply (metis setA_liftB elemInsetA emptyE)\n  apply(rule cfgLM.derivation_map_preserves_belongs)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: cfg_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac y ca)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac y ca)(*strict*)\n   apply (metis setADropIndexSubset2 psubset_eq psubset_subset_trans)\n  apply(rename_tac y ca)(*strict*)\n  apply (metis setBDropIndexSubset2 psubset_eq psubset_subset_trans)\n  done\n\nlemma unique_CFGlmEliminators_final_string: \"\n  valid_cfg G\n  \\<Longrightarrow> \\<pi> \\<in> CFGlmEliminators G X\n  \\<Longrightarrow> \\<exists>!w. \\<exists>d n e.\n  cfgLM.derivation G d\n  \\<and> cfgLM.belongs G d\n  \\<and> d 0 = Some (pair None \\<lparr>cfg_conf=(option_to_list X)\\<rparr>)\n  \\<and> d n = Some (pair e \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<and> \\<pi>=map the (get_labels d n)\"\n  apply(rule HOL.ex_ex1I)\n   apply(clarsimp)\n   apply(simp add: CFGlmEliminators_def)\n   apply(clarsimp)\n   apply(rename_tac d n e w)(*strict*)\n   apply(rule_tac\n      x=\"w\"\n      in exI)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n  apply(rename_tac w y)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac w y d da n na e ea)(*strict*)\n  apply(subgoal_tac \"n=na\")\n   apply(rename_tac w y d da n na e ea)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac w y d da na e ea)(*strict*)\n   apply(subgoal_tac \"da na = d na\")\n    apply(rename_tac w y d da na e ea)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac w y d da na ea)(*strict*)\n    apply(rule liftB_inj)\n    apply(force)\n   apply(rename_tac w y d da na e ea)(*strict*)\n   apply(rule_tac\n      n=\"na\"\n      and ?m1.0=\"0\"\n      and ?m2.0=\"0\"\n      in equal_labels_implies_equal_cfgLMderivation)\n          apply(rename_tac w y d da na e ea)(*strict*)\n          apply(force)\n         apply(rename_tac w y d da na e ea)(*strict*)\n         apply(force)\n        apply(rename_tac w y d da na e ea)(*strict*)\n        apply(force)\n       apply(rename_tac w y d da na e ea)(*strict*)\n       apply(force)\n      apply(rename_tac w y d da na e ea)(*strict*)\n      apply(force)\n     apply(rename_tac w y d da na e ea)(*strict*)\n     apply(force)\n    apply(rename_tac w y d da na e ea)(*strict*)\n    apply(force)\n   apply(rename_tac w y d da na e ea)(*strict*)\n   apply(force)\n  apply(rename_tac w y d da n na e ea)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSn + 1 - SSi\" for SSn SSi)\n   apply(rename_tac w y d da n na e ea)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac w y d da n na e ea)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) na) = SSn + 1 - SSi\" for SSn SSi)\n   apply(rename_tac w y d da n na e ea)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac w y d da n na e ea)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"length (map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) n)) = length(map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) na))\")\n   apply(rename_tac w y d da n na e ea)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac w y d da n na e ea)(*strict*)\n  apply(rule_tac\n      t=\"n\"\n      and s=\"length (map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) n))\"\n      in ssubst)\n   apply(rename_tac w y d da n na e ea)(*strict*)\n   apply (metis length_map)\n  apply(rename_tac w y d da n na e ea)(*strict*)\n  apply(rule_tac\n      t=\"na\"\n      and s=\"length (map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) na))\"\n      in ssubst)\n   apply(rename_tac w y d da n na e ea)(*strict*)\n   apply (metis length_map)\n  apply(rename_tac w y d da n na e ea)(*strict*)\n  apply(force)\n  done\n\nlemma uniqueness_of_elimination_string_list_hlp: \"\n  valid_cfg G\n  \\<Longrightarrow> length ws1 = length w\n  \\<Longrightarrow> length ws2 = length w\n  \\<Longrightarrow> \\<forall>k<length w. \\<exists>d. cfgLM.derivation G d \\<and> cfgLM.belongs G d \\<and>d 0 = Some (pair None \\<lparr>cfg_conf = option_to_list (Some (w ! k))\\<rparr>) \\<and> (\\<exists>n. (\\<exists>e. d n = Some (pair e \\<lparr>cfg_conf = liftB (ws1 ! k)\\<rparr>)) \\<and> \\<pi>s ! k = map the (get_labels d n))\n  \\<Longrightarrow> length \\<pi>s = length w\n  \\<Longrightarrow> \\<forall>k<length w. \\<exists>d. cfgLM.derivation G d \\<and> cfgLM.belongs G d \\<and> d 0 = Some (pair None \\<lparr>cfg_conf = option_to_list (Some (w ! k))\\<rparr>) \\<and> (\\<exists>n. (\\<exists>e. d n = Some (pair e \\<lparr>cfg_conf = liftB (ws2 ! k)\\<rparr>)) \\<and> \\<pi>s ! k = map the (get_labels d n))\n  \\<Longrightarrow> i < length w \\<Longrightarrow> ws1 ! i = ws2 ! i\"\n  apply(induct i rule: less_induct)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"x\"\n      in allE)+\n  apply(clarsimp)\n  apply(rename_tac x d da n na e ea)(*strict*)\n  apply(subgoal_tac \"n=na\")\n   apply(rename_tac x d da n na e ea)(*strict*)\n   prefer 2\n   apply(simp add: get_labels_def)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSm + 1 - SSn\" for SSm SSn)\n    apply(rename_tac x d da n na e ea)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac x d da n na e ea)(*strict*)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc na)) = SSm + 1 - SSn\" for SSm SSn)\n    apply(rename_tac x d da n na e ea)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac x d da n na e ea)(*strict*)\n   apply (metis One_nat_def Suc_eq_plus1 diff_Suc_1 length_map nat_seq_length_prime)\n  apply(rename_tac x d da n na e ea)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d da na e ea)(*strict*)\n  apply(subgoal_tac \"d na=da na\")\n   apply(rename_tac x d da na e ea)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x d da na e)(*strict*)\n   apply(rule liftB_inj)\n   apply(rule sym)\n   apply(force)\n  apply(rename_tac x d da na e ea)(*strict*)\n  apply(rule_tac\n      d'=\"d\"\n      and d'a=\"da\"\n      and n=\"na\"\n      and ?m1.0=\"0\"\n      and ?m2.0=\"0\"\n      and i=\"na\"\n      in equal_labels_implies_equal_cfgLMderivation)\n         apply(rename_tac x d da na e ea)(*strict*)\n         apply(force)\n        apply(rename_tac x d da na e ea)(*strict*)\n        apply(force)\n       apply(rename_tac x d da na e ea)(*strict*)\n       apply(force)\n      apply(rename_tac x d da na e ea)(*strict*)\n      apply(force)\n     apply(rename_tac x d da na e ea)(*strict*)\n     apply(force)\n    apply(rename_tac x d da na e ea)(*strict*)\n    apply(force)\n   apply(rename_tac x d da na e ea)(*strict*)\n   apply(force)\n  apply(rename_tac x d da na e ea)(*strict*)\n  apply(force)\n  done\n\nlemma uniqueness_of_elimination_string_list: \"\n  valid_cfg G\n  \\<Longrightarrow> length \\<pi>s=length w\n  \\<Longrightarrow> \\<forall>i<length \\<pi>s. \\<pi>s ! i \\<in> CFGlmEliminators G (Some (w ! i))\n  \\<Longrightarrow> length \\<pi>s = length ws1 \\<and>\n               (\\<forall>k<length \\<pi>s.\n                   \\<exists>d n e.\n                      cfgLM.derivation G d \\<and>\n                      cfgLM.belongs G d \\<and>\n                      d 0 =\n                      Some (pair None\n                             \\<lparr>cfg_conf = option_to_list (Some (w ! k))\\<rparr>) \\<and>\n                      d n = Some (pair e \\<lparr>cfg_conf = liftB (ws1 ! k)\\<rparr>) \\<and>\n                      \\<pi>s ! k = map the (get_labels d n))\n  \\<Longrightarrow> length \\<pi>s = length ws2 \\<and>\n               (\\<forall>k<length \\<pi>s.\n                   \\<exists>d n e.\n                      cfgLM.derivation G d \\<and>\n                      cfgLM.belongs G d \\<and>\n                      d 0 =\n                      Some (pair None\n                             \\<lparr>cfg_conf = option_to_list (Some (w ! k))\\<rparr>) \\<and>\n                      d n = Some (pair e \\<lparr>cfg_conf = liftB (ws2 ! k)\\<rparr>) \\<and>\n                      \\<pi>s ! k = map the (get_labels d n))\n  \\<Longrightarrow> ws1 = ws2\"\n  apply(rule listEqI)\n   apply(force)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      \\<pi>s=\"\\<pi>s\"\n      and w=\"w\"\n      in uniqueness_of_elimination_string_list_hlp)\n        apply(rename_tac i)(*strict*)\n        apply(force)\n       apply(rename_tac i)(*strict*)\n       apply(force)\n      apply(rename_tac i)(*strict*)\n      apply(force)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(force)\n  apply(rename_tac i)(*strict*)\n  apply(force)\n  done\n\nlemma unique_existence_of_elimination_string_list: \"\n  valid_cfg G\n  \\<Longrightarrow> length \\<pi>s=length w\n  \\<Longrightarrow> \\<forall>i<length \\<pi>s. \\<pi>s ! i \\<in> CFGlmEliminators G (Some (w ! i))\n  \\<Longrightarrow> \\<exists>!ws. length \\<pi>s = length ws \\<and>\n               (\\<forall>k<length \\<pi>s.\n                   \\<exists>d n e.\n                      cfgLM.derivation G d \\<and>\n                      cfgLM.belongs G d \\<and>\n                      d 0 =\n                      Some (pair None\n                             \\<lparr>cfg_conf = option_to_list (Some (w ! k))\\<rparr>) \\<and>\n                      d n = Some (pair e \\<lparr>cfg_conf = liftB (ws ! k)\\<rparr>) \\<and>\n                      \\<pi>s ! k = map the (get_labels d n))\"\n  apply(rule HOL.ex_ex1I)\n   apply(rule existence_of_elimination_string_list)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rename_tac ws y)(*strict*)\n  apply(rule uniqueness_of_elimination_string_list)\n      apply(rename_tac ws y)(*strict*)\n      apply(force)\n     apply(rename_tac ws y)(*strict*)\n     apply(force)\n    apply(rename_tac ws y)(*strict*)\n    apply(force)\n   apply(rename_tac ws y)(*strict*)\n   apply(force)\n  apply(rename_tac ws y)(*strict*)\n  apply(force)\n  done\n\nlemma CFGlm_unambiguous_coincide: \"\n  valid_cfg G\n  \\<Longrightarrow> CFGlm_unambiguous G\n  \\<Longrightarrow> cfgLM.derivation_initial G d1\n  \\<Longrightarrow> cfgLM.derivation_initial G d2\n  \\<Longrightarrow> d1 n1 = Some (pair e1 \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<Longrightarrow> d2 n2 = Some (pair e2 \\<lparr>cfg_conf=liftB w\\<rparr>)\n  \\<Longrightarrow> n1=n2 \\<and> d1 = d2\"\n  apply(subgoal_tac \"d1=d2\")\n   prefer 2\n   apply(simp add: CFGlm_unambiguous_def)\n  apply(clarsimp)\n  apply(case_tac \"n1<n2\")\n   apply(subgoal_tac \"n2-n1=0\")\n    apply(force)\n   apply(rule cfgLM_no_step_without_nontermsX)\n       apply(force)\n      apply(rule cfgLM.derivation_initial_is_derivation)\n      apply(force)\n     apply(force)\n    apply(clarsimp)\n    apply(simp add: simpX)\n   apply(force)\n  apply(case_tac \"n2<n1\")\n   apply(subgoal_tac \"n1-n2=0\")\n    apply(force)\n   apply(rule_tac\n      d=\"d2\"\n      and n=\"n2\"\n      in cfgLM_no_step_without_nontermsX)\n       apply(force)\n      apply(rule cfgLM.derivation_initial_is_derivation)\n      apply(force)\n     apply(force)\n    apply(clarsimp)\n    apply(simp add: simpX)\n   apply(force)\n  apply(force)\n  done\n\nlemma equal_eliminators_hlp1: \"\n  valid_cfg G\n  \\<Longrightarrow> take i y1 = take i y2\n  \\<Longrightarrow> foldl (@) [] y1 = foldl (@) [] f\\<pi>2\n  \\<Longrightarrow> foldl (@) [] y2 = foldl (@) [] f\\<pi>2\n  \\<Longrightarrow> length y1 = length w\n  \\<Longrightarrow> length y2 = length w\n  \\<Longrightarrow> Suc i \\<le> length w\n  \\<Longrightarrow> y1 ! i \\<in> CFGlmEliminators G (Some (w ! i))\n  \\<Longrightarrow> y2 ! i \\<in> CFGlmEliminators G (Some (w ! i))\n  \\<Longrightarrow> y1 ! i @ c = y2 ! i\n  \\<Longrightarrow> y1 ! i = y2 ! i\"\n  apply(simp add: CFGlmEliminators_def)\n  apply(clarsimp)\n  apply(rename_tac d da n na e wa ea waa)(*strict*)\n  apply(subgoal_tac \"n\\<le>na\")\n   apply(rename_tac d da n na e wa ea waa)(*strict*)\n   prefer 2\n   apply (metis get_labels_length drop_length_append length_map)\n  apply(rename_tac d da n na e wa ea waa)(*strict*)\n  apply(subgoal_tac \"da n = d n\")\n   apply(rename_tac d da n na e wa ea waa)(*strict*)\n   apply(clarsimp)\n   apply(case_tac c)\n    apply(rename_tac d da n na e wa ea waa)(*strict*)\n    apply(force)\n   apply(rename_tac d da n na e wa ea waa a list)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"n=na\")\n    apply(rename_tac d da n na e wa ea waa a list)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d da na e wa waa a list)(*strict*)\n    apply (metis get_labels_length length_map self_append_conv takePrecise)\n   apply(rename_tac d da n na e wa ea waa a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. da n = Some (pair e1 c1) \\<and> da (Suc n) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\")\n    apply(rename_tac d da n na e wa ea waa a list)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"na\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac d da n na e wa ea waa a list)(*strict*)\n      apply(force)\n     apply(rename_tac d da n na e wa ea waa a list)(*strict*)\n     apply(force)\n    apply(rename_tac d da n na e wa ea waa a list)(*strict*)\n    apply(force)\n   apply(rename_tac d da n na e wa ea waa a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d da n na e wa ea waa a list e2 c2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac d da n na e wa ea waa a list e2 c2 l r)(*strict*)\n   apply (metis hlp2 liftB_reflects_length append_self_conv drop_length_append le_neq_implies_less list.simps(3) nth_append_length take_liftB take_append_prime)\n  apply(rename_tac d da n na e wa ea waa)(*strict*)\n  apply(rule_tac\n      ?x2.0=\"0\"\n      and n=\"n\"\n      and ?x1.0=\"na-n\"\n      in equal_eliminators_hlp2)\n         apply(rename_tac d da n na e wa ea waa)(*strict*)\n         apply(force)\n        apply(rename_tac d da n na e wa ea waa)(*strict*)\n        apply(force)\n       apply(rename_tac d da n na e wa ea waa)(*strict*)\n       apply(force)\n      apply(rename_tac d da n na e wa ea waa)(*strict*)\n      apply(force)\n     apply(rename_tac d da n na e wa ea waa)(*strict*)\n     apply(force)\n    apply(rename_tac d da n na e wa ea waa)(*strict*)\n    apply(force)\n   apply(rename_tac d da n na e wa ea waa)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(clarsimp)\n   apply(rename_tac d da n na e wa ea waa x)(*strict*)\n   apply(subgoal_tac \"Suc 0\\<le>x \\<and> x\\<le>n\")\n    apply(rename_tac d da n na e wa ea waa x)(*strict*)\n    prefer 2\n    apply (metis less_eq_Suc_le_raw nat_seq_in_interval)\n   apply(rename_tac d da n na e wa ea waa x)(*strict*)\n   apply(clarsimp)\n   apply(case_tac x)\n    apply(rename_tac d da n na e wa ea waa x)(*strict*)\n    apply(force)\n   apply(rename_tac d da n na e wa ea waa x nat)(*strict*)\n   apply(subgoal_tac \"the(get_label (da x)) = the(get_label (d x))\")\n    apply(rename_tac d da n na e wa ea waa x nat)(*strict*)\n    apply(subgoal_tac \"\\<exists>e c. da (Suc nat) = Some (pair (Some e) c)\")\n     apply(rename_tac d da n na e wa ea waa x nat)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"na\"\n      in cfgLM.pre_some_position_is_some_position_prime)\n        apply(rename_tac d da n na e wa ea waa x nat)(*strict*)\n        apply(force)\n       apply(rename_tac d da n na e wa ea waa x nat)(*strict*)\n       apply(force)\n      apply(rename_tac d da n na e wa ea waa x nat)(*strict*)\n      apply(force)\n     apply(rename_tac d da n na e wa ea waa x nat)(*strict*)\n     apply(force)\n    apply(rename_tac d da n na e wa ea waa x nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d da n na e wa ea waa nat eb ca)(*strict*)\n    apply(subgoal_tac \"\\<exists>e c. d (Suc nat) = Some (pair (Some e) c)\")\n     apply(rename_tac d da n na e wa ea waa nat eb ca)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"n\"\n      in cfgLM.pre_some_position_is_some_position_prime)\n        apply(rename_tac d da n na e wa ea waa nat eb ca)(*strict*)\n        apply(force)\n       apply(rename_tac d da n na e wa ea waa nat eb ca)(*strict*)\n       apply(force)\n      apply(rename_tac d da n na e wa ea waa nat eb ca)(*strict*)\n      apply(force)\n     apply(rename_tac d da n na e wa ea waa nat eb ca)(*strict*)\n     apply(force)\n    apply(rename_tac d da n na e wa ea waa nat eb ca)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d da n na e wa ea waa nat eb ca ec caa)(*strict*)\n    apply(simp add: get_label_def)\n   apply(rename_tac d da n na e wa ea waa x nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n   apply(rule_tac\n      t=\"the (get_label (da (Suc nat)))\"\n      and s=\"(map (the \\<circ> (\\<lambda>i. get_label (da i))) (nat_seq (Suc 0) na))!nat\"\n      in ssubst)\n    apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n    prefer 2\n    apply(rule_tac\n      t=\"the (get_label (d (Suc nat)))\"\n      and s=\"(map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) n) @ c)! nat\"\n      in ssubst)\n     apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n     prefer 2\n     apply(rule sym)\n     apply(rule_tac\n      f=\"\\<lambda>x. x! nat\"\n      in HOL.arg_cong)\n     apply(force)\n    apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n    apply(subgoal_tac \"nat_seq (Suc 0) n ! nat = (SSn)+(SSi)\" for SSn SSi)\n     apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n     prefer 2\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n      apply(force)\n     apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n     apply(force)\n    apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n    apply(rule_tac\n      t=\"(map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) n) @ c) ! nat\"\n      and s=\"(map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) n)) ! nat\"\n      in ssubst)\n     apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n     apply(rule nth_append_1)\n     apply(clarsimp)\n     apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSn + 1 - SSi\" for SSn SSi)\n      apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n      prefer 2\n      apply(rule nat_seq_length_prime)\n     apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n     apply(force)\n    apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n    apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (d i))) (nat_seq (Suc 0) n) ! nat\"\n      and s=\"((the \\<circ> (\\<lambda>i. get_label (d i)))) ((nat_seq (Suc 0) n) ! nat)\"\n      in ssubst)\n     apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n     apply(rule nth_map)\n     apply(subgoal_tac \"length (nat_seq (Suc 0) n) = SSn + 1 - SSi\" for SSn SSi)\n      apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n      prefer 2\n      apply(rule nat_seq_length_prime)\n     apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n     apply(force)\n    apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n    apply(force)\n   apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n   apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (da i))) (nat_seq (Suc 0) na) ! nat\"\n      and s=\"((the \\<circ> (\\<lambda>i. get_label (da i)))) ((nat_seq (Suc 0) na) ! nat)\"\n      in ssubst)\n    apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n    apply(rule nth_map)\n    apply(subgoal_tac \"length (nat_seq (Suc 0) na) = SSn + 1 - SSi\" for SSn SSi)\n     apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n     prefer 2\n     apply(rule nat_seq_length_prime)\n    apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n    apply(force)\n   apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n   apply(subgoal_tac \"nat_seq (Suc 0) na ! nat = (SSn)+(SSi)\" for SSn SSi)\n    apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n     apply(force)\n    apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n    apply(force)\n   apply(rename_tac d da n na e wa ea waa nat)(*strict*)\n   apply(force)\n  apply(rename_tac d da n na e wa ea waa)(*strict*)\n  apply(force)\n  done\n\nlemma equal_eliminators_hlp0: \"\n  valid_cfg G\n  \\<Longrightarrow> foldl (@) [] y1 = foldl (@) [] f\\<pi>2\n  \\<Longrightarrow> foldl (@) [] y2 = foldl (@) [] f\\<pi>2\n  \\<Longrightarrow> length y1 = length w\n  \\<Longrightarrow> \\<forall>i<length w.\n           y1 ! i\n           \\<in> CFGlmEliminators G\n              (Some (w ! i))\n  \\<Longrightarrow> length y2 = length w\n  \\<Longrightarrow> \\<forall>i<length w.\n           y2 ! i\n           \\<in> CFGlmEliminators G\n              (Some (w ! i))\n  \\<Longrightarrow> i\\<le>length w\n  \\<Longrightarrow> take i y1 = take i y2\"\n  apply(induct i)\n   apply(clarsimp)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"take (Suc i) y1\"\n      and s=\"take i y1 @ [y1!i]\"\n      in ssubst)\n   apply(rename_tac i)(*strict*)\n   apply (metis less_eq_Suc_le take_n_vs_take_Suc_n)\n  apply(rename_tac i)(*strict*)\n  apply(rule_tac\n      t=\"take (Suc i) y2\"\n      and s=\"take i y2 @ [y2!i]\"\n      in ssubst)\n   apply(rename_tac i)(*strict*)\n   apply (metis less_eq_Suc_le take_n_vs_take_Suc_n)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"i\"\n      in allE)+\n  apply(clarsimp)\n  apply(subgoal_tac \"prefix ((foldl (@) [] (take i y1)) @ y1!i) ((foldl (@) [] (take i y2)) @ y2!i) \\<or> prefix ((foldl (@) [] (take i y2)) @y2!i) ((foldl (@) [] (take i y1)) @ y1!i)\")\n   apply(rename_tac i)(*strict*)\n   prefer 2\n   apply(rule_tac\n      b=\"(foldl (@) [] (drop (Suc i) y1))\"\n      and d=\"(foldl (@) [] (drop (Suc i) y2))\"\n      in mutual_prefix_prefix)\n   apply(rule_tac\n      t=\"(foldl (@) [] (take i y1) @ y1 ! i) @ foldl (@) [] (drop (Suc i) y1)\"\n      and s=\"foldl (@) [] y1\"\n      in ssubst)\n    apply(rename_tac i)(*strict*)\n    apply (metis Suc_le_lessD append_take_drop_id foldl_Cons foldl_append foldl_first Cons_nth_drop_Suc)\n   apply(rename_tac i)(*strict*)\n   apply(rule_tac\n      t=\"(foldl (@) [] (take i y2) @ y2 ! i) @ foldl (@) [] (drop (Suc i) y2)\"\n      and s=\"foldl (@) [] y2\"\n      in ssubst)\n    apply(rename_tac i)(*strict*)\n    apply (metis Suc_le_lessD append_take_drop_id foldl_Cons foldl_append foldl_first Cons_nth_drop_Suc)\n   apply(rename_tac i)(*strict*)\n   apply(force)\n  apply(rename_tac i)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac i c)(*strict*)\n   apply(rule equal_eliminators_hlp1)\n            apply(rename_tac i c)(*strict*)\n            apply(force)\n           apply(rename_tac i c)(*strict*)\n           apply(force)\n          apply(rename_tac i c)(*strict*)\n          apply(force)\n         apply(rename_tac i c)(*strict*)\n         apply(force)\n        apply(rename_tac i c)(*strict*)\n        apply(force)\n       apply(rename_tac i c)(*strict*)\n       apply(force)\n      apply(rename_tac i c)(*strict*)\n      apply(force)\n     apply(rename_tac i c)(*strict*)\n     apply(force)\n    apply(rename_tac i c)(*strict*)\n    apply(force)\n   apply(rename_tac i c)(*strict*)\n   apply(force)\n  apply(rename_tac i)(*strict*)\n  apply(rule sym)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac i c)(*strict*)\n  apply(rule equal_eliminators_hlp1)\n           apply(rename_tac i c)(*strict*)\n           apply(force)\n          apply(rename_tac i c)(*strict*)\n          apply(force)\n         apply(rename_tac i c)(*strict*)\n         apply(force)\n        apply(rename_tac i c)(*strict*)\n        apply(force)\n       apply(rename_tac i c)(*strict*)\n       apply(force)\n      apply(rename_tac i c)(*strict*)\n      apply(force)\n     apply(rename_tac i c)(*strict*)\n     apply(force)\n    apply(rename_tac i c)(*strict*)\n    apply(force)\n   apply(rename_tac i c)(*strict*)\n   apply(force)\n  apply(rename_tac i c)(*strict*)\n  apply(force)\n  done\n\nlemma equal_eliminators: \"\n  valid_cfg G\n  \\<Longrightarrow> foldl (@) [] y1 = foldl (@) [] f\\<pi>2\n  \\<Longrightarrow> foldl (@) [] y2 = foldl (@) [] f\\<pi>2\n  \\<Longrightarrow> length y1 = length w\n  \\<Longrightarrow> \\<forall>i<length w.\n           y1 ! i\n           \\<in> CFGlmEliminators G\n              (Some (w ! i))\n  \\<Longrightarrow> length y2 = length w\n  \\<Longrightarrow> \\<forall>i<length w.\n           y2 ! i\n           \\<in> CFGlmEliminators G\n              (Some (w ! i))\n  \\<Longrightarrow> y1 = y2\"\n  apply(subgoal_tac \"take (length w) y1 = take (length w) y2\")\n   prefer 2\n   apply(rule equal_eliminators_hlp0)\n          apply(force)+\n  done\n\nlemma cfgLM_decompose_eliminating_derivation: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> cfgLM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1@w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = []\\<rparr>}\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> \\<exists>d1 d2 w1' w2' n1 n2. cfgLM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgLM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1'@w2'=[] \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=n\n  \\<and> get_labels d n=get_labels d1 n1@ (get_labels d2 n2)\"\n  apply(subgoal_tac \" \\<forall>n. \\<forall>d w1 w2. cfgLM.belongs G d \\<and> cfgLM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = []\\<rparr>} \\<and> maximum_of_domain d n \\<longrightarrow> (\\<exists>d1 d2 w1' w2' n1 n2. cfgLM.derivation_from_to G d1 {pair None \\<lparr>cfg_conf = w1\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w1'\\<rparr>} \\<and> cfgLM.derivation_from_to G d2 {pair None \\<lparr>cfg_conf = w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = w2'\\<rparr>} \\<and> w1' @ w2' = [] \\<and> maximum_of_domain d1 n1 \\<and> maximum_of_domain d2 n2 \\<and> n1+n2=n \\<and> (get_labels d n)=(get_labels d1 n1)@(get_labels d2 n2))\")\n   apply(blast)\n  apply(thin_tac \"cfgLM.derivation_from_to G d {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>} {y. \\<exists>xa. y = pair xa \\<lparr>cfg_conf = []\\<rparr>}\")\n  apply(thin_tac \"cfgLM.belongs G d\")\n  apply(thin_tac \"maximum_of_domain d n\")\n  apply(rule allI)\n  apply(rename_tac n)(*strict*)\n  apply(induct_tac n)\n   apply(rename_tac n)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2)(*strict*)\n   apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n   apply(clarsimp)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(subgoal_tac \"n=0\")\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d)(*strict*)\n    apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = []\\<rparr>\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac d)(*strict*)\n     apply(rule cfgLM.der1_is_derivation)\n    apply(rename_tac d)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d)(*strict*)\n     apply(simp add: der1_def)\n    apply(rename_tac d)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d)(*strict*)\n     apply(rule cfgLM.der1_is_derivation)\n    apply(rename_tac d)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d)(*strict*)\n     apply(rule_tac\n      x=\"0\"\n      in exI)\n     apply(simp add: der1_def)\n    apply(rename_tac d)(*strict*)\n    apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = []\\<rparr>\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac d)(*strict*)\n     apply(rule cfgLM.der1_is_derivation)\n    apply(rename_tac d)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d)(*strict*)\n     apply(simp add: der1_def)\n    apply(rename_tac d)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d)(*strict*)\n     apply(rule cfgLM.der1_is_derivation)\n    apply(rename_tac d)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d)(*strict*)\n     apply(rule_tac\n      x=\"0\"\n      in exI)\n     apply(simp add: der1_def)\n    apply(rename_tac d)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d)(*strict*)\n     apply(rule der1_maximum_of_domain)\n    apply(rename_tac d)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac d)(*strict*)\n     apply(rule der1_maximum_of_domain)\n    apply(rename_tac d)(*strict*)\n    apply(simp add: get_labels_def)\n    apply(rule_tac\n      t=\"nat_seq (Suc 0) 0\"\n      and s=\"[]\"\n      in ssubst)\n     apply(rename_tac d)(*strict*)\n     apply(rule nat_seqEmpty)\n     apply(force)\n    apply(rename_tac d)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(rule cfgLM.maximum_of_domainUnique)\n     apply(rename_tac d w1 w2 n xa)(*strict*)\n     apply(force)\n    apply(rename_tac d w1 w2 n xa)(*strict*)\n    apply(force)\n   apply(rename_tac d w1 w2 n xa)(*strict*)\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac n na)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2)(*strict*)\n  apply(simp add: cfgLM.derivation_from_to_def cfgLM.derivation_from_def cfgLM.derivation_to_def)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 n xa)(*strict*)\n  apply(subgoal_tac \"n=Suc na\")\n   apply(rename_tac na d w1 w2 n xa)(*strict*)\n   prefer 2\n   apply(rule cfgLM.maximum_of_domainUnique)\n     apply(rename_tac na d w1 w2 n xa)(*strict*)\n     apply(force)\n    apply(rename_tac na d w1 w2 n xa)(*strict*)\n    apply(force)\n   apply(rename_tac na d w1 w2 n xa)(*strict*)\n   apply(simp add: maximum_of_domain_def)\n  apply(rename_tac na d w1 w2 n xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 xa)(*strict*)\n  apply(case_tac \"d 0\")\n   apply(rename_tac na d w1 w2 xa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac na d w1 w2 xa a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 xa)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d 0 = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac na d w1 w2 xa)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc na\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac na d w1 w2 xa)(*strict*)\n     apply(force)\n    apply(rename_tac na d w1 w2 xa)(*strict*)\n    apply(force)\n   apply(rename_tac na d w1 w2 xa)(*strict*)\n   apply(force)\n  apply(rename_tac na d w1 w2 xa)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 xa e2 c2 l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac na d w1 w2 xa e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 xa e2 l r)(*strict*)\n  apply(subgoal_tac \"\\<exists>l'. liftB l' = l\")\n   apply(rename_tac na d w1 w2 xa e2 l r)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n   apply (rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac na d w1 w2 xa e2 l r)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 xa e2 r l')(*strict*)\n  apply(thin_tac \"setA (liftB l') = {}\")\n  apply(case_tac l')\n   apply(rename_tac na d w1 w2 xa e2 r l')(*strict*)\n   prefer 2\n   apply(rename_tac na d w1 w2 xa e2 r l' a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n   apply(subgoal_tac \"False\")\n    apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n    apply(force)\n   apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w. cfg_get_history SSci @ w = cfg_get_history SScij\" for SSci SScij)\n    apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n    prefer 2\n    apply(rule_tac\n      P=\"G\"\n      and d=\"d\"\n      and i=\"Suc 0\"\n      and j=\"na\"\n      in cfgLM.derivation_monotonically_inc)\n         apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n         apply(force)\n        apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n        apply(force)\n       apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n       apply(force)\n      apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n      apply(force)\n     apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n     apply(force)\n    apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n    apply(force)\n   apply(rename_tac na d w1 w2 xa e2 r a list)(*strict*)\n   apply(simp add: cfg_get_history_def)\n   apply(clarsimp)\n   apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n   apply(subgoal_tac \"maxTermPrefix (liftB []) = []\")\n    apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n    prefer 2\n    apply (rule maxTermPrefix_term_string)\n   apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"maxTermPrefix (teB a # liftB list @ prod_rhs e2 @ r) = a#maxTermPrefix (liftB list @ prod_rhs e2 @ r)\")\n    apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"a # maxTermPrefix (liftB list @ prod_rhs e2 @ r)=[]\")\n     apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n     apply(force)\n    apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n    apply(clarsimp)\n    apply(thin_tac \"\\<forall>d w1 w2. cfgLM.belongs G d \\<and> cfgLM.derivation G d \\<and> (case d 0 of None \\<Rightarrow> False | Some x \\<Rightarrow> x \\<in> {pair None \\<lparr>cfg_conf = w1 @ w2\\<rparr>}) \\<and> cfgLM.derivation G d \\<and> (\\<exists>n. d (Suc n) = None \\<and> (\\<exists>y. (\\<exists>xa. y = pair xa \\<lparr>cfg_conf = []\\<rparr>) \\<and> d n = Some y)) \\<and> maximum_of_domain d na \\<longrightarrow> (\\<exists>d1. cfgLM.derivation G d1 \\<and> (case d1 0 of None \\<Rightarrow> False | Some x \\<Rightarrow> x \\<in> {pair None \\<lparr>cfg_conf = w1\\<rparr>}) \\<and> cfgLM.derivation G d1 \\<and> (\\<exists>n. d1 (Suc n) = None \\<and> (\\<exists>y. (\\<exists>xa. y = pair xa \\<lparr>cfg_conf = []\\<rparr>) \\<and> d1 n = Some y)) \\<and> (\\<exists>d2. cfgLM.derivation G d2 \\<and> (case d2 0 of None \\<Rightarrow> False | Some x \\<Rightarrow> x \\<in> {pair None \\<lparr>cfg_conf = w2\\<rparr>}) \\<and> cfgLM.derivation G d2 \\<and> (\\<exists>n. d2 (Suc n) = None \\<and> (\\<exists>y. (\\<exists>xa. y = pair xa \\<lparr>cfg_conf = []\\<rparr>) \\<and> d2 n = Some y)) \\<and> (\\<exists>n1. maximum_of_domain d1 n1 \\<and> (\\<exists>n2. maximum_of_domain d2 n2 \\<and> n1 + n2 = na \\<and> get_labels d na = get_labels d1 n1 @ get_labels d2 n2))))\")\n    apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n    apply(thin_tac \"maxTermPrefix (teB a # liftB list @ prod_rhs e2 @ r) = a # maxTermPrefix (liftB list @ prod_rhs e2 @ r)\")\n    apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n    apply(thin_tac \"w1 @ w2 = teB a # liftB list @ teA (prod_lhs e2) # r\")\n    apply(thin_tac \"cfgLM.belongs G d\")\n    apply(thin_tac \"maximum_of_domain d (Suc na)\")\n    apply(thin_tac \"cfgLM.derivation G d\")\n    apply(thin_tac \"d (Suc (Suc na)) = None\")\n    apply(thin_tac \"d (Suc na) = Some (pair xa \\<lparr>cfg_conf = []\\<rparr>)\")\n    apply(thin_tac \"d 0 = Some (pair None \\<lparr>cfg_conf = teB a # liftB list @ teA (prod_lhs e2) # r\\<rparr>)\")\n    apply(thin_tac \"d (Suc 0) = Some (pair (Some e2) \\<lparr>cfg_conf = teB a # liftB list @ prod_rhs e2 @ r\\<rparr>)\")\n    apply(thin_tac \"e2 \\<in> cfg_productions G\")\n    apply(thin_tac \"valid_cfg G\")\n    apply(subgoal_tac \"[a]@(maxTermPrefix (liftB list @ prod_rhs e2 @ r) @ w)=[]\")\n     apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n     apply(force)\n    apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac e2 r a list w)(*strict*)\n    apply(force)\n   apply(rename_tac na d w1 w2 xa e2 r a list w)(*strict*)\n   apply(rule maxTermPrefix_pull_out)\n  apply(rename_tac na d w1 w2 xa e2 r l')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 xa e2 r)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac na d w1 w2 xa e2 r prod_lhsa prod_rhsa)(*strict*)\n  apply(rename_tac A w)\n  apply(rename_tac na d w1 w2 xa e2 r A w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w1 w2 xa r A w)(*strict*)\n  apply(case_tac w1)\n   apply(rename_tac na d w1 w2 xa r A w)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac na d xa r A w)(*strict*)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = []\\<rparr>\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac na d xa r A w)(*strict*)\n    apply(rule cfgLM.der1_is_derivation)\n   apply(rename_tac na d xa r A w)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d xa r A w)(*strict*)\n    apply(simp add: der1_def)\n   apply(rename_tac na d xa r A w)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d xa r A w)(*strict*)\n    apply(rule cfgLM.der1_is_derivation)\n   apply(rename_tac na d xa r A w)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d xa r A w)(*strict*)\n    apply(rule_tac\n      x=\"0\"\n      in exI)\n    apply(simp add: der1_def)\n   apply(rename_tac na d xa r A w)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac na d xa r A w)(*strict*)\n    apply(rule_tac\n      x=\"Suc na\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac na d xa r A w)(*strict*)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac na d xa r A w)(*strict*)\n    apply(rule der1_maximum_of_domain)\n   apply(rename_tac na d xa r A w)(*strict*)\n   apply(rule_tac\n      x=\"Suc na\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: get_labels_def)\n   apply(rule_tac\n      t=\"nat_seq (Suc 0) 0\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac na d xa r A w)(*strict*)\n    apply(rule nat_seqEmpty)\n    apply(force)\n   apply(rename_tac na d xa r A w)(*strict*)\n   apply(force)\n  apply(rename_tac na d w1 w2 xa r A w a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d w2 xa A w list)(*strict*)\n  apply(rename_tac w1)\n  apply(rename_tac na d w2 xa A w w1)(*strict*)\n  apply(erule_tac\n      x=\"derivation_drop d (Suc 0)\"\n      in allE)\n  apply(erule_tac\n      x=\"w@w1\"\n      in allE)\n  apply(erule_tac\n      x=\"w2\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac na d w2 xa A w w1)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d w2 xa A w w1)(*strict*)\n    apply(rule cfgLM.derivation_drop_preserves_belongs)\n      apply(rename_tac na d w2 xa A w w1)(*strict*)\n      apply(force)\n     apply(rename_tac na d w2 xa A w w1)(*strict*)\n     apply(force)\n    apply(rename_tac na d w2 xa A w w1)(*strict*)\n    apply(force)\n   apply(rename_tac na d w2 xa A w w1)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d w2 xa A w w1)(*strict*)\n    apply(rule cfgLM.derivation_drop_preserves_derivation)\n     apply(rename_tac na d w2 xa A w w1)(*strict*)\n     apply(force)\n    apply(rename_tac na d w2 xa A w w1)(*strict*)\n    apply(force)\n   apply(rename_tac na d w2 xa A w w1)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d w2 xa A w w1)(*strict*)\n    apply(simp add: derivation_drop_def)\n   apply(rename_tac na d w2 xa A w w1)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d w2 xa A w w1)(*strict*)\n    apply(rule cfgLM.derivation_drop_preserves_derivation)\n     apply(rename_tac na d w2 xa A w w1)(*strict*)\n     apply(force)\n    apply(rename_tac na d w2 xa A w w1)(*strict*)\n    apply(force)\n   apply(rename_tac na d w2 xa A w w1)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d w2 xa A w w1)(*strict*)\n    apply(rule_tac\n      x=\"na\"\n      in exI)\n    apply(simp add: derivation_drop_def)\n    apply(clarsimp)\n   apply(rename_tac na d w2 xa A w w1)(*strict*)\n   apply(simp add: maximum_of_domain_def)\n   apply(simp add: derivation_drop_def)\n  apply(rename_tac na d w2 xa A w w1)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n  apply(case_tac \"d1 0\")\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(force)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n  apply(case_tac \"d2 0\")\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(force)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n  apply(rule_tac\n      x = \"derivation_append (der2 \\<lparr>cfg_conf = [teA A]@w1\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = w\\<rparr> \\<lparr>cfg_conf = w@w1\\<rparr>) d1 (Suc 0)\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(rule cfgLM.derivation_append_preserves_derivation)\n     apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n     apply(rule cfgLM.der2_is_derivation)\n     apply(simp add: cfgLM_step_relation_def)\n     apply(rule_tac\n      x=\"[]\"\n      in exI)\n     apply(clarsimp)\n    apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n    apply(force)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(simp add: der2_def)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(rule cfgLM.derivation_append_preserves_derivation)\n     apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n     apply(rule cfgLM.der2_is_derivation)\n     apply(simp add: cfgLM_step_relation_def)\n     apply(rule_tac\n      x=\"[]\"\n      in exI)\n     apply(clarsimp)\n    apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n    apply(force)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(simp add: der2_def)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(rule_tac\n      x=\"Suc 0 + n\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(simp add: derivation_append_def der2_def)\n   apply(clarsimp)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n  apply(rule_tac\n      x=\"d2\"\n      in exI)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(rule_tac\n      x=\"nb\"\n      in exI)\n   apply(clarsimp)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n  apply(rule_tac\n      x=\"Suc 0+n\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(simp add: maximum_of_domain_def)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n  apply(rule_tac\n      x=\"nb\"\n      in exI)\n  apply(clarsimp)\n  apply(subgoal_tac \"n2=nb\")\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d2\"\n      in cfgLM.maximum_of_domainUnique)\n     apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n     apply(force)\n    apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n    apply(simp add: maximum_of_domain_def)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 n2 xab)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 xab)(*strict*)\n  apply(subgoal_tac \"n1=n\")\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 xab)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d1\"\n      in cfgLM.maximum_of_domainUnique)\n     apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 xab)(*strict*)\n     apply(force)\n    apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 xab)(*strict*)\n    apply(simp add: maximum_of_domain_def)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 xab)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb n1 xab)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb xab)(*strict*)\n  apply(rule_tac\n      t=\"get_labels (derivation_append (der2 \\<lparr>cfg_conf = teA A # w1\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = w\\<rparr> \\<lparr>cfg_conf = w @ w1\\<rparr>) d1 (Suc 0)) (Suc n)\"\n      and s=\"x\" for x\n      in ssubst)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb xab)(*strict*)\n   apply(rule get_labels_der2_decompose)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb xab)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"get_labels d (Suc (n + nb))\"\n      and s=\"Some SSe#get_labels (derivation_drop d (Suc 0)) ((n + nb))\" for SSe\n      in ssubst)\n   apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb xab)(*strict*)\n   prefer 2\n   apply(clarsimp)\n   apply(force)\n  apply(rename_tac d w2 xa A w w1 d1 n d2 xaa nb xab)(*strict*)\n  apply(rule get_labels_derivation_drop_decompose)\n  apply(force)\n  done\n\nlemma coinciding_derivation_parts_are_equal_up_to_unused_context: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d1\n  \\<Longrightarrow> cfgLM.derivation G d2\n  \\<Longrightarrow> cfgLM.belongs G d1\n  \\<Longrightarrow> cfgLM.belongs G d2\n  \\<Longrightarrow> length v=m\n  \\<Longrightarrow> length v1=n1\n  \\<Longrightarrow> length v2=n2\n  \\<Longrightarrow> get_labels d1 (m+n1) = v@v1\n  \\<Longrightarrow> d1 (m+n1) \\<noteq> None\n  \\<Longrightarrow> get_labels d2 (n2+m) = v2@v\n  \\<Longrightarrow> d2 (n2+m) \\<noteq> None\n  \\<Longrightarrow> d1 0 = Some (pair None c1)\n  \\<Longrightarrow> d2 n2 = Some (pair e2 c2)\n  \\<Longrightarrow> (\\<lambda>v. \\<lparr>cfg_conf = cfg_conf v @ C\\<rparr>)c1 = c2\n  \\<Longrightarrow> i\\<le>m\n  \\<Longrightarrow> derivation_take (derivation_drop d2 n2) m i = derivation_take (derivation_map d1 (\\<lambda>v. \\<lparr>cfg_conf = cfg_conf v @ C\\<rparr>)) m i\"\n  apply(induct i)\n   apply(clarsimp)\n   apply(rename_tac y ya)(*strict*)\n   apply(simp add: derivation_take_def derivation_drop_def derivation_map_def)\n  apply(rename_tac i)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya)(*strict*)\n  apply(simp add: derivation_take_def derivation_drop_def derivation_map_def)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 i = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i y ya)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"length v+length v1\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i y ya)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2a c1a c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2a c1a c2 l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac i y ya e1 e2a c1a c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2a c1a l r)(*strict*)\n  apply(case_tac c1a)\n  apply(rename_tac i y ya e1 e2a c1a l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2a l r)(*strict*)\n  apply(subgoal_tac \"\\<exists>l'. liftB l' = l\")\n   apply(rename_tac i y ya e1 e2a l r)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n   apply (rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac i y ya e1 e2a l r)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 e2a r l')(*strict*)\n  apply(thin_tac \"setA (liftB l') = {}\")\n  apply(case_tac e2a)\n  apply(rename_tac i y ya e1 e2a r l' prod_lhsa prod_rhsa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 r l' prod_lhs prod_rhs)(*strict*)\n  apply(rename_tac A w)\n  apply(rename_tac i y ya e1 r l' A w)(*strict*)\n  apply(case_tac \"i+length v2\")\n   apply(rename_tac i y ya e1 r l' A w)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y ya r l' A w)(*strict*)\n   apply(case_tac v)\n    apply(rename_tac y ya r l' A w)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac y ya r l' A w a list)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 0 = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n    apply(rename_tac y ya r l' A w a list)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc(length list)\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac y ya r l' A w a list)(*strict*)\n      apply(force)\n     apply(rename_tac y ya r l' A w a list)(*strict*)\n     apply(force)\n    apply(rename_tac y ya r l' A w a list)(*strict*)\n    apply(force)\n   apply(rename_tac y ya r l' A w a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y ya r l' A w a list e2a c2)(*strict*)\n   apply(case_tac e2a)\n   apply(rename_tac y ya r l' A w a list e2a c2 prod_lhs prod_rhs)(*strict*)\n   apply(rename_tac B w')\n   apply(rename_tac y ya r l' A w a list e2a c2 B w')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y ya r l' A w a list c2 B w')(*strict*)\n   apply(case_tac c2)\n   apply(rename_tac y ya r l' A w a list c2 B w' cfg_confa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y ya r l' A w a list B w' cfg_confa)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac y ya r l' A w a list B w' l ra)(*strict*)\n   apply(subgoal_tac \"\\<exists>l'. liftB l' = l\")\n    apply(rename_tac y ya r l' A w a list B w' l ra)(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n    apply (rule liftBDeConv2)\n    apply(force)\n   apply(rename_tac y ya r l' A w a list B w' l ra)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y ya r l' A w a list B w' ra l'a)(*strict*)\n   apply(thin_tac \"setA (liftB l'a) = {}\")\n   apply(subgoal_tac \"l'=l'a\")\n    apply(rename_tac y ya r l' A w a list B w' ra l'a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n    apply(subgoal_tac \"Some\\<lparr>prod_lhs = B, prod_rhs = w\\<rparr>=a\")\n     apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n     apply(subgoal_tac \"Some\\<lparr>prod_lhs = B, prod_rhs = w'\\<rparr>=a\")\n      apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n      apply(force)\n     apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n     prefer 2\n     apply(rule_tac\n      t=\"a\"\n      and s=\"(a # list @ v1)!0\"\n      in ssubst)\n      apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n      apply(force)\n     apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n     apply(rule_tac\n      t=\"a # list @ v1\"\n      and s=\"get_labels d1 (Suc (length list + length v1))\"\n      in ssubst)\n      apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n      apply(force)\n     apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n     apply(thin_tac \"get_labels d1 (Suc (length list + length v1)) = a # list @ v1\")\n     apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc (length list + length v1))) = SSn + 1 - Suc 0\" for SSn)\n      apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n      prefer 2\n      apply(rule nat_seq_length_prime)\n     apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n     apply(simp add: get_labels_def)\n     apply(clarsimp)\n     apply(rename_tac y ya r w B w' l'a z zs)(*strict*)\n     apply(rule_tac\n      t=\"map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) (Suc (length zs + length v1))) ! 0\"\n      and s=\"(\\<lambda>i. get_label (d1 i)) ((nat_seq (Suc 0) (Suc (length zs + length v1))) ! 0)\"\n      in ssubst)\n      apply(rename_tac y ya r w B w' l'a z zs)(*strict*)\n      apply(rule nth_map)\n      apply(force)\n     apply(rename_tac y ya r w B w' l'a z zs)(*strict*)\n     apply(subgoal_tac \"nat_seq (Suc 0) (Suc (length zs + length v1)) ! 0 = (SSn)+(SSi)\" for SSn SSi)\n      apply(rename_tac y ya r w B w' l'a z zs)(*strict*)\n      prefer 2\n      apply(rule nat_seq_nth_compute)\n       apply(rename_tac y ya r w B w' l'a z zs)(*strict*)\n       apply(force)\n      apply(rename_tac y ya r w B w' l'a z zs)(*strict*)\n      apply(force)\n     apply(rename_tac y ya r w B w' l'a z zs)(*strict*)\n     apply(clarsimp)\n     apply(simp add: get_label_def)\n    apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n    apply(rule_tac\n      t=\"a\"\n      and s=\"(a # list)!0\"\n      in ssubst)\n     apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n     apply(force)\n    apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n    apply(rule_tac\n      t=\"a # list\"\n      and s=\"get_labels d2 (Suc (length list))\"\n      in ssubst)\n     apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n     apply(force)\n    apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n    apply(thin_tac \"get_labels d2 (Suc (length list)) = a # list\")\n    apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc (length list))) = SSn + 1 - Suc 0\" for SSn)\n     apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n     prefer 2\n     apply(rule nat_seq_length_prime)\n    apply(rename_tac y ya r w a list B w' l'a)(*strict*)\n    apply(simp add: get_labels_def)\n    apply(clarsimp)\n    apply(rename_tac y ya r w list B w' l'a z zs)(*strict*)\n    apply(subgoal_tac \"nat_seq (Suc 0) (Suc (length list)) ! 0 = (SSn)+(SSi)\" for SSn SSi)\n     apply(rename_tac y ya r w list B w' l'a z zs)(*strict*)\n     prefer 2\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac y ya r w list B w' l'a z zs)(*strict*)\n      apply(force)\n     apply(rename_tac y ya r w list B w' l'a z zs)(*strict*)\n     apply(force)\n    apply(rename_tac y ya r w list B w' l'a z zs)(*strict*)\n    apply(clarsimp)\n    apply(simp add: get_label_def)\n   apply(rename_tac y ya r l' A w a list B w' ra l'a)(*strict*)\n   apply (metis identical_temrinal_maximal_prefix)\n  apply(rename_tac i y ya e1 r l' A w nat)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 (Suc nat) = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac i y ya e1 r l' A w nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"length v2+length v\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac i y ya e1 r l' A w nat)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya e1 r l' A w nat)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 r l' A w nat)(*strict*)\n   apply(force)\n  apply(rename_tac i y ya e1 r l' A w nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 r l' A w nat e1a e2a c1a c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 r l' A w nat e1a e2a c1a c2 l ra)(*strict*)\n  apply(case_tac c1a)\n  apply(rename_tac i y ya e1 r l' A w nat e1a e2a c1a c2 l ra cfg_confa)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac i y ya e1 r l' A w nat e1a e2a c1a c2 l ra cfg_confa cfg_confaa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 r l' A w nat e1a e2a l ra)(*strict*)\n  apply(case_tac e2a)\n  apply(rename_tac i y ya e1 r l' A w nat e1a e2a l ra prod_lhsa prod_rhsa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 r l' A w nat e1a l ra prod_lhs prod_rhs)(*strict*)\n  apply(rename_tac B w')\n  apply(rename_tac i y ya e1 r l' A w nat e1a l ra B w')(*strict*)\n  apply(subgoal_tac \"\\<exists>l'. liftB l' = l\")\n   apply(rename_tac i y ya e1 r l' A w nat e1a l ra B w')(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n   apply (rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac i y ya e1 r l' A w nat e1a l ra B w')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n  apply(thin_tac \"setA (liftB l'a) = {}\")\n  apply(subgoal_tac \"Some \\<lparr>prod_lhs = B, prod_rhs = w'\\<rparr> = Some \\<lparr>prod_lhs = A, prod_rhs = w\\<rparr>\")\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"Some \\<lparr>prod_lhs = B, prod_rhs = w'\\<rparr>\"\n      and s=\"(get_labels d2 (length v2 + length v))!(Suc nat)\"\n      in ssubst)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply(thin_tac \"get_labels d2 (length v2 + length v) = v2 @ v\")\n    apply(simp add: get_labels_def)\n    apply(subgoal_tac \"length (nat_seq (Suc 0) ((length v2 + length v))) = SSn + 1 - Suc 0\" for SSn)\n     apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n     prefer 2\n     apply(rule nat_seq_length_prime)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply(rule_tac\n      t=\"map (\\<lambda>i. get_label (d2 i)) (nat_seq (Suc 0) (length v2 + length v)) ! Suc nat\"\n      and s=\"(\\<lambda>i. get_label (d2 i)) ((nat_seq (Suc 0) (length v2 + length v)) ! Suc nat)\"\n      in ssubst)\n     apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n     apply(rule nth_map)\n     apply(force)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply(simp add: get_label_def)\n    apply(subgoal_tac \"nat_seq (Suc 0) (length v2 + length v) ! Suc nat= (SSn)+(SSi)\" for SSn SSi)\n     apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n     prefer 2\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n      apply(force)\n     apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n   apply(rule_tac\n      t=\"Suc nat\"\n      and s=\"length v2+i\"\n      in ssubst)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n   apply(rule_tac\n      t=\"get_labels d2 (length v2 + length v)\"\n      and s=\"v2 @ v\"\n      in ssubst)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n   apply(rule_tac\n      t=\"(v2 @ v) ! (length v2 + i)\"\n      and s=\"v ! i\"\n      in ssubst)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply (metis nth_shift2 add.commute)\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n   apply(rule_tac\n      t=\"v!i\"\n      and s=\"(v@v1)!i\"\n      in ssubst)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply (metis nth_append less_eq_Suc_le_raw)\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n   apply(rule_tac\n      t=\"v@v1\"\n      and s=\"get_labels d1 (length v + length v1)\"\n      in ssubst)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n   apply(thin_tac \"get_labels d1 (length v + length v1) = v @ v1\")\n   apply(simp add: get_labels_def)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) ((length v + length v1))) = SSn + 1 - Suc 0\" for SSn)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n   apply(rule_tac\n      t=\"map (\\<lambda>i. get_label (d1 i)) (nat_seq (Suc 0) (length v + length v1)) ! i\"\n      and s=\"(\\<lambda>i. get_label (d1 i)) ((nat_seq (Suc 0) (length v + length v1)) ! i)\"\n      in ssubst)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply(rule nth_map)\n    apply(clarsimp)\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n   apply(simp add: get_label_def)\n   apply(subgoal_tac \"nat_seq (Suc 0) (length v + length v1) ! i= (SSn)+(SSi)\" for SSn SSi)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n     apply(force)\n    apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n    apply(force)\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i y ya e1 r l' A w nat e1a ra B w' l'a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i y ya e1 r l' A w nat e1a ra l'a)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac i y ya e1 r l' A w nat e1a ra l'a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y ya r l' A w nat ra l'a)(*strict*)\n   apply(subgoal_tac \"l'=l'a\")\n    apply(rename_tac y ya r l' A w nat ra l'a)(*strict*)\n    apply(force)\n   apply(rename_tac y ya r l' A w nat ra l'a)(*strict*)\n   apply (metis identical_temrinal_maximal_prefix)\n  apply(rename_tac i y ya e1 r l' A w nat e1a ra l'a nata)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y ya e1 r l' A w ra l'a nata)(*strict*)\n  apply(subgoal_tac \"l'=l'a\")\n   apply(rename_tac y ya e1 r l' A w ra l'a nata)(*strict*)\n   apply(force)\n  apply(rename_tac y ya e1 r l' A w ra l'a nata)(*strict*)\n  apply (metis identical_temrinal_maximal_prefix)\n  done\n\nlemma coinciding_derivation_parts_are_equal_up_to_unused_context_prime: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d1\n  \\<Longrightarrow> cfgLM.derivation G d2\n  \\<Longrightarrow> cfgLM.belongs G d1\n  \\<Longrightarrow> cfgLM.belongs G d2\n  \\<Longrightarrow> length v=m\n  \\<Longrightarrow> length v1=n1\n  \\<Longrightarrow> length v2=n2\n  \\<Longrightarrow> get_labels d1 (m+n1) = v@v1\n  \\<Longrightarrow> d1 (m+n1) \\<noteq> None\n  \\<Longrightarrow> get_labels d2 (n2+m) = v2@v\n  \\<Longrightarrow> d2 (n2+m) \\<noteq> None\n  \\<Longrightarrow> d1 0 = Some (pair None c1)\n  \\<Longrightarrow> d2 n2 = Some (pair e2 c2)\n  \\<Longrightarrow> (\\<lambda>v. \\<lparr>cfg_conf = cfg_conf v @ C\\<rparr>)c1 = c2\n  \\<Longrightarrow> derivation_take (derivation_drop d2 n2) m = derivation_take (derivation_map d1 (\\<lambda>v. \\<lparr>cfg_conf = cfg_conf v @ C\\<rparr>)) m\"\n  apply(rule ext)\n  apply(rename_tac x)(*strict*)\n  apply(case_tac \"x\\<le>m\")\n   apply(rename_tac x)(*strict*)\n   apply(rule_tac\n      v=\"v\"\n      and ?v1.0=\"v1\"\n      and ?v2.0=\"v2\"\n      and G=\"G\"\n      and ?d1.0=\"d1\"\n      and ?d2.0=\"d2\"\n      in coinciding_derivation_parts_are_equal_up_to_unused_context)\n                  apply(rename_tac x)(*strict*)\n                  apply(force)\n                 apply(rename_tac x)(*strict*)\n                 apply(force)\n                apply(rename_tac x)(*strict*)\n                apply(force)\n               apply(rename_tac x)(*strict*)\n               apply(force)\n              apply(rename_tac x)(*strict*)\n              apply(force)\n             apply(rename_tac x)(*strict*)\n             apply(force)\n            apply(rename_tac x)(*strict*)\n            apply(force)\n           apply(rename_tac x)(*strict*)\n           apply(force)\n          apply(rename_tac x)(*strict*)\n          apply(force)\n         apply(rename_tac x)(*strict*)\n         apply(force)\n        apply(rename_tac x)(*strict*)\n        apply(force)\n       apply(rename_tac x)(*strict*)\n       apply(force)\n      apply(rename_tac x)(*strict*)\n      apply(force)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(simp add: derivation_take_def derivation_drop_def derivation_map_def)\n  done\n\nlemma sym_proof1: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.derivation G da\n  \\<Longrightarrow> map the (get_labels d (length (\\<pi>s1 ! i))) = \\<pi>s1 ! i\n  \\<Longrightarrow> map the (get_labels da (length (\\<pi>s2 ! i))) = \\<pi>s2 ! i\n  \\<Longrightarrow> d 0 = Some (pair None \\<lparr>cfg_conf = [teA (f ! i)]\\<rparr>)\n  \\<Longrightarrow> d (length (\\<pi>s1 ! i)) = Some (pair e \\<lparr>cfg_conf = []\\<rparr>)\n  \\<Longrightarrow> da 0 = Some (pair None \\<lparr>cfg_conf = [teA (f ! i)]\\<rparr>)\n  \\<Longrightarrow> da (length (\\<pi>s2 ! i)) = Some (pair ea \\<lparr>cfg_conf = []\\<rparr>)\n  \\<Longrightarrow> length (nat_seq (Suc 0) (length (\\<pi>s1 ! i))) = length (\\<pi>s1 ! i)\n  \\<Longrightarrow> length (nat_seq (Suc 0) (length (\\<pi>s2 ! i))) = length (\\<pi>s2 ! i)\n  \\<Longrightarrow> strict_prefix (\\<pi>s1 ! i) (\\<pi>s2 ! i)\n  \\<Longrightarrow> False\"\n  apply(simp add: strict_prefix_def)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(subgoal_tac \"d (length (\\<pi>s1 ! i)) = da (length (\\<pi>s1 ! i))\")\n   apply(rename_tac c)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. da ((length (\\<pi>s1 ! i))) = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n    apply(rename_tac c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"(length (\\<pi>s2 ! i))\"\n      in cfgLM.step_detail_before_some_position)\n      apply(rename_tac c)(*strict*)\n      apply(force)\n     apply(rename_tac c)(*strict*)\n     apply(force)\n    apply(rename_tac c)(*strict*)\n    apply(rule_tac\n      t=\"\\<pi>s2 ! i\"\n      and s=\"\\<pi>s1 ! i @ c\"\n      in ssubst)\n     apply(rename_tac c)(*strict*)\n     apply(force)\n    apply(rename_tac c)(*strict*)\n    apply(simp (no_asm))\n    apply(case_tac c)\n     apply(rename_tac c)(*strict*)\n     apply(force)\n    apply(rename_tac c a list)(*strict*)\n    apply(force)\n   apply(rename_tac c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac c e2 c2)(*strict*)\n   apply(simp add: cfgLM_step_relation_def)\n  apply(rename_tac c)(*strict*)\n  apply(rule_tac\n      n=\"(length (\\<pi>s1 ! i))\"\n      and ?x1.0=\"0\"\n      and ?x2.0=\"(length (\\<pi>s2 ! i))-(length (\\<pi>s1 ! i))\"\n      and ?d1.0=\"d\"\n      and ?d2.0=\"da\"\n      and G=\"G\"\n      in equal_eliminators_hlp2)\n         apply(rename_tac c)(*strict*)\n         apply(force)\n        apply(rename_tac c)(*strict*)\n        apply(force)\n       apply(rename_tac c)(*strict*)\n       apply(force)\n      apply(rename_tac c)(*strict*)\n      apply(force)\n     apply(rename_tac c)(*strict*)\n     apply(force)\n    apply(rename_tac c)(*strict*)\n    apply(rule_tac\n      t=\"length (\\<pi>s1 ! i) + (length (\\<pi>s2 ! i) - length (\\<pi>s1 ! i))\"\n      and s=\"length(\\<pi>s2!i)\"\n      in ssubst)\n     apply(rename_tac c)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac c)(*strict*)\n    apply(subgoal_tac \"length (\\<pi>s2 ! i)\\<ge>length (\\<pi>s1 ! i)\")\n     apply(rename_tac c)(*strict*)\n     apply(force)\n    apply(rename_tac c)(*strict*)\n    apply(rule_tac\n      t=\"\\<pi>s2 ! i\"\n      and s=\"\\<pi>s1 ! i @ c\"\n      in ssubst)\n     apply(rename_tac c)(*strict*)\n     apply(force)\n    apply(rename_tac c)(*strict*)\n    apply(case_tac c)\n     apply(rename_tac c)(*strict*)\n     apply(force)\n    apply(rename_tac c a list)(*strict*)\n    apply(simp (no_asm))\n   apply(rename_tac c)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac c)(*strict*)\n  apply(rule listEqI)\n   apply(rename_tac c)(*strict*)\n   apply(simp add: get_labels_def)\n  apply(rename_tac c ia)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"map the (get_labels d (length (\\<pi>s1 ! i)))!ia=map the (get_labels da (length (\\<pi>s1 ! i)))!ia\")\n   apply(rename_tac c ia)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"map the (get_labels d (length (\\<pi>s1 ! i)))\"\n      and s=\"\\<pi>s1!i\"\n      in ssubst)\n    apply(rename_tac c ia)(*strict*)\n    apply(force)\n   apply(rename_tac c ia)(*strict*)\n   apply(rule_tac\n      t=\"map the (get_labels da (length (\\<pi>s1 ! i))) ! ia\"\n      and s=\"map the (get_labels da (length (\\<pi>s2 ! i))) ! ia\"\n      in ssubst)\n    apply(rename_tac c ia)(*strict*)\n    apply(simp (no_asm) add: get_labels_def)\n    apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (da i))) (nat_seq (Suc 0) (length (\\<pi>s1 ! i))) ! ia\"\n      and s=\"(the \\<circ> (\\<lambda>i. get_label (da i))) ((nat_seq (Suc 0) (length (\\<pi>s1 ! i))) ! ia)\"\n      in ssubst)\n     apply(rename_tac c ia)(*strict*)\n     apply(rule nth_map)\n     apply(subgoal_tac \"length (nat_seq (Suc 0) (length (\\<pi>s1 ! i))) = (length (\\<pi>s1 ! i)) + 1 - Suc 0\")\n      apply(rename_tac c ia)(*strict*)\n      prefer 2\n      apply(rule nat_seq_length_prime)\n     apply(rename_tac c ia)(*strict*)\n     apply(clarsimp)\n     apply(simp add: get_labels_def)\n    apply(rename_tac c ia)(*strict*)\n    apply(rule_tac\n      t=\"map (the \\<circ> (\\<lambda>i. get_label (da i))) (nat_seq (Suc 0) (length (\\<pi>s2 ! i))) ! ia\"\n      and s=\"(the \\<circ> (\\<lambda>i. get_label (da i))) ((nat_seq (Suc 0) (length (\\<pi>s2 ! i))) ! ia)\"\n      in ssubst)\n     apply(rename_tac c ia)(*strict*)\n     apply(rule nth_map)\n     apply(subgoal_tac \"length (nat_seq (Suc 0) (length (\\<pi>s2 ! i))) = (length (\\<pi>s2 ! i)) + 1 - Suc 0\")\n      apply(rename_tac c ia)(*strict*)\n      prefer 2\n      apply(rule nat_seq_length_prime)\n     apply(rename_tac c ia)(*strict*)\n     apply(clarsimp)\n     apply(simp add: get_labels_def)\n     apply(rule_tac\n      t=\"\\<pi>s2 ! i\"\n      and s=\"\\<pi>s1 ! i @ c\"\n      in ssubst)\n      apply(rename_tac c ia)(*strict*)\n      apply(force)\n     apply(rename_tac c ia)(*strict*)\n     apply(simp (no_asm))\n    apply(rename_tac c ia)(*strict*)\n    apply(clarsimp)\n    apply(simp add: get_label_def)\n    apply(rule_tac\n      t=\"nat_seq (Suc 0) (length (\\<pi>s1 ! i)) ! ia\"\n      and s=\"Suc 0+ia\"\n      in ssubst)\n     apply(rename_tac c ia)(*strict*)\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac c ia)(*strict*)\n      apply(simp add: get_labels_def)\n     apply(rename_tac c ia)(*strict*)\n     apply(simp add: get_labels_def)\n    apply(rename_tac c ia)(*strict*)\n    apply(rule_tac\n      t=\"nat_seq (Suc 0) (length (\\<pi>s2 ! i)) ! ia\"\n      and s=\"Suc 0+ia\"\n      in ssubst)\n     apply(rename_tac c ia)(*strict*)\n     apply(rule nat_seq_nth_compute)\n      apply(rename_tac c ia)(*strict*)\n      apply(simp add: get_labels_def)\n      apply(rule_tac\n      t=\"\\<pi>s2 ! i\"\n      and s=\"\\<pi>s1 ! i @ c\"\n      in ssubst)\n       apply(rename_tac c ia)(*strict*)\n       apply(force)\n      apply(rename_tac c ia)(*strict*)\n      apply(simp (no_asm))\n     apply(rename_tac c ia)(*strict*)\n     apply(rule_tac\n      t=\"\\<pi>s2 ! i\"\n      and s=\"\\<pi>s1 ! i @ c\"\n      in ssubst)\n      apply(rename_tac c ia)(*strict*)\n      apply(force)\n     apply(rename_tac c ia)(*strict*)\n     apply(simp (no_asm))\n     apply(simp add: get_labels_def)\n    apply(rename_tac c ia)(*strict*)\n    apply(force)\n   apply(rename_tac c ia)(*strict*)\n   apply(rule_tac\n      t=\"map the (get_labels da (length (\\<pi>s2 ! i)))\"\n      and s=\"\\<pi>s2!i\"\n      in ssubst)\n    apply(rename_tac c ia)(*strict*)\n    apply(force)\n   apply(rename_tac c ia)(*strict*)\n   apply(simp add: get_labels_def)\n   apply(rule_tac\n      t=\"\\<pi>s1 ! i ! ia\"\n      and s=\"(\\<pi>s1 ! i@c) ! ia\"\n      in ssubst)\n    apply(rename_tac c ia)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac c ia)(*strict*)\n   apply (metis nth_append_1)\n  apply(rename_tac c ia)(*strict*)\n  apply(thin_tac \"map the (get_labels d (length (\\<pi>s1 ! i))) = \\<pi>s1 ! i\")\n  apply(thin_tac \"map the (get_labels da (length (\\<pi>s2 ! i))) = \\<pi>s2 ! i\")\n  apply(simp add: get_labels_def)\n  apply(subgoal_tac \"\\<exists>e c. da (Suc ia) = Some (pair (Some e) c)\")\n   apply(rename_tac c ia)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"(length (\\<pi>s2 ! i))\"\n      in cfgLM.pre_some_position_is_some_position_prime)\n      apply(rename_tac c ia)(*strict*)\n      apply(force)\n     apply(rename_tac c ia)(*strict*)\n     apply(force)\n    apply(rename_tac c ia)(*strict*)\n    apply(rule_tac\n      t=\"\\<pi>s2 ! i\"\n      and s=\"\\<pi>s1 ! i @ c\"\n      in ssubst)\n     apply(rename_tac c ia)(*strict*)\n     apply(force)\n    apply(rename_tac c ia)(*strict*)\n    apply(simp (no_asm))\n   apply(rename_tac c ia)(*strict*)\n   apply(force)\n  apply(rename_tac c ia)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c ia eb ca)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc ia) = Some (pair (Some e) c)\")\n   apply(rename_tac c ia eb ca)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"(length (\\<pi>s1 ! i))\"\n      in cfgLM.pre_some_position_is_some_position_prime)\n      apply(rename_tac c ia eb ca)(*strict*)\n      apply(force)\n     apply(rename_tac c ia eb ca)(*strict*)\n     apply(force)\n    apply(rename_tac c ia eb ca)(*strict*)\n    apply(force)\n   apply(rename_tac c ia eb ca)(*strict*)\n   apply(force)\n  apply(rename_tac c ia eb ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac c ia eb ca eaa cb)(*strict*)\n  apply(subgoal_tac \"nat_seq (Suc 0) (length (\\<pi>s1 ! i)) ! ia = (SSn)+(SSi)\" for SSn SSi)\n   apply(rename_tac c ia eb ca eaa cb)(*strict*)\n   prefer 2\n   apply(rule nat_seq_nth_compute)\n    apply(rename_tac c ia eb ca eaa cb)(*strict*)\n    apply(force)\n   apply(rename_tac c ia eb ca eaa cb)(*strict*)\n   apply(force)\n  apply(rename_tac c ia eb ca eaa cb)(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_label_def)\n  done\n\nlemma cfgLM_trans_der_list_drop: \"\n        cfgLM.trans_der_list G ds\n         (map (\\<lambda>x. \\<lparr>cfg_conf = [x]\\<rparr>) w) \\<pi>s\n         (map (\\<lambda>x. \\<lparr>cfg_conf = liftB x\\<rparr>) fw)\n       \\<Longrightarrow> cfgLM.trans_der_list G\n           (drop n ds)\n           (map (\\<lambda>x. \\<lparr>cfg_conf = [x]\\<rparr>) (drop n w))\n           (drop n \\<pi>s) (map (\\<lambda>x. \\<lparr>cfg_conf = liftB x\\<rparr>) (drop n fw))\"\n  apply(simp add: cfgLM.trans_der_list_def)\n  apply(clarsimp)\n  done\n\nlemma cfgLM_derivation_can_be_decomposed: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgLM.derivation G d\n  \\<Longrightarrow> cfgLM.belongs G d\n  \\<Longrightarrow> d i = Some (pair ei \\<lparr>cfg_conf=w1@w2\\<rparr>)\n  \\<Longrightarrow> d (i+j) = Some (pair ej \\<lparr>cfg_conf=liftB v\\<rparr>)\n  \\<Longrightarrow> \\<exists>v1 v2 d1 d2 e1 e2 n1 n2.\n  v=v1@v2\n  \\<and> j=n1+n2\n  \\<and> cfgLM.derivation G d1\n  \\<and> cfgLM.derivation G d2\n  \\<and> cfgLM.belongs G d1\n  \\<and> cfgLM.belongs G d2\n  \\<and> (get_labels d1 n1)@(get_labels d2 n2)=drop i (get_labels d (i+j))\n  \\<and> d1 0 = Some (pair None \\<lparr>cfg_conf=w1\\<rparr>)\n  \\<and> d2 0 = Some (pair None \\<lparr>cfg_conf=w2\\<rparr>)\n  \\<and> d1 n1 = Some (pair e1 \\<lparr>cfg_conf=liftB v1\\<rparr>)\n  \\<and> d2 n2 = Some (pair e2 \\<lparr>cfg_conf=liftB v2\\<rparr>)\"\n  apply(induct j arbitrary: ej w1 w2 v i ei)\n   apply(rename_tac ej w1 w2 v i ei)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej w1 w2 v i)(*strict*)\n   apply(subgoal_tac \"\\<exists>l'. liftB l' = w1\")\n    apply(rename_tac ej w1 w2 v i)(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB w1\"\n      in exI)\n    apply (rule liftBDeConv2)\n    apply (metis setA_liftB_substring liftB_commutes_over_concat)\n   apply(rename_tac ej w1 w2 v i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej w2 v i l')(*strict*)\n   apply(subgoal_tac \"\\<exists>l'. liftB l' = w2\")\n    apply(rename_tac ej w2 v i l')(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"filterB w2\"\n      in exI)\n    apply (rule liftBDeConv2)\n    apply (metis setA_liftB setA_empty_from_greater_set set_append2)\n   apply(rename_tac ej w2 v i l')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej v i l' l'a)(*strict*)\n   apply(subgoal_tac \"l'@l'a=v\")\n    apply(rename_tac ej v i l' l'a)(*strict*)\n    prefer 2\n    apply(rule liftB_inj)\n    apply(simp add: simpY)\n   apply(rename_tac ej v i l' l'a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(thin_tac \"liftB l' @ liftB l'a = liftB (l' @ l'a)\")\n   apply(rule_tac\n      x=\"l'\"\n      in exI)\n   apply(rule_tac\n      x=\"l'a\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = liftB l'\\<rparr>\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgLM.der1_is_derivation)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule_tac\n      x=\"der1 \\<lparr>cfg_conf = liftB l'a\\<rparr>\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgLM.der1_is_derivation)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgLM.der1_belongs)\n    apply(subgoal_tac \"\\<lparr>cfg_conf = liftB (l' @ l'a)\\<rparr>\\<in> cfg_configurations G\")\n     apply(rename_tac ej i l' l'a)(*strict*)\n     apply(simp add: cfg_configurations_def)\n     apply(simp add: simpY)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgLM.belongs_configurations)\n     apply(rename_tac ej i l' l'a)(*strict*)\n     apply(force)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(force)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgLM.der1_belongs)\n    apply(subgoal_tac \"\\<lparr>cfg_conf = liftB (l' @ l'a)\\<rparr>\\<in> cfg_configurations G\")\n     apply(rename_tac ej i l' l'a)(*strict*)\n     apply(simp add: cfg_configurations_def)\n     apply(simp add: simpY)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(rule cfgLM.belongs_configurations)\n     apply(rename_tac ej i l' l'a)(*strict*)\n     apply(force)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(force)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule_tac\n      t=\"get_labels (der1 \\<lparr>cfg_conf = liftB l'\\<rparr>) 0\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply (metis get_labelsEmpty)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule_tac\n      t=\"get_labels (der1 \\<lparr>cfg_conf = liftB l'a\\<rparr>) 0\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply (metis get_labelsEmpty)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(simp add: get_labels_def)\n    apply(subgoal_tac \"length (nat_seq (Suc 0) i) = SSn + 1 - SSi\" for SSn SSi)\n     apply(rename_tac ej i l' l'a)(*strict*)\n     prefer 2\n     apply(rule nat_seq_length_prime)\n    apply(rename_tac ej i l' l'a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac ej i l' l'a)(*strict*)\n   apply(simp add: der1_def)\n  apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d i = Some (pair e1 c1) \\<and> SSd (Suc SSn) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n   apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc (i+j)\"\n      in cfgLM.step_detail_before_some_position)\n     apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n     apply(force)\n    apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n    apply(force)\n   apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n   apply(force)\n  apply(rename_tac j ej w1 w2 v i ei)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej w1 w2 v i ei e2 c2)(*strict*)\n  apply(simp add: cfgLM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac j ej w1 w2 v i ei e2 c2 l r)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac j ej w1 w2 v i ei e2 c2 l r cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej w1 w2 v i ei e2 l r)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac j ej w1 w2 v i ei e2 l r prod_lhsa prod_rhsa)(*strict*)\n  apply(rename_tac A v)\n  apply(rename_tac j ej w1 w2 va i ei e2 l r A v)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej w1 w2 va i ei l r A v)(*strict*)\n  apply(subgoal_tac \"\\<exists>l'. liftB l' = l\")\n   apply(rename_tac j ej w1 w2 va i ei l r A v)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"filterB l\"\n      in exI)\n   apply (rule liftBDeConv2)\n   apply(force)\n  apply(rename_tac j ej w1 w2 va i ei l r A v)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n  apply(thin_tac \"setA (liftB l') = {}\")\n  apply(erule_tac\n      x=\"ej\"\n      in meta_allE)\n  apply(subgoal_tac \"prefix l' va\")\n   apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n   prefer 2\n   apply(subgoal_tac \"\\<exists>w. cfg_get_history SSci @ w = cfg_get_history SScij\" for SSci SScij)\n    apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"d\"\n      and i=\"i\"\n      and j=\"Suc j\"\n      in cfgLM.derivation_monotonically_inc)\n         apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n         apply(force)\n        apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n        apply(force)\n       apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n       apply(force)\n      apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n      apply(force)\n     apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n     apply(force)\n    apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n    apply(force)\n   apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac j ej w1 w2 va i ei r A v l' w)(*strict*)\n   apply(simp add: cfg_get_history_def)\n   apply(subgoal_tac \"maxTermPrefix (liftB l' @ teA A # r)=l'\")\n    apply(rename_tac j ej w1 w2 va i ei r A v l' w)(*strict*)\n    prefer 2\n    apply(rule_tac\n      t=\"maxTermPrefix (liftB l' @ teA A # r)\"\n      and s=\"maxTermPrefix (liftB l')\"\n      in ssubst)\n     apply(rename_tac j ej w1 w2 va i ei r A v l' w)(*strict*)\n     apply(rule maxTermPrefix_drop_tail)\n    apply(rename_tac j ej w1 w2 va i ei r A v l' w)(*strict*)\n    apply(rule maxTermPrefix_term_string)\n   apply(rename_tac j ej w1 w2 va i ei r A v l' w)(*strict*)\n   apply(subgoal_tac \"maxTermPrefix (liftB va) = va\")\n    apply(rename_tac j ej w1 w2 va i ei r A v l' w)(*strict*)\n    prefer 2\n    apply(rule maxTermPrefix_term_string)\n   apply(rename_tac j ej w1 w2 va i ei r A v l' w)(*strict*)\n   apply(simp add: prefix_def)\n   apply(rule_tac\n      x=\"w\"\n      in exI)\n   apply(force)\n  apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n  apply(subgoal_tac \"strict_prefix (liftB l') w1 \\<or> SSX\" for SSX)\n   apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n   prefer 2\n   apply(rule mutual_strict_prefix_prefix)\n   apply(rule sym)\n   apply(force)\n  apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n  apply(erule disjE)\n   apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n   prefer 2\n   apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n   apply(simp add: prefix_def)\n   apply(clarsimp)\n   apply(rename_tac j ej w1 w2 i ei r A v l' c ca)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac j ej w1 w2 i ei r A v l' c ca)(*strict*)\n    prefer 2\n    apply(rule liftB_append)\n    apply(force)\n   apply(rename_tac j ej w1 w2 i ei r A v l' c ca)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac j ej w2 i ei r A v c l1 l2)(*strict*)\n   apply(thin_tac \"liftB l1 @ liftB l2 = liftB (l1 @ l2)\")\n   apply(simp add: liftB_commutes_over_concat)\n   apply(clarsimp)\n   apply(rename_tac j ej i ei r A v c l1 l2)(*strict*)\n   apply(rule_tac\n      x=\"l1\"\n      in exI)\n   apply(rule_tac\n      x=\"l2@c\"\n      in exI)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"liftB l1\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"liftB l2@v@r\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"l1 @ l2 @ c\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"Suc i\"\n      in meta_allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr>\"\n      in meta_allE)\n   apply(clarsimp)\n   apply(simp add: liftB_commutes_over_concat)\n   apply(clarsimp)\n   apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(rule_tac\n      x=\"d1\"\n      in exI)\n   apply(clarsimp)\n   apply(subgoal_tac \"n1=0\")\n    apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    prefer 2\n    apply(case_tac n1)\n     apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n     apply(force)\n    apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n1 n2 nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n2 nat)(*strict*)\n    apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d1 0 = Some (pair e1 c1) \\<and> SSd (Suc (SSn)) = Some (pair (Some e2) c2) \\<and> cfgLM_step_relation G c1 e2 c2\" for SSd SSn)\n     apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n2 nat)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc nat\"\n      in cfgLM.step_detail_before_some_position)\n       apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n2 nat)(*strict*)\n       apply(force)\n      apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n2 nat)(*strict*)\n      apply(force)\n     apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n2 nat)(*strict*)\n     apply(force)\n    apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n2 nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n2 nat e2a c2)(*strict*)\n    apply(simp add: cfgLM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n2 nat e2a c2 l ra)(*strict*)\n    apply (metis liftB_with_nonterminal_inside)\n   apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(subgoal_tac \"l1=v1\")\n    apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    prefer 2\n    apply(clarsimp)\n    apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e2 n2)(*strict*)\n    apply(rule liftB_inj)\n    apply(force)\n   apply(rename_tac ej i ei r A v c l1 l2 v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(simp add: liftB_commutes_over_concat)\n   apply(rule_tac\n      x=\"derivation_append (der2 \\<lparr>cfg_conf = liftB l2 @ teA A # r\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB l2 @ v @ r\\<rparr> ) d2 (Suc 0)\"\n      in exI)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(rule_tac\n      x=\"None\"\n      in exI)\n   apply(rule_tac\n      x=\"if n2=0 then Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> else e2\"\n      in exI)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule_tac\n      x=\"Suc 0+n2\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(rule context_conjI)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(rule cfgLM.derivation_append_preserves_derivation)\n      apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n      apply(rule cfgLM.der2_is_derivation)\n      apply(simp add: cfgLM_step_relation_def)\n      apply(rule_tac\n      x=\"liftB l2\"\n      in exI)\n      apply(clarsimp)\n      apply(rule setA_liftB)\n     apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n     apply(force)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(simp add: der2_def)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(rule context_conjI)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(rule cfgLM.derivation_belongs)\n       apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n       apply(force)\n      apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n      apply(simp add: derivation_append_def der2_def)\n     apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n     apply(subgoal_tac \"\\<lparr>cfg_conf = liftB v1 @ liftB l2 @ teA A # r\\<rparr> \\<in> cfg_configurations G\")\n      apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n      apply(simp add: cfg_configurations_def)\n      apply(simp add: simpY)\n     apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n     apply(rule cfgLM.belongs_configurations)\n      apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n      apply(force)\n     apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n     apply(force)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def der2_def)\n    apply(clarsimp)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(rule_tac\n      t=\"get_labels (derivation_append (der2 \\<lparr>cfg_conf = liftB l2 @ teA A # r\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB l2 @ v @ r\\<rparr>) d2 (Suc 0)) (Suc 0 + n2)\"\n      and s=\" (get_labels (der2 \\<lparr>cfg_conf = liftB l2 @ teA A # r\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB l2 @ v @ r\\<rparr>) (Suc 0)) @(get_labels d2 n2)\"\n      in ssubst)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(rule cfgLM.get_labels_concat2)\n        apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n        apply(force)\n       apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n       apply(rule cfgLM.der2_is_derivation)\n       apply(simp add: cfgLM_step_relation_def)\n       apply(rule_tac\n      x=\"liftB l2\"\n      in exI)\n       apply(clarsimp)\n       apply(rule setA_liftB)\n      apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n      apply(force)\n     apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n     apply(simp add: der2_def)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(rule_tac\n      t=\"get_labels (der2 \\<lparr>cfg_conf = liftB l2 @ teA A # r\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB l2 @ v @ r\\<rparr>) (Suc 0)\"\n      and s=\"[Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr>]\"\n      in ssubst)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(rule der2_get_labels)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(subgoal_tac \"get_labels d1 0 = []\")\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    prefer 2\n    apply (metis get_labelsEmpty)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(clarsimp)\n   apply(thin_tac \"get_labels d2 n2 = drop (Suc i) (get_labels d (Suc (i + n2)))\")\n   apply(simp add: get_labels_def)\n   apply(rule_tac\n      t=\"drop i (map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (Suc (i + n2))))\"\n      and s=\" (map (\\<lambda>i. get_label (d i)) (drop i (nat_seq (Suc 0) (Suc (i + n2)))))\"\n      in ssubst)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(rule drop_map)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(rule_tac\n      t=\" drop (Suc i) (map (\\<lambda>i. get_label (d i)) ((nat_seq (Suc 0) (Suc (i + n2))))) \"\n      and s=\"(map (\\<lambda>i. get_label (d i)) (drop (Suc i) (nat_seq (Suc 0) (Suc (i + n2)))))\"\n      in ssubst)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(rule drop_map)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc (i + n2))) = SSn + 1 - SSi\" for SSn SSi)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    prefer 2\n    apply(rule nat_seq_length_prime)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n   apply(rule listEqI)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2 ia)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc (i + n2)) ! (i + ia) = (SSn)+(SSi)\" for SSn SSi)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2 ia)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2 ia)(*strict*)\n     apply(force)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2 ia)(*strict*)\n    apply(force)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2 ia)(*strict*)\n   apply(clarsimp)\n   apply(case_tac ia)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2 ia)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2)(*strict*)\n    apply(simp add: get_label_def)\n   apply(rename_tac ej i ei r A v c l2 v1 d1 d2 e2 n2 ia nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac j ej w1 w2 va i ei r A v l')(*strict*)\n  apply(simp add: strict_prefix_def prefix_def)\n  apply(clarsimp)\n  apply(rename_tac j ej w2 i ei r A v l' c ca)(*strict*)\n  apply(case_tac ca)\n   apply(rename_tac j ej w2 i ei r A v l' c ca)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac j ej w2 i ei r A v l' c ca a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac j ej w2 i ei A v l' c list)(*strict*)\n  apply(simp add: liftB_commutes_over_concat)\n  apply(erule_tac\n      x=\"liftB l' @ v @ list\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"w2\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"l'@c\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"Suc i\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(simp add: liftB_commutes_over_concat)\n  apply(erule_tac\n      x=\"Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr>\"\n      in meta_allE)\n  apply(clarsimp)\n  apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n  apply(subgoal_tac \"prefix l' v1\")\n   apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"\\<exists>w. cfg_get_history SSci @ w = cfg_get_history SScij\" for SSci SScij)\n    apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    prefer 2\n    apply(rule_tac\n      d=\"d1\"\n      and i=\"0\"\n      and j=\"n1\"\n      in cfgLM.derivation_monotonically_inc)\n         apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n         apply(force)\n        apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n        apply(force)\n       apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n       apply(force)\n      apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n      apply(force)\n     apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n     apply(force)\n    apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n    apply(force)\n   apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2 w)(*strict*)\n   apply(simp add: cfg_get_history_def)\n   apply(subgoal_tac \"maxTermPrefix (liftB l' @ v @ list)=l'@maxTermPrefix (v @ list)\")\n    apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2 w)(*strict*)\n    prefer 2\n    apply (metis maxTermPrefix_shift)\n   apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2 w)(*strict*)\n   apply(subgoal_tac \"maxTermPrefix (liftB v1) = v1\")\n    apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2 w)(*strict*)\n    prefer 2\n    apply(rule maxTermPrefix_term_string)\n   apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2 w)(*strict*)\n   apply(simp add: prefix_def)\n   apply(rule_tac\n      x=\"maxTermPrefix (v @ list) @ w\"\n      in exI)\n   apply(force)\n  apply(rename_tac ej w2 i ei A v l' c list v1 v2 d1 d2 e1 e2 n1 n2)(*strict*)\n  apply(simp add: prefix_def)\n  apply(clarsimp)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(simp add: liftB_commutes_over_concat)\n  apply(rule_tac\n      x=\"l'@ca\"\n      in exI)\n  apply(rule_tac\n      x=\"v2\"\n      in exI)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"derivation_append (der2 \\<lparr>cfg_conf = liftB l' @ teA A # list\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB l' @ v @ list\\<rparr> ) d1 (Suc 0)\"\n      in exI)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(rule_tac\n      x=\"d2\"\n      in exI)\n  apply(rule_tac\n      x=\"if n1=0 then Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> else e1\"\n      in exI)\n  apply(rule_tac\n      x=\"e2\"\n      in exI)\n  apply(rule_tac\n      x=\"Suc 0+n1\"\n      in exI)\n  apply(rule_tac\n      x=\"n2\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(force)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(rule cfgLM.derivation_append_preserves_derivation)\n     apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n     apply(rule cfgLM.der2_is_derivation)\n     apply(simp add: cfgLM_step_relation_def)\n     apply(rule_tac\n      x=\"liftB l'\"\n      in exI)\n     apply(clarsimp)\n     apply(rule setA_liftB)\n    apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n    apply(force)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(simp add: der2_def)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(force)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(rule cfgLM.derivation_belongs)\n      apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n      apply(force)\n     apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n     apply(simp add: derivation_append_def der2_def)\n    apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n    apply(subgoal_tac \"\\<lparr>cfg_conf = liftB l' @ teA A # list @ w2\\<rparr> \\<in> cfg_configurations G\")\n     apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n     apply(simp add: cfg_configurations_def)\n     apply(simp add: simpY)\n    apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n    apply(rule cfgLM.belongs_configurations)\n     apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n     apply(force)\n    apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n    apply(force)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(force)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(force)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   prefer 2\n   apply(rule conjI)\n    apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def der2_def)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(simp add: derivation_append_def der2_def)\n   apply(simp add: liftB_commutes_over_concat)\n   apply(clarsimp)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(rule_tac\n      t=\"get_labels (derivation_append (der2 \\<lparr>cfg_conf = liftB l' @ teA A # list\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB l' @ v @ list\\<rparr>) d1 (Suc 0)) (Suc 0 + n1)\"\n      in ssubst)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(rule cfgLM.get_labels_concat2)\n       apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n       apply(force)\n      apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n      apply(rule cfgLM.der2_is_derivation)\n      apply(simp add: cfgLM_step_relation_def)\n      apply(rule_tac\n      x=\"liftB l'\"\n      in exI)\n      apply(clarsimp)\n      apply(rule setA_liftB)\n     apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n     apply(force)\n    apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n    apply(simp add: der2_def)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(force)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(rule_tac\n      t=\"get_labels (der2 \\<lparr>cfg_conf = liftB l' @ teA A # list\\<rparr> \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr> \\<lparr>cfg_conf = liftB l' @ v @ list\\<rparr>) (Suc 0)\"\n      and s=\"[Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr>]\"\n      in ssubst)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(rule der2_get_labels)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"drop i (get_labels d (Suc (i + (n1 + n2))))\"\n      and s=\" [Some \\<lparr>prod_lhs = A, prod_rhs = v\\<rparr>]@(drop (Suc i) (get_labels d (Suc (i + (n1 + n2))))) \"\n      in ssubst)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(simp add: get_labels_def)\n  apply(rule_tac\n      t=\"drop i (map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (Suc (i + (n1 + n2)))))\"\n      in ssubst)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(rule drop_map)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(rule_tac\n      t=\"drop (Suc i) (map (\\<lambda>i. get_label (d i)) (nat_seq (Suc 0) (Suc (i + (n1 + n2)))))\"\n      in ssubst)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(rule drop_map)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(subgoal_tac \"length (nat_seq (Suc 0) (Suc (i + (n1 + n2)))) = SSn + 1 - SSi\" for SSn SSi)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   prefer 2\n   apply(rule nat_seq_length_prime)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n  apply(rule listEqI)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca ia)(*strict*)\n  apply(clarsimp)\n  apply(case_tac ia)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca ia)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(subgoal_tac \"nat_seq (Suc 0) (Suc (i + (n1 + n2))) ! i = (SSn)+(SSi)\" for SSn SSi)\n    apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n    prefer 2\n    apply(rule nat_seq_nth_compute)\n     apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n     apply(force)\n    apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n    apply(force)\n   apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca)(*strict*)\n   apply(clarsimp)\n   apply(simp add: get_label_def)\n  apply(rename_tac ej w2 i ei A v l' list v2 d1 d2 e1 e2 n1 n2 ca ia nat)(*strict*)\n  apply(clarsimp)\n  done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_09/I_cfgLM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.585101139733739, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3198971158621158}}
{"text": "theory Array_Map_Impl\nimports \n  \"../Sep_Main\" Imp_Map_Spec Array_Blit\n  \"HOL-Library.Code_Target_Numeral\"\nbegin\n  subsection \"Array Map\"\n\n  type_synonym 'v array_map = \"'v option array\"\n  definition \"iam_initial_size \\<equiv> 8::nat\"\n\n  definition \"iam_of_list l i \\<equiv> if i<length l then l!i else None\"\n\n  definition is_iam :: \"(nat\\<rightharpoonup>'a) \\<Rightarrow> ('a::heap) array_map \\<Rightarrow> assn\" where\n    \"is_iam m a \\<equiv> \\<exists>\\<^sub>Al. a\\<mapsto>\\<^sub>al * \\<up>(m=iam_of_list l)\"\n\n  definition iam_new_sz :: \"nat \\<Rightarrow> ('v::heap) array_map Heap\"\n    where \"iam_new_sz sz \\<equiv> Array.new sz None\"\n\n  definition iam_new :: \"('v::heap) array_map Heap\"\n    where \"iam_new \\<equiv> iam_new_sz iam_initial_size\"\n\n  definition iam_lookup \n    :: \"nat \\<Rightarrow> ('v::heap) array_map \\<Rightarrow> 'v option Heap\"\n    where \"iam_lookup k a = do {\n      l\\<leftarrow>Array.len a;\n      if k < l then Array.nth a k else return None\n    }\"\n\n  \n\n  definition iam_delete\n    :: \"nat \\<Rightarrow> ('v::heap) array_map \\<Rightarrow> ('v::heap) array_map Heap\"\n  where \"iam_delete k a = do {\n      l\\<leftarrow>Array.len a;\n      if k < l then Array.upd k None a else return a\n    }\"\n\n  lemma [code]: \"iam_delete k a \\<equiv> upd_oo (return a) k None a\"\n    unfolding upd_oo_def iam_delete_def .\n\n  definition iam_update\n    :: \"nat \\<Rightarrow> 'v::heap \\<Rightarrow> 'v array_map \\<Rightarrow> 'v array_map Heap\"\n    where \"iam_update k v a = do {\n      l\\<leftarrow>Array.len a;\n      a\\<leftarrow>if k>=l then do {\n          let newsz = max (k+1) (2 * l + 3);\n          array_grow a newsz None\n        } else return a;\n\n      Array.upd k (Some v) a\n    }\"\n\n  lemma [code]: \"iam_update k v a = upd_oo \n    (do {\n      l\\<leftarrow>Array.len a;\n      let newsz = max (k+1) (2 * l + 3);\n      a\\<leftarrow>array_grow a newsz None;\n      Array.upd k (Some v) a\n    })\n    k (Some v) a\"\n  proof -\n    have [simp]: \n      \"\\<And>x t e. do {\n        l\\<leftarrow>Array.len a;\n        if x l then \n          t l \n        else do {\n          l'\\<leftarrow>Array.len a;\n          e l l'\n        } \n      }\n      =\n      do {\n        l\\<leftarrow>Array.len a;\n        if x l then t l else e l l\n      }\"\n      apply (auto \n        simp: bind_def execute_len \n        split: option.split\n        intro!: ext\n      )\n      done\n  \n    show ?thesis\n      unfolding upd_oo_def iam_update_def\n      apply simp\n      apply (rule cong[OF arg_cong, where f1=bind])\n      apply simp\n      apply (rule ext)\n      apply auto\n      done\n  qed\n\n  lemma precise_iam: \"precise is_iam\"\n    apply rule\n    by (auto simp add: is_iam_def dest: preciseD[OF snga_prec])\n\n  lemma iam_new_abs: \"iam_of_list (replicate n None) = Map.empty\"\n    unfolding iam_of_list_def[abs_def]\n    by auto\n\n  lemma iam_new_sz_rule: \"<emp> iam_new_sz n < is_iam Map.empty >\"\n    unfolding iam_new_sz_def is_iam_def[abs_def]\n    by (sep_auto simp: iam_new_abs)\n\n  lemma iam_new_rule: \"<emp> iam_new < is_iam Map.empty >\"\n    unfolding iam_new_def by (sep_auto heap: iam_new_sz_rule)\n\n  \n\n  lemma iam_lookup_rule: \"< is_iam m p > \n    iam_lookup k p \n    <\\<lambda>r. is_iam m p * \\<up>(r=m k) >\"\n    unfolding iam_lookup_def is_iam_def\n    by (sep_auto simp: iam_lookup_abs1 iam_lookup_abs2)\n\n  lemma iam_delete_abs1: \"k<length l \n    \\<Longrightarrow> iam_of_list (l[k := None]) = iam_of_list l |` (- {k})\"\n    unfolding iam_of_list_def[abs_def]\n    by (auto intro!: ext simp: restrict_map_def)\n\n  lemma iam_delete_abs2: \"\\<not>k<length l \n    \\<Longrightarrow> iam_of_list l |` (- {k}) = iam_of_list l\"\n    unfolding iam_of_list_def[abs_def]\n    by (auto intro!: ext simp: restrict_map_def)\n\n  lemma iam_delete_rule: \"< is_iam m p >\n    iam_delete k p\n    <\\<lambda>r. is_iam (m|`(-{k})) r>\"\n    unfolding is_iam_def iam_delete_def\n    by (sep_auto simp: iam_delete_abs1 iam_delete_abs2)\n    \n\n  lemma iam_update_abs1: \"iam_of_list (l@replicate n None) = iam_of_list l\"\n    unfolding iam_of_list_def[abs_def]\n    by (auto intro!: ext simp: nth_append)\n\n  lemma iam_update_abs2: \"\\<not> length l \\<le> k \n    \\<Longrightarrow> iam_of_list (l[k := Some v]) = iam_of_list l(k \\<mapsto> v)\"\n    unfolding iam_of_list_def[abs_def]\n    by auto\n\n  lemma iam_update_rule:\n    \"< is_iam m p > iam_update k v p <\\<lambda>r. is_iam (m(k\\<mapsto>v)) r>\\<^sub>t\"\n    unfolding is_iam_def iam_update_def\n    by (sep_auto \n      decon: decon_if_split \n      simp: iam_update_abs1 iam_update_abs2)\n  \n  interpretation iam: imp_map is_iam\n    apply unfold_locales\n    by (rule precise_iam)\n  interpretation iam: imp_map_empty is_iam iam_new\n    apply unfold_locales\n    by (sep_auto heap: iam_new_rule)\n  interpretation iam_sz: imp_map_empty is_iam \"iam_new_sz sz\"\n    apply unfold_locales\n    by (sep_auto heap: iam_new_sz_rule)\n \n  interpretation iam: imp_map_lookup is_iam iam_lookup\n    apply unfold_locales\n    by (sep_auto heap: iam_lookup_rule)\n  interpretation iam: imp_map_delete is_iam iam_delete\n    apply unfold_locales\n    by (sep_auto heap: iam_delete_rule)\n  interpretation iam: imp_map_update is_iam iam_update\n    apply unfold_locales\n    by (sep_auto heap: iam_update_rule)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Separation_Logic_Imperative_HOL/Examples/Array_Map_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.31980702451896953}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      ComposeEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\ntheory ComposeEx imports Compose \"../Vcg\" \"../HeapList\" begin\n\n\nrecord globals_list = \n  next_' :: \"ref \\<Rightarrow> ref\"\n\nrecord state_list = \"globals_list state\" +\n  p_'    :: \"ref\"\n  sl_q_'    :: \"ref\"\n  r_'    :: \"ref\"\n\n\nprocedures Rev(p|sl_q) =\n      \"\\<acute>sl_q :== Null;;\n       WHILE \\<acute>p \\<noteq> Null \n       DO\n         \\<acute>r :== \\<acute>p;; \\<lbrace>\\<acute>p \\<noteq> Null\\<rbrace>\\<longmapsto> \\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;;\n         \\<lbrace>\\<acute>r \\<noteq> Null\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>sl_q;; \\<acute>sl_q :== \\<acute>r\n       OD\"\nprint_theorems\n\n\n\nlemma (in Rev_impl) \n Rev_modifies:\n  \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile>\\<^bsub>/UNIV \\<^esub>{\\<sigma>} \\<acute>sl_q :== PROC Rev(\\<acute>p) {t. t may_only_modify_globals \\<sigma> in [next]}\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (vcg spec=modifies)\ndone\n\nlemma (in Rev_impl) shows\n Rev_spec: \n  \"\\<forall>Ps. \\<Gamma>\\<turnstile> \\<lbrace>List \\<acute>p \\<acute>next Ps\\<rbrace> \\<acute>sl_q :== PROC Rev(\\<acute>p) \\<lbrace>List \\<acute>sl_q \\<acute>next (rev Ps)\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (hoare_rule anno =\n       \"\\<acute>sl_q :== Null;;\n       WHILE \\<acute>p \\<noteq> Null INV \\<lbrace>\\<exists>Ps' Qs'. List \\<acute>p \\<acute>next Ps' \\<and> List \\<acute>sl_q \\<acute>next Qs' \\<and>\n                             set Ps' \\<inter> set Qs' = {} \\<and>\n                             rev Ps' @ Qs' = rev Ps\\<rbrace>\n        DO\n         \\<acute>r :== \\<acute>p;; \\<lbrace>\\<acute>p \\<noteq> Null\\<rbrace>\\<longmapsto>\\<acute>p :== \\<acute>p\\<rightarrow>\\<acute>next;;\n         \\<lbrace>\\<acute>r \\<noteq> Null\\<rbrace>\\<longmapsto> \\<acute>r\\<rightarrow>\\<acute>next :== \\<acute>sl_q;; \\<acute>sl_q :== \\<acute>r\n       OD\" in HoarePartial.annotateI)\napply vcg \napply   clarsimp\napply  fastforce\napply clarsimp\ndone\n\ndeclare [[names_unique = false]]\n\nrecord globals = \n  strnext_'   :: \"ref \\<Rightarrow> ref\"\n  chr_'    :: \"ref \\<Rightarrow> char\"\n\n  qnext_' :: \"ref \\<Rightarrow> ref\"  \n  cont_'   :: \"ref \\<Rightarrow> int\"\nrecord state = \"globals state\" +\n  str_'  :: \"ref\"\n  queue_':: \"ref\" \n  q_'    :: \"ref\"\n  r_'    :: \"ref\"\n\n\ndefinition project_globals_str:: \"globals \\<Rightarrow> globals_list\"\n  where \"project_globals_str g = \\<lparr>next_' = strnext_' g\\<rparr>\"\n\ndefinition project_str:: \"state \\<Rightarrow> state_list\"\nwhere\n\"project_str s =\n  \\<lparr>globals = project_globals_str (globals s),\n   state_list.p_' = str_' s, sl_q_' = q_' s, state_list.r_' = r_' s\\<rparr>\"\n\ndefinition inject_globals_str:: \n  \"globals \\<Rightarrow> globals_list \\<Rightarrow> globals\"\nwhere\n  \"inject_globals_str G g =\n   G\\<lparr>strnext_' := next_' g\\<rparr>\"\n\ndefinition \"inject_str\"::\"state \\<Rightarrow> state_list \\<Rightarrow> state\" where\n\"inject_str S s = S\\<lparr>globals := inject_globals_str (globals S) (globals s),\n                str_' := state_list.p_' s, q_' := sl_q_' s,\n                r_' := state_list.r_' s\\<rparr>\"\n\nlemma globals_inject_project_str_commutes: \n  \"inject_globals_str G (project_globals_str G) = G\"\n  by (simp add: inject_globals_str_def project_globals_str_def)\n\nlemma inject_project_str_commutes: \"inject_str S (project_str S) = S\"\n  by (simp add: inject_str_def project_str_def globals_inject_project_str_commutes)\n\nlemma globals_project_inject_str_commutes: \n  \"project_globals_str (inject_globals_str G g) = g\"\n  by (simp add: inject_globals_str_def project_globals_str_def)\n\nlemma project_inject_str_commutes: \"project_str (inject_str S s) = s\"\n  by (simp add: inject_str_def project_str_def globals_project_inject_str_commutes)\n\nlemma globals_inject_str_last: \n  \"inject_globals_str (inject_globals_str G g) g' = inject_globals_str G g'\"\n  by (simp add: inject_globals_str_def)\n\nlemma inject_str_last: \n  \"inject_str (inject_str S s) s' = inject_str S s'\"\n  by (simp add: inject_str_def globals_inject_str_last)\n\ndefinition\n  \"lift\\<^sub>e = (\\<lambda>\\<Gamma> p. map_option (lift\\<^sub>c project_str inject_str) (\\<Gamma> p))\"\nprint_locale lift_state_space\ninterpretation ex: lift_state_space project_str inject_str\n  \"xstate_map project_str\" lift\\<^sub>e \"lift\\<^sub>c project_str inject_str\"\n  \"lift\\<^sub>f project_str inject_str\" \"lift\\<^sub>s project_str\"\n  \"lift\\<^sub>r project_str inject_str\"\n  apply -\n  apply       (rule lift_state_space.intro)\n  apply       (rule project_inject_str_commutes)\n  apply      simp\n  apply     simp\n  apply    (simp add: lift\\<^sub>e_def)\n  apply   simp\n  apply  simp\n  apply simp\n  done\n\ninterpretation ex: lift_state_space_ext project_str inject_str\n  \"xstate_map project_str\" lift\\<^sub>e \"lift\\<^sub>c project_str inject_str\"\n  \"lift\\<^sub>f project_str inject_str\" \"lift\\<^sub>s project_str\"\n  \"lift\\<^sub>r project_str inject_str\"\n\n(*  project_str \"inject_str\" _ lift\\<^sub>e *)\napply -\napply intro_locales [1]\n  apply (rule lift_state_space_ext_axioms.intro)\n  apply  (rule inject_project_str_commutes) \n  apply (rule inject_str_last)\napply (simp_all add: lift\\<^sub>e_def)\n  done\n\n(*\n  apply (intro_locales)\n  apply (rule lift_state_space_ext_axioms.intro)\n  apply  (rule inject_project_str_commutes) \n  apply (rule inject_str_last)\n  done\n*)\n\n(*\ndeclare lift_set_def [simp] project_def [simp] project_globals_def [simp]\n*)\nlemmas Rev_lift_spec = ex.lift_hoarep' [OF Rev_impl.Rev_spec,simplified lift\\<^sub>s_def\n project_str_def project_globals_str_def,simplified, of _ \"''Rev''\"]\nprint_theorems\n\n\ndefinition \"\\<N> p' p = (if p=''Rev'' then p' else '''')\"\n\n\nprocedures RevStr(str|q) = \"rename (\\<N> RevStr_'proc)\n                (lift\\<^sub>c project_str inject_str (Rev_body.Rev_body))\"\n\n\nlemmas Rev_lift_spec' = \n  Rev_lift_spec [of \"[''Rev''\\<mapsto>Rev_body.Rev_body]\" ,\n     simplified Rev_impl_def Rev_clique_def,simplified]\nthm Rev_lift_spec'\n\n\nlemma Rev_lift_spec'':\n  \"\\<forall>Ps. lift\\<^sub>e [''Rev'' \\<mapsto> Rev_body.Rev_body]\n       \\<turnstile> \\<lbrace>List \\<acute>str \\<acute>strnext Ps\\<rbrace> Call ''Rev'' \\<lbrace>List \\<acute>q \\<acute>strnext (rev Ps)\\<rbrace>\"\n  by (rule Rev_lift_spec')\n\nlemma (in RevStr_impl) \\<N>_ok: \n\"\\<forall>p bdy. (lift\\<^sub>e [''Rev'' \\<mapsto> Rev_body.Rev_body]) p = Some bdy \\<longrightarrow> \n     \\<Gamma> (\\<N> RevStr_'proc p) = Some (rename (\\<N> RevStr_'proc) bdy)\"\napply (insert RevStr_impl)\napply (auto simp add: RevStr_body_def lift\\<^sub>e_def \\<N>_def)\ndone\n\ncontext RevStr_impl\nbegin\n thm hoare_to_hoare_rename'[OF _ Rev_lift_spec'', OF \\<N>_ok,\n  simplified \\<N>_def, simplified ]\nend\n\nlemmas (in RevStr_impl) RevStr_spec =\n  hoare_to_hoare_rename' [OF _ Rev_lift_spec'', OF \\<N>_ok,\n  simplified \\<N>_def, simplified ]\n\n\nlemma (in RevStr_impl) RevStr_spec': \n\"\\<forall>Ps. \\<Gamma>\\<turnstile> \\<lbrace>List \\<acute>str \\<acute>strnext Ps\\<rbrace> \\<acute>q :== PROC RevStr(\\<acute>str) \n          \\<lbrace>List \\<acute>q \\<acute>strnext (rev Ps)\\<rbrace>\"\n  by (rule RevStr_spec)\n\nlemmas Rev_modifies' =\n  Rev_impl.Rev_modifies [of \"[''Rev''\\<mapsto>Rev_body.Rev_body]\", simplified Rev_impl_def,\n   simplified]\nthm Rev_modifies'\n\ncontext RevStr_impl\nbegin\nlemmas RevStr_modifies' =\n  hoare_to_hoare_rename' [OF _ ex.hoare_lift_modifies' [OF Rev_modifies'],\n         OF \\<N>_ok, of \"''Rev''\", simplified \\<N>_def Rev_clique_def,simplified]\nend\n\n\nlemma (in RevStr_impl) RevStr_modifies:\n\"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile>\\<^bsub>/UNIV \\<^esub>{\\<sigma>} \\<acute>str :== PROC RevStr(\\<acute>str) \n  {t. t may_only_modify_globals \\<sigma> in [strnext]}\"\napply (rule allI)\napply (rule HoarePartialProps.ConseqMGT [OF RevStr_modifies'])\napply (clarsimp simp add: \n  lift\\<^sub>s_def mex_def meq_def\n  project_str_def inject_str_def project_globals_str_def inject_globals_str_def)\napply blast\ndone\n\nend\n\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/ex/ComposeEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.31980702451896953}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\ntheory Addr_Type\nimports \"~~/src/HOL/Word/Word\"\nbegin\n\ntype_synonym addr_bitsize = \"64\"\ntype_synonym addr = \"addr_bitsize word\"\ndefinition addr_bitsize :: nat where \"addr_bitsize \\<equiv> 64\"\ndefinition addr_align :: nat where \"addr_align \\<equiv> 2\"\ndeclare addr_align_def[simp]\n\ndefinition addr_card :: nat where\n  \"addr_card \\<equiv> card (UNIV::addr set)\"\n\n\n\ndeclare addr_bitsize_def[simp]\n\nlemma addr_card:\n  \"addr_card = 2^addr_bitsize\"\n  by (simp add: addr_card_def card_word)\n\nlemma len_of_addr_card:\n  \"2 ^ len_of TYPE(addr_bitsize) = addr_card\"\n  by (simp add: addr_card)\n\nlemma of_nat_addr_card [simp]:\n  \"of_nat addr_card = (0::addr)\"\n  by (simp add: addr_card)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/c-parser/umm_heap/X64/Addr_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.31980701746173923}}
{"text": "theory OpenFlow_Serialize\nimports OpenFlow_Matches\n        OpenFlow_Action\n        Semantics_OpenFlow\n        Simple_Firewall.Primitives_toString\n        IP_Addresses.Lib_Word_toString\nbegin\n\ndefinition \"serialization_test_entry \\<equiv> OFEntry 7 {EtherDst 0x1, IPv4Dst (PrefixMatch 0xA000201 32), IngressPort ''s1-lan'', L4Dst 0x50 0, L4Src 0x400 0x3FF, IPv4Proto 6, EtherType 0x800} [ModifyField_l2dst 0xA641F185E862, Forward ''s1-wan'']\"\n\n\n\nvalue \"(map ((<<) (1::48 word) \\<circ> (*) 8) \\<circ> rev) [0..<6]\"\n\ndefinition \"serialize_mac (m::48 word) \\<equiv> (intersperse (CHR '':'') \\<circ> map (hex_string_of_word 1 \\<circ> (\\<lambda>h. (m >> h * 8) && 0xff)) \\<circ> rev) [0..<6]\"\nlemma \"serialize_mac 0xdeadbeefcafe = ''de:ad:be:ef:ca:fe''\" by eval\n\ndefinition \"serialize_action pids a \\<equiv> (case a of\n\tForward oif \\<Rightarrow> ''output:'' @ pids oif |\n\tModifyField_l2dst na \\<Rightarrow> ''mod_dl_dst:'' @ serialize_mac na)\" \n\ndefinition \"serialize_actions pids a \\<equiv> if length a = 0 then ''drop'' else (intersperse (CHR '','') \\<circ> map (serialize_action pids)) a\"\n\nlemma \"serialize_actions (\\<lambda>oif. ''42'') (ofe_action serialization_test_entry) =\n  ''mod_dl_dst:a6:41:f1:85:e8:62,output:42''\" by eval\nlemma \"serialize_actions anything [] = ''drop''\"\n  by(simp add: serialize_actions_def)\n\ndefinition \"prefix_to_string pfx \\<equiv> ipv4_cidr_toString (pfxm_prefix pfx, pfxm_length pfx)\"\n\nprimrec serialize_of_match where\n\"serialize_of_match pids (IngressPort p) = ''in_port='' @ pids p\" |\n\"serialize_of_match _ (VlanId i) = ''dl_vlan='' @ dec_string_of_word0 i\" |\n\"serialize_of_match _ (VlanPriority _) = undefined\" | (* uh, äh\\<dots> We don't use that anyway\\<dots> *)\n\"serialize_of_match _ (EtherType i) = ''dl_type=0x'' @ hex_string_of_word0 i\" |\n\"serialize_of_match _ (EtherSrc m) = ''dl_src='' @ serialize_mac m\" |\n\"serialize_of_match _ (EtherDst m) = ''dl_dst='' @ serialize_mac m\" |\n\"serialize_of_match _ (IPv4Proto i) = ''nw_proto='' @ dec_string_of_word0 i\" |\n\"serialize_of_match _ (IPv4Src p) = ''nw_src='' @ prefix_to_string p\" |\n\"serialize_of_match _ (IPv4Dst p) = ''nw_dst='' @ prefix_to_string p\" |\n\"serialize_of_match _ (L4Src i m) = ''tp_src='' @ dec_string_of_word0 i @ (if m = max_word then [] else ''/0x'' @ hex_string_of_word 3 m)\" |\n\"serialize_of_match _ (L4Dst i m) = ''tp_dst='' @ dec_string_of_word0 i @ (if m = max_word then [] else ''/0x'' @ hex_string_of_word 3 m)\"\n\ndefinition serialize_of_matches :: \"(string \\<Rightarrow> string) \\<Rightarrow> of_match_field set \\<Rightarrow> string\"\n  where\n  \"serialize_of_matches pids \\<equiv> (@) ''hard_timeout=0,idle_timeout=0,'' \\<circ> intersperse (CHR '','') \\<circ> map (serialize_of_match pids) \\<circ> sorted_list_of_set\" \n\nlemma \"serialize_of_matches pids of_matches= \n(List.append ''hard_timeout=0,idle_timeout=0,'') \n  (intersperse (CHR '','') (map (serialize_of_match pids) (sorted_list_of_set of_matches)))\"\nby (simp add: serialize_of_matches_def)\n\nexport_code serialize_of_matches checking SML (*needs \"HOL-Library.Code_Char\"*)\n\nlemma \"serialize_of_matches (\\<lambda>oif. ''42'') (ofe_fields serialization_test_entry) =\n  ''hard_timeout=0,idle_timeout=0,in_port=42,dl_type=0x800,dl_dst=00:00:00:00:00:01,nw_proto=6,nw_dst=10.0.2.1/32,tp_src=1024/0x03ff,tp_dst=80/0x0000''\"\nby eval\n\ndefinition \"serialize_of_entry pids e \\<equiv> (case e of (OFEntry p f a) \\<Rightarrow> ''priority='' @ dec_string_of_word0 p @ '','' @ serialize_of_matches pids f @ '','' @ ''action='' @ serialize_actions pids a)\"\n\nlemma \"serialize_of_entry (the \\<circ> map_of [(''s1-lan'',''42''),(''s1-wan'',''1337'')]) serialization_test_entry =\n  ''priority=7,hard_timeout=0,idle_timeout=0,in_port=42,dl_type=0x800,dl_dst=00:00:00:00:00:01,nw_proto=6,nw_dst=10.0.2.1/32,tp_src=1024/0x03ff,tp_dst=80/0x0000,action=mod_dl_dst:a6:41:f1:85:e8:62,output:1337''\"\n  by eval\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/LOFT/OpenFlow_Serialize.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297745935070808, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3198070104045088}}
{"text": "theory Optimizing\nimports Semantics_Ternary\nbegin\n\n\nsection\\<open>Optimizing\\<close>\n\nsubsection\\<open>Removing Shadowed Rules\\<close>\ntext\\<open>Note: there is no executable code for rmshadow at the moment\\<close>\n\ntext\\<open>Assumes: @{term \"simple_ruleset\"}\\<close>\nfun rmshadow :: \"('a, 'p) match_tac \\<Rightarrow> 'a rule list \\<Rightarrow> 'p set \\<Rightarrow> 'a rule list\" where\n  \"rmshadow _ [] _ = []\" |\n  \"rmshadow \\<gamma> ((Rule m a)#rs) P = (if (\\<forall>p\\<in>P. \\<not> matches \\<gamma> m a p)\n    then \n      rmshadow \\<gamma> rs P\n    else\n      (Rule m a) # (rmshadow \\<gamma> rs {p \\<in> P. \\<not> matches \\<gamma> m a p}))\"\n(*needs a ruleset without log and empty*)\n\n\n\nsubsubsection\\<open>Soundness\\<close>\n  lemma rmshadow_sound: \n    \"simple_ruleset rs \\<Longrightarrow> p \\<in> P \\<Longrightarrow> approximating_bigstep_fun \\<gamma> p (rmshadow \\<gamma> rs P) = approximating_bigstep_fun \\<gamma> p rs\"\n  proof(induction rs arbitrary: P)\n  case Nil thus ?case by simp\n  next\n  case (Cons r rs)\n    let ?fw=\"approximating_bigstep_fun \\<gamma>\" \\<comment> \\<open>firewall semantics\\<close>\n    let ?rm=\"rmshadow \\<gamma>\"\n    let ?match=\"matches \\<gamma> (get_match r) (get_action r)\"\n    let ?set=\"{p \\<in> P. \\<not> ?match p}\"\n    from Cons.IH Cons.prems have IH: \"?fw p (?rm rs P) = ?fw p rs\" by (simp add: simple_ruleset_def)\n    from Cons.IH[of \"?set\"] Cons.prems have IH': \"p \\<in> ?set \\<Longrightarrow> ?fw p (?rm rs ?set) = ?fw p rs\" by (simp add: simple_ruleset_def)\n    from Cons show ?case\n      proof(cases \"\\<forall>p\\<in>P. \\<not> ?match p\") \\<comment> \\<open>the if-condition of rmshadow\\<close>\n      case True\n        from True have 1: \"?rm (r#rs) P = ?rm rs P\" \n          apply(cases r)\n          apply(rename_tac m a)\n          apply(clarify)\n          apply(simp)\n          done\n        from True Cons.prems have \"?fw p (r # rs) = ?fw p rs\"\n          apply(cases r)\n          apply(rename_tac m a)\n          apply(simp add: fun_eq_iff)\n          apply(clarify)\n          apply(rule just_show_all_approximating_bigstep_fun_equalities_with_start_Undecided)\n          apply(simp)\n          done\n        from this IH have \"?fw p (?rm rs P) = ?fw p (r#rs) \" by simp\n        thus \"?fw p (?rm (r#rs) P) = ?fw p (r#rs) \" using 1 by simp\n      next\n      case False \\<comment> \\<open>else\\<close>\n        have \"?fw p (r # (?rm rs ?set)) = ?fw p (r # rs)\"\n          proof(cases \"p \\<in> ?set\")\n            case True\n              from True IH' show \"?fw p (r # (?rm rs ?set)) = ?fw p (r#rs)\" \n                apply(cases r)\n                apply(rename_tac m a)\n                apply(simp add: fun_eq_iff)\n                apply(clarify)\n                apply(rule just_show_all_approximating_bigstep_fun_equalities_with_start_Undecided)\n                apply(simp)\n                done\n            next\n            case False\n              from False Cons.prems have \"?match p\" by simp\n              from Cons.prems have \"get_action r = Accept \\<or> get_action r = Drop\" by(simp add: simple_ruleset_def)\n              from this \\<open>?match p\\<close>show \"?fw p (r # (?rm rs ?set)) = ?fw p (r#rs)\"\n                apply(cases r)\n                apply(rename_tac m a)\n                apply(simp add: fun_eq_iff)\n                apply(clarify)\n                apply(rename_tac s)\n                apply(rule just_show_all_approximating_bigstep_fun_equalities_with_start_Undecided)\n                apply(simp split:action.split)\n                apply fast\n                done\n          qed\n        from False this show ?thesis \n          apply(cases r)\n          apply(rename_tac m a)\n          apply(simp add: fun_eq_iff)\n          apply(clarify)\n          apply(rule just_show_all_approximating_bigstep_fun_equalities_with_start_Undecided)\n          apply(simp)\n          done\n    qed\n  qed\n\n\n\nsubsection\\<open>Removing rules which cannot apply\\<close>\n\nfun rmMatchFalse :: \"'a rule list \\<Rightarrow> 'a rule list\" where\n  \"rmMatchFalse [] = []\" |\n  \"rmMatchFalse ((Rule (MatchNot MatchAny) _)#rs) = rmMatchFalse rs\" |\n  \"rmMatchFalse (r#rs) = r # rmMatchFalse rs\"\n\nlemma rmMatchFalse_correct: \"approximating_bigstep_fun \\<gamma> p (rmMatchFalse rs) s = approximating_bigstep_fun \\<gamma> p rs s\"\n  proof-\n    { fix m::\"'a match_expr\" and a and rs\n      assume assm: \"m \\<noteq> MatchNot MatchAny\"\n      have \"rmMatchFalse (Rule m a # rs) = Rule m a # (rmMatchFalse rs)\" (is ?hlp)\n      proof(cases m)\n        case (MatchNot mexpr) with assm show ?hlp by(cases mexpr) simp_all\n        qed(simp_all)\n    } note rmMatchFalse_helper=this\n  show ?thesis\n    proof(induction \\<gamma> p rs s rule: approximating_bigstep_fun_induct)\n      case Empty thus ?case by(simp)\n      next\n      case Decision thus ?case by(metis Decision_approximating_bigstep_fun)\n      next\n      case (Nomatch \\<gamma> p m a) thus ?case\n        by(cases \"m = MatchNot MatchAny\") (simp_all add: rmMatchFalse_helper)\n      next\n      case (Match \\<gamma> p m a rs) \n        from Match(1) have \"m \\<noteq> MatchNot MatchAny\" using bunch_of_lemmata_about_matches(3) by fast\n        with Match rmMatchFalse_helper show ?case by(simp split:action.split)\n    qed\n  qed\n\n\n\ntext\\<open>We can stop after a default rule (a rule which matches anything) is observed.\\<close>\nfun cut_off_after_match_any :: \"'a rule list \\<Rightarrow> 'a rule list\" where\n  \"cut_off_after_match_any [] = []\" |\n  \"cut_off_after_match_any (Rule m a # rs) =\n    (if m = MatchAny \\<and> (a = Accept \\<or> a = Drop \\<or> a = Reject)\n     then [Rule m a] else Rule m a # cut_off_after_match_any rs)\"\n\nlemma cut_off_after_match_any:\n  \"approximating_bigstep_fun \\<gamma> p (cut_off_after_match_any rs) s = approximating_bigstep_fun \\<gamma> p rs s\"\n  apply(rule just_show_all_approximating_bigstep_fun_equalities_with_start_Undecided)\n  apply(induction \\<gamma> p rs s rule: approximating_bigstep_fun.induct)\n    apply(simp; fail)\n   apply(simp; fail)\n  by(simp split: action.split action.split_asm add: bunch_of_lemmata_about_matches(2))\n\nlemma cut_off_after_match_any_simplers: \"simple_ruleset rs \\<Longrightarrow> simple_ruleset (cut_off_after_match_any rs)\"\n  by(induction rs rule: cut_off_after_match_any.induct) (simp_all add: simple_ruleset_def)\n\nlemma cut_off_after_match_any_preserve_matches:\n  \"\\<forall> r \\<in> set rs. P (get_match r) \\<Longrightarrow> \\<forall> r \\<in> set (cut_off_after_match_any rs). P (get_match r)\"\n  apply(induction rs rule: cut_off_after_match_any.induct)\n   apply(simp; fail)\n  by(auto simp add: simple_ruleset_def)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Iptables_Semantics/Semantics_Ternary/Optimizing.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.31980701040450876}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005 (modified)    |\n            |              September 2005 (modified)    |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_continuous\nimports CSP_F_domain Domain_F_cpo CSP_T.CSP_T_mono\nbegin\n\n(*****************************************************************\n\n         1. continuous failuresfun\n         2. continuous failuresFun\n         3. continuous [[ ]]Ffun\n         4. continuous [[ ]]FFun\n\n *****************************************************************)\n\n(*=============================================================*\n |                     traces fstF                             |\n *=============================================================*)\n\nlemma continuous_traces_fstF:\n   \"continuous ((%M. traces P (fstF o M)))\"\napply (subgoal_tac \"(%M. traces P (fstF o M)) = (traces P) o ((o) fstF)\")\napply (simp add: continuous_traces continuous_op_fstF compo_continuous)\napply (simp add: fun_eq_iff)\ndone\n\n(*--------------------------------*\n |        STOP,SKIP,DIV           |\n *--------------------------------*)\n\nlemma continuous_failures_STOP: \"continuous (failures (STOP))\"\nby (simp add: failures_iff continuous_Constant)\n\nlemma continuous_failures_SKIP: \"continuous (failures (SKIP))\"\nby (simp add: failures_iff continuous_Constant)\n\nlemma continuous_failures_DIV: \"continuous (failures (DIV))\"\nby (simp add: failures_iff continuous_Constant)\n\n(*--------------------------------*\n |          Act_prefix            |\n *--------------------------------*)\n\nlemma continuous_failures_Act_prefix:\n \"continuous (failures P) ==> continuous (failures (a -> P))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\napply (rule_tac x=\"x\" in exI, simp)\n\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n\n(* <= *)\napply (rule)\napply (simp add: in_failures)\napply (erule disjE, fast)\napply (elim conjE exE)\napply (simp)\n\n(* => *)\napply (rule)\napply (simp)\napply (erule bexE)\napply (simp add: in_failures)\napply (erule disjE, simp)\napply (elim conjE exE)\napply (rule disjI2)\napply (rule_tac x=\"sa\" in exI, simp)\napply (rule_tac x=\"xa\" in bexI)\napply (simp_all)\n\nby (simp add: directed_def)\n\n(*--------------------------------*\n |        Ext_pre_choice          |\n *--------------------------------*)\n\nlemma continuous_failures_Ext_pre_choice:\n \"ALL a. continuous (failures (Pf a))\n     ==> continuous (failures (? a:X -> (Pf a)))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\n\napply (subgoal_tac \"Xa ~= {}\")\napply (erule exchange_forall_orderE)\napply (drule_tac x=\"Xa\" in spec)\napply (simp add: isLUB_UnionF)\n\napply (rule_tac x=\"LUB Xa\" in exI)\napply (rule conjI)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (erule disjE, fast)\n apply (elim conjE exE)\n apply (simp)\n apply (drule_tac x=\"a\" in spec)\n apply (elim conjE exE)\n apply (subgoal_tac \"LUB Xa = x\", simp)\n apply (simp add: isLUB_LUB)\n\n(* => *)\n apply (rule)\n apply (simp)\n apply (erule bexE)\n apply (simp add: in_failures)\n apply (erule disjE, simp)\n apply (elim conjE exE)\n apply (rule disjI2)\n apply (rule_tac x=\"a\" in exI)\n apply (rule_tac x=\"sa\" in exI, simp)\n\n apply (drule_tac x=\"a\" in spec)\n apply (elim conjE exE)\n apply (subgoal_tac \"LUB Xa = xa\", simp)\n apply (rule_tac x=\"x\" in bexI)\n apply (simp)\n apply (simp)\n apply (simp add: isLUB_LUB)\n\n apply (drule_tac x=\"a\" in spec)\n apply (elim conjE exE)\n apply (simp add: isLUB_LUB)\n\nby (simp add: directed_def)\n\n(*--------------------------------*\n |          Ext_choice            |\n *--------------------------------*)\n\nlemma continuous_failures_Ext_choice:\n \"[| continuous (failures P) ; continuous (failures Q) |]\n  ==> continuous (failures (P [+] Q))\"\napply (subgoal_tac \"mono (failures P) & mono (failures Q)\")\napply (subgoal_tac \"continuous (%M. traces P (fstF o M)) &\n                    continuous (%M. traces Q (fstF o M))\")\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (elim conjE)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\n\napply (subgoal_tac \"xa = x\")\napply (subgoal_tac \"xb = x\")\napply (subgoal_tac \"xc = x\")\napply (rule_tac x=\"x\" in exI, simp)\n\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (simp add: isLUB_UnionT)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE bexE disjE)\n\n (* 1 *)\n  apply (simp add: directed_def)\n  apply (drule_tac x=\"xd\" in spec)\n  apply (drule_tac x=\"xe\" in spec)\n  apply (simp, elim conjE exE)\n  apply (rule_tac x=\"z\" in bexI)\n  apply (rule disjI1)\n  apply (rule conjI)\n  apply (rule memF_subsetF, simp)\n  apply (simp add: mono_def)\n  apply (rotate_tac -4)\n  apply (rule memF_subsetF, simp)\n  apply (simp add: mono_def)\n\n (* 2-5 *)\n  apply (fast)+\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (fast)\n\napply (simp add: directed_def)\napply (rule LUB_unique, simp_all)+\n\napply (simp add: continuous_traces_fstF)\napply (simp add: continuous_mono)\ndone\n\n(*--------------------------------*\n |          Int_choice            |\n *--------------------------------*)\n\nlemma continuous_failures_Int_choice:\n \"[| continuous (failures P) ; continuous (failures Q) |]\n  ==> continuous (failures (P |~| Q))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\n\napply (subgoal_tac \"xa = x\")\napply (rule_tac x=\"x\" in exI, simp)\n\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n apply (rule, simp add: in_failures, fast)\n apply (rule, simp add: in_failures, fast)\napply (simp add: directed_def)\nby (rule LUB_unique, simp_all)\n\n(*--------------------------------*\n |        Rep_int_choice          |\n *--------------------------------*)\n\nlemma continuous_failures_Rep_int_choice:\n \"ALL c. continuous (failures (Pf c))\n  ==> continuous (failures (!! :C .. Pf))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\n\napply (subgoal_tac \"X ~= {}\")\napply (erule exchange_forall_orderE)\napply (drule_tac x=\"X\" in spec)\napply (simp add: isLUB_UnionF)\n\napply (rule_tac x=\"LUB X\" in exI)\napply (rule conjI)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim conjE bexE)\n apply (drule_tac x=\"c\" in spec)\n apply (elim conjE exE)\n apply (subgoal_tac \"LUB X = x\", simp)\n apply (elim bexE)\n apply (rule_tac x=\"xa\" in bexI)\n apply (fast)\n apply (simp)\n apply (simp add: isLUB_LUB)\n\n(* => *)\n apply (rule)\n apply (simp)\n apply (erule bexE)\n apply (simp add: in_failures)\n apply (elim conjE bexE)\n apply (rule_tac x=\"c\" in bexI)\n\n apply (drule_tac x=\"c\" in spec)\n apply (elim conjE exE)\n apply (subgoal_tac \"LUB X = xa\", simp)\n apply (rule_tac x=\"x\" in bexI)\n apply (simp)\n apply (simp)\n apply (simp add: isLUB_LUB)\n apply (simp)\n\n apply (drule_tac x=\"c\" in spec)\n apply (elim conjE exE)\n apply (simp add: isLUB_LUB)\n\nby (simp add: directed_def)\n\n(*--------------------------------*\n |              IF                |\n *--------------------------------*)\n\nlemma continuous_failures_IF:\n \"[| continuous (failures P) ; continuous (failures Q) |]\n  ==> continuous (failures (IF b THEN P ELSE Q))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\napply (case_tac \"b\")\n apply (rule_tac x=\"x\" in exI, simp)\n apply (simp add: failures_iff)\n\n apply (rule_tac x=\"xa\" in exI, simp)\n apply (simp add: failures_iff)\ndone\n\n(*--------------------------------*\n |           Parallel             |\n *--------------------------------*)\n\nlemma continuous_failures_Parallel:\n \"[| continuous (failures P) ; continuous (failures Q) |]\n  ==> continuous (failures (P |[X]| Q))\"\napply (subgoal_tac \"mono (failures P) & mono (failures Q)\")\n\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"Xa\" in spec, simp)\napply (drule_tac x=\"Xa\" in spec, simp)\napply (elim conjE exE)\n\napply (subgoal_tac \"xa = x\")\napply (rule_tac x=\"x\" in exI, simp)\n\napply (subgoal_tac \"Xa ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim exE bexE conjE)\n\n apply (simp add: directed_def)\n apply (drule_tac x=\"xb\" in spec)\n apply (drule_tac x=\"xc\" in spec)\n apply (simp, elim conjE exE)\n apply (rule_tac x=\"z\" in bexI)\n apply (rule_tac x=\"Y\" in exI)\n apply (rule_tac x=\"Z\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n apply (rule conjI)\n apply (rule memF_subsetF, simp)\n apply (simp add: mono_def)\n apply (rotate_tac -4)\n apply (rule memF_subsetF, simp)\n apply (simp add: mono_def)\n apply (simp)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (fast)\n\napply (simp add: directed_def)\napply (simp add: LUB_unique)\n\nby (simp add: continuous_mono)\n\n(*--------------------------------*\n |            Hiding              |\n *--------------------------------*)\n\nlemma continuous_failures_Hiding:\n \"continuous (failures P)\n  ==> continuous (failures (P -- X))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"Xa\" in spec, simp)\napply (elim conjE exE)\n\napply (rule_tac x=\"x\" in exI, simp)\napply (subgoal_tac \"Xa ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (fast)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (fast)\n\nby (simp add: directed_def)\n\n(*--------------------------------*\n |           Renaming             |\n *--------------------------------*)\n\nlemma continuous_failures_Renaming:\n \"continuous (failures P)\n  ==> continuous (failures (P [[r]]))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\n\napply (rule_tac x=\"x\" in exI, simp)\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n apply (rule, simp add: in_failures, fast)\n apply (rule, simp add: in_failures, fast)\nby (simp add: directed_def)\n\n(*--------------------------------*\n |           Seq_compo            |\n *--------------------------------*)\n\nlemma continuous_failures_Seq_compo:\n \"[| continuous (failures P) ; continuous (failures Q) |]\n  ==> continuous (failures (P ;; Q))\"\napply (subgoal_tac \"mono (traces P) & mono (failures Q)\")\napply (subgoal_tac \"continuous (%M. traces P (fstF o M))\")\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\n\napply (subgoal_tac \"xa = x\")\napply (subgoal_tac \"xb = x\")\napply (rule_tac x=\"x\" in exI, simp)\n\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (simp add: isLUB_UnionT)\napply (rule order_antisym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures)\n apply (elim bexE exE conjE disjE)\n\n (* 1 *)\n  apply (fast)\n\n (* 2 *)\n  apply (simp add: directed_def)\n  apply (drule_tac x=\"xc\" in spec)\n  apply (drule_tac x=\"xd\" in spec)\n  apply (simp, elim conjE exE)\n  apply (rule_tac x=\"z\" in bexI)\n  apply (rule disjI2)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp)\n\n  apply (rule conjI)\n  apply (rule memT_subdomT, simp)\n  apply (simp add: mono_def)\n  apply (subgoal_tac \"fstF o xc <= fstF o z\")\n  apply (simp add: comp_def)\n\n  apply (simp add: comp_def)\n  apply (simp add: order_prod_def)\n  apply (simp add: mono_fstF[simplified mono_def])\n\n  apply (rotate_tac -4)\n  apply (rule memF_subsetF, simp)\n  apply (simp add: mono_def)\n  apply (simp)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures)\n apply (fast)\n\napply (simp add: directed_def)\napply (simp add: LUB_unique)+\napply (simp add: continuous_traces_fstF)\napply (simp add: continuous_mono)\napply (simp add: mono_traces)\ndone\n\n(*--------------------------------*\n |          Depth_rest            |\n *--------------------------------*)\n\nlemma continuous_failures_Depth_rest:\n \"continuous (failures P)\n  ==> continuous (failures (P |. n))\"\napply (simp add: continuous_iff)\napply (intro allI impI)\napply (drule_tac x=\"X\" in spec, simp)\napply (elim conjE exE)\n\napply (rule_tac x=\"x\" in exI, simp)\napply (subgoal_tac \"X ~= {}\")\napply (simp add: isLUB_UnionF)\napply (rule order_antisym)\n apply (rule, simp add: in_failures)\n apply (rule, simp add: in_failures)\nby (simp add: directed_def)\n\n(*--------------------------------*\n |            variable            |\n *--------------------------------*)\n\nlemma continuous_failures_variable_lm: \"continuous (sndF o (%M. M p))\"\napply (rule compo_continuous)\napply (simp add: continuous_prod_variable)\napply (simp add: sndF_def)\napply (rule compo_continuous)\napply (simp add: cont_Rep_domF)\napply (simp add: snd_continuous)\ndone\n\nlemma continuous_failures_variable: \n   \"continuous (failures ($p))\"\napply (simp add: failures_iff)\napply (simp add: continuous_failures_variable_lm[simplified comp_def])\ndone\n\n(** [[ ]]Ff **)\n\nlemma continuous_semFf_variable: \"continuous ([[$p]]Ff)\"\napply (simp add: semFf_Proc_name)\napply (simp add: continuous_prod_variable)\ndone\n\n(*--------------------------------*\n |             Proc               |\n *--------------------------------*)\n\nlemma continuous_failures: \"continuous (failures P)\"\napply (induct_tac P)\napply (simp add: continuous_failures_STOP)\napply (simp add: continuous_failures_SKIP)\napply (simp add: continuous_failures_DIV)\napply (simp add: continuous_failures_Act_prefix)\napply (simp add: continuous_failures_Ext_pre_choice)\napply (simp add: continuous_failures_Ext_choice)\napply (simp add: continuous_failures_Int_choice)\napply (simp add: continuous_failures_Rep_int_choice)\napply (simp add: continuous_failures_IF)\napply (simp add: continuous_failures_Parallel)\napply (simp add: continuous_failures_Hiding)\napply (simp add: continuous_failures_Renaming)\napply (simp add: continuous_failures_Seq_compo)\napply (simp add: continuous_failures_Depth_rest)\napply (simp add: continuous_failures_variable)\ndone\n\n(*=============================================================*\n |                          [[P]]Ff                            |\n *=============================================================*)\n\nlemma continuous_semFf: \n  \"continuous ([[Pf]]Ff)\"\napply (simp add: semFf_def)\napply (simp add: continuous_domF_decompo)\napply (simp add: continuous_traces_fstF)\napply (simp add: continuous_failures)\ndone\n\n(*=============================================================*\n |                         [[P]]Ffun                           |\n *=============================================================*)\n\nlemma continuous_semFfun: \n  \"continuous ([[PF]]Ffun)\"\napply (simp add: semFfun_def)\napply (simp add: prod_continuous)\napply (simp add: proj_fun_def comp_def)\napply (simp add: continuous_semFf)\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_continuous.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947425132315, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3197742284357521}}
{"text": "(*  Title:      HOL/MicroJava/BV/JVM.thy\n\n    Author:     Tobias Nipkow, Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nsection \\<open>LBV for the JVM \\label{sec:JVM}\\<close>\n\ntheory LBVJVM\nimports \"../DFA/Abstract_BV\" TF_JVM\nbegin\n\ntype_synonym prog_cert = \"cname \\<Rightarrow> mname \\<Rightarrow> ty\\<^sub>i' err list\"\n\ndefinition check_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> bool\"\nwhere\n  \"check_cert P mxs mxl n cert \\<equiv> check_types P mxs mxl cert \\<and> size cert = n+1 \\<and>\n                                 (\\<forall>i<n. cert!i \\<noteq> Err) \\<and> cert!n = OK None\"\n\ndefinition lbvjvm :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> \n             ty\\<^sub>i' err list \\<Rightarrow> instr list \\<Rightarrow> ty\\<^sub>i' err \\<Rightarrow> ty\\<^sub>i' err\"\nwhere\n  \"lbvjvm P mxs maxr T\\<^sub>r et cert bs \\<equiv>\n  wtl_inst_list bs cert (JVM_SemiType.sup P mxs maxr) (JVM_SemiType.le P mxs maxr) Err (OK None) (exec P mxs T\\<^sub>r et bs) 0\"\n\ndefinition wt_lbv :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n             ex_table \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> instr list \\<Rightarrow> bool\"\nwhere\n  \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 et cert ins \\<equiv>\n   check_cert P mxs (1+size Ts+mxl\\<^sub>0) (size ins) cert \\<and>\n   0 < size ins \\<and> \n   (let start  = Some ([],(OK (Class C))#((map OK Ts))@(replicate mxl\\<^sub>0 Err));\n        result = lbvjvm P mxs (1+size Ts+mxl\\<^sub>0) T\\<^sub>r et cert ins (OK start)\n    in result \\<noteq> Err)\"\n\ndefinition wt_jvm_prog_lbv :: \"jvm_prog \\<Rightarrow> prog_cert \\<Rightarrow> bool\"\nwhere\n  \"wt_jvm_prog_lbv P cert \\<equiv>\n  wf_prog (\\<lambda>P C (mn,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,b,et)). wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 et (cert C mn) b) P\"\n\ndefinition mk_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> instr list \n              \\<Rightarrow> ty\\<^sub>m \\<Rightarrow> ty\\<^sub>i' err list\"\nwhere\n  \"mk_cert P mxs T\\<^sub>r et bs phi \\<equiv> make_cert (exec P mxs T\\<^sub>r et bs) (map OK phi) (OK None)\"\n\ndefinition prg_cert :: \"jvm_prog \\<Rightarrow> ty\\<^sub>P \\<Rightarrow> prog_cert\"\nwhere\n  \"prg_cert P phi C mn \\<equiv> let (C,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)) = method P C mn\n                         in  mk_cert P mxs T\\<^sub>r et ins (phi C mn)\"\n   \nlemma check_certD [intro?]:\n  \"check_cert P mxs mxl n cert \\<Longrightarrow> cert_ok cert n Err (OK None) (states P mxs mxl)\"\n  by (unfold cert_ok_def check_cert_def check_types_def) auto\n\n\nlemma (in start_context) wt_lbv_wt_step:\n  assumes lbv: \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"\n  shows \"\\<exists>\\<tau>s \\<in> list (size is) A. wt_step r Err step \\<tau>s \\<and> OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\"\n(*<*)\nproof -\n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover note bounded_step\n  moreover from lbv have \"cert_ok cert (size is) Err (OK None) A\"\n    by (unfold wt_lbv_def) (auto dest: check_certD)\n  moreover note exec_pres_type\n  moreover\n  from lbv \n  have \"wtl_inst_list is cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (simp add: wt_lbv_def lbvjvm_def step_def_exec [symmetric])    \n  moreover note first_in_A\n  moreover from lbv have \"0 < size is\" by (simp add: wt_lbv_def)\n  ultimately show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])\nqed\n(*>*)\n\n\nlemma (in start_context) wt_lbv_wt_method:\n  assumes lbv: \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"  \n  shows \"\\<exists>\\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n(*<*)\nproof -\n  from lbv have l: \"is \\<noteq> []\" by (simp add: wt_lbv_def)\n  moreover\n  from wf lbv C Ts obtain \\<tau>s where \n    list:  \"\\<tau>s \\<in> list (size is) A\" and\n    step:  \"wt_step r Err step \\<tau>s\" and    \n    start: \"OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\" \n    by (blast dest: wt_lbv_wt_step)\n  from list have [simp]: \"size \\<tau>s = size is\" by simp\n  have \"size (map ok_val \\<tau>s) = size is\" by simp  \n  moreover from l have 0: \"0 < size \\<tau>s\" by simp\n  with step obtain \\<tau>s0 where \"\\<tau>s!0 = OK \\<tau>s0\"\n    by (unfold wt_step_def) blast\n  with start 0 have \"wt_start P C Ts mxl\\<^sub>0 (map ok_val \\<tau>s)\"\n    by (simp add: wt_start_def JVM_le_Err_conv lesub_def Err.le_def)    \n  moreover {\n    from list have \"check_types P mxs mxl \\<tau>s\" by (simp add: check_types_def)\n    also from step  have \"\\<forall>x \\<in> set \\<tau>s. x \\<noteq> Err\" \n      by (auto simp add: all_set_conv_all_nth wt_step_def)    \n    hence [symmetric]: \"map OK (map ok_val \\<tau>s) = \\<tau>s\"\n      by (auto intro!: map_idI)\n    finally have \"check_types P mxs mxl (map OK (map ok_val \\<tau>s))\" .\n  }\n  moreover {  \n    note bounded_step\n    moreover from list have \"set \\<tau>s \\<subseteq> A\" by simp\n    moreover from step have \"wt_err_step (sup_state_opt P) step \\<tau>s\"\n      by (simp add: wt_err_step_def JVM_le_Err_conv)\n    ultimately have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\<tau>s)\"\n      by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def states_def)\n  }    \n  ultimately have \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\<tau>s)\"\n    by (simp add: wt_method_def2 check_types_def del: map_map)\n  thus ?thesis ..\nqed\n(*>*)\n\n  \nlemma (in start_context) wt_method_wt_lbv:\n  assumes wt: \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\" \n  defines [simp]: \"cert \\<equiv> mk_cert P mxs T\\<^sub>r xt is \\<tau>s\"\n  \n  shows \"wt_lbv P C Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\" \n(*<*)\nproof -\n  let ?\\<tau>s  = \"map OK \\<tau>s\"\n  let ?cert = \"make_cert step ?\\<tau>s (OK None)\"\n\n  from wt obtain \n    0:        \"0 < size is\" and\n    size:     \"size is = size ?\\<tau>s\" and\n    ck_types: \"check_types P mxs mxl ?\\<tau>s\" and\n    wt_start: \"wt_start P C Ts mxl\\<^sub>0 \\<tau>s\" and\n    app_eff:  \"wt_app_eff (sup_state_opt P) app eff \\<tau>s\"\n    by (force simp add: wt_method_def2 check_types_def) \n  \n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover from wf have \"mono r step (size is) A\" by (rule step_mono)\n  hence \"mono r step (size ?\\<tau>s) A\" by (simp add: size)\n  moreover from exec_pres_type \n  have \"pres_type step (size ?\\<tau>s) A\" by (simp add: size) \n  moreover\n  from ck_types have \\<tau>s_in_A: \"set ?\\<tau>s \\<subseteq> A\" by (simp add: check_types_def)\n  hence \"\\<forall>pc. pc < size ?\\<tau>s \\<longrightarrow> ?\\<tau>s!pc \\<in> A \\<and> ?\\<tau>s!pc \\<noteq> Err\" by auto\n  moreover from bounded_step \n  have \"bounded step (size ?\\<tau>s)\" by (simp add: size)\n  moreover have \"OK None \\<noteq> Err\" by simp\n  moreover from bounded_step size \\<tau>s_in_A app_eff\n  have \"wt_err_step (sup_state_opt P) step ?\\<tau>s\"\n    by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def states_def)    \n  hence \"wt_step r Err step ?\\<tau>s\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  moreover\n  from 0 size have \"0 < size \\<tau>s\" by auto\n  hence \"?\\<tau>s!0 = OK (\\<tau>s!0)\" by simp\n  with wt_start have \"OK first \\<sqsubseteq>\\<^sub>r ?\\<tau>s!0\"\n    by (clarsimp simp add: wt_start_def lesub_def Err.le_def JVM_le_Err_conv)\n  moreover note first_in_A\n  moreover have \"OK first \\<noteq> Err\" by simp\n  moreover note size \n  ultimately\n  have \"wtl_inst_list is ?cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])\n  moreover from 0 size have \"\\<tau>s \\<noteq> []\" by auto\n  moreover from ck_types have \"check_types P mxs mxl ?cert\"\n    apply (auto simp add: make_cert_def check_types_def JVM_states_unfold)\n    apply (subst Ok_in_err [symmetric])\n    apply (drule nth_mem)\n    apply auto\n    done\n  moreover note 0 size\n  ultimately show ?thesis \n    by (simp add: wt_lbv_def lbvjvm_def mk_cert_def step_def_exec [symmetric]\n                  check_cert_def make_cert_def nth_append)\nqed  \n(*>*)\n\n\ntheorem jvm_lbv_correct:\n  \"wt_jvm_prog_lbv P Cert \\<Longrightarrow> wf_jvm_prog P\"\n(*<*)\nproof -  \n  let ?\\<Phi> = \"\\<lambda>C mn. let (C,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)) = method P C mn in \n              SOME \\<tau>s. wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n    \n  assume wt: \"wt_jvm_prog_lbv P Cert\"\n  hence \"wf_jvm_prog\\<^bsub>?\\<Phi>\\<^esub> P\"\n    apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def) \n    apply (erule wf_prog_lift)\n    apply (auto dest!: start_context.wt_lbv_wt_method [OF start_context.intro] \n                intro: someI)\n    apply (erule sees_method_is_class)\n    done\n  thus ?thesis by (unfold wf_jvm_prog_def) blast\nqed\n(*>*)\n\ntheorem jvm_lbv_complete:\n  assumes wt: \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\" \n  shows \"wt_jvm_prog_lbv P (prg_cert P \\<Phi>)\"\n(*<*)\n  using wt\n  apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def)\n  apply (erule wf_prog_lift)\n  apply (auto simp add: prg_cert_def \n              intro!: start_context.wt_method_wt_lbv start_context.intro)\n  apply (erule sees_method_is_class)                                     \n  done\n(*>*)\n\nend  \n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/BV/LBVJVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3197155856257884}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Cong_Subst\n  imports Weak_Early_Cong Weak_Early_Bisim_Subst Strong_Early_Bisim_Subst\nbegin\n\nconsts congruenceSubst :: \"(pi \\<times> pi) set\"\n\ndefinition weakCongruenceSubst (infixr \"\\<simeq>\\<^sup>s\" 65) where \"P \\<simeq>\\<^sup>s Q \\<equiv> \\<forall>\\<sigma>. P[<\\<sigma>>] \\<simeq> Q[<\\<sigma>>]\"\n\nlemma unfoldE:\n  fixes P :: pi\n  and   Q :: pi\n  and   s :: \"(name \\<times> name) list\"\n\n  assumes \"P \\<simeq>\\<^sup>s Q\"\n\n  shows \"P[<s>] \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q[<s>]\"\n  and   \"Q[<s>] \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> P[<s>]\"\nproof -\n  from assms show \"P[<s>] \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q[<s>]\" by(simp add: weakCongruenceSubst_def weakCongruence_def)\nnext\n  from assms show \"Q[<s>] \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> P[<s>]\" by(simp add: weakCongruenceSubst_def weakCongruence_def)\nqed\n\nlemma unfoldI:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"\\<And>s. P[<s>] \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q[<s>]\"\n  and     \"\\<And>s. Q[<s>] \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> P[<s>]\"\n\n  shows \"P \\<simeq>\\<^sup>s Q\"\nusing assms\nby(simp add: weakCongruenceSubst_def weakCongruence_def)\n\n\n\n  assumes \"P \\<simeq>\\<^sup>s Q\"\n\n  shows \"P \\<simeq> Q\"\nusing assms\napply(simp add: weakCongruenceSubst_def weakCongruence_def)\napply(erule_tac x=\"[]\" in allE)\nby auto\n\nlemma eqvtI:\n  fixes P :: pi\n  and   Q :: pi\n  and   p :: \"name prm\"\n\n  assumes \"P \\<simeq>\\<^sup>s Q\"\n\n  shows \"(p \\<bullet> P) \\<simeq>\\<^sup>s (p \\<bullet> Q)\"\nproof(simp add: weakCongruenceSubst_def, rule allI)\n  fix s\n  from assms have \"P[<(rev p \\<bullet> s)>] \\<simeq> Q[<(rev p \\<bullet> s)>]\" by(auto simp add: weakCongruenceSubst_def)\n  thus \"(p \\<bullet> P)[<s>] \\<simeq> (p \\<bullet> Q)[<s>]\" by(drule_tac p=p in Weak_Early_Cong.eqvtI) (simp add: eqvts name_per_rev)\nqed\n\nlemma strongEqWeakCong:\n  fixes P :: pi\n  and   Q :: pi\n  \n  assumes \"P \\<sim>\\<^sup>s Q\"\n\n  shows \"P \\<simeq>\\<^sup>s Q\"\nusing assms\nby(auto intro: strongBisimWeakCong simp add: substClosed_def weakCongruenceSubst_def)\n\nlemma congSubstBisimSubst:\n  fixes P :: pi\n  and   Q :: pi\n  \n  assumes \"P \\<simeq>\\<^sup>s Q\"\n\n  shows \"P \\<approx>\\<^sup>s Q\"\nusing assms\nby(auto intro: congruenceWeakBisim simp add: substClosed_def weakCongruenceSubst_def)\n\nlemma reflexive:\n  fixes P :: pi\n  \n  shows \"P \\<simeq>\\<^sup>s P\"\nproof -\n  from Weak_Early_Bisim.reflexive have \"\\<And>P. P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> P\"\n    by(blast intro: Weak_Early_Step_Sim.reflexive)\n  thus ?thesis\n    by(force simp add: weakCongruenceSubst_def weakCongruence_def)\nqed\n\nlemma symetric:\n  fixes P :: pi\n  and   Q :: pi\n  \n  assumes \"P \\<simeq>\\<^sup>s Q\"\n  \n  shows \"Q \\<simeq>\\<^sup>s P\"\nusing assms by(auto simp add: weakCongruenceSubst_def weakCongruence_def)\n\n\n\nlemma partUnfold:\n  fixes P :: pi\n  and   Q :: pi\n  and   s :: \"(name \\<times> name) list\"\n\n  assumes \"P \\<simeq>\\<^sup>s Q\"\n\n  shows \"P[<s>] \\<simeq>\\<^sup>s Q[<s>]\"\nusing assms\nproof(auto simp add: weakCongruenceSubst_def)\n  fix s'\n  assume \"\\<forall>s. P[<s>] \\<simeq> Q[<s>]\"\n  hence \"P[<(s@s')>] \\<simeq> Q[<(s@s')>]\" by blast\n  moreover have \"P[<(s@s')>] = (P[<s>])[<s'>]\"\n    by(induct s', auto)\n  moreover have \"Q[<(s@s')>] = (Q[<s>])[<s'>]\"\n    by(induct s', auto)\n  \n  ultimately show \"(P[<s>])[<s'>] \\<simeq> (Q[<s>])[<s'>]\"\n    by simp\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Early_Cong_Subst.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3196862947868583}}
{"text": "theory CR\nimports Lam_Funs\nbegin\n\ntext {* The Church-Rosser proof from Barendregt's book *}\n\nlemma forget: \n  assumes asm: \"x\\<sharp>L\"\n  shows \"L[x::=P] = L\"\nusing asm\nproof (nominal_induct L avoiding: x P rule: lam.strong_induct)\n  case (Var z)\n  have \"x\\<sharp>Var z\" by fact\n  thus \"(Var z)[x::=P] = (Var z)\" by (simp add: fresh_atm)\nnext \n  case (App M1 M2)\n  have \"x\\<sharp>App M1 M2\" by fact\n  moreover\n  have ih1: \"x\\<sharp>M1 \\<Longrightarrow> M1[x::=P] = M1\" by fact\n  moreover\n  have ih1: \"x\\<sharp>M2 \\<Longrightarrow> M2[x::=P] = M2\" by fact\n  ultimately show \"(App M1 M2)[x::=P] = (App M1 M2)\" by simp\nnext\n  case (Lam z M)\n  have vc: \"z\\<sharp>x\" \"z\\<sharp>P\" by fact+\n  have ih: \"x\\<sharp>M \\<Longrightarrow>  M[x::=P] = M\" by fact\n  have asm: \"x\\<sharp>Lam [z].M\" by fact\n  then have \"x\\<sharp>M\" using vc by (simp add: fresh_atm abs_fresh)\n  then have \"M[x::=P] = M\" using ih by simp\n  then show \"(Lam [z].M)[x::=P] = Lam [z].M\" using vc by simp\nqed\n\nlemma forget_automatic: \n  assumes asm: \"x\\<sharp>L\"\n  shows \"L[x::=P] = L\"\n  using asm \nby (nominal_induct L avoiding: x P rule: lam.strong_induct)\n   (auto simp add: abs_fresh fresh_atm)\n\nlemma fresh_fact: \n  fixes z::\"name\"\n  assumes asms: \"z\\<sharp>N\" \"z\\<sharp>L\"\n  shows \"z\\<sharp>(N[y::=L])\"\nusing asms\nproof (nominal_induct N avoiding: z y L rule: lam.strong_induct)\n  case (Var u)\n  have \"z\\<sharp>(Var u)\" \"z\\<sharp>L\" by fact+\n  thus \"z\\<sharp>((Var u)[y::=L])\" by simp\nnext\n  case (App N1 N2)\n  have ih1: \"\\<lbrakk>z\\<sharp>N1; z\\<sharp>L\\<rbrakk> \\<Longrightarrow> z\\<sharp>N1[y::=L]\" by fact\n  moreover\n  have ih2: \"\\<lbrakk>z\\<sharp>N2; z\\<sharp>L\\<rbrakk> \\<Longrightarrow> z\\<sharp>N2[y::=L]\" by fact\n  moreover \n  have \"z\\<sharp>App N1 N2\" \"z\\<sharp>L\" by fact+\n  ultimately show \"z\\<sharp>((App N1 N2)[y::=L])\" by simp \nnext\n  case (Lam u N1)\n  have vc: \"u\\<sharp>z\" \"u\\<sharp>y\" \"u\\<sharp>L\" by fact+\n  have \"z\\<sharp>Lam [u].N1\" by fact\n  hence \"z\\<sharp>N1\" using vc by (simp add: abs_fresh fresh_atm)\n  moreover\n  have ih: \"\\<lbrakk>z\\<sharp>N1; z\\<sharp>L\\<rbrakk> \\<Longrightarrow> z\\<sharp>(N1[y::=L])\" by fact\n  moreover\n  have  \"z\\<sharp>L\" by fact\n  ultimately show \"z\\<sharp>(Lam [u].N1)[y::=L]\" using vc by (simp add: abs_fresh)\nqed\n\nlemma fresh_fact_automatic: \n  fixes z::\"name\"\n  assumes asms: \"z\\<sharp>N\" \"z\\<sharp>L\"\n  shows \"z\\<sharp>(N[y::=L])\"\n  using asms \nby (nominal_induct N avoiding: z y L rule: lam.strong_induct)\n   (auto simp add: abs_fresh fresh_atm)\n\nlemma fresh_fact': \n  fixes a::\"name\"\n  assumes a: \"a\\<sharp>t2\"\n  shows \"a\\<sharp>t1[a::=t2]\"\nusing a \nby (nominal_induct t1 avoiding: a t2 rule: lam.strong_induct)\n   (auto simp add: abs_fresh fresh_atm)\n\nlemma substitution_lemma:  \n  assumes a: \"x\\<noteq>y\"\n  and     b: \"x\\<sharp>L\"\n  shows \"M[x::=N][y::=L] = M[y::=L][x::=N[y::=L]]\"\nusing a b\nproof (nominal_induct M avoiding: x y N L rule: lam.strong_induct)\n  case (Var z) (* case 1: Variables*)\n  have \"x\\<noteq>y\" by fact\n  have \"x\\<sharp>L\" by fact\n  show \"Var z[x::=N][y::=L] = Var z[y::=L][x::=N[y::=L]]\" (is \"?LHS = ?RHS\")\n  proof -\n    { (*Case 1.1*)\n      assume  \"z=x\"\n      have \"(1)\": \"?LHS = N[y::=L]\" using `z=x` by simp\n      have \"(2)\": \"?RHS = N[y::=L]\" using `z=x` `x\\<noteq>y` by simp\n      from \"(1)\" \"(2)\" have \"?LHS = ?RHS\"  by simp\n    }\n    moreover \n    { (*Case 1.2*)\n      assume \"z=y\" and \"z\\<noteq>x\" \n      have \"(1)\": \"?LHS = L\"               using `z\\<noteq>x` `z=y` by simp\n      have \"(2)\": \"?RHS = L[x::=N[y::=L]]\" using `z=y` by simp\n      have \"(3)\": \"L[x::=N[y::=L]] = L\"    using `x\\<sharp>L` by (simp add: forget)\n      from \"(1)\" \"(2)\" \"(3)\" have \"?LHS = ?RHS\" by simp\n    }\n    moreover \n    { (*Case 1.3*)\n      assume \"z\\<noteq>x\" and \"z\\<noteq>y\"\n      have \"(1)\": \"?LHS = Var z\" using `z\\<noteq>x` `z\\<noteq>y` by simp\n      have \"(2)\": \"?RHS = Var z\" using `z\\<noteq>x` `z\\<noteq>y` by simp\n      from \"(1)\" \"(2)\" have \"?LHS = ?RHS\" by simp\n    }\n    ultimately show \"?LHS = ?RHS\" by blast\n  qed\nnext\n  case (Lam z M1) (* case 2: lambdas *)\n  have ih: \"\\<lbrakk>x\\<noteq>y; x\\<sharp>L\\<rbrakk> \\<Longrightarrow> M1[x::=N][y::=L] = M1[y::=L][x::=N[y::=L]]\" by fact\n  have \"x\\<noteq>y\" by fact\n  have \"x\\<sharp>L\" by fact\n  have fs: \"z\\<sharp>x\" \"z\\<sharp>y\" \"z\\<sharp>N\" \"z\\<sharp>L\" by fact+\n  hence \"z\\<sharp>N[y::=L]\" by (simp add: fresh_fact)\n  show \"(Lam [z].M1)[x::=N][y::=L] = (Lam [z].M1)[y::=L][x::=N[y::=L]]\" (is \"?LHS=?RHS\") \n  proof - \n    have \"?LHS = Lam [z].(M1[x::=N][y::=L])\" using `z\\<sharp>x` `z\\<sharp>y` `z\\<sharp>N` `z\\<sharp>L` by simp\n    also from ih have \"\\<dots> = Lam [z].(M1[y::=L][x::=N[y::=L]])\" using `x\\<noteq>y` `x\\<sharp>L` by simp\n    also have \"\\<dots> = (Lam [z].(M1[y::=L]))[x::=N[y::=L]]\" using `z\\<sharp>x` `z\\<sharp>N[y::=L]` by simp\n    also have \"\\<dots> = ?RHS\" using  `z\\<sharp>y` `z\\<sharp>L` by simp\n    finally show \"?LHS = ?RHS\" .\n  qed\nnext\n  case (App M1 M2) (* case 3: applications *)\n  thus \"(App M1 M2)[x::=N][y::=L] = (App M1 M2)[y::=L][x::=N[y::=L]]\" by simp\nqed\n\nlemma substitution_lemma_automatic:  \n  assumes asm: \"x\\<noteq>y\" \"x\\<sharp>L\"\n  shows \"M[x::=N][y::=L] = M[y::=L][x::=N[y::=L]]\"\n  using asm \nby (nominal_induct M avoiding: x y N L rule: lam.strong_induct)\n   (auto simp add: fresh_fact forget)\n\nsection {* Beta Reduction *}\n\ninductive\n  \"Beta\" :: \"lam\\<Rightarrow>lam\\<Rightarrow>bool\" (\" _ \\<longrightarrow>\\<^sub>\\<beta> _\" [80,80] 80)\nwhere\n    b1[intro]: \"s1\\<longrightarrow>\\<^sub>\\<beta>s2 \\<Longrightarrow> (App s1 t)\\<longrightarrow>\\<^sub>\\<beta>(App s2 t)\"\n  | b2[intro]: \"s1\\<longrightarrow>\\<^sub>\\<beta>s2 \\<Longrightarrow> (App t s1)\\<longrightarrow>\\<^sub>\\<beta>(App t s2)\"\n  | b3[intro]: \"s1\\<longrightarrow>\\<^sub>\\<beta>s2 \\<Longrightarrow> (Lam [a].s1)\\<longrightarrow>\\<^sub>\\<beta> (Lam [a].s2)\"\n  | b4[intro]: \"a\\<sharp>s2 \\<Longrightarrow> (App (Lam [a].s1) s2)\\<longrightarrow>\\<^sub>\\<beta>(s1[a::=s2])\"\n\nequivariance Beta\n\nnominal_inductive Beta\n  by (simp_all add: abs_fresh fresh_fact')\n\ninductive\n  \"Beta_star\"  :: \"lam\\<Rightarrow>lam\\<Rightarrow>bool\" (\" _ \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* _\" [80,80] 80)\nwhere\n    bs1[intro, simp]: \"M \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M\"\n  | bs2[intro]: \"\\<lbrakk>M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M2; M2 \\<longrightarrow>\\<^sub>\\<beta> M3\\<rbrakk> \\<Longrightarrow> M1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M3\"\n\nequivariance Beta_star\n\nlemma beta_star_trans:\n  assumes a1: \"M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M2\"\n  and     a2: \"M2\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M3\"\n  shows \"M1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M3\"\nusing a2 a1\nby (induct) (auto)\n\nsection {* One-Reduction *}\n\ninductive\n  One :: \"lam\\<Rightarrow>lam\\<Rightarrow>bool\" (\" _ \\<longrightarrow>\\<^sub>1 _\" [80,80] 80)\nwhere\n    o1[intro!]:      \"M\\<longrightarrow>\\<^sub>1M\"\n  | o2[simp,intro!]: \"\\<lbrakk>t1\\<longrightarrow>\\<^sub>1t2;s1\\<longrightarrow>\\<^sub>1s2\\<rbrakk> \\<Longrightarrow> (App t1 s1)\\<longrightarrow>\\<^sub>1(App t2 s2)\"\n  | o3[simp,intro!]: \"s1\\<longrightarrow>\\<^sub>1s2 \\<Longrightarrow> (Lam [a].s1)\\<longrightarrow>\\<^sub>1(Lam [a].s2)\"\n  | o4[simp,intro!]: \"\\<lbrakk>a\\<sharp>(s1,s2); s1\\<longrightarrow>\\<^sub>1s2;t1\\<longrightarrow>\\<^sub>1t2\\<rbrakk> \\<Longrightarrow> (App (Lam [a].t1) s1)\\<longrightarrow>\\<^sub>1(t2[a::=s2])\"\n\nequivariance One\n\nnominal_inductive One\n  by (simp_all add: abs_fresh fresh_fact')\n\ninductive\n  \"One_star\"  :: \"lam\\<Rightarrow>lam\\<Rightarrow>bool\" (\" _ \\<longrightarrow>\\<^sub>1\\<^sup>* _\" [80,80] 80)\nwhere\n    os1[intro, simp]: \"M \\<longrightarrow>\\<^sub>1\\<^sup>* M\"\n  | os2[intro]: \"\\<lbrakk>M1\\<longrightarrow>\\<^sub>1\\<^sup>* M2; M2 \\<longrightarrow>\\<^sub>1 M3\\<rbrakk> \\<Longrightarrow> M1 \\<longrightarrow>\\<^sub>1\\<^sup>* M3\"\n\nequivariance One_star \n\nlemma one_star_trans:\n  assumes a1: \"M1\\<longrightarrow>\\<^sub>1\\<^sup>* M2\" \n  and     a2: \"M2\\<longrightarrow>\\<^sub>1\\<^sup>* M3\"\n  shows \"M1\\<longrightarrow>\\<^sub>1\\<^sup>* M3\"\nusing a2 a1\nby (induct) (auto)\n\nlemma one_fresh_preserv:\n  fixes a :: \"name\"\n  assumes a: \"t\\<longrightarrow>\\<^sub>1s\"\n  and     b: \"a\\<sharp>t\"\n  shows \"a\\<sharp>s\"\nusing a b\nproof (induct)\n  case o1 thus ?case by simp\nnext\n  case o2 thus ?case by simp\nnext\n  case (o3 s1 s2 c)\n  have ih: \"a\\<sharp>s1 \\<Longrightarrow>  a\\<sharp>s2\" by fact\n  have c: \"a\\<sharp>Lam [c].s1\" by fact\n  show ?case\n  proof (cases \"a=c\")\n    assume \"a=c\" thus \"a\\<sharp>Lam [c].s2\" by (simp add: abs_fresh)\n  next\n    assume d: \"a\\<noteq>c\" \n    with c have \"a\\<sharp>s1\" by (simp add: abs_fresh)\n    hence \"a\\<sharp>s2\" using ih by simp\n    thus \"a\\<sharp>Lam [c].s2\" using d by (simp add: abs_fresh) \n  qed\nnext \n  case (o4 c t1 t2 s1 s2)\n  have i1: \"a\\<sharp>t1 \\<Longrightarrow> a\\<sharp>t2\" by fact\n  have i2: \"a\\<sharp>s1 \\<Longrightarrow> a\\<sharp>s2\" by fact\n  have as: \"a\\<sharp>App (Lam [c].s1) t1\" by fact\n  hence c1: \"a\\<sharp>Lam [c].s1\" and c2: \"a\\<sharp>t1\" by (simp add: fresh_prod)+\n  from c2 i1 have c3: \"a\\<sharp>t2\" by simp\n  show \"a\\<sharp>s2[c::=t2]\"\n  proof (cases \"a=c\")\n    assume \"a=c\"\n    thus \"a\\<sharp>s2[c::=t2]\" using c3 by (simp add: fresh_fact')\n  next\n    assume d1: \"a\\<noteq>c\"\n    from c1 d1 have \"a\\<sharp>s1\" by (simp add: abs_fresh)\n    hence \"a\\<sharp>s2\" using i2 by simp\n    thus \"a\\<sharp>s2[c::=t2]\" using c3 by (simp add: fresh_fact)\n  qed\nqed\n\nlemma one_fresh_preserv_automatic:\n  fixes a :: \"name\"\n  assumes a: \"t\\<longrightarrow>\\<^sub>1s\"\n  and     b: \"a\\<sharp>t\"\n  shows \"a\\<sharp>s\"\nusing a b\napply(nominal_induct avoiding: a rule: One.strong_induct)\napply(auto simp add: abs_fresh fresh_atm fresh_fact)\ndone\n\nlemma subst_rename: \n  assumes a: \"c\\<sharp>t1\"\n  shows \"t1[a::=t2] = ([(c,a)]\\<bullet>t1)[c::=t2]\"\nusing a\nby (nominal_induct t1 avoiding: a c t2 rule: lam.strong_induct)\n   (auto simp add: calc_atm fresh_atm abs_fresh)\n\nlemma one_abs: \n  assumes a: \"Lam [a].t\\<longrightarrow>\\<^sub>1t'\"\n  shows \"\\<exists>t''. t'=Lam [a].t'' \\<and> t\\<longrightarrow>\\<^sub>1t''\"\nproof -\n  have \"a\\<sharp>Lam [a].t\" by (simp add: abs_fresh)\n  with a have \"a\\<sharp>t'\" by (simp add: one_fresh_preserv)\n  with a show ?thesis\n    by (cases rule: One.strong_cases[where a=\"a\" and aa=\"a\"])\n       (auto simp add: lam.inject abs_fresh alpha)\nqed\n\nlemma one_app: \n  assumes a: \"App t1 t2 \\<longrightarrow>\\<^sub>1 t'\"\n  shows \"(\\<exists>s1 s2. t' = App s1 s2 \\<and> t1 \\<longrightarrow>\\<^sub>1 s1 \\<and> t2 \\<longrightarrow>\\<^sub>1 s2) \\<or> \n         (\\<exists>a s s1 s2. t1 = Lam [a].s \\<and> t' = s1[a::=s2] \\<and> s \\<longrightarrow>\\<^sub>1 s1 \\<and> t2 \\<longrightarrow>\\<^sub>1 s2 \\<and> a\\<sharp>(t2,s2))\"\nusing a by (erule_tac One.cases) (auto simp add: lam.inject)\n\nlemma one_red: \n  assumes a: \"App (Lam [a].t1) t2 \\<longrightarrow>\\<^sub>1 M\" \"a\\<sharp>(t2,M)\"\n  shows \"(\\<exists>s1 s2. M = App (Lam [a].s1) s2 \\<and> t1 \\<longrightarrow>\\<^sub>1 s1 \\<and> t2 \\<longrightarrow>\\<^sub>1 s2) \\<or> \n         (\\<exists>s1 s2. M = s1[a::=s2] \\<and> t1 \\<longrightarrow>\\<^sub>1 s1 \\<and> t2 \\<longrightarrow>\\<^sub>1 s2)\" \nusing a\nby (cases rule: One.strong_cases [where a=\"a\" and aa=\"a\"])\n   (auto dest: one_abs simp add: lam.inject abs_fresh alpha fresh_prod)\n\ntext {* first case in Lemma 3.2.4*}\n\nlemma one_subst_aux:\n  assumes a: \"N\\<longrightarrow>\\<^sub>1N'\"\n  shows \"M[x::=N] \\<longrightarrow>\\<^sub>1 M[x::=N']\"\nusing a\nproof (nominal_induct M avoiding: x N N' rule: lam.strong_induct)\n  case (Var y) \n  thus \"Var y[x::=N] \\<longrightarrow>\\<^sub>1 Var y[x::=N']\" by (cases \"x=y\") auto\nnext\n  case (App P Q) (* application case - third line *)\n  thus \"(App P Q)[x::=N] \\<longrightarrow>\\<^sub>1  (App P Q)[x::=N']\" using o2 by simp\nnext \n  case (Lam y P) (* abstraction case - fourth line *)\n  thus \"(Lam [y].P)[x::=N] \\<longrightarrow>\\<^sub>1 (Lam [y].P)[x::=N']\" using o3 by simp\nqed\n\nlemma one_subst_aux_automatic:\n  assumes a: \"N\\<longrightarrow>\\<^sub>1N'\"\n  shows \"M[x::=N] \\<longrightarrow>\\<^sub>1 M[x::=N']\"\nusing a\nby (nominal_induct M avoiding: x N N' rule: lam.strong_induct)\n   (auto simp add: fresh_prod fresh_atm)\n\nlemma one_subst: \n  assumes a: \"M\\<longrightarrow>\\<^sub>1M'\"\n  and     b: \"N\\<longrightarrow>\\<^sub>1N'\"\n  shows \"M[x::=N]\\<longrightarrow>\\<^sub>1M'[x::=N']\" \nusing a b\nproof (nominal_induct M M' avoiding: N N' x rule: One.strong_induct)\n  case (o1 M)\n  thus ?case by (simp add: one_subst_aux)\nnext\n  case (o2 M1 M2 N1 N2)\n  thus ?case by simp\nnext\n  case (o3 a M1 M2)\n  thus ?case by simp\nnext\n  case (o4 a N1 N2 M1 M2 N N' x)\n  have vc: \"a\\<sharp>N\" \"a\\<sharp>N'\" \"a\\<sharp>x\" \"a\\<sharp>N1\" \"a\\<sharp>N2\" by fact+\n  have asm: \"N\\<longrightarrow>\\<^sub>1N'\" by fact\n  show ?case\n  proof -\n    have \"(App (Lam [a].M1) N1)[x::=N] = App (Lam [a].(M1[x::=N])) (N1[x::=N])\" using vc by simp\n    moreover have \"App (Lam [a].(M1[x::=N])) (N1[x::=N]) \\<longrightarrow>\\<^sub>1 M2[x::=N'][a::=N2[x::=N']]\" \n      using o4 asm by (simp add: fresh_fact)\n    moreover have \"M2[x::=N'][a::=N2[x::=N']] = M2[a::=N2][x::=N']\" \n      using vc by (simp add: substitution_lemma fresh_atm)\n    ultimately show \"(App (Lam [a].M1) N1)[x::=N] \\<longrightarrow>\\<^sub>1 M2[a::=N2][x::=N']\" by simp\n  qed\nqed\n\nlemma one_subst_automatic: \n  assumes a: \"M\\<longrightarrow>\\<^sub>1M'\" \n  and     b: \"N\\<longrightarrow>\\<^sub>1N'\"\n  shows \"M[x::=N]\\<longrightarrow>\\<^sub>1M'[x::=N']\" \nusing a b\nby (nominal_induct M M' avoiding: N N' x rule: One.strong_induct)\n   (auto simp add: one_subst_aux substitution_lemma fresh_atm fresh_fact)\n\nlemma diamond[rule_format]:\n  fixes    M :: \"lam\"\n  and      M1:: \"lam\"\n  assumes a: \"M\\<longrightarrow>\\<^sub>1M1\" \n  and     b: \"M\\<longrightarrow>\\<^sub>1M2\"\n  shows \"\\<exists>M3. M1\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\"\n  using a b\nproof (nominal_induct avoiding: M1 M2 rule: One.strong_induct)\n  case (o1 M) (* case 1 --- M1 = M *)\n  thus \"\\<exists>M3. M\\<longrightarrow>\\<^sub>1M3 \\<and>  M2\\<longrightarrow>\\<^sub>1M3\" by blast\nnext\n  case (o4 x Q Q' P P') (* case 2 --- a beta-reduction occurs*)\n  have vc: \"x\\<sharp>Q\" \"x\\<sharp>Q'\" \"x\\<sharp>M2\" by fact+\n  have i1: \"\\<And>M2. Q \\<longrightarrow>\\<^sub>1M2 \\<Longrightarrow> (\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3)\" by fact\n  have i2: \"\\<And>M2. P \\<longrightarrow>\\<^sub>1M2 \\<Longrightarrow> (\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3)\" by fact\n  have \"App (Lam [x].P) Q \\<longrightarrow>\\<^sub>1 M2\" by fact\n  hence \"(\\<exists>P' Q'. M2 = App (Lam [x].P') Q' \\<and> P\\<longrightarrow>\\<^sub>1P' \\<and> Q\\<longrightarrow>\\<^sub>1Q') \\<or> \n         (\\<exists>P' Q'. M2 = P'[x::=Q'] \\<and> P\\<longrightarrow>\\<^sub>1P' \\<and> Q\\<longrightarrow>\\<^sub>1Q')\" using vc by (simp add: one_red)\n  moreover (* subcase 2.1 *)\n  { assume \"\\<exists>P' Q'. M2 = App (Lam [x].P') Q' \\<and> P\\<longrightarrow>\\<^sub>1P' \\<and> Q\\<longrightarrow>\\<^sub>1Q'\"\n    then obtain P'' and Q'' where \n      b1: \"M2=App (Lam [x].P'') Q''\" and b2: \"P\\<longrightarrow>\\<^sub>1P''\" and b3: \"Q\\<longrightarrow>\\<^sub>1Q''\" by blast\n    from b2 i2 have \"(\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> P''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain P''' where\n      c1: \"P'\\<longrightarrow>\\<^sub>1P'''\" and c2: \"P''\\<longrightarrow>\\<^sub>1P'''\" by force\n    from b3 i1 have \"(\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> Q''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain Q''' where\n      d1: \"Q'\\<longrightarrow>\\<^sub>1Q'''\" and d2: \"Q''\\<longrightarrow>\\<^sub>1Q'''\" by force\n    from c1 c2 d1 d2 \n    have \"P'[x::=Q']\\<longrightarrow>\\<^sub>1P'''[x::=Q'''] \\<and> App (Lam [x].P'') Q'' \\<longrightarrow>\\<^sub>1 P'''[x::=Q''']\" \n      using vc b3 by (auto simp add: one_subst one_fresh_preserv)\n    hence \"\\<exists>M3. P'[x::=Q']\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" using b1 by blast\n  }\n  moreover (* subcase 2.2 *)\n  { assume \"\\<exists>P' Q'. M2 = P'[x::=Q'] \\<and> P\\<longrightarrow>\\<^sub>1P' \\<and> Q\\<longrightarrow>\\<^sub>1Q'\"\n    then obtain P'' Q'' where\n      b1: \"M2=P''[x::=Q'']\" and b2: \"P\\<longrightarrow>\\<^sub>1P''\" and  b3: \"Q\\<longrightarrow>\\<^sub>1Q''\" by blast\n    from b2 i2 have \"(\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> P''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain P''' where\n      c1: \"P'\\<longrightarrow>\\<^sub>1P'''\" and c2: \"P''\\<longrightarrow>\\<^sub>1P'''\" by blast\n    from b3 i1 have \"(\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> Q''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain Q''' where\n      d1: \"Q'\\<longrightarrow>\\<^sub>1Q'''\" and d2: \"Q''\\<longrightarrow>\\<^sub>1Q'''\" by blast\n    from c1 c2 d1 d2 \n    have \"P'[x::=Q']\\<longrightarrow>\\<^sub>1P'''[x::=Q'''] \\<and> P''[x::=Q'']\\<longrightarrow>\\<^sub>1P'''[x::=Q''']\" \n      by (force simp add: one_subst)\n    hence \"\\<exists>M3. P'[x::=Q']\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" using b1 by blast\n  }\n  ultimately show \"\\<exists>M3. P'[x::=Q']\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" by blast\nnext\n  case (o2 P P' Q Q') (* case 3 *)\n  have i0: \"P\\<longrightarrow>\\<^sub>1P'\" by fact\n  have i0': \"Q\\<longrightarrow>\\<^sub>1Q'\" by fact\n  have i1: \"\\<And>M2. Q \\<longrightarrow>\\<^sub>1M2 \\<Longrightarrow> (\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3)\" by fact\n  have i2: \"\\<And>M2. P \\<longrightarrow>\\<^sub>1M2 \\<Longrightarrow> (\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3)\" by fact\n  assume \"App P Q \\<longrightarrow>\\<^sub>1 M2\"\n  hence \"(\\<exists>P'' Q''. M2 = App P'' Q'' \\<and> P\\<longrightarrow>\\<^sub>1P'' \\<and> Q\\<longrightarrow>\\<^sub>1Q'') \\<or> \n         (\\<exists>x P' P'' Q'. P = Lam [x].P' \\<and> M2 = P''[x::=Q'] \\<and> P'\\<longrightarrow>\\<^sub>1 P'' \\<and> Q\\<longrightarrow>\\<^sub>1Q' \\<and> x\\<sharp>(Q,Q'))\" \n    by (simp add: one_app[simplified])\n  moreover (* subcase 3.1 *)\n  { assume \"\\<exists>P'' Q''. M2 = App P'' Q'' \\<and> P\\<longrightarrow>\\<^sub>1P'' \\<and> Q\\<longrightarrow>\\<^sub>1Q''\"\n    then obtain P'' and Q'' where \n      b1: \"M2=App P'' Q''\" and b2: \"P\\<longrightarrow>\\<^sub>1P''\" and b3: \"Q\\<longrightarrow>\\<^sub>1Q''\" by blast\n    from b2 i2 have \"(\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> P''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain P''' where\n      c1: \"P'\\<longrightarrow>\\<^sub>1P'''\" and c2: \"P''\\<longrightarrow>\\<^sub>1P'''\" by blast\n    from b3 i1 have \"\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> Q''\\<longrightarrow>\\<^sub>1M3\" by simp\n    then obtain Q''' where\n      d1: \"Q'\\<longrightarrow>\\<^sub>1Q'''\" and d2: \"Q''\\<longrightarrow>\\<^sub>1Q'''\" by blast\n    from c1 c2 d1 d2 \n    have \"App P' Q'\\<longrightarrow>\\<^sub>1App P''' Q''' \\<and> App P'' Q'' \\<longrightarrow>\\<^sub>1 App P''' Q'''\" by blast\n    hence \"\\<exists>M3. App P' Q'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" using b1 by blast\n  }\n  moreover (* subcase 3.2 *)\n  { assume \"\\<exists>x P1 P'' Q''. P = Lam [x].P1 \\<and> M2 = P''[x::=Q''] \\<and> P1\\<longrightarrow>\\<^sub>1 P'' \\<and> Q\\<longrightarrow>\\<^sub>1Q'' \\<and> x\\<sharp>(Q,Q'')\"\n    then obtain x P1 P1'' Q'' where\n      b0: \"P = Lam [x].P1\" and b1: \"M2 = P1''[x::=Q'']\" and \n      b2: \"P1\\<longrightarrow>\\<^sub>1P1''\" and  b3: \"Q\\<longrightarrow>\\<^sub>1Q''\" and vc: \"x\\<sharp>(Q,Q'')\" by blast\n    from b0 i0 have \"\\<exists>P1'. P'=Lam [x].P1' \\<and> P1\\<longrightarrow>\\<^sub>1P1'\" by (simp add: one_abs)      \n    then obtain P1' where g1: \"P'=Lam [x].P1'\" and g2: \"P1\\<longrightarrow>\\<^sub>1P1'\" by blast \n    from g1 b0 b2 i2 have \"(\\<exists>M3. (Lam [x].P1')\\<longrightarrow>\\<^sub>1M3 \\<and> (Lam [x].P1'')\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain P1''' where\n      c1: \"(Lam [x].P1')\\<longrightarrow>\\<^sub>1P1'''\" and c2: \"(Lam [x].P1'')\\<longrightarrow>\\<^sub>1P1'''\" by blast\n    from c1 have \"\\<exists>R1. P1'''=Lam [x].R1 \\<and> P1'\\<longrightarrow>\\<^sub>1R1\" by (simp add: one_abs)\n    then obtain R1 where r1: \"P1'''=Lam [x].R1\" and r2: \"P1'\\<longrightarrow>\\<^sub>1R1\" by blast\n    from c2 have \"\\<exists>R2. P1'''=Lam [x].R2 \\<and> P1''\\<longrightarrow>\\<^sub>1R2\" by (simp add: one_abs)\n    then obtain R2 where r3: \"P1'''=Lam [x].R2\" and r4: \"P1''\\<longrightarrow>\\<^sub>1R2\" by blast\n    from r1 r3 have r5: \"R1=R2\" by (simp add: lam.inject alpha)\n    from b3 i1 have \"(\\<exists>M3. Q'\\<longrightarrow>\\<^sub>1M3 \\<and> Q''\\<longrightarrow>\\<^sub>1M3)\" by simp\n    then obtain Q''' where\n      d1: \"Q'\\<longrightarrow>\\<^sub>1Q'''\" and d2: \"Q''\\<longrightarrow>\\<^sub>1Q'''\" by blast\n    from g1 r2 d1 r4 r5 d2 \n    have \"App P' Q'\\<longrightarrow>\\<^sub>1R1[x::=Q'''] \\<and> P1''[x::=Q'']\\<longrightarrow>\\<^sub>1R1[x::=Q''']\" \n      using vc i0' by (simp add: one_subst one_fresh_preserv)\n    hence \"\\<exists>M3. App P' Q'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" using b1 by blast\n  }\n  ultimately show \"\\<exists>M3. App P' Q'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" by blast\nnext\n  case (o3 P P' x) (* case 4 *)\n  have i1: \"P\\<longrightarrow>\\<^sub>1P'\" by fact\n  have i2: \"\\<And>M2. P \\<longrightarrow>\\<^sub>1M2 \\<Longrightarrow> (\\<exists>M3. P'\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3)\" by fact\n  have \"(Lam [x].P)\\<longrightarrow>\\<^sub>1 M2\" by fact\n  hence \"\\<exists>P''. M2=Lam [x].P'' \\<and> P\\<longrightarrow>\\<^sub>1P''\" by (simp add: one_abs)\n  then obtain P'' where b1: \"M2=Lam [x].P''\" and b2: \"P\\<longrightarrow>\\<^sub>1P''\" by blast\n  from i2 b1 b2 have \"\\<exists>M3. (Lam [x].P')\\<longrightarrow>\\<^sub>1M3 \\<and> (Lam [x].P'')\\<longrightarrow>\\<^sub>1M3\" by blast\n  then obtain M3 where c1: \"(Lam [x].P')\\<longrightarrow>\\<^sub>1M3\" and c2: \"(Lam [x].P'')\\<longrightarrow>\\<^sub>1M3\" by blast\n  from c1 have \"\\<exists>R1. M3=Lam [x].R1 \\<and> P'\\<longrightarrow>\\<^sub>1R1\" by (simp add: one_abs)\n  then obtain R1 where r1: \"M3=Lam [x].R1\" and r2: \"P'\\<longrightarrow>\\<^sub>1R1\" by blast\n  from c2 have \"\\<exists>R2. M3=Lam [x].R2 \\<and> P''\\<longrightarrow>\\<^sub>1R2\" by (simp add: one_abs)\n  then obtain R2 where r3: \"M3=Lam [x].R2\" and r4: \"P''\\<longrightarrow>\\<^sub>1R2\" by blast\n  from r1 r3 have r5: \"R1=R2\" by (simp add: lam.inject alpha)\n  from r2 r4 have \"(Lam [x].P')\\<longrightarrow>\\<^sub>1(Lam [x].R1) \\<and> (Lam [x].P'')\\<longrightarrow>\\<^sub>1(Lam [x].R2)\" \n    by (simp add: one_subst)\n  thus \"\\<exists>M3. (Lam [x].P')\\<longrightarrow>\\<^sub>1M3 \\<and> M2\\<longrightarrow>\\<^sub>1M3\" using b1 r5 by blast\nqed\n\nlemma one_lam_cong: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" \n  shows \"(Lam [a].t1)\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*(Lam [a].t2)\"\n  using a\nproof induct\n  case bs1 thus ?case by simp\nnext\n  case (bs2 y z) \n  thus ?case by (blast dest: b3)\nqed\n\nlemma one_app_congL: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" \n  shows \"App t1 s\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App t2 s\"\n  using a\nproof induct\n  case bs1 thus ?case by simp\nnext\n  case bs2 thus ?case by (blast dest: b1)\nqed\n  \nlemma one_app_congR: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" \n  shows \"App s t1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App s t2\"\nusing a\nproof induct\n  case bs1 thus ?case by simp\nnext \n  case bs2 thus ?case by (blast dest: b2)\nqed\n\nlemma one_app_cong: \n  assumes a1: \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" \n  and     a2: \"s1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*s2\" \n  shows \"App t1 s1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App t2 s2\"\nproof -\n  have \"App t1 s1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App t2 s1\" using a1 by (rule one_app_congL)\n  moreover\n  have \"App t2 s1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App t2 s2\" using a2 by (rule one_app_congR)\n  ultimately show ?thesis by (rule beta_star_trans)\nqed\n\nlemma one_beta_star: \n  assumes a: \"(t1\\<longrightarrow>\\<^sub>1t2)\" \n  shows \"(t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2)\"\n  using a\nproof(nominal_induct rule: One.strong_induct)\n  case o1 thus ?case by simp\nnext\n  case o2 thus ?case by (blast intro!: one_app_cong)\nnext\n  case o3 thus ?case by (blast intro!: one_lam_cong)\nnext \n  case (o4 a s1 s2 t1 t2)\n  have vc: \"a\\<sharp>s1\" \"a\\<sharp>s2\" by fact+\n  have a1: \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" and a2: \"s1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*s2\" by fact+\n  have c1: \"(App (Lam [a].t2) s2) \\<longrightarrow>\\<^sub>\\<beta> (t2 [a::= s2])\" using vc by (simp add: b4)\n  from a1 a2 have c2: \"App (Lam [a].t1 ) s1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* App (Lam [a].t2 ) s2\" \n    by (blast intro!: one_app_cong one_lam_cong)\n  show ?case using c2 c1 by (blast intro: beta_star_trans)\nqed\n \nlemma one_star_lam_cong: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t2\" \n  shows \"(Lam  [a].t1)\\<longrightarrow>\\<^sub>1\\<^sup>* (Lam [a].t2)\"\n  using a\nproof induct\n  case os1 thus ?case by simp\nnext\n  case os2 thus ?case by (blast intro: one_star_trans)\nqed\n\nlemma one_star_app_congL: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t2\" \n  shows \"App t1 s\\<longrightarrow>\\<^sub>1\\<^sup>* App t2 s\"\n  using a\nproof induct\n  case os1 thus ?case by simp\nnext\n  case os2 thus ?case by (blast intro: one_star_trans)\nqed\n\nlemma one_star_app_congR: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t2\" \n  shows \"App s t1 \\<longrightarrow>\\<^sub>1\\<^sup>* App s t2\"\n  using a\nproof induct\n  case os1 thus ?case by simp\nnext\n  case os2 thus ?case by (blast intro: one_star_trans)\nqed\n\nlemma beta_one_star: \n  assumes a: \"t1\\<longrightarrow>\\<^sub>\\<beta>t2\" \n  shows \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t2\"\n  using a\nproof(induct)\n  case b1 thus ?case by (blast intro!: one_star_app_congL)\nnext\n  case b2 thus ?case by (blast intro!: one_star_app_congR)\nnext\n  case b3 thus ?case by (blast intro!: one_star_lam_cong)\nnext\n  case b4 thus ?case by auto \nqed\n\nlemma trans_closure: \n  shows \"(M1\\<longrightarrow>\\<^sub>1\\<^sup>*M2) = (M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M2)\"\nproof\n  assume \"M1 \\<longrightarrow>\\<^sub>1\\<^sup>* M2\"\n  then show \"M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M2\"\n  proof induct\n    case (os1 M1) thus \"M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M1\" by simp\n  next\n    case (os2 M1 M2 M3)\n    have \"M2\\<longrightarrow>\\<^sub>1M3\" by fact\n    then have \"M2\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M3\" by (rule one_beta_star)\n    moreover have \"M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M2\" by fact\n    ultimately show \"M1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*M3\" by (auto intro: beta_star_trans)\n  qed\nnext\n  assume \"M1 \\<longrightarrow>\\<^sub>\\<beta>\\<^sup>* M2\" \n  then show \"M1\\<longrightarrow>\\<^sub>1\\<^sup>*M2\"\n  proof induct\n    case (bs1 M1) thus  \"M1\\<longrightarrow>\\<^sub>1\\<^sup>*M1\" by simp\n  next\n    case (bs2 M1 M2 M3) \n    have \"M2\\<longrightarrow>\\<^sub>\\<beta>M3\" by fact\n    then have \"M2\\<longrightarrow>\\<^sub>1\\<^sup>*M3\" by (rule beta_one_star)\n    moreover have \"M1\\<longrightarrow>\\<^sub>1\\<^sup>*M2\" by fact\n    ultimately show \"M1\\<longrightarrow>\\<^sub>1\\<^sup>*M3\" by (auto intro: one_star_trans)\n  qed\nqed\n\nlemma cr_one:\n  assumes a: \"t\\<longrightarrow>\\<^sub>1\\<^sup>*t1\" \n  and     b: \"t\\<longrightarrow>\\<^sub>1t2\"\n  shows \"\\<exists>t3. t1\\<longrightarrow>\\<^sub>1t3 \\<and> t2\\<longrightarrow>\\<^sub>1\\<^sup>*t3\"\n  using a b\nproof (induct arbitrary: t2)\n  case os1 thus ?case by force\nnext\n  case (os2 t s1 s2 t2)  \n  have b: \"s1 \\<longrightarrow>\\<^sub>1 s2\" by fact\n  have h: \"\\<And>t2. t \\<longrightarrow>\\<^sub>1 t2 \\<Longrightarrow> (\\<exists>t3. s1 \\<longrightarrow>\\<^sub>1 t3 \\<and> t2 \\<longrightarrow>\\<^sub>1\\<^sup>* t3)\" by fact\n  have c: \"t \\<longrightarrow>\\<^sub>1 t2\" by fact\n  show \"\\<exists>t3. s2 \\<longrightarrow>\\<^sub>1 t3 \\<and>  t2 \\<longrightarrow>\\<^sub>1\\<^sup>* t3\" \n  proof -\n    from c h have \"\\<exists>t3. s1 \\<longrightarrow>\\<^sub>1 t3 \\<and> t2 \\<longrightarrow>\\<^sub>1\\<^sup>* t3\" by blast\n    then obtain t3 where c1: \"s1 \\<longrightarrow>\\<^sub>1 t3\" and c2: \"t2 \\<longrightarrow>\\<^sub>1\\<^sup>* t3\" by blast\n    have \"\\<exists>t4. s2 \\<longrightarrow>\\<^sub>1 t4 \\<and> t3 \\<longrightarrow>\\<^sub>1 t4\" using b c1 by (blast intro: diamond)\n    thus ?thesis using c2 by (blast intro: one_star_trans)\n  qed\nqed\n\nlemma cr_one_star: \n  assumes a: \"t\\<longrightarrow>\\<^sub>1\\<^sup>*t2\"\n      and b: \"t\\<longrightarrow>\\<^sub>1\\<^sup>*t1\"\n    shows \"\\<exists>t3. t1\\<longrightarrow>\\<^sub>1\\<^sup>*t3\\<and>t2\\<longrightarrow>\\<^sub>1\\<^sup>*t3\"\nusing a b\nproof (induct arbitrary: t1)\n  case (os1 t) then show ?case by force\nnext \n  case (os2 t s1 s2 t1)\n  have c: \"t \\<longrightarrow>\\<^sub>1\\<^sup>* s1\" by fact\n  have c': \"t \\<longrightarrow>\\<^sub>1\\<^sup>* t1\" by fact\n  have d: \"s1 \\<longrightarrow>\\<^sub>1 s2\" by fact\n  have \"t \\<longrightarrow>\\<^sub>1\\<^sup>* t1 \\<Longrightarrow> (\\<exists>t3.  t1 \\<longrightarrow>\\<^sub>1\\<^sup>* t3 \\<and> s1 \\<longrightarrow>\\<^sub>1\\<^sup>* t3)\" by fact\n  then obtain t3 where f1: \"t1 \\<longrightarrow>\\<^sub>1\\<^sup>* t3\"\n                   and f2: \"s1 \\<longrightarrow>\\<^sub>1\\<^sup>* t3\" using c' by blast\n  from cr_one d f2 have \"\\<exists>t4. t3\\<longrightarrow>\\<^sub>1t4 \\<and> s2\\<longrightarrow>\\<^sub>1\\<^sup>*t4\" by blast\n  then obtain t4 where g1: \"t3\\<longrightarrow>\\<^sub>1t4\"\n                   and g2: \"s2\\<longrightarrow>\\<^sub>1\\<^sup>*t4\" by blast\n  have \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t4\" using f1 g1 by (blast intro: one_star_trans)\n  thus ?case using g2 by blast\nqed\n  \nlemma cr_beta_star: \n  assumes a1: \"t\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t1\" \n  and     a2: \"t\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t2\" \n  shows \"\\<exists>t3. t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\\<and>t2\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\"\nproof -\n  from a1 have \"t\\<longrightarrow>\\<^sub>1\\<^sup>*t1\" by (simp only: trans_closure)\n  moreover\n  from a2 have \"t\\<longrightarrow>\\<^sub>1\\<^sup>*t2\" by (simp only: trans_closure)\n  ultimately have \"\\<exists>t3. t1\\<longrightarrow>\\<^sub>1\\<^sup>*t3 \\<and> t2\\<longrightarrow>\\<^sub>1\\<^sup>*t3\" by (blast intro: cr_one_star) \n  then obtain t3 where \"t1\\<longrightarrow>\\<^sub>1\\<^sup>*t3\" and \"t2\\<longrightarrow>\\<^sub>1\\<^sup>*t3\" by blast\n  hence \"t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\" and \"t2\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\" by (simp_all only: trans_closure)\n  then show \"\\<exists>t3. t1\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\\<and>t2\\<longrightarrow>\\<^sub>\\<beta>\\<^sup>*t3\" by blast\nqed\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Nominal/Examples/CR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632683808532, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.31968627824258494}}
{"text": "theory SafeRedUnpack\n    imports FlatLemma SRUseEnv\nbegin\n  \n    (*\nlemma sum_comp_diff_use_env2: \"comp_use_env r_s r_x = comp_use_env r_s (diff_use_env r_x r_s)\"  \n  apply (rule_tac t=\"comp_use_env r_s r_x\" and s=\"comp_use_env r_x r_s\" in subst)\n   apply (rule_tac comm_comp_use_env)\n  apply (rule_tac t=\"comp_use_env r_s (diff_use_env r_x r_s)\" and s=\"comp_use_env (diff_use_env r_x r_s) r_s\" in subst)\n   apply (rule_tac comm_comp_use_env)   \n  apply (simp add: sum_comp_diff_use_env)\n  done\n    \ndefinition anti_norm_use_env where\n  \"anti_norm_use_env r_x r_s = (\\<lambda> x. if r_s x = NoPerm then r_x x else NoPerm)\"\n    \nlemma split_norm_use_env: \"r_x = comp_use_env (norm_use_env r_x r_s) (anti_norm_use_env r_x r_s)\"  \n  apply (case_tac \"\\<forall> x. r_x x = comp_use_env (norm_use_env r_x r_s) (anti_norm_use_env r_x r_s) x\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: anti_norm_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (case_tac \"r_s x = NoPerm\")\n   apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done\n    \nlemma squish_norm_leq_use_env: \"\\<lbrakk> leq_use_env r_s1 (diff_use_env r_c r_ex); leq_use_env (diff_use_env r_x r_ex) r_s2;\n  leq_use_env r_s2 r_s1 \\<rbrakk> \\<Longrightarrow> leq_use_env (norm_use_env r_x r_s1) r_s2 \"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_ex x = OwnPerm\")\n   apply (simp)\n   apply (case_tac \"r_s1 x\")\n     apply (auto)\n    apply (case_tac \"r_c x\")\n      apply (auto)\n   apply (case_tac \"r_c x\")\n  apply (auto)\n  apply (case_tac \"neg_perm (r_ex x) \\<noteq> NoEP\")\n   apply (case_tac \"r_ex x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done\n  \nlemma mini_disj_anti_norm_use_env: \"mini_disj_use_env r_s (anti_norm_use_env r_x r_s)\"\n  apply (simp add: mini_disj_use_env_def)\n  apply (simp add: anti_norm_use_env_def)\n  done\n    \nlemma mini_disj_split_norm_use_env: \"mini_disj_use_env (norm_use_env r_x r_s) (anti_norm_use_env r_x r_s)\"    \n  apply (simp add: mini_disj_use_env_def)\n  apply (simp add: norm_use_env_def)\n  apply (simp add: anti_norm_use_env_def)\n  done\n  \n    (* this lemma is based on two ideas. first, that r_x is already present in r_s2 except for what got subtracted out.\n      and everything that got subtracted out wasn't present in r_s1 to start with, and is thus, add-able.\n      > translating this: r_x can be split into a part that is already in r_s1, and a part that is fully-disjoint.\n    *)\nlemma well_typed_comp_perms_squish: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx;\n  leq_use_env r_s1 (diff_use_env r_c r_ex); leq_use_env (diff_use_env r_x r_ex) r_s2 \\<rbrakk> \\<Longrightarrow>\n  well_typed env (comp_use_env r_s1 r_x) e tau (comp_use_env r_s2 r_x) rx\"    \n  apply (rule_tac t=\"r_x\" and s=\"comp_use_env (norm_use_env r_x r_s1) (anti_norm_use_env r_x r_s1)\" in subst)\n   apply (cut_tac r_x=\"r_x\" and r_s=\"r_s1\" in split_norm_use_env)\n   apply (auto)\n  apply (simp add: assoc_comp_use_env)\n  apply (rule_tac well_typed_comp_perms_gen)\n   apply (rule_tac ?r_s1.0=\"r_s1\" in well_typed_incr_start_perm)\n    apply (rule_tac r_c=\"r_s2\" in well_typed_decr_end_perm)\n      apply (simp)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac r_c=\"r_c\" and r_ex=\"r_ex\" in squish_norm_leq_use_env)\n       apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (rule_tac comp_leq_use_env1)\n    apply (rule_tac well_typed_perm_leqx)\n    apply (auto)\n   apply (rule_tac self_comp_leq_use_env1)\n  apply (rule_tac mini_disj_comp_use_env)\n   apply (rule_tac mini_disj_anti_norm_use_env)\n  apply (rule_tac mini_disj_split_norm_use_env)\n  done\n    \nlemma reverse_disj_use_env1: \"\\<lbrakk> disj_use_env (diff_use_env r_x r_ex) r_s; leq_use_env r_s (diff_use_env r_c r_ex) \\<rbrakk> \\<Longrightarrow> disj_use_env r_x r_s\"    \n  apply (simp add: disj_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (erule_tac x=\"x\" in allE)\n   apply (erule_tac x=\"x\" in allE)\n   apply (auto)\n    apply (case_tac \"neg_perm (r_ex x) \\<noteq> NoEP\")\n     apply (auto)\n    apply (case_tac \"r_ex x\")\n      apply (auto)\n    apply (case_tac \"minus_ep (r_c x) OwnEP \\<noteq> NoPerm\")\n     apply (case_tac \"r_c x\")\n       apply (auto)\n    apply (case_tac \"r_s x\")\n      apply (auto)\n   apply (case_tac \"neg_perm (r_ex x) \\<noteq> OwnEP\")\n    apply (auto)\n    apply (case_tac \"r_ex x\")\n      apply (auto)\n   apply (case_tac \"minus_ep (r_c x) OwnEP \\<noteq> NoPerm\")\n    apply (case_tac \"r_c x\")\n      apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (case_tac \"neg_perm (r_ex x) = OwnEP\")\n   apply (case_tac \"r_c x\")\n     apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n  apply (auto)\n  done\n    \nlemma reverse_disj_use_env2: \"\\<lbrakk> disj_use_env r_s (diff_use_env r_x r_ex); leq_use_env r_s (diff_use_env r_c r_ex) \\<rbrakk> \\<Longrightarrow> disj_use_env r_s r_x\"       \n  apply (rule_tac comm_disj_use_env)\n  apply (rule_tac reverse_disj_use_env1)\n   apply (auto)\n  apply (rule_tac comm_disj_use_env)\n  apply (simp)\n  done\n  \nlemma self_pair_req_leq_use_env: \"leq_use_env (pair_req r_s r_ex t) (diff_use_env r_s r_ex)\"    \n  apply (simp add: pair_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac id_leq_use_env)\n  done\n\nlemma pair_req_leq_use_env: \"\\<lbrakk> leq_use_env (diff_use_env r_x r_ex) r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (pair_req r_x r_ex t) r_s\"    \n  apply (rule_tac r_sb=\"diff_use_env r_x r_ex\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac self_pair_req_leq_use_env)\n  done\n    \n    \ndefinition unpack_abbrev where\n  \"unpack_abbrev f = (AppExp (ConstExp UnpackConst) f)\"\n    \ndefinition pair_abbrev where\n  \"pair_abbrev v1 v2 = (PairExp v1 v2)\"  \n  \ndefinition upc_abbrev where\n  \"upc_abbrev f v1 v2 = (AppExp (unpack_abbrev f) (pair_abbrev v1 v2))\"  \n\ndefinition ures_arg1_abbrev where\n  \"ures_arg1_abbrev f v = (AppExp f v)\"  \n  \ndefinition ures_abbrev where\n  \"ures_abbrev f v1 v2 = (AppExp (ures_arg1_abbrev f v1) v2)\"  \n  \n    \nlemma unpack_lam_type: \"\\<lbrakk> well_typed env r_s1 (unpack_abbrev f) (FunTy tau tx r a) r_s2 rx; is_value f \\<rbrakk> \\<Longrightarrow>\n  (\\<exists> t1 t2 a1 a2. tau = PairTy t1 t2 r \\<and> well_typed env r_s1 f (FunTy t1 (FunTy t2 tx r a2) r a1) r_s1 (comp_use_env rx (infl_use_env r_s1 r_s2)))\" \n  apply (simp add: unpack_abbrev_def)\n  apply (auto)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (simp)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (simp add: app_req_def)\n  apply (simp add: pure_fun_def)\n  apply (auto)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac rx=\"comp_use_env rx2 (infl_use_env r_s1 r_s3)\" in well_typed_incr_req)\n    apply (rule_tac infl_full_sexp_wp)\n      apply (rule_tac ?r_s1.0=\"r_s2a\" in well_typed_incr_start_perm)\n       apply (auto)\n    apply (rule_tac value_is_sexp)\n    apply (auto)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac st_diff_comp_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env_cut)\n     apply (rule_tac self_comp_leq_use_env2)\n    apply (rule_tac infl_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (auto)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n   apply (rule_tac comp_leq_use_env2)\n   apply (rule_tac dist_infl_leq_use_env)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (simp)\n  apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (auto)\n  apply (rule_tac self_infl_leq_use_env)\n  done\n\nlemma unpack_pair_type: \"\\<lbrakk> well_typed env r_s1 (pair_abbrev v1 v2) (PairTy t1 t2 r) r_s2 rx; is_value v1; is_value v2 \\<rbrakk> \\<Longrightarrow>\n   well_typed env r_s1 (pair_abbrev v1 v2) (PairTy t1 t2 r) r_s1 (comp_use_env rx (infl_use_env r_s1 r_s2))\"\n  apply (rule_tac infl_full_sexp_wp)\n    apply (auto)\n   apply (simp add: pair_abbrev_def)(*\n  apply (simp add: pair_abbrev_def)\n  apply (case_tac r)\n    apply (auto)\n  apply (simp add: unlim_def)\n  apply (case_tac \"req_type t1\")\n    apply (auto)\n   apply (case_tac \"req_type t2\")\n     apply (auto)\n  apply (case_tac \"req_type t2\")\n    apply (auto)*)\n  done\n    \nlemma unpack_split_pair_type: \"\\<lbrakk> well_typed env r_s1 (pair_abbrev v1 v2) (PairTy t1 t2 r) r_s1 rx; is_value v1; is_value v2 \\<rbrakk> \\<Longrightarrow>\n  (\\<exists> rx1 rx2. well_typed env r_s1 v1 t1 r_s1 rx1 \\<and> well_typed env r_s1 v2 t2 r_s1 rx2 \\<and>\n    leq_use_env (lift_use_env rx1 r) r_s1 \\<and> leq_use_env (lift_use_env rx2 r) r_s1 \\<and>\n    (*safe_use_lift rx1 r \\<and> safe_use_lift rx2 r \\<and> safe_type t1 r \\<and> safe_type t2 r \\<and>*)\n    disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r) \\<and>\n    leq_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) rx)\"    \n  apply (simp add: pair_abbrev_def)\n  apply (auto)\n  apply (rule_tac x=\"pair_req rx1 empty_use_env (PairTy t1 t2 r)\" in exI)\n  apply (auto)\n   apply (rule_tac r_c=\"r_s2\" in well_typed_decr_end_perm)\n     apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n      apply (simp add: pair_req_def)\n      apply (rule_tac rx=\"rx1\" in wt_sexp_no_req)\n        apply (auto)\n       apply (case_tac r)\n         apply (auto)\n       apply (case_tac \"req_type t1\")\n         apply (auto)\n       apply (case_tac \"req_type t2\")\n         apply (auto)\n      apply (rule_tac value_is_sexp)\n      apply (auto)\n     apply (simp add: pair_req_def)\n     apply (simp add: diff_empty_use_env2)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n   apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac pair_req_leq_use_env)\n   apply (rule_tac diff_leq_use_env)\n   apply (rule_tac well_typed_perm_leqx)\n   apply (auto)\n  apply (rule_tac x=\"pair_req rx2 empty_use_env (PairTy t1 t2 r)\" in exI)\n  apply (auto)\n        apply (rule_tac r_c=\"r_s3\" in well_typed_decr_end_perm)\n          apply (rule_tac ?r_s1.0=\"r_s2\" in well_typed_incr_start_perm)\n           apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n            apply (simp add: pair_req_def)\n            apply (rule_tac rx=\"rx2\" in wt_sexp_no_req)\n              apply (auto)\n             apply (case_tac \"r\")\n              apply (auto)\n             apply (case_tac \"req_type t2\")\n               apply (auto)\n              apply (case_tac \"req_type t1\")\n                apply (auto)\n             apply (case_tac \"req_type t1\")\n               apply (auto)\n            apply (rule_tac value_is_sexp)\n            apply (auto)\n           apply (simp add: pair_req_def)\n           apply (simp add: diff_empty_use_env2)\n          apply (rule_tac well_typed_perm_leq)\n          apply (auto)\n         apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n          apply (rule_tac self_diff_leq_use_env)\n         apply (simp)\n        apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n         apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n          apply (rule_tac well_typed_perm_leq)\n          apply (auto)\n         apply (rule_tac well_typed_perm_leq)\n         apply (auto)\n        apply (rule_tac pair_req_leq_use_env)\n        apply (rule_tac r_sb=\"lift_use_env rx2 r\" in trans_leq_use_env)\n         apply (simp)\n        apply (rule_tac diff_leq_use_env)\n        apply (rule_tac self_lift_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n       apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n       apply (rule_tac r_sb=\"lift_use_env rx1 r\" in trans_leq_use_env)\n        apply (simp)\n       apply (rule_tac dist_lift_leq_use_env)\n       apply (rule_tac pair_req_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n      apply (rule_tac r_sb=\"lift_use_env rx2 r\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_lift_leq_use_env)\n      apply (rule_tac pair_req_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n   apply (rule_tac r_s=\"lift_use_env rx1 r\" in disj_leq_use_env1)\n    apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n     apply (simp)\n    apply (rule_tac dist_lift_leq_use_env)\n    apply (rule_tac pair_req_leq_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (rule_tac dist_lift_leq_use_env)\n   apply (rule_tac pair_req_leq_use_env)\n   apply (rule_tac self_diff_leq_use_env)\n  apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n   apply (simp add: pair_req_def)\n   apply (auto)\n   apply (simp add: lift_empty_use_env)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: pair_req_def)\n  apply (simp add: diff_empty_use_env2)\n  apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac mini_disj_diff_leq_use_env)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac r_s=\"diff_use_env r_s3 r_ex\" in mini_disj_leq_use_env2)\n   apply (rule_tac mini_disj_diff_use_env)\n  apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n   apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (simp_all)\n  done\n    \n    \nlemma unpack_app1_type: \"\\<lbrakk> well_typed env r_s1 f (FunTy t1 (FunTy t2 tau r a2) r a1) r_s1 (comp_use_env rx1 (infl_use_env r_s1 r_s2));\n  well_typed env r_s1 v1 t1 r_s1 rx2a; leq_use_env r_s2 r_s1; leq_use_env rx1 r_s2; leq_use_env (lift_use_env rx2a r) r_s2;\n  disj_use_env rx1 (lift_use_env rx2a r)(*; safe_use_lift rx2a r; safe_type t1 r*) \\<rbrakk> \\<Longrightarrow>\n  well_typed env r_s1 (ures_arg1_abbrev f v1) (FunTy t2 tau r a2)\n  (diff_use_env r_s2 (comp_use_env rx1 (lift_use_env rx2a r)))\n  (diff_use_env (comp_use_env rx1 rx2a) (comp_use_env rx1 (lift_use_env rx2a r)))\"    \n  apply (simp add: ures_arg1_abbrev_def)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a1\" in exI)\n  apply (rule_tac x=\"r_s1\" in exI)\n  apply (rule_tac x=\"comp_use_env rx1 (infl_use_env r_s1 r_s2)\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2a\" in exI)\n  apply (rule_tac x=\"r_s1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n       apply (rule_tac rhs_unroll_dcl_use_env)\n       apply (rule_tac disj_diff_leq_use_env)\n        apply (rule_tac disj_empty_use_env2)\n       apply (rule_tac unroll_dcl_use_env)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (rule_tac rhs_flip_use_env)\n       apply (rule_tac rhs_unroll_dcl_use_env)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (rule_tac disj_diff_leq_use_env)\n        apply (rule_tac comm_disj_use_env)\n        apply (rule_tac infl_disj_use_env)\n        apply (rule_tac id_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac well_typed_perm_leqx)\n       apply (auto)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (simp_all)\n     apply (rule_tac disj_comp_use_env1)\n      apply (simp)\n     apply (rule_tac comm_disj_use_env)\n     apply (rule_tac infl_disj_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (simp)\n    apply (rule_tac r_sb=\"lift_use_env rx2a r\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac self_lift_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: app_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac unroll_dcl_use_env)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac lhs_flip_use_env)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac dist_diff_leq_use_env)  \n  apply (rule_tac lhs_dist_dcl_use_env)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (rule_tac lhs_dist_dcl_use_env)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac comp_leq_use_env1)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (rule_tac diff_infl_leq_use_env)\n  apply (rule_tac comp_leq_use_env2)\n  apply (rule_tac self_diff_leq_use_env)\n  done\n       \n    \nlemma well_typed_simul_diff_perms: \"\\<lbrakk> well_typed env r_s e tau r_s rx; is_sexp e; disj_use_env rx r_x \\<rbrakk> \\<Longrightarrow>\n  well_typed env (diff_use_env r_s r_x) e tau (diff_use_env r_s r_x) (diff_use_env rx r_x)\"    \n  apply (rule_tac well_typed_diff_perms)\n   apply (simp)\n  apply (auto)\n  apply (case_tac \"r_s x = NoPerm\")\n   apply (cut_tac ?r_s1.0=\"r_s\" and env=\"env\" and e=\"e\" and x=\"x\" in well_typed_no_npv_use)\n     apply (auto)\n  apply (cut_tac rx=\"rx\" and x=\"x\" and ?r_s2.0=\"r_s\" and env=\"env\" and e=\"e\" in wt_sexp_req_use)\n      apply (auto)\n  apply (simp add: disj_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  apply (simp add: own_env_vars_def)\n  done\n  \nlemma unpack_app2_type: \"\\<lbrakk> well_typed env r_s1 (ures_arg1_abbrev f v1) (FunTy t2 tau ra a2) (diff_use_env r_s2a (comp_use_env rx1 (lift_use_env rx1a ra)))\n         (diff_use_env (comp_use_env rx1 rx1a) (comp_use_env rx1 (lift_use_env rx1a ra))); well_typed env r_s2a v2 t2 r_s2a rx2a;\n        leq_use_env (lift_use_env rx1a ra) r_s2a; leq_use_env (lift_use_env rx2a ra) r_s2a; leq_use_env r_s3 r_s2a; leq_use_env r_s2a r_s1;\n        (*safe_use_lift rx1a ra; safe_use_lift rx2a ra; safe_type t1a ra; safe_type t2 ra;*)\n        disj_use_env (lift_use_env rx1a ra) (lift_use_env rx2a ra); leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3;\n        disj_use_env rx1 (lift_use_env rx2 r); leq_use_env (comp_use_env (lift_use_env rx1a ra) (lift_use_env rx2a ra)) rx2; is_value v1; is_value v2\n   \\<rbrakk> \\<Longrightarrow>\n  well_typed env r_s1 (ures_abbrev f v1 v2) tau (diff_use_env r_s3 (comp_use_env rx1 (lift_use_env rx2 r)))\n  (diff_use_env (comp_use_env rx1 rx2) (comp_use_env rx1 (lift_use_env rx2 r)))\"\n    (* main disjointness result *)\n  apply (cut_tac r_ex=\"lift_use_env rx2a ra\" and ?r_s1.0=\"rx1\" and ?r_s2.0=\"lift_use_env rx1a ra\" in disj_comp_use_env2)\n    apply (rule_tac comm_disj_use_env)\n    apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n     apply (auto)\n    apply (rule_tac r_sb=\"comp_use_env (lift_use_env rx1a ra) (lift_use_env rx2a ra)\" in trans_leq_use_env)\n     apply (rule_tac lift_leq_use_env)\n     apply (simp)\n    apply (rule_tac self_comp_leq_use_env2)\n   apply (rule_tac comm_disj_use_env)\n   apply (simp)\n    (* other *)\n  apply (simp add: ures_abbrev_def)\n  apply (rule_tac x=\"t2\" in exI)\n  apply (rule_tac x=\"ra\" in exI)\n  apply (rule_tac x=\"a2\" in exI)\n  apply (rule_tac x=\"diff_use_env r_s2a (comp_use_env rx1 (lift_use_env rx1a ra))\" in exI)\n  apply (rule_tac x=\"diff_use_env (comp_use_env rx1 rx1a) (comp_use_env rx1 (lift_use_env rx1a ra))\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2a\" in exI)\n  apply (rule_tac x=\"diff_use_env r_s2a (comp_use_env rx1 (lift_use_env rx1a ra))\" in exI)\n  apply (auto)\n   apply (rule_tac rx=\"diff_use_env rx2a (comp_use_env rx1 (lift_use_env rx1a ra))\" in well_typed_incr_req)\n     apply (rule_tac well_typed_simul_diff_perms)\n       apply (simp)\n      apply (rule_tac value_is_sexp)\n      apply (auto)\n     apply (rule_tac r_s=\"lift_use_env rx2a ra\" in disj_leq_use_env1)\n      apply (simp)\n     apply (rule_tac self_lift_leq_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (rule_tac disj_diff_leq_use_env)\n    apply (rule_tac comm_disj_use_env)\n    apply (rule_tac r_s=\"lift_use_env rx2a ra\" in disj_leq_use_env1)\n     apply (simp)\n    apply (rule_tac self_lift_leq_use_env)\n   apply (rule_tac well_typed_perm_leqx)\n   apply (auto)\n    (* existentials *)\n  apply (rule_tac x=\"comp_use_env rx1 (lift_use_env rx2 r)\" in exI)\n  apply (auto)\n       apply (rule_tac rhs_unroll_dcl_use_env)\n       apply (rule_tac rhs_diff_leq_use_env)\n       apply (rule_tac rhs_fold_dcl_use_env)\n       apply (rule_tac dist_diff_leq_use_env_gen)\n        apply (simp)\n       apply (rule_tac r_sb=\"comp_use_env rx1 (comp_use_env (lift_use_env rx1a ra) (lift_use_env rx2a ra))\" in trans_leq_use_env)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (rule_tac self_comp_leq_use_env1)\n        apply (rule_tac comp_leq_use_env2)\n        apply (rule_tac lift_leq_use_env)\n        apply (simp)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (rule_tac self_comp_leq_use_env1)\n        apply (rule_tac comp_leq_use_env2)\n        apply (rule_tac self_comp_leq_use_env1)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac diff_leq_use_env)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (rule_tac self_comp_leq_use_env1)\n        apply (rule_tac comp_leq_use_env2)\n        apply (rule_tac comp_leq_use_env1)\n        apply (rule_tac self_lift_leq_use_env)\n       apply (rule_tac comp_leq_use_env2)\n       apply (rule_tac self_comp_leq_use_env2)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n         apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n          apply (auto)\n        apply (rule_tac self_comp_leq_use_env1)\n       apply (rule_tac r_sb=\"lift_use_env rx1a ra\" in trans_leq_use_env)\n        apply (simp)\n       apply (rule_tac self_lift_leq_use_env)\n      apply (rule_tac disj_diff_leq_use_env)\n       apply (rule_tac comm_disj_use_env)\n       apply (auto)\n     apply (rule_tac r_s=\"comp_use_env rx1 (lift_use_env rx1a ra)\" in disj_leq_use_env1)\n      apply (rule_tac comm_disj_use_env)\n      apply (simp)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env1)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac self_lift_leq_use_env)\n    apply (rule_tac dist_diff_leq_use_env)\n    apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac self_comp_leq_use_env1)\n    apply (rule_tac comp_leq_use_env2)\n    apply (rule_tac self_lift_leq_use_env)\n   apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n    apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n     apply (auto)\n  apply (simp add: app_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac r_sb=\"comp_use_env rx1 (comp_use_env (lift_use_env rx1a ra) (lift_use_env rx2a ra))\" in trans_leq_use_env)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac self_comp_leq_use_env1)\n   apply (rule_tac comp_leq_use_env2)\n   apply (simp)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (rule_tac diff_leq_use_env)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac self_comp_leq_use_env1)\n   apply (rule_tac comp_leq_use_env2)\n   apply (rule_tac comp_leq_use_env1)\n   apply (rule_tac self_lift_leq_use_env)\n  apply (rule_tac comp_leq_use_env2)\n  apply (rule_tac comp_leq_use_env2)\n  apply (rule_tac self_lift_leq_use_env)\n  done\n    \n  \n(*    \n   \n  apply (rule_tac x=\"t2\" in exI)\n  apply (rule_tac x=\"ra\" in exI)\n  apply (rule_tac x=\"a2\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"comp_use_env rx1 (infl_use_env r_s1 r_s2a)\" in exI)\n  apply (auto)\n   apply (rule_tac x=\"t1a\" in exI)\n   apply (rule_tac x=\"ra\" in exI)\n   apply (rule_tac x=\"a1\" in exI)\n   apply (rule_tac x=\"r_s1\" in exI)\n   apply (rule_tac x=\"comp_use_env rx1 (infl_use_env r_s1 r_s2a)\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"rx1a\" in exI)\n   apply (rule_tac x=\"r_s1\" in exI)\n   apply (auto)\n    apply (rule_tac r_s=\"r_s2a\" in well_typed_incr_simul_perm)\n     apply (auto)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto) \n *)\n    \n    \nlemma unpack_comb: \"\\<lbrakk> is_value f; is_value v1; is_value v2;\n        leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)); (*safe_use_lift rx2 r; safe_type (PairTy t1a t2 r) r;*)\n        leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n        leq_use_env (app_req rx1 rx2 r tau r_ex) rx; leq_use_env r_s2a r_s1; leq_use_env rx1 r_s2a; leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3;\n        well_typed env r_s1 f (FunTy t1a (FunTy t2 tau r a2) r a1) r_s1 (comp_use_env rx1 (infl_use_env r_s1 r_s2a));\n        well_typed env r_s2a (pair_abbrev v1 v2) (PairTy t1a t2 r) r_s2a (comp_use_env rx2 (infl_use_env r_s2a r_s3));\n        leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; leq_use_env r_s3 r_s2a \\<rbrakk>\n       \\<Longrightarrow> well_typed env r_s1 (ures_abbrev f v1 v2) tau (diff_use_env r_s2a (comp_use_env rx1 (lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r)))\n         (diff_use_env (comp_use_env rx1 (comp_use_env rx2 (infl_use_env r_s2a r_s3)))\n           (comp_use_env rx1 (lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r)))\"\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and ?v1.0=\"v1\" and ?v2.0=\"v2\" in unpack_split_pair_type)\n   apply (auto)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and f=\"f\" and ?t1.0=\"t1a\" and ?t2.0=\"t2\" and tau=\"tau\" and r=\"r\" and\n      ?rx1.0=\"rx1\" and ?r_s2.0=\"r_s2a\" and ?v1.0=\"v1\" and rx2a=\"rx1a\" in unpack_app1_type)\n          apply (auto)\n    apply (rule_tac r_s=\"r_s2a\" in well_typed_incr_simul_perm)\n     apply (auto)\n   apply (rule_tac r_s=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in disj_leq_use_env2)\n    apply (rule_tac disj_comp_use_env2)\n     apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n      apply (simp)\n     apply (rule_tac self_lift_leq_use_env)\n    apply (rule_tac infl_disj_use_env)\n    apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2  r)\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac self_comp_leq_use_env1)\n   apply (rule_tac r_sb=\"comp_use_env (lift_use_env rx1a r) (lift_use_env rx2a r)\" in trans_leq_use_env)\n    apply (simp)\n   apply (rule_tac self_comp_leq_use_env1)\n  apply (case_tac \"\\<not> leq_perm r r\")\n   apply (case_tac r)\n     apply (auto)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and r_s2a=\"r_s2a\" and ?r_s3.0=\"r_s2a\" and f=\"f\" and ?v1.0=\"v1\" and ?v2.0=\"v2\" and\n      ?rx1.0=\"rx1\" and rx1a=\"rx1a\" and rx2a=\"rx2a\" and r=\"r\" and ra=\"r\" and ?rx2.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\"\n      and ?t2.0=\"t2\" in unpack_app2_type)\n                  apply (auto)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (auto)\n     apply (rule_tac self_comp_leq_use_env1)\n    apply (simp add: lift_comp_use_env)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (auto)\n     apply (rule_tac self_comp_leq_use_env2)\n    apply (simp add: infl_lift_use_env)\n    apply (rule_tac self_infl_leq_use_env)\n   apply (simp add: lift_comp_use_env)\n   apply (rule_tac disj_comp_use_env2)\n    apply (simp)\n   apply (simp add: infl_lift_use_env)\n   apply (rule_tac infl_disj_use_env)\n   apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n    apply (simp)\n   apply (rule_tac self_comp_leq_use_env1)\n  done\n    \nlemma refl_infl_leq_use_env: \"leq_use_env (refl_use_env r_s r_x r) (infl_use_env r_s r_x)\"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: refl_use_env_def)\n  apply (simp add: infl_use_env_def)\n  done\n    \n    (*\n\\<exists>g_ax. (\\<exists>t1 r a r_s2a rx1.\n                      (\\<exists>t1a ra aa r_s2 rx1a.\n                          well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) v1 (FunTy t1a (FunTy t1 tau r a) ra aa) r_s2 rx1a \\<and>\n                          (\\<exists>rx2 r_s3.\n                              well_typed (red_env env g_ax) r_s2 v1 t1a r_s3 rx2 \\<and>\n                              (\\<exists>r_ex. leq_use_env r_s2a (diff_use_env r_s3 (comp_use_env (comp_use_env rx1a (lift_use_env rx2 ra)) r_ex)) \\<and>\n                                      safe_use_lift rx2 ra \\<and>\n                                      safe_type t1a ra \\<and>\n                                      leq_use_env (comp_use_env rx1a (lift_use_env rx2 ra)) r_s3 \\<and>\n                                      disj_use_env rx1a (lift_use_env rx2 ra) \\<and>\n                                      leq_use_env rx1 r_s2a \\<and>\n                                      leq_use_env r_ex (exp_red_use_env r_s1 g_ax) \\<and> leq_use_env (app_req rx1a rx2 ra (FunTy t1 tau r a) r_ex) rx1))) \\<and>\n                      (\\<exists>rx2 r_s3.\n                          well_typed (red_env env g_ax) r_s2a v2a t1 r_s3 rx2 \\<and>\n                          (\\<exists>r_ex. leq_use_env (end_red_use_env r_s2 g_ax) (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) \\<and>\n                                  safe_use_lift rx2 r \\<and>\n                                  safe_type t1 r \\<and>\n                                  leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3 \\<and>\n                                  disj_use_env rx1 (lift_use_env rx2 r) \\<and>\n                                  leq_use_env (end_red_use_env rx g_ax) (end_red_use_env r_s2 g_ax) \\<and>\n                                  leq_use_env r_ex (exp_red_use_env r_s1 g_ax) \\<and> leq_use_env (app_req rx1 rx2 r tau r_ex) (end_red_use_env rx g_ax)))) \\<and>\n                  well_typed_state s1 (red_env env g_ax) (red_nres_map rs_map g_ax) \\<and>\n                  valid_exp_use_env s1 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\<and> safe_act s1 r_f g_ax \\<and> corr_act NoAct g_ax\n\n*)\n    \nlemma sares_unpack_abbrev: \"\\<lbrakk>well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; leq_use_env r_s1 r_f;\n        proper_exp rs_map (AppExp (AppExp (ConstExp UnpackConst) f) (PairExp v1 v2));\n        well_typed env r_s1 (upc_abbrev f v1 v2) tau r_s2 rx; is_value f; is_value v1; is_value v2 \\<rbrakk>\n       \\<Longrightarrow> \\<exists>g_ax. (\\<exists>t1 r a r_s2a rx1.\n                      (\\<exists>t1a ra aa r_s2 rx1a.\n                          well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) f (FunTy t1a (FunTy t1 tau r a) ra aa) r_s2 rx1a \\<and>\n                          (\\<exists>rx2 r_s3.\n                              well_typed (red_env env g_ax) r_s2 v1 t1a r_s3 rx2 \\<and>\n                              (\\<exists>r_ex. leq_use_env r_s2a (diff_use_env r_s3 (comp_use_env (comp_use_env rx1a (lift_use_env rx2 ra)) r_ex)) \\<and>\n                                      (*safe_use_lift rx2 ra \\<and>\n                                      safe_type t1a ra \\<and>*)\n                                      leq_use_env (comp_use_env rx1a (lift_use_env rx2 ra)) r_s3 \\<and>\n                                      disj_use_env rx1a (lift_use_env rx2 ra) \\<and>\n                                      leq_use_env rx1 r_s2a \\<and>\n                                      leq_use_env r_ex (exp_red_use_env r_s1 g_ax) \\<and> leq_use_env (app_req rx1a rx2 ra (FunTy t1 tau r a) r_ex) rx1))) \\<and>\n                      (\\<exists>rx2 r_s3.\n                          well_typed (red_env env g_ax) r_s2a v2 t1 r_s3 rx2 \\<and>\n                          (\\<exists>r_ex. leq_use_env (end_red_use_env r_s2 g_ax) (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) \\<and>\n                                  (*safe_use_lift rx2 r \\<and>\n                                  safe_type t1 r \\<and>*)\n                                  leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3 \\<and>\n                                  disj_use_env rx1 (lift_use_env rx2 r) \\<and>\n                                  leq_use_env (end_red_use_env rx g_ax) (end_red_use_env r_s2 g_ax) \\<and>\n                                  leq_use_env r_ex (exp_red_use_env r_s1 g_ax) \\<and> leq_use_env (app_req rx1 rx2 r tau r_ex) (end_red_use_env rx g_ax)))) \\<and>\n                  proper_exp (red_nres_map rs_map g_ax) (AppExp (AppExp f v1) v2) \\<and>\n                  well_typed_state s1 (red_env env g_ax) (red_nres_map rs_map g_ax) \\<and>\n                  valid_exp_use_env s1 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\<and> safe_act s1 (infl_use_env r_f r_s2) g_ax \\<and> corr_act NoAct g_ax\"\n  apply (rule_tac x=\"NoResAct\" in exI)\n  apply (auto)\n  apply (simp add: upc_abbrev_def)\n  apply (auto)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and tau=\"t1\" and tx=\"tau\" and f=\"f\" in unpack_lam_type)\n    apply (auto)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and ?v1.0=\"v1\" and ?v2.0=\"v2\" and ?r_s2.0=\"r_s3\" in unpack_pair_type)\n     apply (auto)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and r_s2a=\"r_s2a\" and ?r_s3.0=\"r_s3\" and ?rx1.0=\"rx1\" and ?rx2.0=\"rx2\" \n      and f=\"f\" and ?v1.0=\"v1\" and ?v2.0=\"v2\" and t1a=\"t1a\" and ?t2.0=\"t2\" and r=\"r\" in unpack_comb)\n                    apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (rule_tac well_typed_perm_leqx)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (simp add: ures_abbrev_def)\n  apply (auto)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"ra\" in exI)\n  apply (rule_tac x=\"aa\" in exI)\n  apply (rule_tac x=\"r_s2aa\" in exI)\n  apply (rule_tac x=\"rx1a\" in exI)\n  apply (auto)\n   apply (simp add: ures_arg1_abbrev_def)\n  apply (rule_tac x=\"rx2a\" in exI)\n  apply (rule_tac x=\"r_s3a\" in exI)\n  apply (auto)\n  apply (case_tac \"\\<not> leq_perm r r\")\n   apply (case_tac r)\n     apply (auto)\n  apply (rule_tac x=\"comp_use_env r_exa (comp_use_env (infl_use_env r_s2a r_s3) r_ex)\" in exI)\n  apply (auto)\n    apply (rule_tac r_sb=\"diff_use_env r_s2a (comp_use_env (comp_use_env rx1 (lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r)) (comp_use_env (infl_use_env r_s2a r_s3) r_ex))\" in trans_leq_use_env)\n     apply (rule_tac unroll_dcl_use_env)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (rule_tac rhs_fold_dcl_use_env)\n     apply (simp)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n     apply (rule_tac unroll_dcl_use_env)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (rule_tac disj_diff_leq_use_env)\n      apply (rule_tac comm_disj_use_env)\n      apply (rule_tac infl_disj_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (simp add: lift_comp_use_env)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (simp add: infl_lift_use_env)\n     apply (rule_tac disj_diff_leq_use_env)\n      apply (rule_tac comm_disj_use_env)\n      apply (rule_tac infl_disj_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (rule_tac rhs_fold_dcl_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (auto)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (auto)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n   apply (rule_tac self_infl_leq_use_env)\n  apply (simp add: app_req_def)\n  apply (auto)\n  apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n   apply (simp)\n   apply (rule_tac r_sb=\"diff_use_env (diff_use_env (comp_use_env rx1 (comp_use_env rx2 (infl_use_env r_s2a r_s3)))\n           (comp_use_env rx1 (lift_use_env (comp_use_env rx2 (infl_use_env r_s2a r_s3)) r))) (comp_use_env (infl_use_env r_s2a r_s3) r_ex)\" in trans_leq_use_env)\n   apply (rule_tac unroll_dcl_use_env)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (rule_tac lhs_fold_dcl_use_env)\n   apply (rule_tac lhs_flip_use_env)\n   apply (rule_tac lhs_unroll_dcl_use_env)\n   apply (rule_tac dist_diff_leq_use_env_gen)\n    apply (rule_tac lhs_dist_dcl_use_env)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac self_comp_leq_use_env1)\n    apply (rule_tac lhs_dist_dcl_use_env)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac self_comp_leq_use_env2)\n     apply (rule_tac diff_infl_leq_use_env)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac self_comp_leq_use_env1)\n   apply (rule_tac comp_leq_use_env2)\n   apply (rule_tac dist_lift_leq_use_env)\n   apply (rule_tac self_comp_leq_use_env1)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac lhs_fold_dcl_use_env)\n   apply (simp)\n  apply (simp add: proper_exp_def)\n  done\n    *)\n  \ndefinition upc_init_abbrev where\n  \"upc_init_abbrev v1 v2 = AppExp (ConstExp UnpackConst) (PairExp v1 v2)\"  \n\ndefinition pair_abbrev where\n  \"pair_abbrev v1 v2 = PairExp v1 v2\"  \n  \ndefinition upc_res_abbrev where\n  \"upc_res_abbrev f v1 v2 = LamExp f (AppExp (AppExp (VarExp f NoRef) v1) v2)\"\n  \nlemma wt_sexp_drop_dep_all: \"\\<lbrakk> well_typed env r_s e tau r_s r_s; is_sexp e; safe_type_x tau r \\<rbrakk> \\<Longrightarrow>\n  well_typed env (drop_use_env_dep r_s r) e tau (drop_use_env_dep r_s r) (drop_use_env_dep r_s r)\"  \n  apply (case_tac r)\n    apply (auto)\n   apply (rule_tac wt_sexp_no_all)\n     apply (auto)\n  apply (rule_tac wt_sexp_drop_all)\n    apply (auto)\n  apply (simp add: unlim_def)\n  done  \n  \nlemma leq_safe_type: \"\\<lbrakk> aff_leq (req_type tau) r \\<rbrakk> \\<Longrightarrow> safe_type_x tau r\"    \n  apply (case_tac r)\n    apply (auto)\n   apply (case_tac \"req_type tau\")\n     apply (auto)\n  apply (simp add: unlim_def)\n  apply (case_tac \"req_type tau\")\n    apply (auto)\n  done\n    \nlemma lift_drop_leq_use_env: \"\\<lbrakk> leq_use_env (lift_use_env r_x r) r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (lift_use_env (drop_use_env_dep r_x r) r) r_s\"    \n  apply (rule_tac r_sb=\"lift_use_env r_x r\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac dist_lift_leq_use_env)\n  apply (rule_tac self_drop_dep_leq_use_env)\n  done\n  \nlemma aff_lift_use_env: \"\\<lbrakk> aff_use_env r_s (as_aff r) \\<rbrakk> \\<Longrightarrow> aff_use_env (lift_use_env r_s r) (as_aff r)\"    \n  apply (case_tac \"r\")\n    apply (auto)\n  apply (simp add: aff_use_env_def)\n  done\n  \nlemma aff_drop_dep_use_env: \"aff_use_env (drop_use_env_dep r_s r) (as_aff r)\"    \n  apply (case_tac \"r\")\n    apply (auto)\n    apply (simp add: aff_use_env_def)\n    apply (simp add: null_use_env_def)\n    apply (simp add: empty_use_env_def)\n   apply (simp add: aff_use_env_def)\n   apply (simp add: weak_use_env_def)\n   apply (simp add: drop_use_env_def)\n  apply (simp add: aff_use_env_def)\n  done    \n    \nlemma unpack_pair_type: \"\\<lbrakk> well_typed env r_s1 (upc_init_abbrev v1 v2) t2 r_s2 rx; is_value v1; is_value v2;\n  t2 = FunTy (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r')) tx r' (as_aff r); f \\<notin> free_vars v1; f \\<notin> free_vars v2 \\<rbrakk> \\<Longrightarrow>\n  (\\<exists> rx1 rx2 r_ex.\n    well_typed env rx1 v1 t1a rx1 rx1 \\<and> well_typed env rx2 v2 t2a rx2 rx2 \\<and> rx1 f = NoPerm \\<and> rx2 f = NoPerm \\<and>\n    leq_use_env r_s2 (diff_use_env r_s1 r_ex) \\<and> leq_use_env r_ex r_s1 \\<and>\n    leq_use_env (diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex) rx \\<and>\n    leq_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_s1 \\<and> disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r) \\<and>\n    aff_use_env (lift_use_env rx1 r) (as_aff r) \\<and> aff_use_env (lift_use_env rx2 r) (as_aff r)\n  )\"\n  apply (simp add: upc_init_abbrev_def)\n  apply (auto)\n    (* well-typedness of e1 *)\n  apply (rule_tac x=\"rem_use_env (drop_use_env_dep (comp_use_env rx1a (infl_use_env r_s2a r_s2aa)) r) f\" in exI)\n  apply (auto)\n   apply (rule_tac well_typed_rem_perms)\n    apply (rule_tac wt_sexp_drop_dep_all)\n      apply (rule_tac infl_sexp_wp)\n       apply (simp)\n      apply (rule_tac value_is_sexp)\n      apply (simp)\n     apply (rule_tac value_is_sexp)\n     apply (simp)\n    apply (rule_tac leq_safe_type)\n    apply (case_tac \"req_type t1a\")\n      apply (auto)\n    apply (case_tac r)\n      apply (auto)\n    apply (case_tac \"req_type t2a\")\n      apply (auto)\n   apply (simp add: non_prim_vars_def)\n    (* well-typedness of e2 *)\n  apply (rule_tac x=\"rem_use_env (drop_use_env_dep (comp_use_env rx2a (infl_use_env r_s2aa r_s3a)) r) f\" in exI)\n  apply (auto)\n        apply (rule_tac well_typed_rem_perms)\n         apply (rule_tac wt_sexp_drop_dep_all)\n           apply (rule_tac infl_sexp_wp)\n            apply (simp)\n           apply (rule_tac value_is_sexp)\n           apply (simp)\n          apply (rule_tac value_is_sexp)\n          apply (simp)\n         apply (rule_tac leq_safe_type)\n         apply (case_tac \"req_type t2a\")\n           apply (auto)\n          apply (case_tac r)\n            apply (auto)\n           apply (case_tac \"req_type t1a\")\n             apply (auto)\n          apply (case_tac \"req_type t1a\")\n            apply (auto)\n         apply (case_tac r)\n           apply (auto)\n         apply (case_tac \"req_type t1a\")\n           apply (auto)\n        apply (simp add: non_prim_vars_def)\n    (* none bounds *)\n    apply (simp add: rem_use_env_def)\n   apply (simp add: rem_use_env_def)\n    (* existential bounds *)\n  apply (cut_tac r_sc=\"r_s3a\" and r_sb=\"r_s2aa\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n     apply (simp_all)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (rule_tac x=\"comp_use_env (comp_use_env (comp_use_env (infl_use_env r_s2a r_s2aa) (infl_use_env r_s2aa r_s3a)) r_exa)\n    (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in exI)\n  apply (auto)\n        apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n         apply (rule_tac rhs_unroll_dcl_use_env)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (rule_tac r_sb=\"diff_use_env r_s3a r_exa\" in trans_leq_use_env)\n          apply (rule_tac rhs_unroll_dcl_use_env)\n          apply (rule_tac dist_diff_leq_use_env)\n          apply (simp_all)\n        apply (rule_tac disj_diff_leq_use_env)\n         apply (rule_tac comm_disj_use_env)\n         apply (rule_tac disj_comp_use_env2)\n          apply (rule_tac infl_disj_use_env)\n          apply (rule_tac well_typed_perm_leq)\n          apply (auto)\n        apply (rule_tac infl_disj_use_env)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n         apply (simp)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (rule_tac dist_comp_leq_use_env)\n          apply (rule_tac lhs_infl_leq_use_env)\n          apply (rule_tac id_leq_use_env)\n         apply (rule_tac lhs_infl_leq_use_env)\n         apply (rule_tac well_typed_perm_leq)\n         apply (auto)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n         apply (rule_tac r_sb=\"diff_use_env r_s3a r_exa\" in trans_leq_use_env)\n          apply (rule_tac diff_leq_use_env)\n          apply (simp_all)\n    (* - primitive case *)\n      apply (case_tac \"r = NoPerm\")\n       apply (simp)\n       apply (rule_tac diff_leq_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac rem_leq_use_env)\n        apply (rule_tac leq_empty_use_env)\n       apply (rule_tac rem_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n    (* - non-primitive case *)\n      apply (simp add: pair_req_def)\n      apply (simp add: app_req_def)\n      apply (case_tac \"as_aff r = Prim\")\n       apply (case_tac r)\n         apply (auto)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac lhs_unroll_dcl_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1a r) (lift_use_env rx2a r)) r_exa\" in trans_leq_use_env)\n       apply (rule_tac comp_leq_use_env2)\n       apply (simp)\n      apply (rule_tac lhs_unroll_dcl_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (rule_tac lhs_dist_dcl_use_env)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (simp add: lift_diff_use_env)\n       apply (rule_tac comp_leq_use_env1)\n       apply (rule_tac dist_lift_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1a (infl_use_env r_s2a r_s2aa)) (infl_use_env r_s2a r_s2aa)\" in trans_leq_use_env)\n        apply (rule_tac lhs_dist_dcl_use_env)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (rule_tac self_diff_leq_use_env)\n        apply (rule_tac diff_infl_leq_use_env)\n       apply (rule_tac dist_diff_leq_use_env_gen)\n        apply (rule_tac rem_leq_use_env)\n        apply (rule_tac self_drop_dep_leq_use_env)\n       apply (rule_tac self_comp_leq_use_env1)\n      apply (simp add: lift_diff_use_env)\n      apply (rule_tac comp_leq_use_env2)\n      apply (rule_tac dist_lift_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx2a (infl_use_env r_s2aa r_s3a)) (infl_use_env r_s2aa r_s3a)\" in trans_leq_use_env)\n       apply (rule_tac lhs_dist_dcl_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (rule_tac diff_infl_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env_gen)\n       apply (rule_tac rem_leq_use_env)\n       apply (rule_tac self_drop_dep_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env2)\n    (* main bound *)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (simp add: lift_rem_use_env)\n      apply (rule_tac rem_leq_use_env)\n      apply (rule_tac lift_drop_leq_use_env)\n      apply (simp add: lift_comp_use_env)\n      apply (simp add: infl_lift_use_env)\n      apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2aa\" in trans_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n       apply (rule_tac r_sb=\"r_s3a\" in trans_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n      apply (rule_tac self_infl_leq_use_env)\n     apply (simp add: lift_rem_use_env)\n     apply (rule_tac rem_leq_use_env)\n     apply (rule_tac lift_drop_leq_use_env)\n     apply (simp add: lift_comp_use_env)\n     apply (simp add: infl_lift_use_env)\n     apply (rule_tac r_sb=\"r_s2aa\" in trans_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac r_sb=\"r_s3a\" in trans_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (rule_tac self_infl_leq_use_env)\n    (* disjointness *)\n    apply (simp add: lift_rem_use_env)\n    apply (rule_tac r_s=\"lift_use_env (comp_use_env rx1a (infl_use_env r_s2a r_s2aa)) r\" in disj_leq_use_env1)\n     apply (rule_tac r_s=\"lift_use_env (comp_use_env rx2a (infl_use_env r_s2aa r_s3a)) r\" in disj_leq_use_env2)\n      apply (simp add: lift_comp_use_env)\n      apply (simp add: infl_lift_use_env)\n      apply (rule_tac disj_comp_use_env1)\n       apply (rule_tac disj_comp_use_env2)\n        apply (simp)\n       apply (rule_tac infl_disj_use_env)\n       apply (simp)\n      apply (rule_tac disj_comp_use_env2)\n       apply (rule_tac comm_disj_use_env)\n       apply (rule_tac infl_disj_use_env)\n       apply (rule_tac r_sb=\"r_s3a\" in trans_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n      apply (rule_tac comm_disj_use_env)\n      apply (rule_tac infl_disj_use_env)\n      apply (rule_tac self_infl_leq_use_env)\n     apply (rule_tac rem_leq_use_env)\n     apply (rule_tac lift_drop_leq_use_env)\n     apply (rule_tac id_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (rule_tac lift_drop_leq_use_env)\n    apply (rule_tac id_leq_use_env)\n    (* affinity reqs *)\n   apply (rule_tac aff_lift_use_env)\n   apply (rule_tac aff_rem_use_env)\n   apply (rule_tac aff_drop_dep_use_env)\n  apply (rule_tac aff_lift_use_env)\n  apply (rule_tac aff_rem_use_env)\n  apply (rule_tac aff_drop_dep_use_env)\n  done\n    (*\nlemma well_typed_add_perms2: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; x \\<notin> non_prim_vars env e \\<rbrakk> \\<Longrightarrow>\n  well_typed env (add_use_env r_s1 x r) e tau (add_use_env r_s2 x r) rx\"\n  apply (rule_tac rx=\"rem_use_env rx x\" in well_typed_incr_req)\n    apply (cut_tac r_s=\"r_s1\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n    apply (cut_tac r_s=\"r_s2\" and x=\"x\" and r=\"r\" in partial_add_rem_use_env)\n    apply (cut_tac r_s=\"rem_use_env r_s1 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n     apply (auto)\n     apply (simp add: rem_use_env_def)\n    apply (cut_tac r_s=\"rem_use_env r_s2 x\" and x=\"x\" and r=\"r\" in add_comp_use_env)\n     apply (auto)\n     apply (simp add: rem_use_env_def)\n    apply (rule_tac well_typed_comp_perms)\n     apply (rule_tac well_typed_rem_perms)\n      apply (auto)\n    apply (simp add: disj_use_env_def)\n    apply (simp add: one_use_env_def)\n    apply (simp add: rem_use_env_def)\n   apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" and tau=\"tau\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and x=\"x\" in well_typed_rem_perms)\n     apply (auto)\n  done     *)\n    \n    \nlemma aff_leq_perm: \"\\<lbrakk> aff_use_env r_s (as_aff r) \\<rbrakk> \\<Longrightarrow> leq_perm (r_s x) r\"    \n  apply (case_tac r)\n    apply (auto)\n   apply (simp add: aff_use_env_def)\n   apply (simp add: null_use_env_def)\n  apply (simp add: aff_use_env_def)\n  apply (simp add: weak_use_env_def)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n    \nlemma comp_use_no_own: \"\\<lbrakk> r_sa x \\<noteq> OwnPerm; r_sb x \\<noteq> OwnPerm \\<rbrakk> \\<Longrightarrow> comp_use_env r_sa r_sb x \\<noteq> OwnPerm\"    \n  apply (simp add: comp_use_env_def)\n  apply (case_tac \"r_sa x\")\n    apply (auto)\n   apply (case_tac \"r_sb x\")\n     apply (auto)\n  apply (case_tac \"r_sb x\")\n    apply (auto)\n  done\n    \nlemma sares_unpack_case: \"\\<lbrakk>well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; proper_exp rs_map (AppExp (ConstExp UnpackConst) (PairExp v1 v2));\n        t2 = FunTy (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r')) tx r' (as_aff r); is_value v1; is_value v2;\n        f \\<notin> free_vars v1; f \\<notin> free_vars v2; f \\<notin> ref_vars v1; f \\<notin> ref_vars v2; leq_perm r r';\n        well_typed env r_s1 (upc_init_abbrev v1 v2) t2 r_s3 rx \\<rbrakk>\n       \\<Longrightarrow> \\<exists>g_ax. (\\<exists>rxa. (\\<exists>r_end r_s' t1 ra a r_s2 rx1.\n                             (\\<exists>t1b rb. (\\<exists>aa. add_env (red_env env g_ax) f (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r')) (deref_name f NoRef) =\n                                             Some (FunTy t1b (FunTy t1 tx ra a) rb aa)) \\<and>\n                                       (\\<exists>r_s2a rx1a.\n                                           (\\<exists>r_ex tau_x.\n                                               add_env (red_env env g_ax) f (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r')) f = Some tau_x \\<and>\n                                               leq_use_env (ereq_use_env f tau_x) (add_use_env rxa f r') \\<and>\n                                               leq_use_env r_s2a (diff_use_env (add_use_env rxa f r') (comp_use_env (ereq_use_env f tau_x) r_ex)) \\<and>\n                                               leq_use_env rx1a r_s2a \\<and>\n                                               leq_use_env r_ex (add_use_env rxa f r') \\<and>\n                                               leq_use_env (diff_use_env (ereq_use_env f tau_x) (comp_use_env (ereq_use_env f tau_x) r_ex)) rx1a) \\<and>\n                                           (\\<exists>rx2 r_s3.\n                                               well_typed (add_env (red_env env g_ax) f (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r'))) r_s2a v1 t1b\n                                                r_s3 rx2 \\<and>\n                                               (\\<exists>r_ex. leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1a (lift_use_env rx2 rb)) r_ex)) \\<and>\n                                                       leq_use_env (comp_use_env rx1a (lift_use_env rx2 rb)) r_s3 \\<and>\n                                                       disj_use_env rx1a (lift_use_env rx2 rb) \\<and>\n                                                       leq_use_env rx1 r_s2 \\<and>\n                                                       leq_use_env r_ex (add_use_env rxa f r') \\<and>\n                                                       leq_use_env (app_req rx1a rx2 rb (FunTy t1 tx ra a) r_ex) rx1)))) \\<and>\n                             (\\<exists>rx2 r_s3.\n                                 well_typed (add_env (red_env env g_ax) f (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r'))) r_s2 v2 t1 r_s3 rx2 \\<and>\n                                 (\\<exists>r_ex. leq_use_env r_s' (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_ex)) \\<and>\n                                         leq_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_s3 \\<and>\n                                         disj_use_env rx1 (lift_use_env rx2 ra) \\<and>\n                                         leq_use_env r_end r_s' \\<and>\n                                         leq_use_env r_ex (add_use_env rxa f r') \\<and> leq_use_env (app_req rx1 rx2 ra tx r_ex) r_end))) \\<and>\n                         aff_use_env rxa (as_aff r) \\<and>\n                         leq_use_env rxa (exp_red_use_env r_s1 g_ax) \\<and>\n                         (\\<exists>r_ex. leq_use_env (end_red_use_env r_s3 g_ax) (diff_use_env (exp_red_use_env r_s1 g_ax) r_ex) \\<and>\n                                 leq_use_env (end_red_use_env rx g_ax) (end_red_use_env r_s3 g_ax) \\<and>\n                                 leq_use_env r_ex (exp_red_use_env r_s1 g_ax) \\<and> leq_use_env (diff_use_env rxa r_ex) (end_red_use_env rx g_ax))) \\<and>\n                  proper_exp (red_nres_map rs_map g_ax) (LamExp f (AppExp (AppExp (VarExp f NoRef) v1) v2)) \\<and>\n                  well_typed_state s1 (red_env env g_ax) (red_nres_map rs_map g_ax) \\<and>\n                  valid_exp_use_env s1 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\<and> safe_act s1 (infl_use_env r_f r_s3) g_ax \\<and> corr_act NoAct g_ax\"  \n  apply (rule_tac x=\"NoResAct\" in exI)\n  apply (auto)\n    (* prelim: prepare the type of the pairs *)\n   apply (cut_tac env=\"env\" and ?v1.0=\"v1\" and ?v2.0=\"v2\" in unpack_pair_type)\n       apply (auto)\n    (* permissions given to f v1 v2 derived from the permissions of the pair *)\n   apply (rule_tac x=\"comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)\" in exI)\n   apply (auto)\n     apply (rule_tac x=\"diff_use_env (comp_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) (one_use_env f r'))\n      (comp_use_env (one_use_env f r') (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)))\" in exI)\n     apply (rule_tac x=\"diff_use_env (comp_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) (one_use_env f r'))\n      (comp_use_env (one_use_env f r') (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)))\" in exI)\n    (* typing f v1 *)\n     apply (rule_tac x=\"t2a\" in exI)\n     apply (rule_tac x=\"r\" in exI)\n     apply (rule_tac x=\"as_aff r'\" in exI)\n     apply (rule_tac x=\"diff_use_env (comp_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) (one_use_env f r'))\n      (comp_use_env (one_use_env f r') (lift_use_env rx1 r))\" in exI)\n     apply (rule_tac x=\"diff_use_env (comp_use_env (lift_use_env rx1 r) (one_use_env f r'))\n      (comp_use_env (one_use_env f r') (lift_use_env rx1 r))\" in exI)\n     apply (auto)\n    (* typing f *)\n      apply (rule_tac x=\"t1a\" in exI)\n      apply (rule_tac x=\"r\" in exI)\n      apply (auto)\n       apply (simp add: add_env_def)\n       apply (simp add: deref_name_def)\n      apply (rule_tac x=\"diff_use_env (comp_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) (one_use_env f r')) (one_use_env f r')\" in exI)\n      apply (rule_tac x=\"diff_use_env (one_use_env f r') (one_use_env f r')\" in exI)\n      apply (auto)\n       apply (rule_tac x=\"one_use_env f r'\" in exI)\n       apply (rule_tac x=\"FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r')\" in exI)\n       apply (auto)\n            apply (simp add: add_env_def)\n           apply (rule_tac ereq_leq_use_envx)\n           apply (simp add: add_use_env_def)\n           apply (simp add: end_req_perm_def)\n           apply (case_tac \"r'\")\n             apply (auto)\n          apply (rule_tac dist_diff_leq_use_env_gen)\n           apply (cut_tac r_s=\"comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)\" and x=\"f\" and r=\"r'\" in add_comp_use_env)\n            apply (auto)\n            apply (rule_tac q=\"r\" in trans_leq_perm)\n             apply (rule_tac r_s=\"comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)\" and x=\"f\" in aff_leq_perm)\n             apply (rule_tac aff_comp_use_env)\n              apply (auto)\n           apply (rule_tac id_leq_use_env)\n          apply (rule_tac dist_comp_leq_use_env)\n           apply (rule_tac ereq_leq_use_envx)\n           apply (simp add: one_use_env_def)\n           apply (simp add: end_req_perm_def)\n           apply (case_tac \"r'\")\n             apply (auto)\n          apply (rule_tac id_leq_use_env)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (rule_tac self_comp_leq_use_env2)\n        apply (simp add: leq_use_env_def)\n        apply (simp add: one_use_env_def)\n        apply (simp add: add_use_env_def)\n        apply (case_tac \"r'\")\n          apply (auto)\n       apply (rule_tac dist_diff_leq_use_env_gen)\n        apply (rule_tac ereq_leq_use_envx)\n        apply (simp add: one_use_env_def)\n        apply (simp add: end_req_perm_def)\n        apply (case_tac \"r'\")\n          apply (auto)\n       apply (rule_tac self_comp_leq_use_env2)\n    (* typing v1 + resolving app *)\n      apply (rule_tac x=\"rx1\" in exI)\n      apply (rule_tac x=\"diff_use_env (comp_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) (one_use_env f r')) (one_use_env f r')\" in exI)\n      apply (auto)\n       apply (rule_tac rx=\"diff_use_env rx1 (one_use_env f r')\" in well_typed_incr_req)\n         apply (rule_tac well_typed_diff_perms)\n          apply (rule_tac r_s=\"rx1\" in well_typed_incr_simul_perm)\n           apply (rule_tac comp_leq_use_env1)\n           apply (rule_tac comp_leq_use_env1)\n           apply (rule_tac self_lift_leq_use_env)\n          apply (rule_tac well_typed_add_vars)\n            apply (auto)\n         apply (simp add: own_env_vars_def)\n         apply (simp add: one_use_env_def)\n         apply (simp add: non_prim_vars_def)\n         apply (case_tac \"x = f\")\n          apply (auto)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (rule_tac disj_diff_leq_use_env)\n        apply (simp add: disj_use_env_def)\n        apply (simp add: mini_disj_use_env_def)\n        apply (simp add: one_use_env_def)\n       apply (rule_tac comp_leq_use_env1)\n       apply (rule_tac comp_leq_use_env1)\n       apply (rule_tac self_lift_leq_use_env)\n    (* first app bounds *)\n      apply (rule_tac x=\"empty_use_env\" in exI)\n      apply (auto)\n           apply (rule_tac rhs_fold_dcl_use_env)\n           apply (rule_tac dist_diff_leq_use_env_gen)\n            apply (rule_tac id_leq_use_env)\n           apply (rule_tac dist_comp_leq_use_env)\n            apply (rule_tac self_comp_leq_use_env1)\n           apply (rule_tac dist_comp_leq_use_env)\n            apply (rule_tac dist_comp_leq_use_env)\n             apply (rule_tac diff_leq_use_env)\n             apply (rule_tac self_comp_leq_use_env1)\n            apply (rule_tac self_comp_leq_use_env2)\n           apply (rule_tac leq_empty_use_env)\n          apply (rule_tac dist_comp_leq_use_env)\n           apply (rule_tac dist_diff_leq_use_env)\n           apply (rule_tac self_comp_leq_use_env2)\n          apply (rule_tac disj_diff_leq_use_env)\n           apply (simp add: disj_use_env_def)\n           apply (simp add: mini_disj_use_env_def)\n           apply (simp add: one_use_env_def)\n           apply (case_tac r)\n             apply (simp_all)\n          apply (rule_tac comp_leq_use_env1)\n          apply (rule_tac self_comp_leq_use_env1)\n         apply (rule_tac r_s=\"one_use_env f r'\" in disj_leq_use_env1)\n          apply (simp add: disj_use_env_def)\n          apply (simp add: mini_disj_use_env_def)\n          apply (simp add: one_use_env_def)\n          apply (case_tac r)\n            apply (simp_all)\n         apply (rule_tac self_diff_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (rule_tac comp_leq_use_env1)\n         apply (rule_tac self_comp_leq_use_env1)\n        apply (rule_tac self_comp_leq_use_env2)\n       apply (rule_tac leq_empty_use_env)\n      apply (simp add: app_req_def)\n      apply (auto)\n       apply (rule_tac leq_empty_use_env)\n      apply (rule_tac rhs_unroll_dcl_use_env)\n      apply (rule_tac dist_diff_leq_use_env_gen)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac dist_diff_leq_use_env)\n        apply (rule_tac self_comp_leq_use_env2)\n       apply (rule_tac disj_diff_leq_use_env)\n        apply (simp add: disj_use_env_def)\n        apply (simp add: mini_disj_use_env_def)\n        apply (simp add: one_use_env_def)\n       apply (rule_tac comp_leq_use_env1)\n       apply (rule_tac self_lift_leq_use_env)\n      apply (rule_tac comp_leq_use_env1)\n      apply (rule_tac self_comp_leq_use_env2)\n    (* typing v2 *)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (rule_tac x=\"diff_use_env (comp_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) (one_use_env f r'))\n      (comp_use_env (one_use_env f r') (lift_use_env rx1 r))\" in exI)\n     apply (auto)\n      apply (rule_tac rx=\"diff_use_env rx2 (comp_use_env (one_use_env f r') (lift_use_env rx1 r))\" in well_typed_incr_req)\n        apply (rule_tac well_typed_diff_perms)\n         apply (rule_tac well_typed_comp_perms_gen)\n          apply (rule_tac well_typed_comp_perms2)\n           apply (rule_tac well_typed_lift_perms)\n           apply (rule_tac well_typed_add_vars)\n             apply (auto)\n          apply (rule_tac comm_disj_use_env)\n          apply (simp)\n         apply (simp add: mini_disj_use_env_def)\n         apply (simp add: one_use_env_def)\n         apply (simp add: comp_use_env_def)\n         apply (case_tac r)\n           apply (simp_all)\n        apply (simp add: own_env_vars_def)\n        apply (case_tac \"f = x\")\n         apply (simp add: non_prim_vars_def)\n        apply (case_tac \"one_use_env f r' x = OwnPerm\")\n         apply (simp add: one_use_env_def)\n        apply (case_tac \"lift_use_env rx1 r x = OwnPerm\")\n         apply (case_tac \"lift_use_env rx2 r x = NoPerm\")\n          apply (cut_tac x=\"x\" and ?r_s1.0=\"rx2\" and env=\"env\" and e=\"v2\" in well_typed_no_npv_use)\n            apply (auto)\n           apply (case_tac r)\n             apply (auto)\n           apply (case_tac \"rx2 x\")\n             apply (auto)\n          apply (simp add: non_prim_vars_def)\n          apply (simp add: add_env_def)\n          apply (simp add: non_prim_entry_def)\n         apply (simp add: disj_use_env_def)\n         apply (simp add: mini_disj_use_env_def)\n        apply (cut_tac r_sa=\"one_use_env f r'\" and r_sb=\"lift_use_env rx1 r\" and x=\"x\" in comp_use_no_own)\n          apply (auto)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (rule_tac disj_diff_leq_use_env)\n       apply (rule_tac disj_comp_use_env1)\n        apply (simp add: disj_use_env_def)\n        apply (simp add: mini_disj_use_env_def)\n        apply (simp add: one_use_env_def)\n       apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n        apply (simp)\n       apply (rule_tac self_lift_leq_use_env)\n      apply (rule_tac comp_leq_use_env1)\n      apply (rule_tac comp_leq_use_env2)\n      apply (rule_tac self_lift_leq_use_env)\n    (* (f v1) v2 bounds *)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n          apply (rule_tac rhs_fold_dcl_use_env)\n          apply (rule_tac dist_diff_leq_use_env_gen)\n           apply (rule_tac id_leq_use_env)\n          apply (rule_tac dist_comp_leq_use_env)\n           apply (rule_tac dist_comp_leq_use_env)\n            apply (rule_tac self_comp_leq_use_env1)\n           apply (rule_tac comp_leq_use_env2)\n           apply (rule_tac self_comp_leq_use_env1)\n          apply (rule_tac dist_comp_leq_use_env)\n           apply (rule_tac dist_comp_leq_use_env)\n            apply (rule_tac diff_leq_use_env)\n            apply (rule_tac dist_comp_leq_use_env)\n             apply (rule_tac comp_leq_use_env2)\n             apply (rule_tac self_comp_leq_use_env1)\n            apply (rule_tac self_comp_leq_use_env1)\n           apply (rule_tac comp_leq_use_env2)\n           apply (rule_tac self_comp_leq_use_env2)\n          apply (rule_tac leq_empty_use_env)\n         apply (rule_tac dist_comp_leq_use_env)\n          apply (rule_tac dist_diff_leq_use_env)\n          apply (rule_tac dist_comp_leq_use_env)\n           apply (rule_tac comp_leq_use_env1)\n           apply (rule_tac self_comp_leq_use_env1)\n          apply (rule_tac self_comp_leq_use_env2)\n         apply (rule_tac disj_diff_leq_use_env)\n          apply (rule_tac disj_comp_use_env1)\n           apply (simp add: disj_use_env_def)\n           apply (simp add: mini_disj_use_env_def)\n           apply (simp add: one_use_env_def)\n           apply (case_tac r)\n             apply (auto)\n         apply (rule_tac comp_leq_use_env1)\n         apply (rule_tac self_comp_leq_use_env2)\n        apply (rule_tac r_s=\"comp_use_env (lift_use_env rx1 r) (one_use_env f r')\" in disj_leq_use_env1)\n         apply (rule_tac disj_comp_use_env1)\n          apply (simp)\n         apply (simp add: disj_use_env_def)\n         apply (simp add: mini_disj_use_env_def)\n         apply (simp add: one_use_env_def)\n         apply (case_tac r)\n           apply (simp_all)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac leq_empty_use_env)\n     apply (simp add: app_req_def)\n     apply (auto)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac lhs_unroll_dcl_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac unroll_dcl_use_env)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (rule_tac rhs_fold_dcl_use_env)\n     apply (rule_tac lhs_dist_dcl_use_env)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac diff_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac comp_leq_use_env1)\n       apply (rule_tac self_comp_leq_use_env1)\n      apply (rule_tac self_comp_leq_use_env2)\n     apply (rule_tac disj_diff_leq_use_env)\n      apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n       apply (rule_tac disj_comp_use_env1)\n        apply (simp add: disj_use_env_def)\n        apply (simp add: mini_disj_use_env_def)\n        apply (simp add: one_use_env_def)\n        apply (case_tac r)\n          apply (simp_all)\n      apply (rule_tac diff_leq_use_env)\n      apply (rule_tac self_lift_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac comp_leq_use_env1)\n     apply (rule_tac comp_leq_use_env2)\n     apply (rule_tac self_lift_leq_use_env)\n    apply (rule_tac aff_comp_use_env)\n     apply (simp_all)\n    (* final existential *)\n   apply (rule_tac x=\"r_ex\" in exI)\n   apply (auto)\n   apply (rule_tac well_typed_perm_leqx)\n   apply (auto)\n    (* proper expression *)\n  apply (simp add: proper_exp_def)\n  done\n    \n    \n    \n  (*\nlemma sares_unpack_case: \"\\<lbrakk>well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; proper_exp rs_map (AppExp (ConstExp UnpackConst) (PairExp v1 v2));\n        leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex));\n        leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s2; leq_use_env r_ex r_s1; leq_use_env rx r_s3;\n        leq_use_env (app_req rx1 rx2 r (FunTy (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r')) tx r' (as_aff r)) r_ex) rx; leq_use_env r_s1 r_f;\n        ax = NoAct; c = UnpackConst; v = PairExp v1 v2; t1 = PairTy t1a t2a r; s2 = s1;\n        t2 = FunTy (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r')) tx r' (as_aff r); e2 = LamExp f (AppExp (AppExp (VarExp f NoRef) v1) v2); a = Prim;\n        leq_perm r r'; is_value v1; is_value v2; f \\<notin> free_vars v1; f \\<notin> free_vars v2; f \\<notin> ref_vars v1; f \\<notin> ref_vars v2; well_typed env r_s1 v1 t1a r_s2a rx1a;\n        well_typed env r_s2a v2 t2a r_s3a rx2a; leq_use_env (lift_use_env rx1a r) r_s3a; leq_use_env (lift_use_env rx2a r) r_s3a;\n        aff_leq (max_aff (req_type t1a) (req_type t2a)) r; disj_use_env (lift_use_env rx1a r) (lift_use_env rx2a r);\n        leq_use_env r_s2 (diff_use_env r_s3a r_exa); leq_use_env rx2 r_s2; leq_use_env r_exa r_s1;\n        leq_use_env (pair_req (comp_use_env (lift_use_env rx1a r) (lift_use_env rx2a r)) r_exa (PairTy t1a t2a r)) rx2\\<rbrakk>\n       \\<Longrightarrow> \\<exists>g_ax. (\\<exists>rxa. (\\<exists>r_end r_s' t1 ra a r_s2 rx1.\n                             (\\<exists>t1b rb. (\\<exists>aa. add_env (red_env env g_ax) f (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r')) (deref_name f NoRef) =\n                                             Some (FunTy t1b (FunTy t1 tx ra a) rb aa)) \\<and>\n                                       (\\<exists>r_s2a rx1a.\n                                           (\\<exists>r_ex tau_x.\n                                               add_env (red_env env g_ax) f (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r')) f = Some tau_x \\<and>\n                                               leq_use_env (ereq_use_env f tau_x) (add_use_env rxa f r') \\<and>\n                                               leq_use_env r_s2a (diff_use_env (add_use_env rxa f r') (comp_use_env (ereq_use_env f tau_x) r_ex)) \\<and>\n                                               leq_use_env rx1a r_s2a \\<and>\n                                               leq_use_env r_ex (add_use_env rxa f r') \\<and>\n                                               leq_use_env (diff_use_env (ereq_use_env f tau_x) (comp_use_env (ereq_use_env f tau_x) r_ex)) rx1a) \\<and>\n                                           (\\<exists>rx2 r_s3.\n                                               well_typed (add_env (red_env env g_ax) f (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r'))) r_s2a v1 t1b\n                                                r_s3 rx2 \\<and>\n                                               (\\<exists>r_ex. leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1a (lift_use_env rx2 rb)) r_ex)) \\<and>\n                                                       leq_use_env (comp_use_env rx1a (lift_use_env rx2 rb)) r_s3 \\<and>\n                                                       disj_use_env rx1a (lift_use_env rx2 rb) \\<and>\n                                                       leq_use_env rx1 r_s2 \\<and>\n                                                       leq_use_env r_ex (add_use_env rxa f r') \\<and>\n                                                       leq_use_env (app_req rx1a rx2 rb (FunTy t1 tx ra a) r_ex) rx1)))) \\<and>\n                             (\\<exists>rx2 r_s3.\n                                 well_typed (add_env (red_env env g_ax) f (FunTy t1a (FunTy t2a tx r (as_aff r')) r (as_aff r'))) r_s2 v2 t1 r_s3 rx2 \\<and>\n                                 (\\<exists>r_ex. leq_use_env r_s' (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_ex)) \\<and>\n                                         leq_use_env (comp_use_env rx1 (lift_use_env rx2 ra)) r_s3 \\<and>\n                                         disj_use_env rx1 (lift_use_env rx2 ra) \\<and>\n                                         leq_use_env r_end r_s' \\<and>\n                                         leq_use_env r_ex (add_use_env rxa f r') \\<and> leq_use_env (app_req rx1 rx2 ra tx r_ex) r_end))) \\<and>\n                         aff_use_env rxa (as_aff r) \\<and>\n                         leq_use_env rxa (exp_red_use_env r_s1 g_ax) \\<and>\n                         (\\<exists>r_ex. leq_use_env (end_red_use_env r_s3 g_ax) (diff_use_env (exp_red_use_env r_s1 g_ax) r_ex) \\<and>\n                                 leq_use_env (end_red_use_env rx g_ax) (end_red_use_env r_s3 g_ax) \\<and>\n                                 leq_use_env r_ex (exp_red_use_env r_s1 g_ax) \\<and> leq_use_env (diff_use_env rxa r_ex) (end_red_use_env rx g_ax))) \\<and>\n                  proper_exp (red_nres_map rs_map g_ax) (LamExp f (AppExp (AppExp (VarExp f NoRef) v1) v2)) \\<and>\n                  well_typed_state s1 (red_env env g_ax) (red_nres_map rs_map g_ax) \\<and>\n                  valid_exp_use_env s1 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\<and> safe_act s1 (infl_use_env r_f r_s3) g_ax \\<and> corr_act NoAct g_ax\"\n  apply (rule_tac x=\"NoResAct\" in exI)\n    apply (auto)\n   apply (rule_tac x=\"comp_use_env (drop_use_env_dep (lift_use_env rx1a r) r) (drop_use_env_dep (lift_use_env rx2a r) r)\" in exI)\n   apply (auto)\n      apply (rule_tac x=\"empty_use_env\" in exI)\n      apply (rule_tac x=\"empty_use_env\" in exI)\n      apply (rule_tac x=\"t2a\" in exI)\n      apply (rule_tac x=\"r\" in exI)\n      apply (rule_tac x=\"as_aff r'\" in exI)\n      apply (rule_tac x=\"empty_use_env\" in exI)\n      apply (rule_tac x=\"empty_use_env\" in exI)\n    *)\n    \n    \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/SafeRedUnpack.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442250928250375, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3195960933408314}}
{"text": "section\\<open>LTL for EFSMs\\<close>\ntext\\<open>This theory builds off the \\texttt{Linear\\_Temporal\\_Logic\\_on\\_Streams} theory from the HOL\nlibrary and defines functions to ease the expression of LTL properties over EFSMs. Since the LTL\noperators effectively act over traces of models we must find a way to express models as streams.\\<close>\n\ntheory EFSM_LTL\nimports \"Extended_Finite_State_Machines.EFSM\" \"HOL-Library.Linear_Temporal_Logic_on_Streams\"\nbegin\n\ntext_raw\\<open>\\snip{statedef}{1}{2}{%\\<close>\nrecord state =\n  statename :: \"nat option\"\n  datastate :: registers\n  action :: action\n  \"output\" :: outputs\ntext_raw\\<open>}%endsnip\\<close>\n\ntext_raw\\<open>\\snip{whitebox}{1}{2}{%\\<close>\ntype_synonym whitebox_trace = \"state stream\"\ntext_raw\\<open>}%endsnip\\<close>\n\ntype_synonym property = \"whitebox_trace \\<Rightarrow> bool\"\n\nabbreviation label :: \"state \\<Rightarrow> String.literal\" where\n  \"label s \\<equiv> fst (action s)\"\n\nabbreviation inputs :: \"state \\<Rightarrow> value list\" where\n  \"inputs s \\<equiv> snd (action s)\"\n\ntext_raw\\<open>\\snip{ltlStep}{1}{2}{%\\<close>\nfun ltl_step :: \"transition_matrix \\<Rightarrow> cfstate option \\<Rightarrow> registers \\<Rightarrow> action \\<Rightarrow> (nat option \\<times> outputs \\<times> registers)\" where\n  \"ltl_step _ None r _ = (None, [], r)\" |\n  \"ltl_step e (Some s) r (l, i) = (let possibilities = possible_steps e s r l i in\n                   if possibilities = {||} then (None, [], r)\n                   else\n                     let (s', t) = Eps (\\<lambda>x. x |\\<in>| possibilities) in\n                     (Some s', (evaluate_outputs t i r), (evaluate_updates t i r))\n                  )\"\ntext_raw\\<open>}%endsnip\\<close>\n\nlemma ltl_step_singleton:\n\"\\<exists>t. possible_steps e n r (fst v) (snd v) = {|(aa, t)|} \\<and> evaluate_outputs t (snd v) r  = b \\<and> evaluate_updates t (snd v) r = c\\<Longrightarrow>\nltl_step e (Some n) r v = (Some aa, b, c)\"\n  apply (cases v)\n  by auto\n\nlemma ltl_step_none: \"possible_steps e s r a b = {||} \\<Longrightarrow> ltl_step e (Some s) r (a, b) = (None, [], r)\"\n  by simp\n\nlemma ltl_step_none_2: \"possible_steps e s r (fst ie) (snd ie) = {||} \\<Longrightarrow> ltl_step e (Some s) r ie = (None, [], r)\"\n  by (metis ltl_step_none prod.exhaust_sel)\n\nlemma ltl_step_alt: \"ltl_step e (Some s) r t = (\n  let possibilities = possible_steps e s r (fst t) (snd t) in\n  if possibilities = {||} then\n    (None, [], r)\n  else\n  let (s', t') = Eps (\\<lambda>x. x |\\<in>| possibilities) in\n  (Some s', (apply_outputs (Outputs t') (join_ir (snd t) r)), (apply_updates (Updates t') (join_ir (snd t) r) r))\n)\"\n  by (case_tac t, simp add: Let_def)\n\nlemma ltl_step_some:\n  assumes \"possible_steps e s r l i = {|(s', t)|}\"\n      and \"evaluate_outputs t i r = p\"\n      and \"evaluate_updates t i r = r'\"\n    shows \"ltl_step e (Some s) r (l, i) = (Some s', p, r')\"\n  by (simp add: assms)\n\nlemma ltl_step_cases:\n  assumes invalid: \"P (None, [], r)\"\n      and valid: \"\\<forall>(s', t) |\\<in>| (possible_steps e s r l i). P (Some s', (evaluate_outputs t i r), (evaluate_updates t i r))\"\n    shows \"P (ltl_step e (Some s) r (l, i))\"\n  apply simp\n  apply (case_tac \"possible_steps e s r l i\")\n   apply (simp add: invalid)\n  apply simp\n  subgoal for x S'\n    apply (case_tac \"SOME xa. xa = x \\<or> xa |\\<in>| S'\")\n    apply simp\n    apply (insert assms(2))\n    apply (simp add: fBall_def Ball_def fmember_def)\n    by (metis (mono_tags, lifting) fst_conv prod.case_eq_if snd_conv someI_ex)\n  done\n\ntext\\<open>The \\texttt{make\\_full\\_observation} function behaves similarly to \\texttt{observe\\_execution}\nfrom the \\texttt{EFSM} theory. The main difference in behaviour is what is recorded. While the\nobserve execution function simply observes an execution of the EFSM to produce the corresponding\noutput for each action, the intention here is to record every detail of execution, including the\nvalues of internal variables.\n\nThinking of each action as a step forward in time, there are five components which characterise\na given point in the execution of an EFSM. At each point, the model has a current control state and\ndata state. Each action has a label and some input parameters, and its execution may produce\nsome observableoutput. It is therefore sufficient to provide a stream of 5-tuples containing the\ncurrent control state, data state, the label and inputs of the action, and computed output. The\nmake full observation function can then be defined as in Figure 9.1, with an additional\nfunction watch defined on top of this which starts the make full observation off in the\ninitial control state with the empty data state.\n\nCareful inspection of the definition reveals another way that \\texttt{make\\_full\\_observation}\ndiffers from \\texttt{observe\\_execution}. Rather than taking a cfstate, it takes a cfstate option.\nThe reason for this is that we need to make our EFSM models complete. That is, we need them to be\nable to respond to every action from every state like a DFA. If a model does not recognise a given\naction in a given state, we cannot simply stop processing because we are working with necessarily\ninfinite traces. Since these traces are generated by observing action sequences, the make full\nobservation function must keep processing whether there is a viable transition or not.\n\nTo support this, the make full observation adds an implicit ``sink state'' to every EFSM it\nprocesses by lifting control flow state indices from \\texttt{nat} to \\texttt{nat option} such that\nstate $n$ is seen as state \\texttt{Some} $n$. The control flow state \\texttt{None} represents a sink\nstate. If a model is unable to recognise a particular action from its current state, it moves into\nthe \\texttt{None} state. From here, the behaviour is constant for the rest of the time --- the\ncontrol flow state remains None; the data state does not change, and no output is produced.\\<close>\n\ntext_raw\\<open>\\snip{makeFullObservation}{1}{2}{%\\<close>\nprimcorec make_full_observation :: \"transition_matrix \\<Rightarrow> cfstate option \\<Rightarrow> registers \\<Rightarrow> outputs \\<Rightarrow> action stream \\<Rightarrow> whitebox_trace\" where\n  \"make_full_observation e s d p i = (\n    let (s', o', d') = ltl_step e s d (shd i) in\n    \\<lparr>statename = s, datastate = d, action=(shd i), output = p\\<rparr>##(make_full_observation e s' d' o' (stl i))\n  )\"\ntext_raw\\<open>}%endsnip\\<close>\n\ntext_raw\\<open>\\snip{watch}{1}{2}{%\\<close>\nabbreviation watch :: \"transition_matrix \\<Rightarrow> action stream \\<Rightarrow> whitebox_trace\" where\n  \"watch e i \\<equiv> (make_full_observation e (Some 0) <> [] i)\"\ntext_raw\\<open>}%endsnip\\<close>\n\nsubsection\\<open>Expressing Properties\\<close>\ntext\\<open>In order to simplify the expression and understanding of properties, this theory defines a\nnumber of named functions which can be used to express certain properties of EFSMs.\\<close>\n\nsubsubsection\\<open>State Equality\\<close>\ntext\\<open>The \\textsc{state\\_eq} takes a cfstate option representing a control flow state index and\nreturns true if this is the control flow state at the head of the full observation.\\<close>\n\nabbreviation state_eq :: \"cfstate option \\<Rightarrow> whitebox_trace \\<Rightarrow> bool\" where\n  \"state_eq v s \\<equiv> statename (shd s) = v\"\n\nlemma state_eq_holds: \"state_eq s = holds (\\<lambda>x. statename x = s)\"\n  apply (rule ext)\n  by (simp add: holds_def)\n\nlemma state_eq_None_not_Some: \"state_eq None s \\<Longrightarrow> \\<not> state_eq (Some n) s\"\n  by simp\n\nsubsubsection\\<open>Label Equality\\<close>\ntext\\<open>The \\textsc{label\\_eq} function takes a string and returns true if this is equal to the label\nat the head of the full observation.\\<close>\n\nabbreviation \"label_eq v s \\<equiv> fst (action (shd s)) = (String.implode v)\"\n\nlemma watch_label: \"label_eq l (watch e t) = (fst (shd t) = String.implode l)\"\n  by simp\n\nsubsubsection\\<open>Input Equality\\<close>\ntext\\<open>The \\textsc{input\\_eq} function takes a value list and returns true if this is equal to the\ninput at the head of the full observation.\\<close>\n\nabbreviation \"input_eq v s \\<equiv> inputs (shd s) = v\"\n\nsubsubsection\\<open>Action Equality\\<close>\ntext\\<open>The \\textsc{action\\_eq} function takes a (label, value list) pair and returns true if this is\nequal to the action at the head of the full observation. This effectively combines\n\\texttt{label\\_eq} and \\texttt{input\\_eq} into one function.\\<close>\n\nabbreviation \"action_eq e \\<equiv> label_eq (fst e) aand input_eq (snd e)\"\n\nsubsubsection\\<open>Output Equality\\<close>\ntext\\<open>The \\textsc{output\\_eq} function takes a takes a value option list and returns true if this is\nequal to the output at the head of the full observation.\\<close>\n\nabbreviation \"output_eq v s \\<equiv> output (shd s) = v\"\n\ntext_raw\\<open>\\snip{ltlVName}{1}{2}{%\\<close>\ndatatype ltl_vname = Ip nat | Op nat | Rg nat\ntext_raw\\<open>}%endsnip\\<close>\n\nsubsubsection\\<open>Checking Arbitrary Expressions\\<close>\ntext\\<open>The \\textsc{check\\_exp} function takes a guard expression and returns true if the guard\nexpression evaluates to true in the given state.\\<close>\n\ntype_synonym ltl_gexp = \"ltl_vname gexp\"\n\ndefinition join_iro :: \"value list \\<Rightarrow> registers \\<Rightarrow> outputs \\<Rightarrow> ltl_vname datastate\" where\n  \"join_iro i r p = (\\<lambda>x. case x of\n    Rg n \\<Rightarrow> r $ n |\n    Ip n \\<Rightarrow> Some (i ! n) |\n    Op n \\<Rightarrow> p ! n\n  )\"\n\nlemma join_iro_R [simp]: \"join_iro i r p (Rg n) = r $ n\"\n  by (simp add: join_iro_def)\n\nabbreviation \"check_exp g s \\<equiv> (gval g (join_iro (snd (action (shd s))) (datastate (shd s)) (output (shd s))) = trilean.true)\"\n\nlemma alw_ev: \"alw f = not (ev (\\<lambda>s. \\<not>f s))\"\n  by simp\n\nlemma alw_state_eq_smap:\n  \"alw (state_eq s) ss = alw (\\<lambda>ss. shd ss = s) (smap statename ss)\"\n  apply standard\n   apply (simp add: alw_iff_sdrop )\n  by (simp add: alw_mono alw_smap )\n\nsubsection\\<open>Sink State\\<close>\ntext\\<open>Once the sink state is entered, it cannot be left and there are no outputs or updates\nhenceforth.\\<close>\n\nlemma shd_state_is_none: \"(state_eq None) (make_full_observation e None r p t)\"\n  by simp\n\nlemma unfold_observe_none: \"make_full_observation e None d p t = (\\<lparr>statename = None, datastate = d, action=(shd t), output = p\\<rparr>##(make_full_observation e None d [] (stl t)))\"\n  by (simp add: stream.expand)\n\nlemma once_none_always_none_aux:\n  assumes \"\\<exists> p r i. j = (make_full_observation e None r p) i\"\n  shows \"alw (state_eq None) j\"\n  using assms apply coinduct\n  apply simp\n  by fastforce\n\nlemma once_none_always_none: \"alw (state_eq None) (make_full_observation e None r p t)\"\n  using once_none_always_none_aux by blast\n\nlemma once_none_nxt_always_none: \"alw (nxt (state_eq None)) (make_full_observation e None r p t)\"\n  using once_none_always_none\n  by (simp add: alw_iff_sdrop del: sdrop.simps)\n\nlemma snth_sconst: \"(\\<forall>i. s !! i = h) = (s = sconst h)\"\n  by (auto simp add: sconst_alt sset_range)\n\nlemma alw_sconst: \"(alw (\\<lambda>xs. shd xs = h) t) = (t = sconst h)\"\n  by (simp add: snth_sconst[symmetric] alw_iff_sdrop)\n\nlemma smap_statename_None: \"smap statename (make_full_observation e None r p i) = sconst None\"\n  by (meson EFSM_LTL.alw_sconst alw_state_eq_smap once_none_always_none)\n\nlemma alw_not_some: \"alw (\\<lambda>xs. statename (shd xs) \\<noteq> Some s) (make_full_observation e None r p t)\"\n  by (metis (mono_tags, lifting) alw_mono once_none_always_none option.distinct(1) )\n\nlemma state_none: \"((state_eq None) impl nxt (state_eq None)) (make_full_observation e s r p t)\"\n  by simp\n\nlemma state_none_2:\n  \"(state_eq None) (make_full_observation e s r p t) \\<Longrightarrow>\n   (state_eq None) (make_full_observation e s r p (stl t))\"\n  by simp\n\nlemma no_output_none_aux:\n  assumes \"\\<exists> p r i. j = (make_full_observation e None r []) i\"\n  shows \"alw (output_eq []) j\"\n  using assms apply coinduct\n  apply simp\n  by fastforce\n\nlemma no_output_none: \"nxt (alw (output_eq [])) (make_full_observation e None r p t)\"\n  using no_output_none_aux by auto\n\nlemma nxt_alw: \"nxt (alw P) s \\<Longrightarrow> alw (nxt P) s\"\n  by (simp add: alw_iff_sdrop)\n\nlemma no_output_none_nxt: \"alw (nxt (output_eq [])) (make_full_observation e None r p t)\"\n  using nxt_alw no_output_none by blast\n\nlemma no_output_none_if_empty: \"alw (output_eq []) (make_full_observation e None r [] t)\"\n  by (metis (mono_tags, lifting) alw_nxt make_full_observation.simps(1) no_output_none state.select_convs(4))\n\nlemma no_updates_none_aux:\n  assumes \"\\<exists> p i. j = (make_full_observation e None r p) i\"\n  shows \"alw (\\<lambda>x. datastate (shd x) = r) j\"\n  using assms apply coinduct\n  by fastforce\n\nlemma no_updates_none: \"alw (\\<lambda>x. datastate (shd x) = r) (make_full_observation e None r p t)\"\n  using no_updates_none_aux by blast\n\nlemma action_components: \"(label_eq l aand input_eq i) s = (action (shd s) = (String.implode l, i))\"\n  by (metis fst_conv prod.collapse snd_conv)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Extended_Finite_State_Machines/EFSM_LTL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5195213368305398, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.3195512649659368}}
{"text": "(*  Title:      HOL/Auth/n_g2kAbsAfter.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_g2kAbsAfter Protocol Case Study*} \n\ntheory n_g2kAbsAfter imports n_g2kAbsAfter_lemma_invs_on_rules n_g2kAbsAfter_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_g2kAbsAfter/n_g2kAbsAfter.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160666, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.31955125581438487}}
{"text": "(*  Title:      Imperative_HOL_Time/Array_Time.thy\n    Author:     Maximilian P. L. Haslbeck & Bohua Zhan, TU Muenchen\n*)\nsection \\<open>Monadic arrays\\<close>\n\ntext \\<open>This theory is an adaptation of \\<open>HOL/Imperative_HOL/Array_Time.thy\\<close>,\n adding time bookkeeping.\\<close>\n\ntheory Array_Time\nimports Heap_Time_Monad\nbegin\n\nsubsection \\<open>Primitives\\<close>\n\ndefinition present :: \"heap \\<Rightarrow> 'a::heap array \\<Rightarrow> bool\" where\n  \"present h a \\<longleftrightarrow> addr_of_array a < lim h\"\n\ndefinition get :: \"heap \\<Rightarrow> 'a::heap array \\<Rightarrow> 'a list\" where\n  \"get h a = map from_nat (arrays h (TYPEREP('a)) (addr_of_array a))\"\n\ndefinition set :: \"'a::heap array \\<Rightarrow> 'a list \\<Rightarrow> heap \\<Rightarrow> heap\" where\n  \"set a x = arrays_update (\\<lambda>h. h(TYPEREP('a) := ((h(TYPEREP('a))) (addr_of_array a:=map to_nat x))))\"\n\ndefinition alloc :: \"'a list \\<Rightarrow> heap \\<Rightarrow> 'a::heap array \\<times> heap\" where\n  \"alloc xs h = (let\n     l = lim h;\n     r = Array l;\n     h'' = set r xs (h\\<lparr>lim := l + 1\\<rparr>)\n   in (r, h''))\"\n\ndefinition length :: \"heap \\<Rightarrow> 'a::heap array \\<Rightarrow> nat\" where\n  \"length h a = List.length (get h a)\"\n  \ndefinition update :: \"'a::heap array \\<Rightarrow> nat \\<Rightarrow> 'a \\<Rightarrow> heap \\<Rightarrow> heap\" where\n  \"update a i x h = set a ((get h a)[i:=x]) h\"\n\ndefinition noteq :: \"'a::heap array \\<Rightarrow> 'b::heap array \\<Rightarrow> bool\" (infix \"=!!=\" 70) where\n  \"r =!!= s \\<longleftrightarrow> TYPEREP('a) \\<noteq> TYPEREP('b) \\<or> addr_of_array r \\<noteq> addr_of_array s\"\n\n\nsubsection \\<open>Monad operations\\<close>\n\ndefinition new :: \"nat \\<Rightarrow> 'a::heap \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"new n x = Heap_Time_Monad.heap (%h. let (r,h') = alloc (replicate n x) h in (r,h',n+1))\"\n\ndefinition of_list :: \"'a::heap list \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"of_list xs = Heap_Time_Monad.heap (%h. let (r,h') = alloc xs h in (r,h',1+List.length xs))\"\n\ndefinition make :: \"nat \\<Rightarrow> (nat \\<Rightarrow> 'a::heap) \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"make n f = Heap_Time_Monad.heap (%h. let (r,h') = alloc (map f [0 ..< n]) h in (r,h',n+1))\"\n\ndefinition len :: \"'a::heap array \\<Rightarrow> nat Heap\" where\n  [code del]: \"len a = Heap_Time_Monad.tap (\\<lambda>h. length h a)\"\n\ndefinition nth :: \"'a::heap array \\<Rightarrow> nat \\<Rightarrow> 'a Heap\" where\n  [code del]: \"nth a i = Heap_Time_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (get h a ! i, h, 1))\"\n\ndefinition upd :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a::heap array \\<Rightarrow> 'a::heap array Heap\" where\n  [code del]: \"upd i x a = Heap_Time_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (a, update a i x h, 1))\"\n\ndefinition map_entry :: \"nat \\<Rightarrow> ('a::heap \\<Rightarrow> 'a) \\<Rightarrow> 'a array \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"map_entry i f a = Heap_Time_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (a, update a i (f (get h a ! i)) h, 2))\"\n\ndefinition swap :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a::heap array \\<Rightarrow> 'a Heap\" where\n  [code del]: \"swap i x a = Heap_Time_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (get h a ! i, update a i x h, 2 ))\"  (* questionable *)\n\ndefinition freeze :: \"'a::heap array \\<Rightarrow> 'a list Heap\" where\n  [code del]: \"freeze a = Heap_Time_Monad.heap (\\<lambda>h. (get h a, h, 1+length h a)) \"\n\n\nsubsection \\<open>Properties\\<close>\n\ntext \\<open>FIXME: Does there exist a \"canonical\" array axiomatisation in\nthe literature?\\<close>\n\ntext \\<open>Primitives\\<close>\n\nlemma noteq_sym: \"a =!!= b \\<Longrightarrow> b =!!= a\"\n  and unequal [simp]: \"a \\<noteq> a' \\<longleftrightarrow> a =!!= a'\"\n  unfolding noteq_def by auto\n\nlemma noteq_irrefl: \"r =!!= r \\<Longrightarrow> False\"\n  unfolding noteq_def by auto\n\nlemma present_alloc_noteq: \"present h a \\<Longrightarrow> a =!!= fst (alloc xs h)\"\n  by (simp add: present_def noteq_def alloc_def Let_def)\n\nlemma get_set_eq [simp]: \"get (set r x h) r = x\"\n  by (simp add: get_def set_def o_def)\n\nlemma get_set_neq [simp]: \"r =!!= s \\<Longrightarrow> get (set s x h) r = get h r\"\n  by (simp add: noteq_def get_def set_def)\n\nlemma set_same [simp]:\n  \"set r x (set r y h) = set r x h\"\n  by (simp add: set_def)\n\nlemma set_set_swap:\n  \"r =!!= r' \\<Longrightarrow> set r x (set r' x' h) = set r' x' (set r x h)\"\n  by (simp add: Let_def fun_eq_iff noteq_def set_def)\n\nlemma get_update_eq [simp]:\n  \"get (update a i v h) a = (get h a) [i := v]\"\n  by (simp add: update_def)\n\nlemma nth_update_neq [simp]:\n  \"a =!!= b \\<Longrightarrow> get (update b j v h) a ! i = get h a ! i\"\n  by (simp add: update_def noteq_def)\n\nlemma get_update_elem_neqIndex [simp]:\n  \"i \\<noteq> j \\<Longrightarrow> get (update a j v h) a ! i = get h a ! i\"\n  by simp\n\nlemma length_update [simp]: \n  \"length (update b i v h) = length h\"\n  by (simp add: update_def length_def set_def get_def fun_eq_iff)\n\nlemma update_swap_neq:\n  \"a =!!= a' \\<Longrightarrow> \n  update a i v (update a' i' v' h) \n  = update a' i' v' (update a i v h)\"\napply (unfold update_def)\napply simp\napply (subst set_set_swap, assumption)\napply (subst get_set_neq)\napply (erule noteq_sym)\napply simp\ndone\n\nlemma update_swap_neqIndex:\n  \"\\<lbrakk> i \\<noteq> i' \\<rbrakk> \\<Longrightarrow> update a i v (update a i' v' h) = update a i' v' (update a i v h)\"\n  by (auto simp add: update_def set_set_swap list_update_swap)\n\nlemma get_alloc:\n  \"get (snd (alloc xs h)) (fst (alloc ys h)) = xs\"\n  by (simp add: Let_def split_def alloc_def)\n\nlemma length_alloc:\n  \"length (snd (alloc (xs :: 'a::heap list) h)) (fst (alloc (ys :: 'a list) h)) = List.length xs\"\n  by (simp add: Array_Time.length_def get_alloc)\n\nlemma set:\n  \"set (fst (alloc ls h))\n     new_ls (snd (alloc ls h))\n       = snd (alloc new_ls h)\"\n  by (simp add: Let_def split_def alloc_def)\n\nlemma present_update [simp]: \n  \"present (update b i v h) = present h\"\n  by (simp add: update_def present_def set_def get_def fun_eq_iff)\n\nlemma present_alloc [simp]:\n  \"present (snd (alloc xs h)) (fst (alloc xs h))\"\n  by (simp add: present_def alloc_def set_def Let_def)\n\nlemma not_present_alloc [simp]:\n  \"\\<not> present h (fst (alloc xs h))\"\n  by (simp add: present_def alloc_def Let_def)\n\n\ntext \\<open>Monad operations\\<close>\n\nlemma execute_new [execute_simps]:\n  \"execute (new n x) h = Some (let (r,h') = alloc (replicate n x) h in (r,h',n+1))\"\n  by (simp add: new_def execute_simps)\n\nlemma success_newI [success_intros]:\n  \"success (new n x) h\"\n  by (auto intro: success_intros simp add: new_def)\n\nlemma effect_newI [effect_intros]:\n  assumes \"(a, h') = alloc (replicate n x) h\"\n  shows \"effect (new n x) h h' a (n+1)\"\n  apply (rule effectI) apply (simp add: assms execute_simps)  by (metis assms case_prod_conv) \n    \nlemma effect_newE [effect_elims]:\n  assumes \"effect (new n x) h h' r n'\"\n  obtains \"r = fst (alloc (replicate n x) h)\" \"h' = snd (alloc (replicate n x) h)\" \n    \"get h' r = replicate n x\" \"present h' r\" \"\\<not> present h r\" \"n+1=n'\"\n  using assms apply (rule effectE) using  case_prod_beta get_alloc execute_new\n  by (metis (mono_tags, lifting) fst_conv not_present_alloc option.sel present_alloc sndI) \n  \n  (* apply (si mp add: case_prod_beta get_alloc execute_simps) refactor proof *) \n\nlemma execute_of_list [execute_simps]:\n  \"execute (of_list xs) h = Some (let (r,h') = alloc xs h in (r,h',1 + List.length xs))\"\n  by (simp add: of_list_def execute_simps)\n\nlemma success_of_listI [success_intros]:\n  \"success (of_list xs) h\"\n  by (auto intro: success_intros simp add: of_list_def)\n\nlemma effect_of_listI [effect_intros]:\n  assumes \"(a, h') = alloc xs h\"\n  shows \"effect (of_list xs) h h' a (1 + List.length xs)\"\n  by (rule effectI, simp add: assms execute_simps, metis assms case_prod_conv) \n    \n    \nlemma effect_of_listE [effect_elims]:\n  assumes \"effect (of_list xs) h h' r n'\"\n  obtains \"r = fst (alloc xs h)\" \"h' = snd (alloc xs h)\" \n    \"get h' r = xs\" \"present h' r\" \"\\<not> present h r\" \"n' = 1 + List.length xs\"\n  using assms apply (rule effectE) apply (simp add: get_alloc  execute_of_list) by (simp add: case_prod_unfold)\n\nlemma execute_make [execute_simps]:\n  \"execute (make n f) h = Some (let (r,h') = alloc (map f [0 ..< n]) h in (r,h',n+1))\"\n  by (simp add: make_def execute_simps)\n\nlemma success_makeI [success_intros]:\n  \"success (make n f) h\"\n  by (auto intro: success_intros simp add: make_def)\n\nlemma effect_makeI [effect_intros]:\n  assumes \"(a, h') = alloc (map f [0 ..< n]) h\"\n  shows \"effect (make n f) h h' a (n+1)\"\n  by (rule effectI) (simp add: assms execute_simps, metis assms case_prod_conv) \n\nlemma effect_makeE [effect_elims]:\n  assumes \"effect (make n f) h h' r n'\"\n  obtains \"r = fst (alloc (map f [0 ..< n]) h)\" \"h' = snd (alloc (map f [0 ..< n]) h)\" \n    \"get h' r = map f [0 ..< n]\" \"present h' r\" \"\\<not> present h r\" \"n+1=n'\"\n  using assms apply (rule effectE) using get_alloc  \n  by (metis (mono_tags, hide_lams) effectE effect_makeI not_present_alloc present_alloc prod.collapse)\n  \n  (* apply (si mp add: get_alloc execute_make) by (s imp add: case_prod_unfold) *)\n\nlemma execute_len [execute_simps]:\n  \"execute (len a) h = Some (length h a, h, 1)\"\n  by (simp add: len_def execute_simps)\n\nlemma success_lenI [success_intros]:\n  \"success (len a) h\"\n  by (auto intro: success_intros simp add: len_def)\n\nlemma effect_lengthI [effect_intros]:\n  assumes \"h' = h\" \"r = length h a\" \"n=1\"\n  shows \"effect (len a) h h' r n\"\n  by (rule effectI) (simp add: assms execute_simps)\n\nlemma effect_lengthE [effect_elims]:\n  assumes \"effect (len a) h h' r n\"\n  obtains \"r = length h' a\" \"h' = h\" \"n=1\" \n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_nth [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n    execute (nth a i) h = Some (get h a ! i, h,1)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (nth a i) h = None\"\n  by (simp_all add: nth_def execute_simps)\n\nlemma success_nthI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (nth a i) h\"\n  by (auto intro: success_intros simp add: nth_def)\n\nlemma effect_nthI [effect_intros]:\n  assumes \"i < length h a\" \"h' = h\" \"r = get h a ! i\" \"n=1\"\n  shows \"effect (nth a i) h h' r n\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_nthE [effect_elims]:\n  assumes \"effect (nth a i) h h' r n\"\n  obtains \"i < length h a\" \"r = get h a ! i\" \"h' = h\" \"n=1\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_upd [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n    execute (upd i x a) h = Some (a, update a i x h, 1)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (upd i x a) h = None\"\n  by (simp_all add: upd_def execute_simps)\n\nlemma success_updI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (upd i x a) h\"\n  by (auto intro: success_intros simp add: upd_def)\n\nlemma effect_updI [effect_intros]:\n  assumes \"i < length h a\" \"h' = update a i v h\" \"n=1\"\n  shows \"effect (upd i v a) h h' a n\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_updE [effect_elims]:\n  assumes \"effect (upd i v a) h h' r n\"\n  obtains \"r = a\" \"h' = update a i v h\" \"i < length h a\" \"n=1\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_map_entry [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n   execute (map_entry i f a) h =\n      Some (a, update a i (f (get h a ! i)) h, 2)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (map_entry i f a) h = None\"\n  by (simp_all add: map_entry_def execute_simps)\n\nlemma success_map_entryI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (map_entry i f a) h\"\n  by (auto intro: success_intros simp add: map_entry_def)\n\nlemma effect_map_entryI [effect_intros]:\n  assumes \"i < length h a\" \"h' = update a i (f (get h a ! i)) h\" \"r = a\" \"n=2\"\n  shows \"effect (map_entry i f a) h h' r n\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_map_entryE [effect_elims]:\n  assumes \"effect (map_entry i f a) h h' r n\"\n  obtains \"r = a\" \"h' = update a i (f (get h a ! i)) h\" \"i < length h a\" \"n=2\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_swap [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n   execute (swap i x a) h =\n      Some (get h a ! i, update a i x h, 2)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (swap i x a) h = None\"\n  by (simp_all add: swap_def execute_simps)\n\nlemma success_swapI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (swap i x a) h\"\n  by (auto intro: success_intros simp add: swap_def)\n\nlemma effect_swapI [effect_intros]:\n  assumes \"i < length h a\" \"h' = update a i x h\" \"r = get h a ! i\" \"n=2\"\n  shows \"effect (swap i x a) h h' r n\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_swapE [effect_elims]:\n  assumes \"effect (swap i x a) h h' r n\"\n  obtains \"r = get h a ! i\" \"h' = update a i x h\" \"i < length h a\" \"n=2\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_freeze [execute_simps]:\n  \"execute (freeze a) h = Some (get h a, h, 1+length h a)\"\n  by (simp add: freeze_def execute_simps)\n\nlemma success_freezeI [success_intros]:\n  \"success (freeze a) h\"\n  by (auto intro: success_intros simp add: freeze_def)\n\nlemma effect_freezeI [effect_intros]:\n  assumes \"h' = h\" \"r = get h a\" \"n=length h a\"\n  shows \"effect (freeze a) h h' r (n+1)\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_freezeE [effect_elims]:\n  assumes \"effect (freeze a) h h' r n\"\n  obtains \"h' = h\" \"r = get h a\" \"n=length h a+1\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma upd_ureturn:\n  \"upd i x a \\<then> ureturn a =   upd i x a \"\n  by (rule Heap_eqI) (simp add: bind_def guard_def upd_def execute_simps)\n\nlemma array_make:\n  \"new n x = make n (\\<lambda>_. x)\"\n  by (rule Heap_eqI) (simp add: map_replicate_trivial execute_simps)\n\nlemma array_of_list_make [code]:\n  \"of_list xs = make (List.length xs) (\\<lambda>n. xs ! n)\"\n  by (rule Heap_eqI) (simp add: map_nth execute_simps)\n\nhide_const (open) present get set alloc length update noteq new of_list make len nth upd map_entry swap freeze\n\n\nsubsection \\<open>Code generator setup\\<close>\n\nsubsubsection \\<open>Logical intermediate layer\\<close>\n\ndefinition new' where\n  [code del]: \"new' = Array_Time.new o nat_of_integer\"\n\n\n\ndefinition make' where\n  [code del]: \"make' i f = Array_Time.make (nat_of_integer i) (f o of_nat)\"\n\nlemma [code]:\n  \"Array_Time.make n f = make' (of_nat n) (f o nat_of_integer)\"\n  by (simp add: make'_def o_def)\n\ndefinition len' where\n  [code del]: \"len' a = Array_Time.len a \\<bind> (\\<lambda>n. ureturn (of_nat n))\"\n\nlemma [code]:\n  \"Array_Time.len a = len' a \\<bind> (\\<lambda>i. ureturn (nat_of_integer i))\"\n  by (simp add: len'_def execute_simps)    \n\ndefinition nth' where\n  [code del]: \"nth' a = Array_Time.nth a o nat_of_integer\"\n\nlemma [code]:\n  \"Array_Time.nth a n = nth' a (of_nat n)\"\n  by (simp add: nth'_def)\n\ndefinition upd' where\n  [code del]: \"upd' a i x = Array_Time.upd (nat_of_integer i) x a \\<then> ureturn ()\"\n\nlemma [code]:\n  \"Array_Time.upd i x a = upd' a (of_nat i) x \\<then> ureturn a\"\n  by (simp add: upd'_def upd_ureturn execute_simps)  \n\nlemma [code]:\n  \"Array_Time.map_entry i f a = do {\n     x \\<leftarrow> Array_Time.nth a i;\n     Array_Time.upd i (f x) a\n   }\"                                                                \n  by (rule Heap_eqI) (simp add: bind_def guard_def map_entry_def execute_simps)\n\nlemma [code]:\n  \"Array_Time.swap i x a = do {\n     y \\<leftarrow> Array_Time.nth a i;\n     Array_Time.upd i x a;\n     ureturn y\n   }\"\n  by (rule Heap_eqI) (simp add: bind_def guard_def swap_def execute_simps)\n(*\nlemma [code]:\n  \"Array_Time.freeze a = do {\n     n \\<leftarrow> Array_Time.len a;\n     Heap_Monad.fold_map (\\<lambda>i. Array_Time.nth a i) [0..<n]\n   }\"\nproof (rule Heap_eqI)\n  fix h\n  have *: \"List.map\n     (\\<lambda>x. fst (the (if x < Array_Time.length h a\n                    then Some (Array_Time.get h a ! x, h) else None)))\n     [0..<Array_Time.length h a] =\n       List.map (List.nth (Array_Time.get h a)) [0..<Array_Time.length h a]\"\n    by simp\n  have \"execute (Heap_Monad.fold_map (Array_Time.nth a) [0..<Array_Time.length h a]) h =\n    Some (Array_Time.get h a, h)\"\n    apply (subst execute_fold_map_unchanged_heap)\n    apply (simp_all add: nth_def guard_def * )\n    apply (simp add: length_def map_nth)\n    done\n  then have \"execute (do {\n      n \\<leftarrow> Array_Time.len a;\n      Heap_Monad.fold_map (Array_Time.nth a) [0..<n]\n    }) h = Some (Array_Time.get h a, h)\"\n    by (auto intro: execute_bind_eq_SomeI simp add: execute_simps)\n  then show \"execute (Array_Time.freeze a) h = execute (do {\n      n \\<leftarrow> Array_Time.len a;\n      Heap_Monad.fold_map (Array_Time.nth a) [0..<n]\n    }) h\" by (simp add: execute_simps)\nqed\n*)\nhide_const (open) new' make' len' nth' upd'\n\n\n  \ntext \\<open>SML\\<close>\n\ncode_printing type_constructor array \\<rightharpoonup> (SML) \"_/ array\"\ncode_printing constant Array \\<rightharpoonup> (SML) \"raise/ (Fail/ \\\"bare Array\\\")\"\ncode_printing constant Array_Time.new' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.array/ ((_),/ (_)))\"\ncode_printing constant Array_Time.of_list \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.fromList/ _)\"\ncode_printing constant Array_Time.make' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.tabulate/ ((_),/ (_)))\"\ncode_printing constant Array_Time.len' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.length/ _)\"\ncode_printing constant Array_Time.nth' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.sub/ ((_),/ (_)))\"\ncode_printing constant Array_Time.upd' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.update/ ((_),/ (_),/ (_)))\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (SML) infixl 6 \"=\"\n\ncode_reserved SML Array\n\n\ntext \\<open>OCaml\\<close>\n\ncode_printing type_constructor array \\<rightharpoonup> (OCaml) \"_/ array\"\ncode_printing constant Array \\<rightharpoonup> (OCaml) \"failwith/ \\\"bare Array\\\"\"\ncode_printing constant Array_Time.new' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.make/ (Big'_int.int'_of'_big'_int/ _)/ _)\"\ncode_printing constant Array_Time.of_list \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.of'_list/ _)\"\ncode_printing constant Array_Time.make' \\<rightharpoonup> (OCaml)\n  \"(fun/ ()/ ->/ Array.init/ (Big'_int.int'_of'_big'_int/ _)/ (fun k'_ ->/ _/ (Big'_int.big'_int'_of'_int/ k'_)))\"\ncode_printing constant Array_Time.len' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Big'_int.big'_int'_of'_int/ (Array.length/ _))\"\ncode_printing constant Array_Time.nth' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.get/ _/ (Big'_int.int'_of'_big'_int/ _))\"\ncode_printing constant Array_Time.upd' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.set/ _/ (Big'_int.int'_of'_big'_int/ _)/ _)\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (OCaml) infixl 4 \"=\"\n\ncode_reserved OCaml Array\n\n\ntext \\<open>Haskell\\<close>\n\ncode_printing type_constructor array \\<rightharpoonup> (Haskell) \"Heap.STArray/ Heap.RealWorld/ _\"\ncode_printing constant Array \\<rightharpoonup> (Haskell) \"error/ \\\"bare Array\\\"\"\ncode_printing constant Array_Time.new' \\<rightharpoonup> (Haskell) \"Heap.newArray\"\ncode_printing constant Array_Time.of_list \\<rightharpoonup> (Haskell) \"Heap.newListArray\"\ncode_printing constant Array_Time.make' \\<rightharpoonup> (Haskell) \"Heap.newFunArray\"\ncode_printing constant Array_Time.len' \\<rightharpoonup> (Haskell) \"Heap.lengthArray\"\ncode_printing constant Array_Time.nth' \\<rightharpoonup> (Haskell) \"Heap.readArray\"\ncode_printing constant Array_Time.upd' \\<rightharpoonup> (Haskell) \"Heap.writeArray\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (Haskell) infix 4 \"==\"\ncode_printing class_instance array :: HOL.equal \\<rightharpoonup> (Haskell) -\n\n\ntext \\<open>Scala\\<close>\n\ncode_printing type_constructor array \\<rightharpoonup> (Scala) \"!collection.mutable.ArraySeq[_]\"\ncode_printing constant Array \\<rightharpoonup> (Scala) \"!sys.error(\\\"bare Array\\\")\"\ncode_printing constant Array_Time.new' \\<rightharpoonup> (Scala) \"('_: Unit)/ => / Array.alloc((_))((_))\"\ncode_printing constant Array_Time.make' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.make((_))((_))\"\ncode_printing constant Array_Time.len' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.len((_))\"\ncode_printing constant Array_Time.nth' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.nth((_), (_))\"\ncode_printing constant Array_Time.upd' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.upd((_), (_), (_))\"\ncode_printing constant Array_Time.freeze \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.freeze((_))\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (Scala) infixl 5 \"==\"\n\n\n\nend\n", "meta": {"author": "bzhan", "repo": "Imperative_HOL_Time", "sha": "09f9bc7a7cf177d3adf1e9ce6adae09a85ebe5ec", "save_path": "github-repos/isabelle/bzhan-Imperative_HOL_Time", "path": "github-repos/isabelle/bzhan-Imperative_HOL_Time/Imperative_HOL_Time-09f9bc7a7cf177d3adf1e9ce6adae09a85ebe5ec/Array_Time.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160666, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.31955125581438487}}
{"text": "(*  Title:       Conservation of CSP Noninterference Security under Concurrent Composition\n    Author:      Pasquale Noce\n                 Security Certification Specialist at Arjo Systems, Italy\n                 pasquale dot noce dot lavoro at gmail dot com\n                 pasquale dot noce at arjosystems dot com\n*)\n\nsection \"Concurrent composition and noninterference security\"\n\ntheory ConcurrentComposition\nimports Noninterference_Sequential_Composition.Propaedeutics\nbegin\n\ntext \\<open>\n\\null\n\nIn his outstanding work on Communicating Sequential Processes \\<^cite>\\<open>\"R6\"\\<close>, Hoare has defined two\nfundamental binary operations allowing to compose the input processes into another, typically more\ncomplex, process: sequential composition and concurrent composition. Particularly, the output of the\nlatter operation is a process in which any event not shared by both operands can occur whenever the\noperand that admits the event can engage in it, whereas any event shared by both operands can occur\njust in case both can engage in it. In other words, shared events are those that synchronize the\nconcurrent processes, which on the contrary can engage asynchronously in the respective non-shared\nevents.\n\nThis paper formalizes Hoare's definition of concurrent composition and proves, in the general case\nof a possibly intransitive policy, that CSP noninterference security \\<^cite>\\<open>\"R1\"\\<close> is conserved under\nthis operation, viz. the security of both of the input processes implies that of the output process.\nThis result, along with the analogous one concerning sequential composition attained in \\<^cite>\\<open>\"R5\"\\<close>,\nenables the construction of more and more complex processes enforcing noninterference security by\ncomposing, sequentially or concurrently, simpler secure processes, whose security can in turn be\nproven using either the definition of security formulated in \\<^cite>\\<open>\"R1\"\\<close>, or the unwinding theorems\ndemonstrated in \\<^cite>\\<open>\"R2\"\\<close>, \\<^cite>\\<open>\"R3\"\\<close>, and \\<^cite>\\<open>\"R4\"\\<close>.\n\nThroughout this paper, the salient points of definitions and proofs are commented; for additional\ninformation, cf. Isabelle documentation, particularly \\<^cite>\\<open>\"R7\"\\<close>, \\<^cite>\\<open>\"R8\"\\<close>, \\<^cite>\\<open>\"R9\"\\<close>, and\n\\<^cite>\\<open>\"R10\"\\<close>.\n\\<close>\n\n\nsubsection \"Propaedeutic definitions and lemmas\"\n\ntext \\<open>\nThe starting point is comprised of some definitions and lemmas propaedeutic to the proof of the\ntarget security conservation theorem.\n\nParticularly, the definition of operator \\emph{after} given in \\<^cite>\\<open>\"R6\"\\<close> is formalized, and it is\nproven that for any secure process @{term P} and any trace @{term xs} of @{term P}, @{term P} after\n@{term xs} is still a secure process. Then, this result is used to generalize the lemma stating the\nclosure of the failures of a secure process @{term P} under intransitive purge, proven in \\<^cite>\\<open>\"R5\"\\<close>,\nto the futures of @{term P} associated to any one of its traces. This is a generalization of the\nformer result since @{term \"futures P xs = failures P\"} for @{term \"xs = []\"}.\n\n\\null\n\\<close>\n\nlemma sinks_aux_elem [rule_format]:\n \"u \\<in> sinks_aux I D U xs \\<longrightarrow> u \\<in> U \\<or> (\\<exists>x \\<in> set xs. u = D x)\"\nby (induction xs rule: rev_induct, simp_all, blast)\n\nlemma ipurge_ref_aux_cons:\n \"ipurge_ref_aux I D U (x # xs) X = ipurge_ref_aux I D (sinks_aux I D U [x]) xs X\"\nby (subgoal_tac \"x # xs = [x] @ xs\", simp only: ipurge_ref_aux_append, simp)\n\nlemma process_rule_1_futures:\n \"xs \\<in> traces P \\<Longrightarrow> ([], {}) \\<in> futures P xs\"\nby (simp add: futures_def, rule traces_failures)\n\nlemma process_rule_3_futures:\n \"(ys, Y) \\<in> futures P xs \\<Longrightarrow> Y' \\<subseteq> Y \\<Longrightarrow> (ys, Y') \\<in> futures P xs\"\nby (simp add: futures_def, rule process_rule_3)\n\nlemma process_rule_4_futures:\n \"(ys, Y) \\<in> futures P xs \\<Longrightarrow>\n    (ys @ [x], {}) \\<in> futures P xs \\<or> (ys, insert x Y) \\<in> futures P xs\"\nby (simp add: futures_def, subst append_assoc [symmetric], rule process_rule_4)\n\nlemma process_rule_5_general [rule_format]:\n \"xs \\<in> divergences P \\<longrightarrow> xs @ ys \\<in> divergences P\"\nproof (induction ys rule: rev_induct, simp, rule impI, simp)\nqed (subst append_assoc [symmetric], rule process_rule_5)\n\ntext \\<open>\n\\null\n\nHere below is the definition of operator \\emph{after}, for which a symbolic notation similar to the\none used in \\<^cite>\\<open>\"R6\"\\<close> is introduced. Then, it is proven that for any process @{term P} and any trace\n@{term xs} of @{term P}, the failures set and the divergences set of @{term P} after @{term xs}\nindeed enjoy their respective characteristic properties as defined in \\<^cite>\\<open>\"R1\"\\<close>.\n\n\\null\n\\<close>\n\ndefinition future_divergences :: \"'a process \\<Rightarrow> 'a list \\<Rightarrow> 'a list set\" where\n\"future_divergences P xs \\<equiv> {ys. xs @ ys \\<in> divergences P}\"\n\ndefinition after :: \"'a process \\<Rightarrow> 'a list \\<Rightarrow> 'a process\" (infixl \"\\<setminus>\" 64) where\n\"P \\<setminus> xs \\<equiv> Abs_process (futures P xs, future_divergences P xs)\"\n\nlemma process_rule_5_futures:\n \"ys \\<in> future_divergences P xs \\<Longrightarrow> ys @ [x] \\<in> future_divergences P xs\"\nby (simp add: future_divergences_def, subst append_assoc [symmetric],\n rule process_rule_5)\n\nlemma process_rule_6_futures:\n \"ys \\<in> future_divergences P xs \\<Longrightarrow> (ys, Y) \\<in> futures P xs\"\nby (simp add: futures_def future_divergences_def, rule process_rule_6)\n\nlemma after_rep:\n  assumes A: \"xs \\<in> traces P\"\n  shows \"Rep_process (P \\<setminus> xs) = (futures P xs, future_divergences P xs)\"\n    (is \"_ = ?X\")\nproof (subst after_def, rule Abs_process_inverse, simp add: process_set_def,\n (subst conj_assoc [symmetric])+, (rule conjI)+)\n  show \"process_prop_1 ?X\"\n  proof (simp add: process_prop_1_def)\n  qed (rule process_rule_1_futures [OF A])\nnext\n  show \"process_prop_2 ?X\"\n  proof (simp add: process_prop_2_def del: all_simps, (rule allI)+, rule impI)\n  qed (rule process_rule_2_futures)\nnext\n  show \"process_prop_3 ?X\"\n  proof (simp add: process_prop_3_def del: all_simps, (rule allI)+, rule impI,\n   erule conjE)\n  qed (rule process_rule_3_futures)\nnext\n  show \"process_prop_4 ?X\"\n  proof (simp add: process_prop_4_def, (rule allI)+, rule impI)\n  qed (rule process_rule_4_futures)\nnext\n  show \"process_prop_5 ?X\"\n  proof (simp add: process_prop_5_def, rule allI, rule impI, rule allI)\n  qed (rule process_rule_5_futures)\nnext\n  show \"process_prop_6 ?X\"\n  proof (simp add: process_prop_6_def, rule allI, rule impI, rule allI)\n  qed (rule process_rule_6_futures)\nqed\n\nlemma after_failures:\n  assumes A: \"xs \\<in> traces P\"\n  shows \"failures (P \\<setminus> xs) = futures P xs\"\nby (simp add: failures_def after_rep [OF A])\n\nlemma after_futures:\n  assumes A: \"xs \\<in> traces P\"\n  shows \"futures (P \\<setminus> xs) ys = futures P (xs @ ys)\"\nby (simp add: futures_def after_failures [OF A])\n\ntext \\<open>\n\\null\n\nFinally, the closure of the futures of a secure process under intransitive purge is proven.\n\n\\null\n\\<close>\n\nlemma after_secure:\n  assumes A: \"xs \\<in> traces P\"\n  shows \"secure P I D \\<Longrightarrow> secure (P \\<setminus> xs) I D\"\nby (simp add: secure_def after_futures [OF A], blast)\n\nlemma ipurge_tr_ref_aux_futures:\n \"\\<lbrakk>secure P I D; (ys, Y) \\<in> futures P xs\\<rbrakk> \\<Longrightarrow>\n    (ipurge_tr_aux I D U ys, ipurge_ref_aux I D U ys Y) \\<in> futures P xs\"\nproof (subgoal_tac \"xs \\<in> traces P\", simp add: after_failures [symmetric],\n rule ipurge_tr_ref_aux_failures, rule after_secure, assumption+)\nqed (simp add: futures_def, drule failures_traces, rule process_rule_2_traces)\n\nlemma ipurge_tr_ref_aux_failures_general:\n \"\\<lbrakk>secure P I D; (xs @ ys, Y) \\<in> failures P\\<rbrakk> \\<Longrightarrow>\n    (xs @ ipurge_tr_aux I D U ys, ipurge_ref_aux I D U ys Y) \\<in> failures P\"\nby (drule ipurge_tr_ref_aux_futures, simp_all add: futures_def)\n\n\nsubsection \"Concurrent composition\"\n\ntext \\<open>\nIn \\<^cite>\\<open>\"R6\"\\<close>, the concurrent composition of two processes @{term P}, @{term Q}, expressed using\nnotation \\<open>P \\<parallel> Q\\<close>, is defined as a process whose alphabet is the union of the alphabets of\n@{term P} and @{term Q}, so that the shared events requiring the synchronous participation of both\nprocesses are those in the intersection of their alphabets.\n\nIn the formalization of Communicating Sequential Processes developed in \\<^cite>\\<open>\"R1\"\\<close>, the alphabets of\n@{term P} and @{term Q} are the data types @{typ 'a} and @{typ 'b} nested in their respective types\n@{typ \"'a process\"} and @{typ \"'b process\"}. Therefore, for any two maps @{term \"p :: 'a \\<Rightarrow> 'c\"},\n@{term \"q :: 'b \\<Rightarrow> 'c\"}, the concurrent composition of @{term P} and @{term Q} with respect to\n@{term p} and @{term q}, expressed using notation \\<open>P \\<parallel> Q <p, q>\\<close>, is defined in what follows\nas a process of type @{typ \"'c process\"}, where meaningful events are those in\n@{term \"range p \\<union> range q\"} and shared events are those in @{term \"range p \\<inter> range q\"}.\n\nThe case where @{term \"- (range p \\<union> range q) \\<noteq> {}\"} constitutes a generalization of the definition\ngiven in \\<^cite>\\<open>\"R6\"\\<close>, and the events in @{term \"- (range p \\<union> range q)\"}, not being mapped to any event\nin the alphabets of the input processes, shall be understood as fake events lacking any meaning.\nConsistently with this interpretation, such events are allowed to occur in divergent traces only --\nnecessarily, since divergences are capable by definition of giving rise to any sort of event. As a\nresult, while in \\<^cite>\\<open>\"R6\"\\<close> the refusals associated to non-divergent traces are the union of two\nsets, a refusal of @{term P} and a refusal of @{term Q}, in the following definition they are the\nunion of three sets instead, where the third set is any subset of @{term \"- (range p \\<union> range q)\"}.\n\nSince the definition given in \\<^cite>\\<open>\"R6\"\\<close> preserves the identity of the events of the input processes,\na further generalization resulting from the following definition corresponds to the case where\neither map @{term p}, @{term q} is not injective. However, as shown below, these generalizations\nturn out to compromise neither the compliance of the output of concurrent composition with the\ncharacteristic properties of processes as defined in \\<^cite>\\<open>\"R1\"\\<close>, nor even the validity of the target\nsecurity conservation theorem.\n\nSince divergences can contain fake events, whereas non-divergent traces cannot, it is necessary to\nadd divergent failures to the failures set explicitly. The following definition of the divergences\nset restricts the definition given in \\<^cite>\\<open>\"R6\"\\<close>, as it identifies a divergence with an arbitrary\nextension of an event sequence @{term xs} being a divergence of both @{term P} and @{term Q}, rather\nthan a divergence of either process and a trace of the other one. This is a reasonable restriction,\nin that it requires the concurrent composition of @{term P} and @{term Q} to admit a shared event\n@{term x} in a divergent trace just in case both @{term P} and @{term Q} diverge and can then accept\n@{term x}, analogously to what is required for a non-divergent trace. Anyway, the definitions match\nif the input processes do not diverge, which is the case for any process of practical significance\n(cf. \\<^cite>\\<open>\"R6\"\\<close>).\n\n\\null\n\\<close>\n\ndefinition con_comp_divergences ::\n \"'a process \\<Rightarrow> 'b process \\<Rightarrow> ('a \\<Rightarrow> 'c) \\<Rightarrow> ('b \\<Rightarrow> 'c) \\<Rightarrow> 'c list set\" where\n\"con_comp_divergences P Q p q \\<equiv>\n  {xs @ ys | xs ys.\n    set xs \\<subseteq> range p \\<union> range q \\<and>\n    map (inv p) [x\\<leftarrow>xs. x \\<in> range p] \\<in> divergences P \\<and>\n    map (inv q) [x\\<leftarrow>xs. x \\<in> range q] \\<in> divergences Q}\"\n\ndefinition con_comp_failures ::\n \"'a process \\<Rightarrow> 'b process \\<Rightarrow> ('a \\<Rightarrow> 'c) \\<Rightarrow> ('b \\<Rightarrow> 'c) \\<Rightarrow> 'c failure set\" where\n\"con_comp_failures P Q p q \\<equiv>\n  {(xs, X \\<union> Y \\<union> Z) | xs X Y Z.\n    set xs \\<subseteq> range p \\<union> range q \\<and>\n    X \\<subseteq> range p \\<and> Y \\<subseteq> range q \\<and> Z \\<subseteq> - (range p \\<union> range q) \\<and>\n    (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` X) \\<in> failures P \\<and>\n    (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` Y) \\<in> failures Q} \\<union>\n  {(xs, X). xs \\<in> con_comp_divergences P Q p q}\"\n\ndefinition con_comp ::\n \"'a process \\<Rightarrow> 'b process \\<Rightarrow> ('a \\<Rightarrow> 'c) \\<Rightarrow> ('b \\<Rightarrow> 'c) \\<Rightarrow> 'c process\" where\n\"con_comp P Q p q \\<equiv>\n  Abs_process (con_comp_failures P Q p q, con_comp_divergences P Q p q)\"\n\nabbreviation con_comp_syntax ::\n \"'a process \\<Rightarrow> 'b process \\<Rightarrow> ('a \\<Rightarrow> 'c) \\<Rightarrow> ('b \\<Rightarrow> 'c) \\<Rightarrow> 'c process\"\n (\"(_ \\<parallel> _ <_, _>)\" 55)\nwhere\n\"P \\<parallel> Q <p, q> \\<equiv> con_comp P Q p q\"\n\ntext \\<open>\n\\null\n\nHere below is the proof that, for any two processes @{term P}, @{term Q} and any two maps @{term p},\n@{term q}, sets @{term \"con_comp_failures P Q p q\"} and @{term \"con_comp_divergences P Q p q\"} enjoy\nthe characteristic properties of the failures and the divergences sets of a process as defined in\n\\<^cite>\\<open>\"R1\"\\<close>.\n\n\\null\n\\<close>\n\nlemma con_comp_prop_1:\n \"([], {}) \\<in> con_comp_failures P Q p q\"\nproof (simp add: con_comp_failures_def)\nqed (rule disjI1, rule conjI, (rule process_rule_1)+)\n\n\n\nlemma con_comp_prop_3:\n \"\\<lbrakk>(xs, Y) \\<in> con_comp_failures P Q p q; X \\<subseteq> Y\\<rbrakk> \\<Longrightarrow>\n    (xs, X) \\<in> con_comp_failures P Q p q\"\nproof (simp add: con_comp_failures_def, erule disjE, simp_all,\n (erule exE)+, (erule conjE)+, rule disjI1, simp)\n  fix X' Y' Z'\n  assume\n    A: \"X \\<subseteq> X' \\<union> Y' \\<union> Z'\" and\n    B: \"X' \\<subseteq> range p\" and\n    C: \"Y' \\<subseteq> range q\" and\n    D: \"Z' \\<subseteq> - range p\" and\n    E: \"Z' \\<subseteq> - range q\" and\n    F: \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` X') \\<in> failures P\" and\n    G: \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` Y') \\<in> failures Q\"\n  show \"\\<exists>X' Y' Z'.\n    X = X' \\<union> Y' \\<union> Z' \\<and>\n    X' \\<subseteq> range p \\<and>\n    Y' \\<subseteq> range q \\<and>\n    Z' \\<subseteq> - range p \\<and>\n    Z' \\<subseteq> - range q \\<and>\n    (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` X') \\<in> failures P \\<and>\n    (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` Y') \\<in> failures Q\"\n  proof (rule_tac x = \"X' \\<inter> X\" in exI, rule_tac x = \"Y' \\<inter> X\" in exI,\n   rule_tac x = \"Z' \\<inter> X\" in exI, (subst conj_assoc [symmetric])+, (rule conjI)+)\n    show \"X = X' \\<inter> X \\<union> Y' \\<inter> X \\<union> Z' \\<inter> X\"\n     using A by blast\n  next\n    show \"X' \\<inter> X \\<subseteq> range p\"\n     using B by blast\n  next\n    show \"Y' \\<inter> X \\<subseteq> range q\"\n     using C by blast\n  next\n    show \"Z' \\<inter> X \\<subseteq> - range p\"\n     using D by blast\n  next\n    show \"Z' \\<inter> X \\<subseteq> - range q\"\n     using E by blast\n  next\n    have \"inv p ` (X' \\<inter> X) \\<subseteq> inv p ` X'\"\n     by blast\n    with F show \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` (X' \\<inter> X))\n      \\<in> failures P\"\n     by (rule process_rule_3)\n  next\n    have \"inv q ` (Y' \\<inter> X) \\<subseteq> inv q ` Y'\"\n     by blast\n    with G show \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` (Y' \\<inter> X))\n      \\<in> failures Q\"\n     by (rule process_rule_3)\n  qed\nqed\n\nlemma con_comp_prop_4:\n \"(xs, X) \\<in> con_comp_failures P Q p q \\<Longrightarrow>\n    (xs @ [x], {}) \\<in> con_comp_failures P Q p q \\<or>\n    (xs, insert x X) \\<in> con_comp_failures P Q p q\"\nproof (simp add: con_comp_failures_def del: filter_append,\n erule disjE, (erule exE)+, (erule conjE)+, simp_all del: filter_append)\n  fix X Y Z\n  assume\n    A: \"X \\<subseteq> range p\" and\n    B: \"Y \\<subseteq> range q\" and\n    C: \"Z \\<subseteq> - range p\" and\n    D: \"Z \\<subseteq> - range q\" and\n    E: \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` X) \\<in> failures P\" and\n    F: \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` Y) \\<in> failures Q\"\n  show\n   \"(x \\<in> range p \\<or> x \\<in> range q) \\<and>\n      (map (inv p) [x\\<leftarrow>xs @ [x]. x \\<in> range p], {}) \\<in> failures P \\<and>\n      (map (inv q) [x\\<leftarrow>xs @ [x]. x \\<in> range q], {}) \\<in> failures Q \\<or>\n    xs @ [x] \\<in> con_comp_divergences P Q p q \\<or>\n    (\\<exists>X' Y' Z'.\n      insert x (X \\<union> Y \\<union> Z) = X' \\<union> Y' \\<union> Z' \\<and>\n      X' \\<subseteq> range p \\<and>\n      Y' \\<subseteq> range q \\<and>\n      Z' \\<subseteq> - range p \\<and>\n      Z' \\<subseteq> - range q \\<and>\n      (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` X') \\<in> failures P \\<and>\n      (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` Y') \\<in> failures Q) \\<or>\n    xs \\<in> con_comp_divergences P Q p q\"\n    (is \"_ \\<or> _ \\<or> ?A \\<or> _\")\n  proof (cases \"x \\<in> range p\", case_tac [!] \"x \\<in> range q\", simp_all)\n    assume\n      G: \"x \\<in> range p\" and\n      H: \"x \\<in> range q\"\n    show\n     \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @ [inv p x], {}) \\<in> failures P \\<and>\n        (map (inv q) [x\\<leftarrow>xs. x \\<in> range q] @ [inv q x], {}) \\<in> failures Q \\<or>\n      xs @ [x] \\<in> con_comp_divergences P Q p q \\<or>\n      ?A \\<or>\n      xs \\<in> con_comp_divergences P Q p q\"\n      (is \"?B \\<or> _\")\n    proof (cases ?B, simp_all del: disj_not1, erule disjE)\n      assume\n        I: \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @ [inv p x], {}) \\<notin> failures P\"\n      have ?A\n      proof (rule_tac x = \"insert x X\" in exI, rule_tac x = \"Y\" in exI,\n       rule_tac x = \"Z\" in exI, (subst conj_assoc [symmetric])+, (rule conjI)+)\n        show \"insert x (X \\<union> Y \\<union> Z) = insert x X \\<union> Y \\<union> Z\"\n         by simp\n      next\n        show \"insert x X \\<subseteq> range p\"\n         using A and G by simp\n      next\n        show \"Y \\<subseteq> range q\"\n         using B .\n      next\n        show \"Z \\<subseteq> - range p\"\n         using C .\n      next\n        show \"Z \\<subseteq> - range q\"\n         using D .\n      next\n        have\n         \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @ [inv p x], {})\n            \\<in> failures P \\<or>\n          (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], insert (inv p x) (inv p ` X))\n            \\<in> failures P\"\n         using E by (rule process_rule_4)\n        thus \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` insert x X) \\<in> failures P\"\n         using I by simp\n      next\n        show \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` Y) \\<in> failures Q\"\n         using F .\n      qed\n      thus ?thesis\n       by simp\n    next\n      assume\n        I: \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q] @ [inv q x], {}) \\<notin> failures Q\"\n      have ?A\n      proof (rule_tac x = \"X\" in exI, rule_tac x = \"insert x Y\" in exI,\n       rule_tac x = \"Z\" in exI, (subst conj_assoc [symmetric])+, (rule conjI)+)\n        show \"insert x (X \\<union> Y \\<union> Z) = X \\<union> insert x Y \\<union> Z\"\n         by simp\n      next\n        show \"X \\<subseteq> range p\"\n         using A .\n      next\n        show \"insert x Y \\<subseteq> range q\"\n         using B and H by simp\n      next\n        show \"Z \\<subseteq> - range p\"\n         using C .\n      next\n        show \"Z \\<subseteq> - range q\"\n         using D .\n      next\n        show \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` X) \\<in> failures P\"\n         using E .\n      next\n        have\n         \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q] @ [inv q x], {})\n            \\<in> failures Q \\<or>\n          (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], insert (inv q x) (inv q ` Y))\n            \\<in> failures Q\"\n         using F by (rule process_rule_4)\n        thus \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` insert x Y) \\<in> failures Q\"\n         using I by simp\n      qed\n      thus ?thesis\n       by simp\n    qed\n  next\n    assume G: \"x \\<in> range p\"\n    show\n     \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @ [inv p x], {}) \\<in> failures P \\<and>\n        (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], {}) \\<in> failures Q \\<or>\n      xs @ [x] \\<in> con_comp_divergences P Q p q \\<or>\n      ?A \\<or>\n      xs \\<in> con_comp_divergences P Q p q\"\n    proof (cases \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @ [inv p x], {})\n     \\<in> failures P\")\n      case True\n      moreover have \"{} \\<subseteq> inv q ` Y\" ..\n      with F have \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], {}) \\<in> failures Q\"\n       by (rule process_rule_3)\n      ultimately show ?thesis\n       by simp\n    next\n      case False\n      have ?A\n      proof (rule_tac x = \"insert x X\" in exI, rule_tac x = \"Y\" in exI,\n       rule_tac x = \"Z\" in exI, (subst conj_assoc [symmetric])+, (rule conjI)+)\n        show \"insert x (X \\<union> Y \\<union> Z) = insert x X \\<union> Y \\<union> Z\"\n         by simp\n      next\n        show \"insert x X \\<subseteq> range p\"\n         using A and G by simp\n      next\n        show \"Y \\<subseteq> range q\"\n         using B .\n      next\n        show \"Z \\<subseteq> - range p\"\n         using C .\n      next\n        show \"Z \\<subseteq> - range q\"\n         using D .\n      next\n        have\n         \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @ [inv p x], {})\n            \\<in> failures P \\<or>\n          (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], insert (inv p x) (inv p ` X))\n            \\<in> failures P\"\n         using E by (rule process_rule_4)\n        thus \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` insert x X) \\<in> failures P\"\n         using False by simp\n      next\n        show \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` Y) \\<in> failures Q\"\n         using F .\n      qed\n      thus ?thesis\n       by simp\n    qed\n  next\n    assume G: \"x \\<in> range q\"\n    show\n     \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], {}) \\<in> failures P \\<and>\n        (map (inv q) [x\\<leftarrow>xs. x \\<in> range q] @ [inv q x], {}) \\<in> failures Q \\<or>\n      xs @ [x] \\<in> con_comp_divergences P Q p q \\<or>\n      ?A \\<or>\n      xs \\<in> con_comp_divergences P Q p q\"\n    proof (cases \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q] @ [inv q x], {})\n     \\<in> failures Q\")\n      case True\n      moreover have \"{} \\<subseteq> inv p ` X\" ..\n      with E have \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], {}) \\<in> failures P\"\n       by (rule process_rule_3)\n      ultimately show ?thesis\n       by simp\n    next\n      case False\n      have ?A\n      proof (rule_tac x = \"X\" in exI, rule_tac x = \"insert x Y\" in exI,\n       rule_tac x = \"Z\" in exI, (subst conj_assoc [symmetric])+, (rule conjI)+)\n        show \"insert x (X \\<union> Y \\<union> Z) = X \\<union> insert x Y \\<union> Z\"\n         by simp\n      next\n        show \"X \\<subseteq> range p\"\n         using A .\n      next\n        show \"insert x Y \\<subseteq> range q\"\n         using B and G by simp\n      next\n        show \"Z \\<subseteq> - range p\"\n         using C .\n      next\n        show \"Z \\<subseteq> - range q\"\n         using D .\n      next\n        show \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` X) \\<in> failures P\"\n         using E .\n      next\n        have\n         \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q] @ [inv q x], {})\n            \\<in> failures Q \\<or>\n          (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], insert (inv q x) (inv q ` Y))\n            \\<in> failures Q\"\n         using F by (rule process_rule_4)\n        thus \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` insert x Y) \\<in> failures Q\"\n         using False by simp\n      qed\n      thus ?thesis\n       by simp\n    qed\n  next\n    assume\n      G: \"x \\<notin> range p\" and\n      H: \"x \\<notin> range q\"\n    have ?A\n    proof (rule_tac x = \"X\" in exI, rule_tac x = \"Y\" in exI,\n     rule_tac x = \"insert x Z\" in exI, (subst conj_assoc [symmetric])+,\n     (rule conjI)+)\n      show \"insert x (X \\<union> Y \\<union> Z) = X \\<union> Y \\<union> insert x Z\"\n       by simp\n    next\n      show \"X \\<subseteq> range p\"\n       using A .\n    next\n      show \"Y \\<subseteq> range q\"\n       using B .\n    next\n      show \"insert x Z \\<subseteq> - range p\"\n       using C and G by simp\n    next\n      show \"insert x Z \\<subseteq> - range q\"\n       using D and H by simp\n    next\n      show \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` X) \\<in> failures P\"\n       using E .\n    next\n      show \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` Y) \\<in> failures Q\"\n       using F .\n    qed\n    thus\n     \"xs @ [x] \\<in> con_comp_divergences P Q p q \\<or>\n      ?A \\<or>\n      xs \\<in> con_comp_divergences P Q p q\"\n     by simp\n  qed\nqed\n\n\n\nlemma con_comp_prop_6:\n \"xs \\<in> con_comp_divergences P Q p q \\<Longrightarrow>\n    (xs, X) \\<in> con_comp_failures P Q p q\"\nby (simp add: con_comp_failures_def)\n\nlemma con_comp_rep:\n \"Rep_process (P \\<parallel> Q <p, q>) =\n    (con_comp_failures P Q p q, con_comp_divergences P Q p q)\"\n  (is \"_ = ?X\")\nproof (subst con_comp_def, rule Abs_process_inverse, simp add: process_set_def,\n (subst conj_assoc [symmetric])+, (rule conjI)+)\n  show \"process_prop_1 ?X\"\n  proof (simp add: process_prop_1_def)\n  qed (rule con_comp_prop_1)\nnext\n  show \"process_prop_2 ?X\"\n  proof (simp add: process_prop_2_def del: all_simps, (rule allI)+, rule impI)\n  qed (rule con_comp_prop_2)\nnext\n  show \"process_prop_3 ?X\"\n  proof (simp add: process_prop_3_def del: all_simps, (rule allI)+, rule impI,\n   erule conjE)\n  qed (rule con_comp_prop_3)\nnext\n  show \"process_prop_4 ?X\"\n  proof (simp add: process_prop_4_def, (rule allI)+, rule impI)\n  qed (rule con_comp_prop_4)\nnext\n  show \"process_prop_5 ?X\"\n  proof (simp add: process_prop_5_def, rule allI, rule impI, rule allI)\n  qed (rule con_comp_prop_5)\nnext\n  show \"process_prop_6 ?X\"\n  proof (simp add: process_prop_6_def, rule allI, rule impI, rule allI)\n  qed (rule con_comp_prop_6)\nqed\n\ntext \\<open>\n\\null\n\nHere below, the previous result is applied to derive useful expressions for the outputs of the\nfunctions returning the elements of a process, as defined in \\<^cite>\\<open>\"R1\"\\<close> and \\<^cite>\\<open>\"R2\"\\<close>, when acting on\nthe concurrent composition of a pair of processes.\n\n\\null\n\\<close>\n\nlemma con_comp_failures:\n \"failures (P \\<parallel> Q <p, q>) = con_comp_failures P Q p q\"\nby (simp add: failures_def con_comp_rep)\n\nlemma con_comp_divergences:\n \"divergences (P \\<parallel> Q <p, q>) = con_comp_divergences P Q p q\"\nby (simp add: divergences_def con_comp_rep)\n\nlemma con_comp_futures:\n \"futures (P \\<parallel> Q <p, q>) xs =\n    {(ys, Y). (xs @ ys, Y) \\<in> con_comp_failures P Q p q}\"\nby (simp add: futures_def con_comp_failures)\n\nlemma con_comp_traces:\n \"traces (P \\<parallel> Q <p, q>) = Domain (con_comp_failures P Q p q)\"\nby (simp add: traces_def con_comp_failures)\n\nlemma con_comp_refusals:\n \"refusals (P \\<parallel> Q <p, q>) xs \\<equiv> con_comp_failures P Q p q `` {xs}\"\nby (simp add: refusals_def con_comp_failures)\n\nlemma con_comp_next_events:\n \"next_events (P \\<parallel> Q <p, q>) xs =\n    {x. xs @ [x] \\<in> Domain (con_comp_failures P Q p q)}\"\nby (simp add: next_events_def con_comp_traces)\n\ntext \\<open>\n\\null\n\nIn what follows, three lemmas are proven. The first one, whose proof makes use of the axiom of\nchoice, establishes an additional property required for the above definition of concurrent\ncomposition to be correct, namely that for any two processes whose refusals are closed under set\nunion, their concurrent composition still be such, which is what is expected for any process of\npractical significance (cf. \\<^cite>\\<open>\"R2\"\\<close>). The other two lemmas are auxiliary properties of concurrent\ncomposition used in the proof of the target security conservation theorem.\n\n\\null\n\\<close>\n\nlemma con_comp_ref_union_closed:\n  assumes\n    A: \"ref_union_closed P\" and\n    B: \"ref_union_closed Q\"\n  shows \"ref_union_closed (P \\<parallel> Q <p, q>)\"\nproof (simp add: ref_union_closed_def con_comp_failures con_comp_failures_def\n con_comp_divergences_def del: SUP_identity_eq cong: SUP_cong_simp, (rule allI)+, (rule impI)+,\n erule exE, rule disjI1)\n  fix xs A X\n  assume \"\\<forall>X \\<in> A. \\<exists>R S T.\n    X = R \\<union> S \\<union> T \\<and>\n    set xs \\<subseteq> range p \\<union> range q \\<and>\n    R \\<subseteq> range p \\<and>\n    S \\<subseteq> range q \\<and>\n    T \\<subseteq> - range p \\<and>\n    T \\<subseteq> - range q \\<and>\n    (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` R) \\<in> failures P \\<and>\n    (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` S) \\<in> failures Q\"\n    (is \"\\<forall>X \\<in> A. \\<exists>R S T. ?F X R S T\")\n  hence \"\\<exists>r. \\<forall>X \\<in> A. \\<exists>S T. ?F X (r X) S T\"\n   by (rule bchoice)\n  then obtain r where \"\\<forall>X \\<in> A. \\<exists>S T. ?F X (r X) S T\" ..\n  hence \"\\<exists>s. \\<forall>X \\<in> A. \\<exists>T. ?F X (r X) (s X) T\"\n   by (rule bchoice)\n  then obtain s where \"\\<forall>X \\<in> A. \\<exists>T. ?F X (r X) (s X) T\" ..\n  hence \"\\<exists>t. \\<forall>X \\<in> A. ?F X (r X) (s X) (t X)\"\n   by (rule bchoice)\n  then obtain t where C: \"\\<forall>X \\<in> A. ?F X (r X) (s X) (t X)\" ..\n  assume D: \"X \\<in> A\"\n  show \"\\<exists>R S T. ?F (\\<Union>X \\<in> A. X) R S T\"\n  proof (rule_tac x = \"\\<Union>X \\<in> A. r X\" in exI, rule_tac x = \"\\<Union>X \\<in> A. s X\" in exI,\n   rule_tac x = \"\\<Union>X \\<in> A. t X\" in exI, (subst conj_assoc [symmetric])+,\n   (rule conjI)+)\n    show \"(\\<Union>X \\<in> A. X) = (\\<Union>X \\<in> A. r X) \\<union> (\\<Union>X \\<in> A. s X) \\<union> (\\<Union>X \\<in> A. t X)\"\n    proof (simp add: set_eq_iff, rule allI, rule iffI, erule_tac [2] disjE,\n     erule_tac [3] disjE, erule_tac [!] bexE)\n      fix x X\n      have \"\\<forall>X \\<in> A. X = r X \\<union> s X \\<union> t X\"\n       using C by simp\n      moreover assume E: \"X \\<in> A\"\n      ultimately have \"X = r X \\<union> s X \\<union> t X\" ..\n      moreover assume \"x \\<in> X\"\n      ultimately have \"x \\<in> r X \\<or> x \\<in> s X \\<or> x \\<in> t X\"\n       by blast\n      hence \"\\<exists>X \\<in> A. x \\<in> r X \\<or> x \\<in> s X \\<or> x \\<in> t X\"\n       using E ..\n      thus \"(\\<exists>X \\<in> A. x \\<in> r X) \\<or> (\\<exists>X \\<in> A. x \\<in> s X) \\<or> (\\<exists>X \\<in> A. x \\<in> t X)\"\n       by blast\n    next\n      fix x X\n      have \"\\<forall>X \\<in> A. X = r X \\<union> s X \\<union> t X\"\n       using C by simp\n      moreover assume E: \"X \\<in> A\"\n      ultimately have \"X = r X \\<union> s X \\<union> t X\" ..\n      moreover assume \"x \\<in> r X\"\n      ultimately have \"x \\<in> X\"\n       by blast\n      thus \"\\<exists>X \\<in> A. x \\<in> X\"\n       using E ..\n    next\n      fix x X\n      have \"\\<forall>X \\<in> A. X = r X \\<union> s X \\<union> t X\"\n       using C by simp\n      moreover assume E: \"X \\<in> A\"\n      ultimately have \"X = r X \\<union> s X \\<union> t X\" ..\n      moreover assume \"x \\<in> s X\"\n      ultimately have \"x \\<in> X\"\n       by blast\n      thus \"\\<exists>X \\<in> A. x \\<in> X\"\n       using E ..\n    next\n      fix x X\n      have \"\\<forall>X \\<in> A. X = r X \\<union> s X \\<union> t X\"\n       using C by simp\n      moreover assume E: \"X \\<in> A\"\n      ultimately have \"X = r X \\<union> s X \\<union> t X\" ..\n      moreover assume \"x \\<in> t X\"\n      ultimately have \"x \\<in> X\"\n       by blast\n      thus \"\\<exists>X \\<in> A. x \\<in> X\"\n       using E ..\n    qed\n  next\n    have \"\\<forall>X \\<in> A. set xs \\<subseteq> range p \\<union> range q\"\n     using C by simp\n    thus \"set xs \\<subseteq> range p \\<union> range q\"\n     using D ..\n  next\n    show \"(\\<Union>X \\<in> A. r X) \\<subseteq> range p\"\n    proof (rule subsetI, erule UN_E)\n      fix x X\n      have \"\\<forall>X \\<in> A. r X \\<subseteq> range p\"\n       using C by simp\n      moreover assume \"X \\<in> A\"\n      ultimately have \"r X \\<subseteq> range p\" ..\n      moreover assume \"x \\<in> r X\"\n      ultimately show \"x \\<in> range p\" ..\n    qed\n  next\n    show \"(\\<Union>X \\<in> A. s X) \\<subseteq> range q\"\n    proof (rule subsetI, erule UN_E)\n      fix x X\n      have \"\\<forall>X \\<in> A. s X \\<subseteq> range q\"\n       using C by simp\n      moreover assume \"X \\<in> A\"\n      ultimately have \"s X \\<subseteq> range q\" ..\n      moreover assume \"x \\<in> s X\"\n      ultimately show \"x \\<in> range q\" ..\n    qed\n  next\n    show \"(\\<Union>X \\<in> A. t X) \\<subseteq> - range p\"\n    proof (rule subsetI, erule UN_E)\n      fix x X\n      have \"\\<forall>X \\<in> A. t X \\<subseteq> - range p\"\n       using C by simp\n      moreover assume \"X \\<in> A\"\n      ultimately have \"t X \\<subseteq> - range p\" ..\n      moreover assume \"x \\<in> t X\"\n      ultimately show \"x \\<in> - range p\" ..\n    qed\n  next\n    show \"(\\<Union>X \\<in> A. t X) \\<subseteq> - range q\"\n    proof (rule subsetI, erule UN_E)\n      fix x X\n      have \"\\<forall>X \\<in> A. t X \\<subseteq> - range q\"\n       using C by simp\n      moreover assume \"X \\<in> A\"\n      ultimately have \"t X \\<subseteq> - range q\" ..\n      moreover assume \"x \\<in> t X\"\n      ultimately show \"x \\<in> - range q\" ..\n    qed\n  next\n    let ?A' = \"{inv p ` X | X. X \\<in> r ` A}\"\n    have\n     \"(\\<exists>X. X \\<in> ?A') \\<longrightarrow>\n      (\\<forall>X \\<in> ?A'. (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], X) \\<in> failures P) \\<longrightarrow>\n        (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], \\<Union>X \\<in> ?A'. X) \\<in> failures P\"\n     using A by (simp add: ref_union_closed_def)\n    moreover have \"\\<exists>X. X \\<in> ?A'\"\n     using D by blast\n    ultimately have\n     \"(\\<forall>X \\<in> ?A'. (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], X) \\<in> failures P) \\<longrightarrow>\n        (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], \\<Union>X \\<in> ?A'. X) \\<in> failures P\" ..\n    moreover have\n     \"\\<forall>X \\<in> ?A'. (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], X) \\<in> failures P\"\n    proof (rule ballI, simp, erule exE, erule conjE)\n      fix R R'\n      assume \"R \\<in> r ` A\"\n      hence \"\\<exists>X \\<in> A. R = r X\"\n       by (simp add: image_iff)\n      then obtain X where E: \"X \\<in> A\" and F: \"R = r X\" ..\n      have \"\\<forall>X \\<in> A. (map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` r X) \\<in> failures P\"\n       using C by simp\n      hence \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` r X) \\<in> failures P\"\n       using E ..\n      moreover assume \"R' = inv p ` R\"\n      ultimately show \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], R') \\<in> failures P\"\n       using F by simp\n    qed\n    ultimately have \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], \\<Union>X \\<in> ?A'. X)\n      \\<in> failures P\" ..\n    moreover have \"(\\<Union>X \\<in> ?A'. X) = inv p ` (\\<Union>X \\<in> A. r X)\"\n    proof (subst set_eq_iff, simp, rule allI, rule iffI, (erule exE, erule conjE)+)\n      fix a R R'\n      assume \"R \\<in> r ` A\"\n      hence \"\\<exists>X \\<in> A. R = r X\"\n       by (simp add: image_iff)\n      then obtain X where E: \"X \\<in> A\" and F: \"R = r X\" ..\n      assume \"a \\<in> R'\" and \"R' = inv p ` R\"\n      hence \"a \\<in> inv p ` r X\"\n       using F by simp\n      hence \"\\<exists>x \\<in> r X. a = inv p x\"\n       by (simp add: image_iff)\n      then obtain x where G: \"x \\<in> r X\" and H: \"a = inv p x\" ..\n      have \"x \\<in> (\\<Union>X \\<in> A. r X)\"\n       using E and G by (rule UN_I)\n      with H have \"\\<exists>x \\<in> (\\<Union>X \\<in> A. r X). a = inv p x\" ..\n      thus \"a \\<in> inv p ` (\\<Union>X \\<in> A. r X)\"\n       by (simp add: image_iff)\n    next\n      fix a\n      assume \"a \\<in> inv p ` (\\<Union>X \\<in> A. r X)\"\n      hence \"\\<exists>x \\<in> (\\<Union>X \\<in> A. r X). a = inv p x\"\n       by (simp add: image_iff)\n      then obtain x where E: \"x \\<in> (\\<Union>X \\<in> A. r X)\" and F: \"a = inv p x\" ..\n      obtain X where G: \"X \\<in> A\" and H: \"x \\<in> r X\" using E ..\n      show \"\\<exists>R'. (\\<exists>R. R' = inv p ` R \\<and> R \\<in> r ` A) \\<and> a \\<in> R'\"\n      proof (rule_tac x = \"inv p ` r X\" in exI, rule conjI,\n       rule_tac x = \"r X\" in exI)\n      qed (rule_tac [2] image_eqI, simp add: G, simp add: F, simp add: H)\n    qed\n    ultimately show \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` (\\<Union>X \\<in> A. r X))\n      \\<in> failures P\"\n     by simp\n  next\n    let ?A' = \"{inv q ` X | X. X \\<in> s ` A}\"\n    have\n     \"(\\<exists>X. X \\<in> ?A') \\<longrightarrow>\n      (\\<forall>X \\<in> ?A'. (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], X) \\<in> failures Q) \\<longrightarrow>\n        (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], \\<Union>X \\<in> ?A'. X) \\<in> failures Q\"\n     using B by (simp add: ref_union_closed_def)\n    moreover have \"\\<exists>X. X \\<in> ?A'\"\n     using D by blast\n    ultimately have\n     \"(\\<forall>X \\<in> ?A'. (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], X) \\<in> failures Q) \\<longrightarrow>\n        (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], \\<Union>X \\<in> ?A'. X) \\<in> failures Q\" ..\n    moreover have\n     \"\\<forall>X \\<in> ?A'. (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], X) \\<in> failures Q\"\n    proof (rule ballI, simp, erule exE, erule conjE)\n      fix S S'\n      assume \"S \\<in> s ` A\"\n      hence \"\\<exists>X \\<in> A. S = s X\"\n       by (simp add: image_iff)\n      then obtain X where E: \"X \\<in> A\" and F: \"S = s X\" ..\n      have \"\\<forall>X \\<in> A. (map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` s X) \\<in> failures Q\"\n       using C by simp\n      hence \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` s X) \\<in> failures Q\"\n       using E ..\n      moreover assume \"S' = inv q ` S\"\n      ultimately show \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], S') \\<in> failures Q\"\n       using F by simp\n    qed\n    ultimately have \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], \\<Union>X \\<in> ?A'. X)\n      \\<in> failures Q\" ..\n    moreover have \"(\\<Union>X \\<in> ?A'. X) = inv q ` (\\<Union>X \\<in> A. s X)\"\n    proof (subst set_eq_iff, simp, rule allI, rule iffI, (erule exE, erule conjE)+)\n      fix b S S'\n      assume \"S \\<in> s ` A\"\n      hence \"\\<exists>X \\<in> A. S = s X\"\n       by (simp add: image_iff)\n      then obtain X where E: \"X \\<in> A\" and F: \"S = s X\" ..\n      assume \"b \\<in> S'\" and \"S' = inv q ` S\"\n      hence \"b \\<in> inv q ` s X\"\n       using F by simp\n      hence \"\\<exists>x \\<in> s X. b = inv q x\"\n       by (simp add: image_iff)\n      then obtain x where G: \"x \\<in> s X\" and H: \"b = inv q x\" ..\n      have \"x \\<in> (\\<Union>X \\<in> A. s X)\"\n       using E and G by (rule UN_I)\n      with H have \"\\<exists>x \\<in> (\\<Union>X \\<in> A. s X). b = inv q x\" ..\n      thus \"b \\<in> inv q ` (\\<Union>X \\<in> A. s X)\"\n       by (simp add: image_iff)\n    next\n      fix b\n      assume \"b \\<in> inv q ` (\\<Union>X \\<in> A. s X)\"\n      hence \"\\<exists>x \\<in> (\\<Union>X \\<in> A. s X). b = inv q x\"\n       by (simp add: image_iff)\n      then obtain x where E: \"x \\<in> (\\<Union>X \\<in> A. s X)\" and F: \"b = inv q x\" ..\n      obtain X where G: \"X \\<in> A\" and H: \"x \\<in> s X\" using E ..\n      show \"\\<exists>S'. (\\<exists>S. S' = inv q ` S \\<and> S \\<in> s ` A) \\<and> b \\<in> S'\"\n      proof (rule_tac x = \"inv q ` s X\" in exI, rule conjI,\n       rule_tac x = \"s X\" in exI)\n      qed (rule_tac [2] image_eqI, simp add: G, simp add: F, simp add: H)\n    qed\n    ultimately show \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` (\\<Union>X \\<in> A. s X))\n      \\<in> failures Q\"\n     by simp\n  qed\nqed\n\nlemma con_comp_failures_traces:\n \"(xs, X) \\<in> con_comp_failures P Q p q \\<Longrightarrow>\n    map (inv p) [x\\<leftarrow>xs. x \\<in> range p] \\<in> traces P \\<and>\n    map (inv q) [x\\<leftarrow>xs. x \\<in> range q] \\<in> traces Q\"\nproof (simp add: con_comp_failures_def con_comp_divergences_def, erule disjE,\n (erule exE)+, (erule conjE)+, erule_tac [2] exE, (erule_tac [2] conjE)+,\n erule_tac [2] exE)\n  fix X Y\n  assume \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` X) \\<in> failures P\"\n  hence \"map (inv p) [x\\<leftarrow>xs. x \\<in> range p] \\<in> traces P\"\n   by (rule failures_traces)\n  moreover assume \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], inv q ` Y) \\<in> failures Q\"\n  hence \"map (inv q) [x\\<leftarrow>xs. x \\<in> range q] \\<in> traces Q\"\n   by (rule failures_traces)\n  ultimately show ?thesis ..\nnext\n  fix vs ws\n  assume A: \"xs = vs @ ws\"\n  assume \"map (inv p) [x\\<leftarrow>vs. x \\<in> range p] \\<in> divergences P\"\n  hence \"map (inv p) [x\\<leftarrow>vs. x \\<in> range p] @ map (inv p) [x\\<leftarrow>ws. x \\<in> range p]\n    \\<in> divergences P\"\n   by (rule process_rule_5_general)\n  hence \"map (inv p) [x\\<leftarrow>xs. x \\<in> range p] \\<in> divergences P\"\n   using A by simp\n  hence \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], {}) \\<in> failures P\"\n   by (rule process_rule_6)\n  hence \"map (inv p) [x\\<leftarrow>xs. x \\<in> range p] \\<in> traces P\"\n   by (rule failures_traces)\n  moreover assume \"map (inv q) [x\\<leftarrow>vs. x \\<in> range q] \\<in> divergences Q\"\n  hence \"map (inv q) [x\\<leftarrow>vs. x \\<in> range q] @ map (inv q) [x\\<leftarrow>ws. x \\<in> range q]\n    \\<in> divergences Q\"\n   by (rule process_rule_5_general)\n  hence \"map (inv q) [x\\<leftarrow>xs. x \\<in> range q] \\<in> divergences Q\"\n   using A by simp\n  hence \"(map (inv q) [x\\<leftarrow>xs. x \\<in> range q], {}) \\<in> failures Q\"\n   by (rule process_rule_6)\n  hence \"map (inv q) [x\\<leftarrow>xs. x \\<in> range q] \\<in> traces Q\"\n   by (rule failures_traces)\n  ultimately show ?thesis ..\nqed\n\nlemma con_comp_failures_divergences:\n \"(xs @ y # ys, Y) \\<in> con_comp_failures P Q p q \\<Longrightarrow>\n  y \\<notin> range p \\<Longrightarrow>\n  y \\<notin> range q \\<Longrightarrow>\n    \\<exists>xs'.\n      (\\<exists>ys'. xs @ zs = xs' @ ys') \\<and>\n      set xs' \\<subseteq> range p \\<union> range q \\<and>\n      map (inv p) [x\\<leftarrow>xs'. x \\<in> range p] \\<in> divergences P \\<and>\n      map (inv q) [x\\<leftarrow>xs'. x \\<in> range q] \\<in> divergences Q\"\nproof (simp add: con_comp_failures_def con_comp_divergences_def,\n erule exE, (erule conjE)+, erule exE)\n  fix xs' ys'\n  assume\n    A: \"y \\<notin> range p\" and\n    B: \"y \\<notin> range q\" and\n    C: \"set xs' \\<subseteq> range p \\<union> range q\" and\n    D: \"map (inv p) [x\\<leftarrow>xs'. x \\<in> range p] \\<in> divergences P\" and\n    E: \"map (inv q) [x\\<leftarrow>xs'. x \\<in> range q] \\<in> divergences Q\" and\n    F: \"xs @ y # ys = xs' @ ys'\"\n  have \"length xs' \\<le> length xs\"\n  proof (rule ccontr)\n    assume \"\\<not> length xs' \\<le> length xs\"\n    moreover have \"take (length xs') (xs @ [y] @ ys) =\n      take (length xs') (xs @ [y]) @ take (length xs' - Suc (length xs)) ys\"\n      (is \"_ = _ @ ?vs\")\n     by (simp only: take_append, simp)\n    ultimately have \"take (length xs') (xs @ y # ys) = xs @ y # ?vs\"\n     by simp\n    moreover have \"take (length xs') (xs @ y # ys) =\n      take (length xs') (xs' @ ys')\"\n     using F by simp\n    ultimately have \"xs' = xs @ y # ?vs\"\n     by simp\n    hence \"set (xs @ y # ?vs) \\<subseteq> range p \\<union> range q\"\n     using C by simp\n    hence \"y \\<in> range p \\<union> range q\"\n     by simp\n    thus False\n     using A and B by simp\n  qed\n  moreover have \"xs @ zs =\n    take (length xs') (xs @ zs) @ drop (length xs') (xs @ zs)\"\n    (is \"_ = _ @ ?vs\")\n   by (simp only: append_take_drop_id)\n  ultimately have \"xs @ zs = take (length xs') (xs @ y # ys) @ ?vs\"\n   by simp\n  moreover have \"take (length xs') (xs @ y # ys) =\n    take (length xs') (xs' @ ys')\"\n   using F by simp\n  ultimately have G: \"xs @ zs = xs' @ ?vs\"\n   by (simp del: take_append, simp)\n  show ?thesis\n  proof (rule_tac x = xs' in exI, rule conjI, rule_tac x = ?vs in exI)\n  qed (subst G, simp_all add: C D E)\nqed\n\ntext \\<open>\n\\null\n\nIn order to prove that CSP noninterference security is conserved under concurrent composition, the\nfirst issue to be solved is to identify the noninterference policy @{term I'} and the event-domain\nmap @{term D'} with respect to which the output process is secure.\n\nIf the events of the input processes corresponding to those of the output process contained in\n@{term \"range p \\<inter> range q\"} were mapped by the respective event-domain maps @{term D}, @{term E}\ninto distinct security domains, there would be no criterion for determining the domains of the\naforesaid events of the output process, due to the equivalence of the input processes ensuing from\nthe commutative property of concurrent composition. Therefore, @{term D} and @{term E} must map the\nevents of the input processes into security domains of the same type @{typ 'd}, and for each\n@{term x} in @{term \"range p \\<inter> range q\"}, @{term D} and @{term E} must map the events of the input\nprocesses corresponding to @{term x} into the same domain. This requirement is formalized here below\nby means of predicate \\<open>consistent_maps\\<close>.\n\nSimilarly, if distinct noninterference policies applied to the input processes, there would exist\nsome ordered pair of security domains included in one of the policies, but not in the other one.\nThus, again, there would be no criterion for determining the inclusion of such a pair of domains in\nthe policy @{term I'} applying to the output process. As a result, the input processes are required\nto enforce the same noninterference policy @{term I}, so that for any two domains @{term d},\n@{term e} of type @{typ 'd}, the ordered pair comprised of the corresponding security domains for\nthe output process will be included in @{term I'} just in case @{term \"(d, e) \\<in> I\"}.\n\nHowever, in case @{term \"- (range p \\<union> range q) \\<noteq> {}\"}, the event-domain map @{term D'} for the\noutput process must assign a security domain to the fake events in @{term \"- (range p \\<union> range q)\"}\nas well. Since such events lack any meaning, they may all be mapped to the same security domain,\ndistinct from the domains of the meaningful events in @{term \"range p \\<union> range q\"}. A simple way to\ndo this is to identify the type of the security domains for the output process with\n@{typ \"'d option\"}. Then, for any meaningful event @{term x}, @{term D'} will assign @{term x} to\ndomain @{term \"Some d\"}, where @{term d} is the domain of the events of the input processes mapped\nto @{term x}, whereas @{term \"D' y = None\"} for any fake event @{term y}. Such an event-domain map,\ndenoted using notation @{term \"con_comp_map D E p q\"}, is defined here below.\n\nTherefore, for any two security domains @{term \"Some d\"}, @{term \"Some e\"} for the output process,\nthe above considerations about policy @{term I'} entail that @{term \"(Some d, Some e) \\<in> I'\"} just in\ncase @{term \"(d, e) \\<in> I\"}. Furthermore, since fake events may only occur in divergent traces, which\nare extensions of divergences of the input processes comprised of meaningful events, @{term I'} must\nallow the security domain @{term None} of fake events to be affected by any meaningful domain\nmatching pattern \\<open>Some _\\<close>. Such a noninterference policy, denoted using notation\n@{term \"con_comp_pol I\"}, is defined here below. Observe that @{term \"con_comp_pol I\"} keeps being\nreflexive or transitive if @{term I} is.\n\n\\null\n\\<close>\n\ndefinition con_comp_pol ::\n \"('d \\<times> 'd) set \\<Rightarrow> ('d option \\<times> 'd option) set\" where\n\"con_comp_pol I \\<equiv>\n  {(Some d, Some e) | d e. (d, e) \\<in> I} \\<union> {(u, v). v = None}\"\n\nfunction con_comp_map ::\n \"('a \\<Rightarrow> 'd) \\<Rightarrow> ('b \\<Rightarrow> 'd) \\<Rightarrow> ('a \\<Rightarrow> 'c) \\<Rightarrow> ('b \\<Rightarrow> 'c) \\<Rightarrow> 'c \\<Rightarrow> 'd option\" where\n\"x \\<in> range p \\<Longrightarrow>\n  con_comp_map D E p q x = Some (D (inv p x))\" |\n\"x \\<notin> range p \\<Longrightarrow> x \\<in> range q \\<Longrightarrow>\n  con_comp_map D E p q x = Some (E (inv q x))\" |\n\"x \\<notin> range p \\<Longrightarrow> x \\<notin> range q \\<Longrightarrow>\n  con_comp_map D E p q x = None\"\nby (atomize_elim, simp_all add: split_paired_all, blast)\ntermination by lexicographic_order\n\ndefinition consistent_maps ::\n \"('a \\<Rightarrow> 'd) \\<Rightarrow> ('b \\<Rightarrow> 'd) \\<Rightarrow> ('a \\<Rightarrow> 'c) \\<Rightarrow> ('b \\<Rightarrow> 'c) \\<Rightarrow> bool\" where\n\"consistent_maps D E p q \\<equiv>\n  \\<forall>x \\<in> range p \\<inter> range q. D (inv p x) = E (inv q x)\"\n\n\nsubsection \"Auxiliary intransitive purge functions\"\n\ntext \\<open>\nLet @{term I} be a noninterference policy, @{term D} an event-domain map, @{term U} a domain set,\nand @{term \"xs = x # xs'\"} an event list. Suppose to take event @{term x} just in case it satisfies\npredicate @{term P}, to append @{term xs'} to the resulting list (matching either @{term \"[x]\"} or\n@{term \"[]\"}), and then to compute the intransitive purge of the resulting list with domain set\n@{term U}. If recursion with respect to the input list is added, replacing @{term xs'} with the list\nproduced by the same algorithm using @{term xs'} as input list and @{term \"sinks_aux I D U [x]\"} as\ndomain set, the final result matches that obtained by applying filter @{term P} to the intransitive\npurge of @{term xs} with domain set @{term U}. In fact, in each recursive step, the processed item\nof the input list is retained in the output list just in case it passes filter @{term P} and may be\naffected neither by the domains in @{term U}, nor by the domains of the previous items affected by\nsome domain in @{term U}.\n\nHere below is the formal definition of such purge function, named \\<open>ipurge_tr_aux_foldr\\<close> as its\naction resembles that of function @{term foldr}.\n\n\\null\n\\<close>\n\nprimrec ipurge_tr_aux_foldr ::\n \"('d \\<times> 'd) set \\<Rightarrow> ('a \\<Rightarrow> 'd) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'd set \\<Rightarrow> 'a list \\<Rightarrow> 'a list\"\nwhere\n\"ipurge_tr_aux_foldr I D P U [] = []\" |\n\"ipurge_tr_aux_foldr I D P U (x # xs) = ipurge_tr_aux I D U\n   ((if P x then [x] else []) @\n     ipurge_tr_aux_foldr I D P (sinks_aux I D U [x]) xs)\"\n\ntext \\<open>\n\\null\n\nLikewise, given @{term I}, @{term D}, @{term U}, @{term \"xs = x # xs'\"}, and an event set @{term X},\nsuppose to take @{term x} just in case it satisfies predicate @{term P}, to append\n@{term \"ipurge_tr_aux_foldr I D P (sinks_aux I D U [x]) xs'\"} to the resulting list (matching either\n@{term \"[x]\"} or @{term \"[]\"}), and then to compute the intransitive purge of @{term X} using the\nresulting list as input list and @{term U} as domain set. If recursion with respect to the input\nlist is added, replacing @{term X} with the set produced by the same algorithm using @{term xs'} as\ninput list, @{term X} as input set, and @{term \"sinks_aux I D U [x]\"} as domain set, the final\nresult matches the intransitive purge of @{term X} with input list @{term xs} and domain set\n@{term U}. In fact, each recursive step is such as to remove from @{term X} any event that may be\naffected either by the domains in @{term U}, or by the domains of the items of @{term xs} preceding\nthe processed one which are affected by some domain in @{term U}.\n\nFrom the above considerations on function @{term ipurge_tr_aux_foldr}, it follows that the presence\nof list @{term \"ipurge_tr_aux_foldr I D P (sinks_aux I D U [x]) xs'\"} has no impact on the final\nresult, because none of its items may be affected by the domains in @{term U}.\n\nHere below is the formal definition of such purge function, named \\<open>ipurge_ref_aux_foldr\\<close>,\nwhich at first glance just seems a uselessly complicate and inefficient way to compute the\nintransitive purge of an event set.\n\n\\null\n\\<close>\n\nprimrec ipurge_ref_aux_foldr ::\n \"('d \\<times> 'd) set \\<Rightarrow> ('a \\<Rightarrow> 'd) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'd set \\<Rightarrow> 'a list \\<Rightarrow> 'a set \\<Rightarrow> 'a set\"\nwhere\n\"ipurge_ref_aux_foldr I D P U [] X = ipurge_ref_aux I D U [] X\" |\n\"ipurge_ref_aux_foldr I D P U (x # xs) X = ipurge_ref_aux I D U\n   ((if P x then [x] else []) @\n     ipurge_tr_aux_foldr I D P (sinks_aux I D U [x]) xs)\n   (ipurge_ref_aux_foldr I D P (sinks_aux I D U [x]) xs X)\"\n\ntext \\<open>\n\\null\n\nThe reason for the introduction of such intransitive purge functions is that the recursive equations\ncontained in their definitions, along with lemma @{thm [source] ipurge_tr_ref_aux_failures_general},\nenable to prove by induction on list @{term ys}, assuming that process @{term P} be secure in\naddition to further, minor premises, the following implication:\n\n\\null\n\n@{term \"(map (inv p) [x\\<leftarrow>xs @ ys. x \\<in> range p], inv p ` Y) \\<in> failures P \\<longrightarrow>\n  (map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @\n   map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q)\n     (\\<lambda>x. x \\<in> range p) U ys),\n   inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q)\n     (\\<lambda>x. x \\<in> range p) U ys Y) \\<in> failures P\"}\n\n\\null\n\nIn fact, for @{term \"ys = y # ys'\"}, the induction hypothesis entails that the consequent holds if\n@{term xs}, @{term ys}, and @{term U} are replaced with @{term \"xs @ [y]\"}, @{term ys'}, and\n@{term \"sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y]\"}, respectively. The proof can then\nbe accomplished by applying lemma @{thm [source] ipurge_tr_ref_aux_failures_general} to the\nresulting future of trace @{term \"map (inv p) [x\\<leftarrow>xs. x \\<in> range p]\"}, moving functions\n@{term ipurge_tr_aux} and @{term \"ipurge_ref_aux\"} into the arguments of @{term \"map (inv p)\"} and\n@{term \"(`) (inv p)\"}, and using the recursive equations contained in the definitions of functions\n@{term ipurge_tr_aux_foldr} and @{term ipurge_ref_aux_foldr}.\n\nThis property, along with the match of the outputs of functions @{term ipurge_tr_aux_foldr} and\n@{term ipurge_ref_aux_foldr} with the filtered intransitive purge of the input event list and the\nintransitive purge of the input event set, respectively, permits to solve the main proof obligations\narising from the demonstration of the target security conservation theorem.\n\nHere below is the proof of the equivalence between function @{term ipurge_tr_aux_foldr} and the\nfiltered intransitive purge of an event list.\n\n\\null\n\\<close>\n\nlemma ipurge_tr_aux_foldr_subset:\n \"U \\<subseteq> V \\<Longrightarrow>\n  ipurge_tr_aux I D U (ipurge_tr_aux_foldr I D P V xs) =\n    ipurge_tr_aux_foldr I D P V xs\"\nproof (induction xs, simp_all add: ipurge_tr_aux_union [symmetric])\nqed (drule Un_absorb2, simp)\n\nlemma ipurge_tr_aux_foldr_eq:\n \"[x\\<leftarrow>ipurge_tr_aux I D U xs. P x] = ipurge_tr_aux_foldr I D P U xs\"\nproof (induction xs arbitrary: U, simp)\n  fix x xs U\n  assume\n    A: \"\\<And>U. [x\\<leftarrow>ipurge_tr_aux I D U xs. P x] = ipurge_tr_aux_foldr I D P U xs\"\n  show \"[x\\<leftarrow>ipurge_tr_aux I D U (x # xs). P x] =\n    ipurge_tr_aux_foldr I D P U (x # xs)\"\n  proof (cases \"\\<exists>u \\<in> U. (u, D x) \\<in> I\",\n   simp_all only: ipurge_tr_aux_foldr.simps ipurge_tr_aux_cons\n   sinks_aux_single_event if_True if_False)\n    case True\n    have B: \"[x\\<leftarrow>ipurge_tr_aux I D (insert (D x) U) xs. P x] =\n      ipurge_tr_aux_foldr I D P (insert (D x) U) xs\"\n     using A .\n    show \"[x\\<leftarrow>ipurge_tr_aux I D (insert (D x) U) xs. P x] = ipurge_tr_aux I D U\n      ((if P x then [x] else []) @ ipurge_tr_aux_foldr I D P (insert (D x) U) xs)\"\n    proof (cases \"P x\", simp_all add: ipurge_tr_aux_cons True\n     del: con_comp_map.simps)\n      have \"insert (D x) U \\<subseteq> insert (D x) U\" ..\n      hence \"ipurge_tr_aux I D (insert (D x) U)\n        (ipurge_tr_aux_foldr I D P (insert (D x) U) xs) =\n          ipurge_tr_aux_foldr I D P (insert (D x) U) xs\"\n       by (rule ipurge_tr_aux_foldr_subset)\n      thus \"[x\\<leftarrow>ipurge_tr_aux I D (insert (D x) U) xs. P x] =\n        ipurge_tr_aux I D (insert (D x) U)\n          (ipurge_tr_aux_foldr I D P (insert (D x) U) xs)\"\n       using B by simp\n    next\n      have \"U \\<subseteq> insert (D x) U\"\n       by (rule subset_insertI)\n      hence \"ipurge_tr_aux I D U\n        (ipurge_tr_aux_foldr I D P (insert (D x) U) xs) =\n          ipurge_tr_aux_foldr I D P (insert (D x) U) xs\"\n       by (rule ipurge_tr_aux_foldr_subset)\n      thus \"[x\\<leftarrow>ipurge_tr_aux I D (insert (D x) U) xs. P x] =\n        ipurge_tr_aux I D U\n          (ipurge_tr_aux_foldr I D P (insert (D x) U) xs)\"\n       using B by simp\n    qed\n  next\n    case False\n    have B: \"[x\\<leftarrow>ipurge_tr_aux I D U xs. P x] = ipurge_tr_aux_foldr I D P U xs\"\n     using A .\n    show \"[x\\<leftarrow>x # ipurge_tr_aux I D U xs. P x] = ipurge_tr_aux I D U\n      ((if P x then [x] else []) @ ipurge_tr_aux_foldr I D P U xs)\"\n    proof (cases \"P x\", simp_all add: ipurge_tr_aux_cons False\n     del: con_comp_map.simps)\n      have \"U \\<subseteq> U\" ..\n      hence \"ipurge_tr_aux I D U (ipurge_tr_aux_foldr I D P U xs) =\n        ipurge_tr_aux_foldr I D P U xs\"\n       by (rule ipurge_tr_aux_foldr_subset)\n      thus \"[x\\<leftarrow>ipurge_tr_aux I D U xs. P x] =\n        ipurge_tr_aux I D U (ipurge_tr_aux_foldr I D P U xs)\"\n       using B by simp\n    next\n      have \"U \\<subseteq> U\" ..\n      hence \"ipurge_tr_aux I D U (ipurge_tr_aux_foldr I D P U xs) =\n        ipurge_tr_aux_foldr I D P U xs\"\n       by (rule ipurge_tr_aux_foldr_subset)\n      thus \"[x\\<leftarrow>ipurge_tr_aux I D U xs. P x] =\n        ipurge_tr_aux I D U (ipurge_tr_aux_foldr I D P U xs)\"\n       using B by simp\n    qed\n  qed\nqed\n\ntext \\<open>\n\\null\n\nHere below is the proof of the equivalence between function @{term ipurge_ref_aux_foldr} and the\nintransitive purge of an event set.\n\n\\null\n\\<close>\n\nlemma ipurge_tr_aux_foldr_sinks_aux [rule_format]:\n \"U \\<subseteq> V \\<longrightarrow> sinks_aux I D U (ipurge_tr_aux_foldr I D P V xs) = U\"\nproof (induction xs arbitrary: V, simp, rule impI)\n  fix x xs V\n  assume\n    A: \"\\<And>V. U \\<subseteq> V \\<longrightarrow> sinks_aux I D U (ipurge_tr_aux_foldr I D P V xs) = U\" and\n    B: \"U \\<subseteq> V\"\n  show \"sinks_aux I D U (ipurge_tr_aux_foldr I D P V (x # xs)) = U\"\n  proof (cases \"P x\", case_tac [!] \"\\<exists>v \\<in> V. (v, D x) \\<in> I\",\n   simp_all (no_asm_simp) add: sinks_aux_cons ipurge_tr_aux_cons)\n    have \"U \\<subseteq> insert (D x) V \\<longrightarrow>\n      sinks_aux I D U (ipurge_tr_aux_foldr I D P (insert (D x) V) xs) = U\"\n      (is \"_ \\<longrightarrow> sinks_aux I D U ?ys = U\")\n     using A .\n    moreover have \"U \\<subseteq> insert (D x) V\"\n     using B by (rule subset_insertI2)\n    ultimately have \"sinks_aux I D U ?ys = U\" ..\n    moreover have \"insert (D x) V \\<subseteq> insert (D x) V\" ..\n    hence \"ipurge_tr_aux I D (insert (D x) V)\n      (ipurge_tr_aux_foldr I D P (insert (D x) V) xs) = ?ys\"\n      (is \"?zs = _\")\n     by (rule ipurge_tr_aux_foldr_subset)\n    ultimately show \"sinks_aux I D U ?zs = U\"\n     by simp\n  next\n    assume C: \"\\<not> (\\<exists>v \\<in> V. (v, D x) \\<in> I)\"\n    have \"\\<not> (\\<exists>u \\<in> U. (u, D x) \\<in> I)\"\n    proof\n      assume \"\\<exists>u \\<in> U. (u, D x) \\<in> I\"\n      then obtain u where D: \"u \\<in> U\" and E: \"(u, D x) \\<in> I\" ..\n      have \"u \\<in> V\"\n       using B and D ..\n      with E have \"\\<exists>v \\<in> V. (v, D x) \\<in> I\" ..\n      thus False\n       using C by contradiction\n    qed\n    thus\n     \"((\\<exists>v \\<in> U. (v, D x) \\<in> I) \\<longrightarrow> sinks_aux I D (insert (D x) U)\n        (ipurge_tr_aux I D V (ipurge_tr_aux_foldr I D P V xs)) = U) \\<and>\n      ((\\<forall>v \\<in> U. (v, D x) \\<notin> I) \\<longrightarrow> sinks_aux I D U\n        (ipurge_tr_aux I D V (ipurge_tr_aux_foldr I D P V xs)) = U)\"\n    proof simp\n      have \"U \\<subseteq> V \\<longrightarrow> sinks_aux I D U (ipurge_tr_aux_foldr I D P V xs) = U\"\n        (is \"_ \\<longrightarrow> sinks_aux I D U ?ys = U\")\n       using A .\n      hence \"sinks_aux I D U ?ys = U\" using B ..\n      moreover have \"V \\<subseteq> V\" ..\n      hence \"ipurge_tr_aux I D V (ipurge_tr_aux_foldr I D P V xs) = ?ys\"\n        (is \"?zs = _\")\n       by (rule ipurge_tr_aux_foldr_subset)\n      ultimately show \"sinks_aux I D U ?zs = U\"\n       by simp\n    qed\n  next\n    have \"U \\<subseteq> insert (D x) V \\<longrightarrow>\n      sinks_aux I D U (ipurge_tr_aux_foldr I D P (insert (D x) V) xs) = U\"\n      (is \"_ \\<longrightarrow> sinks_aux I D U ?ys = U\")\n     using A .\n    moreover have \"U \\<subseteq> insert (D x) V\"\n     using B by (rule subset_insertI2)\n    ultimately have \"sinks_aux I D U ?ys = U\" ..\n    moreover have \"V \\<subseteq> insert (D x) V\"\n     by (rule subset_insertI)\n    hence \"ipurge_tr_aux I D V\n      (ipurge_tr_aux_foldr I D P (insert (D x) V) xs) = ?ys\"\n      (is \"?zs = _\")\n     by (rule ipurge_tr_aux_foldr_subset)\n    ultimately show \"sinks_aux I D U ?zs = U\"\n     by simp\n  next\n    have \"U \\<subseteq> V \\<longrightarrow> sinks_aux I D U (ipurge_tr_aux_foldr I D P V xs) = U\"\n      (is \"_ \\<longrightarrow> sinks_aux I D U ?ys = U\")\n     using A .\n    hence \"sinks_aux I D U ?ys = U\" using B ..\n    moreover have \"V \\<subseteq> V\" ..\n    hence \"ipurge_tr_aux I D V (ipurge_tr_aux_foldr I D P V xs) = ?ys\"\n      (is \"?zs = _\")\n     by (rule ipurge_tr_aux_foldr_subset)\n    ultimately show \"sinks_aux I D U ?zs = U\"\n     by simp\n  qed\nqed\n\nlemma ipurge_tr_aux_foldr_ref_aux:\n  assumes A: \"U \\<subseteq> V\"\n  shows \"ipurge_ref_aux I D U (ipurge_tr_aux_foldr I D P V xs) X =\n    ipurge_ref_aux I D U [] X\"\nby (simp add: ipurge_ref_aux_def ipurge_tr_aux_foldr_sinks_aux [OF A])\n\nlemma ipurge_ref_aux_foldr_subset [rule_format]:\n \"sinks_aux I D U ys \\<subseteq> V \\<longrightarrow>\n  ipurge_ref_aux I D U ys (ipurge_ref_aux_foldr I D P V xs X) =\n    ipurge_ref_aux_foldr I D P V xs X\"\nproof (induction xs arbitrary: ys U V, rule_tac [!] impI,\n simp add: ipurge_ref_aux_def, blast)\n  fix x xs ys U V\n  assume\n    A: \"\\<And>ys U V.\n      sinks_aux I D U ys \\<subseteq> V \\<longrightarrow>\n      ipurge_ref_aux I D U ys (ipurge_ref_aux_foldr I D P V xs X) =\n        ipurge_ref_aux_foldr I D P V xs X\" and\n    B: \"sinks_aux I D U ys \\<subseteq> V\"\n  show \"ipurge_ref_aux I D U ys (ipurge_ref_aux_foldr I D P V (x # xs) X) =\n    ipurge_ref_aux_foldr I D P V (x # xs) X\"\n  proof (cases \"P x\", simp_all add: ipurge_ref_aux_cons)\n    have C: \"sinks_aux I D V [x] \\<subseteq> sinks_aux I D V [x]\" ..\n    show\n     \"ipurge_ref_aux I D U ys (ipurge_ref_aux I D (sinks_aux I D V [x])\n        (ipurge_tr_aux_foldr I D P (sinks_aux I D V [x]) xs)\n        (ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X)) =\n      ipurge_ref_aux I D (sinks_aux I D V [x])\n        (ipurge_tr_aux_foldr I D P (sinks_aux I D V [x]) xs)\n        (ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X)\"\n    proof (simp add: ipurge_tr_aux_foldr_ref_aux [OF C])\n      have \"sinks_aux I D (sinks_aux I D V [x]) [] \\<subseteq> sinks_aux I D V [x] \\<longrightarrow>\n        ipurge_ref_aux I D (sinks_aux I D V [x]) []\n          (ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X) =\n        ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X\"\n        (is \"?A \\<longrightarrow> ?us = ?vs\")\n       using A .\n      moreover have ?A\n       by simp\n      ultimately have \"?us = ?vs\" ..\n      thus \"ipurge_ref_aux I D U ys ?us = ?us\"\n      proof simp\n        have \"sinks_aux I D U ys \\<subseteq> sinks_aux I D V [x] \\<longrightarrow>\n          ipurge_ref_aux I D U ys\n            (ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X) =\n          ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X\"\n          (is \"_ \\<longrightarrow> ?T\")\n         using A .\n        moreover have \"V \\<subseteq> sinks_aux I D V [x]\"\n         by (rule sinks_aux_subset)\n        hence \"sinks_aux I D U ys \\<subseteq> sinks_aux I D V [x]\"\n         using B by simp\n        ultimately show ?T ..\n      qed\n    qed\n  next\n    have C: \"V \\<subseteq> sinks_aux I D V [x]\"\n     by (rule sinks_aux_subset)\n    show\n     \"ipurge_ref_aux I D U ys (ipurge_ref_aux I D V\n        (ipurge_tr_aux_foldr I D P (sinks_aux I D V [x]) xs)\n        (ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X)) =\n      ipurge_ref_aux I D V\n        (ipurge_tr_aux_foldr I D P (sinks_aux I D V [x]) xs)\n        (ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X)\"\n    proof (simp add: ipurge_tr_aux_foldr_ref_aux [OF C])\n      have \"sinks_aux I D V [] \\<subseteq> sinks_aux I D V [x] \\<longrightarrow>\n        ipurge_ref_aux I D V []\n          (ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X) =\n        ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X\"\n        (is \"?A \\<longrightarrow> ?us = ?vs\")\n       using A .\n      moreover have ?A\n       using C by simp\n      ultimately have \"?us = ?vs\" ..\n      thus \"ipurge_ref_aux I D U ys ?us = ?us\"\n      proof simp\n        have \"sinks_aux I D U ys \\<subseteq> sinks_aux I D V [x] \\<longrightarrow>\n          ipurge_ref_aux I D U ys\n            (ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X) =\n          ipurge_ref_aux_foldr I D P (sinks_aux I D V [x]) xs X\"\n          (is \"_ \\<longrightarrow> ?T\")\n         using A .\n        moreover have \"sinks_aux I D U ys \\<subseteq> sinks_aux I D V [x]\"\n         using B and C by simp\n        ultimately show ?T ..\n      qed\n    qed\n  qed\nqed\n\nlemma ipurge_ref_aux_foldr_eq:\n \"ipurge_ref_aux I D U xs X = ipurge_ref_aux_foldr I D P U xs X\"\nproof (induction xs arbitrary: U, simp)\n  fix x xs U\n  assume A: \"\\<And>U. ipurge_ref_aux I D U xs X = ipurge_ref_aux_foldr I D P U xs X\"\n  show \"ipurge_ref_aux I D U (x # xs) X =\n    ipurge_ref_aux_foldr I D P U (x # xs) X\"\n  proof (cases \"P x\", simp_all add: ipurge_ref_aux_cons)\n    have \"sinks_aux I D U [x] \\<subseteq> sinks_aux I D U [x]\" ..\n    hence\n     \"ipurge_ref_aux I D (sinks_aux I D U [x])\n        (ipurge_tr_aux_foldr I D P (sinks_aux I D U [x]) xs)\n        (ipurge_ref_aux_foldr I D P (sinks_aux I D U [x]) xs X) =\n      ipurge_ref_aux I D (sinks_aux I D U [x]) []\n        (ipurge_ref_aux_foldr I D P (sinks_aux I D U [x]) xs X)\"\n      (is \"ipurge_ref_aux _ _ _ ?xs' ?X' = _\")\n     by (rule ipurge_tr_aux_foldr_ref_aux)\n    also have \"sinks_aux I D (sinks_aux I D U [x]) [] \\<subseteq> sinks_aux I D U [x]\"\n     by simp\n    hence \"ipurge_ref_aux I D (sinks_aux I D U [x]) [] ?X' = ?X'\"\n     by (rule ipurge_ref_aux_foldr_subset)\n    finally have \"ipurge_ref_aux I D (sinks_aux I D U [x]) ?xs' ?X' = ?X'\" .\n    thus \"ipurge_ref_aux I D (sinks_aux I D U [x]) xs X =\n      ipurge_ref_aux I D (sinks_aux I D U [x]) ?xs' ?X'\"\n    proof simp\n      show \"ipurge_ref_aux I D (sinks_aux I D U [x]) xs X =\n        ipurge_ref_aux_foldr I D P (sinks_aux I D U [x]) xs X\"\n       using A .\n    qed\n  next\n    have \"U \\<subseteq> sinks_aux I D U [x]\"\n     by (rule sinks_aux_subset)\n    hence\n     \"ipurge_ref_aux I D U\n        (ipurge_tr_aux_foldr I D P (sinks_aux I D U [x]) xs)\n        (ipurge_ref_aux_foldr I D P (sinks_aux I D U [x]) xs X) =\n      ipurge_ref_aux I D U []\n        (ipurge_ref_aux_foldr I D P (sinks_aux I D U [x]) xs X)\"\n      (is \"ipurge_ref_aux _ _ _ ?xs' ?X' = _\")\n     by (rule ipurge_tr_aux_foldr_ref_aux)\n    also have \"sinks_aux I D U [] \\<subseteq> sinks_aux I D U [x]\"\n     by (simp, rule sinks_aux_subset)\n    hence \"ipurge_ref_aux I D U [] ?X' = ?X'\"\n     by (rule ipurge_ref_aux_foldr_subset)\n    finally have \"ipurge_ref_aux I D U ?xs' ?X' = ?X'\" .\n    thus \"ipurge_ref_aux I D (sinks_aux I D U [x]) xs X =\n      ipurge_ref_aux I D U ?xs' ?X'\"\n    proof simp\n      show \"ipurge_ref_aux I D (sinks_aux I D U [x]) xs X =\n        ipurge_ref_aux_foldr I D P (sinks_aux I D U [x]) xs X\"\n       using A .\n    qed\n  qed\nqed\n\ntext \\<open>\n\\null\n\nFinally, here below is the proof of the implication involving functions @{term ipurge_tr_aux_foldr}\nand @{term ipurge_ref_aux_foldr} discussed above.\n\n\\null\n\\<close>\n\nlemma con_comp_sinks_aux_range:\n  assumes\n    A: \"U \\<subseteq> range Some\" and\n    B: \"set xs \\<subseteq> range p \\<union> range q\"\n  shows \"sinks_aux (con_comp_pol I) (con_comp_map D E p q) U xs \\<subseteq> range Some\"\n    (is \"sinks_aux _ ?D' _ _ \\<subseteq> _\")\nproof (rule subsetI, drule sinks_aux_elem, erule disjE, erule_tac [2] bexE)\n  fix u\n  assume \"u \\<in> U\"\n  with A show \"u \\<in> range Some\" ..\nnext\n  fix u x\n  assume \"x \\<in> set xs\"\n  with B have \"x \\<in> range p \\<union> range q\" ..\n  hence \"?D' x \\<in> range Some\"\n   by (cases \"x \\<in> range p\", simp_all)\n  moreover assume \"u = ?D' x\"\n  ultimately show \"u \\<in> range Some\"\n   by simp\nqed\n\nlemma con_comp_sinks_aux [rule_format]:\n  assumes A: \"U \\<subseteq> range Some\"\n  shows \"set xs \\<subseteq> range p \\<longrightarrow>\n    sinks_aux I D (the ` U) (map (inv p) xs) =\n    the ` sinks_aux (con_comp_pol I) (con_comp_map D E p q) U xs\"\n    (is \"_ \\<longrightarrow> _ = the ` sinks_aux ?I' ?D' _ _\")\nproof (induction xs rule: rev_induct, simp, rule impI)\n  fix x xs\n  assume \"set xs \\<subseteq> range p \\<longrightarrow>\n    sinks_aux I D (the ` U) (map (inv p) xs) =\n    the ` sinks_aux ?I' ?D' U xs\"\n  moreover assume B: \"set (xs @ [x]) \\<subseteq> range p\"\n  ultimately have C: \"sinks_aux I D (the ` U) (map (inv p) xs) =\n    the ` sinks_aux ?I' ?D' U xs\"\n   by simp\n  show \"sinks_aux I D (the ` U) (map (inv p) (xs @ [x])) =\n    the ` sinks_aux ?I' ?D' U (xs @ [x])\"\n  proof (cases \"\\<exists>u \\<in> sinks_aux ?I' ?D' U xs. (u, ?D' x) \\<in> ?I'\",\n   simp_all (no_asm_simp) del: map_append)\n    case True\n    then obtain u where\n      D: \"u \\<in> sinks_aux ?I' ?D' U xs\" and E: \"(u, ?D' x) \\<in> ?I'\" ..\n    have \"(the u, D (inv p x)) \\<in> I\"\n     using B and E by (simp add: con_comp_pol_def, erule_tac exE, simp)\n    moreover have \"the u \\<in> the ` sinks_aux ?I' ?D' U xs\"\n     using D by simp\n    hence \"the u \\<in> sinks_aux I D (the ` U) (map (inv p) xs)\"\n     using C by simp\n    ultimately have \"\\<exists>d \\<in> sinks_aux I D (the ` U) (map (inv p) xs).\n      (d, D (inv p x)) \\<in> I\" ..\n    hence \"sinks_aux I D (the ` U) (map (inv p) (xs @ [x])) =\n      insert (D (inv p x)) (sinks_aux I D (the ` U) (map (inv p) xs))\"\n     by simp\n    thus \"sinks_aux I D (the ` U) (map (inv p) (xs @ [x])) =\n      insert (the (?D' x)) (the ` sinks_aux ?I' ?D' U xs)\"\n     using B and C by simp\n  next\n    case False\n    have \"\\<not> (\\<exists>d \\<in> sinks_aux I D (the ` U) (map (inv p) xs).\n      (d, D (inv p x)) \\<in> I)\"\n    proof (rule notI, erule bexE)\n      fix d\n      assume \"d \\<in> sinks_aux I D (the ` U) (map (inv p) xs)\"\n      hence \"d \\<in> the ` sinks_aux ?I' ?D' U xs\"\n       using C by simp\n      hence \"\\<exists>u \\<in> sinks_aux ?I' ?D' U xs. d = the u\"\n       by (simp add: image_iff)\n      then obtain u where\n        D: \"u \\<in> sinks_aux ?I' ?D' U xs\" and E: \"d = the u\" ..\n      have \"set xs \\<subseteq> range p \\<union> range q\"\n       using B by (simp, blast)\n      with A have \"sinks_aux ?I' ?D' U xs \\<subseteq> range Some\"\n       by (rule con_comp_sinks_aux_range)\n      hence \"u \\<in> range Some\"\n       using D ..\n      hence \"u = Some d\"\n       using E by (simp add: image_iff)\n      moreover assume \"(d, D (inv p x)) \\<in> I\"\n      hence \"(Some d, Some (D (inv p x))) \\<in> ?I'\"\n       by (simp add: con_comp_pol_def)\n      ultimately have \"(u, ?D' x) \\<in> ?I'\"\n       using B by simp\n      hence \"\\<exists>u \\<in> sinks_aux ?I' ?D' U xs. (u, ?D' x) \\<in> ?I'\"\n       using D ..\n      thus False\n       using False by contradiction\n    qed\n    thus \"sinks_aux I D (the ` U) (map (inv p) (xs @ [x])) =\n      the ` sinks_aux ?I' ?D' U xs\"\n     using C by simp\n  qed\nqed\n\nlemma con_comp_ipurge_tr_aux [rule_format]:\n  assumes A: \"U \\<subseteq> range Some\"\n  shows \"set xs \\<subseteq> range p \\<longrightarrow>\n    ipurge_tr_aux I D (the ` U) (map (inv p) xs) =\n    map (inv p) (ipurge_tr_aux (con_comp_pol I) (con_comp_map D E p q) U xs)\"\n    (is \"_ \\<longrightarrow> _ = map (inv p) (ipurge_tr_aux ?I' ?D' _ _)\")\nproof (induction xs rule: rev_induct, simp, rule impI)\n  fix x xs\n  assume \"set xs \\<subseteq> range p \\<longrightarrow>\n    ipurge_tr_aux I D (the ` U) (map (inv p) xs) =\n    map (inv p) (ipurge_tr_aux ?I' ?D' U xs)\"\n  moreover assume B: \"set (xs @ [x]) \\<subseteq> range p\"\n  ultimately have C: \"ipurge_tr_aux I D (the ` U) (map (inv p) xs) =\n    map (inv p) (ipurge_tr_aux ?I' ?D' U xs)\"\n   by simp\n  show \"ipurge_tr_aux I D (the ` U) (map (inv p) (xs @ [x])) =\n    map (inv p) (ipurge_tr_aux ?I' ?D' U (xs @ [x]))\"\n  proof (cases \"\\<exists>u \\<in> sinks_aux ?I' ?D' U xs. (u, ?D' x) \\<in> ?I'\")\n    case True\n    then obtain u where\n      D: \"u \\<in> sinks_aux ?I' ?D' U xs\" and E: \"(u, ?D' x) \\<in> ?I'\" ..\n    have \"(the u, D (inv p x)) \\<in> I\"\n     using B and E by (simp add: con_comp_pol_def, erule_tac exE, simp)\n    moreover have F: \"the u \\<in> the ` sinks_aux ?I' ?D' U xs\"\n     using D by simp\n    have \"set xs \\<subseteq> range p\"\n     using B by simp\n    with A have \"sinks_aux I D (the ` U) (map (inv p) xs) =\n      the ` sinks_aux ?I' ?D' U xs\"\n     by (rule con_comp_sinks_aux)\n    hence \"the u \\<in> sinks_aux I D (the ` U) (map (inv p) xs)\"\n     using F by simp\n    ultimately have \"\\<exists>d \\<in> sinks_aux I D (the ` U) (map (inv p) xs).\n      (d, D (inv p x)) \\<in> I\" ..\n    hence \"ipurge_tr_aux I D (the ` U) (map (inv p) (xs @ [x])) =\n      ipurge_tr_aux I D (the ` U) (map (inv p) xs)\"\n     by simp\n    moreover have \"map (inv p) (ipurge_tr_aux ?I' ?D' U (xs @ [x])) =\n      map (inv p) (ipurge_tr_aux ?I' ?D' U xs)\"\n     using True by simp\n    ultimately show ?thesis\n     using C by simp\n  next\n    case False\n    have \"\\<not> (\\<exists>d \\<in> sinks_aux I D (the ` U) (map (inv p) xs).\n      (d, D (inv p x)) \\<in> I)\"\n    proof (rule notI, erule bexE)\n      fix d\n      assume \"d \\<in> sinks_aux I D (the ` U) (map (inv p) xs)\"\n      moreover have \"set xs \\<subseteq> range p\"\n       using B by simp\n      with A have \"sinks_aux I D (the ` U) (map (inv p) xs) =\n        the ` sinks_aux ?I' ?D' U xs\"\n       by (rule con_comp_sinks_aux)\n      ultimately have \"d \\<in> the ` sinks_aux ?I' ?D' U xs\"\n       by simp\n      hence \"\\<exists>u \\<in> sinks_aux ?I' ?D' U xs. d = the u\"\n       by (simp add: image_iff)\n      then obtain u where\n        D: \"u \\<in> sinks_aux ?I' ?D' U xs\" and E: \"d = the u\" ..\n      have \"set xs \\<subseteq> range p \\<union> range q\"\n       using B by (simp, blast)\n      with A have \"sinks_aux ?I' ?D' U xs \\<subseteq> range Some\"\n       by (rule con_comp_sinks_aux_range)\n      hence \"u \\<in> range Some\"\n       using D ..\n      hence \"u = Some d\"\n       using E by (simp add: image_iff)\n      moreover assume \"(d, D (inv p x)) \\<in> I\"\n      hence \"(Some d, Some (D (inv p x))) \\<in> ?I'\"\n       by (simp add: con_comp_pol_def)\n      ultimately have \"(u, ?D' x) \\<in> ?I'\"\n       using B by simp\n      hence \"\\<exists>u \\<in> sinks_aux ?I' ?D' U xs. (u, ?D' x) \\<in> ?I'\"\n       using D ..\n      thus False\n       using False by contradiction\n    qed\n    hence \"ipurge_tr_aux I D (the ` U) (map (inv p) (xs @ [x])) =\n      ipurge_tr_aux I D (the ` U) (map (inv p) xs) @ [inv p x]\"\n     by simp\n    moreover have \"map (inv p) (ipurge_tr_aux ?I' ?D' U (xs @ [x])) =\n      map (inv p) (ipurge_tr_aux ?I' ?D' U xs) @ [inv p x]\"\n     using False by simp\n    ultimately show ?thesis\n     using C by simp\n  qed\nqed\n\nlemma con_comp_ipurge_ref_aux:\n  assumes\n    A: \"U \\<subseteq> range Some\" and\n    B: \"set xs \\<subseteq> range p\" and\n    C: \"X \\<subseteq> range p\"\n  shows \"ipurge_ref_aux I D (the ` U) (map (inv p) xs) (inv p ` X) =\n    inv p ` ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U xs X\"\n  (is \"_ = inv p ` ipurge_ref_aux ?I' ?D' _ _ _\")\nproof (simp add: ipurge_ref_aux_def set_eq_iff image_iff, rule allI, rule iffI,\n erule conjE, erule bexE, erule_tac [2] exE, (erule_tac [2] conjE)+)\n  fix a x\n  assume\n    D: \"x \\<in> X\" and\n    E: \"a = inv p x\" and\n    F: \"\\<forall>d \\<in> sinks_aux I D (the ` U) (map (inv p) xs). (d, D a) \\<notin> I\"\n  show \"\\<exists>x. x \\<in> X \\<and> (\\<forall>u \\<in> sinks_aux ?I' ?D' U xs. (u, ?D' x) \\<notin> ?I') \\<and>\n    a = inv p x\"\n  proof (rule_tac x = x in exI, simp add: D E, rule ballI)\n    fix u\n    assume G: \"u \\<in> sinks_aux ?I' ?D' U xs\"\n    moreover have \"sinks_aux I D (the ` U) (map (inv p) xs) =\n      the ` sinks_aux ?I' ?D' U xs\"\n     using A and B by (rule con_comp_sinks_aux)\n    ultimately have \"the u \\<in> sinks_aux I D (the ` U) (map (inv p) xs)\"\n     by simp\n    with F have \"(the u, D a) \\<notin> I\" ..\n    moreover have \"set xs \\<subseteq> range p \\<union> range q\"\n     using B by blast\n    with A have \"sinks_aux ?I' ?D' U xs \\<subseteq> range Some\"\n     by (rule con_comp_sinks_aux_range)\n    hence \"u \\<in> range Some\"\n     using G ..\n    hence \"\\<exists>d. u = Some d\"\n     by (simp add: image_iff)\n    then obtain d where H: \"u = Some d\" ..\n    ultimately have \"(d, D (inv p x)) \\<notin> I\"\n     using E by simp\n    hence \"(u, Some (D (inv p x))) \\<notin> ?I'\"\n     using H by (simp add: con_comp_pol_def)\n    moreover have \"x \\<in> range p\"\n     using C and D ..\n    ultimately show \"(u, ?D' x) \\<notin> ?I'\"\n     by simp\n  qed\nnext\n  fix a x\n  assume\n    D: \"x \\<in> X\" and\n    E: \"a = inv p x\" and\n    F: \"\\<forall>u \\<in> sinks_aux ?I' ?D' U xs. (u, ?D' x) \\<notin> ?I'\"\n  show \"(\\<exists>x \\<in> X. a = inv p x) \\<and>\n    (\\<forall>u \\<in> sinks_aux I D (the ` U) (map (inv p) xs). (u, D a) \\<notin> I)\"\n  proof (rule conjI, rule_tac [2] ballI)\n    show \"\\<exists>x \\<in> X. a = inv p x\"\n     using E and D ..\n  next\n    fix d\n    assume \"d \\<in> sinks_aux I D (the ` U) (map (inv p) xs)\"\n    moreover have \"sinks_aux I D (the ` U) (map (inv p) xs) =\n      the ` sinks_aux ?I' ?D' U xs\"\n     using A and B by (rule con_comp_sinks_aux)\n    ultimately have \"d \\<in> the ` sinks_aux ?I' ?D' U xs\"\n     by simp\n    hence \"\\<exists>u \\<in> sinks_aux ?I' ?D' U xs. d = the u\"\n     by (simp add: image_iff)\n    then obtain u where G: \"u \\<in> sinks_aux ?I' ?D' U xs\" and H: \"d = the u\" ..\n    have \"(u, ?D' x) \\<notin> ?I'\"\n     using F and G ..\n    moreover have \"set xs \\<subseteq> range p \\<union> range q\"\n     using B by blast\n    with A have \"sinks_aux ?I' ?D' U xs \\<subseteq> range Some\"\n     by (rule con_comp_sinks_aux_range)\n    hence \"u \\<in> range Some\"\n     using G ..\n    hence \"u = Some d\"\n     using H by (simp add: image_iff)\n    moreover have \"x \\<in> range p\"\n     using C and D ..\n    ultimately have \"(d, D (inv p x)) \\<notin> I\"\n     by (simp add: con_comp_pol_def)\n    thus \"(d, D a) \\<notin> I\"\n     using E by simp\n  qed\nqed\n\nlemma con_comp_sinks_filter:\n \"sinks (con_comp_pol I) (con_comp_map D E p q) u\n    [x\\<leftarrow>xs. x \\<in> range p \\<union> range q] =\n  sinks (con_comp_pol I) (con_comp_map D E p q) u xs \\<inter> range Some\"\n  (is \"sinks ?I' ?D' _ _ = _\")\nproof (induction xs rule: rev_induct, simp)\n  fix x xs\n  assume A: \"sinks ?I' ?D' u [x\\<leftarrow>xs. x \\<in> range p \\<union> range q] =\n    sinks ?I' ?D' u xs \\<inter> range Some\"\n    (is \"sinks _ _ _ ?xs' = _\")\n  show \"sinks ?I' ?D' u [x\\<leftarrow>xs @ [x]. x \\<in> range p \\<union> range q] =\n    sinks ?I' ?D' u (xs @ [x]) \\<inter> range Some\"\n  proof (cases \"x \\<in> range p \\<union> range q\", simp_all del: Un_iff sinks.simps,\n   cases \"(u, ?D' x) \\<in> ?I' \\<or> (\\<exists>v \\<in> sinks ?I' ?D' u ?xs'. (v, ?D' x) \\<in> ?I')\")\n    assume\n      B: \"x \\<in> range p \\<union> range q\" and\n      C: \"(u, ?D' x) \\<in> ?I' \\<or> (\\<exists>v \\<in> sinks ?I' ?D' u ?xs'. (v, ?D' x) \\<in> ?I')\"\n    have \"sinks ?I' ?D' u (?xs' @ [x]) =\n      insert (?D' x) (sinks ?I' ?D' u ?xs')\"\n     using C by simp\n    also have \"\\<dots> =\n      insert (?D' x) (sinks ?I' ?D' u xs \\<inter> range Some)\"\n     using A by simp\n    also have \"\\<dots> =\n      insert (?D' x) (sinks ?I' ?D' u xs) \\<inter> insert (?D' x) (range Some)\"\n     by simp\n    finally have \"sinks ?I' ?D' u (?xs' @ [x]) =\n      insert (?D' x) (sinks ?I' ?D' u xs) \\<inter> insert (?D' x) (range Some)\" .\n    moreover have \"insert (?D' x) (range Some) = range Some\"\n     using B by (rule_tac insert_absorb, cases \"x \\<in> range p\", simp_all)\n    ultimately have \"sinks ?I' ?D' u (?xs' @ [x]) =\n      insert (?D' x) (sinks ?I' ?D' u xs) \\<inter> range Some\"\n     by simp\n    moreover have \"(u, ?D' x) \\<in> ?I' \\<or>\n      (\\<exists>v \\<in> sinks ?I' ?D' u xs. (v, ?D' x) \\<in> ?I')\"\n     using A and C by (simp, blast)\n    ultimately show \"sinks ?I' ?D' u (?xs' @ [x]) =\n      sinks ?I' ?D' u (xs @ [x]) \\<inter> range Some\"\n     by simp\n  next\n    assume\n      B: \"x \\<in> range p \\<union> range q\" and\n      C: \"\\<not> ((u, ?D' x) \\<in> ?I' \\<or> (\\<exists>v \\<in> sinks ?I' ?D' u ?xs'. (v, ?D' x) \\<in> ?I'))\"\n    have \"sinks ?I' ?D' u (?xs' @ [x]) = sinks ?I' ?D' u ?xs'\"\n     using C by simp\n    hence \"sinks ?I' ?D' u (?xs' @ [x]) = sinks ?I' ?D' u xs \\<inter> range Some\"\n     using A by simp\n    moreover from C have\n     \"\\<not> ((u, ?D' x) \\<in> ?I' \\<or> (\\<exists>v \\<in> sinks ?I' ?D' u xs. (v, ?D' x) \\<in> ?I'))\"\n    proof (rule_tac notI, simp del: bex_simps)\n      assume \"\\<exists>v \\<in> sinks ?I' ?D' u xs. (v, ?D' x) \\<in> ?I'\"\n      then obtain v where E: \"v \\<in> sinks ?I' ?D' u xs\" and F: \"(v, ?D' x) \\<in> ?I'\" ..\n      have \"\\<exists>d. ?D' x = Some d\"\n       using B by (cases \"x \\<in> range p\", simp_all)\n      then obtain d where \"?D' x = Some d\" ..\n      hence \"(v, Some d) \\<in> ?I'\"\n       using F by simp\n      hence \"v \\<in> range Some\"\n       by (cases v, simp_all add: con_comp_pol_def)\n      with E have \"v \\<in> sinks ?I' ?D' u xs \\<inter> range Some\" ..\n      hence \"v \\<in> sinks ?I' ?D' u ?xs'\"\n       using A by simp\n      with F have \"\\<exists>v \\<in> sinks ?I' ?D' u ?xs'. (v, ?D' x) \\<in> ?I'\" ..\n      thus False\n       using C by simp\n    qed\n    ultimately show \"sinks ?I' ?D' u (?xs' @ [x]) =\n      sinks ?I' ?D' u (xs @ [x]) \\<inter> range Some\"\n     by simp\n  next\n    assume B: \"x \\<notin> range p \\<union> range q\"\n    hence \"(u, ?D' x) \\<in> ?I'\"\n     by (simp add: con_comp_pol_def)\n    hence \"sinks ?I' ?D' u (xs @ [x]) = insert (?D' x) (sinks ?I' ?D' u xs)\"\n     by simp\n    moreover have \"insert (?D' x) (sinks ?I' ?D' u xs) \\<inter> range Some =\n      sinks ?I' ?D' u xs \\<inter> range Some\"\n     using B by simp\n    ultimately have \"sinks ?I' ?D' u (xs @ [x]) \\<inter> range Some =\n      sinks ?I' ?D' u xs \\<inter> range Some\"\n     by simp\n    thus \"sinks ?I' ?D' u ?xs' = sinks ?I' ?D' u (xs @ [x]) \\<inter> range Some\"\n     using A by simp\n  qed\nqed\n\nlemma con_comp_ipurge_tr_filter:\n \"ipurge_tr (con_comp_pol I) (con_comp_map D E p q) u\n    [x\\<leftarrow>xs. x \\<in> range p \\<union> range q] =\n  ipurge_tr (con_comp_pol I) (con_comp_map D E p q) u xs\"\n  (is \"ipurge_tr ?I' ?D' _ _ = _\")\nproof (induction xs rule: rev_induct, simp)\n  fix x xs\n  assume A: \"ipurge_tr ?I' ?D' u [x\\<leftarrow>xs. x \\<in> range p \\<union> range q] =\n    ipurge_tr ?I' ?D' u xs\"\n    (is \"ipurge_tr _ _ _ ?xs' = _\")\n  show \"ipurge_tr ?I' ?D' u [x\\<leftarrow>xs @ [x]. x \\<in> range p \\<union> range q] =\n    ipurge_tr ?I' ?D' u (xs @ [x])\"\n  proof (cases \"x \\<in> range p \\<union> range q\", simp_all del: Un_iff ipurge_tr.simps,\n   cases \"?D' x \\<in> sinks ?I' ?D' u (?xs' @ [x])\")\n    assume\n      B: \"x \\<in> range p \\<union> range q\" and\n      C: \"?D' x \\<in> sinks ?I' ?D' u (?xs' @ [x])\"\n    have \"ipurge_tr ?I' ?D' u (?xs' @ [x]) = ipurge_tr ?I' ?D' u ?xs'\"\n     using C by simp\n    hence \"ipurge_tr ?I' ?D' u (?xs' @ [x]) = ipurge_tr ?I' ?D' u xs\"\n     using A by simp\n    moreover have \"?D' x \\<in> sinks ?I' ?D' u [x\\<leftarrow>xs @ [x]. x \\<in> range p \\<union> range q]\"\n     using B and C by simp\n    hence \"?D' x \\<in> sinks ?I' ?D' u (xs @ [x])\"\n     by (simp only: con_comp_sinks_filter, blast)\n    ultimately show \"ipurge_tr ?I' ?D' u (?xs' @ [x]) =\n      ipurge_tr ?I' ?D' u (xs @ [x])\"\n     by simp\n  next\n    assume\n      B: \"x \\<in> range p \\<union> range q\" and\n      C: \"\\<not> (?D' x \\<in> sinks ?I' ?D' u (?xs' @ [x]))\"\n    have \"ipurge_tr ?I' ?D' u (?xs' @ [x]) = ipurge_tr ?I' ?D' u ?xs' @ [x]\"\n     using C by simp\n    hence \"ipurge_tr ?I' ?D' u (?xs' @ [x]) = ipurge_tr ?I' ?D' u xs @ [x]\"\n     using A by simp\n    moreover have \"?D' x \\<notin> sinks ?I' ?D' u [x\\<leftarrow>xs @ [x]. x \\<in> range p \\<union> range q]\"\n     using B and C by simp\n    hence \"?D' x \\<notin> sinks ?I' ?D' u (xs @ [x]) \\<inter> range Some\"\n     by (simp only: con_comp_sinks_filter, simp)\n    hence \"?D' x \\<notin> sinks ?I' ?D' u (xs @ [x])\"\n     using B by (cases \"x \\<in> range p\", simp_all)\n    ultimately show \"ipurge_tr ?I' ?D' u (?xs' @ [x]) =\n      ipurge_tr ?I' ?D' u (xs @ [x])\"\n     by simp\n  next\n    assume \"x \\<notin> range p \\<union> range q\"\n    hence \"(u, ?D' x) \\<in> ?I'\"\n     by (simp add: con_comp_pol_def)\n    hence \"?D' x \\<in> sinks ?I' ?D' u (xs @ [x])\"\n     by simp\n    thus \"ipurge_tr ?I' ?D' u ?xs' = ipurge_tr ?I' ?D' u (xs @ [x])\"\n     using A by simp\n  qed\nqed\n\nlemma con_comp_ipurge_ref_filter:\n \"ipurge_ref (con_comp_pol I) (con_comp_map D E p q) u\n    [x\\<leftarrow>xs. x \\<in> range p \\<union> range q] X =\n  ipurge_ref (con_comp_pol I) (con_comp_map D E p q) u xs X\"\n  (is \"ipurge_ref ?I' ?D' _ _ _ = _\")\nproof (simp add: ipurge_ref_def con_comp_sinks_filter set_eq_iff del: Un_iff,\n rule allI, rule iffI, simp_all, (erule conjE)+, rule ballI)\n  fix x v\n  assume\n    A: \"(u, ?D' x) \\<notin> ?I'\" and\n    B: \"\\<forall>v \\<in> sinks ?I' ?D' u xs \\<inter> range Some. (v, ?D' x) \\<notin> ?I'\" and\n    C: \"v \\<in> sinks ?I' ?D' u xs\"\n  show \"(v, ?D' x) \\<notin> ?I'\"\n  proof (cases v, simp)\n    have \"?D' x \\<in> range Some\"\n     using A by (cases \"?D' x\", simp_all add: con_comp_pol_def)\n    thus \"(None, ?D' x) \\<notin> ?I'\"\n     by (simp add: image_iff con_comp_pol_def)\n  next\n    fix d\n    assume \"v = Some d\"\n    hence \"v \\<in> range Some\"\n     by simp\n    with C have \"v \\<in> sinks ?I' ?D' u xs \\<inter> range Some\" ..\n    with B show \"(v, ?D' x) \\<notin> ?I'\" ..\n  qed\nqed\n\nlemma con_comp_secure_aux [rule_format]:\n  assumes\n    A: \"secure P I D\" and\n    B: \"Y \\<subseteq> range p\"\n  shows \"set ys \\<subseteq> range p \\<union> range q \\<longrightarrow> U \\<subseteq> range Some \\<longrightarrow>\n    (map (inv p) [x\\<leftarrow>xs @ ys. x \\<in> range p], inv p ` Y) \\<in> failures P \\<longrightarrow>\n    (map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @\n     map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q)\n       (\\<lambda>x. x \\<in> range p) U ys),\n     inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q)\n       (\\<lambda>x. x \\<in> range p) U ys Y) \\<in> failures P\"\nproof (induction ys arbitrary: xs U, (rule_tac [!] impI)+, simp)\n  fix xs U\n  assume \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` Y) \\<in> failures P\"\n  moreover have\n   \"ipurge_ref_aux (con_comp_pol I) (con_comp_map D E p q) U [] Y \\<subseteq> Y\"\n    (is \"?Y' \\<subseteq> _\")\n   by (rule ipurge_ref_aux_subset)\n  hence \"inv p ` ?Y' \\<subseteq> inv p ` Y\"\n   by (rule image_mono)\n  ultimately show \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p], inv p ` ?Y') \\<in> failures P\"\n   by (rule process_rule_3)\nnext\n  fix y ys xs U\n  assume \"\\<And>xs U. set ys \\<subseteq> range p \\<union> range q \\<longrightarrow> U \\<subseteq> range Some \\<longrightarrow>\n    (map (inv p) [x\\<leftarrow>xs @ ys. x \\<in> range p], inv p ` Y) \\<in> failures P \\<longrightarrow>\n    (map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @\n     map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q)\n       (\\<lambda>x. x \\<in> range p) U ys),\n     inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q)\n       (\\<lambda>x. x \\<in> range p) U ys Y) \\<in> failures P\"\n  hence \"set ys \\<subseteq> range p \\<union> range q \\<longrightarrow>\n    sinks_aux (con_comp_pol I) (con_comp_map D E p q) U [y] \\<subseteq> range Some \\<longrightarrow>\n    (map (inv p) [x\\<leftarrow>(xs @ [y]) @ ys. x \\<in> range p], inv p ` Y) \\<in> failures P \\<longrightarrow>\n    (map (inv p) [x\\<leftarrow>xs @ [y]. x \\<in> range p] @\n     map (inv p) (ipurge_tr_aux_foldr (con_comp_pol I) (con_comp_map D E p q)\n       (\\<lambda>x. x \\<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q)\n         U [y]) ys),\n     inv p ` ipurge_ref_aux_foldr (con_comp_pol I) (con_comp_map D E p q)\n       (\\<lambda>x. x \\<in> range p) (sinks_aux (con_comp_pol I) (con_comp_map D E p q)\n         U [y]) ys Y) \\<in> failures P\"\n    (is \"_ \\<longrightarrow> _ \\<longrightarrow> _ \\<longrightarrow>\n      (_ @ map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F ?U' _), _) \\<in> _\") .\n  moreover assume C: \"set (y # ys) \\<subseteq> range p \\<union> range q\"\n  hence \"set ys \\<subseteq> range p \\<union> range q\"\n   by simp\n  ultimately have \"?U' \\<subseteq> range Some \\<longrightarrow>\n    (map (inv p) [x\\<leftarrow>(xs @ [y]) @ ys. x \\<in> range p], inv p ` Y) \\<in> failures P \\<longrightarrow>\n    (map (inv p) [x\\<leftarrow>xs @ [y]. x \\<in> range p] @\n     map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys),\n     inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y) \\<in> failures P\" ..\n  moreover assume D: \"U \\<subseteq> range Some\"\n  hence \"?U' \\<subseteq> range Some\"\n  proof (cases \"\\<exists>u \\<in> U. (u, ?D' y) \\<in> ?I'\", simp_all add: sinks_aux_single_event)\n    have \"y \\<in> range p \\<union> range q\"\n     using C by simp\n    thus \"?D' y \\<in> range Some\"\n     by (cases \"y \\<in> range p\", simp_all)\n  qed\n  ultimately have\n   \"(map (inv p) [x\\<leftarrow>(xs @ [y]) @ ys. x \\<in> range p], inv p ` Y) \\<in> failures P \\<longrightarrow>\n    (map (inv p) [x\\<leftarrow>xs @ [y]. x \\<in> range p] @\n     map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys),\n     inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y) \\<in> failures P\" ..\n  moreover assume\n   \"(map (inv p) [x\\<leftarrow>xs @ y # ys. x \\<in> range p], inv p ` Y) \\<in> failures P\"\n  ultimately have\n   \"(map (inv p) [x\\<leftarrow>xs @ [y]. x \\<in> range p] @\n     map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys),\n     inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y) \\<in> failures P\"\n   by simp\n  hence\n   \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @\n     map (inv p) ((if y \\<in> range p then [y] else []) @\n       ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys),\n     inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y) \\<in> failures P\"\n   by (cases \"y \\<in> range p\", simp_all)\n  with A have\n   \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @\n     ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \\<in> range p then [y] else []) @\n       ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys)),\n     ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \\<in> range p then [y] else []) @\n       ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys))\n     (inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y)) \\<in> failures P\"\n   by (rule ipurge_tr_ref_aux_failures_general)\n  moreover have\n   \"ipurge_tr_aux I D (the ` U) (map (inv p) ((if y \\<in> range p then [y] else []) @\n      ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys)) =\n    map (inv p) (ipurge_tr_aux ?I' ?D' U ((if y \\<in> range p then [y] else []) @\n      ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys))\"\n   by (rule con_comp_ipurge_tr_aux, simp_all add:\n    D ipurge_tr_aux_foldr_eq [symmetric], blast)\n  moreover have\n   \"ipurge_ref_aux I D (the ` U) (map (inv p) ((if y \\<in> range p then [y] else []) @\n      ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys))\n      (inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y) =\n    inv p ` ipurge_ref_aux ?I' ?D' U ((if y \\<in> range p then [y] else []) @\n      ipurge_tr_aux_foldr ?I' ?D' ?F ?U' ys)\n      (ipurge_ref_aux_foldr ?I' ?D' ?F ?U' ys Y)\"\n  proof (rule con_comp_ipurge_ref_aux, simp_all add:\n   D ipurge_tr_aux_foldr_eq [symmetric] ipurge_ref_aux_foldr_eq [symmetric], blast)\n    have \"ipurge_ref_aux ?I' ?D' ?U' ys Y \\<subseteq> Y\"\n     by (rule ipurge_ref_aux_subset)\n    thus \"ipurge_ref_aux ?I' ?D' ?U' ys Y \\<subseteq> range p\"\n     using B by simp\n  qed\n  ultimately show\n   \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @\n     map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F U (y # ys)),\n     inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F U (y # ys) Y) \\<in> failures P\"\n   by simp\nqed\n\n\nsubsection \"Conservation of noninterference security under concurrent composition\"\n\ntext \\<open>\nEverything is now ready for proving the target security conservation theorem. It states that for any\ntwo processes @{term P}, @{term Q} being secure with respect to the noninterference policy @{term I}\nand the event-domain maps @{term D}, @{term E}, their concurrent composition @{term \"P \\<parallel> Q <p, q>\"}\nis secure with respect to the noninterference policy @{term \"con_comp_pol I\"} and the event-domain\nmap @{term \"con_comp_map D E p q\"}, provided that condition @{term \"consistent_maps D E p q\"} is\nsatisfied.\n\nThe only assumption, in addition to the security of the input processes, is the consistency of the\nrespective event-domain maps. Particularly, this assumption permits to solve the proof obligations\nconcerning the latter input process by just swapping @{term D} for @{term E} and @{term p} for\n@{term q} in the term @{term \"con_comp_map D E p q\"} and then applying the corresponding lemmas\nproven for the former input process.\n\n\\null\n\\<close>\n\nlemma con_comp_secure_del_aux_1:\n  assumes\n    A: \"secure P I D\" and\n    B: \"y \\<in> range p \\<or> y \\<in> range q\" and\n    C: \"set ys \\<subseteq> range p \\<union> range q\" and\n    D: \"Y \\<subseteq> range p\" and\n    E: \"(map (inv p) [x\\<leftarrow>xs @ y # ys. x \\<in> range p], inv p ` Y) \\<in> failures P\"\n  shows\n   \"(map (inv p) [x\\<leftarrow>xs @ ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n       (con_comp_map D E p q y) ys. x \\<in> range p],\n     inv p ` ipurge_ref (con_comp_pol I) (con_comp_map D E p q)\n       (con_comp_map D E p q y) ys Y) \\<in> failures P\"\n    (is \"(map (inv p) [x\\<leftarrow>xs @ ipurge_tr ?I' ?D' _ _. _], _) \\<in> _\")\nproof (simp add:\n ipurge_tr_aux_single_dom [symmetric] ipurge_ref_aux_single_dom [symmetric]\n ipurge_tr_aux_foldr_eq ipurge_ref_aux_foldr_eq [where P = \"\\<lambda>x. x \\<in> range p\"])\n  have \"(map (inv p) [x\\<leftarrow>xs @ [y]. x \\<in> range p] @\n    map (inv p) (ipurge_tr_aux_foldr ?I' ?D' (\\<lambda>x. x \\<in> range p) {?D' y} ys),\n    inv p ` ipurge_ref_aux_foldr ?I' ?D' (\\<lambda>x. x \\<in> range p) {?D' y} ys Y)\n      \\<in> failures P\"\n    (is \"(_ @ map (inv p) (ipurge_tr_aux_foldr _ _ ?F _ _), _) \\<in> _\")\n  proof (rule con_comp_secure_aux [OF A D C])\n    show \"{?D' y} \\<subseteq> range Some\"\n     using B by (cases \"y \\<in> range p\", simp_all)\n  next\n    show \"(map (inv p) [x\\<leftarrow>(xs @ [y]) @ ys. x \\<in> range p], inv p ` Y) \\<in> failures P\"\n     using E by simp\n  qed\n  thus \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @\n    map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {?D' y} ys),\n    inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {?D' y} ys Y)\n      \\<in> failures P\"\n  proof (cases \"y \\<in> range p\", simp_all)\n    assume \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @ inv p y #\n      map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys),\n      inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y)\n      \\<in> failures P\"\n    hence \"(inv p y #\n      map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys),\n      inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y)\n      \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n     by (simp add: futures_def)\n    hence\n     \"(ipurge_tr I D (D (inv p y))\n         (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys)),\n       ipurge_ref I D (D (inv p y))\n         (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys))\n         (inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y))\n      \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n     using A by (simp add: secure_def)\n    hence\n     \"(ipurge_tr_aux I D (the ` {Some (D (inv p y))})\n         (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys)),\n       ipurge_ref_aux I D (the ` {Some (D (inv p y))})\n         (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys))\n         (inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y))\n      \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n     by (simp add: ipurge_tr_aux_single_dom ipurge_ref_aux_single_dom)\n    moreover have\n     \"ipurge_tr_aux I D (the ` {Some (D (inv p y))})\n        (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys)) =\n      map (inv p) (ipurge_tr_aux ?I' ?D' {Some (D (inv p y))}\n        (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys))\"\n     by (rule con_comp_ipurge_tr_aux, simp_all add:\n      ipurge_tr_aux_foldr_eq [symmetric], blast)\n    moreover have\n     \"ipurge_ref_aux I D (the ` {Some (D (inv p y))})\n        (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys))\n        (inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y) =\n      inv p ` ipurge_ref_aux ?I' ?D' {Some (D (inv p y))}\n        (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys)\n        (ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y)\"\n    proof (rule con_comp_ipurge_ref_aux, simp_all add:\n     ipurge_tr_aux_foldr_eq [symmetric] ipurge_ref_aux_foldr_eq [symmetric], blast)\n      have \"ipurge_ref_aux ?I' ?D' {Some (D (inv p y))} ys Y \\<subseteq> Y\"\n       by (rule ipurge_ref_aux_subset)\n      thus \"ipurge_ref_aux ?I' ?D' {Some (D (inv p y))} ys Y \\<subseteq> range p\"\n       using D by simp\n    qed\n    ultimately have\n     \"(map (inv p) (ipurge_tr_aux ?I' ?D' {Some (D (inv p y))}\n         (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys)),\n       inv p ` ipurge_ref_aux ?I' ?D' {Some (D (inv p y))}\n         (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys)\n         (ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y))\n      \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n     by simp\n    moreover have\n     \"ipurge_tr_aux ?I' ?D' {Some (D (inv p y))}\n        (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys) =\n      ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys\"\n     by (rule ipurge_tr_aux_foldr_subset, simp)\n    moreover have\n     \"ipurge_ref_aux ?I' ?D' {Some (D (inv p y))}\n        (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys)\n        (ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y) =\n      ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y\"\n     by (rule ipurge_ref_aux_foldr_subset, subst ipurge_tr_aux_foldr_sinks_aux, simp)\n    ultimately have\n     \"(map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys),\n       inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y)\n      \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n     by simp\n    thus \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @\n      map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys),\n      inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} ys Y)\n      \\<in> failures P\"\n     by (simp add: futures_def)\n  qed\nqed\n\nlemma con_comp_secure_add_aux_1:\n  assumes\n    A: \"secure P I D\" and\n    B: \"y \\<in> range p \\<or> y \\<in> range q\" and\n    C: \"set zs \\<subseteq> range p \\<union> range q\" and\n    D: \"Z \\<subseteq> range p\" and\n    E: \"(map (inv p) [x\\<leftarrow>xs @ zs. x \\<in> range p], inv p ` Z) \\<in> failures P\" and\n    F: \"map (inv p) [x\\<leftarrow>xs @ [y]. x \\<in> range p] \\<in> traces P\"\n  shows\n   \"(map (inv p) [x\\<leftarrow>xs @ y # ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n       (con_comp_map D E p q y) zs. x \\<in> range p],\n     inv p ` ipurge_ref (con_comp_pol I) (con_comp_map D E p q)\n       (con_comp_map D E p q y) zs Z) \\<in> failures P\"\n    (is \"(map (inv p) [x\\<leftarrow>xs @ y # ipurge_tr ?I' ?D' _ _. _], _) \\<in> _\")\nproof -\n  have\n   \"(map (inv p) [x\\<leftarrow>(xs @ [y]) @ ipurge_tr ?I' ?D' (?D' y) zs. x \\<in> range p],\n     inv p ` ipurge_ref ?I' ?D' (?D' y) zs Z) \\<in> failures P\"\n  proof (subst filter_append, simp del: filter_append add:\n   ipurge_tr_aux_single_dom [symmetric] ipurge_ref_aux_single_dom [symmetric]\n   ipurge_tr_aux_foldr_eq ipurge_ref_aux_foldr_eq [where P = \"\\<lambda>x. x \\<in> range p\"])\n    have \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @\n      map (inv p) (ipurge_tr_aux_foldr ?I' ?D' (\\<lambda>x. x \\<in> range p) {?D' y} zs),\n      inv p ` ipurge_ref_aux_foldr ?I' ?D' (\\<lambda>x. x \\<in> range p) {?D' y} zs Z)\n        \\<in> failures P\"\n      (is \"(_ @ map (inv p) (ipurge_tr_aux_foldr _ _ ?F _ _), _) \\<in> _\")\n    proof (rule con_comp_secure_aux [OF A D C])\n      show \"{?D' y} \\<subseteq> range Some\"\n       using B by (cases \"y \\<in> range p\", simp_all)\n    next\n      show \"(map (inv p) [x\\<leftarrow>xs @ zs. x \\<in> range p], inv p ` Z) \\<in> failures P\"\n       using E .\n    qed\n    thus \"(map (inv p) [x\\<leftarrow>xs @ [y]. x \\<in> range p] @\n      map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {?D' y} zs),\n      inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {?D' y} zs Z)\n        \\<in> failures P\"\n    proof (cases \"y \\<in> range p\", simp_all)\n      case True\n      assume \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @\n        map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs),\n        inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs Z)\n        \\<in> failures P\"\n      hence\n       \"(map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs),\n         inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs Z)\n        \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n       by (simp add: futures_def)\n      moreover have \"(map (inv p) [x\\<leftarrow>xs @ [y]. x \\<in> range p], {}) \\<in> failures P\"\n       using F by (rule traces_failures)\n      hence \"([inv p y], {}) \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n       using True by (simp add: futures_def)\n      ultimately have\n       \"(inv p y # ipurge_tr I D (D (inv p y))\n           (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs)),\n         ipurge_ref I D (D (inv p y))\n           (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs))\n           (inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs Z))\n        \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n       using A by (simp add: secure_def)\n      hence\n       \"(inv p y # ipurge_tr_aux I D (the ` {Some (D (inv p y))})\n           (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs)),\n         ipurge_ref_aux I D (the ` {Some (D (inv p y))})\n           (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs))\n           (inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs Z))\n        \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n       by (simp add: ipurge_tr_aux_single_dom ipurge_ref_aux_single_dom)\n      moreover have\n       \"ipurge_tr_aux I D (the ` {Some (D (inv p y))})\n          (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs)) =\n        map (inv p) (ipurge_tr_aux ?I' ?D' {Some (D (inv p y))}\n          (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs))\"\n       by (rule con_comp_ipurge_tr_aux, simp_all add:\n        ipurge_tr_aux_foldr_eq [symmetric], blast)\n      moreover have\n       \"ipurge_ref_aux I D (the ` {Some (D (inv p y))})\n          (map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs))\n          (inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs Z) =\n        inv p ` ipurge_ref_aux ?I' ?D' {Some (D (inv p y))}\n          (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs)\n          (ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs Z)\"\n      proof (rule con_comp_ipurge_ref_aux, simp_all add:\n       ipurge_tr_aux_foldr_eq [symmetric] ipurge_ref_aux_foldr_eq [symmetric], blast)\n        have \"ipurge_ref_aux ?I' ?D' {Some (D (inv p y))} zs Z \\<subseteq> Z\"\n         by (rule ipurge_ref_aux_subset)\n        thus \"ipurge_ref_aux ?I' ?D' {Some (D (inv p y))} zs Z \\<subseteq> range p\"\n         using D by simp\n      qed\n      ultimately have\n       \"(inv p y # map (inv p) (ipurge_tr_aux ?I' ?D' {Some (D (inv p y))}\n           (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs)),\n         inv p ` ipurge_ref_aux ?I' ?D' {Some (D (inv p y))}\n           (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs)\n           (ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs Z))\n        \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n       by simp\n      moreover have\n       \"ipurge_tr_aux ?I' ?D' {Some (D (inv p y))}\n          (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs) =\n        ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs\"\n       by (rule ipurge_tr_aux_foldr_subset, simp)\n      moreover have\n       \"ipurge_ref_aux ?I' ?D' {Some (D (inv p y))}\n          (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs)\n          (ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs Z) =\n        ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs Z\"\n       by (rule ipurge_ref_aux_foldr_subset, subst ipurge_tr_aux_foldr_sinks_aux, simp)\n      ultimately have\n       \"(inv p y # map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F\n           {Some (D (inv p y))} zs),\n         inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F\n           {Some (D (inv p y))} zs Z)\n        \\<in> futures P (map (inv p) [x\\<leftarrow>xs. x \\<in> range p])\"\n       by simp\n      thus \"(map (inv p) [x\\<leftarrow>xs. x \\<in> range p] @ inv p y #\n        map (inv p) (ipurge_tr_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs),\n        inv p ` ipurge_ref_aux_foldr ?I' ?D' ?F {Some (D (inv p y))} zs Z)\n        \\<in> failures P\"\n       by (simp add: futures_def)\n    qed\n  qed\n  thus ?thesis\n   by simp\nqed\n\nlemma con_comp_consistent_maps:\n \"consistent_maps D E p q \\<Longrightarrow> con_comp_map D E p q = con_comp_map E D q p\"\nusing [[simproc del: defined_all]] proof (simp add: consistent_maps_def, rule ext)\n  fix x\n  assume A: \"\\<forall>x \\<in> range p \\<inter> range q. D (inv p x) = E (inv q x)\"\n  show \"con_comp_map D E p q x = con_comp_map E D q p x\"\n  proof (rule con_comp_map.cases [of \"(D, E, p, q, x)\"], simp_all, (erule conjE)+)\n    fix p' q' D' E' x'\n    assume\n      B: \"p = p'\" and\n      C: \"q = q'\" and\n      D: \"D = D'\" and\n      E: \"E = E'\" and\n      F: \"x' \\<in> range p'\"\n    show \"Some (D' (inv p' x')) = con_comp_map E' D' q' p' x'\"\n    proof (cases \"x' \\<in> range q'\", simp_all add: F)\n      case True\n      with F have \"x' \\<in> range p' \\<inter> range q'\" ..\n      hence \"x' \\<in> range p \\<inter> range q\"\n       using B and C by simp\n      with A have \"D (inv p x') = E (inv q x')\" ..\n      thus \"D' (inv p' x') = E' (inv q' x')\"\n       using B and C and D and E by simp\n    qed\n  qed\nqed\n\nlemma con_comp_secure_del_aux_2:\n  assumes A: \"consistent_maps D E p q\"\n  shows\n   \"secure Q I E \\<Longrightarrow>\n    y \\<in> range p \\<or> y \\<in> range q \\<Longrightarrow>\n    set ys \\<subseteq> range p \\<union> range q \\<Longrightarrow>\n    Y \\<subseteq> range q \\<Longrightarrow>\n    (map (inv q) [x\\<leftarrow>xs @ y # ys. x \\<in> range q], inv q ` Y) \\<in> failures Q \\<Longrightarrow>\n      (map (inv q) [x\\<leftarrow>xs @ ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n         (con_comp_map D E p q y) ys. x \\<in> range q],\n       inv q ` ipurge_ref (con_comp_pol I) (con_comp_map D E p q)\n         (con_comp_map D E p q y) ys Y) \\<in> failures Q\"\nproof (simp only: con_comp_consistent_maps [OF A], rule con_comp_secure_del_aux_1)\nqed (simp_all, blast+)\n\nlemma con_comp_secure_add_aux_2:\n  assumes A: \"consistent_maps D E p q\"\n  shows\n   \"secure Q I E \\<Longrightarrow>\n    y \\<in> range p \\<or> y \\<in> range q \\<Longrightarrow>\n    set zs \\<subseteq> range p \\<union> range q \\<Longrightarrow>\n    Z \\<subseteq> range q \\<Longrightarrow>\n    (map (inv q) [x\\<leftarrow>xs @ zs. x \\<in> range q], inv q ` Z) \\<in> failures Q \\<Longrightarrow>\n    map (inv q) [x\\<leftarrow>xs @ [y]. x \\<in> range q] \\<in> traces Q \\<Longrightarrow>\n      (map (inv q) [x\\<leftarrow>xs @ y # ipurge_tr (con_comp_pol I)\n         (con_comp_map D E p q) (con_comp_map D E p q y) zs. x \\<in> range q],\n       inv q ` ipurge_ref (con_comp_pol I)\n         (con_comp_map D E p q) (con_comp_map D E p q y) zs Z) \\<in> failures Q\"\nproof (simp only: con_comp_consistent_maps [OF A], rule con_comp_secure_add_aux_1)\nqed (simp_all, blast+)\n\nlemma con_comp_secure_del_case_1:\n  assumes\n    A: \"consistent_maps D E p q\" and\n    B: \"secure P I D\" and\n    C: \"secure Q I E\"\n  shows\n   \"\\<exists>R S T.\n      Y = R \\<union> S \\<union> T \\<and>\n      (y \\<in> range p \\<or> y \\<in> range q) \\<and>\n      set xs \\<subseteq> range p \\<union> range q \\<and>\n      set ys \\<subseteq> range p \\<union> range q \\<and>\n      R \\<subseteq> range p \\<and>\n      S \\<subseteq> range q \\<and>\n      T \\<subseteq> - range p \\<and>\n      T \\<subseteq> - range q \\<and>\n      (map (inv p) [x\\<leftarrow>xs @ y # ys. x \\<in> range p], inv p ` R) \\<in> failures P \\<and>\n      (map (inv q) [x\\<leftarrow>xs @ y # ys. x \\<in> range q], inv q ` S) \\<in> failures Q \\<Longrightarrow>\n    \\<exists>R S T.\n      ipurge_ref (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) ys Y = R \\<union> S \\<union> T \\<and>\n      set xs \\<subseteq> range p \\<union> range q \\<and>                     \n      set (ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) ys) \\<subseteq> range p \\<union> range q \\<and>\n      R \\<subseteq> range p \\<and>\n      S \\<subseteq> range q \\<and>\n      T \\<subseteq> - range p \\<and>\n      T \\<subseteq> - range q \\<and>\n      (map (inv p) [x\\<leftarrow>xs @ ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) ys. x \\<in> range p], inv p ` R) \\<in> failures P \\<and>\n      (map (inv q) [x\\<leftarrow>xs @ ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) ys. x \\<in> range q], inv q ` S) \\<in> failures Q\"\n  (is \"_ \\<Longrightarrow> \\<exists>_ _ _. ipurge_ref ?I' ?D' _ _ _ = _ \\<and> _\")\nproof ((erule exE)+, (erule conjE)+)\n  fix R S T\n  assume\n    D: \"Y = R \\<union> S \\<union> T\" and\n    E: \"y \\<in> range p \\<or> y \\<in> range q\" and\n    F: \"set xs \\<subseteq> range p \\<union> range q\" and\n    G: \"set ys \\<subseteq> range p \\<union> range q\" and\n    H: \"R \\<subseteq> range p\" and\n    I: \"S \\<subseteq> range q\" and\n    J: \"T \\<subseteq> - range p\" and\n    K: \"T \\<subseteq> - range q\" and\n    L: \"(map (inv p) [x\\<leftarrow>xs @ y # ys. x \\<in> range p], inv p ` R) \\<in> failures P\" and\n    M: \"(map (inv q) [x\\<leftarrow>xs @ y # ys. x \\<in> range q], inv q ` S) \\<in> failures Q\"\n  show ?thesis\n  proof (rule_tac x = \"ipurge_ref ?I' ?D' (?D' y) ys R\" in exI,\n   rule_tac x = \"ipurge_ref ?I' ?D' (?D' y) ys S\" in exI, rule_tac x = \"{}\" in exI,\n   (subst conj_assoc [symmetric])+, (rule conjI)+, simp_all del: filter_append)\n    have \"ipurge_ref ?I' ?D' (?D' y) ys Y =\n      ipurge_ref ?I' ?D' (?D' y) ys (R \\<union> S \\<union> T)\"\n     using D by simp\n    hence \"ipurge_ref ?I' ?D' (?D' y) ys Y =\n      ipurge_ref ?I' ?D' (?D' y) ys R \\<union>\n      ipurge_ref ?I' ?D' (?D' y) ys S \\<union>\n      ipurge_ref ?I' ?D' (?D' y) ys T\"\n     by (simp add: ipurge_ref_distrib_union)\n    moreover have \"ipurge_ref ?I' ?D' (?D' y) ys T = {}\"\n    proof (rule ipurge_ref_empty [of \"?D' y\"], simp, insert E,\n     cases \"y \\<in> range p\", simp_all)\n      fix x\n      assume N: \"x \\<in> T\"\n      with J have \"x \\<in> - range p\" ..\n      moreover have \"x \\<in> - range q\"\n       using K and N ..\n      ultimately have \"?D' x = None\"\n       by simp\n      thus \"(Some (D (inv p y)), ?D' x) \\<in> ?I'\"\n       by (simp add: con_comp_pol_def)\n    next\n      fix x\n      assume N: \"x \\<in> T\"\n      with J have \"x \\<in> - range p\" ..\n      moreover have \"x \\<in> - range q\"\n       using K and N ..\n      ultimately have \"?D' x = None\"\n       by simp\n      thus \"(Some (E (inv q y)), ?D' x) \\<in> ?I'\"\n       by (simp add: con_comp_pol_def)\n    qed\n    ultimately show \"ipurge_ref ?I' ?D' (?D' y) ys Y =\n      ipurge_ref ?I' ?D' (?D' y) ys R \\<union>\n      ipurge_ref ?I' ?D' (?D' y) ys S\"\n     by simp\n  next\n    show \"set xs \\<subseteq> range p \\<union> range q\"\n     using F .\n  next\n    have \"set (ipurge_tr ?I' ?D' (?D' y) ys) \\<subseteq> set ys\"\n     by (rule ipurge_tr_set)\n    thus \"set (ipurge_tr ?I' ?D' (?D' y) ys) \\<subseteq> range p \\<union> range q\"\n     using G by simp\n  next\n    have \"ipurge_ref ?I' ?D' (?D' y) ys R \\<subseteq> R\"\n     by (rule ipurge_ref_subset)\n    thus \"ipurge_ref ?I' ?D' (?D' y) ys R \\<subseteq> range p\"\n     using H by simp\n  next\n    have \"ipurge_ref ?I' ?D' (?D' y) ys S \\<subseteq> S\"\n     by (rule ipurge_ref_subset)\n    thus \"ipurge_ref ?I' ?D' (?D' y) ys S \\<subseteq> range q\"\n     using I by simp\n  next\n    show \"(map (inv p) [x\\<leftarrow>xs @ ipurge_tr ?I' ?D' (?D' y) ys. x \\<in> range p],\n      inv p ` ipurge_ref ?I' ?D' (?D' y) ys R) \\<in> failures P\"\n     by (rule con_comp_secure_del_aux_1 [OF B E G H L])\n  next\n    show \"(map (inv q) [x\\<leftarrow>xs @ ipurge_tr ?I' ?D' (?D' y) ys. x \\<in> range q],\n      inv q ` ipurge_ref ?I' ?D' (?D' y) ys S) \\<in> failures Q\"\n     by (rule con_comp_secure_del_aux_2 [OF A C E G I M])\n  qed\nqed\n\nlemma con_comp_secure_del_case_2:\n  assumes\n    A: \"consistent_maps D E p q\" and\n    B: \"secure P I D\" and\n    C: \"secure Q I E\"\n  shows\n   \"\\<exists>xs'.\n      (\\<exists>ys'. xs @ y # ys = xs' @ ys') \\<and>\n      set xs' \\<subseteq> range p \\<union> range q \\<and>\n      map (inv p) [x\\<leftarrow>xs'. x \\<in> range p] \\<in> divergences P \\<and>\n      map (inv q) [x\\<leftarrow>xs'. x \\<in> range q] \\<in> divergences Q \\<Longrightarrow>\n    (\\<exists>R S T.\n      ipurge_ref (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) ys Y = R \\<union> S \\<union> T \\<and>\n      set xs \\<subseteq> range p \\<union> range q \\<and>\n      set (ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) ys) \\<subseteq> range p \\<union> range q \\<and>\n      R \\<subseteq> range p \\<and>\n      S \\<subseteq> range q \\<and>\n      T \\<subseteq> - range p \\<and>\n      T \\<subseteq> - range q \\<and>\n      (map (inv p) [x\\<leftarrow>xs @ ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) ys. x \\<in> range p], inv p ` R) \\<in> failures P \\<and>\n      (map (inv q) [x\\<leftarrow>xs @ ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) ys. x \\<in> range q], inv q ` S) \\<in> failures Q) \\<or>\n    (\\<exists>xs'.\n      (\\<exists>ys'. xs @ ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) ys = xs' @ ys') \\<and>\n      set xs' \\<subseteq> range p \\<union> range q \\<and>\n      map (inv p) [x\\<leftarrow>xs'. x \\<in> range p] \\<in> divergences P \\<and>\n      map (inv q) [x\\<leftarrow>xs'. x \\<in> range q] \\<in> divergences Q)\"\n  (is \"_ \\<Longrightarrow> (\\<exists>R S T. ?F R S T ys) \\<or> ?G\")\nproof (erule exE, (erule conjE)+, erule exE)\n  fix xs' ys'\n  assume\n    D: \"set xs' \\<subseteq> range p \\<union> range q\" and\n    E: \"map (inv p) [x\\<leftarrow>xs'. x \\<in> range p] \\<in> divergences P\" and\n    F: \"map (inv q) [x\\<leftarrow>xs'. x \\<in> range q] \\<in> divergences Q\" and\n    G: \"xs @ y # ys = xs' @ ys'\"\n  show ?thesis\n  proof (cases \"length xs < length xs'\", rule disjI1, rule_tac [2] disjI2)\n    case True\n    moreover have \"take (length xs') (xs @ [y] @ ys) =\n      take (length xs') (xs @ [y]) @ take (length xs' - Suc (length xs)) ys\"\n     by (simp only: take_append, simp)\n    ultimately have \"take (length xs') (xs @ [y] @ ys) =\n      xs @ y # take (length xs' - Suc (length xs)) ys\"\n      (is \"_ = _ @ _ # ?vs\")\n     by simp\n    moreover have \"take (length xs') (xs @ [y] @ ys) =\n      take (length xs') (xs' @ ys')\"\n     using G by simp\n    ultimately have H: \"xs @ y # ?vs = xs'\"\n     by simp\n    moreover have \"y \\<in> set (xs @ y # ?vs)\"\n     by simp\n    ultimately have \"y \\<in> set xs'\"\n     by simp\n    with D have I: \"y \\<in> range p \\<union> range q\" ..\n    have \"set xs \\<subseteq> set (xs @ y # ?vs)\"\n     by auto\n    hence \"set xs \\<subseteq> set xs'\"\n     using H by simp\n    hence J: \"set xs \\<subseteq> range p \\<union> range q\"\n     using D by simp\n    have \"\\<exists>R S T. ?F R S T [x\\<leftarrow>ys. x \\<in> range p \\<union> range q]\"\n      (is \"\\<exists>_ _ _. ipurge_ref ?I' ?D' _ _ _ = _ \\<and> _\")\n    proof (rule con_comp_secure_del_case_1 [OF A B C],\n     rule_tac x = \"range p \\<inter> Y\" in exI, rule_tac x = \"range q \\<inter> Y\" in exI,\n     rule_tac x = \"- range p \\<inter> - range q \\<inter> Y\" in exI,\n     (subst conj_assoc [symmetric])+, (rule conjI)+, simp_all del: filter_append)\n      show \"Y = range p \\<inter> Y \\<union> range q \\<inter> Y \\<union> - range p \\<inter> - range q \\<inter> Y\"\n       by blast\n    next\n      show \"y \\<in> range p \\<or> y \\<in> range q\"\n       using I by simp\n    next\n      show \"set xs \\<subseteq> range p \\<union> range q\"\n       using J .\n    next\n      show \"{x \\<in> set ys. x \\<in> range p \\<or> x \\<in> range q} \\<subseteq> range p \\<union> range q\"\n       by blast\n    next\n      show \"- range p \\<inter> - range q \\<inter> Y \\<subseteq> - range p\"\n       by blast\n    next\n      show \"- range p \\<inter> - range q \\<inter> Y \\<subseteq> - range q\"\n       by blast\n    next\n      have \"map (inv p) [x\\<leftarrow>xs @ y # ?vs. x \\<in> range p] \\<in> divergences P\"\n       using E and H by simp\n      hence \"map (inv p) [x\\<leftarrow>xs @ y # ?vs. x \\<in> range p] @\n        map (inv p) [x\\<leftarrow>drop (length xs' - Suc (length xs)) ys. x \\<in> range p]\n        \\<in> divergences P\"\n        (is \"_ @ map (inv p) [x\\<leftarrow>?ws. _] \\<in> _\")\n       by (rule process_rule_5_general)\n      hence \"map (inv p) [x\\<leftarrow>(xs @ y # ?vs) @ ?ws. x \\<in> range p] \\<in> divergences P\"\n       by (subst filter_append, simp)\n      hence \"map (inv p) [x\\<leftarrow>(xs @ [y]) @ ys. x \\<in> range p] \\<in> divergences P\"\n       by simp\n      hence \"map (inv p) [x\\<leftarrow>(xs @ [y]) @ [x\\<leftarrow>ys. x \\<in> range p \\<or> x \\<in> range q].\n        x \\<in> range p] \\<in> divergences P\"\n      proof (subst (asm) filter_append, subst filter_append, subst filter_filter)\n      qed (subgoal_tac \"(\\<lambda>x. (x \\<in> range p \\<or> x \\<in> range q) \\<and> x \\<in> range p) =\n       (\\<lambda>x. x \\<in> range p)\", simp, blast)\n      hence \"map (inv p) [x\\<leftarrow>xs @ y # [x\\<leftarrow>ys. x \\<in> range p \\<or> x \\<in> range q].\n        x \\<in> range p] \\<in> divergences P\"\n       by simp\n      thus \"(map (inv p) [x\\<leftarrow>xs @ y # [x\\<leftarrow>ys. x \\<in> range p \\<or> x \\<in> range q].\n        x \\<in> range p], inv p ` (range p \\<inter> Y)) \\<in> failures P\"\n       by (rule process_rule_6)\n    next\n      have \"map (inv q) [x\\<leftarrow>xs @ y # ?vs. x \\<in> range q] \\<in> divergences Q\"\n       using F and H by simp\n      hence \"map (inv q) [x\\<leftarrow>xs @ y # ?vs. x \\<in> range q] @\n        map (inv q) [x\\<leftarrow>drop (length xs' - Suc (length xs)) ys. x \\<in> range q]\n        \\<in> divergences Q\"\n        (is \"_ @ map (inv q) [x\\<leftarrow>?ws. _] \\<in> _\")\n       by (rule process_rule_5_general)\n      hence \"map (inv q) [x\\<leftarrow>(xs @ y # ?vs) @ ?ws. x \\<in> range q] \\<in> divergences Q\"\n       by (subst filter_append, simp)\n      hence \"map (inv q) [x\\<leftarrow>(xs @ [y]) @ ys. x \\<in> range q] \\<in> divergences Q\"\n       by simp\n      hence \"map (inv q) [x\\<leftarrow>(xs @ [y]) @ [x\\<leftarrow>ys. x \\<in> range p \\<or> x \\<in> range q].\n        x \\<in> range q] \\<in> divergences Q\"\n      proof (subst (asm) filter_append, subst filter_append, subst filter_filter)\n      qed (subgoal_tac \"(\\<lambda>x. (x \\<in> range p \\<or> x \\<in> range q) \\<and> x \\<in> range q) =\n       (\\<lambda>x. x \\<in> range q)\", simp, blast)\n      hence \"map (inv q) [x\\<leftarrow>xs @ y # [x\\<leftarrow>ys. x \\<in> range p \\<or> x \\<in> range q].\n        x \\<in> range q] \\<in> divergences Q\"\n       by simp\n      thus \"(map (inv q) [x\\<leftarrow>xs @ y # [x\\<leftarrow>ys. x \\<in> range p \\<or> x \\<in> range q].\n        x \\<in> range q], inv q ` (range q \\<inter> Y)) \\<in> failures Q\"\n       by (rule process_rule_6)\n    qed\n    then obtain R and S and T where\n     \"?F R S T [x\\<leftarrow>ys. x \\<in> range p \\<union> range q]\"\n     by blast\n    thus \"\\<exists>R S T. ?F R S T ys\"\n    proof (rule_tac x = R in exI, rule_tac x = S in exI, rule_tac x = T in exI)\n    qed (simp only: con_comp_ipurge_tr_filter con_comp_ipurge_ref_filter)\n  next\n    let\n      ?I' = \"con_comp_pol I\" and\n      ?D' = \"con_comp_map D E p q\"\n    case False\n    moreover have \"xs @ ipurge_tr ?I' ?D' (?D' y) ys =\n      take (length xs') (xs @ ipurge_tr ?I' ?D' (?D' y) ys) @\n      drop (length xs') (xs @ ipurge_tr ?I' ?D' (?D' y) ys)\"\n      (is \"_ = _ @ ?vs\")\n     by (simp only: append_take_drop_id)\n    ultimately have \"xs @ ipurge_tr ?I' ?D' (?D' y) ys =\n      take (length xs') (xs @ y # ys) @ ?vs\"\n     by simp\n    hence H: \"xs @ ipurge_tr ?I' ?D' (?D' y) ys = xs' @ ?vs\"\n     using G by simp\n    show ?G\n    proof (rule_tac x = xs' in exI, rule conjI, rule_tac x = ?vs in exI)\n    qed (subst H, simp_all add: D E F)\n  qed\nqed\n\nlemma con_comp_secure_add_case_1:\n  assumes\n    A: \"consistent_maps D E p q\" and\n    B: \"secure P I D\" and\n    C: \"secure Q I E\" and\n    D: \"(xs @ y # ys, Y) \\<in> con_comp_failures P Q p q\" and\n    E: \"y \\<in> range p \\<or> y \\<in> range q\"\n  shows\n   \"\\<exists>R S T.\n      Z = R \\<union> S \\<union> T \\<and>\n      set xs \\<subseteq> range p \\<union> range q \\<and>\n      set zs \\<subseteq> range p \\<union> range q \\<and>\n      R \\<subseteq> range p \\<and>\n      S \\<subseteq> range q \\<and>\n      T \\<subseteq> - range p \\<and>\n      T \\<subseteq> - range q \\<and>\n      (map (inv p) [x\\<leftarrow>xs @ zs. x \\<in> range p], inv p ` R) \\<in> failures P \\<and>\n      (map (inv q) [x\\<leftarrow>xs @ zs. x \\<in> range q], inv q ` S) \\<in> failures Q \\<Longrightarrow>\n    \\<exists>R S T.\n      ipurge_ref (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) zs Z = R \\<union> S \\<union> T \\<and>\n      set xs \\<subseteq> range p \\<union> range q \\<and>\n      set (ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) zs) \\<subseteq> range p \\<union> range q \\<and>\n      R \\<subseteq> range p \\<and>\n      S \\<subseteq> range q \\<and>\n      T \\<subseteq> - range p \\<and>\n      T \\<subseteq> - range q \\<and>\n      (map (inv p) [x\\<leftarrow>xs @ y # ipurge_tr (con_comp_pol I)\n         (con_comp_map D E p q) (con_comp_map D E p q y) zs. x \\<in> range p],\n       inv p ` R) \\<in> failures P \\<and>\n      (map (inv q) [x\\<leftarrow>xs @ y # ipurge_tr (con_comp_pol I)\n         (con_comp_map D E p q) (con_comp_map D E p q y) zs. x \\<in> range q],\n       inv q ` S) \\<in> failures Q\"\n  (is \"_ \\<Longrightarrow> \\<exists>_ _ _. ipurge_ref ?I' ?D' _ _ _ = _ \\<and> _\")\nproof ((erule exE)+, (erule conjE)+)\n  fix R S T\n  assume\n    F: \"Z = R \\<union> S \\<union> T\" and\n    G: \"set xs \\<subseteq> range p \\<union> range q\" and\n    H: \"set zs \\<subseteq> range p \\<union> range q\" and\n    I: \"R \\<subseteq> range p\" and\n    J: \"S \\<subseteq> range q\" and\n    K: \"T \\<subseteq> - range p\" and\n    L: \"T \\<subseteq> - range q\" and\n    M: \"(map (inv p) [x\\<leftarrow>xs @ zs. x \\<in> range p], inv p ` R) \\<in> failures P\" and\n    N: \"(map (inv q) [x\\<leftarrow>xs @ zs. x \\<in> range q], inv q ` S) \\<in> failures Q\"\n  show ?thesis\n  proof (rule_tac x = \"ipurge_ref ?I' ?D' (?D' y) zs R\" in exI,\n   rule_tac x = \"ipurge_ref ?I' ?D' (?D' y) zs S\" in exI, rule_tac x = \"{}\" in exI,\n   (subst conj_assoc [symmetric])+, (rule conjI)+, simp_all del: filter_append)\n    have \"ipurge_ref ?I' ?D' (?D' y) zs Z =\n      ipurge_ref ?I' ?D' (?D' y) zs (R \\<union> S \\<union> T)\"\n     using F by simp\n    hence \"ipurge_ref ?I' ?D' (?D' y) zs Z =\n      ipurge_ref ?I' ?D' (?D' y) zs R \\<union>\n      ipurge_ref ?I' ?D' (?D' y) zs S \\<union>\n      ipurge_ref ?I' ?D' (?D' y) zs T\"\n     by (simp add: ipurge_ref_distrib_union)\n    moreover have \"ipurge_ref ?I' ?D' (?D' y) zs T = {}\"\n    proof (rule ipurge_ref_empty [of \"?D' y\"], simp, insert E,\n     cases \"y \\<in> range p\", simp_all)\n      fix x\n      assume O: \"x \\<in> T\"\n      with K have \"x \\<in> - range p\" ..\n      moreover have \"x \\<in> - range q\"\n       using L and O ..\n      ultimately have \"?D' x = None\"\n       by simp\n      thus \"(Some (D (inv p y)), ?D' x) \\<in> ?I'\"\n       by (simp add: con_comp_pol_def)\n    next\n      fix x\n      assume O: \"x \\<in> T\"\n      with K have \"x \\<in> - range p\" ..\n      moreover have \"x \\<in> - range q\"\n       using L and O ..\n      ultimately have \"?D' x = None\"\n       by simp\n      thus \"(Some (E (inv q y)), ?D' x) \\<in> ?I'\"\n       by (simp add: con_comp_pol_def)\n    qed\n    ultimately show \"ipurge_ref ?I' ?D' (?D' y) zs Z =\n      ipurge_ref ?I' ?D' (?D' y) zs R \\<union>\n      ipurge_ref ?I' ?D' (?D' y) zs S\"\n     by simp\n  next\n    show \"set xs \\<subseteq> range p \\<union> range q\"\n     using G .\n  next\n    have \"set (ipurge_tr ?I' ?D' (?D' y) zs) \\<subseteq> set zs\"\n     by (rule ipurge_tr_set)\n    thus \"set (ipurge_tr ?I' ?D' (?D' y) zs) \\<subseteq> range p \\<union> range q\"\n     using H by simp\n  next\n    have \"ipurge_ref ?I' ?D' (?D' y) zs R \\<subseteq> R\"\n     by (rule ipurge_ref_subset)\n    thus \"ipurge_ref ?I' ?D' (?D' y) zs R \\<subseteq> range p\"\n     using I by simp\n  next\n    have \"ipurge_ref ?I' ?D' (?D' y) zs S \\<subseteq> S\"\n     by (rule ipurge_ref_subset)\n    thus \"ipurge_ref ?I' ?D' (?D' y) zs S \\<subseteq> range q\"\n     using J by simp\n  next\n    have \"map (inv p) [x\\<leftarrow>xs @ y # ys. x \\<in> range p] \\<in> traces P \\<and>\n      map (inv q) [x\\<leftarrow>xs @ y # ys. x \\<in> range q] \\<in> traces Q\"\n     using D by (rule con_comp_failures_traces)\n    hence \"map (inv p) [x\\<leftarrow>(xs @ [y]) @ ys. x \\<in> range p] \\<in> traces P\"\n     by simp\n    hence \"map (inv p) [x\\<leftarrow>xs @ [y]. x \\<in> range p] @\n      map (inv p) [x\\<leftarrow>ys. x \\<in> range p] \\<in> traces P\"\n     by (subst (asm) filter_append, simp)\n    hence \"map (inv p) [x\\<leftarrow>xs @ [y]. x \\<in> range p] \\<in> traces P\"\n     by (rule process_rule_2_traces)\n    thus \"(map (inv p) [x\\<leftarrow>xs @ y # ipurge_tr ?I' ?D' (?D' y) zs. x \\<in> range p],\n      inv p ` ipurge_ref ?I' ?D' (?D' y) zs R) \\<in> failures P\"\n     by (rule con_comp_secure_add_aux_1 [OF B E H I M])\n  next\n    have \"map (inv p) [x\\<leftarrow>xs @ y # ys. x \\<in> range p] \\<in> traces P \\<and>\n      map (inv q) [x\\<leftarrow>xs @ y # ys. x \\<in> range q] \\<in> traces Q\"\n     using D by (rule con_comp_failures_traces)\n    hence \"map (inv q) [x\\<leftarrow>(xs @ [y]) @ ys. x \\<in> range q] \\<in> traces Q\"\n     by simp\n    hence \"map (inv q) [x\\<leftarrow>xs @ [y]. x \\<in> range q] @\n      map (inv q) [x\\<leftarrow>ys. x \\<in> range q] \\<in> traces Q\"\n     by (subst (asm) filter_append, simp)\n    hence \"map (inv q) [x\\<leftarrow>xs @ [y]. x \\<in> range q] \\<in> traces Q\"\n     by (rule process_rule_2_traces)\n    thus \"(map (inv q) [x\\<leftarrow>xs @ y # ipurge_tr ?I' ?D' (?D' y) zs. x \\<in> range q],\n      inv q ` ipurge_ref ?I' ?D' (?D' y) zs S) \\<in> failures Q\"\n     by (rule con_comp_secure_add_aux_2 [OF A C E H J N])\n  qed\nqed\n\nlemma con_comp_secure_add_case_2:\n  assumes\n    A: \"consistent_maps D E p q\" and\n    B: \"secure P I D\" and\n    C: \"secure Q I E\" and\n    D: \"(xs @ y # ys, Y) \\<in> con_comp_failures P Q p q\" and\n    E: \"y \\<in> range p \\<or> y \\<in> range q\"\n  shows\n   \"\\<exists>xs'.\n      (\\<exists>ys'. xs @ zs = xs' @ ys') \\<and>\n      set xs' \\<subseteq> range p \\<union> range q \\<and>\n      map (inv p) [x\\<leftarrow>xs'. x \\<in> range p] \\<in> divergences P \\<and>\n      map (inv q) [x\\<leftarrow>xs'. x \\<in> range q] \\<in> divergences Q \\<Longrightarrow>\n    (\\<exists>R S T.\n      ipurge_ref (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) zs Z = R \\<union> S \\<union> T \\<and>\n      set xs \\<subseteq> range p \\<union> range q \\<and>\n      set (ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) zs) \\<subseteq> range p \\<union> range q \\<and>\n      R \\<subseteq> range p \\<and>\n      S \\<subseteq> range q \\<and>\n      T \\<subseteq> - range p \\<and>\n      T \\<subseteq> - range q \\<and>\n      (map (inv p) [x\\<leftarrow>xs @ y # ipurge_tr (con_comp_pol I)\n         (con_comp_map D E p q) (con_comp_map D E p q y) zs. x \\<in> range p],\n       inv p ` R) \\<in> failures P \\<and>\n      (map (inv q) [x\\<leftarrow>xs @ y # ipurge_tr (con_comp_pol I)\n         (con_comp_map D E p q) (con_comp_map D E p q y) zs. x \\<in> range q],\n       inv q ` S) \\<in> failures Q) \\<or>\n    (\\<exists>xs'.\n      (\\<exists>ys'. xs @ y # ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n        (con_comp_map D E p q y) zs = xs' @ ys') \\<and>\n      set xs' \\<subseteq> range p \\<union> range q \\<and>\n      map (inv p) [x\\<leftarrow>xs'. x \\<in> range p] \\<in> divergences P \\<and>\n      map (inv q) [x\\<leftarrow>xs'. x \\<in> range q] \\<in> divergences Q)\"\n  (is \"_ \\<Longrightarrow> (\\<exists>R S T. ?F R S T zs) \\<or> ?G\")\nproof (erule exE, (erule conjE)+, erule exE)\n  fix xs' ys'\n  assume\n    F: \"set xs' \\<subseteq> range p \\<union> range q\" and\n    G: \"map (inv p) [x\\<leftarrow>xs'. x \\<in> range p] \\<in> divergences P\" and\n    H: \"map (inv q) [x\\<leftarrow>xs'. x \\<in> range q] \\<in> divergences Q\" and\n    I: \"xs @ zs = xs' @ ys'\"\n  show ?thesis\n  proof (cases \"length xs < length xs'\", rule disjI1, rule_tac [2] disjI2)\n    case True\n    moreover have \"take (length xs') (xs @ zs) =\n      take (length xs') xs @ take (length xs' - length xs) zs\"\n     by simp\n    ultimately have \"take (length xs') (xs @ zs) =\n      xs @ take (length xs' - length xs) zs\"\n      (is \"_ = _ @ ?vs\")\n     by simp\n    moreover have \"take (length xs') (xs @ zs) =\n      take (length xs') (xs' @ ys')\"\n     using I by simp\n    ultimately have J: \"xs @ ?vs = xs'\"\n     by simp\n    moreover have \"set xs \\<subseteq> set (xs @ ?vs)\"\n     by simp\n    ultimately have \"set xs \\<subseteq> set xs'\"\n     by simp\n    hence K: \"set xs \\<subseteq> range p \\<union> range q\"\n     using F by simp\n    have \"\\<exists>R S T. ?F R S T [x\\<leftarrow>zs. x \\<in> range p \\<union> range q]\"\n      (is \"\\<exists>_ _ _. ipurge_ref ?I' ?D' _ _ _ = _ \\<and> _\")\n    proof (rule con_comp_secure_add_case_1 [OF A B C D E],\n     rule_tac x = \"range p \\<inter> Z\" in exI, rule_tac x = \"range q \\<inter> Z\" in exI,\n     rule_tac x = \"- range p \\<inter> - range q \\<inter> Z\" in exI,\n     (subst conj_assoc [symmetric])+, (rule conjI)+, simp_all del: filter_append)\n      show \"Z = range p \\<inter> Z \\<union> range q \\<inter> Z \\<union> - range p \\<inter> - range q \\<inter> Z\"\n       by blast\n    next\n      show \"set xs \\<subseteq> range p \\<union> range q\"\n       using K .\n    next\n      show \"{x \\<in> set zs. x \\<in> range p \\<or> x \\<in> range q} \\<subseteq> range p \\<union> range q\"\n       by blast\n    next\n      show \"- range p \\<inter> - range q \\<inter> Z \\<subseteq> - range p\"\n       by blast\n    next\n      show \"- range p \\<inter> - range q \\<inter> Z \\<subseteq> - range q\"\n       by blast\n    next\n      have \"map (inv p) [x\\<leftarrow>xs @ ?vs. x \\<in> range p] \\<in> divergences P\"\n       using G and J by simp\n      hence \"map (inv p) [x\\<leftarrow>xs @ ?vs. x \\<in> range p] @\n        map (inv p) [x\\<leftarrow>drop (length xs' - length xs) zs. x \\<in> range p]\n        \\<in> divergences P\"\n        (is \"_ @ map (inv p) [x\\<leftarrow>?ws. _] \\<in> _\")\n       by (rule process_rule_5_general)\n      hence \"map (inv p) [x\\<leftarrow>(xs @ ?vs) @ ?ws. x \\<in> range p] \\<in> divergences P\"\n       by (subst filter_append, simp)\n      hence \"map (inv p) [x\\<leftarrow>xs @ zs. x \\<in> range p] \\<in> divergences P\"\n       by simp\n      hence \"map (inv p) [x\\<leftarrow>xs @ [x\\<leftarrow>zs. x \\<in> range p \\<or> x \\<in> range q].\n        x \\<in> range p] \\<in> divergences P\"\n      proof (subst (asm) filter_append, subst filter_append, subst filter_filter)\n      qed (subgoal_tac \"(\\<lambda>x. (x \\<in> range p \\<or> x \\<in> range q) \\<and> x \\<in> range p) =\n       (\\<lambda>x. x \\<in> range p)\", simp, blast)\n      thus \"(map (inv p) [x\\<leftarrow>xs @ [x\\<leftarrow>zs. x \\<in> range p \\<or> x \\<in> range q].\n        x \\<in> range p], inv p ` (range p \\<inter> Z)) \\<in> failures P\"\n       by (rule process_rule_6)\n    next\n      have \"map (inv q) [x\\<leftarrow>xs @ ?vs. x \\<in> range q] \\<in> divergences Q\"\n       using H and J by simp\n      hence \"map (inv q) [x\\<leftarrow>xs @ ?vs. x \\<in> range q] @\n        map (inv q) [x\\<leftarrow>drop (length xs' - length xs) zs. x \\<in> range q]\n        \\<in> divergences Q\"\n        (is \"_ @ map (inv q) [x\\<leftarrow>?ws. _] \\<in> _\")\n       by (rule process_rule_5_general)\n      hence \"map (inv q) [x\\<leftarrow>(xs @ ?vs) @ ?ws. x \\<in> range q] \\<in> divergences Q\"\n       by (subst filter_append, simp)\n      hence \"map (inv q) [x\\<leftarrow>xs @ zs. x \\<in> range q] \\<in> divergences Q\"\n       by simp\n      hence \"map (inv q) [x\\<leftarrow>xs @ [x\\<leftarrow>zs. x \\<in> range p \\<or> x \\<in> range q].\n        x \\<in> range q] \\<in> divergences Q\"\n      proof (subst (asm) filter_append, subst filter_append, subst filter_filter)\n      qed (subgoal_tac \"(\\<lambda>x. (x \\<in> range p \\<or> x \\<in> range q) \\<and> x \\<in> range q) =\n       (\\<lambda>x. x \\<in> range q)\", simp, blast)\n      thus \"(map (inv q) [x\\<leftarrow>xs @ [x\\<leftarrow>zs. x \\<in> range p \\<or> x \\<in> range q].\n        x \\<in> range q], inv q ` (range q \\<inter> Z)) \\<in> failures Q\"\n       by (rule process_rule_6)\n    qed\n    then obtain R and S and T where\n     \"?F R S T [x\\<leftarrow>zs. x \\<in> range p \\<union> range q]\"\n     by blast\n    thus \"\\<exists>R S T. ?F R S T zs\"\n    proof (rule_tac x = R in exI, rule_tac x = S in exI, rule_tac x = T in exI)\n    qed (simp only: con_comp_ipurge_tr_filter con_comp_ipurge_ref_filter)\n  next\n    let\n      ?I' = \"con_comp_pol I\" and\n      ?D' = \"con_comp_map D E p q\"\n    case False\n    moreover have \"xs @ y # ipurge_tr ?I' ?D' (?D' y) zs =\n      take (length xs') (xs @ y # ipurge_tr ?I' ?D' (?D' y) zs) @\n      drop (length xs') (xs @ y # ipurge_tr ?I' ?D' (?D' y) zs)\"\n      (is \"_ = _ @ ?vs\")\n     by (simp only: append_take_drop_id)\n    ultimately have \"xs @ y # ipurge_tr ?I' ?D' (?D' y) zs =\n      take (length xs') (xs @ zs) @ ?vs\"\n     by simp\n    hence J: \"xs @ y # ipurge_tr ?I' ?D' (?D' y) zs = xs' @ ?vs\"\n     using I by simp\n    show ?G\n    proof (rule_tac x = xs' in exI, rule conjI, rule_tac x = ?vs in exI)\n    qed (subst J, simp_all add: F G H)\n  qed\nqed\n\ntheorem con_comp_secure:\n  assumes\n    A: \"consistent_maps D E p q\" and\n    B: \"secure P I D\" and\n    C: \"secure Q I E\"\n  shows \"secure (P \\<parallel> Q <p, q>) (con_comp_pol I) (con_comp_map D E p q)\"\nproof (simp add: secure_def con_comp_futures, (rule allI)+, rule impI,\n erule conjE, rule conjI, (erule rev_mp)+, rotate_tac [2], erule_tac [2] rev_mp)\n  fix xs y ys Y zs Z\n  show\n   \"(xs @ zs, Z) \\<in> con_comp_failures P Q p q \\<longrightarrow>\n    (xs @ y # ys, Y) \\<in> con_comp_failures P Q p q \\<longrightarrow>\n      (xs @ ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n         (con_comp_map D E p q y) ys,\n       ipurge_ref (con_comp_pol I) (con_comp_map D E p q)\n         (con_comp_map D E p q y) ys Y)\n      \\<in> con_comp_failures P Q p q\"\n    (is \"_ \\<longrightarrow> _ \\<longrightarrow> (_ @ ipurge_tr ?I' ?D' _ _, _) \\<in> _\")\n  proof ((rule impI)+, thin_tac \"(xs @ zs, Z) \\<in> con_comp_failures P Q p q\",\n   simp_all add: con_comp_failures_def con_comp_divergences_def\n   del: filter_append, erule disjE, rule disjI1)\n  qed (erule con_comp_secure_del_case_1 [OF A B C],\n   rule con_comp_secure_del_case_2 [OF A B C])\nnext\n  fix xs y ys Y zs Z\n  assume D: \"(xs @ y # ys, Y) \\<in> con_comp_failures P Q p q\"\n  show\n   \"(xs @ zs, Z) \\<in> con_comp_failures P Q p q \\<longrightarrow>\n      (xs @ y # ipurge_tr (con_comp_pol I) (con_comp_map D E p q)\n         (con_comp_map D E p q y) zs,\n       ipurge_ref (con_comp_pol I) (con_comp_map D E p q)\n         (con_comp_map D E p q y) zs Z)\n      \\<in> con_comp_failures P Q p q\"\n    (is \"_ \\<longrightarrow> (_ @ _ # ipurge_tr ?I' ?D' _ _, _) \\<in> _\")\n  proof (rule impI, simp_all add: con_comp_failures_def con_comp_divergences_def\n   del: filter_append, cases \"y \\<in> range p \\<or> y \\<in> range q\", simp del: filter_append,\n   erule disjE, rule disjI1, rule_tac [3] disjI2)\n  qed (erule con_comp_secure_add_case_1 [OF A B C D], assumption,\n   erule con_comp_secure_add_case_2 [OF A B C D], assumption,\n   rule con_comp_failures_divergences [OF D], simp_all)\nqed\n\n\nsubsection \"Conservation of noninterference security in the absence of fake events\"\n\ntext \\<open>\nIn what follows, it is proven that in the absence of fake events, namely if\n@{term \"range p \\<union> range q = UNIV\"}, the output of the concurrent composition of two secure processes\nis secure with respect to the same noninterference policy enforced by the input processes, and to\nthe event-domain map that simply associates each event to the same security domain as the\ncorresponding events of the input processes.\n\nMore formally, for any two processes @{term P}, @{term Q} being secure with respect to the\nnoninterference policy @{term I} and the event-domain maps @{term D}, @{term E}, their concurrent\ncomposition @{term \"P \\<parallel> Q <p, q>\"} is secure with respect to the same noninterference policy\n@{term I} and the event-domain map @{term \"the \\<circ> con_comp_map D E p q\"}, provided that conditions\n@{term \"range p \\<union> range q = UNIV\"} and @{term \"consistent_maps D E p q\"} are satisfied.\n\n\\null\n\\<close>\n\nlemma con_comp_sinks_range:\n \"u \\<in> range Some \\<Longrightarrow>\n  set xs \\<subseteq> range p \\<union> range q \\<Longrightarrow>\n    sinks (con_comp_pol I) (con_comp_map D E p q) u xs \\<subseteq> range Some\"\nby (insert con_comp_sinks_aux_range [of \"{u}\" xs p q I D E],\n simp add: sinks_aux_single_dom)\n\nlemma con_comp_sinks_no_fake:\n  assumes\n    A: \"range p \\<union> range q = UNIV\" and\n    B: \"u \\<in> range Some\"\n  shows \"sinks I (the \\<circ> con_comp_map D E p q) (the u) xs =\n    the ` sinks (con_comp_pol I) (con_comp_map D E p q) u xs\"\n    (is \"_ = the ` sinks ?I' ?D' _ _\")\nproof (induction xs rule: rev_induct, simp)\n  fix x xs\n  assume C: \"sinks I (the \\<circ> ?D') (the u) xs = the ` sinks ?I' ?D' u xs\"\n  have \"x \\<in> range p \\<union> range q\"\n   using A by simp\n  hence D: \"?D' x = Some (the (?D' x))\"\n   by (cases \"x \\<in> range p\", simp_all)\n  have E: \"u = Some (the u)\"\n   using B by (simp add: image_iff)\n  show \"sinks I (the \\<circ> ?D') (the u) (xs @ [x]) = the ` sinks ?I' ?D' u (xs @ [x])\"\n  proof (cases \"(u, ?D' x) \\<in> ?I' \\<or> (\\<exists>v \\<in> sinks ?I' ?D' u xs. (v, ?D' x) \\<in> ?I')\")\n    case True\n    hence \"sinks ?I' ?D' u (xs @ [x]) = insert (?D' x) (sinks ?I' ?D' u xs)\"\n     by simp\n    moreover have \"(the u, the (?D' x)) \\<in> I \\<or>\n      (\\<exists>d \\<in> sinks I (the \\<circ> ?D') (the u) xs. (d, the (?D' x)) \\<in> I)\"\n    proof (rule disjE [OF True], rule disjI1, rule_tac [2] disjI2)\n      assume \"(u, ?D' x) \\<in> ?I'\"\n      hence \"(Some (the u), Some (the (?D' x))) \\<in> ?I'\"\n       using D and E by simp\n      thus \"(the u, the (?D' x)) \\<in> I\"\n       by (simp add: con_comp_pol_def)\n    next\n      assume \"\\<exists>v \\<in> sinks ?I' ?D' u xs. (v, ?D' x) \\<in> ?I'\"\n      then obtain v where F: \"v \\<in> sinks ?I' ?D' u xs\" and G: \"(v, ?D' x) \\<in> ?I'\" ..\n      have \"sinks ?I' ?D' u xs \\<subseteq> range Some\"\n       by (rule con_comp_sinks_range, simp_all add: A B)\n      hence \"v \\<in> range Some\"\n       using F ..\n      hence \"v = Some (the v)\"\n       by (simp add: image_iff)\n      hence \"(Some (the v), Some (the (?D' x))) \\<in> ?I'\"\n       using D and G by simp\n      hence \"(the v, the (?D' x)) \\<in> I\"\n       by (simp add: con_comp_pol_def)\n      moreover have \"the v \\<in> sinks I (the \\<circ> ?D') (the u) xs\"\n       using C and F by simp\n      ultimately show \"\\<exists>d \\<in> sinks I (the \\<circ> ?D') (the u) xs.\n        (d, the (?D' x)) \\<in> I\" ..\n    qed\n    hence \"sinks I (the \\<circ> ?D') (the u) (xs @ [x]) =\n      insert (the (?D' x)) (sinks I (the \\<circ> ?D') (the u) xs)\"\n     by simp\n    ultimately show ?thesis\n     using C by simp\n  next\n    case False\n    hence \"sinks ?I' ?D' u (xs @ [x]) = sinks ?I' ?D' u xs\"\n     by simp\n    moreover have \"\\<not> ((the u, the (?D' x)) \\<in> I \\<or>\n      (\\<exists>v \\<in> sinks I (the \\<circ> ?D') (the u) xs. (v, the (?D' x)) \\<in> I))\"\n    proof (insert False, simp, erule conjE, rule conjI, rule_tac [2] ballI)\n      assume \"(u, ?D' x) \\<notin> ?I'\"\n      hence \"(Some (the u), Some (the (?D' x))) \\<notin> ?I'\"\n       using D and E by simp\n      thus \"(the u, the (?D' x)) \\<notin> I\"\n       by (simp add: con_comp_pol_def)\n    next\n      fix d\n      assume \"d \\<in> sinks I (the \\<circ> ?D') (the u) xs\"\n      hence \"d \\<in> the ` sinks ?I' ?D' u xs\"\n       using C by simp\n      hence \"\\<exists>v \\<in> sinks ?I' ?D' u xs. d = the v\"\n       by (simp add: image_iff)\n      then obtain v where F: \"v \\<in> sinks ?I' ?D' u xs\" and G: \"d = the v\" ..\n      have \"sinks ?I' ?D' u xs \\<subseteq> range Some\"\n       by (rule con_comp_sinks_range, simp_all add: A B)\n      hence \"v \\<in> range Some\"\n       using F ..\n      hence H: \"v = Some d\"\n       using G by (simp add: image_iff)\n      assume \"\\<forall>v \\<in> sinks ?I' ?D' u xs. (v, ?D' x) \\<notin> ?I'\"\n      hence \"(v, ?D' x) \\<notin> ?I'\"\n       using F ..\n      hence \"(Some d, Some (the (?D' x))) \\<notin> ?I'\"\n       using D and H by simp\n      thus \"(d, the (?D' x)) \\<notin> I\"\n       by (simp add: con_comp_pol_def)\n    qed\n    hence \"sinks I (the \\<circ> ?D') (the u) (xs @ [x]) = sinks I (the \\<circ> ?D') (the u) xs\"\n     by simp\n    ultimately show ?thesis\n     using C by simp\n  qed\nqed\n\n\n\nlemma con_comp_ipurge_ref_no_fake:\n  assumes\n    A: \"range p \\<union> range q = UNIV\" and\n    B: \"u \\<in> range Some\"\n  shows \"ipurge_ref (con_comp_pol I) (con_comp_map D E p q) u xs X =\n    ipurge_ref I (the \\<circ> con_comp_map D E p q) (the u) xs X\"\n    (is \"ipurge_ref ?I' ?D' _ _ _ = _\")\nproof (simp add: ipurge_ref_def set_eq_iff, rule allI,\n simp_all add: con_comp_sinks_no_fake [OF A B])\n  fix x\n  have \"x \\<in> range p \\<union> range q\"\n   using A by simp\n  hence C: \"?D' x = Some (the (?D' x))\"\n   by (cases \"x \\<in> range p\", simp_all)\n  have D: \"u = Some (the u)\"\n   using B by (simp add: image_iff)\n  show\n   \"(x \\<in> X \\<and> (u, ?D' x) \\<notin> con_comp_pol I \\<and>\n      (\\<forall>v \\<in> sinks ?I' ?D' u xs. (v, ?D' x) \\<notin> con_comp_pol I)) =\n    (x \\<in> X \\<and> (the u, the (?D' x)) \\<notin> I \\<and>\n      (\\<forall>v \\<in> sinks ?I' ?D' u xs. (the v, the (?D' x)) \\<notin> I))\"\n  proof (rule iffI, (erule_tac [!] conjE)+, simp_all, rule_tac [!] conjI,\n   rule_tac [2] ballI, rule_tac [4] ballI)\n    assume \"(u, ?D' x) \\<notin> ?I'\"\n    hence \"(Some (the u), Some (the (?D' x))) \\<notin> ?I'\"\n     using C and D by simp\n    thus \"(the u, the (?D' x)) \\<notin> I\"\n     by (simp add: con_comp_pol_def)\n  next\n    fix v\n    assume \"\\<forall>v \\<in> sinks ?I' ?D' u xs. (v, ?D' x) \\<notin> ?I'\" and\n      E: \"v \\<in> sinks ?I' ?D' u xs\"\n    hence \"(v, ?D' x) \\<notin> ?I'\" ..\n    moreover have \"sinks ?I' ?D' u xs \\<subseteq> range Some\"\n     by (rule con_comp_sinks_range, simp_all add: A B)\n    hence \"v \\<in> range Some\"\n     using E ..\n    hence \"v = Some (the v)\"\n     by (simp add: image_iff)\n    ultimately have \"(Some (the v), Some (the (?D' x))) \\<notin> ?I'\"\n     using C by simp\n    thus \"(the v, the (?D' x)) \\<notin> I\"\n     by (simp add: con_comp_pol_def)\n  next\n    assume \"(the u, the (?D' x)) \\<notin> I\"\n    hence \"(Some (the u), Some (the (?D' x))) \\<notin> ?I'\"\n     by (simp add: con_comp_pol_def)\n    thus \"(u, ?D' x) \\<notin> ?I'\"\n     using C and D by simp\n  next\n    fix v\n    assume \"\\<forall>v \\<in> sinks ?I' ?D' u xs. (the v, the (?D' x)) \\<notin> I\" and\n      E: \"v \\<in> sinks ?I' ?D' u xs\"\n    hence \"(the v, the (?D' x)) \\<notin> I\" ..\n    hence \"(Some (the v), Some (the (?D' x))) \\<notin> ?I'\"\n     by (simp add: con_comp_pol_def)\n    moreover have \"sinks ?I' ?D' u xs \\<subseteq> range Some\"\n     by (rule con_comp_sinks_range, simp_all add: A B)\n    hence \"v \\<in> range Some\"\n     using E ..\n    hence \"v = Some (the v)\"\n     by (simp add: image_iff)\n    ultimately show \"(v, ?D' x) \\<notin> ?I'\"\n     using C by simp\n  qed\nqed\n\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Noninterference_Concurrent_Composition/ConcurrentComposition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.31943735283726377}}
{"text": "(*  Title:       CoreC++\n    Author:      Daniel Wasserrab\n    Maintainer:  Daniel Wasserrab <wasserra at fmi.uni-passau.de>\n*)\n\nsection \\<open>Definition of Subobjects\\<close>\n\ntheory SubObj\nimports ClassRel\nbegin\n\n\nsubsection \\<open>General definitions\\<close>\n\ntype_synonym\n  subobj = \"cname  \\<times> path\"\n\ndefinition mdc :: \"subobj \\<Rightarrow> cname\" where\n  \"mdc S = fst S\"\n\ndefinition ldc :: \"subobj \\<Rightarrow> cname\" where\n  \"ldc S = last (snd S)\"\n\n\nlemma mdc_tuple [simp]: \"mdc (C,Cs) = C\"\nby(simp add:mdc_def)\n\nlemma ldc_tuple [simp]: \"ldc (C,Cs) = last Cs\"\nby(simp add:ldc_def)\n\n\nsubsection \\<open>Subobjects according to Rossie-Friedman\\<close>\n\nfun is_subobj :: \"prog \\<Rightarrow> subobj \\<Rightarrow> bool\" \\<comment> \\<open>legal subobject to class hierarchie\\<close> where\n  \"is_subobj P (C, []) \\<longleftrightarrow> False\"\n| \"is_subobj P (C, [D]) \\<longleftrightarrow> (is_class P C \\<and> C = D) \n                                \\<or> (\\<exists> X. P \\<turnstile> C \\<preceq>\\<^sup>* X \\<and> P \\<turnstile> X \\<prec>\\<^sub>S D)\"\n| \"is_subobj P (C, D # E # Xs) = (let Ys=butlast (D # E # Xs); \n                                      Y=last (D # E # Xs); \n                                      X=last Ys \n                                in is_subobj P (C, Ys) \\<and> P \\<turnstile> X \\<prec>\\<^sub>R Y)\"\n\nlemma subobj_aux_rev:\nassumes 1:\"is_subobj P ((C,C'#rev Cs@[C'']))\"\nshows \"is_subobj P ((C,C'#rev Cs))\"\nproof -\n  obtain Cs' where Cs':\"Cs' = rev Cs\" by simp\n  hence rev:\"Cs'@[C''] = rev Cs@[C'']\" by simp\n  from this obtain D Ds where DDs:\"Cs'@[C''] = D#Ds\" by (cases Cs') auto\n  with 1 rev have subo:\"is_subobj P ((C,C'#D#Ds))\" by simp\n  from DDs have \"butlast (C'#D#Ds) = C'#Cs'\" by (cases Cs') auto\n  with subo have \"is_subobj P ((C,C'#Cs'))\" by simp\n  with Cs' show ?thesis by simp\nqed\n\n\n\nlemma subobj_aux:\nassumes 1:\"is_subobj P ((C,C'#Cs@[C'']))\"\nshows \"is_subobj P ((C,C'#Cs))\"\nproof -\n  from 1 obtain Cs' where Cs':\"Cs' = rev Cs\" by simp\n  with 1 have \"is_subobj P ((C,C'#rev Cs'@[C'']))\" by simp\n  hence \"is_subobj P ((C,C'#rev Cs'))\" by (rule subobj_aux_rev)\n  with Cs' show ?thesis by simp\nqed\n\n\n\nlemma isSubobj_isClass:\nassumes 1:\"is_subobj P (R)\"\nshows \"is_class P (mdc R)\"\n\nproof -\n  obtain C' Cs' where R:\"R = (C',Cs')\" by(cases R) auto\n  with 1 have ne:\"Cs' \\<noteq> []\" by (cases Cs') auto\n  from this obtain C'' Cs'' where C''Cs'':\"Cs' = C''#Cs''\" by (cases Cs') auto\n  from this obtain Ds where \"Ds = rev Cs''\" by simp\n  with 1 R C''Cs'' have subo1:\"is_subobj P ((C',C''#rev Ds))\" by simp\n  with R show ?thesis\n    by (induct Ds,auto simp:mdc_def split:if_split_asm dest:subobj_aux,\n      auto elim:converse_rtranclE dest!:subclsS_subcls1 elim:subcls1_class)\nqed\n\n\n\n\nlemma isSubobjs_subclsR_rev:\nassumes 1:\"is_subobj P ((C,Cs@[D,D']@(rev Cs')))\"\nshows \"P \\<turnstile> D \\<prec>\\<^sub>R D'\"\nusing 1\nproof (induct Cs')\n  case Nil\n  from this obtain Cs' X Y Xs where Cs'1:\"Cs' = Cs@[D,D']\" \n    and \"X = hd(Cs@[D,D'])\" and \"Y = hd(tl(Cs@[D,D']))\"\n    and \"Xs =  tl(tl(Cs@[D,D']))\" by simp\n  hence Cs'2:\"Cs' = X#Y#Xs\" by (cases Cs) auto\n  from Cs'1 have last:\"last Cs' = D'\" by simp\n  from Cs'1 have butlast:\"last(butlast Cs') = D\" by (simp add:butlast_tail)\n  from Nil Cs'1 Cs'2 have \"is_subobj P ((C,X#Y#Xs))\" by simp\n  with last butlast Cs'2 show ?case by simp\nnext\n  case (Cons C'' Cs'')\n  have IH:\"is_subobj P ( (C, Cs @ [D, D'] @ rev Cs'')) \\<Longrightarrow> P \\<turnstile> D \\<prec>\\<^sub>R D'\" by fact\n  from Cons obtain Cs' X Y Xs where Cs'1:\"Cs' = Cs@[D,D']@(rev (C''#Cs''))\" \n    and \"X = hd(Cs@[D,D']@(rev (C''#Cs'')))\" \n    and \"Y = hd(tl(Cs@[D,D']@(rev (C''#Cs''))))\"\n    and \"Xs =  tl(tl(Cs@[D,D']@(rev (C''#Cs''))))\" by simp\n  hence Cs'2:\"Cs' = X#Y#Xs\" by (cases Cs) auto\n  from Cons Cs'1 Cs'2 have \"is_subobj P ((C,X#Y#Xs))\" by simp\n  hence sub:\"is_subobj P ((C,butlast (X#Y#Xs)))\" by simp\n  from Cs'1 obtain E Es where Cs'3:\"Cs' = Es@[E]\" by (cases Cs') auto\n  with Cs'1 have butlast:\"Es = Cs@[D,D']@(rev Cs'')\" by simp\n  from Cs'3 have \"butlast Cs' = Es\" by simp\n  with butlast have \"butlast Cs' = Cs@[D,D']@(rev Cs'')\" by simp\n  with Cs'2 sub have \"is_subobj P ((C,Cs@[D,D']@(rev Cs'')))\"\n    by simp\n  with IH show ?case by simp\nqed\n\n\n\nlemma isSubobjs_subclsR:\nassumes 1:\"is_subobj P ((C,Cs@[D,D']@Cs'))\"\nshows \"P \\<turnstile> D \\<prec>\\<^sub>R D'\"\n\nproof -\n  from 1 obtain Cs'' where \"Cs'' = rev Cs'\" by simp\n  with 1 have \"is_subobj P ((C,Cs@[D,D']@(rev Cs'')))\" by simp\n  thus ?thesis by (rule isSubobjs_subclsR_rev)\nqed\n\n\n\n\nlemma mdc_leq_ldc_aux:\nassumes 1:\"is_subobj P ((C,C'#rev Cs'))\"\nshows \"P \\<turnstile> C \\<preceq>\\<^sup>* last (C'#rev Cs')\"\nusing 1\nproof (induct Cs')\n  case Nil\n  from 1 have \"is_class P C\"\n    by (drule_tac R=\"(C,C'#rev Cs')\" in isSubobj_isClass, simp add:mdc_def)\n  with Nil show ?case\n    proof (cases \"C=C'\")\n      case True\n      thus ?thesis by simp\n    next\n      case False\n      with Nil show ?thesis \n        by (auto dest!:subclsS_subcls1)\n    qed\n  next\n    case (Cons C'' Cs'')\n    have IH:\"is_subobj P ( (C, C' # rev Cs'')) \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* last (C' # rev Cs'')\"\n      and subo:\"is_subobj P ( (C, C' # rev (C'' # Cs'')))\" by fact+\n    hence \"is_subobj P ( (C, C' # rev Cs''))\" by (simp add:subobj_aux_rev)\n    with IH have rel:\"P \\<turnstile> C \\<preceq>\\<^sup>* last (C' # rev Cs'')\" by simp\n    from subo obtain D Ds where DDs:\"C' # rev Cs'' = Ds@[D]\"\n      by (cases Cs'') auto\n    hence \" C' # rev (C'' # Cs'') = Ds@[D,C'']\" by simp\n    with subo have \"is_subobj P ((C,Ds@[D,C'']))\" by (cases Ds) auto\n    hence \"P \\<turnstile> D \\<prec>\\<^sub>R C''\" by (rule_tac Cs'=\"[]\" in isSubobjs_subclsR) simp\n    hence rel1:\"P \\<turnstile> D \\<prec>\\<^sup>1 C''\" by (rule subclsR_subcls1)\n    from DDs have \"D = last (C' # rev Cs'')\" by simp\n    with rel1 have lastrel1:\"P \\<turnstile> last (C' # rev Cs'') \\<prec>\\<^sup>1 C''\" by simp\n    with rel have \"P \\<turnstile> C \\<preceq>\\<^sup>* C''\"\n      by(rule_tac b=\"last (C' # rev Cs'')\" in rtrancl_into_rtrancl) simp\n    thus ?case by simp\nqed\n\n\n\nlemma mdc_leq_ldc:\nassumes 1:\"is_subobj P (R)\"\nshows \"P \\<turnstile> mdc R \\<preceq>\\<^sup>* ldc R\"\n\nproof -\n  from 1 obtain C Cs where R:\"R = (C,Cs)\" by (cases R) auto\n  with 1 have ne:\"Cs \\<noteq> []\" by (cases Cs) auto\n  from this obtain C' Cs' where Cs:\"Cs = C'#Cs'\" by (cases Cs) auto\n  from this obtain Cs'' where Cs':\"Cs'' = rev Cs'\" by simp\n  with R Cs 1 have \"is_subobj P ((C,C'#rev Cs''))\" by simp\n  hence rel:\"P \\<turnstile> C \\<preceq>\\<^sup>* last (C'#rev Cs'')\" by (rule mdc_leq_ldc_aux)\n  from R Cs Cs' have ldc:\"last (C'#rev Cs'') = ldc R\" by(simp add:ldc_def)\n  from R have \"mdc R = C\" by(simp add:mdc_def)\n  with ldc rel show ?thesis by simp\nqed\n\n\n\ntext\\<open>Next three lemmas show subobject property as presented in literature\\<close>\n\nlemma class_isSubobj:\n  \"is_class P C \\<Longrightarrow> is_subobj P ((C,[C]))\"\nby simp\n\n\nlemma repSubobj_isSubobj:\nassumes 1:\"is_subobj P ((C,Xs@[X]))\" and 2:\"P \\<turnstile> X \\<prec>\\<^sub>R Y\"\nshows \"is_subobj P ((C,Xs@[X,Y]))\"\n\nusing 1\nproof -\n  obtain Cs D E Cs' where Cs1:\"Cs = Xs@[X,Y]\" and  \"D = hd(Xs@[X,Y])\"\n    and \"E = hd(tl(Xs@[X,Y]))\" and \"Cs' = tl(tl(Xs@[X,Y]))\"by simp\n  hence Cs2:\"Cs = D#E#Cs'\" by (cases Xs) auto\n  with 1 Cs1 have subobj_butlast:\"is_subobj P ((C,butlast(D#E#Cs')))\" \n    by (simp add:butlast_tail)\n  with 2 Cs1 Cs2 have \"P \\<turnstile> (last(butlast(D#E#Cs'))) \\<prec>\\<^sub>R last(D#E#Cs')\"\n    by (simp add:butlast_tail)\n  with subobj_butlast have \"is_subobj P ((C,(D#E#Cs')))\" by simp\n  with Cs1 Cs2 show ?thesis by simp\nqed\n\n\n\nlemma shSubobj_isSubobj:\nassumes 1:  \"is_subobj P ((C,Xs@[X]))\" and 2:\"P \\<turnstile> X \\<prec>\\<^sub>S Y\"\nshows \"is_subobj P ((C,[Y]))\"\n\nusing 1\nproof -\n  from 1 have classC:\"is_class P C\" \n    by (drule_tac R=\"(C,Xs@[X])\" in isSubobj_isClass, simp add:mdc_def)\n  from 1 have \"P \\<turnstile> C \\<preceq>\\<^sup>* X\" \n    by (drule_tac R=\"(C,Xs@[X])\" in mdc_leq_ldc, simp add:mdc_def ldc_def)\n  with classC 2 show ?thesis by fastforce\nqed\n\n\n\ntext\\<open>Auxiliary lemmas\\<close>\n\n\nlemma build_rec_isSubobj_rev:\nassumes 1:\"is_subobj P ((D,D#rev Cs))\" and 2:\" P \\<turnstile> C \\<prec>\\<^sub>R D\"\nshows \"is_subobj P ((C,C#D#rev Cs))\"\nusing 1\nproof (induct Cs)\n  case Nil\n  from 2 have \"is_class P C\" by (auto dest:subclsRD simp add:is_class_def)\n  with 1 2 show ?case by simp\nnext\n  case (Cons C' Cs')\n  have suboD:\"is_subobj P ((D,D#rev (C'#Cs')))\" \n    and IH:\"is_subobj P ((D,D#rev Cs')) \\<Longrightarrow> is_subobj P ((C,C#D#rev Cs'))\" by fact+\n  obtain E Es where E:\"E = hd (rev (C'#Cs'))\" and Es:\"Es = tl (rev (C'#Cs'))\"\n    by simp\n  with E have E_Es:\"rev (C'#Cs') = E#Es\" by simp\n  with E Es have butlast:\"butlast (D#E#Es) = D#rev Cs'\" by simp\n  from E_Es suboD have suboDE:\"is_subobj P ((D,D#E#Es))\" by simp\n  hence \"is_subobj P ((D,butlast (D#E#Es)))\" by simp\n  with butlast have \"is_subobj P ((D,D#rev Cs'))\" by simp\n  with IH have suboCD:\"is_subobj P ( (C, C#D#rev Cs'))\" by simp\n  from suboDE obtain Xs X Y Xs' where Xs':\"Xs' = D#E#Es\"\n    and bb:\"Xs = butlast (butlast (D#E#Es))\" \n    and lb:\"X = last(butlast (D#E#Es))\" and l:\"Y = last (D#E#Es)\" by simp\n  from this obtain Xs'' where Xs'':\"Xs'' = Xs@[X]\" by simp\n  with bb lb have \"Xs'' = butlast (D#E#Es)\" by simp\n  with l have \"D#E#Es = Xs''@[Y]\" by simp\n  with Xs'' have \"D#E#Es = Xs@[X]@[Y]\" by simp\n  with suboDE have \"is_subobj P ((D,Xs@[X,Y]))\" by simp\n  hence subR:\"P \\<turnstile> X \\<prec>\\<^sub>R Y\"  by(rule_tac Cs=\"Xs\" and Cs'=\"[]\" in isSubobjs_subclsR) simp\n  from E_Es Es have \"last (D#E#Es) = C'\" by simp\n  with subR lb l butlast have \"P \\<turnstile> last(D#rev Cs') \\<prec>\\<^sub>R C'\"\n    by (auto split:if_split_asm)\n  with suboCD show ?case by simp\nqed\n\n\n\nlemma build_rec_isSubobj:\nassumes 1:\"is_subobj P ((D,D#Cs))\" and 2:\" P \\<turnstile> C \\<prec>\\<^sub>R D\" \nshows \"is_subobj P ((C,C#D#Cs))\"\n\nproof -\n  obtain Cs' where Cs':\"Cs' = rev Cs\" by simp\n  with 1 have \"is_subobj P ((D,D#rev Cs'))\" by simp\n  with 2 have \"is_subobj P ((C,C#D#rev Cs'))\" \n    by - (rule build_rec_isSubobj_rev) \n  with Cs' show ?thesis by simp\nqed\n\n\n\n\n\nlemma isSubobj_isSubobj_isSubobj_rev:\nassumes 1:\"is_subobj P ((C,[D]))\" and 2:\"is_subobj P ((D,D#(rev Cs)))\" \nshows \"is_subobj P ((C,D#(rev Cs)))\"\nusing 2\nproof (induct Cs)\n case Nil\n with 1 show ?case by simp\nnext\n  case (Cons C' Cs')\n  have IH:\"is_subobj P ((D,D#rev Cs')) \\<Longrightarrow> is_subobj P ((C,D#rev Cs'))\"\n    and \"is_subobj P ((D,D#rev (C'#Cs')))\" by fact+\n  hence suboD:\"is_subobj P ((D,D#rev Cs'@[C']))\" by simp\n  hence \"is_subobj P ((D,D#rev Cs'))\" by (rule subobj_aux_rev)\n  with IH have suboC:\"is_subobj P ((C,D#rev Cs'))\" by simp\n  obtain C'' where C'': \"C'' = last (D # rev Cs')\" by simp\n  moreover have \"D # rev Cs' = butlast (D # rev Cs') @ [last (D # rev Cs')]\"\n    by (rule append_butlast_last_id [symmetric]) simp\n  ultimately have butlast: \"D # rev Cs' = butlast (D  #rev Cs') @ [C'']\"\n    by simp\n  hence butlast2:\"D#rev Cs'@[C'] = butlast(D#rev Cs')@[C'']@[C']\" by simp\n  with suboD have \"is_subobj P ((D,butlast(D#rev Cs')@[C'']@[C']))\"\n    by simp\n  with C'' have subR:\"P \\<turnstile> C'' \\<prec>\\<^sub>R C'\"\n    by (rule_tac Cs=\"butlast(D#rev Cs')\" and Cs'=\"[]\" in isSubobjs_subclsR)simp\n  with C'' suboC butlast have \"is_subobj P ((C,butlast(D#rev Cs')@[C'']@[C']))\"\n    by (auto intro:repSubobj_isSubobj simp del:butlast.simps)\n  with butlast2 have \"is_subobj P ((C,D#rev Cs'@[C']))\"\n    by (cases Cs')auto\n  thus ?case by simp\nqed\n\n\nlemma isSubobj_isSubobj_isSubobj:\nassumes 1:\"is_subobj P ((C,[D]))\" and 2:\"is_subobj P ((D,D#Cs))\" \nshows \"is_subobj P ((C,D#Cs))\"\n\nproof -\n  obtain Cs' where Cs':\"Cs' = rev Cs\" by simp\n  with 2 have \"is_subobj P ((D,D#rev Cs'))\" by simp\n  with 1 have \"is_subobj P ((C,D#rev Cs'))\"\n  by - (rule isSubobj_isSubobj_isSubobj_rev)\nwith Cs' show ?thesis by simp\nqed\n\n\n\nsubsection \\<open>Subobject handling and lemmas\\<close>\n\ntext\\<open>Subobjects consisting of repeated inheritance relations only:\\<close>\n\ninductive Subobjs\\<^sub>R :: \"prog \\<Rightarrow> cname \\<Rightarrow> path \\<Rightarrow> bool\" for P :: prog\nwhere\n  SubobjsR_Base: \"is_class P C \\<Longrightarrow> Subobjs\\<^sub>R P C [C]\"\n| SubobjsR_Rep: \"\\<lbrakk>P \\<turnstile> C \\<prec>\\<^sub>R D; Subobjs\\<^sub>R P D Cs\\<rbrakk> \\<Longrightarrow> Subobjs\\<^sub>R P C (C # Cs)\"\n\ntext\\<open>All subobjects:\\<close>\n\ninductive Subobjs :: \"prog \\<Rightarrow> cname \\<Rightarrow> path \\<Rightarrow> bool\" for P :: prog\nwhere\n  Subobjs_Rep: \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> Subobjs P C Cs\"\n| Subobjs_Sh: \"\\<lbrakk>P \\<turnstile> C \\<preceq>\\<^sup>* C'; P \\<turnstile> C' \\<prec>\\<^sub>S D; Subobjs\\<^sub>R P D Cs\\<rbrakk>\n             \\<Longrightarrow> Subobjs P C Cs\"\n\n\nlemma Subobjs_Base:\"is_class P C \\<Longrightarrow> Subobjs P C [C]\"\nby (fastforce intro:Subobjs_Rep SubobjsR_Base)\n\nlemma SubobjsR_nonempty: \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> Cs \\<noteq> []\"\nby (induct rule: Subobjs\\<^sub>R.induct, simp_all)\n\nlemma Subobjs_nonempty: \"Subobjs P C Cs \\<Longrightarrow> Cs \\<noteq> []\"\nby (erule Subobjs.induct)(erule SubobjsR_nonempty)+\n\n\nlemma hd_SubobjsR:\n  \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> \\<exists>Cs'. Cs = C#Cs'\"\nby(erule Subobjs\\<^sub>R.induct,simp+)\n\n\nlemma SubobjsR_subclassRep: \n  \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> (C,last Cs) \\<in> (subclsR P)\\<^sup>*\"\n\napply(erule Subobjs\\<^sub>R.induct)\n apply simp\napply(simp add: SubobjsR_nonempty)\ndone\n\n\nlemma SubobjsR_subclass: \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* last Cs\"\n\napply(erule Subobjs\\<^sub>R.induct)\n apply simp\napply(simp add: SubobjsR_nonempty)\napply(blast intro:subclsR_subcls1 rtrancl_trans)\ndone\n\n\nlemma Subobjs_subclass: \"Subobjs P C Cs \\<Longrightarrow> P \\<turnstile> C \\<preceq>\\<^sup>* last Cs\"\n\napply(erule Subobjs.induct)\n apply(erule SubobjsR_subclass)\napply(erule rtrancl_trans)\napply(blast intro:subclsS_subcls1 SubobjsR_subclass rtrancl_trans)\ndone\n\n\n\n\nlemma Subobjs_notSubobjsR:\n  \"\\<lbrakk>Subobjs P C Cs; \\<not> Subobjs\\<^sub>R P C Cs\\<rbrakk>\n\\<Longrightarrow> \\<exists>C' D. P \\<turnstile> C \\<preceq>\\<^sup>* C' \\<and> P \\<turnstile> C' \\<prec>\\<^sub>S D \\<and> Subobjs\\<^sub>R P D Cs\"\napply (induct rule: Subobjs.induct)\n apply clarsimp\napply fastforce\ndone\n\n\n\n\n\nlemma Subobjs_Subobjs:\"Subobjs P C (Cs@ C'#Cs') \\<Longrightarrow> Subobjs P C' (C'#Cs')\"\n  \n  apply -\n  apply (drule Subobjs.cases)\n  apply auto\n   apply (subgoal_tac \"C = hd(Cs @ C' # Cs')\")\n    apply (fastforce intro:SubobjsR_Subobjs)\n   apply (fastforce dest:hd_SubobjsR)\n  apply (subgoal_tac \"D = hd(Cs @ C' # Cs')\")\n   apply (fastforce intro:SubobjsR_Subobjs)\n  apply (fastforce dest:hd_SubobjsR)\n  done\n  \n\n\nlemma SubobjsR_isClass:\nassumes subo:\"Subobjs\\<^sub>R P C Cs\"\nshows \"is_class P C\"\n\nusing subo\nproof (induct rule:Subobjs\\<^sub>R.induct)\n  case SubobjsR_Base thus ?case by assumption\nnext\n  case SubobjsR_Rep thus ?case by (fastforce intro:subclsR_subcls1 subcls1_class)\nqed\n\n\nlemma Subobjs_isClass:\nassumes subo:\"Subobjs P C Cs\"\nshows \"is_class P C\"\n\nusing subo\nproof (induct rule:Subobjs.induct)\n  case Subobjs_Rep thus ?case by (rule SubobjsR_isClass)\nnext\n  case (Subobjs_Sh C C' D Cs)\n  have leq:\"P \\<turnstile> C \\<preceq>\\<^sup>* C'\" and leqS:\"P \\<turnstile> C' \\<prec>\\<^sub>S D\" by fact+\n  hence \"(C,D) \\<in> (subcls1 P)\\<^sup>+\" by (fastforce intro:rtrancl_into_trancl1 subclsS_subcls1)\n  thus ?case by (induct rule:trancl_induct, fastforce intro:subcls1_class)\nqed\n\n\nlemma Subobjs_subclsR:\nassumes subo:\"Subobjs P C (Cs@[D,D']@Cs')\"\nshows \"P \\<turnstile> D \\<prec>\\<^sub>R D'\"\n\nusing subo\nproof -\n  from subo have \"Subobjs P D (D#D'#Cs')\" by -(rule Subobjs_Subobjs,simp)\n  then obtain C' where subo':\"Subobjs\\<^sub>R P C' (D#D'#Cs')\"\n    by (induct rule:Subobjs.induct,blast+)\n  hence \"C' = D\" by -(drule hd_SubobjsR,simp)\n  with subo' have \"Subobjs\\<^sub>R P D (D#D'#Cs')\" by simp\n  thus ?thesis by (fastforce elim:Subobjs\\<^sub>R.cases dest:hd_SubobjsR)\nqed\n\n\n\n\nlemma assumes subo:\"Subobjs\\<^sub>R P (hd Cs) (Cs@[D])\" and notempty:\"Cs \\<noteq> []\"\n  shows butlast_Subobjs_Rep:\"Subobjs\\<^sub>R P (hd Cs) Cs\"\nusing subo notempty\nproof (induct Cs)\n  case Nil thus ?case by simp\nnext\n  case (Cons C' Cs')\n  have subo:\"Subobjs\\<^sub>R P (hd(C'#Cs')) ((C'#Cs')@[D])\"\n    and IH:\"\\<lbrakk>Subobjs\\<^sub>R P (hd Cs') (Cs'@[D]); Cs' \\<noteq> []\\<rbrakk> \\<Longrightarrow> Subobjs\\<^sub>R P (hd Cs') Cs'\" by fact+\n  from subo have subo':\"Subobjs\\<^sub>R P C' (C'#Cs'@[D])\" by simp\n  show ?case\n  proof (cases \"Cs' = []\")\n    case True\n    with subo' have \"Subobjs\\<^sub>R P C' [C',D]\" by simp\n    hence \"is_class P C'\" by(rule SubobjsR_isClass)\n    hence \"Subobjs\\<^sub>R P C' [C']\" by (rule SubobjsR_Base)\n    with True show ?thesis by simp\n  next\n    case False\n    with subo' obtain D' where subo'':\"Subobjs\\<^sub>R P D' (Cs'@[D])\"\n      and subR:\"P \\<turnstile> C' \\<prec>\\<^sub>R D'\"\n      by (auto elim:Subobjs\\<^sub>R.cases)\n    from False subo'' have hd:\"D' = hd Cs'\"\n      by (induct Cs',auto dest:hd_SubobjsR)\n    with subo'' False IH have \"Subobjs\\<^sub>R P (hd Cs') Cs'\" by simp \n    with subR hd have \"Subobjs\\<^sub>R P C' (C'#Cs')\" by (fastforce intro:SubobjsR_Rep)\n    thus ?thesis by simp\n  qed\nqed\n\n\n\nlemma assumes subo:\"Subobjs P C (Cs@[D])\" and notempty:\"Cs \\<noteq> []\"\n  shows butlast_Subobjs:\"Subobjs P C Cs\"\n\nusing subo\nproof (rule Subobjs.cases,auto)\n  assume suboR:\"Subobjs\\<^sub>R P C (Cs@[D])\" and \"Subobjs P C (Cs@[D])\"\n  from suboR notempty have hd:\"C = hd Cs\"\n    by (induct Cs,auto dest:hd_SubobjsR)\n  with suboR notempty have \"Subobjs\\<^sub>R P (hd Cs) Cs\"\n    by(fastforce intro:butlast_Subobjs_Rep)\n  with hd show \"Subobjs P C Cs\" by (fastforce intro:Subobjs_Rep)\nnext\n  fix C' D' assume leq:\"P \\<turnstile> C \\<preceq>\\<^sup>* C'\" and subS:\"P \\<turnstile> C' \\<prec>\\<^sub>S D'\"\n  and suboR:\"Subobjs\\<^sub>R P D' (Cs@[D])\" and \"Subobjs P C (Cs@[D])\"\n  from suboR notempty have hd:\"D' = hd Cs\"\n    by (induct Cs,auto dest:hd_SubobjsR)\n  with suboR notempty have \"Subobjs\\<^sub>R P (hd Cs) Cs\"\n    by(fastforce intro:butlast_Subobjs_Rep)\n  with hd leq subS show \"Subobjs P C Cs\"\n    by(fastforce intro:Subobjs_Sh)\nqed\n\n\n\n\nlemma assumes subo:\"Subobjs P C (Cs@(rev Cs'))\" and notempty:\"Cs \\<noteq> []\"\n  shows rev_appendSubobj:\"Subobjs P C Cs\"\nusing subo\nproof(induct Cs')\n  case Nil thus ?case by simp\nnext\n  case (Cons D Ds)\n  have subo':\"Subobjs P C (Cs@rev(D#Ds))\"\n    and IH:\"Subobjs P C (Cs@rev Ds) \\<Longrightarrow> Subobjs P C Cs\" by fact+\n  from notempty subo' have \"Subobjs P C (Cs@rev Ds)\"\n    by (fastforce intro:butlast_Subobjs)\n  with IH show ?case by simp\nqed\n\n\n\nlemma appendSubobj:\nassumes subo:\"Subobjs P C (Cs@Cs')\" and notempty:\"Cs \\<noteq> []\"\nshows \"Subobjs P C Cs\"\n\nproof -\n  obtain Cs'' where Cs'':\"Cs'' = rev Cs'\" by simp\n  with subo have \"Subobjs P C (Cs@(rev Cs''))\" by simp\n  with notempty show ?thesis by - (rule rev_appendSubobj)\nqed\n\n\n\n\nlemma SubobjsR_isSubobj:\n  \"Subobjs\\<^sub>R P C Cs \\<Longrightarrow> is_subobj P ((C,Cs))\"\nby(erule Subobjs\\<^sub>R.induct,simp,\n  auto dest:hd_SubobjsR intro:build_rec_isSubobj)\n\nlemma leq_SubobjsR_isSubobj:\n  \"\\<lbrakk>P \\<turnstile> C \\<preceq>\\<^sup>* C'; P \\<turnstile> C' \\<prec>\\<^sub>S D; Subobjs\\<^sub>R P D Cs\\<rbrakk> \n\\<Longrightarrow> is_subobj P ((C,Cs))\"\n\napply (subgoal_tac \"is_subobj P ((C,[D]))\")\n apply (frule hd_SubobjsR)\n apply (drule SubobjsR_isSubobj)\n apply (erule exE)\n apply (simp del: is_subobj.simps)\n apply (erule isSubobj_isSubobj_isSubobj)\n apply simp\napply auto\ndone\n\n\nlemma Subobjs_isSubobj:\n  \"Subobjs P C Cs \\<Longrightarrow> is_subobj P ((C,Cs))\"\nby (auto elim:Subobjs.induct SubobjsR_isSubobj \n  simp add:leq_SubobjsR_isSubobj)\n\n\n\nsubsection \\<open>Paths\\<close>\n\n\nsubsection \\<open>Appending paths\\<close>\n\ntext\\<open>Avoided name clash by calling one path Path.\\<close>\n\ndefinition path_via :: \"prog \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> path \\<Rightarrow> bool\" (\"_ \\<turnstile> Path _ to _ via _ \" [51,51,51,51] 50) where\n  \"P \\<turnstile> Path C to D via Cs \\<equiv> Subobjs P C Cs \\<and> last Cs = D\"\n\ndefinition path_unique :: \"prog \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> bool\" (\"_ \\<turnstile> Path _ to _ unique\" [51,51,51] 50) where\n  \"P \\<turnstile> Path C to D unique \\<equiv> \\<exists>!Cs. Subobjs P C Cs \\<and> last Cs = D\"\n\ndefinition appendPath :: \"path \\<Rightarrow> path \\<Rightarrow> path\" (infixr \"@\\<^sub>p\" 65) where\n  \"Cs @\\<^sub>p Cs' \\<equiv> if (last Cs = hd Cs') then Cs @ (tl Cs') else Cs'\"\n\n\nlemma appendPath_last: \"Cs \\<noteq> [] \\<Longrightarrow> last Cs = last (Cs'@\\<^sub>pCs)\"\nby(auto simp:appendPath_def last_append)(cases Cs, simp_all)+\n\n\n\ninductive\n  casts_to :: \"prog \\<Rightarrow> ty \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ casts _ to _ \" [51,51,51,51] 50)\n  for P :: prog\nwhere\n\n  casts_prim: \"\\<forall>C. T \\<noteq> Class C \\<Longrightarrow> P \\<turnstile> T casts v to v\"\n\n| casts_null: \"P \\<turnstile> Class C casts Null to Null\"\n\n| casts_ref: \"\\<lbrakk> P \\<turnstile> Path last Cs to C via Cs'; Ds = Cs@\\<^sub>pCs' \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> Class C casts Ref(a,Cs) to Ref(a,Ds)\"\n\n\ninductive\n  Casts_to :: \"prog \\<Rightarrow> ty list \\<Rightarrow> val list \\<Rightarrow> val list \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ Casts _ to _ \" [51,51,51,51] 50)\n  for P :: prog\nwhere\n\n  Casts_Nil: \"P \\<turnstile> [] Casts [] to []\"\n\n| Casts_Cons: \"\\<lbrakk> P \\<turnstile> T casts v to v'; P \\<turnstile> Ts Casts vs to vs' \\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> (T#Ts) Casts (v#vs) to (v'#vs')\"\n\n\n\nlemma length_Casts_vs:\n  \"P \\<turnstile> Ts Casts vs to vs' \\<Longrightarrow> length Ts = length vs\"\nby (induct rule:Casts_to.induct,simp_all)\n\nlemma length_Casts_vs':\n  \"P \\<turnstile> Ts Casts vs to vs' \\<Longrightarrow> length Ts = length vs'\"\nby (induct rule:Casts_to.induct,simp_all)\n\n\n\nsubsection \\<open>The relation on paths\\<close>\n\ninductive_set\n  leq_path1 :: \"prog \\<Rightarrow> cname \\<Rightarrow> (path \\<times> path) set\"\n  and leq_path1' :: \"prog \\<Rightarrow> cname \\<Rightarrow> [path, path] \\<Rightarrow> bool\" (\"_,_ \\<turnstile> _ \\<sqsubset>\\<^sup>1 _\" [71,71,71] 70)\n  for P :: prog and C :: cname\nwhere\n  \"P,C \\<turnstile> Cs \\<sqsubset>\\<^sup>1 Ds \\<equiv> (Cs,Ds) \\<in> leq_path1 P C\"\n| leq_pathRep: \"\\<lbrakk> Subobjs P C Cs; Subobjs P C Ds; Cs = butlast Ds\\<rbrakk>\n  \\<Longrightarrow> P,C \\<turnstile> Cs \\<sqsubset>\\<^sup>1 Ds\"\n| leq_pathSh:  \"\\<lbrakk> Subobjs P C Cs; P \\<turnstile> last Cs \\<prec>\\<^sub>S D \\<rbrakk>\n  \\<Longrightarrow> P,C \\<turnstile> Cs \\<sqsubset>\\<^sup>1 [D]\"\n\nabbreviation\n  leq_path :: \"prog \\<Rightarrow> cname \\<Rightarrow> [path, path] \\<Rightarrow> bool\" (\"_,_ \\<turnstile> _ \\<sqsubseteq> _\"  [71,71,71] 70) where\n  \"P,C \\<turnstile> Cs \\<sqsubseteq> Ds \\<equiv> (Cs,Ds) \\<in> (leq_path1 P C)\\<^sup>*\"\n\n\nlemma leq_path_rep:\n  \"\\<lbrakk> Subobjs P C (Cs@[C']); Subobjs P C (Cs@[C',C''])\\<rbrakk> \n\\<Longrightarrow> P,C \\<turnstile> (Cs@[C']) \\<sqsubset>\\<^sup>1 (Cs@[C',C''])\"\nby(rule leq_pathRep,simp_all add:butlast_tail)\n\nlemma leq_path_sh:\n  \"\\<lbrakk> Subobjs P C (Cs@[C']); P \\<turnstile> C' \\<prec>\\<^sub>S C''\\<rbrakk> \n\\<Longrightarrow> P,C \\<turnstile> (Cs@[C']) \\<sqsubset>\\<^sup>1 [C'']\"\nby(erule leq_pathSh)simp\n\n\n\n\nsubsection\\<open>Member lookups\\<close>\n\ndefinition FieldDecls :: \"prog \\<Rightarrow> cname \\<Rightarrow> vname \\<Rightarrow> (path \\<times> ty) set\" where\n  \"FieldDecls P C F \\<equiv> \n   {(Cs,T). Subobjs P C Cs \\<and> (\\<exists>Bs fs ms. class P (last Cs) = Some(Bs,fs,ms)\n                                    \\<and> map_of fs F = Some T)}\"\n\ndefinition LeastFieldDecl  :: \"prog \\<Rightarrow> cname \\<Rightarrow> vname \\<Rightarrow> ty \\<Rightarrow> path \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ has least _:_ via _\" [51,0,0,0,51] 50) where\n  \"P \\<turnstile> C has least F:T via Cs \\<equiv>\n   (Cs,T) \\<in> FieldDecls P C F \\<and>\n   (\\<forall>(Cs',T') \\<in> FieldDecls P C F. P,C \\<turnstile> Cs \\<sqsubseteq> Cs')\"\n\ndefinition MethodDefs :: \"prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> (path \\<times> method)set\" where\n  \"MethodDefs P C M \\<equiv>\n   {(Cs,mthd). Subobjs P C Cs \\<and> (\\<exists>Bs fs ms. class P (last Cs) = Some(Bs,fs,ms)\n                                    \\<and> map_of ms M = Some mthd)}\"\n\n  \\<comment> \\<open>needed for well formed criterion\\<close>\ndefinition HasMethodDef :: \"prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> method \\<Rightarrow> path \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ has _ = _ via _\" [51,0,0,0,51] 50) where\n  \"P \\<turnstile> C has M = mthd via Cs \\<equiv> (Cs,mthd) \\<in> MethodDefs P C M\"\n\ndefinition LeastMethodDef :: \"prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> method \\<Rightarrow> path \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ has least _ = _ via _\" [51,0,0,0,51] 50) where\n  \"P \\<turnstile> C has least M = mthd via Cs \\<equiv>\n   (Cs,mthd) \\<in> MethodDefs P C M \\<and>\n   (\\<forall>(Cs',mthd') \\<in> MethodDefs P C M. P,C \\<turnstile> Cs \\<sqsubseteq> Cs')\"\n\ndefinition MinimalMethodDefs :: \"prog \\<Rightarrow> cname \\<Rightarrow> mname \\<Rightarrow> (path \\<times> method)set\" where\n  \"MinimalMethodDefs P C M \\<equiv> \n      {(Cs,mthd). (Cs,mthd) \\<in> MethodDefs P C M \\<and> \n         (\\<forall>(Cs',mthd')\\<in> MethodDefs P C M. P,C \\<turnstile> Cs' \\<sqsubseteq> Cs \\<longrightarrow> Cs' = Cs)}\"\n\ndefinition OverriderMethodDefs :: \"prog \\<Rightarrow> subobj \\<Rightarrow> mname \\<Rightarrow> (path \\<times> method)set\" where\n  \"OverriderMethodDefs P R M \\<equiv>\n      {(Cs,mthd). \\<exists>Cs' mthd'. P \\<turnstile> (ldc R) has least M = mthd' via Cs' \\<and>\n                      (Cs,mthd) \\<in> MinimalMethodDefs P (mdc R) M \\<and> \n                      P,mdc R \\<turnstile> Cs \\<sqsubseteq> (snd R)@\\<^sub>pCs'}\"\n\ndefinition FinalOverriderMethodDef :: \"prog \\<Rightarrow> subobj \\<Rightarrow> mname \\<Rightarrow> method \\<Rightarrow> path \\<Rightarrow> bool\"\n    (\"_ \\<turnstile> _ has overrider _ = _ via _\" [51,0,0,0,51] 50) where\n  \"P \\<turnstile> R has overrider M = mthd via Cs \\<equiv> \n      (Cs,mthd) \\<in> OverriderMethodDefs P R M \\<and> \n      card(OverriderMethodDefs P R M) = 1\"\n      (*(\\<forall>(Cs',mthd') \\<in> OverriderMethodDefs P R M. Cs = Cs' \\<and> mthd = mthd')\"*)\n\n\ninductive\n  SelectMethodDef :: \"prog \\<Rightarrow> cname \\<Rightarrow> path \\<Rightarrow> mname \\<Rightarrow> method \\<Rightarrow> path \\<Rightarrow> bool\"\n     (\"_ \\<turnstile> '(_,_') selects _ = _ via _\" [51,0,0,0,0,51] 50)\n  for P :: prog\nwhere\n\n  dyn_unique:\n    \"P \\<turnstile> C has least M = mthd via Cs' \\<Longrightarrow> P \\<turnstile> (C,Cs) selects M = mthd via Cs'\"\n\n| dyn_ambiguous:\n    \"\\<lbrakk>\\<forall>mthd Cs'. \\<not> P \\<turnstile> C has least M = mthd via Cs'; \n      P \\<turnstile> (C,Cs) has overrider M = mthd via Cs'\\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> (C,Cs) selects M = mthd via Cs'\"\n\n\n\nlemma sees_fields_fun:\n  \"(Cs,T) \\<in> FieldDecls P C F \\<Longrightarrow> (Cs,T') \\<in> FieldDecls P C F \\<Longrightarrow> T = T'\"\nby(fastforce simp:FieldDecls_def)\n\nlemma sees_field_fun:\n  \"\\<lbrakk>P \\<turnstile> C has least F:T via Cs; P \\<turnstile> C has least F:T' via Cs\\<rbrakk>\n  \\<Longrightarrow> T = T'\"\nby (fastforce simp:LeastFieldDecl_def dest:sees_fields_fun)\n\n\nlemma has_least_method_has_method:\n  \"P \\<turnstile> C has least M = mthd via Cs \\<Longrightarrow> P \\<turnstile> C has M = mthd via Cs\"\nby (simp add:LeastMethodDef_def HasMethodDef_def)\n\n\nlemma visible_methods_exist:\n  \"(Cs,mthd) \\<in> MethodDefs P C M \\<Longrightarrow>\n  (\\<exists>Bs fs ms. class P (last Cs) = Some(Bs,fs,ms) \\<and> map_of ms M = Some mthd)\"\nby(auto simp:MethodDefs_def)\n\n\nlemma sees_methods_fun:\n  \"(Cs,mthd) \\<in> MethodDefs P C M \\<Longrightarrow> (Cs,mthd') \\<in> MethodDefs P C M \\<Longrightarrow> mthd = mthd'\"\nby(fastforce simp:MethodDefs_def)\n\nlemma sees_method_fun:\n  \"\\<lbrakk>P \\<turnstile> C has least M = mthd via Cs; P \\<turnstile> C has least M = mthd' via Cs\\<rbrakk>\n  \\<Longrightarrow> mthd = mthd'\"\nby (fastforce simp:LeastMethodDef_def dest:sees_methods_fun)\n\n\nlemma overrider_method_fun:\nassumes overrider:\"P \\<turnstile> (C,Cs) has overrider M = mthd via Cs'\"\n  and overrider':\"P \\<turnstile> (C,Cs) has overrider M = mthd' via Cs''\"\nshows \"mthd = mthd' \\<and> Cs' = Cs''\"\nproof -\n  from overrider' have omd:\"(Cs'',mthd') \\<in> OverriderMethodDefs P (C,Cs) M\"\n    by(simp_all add:FinalOverriderMethodDef_def)\n  from overrider have \"(Cs',mthd) \\<in> OverriderMethodDefs P (C,Cs) M\"\n    and \"card(OverriderMethodDefs P (C,Cs) M) = 1\" \n    by(simp_all add:FinalOverriderMethodDef_def)\n  hence \"\\<forall>(Ds,mthd'') \\<in> OverriderMethodDefs P (C,Cs) M. (Cs',mthd) = (Ds,mthd'')\"\n    by(fastforce simp:card_Suc_eq)\n  with omd show ?thesis by fastforce\nqed\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/CoreC++/SubObj.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.31943735283726377}}
{"text": "(*\n   Title:  Theory  CompLocalSecrets.thy\n   Author: Maria Spichkova <maria.spichkova at rmit.edu.au>, 2014\n*)\nheader {*Local Secrets of a component *}\n\ntheory CompLocalSecrets\nimports Secrecy \nbegin\n\n-- \"Set of local secrets: the set of secrets which does not belong to\"\n-- \"the set of private keys and unguessable values, but are transmitted\"\n-- \"via local channels or belongs to the local secrets of its subcomponents\"\naxiomatization\n  LocalSecrets :: \"specID  \\<Rightarrow> KS set\"\nwhere\nLocalSecretsDef:\n \"LocalSecrets A =\n  {(m :: KS). m \\<notin> specKeysSecrets A  \\<and> \n              ((\\<exists> x y. ((x \\<in> loc A) \\<and> m = (kKS y) \\<and> (exprChannel x (kE y)))) \n              |(\\<exists> x z. ((x \\<in> loc A) \\<and> m = (sKS z) \\<and> (exprChannel x (sE z)) )) )} \n   \\<union>  (\\<Union> (LocalSecrets ` (subcomponents A) ))\"\n\nlemma LocalSecretsComposition1:\nassumes \"ls \\<in> LocalSecrets P\"\n       and \"subcomponents PQ = {P, Q}\"\nshows    \"ls \\<in> LocalSecrets PQ\"\nusing assms by (simp (no_asm) only: LocalSecretsDef, auto)\n\nlemma  LocalSecretsComposition_exprChannel_k:\nassumes \"exprChannel x (kE Keys)\"\n       and \"\\<not> ine P (kE Keys)\"\n       and \"\\<not> ine Q (kE Keys)\"\n       and \"\\<not> (x \\<notin> ins P \\<and> x \\<notin> ins Q)\"\nshows \"False\"\nusing assms by (metis ine_def)\n\nlemma  LocalSecretsComposition_exprChannel_s:\nassumes \"exprChannel x (sE Secrets)\"\n       and \"\\<not> ine P (sE Secrets)\"\n       and \"\\<not> ine Q (sE Secrets)\"\n       and \"\\<not> (x \\<notin> ins P \\<and> x \\<notin> ins Q)\"\nshows \"False\"\nusing assms by (metis ine_ins_neg1)\n\nlemma LocalSecretsComposition_neg1_k:\nassumes \"subcomponents PQ = {P, Q}\"\n       and \"correctCompositionLoc PQ\"\n       and \"\\<not> ine P (kE Keys)\"\n       and \"\\<not> ine Q (kE Keys)\"\n       and \"kKS Keys \\<notin> LocalSecrets P\"\n       and \"kKS Keys \\<notin> LocalSecrets Q\"\nshows    \"kKS Keys \\<notin> LocalSecrets PQ\"\nproof - \n  from assms show ?thesis \n    apply (simp (no_asm) only: LocalSecretsDef, \n           simp add: correctCompositionLoc_def, clarify)\n    by (rule LocalSecretsComposition_exprChannel_k, auto)\nqed\n\nlemma LocalSecretsComposition_neg_k:\nassumes \"subcomponents PQ = {P,Q}\"\n       and \"correctCompositionLoc PQ\"\n       and \"correctCompositionKS PQ\"\n       and \"(kKS m) \\<notin> specKeysSecrets P\"\n       and \"(kKS m) \\<notin> specKeysSecrets Q\"\n       and \"\\<not> ine P (kE m)\"\n       and \"\\<not> ine Q (kE m)\"\n       and \"(kKS m) \\<notin> ((LocalSecrets P) \\<union> (LocalSecrets Q))\"\nshows    \"(kKS m) \\<notin> (LocalSecrets PQ)\"\nproof -\n  from assms show ?thesis \n    apply (simp (no_asm) only: LocalSecretsDef, \n           simp add: correctCompositionLoc_def, clarify)\n    by (rule LocalSecretsComposition_exprChannel_k, auto)\nqed  \n\nlemma LocalSecretsComposition_neg_s:\nassumes subPQ:\"subcomponents PQ = {P,Q}\"\n       and cCompLoc:\"correctCompositionLoc PQ\"\n       and cCompKS:\"correctCompositionKS PQ\"\n       and notKSP:\"(sKS m) \\<notin> specKeysSecrets P\"\n       and notKSQ:\"(sKS m) \\<notin> specKeysSecrets Q\"\n       and \"\\<not> ine P (sE m)\"\n       and \"\\<not> ine Q (sE m)\"\n       and notLocSeqPQ:\"(sKS m) \\<notin> ((LocalSecrets P) \\<union> (LocalSecrets Q))\"\nshows   \"(sKS m) \\<notin> (LocalSecrets PQ)\"\nproof -\n  from subPQ and cCompKS and notKSP and notKSQ\n  have sg1:\"sKS m \\<notin> specKeysSecrets PQ\"\n    by (simp add: correctCompositionKS_neg1) \n  from subPQ and cCompLoc and notLocSeqPQ have sg2:\n   \"sKS m \\<notin>  \\<Union> (LocalSecrets ` subcomponents PQ)\"\n    by simp\n  from sg1 and sg2 and assms show ?thesis \n    apply (simp (no_asm) only: LocalSecretsDef, \n           simp add: correctCompositionLoc_def, clarify)\n    by (rule LocalSecretsComposition_exprChannel_s, auto)\nqed  \n\nlemma LocalSecretsComposition_neg:\nassumes \"subcomponents PQ = {P,Q}\" \n       and \"correctCompositionLoc PQ\" \n       and \"correctCompositionKS PQ\"\n       and \"ks \\<notin> specKeysSecrets P\"\n       and \"ks \\<notin> specKeysSecrets Q\"\n       and h1:\"\\<forall> m. ks = kKS m \\<longrightarrow> (\\<not> ine P (kE m) \\<and> \\<not> ine Q (kE m))\"\n       and h2:\"\\<forall> m. ks = sKS m \\<longrightarrow> (\\<not> ine P (sE m) \\<and> \\<not> ine Q (sE m))\"\n       and \"ks \\<notin> ((LocalSecrets P) \\<union> (LocalSecrets Q))\"\nshows   \"ks \\<notin> (LocalSecrets PQ)\"\nproof (cases \"ks\")\n  fix m\n  assume a1:\"ks = kKS m\"\n  from this and h1 have \"\\<not> ine P (kE m) \\<and> \\<not> ine Q (kE m)\" by simp\n  from this and a1 and assms show ?thesis\n    by (simp add: LocalSecretsComposition_neg_k)\nnext\n  fix m\n  assume a2:\"ks = sKS m\"\n  from this and h2 have \"\\<not> ine P (sE m) \\<and> \\<not> ine Q (sE m)\" by simp\n  from this and a2 and assms show ?thesis\n    by (simp add: LocalSecretsComposition_neg_s)\nqed\n\nlemma LocalSecretsComposition_neg1_s:\nassumes \"subcomponents PQ = {P, Q}\"\n       and \"correctCompositionLoc PQ\"\n       and \"\\<not> ine P (sE s)\"\n       and \"\\<not> ine Q (sE s)\"\n       and \"sKS s \\<notin> LocalSecrets P\" \n       and \"sKS s \\<notin> LocalSecrets Q\"\nshows    \"sKS s \\<notin> LocalSecrets PQ\"\nproof - \n  from assms have \n   \"sKS s \\<notin>  \\<Union> (LocalSecrets ` subcomponents PQ)\"\n    by simp\n    from  assms and this show ?thesis \n    apply (simp (no_asm) only: LocalSecretsDef, \n              simp add: correctCompositionLoc_def, clarify)\n    by (rule LocalSecretsComposition_exprChannel_s, auto)\nqed  \n\n\n\nlemma LocalSecretsComposition_ine1_k:\nassumes \"kKS k \\<in> LocalSecrets PQ\" \n       and \"subcomponents PQ = {P, Q}\"\n       and \"correctCompositionLoc PQ\" \n       and \"\\<not> ine Q (kE k)\"\n       and \"kKS k \\<notin> LocalSecrets P\"\n       and \"kKS k \\<notin> LocalSecrets Q\"\nshows    \"ine P (kE k)\"\nusing assms by (metis LocalSecretsComposition_neg1_k)\n\nlemma LocalSecretsComposition_ine1_s:\nassumes \"sKS s \\<in> LocalSecrets PQ\" \n       and \"subcomponents PQ = {P, Q}\"\n       and \"correctCompositionLoc PQ\" \n       and \"\\<not> ine Q (sE s)\"\n       and \"sKS s \\<notin> LocalSecrets P\"\n       and \"sKS s \\<notin> LocalSecrets Q\"\nshows    \"ine P (sE s)\"\nusing assms by (metis LocalSecretsComposition_neg1_s)\n\nlemma LocalSecretsComposition_ine2_k:\nassumes \"kKS k \\<in> LocalSecrets PQ\"\n       and \"subcomponents PQ = {P, Q}\"\n       and \"correctCompositionLoc PQ\"\n       and \"\\<not> ine P (kE k)\"\n       and \"kKS k \\<notin> LocalSecrets P\"\n       and \"kKS k \\<notin> LocalSecrets Q\"\nshows   \"ine Q (kE k)\" \nusing assms  by (metis LocalSecretsComposition_ine1_k)\n\nlemma LocalSecretsComposition_ine2_s:\nassumes \"sKS s \\<in> LocalSecrets PQ\" \n       and \"subcomponents PQ = {P, Q}\"\n       and \"correctCompositionLoc PQ\"\n       and \"\\<not> ine P (sE s)\"\n       and \"sKS s \\<notin> LocalSecrets P\"\n       and \"sKS s \\<notin> LocalSecrets Q\"\nshows    \"ine Q (sE s)\"\nusing assms by (metis LocalSecretsComposition_ine1_s)\n\nlemma LocalSecretsComposition_neg_loc_k:\nassumes \"kKS key \\<notin> LocalSecrets P\"\n       and \"exprChannel ch (kE key)\"\n       and \"kKS key \\<notin> specKeysSecrets P\"\nshows    \"ch \\<notin> loc P\"\nusing assms by (simp only: LocalSecretsDef, auto)\n\nlemma LocalSecretsComposition_neg_loc_s:\nassumes \"sKS secret \\<notin> LocalSecrets P\"\n       and \"exprChannel ch (sE secret)\"\n       and \"sKS secret \\<notin> specKeysSecrets P\"\nshows    \"ch \\<notin> loc P\"\nusing assms by (simp only: LocalSecretsDef, auto)\n\nlemma correctCompositionKS_exprChannel_k_P:\nassumes \"subcomponents PQ = {P,Q}\" \n       and \"correctCompositionKS PQ\"\n       and \"kKS key \\<notin> LocalSecrets PQ\"\n       and \"ch \\<in> ins P\"\n       and \"exprChannel ch (kE key)\"\n       and \"kKS key \\<notin> specKeysSecrets PQ\"\n       and \"correctCompositionIn PQ\"\nshows    \"ch \\<in> ins PQ \\<and> exprChannel ch (kE key)\"\nusing assms\nby (metis LocalSecretsComposition_neg_loc_k correctCompositionIn_L1)\n\nlemma correctCompositionKS_exprChannel_k_Pex:\nassumes \"subcomponents PQ = {P,Q}\" \n       and \"correctCompositionKS PQ\"\n       and \"kKS key \\<notin> LocalSecrets PQ\"\n       and \"ch \\<in> ins P\"\n       and \"exprChannel ch (kE key)\"\n       and \"kKS key \\<notin> specKeysSecrets PQ\"\n       and \"correctCompositionIn PQ\"\nshows    \"\\<exists>ch. ch \\<in> ins PQ \\<and> exprChannel ch (kE key)\"\nusing assms\nby (metis correctCompositionKS_exprChannel_k_P)\n\nlemma correctCompositionKS_exprChannel_k_Q:\nassumes \"subcomponents PQ = {P,Q}\" \n       and \"correctCompositionKS PQ\"\n       and \"kKS key \\<notin> LocalSecrets PQ\"\n       and \"ch \\<in> ins Q\"\n       and h1:\"exprChannel ch (kE key)\"\n       and \"kKS key \\<notin> specKeysSecrets PQ\"\n       and \"correctCompositionIn PQ\"\nshows    \"ch \\<in> ins PQ \\<and> exprChannel ch (kE key)\"\nproof - \n  from assms have \"ch \\<notin> loc PQ\" \n    by (simp add: LocalSecretsComposition_neg_loc_k)\n  from this and assms have \"ch \\<in> ins PQ\" \n    by (simp add: correctCompositionIn_def) \n  from this and h1 show ?thesis by simp\nqed\n\nlemma correctCompositionKS_exprChannel_k_Qex:\nassumes \"subcomponents PQ = {P,Q}\" \n        and \"correctCompositionKS PQ\"\n        and \"kKS key \\<notin> LocalSecrets PQ\"\n        and \"ch \\<in> ins Q\"\n        and \"exprChannel ch (kE key)\"\n        and \"kKS key \\<notin> specKeysSecrets PQ\"\n        and \"correctCompositionIn PQ\"\nshows    \"\\<exists>ch. ch \\<in> ins PQ \\<and> exprChannel ch (kE key)\"\nusing assms\nby (metis correctCompositionKS_exprChannel_k_Q)\n\nlemma correctCompositionKS_exprChannel_s_P:\nassumes \"subcomponents PQ = {P,Q}\" \n       and \"correctCompositionKS PQ\"\n       and \"sKS secret \\<notin> LocalSecrets PQ\"\n       and \"ch \\<in> ins P\"\n       and \"exprChannel ch (sE secret)\"\n       and \"sKS secret \\<notin> specKeysSecrets PQ\"\n       and \"correctCompositionIn PQ\"\nshows    \"ch \\<in> ins PQ \\<and> exprChannel ch (sE secret)\"\nusing assms\nby (metis LocalSecretsComposition_neg_loc_s correctCompositionIn_L1)\n\nlemma correctCompositionKS_exprChannel_s_Pex:\nassumes \"subcomponents PQ = {P,Q}\" \n       and \"correctCompositionKS PQ\"\n       and \"sKS secret \\<notin> LocalSecrets PQ\"\n       and \"ch \\<in> ins P\"\n       and \"exprChannel ch (sE secret)\"\n       and \"sKS secret \\<notin> specKeysSecrets PQ\"\n       and \"correctCompositionIn PQ\"\nshows    \"\\<exists>ch. ch \\<in> ins PQ \\<and> exprChannel ch (sE secret)\"\nusing assms  \nby (metis correctCompositionKS_exprChannel_s_P)\n\nlemma correctCompositionKS_exprChannel_s_Q:\nassumes \"subcomponents PQ = {P,Q}\" \n       and \"correctCompositionKS PQ\"\n       and \"sKS secret \\<notin> LocalSecrets PQ\"\n       and \"ch \\<in> ins Q\"\n       and h1:\"exprChannel ch (sE secret)\"\n       and \"sKS secret \\<notin> specKeysSecrets PQ\"\n       and \"correctCompositionIn PQ\"\nshows    \"ch \\<in> ins PQ \\<and> exprChannel ch (sE secret)\"\nproof - \n  from assms have \"ch \\<notin> loc PQ\" \n    by (simp add: LocalSecretsComposition_neg_loc_s)\n  from this and assms have \"ch \\<in> ins PQ\" \n    by (simp add: correctCompositionIn_def) \n  from this and h1 show ?thesis by simp\nqed\n\nlemma correctCompositionKS_exprChannel_s_Qex:\nassumes \"subcomponents PQ = {P,Q}\" \n       and \"correctCompositionKS PQ\"\n       and \"sKS secret \\<notin> LocalSecrets PQ\"\n       and \"ch \\<in> ins Q\"\n       and \"exprChannel ch (sE secret)\"\n       and \"sKS secret \\<notin> specKeysSecrets PQ\"\n       and \"correctCompositionIn PQ\"\nshows    \"\\<exists>ch. ch \\<in> ins PQ \\<and> exprChannel ch (sE secret)\"\nusing assms\nby (metis correctCompositionKS_exprChannel_s_Q)\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/CryptoBasedCompositionalProperties/CompLocalSecrets.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646140788307, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.3194227671598468}}
{"text": "theory BaseLogicDeep\nimports CoreStructures LogicSyntaxDeep \"../HeapLang/State\" LogicTypesDeep\nbegin\n\nsection \\<open> Base Logic \\<close>\n\n(* Irrelevant contexts that were left out in the description are called I instead of \\<Gamma>.  *)\ninductive judgement :: \"(string\\<times>logic_type) list \\<Rightarrow> 'a::ucamera logic_term \\<Rightarrow> 'a logic_term \\<Rightarrow> bool\" \n  (\"_ | _ \\<turnstile> _\" 60)  where\n  Asm: \"I|P\\<turnstile>P\"\n| Cut: \"\\<lbrakk>I|P\\<turnstile>Q; I|Q\\<turnstile>R\\<rbrakk> \\<Longrightarrow> I|P\\<turnstile>Q\"\n| Eq: \"\\<lbrakk>(x,\\<tau>)#\\<Gamma>\\<turnstile>Q:PropT; \\<Gamma>|P\\<turnstile>term_subst t x Q; \\<Gamma>|P\\<turnstile>EqTrm \\<tau> t t'\\<rbrakk> \\<Longrightarrow> \\<Gamma>|P\\<turnstile>term_subst t' x Q\"\n| Refl: \"I|TrueTrm\\<turnstile>EqTrm \\<tau> t t\"\n| BotE: \"I|FalseTrm\\<turnstile>P\"\n| TopI: \"I|P\\<turnstile>TrueTrm\"\n| ConjI: \"\\<lbrakk>I|P\\<turnstile>Q; I|P\\<turnstile>R\\<rbrakk> \\<Longrightarrow> I|P\\<turnstile>Conj Q R\"\n| ConjEL: \"I|P\\<turnstile>Conj Q R \\<Longrightarrow> I|P\\<turnstile>Q\"\n| ConjER: \"I|P\\<turnstile>Conj Q R \\<Longrightarrow> I|P\\<turnstile>R\"\n| DisjIL: \"I|P\\<turnstile>Q \\<Longrightarrow> I|P\\<turnstile>Disj Q R\"\n| DisjIR: \"I|P\\<turnstile>R \\<Longrightarrow> I|P\\<turnstile>Disj Q R\"\n| DisjE: \"\\<lbrakk>I|P\\<turnstile>R; I|Q\\<turnstile>R\\<rbrakk> \\<Longrightarrow> I|Disj P Q\\<turnstile>R\"\n| ImplI: \"I|Conj P Q\\<turnstile>R \\<Longrightarrow> I|P\\<turnstile>Impl Q R\"\n| ImplE: \"\\<lbrakk>I|P\\<turnstile>Impl Q R; I|P\\<turnstile>Q\\<rbrakk> \\<Longrightarrow> I|P\\<turnstile>R\"\n| ForallI: \"(x,\\<tau>)#\\<Gamma>|P\\<turnstile>Q \\<Longrightarrow> \\<Gamma>|P\\<turnstile>Forall x \\<tau> Q\"\n| ForallE: \"\\<lbrakk>\\<Gamma>|P\\<turnstile>Forall x \\<tau> Q; \\<Gamma>\\<turnstile>t:\\<tau>\\<rbrakk> \\<Longrightarrow> \\<Gamma>|P\\<turnstile>term_subst t x Q\"\n| ExistsI: \"\\<lbrakk>\\<Gamma>|P\\<turnstile>term_subst t x Q; \\<Gamma>\\<turnstile>t:\\<tau>\\<rbrakk> \\<Longrightarrow> \\<Gamma>|P\\<turnstile>Exists x \\<tau> Q\"\n| ExistsE: \"(x,\\<tau>)#\\<Gamma>|P\\<turnstile>Q \\<Longrightarrow> \\<Gamma>|Exists x \\<tau> P\\<turnstile>Q\"\n| EtaRed: \"I|P\\<turnstile>Q \\<Longrightarrow> I|P\\<turnstile>Abs x \\<tau> (AppL Q (VarL x))\"\n\ndatatype 'a semantic_type = PropS \"'a \\<Rightarrow> nat \\<Rightarrow> bool\" | CmraS 'a | UnitS unit \n  | ProdS \"'a semantic_type\\<times>'a semantic_type\" \n  | FunS \"('a semantic_type\\<times>'a semantic_type) fset\" \\<comment> \\<open>BNFs can't have recursion in function arguments\\<close>\n  | ExprS expr | StateS state | ObservationS observation | ListS \"'a semantic_type list\"\n  \ndefinition funS :: \"('a semantic_type\\<Rightarrow>'a semantic_type) \\<Rightarrow> 'a semantic_type\" where\n  \"funS f = FunS (Abs_fset {(x,y) | x y. f x = y})\"\n\ndefinition appS :: \"'a semantic_type \\<Rightarrow> 'a semantic_type \\<Rightarrow> 'a semantic_type\" where\n  \"appS fS x \\<equiv> case fS of FunS f \\<Rightarrow> the_elem ((fset f) `` {x}) | _ \\<Rightarrow> undefined\"\nnotation appS (infixl \"$$\" 60)\n\nabbreviation \"unwrap_expr eS \\<equiv> case eS of ExprS e \\<Rightarrow> e | _ \\<Rightarrow> undefined\"\nabbreviation \"unwrap_state sS \\<equiv> case sS of StateS s \\<Rightarrow> s | _ \\<Rightarrow> undefined\"\nabbreviation \"unwrap_obs oS \\<equiv> case oS of ObservationS ob \\<Rightarrow> ob | _ \\<Rightarrow> undefined\"\nabbreviation \"unwrap_list m lS \\<equiv> case lS of ListS l \\<Rightarrow> map m l | _ \\<Rightarrow> undefined\"\nabbreviation \"unwrap_prop pS x n \\<equiv> case pS of PropS p \\<Rightarrow> p x n | _ \\<Rightarrow> undefined\"\n\ndefinition head_step_sem :: \"'a::ucamera semantic_type\" where\n  \"head_step_sem \\<equiv> funS (\\<lambda>e1S. funS (\\<lambda>s1S. funS (\\<lambda>kl. funS (\\<lambda>e2S. funS (\\<lambda>s2S. funS (\\<lambda>efsl. \n      PropS (\\<lambda>_ _.\n      ((unwrap_expr e1S) (unwrap_state s1S) (unwrap_list unwrap_obs kl) \\<Rightarrow>\\<^sub>h \n      (unwrap_expr e2S) (unwrap_state s2S) (unwrap_list unwrap_expr efsl))\n  )))))))\"\n  \ndefinition \"wp_sem \\<equiv> funS \n  (\\<lambda>e. PropS (\\<lambda>x n. \\<forall>s1 k e2 s2 efs. unwrap_prop (head_step_sem$$e$$s1$$k$$e2$$s2$$efs) x n))\"\n\nabbreviation \"comb_prop p q pcomb \\<equiv> (case p of Some (PropS p') \\<Rightarrow> (case q of Some (PropS q') \\<Rightarrow> \n  Some (PropS (\\<lambda>a n. pcomb p' q' a n)) | _ \\<Rightarrow> None) | _ \\<Rightarrow> None)\"\n  \nfun logic_semantic \n  :: \"'a::ucamera logic_term \\<Rightarrow> (string\\<rightharpoonup>'a semantic_type) \\<Rightarrow> 'a semantic_type option\" where\n  \"logic_semantic Unit _ = Some (UnitS ())\"\n| \"logic_semantic (VarL v) \\<Gamma> = \\<Gamma> v\"\n| \"logic_semantic (Prod f s) \\<Gamma> = comb_option (logic_semantic f \\<Gamma>) (logic_semantic s \\<Gamma>) \n  (\\<lambda>fS sS. ProdS (fS,sS))\"\n| \"logic_semantic (FstL p) \\<Gamma> = (case logic_semantic p \\<Gamma> of Some (ProdS pS) \\<Rightarrow> Some (fst pS) \n  | _ \\<Rightarrow> None)\"\n| \"logic_semantic (SndL p) \\<Gamma> = (case logic_semantic p \\<Gamma> of Some (ProdS pS) \\<Rightarrow> Some (snd pS) \n  | _ \\<Rightarrow> None)\"\n| \"logic_semantic (Abs v _ b) \\<Gamma> = Some (funS (\\<lambda>vS. the (logic_semantic b (\\<Gamma>(v\\<mapsto>vS)))))\"\n| \"logic_semantic (AppL f x) \\<Gamma> = comb_option (logic_semantic f \\<Gamma>) (logic_semantic x \\<Gamma>) appS\"\n| \"logic_semantic (Const x) _ = Some (CmraS x)\"\n| \"logic_semantic (Core x) \\<Gamma> = (case logic_semantic x \\<Gamma> of Some (CmraS x') \\<Rightarrow> Some (CmraS (core x')) \n  | _ \\<Rightarrow> None)\"\n| \"logic_semantic (Comp x y) \\<Gamma> = (case logic_semantic x \\<Gamma> of Some (CmraS x') \\<Rightarrow> \n  (case logic_semantic y \\<Gamma> of Some (CmraS y') \\<Rightarrow> Some (CmraS (x'\\<cdot>y')) | _ \\<Rightarrow> None) | _ \\<Rightarrow> None)\"\n| \"logic_semantic FalseTrm _ = Some (PropS (\\<lambda>_ _. False))\"\n| \"logic_semantic TrueTrm _ = Some (PropS (\\<lambda>_ _. True))\"\n| \"logic_semantic (EqTrm _ x y) \\<Gamma> = comb_option (logic_semantic x \\<Gamma>) (logic_semantic y \\<Gamma>) \n  (\\<lambda>x y. PropS (\\<lambda> _ _. x=y))\"\n| \"logic_semantic (Impl p q) \\<Gamma> = comb_prop (logic_semantic p \\<Gamma>) (logic_semantic q \\<Gamma>) \n  (\\<lambda>p q a n. p a n \\<longrightarrow> q a n)\"\n| \"logic_semantic (Conj p q) \\<Gamma> = comb_prop (logic_semantic p \\<Gamma>) (logic_semantic q \\<Gamma>) \n  (\\<lambda>p q a n. p a n \\<and> q a n)\"\n| \"logic_semantic (Disj p q) \\<Gamma> = comb_prop (logic_semantic p \\<Gamma>) (logic_semantic q \\<Gamma>) \n  (\\<lambda>p q a n. p a n \\<or> q a n)\"\n| \"logic_semantic (Sep p q) \\<Gamma> = comb_prop (logic_semantic p \\<Gamma>) (logic_semantic q \\<Gamma>) \n  (\\<lambda>p q a n. \\<exists>b1 b2. n_equiv n a (b1\\<cdot>b2) \\<and> p b1 n \\<and> q b2 n)\"\n| \"logic_semantic (Wand p q) \\<Gamma> = comb_prop (logic_semantic p \\<Gamma>) (logic_semantic q \\<Gamma>) \n  (\\<lambda>p q a n. \\<forall>b m. m\\<le>n \\<longrightarrow> n_valid (a \\<cdot> b) m \\<longrightarrow> p b m \\<longrightarrow> q (a \\<cdot> b) m)\"\n| \"logic_semantic (Guarded v _ b) \\<Gamma> = (if guarded v b then \n  Some (funS (\\<lambda>vS. the (logic_semantic b (\\<Gamma>(v\\<mapsto>vS))))) else None)\"\n| \"logic_semantic (Exists v _ b) \\<Gamma> = \n  Some (PropS (\\<lambda>a n. \\<exists>vS. unwrap_prop (the (logic_semantic b (\\<Gamma>(v\\<mapsto>vS)))) a n))\"\n| \"logic_semantic (Forall v _ b) \\<Gamma> = \n  Some (PropS (\\<lambda>a n. \\<forall>vS. unwrap_prop (the (logic_semantic b (\\<Gamma>(v\\<mapsto>vS)))) a n))\"\n| \"logic_semantic (Own x) \\<Gamma> = (case logic_semantic x \\<Gamma> of Some (CmraS x') \\<Rightarrow> \n  Some (PropS (\\<lambda>a n. n_incl n x' a)) | _ \\<Rightarrow> None)\"\n| \"logic_semantic (Valid x) \\<Gamma> = (case logic_semantic x \\<Gamma> of Some (CmraS x') \\<Rightarrow> \n  Some (PropS (\\<lambda>_. n_valid x')) | _ \\<Rightarrow> None)\"\n| \"logic_semantic (Persistent p) \\<Gamma> = (case logic_semantic p \\<Gamma> of Some (PropS p') \\<Rightarrow> \n  Some (PropS (\\<lambda>a n. p' (core a) n)) | _ \\<Rightarrow> None)\"\n| \"logic_semantic (Plain p) \\<Gamma> = (case logic_semantic p \\<Gamma> of Some (PropS p') \\<Rightarrow>\n  Some (PropS (\\<lambda>_ n. p' \\<epsilon> n)) | _ \\<Rightarrow> None)\"\n| \"logic_semantic (Later p) \\<Gamma> = (case logic_semantic p \\<Gamma> of Some (PropS p') \\<Rightarrow>\n  Some (PropS (\\<lambda>a n. n=0 \\<or> p' a (n-1))))\"\n| \"logic_semantic (Upd p) \\<Gamma> = (case logic_semantic p \\<Gamma> of Some (PropS p') \\<Rightarrow>\n  Some (PropS (\\<lambda>a n. \\<forall>m b. m\\<le>n \\<longrightarrow> n_valid (a \\<cdot> b) m \\<longrightarrow> (\\<exists>c. n_valid (c \\<cdot> b) m \\<and> p' c m))))\"\n\nlemma \"\\<lbrakk>dom \\<Gamma>S \\<subseteq> dom \\<Gamma>T; type_of_term t \\<Gamma>T = None\\<rbrakk> \\<Longrightarrow> logic_semantic t \\<Gamma>S = None\"\napply (induction t)\napply (auto split: option.splits)\nsorry\n\ndefinition entails :: \"'a::ucamera semantic_type \\<Rightarrow> 'a semantic_type \\<Rightarrow> bool\" where\n  \"entails P Q \\<equiv> let P' = unwrap_prop P in let Q' = unwrap_prop Q in \n    (\\<forall>a n. n_valid a n \\<longrightarrow> P' a n \\<longrightarrow> Q' a n)\"\n\nlemma \"\\<lbrakk>\\<Gamma>T|P\\<turnstile>Q; logic_semantic P \\<Gamma>S = Some P'; logic_semantic Q \\<Gamma>S = Some Q'\\<rbrakk> \\<Longrightarrow> entails P' Q'\"\nsorry\n    \nlemma \"logic_semantic wp [''head_step''\\<mapsto>head_step_sem] = Some wp_sem\"\napply (auto simp add: wp_def head_step_sem_def funS_def appS_def the_elem_def Abs_fset_inverse)\nsorry\n\n\ntext \\<open>\n  Deep Embedding of uniform predicates:\n\n  - all Iris logic formulae as instances of datatype \\<^typ>\\<open>'a logic_term\\<close>\n  - terms with camera objects (\\<^typ>\\<open>'a::ucamera\\<close>/\\<^const>\\<open>CmraT\\<close>) very simple: \n    \\<^const>\\<open>Const\\<close>, \\<^const>\\<open>Core\\<close>, \\<^const>\\<open>Comp\\<close>\n  - uniform predicates about camera objects (\\<^typ>\\<open>'a::ucamera\\<Rightarrow>nat\\<Rightarrow>bool\\<close>/\\<^const>\\<open>PropT\\<close>) very simple: \n    \\<^const>\\<open>Own\\<close>, \\<^const>\\<open>Valid\\<close>, \\<^const>\\<open>Conj\\<close>, \\<^const>\\<open>Disj\\<close>, \\<^const>\\<open>TrueTrm\\<close>, \\<^const>\\<open>FalseTrm\\<close>, \n    \\<^const>\\<open>EqTrm\\<close>, \\<^const>\\<open>Impl\\<close>, \\<^const>\\<open>Sep\\<close>, \\<^const>\\<open>Wand\\<close>, \\<^const>\\<open>Persistent\\<close>, \\<^const>\\<open>Plain\\<close>, \n    \\<^const>\\<open>Later\\<close>, \\<^const>\\<open>Upd\\<close>, (maybe also have a wrapper for \"pure\" propositions, e.g. \\<open>\\<lambda>a n. True\\<close>)\n  - BUT: Iris base logic also reasons about terms of other types as well:\n    \\<^typ>\\<open>unit\\<close>/\\<^const>\\<open>UnitT\\<close>, \\<^typ>\\<open>'a\\<times>'b\\<close>/\\<^const>\\<open>ProdT\\<close>, \\<^typ>\\<open>'a\\<Rightarrow>'b\\<close>/\\<^const>\\<open>FunT\\<close> (i.e. \\<^typ>\\<open>'a-n>'b\\<close>),\n    \\<^typ>\\<open>'a+'b\\<close> (omitted), and all other types an application needs (e.g. \\<^typ>\\<open>expr\\<close>/\\<^const>\\<open>Expr\\<close>,\n    \\<^typ>\\<open>state\\<close>/\\<^const>\\<open>State\\<close>, \\<^typ>\\<open>observation\\<close>/\\<^const>\\<open>Observation\\<close> and lists of these types)\n  - Do we need to be to argue about other types than cameras within the base logic?\n    => if we would only be able to reason about cameras, we would lose the ability to have \n    sideconditions about them (e.g. if we can do a head step in HeapLang, we can also do a ghost update\n    to then own the new state)\n    => quantifiers make things really difficult either way if the variable, over which we abstract\n    is used within a \"pure\" context\n    => The biggest problem is the semantics of functions and application, no deep embedding can have \n    well-typed function semantics (i.e. a datatype which wraps functions on itself)\n  - Make quantifiers only inside a Pure wrapper doesn't work as it cuts the connection of outer camera\n    objects necessary for the semantics from the inner ones.\n\\<close>\nend", "meta": {"author": "firefighterduck", "repo": "isariris", "sha": "d02268e1e11cf681cae70b366b52843cbd90cc49", "save_path": "github-repos/isabelle/firefighterduck-isariris", "path": "github-repos/isabelle/firefighterduck-isariris/isariris-d02268e1e11cf681cae70b366b52843cbd90cc49/IrisCore/BaseLogicDeep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.3194227609867031}}
{"text": "theory Hash_User\nimports Hash_Specification Hash_Declaration\n\nbegin\n\n\nlemma goal12'1: \n  assumes H1: \" x__index__subtype__1__first'' = (0 :: int)\n  \"\n  assumes H6: \n  \" chain___default_rcd''\n    (| h0'chain\n       := ca__1''\n    |)\n    (| h1'chain\n       := cb__1''\n    |)\n    (| h2'chain\n       := cc__1''\n    |)\n    (| h3'chain\n       := cd__1''\n    |)\n    (| h4'chain\n       := ce__1''\n    |)\n    = round'\n        ( chain___default_rcd''\n          (| h0'chain\n             := (1732584193 :: int)\n          |)\n          (| h1'chain\n             := (4023233417 :: int)\n          |)\n          (| h2'chain\n             := (2562383102 :: int)\n          |)\n          (| h3'chain\n             := (271733878 :: int)\n          |)\n          (| h4'chain\n             := (3285377520 :: int)\n          |)\n        )\n        ( x'' x__index__subtype__1__first''\n        )\n  \"\n  shows \" chain___default_rcd''\n          (| h0'chain\n             := ca__1''\n          |)\n          (| h1'chain\n             := cb__1''\n          |)\n          (| h2'chain\n             := cc__1''\n          |)\n          (| h3'chain\n             := cd__1''\n          |)\n          (| h4'chain\n             := ce__1''\n          |)\n          = rounds'\n              ( chain___default_rcd''\n                (| h0'chain\n                   := (1732584193 :: int)\n                |)\n                (| h1'chain\n                   := (4023233417 :: int)\n                |)\n                (| h2'chain\n                   := (2562383102 :: int)\n                |)\n                (| h3'chain\n                   := (271733878 :: int)\n                |)\n                (| h4'chain\n                   := (3285377520 :: int)\n                |)\n              )\n              ( x__index__subtype__1__first'' + (1 :: int) )\n              x''\n        \" (is \"?C1\")\nusing H1 H6\nby (simp add:\n  rounds_def rmd_body_def round_def\n  h_0_def h0_0_def h1_0_def h2_0_def h3_0_def h4_0_def)\n\n\nlemma rounds_step:\n  assumes \"0 <= i\"\n  shows \"rounds X b (Suc i) = round (X i) (rounds X b i)\"\n  by (simp add: rounds_def rmd_body_def)\n\nlemma from_to_id: \"from_chain (to_chain C) = C\"\nproof (cases C)\n  fix a b c d e f::word32\n  assume \"C = (a, b, c, d, e)\"\n  thus ?thesis by (cases a) simp\nqed\n\nlemma steps_to_steps':\n  \"round X (foldl a b c) = round X (from_chain (to_chain (foldl a b c)))\"\n  unfolding from_to_id ..\n\nlemma rounds'_step:\n  assumes \"0 <= i\"\n  shows \"rounds' c (i + 1) x = round' (rounds' c i x) (x i)\"\nproof -\n  have makesuc: \"nat (i + 1) = Suc (nat i)\" using assms by simp\n  show ?thesis using assms\n    by (simp add: makesuc rounds_def rmd_body_def steps_to_steps')\nqed\n\nlemma goal13'1:\n  assumes \"0 <= loop__1__i''\"\n  assumes H1: \n  \" chain___default_rcd''\n    (| h0'chain\n       := ca''\n    |)\n    (| h1'chain\n       := cb''\n    |)\n    (| h2'chain\n       := cc''\n    |)\n    (| h3'chain\n       := cd''\n    |)\n    (| h4'chain\n       := ce''\n    |)\n    = rounds'\n        ( chain___default_rcd''\n          (| h0'chain\n             := (1732584193 :: int)\n          |)\n          (| h1'chain\n             := (4023233417 :: int)\n          |)\n          (| h2'chain\n             := (2562383102 :: int)\n          |)\n          (| h3'chain\n             := (271733878 :: int)\n          |)\n          (| h4'chain\n             := (3285377520 :: int)\n          |)\n        )\n        ( loop__1__i'' + (1 :: int) )\n        x''\n  \"\n  assumes H18: \n  \" chain___default_rcd''\n    (| h0'chain\n       := ca__1''\n    |)\n    (| h1'chain\n       := cb__1''\n    |)\n    (| h2'chain\n       := cc__1''\n    |)\n    (| h3'chain\n       := cd__1''\n    |)\n    (| h4'chain\n       := ce__1''\n    |)\n    = round'\n        ( chain___default_rcd''\n          (| h0'chain\n             := ca''\n          |)\n          (| h1'chain\n             := cb''\n          |)\n          (| h2'chain\n             := cc''\n          |)\n          (| h3'chain\n             := cd''\n          |)\n          (| h4'chain\n             := ce''\n          |)\n        )\n        ( x'' ( loop__1__i'' + (1 :: int) )\n        )\n  \"\n  shows \" chain___default_rcd''\n          (| h0'chain\n             := ca__1''\n          |)\n          (| h1'chain\n             := cb__1''\n          |)\n          (| h2'chain\n             := cc__1''\n          |)\n          (| h3'chain\n             := cd__1''\n          |)\n          (| h4'chain\n             := ce__1''\n          |)\n          = rounds'\n              ( chain___default_rcd''\n                (| h0'chain\n                   := (1732584193 :: int)\n                |)\n                (| h1'chain\n                   := (4023233417 :: int)\n                |)\n                (| h2'chain\n                   := (2562383102 :: int)\n                |)\n                (| h3'chain\n                   := (271733878 :: int)\n                |)\n                (| h4'chain\n                   := (3285377520 :: int)\n                |)\n              )\n              ( loop__1__i'' + (2 :: int) )\n              x''\n        \"\nproof -\n  have loop_suc: \"loop__1__i'' + 2 = (loop__1__i'' + 1) + 1\" by simp\n  have \"0 <= loop__1__i'' + 1\" using `0 <= loop__1__i''` by simp\n  show ?thesis\n    unfolding loop_suc\n    unfolding rounds'_step[OF `0 <= loop__1__i'' + 1`]\n    unfolding H1[symmetric]\n    unfolding H18 ..\nqed\n\n\nlemma goal17'1:\n  assumes H1: \n  \" chain___default_rcd''\n    (| h0'chain\n       := ca''\n    |)\n    (| h1'chain\n       := cb''\n    |)\n    (| h2'chain\n       := cc''\n    |)\n    (| h3'chain\n       := cd''\n    |)\n    (| h4'chain\n       := ce''\n    |)\n    = rounds'\n        ( chain___default_rcd''\n          (| h0'chain\n             := (1732584193 :: int)\n          |)\n          (| h1'chain\n             := (4023233417 :: int)\n          |)\n          (| h2'chain\n             := (2562383102 :: int)\n          |)\n          (| h3'chain\n             := (271733878 :: int)\n          |)\n          (| h4'chain\n             := (3285377520 :: int)\n          |)\n        )\n        ( x__index__subtype__1__last'' + (1 :: int) )\n        x''\n  \"\n  shows \" chain___default_rcd''\n          (| h0'chain\n             := ca''\n          |)\n          (| h1'chain\n             := cb''\n          |)\n          (| h2'chain\n             := cc''\n          |)\n          (| h3'chain\n             := cd''\n          |)\n          (| h4'chain\n             := ce''\n          |)\n          = rmd_hash'\n              x''\n              ( x__index__subtype__1__last'' + (1 :: int) )\n        \"\nunfolding rmd_def H1 rounds_def ..\n\n\nlemmas userlemmas = goal12'1 goal13'1 goal17'1\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/RIPEMD-160-SPARK/Hash_User.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6926419704455589, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.31931957043134784}}
{"text": "theory Submission\n  imports Defs\nbegin\n\nabbreviation (input) change_rule :: \"vname \\<Rightarrow> bexp \\<Rightarrow> assn \\<Rightarrow> assn\" where\n\"change_rule x b P \\<equiv> \\<lambda>s. \\<exists>x'. (bval b (s[x'/x]) \\<and> P (s[x'/x]))\"\n\ninductive\n  hoare :: \"assn \\<Rightarrow> com \\<Rightarrow> assn \\<Rightarrow> bool\" (\"\\<turnstile> ({(1_)}/ (_)/ {(1_)})\" 50)\nwhere\nSkip: \"\\<turnstile> {P} SKIP {P}\"  |\n\nAssign:  \"\\<turnstile> {\\<lambda>s. P(s[a/x])} x::=a {P}\"  |\n\nSeq: \"\\<lbrakk> \\<turnstile> {P} c\\<^sub>1 {Q};  \\<turnstile> {Q} c\\<^sub>2 {R} \\<rbrakk>\n      \\<Longrightarrow> \\<turnstile> {P} c\\<^sub>1;;c\\<^sub>2 {R}\"  |\n\nIf: \"\\<lbrakk> \\<turnstile> {\\<lambda>s. P s \\<and> bval b s} c\\<^sub>1 {Q};  \\<turnstile> {\\<lambda>s. P s \\<and> \\<not> bval b s} c\\<^sub>2 {Q} \\<rbrakk>\n     \\<Longrightarrow> \\<turnstile> {P} IF b THEN c\\<^sub>1 ELSE c\\<^sub>2 {Q}\"  |\n\nWhile: \"\\<turnstile> {\\<lambda>s. P s \\<and> bval b s} c {P} \\<Longrightarrow>\n        \\<turnstile> {P} WHILE b DO c {\\<lambda>s. P s \\<and> \\<not> bval b s}\"  |\n\nSwap: \"\\<turnstile> {\\<lambda>s. P (s(x:=s y,y:=s x))} SWAP x y {P}\" |\n\nChange: \"\\<turnstile> {change_rule x b P} CHANGE x ST b {P}\" |\n\nconseq: \"\\<lbrakk> \\<forall>s. P' s \\<longrightarrow> P s;  \\<turnstile> {P} c {Q};  \\<forall>s. Q s \\<longrightarrow> Q' s \\<rbrakk>\n        \\<Longrightarrow> \\<turnstile> {P'} c {Q'}\"\n\n\n\n\n\n\nlemma sound: \"\\<Turnstile> {change_rule x b P} CHANGE x ST b {P}\" nitpick\n  sorry\n\nlemma complete: \"\\<Turnstile> {P} (CHANGE x ST b) {Q} \\<Longrightarrow> \\<turnstile> {P} CHANGE x ST b {Q}\"\n  sorry\n\nvalue \"(Not (Less (Plus (V ''y'') (V ''x'')) (N 0)))\"\nvalue \"(Not (Less (N 0) (Plus (V ''y'') (V ''x''))))\"\ndefinition MINUS :: com where\n \"MINUS = (\n  CHANGE ''y'' ST (And\n  (Not (Less (Plus (V ''y'') (V ''x'')) (N 0)))\n  (Not (Less (N 0) (Plus (V ''y'') (V ''x''))))\n)\n)\"\n\nlemma MINUS_correct:\n  \"\\<turnstile> {\\<lambda>s. s=s\\<^sub>0} MINUS {\\<lambda>s. s ''y'' = - s ''x'' \\<and> (\\<forall>v \\<noteq> ''y''. s v = s\\<^sub>0 v)}\"\n  unfolding MINUS_def\n  sorry\n\ndefinition invar :: \"vname \\<Rightarrow> bexp \\<Rightarrow> vname \\<Rightarrow> state \\<Rightarrow> assn\" where\n  \"invar x b y s\\<^sub>0 = undefined\"\n\nend", "meta": {"author": "MaximilianAnzinger", "repo": "semantics2223-exercises", "sha": "938719cbbe0aaf89e133cd7d47e52da6adca8fec", "save_path": "github-repos/isabelle/MaximilianAnzinger-semantics2223-exercises", "path": "github-repos/isabelle/MaximilianAnzinger-semantics2223-exercises/semantics2223-exercises-938719cbbe0aaf89e133cd7d47e52da6adca8fec/exam/03/Submission.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.31917934034371553}}
{"text": "(* \n   Title: Psi-calculi   \n   Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Tau_Stat_Imp\n  imports Tau_Sim Weaken_Stat_Imp\nbegin\n\nlocale weakTauLaws = weak + tau\nbegin\n\nlemma tauLaw1StatImpLeft:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<Rel> Q\"\n  and     \"(\\<Psi>, \\<tau>.(P), Q) \\<in> Rel\"\n \n  shows \"\\<Psi> \\<rhd> \\<tau>.(P) \\<lessapprox>\\<^sub>w<Rel> Q\"\nproof -\n  have \"\\<Psi> \\<rhd> Q \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> Q\" by simp\n  moreover have \"insertAssertion (extractFrame(\\<tau>.(P))) \\<Psi> \\<simeq>\\<^sub>F \\<langle>\\<epsilon>, \\<Psi>\\<rangle>\" by(rule insertTauAssertion)\n  hence \"insertAssertion (extractFrame(\\<tau>.(P))) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi>\"\n    by(metis FrameStatImpTrans FrameStatEq_def insertAssertionWeaken)\n  ultimately show ?thesis using `(\\<Psi>, \\<tau>.(P), Q) \\<in> Rel`\n    by(rule weakenStatImpI)\nqed\n\nlemma tauLaw1StatImpRight:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<lessapprox><Rel> Q\"\n  and     C1: \"\\<And>\\<Psi> P Q R. \\<lbrakk>(\\<Psi>, P, Q) \\<in> Rel; \\<Psi> \\<rhd> Q \\<sim> R\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, R) \\<in> Rel'\"\n\n  shows \"\\<Psi> \\<rhd> P \\<lessapprox><Rel'> \\<tau>.(Q)\"\nproof(induct rule: weakStatImpI)\n  case(cStatImp \\<Psi>')\n  from `\\<Psi> \\<rhd> P \\<lessapprox><Rel> Q` obtain Q' Q'' \n    where QChain: \"\\<Psi> \\<rhd> Q \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> Q'\" and PImpQ': \"insertAssertion (extractFrame P) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion (extractFrame Q') \\<Psi>\" \n      and Q'Chain: \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> Q' \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> Q''\" and PRelQ'': \"(\\<Psi> \\<otimes> \\<Psi>', P, Q'') \\<in> Rel\"\n    by(rule weakStatImpE)\n    \n  obtain Q''' where QTrans: \"\\<Psi> \\<rhd> \\<tau>.(Q) \\<longmapsto>\\<tau> \\<prec> Q'''\" and \"\\<Psi> \\<rhd> Q \\<sim> Q'''\" using tauActionI by auto\n  \n  from `\\<Psi> \\<rhd> Q \\<sim> Q'''` QChain bisimE(2) obtain Q'''' where Q'''Chain: \"\\<Psi> \\<rhd> Q''' \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> Q''''\" and \"\\<Psi> \\<rhd> Q' \\<sim> Q''''\"\n    by(metis bisimE(4) simTauChain)\n  \n  from QTrans Q'''Chain have \"\\<Psi> \\<rhd> \\<tau>.(Q) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> Q''''\" by(drule_tac tauActTauChain) auto\n  moreover from `\\<Psi> \\<rhd> Q' \\<sim> Q''''` have \"insertAssertion (extractFrame Q') \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion (extractFrame Q'''') \\<Psi>\"\n    by(metis bisimE FrameStatEq_def)\n  with PImpQ'  have \"insertAssertion (extractFrame P) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion (extractFrame Q'''') \\<Psi>\"\n    by(rule FrameStatImpTrans)\n  moreover from `\\<Psi> \\<rhd> Q' \\<sim> Q''''` have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> Q' \\<sim> Q''''\" by(rule bisimE) \n  then obtain Q''''' where Q''''Chain: \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> Q'''' \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> Q'''''\" and \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> Q'' \\<sim> Q'''''\" using Q'Chain bisimE(2) \n    by(metis bisimE(4) simTauChain)\n  note Q''''Chain\n  moreover from `(\\<Psi> \\<otimes> \\<Psi>', P, Q'') \\<in> Rel` `\\<Psi> \\<otimes> \\<Psi>' \\<rhd> Q'' \\<sim> Q'''''` have \"(\\<Psi> \\<otimes> \\<Psi>', P, Q''''') \\<in> Rel'\"\n    by(rule C1)\n  ultimately show ?case by blast\nqed\n\nend\n\ncontext tau begin\n\nlemma tauLaw3StatImpLeft:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   \\<alpha> :: \"'a prefix\"\n\n  assumes C1: \"\\<And>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', \\<alpha>\\<cdot>(\\<tau>.(P)), \\<alpha>\\<cdot>Q) \\<in> Rel\"\n\n  shows \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P)) \\<lessapprox><Rel> \\<alpha>\\<cdot>Q\"\nproof(induct rule: weakStatImpI)\n  case(cStatImp \\<Psi>')\n  have \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>Q \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> \\<alpha>\\<cdot>Q\" by auto\n  moreover have \"insertAssertion (extractFrame(\\<alpha>\\<cdot>(\\<tau>.(P)))) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion (extractFrame(\\<alpha>\\<cdot>Q)) \\<Psi>\" using insertTauAssertion\n    by(nominal_induct \\<alpha> rule: prefix.strong_inducts) (auto simp add: FrameStatEq_def intro: FrameStatImpTrans)\n  moreover have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> \\<alpha>\\<cdot>Q \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> \\<alpha>\\<cdot>Q\" by auto\n  moreover have \"(\\<Psi> \\<otimes> \\<Psi>', \\<alpha>\\<cdot>(\\<tau>.(P)), \\<alpha>\\<cdot>Q) \\<in> Rel\" by(rule C1)\n  ultimately show ?case by blast\nqed\n\nlemma tauLaw3StatImpRight:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes C1: \"\\<And>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', \\<alpha>\\<cdot>P, \\<alpha>\\<cdot>(\\<tau>.(Q))) \\<in> Rel\"\n\n  shows \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>P \\<lessapprox><Rel> \\<alpha>\\<cdot>(\\<tau>.(Q))\"\nproof(induct rule: weakStatImpI)\n  case(cStatImp \\<Psi>')\n  have \"\\<Psi> \\<rhd>  \\<alpha>\\<cdot>(\\<tau>.(Q)) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau>  \\<alpha>\\<cdot>(\\<tau>.(Q))\" by auto\n  moreover have \"insertAssertion (extractFrame(\\<alpha>\\<cdot>P)) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion (extractFrame(\\<alpha>\\<cdot>(\\<tau>.(Q)))) \\<Psi>\" using insertTauAssertion\n    by(nominal_induct \\<alpha> rule: prefix.strong_inducts) (auto simp add: FrameStatEq_def intro: FrameStatImpTrans)\n  moreover have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd>  \\<alpha>\\<cdot>(\\<tau>.(Q)) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau>  \\<alpha>\\<cdot>(\\<tau>.(Q))\" by auto\n  moreover have \"(\\<Psi> \\<otimes> \\<Psi>', \\<alpha>\\<cdot>P, \\<alpha>\\<cdot>(\\<tau>.(Q))) \\<in> Rel\" by(rule C1)\n  ultimately show ?case by blast\nqed\n\nend\n\ncontext tauSum begin\n\nlemma tauLaw2StatImpLeft:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes C1: \"\\<And>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P \\<oplus> \\<tau>.(P), \\<tau>.(P)) \\<in> Rel\" \n\n  shows \"\\<Psi> \\<rhd> P \\<oplus> \\<tau>.(P) \\<lessapprox><Rel> \\<tau>.(P)\"\nproof(induct rule: weakStatImpI)\n  case(cStatImp \\<Psi>')\n  have \"\\<Psi> \\<rhd> \\<tau>.(P) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> \\<tau>.(P)\" by auto\n  moreover have \"insertAssertion (extractFrame(\\<tau>.(P))) \\<Psi> \\<simeq>\\<^sub>F \\<langle>\\<epsilon>, \\<Psi>\\<rangle>\" by(rule insertTauAssertion)\n  hence \"insertAssertion (extractFrame(P \\<oplus> \\<tau>.(P))) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion (extractFrame(\\<tau>.(P))) \\<Psi>\" using Identity\n    by(rule_tac FrameStatImpTrans) (auto simp add: FrameStatEq_def AssertionStatEq_def)\n  moreover have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> \\<tau>.(P) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> \\<tau>.(P)\" by auto\n  moreover have \"(\\<Psi> \\<otimes> \\<Psi>', P \\<oplus> \\<tau>.(P), \\<tau>.(P)) \\<in> Rel\" by(rule C1)\n  ultimately show ?case by blast\nqed  \n\nlemma tauLaw2StatImpRight:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes C1: \"\\<And>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', \\<tau>.(P), P \\<oplus> \\<tau>.(P)) \\<in> Rel\"\n\n  shows \"\\<Psi> \\<rhd> \\<tau>.(P) \\<lessapprox><Rel> P \\<oplus> \\<tau>.(P)\"\nproof(induct rule: weakStatImpI)\n  case(cStatImp \\<Psi>')\n  have \"\\<Psi> \\<rhd> P \\<oplus> \\<tau>.(P) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> P \\<oplus> \\<tau>.(P)\" by auto\n  moreover have \"insertAssertion (extractFrame(\\<tau>.(P))) \\<Psi> \\<simeq>\\<^sub>F \\<langle>\\<epsilon>, \\<Psi>\\<rangle>\" by(rule insertTauAssertion)\n  hence \"insertAssertion (extractFrame(\\<tau>.(P))) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion (extractFrame(P \\<oplus> \\<tau>.(P))) \\<Psi>\" using Identity\n    by(rule_tac FrameStatImpTrans) (auto simp add: FrameStatEq_def AssertionStatEq_def)\n  moreover have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P \\<oplus> \\<tau>.(P) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> P \\<oplus> \\<tau>.(P)\" by auto\n  moreover have \"(\\<Psi> \\<otimes> \\<Psi>', \\<tau>.(P), P \\<oplus> \\<tau>.(P)) \\<in> Rel\" by(rule C1)\n  ultimately show ?case by blast\nqed\n\nlemma tauLaw4StatImpLeft:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   M :: 'a\n  and   N :: 'a\n\n  assumes C1: \"\\<And>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', \\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q), \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q)) \\<in> Rel\"\n\n  shows \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q) \\<lessapprox><Rel> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q)\"\nproof(induct rule: weakStatImpI)\n  case(cStatImp \\<Psi>')\n  have \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q)\" by auto\n  hence \"insertAssertion (extractFrame(\\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q))) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion (extractFrame(\\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q))) \\<Psi>\" \n    using insertTauAssertion Identity\n    by(nominal_induct \\<alpha> rule: prefix.strong_inducts, auto) \n  (rule FrameStatImpTrans[where G=\"\\<langle>\\<epsilon>, \\<Psi>\\<rangle>\"], auto simp add: FrameStatEq_def AssertionStatEq_def)\n  moreover have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q)\" by auto\n  moreover have \"(\\<Psi> \\<otimes> \\<Psi>', \\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q), \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q)) \\<in> Rel\" by(rule C1)\n  ultimately show ?case by blast\nqed\n\nlemma tauLaw4StatImpRight:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   \\<alpha> :: \"'a prefix\"\n\n  assumes C1: \"\\<And>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q), \\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q)) \\<in> Rel\"\n\n  shows \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q) \\<lessapprox><Rel> \\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q)\"\nproof(induct rule: weakStatImpI)\n  case(cStatImp \\<Psi>')\n  have \"\\<Psi> \\<rhd> \\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> \\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q)\" by auto\n  hence \"insertAssertion (extractFrame(\\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q))) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion (extractFrame(\\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q))) \\<Psi>\"\n    using insertTauAssertion Identity\n    by(nominal_induct \\<alpha> rule: prefix.strong_inducts, auto) \n  (rule FrameStatImpTrans[where G=\"\\<langle>\\<epsilon>, \\<Psi>\\<rangle>\"], auto simp add: FrameStatEq_def AssertionStatEq_def)\n  moreover have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> \\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q) \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> \\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q)\" by auto\n  moreover have \"(\\<Psi> \\<otimes> \\<Psi>', \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q), \\<alpha>\\<cdot>P \\<oplus> \\<alpha>\\<cdot>(\\<tau>.(P) \\<oplus> Q)) \\<in> Rel\" by(rule C1)\n  ultimately show ?case by blast\nqed\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Psi_Calculi/Tau_Stat_Imp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.63341026367784, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3191793403437155}}
{"text": "(*  Title:      Uint16.thy\n    Author:     Andreas Lochbihler, ETH Zurich\n*)\n\nheader {* Unsigned words of 16 bits *}\n\ntheory Uint16 imports\n  Word_Misc\n  Bits_Integer\nbegin\n\ntext {*\n  Restriction for ML code generation:\n  This theory assumes that the ML system provides a Word16\n  implementation (mlton does, but PolyML 5.5 does not).\n  Therefore, the code setup lives in the target @{text SML_word}\n  rather than @{text SML}.  This ensures that code generation still\n  works as long as @{text \"uint16\"} is not involved.\n  For the target @{text SML} itself, no special code generation \n  for this type is set up. Nevertheless, it should work by emulation via @{typ \"16 word\"} \n  if the theory @{text Code_Target_Bits_Int} is imported.\n\n  Restriction for OCaml code generation:\n  OCaml does not provide an int16 type, so no special code generation \n  for this type is set up.\n*}\n\ndeclare prod.Quotient[transfer_rule]\n\nsection {* Type definition and primitive operations *}\n\ntypedef uint16 = \"UNIV :: 16 word set\" ..\n\nsetup_lifting type_definition_uint16\n\ntext {* Use an abstract type for code generation to disable pattern matching on @{term Abs_uint16}. *}\ndeclare Rep_uint16_inverse[code abstype]\n\ndeclare Quotient_uint16[transfer_rule]\n\ninstantiation uint16 :: \"{neg_numeral, Divides.div, comm_monoid_mult, comm_ring}\" begin\nlift_definition zero_uint16 :: uint16 is \"0\" .\nlift_definition one_uint16 :: uint16 is \"1\" .\nlift_definition plus_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op +\" .\nlift_definition minus_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op -\" .\nlift_definition uminus_uint16 :: \"uint16 \\<Rightarrow> uint16\" is uminus .\nlift_definition times_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op *\" .\nlift_definition div_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op div\" .\nlift_definition mod_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is \"op mod\" .\ninstance by default (transfer, simp add: algebra_simps)+\nend\n\ninstantiation uint16 :: linorder begin\nlift_definition less_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"op <\" .\nlift_definition less_eq_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"op \\<le>\" .\ninstance by(default)(transfer, simp add: less_le_not_le linear)+\nend\n\nlemmas [code] = less_uint16.rep_eq less_eq_uint16.rep_eq\n\ninstantiation uint16 :: bitss begin\nlift_definition bitNOT_uint16 :: \"uint16 \\<Rightarrow> uint16\" is bitNOT .\nlift_definition bitAND_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitAND .\nlift_definition bitOR_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitOR .\nlift_definition bitXOR_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" is bitXOR .\nlift_definition test_bit_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> bool\" is test_bit .\nlift_definition set_bit_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> bool \\<Rightarrow> uint16\" is set_bit .\nlift_definition set_bits_uint16 :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> uint16\" is \"set_bits\" .\nlift_definition lsb_uint16 :: \"uint16 \\<Rightarrow> bool\" is lsb .\nlift_definition shiftl_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is shiftl .\nlift_definition shiftr_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is shiftr .\nlift_definition msb_uint16 :: \"uint16 \\<Rightarrow> bool\" is msb .\ninstance ..\nend\n\nlemmas [code] = test_bit_uint16.rep_eq lsb_uint16.rep_eq msb_uint16.rep_eq\n\ninstantiation uint16 :: equal begin\nlift_definition equal_uint16 :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> bool\" is \"equal_class.equal\" .\ninstance by default(transfer, simp add: equal_eq)\nend\n\nlemmas [code] = equal_uint16.rep_eq\n\ninstantiation uint16 :: size begin\nlift_definition size_uint16 :: \"uint16 \\<Rightarrow> nat\" is \"size\" .\ninstance ..\nend\n\nlemmas [code] = size_uint16.rep_eq\n\nlift_definition sshiftr_uint16 :: \"uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" (infixl \">>>\" 55) is sshiftr .\n\nlift_definition uint16_of_int :: \"int \\<Rightarrow> uint16\" is \"word_of_int\" .\n\ndefinition uint16_of_nat :: \"nat \\<Rightarrow> uint16\"\nwhere \"uint16_of_nat = uint16_of_int \\<circ> int\"\n\nlift_definition int_of_uint16 :: \"uint16 \\<Rightarrow> int\" is \"uint\" .\nlift_definition nat_of_uint16 :: \"uint16 \\<Rightarrow> nat\" is \"unat\" .\n\ndefinition integer_of_uint16 :: \"uint16 \\<Rightarrow> integer\"\nwhere \"integer_of_uint16 = integer_of_int o int_of_uint16\"\n\ntext {* Use pretty numerals from integer for pretty printing *}\n\ncontext includes integer.lifting begin\n\nlift_definition Uint16 :: \"integer \\<Rightarrow> uint16\" is \"word_of_int\" .\n\nlemma Rep_uint16_numeral [simp]: \"Rep_uint16 (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint16_def Abs_uint16_inverse numeral.simps plus_uint16_def)\n\nlemma Rep_uint16_neg_numeral [simp]: \"Rep_uint16 (- numeral n) = - numeral n\"\nby(simp only: uminus_uint16_def)(simp add: Abs_uint16_inverse)\n\nlemma numeral_uint16_transfer [transfer_rule]:\n  \"(rel_fun op = cr_uint16) numeral numeral\"\nby(auto simp add: cr_uint16_def)\n\nlemma numeral_uint16 [code_unfold]: \"numeral n = Uint16 (numeral n)\"\nby transfer simp\n\nlemma neg_numeral_uint16 [code_unfold]: \"- numeral n = Uint16 (- numeral n)\"\nby transfer(simp add: cr_uint16_def)\n\nend\n\nlemma Abs_uint16_numeral [code_post]: \"Abs_uint16 (numeral n) = numeral n\"\nby(induction n)(simp_all add: one_uint16_def numeral.simps plus_uint16_def Abs_uint16_inverse)\n\nlemma Abs_uint16_0 [code_post]: \"Abs_uint16 0 = 0\"\nby(simp add: zero_uint16_def)\n\nlemma Abs_uint16_1 [code_post]: \"Abs_uint16 1 = 1\"\nby(simp add: one_uint16_def)\n\nsection {* Code setup *}\n\ncode_printing code_module Uint16 \\<rightharpoonup> (SML_word)\n{*(* Test that words can handle numbers between 0 and 15 *)\nval _ = if 4 <= Word.wordSize then () else raise (Fail (\"wordSize less than 4\"));\n\nstructure Uint16 : sig\n  val set_bit : Word16.word -> IntInf.int -> bool -> Word16.word\n  val shiftl : Word16.word -> IntInf.int -> Word16.word\n  val shiftr : Word16.word -> IntInf.int -> Word16.word\n  val shiftr_signed : Word16.word -> IntInf.int -> Word16.word\n  val test_bit : Word16.word -> IntInf.int -> bool\nend = struct\n\nfun set_bit x n b =\n  let val mask = Word16.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))\n  in if b then Word16.orb (x, mask)\n     else Word16.andb (x, Word16.notb mask)\n  end\n\nfun shiftl x n =\n  Word16.<< (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr x n =\n  Word16.>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun shiftr_signed x n =\n  Word16.~>> (x, Word.fromLargeInt (IntInf.toLarge n))\n\nfun test_bit x n =\n  Word16.andb (x, Word16.<< (0wx1, Word.fromLargeInt (IntInf.toLarge n))) <> Word16.fromInt 0\n\nend; (* struct Uint16 *)*}\ncode_reserved SML_word Uint16\n\ncode_printing code_module Uint16 \\<rightharpoonup> (Haskell)\n{*import qualified Data.Word;\nimport qualified Data.Int;\n\ntype Int16 = Data.Int.Int16;\n\ntype Word16 = Data.Word.Word16;*}\ncode_reserved Haskell Uint16\n\ntext {* Scala provides unsigned 16-bit numbers as Char. *}\n\ncode_printing code_module Uint16 \\<rightharpoonup> (Scala)\n{*object Uint16 {\n\ndef set_bit(x: scala.Char, n: BigInt, b: Boolean) : scala.Char =\n  if (b)\n    (x | (1.toChar << n.intValue)).toChar\n  else\n    (x & (1.toChar << n.intValue).unary_~).toChar\n\ndef shiftl(x: scala.Char, n: BigInt) : scala.Char = (x << n.intValue).toChar\n\ndef shiftr(x: scala.Char, n: BigInt) : scala.Char = (x >>> n.intValue).toChar\n\ndef shiftr_signed(x: scala.Char, n: BigInt) : scala.Char = (x.toShort >> n.intValue).toChar\n\ndef test_bit(x: scala.Char, n: BigInt) : Boolean = (x & (1.toChar << n.intValue)) != 0\n\n} /* object Uint16 */*}\ncode_reserved Scala Uint16\n\ntext {* \n  Avoid @{term Abs_uint16} in generated code, use @{term Rep_uint16'} instead. \n  The symbolic implementations for code\\_simp use @{term Rep_uint16}.\n\n  The new destructor @{term Rep_uint16'} is executable.\n  As the simplifier is given the [code abstract] equations literally, \n  we cannot implement @{term Rep_uint16} directly, because that makes code\\_simp loop.\n\n  If code generation raises Match, some equation probably contains @{term Rep_uint16} \n  ([code abstract] equations for @{typ uint16} may use @{term Rep_uint16} because\n  these instances will be folded away.)\n\n  To convert @{typ \"16 word\"} values into @{typ uint16}, use @{term \"Abs_uint16'\"}.\n*}\n\ndefinition Rep_uint16' where [simp]: \"Rep_uint16' = Rep_uint16\"\n\nlemma Rep_uint16'_transfer [transfer_rule]:\n  \"rel_fun cr_uint16 op = (\\<lambda>x. x) Rep_uint16'\"\nunfolding Rep_uint16'_def by(rule uint16.rep_transfer)\n\n\n\nlift_definition Abs_uint16' :: \"16 word \\<Rightarrow> uint16\" is \"\\<lambda>x :: 16 word. x\" .\n\nlemma Abs_uint16'_code [code]:\n  \"Abs_uint16' x = Uint16 (integer_of_int (uint x))\"\nincluding integer.lifting by transfer simp\n\nlemma [code, code del]: \"term_of_class.term_of = (term_of_class.term_of :: uint16 \\<Rightarrow> _)\" ..\n\nlemma term_of_uint16_code [code]:\n  defines \"TR \\<equiv> typerep.Typerep\" and \"bit0 \\<equiv> STR ''Numeral_Type.bit0''\" shows\n  \"term_of_class.term_of x = \n   Code_Evaluation.App (Code_Evaluation.Const (STR ''Uint16.Abs_uint16'') (TR (STR ''fun'') [TR (STR ''Word.word'') [TR bit0 [TR bit0 [TR bit0 [TR bit0 [TR (STR ''Numeral_Type.num1'') []]]]]], TR (STR ''Uint16.uint16'') []]))\n       (term_of_class.term_of (Rep_uint16' x))\"\nby(simp add: term_of_anything)\n\nlemma Uin16_code [code abstract]: \"Rep_uint16 (Uint16 i) = word_of_int (int_of_integer_symbolic i)\"\nunfolding Uint16_def int_of_integer_symbolic_def by(simp add: Abs_uint16_inverse)\n\ncode_printing\n  type_constructor uint16 \\<rightharpoonup>\n  (SML_word) \"Word16.word\" and\n  (Haskell) \"Uint16.Word16\" and\n  (Scala) \"scala.Char\"\n| constant Uint16 \\<rightharpoonup>\n  (SML_word) \"Word16.fromLargeInt (IntInf.toLarge _)\" and\n  (Haskell) \"(Prelude.fromInteger _ :: Uint16.Word16)\" and\n  (Haskell_Quickcheck) \"(Prelude.fromInteger (Prelude.toInteger _) :: Uint16.Word16)\" and\n  (Scala) \"_.charValue\"\n| constant \"0 :: uint16\" \\<rightharpoonup>\n  (SML_word) \"(Word16.fromInt 0)\" and\n  (Haskell) \"(0 :: Uint16.Word16)\" and\n  (Scala) \"0\"\n| constant \"1 :: uint16\" \\<rightharpoonup>\n  (SML_word) \"(Word16.fromInt 1)\" and\n  (Haskell) \"(1 :: Uint16.Word16)\" and\n  (Scala) \"1\"\n| constant \"plus :: uint16 \\<Rightarrow> _ \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.+ ((_), (_))\" and\n  (Haskell) infixl 6 \"+\" and\n  (Scala) \"(_ +/ _).toChar\"\n| constant \"uminus :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.~\" and\n  (Haskell) \"negate\" and\n  (Scala) \"(- _).toChar\"\n| constant \"minus :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.- ((_), (_))\" and\n  (Haskell) infixl 6 \"-\" and\n  (Scala) \"(_ -/ _).toChar\"\n| constant \"times :: uint16 \\<Rightarrow> _ \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.* ((_), (_))\" and\n  (Haskell) infixl 7 \"*\" and\n  (Scala) \"(_ */ _).toChar\"\n| constant \"HOL.equal :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"!((_ : Word16.word) = _)\" and\n  (Haskell) infix 4 \"==\" and\n  (Scala) infixl 5 \"==\"\n| class_instance uint16 :: equal \\<rightharpoonup> (Haskell) -\n| constant \"less_eq :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"Word16.<= ((_), (_))\" and\n  (Haskell) infix 4 \"<=\" and\n  (Scala) infixl 4 \"<=\"\n| constant \"less :: uint16 \\<Rightarrow> _ \\<Rightarrow> bool\" \\<rightharpoonup>\n  (SML_word) \"Word16.< ((_), (_))\" and\n  (Haskell) infix 4 \"<\" and\n  (Scala) infixl 4 \"<\"\n| constant \"bitNOT :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.notb\" and\n  (Haskell) \"Data'_Bits.complement\" and\n  (Scala) \"_.unary'_~.toChar\"\n| constant \"bitAND :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.andb ((_),/ (_))\" and\n  (Haskell) infixl 7 \"Data_Bits..&.\" and\n  (Scala) \"(_ & _).toChar\"\n| constant \"bitOR :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.orb ((_),/ (_))\" and\n  (Haskell) infixl 5 \"Data_Bits..|.\" and\n  (Scala) \"(_ | _).toChar\"\n| constant \"bitXOR :: uint16 \\<Rightarrow> _\" \\<rightharpoonup>\n  (SML_word) \"Word16.xorb ((_),/ (_))\" and\n  (Haskell) \"Data'_Bits.xor\" and\n  (Scala) \"(_ ^ _).toChar\"\n\ndefinition uint16_div :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" \nwhere \"uint16_div x y = (if y = 0 then undefined (op div :: uint16 \\<Rightarrow> _) x (0 :: uint16) else x div y)\"\n\ndefinition uint16_mod :: \"uint16 \\<Rightarrow> uint16 \\<Rightarrow> uint16\" \nwhere \"uint16_mod x y = (if y = 0 then undefined (op mod :: uint16 \\<Rightarrow> _) x (0 :: uint16) else x mod y)\"\n\ncontext includes undefined_transfer begin\n\nlemma div_uint16_code [code]: \"x div y = (if y = 0 then 0 else uint16_div x y)\"\nunfolding uint16_div_def by transfer(simp add: word_div_def)\n\nlemma mod_uint16_code [code]: \"x mod y = (if y = 0 then x else uint16_mod x y)\"\nunfolding uint16_mod_def by transfer(simp add: word_mod_def)\n\nlemma uint16_div_code [code abstract]:\n  \"Rep_uint16 (uint16_div x y) =\n  (if y = 0 then Rep_uint16 (undefined (op div :: uint16 \\<Rightarrow> _) x (0 :: uint16)) else Rep_uint16 x div Rep_uint16 y)\"\nunfolding uint16_div_def by transfer simp\n\nlemma uint16_mod_code [code abstract]:\n  \"Rep_uint16 (uint16_mod x y) =\n  (if y = 0 then Rep_uint16 (undefined (op mod :: uint16 \\<Rightarrow> _) x (0 :: uint16)) else Rep_uint16 x mod Rep_uint16 y)\"\nunfolding uint16_mod_def by transfer simp\n\nend\n\ncode_printing constant uint16_div \\<rightharpoonup>\n  (SML_word) \"Word16.div ((_), (_))\" and\n  (Haskell) \"Prelude.div\" and\n  (Scala) \"(_ '/ _).toChar\"\n| constant uint16_mod \\<rightharpoonup>\n  (SML_word) \"Word16.mod ((_), (_))\" and\n  (Haskell) \"Prelude.mod\" and\n  (Scala) \"(_ % _).toChar\"\n\ndefinition uint16_test_bit :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> bool\"\nwhere [code del]:\n  \"uint16_test_bit x n =\n  (if n < 0 \\<or> 15 < n then undefined (test_bit :: uint16 \\<Rightarrow> _) x n\n   else x !! (nat_of_integer n))\"\n\nlemma test_bit_uint16_code [code]:\n  \"test_bit x n \\<longleftrightarrow> n < 16 \\<and> uint16_test_bit x (integer_of_nat n)\"\nunfolding uint16_test_bit_def including undefined_transfer integer.lifting \nby transfer(auto cong: conj_cong dest: test_bit_size simp add: word_size)\n\nlemma uint16_test_bit_code [code]:\n  \"uint16_test_bit w n =\n  (if n < 0 \\<or> 15 < n then undefined (test_bit :: uint16 \\<Rightarrow> _) w n else Rep_uint16 w !! nat_of_integer n)\"\nunfolding uint16_test_bit_def by(simp add: test_bit_uint16.rep_eq)\n\ncode_printing constant uint16_test_bit \\<rightharpoonup>\n  (SML_word) \"Uint16.test'_bit\" and\n  (Haskell) \"Data'_Bits.testBitBounded\" and\n  (Scala) \"Uint16.test'_bit\"\n\ndefinition uint16_set_bit :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> bool \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_set_bit x n b =\n  (if n < 0 \\<or> 15 < n then undefined (set_bit :: uint16 \\<Rightarrow> _) x n b\n   else set_bit x (nat_of_integer n) b)\"\n\nlemma set_bit_uint16_code [code]:\n  \"set_bit x n b = (if n < 16 then uint16_set_bit x (integer_of_nat n) b else x)\"\nincluding undefined_transfer integer.lifting unfolding uint16_set_bit_def\nby(transfer)(auto cong: conj_cong simp add: not_less set_bit_beyond word_size)\n\nlemma uint16_set_bit_code [code abstract]:\n  \"Rep_uint16 (uint16_set_bit w n b) = \n  (if n < 0 \\<or> 15 < n then Rep_uint16 (undefined (set_bit :: uint16 \\<Rightarrow> _) w n b)\n   else set_bit (Rep_uint16 w) (nat_of_integer n) b)\"\nincluding undefined_transfer unfolding uint16_set_bit_def by transfer simp\n\ncode_printing constant uint16_set_bit \\<rightharpoonup>\n  (SML_word) \"Uint16.set'_bit\" and\n  (Haskell) \"Data'_Bits.setBitBounded\" and\n  (Scala) \"Uint16.set'_bit\"\n\nlift_definition uint16_set_bits :: \"(nat \\<Rightarrow> bool) \\<Rightarrow> uint16 \\<Rightarrow> nat \\<Rightarrow> uint16\" is set_bits_aux .\n\nlemma uint16_set_bits_code [code]:\n  \"uint16_set_bits f w n =\n  (if n = 0 then w \n   else let n' = n - 1 in uint16_set_bits f ((w << 1) OR (if f n' then 1 else 0)) n')\"\nby(transfer fixing: n)(cases n, simp_all)\n\nlemma set_bits_uint16 [code]:\n  \"(BITS n. f n) = uint16_set_bits f 0 16\"\nby transfer(simp add: set_bits_conv_set_bits_aux)\n\n\nlemma lsb_code [code]: fixes x :: uint16 shows \"lsb x = x !! 0\"\nby transfer(simp add: word_lsb_def word_test_bit_def)\n\n\ndefinition uint16_shiftl :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_shiftl x n = (if n < 0 \\<or> 16 \\<le> n then undefined (shiftl :: uint16 \\<Rightarrow> _) x n else x << (nat_of_integer n))\"\n\nlemma shiftl_uint16_code [code]: \"x << n = (if n < 16 then uint16_shiftl x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_shiftl_def\nby transfer(simp add: not_less shiftl_zero_size word_size)\n\nlemma uint16_shiftl_code [code abstract]:\n  \"Rep_uint16 (uint16_shiftl w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined (shiftl :: uint16 \\<Rightarrow> _) w n)\n   else Rep_uint16 w << nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_shiftl_def by transfer simp\n\ncode_printing constant uint16_shiftl \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftl\" and\n  (Haskell) \"Data'_Bits.shiftlBounded\" and\n  (Scala) \"Uint16.shiftl\"\n\ndefinition uint16_shiftr :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_shiftr x n = (if n < 0 \\<or> 16 \\<le> n then undefined (shiftr :: uint16 \\<Rightarrow> _) x n else x >> (nat_of_integer n))\"\n\nlemma shiftr_uint16_code [code]: \"x >> n = (if n < 16 then uint16_shiftr x (integer_of_nat n) else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_shiftr_def\nby transfer(simp add: not_less shiftr_zero_size word_size)\n\nlemma uint16_shiftr_code [code abstract]:\n  \"Rep_uint16 (uint16_shiftr w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined (shiftr :: uint16 \\<Rightarrow> _) w n)\n   else Rep_uint16 w >> nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_shiftr_def by transfer simp\n\ncode_printing constant uint16_shiftr \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftr\" and\n  (Haskell) \"Data'_Bits.shiftrBounded\" and\n  (Scala) \"Uint16.shiftr\"\n\ndefinition uint16_sshiftr :: \"uint16 \\<Rightarrow> integer \\<Rightarrow> uint16\"\nwhere [code del]:\n  \"uint16_sshiftr x n =\n  (if n < 0 \\<or> 16 \\<le> n then undefined sshiftr_uint16 x n else sshiftr_uint16 x (nat_of_integer n))\"\n\nlemma sshiftr_beyond: fixes x :: \"'a :: len word\" shows\n  \"size x \\<le> n \\<Longrightarrow> x >>> n = (if x !! (size x - 1) then -1 else 0)\"\nby(rule word_eqI)(simp add: nth_sshiftr word_size)\n\nlemma sshiftr_uint16_code [code]:\n  \"x >>> n = \n  (if n < 16 then uint16_sshiftr x (integer_of_nat n) else if x !! 15 then -1 else 0)\"\nincluding undefined_transfer integer.lifting unfolding uint16_sshiftr_def\nby transfer (simp add: not_less sshiftr_beyond word_size)\n\nlemma uint16_sshiftr_code [code abstract]:\n  \"Rep_uint16 (uint16_sshiftr w n) =\n  (if n < 0 \\<or> 16 \\<le> n then Rep_uint16 (undefined sshiftr_uint16 w n)\n   else Rep_uint16 w >>> nat_of_integer n)\"\nincluding undefined_transfer unfolding uint16_sshiftr_def by transfer simp\n\ncode_printing constant uint16_sshiftr \\<rightharpoonup>\n  (SML_word) \"Uint16.shiftr'_signed\" and\n  (Haskell) \n    \"(Prelude.fromInteger (Prelude.toInteger (Data'_Bits.shiftrBounded (Prelude.fromInteger (Prelude.toInteger _) :: Uint16.Int16) _)) :: Uint16.Word16)\" and\n  (Scala) \"Uint16.shiftr'_signed\"\n\nlemma uint16_msb_test_bit: \"msb x \\<longleftrightarrow> (x :: uint16) !! 15\"\nby transfer(simp add: msb_nth)\n\nlemma msb_uint16_code [code]: \"msb x \\<longleftrightarrow> uint16_test_bit x 15\"\nby(simp add: uint16_test_bit_def uint16_msb_test_bit)\n\nlemma uint16_of_int_code [code]: \"uint16_of_int i = Uint16 (integer_of_int i)\"\nincluding integer.lifting by transfer simp\n\nlemma int_of_uint16_code [code]:\n  \"int_of_uint16 x = int_of_integer (integer_of_uint16 x)\"\nby(simp add: integer_of_uint16_def)\n\nlemma nat_of_uint16_code [code]:\n  \"nat_of_uint16 x = nat_of_integer (integer_of_uint16 x)\"\nunfolding integer_of_uint16_def including integer.lifting by transfer (simp add: unat_def)\n\nlemma integer_of_uint16_code [code]:\n  \"integer_of_uint16 n = integer_of_int (uint (Rep_uint16' n))\"\nunfolding integer_of_uint16_def by transfer auto\n\ncode_printing\n  constant \"integer_of_uint16\" \\<rightharpoonup>\n  (SML_word) \"Word16.toInt _ : IntInf.int\" and\n  (Haskell) \"Prelude.toInteger\" and\n  (Scala) \"BigInt\"\n\nsection {* Quickcheck setup *}\n\ndefinition uint16_of_natural :: \"natural \\<Rightarrow> uint16\"\nwhere \"uint16_of_natural x \\<equiv> Uint16 (integer_of_natural x)\"\n\ninstantiation uint16 :: \"{random, exhaustive, full_exhaustive}\" begin\ndefinition \"random_uint16 \\<equiv> qc_random_cnv uint16_of_natural\"\ndefinition \"exhaustive_uint16 \\<equiv> qc_exhaustive_cnv uint16_of_natural\"\ndefinition \"full_exhaustive_uint16 \\<equiv> qc_full_exhaustive_cnv uint16_of_natural\"\ninstance ..\nend\n\ninstantiation uint16 :: narrowing begin\n\ninterpretation quickcheck_narrowing_samples\n  \"\\<lambda>i. let x = Uint16 i in (x, 0xFFFF - x)\" \"0\"\n  \"Typerep.Typerep (STR ''Uint16.uint16'') []\" .\n\ndefinition \"narrowing_uint16 d = qc_narrowing_drawn_from (narrowing_samples d) d\"\ndeclare [[code drop: \"partial_term_of :: uint16 itself \\<Rightarrow> _\"]]\nlemmas partial_term_of_uint16 [code] = partial_term_of_code\n\ninstance ..\nend\n\nno_notation sshiftr_uint16 (infixl \">>>\" 55)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Native_Word/Uint16.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3191504470240181}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\n(*\n   Test proofs for corres methods. Builds on AInvs image.\n*)\n\ntheory Corres_Test\nimports \"Refine.VSpace_R\" \"Lib.Corres_Method\"\nbegin\n\nchapter \\<open>The Corres Method\\<close>\n\nsection \\<open>Introduction\\<close>\n\ntext \\<open>The @{method corres} method tries to do for corres-style refinement proofs what\n@{method wp} did for hoare logic proofs. The intention is to automate the application\nof corres calculational rules, so that the bulk of the manual proof is now handling\na verification condition. In general refinement proofs are difficult to automate, so here we\nexploit the fact that in l4v the abstract and executable specifications tend to be structurally\nsimilar. Corres proofs are based on the @{const corres_underlying} constant, which takes a number\nof parameters that allow it to be specialized for different flavours of refinement.\n\nA corres statement has the following form: @{term \"corres_underlying sr nf nf' r P P' f f'\"}, where\n@{term sr} is a state-relation, @{term nf} and @{term nf'} refer to whether or not the left and\nright hand functions may fail, @{term r} is a return value relation between the functions, @{term P}\nand @{term P'} are preconditions for the functions @{term f} and @{term f'} respectively. Informally\nthe statement says that: under the given preconditions, for every execution of @{term f'} there exists\nan execution of @{term f} that is related by the given state relation @{term sr} and return-value\nrelation @{term r}.\n\nIf the left and right side of a corres statement share similar structure, we can \"unzip\" the function\ninto one corres obligation for each atomic function. This is done through the application of\n  @{thm corres_split}.\n\\<close>\n\nthm corres_split[no_vars]\n\ntext \\<open>Briefly this states that: given a corres goal proving refinement between @{term \"a >>= b\"} and\n  @{term \"c >>= d\"}, we can decompose this into a proof showing refinement between @{term a} and\n@{term c}, and between @{term a} and @{term c}. Additionally @{term a} and @{term c} must establish\nappropriate postconditions to satisfy the obligations of proving refinement between @{term b} and @{term d}.\n\nThe first subgoal that is produced has an important characteristic: the preconditions for each\nside may only discuss the return value of its respective side. This means that rules such as\n@{term \"corres_underlying sr nf nf' r (\\<lambda>s. x = x') (\\<lambda>_. True) (f x) (f' x')\"} will not apply to a goal\n if @{term x} and @{term x'} are variables generated by applying @{thm corres_split} (i.e. the\nreturn values of functions).\n\nThis means that any such conditions must instead be phrased as an assumption to the rule, and our rule must be\nrephrased as follows:\n  @{term \"x = x' \\<Longrightarrow> corres_underlying sr nf nf' r (\\<lambda>_. True) (\\<lambda>_. True) (f x) (f' x')\"}.\nThe result is that we must solve @{term \"x = x'\"} immediately after applying our rule. While this\nis not a major concern for a manual proof, it proves to be a significant obstacle if we're trying\nto focus on automating the \"corres\" part of the refinement.\n\\<close>\n\nsection \\<open>corres_underlyingK and corres_rv\\<close>\n\ntext \\<open>To remedy this situation, we augment the @{const corres_underlying} definition to include\nyet another flag: a single boolean. This new constant: @{const corres_underlyingK},\nwill form the basis of the calculus for our corres method.\\<close>\n\nthm corres_underlyingK_def[no_vars]\n\ntext \\<open>The boolean in @{const corres_underlyingK} can be thought of as a stateless precondition. It\nis used to propagate additional proof obligations for rules that either do not need to discuss\neither the left or right hand state, or must discuss bound variables from both sides.\\<close>\n\nthm corresK_split[no_vars]\n\ntext \\<open>In this split rule for @{const corres_underlyingK} we see that the additional precondition @{term F'}\nmay discuss both @{term rv} and @{term rv'}. To show that this condition is satisified, however,\nwe can't use hoare logic and instead need a new definition: @{const corres_rv}.\\<close>\n\nthm corres_rv_def_I_know_what_I'm_doing[no_vars]\n\ntext \\<open>This is a weaker form of @{const corres_underlying} that is only interested in the return value\nof the functions. In essence, it states the given functions will establish @{term Q} after executing,\nassuming the given return-value relation @{term r} holds, along with the given stateless precondition\n@{term F} and left/right preconditions @{term P} and @{term P'}.\n\nThe assumption in general is that corres_rv rules should never be written, instead corres_rv obligations\nshould be propagated into either the stateless precondition (@{term F} from @{term corres_underlyingK}),\nthe left precondition (@{term P}) or the right precondition @{term P'}. This is implicitly handled\nby @{method corres_rv} (called from @{method corres}) by applying one of the following rules to each conjunct:\\<close>\n\nthm corres_rv_defer\nthm corres_rv_wp_left\nthm corres_rv_wp_right\n\ntext \\<open>If none of these rules can be safely applied, then @{method corres_rv} will leave the\n  obligation untouched. The user can manually apply one of them if desired, but this is liable to\n  create unsolvable proof obligations. In the worst case, the user may manually solve the goal in-place.\\<close>\n\nthm corres_rv_proveT[no_vars]\n\nsection \\<open>The corres method\\<close>\n\ntext \\<open>The core algorithm of the corres method is simple:\n  1) start by applying any necessary weakening rules to ensure the goal has schematic preconditions\n  2) apply a known @{thm corres} or @{thm corresK} rule (see next section)\n  3) if unsuccessful, apply a split rule (i.e. @{thm corresK_split}) and go to 2\n\nImportantly, @{method corres} will not split a goal if it ultimately is not able to apply at least\none @{thm corres} or @{thm corresK} rule.\n\\<close>\n\nsubsection \\<open>The corres and corresK named_theorems\\<close>\n\ntext \\<open>To address the fact that existing refinement rules are phrased as @{const corres_underlying}\nand not @{const corres_underlyingK} there are two different named_theorems that are used for different\nkind of rules @{thm corres} and @{thm corresK}. A @{thm corres} rule is understood to be phrased\nwith @{const corres_underlying} and may have additional assumptions. These assumptions will be\npropagated through the additional @{term F} flag in @{const corres_underlyingK}, rather than presented\nas proof obligations immediately. A @{thm corresK} rule is understood to be phrased with\n@{const corres_underlyingK}, and is meant for calculational rules which may have proper assumptions that\nshould not be propagated.\n\\<close>\nthm corresK\nthm corres\n\nsubsection \\<open>The corresc method\\<close>\n\ntext \\<open>Similar to @{method wpc}, @{method corresc} can handle case statements in @{const corres_underlyingK}\nproof goals. Importantly, however, it is split into two sub-methods @{method corresc_left} and\n@{method corresc_right}, which perform case-splitting on each side respectively. The combined method\n@{method corresc}, however, attempts to discharge the contradictions that arise from the quadratic\nblowup of a case analysis on both the left and right sides.\\<close>\n\nsubsection \\<open>corres_concrete_r, corres_concrete_rE\\<close>\n\ntext \\<open>Some @{thm corresK} rules should only be applied if certain variables are concrete\n(i.e. not schematic) in the goal. These are classified separately with the named_theorems\n@{thm corres_concrete_r} and @{thm corres_concrete_rER}. The first\nindicates that the return value relation of the goal must be concrete, the second indicates that\nonly the left side of the error relation must be concrete.\\<close>\n\nthm corres_concrete_r\nthm corres_concrete_rER\n\nsubsection \\<open>The corres_search method\\<close>\n\ntext \\<open>The purpose of @{method corres_search} is to address cases where there is non-trivial control flow.\nIn particular: in the case where there is an \"if\" statement or either side needs to be symbolically\nexecuted. The core idea is that corres_search should be provided with a \"search\" rule that acts\nas an anchoring point. Symbolic execution and control flow is decomposed until either the given\nrule is successfully applied or all search branches are exhausted.\\<close>\n\nsubsubsection \\<open>Symbolic Execution\\<close>\n\ntext \\<open>Symbolic execution is handled by two named theorems:\n @{thm corres_symb_exec_ls} and @{thm corres_symb_exec_rs}, which perform symbolic execution on\nthe left and right hand sides of a corres goal.\\<close>\n\nthm corres_symb_exec_ls\nthm corres_symb_exec_rs\n\ntext \\<open>A function may be symbolically executed if it does not modify the state, i.e. its only purpose\nis to compute some value and return it. After being symbolically executed,\nthis value can only be discussed by the precondition of the associated side or the stateless\nprecondition of corresK. The resulting @{const corres_rv} goal has @{const corres_noop} as the\nfunction on the alternate side. This gives @{method corres_rv} a hint that the resulting obligation\nshould be aggressively re-written into a hoare triple over @{term m} if it can't be propagated\nback statelessly safely.\n\\<close>\n\n\nsection \\<open>Demo\\<close>\n\n\ncontext begin interpretation Arch .\n\n(* VSpace_R *)\n\n\nlemmas load_hw_asid_corres_args[corres] =\n  loadHWASID_corres[@lift_corres_args]\n\nlemmas invalidate_asid_corres_args[corres] =\n  invalidateASID_corres[@lift_corres_args]\n\nlemmas invalidate_hw_asid_entry_corres_args[corres] =\n  invalidateHWASIDEntry_corres[@lift_corres_args]\n\nlemma invalidateASIDEntry_corres:\n  \"corres dc (valid_vspace_objs and valid_asid_map\n                and K (asid \\<le> mask asid_bits \\<and> asid \\<noteq> 0)\n                and vspace_at_asid asid pd and valid_vs_lookup\n                and unique_table_refs o caps_of_state\n                and valid_global_objs and valid_arch_state\n                and pspace_aligned and pspace_distinct)\n             (pspace_aligned' and pspace_distinct' and no_0_obj')\n             (invalidate_asid_entry asid) (invalidateASIDEntry asid)\"\n  apply (simp add: invalidate_asid_entry_def invalidateASIDEntry_def)\n  apply_debug (trace) (* apply_trace between steps *)\n   (tags \"corres\") (* break at breakpoints labelled \"corres\" *)\n   corres (* weaken precondition *)\n   continue (* split *)\n   continue (* solve load_hw_asid *)\n   continue (* split *)\n   continue (* apply corres_when *)\n   continue (* trivial simplification *)\n   continue (* invalidate _hw_asid_entry *)\n   finish (* invalidate_asid *)\n\n  apply (corressimp wp: load_hw_asid_wp)+\n  apply (fastforce simp: pd_at_asid_uniq)\n  done\n\n\ncrunch typ_at'[wp]: invalidateASIDEntry, flushSpace \"typ_at' T t\"\ncrunch ksCurThread[wp]: invalidateASIDEntry, flushSpace \"\\<lambda>s. P (ksCurThread s)\"\ncrunch obj_at'[wp]: invalidateASIDEntry, flushSpace \"obj_at' P p\"\n\nlemmas flush_space_corres_args[corres] =\n  flushSpace_corres[@lift_corres_args]\n\nlemmas invalidate_asid_entry_corres_args[corres] =\n  invalidateASIDEntry_corres[@lift_corres_args]\n\n\nlemma corres_inst_eq_ext:\n  \"(\\<And>x. corres_inst_eq (f x) (f' x)) \\<Longrightarrow> corres_inst_eq f f'\"\n  by (auto simp add: corres_inst_eq_def)\n\nlemma delete_asid_corresb:\n  notes [corres] = corres_gets_asid getCurThread_corres setObject_ASIDPool_corres and\n    [@lift_corres_args, corres] =  get_asid_pool_corres_inv'\n    invalidateASIDEntry_corres\n    setVMRoot_corres\n  notes [wp] = set_asid_pool_asid_map_unmap set_asid_pool_vs_lookup_unmap'\n    set_asid_pool_vspace_objs_unmap'\n    invalidate_asid_entry_invalidates\n    getASID_wp\n  notes if_weak_cong[cong] option.case_cong_weak[cong]\n  shows\n    \"corres dc\n          (invs and valid_etcbs and K (asid \\<le> mask asid_bits \\<and> asid \\<noteq> 0))\n          (pspace_aligned' and pspace_distinct' and no_0_obj'\n              and valid_arch_state' and cur_tcb')\n          (delete_asid asid pd) (deleteASID asid pd)\"\n  apply (simp add: delete_asid_def deleteASID_def)\n  apply_debug (trace) (* apply_trace between steps *)\n    (tags \"corres\") (* break at breakpoints labelled \"corres\" *)\n    corres (* weaken precondition *)\n   continue (* split *)\n       continue (* gets rule *)\n      continue (* corresc *)\n       continue (* return rule *)\n      continue (* split *)\n          continue (* function application *)\n          continue (* liftM rule *)\n          continue (* get_asid_pool_corres_inv' *)\n         continue (* function application *)\n         continue (* function application *)\n         continue (* corresK_when *)\n         continue (* split *)\n             continue (* flushSpace_corres *)\n            continue (* K_bind *)\n            continue (* K_bind *)\n            continue (* split *)\n                continue (* invalidateASIDEntry_corres *)\n               continue (* K_bind *)\n               continue (* return bind *)\n               continue (* K_bind *)\n               continue (* split *)\n                   continue (* backtracking *)\n               continue (* split *)\n                   continue (* function application *)\n                   continue (* setObject_ASIDPool_corres *)\n                  continue (* K_bind *)\n                  continue (* K_bind *)\n                  continue (* split *)\n                      continue (* getCurThread_corres *)\n                     continue (* setVMRoot_corres *)\n                    finish (* backtracking? *)\n                    apply (corressimp simp: mask_asid_low_bits_ucast_ucast\n      | fold cur_tcb_def | wps)+\n  apply (frule arm_asid_table_related,clarsimp)\n  apply (rule conjI)\n   apply (intro impI allI)\n    apply (rule conjI)\n     apply (safe; assumption?)\n     apply (rule ext)\n     apply (fastforce simp: inv_def dest: ucast_ucast_eq)\n    apply (rule context_conjI)\n    apply (fastforce simp: o_def dest: valid_asid_tableD invs_valid_asid_table)\n   apply (intro allI impI)\n   apply (subgoal_tac \"vspace_at_asid asid pd s\")\n    prefer 2\n    apply (simp add: vspace_at_asid_def)\n    apply (rule vs_lookupI)\n     apply (simp add: vs_asid_refs_def)\n     apply (rule image_eqI[OF refl])\n     apply (rule graph_ofI)\n     apply fastforce\n    apply (rule r_into_rtrancl)\n    apply simp\n    apply (rule vs_lookup1I [OF _ _ refl], assumption)\n    apply (simp add: vs_refs_def)\n    apply (rule image_eqI[rotated], erule graph_ofI)\n    apply (simp add: mask_asid_low_bits_ucast_ucast)\n   prefer 2\n   apply (intro allI impI context_conjI; assumption?)\n    apply (rule aligned_distinct_relation_asid_pool_atI'; fastforce?)\n    apply (fastforce simp: o_def dest: valid_asid_tableD invs_valid_asid_table)\n    apply (simp add: cur_tcb'_def)\n    apply (safe; assumption?)\n    apply (erule ko_at_weakenE)\n    apply (clarsimp simp: graph_of_def)\n    apply (fastforce split: if_split_asm)\n   apply (frule invs_vspace_objs)\n   apply (drule (2) valid_vspace_objsD)\n   apply (erule ranE)\n   apply (fastforce split: if_split_asm)\n  apply (erule ko_at_weakenE)\n  apply (clarsimp simp: graph_of_def)\n  apply (fastforce split: if_split_asm)\n  done\n\nlemma cte_wp_at_ex:\n  \"cte_wp_at (\\<lambda>_. True) p s \\<Longrightarrow> (\\<exists>cap. cte_wp_at ((=) cap) p s)\"\n  by (simp add: cte_wp_at_def)\n\n(* Sadly broken:\nlemma setVMRootForFlush_corres:\n  notes [corres] = getCurThread_corres getSlotCap_corres\n  shows\n  \"corres (=)\n          (cur_tcb and vspace_at_asid asid pd\n           and K (asid \\<noteq> 0 \\<and> asid \\<le> mask asid_bits)\n           and valid_asid_map and valid_vs_lookup\n           and valid_vspace_objs and valid_global_objs\n           and unique_table_refs o caps_of_state\n           and valid_arch_state\n           and pspace_aligned and pspace_distinct)\n          (pspace_aligned' and pspace_distinct' and no_0_obj')\n          (set_vm_root_for_flush pd asid)\n          (setVMRootForFlush pd asid)\"\n  apply (simp add: set_vm_root_for_flush_def setVMRootForFlush_def getThreadVSpaceRoot_def locateSlot_conv)\n  apply corres\n         apply_debug (trace) (tags \"corres_search\") (corres_search search: armv_contextSwitch_corres)\n  continue (* step left *)\n  continue (* if rule *)\n  continue (* failed corres on first subgoal, trying next *)\n  continue (* fail corres on last subgoal, trying reverse if rule *)\n  continue (* can't make corres progress here, trying other goal *)\n  finish (* successful goal discharged by corres *)\n\n  apply (corressimp wp: get_cap_wp getSlotCap_wp)+\n  apply (rule context_conjI)\n  subgoal by (simp add: cte_map_def objBits_simps tcb_cnode_index_def\n                        tcbVTableSlot_def to_bl_1 cte_level_bits_def)\n  apply (rule context_conjI)\n  subgoal by (fastforce simp: cur_tcb_def intro!: tcb_at_cte_at_1[simplified])\n  apply (rule conjI)\n   subgoal by (fastforce simp: isCap_simps)\n  apply (drule cte_wp_at_ex)\n  apply clarsimp\n  apply (drule (1) pspace_relation_cte_wp_at[rotated 1]; (assumption | clarsimp)?)\n  apply (drule cte_wp_at_norm')\n  apply clarsimp\n  apply (rule_tac x=\"cteCap cte\" in exI)\n  apply (auto elim: cte_wp_at_weakenE' dest!: curthread_relation)\n  done\n\ntext \\<open>Note we can wrap it all up in corressimp\\<close>\n\nlemma setVMRootForFlush_corres':\n  notes [corres] = getCurThread_corres getSlotCap_corres\n  shows\n  \"corres (=)\n          (cur_tcb and vspace_at_asid asid pd\n           and K (asid \\<noteq> 0 \\<and> asid \\<le> mask asid_bits)\n           and valid_asid_map and valid_vs_lookup\n           and valid_vspace_objs and valid_global_objs\n           and unique_table_refs o caps_of_state\n           and valid_arch_state\n           and pspace_aligned and pspace_distinct)\n          (pspace_aligned' and pspace_distinct' and no_0_obj')\n          (set_vm_root_for_flush pd asid)\n          (setVMRootForFlush pd asid)\"\n  apply (simp add: set_vm_root_for_flush_def setVMRootForFlush_def getThreadVSpaceRoot_def locateSlot_conv)\n  apply (corressimp search: armv_contextSwitch_corres\n                        wp: get_cap_wp getSlotCap_wp\n                      simp: isCap_simps)\n  apply (rule context_conjI)\n  subgoal by (simp add: cte_map_def objBits_simps tcb_cnode_index_def\n                        tcbVTableSlot_def to_bl_1 cte_level_bits_def)\n  apply (rule context_conjI)\n  subgoal by (fastforce simp: cur_tcb_def intro!: tcb_at_cte_at_1[simplified])\n  apply (rule conjI)\n   subgoal by (fastforce)\n  apply (drule cte_wp_at_ex)\n  apply clarsimp\n  apply (drule (1) pspace_relation_cte_wp_at[rotated 1]; (assumption | clarsimp)?)\n  apply (drule cte_wp_at_norm')\n  apply clarsimp\n  apply (rule_tac x=\"cteCap cte\" in exI)\n  apply (auto elim: cte_wp_at_weakenE' dest!: curthread_relation)\n  done\n*)\n\nend\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/test/Corres_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.31915043934702697}}
{"text": "subsection\\<open>\\<open>\\<Sigma>\\<close>-OR statements\\<close>\n\ntheory Sigma_OR imports\n  Sigma_Protocols\n  Xor\nbegin \n\nlocale \\<Sigma>_OR_base = \\<Sigma>0: \\<Sigma>_protocols_base init0 response0 check0 Rel0 S0_raw \\<A>ss0 \"carrier L\" valid_pub0\n  + \\<Sigma>1: \\<Sigma>_protocols_base init1 response1 check1 Rel1 S1_raw \\<A>ss1 \"carrier L\" valid_pub1\n  for init1 :: \"'pub1 \\<Rightarrow> 'witness1 \\<Rightarrow> ('rand1 \\<times> 'msg1) spmf\"\n    and response1 :: \"'rand1 \\<Rightarrow> 'witness1 \\<Rightarrow> 'bool  \\<Rightarrow> 'response1 spmf\"\n    and check1 :: \"'pub1 \\<Rightarrow> 'msg1 \\<Rightarrow> 'bool \\<Rightarrow> 'response1 \\<Rightarrow> bool\"\n    and Rel1 :: \"('pub1 \\<times> 'witness1) set\"\n    and S1_raw :: \"'pub1 \\<Rightarrow> 'bool \\<Rightarrow> ('msg1 \\<times> 'response1) spmf\"\n    and \\<A>ss1 :: \"'pub1 \\<Rightarrow> 'msg1 \\<times> 'bool \\<times> 'response1 \\<Rightarrow> 'msg1 \\<times> 'bool \\<times> 'response1 \\<Rightarrow> 'witness1 spmf\"\n    and challenge_space1 :: \"'bool set\"\n    and valid_pub1 :: \"'pub1 set\"\n    and init0 :: \"'pub0 \\<Rightarrow> 'witness0 \\<Rightarrow> ('rand0 \\<times> 'msg0) spmf\"\n    and response0 :: \"'rand0 \\<Rightarrow> 'witness0 \\<Rightarrow> 'bool \\<Rightarrow> 'response0 spmf\"\n    and check0 :: \"'pub0 \\<Rightarrow> 'msg0 \\<Rightarrow> 'bool \\<Rightarrow> 'response0 \\<Rightarrow> bool\"\n    and Rel0 :: \"('pub0 \\<times> 'witness0) set\"\n    and S0_raw :: \"'pub0 \\<Rightarrow> 'bool \\<Rightarrow> ('msg0 \\<times> 'response0) spmf\"\n    and \\<A>ss0 :: \"'pub0 \\<Rightarrow> 'msg0 \\<times> 'bool \\<times> 'response0 \\<Rightarrow> 'msg0 \\<times> 'bool \\<times> 'response0 \\<Rightarrow> 'witness0 spmf\"\n    and challenge_space0 :: \"'bool set\"\n    and valid_pub0 :: \"'pub0 set\"\n    and G :: \"(('pub0 \\<times> 'pub1)  \\<times> ('witness0 + 'witness1)) spmf\"\n    and L :: \"'bool boolean_algebra\" (structure)\n    + \n  assumes \\<Sigma>_prot1: \"\\<Sigma>1.\\<Sigma>_protocol\"  \n    and \\<Sigma>_prot0: \"\\<Sigma>0.\\<Sigma>_protocol\"  \n    and lossless_init: \"lossless_spmf (init0 h0 w0)\" \"lossless_spmf (init1 h1 w1)\"\n    and lossless_response: \"lossless_spmf (response0 r0 w0 e0)\" \"lossless_spmf (response1 r1 w1 e1)\"\n    and lossless_S: \"lossless_spmf (S0 h0 e0)\" \"lossless_spmf (S1 h1 e1)\"\n    and finite_L: \"finite (carrier L)\"\n    and carrier_L_not_empty: \"carrier L \\<noteq> {}\"\n    and lossless_G: \"lossless_spmf G\"\nbegin\n\ninductive_set Rel_OR :: \"(('pub0 \\<times> 'pub1) \\<times> ('witness0 + 'witness1)) set\" where\n  Rel_OR_I0: \"((x0, x1), Inl w0) \\<in> Rel_OR\" if \"(x0, w0) \\<in> Rel0 \\<and> x1 \\<in> valid_pub1\"\n| Rel_OR_I1: \"((x0, x1), Inr w1) \\<in> Rel_OR\" if \"(x1, w1) \\<in> Rel1 \\<and> x0 \\<in> valid_pub0\"\n\ninductive_simps Rel_OR_simps [simp]:\n  \"((x0, x1), Inl w0) \\<in> Rel_OR\"\n  \"((x0, x1), Inr w1) \\<in> Rel_OR\"\n\nlemma Domain_Rel_cases: \n  assumes \"(x0,x1) \\<in> Domain Rel_OR\"\n  shows \"(\\<exists> w0. (x0,w0) \\<in> Rel0 \\<and> x1 \\<in> valid_pub1) \\<or> (\\<exists> w1. (x1,w1) \\<in> Rel1 \\<and> x0 \\<in> valid_pub0)\"\n  using assms \n  by (meson DomainE Rel_OR.cases)\n\nlemma set_spmf_lists_sample [simp]: \"set_spmf (spmf_of_set (carrier L)) = (carrier L)\"\n  using finite_L by simp\n\ndefinition \"challenge_space = carrier L\"\n \nfun init_OR :: \"('pub0 \\<times> 'pub1) \\<Rightarrow> ('witness0 + 'witness1) \\<Rightarrow> (((('rand0 \\<times> 'bool \\<times> 'response1 + 'rand1 \\<times> 'bool \\<times> 'response0)) \\<times> 'msg0 \\<times> 'msg1)) spmf\"\n  where \"init_OR (x0,x1) (Inl w0) = do {\n    (r0,a0) \\<leftarrow> init0 x0 w0;\n    e1 \\<leftarrow> spmf_of_set (carrier L);\n    (a1, e'1, z1) \\<leftarrow> \\<Sigma>1.S x1 e1;\n    return_spmf (Inl (r0, e1, z1), a0, a1)}\" |\n    \"init_OR (x0, x1) (Inr w1) = do {\n    (r1, a1) \\<leftarrow> init1 x1 w1;\n    e0 \\<leftarrow> spmf_of_set (carrier L);\n    (a0, e'0, z0) \\<leftarrow> \\<Sigma>0.S x0 e0;\n    return_spmf ((Inr (r1, e0, z0), a0, a1))}\"\n\nlemma lossless_\\<Sigma>_S: \"lossless_spmf (\\<Sigma>1.S x1 e1)\" \"lossless_spmf (\\<Sigma>0.S x0 e0)\"\n  using lossless_S by fast +\n\nlemma lossless_init_OR: \"lossless_spmf (init_OR (x0,x1) w)\"\n  by(cases w;simp add: lossless_\\<Sigma>_S split_def lossless_init lossless_S finite_L carrier_L_not_empty) \n\nfun response_OR :: \"(('rand0 \\<times> 'bool \\<times> 'response1 + 'rand1 \\<times> 'bool \\<times> 'response0)) \\<Rightarrow> ('witness0 + 'witness1) \n                        \\<Rightarrow> 'bool \\<Rightarrow> (('bool \\<times> 'response0) \\<times> ('bool \\<times> 'response1)) spmf\"\n  where \"response_OR (Inl (r0 , e_1, z1)) (Inl w0) s = do {  \n    let e0 = s \\<oplus> e_1;\n    z0 \\<leftarrow> response0 r0 w0 e0;\n    return_spmf ((e0,z0),  (e_1,z1))}\" |\n    \"response_OR  (Inr (r1, e_0, z0)) (Inr w1) s = do {\n    let e1 = s \\<oplus> e_0;\n    z1 \\<leftarrow> response1 r1 w1 e1;\n    return_spmf ((e_0, z0), (e1, z1))}\" \n\ndefinition check_OR :: \"('pub0 \\<times> 'pub1) \\<Rightarrow> ('msg0 \\<times> 'msg1) \\<Rightarrow> 'bool \\<Rightarrow> (('bool \\<times> 'response0) \\<times> ('bool \\<times> 'response1)) \\<Rightarrow> bool\"\n  where \"check_OR X A s Z\n             = (s = (fst (fst Z)) \\<oplus> (fst (snd Z)) \n                   \\<and> (fst (fst Z)) \\<in> challenge_space \\<and> (fst (snd Z)) \\<in> challenge_space \n                      \\<and> check0 (fst X) (fst A) (fst (fst Z)) (snd (fst Z)) \\<and> check1 (snd X) (snd A) (fst (snd Z)) (snd (snd Z)))\"\n\nlemma  \"check_OR (x0,x1) (a0,a1) s ((e0,z0), (e1,z1))\n             = (s = e0 \\<oplus> e1 \n                   \\<and> e0 \\<in> challenge_space \\<and> e1 \\<in> challenge_space \n                      \\<and> check0 x0 a0 e0 z0 \\<and> check1 x1 a1 e1 z1)\"\n  by(simp add: check_OR_def)\n\nfun S_OR where \"S_OR (x0,x1) c = do {\n    e1 \\<leftarrow> spmf_of_set (carrier L);\n    (a1, e1', z1) \\<leftarrow> \\<Sigma>1.S x1 e1;\n    let e0 = c \\<oplus> e1;\n    (a0, e0', z0) \\<leftarrow> \\<Sigma>0.S x0 e0; \n    let z = ((e0',z0), (e1',z1));\n    return_spmf ((a0, a1),z)}\"\n\ndefinition \\<A>ss_OR' :: \"'pub0 \\<times> 'pub1 \\<Rightarrow> ('msg0 \\<times> 'msg1) \\<times> 'bool \\<times> ('bool \\<times> 'response0) \\<times> 'bool \\<times> 'response1\n                    \\<Rightarrow> ('msg0 \\<times> 'msg1) \\<times> 'bool \\<times> ('bool \\<times> 'response0) \\<times> 'bool \\<times> 'response1 \\<Rightarrow> ('witness0 + 'witness1) spmf\"\n  where \"\\<A>ss_OR' X C1 C2 = TRY do {\n    _ :: unit \\<leftarrow> assert_spmf ((fst (fst  (snd (snd C1)))) \\<noteq> (fst (fst (snd (snd C2)))));\n    w0 :: 'witness0 \\<leftarrow> \\<A>ss0 (fst X) (fst (fst C1),fst (fst (snd (snd C1))),snd (fst (snd (snd C1)))) (fst (fst C2),fst (fst (snd (snd C2))),snd (fst (snd (snd C2))));\n    return_spmf ((Inl w0)) :: ('witness0 + 'witness1) spmf} ELSE do {\n     w1 :: 'witness1 \\<leftarrow> \\<A>ss1  (snd X) (snd (fst C1),fst (snd (snd (snd C1))), snd (snd (snd (snd C1)))) (snd (fst C2), fst (snd (snd (snd C2))), snd (snd (snd (snd C2))));\n    (return_spmf ((Inr w1)) :: ('witness0 + 'witness1) spmf)}\"\n\ndefinition \\<A>ss_OR :: \"'pub0 \\<times> 'pub1 \\<Rightarrow> ('msg0 \\<times> 'msg1) \\<times> 'bool \\<times> ('bool \\<times> 'response0) \\<times> 'bool \\<times> 'response1\n                    \\<Rightarrow> ('msg0 \\<times> 'msg1) \\<times> 'bool \\<times> ('bool \\<times> 'response0) \\<times> 'bool \\<times> 'response1 \\<Rightarrow> ('witness0 + 'witness1) spmf\"\n  where \"\\<A>ss_OR X C1 C2 = do {\n    if ((fst (fst  (snd (snd C1)))) \\<noteq> (fst (fst (snd (snd C2))))) then do \n        {w0 :: 'witness0 \\<leftarrow> \\<A>ss0 (fst X) (fst (fst C1),fst (fst (snd (snd C1))),snd (fst (snd (snd C1)))) (fst (fst C2),fst (fst (snd (snd C2))),snd (fst (snd (snd C2)))); return_spmf (Inl w0)} \n    else\n    do  {w1 :: 'witness1 \\<leftarrow> \\<A>ss1  (snd X) (snd (fst C1),fst (snd (snd (snd C1))), snd (snd (snd (snd C1)))) (snd (fst C2), fst (snd (snd (snd C2))), snd (snd (snd (snd C2)))); return_spmf (Inr w1)}}\"\n\nlemma \\<A>ss_OR_alt_def: \"\\<A>ss_OR (x0,x1) ((a0,a1),s,(e0,z0),e1,z1) ((a0,a1),s',(e0',z0'),e1',z1') = do {\n    if (e0 \\<noteq> e0') then do {w0 :: 'witness0 \\<leftarrow> \\<A>ss0 x0 (a0,e0,z0) (a0,e0',z0'); return_spmf (Inl w0)}\n    else do {w1 :: 'witness1 \\<leftarrow> \\<A>ss1 x1 (a1,e1,z1) (a1,e1',z1'); return_spmf (Inr w1)}}\"\n  by(simp add: \\<A>ss_OR_def)\n\ndefinition \"valid_pub_OR = {(x0,x1). x0 \\<in> valid_pub0 \\<and> x1 \\<in> valid_pub1}\"\n\nsublocale \\<Sigma>_OR: \\<Sigma>_protocols_base init_OR response_OR check_OR Rel_OR S_OR \\<A>ss_OR challenge_space valid_pub_OR \n  unfolding \\<Sigma>_protocols_base_def\nproof(goal_cases)\n  case 1\n  then show ?case \n  proof\n    fix x \n    assume asm: \"x \\<in> Domain Rel_OR\"\n    then obtain x0 x1 where x: \"(x0,x1) = x\" \n      by (metis surj_pair)\n    show \"x \\<in> valid_pub_OR\"\n    proof(cases \"\\<exists> w0. (x0,w0) \\<in> Rel0 \\<and> x1 \\<in> valid_pub1\")\n      case True\n      then show ?thesis \n        using \\<Sigma>0.domain_subset_valid_pub valid_pub_OR_def x by auto\n    next\n      case False\n      hence \"\\<exists> w1. (x1,w1) \\<in> Rel1 \\<and> x0 \\<in> valid_pub0\" \n        using Domain_Rel_cases asm x by auto\n      then show ?thesis \n        using \\<Sigma>1.domain_subset_valid_pub valid_pub_OR_def x by auto\n    qed\n  qed\nqed\n\nend \n\nlocale \\<Sigma>_OR_proofs = \\<Sigma>_OR_base + boolean_algebra L +\n  assumes G_Rel_OR: \"((x0, x1), w) \\<in> set_spmf G \\<Longrightarrow> ((x0, x1), w) \\<in> Rel_OR\"\n    and lossless_response_OR: \"lossless_spmf (response_OR R W s)\"\nbegin\n\nlemma HVZK1:\n  assumes \"(x1,w1) \\<in> Rel1\"\n  shows \"\\<forall> c \\<in> challenge_space. \\<Sigma>_OR.R (x0,x1) (Inr w1) c = \\<Sigma>_OR.S (x0,x1) c\"\n  including monad_normalisation\nproof\n  fix c\n  assume c: \"c \\<in> challenge_space\"\n  show \"\\<Sigma>_OR.R (x0,x1) (Inr w1) c = \\<Sigma>_OR.S (x0,x1) c\"\n  proof-\n    have *: \"x \\<in> carrier L \\<longrightarrow> c \\<oplus> c \\<oplus> x = x\" for x  \n      using c challenge_space_def by auto\n    have \"\\<Sigma>_OR.R (x0,x1) (Inr w1) c = do {\n    (r1, ab1) \\<leftarrow> init1 x1 w1;\n    eb' \\<leftarrow> spmf_of_set (carrier L);\n    (ab0', eb0'', zb0') \\<leftarrow> \\<Sigma>0.S x0 eb';\n    let ((r, eb', zb'),a) = ((r1, eb', zb0' ),  ab0' , ab1);\n    let eb = c \\<oplus> eb';\n    zb1 \\<leftarrow> response1 r w1 eb;\n    let z = ((eb', zb') , (eb, zb1));\n    return_spmf (a,c,z)}\"\n      supply [[simproc del: monad_normalisation]]\n      by(simp add: \\<Sigma>_OR.R_def split_def Let_def)\n    also have \"... = do {\n    eb' \\<leftarrow> spmf_of_set (carrier L);\n    (ab0', eb0'', zb0') \\<leftarrow> \\<Sigma>0.S x0 eb';\n    let eb = c \\<oplus> eb';\n    (ab1, c', zb1) \\<leftarrow> \\<Sigma>1.R x1 w1 eb;\n    let z = ((eb', zb0'), (eb, zb1));\n    return_spmf ((ab0',ab1),c,z)}\"\n      by(simp add: \\<Sigma>1.R_def split_def Let_def)\n    also have \"... = do {\n    eb' \\<leftarrow> spmf_of_set (carrier L);\n    (ab0', eb0'', zb0') \\<leftarrow> \\<Sigma>0.S x0 eb';\n    let eb = c \\<oplus> eb';\n    (ab1, c', zb1) \\<leftarrow> \\<Sigma>1.S x1 eb;\n    let z = ((eb', zb0'), (eb, zb1));\n    return_spmf ((ab0',ab1),c,z)}\"\n      using c\n      by(simp add: split_def Let_def \\<Sigma>_prot1 \\<Sigma>1.HVZK_unfold1 assms challenge_space_def  cong: bind_spmf_cong_simp)\n    also have \"... = do {\n    eb \\<leftarrow> map_spmf (\\<lambda> eb'. c \\<oplus> eb') (spmf_of_set (carrier L));\n    (ab1, c', zb1) \\<leftarrow> \\<Sigma>1.S x1 eb;\n    (ab0', eb0'', zb0') \\<leftarrow> \\<Sigma>0.S x0 (c \\<oplus> eb);\n    let z = ((c \\<oplus> eb, zb0'), (eb, zb1));\n    return_spmf ((ab0',ab1),c,z)}\"\n      apply(simp add: bind_map_spmf o_def Let_def)\n      by(simp add: * split_def cong: bind_spmf_cong_simp)\n    also have \"... = do {\n    eb \\<leftarrow> (spmf_of_set (carrier L));\n    (ab1, c', zb1) \\<leftarrow> \\<Sigma>1.S x1 eb;\n    (ab0', eb0'', zb0') \\<leftarrow> \\<Sigma>0.S x0 (c \\<oplus> eb);\n    let z = ((c \\<oplus> eb, zb0'), (eb, zb1));\n    return_spmf ((ab0',ab1),c,z)}\"\n      using assms assms one_time_pad c challenge_space_def by simp\n    also have \"... = do {\n    eb \\<leftarrow> (spmf_of_set (carrier L));\n    (ab1, c', zb1) \\<leftarrow> \\<Sigma>1.S x1 eb;\n    (ab0', eb0'', zb0') \\<leftarrow> \\<Sigma>0.S x0 (c \\<oplus> eb);\n    let z = ((eb0'', zb0'), (c', zb1));\n    return_spmf ((ab0',ab1),c,z)}\"\n      by(simp add: \\<Sigma>0.S_def \\<Sigma>1.S_def bind_map_spmf o_def split_def)\n    ultimately show ?thesis by(simp add: Let_def map_spmf_conv_bind_spmf \\<Sigma>_OR.S_def split_def)\n  qed\nqed\n\nlemma HVZK0: \n  assumes \"(x0,w0) \\<in> Rel0\"\n  shows \"\\<forall> c \\<in> challenge_space. \\<Sigma>_OR.R (x0,x1) (Inl w0) c = \\<Sigma>_OR.S (x0,x1) c\"\nproof\n  fix c \n  assume c: \"c \\<in> challenge_space\"\n  show \"\\<Sigma>_OR.R (x0,x1) (Inl w0) c = \\<Sigma>_OR.S (x0,x1) c\"\n  proof-\n    have \"\\<Sigma>_OR.R (x0,x1) (Inl w0) c = do {\n    (r0,ab0) \\<leftarrow> init0 x0 w0;\n    eb' \\<leftarrow> spmf_of_set (carrier L);\n    (ab1', eb1'', zb1') \\<leftarrow> \\<Sigma>1.S x1 eb';\n    let ((r, eb', zb'),a) = ((r0, eb', zb1'),  ab0,  ab1');\n    let eb = c \\<oplus> eb';\n    zb0 \\<leftarrow> response0 r w0 eb;\n    let z = ((eb,zb0), (eb',zb'));\n    return_spmf (a,c,z)}\"\n      by(simp add: \\<Sigma>_OR.R_def split_def Let_def)\n    also have \"... = do {\n    eb' \\<leftarrow> (spmf_of_set (carrier L));\n    (ab1', eb1'', zb1') \\<leftarrow> \\<Sigma>1.S x1 eb';\n    let eb = c \\<oplus> eb';\n    (ab0, c', zb0) \\<leftarrow> \\<Sigma>0.R x0 w0 eb;\n    let z = ((eb,zb0),  (eb',zb1'));\n    return_spmf ((ab0,  ab1'),c,z)}\"\n      apply(simp add: \\<Sigma>0.R_def split_def Let_def)\n      apply(rewrite bind_commute_spmf)\n      apply(rewrite bind_commute_spmf[of _ \"\\<Sigma>1.S _ _\"])\n      by simp\n    also have \"... = do {\n    eb' \\<leftarrow> (spmf_of_set (carrier L));\n    (ab1', eb1'', zb1') \\<leftarrow> \\<Sigma>1.S x1 eb';\n    let eb = c \\<oplus> eb';\n    (ab0, c', zb0) \\<leftarrow> \\<Sigma>0.S x0 eb;\n    let z = ((eb,zb0), (eb',zb1'));\n    return_spmf ((ab0,  ab1'),c,z)}\"\n      using c\n      by(simp add: \\<Sigma>_prot0 \\<Sigma>0.HVZK_unfold1 assms challenge_space_def split_def Let_def cong: bind_spmf_cong_simp)\n    ultimately show ?thesis\n      by(simp add: \\<Sigma>_OR.S_def \\<Sigma>1.S_def \\<Sigma>0.S_def Let_def o_def bind_map_spmf split_def map_spmf_conv_bind_spmf)\n  qed\nqed\n\nlemma HVZK:\n  shows \"\\<Sigma>_OR.HVZK\"\n  unfolding \\<Sigma>_OR.HVZK_def\n  apply auto\n  subgoal for e a b w\n    apply(cases w)\n    using HVZK0 HVZK1 by auto \n  apply(auto simp add: valid_pub_OR_def \\<Sigma>_OR.S_def bind_map_spmf o_def check_OR_def image_def \\<Sigma>0.S_def \\<Sigma>1.S_def split_def challenge_space_def local.xor_ac(1))\n  using \\<Sigma>0.HVZK_unfold2 \\<Sigma>_prot0 challenge_space_def apply force\n  using \\<Sigma>1.HVZK_unfold2 \\<Sigma>_prot1 challenge_space_def by force\n\nlemma assumes \"(x0,x1) \\<in> Domain Rel_OR\"\n  shows \"(\\<exists> w0. (x0,w0) \\<in> Rel0) \\<or> (\\<exists> w1. (x1,w1) \\<in> Rel1)\"\n  using assms Rel_OR.simps by blast\n\nlemma ss: \n  assumes valid_pub_OR: \"(x0,x1) \\<in> valid_pub_OR\" \n    and check: \"check_OR (x0,x1) (a0,a1) s ((e0,z0), (e1,z1))\"\n    and check': \"check_OR (x0,x1) (a0,a1) s' ((e0',z0'), (e1',z1'))\"\n    and \"s \\<noteq> s'\"\n    and challenge_space: \"s \\<in> challenge_space\" \"s' \\<in> challenge_space\"\n  shows \"lossless_spmf (\\<A>ss_OR (x0,x1) ((a0,a1),s,(e0,z0), e1,z1) ((a0,a1),s',(e0',z0'), e1',z1')) \\<and>\n           (\\<forall>w'\\<in>set_spmf (\\<A>ss_OR (x0,x1) ((a0,a1),s,(e0,z0), e1,z1) ((a0,a1),s',(e0',z0'), e1',z1')). ((x0,x1), w') \\<in> Rel_OR)\"\nproof-\n  have e_or: \"e0 \\<noteq> e0' \\<or> e1 \\<noteq> e1'\" using assms check_OR_def by auto\n  show ?thesis \n  proof(cases \"e0 \\<noteq> e0'\")\n    case True\n    moreover have 2: \"x0 \\<in> valid_pub0\" \n      using valid_pub_OR valid_pub_OR_def by simp \n    moreover have 3: \"check0 x0 a0 e0 z0\" \n      using assms check_OR_def by simp \n    moreover have 4: \"check0 x0 a0 e0' z0'\"\n      using assms check_OR_def by simp \n    moreover have e: \"e0 \\<in> carrier L\" \"e0' \\<in> carrier L\" \n      using challenge_space_def check check' check_OR_def by auto \n    ultimately have \"(\\<forall>w'\\<in>set_spmf (\\<A>ss0 x0 (a0,e0,z0) (a0,e0',z0')). (x0, w') \\<in> Rel0)\" \n      using True \\<Sigma>0.\\<Sigma>_protocol_def \\<Sigma>0.special_soundness_def \\<Sigma>_prot0 challenge_space assms by blast\n    moreover have  \"lossless_spmf (\\<A>ss0 x0 (a0, e0, z0) (a0, e0', z0'))\"\n      using 2 3 4 \\<A>ss_OR_def True \\<Sigma>_prot0  \\<Sigma>0.\\<Sigma>_protocol_def \\<Sigma>0.special_soundness_def challenge_space_def e by blast\n    ultimately have \"\\<forall> w' \\<in> set_spmf (\\<A>ss_OR (x0,x1) ((a0,a1),s,(e0,z0), e1,z1) ((a0,a1),s',(e0',z0'), e1',z1')). ((x0,x1),  w') \\<in> Rel_OR\"\n      apply(auto simp only: \\<A>ss_OR_alt_def True)\n      apply(auto simp add: o_def \\<A>ss_OR_def) \n      using assms valid_pub_OR_def by blast\n    moreover have \"lossless_spmf (\\<A>ss_OR (x0,x1) ((a0,a1),s,(e0,z0), e1,z1) ((a0,a1),s',(e0',z0'), e1',z1'))\"\n      apply(simp add: \\<A>ss_OR_def)   \n      using 2 3 4 True \\<Sigma>_prot0  \\<Sigma>0.\\<Sigma>_protocol_def \\<Sigma>0.special_soundness_def challenge_space e by blast\n    ultimately show ?thesis by simp\n  next\n    case False\n    hence e1_neq_e1': \"e1 \\<noteq> e1'\" using e_or by simp\n    moreover have 2: \"x1 \\<in> valid_pub1\" \n      using valid_pub_OR valid_pub_OR_def by simp \n    moreover have 3: \"check1 x1 a1 e1 z1\" \n      using assms check_OR_def by simp\n    moreover have 4: \"check1 x1 a1 e1' z1'\"\n      using assms check_OR_def by simp \n    moreover have e: \"e1 \\<in> carrier L\" \"e1' \\<in> carrier L\" \n      using challenge_space_def check check' check_OR_def by auto\n    ultimately have \"(\\<forall>w'\\<in>set_spmf (\\<A>ss1 x1 (a1,e1,z1) (a1,e1',z1')). (x1,w') \\<in> Rel1)\" \n      using False \\<Sigma>1.\\<Sigma>_protocol_def \\<Sigma>1.special_soundness_def \\<Sigma>_prot1 e1_neq_e1' challenge_space by blast \n    hence \"\\<forall>w' \\<in> set_spmf (\\<A>ss_OR (x0,x1) ((a0,a1),s,(e0,z0), e1,z1) ((a0,a1),s',(e0',z0'), e1',z1')). ((x0,x1), w') \\<in> Rel_OR\"\n      apply(auto simp add: o_def \\<A>ss_OR_def) \n      using False assms \\<Sigma>1.L_def assms valid_pub_OR_def by auto    \n    moreover have \"lossless_spmf (\\<A>ss_OR (x0,x1) ((a0,a1),s,(e0,z0), e1,z1) ((a0,a1),s',(e0',z0'), e1',z1'))\"\n      apply(simp add: \\<A>ss_OR_def)  \n      using 2 3 4 \\<Sigma>_prot1 \\<Sigma>1.\\<Sigma>_protocol_def \\<Sigma>1.special_soundness_def False e1_neq_e1' challenge_space e by blast\n    ultimately show ?thesis by simp\n  qed\nqed\n\nlemma special_soundness: \n  shows \"\\<Sigma>_OR.special_soundness\"\n  unfolding \\<Sigma>_OR.special_soundness_def \n  using ss prod.collapse by fastforce\n\nlemma correct0: \n  assumes e_in_carrier: \"e \\<in> carrier L\"\n    and \"(x0,w0) \\<in> Rel0\"\n    and valid_pub: \"x1 \\<in> valid_pub1\"\n  shows \"\\<Sigma>_OR.completeness_game (x0,x1) (Inl w0) e = return_spmf True\"\n    (is \"?lhs = ?rhs\")\nproof-\n  have \"x \\<in> carrier L \\<longrightarrow> e = (e \\<oplus> x) \\<oplus> x\" for x \n    using e_in_carrier xor_assoc by simp\n  hence \"?lhs = do {\n    (r0,ab0) \\<leftarrow> init0 x0 w0;\n    eb' \\<leftarrow> spmf_of_set (carrier L);\n    (ab1', eb1'', zb1') \\<leftarrow> \\<Sigma>1.S x1 eb';\n    let eb = e \\<oplus> eb';\n    zb0 \\<leftarrow> response0 r0 w0 eb;\n    return_spmf ((check0 x0 ab0 eb zb0 \\<and> check1 x1 ab1' eb' zb1'))}\" \n    by(simp add: \\<Sigma>_OR.completeness_game_def split_def Let_def challenge_space_def assms check_OR_def cong: bind_spmf_cong_simp)\n  also have \"... = do {\n    eb' \\<leftarrow> spmf_of_set (carrier L);\n    (ab1', eb1'', zb1') \\<leftarrow> \\<Sigma>1.S x1 eb';\n    let eb = e \\<oplus> eb';\n    (r0,ab0) \\<leftarrow> init0 x0 w0;\n    zb0 \\<leftarrow> response0 r0 w0 eb;\n    return_spmf ((check0 x0 ab0 eb zb0 \\<and> check1 x1 ab1' eb' zb1'))}\" \n    apply(simp add: Let_def split_def)\n    apply(rewrite bind_commute_spmf)\n    apply(rewrite bind_commute_spmf[of _ \"\\<Sigma>1.S _ _\"])\n    by simp\n  also have \"... = do {\n    eb' :: 'e \\<leftarrow> spmf_of_set (carrier L);\n    (ab1', eb1'', zb1') \\<leftarrow> \\<Sigma>1.S x1 eb';\n    return_spmf (check1 x1 ab1' eb' zb1')}\" \n    apply(simp add: Let_def)\n    apply(intro bind_spmf_cong; clarsimp?)+\n    subgoal for e' a e z\n      apply(cases \"check1 x1 a e' z\")\n      using \\<Sigma>0.complete_game_return_true \\<Sigma>_prot0 \\<Sigma>0.completeness_game_def \\<Sigma>0.\\<Sigma>_protocol_def  \n      by(auto simp add: assms bind_spmf_const lossless_init lossless_response lossless_weight_spmfD split_def cong: bind_spmf_cong_simp)\n    done\n  also have \"... = do {\n    eb' :: 'e \\<leftarrow> spmf_of_set (carrier L);\n    (ab1', eb1'', zb1') \\<leftarrow> \\<Sigma>1.S x1 eb';\n    return_spmf (True)}\"\n    apply(intro bind_spmf_cong; clarsimp?)\n    subgoal for x a aa b\n      using  \\<Sigma>_prot1 \n      apply(auto simp add: \\<Sigma>1.S_def split_def image_def \\<Sigma>1.HVZK_unfold2_alt)  \n      using \\<Sigma>1.S_def split_def image_def \\<Sigma>1.HVZK_unfold2_alt \\<Sigma>_prot1 valid_pub by blast\n    done\n  ultimately show ?thesis \n    using \\<Sigma>1.HVZK_unfold2_alt\n    by(simp add: bind_spmf_const Let_def \\<Sigma>1.HVZK_unfold2_alt split_def lossless_\\<Sigma>_S lossless_weight_spmfD carrier_L_not_empty finite_L)\nqed\n\nlemma correct1: \n  assumes rel1: \"(x1,w1) \\<in> Rel1\"\n    and valid_pub: \"x0 \\<in> valid_pub0\"\n    and e_in_carrier: \"e \\<in> carrier L\"\n  shows \"\\<Sigma>_OR.completeness_game (x0,x1) (Inr w1) e = return_spmf True\"\n    (is \"?lhs = ?rhs\")\nproof-\n  have x1_inL: \"x1 \\<in> \\<Sigma>1.L\"\n    using \\<Sigma>1.L_def rel1 by auto\n  have \"x \\<in> carrier L \\<longrightarrow> e = x \\<oplus> e \\<oplus> x\" for x \n    by (simp add: e_in_carrier xor_assoc xor_commute  local.xor_ac(3)) \n  hence \"?lhs = do {\n    (r1, ab1) \\<leftarrow> init1 x1 w1;\n    eb' \\<leftarrow> spmf_of_set (carrier L);\n    (ab0', eb0'', zb0') \\<leftarrow> \\<Sigma>0.S x0 eb';\n    let eb = e \\<oplus> eb';\n    zb1 \\<leftarrow> response1 r1 w1 eb;\n    return_spmf (check0 x0 ab0' eb' zb0' \\<and> check1 x1 ab1 eb zb1)}\" \n    by(simp add: \\<Sigma>_OR.completeness_game_def split_def Let_def assms challenge_space_def check_OR_def cong: bind_spmf_cong_simp)\n  also have \"... = do {\n    eb' \\<leftarrow> spmf_of_set (carrier L);\n    (ab0', eb0'', zb0') \\<leftarrow> \\<Sigma>0.S x0 eb';\n    let eb = e \\<oplus> eb';\n    (r1, ab1) \\<leftarrow> init1 x1 w1;\n    zb1 \\<leftarrow> response1 r1 w1 eb;\n    return_spmf (check0 x0 ab0' eb' zb0' \\<and> check1 x1 ab1 eb zb1)}\" \n    apply(simp add: Let_def split_def)\n    apply(rewrite bind_commute_spmf)\n    apply(rewrite bind_commute_spmf[of _ \"\\<Sigma>0.S _ _\"])\n    by simp\n  also have \"... = do {\n    eb' \\<leftarrow> spmf_of_set (carrier L);\n    (ab0', eb0'', zb0') \\<leftarrow> \\<Sigma>0.S x0 eb';\n    return_spmf (check0 x0 ab0' eb' zb0')}\" \n    apply(simp add: Let_def)\n    apply(intro bind_spmf_cong; clarsimp?)+\n    subgoal for e' a e z\n      apply(cases \"check0 x0 a e' z\")\n      using \\<Sigma>1.complete_game_return_true \\<Sigma>_prot1 \\<Sigma>1.completeness_game_def \\<Sigma>1.\\<Sigma>_protocol_def\n      by(auto simp add: x1_inL assms bind_spmf_const lossless_init lossless_response lossless_weight_spmfD split_def)\n    done\n  also have \"... = do {\n    eb' \\<leftarrow> spmf_of_set (carrier L);\n    (ab0', eb0'', zb0') \\<leftarrow> \\<Sigma>0.S x0 eb';\n    return_spmf (True)}\" \n    apply(intro bind_spmf_cong; clarsimp?)\n    subgoal for x a aa b\n      using  \\<Sigma>_prot0\n      by(auto simp add: valid_pub valid_pub_OR_def \\<Sigma>0.S_def split_def image_def \\<Sigma>0.HVZK_unfold2_alt)  \n    done\n  ultimately show ?thesis \n    apply(simp add: \\<Sigma>0.HVZK_unfold2 Let_def)\n    using \\<Sigma>0.complete_game_return_true \\<Sigma>_OR.completeness_game_def\n    by(simp add: bind_spmf_const split_def lossless_\\<Sigma>_S(2) lossless_weight_spmfD Let_def carrier_L_not_empty finite_L)\nqed\n\nlemma completeness':\n  assumes  Rel_OR_asm: \"((x0,x1), w) \\<in> Rel_OR\" \n  shows \"\\<forall> e \\<in> carrier L. spmf (\\<Sigma>_OR.completeness_game (x0,x1) w e) True = 1\" \nproof\n  fix e\n  assume asm: \"e \\<in> carrier L\"\n  hence \"(\\<Sigma>_OR.completeness_game (x0,x1) w e) = return_spmf True\"\n  proof(cases w)\n    case inl: (Inl a)\n    then show ?thesis \n      using asm correct0 assms inl by auto\n  next\n    case inr: (Inr b)\n    then show ?thesis \n      using asm correct1 assms inr by auto\n  qed\n  thus \"spmf (\\<Sigma>_OR.completeness_game (x0,x1) w e) True = 1\" \n    by simp\nqed\n\nlemma completeness: shows \"\\<Sigma>_OR.completeness\"\n  unfolding \\<Sigma>_OR.completeness_def\n  using completeness' challenge_space_def by auto\n\nlemma \\<Sigma>_protocol: shows \"\\<Sigma>_OR.\\<Sigma>_protocol\"\n by(simp add: completeness HVZK special_soundness \\<Sigma>_OR.\\<Sigma>_protocol_def)\n\nsublocale OR_\\<Sigma>_commit: \\<Sigma>_protocols_to_commitments init_OR response_OR check_OR Rel_OR S_OR \\<A>ss_OR challenge_space valid_pub_OR G \n  by unfold_locales (auto simp add: \\<Sigma>_protocol lossless_G lossless_init_OR G_Rel_OR lossless_response_OR)\n\nlemma \"OR_\\<Sigma>_commit.abstract_com.correct\"\n  using OR_\\<Sigma>_commit.commit_correct by simp\n\nlemma \"OR_\\<Sigma>_commit.abstract_com.perfect_hiding_ind_cpa \\<A>\"\n  using OR_\\<Sigma>_commit.perfect_hiding by blast\n\nlemma bind_advantage_bound_dis_log: \n  shows \"OR_\\<Sigma>_commit.abstract_com.bind_advantage \\<A> \\<le> OR_\\<Sigma>_commit.rel_advantage (OR_\\<Sigma>_commit.adversary \\<A>)\"\n  using OR_\\<Sigma>_commit.bind_advantage by simp\n\nend\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Sigma_Commit_Crypto/Sigma_OR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.31905551509805496}}
{"text": "section \\<open>Accuracy without cutoff\\label{sec:accuracy_wo_cutoff}\\<close>\n\ntext \\<open>This section verifies that each of the $l$ estimate have the required accuracy with high\nprobability assuming that there was no cut-off, i.e., that $s=0$. Section~\\ref{sec:accuracy} will\nthen show that this remains true as long as the cut-off is below @{term \"t f\"} the subsampling\nthreshold.\\<close>\n                        \ntheory Distributed_Distinct_Elements_Accuracy_Without_Cutoff\n  imports \n    Distributed_Distinct_Elements_Inner_Algorithm \n    Distributed_Distinct_Elements_Balls_and_Bins\nbegin\n\nno_notation Polynomials.var (\"X\\<index>\")\n\nlocale inner_algorithm_fix_A = inner_algorithm +\n  fixes A\n  assumes A_range: \"A \\<subseteq> {..<n}\"\n  assumes A_nonempty: \"{} \\<noteq> A\"\nbegin\n\ndefinition X :: nat where \"X = card A\"\n\ndefinition q_max where \"q_max = nat (\\<lceil>log 2 X\\<rceil> - b_exp)\"\n\ndefinition t :: \"(nat \\<Rightarrow> nat) \\<Rightarrow> int\" \n  where \"t f = int (Max (f ` A)) - b_exp + 9\"\n\ndefinition s :: \"(nat \\<Rightarrow> nat) \\<Rightarrow> nat\"\n  where \"s f = nat (t f)\"\n\ndefinition R :: \"(nat \\<Rightarrow> nat) \\<Rightarrow> nat set\"\n  where \"R f = {a. a \\<in> A \\<and> f a \\<ge> s f}\"\n\ndefinition r :: \"nat \\<Rightarrow> (nat \\<Rightarrow> nat) \\<Rightarrow> nat\"\n  where \"r x f = card {a. a \\<in> A \\<and> f a \\<ge> x}\"\n\ndefinition p where \"p = (\\<lambda>(f,g,h). card {j\\<in> {..<b}. \\<tau>\\<^sub>1 (f,g,h) A 0 j \\<ge> s f})\"\n\ndefinition Y where \"Y = (\\<lambda>(f,g,h). 2 ^ s f * \\<rho>_inv (p (f,g,h)))\"\n\nlemma fin_A: \"finite A\"\n  using A_range finite_nat_iff_bounded by auto\n\nlemma X_le_n: \"X \\<le> n\"\nproof -\n  have \"card A \\<le> card {..<n}\" \n    by (intro card_mono A_range) simp\n  thus ?thesis\n    unfolding X_def by simp\nqed\n\nlemma X_ge_1: \"X \\<ge> 1\"\n  unfolding X_def \n  using fin_A A_nonempty by (simp add: leI)\n\nlemma of_bool_square: \"(of_bool x)\\<^sup>2 = ((of_bool x)::real)\"\n  by (cases x, auto)\n\nlemma r_eq: \"r x f = (\\<Sum> a \\<in> A.( of_bool( x \\<le> f a) :: real))\"\n  unfolding r_def of_bool_def sum.If_cases[OF fin_A]\n  by (simp add: Collect_conj_eq)\n\nlemma \n  shows \n    r_exp: \"(\\<integral>\\<omega>. real (r x \\<omega>) \\<partial> \\<Psi>\\<^sub>1) = real X * (of_bool (x \\<le> max (nat \\<lceil>log 2 n\\<rceil>) 1) / 2^x)\" and\n    r_var: \"measure_pmf.variance \\<Psi>\\<^sub>1 (\\<lambda>\\<omega>. real (r x \\<omega>)) \\<le> (\\<integral>\\<omega>. real (r x \\<omega>) \\<partial> \\<Psi>\\<^sub>1)\"\nproof -\n  define V :: \"nat \\<Rightarrow> (nat \\<Rightarrow> nat) \\<Rightarrow> real\" where \"V = (\\<lambda>a f. of_bool (x \\<le> f a))\"\n\n  have V_exp: \"(\\<integral>\\<omega>. V a \\<omega> \\<partial>\\<Psi>\\<^sub>1) = of_bool (x \\<le> max (nat \\<lceil>log 2 n\\<rceil>) 1)/2^x\" \n    (is \"?L = ?R\") if \"a \\<in> A\" for a\n  proof -\n    have a_le_n: \"a < n\"\n      using that A_range by auto\n\n    have \"?L = (\\<integral>\\<omega>. indicator {f. x \\<le> f a} \\<omega> \\<partial> \\<Psi>\\<^sub>1)\"\n      unfolding V_def by (intro integral_cong_AE) auto\n    also have \"... = measure (map_pmf (\\<lambda>\\<omega>. \\<omega> a) (sample_pmf \\<Psi>\\<^sub>1)) {f. x \\<le> f}\"\n      by simp\n    also have \"... = measure (\\<G> n_exp) {f. x \\<le> f}\"\n      unfolding \\<Psi>\\<^sub>1.single[OF a_le_n] by simp\n    also have \"... = of_bool (x \\<le> max (nat \\<lceil>log 2 n\\<rceil>) 1)/2^x\"\n      unfolding \\<G>_prob n_exp_def by simp\n    finally show ?thesis by simp\n  qed\n\n  have b:\"(\\<integral>\\<omega>. real (r x \\<omega>) \\<partial> \\<Psi>\\<^sub>1) = (\\<Sum> a \\<in> A. (\\<integral>\\<omega>. V a \\<omega> \\<partial>\\<Psi>\\<^sub>1))\" \n    unfolding r_eq V_def  using \\<Psi>\\<^sub>1.sample_space\n    by (intro Bochner_Integration.integral_sum) auto \n  also have \"... = (\\<Sum> a \\<in> A.  of_bool (x \\<le> max (nat \\<lceil>log 2 n\\<rceil>) 1)/2^x)\"\n    using V_exp by (intro sum.cong) auto\n  also have \"... = X * (of_bool (x \\<le> max (nat \\<lceil>log 2 n\\<rceil>) 1) / 2^x)\"\n    using X_def by simp\n  finally show \"(\\<integral>\\<omega>. real (r x \\<omega>) \\<partial> \\<Psi>\\<^sub>1) = real X * (of_bool (x \\<le> max (nat \\<lceil>log 2 n\\<rceil>) 1)/ 2^x)\"\n    by simp\n\n  have \"(\\<integral>\\<omega>. (V a \\<omega>)^2 \\<partial> \\<Psi>\\<^sub>1) = (\\<integral>\\<omega>. V a \\<omega> \\<partial> \\<Psi>\\<^sub>1)\" for a\n    unfolding V_def of_bool_square by simp\n\n  hence a:\"measure_pmf.variance \\<Psi>\\<^sub>1 (V a) \\<le> measure_pmf.expectation \\<Psi>\\<^sub>1 (V a)\"  for a \n    using \\<Psi>\\<^sub>1.sample_space by (subst measure_pmf.variance_eq) auto\n\n  have \"J \\<subseteq> A \\<Longrightarrow> card J = 2 \\<Longrightarrow> prob_space.indep_vars \\<Psi>\\<^sub>1 (\\<lambda>_. borel) V J\" for J\n    unfolding V_def using A_range finite_subset[OF _ fin_A]\n    by (intro prob_space.indep_vars_compose2[where Y=\"\\<lambda>i y. of_bool(x \\<le> y)\" and M'=\"\\<lambda>_. discrete\"]\n        prob_space.k_wise_indep_vars_subset[OF _ \\<Psi>\\<^sub>1.\\<H>_indep]) (auto simp:prob_space_measure_pmf)\n  hence \"measure_pmf.variance \\<Psi>\\<^sub>1 (\\<lambda>\\<omega>. real (r x \\<omega>)) = (\\<Sum> a \\<in> A. measure_pmf.variance \\<Psi>\\<^sub>1 (V a))\"\n    unfolding r_eq V_def using \\<Psi>\\<^sub>1.sample_space\n    by (intro measure_pmf.var_sum_pairwise_indep_2 fin_A) (simp_all)\n  also have \"... \\<le> (\\<Sum> a \\<in> A. (\\<integral>\\<omega>. V a \\<omega> \\<partial> \\<Psi>\\<^sub>1))\"\n    by (intro sum_mono a) \n  also have \"... = (\\<integral>\\<omega>. real (r x \\<omega>) \\<partial> \\<Psi>\\<^sub>1)\"\n    unfolding b by simp\n  finally show \"measure_pmf.variance \\<Psi>\\<^sub>1 (\\<lambda>\\<omega>. real (r x \\<omega>)) \\<le> (\\<integral>\\<omega>. real (r x \\<omega>) \\<partial> \\<Psi>\\<^sub>1)\" by simp\nqed\n\ndefinition E\\<^sub>1 where \"E\\<^sub>1 = (\\<lambda>(f,g,h). 2 powr (-t f) * X \\<in> {b/2^16..b/2})\"\n\nlemma t_low: \n  \"measure \\<Psi>\\<^sub>1 {f. of_int (t f) < log 2 (real X) + 1 - b_exp} \\<le> 1/2^7\" (is \"?L \\<le> ?R\")\nproof (cases \"log 2 (real X) \\<ge> 8\")\n  case True\n  define Z :: \"(nat \\<Rightarrow> nat) \\<Rightarrow> real\" where \"Z = r (nat \\<lceil>log 2 (real X) - 8\\<rceil>)\"\n\n  have \"log 2 (real X) \\<le> log 2 (real n)\"\n    using X_le_n X_ge_1 by (intro log_mono) auto\n  hence \"nat \\<lceil>log 2 (real X) - 8\\<rceil> \\<le> nat \\<lceil>log 2 (real n)\\<rceil>\"\n    by (intro nat_mono ceiling_mono) simp\n  hence a:\"(nat \\<lceil>log 2 (real X) - 8\\<rceil> \\<le> max (nat \\<lceil>log 2 (real n)\\<rceil>) 1)\" \n    by simp\n\n  have b:\"real (nat (\\<lceil>log 2 (real X)\\<rceil> - 8)) \\<le> log 2 (real X) - 7\"\n    using True by linarith\n\n  have \"2 ^ 7 = real X / (2 powr (log 2 X) * 2 powr (-7))\"\n    using X_ge_1 by simp\n  also have \"... = real X / (2 powr (log 2 X - 7))\"\n    by (subst powr_add[symmetric]) simp\n  also have \"... \\<le> real X / (2 powr (real (nat \\<lceil>log 2 (real X) - 8\\<rceil>)))\"\n    using b by (intro divide_left_mono powr_mono) auto\n  also have \"... = real X / 2 ^ nat \\<lceil>log 2 (real X) - 8\\<rceil>\"\n    by (subst powr_realpow) auto\n  finally have \"2 ^ 7 \\<le> real X / 2 ^ nat \\<lceil>log 2 (real X) - 8\\<rceil>\" \n    by simp\n  hence exp_Z_gt_2_7: \"(\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1) \\<ge> 2^7\" \n    using a unfolding Z_def r_exp by simp\n\n  have var_Z_le_exp_Z: \"measure_pmf.variance \\<Psi>\\<^sub>1 Z \\<le> (\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1)\" \n    unfolding Z_def by (intro r_var)\n\n  have \"?L \\<le> measure \\<Psi>\\<^sub>1 {f. of_nat (Max (f ` A)) < log 2 (real X) - 8}\"\n    unfolding t_def by (intro pmf_mono) (auto simp add:int_of_nat_def)\n  also have \"... \\<le> measure \\<Psi>\\<^sub>1 {f \\<in> space \\<Psi>\\<^sub>1.  (\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1) \\<le> \\<bar>Z f - (\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1) \\<bar>}\"\n  proof (rule pmf_mono)\n    fix f assume \"f \\<in> set_pmf (sample_pmf \\<Psi>\\<^sub>1)\"\n    have fin_f_A: \"finite (f ` A)\" using fin_A finite_imageI by blast\n    assume \" f \\<in> {f. real (Max (f ` A)) < log 2 (real X) - 8}\"\n    hence \"real (Max (f ` A)) < log 2 (real X) - 8\" by auto\n    hence \"real (f a) < log 2 (real X) - 8\" if \"a \\<in> A\" for a\n      using Max_ge[OF fin_f_A] imageI[OF that]  order_less_le_trans by fastforce\n    hence \"of_nat (f a) < \\<lceil>log 2 (real X) - 8\\<rceil>\" if \"a \\<in> A\" for a\n      using that by (subst less_ceiling_iff) auto\n    hence \"f a < nat \\<lceil>log 2 (real X) - 8\\<rceil>\" if \"a \\<in> A\" for a\n      using that True by fastforce\n    hence \"r (nat \\<lceil>log 2 (real X) - 8\\<rceil>) f = 0\"\n      unfolding r_def card_eq_0_iff using not_less by auto\n    hence \"Z f = 0\"\n      unfolding Z_def by simp\n    thus \"f \\<in> {f \\<in> space \\<Psi>\\<^sub>1.  (\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1) \\<le> \\<bar>Z f - (\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1)\\<bar>}\"\n      by auto\n  qed\n  also have \"... \\<le> measure_pmf.variance \\<Psi>\\<^sub>1 Z / (\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1)^2\" \n    using exp_Z_gt_2_7 \\<Psi>\\<^sub>1.sample_space by (intro measure_pmf.second_moment_method) simp_all\n  also have \"... \\<le> (\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1) / (\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1)^2\" \n    by (intro divide_right_mono var_Z_le_exp_Z) simp\n  also have \"... = 1 / (\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1)\" \n    using exp_Z_gt_2_7 by (simp add:power2_eq_square)\n  also have \"... \\<le> ?R\" \n    using exp_Z_gt_2_7 by (intro divide_left_mono) auto\n  finally show ?thesis by simp\nnext\n  case \"False\"\n  have \"?L \\<le> measure \\<Psi>\\<^sub>1 {f. of_nat (Max (f ` A)) < log 2 (real X) - 8}\"\n    unfolding t_def by (intro pmf_mono) (auto simp add:int_of_nat_def)\n  also have \"... \\<le> measure \\<Psi>\\<^sub>1 {}\"\n    using False by (intro pmf_mono) simp\n  also have \"... = 0\"\n    by simp\n  also have \"... \\<le> ?R\" by simp\n  finally show ?thesis by simp\nqed\n\nlemma t_high: \n  \"measure \\<Psi>\\<^sub>1 {f. of_int (t f) > log 2 (real X) + 16 - b_exp} \\<le> 1/2^7\" (is \"?L \\<le> ?R\")\nproof -\n  define Z :: \"(nat \\<Rightarrow> nat) \\<Rightarrow> real\" where \"Z = r (nat \\<lfloor>log 2 (real X) + 8\\<rfloor>)\"\n\n  have Z_nonneg: \"Z f \\<ge> 0\" for f\n    unfolding Z_def r_def by simp\n\n  have \"(\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1) \\<le> real X / (2 ^ nat \\<lfloor>log 2 (real X) + 8\\<rfloor>)\"\n    unfolding Z_def r_exp by simp\n  also have \"... \\<le> real X / (2 powr (real (nat \\<lfloor>log 2 (real X) + 8\\<rfloor>)))\"\n    by (subst powr_realpow) auto\n  also have \"... \\<le> real X / (2 powr \\<lfloor>log 2 (real X) + 8\\<rfloor>)\"\n    by (intro divide_left_mono powr_mono) auto\n  also have \"... \\<le> real X / (2 powr (log 2 (real X) + 7))\"\n    by (intro divide_left_mono powr_mono, linarith) auto\n  also have \"... = real X / 2 powr (log 2 (real X)) / 2 powr 7\"\n    by (subst powr_add) simp\n  also have \"... \\<le> 1/2 powr 7\"\n    using X_ge_1 by (subst powr_log_cancel) auto\n  finally have Z_exp: \"(\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1) \\<le> 1/2^7\" \n    by simp\n\n  have \"?L \\<le> measure \\<Psi>\\<^sub>1 {f. of_nat (Max (f ` A)) > log 2 (real X) + 7}\"\n    unfolding t_def  by (intro pmf_mono) (auto simp add:int_of_nat_def)\n  also have \"... \\<le> measure \\<Psi>\\<^sub>1 {f. Z f \\<ge> 1}\"\n  proof (rule pmf_mono)\n    fix f assume \"f \\<in> set_pmf (sample_pmf \\<Psi>\\<^sub>1)\"\n    assume \" f \\<in> {f. real (Max (f ` A)) > log 2 (real X) + 7}\"\n    hence \"real (Max (f ` A)) > log 2 (real X) + 7\" by simp\n    hence \"int (Max (f ` A)) \\<ge> \\<lfloor>log 2 (real X) + 8\\<rfloor>\"\n      by linarith\n    hence \"Max (f ` A) \\<ge> nat \\<lfloor>log 2 (real X) + 8\\<rfloor>\"\n      by simp\n    moreover have \"f ` A \\<noteq> {}\" \"finite (f ` A)\"\n      using fin_A finite_imageI A_nonempty by auto\n    ultimately obtain fa where \"fa \\<in> f ` A\" \" fa \\<ge>  nat \\<lfloor>log 2 (real X) + 8\\<rfloor>\"\n      using Max_in by auto\n    then obtain ae where ae_def: \"ae \\<in> A\" \"nat \\<lfloor>log 2 (real X) + 8\\<rfloor> \\<le> f ae\"\n      by auto\n    hence \"r (nat \\<lfloor>log 2 (real X) + 8\\<rfloor>) f > 0\"\n      unfolding r_def card_gt_0_iff using fin_A by auto\n    hence \"Z f \\<ge> 1\"\n      unfolding Z_def by simp\n    thus \"f \\<in> {f. 1 \\<le> Z f}\" by simp\n  qed\n  also have \"... \\<le> (\\<integral>\\<omega>. Z \\<omega> \\<partial>\\<Psi>\\<^sub>1) / 1\"\n    using Z_nonneg using \\<Psi>\\<^sub>1.sample_space by (intro pmf_markov) auto\n  also have \"... \\<le> ?R\"\n    using Z_exp by simp\n  finally show ?thesis by simp\nqed\n\nlemma e_1: \"measure \\<Psi> {\\<psi>. \\<not>E\\<^sub>1 \\<psi>} \\<le> 1/2^6\"\nproof -\n  have \"measure \\<Psi>\\<^sub>1 {f. 2 powr (of_int (-t f)) * real X \\<notin> {real b/2^16..real b/2}} \\<le> \n    measure \\<Psi>\\<^sub>1 {f. 2 powr (of_int (-t f)) * real X < real b/2^16} + \n    measure \\<Psi>\\<^sub>1 {f. 2 powr (of_int (-t f)) * real X > real b/2}\"\n    by (intro pmf_add) auto\n  also have \"... \\<le> measure \\<Psi>\\<^sub>1 {f. of_int (t f) > log 2 X + 16 - b_exp} + \n                   measure \\<Psi>\\<^sub>1 {f. of_int (t f) < log 2 X + 1 - b_exp}\"\n  proof (rule add_mono)\n    show \"measure \\<Psi>\\<^sub>1 {f. 2 powr (of_int (-t f)) * real X < real b/2^16} \\<le> \n    measure \\<Psi>\\<^sub>1 {f. of_int (t f) > log 2 X + 16 - b_exp}\"\n    proof (rule pmf_mono)\n      fix f assume \"f \\<in> {f. 2 powr real_of_int (-t f) * real X < real b / 2 ^ 16}\"\n      hence \"2 powr real_of_int (-t f) * real X < real b / 2 ^ 16\"\n        by simp\n      hence \"log 2 (2 powr of_int (-t f) * real X) < log 2 (real b / 2^16)\"\n        using b_min X_ge_1 by (intro iffD2[OF log_less_cancel_iff]) auto\n      hence \"of_int (-t f) + log  2 (real X) < log 2 (real b / 2^16)\"\n        using X_ge_1 by (subst (asm) log_mult) auto\n      also have  \"... = real b_exp - log 2 (2 powr 16)\"\n        unfolding b_def by (subst log_divide) auto \n      also have \"... = real b_exp - 16\"\n        by (subst log_powr_cancel) auto\n      finally have \"of_int (-t f) + log 2 (real X) < real b_exp - 16\" by simp\n      thus \"f \\<in> {f. of_int (t f) > log 2 (real X) + 16 - b_exp}\"\n        by simp\n    qed\n  next\n    show \"measure \\<Psi>\\<^sub>1 {f. 2 powr of_int (-t f) * real X > real b/2} \\<le> \n      measure \\<Psi>\\<^sub>1 {f. of_int (t f) < log 2 X + 1 - b_exp}\"\n    proof (rule pmf_mono)\n      fix f assume \"f \\<in> {f. 2 powr real_of_int (-t f) * real X > real b / 2}\"\n      hence \"2 powr real_of_int (-t f) * real X > real b / 2\"\n        by simp\n      hence \"log 2 (2 powr of_int (-t f) * real X) > log 2 (real b / 2)\"\n        using b_min X_ge_1 by (intro iffD2[OF log_less_cancel_iff]) auto\n      hence \"of_int (-t f) + log  2 (real X) > log 2 (real b / 2)\"\n        using X_ge_1 by (subst (asm) log_mult) auto\n      hence  \"of_int (-t f) + log  2 (real X) > real b_exp - 1\"\n        unfolding b_def by (subst (asm) log_divide) auto \n      hence \"of_int (t f) < log 2 (real X) + 1 - b_exp\"\n        by simp\n      thus \"f \\<in> {f. of_int (t f) < log 2 (real X) + 1 - b_exp}\"\n        by simp\n    qed\n  qed\n  also have \"... \\<le> 1/2^7 + 1/2^7\"\n    by (intro add_mono t_low t_high)\n  also have \"... = 1/2^6\" by simp\n  finally have \"measure \\<Psi>\\<^sub>1 {f. 2 powr of_int (-t f) * real X \\<notin> {real b/2^16..real b/2}} \\<le> 1/2^6\" \n    by simp\n\n  thus ?thesis\n    unfolding sample_pmf_\\<Psi> E\\<^sub>1_def case_prod_beta\n    by (subst pair_pmf_prob_left)\nqed\n\ndefinition E\\<^sub>2 where \"E\\<^sub>2 = (\\<lambda>(f,g,h). \\<bar>card (R f) - X / 2^(s f)\\<bar> \\<le> \\<delta>/3 * X / 2^(s f))\"\n\nlemma e_2: \"measure \\<Psi> {\\<psi>. E\\<^sub>1 \\<psi> \\<and> \\<not>E\\<^sub>2 \\<psi>} \\<le> 1/2^6\" (is \"?L \\<le> ?R\")\nproof -\n  define t\\<^sub>m :: int where \"t\\<^sub>m = \\<lfloor>log 2 (real X)\\<rfloor> + 16 - b_exp\"\n\n  have t_m_bound: \"t\\<^sub>m \\<le> \\<lfloor>log 2 (real X)\\<rfloor> - 10\"\n    unfolding t\\<^sub>m_def using b_exp_ge_26 by simp\n\n  have \"real b / 2^16 = (real X * (1/ X)) * (real b / 2^16)\"\n    using X_ge_1 by simp\n  also have \"... = (real X * 2 powr (-log 2 X)) * (real b / 2^16)\" \n    using X_ge_1 by (subst powr_minus_divide) simp\n  also have \"... \\<le> (real X * 2 powr (- \\<lfloor>log 2 (real X)\\<rfloor>)) * (2 powr b_exp / 2^16)\"\n    unfolding b_def using powr_realpow\n    by (intro mult_mono powr_mono) auto\n  also have \"... = real X * (2 powr (- \\<lfloor>log 2 (real X)\\<rfloor>) * 2 powr(real b_exp-16))\"\n    by (subst powr_diff) simp\n  also have \"... = real X * 2 powr (- \\<lfloor>log 2 (real X)\\<rfloor> + (int b_exp - 16))\"\n    by (subst powr_add[symmetric]) simp\n  also have \"... = real X * 2 powr (-t\\<^sub>m)\"\n    unfolding t\\<^sub>m_def by (simp add:algebra_simps)\n  finally have c:\"real b / 2^16 \\<le> real X * 2 powr (-t\\<^sub>m)\" by simp\n\n  define T :: \"nat set\" where \"T = {x. (real X / 2^x \\<ge> real b / 2^16)}\"\n\n  have \"x \\<in> T \\<longleftrightarrow> int x \\<le> t\\<^sub>m\" for x\n  proof -\n    have \"x \\<in> T \\<longleftrightarrow> 2^ x \\<le> real X * 2^16 / b\"\n      using b_min by (simp add: field_simps T_def)\n    also have \"... \\<longleftrightarrow> log 2 (2^x) \\<le> log 2 (real X * 2^16 / b)\"\n      using X_ge_1 b_min by (intro log_le_cancel_iff[symmetric] divide_pos_pos) auto\n    also have \"... \\<longleftrightarrow> x \\<le> log 2 (real X * 2^16) - log 2 b\"\n      using X_ge_1 b_min by (subst log_divide) auto\n    also have \"... \\<longleftrightarrow> x \\<le> log 2 (real X) + log 2 (2 powr 16) - b_exp\"\n      unfolding b_def using X_ge_1 by (subst log_mult) auto\n    also have \"... \\<longleftrightarrow> x \\<le> \\<lfloor>log 2 (real X) + log 2 (2 powr 16) - b_exp\\<rfloor>\"\n      by linarith\n    also have \"... \\<longleftrightarrow> x \\<le> \\<lfloor>log 2 (real X) + 16 - real_of_int (int b_exp)\\<rfloor>\"\n      by (subst log_powr_cancel) auto\n    also have \"... \\<longleftrightarrow> x \\<le> t\\<^sub>m\"\n      unfolding t\\<^sub>m_def by linarith\n    finally show ?thesis by simp\n  qed\n  hence T_eq: \"T = {x. int x \\<le> t\\<^sub>m}\" by auto\n\n  have \"T = {x. int x < t\\<^sub>m+1}\"\n    unfolding T_eq by simp\n  also have \"... = {x. x < nat (t\\<^sub>m + 1)}\"\n    unfolding zless_nat_eq_int_zless by simp\n  finally have T_eq_2: \"T = {x. x < nat (t\\<^sub>m + 1)}\"\n    by simp\n                                              \n  have inj_1: \"inj_on ((-) (nat t\\<^sub>m)) T\"\n    unfolding T_eq by (intro inj_onI) simp\n  have fin_T: \"finite T\" \n    unfolding T_eq_2 by simp\n\n  have r_exp: \"(\\<integral>\\<omega>. real (r t \\<omega>) \\<partial>\\<Psi>\\<^sub>1) = real X / 2^t\" if \"t \\<in> T\" for t \n  proof -\n    have \"t \\<le> t\\<^sub>m\"\n      using that unfolding T_eq by simp\n    also have \"... \\<le> \\<lfloor>log 2 (real X)\\<rfloor> - 10\"\n      using t_m_bound by simp\n    also have \"... \\<le> \\<lfloor>log 2 (real X)\\<rfloor>\"\n      by simp\n    also have \"... \\<le> \\<lfloor>log 2 (real n)\\<rfloor>\"\n      using X_le_n X_ge_1 by (intro floor_mono log_mono) auto\n    also have \"... \\<le> \\<lceil>log 2 (real n)\\<rceil>\"\n      by simp\n    finally have \"t \\<le> \\<lceil>log 2 (real n)\\<rceil>\" by simp\n    hence \"t \\<le> max (nat \\<lceil>log 2 (real n)\\<rceil>) 1\"by simp\n    thus ?thesis\n      unfolding r_exp by simp\n  qed\n\n  have r_var: \"measure_pmf.variance \\<Psi>\\<^sub>1 (\\<lambda>\\<omega>. real (r t \\<omega>)) \\<le> real X / 2^t\" if \"t \\<in> T\" for t \n    using r_exp[OF that] r_var by metis\n\n  have \"9 = C\\<^sub>4 / \\<delta>\\<^sup>2 * \\<delta>^2/2^23\" \n    using \\<delta>_gt_0 by (simp add:C\\<^sub>4_def)\n  also have \"... = 2 powr (log 2 (C\\<^sub>4 /  \\<delta>\\<^sup>2)) *  \\<delta>^2/2^23\" \n    using \\<delta>_gt_0 C\\<^sub>4_def by (subst powr_log_cancel) auto\n  also have \"... \\<le> 2 powr b_exp * \\<delta>^2/2^23\" \n    unfolding b_exp_def\n    by (intro divide_right_mono mult_right_mono powr_mono, linarith) auto \n  also have \"... = b * \\<delta>^2/2^23\"  \n    using powr_realpow unfolding b_def by simp\n  also have \"... = (b/2^16) * (\\<delta>^2/2^7)\" \n    by simp\n  also have \"... \\<le> (X * 2 powr (-t\\<^sub>m)) * (\\<delta>^2/2^7)\" \n    by (intro mult_mono c) auto\n  also have \"... = X * (2 powr (-t\\<^sub>m) * 2 powr (-7)) * \\<delta>^2\" \n    using powr_realpow by simp\n  also have \"... = 2 powr (-t\\<^sub>m-7) * (\\<delta>^2 * X)\" \n    by (subst powr_add[symmetric]) (simp )\n  finally have \"9 \\<le> 2 powr (-t\\<^sub>m-7) * (\\<delta>^2 * X)\" by simp\n  hence b: \"9/ (\\<delta>^2 * X) \\<le> 2 powr (-t\\<^sub>m -7)\"\n    using \\<delta>_gt_0 X_ge_1\n    by (subst pos_divide_le_eq) auto\n\n  have a: \"measure \\<Psi>\\<^sub>1 {f.\\<bar>real (r t f)-real X/2^t\\<bar>> \\<delta>/3 *real X/2^t} \\<le> 2 powr (real t-t\\<^sub>m-7)\" \n    (is\"?L1 \\<le> ?R1\") if \"t \\<in> T\" for t\n  proof -\n    have \"?L1 \\<le> \\<P>(f in \\<Psi>\\<^sub>1. \\<bar>real (r t f) - real X / 2^t\\<bar> \\<ge>  \\<delta>/3 * real X / 2^t)\"\n      by (intro pmf_mono) auto\n    also have \"... = \\<P>(f in \\<Psi>\\<^sub>1. \\<bar>real (r t f)-(\\<integral>\\<omega>. real (r t \\<omega>) \\<partial> \\<Psi>\\<^sub>1)\\<bar> \\<ge> \\<delta>/3 * real X/2^t)\"\n      by (simp add: r_exp[OF that]) \n    also have \"... \\<le> measure_pmf.variance \\<Psi>\\<^sub>1 (\\<lambda>\\<omega>. real (r t \\<omega>)) / (\\<delta>/3 * real X / 2^t)^2\"\n      using X_ge_1 \\<delta>_gt_0 \\<Psi>\\<^sub>1.sample_space\n      by (intro measure_pmf.Chebyshev_inequality divide_pos_pos mult_pos_pos) auto\n    also have \"... \\<le> (X / 2^t) / (\\<delta>/3 * X / 2^t)^2\"\n      by (intro divide_right_mono r_var[OF that]) simp\n    also have \"... = 2^t*(9/ ( \\<delta>^2 * X))\"\n      by (simp add:power2_eq_square algebra_simps)\n    also have \"... \\<le> 2^t*(2 powr (-t\\<^sub>m-7))\"\n      by (intro mult_left_mono b) simp\n    also have \"... = 2 powr t * 2 powr (-t\\<^sub>m-7)\" \n      by (subst powr_realpow[symmetric]) auto\n    also have \"... = ?R1\"\n      by (subst powr_add[symmetric]) (simp add:algebra_simps)\n    finally show \"?L1 \\<le> ?R1\" by simp\n  qed\n\n  have \"\\<exists>y<nat (t\\<^sub>m + 1). x = nat t\\<^sub>m - y\" if \"x < nat (t\\<^sub>m+1)\" for x \n    using that by (intro exI[where x=\"nat t\\<^sub>m - x\"]) simp\n  hence T_reindex: \"(-) (nat t\\<^sub>m) ` {x. x < nat (t\\<^sub>m + 1)} = {..<nat (t\\<^sub>m + 1)}\"\n    by (auto simp add: set_eq_iff image_iff) \n\n  have \"?L \\<le> measure \\<Psi> {\\<psi>. (\\<exists>t \\<in> T. \\<bar>real (r t (fst \\<psi>))-real X/2^t\\<bar> > \\<delta>/3 * real X / 2^t)}\"\n  proof (rule pmf_mono)\n    fix \\<psi>\n    assume \"\\<psi> \\<in> set_pmf (sample_pmf \\<Psi>)\"\n    obtain f g h where \\<psi>_def: \"\\<psi> = (f,g,h)\" by (metis prod_cases3)\n    assume \"\\<psi> \\<in> {\\<psi>. E\\<^sub>1 \\<psi> \\<and> \\<not> E\\<^sub>2 \\<psi>}\"\n    hence a:\"2 powr ( -real_of_int (t f)) * real X \\<in> {real b/2^16..real b/2}\" and\n      b:\"\\<bar>card (R f) - real X / 2^(s f)\\<bar> >  \\<delta>/3 * X / 2^(s f)\"\n      unfolding E\\<^sub>1_def E\\<^sub>2_def by (auto simp add:\\<psi>_def)\n    have \"\\<bar>card (R f) - X / 2^(s f)\\<bar> = 0\" if \"s f= 0\"\n      using that by (simp add:R_def X_def)\n    moreover have \"( \\<delta>/3) * (X / 2^s f) \\<ge> 0\" \n      using \\<delta>_gt_0 X_ge_1 by (intro mult_nonneg_nonneg) auto\n    ultimately have \"False\" if \"s f = 0\" \n      using b that by simp\n    hence \"s f > 0\" by auto\n    hence \"t f = s f\" unfolding s_def by simp\n    hence \"2 powr (-real (s f)) * X \\<ge> b / 2^16\"\n      using a by simp\n    hence \"X / 2 powr (real (s f)) \\<ge> b / 2^16\"\n      by (simp add: divide_powr_uminus mult.commute)\n    hence \"real X / 2 ^ (s f) \\<ge> b / 2^16\"\n      by (subst (asm) powr_realpow, auto)\n    hence \"s f \\<in> T\" unfolding T_def by simp\n    moreover have \"\\<bar>r (s f) f - X / 2^s f\\<bar> >  \\<delta>/3 * X / 2^s f\" \n      using R_def r_def b by simp\n    ultimately have \"\\<exists>t \\<in> T. \\<bar>r t (fst \\<psi>) - X / 2^t\\<bar> >  \\<delta>/3 * X / 2^t\"\n      using \\<psi>_def by (intro bexI[where x=\"s f\"]) simp\n    thus \"\\<psi> \\<in> {\\<psi>. (\\<exists>t \\<in> T. \\<bar>r t (fst \\<psi>) - X / 2^t\\<bar> >  \\<delta>/3 * X / 2^t)}\" by simp\n  qed\n  also have \"... = measure \\<Psi>\\<^sub>1 {f. (\\<exists>t \\<in> T. \\<bar>real (r t f)-real X / 2^t\\<bar> > \\<delta>/3 * real X/2^t)}\"\n    unfolding sample_pmf_\\<Psi> by (intro pair_pmf_prob_left)\n  also have \"... = measure \\<Psi>\\<^sub>1 (\\<Union>t \\<in> T. {f. \\<bar>real (r t f)-real X / 2^t\\<bar> > \\<delta>/3 * real X/2^t})\"\n    by (intro measure_pmf_cong) auto\n  also have \"... \\<le> (\\<Sum>t \\<in> T. measure \\<Psi>\\<^sub>1 {f.\\<bar>real (r t f)-real X / 2^t\\<bar> > \\<delta>/3 * real X/2^t})\"\n    by (intro measure_UNION_le fin_T) (simp)\n  also have \"... \\<le> (\\<Sum>t \\<in> T.  2 powr (real t - of_int t\\<^sub>m - 7))\"\n    by (intro sum_mono a)\n  also have \"... = (\\<Sum>t \\<in> T.  2 powr (-int (nat t\\<^sub>m-t) - 7))\" \n    unfolding T_eq\n    by (intro sum.cong refl arg_cong2[where f=\"(powr)\"]) simp\n  also have \"... = (\\<Sum>x \\<in> (\\<lambda>x. nat t\\<^sub>m - x) ` T. 2 powr (-real x - 7))\"\n    by (subst sum.reindex[OF inj_1]) simp\n  also have \"... = (\\<Sum>x \\<in> (\\<lambda>x. nat t\\<^sub>m - x) ` T. 2 powr (-7) * 2 powr (-real x))\"\n    by (subst powr_add[symmetric]) (simp add:algebra_simps)\n  also have \"... = 1/2^7 * (\\<Sum>x \\<in> (\\<lambda>x. nat t\\<^sub>m - x) ` T. 2 powr (-real x))\"\n    by (subst sum_distrib_left) simp\n  also have \"... = 1/2^7 * (\\<Sum>x <nat (t\\<^sub>m+1). 2 powr (-real x))\"\n    unfolding T_eq_2 T_reindex\n    by (intro arg_cong2[where f=\"(*)\"] sum.cong) auto\n  also have \"... = 1/2^7 * (\\<Sum>x <nat (t\\<^sub>m+1). (2 powr (-1)) powr (real x))\"\n    by (subst powr_powr) simp\n  also have \"... = 1/2^7 * (\\<Sum>x <nat (t\\<^sub>m+1). (1/2)^x)\"\n    using powr_realpow by simp\n  also have \"... \\<le> 1/2^7 * 2\"\n    by(subst geometric_sum) auto\n  also have \"... = 1/2^6\" by simp\n  finally show ?thesis by simp\nqed\n\ndefinition E\\<^sub>3 where \"E\\<^sub>3 = (\\<lambda>(f,g,h). inj_on g (R f))\"\n\nlemma R_bound:\n  fixes f g h\n  assumes \"E\\<^sub>1 (f,g,h)\"\n  assumes \"E\\<^sub>2 (f,g,h)\"\n  shows \"card (R f) \\<le> 2/3 * b\"\nproof -\n  have \"real (card (R f)) \\<le> ( \\<delta> / 3) * (real X / 2 ^ s f) + real X / 2 ^ s f\"\n    using assms(2) unfolding E\\<^sub>2_def by simp\n  also have \"... \\<le> (1/3) * (real X / 2 ^ s f) + real X / 2 ^ s f\"\n    using \\<delta>_lt_1 by (intro add_mono mult_right_mono) auto\n  also have \"... = (4/3) * (real X / 2 powr s f)\"\n    using powr_realpow by simp\n  also have \"... \\<le> (4/3) * (real X / 2 powr t f)\"\n    unfolding s_def\n    by (intro mult_left_mono divide_left_mono powr_mono) auto\n  also have \"... = (4/3) * (2 powr (-(of_int (t f))) * real X)\"\n    by (subst powr_minus_divide) simp\n  also have \"... = (4/3) * (2 powr (- t f) * real X)\"\n    by simp\n  also have \"... \\<le> (4/3) * (b/2)\"\n    using assms(1) unfolding E\\<^sub>1_def\n    by (intro mult_left_mono) auto\n  also have \"... \\<le> (2/3) * b\" by simp\n  finally show ?thesis by simp\nqed\n\nlemma e_3: \"measure \\<Psi> {\\<psi>. E\\<^sub>1 \\<psi> \\<and> E\\<^sub>2 \\<psi> \\<and> \\<not>E\\<^sub>3 \\<psi>} \\<le> 1/2^6\" (is \"?L \\<le> ?R\")\nproof -\n  let ?\\<alpha> = \"(\\<lambda>(z,x,y) f. z < C\\<^sub>7*b^2 \\<and> x \\<in> R f \\<and> y \\<in> R f \\<and> x < y)\"\n  let ?\\<beta> = \"(\\<lambda>(z,x,y) g. g x = z \\<and> g y = z)\"\n\n  have \\<beta>_prob: \"measure \\<Psi>\\<^sub>2 {g. ?\\<beta> \\<omega> g} \\<le> (1/real (C\\<^sub>7*b^2)^2)\" \n    if \"?\\<alpha> \\<omega> f\" for \\<omega> f\n  proof -\n    obtain x y z where \\<omega>_def: \"\\<omega> = (z,x,y)\" by (metis prod_cases3)\n    have a:\"prob_space.k_wise_indep_vars \\<Psi>\\<^sub>2 2 (\\<lambda>i. discrete) (\\<lambda>x \\<omega>. \\<omega> x = z) {..<n}\"\n      by (intro prob_space.k_wise_indep_vars_compose[OF _ \\<Psi>\\<^sub>2.\\<H>_indep]) \n       (simp_all add:prob_space_measure_pmf)\n\n    have \"u \\<in> R f \\<Longrightarrow> u < n\" for u\n      unfolding R_def using A_range by auto\n    hence b: \"x < n\" \"y < n\" \"card {x, y} = 2\" \n      using that \\<omega>_def by auto\n    have c: \"z < C\\<^sub>7*b\\<^sup>2\" using \\<omega>_def that by simp\n\n    have \"measure \\<Psi>\\<^sub>2 {g. ?\\<beta> \\<omega> g} = measure \\<Psi>\\<^sub>2 {g. (\\<forall>\\<xi> \\<in> {x,y}. g \\<xi> = z)}\"\n      by (simp add:\\<omega>_def)\n    also have \"... = (\\<Prod>\\<xi> \\<in> {x,y}. measure \\<Psi>\\<^sub>2 {g. g \\<xi> = z})\"\n      using b by (intro measure_pmf.split_indep_events[OF refl, where I=\"{x,y}\"] \n          prob_space.k_wise_indep_vars_subset[OF _ a]) (simp_all add:prob_space_measure_pmf)\n    also have \"... = (\\<Prod>\\<xi> \\<in> {x,y}. measure (map_pmf (\\<lambda>\\<omega>. \\<omega> \\<xi>) (sample_pmf \\<Psi>\\<^sub>2)) {g. g = z}) \"\n      by (simp add:vimage_def) \n    also have \"... = (\\<Prod>\\<xi> \\<in> {x,y}. measure [C\\<^sub>7 * b\\<^sup>2]\\<^sub>S {g. g=z})\"\n      using b \\<Psi>\\<^sub>2.single by (intro prod.cong) fastforce+ \n    also have \"... = (\\<Prod>\\<xi> \\<in> {x,y}. measure (pmf_of_set {..<C\\<^sub>7 * b\\<^sup>2}) {z})\"\n      by (subst nat_sample_pmf) simp\n    also have \"... = (measure (pmf_of_set {..<C\\<^sub>7 * b\\<^sup>2}) {z})^2\"\n      using b by simp\n    also have \"... \\<le> (1 /(C\\<^sub>7*b\\<^sup>2))^2\"\n      using c by (subst measure_pmf_of_set) auto\n    also have \"... = (1 /(C\\<^sub>7*b\\<^sup>2)^2)\"\n      by (simp add:algebra_simps power2_eq_square)\n    finally show ?thesis by simp\n  qed\n  \n  have \\<alpha>_card: \"card {\\<omega>. ?\\<alpha> \\<omega> f} \\<le> (C\\<^sub>7*b^2) * (card (R f) * (card (R f)-1)/2)\" \n    (is \"?TL \\<le> ?TR\") and fin_\\<alpha>: \"finite {\\<omega>. ?\\<alpha> \\<omega> f}\" (is \"?T2\") for f\n  proof -\n    have t1: \"{\\<omega>. ?\\<alpha> \\<omega> f} \\<subseteq> {..<C\\<^sub>7*b^2} \\<times> {(x,y) \\<in> R f \\<times> R f. x < y}\" \n      by (intro subsetI) auto\n    moreover have \"card ({..<C\\<^sub>7*b^2} \\<times> {(x,y) \\<in> R f \\<times> R f. x < y}) = ?TR\"\n      using  card_ordered_pairs'[where M=\"R f\"]\n      by (simp add: card_cartesian_product) \n    moreover have \"finite (R f)\" \n      unfolding R_def using fin_A finite_subset by simp    \n    hence \"finite {(x, y). (x, y) \\<in> R f \\<times> R f \\<and> x < y}\"\n      by (intro finite_subset[where B=\"R f \\<times> R f\", OF _ finite_cartesian_product]) auto\n    hence t2: \"finite ({..<C\\<^sub>7*b^2} \\<times> {(x,y) \\<in> R f \\<times> R f. x < y})\"\n      by (intro finite_cartesian_product) auto\n    ultimately show \"?TL \\<le> ?TR\" \n      using card_mono of_nat_le_iff by (metis (no_types, lifting)) \n    show ?T2 \n      using finite_subset[OF t1 t2] by simp\n  qed\n\n  have \"?L \\<le> measure \\<Psi> {(f,g,h). card (R f) \\<le> b \\<and> (\\<exists> x y z. ?\\<alpha> (x,y,z) f \\<and> ?\\<beta> (x,y,z) g)}\"\n  proof (rule pmf_mono)\n    fix \\<psi> assume b:\"\\<psi> \\<in> set_pmf (sample_pmf \\<Psi>)\"\n    obtain f g h where \\<psi>_def:\"\\<psi> = (f,g,h)\" by (metis prod_cases3)\n    have \"(f,g,h) \\<in> sample_set \\<Psi>\"\n      using sample_space_alt[OF sample_space_\\<Psi>] b \\<psi>_def by simp\n    hence c:\"g x < C\\<^sub>7*b^2\" for x\n      using g_range by simp\n\n    assume a:\"\\<psi> \\<in> {\\<psi>. E\\<^sub>1 \\<psi> \\<and> E\\<^sub>2 \\<psi> \\<and> \\<not> E\\<^sub>3 \\<psi>}\"\n    hence \"card (R f) \\<le> 2/3 * b\"\n      using R_bound \\<psi>_def by force\n    moreover have \"\\<exists>a b. a \\<in> R f \\<and> b \\<in> R f \\<and> a \\<noteq> b \\<and> g a = g b\"\n      using a unfolding \\<psi>_def E\\<^sub>3_def inj_on_def by auto\n    hence \"\\<exists>x y. x \\<in> R f \\<and> y \\<in> R f \\<and> x < y \\<and> g x = g y\"\n      by (metis not_less_iff_gr_or_eq)\n    hence \"\\<exists>x y z. ?\\<alpha> (x,y,z) f \\<and> ?\\<beta> (x,y,z) g\"\n      using c by blast\n    ultimately show \"\\<psi> \\<in> {(f, g, h). card (R f) \\<le> b \\<and> (\\<exists> x y z. ?\\<alpha> (x,y,z) f \\<and> ?\\<beta> (x,y,z) g)}\"\n      unfolding \\<psi>_def by auto\n  qed\n  also have \"... = (\\<integral>f. measure (pair_pmf \\<Psi>\\<^sub>2 \\<Psi>\\<^sub>3)\n     {g. card (R f) \\<le> b \\<and> (\\<exists>x y z. ?\\<alpha> (x,y,z) f \\<and> ?\\<beta> (x,y,z) (fst g))} \\<partial>\\<Psi>\\<^sub>1)\"\n    unfolding sample_pmf_\\<Psi> split_pair_pmf by (simp add: case_prod_beta)\n  also have \n    \"... = (\\<integral>f. measure \\<Psi>\\<^sub>2 {g. card (R f) \\<le> b \\<and> (\\<exists>x y z. ?\\<alpha> (x,y,z) f \\<and> ?\\<beta> (x,y,z) g)} \\<partial>\\<Psi>\\<^sub>1)\"\n    by (subst pair_pmf_prob_left) simp\n  also have \"... \\<le> (\\<integral>f. 1/real (2*C\\<^sub>7) \\<partial>\\<Psi>\\<^sub>1)\"\n  proof (rule pmf_exp_mono[OF integrable_sample_pmf[OF \\<Psi>\\<^sub>1.sample_space] \n          integrable_sample_pmf[OF \\<Psi>\\<^sub>1.sample_space]]) \n    fix f assume \"f \\<in> set_pmf (sample_pmf \\<Psi>\\<^sub>1)\"\n    show \"measure \\<Psi>\\<^sub>2 {g. card (R f) \\<le> b \\<and> (\\<exists>x y z. ?\\<alpha> (x,y,z) f \\<and> ?\\<beta> (x,y,z) g)} \\<le> 1 / real (2 * C\\<^sub>7)\" \n      (is \"?L1 \\<le> ?R1\")\n    proof (cases \"card (R f) \\<le> b\")\n      case True\n      have \"?L1 \\<le> measure \\<Psi>\\<^sub>2 (\\<Union> \\<omega> \\<in> {\\<omega>. ?\\<alpha> \\<omega> f}. {g. ?\\<beta> \\<omega> g})\"\n        by (intro pmf_mono) auto\n      also have \"... \\<le> (\\<Sum>\\<omega> \\<in> {\\<omega>. ?\\<alpha> \\<omega> f}. measure \\<Psi>\\<^sub>2 {g. ?\\<beta> \\<omega> g})\"\n        by (intro measure_UNION_le fin_\\<alpha>) auto\n      also have \"... \\<le> (\\<Sum>\\<omega> \\<in> {\\<omega>. ?\\<alpha> \\<omega> f}. (1/real (C\\<^sub>7*b^2)^2))\"\n        by (intro sum_mono \\<beta>_prob) auto\n      also have \"... = card {\\<omega>. ?\\<alpha> \\<omega> f} /(C\\<^sub>7*b^2)^2\"\n        by simp\n      also have \"... \\<le> (C\\<^sub>7*b^2) * (card (R f) * (card (R f)-1)/2) / (C\\<^sub>7*b^2)^2\"\n        by (intro \\<alpha>_card divide_right_mono) simp\n      also have \"... \\<le> (C\\<^sub>7*b^2) * (b * b / 2)  / (C\\<^sub>7*b^2)^2\"\n        unfolding C\\<^sub>7_def using True \n        by (intro divide_right_mono Nat.of_nat_mono mult_mono) auto\n      also have \"... = 1/(2*C\\<^sub>7)\"\n        using b_min by (simp add:algebra_simps power2_eq_square)\n      finally show ?thesis by simp\n    next\n      case False\n      then show ?thesis by simp\n    qed\n  qed\n  also have \"... \\<le> 1/2^6\"\n    unfolding C\\<^sub>7_def by simp\n  finally show ?thesis by simp\nqed\n\ndefinition E\\<^sub>4 where \"E\\<^sub>4 = (\\<lambda>(f,g,h). \\<bar>p (f,g,h) - \\<rho> (card (R f))\\<bar> \\<le>  \\<delta>/12 * card (R f))\"\n\nlemma e_4_h: \"9 / sqrt b \\<le> \\<delta> / 12\"\nproof -\n  have \"108 \\<le> sqrt (C\\<^sub>4)\"\n    unfolding C\\<^sub>4_def by (approximation 5)\n  also have \"... \\<le> sqrt( \\<delta>^2 * real b)\"\n    using b_lower_bound \\<delta>_gt_0\n    by (intro real_sqrt_le_mono) (simp add: pos_divide_le_eq algebra_simps)\n  also have \"... =  \\<delta> * sqrt b\"\n    using \\<delta>_gt_0 by (simp add:real_sqrt_mult)\n  finally have \"108 \\<le>  \\<delta> * sqrt b\"  by simp\n  thus ?thesis\n    using b_min by (simp add:pos_divide_le_eq)\nqed\n\nlemma e_4: \"measure \\<Psi> {\\<psi>. E\\<^sub>1 \\<psi> \\<and> E\\<^sub>2 \\<psi> \\<and> E\\<^sub>3 \\<psi> \\<and> \\<not>E\\<^sub>4 \\<psi>} \\<le> 1/2^6\" (is \"?L \\<le> ?R\")\nproof -\n  have a: \"measure \\<Psi>\\<^sub>3 {h. E\\<^sub>1 (f,g,h) \\<and> E\\<^sub>2 (f,g,h) \\<and> E\\<^sub>3 (f,g,h) \\<and> \\<not>E\\<^sub>4 (f,g,h)} \\<le> 1/2^6\" \n    (is \"?L1 \\<le> ?R1\") if \"f \\<in> set_pmf (sample_pmf \\<Psi>\\<^sub>1)\" \"g \\<in> set_pmf(sample_pmf \\<Psi>\\<^sub>2)\"\n    for f g \n  proof (cases \"card (R f) \\<le> b \\<and> inj_on g (R f)\")\n    case True\n\n    have g_inj: \"inj_on g (R f)\"\n      using True by simp\n\n    have fin_R: \"finite (g ` R f)\"\n      unfolding R_def using fin_A\n      by (intro finite_imageI) simp\n\n    interpret B:balls_and_bins_abs \"g ` R f\" \"{..<b}\"\n      using fin_R b_ne by unfold_locales auto \n\n    have \"range g \\<subseteq> {..<C\\<^sub>7 * b\\<^sup>2}\"\n      using g_range_1 that(2) unfolding sample_space_alt[OF \\<Psi>\\<^sub>2.sample_space] by auto\n    hence g_ran: \"g ` R f \\<subseteq> {..<C\\<^sub>7 * b\\<^sup>2}\" \n      by auto\n\n    have \"sample_pmf [b]\\<^sub>S = pmf_of_set {..<b}\" \n      unfolding sample_pmf_def nat_sample_space_def by simp\n    hence \" map_pmf (\\<lambda>\\<omega>. \\<omega> x) (sample_pmf (\\<H> k (C\\<^sub>7 * b\\<^sup>2) [b]\\<^sub>S)) = pmf_of_set {..<b}\"\n      if \"x \\<in> g ` R f\" for x \n      using g_ran \\<Psi>\\<^sub>3.single that by auto\n    moreover have \"prob_space.k_wise_indep_vars \\<Psi>\\<^sub>3 k (\\<lambda>_. discrete) (\\<lambda>x \\<omega>. \\<omega> x) (g ` R f)\"\n      by (intro prob_space.k_wise_indep_subset[OF _ _ \\<Psi>\\<^sub>3.\\<H>_indep] g_ran prob_space_measure_pmf)\n    ultimately have lim_balls_and_bins: \"B.lim_balls_and_bins k (sample_pmf (\\<H> k (C\\<^sub>7 * b\\<^sup>2) [b]\\<^sub>S))\"\n      unfolding B.lim_balls_and_bins_def by auto\n\n    have card_g_R: \"card (g ` R f) = card (R f)\" \n      using True card_image by auto\n    hence b_mu: \"\\<rho> (card (R f)) = B.\\<mu>\"\n      unfolding B.\\<mu>_def \\<rho>_def using b_min by (simp add:powr_realpow)\n\n    have card_g_le_b: \"card (g ` R f) \\<le> card {..<b}\"\n      unfolding card_g_R using True by simp\n\n    have \"?L1 \\<le> measure \\<Psi>\\<^sub>3 {h. \\<bar>B.Y h - B.\\<mu>\\<bar> > 9 * real (card (g ` R f)) / sqrt (card {..<b})}\"\n    proof (rule pmf_mono)\n      fix h assume \"h \\<in> {h. E\\<^sub>1 (f,g,h) \\<and> E\\<^sub>2 (f,g,h) \\<and> E\\<^sub>3 (f,g,h) \\<and> \\<not>E\\<^sub>4 (f,g,h)}\"\n      hence b: \"\\<bar>p (f,g,h) -\\<rho> (card (R f))\\<bar> >  \\<delta>/12 * card (R f)\"\n        unfolding E\\<^sub>4_def by simp\n      assume \"h \\<in> set_pmf (sample_pmf \\<Psi>\\<^sub>3)\"\n      hence h_range: \"h x < b\" for x\n        unfolding sample_space_alt[OF \\<Psi>\\<^sub>3.sample_space,symmetric] using h_range_1 by simp\n\n      have \"{j \\<in> {..<b}. int (s f) \\<le> \\<tau>\\<^sub>1 (f, g, h) A 0 j} =\n        {j \\<in> {..<b}. int (s f) \\<le> max (Max ({int (f a) |a. a \\<in> A \\<and> h (g a) = j} \\<union> {-1})) (- 1)}\"\n        unfolding \\<tau>\\<^sub>1_def by simp\n      also have \"... = {j \\<in> {..<b}. int (s f) \\<le> Max ({int (f a) |a. a \\<in> A \\<and> h (g a) = j} \\<union> {-1})}\"\n        using fin_A by (subst max_absorb1) (auto intro: Max_ge)\n      also have \"... = {j \\<in> {..<b}. (\\<exists>a \\<in> R f. h (g a) = j)}\"\n        unfolding R_def using fin_A by (subst Max_ge_iff) auto\n      also have \"... = {j. \\<exists>a \\<in> R f. h (g a) = j}\"\n        using h_range by auto\n      also have \"... = (h \\<circ> g) ` (R f)\"\n        by (auto simp add:set_eq_iff image_iff)\n      also have \"... = h ` (g ` (R f))\"\n        by (simp add:image_image)\n      finally have c:\"{j \\<in> {..<b}. int (s f) \\<le> \\<tau>\\<^sub>1 (f, g, h) A 0 j} = h ` (g ` R f)\"\n        by simp \n      have \"9 * real (card (g ` R f)) / sqrt (card {..<b}) = 9/ sqrt b * real (card (R f))\"\n        using card_image[OF g_inj] by simp\n      also have \"... \\<le>  \\<delta>/12 * card (R f)\" \n        by (intro mult_right_mono e_4_h) simp\n      also have \"... < \\<bar>B.Y h - B.\\<mu>\\<bar>\"\n        using b c unfolding B.Y_def p_def b_mu by simp\n      finally show \"h \\<in> {h. \\<bar>B.Y h - B.\\<mu>\\<bar> >  9 * real (card (g ` R f)) / sqrt (card {..<b})}\"\n        by simp\n    qed\n    also have \"... \\<le> 1/2^6\"\n      using k_min\n      by (intro B.devitation_bound[OF card_g_le_b lim_balls_and_bins]) auto\n    finally show ?thesis by simp\n  next\n    case False\n    have \"?L1 \\<le> measure \\<Psi>\\<^sub>3 {}\"\n    proof (rule pmf_mono)\n      fix h assume b:\"h \\<in> {h. E\\<^sub>1 (f, g, h) \\<and> E\\<^sub>2 (f, g, h) \\<and> E\\<^sub>3 (f, g, h) \\<and> \\<not> E\\<^sub>4 (f, g, h)}\"\n      hence \"card (R f) \\<le> (2/3)*b\"\n        by (auto intro!: R_bound[simplified])\n      hence \"card (R f) \\<le> b\" \n        by simp\n      moreover have \"inj_on g (R f)\"\n        using b by (simp add:E\\<^sub>3_def)\n      ultimately have \"False\" using False by simp\n      thus \"h \\<in> {}\" by simp\n    qed\n    also have \"... = 0\" by simp\n    finally show ?thesis by simp\n  qed\n\n  have \"?L = (\\<integral>f. (\\<integral>g. \n    measure \\<Psi>\\<^sub>3 {h. E\\<^sub>1 (f,g,h) \\<and> E\\<^sub>2 (f,g,h) \\<and> E\\<^sub>3 (f,g,h) \\<and> \\<not>E\\<^sub>4 (f,g,h)} \\<partial>\\<Psi>\\<^sub>2) \\<partial>\\<Psi>\\<^sub>1)\"\n    unfolding sample_pmf_\\<Psi> split_pair_pmf by simp\n  also have \"... \\<le> (\\<integral>f. (\\<integral>g.  1/2^6  \\<partial>\\<Psi>\\<^sub>2) \\<partial>\\<Psi>\\<^sub>1)\"\n    using a \\<Psi>\\<^sub>1.sample_space \\<Psi>\\<^sub>2.sample_space\n    by (intro integral_mono_AE AE_pmfI) simp_all\n  also have \"... = 1/2^6\" \n    by simp\n  finally show ?thesis by simp\nqed\n\nlemma \\<rho>_inverse: \"\\<rho>_inv (\\<rho> x) = x\"\nproof -\n  have a:\"1-1/b \\<noteq> 0\" \n    using b_min by simp\n\n  have \"\\<rho> x = b * (1-(1-1/b) powr x)\" \n    unfolding \\<rho>_def by simp\n  hence \"\\<rho> x / real b = 1-(1-1/b) powr x\" by simp\n  hence \"ln (1 - \\<rho> x / real b) = ln ((1-1/b) powr x)\" by simp\n  also have \"... = x * ln (1 - 1/ b)\" \n    using a by (intro ln_powr) \n  finally have \"ln (1 - \\<rho> x / real b) = x * ln (1- 1/ b)\"\n    by simp\n  moreover have \"ln (1-1/b) < 0\" \n    using b_min by (subst ln_less_zero_iff) auto\n  ultimately show ?thesis\n    using \\<rho>_inv_def by simp\nqed\n\nlemma rho_mono:\n  assumes \"x \\<le> y\"\n  shows \"\\<rho> x \\<le> \\<rho> y\" \nproof-\n  have \"(1 - 1 / real b) powr y \\<le> (1 - 1 / real b) powr x\" \n    using b_min\n    by (intro powr_mono_rev assms) auto\n  thus ?thesis \n    unfolding \\<rho>_def by (intro mult_left_mono) auto\nqed\n\nlemma rho_two_thirds: \"\\<rho> (2/3 * b) \\<le> 3/5 *b\"\nproof -\n  have \"1/3 \\<le> exp ( - 13 / 12::real )\" \n    by (approximation 8)\n  also have \"... \\<le> exp ( - 1 - 2 / real b )\" \n    using b_min by (intro iffD2[OF exp_le_cancel_iff]) (simp add:algebra_simps)\n  also have \"... \\<le> exp ( b * (-(1/real b)-2*(1/real b)^2))\" \n    using b_min by (simp add:algebra_simps power2_eq_square)\n  also have  \"... \\<le> exp ( b * ln (1-1/real b))\" \n    using b_min\n    by (intro iffD2[OF exp_le_cancel_iff] mult_left_mono ln_one_minus_pos_lower_bound) auto\n  also have \"... = exp ( ln ( (1-1/real b) powr b))\"\n    using b_min by (subst ln_powr) auto\n  also have \"... = (1-1/real b) powr b\" \n    using b_min by (subst exp_ln) auto\n  finally have a:\"1/3 \\<le> (1-1/real b) powr b\" by simp\n\n  have \"2/5 \\<le> (1/3) powr (2/3::real)\"\n    by (approximation 5)\n  also have \"... \\<le> ((1-1/real b) powr b) powr (2/3)\" \n    by (intro powr_mono2 a) auto\n  also have \"... = (1-1/real b) powr (2/3 * real b)\" \n    by (subst powr_powr) (simp add:algebra_simps)\n  finally have \"2/5 \\<le> (1 - 1 / real b) powr (2 / 3 * real b)\" by simp\n  hence \"1 - (1 - 1 / real b) powr (2 / 3 * real b) \\<le> 3/5\"\n    by simp\n  hence \"\\<rho> (2/3 * b) \\<le> b * (3/5)\"\n    unfolding \\<rho>_def by (intro mult_left_mono) auto\n  thus ?thesis\n    by simp\nqed\n\ndefinition \\<rho>_inv' :: \"real \\<Rightarrow> real\"\n  where \"\\<rho>_inv' x = -1 / (real b * (1-x / real b) * ln (1 - 1 / real b))\"\n\nlemma \\<rho>_inv'_bound:\n  assumes \"x \\<ge> 0\"\n  assumes \"x \\<le> 59/90*b\"\n  shows \"\\<bar>\\<rho>_inv' x\\<bar> \\<le> 4\"\nproof -\n  have c:\"ln (1 - 1 / real b) < 0\"\n    using b_min\n    by (subst ln_less_zero_iff) auto\n  hence d:\"real b * (1 - x / real b) * ln (1 - 1 / real b) < 0\"\n    using b_min assms by (intro Rings.mult_pos_neg) auto\n\n  have \"(1::real) \\<le> 31/30\" by simp\n  also have \"... \\<le> (31/30) * (b * -(- 1 / real b))\" \n    using b_min by simp\n  also have \"... \\<le> (31/30) * (b * -ln (1 + (- 1 / real b)))\" \n    using b_min\n    by (intro mult_left_mono le_imp_neg_le  ln_add_one_self_le_self2) auto\n  also have \"... \\<le> 3 * (31/90) * (- b * ln (1 - 1 / real b))\"\n    by simp\n  also have \"... \\<le> 3 * (1 - x / real b) * (- b * ln (1 - 1 / real b))\" \n    using assms b_min pos_divide_le_eq[where c=\"b\"] c\n    by (intro mult_right_mono mult_left_mono mult_nonpos_nonpos) auto\n  also have \"... \\<le> 3 * (real b * (1 - x / real b) * (-ln (1 - 1 / real b)))\"\n    by (simp add:algebra_simps)\n  finally have \"3 * (real b * (1 - x / real b) * (-ln (1 - 1 / real b))) \\<ge> 1\" by simp\n  hence \"3 * (real b * (1 - x / real b) * ln (1 - 1 / real b)) \\<le> -1\" by simp\n  hence \"\\<rho>_inv' x \\<le> 3\"\n    unfolding \\<rho>_inv'_def using d\n    by (subst neg_divide_le_eq) auto\n  moreover have \"\\<rho>_inv' x > 0\" \n    unfolding \\<rho>_inv'_def using d by (intro divide_neg_neg) auto\n  ultimately show ?thesis by simp\nqed\n\nlemma \\<rho>_inv':\n  fixes x :: real\n  assumes \"x < b\"\n  shows \"DERIV \\<rho>_inv x :> \\<rho>_inv' x\" \nproof -\n  have \"DERIV (ln \\<circ> (\\<lambda>x. (1 - x / real b))) x :> 1 / (1-x / real b) * (0 -1/b)\"\n    using assms b_min\n    by (intro DERIV_chain DERIV_ln_divide DERIV_cdivide derivative_intros) auto\n  hence \"DERIV \\<rho>_inv x :> (1 / (1-x / real b) * (-1/b)) / ln (1-1/real b)\"\n    unfolding comp_def \\<rho>_inv_def by (intro DERIV_cdivide) auto\n  thus ?thesis\n    by (simp add:\\<rho>_inv'_def algebra_simps)\nqed\n\nlemma accuracy_without_cutoff: \n  \"measure \\<Psi> {(f,g,h). \\<bar>Y (f,g,h) - real X\\<bar> > \\<delta> * X \\<or> s f < q_max} \\<le> 1/2^4\" \n  (is \"?L \\<le> ?R\")\nproof -\n  have \"?L \\<le> measure \\<Psi> {\\<psi>. \\<not>E\\<^sub>1 \\<psi> \\<or>  \\<not>E\\<^sub>2 \\<psi> \\<or>  \\<not>E\\<^sub>3 \\<psi> \\<or>  \\<not>E\\<^sub>4 \\<psi>}\"\n  proof (rule pmf_rev_mono)\n    fix \\<psi> assume \"\\<psi> \\<in> set_pmf (sample_pmf \\<Psi>)\"\n    obtain f g h where \\<psi>_def: \"\\<psi> = (f,g,h)\" by (metis prod_cases3)\n    \n    assume \"\\<psi> \\<notin> {\\<psi>. \\<not> E\\<^sub>1 \\<psi> \\<or> \\<not> E\\<^sub>2 \\<psi> \\<or> \\<not> E\\<^sub>3 \\<psi> \\<or> \\<not> E\\<^sub>4 \\<psi>}\"\n    hence assms: \"E\\<^sub>1 (f,g,h)\" \"E\\<^sub>2 (f,g,h)\" \"E\\<^sub>3 (f,g,h)\" \"E\\<^sub>4 (f,g,h)\"\n      unfolding \\<psi>_def by auto\n\n    define I :: \"real set\" where \"I = {0..59/90*b}\"\n\n    have \"p (f,g,h) \\<le> \\<rho> (card (R f)) + \\<delta>/12 * card (R f)\"\n      using assms(4) E\\<^sub>4_def unfolding abs_le_iff by simp\n    also have \"... \\<le> \\<rho>(2/3*b) + 1/12* (2/3*b)\"\n      using \\<delta>_lt_1 R_bound[OF assms(1,2)]\n      by (intro add_mono rho_mono mult_mono) auto\n    also have \"... \\<le> 3/5 * b + 1/18*b\"\n      by (intro add_mono rho_two_thirds) auto\n    also have \"... \\<le> 59/90 * b\"\n       by simp\n    finally have \"p (f,g,h) \\<le> 59/90 * b\" by simp\n    hence p_in_I: \"p (f,g,h) \\<in> I\"\n      unfolding I_def by simp\n\n    have \"\\<rho> (card (R f)) \\<le> \\<rho>(2/3 * b)\"\n      using  R_bound[OF assms(1,2)]\n      by (intro rho_mono) auto\n    also have \"... \\<le> 3/5 * b\"\n      using rho_two_thirds by simp\n    also have \"... \\<le> b * 59/90\" by simp\n    finally have \"\\<rho> (card (R f)) \\<le> b * 59/90\" by simp\n    moreover have \"(1 - 1 / real b) powr (real (card (R f))) \\<le> 1 powr (real (card (R f)))\" \n      using b_min by (intro powr_mono2) auto\n    hence \"\\<rho> (card (R f)) \\<ge> 0\"\n      unfolding \\<rho>_def by (intro mult_nonneg_nonneg) auto\n    ultimately have \"\\<rho> (card (R f)) \\<in> I\"\n      unfolding I_def by simp\n\n    moreover have \"interval I\" \n      unfolding I_def interval_def by simp\n    moreover have \"59 / 90 * b < b\" \n      using b_min by simp\n    hence \"DERIV \\<rho>_inv x :> \\<rho>_inv' x\" if \"x \\<in> I\" for x\n      using that I_def by (intro \\<rho>_inv') simp \n    ultimately obtain \\<xi> :: real where \\<xi>_def: \"\\<xi> \\<in> I\"\n      \"\\<rho>_inv (p(f,g,h)) - \\<rho>_inv (\\<rho> (card (R f))) = (p (f,g,h) - \\<rho>(card (R f))) * \\<rho>_inv' \\<xi>\" \n      using p_in_I MVT_interval by blast\n\n    have \"\\<bar>\\<rho>_inv(p (f,g,h)) - card (R f)\\<bar> = \\<bar>\\<rho>_inv(p (f,g,h)) - \\<rho>_inv(\\<rho>(card (R f)))\\<bar>\"\n      by (subst \\<rho>_inverse) simp\n    also have \"... = \\<bar>(p (f,g,h) - \\<rho> (card (R f)))\\<bar> * \\<bar>\\<rho>_inv' \\<xi> \\<bar>\"\n      using \\<xi>_def(2) abs_mult by simp\n    also have \"... \\<le> \\<bar>p (f,g,h) - \\<rho> (card (R f))\\<bar> * 4\"\n      using \\<xi>_def(1) I_def\n      by (intro mult_left_mono \\<rho>_inv'_bound) auto\n    also have \"... \\<le> ( \\<delta>/12 * card (R f)) * 4\"\n      using assms(4) E\\<^sub>4_def by (intro mult_right_mono) auto\n    also have \"... = \\<delta>/3 * card (R f)\" by simp\n    finally have b: \"\\<bar>\\<rho>_inv(p (f,g,h)) - card (R f)\\<bar> \\<le> \\<delta>/3 * card (R f)\"  by simp\n\n    have \"\\<bar>\\<rho>_inv(p (f,g,h)) - X / 2 ^ (s f)\\<bar> \\<le> \n      \\<bar>\\<rho>_inv(p (f,g,h)) - card (R f)\\<bar> + \\<bar>card (R f) - X / 2 ^ (s f)\\<bar>\" \n      by simp\n    also have \"... \\<le> \\<delta>/3 * card (R f) + \\<bar>card (R f) - X / 2 ^ (s f)\\<bar>\"\n      by (intro add_mono b) auto\n    also have \"... =  \\<delta>/3 * \\<bar>X / 2 ^ (s f) + (card (R f) - X / 2 ^ (s f))\\<bar> + \n      \\<bar>card (R f) - X / 2 ^ (s f)\\<bar>\" by simp\n    also have \"... \\<le>  \\<delta>/3 * (\\<bar>X / 2 ^ (s f)\\<bar> + \\<bar>card (R f) - X / 2 ^ (s f)\\<bar>) + \n      \\<bar>card (R f) - X / 2 ^ (s f)\\<bar>\" \n      using \\<delta>_gt_0 by (intro mult_left_mono add_mono abs_triangle_ineq) auto\n    also have \"... \\<le>  \\<delta>/3 * \\<bar>X / 2 ^ (s f)\\<bar> + (1+  \\<delta>/3) * \\<bar>card (R f) - X / 2 ^ (s f)\\<bar>\"\n      using \\<delta>_gt_0 \\<delta>_lt_1 by (simp add:algebra_simps) \n    also have \"... \\<le>  \\<delta>/3 * \\<bar>X / 2 ^ s f\\<bar> + (4/3) * ( \\<delta> / 3 * real X / 2 ^ s f)\"\n      using assms(2) \\<delta>_gt_0 \\<delta>_lt_1 \n      unfolding E\\<^sub>2_def by (intro add_mono mult_mono) auto\n    also have \"... = (7/9) * \\<delta> * real X / 2^s f\"\n      using X_ge_1 by (subst abs_of_nonneg) auto\n    also have \"... \\<le> 1 * \\<delta> * real X / 2^s f\" \n      using \\<delta>_gt_0 by (intro mult_mono divide_right_mono) auto\n    also have \"... =  \\<delta> * real X / 2^s f\" by simp\n    finally have a:\"\\<bar>\\<rho>_inv(p (f,g,h)) - X / 2 ^ (s f)\\<bar> \\<le> \\<delta> * X / 2 ^ (s f)\"\n      by simp\n\n    have \"\\<bar>Y (f, g, h) - real X\\<bar> = \\<bar>2 ^ (s f)\\<bar> * \\<bar>\\<rho>_inv(p (f,g,h)) - real X / 2 ^ (s f)\\<bar>\"\n      unfolding Y_def by (subst abs_mult[symmetric]) (simp add:algebra_simps powr_add[symmetric])\n    also have \"... \\<le> 2 ^ (s f) * (\\<delta> * X / 2 ^ (s f))\"\n      by (intro mult_mono a) auto\n    also have \"... = \\<delta> * X\" \n      by (simp add:algebra_simps powr_add[symmetric])\n    finally have \"\\<bar>Y (f, g, h) - real X\\<bar> \\<le> \\<delta> * X\" by simp\n    moreover have \"2 powr (\\<lceil>log 2 (real X)\\<rceil> - t f) \\<le> 2 powr b_exp\" (is \"?L1 \\<le> ?R1\")\n    proof -\n      have \"?L1 \\<le> 2 powr (1 + log 2 (real X)- t f)\"\n        by (intro powr_mono, linarith) auto\n      also have \"... = 2 powr 1 * 2 powr (log 2 (real X)) * 2 powr (- t f)\"\n        unfolding powr_add[symmetric] by simp\n      also have \"... = 2 * (2 powr (-t f) * X)\" \n        using X_ge_1 by simp\n      also have \"... \\<le> 2 * (b/2)\" \n        using assms(1) unfolding E\\<^sub>1_def by (intro mult_left_mono) auto\n      also have \"... = b\" by simp\n      also have \"... = ?R1\"\n        unfolding b_def by (simp add: powr_realpow)\n      finally show ?thesis by simp\n    qed\n    hence \"\\<lceil>log 2 (real X)\\<rceil> - t f \\<le> real b_exp\"\n      unfolding not_less[symmetric] using powr_less_mono[where x=\"2\"] by simp\n    hence \"s f \\<ge> q_max\" unfolding s_def q_max_def by (intro nat_mono) auto\n    ultimately show \"\\<psi> \\<notin> {(f, g, h). \\<delta> * X < \\<bar>Y (f, g, h) - real X\\<bar> \\<or> s f < q_max}\"\n      unfolding \\<psi>_def by auto\n  qed\n  also have \"... \\<le> \n    measure \\<Psi> {\\<psi>. \\<not>E\\<^sub>1 \\<psi> \\<or> \\<not>E\\<^sub>2 \\<psi> \\<or> \\<not>E\\<^sub>3 \\<psi>} + measure \\<Psi> {\\<psi>. E\\<^sub>1 \\<psi> \\<and> E\\<^sub>2 \\<psi> \\<and> E\\<^sub>3 \\<psi> \\<and> \\<not>E\\<^sub>4 \\<psi>}\"\n    by (intro pmf_add) auto\n  also have \"... \\<le> (measure \\<Psi> {\\<psi>. \\<not>E\\<^sub>1 \\<psi> \\<or> \\<not>E\\<^sub>2 \\<psi>} + measure \\<Psi> {\\<psi>. E\\<^sub>1 \\<psi> \\<and> E\\<^sub>2 \\<psi> \\<and> \\<not>E\\<^sub>3 \\<psi>}) + 1/2^6\"\n    by (intro add_mono e_4 pmf_add) auto\n  also have \"... \\<le> ((measure \\<Psi> {\\<psi>. \\<not>E\\<^sub>1 \\<psi>} + measure \\<Psi> {\\<psi>. E\\<^sub>1 \\<psi> \\<and> \\<not>E\\<^sub>2 \\<psi>}) + 1/2^6) + 1/2^6\"\n    by (intro add_mono e_3 pmf_add) auto\n  also have \"... \\<le> ((1/2^6 + 1/2^6) + 1/2^6) + 1/2^6\"\n    by (intro add_mono e_2 e_1) auto\n  also have \"... = ?R\" by simp\n  finally show ?thesis by simp\nqed\n\nend\n\nend\n", "meta": {"author": "ekarayel", "repo": "distributed-distinct-elements-formalization", "sha": "0fe0146cfb86bcfa79957e46d243426e6c5cea4e", "save_path": "github-repos/isabelle/ekarayel-distributed-distinct-elements-formalization", "path": "github-repos/isabelle/ekarayel-distributed-distinct-elements-formalization/distributed-distinct-elements-formalization-0fe0146cfb86bcfa79957e46d243426e6c5cea4e/Distributed_Distinct_Elements/Distributed_Distinct_Elements_Accuracy_Without_Cutoff.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.6187804337438501, "lm_q1q2_score": 0.31905551509805496}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   June 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |               November 2005  (modified)   |\n            |               December 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_law\nimports CSP_F_law_SKIP      CSP_F_law_ref\n        CSP_F_law_dist      CSP_F_law_alpha_par \n        CSP_F_law_step      CSP_F_law_rep_par   \n        CSP_F_law_fix\n        CSP_F_law_DIV       CSP_F_law_SKIP_DIV  \n        CSP_F_law_step_ext  CSP_F_law_norm      \n        CSP_T_law\nbegin\n\n(*********************************************************\n            SKIP , DIV  and Internal choice\n *********************************************************)\n\n(*** |~| ***)\n\nlemma cspF_SKIP_DIV_Int_choice: \n  \"[| P = SKIP | P = DIV ; Q = SKIP | Q = DIV |] ==>\n   (P |~| Q) =F[M1,M2] (if (P = SKIP | Q = SKIP) then SKIP else DIV)\"\napply (elim disjE)\napply (simp_all)\napply (rule cspF_rw_left)\napply (rule cspF_idem)\napply (rule cspF_reflex)\napply (rule cspF_rw_left)\napply (rule cspF_unit)\napply (rule cspF_reflex)\napply (rule cspF_rw_left)\napply (rule cspF_unit)\napply (rule cspF_reflex)\napply (rule cspF_rw_left)\napply (rule cspF_idem)\napply (rule cspF_reflex)\ndone\n\n(*** !! ***)\n\nlemma cspF_SKIP_DIV_Rep_int_choice_sum: \n  \"[| ALL c: sumset C. (Qf c = SKIP | Qf c = DIV) |] ==>\n   (!! c:C .. Qf c) =F[M1,M2] \n   (if (EX c: sumset C. Qf c = SKIP) then SKIP else DIV)\"\napply (case_tac \" sumset C={}\")\napply (simp add: cspF_Rep_int_choice_empty)\napply (case_tac \"ALL c: sumset C. Qf c = DIV\")\n apply (simp)\n apply (rule cspF_rw_left)\n apply (rule cspF_Rep_int_choice_const)\n apply (simp)\n apply (force)\n apply (simp)\n\n apply (simp)\n apply (elim bexE)\n apply (frule_tac x=\"c\" in bspec)\n apply (simp_all)\n apply (intro conjI impI)\n\n  apply (rule cspF_rw_left)\n  apply (subgoal_tac \n  \"!! :C .. Qf =F[M1,M1]\n   !! :({c:C. Qf c = SKIP}s Uns {c:C. Qf c ~= SKIP}s) .. Qf\")\n  apply (simp (no_asm))\n  apply (rule cspF_decompo)\n   apply (simp)\n   apply (simp)\n\n  apply (rule cspF_rw_left)\n  apply (rule cspF_Rep_int_choice_union_Int)\n  apply (simp)\n\n  apply (rule cspF_rw_left)\n  apply (rule cspF_decompo)\n  apply (rule cspF_Rep_int_choice_const)\n  apply (force)\n  apply (rule ballI)\n  apply (simp)\n  apply (case_tac \" sumset ({c:C. Qf c ~= SKIP}s) ={}\")\n   apply (rule cspF_Rep_int_choice_DIV)\n   apply (simp)\n\n   apply (rule cspF_rw_left)\n   apply (rule cspF_Rep_int_choice_const)\n   apply (simp_all)\n   apply (intro allI impI)\n   apply (subgoal_tac \"Qf ca = DIV\")\n   apply (simp)\n   apply (force)\n   apply (simp)\n\n  apply (rule cspF_rw_left)\n  apply (rule cspF_unit)\n  apply (simp)\ndone\n\nlemma cspF_SKIP_DIV_Rep_int_choice_nat: \n  \"[| ALL n:N. (Qf n = SKIP | Qf n = DIV) |] ==>\n   (!nat n:N .. Qf n) =F[M1,M2] \n   (if (EX n:N. Qf n = SKIP) then SKIP else DIV)\"\napply (unfold Rep_int_choice_ss_def)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_DIV_Rep_int_choice_sum)\napply (auto)\ndone\n\nlemma cspF_SKIP_DIV_Rep_int_choice_set: \n  \"[| ALL X:Xs. (Qf X = SKIP | Qf X = DIV) |] ==>\n   (!set X:Xs .. Qf X) =F[M1,M2] \n   (if (EX X:Xs. Qf X = SKIP) then SKIP else DIV)\"\napply (unfold Rep_int_choice_ss_def)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_DIV_Rep_int_choice_sum)\napply (auto)\ndone\n\nlemmas cspF_SKIP_DIV_Rep_int_choice =\n       cspF_SKIP_DIV_Rep_int_choice_sum\n       cspF_SKIP_DIV_Rep_int_choice_nat\n       cspF_SKIP_DIV_Rep_int_choice_set\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_law.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6584175139669998, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.3189243309047779}}
{"text": "theory DropEnv\n  imports WTLemma\nbegin\n  \n\n  \nlemma var_value_prim1: \"\\<lbrakk> v \\<noteq> NoRef; var_val_type v tau tau_x \\<rbrakk> \\<Longrightarrow> req_type tau \\<noteq> Prim\"  \n  apply (case_tac v)\n    apply (auto)\n   apply (case_tac tau_x)\n         apply (auto)\n  apply (case_tac tau_x)\n        apply (auto)\n  done\n\nlemma var_value_unlim: \"\\<lbrakk> v \\<noteq> NoRef; var_val_type v tau tau_x \\<rbrakk> \\<Longrightarrow> req_type tau_x = Ref\" \n  apply (case_tac v)\n    apply (auto)\n   apply (case_tac tau_x)\n         apply (auto)\n  apply (case_tac tau_x)\n        apply (auto)\n  done  \n  \n    (* - requirements dropping (reduces requirements to pass into lambdas) *)\n    \ndefinition drop_use_env where\n  \"drop_use_env r_s = (\\<lambda> x. if r_s x = OwnPerm then UsePerm else r_s x)\"    \n\nlemma self_drop_leq_use_env: \"leq_use_env (drop_use_env r_x) r_x\"  \n  apply (simp add: leq_use_env_def)\n  apply (simp add: drop_use_env_def)\n  apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done\n    \nlemma drop_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (drop_use_env r_x) r_s\"    \n  apply (rule_tac r_sb=\"r_x\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac self_drop_leq_use_env)\n  done  \n    \nlemma dist_drop_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (drop_use_env r_x) (drop_use_env r_s)\"    \n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: drop_use_env_def)\n  apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done    \n  \nlemma weak_drop_use_env: \"\\<lbrakk> weak_use_env r_s \\<rbrakk> \\<Longrightarrow> drop_use_env r_s = r_s\"\n  apply (case_tac \"\\<forall> x. drop_use_env r_s x = r_s x\")\n   apply (auto)\n  apply (simp add: drop_use_env_def)\n  apply (simp add: weak_use_env_def)\n  done    \n    \nlemma drop_weak_use_env: \"weak_use_env (drop_use_env r_s)\"    \n  apply (simp add: weak_use_env_def)\n  apply (simp add: drop_use_env_def)\n  done    \n\nlemma dist_drop_comp_use_env: \"drop_use_env (comp_use_env r_sa r_sb) = comp_use_env (drop_use_env r_sa) (drop_use_env r_sb)\"    \n  apply (case_tac \"\\<forall> x. drop_use_env (comp_use_env r_sa r_sb) x = comp_use_env (drop_use_env r_sa) (drop_use_env r_sb) x\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: drop_use_env_def)\n  apply (case_tac \"r_sa x\")\n    apply (auto)\n    apply (case_tac \"r_sb x\")\n      apply (auto)\n   apply (case_tac \"r_sb x\")\n     apply (auto)\n  apply (case_tac \"r_sb x\")\n    apply (auto)\n  done\n    \nlemma drop_lift_leq_use_env: \"leq_use_env (drop_use_env (lift_use_env r_s r)) (lift_use_env (drop_use_env r_s) r)\"    \n  apply (simp add: drop_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n   apply (case_tac r)\n     apply (auto)\n  apply (case_tac r)\n    apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n\nlemma rhs_drop_leq_use_env: \"\\<lbrakk> weak_use_env r_x; leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env r_x (drop_use_env r_s)\"    \n  apply (simp add: weak_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: drop_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done     \n    \nlemma diff_drop_use_env: \"drop_use_env (diff_use_env r_s r_ex) = diff_use_env (drop_use_env r_s) r_ex\"\n  apply (case_tac \"\\<forall> x. drop_use_env (diff_use_env r_s r_ex) x = diff_use_env (drop_use_env r_s) r_ex x\")\n   apply (auto)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: drop_use_env_def)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n   apply (case_tac \"r_ex x\")\n     apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  done  \n  \n\nlemma dist_drop_diff_use_env: \"diff_use_env (drop_use_env r_s) r_x = drop_use_env (diff_use_env r_s r_x)\"    \n  apply (case_tac \"\\<forall> x. diff_use_env (drop_use_env r_s) r_x x = drop_use_env (diff_use_env r_s r_x) x\")\n   apply (auto)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: drop_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (case_tac \"r_s x = OwnPerm\")\n   apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n   apply (simp add: neg_use_env_def)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n    apply (simp_all add: neg_use_env_def)\n  done\n    \n\nlemma wtsdr_weak_use_env: \"\\<lbrakk> leq_use_env r_s (diff_use_env r_s r_x); leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> weak_use_env r_x\"  \n  apply (simp add: leq_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: weak_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done    \n    \n \nlemma wt_sexp_drop_all: \"\\<lbrakk> well_typed env rx e tau rx rx'; req_type tau \\<noteq> Aff; is_sexp e \\<rbrakk> \\<Longrightarrow>\n  well_typed env (drop_use_env rx) e tau (drop_use_env rx) (drop_use_env rx')\"    \n  apply (induct e arbitrary: env tau rx rx')\n        apply (auto)\n    (* const + op cases *)\n          apply (rule_tac id_leq_use_env)\n         apply (rule_tac dist_drop_leq_use_env)\n         apply (simp)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac dist_drop_leq_use_env)\n       apply (simp)\n    (* var case p1 *)\n      apply (rule_tac ereq_leq_use_envx)\n      apply (cut_tac r_x=\"ereq_use_env x1a tau_x\" and r_s=\"rx\" and x=\"x1a\" in spec_leq_perm)\n       apply (simp)    \n      apply (simp add: ereq_use_env_def)\n      apply (simp add: one_use_env_def)\n      apply (simp add: drop_use_env_def)\n      apply (simp add: end_req_perm_def)\n      apply (cut_tac v=\"x2a\" and tau_x=\"tau_x\" in var_value_unlim)\n        apply (auto)\n    (* var case p2 *)\n     apply (cut_tac r_s=\"rx\" and r_x=\"comp_use_env (ereq_use_env x1a tau_x) r_ex\" in wtsdr_weak_use_env)\n       apply (simp)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (auto)\n     apply (rule_tac x=\"r_ex\" in exI)\n     apply (auto)\n        apply (rule_tac rhs_weak_leq_use_env)\n         apply (case_tac tau)\n               apply (auto)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac dist_drop_leq_use_env)\n       apply (simp)\n      apply (rule_tac rhs_drop_leq_use_env)\n       apply (rule_tac r_sa=\"ereq_use_env x1a tau_x\" in weak_comp_use_env2)\n       apply (auto)\n     apply (rule_tac rhs_drop_leq_use_env)\n      apply (rule_tac weak_diff_use_env)\n      apply (rule_tac r_sb=\"r_ex\" in weak_comp_use_env1)\n      apply (case_tac tau)\n            apply (auto)\n    (* pair case *)\n    apply (case_tac \"r = OwnPerm\")\n     apply (auto)\n    apply (case_tac \"max_aff (req_type t1) (req_type t2) = Aff\")\n     apply (case_tac r)\n       apply (auto)\n    apply (case_tac \"req_type t1 = Aff\")\n     apply (auto)\n    apply (case_tac \"req_type t2 = Aff\")\n      apply (case_tac \"req_type t1\")\n       apply (auto)\n    apply (case_tac \"lift_use_env rx2 r \\<noteq> rx2 \\<or> lift_use_env rx1 r \\<noteq> rx1\")\n     apply (case_tac r)\n       apply (auto)\n(*\n    apply (case_tac \"\\<not> (req_type t1 \\<noteq> Aff \\<and> req_type t2 \\<noteq> Aff)\")\n     apply (auto)\n     apply (case_tac \"req_type t1\")\n       apply (auto)*)\n    apply (cut_tac r_s=\"rx\" and r_x=\"r_ex\" in wtsdr_weak_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n       apply (rule_tac dist_diff_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (rule_tac x=\"drop_use_env rx\" in exI)\n    apply (rule_tac x=\"drop_use_env rx\" in exI)\n    apply (rule_tac x=\"drop_use_env rx1\" in exI)\n    apply (auto)\n     apply (cut_tac e=\"e1\" in value_is_sexp)\n      apply (auto)\n     apply (cut_tac env=\"env\" and ?r_s1.0=\"rx\" and r_c=\"r_s2\" and ?r_s2.0=\"rx\" and e=\"e1\" and tau=\"t1\" and rx=\"rx1\" in well_typed_decr_end_perm)\n        apply (auto)\n      apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n       apply (rule_tac diff_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n     apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leqx)\n     apply (auto)\n    apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2\" and r_sa=\"rx\" in trans_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (cut_tac r_sc=\"rx\" and r_sb=\"diff_use_env r_s3 r_ex\" and r_sa=\"r_s3\" in trans_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (simp)\n    apply (case_tac \"lift_use_env (drop_use_env rx2) r \\<noteq> drop_use_env rx2\")\n     apply (case_tac r)\n       apply (auto)\n    apply (case_tac \"lift_use_env (drop_use_env rx1) r \\<noteq> drop_use_env rx1\")\n     apply (case_tac r)\n       apply (auto)\n    apply (rule_tac x=\"drop_use_env rx2\" in exI)\n    apply (auto)\n          apply (cut_tac e=\"e2\" in value_is_sexp)\n           apply (auto)\n          apply (cut_tac env=\"env\" and ?r_s1.0=\"rx\" and r_c=\"r_s3\" and ?r_s2.0=\"rx\" and e=\"e2\" and tau=\"t2\" and rx=\"rx2\" in well_typed_decr_end_perm)\n             apply (rule_tac ?r_s1.0=\"r_s2\" in well_typed_incr_start_perm)\n              apply (auto)\n           apply (rule_tac well_typed_perm_leq)\n           apply (auto)\n          apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n         apply (auto)\n         apply (rule_tac dist_drop_leq_use_env)\n         apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n          apply (auto)\n        apply (rule_tac dist_drop_leq_use_env)\n        apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n         apply (auto)\n     apply (rule_tac r_s=\"rx1\" in disj_leq_use_env1)\n      apply (rule_tac r_s=\"rx2\" in disj_leq_use_env2)\n       apply (simp)\n      apply (rule_tac self_drop_leq_use_env)\n     apply (rule_tac self_drop_leq_use_env)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n       apply (rule_tac rhs_weak_leq_use_env)\n        apply (simp add: weak_use_env_def)\n        apply (simp add: empty_use_env_def)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac dist_drop_leq_use_env)\n      apply (simp)\n     apply (rule_tac leq_empty_use_env)\n    apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n     apply (simp add: pair_req_def)\n     apply (rule_tac leq_empty_use_env)\n    apply (simp add: pair_req_def)\n    apply (rule_tac diff_leq_use_env)\n    apply (rule_tac r_sb=\"drop_use_env (diff_use_env (comp_use_env rx1 rx2) r_ex)\" in trans_leq_use_env)\n     apply (rule_tac dist_drop_leq_use_env)\n     apply (simp)\n    apply (rule_tac t=\"drop_use_env (diff_use_env (comp_use_env rx1 rx2) r_ex)\" and s=\"diff_use_env (drop_use_env (comp_use_env rx1 rx2)) r_ex\" in subst)\n     apply (rule_tac dist_drop_diff_use_env)\n    apply (rule_tac rhs_weak_leq_use_env)\n     apply (simp)\n    apply (simp add: dist_drop_comp_use_env)\n    apply (rule_tac id_leq_use_env)\n    (* lam case *)\n   apply (simp add: aff_use_env_def)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n    apply (rule_tac rhs_drop_leq_use_env)\n     apply (auto)\n    apply (case_tac a)\n      apply (auto)\n    apply (simp add: weak_use_env_def)\n    apply (simp add: null_use_env_def)\n   apply (cut_tac r_s=\"rx\" and r_x=\"r_ex\" in wtsdr_weak_use_env)\n     apply (auto)\n   apply (rule_tac x=\"r_ex\" in exI)\n   apply (auto)\n      apply (rule_tac rhs_weak_leq_use_env)\n       apply (simp)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac dist_drop_leq_use_env)\n     apply (simp)\n    apply (rule_tac rhs_drop_leq_use_env)\n     apply (auto)\n   apply (rule_tac rhs_drop_leq_use_env)\n    apply (rule_tac weak_diff_use_env)\n    apply (auto)\n   apply (case_tac a)\n     apply (auto)\n   apply (simp add: weak_use_env_def)\n   apply (simp add: null_use_env_def)\n    (* app case. e1 *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"drop_use_env rx\" in exI)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n   apply (case_tac e1)\n         apply (auto)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n    (* app case. e2, lambda unrolling *)\n  apply (rule_tac x=\"drop_use_env rx2\" in exI)\n  apply (rule_tac x=\"drop_use_env rx\" in exI)\n  apply (auto)\n   apply (cut_tac env=\"env\" and r_c=\"rx\" and ?r_s1.0=\"r_s2\" and ?r_s2.0=\"rx\" and e=\"e2\" and tau=\"t1\" and rx=\"rx2\" in well_typed_incr_start_perm)\n     apply (rule_tac r_c=\"r_s3\" in well_typed_decr_end_perm)\n       apply (simp)\n      apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (simp)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leqx)\n     apply (auto)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n    (* - prove that e2 is an s-expression *)\n   apply (case_tac \"\\<not> is_sexp e2\")\n    apply (cut_tac ?e1.0=\"e1\" and ?e2.0=\"e2\" in e2_sexp)\n     apply (simp_all)\n    (* - prove that t1 is unlim *)\n   apply (case_tac \"\\<not> req_type t1 \\<noteq> Aff\")\n    apply (case_tac e1)\n         apply (auto)\n    apply (case_tac x1)\n               apply (auto)\n        apply (simp_all add: pure_fun_def)\n    (* app case. tau primitive case (only happens for fixed point w/ primitive fun) *)\n  apply (simp add: app_req_def)\n  apply (case_tac \"req_type tau = Prim\")\n   apply (auto)\n   apply (case_tac e1)\n        apply (auto)\n    apply (case_tac x1)\n                apply (auto)\n        apply (simp_all add: pure_fun_def)\n   apply (auto)\n   apply (case_tac t)\n          apply (auto)\n   apply (case_tac \"\\<not> weak_use_env empty_use_env\")\n    apply (simp add: weak_use_env_def)\n    apply (simp add: empty_use_env_def)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n         apply (rule_tac rhs_weak_leq_use_env)\n          apply (rule_tac dist_weak_comp_use_env)\n           apply (rule_tac dist_weak_comp_use_env)\n            apply (auto)\n          apply (rule_tac drop_weak_use_env)\n         apply (rule_tac id_leq_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac leq_empty_use_env)\n       apply (rule_tac dist_drop_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (simp)\n       apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n       apply (rule_tac well_typed_perm_leqx)\n       apply (auto)\n      apply (rule_tac disj_empty_use_env2)\n     apply (rule_tac dist_drop_leq_use_env)\n     apply (simp)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac leq_empty_use_env)\n    (* non prim case. *)\n    (* - prove weakness of rx1 + rx2 + r_ex *)\n  apply (cut_tac r_s=\"r_s3\" and r_x=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in wtsdr_weak_use_env)\n    apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (simp)\n   apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n     apply (rule_tac self_diff_leq_use_env)\n    apply (simp_all)\n    (* - r not ownership *)\n  apply (case_tac \"r = OwnPerm\")\n   apply (case_tac e1)\n        apply (auto)\n   apply (case_tac x1)\n               apply (auto)\n        apply (simp_all add: pure_fun_def)\n    (* - final manipulation *)\n  apply (rule_tac x=\"r_ex\" in exI)\n  apply (auto)\n       apply (rule_tac rhs_weak_leq_use_env)\n        apply (rule_tac r_s=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in leq_weak_use_env)\n         apply (simp)\n        apply (rule_tac dist_comp_leq_use_env)\n         apply (rule_tac comp_leq_use_env1)\n         apply (rule_tac dist_comp_leq_use_env)\n          apply (rule_tac leq_empty_use_env)\n         apply (rule_tac comp_leq_use_env2)\n         apply (rule_tac dist_lift_leq_use_env)\n         apply (rule_tac self_drop_leq_use_env)\n        apply (rule_tac self_comp_leq_use_env2)\n       apply (rule_tac id_leq_use_env)\n(*\n       apply (simp add: drop_use_env_def)\n       apply (case_tac r)\n         apply (auto)*)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n      apply (case_tac \"lift_use_env (drop_use_env rx2) r \\<noteq> drop_use_env rx2\")\n       apply (case_tac r)\n         apply (auto)\n      apply (rule_tac dist_drop_leq_use_env)\n      apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n       apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n        apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n         apply (rule_tac well_typed_perm_leq)\n         apply (auto)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n      apply (rule_tac comp_leq_use_env2)\n      apply (rule_tac self_lift_leq_use_env)\n     apply (rule_tac disj_empty_use_env2)\n    apply (rule_tac dist_drop_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_drop_leq_use_env)\n    apply (rule_tac r_sa=\"comp_use_env rx1 (lift_use_env rx2 r)\" in weak_comp_use_env2)\n    apply (auto)\n  apply (rule_tac r_sb=\"drop_use_env (diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex))\" in trans_leq_use_env)\n   apply (rule_tac dist_drop_leq_use_env)\n   apply (auto)\n  apply (rule_tac rhs_drop_leq_use_env)\n   apply (rule_tac weak_diff_use_env)\n   apply (rule_tac dist_weak_comp_use_env)\n    apply (simp add: weak_use_env_def)\n    apply (simp add: empty_use_env_def)\n   apply (rule_tac drop_weak_use_env)\n  apply (rule_tac rhs_weak_leq_use_env)\n   apply (simp)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac comp_leq_use_env2)\n  apply (rule_tac self_drop_leq_use_env)\n  done        \n\nlemma wt_sexp_drop_req: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; req_type tau \\<noteq> Aff; (*\\<not> aff_fun_ty tau;*) is_sexp e \\<rbrakk> \\<Longrightarrow>\n    well_typed env r_s1 e tau r_s2 (drop_use_env rx)\"\n  apply (induct e arbitrary: r_s1 r_s2 tau rx)\n        apply (auto)\n    (* const + op cases *)\n       apply (rule_tac drop_leq_use_env)\n       apply (simp)\n      apply (rule_tac drop_leq_use_env)\n      apply (simp)\n    (* var case. *)\n     apply (rule_tac x=\"r_ex\" in exI)\n     apply (auto)\n      apply (rule_tac drop_leq_use_env)\n      apply (simp)\n     apply (rule_tac rhs_drop_leq_use_env)\n      apply (rule_tac weak_diff_use_env)\n      apply (rule_tac weak_ereq_use_env)\n      apply (cut_tac tau_x=\"tau_x\" in var_value_unlim)\n        apply (auto)\n     apply (simp add: unlim_def)\n    (* pair case. *)\n    apply (case_tac \"r = OwnPerm\")\n     apply (auto)\n    apply (case_tac \"max_aff (req_type t1) (req_type t2) = Aff\")\n     apply (case_tac r)\n       apply (auto)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (rule_tac x=\"r_s3\" in exI)\n    apply (rule_tac x=\"drop_use_env rx1\" in exI)\n    apply (auto)\n     apply (case_tac \"req_type t1 = Aff\")\n      apply (auto)\n     apply (cut_tac e=\"e1\" in value_is_sexp)\n      apply (auto)\n    apply (rule_tac x=\"drop_use_env rx2\" in exI)\n    apply (auto)\n        apply (case_tac \"req_type t2 = Aff\")\n         apply (case_tac \"req_type t1\")\n           apply (auto)\n        apply (cut_tac e=\"e2\" in value_is_sexp)\n         apply (auto)\n       apply (rule_tac r_sb=\"lift_use_env rx1 r\" in trans_leq_use_env)\n        apply (simp)\n       apply (rule_tac dist_lift_leq_use_env)\n       apply (rule_tac self_drop_leq_use_env)\n      apply (rule_tac r_sb=\"lift_use_env rx2 r\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_lift_leq_use_env)\n      apply (rule_tac self_drop_leq_use_env)\n     apply (rule_tac r_s=\"lift_use_env rx1 r\" in disj_leq_use_env1)\n      apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n       apply (simp)\n      apply (rule_tac dist_lift_leq_use_env)\n      apply (rule_tac self_drop_leq_use_env)\n     apply (rule_tac dist_lift_leq_use_env)\n     apply (rule_tac self_drop_leq_use_env)\n    apply (rule_tac x=\"r_ex\" in exI)\n    apply (auto)\n     apply (rule_tac drop_leq_use_env)\n     apply (simp)\n    apply (case_tac \"lift_use_env (drop_use_env rx1) r \\<noteq> drop_use_env rx1\")\n     apply (case_tac r)\n       apply (auto)\n    apply (case_tac \"lift_use_env (drop_use_env rx2) r \\<noteq> drop_use_env rx2\")\n     apply (case_tac r)\n       apply (auto)\n    apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n     apply (simp add: pair_req_def)\n     apply (rule_tac leq_empty_use_env)\n    apply (simp add: pair_req_def)\n    apply (rule_tac rhs_drop_leq_use_env)\n     apply (rule_tac weak_diff_use_env)\n     apply (rule_tac dist_weak_comp_use_env)\n      apply (rule_tac drop_weak_use_env)\n     apply (rule_tac drop_weak_use_env)\n    apply (rule_tac r_sb=\"diff_use_env (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac dist_diff_leq_use_env)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac comp_leq_use_env1)\n     apply (rule_tac drop_leq_use_env)\n     apply (rule_tac self_lift_leq_use_env)\n    apply (rule_tac comp_leq_use_env2)\n    apply (rule_tac drop_leq_use_env)\n    apply (rule_tac self_lift_leq_use_env)\n    (* lam case  *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_ex\" in exI)\n   apply (auto)\n    apply (rule_tac drop_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_drop_leq_use_env)\n    apply (rule_tac weak_diff_use_env)\n    apply (simp add: aff_use_env_def)\n    apply (case_tac a)\n      apply (auto)\n   apply (simp add: null_use_env_def)\n   apply (simp add: weak_use_env_def)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"drop_use_env rx1\" in exI)\n  apply (auto)\n   apply (case_tac \"req_type (FunTy t1 tau r a) = Aff\")\n    apply (case_tac e1)\n          apply (auto)\n    apply (case_tac x1)\n                apply (auto)\n         apply (simp_all add: pure_fun_def)\n   apply (case_tac \"\\<not> is_sexp e1\")\n    apply (case_tac e1)\n          apply (auto)\n  apply (rule_tac x=\"drop_use_env rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n   apply (case_tac \"req_type t1 = Aff\")\n    apply (case_tac e1)\n          apply (auto)\n    apply (case_tac x1)\n                apply (auto)\n         apply (simp_all add: pure_fun_def)\n   apply (case_tac \"\\<not> is_sexp e2\")\n    apply (case_tac \"is_value e2\")\n     apply (cut_tac e=\"e2\" in value_is_sexp)\n      apply (auto)\n    apply (case_tac e1)\n          apply (auto)\n   apply (case_tac x1)\n               apply (auto)\n   apply (case_tac e2)\n         apply (auto)\n  apply (cut_tac r_xa=\"drop_use_env rx1\" and r_xb=\"lift_use_env (drop_use_env rx2) r\" and r_s=\"comp_use_env rx1 (lift_use_env rx2 r)\" in dist_comp_leq_use_env)\n    apply (rule_tac comp_leq_use_env1)\n    apply (rule_tac self_drop_leq_use_env)\n   apply (rule_tac comp_leq_use_env2)\n   apply (rule_tac dist_lift_leq_use_env)\n   apply (rule_tac self_drop_leq_use_env)\n  apply (rule_tac x=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" in exI)\n  apply (auto)\n      apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n       apply (rule_tac dist_diff_leq_use_env_gen)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac comp_leq_use_env1)\n         apply (simp)\n        apply (rule_tac id_leq_use_env)\n       apply (simp)\n     apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n      apply (simp_all)\n    apply (rule_tac r_s=\"rx1\" in disj_leq_use_env1)\n     apply (rule_tac r_s=\"lift_use_env rx2 r\" in disj_leq_use_env2)\n      apply (simp)\n     apply (rule_tac dist_lift_leq_use_env)\n     apply (rule_tac self_drop_leq_use_env)\n    apply (rule_tac self_drop_leq_use_env)\n   apply (rule_tac drop_leq_use_env)\n    apply (simp)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (case_tac \"req_type tau = Prim\")\n   apply (simp add: app_req_def)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: app_req_def)\n  apply (rule_tac rhs_drop_leq_use_env)\n   apply (rule_tac weak_diff_use_env)\n   apply (rule_tac dist_weak_comp_use_env)\n    apply (rule_tac drop_weak_use_env)\n   apply (rule_tac drop_weak_use_env)\n  apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac dist_diff_leq_use_env_gen)\n   apply (rule_tac dist_comp_leq_use_env)\n    apply (rule_tac comp_leq_use_env1)\n    apply (rule_tac self_drop_leq_use_env)\n   apply (rule_tac comp_leq_use_env2)\n   apply (rule_tac self_drop_leq_use_env)\n  apply (rule_tac self_comp_leq_use_env2)\n  done\n    \n    (* ####### primitive lemmas *)\n    \nlemma wt_sexp_no_all: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; req_type tau = Prim; is_sexp e \\<rbrakk> \\<Longrightarrow> well_typed env empty_use_env e tau empty_use_env empty_use_env\"     \n  apply (induction e arbitrary: env tau r_s1 r_s2 rx)\n        apply (auto)\n    (* const + op case *)   \n       apply (rule_tac leq_empty_use_env)\n       apply (rule_tac leq_empty_use_env)\n    (* var cases (impossible) *)\n      apply (simp add: var_value_prim1)\n     apply (simp add: var_value_prim1)\n    (* pair case *)\n    apply (case_tac \"r \\<noteq> NoPerm\")\n     apply (case_tac r)\n       apply (auto)\n    apply (case_tac \"max_aff (req_type t1) (req_type t2)\")\n      apply (auto)\n    apply (case_tac \"req_type t1\")\n       apply (auto)\n     apply (case_tac \"req_type t2\")\n       apply (auto)\n    apply (case_tac \"req_type t2\")\n      apply (auto)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n     apply (cut_tac e=\"e1\" in value_is_sexp)\n      apply (auto)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n        apply (cut_tac e=\"e2\" in value_is_sexp)\n         apply (auto)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac disj_empty_use_env1)\n    apply (rule_tac x=\"empty_use_env\" in exI)\n    apply (auto)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac leq_empty_use_env)\n    apply (simp add: pair_req_def)\n    apply (rule_tac leq_empty_use_env)\n    (* lam case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n    apply (simp add: leq_use_env_def)\n    apply (simp add: aff_use_env_def)\n    apply (simp add: null_use_env_def)\n   apply (rule_tac x=\"empty_use_env\" in exI)\n   apply (auto)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac diff_leq_use_env)\n   apply (simp add: leq_use_env_def)\n   apply (simp add: aff_use_env_def)\n   apply (simp add: null_use_env_def)\n    (* app case. since tau is primitive, the only possible const is the fix point *)\n  apply (case_tac e1)\n        apply (auto)\n  apply (case_tac \"x1 \\<noteq> FixConst\")\n   apply (case_tac x1)\n               apply (auto)\n       apply (simp_all add: pure_fun_def)\n    (* - with that in mind, we fill in the rest *)\n  apply (auto)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n   apply (case_tac \"\\<not> is_sexp e2\")\n    apply (case_tac e2)\n          apply (auto)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n       apply (rule_tac leq_empty_use_env)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac disj_empty_use_env2)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: app_req_def)\n  apply (rule_tac leq_empty_use_env)\n  done\n    \nlemma wt_sexp_no_req: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; req_type tau = Prim; is_sexp e \\<rbrakk> \\<Longrightarrow> well_typed env r_s1 e tau r_s2 empty_use_env\"     \n  apply (rule_tac r_c=\"r_s1\" in well_typed_decr_end_perm)\n    apply (rule_tac r_s=\"empty_use_env\" in well_typed_incr_simul_perm)\n     apply (rule_tac leq_empty_use_env)\n    apply (rule_tac wt_sexp_no_all)\n      apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (rule_tac leq_empty_use_env)\n  done       \n    \n    \nfun drop_use_env_dep where\n  \"drop_use_env_dep r_s OwnPerm = r_s\"\n| \"drop_use_env_dep r_s UsePerm = drop_use_env r_s\"\n| \"drop_use_env_dep r_s NoPerm = empty_use_env\"    \n  \nlemma wt_sexp_drop_dep_req: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; is_sexp e; safe_type_x tau r \\<rbrakk> \\<Longrightarrow> well_typed env r_s1 e tau r_s2 (drop_use_env_dep rx r)\"  \n  apply (case_tac r)\n    apply (auto)\n   apply (rule_tac wt_sexp_no_req)\n     apply (auto)\n  apply (rule_tac wt_sexp_drop_req)\n    apply (auto)\n  apply (simp add: unlim_def)\n  done\n    \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/DropEnv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982043529716, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.31883859052376806}}
{"text": "(*  Title:      JinjaThreads/Compiler/Compiler1.thy\n    Author:     Andreas Lochbihler, Tobias Nipkow\n\n    Based on Jinja/Compiler/Compiler1\n*)\n\nsection \\<open>Compilation Stage 1\\<close>\n\ntheory Compiler1 imports\n  PCompiler\n  J1State\n  ListIndex \nbegin\n\ndefinition fresh_var :: \"vname list \\<Rightarrow> vname\"\n  where \"fresh_var Vs = sum_list (STR ''V'' # Vs)\"\n\nlemma fresh_var_fresh: \"fresh_var Vs \\<notin> set Vs\"\nproof -\n  have \"V \\<in> set Vs \\<Longrightarrow> length (String.explode V) < length (String.explode (fresh_var Vs))\" for V\n    by (induction Vs) (auto simp add: fresh_var_def Literal.rep_eq)\n  then show ?thesis\n    by auto\nqed\n\ntext\\<open>Replacing variable names by indices.\\<close>\n\nfunction compE1  :: \"vname list \\<Rightarrow> 'addr expr      \\<Rightarrow> 'addr expr1\"\n  and compEs1 :: \"vname list \\<Rightarrow> 'addr expr list \\<Rightarrow> 'addr expr1 list\"\nwhere\n  \"compE1 Vs (new C) = new C\"\n| \"compE1 Vs (newA T\\<lfloor>e\\<rceil>) = newA T\\<lfloor>compE1 Vs e\\<rceil>\"\n| \"compE1 Vs (Cast T e) = Cast T (compE1 Vs e)\"\n| \"compE1 Vs (e instanceof T) = (compE1 Vs e) instanceof T\"\n| \"compE1 Vs (Val v) = Val v\"\n| \"compE1 Vs (Var V) = Var(index Vs V)\"\n| \"compE1 Vs (e\\<guillemotleft>bop\\<guillemotright>e') = (compE1 Vs e)\\<guillemotleft>bop\\<guillemotright>(compE1 Vs e')\"\n| \"compE1 Vs (V:=e) = (index Vs V):= (compE1 Vs e)\"\n| \"compE1 Vs (a\\<lfloor>i\\<rceil>) = (compE1 Vs a)\\<lfloor>compE1 Vs i\\<rceil>\"\n| \"compE1 Vs (a\\<lfloor>i\\<rceil>:=e) = (compE1 Vs a)\\<lfloor>compE1 Vs i\\<rceil>:=compE1 Vs e\"\n| \"compE1 Vs (a\\<bullet>length) = compE1 Vs a\\<bullet>length\"\n| \"compE1 Vs (e\\<bullet>F{D}) = compE1 Vs e\\<bullet>F{D}\"\n| \"compE1 Vs (e\\<bullet>F{D}:=e') = compE1 Vs e\\<bullet>F{D}:=compE1 Vs e'\"\n| \"compE1 Vs (e\\<bullet>compareAndSwap(D\\<bullet>F, e', e'')) = compE1 Vs e\\<bullet>compareAndSwap(D\\<bullet>F, compE1 Vs e', compE1 Vs e'')\"\n| \"compE1 Vs (e\\<bullet>M(es)) = (compE1 Vs e)\\<bullet>M(compEs1 Vs es)\"\n| \"compE1 Vs {V:T=vo; e} = {(size Vs):T=vo; compE1 (Vs@[V]) e}\"\n| \"compE1 Vs (sync\\<^bsub>U\\<^esub> (o') e) = sync\\<^bsub>length Vs\\<^esub> (compE1 Vs o') (compE1 (Vs@[fresh_var Vs]) e)\"\n| \"compE1 Vs (insync\\<^bsub>U\\<^esub> (a) e) = insync\\<^bsub>length Vs\\<^esub> (a) (compE1 (Vs@[fresh_var Vs]) e)\"\n| \"compE1 Vs (e1;;e2) = (compE1 Vs e1);;(compE1 Vs e2)\"\n| \"compE1 Vs (if (b) e1 else e2) = (if (compE1 Vs b) (compE1 Vs e1) else (compE1 Vs e2))\"\n| \"compE1 Vs (while (b) e) = (while (compE1 Vs b) (compE1 Vs e))\"\n| \"compE1 Vs (throw e) = throw (compE1 Vs e)\"\n| \"compE1 Vs (try e1 catch(C V) e2) = try(compE1 Vs e1) catch(C (size Vs)) (compE1 (Vs@[V]) e2)\"\n\n| \"compEs1 Vs []     = []\"\n| \"compEs1 Vs (e#es) = compE1 Vs e # compEs1 Vs es\"\nby pat_completeness auto\ntermination\napply(relation \"case_sum (\\<lambda>p. size (snd p)) (\\<lambda>p. size_list size (snd p)) <*mlex*> {}\")\napply(rule wf_mlex[OF wf_empty])\napply(rule mlex_less, simp)+\ndone\n\nlemmas compE1_compEs1_induct =\n  compE1_compEs1.induct[case_names New NewArray Cast InstanceOf Val Var BinOp LAss AAcc AAss ALen FAcc FAss CAS Call Block Synchronized InSynchronized Seq Cond While throw TryCatch Nil Cons]\n\nlemma compEs1_conv_map [simp]: \"compEs1 Vs es = map (compE1 Vs) es\"\nby(induct es) simp_all\n\nlemmas compEs1_map_Val = compEs1_conv_map\n\nlemma compE1_eq_Val [simp]: \"compE1 Vs e = Val v \\<longleftrightarrow> e = Val v\"\napply(cases e, auto)\ndone\n\nlemma Val_eq_compE1 [simp]: \"Val v = compE1 Vs e \\<longleftrightarrow> e = Val v\"\napply(cases e, auto)\ndone\n\nlemma compEs1_eq_map_Val [simp]: \"compEs1 Vs es = map Val vs \\<longleftrightarrow> es = map Val vs\"\napply(induct es arbitrary: vs)\napply(auto, blast)\ndone\n\nlemma compE1_eq_Var [simp]: \"compE1 Vs e = Var V \\<longleftrightarrow> (\\<exists>V'. e = Var V' \\<and> V = index Vs V')\"\nby(cases e, auto)\n\nlemma compE1_eq_Call [simp]:\n  \"compE1 Vs e = obj\\<bullet>M(params) \\<longleftrightarrow> (\\<exists>obj' params'. e = obj'\\<bullet>M(params') \\<and> compE1 Vs obj' = obj \\<and> compEs1 Vs params' = params)\"\nby(cases e, auto)\n\nlemma length_compEs2 [simp]:\n  \"length (compEs1 Vs es) = length es\"\nby(simp add: compEs1_conv_map)\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n  shows expr_locks_compE1 [simp]: \"expr_locks (compE1 Vs e) = expr_locks e\"\n  and expr_lockss_compEs1 [simp]: \"expr_lockss (compEs1 Vs es) = expr_lockss es\"\nby(induct Vs e and Vs es rule: compE1_compEs1.induct)(auto intro: ext)\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n  shows contains_insync_compE1 [simp]: \"contains_insync (compE1 Vs e) = contains_insync e\"\n  and contains_insyncs_compEs1 [simp]: \"contains_insyncs (compEs1 Vs es) = contains_insyncs es\"\nby(induct Vs e and Vs es rule: compE1_compEs1.induct)simp_all\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n  shows max_vars_compE1: \"max_vars (compE1 Vs e) = max_vars e\"\n  and max_varss_compEs1: \"max_varss (compEs1 Vs es) = max_varss es\"\napply(induct Vs e and Vs es rule: compE1_compEs1.induct)\napply(auto)\ndone\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n  shows \\<B>: \"size Vs = n \\<Longrightarrow> \\<B> (compE1 Vs e) n\"\n  and \\<B>s: \"size Vs = n \\<Longrightarrow> \\<B>s (compEs1 Vs es) n\"\napply(induct Vs e and Vs es arbitrary: n and n rule: compE1_compEs1.induct)\napply auto\ndone\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n  shows fv_compE1: \"fv e \\<subseteq> set Vs \\<Longrightarrow> fv (compE1 Vs e) = (index Vs) ` (fv e)\"\n  and fvs_compEs1: \"fvs es \\<subseteq> set Vs \\<Longrightarrow> fvs (compEs1 Vs es) = (index Vs) ` (fvs es)\"\nproof(induct Vs e and Vs es rule: compE1_compEs1_induct)\n  case (Block Vs V ty vo exp)\n  have IH: \"fv exp \\<subseteq> set (Vs @ [V]) \\<Longrightarrow> fv (compE1 (Vs @ [V]) exp) = index (Vs @ [V]) ` fv exp\" by fact\n  from \\<open>fv {V:ty=vo; exp} \\<subseteq> set Vs\\<close> have fv': \"fv exp \\<subseteq> set (Vs @ [V])\" by auto\n  from IH[OF this] have IH': \"fv (compE1 (Vs @ [V]) exp) = index (Vs @ [V]) ` fv exp\" .\n  have \"fv (compE1 (Vs @ [V]) exp) - {length Vs} = index Vs ` (fv exp - {V})\"\n  proof(rule equalityI[OF subsetI subsetI])\n    fix x\n    assume x: \"x \\<in> fv (compE1 (Vs @ [V]) exp) - {length Vs}\"\n    hence \"x \\<noteq> length Vs\" by simp\n    from x IH' have \"x \\<in> index (Vs @ [V]) ` fv exp\" by simp\n    thus \"x \\<in> index Vs ` (fv exp - {V})\"\n    proof(rule imageE)\n      fix y\n      assume [simp]: \"x = index (Vs @ [V]) y\"\n        and y: \"y \\<in> fv exp\"\n      have \"y \\<noteq> V\"\n      proof\n        assume [simp]: \"y = V\"\n        hence \"x = length Vs\" by simp\n        with \\<open>x \\<noteq> length Vs\\<close> show False by contradiction\n      qed\n      moreover with fv' y have \"y \\<in> set Vs\" by auto\n      ultimately have \"index (Vs @ [V]) y = index Vs y\" by(simp)\n      thus ?thesis using y \\<open>y \\<noteq> V\\<close> by auto\n    qed\n  next\n    fix x\n    assume x: \"x \\<in> index Vs ` (fv exp - {V})\"\n    thus \"x \\<in> fv (compE1 (Vs @ [V]) exp) - {length Vs}\"\n    proof(rule imageE)\n      fix y\n      assume [simp]: \"x = index Vs y\"\n        and y: \"y \\<in> fv exp - {V}\"\n      with fv' have \"y \\<in> set Vs\" \"y \\<noteq> V\" by auto\n      hence \"index Vs y = index (Vs @ [V]) y\" by simp\n      with y have \"x \\<in> index (Vs @ [V]) ` fv exp\" by auto\n      thus ?thesis using IH' \\<open>y \\<in> set Vs\\<close> by simp\n    qed\n  qed\n  thus ?case by simp\nnext\n  case (Synchronized Vs V exp1 exp2)\n  have IH1: \"fv exp1 \\<subseteq> set Vs \\<Longrightarrow> fv (compE1 Vs exp1) = index Vs ` fv exp1\" \n    and IH2: \"fv exp2 \\<subseteq> set (Vs @ [fresh_var Vs]) \\<Longrightarrow> fv (compE1 (Vs @ [fresh_var Vs]) exp2) = index (Vs @ [fresh_var Vs]) ` fv exp2\"\n    by fact+\n  from \\<open>fv (sync\\<^bsub>V\\<^esub> (exp1) exp2) \\<subseteq> set Vs\\<close> have fv1: \"fv exp1 \\<subseteq> set Vs\"\n    and fv2: \"fv exp2 \\<subseteq> set Vs\" by auto\n  from fv2 have fv2': \"fv exp2 \\<subseteq> set (Vs @ [fresh_var Vs])\" by auto\n  have \"index (Vs @ [fresh_var Vs]) ` fv exp2 = index Vs ` fv exp2\"\n  proof(rule equalityI[OF subsetI subsetI])\n    fix x\n    assume x: \"x \\<in> index (Vs @ [fresh_var Vs]) ` fv exp2\"\n    thus \"x \\<in> index Vs ` fv exp2\"\n    proof(rule imageE)\n      fix y\n      assume [simp]: \"x = index (Vs @ [fresh_var Vs]) y\"\n        and y: \"y \\<in> fv exp2\"\n      from y fv2 have \"y \\<in> set Vs\" by auto\n      moreover hence \"y \\<noteq> (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n      ultimately show ?thesis using y by(auto)\n    qed\n  next\n    fix x\n    assume x: \"x \\<in> index Vs ` fv exp2\"\n    thus \"x \\<in> index (Vs @ [fresh_var Vs]) ` fv exp2\"\n    proof(rule imageE)\n      fix y\n      assume [simp]: \"x = index Vs y\"\n        and y: \"y \\<in> fv exp2\"\n      from y fv2 have \"y \\<in> set Vs\" by auto\n      moreover hence \"y \\<noteq> (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n      ultimately have \"index Vs y = index (Vs @ [fresh_var Vs]) y\" by simp\n      thus ?thesis using y by(auto)\n    qed\n  qed\n  with IH1[OF fv1] IH2[OF fv2'] show ?case by(auto)\nnext\n  case (InSynchronized Vs V a exp)\n  have IH: \"fv exp \\<subseteq> set (Vs @ [fresh_var Vs]) \\<Longrightarrow> fv (compE1 (Vs @ [fresh_var Vs]) exp) = index (Vs @ [fresh_var Vs]) ` fv exp\"\n    by fact\n  from \\<open>fv (insync\\<^bsub>V\\<^esub> (a) exp) \\<subseteq> set Vs\\<close> have fv: \"fv exp \\<subseteq> set Vs\" by simp\n  hence fv': \"fv exp \\<subseteq> set (Vs @ [fresh_var Vs])\" by auto\n  have \"index (Vs @ [fresh_var Vs]) ` fv exp = index Vs ` fv exp\"\n  proof(rule equalityI[OF subsetI subsetI])\n    fix x\n    assume \"x \\<in> index (Vs @ [fresh_var Vs]) ` fv exp\"\n    thus \"x \\<in> index Vs ` fv exp\"\n    proof(rule imageE)\n      fix y\n      assume [simp]: \"x = index (Vs @ [fresh_var Vs]) y\"\n        and y: \"y \\<in> fv exp\"\n      from y fv have \"y \\<in> set Vs\" by auto\n      moreover hence \"y \\<noteq> (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n      ultimately have \"index (Vs @ [fresh_var Vs]) y = index Vs y\" by simp\n      thus ?thesis using y by simp\n    qed\n  next\n    fix x\n    assume \"x \\<in> index Vs ` fv exp\"\n    thus \"x \\<in> index (Vs @ [fresh_var Vs]) ` fv exp\"\n    proof(rule imageE)\n      fix y\n      assume [simp]: \"x = index Vs y\"\n        and y: \"y \\<in> fv exp\"\n      from y fv have \"y \\<in> set Vs\" by auto\n      moreover hence \"y \\<noteq> (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n      ultimately have \"index Vs y = index (Vs @ [fresh_var Vs]) y\" by simp\n      thus ?thesis using y by auto\n    qed\n  qed\n  with IH[OF fv'] show ?case by simp\nnext\n  case (TryCatch Vs exp1 C V exp2)\n  have IH1: \"fv exp1 \\<subseteq> set Vs \\<Longrightarrow> fv (compE1 Vs exp1) = index Vs ` fv exp1\" \n    and IH2: \"fv exp2 \\<subseteq> set (Vs @ [V]) \\<Longrightarrow> fv (compE1 (Vs @ [V]) exp2) = index (Vs @ [V]) ` fv exp2\"\n    by fact+\n  from \\<open>fv (try exp1 catch(C V) exp2) \\<subseteq> set Vs\\<close> have fv1: \"fv exp1 \\<subseteq> set Vs\"\n    and fv2: \"fv exp2 \\<subseteq> set (Vs @ [V])\" by auto\n  have \"index (Vs @ [V]) ` fv exp2 - {length Vs} = index Vs ` (fv exp2 - {V})\" \n  proof(rule equalityI[OF subsetI subsetI])\n    fix x\n    assume x: \"x \\<in> index (Vs @ [V]) ` fv exp2 - {length Vs}\"\n    hence \"x \\<noteq> length Vs\" by simp\n    from x have \"x \\<in> index (Vs @ [V]) ` fv exp2\" by auto\n    thus \"x \\<in> index Vs ` (fv exp2 - {V})\"\n    proof(rule imageE)\n      fix y\n      assume [simp]: \"x = index (Vs @ [V]) y\"\n        and y: \"y \\<in> fv exp2\"\n      have \"y \\<noteq> V\"\n      proof\n        assume [simp]: \"y = V\"\n        hence \"x = length Vs\" by simp\n        with \\<open>x \\<noteq> length Vs\\<close> show False by contradiction\n      qed\n      moreover with fv2 y have \"y \\<in> set Vs\" by auto\n      ultimately have \"index (Vs @ [V]) y = index Vs y\" by(simp)\n      thus ?thesis using y \\<open>y \\<noteq> V\\<close> by auto\n    qed\n  next\n    fix x\n    assume x: \"x \\<in> index Vs ` (fv exp2 - {V})\"\n    thus \"x \\<in> index (Vs @ [V]) ` fv exp2 - {length Vs}\"\n    proof(rule imageE)\n      fix y\n      assume [simp]: \"x = index Vs y\"\n        and y: \"y \\<in> fv exp2 - {V}\"\n      with fv2 have \"y \\<in> set Vs\" \"y \\<noteq> V\" by auto\n      hence \"index Vs y = index (Vs @ [V]) y\" by simp\n      with y have \"x \\<in> index (Vs @ [V]) ` fv exp2\" by auto\n      thus ?thesis using \\<open>y \\<in> set Vs\\<close> by simp\n    qed\n  qed\n  with IH1[OF fv1] IH2[OF fv2] show ?case by auto\nqed(auto)\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n  shows syncvars_compE1: \"fv e \\<subseteq> set Vs \\<Longrightarrow> syncvars (compE1 Vs e)\"\n  and syncvarss_compEs1: \"fvs es \\<subseteq> set Vs \\<Longrightarrow> syncvarss (compEs1 Vs es)\"\nproof(induct Vs e and Vs es rule: compE1_compEs1_induct)\n  case (Block Vs V ty vo exp)\n  from \\<open>fv {V:ty=vo; exp} \\<subseteq> set Vs\\<close> have \"fv exp \\<subseteq> set (Vs @ [V])\" by auto\n  from \\<open>fv exp \\<subseteq> set (Vs @ [V]) \\<Longrightarrow> syncvars (compE1 (Vs @ [V]) exp)\\<close>[OF this] show ?case by(simp)\nnext\n  case (Synchronized Vs V exp1 exp2)\n  note IH1 = \\<open>fv exp1 \\<subseteq> set Vs \\<Longrightarrow> syncvars (compE1 Vs exp1)\\<close>\n  note IH2 = \\<open>fv exp2 \\<subseteq> set (Vs @ [fresh_var Vs]) \\<Longrightarrow> syncvars (compE1 (Vs @ [fresh_var Vs]) exp2)\\<close>\n  from \\<open>fv (sync\\<^bsub>V\\<^esub> (exp1) exp2) \\<subseteq> set Vs\\<close> have fv1: \"fv exp1 \\<subseteq> set Vs\"\n    and fv2: \"fv exp2 \\<subseteq> set Vs\" and fv2': \"fv exp2 \\<subseteq> set (Vs @ [fresh_var Vs])\" by auto\n  have \"length Vs \\<notin> index (Vs @ [fresh_var Vs]) ` fv exp2\"\n  proof\n    assume \"length Vs \\<in> index (Vs @ [fresh_var Vs]) ` fv exp2\"\n    thus False\n    proof(rule imageE)\n      fix x\n      assume x: \"length Vs = index (Vs @ [fresh_var Vs]) x\"\n        and x': \"x \\<in> fv exp2\"\n      from x' fv2 have \"x \\<in> set Vs\" \"x \\<noteq> (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n      with x show ?thesis by(simp)\n    qed\n  qed\n  with IH1[OF fv1] IH2[OF fv2'] fv2' show ?case by(simp add: fv_compE1)\nnext\n  case (InSynchronized Vs V a exp)\n  note IH = \\<open>fv exp \\<subseteq> set (Vs @ [fresh_var Vs]) \\<Longrightarrow> syncvars (compE1 (Vs @ [fresh_var Vs]) exp)\\<close>\n  from \\<open>fv (insync\\<^bsub>V\\<^esub> (a) exp) \\<subseteq> set Vs\\<close> have fv: \"fv exp \\<subseteq> set Vs\"\n    and fv': \"fv exp \\<subseteq> set (Vs @ [fresh_var Vs])\" by auto\n  have \"length Vs \\<notin> index (Vs @ [fresh_var Vs]) ` fv exp\"\n  proof\n    assume \"length Vs \\<in> index (Vs @ [fresh_var Vs]) ` fv exp\"\n    thus False\n    proof(rule imageE)\n      fix x\n      assume x: \"length Vs = index (Vs @ [fresh_var Vs]) x\"\n        and x': \"x \\<in> fv exp\"\n      from x' fv have \"x \\<in> set Vs\" \"x \\<noteq> (fresh_var Vs)\" by(auto simp add: fresh_var_fresh)\n      with x show ?thesis by(simp)\n    qed\n  qed\n  with IH[OF fv'] fv' show ?case by(simp add: fv_compE1)\nnext\n  case (TryCatch Vs exp1 C V exp2)\n  note IH1 = \\<open>fv exp1 \\<subseteq> set Vs \\<Longrightarrow> syncvars (compE1 Vs exp1)\\<close>\n  note IH2 = \\<open>fv exp2 \\<subseteq> set (Vs @ [V]) \\<Longrightarrow> syncvars (compE1 (Vs @ [V]) exp2)\\<close>\n  from \\<open>fv (try exp1 catch(C V) exp2) \\<subseteq> set Vs\\<close> have fv1: \"fv exp1 \\<subseteq> set Vs\"\n    and fv2: \"fv exp2 \\<subseteq> set (Vs @ [V])\" by auto\n  from IH1[OF fv1] IH2[OF fv2] show ?case by auto\nqed auto\n\nlemma (in heap_base) synthesized_call_compP [simp]:\n  \"synthesized_call (compP f P) h aMvs = synthesized_call P h aMvs\"\nby(simp add: synthesized_call_def)\n\n\nprimrec fin1 :: \"'addr expr \\<Rightarrow> 'addr expr1\"\nwhere\n  \"fin1 (Val v) = Val v\"\n| \"fin1 (throw e) = throw (fin1 e)\"\n\nlemma comp_final: \"final e \\<Longrightarrow> compE1 Vs e = fin1 e\"\nby(erule finalE, simp_all)\n\nlemma fixes e :: \"'addr expr\" and es :: \"'addr expr list\"\n  shows [simp]: \"max_vars (compE1 Vs e) = max_vars e\"\n  and \"max_varss (compEs1 Vs es) = max_varss es\"\nby (induct Vs e and Vs es rule: compE1_compEs1_induct)(simp_all)\n\ntext\\<open>Compiling programs:\\<close>\n\ndefinition compP1 :: \"'addr J_prog \\<Rightarrow> 'addr J1_prog\"\nwhere\n  \"compP1  \\<equiv>  compP (\\<lambda>C M Ts T (pns,body). compE1 (this#pns) body)\"\n\ndeclare compP1_def[simp]\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Compiler/Compiler1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3188256822288364}}
{"text": "theory SafeRedCase\n  imports WTLemma ReduceRestrX ReduceWTS SRUseEnv SafeRedUnpack\nbegin \n  \n  (* ###### case lemmas *)    \n\nlemma safe_app_op_case: \"\\<lbrakk> app_red_exp OpApp (s1, AppExp (OpExp xop) v) ax (s2, e2); FunTy tx tau r a = op_type xop \\<rbrakk> \\<Longrightarrow> well_typed env r_s1 e2 tau r_s1 empty_use_env\"\n  apply (case_tac v)\n       apply (auto)\n  apply (case_tac ax)\n   apply (auto)\n    (* given xop: op, x1: const, assuming tau matches the return type of xop, we want to show that e2 is well-typed.\n        now e2 can either be an op or a const.\n    *)\n  apply (case_tac \"\\<not> (\\<exists> rop. e2 = OpExp rop)\")\n   apply (case_tac \"\\<not> (\\<exists> c. e2 = ConstExp c)\")\n    apply (auto)\n        apply (case_tac xop)\n             apply (auto)\n    (* the hard part is proving that e2 will have the right type. *)\n       apply (case_tac xop)\n            apply (auto)\n         apply (simp add: pure_fun_def)\n        apply (simp add: pure_fun_def)\n       apply (simp add: pure_fun_def)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac leq_empty_use_env)\n    (* op case, same thing *)\n    apply (case_tac xop)\n         apply (auto)\n      apply (simp add: pure_fun_def)\n     apply (simp add: pure_fun_def)\n    apply (simp add: pure_fun_def)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac leq_empty_use_env)\n  done  \n\nlemma well_typed_state_add_vars: \"\\<lbrakk> well_typed_state s1 env rs_map; fresh_var s1 x; well_typed_mem_value env r_s tau v; proper_mem_value rs_map v;\n  sub_use_env s1 r_s; sep_nres_map r_s (rem_env rs_map x) \\<rbrakk> \\<Longrightarrow> well_typed_state (add_env s1 x v) (add_env env x tau) (add_env rs_map x r_s)\"\n    (* starts by proving the validity of the env + res map *)\n  apply (simp add: well_typed_state_def)\n  apply (auto)\n    apply (rule_tac dist_add_sub_env)\n    apply (simp)\n   apply (simp add: valid_nres_map_def)\n   apply (auto)\n    (* the state is still fully covered by the map *)\n     apply (simp add: full_nres_map_def)\n     apply (auto)\n      apply (simp add: add_env_def)\n      apply (auto)\n     apply (simp add: add_env_def)\n     apply (auto)\n    (* prove disjointness remains *)\n    apply (rule_tac disj_add_nres_map)\n     apply (auto)\n    (* prove containment remains *)\n   apply (rule_tac add_sub_nres_map2)\n    apply (rule_tac add_sub_nres_map1)\n     apply (simp_all)\n   apply (simp add: fresh_var_def)\n    (* now it remains to prove that all the values are still well-typed. we do the x = xa case first *)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (case_tac \"x = xa\")\n   apply (case_tac \"add_env s1 x v x\")\n    apply (simp add: add_env_def)\n   apply (auto)\n   apply (case_tac \"add_env env x tau x\")\n    apply (simp add: add_env_def)\n   apply (auto)\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" in nres_add_same)\n   apply (simp)\n   apply (rule_tac well_typed_mv_add_vars)\n    apply (simp add: add_env_def)\n   apply (simp add: fresh_var_def)\n    apply (simp add: sub_env_def)\n    (* proper mem value *)\n   apply (rule_tac proper_add_mv)\n    apply (simp add: add_env_def)\n   apply (simp add: nres_lookup_def)\n   apply (simp add: valid_nres_map_def)\n   apply (simp add: full_nres_map_def)\n   apply (simp add: fresh_var_def)\n   apply (rule_tac leq_empty_use_env)\n    (* now we do that x \\<noteq> xa case *)\n  apply (simp add: add_env_def)\n  apply (case_tac \"s1 xa\")\n   apply (auto)\n  apply (simp add: add_env_def)\n  apply (case_tac \"env xa\")\n   apply (auto)\n  apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" and y=\"xa\" in nres_add_diff)\n   apply (simp_all)\n  apply (rule_tac well_typed_mv_add_vars)\n   apply (auto)\n  apply (simp add: fresh_var_def)\n   apply (simp add: sub_env_def)\n    (* properness *)\n  apply (rule_tac proper_add_mv)\n   apply (simp)\n  apply (simp add: fresh_var_def)\n  apply (simp add: valid_nres_map_def)\n  apply (simp add: full_nres_map_def)\n  apply (simp add: nres_lookup_def)\n  apply (rule_tac leq_empty_use_env)\n  done    \n    \n    (* this lemma states that given a well-typed state, adding x simultaneously to the state, env, rs_map should yield another well-typed state.  *)(*\nlemma well_typed_state_add_vars: \"\\<lbrakk> well_typed_state s1 env rs_map; fresh_var s1 x; well_typed_mem_value s1 env (intro_use_env empty_use_env cs) tau v;\n  scope_use_env rs_map (intro_use_env empty_use_env cs)(*; sep_res_map (intro_use_env empty_use_env cs) rs_map*) \\<rbrakk> \\<Longrightarrow>\n  well_typed_state (add_env s1 x v) (add_env env x tau) (add_mem rs_map x (intro_use_env empty_use_env cs))\"\n    (* starts by proving the validity of the env + res map *)\n  apply (simp add: well_typed_state_def)\n  apply (auto)\n    apply (rule_tac dist_add_sub_env)\n    apply (simp)\n   apply (simp add: valid_res_map_def)\n   apply (auto)(*\n     apply (rule_tac disj_add_res_map)\n      apply (auto)*)\n    apply (rule_tac add_sub_res_map)\n    apply (auto)\n   apply (rule_tac add_scope_res_map)\n     apply (auto)\n   apply (simp add: fresh_var_def)\n   apply (simp add: sub_res_map_def)\n   apply (simp add: fresh_map_var_def)\n    (* now it remains to prove that all the values are still well-typed. we do the x = xa case first *)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (case_tac \"x = xa\")\n   apply (case_tac \"add_env s1 x v x\")\n    apply (simp add: add_env_def)\n   apply (auto)\n   apply (case_tac \"add_env env x tau x\")\n    apply (simp add: add_env_def)\n   apply (auto)\n   apply (simp add: lookup_res_def)\n   apply (simp add: add_mem_def)\n   apply (rule_tac well_typed_mv_add_vars)\n    apply (rule_tac well_typed_mv_add_env)\n      apply (simp add: add_env_def)\n     apply (auto)\n   apply (simp add: fresh_var_def)\n   apply (simp add: sub_env_def)\n    (* now we do that x \\<noteq> xa case *)\n  apply (simp add: add_env_def)\n  apply (case_tac \"s1 xa\")\n   apply (auto)\n  apply (simp add: add_env_def)\n  apply (case_tac \"env xa\")\n   apply (auto)\n  apply (simp add: lookup_res_def)\n  apply (simp add: add_mem_def)\n  apply (rule_tac well_typed_mv_add_vars)\n   apply (rule_tac well_typed_mv_add_env)\n     apply (auto)\n  apply (simp add: fresh_var_def)\n  apply (simp add: sub_env_def)\n  done*)\n    \nlemma sacc_make_act_case: \"\n        \\<lbrakk>well_typed_state s1 env rs_map; app_red_exp ConstApp (s1, AppExp (ConstExp c) v) (MakeAct x) (s2, e2); valid_exp_use_env s1 rs_map r_f;\n                well_typed env r_s1 v t1 r_s2 rx2; leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env rx1 (lift_use_env rx2 r))); leq_use_env rx r_s3;\n                FunTy t1 t2 r a \\<in> const_type c; c \\<noteq> FixConst; ax = MakeAct x; leq_use_env r_s1 r_f\\<rbrakk>\n               \\<Longrightarrow> well_typed (add_env env x t2) (add_use_env r_s1 x OwnPerm) e2 t2 r_s3 rx\"\n    (* e2 will always be the generated variable *)\n  apply (case_tac \"e2 \\<noteq> VarExp x SelfRef\")\n   apply (case_tac c)\n                apply (auto)\n    (* simple var reqs *)\n   apply (simp add: add_env_def)\n    apply (case_tac c)\n               apply (auto)\n   apply (simp add: deref_name_def)\n  apply (simp add: add_env_def)\n  apply (auto)\n    apply (case_tac c)\n                apply (auto)\n    apply (simp add: pure_fun_def)\n   apply (rule_tac ereq_leq_use_envx)\n   apply (simp add: add_use_env_def)\n    (* prelim: x2 is fresh *)\n  apply (case_tac \"\\<not> fresh_var s1 x\")\n   apply (case_tac c)\n                apply (auto)\n    (* prelim: cs is empty, remove elim *)(*\n  apply (case_tac \"\\<not> cs = {}\")\n   apply (case_tac c)\n                apply (auto)*)\n    (* prelim: r_s3 \\<le> r_s1 *)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"diff_use_env r_s2 (comp_use_env rx1 (lift_use_env rx2 r))\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n    (* we can achieve the desired permissions by removing x from the end perms + reqs (which is okay since they dont appear anywhere else yet). *)\n  apply (rule_tac x=\"one_use_env x OwnPerm\" in exI)\n  apply (auto)\n    (* - the end perm bound is possible since we assume r_s3 didnt already contain x2 *)\n    apply (rule_tac t=\" leq_use_env r_s3 (diff_use_env (add_use_env r_s1 x OwnPerm) (comp_use_env (ereq_use_env x t2) (one_use_env x OwnPerm)))\" and\n        s=\" leq_use_env (rem_use_env r_s3 x) (diff_use_env (add_use_env r_s1 x OwnPerm) (comp_use_env (ereq_use_env x t2) (one_use_env x OwnPerm)))\" in subst)\n     apply (cut_tac r_s=\"r_s3\" and x=\"x\" in ignore_rem_use_env)\n      apply (rule_tac r_s=\"r_s1\" in leq_use_none)\n       apply (auto)\n     apply (simp add: valid_exp_use_env_def)\n     apply (simp add: sub_use_env_def)\n     apply (auto)\n     apply (erule_tac x=\"x\" in allE)\n     apply (simp add: fresh_var_def)\n     apply (cut_tac r_x=\"r_s1\" and r_s=\"r_f\" and x=\"x\" in leq_use_none)\n       apply (auto)\n    (* - given this, we can finish proving the bound *)\n    apply (rule_tac rhs_unroll_dcl_use_env)\n    apply (rule_tac rhs_unroll_rem_use_env)\n    apply (rule_tac dist_rem_leq_use_env)\n    apply (rule_tac rhs_weak_leq_use_env)\n     apply (rule_tac weak_ereq_use_env)\n     apply (case_tac c)\n                   apply (auto)\n     apply (simp add: pure_fun_def)\n     apply (simp add: unlim_def)\n    apply (rule_tac rhs_add_leq_use_env)\n     apply (auto)\n    (* - unrolling definitions to prove the subtracter bound *)\n   apply (simp add: leq_use_env_def)\n   apply (simp add: one_use_env_def)\n   apply (simp add: add_use_env_def)\n    (* - proving the requirement bound *)\n  apply (rule_tac r_sb=\"diff_use_env (ereq_use_env x t2) (one_use_env x OwnPerm)\" in trans_leq_use_env)\n   apply (simp add: ereq_use_env_def)\n   apply (rule_tac diff_one_leq_use_env)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac self_diff_leq_use_env)\n  done    \n    \nlemma add_env_force_ex: \"\\<lbrakk> \\<forall> z. add_env s x v z = add_env s x w z \\<rbrakk> \\<Longrightarrow> v = w\"    \n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: add_env_def)\n  done\n    \nlemma add_env_force: \"\\<lbrakk> add_env s x v = add_env s x w \\<rbrakk> \\<Longrightarrow> v = w\"    \n  apply (rule_tac s=\"s\" and x=\"x\" and v=\"v\" and w=\"w\" in add_env_force_ex)\n  apply (auto)\n  done\n    \nlemma disj_add_use_env: \"\\<lbrakk> disj_use_env r_s r_x; r_s x = NoPerm \\<rbrakk> \\<Longrightarrow> disj_use_env r_s (add_use_env r_x x r)\"    \n  apply (simp add: disj_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  done\n    \nlemma strong_disj_add_use_env: \"\\<lbrakk> strong_disj_use_env r_s r_x; r_s x = NoPerm \\<rbrakk> \\<Longrightarrow> strong_disj_use_env r_s (add_use_env r_x x r)\"    \n  apply (simp add: strong_disj_use_env_def)\n  apply (simp add: add_use_env_def)\n  done    \n\nlemma add_valid_exp_use_env: \"\\<lbrakk> valid_nres_map s rs_map; valid_exp_use_env s rs_map r_s; fresh_var s x \\<rbrakk> \\<Longrightarrow>\n  valid_exp_use_env (add_env s x v) (add_env rs_map x empty_use_env) (add_use_env r_s x OwnPerm)\"  \n  apply (simp add: valid_exp_use_env_def)  \n  apply (auto)\n    (* domain preservation *)\n   apply (rule_tac rhs_add_sub_use_env)\n   apply (rule_tac add_sub_use_env)\n    apply (simp)\n   apply (simp add: add_env_def)\n    (* separation *)\n  apply (simp add: sep_nres_map_def)\n  apply (auto)\n  apply (case_tac \"x = xa\")\n   apply (auto)\n   apply (simp add: nres_add_same)\n   apply (rule_tac empty_strong_disj_use_env2)\n  apply (simp add: nres_add_diff)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (rule_tac comm_strong_disj_use_env)\n  apply (rule_tac strong_disj_add_use_env)\n  apply (rule_tac comm_strong_disj_use_env)\n   apply (simp)\n  apply (simp add: valid_nres_map_def)\n  apply (simp add: sub_nres_map_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (simp add: sub_use_env_def)\n  apply (simp add: fresh_var_def)\n  done\n    \n    \nlemma add_valid_use_env: \"\\<lbrakk> valid_res_map s rs_map; valid_use_env s rs_map r_c r_s; fresh_var s x \\<rbrakk> \\<Longrightarrow>\n  valid_use_env (add_env s x v) (add_mem rs_map x empty_use_env) (add_use_env r_c x OwnPerm) (add_use_env r_s x OwnPerm)\"    \n  apply (simp add: valid_use_env_def)\n  apply (auto)\n    (* subset preservation *)\n      apply (rule_tac rhs_add_sub_use_env)\n       apply (rule_tac add_sub_use_env)\n       apply (simp)\n      apply (simp add: add_env_def)\n    (* main perm set containment *)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    (* resource perm set containment *)\n  apply (simp add: valid_use_entry_def)\n  apply (auto)\n   apply (case_tac \"x = xa\")\n    apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"empty_use_env\" in lookup_add_mem_same)\n    apply (auto)\n    apply (rule_tac leq_empty_use_env)\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and y=\"xa\" and r_s=\"empty_use_env\" in lookup_add_mem_diff)\n    apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (auto)\n    apply (simp add: add_use_env_def)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (auto)\n    (* resource perm set disjointness *)\n  apply (case_tac \"x = xa\")\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"empty_use_env\" in lookup_add_mem_same)\n   apply (auto)\n   apply (rule_tac empty_strong_disj_use_env1)\n  apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and y=\"xa\" and r_s=\"empty_use_env\" in lookup_add_mem_diff)\n   apply (auto)\n  apply (rule_tac strong_disj_add_use_env)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (simp add: add_use_env_def)\n  apply (simp add: valid_res_map_def)\n    (* - by scoping, x cannot be in rs_map xa unless it is in rs_map, meaning it is in s, a contradiction *)\n  apply (cut_tac rs_map=\"rs_map\" and x=\"xa\" in self_scope_use_env)\n   apply (simp)\n  apply (case_tac \"lookup_mem rs_map x = None\")\n   apply (simp add: scope_use_env_def)\n  apply (simp add: sub_res_map_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: fresh_var_def)\n    (* - proving the weak part of rs_map is still contained *)(*\n  apply (case_tac \"x = xa\")\n   apply (cut_tac rs_map=\"rs_map\" and r_s=\"empty_use_env\" and x=\"xa\" in lookup_add_mem_same)\n   apply (auto)\n   apply (rule_tac sdrop_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (auto)\n   apply (simp add: add_use_env_def)\n  apply (cut_tac rs_map=\"rs_map\" and r_s=\"empty_use_env\" and x=\"x\" and y=\"xa\" in lookup_add_mem_diff)\n   apply (auto)\n  apply (rule_tac rhs_add_leq_use_env)\n   apply (simp_all)*)\n  done\n    \n\n\n  \n    (*\n      the hard part that we're dealing with right now is that at the end using pairs does NOT work for the WRITE constants,\n        since we want \"use\" permission for the array, but \"own\" permission for the value being written.\n\n      what this suggests is that we have to allow for constant + application to be a value.\n      even if we do this, we need to give them all their own unique cases, just like for unpacking.\n      - this is more complicated than it is with constants, since the contents of the first arg will generally be somewhat complex.\n\n    *)\n    \n    (*\nlemma sacc_use_case: \"\\<lbrakk>well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; well_typed env r_s1 v t1 r_s2 rx2;\n           leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)); leq_use_env rx r_s3; leq_use_env r_s1 r_f;\n           leq_use_env (app_req rx1 rx2 r t2 r_ex) rx; leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s2; leq_use_env r_ex r_s1;\n           FunTy t1 t2 r a \\<in> const_type c; c \\<noteq> FixConst; ax = UseAct x3; is_value v; app_con s1 c v (UseAct x3) (s2, e2)\\<rbrakk>\n          \\<Longrightarrow> \\<exists>g_ax. well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) e2 t2 r_s3 rx \\<and>\n                     well_typed_state s2 (red_env env g_ax) (red_nres_map rs_map g_ax) \\<and>\n                     valid_exp_use_env s2 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\<and>\n                     safe_act s1 r_f g_ax \\<and> corr_act (UseAct x3) g_ax\"    \n    (* array ext case *)\n  apply (case_tac c)\n              apply (auto)\n    apply (rule_tac x=\"WriteResAct x3\" in exI)\n    (* array read case *)\n    (* - first we have to extract the type of e2. *)\n  apply (cut_tac rs_map=\"rs_map\" and s=\"s1\" and env=\"env\" and i=\"i\" and v=\"va\" and x=\"deref_name x3 aa\" and arr=\"arr\" in well_typed_lookup_array_elem)\n      apply (auto)\n   apply (simp add: pure_fun_def)\n  apply (rule_tac x=\"ReadResAct\" in exI)\n  apply (auto)\n    (* - the idea here is that e2 should be re-typed so that all of its permissions are encompassed by x3. *)\n  apply (cut_tac env=\"env\" and s=\"s1\" and rs_map=\"rs_map\" in wts_mem_val_env)\n   apply (auto)\n  apply (case_tac \"\\<not> mem_ty tau_x\")\n   apply (simp add: mem_val_env_def)\n   apply (erule_tac x=\"x3\" in allE)\n   apply (auto)\n  apply (case_tac tau_x)\n        apply (auto)\n  apply (cut_tac env=\"env\" and r_x=\"r_x\" and e=\"va\" and tau=\"t\" and t=\"x4\" and x=\"x3\" and r_s=\"one_use_env x3 UsePerm\" in well_typed_ack_exp)\n          apply (auto)\n   apply (simp add: one_use_env_def)\n  apply (simp add: mem_val_env_def)\n  apply (erule_tac x=\"x3\" in allE)\n  apply (auto)\n    (* prelim: r_s3 \\<le> r_s1 *)\n  apply (cut_tac r_sc=\"r_s2\" and r_sb=\"diff_use_env r_s3a r_exaa\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env x3 (ArrayTy x4)) r_exa)\" in trans_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (auto)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (auto)\n    (* analysis based on whether x3 is in rx or not *)\n  apply (case_tac \"rx x3 \\<noteq> NoPerm\")\n   apply (case_tac \"\\<not> leq_use_env (one_use_env x3 UsePerm) rx\")\n    apply (simp add: leq_use_env_def)\n    apply (simp add: one_use_env_def)\n    apply (auto)\n    apply (case_tac \"x3 = x\")\n     apply (auto)\n    apply (case_tac \"rx x3\")\n      apply (auto)\n   apply (rule_tac ?r_s1.0=\"r_s3\" in well_typed_incr_start_perm)\n    apply (rule_tac rx=\"one_use_env x3 UsePerm\" in well_typed_incr_req)\n      apply (rule_tac r_s=\"one_use_env x3 UsePerm\" in well_typed_incr_simul_perm)\n       apply (rule_tac r_sb=\"rx\" in trans_leq_use_env)\n        apply (auto)\n   apply (simp add: pure_fun_def)\n    (* prelim: x3 \\<le> r_s1 *)\n  apply (cut_tac r_sc=\"one_use_env x3 UsePerm\" and r_sb=\"ereq_use_env x3 (ArrayTy x4)\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (simp)\n   apply (simp add: ereq_use_env_def)\n   apply (simp add: leq_use_env_def)\n   apply (simp add: one_use_env_def)\n   apply (simp add: end_req_perm_def)\n    (* case where t2 = Prim *)\n  apply (simp add: app_req_def)\n  apply (case_tac \"req_type t2 = Prim\")\n   apply (auto)\n   apply (rule_tac ?r_s2.0=\"r_s1\" and rx=\"empty_use_env\" in well_typed_simul_end_perm)\n      apply (rule_tac rx=\"one_use_env x3 UsePerm\" in wt_sexp_no_req)\n        apply (rule_tac r_s=\"one_use_env x3 UsePerm\" in well_typed_incr_simul_perm)\n         apply (auto)\n    apply (simp add: pure_fun_def)\n   apply (rule_tac value_is_sexp)\n   apply (rule_tac ?e1.0=\"va\" in ack_full_exp_value)\n    apply (auto)\n    (* otherwise, since rx x3 = NoPerm, we prepare a diff *)\n  apply (rule_tac ?r_s2.0=\"diff_use_env r_s1 (comp_use_env (comp_use_env (comp_use_env (ereq_use_env x3 (ArrayTy x4)) r_exa) r_exaa)\n          (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex))\" and\n      rx=\"diff_use_env (one_use_env x3 UsePerm) (comp_use_env (comp_use_env (comp_use_env (ereq_use_env x3 (ArrayTy x4)) r_exa) r_exaa)\n          (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex))\" in well_typed_simul_end_perm)\n     apply (rule_tac well_typed_diff_end_perm)\n      apply (rule_tac r_s=\"one_use_env x3 UsePerm\" in well_typed_incr_simul_perm)\n       apply (simp)\n      apply (simp add: pure_fun_def)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n      apply (auto)\n   apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n    apply (rule_tac rhs_unroll_dcl_use_env)\n    apply (rule_tac dist_diff_leq_use_env)\n    apply (rule_tac r_sb=\"diff_use_env r_s3a r_exaa\" in trans_leq_use_env)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (rule_tac dist_diff_leq_use_env)\n     apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n      apply (auto)\n  apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac comp_leq_use_env2)\n  apply (simp add: pair_req_def)\n  apply (simp add: pure_fun_def)\n  apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1a rx2a) r_exaa\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac lhs_unroll_dcl_use_env)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac comp_leq_use_env1)\n  apply (auto)\n  apply (rule_tac r_sb=\"diff_use_env (ereq_use_env x3 (ArrayTy x4)) (comp_use_env (ereq_use_env x3 (ArrayTy x4)) r_exa)\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (simp add: ereq_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: one_use_env_def)\n  apply (simp add: end_req_perm_def)\n  done*)\n    \nlemma saccmk2_var_type: \"\\<lbrakk> env x = Some (ChanTy t c_end) \\<rbrakk> \\<Longrightarrow>\n  well_typed env (one_use_env x OwnPerm) (VarExp x SelfRef) (ChanTy t c_end) (one_use_env x OwnPerm) (one_use_env x OwnPerm)\"    \n  apply (auto)\n    apply (simp add: deref_name_def)\n   apply (rule_tac ereq_leq_use_envx)\n   apply (simp add: one_use_env_def)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n     apply (rule_tac rhs_weak_leq_use_env)\n      apply (rule_tac dist_weak_comp_use_env)\n       apply (rule_tac weak_ereq_use_env)\n       apply (simp add: unlim_def)\n      apply (simp add: weak_use_env_def)\n      apply (simp add: empty_use_env_def)\n     apply (rule_tac id_leq_use_env)\n     apply (rule_tac id_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac ereq_leq_use_envx)\n  apply (simp add: one_use_env_def)\n  done\n  \nlemma saccmk2_pair_type: \"\\<lbrakk> well_typed env (one_use_env x1 OwnPerm) v1 t1 (one_use_env x1 OwnPerm) (one_use_env x1 OwnPerm);\n  well_typed env (one_use_env x2 OwnPerm) v2 t2 (one_use_env x2 OwnPerm) (one_use_env x2 OwnPerm);\n  r_s1 x1 = OwnPerm; r_s1 x2 = OwnPerm; r_s2 x1 = NoPerm; r_s2 x2 = NoPerm;\n  leq_use_env r_s2 r_s1; leq_use_env rx r_s2; is_own r; x1 \\<noteq> x2 \\<rbrakk> \\<Longrightarrow>\n  well_typed env r_s1 (PairExp v1 v2) (PairTy t1 t2 r) r_s2 rx\"\n  apply (auto)\n  apply (rule_tac x=\"r_s1\" in exI)\n  apply (rule_tac x=\"r_s1\" in exI)\n  apply (rule_tac x=\"one_use_env x1 OwnPerm\" in exI)\n  apply (auto)\n   apply (rule_tac r_s=\"one_use_env x1 OwnPerm\" in well_typed_incr_simul_perm)\n    apply (simp add: leq_use_env_def)\n    apply (simp add: one_use_env_def)\n   apply (simp)\n  apply (rule_tac x=\"one_use_env x2 OwnPerm\" in exI)\n  apply (auto)\n       apply (rule_tac r_s=\"one_use_env x2 OwnPerm\" in well_typed_incr_simul_perm)\n        apply (simp add: leq_use_env_def)\n        apply (simp add: one_use_env_def)\n       apply (simp)\n      apply (simp add: is_own_def)\n      apply (simp add: leq_use_env_def)\n      apply (simp add: one_use_env_def)\n     apply (simp add: is_own_def)\n     apply (simp add: leq_use_env_def)\n     apply (simp add: one_use_env_def)\n    apply (simp add: is_own_def)\n    apply (case_tac \"max_aff (req_type t1) (req_type t2)\")\n      apply (auto)\n   apply (simp add: is_own_def)\n   apply (simp add: one_use_env_def)\n   apply (simp add: disj_use_env_def)\n   apply (simp add: mini_disj_use_env_def)\n  apply (rule_tac x=\"add_use_env (one_use_env x1 OwnPerm) x2 OwnPerm\" in exI)\n  apply (auto)\n    apply (rule_tac mini_disj_diff_leq_use_env2)\n     apply (simp)\n    apply (simp add: mini_disj_use_env_def)\n    apply (simp add: one_use_env_def)\n    apply (simp add: add_use_env_def)\n    apply (auto)\n   apply (rule_tac add_leq_use_env)\n    apply (simp add: leq_use_env_def)\n    apply (simp add: one_use_env_def)\n   apply (auto)\n  apply (simp add: pair_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: one_use_env_def)\n  apply (simp add: is_own_def)\n  done\n    \nlemma sacc_mk2_act_case: \"\n  \\<lbrakk>well_typed_state s1 env rs_map; valid_exp_use_env s1 rs_map r_f; well_typed env r_s1 v t1 r_s2 rx2; proper_exp rs_map (AppExp (ConstExp c) v);\n                leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex));\n                leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s2; leq_use_env r_ex r_s1; leq_use_env rx r_s3;\n                leq_use_env (app_req rx1 rx2 r t2 r_ex) rx; leq_use_env r_s1 r_f; FunTy t1 t2 r a \\<in> const_type c; c \\<noteq> FixConst; ax = Mk2Act x31 x32;\n                is_value v; app_con s1 c v (Mk2Act x31 x32) (s2, e2)\\<rbrakk>\n               \\<Longrightarrow> \\<exists>g_ax. well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) e2 t2 (end_red_use_env r_s3 g_ax) (end_red_use_env rx g_ax) \\<and>\n                          proper_exp (red_nres_map rs_map g_ax) e2 \\<and>\n                          well_typed_state s2 (red_env env g_ax) (red_nres_map rs_map g_ax) \\<and>\n                          valid_exp_use_env s2 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\<and>\n                          safe_act s1 (infl_use_env r_f r_s3) g_ax \\<and> corr_act (Mk2Act x31 x32) g_ax\"\n  apply (case_tac c)\n              apply (auto)\n  apply (cut_tac eq_own)\n  apply (auto)\n  apply (rule_tac x=\"Add2ResAct x31 x32 t\" in exI)\n  apply (auto)\n       apply (cut_tac env=\"add_env (add_env env x31 (ChanTy t SEnd)) x32 (ChanTy t REnd)\" and\n        ?r_s1.0=\"add_use_env (add_use_env r_s1 x31 OwnPerm) x32 OwnPerm\" and\n        ?r_s2.0=\"r_s3\" and ?v1.0=\"VarExp x31 SelfRef\" and ?v2.0=\"VarExp x32 SelfRef\" and ?t1.0=\"ChanTy t SEnd\" and ?t2.0=\"ChanTy t REnd\"\n        and ?x1.0=\"x31\" and ?x2.0=\"x32\" in saccmk2_pair_type)\n                 apply (rule_tac saccmk2_var_type)\n                 apply (simp add: add_env_def)\n                apply (rule_tac saccmk2_var_type)\n                apply (simp add: add_env_def)\n               apply (auto)\n            apply (simp add: add_use_env_def)\n           apply (simp add: add_use_env_def)\n          apply (rule_tac r_s=\"r_f\" in leq_use_none)\n           apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n            apply (simp)\n           apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n            apply (rule_tac diff_leq_use_env)\n            apply (simp_all)\n          apply (simp add: fresh_var_def)\n          apply (simp add: valid_exp_use_env_def)\n          apply (simp add: sub_use_env_def)\n         apply (rule_tac r_s=\"r_f\" in leq_use_none)\n          apply (rule_tac r_sb=\"r_s1\" in trans_leq_use_env)\n           apply (simp)\n          apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n           apply (rule_tac diff_leq_use_env)\n           apply (simp_all)\n         apply (simp add: fresh_var_def)\n         apply (simp add: valid_exp_use_env_def)\n         apply (simp add: sub_use_env_def)\n        apply (rule_tac rhs_add_leq_use_env)\n         apply (rule_tac rhs_add_leq_use_env)\n          apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n           apply (rule_tac diff_leq_use_env)\n           apply (simp_all)\n       apply (rule_tac x=\"ChanTy t REnd\" in exI)\n       apply (rule_tac x=\"ra\" in exI)\n       apply (auto)\n        apply (simp add: pure_fun_def)\n        apply (simp add: is_own_def)\n       apply (rule_tac x=\"r_s2a\" in exI)\n       apply (rule_tac x=\"r_s3a\" in exI)\n       apply (rule_tac x=\"rx1a\" in exI)\n       apply (auto)\n       apply (rule_tac x=\"rx2a\" in exI)\n       apply (auto)\n       apply (rule_tac x=\"r_exb\" in exI)\n       apply (auto)\n       apply (simp add: pure_fun_def)\n       apply (simp add: is_own_def)\n    (* proving the state remains proper *)\n      apply (simp add: proper_exp_def)\n    (* proving the state remains well-typed: environment containment *)\n     apply (simp add: well_typed_state_def)\n     apply (auto)\n       apply (rule_tac dist_add_sub_env)\n       apply (rule_tac dist_add_sub_env)\n       apply (simp)\n    (* res_map validity: completeness *)\n      apply (simp add: valid_nres_map_def)\n      apply (auto)\n        apply (rule_tac add_full_nres_map)\n        apply (rule_tac add_full_nres_map)\n        apply (simp)\n    (* - disjointness *)\n       apply (rule_tac disj_add_nres_map)\n        apply (rule_tac disj_add_nres_map)\n         apply (simp)\n        apply (simp add: sep_nres_map_def)\n        apply (simp add: empty_strong_disj_use_env1)\n       apply (simp add: sep_nres_map_def)\n       apply (simp add: empty_strong_disj_use_env1)\n    (* - element containment *)\n      apply (rule_tac dist_add_sub_nres_map)\n       apply (rule_tac dist_add_sub_nres_map)\n        apply (simp)\n       apply (rule_tac empty_sub_use_env)\n      apply (rule_tac empty_sub_use_env)\n    (* proving that the memory is still well-typed. starting with x = x31 / x = x32 *)\n     apply (case_tac \"x = x31\")\n      apply (simp add: add_env_def)\n     apply (case_tac \"x = x32\")\n      apply (simp add: add_env_def)\n    (* - otherwise compare with the originals *)\n     apply (simp add: add_env_def)\n     apply (erule_tac x=\"x\" in allE)\n     apply (case_tac \"s1 x\")\n      apply (auto)\n     apply (simp add: add_env_def)\n     apply (case_tac \"env x\")\n      apply (auto)\n     apply (rule_tac well_typed_mv_add_vars)\n      apply (rule_tac well_typed_mv_add_vars)\n       apply (simp add: nres_lookup_def)\n       apply (simp add: add_env_def)\n      apply (simp add: fresh_var_def)\n      apply (simp add: sub_env_def)\n     apply (simp add: fresh_var_def)\n     apply (simp add: sub_env_def)\n      apply (simp add: add_env_def)\n    (* - properness *)\n     apply (rule_tac proper_add_mv)\n      apply (rule_tac proper_add_mv)\n       apply (simp)\n      apply (simp add: fresh_var_def)\n      apply (simp add: valid_nres_map_def)\n      apply (simp add: full_nres_map_def)\n      apply (simp add: nres_lookup_def)\n      apply (rule_tac leq_empty_use_env)\n     apply (simp add: fresh_var_def)\n     apply (simp add: valid_nres_map_def)\n     apply (simp add: full_nres_map_def)\n     apply (simp add: nres_lookup_def)\n     apply (simp add: add_env_def)\n     apply (rule_tac leq_empty_use_env)\n    (* proving the new res_map is still valid: expression map containment *)\n    apply (simp add: valid_exp_use_env_def)\n    apply (auto)\n     apply (rule_tac rhs_add_sub_use_env)\n      apply (rule_tac rhs_add_sub_use_env)\n       apply (rule_tac add_sub_use_env)\n       apply (rule_tac add_sub_use_env)\n       apply (simp)\n      apply (simp add: add_env_def)\n     apply (simp add: add_env_def)\n    (* map separation *)\n    apply (rule_tac add_sep_nres_map)\n     apply (rule_tac add_sep_nres_map)\n      apply (simp add: sep_nres_map_def)\n      apply (auto)\n      apply (simp add: well_typed_state_def)\n      apply (simp add: valid_nres_map_def)\n      apply (simp add: sub_nres_map_def)\n      apply (rule_tac add_strong_disj_use_env)\n       apply (rule_tac add_strong_disj_use_env)\n        apply (simp)\n       apply (simp add: sub_use_env_def)\n       apply (simp add: fresh_var_def)\n      apply (simp add: sub_use_env_def)\n      apply (simp add: fresh_var_def)\n     apply (rule_tac empty_strong_disj_use_env2)\n    apply (rule_tac empty_strong_disj_use_env2)\n   apply (simp add: fresh_var_def)\n  apply (simp add: fresh_var_def)\n  done\n      \n  \n    (* the idea is that if we added a permission, we required it to be a variable not already in the env, ie a variable free in e2.\n      so then we can remove x by default. *)\n    (* in general, this statement says that given a constant-application, the result can be typed with a certain env + perm set,\n      so that the state remains well-typed relative to the env + global perm_map, and the env + perm set remains valid *)\nlemma safe_app_con_case: \"\\<lbrakk> well_typed_state s1 env rs_map;\n    app_red_exp ConstApp (s1, AppExp (ConstExp c) v) ax (s2, e2); valid_exp_use_env s1 rs_map r_f;\n    well_typed env r_s1 v t1 r_s2 rx2; proper_exp rs_map (AppExp (ConstExp c) v);\n    leq_use_env r_s3 (diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex));\n    leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s2; leq_use_env r_ex r_s1; disj_use_env rx1 (lift_use_env rx2 r);\n    leq_use_env rx r_s3; leq_use_env (app_req rx1 rx2 r t2 r_ex) rx; leq_use_env r_s1 r_f;\n    FunTy t1 t2 r a \\<in> const_type c; c \\<noteq> FixConst\\<rbrakk>\n       \\<Longrightarrow> \\<exists>g_ax . well_typed (red_env env g_ax) (exp_red_use_env r_s1 g_ax) e2 t2 (end_red_use_env r_s3 g_ax) (end_red_use_env rx g_ax) \\<and>\n                  proper_exp (red_nres_map rs_map g_ax) e2 \\<and> well_typed_state s2 (red_env env g_ax) (red_nres_map rs_map g_ax) \\<and>\n                  valid_exp_use_env s2 (red_nres_map rs_map g_ax) (exp_red_use_env r_f g_ax) \\<and> safe_act s1 (infl_use_env r_f r_s3) g_ax \\<and> corr_act ax g_ax\"\n  apply (case_tac ax)\n     apply (auto)\n    (* no action cases *)\n     apply (cut_tac ?r_s2.0=\"r_s2\" and ?r_s1.0=\"r_s1\" and env=\"env\" in well_typed_perm_leq)\n      apply (auto)\n     apply (case_tac c)\n                 apply (auto)\n     apply (rule_tac sares_unpack_case)\n                apply (auto)\n     apply (simp add: upc_init_abbrev_def)\n     apply (rule_tac x=\"r_s1\" in exI)\n     apply (auto)\n      apply (rule_tac id_leq_use_env)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac self_comp_leq_use_env1)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (rule_tac x=\"r_s2\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3a\" in exI)\n     apply (rule_tac x=\"rx1a\" in exI)\n     apply (auto)\n    (* new resource cases. in all cases t2 should be the correct type to add *)\n    apply (rule_tac x=\"AddResAct x2 t2 empty_use_env\" in exI)\n    apply (auto)\n    (* - lemma for main well-typedness statement *)\n        apply (rule_tac ?s2.0=\"s2\" and ?rx1.0=\"rx1\" in sacc_make_act_case)\n                  apply (auto)\n         apply (rule_tac r_sb=\"diff_use_env r_s2 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n          apply (rule_tac lhs_unroll_dcl_use_env)\n          apply (rule_tac self_diff_leq_use_env)\n         apply (simp)\n    (* - proper expression *)\n        apply (case_tac c)\n                    apply (auto)\n        apply (simp add: proper_exp_def)\n    (* - well typed state. *)\n       apply (case_tac \"\\<not> (\\<exists> v. s2 = add_env s1 x2 v)\")\n        apply (case_tac c)\n                    apply (auto)\n       apply (rule_tac well_typed_state_add_vars)\n           apply (auto)\n          apply (case_tac c)\n                      apply (auto)\n    (* - wt mem val: array case *)\n         apply (case_tac c)\n                     apply (auto)\n         apply (cut_tac s=\"s1\" and x=\"x2\" and v=\"va\" and w=\"ArrValue []\" in add_env_force)\n          apply (auto)\n         apply (simp add: pure_fun_def)\n    (* - valid res list *)\n         apply (rule_tac x=\"\\<lambda> x. None\" in exI)\n          apply (simp add: valid_res_list_def)\n    (* - properness *)\n         apply (case_tac c)\n                     apply (auto)\n         apply (cut_tac s=\"s1\" and x=\"x2\" and v=\"va\" and w=\"ArrValue []\" in add_env_force)\n          apply (simp)\n         apply (auto)\n    (* - x22 is contained in rs_map (true because x22 is the empty set) *)\n        apply (simp add: sub_use_env_def)\n        apply (simp add: empty_use_env_def)\n    (* - map separation + strength *)\n       apply (simp add: sep_nres_map_def)\n       apply (auto)\n       apply (rule_tac empty_strong_disj_use_env1)\n    (* - valid use env. *)\n      apply (case_tac \"\\<not> (\\<exists> v. s2 = add_env s1 x2 v)\")\n       apply (case_tac c)\n                   apply (auto)\n      apply (rule_tac add_valid_exp_use_env)\n        apply (simp add: well_typed_state_def)\n       apply (simp)\n      apply (case_tac c)\n                  apply (auto)\n     apply (case_tac c)\n                 apply (auto)\n     apply (simp add: fresh_var_def)\n    apply (rule_tac leq_empty_use_env)\n    (* dual new resource case. (basically only channel creation) *)\n   apply (rule_tac sacc_mk2_act_case)\n                apply (auto)\n    (* resource usage case. (currently empty) *)\n  apply (case_tac c)\n              apply (auto)\n(*\n   apply (case_tac c)\n                apply (auto)\n  apply (case_tac c)\n               apply (auto)*)\n  done    \n\n  \nlemma well_typed_empty_state: \"well_typed_state empty_env empty_env empty_env\"\n  apply (simp add: well_typed_state_def)\n  apply (auto)\n    apply (simp add: sub_env_def)\n    apply (simp add: empty_env_def)\n   apply (simp add: valid_nres_map_def)(*\n   apply (simp add: disj_res_map_def)\n   apply (auto)\n     apply (simp add: lookup_res_def)\n     apply (rule_tac empty_strong_disj_use_env1)*)\n   apply (auto)\n     apply (simp add: full_nres_map_def)\n     apply (simp add: empty_env_def)\n    apply (simp add: disj_nres_map_def)\n    apply (auto)\n    apply (simp add: nres_lookup_def)\n    apply (simp add: empty_env_def)\n    apply (rule_tac empty_strong_disj_use_env1)\n   apply (simp add: sub_nres_map_def)\n   apply (simp add: sub_use_env_def)\n   apply (simp add: nres_lookup_def)\n   apply (simp add: empty_env_def)\n   apply (simp add: empty_use_env_def) \n  apply (simp add: empty_env_def)\n  done\n  (*\nlemma well_typed_empty_env: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; well_typed_state s env rs_map; non_prim_env env; leq_use_env r_s1 empty_use_env \\<rbrakk> \\<Longrightarrow>\n  well_typed empty_env r_s1 e tau r_s2 rx\"\n  apply (cut_tac env=\"env\" and rs_map=\"empty_env\" and v=\"e\" and ?r_s1.0=\"r_s1\" and s=\"s\" in well_typed_restr)\n     apply (simp add: well_typed_state_def)\n     apply (simp add: valid_nres_map_def)\n    \n     apply (simp add: scope_res_map_def)\n    apply (simp add: scope_use_env_def)\n    apply (simp add: leq_use_env_def)\n    apply (simp add: empty_use_env_def)\n    apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (case_tac \"r_s1 x\")\n     apply (auto)\n  apply (rule_tac s=\"restr_env env NilStack\" and t=\"empty_env\" in subst)\n   apply (case_tac \"\\<not> (\\<forall> x. restr_env env NilStack x = empty_env x)\")\n    apply (auto)\n  apply (simp add: restr_env_def)\n  apply (simp add: empty_env_def)\n  done*)\n  \nfun state_vars where\n  \"state_vars s = { x | x. s x \\<noteq> None }\"\n  \ndefinition fv_restr_env where\n  \"fv_restr_env e s = (\\<lambda> x. if x \\<in> free_vars e then s x else None)\"\n  \nlemma fv_restr_env_use: \"\\<lbrakk> x \\<in> free_vars e \\<rbrakk> \\<Longrightarrow> fv_restr_env e s x = s x\"  \n  apply (simp add: fv_restr_env_def)\n  done\n    \nlemma dist_rem_contain_env: \"\\<lbrakk> contain_env s s' \\<rbrakk> \\<Longrightarrow> contain_env (rem_env s x) (rem_env s' x)\"    \n  apply (simp add: contain_env_def)\n  apply (simp add: rem_env_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (case_tac \"s' xa\")\n   apply (auto)\n  apply (simp add: rem_env_def)\n  done\n\nlemma fv_contain_env: \"\\<lbrakk> free_vars e' \\<subseteq> free_vars e \\<rbrakk> \\<Longrightarrow> contain_env (fv_restr_env e s) (fv_restr_env e' s)\"    \n  apply (simp add: contain_env_def)\n  apply (simp add: fv_restr_env_def)\n  apply (auto)\n  apply (case_tac \"s x\")\n   apply (auto)\n  apply (simp add: fv_restr_env_def)\n  apply (auto)\n  done\n\nlemma rem_fv_contain_env: \"\\<lbrakk> free_vars e' - {x} \\<subseteq> free_vars e \\<rbrakk> \\<Longrightarrow> contain_env (fv_restr_env e (rem_env s x)) (fv_restr_env e' (rem_env s x))\"    \n  apply (simp add: contain_env_def)\n  apply (simp add: fv_restr_env_def)\n  apply (auto)\n  apply (simp add: rem_env_def)\n  apply (auto)\n  apply (case_tac \"s xa\")\n   apply (auto)\n  apply (simp add: fv_restr_env_def)\n  apply (simp add: rem_env_def)\n  apply (auto)\n  done\n    \nlemma rem_fv_restr_env: \"rem_env (fv_restr_env e s) x = fv_restr_env e (rem_env s x)\"    \n  apply (case_tac \"\\<not> (\\<forall> y. rem_env (fv_restr_env e s) x y = fv_restr_env e (rem_env s x) y)\")\n   apply (auto)\n  apply (simp add: rem_env_def)\n  apply (simp add: fv_restr_env_def)\n  apply (case_tac \"x = y\")\n   apply (auto)\n   apply (case_tac \"x \\<in> free_vars e\")\n    apply (auto)\n  apply (simp add: fv_restr_env_def)\n  apply (case_tac \"y \\<in> free_vars e\")\n   apply (auto)\n  done\n(*\nlemma fv_restr_contain_env: \"\\<lbrakk> scope_use_env rs_map r_s; non_prim_env env; well_typed env r_s v tau r_se r_xe \\<rbrakk> \\<Longrightarrow>\n  contain_env (restr_env s rs_map) (fv_restr_env v s)\"    \n  apply (simp add: contain_env_def)\n  apply (simp add: fv_restr_env_def)\n  apply (auto)\n  apply (case_tac \"s x\")\n   apply (auto)\n  apply (simp add: scope_use_env_def)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n   apply (simp add: restr_env_def)\n  apply (cut_tac x=\"x\" and e=\"v\" and ?r_s1.0=\"r_s\" in well_typed_no_npv_use)\n    apply (auto)\n  apply (simp add: non_prim_vars_def)\n  apply (simp add: non_prim_env_def)\n  apply (erule_tac x=\"x\" in allE)\n  apply (cut_tac env=\"env\" and x=\"x\" and e=\"v\" in well_typed_fv_env_use)\n    apply (auto)\n  apply (simp add: non_prim_entry_def)\n  done*)\n  \n    \n    (* the question is, how do we allow for replicable pairs while enforcing full resource disjointness?\n        i guess the \"natural\" way to do it based on what we already have is to simply allow pairs that contain\n        values that are not unique to also be values.\n\n        - if x is in the end perms, x is in the reqs. if r is own, (lift rx r) subtracts it out.\n        - if r is not own, it means that e is replicable, in which case it is again not a var,\n        - x is not in the end perms, which is trivial\n\n        an even cleaner solution is to make a \"replicable\" pair value and type accordingly.\n        in this case e is still a var, however at the level of reduction semantics, we can keep\n        the var out of the name set.\n     *)\n    \n    (* this lemma is used to show that variables passed into pair constructors are semi-disjoint.\n        we do this by showing that the var is not in the end perms after the reqs are removed.\n        - if x is in the end perms, x is in the reqs. if r is own, (lift rx r) subtracts it out.\n        - if r is not own, e is non-affine, meaning the \"var\" is not passed in. (empty name set)\n        - if x is not in the end perms, trivial.\n     *)\n    \ndefinition is_var where\n  \"is_var e x = (if e = VarExp x NoRef then False else True)\"\n    \nfun size_mem :: \"'a p_stack \\<Rightarrow> nat\" where  \n  \"size_mem NilStack = 0\"\n| \"size_mem (ConsStack x v s') = (size_mem s' + 1)\"\n \nlemma decr_size_mem: \"\\<lbrakk> lookup_mem rs_map x = Some (r_s, rs_map') \\<rbrakk> \\<Longrightarrow> size_mem rs_map' < size_mem rs_map\"    \n  apply (induct rs_map)\n   apply (auto)\n  apply (case_tac \"x1 = x\")\n   apply (auto)\n  done\n    \n    \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/SafeRedCase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883592602049, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.31882568222883634}}
{"text": "theory CoronaAppTwo\n  imports InfrastructureTwo\nbegin\nlocale scenarioCoronaTwo = scenarioCoronaOne +\n\nfixes corona_actorsT :: \"identity set\"\ndefines corona_actorsT_def: \"corona_actorsT \\<equiv> {''Alice'', ''Bob'', ''Charly'', ''David'', ''Eve'', ''Flo''}\"\n\nfixes corona_locationsT :: \"location set\"\ndefines corona_locationsT_def: \"corona_locationsT \\<equiv> {Location 0, Location 1}\"\nfixes pubT :: \"location\"\ndefines pubT_def: \"pubT \\<equiv> Location 0\"\nfixes shopT :: \"location\"\ndefines shopT_def: \"shopT \\<equiv> Location 1\"\n\n(* not relevant any more. It was made for earlier versions where the intersection happened\n   implicitly in the semantics. \nfixes identifiable :: \"[infrastructure,actor,efid, location] \\<Rightarrow> bool\"\ndefines identifiable_def: \"identifiable I a eid l\\<equiv> is_singleton{(Id,Eid). (Id, Eid) \\<in> kgra (graphI I) a l \\<and> Eid = eid}\"\nfixes global_policy :: \"[infrastructure, efid] \\<Rightarrow> bool\"\ndefines global_policy_def: \"global_policy I eid \\<equiv>  (\\<exists> l. \\<not>(identifiable I (Actor ''Eve'') eid l))\"\n*)\n\nfixes identifiableT' :: \"[efid, (identity * efid)set] \\<Rightarrow> bool\"\ndefines identifiableT'_def: \"identifiableT' eid A \\<equiv> is_singleton{(Id,Eid). (Id, Eid) \\<in> A \\<and> Eid = eid}\"\n\nfixes global_policyT'' :: \"[infrastructure, efid] \\<Rightarrow> bool\"\ndefines global_policyT''_def: \"global_policyT'' I eid \\<equiv>  \n             \\<not>(identifiableT' eid \n                ((\\<Inter> (kgra(graphI I)(''Eve'')`(nodes(graphI I))))\n                 - {(x,y). x = ''Eve''}))\"\n\nfixes global_policyT :: \"[infrastructure, efid] \\<Rightarrow> bool\"\ndefines global_policyT_def: \"global_policyT I eid \\<equiv>  \n             \\<forall> L. L \\<subseteq> nodes(graphI I) \\<longrightarrow> (\\<not>(identifiableT' eid \n               ((\\<Inter> (kgra(graphI I)(''Eve'')`L))\n                          - {(x,y). x = ''Eve''})))\"\n\nfixes ex_credsT :: \"identity \\<Rightarrow> efidlist\"\ndefines ex_credsT_def: \n          \"ex_credsT \\<equiv> (\\<lambda> x. if x = ''Alice'' then (Efids (Efid 1) 0 (\\<lambda> n. Efid (2^(n+1)))) else \n                            (if x = ''Bob'' then  (Efids (Efid 2) 0 (\\<lambda> n. Efid (3^(n+1)))) else \n                            (if x = ''Charly'' then (Efids (Efid 3) 0 (\\<lambda> n. Efid (5^(n+1)))) else\n                            (if x = ''David'' then (Efids (Efid 4) 0 (\\<lambda> n. Efid (7^(n+1)))) else\n                            (if x = ''Eve'' then (Efids (Efid 5) 0 (\\<lambda> n. Efid (11^(n+1)))) else \n                            (if x = ''Flo'' then (Efids (Efid 6) 0 (\\<lambda> n. Efid (13^(n+1)))) else\n                                 (Efids (Efid 0) 0 (\\<lambda> n. Efid (17^(n+1))))))))))\"\n\nfixes ex_credsT' :: \"identity \\<Rightarrow> efidlist\"\ndefines ex_credsT'_def: \n          \"ex_credsT' \\<equiv> (\\<lambda> x. if x = ''Alice'' then (Efids (Efid 1) 0 (\\<lambda> n. Efid (2^(n+1)))) else \n                            (if x = ''Bob'' then  (Efids (Efid 2) 1 (\\<lambda> n. Efid (3^(n+1)))) else \n                            (if x = ''Charly'' then (Efids (Efid 3) 0 (\\<lambda> n. Efid (5^(n+1)))) else\n                            (if x = ''David'' then (Efids (Efid 4) 0 (\\<lambda> n. Efid (7^(n+1)))) else\n                            (if x = ''Eve'' then (Efids (Efid 5) 0 (\\<lambda> n. Efid (11^(n+1)))) else \n                            (if x = ''Flo'' then (Efids (Efid 6) 0 (\\<lambda> n. Efid (13^(n+1)))) else\n                                 (Efids (Efid 0) 0 (\\<lambda> n. Efid (17^(n+1))))))))))\"\n\nfixes ex_credsT'' :: \"identity \\<Rightarrow> efidlist\"\ndefines ex_credsT''_def: \n          \"ex_credsT'' \\<equiv> (\\<lambda> x. if x = ''Alice'' then (Efids (Efid 1) 0 (\\<lambda> n. Efid (2^(n+1)))) else \n                            (if x = ''Bob'' then  (Efids (Efid 2) 1 (\\<lambda> n. Efid (3^(n+1)))) else \n                            (if x = ''Charly'' then (Efids (Efid 3) 0 (\\<lambda> n. Efid (5^(n+1)))) else\n                            (if x = ''David'' then (Efids (Efid 4) 0 (\\<lambda> n. Efid (7^(n+1)))) else\n                            (if x = ''Eve'' then (Efids (Efid 5) 1 (\\<lambda> n. Efid (11^(n+1)))) else \n                            (if x = ''Flo'' then (Efids (Efid 6) 0 (\\<lambda> n. Efid (13^(n+1)))) else\n                                 (Efids (Efid 0) 0 (\\<lambda> n. Efid (17^(n+1))))))))))\"\n\nfixes ex_locsT :: \"location \\<Rightarrow> string * (dlm * data) set\"\ndefines \"ex_locsT \\<equiv> (\\<lambda> x. ('''',{}))\"\n\nfixes ex_loc_assT :: \"location \\<Rightarrow> identity set\"\ndefines ex_loc_assT_def: \"ex_loc_assT \\<equiv>\n          (\\<lambda> x. if x = pubT then {''Alice'', ''Bob'', ''Eve''}  \n                 else (if x = shopT then {''Charly'', ''David'', ''Flo''} \n                       else {}))\"\nfixes ex_loc_assT' :: \"location \\<Rightarrow> identity set\"\ndefines ex_loc_assT'_def: \"ex_loc_assT' \\<equiv>\n          (\\<lambda> x. if x = pubT then {''Alice'', ''Eve''}  \n                 else (if x = shopT then { ''Bob'', ''Charly'', ''David'', ''Flo''} \n                       else {}))\"\nfixes ex_loc_assT'' :: \"location \\<Rightarrow> identity set\"\ndefines ex_loc_assT''_def: \"ex_loc_assT'' \\<equiv>\n          (\\<lambda> x. if x = pubT then {''Alice''}  \n                 else (if x = shopT then {''Eve'', ''Bob'', ''Charly'', ''David'', ''Flo''} \n                       else {}))\"\n\nfixes ex_efidsT :: \"location \\<Rightarrow> efid set\"\ndefines ex_efidsT_def: \"ex_efidsT \\<equiv> \n          (\\<lambda> x. if x = pubT then {Efid 2, Efid 3, Efid 11}\n                else (if x = shopT then {Efid 5, Efid 7, Efid 13}\n                      else {}))\"\n\nfixes ex_efidsT' :: \"location \\<Rightarrow> efid set\"\ndefines ex_efidsT'_def: \"ex_efidsT' \\<equiv> \n          (\\<lambda> x. if x = pubT then {Efid 2, Efid 11}\n                else (if x = shopT then {Efid 9, Efid 5, Efid 7, Efid 13}\n                      else {}))\"\n\nfixes ex_efidsT'' :: \"location \\<Rightarrow> efid set\"\ndefines ex_efidsT''_def: \"ex_efidsT'' \\<equiv> \n          (\\<lambda> x. if x = pubT then {Efid 2}\n                else (if x = shopT then {Efid 121, Efid 9, Efid 5, Efid 7, Efid 13}\n                      else {}))\"\n\nfixes ex_knosT :: \"identity \\<Rightarrow> location \\<Rightarrow> (identity * efid) set\"\ndefines ex_knosT_def: \"ex_knosT \\<equiv> (\\<lambda> x :: identity. \n                  (if x = ''Eve'' then (\\<lambda> l :: location. {} :: (identity * efid) set) \n                   else (\\<lambda> l :: location. {} :: (identity * efid) set)))\"\n\nfixes ex_knosT' :: \"identity \\<Rightarrow> location \\<Rightarrow> (identity * efid) set\"\ndefines ex_knosT'_def: \"ex_knosT' \\<equiv>(\\<lambda> x :: identity. \n                  (if x = ''Eve'' then \n                     (\\<lambda> l :: location.\n                        (if l = pubT then \n                                  ({(''Alice'', Efid 2),(''Alice'', Efid 3),(''Alice'', Efid 11),\n                                    (''Bob'', Efid 2),(''Bob'', Efid 3),(''Bob'', Efid 11),\n                                    (''Eve'', Efid 2),(''Eve'', Efid 3),(''Eve'', Efid 11)})\n                         else {})) \n                   else (\\<lambda> l :: location. {} :: (identity * efid) set)))\"\n\nfixes ex_knosT'' :: \"identity \\<Rightarrow> location \\<Rightarrow> (identity * efid) set\"\ndefines ex_knosT''_def: \"ex_knosT'' \\<equiv> (\\<lambda> x :: identity.                       \n                  (if x = ''Eve'' then \n                      (\\<lambda> l :: location.\n                          (if l = pubT then \n                                  ({(''Alice'', Efid 2),(''Alice'', Efid 3),(''Alice'', Efid 11),\n                                    (''Bob'', Efid 2),(''Bob'', Efid 3),(''Bob'', Efid 11),\n                                    (''Eve'', Efid 2),(''Eve'', Efid 3),(''Eve'', Efid 11)})\n                            else (if l = shopT then \n                                     ({(''Eve'', Efid 121),(''Eve'', Efid 9),(''Eve'', Efid 5),(''Eve'', Efid 7),(''Eve'', Efid 13),\n                                       (''Bob'', Efid 121),(''Bob'', Efid 9),(''Bob'', Efid 5),(''Bob'', Efid 7), (''Bob'', Efid 13), \n                                       (''Charly'', Efid 121),(''Charly'', Efid 9),(''Charly'', Efid 5),(''Charly'', Efid 7),(''Charly'', Efid 13),\n                                       (''David'', Efid 121),(''David'', Efid 9),(''David'', Efid 5),(''David'', Efid 7), (''David'', Efid 13),\n                                       (''Flo'', Efid 121),(''Flo'', Efid 9),(''Flo'', Efid 5),(''Flo'', Efid 7), (''Flo'', Efid 13)\n                                      })\n                                   else {})))\n                   else (\\<lambda> l :: location. {} :: (identity * efid) set)))\"\n\n(* The nicer representation with case suffers from\n   not so nice presentation in the cases (need to unfold the syntax)  \nfixes ex_loc_ass_alt :: \"location \\<Rightarrow> identity set\"\ndefines ex_loc_ass_alt_def: \"ex_loc_ass_alt \\<equiv>\n          (\\<lambda> x.  (case x of \n             Location (Suc 0) \\<Rightarrow> {''Alice'', ''Bob'', ''Eve''}  \n           | Location (Suc (Suc 0)) \\<Rightarrow> {''Charly'', ''David''} \n           |  _ \\<Rightarrow> {}))\"\n*)\n\n(* Alternative attack that persists even in Level Two: \n   Bob gets isolated by Alice leaving pub so he's alone with Eve*)\nfixes ex_credsTi :: \"identity \\<Rightarrow> efidlist\"\ndefines ex_credsTi_def: \n          \"ex_credsTi \\<equiv> (\\<lambda> x. if x = ''Alice'' then (Efids (Efid 1) 1 (\\<lambda> n. Efid (2^(n+1)))) else \n                            (if x = ''Bob'' then  (Efids (Efid 2) 0 (\\<lambda> n. Efid (3^(n+1)))) else \n                            (if x = ''Charly'' then (Efids (Efid 3) 0 (\\<lambda> n. Efid (5^(n+1)))) else\n                            (if x = ''David'' then (Efids (Efid 4) 0 (\\<lambda> n. Efid (7^(n+1)))) else\n                            (if x = ''Eve'' then (Efids (Efid 5) 0 (\\<lambda> n. Efid (11^(n+1)))) else \n                            (if x = ''Flo'' then (Efids (Efid 6) 0 (\\<lambda> n. Efid (13^(n+1)))) else \n                                 (Efids (Efid 0) 0 (\\<lambda> n. Efid (17^(n+1))))))))))\"\n\nfixes ex_loc_assTi :: \"location \\<Rightarrow> identity set\"\ndefines ex_loc_assTi_def: \"ex_loc_assTi \\<equiv>\n          (\\<lambda> x. if x = pubT then {''Bob'', ''Eve''}  \n                 else (if x = shopT then {''Alice'', ''Charly'', ''David'', ''Flo''} \n                       else {}))\"\n\nfixes ex_efidsTi :: \"location \\<Rightarrow> efid set\"\ndefines ex_efidsTi_def: \"ex_efidsTi \\<equiv> \n          (\\<lambda> x. if x = pubT then {Efid 3, Efid 11}\n                else (if x = shopT then {Efid 4, Efid 5, Efid 7, Efid 13}\n                      else {}))\"\n\nfixes ex_knosTi :: \"identity \\<Rightarrow> location \\<Rightarrow> (identity * efid) set\"\ndefines ex_knosTi_def: \"ex_knosTi \\<equiv>(\\<lambda> x :: identity. \n                  (if x = ''Eve'' then \n                     (\\<lambda> l :: location.\n                        (if l = pubT then \n                                  ({(''Bob'', Efid 3),(''Bob'', Efid 11),\n                                    (''Eve'', Efid 3),(''Eve'', Efid 11)})\n                         else {})) \n                   else (\\<lambda> l :: location. {} :: (identity * efid) set)))\"\n\n\n(* initial attack -- not working any more here after action refinement (se below) *)\nfixes ex_graphT :: \"igraph\"\ndefines ex_graphT_def: \"ex_graphT \\<equiv> Lgraph {(pubT, shopT)} ex_loc_assT ex_credsT ex_locsT ex_efidsT ex_knosT\"\n\n(* Eve gets the ex_knos *)\nfixes ex_graphT' :: \"igraph\"\ndefines ex_graphT'_def: \"ex_graphT' \\<equiv> Lgraph {(pubT, shopT)} ex_loc_assT ex_credsT ex_locsT ex_efidsT ex_knosT'\"\n\n(* Bob goes to shop *)\nfixes ex_graphT'' :: \"igraph\"\ndefines ex_graphT''_def: \"ex_graphT'' \\<equiv> Lgraph {(pubT, shopT)} ex_loc_assT' ex_credsT' ex_locsT ex_efidsT' ex_knosT'\"\n\n(* Eve goes to shop *)\nfixes ex_graphT''' :: \"igraph\"\ndefines ex_graphT'''_def: \"ex_graphT''' \\<equiv> Lgraph {(pubT, shopT)} ex_loc_assT'' ex_credsT'' ex_locsT ex_efidsT'' ex_knosT'\"\n\n(* Eve gets ex_knos at shop *)\nfixes ex_graphT'''' :: \"igraph\"\ndefines ex_graphT''''_def: \"ex_graphT'''' \\<equiv> Lgraph {(pubT, shopT)} ex_loc_assT'' ex_credsT'' ex_locsT ex_efidsT'' ex_knosT''\"\n\n(* Same as above: the nicer representation with case suffers from\n   not so nice presentation in the cases (need to unfold the syntax) \nfixes local_policies_alt :: \"[igraph, location] \\<Rightarrow> policy set\"\ndefines local_policies_alt_def: \"local_policies_alt G \\<equiv> \n    (\\<lambda> x. case x of \n         Location (Suc 0) \\<Rightarrow> {(\\<lambda> y. True, {put,get,move,eval})}\n       | Location 0 \\<Rightarrow> {((\\<lambda> y. has G (y, ''PIN'')), {put,get,move,eval})} \n       | Location (Suc (Suc (Suc 0))) \\<Rightarrow> {(\\<lambda> y. True, {put,get,move,eval})}\n       | Location (Suc (Suc 0)) \\<Rightarrow>\n                {((\\<lambda> y. (\\<exists> n. (n  @\\<^bsub>G\\<^esub> hospital) \\<and> Actor n = y \\<and> \n                           has G (y, ''skey''))), {put,get,move,eval})} \n       | _ \\<Rightarrow>  {})\"\n*)\n(* Second attack: Alice goes and then Bob is alone with Eve, so Eve can get and make the identification *)\n(* Alice goes to shop*)\nfixes ex_graphTi :: \"igraph\"\ndefines ex_graphTi_def: \"ex_graphTi \\<equiv> Lgraph {(pubT, shopT)} ex_loc_assTi ex_credsTi ex_locsT ex_efidsTi ex_knosT\"\n\n(* Eve gets the ex_knos *)\nfixes ex_graphTii :: \"igraph\"\ndefines ex_graphTii_def: \"ex_graphTii \\<equiv> Lgraph {(pubT, shopT)} ex_loc_assTi ex_credsTi ex_locsT ex_efidsTi ex_knosTi\"\n\nfixes local_policiesT :: \"[igraph, location] \\<Rightarrow> policy set\"\ndefines local_policiesT_def: \"local_policiesT G \\<equiv> \n    (\\<lambda> x. if x = pubT then  {(\\<lambda> y. True, {get,move,put})}\n          else (if x = shopT then {(\\<lambda> y. True, {get,move,put})} \n                else {}))\"\n\n(* problems with case in locales?\ndefines local_policies_def: \"local_policies G x \\<equiv> \n     (case x of \n       home \\<Rightarrow> {(\\<lambda> y. True, {put,get,move,eval})}\n     | sphone \\<Rightarrow> {((\\<lambda> y. has G (y, ''PIN'')), {put,get,move,eval})} \n     | cloud \\<Rightarrow> {(\\<lambda> y. True, {put,get,move,eval})}\n     | hospital \\<Rightarrow> {((\\<lambda> y. (\\<exists> n. (n  @\\<^bsub>G\\<^esub> hospital) \\<and> Actor n = y \\<and> \n                           has G (y, ''skey''))), {put,get,move,eval})} \n     | _ \\<Rightarrow>  {})\"\n*)\n\nfixes rmapT :: \"InfrastructureTwo.infrastructure \\<Rightarrow> InfrastructureOne.infrastructure\"\ndefines rmapT_def:\n\"rmapT I \\<equiv> InfrastructureTwo.ref_map I local_policiesO\"\n\nfixes corona_scenarioT :: \"infrastructure\"\ndefines corona_scenarioT_def:\n\"corona_scenarioT \\<equiv> Infrastructure ex_graphT local_policiesT\"\nfixes IcoronaT :: \"infrastructure set\"\ndefines IcoronaT_def:\n  \"IcoronaT \\<equiv> {corona_scenarioT}\"\n\n(* other states of scenario *)\n(* First step: Bob goes to shop *)\n\nfixes corona_scenarioT' :: \"infrastructure\"\ndefines corona_scenarioT'_def: \"corona_scenarioT' \\<equiv> Infrastructure ex_graphT' local_policiesT\"\nfixes CoronaT' :: \"infrastructure set\"\ndefines CoronaT'_def: \"CoronaT' \\<equiv> {corona_scenarioT'}\"\nfixes corona_scenarioT'' :: \"infrastructure\"\ndefines corona_scenarioT''_def: \"corona_scenarioT'' \\<equiv> Infrastructure ex_graphT'' local_policiesT\"\nfixes CoronaT'' :: \"infrastructure set\"\ndefines CoronaT''_def: \"CoronaT'' \\<equiv> {corona_scenarioT''}\"\nfixes corona_scenarioT''' :: \"infrastructure\"\ndefines corona_scenarioT'''_def: \"corona_scenarioT''' \\<equiv> Infrastructure ex_graphT''' local_policiesT\"\nfixes CoronaT''' :: \"infrastructure set\"\ndefines CoronaT'''_def: \"CoronaT''' \\<equiv> {corona_scenarioT'''}\"\nfixes corona_scenarioT'''' :: \"infrastructure\"\ndefines corona_scenarioT''''_def: \"corona_scenarioT'''' \\<equiv> Infrastructure ex_graphT'''' local_policiesT\"\nfixes CoronaT'''' :: \"infrastructure set\"\ndefines CoronaT''''_def: \"CoronaT'''' \\<equiv> {corona_scenarioT''''}\"\n(* Second attack where Alice leaves*)\nfixes corona_scenarioTi :: \"infrastructure\"\ndefines corona_scenarioTi_def: \"corona_scenarioTi \\<equiv> Infrastructure ex_graphTi local_policiesT\"\nfixes CoronaTi :: \"infrastructure set\"\ndefines CoronaTi_def: \"CoronaTi \\<equiv> {corona_scenarioTi}\"\nfixes corona_scenarioTii :: \"infrastructure\"\ndefines corona_scenarioTii_def: \"corona_scenarioTii \\<equiv> Infrastructure ex_graphTii local_policiesT\"\nfixes CoronaTii :: \"infrastructure set\"\ndefines CoronaTii_def: \"CoronaTii \\<equiv> {corona_scenarioTii}\"\n\nfixes corona_statesT\ndefines corona_statesT_def: \"corona_statesT \\<equiv> { I. corona_scenarioT \\<rightarrow>\\<^sub>i* I }\"\nfixes corona_KripkeT\ndefines \"corona_KripkeT \\<equiv> Kripke corona_statesT IcoronaT\"\nfixes scoronaT \ndefines \"scoronaT \\<equiv> {x. \\<exists> n. \\<not> global_policyT'' x (Efid n)}\"  \nfixes scoronaT' \ndefines \"scoronaT' \\<equiv> {x. \\<exists> n. \\<not> global_policyT x (Efid n)}\"  \n\nbegin\n(* actor invariants for example *)\nlemma all_actors: \"actors_graph(graphI corona_scenarioT) = corona_actorsT\"\nproof (simp add: corona_scenarioT_def corona_actorsT_def ex_graphT_def actors_graph_def nodes_def\n                 ex_loc_assT_def, rule equalityI)\n  show \"{x. \\<exists>y. (y = shopT \\<longrightarrow>\n             (shopT = pubT \\<longrightarrow> x = ''Alice'' \\<or> x = ''Bob'' \\<or> x = ''Eve'') \\<and>\n             (shopT \\<noteq> pubT \\<longrightarrow> x = ''Charly'' \\<or> x = ''David'' \\<or> x = ''Flo'')) \\<and>\n            (y \\<noteq> shopT \\<longrightarrow>\n             (y = pubT \\<longrightarrow> (\\<exists>y. y = shopT \\<or> y = pubT \\<and> pubT = shopT) \\<and> (x = ''Alice'' \\<or> x = ''Bob'' \\<or> x = ''Eve'')) \\<and>\n             y = pubT)}\n    \\<subseteq> {''Alice'', ''Bob'', ''Charly'', ''David'', ''Eve'', ''Flo''}\"\n    by auto\nnext show \"{''Alice'', ''Bob'', ''Charly'', ''David'', ''Eve'', ''Flo''}\n    \\<subseteq> {x. \\<exists>y. (y = shopT \\<longrightarrow>\n                (shopT = pubT \\<longrightarrow> x = ''Alice'' \\<or> x = ''Bob'' \\<or> x = ''Eve'') \\<and>\n                (shopT \\<noteq> pubT \\<longrightarrow> x = ''Charly'' \\<or> x = ''David'' \\<or> x = ''Flo'')) \\<and>\n               (y \\<noteq> shopT \\<longrightarrow>\n                (y = pubT \\<longrightarrow> (\\<exists>y. y = shopT \\<or> y = pubT \\<and> pubT = shopT) \\<and> (x = ''Alice'' \\<or> x = ''Bob'' \\<or> x = ''Eve'')) \\<and>\n                y = pubT)}\"\n    using pubT_def shopT_def by auto\nqed\n\nlemma all_corona_actors: \"(corona_scenarioT, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \n              \\<Longrightarrow> actors_graph(graphI y) = corona_actorsT\"\n  using all_actors same_actors by auto\n\n(* nodes invariants *)\nlemma same_nodes: \"(corona_scenarioT, s) \\<in> {(x::InfrastructureTwo.infrastructure, y::InfrastructureTwo.infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\n\\<Longrightarrow> InfrastructureTwo.nodes (graphI corona_scenarioT) = InfrastructureTwo.nodes (graphI s)\"\n  using InfrastructureTwo.same_nodes by blast\n\n(* efids invariants *)\n\nlemma isthere_lem00: \" a \\<in>  agra (graphI corona_scenarioT) l \\<Longrightarrow> l \\<in> nodes (graphI corona_scenarioT) \\<Longrightarrow>\n            efids_cur (cgra (graphI corona_scenarioT) a) \\<in> egra (graphI corona_scenarioT) l\"\n  apply (simp add: corona_scenarioT_def ex_graphT_def ex_loc_assT_def nodes_def ex_credsT_def ex_efidsT_def\n             shopT_def pubT_def)\n  by (smt (z3) One_nat_def Zero_not_Suc char.inject insertE list.inject location.inject shopT_def singleton_iff)\n\n\nlemma efids_root_lem: \"a \\<in> actors_graph (InfrastructureTwo.graphI corona_scenarioT) \\<Longrightarrow> \n                      a' \\<in> actors_graph (InfrastructureTwo.graphI corona_scenarioT) \\<Longrightarrow>\n                 a \\<noteq> a' \\<Longrightarrow>\n                  efids_root (cgra (InfrastructureTwo.graphI corona_scenarioT) a) \\<noteq> \n                  efids_root (cgra (InfrastructureTwo.graphI corona_scenarioT) a')\"\n    apply (simp add: rmapT_def ref_map_def move_graph_a_def  corona_scenarioT_def Infrastructure.move_graph_a_def)\n  apply (simp add: repl_efr_def ex_graphT_def ex_credsT_def)\n  by (smt CollectD InfrastructureTwo.actors_graph_def InfrastructureTwo.agra.simps InfrastructureTwo.gra.simps InfrastructureTwo.nodes_def ex_loc_assT_def insertE prod.inject singletonD)\n\n\nlemma efids_root_minus: \"(corona_scenarioT, I) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \n      \\<Longrightarrow> a \\<in> InfrastructureTwo.agra (InfrastructureTwo.graphI I) l \n      \\<Longrightarrow> l \\<in> InfrastructureTwo.nodes (InfrastructureTwo.graphI I)  \\<Longrightarrow>\n(\\<lambda>x. efids_root (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) x)) `\n       (InfrastructureTwo.agra (InfrastructureTwo.graphI I) l - {a}) =\n       (\\<lambda>a. efids_root (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)) `\n       InfrastructureTwo.agra (InfrastructureTwo.graphI I) l -\n       {efids_root (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)}\"\n  apply auto\n  apply (frule InfrastructureTwo.eroots_inj_on_inv)\n  using efids_root_lem inj_on_def apply blast\n  by (metis (mono_tags, lifting) InfrastructureTwo.actors_graph_def inj_on_def mem_Collect_eq)\n\n\ntext \\<open>Other invariants are that the efids at egra l are in fact efids of the actors at\n      that location, i.e. \n       e \\<in> egra G l = (\\<exists>! a \\<in> agra G l.  e \\<in> efid_list (cgra G a) (for InfrastructureTwo))\n                      .....        /\\ e = efid_root (cgra G a) \n            \\<close>\nlemma range_disjoint_corona_scenarioO[rule_format]: \"(\\<forall> a \\<in> actors_graph (InfrastructureTwo.graphI corona_scenarioT). \n   (\\<forall> a' \\<in> actors_graph(InfrastructureTwo.graphI corona_scenarioT). a \\<noteq> a' \\<longrightarrow>\n     ((range (efids_list (InfrastructureTwo.cgra (InfrastructureTwo.graphI corona_scenarioT) a)) \\<inter> \n      (range (efids_list (InfrastructureTwo.cgra (InfrastructureTwo.graphI corona_scenarioT) a')))) = {})))\"\nproof (unfold corona_scenarioT_def ex_graphT_def ex_credsT_def, simp)\n  show \" \\<forall>a\\<in>InfrastructureTwo.actors_graph\n         (InfrastructureTwo.igraph.Lgraph {(pubT, shopT)} ex_loc_assT\n           (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                     else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                          else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                               else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                    else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                         else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n           ex_locsT ex_efidsT ex_knosT).\n       (a = ''Flo'' \\<longrightarrow>\n        (\\<forall>a'\\<in>InfrastructureTwo.actors_graph\n               (InfrastructureTwo.igraph.Lgraph {(pubT, shopT)} ex_loc_assT\n                 (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                      else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                           else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                     else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                          else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                               else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                 ex_locsT ex_efidsT ex_knosT).\n            (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n            (a' \\<noteq> ''Eve'' \\<longrightarrow>\n             (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n             (a' \\<noteq> ''David'' \\<longrightarrow>\n              (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n              (a' \\<noteq> ''Charly'' \\<longrightarrow>\n               (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n               (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                (a' \\<noteq> ''Alice'' \\<longrightarrow>\n                 ''Flo'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (13 * 13 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n       (a \\<noteq> ''Flo'' \\<longrightarrow>\n        (a = ''Eve'' \\<longrightarrow>\n         (\\<forall>a'\\<in>InfrastructureTwo.actors_graph\n                (InfrastructureTwo.igraph.Lgraph {(pubT, shopT)} ex_loc_assT\n                  (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                       else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                            else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                 else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                      else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                           else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                  ex_locsT ex_efidsT ex_knosT).\n             (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n             (a' \\<noteq> ''Flo'' \\<longrightarrow>\n              (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n              (a' \\<noteq> ''David'' \\<longrightarrow>\n               (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n               (a' \\<noteq> ''Charly'' \\<longrightarrow>\n                (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n                (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                 (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''Alice'' \\<longrightarrow>\n                  ''Eve'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (11 * 11 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n        (a \\<noteq> ''Eve'' \\<longrightarrow>\n         (a = ''David'' \\<longrightarrow>\n          (\\<forall>a'\\<in>InfrastructureTwo.actors_graph\n                 (InfrastructureTwo.igraph.Lgraph {(pubT, shopT)} ex_loc_assT\n                   (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                        else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                             else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                  else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                       else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                            else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                 else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                   ex_locsT ex_efidsT ex_knosT).\n              (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n              (a' \\<noteq> ''Flo'' \\<longrightarrow>\n               (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n               (a' \\<noteq> ''Eve'' \\<longrightarrow>\n                (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n                (a' \\<noteq> ''Charly'' \\<longrightarrow>\n                 (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                  (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                  (a' \\<noteq> ''Alice'' \\<longrightarrow>\n                   ''David'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (7 * 7 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n         (a \\<noteq> ''David'' \\<longrightarrow>\n          (a = ''Charly'' \\<longrightarrow>\n           (\\<forall>a'\\<in>InfrastructureTwo.actors_graph\n                  (InfrastructureTwo.igraph.Lgraph {(pubT, shopT)} ex_loc_assT\n                    (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                         else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                              else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                   else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                        else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                             else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                  else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                    ex_locsT ex_efidsT ex_knosT).\n               (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n               (a' \\<noteq> ''Flo'' \\<longrightarrow>\n                (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n                (a' \\<noteq> ''Eve'' \\<longrightarrow>\n                 (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''David'' \\<longrightarrow>\n                  (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n                  (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                   (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                   (a' \\<noteq> ''Alice'' \\<longrightarrow>\n                    ''Charly'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (5 * 5 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n          (a \\<noteq> ''Charly'' \\<longrightarrow>\n           (a = ''Bob'' \\<longrightarrow>\n            (\\<forall>a'\\<in>InfrastructureTwo.actors_graph\n                   (InfrastructureTwo.igraph.Lgraph {(pubT, shopT)} ex_loc_assT\n                     (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                          else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                               else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                    else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                         else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                              else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                   else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                     ex_locsT ex_efidsT ex_knosT).\n                (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n                (a' \\<noteq> ''Flo'' \\<longrightarrow>\n                 (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''Eve'' \\<longrightarrow>\n                  (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n                  (a' \\<noteq> ''David'' \\<longrightarrow>\n                   (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n                   (a' \\<noteq> ''Charly'' \\<longrightarrow>\n                    (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                    (a' \\<noteq> ''Alice'' \\<longrightarrow>\n                     ''Bob'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (3 * 3 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n           (a \\<noteq> ''Bob'' \\<longrightarrow>\n            (a = ''Alice'' \\<longrightarrow>\n             (\\<forall>a'\\<in>InfrastructureTwo.actors_graph\n                    (InfrastructureTwo.igraph.Lgraph {(pubT, shopT)} ex_loc_assT\n                      (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                           else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                                else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                     else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                          else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                               else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                    else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                      ex_locsT ex_efidsT ex_knosT).\n                 (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''Flo'' \\<longrightarrow>\n                  (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n                  (a' \\<noteq> ''Eve'' \\<longrightarrow>\n                   (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n                   (a' \\<noteq> ''David'' \\<longrightarrow>\n                    (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n                    (a' \\<noteq> ''Charly'' \\<longrightarrow>\n                     (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n                     (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                      ''Alice'' \\<noteq> a' \\<longrightarrow> range (\\<lambda>x. Efid (2 * 2 ^ x)) \\<inter> range (\\<lambda>x. Efid (17 * 17 ^ x)) = {}))))))) \\<and>\n            (a \\<noteq> ''Alice'' \\<longrightarrow>\n             (\\<forall>a'\\<in>InfrastructureTwo.actors_graph\n                    (InfrastructureTwo.igraph.Lgraph {(pubT, shopT)} ex_loc_assT\n                      (\\<lambda>x. if x = ''Alice'' then Efids (Efid 1) 0 (\\<lambda>n. Efid (2 ^ (n + 1)))\n                           else if x = ''Bob'' then Efids (Efid 2) 0 (\\<lambda>n. Efid (3 ^ (n + 1)))\n                                else if x = ''Charly'' then Efids (Efid 3) 0 (\\<lambda>n. Efid (5 ^ (n + 1)))\n                                     else if x = ''David'' then Efids (Efid 4) 0 (\\<lambda>n. Efid (7 ^ (n + 1)))\n                                          else if x = ''Eve'' then Efids (Efid 5) 0 (\\<lambda>n. Efid (11 ^ (n + 1)))\n                                               else if x = ''Flo'' then Efids (Efid 6) 0 (\\<lambda>n. Efid (13 ^ (n + 1)))\n                                                    else Efids (Efid 0) 0 (\\<lambda>n. Efid (17 ^ (n + 1))))\n                      ex_locsT ex_efidsT ex_knosT).\n                 (a' = ''Flo'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (13 * 13 ^ x)) = {}) \\<and>\n                 (a' \\<noteq> ''Flo'' \\<longrightarrow>\n                  (a' = ''Eve'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (11 * 11 ^ x)) = {}) \\<and>\n                  (a' \\<noteq> ''Eve'' \\<longrightarrow>\n                   (a' = ''David'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (7 * 7 ^ x)) = {}) \\<and>\n                   (a' \\<noteq> ''David'' \\<longrightarrow>\n                    (a' = ''Charly'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (5 * 5 ^ x)) = {}) \\<and>\n                    (a' \\<noteq> ''Charly'' \\<longrightarrow>\n                     (a' = ''Bob'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (3 * 3 ^ x)) = {}) \\<and>\n                     (a' \\<noteq> ''Bob'' \\<longrightarrow>\n                      (a' = ''Alice'' \\<longrightarrow> range (\\<lambda>x. Efid (17 * 17 ^ x)) \\<inter> range (\\<lambda>x. Efid (2 * 2 ^ x)) = {}) \\<and>\n                      (a' \\<noteq> ''Alice'' \\<longrightarrow> a = a')))))))))))))\"\n    apply (rule ballI)+\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_13_11, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_13_7, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_13_5, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_13_3, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_13_2, simp, simp)\n     apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n        apply (rule coprime_13_17, simp, simp)\n    apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_11_13, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_11_7, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_11_5, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n        apply (rule coprime_11_3, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n        apply (rule coprime_11_2, arith, arith)\n     apply (rule impI)+\n     apply (rule coprime_range_disjointOO)\n    apply (rule coprime_11_17, simp, simp)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n    apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_13, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_11, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_5, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_3, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_2, arith, arith)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_7_17, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_13, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_11, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_7, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_3, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_2, arith, arith)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_5_17, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_13, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_11, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_7, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_5, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_2, arith, arith)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_3_17, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_13, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_11, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_7, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_5, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_3, arith, arith)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_2_17, arith, arith)\n     apply (rule impI)+\n    apply (rule ballI)+\n    apply (rule conjI)\n      apply (rule impI)+\n     apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_13, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_11, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n     apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_7, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_5, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n      apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_3, arith, arith)\n     apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n     apply (rule coprime_range_disjointOO)\n    apply (rule coprime_17_2, arith, arith)\n     apply (rule impI)+\n    by (smt (z3) InfrastructureTwo.actors_graph_def InfrastructureTwo.agra.simps all_not_in_conv ex_loc_assT_def insertE mem_Collect_eq)\nqed\n\n\nlemma inj_on_corona_scenarioT: \"inj_on (\\<lambda>x. efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI corona_scenarioT) x))\n        (InfrastructureTwo.actors_graph (InfrastructureTwo.graphI corona_scenarioT))\"\n  by (simp add: corona_scenarioT_def ex_graphT_def ex_loc_assT_def nodes_def\n                    ex_credsT_def ex_locsT_def ex_efidsT_def ex_knosT_def inj_on_def\n                    actors_graph_def)\n\nlemma l_eq_corona_scenarioT[rule_format]: \"(\\<forall> l l'. l \\<in> nodes (graphI corona_scenarioT) \\<longrightarrow>\n                a \\<in>  agra (graphI corona_scenarioT) l \\<longrightarrow>  a \\<in>  agra (graphI corona_scenarioT) l' \\<longrightarrow> l = l')\"\n  by (simp add: corona_scenarioT_def ex_graphT_def ex_loc_assT_def nodes_def)\n\nlemma coronaT_efids_list_inj: \n\"a \\<in> actors_graph(InfrastructureTwo.graphI corona_scenarioT) \\<Longrightarrow> \ninj (efids_list (InfrastructureTwo.cgra (InfrastructureTwo.graphI corona_scenarioT) a))\"\n  by (simp add: corona_scenarioT_def ex_graphT_def ex_loc_assT_def nodes_def\n                    ex_credsT_def ex_locsT_def ex_efidsT_def ex_knosT_def pubT_def shopT_def inj_def)\n  \nlemma efid_in_range_corona_scenarioT: \"(\\<forall> l \\<in> nodes (graphI corona_scenarioT).\n         (\\<forall> e \\<in> (egra (InfrastructureTwo.graphI corona_scenarioT) l).\n         (\\<exists> a \\<in> actors_graph (graphI corona_scenarioT). \n             e \\<in> range (efids_list (InfrastructureTwo.cgra (graphI corona_scenarioT) a)))))\"\n  apply (simp add: corona_scenarioT_def ex_graphT_def nodes_def)\n  apply (rule allI)\n   apply (rule impI)+\n   apply (rule ballI)\n  apply (simp add: ex_efidsT_def actors_graph_def ex_loc_assT_def)\n  apply (erule exE)\n  apply (erule disjE)\n   apply (simp add: pubT_def shopT_def ex_credsT_def nodes_def)\n   apply (erule disjE)\n    apply (rule_tac x = \"''Alice''\" in exI)\n  apply simp\n    apply blast\n   apply (erule disjE)\n  apply (rule_tac x = \"''Bob''\" in exI)\n  apply simp\n    apply blast\n   apply (rule_tac x = \"''Eve''\" in exI)\n  apply simp\n    apply blast\n   apply (simp add: pubT_def shopT_def ex_credsT_def nodes_def)\n   apply (erule disjE)\n   apply (rule_tac x = \"''Charly''\" in exI)\n  apply simp\n   apply (erule disjE)\n   apply (rule_tac x = \"''David''\" in exI)\n  apply simp\n  apply (rule_tac x = \"''Flo''\" in exI)\n  by simp\n\nlemma efid_kgra_in_range_corona_scenarioT: \"(\\<forall> l \\<in> InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT). \n         (\\<forall> h \\<in> InfrastructureTwo.actors_graph(InfrastructureTwo.graphI corona_scenarioT).\n         (\\<forall> e \\<in> (snd`((InfrastructureTwo.kgra (InfrastructureTwo.graphI corona_scenarioT) h l))).\n         (\\<exists> a \\<in> InfrastructureTwo.actors_graph (InfrastructureTwo.graphI corona_scenarioT). \n           e \\<in> range (InfrastructureTwo.efids_list (InfrastructureTwo.cgra (InfrastructureTwo.graphI corona_scenarioT) a))))))\"\n  by (simp add: corona_scenarioT_def ex_graphT_def nodes_def\n                 ex_credsT_def ex_locsT_def ex_efidsT_def ex_knosT_def pubT_def shopT_def)\n\nlemma efid_eq_efid_cur_corona_scenarioT: \"lb \\<in> InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) \\<Longrightarrow>\n       e \\<in> InfrastructureTwo.egra (InfrastructureTwo.graphI corona_scenarioT) lb \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureTwo.agra (InfrastructureTwo.graphI corona_scenarioT) lb.\n          e = efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI corona_scenarioT) a)\"\n  apply (simp add: corona_scenarioT_def ex_graphT_def nodes_def ex_loc_assT_def \n                 ex_credsT_def ex_locsT_def ex_efidsT_def ex_knosT_def pubT_def shopT_def)\n  using shopT_def by fastforce\n\nlemma anonymous_actor_corona_scenarioT: \" lb \\<in> InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) \\<Longrightarrow>\n       e \\<in> InfrastructureTwo.egra (InfrastructureTwo.graphI corona_scenarioT) lb \\<Longrightarrow>\n       anonymous_actor corona_scenarioT e \\<in> InfrastructureTwo.agra (InfrastructureTwo.graphI corona_scenarioT) lb\"\n  apply (subgoal_tac \"InfrastructureTwo.actors_graph (InfrastructureTwo.graphI corona_scenarioT) \\<noteq> {}\")\n  apply (drule anonymous_actor_defO)\n  using coronaT_efids_list_inj apply blast\n      apply (simp add: range_disjoint_corona_scenarioO, assumption)\n  apply (simp add: corona_scenarioT_def ex_graphT_def nodes_def ex_loc_assT_def local_policiesT_def\n                 ex_credsT_def ex_locsT_def ex_efidsT_def ex_knosT_def pubT_def shopT_def)\n    apply (erule exE)\n    apply (erule disjE)\n     apply (simp add: actors_graph_def)  \n  oops\n\n\nlemma refmap_lem_egra_unique_corona_scenarioT: \n\"(\\<forall> a \\<in> InfrastructureTwo.actors_graph (InfrastructureTwo.graphI corona_scenarioT). \n     (\\<forall> l \\<in> InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT). \n       (\\<forall> l' \\<in> InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT). \n        ((a @\\<^bsub>(InfrastructureTwo.graphI corona_scenarioT)\\<^esub> l) \\<longrightarrow>\n        (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI corona_scenarioT) a)\n       \\<in> InfrastructureTwo.egra (InfrastructureTwo.graphI corona_scenarioT) l') \n       \\<longrightarrow> l = l' ))))\"\n  by (metis (mono_tags, lifting) efid_eq_efid_cur_corona_scenarioT inj_on_cong inj_on_corona_scenarioT l_eq_corona_scenarioT refmap_lem_egra_unique_prepO)\n\nlemma rtrancl_imp_step: \"(I \\<rightarrow>\\<^sub>n y) \\<Longrightarrow>  (I, y) \\<in> {(x::InfrastructureOne.infrastructure, y::InfrastructureOne.infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \"\n  by (simp add: r_into_rtrancl) \n  \nlemma rtrancl_imp_two_step: \"(I \\<rightarrow>\\<^sub>n y) \\<Longrightarrow>  (y \\<rightarrow>\\<^sub>n z) \\<Longrightarrow> (I, z) \\<in> {(x::InfrastructureOne.infrastructure, y::InfrastructureOne.infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \"\n  by (simp add: converse_rtrancl_into_rtrancl)\n\n(* We need an invariant on put-enabledness that can only be proved at the level of the concrete example CoronaApp\n   since in local_policies the infrastructure graph is a parameter to the local_policies component. *) \nlemma put_enables_initial: \n\"(\\<forall> a \\<in> actors_graph (graphI corona_scenarioT). \\<forall> l \\<in> nodes (graphI corona_scenarioT). \nenables corona_scenarioT l (Actor a) put)\"\n  by (simp add: corona_scenarioT_def ex_graphT_def ex_loc_assT_def nodes_def local_policiesT_def\n          ex_credsT_def pubT_def shopT_def ex_locsT_def ex_efidsT_def enables_def InfrastructureTwo.actors_graph_def)\n\nlemma put_enables_init_reach: \n\"(corona_scenarioT, y) \\<in> {(x::InfrastructureTwo.infrastructure, y::InfrastructureTwo.infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n(\\<forall> l \\<in> nodes (graphI corona_scenarioT).\n       \\<forall> xa \\<in> InfrastructureTwo.delta corona_scenarioT (InfrastructureTwo.graphI corona_scenarioT) l. \n            xa \\<in> InfrastructureTwo.delta y (InfrastructureTwo.graphI y) l)\"\nproof (erule rtrancl_induct)\n  show \" \\<forall>l\\<in>InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT).\n       \\<forall>xa\\<in>InfrastructureTwo.delta corona_scenarioT (InfrastructureTwo.graphI corona_scenarioT) l.\n          xa \\<in> InfrastructureTwo.delta corona_scenarioT (InfrastructureTwo.graphI corona_scenarioT) l\"\n    by simp\nnext show \"\\<And>y z. (corona_scenarioT, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           \\<forall>l\\<in>InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT).\n              \\<forall>xa\\<in>InfrastructureTwo.delta corona_scenarioT (InfrastructureTwo.graphI corona_scenarioT) l.\n                 xa \\<in> InfrastructureTwo.delta y (InfrastructureTwo.graphI y) l \\<Longrightarrow>\n           \\<forall>l\\<in>InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT).\n              \\<forall>xa\\<in>InfrastructureTwo.delta corona_scenarioT (InfrastructureTwo.graphI corona_scenarioT) l.\n                 xa \\<in> InfrastructureTwo.delta z (InfrastructureTwo.graphI z) l \"\n  apply (simp add: corona_scenarioT_def ex_graphT_def ex_loc_assT_def nodes_def local_policiesT_def\n          ex_credsT_def pubT_def shopT_def ex_locsT_def ex_efidsT_def enables_def InfrastructureTwo.actors_graph_def)\n    apply (rule allI)\n    apply (drule_tac x = l in spec)\n    by (metis (no_types, lifting) InfrastructureTwo.delta.simps InfrastructureTwo.delta_invariant InfrastructureTwo.init_state_policy0 local_policiesT_def numeral_1_eq_Suc_0 numerals(1) shopT_def singleton_iff)\nqed\n\n(* not possible to prove\n\nlemma delta_pres_step: \"(\\<forall>z z'. (z \\<rightarrow>\\<^sub>n z') \\<longrightarrow>  (\\<forall> l \\<in> nodes (graphI z).\n       \\<forall> xa \\<in> InfrastructureTwo.delta z (InfrastructureTwo.graphI z) l. \n            xa \\<in> InfrastructureTwo.delta z' (InfrastructureTwo.graphI z') l))\"\nproof (clarify, frule delta_invariant, erule state_transition_in.cases)\n  show \"\\<And>z z' l a b G I aa la I'.\n       l \\<in> InfrastructureTwo.nodes (InfrastructureTwo.graphI z) \\<Longrightarrow>\n       (a, b) \\<in> InfrastructureTwo.delta z (InfrastructureTwo.graphI z) l \\<Longrightarrow>\n       InfrastructureTwo.delta z = InfrastructureTwo.delta z' \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       InfrastructureTwo.enables I la (Actor aa) get \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure\n        (InfrastructureTwo.igraph.Lgraph (InfrastructureTwo.gra G) (InfrastructureTwo.agra G) (InfrastructureTwo.cgra G)\n          (InfrastructureTwo.lgra G) (InfrastructureTwo.egra G)\n          ((InfrastructureTwo.kgra G)\n           (aa := (InfrastructureTwo.kgra G aa)\n              (la := {(x, y). x \\<in> InfrastructureTwo.agra G la \\<and> y \\<in> InfrastructureTwo.egra G la}))))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       (a, b) \\<in> InfrastructureTwo.delta z' (InfrastructureTwo.graphI z') l\"\n    oops\n*)\n\nlemma put_enables_pres_refl[rule_format]: \n\"(corona_scenarioT, s) \\<in> {(x::InfrastructureTwo.infrastructure, y::InfrastructureTwo.infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\n\\<Longrightarrow> (\\<forall> a \\<in> actors_graph (graphI s). \\<forall> l \\<in> nodes (graphI s). enables s l (Actor a) put)\"\n  apply (rule put_enables_invariant_refOO, assumption)\n  using put_enables_init_reach apply blast\n  using put_enables_initial by blast\n\n\nlemma refmapTwo_lem: \"\\<forall>s::InfrastructureTwo.infrastructure.\n       (corona_scenarioT, s) \\<in> {(x::InfrastructureTwo.infrastructure, y::InfrastructureTwo.infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<longrightarrow>\n        (\\<forall>s'. s \\<rightarrow>\\<^sub>n s' \\<longrightarrow> (rmapT s, rmapT s') \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>*)\"\nproof (clarify, frule same_nodes, frule init_state_policy, erule state_transition_in.cases)\n(* move case *)\n  show \"\\<And>s s' G I a l l' I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureTwo.actors_graph G \\<Longrightarrow>\n       InfrastructureTwo.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure (InfrastructureTwo.move_graph_a a l l' (InfrastructureTwo.graphI I))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       (rmapT s, rmapT s') \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n  proof (case_tac \"l = l'\")\n    show \"\\<And>s s' G I a l l' I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureTwo.actors_graph G \\<Longrightarrow>\n       InfrastructureTwo.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure (InfrastructureTwo.move_graph_a a l l' (InfrastructureTwo.graphI I))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       l = l' \\<Longrightarrow> (rmapT s, rmapT s') \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n      using InfrastructureTwo.move_graph_eq InfrastructureTwo.ref_map_def rmapT_def by force\n  next show \"\\<And>s s' G I a l l' I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureTwo.actors_graph G \\<Longrightarrow>\n       InfrastructureTwo.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure (InfrastructureTwo.move_graph_a a l l' (InfrastructureTwo.graphI I))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow> (rmapT s, rmapT s') \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n  proof (rule_tac y = \"InfrastructureOne.infrastructure.Infrastructure (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI (rmapT s)))\n        (InfrastructureOne.delta (rmapT s))\" in rtrancl_imp_two_step)\n    show \"\\<And>s s' G I a l l' I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureTwo.actors_graph G \\<Longrightarrow>\n       InfrastructureTwo.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure (InfrastructureTwo.move_graph_a a l l' (InfrastructureTwo.graphI I))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       rmapT\n        s \\<rightarrow>\\<^sub>n InfrastructureOne.infrastructure.Infrastructure\n                (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI (rmapT s)))\n                (InfrastructureOne.delta (rmapT s))\"\n  apply (rule_tac I = \"rmapT s\" and I' = \"(InfrastructureOne.infrastructure.Infrastructure\n                (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI (rmapT s)))\n                (InfrastructureOne.delta (rmapT s)))\" and l = l and l' = l' \n                             and a = a \n in InfrastructureOne.state_transition_in.move)\n  apply (rule refl)\n         apply (simp add: rmapT_def ref_map_def atI_def InfrastructureOne.atI_def)\n         apply (simp add: rmapT_def ref_map_def nodes_def InfrastructureOne.nodes_def)\n         apply (simp add: rmapT_def ref_map_def nodes_def InfrastructureOne.nodes_def)\n      apply (simp add: rmapT_def ref_map_def actors_graph_def InfrastructureOne.actors_graph_def)\n    apply (simp add: Infrastructure.nodes_def InfrastructureOne.nodes_def)\n      apply (simp add: nodes_def Infrastructure.nodes_def atI_def rmapT_def local_policiesO_def)\n(* *)\n     apply (simp add: rmapT_def ref_map_def enables_def InfrastructureOne.enables_def local_policiesO_def shop_def pubO_def)\n      apply (metis InfrastructureTwo.delta.simps corona_scenarioT_def empty_iff local_policiesT_def pubT_def shopO_def shopT_def)\n    by (rule refl)\nnext show \"\\<And>s s' G I a l l' I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureTwo.actors_graph G \\<Longrightarrow>\n       InfrastructureTwo.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure (InfrastructureTwo.move_graph_a a l l' (InfrastructureTwo.graphI I))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureOne.infrastructure.Infrastructure\n        (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI (rmapT s)))\n        (InfrastructureOne.delta (rmapT s)) \\<rightarrow>\\<^sub>n rmapT s'\"\n  apply (rule_tac I = \"InfrastructureOne.infrastructure.Infrastructure\n        (InfrastructureOne.move_graph_a a l l' (InfrastructureOne.graphI (rmapT s)))\n        (InfrastructureOne.delta (rmapT s))\" and I' = \"rmapT s'\" and l = l'\n                             and a = a \n in InfrastructureOne.state_transition_in.put)\napply (rule refl)\n         apply (simp add: rmapT_def ref_map_def atI_def InfrastructureOne.atI_def)\n         apply (simp add: rmapT_def ref_map_def nodes_def InfrastructureOne.nodes_def)\n      apply (simp add: rmapT_def ref_map_def actors_graph_def InfrastructureOne.actors_graph_def)\n      apply (simp add: InfrastructureOne.move_graph_a_def)\n     apply (simp add: rmapT_def ref_map_def enables_def InfrastructureOne.enables_def local_policiesO_def shop_def pubO_def)\n      apply (metis InfrastructureTwo.delta.simps corona_scenarioT_def empty_iff local_policiesT_def pubT_def shopO_def shopT_def)\n\n(* need invariant for that *)\n    apply (subgoal_tac \"InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a) \\<notin>\n                         (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')\")\n(* This should follow from invariant and l \\<noteq> l'*)\n    apply (subgoal_tac \"\\<not>(a  @\\<^bsub>G\\<^esub> l')\") \napply (simp add: rmapT_def ref_map_def move_graph_a_def InfrastructureOne.move_graph_a_def )\n    apply clarify\n     apply (rule conjI)\n    prefer 2\n    using InfrastructureTwo.atI_def apply blast\n      apply (rule impI)+    \n    apply (simp add: InfrastructureOne.put_graph_efid_def InfrastructureTwo.efids_inc_ind_def InfrastructureOne.efids_inc_ind_def\n                      InfrastructureTwo.efids_cur_def InfrastructureOne.efids_cur_def)\n    using InfrastructureTwo.actor_unique_loc_lem InfrastructureTwo.atI_def l_eq_corona_scenarioT apply blast\n(* here: still need to show invariant :\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureTwo.actors_graph G \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)\n       \\<notin> InfrastructureTwo.egra (InfrastructureTwo.graphI I) l' \nequivalent to:\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureTwo.actors_graph G \\<Longrightarrow>\n       InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)\n       \\<in> InfrastructureTwo.egra (InfrastructureTwo.graphI I) l' \n\\<Longrightarrow> l = l'\n\n*)\n    apply (erule contrapos_nn)\n    apply (erule_tac refmap_lem_egra_unique_refl)\n    using efid_eq_efid_cur_corona_scenarioT apply blast\n    using l_eq_corona_scenarioT apply force\n    using range_disjoint_corona_scenarioO apply presburger\n    using InfrastructureTwo.efids_list_inj_imp_inc_ind_not_eq coronaT_efids_list_inj apply presburger\n    using inj_on_corona_scenarioT apply blast\n    apply simp\n       apply simp\n      apply simp\n     apply simp\nby (simp add: InfrastructureOne.efids_cur_def InfrastructureTwo.efids_cur_def)\nqed\n(* previous attempt stepwise that lead on to understand the invariant:\n     apply (unfold InfrastructureOne.put_graph_efid_def )\n     apply (subgoal_tac \n     \"((InfrastructureOne.egra\n           (InfrastructureOne.igraph.Lgraph (InfrastructureTwo.gra (InfrastructureTwo.graphI I))\n             ((InfrastructureTwo.agra (InfrastructureTwo.graphI I))\n              (l := InfrastructureTwo.agra (InfrastructureTwo.graphI I) l - {a},\n               l' := insert a (InfrastructureTwo.agra (InfrastructureTwo.graphI I) l')))\n             (InfrastructureTwo.cgra (InfrastructureTwo.graphI I)) (InfrastructureTwo.lgra (InfrastructureTwo.graphI I))\n             ((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n              (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                    {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n               l' :=\n                 insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                  (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n             (InfrastructureTwo.kgra (InfrastructureTwo.graphI I))))\n         (l' :=\n            insert\n             (InfrastructureOne.efids_cur\n               (InfrastructureOne.efids_inc_ind\n                 (InfrastructureOne.cgra\n                   (InfrastructureOne.igraph.Lgraph (InfrastructureTwo.gra (InfrastructureTwo.graphI I))\n                     ((InfrastructureTwo.agra (InfrastructureTwo.graphI I))\n                      (l := InfrastructureTwo.agra (InfrastructureTwo.graphI I) l - {a},\n                       l' := insert a (InfrastructureTwo.agra (InfrastructureTwo.graphI I) l')))\n                     (InfrastructureTwo.cgra (InfrastructureTwo.graphI I))\n                     (InfrastructureTwo.lgra (InfrastructureTwo.graphI I))\n                     ((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n                      (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                            {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n                       l' :=\n                         insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                          (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n                     (InfrastructureTwo.kgra (InfrastructureTwo.graphI I)))\n                   a)))\n             (InfrastructureOne.egra\n               (InfrastructureOne.igraph.Lgraph (InfrastructureTwo.gra (InfrastructureTwo.graphI I))\n                 ((InfrastructureTwo.agra (InfrastructureTwo.graphI I))\n                  (l := InfrastructureTwo.agra (InfrastructureTwo.graphI I) l - {a},\n                   l' := insert a (InfrastructureTwo.agra (InfrastructureTwo.graphI I) l')))\n                 (InfrastructureTwo.cgra (InfrastructureTwo.graphI I))\n                 (InfrastructureTwo.lgra (InfrastructureTwo.graphI I))\n                 ((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n                  (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                        {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n                   l' :=\n                     insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                      (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n                 (InfrastructureTwo.kgra (InfrastructureTwo.graphI I)))\n               l' -\n              {InfrastructureOne.efids_cur\n                (InfrastructureOne.cgra\n                  (InfrastructureOne.igraph.Lgraph (InfrastructureTwo.gra (InfrastructureTwo.graphI I))\n                    ((InfrastructureTwo.agra (InfrastructureTwo.graphI I))\n                     (l := InfrastructureTwo.agra (InfrastructureTwo.graphI I) l - {a},\n                      l' := insert a (InfrastructureTwo.agra (InfrastructureTwo.graphI I) l')))\n                    (InfrastructureTwo.cgra (InfrastructureTwo.graphI I))\n                    (InfrastructureTwo.lgra (InfrastructureTwo.graphI I))\n                    ((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n                     (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                           {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n                      l' :=\n                        insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                         (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n                    (InfrastructureTwo.kgra (InfrastructureTwo.graphI I)))\n                  a)}))) = \n(((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n              (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                    {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n               l' :=\n                 insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                  (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n         (l' :=\n            insert (InfrastructureOne.efids_cur (InfrastructureOne.efids_inc_ind\n                                                     (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)))\n             ( ((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n                  (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                        {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n                   l' :=\n                     insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                      (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n                 l' -\n              {InfrastructureOne.efids_cur\n                (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)}))) \")\n(* test *)\n      prefer 2\n      apply simp\n    apply (subgoal_tac \"(((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n              (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                    {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n               l' :=\n                 insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                  (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n         (l' :=\n            insert (InfrastructureOne.efids_cur (InfrastructureOne.efids_inc_ind\n                                                     (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)))\n             ( ((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n                  (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                        {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n                   l' :=\n                     insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                      (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n                 l' -\n              {InfrastructureOne.efids_cur\n                (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)}))) =\n(((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n              (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                    {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n               l' :=\n                 insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                  (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n         (l' :=\n            insert (InfrastructureOne.efids_cur (InfrastructureOne.efids_inc_ind\n                                                     (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)))\n             ((insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                      (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')\n              ) -\n              {InfrastructureOne.efids_cur\n                (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)})))\")\n      prefer 2\n      apply simp\n(* step 3 *)\n    apply (subgoal_tac \"(((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n              (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                    {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n               l' :=\n                 insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                  (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n         (l' :=\n            insert (InfrastructureOne.efids_cur (InfrastructureOne.efids_inc_ind\n                                                     (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)))\n             ((insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                      (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')\n              ) -\n              {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)}))) =\n(((InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n              (l := InfrastructureTwo.egra (InfrastructureTwo.graphI I) l -\n                    {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)},\n               l' :=\n                 insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                  (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')))\n         (l' :=\n            insert (InfrastructureOne.efids_cur (InfrastructureOne.efids_inc_ind\n                                                     (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)))\n              (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')\n              ))\")\n      prefer 2\n    apply (subgoal_tac \" ((insert (InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a))\n                      (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')\n              ) -\n              {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)}) =\n             (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')\")\n       prefer 2\n    apply (subgoal_tac \"InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a) \\<notin>\n                         (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')\")\n        apply simp\n    defer\n       apply simp\n    apply simp\n    apply (rule conjI)\n     apply (simp add: InfrastructureTwo.efids_inc_ind_def InfrastructureOne.efids_inc_ind_def\n                      InfrastructureTwo.efids_cur_def InfrastructureOne.efids_cur_def)\n     apply (simp add: InfrastructureTwo.efids_inc_ind_def InfrastructureOne.efids_inc_ind_def\n                      InfrastructureTwo.efids_cur_def InfrastructureOne.efids_cur_def)\n\n     apply (rule impI)+\n     apply (rule conjI)\n      apply blast\n    apply (subgoal_tac \"l = l'\")\n    apply simp\n     apply (simp add: InfrastructureTwo.efids_inc_ind_def InfrastructureOne.efids_inc_ind_def\n                      InfrastructureTwo.efids_cur_def InfrastructureOne.efids_cur_def)\n    apply (simp add: nodes_def Infrastructure.nodes_def atI_def rmapT_def local_policiesO_def ref_map_def put_graph_efid_def\n                  InfrastructureOne.put_graph_efid_def move_graph_a_def InfrastructureOne.move_graph_a_def)\n\n    apply (rule conjI)\n     apply (rule impI)\n     apply (rule conjI)\n     apply (simp add: InfrastructureTwo.efids_inc_ind_def InfrastructureOne.efids_inc_ind_def\n                      InfrastructureTwo.efids_cur_def InfrastructureOne.efids_cur_def)\n\n    apply (subgoal_tac \"InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)\n        \\<notin>  (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')\")\n    apply (subgoal_tac \"(InfrastructureTwo.egra (InfrastructureTwo.graphI I) l' -\n             {InfrastructureOne.efids_cur (InfrastructureTwo.cgra (InfrastructureTwo.graphI I) a)}) =\n              (InfrastructureTwo.egra (InfrastructureTwo.graphI I) l')\")\n      apply (rotate_tac -1)\n    apply (erule ssubst)\n      apply (simp add: InfrastructureTwo.efids_inc_ind_def InfrastructureOne.efids_inc_ind_def\n                      InfrastructureTwo.efids_cur_def InfrastructureOne.efids_cur_def)\n    apply simp\n\n     apply (simp add: InfrastructureTwo.efids_inc_ind_def InfrastructureOne.efids_inc_ind_def\n                      InfrastructureTwo.efids_cur_def InfrastructureOne.efids_cur_def)\n     prefer 2\n     apply (rule impI)\n    apply (rule conjI)\n\n    apply simp\n    prefer 2\n*)\n(* get case *)\nqed\nnext show \"\\<And>s s' G I a l I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       InfrastructureTwo.enables I l (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure\n        (InfrastructureTwo.igraph.Lgraph (InfrastructureTwo.gra G) (InfrastructureTwo.agra G) (InfrastructureTwo.cgra G)\n          (InfrastructureTwo.lgra G) (InfrastructureTwo.egra G)\n          ((InfrastructureTwo.kgra G)\n           (a := (InfrastructureTwo.kgra G a)\n              (l := {(x, y). x \\<in> InfrastructureTwo.agra G l \\<and> y \\<in> InfrastructureTwo.egra G l}))))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       (rmapT s, rmapT s') \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n  proof (rule rtrancl_imp_step, rule_tac I =  \"rmapT s\" and I' = \"rmapT s'\" and l = l  and a = a  \n        in InfrastructureOne.state_transition_in.get, \n        rule refl, simp add: rmapT_def ref_map_def atI_def InfrastructureOne.atI_def\n        local_policiesO_def InfrastructureOne.nodes_def shopO_def pubO_def)\n    show \"\\<And>s s' G I a l I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureTwo.nodes G \\<Longrightarrow>\n       InfrastructureTwo.enables I l (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure\n        (InfrastructureTwo.igraph.Lgraph (InfrastructureTwo.gra G) (InfrastructureTwo.agra G) (InfrastructureTwo.cgra G)\n          (InfrastructureTwo.lgra G) (InfrastructureTwo.egra G)\n          ((InfrastructureTwo.kgra G)\n           (a := (InfrastructureTwo.kgra G a)\n              (l := {(x, y). x \\<in> InfrastructureTwo.agra G l \\<and> y \\<in> InfrastructureTwo.egra G l}))))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       l \\<in> InfrastructureOne.nodes (InfrastructureOne.graphI (rmapT s))\"\n      apply (simp add: rmapT_def local_policiesO_def ref_map_def)\n      using InfrastructureOne.nodes_def InfrastructureTwo.nodes_def by fastforce\n  next show \"\\<And>s s' G I a l I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureTwo.enables I l (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure\n        (InfrastructureTwo.igraph.Lgraph (InfrastructureTwo.gra G) (InfrastructureTwo.agra G) (InfrastructureTwo.cgra G)\n          (InfrastructureTwo.lgra G) (InfrastructureTwo.egra G)\n          ((InfrastructureTwo.kgra G)\n           (a := (InfrastructureTwo.kgra G a)\n              (l := {(x, y). x \\<in> InfrastructureTwo.agra G l \\<and> y \\<in> InfrastructureTwo.egra G l}))))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       InfrastructureOne.enables (rmapT s) l (Actor a) get\"\n   proof (simp add: rmapT_def ref_map_def nodes_def enables_def InfrastructureOne.enables_def\n              local_policiesO_def InfrastructureOne.nodes_def shopO_def pubO_def)\n     show \"\\<And>s s' G I a l I'.\n       (corona_scenarioT, I) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       {x. \\<exists>y. (x, y) \\<in> InfrastructureTwo.gra (InfrastructureTwo.graphI corona_scenarioT) \\<or>\n               (y, x) \\<in> InfrastructureTwo.gra (InfrastructureTwo.graphI corona_scenarioT)} =\n       {x. \\<exists>y. (x, y) \\<in> InfrastructureTwo.gra (InfrastructureTwo.graphI I) \\<or>\n               (y, x) \\<in> InfrastructureTwo.gra (InfrastructureTwo.graphI I)} \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta I \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' =\n       InfrastructureTwo.infrastructure.Infrastructure\n        (InfrastructureTwo.igraph.Lgraph (InfrastructureTwo.gra (InfrastructureTwo.graphI I))\n          (InfrastructureTwo.agra (InfrastructureTwo.graphI I)) (InfrastructureTwo.cgra (InfrastructureTwo.graphI I))\n          (InfrastructureTwo.lgra (InfrastructureTwo.graphI I)) (InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n          ((InfrastructureTwo.kgra (InfrastructureTwo.graphI I))\n           (a := (InfrastructureTwo.kgra (InfrastructureTwo.graphI I) a)\n              (l := InfrastructureTwo.agra (InfrastructureTwo.graphI I) l \\<times>\n                    InfrastructureTwo.egra (InfrastructureTwo.graphI I) l))))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>InfrastructureTwo.graphI I\\<^esub> l \\<Longrightarrow>\n       \\<exists>x\\<in>InfrastructureTwo.delta I (InfrastructureTwo.graphI I) l. case x of (p, e) \\<Rightarrow> get \\<in> e \\<and> p (Actor a) \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure\n        (InfrastructureTwo.igraph.Lgraph (InfrastructureTwo.gra (InfrastructureTwo.graphI I))\n          (InfrastructureTwo.agra (InfrastructureTwo.graphI I)) (InfrastructureTwo.cgra (InfrastructureTwo.graphI I))\n          (InfrastructureTwo.lgra (InfrastructureTwo.graphI I)) (InfrastructureTwo.egra (InfrastructureTwo.graphI I))\n          ((InfrastructureTwo.kgra (InfrastructureTwo.graphI I))\n           (a := (InfrastructureTwo.kgra (InfrastructureTwo.graphI I) a)\n              (l := InfrastructureTwo.agra (InfrastructureTwo.graphI I) l \\<times>\n                    InfrastructureTwo.egra (InfrastructureTwo.graphI I) l))))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       l \\<noteq> Location (Suc 0) \\<longrightarrow> l = Location 0\"\n        by (metis InfrastructureTwo.delta.simps One_nat_def corona_scenarioT_def empty_iff local_policiesT_def pubT_def shopT_def)\n    qed\n next show \"\\<And>s s' G I a l I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureTwo.enables I l (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure\n        (InfrastructureTwo.igraph.Lgraph (InfrastructureTwo.gra G) (InfrastructureTwo.agra G) (InfrastructureTwo.cgra G)\n          (InfrastructureTwo.lgra G) (InfrastructureTwo.egra G)\n          ((InfrastructureTwo.kgra G)\n           (a := (InfrastructureTwo.kgra G a)\n              (l := {(x, y). x \\<in> InfrastructureTwo.agra G l \\<and> y \\<in> InfrastructureTwo.egra G l}))))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       rmapT s' =\n       InfrastructureOne.infrastructure.Infrastructure\n        (InfrastructureOne.igraph.Lgraph (InfrastructureOne.gra (InfrastructureOne.graphI (rmapT s)))\n          (InfrastructureOne.agra (InfrastructureOne.graphI (rmapT s)))\n          (InfrastructureOne.cgra (InfrastructureOne.graphI (rmapT s)))\n          (InfrastructureOne.lgra (InfrastructureOne.graphI (rmapT s)))\n          (InfrastructureOne.egra (InfrastructureOne.graphI (rmapT s)))\n          ((InfrastructureOne.kgra (InfrastructureOne.graphI (rmapT s)))\n           (a := (InfrastructureOne.kgra (InfrastructureOne.graphI (rmapT s)) a)\n              (l := {(x, y).\n                     x \\<in> InfrastructureOne.agra (InfrastructureOne.graphI (rmapT s)) l \\<and>\n                     y \\<in> InfrastructureOne.egra (InfrastructureOne.graphI (rmapT s)) l}))))\n        (InfrastructureOne.delta (rmapT s))\"\nby (simp add: rmapT_def ref_map_def)\n  qed\nnext show \"\\<And>s s' G I a l I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureTwo.enables I l (Actor a) put \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure (InfrastructureTwo.put_graph_efid a l G)\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       (rmapT s, rmapT s') \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n  proof (rule rtrancl_imp_step, rule_tac I = \"rmapT s\" and I' = \"rmapT s'\" and l = l  \n                             and a = a \n in InfrastructureOne.state_transition_in.put, rule refl, simp add: rmapT_def ref_map_def atI_def InfrastructureOne.atI_def\n     ,simp add: rmapT_def ref_map_def nodes_def enables_def InfrastructureOne.enables_def\n              local_policiesO_def InfrastructureOne.nodes_def shopO_def pubO_def)\n    show \"\\<And>s s' G I a l I'.\n       (corona_scenarioT, I) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       {x. \\<exists>y. (x, y) \\<in> InfrastructureTwo.gra (InfrastructureTwo.graphI corona_scenarioT) \\<or>\n               (y, x) \\<in> InfrastructureTwo.gra (InfrastructureTwo.graphI corona_scenarioT)} =\n       {x. \\<exists>y. (x, y) \\<in> InfrastructureTwo.gra (InfrastructureTwo.graphI I) \\<or>\n               (y, x) \\<in> InfrastructureTwo.gra (InfrastructureTwo.graphI I)} \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta I \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' =\n       InfrastructureTwo.infrastructure.Infrastructure (InfrastructureTwo.put_graph_efid a l (InfrastructureTwo.graphI I))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>InfrastructureTwo.graphI I\\<^esub> l \\<Longrightarrow>\n       \\<exists>x\\<in>InfrastructureTwo.delta I (InfrastructureTwo.graphI I) l. case x of (p, e) \\<Rightarrow> put \\<in> e \\<and> p (Actor a) \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure (InfrastructureTwo.put_graph_efid a l (InfrastructureTwo.graphI I))\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       l \\<noteq> Location (Suc 0) \\<longrightarrow> l = Location 0\"\n      using all_not_in_conv corona_scenarioT_def local_policiesT_def pubT_def shopT_def by fastforce\n  next show \"\\<And>s s' G I a l I'.\n       (corona_scenarioT, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT) =\n       InfrastructureTwo.nodes (InfrastructureTwo.graphI s) \\<Longrightarrow>\n       InfrastructureTwo.delta corona_scenarioT = InfrastructureTwo.delta s \\<Longrightarrow>\n       s = I \\<Longrightarrow>\n       s' = I' \\<Longrightarrow>\n       G = InfrastructureTwo.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureTwo.enables I l (Actor a) put \\<Longrightarrow>\n       I' =\n       InfrastructureTwo.infrastructure.Infrastructure (InfrastructureTwo.put_graph_efid a l G)\n        (InfrastructureTwo.delta I) \\<Longrightarrow>\n       rmapT s' =\n       InfrastructureOne.infrastructure.Infrastructure\n        (InfrastructureOne.put_graph_efid a l (InfrastructureOne.graphI (rmapT s))) (InfrastructureOne.delta (rmapT s))\"\n      apply (simp add: rmapT_def ref_map_def)\n    apply (simp add: put_graph_efid_def InfrastructureOne.put_graph_efid_def)\n      apply (rule conjI)\n       apply (rule ext, simp add: InfrastructureTwo.efids_inc_ind_def InfrastructureOne.efids_inc_ind_def)\n       apply (rule ext, simp)\n      apply (rule impI)\n      by (simp add: InfrastructureTwo.efids_cur_def InfrastructureOne.efids_cur_def\n                       InfrastructureTwo.efids_inc_ind_def InfrastructureOne.efids_inc_ind_def)\nqed\nqed\n\ntheorem refmapTwo: \"corona_KripkeO \\<sqsubseteq>\\<^sub>rmapT corona_KripkeT\"\nproof (rule strong_mt'', simp add: corona_KripkeT_def corona_KripkeO_def corona_statesT_def corona_statesO_def state_transition_refl_def, rule conjI)\n  show \"IcoronaT \\<subseteq> {I. (corona_scenarioT, I) \\<in> {(x, y). x \\<rightarrow>\\<^sub>i y}\\<^sup>*}\"\n    using IcoronaT_def by fastforce\nnext show \"IcoronaO \\<subseteq> {I. (corona_scenarioO, I) \\<in> {(x, y). x \\<rightarrow>\\<^sub>i y}\\<^sup>*} \\<and>\n    rmapT ` IcoronaT \\<subseteq> IcoronaO \\<and>\n    (\\<forall>s. (\\<exists>s0\\<in>IcoronaT. (s0, s) \\<in> {(x, y). x \\<rightarrow>\\<^sub>i y}\\<^sup>*) \\<longrightarrow>\n         (\\<forall>s'. s \\<rightarrow>\\<^sub>i s' \\<longrightarrow> (rmapT s, rmapT s') \\<in> {(x, y). x \\<rightarrow>\\<^sub>i y}\\<^sup>*))\"\n    apply (rule conjI)\n    using IcoronaO_def apply blast\n    apply (rule conjI)\n     apply (simp add: rmapT_def ref_map_def IcoronaO_def IcoronaT_def corona_scenarioO_def corona_scenarioT_def\n                      ex_graphO_def ex_graphT_def pubO_def pubT_def  ex_loc_assT_def\n            ex_loc_assO_def ext ex_credsO_def  ex_credsT_def ex_locsO_def ex_locsT_def \n            ex_efidsT_def ex_efidsO_def shopO_def shopT_def\n            ex_knosT_def ex_knosO_def repl_efr_def)\n    using IcoronaT_def InfrastructureOne.state_transition_infra_def InfrastructureTwo.state_transition_infra_def refmapTwo_lem by auto\n  (*  using IcoronaT_def InfrastructureTwo.state_transition_infra_def refmapTwo_lem by auto *)\nqed\n\n(* The steps from the previous attack of level 1 still work still (but won't allow identification) *)\nlemma step1: \"corona_scenarioT  \\<rightarrow>\\<^sub>n corona_scenarioT'\"\nproof (rule_tac l = pubT and a = \"''Eve''\" in get)\n  show \"graphI corona_scenarioT = graphI corona_scenarioT\" by (rule refl)\nnext show \"''Eve'' @\\<^bsub>graphI corona_scenarioT\\<^esub> pubT\" \n    by (simp add: corona_scenarioT_def ex_graphT_def ex_loc_assT_def atI_def nodes_def)\nnext show \"enables corona_scenarioT pubT (Actor ''Eve'') get\"\n    by (simp add: enables_def corona_scenarioT_def ex_graphT_def local_policiesT_def\n                    ex_credsT_def ex_locsT_def)\nnext show \"pubT \\<in> nodes (graphI corona_scenarioT)\"\n    using corona_scenarioT_def ex_graphT_def nodes_def by auto \nnext show \"corona_scenarioT' =\n    Infrastructure\n     (Lgraph (gra (graphI corona_scenarioT)) (agra (graphI corona_scenarioT)) (cgra (graphI corona_scenarioT))\n       (lgra (graphI corona_scenarioT)) (egra (graphI corona_scenarioT))\n       ((kgra (graphI corona_scenarioT))\n        (''Eve'' := (kgra (graphI corona_scenarioT) (''Eve''))\n           (pubT := {(x, y). x \\<in> agra (graphI corona_scenarioT) pubT \\<and> y \\<in> egra (graphI corona_scenarioT) pubT}))))\n     (delta corona_scenarioT)\"\n    apply (simp add: corona_scenarioT'_def ex_graphT'_def move_graph_a_def \n                     corona_scenarioT_def ex_graphT_def pubT_def shopT_def \n                     ex_loc_assT'_def ex_loc_assT_def ex_efidsT'_def ex_efidsT_def \n                     ex_knosT_def ex_knosT'_def ex_credsT_def)\n    apply (rule ext, simp add: insert_Diff_if shopT_def pubT_def)\n      apply (rule impI, rule ext)\nby auto[1]\nqed\n\nlemma step1r: \"corona_scenarioT  \\<rightarrow>\\<^sub>n* corona_scenarioT'\"\nproof (simp add: state_transition_in_refl_def)\n  show \" (corona_scenarioT, corona_scenarioT') \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n  by (insert step1, auto)\nqed\n\n\n\nlemma step2r: \"corona_scenarioT'  \\<rightarrow>\\<^sub>n* corona_scenarioT''\"\nproof (simp add: state_transition_in_refl_def)\n  show \"(corona_scenarioT', corona_scenarioT'') \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n    by (insert step2, auto)\nqed\n\nlemma step3: \"corona_scenarioT''  \\<rightarrow>\\<^sub>n corona_scenarioT'''\"\nproof (rule_tac l' = shopT and l = pubT and a = \"''Eve''\" in move, rule refl)\n  show \"''Eve'' @\\<^bsub>graphI corona_scenarioT''\\<^esub> pubT\"\n   by (simp add: corona_scenarioT''_def ex_graphT''_def pubT_def shopT_def atI_def ex_loc_assT'_def)\nnext show \\<open>pubT \\<in> nodes (graphI corona_scenarioT'')\\<close>\n    by (simp add: corona_scenarioT''_def pubT_def ex_graphT''_def nodes_def, blast)\nnext show \\<open>shopT \\<in> nodes (graphI corona_scenarioT'')\\<close>\n    by (simp add: corona_scenarioT''_def pubT_def ex_graphT''_def nodes_def, blast)\nnext show \\<open>''Eve'' \\<in> actors_graph (graphI corona_scenarioT'')\\<close>\n    by (simp add: actors_graph_def corona_scenarioT''_def ex_graphT''_def nodes_def ex_loc_assT'_def \n                  shopT_def pubT_def, blast)\nnext show \\<open>enables corona_scenarioT'' shopT (Actor ''Eve'') move\\<close>\n    by (simp add: enables_def corona_scenarioT''_def local_policiesT_def)\nnext show \\<open>corona_scenarioT''' =\n    Infrastructure (move_graph_a ''Eve'' pubT shopT (graphI corona_scenarioT'')) (delta corona_scenarioT'')\\<close>\n    apply (simp add: corona_scenarioT'''_def ex_graphT'''_def move_graph_a_def pubT_def shopT_def\n                     corona_scenarioT''_def ex_graphT''_def ex_loc_assT''_def ex_loc_assT'_def)\n    apply (rule conjI)\n     apply (rule ext, simp add: insert_Diff_if shopT_def pubT_def)+\n    apply (rule conjI)\n    apply (simp add: ex_credsT'_def ex_credsT''_def)\n     apply force\n    by (rule ext, simp add: ex_efidsT'_def ex_efidsT''_def ex_credsT'_def insert_Diff_if shopT_def pubT_def)\nqed\n\nlemma step3r: \"corona_scenarioT''  \\<rightarrow>\\<^sub>n* corona_scenarioT'''\"\nproof (simp add: state_transition_in_refl_def)\n  show \"(corona_scenarioT'', corona_scenarioT''') \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n    by (insert step3, auto)\nqed\n\nlemma step4: \"corona_scenarioT'''  \\<rightarrow>\\<^sub>n corona_scenarioT''''\"\nproof (rule_tac l = shopT and a = \"''Eve''\" in get, rule refl)\n  show \\<open>''Eve'' @\\<^bsub>graphI corona_scenarioT'''\\<^esub> shopT\\<close>\n   by (simp add: corona_scenarioT'''_def ex_graphT'''_def pubT_def shopT_def atI_def ex_loc_assT''_def)\nnext show \\<open>enables corona_scenarioT''' shopT (Actor ''Eve'') get\\<close>\n    by (simp add: enables_def corona_scenarioT'''_def local_policiesT_def)\nnext show \"shopT \\<in> nodes (graphI corona_scenarioT''')\"\n    using corona_scenarioT'''_def ex_graphT'''_def nodes_def by auto\nnext show \\<open>corona_scenarioT'''' =\n    Infrastructure\n     (Lgraph (gra (graphI corona_scenarioT''')) (agra (graphI corona_scenarioT''')) (cgra (graphI corona_scenarioT'''))\n       (lgra (graphI corona_scenarioT''')) (egra (graphI corona_scenarioT'''))\n       ((kgra (graphI corona_scenarioT'''))\n        (''Eve'' := (kgra (graphI corona_scenarioT''') (''Eve''))\n           (shopT := {(x, y). x \\<in> agra (graphI corona_scenarioT''') shopT \\<and> y \\<in> egra (graphI corona_scenarioT''') shopT}))))\n     (delta corona_scenarioT''') \\<close>\n    apply (simp add: corona_scenarioT'''_def ex_graphT'''_def move_graph_a_def pubT_def shopT_def\n                     corona_scenarioT''''_def ex_graphT''''_def ex_loc_assT''_def ex_loc_assT'_def)\n     apply (rule ext, simp add: insert_Diff_if shopT_def pubT_def)+\n    apply (simp add: ex_efidsT''_def shopT_def pubT_def ex_knosT'_def ex_knosT''_def)\n    apply (rule impI, rule ext)\n    apply (simp add: insert_Diff_if shopT_def pubT_def)\n    apply (rule impI)+\n    apply (rule equalityI)\n     apply (rule subsetI)\n     apply (case_tac xa)\n    apply simp\n    apply linarith\n     apply (rule subsetI)\n     apply (case_tac xa)\n    apply simp\n    by metis\nqed\n\nlemma step4r: \"corona_scenarioT'''  \\<rightarrow>\\<^sub>n* corona_scenarioT''''\"\nproof (simp add: state_transition_in_refl_def)\n  show \"(corona_scenarioT''', corona_scenarioT'''') \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n    by (insert step4, auto)\nqed\n\n(* The refinements for the previous attack still work *)\nlemma corona_refT: \"[\\<N>\\<^bsub>(IcoronaT,scoronaT)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaT,scoronaT)\\<^esup> \\<sqsubseteq>\n                  ([\\<N>\\<^bsub>(IcoronaT,CoronaT')\\<^esub>, \\<N>\\<^bsub>(CoronaT',CoronaT'')\\<^esub>,  \\<N>\\<^bsub>(CoronaT'',CoronaT''')\\<^esub>, \\<N>\\<^bsub>(CoronaT''',scoronaT)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaT,scoronaT)\\<^esup>)\"\n  by (metis append_Cons append_Nil refI)  \n\nlemma corona_refT': \"[\\<N>\\<^bsub>(IcoronaT,scoronaT')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaT,scoronaT')\\<^esup> \\<sqsubseteq>\n                  ([\\<N>\\<^bsub>(IcoronaT,CoronaT')\\<^esub>, \\<N>\\<^bsub>(CoronaT',CoronaT'')\\<^esub>,  \\<N>\\<^bsub>(CoronaT'',CoronaT''')\\<^esub>, \\<N>\\<^bsub>(CoronaT''',scoronaT')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaT,scoronaT')\\<^esup>)\"\n  by (metis append_Cons append_Nil refI)  \n\n\nlemma att_coronaT: \"\\<turnstile>([\\<N>\\<^bsub>(IcoronaT,CoronaT')\\<^esub>, \\<N>\\<^bsub>(CoronaT',CoronaT'')\\<^esub>,  \\<N>\\<^bsub>(CoronaT'',CoronaT''')\\<^esub>, \\<N>\\<^bsub>(CoronaT''',scoronaT)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaT,scoronaT)\\<^esup>)\"\nproof (subst att_and, simp, rule conjI)\n  show \" \\<turnstile>\\<N>\\<^bsub>(IcoronaT, CoronaT')\\<^esub>\"\n    apply (simp add: IcoronaT_def CoronaT'_def att_base)\n    using state_transition_infra_def step1 by blast\nnext show \\<open> \\<turnstile>[\\<N>\\<^bsub>(CoronaT', CoronaT'')\\<^esub>, \\<N>\\<^bsub>(CoronaT'', CoronaT''')\\<^esub>, \\<N>\\<^bsub>(CoronaT''', scoronaT)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(CoronaT', scoronaT)\\<^esup>\\<close>\n    apply (subst att_and, simp)\n    apply (rule conjI)\n     apply (simp add: CoronaT'_def CoronaT''_def att_base state_transition_infra_def step2)\n    apply (subst att_and, simp, rule conjI)\n     apply (simp add: CoronaT''_def CoronaT'''_def att_base state_transition_infra_def step3)\n    apply (subst att_and, simp)\n    apply (simp add: CoronaT'''_def scoronaT_def att_base state_transition_infra_def step4)\n    apply (rule_tac x = \"corona_scenarioT''''\" in exI)\n    apply (rule conjI)\n     prefer 2\n    apply (rule step4)\n     apply (unfold corona_scenarioT''''_def global_policyT''_def)\n     apply (unfold global_policyT''_def identifiableT'_def ex_graphT''''_def ex_loc_assT''_def nodes_def is_singleton_def\n                  ex_efidsT''_def pubT_def shopT_def ex_credsT_def ex_locsT_def ex_knosT''_def local_policiesT_def)\n    apply (rule_tac x = 3 in exI, simp)\n    oops\n(* Here the proof following the outline of the previous step fails and that is what we want to show \n   here (so it is intentional showing that the \"old\" attack is now indeed eliminated. But there is \n   a new one (see below).\nproof (prove)\ngoal (1 subgoal):\n 1. False\n\nremaining steps would have been:\n     apply (rule conjI)\n    apply (rule impI)\n     apply (rule_tac x = \"''Bob''\" in exI)\n      apply (rule_tac  x = \"Efid 3\" in exI)\n      apply (rule equalityI)\n          apply auto[1]\n      apply simp\nby blast\nqed\n\n\nlemma corona_abs_attT: \"\\<turnstile>\\<^sub>V([\\<N>\\<^bsub>(IcoronaT,scoronaT)\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaT,scoronaT)\\<^esup>)\"\n  oops\n\nlemma corona_attT: \"corona_KripkeT \\<turnstile> EF {x. \\<exists> n. \\<not>(global_policyT'' x (Efid n))}\"\n  oops\n\ntheorem corona_EFT: \"corona_KripkeT \\<turnstile> EF scoronaT\"\n  oops\n\ntheorem corona_ATT: \"\\<exists> A. \\<turnstile> A \\<and> attack A = (IcoronaT,scoronaT)\"\n  oops\n\ntheorem corona_EFT': \"corona_KripkeT \\<turnstile> EF scoronaT\"\n  oops\n\n(* We can already show security for global_policy'' *)\nlemma kgra_disj_imp_not_identifiable: \n\"''Eve'' \\<in>  actors_graph  (graphI I) \\<Longrightarrow>\n\\<exists> l \\<in> nodes (graphI I). \\<exists> l' \\<in> nodes (graphI I). l \\<noteq> l' \\<Longrightarrow>\n(\\<forall> a \\<in> actors_graph  (graphI I).\n     (\\<forall> l \\<in> nodes (graphI I). \\<forall> l' \\<in> nodes (graphI I). \n         (l \\<noteq> l' \\<longrightarrow> (kgra (graphI I) a l) \\<inter> kgra(graphI I) a l' = {})))\n\\<Longrightarrow> global_policyT'' I eid \"\n  apply (simp add: global_policyT''_def identifiableT'_def)\n  apply (erule bexE)+\n  apply (subgoal_tac \"{(Id, Eid).\n            (\\<forall>x\\<in>InfrastructureTwo.nodes (InfrastructureTwo.graphI I).\n                (Id, Eid) \\<in> InfrastructureTwo.kgra (InfrastructureTwo.graphI I) ''Eve'' x) \\<and>\n            Id \\<noteq> ''Eve'' \\<and> Eid = eid} = {}\")\n   apply (erule ssubst)\n   apply (simp add: is_singleton_def)\n  by (smt (verit, ccfv_threshold) IntI case_prodI2 case_prod_conv empty_Collect_eq empty_iff split_part)\n(* The above theorem can be generalized for any reachable I since the preconditions are preserved\n   (see the standard procdure for other invariants) *)\n\ntheorem RR_cycle_succeeds: \"corona_KripkeT \\<turnstile> AG {x. \\<forall> n. global_policyT'' x (Efid n)}\"\n\n  oops\n*)\n\n(* Instead we now find the alternative attack where Bob is left on his own with Eve in the pub*)\n(* The steps for the isolation attack where Alice leaves and then Eve does a get *)\nlemma step1i: \"corona_scenarioT  \\<rightarrow>\\<^sub>n corona_scenarioTi\"\nproof (rule_tac l = pubT and l' = shopT and a = \"''Alice''\" in move)\n  show \"graphI corona_scenarioT = graphI corona_scenarioT\" by (rule refl)\nnext show \"''Alice'' @\\<^bsub>InfrastructureTwo.graphI corona_scenarioT\\<^esub> pubT\" \n    by (simp add: corona_scenarioT_def ex_graphT_def ex_loc_assT_def atI_def nodes_def)\nnext show \"pubT \\<in> InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT)\"\n    by (simp add: pubT_def shopT_def corona_scenarioT_def ex_graphT_def ex_loc_assT_def atI_def nodes_def)\nnext show \"shopT \\<in> InfrastructureTwo.nodes (InfrastructureTwo.graphI corona_scenarioT)\"\n    by (simp add: pubT_def shopT_def corona_scenarioT_def ex_graphT_def ex_loc_assT_def atI_def nodes_def)\nnext show \"''Alice'' \\<in> InfrastructureTwo.actors_graph (InfrastructureTwo.graphI corona_scenarioT)\"\n    by (simp add: pubT_def shopT_def corona_scenarioT_def ex_graphT_def ex_loc_assT_def ex_knosT_def \n           ex_credsT_def ex_locsT_def ex_efidsT_def InfrastructureTwo.actors_graph_def nodes_def, blast)\nnext show \"InfrastructureTwo.enables corona_scenarioT shopT (Actor ''Alice'') move\"\n    by (simp add: enables_def corona_scenarioT_def ex_graphT_def local_policiesT_def\n                    ex_credsT_def ex_locsT_def)\nnext show \"corona_scenarioTi =\n    InfrastructureTwo.infrastructure.Infrastructure\n     (InfrastructureTwo.move_graph_a ''Alice'' pubT shopT (InfrastructureTwo.graphI corona_scenarioT))\n     (InfrastructureTwo.delta corona_scenarioT)\"\n    apply (simp add: corona_scenarioTi_def ex_graphTi_def move_graph_a_def \n                     corona_scenarioT_def ex_graphT_def pubT_def shopT_def \n                     ex_loc_assTi_def ex_loc_assT_def ex_efidsTi_def ex_efidsT_def \n                     ex_knosT_def ex_knosTi_def ex_credsT_def ex_credsTi_def)\n    apply (rule conjI)\n     apply (rule ext, simp add: insert_Diff_if shopT_def pubT_def)\n    apply (rule conjI)\n    apply (rule ext, simp)\n    by (rule ext, simp add: shopT_def)\nqed\n\nlemma step1ir: \"corona_scenarioT  \\<rightarrow>\\<^sub>n* corona_scenarioTi\"\nproof (simp add: state_transition_in_refl_def)\n  show \" (corona_scenarioT, corona_scenarioTi) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n  by (insert step1i, auto)\nqed\n\nlemma step2i: \"corona_scenarioTi  \\<rightarrow>\\<^sub>n corona_scenarioTii\"\nproof (rule_tac l = pubT  and a = \"''Eve''\" in get, rule refl)\n  show \"''Eve'' @\\<^bsub>InfrastructureTwo.graphI corona_scenarioTi\\<^esub> pubT\"\n   by (simp add: corona_scenarioTi_def ex_graphTi_def pubT_def shopT_def atI_def ex_loc_assT_def ex_loc_assTi_def)\nnext show \"pubT \\<in> nodes (graphI corona_scenarioTi)\"\n    by (simp add: corona_scenarioTi_def ex_graphTi_def pubT_def atI_def nodes_def, blast)\nnext show \"enables corona_scenarioTi pubT (Actor ''Eve'') get\"\n    by (simp add: enables_def corona_scenarioTi_def local_policiesT_def)\nnext show \"corona_scenarioTii =\n    InfrastructureTwo.infrastructure.Infrastructure\n     (InfrastructureTwo.igraph.Lgraph (InfrastructureTwo.gra (InfrastructureTwo.graphI corona_scenarioTi))\n       (InfrastructureTwo.agra (InfrastructureTwo.graphI corona_scenarioTi))\n       (InfrastructureTwo.cgra (InfrastructureTwo.graphI corona_scenarioTi))\n       (InfrastructureTwo.lgra (InfrastructureTwo.graphI corona_scenarioTi))\n       (InfrastructureTwo.egra (InfrastructureTwo.graphI corona_scenarioTi))\n       ((InfrastructureTwo.kgra (InfrastructureTwo.graphI corona_scenarioTi))\n        (''Eve'' := (InfrastructureTwo.kgra (InfrastructureTwo.graphI corona_scenarioTi) ''Eve'')\n           (pubT :=\n              {(x, y).\n               x \\<in> InfrastructureTwo.agra (InfrastructureTwo.graphI corona_scenarioTi) pubT \\<and>\n               y \\<in> InfrastructureTwo.egra (InfrastructureTwo.graphI corona_scenarioTi) pubT}))))\n     (InfrastructureTwo.delta corona_scenarioTi)\"\n    apply (simp add: corona_scenarioTi_def ex_graphTii_def move_graph_a_def corona_scenarioTii_def \n                     ex_graphTi_def ex_loc_assT_def ex_loc_assTi_def shopT_def pubT_def ex_credsT_def\n                     ex_credsTi_def ex_knosT_def ex_knosTi_def ex_efidsTi_def)\n    apply (rule ext, simp add: insert_Diff_if shopT_def pubT_def)\n    apply (rule impI)\n    by (rule ext, force)\nqed\n\nlemma step2ir: \"corona_scenarioTi  \\<rightarrow>\\<^sub>n* corona_scenarioTii\"\nproof (simp add: state_transition_in_refl_def)\n  show \"(corona_scenarioTi, corona_scenarioTii) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n    by (insert step2i, auto)\nqed\n\nlemma corona_refTi: \"[\\<N>\\<^bsub>(IcoronaT,scoronaT')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaT,scoronaT')\\<^esup> \\<sqsubseteq>\n                  ([\\<N>\\<^bsub>(IcoronaT,CoronaTi)\\<^esub>,  \\<N>\\<^bsub>(CoronaTi,scoronaT')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaT,scoronaT')\\<^esup>)\"\n  by (metis append_Cons append_Nil refI)  \n\n\nlemma att_coronaTi: \"\\<turnstile>([\\<N>\\<^bsub>(IcoronaT,CoronaTi)\\<^esub>, \\<N>\\<^bsub>(CoronaTi,scoronaT')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(IcoronaT,scoronaT')\\<^esup>)\"\nproof (subst att_and, simp, rule conjI)\n  show \" \\<turnstile>\\<N>\\<^bsub>(IcoronaT, CoronaTi)\\<^esub>\"\n apply (simp add: IcoronaT_def CoronaTi_def att_base)\n    using state_transition_infra_def step1i by blast\nnext show \" \\<turnstile>[\\<N>\\<^bsub>(CoronaTi, scoronaT')\\<^esub>] \\<oplus>\\<^sub>\\<and>\\<^bsup>(CoronaTi, scoronaT')\\<^esup>\"\napply (subst att_and, simp)\n     apply (simp add: CoronaTi_def CoronaTii_def att_base state_transition_infra_def step2i)\n    apply (simp add: CoronaTi_def CoronaTii_def scoronaT'_def  att_base state_transition_infra_def step2i)\n    apply (rule_tac x = \"corona_scenarioTii\" in exI)\n    apply (rule conjI)\n     prefer 2\n    apply (rule step2i)\n    apply (simp add: global_policyT_def corona_scenarioTii_def ex_graphTii_def ex_efidsTi_def\n                     identifiableT'_def is_singleton_def nodes_def\n                     ex_knosTi_def pubT_def shopT_def)\n    apply (rule_tac  x = \"3\" in exI)\n apply (rule set_exI)\n     prefer 2\n    apply (subgoal_tac \n    \"{Location 0} \\<subseteq> {x. \\<exists>y. x = Location 0 \\<and> y = Location (Suc 0) \\<or> y = Location 0 \\<and> x = Location (Suc 0)}\")\n      apply assumption\n    apply simp\n     apply (rule_tac x = \"''Bob''\" in exI)\n      apply (rule_tac  x = \"Efid 3\" in exI)\n      apply (rule equalityI)\n     apply simp\n     apply auto[1]\n    apply (rule subsetI)\n    apply (rule CollectI)\n      apply (case_tac x)\nby simp\nqed\n\n(* We can already establish non-identifiability for subsets L with more than 2 elements.\n   This should follow simply from disjointness of the kgra set intersections for all pairs of \n   locations. *)\nlemma all_kgra_disj_imp_greater_two_inv: \"(\\<forall> a \\<in> actors_graph (graphI y). \n     (\\<forall> l \\<in> nodes (graphI I). \\<forall> l' \\<in> nodes (graphI I). \n      (l \\<noteq> l' \\<longrightarrow> (kgra (graphI I) a l) \\<inter> kgra(graphI I) a l' = {}))) \\<Longrightarrow>\n      L \\<subseteq> nodes(graphI I)  \\<Longrightarrow> card L \\<ge> 2 \\<Longrightarrow> \n      (\\<not>(identifiableT' eid \n               ((\\<Inter> (kgra(graphI I)(''Eve'')`L))\n                          - {(x,y). x = ''Eve''})))\"\n  oops\n\nend\nend\n", "meta": {"author": "flokam", "repo": "CoronaApp", "sha": "6258178b8f9d10f43e0825d99cbb0126ee51612c", "save_path": "github-repos/isabelle/flokam-CoronaApp", "path": "github-repos/isabelle/flokam-CoronaApp/CoronaApp-6258178b8f9d10f43e0825d99cbb0126ee51612c/IsabelleCorona/CoronaAppTwo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.668880247169804, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.3187747147995705}}
{"text": "theory flash102Bra  imports flash102Rev\n \n  begin\nlemma onInv102:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv102 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv102 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv102 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash102Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7217432182679956, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.3187744965304855}}
{"text": "theory BinarySearch\nimports \n  \"variable\"\nbegin\n\nsubsection\\<open>Definition of the environment\\<close>\nrecord env = \n  right :: \"nat\"\n  left  :: \"nat\"\n  arr   :: \"nat list\"\n  mid   :: \"nat\"\n  val   :: \"nat\"\n\nsubsubsection\\<open>Monad update functions\\<close>\ntext\\<open>Each of the definitions takes an environment and a value of one of the variables. They update the value of the variable and outputs a new environment.\\<close>\ndefinition right_Env:: \"env \\<Rightarrow> nat \\<Rightarrow> env\" where \"right_Env s v = s \\<lparr> right := v \\<rparr>\"\ndefinition left_Env:: \"env \\<Rightarrow> nat \\<Rightarrow> env\" where \"left_Env s v = s \\<lparr> left := v \\<rparr>\"\ndefinition arr_Env:: \"env \\<Rightarrow> nat list  \\<Rightarrow> env\" where \"arr_Env s v = s \\<lparr> arr := v \\<rparr>\"\ndefinition mid_Env:: \"env \\<Rightarrow> nat \\<Rightarrow> env\" where \"mid_Env s v = s \\<lparr> mid := v \\<rparr>\"\ndefinition val_Env:: \"env \\<Rightarrow> nat \\<Rightarrow> env\" where \"val_Env s v = s \\<lparr> val := v \\<rparr>\"\n\ntext\\<open>I think the update functions should be changed to have the same signature as in the Refinement Calculus book\\<close>\ndefinition right_Env1:: \"nat \\<Rightarrow> env \\<Rightarrow> env\" where \"right_Env1 v s = s \\<lparr> right := v \\<rparr>\"\ndefinition left_Env1:: \"nat \\<Rightarrow> env \\<Rightarrow> env\" where \"left_Env1 v s = s \\<lparr> left := v \\<rparr>\"\ndefinition arr_Env1:: \"nat list \\<Rightarrow> env \\<Rightarrow> env\" where \"arr_Env1 v s = s \\<lparr> arr := v \\<rparr>\"\ndefinition mid_Env1:: \"nat \\<Rightarrow> env \\<Rightarrow> env\" where \"mid_Env1 v s = s \\<lparr> mid := v \\<rparr>\"\ndefinition val_Env1:: \"nat \\<Rightarrow> env \\<Rightarrow> env\" where \"val_Env1 v s = s \\<lparr> val := v \\<rparr>\"\n\ntext\\<open>Should I make a get function?\\<close>\ndefinition right_get:: \"env \\<Rightarrow> nat\" where \"right_get s = right s\"\ndefinition left_get:: \"env \\<Rightarrow> nat\" where \"left_get s = left s\"\ndefinition arr_get:: \"env \\<Rightarrow>nat list\" where \"arr_get s = arr s\"\ndefinition mid_get:: \"env \\<Rightarrow>nat\" where \"mid_get s = mid s\"\ndefinition val_get:: \"env \\<Rightarrow>nat\" where \"val_get s = val s\"\n\ntext\\<open>Variable definitions\\<close>\n\nsubsubsection\\<open>Theorems about how the update functions changes the environment\\<close>\n\ntheorem put_right_rule: \"\\<lbrakk>dcl [x]; x=(xa,xu)\\<rbrakk> \\<Longrightarrow> spec {v. v \\<in> p \\<and> right_get v = xa v} ((right_get, right_Env1) := x) p\"\n  apply (simp add: spec_def put_def get_state_def assign_def put_state_def var_def; clarify)\n  apply(simp add: right_get_def right_Env1_def)\n  by (metis env.surjective env.update_convs(1))\n\ntheorem put_left_rule: \"spec (\\<lambda>x. p () (x \\<lparr> left := v \\<rparr>)) (put left_Env v) p\"\n  by (simp add: spec_def put_def get_state_def put_state_def left_Env_def)\n\ntheorem put_arr_rule: \"spec (\\<lambda>x. p () (x \\<lparr> arr := v \\<rparr>)) (put arr_Env v) p\"\n  by (simp add: spec_def put_def get_state_def put_state_def arr_Env_def)\n\ntheorem put_mid_rule: \"spec (\\<lambda>x. p () (x \\<lparr> mid := v \\<rparr>)) (put mid_Env v) p\"\n  by (simp add: spec_def put_def get_state_def put_state_def mid_Env_def)\n\ntheorem put_val_rule: \"spec (\\<lambda>x. p () (x \\<lparr> val := v \\<rparr>)) (put val_Env v) p\"\n  by (simp add: spec_def put_def get_state_def put_state_def val_Env_def)\n\n\nsubsection\\<open>Definitions of the methods\\<close>\ndefinition update_left where\n  \"update_left \\<equiv> do{\n    (left_get,left_Env1) := (mid_get, mid_Env1)\n  }\"\n\ndefinition update_right where\n  \"update_right \\<equiv> do{\n    (right_get,right_Env1) := (mid_get, mid_Env1)\n  }\"\n\nend", "meta": {"author": "SimplisticCode", "repo": "Tarjan-Isabelle", "sha": "ecd72ef5fc352075e6037965cc30844b7db4bacc", "save_path": "github-repos/isabelle/SimplisticCode-Tarjan-Isabelle", "path": "github-repos/isabelle/SimplisticCode-Tarjan-Isabelle/Tarjan-Isabelle-ecd72ef5fc352075e6037965cc30844b7db4bacc/BinarySearch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593312018545, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.31852277552903846}}
{"text": "(*  Title:      HOL/HOLCF/Library/Char_Discrete.thy\n    Author:     Brian Huffman\n*)\n\nsection {* Discrete cpo instance for 8-bit char type *}\n\ntheory Char_Discrete\nimports HOLCF\nbegin\n\nsubsection {* Discrete cpo instance for @{typ nibble}. *}\n\ninstantiation nibble :: discrete_cpo\nbegin\n\ndefinition below_nibble_def:\n  \"(x::nibble) \\<sqsubseteq> y \\<longleftrightarrow> x = y\"\n\ninstance proof\nqed (rule below_nibble_def)\n\nend\n\ntext {*\n  TODO: implement a command to automate discrete predomain instances.\n*}\n\ninstantiation nibble :: predomain\nbegin\n\ndefinition\n  \"(liftemb :: nibble u \\<rightarrow> udom u) \\<equiv> liftemb oo u_map\\<cdot>(\\<Lambda> x. Discr x)\"\n\ndefinition\n  \"(liftprj :: udom u \\<rightarrow> nibble u) \\<equiv> u_map\\<cdot>(\\<Lambda> y. undiscr y) oo liftprj\"\n\ndefinition\n  \"liftdefl \\<equiv> (\\<lambda>(t::nibble itself). LIFTDEFL(nibble discr))\"\n\ninstance proof\n  show \"ep_pair liftemb (liftprj :: udom u \\<rightarrow> nibble u)\"\n    unfolding liftemb_nibble_def liftprj_nibble_def\n    apply (rule ep_pair_comp)\n    apply (rule ep_pair_u_map)\n    apply (simp add: ep_pair.intro)\n    apply (rule predomain_ep)\n    done\n  show \"cast\\<cdot>LIFTDEFL(nibble) = liftemb oo (liftprj :: udom u \\<rightarrow> nibble u)\"\n    unfolding liftemb_nibble_def liftprj_nibble_def liftdefl_nibble_def\n    apply (simp add: cast_liftdefl cfcomp1 u_map_map)\n    apply (simp add: ID_def [symmetric] u_map_ID)\n    done\nqed\n\nend\n\nsubsection {* Discrete cpo instance for @{typ char}. *}\n\ninstantiation char :: discrete_cpo\nbegin\n\ndefinition below_char_def:\n  \"(x::char) \\<sqsubseteq> y \\<longleftrightarrow> x = y\"\n\ninstance proof\nqed (rule below_char_def)\n\nend\n\ntext {*\n  TODO: implement a command to automate discrete predomain instances.\n*}\n\ninstantiation char :: predomain\nbegin\n\ndefinition\n  \"(liftemb :: char u \\<rightarrow> udom u) \\<equiv> liftemb oo u_map\\<cdot>(\\<Lambda> x. Discr x)\"\n\ndefinition\n  \"(liftprj :: udom u \\<rightarrow> char u) \\<equiv> u_map\\<cdot>(\\<Lambda> y. undiscr y) oo liftprj\"\n\ndefinition\n  \"liftdefl \\<equiv> (\\<lambda>(t::char itself). LIFTDEFL(char discr))\"\n\ninstance proof\n  show \"ep_pair liftemb (liftprj :: udom u \\<rightarrow> char u)\"\n    unfolding liftemb_char_def liftprj_char_def\n    apply (rule ep_pair_comp)\n    apply (rule ep_pair_u_map)\n    apply (simp add: ep_pair.intro)\n    apply (rule predomain_ep)\n    done\n  show \"cast\\<cdot>LIFTDEFL(char) = liftemb oo (liftprj :: udom u \\<rightarrow> char u)\"\n    unfolding liftemb_char_def liftprj_char_def liftdefl_char_def\n    apply (simp add: cast_liftdefl cfcomp1 u_map_map)\n    apply (simp add: ID_def [symmetric] u_map_ID)\n    done\nqed\n\nend\n\nsubsection {* Using chars with Fixrec *}\n\ndefinition match_Char :: \"char \\<rightarrow> (nibble \\<rightarrow> nibble \\<rightarrow> 'a match) \\<rightarrow> 'a match\"\n  where \"match_Char = (\\<Lambda> c k. case c of Char a b \\<Rightarrow> k\\<cdot>a\\<cdot>b)\"\n\nlemma match_Char_simps [simp]:\n  \"match_Char\\<cdot>(Char a b)\\<cdot>k = k\\<cdot>a\\<cdot>b\"\nby (simp add: match_Char_def)\n\ndefinition match_Nibble0 :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_Nibble0 = (\\<Lambda> c k. if c = Nibble0 then k else Fixrec.fail)\"\n\ndefinition match_Nibble1 :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_Nibble1 = (\\<Lambda> c k. if c = Nibble1 then k else Fixrec.fail)\"\n\ndefinition match_Nibble2 :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_Nibble2 = (\\<Lambda> c k. if c = Nibble2 then k else Fixrec.fail)\"\n\ndefinition match_Nibble3 :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_Nibble3 = (\\<Lambda> c k. if c = Nibble3 then k else Fixrec.fail)\"\n\ndefinition match_Nibble4 :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_Nibble4 = (\\<Lambda> c k. if c = Nibble4 then k else Fixrec.fail)\"\n\ndefinition match_Nibble5 :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_Nibble5 = (\\<Lambda> c k. if c = Nibble5 then k else Fixrec.fail)\"\n\ndefinition match_Nibble6 :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_Nibble6 = (\\<Lambda> c k. if c = Nibble6 then k else Fixrec.fail)\"\n\ndefinition match_Nibble7 :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_Nibble7 = (\\<Lambda> c k. if c = Nibble7 then k else Fixrec.fail)\"\n\ndefinition match_Nibble8 :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_Nibble8 = (\\<Lambda> c k. if c = Nibble8 then k else Fixrec.fail)\"\n\ndefinition match_Nibble9 :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_Nibble9 = (\\<Lambda> c k. if c = Nibble9 then k else Fixrec.fail)\"\n\ndefinition match_NibbleA :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_NibbleA = (\\<Lambda> c k. if c = NibbleA then k else Fixrec.fail)\"\n\ndefinition match_NibbleB :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_NibbleB = (\\<Lambda> c k. if c = NibbleB then k else Fixrec.fail)\"\n\ndefinition match_NibbleC :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_NibbleC = (\\<Lambda> c k. if c = NibbleC then k else Fixrec.fail)\"\n\ndefinition match_NibbleD :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_NibbleD = (\\<Lambda> c k. if c = NibbleD then k else Fixrec.fail)\"\n\ndefinition match_NibbleE :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_NibbleE = (\\<Lambda> c k. if c = NibbleE then k else Fixrec.fail)\"\n\ndefinition match_NibbleF :: \"nibble \\<rightarrow> 'a match \\<rightarrow> 'a match\"\n  where \"match_NibbleF = (\\<Lambda> c k. if c = NibbleF then k else Fixrec.fail)\"\n\nlemma match_Nibble0_simps [simp]:\n  \"match_Nibble0\\<cdot>c\\<cdot>k = (if c = Nibble0 then k else Fixrec.fail)\"\nby (simp add: match_Nibble0_def)\n\nlemma match_Nibble1_simps [simp]:\n  \"match_Nibble1\\<cdot>c\\<cdot>k = (if c = Nibble1 then k else Fixrec.fail)\"\nby (simp add: match_Nibble1_def)\n\nlemma match_Nibble2_simps [simp]:\n  \"match_Nibble2\\<cdot>c\\<cdot>k = (if c = Nibble2 then k else Fixrec.fail)\"\nby (simp add: match_Nibble2_def)\n\nlemma match_Nibble3_simps [simp]:\n  \"match_Nibble3\\<cdot>c\\<cdot>k = (if c = Nibble3 then k else Fixrec.fail)\"\nby (simp add: match_Nibble3_def)\n\nlemma match_Nibble4_simps [simp]:\n  \"match_Nibble4\\<cdot>c\\<cdot>k = (if c = Nibble4 then k else Fixrec.fail)\"\nby (simp add: match_Nibble4_def)\n\nlemma match_Nibble5_simps [simp]:\n  \"match_Nibble5\\<cdot>c\\<cdot>k = (if c = Nibble5 then k else Fixrec.fail)\"\nby (simp add: match_Nibble5_def)\n\nlemma match_Nibble6_simps [simp]:\n  \"match_Nibble6\\<cdot>c\\<cdot>k = (if c = Nibble6 then k else Fixrec.fail)\"\nby (simp add: match_Nibble6_def)\n\nlemma match_Nibble7_simps [simp]:\n  \"match_Nibble7\\<cdot>c\\<cdot>k = (if c = Nibble7 then k else Fixrec.fail)\"\nby (simp add: match_Nibble7_def)\n\nlemma match_Nibble8_simps [simp]:\n  \"match_Nibble8\\<cdot>c\\<cdot>k = (if c = Nibble8 then k else Fixrec.fail)\"\nby (simp add: match_Nibble8_def)\n\nlemma match_Nibble9_simps [simp]:\n  \"match_Nibble9\\<cdot>c\\<cdot>k = (if c = Nibble9 then k else Fixrec.fail)\"\nby (simp add: match_Nibble9_def)\n\nlemma match_NibbleA_simps [simp]:\n  \"match_NibbleA\\<cdot>c\\<cdot>k = (if c = NibbleA then k else Fixrec.fail)\"\nby (simp add: match_NibbleA_def)\n\nlemma match_NibbleB_simps [simp]:\n  \"match_NibbleB\\<cdot>c\\<cdot>k = (if c = NibbleB then k else Fixrec.fail)\"\nby (simp add: match_NibbleB_def)\n\nlemma match_NibbleC_simps [simp]:\n  \"match_NibbleC\\<cdot>c\\<cdot>k = (if c = NibbleC then k else Fixrec.fail)\"\nby (simp add: match_NibbleC_def)\n\nlemma match_NibbleD_simps [simp]:\n  \"match_NibbleD\\<cdot>c\\<cdot>k = (if c = NibbleD then k else Fixrec.fail)\"\nby (simp add: match_NibbleD_def)\n\nlemma match_NibbleE_simps [simp]:\n  \"match_NibbleE\\<cdot>c\\<cdot>k = (if c = NibbleE then k else Fixrec.fail)\"\nby (simp add: match_NibbleE_def)\n\nlemma match_NibbleF_simps [simp]:\n  \"match_NibbleF\\<cdot>c\\<cdot>k = (if c = NibbleF then k else Fixrec.fail)\"\nby (simp add: match_NibbleF_def)\n\nsetup {*\n  Fixrec.add_matchers\n    [ (@{const_name Char}, @{const_name match_Char}),\n      (@{const_name Nibble0}, @{const_name match_Nibble0}),\n      (@{const_name Nibble1}, @{const_name match_Nibble1}),\n      (@{const_name Nibble2}, @{const_name match_Nibble2}),\n      (@{const_name Nibble3}, @{const_name match_Nibble3}),\n      (@{const_name Nibble4}, @{const_name match_Nibble4}),\n      (@{const_name Nibble5}, @{const_name match_Nibble5}),\n      (@{const_name Nibble6}, @{const_name match_Nibble6}),\n      (@{const_name Nibble7}, @{const_name match_Nibble7}),\n      (@{const_name Nibble8}, @{const_name match_Nibble8}),\n      (@{const_name Nibble9}, @{const_name match_Nibble9}),\n      (@{const_name NibbleA}, @{const_name match_NibbleA}),\n      (@{const_name NibbleB}, @{const_name match_NibbleB}),\n      (@{const_name NibbleC}, @{const_name match_NibbleC}),\n      (@{const_name NibbleD}, @{const_name match_NibbleD}),\n      (@{const_name NibbleE}, @{const_name match_NibbleE}),\n      (@{const_name NibbleF}, @{const_name match_NibbleF}) ]\n*}\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/Library/Char_Discrete.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593171945416, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.31852276836126386}}
{"text": "theory Horn_List\n  imports Horn_Inference\nbegin\n\nlocale horn_list_impl = horn +\n  fixes infer0_impl :: \"'a list\" and infer1_impl :: \"'a \\<Rightarrow> 'a list \\<Rightarrow> 'a list\"\nbegin\n\nlemma saturate_fold_simp [simp]:\n  \"fold (\\<lambda>xa. case_option None (f xa)) xs None = None\"\n  by (induct xs) auto\n\nlemma saturate_fold_mono [partial_function_mono]:\n  \"option.mono_body (\\<lambda>f. fold (\\<lambda>x. case_option None (\\<lambda>y. f (x, y))) xs b)\"\n  unfolding monotone_def fun_ord_def flat_ord_def\nproof (intro allI impI, induct xs arbitrary: b)\n  case (Cons a xs)\n  show ?case\n    using Cons(1)[OF Cons(2), of \"x (a, the b)\"] Cons(2)[rule_format, of \"(a, the b)\"]\n    by (cases b) auto\nqed auto\n\npartial_function (option) saturate_rec :: \"'a \\<Rightarrow> 'a list \\<Rightarrow> ('a list) option\" where\n  \"saturate_rec x bs = (if x \\<in> set bs then Some bs else\n     fold (\\<lambda>x. case_option None (saturate_rec x)) (infer1_impl x bs) (Some (x # bs)))\"\n\ndefinition saturate_impl where\n  \"saturate_impl = fold (\\<lambda>x. case_option None (saturate_rec x)) infer0_impl (Some [])\"\n\nend\n\nlocale horn_list = horn_list_impl +\n  assumes infer0: \"infer0 = set infer0_impl\"\n    and infer1: \"\\<And>x bs. infer1 x (set bs) = set (infer1_impl x bs)\"\nbegin\n\nlemma saturate_rec_sound:\n  \"saturate_rec x bs = Some bs' \\<Longrightarrow> ({x}, set bs) \\<turnstile> ({}, set bs')\"\nproof (induct arbitrary: x bs bs' rule: saturate_rec.fixp_induct)\n  case 1 show ?case using option_admissible[of \"\\<lambda>(x, y) z. _ x y z\"]\n    by fastforce\nnext\n  case (3 rec)\n  have [dest!]: \"(set xs, set ys) \\<turnstile> ({}, set bs')\"\n    if \"fold (\\<lambda>x a. case a of None \\<Rightarrow> None | Some a \\<Rightarrow> rec x a) xs (Some ys) = Some bs'\"\n    for xs ys using that\n  proof (induct xs arbitrary: ys)\n    case (Cons a xs)\n    show ?case using trans[OF step_mono[OF 3(1)], of a ys _ \"set xs\" \"{}\" \"set bs'\"] Cons\n      by (cases \"rec a ys\") auto\n  qed (auto intro: refl)\n  show ?case using propagate[of x \"{}\" \"set bs\", unfolded infer1 Un_empty_left] 3(2)\n    by (auto split: if_splits intro: trans delete)\nqed auto\n\nlemma saturate_impl_sound:\n  assumes \"saturate_impl = Some B'\"\n  shows \"set B' = saturate\"\nproof -\n  have \"(set xs, set ys) \\<turnstile> ({}, set bs')\"\n    if \"fold (\\<lambda>x a. case a of None \\<Rightarrow> None | Some a \\<Rightarrow> saturate_rec x a) xs (Some ys) = Some bs'\"\n    for xs ys bs' using that\n  proof (induct xs arbitrary: ys)\n    case (Cons a xs)\n    show ?case\n      using trans[OF step_mono[OF saturate_rec_sound], of a ys _ \"set xs\" \"{}\" \"set bs'\"] Cons\n      by (cases \"saturate_rec a ys\") auto\n  qed (auto intro: refl)\n  from this[of infer0_impl \"[]\" B'] assms step_sound show ?thesis\n    by (auto simp: saturate_impl_def infer0)\nqed\n\nlemma saturate_impl_complete:\n  assumes \"finite saturate\"\n  shows \"saturate_impl \\<noteq> None\"\nproof -\n  have *: \"fold (\\<lambda>x. case_option None (saturate_rec x)) ds (Some bs) \\<noteq> None\"\n    if \"set bs \\<subseteq> saturate\" \"set ds \\<subseteq> saturate\" for bs ds\n    using that\n  proof (induct \"card (saturate - set bs)\" arbitrary: bs ds rule: less_induct)\n    case less\n    show ?case using less(3)\n    proof (induct ds)\n      case (Cons d ds)\n      have \"infer1 d (set bs) \\<subseteq> saturate\" using less(2) Cons(2)\n        unfolding infer1_def by (auto intro: saturate.infer)\n      moreover have \"card (saturate - set (d # bs)) < card (saturate - set bs)\" if \"d \\<notin> set bs\"\n        using Cons(2) assms that\n        by (metis (no_types, lifting) DiffI card_Diff1_less_iff card_Diff_insert card_Diff_singleton_if finite_Diff list.set_intros(1) list.simps(15) subsetD)\n      ultimately show ?case using less(1)[of \"d # bs\" \"infer1_impl d bs @ ds\"] less(2) Cons assms\n        unfolding fold.simps comp_def option.simps\n        by (subst saturate_rec.simps) (auto split: if_splits simp: infer1)\n    qed simp\n  qed\n  show ?thesis using *[of \"[]\" \"infer0_impl\"] inv_start by (simp add: saturate_impl_def infer0)\nqed\n\nend\n\nlemmas [code] = horn_list_impl.saturate_rec.simps horn_list_impl.saturate_impl_def\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Regular_Tree_Relations/Horn_Setup/Horn_List.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.5, "lm_q1q2_score": 0.31851539724019157}}
{"text": "(*  Title:      MultiASP.thy\n    Author:     Ludovic Henrio and Florian Kammuller\n                2014\n\n    Note:       Multi-active object formalisation\n                For the moment methods and parameter bindings are done statically, \n                  without inheritance but with interfaces\n                  this could be improved\n*)\ntheory Serialization imports StoreDefinition Main AuxiliaryFunctions begin\nsection{*References, Well-formed store, finite objects*}\n(*lemma map_restrict_id: \"\\<sigma> x = None \\<Longrightarrow>(\\<sigma>|` L) x = None\"\napply (unfold restrict_map_def)\napply auto\n  *)       \n\naxiomatization where \nfinite_map: \"finite (dom (\\<sigma>::Store))\"\nand\nfinite_obj: \"V=Obj(f,C) \\<Longrightarrow>finite (dom f)\"\n\nabbreviation isnotObjRef where \"isnotObjRef V \\<equiv>\\<forall>l'. V\\<noteq>ObjRef l'\"\n\nlemma finite_ran_obj:\n\"V=Obj(f,C) \\<Longrightarrow>finite (ran f)\"\napply (drule finite_obj)\napply (auto simp: ran_and_dom)\ndone\n\ndefinition Referenced_locations_Value:: \"Value \\<Rightarrow> Location set\"\nwhere  \"Referenced_locations_Value v \\<equiv> (case v of ObjRef l \\<Rightarrow>{l} | _ \\<Rightarrow> {})\"\n\ndefinition Referenced_locations_Location:: \"Store \\<Rightarrow>Location \\<Rightarrow> Location set\" \n(*Set of locations referenced from a location (non-recursive))*)\nwhere  \"Referenced_locations_Location \\<sigma> l \\<equiv> \ncase \\<sigma> l of \nNone \\<Rightarrow>{} |\nSome (Obj obj) \\<Rightarrow> \\<Union>(Referenced_locations_Value`ran(fst(obj))) |\nSome (StoredVal (ObjRef l')) \\<Rightarrow> {l'} |\n_\\<Rightarrow>{}\n\"\n\nlemma  finite_ran_obj_Referenced_locations_Value: \"V=Obj(f,C) \\<Longrightarrow>finite (\\<Union>l'\\<in>ran f. Referenced_locations_Value l')\"\napply (drule finite_ran_obj)\napply (auto simp: Referenced_locations_Value_def split: Value.splits)\ndone\n\ndefinition Well_Formed_Store where\n\"Well_Formed_Store \\<sigma> \\<equiv> \\<forall> l\\<in> dom \\<sigma>. Referenced_locations_Location \\<sigma> l\\<subseteq>dom \\<sigma>\"\n\n\nsubsection{*generic lemmas on folding (for Mark serialization)*}\n\nlemma SF_fold_to_Union[rule_format]: \"\\<forall>LS . ((distinct fieldlist)\\<longrightarrow>(\\<exists> F .\n (fold (\\<lambda>x S.  (S\\<union>(SF x \\<sigma> (L\\<union>{l}\\<union>S) )) ) fieldlist (LS) \n      = LS\\<union> \\<Union>((\\<lambda> x . SF x \\<sigma> (L\\<union>{l}\\<union>F x) ) `(set fieldlist)))))\"\napply (induct_tac fieldlist)\napply auto\napply (drule_tac x= \"(LS \\<union> SF a \\<sigma> (insert l (L \\<union> LS)) )\" in spec,clarsimp)\napply (rule_tac x=\"F(a:= LS)\" in exI)\napply (auto split: split_if_asm)\ndone\n\nlemma SF_fold_to_Union_what_F[rule_format]: \"\\<forall>LS . ((distinct fieldlist)\\<longrightarrow>(\\<exists> F .\n (fold (\\<lambda>x S.  (S\\<union>(SF x \\<sigma> (L\\<union>{l}\\<union>S) )) ) fieldlist (LS) \n      = LS\\<union> \\<Union>((\\<lambda> x . SF x \\<sigma> (L\\<union>{l}\\<union>F x) ) `(set fieldlist)) \\<and> \n  (\\<forall> n <length fieldlist. \\<forall> l'\\<in>F (fieldlist!n). l'\\<in>LS \\<or> (\\<exists> n'<n . (l'\\<in>SF (fieldlist!n') \\<sigma> (L\\<union>{l}\\<union>F (fieldlist!n')) )) ))))\"\napply (induct_tac fieldlist)\n apply auto\napply (drule_tac x= \"(LS \\<union> SF a \\<sigma> (insert l (L \\<union> LS)) )\" in spec,clarsimp)\napply (rule_tac x=\"F(a:= LS)\" in exI)\napply (auto split: split_if_asm)\napply (case_tac n)\n(*2*)\n apply clarsimp+\napply (drule_tac x=nat in spec,erule impE,blast)\napply (drule_tac x=l' in bspec)\n apply clarsimp\napply auto\napply (drule_tac x=\"Suc n'\" in spec,clarsimp)\ndone\n\nlemma Union_list_unfold_one: \"(\\<Union>n\\<in>{n'. n' < Suc (length list)}. G ((a # list)!n)  n) = (G a 0) \\<union>(\\<Union> n\\<in>{n'. n' <  (length list)}. (G  (list!n)  (Suc n))) \"\napply (subgoal_tac \"{n'. n' < Suc (length list)} = insert 0 {Suc n'| n' . n' < (length list)}\")\napply  clarsimp\napply force\napply rule\napply rule\napply (case_tac x,simp,force)\napply force\ndone\n\nlemma Union_list_unfold_one_generalised[rule_format]: \"N\\<le>(length list)\\<longrightarrow>(\\<Union>n\\<in>{n'. n' < Suc N}. G ((a # list)!n)  n) = (G a 0) \\<union>(\\<Union> n\\<in>{n'. n' <  N}. (G  (list!n)  (Suc n))) \"\napply (subgoal_tac \"{n'. n' < Suc N} = insert 0 {Suc n'| n' . n' < N}\")\n apply force\napply auto\napply (case_tac x,auto)\ndone\n\nlemma SF_fold_to_Union_what_F2[rule_format]: \"\\<forall>LS . ((distinct locationlist)\\<longrightarrow>(\\<exists> F .\n (fold (\\<lambda>x S.  (S\\<union>(SF x \\<sigma> (L\\<union>{l}\\<union>S) )) ) locationlist (LS) \n      = LS\\<union> \\<Union>((\\<lambda> n . SF (locationlist!n) \\<sigma> (L\\<union>{l}\\<union>F n) ) `{n'. n'<length locationlist}) \\<and> \n(F = (\\<lambda>n. if n < length locationlist then \n                  (fold (\\<lambda>l' S.  (S\\<union>(SF l' \\<sigma> (L\\<union>{l}\\<union>S) )) ) \n                                        (take n locationlist) (LS)) else {})))))\"\napply (induct_tac locationlist)\napply auto\napply (case_tac xa)\napply auto\ndone\n\nsubsection{*Properties on locations and stores*}\n\nlemma Referenced_locations_Value_obj[simp]: \"Referenced_locations_Value (ObjRef l) = {l}\"\napply (auto simp: Referenced_locations_Value_def)\ndone\n\n\n\nlemma Referenced_locations_LocationI_Obj[intro]:\n\"\\<sigma> l = Some (Obj (a, b)) \\<Longrightarrow> a x = Some (ObjRef l') \\<Longrightarrow> l'\\<in> Referenced_locations_Location \\<sigma> l\"\napply (auto simp: Referenced_locations_Location_def Referenced_locations_Value_def)\napply (rule_tac x=\"ObjRef l'\" in bexI)\n apply auto\napply (rule ranI,blast)\ndone\n\n\nlemma Referenced_locations_LocationI_ref[intro]:\n\"\\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>  l'\\<in> Referenced_locations_Location \\<sigma> l\"\napply (auto simp: Referenced_locations_Location_def Referenced_locations_Value_def)\ndone\nlemma Well_Formed_StoreD_obj[intro]: \n\"\\<sigma> la = Some (Obj (f, C)) \\<Longrightarrow>  Well_Formed_Store \\<sigma> \\<Longrightarrow> f x = Some (ObjRef l) \\<Longrightarrow>   l \\<in> dom \\<sigma>\"\napply (auto simp: Well_Formed_Store_def )\ndone\n\nlemma Well_Formed_StoreD_ref[intro]: \n\"\\<sigma> la = Some (StoredVal (ObjRef l)) \\<Longrightarrow>  Well_Formed_Store \\<sigma> \\<Longrightarrow> l \\<in> dom \\<sigma>\"\napply (auto simp: Well_Formed_Store_def )\ndone\n\n\nsubsection {* serialization and location renaming *}\n\ncoinductive serialize :: \"Value \\<Rightarrow> Store \\<Rightarrow> Store \\<Rightarrow> bool\"\n(*serialize v \\<sigma> \\<sigma>' is true if all the references pointed recursively by v are in sigma' \n(v refers originally to location in sigma and sigma'should be a subset of sigma) \nNB: one should expect that the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)\nbut in practice there is no rule for the non-accessible part of the store*)\n  where\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (Obj obj) \\<and> (\\<forall> v\\<in> ran(fst(obj)). \\<exists>\\<sigma>''. (serialize v \\<sigma> \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>'))\n     \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (StoredVal v) \\<and>  (serialize v \\<sigma> \\<sigma>')\\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n\n     \"serialize (null) \\<sigma> \\<sigma>' \" \n\n(*lemma serialize_composable_inductive_proof:     \n\"serialize v \\<sigma> \\<sigma>' \\<Longrightarrow> (\\<forall> v \\<sigma> \\<sigma>'. serialize v \\<sigma> \\<sigma>' \\<longrightarrow> Q v \\<sigma> \\<sigma>') \\<Longrightarrow>\n    (\\<And>\\<sigma>' l \\<sigma> obj.\n        \\<sigma>' l = \\<sigma> l \\<and> \\<sigma> l = Some (Obj obj) \\<and> \n          (\\<forall>v\\<in>ran (fst obj). \\<exists>\\<sigma>''. (serialize v \\<sigma> \\<sigma>'' \\<and> P v \\<sigma> \\<sigma>''\\<and> Q v \\<sigma> \\<sigma>'') \\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>') \n              \\<Longrightarrow> P (ObjRef l) \\<sigma> \\<sigma>') \\<Longrightarrow>\n    (\\<And>\\<sigma>' l \\<sigma> v. \\<sigma>' l = \\<sigma> l \\<and> \\<sigma> l = Some (StoredVal v) \\<and> serialize v \\<sigma> \\<sigma>' \\<and> P v \\<sigma> \\<sigma>'\\<and> Q v \\<sigma> \\<sigma>' \n              \\<Longrightarrow> P (ObjRef l) \\<sigma> \\<sigma>') \\<Longrightarrow>\n    (\\<And>\\<sigma> \\<sigma>'. P null \\<sigma> \\<sigma>'\\<and> Q null \\<sigma> \\<sigma>') \\<Longrightarrow> P  v \\<sigma> \\<sigma>'\"\napply (erule serialize.induct,auto)\n apply (subgoal_tac \" (\\<forall>v\\<in>ran a. \\<exists>\\<sigma>''. serialize v \\<sigma> \\<sigma>'' \\<and> P v \\<sigma> \\<sigma>'' \\<and> Q v \\<sigma> \\<sigma>'' \\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>' )\")\n  apply auto\n apply (drule_tac x=v  in bspec,auto)\napply (subgoal_tac \" serialize v \\<sigma> \\<sigma>' \\<and> P v \\<sigma> \\<sigma>' \\<and> Q v \\<sigma> \\<sigma>'\")\n apply auto\ndone\n*)\n\n\n\nsection{* a weaker serialize (for non-WF stores)*}\n(* serialize_weak l \\<sigma> \\<sigma>' does not constraint \\<sigma>' if l points to none \nit will be useful to define more easily properties on the serialisation, especially to reason by recurrence *)\ncoinductive serialize_weak :: \"Value \\<Rightarrow> Store \\<Rightarrow> Store \\<Rightarrow> bool\"\n  where\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (Obj obj) \\<and> (\\<forall> v\\<in> ran(fst(obj)). \\<exists>\\<sigma>''. (serialize_weak v \\<sigma> \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>'))\n     \\<Longrightarrow> (serialize_weak (ObjRef l) \\<sigma> \\<sigma>')\" |\n\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (StoredVal v) \\<and>  (serialize_weak v \\<sigma> \\<sigma>')\\<Longrightarrow> (serialize_weak (ObjRef l) \\<sigma> \\<sigma>')\" |\n\n     \"serialize_weak (null) \\<sigma> \\<sigma>' \" |\n\n(*New : *)\n    \" \\<sigma>(l) =None \\<Longrightarrow> (serialize_weak (ObjRef l) \\<sigma> \\<sigma>')\" \n\nsection{*serialize lemmas*}\n\nlemma format_conj: \"(P\\<and>Q\\<longrightarrow>R) \\<Longrightarrow> (P\\<Longrightarrow>Q\\<Longrightarrow>R)\"\nby simp\n\n\nlemma serialize_substore_result[THEN format_conj,rule_format]: \" serialize v \\<sigma> \\<sigma>' \\<and>\\<sigma>'\\<subseteq>\\<^sub>m  \\<sigma>''\\<longrightarrow>  serialize v \\<sigma> \\<sigma>''\"\napply (intro impI)\napply (erule serialize.coinduct)\napply clarsimp\napply (erule serialize.cases)\napply auto\n(*4*)\n   apply (force simp: map_le_def)\n  apply (clarsimp simp: map_le_def)\n  apply (drule_tac x=v in bspec)\n   apply force\n  apply force\n(*2*)\n apply (rotate_tac -1, erule contrapos_pp,clarsimp)\n  apply (drule_tac x=v in bspec)\n  apply force\n apply clarsimp\n apply (rule_tac x=\\<sigma>'' in exI)\n apply clarsimp\n apply (erule map_le_trans,simp)\napply (force simp: map_le_def)\ndone\n\nlemma serialize_weak_substore_result[THEN format_conj]: \" (serialize_weak v \\<sigma> \\<sigma>' \\<and>\\<sigma>'\\<subseteq>\\<^sub>m  \\<sigma>'')\\<longrightarrow>  serialize_weak v \\<sigma> \\<sigma>''\"\napply (intro impI)\napply (erule serialize_weak.coinduct)\napply clarsimp\napply (erule serialize_weak.cases)\napply auto\n(*4*)\n   apply (force simp: map_le_def)\n  apply (clarsimp simp: map_le_def)\n  apply (drule_tac x=v in bspec)\n   apply force\n  apply force\n(*2*)\n apply (rotate_tac -1, erule contrapos_pp,clarsimp)\n  apply (drule_tac x=v in bspec)\n  apply force\n apply clarsimp\n apply (rule_tac x=\\<sigma>'' in exI)\n apply clarsimp\n apply (erule map_le_trans,simp)\napply (force simp: map_le_def)\ndone\n\nlemma serialize_value: \"serialize (ObjRef l) \\<sigma> \\<sigma>' \\<Longrightarrow> \\<sigma>' l = \\<sigma> l\"\napply (erule serialize.cases)\napply auto\ndone\nlemma serialize_weak_value: \"serialize_weak (ObjRef l) \\<sigma> \\<sigma>' \\<Longrightarrow>l\\<in>dom \\<sigma>\\<Longrightarrow> \\<sigma>' l = \\<sigma> l\"\napply (erule serialize_weak.cases)\napply auto\ndone\n\n\nlemma serialize_weak_substore[THEN format_conj]: \" (serialize_weak v \\<sigma> \\<sigma>' \\<and>\\<sigma>''\\<subseteq>\\<^sub>m  \\<sigma> ) \\<longrightarrow>  serialize_weak v \\<sigma>'' \\<sigma>'\"\napply (intro impI)\napply (erule serialize_weak.coinduct)\napply (case_tac x)\n apply clarsimp\n apply (case_tac \"x2\\<in>dom xa\")\n  apply (subgoal_tac \"xb x2 = \\<sigma> x2\")\n  apply (elim conjE)\n(*6*)\n     apply (erule serialize_weak.cases)\n     apply (clarsimp simp: map_le_def)\n     apply (auto simp: map_le_def)\n(*1*)\napply (rule serialize_weak_value)\n apply (auto simp: map_le_def)\n  apply force\ndone\n\n\nlemma serialize_weak_weaker_intro_pre:\n  \" vv=ObjRef l \\<and>\\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (Obj obj) \\<and> (\\<forall> v\\<in> ((ran(fst(obj)) - {ObjRef l})). \\<exists>\\<sigma>''. (serialize_weak v \\<sigma> \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>'))\n    \\<Longrightarrow> (serialize_weak vv \\<sigma> \\<sigma>')\"\napply (erule serialize_weak.coinduct) \napply (case_tac obj,clarsimp)\napply (case_tac \"v=ObjRef l\")\n apply (rule_tac x= xb in exI,clarsimp+)\ndone\n\n(*no need to iter on self reference when checking serialize(weak) *)\nlemma serialize_weak_weaker_intro:\n\" \\<sigma>(l) = Some (Obj obj) \\<Longrightarrow> \\<sigma>'(l) = \\<sigma>(l) \\<Longrightarrow> (\\<forall> v\\<in> ((ran(fst(obj)) - {ObjRef l})). \\<exists>\\<sigma>''. (serialize_weak v \\<sigma> \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>'))\n    \\<Longrightarrow> (serialize_weak (ObjRef l) \\<sigma> \\<sigma>')\"\nby (rule serialize_weak_weaker_intro_pre,auto)\n\n\n\nlemma serialize_weak_remove_1_unreferenced_pre: \n\"(l\\<in>dom \\<sigma>\\<and>serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>' \\<and>(\\<exists> \\<sigma>''. serialize_weak v \\<sigma> \\<sigma>''\\<and> l\\<notin>dom \\<sigma>''))\\<Longrightarrow>  serialize_weak v \\<sigma> \\<sigma>'\"\napply (erule serialize_weak.coinduct)\napply (case_tac x)\napply clarsimp\napply (elim conjE)\napply (case_tac \"x2=l\")\n(*2 easy when l=x2 *)\n apply (elim exE conjE,simp)\n apply (drule serialize_weak_value,assumption)\n apply clarsimp\n(*1*)\napply (elim exE conjE,simp)\napply (case_tac \"x2\\<in>dom xa\")\n(*2 we eliminate the case x2 in dom xa *)\ndefer\napply force\napply (case_tac \"xa x2\")\n apply force\napply (case_tac a)\n apply (case_tac x1)\n apply simp\n apply (frule serialize_weak_value)\n  apply clarsimp\n apply (intro conjI)\n  apply force\n(*2*)\n apply (intro ballI)\n apply (erule serialize_weak.cases,simp+)\n    apply (erule serialize_weak.cases,simp+)\n(*8*)\n       apply (elim conjE exE)\n       apply (drule_tac x=v in bspec, assumption)\n       apply (drule_tac x=v in bspec, force)\n       apply (elim conjE exE)\n       apply (rule_tac x=\\<sigma>'''''' in exI)\n       apply simp\n       apply (intro disjI1)\n       apply (rule_tac x=\\<sigma>''' in exI)\n       apply simp\n       apply (rule serialize_weak_substore_result)\n(*10*)\n         apply force\n        apply simp+\n(*4*)\n   apply force\n  apply force\n apply force\napply simp\napply (erule serialize_weak.cases)\n   apply auto\napply (erule serialize_weak.cases)\n   apply auto\ndone\n\nlemma serialize_weak_remove_1_unreferenced: \n\"serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>' \\<Longrightarrow>(\\<exists> \\<sigma>''. serialize_weak v \\<sigma> \\<sigma>''\\<and> l\\<notin>dom \\<sigma>'')\\<Longrightarrow>  serialize_weak v \\<sigma> \\<sigma>'\"\napply (case_tac \"l\\<in>dom \\<sigma>\")\napply (rule serialize_weak_remove_1_unreferenced_pre)\napply auto\napply (subgoal_tac \"(\\<sigma> |` (- {l})) = \\<sigma>\")\napply (auto simp: restrict_map_def)\ndone\n\nlemma serialize_weak_remove_1_referenced_pre: \n\"l\\<in>dom \\<sigma>\\<and>serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>' \\<and> serialize_weak (ObjRef l) \\<sigma> \\<sigma>''\\<and>\\<sigma>'\\<subseteq>\\<^sub>m  \\<sigma>1\\<and>\\<sigma>''\\<subseteq>\\<^sub>m  \\<sigma>1\n        \\<Longrightarrow>  serialize_weak v \\<sigma> \\<sigma>1\"\napply (erule serialize_weak.coinduct)\napply (case_tac x)\napply clarsimp\napply (elim conjE)\napply (case_tac \"x2=l\")\n(*2 when l=x2 *)\n apply (frule serialize_weak_value,assumption)\n apply (simp add: map_le_def)\n apply (frule_tac x=l in bspec)\n back\n  apply force\n apply simp\n apply (case_tac \"xa l\")\n  apply (erule serialize_weak.cases,simp+)\n apply (case_tac a)\n  apply (erule serialize_weak.cases,simp+)\n(*6*)\n     apply force\n    apply force\n   apply force\n  apply (erule serialize_weak.cases,simp+)\n(*6*)\n     apply clarsimp\n     apply (drule_tac x=v in bspec, assumption)\n     apply clarsimp\n     apply (rule_tac x=\\<sigma>'''' in exI)\n     apply (force simp: map_le_def)\n    apply force\n   apply force\n  apply force\n apply (erule serialize_weak.cases,simp+)\n(*5*)\n    apply clarsimp\n   apply force\n  apply force\n apply (rule disjI2)\n apply simp\n apply (erule serialize_weak.cases,simp+)\n(*4*)\n   apply (rule disjI2)\n   apply (rule serialize_weak_substore_result,simp+)\n    apply force\n   apply (force simp: map_le_def)\n  apply force\n apply force\n\n(*1*)\napply (case_tac \"x2\\<in>dom xa\")\n(*2 we eliminate the case x2 in dom xa *)\ndefer\napply force\n(*1 else*)\napply (case_tac \"xa x2\")\n apply force\napply (case_tac a)\n apply (case_tac x1)\n apply simp\n apply (frule serialize_weak_value)\n  apply clarsimp\n apply (intro conjI)\n  apply (force simp: map_le_def)\n(*2*)\n apply (intro ballI)\n apply (erule serialize_weak.cases,simp+)\n    apply (erule serialize_weak.cases,simp+)\n(*8*)\n       apply (elim conjE exE)\n       apply (drule_tac x=v in bspec, force)\n       apply (elim conjE exE)\n       apply (rule_tac x=xb in exI)\n       apply (intro conjI)       \n        apply (intro disjI1)\n        apply (intro conjI)       \n(*11*)\n          apply (rule serialize_weak_substore_result,force,assumption)\n          apply force\n         apply (force simp: map_le_def)\n        apply (force simp: map_le_def)\n       apply simp+\n      apply clarsimp\n      apply (drule_tac x=v in bspec, assumption)\n      apply clarsimp\n      apply (rule_tac x=xb in exI)\n      apply (intro conjI)       \n       apply (intro disjI1)\n       apply (intro conjI)       \n(*10*)\n         apply (rule serialize_weak_substore_result,force,assumption,simp)\n         apply clarsimp+\n\n(*1*)\napply (erule serialize_weak.cases)\n   apply auto\napply (erule serialize_weak.cases)\n   apply (auto)\n apply (force  simp: map_le_def)\napply (force  simp: map_le_def)\ndone\n\nlemma serialize_weak_remove_1_referenced: \n\"serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>' \\<Longrightarrow> serialize_weak (ObjRef l) \\<sigma> \\<sigma>''\\<Longrightarrow>\\<sigma>'\\<subseteq>\\<^sub>m  \\<sigma>'''\\<Longrightarrow>\\<sigma>''\\<subseteq>\\<^sub>m  \\<sigma>'''\n        \\<Longrightarrow>  serialize_weak v \\<sigma> \\<sigma>'''\"\napply (case_tac \"l\\<in>dom \\<sigma>\")\napply (rule serialize_weak_remove_1_referenced_pre,simp)\napply (subgoal_tac \"(\\<sigma> |` (- {l})) = \\<sigma>\",simp)\napply (rule serialize_weak_substore_result)\napply (auto simp: restrict_map_def)\ndone\n\nlemma serialize_weak_remove_one_obj_pre: \n\"\\<sigma> l = Some (Obj obj)\\<and>serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>' \\<and> \\<sigma>l\\<subseteq>\\<^sub>m  \\<sigma>' \\<and>\n(\\<forall> v\\<in> ((ran(fst(obj)) - {ObjRef l})). \\<exists>\\<sigma>''. (serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>l)) \\<and>\\<sigma>l l = Some (Obj obj)\n        \\<Longrightarrow>  serialize_weak v \\<sigma> \\<sigma>'\"\napply (erule serialize_weak.coinduct)\napply (case_tac x)\n apply clarsimp\napply (elim conjE)\napply (case_tac \"x2=l\")\n(*2 when l=x2 *)\n apply (clarsimp simp: map_le_def)\n apply (intro conjI,force)\n apply (case_tac obj,clarsimp)\n apply (case_tac \"v=ObjRef l\")\n  apply clarsimp\n  apply (rule_tac x=xb in exI)\n  apply force\n apply (frule_tac x=v in bspec)\n  apply force\n apply (elim exE conjE)\n apply (rule_tac x=\\<sigma>l in exI)\n apply (intro conjI disjI1)\n   apply (rule serialize_weak_substore_result,simp+)\n   apply (clarsimp simp: map_le_def)\n   apply (clarsimp simp: map_le_def)\n   apply (clarsimp simp: map_le_def)\n\n(*1*)\napply (case_tac \"x2\\<in>dom xa\")\n(*2 we eliminate the case x2 in dom xa *)\ndefer\napply force\n(*1 else*)\napply (case_tac \"xa x2\")\n apply force\napply (case_tac a)\n apply (case_tac x1)\n apply simp\n apply (frule serialize_weak_value)\n  apply clarsimp\n apply (intro conjI)\n  apply (clarsimp simp: map_le_def)\n(*2*)\n apply (intro ballI)\n apply (erule serialize_weak.cases,simp+)\n(*5*)\n    apply (elim conjE exE)\n    apply (drule_tac x=v in bspec, force)\n    apply (elim conjE exE)\n    apply (rule_tac x=xb in exI)\n    apply (intro conjI)       \n     apply (intro disjI1)\n     apply (intro conjI)\n(*7*)\n      apply (rule serialize_weak_substore_result,force,force)\n     apply clarsimp+\n\n(*1*)\napply (erule serialize_weak.cases)\n   apply auto\ndone\n\nlemma serialize_weak_remove_one_obj:\n\" \\<sigma>l l = Some (Obj obj)\n        \\<Longrightarrow>\\<sigma> l = Some (Obj obj) \n        \\<Longrightarrow>  serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>'' \n        \\<Longrightarrow> \\<sigma>''\\<subseteq>\\<^sub>m\\<sigma>' \n        \\<Longrightarrow> \\<sigma>l\\<subseteq>\\<^sub>m  \\<sigma>' \n        \\<Longrightarrow> (\\<forall> v\\<in> ((ran(fst(obj)) - {ObjRef l})). \\<exists>\\<sigma>''. (serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>l)) \n            \\<Longrightarrow> serialize_weak v \\<sigma> \\<sigma>'\"\napply (rule_tac \\<sigma>l=\\<sigma>l in serialize_weak_remove_one_obj_pre,(intro conjI,simp)+)\napply (rule serialize_weak_substore_result)\nby auto\n\nlemma serialize_weak_serialize_one_obj:\n\" \\<sigma>l l = Some (Obj obj)\n  \\<Longrightarrow>\\<sigma> l = Some (Obj obj) \n  \\<Longrightarrow> (\\<forall> v\\<in> ((ran(fst(obj)) - {ObjRef l})). \\<exists>\\<sigma>''. (serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>l)) \n      \\<Longrightarrow> serialize_weak (ObjRef l) \\<sigma> \\<sigma>l\"\napply (rule_tac obj=obj in serialize_weak_weaker_intro,simp+)\napply (intro ballI conjI)\napply (rule_tac x=\\<sigma>l in exI)\napply clarsimp\napply (frule_tac x=v in bspec,force)\napply (elim exE conjE)\napply (rule_tac \\<sigma>l=\\<sigma>l in serialize_weak_remove_one_obj,simp+)\ndone\n\nlemma serialize_weak_serialize_one_self_ref_pre:\n\" v= ObjRef l \\<and>\\<sigma> l = Some (StoredVal (ObjRef l)) \\<and> \\<sigma>' l = \\<sigma> l \\<and> \\<sigma> l = Some (StoredVal (ObjRef l)) \\<Longrightarrow>  serialize_weak v \\<sigma>  \\<sigma>'\"\nby (erule serialize_weak.coinduct, auto)\n\nlemma serialize_weak_serialize_one_self_ref:\n\"\\<sigma> l = Some (StoredVal (ObjRef l)) \n  \\<Longrightarrow> \\<sigma>' l = \\<sigma> l \n  \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l)) \n        \\<Longrightarrow>  serialize_weak (ObjRef l) \\<sigma>  \\<sigma>'\"\nby (rule serialize_weak_serialize_one_self_ref_pre, auto)\n\n\nlemma serialize_weak_remove_one_ref_pre: \n\"\\<sigma> l = Some (StoredVal (ObjRef l'))\\<and>serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>' \\<and> \\<sigma>l\\<subseteq>\\<^sub>m  \\<sigma>' \\<and>\n serialize_weak (ObjRef l') (\\<sigma>|` (-{l})) \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>l \\<and>\\<sigma>l l = Some (StoredVal (ObjRef l'))\n        \\<Longrightarrow>  serialize_weak v \\<sigma> \\<sigma>'\"\napply (erule serialize_weak.coinduct)\napply (case_tac x)\n apply clarsimp\napply (elim conjE)\napply (case_tac \"x2=l\")\n(*2 when l=x2 *)\n apply (clarsimp simp: map_le_def)\n apply (intro conjI,force)\n apply (intro conjI disjI1)\n   apply (rule_tac \\<sigma>'1=\\<sigma>'' in serialize_weak_substore_result)\n    apply assumption\n   apply (force simp: map_le_def)\n\n(*1 the rest is similar to the obj case*)\napply (case_tac \"x2\\<in>dom xa\")\n(*2 we eliminate the case x2 in dom xa *)\ndefer\napply force\n(*1 else*)\napply (case_tac \"xa x2\")\n apply force\napply (case_tac a)\n apply (case_tac x1)\n apply simp\n apply (frule serialize_weak_value)\n  apply clarsimp\n apply (intro conjI)\n  apply (clarsimp simp: map_le_def)\n(*2*)\n apply (intro ballI)\n apply (erule serialize_weak.cases,simp+)\n(*5*)\n    apply (elim conjE exE)\n    apply (drule_tac x=v in bspec, force)\n    apply (elim conjE exE)\n    apply (rule_tac x=xb in exI)\n    apply (intro conjI)       \n     apply (intro disjI1)\n     apply (intro conjI)\n(*7*)\n      apply (rule serialize_weak_substore_result,force,force)\n     apply clarsimp+\n\n(*1*)\napply (erule serialize_weak.cases)\n   apply auto\ndone\n\nlemma serialize_weak_remove_one_ref:\n\" \\<sigma>l l = Some (StoredVal (ObjRef l'))\n      \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \n      \\<Longrightarrow> serialize_weak v (\\<sigma>|` (-{l})) \\<sigma>'' \n      \\<Longrightarrow> \\<sigma>''\\<subseteq>\\<^sub>m\\<sigma>' \\<Longrightarrow> \\<sigma>l\\<subseteq>\\<^sub>m  \\<sigma>' \n      \\<Longrightarrow>serialize_weak (ObjRef l') (\\<sigma> |` (- {l})) \\<sigma>l \n            \\<Longrightarrow> serialize_weak v \\<sigma> \\<sigma>'\"\napply (rule_tac \\<sigma>l=\\<sigma>l in serialize_weak_remove_one_ref_pre,(intro conjI,simp)+)\napply (rule serialize_weak_substore_result)\nby auto\n\n\nlemma serialize_weak_serialize_one_ref:\n\" \\<sigma>l l = Some (StoredVal (ObjRef l'))  \\<Longrightarrow> \n  \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>\n serialize_weak (ObjRef l') (\\<sigma>|` (-{l}))  \\<sigma>l \\<Longrightarrow>\n serialize_weak (ObjRef l) \\<sigma> \\<sigma>l\"\napply (rule_tac v=\"ObjRef l'\" in serialize_weak.intros(2),auto)\napply (rule_tac \\<sigma>l=\\<sigma>l and \\<sigma>''=\\<sigma>l in serialize_weak_remove_one_ref,simp+)\ndone\n\nlemma serialize_weak_serialize_pre: \n\"Well_Formed_Store \\<sigma> \\<and>(Referenced_locations_Value v) \\<subseteq> (dom \\<sigma>)\\<and> serialize_weak v \\<sigma> \\<sigma>'\n \\<Longrightarrow> serialize v \\<sigma> \\<sigma>' \"\napply (erule serialize.coinduct)\napply (case_tac x)\napply force\n\napply (simp add: Referenced_locations_Value_def)\napply (elim conjE)\napply (case_tac \"xa x2\")\napply force\napply (case_tac a)\napply (case_tac x1)\n apply (erule serialize_weak.cases,simp+)\n apply clarsimp\n apply (case_tac v,force)\n apply (drule_tac x=v in bspec,force,clarsimp)\n apply (rule_tac x=\\<sigma>'' in exI)\n apply (intro conjI disjI1)\n apply (simp add: ran_def)\n apply (elim exE)\n apply (erule Well_Formed_StoreD_obj,simp+)\n\n apply (erule serialize_weak.cases,simp+)\n apply (case_tac x2a,force,simp)\n apply (rule disjI1)\n apply (rule Well_Formed_StoreD_ref)\n apply auto\ndone\n\ntheorem serialize_weak_serialize: \n\"Well_Formed_Store \\<sigma> \n  \\<Longrightarrow>(Referenced_locations_Value v) \\<subseteq> (dom \\<sigma>) \n  \\<Longrightarrow> serialize_weak v \\<sigma> \\<sigma>'\n \\<Longrightarrow> serialize v \\<sigma> \\<sigma>' \"\nby (rule serialize_weak_serialize_pre,auto)\n\nsection {* serialization filter*}\n\nfunction (sequential) serialization_filter :: \"Location \\<Rightarrow> Store \\<Rightarrow> Location set \\<Rightarrow> Location set\"\n(*serialization_filter v \\<sigma> L  is the set of locations that are recursively referenced by the value v\n  locations in L are EXCLUDED from the set (to prevent non-termination in case of reference loop) *)\n  where\n    \"\n    (serialization_filter l \\<sigma> L) = (if l\\<in>L then {} else\n      (case \\<sigma>(l) of\n      None \\<Rightarrow>{} |\n      Some (Obj obj) \\<Rightarrow> {l}\\<union>\\<Union>( (\\<lambda>x.(serialization_filter x \\<sigma> (L\\<union>{l}))) \n                `( (\\<Union>(Referenced_locations_Value`ran(fst(obj)))))) |\n      Some (StoredVal (ObjRef l')) \\<Rightarrow>{l}\\<union> (serialization_filter l' \\<sigma> (L\\<union>{l}))|\n      _ \\<Rightarrow> {l}))\" \nby auto\ntermination \napply (relation \"measure (\\<lambda>(l,\\<sigma>,L). card (dom \\<sigma> - L))\") \n  apply auto\n apply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \n  apply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\n(*4*)\n   apply (drule_tac x=l in Finite_Set.card.remove)+\n    apply (insert finite_map)\n    apply auto\n(*1*)\napply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \n apply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\n  apply (drule_tac x=l in Finite_Set.card.remove)+\n   apply (insert finite_map)\n   apply auto\ndone\n\nabbreviation serialize_filter:: \"Location \\<Rightarrow> Store \\<Rightarrow> Store\" \n(* a second definition of serialisation based on the serialisation filter: \nsigma' is exactly the store captured by the algorithm (the smallest necessary sub-store *)\nwhere\n\"serialize_filter l \\<sigma> \\<equiv>  \\<sigma> |` serialization_filter l \\<sigma> {}\" \n\n(* intermediary lemma for serialization_filter1*)\nlemma SFI1SG1: \"(\\<And>a b. l \\<notin> L \\<Longrightarrow>\n               \\<sigma> l = Some (Obj (a, b)) \\<Longrightarrow>\n               \\<forall>x\\<in>\\<Union>(Referenced_locations_Value ` ran a). P (serialization_filter x \\<sigma> (L \\<union> {l})) x \\<sigma> (L \\<union> {l}) \\<Longrightarrow>\n               P ({l} \\<union> \\<Union>((\\<lambda>x. serialization_filter x \\<sigma> (L \\<union> {l})) ` \\<Union>(Referenced_locations_Value ` ran a))) l \\<sigma> L) \\<Longrightarrow>\n       ((\\<sigma> l=None \\<or>l\\<in>L)\\<longrightarrow>P {} l \\<sigma> L) \\<Longrightarrow>\n        (\\<And>x2 prod x.\n           l \\<notin> L \\<Longrightarrow>\n           \\<sigma> l = Some x2 \\<Longrightarrow>\n           x2 = Obj prod \\<Longrightarrow>\n           x \\<in> \\<Union>(Referenced_locations_Value ` ran (fst prod)) \\<Longrightarrow> P (serialization_filter x \\<sigma> (L \\<union> {l})) x \\<sigma> (L \\<union> {l})) \\<Longrightarrow>\n        \\<sigma> l = Some a \\<Longrightarrow> a = Obj prod \\<Longrightarrow> P (serialization_filter l \\<sigma> L) l \\<sigma> L\"\n(* intermediary lemma *)\napply (case_tac prod)\napply clarsimp\napply blast\ndone\n(* intermediary lemma for serialization_filter1 and 1B*)\nlemma  SFI1SG2:\"(\\<And>x2 v nat.\n           l \\<notin> L \\<Longrightarrow>\n           \\<sigma> l = Some x2 \\<Longrightarrow>\n           x2 = StoredVal v \\<Longrightarrow> v = ObjRef nat \\<Longrightarrow> P (serialization_filter nat \\<sigma> (L \\<union> {l})) nat \\<sigma> (L \\<union> {l})) \\<Longrightarrow>\n     (\\<And>l'. l \\<notin> L \\<Longrightarrow>\n              \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>\n              P (serialization_filter l' \\<sigma> (L \\<union> {l})) l' \\<sigma> (L \\<union> {l}) \\<Longrightarrow> P ({l} \\<union> serialization_filter l' \\<sigma> (L \\<union> {l})) l \\<sigma> L) \\<Longrightarrow>\n  \\<sigma> l = Some a \\<Longrightarrow>  ((\\<sigma> l=None \\<or>l\\<in>L)\\<longrightarrow>P {} l \\<sigma> L)\\<Longrightarrow>a = StoredVal (ObjRef l') \\<Longrightarrow> P (serialization_filter l \\<sigma> L) l \\<sigma> L\n  \"\napply clarsimp\ndone\n\n(* INDUCTION PRINCIPLES on Filtering \n1 - is with an additional variable for the induction set (often useful)\n1B - the same as 1 but weaker on the recurrence hypothesis taking into acccount that the current loc l is filtered\n2 - is the most natural one\n*)\nlemma serialization_filter1: \"   \n(\\<And>l \\<sigma> L. \\<sigma> l=None\\<or>l\\<in>L \\<longrightarrow> P {} l \\<sigma> L) \\<Longrightarrow> \n(\\<And>l \\<sigma> L V. l\\<notin>L \\<Longrightarrow>  \\<sigma> l = Some (StoredVal V) \\<Longrightarrow>isnotObjRef V \\<Longrightarrow>P {l} l \\<sigma> L) \\<Longrightarrow> \n(\\<And>l \\<sigma> L f C.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (Obj (f,C)) \\<Longrightarrow> \n           (\\<forall> x\\<in>\\<Union>(Referenced_locations_Value`(ran f)). \n                          P (serialization_filter x \\<sigma> (L\\<union>{l})) x \\<sigma> (L\\<union>{l})) \\<Longrightarrow>\n            P ({l}\\<union>(\\<Union> ((\\<lambda> x. serialization_filter x \\<sigma> (L \\<union> {l}))` \\<Union>(Referenced_locations_Value`ran(f))))) l \\<sigma> L)  \\<Longrightarrow>\n(\\<And>l \\<sigma> L l'.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> \n           (P (serialization_filter l' \\<sigma> (L\\<union>{l})) l' \\<sigma>  (L\\<union>{l}))\\<Longrightarrow>\n           (P ({l}\\<union>(serialization_filter l' \\<sigma> (L\\<union>{l}))) l \\<sigma> L))         \\<Longrightarrow>   \n   P (serialization_filter l' \\<sigma>' L') l' \\<sigma>' L'\"\napply (rule serialization_filter.induct)\napply (rotate_tac 1,drule_tac x=l in meta_spec)+\napply (rotate_tac -1,drule_tac x=\\<sigma> in meta_spec)+\napply (rotate_tac -1,drule_tac x=L in meta_spec)+\napply (case_tac \"\\<sigma> l\")\n(*2*)\n apply force\napply (case_tac a)\n apply (erule SFI1SG1,simp,simp,simp,simp)\napply (rename_tac val)\napply (case_tac val)\n apply force\napply (erule SFI1SG2,simp+)\ndone\n\n(* intermediary lemma for serialization_filter1B*)\nlemma SFI1SG1B: \"(\\<And>a b. l \\<notin> L \\<Longrightarrow>\n               \\<sigma> l = Some (Obj (a, b)) \\<Longrightarrow>\n               \\<forall>x\\<in>\\<Union>(Referenced_locations_Value ` ran a)-{l}. P (serialization_filter x \\<sigma> (L \\<union> {l})) x \\<sigma> (L \\<union> {l}) \\<Longrightarrow>\n               P ({l} \\<union> \\<Union>((\\<lambda>x. serialization_filter x \\<sigma> (L \\<union> {l})) ` (\\<Union>(Referenced_locations_Value ` ran a)-{l}))) l \\<sigma> L) \\<Longrightarrow>\n       (\\<And>l \\<sigma> L.(\\<sigma> l=None \\<or>l\\<in>L)\\<longrightarrow>P {} l \\<sigma> L) \\<Longrightarrow>\n        (\\<And>x2 prod x.\n           l \\<notin> L \\<Longrightarrow>\n           \\<sigma> l = Some x2 \\<Longrightarrow>\n           x2 = Obj prod \\<Longrightarrow>\n           x \\<in> \\<Union>(Referenced_locations_Value ` ran (fst prod))-{l} \\<Longrightarrow> P (serialization_filter x \\<sigma> (L \\<union> {l})) x \\<sigma> (L \\<union> {l})) \\<Longrightarrow>\n        \\<sigma> l = Some a \\<Longrightarrow> a = Obj prod \\<Longrightarrow> P (serialization_filter l \\<sigma> L) l \\<sigma> L\"\napply (case_tac prod)\napply clarsimp\napply (subgoal_tac \"(insert l (\\<Union>x\\<in>((\\<Union>x\\<in>ran aa. Referenced_locations_Value x) - {l}) \\<inter> {x. x \\<noteq> l \\<and> x \\<notin> L}.\n                                     case \\<sigma> x of None \\<Rightarrow> {} | Some (Obj obj) \\<Rightarrow> {x} \\<union> \\<Union>((\\<lambda>xa. serialization_filter xa \\<sigma> (insert l L \\<union> {x})) ` \\<Union>(Referenced_locations_Value ` ran (fst obj))) | Some (StoredVal null) \\<Rightarrow> {x}\n                                     | Some (StoredVal (ObjRef l')) \\<Rightarrow> {x} \\<union> serialization_filter l' \\<sigma> (insert l L \\<union> {x})))\n =\n(insert l (\\<Union>x\\<in>(\\<Union>x\\<in>ran aa. Referenced_locations_Value x) \\<inter> {x. x \\<noteq> l \\<and> x \\<notin> L}.\n                                       case \\<sigma> x of None \\<Rightarrow> {} | Some (Obj obj) \\<Rightarrow> {x} \\<union> \\<Union>((\\<lambda>xa. serialization_filter xa \\<sigma> (insert l L \\<union> {x})) ` \\<Union>(Referenced_locations_Value ` ran (fst obj))) | Some (StoredVal null) \\<Rightarrow> {x}\n                                       | Some (StoredVal (ObjRef l')) \\<Rightarrow> {x} \\<union> serialization_filter l' \\<sigma> (insert l L \\<union> {x})))\")\ndefer\napply blast\napply (subgoal_tac \n    \"\\<And>A. ((A - {l}) \\<inter> {x. x \\<noteq> l \\<and> x \\<notin> L}) = (A \\<inter> {x. x \\<noteq> l \\<and> x \\<notin> L})\")\napply auto\ndone\n\nlemma serialization_filter1B: \"   \n(\\<And>l \\<sigma> L. (\\<sigma> l=None\\<or>l\\<in>L) \\<longrightarrow> P {} l \\<sigma> L) \\<Longrightarrow> \n(\\<And>l \\<sigma> L V. l\\<notin>L \\<Longrightarrow>  \\<sigma> l = Some (StoredVal V) \\<Longrightarrow>isnotObjRef V \\<Longrightarrow>P {l} l \\<sigma> L) \\<Longrightarrow> \n(\\<And>l \\<sigma> L f C.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (Obj (f,C)) \\<Longrightarrow> \n           (\\<forall> x\\<in>\\<Union>(Referenced_locations_Value`(ran f))-{l}. \n                          P (serialization_filter x \\<sigma> (L\\<union>{l})) x \\<sigma> (L\\<union>{l})) \\<Longrightarrow>\n            P ({l}\\<union>(\\<Union> ((\\<lambda> x. serialization_filter x \\<sigma> (L \\<union> {l}))` (\\<Union>(Referenced_locations_Value`ran(f))-{l})))) l \\<sigma> L)  \\<Longrightarrow>\n(\\<And>l \\<sigma> L l'.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> \n           (P (serialization_filter l' \\<sigma> (L\\<union>{l})) l' \\<sigma>  (L\\<union>{l}))\\<Longrightarrow>\n           (P ({l}\\<union>(serialization_filter l' \\<sigma> (L\\<union>{l}))) l \\<sigma> L))         \\<Longrightarrow>   \n   P (serialization_filter l' \\<sigma>' L') l' \\<sigma>' L'\"\napply (rule serialization_filter.induct)\napply (case_tac \"\\<sigma> l\")\n(*2 CASE None*)\n apply force\napply (case_tac a)\n(*2 case obj *)\n apply (rule SFI1SG1B,clarsimp,simp)\n(*4*)\n   apply ((rotate_tac 1,drule_tac x=l in meta_spec)+,(rotate_tac -1,drule_tac x=\\<sigma> in meta_spec)+,(rotate_tac -1,drule_tac x=L in meta_spec)+)\n   apply blast\n  apply ((rotate_tac 1,drule_tac x=l in meta_spec)+,(rotate_tac -1,drule_tac x=\\<sigma> in meta_spec)+,(rotate_tac -1,drule_tac x=L in meta_spec)+)\n  apply blast\n apply ((rotate_tac 1,drule_tac x=l in meta_spec)+,(rotate_tac -1,drule_tac x=\\<sigma> in meta_spec)+,(rotate_tac -1,drule_tac x=L in meta_spec)+)\n apply blast\napply ((rotate_tac 1,drule_tac x=l in meta_spec)+,(rotate_tac -1,drule_tac x=\\<sigma> in meta_spec)+,(rotate_tac -1,drule_tac x=L in meta_spec)+)\n(* CASE StoredVal*)\napply (case_tac x2)\n apply simp\napply (erule SFI1SG2,simp+)\ndone\n\nlemma serialization_filter2: \"   (\\<And>l \\<sigma> L. P {} ) \\<Longrightarrow> (* NOT USED FOR THE MOMENT *)\n(\\<And>l \\<sigma> L V.  l\\<notin>L \\<Longrightarrow> \\<sigma> l = Some (StoredVal V) \\<Longrightarrow>isnotObjRef V \\<Longrightarrow>P {l} ) \\<Longrightarrow> \n(\\<And>l \\<sigma> L f C.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (Obj (f,C)) \\<Longrightarrow> \n           (\\<forall> x\\<in>\\<Union>(Referenced_locations_Value`(ran f)). P (serialization_filter x \\<sigma> (L\\<union>{l})) ) \\<Longrightarrow>\n           P ({l}\\<union>(\\<Union> ((\\<lambda> x. serialization_filter x \\<sigma> (L \\<union> {l}))` \\<Union>(Referenced_locations_Value`ran(f))))) )   \\<Longrightarrow> \n(\\<And>l \\<sigma> L l'.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> \n           (P (serialization_filter l' \\<sigma> (L\\<union>{l})) )\\<Longrightarrow>\n           (P ({l}\\<union>(serialization_filter l' \\<sigma> (L\\<union>{l}))))) \n  \\<Longrightarrow>    \n   P (serialization_filter l \\<sigma> L) \"\napply (insert  serialization_filter1 [of \"(\\<lambda> S l \\<sigma> L. (P S))\" ])\napply auto\ndone\n\nsection{* Serialization filter lemmas*}\nlemma serialization_filter_subset: \"serialization_filter l \\<sigma> L \\<subseteq> dom \\<sigma>\"\napply (rule_tac P= \"\\<lambda> S l \\<sigma> L. (S \\<subseteq> dom \\<sigma>)\" in   serialization_filter1)\n   apply auto\napply (drule_tac x=xb in bspec)\n apply auto\napply (drule_tac x=xa in bspec)\n apply (auto split: option.splits )\ndone\n\nlemma serialize_filter_subset: \"dom (serialize_filter l \\<sigma>) \\<subseteq> dom \\<sigma>\"\napply (insert serialization_filter_subset, auto)\ndone\n\nlemma serialize_filter_value: \"(serialize_filter l \\<sigma>) l' = Some x \\<Longrightarrow> \\<sigma> l' = Some x\"\napply (subgoal_tac \"l'\\<in>(serialization_filter l \\<sigma> {})\")\n apply (drule_tac m=\\<sigma> in Map.restrict_in)\n apply force\napply (rule Map_restrict_Some,blast)\ndone\n\nlemma Serialization_excluded_set_subset[rule_format]: \n\"\\<forall> L . L\\<subseteq>L' \\<longrightarrow> serialization_filter l \\<sigma> L' \\<subseteq> serialization_filter l \\<sigma> L\"\napply (rule_tac P= \"\\<lambda> S l \\<sigma> L'. (\\<forall>L. L\\<subseteq>L' \\<longrightarrow> S \\<subseteq> serialization_filter l \\<sigma> L)\" in   serialization_filter1)\n(*4*)\n   apply clarsimp\n  apply (clarsimp split: Value.splits)\n  apply blast\n apply clarsimp\n apply rule\n  apply blast\n apply clarsimp\n apply (drule_tac x=xb in bspec,blast) \n apply (rotate_tac -1,drule_tac x=xa in bspec,blast) \n apply clarsimp\n apply (drule_tac x=\"insert l La\" in spec)\n apply clarsimp \n apply (erule impE, blast)\n apply (drule_tac x=xa in bspec,blast) \n apply (case_tac \"xa\\<in>La\")\n(*3*)\n  apply clarsimp\n apply clarsimp\n apply blast\napply (intro impI allI)\napply (drule_tac x=\"La \\<union> {l}\" in spec)\napply auto\ndone\n\nlemma serialization_filter_dom_subset_pre[rule_format]: \n          \"\\<forall> \\<sigma>' v. (serialize v \\<sigma> \\<sigma>' \\<longrightarrow> (v=ObjRef l \\<longrightarrow> serialization_filter l \\<sigma> L \\<subseteq> dom \\<sigma>'))\"\napply (rule_tac P= \"\\<lambda> S l \\<sigma> L. \\<forall> \\<sigma>' v. (serialize v \\<sigma> \\<sigma>' \\<longrightarrow> (v=ObjRef l \\<longrightarrow> S \\<subseteq> dom \\<sigma>'))\" in   serialization_filter1)\n(*4*)\n   apply force\n  apply clarsimp\n  apply (erule serialize.cases,simp,simp,simp)\n apply clarsimp\n apply (intro conjI)\n  apply (drule serialize_value)\n  apply force\n apply clarsimp\n apply (drule_tac x=xb in bspec,assumption)\n apply (drule_tac x=xa in bspec,assumption)\n apply (drule_tac x=\\<sigma>' in spec)\n apply clarsimp\n apply (case_tac xb)\n(*3 null*)\n  apply (clarsimp simp: Referenced_locations_Value_def)\n(*2 objref*)\n apply clarsimp\n apply (erule impE)\n  apply (erule serialize.cases,clarsimp)\n    apply (drule_tac x=\"ObjRef x2\" in bspec,assumption)\n    apply clarsimp+\n    apply (rule serialize_substore_result)\n  apply simp+\n(*2*)\n apply force\napply clarsimp\napply (intro conjI)\n(*3*)  \n  apply clarsimp\n  apply (drule serialize_value,force)\n apply clarsimp\n apply (drule serialize_value,force)\n(*1*)\napply clarsimp\napply (intro conjI) \n apply (drule serialize_value,force)\napply clarsimp\napply (drule_tac x=\\<sigma>' in spec)\napply (erule impE)\n apply (erule serialize.cases)\napply auto\ndone\n\nlemma serialization_filter_dom_subset: \n  \"serialize (ObjRef l) \\<sigma> \\<sigma>' \\<Longrightarrow>  serialization_filter l \\<sigma> L \\<subseteq> dom \\<sigma>' \"\nby (drule serialization_filter_dom_subset_pre[of \"ObjRef l\" \\<sigma> \\<sigma>'],auto)\n\nlemma serialization_filter_coincide_val_pre[rule_format,elim]: (* VERY SIMILAR TO LEMMA dom_subset_pre*)\n\"\\<forall> \\<sigma>' v l'.(serialize v \\<sigma> \\<sigma>' \\<longrightarrow> (v=ObjRef x2 \\<longrightarrow> l'\\<in>serialization_filter x2 \\<sigma> L \\<longrightarrow> \\<sigma> l' = \\<sigma>' l'))\"\napply (rule_tac P= \"\\<lambda> S l \\<sigma> L. \\<forall> \\<sigma>' v l'. (serialize v \\<sigma> \\<sigma>' \\<longrightarrow> (v=ObjRef l \\<longrightarrow> l'\\<in>S \\<longrightarrow> \\<sigma> l' = \\<sigma>' l'))\" in   serialization_filter1)\n apply clarsimp\n  apply clarsimp\n  apply (erule serialize.cases,simp,simp,simp)\n apply clarsimp\n apply (intro conjI)\n  apply (drule serialize_value)\n apply clarsimp\n\n apply clarsimp\n apply (drule_tac x=xa in bspec,assumption)\n apply (drule_tac x=x in bspec,assumption)\n apply (drule_tac x=\\<sigma>' in spec)\n apply clarsimp\n apply (case_tac xa)\n(*3 null*)\n  apply (clarsimp simp: Referenced_locations_Value_def)\n(*2 objref*)\n apply clarsimp\n apply (erule impE)\n  apply (erule serialize.cases,clarsimp)\n    apply (drule_tac x=\"ObjRef x2\" in bspec,assumption)\n    apply clarsimp\n    apply (rule serialize_substore_result)\n     apply simp+\n apply (intro conjI)\n(*3*)  \n  apply clarsimp\n  apply (drule serialize_value,force)\n apply clarsimp\n apply (drule serialize_value,force)\n(*1*)\napply clarsimp\napply (intro conjI) \n apply (drule serialize_value,force)\napply clarsimp\napply (drule_tac x=\\<sigma>' in spec)\napply (erule impE)\n apply (erule serialize.cases)\n   apply auto\ndone\n\nlemma serialization_filter_coincide_val: \n  \"serialize v \\<sigma> \\<sigma>' \\<Longrightarrow> (\\<forall> L. case v of ObjRef l \\<Rightarrow> l'\\<in>serialization_filter l \\<sigma> L \\<longrightarrow> \\<sigma>' l' = \\<sigma> l' | null \\<Rightarrow> True) \"\nby( auto split: Value.splits,drule serialization_filter_coincide_val_pre,auto)\n\nlemma serialization_filter_origin: \"\\<sigma> l = Some y\\<Longrightarrow>l\\<in> serialization_filter l \\<sigma> {}\"\nby (auto split: Storable.splits Value.splits option.splits)\n\n\n\n\nsection{*serialization filter well formed*}\nlemma serialization_filter_WF_1step_obj[rule_format]: \n  \"l\\<in>serialization_filter l'' \\<sigma> L \\<longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<longrightarrow>  a x = Some (ObjRef l') \n        \\<longrightarrow>Well_Formed_Store \\<sigma>\\<longrightarrow>  l'\\<in>L\\<or>l'\\<in>serialization_filter l'' \\<sigma> L \"\napply (rule_tac P= \n\"\\<lambda> S l'' \\<sigma> L. l\\<in>S \\<longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<longrightarrow>  a x = Some ( ObjRef l')   \\<longrightarrow>Well_Formed_Store \\<sigma>\n\\<longrightarrow>   l'\\<in>L\\<or>l'\\<in>S\" in   serialization_filter1)\n(*4*)\n   apply force\n  apply clarsimp\n apply (case_tac \"l'=la\")\n  apply simp\n apply (case_tac \"l=la\")\n  apply clarsimp\n  apply (drule_tac x=\"( ObjRef l')\" in bspec)\n   apply (rule ranI)\n   apply blast\n  apply (drule_tac x=l' in bspec,simp,simp)\n  apply (auto split: split_if_asm )\n(*2*)\n apply (drule_tac x=l' in bspec,simp)\n  apply (rule_tac x=\"( ObjRef l')\" in bexI)\n  apply simp\n  apply (rule ranI,simp)\n apply (clarsimp split: option.splits Storable.splits simp: Well_Formed_Store_def)\n  apply (drule_tac x=l in bspec,blast)\n  apply (drule Referenced_locations_LocationI_Obj, simp+)\n  apply force\n(*2*)\n apply (simp split: Value.splits)\napply (drule_tac x=l' in bspec,simp)\n apply (rule_tac x=\"( ObjRef l')\" in bexI)\n  apply simp\n apply (rule ranI,simp)\napply auto\ndone\n\nlemma serialization_filter_WF_1step_ref[rule_format]: \n  \"l\\<in>serialization_filter l'' \\<sigma> L \\<longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \n        \\<longrightarrow>Well_Formed_Store \\<sigma>\\<longrightarrow>  l'\\<in>L\\<or>l'\\<in>serialization_filter l'' \\<sigma> L \"\napply (rule_tac P= \"\\<lambda> S l'' \\<sigma> L. l\\<in>S \\<longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \n        \\<longrightarrow>Well_Formed_Store \\<sigma>\\<longrightarrow>  l'\\<in>L\\<or>l'\\<in>S\" in   serialization_filter1)\n   apply force\n  apply clarsimp\n(*2*)\n apply (case_tac \"l'=la\")\n  apply simp\n apply (case_tac \"l=la\")\n  apply clarsimp\n apply clarsimp\n apply (auto split: split_if_asm )\napply (clarsimp split: option.splits Storable.splits simp: Well_Formed_Store_def)\n(*2*)\n apply (drule_tac x=l in bspec,blast)\n apply (drule Referenced_locations_LocationI_ref)\n apply force\napply (simp split: Value.splits)\ndone\n\nlemma Serialization_WF: \"Well_Formed_Store \\<sigma> \\<Longrightarrow> Well_Formed_Store (serialize_filter l \\<sigma>)\"\napply (unfold Well_Formed_Store_def)\napply (intro ballI)\napply (fold Well_Formed_Store_def)\napply (subgoal_tac \" la \\<in> dom \\<sigma>\")\n apply (case_tac \"\\<sigma> la\")\n  apply blast\n apply rule\n apply (unfold Referenced_locations_Location_def)\n(*2*)\n apply (case_tac  \"serialize_filter l \\<sigma> la\")\n  apply blast\n apply (drule serialize_filter_value)\n apply (subgoal_tac \"a=aa\")\n  apply clarify\n  apply (case_tac aa,rename_tac obj')\n  apply (case_tac obj')\n   apply (frule serialize_filter_value)\n   apply  clarsimp\n   apply (subgoal_tac \"serialize_filter l \\<sigma> la = Some (Obj (ab, ba))\")\n(*5*)\n    apply clarsimp\n    apply (simp add: ran_def Referenced_locations_Value_def,clarify)\n    apply (subgoal_tac \"la\\<in>serialization_filter l \\<sigma> {}\")\n     apply (drule serialization_filter_WF_1step_obj,simp, force split: Value.splits)\n       apply (simp split: Value.splits,simp)\n     apply (simp split: Value.splits)\n     apply (drule Well_Formed_StoreD_obj,simp,simp)\n     apply blast\n    apply (rule Map_restrict_Some,force)\n   apply simp\n  apply (frule serialize_filter_value)\n  apply simp\n(*3*)\n  apply (subgoal_tac \"la\\<in>serialization_filter l \\<sigma> {}\")\n   apply (drule serialization_filter_WF_1step_ref,simp, simp split: Value.splits,simp,simp)\n   apply (simp split: Value.splits)\n   apply (drule Well_Formed_StoreD_ref,simp)\n   apply blast\n(*3*)\n  apply (rule Map_restrict_Some,force)\n apply force\napply (insert serialize_filter_subset[of \\<sigma> l])\napply blast\ndone\n\nsection{*serialization filter VS serialize*}\n\ntheorem serializationfilter_smallest_serialize: \"serialize (ObjRef l) \\<sigma> \\<sigma>' \\<Longrightarrow> (serialize_filter l \\<sigma>) \\<subseteq>\\<^sub>m \\<sigma>'\"\napply (rule map_le_eq)\n apply (frule serialization_filter_dom_subset[of l \\<sigma> \\<sigma>' \"{}\"])\n apply force\napply rule\napply (frule_tac l'=x in serialization_filter_coincide_val)\napply (drule_tac x=\"{}\" in spec)\napply (auto simp: restrict_map_def)\ndone\n\n\n\nlemma serialization_filter_verifies_serialize_weak_axiomatic_def: \n   \"serialize_weak (ObjRef l) (\\<sigma>|` (-L)) (\\<sigma> |` serialization_filter l \\<sigma> L)\"\napply (rule_tac P=\"\\<lambda> S l \\<sigma> L. serialize_weak  (ObjRef l) (\\<sigma>|` (-L)) (\\<sigma> |` serialization_filter l \\<sigma> L)\"\n            in serialization_filter1B)\n(*4 None*)\n   apply clarify\n   apply (rule serialize_weak.intros(4))\n   apply (force simp: restrict_map_def)\n(*3 notobjref*)\n  apply (case_tac V)\n   apply (rule_tac v=\"null\" in serialize_weak.intros(2),clarsimp)  \n   apply (rule serialize_weak.intros(3))\n  apply (force)\n\n(*2 obj*)\n apply (rule serialize_weak_serialize_one_obj,simp,simp)\n apply (intro ballI)\n apply (case_tac v)\n  apply (rule_tac x=empty in exI)\n  apply clarsimp\n  apply (rule serialize_weak.intros)\n apply (drule_tac x=x2 in bspec)\n  apply force\n apply (rule_tac x=\"(\\<sigma> |` (if x2 \\<in> L then {}\n                          else case \\<sigma> x2 of None \\<Rightarrow> {} | Some (Obj obj) \\<Rightarrow> {x2} \\<union> \\<Union>((\\<lambda>x. serialization_filter x \\<sigma> (insert l L \\<union> {x2})) ` \\<Union>(Referenced_locations_Value ` ran (fst obj))) | Some (StoredVal null) \\<Rightarrow> {x2}\n                               | Some (StoredVal (ObjRef l')) \\<Rightarrow> {x2} \\<union> serialization_filter l' \\<sigma> (insert l L \\<union> {x2})))\" in exI)\n apply clarsimp\n  apply (subgoal_tac \" (\\<sigma> |` (- insert l L)) = (\\<sigma> |` (- L \\<inter> - {l}))\")\n  apply (intro conjI impI)\n(*5*)\n    apply (rule serialize_weak.intros(4),force)\n   apply clarsimp\n  apply (force simp: map_le_def Map.restrict_map_def)\n apply (force simp: Map.restrict_map_def)\n\n(*1 ref*)\napply (rule serialize_weak_serialize_one_ref,simp+)\napply (intro conjI)\n  apply clarsimp\n  apply (rule serialize_weak.intros(4),force)\n apply clarsimp\n apply (rule serialize_weak.intros(4),force)\napply clarsimp\napply (subgoal_tac \" (\\<sigma> |` (- insert l L)) = (\\<sigma> |` (- L \\<inter> - {l}))\")\n apply clarsimp\n apply (rule serialize_weak_substore_result,simp)\n apply (force simp: map_le_def )\napply (force simp: Map.restrict_map_def)\ndone\n\ntheorem serialization_filter_verifies_serialize_axiomatic_def: \n\"Well_Formed_Store \\<sigma> \\<Longrightarrow> l\\<in>dom \\<sigma> \n    \\<Longrightarrow> serialize (ObjRef l) \\<sigma> (serialize_filter l \\<sigma>)\"\napply (subgoal_tac \"serialize_weak (ObjRef l) (\\<sigma>|`(-{})) (\\<sigma>|` (serialization_filter l \\<sigma> {}))\")\n apply (erule serialize_weak_serialize,simp,simp add: Map.restrict_map_def)\napply (rule serialization_filter_verifies_serialize_weak_axiomatic_def)\ndone\n\nsection{*renaming*}\n\nprimrec subst_Value :: \" Value \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Value\"\nwhere\n  \"subst_Value (ObjRef l) \\<psi> = ObjRef (\\<psi>(l))\" |\n  \"subst_Value (null) \\<psi> = null\" \n\ndefinition check_subst :: \"Store \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Store \\<Rightarrow> bool\"\nwhere\n  \"check_subst  \\<sigma> \\<psi> \\<sigma>' \\<equiv>\n    ( inj \\<psi> \\<and> dom \\<sigma>' =  \\<psi> ` (dom(\\<sigma>)) \n    \\<and> (\\<forall> f C l . (\\<sigma>(l) = Some (Obj (f,C))  \n      \\<longrightarrow> (\\<exists> f' C'. (\\<sigma>'(\\<psi>(l)) = Some (Obj (f',C')) \\<and> dom f= dom f'\n      \\<and>(\\<forall> x  v. (f x = Some v) \\<longrightarrow> (f' x=Some (subst_Value v \\<psi>))))))\n    \\<and>   (\\<forall> v l . (\\<sigma>(l) = Some (StoredVal v) \\<longrightarrow> \n      \\<sigma>'(\\<psi>(l)) = Some (StoredVal (subst_Value v \\<psi>))))))\"\n\n\n\nlemma \"check_subst \\<sigma> \\<psi> \\<sigma>' \\<Longrightarrow> (\\<forall> l \\<in> dom \\<sigma>. \\<exists> l' \\<in> dom \\<sigma>'. l'= \\<psi>(l))\"\napply (auto simp: check_subst_def)\ndone\n\nlemma subst_dom: \"check_subst \\<sigma> \\<psi> \\<sigma>' \\<Longrightarrow> \\<psi> ` (dom \\<sigma>) \\<subseteq> dom \\<sigma>'\"\napply (auto simp: check_subst_def)\ndone\n\nlemma subst_ref_dom: \" \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>check_subst \\<sigma> \\<psi> \\<sigma>' \\<Longrightarrow> (l' \\<in> dom \\<sigma>) \\<Longrightarrow> \\<psi>(l') \\<in> dom \\<sigma>'\"\napply (auto simp: check_subst_def)\ndone\n\nlemma subst_follow_ref: \n\"check_subst \\<sigma> \\<psi> \\<sigma>' \\<Longrightarrow> \n        \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>  (l' \\<in> dom \\<sigma>) \\<Longrightarrow>\n        \\<sigma>' l'' = Some (StoredVal (ObjRef l''')) \\<Longrightarrow>  (l''' \\<in> dom \\<sigma>') \\<Longrightarrow> \n        l'' = \\<psi>(l) \n        \\<Longrightarrow> l''' = \\<psi>(l')\"\napply (auto simp: check_subst_def)\ndone\n\n\nlemma subst_referenced_locations: \" check_subst \\<sigma> \\<psi> \\<sigma>' \\<Longrightarrow> \n       ( (\\<psi> `(Referenced_locations_Location \\<sigma> l)) = (Referenced_locations_Location \\<sigma>' (\\<psi> l)) )\" \napply(auto simp: check_subst_def)\n apply (case_tac \"\\<sigma> l\")\n  apply(auto simp: Referenced_locations_Location_def Referenced_locations_Value_def )\n apply (case_tac a)\n  apply clarsimp\n(*3*)\n  apply (drule_tac x=aa in spec)\n  apply (drule_tac x=b in spec)\n  apply (drule_tac x=l in spec)\n  apply (clarsimp simp: ran_def, rename_tac Val x f C)\n  apply ( drule_tac x=x in spec)\n  apply (rotate_tac -1, drule_tac x=Val in spec)\n  apply clarsimp\n  apply (rule_tac x=\"(subst_Value Val \\<psi>)\" in exI)\n  apply (rule conjI)\n(*4*)\n   apply (rule_tac x=x in exI)\n   apply (auto simp: Referenced_locations_Value_def split: Value.splits)\n(*1*)\napply (case_tac \"\\<sigma>' (\\<psi> l)\")\n apply(auto simp: Referenced_locations_Location_def Referenced_locations_Value_def )\napply (case_tac \"\\<sigma> l\")\n apply clarsimp\n apply (subgoal_tac \"\\<psi> l\\<in>dom \\<sigma>'\")\n  apply (clarsimp simp: inj_on_def)\n  apply (drule_tac x=l in spec)\n  apply (drule_tac x=xa in spec)\n  apply clarsimp\n apply force\n\n(*1*)\napply (case_tac a)\n apply (case_tac aa)\n  apply clarsimp\n  apply (drule_tac x=ac in spec)\n  apply (drule_tac x=ba in spec)\n  apply (drule_tac x=l in spec)\n  apply (clarsimp simp: ran_def)\n  apply ( drule_tac x=a in spec)\n  apply clarsimp\n  apply (subgoal_tac \"\\<exists> v . ac a = Some v\")\n   apply clarsimp\n   apply (clarsimp simp: Referenced_locations_Value_def)\n(*4*)\n   apply (case_tac \"subst_Value v \\<psi>\")\n    apply force\n   apply (case_tac v,clarsimp)\n   apply (clarsimp )\n   apply (rule,simp+)\n   apply (rename_tac oref)\n   apply (rule_tac x=\"ObjRef oref\" in exI,force)\n  apply blast\n apply force\n(*1*)\napply (case_tac aa)\n apply force\napply (rename_tac val)\napply (case_tac val,auto)\ndone\n\n\nlemma check_subst_rev: \"check_subst \\<sigma> \\<psi> \\<sigma>' \\<Longrightarrow>  l\\<in>dom \\<sigma>' \\<Longrightarrow> \\<exists>l'\\<in>dom \\<sigma>. l=\\<psi> l'\"\napply (auto simp:  check_subst_def)\ndone\n\nlemma subst_WF: \" Well_Formed_Store \\<sigma> \\<Longrightarrow> check_subst \\<sigma> \\<psi> \\<sigma>' \\<Longrightarrow> Well_Formed_Store \\<sigma>'\"\napply (auto simp:  Well_Formed_Store_def)\napply (frule_tac check_subst_rev,force,clarsimp)\napply (frule_tac l =\"l'\" in subst_referenced_locations)\napply (subgoal_tac \"\\<exists> y \\<in>Referenced_locations_Location \\<sigma> l' . x=\\<psi> y\")\n apply clarsimp\n apply (frule_tac x=yb in bspec,clarsimp)\n  apply blast\n(*2*)\n apply (auto simp: check_subst_def)\napply (subgoal_tac \"yb\\<in>dom \\<sigma>\")\n apply auto\napply blast\ndone\n\n\nsection{*Mark filtering*}\n\nfunction (sequential) Serialization_filter_eff :: \"Location \\<Rightarrow> Store \\<Rightarrow> Location set \\<Rightarrow> Location set\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n    \"\n    (Serialization_filter_eff l \\<sigma> L ) = (if l\\<in>L then {} else\n      (case \\<sigma>(l) of\n      None => {} |\n      Some (Obj obj) \\<Rightarrow> (fold (\\<lambda>l' S.  (S\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}\\<union>S)   )) ) \n                (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fst(obj))))) ({l}))  |\n      Some (StoredVal (ObjRef l')) \\<Rightarrow>{l}\\<union> (Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) )|\n      _ \\<Rightarrow> {l}))\" \n\nby auto\ntermination\napply (relation \"measure (\\<lambda>(l,\\<sigma>,L). card (dom \\<sigma> - L))\") \n  apply auto\n apply (subgoal_tac  \"card (dom \\<sigma> -  insert l (L \\<union> xa)) \\<le>card (dom \\<sigma> - insert l L)\")\n  apply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \n   apply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\n(*5*)\n    apply (drule_tac x=l in Finite_Set.card.remove)+\n     apply (insert finite_map)\n     apply auto\n apply (subgoal_tac \"dom \\<sigma> - insert l (L \\<union> xa) \\<subseteq>(dom \\<sigma> - insert l L)\")\n  apply (subgoal_tac \"dom \\<sigma> - insert l (L \\<union> xa) =(dom \\<sigma> - insert l L)\\<or>dom \\<sigma> -insert l (L \\<union> xa) \\<subset>(dom \\<sigma> - insert l L)\")\n   apply (elim disjE)\n    apply force\n(*4*)\n   apply (subgoal_tac \"finite ((dom \\<sigma>- insert l L))\")\n    apply (drule_tac A=\"dom \\<sigma>-insert l (L \\<union> xa)\" in Finite_Set.psubset_card_mono)\n     apply auto\n(*1*)\napply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \n apply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\n  apply (drule_tac x=l in Finite_Set.card.remove)+\n   apply (insert finite_map)\n   apply auto\ndone\n\nabbreviation serialize_filter_eff:: \"Location \\<Rightarrow> Store \\<Rightarrow> Store\" \nwhere\n\"serialize_filter_eff l \\<sigma> \\<equiv>  \\<sigma> |` Serialization_filter_eff l \\<sigma> {} \" \n\nlemma SFI2SG1: \"\n       (\\<And>l \\<sigma> L a b S.\n           l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (Obj (a, b)) \\<Longrightarrow>\n                     \\<forall>x\\<in>\\<Union>(Referenced_locations_Value ` ran a). P (Serialization_filter_eff x \\<sigma> (L \\<union> {l} \\<union> S x) ) x \\<sigma> (L \\<union> {l} \\<union> S x)  \\<Longrightarrow>\n                     P ({l} \\<union> \\<Union>((\\<lambda>x. Serialization_filter_eff x \\<sigma> (L \\<union> {l} \\<union> S x) ) ` \\<Union>(Referenced_locations_Value ` ran a))) l \\<sigma> L ) \\<Longrightarrow>\n       (\\<And>l \\<sigma> L l' . l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> P (Serialization_filter_eff l' \\<sigma> (L \\<union> {l}) ) l' \\<sigma> (L \\<union> {l})  \\<Longrightarrow> P ({l} \\<union> Serialization_filter_eff l' \\<sigma> (L \\<union> {l}) ) l \\<sigma> L ) \\<Longrightarrow>\n       (\\<And>x2 prod x xa.\n           l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some x2 \\<Longrightarrow>\n                     x2 = Obj prod \\<Longrightarrow>\n                     x \\<in> set (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (fst prod)))) \\<Longrightarrow>\n                     P (Serialization_filter_eff x \\<sigma> (L \\<union> {l} \\<union> xa) ) x \\<sigma> (L \\<union> {l} \\<union> xa) ) \\<Longrightarrow>\n       (\\<And>l \\<sigma> L  . P {} l \\<sigma> L ) \\<Longrightarrow> \\<sigma> l = Some a \\<Longrightarrow> a = Obj prod \\<Longrightarrow> P (Serialization_filter_eff l \\<sigma> L ) l \\<sigma> L \n\"\napply (case_tac prod,rename_tac f C)\napply clarsimp\napply (subgoal_tac \n  \"set (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (f)))) = \n    \\<Union>(Referenced_locations_Value ` ran (f))\")\n apply clarsimp\n(*2*)\n apply (drule_tac x=l in meta_spec)\n apply (drule_tac x=\\<sigma> in meta_spec)\n apply (drule_tac x=L in meta_spec)\n apply (drule_tac x=f in meta_spec)\n apply (rotate_tac -1, drule_tac x=C in meta_spec)\n apply simp\n apply (drule_tac x=l in meta_spec)\n apply (drule_tac x=\\<sigma> in meta_spec)\n apply (drule_tac x=L in meta_spec)\n apply (drule_tac x=\"Obj(f,C)\" in meta_spec)\n apply (drule_tac x=f in meta_spec)\n apply (drule_tac x=C in meta_spec)\n apply simp\n(*2*)\n apply (subgoal_tac \"distinct (sorted_list_of_set\n                                              (\\<Union>(Referenced_locations_Value ` (ran (f)))))\")\n  apply (drule_tac SF=Serialization_filter_eff and \\<sigma> = \\<sigma> and LS =\"{l}\" and l=l and L=L  in SF_fold_to_Union,simp)\n(*SF_fold_to_Union[rule_format]: \"((distinct fieldlist)\\<longrightarrow>(\\<exists> F . (fold (\\<lambda>x S.  (S\\<union>(SF x \\<sigma> (L\\<union>{l}\\<union>S) T)) ) fieldlist (LS)  = LS\\<union> \\<Union>((\\<lambda> x . SF x \\<sigma> (L\\<union>{l}\\<union>F x) T) `(set fieldlist)))))\"*)\n  apply clarsimp\n(*3*)\n  apply (drule_tac x=F in meta_spec)\n   apply (erule meta_impE)\n   apply clarsimp\n   apply (rotate_tac 7,drule_tac x=x in meta_spec, drule_tac x=\"F x\" in meta_spec)\n   apply (clarsimp)\n   apply (rotate_tac -1,erule meta_impE)\n    apply force\n(*4*)\n   apply (case_tac \"\\<sigma> x\",force)\n   apply (case_tac \"aaa\",force,simp)\n   apply (force split: Value.splits)\n(*2*)\n apply (rule distinct_sorted_list_of_set)\n apply (subgoal_tac \"finite (\\<Union>l'\\<in>ran (f). Referenced_locations_Value l')\")\n apply force\napply (rule finite_ran_obj_Referenced_locations_Value)\napply force\ndone\n\nlemma  SFI2SG2:\"(\\<And>x2 Value nat.\n           l \\<notin> L \\<Longrightarrow>\n           \\<sigma> l = Some x2 \\<Longrightarrow>\n           x2 = StoredVal Value \\<Longrightarrow> Value = ObjRef nat \\<Longrightarrow> \n           P (Serialization_filter_eff nat \\<sigma> (L \\<union> {l}) ) nat \\<sigma> (L \\<union> {l}) ) \\<Longrightarrow>\n     (\\<And>l'. l \\<notin> L \\<Longrightarrow>\n              \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>\n              P (Serialization_filter_eff l' \\<sigma> (L \\<union> {l}) ) l' \\<sigma> (L \\<union> {l})  \\<Longrightarrow>\n              P ({l} \\<union> Serialization_filter_eff l' \\<sigma> (L \\<union> {l}) ) l \\<sigma> L ) \\<Longrightarrow>\n  \\<sigma> l = Some a \\<Longrightarrow>  P {} l \\<sigma> L \\<Longrightarrow>a = StoredVal (ObjRef l') \\<Longrightarrow> P (Serialization_filter_eff l \\<sigma> L ) l \\<sigma> L \n  \"\napply clarsimp\ndone\n\nlemma Serialization_filter_eff_induct_1: \"   \n(\\<And>l \\<sigma> L . P {} l \\<sigma> L ) \\<Longrightarrow> \n(\\<And>l \\<sigma> L V .  l\\<notin>L \\<Longrightarrow> \\<sigma> l = Some (StoredVal V) \\<Longrightarrow>isnotObjRef V \\<Longrightarrow>P {l} l \\<sigma> L ) \\<Longrightarrow> \n(\\<And>l \\<sigma> L a b S .\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<Longrightarrow> \n           (\\<forall> x\\<in>\\<Union>(Referenced_locations_Value`(ran a)). \n                          P (Serialization_filter_eff x \\<sigma> (L\\<union>{l}\\<union>(S x)) ) x \\<sigma> (L\\<union>{l}\\<union>(S x)) \n                                     ) \\<Longrightarrow>\n            P ({l}\\<union>(\\<Union> ((\\<lambda> x. Serialization_filter_eff x \\<sigma> (L \\<union> {l}\\<union>S x))` \n                                             \\<Union>(Referenced_locations_Value`ran(a))))) l \\<sigma> L )  \\<Longrightarrow>\n(\\<And>l \\<sigma> L l' .\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> \n           (P (Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) ) l' \\<sigma>  (L\\<union>{l}) )\\<Longrightarrow>\n           (P ({l}\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) )) l \\<sigma> L ))         \\<Longrightarrow>   \n   P (Serialization_filter_eff l' \\<sigma>' L' ) l' \\<sigma>' L' \"\napply (rule Serialization_filter_eff.induct)\napply (case_tac \"\\<sigma> l\")\n apply (simp)\n(*1*)\napply (case_tac a)\n apply (erule SFI2SG1,simp,simp,simp,simp,simp)\napply (rename_tac val,case_tac val)\n apply force\napply (erule SFI2SG2,simp+)\ndone\n\n\n\nlemma Serialization_filter_effD_L:\"x\\<in>Serialization_filter_eff l \\<sigma> L \\<Longrightarrow> l\\<notin>L\"\napply force\ndone\n\nlemma Serialization_filter_effD_L_contrapos:\"l\\<notin>Serialization_filter_eff l \\<sigma> L  \\<Longrightarrow> l\\<in>L \\<or> \\<sigma> l = None\"\napply (simp split: option.splits Storable.splits split_if_asm )\napply (clarsimp,rename_tac f C)\napply (subgoal_tac \"l\\<in>{l}\",drule_tac F=\"\\<lambda> l' S . (if l' = l \\<or> l' \\<in> L \\<or> l' \\<in> S then {}\n                                  else case \\<sigma> l' of None \\<Rightarrow> {}\n                                                 | Some (Obj obj) \\<Rightarrow>\n                                                     fold (\\<lambda>l'a Sa. Sa \\<union> Serialization_filter_eff l'a \\<sigma> (insert l (L \\<union> S) \\<union> {l'} \\<union> Sa))\n                                                      (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (fst obj)))) {l'}\n                                                 | Some (StoredVal null) \\<Rightarrow> {l'} | Some (StoredVal (ObjRef l'a)) \\<Rightarrow> {l'} \\<union> Serialization_filter_eff l'a \\<sigma> (insert l (L \\<union> S) \\<union> {l'}) )\" in AuxiliaryFunctions.foldr_Un_init\n       ,blast)\napply blast\napply (simp split: Value.splits Storable.splits split_if_asm )\ndone\n\nlemma Serialization_filter_eff_no_l[simp]:\"l\\<notin>Serialization_filter_eff l \\<sigma> L = (l\\<in>L \\<or> \\<sigma> l = None)\"\napply rule\napply (rule Serialization_filter_effD_L_contrapos,simp)\napply auto\ndone\n\nlemma Serialization_filter_effD: \"x\\<in>Serialization_filter_eff l \\<sigma> L \\<Longrightarrow> \n                                   ((\\<exists> fields C . (\\<sigma> l = Some (Obj (fields,C))\\<and> \n                                        x \\<in> (fold (\\<lambda>l' S.  (S\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}\\<union>S)))) \n                                        (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fields)))) ({l})))) \\<or>  \n                                   (x=l \\<and>\\<sigma> l \\<noteq>None) \\<or>\n                                   (\\<exists> l' . (\\<sigma> l = Some (StoredVal (ObjRef l'))\\<and> x\\<in>Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) )))\"\napply (case_tac \"\\<sigma> l\")\napply (simp split: option.splits Storable.splits split_if_asm )\napply (case_tac \"x=l\",force)\napply (case_tac a)\napply (force split: option.splits Storable.splits split_if_asm Value.splits)\napply (force split: Value.splits split_if_asm)\ndone\n\nlemma Serialization_filter_effI: \"l\\<notin>L\\<Longrightarrow> ((\\<exists> fields C . (\\<sigma> l = Some (Obj (fields,C))\\<and> \n                                        x \\<in> (fold (\\<lambda>l' S.  (S\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}\\<union>S))) ) \n                                        (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fields)))) ({l})))) \\<or>  \n                                   (x=l \\<and>\\<sigma> l \\<noteq>None) \\<or>\n                                   (\\<exists> l' . (\\<sigma> l = Some (StoredVal (ObjRef l'))\\<and> x\\<in>Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) )) ) \n                                   \\<Longrightarrow> x\\<in>Serialization_filter_eff l \\<sigma> L \"\napply (elim disjE)\napply (clarsimp split: Storable.splits split_if_asm)\napply (clarsimp split: Storable.splits split_if_asm )\n(*3*)\napply (case_tac y,rename_tac obj',case_tac obj')\napply (subgoal_tac \"l\\<in>{l}\",drule AuxiliaryFunctions.foldr_Un_init,simp,blast)\napply (simp split: Value.splits)\napply force\ndone\n\nlemma Serialization_filter_eff_def2: \n\"x\\<in>Serialization_filter_eff l \\<sigma> L  = (l\\<notin>L \\<and> ((\\<exists> fields C . (\\<sigma> l = Some (Obj (fields,C))\\<and> \n                                  x \\<in> (fold (\\<lambda>l' S.  (S\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}\\<union>S))) ) \n                                        (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fields)))) ({l})))) \\<or>  \n                                   (x=l \\<and>\\<sigma> l \\<noteq>None) \\<or>\n                                   (\\<exists> l' . (\\<sigma> l = Some (StoredVal (ObjRef l'))\\<and> x\\<in>Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) )) )) \n                       \"\napply rule \napply (frule Serialization_filter_effD, drule Serialization_filter_effD_L,blast)\napply (rule Serialization_filter_effI,blast,blast)\ndone\n\ndeclare Serialization_filter_eff.simps[simp del]\n\nlemma Serialization_filter_eff_empty[simp]: \"(Serialization_filter_eff l \\<sigma> L  ={}) = (l\\<in>L\\<or> \\<sigma> l = None)\"\napply rule\napply (case_tac \"l\\<in>(Serialization_filter_eff l \\<sigma> L )\")\napply force\napply (drule Serialization_filter_effD_L_contrapos)\napply simp\napply (clarsimp simp: Serialization_filter_eff.simps)\ndone\n\nlemma serialize_value_Mark: \"(serialize_filter_eff l \\<sigma>) l' = Some x \\<Longrightarrow> \\<sigma> l' = Some x\"\napply (subgoal_tac \"l'\\<in>(Serialization_filter_eff l \\<sigma> {} )\")\n apply (drule_tac m=\\<sigma> in Map.restrict_in)\n apply force\napply (rule Map_restrict_Some,blast)\ndone\n\nlemma Serialization_filter_eff_serialization_filter:\n\" \\<forall> L'. (L'\\<subseteq>L \\<longrightarrow>Serialization_filter_eff l \\<sigma> L \\<subseteq> serialization_filter l \\<sigma> L')\"\napply (rule_tac P= \"\\<lambda> S l \\<sigma> L. (\\<forall> L'. (L'\\<subseteq>L \\<longrightarrow>S \\<subseteq> serialization_filter l \\<sigma> L'))\" in   Serialization_filter_eff_induct_1)\napply clarsimp\napply clarify\napply (subgoal_tac \"serialization_filter l \\<sigma> L'={l}\")\napply force\napply (case_tac V,simp)\napply force\napply force\n\napply clarify\n\napply (subgoal_tac \"l\\<notin>L'\")\nprefer 2\napply force\n\napply simp\napply (case_tac \"x=l\",force)\napply clarsimp\napply (drule_tac x=xa in bspec)\napply simp\n\napply (drule_tac x=xb in bspec)\napply simp\napply (drule_tac x=\"insert l L\" in spec)\napply simp\napply (erule impE)\napply force\napply (case_tac \"xb = l\\<or> \\<sigma> xb=None \\<or>xb\\<in>L\")\napply (subgoal_tac \"Serialization_filter_eff xb \\<sigma> (insert l (L \\<union> S xb)) = {}\")\napply force\napply force\n\napply clarsimp\napply (rule_tac x=xb in bexI)\napply simp\napply (subgoal_tac \"serialization_filter xb \\<sigma>  (insert l L ) \\<subseteq> serialization_filter xb \\<sigma>  (insert l L' ) \")\nprefer 2\napply (rule Serialization_excluded_set_subset,force)\n\napply simp\napply (rotate_tac 3, drule_tac c=x in subsetD,assumption)\napply (subgoal_tac \"xb\\<notin>L'\",force)\napply force\n\napply force\n\napply clarify\napply (subgoal_tac \"l\\<notin>L'\")\nprefer 2\napply blast\n\napply (drule_tac x=\"insert l L'\" in spec)\napply (erule impE,blast)\napply (erule UnE)\napply (force split: Storable.splits Value.splits option.splits)\napply clarsimp\napply rule\napply clarify\napply (subgoal_tac \"Serialization_filter_eff l \\<sigma> (insert l L) ={}\",blast)\napply force\napply rule\napply clarsimp\napply (subgoal_tac \"Serialization_filter_eff l' \\<sigma> (insert l L) ={}\",blast)\napply force\napply force\ndone\nlemma Serialization_filter_eff_origin: \"l \\<notin> L \\<Longrightarrow> \\<sigma> l \\<noteq>None\\<Longrightarrow> l \\<in> Serialization_filter_eff l \\<sigma> L\"\n apply (simp add: Serialization_filter_eff.simps)\n apply (auto split: Storable.splits Value.splits option.splits)\n apply (subgoal_tac \"distinct (sorted_list_of_set (\\<Union>x\\<in>ran a. Referenced_locations_Value x))\")\napply (drule SF_fold_to_Union,force)\n apply (rule distinct_sorted_list_of_set)\ndone\n\nlemma Serialization_filter_eff_excluded_set_subset[rule_format]: \n\"\\<forall> L . L\\<subseteq>L' \\<longrightarrow> Serialization_filter_eff l \\<sigma> L' \\<subseteq> Serialization_filter_eff l \\<sigma> L\"\napply (rule_tac P= \"\\<lambda> S l \\<sigma> L'. (\\<forall>L. L\\<subseteq>L' \\<longrightarrow> S \\<subseteq> Serialization_filter_eff l \\<sigma> L)\" in   Serialization_filter_eff_induct_1)\n(*4*)\n   apply clarsimp\n  apply (clarsimp split: Value.splits)\n  apply (subgoal_tac \"l\\<notin> La\")\n  apply (rule Serialization_filter_eff_origin,simp+)\n  apply blast\n  apply clarsimp\n  apply rule\n   apply (rule Serialization_filter_eff_origin)\n  apply blast\n  apply simp\n  apply clarsimp\n\n  apply (drule_tac x=xa in bspec,assumption)\n  apply (drule_tac x=xb in bspec,assumption)\n   apply (drule_tac x=\"insert l (La \\<union> S xb)\" in spec)\n apply (erule impE,blast)\napply (drule_tac c=x in subsetD,assumption)\n apply (simp(no_asm) add: Serialization_filter_eff.simps)\n  apply (subgoal_tac \"l\\<notin> La\")\n apply clarsimp\n apply (subgoal_tac \"distinct (sorted_list_of_set (\\<Union>x\\<in>ran a. Referenced_locations_Value x)) \")\napply (drule_tac SF=Serialization_filter_eff and \\<sigma>=\\<sigma> and l=l and L=La and LS=\"{l}\" in SF_fold_to_Union_what_F2,simp)\napply (case_tac \"x=l\")\napply force\napply clarsimp\napply (subgoal_tac \"finite (\\<Union>x\\<in>ran a. Referenced_locations_Value x)\")\napply (frule_tac x=xb in AuxiliaryFunctions.sorted_list_of_set_nthI)\napply force\napply clarsimp\napply (rule_tac x=n in exI)\napply (drule sorted_list_of_set_card_length)\napply clarsimp\nSTOPPED HERE :\ninduction is not powerful enough because we loose the relation between the S in one exploration of an object and the S in another exploration of the same object\n (insert l (La \\<union> S (sorted_list_of_set (\\<Union>x\\<in>ran a. Referenced_locations_Value x) ! n)))\n (insert l (La \\<union> fold (\\<lambda>l' S. S \\<union> Serialization_filter_eff l' \\<sigma> (insert l (La \\<union> S))) (take n (sorted_list_of_set (\\<Union>x\\<in>ran a. Referenced_locations_Value x))) {l}))\n apply (clarsimp split: Storable.splits Value.splits option.splits)\n  apply blast\n apply clarsimp\n apply rule\n  apply blast\n apply clarsimp\n apply (drule_tac x=xb in bspec,blast) \n apply (rotate_tac -1,drule_tac x=xa in bspec,blast) \n apply clarsimp\n apply (drule_tac x=\"insert l La\" in spec)\n apply clarsimp \n apply (erule impE, blast)\n apply (drule_tac x=xa in bspec,blast) \n apply (case_tac \"xa\\<in>La\")\n(*3*)\n  apply clarsimp\n apply clarsimp\n apply blast\napply (intro impI allI)\napply (drule_tac x=\"La \\<union> {l}\" in spec)\napply auto\ndone\n\nsection\n(* mark filtering with additional param useful?\nsection{*Mark filtering*}\n\n\nfunction (sequential) Serialization_filter_eff :: \"Location \\<Rightarrow> Store \\<Rightarrow> Location set \\<Rightarrow> Location set\\<Rightarrow> Location set\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n    \"\n    (Serialization_filter_eff l \\<sigma> L T) = (if l\\<in>L then {} else\n      (case \\<sigma>(l) of\n      None => {} |\n      Some (Obj obj) \\<Rightarrow> (fold (\\<lambda>l' S.  (S\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}\\<union>S)   (T\\<union>(\\<Union>(Referenced_locations_Value`ran(fst(obj))))))) ) \n                (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fst(obj))))) ({l}))  |\n      Some (StoredVal (ObjRef l')) \\<Rightarrow>{l}\\<union> (Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) T)|\n      _ \\<Rightarrow> {l}))\" \n\nby auto\ntermination\napply (relation \"measure (\\<lambda>(l,\\<sigma>,L,T). card (dom \\<sigma> - L))\") \n  apply auto\n apply (subgoal_tac  \"card (dom \\<sigma> -  insert l (L \\<union> xa)) \\<le>card (dom \\<sigma> - insert l L)\")\n  apply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \n   apply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\n(*5*)\n    apply (drule_tac x=l in Finite_Set.card.remove)+\n     apply (insert finite_map)\n     apply auto\n apply (subgoal_tac \"dom \\<sigma> - insert l (L \\<union> xa) \\<subseteq>(dom \\<sigma> - insert l L)\")\n  apply (subgoal_tac \"dom \\<sigma> - insert l (L \\<union> xa) =(dom \\<sigma> - insert l L)\\<or>dom \\<sigma> -insert l (L \\<union> xa) \\<subset>(dom \\<sigma> - insert l L)\")\n   apply (elim disjE)\n    apply force\n(*4*)\n   apply (subgoal_tac \"finite ((dom \\<sigma>- insert l L))\")\n    apply (drule_tac A=\"dom \\<sigma>-insert l (L \\<union> xa)\" in Finite_Set.psubset_card_mono)\n     apply auto\n(*1*)\napply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \n apply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\n  apply (drule_tac x=l in Finite_Set.card.remove)+\n   apply (insert finite_map)\n   apply auto\ndone\n\nabbreviation serialize_filter_eff:: \"Location \\<Rightarrow> Store \\<Rightarrow> Store\" \nwhere\n\"serialize_filter_eff l \\<sigma> \\<equiv>  \\<sigma> |` Serialization_filter_eff l \\<sigma> {} {}\" \n\nlemma SFI2SG1: \"\n       (\\<And>l \\<sigma> L a b S T.\n           l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (Obj (a, b)) \\<Longrightarrow>\n                     \\<forall>x\\<in>\\<Union>(Referenced_locations_Value ` ran a). P (Serialization_filter_eff x \\<sigma> (L \\<union> {l} \\<union> S x) (T \\<union> \\<Union>(Referenced_locations_Value ` ran a))) x \\<sigma> (L \\<union> {l} \\<union> S x) (T \\<union> \\<Union>(Referenced_locations_Value ` ran a)) \\<Longrightarrow>\n                     P ({l} \\<union> \\<Union>((\\<lambda>x. Serialization_filter_eff x \\<sigma> (L \\<union> {l} \\<union> S x) (T \\<union> \\<Union>(Referenced_locations_Value ` ran a))) ` \\<Union>(Referenced_locations_Value ` ran a))) l \\<sigma> L T) \\<Longrightarrow>\n       (\\<And>l \\<sigma> L l' T. l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> P (Serialization_filter_eff l' \\<sigma> (L \\<union> {l}) T) l' \\<sigma> (L \\<union> {l}) T \\<Longrightarrow> P ({l} \\<union> Serialization_filter_eff l' \\<sigma> (L \\<union> {l}) T) l \\<sigma> L T) \\<Longrightarrow>\n       (\\<And>x2 prod x xa.\n           l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some x2 \\<Longrightarrow>\n                     x2 = Obj prod \\<Longrightarrow>\n                     x \\<in> set (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (fst prod)))) \\<Longrightarrow>\n                     P (Serialization_filter_eff x \\<sigma> (L \\<union> {l} \\<union> xa) (T \\<union> \\<Union>(Referenced_locations_Value ` ran (fst prod)))) x \\<sigma> (L \\<union> {l} \\<union> xa) (T \\<union> \\<Union>(Referenced_locations_Value ` ran (fst prod)))) \\<Longrightarrow>\n       (\\<And>l \\<sigma> L  T. P {} l \\<sigma> L T) \\<Longrightarrow> \\<sigma> l = Some a \\<Longrightarrow> a = Obj prod \\<Longrightarrow> P (Serialization_filter_eff l \\<sigma> L T) l \\<sigma> L T\n\"\napply (case_tac prod,rename_tac f C)\napply clarsimp\napply (subgoal_tac \n  \"set (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (f)))) = \n    \\<Union>(Referenced_locations_Value ` ran (f))\")\n apply clarsimp\n(*2*)\n apply (drule_tac x=l in meta_spec)\n apply (drule_tac x=\\<sigma> in meta_spec)\n apply (drule_tac x=L in meta_spec)\n apply (drule_tac x=f in meta_spec)\n apply (rotate_tac -1, drule_tac x=C in meta_spec)\n apply simp\n apply (drule_tac x=l in meta_spec)\n apply (drule_tac x=\\<sigma> in meta_spec)\n apply (drule_tac x=L in meta_spec)\n apply (drule_tac x=\"Obj(f,C)\" in meta_spec)\n apply (drule_tac x=f in meta_spec)\n apply (drule_tac x=C in meta_spec)\n apply simp\n(*2*)\n apply (subgoal_tac \"distinct (sorted_list_of_set\n                                              (\\<Union>(Referenced_locations_Value ` (ran (f)))))\")\n  apply (drule_tac SF=Serialization_filter_eff and \\<sigma> = \\<sigma> and LS =\"{l}\" and l=l and L=L and T=\"T\\<union>UNION (ran f) Referenced_locations_Value\" in SF_fold_to_Union,simp)\n(*SF_fold_to_Union[rule_format]: \"((distinct fieldlist)\\<longrightarrow>(\\<exists> F . (fold (\\<lambda>x S.  (S\\<union>(SF x \\<sigma> (L\\<union>{l}\\<union>S) T)) ) fieldlist (LS)  = LS\\<union> \\<Union>((\\<lambda> x . SF x \\<sigma> (L\\<union>{l}\\<union>F x) T) `(set fieldlist)))))\"*)\n  apply clarsimp\n(*3*)\n  apply (drule_tac x=F in meta_spec)\n  apply (drule_tac x=\"T\" in meta_spec)\n   apply (erule meta_impE)\n   apply clarsimp\n   apply (rotate_tac 7,drule_tac x=x in meta_spec, drule_tac x=\"F x\" in meta_spec)\n   apply (clarsimp)\n   apply (rotate_tac -1,erule meta_impE)\n    apply force\n(*4*)\n   apply (case_tac \"\\<sigma> x\",force)\n   apply (case_tac \"aaa\",force,simp)\n   apply (force split: Value.splits)\n  apply force\n(*2*)\n apply (rule distinct_sorted_list_of_set)\n apply (subgoal_tac \"finite (\\<Union>l'\\<in>ran (f). Referenced_locations_Value l')\")\n apply force\napply (rule finite_ran_obj_Referenced_locations_Value)\napply force\ndone\n\nlemma  SFI2SG2:\"(\\<And>x2 Value nat.\n           l \\<notin> L \\<Longrightarrow>\n           \\<sigma> l = Some x2 \\<Longrightarrow>\n           x2 = StoredVal Value \\<Longrightarrow> Value = ObjRef nat \\<Longrightarrow> \n           P (Serialization_filter_eff nat \\<sigma> (L \\<union> {l}) T) nat \\<sigma> (L \\<union> {l}) T) \\<Longrightarrow>\n     (\\<And>l'. l \\<notin> L \\<Longrightarrow>\n              \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>\n              P (Serialization_filter_eff l' \\<sigma> (L \\<union> {l}) T) l' \\<sigma> (L \\<union> {l}) T \\<Longrightarrow>\n              P ({l} \\<union> Serialization_filter_eff l' \\<sigma> (L \\<union> {l}) T) l \\<sigma> L T) \\<Longrightarrow>\n  \\<sigma> l = Some a \\<Longrightarrow>  P {} l \\<sigma> L T\\<Longrightarrow>a = StoredVal (ObjRef l') \\<Longrightarrow> P (Serialization_filter_eff l \\<sigma> L T) l \\<sigma> L T\n  \"\napply clarsimp\ndone\n\nlemma Serialization_filter_eff1: \"   \n(\\<And>l \\<sigma> L T. P {} l \\<sigma> L T) \\<Longrightarrow> \n(\\<And>l \\<sigma> L V T.  l\\<notin>L \\<Longrightarrow> \\<sigma> l = Some (StoredVal V) \\<Longrightarrow>isnotObjRef V \\<Longrightarrow>P {l} l \\<sigma> L T) \\<Longrightarrow> \n(\\<And>l \\<sigma> L a b S T.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<Longrightarrow> \n           (\\<forall> x\\<in>\\<Union>(Referenced_locations_Value`(ran a)). \n                          P (Serialization_filter_eff x \\<sigma> (L\\<union>{l}\\<union>(S x)) (T\\<union>\\<Union>(Referenced_locations_Value`(ran a)))) x \\<sigma> (L\\<union>{l}\\<union>(S x)) \n                                     (T\\<union>\\<Union>(Referenced_locations_Value`(ran a)))) \\<Longrightarrow>\n            P ({l}\\<union>(\\<Union> ((\\<lambda> x. Serialization_filter_eff x \\<sigma> (L \\<union> {l}\\<union>S x) (T\\<union>\\<Union>(Referenced_locations_Value`(ran a))))` \n                                             \\<Union>(Referenced_locations_Value`ran(a))))) l \\<sigma> L T)  \\<Longrightarrow>\n(\\<And>l \\<sigma> L l' T.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> \n           (P (Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) T) l' \\<sigma>  (L\\<union>{l}) T)\\<Longrightarrow>\n           (P ({l}\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) T)) l \\<sigma> L T))         \\<Longrightarrow>   \n   P (Serialization_filter_eff l' \\<sigma>' L' T) l' \\<sigma>' L' T\"\napply (rule Serialization_filter_eff.induct)\napply (case_tac \"\\<sigma> l\")\n apply (simp)\n(*1*)\napply (case_tac a)\n apply (erule SFI2SG1,simp,simp,simp,simp,simp)\napply (rename_tac val,case_tac val)\n apply force\napply (erule SFI2SG2,simp+)\ndone\n\n\n\nlemma Serialization_filter_effD_L:\"x\\<in>Serialization_filter_eff l \\<sigma> L T\\<Longrightarrow> l\\<notin>L\"\napply force\ndone\n\nlemma Serialization_filter_effD_L_contrapos:\"l\\<notin>Serialization_filter_eff l \\<sigma> L T \\<Longrightarrow> l\\<in>L \\<or> \\<sigma> l = None\"\napply (simp split: option.splits Storable.splits split_if_asm )\napply (clarsimp,rename_tac f C)\napply (subgoal_tac \"l\\<in>{l}\",drule_tac F=\"\\<lambda> l' S . (if l' = l \\<or> l' \\<in> L \\<or> l' \\<in> S then {}\n                                  else case \\<sigma> l' of None \\<Rightarrow> {}\n                                                 | Some (Obj obj) \\<Rightarrow>\n                                                     fold (\\<lambda>l'a Sa. Sa \\<union> Serialization_filter_eff l'a \\<sigma> (insert l (L \\<union> S) \\<union> {l'} \\<union> Sa) (T \\<union> UNION (ran (fst (f, C))) Referenced_locations_Value \\<union> \\<Union>(Referenced_locations_Value ` ran (fst obj))))\n                                                      (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (fst obj)))) {l'}\n                                                 | Some (StoredVal null) \\<Rightarrow> {l'} | Some (StoredVal (ObjRef l'a)) \\<Rightarrow> {l'} \\<union> Serialization_filter_eff l'a \\<sigma> (insert l (L \\<union> S) \\<union> {l'}) (T \\<union> UNION (ran (fst (f, C))) Referenced_locations_Value))\" in AuxiliaryFunctions.foldr_Un_init\n       ,blast)\napply blast\napply (simp split: Value.splits Storable.splits split_if_asm )\ndone\n\nlemma Serialization_filter_eff_no_l[simp]:\"l\\<notin>Serialization_filter_eff l \\<sigma> L T= (l\\<in>L \\<or> \\<sigma> l = None)\"\napply rule\napply (rule Serialization_filter_effD_L_contrapos,simp)\napply auto\ndone\n\nlemma Serialization_filter_effD_: \"x\\<in>Serialization_filter_eff l \\<sigma> L T\\<Longrightarrow> \n                                   ((\\<exists> fields C . (\\<sigma> l = Some (Obj (fields,C))\\<and> \n                                        x \\<in> (fold (\\<lambda>l' S.  (S\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}\\<union>S) (T\\<union>\\<Union>(Referenced_locations_Value`ran(fields)))))) \n                                        (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fields)))) ({l})))) \\<or>  \n                                   (x=l \\<and>\\<sigma> l \\<noteq>None) \\<or>\n                                   (\\<exists> l' . (\\<sigma> l = Some (StoredVal (ObjRef l'))\\<and> x\\<in>Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) T)))\"\napply (case_tac \"\\<sigma> l\")\napply (simp split: option.splits Storable.splits split_if_asm )\napply (case_tac \"x=l\",force)\napply (case_tac a)\napply (force split: option.splits Storable.splits split_if_asm Value.splits)\napply (force split: Value.splits split_if_asm)\ndone\n\nlemma Serialization_filter_effI: \"l\\<notin>L\\<Longrightarrow> ((\\<exists> fields C . (\\<sigma> l = Some (Obj (fields,C))\\<and> \n                                        x \\<in> (fold (\\<lambda>l' S.  (S\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}\\<union>S) (T\\<union>\\<Union>(Referenced_locations_Value`ran(fields))))) ) \n                                        (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fields)))) ({l})))) \\<or>  \n                                   (x=l \\<and>\\<sigma> l \\<noteq>None) \\<or>\n                                   (\\<exists> l' . (\\<sigma> l = Some (StoredVal (ObjRef l'))\\<and> x\\<in>Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) T)) ) \n                                   \\<Longrightarrow> x\\<in>Serialization_filter_eff l \\<sigma> L T\"\napply (elim disjE)\napply (clarsimp split: Storable.splits split_if_asm)\napply (clarsimp split: Storable.splits split_if_asm )\n(*3*)\napply (case_tac y,rename_tac obj',case_tac obj')\napply (subgoal_tac \"l\\<in>{l}\",drule AuxiliaryFunctions.foldr_Un_init,simp,blast)\napply (simp split: Value.splits)\napply force\ndone\n\nlemma Serialization_filter_eff_def2: \n\"x\\<in>Serialization_filter_eff l \\<sigma> L T = (l\\<notin>L \\<and> ((\\<exists> fields C . (\\<sigma> l = Some (Obj (fields,C))\\<and> \n                                  x \\<in> (fold (\\<lambda>l' S.  (S\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}\\<union>S) (T\\<union>\\<Union>(Referenced_locations_Value`ran(fields))))) ) \n                                        (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fields)))) ({l})))) \\<or>  \n                                   (x=l \\<and>\\<sigma> l \\<noteq>None) \\<or>\n                                   (\\<exists> l' . (\\<sigma> l = Some (StoredVal (ObjRef l'))\\<and> x\\<in>Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) T)) )) \n                       \"\napply rule \napply (frule Serialization_filter_effD_, drule Serialization_filter_effD_L,blast)\napply (rule Serialization_filter_effI,blast,blast)\ndone\n\ndeclare Serialization_filter_eff.simps[simp del]\n\nlemma Serialization_filter_eff_empty[simp]: \"(Serialization_filter_eff l \\<sigma> L T ={}) = (l\\<in>L\\<or> \\<sigma> l = None)\"\napply rule\napply (case_tac \"l\\<in>(Serialization_filter_eff l \\<sigma> L T)\")\napply force\napply (drule Serialization_filter_effD_L_contrapos)\napply simp\napply (clarsimp simp: Serialization_filter_eff.simps)\ndone\n\nlemma serialize_value_Mark: \"(serialize_filter_eff l \\<sigma>) l' = Some x \\<Longrightarrow> \\<sigma> l' = Some x\"\napply (subgoal_tac \"l'\\<in>(Serialization_filter_eff l \\<sigma> {} {})\")\n apply (drule_tac m=\\<sigma> in Map.restrict_in)\n apply force\napply (rule Map_restrict_Some,blast)\ndone\n\nlemma Serialization_filter_eff_serialization_filter:\n\"Serialization_filter_eff l \\<sigma> L {}= serialization_filter l \\<sigma> L\"\napply (rule serialization_filter1B)\napply auto\n\nlemma Serialization_filter_eff2: \"   \n(\\<And>l \\<sigma> L T. P {} l \\<sigma> L T) \\<Longrightarrow> \n(\\<And>l \\<sigma> L V T.  l\\<notin>L \\<Longrightarrow> \\<sigma> l = Some (StoredVal V) \\<Longrightarrow>isnotObjRef V \\<Longrightarrow>P {l} l \\<sigma> L T) \\<Longrightarrow> \n(\\<And>l \\<sigma> L a b S T.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<Longrightarrow> \n        let locationlist = sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(a))) in\n           S = (\\<lambda> n . (if (n< length locationlist) then (L\\<union>{l}\\<union> (\\<Union>k\\<in>{n'. n'<n}. (Serialization_filter_eff ((locationlist)!k) \\<sigma> (L\\<union>{l}\\<union>S k) T))) else {})) \\<Longrightarrow>\n           (\\<forall> x\\<in>\\<Union>(Referenced_locations_Value`(ran a)). \n                          P (Serialization_filter_eff x \\<sigma> (L\\<union>{l}\\<union>(S x)) (T\\<union>\\<Union>(Referenced_locations_Value`(ran a)))) x \\<sigma> (L\\<union>{l}\\<union>(S x)) \n                                     (T\\<union>\\<Union>(Referenced_locations_Value`(ran a)))) \\<Longrightarrow>\n            P ({l}\\<union>(\\<Union> ((\\<lambda> x. Serialization_filter_eff x \\<sigma> (L \\<union> {l}\\<union>S x) (T\\<union>\\<Union>(Referenced_locations_Value`(ran a))))` \n                                             \\<Union>(Referenced_locations_Value`ran(a))))) l \\<sigma> L T)  \\<Longrightarrow>\n(\\<And>l \\<sigma> L l' T.\n        l \\<notin> L \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow> \n           (P (Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) T) l' \\<sigma>  (L\\<union>{l}) T)\\<Longrightarrow>\n           (P ({l}\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>{l}) T)) l \\<sigma> L T))         \\<Longrightarrow>   \n   P (Serialization_filter_eff l' \\<sigma>' L' T) l' \\<sigma>' L' T\"\napply (rule Serialization_filter_eff.induct)\napply (case_tac \"\\<sigma> l\")\n apply (simp add: Serialization_filter_eff.simps)\n(*1*)\napply (case_tac a)\n\n apply (erule SFI2SG1,simp,simp,simp,simp,simp)\napply (case_tac Value)\n(* apply force\napply (erule SFI2SG2,simp+)\ndone\n\n\n\nlemma T_is_accessory_pre: \"x\\<in>Serialization_filter_eff l \\<sigma> L T \\<longrightarrow> x\\<in>Serialization_filter_eff l \\<sigma> L (T\\<union>T')\"\napply (rule_tac P=\"\\<lambda> S l \\<sigma> L T. x\\<in>S \\<longrightarrow>x\\<in> Serialization_filter_eff l \\<sigma> L (T\\<union>T')\" in Serialization_filter_eff1)\napply auto\napply (erule Serialization_filter_effI_,force)\napply (erule Serialization_filter_effI_,force)\napply (erule Serialization_filter_effI_,simp)\napply (drule_tac x=xa in bspec,simp)\napply (drule_tac x=xaa in bspec,simp)\napply clarsimp\nS too imprecise\n\nlemma serialization_filter_WF_1step_obj[rule_format]: \n  \"l\\<in>Serialization_filter_eff l'' \\<sigma> L T\\<longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<longrightarrow>  a x = Some (ObjRef l') \n        \\<longrightarrow>Well_Formed_Store \\<sigma>\\<longrightarrow>  \\<exists> t\\<in>T. l'\\<in>serialization_filter l'' \\<sigma> L {} \\<or>l'\\<in>L\\<or>l'\\<in>serialization_filter l'' \\<sigma> L T\"\napply (rule_tac P= \n\"\\<lambda> S l'' \\<sigma> L. l\\<in>S \\<longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<longrightarrow>  a x = Some ( ObjRef l')   \\<longrightarrow>Well_Formed_Store \\<sigma>\n\\<longrightarrow>   l'\\<in>L\\<or>l'\\<in>S\" in   serialization_filter1)\n(*4*)\n   apply force\n  apply clarsimp\n apply (case_tac \"l'=la\")\n  apply simp\n apply (case_tac \"l=la\")\n  apply clarsimp\n  apply (drule_tac x=\"( ObjRef l')\" in bspec)\n   apply (rule ranI)\n   apply blast\n  apply (drule_tac x=l' in bspec,simp,simp)\n  apply (auto split: split_if_asm )\n(*2*)\n apply (drule_tac x=l' in bspec,simp)\n  apply (rule_tac x=\"( ObjRef l')\" in bexI)\n  apply simp\n  apply (rule ranI,simp)\n apply (clarsimp split: option.splits Storable.splits simp: Well_Formed_Store_def)\n  apply (drule_tac x=l in bspec,blast)\n  apply (drule Referenced_locations_LocationI_Obj, simp+)\n  apply force\n(*2*)\n apply (simp split: Value.splits)\napply (drule_tac x=l' in bspec,simp)\n apply (rule_tac x=\"( ObjRef l')\" in bexI)\n  apply simp\n apply (rule ranI,simp)\napply auto\ndone\n\n\nlemma Serialization_WF: \"Well_Formed_Store \\<sigma> \\<Longrightarrow> Well_Formed_Store (serialize_filter_eff l \\<sigma>)\"\napply (unfold Well_Formed_Store_def)\napply (intro ballI)\napply (fold Well_Formed_Store_def)\napply (subgoal_tac \" la \\<in> dom \\<sigma>\")\n apply (case_tac \"\\<sigma> la\")\n  apply blast\n apply rule\n apply (unfold Referenced_locations_Location_def)\n(*2*)\n apply (case_tac  \"serialize_filter_eff l \\<sigma> la\")\n  apply blast\n apply (drule serialize_value)\n apply (subgoal_tac \"a=aa\")\n  apply clarify\n  apply (case_tac aa,case_tac prod)\n   apply (frule serialize_value)\n   apply  clarsimp\n   apply (subgoal_tac \"serialize_filter l \\<sigma> la = Some (Obj (ab, ba))\")\n(*5*)\n    apply clarsimp\n    apply (simp add: ran_def Referenced_locations_Value_def,clarify)\n    apply (subgoal_tac \"la\\<in>serialization_filter l \\<sigma> {}\")\n     apply (drule serialization_filter_WF_1step_obj,simp, force split: Value.splits)\n       apply (simp split: Value.splits,simp)\n     apply (simp split: Value.splits)\n     apply (drule Well_Formed_StoreD_obj,simp,simp)\n     apply blast\n    apply (rule Map_restrict_Some,force)\n   apply simp\n  apply (frule serialize_value)\n  apply simp\n(*3*)\n  apply (subgoal_tac \"la\\<in>serialization_filter l \\<sigma> {}\")\n   apply (drule serialization_filter_WF_1step_ref,simp, simp split: Value.splits,simp,simp)\n   apply (simp split: Value.splits)\n   apply (drule Well_Formed_StoreD_ref,simp)\n   apply blast\n(*3*)\n  apply (rule Map_restrict_Some,force)\n apply force\napply (insert serialize_filter_subset[of \\<sigma> l])\napply blast\ndone\n\n\nlemma Serialization_filter_eff_union: (Serialization_filter_eff l' \\<sigma> L\\<union>L')\\<union>L' = (Serialization_filter_eff l' \\<sigma> L\\<union>L')\n\nlemma fold_union_init[rule_format]: \"\\<forall> L'' . fold (\\<lambda>l' S. S \\<union> (Serialization_filter_eff l' \\<sigma> S)) list (L \\<union> L'') = (fold (\\<lambda>l' S. S \\<union> Serialization_filter_eff l' \\<sigma> S) list L) \\<union> L''\"\napply (induct_tac list)\napply force\napply clarsimp\napply (drule_tac x=\"L''\\<union>L'' \\<union> Serialization_filter_eff a \\<sigma> (L \\<union> L'')\" in spec) \napply simp\napply (subgoal_tac \"(L'' \\<union> F a (L \\<union> L'')) =   (L'' \\<union> (F a (L \\<union> L'')))\")\napply simp\napply blast\napply blast\ndone\nlemma \"\\<forall> L' . l \\<in> fold (\\<lambda>l' S. S \\<union> Serialization_filter_eff l' \\<sigma> (L' \\<union> S)) list L = (l\\<in>L\\<or> \n            ( \\<exists> i<length list . let S =  fold (\\<lambda>l' S. S \\<union> Serialization_filter_eff l' \\<sigma> (L' \\<union> S)) (take i list) L  in  (l\\<in>Serialization_filter_eff (list!i) \\<sigma> (L' \\<union> S) \\<and> l\\<notin>S)))\"\napply (induct_tac list)\napply force\napply (clarsimp)\napply (subgoal_tac \"fold (\\<lambda>l' S. S \\<union> Serialization_filter_eff l' \\<sigma> (L' \\<union> S)) list (L \\<union> Serialization_filter_eff a \\<sigma> (L' \\<union> L)) = fold (\\<lambda>l' S. S \\<union> Serialization_filter_eff l' \\<sigma> (L' \\<union> S)) list L \\<union> Serialization_filter_eff a \\<sigma> (L' \\<union> L)\")\ndefer\napply (rule_tac list=list and L''=\"Serialization_filter_eff a \\<sigma> (L' \\<union> L)\"  in fold_union_init)\napply clarsimp\napply (case_tac \"l\\<in>L\")\napply force\napply clarsimp\napply rule\napply (case_tac \"l \\<in> Serialization_filter_eff a \\<sigma> (L' \\<union> L)\")\napply clarsimp\napply (rule_tac x=0 in exI)\napply clarsimp\napply (clarsimp simp: Let_def)\n\napply (rule_tac x=\"Suc i\" in exI)\napply (clarsimp simp: Let_def)\n\nlemma \" \\<forall> x . l \\<in> Serialization_filter_eff l' \\<sigma> L \\<longrightarrow>\n                    x \\<in> Serialization_filter_eff l \\<sigma> L \\<longrightarrow>x \\<in> Serialization_filter_eff l' \\<sigma> L\"\napply (rule_tac P = \" \\<lambda> l' \\<sigma> L .\\<forall> x .l \\<in> Serialization_filter_eff l' \\<sigma> L \\<longrightarrow>\n                    x \\<in> Serialization_filter_eff l \\<sigma> L \\<longrightarrow>x \\<in> Serialization_filter_eff l' \\<sigma> L\" in Serialization_filter_eff.induct)\napply (case_tac \"l=la\")\napply clarsimp\napply clarsimp\napply (frule Serialization_filter_effD_L)\napply (frule Serialization_filter_effD_L)\napply (drule Serialization_filter_effD_,clarsimp)\napply (elim disjE)\napply clarsimp\napply(thin_tac \"(\\<And>x2 Value nat. False \\<Longrightarrow> x2 = StoredVal (ObjRef nat) \\<Longrightarrow> Value = ObjRef nat \\<Longrightarrow> l \\<in> Serialization_filter_eff nat \\<sigma> (insert la L) \\<longrightarrow> (\\<forall>x. x \\<in> Serialization_filter_eff l \\<sigma> (insert la L) \\<longrightarrow> x \\<in> Serialization_filter_eff nat \\<sigma> (insert la L))) \")\napply (drule_tac x= \"Obj(fields,C)\" in meta_spec)\napply (drule_tac x= \"fields\" in meta_spec)\napply (drule_tac x= C in meta_spec)\napply (rule Serialization_filter_effI_)\napply clarsimp\napply clarsimp\n\n(*\nDO NOT DO FOLD TO UNION FIND BETTER\n*)\n\n apply (subgoal_tac \"distinct (sorted_list_of_set\n                                              (\\<Union>x\\<in>ran fields. Referenced_locations_Value x))\")\napply (drule_tac SF=Serialization_filter_eff and \\<sigma> = \\<sigma> and LS =\"{la}\" and l=la and L=\"L\" in SF_fold_to_Union)\napply clarsimp\napply (drule_tac x= xa in meta_spec)\napply (drule_tac x= \"F xa\" in meta_spec)\napply clarsimp\napply (rule_tac x=xa in bexI)\napply (drule_tac x=x in spec)\napply clarsimp\napply (erule disjE,simp)\n\nlemma Serialization_filter_effdouble_union[rule_format]: \"   \n   \\<forall>  l'. ( Serialization_filter_eff l \\<sigma> L \\<subseteq> Serialization_filter_eff l' \\<sigma> L \\<union> Serialization_filter_eff l \\<sigma> (L\\<union>Serialization_filter_eff l' \\<sigma> L))\"\napply (rule_tac P = \" \\<lambda> l \\<sigma> L . \\<forall>  l'. ( Serialization_filter_eff l \\<sigma> L \\<subseteq> Serialization_filter_eff l' \\<sigma> L \\<union> Serialization_filter_eff l \\<sigma> (L\\<union>Serialization_filter_eff l' \\<sigma> L))\" in Serialization_filter_eff.induct)\napply clarsimp\napply (erule contrapos_np)\napply (frule Serialization_filter_effD_L)\napply (frule Serialization_filter_effD_,simp)\napply (elim disjE)\napply clarsimp\napply(thin_tac \"       (\\<And>x2 Value nat. False \\<Longrightarrow> x2 = StoredVal (ObjRef nat) \\<Longrightarrow> Value = ObjRef nat \\<Longrightarrow> \\<forall>l'. Serialization_filter_eff nat \\<sigma> (insert l L) \\<subseteq> Serialization_filter_eff l' \\<sigma> (insert l L) \\<union> Serialization_filter_eff nat \\<sigma> (insert l (L \\<union> Serialization_filter_eff l' \\<sigma> (insert l L)))) \")\napply (drule_tac x= \"Obj(fields,C)\" in meta_spec)\napply (drule_tac x= \"fields\" in meta_spec)\napply (drule_tac x= C in meta_spec)\napply clarsimp\napply (rule Serialization_filter_effI_)\napply clarsimp\n\n\napply (subgoal_tac \"\\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) |i. i \\<in> I}\\<subseteq> \\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) |i. i \\<in> I} \\<union> Serialization_filter_eff l \\<sigma> (L \\<union> \\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) |i. i \\<in> I})\")\napply (erule Set.subset_trans,simp)\napply blast\n(*1*)\napply rule\ndefer\napply simp\napply (clarsimp)\n\napply clarsimp\napply (thin_tac \"(\\<And>x2 a b x xa. False \\<Longrightarrow> x2 = Obj (a, b) \\<Longrightarrow>\n                                 x \\<in> set (sorted_list_of_set (\\<Union>x\\<in>ran a. Referenced_locations_Value x)) \\<Longrightarrow>\n                                 ?P x2 a b x xa)\")\napply (drule_tac x= \"(StoredVal (ObjRef l'))\" in meta_spec)\napply (drule_tac x= \"((ObjRef l'))\" in meta_spec)\napply (drule_tac x= l' in meta_spec)\napply simp\napply (drule_tac x=L' in spec)\napply (drule_tac x= S in spec)\napply (drule_tac x= I in spec)\n\n\nlemma Serialization_filter_effdouble[rule_format]: \"   \n   \\<forall> L' S S' I ll LL. ((S\\<subseteq>S'\\<and>S'=\\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) | i . i\\<in> I})\\<longrightarrow>(S\\<union>(Serialization_filter_eff l \\<sigma> (L\\<union>L'\\<union>S))\\<subseteq> S'\\<union>(Serialization_filter_eff l \\<sigma> (L\\<union>S'))))\"\napply (rule_tac P = \" \\<lambda> l \\<sigma> L . \\<forall> L' S S' I ll LL. ((S\\<subseteq>S'\\<and>S'=\\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) | i . i\\<in> I})\\<longrightarrow>(S\\<union>(Serialization_filter_eff l \\<sigma> (L\\<union>L'\\<union>S))\\<subseteq> S'\\<union>(Serialization_filter_eff l \\<sigma> (L\\<union>S'))))\" in  Serialization_filter_eff.induct)\napply clarsimp\napply rule\napply (subgoal_tac \"\\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) |i. i \\<in> I}\\<subseteq> \\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) |i. i \\<in> I} \\<union> Serialization_filter_eff l \\<sigma> (L \\<union> \\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) |i. i \\<in> I})\")\napply (erule Set.subset_trans,simp)\napply blast\n(*1*)\napply rule\napply (frule Serialization_filter_effD_L)\napply (frule Serialization_filter_effD_,simp)\napply (elim disjE)\ndefer\napply simp\napply (clarsimp)\n\napply clarsimp\napply (thin_tac \"(\\<And>x2 a b x xa. False \\<Longrightarrow> x2 = Obj (a, b) \\<Longrightarrow>\n                                 x \\<in> set (sorted_list_of_set (\\<Union>x\\<in>ran a. Referenced_locations_Value x)) \\<Longrightarrow>\n                                 ?P x2 a b x xa)\")\napply (drule_tac x= \"(StoredVal (ObjRef l'))\" in meta_spec)\napply (drule_tac x= \"((ObjRef l'))\" in meta_spec)\napply (drule_tac x= l' in meta_spec)\napply simp\napply (drule_tac x=L' in spec)\napply (drule_tac x= S in spec)\napply (drule_tac x= I in spec)\napply (drule_tac x= ll in spec)\napply (drule_tac x= LL in spec)\napply simp\napply (subgoal_tac \"x\\<in>\\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) |i. i \\<in> I}\\<or>x\\<in>Serialization_filter_eff l' \\<sigma> (insert l (L \\<union> \\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) |i. i \\<in> I}))\")\napply(case_tac \"x \\<in> \\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) |i. i \\<in> I}\")\napply (blast)\napply clarsimp\napply (subgoal_tac \"x \\<in> Serialization_filter_eff l \\<sigma> (L \\<union> \\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) |i. i \\<in> I})\")\napply simp\napply (rule Serialization_filter_effI_)\napply clarsimp\napply(subgoal_tac \"Serialization_filter_eff l \\<sigma> (L \\<union> L' \\<union> S) ={}\")\napply blast\napply(subgoal_tac \"l\\<in>(L \\<union> L' \\<union> S)\")\napply(thin_tac \"x \\<in> Serialization_filter_eff l \\<sigma> (L \\<union> L' \\<union> S)\")\napply clarsimp\napply(subgoal_tac \"l\\<in>S\")\napply blast\napply (drule_tac c=l in Set.subsetD,simp)\napply (rule Serialization_filter_effI_) \n apply (simp (no_asm) add: Serialization_filter_eff.simps)\n(*1*)\napply (case_tac a, case_tac prod)\napply (clarsimp simp del: Serialization_filter_eff.simps)\napply (rule)\napply (drule Set.Un_mono ,blast,simp)\napply (thin_tac \"(\\<And>x2 Value nat. ?P x2 Value nat\\<Longrightarrow>?Q x2 Value nat \\<Longrightarrow>?R x2 Value nat\\<Longrightarrow>?U x2 Value nat\\<Longrightarrow>?T x2 Value nat)\")\napply (drule_tac x=\"Obj (aaa, ba)\" in meta_spec)\napply (drule_tac x=aaa in meta_spec)\napply (drule_tac x=ba in meta_spec)\napply (clarsimp simp del: Serialization_filter_eff.simps)\napply (clarsimp)\napply (case_tac \"l\\<in>L\",simp)\napply (case_tac \"l\\<in>L'\",simp)\napply (case_tac \"l\\<in>S\",simp)\napply (clarsimp simp del: Serialization_filter_eff.simps split: split_if_asm)\napply simp\n apply (subgoal_tac \"distinct (sorted_list_of_set\n                                              (\\<Union>x\\<in>ran aaa. Referenced_locations_Value x))\")\n  apply (drule_tac SF=Serialization_filter_eff and \\<sigma> = \\<sigma> and LS =\"{l}\" and l=l and L=\"L\\<union>L'\\<union>S\" in SF_fold_to_Union,simp)\napply (clarsimp)\napply (case_tac \"x=l\",simp)\napply (rule_tac x=\"(case \\<sigma> (ll i) of None \\<Rightarrow> {} | Some (Obj obj) \\<Rightarrow>  fold (\\<lambda>l' S. S \\<union> Serialization_filter_eff l' \\<sigma> (LL i \\<union> {ll i} \\<union> S)) (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (fst obj)))) {ll i}\n                                                                           | Some (StoredVal null) \\<Rightarrow> {ll i} | Some (StoredVal (ObjRef l')) \\<Rightarrow> {ll i} \\<union> Serialization_filter_eff l' \\<sigma> (LL i \\<union> {ll i}))\" in exI)\napply simp\napply (rule_tac x=i in exI)\napply simp\napply (clarsimp simp del: Serialization_filter_eff.simps )\napply (subgoal_tac \"l'\\<in>LL i \\<or>l'\\<in>Serialization_filter_eff (ll i) \\<sigma> (LL i)\") (* IF WELL FORMEDNESS IS PROVEN*)\napply (elim disjE)\napply (subgoal_tac \"l'\\<in>Serialization_filter_eff l \\<sigma> (L\\<union> \\<Union>{Serialization_filter_eff (ll i) \\<sigma> (LL i) | i . i\\<in> I})\")\napply (clarsimp  split: split_if_asm)\napply (drule_tac x=\"(case \\<sigma> (ll i) of None \\<Rightarrow> {}        \n| Some (Obj obj) \\<Rightarrow>fold (\\<lambda>l' S. S \\<union> Serialization_filter_eff l' \\<sigma> (LL i \\<union> {ll i} \\<union> S)) (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (fst obj)))) {ll i}                                                \n| Some (StoredVal null) \\<Rightarrow> {ll i} | Some (StoredVal (ObjRef l')) \\<Rightarrow> {ll i} \\<union> Serialization_filter_eff l' \\<sigma> (LL i \\<union> {ll i}))\" in spec)\napply simp\napply (drule_tac x= i in spec)\napply simp\napply (simp (no_asm))\napply (clarsimp simp del: Serialization_filter_eff.simps)\napply simp\napply (drule_tac x= i in spec)\napply simp\napply \napply\n(*\napply clarsimp\napply (case_tac \"\\<sigma> l'\",simp)\napply (case_tac \"\\<sigma> (ll i)\",simp)\napply clarsimp\n\napply (rule_tac x=\"(case \\<sigma> (ll i) of None \\<Rightarrow> {}\n                                                                                                                 | Some (Obj obj) \\<Rightarrow>\n  fold (\\<lambda>l' S. S \\<union> Serialization_filter_eff l' \\<sigma> (LL i \\<union> {ll i} \\<union> S)) (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran (fst obj)))) {ll i}\n                                                                                                                 | Some (StoredVal null) \\<Rightarrow> {ll i} | Some (StoredVal (ObjRef l')) \\<Rightarrow> {ll i} \\<union> Serialization_filter_eff l' \\<sigma> (LL i \\<union> {ll i}))\" in exI)\napply (clarsimp simp del: Serialization_filter_eff.simps )\napply (rule_tac x=i in exI)\napply simp\n\napply clarsimp\napply (drule_tac x=\"{}\" in meta_pec) (*? ? ?*)\napply (case_tac \"l\\<in>L\")\napply simp\napply (clarsimp simp del: Serialization_filter_eff.simps)\n apply (clarsimp split: option.splits Storable.splits)\napply (clarsimp split: Value.splits)\napply bast\nsorry\n\n\n(*induction useful\\<Or>? (\\<And>l \\<sigma> L a b S L'.\n        l \\<notin> L \\<Longrightarrow> l \\<notin> L' \\<Longrightarrow> \\<sigma> l = Some (Obj (a,b)) \\<Longrightarrow> \n          (\\<forall> x\\<in>\\<Union>(Referenced_locations_Value`(ran a)). (\\<forall> L'. \n                          (Serialization_filter_eff x \\<sigma> (L\\<union>L'\\<union>{l}\\<union>(S x))) \\<subseteq>(Serialization_filter_eff x \\<sigma> (L\\<union>{l}\\<union>(S x))))) \\<Longrightarrow>\n            ({l}\\<union>(\\<Union> ((\\<lambda> x. Serialization_filter_eff x \\<sigma> (L\\<union>L' \\<union> {l}\\<union>S x))` \n                                             \\<Union>(Referenced_locations_Value`ran(a)))))\\<subseteq> ({l}\\<union>(\\<Union> ((\\<lambda> x. Serialization_filter_eff x \\<sigma> ((L) \\<union> {l}\\<union>S x))` \n                                             \\<Union>(Referenced_locations_Value`ran(a))))) )  \\<Longrightarrow>\n(\\<And>l \\<sigma> L l' L'.\n        l \\<notin> L\\<Longrightarrow> l\\<notin> L' \\<Longrightarrow> \\<sigma> l = Some (StoredVal (ObjRef l')) \\<Longrightarrow>\n           \\<forall> L'. (Serialization_filter_eff l' \\<sigma> (L\\<union>L'\\<union>{l}))\\<subseteq> ( (Serialization_filter_eff l' \\<sigma> (L\\<union>{l})) )\\<Longrightarrow>\n           (({l}\\<union>(Serialization_filter_eff l' \\<sigma> (L\\<union>L'\\<union>{l})))\\<subseteq>  ({l}\\<union>(Serialization_filter_eff l' \\<sigma> ((L)\\<union>{l}))) ))         \\<Longrightarrow>   \n*)\nlemma \" S \\<subseteq> S' \\<Longrightarrow> \\<sigma> l = Some (Obj (aaa, ba)) \\<Longrightarrow>\n                   (\\<And>x xa. l \\<notin> L \\<Longrightarrow> x \\<in> set (sorted_list_of_set (\\<Union>x\\<in>ran aaa. Referenced_locations_Value x)) \\<Longrightarrow>\n                                      \\<forall>L' S S'. S \\<subseteq> S' \\<longrightarrow> S \\<subseteq> S' \\<union> Serialization_filter_eff x \\<sigma> (insert l (L \\<union> xa \\<union> S')) \\<and>\n                                                            Serialization_filter_eff x \\<sigma> (insert l (L \\<union> xa \\<union> L' \\<union> S)) \\<subseteq> S' \\<union> Serialization_filter_eff x \\<sigma> (insert l (L \\<union> xa \\<union> S'))) \\<Longrightarrow>\n                   x \\<in> Serialization_filter_eff l \\<sigma> (L \\<union> L' \\<union> S) \\<Longrightarrow> x \\<notin> Serialization_filter_eff l \\<sigma> (L \\<union> S') \\<Longrightarrow> x \\<in> S'\"\napply(induct_tac list)\napply force\napply (clarsimp simp del: Serialization_filter_eff.simps)\napply (rotate_tac -1,frule_tac x=\"(La \\<union> Serialization_filter_eff a \\<sigma> (L  \\<union> La))\" in spec)\napply (drule_tac x=\"(La \\<union> Serialization_filter_eff a \\<sigma> (L\\<union>L'  \\<union> La))\" in spec)\napply (clarsimp simp del: Serialization_filter_eff.simps)\napply auto\napply (case_tac \"\\<sigma> l'\")\nsorry\nlemma Serialization_filter_effdouble[rule_format]: \"   \n   \\<forall> L'. (Serialization_filter_eff l \\<sigma> (L\\<union>L'))\\<subseteq> (Serialization_filter_eff l \\<sigma> (L))\"\napply (rule_tac P = \" \\<lambda> l \\<sigma> L . \\<forall> L'. (Serialization_filter_eff l \\<sigma> (L\\<union>L'))\\<subseteq> (Serialization_filter_eff l \\<sigma> (L))\" in  Serialization_filter_eff.induct)\napply (clarsimp simp del: Serialization_filter_eff.simps)\napply (case_tac \"\\<sigma> l\")\n apply (clarsimp split: split_if_asm)\n(*1*)\napply (case_tac a, case_tac prod)\napply (rotate_tac 2,drule_tac x=a in meta_spec)\napply (rotate_tac -1,drule_tac x=aa in meta_spec)\napply (rotate_tac -1,drule_tac x=b in meta_spec)\n apply (clarsimp split: Value.splits split_if_asm)\napply (erule Set.rev_subsetD)\napply (rule)\napply (case_tac Value)\n apply fore\n\napply (erule SFI2SG2,simp+)\ndone\n\nlemma l_in_fold_union_selection[rule_format]: \"\n\\<forall> L. l \\<in> fold (\\<lambda>l' S. S \\<union> (F l' S))  list ({l}\\<union>L)\"\napply (induct_tac list)\napply auto\ndone\n\nlemma l_in_fold_union_selection_empty[rule_format]: \"\nl \\<in> fold (\\<lambda>l' S. S \\<union> (F l' S))  list {l}\"\napply (insert l_in_fold_union_selection [of l F list \"{}\"])\napply auto\ndone\n\nlemma Serialization_2_excluded_set_subset: \"\\<forall> L . L\\<subseteq>L' \\<longrightarrow> Serialization_filter_eff l \\<sigma> L' \\<subseteq> Serialization_filter_eff l \\<sigma> L\"\napply (rule_tac P= \"\\<lambda> S l \\<sigma> L'. (\\<forall>L. L\\<subseteq>L' \\<longrightarrow> S \\<subseteq> Serialization_filter_eff l \\<sigma> L)\" in   Serialization_filter_eff1)\napply clarsimp\napply (clarsimp split: Value.splits)\napply blast\napply (clarsimp simp del: Serialization_filter_eff.simps)\napply rule\napply (subgoal_tac \"l\\<notin>La\")\napply (clarsimp split: Value.splits Storable.splits)\napply (rule l_in_fold_union_selection_empty)\napply blast\napply (clarsimp simp del: Serialization_filter_eff.simps)\napply (drule_tac x=xa in bspec,blast) \napply (drule_tac x=xb in bspec,blast) \napply (drule_tac x=\"insert l (La \\<union> S xb)\" in spec)\napply (clarsimp simp del: Serialization_filter_eff.simps)\napply (erule impE, blast)\n\napply clarsimp\napply (rule)\napply (force split: Value.splits )\napply (clarsimp split: split_if )\napply blast\napply clarsimp\napply (subgoal_tac \"distinct (sorted_list_of_set (\\<Union>(Referenced_locations_Value ` ran a)))\")\napply (drule_tac SF=Serialization_filter_eff  and \\<sigma>=\\<sigma> and l = l and L = \"La\" and LS=\"{l}\" in SF_fold_to_Union_what_F)\napply clarsimp\napply (drule_tac x=xb in bspec,blast) \napply (rotate_tac -1,drule_tac x=xa in bspec,blast) \napply clarsimp\napply (drule_tac x=\"insert l (La \\<union> S xa)\" in spec)\napply clarsimp \napply (drule_tac x=xa in bspec,simp)\napply (intro conjI,simp)\napply (subgoal_tac \"finite (\\<Union>x\\<in>ran a. Referenced_locations_Value x)\")\napply (drule sorted_list_of_set)\napply blast\napply (rule finite_ran_obj_Referenced_locations_Value,simp)\napply blast\napply (subgoal_tac \"\\<exists> n <length (sorted_list_of_set(\\<Union>x\\<in>ran a. Referenced_locations_Value x)). (xa = (sorted_list_of_set(\\<Union>x\\<in>ran a. Referenced_locations_Value x)!n)) \")\napply clarsimp\napply (drule_tac x=n in spec)\napply clarsimp\napply (drule_tac x=\"(sorted_list_of_set(\\<Union>x\\<in>ran a. Referenced_locations_Value x)!n)\" in bspec)\napply clarsimp\napply (clarsimp split: split_if_asm option.splits)\napply (case_tac x2a)\napply clarsimp\n\n(*\napply (intro impI allI)\napply (drule_tac x=\"La \\<union> {l}\" in spec)\napply auto\ndone\n*)\n\nlemma equivalence_filters_1:\n\"\\<forall> L'. ((serialization_filter l \\<sigma> L)  \\<subseteq> (Serialization_filter_eff l \\<sigma> L') \\<union> L \\<union> L')\"\napply (rule_tac P= \n\"\\<lambda> S l'' \\<sigma> L. \\<forall> L'. (S  \\<subseteq> (Serialization_filter_eff l'' \\<sigma> L') \\<union> L \\<union> L')\" in   serialization_filter1)\napply blast\napply (clarsimp split: Value.splits)\napply (clarsimp)\napply (case_tac \"l\\<in>L'\")\napply (clarsimp)\napply (case_tac aa)\napply simp\napply (drule_tac x=xb in bspec)\napply blast\napply clarsimp\napply (elim disjE,clarsimp)\nprimrec subst_Value :: \" Value \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Value\"\nwhere\n  \"subst_Value (ObjRef l) \\<psi> = ObjRef (\\<psi>(l))\" |\n  \"subst_Value (ActRef a) \\<psi> = ActRef a\" |\n  \"subst_Value (null) \\<psi> = null\" |\n  \"subst_Value (ASPInt i) \\<psi> = ASPInt i\" |\n  \"subst_Value (ASPBool b) \\<psi> = ASPBool b\"\n\ndefinition check_subst :: \"Store \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Store \\<Rightarrow> bool\"\nwhere\n  \"check_subst  \\<sigma> \\<psi> \\<sigma>' \\<equiv>\n    ( inj \\<psi> \\<and> dom \\<sigma>' =  \\<psi> ` (dom(\\<sigma>)) \n    \\<and> (\\<forall> obj l . (\\<sigma>(l) = Some (Obj obj)  \n      \\<longrightarrow> (\\<exists> obj'. (\\<sigma>'(\\<psi>(l)) = Some (Obj obj') \\<and> (\\<forall> x  v. (obj.[x]) = Some v \\<longrightarrow> (obj'.[x])=Some (subst_Value v \\<psi>)))))\n    \\<and>   (\\<forall> f l . (\\<sigma>(l) = Some (FutRef f) \\<longrightarrow> \\<sigma>'(\\<psi>(l)) =Some (FutRef f)))\n    \\<and>   (\\<forall> v l . (\\<sigma>(l) = Some (StoredVal v) \\<longrightarrow> \n      \\<sigma>'(\\<psi>(l)) = Some (StoredVal (subst_Value v \\<psi>))))))\"\n\ndefinition rename_value_store :: \" Store \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> bool\"\n where \"rename_value_store \\<sigma>\\<^sub>0 v \\<sigma> v' \\<sigma>'  \\<equiv> (\\<exists>\\<psi> . check_subst \\<sigma> \\<psi> \\<sigma>'\\<and>v'=subst_Value v \\<psi>)\\<and>\n                                            dom \\<sigma>\\<^sub>0 \\<inter> dom \\<sigma>' = {}\"\n\ndefinition serialize_and_rename_list :: \" Store \\<Rightarrow> Value list \\<Rightarrow> Store \\<Rightarrow> Value list \\<Rightarrow> Store \\<Rightarrow> bool\"\n where \"serialize_and_rename_list \\<sigma>\\<^sub>0 vl \\<sigma> vl' \\<sigma>'  \\<equiv> \n              length vl=length vl' \\<and>\n              (\\<exists>\\<psi> \\<sigma>''. (\\<forall> i<length vl. serialize  (vl!i) \\<sigma> \\<sigma>''\\<and>vl'!i=subst_Value (vl!i) \\<psi>) \\<and>check_subst \\<sigma>'' \\<psi> \\<sigma>') \\<and>\n              dom \\<sigma>\\<^sub>0 \\<inter> dom \\<sigma>' = {}\"\n\n(*locale Generic_Functions = *)\n\n(*consts \n  Bind:: \"Program\\<Rightarrow>Location\\<Rightarrow>ClassName\\<Rightarrow>MethodName\\<Rightarrow>Value list\\<Rightarrow> EContext \"*)\n(* consts\n  params:: \"Program\\<Rightarrow>ClassName \\<Rightarrow>VarName list\"\n *)\n(*consts fetch:: \"Class list\\<Rightarrow>ClassName\\<Rightarrow>MethodName\\<Rightarrow>\n            ((VarName list) *(VarName list) * (Statement list)) option\" *)\n\n            subsection {* serialization and location renaming *}\n\ninductive serialize :: \"Value \\<Rightarrow> Store \\<Rightarrow> Store \\<Rightarrow> bool\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (Obj obj) \\<and> (\\<forall> v\\<in> ran(fst(obj)). \\<exists>\\<sigma>''. (serialize v \\<sigma> \\<sigma>''\\<and> \\<sigma>'' \\<subseteq>\\<^sub>m \\<sigma>'))\n     \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (FutRef f)  \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n    \" \\<sigma>'(l) = \\<sigma>(l) \\<and> \\<sigma>(l) = Some (StoredVal v)  \\<Longrightarrow> (serialize (ObjRef l) \\<sigma> \\<sigma>')\" |\n     \"(serialize (ActRef f) \\<sigma> \\<sigma>')\" |\n     \"serialize (null) \\<sigma> \\<sigma>' \" | \n     \"serialize (ASPInt n) \\<sigma> \\<sigma>'\" | \n     \"serialize (ASPBool b) \\<sigma> \\<sigma>'\"\n\n definition Referenced_locations_Value:: \"Value \\<Rightarrow> Location set\"\nwhere  \"Referenced_locations_Value v \\<equiv> (case v of ObjRef l \\<Rightarrow>{l} | _ \\<Rightarrow> {})\"\n\naxiomatization where finite_map: \"finite (dom (\\<sigma>::Store))\"\nfunction (sequential) serialization_filter :: \"Location \\<Rightarrow> Store \\<Rightarrow> Location set \\<Rightarrow> Location set\"\n(*serialize v \\<sigma> \\<sigma>' is true if the serialization of value v is a subset of \\<sigma>' (using store \\<sigma>)*)\n  where\n    \"\n    (serialization_filter l \\<sigma> L) = (if l\\<in>L then {} else\n      (case \\<sigma>(l) of\n      Some (Obj obj) \\<Rightarrow> listunionMap (\\<lambda>x.(serialization_filter x \\<sigma> (L\\<union>{l}))) \n                (sorted_list_of_set (\\<Union>(Referenced_locations_Value`ran(fst(obj))))) |\n      _ \\<Rightarrow> {}))\" \nby auto\ntermination \napply (relation \"measure (\\<lambda>(l,\\<sigma>,L). card (dom \\<sigma> - L))\") \napply auto\napply (subgoal_tac \"dom \\<sigma> - insert l L = (dom \\<sigma> - L) - {l}\") \napply (subgoal_tac \"finite ((dom \\<sigma>-L))\")\napply (drule_tac x=l in Finite_Set.card.remove)+\napply (insert finite_map)\napply auto\ndone\n\n\nlemma \"serialization_filter l \\<sigma> L \\<subseteq> dom \\<sigma>\"\napply (induct l \\<sigma> L rule: serialization_filter.induct)\napply (auto split: option.splits Storable.splits simp: listunionMap_def)\napply (drule AuxiliaryFunctions.foldr_Un_mapD)\napply (auto split: split_if_asm option.splits Storable.splits)\napply (drule_tac x=\"(Obj(a,b))\" in meta_spec,drule_tac x=a in meta_spec,drule_tac x=b in meta_spec,\n  drule_tac x=y in meta_spec,simp)\napply (case_tac ya, case_tac prod)\napply (drule_tac x=ya in spec, clarsimp)\napply (erule disjE,force)\napply clarsimp\napply (drule subsetD,simp)\napply auto\ndone     \n     \nprimrec subst_Value :: \" Value \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Value\"\nwhere\n  \"subst_Value (ObjRef l) \\<psi> = ObjRef (\\<psi>(l))\" |\n  \"subst_Value (ActRef a) \\<psi> = ActRef a\" |\n  \"subst_Value (null) \\<psi> = null\" |\n  \"subst_Value (ASPInt i) \\<psi> = ASPInt i\" |\n  \"subst_Value (ASPBool b) \\<psi> = ASPBool b\"\n\ndefinition check_subst :: \"Store \\<Rightarrow> (Location\\<Rightarrow>Location) \\<Rightarrow> Store \\<Rightarrow> bool\"\nwhere\n  \"check_subst  \\<sigma> \\<psi> \\<sigma>' \\<equiv>\n    ( inj \\<psi> \\<and> dom \\<sigma>' =  \\<psi> ` (dom(\\<sigma>)) \n    \\<and> (\\<forall> obj l . (\\<sigma>(l) = Some (Obj obj)  \n      \\<longrightarrow> (\\<exists> obj'. (\\<sigma>'(\\<psi>(l)) = Some (Obj obj') \\<and> (\\<forall> x  v. (obj.[x]) = Some v \\<longrightarrow> (obj'.[x])=Some (subst_Value v \\<psi>)))))\n    \\<and>   (\\<forall> f l . (\\<sigma>(l) = Some (FutRef f) \\<longrightarrow> \\<sigma>'(\\<psi>(l)) =Some (FutRef f)))\n    \\<and>   (\\<forall> v l . (\\<sigma>(l) = Some (StoredVal v) \\<longrightarrow> \n      \\<sigma>'(\\<psi>(l)) = Some (StoredVal (subst_Value v \\<psi>))))))\"\n\ndefinition rename_value_store :: \" Store \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> bool\"\n where \"rename_value_store \\<sigma>\\<^sub>0 v \\<sigma> v' \\<sigma>'  \\<equiv> (\\<exists>\\<psi> . check_subst \\<sigma> \\<psi> \\<sigma>'\\<and>v'=subst_Value v \\<psi>)\\<and>\n                                            dom \\<sigma>\\<^sub>0 \\<inter> dom \\<sigma>' = {}\"\n\ndefinition serialize_and_rename_list :: \" Store \\<Rightarrow> Value list \\<Rightarrow> Store \\<Rightarrow> Value list \\<Rightarrow> Store \\<Rightarrow> bool\"\n where \"serialize_and_rename_list \\<sigma>\\<^sub>0 vl \\<sigma> vl' \\<sigma>'  \\<equiv> \n              length vl=length vl' \\<and>\n              (\\<exists>\\<psi> \\<sigma>''. (\\<forall> i<length vl. serialize  (vl!i) \\<sigma> \\<sigma>''\\<and>vl'!i=subst_Value (vl!i) \\<psi>) \\<and>check_subst \\<sigma>'' \\<psi> \\<sigma>') \\<and>\n              dom \\<sigma>\\<^sub>0 \\<inter> dom \\<sigma>' = {}\"\n\n(*locale Generic_Functions = *)\n\n(*consts \n  Bind:: \"Program\\<Rightarrow>Location\\<Rightarrow>ClassName\\<Rightarrow>MethodName\\<Rightarrow>Value list\\<Rightarrow> EContext \"*)\n(* consts\n  params:: \"Program\\<Rightarrow>ClassName \\<Rightarrow>VarName list\"\n *)\n(*consts fetch:: \"Class list\\<Rightarrow>ClassName\\<Rightarrow>MethodName\\<Rightarrow>\n            ((VarName list) *(VarName list) * (Statement list)) option\" *)\n\n", "meta": {"author": "lhenrio", "repo": "MultiASP-Isabelle", "sha": "2cc5a5ef4cb6499311e429d98e18991fcb9f88d0", "save_path": "github-repos/isabelle/lhenrio-MultiASP-Isabelle", "path": "github-repos/isabelle/lhenrio-MultiASP-Isabelle/MultiASP-Isabelle-2cc5a5ef4cb6499311e429d98e18991fcb9f88d0/Serialisation/Serialization.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803831, "lm_q2_score": 0.5, "lm_q1q2_score": 0.31851539724019157}}
{"text": "theory NBA_Rule\nimports Scoring_Rules\n        \"Compositional_Structures/Basic_Modules/Scoring_Module\"\n        \"Compositional_Structures/Basic_Modules/NBA_Module\"\n        \"Compositional_Structures/Elect_Composition\"\n\nbegin\n\nlemma mvp_elect:\n  shows \"electoral_module (elector mvp)\"\nproof(unfold mvp.simps)\n  show \"electoral_module (elector (max_eliminator (scoring vector_A_mvp)))\"\n    using scoring_mod_A by blast \nqed\n\n\nlemma mvp_hom:\n  shows \"homogeneity (elector mvp)\" unfolding mvp.simps \n  using scoring_rules_homogeneity\n  by blast\n\nlemma mvp_reinforcement:\n  shows \"reinforcement_complete (elector mvp)\" unfolding mvp.simps \n  using scoring_module_rein\n  by blast\n\nend\n", "meta": {"author": "ChrisMackKit", "repo": "ba-scoring-rule-reinforcement-homogeneity", "sha": "d87febd04743389ac578b332349ae446b9c55e89", "save_path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity", "path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity/ba-scoring-rule-reinforcement-homogeneity-d87febd04743389ac578b332349ae446b9c55e89/verifiedVotingRuleConstruction-master - Bevor Range/theories/NBA_Rule.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5273165233795672, "lm_q1q2_score": 0.31846323491861916}}
{"text": "(* \n   Title: Psi-calculi   \n   Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Cong_Struct_Cong\n  imports Weak_Cong_Pres Weak_Bisim_Struct_Cong\nbegin\n\ncontext env begin\n\nlemma weakPsiCongParComm:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  \n  shows \"\\<Psi> \\<rhd> P \\<parallel> Q \\<doteq> Q \\<parallel> P\"\nby(metis bisim_par_comm strongBisimWeakPsiCong)\n\nlemma weakPsiCongResComm:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   y :: name\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"y \\<sharp> \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P) \\<doteq> \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\"\nusing assms\nby(metis bisim_res_comm strongBisimWeakPsiCong)\n\nlemma weakPsiCongResComm':\n  fixes x    :: name\n  and   \\<Psi>   :: 'b\n  and   xvec :: \"name list\"\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"xvec \\<sharp>* \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec\\<rparr>P) \\<doteq> \\<lparr>\\<nu>*xvec\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\"\nusing assms\nby(metis bisim_res_comm' strongBisimWeakPsiCong)\n\nlemma weakPsiCongScopeExt:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> P\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q) \\<doteq> P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q\"\nusing assms\nby(metis bisim_scope_ext strongBisimWeakPsiCong)\n\nlemma weakPsiCongScopeExtChain:\n  fixes xvec :: \"name list\"\n  and   \\<Psi>    :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"xvec \\<sharp>* \\<Psi>\"\n  and     \"xvec \\<sharp>* P\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q) \\<doteq> P \\<parallel> (\\<lparr>\\<nu>*xvec\\<rparr>Q)\"\nusing assms\nby(metis bisim_scope_ext_chain strongBisimWeakPsiCong)\n\nlemma weakPsiCongParAssoc:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> (P \\<parallel> Q) \\<parallel> R \\<doteq> P \\<parallel> (Q \\<parallel> R)\"\nby(metis bisim_par_assoc strongBisimWeakPsiCong)\n\nlemma weakPsiCongParNil:\n  fixes P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> \\<zero> \\<doteq> P\"\nby(metis bisim_par_nil strongBisimWeakPsiCong)\n\nlemma weakPsiCongResNil:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  \n  assumes \"x \\<sharp> \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>\\<zero> \\<doteq> \\<zero>\"\nusing assms\nby(metis bisim_res_nil strongBisimWeakPsiCong)\n\nlemma weakPsiCongOutputPushRes:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   M :: 'a\n  and   N :: 'a\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> M\"\n  and     \"x \\<sharp> N\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P) \\<doteq> M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P\"\nusing assms\nby(metis bisim_output_push_res strongBisimWeakPsiCong)\n\nlemma weakPsiCongInputPushRes:\n  fixes x    :: name\n  and   \\<Psi>    :: 'b\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> M\"\n  and     \"x \\<sharp> xvec\"\n  and     \"x \\<sharp> N\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P) \\<doteq> M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P\"\nusing assms\nby(metis bisim_input_push_res strongBisimWeakPsiCong)\n\nlemma weakPsiCongCasePushRes:\n  fixes x  :: name\n  and   \\<Psi>  :: 'b\n  and   Cs :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> (map fst Cs)\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(Cases Cs) \\<doteq> Cases(map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)\"\nusing assms\nby(metis bisim_case_push_res strongBisimWeakPsiCong)\n\nlemma weak_bangExt:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"guarded P\"\n\n  shows \"\\<Psi> \\<rhd> !P \\<doteq> P \\<parallel> !P\"\nusing assms\nby(metis bang_ext strongBisimWeakPsiCong)\n\nlemma weakPsiCongParSym:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q\"\n\n  shows \"\\<Psi> \\<rhd> R \\<parallel> P \\<doteq> R \\<parallel> Q\"\nusing assms\nby(metis weakPsiCongParComm weakPsiCongParPres weakPsiCongTransitive)\n\nlemma weakPsiCongScopeExtSym:\n  fixes x :: name\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> \\<Psi>\"\n  and     \"x \\<sharp> Q\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q) \\<doteq> (\\<lparr>\\<nu>x\\<rparr>P) \\<parallel> Q\"\nusing assms\nby(metis weakPsiCongScopeExt weakPsiCongTransitive weakPsiCongParComm weakPsiCongE weakPsiCongResPres)\n\nlemma weakPsiCongScopeExtChainSym:\n  fixes xvec :: \"name list\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   P    :: \"('a, 'b, 'c) psi\"\n\n  assumes \"xvec \\<sharp>* \\<Psi>\"\n  and     \"xvec \\<sharp>* Q\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> Q) \\<doteq> (\\<lparr>\\<nu>*xvec\\<rparr>P) \\<parallel> Q\"\nusing assms\nby(induct xvec) (auto intro: weakPsiCongScopeExtSym weakPsiCongReflexive weakPsiCongTransitive weakPsiCongResPres)\n\nlemma weakPsiCongParPresSym:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<And>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q\"\n\n  shows \"\\<Psi> \\<rhd> R \\<parallel> P \\<doteq> R \\<parallel> Q\"\nusing assms\nby(metis weakPsiCongParComm weakPsiCongParPres weakPsiCongTransitive)\n\nlemma tauCongChainBangI:\n  fixes \\<Psi> :: 'b\n  and   P  :: \"('a, 'b, 'c) psi\"\n  and   P' :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"\\<Psi> \\<rhd> P \\<parallel> P \\<Longrightarrow>\\<^sub>\\<tau> P'\"\n  and     \"guarded P\"\n\n  obtains Q where \"\\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q\" and \"\\<Psi> \\<rhd> Q \\<sim> P' \\<parallel> !P\"\nproof -\n  assume \"\\<And>Q. \\<lbrakk>\\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q; \\<Psi> \\<rhd> Q \\<sim> P' \\<parallel> !P\\<rbrakk> \\<Longrightarrow> thesis\"\n  moreover from `\\<Psi> \\<rhd> P \\<parallel> P \\<Longrightarrow>\\<^sub>\\<tau> P'` have \"\\<exists>Q. \\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q \\<and> \\<Psi> \\<rhd> Q \\<sim> P' \\<parallel> !P\"\n  proof(induct x1==\"P \\<parallel> P\" P' rule: tau_step_chain_induct)\n    case(tau_base R')\n    from `\\<Psi> \\<rhd> P \\<parallel> P \\<longmapsto>None @ \\<tau> \\<prec> R'`\n    obtain Q where \"\\<Psi> \\<rhd> !P \\<longmapsto>None @ \\<tau> \\<prec> Q\" and \"Q \\<sim> R' \\<parallel> !P\" using `guarded P` \n      by(rule tauBangI)\n    from `\\<Psi> \\<rhd> !P \\<longmapsto>None @ \\<tau> \\<prec> Q` have \"\\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q\" by auto\n    moreover from `Q \\<sim> R' \\<parallel> !P` have \"\\<Psi> \\<rhd> Q \\<sim> R' \\<parallel> !P\"\n      apply(drule_tac bisimE(3)[where \\<Psi>'=\\<Psi>])\n      by(rule_tac stat_eq_bisim, assumption) (metis Identity Assertion_stat_eq_sym Assertion_stat_eq_trans Commutativity)\n    ultimately show ?case by blast\n  next\n    case(tau_step R' R'')\n    then obtain Q where PChain: \"\\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q\" and \"\\<Psi> \\<rhd> Q \\<sim> R' \\<parallel> !P\" by auto\n    from `\\<Psi> \\<rhd> R' \\<longmapsto>None @ \\<tau> \\<prec> R''` have \"\\<Psi> \\<otimes> \\<one> \\<rhd> R' \\<longmapsto>None @ \\<tau> \\<prec> R''\" by(rule stat_eq_transition) (metis Identity Assertion_stat_eq_sym)\n    hence \"\\<Psi> \\<rhd> R' \\<parallel> !P \\<longmapsto>None @ \\<tau> \\<prec> R'' \\<parallel> !P\" by(rule_tac Par1[where \\<pi>=None,simplified]) auto\n    with `\\<Psi> \\<rhd> Q \\<sim> R' \\<parallel> !P` obtain Q' \\<pi> where QTrans: \"\\<Psi> \\<rhd> Q \\<longmapsto>\\<pi> @ \\<tau> \\<prec> Q'\" and \"\\<Psi> \\<rhd> Q' \\<sim> R'' \\<parallel> !P\"\n      by(force dest: bisimE(2) simE)\n    from PChain tau_no_provenance'[OF QTrans] have \"\\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q'\" by(auto dest: tau_act_tau_step_chain)\n    thus ?case using `\\<Psi> \\<rhd> Q' \\<sim> R'' \\<parallel> !P` by blast\n  qed\n  ultimately show ?thesis by blast\nqed\n\nlemma weakPsiCongBangPres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes PeqQ: \"\\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q\"\n  and     \"guarded P\"\n  and     \"guarded Q\"\n\n  shows   \"\\<Psi> \\<rhd> !P \\<doteq> !Q\"\nproof -\n  from assms have \"(\\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q) \\<and> guarded P \\<and> guarded Q\" by auto\n  hence \"\\<Psi> \\<rhd> \\<zero> \\<parallel> !P \\<doteq> \\<zero> \\<parallel> !Q\"\n  proof(induct rule: weakPsiCongSymI[where C=\"\\<lambda>P. \\<zero> \\<parallel> !P\"])\n    case(cSym P Q)\n    thus ?case by(auto dest: weakPsiCongSym)\n  next\n    case(cWeakBisim P Q)\n    thus ?case by(metis weakPsiCongE weakBisimBangPresAux)\n  next\n    case(cSim P Q)\n    then have \"\\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q\" and \"guarded P\" and \"guarded Q\" by auto\n    moreover hence \"\\<Psi> \\<rhd> P \\<approx> Q\" by(metis weakPsiCongE weakBisimE)\n    moreover have \"\\<And>\\<Psi> P Q. (\\<forall>\\<Psi>. (\\<Psi> \\<rhd> P \\<doteq> Q)) \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>\\<guillemotleft>weakBisim\\<guillemotright> Q\"\n      by(blast dest: weakPsiCongE)\n    moreover note weakBisimClosed bisim_closed weakBisimE(3) bisimE(3) weakBisimE(2) \n                  weakBisimE(4) bisimE(4) statEqWeakBisim stat_eq_bisim weakBisimTransitive bisim_transitive weakBisimParAssoc[THEN weakBisimE(4)]\n                  bisim_par_assoc[THEN bisimE(4)] weakBisimParPres\n    moreover have \"\\<And>P Q. \\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q \\<Longrightarrow> \\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<parallel> P \\<doteq> Q \\<parallel> Q\"\n      by(metis weakPsiCongParPres weakPsiCongParComm weakPsiCongSym weakPsiCongTransitive)\n    moreover note bisim_par_pres_sym\n    moreover from strongBisimWeakBisim have \"bisim \\<subseteq> weakBisim\" by auto\n    moreover have \"\\<And>\\<Psi> \\<Psi>\\<^sub>R P Q R A\\<^sub>R. \\<lbrakk>\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q; extract_frame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>; A\\<^sub>R \\<sharp>* \\<Psi>; A\\<^sub>R \\<sharp>* P; A\\<^sub>R \\<sharp>* Q\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<rhd> R \\<parallel> P \\<approx> R \\<parallel> Q\"\n      by(metis weakBisimParComm weakBisimTransitive weakBisimParPresAux)\n    moreover note weakBisimResChainPres bisim_res_chain_pres weakBisimScopeExtChainSym bisim_scope_ext_chain_sym\n    moreover have \"\\<And>\\<Psi> P R S Q. \\<lbrakk>\\<Psi> \\<rhd> P \\<approx> R; \\<Psi> \\<rhd> R \\<approx> S; \\<Psi> \\<rhd> S \\<sim> Q\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<rhd> P \\<approx> Q\"\n      by(blast dest: weakBisimTransitive strongBisimWeakBisim)\n    moreover note weakBisimBangPresAux\n    moreover from bangActE have \"\\<And>\\<Psi> P \\<alpha> \\<pi> P'. \\<lbrakk>\\<Psi> \\<rhd> !P \\<longmapsto>\\<pi> @ \\<alpha> \\<prec> P'; bn \\<alpha> \\<sharp>* P; guarded P; \\<alpha> \\<noteq> \\<tau>; bn \\<alpha> \\<sharp>* subject \\<alpha>\\<rbrakk> \\<Longrightarrow> \\<exists>Q \\<pi>. \\<Psi> \\<rhd> P \\<longmapsto>\\<pi> @ \\<alpha> \\<prec> Q \\<and> P' \\<sim> Q \\<parallel> !P\"\n      by blast\n    moreover from bangTauE have \"\\<And>\\<Psi> P P'. \\<lbrakk>\\<Psi> \\<rhd> !P \\<longmapsto>None @ \\<tau> \\<prec> P'; guarded P\\<rbrakk> \\<Longrightarrow> \\<exists>Q. \\<Psi> \\<rhd> P \\<parallel> P \\<longmapsto>None @ \\<tau> \\<prec> Q \\<and> P' \\<sim> Q \\<parallel> !P\"\n      by blast\n    moreover from tauCongChainBangI have \"\\<And>\\<Psi> P P'. \\<lbrakk>\\<Psi> \\<rhd> P \\<parallel> P \\<Longrightarrow>\\<^sub>\\<tau> P'; guarded P\\<rbrakk> \\<Longrightarrow> \\<exists>Q. \\<Psi> \\<rhd> !P \\<Longrightarrow>\\<^sub>\\<tau> Q \\<and> \\<Psi> \\<rhd> Q \\<sim> P' \\<parallel> !P\"\n      by blast\n    ultimately show ?case\n      by(rule_tac weakCongSimBangPres[where Rel=weakBisim and Rel'=bisim and Rel''=weakBisim and Eq=\"\\<lambda>P Q. \\<forall>\\<Psi>. \\<Psi> \\<rhd> P \\<doteq> Q\"])\n  qed\n  thus ?thesis\n    by(metis weakPsiCongParNil weakPsiCongParComm weakPsiCongTransitive weakPsiCongSym)\nqed\n\nend\n\nend\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Weak_Cong_Struct_Cong.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.31846323491861916}}
{"text": "theory Manual_Type_Checks\n  imports \"Soft_Types.Soft_Types_HOL\"\nbegin\n\nsubsection \\<open>Greedy Instantiations and Subtyping\\<close>\n\nconsts Nat :: \"'a type\"\nconsts Int :: \"'a type\"\nconsts add :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n\nlemma Int_if_Nat: \"x : Nat \\<Longrightarrow> x : Int\"\n  sorry\n\nlemma add_type: \"add : A \\<Rightarrow> A \\<Rightarrow> A\"\n  sorry\n\nlemma app_type:\n  assumes \"t : A \\<Rightarrow> B\"\n  and \"t : A \\<Rightarrow> B \\<Longrightarrow> u : A\"\n  shows \"t u : B\"\n  sorry\n\n(*subtyping in domain and codomain*)\nlemma app_type':\n  assumes \"t : A \\<Rightarrow> B'\"\n  and \"t : A \\<Rightarrow> B' \\<Longrightarrow> u : A'\"\n  (*subtyping*)\n  and \"t u : B' \\<Longrightarrow> t u : B\"\n  and \"t : A \\<Rightarrow> B' \\<Longrightarrow> u : A' \\<Longrightarrow> u : A\"\n  shows \"t u : B\"\n  sorry\n\n(*subtyping in domain*)\nlemma app_type'':\n  assumes \"t : A \\<Rightarrow> B\"\n  and \"t : A \\<Rightarrow> B \\<Longrightarrow> u : A'\"\n  (*subtyping*)\n  and \"t : A \\<Rightarrow> B \\<Longrightarrow> u : A' \\<Longrightarrow> u : A\"\n  shows \"t u : B\"\n  sorry\n\n(*loops if above rules are tagged with intro *)\n(* schematic_goal\n  assumes n_type: \"n : Nat\" and i_type: \"i : Int\"\n  shows \"add n i : ?T\"\n  using assms by (-) auto *)\n\nlemma app_dep_type:\n  assumes \"t : (x : A) \\<Rightarrow> B x\"\n  and \"t : (x : A) \\<Rightarrow> B x \\<Longrightarrow> u : A\"\n  shows \"t u : B u\"\n  sorry\n\n(*subtyping in domain and codomain*)\nlemma app_dep_type':\n  assumes \"t : (x : A) \\<Rightarrow> B' x\"\n  and \"t : (x : A) \\<Rightarrow> B' x \\<Longrightarrow> u : A'\"\n  (*subtyping*)\n  and \"t u : B' u \\<Longrightarrow> t u : B u\"\n  and \"t : (x : A) \\<Rightarrow> B' x \\<Longrightarrow> u : A' \\<Longrightarrow> u : A\"\n  shows \"t u : B u\"\n  sorry\n\n(*subtyping in domain*)\nlemma app_dep_type'':\n  assumes \"t : (x : A) \\<Rightarrow> B x\"\n  and \"t : (x : A) \\<Rightarrow> B x \\<Longrightarrow> u : A'\"\n  (*subtyping*)\n  and \"t : (x : A) \\<Rightarrow> B x \\<Longrightarrow> u : A' \\<Longrightarrow> u : A\"\n  shows \"t u : B u\"\n  sorry\n\nlemma\n  assumes f_type: \"f : (A \\<Rightarrow> C) \\<Rightarrow> C\"\n  and c_type: \"c : A \\<Rightarrow> Bool \\<Rightarrow> C\"\n  shows \"f (\\<lambda> a. c a True) : C\"\n  using assms\n  apply -\n  apply (rule app_type''[where ?t=f])\n    apply (rule f_type)\n    apply (rule Dep_fun_typeI)\n    apply (rule app_type''[where ?t=\"c a\" for a])\n      apply (rule app_type''[where ?t=\"c\" for a])\n        apply (rule c_type)\n        apply assumption\n        defer\n      apply (rule Any_typeI)\n      defer\n    defer\n  (*subtyping*)\n  apply assumption+\n  done\n\n(*subtyping in domain and codomain*)\nschematic_goal\n  assumes n_type: \"n : Nat\" and i_type: \"i : Int\"\n  shows \"add n i : ?T\"\n  using assms\n  apply -\n  apply (rule app_type'[where ?t=\"add n\" and ?u=\"i\"])\n    apply (rule app_type'[where ?t=add and ?u=n])\n      apply (rule add_type)\n      apply (rule n_type)\n      defer\n      defer\n    apply (rule i_type)\n    defer\n    defer\n  (*subtyping*)\n  apply assumption\n  apply (rule Int_if_Nat)\n  apply assumption\n  apply assumption\n  apply assumption\n  done\n\n(*subtyping in domain*)\nschematic_goal\n  assumes n_type: \"n : Nat\" and i_type: \"i : Int\"\n  shows \"add n i : ?T\"\n  using assms\n  apply -\n  apply (rule app_type''[where ?t=\"add n\" and ?u=\"i\"])\n    apply (rule app_type''[where ?t=add and ?u=n])\n      apply (rule add_type)\n      apply (rule n_type)\n      defer\n    apply (rule i_type)\n    defer\n  (*subtyping*)\n  apply (rule Int_if_Nat)\n  apply assumption\n  apply assumption\n  done\n\n\nsubsection \\<open>Higher-Order Functions\\<close>\n\nconsts mynat :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n\nlemma mynat_type: \"mynat : Nat \\<Rightarrow> Nat \\<Rightarrow> Nat\"\n  sorry\n\n(*compound arguments with subtyping in domain*)\nschematic_goal\n  assumes n_type: \"n : Nat\" and i_type: \"i : Int\"\n  shows \"add (mynat n n) i : ?T\"\n  using assms\n  apply -\n  apply (rule app_type''[where ?t=\"add (mynat n n)\" and ?u=\"i\"])\n    apply (rule app_type''[where ?t=add and ?u=\"mynat n n\"])\n      apply (rule add_type)\n      apply (rule app_type''[where ?t=\"mynat n\" and ?u=\"n\"])\n        apply (rule app_type''[where ?t=\"mynat\" and ?u=\"n\"])\n          apply (rule mynat_type)\n          apply (rule n_type)\n          defer\n        apply (rule n_type)\n        defer\n      defer\n    apply (rule i_type)\n    defer\n  (*subtyping*)\n  apply assumption\n  apply assumption\n  apply (rule app_type''[where ?t=\"mynat n\" and ?u=n])\n    apply (rule app_type'[where ?t=\"mynat\" and ?u=n])\n      apply (rule mynat_type)\n      apply (rule n_type)\n      defer\n    apply assumption\n    defer\n  (*subtyping*)\n  apply assumption\n  defer\n  apply (rule app_type'[where ?t=\"mynat\" and ?u=n])\n    apply (rule mynat_type)\n    apply (rule n_type)\n    defer\n  apply assumption\n  defer\n  defer\n  (*loops; subtyping goals must be solved by user instead*)\n  oops\n\nschematic_goal\n  assumes f_type: \"f : Nat \\<Rightarrow> Int \\<Rightarrow> Nat\" and g_type: \"g : Nat \\<Rightarrow> Nat \\<Rightarrow> Int\"\n  shows \"add f g : Nat \\<Rightarrow> Nat \\<Rightarrow> Int\"\n  apply (rule app_type''[where ?t=\"add f\" and ?u=\"g\"])\n    apply (rule app_type''[where ?t=add and ?u=f])\n      apply (rule add_type)\n      apply (rule f_type)\n      defer\n    apply (rule g_type)\n    defer\n  (*subtyping*)\n  apply (rule Dep_fun_typeI)+\n  apply (rule app_type'[where ?t=\"f x\" and ?u=y for x y])\n    apply (rule app_type''[where ?t=\"f\" and ?u=x for x])\n      apply assumption\n      apply assumption\n      defer\n    apply assumption\n    defer\n    defer\n  (*subtyping*)\n  apply assumption\n  apply assumption\n  apply (rule Int_if_Nat)\n  apply assumption\n  apply (rule Int_if_Nat)\n  apply assumption\n  done\n\nschematic_goal\n  assumes f_type: \"f : Nat \\<Rightarrow> Int \\<Rightarrow> Nat\" and g_type: \"g : Nat \\<Rightarrow> Nat \\<Rightarrow> Int\"\n  shows \"add f g : Nat \\<Rightarrow> Nat \\<Rightarrow> Int\"\n  apply (rule Dep_fun_typeI)+\n  apply (rule app_type''[where ?t=\"add f g x\" and ?u=\"y\" for x y])\n    apply (rule app_type''[where ?t=\"add f g\" and ?u=x for x])\n      apply (rule app_type''[where ?t=\"add f\" and ?u=g])\n        apply (rule app_type''[where ?t=\"add\" and ?u=f])\n          apply (rule add_type)\n          apply (rule f_type)\n          defer\n        apply (rule g_type)\n        defer\n      apply assumption\n      defer\n    apply assumption\n    defer\n  (*subtyping*)\n  apply (rule Dep_fun_typeI)+\n  apply (rule app_type'[where ?t=\"f x\" and ?u=y for x y])\n    apply (rule app_type''[where ?t=\"f\" and ?u=x for x])\n      apply assumption\n      apply assumption\n      defer\n    apply assumption\n    defer\n  (*subtyping*)\n  apply (rule Int_if_Nat)\n  apply assumption\n  apply assumption\n  apply assumption\n  apply assumption\n  apply assumption\n  apply (rule Int_if_Nat)\n  apply assumption\n  done\n\n\nsubsection \\<open>Non-Immediate Subtyping\\<close>\n\nschematic_goal\n  assumes n_type: \"n : A & (B & Nat)\" and i_type: \"i : Int & B\"\n  shows \"add n i : Int & B\"\n  using assms\n  apply -\n  apply (rule app_type''[where ?t=\"add n\" and ?u=\"i\"])\n    apply (rule app_type''[where ?t=add and ?u=n])\n      apply (rule add_type)\n      apply (rule n_type)\n      defer\n    apply (rule i_type)\n    defer\n  (*subtyping*)\n  (* apply (assumption | (rule Int_typeI | rule Int_if_Nat) | erule Int_typeE)+ *)\n  apply (rule Int_typeI)\n  apply (erule Int_typeE)+\n  apply (rule Int_if_Nat)\n  apply assumption\n  apply (erule Int_typeE)+\n  apply assumption\n  apply assumption\n  done\n\nschematic_goal\n  assumes n_type: \"n : Nat\" and i_type: \"i : Int\"\n  shows \"add n i : Int \\<bar> B\"\n  using assms\n  apply -\n  apply (rule app_type''[where ?t=\"add n\" and ?u=\"i\"])\n    apply (rule app_type''[where ?t=add and ?u=n])\n      apply (rule add_type)\n      apply (rule n_type)\n      defer\n    apply (rule i_type)\n    defer\n  (*subtyping*)\n  apply (rule Union_type_leftI)\n  apply (rule Int_if_Nat)\n  apply assumption\n  apply (rule Union_type_leftI)\n  apply assumption\n  done\n\nschematic_goal\n  assumes n_type: \"\\<And>x. x : A \\<Longrightarrow> n x : B x\" and n_type': \"\\<And>x. x : A \\<Longrightarrow> n x : B' x\"\n  and x_type: \"x : A\"\n  and f_type: \"\\<And>C. f : (x : A) \\<Rightarrow> C x \\<Rightarrow> C x\"\n  shows \"f x (n x) : B x & B' x\"\n  using assms\n  apply -\n  apply (rule app_dep_type''[where ?t=\"f x\" and ?u=\"n x\"])\n    apply (rule app_dep_type''[where ?t=f and ?u=x])\n      apply (rule f_type)\n      apply (rule x_type)\n      defer\n    apply (rule n_type)\n    defer\n  (*subtyping*)\n  apply (rule Int_typeI)\n  apply assumption\n  apply assumption\n  apply assumption\n  apply assumption\n  done\n\n\nsubsection \\<open>Type Simplification and Equivalences\\<close>\n\nconsts Vec :: \"'a \\<Rightarrow> 'a type\"\n\nschematic_goal\n  assumes v_type: \"v : Vec n\" and v'_type: \"v' : Vec m\"\n  and n_eq_m: \"n = m\"\n  shows \"add v v' : Vec m\"\n  using assms\n  apply -\n  apply (rule app_type''[where ?t=\"add v\" and ?u=\"v'\"])\n    apply (rule app_type''[where ?t=add and ?u=v])\n      apply (rule add_type)\n      apply (rule v_type)\n      defer\n    apply (rule v'_type)\n    defer\n  (*subtyping*)\n  defer\n  apply assumption\n  (*left to the user; solvable with integration in simplifier*)\n  oops\n  (* done *)\n\nconsts pos :: \"'a \\<Rightarrow> bool\"\n\nlemma Nat_if_pos_Int:\n  assumes \"i : Int\"\n  and \"pos i\"\n  shows \"i : Nat\"\n  sorry\n\nschematic_goal\n  assumes n_type: \"n : Nat\" and i_type: \"i : Int\"\n  and \"pos i\"\n  shows \"add n i : Nat\"\n  using assms\n  apply -\n  apply (rule app_type''[where ?t=\"add n\" and ?u=\"i\"])\n    apply (rule app_type''[where ?t=add and ?u=n])\n      apply (rule add_type)\n      apply (rule n_type)\n      defer\n    apply (rule i_type)\n    defer\n  (*subtyping*)\n  apply assumption\n  apply (rule Nat_if_pos_Int)\n  apply assumption\n  apply assumption\n  done\n\nlemma Int_pos_iff_Nat:\n  shows \"i : Int & type pos \\<longleftrightarrow> i : Nat\"\n  sorry\n\nschematic_goal\n  assumes n_type: \"n : Nat\" and i_type: \"i : Int\"\n  and \"pos i\"\n  shows \"add n i : Int & type pos\"\n  using assms\n  apply -\n  apply (rule app_type''[where ?t=\"add n\" and ?u=\"i\"])\n    apply (rule app_type''[where ?t=add and ?u=n])\n      apply (rule add_type)\n      apply (rule n_type)\n      defer\n    apply (rule i_type)\n    defer\n  (*subtyping*)\n  apply (rule Int_typeI)\n  apply (rule Int_if_Nat)\n  apply assumption\n  defer\n  apply (rule Int_typeI)\n  apply assumption\n  apply (rule has_typeI)\n  apply assumption\n  apply (rule has_typeI)\n  (*left to the user; solvable with integration in simplifier*)\n  oops\n\nlemma\n  assumes f_type: \"f : (x : A) \\<Rightarrow> (y : B x) \\<Rightarrow> C x y\"\n  and A_eq_B: \"\\<And>x. x : A \\<Longrightarrow> B x = B' x\"\n  shows \"add f : ((x : A) \\<Rightarrow> (y : B' x) \\<Rightarrow> C x y) \\<Rightarrow> (x : A) \\<Rightarrow> (y : B' x) \\<Rightarrow> C x y\"\n  apply (rule app_dep_type'[where ?t=\"add\" and ?u=\"f\"])\n    apply (rule add_type)\n    apply (rule f_type)\n  (*subtyping*)\n  apply assumption\n  apply (rule Dep_fun_typeI)+\n    apply (rule app_dep_type''[where ?t=\"f x\" and ?u=y for x y])\n      apply (rule app_dep_type''[where ?t=\"f\" and ?u=x for x])\n        apply assumption\n        apply assumption\n        defer\n        defer\n      apply assumption\n      defer\n      defer\n    apply assumption\n  apply (subst A_eq_B)\n  apply assumption\n  apply assumption\n  done\n\n\nsubsection \\<open>Implicit Arguments\\<close>\n\nconsts List :: \"'a type \\<Rightarrow> 'a type\"\nconsts nil :: \"'a type \\<Rightarrow> 'a\"\nconsts cons :: \"'a type \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n\nlemma nil_type: \"nil : (A : Any) \\<Rightarrow> List A\"\n  sorry\n\nlemma cons_type: \"cons : (A : Any) \\<Rightarrow> A \\<Rightarrow> List A \\<Rightarrow> List A\"\n  sorry\n\nschematic_goal\n  \"?A : ?TA \\<Longrightarrow> x : ?TX \\<Longrightarrow> ?B : ?TB \\<Longrightarrow> cons ?A x (nil ?B) : ?T\"\n  apply (rule app_dep_type''[where ?t=\"cons A x\" and ?u=\"nil B\" for A B])\n    apply (rule app_dep_type''[where ?t=\"cons A\" and ?u=\"x\" for A])\n      apply (rule app_dep_type''[where ?t=\"cons\" and ?u=\"A\" for A])\n        apply (rule cons_type)\n        apply assumption\n        defer\n      apply assumption\n      defer\n    apply (rule app_dep_type''[where ?t=nil and ?u=B for B])\n      apply (rule nil_type)\n      apply assumption\n      defer\n    defer\n  (*subtyping*)\n  apply (rule Any_typeI)\n  defer\n  apply (rule Any_typeI)\n  apply assumption\n  apply assumption\n  done\n\nschematic_goal\n  \"?A : ?TA \\<Longrightarrow> x : ?TX \\<Longrightarrow> ?B : ?TB \\<Longrightarrow> cons ?A x (nil ?B) : ?T\"\n  apply (rule app_dep_type[where ?t=\"cons A x\" and ?u=\"nil B\" for A B])\n    apply (rule app_dep_type[where ?t=\"cons A\" and ?u=\"x\" for A])\n      apply (rule app_dep_type[where ?t=\"cons\" and ?u=\"A\" for A])\n        apply (rule cons_type)\n        apply (rule Any_typeI)\n      apply assumption\n    apply (rule app_dep_type[where ?t=nil and ?u=B for B])\n      (*Problem: when matching `nil ?B : List ?A = nil ?B : ?C ?B`,\n        the higher-order unifier picks `?C=\\<lambda>x. ?x` and `?B = List ?A`*)\n      apply (rule nil_type)\n      apply (rule Any_typeI)\n   oops\n\nschematic_goal \"?A : ?TA \\<Longrightarrow> B : ?TB \\<Longrightarrow> nil ?A = B : ?T\"\n  apply (rule app_dep_type''[where ?t=\"(=) (nil A)\" for A])\n    apply (rule app_dep_type''[where ?t=\"(=)\"])\n      apply (rule eq_type)\n      apply (rule app_dep_type''[where ?t=\"nil\"])\n        apply (rule nil_type)\n        apply assumption\n        defer\n      defer\n    apply assumption\n    defer\n  (*subtyping*)\n  apply (rule Any_typeI)\n  apply assumption\n  apply assumption\n  done\n\nexperiment\n  fixes Element :: \"'a \\<Rightarrow> 'a type\"\n  and nat :: \"'a\"\n  and zero :: \"'a\" (\"0\")\n  and succ :: \"'a \\<Rightarrow> 'a\"\n  and add :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  and vec :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  and vnil :: \"'a \\<Rightarrow> 'a\"\n  and vcons :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  and vappend :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  assumes vec_type: \"vec: Any \\<Rightarrow> Element nat \\<Rightarrow> Any\"\n  and vnil_type: \"vnil : (A : Any) \\<Rightarrow> Element (vec A 0)\"\n  and vcons_type: \"vcons: (A : Any) \\<Rightarrow> (n : Element nat) \\<Rightarrow>\n    Element A \\<Rightarrow> Element (vec A n) \\<Rightarrow> Element (vec A (succ n))\"\n  and add_type: \"add: Element nat \\<Rightarrow> Element nat \\<Rightarrow> Element nat\"\n  and succ_type: \"succ: Element nat \\<Rightarrow> Element nat\"\n  and zero_type: \"0: Element nat\"\n  and vappend_type: \"vappend: (A : Any) \\<Rightarrow> (n : Element nat) \\<Rightarrow> (m : Element nat) \\<Rightarrow>\n    Element (vec A n) \\<Rightarrow> Element (vec A m) \\<Rightarrow> Element (vec A (add n m))\"\n  and add_succ_eq_succ_add: \"add (succ n) m = succ (add n m)\"\nbegin\n\ntext \\<open>The base 'a of the vector and the dimensions are completely inferred:\\<close>\n\nschematic_goal\n  \"?A1 : ?TA1 \\<Longrightarrow> ?A2 : ?TA2 \\<Longrightarrow> ?A3 : ?TA3 \\<Longrightarrow> ?A4 : ?TA4 \\<Longrightarrow>\n  ?n1 : ?Tn1 \\<Longrightarrow> ?n2 : ?Tn2 \\<Longrightarrow> ?n3 : ?Tn3 \\<Longrightarrow> ?n4 : ?Tn4 \\<Longrightarrow>\n  ?m1 : ?Tm1 \\<Longrightarrow> ?m2 : ?Tm2 \\<Longrightarrow> ys : ?Tys \\<Longrightarrow> x : ?Tx \\<Longrightarrow> xs : ?Txs \\<Longrightarrow>\n  vappend ?A1 ?n1 ?m1 (vcons ?A2 ?n2 x xs) ys = vcons ?A3 ?n3 x (vappend ?A4 ?n4 ?m2 xs ys) : ?T\"\n  apply (rule app_dep_type''[where ?t=\"(=) (vappend A1 n1 m1 (vcons A2 n2 x xs) ys)\" for A1 n1 m1 A2 n2])\n    apply (rule app_dep_type''[where ?t=\"(=)\"])\n      apply (rule eq_type)\n      apply (rule app_dep_type''[where ?t=\"vappend A1 n1 m1 (vcons A2 n2 x xs)\" for A1 n1 m1 A2 n2])\n        apply (rule app_dep_type''[where ?t=\"vappend A1 n1 m1\" for A1 n1 m1])\n          apply (rule app_dep_type''[where ?t=\"vappend A1 n1\" for A1 n1])\n            apply (rule app_dep_type''[where ?t=\"vappend A1\" for A1])\n              apply (rule app_dep_type''[where ?t=\"vappend\"])\n                apply (rule vappend_type)\n                apply (assumption)\n                defer\n              (*unify constraints for matching meta variables*)\n              apply (tactic \\<open>rotate_tac 4 1\\<close>, assumption)\n              defer\n            apply (tactic \\<open>rotate_tac 8 1\\<close>, assumption)\n            defer\n          apply (rule app_dep_type''[where ?t=\"vcons A2 n2 x\" for A2 n2])\n            apply (rule app_dep_type''[where ?t=\"vcons A2 n2\" for A2 n2])\n              apply (rule app_dep_type''[where ?t=\"vcons A2\" for A2])\n                apply (rule app_dep_type''[where ?t=\"vcons\"])\n                  apply (rule vcons_type)\n                  apply (tactic \\<open>rotate_tac 1 1\\<close>, assumption)\n                  defer\n                apply (tactic \\<open>rotate_tac 5 1\\<close>, assumption)\n                defer\n              apply (tactic \\<open>rotate_tac 10 1\\<close>, assumption)\n              defer\n            apply (tactic \\<open>rotate_tac 11 1\\<close>, assumption)\n            defer\n          defer\n        apply (tactic \\<open>rotate_tac 10 1\\<close>, assumption)\n        defer\n      defer\n    apply (rule app_dep_type''[where ?t=\"vcons A3 n3 x\" for A3 n3])\n      apply (rule app_dep_type''[where ?t=\"vcons A3 n3\" for A3 n3])\n        apply (rule app_dep_type''[where ?t=\"vcons A3\" for A3])\n          apply (rule app_dep_type''[where ?t=\"vcons\"])\n            apply (rule vcons_type)\n            apply (tactic \\<open>rotate_tac 2 1\\<close>, assumption)\n            defer\n          apply (tactic \\<open>rotate_tac 6 1\\<close>, assumption)\n          defer\n        apply (tactic \\<open>rotate_tac 11 1\\<close>, assumption)\n        defer\n      apply (rule app_dep_type''[where ?t=\"vappend A4 n4 m2 xs\" for A4 n4 m2])\n        apply (rule app_dep_type''[where ?t=\"vappend A4 n4 m2\" for A4 n4 m2])\n          apply (rule app_dep_type''[where ?t=\"vappend A4 n4\" for A4 n4])\n            apply (rule app_dep_type''[where ?t=\"vappend A4\" for A4])\n              apply (rule app_dep_type''[where ?t=\"vappend\"])\n                apply (rule vappend_type)\n                apply (tactic \\<open>rotate_tac 3 1\\<close>, assumption)\n                defer\n              apply (tactic \\<open>rotate_tac 7 1\\<close>, assumption)\n              defer\n            apply (tactic \\<open>rotate_tac 9 1\\<close>, assumption)\n            defer\n          apply (tactic \\<open>rotate_tac 12 1\\<close>, assumption)\n          defer\n        apply (tactic \\<open>rotate_tac 10 1\\<close>, assumption)\n        defer\n      defer\n    defer\n  (*subtyping*)\n  apply (rule Any_typeI)\n  apply (tactic \\<open>rotate_tac 4 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 8 1\\<close>, assumption)\n  apply (rule Any_typeI)\n  apply (tactic \\<open>rotate_tac 5 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 11 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 12 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 15 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 10 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 14 1\\<close>, assumption)\n  apply (rule Any_typeI)\n  apply (tactic \\<open>rotate_tac 6 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 11 1\\<close>, assumption)\n  apply (rule Any_typeI)\n  apply (tactic \\<open>rotate_tac 7 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 9 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 12 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 10 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 15 1\\<close>, assumption)\n  apply (tactic \\<open>rotate_tac 14 1\\<close>)\n  apply (simp only: add_succ_eq_succ_add)\n  done\n  (*assumptions can be cleaned by merging assumptions for meta variables\n    and discharging remaining assumptions by type-checker.*)\n\nschematic_goal \"g : ?Tg \\<Longrightarrow> ?y1 : ?Ty1 \\<Longrightarrow> ?y2 : ?Ty2 \\<Longrightarrow> x : ?Tx \\<Longrightarrow> xs : ?Txs\n  \\<Longrightarrow> g (vcons ?y1 ?y2 x xs) : ?T\"\n  apply (rule app_type[where ?t=g])\n    apply assumption\n    apply (rule app_dep_type[where ?t=\"vcons y1 y2 x\" for y1 y2])\n      apply (rule app_dep_type[where ?t=\"vcons y1 y2\" for y1 y2])\n        apply (rule app_dep_type[where ?t=\"vcons y1\" for y1])\n          apply (rule app_dep_type[where ?t=\"vcons\"])\n            apply (rule vcons_type)\n            apply (rule Any_typeI)\n          apply (tactic \\<open>rotate_tac 2 1\\<close>, assumption)\n        apply (tactic \\<open>rotate_tac 3 1\\<close>, assumption)\n      apply (tactic \\<open>rotate_tac 4 1\\<close>, assumption)\n   done\n\nend\n\nexperiment\n  fixes Id\n  and refl\n  and J\n  assumes Id_type: \"Id : (A : U) \\<Rightarrow> A \\<Rightarrow> A \\<Rightarrow> U\"\n  and refl_type: \"refl: (A : U) \\<Rightarrow> (x: A) \\<Rightarrow> Id A x x\"\n  and J_type: \"J: (A : U) \\<Rightarrow> (C: (x: A) \\<Rightarrow> (y: A) \\<Rightarrow>\n    (p: Id A x y) \\<Rightarrow> U) \\<Rightarrow> ((x: A) \\<Rightarrow> C x x (refl A x)) \\<Rightarrow> (a: A) \\<Rightarrow> (b: A)\n    \\<Rightarrow> (p: Id A a b) \\<Rightarrow> C a b p\"\nbegin\n\ntext \\<open>The proof term for reflexivity of equality:\\<close>\n\nschematic_goal\n  \"?A1 : ?TA1 \\<Longrightarrow> ?C1 : ?TC1 \\<Longrightarrow> ?A2 : ?TA2 \\<Longrightarrow> a : ?Ta \\<Longrightarrow> b : ?Tb \\<Longrightarrow>\n    p : ?Tp \\<Longrightarrow> J ?A1 ?C1 (refl ?A2) a b p : ?T\"\n  apply (rule app_dep_type[where ?t=\"J A1 C1 (\\<lambda>x. refl A2 x) a b\" for A1 C1 A2])\n    apply (rule app_dep_type[where ?t=\"J A1 C1 (\\<lambda>x. refl A2 x) a\" for A1 C1 A2])\n      apply (rule app_dep_type[where ?t=\"J A1 C1 (\\<lambda>x. refl A2 x)\" for A1 C1 A2])\n        apply (rule app_dep_type[where ?t=\"J A1 C1\" for A1 C1])\n          apply (rule app_dep_type[where ?t=\"J A1\" for A1])\n            apply (rule app_dep_type[where ?t=\"J\"])\n              apply (rule J_type)\n              apply assumption\n            apply (tactic \\<open>rotate_tac 1 1\\<close>, assumption)\n          apply (rule Dep_fun_typeI)\n          apply (rule app_dep_type[where ?t=\"refl A2\" for A2])\n            apply (rule app_dep_type[where ?t=\"refl\"])\n              apply (rule refl_type)\n              apply (tactic \\<open>rotate_tac 2 1\\<close>, assumption)\n            apply (tactic \\<open>rotate_tac 7 1\\<close>, assumption)\n          apply (tactic \\<open>rotate_tac 3 1\\<close>, assumption)\n        apply (tactic \\<open>rotate_tac 4 1\\<close>, assumption)\n      apply (tactic \\<open>rotate_tac 5 1\\<close>, assumption)\n  done\n\nend\n\n\n(*\nNotes:\n1. Priority of rules\n2. Priority of assumptions\n3. Specification of unification algorithm for rules?\n4. Postponing zero-priority rules (e.g. subtype conditions, additional assumptions)\n*)\n\nend", "meta": {"author": "kappelmann", "repo": "Isabelle-Set", "sha": "2ac3e1cb6bf847d413f06978b7c82e4d0c103477", "save_path": "github-repos/isabelle/kappelmann-Isabelle-Set", "path": "github-repos/isabelle/kappelmann-Isabelle-Set/Isabelle-Set-2ac3e1cb6bf847d413f06978b7c82e4d0c103477/Soft_Types/Tests/Manual_Type_Checks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765155565327, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.31820232785695696}}
{"text": "(*  Title:        C2KA: Communicating Concurrent Kleene Algebra\n    Author:       Maxime Buyse <maxime.buyse at polytechnique.edu>, 2019\n    Maintainers:  Maxime Buyse <maxime.buyse at polytechnique.edu> and Jason Jaskolka <jason.jaskolka at carleton.ca>\n*)\n\nsection \\<open>Communicating Concurrent Kleene Algebra \\label{sec:ccka}\\<close>\n\ntext \\<open>\n\\CCKAabbrv extends the algebraic foundation of \\CKAabbrv with the notions of semimodules and \nstimulus structures to capture the influence of stimuli on the behaviour of system agents.\n\nA \\CCKAabbrv is a mathematical system consisting of two semimodules which describe how a stimulus \nstructure~$\\stim$ and a \\CKAabbrv~$\\cka$ mutually act upon one another to characterize the response \ninvoked by a stimulus on an agent behaviour as a next behaviour and a next stimulus. The \n\\leftSemimodule{\\stim}~$\\ActSemimodule$ describes how the stimulus structure~$\\stim$ acts upon the \n\\CKAabbrv~$\\cka$ via the mapping~$\\actOp$. The mapping~$\\actOp$ is called the \\emph{next behaviour mapping} \nand it describes how a stimulus invokes a behavioural response from a given agent. From~$\\ActSemimodule$, \nthe next behaviour mapping~$\\actOp$ distributes over~$+$ and~$\\STIMplus$. Additionally, since~$\\ActSemimodule$ \nis unitary, it is the case that the neutral stimulus has no influence on the behaviour of all agents and \nsince~$\\ActSemimodule$ is zero-preserving, the deactivation stimulus influences all agents to become inactive. \nThe \\rightSemimodule{\\cka}~$\\OutSemimodule$ describes how the \\CKAabbrv~$\\cka$ acts upon the stimulus \nstructure~$\\stim$ via the mapping~$\\outOp$. The mapping~$\\outOp$ is called the \\emph{next stimulus mapping} \nand it describes how a new stimulus is generated as a result of the response invoked by a given stimulus on \nan agent behaviour. From~$\\OutSemimodule$, the next stimulus mapping~$\\outOp$ distributes over~$\\STIMplus$ \nand~$+$. Also, since~$\\OutSemimodule$ is unitary, it is the case that the idle agent forwards any stimulus that \nacts on it and since~$\\OutSemimodule$ is zero-preserving, the inactive agent always generates the deactivation \nstimulus. A full account of \\CCKAabbrv can be found in~\\cite{Jaskolka2015ab,Jaskolka2013aa,Jaskolka2014aa}. \n\\<close>\n\ntheory C2KA\n  imports CKA Stimuli\nbegin\n\nno_notation\ncomp (infixl \"\\<circ>\" 55)\nand rtrancl (\"(_\\<^sup>*)\" [1000] 999)\n\ntext \\<open>\nThe locale \\emph{c2ka} contains an axiomatisation of \\CCKAabbrv  and some basic theorems relying on the \naxiomatisations of stimulus structures and \\CKAabbrv provided in Sections~\\ref{sec:stimulus_structure} \nand~\\ref{sec:behaviour_structure}, respectively. We use a locale instead of a class in order to allow \nstimuli and behaviours to have two different types.\n\\<close>\n\nlocale c2ka =\n  fixes next_behaviour :: \"'b::stimuli \\<Rightarrow> 'a::cka \\<Rightarrow> 'a\" (infixr \"\\<circ>\" 75)\n  and next_stimulus :: \"('b::stimuli \\<times> 'a::cka) \\<Rightarrow> 'b\" (\"\\<lambda>\")\n  assumes lsemimodule1 [simp]: \"s \\<circ> (a + b) = (s \\<circ> a) + (s \\<circ> b)\"\n  and lsemimodule2 [simp]: \"(s \\<oplus> t) \\<circ> a = (s \\<circ> a) + (t \\<circ> a)\"\n  and lsemimodule3 [simp]: \"(s \\<odot> t) \\<circ> a = s \\<circ> (t \\<circ> a)\"\n  and lsemimodule4 [simp]: \"\\<nn> \\<circ> a = a\"\n  and lsemimodule5 [simp]: \"\\<dd> \\<circ> a = 0\"\n  and rsemimodule1 [simp]: \"\\<lambda>(s \\<oplus> t, a) = \\<lambda>(s, a) \\<oplus> \\<lambda>(t, a)\"\n  and rsemimodule2 [simp]: \"\\<lambda>(s, a + b) = \\<lambda>(s, a) \\<oplus> \\<lambda>(s, b)\"\n  and rsemimodule3 [simp]: \"\\<lambda>(s, a ; b) = \\<lambda>(\\<lambda>(s, a), b)\"\n  and rsemimodule4 [simp]: \"\\<lambda>(s, 1) = s\"\n  and rsemimodule5 [simp]: \"\\<lambda>(s, 0) = \\<dd>\"\n  and cascadingaxiom [simp]: \"s \\<circ> (a ; b) = (s \\<circ> a);(\\<lambda>(s, a) \\<circ> b)\"\n  and cascadingoutputlaw: \"a \\<le>\\<^sub>\\<K> c \\<or> b = 1 \\<or> (s \\<circ> a);(\\<lambda>(s,c) \\<circ> b) = 0\"\n  and sequentialoutputlaw [simp]: \"\\<lambda>(s \\<odot> t, a) = \\<lambda>(s, t\\<circ>a) \\<odot> \\<lambda>(t, a)\"\n  and onefix: \"s = \\<dd> \\<or> s \\<circ> 1 = 1\"\n  and neutralunmodified: \"a = 0 \\<or> \\<lambda>(\\<nn>, a) = \\<nn>\"\nbegin\n\ntext \\<open>\nLemmas \\emph{inf-K-S-next-behaviour} and \\emph{inf-K-S-next-stimulus} show basic results from the axiomatisation of \\CCKAabbrv.\n\\<close>\n\nlemma inf_K_S_next_behaviour: \"(a \\<le>\\<^sub>\\<K> b \\<and> s \\<le>\\<^sub>\\<S> t) \\<Longrightarrow> (s \\<circ> a \\<le>\\<^sub>\\<K> t \\<circ> b)\"\n  unfolding Stimuli.leq_def CKA.leq_def\nproof -\n  assume hyp: \"a + b = b \\<and> s \\<oplus> t = t\"\n  hence \"s \\<circ> a + t \\<circ> b = s \\<circ> a + (s \\<oplus> t) \\<circ> b\" by simp\n  hence \"s \\<circ> a + t \\<circ> b = s \\<circ> a + s \\<circ> b + t \\<circ> b\" by (simp add: algebra_simps)\n  moreover have \"s \\<circ> (a + b) = s \\<circ> a + s \\<circ> b\" by simp\n  ultimately have \"s \\<circ> a + t \\<circ> b = s \\<circ> (a + b) + t \\<circ> b\" by simp\n  hence \"s \\<circ> a + t \\<circ> b = s \\<circ> b + t \\<circ> b\" by (simp add: hyp)\n  hence \"s \\<circ> a + t \\<circ> b = (s \\<oplus> t) \\<circ> b\" by simp\n  thus \"s \\<circ> a + t \\<circ> b = t \\<circ> b\" by (simp add: hyp)\nqed\n\nlemma inf_K_S_next_stimulus: \"a \\<le>\\<^sub>\\<K> b \\<and> s \\<le>\\<^sub>\\<S> t \\<Longrightarrow> \\<lambda>(s,a) \\<le>\\<^sub>\\<S> \\<lambda>(t,b)\"\n  unfolding Stimuli.leq_def CKA.leq_def\nproof -\n  assume hyp: \"a + b = b \\<and> s \\<oplus> t = t\"\n  hence \"\\<lambda>(s,a) \\<oplus> \\<lambda>(t,b) = \\<lambda>(s,a) \\<oplus> \\<lambda>(s\\<oplus>t,b)\" by simp\n  hence \"\\<lambda>(s,a) \\<oplus> \\<lambda>(t,b) = \\<lambda>(s,a) \\<oplus> \\<lambda>(s,b) \\<oplus> \\<lambda>(t,b)\" by (simp add: add_assoc)\n  moreover have \"\\<lambda>(s,a+b) = \\<lambda>(s,a) \\<oplus> \\<lambda>(s,b)\" by simp\n  ultimately have \"\\<lambda>(s,a) \\<oplus> \\<lambda>(t,b) = \\<lambda>(s,a+b) \\<oplus> \\<lambda>(t,b)\" by simp\n  hence \"\\<lambda>(s,a) \\<oplus> \\<lambda>(t,b) = \\<lambda>(s,b) \\<oplus> \\<lambda>(t,b)\" by (simp add: hyp)\n  hence \"\\<lambda>(s,a) \\<oplus> \\<lambda>(t,b) = \\<lambda>(s\\<oplus>t,b)\" by simp\n  thus \"\\<lambda>(s,a) \\<oplus> \\<lambda>(t,b) = \\<lambda>(t,b)\" by (simp add: hyp)\nqed\n\ntext \\<open>\nThe following lemmas show additional results from the axiomatisation of \\CCKAabbrv which follow from lemmas \\emph{inf-K-S-next-behaviour} and \\emph{inf-K-S-next-stimulus}.\n\\<close>\n\nlemma inf_K_next_behaviour: \"a \\<le>\\<^sub>\\<K> b \\<Longrightarrow> s \\<circ> a \\<le>\\<^sub>\\<K> s \\<circ> b\"\n  by (simp add: inf_K_S_next_behaviour)\n\nlemma inf_S_next_behaviour: \"s \\<le>\\<^sub>\\<S> t \\<Longrightarrow> s \\<circ> a \\<le>\\<^sub>\\<K> t \\<circ> a\"\n  by (simp add: inf_K_S_next_behaviour)\n\nlemma inf_add_seq_par_next_behaviour: \"s \\<circ> (a;b + b;a) \\<le>\\<^sub>\\<K> s \\<circ> (a*b)\"\n  using inf_K_next_behaviour add_seq_inf_par by blast\n\nlemma inf_seqstar_parstar_next_behaviour: \"s \\<circ> a\\<^sup>; \\<le>\\<^sub>\\<K> s \\<circ> a\\<^sup>*\"\n  by (simp add: seqstar_inf_parstar inf_K_next_behaviour)\n\nlemma inf_S_next_stimulus: \"s \\<le>\\<^sub>\\<S> t \\<Longrightarrow> \\<lambda>(s,a) \\<le>\\<^sub>\\<S> \\<lambda>(t,a)\"\n  by (simp add: inf_K_S_next_stimulus)\n\nlemma inf_K_next_stimulus: \"a \\<le>\\<^sub>\\<K> b \\<Longrightarrow> \\<lambda>(s,a) \\<le>\\<^sub>\\<S> \\<lambda>(s,b)\"\n  by (simp add: inf_K_S_next_stimulus)\n\nlemma inf_add_seq_par_next_stimulus: \"\\<lambda>(s, a;b + b;a) \\<le>\\<^sub>\\<S> \\<lambda>(s, a*b)\"\nproof -\n  have \"a;b \\<le>\\<^sub>\\<K> a*b\" by (rule seq_inf_par)\n  moreover have \"b;a \\<le>\\<^sub>\\<K> b*a\" by (rule seq_inf_par)\n  ultimately have \"a;b + b;a \\<le>\\<^sub>\\<K> a*b + b*a\" by (simp add: add_mono)\n  hence \"a;b + b;a \\<le>\\<^sub>\\<K> a*b\" by (simp add: par_comm)\n  thus \"\\<lambda>(s, a;b + b;a) \\<le>\\<^sub>\\<S> \\<lambda>(s, a*b)\" by (rule inf_K_next_stimulus)\nqed\n\nlemma inf_seqstar_parstar_next_stimulus: \"\\<lambda>(s, a\\<^sup>;) \\<le>\\<^sub>\\<S> \\<lambda>(s, a\\<^sup>*)\"\n  by (simp add: seqstar_inf_parstar inf_K_next_stimulus)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/C2KA_DistributedSystems/C2KA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3182023278569569}}
{"text": "header {* Binary tree monad *}\n\ntheory Binary_Tree_Monad\nimports Monad\nbegin\n\nsubsection {* Type definition *}\n\ntycondef 'a\\<cdot>btree =\n  Leaf (lazy \"'a\") | Node (lazy \"'a\\<cdot>btree\") (lazy \"'a\\<cdot>btree\")\n\nlemma coerce_btree_abs [simp]: \"coerce\\<cdot>(btree_abs\\<cdot>x) = btree_abs\\<cdot>(coerce\\<cdot>x)\"\napply (simp add: btree_abs_def coerce_def)\napply (simp add: emb_prj_emb prj_emb_prj DEFL_eq_btree)\ndone\n\nlemma coerce_Leaf [simp]: \"coerce\\<cdot>(Leaf\\<cdot>x) = Leaf\\<cdot>(coerce\\<cdot>x)\"\nunfolding Leaf_def by simp\n\nlemma coerce_Node [simp]: \"coerce\\<cdot>(Node\\<cdot>xs\\<cdot>ys) = Node\\<cdot>(coerce\\<cdot>xs)\\<cdot>(coerce\\<cdot>ys)\"\nunfolding Node_def by simp\n\nlemma fmapU_btree_simps [simp]:\n  \"fmapU\\<cdot>f\\<cdot>(\\<bottom>::udom\\<cdot>btree) = \\<bottom>\"\n  \"fmapU\\<cdot>f\\<cdot>(Leaf\\<cdot>x) = Leaf\\<cdot>(f\\<cdot>x)\"\n  \"fmapU\\<cdot>f\\<cdot>(Node\\<cdot>xs\\<cdot>ys) = Node\\<cdot>(fmapU\\<cdot>f\\<cdot>xs)\\<cdot>(fmapU\\<cdot>f\\<cdot>ys)\"\nunfolding fmapU_btree_def btree_map_def\napply (subst fix_eq, simp)\napply (subst fix_eq, simp add: Leaf_def)\napply (subst fix_eq, simp add: Node_def)\ndone\n\nsubsection {* Class instance proofs *}\n\ninstance btree :: \"functor\"\napply default\napply (induct_tac xs rule: btree.induct, simp_all)\ndone\n\ninstantiation btree :: monad\nbegin\n\ndefinition\n  \"returnU = Leaf\"\n\nfixrec bindU_btree :: \"udom\\<cdot>btree \\<rightarrow> (udom \\<rightarrow> udom\\<cdot>btree) \\<rightarrow> udom\\<cdot>btree\"\n  where \"bindU_btree\\<cdot>(Leaf\\<cdot>x)\\<cdot>k = k\\<cdot>x\"\n  | \"bindU_btree\\<cdot>(Node\\<cdot>xs\\<cdot>ys)\\<cdot>k =\n      Node\\<cdot>(bindU_btree\\<cdot>xs\\<cdot>k)\\<cdot>(bindU_btree\\<cdot>ys\\<cdot>k)\"\n\nlemma bindU_btree_strict [simp]: \"bindU\\<cdot>\\<bottom>\\<cdot>k = (\\<bottom>::udom\\<cdot>btree)\"\nby fixrec_simp\n\ninstance proof\n  fix x :: \"udom\"\n  fix f :: \"udom \\<rightarrow> udom\"\n  fix h k :: \"udom \\<rightarrow> udom\\<cdot>btree\"\n  fix xs :: \"udom\\<cdot>btree\"\n  show \"fmapU\\<cdot>f\\<cdot>xs = bindU\\<cdot>xs\\<cdot>(\\<Lambda> x. returnU\\<cdot>(f\\<cdot>x))\"\n    by (induct xs rule: btree.induct, simp_all add: returnU_btree_def)\n  show \"bindU\\<cdot>(returnU\\<cdot>x)\\<cdot>k = k\\<cdot>x\"\n    by (simp add: returnU_btree_def)\n  show \"bindU\\<cdot>(bindU\\<cdot>xs\\<cdot>h)\\<cdot>k = bindU\\<cdot>xs\\<cdot>(\\<Lambda> x. bindU\\<cdot>(h\\<cdot>x)\\<cdot>k)\"\n    by (induct xs rule: btree.induct) simp_all\nqed\n\nend\n\nsubsection {* Transfer properties to polymorphic versions *}\n\nlemma fmap_btree_simps [simp]:\n  \"fmap\\<cdot>f\\<cdot>(\\<bottom>::'a\\<cdot>btree) = \\<bottom>\"\n  \"fmap\\<cdot>f\\<cdot>(Leaf\\<cdot>x) = Leaf\\<cdot>(f\\<cdot>x)\"\n  \"fmap\\<cdot>f\\<cdot>(Node\\<cdot>xs\\<cdot>ys) = Node\\<cdot>(fmap\\<cdot>f\\<cdot>xs)\\<cdot>(fmap\\<cdot>f\\<cdot>ys)\"\nunfolding fmap_def by simp_all\n\nlemma bind_btree_simps [simp]:\n  \"bind\\<cdot>(\\<bottom>::'a\\<cdot>btree)\\<cdot>k = \\<bottom>\"\n  \"bind\\<cdot>(Leaf\\<cdot>x)\\<cdot>k = k\\<cdot>x\"\n  \"bind\\<cdot>(Node\\<cdot>xs\\<cdot>ys)\\<cdot>k = Node\\<cdot>(bind\\<cdot>xs\\<cdot>k)\\<cdot>(bind\\<cdot>ys\\<cdot>k)\"\nunfolding bind_def\nby (simp_all add: coerce_simp)\n\nlemma return_btree_def:\n  \"return = Leaf\"\nunfolding return_def returnU_btree_def\nby (simp add: coerce_simp eta_cfun)\n\nlemma join_btree_simps [simp]:\n  \"join\\<cdot>(\\<bottom>::'a\\<cdot>btree\\<cdot>btree) = \\<bottom>\"\n  \"join\\<cdot>(Leaf\\<cdot>xs) = xs\"\n  \"join\\<cdot>(Node\\<cdot>xss\\<cdot>yss) = Node\\<cdot>(join\\<cdot>xss)\\<cdot>(join\\<cdot>yss)\"\nunfolding join_def by simp_all\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Tycon/Binary_Tree_Monad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185351961016, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.3182023195530494}}
{"text": "theory Abstract_Rbt\n  imports \"HOL-Library.RBT_Impl\"\nbegin\n\nabbreviation \"rbt_balance \\<equiv> RBT_Impl.balance\"\nabbreviation \"rbt_balance_left \\<equiv> RBT_Impl.balance_left\"\nabbreviation \"rbt_balance_right \\<equiv> RBT_Impl.balance_right\"\nabbreviation \"rbt_combine \\<equiv> RBT_Impl.combine\"\n\nabbreviation \"rbt_update k v t \\<equiv> rbt_map_entry k (\\<lambda>_. v) t\"\n\nhide_const (open) balance\nhide_const (open) balance_left\nhide_const (open) balance_right\nhide_const (open) combine\n\nabbreviation \"is_rbt_node t \\<equiv> inv1 t \\<and> inv2 t \\<and> rbt_sorted t\"\n\nsubsection \\<open>Rbt Utilities\\<close>\n\n\ndefinition \"rbt_is_red tree \\<equiv> \n  case tree of\n    (Branch color.R _ _ _ _ ) \\<Rightarrow> True |\n    _ \\<Rightarrow> False\n\"\n\n\nlemma rbt_is_red_unfold_branch [elim!]:\n  assumes \"rbt_is_red tree\"\n  obtains lhs k v rhs where \"tree = Branch color.R lhs k v rhs\"\n  using assms\n  unfolding rbt_is_red_def\n  apply (cases tree)\n  subgoal by auto\n  subgoal for c  by (cases c; auto)\n  done\n\n\ndefinition \"rbt_is_black tree \\<equiv> \n  case tree of\n    (rbt.Branch color.B _ _ _ _ ) \\<Rightarrow> True |\n    rbt.Empty \\<Rightarrow> True |\n    _ \\<Rightarrow> False\n\"\n\n\nlemma rbt_is_black_cases [elim!]:\n  assumes\n    \"rbt_is_black tree\"\n    \"tree = rbt.Empty \\<Longrightarrow> thesis\"\n    \"EX l k v r. tree = (rbt.Branch color.B l k v r) \\<Longrightarrow> thesis\"\n  shows \"thesis\"\n  using assms\n  unfolding rbt_is_black_def\n  by (auto split: color.splits rbt.splits)\n  \n\nlemma rbt_is_black_branchE [elim!]:\n  assumes \n    \"rbt_is_black (rbt.Branch c l k v r)\"\n    \"c = color.B \\<Longrightarrow> thesis\"\n  shows \"thesis\"\n  using assms by auto\n\n\ndefinition \"rbt_is_branch tree \\<equiv> \n  (case tree of rbt.Empty \\<Rightarrow> False | _ \\<Rightarrow> True)\"\n\n\nlemma rbt_is_branch_unfold [elim!]:\n  assumes \"rbt_is_branch tree\"\n  obtains c lhs k v rhs where \"tree = Branch c lhs k v rhs\"\n  using assms\n  unfolding rbt_is_branch_def\n  by (cases tree; auto)\n\n\ndefinition \"rbt_left node \\<equiv> case node of (Branch _ lhs _ _ _) \\<Rightarrow> lhs\" \ndefinition \"rbt_right node \\<equiv> case node of (Branch _ _ _ _ rhs) \\<Rightarrow> rhs\"\n\n\nabbreviation \"rbt_key_set t \\<equiv> set (RBT_Impl.keys t)\"\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Abstract_Rbt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3182023195530493}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory BinarySearch\nimports \"AutoCorres.AutoCorres\" \"AutoCorres.DataStructures\"\nbegin\n\nexternal_file \"binary_search.c\"\ninstall_C_file \"binary_search.c\"\n\nautocorres [ts_rules = nondet, unsigned_word_abs=binary_search] \"binary_search.c\"\n\ncontext binary_search begin\n\nlemma uint_of_nat:\n    \"uint (of_nat x :: 'a::len word) = (int x) mod 2^ len_of TYPE('a)\"\n  apply (clarsimp simp only: uint_nat unat_of_nat)\n  apply (metis of_nat_numeral semiring_1_class.of_nat_power zmod_int)\n  done\n\nlemma ptr_add_uint_of_nat [simp]:\n    \"p +\\<^sub>p uint (of_nat x :: addr) = p +\\<^sub>p int x\"\n  apply (subst uint_of_nat)\n  apply (unfold CTypesDefs.ptr_add_def)\n  apply (metis (opaque_lifting, no_types) uint_of_nat of_int_of_nat_eq of_int_uint)\n  done\n\nlemmas [simp] = sint_ucast_eq_uint is_up is_down\n\n\nprimrec\n  array :: \"lifted_globals \\<Rightarrow> word32 ptr \\<Rightarrow> word32 list \\<Rightarrow> bool\"\nwhere\n    \"array s p [] = True\"\n  | \"array s p (x#xs) = ((heap_w32 s p = x) \\<and> (is_valid_w32 s p) \\<and> array s (p +\\<^sub>p 1) xs)\"\n\ndefinition\n  \"is_array s p n \\<equiv> \\<exists>l. array s p l \\<and> length l = n\"\n\ndefinition\n  \"the_array s p n \\<equiv> (THE l. length l = n \\<and> array s p l)\"\n\nlemma array_unique:\n    \"\\<lbrakk> array s p l; array s p l'; length l = length l' \\<rbrakk> \\<Longrightarrow> l = l'\"\n  apply (induct l arbitrary: l' p)\n   apply clarsimp\n  apply (case_tac l')\n   apply clarsimp\n   apply clarsimp\n  done\n\nlemma array_concat [simp]:\n  \"array s p (a @ b) = (array s p a \\<and> array s (p +\\<^sub>p int (length a)) b)\"\n  apply (induct a arbitrary: p)\n   apply clarsimp\n  apply clarsimp\n  apply atomize\n  apply (erule_tac x=\"p +\\<^sub>p 1\" in allE)\n  apply (clarsimp simp: CTypesDefs.ptr_add_def field_simps)\n  done\n\nlemma array_is_array: \"array s p a \\<Longrightarrow> is_array s p (length a)\"\n  apply (clarsimp simp: is_array_def)\n  apply force\n  done\n\nlemma array_the_array: \"\\<lbrakk> array s p a; length a = n \\<rbrakk> \\<Longrightarrow> the_array s p n = a\"\n  apply (simp add: the_array_def)\n  apply (metis (lifting, mono_tags) array_unique the_equality)\n  done\n\nlemma length_the_array [simp]: \"is_array s p n \\<Longrightarrow> length (the_array s p n) = n\"\n  apply (induct n arbitrary: n)\n   apply (clarsimp simp: is_array_def)\n   apply (metis array_the_array)\n  apply (clarsimp simp: is_array_def)\n  done\n\nlemma the_array_Suc:\n  \"\\<lbrakk> is_array s p n; n > 0 \\<rbrakk> \\<Longrightarrow> the_array s p n = (heap_w32 s p) # (the_array s (p +\\<^sub>p 1) (n - 1))\"\n  apply (clarsimp simp: is_array_def)\n  apply (case_tac l)\n   apply clarsimp\n  apply clarsimp\n  apply (metis One_nat_def Suc_eq_plus1 list.size(4) array.simps(2) array_the_array)\n  done\n\nlemma the_array_0 [simp]:\n  \"the_array s p 0 = []\"\n  by (metis list.size(3) array.simps(1) array_the_array)\n\nlemma is_array_0 [simp]:\n  \"is_array s p 0\"\n  apply (clarsimp simp: is_array_def)\n  done\n\nlemma is_array_Suc:\n  \"\\<lbrakk> is_array s p n; is_valid_w32 s (p +\\<^sub>p int n) \\<rbrakk> \\<Longrightarrow>\n      is_array s p (Suc n)\"\n  apply (clarsimp simp: is_array_def)\n  apply (rule_tac x=\"l @ [heap_w32 s (p +\\<^sub>p int (length l))]\" in exI)\n  apply clarsimp\n  done\n\nlemma array_expand: \"array s p n \\<Longrightarrow> array s (p +\\<^sub>p 1) (tl n)\"\n  apply (case_tac n)\n   apply clarsimp\n  apply clarsimp\n  done\n\nlemma array_Ex:\n  \"\\<lbrakk> array s p n; 0 \\<le> i; i < int (length n) \\<rbrakk> \\<Longrightarrow> is_valid_w32 s (p +\\<^sub>p i)\"\n  apply (induct n arbitrary: p i)\n   apply clarsimp\n  apply clarsimp\n  apply atomize\n  apply (erule_tac x=\"p +\\<^sub>p 1\" in allE)\n  apply (erule_tac x=\"i - 1\" in allE)\n  apply (clarsimp simp: CTypesDefs.ptr_add_def)\n  done\n\nlemma sorted_index_lt:\n  \"\\<lbrakk> sorted xs; unat (xs ! m) < v; n \\<le> m; m < length xs \\<rbrakk> \\<Longrightarrow>  unat (xs ! n) < v\"\n  by (meson le_less_trans sorted_nth_mono unat_arith_simps(1))\n\nlemma sorted_index_gt:\n    \"\\<lbrakk> sorted xs; v < unat (xs ! m); m \\<le> n; n < length xs \\<rbrakk> \\<Longrightarrow>  v < unat (xs ! n)\"\n  by (metis le_less_linear le_less_trans less_irrefl sorted_nth_mono word_less_nat_alt)\n\nlemma array_access_to_list_access:\n    \"\\<lbrakk> array s p data; n < length data \\<rbrakk> \\<Longrightarrow> (heap_w32 s (p +\\<^sub>p int n)) = data ! n\"\n  apply (induct data arbitrary: n p)\n   apply clarsimp\n  apply (case_tac \"n = 0\")\n   apply clarsimp\n  apply atomize\n  apply (erule_tac x=\"n - 1\" in allE)\n  apply (erule_tac x=\"p +\\<^sub>p 1\" in allE)\n  apply (erule impE)\n   apply clarsimp\n  apply (erule impE)\n   apply clarsimp\n   apply arith\n  apply (clarsimp simp: field_simps CTypesDefs.ptr_add_def)\n  done\n\nlemma binary_search_correct:\n  \"\\<lbrace> \\<lambda>s. array s arr data \\<and> length data < 1000000000 \\<and> n = length data \\<and> sorted data \\<rbrace>\n           binary_search' arr n v\n        \\<lbrace> \\<lambda>r s. r \\<noteq> 0 \\<longleftrightarrow> v \\<in> unat ` set data \\<rbrace>!\"\n  apply (rule validNF_assume_pre)\n  apply (unfold binary_search'_def)\n  apply (case_tac \"n = 0\")\n   apply (subst whileLoop_add_inv [where I=\"\\<lambda>(f, l, r) _. f = 0 \\<and> l = 0 \\<and> r = 0\" and M=\"\\<lambda>_. 0\"])\n   apply ((wp | clarsimp)+)[1]\n  apply (subst whileLoop_add_inv [where\n        I=\"\\<lambda>(found, l, r) s. array s arr data  \\<and> (r \\<le> n)\n                \\<and> (\\<forall>i. i < l \\<longrightarrow> i < n \\<longrightarrow> unat (data ! i) <  v)\n                \\<and> (\\<forall>i. i \\<ge> r \\<longrightarrow> i < n \\<longrightarrow> v < unat (data ! i))\n                \\<and> (found \\<noteq> 0 \\<longrightarrow> v \\<in> unat ` set data)\"\n          and  M=\"\\<lambda>((found, l, r), s). if found = 0 then 1 + (r - l) else 0\" ])\n  apply wp\n     apply (clarsimp split del: if_split cong: if_cong\n       simp: field_simps array_access_to_list_access array_Ex UINT_MAX_def)\n    apply (subgoal_tac \"aa \\<le> ((aa + b)  div 2) \\<and> ((aa + b) div 2) \\<le> b\")\n     apply (case_tac \"unat (data ! ((aa + b) div 2)) = v\")\n      apply (clarsimp simp: UINT_MAX_def INT_MAX_def)\n     apply (case_tac \"unat (data ! ((aa + b) div 2)) < v\")\n      apply (auto elim: sorted_index_lt simp: UINT_MAX_def INT_MAX_def cong: if_cong)[1]\n     apply (subgoal_tac \"unat (data ! ((aa + b) div 2)) > v\")\n      apply (clarsimp simp: UINT_MAX_def INT_MAX_def)\n      apply (fastforce elim: sorted_index_gt)\n     apply force\n    apply force\n   apply (clarsimp split del: if_split simp: field_simps cong: if_cong)\n   apply rule\n    apply clarsimp\n   apply clarsimp\n   apply (metis (no_types) in_set_conv_nth le_less_trans neq_iff not_less)\n  apply clarsimp\n  done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/tests/examples/BinarySearch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3182023195530493}}
{"text": "theory \"NS_Public_cert_auto\"\nimports\n  \"ESPLogic\"\nbegin\n\n(* section:  The Needham-Schroeder-Lowe Public-Key Protocol  *)\n\n(* text: \n  Modeled after the description by Paulson in Isabelle/HOL/Auth/NS_Public.thy.\n\n  Notable differences:\n    \n    1. We are using explicit global constants for discerning the different\n       encryption instead of the implicit typing.\n *)\n\nrole I\nwhere \"I =\n  [ Send ''1'' ( PEnc <| sC ''1'', sN ''ni'', sAV ''I'' |> ( sPK ''R'' ) )\n  , Recv ''2'' ( PEnc <| sC ''2'', sN ''ni'', sMV ''nr'', sAV ''R'' |>\n                      ( sPK ''I'' )\n               )\n  , Send ''3'' ( PEnc <| sC ''3'', sMV ''nr'' |> ( sPK ''R'' ) )\n  ]\"\n\nrole R\nwhere \"R =\n  [ Recv ''1'' ( PEnc <| sC ''1'', sMV ''ni'', sMV ''I'' |> ( sPK ''R'' ) )\n  , Send ''2'' ( PEnc <| sC ''2'', sMV ''ni'', sN ''nr'', sAV ''R'' |>\n                      ( PAsymPK ( sMV ''I'' ) )\n               )\n  , Recv ''3'' ( PEnc <| sC ''3'', sN ''nr'' |> ( sPK ''R'' ) )\n  ]\"\n\nprotocol ns_public\nwhere \"ns_public = { I, R }\"\n\nlocale restricted_ns_public_state = ns_public_state\n\ntype_invariant ns_public_msc_typing for ns_public\nwhere \"ns_public_msc_typing = mk_typing\n  [ ((R, ''I''), (SumT (KnownT R_1) AgentT))\n  , ((R, ''ni''), (SumT (KnownT R_1) (NonceT I ''ni'')))\n  , ((I, ''nr''), (SumT (KnownT I_2) (NonceT R ''nr'')))\n  ]\"\n\nsublocale ns_public_state < ns_public_msc_typing_state\nproof -\n  have \"(t,r,s) : approx ns_public_msc_typing\"\n  proof(cases rule: reachable_in_approxI_ext\n        [OF ns_public_msc_typing.monoTyp, completeness_cases_rule])\n    case (I_2_nr t r s tid0)\n    then interpret state: ns_public_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = I_2_nr\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''2'', LN ''ni'' tid0, s(MV ''nr'' tid0), s(AV ''R'' tid0) |}\n            ( PK ( s(AV ''I'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (R_1_I t r s tid0)\n    then interpret state: ns_public_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = R_1_I\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''1'', s(MV ''ni'' tid0), s(MV ''I'' tid0) |}\n            ( PK ( s(AV ''R'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (R_1_ni t r s tid0)\n    then interpret state: ns_public_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = R_1_ni\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''1'', s(MV ''ni'' tid0), s(MV ''I'' tid0) |}\n            ( PK ( s(AV ''R'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  qed\n  thus \"ns_public_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext ns_public_state begin\n\n  (* This rule is unsafe in general, but OK here, \n     as we are only reasoning about static compromise. \n  *)\n  lemma static_longterm_key_reveal[dest!]:\n    \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n    by (auto intro: compr_predOrdI)\n\n  lemma longterm_private_key_secrecy:\n    assumes facts:\n      \"SK m : knows t\"\n      \"RLKR m ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"SK m\")\n\n  lemma longterm_sym_ud_key_secrecy:\n    assumes facts:\n      \"K m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"K m1 m2\")\n\n  lemma longterm_sym_bd_key_secrecy:\n    assumes facts:\n      \"Kbd m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n      \"m1 : Agent\"\n      \"m2 : Agent\"\n    shows \"False\"\n  proof -\n    from facts \n    have \"KShr (agents {m1, m2}) : knows t\"\n      by (auto simp: Kbd_def)\n    thus ?thesis using facts\n    proof (sources \"KShr (agents {m1, m2})\")\n    qed (auto simp: agents_def Agent_def)\n  qed\n\n  lemmas ltk_secrecy =\n    longterm_sym_ud_key_secrecy\n    longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n    longterm_sym_bd_key_secrecy\n    longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n    longterm_private_key_secrecy\n    longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection:  Secrecy Properties  *)\n\nlemma (in restricted_ns_public_state) I_ni_secrecy:\n  assumes facts:\n    \"roleMap r tid0 = Some I\"\n    \"RLKR(s(AV ''I'' tid0)) ~: reveals t\"\n    \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n    \"LN ''ni'' tid0 : knows t\"\n  shows \"False\"\nusing facts proof(sources! \" LN ''ni'' tid0 \")\n  case I_1_ni note_unified facts = this facts\n  thus ?thesis by (auto dest!: ltk_secrecy)\nnext\n  case (R_2_ni tid1) note_unified facts = this facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''1'', LN ''ni'' tid0, s(MV ''I'' tid1) |}\n                       ( PK ( s(AV ''R'' tid1) ) ) \")\n    case (I_1_enc tid2) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_ns_public_state) R_nr_secrecy:\n  assumes facts:\n    \"roleMap r tid0 = Some R\"\n    \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''I'' tid0)) ~: reveals t\"\n    \"LN ''nr'' tid0 : knows t\"\n  shows \"False\"\nusing facts proof(sources! \" LN ''nr'' tid0 \")\n  case (I_3_nr tid1) note_unified facts = this facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''2'', LN ''ni'' tid1, LN ''nr'' tid0, s(AV ''R'' tid1) |}\n                       ( PK ( s(AV ''I'' tid1) ) ) \")\n    case (R_2_enc tid2) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nnext\n  case R_2_nr note_unified facts = this facts\n  thus ?thesis by (auto dest!: ltk_secrecy)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_ns_public_state) I_nr_secrecy:\n  assumes facts:\n    \"roleMap r tid0 = Some I\"\n    \"RLKR(s(AV ''I'' tid0)) ~: reveals t\"\n    \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n    \"( tid0, I_2 ) : steps t\"\n    \"s(MV ''nr'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''2'', LN ''ni'' tid0, s(MV ''nr'' tid0), s(AV ''R'' tid0) |}\n                       ( PK ( s(AV ''I'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (fastforce dest: I_ni_secrecy intro: event_predOrdI)\n  next\n    case (R_2_enc tid1) note_unified facts = this facts\n    thus ?thesis by (fastforce dest: R_nr_secrecy intro: event_predOrdI)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_ns_public_state) R_ni_secrecy:\n  assumes facts:\n    \"roleMap r tid0 = Some R\"\n    \"RLKR(s(AV ''R'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''I'' tid0)) ~: reveals t\"\n    \"( tid0, R_3 ) : steps t\"\n    \"s(MV ''ni'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''3'', LN ''nr'' tid0 |} ( PK ( s(AV ''R'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (fastforce dest: R_nr_secrecy intro: event_predOrdI)\n  next\n    case (I_3_enc tid1) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''2'', LN ''ni'' tid1, LN ''nr'' tid0, s(AV ''R'' tid0) |}\n                         ( PK ( s(AV ''I'' tid1) ) ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (fastforce dest: R_nr_secrecy intro: event_predOrdI)\n    next\n      case (R_2_enc tid2) note_unified facts = this facts\n      thus ?thesis by (fastforce dest: I_ni_secrecy intro: event_predOrdI)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\n(* subsection:  Authentication Properties  *)\n\nlemma (in restricted_ns_public_state) I_ni_synch:\n  assumes facts:\n    \"roleMap r tid1 = Some I\"\n    \"RLKR(s(AV ''I'' tid1)) ~: reveals t\"\n    \"RLKR(s(AV ''R'' tid1)) ~: reveals t\"\n    \"( tid1, I_3 ) : steps t\"\n  shows\n    \"(?  tid2.\n        roleMap r tid2 = Some R &\n        s(AV ''I'' tid1) = s(MV ''I'' tid2) &\n        s(AV ''R'' tid1) = s(AV ''R'' tid2) &\n        LN ''ni'' tid1 = s(MV ''ni'' tid2) &\n        s(MV ''nr'' tid1) = LN ''nr'' tid2 &\n        predOrd t (St( tid1, I_1 )) (St( tid2, R_1 )) &\n        predOrd t (St( tid2, R_1 )) (St( tid2, R_2 )) &\n        predOrd t (St( tid2, R_2 )) (St( tid1, I_2 )) &\n        predOrd t (St( tid1, I_2 )) (St( tid1, I_3 )))\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''2'', LN ''ni'' tid1, s(MV ''nr'' tid1), s(AV ''R'' tid1) |}\n                       ( PK ( s(AV ''I'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (fastforce dest: I_ni_secrecy intro: event_predOrdI)\n  next\n    case (R_2_enc tid2) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''1'', LN ''ni'' tid1, s(AV ''I'' tid1) |}\n                         ( PK ( s(AV ''R'' tid1) ) ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (fastforce dest: I_ni_secrecy intro: event_predOrdI)\n    next\n      case (I_1_enc tid3) note_unified facts = this facts\n      thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_ns_public_state) R_ni_synch:\n  assumes facts:\n    \"roleMap r tid1 = Some R\"\n    \"RLKR(s(AV ''R'' tid1)) ~: reveals t\"\n    \"RLKR(s(MV ''I'' tid1)) ~: reveals t\"\n    \"( tid1, R_3 ) : steps t\"\n  shows\n    \"(?  tid2.\n        roleMap r tid2 = Some I &\n        s(MV ''I'' tid1) = s(AV ''I'' tid2) &\n        s(AV ''R'' tid1) = s(AV ''R'' tid2) &\n        s(MV ''ni'' tid1) = LN ''ni'' tid2 &\n        LN ''nr'' tid1 = s(MV ''nr'' tid2) &\n        predOrd t (St( tid2, I_1 )) (St( tid1, R_1 )) &\n        predOrd t (St( tid1, R_1 )) (St( tid1, R_2 )) &\n        predOrd t (St( tid1, R_2 )) (St( tid2, I_2 )) &\n        predOrd t (St( tid2, I_2 )) (St( tid2, I_3 )) &\n        predOrd t (St( tid2, I_3 )) (St( tid1, R_3 )))\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''1'', s(MV ''ni'' tid1), s(MV ''I'' tid1) |}\n                       ( PK ( s(AV ''R'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (fastforce dest: R_ni_secrecy intro: event_predOrdI)\n  next\n    case (I_1_enc tid2) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''3'', LN ''nr'' tid1 |} ( PK ( s(AV ''R'' tid1) ) ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (fastforce dest: R_nr_secrecy intro: event_predOrdI)\n    next\n      case (I_3_enc tid3) note_unified facts = this facts\n      thus ?thesis proof(sources! \"\n                       Enc {| LC ''2'', LN ''ni'' tid3, LN ''nr'' tid1, s(AV ''R'' tid1) |}\n                           ( PK ( s(AV ''I'' tid3) ) ) \")\n        case fake note_unified facts = this facts\n        thus ?thesis by (fastforce dest: R_nr_secrecy intro: event_predOrdI)\n      next\n        case (R_2_enc tid4) note_unified facts = this facts\n        thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n      qed (safe?, simp_all?, insert facts, (fastforce+)?)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/classic/isabelle-proofs/NS_Public_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3182023195530493}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Peter Lammich <peter dot lammich at uni-muenster.de>\n    Maintainer:  Peter Lammich <peter dot lammich at uni-muenster.de>\n*)\nsection {* \\isaheader{Hash Set} *}\ntheory HashSet\n  imports \n  \"../spec/SetSpec\" \n  \"HashMap\" \n  \"../gen_algo/SetByMap\" \n  \"../gen_algo/SetGA\"\nbegin\ntext_raw {*\\label{thy:HashSet}*}\n(*@impl Set\n  @type 'a::hashable hs\n  @abbrv hs,h\n  Hash sets based on red-black trees.\n*)\n\nsubsection \"Definitions\"\ntype_synonym\n  'a hs = \"('a::hashable,unit) hm\"\n\nsetup Locale_Code.open_block\ninterpretation hs_sbm: SetByMap hm_basic_ops by unfold_locales\nsetup Locale_Code.close_block\n\ndefinition hs_ops :: \"('a::hashable,'a hs) set_ops\"\n  where [icf_rec_def]:\n  \"hs_ops \\<equiv> hs_sbm.basic.dflt_ops\"\n\nsetup Locale_Code.open_block\ninterpretation hs: StdSet hs_ops\n  unfolding hs_ops_def by (rule hs_sbm.basic.dflt_ops_impl)\ninterpretation hs: StdSet_no_invar hs_ops\n  by unfold_locales (simp add: icf_rec_unf SetByMapDefs.invar_def)\nsetup Locale_Code.close_block\n\nsetup {* ICF_Tools.revert_abbrevs \"hs\"*}\n\nlemmas hs_it_to_it_map_code_unfold[code_unfold] = \n  it_to_it_map_fold'[OF pi_hm]\n\nlemma pi_hs[proper_it]: \"proper_it' hs.iteratei hs.iteratei\"\n  unfolding hs.iteratei_def[abs_def]\n  by (rule proper_it'I icf_proper_iteratorI)+\n\ninterpretation pi_hs: proper_it_loc hs.iteratei hs.iteratei\n  by unfold_locales (rule pi_hs)\n\ndefinition test_codegen where \"test_codegen \\<equiv> (\n  hs.empty,\n  hs.memb,\n  hs.ins,\n  hs.delete,\n  hs.list_it,\n  hs.sng,\n  hs.isEmpty,\n  hs.isSng,\n  hs.ball,\n  hs.bex,\n  hs.size,\n  hs.size_abort,\n  hs.union,\n  hs.union_dj,\n  hs.diff,\n  hs.filter,\n  hs.inter,\n  hs.subset,\n  hs.equal,\n  hs.disjoint,\n  hs.disjoint_witness,\n  hs.sel,\n  hs.to_list,\n  hs.from_list\n)\"\n\nexport_code test_codegen in SML\n\nend\n", "meta": {"author": "andredidier", "repo": "phd", "sha": "113f7c8b360a3914a571db13d9513e313954f4b2", "save_path": "github-repos/isabelle/andredidier-phd", "path": "github-repos/isabelle/andredidier-phd/phd-113f7c8b360a3914a571db13d9513e313954f4b2/thesis/Collections/ICF/impl/HashSet.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3182023195530493}}
{"text": "section \\<open> State Variable Declaration Parser \\<close>\n\ntheory utp_state_parser\n  imports \"utp_blocks\"\nbegin\n\ntext \\<open> This theory sets up a parser for state blocks, as an alternative way of providing lenses to\n  a predicate. A program with local variables can be represented by a predicate indexed by a tuple\n  of lenses, where each lens represents a variable. These lenses must then be supplied with respect\n  to a suitable state space. Instead of creating a type to represent this alphabet, we can create\n  a product type for the state space, with an entry for each variable. Then each variable becomes\n  a composition of the @{term fst\\<^sub>L} and @{term snd\\<^sub>L} lenses to index the correct position in the\n  variable vector. \n\n  We first creation a vacuous definition that will mark when an indexed predicate denotes a state\n  block. \\<close>\n\ndefinition state_block :: \"('v \\<Rightarrow> 'p) \\<Rightarrow> 'v \\<Rightarrow> 'p\" where\n[upred_defs]: \"state_block f x = f x\"\n\ntext \\<open> We declare a number of syntax translations to produce lens and product types, to obtain\n  a type for the overall state space, to construct a tuple that denotes the lens vector parameter, \n  to construct the vector itself, and finally to construct the state declaration. \\<close>\n\nsyntax\n  \"_lensT\" :: \"type \\<Rightarrow> type \\<Rightarrow> type\" (\"LENSTYPE'(_, _')\")\n  \"_pairT\" :: \"type \\<Rightarrow> type \\<Rightarrow> type\" (\"PAIRTYPE'(_, _')\")\n  \"_state_type\" :: \"pttrn \\<Rightarrow> type\"\n  \"_state_tuple\" :: \"type \\<Rightarrow> pttrn \\<Rightarrow> logic\"\n  \"_state_lenses\" :: \"pttrn \\<Rightarrow> logic \\<Rightarrow> logic\"\n  \"_state_decl\" :: \"pttrn \\<Rightarrow> logic \\<Rightarrow> logic\" (\"alpha _ \\<bullet> _\" [0, 10] 10) \n  \"_state_decl_in\" :: \"pttrn \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"alpha _ in _ \\<bullet> _\" [0, 0, 10] 10)\n\ntranslations\n  (type) \"PAIRTYPE('a, 'b)\" => (type) \"'a \\<times> 'b\"\n  (type) \"LENSTYPE('a, 'b)\" => (type) \"'a \\<Longrightarrow> _\"\n\n  \"_state_type (_constrain x t)\" => \"t\"\n  \"_state_type (CONST Pair (_constrain x t) vs)\" => \"_pairT t (_state_type vs)\"\n\n  \"_state_tuple st (_constrain x t)\" => \"_constrain x (_lensT t st)\"\n  \"_state_tuple st (CONST Pair (_constrain x t) vs)\" =>\n    \"CONST Product_Type.Pair (_constrain x (_lensT t st)) (_state_tuple st vs)\"\n\n  \"_state_decl_in vs loc P\" =>\n    \"CONST state_block (_abs (_state_tuple (_state_type vs) vs) P) (_state_lenses vs loc)\"\n\n  \"_state_decl vs P\" =>\n    \"CONST state_block (_abs (_state_tuple (_state_type vs) vs) P) (_state_lenses vs 1\\<^sub>L)\"\n  \"_state_decl vs P\" <= \"CONST state_block (_abs vs P) k\"\n\nML \\<open>\n\n \\<close>\n\nparse_translation \\<open>\n  let\n    open HOLogic; open Syntax;\n    fun lensT s t = Type (@{type_name lens_ext}, [s, t, HOLogic.unitT]);\n    fun lens_comp a b c = Const (@{const_syntax \"lens_comp\"}, lensT a b --> lensT b c --> lensT a c);\n    fun fst_lens t = Const (@{const_syntax \"fst_lens\"}, Type (@{type_name lens_ext}, [t, dummyT, unitT]));\n    val snd_lens = Const (@{const_syntax \"snd_lens\"}, dummyT);\n    fun id_lens t = Const (@{const_syntax \"id_lens\"},Type (@{type_name lens_ext}, [t, dummyT, unitT]));\n    fun lens_syn_typ t = const @{type_syntax lens_ext} $ t $ const @{type_syntax dummy} $ const @{type_syntax unit};\n    fun constrain t ty = const @{syntax_const \"_constrain\"} $ t $ ty;\n\n    (* Construct a tuple of n lenses, whose source type is product of the types in ts, and each lens\n       has an element of the type: prod_lens [t0, t1 ... ] 1 : t1 ==> t0 * t1 * ... *)\n    fun prod_lens ts i = \n      let open Syntax; open Library; fun lens_compf (x, y) = const @{const_name lens_comp} $ x $ y in\n      if (length ts = 1) \n      then Const (@{const_name id_lens}, lensT (nth ts i) (nth ts i))\n      else if (length ts = i + 1) \n      then foldl lens_compf (Const (@{const_name \"snd_lens\"}, lensT (nth ts i) dummyT), replicate (i-1) (const @{const_name \"snd_lens\"}))\n      else foldl lens_compf (Const (@{const_name \"fst_lens\"}, lensT (nth ts i) dummyT), replicate i (const @{const_name \"snd_lens\"}))\n      end;\n\n    (* Construct a tuple of lenses for each of the possible locally declared variables *)\n    fun state_lenses ts sty st = \n      foldr1 (fn (x, y) => pair_const dummyT dummyT $ x $ y) (map (fn i => lens_comp dummyT sty dummyT $ prod_lens ts i $ st) (upto (0, length ts - 1)));\n\n    fun\n      (* Add up the number of variable declarations in the tuple *)\n      var_decl_num (Const (@{const_syntax \"Product_Type.Pair\"},_) $ _ $ vs) = var_decl_num vs + 1 |\n      var_decl_num _ = 1;\n\n    fun\n      var_decl_typs (Const (@{const_syntax \"Product_Type.Pair\"},_) $ (Const (\"_constrain\", _) $ _ $ typ) $ vs) = Syntax_Phases.decode_typ typ :: var_decl_typs vs |\n      var_decl_typs (Const (\"_constrain\", _) $ _ $ typ) = [Syntax_Phases.decode_typ typ] |\n      var_decl_typs _ = [];\n\n    fun state_lens ctx [vs, loc] = (state_lenses (var_decl_typs vs) (mk_tupleT (var_decl_typs vs)) loc);\n  in\n  [(\"_state_lenses\", state_lens)]\n  end\n\\<close>\n\nsubsection \\<open> Variable Block Syntax \\<close>\n\ndefinition vblock :: \"(<'a, 'b> \\<Longleftrightarrow> 'c) \\<Rightarrow> ('d \\<Rightarrow> 'c hrel) \\<Rightarrow> 'd \\<Rightarrow> 'a hrel\" where\n[upred_defs]: \"vblock sl f x = open\\<^bsub>sl\\<^esub> ;; f x ;; close\\<^bsub>sl\\<^esub>\"\n\nsyntax\n  \"_var_block_in\" :: \"pttrn \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"var _ in _ \\<bullet> _\" [0, 0, 10] 10)\n\ntranslations\n  \"_var_block_in vs sl P\" => \"CONST vblock sl (_abs (_state_tuple (_state_type vs) vs) P) (_state_lenses vs \\<C>\\<^bsub>sl\\<^esub>)\"\n\nsubsection \\<open> Examples \\<close>\n\nterm \"alpha (x::int, y::real, z::int) \\<bullet> y := &x + &z\"\n\nlemma \"alpha p \\<bullet> II = II\"\n  by (rel_auto)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/utp/utp_state_parser.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5660185351961013, "lm_q1q2_score": 0.3182023195530492}}
{"text": "section \\<open>Refinement for Transition Systems\\<close>\n\ntheory Transition_System_Refine\nimports\n  \"Transition_System\"\n  \"Transition_System_Extra\"\n  \"../Basic/Refine\"\nbegin\n\n  lemma path_param[param]: \"(transition_system.path, transition_system.path) \\<in>\n    (T \\<rightarrow> S \\<rightarrow> S) \\<rightarrow> (T \\<rightarrow> S \\<rightarrow> bool_rel) \\<rightarrow> \\<langle>T\\<rangle> list_rel \\<rightarrow> S \\<rightarrow> bool_rel\"\n  proof (rule, rule)\n    fix exa exb ena enb\n    assume [param]: \"(exa, exb) \\<in> T \\<rightarrow> S \\<rightarrow> S\" \"(ena, enb) \\<in> T \\<rightarrow> S \\<rightarrow> bool_rel\"\n    interpret A: transition_system exa ena by this\n    interpret B: transition_system exb enb by this\n    have [param]: \"(A.path [] p, B.path [] q) \\<in> bool_rel\" for p q by auto\n    have [param]: \"(A.path (a # r) p, B.path (b # s) q) \\<in> bool_rel\"\n      if \"(ena a p, enb b q) \\<in> bool_rel\" \"(A.path r (exa a p), B.path s (exb b q)) \\<in> bool_rel\"\n      for a r p b s q\n      using that by auto\n    show \"(A.path, B.path) \\<in> \\<langle>T\\<rangle> list_rel \\<rightarrow> S \\<rightarrow> bool_rel\"\n    proof (intro fun_relI)\n      show \"(A.path r p, B.path s q) \\<in> bool_rel\" if \"(r, s) \\<in> \\<langle>T\\<rangle> list_rel\" \"(p, q) \\<in> S\" for r s p q\n        using that by (induct arbitrary: p q) (parametricity+)\n    qed\n  qed\n  lemma run_param[param]: \"(transition_system.run, transition_system.run) \\<in>\n    (T \\<rightarrow> S \\<rightarrow> S) \\<rightarrow> (T \\<rightarrow> S \\<rightarrow> bool_rel) \\<rightarrow> \\<langle>T\\<rangle> stream_rel \\<rightarrow> S \\<rightarrow> bool_rel\"\n  proof (rule, rule)\n    fix exa exb ena enb\n    assume 1: \"(exa, exb) \\<in> T \\<rightarrow> S \\<rightarrow> S\" \"(ena, enb) \\<in> T \\<rightarrow> S \\<rightarrow> bool_rel\"\n    interpret A: transition_system exa ena by this\n    interpret B: transition_system exb enb by this\n    show \"(A.run, B.run) \\<in> \\<langle>T\\<rangle> stream_rel \\<rightarrow> S \\<rightarrow> bool_rel\"\n    proof safe\n      show \"B.run s q\" if \"(r, s) \\<in> \\<langle>T\\<rangle> stream_rel\" \"(p, q) \\<in> S\" \"A.run r p\" for r s p q\n        using 1[param_fo] that by (coinduction arbitrary: r s p q) (blast elim: stream_rel_cases)\n      show \"A.run r p\" if \"(r, s) \\<in> \\<langle>T\\<rangle> stream_rel\" \"(p, q) \\<in> S\" \"B.run s q\" for r s p q\n        using 1[param_fo] that by (coinduction arbitrary: r s p q) (blast elim: stream_rel_cases)\n    qed\n  qed\n\n  lemma paths_param[param]:\n    assumes [param]: \"(exa, exb) \\<in> T \\<rightarrow> S \\<rightarrow> S\"\n    assumes \"(transition_system.enableds ena, transition_system.enableds enb) \\<in> S \\<rightarrow> \\<langle>T\\<rangle> set_rel\"\n    shows \"(transition_system.paths exa ena, transition_system.paths exb enb) \\<in> S \\<rightarrow> \\<langle>\\<langle>T\\<rangle> list_rel\\<rangle> set_rel\"\n  proof -\n    note assms = assms[param_fo, unfolded transition_system.enableds_def]\n    interpret A: transition_system exa ena by this\n    interpret B: transition_system exb enb by this\n    have 1: \"\\<exists> s. (r, s) \\<in> \\<langle>T\\<rangle> list_rel \\<and> B.path s q\" if \"(p, q) \\<in> S\" \"A.path r p\" for p q r\n    using that(2, 1)\n    proof (induct arbitrary: q)\n      case (nil p)\n      show ?case by auto\n    next\n      case (cons a p r)\n      obtain b where 1: \"(a, b) \\<in> T\" \"enb b q\" using assms(2) cons(1, 4) by (blast elim: set_relE1)\n      have 2: \"(exa a p, exb b q) \\<in> S\" using cons(4) 1(1) by parametricity\n      obtain s where 3: \"(r, s) \\<in> \\<langle>T\\<rangle> list_rel\" \"B.path s (exb b q)\" using cons(3) 2 by auto\n      show ?case using 1 3 by force\n    qed\n    have 2: \"\\<exists> r. (r, s) \\<in> \\<langle>T\\<rangle> list_rel \\<and> A.path r p\" if \"(p, q) \\<in> S\" \"B.path s q\" for p q s\n    using that(2, 1)\n    proof (induct arbitrary: p)\n      case (nil q)\n      show ?case by auto\n    next\n      case (cons b q s)\n      obtain a where 1: \"(a, b) \\<in> T\" \"ena a p\" using assms(2) cons(1, 4) by (blast elim: set_relE2)\n      have 2: \"(exa a p, exb b q) \\<in> S\" using cons(4) 1(1) by parametricity\n      obtain r where 3: \"(r, s) \\<in> \\<langle>T\\<rangle> list_rel\" \"A.path r (exa a p)\" using cons(3) 2 by auto\n      show ?case using 1 3 by force\n    qed\n    show ?thesis unfolding transition_system.paths_def set_rel_def using 1 2 by blast\n  qed\n  lemma runs_param[param]:\n    assumes \"(exa, exb) \\<in> T \\<rightarrow> S \\<rightarrow> S\"\n    assumes \"(transition_system.enableds ena, transition_system.enableds enb) \\<in> S \\<rightarrow> \\<langle>T\\<rangle> set_rel\"\n    shows \"(transition_system.runs exa ena, transition_system.runs exb enb) \\<in> S \\<rightarrow> \\<langle>\\<langle>T\\<rangle> stream_rel\\<rangle> set_rel\"\n  proof -\n    note assms = assms[param_fo, unfolded transition_system.enableds_def]\n    interpret A: transition_system exa ena by this\n    interpret B: transition_system exb enb by this\n    have 1: \"\\<exists> s. (r, s) \\<in> \\<langle>T\\<rangle> stream_rel \\<and> B.run s q\" if \"(p, q) \\<in> S\" \"A.run r p\" for p q r\n    proof -\n      define P where \"P \\<equiv> \\<lambda> (p, q, r). (p, q) \\<in> S \\<and> A.run r p\"\n      define Q where \"Q \\<equiv> \\<lambda> (p :: 'b, q, r) a. (shd r, a) \\<in> T \\<and> enb a q\"\n      have 1: \"P (p, q, r)\" using that unfolding P_def by auto\n      have \"\\<exists> a. Q x a\" if \"P x\" for x\n        using assms(2) that unfolding P_def Q_def by (force elim: set_relE1 A.run.cases)\n      then obtain f where 2: \"\\<And> x. P x \\<Longrightarrow> Q x (f x)\" by metis\n      define g where \"g \\<equiv> \\<lambda> (p, q, r). (exa (shd r) p, exb (f (p, q, r)) q, stl r)\"\n      have 3: \"P (g x)\" if \"P x\" for x\n        using assms(1) 2 that unfolding P_def Q_def g_def by (auto elim: A.run.cases)\n      show ?thesis\n      proof (intro exI conjI)\n        show \"(r, smap f (siterate g (p, q, r))) \\<in> \\<langle>T\\<rangle> stream_rel\"\n          using 1 2 3 unfolding Q_def g_def by (coinduction arbitrary: p q r) (fastforce)\n        show \"B.run (smap f (siterate g (p, q, r))) q\"\n          using 1 2 3 unfolding Q_def g_def by (coinduction arbitrary: p q r) (fastforce)\n      qed\n    qed\n    have 2: \"\\<exists> r. (r, s) \\<in> \\<langle>T\\<rangle> stream_rel \\<and> A.run r p\" if \"(p, q) \\<in> S\" \"B.run s q\" for p q s\n    proof -\n      define P where \"P \\<equiv> \\<lambda> (p, q, s). (p, q) \\<in> S \\<and> B.run s q\"\n      define Q where \"Q \\<equiv> \\<lambda> (p, q :: 'd, s) b. (b, shd s) \\<in> T \\<and> ena b p\"\n      have 1: \"P (p, q, s)\" using that unfolding P_def by auto\n      have \"\\<exists> a. Q x a\" if \"P x\" for x\n        using assms(2) that unfolding P_def Q_def by (force elim: set_relE2 B.run.cases)\n      then obtain f where 2: \"\\<And> x. P x \\<Longrightarrow> Q x (f x)\" by metis\n      define g where \"g \\<equiv> \\<lambda> (p, q, s). (exa (f (p, q, s)) p, exb (shd s) q, stl s)\"\n      have 3: \"P (g x)\" if \"P x\" for x\n        using assms(1) 2 that unfolding P_def Q_def g_def by (auto elim: B.run.cases)\n      show ?thesis\n      proof (intro exI conjI)\n        show \"(smap f (siterate g (p, q, s)), s) \\<in> \\<langle>T\\<rangle> stream_rel\"\n          using 1 2 3 unfolding Q_def g_def by (coinduction arbitrary: p q s) (fastforce)\n        show \"A.run (smap f (siterate g (p, q, s))) p\"\n          using 1 2 3 unfolding Q_def g_def by (coinduction arbitrary: p q s) (fastforce)\n      qed\n    qed\n    show ?thesis unfolding transition_system.runs_def set_rel_def using 1 2 by force\n  qed\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Transition_Systems_and_Automata/Transition_Systems/Transition_System_Refine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621764862150634, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.31820231124914156}}
{"text": "(*  Title:       Jive Data and Store Model\n    Author:      Norbert Schirmer <schirmer at informatik.tu-muenchen.de>, 2003\n    Maintainer:  Nicole Rauch <rauch at informatik.uni-kl.de>\n    License:     LGPL\n*)\n\nsection \\<open>Store Properties\\<close>\n\ntheory StoreProperties\nimports Store\nbegin\n\ntext \\<open>This theory formalizes advanced concepts and properties of stores.\\<close>\n\nsubsection \\<open>Reachability of a Location from a Reference\\<close>\n\ntext \\<open>For a given store, the function \\<open>reachS\\<close> yields the set of all pairs \n$(l,v)$ where $l$ is a location that is reachable from the value $v$ (which must be a reference)\nin the given store.\nThe predicate \\<open>reach\\<close> decides whether a location is reachable from a value in a store.\n\\<close>\n\ninductive\n  reach :: \"Store \\<Rightarrow> Location \\<Rightarrow> Value \\<Rightarrow> bool\" \n    (\"_\\<turnstile> _ reachable'_from _\" [91,91,91]90)\n  for s :: Store\nwhere\n  Immediate: \"ref l \\<noteq> nullV \\<Longrightarrow> s\\<turnstile> l reachable_from (ref l)\"\n| Indirect: \"\\<lbrakk>s\\<turnstile> l reachable_from (s@@k); ref k \\<noteq> nullV\\<rbrakk> \n             \\<Longrightarrow> s\\<turnstile> l reachable_from (ref k)\" \n\ntext \\<open>Note that we explicitly exclude \\<open>nullV\\<close> as legal reference\nfor reachability. \nKeep in mind that static fields are not associated to any object,\ntherefore \\<open>ref\\<close> yields \\<open>nullV\\<close> if invoked on static fields \n(see the\ndefinition of the function \\<open>ref\\<close>, Sect. \\ref{ref_def}).\nReachability only describes the locations directly \nreachable from the object or array by following the pointers and should not include \nthe static fields if we encounter a \\<open>nullV\\<close> reference in the pointer \nchain.\\<close>\n\ntext \\<open>We formalize some properties of reachability. \nEspecially, Lemma 3.2 as given in \\cite[p. 53]{Poetzsch-Heffter97specification} is proven.\\<close>\n\nlemma unreachable_Null: \n  assumes reach: \"s\\<turnstile> l reachable_from x\" shows \"x\\<noteq>nullV\"\n  using reach by (induct) auto\n\ncorollary unreachable_Null_simp [simp]:\n  \"\\<not> s\\<turnstile> l reachable_from nullV\"\n  by (iprover dest: unreachable_Null)\n\ncorollary unreachable_NullE [elim]:\n  \"s\\<turnstile> l reachable_from nullV \\<Longrightarrow> P\"\n  by (simp)\n\nlemma reachObjLoc [simp,intro]: \n  \"C=cls cf \\<Longrightarrow> s\\<turnstile> objLoc cf a reachable_from objV C a\"\n  by (iprover intro: reach.Immediate [of \"objLoc cf a\",simplified])\n\nlemma reachArrLoc [simp,intro]: \"s\\<turnstile> arrLoc T a i reachable_from arrV T a\"\n  by (rule reach.Immediate [of \"arrLoc T a i\",simplified])\n\nlemma reachArrLen [simp,intro]: \"s\\<turnstile> arrLenLoc T a reachable_from arrV T a\"\n  by (rule reach.Immediate [of \"arrLenLoc T a\",simplified])\n\nlemma unreachStatic [simp]: \"\\<not> s\\<turnstile> staticLoc f reachable_from x\"\nproof -\n  {\n    fix y assume \"s\\<turnstile> y reachable_from x\" \"y=staticLoc f\"\n    then have False\n      by induct auto\n  }\n  thus ?thesis\n    by auto\nqed\n\nlemma unreachStaticE [elim]: \"s\\<turnstile> staticLoc f reachable_from x \\<Longrightarrow> P\"\n  by (simp add: unreachStatic)\n\nlemma reachable_from_ArrLoc_impl_Arr [simp,intro]:\n  assumes reach_loc: \"s\\<turnstile> l reachable_from (s@@arrLoc T a i)\"\n  shows \"s\\<turnstile> l reachable_from (arrV T a)\"\n  using reach.Indirect [OF reach_loc]\n  by simp\n\nlemma reachable_from_ObjLoc_impl_Obj [simp,intro]:\n  assumes reach_loc: \"s\\<turnstile> l reachable_from (s@@objLoc cf a)\"\n  assumes C: \"C=cls cf\"\n  shows \"s\\<turnstile> l reachable_from (objV C a)\"\n  using C reach.Indirect [OF reach_loc]\n  by simp\n\n\ntext \\<open>Lemma 3.2 (i)\\<close>\nlemma reach_update [simp]:\n  assumes unreachable_l_x: \"\\<not> s\\<turnstile> l reachable_from x\" \n  shows \"s\\<langle>l:=y\\<rangle>\\<turnstile> k reachable_from  x = s\\<turnstile> k reachable_from x\"\nproof\n  assume \"s\\<turnstile> k reachable_from x\"\n  from this unreachable_l_x\n  show \"s\\<langle>l := y\\<rangle>\\<turnstile> k reachable_from x\"\n  proof (induct)\n    case (Immediate k)\n    have \"ref k \\<noteq> nullV\" by fact\n    then show \"s\\<langle>l := y\\<rangle>\\<turnstile> k reachable_from (ref k)\"\n      by (rule reach.Immediate)\n  next\n    case (Indirect k m)\n    have hyp: \"\\<not> s\\<turnstile> l reachable_from (s@@m) \n               \\<Longrightarrow> s\\<langle>l:=y\\<rangle> \\<turnstile> k reachable_from (s@@m)\" by fact\n    have \"ref m \\<noteq> nullV\" and \"\\<not> s\\<turnstile> l reachable_from (ref m)\" by fact+\n    hence \"l\\<noteq>m\" \"\\<not> s\\<turnstile> l reachable_from (s@@m)\"\n      by (auto intro: reach.intros)\n    with hyp have \"s\\<langle>l := y\\<rangle> \\<turnstile> k reachable_from (s\\<langle>l := y\\<rangle>@@m)\"\n      by simp\n    then show \"s\\<langle>l := y\\<rangle>\\<turnstile> k reachable_from (ref m)\"\n      by (rule reach.Indirect) (rule Indirect.hyps)\n  qed\nnext\n  assume \"s\\<langle>l := y\\<rangle>\\<turnstile> k reachable_from x\"\n  from this unreachable_l_x\n  show \"s\\<turnstile> k reachable_from x\"\n  proof (induct)\n    case (Immediate k)\n    have \"ref k \\<noteq> nullV\" by fact\n    then show \"s \\<turnstile> k reachable_from (ref k)\"\n      by (rule reach.Immediate)\n  next\n    case (Indirect k m)\n    with Indirect.hyps \n    have hyp: \"\\<not> s\\<turnstile> l reachable_from (s\\<langle>l := y\\<rangle>@@m)  \n               \\<Longrightarrow> s\\<turnstile> k reachable_from (s\\<langle>l := y\\<rangle>@@m)\" by simp\n    have \"ref m \\<noteq> nullV\" and \"\\<not> s\\<turnstile> l reachable_from (ref m)\" by fact+\n    hence \"l\\<noteq>m\" \"\\<not> s \\<turnstile> l reachable_from (s@@m)\"  \n      by (auto intro: reach.intros)\n    with hyp have \"s \\<turnstile> k reachable_from (s@@m)\"\n      by simp\n    thus \"s\\<turnstile> k reachable_from (ref m)\"\n      by (rule reach.Indirect) (rule Indirect.hyps)\n  qed\nqed\n\n\ntext \\<open>Lemma 3.2 (ii)\\<close>\nlemma reach2: \n  \"\\<not> s\\<turnstile> l reachable_from x \\<Longrightarrow> \\<not> s\\<langle>l:=y\\<rangle>\\<turnstile> l reachable_from x\"\n  by (simp)\n\ntext \\<open>Lemma 3.2 (iv)\\<close>\nlemma reach4: \"\\<not> s \\<turnstile> l reachable_from (ref k) \\<Longrightarrow> k \\<noteq> l \\<or> (ref k) = nullV\"\n  by (auto intro: reach.intros)\n\nlemma reachable_isRef: \n  assumes reach: \"s\\<turnstile>l reachable_from x\" \n  shows \"isRefV x\"\n  using reach \nproof (induct)\n  case (Immediate l)\n  show \"isRefV (ref l)\"\n    by (cases l) simp_all\nnext\n  case (Indirect l k)\n  show \"isRefV (ref k)\"\n    by (cases k) simp_all\nqed\n\n\nlemma val_ArrLen_IntgT: \"isArrLenLoc l \\<Longrightarrow> typeof (s@@l) = IntgT\"\nproof -\n  assume isArrLen: \"isArrLenLoc l\"\n  have T: \"typeof (s@@l) \\<le> ltype l\"\n    by (simp)\n  also from isArrLen have I: \"ltype l = IntgT\"\n    by (cases l) simp_all\n  finally show ?thesis\n    by (auto elim: rtranclE simp add: le_Javatype_def subtype_defs)\nqed\n\nlemma access_alloc' [simp]:\n  assumes no_arr_len: \"\\<not> isArrLenLoc l\"\n  shows \"s\\<langle>t\\<rangle>@@l = s@@l\"\nproof -\n  from no_arr_len \n  have \"isNewArr t \\<longrightarrow> l \\<noteq> arr_len (new s t)\"\n    by (cases t) (auto simp add: new_def isArrLenLoc_def split: Location.splits)\n  thus ?thesis \n    by (rule access_alloc)\nqed\n \ntext \\<open>Lemma 3.2 (v)\\<close>\nlemma reach_alloc [simp]: \"s\\<langle>t\\<rangle>\\<turnstile> l reachable_from x = s\\<turnstile> l reachable_from x\"\nproof \n  assume \"s\\<langle>t\\<rangle>\\<turnstile> l reachable_from x\"\n  thus \"s\\<turnstile> l reachable_from x\"\n  proof (induct)\n    case (Immediate l)\n    thus \"s\\<turnstile> l reachable_from ref l\"\n      by (rule reach.intros)\n  next\n    case (Indirect l k)\n    have reach_k: \"s\\<turnstile> l reachable_from (s\\<langle>t\\<rangle>@@k)\" by fact\n    moreover\n    have \"s\\<langle>t\\<rangle>@@k = s@@k\"\n    proof -\n      from reach_k have isRef: \"isRefV (s\\<langle>t\\<rangle>@@k)\"\n        by (rule reachable_isRef)\n      have \"\\<not> isArrLenLoc k\"\n      proof (rule ccontr,simp)\n        assume \"isArrLenLoc k\"\n        then have \"typeof (s\\<langle>t\\<rangle>@@k) = IntgT\"\n          by (rule val_ArrLen_IntgT)\n        with isRef \n        show \"False\"\n          by (cases \"(s\\<langle>t\\<rangle>@@k)\") simp_all\n      qed\n      thus ?thesis\n        by (rule access_alloc')\n    qed\n    ultimately have \"s\\<turnstile> l reachable_from (s@@k)\"\n      by simp\n    thus \"s\\<turnstile> l reachable_from ref k\"\n      by (rule reach.intros) (rule Indirect.hyps)\n  qed\nnext\n  assume \"s\\<turnstile> l reachable_from x\"\n  thus \"s\\<langle>t\\<rangle>\\<turnstile> l reachable_from x\"\n  proof (induct)\n    case (Immediate l)\n    thus \"s\\<langle>t\\<rangle>\\<turnstile> l reachable_from ref l\"\n      by (rule reach.intros)\n  next\n    case (Indirect l k)\n    have reach_k: \"s\\<langle>t\\<rangle>\\<turnstile> l reachable_from (s@@k)\" by fact\n    moreover\n    have \"s\\<langle>t\\<rangle>@@k = s@@k\"\n    proof -\n      from reach_k have isRef: \"isRefV (s@@k)\"\n        by (rule reachable_isRef)\n      have \"\\<not> isArrLenLoc k\"\n      proof (rule ccontr,simp)\n        assume \"isArrLenLoc k\"\n        then have \"typeof (s@@k) = IntgT\"\n          by (rule val_ArrLen_IntgT)\n        with isRef \n        show \"False\"\n          by (cases \"(s@@k)\") simp_all\n      qed\n      thus ?thesis\n        by (rule access_alloc')\n    qed\n    ultimately have \"s\\<langle>t\\<rangle>\\<turnstile> l reachable_from (s\\<langle>t\\<rangle>@@k)\"\n      by simp\n    thus \"s\\<langle>t\\<rangle>\\<turnstile> l reachable_from ref k\"\n      by (rule reach.intros) (rule Indirect.hyps)\n  qed\nqed\n       \n\ntext \\<open>Lemma 3.2 (vi)\\<close>\nlemma reach6: \"isprimitive(typeof x) \\<Longrightarrow> \\<not> s \\<turnstile> l reachable_from x\"\nproof \n  assume prim: \"isprimitive(typeof x)\"\n  assume \"s \\<turnstile> l reachable_from x\"\n  hence \"isRefV x\"\n    by (rule reachable_isRef)\n  with prim show False\n    by (cases x) simp_all\nqed\n\ntext \\<open>Lemma 3.2 (iii)\\<close>\nlemma reach3: \n  assumes k_y: \"\\<not> s\\<turnstile> k reachable_from y\"\n  assumes k_x: \"\\<not> s\\<turnstile> k reachable_from x\"\n  shows \"\\<not> s\\<langle>l:=y\\<rangle>\\<turnstile> k reachable_from x\"\nproof\n  assume \"s\\<langle>l:=y\\<rangle>\\<turnstile> k reachable_from x\"\n  from this k_y k_x\n  show False\n  proof (induct)\n    case (Immediate l)\n    have \"\\<not> s\\<turnstile> l reachable_from ref l\" and \"ref l \\<noteq> nullV\" by fact+\n    thus False\n      by (iprover intro: reach.intros)\n  next\n    case (Indirect m k)\n    have k_not_Null: \"ref k \\<noteq> nullV\" by fact\n    have not_m_y: \"\\<not> s\\<turnstile> m reachable_from y\" by fact\n    have not_m_k: \"\\<not> s\\<turnstile> m reachable_from ref k\" by fact\n    have hyp: \"\\<lbrakk>\\<not> s\\<turnstile> m reachable_from y; \\<not> s\\<turnstile> m reachable_from (s\\<langle>l := y\\<rangle>@@k)\\<rbrakk>\n               \\<Longrightarrow> False\" by fact\n    have m_upd_k: \"s\\<langle>l := y\\<rangle>\\<turnstile> m reachable_from (s\\<langle>l := y\\<rangle>@@k)\" by fact\n    show False\n    proof (cases \"l=k\")\n      case False\n      then have \"s\\<langle>l := y\\<rangle>@@k = s@@k\" by simp\n      moreover \n      from not_m_k k_not_Null have \"\\<not> s\\<turnstile> m reachable_from (s@@k)\"\n        by (iprover intro: reach.intros)\n      ultimately show False\n        using not_m_y hyp by simp\n    next\n      case True note eq_l_k = this\n      show ?thesis\n      proof (cases \"alive (ref l) s \\<and> alive y s \\<and> typeof y \\<le> ltype l\")\n        case True\n        with eq_l_k have \"s\\<langle>l := y\\<rangle>@@k = y\"\n          by simp\n        with not_m_y hyp show False by simp\n      next\n        case False\n        hence \"s\\<langle>l := y\\<rangle> = s\"\n          by auto\n        moreover \n        from not_m_k k_not_Null have \"\\<not> s\\<turnstile> m reachable_from (s@@k)\"\n          by (iprover intro: reach.intros)\n        ultimately show False\n          using not_m_y hyp by simp\n      qed\n    qed\n  qed\nqed\n\n\n\ntext \\<open>Lemma 3.2 (vii).\\<close>\n\nlemma unreachable_from_init [simp,intro]: \"\\<not> s\\<turnstile> l reachable_from (init T)\"\n  using reach6 by (cases T) simp_all\n\nlemma ref_reach_unalive: \n  assumes unalive_x:\"\\<not> alive x s\" \n  assumes l_x: \"s\\<turnstile> l reachable_from x\" \n  shows \"x = ref l\"\nusing l_x unalive_x\nproof induct\n  case (Immediate l)\n  show \"ref l = ref l\"\n    by simp\nnext\n  case (Indirect l k)\n  have \"ref k \\<noteq> nullV\" by fact\n  have \"\\<not> alive (ref k) s\" by fact\n  hence \"s@@k = init (ltype k)\" by simp\n  moreover have \"s\\<turnstile> l reachable_from (s@@k)\" by fact\n  ultimately have False by simp\n  thus ?case ..\nqed\n\nlemma loc_new_reach: \n  assumes l: \"ref l = new s t\"\n  assumes l_x: \"s\\<turnstile> l reachable_from x\"\n  shows \"x = new s t\"\nusing l_x l\nproof induct\n  case (Immediate l)\n  show \"ref l = new s t\" by fact\nnext\n  case (Indirect l k)\n  hence \"s@@k = new s t\" by iprover\n  moreover \n  have \"\\<not> alive (new s t) s\"\n    by simp\n  moreover \n  have \"alive (s@@k) s\"\n    by simp\n  ultimately have False by simp\n  thus ?case ..\nqed\n \n\ntext \\<open>Lemma 3.2 (viii)\\<close>\nlemma alive_reach_alive: \n  assumes alive_x: \"alive x s\" \n  assumes reach_l: \"s \\<turnstile> l reachable_from x\" \n  shows \"alive (ref l) s\"\nusing reach_l alive_x\nproof (induct)\n  case (Immediate l)\n  show ?case by fact\nnext\n  case (Indirect l k)\n  have hyp: \"alive (s@@k) s \\<Longrightarrow> alive (ref l) s\" by fact\n  moreover have \"alive (s@@k) s\" by simp\n  ultimately\n  show \"alive (ref l) s\"\n    by iprover\nqed\n \ntext \\<open>Lemma 3.2 (ix)\\<close>\nlemma reach9: \n  assumes reach_impl_access_eq: \"\\<forall>l. s1\\<turnstile>l reachable_from x \\<longrightarrow> (s1@@l = s2@@l)\"\n  shows \"s1\\<turnstile> l reachable_from x = s2\\<turnstile> l reachable_from x\"\nproof \n  assume \"s1\\<turnstile> l reachable_from x\"\n  from this reach_impl_access_eq \n  show \"s2\\<turnstile> l reachable_from x\"\n  proof (induct)\n    case (Immediate l)\n    show \"s2\\<turnstile> l reachable_from ref l\"\n      by (rule reach.intros) (rule Immediate.hyps)\n  next\n    case (Indirect l k)\n    have hyp: \"\\<forall>l. s1\\<turnstile> l reachable_from (s1@@k) \\<longrightarrow> s1@@l = s2@@l \n               \\<Longrightarrow> s2\\<turnstile> l reachable_from (s1@@k)\" by fact\n    have k_not_Null: \"ref k \\<noteq> nullV\" by fact\n    have reach_impl_access_eq: \n      \"\\<forall>l. s1\\<turnstile> l reachable_from ref k \\<longrightarrow> s1@@l = s2@@l\" by fact\n    have \"s1\\<turnstile> l reachable_from (s1@@k)\" by fact\n    with k_not_Null\n    have \"s1@@k = s2@@k\"\n      by (iprover intro: reach_impl_access_eq [rule_format] reach.intros)\n    moreover from reach_impl_access_eq k_not_Null\n    have \"\\<forall>l. s1\\<turnstile> l reachable_from (s1@@k) \\<longrightarrow> s1@@l = s2@@l\"\n      by (iprover intro: reach.intros)\n    then have \"s2\\<turnstile> l reachable_from (s1@@k)\"\n      by (rule hyp)\n    ultimately have \"s2\\<turnstile> l reachable_from (s2@@k)\"\n      by simp\n    thus \"s2\\<turnstile> l reachable_from ref k\"\n      by (rule reach.intros) (rule Indirect.hyps)\n  qed\nnext\n  assume \"s2\\<turnstile> l reachable_from x\"\n  from this reach_impl_access_eq \n  show \"s1\\<turnstile> l reachable_from x\"\n  proof (induct)\n    case (Immediate l)\n    show \"s1\\<turnstile> l reachable_from ref l\"\n      by (rule reach.intros) (rule Immediate.hyps)\n  next\n    case (Indirect l k)\n    have hyp: \"\\<forall>l. s1\\<turnstile> l reachable_from (s2@@k) \\<longrightarrow> s1@@l = s2@@l \n               \\<Longrightarrow> s1\\<turnstile> l reachable_from (s2@@k)\" by fact\n    have k_not_Null: \"ref k \\<noteq> nullV\" by fact\n    have reach_impl_access_eq: \n      \"\\<forall>l. s1\\<turnstile> l reachable_from ref k \\<longrightarrow> s1@@l = s2@@l\" by fact\n    have \"s1\\<turnstile> k reachable_from ref k\"\n      by (rule reach.intros) (rule Indirect.hyps)\n    with reach_impl_access_eq\n    have eq_k: \"s1@@k = s2@@k\"\n      by simp\n    from reach_impl_access_eq k_not_Null\n    have \"\\<forall>l. s1\\<turnstile> l reachable_from (s1@@k) \\<longrightarrow> s1@@l = s2@@l\"\n      by (iprover intro: reach.intros)\n    then \n    have \"\\<forall>l. s1\\<turnstile> l reachable_from (s2@@k) \\<longrightarrow> s1@@l = s2@@l\"\n      by (simp add: eq_k)\n    with eq_k hyp have \"s1\\<turnstile> l reachable_from (s1@@k)\"\n      by simp\n    thus \"s1\\<turnstile> l reachable_from ref k\"\n      by (rule reach.intros) (rule Indirect.hyps)\n   qed\nqed\n\n\nsubsection \\<open>Reachability of a Reference from a Reference\\<close>\n\ntext \\<open>The predicate \\<open>rreach\\<close> tests whether a value is reachable from\nanother value. This is an extension of the predicate \\<open>oreach\\<close> as described\nin \\cite[p. 54]{Poetzsch-Heffter97specification} because now arrays are handled as well.\n\\<close>\n\ndefinition rreach:: \"Store \\<Rightarrow> Value \\<Rightarrow> Value \\<Rightarrow> bool\" \n  (\"_\\<turnstile>Ref _ reachable'_from _\" [91,91,91]90) where\n\"s\\<turnstile>Ref y reachable_from x = (\\<exists> l. s\\<turnstile> l reachable_from x \\<and> y = ref l)\"\n\n\nsubsection \\<open>Disjointness of Reachable Locations\\<close>\n\ntext \\<open>The predicate \\<open>disj\\<close> tests whether two values are disjoint\nin a given store. Its properties as given in \n\\cite[Lemma 3.3, p. 54]{Poetzsch-Heffter97specification} are then proven.\n\\<close>\n\ndefinition disj:: \"Value \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> bool\" where\n\"disj x y s = (\\<forall> l. \\<not> s\\<turnstile> l reachable_from x \\<or> \\<not> s\\<turnstile> l reachable_from y)\"\n\n\nlemma disjI1: \"\\<lbrakk>\\<And> l. s\\<turnstile> l reachable_from x \\<Longrightarrow> \\<not> s\\<turnstile> l reachable_from y\\<rbrakk> \n \\<Longrightarrow> disj x y s\"\n  by (simp add: disj_def)\n\nlemma disjI2: \"\\<lbrakk>\\<And> l. s\\<turnstile> l reachable_from y \\<Longrightarrow> \\<not> s\\<turnstile> l reachable_from x\\<rbrakk> \n \\<Longrightarrow> disj x y s\"\n  by (auto simp add: disj_def)\n\nlemma disj_cases [consumes 1]: \n  assumes \"disj x y s\"\n  assumes \"\\<And> l.  \\<not> s\\<turnstile> l reachable_from x \\<Longrightarrow> P\"\n  assumes \"\\<And> l.  \\<not> s\\<turnstile> l reachable_from y \\<Longrightarrow> P\"\n  shows \"P\"\n  using assms by (auto simp add: disj_def)\n\ntext \\<open>Lemma 3.3 (i) in \\cite{Poetzsch-Heffter97specification}\\<close>\nlemma disj1: \"\\<lbrakk>disj x y s; \\<not> s\\<turnstile> l reachable_from x; \\<not> s\\<turnstile> l reachable_from y\\<rbrakk> \n              \\<Longrightarrow> disj x y (s\\<langle>l:=z\\<rangle>)\"\n  by (auto simp add: disj_def)\n\ntext \\<open>Lemma 3.3 (ii)\\<close>\nlemma disj2: \n  assumes disj_x_y: \"disj x y s\" \n  assumes disj_x_z: \"disj x z s\"\n  assumes unreach_l_x: \"\\<not> s\\<turnstile> l reachable_from x\"\n  shows \"disj x y (s\\<langle>l:=z\\<rangle>)\"\nproof (rule disjI1)\n  fix k \n  assume reach_k_x: \"s\\<langle>l := z\\<rangle>\\<turnstile> k reachable_from x\"\n  show \"\\<not> s\\<langle>l := z\\<rangle>\\<turnstile> k reachable_from y\"\n  proof - \n    from unreach_l_x reach_k_x \n    have reach_s_k_x: \"s\\<turnstile> k reachable_from x\"\n      by simp\n    with disj_x_z \n    have \"\\<not> s\\<turnstile> k reachable_from z\"\n      by (simp add: disj_def)\n    moreover from reach_s_k_x disj_x_y\n    have \"\\<not> s\\<turnstile> k reachable_from y\"\n      by (simp add: disj_def)\n    ultimately show ?thesis\n      by (rule reach3)\n  qed\nqed\n\n   \n\ntext \\<open>Lemma 3.3 (iii)\\<close>\nlemma disj3: assumes alive_x_s: \"alive x s\" \n  shows \"disj x (new s t) (s\\<langle>t\\<rangle>)\"\nproof (rule disjI1,simp only: reach_alloc)\n  fix l\n  assume reach_l_x: \"s\\<turnstile> l reachable_from x\"\n  show \"\\<not> s\\<turnstile> l reachable_from new s t\"\n  proof \n    assume reach_l_new: \"s\\<turnstile> l reachable_from new s t\" \n    have unalive_new: \"\\<not> alive (new s t) s\" by simp\n    from this reach_l_new\n    have  \"new s t = ref l\"\n      by (rule ref_reach_unalive)\n    moreover from alive_x_s reach_l_x \n    have \"alive (ref l) s\"\n      by (rule alive_reach_alive)\n    ultimately show False\n      using unalive_new\n      by simp\n  qed\nqed\n\ntext \\<open>Lemma 3.3 (iv)\\<close>\nlemma disj4: \"\\<lbrakk>disj (objV C a) y s; CClassT C \\<le> dtype f \\<rbrakk>  \n              \\<Longrightarrow> disj (s@@(objV C a)..f) y s\"\n  by (auto simp add: disj_def)\n  \nlemma disj4': \"\\<lbrakk>disj (arrV T a) y s \\<rbrakk>  \n              \\<Longrightarrow> disj (s@@(arrV T a).[i]) y s\"\n  by (auto simp add: disj_def)\n\n\nsubsection \\<open>X-Equivalence\\<close>\n\ntext \\<open>We call two stores $s_1$ and $s_2$ equivalent wrt. a given value $X$\n(which is called X-equivalence)\n iff $X$ and all values\nreachable from $X$ in $s_1$ or $s_2$ have the same state \\cite[p. 55]{Poetzsch-Heffter97specification}. \nThis is tested by  the predicate\n\\<open>xeq\\<close>. Lemma 3.4 of  \\cite{Poetzsch-Heffter97specification} is then proven for \\<open>xeq\\<close>.\n\\<close> \n\ndefinition xeq:: \"Value \\<Rightarrow> Store \\<Rightarrow> Store \\<Rightarrow> bool\" where\n\"xeq x s t = (alive x s = alive x t \\<and> \n             (\\<forall> l. s\\<turnstile> l reachable_from x \\<longrightarrow> s@@l = t@@l))\"\n\nabbreviation xeq_syntax :: \"Store \\<Rightarrow> Value \\<Rightarrow> Store \\<Rightarrow> bool\"\n  (\"_/ (\\<equiv>[_])/ _\" [900,0,900] 900)\nwhere \"s \\<equiv>[x] t == xeq x s t\"\n\n\nlemma xeqI: \"\\<lbrakk>alive x s = alive x t;  \n             \\<And> l. s\\<turnstile> l reachable_from x \\<Longrightarrow> s@@l = t@@l\n             \\<rbrakk> \\<Longrightarrow> s \\<equiv>[x] t\"\n  by (auto simp add: xeq_def)\n\ntext \\<open>Lemma 3.4 (i) in  \\cite{Poetzsch-Heffter97specification}.\\<close>\nlemma xeq1_refl: \"s \\<equiv>[x] s\"\n  by (simp add: xeq_def)\n\ntext \\<open>Lemma 3.4 (i)\\<close>\nlemma xeq1_sym': \n  assumes s_t: \"s \\<equiv>[x] t\"\n  shows \"t \\<equiv>[x] s\"\nproof -\n  from s_t have \"alive x s = alive x t\" by (simp add: xeq_def)\n  moreover\n  from s_t have \"\\<forall> l. s\\<turnstile> l reachable_from x \\<longrightarrow> s@@l = t@@l\" \n    by (simp add: xeq_def)\n  with reach9 [OF this]\n  have \"\\<forall> l. t\\<turnstile> l reachable_from x \\<longrightarrow> t@@l = s@@l\" \n    by simp\n  ultimately show ?thesis\n    by (simp add: xeq_def)\nqed\n \nlemma xeq1_sym: \"s \\<equiv>[x] t = t \\<equiv>[x] s\"\n  by (auto intro: xeq1_sym')\n\n\ntext \\<open>Lemma 3.4 (i)\\<close>\nlemma xeq1_trans [trans]: \n  assumes s_t: \"s \\<equiv>[x] t\" \n  assumes t_r: \"t \\<equiv>[x] r\" \n  shows \"s \\<equiv>[x] r\"\nproof -\n  from s_t t_r\n  have \"alive x s = alive x r\"\n    by (simp add: xeq_def)\n  moreover\n  have \"\\<forall> l. s\\<turnstile> l reachable_from x \\<longrightarrow> s@@l = r@@l\"\n  proof (intro allI impI)\n    fix l\n    assume reach_l: \"s\\<turnstile> l reachable_from x\"\n    show \"s@@l = r@@l\"\n    proof -\n      from reach_l s_t have \"s@@l=t@@l\"\n        by (simp add: xeq_def)\n      also have \"t@@l = r@@l\"\n      proof -\n        from s_t have \"\\<forall> l. s\\<turnstile> l reachable_from x \\<longrightarrow> s@@l = t@@l\"\n          by (simp add: xeq_def)\n        from reach9 [OF this] reach_l have \"t\\<turnstile> l reachable_from x\"\n          by simp\n        with t_r show ?thesis\n          by (simp add: xeq_def)\n      qed\n      finally show ?thesis .\n    qed\n  qed\n  ultimately show ?thesis\n    by (simp add: xeq_def)\nqed\n   \n\n  \ntext \\<open>Lemma 3.4 (ii)\\<close>\nlemma xeq2: \n  assumes xeq: \"\\<forall> x. s \\<equiv>[x] t\" \n  assumes static_eq: \"\\<forall> f. s@@(staticLoc f) = t@@(staticLoc f)\" \n  shows \"s = t\"\nproof (rule Store_eqI)\n  from xeq \n  show \"\\<forall>x. alive x s = alive x t\"\n    by (simp add: xeq_def)\nnext\n  show \"\\<forall>l. s@@l = t@@l\"\n  proof \n    fix l \n    show \"s@@l = t@@l\"\n    proof (cases l)\n      case (objLoc cf a)\n      have \"l = objLoc cf a\" by fact\n      hence \"s\\<turnstile> l reachable_from (objV (cls cf) a)\"\n        by simp\n      with xeq show ?thesis\n        by (simp add: xeq_def)\n    next\n      case (staticLoc f)\n      have \"l = staticLoc f\" by fact\n      with static_eq show ?thesis \n        by (simp add: xeq_def)\n    next\n      case (arrLenLoc T a)\n      have \"l = arrLenLoc T a\" by fact\n      hence \"s\\<turnstile> l reachable_from (arrV T a)\"\n        by simp\n      with xeq show ?thesis\n        by (simp add: xeq_def)\n    next\n      case (arrLoc T a i)\n      have \"l = arrLoc T a i\" by fact\n      hence \"s\\<turnstile> l reachable_from (arrV T a)\"\n        by simp\n      with xeq show ?thesis\n        by (simp add: xeq_def)\n    qed\n  qed\nqed\n\n\ntext \\<open>Lemma 3.4 (iii)\\<close>\nlemma xeq3: \n  assumes unreach_l: \"\\<not> s\\<turnstile> l reachable_from x\" \n  shows \"s \\<equiv>[x] s\\<langle>l:=y\\<rangle>\"\nproof (rule xeqI)\n  show \"alive x s = alive x (s\\<langle>l := y\\<rangle>)\"\n    by simp\nnext\n  fix k \n  assume reach_k: \"s\\<turnstile> k reachable_from x\"\n  with unreach_l have \"l\\<noteq>k\" by auto\n  then show \"s@@k = s\\<langle>l := y\\<rangle>@@k\"\n    by simp\nqed\n\n\n\ntext \\<open>Lemma 3.4 (iv)\\<close>\n\n\ntext \\<open>Lemma 3.4 (v)\\<close>\nlemma xeq5: \"s \\<equiv>[x] t \\<Longrightarrow> s\\<turnstile> l reachable_from x = t\\<turnstile> l reachable_from x\"\n  by (rule reach9) (simp add:  xeq_def)\n  \n\nsubsection \\<open>T-Equivalence\\<close>\n\ntext \\<open>T-equivalence is the extension of X-equivalence from values to types. Two stores are\nT-equivalent iff they are X-equivalent for all values of type T. This is formalized by the\npredicate \\<open>teq\\<close> \\cite[p. 55]{Poetzsch-Heffter97specification}.\\<close>\n\ndefinition teq:: \"Javatype \\<Rightarrow> Store \\<Rightarrow> Store \\<Rightarrow> bool\" where\n\"teq t s1 s2 = (\\<forall> x. typeof x \\<le> t \\<longrightarrow> s1 \\<equiv>[x] s2)\"\n\nsubsection \\<open>Less Alive\\<close>\n\ntext \\<open>To specify that methods have no side-effects, the following binary relation on stores \nplays a prominent role. It expresses that the two stores differ only in values that are alive\nin the store passed as first argument. This is formalized by the predicate \\<open>lessalive\\<close>\n\\cite[p. 55]{Poetzsch-Heffter97specification}.\nThe stores have to be X-equivalent for the references of the\nfirst store that are alive, and the values of the static fields have to be the same in both stores.\n\\<close>\n\ndefinition lessalive:: \"Store \\<Rightarrow> Store \\<Rightarrow> bool\" (\"_/ \\<lless> _\" [70,71] 70)\n  where \"lessalive s t = ((\\<forall> x. alive x s \\<longrightarrow> s \\<equiv>[x] t) \\<and> (\\<forall> f. s@@staticLoc f = t@@staticLoc f))\"\n\ntext \\<open>We define an introduction rule for the new operator.\\<close>\n\nlemma lessaliveI: \n  \"\\<lbrakk>\\<And> x. alive x s \\<Longrightarrow>  s \\<equiv>[x] t; \\<And> f. s@@staticLoc f = t@@staticLoc f\\<rbrakk>\n   \\<Longrightarrow> s \\<lless> t\"\nby (simp add: lessalive_def)\n\ntext \\<open>It can be shown that \\<open>lessalive\\<close> is reflexive, transitive and antisymmetric.\\<close>\n\nlemma lessalive_refl: \"s \\<lless> s\"\n  by (simp add: lessalive_def xeq1_refl)\n\nlemma lessalive_trans [trans]: \n  assumes s_t: \"s \\<lless> t\"\n  assumes t_w: \"t \\<lless> w\"\n  shows \"s \\<lless> w\"\nproof (rule lessaliveI)\n  fix x \n  assume alive_x_s: \"alive x s\"\n  with s_t have \"s \\<equiv>[x] t\"\n    by (simp add: lessalive_def)\n  also\n  have \"t \\<equiv>[x] w\"\n  proof -\n    from alive_x_s s_t have \"alive x t\" by (simp add: lessalive_def xeq_def)\n    with t_w show ?thesis\n      by (simp add: lessalive_def)\n  qed\n  finally show \"s \\<equiv>[x] w\".\nnext\n  fix f\n  from s_t t_w show \"s@@staticLoc f = w@@staticLoc f\"\n    by (simp add: lessalive_def)\nqed\n\nlemma lessalive_antisym:\n  assumes s_t: \"s \\<lless> t\"\n  assumes t_s: \"t \\<lless> s\"\n  shows \"s = t\"\nproof (rule xeq2)\n  show \"\\<forall>x. s \\<equiv>[x] t\"\n  proof \n    fix x show \"s \\<equiv>[x] t\"\n    proof (cases \"alive x s\")\n      case True\n      with s_t show ?thesis by (simp add: lessalive_def)\n    next\n      case False note unalive_x_s = this\n      show ?thesis\n      proof (cases \"alive x t\")\n        case True\n        with t_s show ?thesis \n          by (subst xeq1_sym) (simp add: lessalive_def)\n      next\n        case False \n        show ?thesis\n        proof (rule xeqI)\n          from False unalive_x_s show \"alive x s = alive x t\" by simp\n        next\n          fix l assume reach_s_x: \"s\\<turnstile> l reachable_from x\"\n          with unalive_x_s have x: \"x = ref l\" \n            by (rule ref_reach_unalive)\n          with unalive_x_s have \"s@@l = init (ltype l)\"\n            by simp\n          also from reach_s_x x have \"t\\<turnstile> l reachable_from x\"\n            by (auto intro: reach.Immediate unreachable_Null)\n          with False x have \"t@@l = init (ltype l)\"\n            by simp\n          finally show \"s@@l = t@@l\"\n            by simp\n        qed\n      qed\n    qed\n  qed\nnext\n  from s_t show \"\\<forall>f. s@@staticLoc f = t@@staticLoc f\"\n    by (simp add: lessalive_def)\nqed\n\ntext \\<open>This gives us a partial ordering on the store. Thus, the type @{typ \"Store\"}\ncan be added to the appropriate type class @{term \"ord\"} which lets us define the $<$ and\n$\\leq$ symbols, and to the type class  @{term \"order\"} which axiomatizes partial orderings.\n\\<close>\n\ninstantiation Store :: order\nbegin\n\ndefinition\n  le_Store_def: \"s \\<le> t \\<longleftrightarrow> s \\<lless> t\"\n\ndefinition\n  less_Store_def: \"(s::Store) < t \\<longleftrightarrow> s \\<le> t \\<and> \\<not> t \\<le> s\"\n\ntext \\<open>We prove Lemma 3.5 of \\cite[p. 56]{Poetzsch-Heffter97specification} for this relation.\n\\<close>\n\ntext \\<open>Lemma 3.5 (i)\\<close>\n\ninstance  proof \n  fix s t w:: \"Store\"\n  {\n    show \"s \\<le> s\"\n      by (simp add: le_Store_def lessalive_refl)\n  next\n    assume \"s \\<le> t\" \"t \\<le> w\"\n    then show \"s \\<le> w\"\n      by (unfold le_Store_def) (rule lessalive_trans) \n  next\n    assume \"s \\<le> t\" \"t \\<le> s\" \n    then show \"s = t\"\n      by (unfold le_Store_def) (rule lessalive_antisym) \n  next\n    show \"(s < t) = (s \\<le> t \\<and> \\<not> t \\<le> s)\"\n      by (simp add: less_Store_def)\n  }\nqed\n\nend\n\ntext \\<open>Lemma 3.5 (ii)\\<close>\nlemma lessalive2: \"\\<lbrakk>s \\<lless> t; alive x s\\<rbrakk> \\<Longrightarrow> alive x t\"\n  by (simp add: lessalive_def xeq_def)\n  \n\ntext \\<open>Lemma 3.5 (iii)\\<close>\nlemma lessalive3: \n  assumes s_t: \"s \\<lless> t\" \n  assumes alive: \"alive x s \\<or> \\<not> alive x t\"\n  shows \"s \\<equiv>[x] t\"\nproof (cases \"alive x s\")\n  case True\n  with s_t show ?thesis\n    by (simp add: lessalive_def)\nnext\n  case False\n  note unalive_x_s = this\n  with alive have unalive_x_t: \"\\<not> alive x t\"\n    by simp\n  show ?thesis\n  proof (rule xeqI)\n    from False alive show \"alive x s = alive x t\"\n      by simp\n  next\n    fix l assume reach_s_x: \"s\\<turnstile> l reachable_from x\"\n    with unalive_x_s have x: \"x = ref l\" \n      by (rule ref_reach_unalive)\n    with unalive_x_s have \"s@@l = init (ltype l)\"\n      by simp\n    also from reach_s_x x have \"t\\<turnstile> l reachable_from x\"\n      by (auto intro: reach.Immediate unreachable_Null)\n    with unalive_x_t x have \"t@@l = init (ltype l)\"\n      by simp\n    finally show \"s@@l = t@@l\"\n      by simp\n  qed\nqed\n   \ntext \\<open>Lemma 3.5 (iv)\\<close>\nlemma lessalive_update [simp,intro]: \n  assumes s_t: \"s \\<lless> t\" \n  assumes unalive_l: \"\\<not> alive (ref l) t\"\n  shows \"s \\<lless> t\\<langle>l:=x\\<rangle>\"\nproof -\n  from unalive_l have \"t\\<langle>l:=x\\<rangle> = t\"\n    by simp\n  with s_t show ?thesis by simp\nqed\n\nlemma Xequ4':  \n  assumes alive: \"alive x s\" \n  shows \"s \\<equiv>[x] s\\<langle>t\\<rangle>\"\nproof -\n  from alive have \"x \\<noteq> new s t\"\n    by auto\n  thus ?thesis\n    by (rule xeq4)\nqed\n\n  \n\ntext \\<open>Lemma 3.5 (v)\\<close>\nlemma lessalive_alloc [simp,intro]: \"s \\<lless> s\\<langle>t\\<rangle>\"\n  by (simp add: lessalive_def Xequ4')\n \n\nsubsection \\<open>Reachability of Types from Types\\<close>\n\ntext \\<open>The predicate \\<open>treach\\<close> denotes the fact that the first type reaches \nthe second type by stepping finitely many times from a type to the range type of one \nof its fields. This formalization diverges from \\cite[p. 106]{Poetzsch-Heffter97specification} \nin that it does not include the number of steps that are allowed to reach the second type.\nReachability of types is a static approximation of reachability in\nthe store. If I cannot reach the type of a location from the type of a\nreference, I cannot reach the location from the reference. See lemma  \n\\<open>not_treach_ref_impl_not_reach\\<close> below.\n\\<close>\n\ninductive\n  treach :: \"Javatype \\<Rightarrow> Javatype \\<Rightarrow> bool\"\nwhere\n  Subtype:       \"U \\<le> T \\<Longrightarrow> treach T U\"\n| Attribute:     \"\\<lbrakk>treach T S; S \\<le> dtype f; U \\<le> rtype f\\<rbrakk>  \\<Longrightarrow> treach T U\"\n| ArrLength:     \"treach (ArrT AT) IntgT\"\n| ArrElem:       \"treach (ArrT AT) (at2jt AT)\"\n| Trans [trans]: \"\\<lbrakk>treach T U; treach U V\\<rbrakk> \\<Longrightarrow> treach T V\"\n\n\nlemma treach_ref_l [simp,intro]: \n  assumes not_Null: \"ref l \\<noteq> nullV\"\n  shows \"treach (typeof (ref l)) (ltype l)\"\nproof (cases l)\n  case (objLoc cf a)\n  have \"l=objLoc cf a\" by fact\n  moreover\n  have \"treach (CClassT (cls cf)) (rtype (att cf))\"\n    by (rule treach.Attribute [where ?f=\"att cf\" and ?S=\"CClassT (cls cf)\"])\n       (auto intro: treach.Subtype)\n  ultimately show ?thesis\n    by simp\nnext\n  case (staticLoc f)\n  have \"l=staticLoc f\" by fact\n  hence \"ref l = nullV\" by simp\n  with not_Null show ?thesis\n    by simp\nnext\n  case (arrLenLoc T a)\n  have \"l=arrLenLoc T a\" by fact\n  then show ?thesis\n    by (auto intro: treach.ArrLength)\nnext\n  case (arrLoc T a i)\n  have \"l=arrLoc T a i\" by fact\n  then show ?thesis\n    by (auto intro: treach.ArrElem)\nqed\n\nlemma treach_ref_l' [simp,intro]:\n  assumes not_Null: \"ref l \\<noteq> nullV\"\n  shows \"treach (typeof (ref l)) (typeof (s@@l))\"\nproof -\n  from not_Null have \"treach (typeof (ref l)) (ltype l)\" by (rule treach_ref_l)\n  also have \"typeof (s@@l) \\<le> ltype l\"\n    by simp\n  hence \"treach (ltype l) (typeof (s@@l))\"\n    by (rule treach.intros)\n  finally show ?thesis .\nqed\n  \n\nlemma reach_impl_treach: \n  assumes reach_l: \"s \\<turnstile> l reachable_from x\"\n  shows \"treach (typeof x) (ltype l)\"\nusing reach_l\nproof (induct)\n  case (Immediate l)\n  have \"ref l \\<noteq> nullV\" by fact\n  then show \"treach (typeof (ref l)) (ltype l)\"\n    by (rule treach_ref_l)\nnext\n  case (Indirect l k)\n  have \"treach (typeof (s@@k)) (ltype l)\" by fact\n  moreover\n  have \"ref k \\<noteq> nullV\" by fact\n  hence \"treach (typeof (ref k)) (typeof (s@@k))\"\n    by simp\n  ultimately show \"treach (typeof (ref k)) (ltype l)\"\n    by (iprover intro: treach.Trans)\nqed\n\nlemma not_treach_ref_impl_not_reach: \n  assumes not_treach: \"\\<not> treach (typeof x) (typeof (ref l))\"\n  shows \"\\<not> s \\<turnstile> l reachable_from x\"\nproof \n  assume reach_l: \"s\\<turnstile> l reachable_from x\"\n  from this not_treach\n  show False\n  proof (induct)\n    case (Immediate l)\n    have \"\\<not> treach (typeof (ref l)) (typeof (ref l))\" by fact\n    thus False by (iprover intro: treach.intros order_refl)\n  next\n    case (Indirect l k)\n    have hyp: \"\\<not> treach (typeof (s@@k)) (typeof (ref l)) \\<Longrightarrow> False\" by fact\n    have not_Null: \"ref k \\<noteq> nullV\" by fact\n    have not_k_l:\"\\<not> treach (typeof (ref k)) (typeof (ref l))\" by fact\n    show False\n    proof (cases \"treach (typeof (s@@k)) (typeof (ref l))\")\n      case False thus False by (rule hyp)\n    next\n      case True\n      from not_Null have \"treach (typeof (ref k)) (typeof (s@@k))\"\n        by (rule treach_ref_l')\n      also note True\n      finally have \"treach (typeof (ref k)) (typeof (ref l))\" .\n      with not_k_l show False ..\n    qed\n  qed\nqed\n\ntext \\<open>Lemma 4.6 in \\cite[p. 107]{Poetzsch-Heffter97specification}.\\<close>\nlemma treach1: \n  assumes x_t: \"typeof x \\<le> T\" \n  assumes not_treach: \"\\<not> treach T (typeof (ref l))\"\n  shows \"\\<not> s \\<turnstile> l reachable_from x\"\nproof -\n  have \"\\<not> treach (typeof x) (typeof (ref l))\"\n  proof \n    from x_t have \"treach T (typeof x)\" by (rule treach.intros)\n    also assume \"treach (typeof x) (typeof (ref l))\"\n    finally have \"treach T (typeof (ref l))\" .\n    with not_treach show False ..\n  qed\n  thus ?thesis\n    by (rule not_treach_ref_impl_not_reach)\nqed\n\n  \nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JiveDataStoreModel/Isabelle_Store/StoreProperties.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3181641180781102}}
{"text": "section\\<open>Storage\\<close>\n\ntheory Storage\nimports Valuetypes \"HOL-Library.Finite_Map\"\n\nbegin\n\n(*Covered*)\nfun hash :: \"Location \\<Rightarrow> String.literal \\<Rightarrow> Location\"\nwhere \"hash loc ix = ix + (STR ''.'' + loc)\"\n\nsubsection \\<open>General Store\\<close>\n\n(*Covered*)\nrecord 'v Store =\n  mapping :: \"(Location,'v) fmap\"\n  toploc :: nat \n\nfun accessStore :: \"Location \\<Rightarrow> 'v Store \\<Rightarrow> 'v option\"\nwhere \"accessStore loc st = fmlookup (mapping st) loc\"\n\ndefinition emptyStore :: \"'v Store\"\nwhere \"emptyStore = \\<lparr> mapping=fmempty, toploc=0 \\<rparr>\"\n\ndeclare emptyStore_def [solidity_symbex]\n\nfun allocate :: \"'v Store \\<Rightarrow> Location * ('v Store)\"\nwhere \"allocate s = (let ntop = Suc(toploc s) in (ShowL\\<^sub>n\\<^sub>a\\<^sub>t ntop, s \\<lparr>toploc := ntop\\<rparr>))\"\n\nfun updateStore :: \"Location \\<Rightarrow> 'v \\<Rightarrow> 'v Store \\<Rightarrow> 'v Store\"\nwhere \"updateStore loc val s = s \\<lparr> mapping := fmupd loc val (mapping s)\\<rparr>\"\n\nfun push :: \"'v \\<Rightarrow> 'v Store \\<Rightarrow> 'v Store\"\n  where \"push val sto = (let s = updateStore (ShowL\\<^sub>n\\<^sub>a\\<^sub>t (toploc sto)) val sto in snd (allocate s))\"\n\nsubsection \\<open>Stack\\<close>\n(*Covered*)\ndatatype Stackvalue = KValue Valuetype\n                    | KCDptr Location\n                    | KMemptr Location\n                    | KStoptr Location\n\n(*Covered*)\ntype_synonym Stack = \"Stackvalue Store\"\n\nsubsection \\<open>Storage\\<close>\n\nsubsubsection \\<open>Definition\\<close>\n\ntype_synonym Storagevalue = Valuetype\n\n(*Covered*)\ntype_synonym StorageT = \"(Location,Storagevalue) fmap\"\n\n(*Covered*)\ndatatype STypes = STArray int STypes\n                | STMap Types STypes\n                | STValue Types\n\nsubsubsection \\<open>Example\\<close>\n\nabbreviation mystorage::StorageT\nwhere \"mystorage \\<equiv> (fmap_of_list\n  [(STR ''0.0.1'', STR ''True''),\n   (STR ''1.0.1'', STR ''False''),\n   (STR ''0.1.1'', STR ''True''),\n   (STR ''1.1.1'', STR ''False'')])\"\n\nsubsubsection \\<open>Access storage\\<close>\n\n(*Covered*)\nfun accessStorage :: \"Types \\<Rightarrow> Location \\<Rightarrow> StorageT \\<Rightarrow> Storagevalue\"\nwhere\n  \"accessStorage t loc sto =\n    (case fmlookup sto loc of\n      Some v \\<Rightarrow> v\n    | None \\<Rightarrow> ival t)\"\n\nsubsubsection \\<open>Copy from storage to storage\\<close>\n\nfun copyRec :: \"Location \\<Rightarrow> Location \\<Rightarrow> STypes \\<Rightarrow> StorageT \\<Rightarrow> StorageT option\"\nwhere\n  \"copyRec loc loc' (STArray x t) sto =\n    iter' (\\<lambda>i s'. copyRec (hash loc (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) (hash loc' (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) t s') sto x\"\n| \"copyRec loc loc' (STValue t) sto =\n    (let e = accessStorage t loc sto in Some (fmupd loc' e sto))\"\n| \"copyRec _ _ (STMap _ _) _ = None\"\n \nfun copy :: \"Location \\<Rightarrow> Location \\<Rightarrow> int \\<Rightarrow> STypes \\<Rightarrow> StorageT \\<Rightarrow> StorageT option\"\nwhere\n  \"copy loc loc' x t sto =\n    iter' (\\<lambda>i s'. copyRec (hash loc (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) (hash loc' (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) t s') sto x\"\n\nsubsection \\<open>Memory and Calldata\\<close>\n\nsubsubsection \\<open>Definition\\<close>\n\n(*Covered*)\ndatatype Memoryvalue =\n  MValue Valuetype\n  | MPointer Location\n(*Covered*)\ntype_synonym MemoryT = \"Memoryvalue Store\"\n(*Covered*)\ntype_synonym CalldataT = MemoryT\n(*Covered*)\ndatatype MTypes = MTArray int MTypes\n  | MTValue Types\n\nsubsubsection \\<open>Example\\<close>\n\nabbreviation mymemory::MemoryT\n  where \"mymemory \\<equiv>\n    \\<lparr>mapping = fmap_of_list\n      [(STR ''1.1.0'', MValue STR ''False''),\n       (STR ''0.1.0'', MValue STR ''True''),\n       (STR ''1.0'', MPointer STR ''1.0''),\n       (STR ''1.0.0'', MValue STR ''False''),\n       (STR ''0.0.0'', MValue STR ''True''),\n       (STR ''0.0'', MPointer STR ''0.0'')],\n     toploc = 1\\<rparr>\"\n\nsubsubsection \\<open>Initialization\\<close>\n\nsubsubsection \\<open>Definition\\<close>\n\n(*Covered*)\nfun minitRec :: \"Location \\<Rightarrow> MTypes \\<Rightarrow> MemoryT \\<Rightarrow> MemoryT\"\nwhere\n  \"minitRec loc (MTArray x t) = (\\<lambda>mem.\n    let m = updateStore loc (MPointer loc) mem\n    in iter (\\<lambda>i m' . minitRec (hash loc (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) t m') m x)\"\n| \"minitRec loc (MTValue t) = updateStore loc (MValue (ival t))\"\n\n(*Covered*)\nfun minit :: \"int \\<Rightarrow> MTypes \\<Rightarrow> MemoryT \\<Rightarrow> MemoryT\"\nwhere\n  \"minit x t mem =\n    (let l = ShowL\\<^sub>n\\<^sub>a\\<^sub>t (toploc mem);\n         m = iter (\\<lambda>i m' . minitRec (hash l (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) t m') mem x\n     in snd (allocate m))\"\n\nsubsubsection \\<open>Example\\<close>\n\nlemma \"minit 2 (MTArray 2 (MTValue TBool)) emptyStore =\n\\<lparr>mapping = fmap_of_list\n  [(STR ''0.0'', MPointer STR ''0.0''), (STR ''0.0.0'', MValue STR ''False''),\n   (STR ''1.0.0'', MValue STR ''False''), (STR ''1.0'', MPointer STR ''1.0''),\n   (STR ''0.1.0'', MValue STR ''False''), (STR ''1.1.0'', MValue STR ''False'')],\n  toploc = 1\\<rparr>\" by eval\n\nsubsubsection \\<open>Copy from memory to memory\\<close>\n\nsubsubsection \\<open>Definition\\<close>\n\nfun cpm2mrec :: \"Location \\<Rightarrow> Location \\<Rightarrow> MTypes \\<Rightarrow> MemoryT \\<Rightarrow> MemoryT \\<Rightarrow> MemoryT option\"\nwhere\n  \"cpm2mrec l\\<^sub>s l\\<^sub>d (MTArray x t) m\\<^sub>s m\\<^sub>d =\n    (case accessStore l\\<^sub>s m\\<^sub>s of\n      Some e \\<Rightarrow>\n        (case e of\n          MPointer l \\<Rightarrow> (let m = updateStore l\\<^sub>d (MPointer l\\<^sub>d) m\\<^sub>d\n             in iter' (\\<lambda>i m'. cpm2mrec (hash l\\<^sub>s (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) (hash l\\<^sub>d (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) t m\\<^sub>s m') m x)\n        | _ \\<Rightarrow> None)\n    | None \\<Rightarrow> None)\"\n| \"cpm2mrec l\\<^sub>s l\\<^sub>d (MTValue t) m\\<^sub>s m\\<^sub>d =\n    (case accessStore l\\<^sub>s m\\<^sub>s of\n      Some e \\<Rightarrow> (case e of\n          MValue v \\<Rightarrow> Some (updateStore l\\<^sub>d (MValue v) m\\<^sub>d)\n        | _ \\<Rightarrow> None)\n    | None \\<Rightarrow> None)\"\n \nfun cpm2m :: \"Location \\<Rightarrow> Location \\<Rightarrow> int \\<Rightarrow> MTypes \\<Rightarrow> MemoryT \\<Rightarrow> MemoryT \\<Rightarrow> MemoryT option\"\nwhere\n  \"cpm2m l\\<^sub>s l\\<^sub>d x t m\\<^sub>s m\\<^sub>d = iter' (\\<lambda>i m. cpm2mrec (hash l\\<^sub>s (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) (hash l\\<^sub>d (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) t m\\<^sub>s m) m\\<^sub>d x\"\n\nsubsubsection \\<open>Example\\<close>\n\nlemma \"cpm2m (STR ''0'') (STR ''0'') 2 (MTArray 2 (MTValue TBool)) mymemory (snd (allocate emptyStore)) = Some mymemory\"\n  by eval\n\nsubsection \\<open>Copy from storage to memory\\<close>\n\nsubsubsection \\<open>Definition\\<close>\n\n(*Covered*)\nfun cps2mrec :: \"Location \\<Rightarrow> Location \\<Rightarrow> STypes \\<Rightarrow> StorageT \\<Rightarrow> MemoryT \\<Rightarrow> MemoryT option\"\nwhere\n  \"cps2mrec locs locm (STArray x t) sto mem =\n    (let m = updateStore locm (MPointer locm) mem\n    in iter' (\\<lambda>i m'. cps2mrec (hash locs (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) (hash locm (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) t sto m') m x)\"\n| \"cps2mrec locs locm (STValue t) sto mem =\n    (let v = accessStorage t locs sto\n    in Some (updateStore locm (MValue v) mem))\"\n| \"cps2mrec _ _ (STMap _ _) _ _ = None\"\n\n(*Covered*)\nfun cps2m :: \"Location \\<Rightarrow> Location \\<Rightarrow> int \\<Rightarrow> STypes \\<Rightarrow> StorageT \\<Rightarrow> MemoryT \\<Rightarrow> MemoryT option\"\nwhere\n  \"cps2m locs locm x t sto mem =\n    iter' (\\<lambda>i m'. cps2mrec (hash locs (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) (hash locm (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) t sto m') mem x\"\n\nsubsubsection \\<open>Example\\<close>\n\nlemma \"cps2m (STR ''1'') (STR ''0'') 2 (STArray 2 (STValue TBool)) mystorage (snd (allocate emptyStore)) = Some mymemory\"\n  by eval\n\nsubsection \\<open>Copy from memory to storage\\<close>\n\nsubsubsection \\<open>Definition\\<close>\n\n(*covered*)\nfun cpm2srec :: \"Location \\<Rightarrow> Location \\<Rightarrow> MTypes \\<Rightarrow> MemoryT \\<Rightarrow> StorageT \\<Rightarrow> StorageT option\"\nwhere\n  \"cpm2srec locm locs (MTArray x t) mem sto =\n    (case accessStore locm mem of\n      Some e \\<Rightarrow>\n        (case e of\n          MPointer l \\<Rightarrow> iter' (\\<lambda>i s'. cpm2srec (hash locm (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) (hash locs (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) t mem s') sto x\n        | _ \\<Rightarrow> None)\n    | None \\<Rightarrow> None)\"\n| \"cpm2srec locm locs (MTValue t) mem sto =\n    (case accessStore locm mem of\n      Some e \\<Rightarrow> (case e of\n          MValue v \\<Rightarrow> Some (fmupd locs v sto)\n        | _ \\<Rightarrow> None)\n    | None \\<Rightarrow> None)\"\n\n(*covered*)\nfun cpm2s :: \"Location \\<Rightarrow> Location \\<Rightarrow> int \\<Rightarrow> MTypes \\<Rightarrow> MemoryT \\<Rightarrow> StorageT \\<Rightarrow> StorageT option\"\nwhere\n  \"cpm2s locm locs x t mem sto =\n    iter' (\\<lambda>i s'. cpm2srec (hash locm (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) (hash locs (ShowL\\<^sub>i\\<^sub>n\\<^sub>t i)) t mem s') sto x\"\n\nsubsubsection \\<open>Example\\<close>\n\nlemma \"cpm2s (STR ''0'') (STR ''1'') 2 (MTArray 2 (MTValue TBool)) mymemory fmempty = Some mystorage\"\n  by eval\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Solidity/Storage.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3181641180781102}}
{"text": "(*:maxLineLen=78:*)\n\ntheory Eq\nimports Base\nbegin\n\nchapter \\<open>Equational reasoning\\<close>\n\ntext \\<open>\n  Equality is one of the most fundamental concepts of mathematics. The\n  Isabelle/Pure logic (\\chref{ch:logic}) provides a builtin relation \\<open>\\<equiv> :: \\<alpha> \\<Rightarrow>\n  \\<alpha> \\<Rightarrow> prop\\<close> that expresses equality of arbitrary terms (or propositions) at\n  the framework level, as expressed by certain basic inference rules\n  (\\secref{sec:eq-rules}).\n\n  Equational reasoning means to replace equals by equals, using reflexivity\n  and transitivity to form chains of replacement steps, and congruence rules\n  to access sub-structures. Conversions (\\secref{sec:conv}) provide a\n  convenient framework to compose basic equational steps to build specific\n  equational reasoning tools.\n\n  Higher-order matching is able to provide suitable instantiations for giving\n  equality rules, which leads to the versatile concept of \\<open>\\<lambda>\\<close>-term rewriting\n  (\\secref{sec:rewriting}). Internally this is based on the general-purpose\n  Simplifier engine of Isabelle, which is more specific and more efficient\n  than plain conversions.\n\n  Object-logics usually introduce specific notions of equality or equivalence,\n  and relate it with the Pure equality. This enables to re-use the Pure tools\n  for equational reasoning for particular object-logic connectives as well.\n\\<close>\n\n\nsection \\<open>Basic equality rules \\label{sec:eq-rules}\\<close>\n\ntext \\<open>\n  Isabelle/Pure uses \\<open>\\<equiv>\\<close> for equality of arbitrary terms, which includes\n  equivalence of propositions of the logical framework. The conceptual\n  axiomatization of the constant \\<open>\\<equiv> :: \\<alpha> \\<Rightarrow> \\<alpha> \\<Rightarrow> prop\\<close> is given in\n  \\figref{fig:pure-equality}. The inference kernel presents slightly different\n  equality rules, which may be understood as derived rules from this minimal\n  axiomatization. The Pure theory also provides some theorems that express the\n  same reasoning schemes as theorems that can be composed like object-level\n  rules as explained in \\secref{sec:obj-rules}.\n\n  For example, \\<^ML>\\<open>Thm.symmetric\\<close> as Pure inference is an ML function that\n  maps a theorem \\<open>th\\<close> stating \\<open>t \\<equiv> u\\<close> to one stating \\<open>u \\<equiv> t\\<close>. In contrast,\n  @{thm [source] Pure.symmetric} as Pure theorem expresses the same reasoning\n  in declarative form. If used like \\<open>th [THEN Pure.symmetric]\\<close> in Isar source\n  notation, it achieves a similar effect as the ML inference function,\n  although the rule attribute @{attribute THEN} or ML operator \\<^ML>\\<open>op RS\\<close>\n  involve the full machinery of higher-order unification (modulo\n  \\<open>\\<beta>\\<eta>\\<close>-conversion) and lifting of \\<open>\\<And>/\\<Longrightarrow>\\<close> contexts.\n\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{define_ML Thm.reflexive: \"cterm -> thm\"} \\\\\n  @{define_ML Thm.symmetric: \"thm -> thm\"} \\\\\n  @{define_ML Thm.transitive: \"thm -> thm -> thm\"} \\\\\n  @{define_ML Thm.abstract_rule: \"string -> cterm -> thm -> thm\"} \\\\\n  @{define_ML Thm.combination: \"thm -> thm -> thm\"} \\\\[0.5ex]\n  @{define_ML Thm.equal_intr: \"thm -> thm -> thm\"} \\\\\n  @{define_ML Thm.equal_elim: \"thm -> thm -> thm\"} \\\\\n  \\end{mldecls}\n\n  See also \\<^file>\\<open>~~/src/Pure/thm.ML\\<close> for further description of these inference\n  rules, and a few more for primitive \\<open>\\<beta>\\<close> and \\<open>\\<eta>\\<close> conversions. Note that \\<open>\\<alpha>\\<close>\n  conversion is implicit due to the representation of terms with de-Bruijn\n  indices (\\secref{sec:terms}).\n\\<close>\n\n\nsection \\<open>Conversions \\label{sec:conv}\\<close>\n\ntext \\<open>\n  The classic article \\<^cite>\\<open>\"paulson:1983\"\\<close> introduces the concept of\n  conversion for Cambridge LCF. This was historically important to implement\n  all kinds of ``simplifiers'', but the Isabelle Simplifier is done quite\n  differently, see \\<^cite>\\<open>\\<open>\\S9.3\\<close> in \"isabelle-isar-ref\"\\<close>.\n\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{define_ML_structure Conv} \\\\\n  @{define_ML_type conv} \\\\\n  @{define_ML Simplifier.asm_full_rewrite : \"Proof.context -> conv\"} \\\\\n  \\end{mldecls}\n\n  \\<^descr> \\<^ML_structure>\\<open>Conv\\<close> is a library of combinators to build conversions,\n  over type \\<^ML_type>\\<open>conv\\<close> (see also \\<^file>\\<open>~~/src/Pure/conv.ML\\<close>). This is one\n  of the few Isabelle/ML modules that are usually used with \\<^verbatim>\\<open>open\\<close>: finding\n  examples works by searching for ``\\<^verbatim>\\<open>open Conv\\<close>'' instead of ``\\<^verbatim>\\<open>Conv.\\<close>''.\n\n  \\<^descr> \\<^ML>\\<open>Simplifier.asm_full_rewrite\\<close> invokes the Simplifier as a\n  conversion. There are a few related operations, corresponding to the various\n  modes of simplification.\n\\<close>\n\n\nsection \\<open>Rewriting \\label{sec:rewriting}\\<close>\n\ntext \\<open>\n  Rewriting normalizes a given term (theorem or goal) by replacing instances\n  of given equalities \\<open>t \\<equiv> u\\<close> in subterms. Rewriting continues until no\n  rewrites are applicable to any subterm. This may be used to unfold simple\n  definitions of the form \\<open>f x\\<^sub>1 \\<dots> x\\<^sub>n \\<equiv> u\\<close>, but is slightly more general than\n  that. \\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{define_ML rewrite_rule: \"Proof.context -> thm list -> thm -> thm\"} \\\\\n  @{define_ML rewrite_goals_rule: \"Proof.context -> thm list -> thm -> thm\"} \\\\\n  @{define_ML rewrite_goal_tac: \"Proof.context -> thm list -> int -> tactic\"} \\\\\n  @{define_ML rewrite_goals_tac: \"Proof.context -> thm list -> tactic\"} \\\\\n  @{define_ML fold_goals_tac: \"Proof.context -> thm list -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\<^descr> \\<^ML>\\<open>rewrite_rule\\<close>~\\<open>ctxt rules thm\\<close> rewrites the whole theorem by the\n  given rules.\n\n  \\<^descr> \\<^ML>\\<open>rewrite_goals_rule\\<close>~\\<open>ctxt rules thm\\<close> rewrites the outer premises of\n  the given theorem. Interpreting the same as a goal state\n  (\\secref{sec:tactical-goals}) it means to rewrite all subgoals (in the same\n  manner as \\<^ML>\\<open>rewrite_goals_tac\\<close>).\n\n  \\<^descr> \\<^ML>\\<open>rewrite_goal_tac\\<close>~\\<open>ctxt rules i\\<close> rewrites subgoal \\<open>i\\<close> by the given\n  rewrite rules.\n\n  \\<^descr> \\<^ML>\\<open>rewrite_goals_tac\\<close>~\\<open>ctxt rules\\<close> rewrites all subgoals by the given\n  rewrite rules.\n\n  \\<^descr> \\<^ML>\\<open>fold_goals_tac\\<close>~\\<open>ctxt rules\\<close> essentially uses \\<^ML>\\<open>rewrite_goals_tac\\<close>\n  with the symmetric form of each member of \\<open>rules\\<close>, re-ordered to fold longer\n  expression first. This supports to idea to fold primitive definitions that\n  appear in expended form in the proof state.\n\\<close>\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/Doc/Implementation/Eq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.3181641180781102}}
{"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n *  Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory VHDL_Hoare_Complete\n  imports VHDL_Hoare\n          \"HOL-Library.Poly_Mapping\"\nbegin\n\nsubsection \\<open>A sound and complete Hoare logic for VHDL's sequential statements\\<close>\n\ndefinition worldline_upd2 ::\n  \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal \\<Rightarrow> nat \\<Rightarrow> val \\<Rightarrow> nat \\<times> 'signal worldline_init\" (\"_[ _, _ :=\\<^sub>2 _]\")\n  where \"worldline_upd2 \\<equiv> \\<lambda>tw sig dly val. (fst tw, worldline_upd (snd tw) sig (fst tw + dly) val)\"\n\nlemma fst_worldline_upd2 [simp]:\n  \"fst (tw[sig, t :=\\<^sub>2 v]) = fst tw\"\n  unfolding worldline_upd2_def by auto\n\nlemma switch_worldline_upd2:\n  assumes \"sig1 \\<noteq> sig2\"\n  shows \"tw[sig1, dly1 :=\\<^sub>2 v1][sig2, dly2 :=\\<^sub>2 v2] = tw[sig2, dly2 :=\\<^sub>2 v2][sig1, dly1 :=\\<^sub>2 v1]\"\n  using assms unfolding worldline_upd2_def worldline_upd_def fst_conv snd_conv\n  by force\n\nlemma switch_assignment3: \n  assumes \"sig1 \\<noteq> sig2\" and \"sig2 \\<noteq> sig3\" and \"sig1 \\<noteq> sig3\"\n  shows   \"tw[sig1, dly1 :=\\<^sub>2 v1][sig2, dly2 :=\\<^sub>2 v2][sig3, dly3 :=\\<^sub>2 v3] = \n           tw[sig2, dly2 :=\\<^sub>2 v2][sig3, dly3 :=\\<^sub>2 v3][sig1, dly1 :=\\<^sub>2 v1]\"\n  using assms\n  unfolding worldline_upd2_def snd_conv worldline_upd_def fst_conv \n  by (auto intro!:ext)\n\nabbreviation wline_of where \"wline_of (tw :: nat \\<times> 'signal worldline_init) \\<equiv> (snd o snd) tw\"\n\nlemma worldline_upd2_before_dly:\n  fixes tw val dly sig\n  defines \"tw' \\<equiv> tw[sig, dly :=\\<^sub>2 val]\"\n  shows \"\\<And>s i. i < fst tw + dly \\<Longrightarrow> wline_of tw' s i = wline_of tw s i\"\n  unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n\nlemma worldline_upd2_at_dly:\n  fixes tw val dly sig\n  defines \"tw' \\<equiv> tw[sig, dly :=\\<^sub>2 val]\"\n  shows \"wline_of tw' sig (fst tw + dly) = val\"\n  unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n\nlemma worldline_upd2_at_dly_nonsig:\n  fixes tw val dly sig\n  defines \"tw' \\<equiv> tw[sig, dly :=\\<^sub>2 val]\"\n  shows \"s \\<noteq> sig \\<Longrightarrow> wline_of tw' s (fst tw + dly) = wline_of tw s (fst tw + dly)\"\n  unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n\nlemma worldline_upd2_after_dly:\n  fixes tw val dly sig\n  defines \"tw' \\<equiv> tw[sig, dly :=\\<^sub>2 val]\"\n  shows \"\\<And>s i. fst tw + dly < i \\<Longrightarrow> wline_of (fst tw + dly, snd tw') sig i = val\"\n  unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n\nlemma snd_worldline_upd2:\n  \"sig \\<noteq> sig' \\<Longrightarrow> snd (snd (tw[sig, t :=\\<^sub>2 v])) sig' t' = snd (snd tw) sig' t'\"\n  unfolding worldline_upd2_def worldline_upd_def by auto\n\nlemma snd_worldline_upd2':\n  \"0 < t \\<Longrightarrow> t' \\<le> fst tw \\<Longrightarrow> snd (snd (tw[sig, t :=\\<^sub>2 v])) sig' t' = snd (snd tw) sig' t'\"\n  unfolding worldline_upd2_def worldline_upd_def by auto\n\ndefinition worldline_inert_upd2 ::\n  \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal \\<Rightarrow> nat \\<Rightarrow> val \\<Rightarrow> nat \\<times> 'signal worldline_init\" (\"_\\<lbrakk> _, _ :=\\<^sub>2 _\\<rbrakk>\")\n  where \"worldline_inert_upd2 \\<equiv> \\<lambda>tw sig dly v. (fst tw, VHDL_Hoare.worldline_inert_upd2 (snd tw) sig (fst tw) dly v)\"\n\nlemma fst_worldline_inert_upd2:\n  \"fst (worldline_inert_upd2 tw sig dly v) = fst tw\"\n  unfolding worldline_inert_upd2_def worldline_inert_upd_def by auto\n\nlemma snd_worldline_inert_upd2_bv:\n  \"0 < t \\<Longrightarrow> t' \\<le> fst tw \\<Longrightarrow> snd (snd (tw\\<lbrakk>sig, t :=\\<^sub>2 Bv b\\<rbrakk>)) sig' t' = snd (snd tw) sig' t'\"\nproof -\n  assume \"0 < t\" and \"t' \\<le> fst tw\"\n  have \"snd (snd (tw\\<lbrakk>sig, t :=\\<^sub>2 Bv b\\<rbrakk>)) sig' t' = (let time =\n           if snd (snd tw) sig (get_time tw) = Bv b \\<or> snd (snd tw) sig (get_time tw + t) \\<noteq> Bv b then get_time tw + t\n           else GREATEST n. n \\<le> get_time tw + t \\<and> snd (snd tw) sig (n - 1) \\<noteq> Bv b \\<and> snd (snd tw) sig n = Bv b\n     in if sig' \\<noteq> sig \\<or> t' < get_time tw then snd (snd tw) sig' t' else if t' < time then snd (snd tw) sig' (get_time tw) else Bv b)\"\n    (is \"_ = ?comp\")\n    unfolding worldline_inert_upd2_def snd_conv VHDL_Hoare.worldline_inert_upd2.simps worldline_inert_upd_def by auto\n  have \"(snd (snd tw) sig (get_time tw) = Bv b \\<or> snd (snd tw) sig (get_time tw + t) \\<noteq> Bv b) \\<or> \n      \\<not> (snd (snd tw) sig (get_time tw) = Bv b \\<or> snd (snd tw) sig (get_time tw + t) \\<noteq> Bv b)\"\n    by auto\n  moreover\n  { assume \"snd (snd tw) sig (get_time tw) = Bv b \\<or> snd (snd tw) sig (get_time tw + t) \\<noteq> Bv b\"\n    hence \"?comp = (if sig' \\<noteq> sig \\<or> t' < get_time tw then snd (snd tw) sig' t' else if t' < fst tw + t then snd (snd tw) sig' (get_time tw) else Bv b)\"\n      by auto\n    also have \"... = snd (snd tw) sig' t'\"\n      using \\<open>0 < t\\<close> \\<open>t' \\<le> get_time tw\\<close> by auto\n    finally have \"?comp = snd (snd tw) sig' t'\"\n      by auto }\n  moreover\n  { let ?t = \"GREATEST n. n \\<le> get_time tw + t \\<and> snd (snd tw) sig (n - 1) \\<noteq> Bv b \\<and> snd (snd tw) sig n = Bv b\"\n    assume \"\\<not> (snd (snd tw) sig (get_time tw) = Bv b \\<or> snd (snd tw) sig (get_time tw + t) \\<noteq> Bv b)\"\n    hence temp: \"?comp = (if sig' \\<noteq> sig \\<or> t' < get_time tw then snd (snd tw) sig' t' else if t' < ?t then snd (snd tw) sig' (get_time tw) else Bv b)\"\n      by auto\n    have \"snd (snd tw) sig (fst tw) \\<noteq> Bv b\" and \"snd (snd tw) sig (fst tw + t) = Bv b\"\n      using \\<open>\\<not> (snd (snd tw) sig (get_time tw) = Bv b \\<or> snd (snd tw) sig (get_time tw + t) \\<noteq> Bv b)\\<close> by auto\n    have *: \"\\<exists>n. fst tw \\<le> n \\<and> n \\<le> get_time tw + t \\<and> snd (snd tw) sig (n - 1) \\<noteq> Bv b \\<and> snd (snd tw) sig n = Bv b\"\n    proof (rule ccontr)\n      assume \"\\<not> (\\<exists>n. fst tw \\<le> n \\<and> n \\<le> get_time tw + t \\<and> snd (snd tw) sig (n - 1) \\<noteq> Bv b \\<and> snd (snd tw) sig n = Bv b)\"\n      hence \"\\<forall>n. fst tw \\<le> n \\<and> n \\<le> fst tw + t \\<and> snd (snd tw) sig (n - 1) \\<noteq> Bv b \\<longrightarrow> snd (snd tw) sig n \\<noteq> Bv b\"\n        by auto\n      have \"(\\<forall>n. fst tw \\<le> n \\<and> n \\<le> fst tw + t \\<longrightarrow> snd (snd tw) sig n \\<noteq> Bv b) \\<longleftrightarrow> \n            (\\<forall>j. j \\<le> t \\<longrightarrow> snd (snd tw) sig (j + fst tw) \\<noteq> Bv b)\"\n        by (metis \\<open>snd (snd tw) sig (get_time tw + t) = Bv b\\<close> add.commute add_leD2 order_refl)\n      have \"(\\<forall>j. j \\<le> t \\<longrightarrow> snd (snd tw) sig (j + fst tw) \\<noteq> Bv b)\"\n      proof (rule, rule)\n        fix j \n        show \"j \\<le> t  \\<Longrightarrow> snd (snd tw) sig (j + get_time tw) \\<noteq> Bv b\"\n        proof (induction j)\n          case 0\n          then show ?case using \\<open>snd (snd tw) sig (fst tw) \\<noteq> Bv b\\<close> by auto\n        next\n          case (Suc j)\n          hence \"j \\<le> t\" by  linarith\n          hence \"snd (snd tw) sig (j + get_time tw) \\<noteq> Bv b\"\n            using Suc by auto\n          then show ?case \n            using \\<open>\\<forall>n. fst tw \\<le> n \\<and> n \\<le> fst tw + t \\<and> snd (snd tw) sig (n - 1) \\<noteq> Bv b \\<longrightarrow> snd (snd tw) sig n \\<noteq> Bv b\\<close> \\<open>j \\<le> t\\<close> Suc(2)\n            by (simp add: \\<open>snd (snd tw) sig (j + get_time tw) \\<noteq> Bv b\\<close>)\n        qed\n      qed\n      thus False\n        by (metis (full_types) \\<open>snd (snd tw) sig (get_time tw + t) = Bv b\\<close> add.commute order_refl)\n    qed\n    hence ***: \"\\<exists>n. n \\<le> get_time tw + t \\<and> snd (snd tw) sig (n - 1) \\<noteq> Bv b \\<and> snd (snd tw) sig n = Bv b\"\n      by blast\n    have **: \"\\<forall>y. y \\<le> get_time tw + t \\<and> snd (snd tw) sig (y - 1) \\<noteq> Bv b \\<and> snd (snd tw) sig y = Bv b \\<longrightarrow> y \\<le> fst tw + t\"\n      by blast\n    hence \"?t \\<le> fst tw + t\" and \"snd (snd tw) sig (?t - 1) \\<noteq> Bv b \" and \" snd (snd tw) sig ?t = Bv b\"\n      using GreatestI_ex_nat[OF *** **] by auto\n    have \"?t \\<noteq> fst tw\"\n      using \\<open>snd (snd tw) sig (GREATEST n. n \\<le> get_time tw + t \\<and> snd (snd tw) sig (n - 1) \\<noteq> Bv b \\<and> snd\n      (snd tw) sig n = Bv b) = Bv b\\<close> \\<open>snd (snd tw) sig (get_time tw) \\<noteq> Bv b\\<close> by auto\n    have \"fst tw < ?t\"\n    proof (rule ccontr)\n      assume \"\\<not> fst tw < ?t\" hence \"?t \\<le> fst tw\" by auto hence \"?t < fst tw\" using `?t \\<noteq> fst tw` by auto\n      obtain n where \"fst tw \\<le> n\" and \"n \\<le> fst tw + t\" and \"snd (snd tw) sig (n - 1) \\<noteq> Bv b\" and \n        \"snd (snd tw) sig n = Bv b\" using * by blast\n      hence \"n \\<le> ?t\"\n        using Greatest_le_nat[where b=\"fst tw + t\"] by auto\n      hence \"n < fst tw\"\n        using `?t < fst tw` by auto\n      with `fst tw \\<le> n` show False by auto\n    qed\n    consider \"sig' \\<noteq> sig \\<or> t' < get_time tw\" | \"sig' = sig \\<and> fst tw \\<le> t'\"\n      using not_le_imp_less by blast\n    hence \"?comp = snd (snd tw) sig' t'\"\n    proof (cases)\n      case 2\n      with `t' \\<le> fst tw` have \"fst tw = t'\" by auto\n      hence \"t' < ?t\" using `fst tw < ?t` by auto\n      then show ?thesis \n        unfolding temp  by (simp add: \\<open>get_time tw = t'\\<close>)\n    qed auto }\n  ultimately have \"?comp = snd (snd tw) sig' t'\"\n    by auto\n  thus ?thesis\n    by (simp add: \\<open>snd (snd tw\\<lbrakk> sig, t :=\\<^sub>2 Bv b\\<rbrakk>) sig' t' = ?comp\\<close>)\nqed\n\nlemma snd_worldline_inert_upd2_lv:\n  \"0 < t \\<Longrightarrow> t' \\<le> fst tw \\<Longrightarrow> snd (snd (tw\\<lbrakk>sig, t :=\\<^sub>2 Lv sign bs\\<rbrakk>)) sig' t' = snd (snd tw) sig' t'\"\nproof -\n  assume \"0 < t\" and \"t' \\<le> fst tw\"\n  have \"sig = sig' \\<or> sig \\<noteq> sig'\"\n    by auto\n  moreover\n  { assume \"sig \\<noteq> sig'\"\n    hence ?thesis\n      unfolding worldline_inert_upd2_def snd_conv VHDL_Hoare.worldline_inert_upd2.simps fun_upd_def\n      by auto }\n  moreover\n  { assume \"sig = sig'\"\n    hence *: \"snd (snd (tw\\<lbrakk>sig, t :=\\<^sub>2 Lv sign bs\\<rbrakk>)) sig' t' = (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, t := Bv (bs ! b)];\n                  time =\n                    if \\<exists>n>get_time tw. n \\<le> get_time tw + t \\<and> (\\<exists>b\\<in>set [0..<length bs]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                    then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + t \\<and> (\\<exists>b\\<in>set [0..<length bs]. w' b sig (n - 1) \\<noteq> w' b sig n) else get_time tw + t\n              in if t' < get_time tw then snd (snd tw) sig t'\n                 else if t' < time then snd (snd tw) sig (get_time tw)\n                      else Lv sign (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, t := Bv (bs ! b)] sig t')) [0..<length bs]))\"\n      unfolding worldline_inert_upd2_def snd_conv VHDL_Hoare.worldline_inert_upd2.simps fun_upd_def\n      by auto\n    have \"t' < fst tw \\<or> t' = fst tw\"\n      using \\<open>t' \\<le> fst tw\\<close> by auto\n    moreover\n    { assume \"t' < fst tw\"\n      hence ?thesis\n        unfolding * using \\<open>sig = sig'\\<close> by auto }\n    moreover\n    { assume \"t' = fst tw\"\n      let ?w' = \"\\<lambda>b. snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, t := Bv (bs ! b)]\"\n      have \"(\\<exists>n>get_time tw. n \\<le> get_time tw + t \\<and> (\\<exists>b\\<in>set [0..<length bs]. ?w' b sig (n - 1) \\<noteq> ?w' b sig n)) \\<or> \n          \\<not> (\\<exists>n>get_time tw. n \\<le> get_time tw + t \\<and> (\\<exists>b\\<in>set [0..<length bs]. ?w' b sig (n - 1) \\<noteq> ?w' b sig n))\"\n        by auto\n      moreover\n      { assume exist: \"\\<exists>n>get_time tw. n \\<le> get_time tw + t \\<and> (\\<exists>b\\<in>set [0..<length bs]. ?w' b sig (n - 1) \\<noteq> ?w' b sig n)\"\n        hence \"t' < (LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + t \\<and> (\\<exists>b\\<in>set [0..<length bs]. ?w' b sig (n - 1) \\<noteq> ?w' b sig n))\"\n          by (metis (mono_tags, lifting) LeastI_ex \\<open>t' = get_time tw\\<close>)\n        hence ?thesis\n          using exist unfolding *  by (simp add: \\<open>sig = sig'\\<close> \\<open>t' = get_time tw\\<close>) }\n      moreover\n      { assume nonexist: \"\\<not> (\\<exists>n>get_time tw. n \\<le> get_time tw + t \\<and> (\\<exists>b\\<in>set [0..<length bs]. ?w' b sig (n - 1) \\<noteq> ?w' b sig n))\"\n        hence ?thesis\n          unfolding * using \\<open>t' \\<le> fst tw\\<close> \\<open>0 < t\\<close>  using \\<open>sig = sig'\\<close> by auto }\n      ultimately have ?thesis\n        by auto }\n    ultimately have ?thesis\n      by auto }\n  ultimately show ?thesis\n    by auto\nqed\n\nlemma snd_worldline_inert_upd2:\n  \"0 < t \\<Longrightarrow> t' \\<le> fst tw \\<Longrightarrow> snd (snd (tw\\<lbrakk>sig, t :=\\<^sub>2 v\\<rbrakk>)) sig' t' = snd (snd tw) sig' t'\"\n  using snd_worldline_inert_upd2_bv snd_worldline_inert_upd2_lv\n  by (induction v)\n  \nlemma switch_worldline_inert_upd2:\n  assumes \"sig \\<noteq> sig'\"\n  shows \"(tw\\<lbrakk>sig, dly :=\\<^sub>2 v\\<rbrakk>)\\<lbrakk>sig', dly' :=\\<^sub>2 v'\\<rbrakk> = (tw\\<lbrakk>sig', dly' :=\\<^sub>2 v'\\<rbrakk>)\\<lbrakk>sig, dly :=\\<^sub>2 v\\<rbrakk>\"\n  apply (rule)\n  subgoal by (auto simp add: fst_worldline_inert_upd2)\n  subgoal \n    apply (rule)\n    subgoal unfolding worldline_inert_upd2_def worldline_inert_upd_def fst_conv snd_conv\n      apply (induction v)\n       apply (induction v')\n      unfolding VHDL_Hoare.worldline_inert_upd2.simps \n        apply (simp add: worldline_inert_upd_def)\n       apply (simp add: worldline_inert_upd_def)\n      apply (induction v')\n      unfolding VHDL_Hoare.worldline_inert_upd2.simps \n        apply (simp add: worldline_inert_upd_def)\n       apply (simp add: worldline_inert_upd_def)\n      done\n    apply (rule ext)\n    apply (rule ext)\n  proof -\n    fix s' t'\n    have \"s' \\<noteq> sig' \\<and> s' \\<noteq> sig \\<or> s' = sig \\<or> s' = sig'\"\n      by auto\n    moreover\n    { assume \"s' \\<noteq> sig' \\<and> s' \\<noteq> sig\"\n      hence \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>) s' t' = snd (snd tw) s' t'\"\n        unfolding worldline_inert_upd2_def worldline_inert_upd_def snd_conv fst_conv\n        apply (induction v)\n         apply (induction v')\n          apply (simp add: worldline_inert_upd_def)\n         apply (simp add: worldline_inert_upd_def)\n        apply (induction v')\n          apply (simp add: worldline_inert_upd_def)\n         apply (simp add: worldline_inert_upd_def)\n        done\n      also have \"... = snd (snd tw\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        using `s' \\<noteq> sig' \\<and> s' \\<noteq> sig`\n        unfolding worldline_inert_upd2_def worldline_inert_upd_def \n        apply (induction v)\n         apply (induction v')\n          apply (simp add: worldline_inert_upd_def)\n         apply (simp add: worldline_inert_upd_def)\n        apply (induction v')\n          apply (simp add: worldline_inert_upd_def)\n         apply (simp add: worldline_inert_upd_def)\n        done\n      finally have \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>) s' t' = snd (snd tw\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by auto }\n    moreover\n    { assume \"s' = sig\" hence \"s' \\<noteq> sig'\" using assms by auto\n      hence \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>) s' t' = snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        unfolding worldline_inert_upd2_def worldline_inert_upd_def \n        apply (induction v)\n         apply (induction v')\n          apply (simp add: worldline_inert_upd_def)\n         apply (simp add: worldline_inert_upd_def)\n        apply (induction v')\n          apply (simp add: worldline_inert_upd_def)\n         apply (simp add: worldline_inert_upd_def)\n        done\n      moreover have \"snd (snd tw\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t' = snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        using `s' = sig` `s' \\<noteq> sig'` unfolding worldline_inert_upd2_def worldline_inert_upd_def \n        apply (induction v)\n         apply (induction v')\n          apply (simp add: worldline_inert_upd_def)\n         apply (simp add: worldline_inert_upd_def)\n      proof (induction v')\n        case (Bv x)\n        define exp where \"exp = (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig' (get_time tw) dly' (Bv x))\"\n        have \"snd (VHDL_Hoare.worldline_inert_upd2 (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig' (get_time tw) dly' (Bv x)) sig (get_time tw) dly (Lv x1a x2)) s' t' = \n              snd (VHDL_Hoare.worldline_inert_upd2 exp sig (get_time tw) dly (Lv x1a x2)) s' t'\"\n          unfolding exp_def by auto\n        also have \"... = ((snd exp) (sig := \\<lambda>n. let w' = \\<lambda>b. snd to_worldline_init_bit exp sig b[sig, get_time tw, dly := Bv (x2 ! b)];\n                                                    time =\n                                                      if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                                                      then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                                                      else get_time tw + dly\n                                                in if n < get_time tw then snd exp sig n\n                                                   else if n < time then snd exp sig (get_time tw)\n                                                        else Lv x1a\n                                                              (map (\\<lambda>b. bval_of (snd to_worldline_init_bit exp sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig n))\n                                                                [0..<length x2])))\n                                         s' t'\"\n          unfolding VHDL_Hoare.worldline_inert_upd2.simps snd_conv by auto\n        also have \"... = (let w' = \\<lambda>b. snd to_worldline_init_bit exp sig b[sig, get_time tw, dly := Bv (x2 ! b)];\n                  time =\n                    if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                    then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                    else get_time tw + dly\n              in if t' < get_time tw then snd exp sig t'\n                 else if t' < time then snd exp sig (get_time tw)\n                      else Lv x1a\n                            (map (\\<lambda>b. bval_of (snd to_worldline_init_bit exp sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig t'))\n                              [0..<length x2]))\"\n          unfolding fun_upd_def \\<open>s' = sig\\<close> by auto\n        also have \"... = (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)];\n                  time =\n                    if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                    then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                    else get_time tw + dly\n              in if t' < get_time tw then snd (snd tw) sig t'\n                 else if t' < time then snd (snd tw) sig (get_time tw)\n                      else Lv x1a\n                            (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig t'))\n                              [0..<length x2]))\"        \n        proof -\n          have \"\\<And>b k. ((snd exp)(sig := to_bit b \\<circ> snd exp sig)) sig k = ((snd (snd tw))(sig := to_bit b \\<circ> snd (snd tw) sig)) sig k\"\n            unfolding exp_def apply auto \n            using assms unfolding worldline_inert_upd_def snd_conv by auto\n          hence *: \"\\<And>b . snd to_worldline_init_bit exp sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig  = \n                       snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig \"\n            unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n          have **: \"snd exp sig = snd (snd tw) sig \"\n            unfolding exp_def using assms by (auto simp add: worldline_inert_upd_def)\n          show ?thesis\n            unfolding Let_def * ** by auto\n        qed\n        also have \"... =  snd (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig (get_time tw) dly (Lv x1a x2)) s' t'\"\n          unfolding  VHDL_Hoare.worldline_inert_upd2.simps snd_conv fun_upd_def \\<open>s' = sig\\<close> by auto\n        finally show ?case \n          by auto\n      next\n        case (Lv sign bs)\n        define exp where \"exp = (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig' (get_time tw) dly' (Lv sign bs))\"\n        have \"snd (VHDL_Hoare.worldline_inert_upd2 (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig' (get_time tw) dly' (Lv sign bs)) sig (get_time tw) dly (Lv x1a x2)) s' t' = \n              snd (VHDL_Hoare.worldline_inert_upd2 exp sig (get_time tw) dly (Lv x1a x2)) s' t'\"\n          unfolding exp_def by auto\n        also have \"... = ((snd exp) (sig := \\<lambda>n. let w' = \\<lambda>b. snd to_worldline_init_bit exp sig b[sig, get_time tw, dly := Bv (x2 ! b)];\n                                                    time =\n                                                      if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                                                      then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                                                      else get_time tw + dly\n                                                in if n < get_time tw then snd exp sig n\n                                                   else if n < time then snd exp sig (get_time tw)\n                                                        else Lv x1a\n                                                              (map (\\<lambda>b. bval_of (snd to_worldline_init_bit exp sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig n))\n                                                                [0..<length x2])))\n                                         s' t'\"\n          unfolding VHDL_Hoare.worldline_inert_upd2.simps snd_conv by auto\n        also have \"... = (let w' = \\<lambda>b. snd to_worldline_init_bit exp sig b[sig, get_time tw, dly := Bv (x2 ! b)];\n                  time =\n                    if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                    then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                    else get_time tw + dly\n              in if t' < get_time tw then snd exp sig t'\n                 else if t' < time then snd exp sig (get_time tw)\n                      else Lv x1a\n                            (map (\\<lambda>b. bval_of (snd to_worldline_init_bit exp sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig t'))\n                              [0..<length x2]))\"\n          unfolding fun_upd_def \\<open>s' = sig\\<close> by auto\n        also have \"... = (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)];\n                  time =\n                    if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                    then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                    else get_time tw + dly\n              in if t' < get_time tw then snd (snd tw) sig t'\n                 else if t' < time then snd (snd tw) sig (get_time tw)\n                      else Lv x1a\n                            (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig t'))\n                              [0..<length x2]))\"        \n        proof -\n          have \"\\<And>b k. ((snd exp)(sig := to_bit b \\<circ> snd exp sig)) sig k = ((snd (snd tw))(sig := to_bit b \\<circ> snd (snd tw) sig)) sig k\"\n            unfolding exp_def apply auto \n            using assms unfolding worldline_inert_upd_def snd_conv by auto\n          hence *: \"\\<And>b . snd to_worldline_init_bit exp sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig  = \n                       snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig \"\n            unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n          have **: \"snd exp sig = snd (snd tw) sig \"\n            unfolding exp_def using assms by (auto simp add: worldline_inert_upd_def)\n          show ?thesis\n            unfolding Let_def * ** by auto\n        qed\n        also have \"... =  snd (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig (get_time tw) dly (Lv x1a x2)) s' t'\"\n          unfolding  VHDL_Hoare.worldline_inert_upd2.simps snd_conv fun_upd_def \\<open>s' = sig\\<close> by auto\n        finally show ?case \n          by auto\n      qed\n      ultimately have \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>) s' t' = snd (snd tw\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by auto }\n    moreover\n    { assume \"s' = sig'\" hence \"s' \\<noteq> sig\" using assms by auto\n      hence \"snd (snd tw\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t' = snd (snd tw\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>) s' t'\"\n        unfolding worldline_inert_upd2_def worldline_inert_upd_def \n        apply (induction v)\n         apply (induction v')\n          apply (simp add: worldline_inert_upd_def)\n         apply (simp add: worldline_inert_upd_def)\n        apply (induction v')\n          apply (simp add: worldline_inert_upd_def)\n         apply (simp add: worldline_inert_upd_def)\n        done\n      moreover have \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>) s' t' =  snd (snd tw\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>) s' t'\"\n        using `s' = sig'` `s' \\<noteq> sig` unfolding worldline_inert_upd2_def worldline_inert_upd_def \n      proof (induction v)\n        case (Bv x)\n        then show ?case \n        proof (induction v')\n          case (Bv x')\n          then show ?case \n            using \\<open>s' \\<noteq> sig\\<close>\n            unfolding snd_conv fst_conv VHDL_Hoare.worldline_inert_upd2.simps \\<open>s' = sig'\\<close> \n            worldline_inert_upd_def by auto\n        next\n          case (Lv sign bs)\n          define exp where \"exp = (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig (get_time tw) dly (Bv x))\"\n          hence \"snd (VHDL_Hoare.worldline_inert_upd2 (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig (get_time tw) dly (Bv x)) sig' (get_time tw) dly' (Lv sign bs)) s' t' = \n                 snd (VHDL_Hoare.worldline_inert_upd2 exp sig' (get_time tw) dly' (Lv sign bs)) s' t'\"\n            by auto\n          also have \"... = ((snd exp) (sig' := \\<lambda>n. let w' = \\<lambda>b. snd to_worldline_init_bit exp sig' b[sig', get_time tw, dly' := Bv (bs ! b)];\n                                                        time =\n                                                          if \\<exists>n>get_time tw. n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs]. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                                                          then LEAST n.\n                                                                  get_time tw < n \\<and> n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs]. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                                                          else get_time tw + dly'\n                                                    in if n < get_time tw then snd exp sig' n\n                                                       else if n < time then snd exp sig' (get_time tw)\n                                                            else Lv sign\n                                                                  (map (\\<lambda>b. bval_of (snd to_worldline_init_bit exp sig' b[sig', get_time tw, dly' := Bv (bs ! b)] sig' n))\n                                                                    [0..<length bs])))\n                                             s' t'\"\n            unfolding VHDL_Hoare.worldline_inert_upd2.simps snd_conv by auto\n          also have \"... = (let w' = \\<lambda>b. snd to_worldline_init_bit exp sig' b[sig', get_time tw, dly' := Bv (bs ! b)];\n                  time =\n                    if \\<exists>n>get_time tw. n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs]. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                    then LEAST n.\n                            get_time tw < n \\<and> n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs]. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                    else get_time tw + dly'\n              in if t' < get_time tw then snd exp sig' t'\n                 else if t' < time then snd exp sig' (get_time tw)\n                      else Lv sign\n                            (map (\\<lambda>b. bval_of (snd to_worldline_init_bit exp sig' b[sig', get_time tw, dly' := Bv (bs ! b)] sig' t'))\n                              [0..<length bs]))\"\n            unfolding `s' = sig'` fun_upd_def by auto\n          also have \"... = (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig' b[sig', get_time tw, dly' := Bv (bs ! b)];\n                  time =\n                    if \\<exists>n>get_time tw. n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs]. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                    then LEAST n.\n                            get_time tw < n \\<and> n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs]. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                    else get_time tw + dly'\n              in if t' < get_time tw then snd (snd tw) sig' t'\n                 else if t' < time then snd (snd tw) sig' (get_time tw)\n                      else Lv sign\n                            (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig' b[sig', get_time tw, dly' := Bv (bs ! b)] sig' t'))\n                              [0..<length bs]))\"\n          proof -\n            have \"\\<And>b k. ((snd exp)(sig' := to_bit b \\<circ> snd exp sig')) sig' k = ((snd (snd tw))(sig' := to_bit b \\<circ> snd (snd tw) sig')) sig' k\"\n              unfolding exp_def apply auto \n              using assms unfolding worldline_inert_upd_def snd_conv by auto\n            hence *: \"\\<And>b . snd to_worldline_init_bit exp sig' b[sig', get_time tw, dly' := Bv (bs ! b)] sig'  = \n                         snd to_worldline_init_bit (snd tw) sig' b[sig', get_time tw, dly' := Bv (bs ! b)] sig' \"\n              unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n            have **: \"snd exp sig' = snd (snd tw) sig' \"\n              unfolding exp_def using assms by (auto simp add: worldline_inert_upd_def)\n            show ?thesis\n              unfolding Let_def * ** by auto\n          qed\n          also have \"... = snd (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig' (get_time tw) dly' (Lv sign bs)) s' t'\"\n              unfolding VHDL_Hoare.worldline_inert_upd2.simps snd_conv `s' = sig'` fun_upd_def Let_def by auto\n          finally show ?case\n            unfolding snd_conv fst_conv by auto\n        qed\n      next\n        case (Lv sign bs)\n        then show ?case  \n        proof (induction v')\n          case (Bv x')\n          then show ?case \n            using \\<open>s' \\<noteq> sig\\<close>\n            unfolding snd_conv fst_conv VHDL_Hoare.worldline_inert_upd2.simps \\<open>s' = sig'\\<close> \n            worldline_inert_upd_def by auto\n        next\n          case (Lv sign' bs')\n          define exp where \"exp = (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig (get_time tw) dly (Lv sign bs))\"\n          hence \"snd (VHDL_Hoare.worldline_inert_upd2 (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig (get_time tw) dly (Lv sign bs)) sig' (get_time tw) dly' (Lv sign' bs')) s' t' = \n                 snd (VHDL_Hoare.worldline_inert_upd2 exp sig' (get_time tw) dly' (Lv sign' bs')) s' t'\"\n            by auto\n          also have \"... = ((snd exp) (sig' := \\<lambda>n. let w' = \\<lambda>b. snd to_worldline_init_bit exp sig' b[sig', get_time tw, dly' := Bv (bs' ! b)];\n                                                        time =\n                                                          if \\<exists>n>get_time tw. n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs']. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                                                          then LEAST n.\n                                                                  get_time tw < n \\<and> n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs']. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                                                          else get_time tw + dly'\n                                                    in if n < get_time tw then snd exp sig' n\n                                                       else if n < time then snd exp sig' (get_time tw)\n                                                            else Lv sign'\n                                                                  (map (\\<lambda>b. bval_of (snd to_worldline_init_bit exp sig' b[sig', get_time tw, dly' := Bv (bs' ! b)] sig' n))\n                                                                    [0..<length bs'])))\n                                             s' t'\"\n            unfolding VHDL_Hoare.worldline_inert_upd2.simps snd_conv by auto\n          also have \"... = (let w' = \\<lambda>b. snd to_worldline_init_bit exp sig' b[sig', get_time tw, dly' := Bv (bs' ! b)];\n                  time =\n                    if \\<exists>n>get_time tw. n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs']. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                    then LEAST n.\n                            get_time tw < n \\<and> n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs']. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                    else get_time tw + dly'\n              in if t' < get_time tw then snd exp sig' t'\n                 else if t' < time then snd exp sig' (get_time tw)\n                      else Lv sign'\n                            (map (\\<lambda>b. bval_of (snd to_worldline_init_bit exp sig' b[sig', get_time tw, dly' := Bv (bs' ! b)] sig' t'))\n                              [0..<length bs']))\"\n            unfolding `s' = sig'` fun_upd_def by auto\n          also have \"... = (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig' b[sig', get_time tw, dly' := Bv (bs' ! b)];\n                  time =\n                    if \\<exists>n>get_time tw. n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs']. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                    then LEAST n.\n                            get_time tw < n \\<and> n \\<le> get_time tw + dly' \\<and> (\\<exists>b\\<in>set [0..<length bs']. w' b sig' (n - 1) \\<noteq> w' b sig' n)\n                    else get_time tw + dly'\n              in if t' < get_time tw then snd (snd tw) sig' t'\n                 else if t' < time then snd (snd tw) sig' (get_time tw)\n                      else Lv sign'\n                            (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig' b[sig', get_time tw, dly' := Bv (bs' ! b)] sig' t'))\n                              [0..<length bs']))\"\n          proof -\n            have \"\\<And>b k. ((snd exp)(sig' := to_bit b \\<circ> snd exp sig')) sig' k = ((snd (snd tw))(sig' := to_bit b \\<circ> snd (snd tw) sig')) sig' k\"\n              unfolding exp_def apply auto \n              using assms unfolding worldline_inert_upd_def snd_conv by auto\n            hence *: \"\\<And>b . snd to_worldline_init_bit exp sig' b[sig', get_time tw, dly' := Bv (bs' ! b)] sig'  = \n                         snd to_worldline_init_bit (snd tw) sig' b[sig', get_time tw, dly' := Bv (bs' ! b)] sig' \"\n              unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n            have **: \"snd exp sig' = snd (snd tw) sig' \"\n              unfolding exp_def using assms by (auto simp add: worldline_inert_upd_def)\n            show ?thesis\n              unfolding Let_def * ** by auto\n          qed\n          also have \"... = snd (VHDL_Hoare.worldline_inert_upd2 (snd tw) sig' (get_time tw) dly' (Lv sign' bs')) s' t'\"\n              unfolding VHDL_Hoare.worldline_inert_upd2.simps snd_conv `s' = sig'` fun_upd_def Let_def by auto\n          finally show ?case\n            unfolding snd_conv fst_conv by auto\n        qed\n      qed\n      ultimately have \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>) s' t' = snd (snd tw\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by auto } \n    ultimately show \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>) s' t' = snd (snd tw\\<lbrakk> sig', dly' :=\\<^sub>2 v'\\<rbrakk>\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n      by auto\n  qed\n  done\n\nlemma switch_worldline_inert_non_inert:\n  assumes \"sig \\<noteq> sig'\"\n  shows \"(tw\\<lbrakk>sig, dly :=\\<^sub>2 v\\<rbrakk>)[sig', dly' :=\\<^sub>2 v'] = (tw[sig', dly' :=\\<^sub>2 v'])\\<lbrakk>sig, dly :=\\<^sub>2 v\\<rbrakk>\"\n  apply (rule)\n   apply (simp add: fst_worldline_inert_upd2)\n  apply (rule)\n  subgoal\n  proof (induction v)\n    case (Bv x)\n    then show ?case \n      by (auto simp add: worldline_inert_upd2_def  worldline_inert_upd_def worldline_upd2_def worldline_upd_def)\n  next\n    case (Lv x1a x2)\n    then show ?case \n      by (auto simp add: worldline_inert_upd2_def  worldline_inert_upd_def worldline_upd2_def worldline_upd_def)\n  qed\n  subgoal\n  proof (rule ext)+\n    fix s' t'\n    have \"s' \\<noteq> sig' \\<and> s' \\<noteq> sig \\<or> s' = sig \\<or> s' = sig'\"\n      by auto  \n    moreover\n    { assume \"s' \\<noteq> sig' \\<and> s' \\<noteq> sig\"\n      hence \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>[ sig', dly' :=\\<^sub>2 v']) s' t' = snd (snd tw) s' t'\"\n        by (induction v)(auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      also have \"... = snd (snd tw[ sig', dly' :=\\<^sub>2 v']\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        using `s' \\<noteq> sig' \\<and> s' \\<noteq> sig` \n        by (induction v)(auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      finally have \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>[ sig', dly' :=\\<^sub>2 v']) s' t' = snd (snd tw[ sig', dly' :=\\<^sub>2 v']\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by auto }\n    moreover\n    { assume \"s' = sig\" hence \"s' \\<noteq> sig'\" using assms by auto\n      hence \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>[ sig', dly' :=\\<^sub>2 v']) s' t' = snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by (simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      also have \"... = snd (snd tw[ sig', dly' :=\\<^sub>2 v']\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        using `s' = sig` `s' \\<noteq> sig'`\n      proof (induction v)\n        case (Bv x)\n        then show ?case \n          unfolding worldline_upd2_def worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps snd_conv fst_conv\n          worldline_upd_def worldline_inert_upd_def by auto\n      next\n        case (Lv x1a x2)\n        have \" (snd (snd tw[ sig', dly' :=\\<^sub>2 v']\\<lbrakk> sig, dly :=\\<^sub>2 Lv x1a x2\\<rbrakk>) s' t') = \n              (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw[ sig', dly' :=\\<^sub>2 v']) sig b[sig, get_time tw, dly := Bv (x2 ! b)];\n                    time =\n                      if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                      then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n) else get_time tw + dly\n                in if t' < get_time tw then snd (snd tw[ sig', dly' :=\\<^sub>2 v']) sig t'\n                   else if t' < time then snd (snd tw[ sig', dly' :=\\<^sub>2 v']) sig (get_time tw)\n                        else Lv x1a (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw[ sig', dly' :=\\<^sub>2 v']) sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig t')) [0..<length x2]))\"\n          unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps \\<open>s' = sig\\<close> snd_conv\n            fun_upd_def fst_worldline_upd2 by auto\n        also have \"... = \n              (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)];\n                    time =\n                      if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                      then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n) else get_time tw + dly\n                in if t' < get_time tw then snd (snd tw) sig t'\n                   else if t' < time then snd (snd tw) sig (get_time tw)\n                        else Lv x1a (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig t')) [0..<length x2]))\"\n        proof -\n          let ?w1 = \"\\<lambda>b. snd to_worldline_init_bit (snd tw[ sig', dly' :=\\<^sub>2 v']) sig b[sig, get_time tw, dly := Bv (x2 ! b)]\"\n          let ?w2 = \"\\<lambda>b. snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)]\"\n          have *: \"\\<And>k b. ?w1 b sig k = ?w2 b sig k\"\n            using assms unfolding to_worldline_init_bit_def snd_conv fst_conv worldline_inert_upd_def\n            worldline_upd2_def fun_upd_def worldline_upd_def by auto\n          have **: \"snd (snd tw[ sig', dly' :=\\<^sub>2 v']) sig t' = snd (snd tw) sig t'\"\n            unfolding worldline_upd2_def worldline_upd_def using assms by auto\n          have ***: \" snd (snd tw[ sig', dly' :=\\<^sub>2 v']) sig (get_time tw) =  snd (snd tw) sig (get_time tw)\"\n            unfolding worldline_upd2_def worldline_upd_def using assms by auto\n          show ?thesis\n            unfolding Let_def * ** *** by auto\n        qed\n        finally have h: \"(snd (snd tw[ sig', dly' :=\\<^sub>2 v']\\<lbrakk> sig, dly :=\\<^sub>2 Lv x1a x2\\<rbrakk>) s' t') = \n              (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)];\n                    time =\n                      if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                      then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n) else get_time tw + dly\n                in if t' < get_time tw then snd (snd tw) sig t'\n                   else if t' < time then snd (snd tw) sig (get_time tw)\n                        else Lv x1a (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig t')) [0..<length x2]))\"\n          by auto\n        have h': \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 Lv x1a x2\\<rbrakk>) s' t' = \n  (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)];\n                    time =\n                      if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n)\n                      then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig (n - 1) \\<noteq> w' b sig n) else get_time tw + dly\n                in if t' < get_time tw then snd (snd tw) sig t'\n                   else if t' < time then snd (snd tw) sig (get_time tw)\n                        else Lv x1a (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig b[sig, get_time tw, dly := Bv (x2 ! b)] sig t')) [0..<length x2]))\"\n          unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps \\<open>s' = sig\\<close> snd_conv\n            fun_upd_def fst_worldline_upd2 by auto\n        show ?case \n          unfolding h h' by auto\n      qed\n      finally have \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>[ sig', dly' :=\\<^sub>2 v']) s' t' = snd (snd tw[ sig', dly' :=\\<^sub>2 v']\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by auto }\n    moreover\n    { assume \"s' = sig'\" hence \"s' \\<noteq> sig\" using assms by auto\n      hence \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>[ sig', dly' :=\\<^sub>2 v']) s' t' = snd (snd tw[ sig', dly' :=\\<^sub>2 v']) s' t'\"\n        by (induction v)(auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      also have \"... = snd (snd tw[ sig', dly' :=\\<^sub>2 v']\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        using `s' \\<noteq> sig` `s' = sig'`\n        by (induction v)(auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      finally have \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>[ sig', dly' :=\\<^sub>2 v']) s' t' = snd (snd tw[ sig', dly' :=\\<^sub>2 v']\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by auto }\n    ultimately show \"snd (snd tw\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>[ sig', dly' :=\\<^sub>2 v']) s' t' = snd (snd tw[ sig', dly' :=\\<^sub>2 v']\\<lbrakk> sig, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n      by auto\n  qed\n  done\n\nlemma switch_worldline_inert_non_inert3:\n  assumes \"sig1 \\<noteq> sig2\" and \"sig2 \\<noteq> sig3\" and \"sig1 \\<noteq> sig3\"\n  shows \"(tw\\<lbrakk>sig1, dly :=\\<^sub>2 v\\<rbrakk>)[sig2, dly2 :=\\<^sub>2 v2][sig3, dly3 :=\\<^sub>2 v3] = \n         (tw[sig2, dly2 :=\\<^sub>2 v2][sig3, dly3 :=\\<^sub>2 v3])\\<lbrakk>sig1, dly :=\\<^sub>2 v\\<rbrakk>\"\n  apply (rule)\n   apply (simp add: fst_worldline_inert_upd2)\n  apply (rule)\n  subgoal\n  proof (induction v)\n    case (Bv x)\n    then show ?case \n      by (auto simp add: worldline_inert_upd2_def  worldline_inert_upd_def worldline_upd2_def worldline_upd_def)\n  next\n    case (Lv x1a x2)\n    then show ?case \n      by (auto simp add: worldline_inert_upd2_def  worldline_inert_upd_def worldline_upd2_def worldline_upd_def)\n  qed\n  subgoal\n  proof (rule ext)+\n    fix s' t'\n    have \"s' \\<noteq> sig1 \\<and> s' \\<noteq> sig2 \\<and> s' \\<noteq> sig3 \\<or> s' = sig1 \\<or> s' = sig2 \\<or> s' = sig3\"\n      by auto\n    moreover\n    { assume \"s' \\<noteq> sig1 \\<and> s' \\<noteq> sig2 \\<and> s' \\<noteq> sig3\"\n      hence \"snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) s' t' = snd (snd tw) s' t'\"\n        by (induction v)(auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      also have \"... = snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        using `s' \\<noteq> sig1 \\<and> s' \\<noteq> sig2 \\<and> s' \\<noteq> sig3`\n        by (induction v)(auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      finally have \"snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) s' t' = \n                    snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by auto }\n    moreover\n    { assume \"s' = sig1\" hence \"s' \\<noteq> sig2\" and \"s' \\<noteq> sig3\" using assms by auto\n      hence \"snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) s' t' = snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by (auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      also have \"... = snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        using `s' = sig1` `s' \\<noteq> sig2`  `s' \\<noteq> sig3`\n      proof (induction v)\n        case (Bv x)\n        then show ?case \n          unfolding worldline_upd2_def worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps snd_conv fst_conv\n          worldline_upd_def worldline_inert_upd_def by auto\n      next\n        case (Lv x1a x2)\n        have \"snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 Lv x1a x2\\<rbrakk>) s' t' = \n              (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) sig1\n                                b[sig1, get_time tw, dly := Bv (x2 ! b)];\n                  time =\n                    if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig1 (n - 1) \\<noteq> w' b sig1 n)\n                    then LEAST n.\n                            get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig1 (n - 1) \\<noteq> w' b sig1 n)\n                    else get_time tw + dly\n              in if t' < get_time tw then snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) sig1 t'\n                 else if t' < time then snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) sig1 (get_time tw)\n                      else Lv x1a\n                            (map (\\<lambda>b. bval_of\n                                       (snd to_worldline_init_bit (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) sig1\n                                             b[sig1, get_time tw, dly := Bv (x2 ! b)]\n                                         sig1 t'))\n                              [0..<length x2]))\"\n          unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps \\<open>s' = sig1\\<close> snd_conv\n            fun_upd_def fst_worldline_upd2 by auto\n        also have \"... = \n              (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig1 b[sig1, get_time tw, dly := Bv (x2 ! b)];\n                    time =\n                      if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig1 (n - 1) \\<noteq> w' b sig1 n)\n                      then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig1 (n - 1) \\<noteq> w' b sig1 n) else get_time tw + dly\n                in if t' < get_time tw then snd (snd tw) sig1 t'\n                   else if t' < time then snd (snd tw) sig1 (get_time tw)\n                        else Lv x1a (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig1 b[sig1, get_time tw, dly := Bv (x2 ! b)] sig1 t')) [0..<length x2]))\"\n        proof -\n          let ?w1 = \"\\<lambda>b.  snd to_worldline_init_bit (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) sig1\n                       b[sig1, get_time tw, dly := Bv (x2 ! b)]\"\n          let ?w2 = \"\\<lambda>b. snd to_worldline_init_bit (snd tw) sig1 b[sig1, get_time tw, dly := Bv (x2 ! b)]\"\n          have *: \"\\<And>k b. ?w1 b sig1 k = ?w2 b sig1 k\"\n            using assms unfolding to_worldline_init_bit_def snd_conv fst_conv worldline_inert_upd_def\n            worldline_upd2_def fun_upd_def worldline_upd_def by auto\n          have **: \"snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) sig1 t' = snd (snd tw) sig1 t'\"\n            unfolding worldline_upd2_def worldline_upd_def using assms by auto\n          have *** : \"snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) sig1 (get_time tw) = snd (snd tw) sig1 (get_time tw)\"\n            unfolding worldline_upd2_def worldline_upd_def using assms by auto\n          show ?thesis\n            unfolding Let_def * ** *** by auto\n        qed         \n        finally have h: \"snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 Lv x1a x2\\<rbrakk>) s' t' = \n(let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig1 b[sig1, get_time tw, dly := Bv (x2 ! b)];\n                    time =\n                      if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig1 (n - 1) \\<noteq> w' b sig1 n)\n                      then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig1 (n - 1) \\<noteq> w' b sig1 n) else get_time tw + dly\n                in if t' < get_time tw then snd (snd tw) sig1 t'\n                   else if t' < time then snd (snd tw) sig1 (get_time tw)\n                        else Lv x1a (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig1 b[sig1, get_time tw, dly := Bv (x2 ! b)] sig1 t')) [0..<length x2]))\"\n          by auto\n        have h': \"snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 Lv x1a x2\\<rbrakk>) s' t' = \n  (let w' = \\<lambda>b. snd to_worldline_init_bit (snd tw) sig1 b[sig1, get_time tw, dly := Bv (x2 ! b)];\n                    time =\n                      if \\<exists>n>get_time tw. n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig1 (n - 1) \\<noteq> w' b sig1 n)\n                      then LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + dly \\<and> (\\<exists>b\\<in>set [0..<length x2]. w' b sig1 (n - 1) \\<noteq> w' b sig1 n) else get_time tw + dly\n                in if t' < get_time tw then snd (snd tw) sig1 t'\n                   else if t' < time then snd (snd tw) sig1 (get_time tw)\n                        else Lv x1a (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) sig1 b[sig1, get_time tw, dly := Bv (x2 ! b)] sig1 t')) [0..<length x2]))\"\n          unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps \\<open>s' = sig1\\<close> snd_conv\n            fun_upd_def fst_worldline_upd2 by auto\n        show ?case\n          unfolding h h' by auto\n      qed\n      finally have \"snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) s' t' = \n                    snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by auto }\n    moreover\n    { assume \"s' = sig2\" hence \"s' \\<noteq> sig1\" and \"s' \\<noteq> sig3\" using assms by auto\n      hence \"snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) s' t' = snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2]) s' t'\"\n        by (induction v)(auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      also have \"... = snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        using `s' = sig2` `s' \\<noteq> sig1`  `s' \\<noteq> sig3`\n        by (induction v)(auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      finally have \"snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) s' t' = \n                    snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by auto }\n    moreover\n    { assume \"s' = sig3\" hence \"s' \\<noteq> sig1\" and \"s' \\<noteq> sig2\" using assms by auto\n      hence \"snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) s' t' = snd (snd tw[ sig3, dly3 :=\\<^sub>2 v3]) s' t'\"\n        by (induction v)(auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      also have \"... = snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        using `s' = sig3` `s' \\<noteq> sig1`  `s' \\<noteq> sig2`\n        by (induction v)(auto simp add: worldline_upd2_def worldline_upd_def worldline_inert_upd2_def worldline_inert_upd_def)\n      finally have \"snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) s' t' = \n                    snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n        by auto }\n    ultimately show \"snd (snd tw\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]) s' t' = \n                    snd (snd tw[ sig2, dly2 :=\\<^sub>2 v2][ sig3, dly3 :=\\<^sub>2 v3]\\<lbrakk> sig1, dly :=\\<^sub>2 v\\<rbrakk>) s' t'\"\n      by auto \n  qed\n  done\n\ndefinition beval_world_raw2 :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal bexp \\<Rightarrow> val \\<Rightarrow> bool\" where\n  \"beval_world_raw2 \\<equiv> \\<lambda>tw exp. beval_world_raw (snd tw) (fst tw) exp\"\n\nlemma beval_world_raw2_deterministic:\n  assumes \"beval_world_raw2 tw exp x1\"\n  assumes \"beval_world_raw2 tw exp x2\"\n  shows   \"x2 = x1\"\n  using assms unfolding beval_world_raw2_def\n  by (simp add: beval_world_raw_deterministic)\n  \nlemma beval_world_raw2_Bsig:\n  \"beval_world_raw2 tw (Bsig s) (wline_of tw s (fst tw))\"\n  unfolding beval_world_raw2_def\n  by (auto intro!: beval_world_raw.intros beval_raw.intros simp add: state_of_world_def)\n\ntype_synonym 'signal assn2 = \"nat \\<times> 'signal worldline_init \\<Rightarrow> bool\"\n\ninductive\n  seq_hoare2 :: \"'signal assn2 \\<Rightarrow> 'signal seq_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\" (\"\\<turnstile> ([(1_)]/ (_)/ [(1_)])\" 50)\n  where\nNull2: \"\\<turnstile> [P] Bnull [P]\"\n\n| Assign2: \"\\<turnstile> [\\<lambda>tw. (\\<forall>x. beval_world_raw2 tw exp x \\<longrightarrow> P(  tw[sig, dly :=\\<^sub>2 x] )) ] Bassign_trans sig exp dly [P]\"\n\n| AssignI2: \"\\<turnstile> [\\<lambda>tw. (\\<forall>x. beval_world_raw2 tw exp x \\<longrightarrow> P( tw\\<lbrakk>sig, dly :=\\<^sub>2 x\\<rbrakk>))] Bassign_inert sig exp dly [P]\"\n\n| Comp2: \"\\<lbrakk> \\<turnstile> [P] s1 [Q]; \\<turnstile> [Q] s2 [R]\\<rbrakk> \\<Longrightarrow> \\<turnstile> [P] Bcomp s1 s2 [R]\"\n\n| If2: \"\\<lbrakk>\\<turnstile> [\\<lambda>tw. P tw \\<and> beval_world_raw2 tw g (Bv True)] s1 [Q];\n         \\<turnstile> [\\<lambda>tw. P tw \\<and> beval_world_raw2 tw g (Bv False)] s2 [Q]\\<rbrakk>\n        \\<Longrightarrow>  \\<turnstile> [P] Bguarded g s1 s2 [Q]\"\n\n| Conseq2: \"\\<lbrakk>\\<forall>tw. P' tw \\<longrightarrow> P tw; \\<turnstile> [P] s [Q]; \\<forall>tw. Q tw \\<longrightarrow> Q' tw\\<rbrakk> \\<Longrightarrow> \\<turnstile> [P'] s [Q']\"\n\n| Conj: \"\\<turnstile> [P] s [Q1] \\<Longrightarrow> \\<turnstile> [P] s [Q2] \\<Longrightarrow> \\<turnstile> [P] s [\\<lambda>tw. Q1 tw \\<and> Q2 tw]\"\n\n| Bcase_empty_choices2: \"\\<turnstile> [P] Bcase exp [] [P]\"\n\n| Bcase_others2: \"\\<turnstile> [P] ss [Q] \\<Longrightarrow> \\<turnstile> [P] Bcase exp ((Others, ss) # choices) [Q]\"\n\n| Bcase_if2: \"\\<turnstile> [\\<lambda>tw. P tw \\<and> (\\<exists>x. beval_world_raw2 tw exp x \\<and> beval_world_raw2 tw exp' x)] ss [Q]\n  \\<Longrightarrow> \\<turnstile> [\\<lambda>tw. P tw \\<and> (\\<exists>x x'. beval_world_raw2 tw exp x \\<and> beval_world_raw2 tw exp' x' \\<and> x \\<noteq> x')] Bcase exp choices [Q]\n  \\<Longrightarrow> \\<turnstile> [P] Bcase exp ( (Explicit exp', ss) # choices) [Q]\"\n\ntext \\<open>Derived rules\\<close>\n\nlemma strengthen_precondition:\n  \"\\<turnstile> [P] ss [Q] \\<Longrightarrow> \\<turnstile> [\\<lambda>tw. P tw \\<and> P' tw] ss [Q]\"\n  by (rule Conseq2[where Q=\"Q\" and P=\"P\"]) auto\n\nlemma strengthen_precondition2:\n  \"\\<turnstile> [P'] ss [Q] \\<Longrightarrow> \\<turnstile> [\\<lambda>tw. P tw \\<and> P' tw] ss [Q]\"\n  by (rule Conseq2[where Q=\"Q\" and P=\"P'\"]) auto\n\nlemma weaken_postcondition:\n  \"\\<turnstile> [P] ss [\\<lambda>tw. Q1 tw \\<and> Q2 tw] \\<Longrightarrow> \\<turnstile> [P] ss [Q1]\"\n  by (rule Conseq2) auto\n\nlemma Conj_univ_qtfd:\n  \"\\<turnstile> [P] ss [\\<lambda>tw. \\<forall>i\\<in>S tw. Q (i, snd tw)] \\<Longrightarrow> \\<turnstile> [P] ss [\\<lambda>tw. \\<forall>i\\<in>S tw. R (i, snd tw)] \\<Longrightarrow> \\<turnstile> [P] ss [\\<lambda>tw. \\<forall>i\\<in>S tw. Q (i, snd tw) \\<and> R (i, snd tw)]\"\n  apply (rule Conseq2[where P=\"P\" and Q=\"\\<lambda>tw. (\\<forall>i\\<in>S tw. Q (i, snd tw)) \\<and> (\\<forall>i\\<in>S tw. R (i, snd tw))\"])\n    apply (simp)\n   apply (rule Conj)\n    apply assumption+\n  by simp\n\nlemma compositional_conj:\n  assumes \"\\<turnstile> [P1] ss [Q1]\" and \"\\<turnstile> [P2] ss [Q2]\"\n  shows \"\\<turnstile> [\\<lambda>tw. P1 tw \\<and> P2 tw] ss [\\<lambda>tw. Q1 tw \\<and> Q2 tw]\"\n  apply(rule Conj)\n   apply(rule Conseq2[where P=\"P1\" and Q=\"Q1\"])\n     apply simp\n    apply(rule assms(1))\n   apply simp\n  apply(rule Conseq2[where P=\"P2\" and Q=\"Q2\"])\n    apply simp\n   apply (rule assms(2))\n  apply simp\n  done\n\ninductive_cases seq_hoare2_ic: \"\\<turnstile> [P] s [Q]\"\n\nlemma Assign2_altI:\n  \"\\<forall>tw x. P tw \\<and> beval_world_raw2 tw exp x \\<longrightarrow> Q(tw[sig, dly :=\\<^sub>2 x]) \\<Longrightarrow> \\<turnstile> [P] Bassign_trans sig exp dly [Q]\"\n  apply (rule Conseq2[where Q=\"Q\", rotated 1])\n    apply (rule Assign2)\n   apply simp\n  apply simp\n  done\n\nlemma AssignI2_altI:\n  \"\\<forall>tw x. P tw \\<and> beval_world_raw2 tw exp x \\<longrightarrow> Q(tw\\<lbrakk>sig, dly :=\\<^sub>2 x\\<rbrakk>) \\<Longrightarrow> \\<turnstile> [P] Bassign_inert sig exp dly [Q]\"\n  apply (rule Conseq2[where Q=\"Q\", rotated 1])\n    apply (rule AssignI2)\n   apply simp\n  apply simp\n  done\n\nlemma BnullE_hoare2:\n  assumes \"\\<turnstile> [P] s [Q]\"\n  assumes \"s = Bnull\"\n  shows \"\\<forall>tw. P tw \\<longrightarrow> Q tw\"\n  using assms\n  by (induction rule:seq_hoare2.induct, auto)\n\nlemma BnullE'_hoare2:\n  \"\\<turnstile> [P] Bnull [Q] \\<Longrightarrow> \\<forall>tw. P tw \\<longrightarrow> Q tw\"\n  using BnullE_hoare2 by blast\n\nlemma BassignE_hoare2:\n  assumes \"\\<turnstile> [P] s [Q]\"\n  assumes \"s = Bassign_trans sig exp dly\"\n  shows \"\\<forall>tw x. P tw \\<and> beval_world_raw2 tw exp x \\<longrightarrow> Q(tw[sig, dly :=\\<^sub>2 x])\"\n  using assms\nproof (induction rule: seq_hoare2.induct)\n  case (Conseq2 P' P s Q Q')\n  then show ?case by blast\nnext\n  case (Conj P s Q1 Q2)\n  then show ?case\n    by (metis beval_world_raw2_def beval_world_raw_deterministic)\nqed (auto)\n\nlemma Bassign_inertE_hoare2:\n  assumes \"\\<turnstile> [P] s [Q]\"\n  assumes \"s = Bassign_inert sig exp dly\"\n  shows \"\\<forall>tw x. P tw \\<and> beval_world_raw2 tw exp x \\<longrightarrow> Q(tw \\<lbrakk> sig, dly :=\\<^sub>2 x\\<rbrakk>)\"\n  using assms\nproof (induction rule: seq_hoare2.induct)\n  case (Conseq2 P' P s Q Q')\n  then show ?case by blast\nnext\n  case (Conj P s Q1 Q2)\n  then show ?case\n    by (metis beval_world_raw2_def beval_world_raw_deterministic)\nqed auto\n\nlemma BcompE_hoare2:\n  assumes \"\\<turnstile> [P] s [R]\"\n  assumes \"s = Bcomp s1 s2\"\n  shows \"\\<exists>Q. \\<turnstile> [P] s1 [Q] \\<and> \\<turnstile> [Q] s2 [R]\"\n  using assms\nproof (induction rule:seq_hoare2.induct)\n  case (Conseq2 P' P s Q Q')\n  then show ?case\n    using seq_hoare2.Conseq2 by blast\nnext\n  case (Conj P s Q1 Q2)\n  then obtain Q1' Q2' where \" \\<turnstile> [P] s1 [Q1']\" and \"\\<turnstile> [Q1'] s2 [Q1]\" and \" \\<turnstile> [P] s1 [Q2']\" and \"\\<turnstile> [Q2'] s2 [Q2]\"\n    by auto\n  hence \"\\<turnstile> [P] s1 [\\<lambda>tw. Q1' tw \\<and> Q2' tw]\"\n    using seq_hoare2.Conj by auto\n  moreover have \"\\<turnstile> [\\<lambda>tw. Q1' tw \\<and> Q2' tw] s2 [\\<lambda>tw. Q1 tw \\<and> Q2 tw]\"\n    by (simp add: compositional_conj \\<open>\\<turnstile> [Q1'] s2 [Q1]\\<close> \\<open>\\<turnstile> [Q2'] s2 [Q2]\\<close>)\n  ultimately have \"\\<turnstile> [P] s1 [\\<lambda>tw. Q1' tw \\<and> Q2' tw] \\<and> \\<turnstile> [\\<lambda>tw. Q1' tw \\<and> Q2' tw] s2 [\\<lambda>tw. Q1 tw \\<and> Q2 tw]\"\n    by auto\n  then show ?case\n    by (auto)\nqed (auto simp add: Conseq2)\n\nlemmas [simp] = seq_hoare2.Null2 seq_hoare2.Assign2 seq_hoare2.Comp2 seq_hoare2.If2\n                seq_hoare2.Bcase_empty_choices2 seq_hoare2.Bcase_others2 seq_hoare2.Bcase_if2\nlemmas [intro!] = seq_hoare2.Null2 seq_hoare2.Assign2 seq_hoare2.Comp2 seq_hoare2.If2\n                seq_hoare2.Bcase_empty_choices2 seq_hoare2.Bcase_others2 seq_hoare2.Bcase_if2\n\nlemma strengthen_pre_hoare2:\n  assumes \"\\<forall>tw. P' tw \\<longrightarrow> P tw\" and \"\\<turnstile> [P] s [Q]\"\n  shows \"\\<turnstile> [P'] s [Q]\"\n  using assms by (blast intro: Conseq2)\n\nlemma weaken_post_hoare2:\n  assumes \"\\<forall>tw. Q tw \\<longrightarrow> Q' tw\" and \"\\<turnstile> [P] s [Q]\"\n  shows \"\\<turnstile> [P] s [Q']\"\n  using assms by (blast intro: Conseq2)\n\nlemma Assign'_hoare2:\n  assumes \"\\<forall>tw x. P tw \\<and> beval_world_raw2 tw exp x \\<longrightarrow> Q (worldline_upd2 tw sig dly x)\"\n  shows \"\\<turnstile> [P] Bassign_trans sig exp dly [Q]\"\n  using assms\n  by (simp add: Assign2_altI)\n\nsubsubsection \\<open>Validity of Hoare proof rules\\<close>\n\ndefinition worldline2 ::\n  \"nat \\<Rightarrow> 'signal state \\<Rightarrow> 'signal trans_raw \\<Rightarrow> 'signal state \\<Rightarrow> 'signal trans_raw \\<Rightarrow> nat \\<times> 'signal worldline_init\"\n  where \"worldline2 \\<equiv> \\<lambda>t \\<sigma> \\<theta> def \\<tau>. (t, worldline_raw t \\<sigma> \\<theta> def \\<tau>)\"\n\ndefinition destruct_worldline ::\n  \"nat \\<times> 'signal worldline_init \\<Rightarrow> (nat \\<times> 'signal state \\<times> 'signal event \\<times> 'signal trans_raw \\<times> 'signal state \\<times> 'signal trans_raw)\"\n  where\n  \"destruct_worldline tw = (let  t = fst tw; w = snd tw; def = fst w;\n                                 \\<sigma> = (\\<lambda>s. snd w s t);\n                                 \\<theta> = derivative_hist_raw w t;\n                                 \\<gamma> = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)};\n                                 \\<tau> = derivative_raw w t\n                             in (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>))\"\n\nlemma destruct_worldline_trans_zero_upto_now:\n  assumes \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n  shows \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\nproof -\n  have \"\\<tau> = derivative_raw (snd tw) (fst tw)\" and \"fst tw = t\"\n    using assms unfolding destruct_worldline_def Let_def by auto\n  hence \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = Map.empty\"\n    unfolding derivative_raw_def  `fst tw = t` by auto\n  thus \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n    unfolding zero_fun_def zero_option_def by auto\nqed\n\ntext \\<open>One might concern about the event @{term \"\\<gamma> :: 'signal event\"} obtained from the destruction\n@{term \"destruct_worldline tw\"} above. What happens if @{term \"t = 0\"}? This is a valid concern\nsince we have the expression @{term \"t - 1\"} in the definition of @{term \"\\<gamma>\"} above.\n\nNote that, we impose the requirement of @{term \"context_invariant\"} here. When this is the case,\nhistory @{term \"\\<theta> :: 'signal trans_raw\"} is empty when @{term \"t = 0\"}. Hence the expression\n@{term \"signal_of (def s) \\<theta> s (t - 1)\"} is equal to @{term \"signal_of (def s) 0 s 0\"} and,\nsubsequently, equals to @{term \"False\"}. Hence, when @{term \"t = 0\"}, the @{term \"\\<gamma>\"} enumerates the\nsignals which are different with the default value @{term \"Bv False :: val\"}.\\<close>\n\nlemma destruct_worldline_no_trans_at_t:\n  \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>) \\<Longrightarrow> \\<tau> t = 0\"\nproof -\n  assume \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n  hence \"\\<tau> = derivative_raw (snd tw) (fst tw)\" and \"fst tw = t\"\n    unfolding destruct_worldline_def Let_def by auto\n  thus ?thesis\n    by (auto simp add: derivative_raw_def zero_fun_def zero_option_def)\nqed\n\nlemma fst_destruct_worldline:\n  \"fst (destruct_worldline tw) = fst tw\"\n  unfolding destruct_worldline_def Let_def by auto\n\nlemma destruct_worldline_exist:\n  \"\\<exists>t \\<sigma> \\<gamma> \\<theta> def \\<tau>. destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n  unfolding destruct_worldline_def Let_def by auto\n\nlemma worldline2_constructible:\n  fixes tw :: \"nat \\<times> 'signal worldline_init\"\n  assumes \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n  shows \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau> \\<and> context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\nproof -\n  let ?w = \"snd tw\"\n  have **:\n      \"(fst tw,\n        \\<lambda>s. snd ?w s (fst tw),\n        {s. snd ?w s (fst tw) \\<noteq> signal_of (fst ?w s) (derivative_hist_raw (snd tw) (fst tw)) s (fst tw - 1)},\n        derivative_hist_raw (snd tw) (fst tw),\n        fst ?w,\n        derivative_raw (snd tw) (fst tw)) =\n        (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    using assms unfolding destruct_worldline_def Let_def by auto\n  hence \\<sigma>_def: \"\\<sigma> = (\\<lambda>s. snd ?w s t)\" and\n        \\<gamma>_def: \"\\<gamma> = {s. snd ?w s t \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) (fst tw)) s (fst tw - 1)}\" and\n        \\<theta>_def: \"\\<theta> = derivative_hist_raw ?w t\" and\n        def_def: \"def = fst ?w\" and\n        \"fst tw = t\"\n    by auto\n  have \\<tau>_def: \"\\<tau> = derivative_raw ?w t\"\n    using ** by auto\n  have \"?w = worldline_raw t \\<sigma> \\<theta> def \\<tau>\"\n  proof (rule, rule_tac[2] ext, rule_tac[2] ext)\n    fix s' t'\n    have \"snd ?w s' t = \\<sigma> s'\"\n      unfolding \\<sigma>_def by auto\n    have \"t' < t \\<or> t \\<le> t'\" by auto\n    moreover\n    { assume \"t' < t\"\n      hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t' =  signal_of (def s') \\<theta> s' t'\"\n        unfolding worldline_raw_def by auto\n      also have \"... = snd ?w s' t'\"\n        using signal_of_derivative_hist_raw[OF `t' < t`, where w=\"?w\"] unfolding \\<theta>_def\n        using def_def by blast\n      finally have \"snd ?w s' t' = snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t'\"\n        by auto }\n    moreover\n    { assume \"t \\<le> t'\"\n      hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t' = signal_of (\\<sigma> s') \\<tau> s' t'\"\n        unfolding worldline_raw_def by auto\n      also have \"... = snd ?w s' t'\"\n        unfolding \\<tau>_def using `snd ?w s' t = \\<sigma> s'` by (metis \\<open>t \\<le> t'\\<close> signal_of_derivative_raw)\n      finally have \"snd ?w s' t' = snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t'\"\n        by auto }\n    ultimately show \"snd ?w s' t' = snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t'\"\n      by auto\n  qed (simp add: def_def worldline_raw_def)\n  have \"\\<forall>n. t \\<le> n \\<longrightarrow> \\<theta> n = 0\"\n    unfolding \\<theta>_def by (auto simp add: derivative_hist_raw_def zero_fun_def zero_option_def)\n  moreover have \"\\<forall>n. n \\<le> t \\<longrightarrow> \\<tau> n = 0\"\n    unfolding \\<tau>_def by (auto simp add: derivative_raw_def zero_fun_def zero_option_def)\n  ultimately have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    unfolding \\<gamma>_def context_invariant_def \\<sigma>_def \\<theta>_def `fst tw = t` by auto\n  thus \"  tw = worldline2 t \\<sigma> \\<theta> def \\<tau> \\<and> context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using `?w = worldline_raw t \\<sigma> \\<theta> def \\<tau>` `fst tw = t` surjective_pairing[of \"tw\"]\n    by (metis worldline2_def)\nqed\n\nlemma worldline2_constructible':\n  fixes tw :: \"nat \\<times> 'signal worldline_init\"\n  shows \"\\<exists>t \\<sigma> \\<gamma> \\<theta> def \\<tau>. tw = worldline2 t \\<sigma> \\<theta> def \\<tau> \\<and> context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  using destruct_worldline_exist worldline2_constructible by blast\n\nlemma state_worldline2:\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau> n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta> n = 0\"\n  shows \"(\\<lambda>s. wline_of (worldline2 t \\<sigma> \\<theta> def \\<tau>) s t) = \\<sigma>\"\n  using assms\nproof (intro ext)\n  fix s\n  have \" \\<tau> t s = 0\"\n    using assms(1) by (auto simp add: zero_fun_def )\n  have \"\\<forall>k\\<in>dom (to_trans_raw_sig \\<tau> s). t < k\"\n  proof (rule ccontr)\n    assume \"\\<not> (\\<forall>k\\<in>dom (to_trans_raw_sig \\<tau> s). t < k)\"\n    then obtain k where k_dom: \"k \\<in> dom (to_trans_raw_sig \\<tau> s)\" and \"k \\<le> t\"\n      using leI by blast\n    have \" \\<tau> k s = 0\"\n      using `\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau> n = 0` ` \\<tau> t s = 0` `k \\<le> t`\n      by (metis zero_fun_def)\n    moreover have \" \\<tau> k s \\<noteq> 0\"\n      using k_dom unfolding domIff zero_option_def  unfolding to_trans_raw_sig_def\n      by auto\n    ultimately show \"False\"\n      by auto\n  qed\n  hence \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\<tau>) s t = None\"\n    by (auto simp add: inf_time_none_iff)\n  hence \"signal_of (\\<sigma> s) \\<tau> s t = \\<sigma> s\"\n    unfolding Femto_VHDL_raw.to_signal_def comp_def by auto\n  hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s t = \\<sigma> s\"\n    unfolding worldline_raw_def by auto\n  thus \"wline_of (worldline2 t \\<sigma> \\<theta> def \\<tau>) s t = \\<sigma> s\"\n    by (simp add: worldline2_def)\nqed\n\nlemma hist_of_worldline:\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau> n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta> n = 0\"\n  shows \"\\<And>k. signal_of (def s) (derivative_hist_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t) s k = signal_of (def s) \\<theta> s k\"\n  using assms\nproof -\n  fix k\n  have *: \"signal_of (def s) (derivative_hist_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t) s k  =\n           signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s k\"\n    unfolding worldline2_def by auto\n  have \"\\<theta> t = 0\"\n    using assms by auto\n  have \"k < t \\<or> t \\<le> k\"\n    by auto\n  moreover\n  { assume \"k < t\"\n    have \"signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s k = snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s k\"\n      using signal_of_derivative_hist_raw[OF `k < t`]  by (smt fst_conv worldline_raw_def)\n    also have \"... = signal_of (def s) \\<theta> s k\"\n      using `k < t` unfolding worldline_raw_def by auto\n    finally have \"signal_of (def s) (derivative_hist_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t) s k  = signal_of (def s) \\<theta> s k \"\n      using * by auto }\n  moreover\n  { assume \"t \\<le> k\"\n    hence \"t < k \\<or> t = k\" by auto\n    moreover\n    { assume \"t < k\"\n      moreover have \"\\<And>n. t < n \\<Longrightarrow> n \\<le> k \\<Longrightarrow> (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) n s = None\"\n        by (auto simp add: derivative_hist_raw_def)\n      ultimately have \"signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s k =\n                       signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s t\"\n        by (intro signal_of_less_ind')( auto simp add: zero_option_def) }\n    moreover\n    { assume \"t = k\"\n      hence \"signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s k =\n             signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s t\"\n        by auto }\n    ultimately have **: \"signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s k =\n                         signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s t\" by auto\n    have \"(derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) t = Map.empty\"\n      by (auto simp add: derivative_hist_raw_def)\n    hence ***: \"signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s t =\n                signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s (t - 1)\"\n      using signal_of_less_sig zero_option_def  by metis\n    have \"0 < t \\<or> t = 0\"\n      by auto\n    moreover\n    { assume \"0 < t\"\n      hence \"t - 1 < t\"\n        by linarith\n      hence \"signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s (t - 1) = snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s (t - 1)\"\n        using signal_of_derivative_hist_raw[of \"t-1\" \"t\"]  by (smt fst_conv worldline_raw_def)\n      also have \"... = signal_of (def s) \\<theta> s (t- 1)\"\n        using `t- 1 < t`unfolding worldline_raw_def by auto\n      also have \"... = signal_of (def s) \\<theta> s t\"\n        using signal_of_less[where \\<tau>=\"\\<theta>\", OF `\\<theta> t = 0`] by auto\n      also have \"... = signal_of (def s) \\<theta> s k\"\n        by (metis \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>t < k \\<or> t = k\\<close> order.strict_implies_order signal_of_less_ind)\n      finally have \"signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s (t - 1) = signal_of (def s) \\<theta> s k\"\n        by auto\n      hence \"signal_of (def s) (derivative_hist_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t) s k  = signal_of (def s) \\<theta> s k\"\n        using * ** *** by simp }\n    moreover\n    { assume \"t = 0\"\n      have  \"(derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) t = Map.empty\"\n        unfolding `t = 0` by (auto simp add: derivative_hist_raw_def)\n      hence \"signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s t =  def s\"\n        using signal_of_zero unfolding `t = 0` by (metis zero_option_def)\n      also have \"... = signal_of (def s) \\<theta> s 0\"\n        using `\\<theta> t = 0` unfolding `t = 0` using signal_of_zero by (metis zero_fun_def)\n      also have \"... = signal_of (def s) \\<theta> s k\"\n        by (metis \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>t < k \\<or> t = k\\<close> \\<open>t = 0\\<close> le0 signal_of_less_ind)\n      finally have \"signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s t = signal_of (def s) \\<theta> s k\"\n        by auto\n      hence \"signal_of (def s) (derivative_hist_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t) s k   = signal_of (def s) \\<theta> s k\"\n        using * ** by auto }\n    ultimately have \"signal_of (def s) (derivative_hist_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t) s k   = signal_of (def s) \\<theta> s k\"\n      by auto }\n  ultimately show \"signal_of (def s) (derivative_hist_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t) s k   = signal_of (def s) \\<theta> s k\"\n    by auto\nqed\n\nlemma event_worldline2':\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  shows \"{s. wline_of (worldline2 t \\<sigma> \\<theta> def \\<tau>) s t \\<noteq> signal_of (def s) (derivative_hist_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t) s (t - 1)} = \\<gamma>\"\nproof -\n  have \"\\<forall>n\\<le>t. \\<tau> n = 0\" and \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta> n = 0\"\n    using assms unfolding context_invariant_def by auto\n  hence *: \"(\\<lambda>s. wline_of (worldline2 t \\<sigma> \\<theta> def \\<tau>) s t) = \\<sigma>\"\n    by (intro state_worldline2)\n  have **: \"\\<gamma> = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)}\"\n    using `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>` unfolding context_invariant_def by auto\n  have \"{s. snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s t \\<noteq> signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s (t - 1)} =\n        {s. \\<sigma> s \\<noteq> signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s (t - 1)}\"\n    by (metis (no_types, lifting) \\<open>\\<forall>n\\<le>t. \\<tau> n = 0\\<close> state_of_world state_of_world_def)\n  moreover have \"\\<And>s. signal_of (def s) \\<theta> s (t - 1) =\n                      signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s (t - 1)\"\n    using hist_of_worldline\n    by (smt One_nat_def Suc_le_lessD \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> derivative_hist_raw_def diff_is_0_eq' diff_less\n    fst_conv le_eq_less_or_eq signal_of_derivative_hist_raw signal_of_zero snd_conv\n    worldline_raw_def zero_fun_def zero_option_def zero_order(5))\n  ultimately have \"{s. snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s t \\<noteq> signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s (t - 1)} =\n                   {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)}\"\n    by auto\n  thus ?thesis\n    using **  by (simp add: worldline2_def)\nqed\n\nlemma transaction_worldline2:\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau> n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta> n = 0\"\n  shows \"\\<And>k s . signal_of (\\<sigma> s) (derivative_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t) s k = signal_of (\\<sigma> s) \\<tau> s k\"\nproof -\n  fix k s\n  have \"\\<tau> t s = 0\"\n    using assms  by (simp add: zero_fun_def)\n  hence \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n s = 0\"\n    using assms by (auto)\n  hence \"signal_of (\\<sigma> s) \\<tau> s t = signal_of (\\<sigma> s) \\<tau> s 0\"\n    by (meson le0 signal_of_less_ind')\n  also have \"... = \\<sigma> s\"\n    using `\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n s = 0` by (metis le0 signal_of_zero)\n  finally have \"signal_of (\\<sigma> s) \\<tau> s t = \\<sigma> s\"\n    by auto\n  hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s t = \\<sigma> s\"\n    by (simp add: worldline_raw_def)\n  have \"k < t \\<or> t \\<le> k\"\n    by auto\n  moreover\n  { assume \"k < t\"\n    have \"signal_of (\\<sigma> s) (derivative_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s k = \\<sigma> s\"\n      using signal_of2_derivative_before_now \\<open>k < t\\<close>  by metis\n    moreover have \"signal_of (\\<sigma> s) \\<tau> s k = \\<sigma> s\"\n    proof -\n      have \"\\<forall>n\\<in>dom (to_trans_raw_sig \\<tau> s). k < n\"\n      proof (rule ccontr)\n        assume \"\\<not> (\\<forall>n\\<in>dom ( (to_trans_raw_sig \\<tau> s)). k < n)\"\n        then obtain n where \"n \\<in> dom ( (to_trans_raw_sig \\<tau> s))\" and \"n \\<le> k\"\n          using leI by blast\n        hence \" \\<tau> n = 0\"\n          using assms \\<open>k < t\\<close> by auto\n        hence \"n \\<notin> dom ( (to_trans_raw_sig \\<tau> s))\"\n          unfolding to_trans_raw_sig_def  by (simp add: domIff zero_fun_def zero_option_def)\n        with `n \\<in> dom ( (to_trans_raw_sig \\<tau> s))` show False by auto\n      qed\n      hence \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\<tau>) s k = None\"\n        by (auto simp add: inf_time_none_iff)\n      thus ?thesis\n        unfolding Femto_VHDL_raw.to_signal_def comp_def by auto\n    qed\n    ultimately have \"signal_of (\\<sigma> s) (derivative_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s k =\n                     signal_of (\\<sigma> s) \\<tau> s k\"\n      by auto }\n  moreover\n  { assume \"t \\<le> k\"\n    hence \"signal_of (\\<sigma> s) (derivative_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>)  t) s k = snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s k\"\n      using signal_of_derivative_raw `snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s t = \\<sigma> s` by metis\n    also have \"... = signal_of (\\<sigma> s) \\<tau> s k\"\n      unfolding worldline_raw_def using `t \\<le> k` by auto\n    finally have \"signal_of (\\<sigma> s) (derivative_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>)  t) s k =\n                  signal_of (\\<sigma> s) \\<tau> s k\"\n      by auto }\n  ultimately have \"signal_of (\\<sigma> s) (derivative_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>) t) s k =\n                   signal_of (\\<sigma> s) \\<tau> s k\" by auto\n  thus \"signal_of (\\<sigma> s) (derivative_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t) s k = signal_of (\\<sigma> s) \\<tau> s k\"\n    by (simp add: worldline2_def)\nqed\n\nhide_const Poly_Mapping.keys\nhide_fact Poly_Mapping.keys_def\n\ntext \\<open>The following definition is an attempt to define a condition such that the derivative @{term\n\"derivative_raw\"} and @{term \"derivative_hist_raw\"} are the inverses of the integral (@{term\n\"signal_of\"}). The predicate non-stuttering below indicates that, in each signal, there are no two\nsuccessive posting which has the same value. For example, if @{term \"t1\"} and @{term \"t2\"} are\nelements of @{term \"keys (to_trans_raw_sig \\<tau> sig)\"}, then the value of posted at @{term \"t1\"} and\n@{term \"t2\"} are different. That is, @{term \"the ((to_trans_raw_sig \\<tau> sig) t1) \\<noteq>\nthe ((to_trans_raw_sig \\<tau> sig) t2)\"}.\n\nWe must pay a special attention for the first key\n@{term \"k = hd (sorted_list_of_set (keys (\\<tau> s)))\"}. The first key must be\ndifferent from the default state @{term \"\\<sigma> s\"}.\\<close>\n\nlemma derivative_raw_of_worldline2:\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau> n = 0\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n  shows \"derivative_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t = \\<tau>\"\n  using assms unfolding worldline2_def\n  by (simp add: derivative_raw_of_worldline_specific)\n\nlemma derivative_is_history2:\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta> n = 0\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n  shows \"derivative_hist_raw (snd (worldline2 t \\<sigma> \\<theta> def \\<tau>)) t = \\<theta>\"\n  using derivative_is_history unfolding worldline2_def\n  by (simp add: derivative_is_history assms(1) assms(2))\n\ntext \\<open>Several lemmas about preserving non_stuttering property.\\<close>\n\nlemma b_conc_exec_preserves_non_stuttering:\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\"\n  assumes \"non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n  assumes \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n  assumes \"nonneg_delay_conc cs\"\n  assumes \"conc_stmt_wf cs\"\n  shows \"non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n  using assms\nproof (induction cs arbitrary: \\<tau> \\<tau>')\n  case (Bpar cs1 cs2)\n  hence \"nonneg_delay_conc cs1\" and \"conc_stmt_wf cs1\" and \"nonneg_delay_conc cs2\" and \"conc_stmt_wf cs2\"\n    by auto\n  obtain \\<tau>1 where \\<tau>1_def: \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def cs1 \\<tau> \\<tau>1\"\n    using Bpar.prems(1) by blast\n  hence \"non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n    using Bpar(1)[OF _ Bpar(4-5)]  `nonneg_delay_conc cs1` `conc_stmt_wf cs1` by metis\n  obtain \\<tau>2 where \\<tau>2_def: \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def cs2 \\<tau> \\<tau>2\"\n    using Bpar.prems(1) by blast\n  hence \"non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n    using Bpar(2)[OF _ Bpar(4-5)] `nonneg_delay_conc cs2` `conc_stmt_wf cs2`\n    by auto\n  have \\<tau>'_def: \"\\<tau>' = clean_zip_raw \\<tau> (\\<tau>1, set (signals_from cs1)) (\\<tau>2, set (signals_from cs2))\"\n    using Bpar  \\<tau>1_def \\<tau>2_def  by (metis obtain_clean_zip)\n  have \"s \\<in> set (signals_from cs1) \\<or> s \\<in> set (signals_from cs2) \\<or> s \\<notin> set (signals_from cs1) \\<and> s \\<notin> set (signals_from cs2)\"\n    by auto\n  moreover\n  { assume \"s \\<in> set (signals_from cs1)\"\n    hence \"\\<And>n. \\<tau>' n s = \\<tau>1 n s\"\n      using \\<tau>'_def unfolding clean_zip_raw_def Let_def by auto\n    hence \" (to_trans_raw_sig \\<tau>' s) = (to_trans_raw_sig \\<tau>1 s)\"\n      by (auto simp add: to_trans_raw_sig_def)\n    hence ?case\n      using `non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s` unfolding non_stuttering_def Let_def\n      by auto }\n  moreover\n  { assume \"s \\<in> set (signals_from cs2)\"\n    hence \"s \\<notin> set (signals_from cs1)\"\n      using `conc_stmt_wf (cs1 || cs2)` unfolding conc_stmt_wf_def by auto\n    hence \"\\<And>n. \\<tau>' n s = \\<tau>2 n s\"\n      using \\<tau>'_def `s \\<in> set (signals_from cs2)` unfolding clean_zip_raw_def Let_def\n      by auto\n    hence \" (to_trans_raw_sig \\<tau>' s) = (to_trans_raw_sig \\<tau>2 s)\"\n      by transfer' (auto simp add: to_trans_raw_sig_def)\n    hence ?case\n      using `non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s` unfolding non_stuttering_def Let_def\n      by auto }\n  moreover\n  { assume \"s \\<notin> set (signals_from cs1) \\<and> s \\<notin> set (signals_from cs2)\"\n    hence \"\\<And>n. \\<tau>' n s = \\<tau> n s\"\n      unfolding \\<tau>'_def clean_zip_raw_def Let_def by auto\n    hence \" (to_trans_raw_sig \\<tau>' s) = (to_trans_raw_sig \\<tau> s)\"\n      by (auto simp add: to_trans_raw_sig_def)\n    hence ?case\n      using `non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s` unfolding non_stuttering_def Let_def\n      by auto }\n  ultimately show ?case by auto\nnext\n  case (Bsingle x1 x2)\n  then show ?case\n    using b_seq_exec_preserves_non_stuttering by force\nqed\n\nlemma init'_preserves_non_stuttering:\n  assumes \"init' t \\<sigma> \\<gamma> \\<theta> def cs \\<tau> \\<tau>'\"\n  assumes \"non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n  assumes \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n  assumes \"nonneg_delay_conc cs\"\n  assumes \"conc_stmt_wf cs\"\n  shows \"non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n  using assms\nproof (induction cs arbitrary: \\<tau> \\<tau>')\n  case (Bpar cs1 cs2)\n  hence \"nonneg_delay_conc cs1\" and \"conc_stmt_wf cs1\" and \"nonneg_delay_conc cs2\" and \"conc_stmt_wf cs2\"\n    by auto\n  obtain \\<tau>1 where \\<tau>1_def : \"init' t \\<sigma> \\<gamma> \\<theta> def cs1 \\<tau> \\<tau>1\"\n    using Bpar.prems(1) by blast\n  hence \"non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n    using Bpar(1)[OF _ Bpar(4-5)]  `nonneg_delay_conc cs1` `conc_stmt_wf cs1` by metis\n  obtain \\<tau>2 where \\<tau>2_def : \"init' t \\<sigma> \\<gamma> \\<theta> def cs2 \\<tau> \\<tau>2\"\n    using Bpar.prems(1) by blast\n  hence \"non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n    using Bpar(2)[OF _ Bpar(4-5)] `nonneg_delay_conc cs2` `conc_stmt_wf cs2`\n    by auto\n  have \\<tau>'_def: \"\\<tau>' = clean_zip_raw \\<tau> (\\<tau>1, set (signals_from cs1)) (\\<tau>2, set (signals_from cs2))\"\n    using Bpar  \\<tau>1_def \\<tau>2_def  by (meson init'.intros(2) init'_deterministic)\n  have \"s \\<in> set (signals_from cs1) \\<or> s \\<in> set (signals_from cs2) \\<or> s \\<notin> set (signals_from cs1) \\<and> s \\<notin> set (signals_from cs2)\"\n    by auto\n  moreover\n  { assume \"s \\<in> set (signals_from cs1)\"\n    hence \"\\<And>n. \\<tau>' n s = \\<tau>1 n s\"\n      using \\<tau>'_def unfolding clean_zip_raw_def Let_def by auto\n    hence \" (to_trans_raw_sig \\<tau>' s) = (to_trans_raw_sig \\<tau>1 s)\"\n      by (auto simp add: to_trans_raw_sig_def)\n    hence ?case\n      using `non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s` unfolding non_stuttering_def Let_def\n      by auto }\n  moreover\n  { assume \"s \\<in> set (signals_from cs2)\"\n    hence \"s \\<notin> set (signals_from cs1)\"\n      using `conc_stmt_wf (cs1 || cs2)` unfolding conc_stmt_wf_def by auto\n    hence \"\\<And>n. \\<tau>' n s = \\<tau>2 n s\"\n      using \\<tau>'_def `s \\<in> set (signals_from cs2)` unfolding clean_zip_raw_def Let_def\n      by auto\n    hence \" (to_trans_raw_sig \\<tau>' s) = (to_trans_raw_sig \\<tau>2 s)\"\n      by transfer' (auto simp add: to_trans_raw_sig_def)\n    hence ?case\n      using `non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s` unfolding non_stuttering_def Let_def\n      by auto }\n  moreover\n  { assume \"s \\<notin> set (signals_from cs1) \\<and> s \\<notin> set (signals_from cs2)\"\n    hence \"\\<And>n. \\<tau>' n s = \\<tau> n s\"\n      unfolding \\<tau>'_def clean_zip_raw_def Let_def by auto\n    hence \" (to_trans_raw_sig \\<tau>' s) = (to_trans_raw_sig \\<tau> s)\"\n      by (auto simp add: to_trans_raw_sig_def)\n    hence ?case\n      using `non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s` unfolding non_stuttering_def Let_def\n      by auto }\n  ultimately show ?case by auto\nnext\n  case (Bsingle x1 x2)\n  then show ?case\n    using b_seq_exec_preserves_non_stuttering by force\nqed\n\n\n\nlemma destruct_worldline_correctness:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  assumes \"destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>) = (t', \\<sigma>', \\<gamma>', \\<theta>', def' , \\<tau>')\"\n  shows \"t = t'\"\n    and \"\\<sigma> = \\<sigma>'\"\n    and \"\\<gamma> = \\<gamma>'\"\n    and \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>' s k\"\n    and \"\\<And>k s. signal_of (\\<sigma> s) \\<tau> s k = signal_of (\\<sigma> s) \\<tau>' s k\"\n    and \"def' = def\"\nproof -\n  show \"t = t'\"\n    by (metis assms(2) fst_conv fst_destruct_worldline worldline2_def)\nnext\n  have *: \"\\<forall>n\\<le>t. \\<tau> n = 0\" and **: \"\\<forall>n\\<ge>t. \\<theta> n = 0\"\n    using assms unfolding context_invariant_def by auto\n  thus \"\\<sigma> = \\<sigma>'\"\n    using state_worldline2[OF * **] assms(2) unfolding destruct_worldline_def Let_def by auto\nnext\n  show \"\\<gamma> = \\<gamma>'\"\n    using event_worldline2'[OF assms(1)] using assms(2) unfolding destruct_worldline_def\n    Let_def  by (simp add: worldline2_def worldline_raw_def)\nnext\n  have *: \"\\<forall>n\\<le>t. \\<tau> n = 0\" and **: \"\\<forall>n\\<ge>t. \\<theta> n = 0\"\n    using assms unfolding context_invariant_def by auto\n  show \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>' s k\"\n    using hist_of_worldline[OF * **] assms(2) unfolding destruct_worldline_def Let_def by auto\nnext\n  have *: \"\\<forall>n\\<le>t. \\<tau> n = 0\" and **: \"\\<forall>n\\<ge>t. \\<theta> n = 0\"\n    using assms unfolding context_invariant_def by auto\n  show \"\\<And>k s. signal_of (\\<sigma> s) \\<tau> s k = signal_of (\\<sigma> s) \\<tau>' s k\"\n    using transaction_worldline2[OF * **] assms(2) unfolding destruct_worldline_def Let_def by auto\nnext\n  show \" def' = def\"\n    by (smt assms(2) destruct_worldline_def fst_conv snd_conv worldline2_def worldline_raw_def)\nqed\n\nlemma destruct_worldline_correctness2:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n  assumes \" \\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n  assumes \"destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>) = (t', \\<sigma>', \\<gamma>', \\<theta>', def', \\<tau>')\"\n  shows \"t = t'\" and \"\\<sigma> = \\<sigma>'\" and \"\\<gamma> = \\<gamma>'\" and \"\\<tau> = \\<tau>'\" and \"\\<theta> = \\<theta>'\" and \"def = def'\"\nproof -\n  show \"t = t'\" and \"\\<sigma> = \\<sigma>'\" and \"\\<gamma> = \\<gamma>'\"\n    using destruct_worldline_correctness[OF assms(1) assms(4)] by auto\nnext\n  have *: \"\\<forall>n\\<le>t. \\<tau> n = 0\"\n    using assms unfolding context_invariant_def by auto\n  show \"\\<tau> = \\<tau>'\"\n    using derivative_raw_of_worldline2[OF * assms(2)] assms(4) unfolding destruct_worldline_def\n    Let_def by auto\nnext\n  have **: \"\\<forall>n\\<ge>t. \\<theta> n = 0\"\n    using assms unfolding context_invariant_def by auto\n  show \"\\<theta> = \\<theta>'\"\n    using derivative_is_history2[OF ** assms(3)] assms(4) unfolding destruct_worldline_def\n    Let_def by auto\nnext\n  show \"def = def'\"\n    using assms(1) assms(4) destruct_worldline_correctness(6) by blast\nqed\n\nlemma destruct_worldline_correctness3:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n  shows \"destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>) = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n  using destruct_worldline_correctness2[OF assms]\n  by (metis (no_types, lifting) destruct_worldline_def)\n\nlemma destruct_worldline_correctness4:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n  shows   \"\\<exists>\\<theta>'.  destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>) = (t, \\<sigma>, \\<gamma>, \\<theta>', def, \\<tau>)\n              \\<and> (\\<forall>k s. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>' s k)\"\nproof -\n  obtain \\<tau>' \\<theta>' where des: \"destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>) = (t, \\<sigma>, \\<gamma>, \\<theta>', def, \\<tau>')\"\n      and \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>' s k\"\n      and \"\\<And>k s. signal_of (\\<sigma> s) \\<tau> s k = signal_of (\\<sigma> s) \\<tau>' s k\"\n    using destruct_worldline_correctness[OF assms(1)] by (metis (no_types, lifting) destruct_worldline_def)\n  have *: \"\\<forall>n\\<le>t. \\<tau> n = 0\"\n    using assms unfolding context_invariant_def by auto\n  have \"\\<tau> = \\<tau>'\"\n    using derivative_raw_of_worldline2[OF * assms(2)] des unfolding destruct_worldline_def\n    Let_def by auto\n  thus ?thesis\n    using \\<open>\\<And>s k. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>' s k\\<close> des by blast\nqed\n\n\ninductive world_seq_exec :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal seq_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\"\n  (\"(_, _) \\<Rightarrow>\\<^sub>s _\") where\n  \"   destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\n  \\<Longrightarrow> b_seq_exec t \\<sigma> \\<gamma> \\<theta> def s \\<tau> \\<tau>'\n  \\<Longrightarrow> worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\n  \\<Longrightarrow> world_seq_exec tw s tw'\"\n\n(* Diagram for lifting the sequential execution to the worldline level\n *\n *         w, t                    \\<Rightarrow>\\<^sub>s          w', t\n *           \\<down>                                  \\<up>\n *   destruct_worldline                      worldline2 t \\<sigma> \\<theta> \\<tau>'\n *           \\<down>                                  \\<up>\n *         t, \\<sigma>, \\<gamma>, \\<theta> \\<turnstile> <s, \\<tau>>    \\<longrightarrow>\\<^sub>s          \\<tau>'\n *\n *)\n\ninductive_cases world_seq_exec_cases : \"tw, s \\<Rightarrow>\\<^sub>s tw'\"\n\nlemma world_seq_exec_deterministic:\n  assumes \"tw, s \\<Rightarrow>\\<^sub>s tw1\"\n  assumes \"tw, s \\<Rightarrow>\\<^sub>s tw2\"\n  shows   \"tw2 = tw1\"\n  using assms\n  apply (induction arbitrary:tw2 rule:world_seq_exec.induct)\n  using b_seq_exec_deterministic\n  by (smt fst_conv snd_conv world_seq_exec_cases)\n\nlemma time_invariant:\n  assumes \"tw, s \\<Rightarrow>\\<^sub>s tw'\" shows \"fst tw = fst tw'\"\n  using assms\n  by (smt fst_conv fst_destruct_worldline world_seq_exec_cases worldline2_def)\n\ndefinition\nseq_hoare_valid2 :: \"'signal assn2 \\<Rightarrow> 'signal seq_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\" (\"\\<Turnstile> [(1_)]/ (_)/ [(1_)]\" 50)\nwhere \"\\<Turnstile> [P] s [Q] \\<longleftrightarrow>  (\\<forall>tw tw'.  P tw \\<and> (tw, s \\<Rightarrow>\\<^sub>s tw') \\<longrightarrow> Q tw')\"\n\ntext \\<open>This is a cleaner definition of the validity compared to @{term \"seq_hoare_valid\"} in\n@{theory \"Draft.VHDL_Hoare\"}. This also has the same spirit as the definition of validity in\n@{theory_text \"Hoare\"}.\\<close>\n\nlemma beval_cong:\n  assumes \"beval_raw t \\<sigma> \\<gamma> \\<theta>1 def g x\"\n  assumes \"\\<And>k s. signal_of (def s) \\<theta>1 s k = signal_of (def s) \\<theta>2 s k\"\n  shows   \"beval_raw t \\<sigma> \\<gamma> \\<theta>2 def g x\"\n  using assms\n  by (induction rule: beval_raw.inducts) (metis beval_raw.intros)+\n\nlemma signal_of_purge_not_affected:\n  assumes \"s \\<noteq> sig\"\n  shows \"signal_of (\\<sigma> s) (purge_raw \\<tau>1 t dly sig def val) s k = signal_of (\\<sigma> s) \\<tau>1 s k\"\nproof -\n  have \"\\<And>n. to_trans_raw_sig (purge_raw \\<tau>1 t dly sig def val) s n = to_trans_raw_sig \\<tau>1 s n\"\n    using assms purge_raw_does_not_affect_other_sig[of \"\\<tau>1\" \"t\" \"dly\" \"sig\" \"def\" \"val\" \"purge_raw \\<tau>1 t dly sig def val\"]\n    unfolding to_trans_raw_sig_def  by auto\n  show ?thesis\n    by (meson \\<open>\\<And>n. to_trans_raw_sig (purge_raw \\<tau>1 t dly sig def val) s n = to_trans_raw_sig \\<tau>1 s n\\<close> signal_of_equal_when_trans_sig_equal_upto)\nqed\n\nlemma non_stut_unique:\n  assumes \"\\<And>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n  assumes \"\\<And>s. non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n  assumes \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>1 s k = signal_of (\\<sigma> s) \\<tau>2 s k\"\n  shows   \"\\<And>k s. k \\<le> time \\<Longrightarrow> \\<tau>1 k s = \\<tau>2 k s\"\n  using assms\nproof (induction time)\n  case 0\n  hence \"k = 0\"\n    by auto\n  obtain v where  \"\\<tau>1 0 s = None \\<or> \\<tau>1 0 s = Some v\"\n    by (meson not_Some_eq)\n  moreover\n  { assume \"\\<tau>1 0 s = None\"\n    hence \"signal_of (\\<sigma> s) \\<tau>2 s 0 = (\\<sigma> s)\"\n      using assms(3)  by (metis signal_of_zero zero_option_def)\n    obtain v' where \"\\<tau>2 0 s = None \\<or> \\<tau>2 0 s = Some v'\"\n      by (meson not_Some_eq)\n    moreover\n    { assume \"\\<tau>2 0 s = None\"\n      hence ?case\n        using \\<open>\\<tau>1 0 s = None\\<close> unfolding \\<open>k = 0\\<close> by auto }\n    moreover  \n    { assume \"\\<tau>2 0 s = Some v'\"\n      have \"v' \\<noteq> \\<sigma> s\"\n        using assms(2) unfolding non_stuttering_def \n        by (metis Least_eq_0 \\<open>\\<tau>2 0 s = Some v'\\<close> equals0D inf_time_some_exists option.sel some_inf_time' to_trans_raw_sig_def)\n      have \"signal_of (\\<sigma> s) \\<tau>2 s 0 = v'\"\n        by (metis (no_types, hide_lams) \\<open>\\<tau>2 0 s = Some v'\\<close> le_zero_eq option.distinct(1) option.sel signal_of_elim to_trans_raw_sig_def)\n      hence False\n        using \\<open>signal_of (\\<sigma> s) \\<tau>2 s 0 = (\\<sigma> s)\\<close> \\<open>v' \\<noteq> \\<sigma> s\\<close> by blast \n      hence ?case\n        by auto }\n    ultimately have ?case\n      by auto }\n  moreover\n  { assume \"\\<tau>1 0 s = Some v\"\n    hence \"signal_of (\\<sigma> s) \\<tau>1 s 0 = v\"\n      by (metis comp_apply domIff inf_time_someI option.discI option.sel option.simps(5) order_refl to_signal_def to_trans_raw_sig_def)\n    hence \"signal_of (\\<sigma> s) \\<tau>2 s 0 = v\"\n      using assms(3) by auto\n    obtain v' where \"\\<tau>2 0 s = None \\<or> \\<tau>2 0 s = Some v'\"\n      by (meson not_Some_eq)\n    moreover\n    { assume \"\\<tau>2 0 s = Some v'\"\n      hence \"v' = v\"\n        by (metis (mono_tags, hide_lams) \\<open>signal_of (\\<sigma> s) \\<tau>1 s 0 = v\\<close> assms(3) le_zero_eq option.discI option.inject signal_of_elim to_trans_raw_sig_def)\n      hence ?case\n        by (simp add: \\<open>\\<tau>1 0 s = Some v\\<close> \\<open>\\<tau>2 0 s = Some v'\\<close> \\<open>k = 0\\<close>) }\n    moreover\n    { assume \"\\<tau>2 0 s = None\"\n      hence \"\\<sigma> s = v\"\n        by (metis \\<open>signal_of (\\<sigma> s) \\<tau>2 s 0 = v\\<close> signal_of_zero zero_option_def)\n      moreover have \"\\<sigma> s \\<noteq> v\"\n        using \\<open>\\<tau>1 0 s = Some v\\<close> assms(1) unfolding non_stuttering_def \n        by (metis Least_eq_0 all_not_in_conv inf_time_some_exists option.sel some_inf_time' to_trans_raw_sig_def)\n      ultimately have False\n        by auto\n      hence ?case\n        by auto }\n    ultimately have ?case\n      by auto }\n  ultimately show ?case \n    by auto\nnext\n  case (Suc time)\n  hence \"\\<And>k s. k \\<le> time \\<Longrightarrow> \\<tau>1 k s = \\<tau>2 k s\"\n    by auto\n  have \"k \\<le> time \\<or> k = Suc time\"\n    using Suc by auto\n  moreover\n  { assume \"k \\<le> time\"\n    hence ?case\n      using \\<open>\\<And>k s. k \\<le> time \\<Longrightarrow> \\<tau>1 k s = \\<tau>2 k s\\<close> by auto }\n  moreover\n  { assume \"k = Suc time\"\n    obtain v where \"\\<tau>1 (Suc time) s = None \\<or> \\<tau>1 (Suc time) s = Some v\"\n      by (meson not_Some_eq)\n    moreover\n    { assume \"\\<tau>1 (Suc time) s = None\"\n      hence \"signal_of (\\<sigma> s) \\<tau>1 s (Suc time) = signal_of (\\<sigma> s) \\<tau>1 s time\"\n        by (metis signal_of_suc_sig zero_option_def)\n      also have \"... = signal_of (\\<sigma> s) \\<tau>2 s time\"\n        using assms(3) by auto\n      finally have \"signal_of (\\<sigma> s) \\<tau>1 s (Suc time) = signal_of (\\<sigma> s) \\<tau>2 s (time)\"\n        by auto\n\n      obtain v' where \"\\<tau>2 (Suc time) s = None \\<or> \\<tau>2 (Suc time) s = Some v'\"\n        by (meson not_Some_eq)\n      moreover\n      { assume \"\\<tau>2 (Suc time) s = None\"\n        hence ?case\n          using \\<open>\\<tau>1 (Suc time) s = None\\<close> \\<open>k = Suc time\\<close> by auto }\n      moreover\n      { assume \"\\<tau>2 (Suc time) s = Some v'\"\n        hence False\n          by (metis \\<open>signal_of (\\<sigma> s) \\<tau>1 s (Suc time) = signal_of (\\<sigma> s) \\<tau>2 s time\\<close> assms(2) assms(3) current_sig_and_prev_same diff_Suc_1 option.discI zero_less_Suc zero_option_def)\n        hence ?case \n          by auto }\n      ultimately have ?case\n        by auto }\n    moreover\n    { assume \"\\<tau>1 (Suc time) s = Some v\"\n      hence \"signal_of (\\<sigma> s) \\<tau>1 s (Suc time) = v\"\n        by (metis comp_apply domIff inf_time_someI option.case(2) option.discI option.sel order_refl to_signal_def to_trans_raw_sig_def)\n      hence \"signal_of (\\<sigma> s) \\<tau>2 s (Suc time) = v\"\n        using assms(3) by auto\n      obtain v' where \"\\<tau>2 (Suc time) s = None \\<or> \\<tau>2 (Suc time) s = Some v'\"\n        by (meson not_Some_eq)\n      moreover\n      { assume \"\\<tau>2 (Suc time) s = Some v'\"\n        hence \"signal_of (\\<sigma> s) \\<tau>2 s (Suc time) = v'\"\n          by (metis comp_apply domIff inf_time_someI option.case(2) option.discI option.sel order_refl to_signal_def to_trans_raw_sig_def)\n        with `signal_of (\\<sigma> s) \\<tau>2 s (Suc time) = v` have \"v = v'\"\n          by auto\n        hence ?case\n          by (simp add: \\<open>\\<tau>1 (Suc time) s = Some v\\<close> \\<open>\\<tau>2 (Suc time) s = Some v'\\<close> \\<open>k = Suc time\\<close>) }\n      moreover\n      { assume \"\\<tau>2 (Suc time) s = None\"\n        hence \"signal_of (\\<sigma> s) \\<tau>2 s (Suc time) = signal_of (\\<sigma> s) \\<tau>2 s time\"\n          by (metis signal_of_suc_sig zero_option_def)\n        also have \"... = signal_of (\\<sigma> s) \\<tau>1 s time\"\n          using assms(3) by auto\n        finally have \"signal_of (\\<sigma> s) \\<tau>2 s (Suc time) = signal_of (\\<sigma> s) \\<tau>1 s (time)\"\n          by auto        \n        with \\<open>\\<tau>1 (Suc time) s = Some v\\<close> have False\n          by (metis \\<open>signal_of (\\<sigma> s) \\<tau>1 s (Suc time) = v\\<close> \\<open>signal_of (\\<sigma> s) \\<tau>2 s (Suc time) = v\\<close> assms(1) current_sig_and_prev_same diff_Suc_1 option.discI zero_less_Suc zero_option_def)\n        hence ?case\n          by auto }\n      ultimately have ?case\n        by auto }\n    ultimately have ?case\n      by auto }\n  ultimately show ?case \n    by auto\nqed\n\nlemma non_stut_unique': \n  assumes \"\\<And>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n  assumes \"\\<And>s. non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n  assumes \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>1 s k = signal_of (\\<sigma> s) \\<tau>2 s k\"\n  shows   \" \\<tau>1 = \\<tau>2 \"\n  using  non_stut_unique [OF assms] by blast\n\nlemma helper':\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>1, def \\<turnstile> < ss, \\<tau>1> \\<longrightarrow>\\<^sub>s \\<tau>1'\"\n  assumes \"\\<And>k s. signal_of (def s) \\<theta>1 s k = signal_of (def s) \\<theta>2 s k\"\n  assumes \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>1 s k = signal_of (\\<sigma> s) \\<tau>2 s k\"\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2'\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau>1 n = 0\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau>2 n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta>1 n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta>2 n = 0\"\n  assumes \"nonneg_delay ss\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n  shows \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>1' s k = signal_of (\\<sigma> s) \\<tau>2' s k\"\n  using assms\nproof (induction arbitrary: \\<tau>2 \\<tau>2' rule:b_seq_exec.inducts)\n  case (1 t \\<sigma> \\<gamma> \\<theta> def \\<tau>)\n  then show ?case by auto\nnext\n  case (2 t \\<sigma> \\<gamma> \\<theta>1 def ss1 \\<tau>1 \\<tau> ss2 \\<tau>1')\n  note IH = \"2.IH\"\n  note prems = \"2.prems\"\n  obtain \\<tau>' where \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> < ss1 , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>'\" and \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> < ss2 , \\<tau>'> \\<longrightarrow>\\<^sub>s \\<tau>2'\"\n    by (rule seq_cases_bcomp[OF \\<open>t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> <Bcomp ss1 ss2 , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2'\\<close>]) auto\n  have \"\\<And>k s. signal_of (\\<sigma> s) \\<tau> s k = signal_of (\\<sigma> s) \\<tau>' s k\"\n    using IH(1)[OF prems(1-2) \\<open>t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> < ss1 , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close> prems(4-7) _ prems(9-10)]\n    using nonneg_delay.simps(2) prems(8) by blast\n  moreover have \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau> n = 0\"\n    using \"2.hyps\"(1) b_seq_exec_preserve_trans_removal_nonstrict nonneg_delay.simps(2) prems(4) prems(8) by blast\n  moreover have \"\\<forall>n. n \\<le> t \\<longrightarrow> \\<tau>' n = 0\"\n    by (metis \\<open>t , \\<sigma> , \\<gamma> , \\<theta>2, def \\<turnstile> < ss1 , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close> b_seq_exec_preserve_trans_removal_nonstrict\n    nonneg_delay.simps(2) prems(5) prems(8))\n  moreover  have \"\\<forall>a. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> a\"\n    using b_seq_exec_preserves_non_stuttering\n    by (metis \"2.hyps\"(1) nonneg_delay.simps(2) prems(4) prems(8) prems(9))\n  moreover have \"\\<forall>a. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> a\"\n    using b_seq_exec_preserves_non_stuttering\n    by (metis \\<open>t , \\<sigma> , \\<gamma> , \\<theta>2, def \\<turnstile> < ss1 , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close> nonneg_delay.simps(2) prems(10) prems(5) prems(8))\n  ultimately show ?case\n    using IH(2)\n    by (smt \\<open>t , \\<sigma> , \\<gamma> , \\<theta>2, def \\<turnstile> < ss2 , \\<tau>'> \\<longrightarrow>\\<^sub>s \\<tau>2'\\<close> nonneg_delay.simps(2) prems(1) prems(6)\n    prems(7) prems(8))\nnext\n  case (3 t \\<sigma> \\<gamma> \\<theta> def guard ss1 \\<tau> \\<tau>' ss2)\n  have \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> < ss1 , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2'\"\n    apply (rule seq_cases_bguarded[OF 3(6), rotated])\n    by (metis \"3.hyps\"(1) \"3.prems\"(1) beval_cong beval_raw_deterministic val.inject(1))\n  then show ?case\n    using \"3.IH\"[OF \"3.prems\"(1-2) _ \"3.prems\"(4-7) _ \"3.prems\"(9-10)]\n    by (metis \"3.prems\"(8) nonneg_delay.simps(3))\nnext\n  case (4 t \\<sigma> \\<gamma> \\<theta>1 def g ss2 \\<tau>1 \\<tau>1' ss1)\n  hence \"beval_raw t \\<sigma> \\<gamma> \\<theta>2 def g (Bv False)\"\n    using beval_cong[OF 4(1)] by auto\n  hence \"b_seq_exec t \\<sigma> \\<gamma> \\<theta>1 def ss2 \\<tau>1 \\<tau>1'\" and \"b_seq_exec t \\<sigma> \\<gamma> \\<theta>2 def ss2 \\<tau>2 \\<tau>2'\"\n    using `beval_raw t \\<sigma> \\<gamma> \\<theta>1 def g (Bv False)` \"4.hyps\"(2) apply blast\n    by (metis \"4.prems\"(3) \\<open>t , \\<sigma> , \\<gamma> , \\<theta>2, def \\<turnstile> g \\<longrightarrow>\\<^sub>b Bv False\\<close> beval_raw_deterministic seq_cases_bguarded val.inject(1) val.sel(1))\n  then show ?case\n    using \"4.IH\"[OF \"4.prems\"(1-2) _ \"4.prems\"(4-7) _ \"4.prems\"(9-10)]\n    by (metis \"4.prems\"(8) nonneg_delay.simps(3))\nnext\n  case (5 t \\<sigma> \\<gamma> \\<theta> def e x sig \\<tau> dly \\<tau>')\n  have \"beval_raw t \\<sigma> \\<gamma> \\<theta>2 def e x\"\n    using beval_cong[OF 5(1) 5(3)] by auto\n  have tau2:  \"\\<tau>2' = trans_post_raw sig x (\\<sigma> sig) \\<tau>2 t dly\"\n    using `beval_raw t \\<sigma> \\<gamma> \\<theta>2 def e x` beval_raw_deterministic\n    by (metis \"5.prems\"(3) seq_cases_trans)\n  have \"s \\<noteq> sig \\<Longrightarrow> signal_of (\\<sigma> s) \\<tau>' s k = signal_of (\\<sigma> s) \\<tau> s k\"\n    using signal_of_trans_post  by (metis \"5.hyps\"(2))\n  moreover have \"s \\<noteq> sig \\<Longrightarrow> signal_of (\\<sigma> s) \\<tau> s k = signal_of (\\<sigma> s) \\<tau>2 s k\"\n    using \"5.prems\"(2) by blast\n  ultimately have *: \"s \\<noteq> sig \\<Longrightarrow> signal_of (\\<sigma> s) \\<tau>' s k = signal_of (\\<sigma> s) \\<tau>2' s k\"\n    using signal_of_trans_post unfolding tau2 by metis\n  have \"t + dly \\<le> k \\<or> k < t + dly\"\n    by auto\n  moreover\n  { assume \"t + dly \\<le> k\"\n    from signal_of_trans_post3[OF this] have \"signal_of (\\<sigma> sig) \\<tau>' sig k = x\"\n      by (metis \"5.hyps\"(2) \"5.prems\"(4) \"5.prems\"(8) less_or_eq_imp_le nonneg_delay.simps(4))\n    moreover from signal_of_trans_post3[OF `t + dly \\<le> k`] have \"signal_of (\\<sigma> sig) \\<tau>2' sig k = x\"\n      by (metis \"5.prems\"(5) \"5.prems\"(8) nonneg_delay.simps(4) order.strict_implies_order tau2)\n    ultimately have \"signal_of (\\<sigma> sig) \\<tau>' sig k = signal_of (\\<sigma> sig) \\<tau>2' sig k\"\n      by auto\n    with * have \"signal_of (\\<sigma> s) \\<tau>' s k = signal_of (\\<sigma> s) \\<tau>2' s k\"\n      by auto }\n  moreover\n  { assume \"k < t + dly\"\n    from signal_of_trans_post2[OF this] have \"signal_of (\\<sigma> s) \\<tau>' sig k = signal_of (\\<sigma> s) \\<tau> sig k\"\n      and \"signal_of (\\<sigma> s) \\<tau>2' sig k = signal_of (\\<sigma> s) \\<tau>2 sig k\"\n      using \"5.hyps\"(2) apply fastforce\n      using \\<open>\\<And>v s' s def' def \\<tau>. signal_of def (trans_post_raw s' v def' \\<tau> t dly) s k = signal_of def \\<tau> s k\\<close> tau2\n      by fastforce\n    with * have \"signal_of (\\<sigma> s) \\<tau>' s k = signal_of (\\<sigma> s) \\<tau>2' s k\"\n      using \"5.prems\"(2) by fastforce }\n  ultimately show ?case by auto\nnext\n  case (6 t \\<sigma> \\<gamma> \\<theta> def e x sig \\<tau>1 dly \\<tau>1')\n  hence \"beval_raw t \\<sigma> \\<gamma> \\<theta>2 def e x\"\n    using beval_cong by metis\n  have tau1: \"\\<tau>1' = inr_post_raw' sig x (\\<sigma> sig) \\<tau>1 t dly\"\n    using beval_raw_deterministic  using \"6.hyps\"(2) by blast\n  have tau2:  \"\\<tau>2' = inr_post_raw' sig x (\\<sigma> sig) \\<tau>2 t dly\"\n    using `beval_raw t \\<sigma> \\<gamma> \\<theta>2 def e x`  beval_raw_deterministic\n    by (metis \"6.prems\"(3) seq_cases_inert)\n  have \"\\<tau>1 = \\<tau>2\"\n    using non_stut_unique' using 6(11-12) 6(4) by blast\n  hence \"\\<tau>1' = \\<tau>2'\"\n    unfolding tau1 tau2 by auto\n  thus ?case\n    by auto\nnext\n  case (7 t \\<sigma> \\<gamma> \\<theta> def exp x exp' ss \\<tau> \\<tau>' choices)\n  have \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> < ss , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2'\"\n    apply (rule seq_cases_bcase[OF 7(7), rotated])\n    by (metis \"7.hyps\"(1) \"7.hyps\"(2) \"7.prems\"(1) Pair_inject beval_cong beval_raw_deterministic\n    choices.inject list.inject) blast+\n  then show ?case\n    using \"7.IH\"[OF \"7.prems\"(1-2) _ \"7.prems\"(4-7) _ \"7.prems\"(9-10)] \"7.prems\"(8)\n    by auto\nnext\n  case (8 t \\<sigma> \\<gamma> \\<theta> def exp x exp' x' choices \\<tau> \\<tau>' ss)\n  have \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> <Bcase exp choices , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2'\"\n    apply (rule seq_cases_bcase[OF 8(8)])\n    by (metis \"8.hyps\"(1) \"8.hyps\"(2) \"8.hyps\"(3) \"8.prems\"(1) Pair_inject beval_cong\n    beval_raw_deterministic choices.inject list.inject)blast+\n  thus ?case\n    using 8(5)[OF 8(6-7) _ 8(9-12) _ 8(14-15)] 8(13) by auto\nnext\n  case (9 t \\<sigma> \\<gamma> \\<theta> def ss \\<tau> \\<tau>' exp choices)\n  hence \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> < ss , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2'\"\n    using seq_cases_bcase by fastforce\n  moreover have \" nonneg_delay ss \"\n    using 9(10) by auto\n  ultimately show ?case\n    using 9(2)[OF 9(3-4) _ 9(6-9) _ 9(11-12)] 9(10) by auto\nnext\n  case (10 t \\<sigma> \\<gamma> \\<theta> def exp \\<tau>)\n  hence \"\\<tau>2' = \\<tau>2\"\n    using seq_cases_bcase by fastforce\n  then show ?case\n    using 10 by auto\nqed\n\nlemma helper_goal1:\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>1, def \\<turnstile> < ss, \\<tau>1> \\<longrightarrow>\\<^sub>s \\<tau>1'\"\n  assumes \"\\<And>k s. signal_of (def s) \\<theta>1 s k = signal_of (def s) \\<theta>2 s k\"\n  assumes \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>1 s k = signal_of (\\<sigma> s) \\<tau>2 s k\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau>1 n = 0\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau>2 n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta>1 n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta>2 n = 0\"\n  assumes \"nonneg_delay ss\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n  shows   \"\\<exists>\\<tau>2'. t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss, \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2'\"\n  using assms\nproof (induction arbitrary: \\<tau>2 rule:b_seq_exec.inducts)\n  case (1 t \\<sigma> \\<gamma> \\<theta> def \\<tau>)\n  then show ?case by (auto intro!: b_seq_exec.intros)\nnext\n  case (2 t \\<sigma> \\<gamma> \\<theta> def ss1 \\<tau> \\<tau>'' ss2 \\<tau>')\n  hence \"\\<exists>a. t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> < ss1 , \\<tau>2> \\<longrightarrow>\\<^sub>s a\"\n    by (simp add: \"2.IH\"(1) \"2.prems\"(9))\n  then obtain \\<tau>2'' where \"t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss1, \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2''\"\n    by auto\n  have *: \"\\<And>s k. signal_of (\\<sigma> s) \\<tau>'' s k = signal_of (\\<sigma> s) \\<tau>2'' s k\"\n    using helper'[OF 2(1) 2(5-6) `t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss1, \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2''`]\n    using \"2.prems\"(3) \"2.prems\"(4) \"2.prems\"(5) \"2.prems\"(6) \"2.prems\"(7) \"2.prems\"(8) \"2.prems\"(9) by auto\n  hence \"\\<exists>a. t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> < ss2 , \\<tau>2''> \\<longrightarrow>\\<^sub>s a\"\n    using 2(4)[OF 2(5) *]\n    by (smt \"2.hyps\"(1) \"2.prems\"(3) \"2.prems\"(4) \"2.prems\"(5) \"2.prems\"(6) \"2.prems\"(7)\n    \"2.prems\"(8) \"2.prems\"(9) \\<open>t , \\<sigma> , \\<gamma> , \\<theta>2, def \\<turnstile> < ss1 , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2''\\<close>\n    b_seq_exec_preserve_trans_removal_nonstrict b_seq_exec_preserves_non_stuttering\n    nonneg_delay.simps(2))\n  then show ?case\n    using \\<open>t , \\<sigma> , \\<gamma> , \\<theta>2, def \\<turnstile> < ss1 , \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2''\\<close> b_seq_exec.intros(2) by blast\nnext\n  case (3 t \\<sigma> \\<gamma> \\<theta> def guard ss1 \\<tau> \\<tau>' ss2)\n  then show ?case\n    by (metis (full_types) b_seq_exec.intros(3) beval_cong nonneg_delay.simps(3))\nnext\n  case (4 t \\<sigma> \\<gamma> \\<theta> def guard ss2 \\<tau> \\<tau>' ss1)\n  then show ?case\n    by (metis (full_types) b_seq_exec.intros(4) beval_cong nonneg_delay.simps(3))\nnext\n  case (5 t \\<sigma> \\<gamma> \\<theta> def e x sig \\<tau> dly \\<tau>')\n  then show ?case\n    by (meson b_seq_exec.intros(5) beval_cong)\nnext\n  case (6 t \\<sigma> \\<gamma> \\<theta> def e x sig \\<tau> dly \\<tau>')\n  then show ?case\n    by (meson b_seq_exec.intros(6) beval_cong)\nnext\n  case (7 t \\<sigma> \\<gamma> \\<theta> def exp x exp' ss \\<tau> \\<tau>' choices)\n  note prems = \"7.prems\"\n  note IH = \"7.IH\"\n  have \"nonneg_delay ss\"\n    using \\<open>nonneg_delay (Bcase exp ((Explicit exp', ss) # choices))\\<close>  unfolding nonneg_delay.simps by auto\n  then obtain a where \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> < ss , \\<tau>2> \\<longrightarrow>\\<^sub>s a\"\n    using IH[OF prems(1-6) _ prems(8-9)] by auto\n  moreover have \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\"\n    using \"7.hyps\"(1) beval_cong prems(1) by blast\n  moreover have \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> exp' \\<longrightarrow>\\<^sub>b x\"\n    using \"7.hyps\"(2) beval_cong prems(1) by blast\n  ultimately have \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> <Bcase exp ((Explicit exp', ss) # choices) , \\<tau>2> \\<longrightarrow>\\<^sub>s a\"\n    by (intro b_seq_exec.intros)\n  thus ?case\n    by auto\nnext\n  case (8 t \\<sigma> \\<gamma> \\<theta> def exp x exp' x' choices \\<tau> \\<tau>' ss)\n  note prems = \"8.prems\"\n  note IH = \"8.IH\"\n  note hyps = \"8.hyps\"\n  have \"nonneg_delay (Bcase exp choices) \"\n    using prems(7) unfolding nonneg_delay.simps by auto\n  then obtain a where \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> <Bcase exp choices , \\<tau>2> \\<longrightarrow>\\<^sub>s a\"\n    using IH[OF prems(1-6) _ prems(8-9)] by auto\n  moreover have \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\"\n    using hyps(1) beval_cong prems(1) by blast\n  moreover have \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> exp' \\<longrightarrow>\\<^sub>b x'\"\n    using hyps(2) beval_cong prems(1) by blast\n  ultimately have \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> <Bcase exp ((Explicit exp', ss) # choices) , \\<tau>2> \\<longrightarrow>\\<^sub>s a\"\n    by (auto intro!: b_seq_exec.intros(8) simp add: \\<open>x \\<noteq> x'\\<close>)\n  thus ?case\n    by blast\nnext\n  case (9 t \\<sigma> \\<gamma> \\<theta> def ss \\<tau> \\<tau>' exp choices)\n  note prems = \"9.prems\"\n  note IH = \"9.IH\"\n  note hyps = \"9.hyps\"\n  obtain a  where \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> < ss , \\<tau>2> \\<longrightarrow>\\<^sub>s a\"\n    using IH[OF prems(1-6) _ prems(8-9)] prems(7) unfolding nonneg_delay.simps by auto\n  hence \"t , \\<sigma> , \\<gamma> , \\<theta>2, def  \\<turnstile> <Bcase exp ((Others, ss) # choices) , \\<tau>2> \\<longrightarrow>\\<^sub>s a\"\n    by (intro b_seq_exec.intros)\n  then show ?case\n    by auto\nnext\n  case (10 t \\<sigma> \\<gamma> \\<theta> def exp \\<tau>)\n  then show ?case\n    by (meson b_seq_exec.intros(10))\nqed\n\nlemma helper:\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>1, def \\<turnstile> < ss, \\<tau>1> \\<longrightarrow>\\<^sub>s \\<tau>1'\"\n  assumes \"\\<And>k s. signal_of (def s) \\<theta>1 s k = signal_of (def s) \\<theta>2 s k\"\n  assumes \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>1 s k = signal_of (\\<sigma> s) \\<tau>2 s k\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau>1 n = 0\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau>2 n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta>1 n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta>2 n = 0\"\n  assumes \"nonneg_delay ss\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n  shows \"\\<exists>\\<tau>2'. (t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss, \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2') \\<and> (\\<forall>k s. signal_of (\\<sigma> s) \\<tau>1' s k = signal_of (\\<sigma> s) \\<tau>2' s k)\"\nproof -\n  have \"\\<exists>\\<tau>2'. (t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss, \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2')\"\n    using helper_goal1[OF assms] by auto\n  then obtain \\<tau>2' where \"t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss, \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2'\"\n    by blast\n  thus ?thesis\n    using helper'[OF assms(1-3) _ assms(4-10)] `nonneg_delay ss` by blast\nqed\n\nlemma keys_at_least_t:\n  assumes \"k \\<in> keys (to_trans_raw_sig (derivative_raw w t) s)\"\n  shows \"t < k\"\nproof (rule ccontr)\n  assume \"\\<not> t < k\" hence \"k \\<le> t\" by auto\n  hence \"derivative_raw w t k s = None\"\n    unfolding derivative_raw_def by auto\n  hence \"to_trans_raw_sig (derivative_raw w t) s k = None\"\n    by (auto simp add: to_trans_raw_sig_def)\n  hence \"k \\<notin> keys (to_trans_raw_sig (derivative_raw w t) s)\"\n    unfolding keys_def by (auto simp add: zero_option_def)\n  with assms show False\n    by auto\nqed\n\nlemma derivative_raw_ensure_non_stuttering:\n  \"\\<forall>s. non_stuttering (to_trans_raw_sig (derivative_raw w t)) (\\<lambda>s. snd w s t) s\"\nproof\n  fix s\n  define ks where \"ks = keys (to_trans_raw_sig (derivative_raw w t) s)\"\n  { fix k1 k2 :: nat\n    assume \"k1 < k2\" and \"k1 \\<in> ks\" and \"k2 \\<in> ks\"\n    assume \"\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> ks\"\n    have \"t < k1\"\n      using `k1 \\<in> ks` unfolding ks_def by (simp add: keys_at_least_t)\n    hence \"to_trans_raw_sig (derivative_raw w t) s k1 = Some (snd w s k1)\"\n      using `k1 \\<in> ks` unfolding ks_def keys_def to_trans_raw_sig_def derivative_raw_def\n      difference_raw_def  using CollectD zero_option_def by fastforce\n    moreover have \"to_trans_raw_sig (derivative_raw w t) s k2 = Some (snd w s k2)\"\n      using `k2 \\<in> ks` CollectD zero_option_def `t < k1` `k1 < k2`\n      unfolding ks_def keys_def to_trans_raw_sig_def derivative_raw_def difference_raw_def\n      by fastforce\n    moreover have \"snd w s k1 \\<noteq> snd w s k2\"\n    proof -\n      have \"\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> snd w s k = snd w s k1\"\n      proof (rule, rule)\n        fix k\n        assume \"k1 < k \\<and> k < k2\"\n        hence \"signal_of (snd w s t) (derivative_raw w t) s k = snd w s k\"\n          using `t < k1`\n          by(intro signal_of_derivative_raw[where \\<sigma>=\"\\<lambda>s. snd w s t\"])(auto)\n        hence \"snd w s k = signal_of (snd w s t) (derivative_raw w t) s k\"\n          by auto\n        also have \"... = signal_of (snd w s t) (derivative_raw w t) s k1\"\n          using `\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> ks` `k1 < k \\<and> k < k2` unfolding ks_def\n          by (intro signal_of_less_ind')(simp add: keys_def to_trans_raw_sig_def)+\n        also have \"... = snd w s k1\"\n          using `t < k1`\n          by(intro signal_of_derivative_raw[where \\<sigma>=\"\\<lambda>s. snd w s t\"])(auto)\n        finally show \"snd w s k = snd w s k1\"\n          by auto\n      qed\n      hence \"snd w s (k2 - 1) = snd w s k1\"\n        using `k1 < k2` `t < k1`\n        by (metis Suc_diff_1 diff_less less_SucE less_Suc_eq_0_disj less_imp_Suc_add zero_less_one)\n      moreover have \"snd w s k2 \\<noteq> snd w s (k2 - 1)\"\n        using `k2 \\<in> ks` `t < k1` `k1 < k2` zero_option_def\n        unfolding ks_def keys_def to_trans_raw_sig_def derivative_raw_def difference_raw_def by force\n      ultimately show ?thesis\n        by auto\n    qed\n    ultimately have \"to_trans_raw_sig (derivative_raw w t) s k1 \\<noteq> to_trans_raw_sig (derivative_raw w t) s k2\"\n      by auto }\n  note first_po = this\n  { assume \"ks \\<noteq> {}\"\n    hence \"\\<exists>k. k \\<in> ks\"\n      by auto\n    define Least_key where \"Least_key = (LEAST k. k \\<in> ks)\"\n    have \"Least_key \\<in> ks\"\n      using LeastI_ex[OF `\\<exists>k. k \\<in> ks`] unfolding Least_key_def by auto\n    hence \"t < Least_key\"\n      by (simp add: keys_at_least_t ks_def)\n    have \"\\<And>k. k < Least_key \\<Longrightarrow> k \\<notin> ks\"\n      unfolding Least_key_def using not_less_Least by blast\n    hence \"\\<And>k. t \\<le> k \\<and> k < Least_key \\<Longrightarrow> snd w s k = snd w s t\"\n    proof -\n      fix k\n      assume \"t \\<le> k \\<and> k < Least_key\"\n      hence \"signal_of (snd w s t) (derivative_raw w t) s k = snd w s k\"\n        by (intro signal_of_derivative_raw)(auto)\n      hence \"snd w s k = signal_of (snd w s t) (derivative_raw w t) s k \"\n        by auto\n      also have \"... = signal_of (snd w s t) (derivative_raw w t) s t\"\n        using `t \\<le> k \\<and> k < Least_key` `\\<And>k. k < Least_key \\<Longrightarrow> k \\<notin> ks` `t \\<le> k \\<and> k < Least_key`\n        by (intro signal_of_less_ind')(simp add: keys_def ks_def to_trans_raw_sig_def)+\n      also have \"... = signal_of (snd w s t) (derivative_raw w t) s 0\"\n        by (intro signal_of_less_ind')(auto simp add: derivative_raw_def zero_option_def)\n      also have \"... = snd w s t\"\n        by (metis (full_types) derivative_raw_def signal_of_zero zero_option_def zero_order(1))\n      finally show \"snd w s k = snd w s t\"\n        by auto\n    qed\n    moreover have \"snd w s Least_key \\<noteq> snd w s (Least_key - 1)\"\n      using `Least_key \\<in> ks` `t < Least_key` unfolding ks_def keys_def to_trans_raw_sig_def\n      derivative_raw_def difference_raw_def  using zero_option_def by force\n    ultimately have \"snd w s t \\<noteq> snd w s Least_key\"\n      by (metis Suc_diff_1 \\<open>t < Least_key\\<close> diff_less less_Suc_eq_0_disj less_Suc_eq_le\n      less_imp_Suc_add zero_less_one)\n    moreover have \"Some (snd w s Least_key) = to_trans_raw_sig (derivative_raw w t) s Least_key\"\n      using `Least_key \\<in> ks` `t < Least_key` unfolding ks_def keys_def to_trans_raw_sig_def\n      derivative_raw_def difference_raw_def using \\<open>snd w s Least_key \\<noteq> snd w s (Least_key - 1)\\<close> by auto\n    ultimately have \"snd w s t \\<noteq> the (to_trans_raw_sig (derivative_raw w t) s (LEAST k. k \\<in> ks))\"\n      unfolding Least_key_def by (metis option.sel) }\n  with first_po show \"non_stuttering (to_trans_raw_sig (derivative_raw w t)) (\\<lambda>s. snd w s t) s\"\n    unfolding non_stuttering_def ks_def  by blast\nqed\n\nlemma destruct_worldline_ensure_non_stuttering:\n  assumes \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n  shows \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\nproof -\n  have \"\\<tau> = derivative_raw (snd tw) t\"\n    using assms  by (metis (no_types, lifting) Pair_inject destruct_worldline_def)\n  moreover have  \"\\<sigma> = (\\<lambda>s. wline_of tw s t)\"\n    by (metis (no_types, lifting) assms comp_apply destruct_worldline_def fst_conv snd_conv)\n  ultimately show \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    using derivative_raw_ensure_non_stuttering[of \"snd tw\" \"t\"] by auto\nqed\n\nlemma keys_at_most_t:\n  assumes \"k \\<in> keys (to_trans_raw_sig (derivative_hist_raw w t) s)\"\n  shows \"k < t\"\nproof (rule ccontr)\n  assume \"\\<not> k < t\" hence \"t \\<le> k\" by auto\n  hence \"derivative_hist_raw w t k s = None\"\n    unfolding derivative_hist_raw_def by auto\n  hence \"to_trans_raw_sig (derivative_hist_raw w t) s k = None\"\n    by (auto simp add: to_trans_raw_sig_def)\n  hence \"k \\<notin> keys (to_trans_raw_sig (derivative_hist_raw w t) s)\"\n    unfolding keys_def by (auto simp add: zero_option_def)\n  with assms show False\n    by auto\nqed\n\nlemma derivative_hist_raw_ensure_non_stuttering:\n  \"\\<forall>s. non_stuttering (to_trans_raw_sig (derivative_hist_raw w t)) (fst w) s\"\nproof\n  fix s\n  define ks where \"ks = keys (to_trans_raw_sig (derivative_hist_raw w t) s)\"\n  { fix k1 k2 :: nat\n    assume \"k1 < k2\" and \"k1 \\<in> ks\" and \"k2 \\<in> ks\"\n    assume \"\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> ks\"\n    have \"k1 < t\"\n      using `k1 \\<in> ks` unfolding ks_def by (auto simp add: keys_at_most_t)\n    hence \"to_trans_raw_sig (derivative_hist_raw w t) s k1 = Some (snd w s k1)\"\n      using `k1 \\<in> ks` unfolding ks_def keys_def to_trans_raw_sig_def derivative_hist_raw_def\n      difference_raw_def  using CollectD zero_option_def\n    proof -\n      assume \"k1 \\<in> {k. (if t \\<le> k then Map.empty else if k = 0 then \\<lambda>s. if snd w s k \\<noteq> get_time w s then Some (snd w s k) else None else (\\<lambda>s. if snd w s k \\<noteq> snd w s (k - 1) then Some (snd w s k) else None)) s \\<noteq> 0}\"\n      then have f1: \"(if t \\<le> k1 then Map.empty else if k1 = 0 then \\<lambda>a. if snd w a k1 \\<noteq> get_time w a then Some (snd w a k1) else None else (\\<lambda>a. if snd w a k1 \\<noteq> snd w a (k1 - 1) then Some (snd w a k1) else None)) s \\<noteq> 0\"\n        by force\n      then have f2: \"\\<not> (if t \\<le> k1 then (None::val option) = 0 else if k1 = 0 then (if snd w s k1 \\<noteq> get_time w s then Some (snd w s k1) else None) = 0 else (if snd w s k1 \\<noteq> snd w s (k1 - 1) then Some (snd w s k1) else None) = 0)\"\n        by presburger\n      have f3: \"\\<not> t \\<le> k1\"\n        using f1 \\<open>0 = None\\<close> by force\n      then have f4: \"k1 = 0 \\<longrightarrow> snd w s 0 \\<noteq> get_time w s\"\n        using f2 \\<open>0 = None\\<close> by fastforce\n      have \"(if t \\<le> k1 then Map.empty else if k1 = 0 then \\<lambda>a. if snd w a k1 \\<noteq> get_time w a then Some (snd w a k1) else None else (\\<lambda>a. if snd w a k1 \\<noteq> snd w a (k1 - 1) then Some (snd w a k1) else None)) s = Some (snd w s k1) \\<or> k1 = 0\"\n        using f3 f2 \\<open>0 = None\\<close> by fastforce\n      then show \"(if t \\<le> k1 then Map.empty else if k1 = 0 then \\<lambda>a. if snd w a k1 \\<noteq> get_time w a then Some (snd w a k1) else None else (\\<lambda>a. if snd w a k1 \\<noteq> snd w a (k1 - 1) then Some (snd w a k1) else None)) s = Some (snd w s k1)\"\n        using f4 f3 by presburger\n    qed\n    have \"k2 < t\"\n      using `k2 \\<in> ks` unfolding ks_def by (auto simp add: keys_at_most_t)\n    hence \"to_trans_raw_sig (derivative_hist_raw w t) s k2 = Some (snd w s k2)\"\n      using `k2 \\<in> ks` `k1 < k2` unfolding ks_def keys_def to_trans_raw_sig_def derivative_hist_raw_def\n      difference_raw_def  using CollectD zero_option_def by fastforce\n    have \"snd w s k1 \\<noteq> snd w s k2\"\n    proof -\n      have \"\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> snd w s k = snd w s k1\"\n      proof (rule, rule)\n        fix k\n        assume \"k1 < k \\<and> k < k2\"\n        hence \"signal_of (fst w s) (derivative_hist_raw w t) s k = snd w s k\"\n          using `k2 < t`  by(intro signal_of_derivative_hist_raw)(auto)\n        hence \"snd w s k = signal_of (fst w s) (derivative_hist_raw w t) s k\"\n          by auto\n        also have \"... = signal_of (fst w s) (derivative_hist_raw w t) s k1\"\n          using `\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> ks` `k1 < k \\<and> k < k2` unfolding ks_def\n          by (intro signal_of_less_ind')(simp add: keys_def to_trans_raw_sig_def)+\n        also have \"... = snd w s k1\"\n          using `k1 < t` by(intro signal_of_derivative_hist_raw)(auto)\n        finally show \"snd w s k = snd w s k1\"\n          by auto\n      qed\n      hence \"snd w s (k2 - 1) = snd w s k1\"\n        using `k1 < k2`\n        by (metis Suc_diff_1 diff_less less_SucE less_Suc_eq_0_disj less_imp_Suc_add zero_less_one)\n      moreover have \"snd w s k2 \\<noteq> snd w s (k2 - 1)\"\n        using `k2 \\<in> ks`  `k1 < k2` `k2 < t` zero_option_def\n        unfolding ks_def keys_def to_trans_raw_sig_def derivative_hist_raw_def difference_raw_def\n        by force\n      ultimately show ?thesis\n        by auto\n    qed\n    hence \"to_trans_raw_sig (derivative_hist_raw w t) s k1 \\<noteq>\n           to_trans_raw_sig (derivative_hist_raw w t) s k2\"\n      using \\<open>to_trans_raw_sig (derivative_hist_raw w t) s k2 = Some (snd w s k2)\\<close>\n      and \\<open>to_trans_raw_sig (derivative_hist_raw w t) s k1 = Some (snd w s k1)\\<close>\n      by auto }\n  note first_po = this\n  { assume \"ks \\<noteq> {}\"\n    hence \"\\<exists>k. k \\<in> ks\"\n      by auto\n    define Least_key where \"Least_key = (LEAST k. k \\<in> ks)\"\n    have \"Least_key \\<in> ks\"\n      using LeastI_ex[OF `\\<exists>k. k \\<in> ks`] unfolding Least_key_def by auto\n    hence \"Least_key < t\"\n      by (simp add: keys_at_most_t ks_def)\n    have \"\\<And>k. k < Least_key \\<Longrightarrow> k \\<notin> ks\"\n      unfolding Least_key_def using not_less_Least by blast\n    hence \"\\<And>k. k < Least_key \\<Longrightarrow> snd w s k = snd w s 0\"\n    proof -\n      fix k\n      assume \"k < Least_key\"\n      hence \"signal_of (fst w s) (derivative_hist_raw w t) s k = snd w s k\"\n        using `Least_key < t` by (intro signal_of_derivative_hist_raw)(auto)\n      hence \"snd w s k = signal_of (fst w s) (derivative_hist_raw w t) s k \"\n        by auto\n      also have \"... = signal_of (fst w s) (derivative_hist_raw w t) s 0\"\n        using `k < Least_key` `\\<And>k. k < Least_key \\<Longrightarrow> k \\<notin> ks`\n        by (intro signal_of_less_ind')(simp add: keys_def ks_def to_trans_raw_sig_def)+\n      also have \"... = snd w s 0\"\n        by (metis \\<open>Least_key < t\\<close> less_trans not_gr_zero signal_of_derivative_hist_raw)\n      finally show \"snd w s k = snd w s 0\"\n        by auto\n    qed\n    have \"Least_key = 0 \\<or> 0 < Least_key\"\n      by auto\n    moreover\n    { assume \"0 < Least_key\"\n      hence \"snd w s Least_key \\<noteq> snd w s (Least_key - 1)\"\n        using `Least_key \\<in> ks` `Least_key < t` unfolding ks_def keys_def to_trans_raw_sig_def\n        derivative_hist_raw_def difference_raw_def  using zero_option_def\n        by force\n      hence \"snd w s 0 \\<noteq> snd w s Least_key\"\n        using \\<open>0 < Least_key\\<close> \\<open>\\<And>k. k < Least_key \\<Longrightarrow> snd w s k = snd w s 0\\<close>\n        by (metis One_nat_def diff_Suc_less)\n      moreover have \"Some (snd w s Least_key) = to_trans_raw_sig (derivative_hist_raw w t) s Least_key\"\n        using `Least_key \\<in> ks` `Least_key < t` unfolding ks_def keys_def to_trans_raw_sig_def\n        derivative_hist_raw_def difference_raw_def using \\<open>snd w s Least_key \\<noteq> snd w s (Least_key - 1)\\<close>\n        by (simp add: \\<open>0 < Least_key\\<close>)\n      ultimately have \"snd w s 0 \\<noteq> the (to_trans_raw_sig (derivative_hist_raw w t) s (LEAST k. k \\<in> ks))\"\n        unfolding Least_key_def  by (metis option.sel)\n      moreover have \"snd w s 0 = fst w s\"\n      proof (rule ccontr)\n        assume \"snd w s 0 \\<noteq> fst w s\"\n        hence \"0 \\<in> ks\"\n          unfolding ks_def keys_def to_trans_raw_sig_def derivative_hist_raw_def difference_raw_def\n          using `0 < Least_key` `Least_key < t` by (auto simp add: zero_option_def)\n        thus False\n          using \\<open>0 < Least_key\\<close> \\<open>\\<And>ka. ka < Least_key \\<Longrightarrow> ka \\<notin> ks\\<close> by blast\n      qed\n      ultimately have \"fst w s \\<noteq> the (to_trans_raw_sig (derivative_hist_raw w t) s (LEAST k. k \\<in> ks))\"\n        by auto }\n    moreover\n    { assume \"Least_key = 0\"\n      hence \"0 \\<in> ks\"\n        using `Least_key \\<in> ks` by auto\n      hence \"derivative_hist_raw w t 0 s \\<noteq> 0\"\n        unfolding ks_def keys_def to_trans_raw_sig_def by auto\n      hence \"derivative_hist_raw w t 0 s \\<noteq> Some (fst w s)\"\n        using `Least_key < t` `Least_key = 0` unfolding derivative_hist_raw_def difference_raw_def\n        by simp\n      hence \"fst w s \\<noteq> the (to_trans_raw_sig (derivative_hist_raw w t) s (LEAST k. k \\<in> ks))\"\n        by (metis Least_key_def \\<open>Least_key = 0\\<close> \\<open>derivative_hist_raw w t 0 s \\<noteq> 0\\<close> not_None_eq\n        option.sel to_trans_raw_sig_def zero_option_def) }\n    ultimately have \"fst w s \\<noteq> the (to_trans_raw_sig (derivative_hist_raw w t) s (LEAST k. k \\<in> ks))\"\n      by auto }\n  with first_po show \"non_stuttering (to_trans_raw_sig (derivative_hist_raw w t)) (fst w) s\"\n    unfolding non_stuttering_def ks_def by auto\nqed\n\nlemma destruct_worldline_ensure_non_stuttering_hist_raw:\n  assumes \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n  shows \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\nproof -\n  have \"\\<theta> = derivative_hist_raw (snd tw) t\"\n    using assms  by (metis (no_types, lifting) Pair_inject destruct_worldline_def)\n  moreover have  \"def = (fst o snd) tw\"\n    using assms\n    by (metis (mono_tags, lifting) comp_apply destruct_worldline_correctness(6)\n    destruct_worldline_def worldline2_constructible)\n  ultimately show \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n    using derivative_hist_raw_ensure_non_stuttering[of \"snd tw\" \"t\"] by auto\nqed\n\nlemma Bcomp_hoare_valid':\n  assumes \"\\<Turnstile> [P] s1 [Q]\" and \"\\<Turnstile> [Q] s2 [R]\"\n  assumes \"nonneg_delay (Bcomp s1 s2)\"\n  shows \"\\<Turnstile> [P] Bcomp s1 s2 [R]\"\n  unfolding seq_hoare_valid2_def\nproof (rule)+\n  fix tw tw' :: \"nat \\<times> 'a worldline_init\"\n  have \"nonneg_delay s1\" and \"nonneg_delay s2\"\n    using assms(3) by auto\n  assume \"P tw \\<and> (tw, Bcomp s1 s2 \\<Rightarrow>\\<^sub>s tw')\"\n  hence \"P tw\" and \"tw, Bcomp s1 s2 \\<Rightarrow>\\<^sub>s tw'\" by auto\n  then obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> \\<tau>' def  where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    \"(t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <Bcomp s1 s2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>')\" and \"tw'= worldline2 t \\<sigma> \\<theta> def \\<tau>'\"\n    using destruct_worldline_exist by (smt world_seq_exec_cases)\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    using destruct_worldline_ensure_non_stuttering[OF des] by auto\n  hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n    using b_seq_exec_preserves_non_stuttering[OF `t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <Bcomp s1 s2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'`]\n    by (meson assms(3) context_invariant_def des worldline2_constructible)\n  then obtain \\<tau>'' where tau1: \"(t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < s1, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'')\" and tau2: \"(t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < s2, \\<tau>''> \\<longrightarrow>\\<^sub>s \\<tau>')\"\n    using \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bcomp s1 s2 , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close> seq_cases_bcomp by blast\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>'') \\<sigma> s\"\n    using b_seq_exec_preserves_non_stuttering[OF tau1]\n    by (meson \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\\<close> assms(3) context_invariant_def des\n    nonneg_delay.simps(2) worldline2_constructible)\n  define tw'' where \"tw'' = worldline2 t \\<sigma> \\<theta> def \\<tau>''\"\n  hence \"tw, s1 \\<Rightarrow>\\<^sub>s tw''\"\n    using des tau1 world_seq_exec.intros by blast\n  with assms(1) have \"Q tw''\"\n    unfolding seq_hoare_valid2_def using `P tw` by fastforce\n  have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using worldline2_constructible[OF des] by auto\n  hence \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>''\"\n    using b_seq_exec_preserves_context_invariant[OF _ tau1] assms(3) by auto\n  obtain \\<theta>''' \\<tau>''' where des2: \"destruct_worldline tw'' = (t, \\<sigma>, \\<gamma>, \\<theta>''', def, \\<tau>''')\" and\n    sig_beh: \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>''' s k\" and\n    sig_trans: \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>'' s k = signal_of (\\<sigma> s) \\<tau>''' s k\"\n    unfolding tw''_def using destruct_worldline_correctness[OF `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>''`]\n    by (metis (no_types, lifting) destruct_worldline_def)\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>''') \\<sigma> s\"\n    using destruct_worldline_ensure_non_stuttering[OF des2] by blast\n  have \"context_invariant t \\<sigma> \\<gamma> \\<theta>''' def \\<tau>'''\"\n    using worldline2_constructible[OF des2] by auto\n  obtain \\<tau>4 where tau3: \"t, \\<sigma>, \\<gamma>, \\<theta>''', def \\<turnstile> < s2, \\<tau>'''> \\<longrightarrow>\\<^sub>s \\<tau>4\" and\n    sig_trans: \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>4 s k = signal_of (\\<sigma> s) \\<tau>' s k\"\n    using helper[OF tau2 sig_beh sig_trans ]  \\<open>nonneg_delay s2\\<close> `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>''`\n    `context_invariant t \\<sigma> \\<gamma> \\<theta>''' def \\<tau>'''` `\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>'') \\<sigma> s`\n    `\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>''') \\<sigma> s` unfolding context_invariant_def\n    by auto\n  have \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = worldline2 t \\<sigma> \\<theta>''' def \\<tau>4\"\n    unfolding worldline2_def worldline_raw_def  using sig_beh sig_trans\n    by presburger\n  hence \"tw'', s2 \\<Rightarrow>\\<^sub>s tw'\"\n    using des2 tau3 `tw'= worldline2 t \\<sigma> \\<theta> def \\<tau>'` world_seq_exec.intros by fastforce\n  with `Q tw''` show \"R tw'\"\n    using assms(2) unfolding seq_hoare_valid2_def by blast\nqed\n\nlemma Bnull_sound_hoare2:\n  \"\\<turnstile> [P] Bnull [Q] \\<Longrightarrow> \\<Turnstile> [P] Bnull [Q]\"\n  by (smt BnullE_hoare2 seq_cases(1) seq_hoare_valid2_def world_seq_exec_cases worldline2_constructible)\n\nlemma Bguarded_hoare_valid2:\n  assumes \"\\<Turnstile> [\\<lambda>tw. P tw \\<and> (\\<exists>x. beval_world_raw2 tw g x \\<and>   bval_of x)] s1 [Q]\" and\n          \"\\<Turnstile> [\\<lambda>tw. P tw \\<and> (\\<exists>x. beval_world_raw2 tw g x \\<and> \\<not> bval_of x)] s2 [Q]\"\n  shows \"\\<Turnstile> [P] Bguarded g s1 s2 [Q]\"\n  unfolding seq_hoare_valid2_def\nproof (rule)+\n  fix tw  tw':: \"nat \\<times> 'a worldline_init\"\n  assume \"P tw \\<and> (tw, Bguarded g s1 s2 \\<Rightarrow>\\<^sub>s tw')\"\n  hence \"P tw\" and \"tw, Bguarded g s1 s2 \\<Rightarrow>\\<^sub>s tw'\" by auto\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    by (meson destruct_worldline_def)\n  hence \"fst tw = t\" and \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau> \" and \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    by(auto dest!: worldline2_constructible)\n  obtain \\<tau>' where \"t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bguarded g s1 s2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n    by (smt \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>tw, Bguarded g s1 s2 \\<Rightarrow>\\<^sub>s tw'\\<close> fst_conv\n    snd_conv world_seq_exec_cases)\n  hence \"tw' = worldline2 t \\<sigma> \\<theta> def \\<tau>'\"\n    using `tw, Bguarded g s1 s2 \\<Rightarrow>\\<^sub>s tw'` `destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)`\n    by (smt b_seq_exec_deterministic fst_conv snd_conv world_seq_exec_cases)\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n    using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> destruct_worldline_ensure_non_stuttering_hist_raw by blast\n  obtain x where \"beval_raw t \\<sigma> \\<gamma> \\<theta> def g x\" and \"is_Bv x\"\n    using \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bguarded g s1 s2 , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close>\n    by (meson seq_cases_bguarded val.disc(1))\n  have \"bval_of x \\<or> \\<not> bval_of x\"\n    by auto\n  moreover\n  { assume \"bval_of x\"\n    hence \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < s1, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n      using `t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <Bguarded g s1 s2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'`\n      \\<open>is_Bv x\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> g \\<longrightarrow>\\<^sub>b x\\<close> beval_raw_deterministic val.collapse(1)\n      by (metis seq_cases_bguarded val.inject(1))\n    hence \"beval_world_raw2 tw g x\"\n      using `beval_raw t \\<sigma> \\<gamma> \\<theta> def g x` `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>` `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>`\n      by (simp add: \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\\<close> beval_beval_world_raw_ci\n      beval_world_raw2_def worldline2_def)\n    have \"tw , s1 \\<Rightarrow>\\<^sub>s tw'\"\n      using `destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def ,\\<tau>)` `t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < s1, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'`\n      `tw' = worldline2 t \\<sigma> \\<theta> def \\<tau>'` world_seq_exec.intros by blast\n    with assms(1) and `P tw` have \"Q tw'\"\n      using `beval_world_raw2 tw g x` `fst tw = t` unfolding seq_hoare_valid2_def\n      using \\<open>bval_of x\\<close> by blast }\n  moreover\n  { assume \"\\<not> bval_of x\"\n    hence \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < s2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n      using `t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <Bguarded g s1 s2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'`\n      using \\<open>is_Bv x\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> g \\<longrightarrow>\\<^sub>b x\\<close> beval_raw_deterministic val.collapse(1)\n      by (metis seq_cases_bguarded val.inject(1))\n    have \"tw, s2 \\<Rightarrow>\\<^sub>s tw'\"\n      using `destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)` `t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < s2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'`\n      `tw' = worldline2 t \\<sigma> \\<theta> def \\<tau>'` world_seq_exec.intros by blast\n    with assms(2) and `P tw` have \"Q tw'\"\n      using `fst tw = t` unfolding seq_hoare_valid2_def\n      by (metis \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\\<close> \\<open>\\<not> bval_of x\\<close> \\<open>context_invariant t \\<sigma>\n      \\<gamma> \\<theta> def \\<tau>\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> g \\<longrightarrow>\\<^sub>b x\\<close> \\<open>tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\\<close>\n      beval_beval_world_raw_ci beval_world_raw2_def snd_conv worldline2_def) }\n  ultimately show \"Q tw'\"\n    by auto\nqed\n\nlemma lift_world_trans_worldline_upd2:\n  assumes \"tw, Bassign_trans sig exp dly \\<Rightarrow>\\<^sub>s tw'\"\n  assumes \"0 < dly\"\n  shows \"\\<exists>x. beval_world_raw2 tw exp x \\<and> tw' = tw[sig, dly :=\\<^sub>2 x]\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    by (meson destruct_worldline_def)\n  hence \"fst tw = t\" and w_def: \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau> \" and \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    by(auto dest!: worldline2_constructible)\n  hence \"\\<forall>i<fst tw. \\<tau> i = 0\"\n    unfolding context_invariant_def by auto\n  obtain x where \"beval_raw t \\<sigma> \\<gamma> \\<theta> def exp x\"\n    by (smt \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>tw, Bassign_trans sig exp dly \\<Rightarrow>\\<^sub>s tw'\\<close>\n    fst_conv seq_cases_trans snd_conv world_seq_exec_cases)\n  then obtain \\<tau>' where \"t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_trans sig exp dly, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n    and \"\\<tau>' = trans_post_raw sig x (\\<sigma> sig) \\<tau> t dly\"\n    by (simp add: b_seq_exec.intros(5))\n  moreover have \"beval_raw t \\<sigma> \\<gamma> \\<theta> def exp = beval_world_raw2 tw exp\"\n    using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau> ` and `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>`\n    by (metis \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>get_time tw = t\\<close>\n    beval_beval_world_raw_ci beval_world_raw2_def destruct_worldline_ensure_non_stuttering_hist_raw\n    snd_conv worldline2_def)\n  ultimately have \\<tau>'_def: \"\\<tau>' = trans_post_raw sig x (\\<sigma> sig) \\<tau> t dly\"\n    by auto\n  have \"tw' = (worldline2 t \\<sigma> \\<theta> def \\<tau>')\"\n    using `tw, Bassign_trans sig exp dly \\<Rightarrow>\\<^sub>s tw'` `destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)`\n    \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_trans sig exp dly , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close>\n    by (smt b_seq_exec_deterministic old.prod.inject world_seq_exec_cases)\n  also have \"... = tw[sig, dly:=\\<^sub>2 x]\"\n    using w_def \\<tau>'_def `0 < dly` lift_trans_post_worldline_upd[where \\<sigma>=\"\\<sigma>\" and t=\"fst tw\" and \\<tau>=\"\\<tau>\"]\n    `\\<forall>i<fst tw. \\<tau> i = 0`\n    by (metis \\<open>beval_raw t \\<sigma> \\<gamma> \\<theta> def exp = beval_world_raw2 tw exp\\<close> \\<open>get_time tw = t\\<close> \\<open>t , \\<sigma> , \\<gamma> ,\n    \\<theta>, def \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\\<close> beval_world_raw2_def prod.sel(2) worldline2_def worldline_upd2_def)\n  finally have \"tw' = tw[sig, dly:=\\<^sub>2 x]\"\n    using `fst tw = t` by auto\n  thus ?thesis\n    using \\<open>beval_raw t \\<sigma> \\<gamma> \\<theta> def exp = beval_world_raw2 tw exp\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\\<close>\n    by auto\nqed\n\nlemma Bassign_trans_sound_hoare2:\n  \"0 < dly \\<Longrightarrow> \\<turnstile> [P] Bassign_trans sig exp dly [Q] \\<Longrightarrow> \\<Turnstile> [P] Bassign_trans sig exp dly [Q]\"\n  unfolding seq_hoare_valid2_def\nproof rule+\n  fix tw tw' :: \"nat \\<times> 'a worldline_init\"\n  assume \"0 < dly\"\n  assume \"\\<turnstile> [P] Bassign_trans sig exp dly [Q]\"\n  hence imp: \"\\<forall>tw x. P tw \\<and> beval_world_raw2 tw exp x \\<longrightarrow> Q( tw[sig, dly :=\\<^sub>2 x])\"\n    by (auto dest!: BassignE_hoare2)\n  assume \" P tw \\<and> (tw, Bassign_trans sig exp dly \\<Rightarrow>\\<^sub>s tw')\"\n  hence \"P tw\" and \"tw, Bassign_trans sig exp dly \\<Rightarrow>\\<^sub>s tw'\" by auto\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and \"fst tw = t\"\n    by (metis (no_types, lifting) destruct_worldline_def)\n  obtain \\<tau>' where \"t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_trans sig exp dly, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n    by (smt \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>tw, Bassign_trans sig exp dly \\<Rightarrow>\\<^sub>s tw'\\<close> fst_conv snd_conv world_seq_exec_cases)\n  hence \"tw' = worldline2 t \\<sigma> \\<theta> def \\<tau>'\"\n    using `tw, Bassign_trans sig exp dly \\<Rightarrow>\\<^sub>s tw'` `destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)`\n    \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_trans sig exp dly , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close>\n    by (smt b_seq_exec_deterministic fst_conv snd_conv world_seq_exec_cases)\n  hence \"fst tw' = t\"\n    by transfer'  auto\n  obtain x where \"beval_world_raw2 tw exp x\"\n    using \\<open>P tw\\<close> imp\n    by (meson \\<open>0 < dly\\<close> \\<open>tw, Bassign_trans sig exp dly \\<Rightarrow>\\<^sub>s tw'\\<close> lift_world_trans_worldline_upd2)\n  hence \"tw' = tw[sig, dly :=\\<^sub>2 x]\"\n    unfolding `tw' = worldline2 t \\<sigma> \\<theta> def \\<tau>'` using `fst tw = t` `0 < dly`\n    by (metis \\<open>tw' = worldline2 t \\<sigma> \\<theta> def \\<tau>'\\<close> \\<open>tw, Bassign_trans sig exp dly \\<Rightarrow>\\<^sub>s tw'\\<close>\n    beval_world_raw2_def beval_world_raw_deterministic lift_world_trans_worldline_upd2)\n  with imp and `P tw` have \"Q(tw[sig, dly :=\\<^sub>2 x])\"\n    using `fst tw = t`\n    by (metis (full_types) \\<open>beval_world_raw2 tw exp x\\<close> beval_world_raw2_def beval_world_raw_deterministic)\n  thus \"Q tw'\"\n    using `tw' = tw[sig, dly :=\\<^sub>2 x]`\n    `fst tw = t` surjective_pairing[of \"tw'\"]  `fst tw' = t` by auto\nqed\n\nlemma lift_world_inert_worldline_upd2:\n  assumes \"tw, Bassign_inert sig exp dly \\<Rightarrow>\\<^sub>s tw'\"\n  assumes \"0 < dly\"\n  shows \"\\<exists>x. beval_world_raw2 tw exp x \\<and> tw' = tw\\<lbrakk>sig, dly :=\\<^sub>2 x\\<rbrakk>\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    by (meson destruct_worldline_def)\n  hence \"fst tw = t\" and w_def: \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau> \" and \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    by(auto dest!: worldline2_constructible)\n  obtain x where \"beval_raw t \\<sigma> \\<gamma> \\<theta> def exp x\"\n    by (smt \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> assms(1) fst_conv seq_cases_inert snd_conv\n    world_seq_exec_cases)\n  then obtain \\<tau>' where \"t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_inert sig exp dly, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\" and \"\\<tau>' = inr_post_raw' sig x (\\<sigma> sig) \\<tau> t dly\"\n    by (simp add: b_seq_exec.intros(6))\n  have \"beval_raw t \\<sigma> \\<gamma> \\<theta> def exp = beval_world_raw2 tw exp\"\n    using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau> ` and `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>`\n    by (metis \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>get_time tw = t\\<close>\n    beval_beval_world_raw_ci beval_world_raw2_def destruct_worldline_ensure_non_stuttering_hist_raw\n    snd_conv worldline2_def)\n  have \"non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> sig\"\n    using destruct_worldline_ensure_non_stuttering[OF `destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)`]\n    by auto\n  have \"tw' = (worldline2 t \\<sigma> \\<theta> def \\<tau>')\"\n    using `tw, Bassign_inert sig exp dly \\<Rightarrow>\\<^sub>s tw'` `destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)`\n    \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_inert sig exp dly , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close>\n    by (smt b_seq_exec_deterministic fst_conv snd_conv world_seq_exec_cases)\n  also have \"... = tw\\<lbrakk>sig, dly:=\\<^sub>2 x\\<rbrakk>\"\n    using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>` `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>`\n    `t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_inert sig exp dly, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'` `0 < dly`\n    lift_inr_post_worldline_upd[OF _ _ `t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_inert sig exp dly, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'` _\n    `non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> sig`]\n    by (metis \\<open>beval_raw t \\<sigma> \\<gamma> \\<theta> def exp = beval_world_raw2 tw exp\\<close> \\<open>destruct_worldline tw = (t, \\<sigma>,\n    \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>get_time tw = t\\<close> \\<open>non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> sig\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def\n    \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\\<close> beval_world_raw2_def destruct_worldline_ensure_non_stuttering_hist_raw\n    lift_inr_post_worldline_upd_comb snd_conv worldline2_def worldline_inert_upd2_def)\n  finally show ?thesis\n    using `fst tw = t`\n    \\<open>beval_raw t \\<sigma> \\<gamma> \\<theta> def exp = beval_world_raw2 tw exp\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\\<close> by auto\nqed\n\nlemma Bassign_inert_sound_hoare2:\n  assumes \"0 < dly\"\n  shows \"\\<turnstile> [P] Bassign_inert sig exp dly [Q] \\<Longrightarrow> \\<Turnstile> [P] Bassign_inert sig exp dly [Q]\"\n  unfolding seq_hoare_valid2_def\nproof rule+\n  fix tw tw' :: \"nat \\<times> 'a worldline_init\"\n  assume \"\\<turnstile> [P] Bassign_inert sig exp dly [Q]\"\n  hence imp: \"\\<forall>tw x. P tw \\<and> beval_world_raw2 tw exp x \\<longrightarrow> Q(tw \\<lbrakk>sig, dly :=\\<^sub>2 x\\<rbrakk>)\"\n    by (auto dest!: Bassign_inertE_hoare2)\n  assume \"P tw \\<and> (tw, Bassign_inert sig exp dly \\<Rightarrow>\\<^sub>s tw')\"\n  hence \"P tw\" and \"tw, (Bassign_inert sig exp dly) \\<Rightarrow>\\<^sub>s tw'\" by auto\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and \"fst tw = t\"\n    by (metis (no_types, lifting) destruct_worldline_def)\n  obtain \\<tau>' where \"t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_inert sig exp dly, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n    by (smt \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>tw, Bassign_inert sig exp dly \\<Rightarrow>\\<^sub>s tw'\\<close>\n    fst_conv snd_conv world_seq_exec_cases)\n  hence \"tw' = (worldline2 t \\<sigma> \\<theta> def \\<tau>')\"\n    using `tw, Bassign_inert sig exp dly \\<Rightarrow>\\<^sub>s tw'` `destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)`\n    using \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_inert sig exp dly , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close>\n    by (smt b_seq_exec_deterministic fst_conv snd_conv world_seq_exec_cases)\n  hence \"fst tw' = t\"\n    by  auto\n  obtain x where \"beval_world_raw2 tw exp x\"\n    using \\<open>P tw\\<close> imp\n    by (meson \\<open>tw, Bassign_inert sig exp dly \\<Rightarrow>\\<^sub>s tw'\\<close> assms lift_world_inert_worldline_upd2)\n  hence \"tw' = tw\\<lbrakk>sig, dly :=\\<^sub>2 x\\<rbrakk>\"\n    by (metis \\<open>tw, Bassign_inert sig exp dly \\<Rightarrow>\\<^sub>s tw'\\<close> assms beval_world_raw2_def\n    beval_world_raw_deterministic lift_world_inert_worldline_upd2)\n  with imp and `P tw` have \"Q(tw\\<lbrakk>sig, dly :=\\<^sub>2 x\\<rbrakk>)\"\n    using `fst tw = t`\n    by (metis (full_types) \\<open>beval_world_raw2 tw exp x\\<close> beval_world_raw2_def\n    beval_world_raw_deterministic)\n  thus \"Q tw'\"\n    using `tw' = tw \\<lbrakk> sig, dly :=\\<^sub>2 x\\<rbrakk>` `fst tw = t` `fst tw' = t`\n    surjective_pairing[of \"tw'\"] by auto\nqed\n\nsubsubsection \\<open>Soundness and completeness\\<close>\n\nlemma bcase_others_tw_elim:\n  \"\\<And>tw tw'.  tw, Bcase exp ((Others, ss) # choices) \\<Rightarrow>\\<^sub>s tw' \\<Longrightarrow> tw, ss \\<Rightarrow>\\<^sub>s tw'\"\nproof -\n  fix tw tw'\n  assume \"tw, Bcase exp ((Others, ss) # choices) \\<Rightarrow>\\<^sub>s tw'\"\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n                                exe: \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def (Bcase exp ((Others, ss) # choices)) \\<tau> \\<tau>'\" and\n                                con: \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n    apply (rule world_seq_exec_cases[OF \\<open>tw, Bcase exp ((Others, ss) # choices)  \\<Rightarrow>\\<^sub>s tw'\\<close>])\n    by auto\n  hence \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def ss \\<tau> \\<tau>'\"\n    using exe seq_cases_bcase by fastforce\n  thus \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n    using des con by (auto intro!: world_seq_exec.intros)\nqed\n\nlemma soundness_hoare2:\n  assumes \"\\<turnstile> [P] s [R]\"\n  assumes \"nonneg_delay s\"\n  shows \"\\<Turnstile> [P] s [R]\"\n  using assms\nproof (induction rule:seq_hoare2.induct)\n  case (If2 g P s1 Q s2)\n  hence If1: \" \\<Turnstile> [\\<lambda>a. g a \\<and> beval_world_raw2 a P (Bv True)] s1 [Q]\" and\n        If2: \" \\<Turnstile> [\\<lambda>a. g a \\<and> beval_world_raw2 a P (Bv False)] s2 [Q]\"\n    by auto\n  show ?case\n    unfolding seq_hoare_valid2_def\n  proof (rule, rule, rule)\n    fix tw tw'\n    assume \"g tw \\<and> tw, Bguarded P s1 s2 \\<Rightarrow>\\<^sub>s tw'\"\n    hence \"g tw\" and \"tw, Bguarded P s1 s2 \\<Rightarrow>\\<^sub>s tw'\"\n      by auto\n    have \"beval_world_raw2 tw P (Bv True) \\<or> beval_world_raw2 tw P (Bv False)\"\n      by (smt \\<open>tw, Bguarded P s1 s2 \\<Rightarrow>\\<^sub>s tw'\\<close> beval_beval_world_raw_ci beval_world_raw2_def\n      destruct_worldline_ensure_non_stuttering_hist_raw fst_conv seq_cases_bguarded snd_conv\n      world_seq_exec_cases worldline2_constructible worldline2_def)\n    moreover\n    { assume \"beval_world_raw2 tw P (Bv True)\"\n      hence \"tw, s1 \\<Rightarrow>\\<^sub>s tw'\"\n        using \\<open>tw, Bguarded P s1 s2 \\<Rightarrow>\\<^sub>s tw'\\<close>\n        by (smt beval_beval_world_raw_ci beval_world_raw2_def beval_world_raw_deterministic\n        destruct_worldline_ensure_non_stuttering_hist_raw fst_conv seq_cases_bguarded snd_conv\n        val.inject(1) world_seq_exec.intros world_seq_exec_cases worldline2_constructible\n        worldline2_def)\n      hence \"Q tw'\"\n        using If1 \\<open>g tw\\<close> unfolding seq_hoare_valid2_def\n        using \\<open>beval_world_raw2 tw P (Bv True)\\<close> by blast }\n    moreover\n    { assume \"beval_world_raw2 tw P (Bv False)\"\n      hence \"tw, s2 \\<Rightarrow>\\<^sub>s tw'\"\n        by (smt \\<open>tw, Bguarded P s1 s2 \\<Rightarrow>\\<^sub>s tw'\\<close> beval_beval_world_raw_ci beval_world_raw2_def\n        beval_world_raw_deterministic destruct_worldline_ensure_non_stuttering_hist_raw fst_conv\n        seq_cases_bguarded snd_conv val.inject(1) world_seq_exec.intros world_seq_exec_cases\n        worldline2_constructible worldline2_def)\n      hence \"Q tw'\"\n        using If2 \\<open>g tw\\<close> \\<open>beval_world_raw2 tw P (Bv False)\\<close> unfolding seq_hoare_valid2_def by blast }\n    ultimately show \"Q tw'\"\n      by blast\n  qed\nnext\n  case (AssignI2 exp P sig dly)\n  hence \"0 < dly\" by auto\n  then show ?case\n    using Bassign_inert_sound_hoare2[OF `0 < dly`]  using seq_hoare2.AssignI2 by fastforce\nnext\n  case (Conseq2 P' P s Q Q')\n  then show ?case\n    by (smt seq_hoare_valid2_def)\nnext\n  case (Conj P s Q1 Q2)\n  then show ?case by (simp add: seq_hoare_valid2_def)\nnext\n  case (Bcase_empty_choices2 P exp)\n  then show ?case unfolding seq_hoare_valid2_def\n    by (smt b_seq_exec.intros(10) b_seq_exec_deterministic world_seq_exec.simps worldline2_constructible)\nnext\n  case (Bcase_others2 P ss Q exp choices)\n  hence \" \\<Turnstile> [P] ss [Q]\"\n    unfolding nonneg_delay.simps by auto\n  hence \"\\<forall>tw tw'. P tw \\<and> tw, ss \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw'\"\n    unfolding seq_hoare_valid2_def by auto\n  thus ?case\n    using bcase_others_tw_elim unfolding seq_hoare_valid2_def by blast\nnext\n  case (Bcase_if2 P exp exp' ss Q choices)\n  hence eq: \" \\<Turnstile> [\\<lambda>a. P a \\<and> (\\<exists>x. beval_world_raw2 a exp x \\<and> beval_world_raw2 a exp' x)] ss [Q]\"\n    and neq: \" \\<Turnstile> [\\<lambda>a. P a \\<and> (\\<exists>x x'. beval_world_raw2 a exp x \\<and> beval_world_raw2 a exp' x' \\<and> x \\<noteq> x')] Bcase exp choices [Q]\"\n    unfolding nonneg_delay.simps by auto\n  show ?case\n    unfolding seq_hoare_valid2_def\n  proof (rule)+\n    fix tw tw'\n    assume \"P tw \\<and> tw, Bcase exp ((Explicit exp', ss) # choices) \\<Rightarrow>\\<^sub>s tw'\"\n    hence \"P tw\" and \"tw, Bcase exp ((Explicit exp', ss) # choices) \\<Rightarrow>\\<^sub>s tw'\"\n      by auto\n    obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n                                  exe: \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def (Bcase exp ((Explicit exp', ss) # choices)) \\<tau> \\<tau>'\" and\n                                  con: \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n      by (rule world_seq_exec_cases[OF \\<open>tw, Bcase exp ((Explicit exp', ss) # choices) \\<Rightarrow>\\<^sub>s tw'\\<close>])\n    obtain x x' where bevalx: \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\" and bevalx': \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> exp' \\<longrightarrow>\\<^sub>b x'\"\n      by (rule seq_cases_bcase[OF exe]) blast+\n      have beval2x: \"beval_world_raw2 tw exp x\" and beval2x': \"beval_world_raw2 tw exp' x'\"\n        using bevalx bevalx' unfolding beval_world_raw2_def\n        by (metis beval_beval_world_raw_ci des destruct_worldline_ensure_non_stuttering_hist_raw\n        fst_conv snd_conv worldline2_constructible worldline2_def)+\n    have \"x = x' \\<or> x \\<noteq> x'\"\n      by auto\n    moreover\n    { assume \"x = x'\"\n      have \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def ss \\<tau> \\<tau>'\"\n        apply (rule seq_cases_bcase[OF exe, rotated])\n        using bevalx bevalx' \\<open>x = x'\\<close>\n        by (metis beval_raw_deterministic choices.sel fst_conv list.inject) blast+\n      hence \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n        by (smt con des world_seq_exec.intros)\n      with eq `P tw` have \"Q tw'\"\n        using beval2x beval2x'  unfolding \\<open>x = x'\\<close> seq_hoare_valid2_def by blast }\n    moreover\n    { assume \"x \\<noteq> x'\"\n      have \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def (Bcase exp choices) \\<tau> \\<tau>'\"\n        apply (rule seq_cases_bcase[OF exe])\n        using bevalx bevalx' \\<open>x \\<noteq> x'\\<close>\n        by (metis (mono_tags, hide_lams) beval_raw_deterministic choices.sel fst_conv\n            list.inject)blast+\n      hence \"tw, Bcase exp choices \\<Rightarrow>\\<^sub>s tw'\"\n        using con des world_seq_exec.intros by blast\n      with neq `P tw` have \"Q tw'\"\n        using beval2x beval2x' \\<open>x \\<noteq> x'\\<close> unfolding seq_hoare_valid2_def by blast }\n    ultimately show \"Q tw'\"\n      by auto\n  qed\nqed (auto simp add: Bnull_sound_hoare2 Bassign_trans_sound_hoare2 Bcomp_hoare_valid' Bguarded_hoare_valid2)\n\nlemma  world_seq_exec_bnull:\n  \"tw, Bnull \\<Rightarrow>\\<^sub>s tw\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    using prod_cases6 by blast\n  have seq: \" t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <Bnull , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>\"\n    by (intro b_seq_exec.intros)\n  have cons: \"worldline2 t \\<sigma> \\<theta> def \\<tau> = tw\"\n    using worldline2_constructible[OF des] by auto\n  show ?thesis\n    by (intro world_seq_exec.intros)(rule des, rule seq, rule cons)\nqed\n\nlemma world_seq_exec_comp':\n  assumes \"nonneg_delay (Bcomp ss1 ss2)\"\n  assumes \"tw, ss1 \\<Rightarrow>\\<^sub>s tw''\"\n  assumes \"tw'', ss2 \\<Rightarrow>\\<^sub>s tw'\"\n  assumes \"tw, (Bcomp ss1 ss2) \\<Rightarrow>\\<^sub>s tw_res\"\n  shows \"tw_res = tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> \\<tau>' def where des1: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <Bcomp ss1 ss2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\" and ci1: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using destruct_worldline_exist worldline2_constructible\n    by (smt assms(4) world_seq_exec_cases)\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    using destruct_worldline_ensure_non_stuttering[OF des1] by auto\n  then obtain \\<tau>'' where \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss1, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>''\" and exec1: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss2, \\<tau>''> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n    and ci2: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>''\" using b_seq_exec_preserves_context_invariant\n    using assms \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bcomp ss1 ss2 , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close> ci1\n    by (metis nonneg_delay.simps(2) seq_cases_bcomp)\n  hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>'') \\<sigma> s\"\n    using b_seq_exec_preserves_non_stuttering\n    by (metis \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\\<close> assms ci1 context_invariant_def\n    nonneg_delay.simps(2))\n  hence *: \"world_seq_exec tw ss1 (worldline2 t \\<sigma> \\<theta> def \\<tau>'')\"\n    using des1 \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> < ss1 , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>''\\<close> world_seq_exec.intros by blast\n  obtain \\<theta>2 \\<tau>2 \\<tau>3 where des2: \"destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>'') = (t, \\<sigma>, \\<gamma>, \\<theta>2, def, \\<tau>2)\" and\n    beh_same:\"\\<And>s k. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>2 s k\" and\n    trans_same: \"\\<And>s k. signal_of (\\<sigma> s) \\<tau>'' s k = signal_of (\\<sigma> s) \\<tau>2 s k\" and\n    exec2: \"t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss2, \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>3\"\n    using destruct_worldline_correctness[OF ci2]\n    by (smt \"*\" assms(2) assms(3) b_seq_exec_deterministic fst_conv snd_conv world_seq_exec_cases)\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n    using destruct_worldline_ensure_non_stuttering[OF des2] by blast\n  have ci3: \"context_invariant t \\<sigma> \\<gamma> \\<theta>2 def \\<tau>2\"\n    using worldline2_constructible[OF des2] by auto\n  have \"\\<And>s k. signal_of (\\<sigma> s) \\<tau>' s k = signal_of (\\<sigma> s) \\<tau>3 s k\"\n    using helper'[OF exec1 beh_same trans_same exec2] ci2 ci3\n    `\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>'') \\<sigma> s` `\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s`\n    unfolding context_invariant_def using assms by auto\n  hence \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = worldline2 t \\<sigma> \\<theta>2 def \\<tau>3\"\n    using beh_same unfolding worldline2_def worldline_raw_def\n    by presburger\n  hence \"world_seq_exec (worldline2 t \\<sigma> \\<theta> def \\<tau>'') ss2 (worldline2 t \\<sigma> \\<theta>2 def \\<tau>3)\"\n    using des2 `t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss2, \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>3`\n    using world_seq_exec.intros by blast\n  hence \"world_seq_exec (worldline2 t \\<sigma> \\<theta> def \\<tau>'') ss2 (worldline2 t \\<sigma> \\<theta> def \\<tau>')\"\n    by (simp add: \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>' = worldline2 t \\<sigma> \\<theta>2 def \\<tau>3\\<close>)\n  thus ?thesis\n    using des1 `t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <Bcomp ss1 ss2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'` unfolding  *\n    by (smt \"*\" assms(2-4) b_seq_exec_deterministic fst_conv snd_conv world_seq_exec_cases)\nqed\n\nlemma world_seq_exec_comp_exist:\n  assumes \"nonneg_delay (Bcomp ss1 ss2)\"\n  assumes \"tw  , ss1 \\<Rightarrow>\\<^sub>s tw''\"\n  assumes \"tw'', ss2 \\<Rightarrow>\\<^sub>s tw'\"\n  shows   \"\\<exists>tw_res. tw, (Bcomp ss1 ss2) \\<Rightarrow>\\<^sub>s tw_res\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> \\<tau>'' def where des1: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss1, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>''\" and ci1: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\" and\n    \"tw'' = worldline2 t \\<sigma> \\<theta> def \\<tau>''\"\n    by (smt assms(2) world_seq_exec_cases worldline2_constructible)\n  moreover have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>''\"\n    using assms(1) b_seq_exec_preserves_context_invariant calculation(2) ci1 nonneg_delay.simps(2)\n    by blast\n  moreover have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    using des1 destruct_worldline_ensure_non_stuttering by blast\n  moreover hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>'') \\<sigma> s\"\n    using b_seq_exec_preserves_non_stuttering[OF `t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss1, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>''`]\n    using assms(1) des1 destruct_worldline_trans_zero_upto_now nonneg_delay.simps(2) by blast\n  moreover have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n    using des1 destruct_worldline_ensure_non_stuttering_hist_raw by blast\n  ultimately have \"destruct_worldline tw'' = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>'')\"\n    by (simp add: destruct_worldline_correctness3)\n  then obtain \\<tau>' where \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss2, \\<tau>''> \\<longrightarrow>\\<^sub>s \\<tau>'\" and cons: \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n    using assms(3)\n    by (smt fst_conv snd_conv world_seq_exec_cases)\n  hence *: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <Bcomp ss1 ss2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n    using \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> < ss1 , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>''\\<close> b_seq_exec.intros(2) by blast\n  thus ?thesis\n    apply (intro exI[where x=\"tw'\"])\n    apply (intro world_seq_exec.intros)\n      apply (rule des1)\n     apply (rule *)\n    apply (rule cons)\n    done\nqed\n\nlemma world_seq_exec_comp:\n  assumes \"nonneg_delay (Bcomp ss1 ss2)\"\n  assumes \"tw, ss1 \\<Rightarrow>\\<^sub>s tw''\"\n  assumes \"tw'', ss2 \\<Rightarrow>\\<^sub>s tw'\"\n  shows \"tw, (Bcomp ss1 ss2) \\<Rightarrow>\\<^sub>s tw'\"\n  using world_seq_exec_comp' world_seq_exec_comp_exist\n  using assms(1) assms(2) assms(3) by blast\n\nlemma world_seq_exec_guarded:\n  fixes tw :: \"nat \\<times> 'a worldline_init\"\n  assumes \"beval_world_raw2 tw g (Bv True)\"\n  assumes \"tw, ss1 \\<Rightarrow>\\<^sub>s tw'\"\n  shows \"world_seq_exec tw (Bguarded g ss1 ss2) tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> \\<tau>' def where des1: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    ex1: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss1, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\" and ci1: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\" and\n    \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\" and \"fst tw = t\"\n    using destruct_worldline_exist worldline2_constructible\n    by (smt assms(2) fst_conv fst_destruct_worldline world_seq_exec_cases)\n  have beval: \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> g \\<longrightarrow>\\<^sub>b Bv True\"\n    by (metis \\<open>get_time tw = t\\<close> \\<open>tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\\<close> assms(1) beval_beval_world_raw_ci\n    beval_world_raw2_def ci1 des1 destruct_worldline_ensure_non_stuttering_hist_raw sndI\n    worldline2_def)\n  have \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n    by (smt Pair_inject assms(2) b_seq_exec_deterministic des1 ex1 world_seq_exec_cases)\n  thus ?thesis\n    apply (intro world_seq_exec.intros)\n      apply (rule des1)\n     apply (intro b_seq_exec.intros)\n      apply (intro beval)\n     apply (rule ex1)\n    apply assumption\n    done\nqed\n\nlemma world_seq_exec_explicit_match:\n  assumes \"beval_world_raw2 tw exp x\" and \"beval_world_raw2 tw exp' x\"\n  assumes \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n  shows   \"world_seq_exec tw  (Bcase exp ((Explicit exp', ss) # choices)) tw'\"\n  using assms\n  by (smt b_seq_exec.intros(7) beval_beval_world_raw_ci beval_world_raw2_def\n  destruct_worldline_ensure_non_stuttering_hist_raw prod.sel(1) prod.sel(2) world_seq_exec.intros\n  world_seq_exec_cases worldline2_constructible worldline2_def)\n\nlemma world_seq_exec_explicit_no_match:\n  assumes \"beval_world_raw2 tw exp x\" and \"beval_world_raw2 tw exp' x'\" and \"x \\<noteq> x'\"\n  assumes \"tw, (Bcase exp choices) \\<Rightarrow>\\<^sub>s tw'\"\n  shows   \"world_seq_exec tw  (Bcase exp ((Explicit exp', ss) # choices)) tw'\"\n  using assms\n  by (smt b_seq_exec.intros(8) beval_beval_world_raw_ci beval_world_raw2_def\n  destruct_worldline_ensure_non_stuttering_hist_raw fst_conv snd_conv world_seq_exec.intros\n  world_seq_exec_cases worldline2_constructible worldline2_def)\n\nlemma world_seq_exec_guarded_not:\n  fixes tw :: \"nat \\<times> 'a worldline_init\"\n  assumes \"beval_world_raw2 tw g (Bv False)\"\n  assumes \"tw, ss2 \\<Rightarrow>\\<^sub>s tw'\"\n  shows \"world_seq_exec tw (Bguarded g ss1 ss2) tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> \\<tau>' def where des1: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    ex1: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\" and ci1: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\" and\n    \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\" and \"fst tw = t\"\n    using destruct_worldline_exist worldline2_constructible\n    by (smt assms(2) fst_conv fst_destruct_worldline world_seq_exec_cases)\n  have beval: \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> g \\<longrightarrow>\\<^sub>b Bv False\"\n    by (metis \\<open>tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\\<close> assms(1) beval_beval_world_raw_ci beval_world_raw2_def\n    ci1 des1 destruct_worldline_ensure_non_stuttering_hist_raw fst_conv sndI worldline2_def)\n  have \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n    by (smt Pair_inject assms(2) b_seq_exec_deterministic des1 ex1 world_seq_exec_cases)\n  thus ?thesis\n    apply (intro world_seq_exec.intros)\n      apply (rule des1)\n     apply (intro b_seq_exec.intros(4))\n      apply (intro beval)\n     apply (rule ex1)\n    apply assumption\n    done\nqed\n\nlemma world_seq_exec_trans:\n  assumes \"beval_world_raw2 tw exp x\"\n  assumes \"tw' = tw[sig, dly :=\\<^sub>2 x]\"\n  assumes \"0 < dly\"\n  shows   \"tw, Bassign_trans sig exp dly \\<Rightarrow>\\<^sub>s tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def where t_def: \"t = fst tw\" and  \\<sigma>_def: \"\\<sigma> = state_of_world (snd tw) t\" and\n    \\<gamma>_def: \"\\<gamma> = event_of_world (snd tw) t\" and  \\<theta>_def: \"\\<theta> = derivative_hist_raw (snd tw) t\" and\n    def_def: \"def = (fst o snd) tw\" and beval: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\"\n    using assms(1)   by (simp add: beval_world_raw.simps beval_world_raw2_def)\n  obtain \\<gamma>' \\<tau> where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>', \\<theta>, def, \\<tau>)\" and\n    \\<gamma>'_def: \"\\<gamma>' = {s. snd (snd tw) s (fst tw) \\<noteq> signal_of (fst (snd tw) s) (derivative_hist_raw (snd tw) (fst tw)) s (fst tw - 1)}\" and\n    \"\\<tau>  = derivative_raw (snd tw) (fst tw)\"\n    unfolding destruct_worldline_def Let_def t_def \\<sigma>_def state_of_world_def def_def \\<theta>_def by auto\n  have \"\\<gamma> = \\<gamma>'\"\n  proof (cases \"t = 0\")\n    case True\n    hence \"\\<gamma> =  {s. snd (snd tw) s t \\<noteq> fst (snd tw) s}\"\n      unfolding \\<gamma>_def event_of_world_def by auto\n    have \"derivative_hist_raw (snd tw) t = 0\"\n      unfolding derivative_hist_raw_def True zero_fun_def zero_option_def by auto\n    hence \"\\<And>s. signal_of (fst (snd tw) s) (derivative_hist_raw (snd tw) t) s (t - 1) = (fst (snd tw) s)\"\n      using signal_of_empty by fastforce\n    then show ?thesis\n      unfolding \\<gamma>_def \\<gamma>'_def event_of_world_def sym[OF t_def] True by auto\n  next\n    case False\n    hence \"\\<gamma> = {s. snd (snd tw) s t \\<noteq> snd (snd tw) s (t - 1)}\"\n      unfolding \\<gamma>_def event_of_world_def by auto\n    have \"\\<And>s. signal_of (get_time (snd tw) s) (derivative_hist_raw (snd tw) t) s (t - 1) = snd (snd tw) s (t - 1)\"\n      using signal_of_derivative_hist_raw2\n      by (metis False le_0_eq not_le_imp_less signal_of_derivative_hist_raw)\n    then show ?thesis\n      unfolding \\<gamma>_def \\<gamma>'_def event_of_world_def sym[OF t_def] using False\n      by auto\n  qed\n  hence \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>', \\<theta>, def, \\<tau>)\\<close> by blast\n  obtain \\<tau>' where \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <Bassign_trans sig exp dly, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\" and \"trans_post_raw sig x (\\<sigma> sig) \\<tau> t dly = \\<tau>'\"\n    using b_seq_exec.intros(5) beval by fastforce\n  hence \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n    by (metis \\<open>\\<gamma> = \\<gamma>'\\<close> \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>', \\<theta>, def, \\<tau>)\\<close> assms(2) assms(3) beval\n    beval_beval_world_raw_ci beval_raw_deterministic beval_world_raw2_def\n    destruct_worldline_ensure_non_stuttering_hist_raw lift_world_trans_worldline_upd2 snd_conv t_def\n    world_seq_exec.intros worldline2_constructible worldline2_def)\n  thus ?thesis\n    by (meson \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_trans\n    sig exp dly , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close> world_seq_exec.intros)\nqed\n\nlemma world_seq_exec_inert:\n  assumes \"beval_world_raw2 tw exp x\"\n  assumes \"tw' = tw\\<lbrakk>sig, dly :=\\<^sub>2 x\\<rbrakk>\"\n  assumes \"0 < dly\"\n  shows   \"tw, Bassign_inert sig exp dly \\<Rightarrow>\\<^sub>s tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def where t_def: \"t = fst tw\" and  \\<sigma>_def: \"\\<sigma> = state_of_world (snd tw) t\" and\n    \\<gamma>_def: \"\\<gamma> = event_of_world (snd tw) t\" and  \\<theta>_def: \"\\<theta> = derivative_hist_raw (snd tw) t\" and\n    def_def: \"def = (fst o snd) tw\" and beval: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\"\n    using assms(1)   by (simp add: beval_world_raw.simps beval_world_raw2_def)\n  obtain \\<gamma>' \\<tau> where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>', \\<theta>, def, \\<tau>)\" and\n    \\<gamma>'_def: \"\\<gamma>' = {s. snd (snd tw) s (fst tw) \\<noteq> signal_of (fst (snd tw) s) (derivative_hist_raw (snd tw) (fst tw)) s (fst tw - 1)}\" and\n    \"\\<tau>  = derivative_raw (snd tw) (fst tw)\"\n    unfolding destruct_worldline_def Let_def t_def \\<sigma>_def state_of_world_def def_def \\<theta>_def by auto\n  have \"\\<gamma> = \\<gamma>'\"\n  proof (cases \"t = 0\")\n    case True\n    hence \"\\<gamma> =  {s. snd (snd tw) s t \\<noteq> fst (snd tw) s}\"\n      unfolding \\<gamma>_def event_of_world_def by auto\n    have \"derivative_hist_raw (snd tw) t = 0\"\n      unfolding derivative_hist_raw_def True zero_fun_def zero_option_def by auto\n    hence \"\\<And>s. signal_of (fst (snd tw) s) (derivative_hist_raw (snd tw) t) s (t - 1) = (fst (snd tw) s)\"\n      using signal_of_empty by fastforce\n    then show ?thesis\n      unfolding \\<gamma>_def \\<gamma>'_def event_of_world_def sym[OF t_def] True by auto\n  next\n    case False\n    hence \"\\<gamma> = {s. snd (snd tw) s t \\<noteq> snd (snd tw) s (t - 1)}\"\n      unfolding \\<gamma>_def event_of_world_def by auto\n    have \"\\<And>s. signal_of (get_time (snd tw) s) (derivative_hist_raw (snd tw) t) s (t - 1) = snd (snd tw) s (t - 1)\"\n      using signal_of_derivative_hist_raw2\n      by (metis False le_0_eq not_le_imp_less signal_of_derivative_hist_raw)\n    then show ?thesis\n      unfolding \\<gamma>_def \\<gamma>'_def event_of_world_def sym[OF t_def] using False\n      by auto\n  qed\n  hence \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>', \\<theta>, def, \\<tau>)\\<close> by blast\n  obtain \\<tau>' where \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <Bassign_inert sig exp dly, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\" and \"inr_post_raw' sig x (\\<sigma> sig) \\<tau> t dly = \\<tau>'\"\n    using b_seq_exec.intros(6) beval by fastforce\n  hence \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n    by (metis \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> assms(1) assms(2) assms(3)\n    beval_world_raw2_deterministic lift_world_inert_worldline_upd2 world_seq_exec.intros)\n  thus ?thesis\n    by (meson \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <Bassign_inert\n    sig exp dly , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\\<close> world_seq_exec.intros)\nqed\n\ninductive world_seq_exec_alt :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal seq_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\" where\n  \"world_seq_exec_alt tw Bnull tw\"\n\n| \"world_seq_exec_alt tw ss1 tw'' \\<Longrightarrow> world_seq_exec_alt tw'' ss2  tw' \\<Longrightarrow> world_seq_exec_alt tw (Bcomp ss1 ss2) tw'\"\n\n| \"beval_world_raw2 tw g (Bv True) \\<Longrightarrow> world_seq_exec_alt tw ss1 tw' \\<Longrightarrow> world_seq_exec_alt tw (Bguarded g ss1 ss2) tw'\"\n\n| \"beval_world_raw2 tw g (Bv False) \\<Longrightarrow> world_seq_exec_alt tw ss2 tw' \\<Longrightarrow> world_seq_exec_alt tw (Bguarded g ss1 ss2) tw'\"\n\n| \"beval_world_raw2 tw exp x \\<Longrightarrow> tw' = tw[sig, dly :=\\<^sub>2 x] \\<Longrightarrow> world_seq_exec_alt tw (Bassign_trans sig exp dly) tw'\"\n\n| \"beval_world_raw2 tw exp x \\<Longrightarrow> tw' = tw\\<lbrakk> sig, dly :=\\<^sub>2 x\\<rbrakk> \\<Longrightarrow> world_seq_exec_alt tw (Bassign_inert sig exp dly) tw'\"\n\n| \"beval_world_raw2 tw exp x \\<Longrightarrow> beval_world_raw2 tw exp' x \\<Longrightarrow> world_seq_exec_alt tw ss tw' \\<Longrightarrow> world_seq_exec_alt tw (Bcase exp ((Explicit exp', ss) # choices)) tw'\"\n\n| \"beval_world_raw2 tw exp x \\<Longrightarrow> beval_world_raw2 tw exp' x' \\<Longrightarrow> x \\<noteq> x' \\<Longrightarrow> world_seq_exec_alt tw (Bcase exp choices) tw' \\<Longrightarrow> world_seq_exec_alt tw (Bcase exp ((Explicit exp', ss) # choices)) tw'\"\n\n| \"world_seq_exec_alt tw ss tw' \\<Longrightarrow> world_seq_exec_alt tw (Bcase exp ((Others, ss) # choices)) tw'\"\n\n| \"world_seq_exec_alt tw (Bcase exp []) tw\"\n\nlemma fst_world_seq_exec_alt:\n  assumes \"world_seq_exec_alt tw ss tw'\"\n  shows   \"fst tw = fst tw'\"\n  using assms\n  by (induction rule: world_seq_exec_alt.inducts)(auto simp add: worldline_upd2_def\n  worldline_inert_upd2_def)\n\nlemma world_seq_exec_alt_imp_world_seq_exec:\n  assumes \"world_seq_exec_alt tw ss tw'\"\n  assumes \"nonneg_delay ss\"\n  shows   \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n  using assms\nproof (induction rule:world_seq_exec_alt.induct)\n  case (7 tw exp x exp' ss tw' choices)\n  hence \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n    unfolding nonneg_delay.simps by auto\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n                                exe: \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def ss \\<tau> \\<tau>'\" and\n                                con: \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n    by (rule world_seq_exec_cases[OF \\<open>tw, ss \\<Rightarrow>\\<^sub>s tw'\\<close>])\n  have \" t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\" and \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> exp' \\<longrightarrow>\\<^sub>b x\"\n    using 7(1) 7(2) unfolding beval_world_raw2_def\n    by (metis (full_types) beval_beval_world_raw_ci des\n    destruct_worldline_ensure_non_stuttering_hist_raw fst_conv snd_conv worldline2_constructible\n    worldline2_def)+\n  hence \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def (Bcase exp ((Explicit exp', ss) # choices)) \\<tau> \\<tau>'\"\n    using exe by (intro b_seq_exec.intros)\n  thus ?case\n    using des con by (intro world_seq_exec.intros)\nnext\n  case (8 tw exp x exp' x' choices tw' ss)\n  hence \"tw, Bcase exp choices \\<Rightarrow>\\<^sub>s tw'\"\n    unfolding nonneg_delay.simps by auto\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n                                exe: \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def (Bcase exp choices) \\<tau> \\<tau>'\" and\n                                con: \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n    by (rule world_seq_exec_cases[OF \\<open>tw, Bcase exp choices \\<Rightarrow>\\<^sub>s tw'\\<close>])\n  have \" t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\" and \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> exp' \\<longrightarrow>\\<^sub>b x'\"\n    using 8(1) 8(2) unfolding beval_world_raw2_def\n    by (metis (full_types) beval_beval_world_raw_ci des\n    destruct_worldline_ensure_non_stuttering_hist_raw fst_conv snd_conv worldline2_constructible\n    worldline2_def)+\n  hence \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def (Bcase exp ((Explicit exp', ss) # choices)) \\<tau> \\<tau>'\"\n    using exe \\<open>x \\<noteq> x'\\<close> by (intro b_seq_exec.intros(8))\n  then show ?case\n    using des con by (intro world_seq_exec.intros)\nnext\n  case (9 tw ss tw' exp choices)\n  then show ?case\n    by (smt b_seq_exec.intros(9) list.simps(9) list_all_simps(1) nonneg_delay.simps(6) prod.sel(2)\n    world_seq_exec.intros world_seq_exec_cases)\nnext\n  case (10 tw exp)\n  then show ?case\n    by (metis (no_types, lifting) b_seq_exec.intros(10) destruct_worldline_def world_seq_exec.intros\n    worldline2_constructible)\nqed (auto simp add: world_seq_exec_bnull world_seq_exec_comp world_seq_exec_guarded\n     world_seq_exec_guarded_not world_seq_exec_trans world_seq_exec_inert)\n\nlemma world_seq_exec_imp_world_seq_exec_alt:\n  assumes \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n  assumes \"nonneg_delay ss\"\n  shows   \"world_seq_exec_alt tw ss tw'\"\n  using assms\nproof (induction rule:world_seq_exec.induct)\n  case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> s \\<tau>' tw')\n  show ?case\n    using 1(2) 1(1) 1(3-4)\n  proof (induction arbitrary: tw tw' rule: b_seq_exec.inducts)\n    case (1 t \\<sigma> \\<gamma> \\<theta> def \\<tau>)\n    then show ?case\n      using world_seq_exec_alt.intros(1) worldline2_constructible by blast\n  next\n    case (2 t \\<sigma> \\<gamma> \\<theta> def s1 \\<tau> \\<tau>'' s2 \\<tau>')\n    note prems = \"2.prems\"\n    obtain tw'' where tw''_def: \" tw'' = worldline2 t \\<sigma> \\<theta> def \\<tau>''\" and \"world_seq_exec_alt tw s1 tw''\"\n      using \"2.IH\"(1)[OF prems(1)] prems(3) unfolding nonneg_delay.simps by auto\n    have des2: \"destruct_worldline tw'' = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>'')\"\n      unfolding tw''_def\n    proof (rule destruct_worldline_correctness3)\n      show \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>''\"\n        using prems(1) \\<open>nonneg_delay (Bcomp s1 s2)\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> < s1 , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>''\\<close>\n        b_seq_exec_preserves_context_invariant worldline2_constructible\n        unfolding nonneg_delay.simps by blast\n    next\n      have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n        using destruct_worldline_ensure_non_stuttering  using prems(1) by blast\n      thus \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>'') \\<sigma> s\"\n        by (meson \"2.hyps\"(1) b_seq_exec_preserves_non_stuttering\n        destruct_worldline_trans_zero_upto_now nonneg_delay.simps(2) prems(1) prems(3))\n    next\n      show \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n        using prems(1) destruct_worldline_ensure_non_stuttering_hist_raw by blast\n    qed\n    have \" t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> < s2 , \\<tau>''> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n      using \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> < s1 , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>''\\<close> b_seq_exec_deterministic \"2.hyps\"(2)\n      by blast\n    have \"world_seq_exec_alt tw'' s2 (worldline2 t \\<sigma> \\<theta> def \\<tau>')\"\n      using \"2.IH\"(2)[OF des2] prems(3) by auto\n    then show ?case\n      using \\<open>world_seq_exec_alt tw s1 tw''\\<close> prems(2) world_seq_exec_alt.intros(2) by blast\n  next\n    case (3 t \\<sigma> \\<gamma> \\<theta> def x1 s1 \\<tau> \\<tau>' s2)\n    hence \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> < s1 , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n      using \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> x1 \\<longrightarrow>\\<^sub>b Bv True\\<close>  by (metis)\n    thus ?case\n      by (metis \"3.IH\" \"3.prems\"\n      \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> x1 \\<longrightarrow>\\<^sub>b Bv True\\<close> beval_beval_world_raw_ci beval_world_raw2_def\n      destruct_worldline_ensure_non_stuttering_hist_raw fst_conv nonneg_delay.simps(3) snd_conv\n      world_seq_exec_alt.intros(3) worldline2_constructible worldline2_def)\n  next\n    case (4 t \\<sigma> \\<gamma> \\<theta> def x1 s2 \\<tau> \\<tau>' s1)\n    hence \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < s2, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n      using \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> x1 \\<longrightarrow>\\<^sub>b Bv False\\<close> by (metis)\n    thus ?case\n      by (metis \"4.IH\" \"4.prems\" \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> x1 \\<longrightarrow>\\<^sub>b Bv False\\<close> beval_beval_world_raw_ci beval_world_raw2_def\n      destruct_worldline_ensure_non_stuttering_hist_raw fst_conv nonneg_delay.simps(3) snd_conv\n      world_seq_exec_alt.intros(4) worldline2_constructible worldline2_def)\n  next\n    case (5 t \\<sigma> \\<gamma> \\<theta> def e x sig \\<tau> dly \\<tau>')\n    then show ?case\n      by (metis b_seq_exec.intros(5) lift_world_trans_worldline_upd2 nonneg_delay.simps(4)\n      world_seq_exec.intros world_seq_exec_alt.intros(5))\n  next\n    case (6 t \\<sigma> \\<gamma> \\<theta> def e x sig \\<tau> dly \\<tau>')\n    then show ?case\n      by (metis b_seq_exec.intros(6) lift_world_inert_worldline_upd2 nonneg_delay.simps(5)\n      world_seq_exec.intros world_seq_exec_alt.intros(6))\n  next\n    case (7 t \\<sigma> \\<gamma> \\<theta> def exp x exp' ss \\<tau> \\<tau>' choices)\n    hence \"world_seq_exec_alt tw ss tw'\"\n      unfolding nonneg_delay.simps by auto\n    have \"state_of_world (snd tw) (get_time tw) = \\<sigma>\"\n      using \"7.prems\" unfolding destruct_worldline_def Let_def state_of_world_def by auto\n    moreover have \"derivative_hist_raw (snd tw) (get_time tw) = \\<theta>\"\n      using \"7.prems\" unfolding destruct_worldline_def Let_def by auto\n    moreover have \"event_of_world (snd tw) (get_time tw) = \\<gamma>\"\n    proof (cases \"0 < fst tw\")\n      case True\n      fix s\n      have \"snd (snd tw) s t = \\<sigma> s\"\n        using `state_of_world (snd tw) (fst tw) = \\<sigma>` unfolding state_of_world_def\n        by (metis \"7.prems\"(1) fst_conv fst_destruct_worldline)\n      moreover have \"snd (snd tw) s (fst tw - 1) = signal_of (def s) \\<theta> s (fst tw - 1)\"\n        unfolding worldline_raw_def using True\n        by (metis (mono_tags, lifting) \"7.prems\"(1) \\<open>derivative_hist_raw (snd tw) (get_time tw) = \\<theta>\\<close>\n        destruct_worldline_correctness(6) destruct_worldline_def diff_less\n        signal_of_derivative_hist_raw worldline2_constructible zero_less_one)\n      ultimately show ?thesis\n        unfolding event_of_world_def\n        using True\n        by (metis (mono_tags, lifting) \"7.prems\"(1) Collect_cong Pair_inject destruct_worldline_def\n        diff_less less_numeral_extra(3) signal_of_derivative_hist_raw zero_less_one)\n    next\n      case False\n      hence \"fst tw = 0\" by auto\n      hence ev: \"event_of_world (snd tw) (fst tw) = {s. snd (snd tw) s 0 \\<noteq> def s}\"\n        unfolding event_of_world_def\n        by (metis (mono_tags, lifting) \"7.prems\"(1) Collect_cong destruct_worldline_correctness(6)\n        destruct_worldline_def worldline2_constructible)\n      have \\<gamma>_def': \"\\<gamma> = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s 0}\"\n        using `fst tw = 0`\n        by (metis (no_types, lifting) \"7.prems\"(1) Collect_cong One_nat_def calculation(2)\n        destruct_worldline_correctness(2) destruct_worldline_correctness(3)\n        destruct_worldline_correctness(6) destruct_worldline_def diff_is_0_eq' le_add2 plus_1_eq_Suc\n        worldline2_constructible)\n      have \"\\<theta> = 0\"\n        unfolding `fst tw = 0` zero_fun_def\n        by (metis \\<open>get_time tw = 0\\<close> calculation(2) derivative_hist_raw_def zero_option_def\n        zero_order(1))\n      hence \"\\<And>s. signal_of (def s) \\<theta> s 0 = def s\"\n        using signal_of_empty by metis\n      hence \"\\<gamma> = {s. \\<sigma> s \\<noteq> def s}\"\n        using \\<gamma>_def' by auto\n      moreover have \"\\<And>s.  snd (snd tw) s 0 = \\<sigma> s\"\n        using `state_of_world (snd tw) (fst tw) = \\<sigma>` `fst tw = 0` unfolding state_of_world_def by auto\n      ultimately  have \"\\<gamma> = {s. snd (snd tw) s 0 \\<noteq> def s}\"\n        by auto\n      thus ?thesis  using ev by auto\n    qed\n    ultimately have \"beval_world_raw2 tw exp x\"\n      unfolding beval_world_raw2_def\n      by (metis (mono_tags, lifting) \"7.hyps\"(1) \"7.prems\"(1) beval_world_raw.simps\n          destruct_worldline_def old.prod.inject)\n    have \"beval_world_raw2 tw exp' x\"\n      unfolding beval_world_raw2_def\n      by (metis (mono_tags, lifting) \"7.hyps\"(2) \"7.prems\"(1) Pair_inject \\<open>event_of_world (snd tw)\n      (get_time tw) = \\<gamma>\\<close> \\<open>state_of_world (snd tw) (get_time tw) = \\<sigma>\\<close> beval_world_raw.simps\n      destruct_worldline_def)\n    thus ?case\n      using \\<open>beval_world_raw2 tw exp x\\<close> \\<open>world_seq_exec_alt tw ss tw'\\<close> world_seq_exec_alt.intros(7)\n      by blast\n  next\n    case (8 t \\<sigma> \\<gamma> \\<theta> def exp x exp' x' choices \\<tau> \\<tau>' ss)\n    hence \"world_seq_exec_alt tw (Bcase exp choices) tw'\"\n      unfolding nonneg_delay.simps by auto\n    have \"state_of_world (snd tw) (get_time tw) = \\<sigma>\"\n      using \"8.prems\" unfolding destruct_worldline_def Let_def state_of_world_def by auto\n    have \"derivative_hist_raw (snd tw) (get_time tw) = \\<theta>\"\n      using \"8.prems\" unfolding destruct_worldline_def Let_def by auto\n    have \"event_of_world (snd tw) (get_time tw) = \\<gamma>\"\n    proof (cases \"0 < fst tw\")\n      case True\n      fix s\n      have \"snd (snd tw) s t = \\<sigma> s\"\n        using `state_of_world (snd tw) (fst tw) = \\<sigma>` unfolding state_of_world_def\n        by (metis \"8.prems\"(1) fst_conv fst_destruct_worldline)\n      moreover have \"snd (snd tw) s (fst tw - 1) = signal_of (def s) \\<theta> s (fst tw - 1)\"\n        unfolding worldline_raw_def using True\n        by (metis (mono_tags, lifting) \"8.prems\"(1) \\<open>derivative_hist_raw (snd tw) (get_time tw) = \\<theta>\\<close>\n        destruct_worldline_correctness(6) destruct_worldline_def diff_less\n        signal_of_derivative_hist_raw worldline2_constructible zero_less_one)\n      ultimately show ?thesis\n        unfolding event_of_world_def\n        using True\n        by (metis (mono_tags, lifting) \"8.prems\"(1) Collect_cong Pair_inject destruct_worldline_def\n        diff_less less_numeral_extra(3) signal_of_derivative_hist_raw zero_less_one)\n    next\n      case False\n      hence \"fst tw = 0\" by auto\n      hence ev: \"event_of_world (snd tw) (fst tw) = {s. snd (snd tw) s 0 \\<noteq> def s}\"\n        unfolding event_of_world_def\n        by (metis (mono_tags, lifting) \"8.prems\"(1) Collect_cong destruct_worldline_correctness(6)\n        destruct_worldline_def worldline2_constructible)\n      have \\<gamma>_def': \"\\<gamma> = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s 0}\"\n        using `fst tw = 0`\n        by (metis (no_types, lifting) \"8.prems\"(1) Collect_cong One_nat_def\n        \\<open>derivative_hist_raw (snd tw) (get_time tw) = \\<theta>\\<close>\n        destruct_worldline_correctness(2) destruct_worldline_correctness(3)\n        destruct_worldline_correctness(6) destruct_worldline_def diff_is_0_eq' le_add2 plus_1_eq_Suc\n        worldline2_constructible)\n      have \"\\<theta> = 0\"\n        unfolding `fst tw = 0` zero_fun_def\n        by (metis \\<open>get_time tw = 0\\<close> \\<open>derivative_hist_raw (snd tw) (get_time tw) = \\<theta>\\<close>\n        derivative_hist_raw_def zero_option_def zero_order(1))\n      hence \"\\<And>s. signal_of (def s) \\<theta> s 0 = def s\"\n        using signal_of_empty by metis\n      hence \"\\<gamma> = {s. \\<sigma> s \\<noteq> def s}\"\n        using \\<gamma>_def' by auto\n      moreover have \"\\<And>s.  snd (snd tw) s 0 = \\<sigma> s\"\n        using `state_of_world (snd tw) (fst tw) = \\<sigma>` `fst tw = 0` unfolding state_of_world_def by auto\n      ultimately  have \"\\<gamma> = {s. snd (snd tw) s 0 \\<noteq> def s}\"\n        by auto\n      thus ?thesis  using ev by auto\n    qed\n    have \"beval_world_raw2 tw exp x\"\n      unfolding beval_world_raw2_def\n      by (metis (no_types, lifting) \"8.hyps\"(1) \"8.prems\"(1) \\<open>derivative_hist_raw (snd tw) (get_time\n      tw) = \\<theta>\\<close> \\<open>event_of_world (snd tw) (get_time tw) = \\<gamma>\\<close> \\<open>state_of_world (snd tw) (get_time tw) =\n      \\<sigma>\\<close> beval_world_raw.intros destruct_worldline_correctness(6) destruct_worldline_def fst_conv\n      worldline2_constructible)\n    have \"beval_world_raw2 tw exp' x'\"\n      unfolding beval_world_raw2_def\n      by (metis (no_types, lifting) \"8.hyps\"(2) \"8.prems\"(1) \\<open>derivative_hist_raw (snd tw) (get_time\n      tw) = \\<theta>\\<close> \\<open>event_of_world (snd tw) (get_time tw) = \\<gamma>\\<close> \\<open>state_of_world (snd tw) (get_time tw) =\n      \\<sigma>\\<close> beval_world_raw.intros destruct_worldline_correctness(6) destruct_worldline_def fst_conv\n      worldline2_constructible)\n    then show ?case\n      using \"8.hyps\"(3) \\<open>beval_world_raw2 tw exp x\\<close> \\<open>world_seq_exec_alt tw (Bcase exp choices) tw'\\<close>\n      world_seq_exec_alt.intros(8) by blast\n  next\n    case (9 t \\<sigma> \\<gamma> \\<theta> def ss \\<tau> \\<tau>' exp choices)\n    then show ?case\n      by (simp add: world_seq_exec_alt.intros(9))\n  next\n    case (10 t \\<sigma> \\<gamma> \\<theta> def exp \\<tau>)\n    then show ?case\n      using world_seq_exec_alt.intros(10) worldline2_constructible by blast\n  qed\nqed\n\nlemma world_seq_exec_alt_def:\n  assumes \"nonneg_delay ss\"\n  shows \"world_seq_exec_alt tw ss = world_seq_exec tw ss\"\nproof (rule, rule)\n  fix x\n  assume \"world_seq_exec_alt tw ss x\"\n  thus \"tw, ss \\<Rightarrow>\\<^sub>s x\"\n    using world_seq_exec_alt_imp_world_seq_exec assms by blast\nnext\n  fix x\n  assume \"tw, ss \\<Rightarrow>\\<^sub>s x\"\n  thus \"world_seq_exec_alt tw ss x\"\n    using world_seq_exec_imp_world_seq_exec_alt assms by blast\nqed\n\ninductive_cases world_seq_exec_alt_cases [elim!] :\n  \"world_seq_exec_alt tw Bnull ss\"\n  \"world_seq_exec_alt tw (Bcomp ss1 ss2) ss\"\n  \"world_seq_exec_alt tw (Bguarded g ss1 ss2) ss\"\n  \"world_seq_exec_alt tw (Bassign_trans sig exp dly) ss\"\n  \"world_seq_exec_alt tw (Bassign_inert sig exp dly) ss\"\n  \"world_seq_exec_alt tw (Bcase exp ((Explicit exp', ss) # choices)) tw'\"\n\nlemma world_seq_exec_alt_unaffected:\n  assumes \"world_seq_exec_alt tw ss tw'\"\n  assumes \"sig \\<notin> set (signals_in ss)\"\n  shows   \"\\<And>k. wline_of tw sig k = wline_of tw' sig k\"\n  using assms\nproof (induction rule: world_seq_exec_alt.inducts)\n  case (5 tw exp x tw' sig2 dly)\n  hence \"sig2 \\<noteq> sig\"\n    by auto\n  show ?case \n    using snd_worldline_upd2[OF `sig2 \\<noteq> sig`] unfolding comp_def 5(2) by auto\nnext\n  case (6 tw exp x tw' sig2 dly)\n  hence \"sig2 \\<noteq> sig\"\n    by auto\n  then show ?case \n    unfolding comp_def 6(2) worldline_inert_upd2_def worldline_inert_upd_def \n    by (smt fun_upd_def sndI val.exhaust worldline_inert_upd2.simps(1) worldline_inert_upd2.simps(2) worldline_inert_upd_def)\nqed auto\n\nlemma world_seq_exec_bcase_empty:\n  \"tw, Bcase exp [] \\<Rightarrow>\\<^sub>s tw\"\nproof -\n  have \"world_seq_exec_alt tw (Bcase exp []) tw\"\n    by (auto intro!: world_seq_exec_alt.intros)\n  moreover have \"nonneg_delay (Bcase exp [])\"\n    by auto\n  ultimately show ?thesis\n    using world_seq_exec_alt_imp_world_seq_exec  by blast\nqed\n\nlemma world_seq_exec_alt_unaffected_before_curr:\n  assumes \"world_seq_exec_alt tw ss tw'\"\n  assumes \"nonneg_delay ss\"\n  shows   \"\\<And>k. k \\<le> fst tw \\<Longrightarrow> wline_of tw sig k = wline_of tw' sig k\"\n  using assms\nproof (induction rule: world_seq_exec_alt.inducts)\n  case (2 tw ss1 tw'' ss2 tw')\n  then show ?case \n    by (metis (no_types, lifting) fst_world_seq_exec_alt nonneg_delay.simps(2))\nnext\n  case (5 tw exp x tw' sig dly)\n  then show ?case \n    by (simp add: snd_worldline_upd2')\nnext                        \n  case (6 tw exp x tw' sig dly)\n  then show ?case \n    by (auto simp add: snd_worldline_inert_upd2)\nqed auto                                  \n\nlemma world_seq_exec_bcase_others:\n  fixes tw :: \"nat \\<times> 'a worldline_init\"\n  assumes \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n  shows   \"world_seq_exec tw (Bcase exp ((Others, ss) # choices)) tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> \\<tau>' def where des1: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    ex1: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\" and ci1: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\" and\n    \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\" and \"fst tw = t\"\n    using destruct_worldline_exist worldline2_constructible\n    by (smt assms fst_conv fst_destruct_worldline world_seq_exec_cases)\n  hence \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < Bcase exp ((Others, ss) # choices), \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n    by (simp add: b_seq_exec.intros(9))\n  thus ?thesis\n    by (smt Pair_inject assms b_seq_exec_deterministic des1 ex1 world_seq_exec.intros\n    world_seq_exec_cases)\nqed\n\ndefinition wp :: \"'signal seq_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> 'signal assn2\" where\n  \"wp ss Q = (\\<lambda>tw. \\<forall>tw'. (tw, ss \\<Rightarrow>\\<^sub>s tw') \\<longrightarrow> Q tw')\"\n\nlemma wp_bnull:\n  \"wp Bnull Q = Q\"\n  apply (rule ext)\n  by (metis (full_types) nonneg_delay.simps(1) world_seq_exec_alt_cases(1) world_seq_exec_alt_def\n  world_seq_exec_bnull wp_def)\n\nlemma wp_bcomp:\n  \"nonneg_delay (Bcomp ss1 ss2) \\<Longrightarrow> wp (Bcomp ss1 ss2) Q = wp ss1 (wp ss2 Q)\"\n  apply (rule ext)\n  unfolding wp_def\n  by (meson nonneg_delay.simps(2) world_seq_exec_alt_cases(2) world_seq_exec_alt_imp_world_seq_exec\n  world_seq_exec_comp world_seq_exec_imp_world_seq_exec_alt)\n\nlemma wp_guarded:\n  \"wp (Bguarded g ss1 ss2) Q =\n  (\\<lambda>tw. (\\<forall>x. beval_world_raw2 tw g x \\<and> is_Bv x \\<longrightarrow> (if bval_of x then wp ss1 Q tw else wp ss2 Q tw)))\"\n  apply (rule ext)\n  unfolding wp_def\n  by (smt beval_beval_world_raw_ci beval_world_raw2_def\n  destruct_worldline_ensure_non_stuttering_hist_raw prod.sel(1) seq_cases_bguarded snd_conv\n  val.collapse(1) val.discI(1) val.inject(1) world_seq_exec.intros world_seq_exec_cases\n  world_seq_exec_guarded world_seq_exec_guarded_not worldline2_constructible worldline2_def)\n\nlemma wp_bcase_empty:\n  \"wp (Bcase exp []) Q = Q\"\n  apply (rule ext)\n  unfolding wp_def using world_seq_exec_bcase_empty world_seq_exec_deterministic\n  by blast\n\nlemma wp_bcase_others:\n  \"wp (Bcase exp ((Others, ss) # choices)) Q = wp ss Q\"\n  apply (rule ext)\n  unfolding wp_def\n  using bcase_others_tw_elim world_seq_exec_bcase_others by blast\n\nlemma wp_guarded':\n  \"wp (Bguarded g ss1 ss2) Q =\n  (\\<lambda>tw. (beval_world_raw2 tw g (Bv True) \\<longrightarrow> wp ss1 Q tw) \\<and> (beval_world_raw2 tw g (Bv False) \\<longrightarrow> wp ss2 Q tw))\"\n  apply (rule ext)\n  unfolding wp_def\n  by (smt beval_beval_world_raw_ci beval_world_raw2_def\n  destruct_worldline_ensure_non_stuttering_hist_raw fst_conv seq_cases_bguarded snd_conv\n  world_seq_exec.intros world_seq_exec_cases world_seq_exec_guarded world_seq_exec_guarded_not\n  worldline2_constructible worldline2_def)\n\nlemma wp_bcase_explicit:\n  \"wp (Bcase exp ((Explicit exp', ss) # choices)) Q =\n  (\\<lambda>tw. (\\<forall>x x'. beval_world_raw2 tw exp x \\<and> beval_world_raw2 tw exp' x' \\<longrightarrow> (if x = x' then wp ss Q tw else wp (Bcase exp choices) Q tw)))\"\n  apply (rule ext)\n  unfolding wp_def\nproof (rule)+\n  fix tw x x'\n  assume *: \"\\<forall>tw'. tw, Bcase exp ((Explicit exp', ss) # choices) \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw'\"\n  assume \"beval_world_raw2 tw exp x \\<and> beval_world_raw2 tw exp' x'\"\n  have \"x = x' \\<or> x \\<noteq> x'\"\n    by auto\n  moreover\n  { assume \"x = x'\"\n    { fix tw'\n      assume \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n      hence  \"tw, Bcase exp ((Explicit exp', ss) # choices) \\<Rightarrow>\\<^sub>s tw'\"\n        using \\<open>beval_world_raw2 tw exp x \\<and> beval_world_raw2 tw exp' x'\\<close> \\<open>x = x'\\<close>\n        world_seq_exec_explicit_match by blast\n      with * have \"Q tw'\"\n        by blast }\n    hence \"\\<forall>tw'. tw, ss \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw'\"\n      by blast }\n  moreover\n  { assume \"x \\<noteq> x'\"\n    { fix tw'\n      assume \"tw, Bcase exp choices \\<Rightarrow>\\<^sub>s tw'\"\n      hence  \"tw, Bcase exp ((Explicit exp', ss) # choices) \\<Rightarrow>\\<^sub>s tw'\"\n        using \\<open>beval_world_raw2 tw exp x \\<and> beval_world_raw2 tw exp' x'\\<close> \\<open>x \\<noteq> x'\\<close>\n        world_seq_exec_explicit_no_match by blast\n      with * have \"Q tw'\"\n        by blast }\n    hence \"\\<forall>tw'. tw, Bcase exp choices \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw'\"\n      by auto }\n  ultimately show \"if x = x' then \\<forall>tw'. tw, ss \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw' else \\<forall>tw'. tw, Bcase exp choices \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw'\"\n    by simp\nnext\n  fix tw\n  show \"\\<forall>x x'. beval_world_raw2 tw exp x \\<and> beval_world_raw2 tw exp' x' \\<longrightarrow>\n                 (if x = x' then \\<forall>tw'. tw, ss \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw' else \\<forall>tw'. tw, Bcase exp choices \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw') \\<Longrightarrow>\n          \\<forall>tw'. tw, Bcase exp ((Explicit exp', ss) # choices) \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw'\"\n  proof (rule)+\n    fix tw'\n    assume *: \"\\<forall>x x'. beval_world_raw2 tw exp x \\<and> beval_world_raw2 tw exp' x' \\<longrightarrow>\n                  (if x = x' then \\<forall>tw'. tw, ss \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw' else \\<forall>tw'. tw, Bcase exp choices \\<Rightarrow>\\<^sub>s tw' \\<longrightarrow> Q tw')\"\n    assume \"tw, Bcase exp ((Explicit exp', ss) # choices) \\<Rightarrow>\\<^sub>s tw'\"\n    then obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where\n                                  des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n                                  exe: \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def (Bcase exp ((Explicit exp', ss) # choices)) \\<tau> \\<tau>'\" and\n                                  con: \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n      using world_seq_exec_cases by blast\n    obtain x x' where bevalx: \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\" and bevalx': \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> exp' \\<longrightarrow>\\<^sub>b x'\"\n      by (rule seq_cases_bcase[OF exe]) blast+\n    (* TODO: factor this proof out *)\n    have \"beval_world_raw (snd tw) (fst tw) exp x\"\n    proof (intro beval_world_raw.intros)\n      show \" state_of_world (snd tw) (get_time tw) = \\<sigma>\"\n        using des\n        unfolding destruct_worldline_def Let_def state_of_world_def by auto\n      show \"derivative_hist_raw (snd tw) (fst tw) = \\<theta>\"\n        using des\n        unfolding destruct_worldline_def Let_def state_of_world_def by auto\n      show \"get_time tw , \\<sigma> , \\<gamma> , \\<theta>, get_time (snd tw)  \\<turnstile> exp \\<longrightarrow>\\<^sub>b x \"\n        by (metis (no_types, lifting) \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> exp \\<longrightarrow>\\<^sub>b x\\<close> des\n        destruct_worldline_correctness(6) destruct_worldline_def fst_conv worldline2_constructible)\n      show \"event_of_world (snd tw) (fst tw) = \\<gamma>\"\n      proof (cases \"0 < fst tw\")\n        case True\n        fix s\n        have \"snd (snd tw) s t = \\<sigma> s\"\n          using `state_of_world (snd tw) (fst tw) = \\<sigma>` unfolding state_of_world_def\n          by (metis des fst_conv fst_destruct_worldline)\n        moreover have \"snd (snd tw) s (fst tw - 1) = signal_of (def s) \\<theta> s (fst tw - 1)\"\n          unfolding worldline_raw_def using True\n          by (metis (mono_tags, lifting) des \\<open>derivative_hist_raw (snd tw) (get_time tw) = \\<theta>\\<close>\n          destruct_worldline_correctness(6) destruct_worldline_def diff_less\n          signal_of_derivative_hist_raw worldline2_constructible zero_less_one)\n        ultimately show ?thesis\n          unfolding event_of_world_def\n          using True\n          by (metis (mono_tags, lifting) des Collect_cong Pair_inject destruct_worldline_def\n          diff_less less_numeral_extra(3) signal_of_derivative_hist_raw zero_less_one)\n      next\n        case False\n        hence \"fst tw = 0\" by auto\n        hence ev: \"event_of_world (snd tw) (fst tw) = {s. snd (snd tw) s 0 \\<noteq> def s}\"\n          unfolding event_of_world_def\n          by (metis (mono_tags, lifting) des Collect_cong destruct_worldline_correctness(6)\n          destruct_worldline_def worldline2_constructible)\n        have \\<gamma>_def': \"\\<gamma> = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s 0}\"\n          using `fst tw = 0`\n          by (metis (no_types, lifting) Collect_cong One_nat_def \\<open>derivative_hist_raw (snd tw)\n          (get_time tw) = \\<theta>\\<close> des destruct_worldline_correctness(2) destruct_worldline_correctness(3)\n          destruct_worldline_correctness(6) destruct_worldline_def diff_is_0_eq' le_add2 plus_1_eq_Suc\n          worldline2_constructible)\n        have \"\\<theta> = 0\"\n          unfolding `fst tw = 0` zero_fun_def\n          by (metis \\<open>get_time tw = 0\\<close> \\<open>derivative_hist_raw (snd tw) (get_time tw) = \\<theta>\\<close>\n          derivative_hist_raw_def zero_option_def zero_order(1))\n        hence \"\\<And>s. signal_of (def s) \\<theta> s 0 = def s\"\n          using signal_of_empty by metis\n        hence \"\\<gamma> = {s. \\<sigma> s \\<noteq> def s}\"\n          using \\<gamma>_def' by auto\n        moreover have \"\\<And>s.  snd (snd tw) s 0 = \\<sigma> s\"\n          using `state_of_world (snd tw) (fst tw) = \\<sigma>` `fst tw = 0` unfolding state_of_world_def by auto\n        ultimately  have \"\\<gamma> = {s. snd (snd tw) s 0 \\<noteq> def s}\"\n          by auto\n        thus ?thesis  using ev by auto\n      qed\n    qed\n    hence \"beval_world_raw2 tw exp x\"\n      unfolding beval_world_raw2_def by auto\n    have \"beval_world_raw (snd tw) (fst tw) exp' x'\"\n    proof (intro beval_world_raw.intros)\n      show \" state_of_world (snd tw) (get_time tw) = \\<sigma>\"\n        using des\n        unfolding destruct_worldline_def Let_def state_of_world_def by auto\n      show \"derivative_hist_raw (snd tw) (fst tw) = \\<theta>\"\n        using des\n        unfolding destruct_worldline_def Let_def state_of_world_def by auto\n      show \"get_time tw , \\<sigma> , \\<gamma> , \\<theta>, get_time (snd tw)  \\<turnstile> exp' \\<longrightarrow>\\<^sub>b x' \"\n        by (metis (no_types, lifting) \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> exp' \\<longrightarrow>\\<^sub>b x'\\<close> des\n        destruct_worldline_correctness(6) destruct_worldline_def fst_conv worldline2_constructible)\n      show \"event_of_world (snd tw) (fst tw) = \\<gamma>\"\n      proof (cases \"0 < fst tw\")\n        case True\n        fix s\n        have \"snd (snd tw) s t = \\<sigma> s\"\n          using `state_of_world (snd tw) (fst tw) = \\<sigma>` unfolding state_of_world_def\n          by (metis des fst_conv fst_destruct_worldline)\n        moreover have \"snd (snd tw) s (fst tw - 1) = signal_of (def s) \\<theta> s (fst tw - 1)\"\n          unfolding worldline_raw_def using True\n          by (metis (mono_tags, lifting) des \\<open>derivative_hist_raw (snd tw) (get_time tw) = \\<theta>\\<close>\n          destruct_worldline_correctness(6) destruct_worldline_def diff_less\n          signal_of_derivative_hist_raw worldline2_constructible zero_less_one)\n        ultimately show ?thesis\n          unfolding event_of_world_def\n          using True\n          by (metis (mono_tags, lifting) des Collect_cong Pair_inject destruct_worldline_def\n          diff_less less_numeral_extra(3) signal_of_derivative_hist_raw zero_less_one)\n      next\n        case False\n        hence \"fst tw = 0\" by auto\n        hence ev: \"event_of_world (snd tw) (fst tw) = {s. snd (snd tw) s 0 \\<noteq> def s}\"\n          unfolding event_of_world_def\n          by (metis (mono_tags, lifting) des Collect_cong destruct_worldline_correctness(6)\n          destruct_worldline_def worldline2_constructible)\n        have \\<gamma>_def': \"\\<gamma> = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s 0}\"\n          using `fst tw = 0`\n          by (metis (no_types, lifting) Collect_cong One_nat_def \\<open>derivative_hist_raw (snd tw)\n          (get_time tw) = \\<theta>\\<close> des destruct_worldline_correctness(2) destruct_worldline_correctness(3)\n          destruct_worldline_correctness(6) destruct_worldline_def diff_is_0_eq' le_add2 plus_1_eq_Suc\n          worldline2_constructible)\n        have \"\\<theta> = 0\"\n          unfolding `fst tw = 0` zero_fun_def\n          by (metis \\<open>get_time tw = 0\\<close> \\<open>derivative_hist_raw (snd tw) (get_time tw) = \\<theta>\\<close>\n          derivative_hist_raw_def zero_option_def zero_order(1))\n        hence \"\\<And>s. signal_of (def s) \\<theta> s 0 = def s\"\n          using signal_of_empty by metis\n        hence \"\\<gamma> = {s. \\<sigma> s \\<noteq> def s}\"\n          using \\<gamma>_def' by auto\n        moreover have \"\\<And>s.  snd (snd tw) s 0 = \\<sigma> s\"\n          using `state_of_world (snd tw) (fst tw) = \\<sigma>` `fst tw = 0` unfolding state_of_world_def by auto\n        ultimately  have \"\\<gamma> = {s. snd (snd tw) s 0 \\<noteq> def s}\"\n          by auto\n        thus ?thesis  using ev by auto\n      qed\n    qed\n    hence \"beval_world_raw2 tw exp' x'\"\n      unfolding beval_world_raw2_def by auto\n    have \"x = x' \\<or> x \\<noteq> x'\"\n      by auto\n    moreover\n    { assume \"x = x'\"\n      have \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def ss \\<tau> \\<tau>'\"\n        apply (rule seq_cases_bcase[OF exe, rotated])\n        by (metis \\<open>x = x'\\<close> beval_raw_deterministic bevalx bevalx' choices.sel fst_conv list.sel(1)) blast+\n      hence \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n        using des con by (auto intro!: world_seq_exec.intros)\n      hence \"Q tw'\"\n        using \"*\" \\<open>beval_world_raw2 tw exp x\\<close> \\<open>beval_world_raw2 tw exp' x'\\<close> \\<open>x = x'\\<close> by auto }\n    moreover\n    { assume \"x \\<noteq> x'\"\n      have \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def (Bcase exp choices) \\<tau> \\<tau>'\"\n        apply (rule seq_cases_bcase[OF exe])\n        by (metis \\<open>x \\<noteq> x'\\<close> beval_raw_deterministic bevalx bevalx' choices.sel fst_conv list.sel(1))\n        blast+\n      hence \"tw, Bcase exp choices \\<Rightarrow>\\<^sub>s tw'\"\n        using des con by (auto intro!: world_seq_exec.intros)\n      hence \"Q tw'\"\n        using \"*\" \\<open>beval_world_raw2 tw exp x\\<close> \\<open>beval_world_raw2 tw exp' x'\\<close> \\<open>x \\<noteq> x'\\<close> by auto }\n    ultimately show \"Q tw'\"\n      by auto\n  qed\nqed\n\nlemma wp_trans:\n  \"0 < dly \\<Longrightarrow> wp (Bassign_trans sig exp dly) Q = (\\<lambda>tw. \\<forall>x. beval_world_raw2 tw exp x \\<longrightarrow> Q(tw [sig, dly :=\\<^sub>2 x]))\"\n  apply (rule ext)\n  unfolding wp_def\n  by (metis lift_world_trans_worldline_upd2 world_seq_exec_trans)\n\nlemma wp_inert:\n  \"0 < dly \\<Longrightarrow> wp (Bassign_inert sig exp dly) Q = (\\<lambda>tw. \\<forall>x. beval_world_raw2 tw exp x \\<longrightarrow> Q(tw \\<lbrakk> sig, dly :=\\<^sub>2 x \\<rbrakk>))\"\n  apply (rule ext)\n  unfolding wp_def\n  by (metis lift_world_inert_worldline_upd2 world_seq_exec_inert)\n\nlemma wp_is_pre: \"nonneg_delay ss \\<Longrightarrow> \\<turnstile> [wp ss Q] ss [Q]\"\nproof (induction ss arbitrary: Q)\ncase (Bcomp ss1 ss2)\n  then show ?case by (auto simp add: wp_bcomp)\nnext\n  case (Bguarded g ss1 ss2)\n  hence \" \\<turnstile> [wp ss1 Q] ss1 [Q]\" and \" \\<turnstile> [wp ss2 Q] ss2 [Q]\"\n    using nonneg_delay.simps by blast+\n  thus ?case\n    apply (intro If2)\n     apply (intro Conseq2[where Q'=\"Q\" and s=\"ss1\" and P=\"wp ss1 Q\"])\n    unfolding wp_guarded' apply simp\n      apply assumption\n     apply simp\n    apply (intro Conseq2[where Q'=\"Q\" and s=\"ss2\" and P=\"wp ss2 Q\"])\n    unfolding wp_guarded apply simp\n     apply assumption\n    apply simp\n    done\nnext\n  case (Bassign_trans x1 x2 x3)\n  then show ?case by (auto simp add: wp_trans)\nnext\n  case (Bassign_inert x1 x2 x3)\n  moreover have \"0 < x3\" using Bassign_inert by auto\n  ultimately show ?case  using AssignI2 by (auto simp add: wp_inert)\nnext\n  case Bnull\n  then show ?case by (auto simp add: wp_bnull)\nnext\n  case (Bcase exp choices)\n  thus ?case\n  proof (induct choices)\n    case Nil\n    then show ?case\n      by (simp add: wp_bcase_empty)\n  next\n    case (Cons a choices)\n    hence \"nonneg_delay (Bcase exp choices)\"\n      unfolding nonneg_delay.simps by auto\n    hence \"\\<turnstile> [wp (Bcase exp choices) Q] Bcase exp choices [Q]\"\n      using Cons by auto\n    consider (others) ss' where \"a = (Others, ss')\" | (explicit) exp' ss' where \"a = (Explicit exp', ss')\"\n      by (metis choices.collapse  old.prod.exhaust)\n    then show ?case\n    proof (cases)\n      case others\n      hence \" \\<turnstile> [wp ss' Q] ss' [Q]\"\n        using Cons.prems(1) Cons.prems(2) by fastforce\n      then show ?thesis\n        by (simp add: others wp_bcase_others)\n    next\n      case explicit\n      hence \"nonneg_delay (Bcase exp choices)\"\n        using \\<open>nonneg_delay (Bcase exp choices)\\<close> by blast\n      hence \" \\<turnstile> [wp ss' Q] ss' [Q]\"\n        using Cons.prems(1) Cons.prems(2) explicit by fastforce\n      show ?thesis\n        unfolding explicit wp_bcase_explicit\n        apply (rule Bcase_if2)\n         apply (rule strengthen_pre_hoare2[where P=\"wp ss' Q\"])\n          apply auto[1]\n         apply (rule \\<open>\\<turnstile> [wp ss' Q] ss' [Q]\\<close>)\n        apply (rule strengthen_pre_hoare2[where P=\" wp (Bcase exp choices) Q\"])\n         apply auto[1]\n        by (simp add: \\<open>\\<turnstile> [wp (Bcase exp choices) Q] Bcase exp choices [Q]\\<close>)\n    qed\n  qed\nqed\n\nlemma hoare_complete:\n  assumes \"nonneg_delay ss\" assumes \"\\<Turnstile> [P] ss [Q]\" shows \"\\<turnstile> [P] ss [Q]\"\nproof (rule strengthen_pre_hoare2)\n  show \"\\<forall>w. P w \\<longrightarrow> wp ss Q w\" using assms\n    by (metis seq_hoare_valid2_def wp_def)\n  show \" \\<turnstile> [VHDL_Hoare_Complete.wp ss Q] ss [Q]\"\n    using assms by (intro wp_is_pre)\nqed\n\ncorollary hoare_sound_complete:\n  assumes \"nonneg_delay ss\"\n  shows \"\\<turnstile> [P] ss [Q] \\<longleftrightarrow> \\<Turnstile> [P] ss [Q]\"\n  using hoare_complete soundness_hoare2 assms by auto\n\nsubsection \\<open>A sound and complete Hoare logic for VHDL's concurrent statement\\<close>\n\ndefinition event_of :: \"nat \\<times> 'signal worldline_init  \\<Rightarrow> 'signal event\" where\n  \"event_of tw = (fst o snd o snd) (destruct_worldline tw)\"\n\nlemma event_of_alt_def1:\n  \"0 < fst tw \\<Longrightarrow> event_of tw = {s. wline_of tw s (fst tw) \\<noteq> wline_of tw s (fst tw - 1)}\"\nproof-\n  assume \"0 < fst tw\"\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    using prod_cases5 by metis\n  hence \"event_of tw = \\<gamma>\"\n    unfolding event_of_def by auto\n  also have \"... = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)}\"\n    using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> unfolding destruct_worldline_def Let_def\n    by auto\n  finally have \"event_of tw = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)}\"\n    by auto\n  have \"\\<And>s. \\<sigma> s = wline_of tw s (fst tw)\"\n    using des unfolding destruct_worldline_def Let_def by auto\n  have \\<theta>_def: \"\\<theta> = derivative_hist_raw (snd tw) (get_time tw)\" and t_def: \"t = fst tw\"\n    using des unfolding destruct_worldline_def Let_def by auto\n  have \"\\<And>s. signal_of (def s) \\<theta> s (t - 1) = wline_of tw s (fst tw - 1)\"\n    using \\<open>0 < fst tw\\<close> unfolding \\<theta>_def t_def\n    by (metis (mono_tags, lifting) comp_apply des destruct_worldline_correctness(6)\n        destruct_worldline_def diff_less signal_of_derivative_hist_raw worldline2_constructible\n        zero_less_one)\n  thus ?thesis\n    using \\<open>\\<And>s. \\<sigma> s = wline_of tw s (get_time tw)\\<close> \\<open>event_of tw = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)}\\<close>\n    by auto\nqed\n\nlemma event_of_alt_def2:\n  \"fst tw = 0 \\<Longrightarrow> event_of tw = {s. wline_of tw s (fst tw) \\<noteq> ((fst o snd) tw s)}\"\nproof -\n  assume \"fst tw = 0\"\n  obtain def t \\<sigma> \\<gamma> \\<theta> \\<tau> where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    using prod_cases5 by metis\n  hence \"event_of tw = \\<gamma>\"\n    unfolding event_of_def by auto\n  also have \"... = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)}\"\n    using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> unfolding destruct_worldline_def Let_def\n    by auto\n  finally have \"event_of tw = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)}\"\n    by auto\n  have \"\\<And>s. \\<sigma> s = wline_of tw s (fst tw)\"\n    using des unfolding destruct_worldline_def Let_def by auto\n  have \\<theta>_def: \"\\<theta> = derivative_hist_raw (snd tw) (get_time tw)\" and t_def: \"t = fst tw\"\n    using des unfolding destruct_worldline_def Let_def by auto\n  have \"\\<And>s. signal_of (def s) \\<theta> s (t - 1) = (def s)\"\n    using \\<open>fst tw = 0\\<close> unfolding \\<theta>_def t_def\n    by (metis derivative_hist_raw_def diff_0_eq_0 le_numeral_extra(3) signal_of_zero zero_option_def)\n  thus ?thesis\n    using \\<open>\\<And>s. \\<sigma> s = wline_of tw s (get_time tw)\\<close> \\<open>event_of tw = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)}\\<close>\n    by (metis (mono_tags, lifting) Collect_cong comp_apply des destruct_worldline_correctness(6)\n    destruct_worldline_def worldline2_constructible)\nqed\n\nlemma event_of_alt_def:\n  \"event_of tw = (if fst tw = 0 then {s. wline_of tw s (fst tw) \\<noteq> ((fst o snd) tw s)} else\n                                     {s. wline_of tw s (fst tw) \\<noteq> wline_of tw s (fst tw - 1)})\"\n  using event_of_alt_def1 event_of_alt_def2\n  by (metis (mono_tags, lifting) gr0I)\n\nlemma event_of_worldline_upd2:\n  \"\\<And>v1. 0 < dly \\<Longrightarrow> event_of (w[ sig, dly :=\\<^sub>2 v1]) = event_of w\"\n  unfolding event_of_alt_def fst_worldline_upd2 worldline_upd2_def worldline_upd_def\n  by (auto)\n\nlemma event_of_worldline_upd2':\n  \"\\<And>v1.  event_of (w[ sig, 1 :=\\<^sub>2 v1]) = event_of w\"\n  by (simp add: event_of_worldline_upd2)\n\ninductive\n  conc_hoare :: \"'signal assn2 \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\"\n  (\"\\<turnstile> (\\<lbrace>(1_)\\<rbrace>/ (_)/ \\<lbrace>(1_)\\<rbrace>)\" 50)\n  where\nSingle:  \"\\<turnstile> [\\<lambda>tw. P tw \\<and> \\<not> disjnt sl (event_of tw)] ss [Q] \\<Longrightarrow> \\<forall>tw. P tw \\<and> disjnt sl (event_of tw) \\<longrightarrow> Q tw\n    \\<Longrightarrow> \\<turnstile> \\<lbrace>P\\<rbrace> process sl : ss \\<lbrace>Q\\<rbrace>\"\n| Parallel:  \"\\<turnstile> \\<lbrace>P\\<rbrace> cs\\<^sub>1 \\<lbrace>R\\<rbrace> \\<Longrightarrow> \\<turnstile> \\<lbrace>R\\<rbrace> cs\\<^sub>2 \\<lbrace>Q\\<rbrace> \\<Longrightarrow> conc_stmt_wf (cs\\<^sub>1 || cs\\<^sub>2) \\<Longrightarrow> \\<turnstile> \\<lbrace>P\\<rbrace> cs\\<^sub>1 || cs\\<^sub>2 \\<lbrace>Q\\<rbrace>\"\n| Parallel2: \"\\<turnstile> \\<lbrace>P\\<rbrace> cs\\<^sub>2 \\<lbrace>R\\<rbrace> \\<Longrightarrow> \\<turnstile> \\<lbrace>R\\<rbrace> cs\\<^sub>1 \\<lbrace>Q\\<rbrace> \\<Longrightarrow> conc_stmt_wf (cs\\<^sub>1 || cs\\<^sub>2) \\<Longrightarrow> \\<turnstile> \\<lbrace>P\\<rbrace> cs\\<^sub>1 || cs\\<^sub>2 \\<lbrace>Q\\<rbrace>\"\n| Conseq': \"\\<lbrakk>\\<forall>w. P' w \\<longrightarrow> P w; \\<turnstile> \\<lbrace>P\\<rbrace> c \\<lbrace>Q\\<rbrace>; \\<forall>w. Q w \\<longrightarrow> Q' w\\<rbrakk> \\<Longrightarrow> \\<turnstile> \\<lbrace>P'\\<rbrace> c \\<lbrace>Q'\\<rbrace>\"\n| Conj2: \"\\<turnstile> \\<lbrace>P\\<rbrace> s \\<lbrace>Q1\\<rbrace> \\<Longrightarrow> \\<turnstile> \\<lbrace>P\\<rbrace> s \\<lbrace>Q2\\<rbrace> \\<Longrightarrow> \\<turnstile> \\<lbrace>P\\<rbrace> s \\<lbrace>\\<lambda>tw. Q1 tw \\<and> Q2 tw\\<rbrace>\"\n\nlemma Conj2_univ_qtfd:\n  \"\\<turnstile> \\<lbrace>P\\<rbrace> ss \\<lbrace>\\<lambda>tw. \\<forall>i\\<in>S tw. Q (i, snd tw)\\<rbrace> \\<Longrightarrow> \\<turnstile> \\<lbrace>P\\<rbrace> ss \\<lbrace>\\<lambda>tw. \\<forall>i\\<in>S tw. R (i, snd tw)\\<rbrace> \\<Longrightarrow> \n   \\<turnstile> \\<lbrace>P\\<rbrace> ss \\<lbrace>\\<lambda>tw. \\<forall>i\\<in>S tw. Q (i, snd tw) \\<and> R (i, snd tw)\\<rbrace>\"\n  apply (rule Conseq'[where P=\"P\" and Q=\"\\<lambda>tw. (\\<forall>i\\<in>S tw. Q (i, snd tw)) \\<and> (\\<forall>i \\<in> S tw. R (i, snd tw))\"])\n    apply simp\n   apply (rule Conj2)\n  by auto\n  \nlemma strengthen_pre_conc_hoare:\n  assumes \"\\<forall>w. P' w \\<longrightarrow> P w\" and \"\\<turnstile> \\<lbrace>P\\<rbrace> s \\<lbrace>Q\\<rbrace>\"\n  shows \"\\<turnstile> \\<lbrace>P'\\<rbrace> s \\<lbrace>Q\\<rbrace>\"\n  using assms by (blast intro: Conseq')\n\nlemma weaken_post_conc_hoare:\n  assumes \"\\<forall>w. Q w \\<longrightarrow> Q' w\" and \"\\<turnstile> \\<lbrace>P\\<rbrace> s \\<lbrace>Q\\<rbrace>\"\n  shows   \"\\<turnstile> \\<lbrace>P\\<rbrace> s \\<lbrace>Q'\\<rbrace>\"\n  using assms by (blast intro: Conseq')\n\ninductive world_conc_exec :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\"\n    (\"(_ , _) \\<Rightarrow>\\<^sub>c _\") where\n  \"     destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\n   \\<Longrightarrow>  b_conc_exec t \\<sigma> \\<gamma> \\<theta> def c \\<tau> \\<tau>'\n   \\<Longrightarrow>  worldline2  t \\<sigma>   \\<theta> def \\<tau>' = tw'\n   \\<Longrightarrow>  world_conc_exec tw c tw'\"\n\n(* Diagram for lifting the concurrent execution to the worldline level\n *\n *         w, t                    \\<Rightarrow>\\<^sub>c          w', t\n *           \\<down>                                  \\<up>\n *   destruct_worldline                      worldline2 t \\<sigma> \\<theta> \\<tau>'\n *           \\<down>                                  \\<up>\n *         t, \\<sigma>, \\<gamma>, \\<theta> \\<turnstile> <c, \\<tau>>    \\<longrightarrow>\\<^sub>c          \\<tau>'\n *\n *)\n\ninductive_cases world_conc_exec_cases [elim!] : \"world_conc_exec tw c tw'\"\n\nlemma world_conc_exec_deterministic:\n  assumes \"tw, c \\<Rightarrow>\\<^sub>c tw1\"\n  assumes \"tw, c \\<Rightarrow>\\<^sub>c tw2\"\n  shows   \"tw2 = tw1\"\n  using assms\nproof (induction arbitrary: tw2 rule:world_conc_exec.induct)\n  case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> c \\<tau>' tw')\n  obtain \\<tau>2 where \" t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <c , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>2\" and \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw2\"\n    using world_conc_exec_cases[OF 1(4)] 1(1)\n    by (smt \"1.hyps\"(2) Pair_inject b_conc_exec_deterministic)\n  hence \"\\<tau>2 = \\<tau>'\"\n    using b_conc_exec_deterministic 1(2) by blast\n  thus ?case\n    using \"1.hyps\"(3) \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw2\\<close> by blast\nqed\n\ninductive world_conc_exec_alt :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\"  where\n  \"disjnt sl (event_of tw) \\<Longrightarrow> world_conc_exec_alt tw (process sl : ss) tw\"\n\n| \"world_seq_exec_alt tw ss tw' \\<Longrightarrow> \\<not> disjnt sl (event_of tw) \\<Longrightarrow> world_conc_exec_alt tw (process sl : ss) tw'\"\n\n| \"world_conc_exec_alt tw cs1 tw' \\<Longrightarrow> world_conc_exec_alt tw' cs2 tw'' \\<Longrightarrow> world_conc_exec_alt tw (cs1 || cs2) tw''\"\n\n| \"world_conc_exec_alt tw cs2 tw' \\<Longrightarrow> world_conc_exec_alt tw' cs1 tw'' \\<Longrightarrow> world_conc_exec_alt tw (cs1 || cs2) tw''\"\n\nlemma empty_event_world_conc_exec_alt:\n  assumes \"event_of tw = {}\"\n  shows   \"world_conc_exec_alt tw cs tw\"\n  using assms\nproof (induction cs)\n  case (Bpar cs1 cs2)\n  then show ?case \n    using world_conc_exec_alt.intros(3) by blast\nnext\n  case (Bsingle x1 x2)\n  then show ?case \n    by (simp add: world_conc_exec_alt.intros(1))\nqed\n\nlemma world_conc_exec_alt_unaffected:\n  assumes \"world_conc_exec_alt tw cs tw'\"\n  assumes \"sig \\<notin> set (signals_from cs)\"\n  shows   \"\\<And>k. wline_of tw sig k = wline_of tw' sig k\"\n  using assms\nproof (induction rule: world_conc_exec_alt.inducts)\n  case (2 tw ss tw' sl)\n  then show ?case \n    using world_seq_exec_alt_unaffected  by (metis signals_from.simps(1))\nqed (auto)\n\ninductive_cases world_conc_exec_alt_cases [elim!] : \"world_conc_exec tw (process sl : ss) tw'\"\n                                                    \"world_conc_exec tw (cs1 || cs2) tw'\"\nlemma fst_world_conc_exec_alt:\n  assumes \"world_conc_exec_alt tw cs tw'\"\n  shows   \"fst tw = fst tw'\"\n  using assms\n  by (induction rule:world_conc_exec_alt.inducts)(auto simp add: fst_world_seq_exec_alt)\n\nlemma world_conc_exec_imp_world_conc_exec_alt:\n  assumes \"world_conc_exec tw cs tw'\"\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows   \"world_conc_exec_alt tw cs tw'\"\n  using assms\nproof (induction rule: world_conc_exec.induct)\n  case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> c \\<tau>' tw')\n  then show ?case\n  proof (induction c arbitrary: \\<tau> \\<tau>' tw tw')\n    case (Bpar c1 c2)\n    hence \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n      using worldline2_constructible  by blast\n    then obtain \\<tau>'' where \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <c1 , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'' \"\n      using Bpar by blast\n    hence \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <c2 , \\<tau>''> \\<longrightarrow>\\<^sub>c \\<tau>'\"\n      using b_conc_exec_sequential by (metis Bpar.prems(2) Bpar.prems(4))\n    obtain tw'' where \"world_conc_exec_alt tw c1 tw''\" and \"tw'' = worldline2 t \\<sigma> \\<theta> def \\<tau>''\"\n      using Bpar(1)[OF Bpar(3) `t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <c1 , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>''`] ` conc_stmt_wf (c1 || c2)`\n      by (metis Bpar.prems(5) conc_stmt_wf_def distinct_append nonneg_delay_conc.simps(2)\n      signals_from.simps(2))\n    have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>''\"\n      using b_conc_exec_preserves_context_invariant[OF `t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <c1 , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>''` \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\\<close> ]\n      `conc_stmt_wf (c1 || c2)` unfolding conc_stmt_wf_def\n      using Bpar.prems(5) nonneg_delay_conc.simps(2) by blast\n    moreover have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n      using Bpar.prems(1) destruct_worldline_ensure_non_stuttering by blast\n    moreover hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>'') \\<sigma> s\"\n      by (metis (no_types, lifting) Bpar.prems(4) Bpar.prems(5) \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\\<close> \\<open>t\n      , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <c1 , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>''\\<close> b_conc_exec_preserves_non_stuttering conc_stmt_wf_def\n      context_invariant_def distinct_append nonneg_delay_conc.simps(2) signals_from.simps(2))\n    moreover have \" \\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n      using Bpar.prems(1) destruct_worldline_ensure_non_stuttering_hist_raw by blast\n    ultimately have  des2: \"destruct_worldline tw'' = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>'')\"\n      using destruct_worldline_correctness3  by (simp add: destruct_worldline_correctness3 \\<open>tw'' = worldline2 t \\<sigma> \\<theta> def \\<tau>''\\<close>)\n    hence \"world_conc_exec_alt tw'' c2 tw'\"\n      using Bpar(2)[OF des2 `t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <c2 , \\<tau>''> \\<longrightarrow>\\<^sub>c \\<tau>'` Bpar(5)]\n      by (metis Bpar.prems(4) Bpar.prems(5) conc_stmt_wf_def distinct_append\n      nonneg_delay_conc.simps(2) signals_from.simps(2))\n    then show ?case\n      using \\<open>world_conc_exec_alt tw c1 tw''\\<close> world_conc_exec_alt.intros(3) by blast\n  next\n    case (Bsingle x1 x2)\n    then show ?case\n      by (metis comp_apply conc_cases(1) event_of_def fst_conv nonneg_delay_conc.simps(1) snd_conv\n      world_conc_exec_alt.intros(1) world_conc_exec_alt.intros(2) world_seq_exec.intros\n      world_seq_exec_imp_world_seq_exec_alt worldline2_constructible)\n  qed\nqed\n\nlemma world_conc_exec_alt_imp_world_conc_exec:\n  assumes \"world_conc_exec_alt tw cs tw'\"\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows   \"world_conc_exec tw cs tw'\"\n  using assms\nproof (induction rule:world_conc_exec_alt.induct)\n  case (1 sl tw ss)\n  show ?case\n    by (smt \"1.hyps\" b_conc_exec.intros(1) destruct_worldline_def event_of_def fst_conv o_apply\n    snd_conv world_conc_exec.intros worldline2_constructible)\nnext\n  case (2 tw ss tw' sl)\n  hence \"world_seq_exec tw ss tw'\"\n    using world_seq_exec_alt_def by (metis nonneg_delay_conc.simps(1))\n  then obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n      and \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def ss \\<tau> \\<tau>'\" and \" worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\" and \"(event_of tw) = \\<gamma>\"\n    using world_seq_exec_cases by (smt comp_apply event_of_def fst_conv snd_conv)\n  thus ?case\n    using 2(2)\n    by (auto intro!: world_conc_exec.intros b_conc_exec.intros)\nnext\n  case (3 tw cs1 tw' cs2 tw'')\n  hence \"tw , cs1 \\<Rightarrow>\\<^sub>c tw'\" and \"tw', cs2 \\<Rightarrow>\\<^sub>c tw''\"\n    by (simp add: conc_stmt_wf_def)+\n  then obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    and ex1: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs1, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\" and \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\" and\n    \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\" and \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n    using worldline2_constructible\n    by (smt \"3.prems\"(2) b_conc_exec_preserves_context_invariant nonneg_delay_conc.simps(2)\n    world_conc_exec_cases)\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> destruct_worldline_ensure_non_stuttering by blast\n  hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n    using b_conc_exec_preserves_non_stuttering[OF ex1 ] 3(5-6)\n    by (metis (full_types) \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> conc_stmt_wf_def\n    destruct_worldline_trans_zero_upto_now distinct_append nonneg_delay_conc.simps(2)\n    signals_from.simps(2))\n  moreover have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n    using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close>\n    destruct_worldline_ensure_non_stuttering_hist_raw by blast\n  hence \"destruct_worldline tw' = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>')\"\n    using \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\\<close> \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\\<close> calculation\n    destruct_worldline_correctness3 by blast\n  then obtain \\<tau>'' where \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs2, \\<tau>'> \\<longrightarrow>\\<^sub>c \\<tau>''\" and \"worldline2 t \\<sigma> \\<theta> def \\<tau>'' = tw''\"\n    using \\<open>tw' , cs2 \\<Rightarrow>\\<^sub>c tw''\\<close> by auto\n  obtain temp where \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs1 || cs2, \\<tau>> \\<longrightarrow>\\<^sub>c temp\"\n    by (meson \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs2 , \\<tau>'> \\<longrightarrow>\\<^sub>c \\<tau>''\\<close> b_conc_exec.intros(3) ex1\n    only_context_matters_for_progress_conc)\n  hence \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs1 || cs2, \\<tau>>\\<longrightarrow>\\<^sub>c \\<tau>''\"\n    using b_conc_exec_sequential'[OF 3(5) _ `t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs1, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'` `t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs2, \\<tau>'> \\<longrightarrow>\\<^sub>c \\<tau>''`]\n    by auto\n  then show ?case\n    by (metis \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>'' = tw''\\<close>\n    world_conc_exec.intros)\nnext\n  case (4 tw cs2 tw' cs1 tw'')\n  hence \"tw , cs2 \\<Rightarrow>\\<^sub>c tw'\" and \"tw', cs1 \\<Rightarrow>\\<^sub>c tw''\"\n    by (simp add: conc_stmt_wf_def)+\n  have \"conc_stmt_wf (cs2 || cs1)\"\n    using 4(5) by (metis conc_stmt_wf_def disjoint_iff_not_equal distinct_append signals_from.simps(2))\n  then obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    and ex1: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs2, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\" and \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\" and\n    \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\" and \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n    using worldline2_constructible `tw , cs2 \\<Rightarrow>\\<^sub>c tw'` `tw', cs1 \\<Rightarrow>\\<^sub>c tw''`\n    by (smt \"4.prems\"(2) b_conc_exec_preserves_context_invariant nonneg_delay_conc.simps(2)\n    world_conc_exec_cases)\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> destruct_worldline_ensure_non_stuttering by blast\n  hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n    using b_conc_exec_preserves_non_stuttering[OF ex1 ] 4(5-6)\n    by (metis (full_types) \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> conc_stmt_wf_def\n    destruct_worldline_trans_zero_upto_now distinct_append nonneg_delay_conc.simps(2)\n    signals_from.simps(2))\n  moreover have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n    using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close>\n    destruct_worldline_ensure_non_stuttering_hist_raw by blast\n  hence \"destruct_worldline tw' = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>')\"\n    using \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\\<close> \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\\<close> calculation\n    destruct_worldline_correctness3 by blast\n  then obtain \\<tau>'' where ex2: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs1, \\<tau>'> \\<longrightarrow>\\<^sub>c \\<tau>''\" and \"worldline2 t \\<sigma> \\<theta> def \\<tau>'' = tw''\"\n    using \\<open>tw' , cs1 \\<Rightarrow>\\<^sub>c tw''\\<close> by auto\n  obtain temp where \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs1 || cs2, \\<tau>> \\<longrightarrow>\\<^sub>c temp\"\n    by (meson \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs1 , \\<tau>'> \\<longrightarrow>\\<^sub>c \\<tau>''\\<close> b_conc_exec.intros(3) ex1\n    only_context_matters_for_progress_conc)\n  hence \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs1 || cs2, \\<tau>>\\<longrightarrow>\\<^sub>c \\<tau>''\"\n    using b_conc_exec_sequential'[OF `conc_stmt_wf (cs2 || cs1)` _ ex1 ex2]\n    by (metis \"4.prems\"(1) parallel_comp_commute)\n  then show ?case\n    by (metis \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>'' = tw''\\<close>\n    world_conc_exec.intros)\nqed\n\nlemma world_conc_exec_eq_world_conc_exec_alt:\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows   \"world_conc_exec_alt tw cs = world_conc_exec tw cs\"\n  by (rule, rule)\n     (auto simp add: world_conc_exec_alt_imp_world_conc_exec world_conc_exec_imp_world_conc_exec_alt assms)\n\nlemma fst_world_conc_exec:\n  assumes \"tw, cs \\<Rightarrow>\\<^sub>c tw'\"\n  shows \"fst tw = fst tw'\"\nproof -\n  have \"world_conc_exec tw cs tw'\"\n    using assms by auto\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    using destruct_worldline_exist by blast\n  then obtain \\<tau>' where \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def cs \\<tau> \\<tau>'\"\n    using world_conc_exec_cases[OF assms] by fastforce\n  have \"fst tw = t\"\n    using fst_destruct_worldline `destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)`  by (metis fst_conv)\n  have \"fst tw' = fst (worldline2 t \\<sigma> \\<theta> def \\<tau>')\"\n    using `world_conc_exec tw cs tw'` `destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)`\n    by auto\n  also have \"... = t\"\n    by transfer' auto\n  also have \"... = fst tw\"\n    using `fst tw = t` by auto\n  finally show \"fst tw = fst tw'\"\n    by auto\nqed\n\nlemma world_conc_exec_commute:\n  assumes \"tw, (cs1 || cs2) \\<Rightarrow>\\<^sub>c tw1\"\n  assumes \"tw, (cs2 || cs1) \\<Rightarrow>\\<^sub>c tw2\"\n  assumes \"conc_stmt_wf (cs1 || cs2)\"\n  shows \"tw1 = tw2\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs1 || cs2, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\" and \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw1\"\n    using assms(1)  by (smt world_conc_exec_cases)\n  hence \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs2 || cs1, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\"\n    using parallel_comp_commute'[OF assms(3)] by auto\n  thus ?thesis\n    using assms(2) \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw1\\<close>\n    by (smt b_conc_exec_deterministic fst_conv snd_conv world_conc_exec_cases)\nqed\n\nlemma world_conc_exec_commute':\n  assumes \"conc_stmt_wf (cs1 || cs2)\"\n  shows \"tw, (cs1 || cs2) \\<Rightarrow>\\<^sub>c tw' \\<longleftrightarrow> tw, (cs2 || cs1) \\<Rightarrow>\\<^sub>c tw'\"\n  using world_conc_exec_commute \n  by (smt assms parallel_comp_commute world_conc_exec.simps)\n\nlemma world_conc_exec_associative:\n  assumes \"tw, (cs1 || cs2) || cs3 \\<Rightarrow>\\<^sub>c tw1\"\n  assumes \"tw, cs1 || (cs2 || cs3) \\<Rightarrow>\\<^sub>c tw2\"\n  shows   \"tw1 = tw2\"\n  using assms \n  by (smt parallel_comp_assoc2 world_conc_exec.intros world_conc_exec_alt_cases(2) world_conc_exec_deterministic)\n\nlemma world_conc_exec_associative':\n  \"tw, (cs1 || cs2) || cs3 \\<Rightarrow>\\<^sub>c tw' \\<longleftrightarrow> tw, cs1 || (cs2 || cs3) \\<Rightarrow>\\<^sub>c tw'\"\n  using world_conc_exec_associative \n  by (smt parallel_comp_assoc parallel_comp_assoc2 world_conc_exec.intros world_conc_exec_cases)\n\nlemma world_conc_exec_disjnt:\n  fixes tw :: \"nat \\<times> 'a worldline_init\"\n  assumes \"disjnt sl (event_of tw)\" shows \"tw, (process sl : ss) \\<Rightarrow>\\<^sub>c tw\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> def \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def , \\<tau>)\" and\n    ex: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <process sl : ss, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\"\n    using destruct_worldline_exist\n    by (smt assms b_conc_exec.intros(1) comp_apply event_of_def fst_conv snd_conv)\n  moreover have \"disjnt sl \\<gamma>\"\n    using assms unfolding event_of_def by (simp add: des)\n  ultimately have \"\\<tau>' = \\<tau>\"\n    by auto\n  hence \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw\"\n    using des  worldline2_constructible by fastforce\n  with des ex show ?thesis\n    by (meson world_conc_exec.intros)\nqed\n\nlemma world_conc_exec_not_disjnt:\n  fixes tw :: \"nat \\<times> 'a worldline_init\"\n  assumes \"\\<not> disjnt sl (event_of tw)\" and \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n  shows \"tw, (process sl : ss) \\<Rightarrow>\\<^sub>c tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> def \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    ex: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <process sl : ss, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\"\n    using destruct_worldline_exist\n    by (smt assms(2) b_conc_exec.intros(1) b_conc_exec.intros(2) world_seq_exec_cases)\n  moreover have \"\\<not> disjnt sl \\<gamma>\"\n    using assms unfolding event_of_def des by (simp add: des)\n  ultimately have \"b_seq_exec t \\<sigma> \\<gamma> \\<theta> def ss \\<tau> \\<tau>'\"\n    by auto\n  hence \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n    using assms(2) des  by (smt b_seq_exec_deterministic fst_conv snd_conv world_seq_exec_cases)\n  thus ?thesis\n    using des ex\n    by (meson world_conc_exec.intros) \nqed\n\nlemma world_conc_exec_alt_unaffected_before_curr:\n  assumes \"world_conc_exec_alt tw cs tw'\"\n  assumes \"nonneg_delay_conc cs\"\n  shows   \"\\<And>k. k \\<le> fst tw \\<Longrightarrow> wline_of tw sig k = wline_of tw' sig k\"\n  using assms\nproof (induction rule:world_conc_exec_alt.inducts)\n  case (1 sl tw ss)\n  then show ?case by auto\nnext\n  case (2 tw ss tw' sl)\n  then show ?case \n    by (meson nonneg_delay_conc.simps(1) world_seq_exec_alt_unaffected_before_curr)\nnext\n  case (3 tw cs1 tw' cs2 tw'')\n  hence \"\\<And>k. k \\<le> fst tw \\<Longrightarrow> wline_of tw sig k = wline_of tw' sig k\"\n    by auto\n  have \"\\<And>k. k \\<le> fst tw' \\<Longrightarrow> wline_of tw' sig k = wline_of tw'' sig k\"\n    using 3 by auto\n  moreover have \"fst tw = fst tw'\"\n    using 3(1)  using fst_world_conc_exec_alt by blast\n  ultimately have \"\\<And>k. k \\<le> fst tw \\<Longrightarrow> wline_of tw' sig k = wline_of tw'' sig k\"\n    by auto\n  then show ?case\n    using \\<open>\\<And>k. k \\<le> fst tw \\<Longrightarrow> wline_of tw sig k = wline_of tw' sig k\\<close> \\<open>k \\<le> get_time tw\\<close> by auto\nnext\n  case (4 tw cs2 tw' cs1 tw'')\n  hence \"\\<And>k. k \\<le> fst tw \\<Longrightarrow> wline_of tw sig k = wline_of tw' sig k\"\n    by auto\n  have \"\\<And>k. k \\<le> fst tw' \\<Longrightarrow> wline_of tw' sig k = wline_of tw'' sig k\"\n    using 4 by auto\n  moreover have \"fst tw = fst tw'\"\n    using 4(1)  using fst_world_conc_exec_alt by blast\n  ultimately have \"\\<And>k. k \\<le> fst tw \\<Longrightarrow> wline_of tw' sig k = wline_of tw'' sig k\"\n    by auto\n  then show ?case\n    using \\<open>\\<And>k. k \\<le> fst tw \\<Longrightarrow> wline_of tw sig k = wline_of tw' sig k\\<close> \\<open>k \\<le> get_time tw\\<close> by auto\nqed\n\n\ndefinition\nconc_hoare_valid :: \"'signal assn2 \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\" (\"\\<Turnstile> \\<lbrace>(1_)\\<rbrace>/ (_)/ \\<lbrace>(1_)\\<rbrace>\" 50)\nwhere \"\\<Turnstile> \\<lbrace>P\\<rbrace> c \\<lbrace>Q\\<rbrace> \\<longleftrightarrow>  (\\<forall>tw tw'.  P tw \\<and> (tw, c \\<Rightarrow>\\<^sub>c tw') \\<longrightarrow> Q tw')\"\n\nlemma helper_b_conc:\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>1, def \\<turnstile> <cs, \\<tau>1> \\<longrightarrow>\\<^sub>c \\<tau>1'\"\n  assumes \"\\<And>k s. signal_of (def s) \\<theta>1 s k = signal_of (def s) \\<theta>2 s k\"\n  assumes \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>1 s k = signal_of (\\<sigma> s) \\<tau>2 s k\"\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> <cs, \\<tau>2> \\<longrightarrow>\\<^sub>c \\<tau>2'\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau>1 n = 0\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau>2 n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta>1 n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta>2 n = 0\"\n  assumes \"nonneg_delay_conc cs\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n  shows \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>1' s k = signal_of (\\<sigma> s) \\<tau>2' s k\"\n  using assms\nproof (induction cs arbitrary: \\<tau>1 \\<tau>2 \\<tau>1' \\<tau>2')\n  case (Bpar cs1 cs2)\n  then obtain \\<tau>11 \\<tau>12 where \"b_conc_exec t \\<sigma> \\<gamma> \\<theta>1 def cs1 \\<tau>1 \\<tau>11\" and \"b_conc_exec t \\<sigma> \\<gamma> \\<theta>1 def cs2 \\<tau>1 \\<tau>12\"\n    by blast\n  hence \\<tau>1'_def: \"\\<tau>1' = clean_zip_raw \\<tau>1 (\\<tau>11, set (signals_from cs1)) (\\<tau>12, set (signals_from cs2))\"\n    using Bpar by (smt obtain_clean_zip)\n  then obtain \\<tau>21 and \\<tau>22 where \"b_conc_exec t \\<sigma> \\<gamma> \\<theta>2 def cs1 \\<tau>2 \\<tau>21\" and  \"b_conc_exec t \\<sigma> \\<gamma> \\<theta>2 def cs2 \\<tau>2 \\<tau>22\"\n    using Bpar.prems(4) by blast\n  hence \\<tau>2'_def: \"\\<tau>2' = clean_zip_raw \\<tau>2 (\\<tau>21, set (signals_from cs1)) (\\<tau>22, set (signals_from cs2))\"\n    using  Bpar  by (smt obtain_clean_zip)\n  hence ind1: \"\\<And>s k. signal_of (\\<sigma> s) \\<tau>11 s k = signal_of (\\<sigma> s) \\<tau>21 s k\"\n    using Bpar(1)[OF _ Bpar(4-5) _ Bpar(7-10), of \"\\<tau>11\" \"\\<tau>21\"]  Bpar.prems(9) nonneg_delay_conc.simps(2)\n    Bpar.prems(10) Bpar.prems(11) \\<open>t , \\<sigma> , \\<gamma> , \\<theta>1, def \\<turnstile> <cs1 , \\<tau>1> \\<longrightarrow>\\<^sub>c \\<tau>11\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>2, def \\<turnstile> <cs1 , \\<tau>2> \\<longrightarrow>\\<^sub>c \\<tau>21\\<close> by blast\n  hence ind2: \"\\<And>s k. signal_of (\\<sigma> s) \\<tau>12 s k = signal_of (\\<sigma> s) \\<tau>22 s k\"\n    using Bpar(2)[OF _ Bpar(4-5) _ Bpar(7-10), of \"\\<tau>12\" \"\\<tau>22\"]  Bpar.prems(9)\n    by (simp add: Bpar.prems(10) Bpar.prems(11) \\<open>t , \\<sigma> , \\<gamma> , \\<theta>1, def \\<turnstile> <cs2 , \\<tau>1> \\<longrightarrow>\\<^sub>c \\<tau>12\\<close> \\<open>t , \\<sigma> ,\n    \\<gamma> , \\<theta>2, def \\<turnstile> <cs2 , \\<tau>2> \\<longrightarrow>\\<^sub>c \\<tau>22\\<close>)\n  have \"s \\<in> set (signals_from cs1) \\<or> s \\<notin> set (signals_from cs1) \\<and> s \\<in> set (signals_from cs2) \\<or>\n        s \\<notin> set (signals_from cs1) \\<and> s \\<notin> set (signals_from cs2)\"\n    by auto\n  moreover\n  { assume \"s \\<in> set (signals_from cs1)\"\n    hence \"\\<And>n. (to_trans_raw_sig \\<tau>1' s) =  (to_trans_raw_sig \\<tau>11 s)\"\n      using \\<tau>1'_def unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    moreover have \"\\<And>n.  (to_trans_raw_sig \\<tau>2' s) =  (to_trans_raw_sig \\<tau>21 s)\"\n      using `s \\<in> set (signals_from cs1)` \\<tau>2'_def\n      unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    ultimately have  ?case\n      using  ind1 ind2 by (metis signal_of_equal_when_trans_sig_equal_upto to_trans_raw_sig_def) }\n  moreover\n  { assume *: \"s \\<notin> set (signals_from cs1) \\<and> s \\<in> set (signals_from cs2)\"\n    hence \"\\<And>n.  (to_trans_raw_sig \\<tau>1' s) =  (to_trans_raw_sig \\<tau>12 s)\"\n      using \\<tau>1'_def\n      unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    moreover have \"\\<And>n.  (to_trans_raw_sig \\<tau>2' s) =  (to_trans_raw_sig \\<tau>22 s)\"\n      using * \\<tau>2'_def\n      unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    ultimately have  ?case\n      using  ind1 ind2\n      by (metis signal_of_equal_when_trans_sig_equal_upto to_trans_raw_sig_def) }\n  moreover\n  { assume *: \"s \\<notin> set (signals_from cs1) \\<and> s \\<notin> set (signals_from cs2)\"\n    hence \"\\<And>n.  (to_trans_raw_sig \\<tau>1' s) =  (to_trans_raw_sig \\<tau>1 s)\"\n      using \\<tau>1'_def\n      unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    moreover have \"\\<And>n.  (to_trans_raw_sig \\<tau>2' s) =  (to_trans_raw_sig \\<tau>2 s)\"\n      using * \\<tau>2'_def\n      unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    ultimately have  ?case\n      using ind1 ind2 Bpar(5)\n      by (metis signal_of_equal_when_trans_sig_equal_upto to_trans_raw_sig_def) }\n  ultimately show ?case by auto\nnext\n  case (Bsingle sl ss)\n  have \"disjnt sl \\<gamma> \\<or> \\<not> disjnt sl \\<gamma>\"\n    by auto\n  moreover\n  { assume \"disjnt sl \\<gamma>\"\n    hence \"\\<tau>1' = \\<tau>1\" and \"\\<tau>2' = \\<tau>2\"\n      using Bsingle by auto\n    with Bsingle(3) have ?case by auto }\n  moreover\n  { assume \"\\<not> disjnt sl \\<gamma>\"\n    hence tau1': \"t, \\<sigma>, \\<gamma>, \\<theta>1, def \\<turnstile> < ss, \\<tau>1> \\<longrightarrow>\\<^sub>s \\<tau>1'\" and tau2': \"t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss, \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2'\"\n      using Bsingle by auto\n    have \"nonneg_delay ss\"\n      using Bsingle by auto\n    hence ?case\n      using helper'[OF tau1' Bsingle(2-3) tau2' Bsingle(5-8)] Bsingle.prems(10) Bsingle.prems(11)\n      by blast }\n  ultimately show ?case by auto\nqed\n\nlemma helper_init':\n  assumes \"init' t \\<sigma> \\<gamma> \\<theta>1 def cs \\<tau>1 \\<tau>1'\"\n  assumes \"\\<And>k s. signal_of (def s) \\<theta>1 s k = signal_of (def s) \\<theta>2 s k\"\n  assumes \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>1 s k = signal_of (\\<sigma> s) \\<tau>2 s k\"\n  assumes \"init' t \\<sigma> \\<gamma> \\<theta>2 def cs \\<tau>2 \\<tau>2'\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau>1 n = 0\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow>  \\<tau>2 n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta>1 n = 0\"\n  assumes \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta>2 n = 0\"\n  assumes \"nonneg_delay_conc cs\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n  shows \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>1' s k = signal_of (\\<sigma> s) \\<tau>2' s k\"\n  using assms\nproof (induction cs arbitrary: \\<tau>1 \\<tau>2 \\<tau>1' \\<tau>2')\n  case (Bpar cs1 cs2)\n  then obtain \\<tau>11 \\<tau>12 where \\<tau>11_def : \"init' t \\<sigma> \\<gamma> \\<theta>1 def cs1 \\<tau>1 \\<tau>11\" and \\<tau>12_def: \"init' t \\<sigma> \\<gamma> \\<theta>1 def cs2 \\<tau>1 \\<tau>12\"\n    by blast\n  hence \\<tau>1'_def: \"\\<tau>1' = clean_zip_raw \\<tau>1 (\\<tau>11, set (signals_from cs1)) (\\<tau>12, set (signals_from cs2))\"\n    using \\<tau>11_def Bpar by (meson init'.intros(2) init'_deterministic)\n  then obtain \\<tau>21 \\<tau>22 where \\<tau>21_def: \"init' t \\<sigma> \\<gamma> \\<theta>2 def cs1 \\<tau>2 \\<tau>21\" and \\<tau>22_def: \"init' t \\<sigma> \\<gamma> \\<theta>2 def cs2 \\<tau>2 \\<tau>22\"\n    using Bpar.prems(4) by blast\n  hence \\<tau>2'_def: \"\\<tau>2' = clean_zip_raw \\<tau>2 (\\<tau>21, set (signals_from cs1)) (\\<tau>22, set (signals_from cs2))\"\n    using \\<tau>21_def Bpar  by (metis init'.intros(2) init'_deterministic)\n  hence ind1: \"\\<And>s k. signal_of (\\<sigma> s) \\<tau>11 s k = signal_of (\\<sigma> s) \\<tau>21 s k\"\n    using Bpar(1)[OF _ Bpar(4-5) _ Bpar(7-10), of \"\\<tau>11\" \"\\<tau>21\"] \\<tau>11_def \\<tau>21_def\n    using Bpar.prems(9) nonneg_delay_conc.simps(2)\n    by (simp add: Bpar.prems(10) Bpar.prems(11))\n  hence ind2: \"\\<And>s k. signal_of (\\<sigma> s) \\<tau>12 s k = signal_of (\\<sigma> s) \\<tau>22 s k\"\n    using Bpar(2)[OF _ Bpar(4-5) _ Bpar(7-10), of \"\\<tau>12\" \"\\<tau>22\"] \\<tau>12_def \\<tau>22_def\n    using Bpar.prems(9)  by (simp add: Bpar.prems(10) Bpar.prems(11))\n  have \"s \\<in> set (signals_from cs1) \\<or> s \\<notin> set (signals_from cs1) \\<and> s \\<in> set (signals_from cs2) \\<or>\n        s \\<notin> set (signals_from cs1) \\<and> s \\<notin> set (signals_from cs2)\"\n    by auto\n  moreover\n  { assume \"s \\<in> set (signals_from cs1)\"\n    hence \"\\<And>n. (to_trans_raw_sig \\<tau>1' s) =  (to_trans_raw_sig \\<tau>11 s)\"\n      using \\<tau>1'_def unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    moreover have \"\\<And>n.  (to_trans_raw_sig \\<tau>2' s) =  (to_trans_raw_sig \\<tau>21 s)\"\n      using `s \\<in> set (signals_from cs1)` \\<tau>2'_def\n      unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    ultimately have  ?case\n      using  ind1 ind2 by (metis signal_of_equal_when_trans_sig_equal_upto to_trans_raw_sig_def) }\n  moreover\n  { assume *: \"s \\<notin> set (signals_from cs1) \\<and> s \\<in> set (signals_from cs2)\"\n    hence \"\\<And>n.  (to_trans_raw_sig \\<tau>1' s) =  (to_trans_raw_sig \\<tau>12 s)\"\n      using \\<tau>1'_def\n      unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    moreover have \"\\<And>n.  (to_trans_raw_sig \\<tau>2' s) =  (to_trans_raw_sig \\<tau>22 s)\"\n      using * \\<tau>2'_def\n      unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    ultimately have  ?case\n      using  ind1 ind2\n      by (metis signal_of_equal_when_trans_sig_equal_upto to_trans_raw_sig_def) }\n  moreover\n  { assume *: \"s \\<notin> set (signals_from cs1) \\<and> s \\<notin> set (signals_from cs2)\"\n    hence \"\\<And>n.  (to_trans_raw_sig \\<tau>1' s) =  (to_trans_raw_sig \\<tau>1 s)\"\n      using \\<tau>1'_def\n      unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    moreover have \"\\<And>n.  (to_trans_raw_sig \\<tau>2' s) =  (to_trans_raw_sig \\<tau>2 s)\"\n      using * \\<tau>2'_def\n      unfolding to_trans_raw_sig_def clean_zip_raw_def Let_def by (auto split:prod.splits)\n    ultimately have  ?case\n      using ind1 ind2 Bpar(5)\n      by (metis signal_of_equal_when_trans_sig_equal_upto to_trans_raw_sig_def) }\n  ultimately show ?case by auto\nnext\n  case (Bsingle sl ss)\n  hence tau1': \"t, \\<sigma>, \\<gamma>, \\<theta>1, def \\<turnstile> < ss, \\<tau>1> \\<longrightarrow>\\<^sub>s \\<tau>1'\" and tau2': \"t, \\<sigma>, \\<gamma>, \\<theta>2, def \\<turnstile> < ss, \\<tau>2> \\<longrightarrow>\\<^sub>s \\<tau>2'\"\n    using Bsingle by auto\n  have \"nonneg_delay ss\"\n    using Bsingle by auto\n  thus ?case\n    using helper'[OF tau1' Bsingle(2-3) tau2' Bsingle(5-8)]\n    by (simp add: Bsingle.prems(10) Bsingle.prems(11))\nqed\n\nlemma world_conc_exec_parallel:\n  assumes \"conc_stmt_wf (cs1 || cs2)\" and \"nonneg_delay_conc (cs1 || cs2)\"\n  assumes \"world_conc_exec tw   cs1 tw''\"\n  assumes \"world_conc_exec tw'' cs2 tw' \"\n  assumes \"tw, (cs1 || cs2) \\<Rightarrow>\\<^sub>c tw_res\"\n  shows \"tw_res = tw'\"\nproof -\n  have \"nonneg_delay_conc cs1\" and \"nonneg_delay_conc cs2\"\n    using assms by auto\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> def \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    ex: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs1, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\" and ci: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using destruct_worldline_exist worldline2_constructible assms(3) by blast\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    using destruct_worldline_ensure_non_stuttering[OF des] by auto\n  have \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n    using destruct_worldline_trans_zero_upto_now[OF des] by auto\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n  proof (rule)\n    fix s\n    have \"non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n      using `\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s` by auto\n    moreover have \"conc_stmt_wf cs1\" and \"nonneg_delay_conc cs1\"\n      using assms by auto\n    thus \"non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n      using b_conc_exec_preserves_non_stuttering[OF ex `non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s`\n      `\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0`] by auto\n  qed\n  have ci': \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n    using b_conc_exec_preserves_context_invariant[OF ex ci `nonneg_delay_conc cs1`] by auto\n  hence wcs1: \"world_conc_exec tw cs1 (worldline2 t \\<sigma> \\<theta> def \\<tau>')\"\n    using des ex world_conc_exec.intros by blast\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n    using des destruct_worldline_ensure_non_stuttering_hist_raw by blast\n  hence \"destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>') = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>')\"\n    using destruct_worldline_correctness3[OF ci' `\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s`]\n    by blast\n  obtain theta tau' where des2: \"destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>') = (t, \\<sigma>, \\<gamma>, theta, def, tau')\"\n    and beh_same: \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k\" and\n        trans_same: \"\\<And>k s. signal_of (\\<sigma> s) \\<tau>' s k = signal_of (\\<sigma> s) tau' s k\"\n    using destruct_worldline_correctness[OF ci'] by (metis prod_cases4)\n  obtain \\<tau>'' where \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs2, \\<tau>'> \\<longrightarrow>\\<^sub>c \\<tau>''\"\n    using \\<open>destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>') = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>')\\<close> assms(3) assms(4) b_conc_exec_deterministic wcs1 by fastforce\n  have \"\\<exists>\\<tau>'. t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <cs1 || cs2 , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\"\n    by (smt assms(5) des old.prod.inject world_conc_exec_cases)\n  hence \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def (cs1 || cs2) \\<tau> \\<tau>''\"\n    using b_conc_exec_sequential'[OF assms(1) _ ex \\<open>t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs2, \\<tau>'> \\<longrightarrow>\\<^sub>c \\<tau>''\\<close>] by metis\n  hence \"world_conc_exec tw (cs1 || cs2) (worldline2 t \\<sigma> \\<theta> def \\<tau>'')\"\n    using des ex  by (meson world_conc_exec.intros)\n  hence \"tw'', cs2 \\<Rightarrow>\\<^sub>c tw_res\"\n    using des2 wcs1\n    by (smt \\<open>destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>') = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>')\\<close> \\<open>t , \\<sigma> , \\<gamma> , \\<theta>,\n    def \\<turnstile> <cs2 , \\<tau>'> \\<longrightarrow>\\<^sub>c \\<tau>''\\<close> assms(3) assms(5) b_conc_exec_deterministic fst_conv snd_conv\n    world_conc_exec.intros world_conc_exec_cases)\n  thus ?thesis\n    by (smt assms(4) b_conc_exec_deterministic fst_conv snd_conv world_conc_exec_cases)\nqed\n\nlemma world_conc_exec_parallel2:\n  assumes \"conc_stmt_wf (cs1 || cs2)\" and \"nonneg_delay_conc (cs1 || cs2)\"\n  assumes \"world_conc_exec tw   cs2 tw''\"\n  assumes \"world_conc_exec tw'' cs1 tw' \"\n  assumes \"tw, (cs1 || cs2) \\<Rightarrow>\\<^sub>c tw_res\"\n  shows \"tw_res = tw'\"\nproof -\n  have wf: \"conc_stmt_wf (cs2 || cs1)\" and nd: \"nonneg_delay_conc (cs2 || cs1)\"\n    using assms unfolding conc_stmt_wf_def by auto\n  have \"world_conc_exec tw (cs2 || cs1) tw_res\"\n    using world_conc_exec_commute[OF _ _ assms(1)]\n    by (smt assms(1) assms(5) parallel_comp_commute' world_conc_exec.intros world_conc_exec_cases)\n  with world_conc_exec_parallel[OF wf nd] show ?thesis\n    using assms(3) assms(4) by auto\nqed\n\nlemma parallel_valid:\n  assumes \"\\<Turnstile> \\<lbrace>P\\<rbrace> c1 \\<lbrace>R\\<rbrace>\" and \"\\<Turnstile> \\<lbrace>R\\<rbrace> c2 \\<lbrace>Q\\<rbrace>\" and \"conc_stmt_wf (c1 || c2)\"\n  assumes \"nonneg_delay_conc (c1 || c2)\"\n  shows \"\\<Turnstile> \\<lbrace>P\\<rbrace> c1 || c2 \\<lbrace>Q\\<rbrace>\"\n  unfolding conc_hoare_valid_def\nproof rule+\n  fix tw tw':: \"nat \\<times> 'a worldline_init\"\n  assume \"P tw \\<and> tw , c1 || c2 \\<Rightarrow>\\<^sub>c tw'\"\n  hence \"P tw\" and \"tw, c1 || c2 \\<Rightarrow>\\<^sub>c tw'\"\n    by auto\n  then obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> def \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    *: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <c1 || c2, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\" and w'_def: \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\" and\n    ci: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using destruct_worldline_exist  by (smt world_conc_exec_cases worldline2_constructible)\n  have \"\\<And>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    using destruct_worldline_ensure_non_stuttering[OF des] by auto\n  obtain \\<tau>1 where \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def c1 \\<tau> \\<tau>1\"\n    using \"*\" by blast\n  hence ci1: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>1\"\n    using b_conc_exec_preserves_context_invariant[OF _ ci] assms(4)  by auto\n  have \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n    using destruct_worldline_trans_zero_upto_now[OF des] by auto\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n  proof\n    fix s\n    have \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <c1, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>1\"\n      using \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <c1 , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>1\\<close> by blast\n    moreover have \"non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n      by (simp add: \\<open>\\<And>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\\<close>)\n    moreover have \"conc_stmt_wf c1\" and \"nonneg_delay_conc c1\"\n      using assms by auto\n    ultimately show \"non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n      using b_conc_exec_preserves_non_stuttering[OF _ _ `\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0`]\n      by auto\n  qed\n  obtain \\<tau>2 where \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def c2 \\<tau> \\<tau>2\"\n    using \"*\" by blast\n  hence ci2: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>2\"\n    using b_conc_exec_preserves_context_invariant[OF _ ci] assms(4) by auto\n  have \\<tau>'_def: \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def c2 \\<tau>1 \\<tau>'\"\n    using b_conc_exec_sequential[OF assms(3) * `t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <c1, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>1`]\n    by auto\n  define tw1 where \"tw1 = worldline2 t \\<sigma> \\<theta> def \\<tau>1\"\n  have \"tw, c1 \\<Rightarrow>\\<^sub>c tw1\"\n    using des \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <c1 , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>1\\<close> tw1_def world_conc_exec.intros by blast\n  hence \"R tw1\"\n    using assms(1) `P tw` unfolding conc_hoare_valid_def  by meson\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n    using des destruct_worldline_ensure_non_stuttering_hist_raw by blast\n  hence des2: \"destruct_worldline tw1 = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>1)\"\n    using destruct_worldline_correctness3[OF ci1 `\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s`]\n    unfolding tw1_def by auto\n  moreover have \"nonneg_delay_conc c2\"\n    using assms(4) by auto\n  hence \"tw1, c2 \\<Rightarrow>\\<^sub>c tw'\"\n    using des2\n    apply (intro world_conc_exec.intros)\n      apply assumption\n     apply (rule \\<tau>'_def)\n    apply (simp add: w'_def)\n    done\n  with `R tw1` show \"Q tw'\"\n    using assms(2) using conc_hoare_valid_def by metis\nqed\n\nlemma soundness_conc_hoare:\n  assumes \"\\<turnstile> \\<lbrace>P\\<rbrace> c \\<lbrace>Q\\<rbrace>\"\n  assumes \"conc_stmt_wf c\" and \"nonneg_delay_conc c\"\n  shows \"\\<Turnstile> \\<lbrace>P\\<rbrace> c \\<lbrace>Q\\<rbrace>\"\n  using assms\nproof (induction rule:conc_hoare.induct)\n  case (Single P sl ss Q)\n  { fix tw  tw' :: \"nat \\<times> 'a worldline_init\"\n    assume as: \"P tw \\<and> (tw ,  process sl : ss \\<Rightarrow>\\<^sub>c tw')\"\n    then obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> def \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and \"P tw\" and\n      ex: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <process sl : ss, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\" and \"(worldline2 t \\<sigma> \\<theta> def \\<tau>') = tw'\"\n      by force\n    have \"fst tw = t\"\n      by (metis (no_types, lifting) des destruct_worldline_def fst_conv)\n    have \"nonneg_delay ss\"\n      using Single by auto\n    have \"disjnt sl \\<gamma> \\<or> \\<not> disjnt sl \\<gamma>\"\n      by auto\n    moreover\n    { assume \"disjnt sl \\<gamma>\"\n      hence \"\\<tau>' = \\<tau>\" using ex by auto\n      hence \"tw' = tw\"\n        using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>(worldline2 t \\<sigma> \\<theta> def \\<tau>') = tw'\\<close>\n        worldline2_constructible by (metis)\n      with Single have \"Q tw'\"\n        unfolding event_of_def  using \\<open>P tw \\<and> tw, process sl : ss \\<Rightarrow>\\<^sub>c tw'\\<close>\n        \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>disjnt sl \\<gamma>\\<close>  disjnt_sym by fastforce }\n    moreover\n    { assume \"\\<not> disjnt sl \\<gamma>\"\n      hence \"\\<not> disjnt sl (event_of tw)\"\n        unfolding event_of_def using des `fst tw = t` by auto\n      moreover have \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n        using as `\\<not> disjnt sl \\<gamma>`\n      proof -\n        have \"t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> < ss , \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n          using \\<open>\\<not> disjnt sl \\<gamma>\\<close> ex by force\n        then show ?thesis\n          using \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\\<close> des world_seq_exec.intros by blast\n      qed\n      ultimately have \"Q tw'\"\n        using soundness_hoare2[OF Single(1) `nonneg_delay ss`] `P tw` `fst tw = t`\n        unfolding seq_hoare_valid2_def by blast }\n    ultimately have \"Q tw'\" by auto }\n  then show ?case\n    unfolding conc_hoare_valid_def by auto\nnext\n  case (Parallel P cs\\<^sub>1 R cs\\<^sub>2 Q)\n  hence \"conc_stmt_wf cs\\<^sub>1\" and \"conc_stmt_wf cs\\<^sub>2\"\n    by (simp add: conc_stmt_wf_def)+\n  moreover have \"nonneg_delay_conc cs\\<^sub>1\" and \"nonneg_delay_conc cs\\<^sub>2\"\n    using Parallel by auto\n  ultimately have \" \\<Turnstile> \\<lbrace>P\\<rbrace> cs\\<^sub>1 \\<lbrace>R\\<rbrace>\" and \" \\<Turnstile> \\<lbrace>R\\<rbrace> cs\\<^sub>2 \\<lbrace>Q\\<rbrace>\"\n    using Parallel by auto\n  then show ?case\n    using parallel_valid Parallel by blast\nnext\n  case (Parallel2 P cs\\<^sub>2 R cs\\<^sub>1 Q)\n  hence \"conc_stmt_wf cs\\<^sub>1\" and \"conc_stmt_wf cs\\<^sub>2\"\n    by (simp add: conc_stmt_wf_def)+\n  moreover have \"nonneg_delay_conc cs\\<^sub>1\" and \"nonneg_delay_conc cs\\<^sub>2\"\n    using Parallel2 by auto\n  ultimately have cs2: \" \\<Turnstile> \\<lbrace>P\\<rbrace> cs\\<^sub>2 \\<lbrace>R\\<rbrace>\" and cs1: \" \\<Turnstile> \\<lbrace>R\\<rbrace> cs\\<^sub>1 \\<lbrace>Q\\<rbrace>\"\n    using Parallel2 by auto\n  have \"conc_stmt_wf (cs\\<^sub>2 || cs\\<^sub>1)\"\n    using Parallel2(3) unfolding conc_stmt_wf_def by auto\n  moreover have \" nonneg_delay_conc (cs\\<^sub>2 || cs\\<^sub>1) \"\n    using Parallel2(7) by auto\n  ultimately have \"\\<Turnstile> \\<lbrace>P\\<rbrace> cs\\<^sub>2 || cs\\<^sub>1 \\<lbrace>Q\\<rbrace>\"\n    using parallel_valid[OF cs2 cs1]   by auto\n  thus ?case\n    using world_conc_exec_commute[OF _ _ Parallel2(3)]  unfolding conc_hoare_valid_def\n    by (smt Parallel2.prems(1) parallel_comp_commute' world_conc_exec.intros world_conc_exec_cases)\nnext\n  case (Conseq' P' P c Q Q')\n  then show ?case\n    unfolding conc_hoare_valid_def by metis\nnext\n  case (Conj2 P s Q1 Q2)\n  then show ?case  by (simp add: conc_hoare_valid_def)\nqed\n\ndefinition wp_conc :: \"'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> 'signal assn2\" where\n  \"wp_conc cs Q = (\\<lambda>tw. \\<forall>tw'. (tw, cs \\<Rightarrow>\\<^sub>c tw') \\<longrightarrow> Q tw')\"\n\nlemma wp_conc_single:\n  \"wp_conc (process sl : ss) Q =\n  (\\<lambda>tw. if disjnt sl (event_of tw) then Q tw else wp ss Q tw)\"\n  apply (rule ext)\n  unfolding wp_conc_def wp_def\n  by (smt conc_cases(1) event_of_def o_apply prod.sel(1) prod.sel(2) world_conc_exec_cases\n  world_conc_exec_disjnt world_conc_exec_not_disjnt world_seq_exec.intros)\n\nlemma wp_conc_parallel:\n  assumes \"conc_stmt_wf (cs1 || cs2)\" and \"nonneg_delay_conc (cs1 || cs2)\"\n  shows \"wp_conc (cs1 || cs2) Q =  wp_conc cs1 (wp_conc cs2 Q)\"\nproof (rule ext, rule)\n  fix x\n  have \"conc_stmt_wf cs1\" and \"conc_stmt_wf cs2\"\n    using assms  by (simp add: conc_stmt_wf_def)+\n  have \"nonneg_delay_conc cs1\" and \"nonneg_delay_conc cs2\"\n    using assms by auto\n  assume \"wp_conc (cs1 || cs2) Q x \"\n  hence \"(\\<forall>tw'. x , cs1 || cs2 \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> Q tw')\"\n    unfolding wp_conc_def by auto\n  thus\" wp_conc cs1 (wp_conc cs2 Q) x\"\n    unfolding wp_conc_def sym[OF world_conc_exec_eq_world_conc_exec_alt[OF assms]]\n    sym[OF world_conc_exec_eq_world_conc_exec_alt[OF `conc_stmt_wf cs1` `nonneg_delay_conc cs1`]]\n    sym[OF world_conc_exec_eq_world_conc_exec_alt[OF `conc_stmt_wf cs2` `nonneg_delay_conc cs2`]]\n    using world_conc_exec_alt.intros(3) by blast\nnext\n  fix x\n  have \"conc_stmt_wf cs1\" and \"conc_stmt_wf cs2\"\n    using assms  by (simp add: conc_stmt_wf_def)+\n  have \"nonneg_delay_conc cs1\" and \"nonneg_delay_conc cs2\"\n    using assms by auto\n  assume \"wp_conc cs1 (wp_conc cs2 Q) x\"\n  hence \"\\<forall>tw tw'. x , cs1 \\<Rightarrow>\\<^sub>c tw \\<and> tw , cs2 \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> Q tw'\"\n    unfolding wp_conc_def by meson\n  thus \"wp_conc (cs1 || cs2) Q x\"\n    unfolding wp_conc_def sym[OF world_conc_exec_eq_world_conc_exec_alt[OF assms]]\n    by (metis (mono_tags, hide_lams) \\<open>\\<And>tw. world_conc_exec tw (cs1 || cs2) = world_conc_exec_alt tw\n    (cs1 || cs2)\\<close> \\<open>wp_conc cs1 (wp_conc cs2 Q) x\\<close> assms(1) assms(2) conc_hoare_valid_def\n    parallel_valid wp_conc_def)\nqed\n\nlemma wp_conc_parallel2:\n  assumes \"conc_stmt_wf (cs1 || cs2)\" and \"nonneg_delay_conc (cs1 || cs2)\"\n  shows \"wp_conc (cs1 || cs2) Q =  wp_conc cs2 (wp_conc cs1 Q)\"\nproof (rule ext, rule)\n  fix x\n  have \"conc_stmt_wf cs1\" and \"conc_stmt_wf cs2\"\n    using assms  by (simp add: conc_stmt_wf_def)+\n  have \"nonneg_delay_conc cs1\" and \"nonneg_delay_conc cs2\"\n    using assms by auto\n  assume \"wp_conc (cs1 || cs2) Q x\"\n  hence \"\\<forall>tw'. x , cs1 || cs2 \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> Q tw'\"\n    unfolding wp_conc_def by auto\n  thus\" wp_conc cs2 (wp_conc cs1 Q) x\"\n    unfolding wp_conc_def sym[OF world_conc_exec_eq_world_conc_exec_alt[OF assms]]\n    sym[OF world_conc_exec_eq_world_conc_exec_alt[OF `conc_stmt_wf cs1` `nonneg_delay_conc cs1`]]\n    sym[OF world_conc_exec_eq_world_conc_exec_alt[OF `conc_stmt_wf cs2` `nonneg_delay_conc cs2`]]\n    using assms(1) assms(2) world_conc_exec_alt.intros(4) world_conc_exec_alt_imp_world_conc_exec\n    by blast\nnext\n  fix x\n  have \"conc_stmt_wf cs1\" and \"conc_stmt_wf cs2\"\n    using assms  by (simp add: conc_stmt_wf_def)+\n  have \"nonneg_delay_conc cs1\" and \"nonneg_delay_conc cs2\"\n    using assms by auto\n  have \"conc_stmt_wf (cs2 || cs1)\" and \"nonneg_delay_conc (cs2 || cs1)\"\n    using assms\n    by (metis conc_stmt_wf_def disjoint_iff_not_equal distinct_append signals_from.simps(2))\n       (simp add: \\<open>nonneg_delay_conc cs1\\<close> \\<open>nonneg_delay_conc cs2\\<close>)\n  assume \"wp_conc cs2 (wp_conc cs1 Q) x\"\n  hence \"\\<forall>tw tw'. x , cs2 \\<Rightarrow>\\<^sub>c tw \\<and> tw , cs1 \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> Q tw'\"\n    unfolding wp_conc_def  by meson\n  hence \"wp_conc (cs2 || cs1) Q x\"\n    unfolding wp_conc_def\n    using sym[OF world_conc_exec_eq_world_conc_exec_alt[OF `conc_stmt_wf (cs2 || cs1)` `nonneg_delay_conc (cs2 || cs1)`]]\n    by (metis \\<open>conc_stmt_wf (cs2 || cs1)\\<close> \\<open>nonneg_delay_conc (cs2 || cs1)\\<close> wp_conc_def wp_conc_parallel)\n  thus \"wp_conc (cs1 || cs2) Q x\"\n    unfolding wp_conc_def by (smt assms(1) parallel_comp_commute' world_conc_exec.intros world_conc_exec_cases)\nqed\n\nlemma wp_conc_is_pre:\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows \"\\<turnstile> \\<lbrace>wp_conc cs Q\\<rbrace> cs \\<lbrace>Q\\<rbrace>\"\n  using assms\nproof (induction cs arbitrary:Q)\n  case (Bpar cs1 cs2)\n  hence \"conc_stmt_wf cs1\" and \"conc_stmt_wf cs2\" and \"nonneg_delay_conc cs1\" and \"nonneg_delay_conc cs2\"\n    by auto\n  hence \"\\<And>Q.  \\<turnstile> \\<lbrace>wp_conc cs1 Q\\<rbrace> cs1 \\<lbrace>Q\\<rbrace>\" and \"\\<And>Q.  \\<turnstile> \\<lbrace>wp_conc cs2 Q\\<rbrace> cs2 \\<lbrace>Q\\<rbrace>\"\n    using Bpar(1-2) by auto\n  then show ?case\n    unfolding wp_conc_parallel[OF Bpar(3-4)]\n    by (auto intro!: Parallel simp add: Bpar)\nnext\n  case (Bsingle sl ss)\n  hence \"nonneg_delay ss\"\n    by auto\n  then show ?case  unfolding wp_conc_single\n    by (auto intro!: Single simp add: hoare_sound_complete seq_hoare_valid2_def wp_def)\nqed\n\nlemma conc_hoare_complete:\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  assumes \"\\<Turnstile> \\<lbrace>P\\<rbrace> cs \\<lbrace>Q\\<rbrace>\" shows \"\\<turnstile> \\<lbrace>P\\<rbrace> cs \\<lbrace>Q\\<rbrace>\"\nproof (rule strengthen_pre_conc_hoare)\n  show \" \\<forall>tw. P tw \\<longrightarrow> wp_conc cs Q tw\" using assms\n    by (metis conc_hoare_valid_def wp_conc_def)\nnext\n  show \"\\<turnstile> \\<lbrace>wp_conc cs Q\\<rbrace> cs \\<lbrace>Q\\<rbrace>\"\n    using assms by (intro wp_conc_is_pre)\nqed\n\ncorollary conc_hoare_sound_and_complete:\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows \"\\<turnstile> \\<lbrace>P\\<rbrace> cs \\<lbrace>Q\\<rbrace> \\<longleftrightarrow> \\<Turnstile> \\<lbrace>P\\<rbrace> cs \\<lbrace>Q\\<rbrace>\"\n  using conc_hoare_complete soundness_conc_hoare assms by auto\n\nlemma push_rem_curr_trans_purge_raw:\n  assumes \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n  shows \"(purge_raw \\<tau> t dly sig def val)(t:=0) = purge_raw (\\<tau>(t:=0)) t dly sig def val\"\nproof -\n  have \"\\<tau> (t:=0) = \\<tau>\"\n    using assms by auto\n  hence **: \"purge_raw (\\<tau>(t:=0)) t dly sig def val = purge_raw \\<tau> t dly sig def val\"\n    by auto\n  let ?s1 = \"signal_of def \\<tau> sig t\"\n  let ?s2 = \"signal_of def \\<tau> sig (t + dly)\"\n  let ?k2 = \"inf_time (to_trans_raw_sig \\<tau>) sig (t + dly)\"\n  have \"(?s1 = val \\<or> ?s2 \\<noteq> val) \\<or> (?s1 \\<noteq> val \\<and> ?s2 = val)\"\n    by auto\n  moreover\n  { assume \"?s1 = val \\<or> ?s2 \\<noteq> val\"\n    hence *: \"purge_raw \\<tau> t dly sig def val = override_on \\<tau> (\\<lambda>n. (\\<tau> n)(sig := None)) {t<..t + dly}\"\n      unfolding purge_raw_def by auto\n    hence \"(purge_raw \\<tau> t dly sig def val)(t:=0) = (override_on \\<tau> (\\<lambda>n. (\\<tau> n)(sig := None)) {t<..t + dly})(t:=0)\"\n      by auto\n    also have \"... = override_on \\<tau> (\\<lambda>n. (\\<tau> n)(sig := None)) {t<..t + dly}\"\n      by (metis \\<open>\\<tau>(t := 0) = \\<tau>\\<close> \\<open>purge_raw \\<tau> t dly sig def val = override_on \\<tau> (\\<lambda>n. (\\<tau> n)(sig :=\n      None)) {t<..t + dly}\\<close> dual_order.refl fun_upd_idem_iff purge_raw_before_now_unchanged)\n    also have \"... = purge_raw \\<tau> t dly sig def val\"\n      using * by auto\n    finally have ?thesis\n      using ** by auto }\n  moreover\n  { assume \"?s1 \\<noteq> val \\<and> ?s2 = val\"\n    hence \"purge_raw \\<tau> t dly sig def val = override_on \\<tau> (\\<lambda>n. (\\<tau> n)(sig := None)) ({t<..<the ?k2} \\<union> {the ?k2<..t + dly})\"\n      (is \"?lhs = ?rhs\") unfolding purge_raw_def Let_def by auto\n    hence \"?lhs(t:=0) = ?rhs(t:=0)\"\n      by auto\n    have \"t < the ?k2\"\n    proof -\n      have \"?s1 \\<noteq> val\" and \"?s2 = (val)\"\n        using `?s1 \\<noteq>  val \\<and> ?s2 = val` by auto\n      have \"\\<exists>n>t. n \\<le> t + dly \\<and> \\<tau> n sig = Some val\"\n        using switch_signal_ex_mapping[OF `?s1 \\<noteq> val` `?s2 = (val)`] assms\n        by (simp add: zero_fun_def)\n      hence \"?k2 \\<noteq> None\"\n        by (metis add.commute inf_time_noneE2 option.discI semiring_normalization_rules(24)\n        to_trans_raw_sig_def zero_option_def)\n      then obtain k where \"?k2 = Some k\"\n        by auto\n      hence \"\\<tau> k sig \\<noteq> None\"\n        by (metis domIff dom_def inf_time_some_exists keys_def to_trans_raw_sig_def zero_option_def)\n      hence \"t < k\"\n        using assms  by (metis (full_types) not_less zero_fun_def zero_option_def)\n      thus ?thesis\n        by (simp add: \\<open>inf_time (to_trans_raw_sig \\<tau>) sig (t + dly) = Some k\\<close>)\n    qed\n    hence \"?rhs(t:=0) = ?rhs\"\n      by (metis \\<open>\\<tau>(t := 0) = \\<tau>\\<close> \\<open>purge_raw \\<tau> t dly sig def val = override_on \\<tau> (\\<lambda>n. (\\<tau> n)(sig :=\n      None)) ({t<..<the (inf_time (to_trans_raw_sig \\<tau>) sig (t + dly))} \\<union> {the (inf_time\n      (to_trans_raw_sig \\<tau>) sig (t + dly))<..t + dly})\\<close> fun_upd_idem_iff order.order_iff_strict\n      purge_raw_before_now_unchanged)\n    also have \"... = ?lhs\"\n      using `?lhs = ?rhs` by auto\n    finally have \"?lhs(t:=0) = ?lhs\"\n      using \\<open>purge_raw \\<tau> t dly sig def val = override_on \\<tau> (\\<lambda>n. (\\<tau> n)(sig := None)) ({t<..<the\n      (inf_time (to_trans_raw_sig \\<tau>) sig (t + dly))} \\<union> {the (inf_time (to_trans_raw_sig \\<tau>) sig (t +\n      dly))<..t + dly})\\<close> by auto\n    hence ?thesis\n      by (simp add: \\<open>\\<tau>(t := 0) = \\<tau>\\<close>) }\n  ultimately show ?thesis\n    by auto\nqed\n\nlemma post_necessary_raw_rem_curr_trans:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  shows \"post_necessary_raw n \\<tau> t s val (\\<sigma> s) \\<longleftrightarrow> post_necessary_raw n (\\<tau>(t:=0)) t s val (\\<sigma> s)\"\nproof\n  assume \"post_necessary_raw n \\<tau> t s val (\\<sigma> s)\"\n  hence \"(\\<exists>i val'. i \\<le> t + n \\<and>  \\<tau> i s = Some val' \\<and> val' \\<noteq> val \\<and> (\\<forall>j>i. j \\<le> t + n \\<longrightarrow>  \\<tau> j s = None))\n                                      \\<or>   (\\<forall>i. i \\<le> t + n \\<longrightarrow>  \\<tau> i s = None) \\<and> val \\<noteq> (\\<sigma> s)\"\n    (is \"?case1 \\<or> ?case2\")\n    unfolding post_necessary_raw_correctness2 by blast\n  moreover\n  { assume \"?case1\"\n    then obtain i val' where \"i \\<le> t + n\" and \" \\<tau> i s = Some val' \\<and> val' \\<noteq> val \\<and> (\\<forall>j>i. j \\<le> t + n \\<longrightarrow>  \\<tau> j s = None) \"\n      by auto\n    hence \"t < i\"\n      using assms unfolding context_invariant_def\n      by (metis domI domIff not_le_imp_less zero_fun_def zero_option_def)\n    hence \"(\\<exists>i. i \\<le> t + n \\<and>  (\\<tau>(t:=0)) i s = Some val' \\<and> val' \\<noteq> val \\<and> (\\<forall>j>i. j \\<le> t + n \\<longrightarrow>  (\\<tau>(t:=0)) j s = None))\"\n      using `i \\<le> t + n` ` \\<tau> i s = Some val' \\<and> val' \\<noteq> val \\<and> (\\<forall>j>i. j \\<le> t + n \\<longrightarrow>  \\<tau> j s = None)`\n      by (metis fun_upd_apply nat_less_le zero_fun_def zero_option_def)\n    hence \"post_necessary_raw n (\\<tau>(t:=0)) t s val (\\<sigma> s)\"\n      by (metis (no_types, lifting) \\<open>post_necessary_raw n \\<tau> t s val (\\<sigma> s)\\<close> assms context_invariant_def fun_upd_idem_iff less_irrefl_nat not_less) }\n  moreover\n  { assume \"?case2\"\n    hence \"(\\<forall>i. i \\<le> t + n \\<longrightarrow>  (\\<tau>(t:=0)) i s = None) \\<and> val \\<noteq> \\<sigma> s\"\n      by (auto simp add: zero_fun_def zero_option_def)\n    hence \"post_necessary_raw n (\\<tau>(t:=0)) t s val (\\<sigma> s)\"\n      by (metis signal_of_def zero_option_def) }\n  ultimately show \"post_necessary_raw n (\\<tau>(t:=0)) t s val (\\<sigma> s)\"\n    by auto\nnext\n  assume \"post_necessary_raw n (\\<tau>(t:=0)) t s val (\\<sigma> s)\"\n  hence \"(\\<exists>i val'. i \\<le> t + n \\<and>  (\\<tau>(t:=0)) i s = Some val' \\<and> val' \\<noteq> val \\<and> (\\<forall>j>i. j \\<le> t + n \\<longrightarrow>  (\\<tau>(t:=0)) j s = None))\n                                      \\<or>   (\\<forall>i. i \\<le> t + n \\<longrightarrow>  (\\<tau>(t:=0)) i s = None) \\<and> val \\<noteq> (\\<sigma> s)\"\n    (is \"?case1 \\<or> ?case2\") unfolding post_necessary_raw_correctness2 by auto\n  moreover\n  { assume \"?case1\"\n    then obtain i val' where \"i \\<le> t + n\" and \" ((\\<tau>(t:=0)) i s = Some val' \\<and> val' \\<noteq> val \\<and> (\\<forall>j>i. j \\<le> t + n \\<longrightarrow>  (\\<tau>(t:=0)) j s = None)) \"\n      by auto\n    hence \"i \\<ge> t\"\n      using assms unfolding context_invariant_def\n      by (metis fun_upd_triv le_refl nat_le_linear option.discI zero_fun_def zero_option_def)\n    hence \"i \\<noteq> t\"\n      by (metis \\<open>(\\<tau>(t := 0)) i s = Some val' \\<and> val' \\<noteq> val \\<and> (\\<forall>j>i. j \\<le> t + n \\<longrightarrow> (\\<tau>(t := 0)) j s = None)\\<close>\n      fun_upd_apply option.distinct(1) zero_fun_def zero_option_def)\n    hence \" \\<tau> i s = Some val' \\<and> val' \\<noteq> val \\<and> (\\<forall>j>i. j \\<le> t + n \\<longrightarrow>  \\<tau> j s = None)\"\n      using ` (\\<tau>(t:=0)) i s = Some val' \\<and> val' \\<noteq> val \\<and> (\\<forall>j>i. j \\<le> t + n \\<longrightarrow>  (\\<tau>(t:=0)) j s = None)` `i \\<ge> t`\n      by auto\n    with `i \\<ge> t` and `i \\<le> t + n` have \"post_necessary_raw n ( \\<tau>) t s val (\\<sigma> s)\"\n      by (metis (no_types, lifting) \\<open>post_necessary_raw n (\\<tau>(t := 0)) t s val (\\<sigma> s)\\<close> assms\n      context_invariant_def fun_upd_idem_iff order_refl) }\n  moreover\n  { assume \"?case2\"\n    have \" \\<tau> t s = None \\<or>  \\<tau> t s = Some (\\<sigma> s)\"\n      using assms unfolding context_invariant_def by (simp add: zero_fun_def zero_option_def)\n    moreover\n    { assume \" \\<tau> t s = None\"\n      with `?case2` have \"(\\<forall>i\\<ge>t. i \\<le> t + n \\<longrightarrow>  \\<tau> i s = None) \\<and> val \\<noteq> \\<sigma> s\"\n        by (metis (full_types) fun_upd_apply)\n      hence \"post_necessary_raw n ( \\<tau>) t s val (\\<sigma> s)\"\n        by (metis (mono_tags, lifting) \\<open>post_necessary_raw n (\\<tau>(t := 0)) t s val (\\<sigma> s)\\<close> assms\n        context_invariant_def dual_order.refl fun_upd_idem) }\n    moreover\n    { assume \" \\<tau> t s = Some (\\<sigma> s)\"\n      hence \"(\\<exists>i val'. i \\<le> t + n \\<and>  \\<tau> i s = Some val' \\<and> val' \\<noteq> val \\<and> (\\<forall>j>i. j \\<le> t + n \\<longrightarrow>  \\<tau> j s = None))\"\n        using `?case2`\n        apply(intro exI[where x=\"t\"])\n        unfolding rem_curr_trans_def  using le_eq_less_or_eq context_invariant_def by auto\n      hence \"post_necessary_raw n ( \\<tau>) t s val (\\<sigma> s)\"\n        unfolding post_necessary_raw_correctness2 by auto }\n    ultimately have \"post_necessary_raw n ( \\<tau>) t s val (\\<sigma> s)\"\n      by auto }\n  ultimately show \"post_necessary_raw n ( \\<tau>) t s val (\\<sigma> s)\"\n    by auto\nqed\n\nlemma context_invariant_purged:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  shows \"context_invariant t \\<sigma> \\<gamma> \\<theta> def (purge_raw \\<tau> t dly sig (def sig) val)\"\nproof -\n  have \"\\<forall>n\\<le>t.  \\<tau> n = 0\" and \"\\<gamma> = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)}\" and \"\\<forall>n\\<ge>t.  \\<theta> n = 0\"\n    using assms unfolding context_invariant_def by auto\n  moreover hence \"\\<forall>n < t. (purge_raw \\<tau> t dly sig (def sig) val) n = 0\"\n    by (simp add: purge_preserve_trans_removal)\n  ultimately show ?thesis\n    unfolding context_invariant_def by (metis purge_raw_before_now_unchanged)\nqed\n\nlemma context_invariant_purged':\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  shows \"context_invariant t \\<sigma> \\<gamma> \\<theta> def (purge_raw' \\<tau> t dly sig (def sig) val)\"\nproof -\n  have \"\\<forall>n\\<le>t.  \\<tau> n = 0\" and \"\\<gamma> = {s. \\<sigma> s \\<noteq> signal_of (def s) \\<theta> s (t - 1)}\" and \"\\<forall>n\\<ge>t.  \\<theta> n = 0\"\n    using assms unfolding context_invariant_def by auto\n  moreover hence \"\\<forall>n < t. (purge_raw' \\<tau> t dly sig (def sig) val) n = 0\"\n    by (simp add: purge_preserve_trans_removal')\n  ultimately show ?thesis\n    unfolding context_invariant_def by (metis purge_raw'_before_now_unchanged)\nqed\n\nlemma b_seq_exec_mono_wrt_rem_curr_trans:\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n  assumes \"nonneg_delay ss\"\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  shows \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss, \\<tau>(t:=0)> \\<longrightarrow>\\<^sub>s \\<tau>'(t:=0)\"\n  using assms\nproof (induction rule: b_seq_exec.inducts)\n  case (1 t \\<sigma> \\<gamma> \\<theta> def \\<tau>)\n  then show ?case\n    using b_seq_exec.intros(1) by blast\nnext\n  case (2 t \\<sigma> \\<gamma> \\<theta> def ss1 \\<tau> \\<tau>'' ss2 \\<tau>')\n  then show ?case\n    using b_seq_exec_preserves_context_invariant\n    by (metis b_seq_exec.intros(2) nonneg_delay.simps(2))\nnext\n  case (3 t \\<sigma> \\<gamma> \\<theta> def guard ss1 \\<tau> \\<tau>' ss2)\n  then show ?case\n    by (metis b_seq_exec.intros(3) nonneg_delay.simps(3))\nnext\n  case (4 t \\<sigma> \\<gamma> \\<theta> def guard ss2 \\<tau> \\<tau>' ss1)\n  then show ?case\n    by (metis  b_seq_exec.intros(4) nonneg_delay.simps(3))\nnext\n  case (5 t \\<sigma> \\<gamma> \\<theta> def e x sig \\<tau> dly \\<tau>')\n  hence \"\\<tau>' = trans_post_raw sig x (\\<sigma> sig) \\<tau> t dly\" and \"0 < dly\"\n    using \"5.prems\"(1) by auto\n  hence \"\\<tau>'(t:=0) = (trans_post_raw sig x (\\<sigma> sig) \\<tau> t dly)(t:=0)\"\n    by auto\n  also have \"... = trans_post_raw sig x (\\<sigma> sig) (\\<tau>(t:=0)) t dly\"\n    using `0 < dly` post_necessary_raw_rem_curr_trans[OF `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>`]\n  proof -\n    have f1: \"\\<tau> t = 0\"\n      by (meson \"5.prems\"(2) context_invariant_def le_refl)\n    have \"\\<forall>f. trans_post_raw sig x (\\<sigma> sig) f t dly t = f t\"\n      by (metis (no_types) \"5.hyps\"(1) \"5.prems\"(1) b_seq_exec.intros(5) nonneg_delay_same)\n    then show ?thesis\n      using f1 by (metis (no_types) fun_upd_triv)\n  qed\n  finally show ?case\n    by (metis \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> e \\<longrightarrow>\\<^sub>b x\\<close> b_seq_exec.intros(5))\nnext\n  case (6 t \\<sigma> \\<gamma> \\<theta> def e x sig \\<tau> dly \\<tau>')\n  hence \\<tau>'_def: \"\\<tau>' = inr_post_raw' sig x (\\<sigma> sig) \\<tau> t dly\" and \"0 < dly\"\n    using \"6.prems\"(1) by auto\n  have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def (purge_raw' \\<tau> t dly sig (\\<sigma> sig) x)\"\n    using context_invariant_purged' `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>`\n    by (simp add: context_invariant_def purge_preserve_trans_removal_nonstrict')\n  have \"\\<tau>' = trans_post_raw sig x (\\<sigma> sig) (purge_raw' \\<tau> t dly sig (\\<sigma> sig) x) t dly\"\n    using \\<tau>'_def unfolding inr_post_raw'_def by auto\n  hence \"\\<tau>'(t:=0) = (trans_post_raw sig x (\\<sigma> sig) ((purge_raw' \\<tau> t dly sig (\\<sigma> sig) x)) t dly)(t:=0)\"\n    by auto\n  also have \"... = trans_post_raw sig x (\\<sigma> sig) ((purge_raw' \\<tau> t dly sig (\\<sigma> sig) x)(t:=0)) t dly\"\n    using `0 < dly` post_necessary_raw_rem_curr_trans[OF `context_invariant t \\<sigma> \\<gamma> \\<theta> def (purge_raw' \\<tau> t dly sig (\\<sigma> sig) x)`]\n  proof -\n    have f1: \"\\<forall>n. purge_raw' \\<tau> t dly sig (\\<sigma> sig) x n = 0 \\<or> \\<not> n \\<le> t\"\n      by (meson \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def (purge_raw' \\<tau> t dly sig (\\<sigma> sig) x)\\<close> context_invariant_def)\n    have \"\\<forall>f n a. trans_post_raw a x (\\<sigma> a) f t n t = f t \\<or> \\<not> nonneg_delay (Bassign_trans a e n)\"\n      by (metis (no_types) \"6.hyps\"(1) b_seq_exec.intros(5) nonneg_delay_same)\n    then show ?thesis\n      using f1 by (metis \\<open>0 < dly\\<close> dual_order.refl fun_upd_triv nonneg_delay.simps(4))\n  qed\n  also have \"... = trans_post_raw sig x (\\<sigma> sig) (purge_raw' (\\<tau>(t:=0)) t dly sig (\\<sigma> sig) x) t dly\"\n    unfolding push_rem_curr_trans_purge_raw\n    by (metis (mono_tags, lifting) \"6.prems\"(2) \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def (purge_raw' \\<tau> t dly sig (\\<sigma> sig) x)\\<close> context_invariant_def fun_upd_idem_iff le_refl)\n  also have \"... = inr_post_raw' sig x (\\<sigma> sig) (\\<tau>(t:=0)) t dly\"\n    unfolding inr_post_raw'_def by auto\n  finally show ?case\n    by (metis \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> e \\<longrightarrow>\\<^sub>b x\\<close> b_seq_exec.intros(6))\nnext\n  case (7 t \\<sigma> \\<gamma> \\<theta> def exp x exp' ss \\<tau> \\<tau>' choices)\n  then show ?case\n    using b_seq_exec.intros(7) by force\nnext\n  case (8 t \\<sigma> \\<gamma> \\<theta> def exp x exp' x' choices \\<tau> \\<tau>' ss)\n  then show ?case\n    using b_seq_exec.intros(8) by force\nnext\n  case (9 t \\<sigma> \\<gamma> \\<theta> def ss \\<tau> \\<tau>' exp choices)\n  then show ?case\n    by (simp add: b_seq_exec.intros(9))\nnext\n  case (10 t \\<sigma> \\<gamma> \\<theta> def exp \\<tau>)\n  then show ?case\n    by (simp add: b_seq_exec.intros(10))\nqed\n\ntext \\<open>The following lemma is based on the assumption (premise) that @{term \"conc_stmt_wf cs\"}. This\nis because we want to employ the theorem @{thm \"b_conc_exec_sequential\"} where executing two parallel\nprocesses can be seen as executing two sequential processes. This is, of course, relies on the\nassumption that both processes do not modify the same signals.\n\nA more fundamental question arises: can we prove this theorem without this well-formedness premise\nand this theorem? We certainly would need to reason about @{term \"clean_zip\"} as this is the\nprimitive operation for handling parallel execution.\\<close>\n\nlemma b_conc_exec_mono_wrt_rem_curr_trans:\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  shows \"t, \\<sigma>, \\<gamma>, \\<theta>, def  \\<turnstile> <cs, \\<tau>(t:=0)> \\<longrightarrow>\\<^sub>c (\\<tau>'(t:=0))\"\n  using assms\nproof (induction cs arbitrary: \\<tau> \\<tau>')\n  case (Bpar cs1 cs2)\n  then obtain \\<tau>1 where \\<tau>1_def: \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def cs1 \\<tau> \\<tau>1\"\n    by blast\n  hence **: \"t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs1 , \\<tau>(t:=0)> \\<longrightarrow>\\<^sub>c \\<tau>1(t:=0)\"\n    using Bpar unfolding conc_stmt_wf_def by fastforce\n  have *: \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def cs2 \\<tau>1 \\<tau>'\"\n    using b_conc_exec_sequential[OF `conc_stmt_wf (cs1 || cs2)`] Bpar(3) \\<tau>1_def by auto\n  with Bpar have \"t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs2 , \\<tau>1(t:=0)> \\<longrightarrow>\\<^sub>c \\<tau>'(t:=0)\"\n    unfolding conc_stmt_wf_def\n    by (metis \\<tau>1_def b_conc_exec_preserves_context_invariant distinct_append\n    nonneg_delay_conc.simps(2) signals_from.simps(2))\n  then show ?case\n    using * Bpar(3)\n    by (metis (mono_tags, hide_lams) Bpar.prems(2) Bpar.prems(4) context_invariant_def fun_upd_triv\n    nonneg_delay_conc_same order_refl)\nnext\n  case (Bsingle sl ss)\n  hence \"nonneg_delay ss\"\n    by auto\n  have \"disjnt sl \\<gamma> \\<or> \\<not> disjnt sl \\<gamma>\"\n    by auto\n  moreover\n  { assume \"disjnt sl \\<gamma>\"\n    hence ?case\n      using Bsingle.prems(1) b_conc_exec.intros(1) by blast }\n  moreover\n  { assume \"\\<not> disjnt sl \\<gamma>\"\n    hence \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n      using Bsingle by auto\n    hence \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss, \\<tau>(t:=0)> \\<longrightarrow>\\<^sub>s \\<tau>'(t:=0)\"\n      using b_seq_exec_mono_wrt_rem_curr_trans[OF _ `nonneg_delay ss`]  by (simp add: Bsingle.prems(4))\n    hence ?case\n      using `\\<not> disjnt sl \\<gamma>` by (metis b_conc_exec.simps(1)) }\n  ultimately show ?case by auto\nqed\n\nlemma worldline_rem_curr_trans_eq:\n  assumes \"\\<And>s. s \\<in> dom (\\<tau> t) \\<Longrightarrow> \\<sigma> s = the (\\<tau> t s)\"\n  assumes \"\\<And>n. n < t \\<Longrightarrow> \\<tau> n = 0\"\n  shows \"worldline2 t \\<sigma> \\<theta> def \\<tau> = worldline2 t \\<sigma> \\<theta> def (\\<tau>(t:=0))\"\n  using assms unfolding worldline2_def worldline_raw_def\n  using signal_of_rem_curr_trans_at_t[where \\<sigma>=\"\\<sigma>\" and \\<tau>=\"\\<tau>\", OF assms]\n  by presburger\n\nlemma worldline2_constructible_rem_curr_trans:\n  fixes tw :: \"nat \\<times> 'signal worldline_init\"\n  assumes \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n  defines \"\\<tau>' \\<equiv> \\<tau>(t:=0)\"\n  shows \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau>' \\<and> context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\nproof -\n  have \"fst tw = t\" and \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau> \\<and> context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using worldline2_constructible[OF assms(1)] by auto\n  hence \"\\<And>n. n \\<le> t \\<Longrightarrow>  \\<tau> n = 0\"\n    and \" tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\"\n    and \" context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    unfolding context_invariant_def by auto\n  hence \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau>'\"\n    unfolding \\<tau>'_def by (metis fun_upd_triv order_refl)\n  moreover have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n    unfolding \\<tau>'_def using context_invariant_rem_curr_trans[OF `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>`]\n    by auto\n  ultimately show ?thesis\n    by auto\nqed\n\ninductive world_conc_exec2 :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\" where\n  \"   destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\n  \\<Longrightarrow> b_conc_exec t \\<sigma> \\<gamma> \\<theta> def c (\\<tau>(t := 0)) \\<tau>'\n  \\<Longrightarrow> worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\n  \\<Longrightarrow> world_conc_exec2 tw c tw'\"\n\ninductive_cases world_conc_exec2_cases [elim!] : \"world_conc_exec2 tw c tw'\"\n\nlemma world_conc_exec_rem_curr_trans_eq_only_if:\n  assumes \"nonneg_delay_conc c\" and \"conc_stmt_wf c\"\n  assumes \"world_conc_exec tw c tw'\"\n  shows   \"world_conc_exec2 tw c tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and  ex: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <c, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\"\n    and ci: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using destruct_worldline_exist worldline2_constructible assms(3) by blast\n  hence ex2: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <c, \\<tau>(t:=0)> \\<longrightarrow>\\<^sub>c (\\<tau>'(t:=0))\"\n    using b_conc_exec_mono_wrt_rem_curr_trans[OF ex] assms(1-2) by blast\n  moreover have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n    using b_conc_exec_preserves_context_invariant[OF ex ci assms(1)] by auto\n  ultimately have \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = worldline2 t \\<sigma> \\<theta> def (\\<tau>'(t:=0))\"\n    using worldline_rem_curr_trans_eq unfolding context_invariant_def by (simp add: fun_upd_idem)\n  thus ?thesis\n    using des ex ex2\n    by (smt assms(3) destruct_worldline_no_trans_at_t fun_upd_idem world_conc_exec2.intros world_conc_exec_cases)\nqed\n\nsubsection \\<open>A sound and complete Hoare logic for VHDL's simulation\\<close>\n\ndefinition worldline_of_history :: \"'signal state \\<Rightarrow> 'signal trans_raw \\<Rightarrow> 'signal worldline\"\n  where \"worldline_of_history def \\<theta> s t \\<equiv> signal_of (def s) \\<theta> s t\"\n\ninductive world_sim_fin :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> nat \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\"\n  (\" _, _, _ \\<Rightarrow>\\<^sub>S _\") where\n  \"    destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\n   \\<Longrightarrow> T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto> (t', \\<sigma>', \\<theta>', \\<tau>')\n   \\<Longrightarrow> worldline_raw t' \\<sigma>' \\<theta>' def \\<tau>' = w'\n   \\<Longrightarrow> tw, T, cs \\<Rightarrow>\\<^sub>S (t', w')\"\n\ninductive_cases world_sim_fin: \"tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\n\nlemma world_sim_fin_parallel_commute:\n  assumes \"conc_stmt_wf (cs1 || cs2)\"\n  shows   \"tw, T, cs1 || cs2 \\<Rightarrow>\\<^sub>S tw' \\<longleftrightarrow> tw, T, cs2 || cs1 \\<Rightarrow>\\<^sub>S tw'\"\n  using assms b_simulate_fin_parallel_commute_eq  by (smt world_sim_fin.simps)\n\nlemma world_sim_fin_parallel_distrib:\n  assumes \"conc_stmt_wf ((cs1 || cs2) || cs3)\"\n  shows   \"tw, T, (cs1 || cs3) || (cs2 || cs3) \\<Rightarrow>\\<^sub>S tw' \\<longleftrightarrow> tw, T, ((cs1 || cs2) || cs3) \\<Rightarrow>\\<^sub>S tw'\"\n  using assms by (simp add: b_simulat_fin_parallel_distrib world_sim_fin.simps) \n\nlemma world_sim_fin_parallel_associative:\n  assumes \"conc_stmt_wf ((cs1 || cs2) || cs3)\"\n  shows   \"tw, T, (cs1 || cs2) || cs3 \\<Rightarrow>\\<^sub>S tw' \\<longleftrightarrow> tw, T, cs1 || cs2 || cs3 \\<Rightarrow>\\<^sub>S tw'\"\n  using assms by (simp add: b_simulate_fin_parallel_assoc world_sim_fin.simps)\n\nlemma b_simulate_fin_preserves_history_prop:\n  assumes \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto> res\"\n  assumes \"\\<forall>n\\<ge>t. \\<theta> n = 0\" and \"\\<forall>n \\<le> t. \\<tau> n = 0\"\n  shows   \"\\<forall>n\\<ge>T. get_beh res n = 0\"\n  using assms\nproof (induction rule: b_simulate_fin.inducts)\n  case (1 t maxtime \\<tau> \\<gamma> \\<sigma> \\<theta> def cs \\<tau>' res)\n  hence \"t \\<le> next_time t \\<tau>'\"\n    using next_time_at_least by (metis b_conc_exec_preserve_trans_removal less_or_eq_imp_le)\n  hence \"\\<forall>n\\<ge>next_time t \\<tau>'. add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>') n = 0\"\n    using 1(7) unfolding add_to_beh_def by auto\n  moreover have \"\\<forall>n\\<le>next_time t \\<tau>'. (\\<tau>'(next_time t \\<tau>' := 0)) n = 0\"\n    by (simp add: dual_order.order_iff_strict next_time_at_least2)\n  ultimately show ?case \n    using 1(6) by auto\nqed auto\n\nlemma b_simulate_fin_suc_preserves_history_prop:\n  assumes \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto>s res\"\n  assumes \"\\<forall>n\\<ge>t. \\<theta> n = 0\"\n  shows   \"\\<forall>n\\<ge>T. get_beh res n = 0\"\n  using assms\n  by (induction rule:b_simulate_fin_suc.inducts) auto\n\nlemma worldline_raw_semi_equivalent:\n  assumes \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto>  (t1, \\<sigma>1, \\<theta>1, \\<tau>1)\"\n  assumes \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto>s (t2, \\<sigma>2, \\<theta>2, \\<tau>2)\"\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"worldline_raw t1 \\<sigma>1 \\<theta>1 def \\<tau>1 = worldline_raw t2 \\<sigma>2 \\<theta>2 def \\<tau>2\"\nproof -        \n  have \"\\<forall>n \\<ge> T. \\<theta>1 n = 0\" and \"\\<forall>n\\<ge>T. \\<theta>2 n = 0\"\n    using b_simulate_fin_preserves_history_prop b_simulate_fin_suc_preserves_history_prop\n      assms unfolding context_invariant_def \n    by (metis (no_types, hide_lams) comp_eq_dest_lhs fst_conv snd_conv)+\n  hence * : \"\\<forall>s k. k \\<ge> T \\<longrightarrow> signal_of (def s) \\<theta>1 s k = signal_of (def s) \\<theta>1 s T\" \n    and **: \"\\<forall>s k. k \\<ge> T \\<longrightarrow> signal_of (def s) \\<theta>2 s k = signal_of (def s) \\<theta>2 s T\"\n    by (meson less_or_eq_imp_le signal_of_less_ind)+\n  have \"t1 = t2\" \n    using final_time_eq[OF assms(1-2)] by auto\n  moreover have \"\\<sigma>1 = \\<sigma>2\" and \"\\<tau>1 = \\<tau>2\" and \"\\<forall>s k. signal_of (def s) \\<theta>1 s k = signal_of (def s) \\<theta>2 s k\"\n    using b_simulate_fin_and_suc_semi_equivalent2[OF assms(1-5)] * **\n    by (metis \"*\" \"**\" \\<open>\\<forall>s k. k \\<le> T \\<longrightarrow> signal_of (def s) (get_beh (t1, \\<sigma>1, \\<theta>1, \\<tau>1)) s k = signal_of\n    (def s) (get_beh (t2, \\<sigma>2, \\<theta>2, \\<tau>2)) s k\\<close> comp_apply fst_conv le_cases snd_conv)+\n  ultimately show ?thesis\n    unfolding worldline_raw_def by presburger\nqed\n\n(* lemma\n  assumes \"fst tw \\<le> T\" and \"conc_wt \\<Gamma> cs\" and \"wityping \\<Gamma> (snd tw)\"\n  shows   \"\\<exists>tw'. tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    by (meson destruct_worldline_def)\n  hence \"fst tw = t\"\n    by (metis fst_conv fst_destruct_worldline)\n  then obtain t' \\<sigma>' \\<theta>' \\<tau>' where \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto> (t', \\<sigma>', \\<theta>', \\<tau>')\"\n    using assms  conc_wt_simulation_progress\n *)\n\ninductive world_sim_fin2 :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> nat \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\" where\n  \"    destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\n   \\<Longrightarrow> T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto>s (t', \\<sigma>', \\<theta>', \\<tau>')\n   \\<Longrightarrow> worldline_raw t' \\<sigma>' \\<theta>' def \\<tau>' = w'\n   \\<Longrightarrow> world_sim_fin2 tw T cs (t', w')\"\n\ninductive_cases world_sim_fin2: \"world_sim_fin2 tw T cs tw'\"\n\nlemma world_sim_fin_semi_equivalent:\n  assumes \"world_sim_fin tw T cs tw1\"\n  assumes \"world_sim_fin2 tw T cs tw2\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"tw1 = tw2\"\n  using assms\nproof (induction rule:world_sim_fin.inducts)\n  case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> T cs t' \\<sigma>' \\<theta>' \\<tau>' w')\n  show ?case \n    using 1(4) 1(1-3) 1(5-6)\n  proof (induction rule:world_sim_fin2.inducts)\n    case (1 tw t1 \\<sigma>1 \\<gamma>1 \\<theta>1 def1 \\<tau>1 T cs t1' \\<sigma>1' \\<theta>1' \\<tau>1' w1')\n    hence \"t1 = t\" and \"\\<sigma>1 = \\<sigma>\" and \"\\<gamma>1 = \\<gamma>\" and \"def1 = def\" and \"\\<tau>1 = \\<tau>\"\n      by auto\n    moreover have \"t' = t1'\"\n      using \"1.hyps\"(1) \"1.hyps\"(2) \"1.prems\"(1) \"1.prems\"(2) final_time_eq by fastforce\n    ultimately have *: \"T, t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs , \\<tau>> \\<leadsto>s (t1', \\<sigma>1', \\<theta>1', \\<tau>1')\"\n      using 1(2) using \"1.hyps\"(1) \"1.prems\"(1) by auto\n    have \"w' = w1'\"\n      using worldline_raw_semi_equivalent[OF 1(5) * _ 1(7-8)] worldline2_constructible\n      1(3) 1(6) \"1.prems\"(1) \\<open>def1 = def\\<close> by blast\n    then show ?case \n      using `t' = t1'` by auto\n  qed\nqed\n\nlemma only_context_matters_for_sim_fin2:\n  assumes \"world_sim_fin tw T cs tw'\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"\\<exists>tw2. world_sim_fin2 tw T cs tw2\"\n  using assms\nproof (induction rule:world_sim_fin.inducts)\n  case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> T cs t' \\<sigma>' \\<theta>' \\<tau>' w')\n  have *: \"\\<forall>n\\<le>t. \\<tau> n = 0\" \n    using 1(1) destruct_worldline_trans_zero_upto_now by blast\n  moreover have **: \"\\<forall>n\\<ge>t. \\<theta> n = 0\"\n    using 1(1) by (meson context_invariant_def worldline2_constructible)\n  ultimately obtain t1 \\<sigma>1 \\<theta>1 \\<tau>1 where res2: \"T, t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs , \\<tau>> \\<leadsto>s (t1, \\<sigma>1, \\<theta>1, \\<tau>1)\"\n    using only_context_matters_for_simulate_fin_suc_progress2[OF 1(2) * 1(4-5) **] by auto\n  show ?case \n    apply (rule exI)\n    apply (rule world_sim_fin2.intros[OF 1(1) res2]) \n    by auto\nqed\n\nlemma world_sim_fin_imp_fin2:\n  assumes \"world_sim_fin tw T cs tw1\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"world_sim_fin2 tw T cs tw1\"\n  using only_context_matters_for_sim_fin2[OF assms] world_sim_fin_semi_equivalent[OF assms(1) _ assms(2-3)]\n  by auto\n\nlemma world_sim_fin2_imp_fin:\n  assumes \"world_sim_fin2 tw T cs tw1\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"\\<exists>tw2. world_sim_fin tw T cs tw2\"\n  using assms\nproof (induction rule:world_sim_fin2.inducts)\n  case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> T cs t' \\<sigma>' \\<theta>' \\<tau>' w')\n  then obtain res where res: \"T, t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs , \\<tau>> \\<leadsto> res\"\n    using b_sim_fin_suc_progress_for_b_sim_fin[OF 1(2) _ `nonneg_delay_conc cs` `conc_stmt_wf cs`]\n    by (metis (no_types, lifting) context_invariant_def worldline2_constructible)\n  then obtain \\<theta>_res where \"res = (t', \\<sigma>', \\<theta>_res, \\<tau>') \\<and> (\\<forall>s k. k \\<le> T \\<longrightarrow> signal_of (def s) \\<theta>_res s k = signal_of (def s) \\<theta>' s k)\"\n    using b_simulate_fin_and_suc_semi_equivalent2[OF res 1(2) _ `nonneg_delay_conc cs` `conc_stmt_wf cs`]\n    worldline2_constructible[OF 1(1)] \n    by (metis (no_types, hide_lams) \"1.hyps\"(2) comp_apply final_time_b_simulate_fin_suc fst_conv\n    maxtime_lt_fst_tres prod.exhaust_sel snd_conv)\n  moreover have \"t' = T\"\n    using \"1.hyps\"(2) final_time_b_simulate_fin_suc by fastforce\n  ultimately have \"worldline_raw t' \\<sigma>' \\<theta>_res def \\<tau>' = w'\"\n    using 1(3) unfolding worldline_raw_def by (auto intro!: ext)\n  then show ?case \n    using 1 \\<open>res = (t', \\<sigma>', \\<theta>_res, \\<tau>') \\<and> (\\<forall>s k. k \\<le> T \\<longrightarrow> signal_of (def s) \\<theta>_res s k = signal_of (def\n    s) \\<theta>' s k)\\<close> res world_sim_fin.intros by blast\nqed\n\nlemma world_sim_fin2_eq_world_sim_fin:\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"world_sim_fin2 tw T cs = world_sim_fin tw T cs\"\nproof (rule, rule)\n  fix x\n  assume \"world_sim_fin2 tw T cs x\" thus \"tw, T, cs \\<Rightarrow>\\<^sub>S x\"\n    using world_sim_fin2_imp_fin[OF \\<open>world_sim_fin2 tw T cs x\\<close> assms] world_sim_fin_semi_equivalent[OF _ \\<open>world_sim_fin2 tw T cs x\\<close> assms] \n    by blast\nnext\n  fix x\n  assume \"tw, T, cs \\<Rightarrow>\\<^sub>S x\" thus \"world_sim_fin2 tw T cs x\"\n    using world_sim_fin_imp_fin2[OF \\<open>tw, T, cs \\<Rightarrow>\\<^sub>S x\\<close> assms] by auto\nqed\n  \nlemma\n  assumes \"T = fst tw\"\n  shows \"tw, T, cs \\<Rightarrow>\\<^sub>S tw\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    by (meson destruct_worldline_def)\n  hence \"fst tw = t\"\n    unfolding destruct_worldline_def Let_def by auto\n  with assms have \"T = t\"\n    by auto\n  hence sim: \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto> (T, \\<sigma>, \\<theta>, \\<tau>)\"\n    by (intro b_simulate_fin.intros(4)) auto\n  define w' where \"w' = worldline_raw (max T t) \\<sigma> \\<theta> def \\<tau>\"\n  have \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\" and \" context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using worldline2_constructible[OF des] by auto\n  hence \"snd tw = worldline_raw t \\<sigma> \\<theta> def \\<tau>\"\n    unfolding worldline2_def by auto\n  also have \"... = w'\"\n    unfolding w'_def worldline_raw_def using `T = t`\n    by fastforce\n  finally have \"snd tw = w'\"\n    by auto\n  moreover have \"max T t = t\"\n    using `T = t` by auto\n  ultimately show ?thesis\n    using des sim w'_def\n    by (simp add: \\<open>T = t\\<close> \\<open>tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\\<close> world_sim_fin.intros worldline2_def)\nqed\n\nlemma premises_of_world_sim_fin:\n  assumes \"tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\n  shows \"\\<exists>t \\<sigma> \\<gamma> \\<theta> def \\<tau> tres. destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>) \\<and> (T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto> tres)\n                          \\<and> worldline_raw (get_time tres) (get_state tres) (get_beh tres) def (get_trans tres) = snd tw' \\<and> fst tw = t \\<and> fst tw' = get_time tres\"\n  using world_sim_fin[OF assms]\n  by (smt comp_apply fst_conv fst_destruct_worldline snd_conv)\n\nlemma premises_of_world_sim_fin':\n  assumes \"tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\n  obtains t \\<sigma> \\<gamma> \\<theta> def \\<tau> tres where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto> tres\" and   \"worldline_raw (get_time tres) (get_state tres) (get_beh tres) def (get_trans tres) = snd tw'\"\n    and \"fst tw = t\" and \"fst tw' = get_time tres\"\n  using premises_of_world_sim_fin[OF assms] by auto\n\nlemma world_maxtime_lt_fst_tres:\n  assumes \"tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\n  shows \"T = fst tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> tres where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n                              \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto> tres\" and\n                              \"worldline_raw (get_time tres) (get_state tres) (get_beh tres) def (get_trans tres) = snd tw'\"\n                          and \"fst tw = t\" and \"fst tw' = get_time tres\"\n    using premises_of_world_sim_fin'[OF assms] by blast\n  thus ?thesis\n    using maxtime_lt_fst_tres by metis\nqed\n\ndefinition\nsim_hoare_valid :: \"'signal assn2 \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\" (\"\\<Turnstile>\\<^sub>s \\<lbrace>(1_)\\<rbrace>/ (_)/ \\<lbrace>(1_)\\<rbrace>\" 50)\nwhere \"\\<Turnstile>\\<^sub>s \\<lbrace>P\\<rbrace> cs \\<lbrace>Q\\<rbrace> \\<longleftrightarrow> (\\<forall>tw T tw'. P tw \\<and> (tw, T, cs \\<Rightarrow>\\<^sub>S tw') \\<longrightarrow> Q tw')\"\n\ndefinition worldline_deg :: \"'signal worldline \\<Rightarrow> nat\" where\n  \"worldline_deg w = (LEAST n. \\<forall>t > n. \\<forall>s. w s t =  w s n)\"\n\ndefinition world_quiet :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> bool\" where\n  \"world_quiet tw \\<longleftrightarrow> fst tw > worldline_deg (wline_of tw)\"\n\ndefinition next_time_world :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> nat\" where\n  \"next_time_world tw =  (let t  = fst tw; w = snd tw;\n                              \\<tau>  = derivative_raw w t\n                          in\n                              Femto_VHDL_raw.next_time t \\<tau>)\"\n\ntext \\<open>In the definition of @{term \"next_time_world\"} above, note that after we ``differentiate''\n--- perform @{term \"derivative_raw\"} operation which is a term borrowed from the domain of real\nanalysis --- the worldline, we need to remove the current transaction at time @{term \"t\"}. Why?\n\nThis is due to the nature of the derivative operation itself. By peeking into its definition,\nthere will always be a mapping posted at time @{term \"t\"}. If we do not remove this mapping, the\n@{term \"next_time\"} operation performed next will always return time @{term \"t\"} --- because\nof the @{term \"Least\"} operator inside the definition of @{term \"next_time\"} --- and we cannot\nadvance to the actual next time.\\<close>\n\nlemma exist_least_nonzero_sig:\n  fixes t :: \"nat\"\n  assumes \"\\<forall>n. n \\<le> t \\<longrightarrow> \\<tau> n = 0\"\n  assumes \"\\<tau> \\<noteq> 0\"\n  shows \"\\<exists>t' sig val. t < t' \\<and> \\<tau> t' sig = Some val \\<and> (\\<forall>n>t. n < t' \\<longrightarrow> \\<tau> n sig = None)\"\nproof -\n  obtain t' sig where *: \" \\<tau> t' sig \\<noteq> None\"\n    using assms(2) unfolding zero_fun_def zero_option_def by (metis)\n  hence \"t' > t\"\n    using assms(1) by (metis leI option.distinct(1) zero_fun_def zero_option_def)\n  hence **: \"\\<exists>t'>t .  \\<tau> t' sig \\<noteq> None\"\n    using * by auto\n  define time where \"time = (LEAST n. t < n \\<and>  \\<tau> n sig \\<noteq> None)\"\n  hence \" \\<tau> time sig \\<noteq> None\" and \"time > t\"\n    using LeastI_ex[OF **] by auto\n  have \"\\<forall>n > t. n < time \\<longrightarrow>  \\<tau> n sig = None\"\n    using not_less_Least time_def by blast\n  thus ?thesis\n    using ` \\<tau> time sig \\<noteq> None` `time > t`\n    by blast\nqed\n\nlemma exist_least_nonzero:\n  fixes \\<tau> :: \"'a trans_raw\"\n  assumes \"\\<forall>n\\<le>t.  \\<tau> n = 0\"\n  assumes \"\\<tau> \\<noteq> 0\"\n  shows \"\\<exists>t'>t.  \\<tau> t' \\<noteq> 0 \\<and> (\\<forall>n>t. n < t' \\<longrightarrow>  \\<tau> n = 0)\"\nproof -\n  obtain t' where *: \" \\<tau> t' \\<noteq> 0\"\n    using assms(2) unfolding zero_fun_def zero_option_def by (metis)\n  hence \"t' > t\"\n    using assms(1)  using leI by auto\n  hence **: \"\\<exists>t'>t.  \\<tau> t' \\<noteq> 0\"\n    using * by auto\n  define time where \"time = (LEAST n. t < n \\<and>  \\<tau> n \\<noteq> 0)\"\n  hence \" \\<tau> time \\<noteq> 0\" and \"t < time\"\n    using LeastI_ex[OF **] by auto\n  have \"\\<forall>n > t. n < time \\<longrightarrow>  \\<tau> n = 0\"\n    using not_less_Least time_def by blast\n  thus ?thesis\n    using ` \\<tau> time \\<noteq> 0` `time > t` by blast\nqed\n\nlemma signal_of_not_default:\n  assumes \"\\<tau> t sig = Some v\" and \"v \\<noteq> def\"\n  shows \"signal_of def \\<tau> sig t \\<noteq> def\"\nproof -\n  have \"Femto_VHDL_raw.inf_time (to_trans_raw_sig \\<tau>) sig t = Some t\"\n  proof (rule inf_time_someI)\n    show \"t \\<in> dom ((to_trans_raw_sig \\<tau> sig))\"\n      using assms(1) by (auto simp add: to_trans_raw_sig_def)\n  qed auto\n  hence \"signal_of def \\<tau> sig t = the ((to_trans_raw_sig \\<tau> sig) t)\"\n    unfolding Femto_VHDL_raw.to_signal_def comp_def by auto\n  also have \"... = v\"\n    using assms(1) by (auto simp add: to_trans_raw_sig_def)\n  finally show ?thesis\n    using assms(2) by blast\nqed\n\nlemma signal_of_defaultE:\n  assumes \"signal_of def \\<tau> sig t = def\"\n  shows \"\\<tau> t sig = None \\<or> \\<tau> t sig = Some def\"\n  using assms\nproof (rule contrapos_pp)\n  assume \" \\<not> (\\<tau> t sig = None \\<or> \\<tau> t sig = Some def) \"\n  then obtain v where \"\\<tau> t sig = Some v\" and \"v \\<noteq> def\"\n    by auto\n  thus \"signal_of def \\<tau> sig t \\<noteq> def\"\n    by (meson signal_of_not_default)\nqed\n\nlemma next_time_world_alt_def1:\n  assumes \"derivative_raw (snd tw) (fst tw) \\<noteq> 0\"\n  shows \"next_time_world tw = (LEAST n. n \\<ge> fst tw \\<and> (\\<lambda>s. wline_of tw s (fst tw)) \\<noteq> (\\<lambda>s. wline_of tw s n))\"\nproof -\n  define t where \"t = fst tw\"\n  define w where \"w = snd tw\"\n  define \\<tau> where \"\\<tau> = derivative_raw w t\"\n  have non_stut: \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) (\\<lambda>s. snd w s t) s\"\n    by (simp add: derivative_raw_ensure_non_stuttering \\<tau>_def)\n  have \"\\<tau> \\<noteq> 0\"\n    using assms unfolding \\<tau>_def w_def t_def by auto\n  hence \"next_time_world tw = Femto_VHDL_raw.next_time t \\<tau>\"\n    unfolding next_time_world_def Let_def w_def t_def \\<tau>_def by auto\n  also have \"... = (LEAST n. dom (\\<tau> n) \\<noteq> {})\"\n    unfolding Femto_VHDL_raw.next_time_def using `\\<tau> \\<noteq> 0` by auto\n  finally have t'_def: \"next_time_world tw = (LEAST n. dom (\\<tau> n) \\<noteq> {})\"\n    by auto\n  let ?t' = \"next_time_world tw\"\n  have \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n    unfolding \\<tau>_def by (auto simp add: zero_fun_def zero_option_def derivative_raw_def)\n  hence \"t \\<le> ?t'\"\n    unfolding `next_time_world tw = Femto_VHDL_raw.next_time t \\<tau>`  by (simp add: next_time_at_least)\n  have \"\\<exists>x. dom (\\<tau> x) \\<noteq> {}\"\n    using `\\<tau> \\<noteq> 0`\n    unfolding zero_fun_def zero_option_def by auto\n  hence \"dom (\\<tau> ?t') \\<noteq> {}\"\n    unfolding `next_time_world tw = (LEAST n. dom (\\<tau> n) \\<noteq> {})` by (rule LeastI_ex)\n  hence \"\\<tau> ?t' \\<noteq> Map.empty\"\n    by simp\n  then obtain sig val where \"\\<tau> ?t' sig = Some val\"\n    by (meson not_Some_eq)\n  hence non_stut_sig: \"non_stuttering (to_trans_raw_sig \\<tau>) (\\<lambda>s. snd w s t) sig\"\n    using non_stut by auto\n  have \"(\\<lambda>s. snd w s t) \\<noteq> (\\<lambda>s. snd w s (next_time_world tw))\"\n  proof\n    let ?\\<sigma> = \"\\<lambda>s. snd w s t\"\n    assume \" (\\<lambda>s. snd w s t) = (\\<lambda>s. snd w s (next_time_world tw))\"\n    hence \"snd w sig t = snd w sig (next_time_world tw)\"\n      by metis\n    moreover have helper1: \"snd w sig t = signal_of (?\\<sigma> sig) \\<tau> sig t\"\n      by (metis \\<open>\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\\<close> signal_of_def zero_fun_def)\n    moreover have \" signal_of (?\\<sigma> sig)  \\<tau> sig ?t' = snd w sig ?t'\"\n      by (unfold \\<tau>_def, intro signal_of_derivative_raw)(simp add: \\<open>t \\<le> next_time_world tw\\<close>)+\n    ultimately have \"signal_of (?\\<sigma> sig) \\<tau> sig t = signal_of (?\\<sigma> sig) \\<tau> sig ?t'\"\n      by auto\n    have \"t < ?t'\"\n    proof (rule ccontr)\n      assume \"\\<not> t < ?t'\" hence \"?t' \\<le> t\" by auto\n      hence \"\\<tau> ?t' = 0\"\n        using `\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0` by auto\n      with `\\<tau> ?t' sig = Some val` show False\n        by (simp add: zero_fun_def zero_option_def)\n    qed\n    have \"t < ?t' - 1 \\<Longrightarrow> signal_of (?\\<sigma> sig) \\<tau> sig (?t' - 1) = signal_of (?\\<sigma> sig) \\<tau> sig t\"\n    proof (rule signal_of_less_ind)\n      have \"\\<forall>n. t < n \\<and> n < ?t' \\<longrightarrow> \\<tau> n = 0\"\n        using t'_def \\<open>next_time_world tw = Femto_VHDL_raw.next_time t \\<tau>\\<close> next_time_at_least2 by auto\n      thus \"\\<And>n. t < n \\<Longrightarrow> n \\<le> next_time_world tw - 1 \\<Longrightarrow> \\<tau> n = 0\"\n        by auto\n    qed auto\n    with `t < ?t'` have \"signal_of (?\\<sigma> sig) \\<tau> sig (?t' - 1) = signal_of (?\\<sigma> sig) \\<tau> sig t\"\n      by (metis \\<tau>_def helper1 linorder_neqE_nat signal_of2_derivative_before_now)\n    hence \"signal_of (?\\<sigma> sig) \\<tau> sig (?t' - 1) = signal_of (?\\<sigma> sig) \\<tau> sig ?t'\"\n      using \\<open>signal_of (snd w sig t) \\<tau> sig t = signal_of (snd w sig t) \\<tau> sig (next_time_world tw)\\<close>\n      by simp\n    hence \"\\<tau> ?t' sig = None\"\n      using \\<open>t < next_time_world tw\\<close> current_sig_and_prev_same non_stut_sig zero_option_def\n      by (metis gr0I gr_implies_not0)\n    with `\\<tau> ?t' sig = Some val` show False by auto\n  qed\n  have \"(LEAST n. n \\<ge> t \\<and> (\\<lambda>s. snd w s t) \\<noteq> (\\<lambda>s. snd w s n)) = next_time_world tw\"\n  proof (rule Least_equality)\n    show \"t \\<le> next_time_world tw \\<and> (\\<lambda>s. snd w s t) \\<noteq> (\\<lambda>s. snd w s (next_time_world tw))\"\n      by (simp add: \\<open>(\\<lambda>s. snd w s t) \\<noteq> (\\<lambda>s.  snd w s (next_time_world tw))\\<close> \\<open>t \\<le> next_time_world tw\\<close>)\n  next\n    { fix y\n      let ?\\<sigma> = \"\\<lambda>s. snd w s t\"\n      assume \"\\<not> ?t' \\<le> y\" hence \"y < ?t'\" by auto\n      have \"y < t \\<or> \\<not> y < t\" by auto\n      moreover\n      { assume \"\\<not> y < t\" hence \"t \\<le> y\" by auto\n        have \"\\<And>n. t < n \\<Longrightarrow> n \\<le> y \\<Longrightarrow> \\<tau> n = 0\"\n          using `y < ?t'` t'_def\n          by (metis \\<open>next_time_world tw = Femto_VHDL_raw.next_time t \\<tau>\\<close> le_less_trans  next_time_at_least2)\n        have \"\\<And>s.  snd w s t = signal_of (?\\<sigma> s) \\<tau> s t\"\n          using `\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0`\n          by (metis signal_of_less_ind signal_of_zero zero_fun_def zero_le)\n        moreover have \"\\<And>s. signal_of (?\\<sigma> s) \\<tau> s y =  snd w s y\"\n          by (unfold \\<tau>_def, intro signal_of_derivative_raw)(simp add: \\<open>t \\<le> y\\<close>)+\n        moreover have \"\\<And>s. signal_of (?\\<sigma> s) \\<tau> s y = signal_of (?\\<sigma> s) \\<tau> s t\"\n        proof (cases \"t < y\")\n          case True\n          thus \"\\<And>s. signal_of (?\\<sigma> s) \\<tau> s y = signal_of (?\\<sigma> s) \\<tau> s t\"\n            by (meson \\<open>\\<And>n. \\<lbrakk>t < n; n \\<le> y\\<rbrakk> \\<Longrightarrow> \\<tau> n = 0\\<close> \\<open>t \\<le> y\\<close> signal_of_less_ind)\n        next\n          case False\n          with `t \\<le> y` show \"\\<And>s. signal_of (?\\<sigma> s) \\<tau> s y = signal_of (?\\<sigma> s) \\<tau> s t\"\n            by auto\n        qed\n        ultimately have \"(\\<lambda>s. snd w s t) = (\\<lambda>s. snd w s y)\"\n          by auto\n        hence \"\\<not> (t \\<le> y \\<and> (\\<lambda>s.  snd w s t) \\<noteq> (\\<lambda>s.  snd w s y))\"\n          by auto }\n      moreover\n      { assume \"y < t\"\n        hence \"\\<not> (t \\<le> y \\<and> (\\<lambda>s.  snd w s t) \\<noteq> (\\<lambda>s.  snd w s y))\"\n          by auto }\n      ultimately have \"\\<not> (t \\<le> y \\<and> (\\<lambda>s.  snd w s t) \\<noteq> (\\<lambda>s.  snd w s y))\"\n        by auto }\n    thus \"\\<And>y. t \\<le> y \\<and> (\\<lambda>s. snd w s t) \\<noteq> (\\<lambda>s. snd w s y) \\<Longrightarrow> ?t' \\<le> y\"\n      by auto\n  qed\n  thus ?thesis\n    unfolding w_def t_def by auto\nqed\n\nlemma next_time_world_alt_def2:\n  assumes \"derivative_raw (snd tw) (fst tw) = 0\"\n  shows \"next_time_world tw = fst tw + 1\"\n  using assms  by (simp add: next_time_world_def)\n\nlemma derivative_raw_alt_def:\n  \"derivative_raw (snd tw) (fst tw) \\<noteq> 0 \\<longleftrightarrow>  (\\<exists>n\\<ge> (fst tw). (\\<lambda>s. (wline_of tw) s (fst tw)) \\<noteq> (\\<lambda>s. (wline_of tw) s n))\"\nproof\n  assume \"derivative_raw (snd tw) (fst tw) \\<noteq> 0\"\n  hence *: \"\\<exists>n. derivative_raw (snd tw) (fst tw) n \\<noteq> Map.empty\"\n    unfolding zero_option_def zero_fun_def by auto\n  define least where \"least = (LEAST n. derivative_raw (snd tw) (fst tw) n \\<noteq> Map.empty)\"\n  have \"derivative_raw (snd tw) (fst tw) least \\<noteq> Map.empty\"\n    using LeastI_ex[OF *] unfolding least_def by auto\n  then obtain s val where \"derivative_raw (snd tw) (fst tw) least s = Some val\"\n    unfolding zero_fun_def zero_option_def  by fastforce\n  hence \"fst tw < least\"\n    unfolding derivative_raw_def  using not_le by fastforce\n  hence \"difference_raw (snd tw) least s = Some val\"\n    using \\<open>derivative_raw (snd tw) (fst tw) least s = Some val\\<close> unfolding derivative_raw_def by auto\n  hence \"wline_of tw s least \\<noteq> wline_of tw s (least - 1)\"\n    using `fst tw < least` unfolding difference_raw_def by force\n  have **: \"\\<forall>n<least. derivative_raw (snd tw) (fst tw) n = Map.empty\"\n    unfolding least_def using not_less_Least by blast\n  have \"\\<forall>n. fst tw < n \\<and> n < least \\<longrightarrow> wline_of tw s n = wline_of tw s (fst tw)\"\n  proof (intro allI, intro impI)\n    fix n\n    assume \"fst tw < n \\<and> n < least\"\n    hence \"derivative_raw (snd tw) (fst tw) n = Map.empty\" and \"fst tw < n\" and \"n < least\"\n      using ** by auto\n    have \"signal_of (wline_of tw s (fst tw)) (derivative_raw (snd tw) (fst tw)) s n = (wline_of tw) s n\"\n      by (metis \\<open>get_time tw < n\\<close> comp_apply less_imp_le_nat signal_of_derivative_raw state_of_world_def)\n    hence \"(wline_of tw) s n = signal_of (wline_of tw s (fst tw)) (derivative_raw (snd tw) (fst tw)) s n\"\n      by auto\n    also have \"... = signal_of (wline_of tw s (fst tw)) (derivative_raw (snd tw) (fst tw)) s (fst tw)\"\n      by(intro signal_of_less_ind')\n        (simp add: \\<open>fst tw < n \\<and> n < least\\<close> ** le_less_trans zero_option_def order.strict_implies_order)+\n    also have \"... = (wline_of tw) s (fst tw)\"\n      by (metis derivative_raw_def signal_of_def zero_option_def)\n    finally show \"wline_of tw s n = wline_of tw s (fst tw)\"\n      by auto\n  qed\n  hence \"wline_of tw s (least - 1) = wline_of tw s (fst tw)\"\n    using `fst tw < least`\n    by (metis (no_types, lifting) Suc_diff_1 diff_less less_SucE less_Suc_eq_0_disj\n    less_imp_Suc_add zero_less_one)\n  hence \"wline_of tw s least \\<noteq> wline_of tw s (fst tw)\"\n    using `wline_of tw s least \\<noteq> wline_of tw s (least - 1)` by auto\n  with `fst tw < least` show \"\\<exists>n\\<ge>fst tw. (\\<lambda>s. wline_of tw s (fst tw)) \\<noteq> (\\<lambda>s. wline_of tw s n)\"\n    by (metis (full_types) less_imp_le_nat)\nnext\n  assume *: \"\\<exists>n\\<ge>fst tw. (\\<lambda>s. wline_of tw s (fst tw)) \\<noteq> (\\<lambda>s. wline_of tw s n)\"\n  define least where \"least = (LEAST n. n \\<ge> fst tw \\<and> (\\<lambda>s. wline_of tw s (fst tw)) \\<noteq> (\\<lambda>s. wline_of tw s n))\"\n  hence \"fst tw \\<le> least\" and **: \"(\\<lambda>s. wline_of tw s (fst tw)) \\<noteq> (\\<lambda>s. wline_of tw s least)\"\n    using LeastI_ex[OF *] unfolding least_def by auto\n  hence \"fst tw < least\"\n    using nat_less_le by blast\n  have \"\\<forall>n. fst tw < n \\<and> n < least \\<longrightarrow> (\\<forall>s. wline_of tw s (fst tw) = wline_of tw s n)\"\n    unfolding least_def  by (metis (mono_tags, lifting) Least_le leD le_eq_less_or_eq)\n  hence \"(\\<lambda>s. wline_of tw s (fst tw)) = (\\<lambda>s. wline_of tw s (least - 1))\"\n    using `fst tw < least`\n    by (metis (no_types, hide_lams) add.commute add_cancel_right_right diff_Suc_1 diff_less\n    gr0_conv_Suc less_antisym less_diff_conv not_add_less2 not_less_iff_gr_or_eq zero_less_one)\n  hence \"(\\<lambda>s. wline_of tw s least) \\<noteq> (\\<lambda>s. wline_of tw s (least - 1))\"\n    using ** by auto\n  have \"difference_raw (snd tw) least \\<noteq> 0\"\n  proof (rule ccontr)\n    assume \"\\<not> difference_raw (snd tw) least \\<noteq> 0\" hence \"difference_raw (snd tw) least = 0\"\n      by auto\n    hence \"(\\<lambda>s. if wline_of tw s least \\<noteq> wline_of tw s (least - 1) then Some (wline_of tw s least) else None) = 0\"\n      using `fst tw < least` unfolding difference_raw_def\n      by (metis comp_apply gr_implies_not_zero)\n    hence \"(\\<lambda>s. wline_of tw s least) = (\\<lambda>s. wline_of tw s (least - 1))\"\n      by (intro ext)(smt option.distinct(1) zero_fun_def zero_option_def)\n    with `(\\<lambda>s. wline_of tw s least) \\<noteq> (\\<lambda>s. wline_of tw s (least - 1))` show False\n      by auto\n  qed\n  hence \"derivative_raw (snd tw) (fst tw) least \\<noteq> 0\"\n    using `fst tw < least` unfolding derivative_raw_def by auto\n  thus \"derivative_raw (snd tw) (fst tw) \\<noteq> 0\"\n    by (metis zero_fun_def)\nqed\n\nlemma next_time_world_alt_def:\n  \"next_time_world tw = (let t =fst tw; w = wline_of tw in\n                            if \\<exists>n\\<ge>t. (\\<lambda>s. w s t) \\<noteq> (\\<lambda>s. w s n) then (LEAST n. n \\<ge> t \\<and> (\\<lambda>s. w s t) \\<noteq> (\\<lambda>s. w s n))\n                            else t + 1)\"\nproof -\n  have \"derivative_raw (snd tw) (fst tw) = 0 \\<or> derivative_raw (snd tw) (fst tw) \\<noteq> 0\"\n    by auto\n  moreover\n  { assume \"derivative_raw (snd tw) (fst tw) \\<noteq> 0\"\n    hence \"(\\<exists>n\\<ge> (fst tw). (\\<lambda>s. (wline_of tw) s (fst tw)) \\<noteq> (\\<lambda>s. (wline_of tw) s n))\"\n      unfolding derivative_raw_alt_def by auto\n    hence ?thesis\n      using next_time_world_alt_def1[OF `derivative_raw (snd tw) (fst tw) \\<noteq> 0`]\n      unfolding Let_def by auto }\n  moreover\n  { assume \"derivative_raw (snd tw) (fst tw) = 0\"\n    hence \"\\<not> (\\<exists>n\\<ge> (fst tw). (\\<lambda>s. (wline_of tw) s (fst tw)) \\<noteq> (\\<lambda>s. (wline_of tw) s n))\"\n      using derivative_raw_alt_def by blast\n    hence ?thesis\n      using next_time_world_alt_def2[OF `derivative_raw (snd tw) (fst tw) = 0`]\n      unfolding Let_def by auto }\n  ultimately show ?thesis\n    by auto\nqed\n\nlemma next_time_world_at_least:\n  \"fst tw < next_time_world tw\"\nproof -\n  have \"\\<exists>n\\<ge>get_time tw. (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n) \\<or>\n       \\<not> (\\<exists>n\\<ge>get_time tw. (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n))\"\n    by auto\n  moreover\n  { assume \"\\<not> (\\<exists>n\\<ge>get_time tw. (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n))\"\n    hence \"next_time_world tw = get_time tw + 1\"\n      unfolding next_time_world_alt_def Let_def by auto\n    hence \"fst tw < next_time_world tw\"\n      by auto }\n  moreover\n  { assume *: \"\\<exists>n\\<ge>get_time tw. (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n)\"\n    hence \"next_time_world tw = (LEAST n. get_time tw \\<le> n \\<and> (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n))\"\n      unfolding next_time_world_alt_def Let_def by auto\n    hence \"get_time tw < next_time_world tw\"\n      using LeastI_ex[OF *] by auto\n    hence \"fst tw < next_time_world tw\"\n      by auto }\n  ultimately show ?thesis by auto\nqed\n\nlemma unchanged_until_next_time_world:\n  \"\\<forall>i\\<ge>fst tw. i < next_time_world tw \\<longrightarrow> (\\<forall>s. wline_of tw s i = wline_of tw s (fst tw))\"\nproof (rule allI, rule impI, rule impI)\n  fix i\n  assume \"fst tw \\<le> i\"\n  assume \"i < next_time_world tw\"\n  have \"   \\<exists>n\\<ge>get_time tw. (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n) \\<or>\n        \\<not> (\\<exists>n\\<ge>get_time tw. (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n))\"\n    by auto\n  moreover\n  { assume \"\\<exists>n\\<ge>get_time tw. (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n)\"\n    hence \"next_time_world tw = (LEAST n. get_time tw \\<le> n \\<and> (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n))\"\n      unfolding next_time_world_alt_def Let_def by auto\n    hence \"i < (LEAST n. fst tw  \\<le> n \\<and> (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n))\"\n      using \\<open>i < next_time_world tw\\<close> by auto\n    hence \"\\<not> (get_time tw \\<le> i \\<and> (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s i))\"\n      using not_less_Least by auto\n    with \\<open>fst tw \\<le> i\\<close> have \"\\<forall>s. wline_of tw s i = wline_of tw s (fst tw)\"\n      by metis }\n  moreover\n  { assume \"\\<not> (\\<exists>n\\<ge>get_time tw. (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n))\"\n    hence \"\\<forall>n\\<ge>fst tw. \\<forall>s. wline_of tw s n = wline_of tw s (fst tw)\"\n      by metis\n    hence \"\\<forall>s. wline_of tw s i = wline_of tw s (fst tw)\"\n      using \\<open>fst tw \\<le> i\\<close>  by blast }\n  ultimately show \"\\<forall>s. wline_of tw s i = wline_of tw s (fst tw)\"\n    by auto\nqed\n\nlemma successive_empty_event:\n  assumes \"event_of tw = {}\" and \"event_of (next_time_world tw, snd tw) = {}\"\n  shows \"next_time_world tw = fst tw + 1\"\nproof (rule ccontr)\n  assume \"next_time_world tw \\<noteq> fst tw + 1\"\n  hence \"fst tw + 1 < next_time_world tw\"\n    using next_time_world_at_least by (metis discrete less_le)\n  hence *: \"\\<exists>n\\<ge>fst tw. (\\<lambda>s. wline_of tw s (fst tw)) \\<noteq> (\\<lambda>s. wline_of tw s n)\" and\n        \"next_time_world tw = (LEAST n. get_time tw \\<le> n \\<and> (\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s n))\"\n    unfolding next_time_world_alt_def Let_def  by presburger+\n  hence \"(\\<lambda>s. wline_of tw s (get_time tw)) \\<noteq> (\\<lambda>s. wline_of tw s (next_time_world tw))\"\n    using LeastI_ex[OF *]  by simp\n  hence **: \"\\<exists>s. wline_of tw s (next_time_world tw) \\<noteq> wline_of tw s (fst tw)\"\n    by auto\n  have \"\\<And>s. wline_of tw s (next_time_world tw) = wline_of tw s (next_time_world tw - 1)\"\n    using assms(2) unfolding event_of_alt_def\n    using \\<open>get_time tw + 1 < next_time_world tw\\<close> by auto\n  thus False\n    by (metis \"**\" One_nat_def \\<open>get_time tw + 1 < next_time_world tw\\<close> add_le_imp_le_diff\n    diff_Suc_less gr0I gr_implies_not_zero nat_less_le unchanged_until_next_time_world)\nqed\n\ninductive\n  conc_sim :: \"'signal assn2 \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\"\n  (\"\\<turnstile>\\<^sub>s (\\<lbrace>(1_)\\<rbrace>/ (_)/ \\<lbrace>(1_)\\<rbrace>)\" 50)\n  where\nWhile: \"\\<turnstile> \\<lbrace>\\<lambda>tw. P tw\\<rbrace> cs \\<lbrace> \\<lambda>tw. \\<forall>i\\<in>{get_time tw<..next_time_world tw}. P (i, snd tw)\\<rbrace>  \\<Longrightarrow> \\<turnstile>\\<^sub>s \\<lbrace>P\\<rbrace> cs \\<lbrace>P\\<rbrace>\" |\nWhile_Suc: \"\\<turnstile> \\<lbrace>\\<lambda>tw. P tw\\<rbrace> cs \\<lbrace> \\<lambda>tw. P (fst tw + 1, snd tw)\\<rbrace>  \\<Longrightarrow> \\<turnstile>\\<^sub>s \\<lbrace>P\\<rbrace> cs \\<lbrace>P\\<rbrace>\" |\nConseq_sim: \"\\<forall>tw. P' tw \\<longrightarrow> P tw \\<Longrightarrow> \\<turnstile>\\<^sub>s \\<lbrace>P\\<rbrace> cs \\<lbrace>Q\\<rbrace> \\<Longrightarrow> \\<forall>tw. Q tw \\<longrightarrow> Q' tw \\<Longrightarrow> \\<turnstile>\\<^sub>s \\<lbrace>P'\\<rbrace> cs \\<lbrace>Q'\\<rbrace>\"\n\nlemma worldline_next_config:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n  shows \"worldline_raw t \\<sigma> \\<theta> def \\<tau>' = worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def \\<tau>'\"\nproof (rule, rule_tac[2] ext, rule_tac[2] ext)\n  fix s' t'\n  have \"t' < t \\<or> t \\<le> t' \\<and> t' < next_time t \\<tau>' \\<or> next_time t \\<tau>' \\<le> t'\"\n    by auto\n  moreover\n  { assume \"t' < t\"\n    hence \"t' < next_time t \\<tau>'\"\n      using next_time_at_least assms unfolding context_invariant_def\n      by (metis le_less_trans nat_less_le)\n    have \"\\<And>n. n \\<le> t' \\<Longrightarrow>  \\<theta> n =  (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) n\"\n      using `t' < t` unfolding add_to_beh_def\n      by (cases \"t < next_time t \\<tau>'\", auto)\n    hence \"signal_of (def s') \\<theta> s' t' = signal_of (def s') (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s' t'\"\n      by (metis eq_imp_le signal_of_equal_when_trans_equal_upto)\n    hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' = snd (worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def \\<tau>') s' t'\"\n      unfolding worldline_raw_def using `t' < t` `t' < next_time t \\<tau>'` by auto }\n  moreover\n  { assume \"next_time t \\<tau>' \\<le> t'\"\n    moreover have \"t \\<le> next_time t \\<tau>'\"\n      using assms unfolding context_invariant_def by (simp add: next_time_at_least)\n    ultimately have \"t \\<le> t'\"\n      by auto\n    have \"signal_of (\\<sigma> s') \\<tau>' s' t' =  signal_of (next_state t \\<tau>' \\<sigma> s') \\<tau>' s' t'\"\n    proof (cases \"inf_time (to_trans_raw_sig \\<tau>') s' t' = None\")\n      case True\n      hence \" \\<forall>t\\<in>dom ( (to_trans_raw_sig \\<tau>' s')). t' < t\"\n        by (simp add: inf_time_none_iff)\n      hence \"\\<forall>t. t \\<le> t' \\<longrightarrow> t \\<notin> dom (  (to_trans_raw_sig \\<tau>' s'))\"\n        using not_le by blast\n      hence \"next_time t \\<tau>' \\<notin> dom (  (to_trans_raw_sig \\<tau>' s'))\"\n        using `next_time t \\<tau>' \\<le> t'` by auto\n      hence \"s' \\<notin> dom (\\<tau>' (next_time t \\<tau>'))\"\n        unfolding next_time_def by (auto simp add: to_trans_raw_sig_def)\n      hence \"next_state t \\<tau>' \\<sigma> s' = \\<sigma> s'\"\n        unfolding next_state_def Let_def by auto\n      then show ?thesis\n        using True unfolding to_signal_def comp_def by auto\n    next\n      case False\n      then show ?thesis\n        unfolding to_signal_def comp_def by auto\n    qed\n    hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' =\n         snd (worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def \\<tau>') s' t'\"\n      unfolding worldline_raw_def using `t \\<le> t'` and `next_time t \\<tau>' \\<le> t'` by auto }\n  moreover\n  { assume \"t \\<le> t' \\<and> t' < next_time t \\<tau>'\"\n    hence \"t < next_time t \\<tau>'\"\n      by auto\n    have add_to_beh: \"add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>') = \\<theta>(t := (Some o \\<sigma>))\"\n      unfolding add_to_beh_def using `t < next_time t \\<tau>'` by auto\n    have \"signal_of (\\<sigma> s') \\<tau>' s' t' = \\<sigma> s'\"\n    proof -\n      have \"\\<forall>n<next_time t \\<tau>'.  \\<tau>' n = 0\"\n        using `t < next_time t \\<tau>'` next_time_at_least2 by auto\n      hence \"\\<forall>n. n \\<le> t' \\<longrightarrow>  \\<tau>' n = 0\"\n        using `t \\<le> t' \\<and> t' < next_time t \\<tau>'` by auto\n      have \"\\<forall>t\\<in>dom ( (to_trans_raw_sig \\<tau>' s')). t' < t\"\n      proof (rule ccontr)\n        assume \"\\<not> (\\<forall>t\\<in>dom ( (to_trans_raw_sig \\<tau>' s')). t' < t)\"\n        then obtain time where \"time \\<in> dom ( (to_trans_raw_sig \\<tau>' s'))\" and \"time \\<le> t'\"\n          using leI by blast\n        hence \" \\<tau>' time \\<noteq> 0\"\n          by (transfer', auto simp add: to_trans_raw_sig_def zero_fun_def zero_fun_def zero_option_def zero_option_def)\n        moreover have \" \\<tau>' time = 0\"\n          using `\\<forall>n. n \\<le> t' \\<longrightarrow>  \\<tau>' n = 0` `time \\<le> t'` by auto\n        ultimately show False by auto\n      qed\n      hence \"inf_time (to_trans_raw_sig \\<tau>') s' t' = None\"\n        by (auto simp add: inf_time_none_iff)\n      thus ?thesis\n        unfolding to_signal_def comp_def by auto\n    qed\n    moreover have \"signal_of (def s') (\\<theta>(t :=Some o \\<sigma>)) s' t' = \\<sigma> s'\"\n    proof -\n      have \"\\<forall>n<next_time t \\<tau>'.  \\<tau>' n = 0\"\n        using next_time_at_least2 `t < next_time t \\<tau>'` by auto\n      hence \"\\<forall>n. n \\<le> t' \\<longrightarrow>  \\<tau>' n = 0\"\n        using `t \\<le> t' \\<and> t' < next_time t \\<tau>'` by auto\n      have \"t \\<in> dom ( (to_trans_raw_sig (\\<theta>(t :=Some o \\<sigma>)) s'))\"\n        by transfer' (auto simp add: to_trans_raw_sig_def)\n      moreover have \"t \\<le> t'\"\n        using `t \\<le> t' \\<and> t' < next_time t \\<tau>'` by auto\n      moreover have \"\\<forall>ta\\<in>dom ( (to_trans_raw_sig(\\<theta>(t :=Some o \\<sigma>)) s')). ta \\<le> t' \\<longrightarrow> ta \\<le> t\"\n      proof (rule ccontr)\n        assume \"\\<not> (\\<forall>ta\\<in>dom ( (to_trans_raw_sig (\\<theta>(t :=Some o \\<sigma>)) s')). ta \\<le> t' \\<longrightarrow> ta \\<le> t)\"\n        then obtain ta where ta_dom: \"ta\\<in>dom ( (to_trans_raw_sig (\\<theta>(t :=Some o \\<sigma>)) s'))\"  and  \"ta \\<le> t'\" and \"ta > t\"\n          using leI by blast\n        have \" (to_trans_raw_sig (\\<theta>(t :=Some o \\<sigma>)) s') ta =   (to_trans_raw_sig \\<theta> s') ta\"\n          using `ta > t` by  (auto simp add: to_trans_raw_sig_def)\n        hence \" \\<theta> ta \\<noteq> 0\"\n          using ta_dom by ( auto simp add: to_trans_raw_sig_def zero_fun_def zero_fun_def zero_option_def zero_option_def)\n        have \"\\<forall>n \\<ge> t.  \\<theta> n = 0\"\n          using assms(1) unfolding context_invariant_def by auto\n        hence \" \\<theta> ta = 0\"\n          using `ta > t` by auto\n        with ` \\<theta> ta \\<noteq> 0` show False by auto\n      qed\n      ultimately have \"inf_time (to_trans_raw_sig (\\<theta>(t :=Some o \\<sigma>))) s' t' = Some t\"\n        by (rule inf_time_someI)\n      moreover have \"the ( (to_trans_raw_sig (\\<theta>(t :=Some o \\<sigma>)) s') t) = \\<sigma> s'\"\n        by (auto simp add: to_trans_raw_sig_def)\n      ultimately show ?thesis\n        unfolding to_signal_def comp_def by auto\n    qed\n    ultimately have \"signal_of (\\<sigma> s') \\<tau>' s' t' = signal_of (def s') (\\<theta>(t :=Some o \\<sigma>)) s' t'\"\n      by auto\n    hence \"signal_of (\\<sigma> s') \\<tau>' s' t' = signal_of (def s') (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s' t'\"\n      unfolding add_to_beh by auto\n    hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' = snd (worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def \\<tau>') s' t'\"\n      unfolding worldline_raw_def using `t \\<le> t' \\<and> t' < next_time t \\<tau>'` by auto }\n  ultimately show \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' = snd (worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def \\<tau>') s' t'\"\n    by auto\nqed (simp add: worldline_raw_def)\n\nlemma worldline_next_config_next_time:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n  shows \"worldline_raw t \\<sigma> \\<theta> def \\<tau>' = worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))\"\nproof (rule, rule_tac[2] ext, rule_tac[2] ext)\n  fix s' t'\n  have \"t' < t \\<or> t \\<le> t' \\<and> t' < next_time t \\<tau>' \\<or> next_time t \\<tau>' \\<le> t'\"\n    by auto\n  moreover\n  { assume \"t' < t\"\n    hence \"t' < next_time t \\<tau>'\"\n      using next_time_at_least assms unfolding context_invariant_def\n      by (metis (no_types, lifting) dual_order.trans less_imp_le_nat not_less)\n    have \"\\<And>n. n \\<le> t' \\<Longrightarrow>  \\<theta> n =  (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) n\"\n      using `t' < t` unfolding add_to_beh_def\n      by (cases \"t < next_time t \\<tau>'\") (auto)\n    hence \"signal_of (def s') \\<theta> s' t' = signal_of (def s') (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s' t'\"\n      by (metis order_refl signal_of_equal_when_trans_equal_upto)\n    hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' = snd (worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))) s' t'\"\n      unfolding worldline_raw_def using `t' < t` `t' < next_time t \\<tau>'` by auto }\n  moreover\n  { assume \"next_time t \\<tau>' \\<le> t'\"\n    moreover have \"t \\<le> next_time t \\<tau>'\"\n      using assms unfolding context_invariant_def\n      by (simp add: next_time_at_least)\n    ultimately have \"t \\<le> t'\"\n      by auto\n    have \"signal_of (\\<sigma> s') \\<tau>' s' t' =  signal_of (next_state t \\<tau>' \\<sigma> s') (\\<tau>'(next_time t \\<tau>' := 0)) s' t'\"\n    proof (cases \"inf_time (to_trans_raw_sig \\<tau>') s' t' = None\")\n      case True\n      hence \" \\<forall>t\\<in>dom ( (to_trans_raw_sig \\<tau>' s')). t' < t\"\n        by (auto simp add: inf_time_none_iff)\n      hence \"\\<forall>t. t \\<le> t' \\<longrightarrow> t \\<notin> dom (  (to_trans_raw_sig \\<tau>' s'))\"\n        using not_le by blast\n      hence \"next_time t \\<tau>' \\<notin> dom (  (to_trans_raw_sig \\<tau>' s'))\"\n        using `next_time t \\<tau>' \\<le> t'` by auto\n      hence \"s' \\<notin> dom ( \\<tau>' (next_time t \\<tau>'))\"\n        unfolding next_time_def by (auto simp add: to_trans_raw_sig_def)\n      hence \"next_state t \\<tau>' \\<sigma> s' = \\<sigma> s'\"\n        unfolding next_state_def Let_def by auto\n      moreover have \"inf_time (to_trans_raw_sig (\\<tau>'(next_time t \\<tau>' := 0))) s' t' =\n            inf_time (to_trans_raw_sig \\<tau>') s' t'\"\n        using True by (metis inf_time_rem_curr_trans option.distinct(1) rem_curr_trans_to_trans_raw_sig)\n      ultimately show ?thesis\n        using True unfolding to_signal_def comp_def by auto\n    next\n      case False\n      then obtain time where \"inf_time (to_trans_raw_sig \\<tau>') s' t' = Some time\"\n        by auto\n      have \"time = next_time t \\<tau>' \\<or> time \\<noteq> next_time t \\<tau>'\"\n        by auto\n      moreover\n      { assume \"time \\<noteq> next_time t \\<tau>'\"\n        hence \"inf_time (to_trans_raw_sig (\\<tau>'(next_time t \\<tau>' := 0))) s' t' =  inf_time (to_trans_raw_sig \\<tau>') s' t'\"\n          using `inf_time (to_trans_raw_sig \\<tau>') s' t' = Some time`\n          by (metis inf_time_rem_curr_trans option.inject rem_curr_trans_to_trans_raw_sig)\n        hence ?thesis\n          using `inf_time (to_trans_raw_sig \\<tau>') s' t' = Some time` `time \\<noteq> next_time t \\<tau>'`\n          unfolding to_signal_def comp_def\n          by (metis False option.case_eq_if option.sel rem_curr_trans_to_trans_raw_sig\n          trans_value_same_except_at_removed) }\n      moreover\n      { assume \"time = next_time t \\<tau>'\"\n        hence \"inf_time (to_trans_raw_sig \\<tau>') s' t' = Some (next_time t \\<tau>')\"\n          using `inf_time (to_trans_raw_sig \\<tau>') s' t' = Some time` by auto\n        hence *: \"signal_of (\\<sigma> s') \\<tau>' s' t' = the ( (to_trans_raw_sig \\<tau>' s') (next_time t \\<tau>'))\"\n          unfolding to_signal_def comp_def by auto\n        have \"next_time t \\<tau>' \\<in> dom ( (to_trans_raw_sig \\<tau>' s'))\"\n          by (metis (full_types) \\<open>inf_time (to_trans_raw_sig \\<tau>') s' t' = Some time\\<close> \\<open>time =\n          next_time t \\<tau>'\\<close> dom_def inf_time_some_exists keys_def zero_option_def)\n        hence \"s' \\<in> dom ( \\<tau>' (next_time t \\<tau>'))\"\n          unfolding next_time_def by (auto simp add: to_trans_raw_sig_def)\n        moreover have \"the ( (to_trans_raw_sig \\<tau>' s') (next_time t \\<tau>')) = the ( \\<tau>' (next_time t \\<tau>') s')\"\n          unfolding next_time_def by (auto simp add: to_trans_raw_sig_def)\n        ultimately have \"the ( (to_trans_raw_sig \\<tau>' s') (next_time t \\<tau>')) = next_state t \\<tau>' \\<sigma> s'\"\n          unfolding next_state_def Let_def by auto\n        with * have \"signal_of (\\<sigma> s') \\<tau>' s' t' = next_state t \\<tau>' \\<sigma> s'\"\n          by auto\n        have \"\\<And>n. n < next_time t \\<tau>' \\<Longrightarrow>  \\<tau>' n = 0\"\n          using next_time_at_least2 by auto\n        hence \"inf_time (to_trans_raw_sig (\\<tau>'(next_time t \\<tau>' := 0))) s' t' = None\"\n          using inf_time_rem_curr_trans_at_t[OF `inf_time (to_trans_raw_sig \\<tau>') s' t' = Some (next_time t \\<tau>')`]\n          by (metis rem_curr_trans_to_trans_raw_sig to_trans_raw_sig_def zero_fun_def zero_option_def)\n        hence ?thesis\n          unfolding `signal_of (\\<sigma> s') \\<tau>' s' t' = next_state t \\<tau>' \\<sigma> s'` to_signal_def by auto }\n      ultimately show ?thesis\n        unfolding to_signal_def comp_def by auto\n    qed\n    hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' =\n           snd (worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))) s' t'\"\n      unfolding worldline_raw_def using `t \\<le> t'` and `next_time t \\<tau>' \\<le> t'` by auto }\n  moreover\n  { assume \"t \\<le> t' \\<and> t' < next_time t \\<tau>'\"\n    hence \"t < next_time t \\<tau>'\"\n      by auto\n    have add_to_beh: \"add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>') = \\<theta>(t :=Some o \\<sigma>)\"\n      unfolding add_to_beh_def using `t < next_time t \\<tau>'` by auto\n    have \"signal_of (\\<sigma> s') \\<tau>' s' t' = \\<sigma> s'\"\n    proof -\n      have \"\\<forall>n<next_time t \\<tau>'.  \\<tau>' n = 0\"\n        using `t < next_time t \\<tau>'` next_time_at_least2 by auto\n      hence \"\\<forall>n. n \\<le> t' \\<longrightarrow>  \\<tau>' n = 0\"\n        using `t \\<le> t' \\<and> t' < next_time t \\<tau>'` by auto\n      have \"\\<forall>t\\<in>dom ( (to_trans_raw_sig \\<tau>' s')). t' < t\"\n      proof (rule ccontr)\n        assume \"\\<not> (\\<forall>t\\<in>dom ( (to_trans_raw_sig \\<tau>' s')). t' < t)\"\n        then obtain time where \"time \\<in> dom ( (to_trans_raw_sig \\<tau>' s'))\" and \"time \\<le> t'\"\n          using leI by blast\n        hence \" \\<tau>' time \\<noteq> 0\"\n          by (auto simp add: to_trans_raw_sig_def zero_fun_def zero_fun_def zero_option_def zero_option_def)\n        moreover have \" \\<tau>' time = 0\"\n          using `\\<forall>n. n \\<le> t' \\<longrightarrow>  \\<tau>' n = 0` `time \\<le> t'` by auto\n        ultimately show False by auto\n      qed\n      hence \"inf_time (to_trans_raw_sig \\<tau>') s' t' = None\"\n        by (simp add: inf_time_none_iff)\n      thus ?thesis\n        unfolding to_signal_def comp_def by auto\n    qed\n    moreover have \"signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t' = \\<sigma> s'\"\n    proof -\n      have \"\\<forall>n<next_time t \\<tau>'.  \\<tau>' n = 0\"\n        using next_time_at_least2 `t < next_time t \\<tau>'` by auto\n      hence \"\\<forall>n. n \\<le> t' \\<longrightarrow>  \\<tau>' n = 0\"\n        using `t \\<le> t' \\<and> t' < next_time t \\<tau>'` by auto\n      have \"t \\<in> dom ( (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s'))\"\n        by  (auto simp add: to_trans_raw_sig_def)\n      moreover have \"t \\<le> t'\"\n        using `t \\<le> t' \\<and> t' < next_time t \\<tau>'` by auto\n      moreover have \"\\<forall>ta\\<in>dom ( (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s')). ta \\<le> t' \\<longrightarrow> ta \\<le> t\"\n      proof (rule ccontr)\n        assume \"\\<not> (\\<forall>ta\\<in>dom ( (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s')). ta \\<le> t' \\<longrightarrow> ta \\<le> t)\"\n        then obtain ta where ta_dom: \"ta\\<in>dom ( (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s'))\"  and  \"ta \\<le> t'\" and \"ta > t\"\n          using leI by blast\n        have \" (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s') ta =   (to_trans_raw_sig \\<theta> s') ta\"\n          using `ta > t` by  (auto simp add: to_trans_raw_sig_def)\n        hence \" \\<theta> ta \\<noteq> 0\"\n          using ta_dom by (auto simp add: to_trans_raw_sig_def zero_fun_def zero_fun_def zero_option_def zero_option_def)\n        have \"\\<forall>n \\<ge> t.  \\<theta> n = 0\"\n          using assms(1) unfolding context_invariant_def by auto\n        hence \" \\<theta> ta = 0\"\n          using `ta > t` by auto\n        with ` \\<theta> ta \\<noteq> 0` show False by auto\n      qed\n      ultimately have \"inf_time (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>))) s' t' = Some t\"\n        by (rule inf_time_someI)\n      moreover have \"the ( (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s') t) = \\<sigma> s'\"\n        by  (auto simp add: to_trans_raw_sig_def)\n      ultimately show ?thesis\n        unfolding to_signal_def comp_def by auto\n    qed\n    ultimately have \"signal_of (\\<sigma> s') \\<tau>' s' t' = signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t'\"\n      by auto\n    hence \"signal_of (\\<sigma> s') \\<tau>' s' t' = signal_of (def s') (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s' t'\"\n      unfolding add_to_beh by auto\n    hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' =\n           snd (worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))) s' t'\"\n      unfolding worldline_raw_def using `t \\<le> t' \\<and> t' < next_time t \\<tau>'` by auto }\n  ultimately show \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' =\n                   snd (worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))) s' t'\"\n    by auto\nqed (simp add: worldline_raw_def)\n\nlemma worldline_next_config_next_time_suc:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"                     \n  shows \"worldline_raw t \\<sigma> \\<theta> def \\<tau>' = worldline_raw (t + 1) (next_state2 (t + 1) \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>'(t + 1 := 0))\"\nproof (rule, rule_tac[2] ext, rule_tac[2] ext)\n  fix s' t'\n  have \"t' < t \\<or> t = t' \\<or> t + 1 \\<le> t'\"\n    by auto\n  moreover\n  { assume \"t' < t\"\n    hence \"t' < next_time t \\<tau>'\"\n      using next_time_at_least assms unfolding context_invariant_def\n      by (metis (no_types, lifting) dual_order.trans less_imp_le_nat not_less)\n    have \"\\<And>n. n \\<le> t' \\<Longrightarrow>  \\<theta> n =  (add_to_beh \\<sigma> \\<theta> t (t + 1)) n\"\n      using `t' < t` unfolding add_to_beh_def by (cases \"t < next_time t \\<tau>'\") (auto)\n    hence \"signal_of (def s') \\<theta> s' t' = signal_of (def s') (add_to_beh \\<sigma> \\<theta> t (t + 1)) s' t'\"\n      by (meson eq_imp_le signal_of_equal_when_trans_equal_upto)\n    hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' = snd (worldline_raw (t + 1) (next_state2 (t + 1) \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>'(t + 1 := 0))) s' t'\"\n      unfolding worldline_raw_def using `t' < t` `t' < next_time t \\<tau>'` by auto }\n  moreover\n  { assume \"t + 1 \\<le> t'\"\n    moreover have \"t \\<le> next_time t \\<tau>'\"\n      using assms unfolding context_invariant_def\n      by (simp add: next_time_at_least)\n    ultimately have \"t \\<le> t'\"\n      by auto\n    have \"signal_of (\\<sigma> s') \\<tau>' s' t' =  signal_of (next_state2 (t + 1) \\<tau>' \\<sigma> s') (\\<tau>'(t + 1 := 0)) s' t'\"\n    proof (cases \"inf_time (to_trans_raw_sig \\<tau>') s' t' = None\")\n      case True\n      hence \" \\<forall>t\\<in>dom ( (to_trans_raw_sig \\<tau>' s')). t' < t\"\n        by (auto simp add: inf_time_none_iff)\n      hence \"\\<forall>t. t \\<le> t' \\<longrightarrow> t \\<notin> dom (  (to_trans_raw_sig \\<tau>' s'))\"\n        using not_le by blast\n      hence \"t + 1 \\<notin> dom (  (to_trans_raw_sig \\<tau>' s'))\"\n        using `t + 1 \\<le> t'` by auto\n      hence \"s' \\<notin> dom ( \\<tau>' (t + 1))\"\n        unfolding next_time_def by (auto simp add: to_trans_raw_sig_def)\n      hence \"next_state2 (t + 1) \\<tau>' \\<sigma> s' = \\<sigma> s'\"\n        unfolding next_state2_def Let_def by auto\n      moreover have \"inf_time (to_trans_raw_sig (\\<tau>'(t + 1 := 0))) s' t' =\n            inf_time (to_trans_raw_sig \\<tau>') s' t'\"\n        using True by (metis inf_time_rem_curr_trans option.distinct(1) rem_curr_trans_to_trans_raw_sig)\n      ultimately show ?thesis\n        using True unfolding to_signal_def comp_def by auto\n    next\n      case False\n      then obtain time where \"inf_time (to_trans_raw_sig \\<tau>') s' t' = Some time\"\n        by auto\n      have \"time = t + 1 \\<or> time \\<noteq> t + 1\"\n        by auto\n      moreover\n      { assume \"time \\<noteq> t + 1\"\n        hence \"inf_time (to_trans_raw_sig (\\<tau>'(t + 1 := 0))) s' t' =  inf_time (to_trans_raw_sig \\<tau>') s' t'\"\n          using `inf_time (to_trans_raw_sig \\<tau>') s' t' = Some time`\n          by (metis inf_time_rem_curr_trans option.inject rem_curr_trans_to_trans_raw_sig)\n        hence ?thesis\n          using `inf_time (to_trans_raw_sig \\<tau>') s' t' = Some time` `time \\<noteq> t + 1`\n          unfolding to_signal_def comp_def\n          by (metis False option.case_eq_if option.sel rem_curr_trans_to_trans_raw_sig\n          trans_value_same_except_at_removed) }\n      moreover\n      { assume \"time = t + 1\"\n        hence \"inf_time (to_trans_raw_sig \\<tau>') s' t' = Some (t + 1)\"\n          using `inf_time (to_trans_raw_sig \\<tau>') s' t' = Some time` by auto\n        hence *: \"signal_of (\\<sigma> s') \\<tau>' s' t' = the ( (to_trans_raw_sig \\<tau>' s') (t + 1))\"\n          unfolding to_signal_def comp_def by auto\n        have \"t + 1 \\<in> dom ( (to_trans_raw_sig \\<tau>' s'))\"\n          by (metis (full_types) \\<open>inf_time (to_trans_raw_sig \\<tau>') s' t' = Some time\\<close> \\<open>time = t + 1\\<close> \n              dom_def inf_time_some_exists keys_def zero_option_def)\n        hence \"s' \\<in> dom ( \\<tau>' (t + 1))\"\n          unfolding next_time_def by (auto simp add: to_trans_raw_sig_def)\n        moreover have \"the ( (to_trans_raw_sig \\<tau>' s') (t + 1)) = the ( \\<tau>' (t + 1) s')\"\n          unfolding next_time_def by (auto simp add: to_trans_raw_sig_def)\n        ultimately have \"the ( (to_trans_raw_sig \\<tau>' s') (t + 1)) = next_state2 (t + 1) \\<tau>' \\<sigma> s'\"\n          unfolding next_state2_def Let_def by auto\n        with * have \"signal_of (\\<sigma> s') \\<tau>' s' t' = next_state2 (t + 1) \\<tau>' \\<sigma> s'\"\n          by auto\n        have \"\\<And>n. n < t + 1 \\<Longrightarrow>  \\<tau>' n = 0\"\n          using  assms  unfolding context_invariant_def by simp\n        hence \"inf_time (to_trans_raw_sig (\\<tau>'(t + 1 := 0))) s' t' = None\"\n          using inf_time_rem_curr_trans_at_t[OF `inf_time (to_trans_raw_sig \\<tau>') s' t' = Some (t + 1)`]\n          by (metis rem_curr_trans_to_trans_raw_sig to_trans_raw_sig_def zero_fun_def zero_option_def)\n        hence ?thesis\n          unfolding `signal_of (\\<sigma> s') \\<tau>' s' t' = next_state2 (t + 1) \\<tau>' \\<sigma> s'` to_signal_def by auto }\n      ultimately show ?thesis\n        unfolding to_signal_def comp_def by auto\n    qed\n    hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' =\n           snd (worldline_raw (t + 1) (next_state2 (t + 1) \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>'(t + 1 := 0))) s' t'\"\n      unfolding worldline_raw_def using `t \\<le> t'` and `t + 1 \\<le> t'` by auto }\n  moreover\n  { assume \"t = t' \"\n    have add_to_beh: \"add_to_beh \\<sigma> \\<theta> t (t + 1) = \\<theta>(t := Some o \\<sigma>)\"\n      unfolding add_to_beh_def  by auto\n    have \"signal_of (\\<sigma> s') \\<tau>' s' t' = \\<sigma> s'\"\n    proof -\n      have \"\\<forall>n < t + 1.  \\<tau>' n = 0\"\n        using assms unfolding context_invariant_def by auto\n      hence \"\\<forall>n. n \\<le> t' \\<longrightarrow>  \\<tau>' n = 0\"\n        using `t = t'` by auto\n      have \"\\<forall>t\\<in>dom ( (to_trans_raw_sig \\<tau>' s')). t' < t\"\n      proof (rule ccontr)\n        assume \"\\<not> (\\<forall>t\\<in>dom ( (to_trans_raw_sig \\<tau>' s')). t' < t)\"\n        then obtain time where \"time \\<in> dom ( (to_trans_raw_sig \\<tau>' s'))\" and \"time \\<le> t'\"\n          using leI by blast\n        hence \" \\<tau>' time \\<noteq> 0\"\n          by (auto simp add: to_trans_raw_sig_def zero_fun_def zero_fun_def zero_option_def zero_option_def)\n        moreover have \" \\<tau>' time = 0\"\n          using `\\<forall>n. n \\<le> t' \\<longrightarrow>  \\<tau>' n = 0` `time \\<le> t'` by auto\n        ultimately show False by auto\n      qed\n      hence \"inf_time (to_trans_raw_sig \\<tau>') s' t' = None\"\n        by (simp add: inf_time_none_iff)\n      thus ?thesis\n        unfolding to_signal_def comp_def by auto\n    qed\n    moreover have \"signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t' = \\<sigma> s'\"\n    proof -\n      have \"\\<forall>n< t+1.  \\<tau>' n = 0\"\n        using assms unfolding context_invariant_def by auto\n      hence \"\\<forall>n. n \\<le> t' \\<longrightarrow>  \\<tau>' n = 0\"\n        using `t = t'` by auto\n      have \"t \\<in> dom ( (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s'))\"\n        by  (auto simp add: to_trans_raw_sig_def)\n      moreover have \"\\<forall>ta\\<in>dom ( (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s')). ta \\<le> t' \\<longrightarrow> ta \\<le> t\"\n      proof (rule ccontr)\n        assume \"\\<not> (\\<forall>ta\\<in>dom ( (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s')). ta \\<le> t' \\<longrightarrow> ta \\<le> t)\"\n        then obtain ta where ta_dom: \"ta\\<in>dom ( (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s'))\"  and  \"ta \\<le> t'\" and \"ta > t\"\n          using leI by blast\n        have \" (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s') ta =   (to_trans_raw_sig \\<theta> s') ta\"\n          using `ta > t` by  (auto simp add: to_trans_raw_sig_def)\n        hence \" \\<theta> ta \\<noteq> 0\"\n          using ta_dom by (auto simp add: to_trans_raw_sig_def zero_fun_def zero_fun_def zero_option_def zero_option_def)\n        have \"\\<forall>n \\<ge> t.  \\<theta> n = 0\"\n          using assms(1) unfolding context_invariant_def by auto\n        hence \" \\<theta> ta = 0\"\n          using `ta > t` by auto\n        with ` \\<theta> ta \\<noteq> 0` show False by auto\n      qed\n      ultimately have \"inf_time (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>))) s' t' = Some t\"\n        using `t = t'` by (intro inf_time_someI)(auto)\n      moreover have \"the ( (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>)) s') t) = \\<sigma> s'\"\n        by  (auto simp add: to_trans_raw_sig_def)\n      ultimately show ?thesis\n        unfolding to_signal_def comp_def by auto\n    qed\n    ultimately have \"signal_of (\\<sigma> s') \\<tau>' s' t' = signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t'\"\n      by auto\n    hence \"signal_of (\\<sigma> s') \\<tau>' s' t' = signal_of (def s') (add_to_beh \\<sigma> \\<theta> t (t + 1)) s' t'\"\n      unfolding add_to_beh by auto\n    hence \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' =\n           snd (worldline_raw (t + 1) (next_state2 (t + 1) \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>'(t + 1 := 0))) s' t'\"\n      unfolding worldline_raw_def using `t = t'` by auto }\n  ultimately show \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s' t' =\n                   snd (worldline_raw (t + 1) (next_state2 (t + 1) \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>'(t + 1 := 0))) s' t'\"\n    by auto\nqed (simp add: worldline_raw_def)\n\nlemma worldline2_next_config:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n  shows \"(next_time t \\<tau>', snd (worldline2 t \\<sigma> \\<theta> def \\<tau>')) = worldline2 (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def \\<tau>'\"\nproof -\n  have \"worldline_raw t \\<sigma> \\<theta> def \\<tau>' = worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def \\<tau>'\"\n    using worldline_next_config assms by metis\n  thus ?thesis\n    unfolding worldline2_def by auto\nqed\n\nlemma worldline2_next_config_next_time:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n  shows \"(next_time t \\<tau>', snd (worldline2 t \\<sigma> \\<theta> def \\<tau>')) = worldline2 (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))\"\nproof -\n  have \"worldline_raw t \\<sigma> \\<theta> def \\<tau>' = worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))\"\n    using worldline_next_config_next_time using assms by metis\n  thus ?thesis\n    unfolding worldline2_def by auto\nqed\n\nlemma worldline2_next_config_next_time_suc:\n  assumes \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n  shows \"(t + 1, snd (worldline2 t \\<sigma> \\<theta> def \\<tau>')) = worldline2 (t + 1) (next_state2 (t + 1) \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>'(t + 1 := 0))\"\nproof -\n  have \"worldline_raw t \\<sigma> \\<theta> def \\<tau>' = worldline_raw (t + 1) (next_state2 (t + 1) \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>'(t + 1 := 0))\"\n    using worldline_next_config_next_time_suc using assms by metis\n  thus ?thesis\n    unfolding worldline2_def by auto\nqed\n\ninductive world_sim_fin2_alt :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> nat \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\" where\n  \"   fst tw < T \n  \\<Longrightarrow> world_conc_exec_alt tw cs tw2  \\<Longrightarrow> world_sim_fin2_alt (fst tw2 + 1, snd tw2) T cs tw3 \n  \\<Longrightarrow> world_sim_fin2_alt tw T cs tw3\"\n\n| \"  fst tw = T  \\<Longrightarrow> world_sim_fin2_alt tw T cs tw\"\n\ninductive_cases world_sim_fin2_alt_cases : \"world_sim_fin2_alt tw T cs tw'\"\n\nlemma split_world_sim_fin2_alt:\n  assumes \"world_sim_fin2_alt tw T cs tw'\"\n  assumes \"fst tw < t\" and \"t < T\"\n  shows   \"\\<exists>tw2. world_sim_fin2_alt tw t cs tw2 \\<and> world_sim_fin2_alt tw2 T cs tw'\"\n  using assms\nproof (induction rule: world_sim_fin2_alt.induct)\n  case (1 tw T cs tw2 tw3)\n  hence \"fst tw2 = fst tw\"\n    using fst_world_conc_exec_alt by fastforce\n  hence \"fst tw2 + 1 < t \\<or> fst tw2 + 1 = t\"\n    using 1 by linarith\n  moreover\n  { assume \"fst tw2 + 1 < t\"\n    hence \" \\<exists>tw2a. world_sim_fin2_alt (get_time tw2 + 1, snd tw2) t cs tw2a \\<and> world_sim_fin2_alt tw2a T cs tw3\"\n      using 1 unfolding fst_conv by auto\n    hence ?case\n      using \"1.hyps\"(2) \"1.prems\"(1) world_sim_fin2_alt.intros(1) by blast }\n  moreover\n  { assume \"fst tw2 + 1 = t\"\n    hence \"world_sim_fin2_alt (get_time tw2 + 1, snd tw2) t cs (fst tw2 + 1, snd tw2)\"\n      by (simp add: world_sim_fin2_alt.intros(2))\n    hence \" world_sim_fin2_alt tw t cs (fst tw2 + 1, snd tw2)\"\n      using `world_conc_exec_alt tw cs tw2` `fst tw < t` world_sim_fin2_alt.intros(1) by blast\n    hence ?case\n      using 1(3)  by (intro exI[where x=\"(fst tw2 + 1, snd tw2)\"])(auto) }\n  ultimately show ?case\n    by auto\nnext\n  case (2 tw T cs)\n  then show ?case by auto\nqed \n\nlemma world_sim_fin2_alt_unaffected:\n  assumes \"world_sim_fin2_alt tw T cs tw'\"\n  assumes \"sig \\<notin> set (signals_from cs)\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"\\<And>k. wline_of tw sig k = wline_of tw' sig k\"\n  using assms\nproof (induction rule: world_sim_fin2_alt.induct)\n  case (1 tw T cs tw2 tw3)\n  hence \"\\<And>k. wline_of (get_time tw2 + 1, snd tw2) sig k = wline_of tw3 sig k\"\n    by auto\n  moreover have \"\\<And>k. wline_of tw sig k = wline_of tw2 sig k\"\n    using world_conc_exec_alt_unaffected[OF 1(2)] \"1.prems\"(1) by blast\n  ultimately show ?case \n    unfolding comp_def snd_conv by auto\nqed auto\n\nlemma world_sim_fin2_alt_unaffected_before_curr:\n  assumes \"world_sim_fin2_alt tw T cs tw'\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"\\<And>k. k \\<le> fst tw \\<Longrightarrow> wline_of tw sig k = wline_of tw' sig k\"\n  using assms\nproof (induction rule: world_sim_fin2_alt.induct)\n  case (1 tw T cs tw2 tw3)\n  then show ?case \n    by (metis (no_types, lifting) One_nat_def add.right_neutral add_Suc_right comp_apply fst_conv\n    fst_world_conc_exec_alt le_imp_less_Suc nat_less_le snd_conv\n    world_conc_exec_alt_unaffected_before_curr)\nnext\n  case (2 tw T cs)\n  then show ?case by auto\nqed\n\nlemma fst_world_sim_fin2_alt:\n  assumes \"world_sim_fin2_alt tw T cs tw'\"\n  shows   \"fst tw' = T\"\n  using assms\n  apply (induction rule: world_sim_fin2_alt.inducts)\n  by auto\n\nlemma non_stuttering_suc:\n  assumes \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n  assumes \"\\<forall>n \\<le> t. \\<tau> n = 0\"\n  shows   \"\\<forall>s. non_stuttering (to_trans_raw_sig (\\<tau>(t + 1 := 0))) (next_state2 (t + 1) \\<tau> \\<sigma>) s \"\n  unfolding non_stuttering_def\nproof (rule, rule, rule, rule, rule)\n  fix s k1 k2\n  assume \"k1 < k2 \n         \\<and> k1 \\<in> keys (to_trans_raw_sig (\\<tau>(t+1:=0)) s) \n         \\<and> k2 \\<in> keys (to_trans_raw_sig (\\<tau>(t+1:=0)) s)\n         \\<and> (\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> keys (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s))\" \n  hence \"k1 < k2\"\n        \"k1 \\<in> keys (to_trans_raw_sig (\\<tau>(t+1:=0)) s) \"\n        \"k2 \\<in> keys (to_trans_raw_sig (\\<tau>(t+1:=0)) s) \"\n        \"(\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> keys (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s))\" \n    by auto\n  hence in1: \"k1 \\<in> keys (to_trans_raw_sig \\<tau> s)\" and in2: \"k2 \\<in> keys (to_trans_raw_sig \\<tau> s)\"\n    unfolding to_trans_raw_sig_def fun_upd_def keys_def zero_option_def \n  proof -\n    assume \"k1 \\<in> {k. (if k = t + 1 then 0 else \\<tau> k) s \\<noteq> None}\"\n    then have f1: \"(if k1 = t + 1 then 0 else \\<tau> k1) s \\<noteq> None\"\n      by blast\n    have \"\\<forall>n. ((if n = t + 1 then 0 else \\<tau> n) s \\<noteq> None) = (\\<not> (if n = t + 1 then 0 s = (None::val option) else \\<tau> n s = None))\"\n      by presburger\n    then have \"k1 \\<noteq> t + 1\"\n      using f1 by (metis zero_fun_def zero_option_def)\n    then show \"k1 \\<in> {n. \\<tau> n s \\<noteq> None}\"\n      using f1 by simp\n  next\n    assume \"k2 \\<in> {k. (if k = t + 1 then 0 else \\<tau> k) s \\<noteq> None}\"\n    then have f1: \"(if k2 = t + 1 then 0 else \\<tau> k2) s \\<noteq> None\"\n      by blast\n    have \"\\<forall>n. ((if n = t + 1 then 0 else \\<tau> n) s \\<noteq> None) = (\\<not> (if n = t + 1 then 0 s = (None::val option) else \\<tau> n s = None))\"\n      by presburger\n    then have \"k2 \\<noteq> t + 1\"\n      using f1 by (metis zero_fun_def zero_option_def)\n    then show \"k2 \\<in> {n. \\<tau> n s \\<noteq> None}\"\n      using f1 by simp\n  qed\n  have \"t < k1 \\<and> t < k2\"\n    using assms(2) \n    by (metis \\<open>k1 < k2 \\<and> k1 \\<in> keys (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s) \\<and> k2 \\<in> keys\n    (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s) \\<and> (\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> keys (to_trans_raw_sig (\\<tau>(t +\n    1 := 0)) s))\\<close> domIff dom_def in1 keys_def le0 less_trans not_less to_trans_raw_sig_def\n    zero_fun_def zero_option_def)\n  have *: \"(\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> keys (to_trans_raw_sig \\<tau> s))\"\n    by (metis (no_types, lifting) CollectD CollectI \\<open>\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> keys\n    (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s)\\<close> \\<open>t < k1 \\<and> t < k2\\<close> discrete keys_def le_less_trans\n    nat_neq_iff rem_curr_trans_to_trans_raw_sig trans_value_same_except_at_removed)\n  have \"k1 \\<noteq> t + 1 \\<and> k2 \\<noteq> t + 1\"\n    using `k1 \\<in> keys (to_trans_raw_sig (\\<tau>(t+1:=0)) s)` `k2 \\<in> keys (to_trans_raw_sig (\\<tau>(t+1:=0)) s)`\n    by (metis (mono_tags) domIff dom_def fun_upd_same keys_def to_trans_raw_sig_def zero_fun_def zero_option_def)\n  hence \"t + 1 < k1 \\<and> t + 1 < k2\"\n    using \\<open>t < k1 \\<and> t < k2\\<close> by linarith\n  hence \"to_trans_raw_sig (\\<tau>(t + 1 := 0)) s k1 = to_trans_raw_sig \\<tau> s k1\"\n    by (simp add: to_trans_raw_sig_def)\n  also have \"... \\<noteq> to_trans_raw_sig \\<tau> s k2\"\n    using * assms(1) unfolding non_stuttering_def  using \\<open>k1 < k2\\<close> in1 in2 by blast\n  also have \"to_trans_raw_sig \\<tau> s k2 = to_trans_raw_sig (\\<tau>(t+1:=0)) s k2\"\n    using `t + 1 < k1 \\<and> t + 1 < k2`  by (simp add: to_trans_raw_sig_def)\n  finally show \"to_trans_raw_sig (\\<tau>(t + 1 := 0)) s k1 \\<noteq> to_trans_raw_sig (\\<tau>(t+1:=0)) s k2\"\n    by blast\nnext\n  fix s\n  { assume *: \"keys (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s) \\<noteq> {}\"\n    let ?k = \"LEAST k. k \\<in> keys (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s)\"\n    have \"?k \\<in> keys (to_trans_raw_sig (\\<tau>(t+1:=0)) s)\"\n      apply (rule LeastI_ex) using * by blast\n    hence \"?k \\<noteq> t + 1\"  \n      unfolding to_trans_raw_sig_def  \n      by (metis domIff dom_def fun_upd_same keys_def zero_fun_def zero_option_def)\n    moreover have \"t < ?k\"\n      by (metis (mono_tags) \\<open>(LEAST k. k \\<in> keys (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s)) \\<in> keys\n      (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s)\\<close> assms(2) fun_upd_def keys_def mem_Collect_eq not_le\n      to_trans_raw_sig_def zero_fun_def)\n    ultimately have \"t + 1 < ?k\" \n      by auto\n    hence **: \"to_trans_raw_sig (\\<tau>(t+1:=0)) s ?k = to_trans_raw_sig \\<tau> s ?k\"\n      by (simp add: to_trans_raw_sig_def)\n    obtain a where \"\\<tau> (t + 1) s = None \\<or> \\<tau> (t + 1) s = Some a\"\n      using option.cases  by fastforce\n    moreover\n    { assume \"\\<tau> ( t + 1) s = None\"\n      have ***: \"keys (to_trans_raw_sig \\<tau> s) \\<noteq> {}\"\n        using `?k \\<in> keys (to_trans_raw_sig (\\<tau>(t+1:=0)) s)` `t + 1 < ?k` \n        by (metis (mono_tags) ** dom_def dom_eq_empty_conv keys_def mem_Collect_eq\n        zero_option_def)\n      have \"next_state2 (t + 1) \\<tau> \\<sigma> s = \\<sigma> s\"\n        using `\\<tau> (t + 1) s = None` unfolding next_state2_def Let_def  by (simp add: domIff)\n      also have \"... \\<noteq> the (to_trans_raw_sig \\<tau> s (LEAST k. k \\<in> keys (to_trans_raw_sig \\<tau> s)))\" (is \"... \\<noteq> ?comp\")\n        using assms(1) *** unfolding non_stuttering_def by auto\n      also have \"?comp = the (to_trans_raw_sig \\<tau> s ?k)\"\n        using `\\<tau> ( t + 1 ) s = None` `\\<forall>n\\<le>t. \\<tau> n = 0` \n        by (metis (no_types) \\<open>\\<tau> (t + 1) s = None\\<close> domIff dom_def fun_upd_def keys_def to_trans_raw_sig_def zero_fun_def zero_option_def)\n      also have \"... = the (to_trans_raw_sig (\\<tau>(t+1:=0)) s ?k)\"\n        using \"**\" by auto\n      finally have \"next_state2 (t + 1) \\<tau> \\<sigma> s \\<noteq> the (to_trans_raw_sig (\\<tau>(t+1:=0)) s ?k)\"\n        by auto }\n    moreover\n    { assume \"\\<tau> (t + 1) s = Some a\"\n      hence 1: \"t + 1 \\<in> keys (to_trans_raw_sig \\<tau> s)\" \n        by (simp add: keys_def to_trans_raw_sig_def zero_option_def)\n      have 2: \"?k \\<in> keys (to_trans_raw_sig \\<tau> s)\"\n        by (metis \"**\" \\<open>?k \\<in> keys (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s)\\<close> domIff dom_def keys_def zero_option_def)\n      have 3: \"\\<forall>k. t + 1 < k \\<and> k < ?k \\<longrightarrow> k \\<notin> keys (to_trans_raw_sig \\<tau> s)\"\n        by (metis keys_def mem_Collect_eq nat_neq_iff not_less_Least rem_curr_trans_to_trans_raw_sig trans_value_same_except_at_removed)\n      have \"next_state2 (t + 1) \\<tau> \\<sigma> s = a\"\n        using `\\<tau> (t + 1) s = Some a` unfolding next_state2_def Let_def dom_def by auto\n      also have \"... = the (to_trans_raw_sig \\<tau> s (t + 1))\"\n        using `\\<tau> (t + 1) s = Some a` unfolding to_trans_raw_sig_def by auto\n      also have \"... \\<noteq> the (to_trans_raw_sig \\<tau> s ?k)\" (is \"_ \\<noteq> ?comp\")\n        using assms(1) 1 2 3 `t + 1 < ?k`\n        unfolding non_stuttering_def by (smt CollectD keys_def option.exhaust_sel zero_option_def)\n      also have \"?comp = the (to_trans_raw_sig (\\<tau>(t+1:=0)) s ?k)\"\n        using ** by auto\n      finally have \"next_state2 (t + 1) \\<tau> \\<sigma> s \\<noteq> the (to_trans_raw_sig (\\<tau>(t+1:=0)) s ?k)\"\n        by auto }\n    ultimately have \"next_state2 (t + 1) \\<tau> \\<sigma> s \\<noteq> the (to_trans_raw_sig (\\<tau>(t+1:=0)) s ?k)\"\n        by auto }\n  thus \"keys (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s) \\<noteq> {} \\<longrightarrow>\n       next_state2 (t + 1) \\<tau> \\<sigma> s \\<noteq> the (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s (LEAST k. k \\<in> keys (to_trans_raw_sig (\\<tau>(t + 1 := 0)) s)))\"\n    by auto\nqed\n\nlemma world_sim_fin2_alt_semi_det:\n  assumes \"world_sim_fin2_alt tw T cs tw1\"\n  assumes \"world_sim_fin2 tw T cs tw2\"\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows \"tw1 = tw2\"\n  using assms\nproof (induction rule:world_sim_fin2_alt.inducts)\n  case (1 tw T cs tw2' tw3)\n  have \"\\<exists>t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<sigma>' \\<theta>' \\<tau>'. destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>) \\<and> \n       T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto>s (fst tw2, \\<sigma>', \\<theta>', \\<tau>') \\<and> worldline_raw (fst tw2) \\<sigma>' \\<theta>' def \\<tau>' = snd tw2\"\n    by (rule world_sim_fin2[OF 1(5)]) auto\n  then obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<sigma>' \\<theta>' \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and \n    sim: \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto>s (fst tw2, \\<sigma>', \\<theta>', \\<tau>')\" and \"worldline_raw (fst tw2) \\<sigma>' \\<theta>' def \\<tau>' = snd tw2\"\n    by blast\n  hence \"fst tw = t\" unfolding destruct_worldline_def Let_def by auto\n  with `fst tw < T` obtain \\<tau>'' where ex: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'' \\<and> \n      T,  t + 1,  next_state2 (t + 1) \\<tau>'' \\<sigma>,  next_event2 (t + 1) \\<tau>'' \\<sigma>,  \\<theta>(t := Some o \\<sigma>),  def \\<turnstile> <cs, \\<tau>''(t + 1 := 0)> \\<leadsto>s (fst tw2, \\<sigma>', \\<theta>', \\<tau>')\"\n    using bau_suc[OF sim]  by fastforce\n  hence trans_removal: \"\\<forall>n\\<le>t. \\<tau>'' n = 0\" and cont: \"T,  t + 1,  next_state2 (t + 1) \\<tau>'' \\<sigma>,  next_event2 (t + 1) \\<tau>'' \\<sigma>,  \\<theta>(t := Some o \\<sigma>),  def \\<turnstile> <cs, \\<tau>''(t + 1 := 0)> \\<leadsto>s (fst tw2, \\<sigma>', \\<theta>', \\<tau>')\"\n    using \"1.prems\"(3) b_conc_exec_preserve_trans_removal_nonstrict des\n    destruct_worldline_trans_zero_upto_now by blast+\n  have \"T = fst tw2\"\n    using final_time_b_simulate_fin_suc sim by fastforce\n  have \"world_conc_exec tw cs tw2'\"\n    using world_conc_exec_eq_world_conc_exec_alt[OF 1(6-7)] 1(2) by auto\n  have tw2_def: \"worldline2  t \\<sigma> \\<theta> def \\<tau>'' = tw2'\"\n    using fst_world_conc_exec_alt[OF 1(2)] `fst tw = t`  world_conc_exec_cases[OF `tw, cs \\<Rightarrow>\\<^sub>c tw2'`]\n    des ex unfolding worldline2_def \n    by (metis world_conc_exec.intros world_conc_exec_deterministic worldline2_def)\n  have ci: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using worldline2_constructible[OF des] by auto\n  have ci':\"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>''\"\n    apply (rule b_conc_exec_preserves_context_invariant)\n    using ex ci `nonneg_delay_conc cs` by auto\n  hence key: \"(get_time tw2' + 1, snd tw2') = (t + 1, worldline_raw (t + 1) (next_state2 (t + 1) \\<tau>'' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>''(t + 1 := 0)))\"\n    using worldline2_next_config_next_time_suc[OF ci'] tw2_def unfolding worldline2_def by auto\n  hence key': \"(get_time tw2' + 1, snd tw2') = worldline2 (t + 1) (next_state2 (t + 1) \\<tau>'' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>''(t + 1 := 0))\"\n    unfolding worldline2_def by auto\n  have \"fst tw2' = t\"  using \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>'' = tw2'\\<close> by auto\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    using des  using destruct_worldline_ensure_non_stuttering by blast\n  hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>'') \\<sigma> s\"\n    using b_conc_exec_preserves_non_stuttering ex \n    by (metis \"1.prems\"(2) \"1.prems\"(3) des destruct_worldline_trans_zero_upto_now)\n  have addtb: \"add_to_beh \\<sigma> \\<theta> t (t + 1) = \\<theta>(t:= Some o \\<sigma>)\"\n    unfolding add_to_beh_def by auto\n  have ns: \" \\<forall>s. non_stuttering (to_trans_raw_sig (\\<tau>''(t + 1 := 0))) (next_state2 (t + 1) \\<tau>'' \\<sigma>) s\"\n    using non_stuttering_suc \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>'') \\<sigma> s\\<close> trans_removal by blast\n  have \"\\<exists>\\<theta>'. destruct_worldline (fst tw2' + 1, snd tw2') = (t + 1, next_state2 (t + 1) \\<tau>'' \\<sigma>, next_event2 (t + 1) \\<tau>'' \\<sigma>, \\<theta>', def, \\<tau>''(t + 1 := 0))\n           \\<and> (\\<forall>k s. signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (t + 1)) s k = signal_of (def s) \\<theta>' s k)\"\n    unfolding key'\n    apply (rule destruct_worldline_correctness4)\n    unfolding addtb\n    apply (rule context_invariant_suc[OF ci _ `nonneg_delay_conc cs`])  \n    using ex ns by auto\n  then obtain \\<theta>2 where des2: \"destruct_worldline (fst tw2' + 1, snd tw2') = (t + 1, next_state2 (t + 1) \\<tau>'' \\<sigma>, next_event2 (t + 1) \\<tau>'' \\<sigma>, \\<theta>2, def, \\<tau>''(t + 1 := 0))\"\n        and histeq: \"(\\<forall>k s. signal_of (def s) (\\<theta>(t:=Some o \\<sigma>)) s k = signal_of (def s) \\<theta>2 s k)\"\n    unfolding add_to_beh_def by auto\n  have hist: \"\\<forall>n\\<ge>t+1. (\\<theta>(t:= Some o \\<sigma>)) n = 0\"\n    using des \n    by (metis One_nat_def add_leD1 add_le_same_cancel1 ci' context_invariant_def fun_upd_def not_less_eq_eq)\n  have hist2: \"\\<forall>n\\<ge>t + 1. \\<theta>2 n = 0\"\n    using des2  by (meson context_invariant_def worldline2_constructible)\n  obtain res where cont2: \"T,  t + 1,  next_state2 (t + 1) \\<tau>'' \\<sigma>,  next_event2 (t + 1) \\<tau>'' \\<sigma>,  \\<theta>2,  def \\<turnstile> <cs, \\<tau>''(t + 1 := 0)> \\<leadsto>s res\"\n    using only_context_matters_for_simulate_fin_suc_progress[OF cont _ hist hist2] histeq by blast \n  obtain \\<theta>'' where cont3: \"T,  t + 1,  next_state2 (t + 1) \\<tau>'' \\<sigma>,  next_event2 (t + 1) \\<tau>'' \\<sigma>,  \\<theta>2,  def \\<turnstile> <cs, \\<tau>''(t + 1 := 0)> \\<leadsto>s (fst tw2, \\<sigma>', \\<theta>'', \\<tau>')\" and\n    helper: \"(\\<forall>s k. k \\<le> T \\<longrightarrow> signal_of (def s) \\<theta>' s k = signal_of (def s) \\<theta>'' s k)\"\n    using histeq b_simulate_fin_suc_semi_equivalent[OF cont cont2 _ hist hist2]  final_time_b_simulate_fin_suc\n    by (metis (no_types, lifting) comp_def cont2 fst_conv prod.exhaust_sel sim snd_conv)\n  have w: \"worldline_raw (get_time tw2) \\<sigma>' \\<theta>'' def \\<tau>' = snd tw2\"\n    unfolding `worldline_raw (get_time tw2) \\<sigma>' \\<theta>' def \\<tau>' = snd tw2`[THEN sym]\n  proof (rule)\n    show \"get_time (worldline_raw (get_time tw2) \\<sigma>' \\<theta>'' def \\<tau>') = get_time (worldline_raw (get_time tw2) \\<sigma>' \\<theta>' def \\<tau>')\"\n      unfolding worldline_raw_def by auto\n  next\n    show \"snd (worldline_raw (get_time tw2) \\<sigma>' \\<theta>'' def \\<tau>') = snd (worldline_raw (get_time tw2) \\<sigma>' \\<theta>' def \\<tau>')\"\n      unfolding worldline_raw_def using helper unfolding `T = fst tw2` by fastforce\n  qed\n  have \"world_sim_fin2 (get_time tw2' + 1, snd tw2') T cs (fst tw2, snd tw2)\"\n    by (intro world_sim_fin2.intros)(rule des2, rule cont3, rule w)\n  then show ?case \n    using 1(4)[OF _ `conc_stmt_wf cs` `nonneg_delay_conc cs`] by auto\nnext\n  case (2 tw T cs)\n  show ?case \n    using 2(2) 2(1)\n  proof (induction rule:world_sim_fin2.inducts)\n    case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> T cs t' \\<sigma>' \\<theta>' \\<tau>' w')\n    have *: \"t' = t \\<and> \\<sigma>' = \\<sigma> \\<and> \\<theta>' = \\<theta> \\<and> \\<tau>' = \\<tau>\"\n      apply (rule bau_suc[OF 1(2)])\n      using `fst tw = T` 1(1) unfolding destruct_worldline_def Let_def by auto\n    hence \"worldline_raw t \\<sigma> \\<theta> def \\<tau> = w'\"\n      using 1(3) by auto\n    also have \"... = snd tw\"\n      using 1(1) 1(3)  by (metis \"*\" eq_snd_iff worldline2_constructible worldline2_def)\n    finally have \"worldline_raw t \\<sigma> \\<theta> def \\<tau> = snd tw\"\n      by auto\n    then show ?case \n      using 1(1) *  by (metis \\<open>w' = snd tw\\<close> fst_conv fst_destruct_worldline prod.exhaust_sel)\n  qed\nqed\n\nlemma world_sim_fin2_alt_progress:\n  assumes \"world_sim_fin2_alt tw T cs tw2\"\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows   \"\\<exists>tw'. world_sim_fin2 tw T cs tw'\"\n  using assms\nproof (induction rule:world_sim_fin2_alt.inducts)\n  case (1 tw T cs tw2 tw3)\n  then obtain a where \"world_sim_fin2 (get_time tw2 + 1, snd tw2) T cs a\"\n    by auto\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    using prod_cases6 by blast\n  hence \"t < T\"\n    using 1(1) unfolding destruct_worldline_def Let_def by auto\n  have \"tw, cs \\<Rightarrow>\\<^sub>c tw2\"\n    using world_conc_exec_eq_world_conc_exec_alt[OF `conc_stmt_wf cs` `nonneg_delay_conc cs`] 1(2)\n    by auto\n  with des obtain \\<tau>' where ex: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\" and \"worldline2  t \\<sigma> \\<theta> def \\<tau>' = tw2\"\n    using world_conc_exec_cases[OF `tw, cs \\<Rightarrow>\\<^sub>c tw2`] by force\n  have ci: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using des worldline2_constructible by blast\n  hence ci': \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n    using \"1.prems\"(2) \\<open>t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\\<close> b_conc_exec_preserves_context_invariant \n    by blast\n  hence key: \"(fst tw2 + 1, snd tw2) = (t + 1, worldline_raw (t + 1) (next_state2 (t + 1) \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>'(t + 1 := 0)))\"\n    using worldline2_next_config_next_time_suc[OF ci'] `worldline2  t \\<sigma> \\<theta> def \\<tau>' = tw2` \n    by (auto simp add: worldline2_def)\n  hence key': \"(get_time tw2 + 1, snd tw2) = worldline2 (t + 1) (next_state2 (t + 1) \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>'(t + 1 := 0))\"\n    unfolding worldline2_def by auto\n  have trans_removal: \"\\<forall>n\\<le>t. \\<tau>' n = 0\"\n    using des ex  by (meson ci' context_invariant_def)\n  have addtb: \"add_to_beh \\<sigma> \\<theta> t (t + 1) = \\<theta>(t:= Some o \\<sigma>)\"\n    unfolding add_to_beh_def by auto\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    using des  using destruct_worldline_ensure_non_stuttering by blast\n  hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n    using b_conc_exec_preserves_non_stuttering ex \n    by (metis \"1.prems\"(1) \"1.prems\"(2) des destruct_worldline_trans_zero_upto_now) \n  hence ns: \" \\<forall>s. non_stuttering (to_trans_raw_sig (\\<tau>'(t + 1 := 0))) (next_state2 (t + 1) \\<tau>' \\<sigma>) s\"\n    using non_stuttering_suc  trans_removal by blast\n  have \"\\<exists>\\<theta>'. destruct_worldline (fst tw2 + 1, snd tw2) = (t + 1, next_state2 (t + 1) \\<tau>' \\<sigma>, next_event2 (t + 1) \\<tau>' \\<sigma>, \\<theta>', def, \\<tau>'(t + 1 := 0))\n           \\<and> (\\<forall>k s. signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (t + 1)) s k = signal_of (def s) \\<theta>' s k)\"\n    unfolding key'\n    apply (rule destruct_worldline_correctness4)\n    unfolding addtb\n    apply (rule context_invariant_suc[OF ci _ `nonneg_delay_conc cs`])  \n    using ex ns by auto\n  then obtain \\<theta>2 where des2: \"destruct_worldline (fst tw2 + 1, snd tw2) = (t + 1, next_state2 (t + 1) \\<tau>' \\<sigma>, next_event2 (t + 1) \\<tau>' \\<sigma>, \\<theta>2, def, \\<tau>'(t + 1 := 0))\"\n        and histeq: \"(\\<forall>k s. signal_of (def s) (\\<theta>(t:=Some o \\<sigma>)) s k = signal_of (def s) \\<theta>2 s k)\"\n    unfolding add_to_beh_def by auto  \n  hence \"\\<forall>n\\<ge>t + 1. \\<theta>2 n = 0\"\n    by (meson context_invariant_def worldline2_constructible)\n  have \"\\<forall>n\\<ge>t + 1. (\\<theta>(t:=Some o \\<sigma>)) n = 0\"\n    by (metis Suc_eq_plus1 ci' context_invariant_def fun_upd_apply nat_le_linear not_less_eq_eq)\n  then obtain t1 \\<sigma>1 \\<theta>1 \\<tau>1 where *: \"T, t + 1, next_state2 (t + 1) \\<tau>' \\<sigma>, next_event2 (t + 1) \\<tau>' \\<sigma>, \\<theta>2, def \\<turnstile> <cs, \\<tau>'(t + 1 := 0)> \\<leadsto>s (t1, \\<sigma>1, \\<theta>1, \\<tau>1)\"\n                            and \" a = (t1, worldline_raw t1 \\<sigma>1 \\<theta>1 def \\<tau>1)\"\n    using world_sim_fin2[OF `world_sim_fin2 (get_time tw2 + 1, snd tw2) T cs a`] \n  proof -\n    assume a1: \"\\<And>t1 \\<sigma>1 \\<theta>1 \\<tau>1. \\<lbrakk>T, t + 1 , next_state2 (t + 1) \\<tau>' \\<sigma> , next_event2 (t + 1) \\<tau>' \\<sigma> , \\<theta>2, def \\<turnstile> <cs , \\<tau>' (t + 1 := 0)> \\<leadsto>s (t1, \\<sigma>1, \\<theta>1, \\<tau>1); a = (t1, worldline_raw t1 \\<sigma>1 \\<theta>1 def \\<tau>1)\\<rbrakk> \\<Longrightarrow> thesis\"\n    obtain nn :: nat and vv :: \"'a \\<Rightarrow> val\" and zz :: \"nat \\<Rightarrow> 'a \\<Rightarrow> val option\" and vva :: \"'a \\<Rightarrow> val\" and zza :: \"nat \\<Rightarrow> 'a \\<Rightarrow> val option\" and nna :: nat and vvb :: \"'a \\<Rightarrow> val\" and AA :: \"'a set\" and zzb :: \"nat \\<Rightarrow> 'a \\<Rightarrow> val option\" and zzc :: \"nat \\<Rightarrow> 'a \\<Rightarrow> val option\" where\n      \"a = (nn, worldline_raw nn vv zz vva zza) \\<and> destruct_worldline (get_time tw2 + 1, snd tw2) = (nna, vvb, AA, zzb, vva, zzc) \\<and> T, nna , vvb , AA , zzb, vva \\<turnstile> <cs , zzc> \\<leadsto>s (nn, vv, zz, zza)\"\n      using \\<open>\\<And>P. (\\<And>t \\<sigma> \\<gamma> \\<theta> def \\<tau> t' \\<sigma>' \\<theta>' \\<tau>'. \\<lbrakk>a = (t', worldline_raw t' \\<sigma>' \\<theta>' def \\<tau>'); destruct_worldline (get_time tw2 + 1, snd tw2) = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>); T, t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs , \\<tau>> \\<leadsto>s (t', \\<sigma>', \\<theta>', \\<tau>')\\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow> P\\<close> by force\n    then show ?thesis\n      using a1 des2 by auto\n  qed\n  obtain res4 where  **: \"T, t + 1, next_state2 (t + 1) \\<tau>' \\<sigma>, next_event2 (t + 1) \\<tau>' \\<sigma>, \\<theta>(t:=Some o \\<sigma>), def \\<turnstile> <cs, \\<tau>'(t + 1 := 0)> \\<leadsto>s res4\"\n    using only_context_matters_for_simulate_fin_suc_progress[OF * _ `\\<forall>n\\<ge>t + 1. \\<theta>2 n = 0` `\\<forall>n\\<ge>t + 1. (\\<theta>(t:=Some o \\<sigma>)) n = 0`] \n    histeq by presburger\n  obtain \\<theta>4 where \"res4 = (t1, \\<sigma>1, \\<theta>4, \\<tau>1)\"\n    using b_simulate_fin_suc_semi_equivalent[OF * ** _ `\\<forall>n\\<ge>t + 1. \\<theta>2 n = 0` ` \\<forall>n\\<ge>t + 1. (\\<theta>(t := Some \\<circ> \\<sigma>)) n = 0`] \n    histeq final_time_b_simulate_fin_suc[OF **] final_time_b_simulate_fin_suc[OF *] \n    by (metis comp_apply fst_conv prod.exhaust_sel snd_conv)\n  have \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto>s res4\" \n    by (rule b_simulate_fin_suc.intros(1)[OF `t < T` ex **])\n  then show ?case \n    using des \\<open>res4 = (t1, \\<sigma>1, \\<theta>4, \\<tau>1)\\<close> world_sim_fin2.intros by blast\nnext\n  case (2 tw T cs)\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n    using prod_cases6 by blast\n  hence \"t = T\"\n    using 2(1) unfolding destruct_worldline_def Let_def by auto\n  hence \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto>s (t, \\<sigma>, \\<theta>, \\<tau>)\"\n    by (simp add: b_simulate_fin_suc.intros(2))\n  have \"worldline_raw t \\<sigma> \\<theta> def \\<tau> = snd tw\"\n    using des  by (metis snd_conv worldline2_constructible worldline2_def)\n  then show ?case \n    using \\<open>T, t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs , \\<tau>> \\<leadsto>s (t, \\<sigma>, \\<theta>, \\<tau>)\\<close> des world_sim_fin2.intros by blast\nqed\n\nlemma world_simp_fin2_alt_imp_world_sim_fin2:\n  assumes \"world_sim_fin2_alt tw T cs tw'\"\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows   \"world_sim_fin2 tw T cs tw'\"\n  using world_sim_fin2_alt_progress[OF assms] world_sim_fin2_alt_semi_det[OF assms(1) _ assms(2-3)]\n  by blast\n\nlemma world_sim_fin2_progress:\n  assumes \"world_sim_fin2 tw T cs tw2\"\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows   \"\\<exists>tw'. world_sim_fin2_alt tw T cs tw'\"\n  using assms\nproof (induction rule:world_sim_fin2.inducts)\n  case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> T cs t' \\<sigma>' \\<theta>' \\<tau>' w')\n  show ?case \n    using 1(1-2) 1(4-5)\n  proof (induction \"T - t\" arbitrary: tw T t \\<sigma> \\<gamma> \\<theta> \\<tau> \\<theta>' w')\n    case 0\n    then show ?case \n      by (metis (no_types) \"0.hyps\" \"0.prems\"(1) \"0.prems\"(2) bau_suc diff_diff_cancel diff_zero\n      fst_conv fst_destruct_worldline less_or_eq_imp_le world_sim_fin2_alt.intros(2))\n  next\n    case (Suc x) \n    hence \"x = T - (t + 1)\" and \"t < T\" by auto\n    note IH = Suc(1)[OF `x = T - (t + 1)`]\n    obtain \\<tau>2 where ex: \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>2\" and \n                    rest: \"T,  t + 1,  next_state2 (t + 1) \\<tau>2 \\<sigma>,  next_event2 (t + 1) \\<tau>2 \\<sigma>,  \\<theta>(t := Some o \\<sigma>),  def \\<turnstile> <cs, \\<tau>2(t + 1 := 0)> \\<leadsto>s (t', \\<sigma>', \\<theta>', \\<tau>')\"\n      using bau_suc[OF Suc(4)] `t < T` by auto\n    hence \"tw, cs \\<Rightarrow>\\<^sub>c worldline2  t \\<sigma> \\<theta> def \\<tau>2\"\n      by (intro world_conc_exec.intros[OF Suc(3) ex])(auto)\n    hence \"world_conc_exec_alt tw cs (worldline2 t \\<sigma> \\<theta> def \\<tau>2)\" \n      using world_conc_exec_imp_world_conc_exec_alt[OF _ `conc_stmt_wf cs` `nonneg_delay_conc cs`]\n      by auto\n    let ?tw = \"worldline2 t \\<sigma> \\<theta> def \\<tau>2\"\n    have ci: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n      using Suc(3) worldline2_constructible by blast\n    hence ci': \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>2\"\n      using  ex b_conc_exec_preserves_context_invariant Suc.prems(4) by blast\n    hence key: \"(fst ?tw + 1, snd ?tw) = (t + 1, worldline_raw (t + 1) (next_state2 (t + 1) \\<tau>2 \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>2(t + 1 := 0)))\"\n      using worldline2_next_config_next_time_suc[OF ci'] by (auto simp add: worldline2_def)\n    hence key': \"(get_time ?tw + 1, snd ?tw) = worldline2 (t + 1) (next_state2 (t + 1) \\<tau>2 \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (t + 1)) def (\\<tau>2(t + 1 := 0))\"\n      unfolding worldline2_def by auto      \n    have trans_removal: \"\\<forall>n\\<le>t. \\<tau>2 n = 0\"\n      using ex  by (meson ci' context_invariant_def)\n    have addtb: \"add_to_beh \\<sigma> \\<theta> t (t + 1) = \\<theta>(t:= Some o \\<sigma>)\"\n      unfolding add_to_beh_def by auto  \n    have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n      using Suc(3)  using destruct_worldline_ensure_non_stuttering by blast\n    hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>2) \\<sigma> s\"\n      using b_conc_exec_preserves_non_stuttering ex \n      by (metis \"1.prems\"(1) \"1.prems\"(2) Suc(3) destruct_worldline_trans_zero_upto_now) \n    hence ns: \" \\<forall>s. non_stuttering (to_trans_raw_sig (\\<tau>2(t + 1 := 0))) (next_state2 (t + 1) \\<tau>2 \\<sigma>) s\"\n      using non_stuttering_suc  trans_removal by blast\n    have \"\\<exists>\\<theta>'. destruct_worldline (fst ?tw + 1, snd ?tw) = (t + 1, next_state2 (t + 1) \\<tau>2 \\<sigma>, next_event2 (t + 1) \\<tau>2 \\<sigma>, \\<theta>', def, \\<tau>2(t + 1 := 0))\n             \\<and> (\\<forall>k s. signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (t + 1)) s k = signal_of (def s) \\<theta>' s k)\"\n      unfolding key'\n      apply (rule destruct_worldline_correctness4)\n      unfolding addtb\n      apply (rule context_invariant_suc[OF ci _ `nonneg_delay_conc cs`])  \n      using ex ns by auto\n    then obtain \\<theta>2 where des2: \"destruct_worldline (fst ?tw + 1, snd ?tw) = (t + 1, next_state2 (t + 1) \\<tau>2 \\<sigma>, next_event2 (t + 1) \\<tau>2 \\<sigma>, \\<theta>2, def, \\<tau>2(t + 1 := 0))\"\n          and histeq: \"(\\<forall>k s. signal_of (def s) (\\<theta>(t:=Some o \\<sigma>)) s k = signal_of (def s) \\<theta>2 s k)\"\n      unfolding add_to_beh_def by auto     \n    hence \"\\<forall>n\\<ge>t + 1. \\<theta>2 n = 0\"\n      by (meson context_invariant_def worldline2_constructible)\n    have \"\\<forall>n\\<ge>t + 1. (\\<theta>(t:=Some o \\<sigma>)) n = 0\"\n      by (metis Suc_eq_plus1 ci' context_invariant_def fun_upd_apply nat_le_linear not_less_eq_eq)\n    obtain \\<theta>3 where rest2: \"T,  t + 1,  next_state2 (t + 1) \\<tau>2 \\<sigma>,  next_event2 (t + 1) \\<tau>2 \\<sigma>,  \\<theta>2,  def \\<turnstile> <cs, \\<tau>2(t + 1 := 0)> \\<leadsto>s (t', \\<sigma>', \\<theta>3, \\<tau>')\"\n      using only_context_matters_for_simulate_fin_suc_progress[OF rest _ `\\<forall>n\\<ge>t + 1. (\\<theta>(t := Some \\<circ> \\<sigma>)) n = 0` `\\<forall>n\\<ge>t + 1. \\<theta>2 n = 0`] histeq\n      b_simulate_fin_suc_semi_equivalent[OF rest _  _ `\\<forall>n\\<ge>t + 1. (\\<theta>(t := Some \\<circ> \\<sigma>)) n = 0` `\\<forall>n\\<ge>t + 1. \\<theta>2 n = 0`]   \n      final_time_b_simulate_fin_suc[OF rest] final_time_b_simulate_fin_suc \n      by (metis (no_types, hide_lams) comp_apply prod.collapse prod.inject)\n    note IH2 = IH[OF des2 rest2 `conc_stmt_wf cs` `nonneg_delay_conc cs`]\n    then obtain tw' where continue: \"world_sim_fin2_alt (fst ?tw + 1, snd ?tw) T cs tw'\"\n      by auto\n    have \"fst tw < T\"\n      using `t < T`  by (metis Suc.prems(1) fst_conv fst_destruct_worldline)\n    show ?case \n      by (intro exI)\n         (rule world_sim_fin2_alt.intros(1)[OF `fst tw < T` `world_conc_exec_alt tw cs ?tw` continue]) \n  qed\nqed\n\nlemma world_sim_fin2_imp_world_sim_fin2_alt:\n  assumes \"world_sim_fin2 tw T cs tw'\"\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows   \"world_sim_fin2_alt tw T cs tw'\"\n  using world_sim_fin2_progress[OF assms] world_sim_fin2_alt_semi_det[OF _ assms(1) assms(2-3)]\n  by blast\n\nlemma world_sim_fin2_eq_world_sim_fin2_alt:\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows   \"world_sim_fin2 tw T cs = world_sim_fin2_alt tw T cs\"\n  using assms world_sim_fin2_imp_world_sim_fin2_alt world_simp_fin2_alt_imp_world_sim_fin2\n  by blast\n\nlemma world_sim_fin_eq_world_sim_fin2_alt:\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows   \"world_sim_fin w T cs = world_sim_fin2_alt w T cs\"\n  using world_sim_fin2_eq_world_sim_fin2_alt[OF assms] world_sim_fin2_eq_world_sim_fin[OF assms(2) assms(1)]\n  by auto\n\nlemma non_stuttering_preserved:\n  assumes \"non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n  shows   \"non_stuttering (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0))) (next_state t \\<tau> \\<sigma>) s\"\nproof -\n  define ks where \"ks = keys (to_trans_raw_sig \\<tau> s)\"\n  define ks_del where \"ks_del = keys (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s)\"\n  { fix k1 k2 :: nat\n    assume \"k1 < k2\"\n    assume \"k1 \\<in> ks_del\" and \"k2 \\<in> ks_del\"\n    assume \"\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> ks_del\"\n    have \"k1 \\<in> ks\" and \"k2 \\<in> ks\"\n      using `k1 \\<in> ks_del` `k2 \\<in> ks_del` unfolding ks_del_def ks_def to_trans_raw_sig_def keys_def\n      by (metis (mono_tags) fun_upd_apply mem_Collect_eq zero_fun_def)+\n    have \"next_time t \\<tau> < k1\"\n      using `k1 \\<in> ks_del` unfolding ks_del_def to_trans_raw_sig_def keys_def\n      by (metis domIff dom_def fun_upd_apply nat_neq_iff next_time_at_least2 zero_fun_def zero_option_def)\n    hence \"\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> ks\"\n      using `\\<forall>k. k1 < k \\<and> k < k2 \\<longrightarrow> k \\<notin> ks_del` unfolding ks_del_def ks_def to_trans_raw_sig_def\n      keys_def by auto\n    with `k1 \\<in> ks` and `k2 \\<in> ks` have \"to_trans_raw_sig \\<tau> s k1 \\<noteq> to_trans_raw_sig  \\<tau> s k2\"\n      using assms `k1 < k2` unfolding non_stuttering_def ks_def by auto\n    moreover have \"to_trans_raw_sig \\<tau> s k1 = to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s k1\"\n      using `next_time t \\<tau> < k1` unfolding to_trans_raw_sig_def by auto\n    moreover have \"to_trans_raw_sig \\<tau> s k2 = to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s k2\"\n      using `next_time t \\<tau> < k1` `k1 < k2` unfolding to_trans_raw_sig_def by auto\n    ultimately have \"to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s k1 \\<noteq>\n                                            to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s k2\"\n      by auto }\n  note first_po = this\n  { assume \"ks_del \\<noteq> {}\"\n    hence \"\\<tau> \\<noteq> 0\" and \"\\<tau>(next_time t \\<tau> := 0) \\<noteq> 0\"\n      unfolding ks_del_def to_trans_raw_sig_def keys_def\n      by (metis (mono_tags, lifting) Collect_empty_eq fun_upd_idem zero_fun_def)+\n    define least_del where \"least_del \\<equiv> (LEAST k. k \\<in> keys (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s))\"\n    have \"least_del \\<in> keys (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s)\"\n      using LeastI_ex `ks_del \\<noteq> {}` unfolding ks_del_def\n      by (metis (full_types) Collect_mem_eq empty_Collect_eq least_del_def)\n    hence \"dom ((\\<tau>(next_time t \\<tau> := 0)) least_del) \\<noteq> {}\"\n      by (metis domIff dom_def empty_iff keys_def to_trans_raw_sig_def zero_option_def)\n    have \"next_time t \\<tau> \\<le> least_del\"\n    proof (rule ccontr)\n      assume \"\\<not> next_time t \\<tau> \\<le> least_del\"\n      hence \"least_del < next_time t \\<tau>\" by auto\n      hence \"least_del < (LEAST n. dom (\\<tau> n) \\<noteq> {})\"\n        unfolding next_time_def using `\\<tau> \\<noteq> 0` by auto\n      with not_less_Least have \"dom (\\<tau> least_del) = {}\"\n        by auto\n      moreover have \"dom (\\<tau> least_del) \\<noteq> {}\"\n        using `dom ((\\<tau>(next_time t \\<tau> := 0)) least_del) \\<noteq> {}` `least_del < next_time t \\<tau>`\n        by simp\n      ultimately show False by auto\n    qed\n    moreover  have \"next_time t \\<tau> \\<noteq> least_del\"\n      by (metis \\<open>dom ((\\<tau>(next_time t \\<tau> := 0)) least_del) \\<noteq> {}\\<close> dom_eq_empty_conv fun_upd_same\n      zero_fun_def zero_option_def)\n    ultimately have \"next_time t \\<tau> < least_del\"\n      using `next_time t \\<tau> \\<le> least_del` by auto\n    have \"next_time t \\<tau> \\<in> ks \\<or> next_time t \\<tau> \\<notin> ks\"\n      by auto\n    have \"least_del \\<in> ks\"\n      using `next_time t \\<tau> < least_del` `least_del \\<in> keys (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s)`\n      unfolding ks_def by (simp add: keys_def to_trans_raw_sig_def)\n    moreover have \"\\<forall>k. next_time t \\<tau> < k \\<and> k < least_del \\<longrightarrow> k \\<notin> ks\"\n    proof (rule, rule)\n      fix k\n      assume \"next_time t \\<tau> < k \\<and> k < least_del\"\n      hence \"next_time t \\<tau> < k\" and \"k < least_del\"\n        by auto\n      hence \"k \\<notin> ks_del\"\n        unfolding ks_del_def least_del_def using not_less_Least by blast\n      thus \"k \\<notin> ks\"\n        using `next_time t \\<tau> < k` unfolding ks_del_def ks_def keys_def\n        by (simp add: to_trans_raw_sig_def)\n    qed\n    moreover\n    { assume \"next_time t \\<tau> \\<in> ks\"\n      hence \"s \\<in> dom (\\<tau> (next_time t \\<tau>))\"\n        unfolding ks_def keys_def to_trans_raw_sig_def  by (simp add: dom_def zero_option_def)\n      hence *: \"next_state t \\<tau> \\<sigma> s = the (to_trans_raw_sig \\<tau> s (next_time t \\<tau>))\"\n        unfolding next_state_def Let_def to_trans_raw_sig_def by auto\n      have \"to_trans_raw_sig \\<tau> s (next_time t \\<tau>) \\<noteq> to_trans_raw_sig \\<tau> s least_del\"\n        using `next_time t \\<tau> \\<in> ks` `next_time t \\<tau> < least_del` assms unfolding non_stuttering_def\n        ks_def  using calculation(1) calculation(2) ks_def by blast\n      moreover have \"to_trans_raw_sig \\<tau> s least_del = to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s least_del\"\n        using `next_time t \\<tau> \\<noteq> least_del`  by (metis fun_upd_apply to_trans_raw_sig_def)\n      ultimately have \"to_trans_raw_sig \\<tau> s (next_time t \\<tau>) \\<noteq> to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s least_del\"\n        by auto\n      hence \" next_state t \\<tau> \\<sigma> s \\<noteq>\n        the (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s (LEAST k. k \\<in> keys (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s)))\"\n        using * unfolding least_del_def\n      proof -\n        assume a1: \"to_trans_raw_sig \\<tau> s (next_time t \\<tau>) \\<noteq> to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s (LEAST k. k \\<in> keys (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s))\"\n          have \"{n. to_trans_raw_sig \\<tau> s n \\<noteq> 0} = ks\"\n        by (simp add: keys_def ks_def)\n        then have f2: \"\\<And>n. n \\<notin> ks \\<or> to_trans_raw_sig \\<tau> s n \\<noteq> None\"\n        using zero_option_def by force\n        then have \"to_trans_raw_sig \\<tau> s least_del \\<noteq> None\"\n        using \\<open>least_del \\<in> ks\\<close> by blast\n        then show ?thesis\n          using f2 a1 \\<open>next_state t \\<tau> \\<sigma> s = the (to_trans_raw_sig \\<tau> s (next_time t \\<tau>))\\<close> \\<open>next_time t \\<tau> \\<in> ks\\<close> \\<open>to_trans_raw_sig \\<tau> s least_del = to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s least_del\\<close> least_del_def by force\n      qed }\n    moreover\n    { assume \"next_time t \\<tau> \\<notin> ks\"\n      hence \"s \\<notin> dom (\\<tau> (next_time t \\<tau>))\"\n        unfolding ks_def to_trans_raw_sig_def keys_def by (auto simp add: zero_option_def)\n      hence \"next_state t \\<tau> \\<sigma> s = \\<sigma> s\"\n        unfolding next_state_def Let_def by auto\n      have \"to_trans_raw_sig \\<tau> s least_del = to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s least_del\"\n        using `next_time t \\<tau> \\<noteq> least_del`  by (metis fun_upd_apply to_trans_raw_sig_def)\n      have \"to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s = to_trans_raw_sig \\<tau> s\"\n        using `s \\<notin> dom (\\<tau> (next_time t \\<tau>))` unfolding to_trans_raw_sig_def\n        by (intro ext)(simp add: domIff zero_fun_def zero_option_def)\n      hence \"least_del = (LEAST k. k \\<in> keys (to_trans_raw_sig \\<tau> s))\" (is \"_ = ?least\")\n        unfolding least_del_def by auto\n      have \"ks \\<noteq> {}\"\n        using `ks_del \\<noteq> {}` `next_time t \\<tau> \\<notin> ks` unfolding ks_del_def ks_def\n        by (simp add: \\<open>to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s = to_trans_raw_sig \\<tau> s\\<close>)\n      have \"\\<sigma> s \\<noteq> the (to_trans_raw_sig \\<tau> s ?least)\"\n        using assms unfolding non_stuttering_def using \\<open>ks \\<noteq> {}\\<close> ks_def by blast\n      hence \" next_state t \\<tau> \\<sigma> s \\<noteq>\n        the (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s (LEAST k. k \\<in> keys (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s)))\"\n        by (simp add: \\<open>next_state t \\<tau> \\<sigma> s = \\<sigma> s\\<close> \\<open>to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s = to_trans_raw_sig \\<tau> s\\<close>) }\n    ultimately have \"next_state t \\<tau> \\<sigma> s \\<noteq>\n        the (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s (LEAST k. k \\<in> keys (to_trans_raw_sig (\\<tau>(next_time t \\<tau> := 0)) s)))\"\n      by auto }\n  with first_po show ?thesis\n    unfolding non_stuttering_def ks_del_def by auto\nqed\n\nlemma b_seq_exec_mono_wrt_history:\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>,  def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n  assumes \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>' s k\"\n  shows   \"t, \\<sigma>, \\<gamma>, \\<theta>', def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\"\n  using assms\n  by (induction rule:b_seq_exec.inducts)(meson b_seq_exec.intros beval_cong)+\n\nlemma b_conc_exec_mono_wrt_history:\n  assumes \"t, \\<sigma>, \\<gamma>, \\<theta>,  def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\"\n  assumes \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>' s k\"\n  shows   \"t, \\<sigma>, \\<gamma>, \\<theta>', def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\"\n  using assms\n  by (induction rule:b_conc_exec.inducts)(meson b_conc_exec.intros beval_cong b_seq_exec_mono_wrt_history)+\n\nlemma while_soundness2:\n  assumes \"\\<Turnstile> \\<lbrace>\\<lambda>tw. P tw \\<rbrace> cs \\<lbrace>\\<lambda>tw. \\<forall>i \\<in> {fst tw <.. next_time_world tw}. P (i, snd tw)\\<rbrace>\"\n  assumes \"tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\n  assumes \"P tw\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"P tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> def res where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n  sim: \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto> res\" and   woh: \"tw' = (get_time res, worldline_raw (get_time res) (get_state res) (get_beh res) def (get_trans res))\"\n    using premises_of_world_sim_fin'[OF assms(2)]\n    by (smt prod.exhaust_sel)\n  have tau_def:  \"\\<tau> = derivative_raw (snd tw) (fst tw)\" and\n      sigma_def: \"\\<sigma> = (\\<lambda>s. wline_of tw s (fst tw))\" and\n      theta_def: \"\\<theta> = derivative_hist_raw (snd tw) (fst tw)\" and\n      gamma_def: \"\\<gamma> = {s. wline_of tw s (fst tw) \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) (fst tw)) s (fst tw - 1)}\"\n    using des unfolding destruct_worldline_def Let_def by auto\n  have non_stut: \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    unfolding tau_def sigma_def   by (simp add: derivative_raw_ensure_non_stuttering)\n  have non_stut2: \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n    using des destruct_worldline_ensure_non_stuttering_hist_raw theta_def by blast\n  have \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\" and \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using worldline2_constructible[OF des] by auto\n  (*TODO : try to enter the non_stut2 into the inductive hypothesis *)\n  with sim show ?thesis\n    using woh assms(1) assms(3-5) non_stut gamma_def\n  proof (induction arbitrary: tw rule:b_simulate_fin.induct)\n    case (1 t maxtime \\<tau> \\<gamma> \\<sigma> \\<theta> def cs \\<tau>' res)\n    hence \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n      unfolding context_invariant_def by auto\n    have \"snd tw = worldline_raw t \\<sigma> \\<theta> def \\<tau>\"\n      using 1(6-7) unfolding worldline2_def by auto\n    obtain theta where dw_def: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, theta, def, \\<tau>)\" and\n                    \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k\"\n      using destruct_worldline_correctness4[OF \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\\<close> \\<open>\\<forall>s. non_stuttering\n      (to_trans_raw_sig \\<tau>) \\<sigma> s\\<close>]  using \"1.prems\"(1) by blast\n    hence \"b_conc_exec t \\<sigma> \\<gamma> theta def cs \\<tau> \\<tau>'\"\n      using b_conc_exec_mono_wrt_history[OF \\<open> t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\\<close>]\n      by blast\n    then obtain tw_conc where \"tw, cs \\<Rightarrow>\\<^sub>c tw_conc\" and \"worldline2 t \\<sigma> theta def \\<tau>' = tw_conc\"\n      using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, theta, def, \\<tau>)\\<close>\n      using world_conc_exec.intros by blast\n    have \"fst tw = fst tw_conc\"\n      using fst_world_conc_exec `tw, cs \\<Rightarrow>\\<^sub>c tw_conc` by metis\n    have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n      by (meson \"1.prems\"(6) \"1.prems\"(7) \"1.prems\"(8) \\<open>\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\\<close> \\<open>t , \\<sigma> , \\<gamma> , theta, def\n      \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\\<close> b_conc_exec_preserves_non_stuttering)\n    have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n      using b_conc_exec_preserves_context_invariant[OF 1(3) `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>` `nonneg_delay_conc cs`]\n      by auto\n    hence \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau>' n = 0\"\n      unfolding context_invariant_def by auto\n    hence \"derivative_raw (snd tw_conc) (get_time tw_conc) = \\<tau>'\"\n      using derivative_raw_of_worldline2[OF _ \\<open>\\<forall>a. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> a\\<close>]\n      \\<open>worldline2 t \\<sigma> theta def \\<tau>' = tw_conc\\<close> by auto\n    have \"next_time_world tw_conc = next_time t \\<tau>'\"\n      unfolding next_time_world_def Let_def\n      by (metis \\<open>derivative_raw (snd tw_conc) (get_time tw_conc) = \\<tau>'\\<close> \\<open>get_time tw = get_time\n      tw_conc\\<close> dw_def fst_conv fst_destruct_worldline)\n    with `P tw`  have \"P (next_time_world tw_conc, snd tw_conc)\"\n      using 1(10) \\<open>next_time t \\<tau>' \\<le> maxtime\\<close> unfolding conc_hoare_valid_def\n      by (meson \\<open>tw , cs \\<Rightarrow>\\<^sub>c tw_conc\\<close> dual_order.refl greaterThanAtMost_iff next_time_world_at_least)\n    have \"world_conc_exec tw cs tw_conc\"\n      using world_conc_exec_rem_curr_trans_eq_only_if[OF 1(12-13)] `tw, cs \\<Rightarrow>\\<^sub>c tw_conc` by auto\n    have \" \\<tau> t = 0\"\n      by (auto simp add: `\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0`)\n    hence \"t < next_time t \\<tau>'\"\n      using  nonneg_delay_conc_next_time_strict[OF _ `t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'` `nonneg_delay_conc cs` `conc_stmt_wf cs`]\n      \\<open>\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\\<close> dual_order.order_iff_strict  by blast\n    have ci: \"context_invariant (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (next_event t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))\"\n      using context_invariant[OF 1(8) 1(3) `t < next_time t \\<tau>'`]  by auto\n    have \"context_invariant t \\<sigma> \\<gamma> theta def \\<tau>\"\n      using worldline2_constructible using dw_def by blast\n    have \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw_conc\"\n      unfolding sym[OF `worldline2 t \\<sigma> theta def \\<tau>' = tw_conc`] worldline2_def worldline_raw_def\n      `\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k` by auto\n    hence \"fst tw_conc = t\"\n      by auto\n    have \"snd tw_conc = worldline_raw t \\<sigma> \\<theta> def \\<tau>'\"\n      using `worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw_conc` unfolding worldline2_def by auto\n    have \"next_time_world tw_conc = next_time t \\<tau>'\"\n      unfolding next_time_world_def Let_def `snd tw_conc = worldline_raw t \\<sigma> \\<theta> def \\<tau>'`\n      using derivative_raw_of_worldline `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'` `\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s`\n      unfolding world_quiet_def worldline_deg_def `fst tw = fst tw_conc` `snd tw_conc = worldline_raw t \\<sigma> \\<theta> def \\<tau>'`\n      context_invariant_def\n      by (simp add: derivative_raw_of_worldline_specific \\<open>fst tw_conc = t\\<close>)\n    hence twc: \"(next_time_world tw_conc, snd tw_conc) =\n             worldline2 (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))\"\n      using `worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw_conc` worldline2_next_config_next_time[OF `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'`]\n      by auto\n    have ns: \" \\<forall>s. non_stuttering (to_trans_raw_sig (\\<tau>'(next_time t \\<tau>' := 0))) (next_state t \\<tau>' \\<sigma>) s\"\n      using non_stuttering_preserved `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'` unfolding context_invariant_def\n      by (simp add: non_stuttering_preserved \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\\<close>)\n    have ne: \"next_event t \\<tau>' \\<sigma> = {s. (wline_of (next_time_world tw_conc, snd tw_conc)) s (fst (next_time_world tw_conc, snd tw_conc)) \\<noteq>\n      signal_of (def s) (derivative_hist_raw ( (snd (next_time_world tw_conc, snd tw_conc))) (fst (next_time_world tw_conc, snd tw_conc))) s\n       (fst (next_time_world tw_conc, snd tw_conc) - 1)}\" (is \"_ = ?complex\")\n    proof -\n      have \"?complex = {s.  (wline_of tw_conc) s (next_time_world tw_conc) \\<noteq>\n      signal_of (def s) (derivative_hist_raw ( (snd tw_conc)) (next_time_world tw_conc)) s\n       (next_time_world tw_conc - 1)}\"\n        by auto\n      also have \"... = {s. snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s (next_time t \\<tau>') \\<noteq>\n                           signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>') (next_time t \\<tau>')) s (next_time t \\<tau>' - 1)}\"\n        using ` (snd tw_conc) = worldline_raw t \\<sigma> \\<theta> def \\<tau>'` `next_time_world tw_conc = next_time t \\<tau>'`\n        by auto\n      also have \"... = {s. snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s (next_time t \\<tau>') \\<noteq>  signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1)}\"\n      proof -\n        have 0: \"snd (worldline2 t \\<sigma> \\<theta> def \\<tau>') = worldline_raw t \\<sigma> \\<theta> def \\<tau>'\"\n          by (auto simp add: worldline2_def)\n        have *: \"... = worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0)) \"\n          using worldline_next_config_next_time[OF `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'`] by auto\n        have **: \"snd (worldline2 (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>' (next_time t \\<tau>' := 0))) =\n              worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))\"\n          unfolding worldline2_def by auto\n        have \"\\<And>s. signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>') (next_time t \\<tau>')) s (next_time t \\<tau>' - 1) =\n                   signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1)\"\n          using hist_of_worldline ci unfolding context_invariant_def ** sym[OF *]\n          by (smt \"*\" \"**\")\n        thus ?thesis\n          by auto\n      qed\n      also have \"... = {s. next_state t \\<tau>' \\<sigma> s \\<noteq> signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1)}\"\n      proof -\n        have \"t \\<le> next_time t \\<tau>'\"\n          using next_time_at_least[OF `\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau>' n = 0`] by auto\n        hence \"\\<And>s. snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s (next_time t \\<tau>') = signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>')\"\n          unfolding worldline_raw_def by auto\n        moreover have \"\\<And>s. signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = next_state t \\<tau>' \\<sigma> s\"\n        proof -\n          fix s\n          have \"s \\<in> (dom ( \\<tau>' (next_time t \\<tau>'))) \\<or> s \\<notin> (dom ( \\<tau>' (next_time t \\<tau>')))\"\n            by auto\n          moreover\n          { assume s_dom: \"s \\<in> dom ( \\<tau>' (next_time t \\<tau>'))\"\n            then obtain val where lookup: \" \\<tau>' (next_time t \\<tau>') s = Some val\"\n              by auto\n            hence \"next_state t \\<tau>' \\<sigma> s = val\"\n              unfolding next_state_def Let_def using s_dom by auto\n            also have \"... = signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>')\"\n              using lookup trans_some_signal_of' by fastforce\n            finally have \"signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = next_state t \\<tau>' \\<sigma> s\"\n              by auto }\n          moreover\n          { have \" \\<tau> t s = 0\"\n              using ` \\<tau> t  = 0` by (auto simp add: zero_fun_def zero_option_def zero_option_def)\n            have \"\\<And>n. n < t \\<Longrightarrow>  \\<tau>' n  = 0\"\n              using `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'` unfolding context_invariant_def by auto\n            assume s_not_dom: \"s \\<notin> dom ( \\<tau>' (next_time t \\<tau>'))\"\n            hence \"next_state t \\<tau>' \\<sigma> s = \\<sigma> s\"\n              unfolding next_state_def Let_def by auto\n            have \"\\<And>n. n < t \\<Longrightarrow>  \\<tau>' n s = 0\"\n              using s_not_dom \\<open>\\<And>n. n < t \\<Longrightarrow>  \\<tau>' n = 0\\<close>  by (simp add: zero_fun_def)\n            have \"\\<And>n. t < n \\<Longrightarrow> n < next_time t \\<tau>' \\<Longrightarrow>  \\<tau>' n = 0\"\n              by (simp add: until_next_time_zero)\n            hence \"\\<And>n. t < n \\<Longrightarrow> n \\<le> next_time t \\<tau>' \\<Longrightarrow>  \\<tau>' n s = 0\"\n              using s_not_dom by (metis (full_types) domIff nat_less_le zero_fun_def zero_fun_def zero_option_def)\n            hence \"signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = signal_of (\\<sigma> s) \\<tau>' s t\"\n              by (metis \\<open>t \\<le> next_time t \\<tau>'\\<close> le_neq_implies_less signal_of_less_ind')\n            also have \"... = signal_of (\\<sigma> s) \\<tau>' s 0\"\n              by (meson \\<open>\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau>' n = 0\\<close> less_eq_nat.simps(1) signal_of_less_ind)\n            also have \"... = \\<sigma> s\"\n              by (metis \\<open>\\<tau> t = 0\\<close> \\<open>\\<tau> t s = 0\\<close> domIff le0 le_neq_implies_less\n              next_time_at_least2 s_not_dom signal_of_zero zero_fun_def zero_option_def)\n            finally have \"signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = \\<sigma> s\"\n              by auto\n            hence \"signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = next_state t \\<tau>' \\<sigma> s\"\n              using \\<open>next_state t \\<tau>' \\<sigma> s = \\<sigma> s\\<close> by simp }\n          ultimately show \" signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = next_state t \\<tau>' \\<sigma> s\"\n            by auto\n        qed\n        ultimately have \"\\<And>s. snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s (next_time t \\<tau>') = next_state t \\<tau>' \\<sigma> s\"\n          by auto\n        thus ?thesis by auto\n      qed\n      also have \"... = {s. next_state t \\<tau>' \\<sigma> s \\<noteq> \\<sigma> s}\"\n      proof -\n        have \"t \\<le> next_time t \\<tau>'\"\n          using \\<open>\\<And>n. n \\<le> t \\<Longrightarrow>  \\<tau>' n = 0\\<close> next_time_at_least  by (simp add: next_time_at_least)\n        moreover have \"\\<And>n. t \\<le> n \\<Longrightarrow>  \\<theta> n = 0\"\n          using `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>` unfolding context_invariant_def by auto\n        ultimately have \"\\<And>s n. t < n \\<Longrightarrow> n \\<le> next_time t \\<tau>' - 1 \\<Longrightarrow> (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) n s = 0\"\n          unfolding add_to_beh_def by (simp add: lookup_update zero_fun_def)\n        hence \"t \\<le> next_time t \\<tau>' - 1\"\n          using `t < next_time t \\<tau>'` by auto\n        { fix s\n          have \"signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1) =\n                signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s t\"\n            using `t \\<le> next_time t \\<tau>' - 1`\n            by (metis (full_types) \\<open>\\<And>s n. \\<lbrakk>t < n; n \\<le> next_time t \\<tau>' - 1\\<rbrakk> \\<Longrightarrow> (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) n s = 0\\<close> le_neq_implies_less signal_of_less_ind')\n          also have \"... =  signal_of (def s) (\\<theta>(t:= Some o \\<sigma>)) s t\"\n            using `t < next_time t \\<tau>'` unfolding add_to_beh_def by auto\n          also have \"... = \\<sigma> s\"\n            by (meson fun_upd_same trans_some_signal_of)\n          finally have \"signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1) = \\<sigma> s\"\n            by auto }\n        hence \"\\<And>s. signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1) = \\<sigma> s\"\n          by auto\n        thus ?thesis by auto\n      qed\n      also have \"... = next_event t \\<tau>' \\<sigma>\"\n        unfolding next_event_alt_def by auto\n      finally show ?thesis by auto\n    qed\n    show ?case\n      using 1(6)[OF twc ci 1(9-10) _ 1(12-13) ns ne] `P (next_time_world tw_conc, snd tw_conc)`\n      by auto\n  next\n    case (3 t maxtime \\<tau> \\<gamma> \\<sigma> \\<theta> def cs)\n    hence \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta> n = 0\"\n      unfolding context_invariant_def by auto\n    have \"worldline2 t \\<sigma> \\<theta> def \\<tau> = (t, def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\"\n    proof\n      show \"get_time (worldline2 t \\<sigma> \\<theta> def \\<tau>) = get_time (t, def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\"\n        by simp\n    next\n      have \"worldline_raw t \\<sigma> \\<theta> def \\<tau> = (def, \\<lambda>s' t'. signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t')\"\n      proof (rule, rule_tac[2] ext, rule_tac[2] ext)\n        fix s' t'\n        have \"t' < t \\<or> t \\<le> t'\" by auto\n        moreover\n        { assume \"t' < t\"\n          hence *: \"\\<And>n. n < t \\<Longrightarrow>  (to_trans_raw_sig  (\\<theta>(t := Some \\<circ> \\<sigma>)) s') n = (to_trans_raw_sig \\<theta> s') n\"\n            by (auto simp add:to_trans_raw_sig_def)\n          hence \"inf_time (to_trans_raw_sig  (\\<theta>(t := Some \\<circ> \\<sigma>))) s' t' = inf_time (to_trans_raw_sig \\<theta>) s' t'\"\n            by (meson \\<open>t' < t\\<close> inf_time_equal_when_same_trans_upto_strict)\n          hence \"signal_of (def s')  (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' = signal_of (def s') \\<theta> s' t'\"\n            unfolding to_signal_def comp_def using `t' < t`\n            by (auto dest!: inf_time_at_most split:option.splits simp add: to_trans_raw_sig_def)\n          hence \" snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t' = signal_of (def s')  (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t'\"\n            unfolding worldline_raw_def using `t' < t` by auto }\n        moreover\n        { assume \"t \\<le> t'\"\n         have \"\\<tau> = 0\"\n            using `quiet \\<tau> \\<gamma>` unfolding quiet_def by meson\n          hence inf_none: \"inf_time (to_trans_raw_sig \\<tau>) s' t' = None\"\n            unfolding inf_time_def  by (simp add: keys_def to_trans_raw_sig_def zero_fun_def)\n          have *: \"keys (to_trans_raw_sig  (\\<theta>(t := Some \\<circ> \\<sigma>)) s') = insert t (keys (to_trans_raw_sig \\<theta> s'))\"\n            by (auto simp add: to_trans_raw_sig_def keys_def zero_option_def)\n          have \"(\\<forall>n\\<ge>t. \\<theta> n = 0)\"\n            using 3(4) unfolding context_invariant_def by auto\n          hence **: \" \\<forall>k\\<in> (keys (to_trans_raw_sig \\<theta> s')). k < t\"\n            unfolding to_trans_raw_sig_def\n            by (metis domIff dom_def keys_def leI zero_fun_def zero_option_def)\n          have \"inf_time (to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>))) s' t' = Some t\"\n          proof -\n            have \"\\<exists>k\\<in>keys (to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>)) s'). k \\<le> t'\"\n              using * `t \\<le> t'` by auto\n            moreover have \"(GREATEST k. k \\<in> keys (to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>)) s') \\<and> k \\<le> t') = t\"\n            proof (rule Greatest_equality)\n              show \"t \\<in> keys (to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>)) s') \\<and> t \\<le> t'\"\n                using * `t \\<le> t'` by auto\n            next\n              show \"\\<And>y. y \\<in> keys (to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>)) s') \\<and> y \\<le> t' \\<Longrightarrow> y \\<le> t\"\n                unfolding * using ** by auto\n            qed\n            ultimately show ?thesis\n              unfolding inf_time_def  by auto\n          qed\n          moreover have \"the ((to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>)) s') t) = \\<sigma> s'\"\n            using 3(2) unfolding to_trans_raw_sig_def by auto\n          ultimately have \"signal_of (\\<sigma> s') \\<tau> s' t' = signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t'\"\n            using inf_none unfolding to_signal_def comp_def\n            by (simp add: inf_time_def)\n          hence \" snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t' = signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t'\"\n            unfolding worldline_raw_def using `t \\<le> t'` by auto }\n        ultimately show \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t' =  snd (def, \\<lambda>s'. signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s') s' t'\"\n          by auto\n      next\n        show \"get_time (worldline_raw t \\<sigma> \\<theta> def \\<tau>) = get_time (def, \\<lambda>s'. signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s')\"\n          by (simp add: worldline_raw_def)\n      qed\n      thus \"snd (worldline2 t \\<sigma> \\<theta> def \\<tau>) = snd (t, def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\"\n        unfolding worldline2_def  worldline_raw_def worldline_of_history_def by auto\n    qed\n    hence tw_def: \"tw = (t, def, worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)))\"\n      using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>` by auto\n    have *: \"\\<forall>tw'. tw, cs \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> next_time_world tw' = fst tw + 1 \\<and> snd tw = snd tw'\"\n    proof (rule, rule)\n      fix tw'\n      assume \"tw, cs \\<Rightarrow>\\<^sub>c tw'\"\n      hence \"fst tw = fst tw'\"\n        using fst_world_conc_exec  by metis\n      hence \"fst tw' = t\"\n        using tw_def by auto\n      obtain theta where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, theta, def, \\<tau>)\"\n        and sig_eq: \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k\"\n        using 3 destruct_worldline_correctness4 by blast\n      have \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def cs \\<tau> \\<tau>\"\n        using `quiet \\<tau> \\<gamma>`  by (metis b_conc_exec_empty_event quiet_def)\n      moreover have \"b_conc_exec t \\<sigma> \\<gamma> theta def cs \\<tau> \\<tau>\"\n        using `quiet \\<tau> \\<gamma>`  by (metis b_conc_exec_empty_event quiet_def)\n      ultimately have \"tw' = tw\"\n        using `tw, cs \\<Rightarrow>\\<^sub>c tw'` des `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>`\n        by (smt b_conc_exec_deterministic fst_conv snd_conv world_conc_exec_cases worldline2_constructible)\n      have \"derivative_raw (snd tw') (fst tw') = \\<tau>\"\n        unfolding `tw' = tw` using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>` 3(4) unfolding context_invariant_def\n        by (simp add: \"3.prems\"(8) derivative_raw_of_worldline2)\n      thus \"next_time_world tw' = fst tw + 1 \\<and> snd tw = snd tw'\"\n        using 3(2) unfolding next_time_world_def Let_def `fst tw' = t` quiet_def next_time_def\n        using \\<open>fst tw' = t\\<close> \\<open>tw' = tw\\<close> by auto\n    qed\n    obtain \\<theta>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>', def, \\<tau>)\" and\n      \"\\<And>s k. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>' s k\"\n      using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>`\n      by (meson \"3.prems\"(2) \"3.prems\"(8) destruct_worldline_correctness4)\n    moreover have \"tw , cs \\<Rightarrow>\\<^sub>c tw\"\n    proof (intro world_conc_exec.intros)\n      show \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>', def, \\<tau>)\"\n        using des by auto\n    next\n      have \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>\"\n        using `quiet \\<tau> \\<gamma>`  by (metis b_conc_exec_empty_event quiet_def)\n      thus \"t, \\<sigma>, \\<gamma>, \\<theta>', def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>\"\n        using b_conc_exec_mono_wrt_history  calculation(2) by blast\n    next\n      show \" worldline2 t \\<sigma> \\<theta>' def \\<tau> = tw\"\n        using des worldline2_constructible by blast\n    qed\n    ultimately have \"P (fst tw + 1, snd tw)\"\n      using 3(6) `P tw` tw_def \\<open>t < maxtime\\<close> unfolding conc_hoare_valid_def\n      by (simp add: \"*\")\n    { fix time\n      assume \"time > fst tw\"\n      have \"\\<forall>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> next_time_world tw' = time + 1 \\<and> snd tw = snd tw'\"\n      proof (rule, rule)\n        fix tw'\n        assume \"(time, snd tw), cs \\<Rightarrow>\\<^sub>c tw'\"\n        hence \"time = fst tw'\"\n          using fst_world_conc_exec by (metis fst_conv)\n        have \"\\<tau> = 0\"\n          using \\<open>quiet \\<tau> \\<gamma>\\<close> unfolding quiet_def by meson\n        have \"\\<forall>n \\<ge> t. \\<theta> n = 0\" and \"\\<forall>n \\<le> t. \\<tau> n = 0\"\n          using \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\\<close> unfolding context_invariant_def by auto\n        hence \"\\<exists>theta. destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, theta, def, \\<tau>) \\<and>\n               (\\<forall>k s. signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) theta s k)\"\n        proof -\n          have *: \"destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, derivative_hist_raw (snd tw) time, def, \\<tau>)\"\n          proof -\n            have \"snd tw = (def, worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)))\"\n              using tw_def by auto\n            have \"\\<theta> time = 0\"\n              using `time > fst tw` \\<open>\\<forall>n \\<ge> t. \\<theta> n = 0\\<close> by (simp add: \"3.prems\"(1))\n            { fix s\n              have \"wline_of tw s time = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s time\"\n                using \\<open>tw = (t, def, worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)))\\<close>\n                unfolding worldline_of_history_def by auto\n              also have \"... = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s time\"\n                using signal_of_less[of \"\\<theta>(t := Some o \\<sigma>)\" \"t + 1\"] by simp\n              also have \"... = \\<sigma> s\"\n                by (smt \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>get_time tw < time\\<close> fst_conv fun_upd_other fun_upd_same\n                less_imp_le_nat nat_neq_iff signal_of_less_ind trans_some_signal_of tw_def)\n              hence \"wline_of tw s time = \\<sigma> s\"\n                using \\<open>wline_of tw s time = signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s time\\<close>  by simp }\n            note * = this\n            hence \"(\\<lambda>s. wline_of tw s time) = \\<sigma>\"\n              by auto\n            hence 1: \"(\\<lambda>s. wline_of (time, snd tw) s (fst (time, snd tw))) = \\<sigma>\"\n              by auto\n            have 2: \"{s. wline_of tw s time \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) time) s t} = {}\"\n              using *\n              by (metis (mono_tags, lifting) Collect_empty_eq \\<open>get_time tw < time\\<close> des\n              destruct_worldline_correctness(2) destruct_worldline_correctness(6)\n              destruct_worldline_def fst_conv signal_of_derivative_hist_raw\n              worldline2_constructible)\n            { fix s n\n              assume \"n \\<ge> time\"\n              have \"wline_of tw s n = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s n\"\n                by (simp add: tw_def worldline_of_history_def)\n              also have \"... = signal_of (def s) (\\<theta> (t := Some o \\<sigma>)) s time\"\n                using \\<open>n \\<ge> time\\<close>\n                by (intro signal_of_less_ind')\n                   (metis \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>fst tw < time\\<close> dual_order.trans fst_conv fun_upd_apply leD\n                   order.strict_implies_order tw_def zero_fun_def)\n              also have \"... = wline_of tw s time\"\n                by (simp add: tw_def worldline_of_history_def)\n              finally have \"wline_of tw s n = wline_of tw s time\"\n                by auto }\n            hence 3: \"derivative_raw (snd tw) time = \\<tau>\"\n              using derivative_raw_alt_def[where tw=\"(time, snd tw)\"] \\<open>\\<tau> = 0\\<close>\n              by (metis comp_apply fst_conv snd_conv)\n            have \"fst tw = t\"\n              by (simp add: \"3.prems\"(1))\n            hence \"\\<And>s k . signal_of (def s) (derivative_hist_raw (snd tw) time) s (time - 1) =\n                          signal_of (def s) (derivative_hist_raw (snd tw) time ) s t\"\n              using `time > fst tw`\n              by (smt \"3.prems\"(1) Suc_diff_1 Suc_lessI \\<open>\\<tau> = 0\\<close> diff_less fst_conv le_add2\n              le_add_same_cancel2 le_less_trans nat_neq_iff order.strict_implies_order\n              signal_of_derivative_hist_raw signal_of_empty snd_conv worldline2_def\n              worldline_raw_def zero_less_one)\n            hence new2: \"{s. wline_of tw s time \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) time) s (time - 1)} = {}\"\n              using 2 by auto\n            have \"fst (snd tw) = def\"\n              by (simp add: \\<open>snd tw = (def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close>)\n            with 1 new2 3 show ?thesis\n              unfolding destruct_worldline_def Let_def\n              by auto\n          qed\n          { fix k s\n            have \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n            proof -\n              have \"fst tw = t\"\n                by (simp add: tw_def)\n              have \"k \\<le> time \\<or> time < k\"\n                by auto\n              moreover\n              { assume \"k \\<le> time\"\n                hence \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                  using \\<open>fst tw < time\\<close> \\<open>fst tw = t\\<close>\n                  by (smt Suc_diff_1 Suc_leI \\<open>\\<tau> = 0\\<close> \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau> = (t, def,\n                  worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close> dual_order.order_iff_strict\n                  eq_fst_iff le_add2 le_add_same_cancel2 not_le signal_of_derivative_hist_raw\n                  signal_of_derivative_hist_raw2 signal_of_empty snd_conv tw_def worldline2_def\n                  worldline_of_history_def worldline_raw_def) }\n              moreover\n              { assume \"time < k\"\n                hence \"t < k\" and \"time \\<le> k\"\n                  using \\<open>fst tw < time\\<close> tw_def by auto\n                hence \" inf_time (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>))) s k = Some t\"\n                  by (meson \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>t < k\\<close> inf_time_update less_or_eq_imp_le)\n                hence \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = \\<sigma> s\"\n                  unfolding to_signal_def comp_def  by (simp add: to_trans_raw_sig_def)\n                have \"signal_of (def s) (derivative_hist_raw (snd tw) time) s k = wline_of tw s (time - 1)\"\n                  using signal_of_derivative_hist_raw2[OF `time \\<le> k`]\n                  by (smt \\<open>get_time tw < time\\<close> comp_apply fst_conv neq0_conv not_less_zero snd_conv tw_def)\n                also have \"... = worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)) s t\"\n                  unfolding tw_def\n                  by (smt Suc_diff_1 Suc_lessI \\<open>\\<tau> = 0\\<close> \\<open>get_time tw < time\\<close> \\<open>get_time tw = t\\<close>\n                  \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau> = (t, def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close>\n                  comp_apply dual_order.strict_trans2 gr_implies_not_zero less_imp_le_nat\n                  less_irrefl_nat linorder_neqE_nat signal_of_empty snd_conv worldline2_def\n                  worldline_raw_def)\n                also have \"... = signal_of (def s) (\\<theta>(t:= Some o \\<sigma>)) s t\"\n                  unfolding worldline_of_history_def by auto\n                finally have \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                  by (metis \\<open>signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s k = \\<sigma> s\\<close> fun_upd_same trans_some_signal_of) }\n              ultimately show \"signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                by auto\n            qed }\n          with * show ?thesis\n            by auto\n        qed\n        then obtain theta where des: \"destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, theta, def, \\<tau>)\"\n          and \"\\<And>k s. signal_of (def s) (\\<theta>(t:= Some o \\<sigma>)) s k = signal_of (def s) theta s k\"\n          by blast\n        have \"b_conc_exec time \\<sigma> {} theta def cs \\<tau> \\<tau>\"\n          by (simp add: b_conc_exec_empty_event)\n        hence \"(time, snd tw), cs \\<Rightarrow>\\<^sub>c (worldline2  time \\<sigma> theta def \\<tau>)\"\n          using des world_conc_exec.intros by blast\n        moreover have \"(time, snd tw) = worldline2 time \\<sigma> theta def \\<tau>\"\n          using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>`  using des worldline2_constructible by blast\n        ultimately have \"(time, snd tw), cs \\<Rightarrow>\\<^sub>c (time, snd tw)\"\n          by auto\n        hence \"(time, snd tw) = tw'\"\n          using world_conc_exec_deterministic  by (metis \\<open>(time, snd tw) , cs \\<Rightarrow>\\<^sub>c tw'\\<close>)\n        hence \"derivative_raw (snd tw') (fst tw') = \\<tau>\"\n          by (metis \"3.prems\"(8) \\<open>(time, snd tw) = worldline2 time \\<sigma> theta def \\<tau>\\<close> \\<open>\\<tau> = 0\\<close> \\<open>time =\n          get_time tw'\\<close> derivative_raw_of_worldline2 zero_fun_def)\n        thus \" next_time_world tw' = time + 1 \\<and> snd tw = snd tw'\"\n          using 3(2) unfolding next_time_world_def Let_def\n          using \\<open>(time, snd tw) = tw'\\<close> \\<open>\\<tau> = 0\\<close> by force\n      qed }\n    hence \"\\<And>time. time > fst tw \\<Longrightarrow> \\<forall>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> next_time_world tw' = time + 1 \\<and> snd tw = snd tw'\"\n      by auto\n    with * have **: \"\\<And>time. time \\<ge> fst tw \\<Longrightarrow> \\<forall>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> next_time_world tw' = time + 1 \\<and> snd tw = snd tw'\"\n      by (metis (full_types) dual_order.order_iff_strict prod.collapse)\n    have always_progress: \"\\<And>time. get_time tw \\<le> time \\<Longrightarrow> \\<exists>tw'. (time, snd tw) , cs \\<Rightarrow>\\<^sub>c tw'\"\n    proof -\n      fix time\n      have \"\\<tau> = 0\"\n        by (meson \"3.hyps\"(2) quiet_def)\n      assume \"get_time tw \\<le> time\"\n      hence \"get_time tw = time \\<or> get_time tw < time\"\n        by auto\n      moreover\n      { assume \"get_time tw = time\"\n        hence \"(time, snd tw) = tw\"\n          by auto\n        hence \"\\<exists>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw'\"\n          by (metis \\<open>tw , cs \\<Rightarrow>\\<^sub>c tw\\<close>) }\n      moreover\n      { assume \"get_time tw < time\"\n        hence \"\\<exists>theta. destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, theta, def, \\<tau>) \\<and>\n               (\\<forall>k s. signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) theta s k)\"\n        proof -\n          have *: \"destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, derivative_hist_raw (snd tw) time, def, \\<tau>)\"\n          proof -\n            have \"snd tw = (def, worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)))\"\n              using tw_def by auto\n            have \"\\<theta> time = 0\"\n              using `time > fst tw` \\<open>\\<forall>n \\<ge> t. \\<theta> n = 0\\<close> by (simp add: \"3.prems\"(1))\n            { fix s\n              have \"wline_of tw s time = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s time\"\n                using \\<open>tw = (t, def, worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)))\\<close>\n                unfolding worldline_of_history_def by auto\n              also have \"... = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s time\"\n                using signal_of_less[of \"\\<theta>(t := Some o \\<sigma>)\" \"t + 1\"] by simp\n              also have \"... = \\<sigma> s\"\n                by (smt \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>get_time tw < time\\<close> fst_conv fun_upd_other fun_upd_same\n                less_imp_le_nat nat_neq_iff signal_of_less_ind trans_some_signal_of tw_def)\n              hence \"wline_of tw s time = \\<sigma> s\"\n                using \\<open>wline_of tw s time = signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s time\\<close>  by simp }\n            note * = this\n            hence \"(\\<lambda>s. wline_of tw s time) = \\<sigma>\"\n              by auto\n            hence 1: \"(\\<lambda>s. wline_of (time, snd tw) s (fst (time, snd tw))) = \\<sigma>\"\n              by auto\n            have 2: \"{s. wline_of tw s time \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) time) s t} = {}\"\n              using *\n              by (metis (mono_tags, lifting) Collect_empty_eq \\<open>get_time tw < time\\<close> des\n              destruct_worldline_correctness(2) destruct_worldline_correctness(6)\n              destruct_worldline_def fst_conv signal_of_derivative_hist_raw\n              worldline2_constructible)\n            { fix s n\n              assume \"n \\<ge> time\"\n              have \"wline_of tw s n = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s n\"\n                by (simp add: tw_def worldline_of_history_def)\n              also have \"... = signal_of (def s) (\\<theta> (t := Some o \\<sigma>)) s time\"\n                using \\<open>n \\<ge> time\\<close>\n                by (intro signal_of_less_ind')\n                   (metis \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>fst tw < time\\<close> dual_order.trans fst_conv fun_upd_apply leD\n                   order.strict_implies_order tw_def zero_fun_def)\n              also have \"... = wline_of tw s time\"\n                by (simp add: tw_def worldline_of_history_def)\n              finally have \"wline_of tw s n = wline_of tw s time\"\n                by auto }\n            hence 3: \"derivative_raw (snd tw) time = \\<tau>\"\n              using derivative_raw_alt_def[where tw=\"(time, snd tw)\"] \\<open>\\<tau> = 0\\<close>\n              by (metis comp_apply fst_conv snd_conv)\n            have \"fst tw = t\"\n              by (simp add: \"3.prems\"(1))\n            hence \"\\<And>s k . signal_of (def s) (derivative_hist_raw (snd tw) time) s (time - 1) =\n                          signal_of (def s) (derivative_hist_raw (snd tw) time ) s t\"\n              using `time > fst tw`\n              by (smt \"3.prems\"(1) Suc_diff_1 Suc_lessI \\<open>\\<tau> = 0\\<close> diff_less fst_conv le_add2\n              le_add_same_cancel2 le_less_trans nat_neq_iff order.strict_implies_order\n              signal_of_derivative_hist_raw signal_of_empty snd_conv worldline2_def\n              worldline_raw_def zero_less_one)\n            hence new2: \"{s. wline_of tw s time \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) time) s (time - 1)} = {}\"\n              using 2 by auto\n            have \"fst (snd tw) = def\"\n              by (simp add: \\<open>snd tw = (def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close>)\n            with 1 new2 3 show ?thesis\n              unfolding destruct_worldline_def Let_def\n              by auto\n          qed\n          { fix k s\n            have \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n            proof -\n              have \"fst tw = t\"\n                by (simp add: tw_def)\n              have \"k \\<le> time \\<or> time < k\"\n                by auto\n              moreover\n              { assume \"k \\<le> time\"\n                hence \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                  using \\<open>fst tw < time\\<close> \\<open>fst tw = t\\<close>\n                  by (smt Suc_diff_1 Suc_leI \\<open>\\<tau> = 0\\<close> \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau> = (t, def,\n                  worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close> dual_order.order_iff_strict\n                  eq_fst_iff le_add2 le_add_same_cancel2 not_le signal_of_derivative_hist_raw\n                  signal_of_derivative_hist_raw2 signal_of_empty snd_conv tw_def worldline2_def\n                  worldline_of_history_def worldline_raw_def) }\n              moreover\n              { assume \"time < k\"\n                hence \"t < k\" and \"time \\<le> k\"\n                  using \\<open>fst tw < time\\<close> tw_def by auto\n                hence \" inf_time (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>))) s k = Some t\"\n                  by (meson \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>t < k\\<close> inf_time_update less_or_eq_imp_le)\n                hence \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = \\<sigma> s\"\n                  unfolding to_signal_def comp_def  by (simp add: to_trans_raw_sig_def)\n                have \"signal_of (def s) (derivative_hist_raw (snd tw) time) s k = wline_of tw s (time - 1)\"\n                  using signal_of_derivative_hist_raw2[OF `time \\<le> k`]\n                  by (smt \\<open>get_time tw < time\\<close> comp_apply fst_conv neq0_conv not_less_zero snd_conv tw_def)\n                also have \"... = worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)) s t\"\n                  unfolding tw_def\n                  by (smt Suc_diff_1 Suc_lessI \\<open>\\<tau> = 0\\<close> \\<open>get_time tw < time\\<close> \\<open>get_time tw = t\\<close>\n                  \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau> = (t, def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close>\n                  comp_apply dual_order.strict_trans2 gr_implies_not_zero less_imp_le_nat\n                  less_irrefl_nat linorder_neqE_nat signal_of_empty snd_conv worldline2_def\n                  worldline_raw_def)\n                also have \"... = signal_of (def s) (\\<theta>(t:= Some o \\<sigma>)) s t\"\n                  unfolding worldline_of_history_def by auto\n                finally have \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                  by (metis \\<open>signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s k = \\<sigma> s\\<close> fun_upd_same trans_some_signal_of) }\n              ultimately show \"signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                by auto\n            qed }\n          with * show ?thesis\n            by auto\n        qed\n        then obtain theta where des: \"destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, theta, def, \\<tau>)\"\n          and \"\\<And>k s. signal_of (def s) (\\<theta>(t:= Some o \\<sigma>)) s k = signal_of (def s) theta s k\"\n          by blast\n        hence \"b_conc_exec time \\<sigma> {} theta def cs \\<tau> \\<tau>\"\n          by (simp add: b_conc_exec_empty_event)\n        hence \"\\<exists>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw'\"\n          using des world_conc_exec.intros by blast }\n      ultimately show \"\\<exists>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw'\"\n        by auto\n    qed\n    have pseudo_ind: \"\\<And>time. fst tw \\<le> time \\<Longrightarrow> time < maxtime \\<Longrightarrow> P (time, snd tw) \\<Longrightarrow> P (time + 1, snd tw)\"\n      using 3(6) unfolding conc_hoare_valid_def \n      using always_progress ** \n      by (metis greaterThanAtMost_iff next_time_world_at_least order_refl)\n    define distance where \"distance = maxtime - fst tw\"\n    hence pseudo_ind': \"\\<And>time. fst tw \\<le> time \\<Longrightarrow> time < fst tw + distance \\<Longrightarrow> P (time, snd tw) \\<Longrightarrow> P (time + 1, snd tw)\"\n      using pseudo_ind by auto\n    have \"maxtime - 1 < fst tw + distance\"\n      unfolding distance_def using \"3.hyps\"(1) by linarith\n    have \"P (maxtime, snd tw)\"\n      using \\<open>t < maxtime\\<close> \\<open>maxtime - 1 < fst tw + distance\\<close>\n    proof (induction \"maxtime - fst tw\" arbitrary: maxtime)\n      case 0\n      then show ?case using `P tw`  using tw_def by auto\n    next\n      case (Suc x)\n      hence \"x = (maxtime - 1) - fst tw\"\n        by auto\n      hence \"P (maxtime - 1, snd tw)\"\n        using Suc\n        by (metis (no_types, lifting) \"3.prems\"(5) Suc_diff_1 add_less_cancel_left diff_diff_cancel\n        diff_is_0_eq' gr_implies_not_zero less_Suc_eq not_le plus_1_eq_Suc snd_conv tw_def)\n      have \"maxtime - 1 \\<ge> fst tw\"\n        using Suc by auto\n      have \"\\<forall>tw'. (maxtime - 1, snd tw), cs \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> next_time_world tw' = maxtime \\<and> snd tw = snd tw'\"\n        using **[OF `maxtime - 1 \\<ge> fst tw`]\n        by (metis Suc.hyps(2) Suc_eq_plus1 Suc_inject \\<open>x = maxtime - 1 - fst tw\\<close> add_eq_if diff_0_eq_0)\n      have \"\\<exists>tw'. (maxtime - 1, snd tw) , cs \\<Rightarrow>\\<^sub>c tw'\"\n        using always_progress \\<open>get_time tw \\<le> maxtime - 1\\<close> by blast\n      have \"get_time tw \\<le> maxtime - 1\"\n        unfolding tw_def using \\<open>get_time tw \\<le> maxtime - 1\\<close> tw_def by blast\n      thus ?case\n        using pseudo_ind'[OF _ `maxtime - 1 < get_time tw + distance`] \n        by (metis Suc.prems(1) Suc_diff_1 Suc_eq_plus1 \\<open>P (maxtime - 1, snd tw)\\<close> gr_implies_not_zero\n        nat_neq_iff)\n    qed\n    moreover have \"snd tw =  worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0\"\n      unfolding tw_def snd_conv\n    proof (rule, rule_tac[2] ext, rule_tac[2] ext)\n      fix s' t'\n      have \"t' < maxtime \\<or> maxtime \\<le> t'\"\n        by auto\n      moreover\n      { assume \"t' < maxtime\"\n        hence \"snd (worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0) s' t' = signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t'\"\n          unfolding worldline_raw_def by auto\n        also have \"... = worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t'\"\n          unfolding worldline_of_history_def by auto\n        finally have \"worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)) s' t' = snd (worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0) s' t'\"\n          by auto }\n      moreover\n      { assume \" maxtime  \\<le> t'\"\n        hence \"snd (worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0) s' t' = signal_of (\\<sigma> s') 0 s' t'\"\n          unfolding worldline_raw_def by auto\n        also have \"... = \\<sigma> s'\"\n          by (meson signal_of_empty)\n        also have \"... = signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t\"\n          by (metis fun_upd_same trans_some_signal_of)\n        also have \"... = signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t'\"\n          using \\<open>\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta> n = 0\\<close> \\<open>t < maxtime\\<close> \\<open>maxtime \\<le> t'\\<close>\n          by (intro sym[OF signal_of_less_ind'])(simp add: zero_fun_def, linarith)\n        also have \"... = worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)) s' t'\"\n          unfolding worldline_of_history_def by auto\n        finally have \"worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)) s' t' = snd (worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0) s' t'\"\n          by auto }\n      ultimately show \"snd (def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>))) s' t' = snd (worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0) s' t'\"\n        by auto\n    qed (simp add: worldline_raw_def)\n    ultimately show ?case\n      by (simp add: \\<open>tw' = (get_time (maxtime, \\<sigma>, \\<theta>(t := Some \\<circ> \\<sigma>), 0), worldline_raw (get_time\n      (maxtime, \\<sigma>, \\<theta>(t := Some \\<circ> \\<sigma>), 0)) (get_state (maxtime, \\<sigma>, \\<theta>(t := Some \\<circ> \\<sigma>), 0)) (get_beh\n      (maxtime, \\<sigma>, \\<theta>(t := Some \\<circ> \\<sigma>), 0)) def (get_trans (maxtime, \\<sigma>, \\<theta>(t := Some \\<circ> \\<sigma>), 0)))\\<close>)\n  next\n    case (4 t maxtime \\<sigma> \\<gamma> \\<theta> def cs \\<tau>)\n    hence \"tw' = tw\"\n      by (simp add: worldline2_def)\n    then show ?case\n      using `P tw` by auto\n  next\n    case (2 t maxtime \\<tau> \\<gamma> \\<sigma> \\<theta> def cs \\<tau>')\n    hence \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n      unfolding context_invariant_def by auto\n    have \"snd tw = worldline_raw t \\<sigma> \\<theta> def \\<tau>\"\n      using 2 unfolding worldline2_def by auto\n    obtain theta where dw_def: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, theta, def, \\<tau>)\" and\n                    \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k\"\n      using destruct_worldline_correctness4[OF \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\\<close> \\<open>\\<forall>s. non_stuttering\n      (to_trans_raw_sig \\<tau>) \\<sigma> s\\<close>]  using \"2.prems\"(1) by blast\n    hence \"b_conc_exec t \\<sigma> \\<gamma> theta def cs \\<tau> \\<tau>'\"\n      using b_conc_exec_mono_wrt_history[OF \\<open> t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\\<close>]\n      by blast\n    then obtain tw_conc where \"tw, cs \\<Rightarrow>\\<^sub>c tw_conc\" and \"worldline2 t \\<sigma> theta def \\<tau>' = tw_conc\"\n      using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, theta, def, \\<tau>)\\<close>\n      using world_conc_exec.intros by blast\n    have \"fst tw = fst tw_conc\"\n      using fst_world_conc_exec `tw, cs \\<Rightarrow>\\<^sub>c tw_conc` by metis\n    have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n      by (meson 2 \\<open>\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\\<close> \\<open>t , \\<sigma> , \\<gamma> , theta, def \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\\<close> \n          b_conc_exec_preserves_non_stuttering)\n    have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n      using b_conc_exec_preserves_context_invariant[OF 2(3) `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>` `nonneg_delay_conc cs`]\n      by auto\n    hence \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau>' n = 0\"\n      unfolding context_invariant_def by auto\n    hence \"derivative_raw (snd tw_conc) (get_time tw_conc) = \\<tau>'\"\n      using derivative_raw_of_worldline2[OF _ \\<open>\\<forall>a. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> a\\<close>]\n      \\<open>worldline2 t \\<sigma> theta def \\<tau>' = tw_conc\\<close> by auto\n    have \"next_time_world tw_conc = next_time t \\<tau>'\"\n      unfolding next_time_world_def Let_def\n      by (metis \\<open>derivative_raw (snd tw_conc) (get_time tw_conc) = \\<tau>'\\<close> \\<open>get_time tw = get_time\n      tw_conc\\<close> dw_def fst_conv fst_destruct_worldline)\n    hence \"P (maxtime, snd tw_conc)\"\n      using 2(8) `P tw` `maxtime < next_time t \\<tau>'` \\<open>tw, cs \\<Rightarrow>\\<^sub>c tw_conc\\<close> `t < maxtime` \n      unfolding conc_hoare_valid_def \n      by (metis (full_types) \\<open>worldline2 t \\<sigma> theta def \\<tau>' = tw_conc\\<close> dual_order.order_iff_strict\n      fst_conv greaterThanAtMost_iff worldline2_def)\n    have tw'_def: \"tw' = (maxtime, worldline_raw maxtime \\<sigma> (\\<theta>(t := Some o \\<sigma>)) def \\<tau>')\"\n      using 2 by (metis comp_apply fst_conv snd_conv)\n    have \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw_conc\"\n      unfolding sym[OF `worldline2 t \\<sigma> theta def \\<tau>' = tw_conc`] worldline2_def worldline_raw_def\n      `\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k` by auto\n    hence \"snd tw_conc = worldline_raw t \\<sigma> \\<theta> def \\<tau>'\"\n      unfolding worldline2_def by auto\n    also have \"... = worldline_raw maxtime \\<sigma> (\\<theta>(t := Some o \\<sigma>)) def \\<tau>'\"\n      unfolding worldline_raw_def\n    proof (rule+)\n      fix s' t'\n      have \"t' < t \\<or> t \\<le> t' \\<and> t' < next_time t \\<tau>' \\<or> next_time t \\<tau>' \\<le> t'\"\n        using `t < maxtime` by auto\n      moreover\n      { assume \"t' < t\"\n        hence \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') = \n                                                                         signal_of (def s') \\<theta> s' t'\"\n          by auto\n        also have \"... = signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t'\"\n          by (smt \\<open>t' < t\\<close> dual_order.strict_trans2 fun_upd_def le_eq_less_or_eq\n          min.strict_order_iff signal_of_equal_when_trans_equal_upto)\n        also have \"... = (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t')\"\n          using `t' < t` `t < maxtime` by auto\n        finally have \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') =\n       (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t')\"\n          by auto }\n      moreover\n      { assume \"t \\<le> t' \\<and> t' < next_time t \\<tau>' \"\n        hence \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') = \n                                                                          signal_of (\\<sigma> s') \\<tau>' s' t'\"\n          by auto\n        also have \"... = \\<sigma> s'\"\n          using \\<open>t \\<le> t' \\<and> t' < next_time t \\<tau>' \\<close> \\<open>maxtime < next_time t \\<tau>'\\<close> \n          by (metis (mono_tags) dual_order.strict_trans dual_order.strict_trans2 next_time_at_least2\n          signal_of_def zero_fun_def)\n        also have \"... = the ((\\<theta>(t := Some o \\<sigma>)) t s')\"\n          by simp\n        also have \"... = signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t\"\n          by (metis \\<open>\\<sigma> s' = the ((\\<theta>(t := Some \\<circ> \\<sigma>)) t s')\\<close> fun_upd_same trans_some_signal_of)\n        also have \"... = signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t'\"\n          apply (rule signal_of_less_ind[THEN sym])\n          apply (metis \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\\<close> context_invariant_def fun_upd_apply less_imp_le_nat nat_neq_iff)\n          by (auto simp add: `t \\<le> t' \\<and> t' < next_time t \\<tau>' `)      \n        also have \"... = (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') \"\n          using `t \\<le> t' \\<and> t' < next_time t \\<tau>' `  using calculation by auto\n        finally have \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') =\n       (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t')\"\n          by auto }\n      moreover\n      { assume \"next_time t \\<tau>' \\<le> t'\"\n        hence \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') = \n                                                                          signal_of (\\<sigma> s') \\<tau>' s' t'\"\n          using `t < maxtime`  \"2.hyps\"(4) by auto\n        also have \"... =  (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') \"\n          using \"2.hyps\"(4) \\<open>next_time t \\<tau>' \\<le> t'\\<close> by auto\n        finally have \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') =\n       (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t')\"\n          by auto }\n      ultimately show \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') =\n       (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t')\"\n        by auto \n    qed\n    hence \"snd tw_conc = snd tw'\"\n      by (simp add: calculation tw'_def)      \n    then show ?case \n      using \\<open>P (maxtime, snd tw_conc)\\<close> tw'_def by auto\n  qed\nqed\n\nlemma while_soundness3:\n  assumes \"\\<Turnstile> \\<lbrace>\\<lambda>tw. P tw \\<and> fst tw < T\\<rbrace> cs \\<lbrace>\\<lambda>tw. P (min T (next_time_world tw), snd tw)\\<rbrace>\"\n  assumes \"tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\n  assumes \"P tw\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"P tw'\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> def res where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n  sim: \"T, t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> <cs, \\<tau>> \\<leadsto> res\" and   woh: \"tw' = (get_time res, worldline_raw (get_time res) (get_state res) (get_beh res) def (get_trans res))\"\n    using premises_of_world_sim_fin'[OF assms(2)]\n    by (smt prod.exhaust_sel)\n  have tau_def:  \"\\<tau> = derivative_raw (snd tw) (fst tw)\" and\n      sigma_def: \"\\<sigma> = (\\<lambda>s. wline_of tw s (fst tw))\" and\n      theta_def: \"\\<theta> = derivative_hist_raw (snd tw) (fst tw)\" and\n      gamma_def: \"\\<gamma> = {s. wline_of tw s (fst tw) \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) (fst tw)) s (fst tw - 1)}\"\n    using des unfolding destruct_worldline_def Let_def by auto\n  have non_stut: \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n    unfolding tau_def sigma_def   by (simp add: derivative_raw_ensure_non_stuttering)\n  have non_stut2: \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n    using des destruct_worldline_ensure_non_stuttering_hist_raw theta_def by blast\n  have \"tw = worldline2 t \\<sigma> \\<theta> def \\<tau>\" and \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using worldline2_constructible[OF des] by auto\n  (*TODO : try to enter the non_stut2 into the inductive hypothesis *)\n  with sim show ?thesis\n    using woh assms(1) assms(3-5) non_stut gamma_def\n  proof (induction arbitrary: tw rule:b_simulate_fin.induct)\n    case (1 t maxtime \\<tau> \\<gamma> \\<sigma> \\<theta> def cs \\<tau>' res)\n    hence \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n      unfolding context_invariant_def by auto\n    have \"snd tw = worldline_raw t \\<sigma> \\<theta> def \\<tau>\"\n      using 1(6-7) unfolding worldline2_def by auto\n    obtain theta where dw_def: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, theta, def, \\<tau>)\" and\n                    \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k\"\n      using destruct_worldline_correctness4[OF \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\\<close> \\<open>\\<forall>s. non_stuttering\n      (to_trans_raw_sig \\<tau>) \\<sigma> s\\<close>]  using \"1.prems\"(1) by blast\n    hence \"b_conc_exec t \\<sigma> \\<gamma> theta def cs \\<tau> \\<tau>'\"\n      using b_conc_exec_mono_wrt_history[OF \\<open> t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\\<close>]\n      by blast\n    then obtain tw_conc where \"tw, cs \\<Rightarrow>\\<^sub>c tw_conc\" and \"worldline2 t \\<sigma> theta def \\<tau>' = tw_conc\"\n      using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, theta, def, \\<tau>)\\<close>\n      using world_conc_exec.intros by blast\n    have \"fst tw = fst tw_conc\"\n      using fst_world_conc_exec `tw, cs \\<Rightarrow>\\<^sub>c tw_conc` by metis\n    have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n      by (meson \"1.prems\"(6) \"1.prems\"(7) \"1.prems\"(8) \\<open>\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\\<close> \\<open>t , \\<sigma> , \\<gamma> , theta, def\n      \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\\<close> b_conc_exec_preserves_non_stuttering)\n    have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n      using b_conc_exec_preserves_context_invariant[OF 1(3) `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>` `nonneg_delay_conc cs`]\n      by auto\n    hence \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau>' n = 0\"\n      unfolding context_invariant_def by auto\n    hence \"derivative_raw (snd tw_conc) (get_time tw_conc) = \\<tau>'\"\n      using derivative_raw_of_worldline2[OF _ \\<open>\\<forall>a. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> a\\<close>]\n      \\<open>worldline2 t \\<sigma> theta def \\<tau>' = tw_conc\\<close> by auto\n    have \"next_time_world tw_conc = next_time t \\<tau>'\"\n      unfolding next_time_world_def Let_def\n      by (metis \\<open>derivative_raw (snd tw_conc) (get_time tw_conc) = \\<tau>'\\<close> \\<open>get_time tw = get_time\n      tw_conc\\<close> dw_def fst_conv fst_destruct_worldline)\n    with `P tw`  have \"P (min maxtime (next_time_world tw_conc), snd tw_conc)\"\n      using 1(10) \\<open>next_time t \\<tau>' \\<le> maxtime\\<close> unfolding conc_hoare_valid_def\n      by (metis \"1.hyps\"(1) \\<open>tw , cs \\<Rightarrow>\\<^sub>c tw_conc\\<close> dw_def fst_conv fst_destruct_worldline)    \n    have \"world_conc_exec tw cs tw_conc\"\n      using world_conc_exec_rem_curr_trans_eq_only_if[OF 1(12-13)] `tw, cs \\<Rightarrow>\\<^sub>c tw_conc` by auto\n    have \" \\<tau> t = 0\"\n      by (auto simp add: `\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0`)\n    hence \"t < next_time t \\<tau>'\"\n      using  nonneg_delay_conc_next_time_strict[OF _ `t , \\<sigma> , \\<gamma> , \\<theta>, def \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'` `nonneg_delay_conc cs` `conc_stmt_wf cs`]\n      \\<open>\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\\<close> dual_order.order_iff_strict  by blast\n    have ci: \"context_invariant (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (next_event t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))\"\n      using context_invariant[OF 1(8) 1(3) `t < next_time t \\<tau>'`]  by auto\n    have \"context_invariant t \\<sigma> \\<gamma> theta def \\<tau>\"\n      using worldline2_constructible using dw_def by blast\n    have \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw_conc\"\n      unfolding sym[OF `worldline2 t \\<sigma> theta def \\<tau>' = tw_conc`] worldline2_def worldline_raw_def\n      `\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k` by auto\n    hence \"fst tw_conc = t\"\n      by auto\n    have \"snd tw_conc = worldline_raw t \\<sigma> \\<theta> def \\<tau>'\"\n      using `worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw_conc` unfolding worldline2_def by auto\n    have \"next_time_world tw_conc = next_time t \\<tau>'\"\n      unfolding next_time_world_def Let_def `snd tw_conc = worldline_raw t \\<sigma> \\<theta> def \\<tau>'`\n      using derivative_raw_of_worldline `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'` `\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s`\n      unfolding world_quiet_def worldline_deg_def `fst tw = fst tw_conc` `snd tw_conc = worldline_raw t \\<sigma> \\<theta> def \\<tau>'`\n      context_invariant_def\n      by (simp add: derivative_raw_of_worldline_specific \\<open>fst tw_conc = t\\<close>)\n    hence twc: \"(next_time_world tw_conc, snd tw_conc) =\n             worldline2 (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))\"\n      using `worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw_conc` worldline2_next_config_next_time[OF `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'`]\n      by auto\n    have ns: \" \\<forall>s. non_stuttering (to_trans_raw_sig (\\<tau>'(next_time t \\<tau>' := 0))) (next_state t \\<tau>' \\<sigma>) s\"\n      using non_stuttering_preserved `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'` unfolding context_invariant_def\n      by (simp add: non_stuttering_preserved \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\\<close>)\n    have ne: \"next_event t \\<tau>' \\<sigma> = {s. (wline_of (next_time_world tw_conc, snd tw_conc)) s (fst (next_time_world tw_conc, snd tw_conc)) \\<noteq>\n      signal_of (def s) (derivative_hist_raw ( (snd (next_time_world tw_conc, snd tw_conc))) (fst (next_time_world tw_conc, snd tw_conc))) s\n       (fst (next_time_world tw_conc, snd tw_conc) - 1)}\" (is \"_ = ?complex\")\n    proof -\n      have \"?complex = {s.  (wline_of tw_conc) s (next_time_world tw_conc) \\<noteq>\n      signal_of (def s) (derivative_hist_raw ( (snd tw_conc)) (next_time_world tw_conc)) s\n       (next_time_world tw_conc - 1)}\"\n        by auto\n      also have \"... = {s. snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s (next_time t \\<tau>') \\<noteq>\n                           signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>') (next_time t \\<tau>')) s (next_time t \\<tau>' - 1)}\"\n        using ` (snd tw_conc) = worldline_raw t \\<sigma> \\<theta> def \\<tau>'` `next_time_world tw_conc = next_time t \\<tau>'`\n        by auto\n      also have \"... = {s. snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s (next_time t \\<tau>') \\<noteq>  signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1)}\"\n      proof -\n        have 0: \"snd (worldline2 t \\<sigma> \\<theta> def \\<tau>') = worldline_raw t \\<sigma> \\<theta> def \\<tau>'\"\n          by (auto simp add: worldline2_def)\n        have *: \"... = worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0)) \"\n          using worldline_next_config_next_time[OF `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'`] by auto\n        have **: \"snd (worldline2 (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>' (next_time t \\<tau>' := 0))) =\n              worldline_raw (next_time t \\<tau>') (next_state t \\<tau>' \\<sigma>) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) def (\\<tau>'(next_time t \\<tau>' := 0))\"\n          unfolding worldline2_def by auto\n        have \"\\<And>s. signal_of (def s) (derivative_hist_raw (worldline_raw t \\<sigma> \\<theta> def \\<tau>') (next_time t \\<tau>')) s (next_time t \\<tau>' - 1) =\n                   signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1)\"\n          using hist_of_worldline ci unfolding context_invariant_def ** sym[OF *]\n          by (smt \"*\" \"**\")\n        thus ?thesis\n          by auto\n      qed\n      also have \"... = {s. next_state t \\<tau>' \\<sigma> s \\<noteq> signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1)}\"\n      proof -\n        have \"t \\<le> next_time t \\<tau>'\"\n          using next_time_at_least[OF `\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau>' n = 0`] by auto\n        hence \"\\<And>s. snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s (next_time t \\<tau>') = signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>')\"\n          unfolding worldline_raw_def by auto\n        moreover have \"\\<And>s. signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = next_state t \\<tau>' \\<sigma> s\"\n        proof -\n          fix s\n          have \"s \\<in> (dom ( \\<tau>' (next_time t \\<tau>'))) \\<or> s \\<notin> (dom ( \\<tau>' (next_time t \\<tau>')))\"\n            by auto\n          moreover\n          { assume s_dom: \"s \\<in> dom ( \\<tau>' (next_time t \\<tau>'))\"\n            then obtain val where lookup: \" \\<tau>' (next_time t \\<tau>') s = Some val\"\n              by auto\n            hence \"next_state t \\<tau>' \\<sigma> s = val\"\n              unfolding next_state_def Let_def using s_dom by auto\n            also have \"... = signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>')\"\n              using lookup trans_some_signal_of' by fastforce\n            finally have \"signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = next_state t \\<tau>' \\<sigma> s\"\n              by auto }\n          moreover\n          { have \" \\<tau> t s = 0\"\n              using ` \\<tau> t  = 0` by (auto simp add: zero_fun_def zero_option_def zero_option_def)\n            have \"\\<And>n. n < t \\<Longrightarrow>  \\<tau>' n  = 0\"\n              using `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'` unfolding context_invariant_def by auto\n            assume s_not_dom: \"s \\<notin> dom ( \\<tau>' (next_time t \\<tau>'))\"\n            hence \"next_state t \\<tau>' \\<sigma> s = \\<sigma> s\"\n              unfolding next_state_def Let_def by auto\n            have \"\\<And>n. n < t \\<Longrightarrow>  \\<tau>' n s = 0\"\n              using s_not_dom \\<open>\\<And>n. n < t \\<Longrightarrow>  \\<tau>' n = 0\\<close>  by (simp add: zero_fun_def)\n            have \"\\<And>n. t < n \\<Longrightarrow> n < next_time t \\<tau>' \\<Longrightarrow>  \\<tau>' n = 0\"\n              by (simp add: until_next_time_zero)\n            hence \"\\<And>n. t < n \\<Longrightarrow> n \\<le> next_time t \\<tau>' \\<Longrightarrow>  \\<tau>' n s = 0\"\n              using s_not_dom by (metis (full_types) domIff nat_less_le zero_fun_def zero_fun_def zero_option_def)\n            hence \"signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = signal_of (\\<sigma> s) \\<tau>' s t\"\n              by (metis \\<open>t \\<le> next_time t \\<tau>'\\<close> le_neq_implies_less signal_of_less_ind')\n            also have \"... = signal_of (\\<sigma> s) \\<tau>' s 0\"\n              by (meson \\<open>\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau>' n = 0\\<close> less_eq_nat.simps(1) signal_of_less_ind)\n            also have \"... = \\<sigma> s\"\n              by (metis \\<open>\\<tau> t = 0\\<close> \\<open>\\<tau> t s = 0\\<close> domIff le0 le_neq_implies_less\n              next_time_at_least2 s_not_dom signal_of_zero zero_fun_def zero_option_def)\n            finally have \"signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = \\<sigma> s\"\n              by auto\n            hence \"signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = next_state t \\<tau>' \\<sigma> s\"\n              using \\<open>next_state t \\<tau>' \\<sigma> s = \\<sigma> s\\<close> by simp }\n          ultimately show \" signal_of (\\<sigma> s) \\<tau>' s (next_time t \\<tau>') = next_state t \\<tau>' \\<sigma> s\"\n            by auto\n        qed\n        ultimately have \"\\<And>s. snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>') s (next_time t \\<tau>') = next_state t \\<tau>' \\<sigma> s\"\n          by auto\n        thus ?thesis by auto\n      qed\n      also have \"... = {s. next_state t \\<tau>' \\<sigma> s \\<noteq> \\<sigma> s}\"\n      proof -\n        have \"t \\<le> next_time t \\<tau>'\"\n          using \\<open>\\<And>n. n \\<le> t \\<Longrightarrow>  \\<tau>' n = 0\\<close> next_time_at_least  by (simp add: next_time_at_least)\n        moreover have \"\\<And>n. t \\<le> n \\<Longrightarrow>  \\<theta> n = 0\"\n          using `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>` unfolding context_invariant_def by auto\n        ultimately have \"\\<And>s n. t < n \\<Longrightarrow> n \\<le> next_time t \\<tau>' - 1 \\<Longrightarrow> (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) n s = 0\"\n          unfolding add_to_beh_def by (simp add: lookup_update zero_fun_def)\n        hence \"t \\<le> next_time t \\<tau>' - 1\"\n          using `t < next_time t \\<tau>'` by auto\n        { fix s\n          have \"signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1) =\n                signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s t\"\n            using `t \\<le> next_time t \\<tau>' - 1`\n            by (metis (full_types) \\<open>\\<And>s n. \\<lbrakk>t < n; n \\<le> next_time t \\<tau>' - 1\\<rbrakk> \\<Longrightarrow> (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) n s = 0\\<close> le_neq_implies_less signal_of_less_ind')\n          also have \"... =  signal_of (def s) (\\<theta>(t:= Some o \\<sigma>)) s t\"\n            using `t < next_time t \\<tau>'` unfolding add_to_beh_def by auto\n          also have \"... = \\<sigma> s\"\n            by (meson fun_upd_same trans_some_signal_of)\n          finally have \"signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1) = \\<sigma> s\"\n            by auto }\n        hence \"\\<And>s. signal_of (def s) (add_to_beh \\<sigma> \\<theta> t (next_time t \\<tau>')) s (next_time t \\<tau>' - 1) = \\<sigma> s\"\n          by auto\n        thus ?thesis by auto\n      qed\n      also have \"... = next_event t \\<tau>' \\<sigma>\"\n        unfolding next_event_alt_def by auto\n      finally show ?thesis by auto\n    qed\n    show ?case\n      using 1(6)[OF twc ci 1(9-10) _ 1(12-13) ns ne] `P (min maxtime (next_time_world tw_conc), snd tw_conc)`\n      by (simp add: \"1.hyps\"(4) \\<open>next_time_world tw_conc = next_time t \\<tau>'\\<close> min_absorb2)\n  next\n    case (3 t maxtime \\<tau> \\<gamma> \\<sigma> \\<theta> def cs)\n    hence \"\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta> n = 0\"\n      unfolding context_invariant_def by auto\n    have \"worldline2 t \\<sigma> \\<theta> def \\<tau> = (t, def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\"\n    proof\n      show \"get_time (worldline2 t \\<sigma> \\<theta> def \\<tau>) = get_time (t, def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\"\n        by simp\n    next\n      have \"worldline_raw t \\<sigma> \\<theta> def \\<tau> = (def, \\<lambda>s' t'. signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t')\"\n      proof (rule, rule_tac[2] ext, rule_tac[2] ext)\n        fix s' t'\n        have \"t' < t \\<or> t \\<le> t'\" by auto\n        moreover\n        { assume \"t' < t\"\n          hence *: \"\\<And>n. n < t \\<Longrightarrow>  (to_trans_raw_sig  (\\<theta>(t := Some \\<circ> \\<sigma>)) s') n = (to_trans_raw_sig \\<theta> s') n\"\n            by (auto simp add:to_trans_raw_sig_def)\n          hence \"inf_time (to_trans_raw_sig  (\\<theta>(t := Some \\<circ> \\<sigma>))) s' t' = inf_time (to_trans_raw_sig \\<theta>) s' t'\"\n            by (meson \\<open>t' < t\\<close> inf_time_equal_when_same_trans_upto_strict)\n          hence \"signal_of (def s')  (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' = signal_of (def s') \\<theta> s' t'\"\n            unfolding to_signal_def comp_def using `t' < t`\n            by (auto dest!: inf_time_at_most split:option.splits simp add: to_trans_raw_sig_def)\n          hence \" snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t' = signal_of (def s')  (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t'\"\n            unfolding worldline_raw_def using `t' < t` by auto }\n        moreover\n        { assume \"t \\<le> t'\"\n         have \"\\<tau> = 0\"\n            using `quiet \\<tau> \\<gamma>` unfolding quiet_def by meson\n          hence inf_none: \"inf_time (to_trans_raw_sig \\<tau>) s' t' = None\"\n            unfolding inf_time_def  by (simp add: keys_def to_trans_raw_sig_def zero_fun_def)\n          have *: \"keys (to_trans_raw_sig  (\\<theta>(t := Some \\<circ> \\<sigma>)) s') = insert t (keys (to_trans_raw_sig \\<theta> s'))\"\n            by (auto simp add: to_trans_raw_sig_def keys_def zero_option_def)\n          have \"(\\<forall>n\\<ge>t. \\<theta> n = 0)\"\n            using 3(4) unfolding context_invariant_def by auto\n          hence **: \" \\<forall>k\\<in> (keys (to_trans_raw_sig \\<theta> s')). k < t\"\n            unfolding to_trans_raw_sig_def\n            by (metis domIff dom_def keys_def leI zero_fun_def zero_option_def)\n          have \"inf_time (to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>))) s' t' = Some t\"\n          proof -\n            have \"\\<exists>k\\<in>keys (to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>)) s'). k \\<le> t'\"\n              using * `t \\<le> t'` by auto\n            moreover have \"(GREATEST k. k \\<in> keys (to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>)) s') \\<and> k \\<le> t') = t\"\n            proof (rule Greatest_equality)\n              show \"t \\<in> keys (to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>)) s') \\<and> t \\<le> t'\"\n                using * `t \\<le> t'` by auto\n            next\n              show \"\\<And>y. y \\<in> keys (to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>)) s') \\<and> y \\<le> t' \\<Longrightarrow> y \\<le> t\"\n                unfolding * using ** by auto\n            qed\n            ultimately show ?thesis\n              unfolding inf_time_def  by auto\n          qed\n          moreover have \"the ((to_trans_raw_sig (\\<theta>(t := Some \\<circ> \\<sigma>)) s') t) = \\<sigma> s'\"\n            using 3(2) unfolding to_trans_raw_sig_def by auto\n          ultimately have \"signal_of (\\<sigma> s') \\<tau> s' t' = signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t'\"\n            using inf_none unfolding to_signal_def comp_def\n            by (simp add: inf_time_def)\n          hence \" snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t' = signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t'\"\n            unfolding worldline_raw_def using `t \\<le> t'` by auto }\n        ultimately show \"snd (worldline_raw t \\<sigma> \\<theta> def \\<tau>) s' t' =  snd (def, \\<lambda>s'. signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s') s' t'\"\n          by auto\n      next\n        show \"get_time (worldline_raw t \\<sigma> \\<theta> def \\<tau>) = get_time (def, \\<lambda>s'. signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s')\"\n          by (simp add: worldline_raw_def)\n      qed\n      thus \"snd (worldline2 t \\<sigma> \\<theta> def \\<tau>) = snd (t, def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\"\n        unfolding worldline2_def  worldline_raw_def worldline_of_history_def by auto\n    qed\n    hence tw_def: \"tw = (t, def, worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)))\"\n      using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>` by auto\n    have *: \"\\<forall>tw'. tw, cs \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> next_time_world tw' = fst tw + 1 \\<and> snd tw = snd tw'\"\n    proof (rule, rule)\n      fix tw'\n      assume \"tw, cs \\<Rightarrow>\\<^sub>c tw'\"\n      hence \"fst tw = fst tw'\"\n        using fst_world_conc_exec  by metis\n      hence \"fst tw' = t\"\n        using tw_def by auto\n      obtain theta where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, theta, def, \\<tau>)\"\n        and sig_eq: \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k\"\n        using 3 destruct_worldline_correctness4 by blast\n      have \"b_conc_exec t \\<sigma> \\<gamma> \\<theta> def cs \\<tau> \\<tau>\"\n        using `quiet \\<tau> \\<gamma>`  by (metis b_conc_exec_empty_event quiet_def)\n      moreover have \"b_conc_exec t \\<sigma> \\<gamma> theta def cs \\<tau> \\<tau>\"\n        using `quiet \\<tau> \\<gamma>`  by (metis b_conc_exec_empty_event quiet_def)\n      ultimately have \"tw' = tw\"\n        using `tw, cs \\<Rightarrow>\\<^sub>c tw'` des `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>`\n        by (smt b_conc_exec_deterministic fst_conv snd_conv world_conc_exec_cases worldline2_constructible)\n      have \"derivative_raw (snd tw') (fst tw') = \\<tau>\"\n        unfolding `tw' = tw` using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>` 3(4) unfolding context_invariant_def\n        by (simp add: \"3.prems\"(8) derivative_raw_of_worldline2)\n      thus \"next_time_world tw' = fst tw + 1 \\<and> snd tw = snd tw'\"\n        using 3(2) unfolding next_time_world_def Let_def `fst tw' = t` quiet_def next_time_def\n        using \\<open>fst tw' = t\\<close> \\<open>tw' = tw\\<close> by auto\n    qed\n    obtain \\<theta>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>', def, \\<tau>)\" and\n      \"\\<And>s k. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>' s k\"\n      using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>`\n      by (meson \"3.prems\"(2) \"3.prems\"(8) destruct_worldline_correctness4)\n    moreover have \"tw , cs \\<Rightarrow>\\<^sub>c tw\"\n    proof (intro world_conc_exec.intros)\n      show \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>', def, \\<tau>)\"\n        using des by auto\n    next\n      have \"t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>\"\n        using `quiet \\<tau> \\<gamma>`  by (metis b_conc_exec_empty_event quiet_def)\n      thus \"t, \\<sigma>, \\<gamma>, \\<theta>', def \\<turnstile> <cs, \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>\"\n        using b_conc_exec_mono_wrt_history  calculation(2) by blast\n    next\n      show \" worldline2 t \\<sigma> \\<theta>' def \\<tau> = tw\"\n        using des worldline2_constructible by blast\n    qed\n    ultimately have \"P (next_time_world tw, snd tw)\"\n      using 3(6) `P tw` tw_def \\<open>t < maxtime\\<close> unfolding conc_hoare_valid_def\n      by (metis \"*\" Suc_eq_plus1 Suc_leI fst_conv less_imp_le_nat min.absorb2)\n    { fix time\n      assume \"time > fst tw\"\n      have \"\\<forall>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> next_time_world tw' = time + 1 \\<and> snd tw = snd tw'\"\n      proof (rule, rule)\n        fix tw'\n        assume \"(time, snd tw), cs \\<Rightarrow>\\<^sub>c tw'\"\n        hence \"time = fst tw'\"\n          using fst_world_conc_exec by (metis fst_conv)\n        have \"\\<tau> = 0\"\n          using \\<open>quiet \\<tau> \\<gamma>\\<close> unfolding quiet_def by meson\n        have \"\\<forall>n \\<ge> t. \\<theta> n = 0\" and \"\\<forall>n \\<le> t. \\<tau> n = 0\"\n          using \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\\<close> unfolding context_invariant_def by auto\n        hence \"\\<exists>theta. destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, theta, def, \\<tau>) \\<and>\n               (\\<forall>k s. signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) theta s k)\"\n        proof -\n          have *: \"destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, derivative_hist_raw (snd tw) time, def, \\<tau>)\"\n          proof -\n            have \"snd tw = (def, worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)))\"\n              using tw_def by auto\n            have \"\\<theta> time = 0\"\n              using `time > fst tw` \\<open>\\<forall>n \\<ge> t. \\<theta> n = 0\\<close> by (simp add: \"3.prems\"(1))\n            { fix s\n              have \"wline_of tw s time = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s time\"\n                using \\<open>tw = (t, def, worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)))\\<close>\n                unfolding worldline_of_history_def by auto\n              also have \"... = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s time\"\n                using signal_of_less[of \"\\<theta>(t := Some o \\<sigma>)\" \"t + 1\"] by simp\n              also have \"... = \\<sigma> s\"\n                by (smt \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>get_time tw < time\\<close> fst_conv fun_upd_other fun_upd_same\n                less_imp_le_nat nat_neq_iff signal_of_less_ind trans_some_signal_of tw_def)\n              hence \"wline_of tw s time = \\<sigma> s\"\n                using \\<open>wline_of tw s time = signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s time\\<close>  by simp }\n            note * = this\n            hence \"(\\<lambda>s. wline_of tw s time) = \\<sigma>\"\n              by auto\n            hence 1: \"(\\<lambda>s. wline_of (time, snd tw) s (fst (time, snd tw))) = \\<sigma>\"\n              by auto\n            have 2: \"{s. wline_of tw s time \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) time) s t} = {}\"\n              using *\n              by (metis (mono_tags, lifting) Collect_empty_eq \\<open>get_time tw < time\\<close> des\n              destruct_worldline_correctness(2) destruct_worldline_correctness(6)\n              destruct_worldline_def fst_conv signal_of_derivative_hist_raw\n              worldline2_constructible)\n            { fix s n\n              assume \"n \\<ge> time\"\n              have \"wline_of tw s n = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s n\"\n                by (simp add: tw_def worldline_of_history_def)\n              also have \"... = signal_of (def s) (\\<theta> (t := Some o \\<sigma>)) s time\"\n                using \\<open>n \\<ge> time\\<close>\n                by (intro signal_of_less_ind')\n                   (metis \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>fst tw < time\\<close> dual_order.trans fst_conv fun_upd_apply leD\n                   order.strict_implies_order tw_def zero_fun_def)\n              also have \"... = wline_of tw s time\"\n                by (simp add: tw_def worldline_of_history_def)\n              finally have \"wline_of tw s n = wline_of tw s time\"\n                by auto }\n            hence 3: \"derivative_raw (snd tw) time = \\<tau>\"\n              using derivative_raw_alt_def[where tw=\"(time, snd tw)\"] \\<open>\\<tau> = 0\\<close>\n              by (metis comp_apply fst_conv snd_conv)\n            have \"fst tw = t\"\n              by (simp add: \"3.prems\"(1))\n            hence \"\\<And>s k . signal_of (def s) (derivative_hist_raw (snd tw) time) s (time - 1) =\n                          signal_of (def s) (derivative_hist_raw (snd tw) time ) s t\"\n              using `time > fst tw`\n              by (smt \"3.prems\"(1) Suc_diff_1 Suc_lessI \\<open>\\<tau> = 0\\<close> diff_less fst_conv le_add2\n              le_add_same_cancel2 le_less_trans nat_neq_iff order.strict_implies_order\n              signal_of_derivative_hist_raw signal_of_empty snd_conv worldline2_def\n              worldline_raw_def zero_less_one)\n            hence new2: \"{s. wline_of tw s time \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) time) s (time - 1)} = {}\"\n              using 2 by auto\n            have \"fst (snd tw) = def\"\n              by (simp add: \\<open>snd tw = (def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close>)\n            with 1 new2 3 show ?thesis\n              unfolding destruct_worldline_def Let_def\n              by auto\n          qed\n          { fix k s\n            have \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n            proof -\n              have \"fst tw = t\"\n                by (simp add: tw_def)\n              have \"k \\<le> time \\<or> time < k\"\n                by auto\n              moreover\n              { assume \"k \\<le> time\"\n                hence \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                  using \\<open>fst tw < time\\<close> \\<open>fst tw = t\\<close>\n                  by (smt Suc_diff_1 Suc_leI \\<open>\\<tau> = 0\\<close> \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau> = (t, def,\n                  worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close> dual_order.order_iff_strict\n                  eq_fst_iff le_add2 le_add_same_cancel2 not_le signal_of_derivative_hist_raw\n                  signal_of_derivative_hist_raw2 signal_of_empty snd_conv tw_def worldline2_def\n                  worldline_of_history_def worldline_raw_def) }\n              moreover\n              { assume \"time < k\"\n                hence \"t < k\" and \"time \\<le> k\"\n                  using \\<open>fst tw < time\\<close> tw_def by auto\n                hence \" inf_time (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>))) s k = Some t\"\n                  by (meson \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>t < k\\<close> inf_time_update less_or_eq_imp_le)\n                hence \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = \\<sigma> s\"\n                  unfolding to_signal_def comp_def  by (simp add: to_trans_raw_sig_def)\n                have \"signal_of (def s) (derivative_hist_raw (snd tw) time) s k = wline_of tw s (time - 1)\"\n                  using signal_of_derivative_hist_raw2[OF `time \\<le> k`]\n                  by (smt \\<open>get_time tw < time\\<close> comp_apply fst_conv neq0_conv not_less_zero snd_conv tw_def)\n                also have \"... = worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)) s t\"\n                  unfolding tw_def\n                  by (smt Suc_diff_1 Suc_lessI \\<open>\\<tau> = 0\\<close> \\<open>get_time tw < time\\<close> \\<open>get_time tw = t\\<close>\n                  \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau> = (t, def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close>\n                  comp_apply dual_order.strict_trans2 gr_implies_not_zero less_imp_le_nat\n                  less_irrefl_nat linorder_neqE_nat signal_of_empty snd_conv worldline2_def\n                  worldline_raw_def)\n                also have \"... = signal_of (def s) (\\<theta>(t:= Some o \\<sigma>)) s t\"\n                  unfolding worldline_of_history_def by auto\n                finally have \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                  by (metis \\<open>signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s k = \\<sigma> s\\<close> fun_upd_same trans_some_signal_of) }\n              ultimately show \"signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                by auto\n            qed }\n          with * show ?thesis\n            by auto\n        qed\n        then obtain theta where des: \"destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, theta, def, \\<tau>)\"\n          and \"\\<And>k s. signal_of (def s) (\\<theta>(t:= Some o \\<sigma>)) s k = signal_of (def s) theta s k\"\n          by blast\n        have \"b_conc_exec time \\<sigma> {} theta def cs \\<tau> \\<tau>\"\n          by (simp add: b_conc_exec_empty_event)\n        hence \"(time, snd tw), cs \\<Rightarrow>\\<^sub>c (worldline2  time \\<sigma> theta def \\<tau>)\"\n          using des world_conc_exec.intros by blast\n        moreover have \"(time, snd tw) = worldline2 time \\<sigma> theta def \\<tau>\"\n          using `tw = worldline2 t \\<sigma> \\<theta> def \\<tau>`  using des worldline2_constructible by blast\n        ultimately have \"(time, snd tw), cs \\<Rightarrow>\\<^sub>c (time, snd tw)\"\n          by auto\n        hence \"(time, snd tw) = tw'\"\n          using world_conc_exec_deterministic  by (metis \\<open>(time, snd tw) , cs \\<Rightarrow>\\<^sub>c tw'\\<close>)\n        hence \"derivative_raw (snd tw') (fst tw') = \\<tau>\"\n          by (metis \"3.prems\"(8) \\<open>(time, snd tw) = worldline2 time \\<sigma> theta def \\<tau>\\<close> \\<open>\\<tau> = 0\\<close> \\<open>time =\n          get_time tw'\\<close> derivative_raw_of_worldline2 zero_fun_def)\n        thus \" next_time_world tw' = time + 1 \\<and> snd tw = snd tw'\"\n          using 3(2) unfolding next_time_world_def Let_def\n          using \\<open>(time, snd tw) = tw'\\<close> \\<open>\\<tau> = 0\\<close> by force\n      qed }\n    hence \"\\<And>time. time > fst tw \\<Longrightarrow> \\<forall>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> next_time_world tw' = time + 1 \\<and> snd tw = snd tw'\"\n      by auto\n    with * have **: \"\\<And>time. time \\<ge> fst tw \\<Longrightarrow> \\<forall>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> next_time_world tw' = time + 1 \\<and> snd tw = snd tw'\"\n      by (metis (full_types) dual_order.order_iff_strict prod.collapse)\n    have always_progress: \"\\<And>time. get_time tw \\<le> time \\<Longrightarrow> \\<exists>tw'. (time, snd tw) , cs \\<Rightarrow>\\<^sub>c tw'\"\n    proof -\n      fix time\n      have \"\\<tau> = 0\"\n        by (meson \"3.hyps\"(2) quiet_def)\n      assume \"get_time tw \\<le> time\"\n      hence \"get_time tw = time \\<or> get_time tw < time\"\n        by auto\n      moreover\n      { assume \"get_time tw = time\"\n        hence \"(time, snd tw) = tw\"\n          by auto\n        hence \"\\<exists>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw'\"\n          by (metis \\<open>tw , cs \\<Rightarrow>\\<^sub>c tw\\<close>) }\n      moreover\n      { assume \"get_time tw < time\"\n        hence \"\\<exists>theta. destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, theta, def, \\<tau>) \\<and>\n               (\\<forall>k s. signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) theta s k)\"\n        proof -\n          have *: \"destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, derivative_hist_raw (snd tw) time, def, \\<tau>)\"\n          proof -\n            have \"snd tw = (def, worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)))\"\n              using tw_def by auto\n            have \"\\<theta> time = 0\"\n              using `time > fst tw` \\<open>\\<forall>n \\<ge> t. \\<theta> n = 0\\<close> by (simp add: \"3.prems\"(1))\n            { fix s\n              have \"wline_of tw s time = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s time\"\n                using \\<open>tw = (t, def, worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)))\\<close>\n                unfolding worldline_of_history_def by auto\n              also have \"... = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s time\"\n                using signal_of_less[of \"\\<theta>(t := Some o \\<sigma>)\" \"t + 1\"] by simp\n              also have \"... = \\<sigma> s\"\n                by (smt \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>get_time tw < time\\<close> fst_conv fun_upd_other fun_upd_same\n                less_imp_le_nat nat_neq_iff signal_of_less_ind trans_some_signal_of tw_def)\n              hence \"wline_of tw s time = \\<sigma> s\"\n                using \\<open>wline_of tw s time = signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s time\\<close>  by simp }\n            note * = this\n            hence \"(\\<lambda>s. wline_of tw s time) = \\<sigma>\"\n              by auto\n            hence 1: \"(\\<lambda>s. wline_of (time, snd tw) s (fst (time, snd tw))) = \\<sigma>\"\n              by auto\n            have 2: \"{s. wline_of tw s time \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) time) s t} = {}\"\n              using *\n              by (metis (mono_tags, lifting) Collect_empty_eq \\<open>get_time tw < time\\<close> des\n              destruct_worldline_correctness(2) destruct_worldline_correctness(6)\n              destruct_worldline_def fst_conv signal_of_derivative_hist_raw\n              worldline2_constructible)\n            { fix s n\n              assume \"n \\<ge> time\"\n              have \"wline_of tw s n = signal_of (def s) (\\<theta> (t:=Some o \\<sigma>)) s n\"\n                by (simp add: tw_def worldline_of_history_def)\n              also have \"... = signal_of (def s) (\\<theta> (t := Some o \\<sigma>)) s time\"\n                using \\<open>n \\<ge> time\\<close>\n                by (intro signal_of_less_ind')\n                   (metis \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>fst tw < time\\<close> dual_order.trans fst_conv fun_upd_apply leD\n                   order.strict_implies_order tw_def zero_fun_def)\n              also have \"... = wline_of tw s time\"\n                by (simp add: tw_def worldline_of_history_def)\n              finally have \"wline_of tw s n = wline_of tw s time\"\n                by auto }\n            hence 3: \"derivative_raw (snd tw) time = \\<tau>\"\n              using derivative_raw_alt_def[where tw=\"(time, snd tw)\"] \\<open>\\<tau> = 0\\<close>\n              by (metis comp_apply fst_conv snd_conv)\n            have \"fst tw = t\"\n              by (simp add: \"3.prems\"(1))\n            hence \"\\<And>s k . signal_of (def s) (derivative_hist_raw (snd tw) time) s (time - 1) =\n                          signal_of (def s) (derivative_hist_raw (snd tw) time ) s t\"\n              using `time > fst tw`\n              by (smt \"3.prems\"(1) Suc_diff_1 Suc_lessI \\<open>\\<tau> = 0\\<close> diff_less fst_conv le_add2\n              le_add_same_cancel2 le_less_trans nat_neq_iff order.strict_implies_order\n              signal_of_derivative_hist_raw signal_of_empty snd_conv worldline2_def\n              worldline_raw_def zero_less_one)\n            hence new2: \"{s. wline_of tw s time \\<noteq> signal_of (def s) (derivative_hist_raw (snd tw) time) s (time - 1)} = {}\"\n              using 2 by auto\n            have \"fst (snd tw) = def\"\n              by (simp add: \\<open>snd tw = (def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close>)\n            with 1 new2 3 show ?thesis\n              unfolding destruct_worldline_def Let_def\n              by auto\n          qed\n          { fix k s\n            have \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n            proof -\n              have \"fst tw = t\"\n                by (simp add: tw_def)\n              have \"k \\<le> time \\<or> time < k\"\n                by auto\n              moreover\n              { assume \"k \\<le> time\"\n                hence \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                  using \\<open>fst tw < time\\<close> \\<open>fst tw = t\\<close>\n                  by (smt Suc_diff_1 Suc_leI \\<open>\\<tau> = 0\\<close> \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau> = (t, def,\n                  worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close> dual_order.order_iff_strict\n                  eq_fst_iff le_add2 le_add_same_cancel2 not_le signal_of_derivative_hist_raw\n                  signal_of_derivative_hist_raw2 signal_of_empty snd_conv tw_def worldline2_def\n                  worldline_of_history_def worldline_raw_def) }\n              moreover\n              { assume \"time < k\"\n                hence \"t < k\" and \"time \\<le> k\"\n                  using \\<open>fst tw < time\\<close> tw_def by auto\n                hence \" inf_time (to_trans_raw_sig (\\<theta>(t := Some o \\<sigma>))) s k = Some t\"\n                  by (meson \\<open>\\<forall>n\\<ge>t. \\<theta> n = 0\\<close> \\<open>t < k\\<close> inf_time_update less_or_eq_imp_le)\n                hence \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = \\<sigma> s\"\n                  unfolding to_signal_def comp_def  by (simp add: to_trans_raw_sig_def)\n                have \"signal_of (def s) (derivative_hist_raw (snd tw) time) s k = wline_of tw s (time - 1)\"\n                  using signal_of_derivative_hist_raw2[OF `time \\<le> k`]\n                  by (smt \\<open>get_time tw < time\\<close> comp_apply fst_conv neq0_conv not_less_zero snd_conv tw_def)\n                also have \"... = worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)) s t\"\n                  unfolding tw_def\n                  by (smt Suc_diff_1 Suc_lessI \\<open>\\<tau> = 0\\<close> \\<open>get_time tw < time\\<close> \\<open>get_time tw = t\\<close>\n                  \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau> = (t, def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)))\\<close>\n                  comp_apply dual_order.strict_trans2 gr_implies_not_zero less_imp_le_nat\n                  less_irrefl_nat linorder_neqE_nat signal_of_empty snd_conv worldline2_def\n                  worldline_raw_def)\n                also have \"... = signal_of (def s) (\\<theta>(t:= Some o \\<sigma>)) s t\"\n                  unfolding worldline_of_history_def by auto\n                finally have \"signal_of (def s) (\\<theta>(t := Some o \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                  by (metis \\<open>signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s k = \\<sigma> s\\<close> fun_upd_same trans_some_signal_of) }\n              ultimately show \"signal_of (def s) (\\<theta>(t := Some \\<circ> \\<sigma>)) s k = signal_of (def s) (derivative_hist_raw (snd tw) time) s k\"\n                by auto\n            qed }\n          with * show ?thesis\n            by auto\n        qed\n        then obtain theta where des: \"destruct_worldline (time, snd tw) = (time, \\<sigma>, {}, theta, def, \\<tau>)\"\n          and \"\\<And>k s. signal_of (def s) (\\<theta>(t:= Some o \\<sigma>)) s k = signal_of (def s) theta s k\"\n          by blast\n        hence \"b_conc_exec time \\<sigma> {} theta def cs \\<tau> \\<tau>\"\n          by (simp add: b_conc_exec_empty_event)\n        hence \"\\<exists>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw'\"\n          using des world_conc_exec.intros by blast }\n      ultimately show \"\\<exists>tw'. (time, snd tw), cs \\<Rightarrow>\\<^sub>c tw'\"\n        by auto\n    qed\n    have pseudo_ind: \"\\<And>time. fst tw \\<le> time \\<Longrightarrow> time < maxtime \\<Longrightarrow> P (time, snd tw) \\<Longrightarrow> P (time + 1, snd tw)\"\n      using 3(6) unfolding conc_hoare_valid_def  using always_progress **  \n      by (metis discrete fst_conv less_imp_le_nat min.absorb2)\n    define distance where \"distance = maxtime - fst tw\"\n    hence pseudo_ind': \"\\<And>time. fst tw \\<le> time \\<Longrightarrow> time < fst tw + distance \\<Longrightarrow> P (time, snd tw) \\<Longrightarrow> P (time + 1, snd tw)\"\n      using pseudo_ind by auto\n    have \"maxtime - 1 < fst tw + distance\"\n      unfolding distance_def using \"3.hyps\"(1) by linarith\n    have \"P (maxtime, snd tw)\"\n      using \\<open>t < maxtime\\<close> \\<open>maxtime - 1 < fst tw + distance\\<close>\n    proof (induction \"maxtime - fst tw\" arbitrary: maxtime)\n      case 0\n      then show ?case using `P tw`  using tw_def by auto\n    next\n      case (Suc x)\n      hence \"x = (maxtime - 1) - fst tw\"\n        by auto\n      hence \"P (maxtime - 1, snd tw)\"\n        using Suc\n        by (metis (no_types, lifting) \"3.prems\"(5) Suc_diff_1 add_less_cancel_left diff_diff_cancel\n        diff_is_0_eq' gr_implies_not_zero less_Suc_eq not_le plus_1_eq_Suc snd_conv tw_def)\n      have \"maxtime - 1 \\<ge> fst tw\"\n        using Suc by auto\n      have \"\\<forall>tw'. (maxtime - 1, snd tw), cs \\<Rightarrow>\\<^sub>c tw' \\<longrightarrow> next_time_world tw' = maxtime \\<and> snd tw = snd tw'\"\n        using **[OF `maxtime - 1 \\<ge> fst tw`]\n        by (metis Suc.hyps(2) Suc_eq_plus1 Suc_inject \\<open>x = maxtime - 1 - fst tw\\<close> add_eq_if diff_0_eq_0)\n      have \"\\<exists>tw'. (maxtime - 1, snd tw) , cs \\<Rightarrow>\\<^sub>c tw'\"\n        using always_progress \\<open>get_time tw \\<le> maxtime - 1\\<close> by blast\n      have \"get_time tw \\<le> maxtime - 1\"\n        unfolding tw_def using \\<open>get_time tw \\<le> maxtime - 1\\<close> tw_def by blast\n      thus ?case\n        using pseudo_ind'[OF _ `maxtime - 1 < get_time tw + distance`] \n        by (metis Suc.prems(1) Suc_diff_1 Suc_eq_plus1 \\<open>P (maxtime - 1, snd tw)\\<close> gr_implies_not_zero\n        nat_neq_iff)\n    qed\n    moreover have \"snd tw =  worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0\"\n      unfolding tw_def snd_conv\n    proof (rule, rule_tac[2] ext, rule_tac[2] ext)\n      fix s' t'\n      have \"t' < maxtime \\<or> maxtime \\<le> t'\"\n        by auto\n      moreover\n      { assume \"t' < maxtime\"\n        hence \"snd (worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0) s' t' = signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t'\"\n          unfolding worldline_raw_def by auto\n        also have \"... = worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t'\"\n          unfolding worldline_of_history_def by auto\n        finally have \"worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)) s' t' = snd (worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0) s' t'\"\n          by auto }\n      moreover\n      { assume \" maxtime  \\<le> t'\"\n        hence \"snd (worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0) s' t' = signal_of (\\<sigma> s') 0 s' t'\"\n          unfolding worldline_raw_def by auto\n        also have \"... = \\<sigma> s'\"\n          by (meson signal_of_empty)\n        also have \"... = signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t\"\n          by (metis fun_upd_same trans_some_signal_of)\n        also have \"... = signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t'\"\n          using \\<open>\\<forall>n. t \\<le> n \\<longrightarrow>  \\<theta> n = 0\\<close> \\<open>t < maxtime\\<close> \\<open>maxtime \\<le> t'\\<close>\n          by (intro sym[OF signal_of_less_ind'])(simp add: zero_fun_def, linarith)\n        also have \"... = worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)) s' t'\"\n          unfolding worldline_of_history_def by auto\n        finally have \"worldline_of_history def (\\<theta>(t:= Some o \\<sigma>)) s' t' = snd (worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0) s' t'\"\n          by auto }\n      ultimately show \"snd (def, worldline_of_history def (\\<theta>(t := Some \\<circ> \\<sigma>))) s' t' = snd (worldline_raw (maxtime) \\<sigma> (\\<theta>(t := Some \\<circ> \\<sigma>)) def 0) s' t'\"\n        by auto\n    qed (simp add: worldline_raw_def)\n    ultimately show ?case\n      by (simp add: \\<open>tw' = (get_time (maxtime, \\<sigma>, \\<theta>(t := Some \\<circ> \\<sigma>), 0), worldline_raw (get_time\n      (maxtime, \\<sigma>, \\<theta>(t := Some \\<circ> \\<sigma>), 0)) (get_state (maxtime, \\<sigma>, \\<theta>(t := Some \\<circ> \\<sigma>), 0)) (get_beh\n      (maxtime, \\<sigma>, \\<theta>(t := Some \\<circ> \\<sigma>), 0)) def (get_trans (maxtime, \\<sigma>, \\<theta>(t := Some \\<circ> \\<sigma>), 0)))\\<close>)\n  next\n    case (4 t maxtime \\<sigma> \\<gamma> \\<theta> def cs \\<tau>)\n    hence \"tw' = tw\"\n      by (simp add: worldline2_def)\n    then show ?case\n      using `P tw` by auto\n  next\n    case (2 t maxtime \\<tau> \\<gamma> \\<sigma> \\<theta> def cs \\<tau>')\n    hence \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n      unfolding context_invariant_def by auto\n    have \"snd tw = worldline_raw t \\<sigma> \\<theta> def \\<tau>\"\n      using 2 unfolding worldline2_def by auto\n    obtain theta where dw_def: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, theta, def, \\<tau>)\" and\n                    \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k\"\n      using destruct_worldline_correctness4[OF \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\\<close> \\<open>\\<forall>s. non_stuttering\n      (to_trans_raw_sig \\<tau>) \\<sigma> s\\<close>]  using \"2.prems\"(1) by blast\n    hence \"b_conc_exec t \\<sigma> \\<gamma> theta def cs \\<tau> \\<tau>'\"\n      using b_conc_exec_mono_wrt_history[OF \\<open> t , \\<sigma> , \\<gamma> , \\<theta>, def  \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\\<close>]\n      by blast\n    then obtain tw_conc where \"tw, cs \\<Rightarrow>\\<^sub>c tw_conc\" and \"worldline2 t \\<sigma> theta def \\<tau>' = tw_conc\"\n      using \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, theta, def, \\<tau>)\\<close>\n      using world_conc_exec.intros by blast\n    have \"fst tw = fst tw_conc\"\n      using fst_world_conc_exec `tw, cs \\<Rightarrow>\\<^sub>c tw_conc` by metis\n    have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n      by (meson 2 \\<open>\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\\<close> \\<open>t , \\<sigma> , \\<gamma> , theta, def \\<turnstile> <cs , \\<tau>> \\<longrightarrow>\\<^sub>c \\<tau>'\\<close> \n          b_conc_exec_preserves_non_stuttering)\n    have \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n      using b_conc_exec_preserves_context_invariant[OF 2(3) `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>` `nonneg_delay_conc cs`]\n      by auto\n    hence \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau>' n = 0\"\n      unfolding context_invariant_def by auto\n    hence \"derivative_raw (snd tw_conc) (get_time tw_conc) = \\<tau>'\"\n      using derivative_raw_of_worldline2[OF _ \\<open>\\<forall>a. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> a\\<close>]\n      \\<open>worldline2 t \\<sigma> theta def \\<tau>' = tw_conc\\<close> by auto\n    have \"next_time_world tw_conc = next_time t \\<tau>'\"\n      unfolding next_time_world_def Let_def\n      by (metis \\<open>derivative_raw (snd tw_conc) (get_time tw_conc) = \\<tau>'\\<close> \\<open>get_time tw = get_time\n      tw_conc\\<close> dw_def fst_conv fst_destruct_worldline)\n    hence \"P (maxtime, snd tw_conc)\"\n      using 2(8) `P tw` `maxtime < next_time t \\<tau>'` \\<open>tw, cs \\<Rightarrow>\\<^sub>c tw_conc\\<close> `t < maxtime` \n      unfolding conc_hoare_valid_def \n      by (metis \"2.prems\"(1) fst_conv less_imp_le_nat min.strict_order_iff worldline2_def)  \n    have tw'_def: \"tw' = (maxtime, worldline_raw maxtime \\<sigma> (\\<theta>(t := Some o \\<sigma>)) def \\<tau>')\"\n      using 2  by (metis comp_apply fst_conv snd_conv)\n    have \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw_conc\"\n      unfolding sym[OF `worldline2 t \\<sigma> theta def \\<tau>' = tw_conc`] worldline2_def worldline_raw_def\n      `\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta s k` by auto\n    hence \"snd tw_conc = worldline_raw t \\<sigma> \\<theta> def \\<tau>'\"\n      unfolding worldline2_def by auto\n    also have \"... = worldline_raw maxtime \\<sigma> (\\<theta>(t := Some o \\<sigma>)) def \\<tau>'\"\n      unfolding worldline_raw_def\n    proof (rule+)\n      fix s' t'\n      have \"t' < t \\<or> t \\<le> t' \\<and> t' < next_time t \\<tau>' \\<or> next_time t \\<tau>' \\<le> t'\"\n        using `t < maxtime` by auto\n      moreover\n      { assume \"t' < t\"\n        hence \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') = \n                                                                         signal_of (def s') \\<theta> s' t'\"\n          by auto\n        also have \"... = signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t'\"\n          by (smt \\<open>t' < t\\<close> dual_order.strict_trans2 fun_upd_def le_eq_less_or_eq\n          min.strict_order_iff signal_of_equal_when_trans_equal_upto)\n        also have \"... = (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t')\"\n          using `t' < t` `t < maxtime` by auto\n        finally have \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') =\n       (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t')\"\n          by auto }\n      moreover\n      { assume \"t \\<le> t' \\<and> t' < next_time t \\<tau>' \"\n        hence \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') = \n                                                                          signal_of (\\<sigma> s') \\<tau>' s' t'\"\n          by auto\n        also have \"... = \\<sigma> s'\"\n          using \\<open>t \\<le> t' \\<and> t' < next_time t \\<tau>' \\<close> \\<open>maxtime < next_time t \\<tau>'\\<close> \n          by (metis (mono_tags) dual_order.strict_trans dual_order.strict_trans2 next_time_at_least2\n          signal_of_def zero_fun_def)\n        also have \"... = the ((\\<theta>(t := Some o \\<sigma>)) t s')\"\n          by simp\n        also have \"... = signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t\"\n          by (metis \\<open>\\<sigma> s' = the ((\\<theta>(t := Some \\<circ> \\<sigma>)) t s')\\<close> fun_upd_same trans_some_signal_of)\n        also have \"... = signal_of (def s') (\\<theta>(t := Some o \\<sigma>)) s' t'\"\n          apply (rule signal_of_less_ind[THEN sym])\n          apply (metis \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\\<close> context_invariant_def fun_upd_apply less_imp_le_nat nat_neq_iff)\n          by (auto simp add: `t \\<le> t' \\<and> t' < next_time t \\<tau>' `)      \n        also have \"... = (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') \"\n          using `t \\<le> t' \\<and> t' < next_time t \\<tau>' `  using calculation by auto\n        finally have \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') =\n       (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t')\"\n          by auto }\n      moreover\n      { assume \"next_time t \\<tau>' \\<le> t'\"\n        hence \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') = \n                                                                          signal_of (\\<sigma> s') \\<tau>' s' t'\"\n          using `t < maxtime`  \"2.hyps\"(4) by auto\n        also have \"... =  (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') \"\n          using \"2.hyps\"(4) \\<open>next_time t \\<tau>' \\<le> t'\\<close> by auto\n        finally have \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') =\n       (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t')\"\n          by auto }\n      ultimately show \"(if t' < t then signal_of (def s') \\<theta> s' t' else signal_of (\\<sigma> s') \\<tau>' s' t') =\n       (if t' < maxtime then signal_of (def s') (\\<theta>(t := Some \\<circ> \\<sigma>)) s' t' else signal_of (\\<sigma> s') \\<tau>' s' t')\"\n        by auto \n    qed\n    hence \"snd tw_conc = snd tw'\"\n      by (simp add: calculation tw'_def)      \n    then show ?case \n      using \\<open>P (maxtime, snd tw_conc)\\<close> tw'_def by auto\n  qed\nqed\n\nlemma while_soundness4:\n  assumes \"\\<Turnstile> \\<lbrace>P\\<rbrace> cs \\<lbrace>\\<lambda>tw. P (fst tw + 1, snd tw)\\<rbrace>\"\n  assumes \"tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\n  assumes \"P tw\"      \n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"P tw'\"\nproof -\n  have \" world_sim_fin2 tw T cs tw'\"\n    using only_context_matters_for_sim_fin2[OF assms(2) assms(4-5)] world_sim_fin_semi_equivalent[OF assms(2) _ assms(4-5)] \n    by auto\n  hence \"world_sim_fin2_alt tw T cs tw'\"\n    unfolding world_sim_fin2_eq_world_sim_fin2_alt[OF assms(5) assms(4), THEN sym] by auto\n  thus ?thesis\n    using assms(1) assms(3-5)\n  proof (induction rule: world_sim_fin2_alt.inducts)\n    case (1 tw T cs tw2 tw3)\n    hence \"tw, cs \\<Rightarrow>\\<^sub>c tw2\"\n      unfolding world_conc_exec_eq_world_conc_exec_alt[OF ` conc_stmt_wf cs` `nonneg_delay_conc cs`]\n      by auto\n    hence \"P (get_time tw2 + 1, snd tw2)\"\n      using `\\<Turnstile> \\<lbrace>\\<lambda>tw. P tw\\<rbrace> cs \\<lbrace>\\<lambda>tw. P (get_time tw + 1, snd tw)\\<rbrace>` `fst tw < T` `P tw`\n      unfolding conc_hoare_valid_def by presburger\n    then show ?case \n      using 1(4)[OF `\\<Turnstile> \\<lbrace>\\<lambda>tw. P tw\\<rbrace> cs \\<lbrace>\\<lambda>tw. P (get_time tw + 1, snd tw)\\<rbrace>`]\n      using \"1.prems\"(3) \"1.prems\"(4) by blast\n  next\n    case (2 tw T cs)\n    then show ?case by auto\n  qed\nqed\n\nlemma conc_sim_soundness:\n  assumes \"\\<turnstile>\\<^sub>s \\<lbrace>P\\<rbrace> cs \\<lbrace>Q\\<rbrace>\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows \"\\<Turnstile>\\<^sub>s \\<lbrace>P\\<rbrace> cs \\<lbrace>Q\\<rbrace>\"\n  using assms\nproof (induction rule:conc_sim.induct)\n  case (While_Suc P  cs)\n  hence \" \\<Turnstile> \\<lbrace>\\<lambda>tw. P tw\\<rbrace> cs \\<lbrace>\\<lambda>tw. P (fst tw + 1, snd tw)\\<rbrace>\"\n    using soundness_conc_hoare[OF While_Suc(1)] by auto\n  then show ?case \n    unfolding sim_hoare_valid_def using while_soundness4[OF _ _ _ While_Suc(2-3)]\n    by blast\nnext\n  case (While P cs)\n  hence \" \\<Turnstile> \\<lbrace>\\<lambda>tw. P tw\\<rbrace> cs \\<lbrace>\\<lambda>tw. \\<forall>i\\<in>{get_time tw<..next_time_world tw}. P (i, snd tw)\\<rbrace>\"\n    using soundness_conc_hoare[OF While(1)] by auto\n  then show ?case\n    unfolding sim_hoare_valid_def using while_soundness2[OF _ _ _ While(2) While(3)] by auto\nnext\n  case (Conseq_sim P' P cs Q Q')\n  then show ?case by (metis (full_types) sim_hoare_valid_def)\nqed\n\nsubsection \\<open>Initialisation\\<close>\n\ninductive world_init_exec :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\"\n  (\"(_ , _) \\<Rightarrow>\\<^sub>I _\") where\n  \"     destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\n   \\<Longrightarrow>  init' t \\<sigma> \\<gamma> \\<theta> def cs \\<tau> \\<tau>'\n   \\<Longrightarrow>  worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\n   \\<Longrightarrow>  world_init_exec tw cs tw'\"\n\nlemma fst_world_init_exec:\n  assumes \"world_init_exec tw cs tw'\"\n  shows   \"fst tw' = fst tw\"\n  using assms\nproof (induction rule:world_init_exec.inducts)\n  case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> cs \\<tau>' tw')\n  then show ?case \n    by (metis fst_conv fst_destruct_worldline worldline2_def)\nqed\n\ninductive_cases world_init_exec_cases [elim!]: \"world_init_exec tw (process sl : ss) tw'\"\n                                               \"world_init_exec tw (cs1 || cs2) tw'\"\n\nlemma world_init_exec_deterministic:\n  assumes \"tw, cs \\<Rightarrow>\\<^sub>I tw1\"\n  assumes \"tw, cs \\<Rightarrow>\\<^sub>I tw2\"\n  shows   \"tw1 = tw2\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\"\n  and \"init' t \\<sigma> \\<gamma> \\<theta> def cs \\<tau> \\<tau>'\" and \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw1\"\n    using assms(1)  by (smt world_init_exec.cases)\n  thus ?thesis\n    using assms(2) \n    by (smt Pair_inject init'_deterministic world_init_exec.cases)\nqed\n\nlemma world_init_exec_process:\n  assumes \"world_seq_exec tw ss tw'\"\n  shows   \"world_init_exec tw (process sl : ss) tw'\"\n  using assms\nproof (induction rule:world_seq_exec.inducts)\n  case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> s \\<tau>' tw')\n  hence init: \"init' t \\<sigma> \\<gamma> \\<theta> def (process sl : s) \\<tau> \\<tau>'\"\n    by (auto intro!: init'.intros)\n  show ?case \n    by (intro world_init_exec.intros[OF 1(1) init 1(3)])\nqed\n\ninductive world_init_exec_alt :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\" where\n  \"world_seq_exec tw ss tw' \\<Longrightarrow> world_init_exec_alt tw (process sl : ss) tw'\"\n\n| \"world_init_exec_alt tw cs1 tw' \\<Longrightarrow> world_init_exec_alt tw' cs2 tw'' \\<Longrightarrow> world_init_exec_alt tw (cs1 || cs2) tw''\"\n\n| \"world_init_exec_alt tw cs2 tw' \\<Longrightarrow> world_init_exec_alt tw' cs1 tw'' \\<Longrightarrow> world_init_exec_alt tw (cs1 || cs2) tw''\"\n\nlemma world_init_exec_alt_imp_world_init_exec:\n  assumes \"world_init_exec_alt tw cs tw'\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"world_init_exec tw cs tw'\"\n  using assms\nproof (induction rule: world_init_exec_alt.inducts)\n  case (1 tw ss tw' sl)\n  then show ?case  by (auto simp add: world_init_exec_process)\nnext\n  case (2 tw cs1 tw' cs2 tw'')\n  hence \"tw , cs1 \\<Rightarrow>\\<^sub>I tw'\" and \"tw', cs2 \\<Rightarrow>\\<^sub>I tw''\"\n    by (simp add: conc_stmt_wf_def)+\n  then show ?case \n    using `nonneg_delay_conc (cs1 || cs2)` `conc_stmt_wf (cs1 || cs2)`\n  proof (induction rule: world_init_exec.inducts)\n    case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> cs1 \\<tau>' tw')\n    show ?case \n      using 1(4) 1(1-3) 1(5-6)\n    proof (induction rule: world_init_exec.inducts)\n      case (1 tw2 t2 \\<sigma>2 \\<gamma>2 \\<theta>2 def2 \\<tau>2 cs2 \\<tau>2' tw2')\n      hence \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n        using worldline2_constructible by blast\n      hence \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n        using init'_preserves_context_invariant[OF 1(5)] \"1.prems\"(4) nonneg_delay_conc.simps(2) \n        by blast\n      have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n        using 1  using destruct_worldline_ensure_non_stuttering by blast\n      hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n        using init'_preserves_non_stuttering[OF 1(5)] `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>`\n        by (metis \"1.prems\"(4) \"1.prems\"(5) conc_stmt_wf_def context_invariant_def distinct_append\n        nonneg_delay_conc.simps(2) signals_from.simps(2))\n      then obtain \\<theta>_res where \"t2 = t \\<and> \\<sigma>2 = \\<sigma> \\<and> \\<gamma>2 = \\<gamma> \\<and> \\<tau>2 = \\<tau>' \\<and> (\\<forall>k s. signal_of (def s) \\<theta>2 s k = signal_of (def s) \\<theta>_res s k) \n                                                                  \\<and> (\\<forall>k s. signal_of (def s) \\<theta>  s k = signal_of (def s) \\<theta>_res s k)\"\n        using destruct_worldline_correctness4[OF `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'`]\n        using \"1.hyps\"(1) \"1.prems\"(3) by auto      \n      hence \"\\<forall>k s. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>2 s k\"\n        by auto\n      obtain temp where temp: \"init' t \\<sigma> \\<gamma> \\<theta> def (cs1 || cs2) \\<tau> temp\"\n        by (metis (no_types, hide_lams) \"1.hyps\"(1) \"1.hyps\"(2) \"1.prems\"(1) \"1.prems\"(2)\n        \"1.prems\"(3) \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\\<close> \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def\n        \\<tau>'\\<close> destruct_worldline_correctness3 destruct_worldline_ensure_non_stuttering_hist_raw\n        fst_conv init'.intros(2) only_context_matters_for_progress_init snd_conv)\n      hence \"init' t \\<sigma> \\<gamma> \\<theta> def (cs1 || cs2) \\<tau> \\<tau>2'\"\n        using init'_sequential'[OF `conc_stmt_wf (cs1 || cs2)` temp] \n        by (metis \"1.hyps\"(1) \"1.hyps\"(2) \"1.prems\"(1) \"1.prems\"(2) \"1.prems\"(3) \\<open>\\<forall>s. non_stuttering\n        (to_trans_raw_sig \\<tau>') \\<sigma> s\\<close> \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\\<close>\n        destruct_worldline_correctness3 destruct_worldline_ensure_non_stuttering_hist_raw fst_conv\n        snd_conv)\n      then show ?case \n        by (metis \"1.hyps\"(1) \"1.hyps\"(3) \"1.prems\"(1) \"1.prems\"(3) \\<open>\\<forall>s. non_stuttering\n        (to_trans_raw_sig \\<tau>') \\<sigma> s\\<close> \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\\<close>\n        destruct_worldline_correctness3 destruct_worldline_ensure_non_stuttering_hist_raw fst_conv\n        snd_conv world_init_exec.intros)\n    qed\n  qed\nnext\n  case (3 tw cs2 tw' cs1 tw'')\n  hence \"tw , cs2 \\<Rightarrow>\\<^sub>I tw'\" and \"tw', cs1 \\<Rightarrow>\\<^sub>I tw''\"\n    by (simp add: conc_stmt_wf_def)+\n  then show ?case \n    using `nonneg_delay_conc (cs1 || cs2)` `conc_stmt_wf (cs1 || cs2)`\n  proof (induction rule: world_init_exec.inducts)\n    case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> cs2 \\<tau>' tw')\n    show ?case \n      using 1(4) 1(1-3) 1(5-6)\n    proof (induction rule: world_init_exec.inducts)\n      case (1 tw2 t2 \\<sigma>2 \\<gamma>2 \\<theta>2 def2 \\<tau>2 cs1 \\<tau>2' tw2')\n      hence \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n        using worldline2_constructible by blast\n      hence \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\"\n        using init'_preserves_context_invariant[OF 1(5)] \"1.prems\"(4) nonneg_delay_conc.simps(2) \n        by blast\n      have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n        using 1  using destruct_worldline_ensure_non_stuttering by blast\n      hence \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\"\n        using init'_preserves_non_stuttering[OF 1(5)] `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>`\n        by (metis \"1.prems\"(4) \"1.prems\"(5) conc_stmt_wf_def context_invariant_def distinct_append\n        nonneg_delay_conc.simps(2) signals_from.simps(2))\n      then obtain \\<theta>_res where \"t2 = t \\<and> \\<sigma>2 = \\<sigma> \\<and> \\<gamma>2 = \\<gamma> \\<and> \\<tau>2 = \\<tau>' \\<and> (\\<forall>k s. signal_of (def s) \\<theta>2 s k = signal_of (def s) \\<theta>_res s k) \n                                                                  \\<and> (\\<forall>k s. signal_of (def s) \\<theta>  s k = signal_of (def s) \\<theta>_res s k)\"\n        using destruct_worldline_correctness4[OF `context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'`]\n        using \"1.hyps\"(1) \"1.prems\"(3) by auto      \n      hence \"\\<forall>k s. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>2 s k\"\n        by auto\n      obtain temp where temp: \"init' t \\<sigma> \\<gamma> \\<theta> def (cs2 || cs1) \\<tau> temp\"\n        by (metis (no_types, hide_lams) \"1.hyps\"(1) \"1.hyps\"(2) \"1.prems\"(1) \"1.prems\"(2)\n        \"1.prems\"(3) \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\\<close> \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def\n        \\<tau>'\\<close> destruct_worldline_correctness3 destruct_worldline_ensure_non_stuttering_hist_raw\n        fst_conv init'.intros(2) only_context_matters_for_progress_init snd_conv)\n      hence \"init' t \\<sigma> \\<gamma> \\<theta> def (cs2 || cs1) \\<tau> \\<tau>2'\"\n        using init'_sequential'[OF _ temp] \n        by (smt \"1.hyps\"(1) \"1.hyps\"(2) \"1.prems\"(1) \"1.prems\"(2) \"1.prems\"(3) \"1.prems\"(5) \\<open>\\<forall>s.\n        non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\\<close> \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\\<close>\n        conc_stmt_wf_def destruct_worldline_correctness3\n        destruct_worldline_ensure_non_stuttering_hist_raw disjoint_iff_not_equal distinct_append\n        fst_conv signals_from.simps(2) snd_conv)\n      hence \"init' t \\<sigma> \\<gamma> \\<theta> def (cs1 || cs2) \\<tau> \\<tau>2'\"\n        using init'_commute' \n        by (metis \"1.prems\"(5) init'.intros(2) init'_cases(2) init'_deterministic)\n      then show ?case \n        by (metis \"1.hyps\"(1) \"1.hyps\"(3) \"1.prems\"(1) \"1.prems\"(3) \\<open>\\<And>thesis. (\\<And>\\<theta>_res. t2 = t \\<and> \\<sigma>2 =\n        \\<sigma> \\<and> \\<gamma>2 = \\<gamma> \\<and> \\<tau>2 = \\<tau>' \\<and> (\\<forall>k s. signal_of (def s) \\<theta>2 s k = signal_of (def s) \\<theta>_res s k) \\<and> (\\<forall>k\n        s. signal_of (def s) \\<theta> s k = signal_of (def s) \\<theta>_res s k) \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close> \\<open>\\<forall>s.\n        non_stuttering (to_trans_raw_sig \\<tau>') \\<sigma> s\\<close> \\<open>context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>'\\<close>\n        destruct_worldline_correctness(6) destruct_worldline_correctness2(5)\n        destruct_worldline_ensure_non_stuttering_hist_raw world_init_exec.intros)        \n    qed\n  qed\nqed\n\nlemma world_init_exec_imp_world_init_exec_alt:\n  assumes \"world_init_exec tw cs tw'\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"world_init_exec_alt tw cs tw'\"\n  using assms\nproof (induction rule:world_init_exec.induct)\n  case (1 tw t \\<sigma> \\<gamma> \\<theta> def \\<tau> cs \\<tau>' tw')\n  then show ?case \n  proof (induction cs arbitrary: tw \\<tau> \\<tau>' tw')\n    case (Bpar cs1 cs2)\n    obtain \\<tau>_temp where \"init' t \\<sigma> \\<gamma> \\<theta> def cs1 \\<tau> \\<tau>_temp\"\n      using Bpar(4)  by blast\n    hence \" init' t \\<sigma> \\<gamma> \\<theta> def cs2 \\<tau>_temp \\<tau>'\"\n      using init'_sequential[OF _ Bpar(4)]  using Bpar.prems(5) by blast\n    have \"world_init_exec_alt tw cs1 (worldline2 t \\<sigma> \\<theta> def \\<tau>_temp)\"\n      using Bpar(1)[OF Bpar(3) `init' t \\<sigma> \\<gamma> \\<theta> def cs1 \\<tau> \\<tau>_temp`] \n      by (metis Bpar.prems(4) Bpar.prems(5) conc_stmt_wf_def distinct_append\n      nonneg_delay_conc.simps(2) signals_from.simps(2))\n    have ci: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>_temp\"\n      using Bpar.prems(1) Bpar.prems(4) \\<open>init' t \\<sigma> \\<gamma> \\<theta> def cs1 \\<tau> \\<tau>_temp\\<close>\n      init'_preserves_context_invariant nonneg_delay_conc.simps(2) worldline2_constructible by blast\n    have nst: \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>_temp) \\<sigma> s\"\n      by (metis (mono_tags, lifting) Bpar.prems(1) Bpar.prems(4) Bpar.prems(5) \\<open>init' t \\<sigma> \\<gamma> \\<theta> def\n      cs1 \\<tau> \\<tau>_temp\\<close> conc_stmt_wf_def context_invariant_def destruct_worldline_ensure_non_stuttering\n      distinct_append init'_preserves_non_stuttering nonneg_delay_conc.simps(2)\n      signals_from.simps(2) worldline2_constructible)\n    have nsb: \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<theta>) def s\"\n      using Bpar.prems(1) destruct_worldline_ensure_non_stuttering_hist_raw by blast\n    have des: \"destruct_worldline (worldline2 t \\<sigma> \\<theta> def \\<tau>_temp) = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>_temp)\"\n      using destruct_worldline_correctness3[OF ci nst nsb] by auto\n    have \"world_init_exec_alt (worldline2 t \\<sigma> \\<theta> def \\<tau>_temp) cs2 tw'\"\n      using Bpar(2)[OF des `init' t \\<sigma> \\<gamma> \\<theta> def cs2 \\<tau>_temp \\<tau>'`] \n      by (metis Bpar.prems(3) Bpar.prems(4) Bpar.prems(5) conc_stmt_wf_def distinct_append\n      nonneg_delay_conc.simps(2) signals_from.simps(2))\n    then show ?case\n      using `world_init_exec_alt tw cs1 (worldline2 t \\<sigma> \\<theta> def \\<tau>_temp)` \n      using world_init_exec_alt.intros(2) by blast\n  next\n    case (Bsingle sl ss)\n    hence \"t, \\<sigma>, \\<gamma>, \\<theta>, def \\<turnstile> < ss, \\<tau>> \\<longrightarrow>\\<^sub>s \\<tau>'\" by blast\n    hence \"world_seq_exec tw ss tw'\"\n      by (smt Bsingle.prems(1) Bsingle.prems(3) world_seq_exec.intros)    \n    then show ?case \n      by (simp add: world_init_exec_alt.intros(1))\n  qed\nqed\n\nlemma world_init_equality:\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows   \"world_init_exec_alt tw cs = world_init_exec tw cs\"\n  using world_init_exec_alt_imp_world_init_exec world_init_exec_imp_world_init_exec_alt assms\n  by blast\n\nlemma world_init_exec_alt_unaffected:\n  assumes \"world_init_exec_alt tw cs tw'\"\n  assumes \"sig \\<notin> set (signals_from cs)\"\n  assumes \"nonneg_delay_conc cs\"\n  shows   \"\\<And>k. wline_of tw sig k = wline_of tw' sig k\"\n  using assms\nproof (induction rule:world_init_exec_alt.inducts)\n  case (1 tw ss tw' sl)\n  hence \"world_seq_exec_alt tw ss tw'\"\n    using world_seq_exec_imp_world_seq_exec_alt nonneg_delay_conc.simps(1) by blast\n  then show ?case \n    using \"1.prems\"(1) world_seq_exec_alt_unaffected by fastforce\nqed (auto)\n\ninductive\n  init_hoare :: \"'signal assn2 \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\"\n  (\"\\<turnstile>\\<^sub>I (\\<lbrace>(1_)\\<rbrace>/ (_)/ \\<lbrace>(1_)\\<rbrace>)\" 50)\n  where\n  SingleI:    \"\\<turnstile> [P] ss [Q] \\<Longrightarrow> \\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> process sl : ss \\<lbrace>Q\\<rbrace>\"\n| ParallelI:  \"\\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs\\<^sub>1 \\<lbrace>R\\<rbrace> \\<Longrightarrow> \\<turnstile>\\<^sub>I \\<lbrace>R\\<rbrace> cs\\<^sub>2 \\<lbrace>Q\\<rbrace> \\<Longrightarrow> conc_stmt_wf (cs\\<^sub>1 || cs\\<^sub>2) \\<Longrightarrow> \\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs\\<^sub>1 || cs\\<^sub>2 \\<lbrace>Q\\<rbrace>\"\n| ParallelI2: \"\\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs\\<^sub>2 \\<lbrace>R\\<rbrace> \\<Longrightarrow> \\<turnstile>\\<^sub>I \\<lbrace>R\\<rbrace> cs\\<^sub>1 \\<lbrace>Q\\<rbrace> \\<Longrightarrow> conc_stmt_wf (cs\\<^sub>1 || cs\\<^sub>2) \\<Longrightarrow> \\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs\\<^sub>1 || cs\\<^sub>2 \\<lbrace>Q\\<rbrace>\"\n| ConseqI:    \"\\<lbrakk>\\<forall>w. P' w \\<longrightarrow> P w; \\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>Q\\<rbrace>; \\<forall>w. Q w \\<longrightarrow> Q' w\\<rbrakk> \\<Longrightarrow> \\<turnstile>\\<^sub>I \\<lbrace>P'\\<rbrace> cs \\<lbrace>Q\\<rbrace>\"\n| ConjI:      \"\\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>Q1\\<rbrace> \\<Longrightarrow> \\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>Q2\\<rbrace> \\<Longrightarrow> \\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>\\<lambda>tw. Q1 tw \\<and> Q2 tw\\<rbrace>\"\n\ndefinition\n  init_hoare_valid :: \"'signal assn2 \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\" (\"\\<Turnstile>\\<^sub>I \\<lbrace>(1_)\\<rbrace>/ (_)/ \\<lbrace>(1_)\\<rbrace>\" 50)\n  where \"\\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>Q\\<rbrace> \\<longleftrightarrow>  (\\<forall>tw tw'.  P tw \\<and> (tw, cs \\<Rightarrow>\\<^sub>I tw') \\<longrightarrow> Q tw')\"\n\nlemma parallelI_valid:\n  assumes \"\\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> c1 \\<lbrace>R\\<rbrace>\" and \"\\<Turnstile>\\<^sub>I \\<lbrace>R\\<rbrace> c2 \\<lbrace>Q\\<rbrace>\" and \"conc_stmt_wf (c1 || c2)\"\n  assumes \"nonneg_delay_conc (c1 || c2)\"\n  shows \"\\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> c1 || c2 \\<lbrace>Q\\<rbrace>\"\n  unfolding init_hoare_valid_def\nproof rule+\n  fix tw tw':: \"nat \\<times> 'a worldline_init\"\n  assume \"P tw \\<and> tw , c1 || c2 \\<Rightarrow>\\<^sub>I tw'\"\n  hence \"P tw\" and \"tw, c1 || c2 \\<Rightarrow>\\<^sub>I tw'\"\n    by auto\n  then obtain t \\<sigma> \\<gamma> \\<theta> def \\<tau> \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    *: \"init' t \\<sigma> \\<gamma> \\<theta> def (c1 || c2) \\<tau> \\<tau>'\" and w'_def: \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\" and\n    ci: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>\"\n    using destruct_worldline_exist  by (smt world_init_exec_cases(2) worldline2_constructible)\n  then obtain \\<tau>1 where \\<tau>1_def: \"init' t \\<sigma> \\<gamma> \\<theta> def c1 \\<tau> \\<tau>1\"\n    by blast\n  have \"\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n  proof\n    fix s\n    have \"non_stuttering (to_trans_raw_sig \\<tau>) \\<sigma> s\"\n      using destruct_worldline_ensure_non_stuttering[OF des] by auto\n    moreover have \"\\<And>n. n \\<le> t \\<Longrightarrow> \\<tau> n = 0\"\n      using ci unfolding context_invariant_def by auto\n    moreover have \"nonneg_delay_conc c1\" and \"conc_stmt_wf c1\"\n      using assms(3-4) by auto\n    ultimately show \"non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\"\n      using init'_preserves_non_stuttering[OF \\<tau>1_def] by auto\n  qed\n  hence ci1: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>1\"\n    using init'_preserves_context_invariant[OF \\<tau>1_def ci] assms(4) by simp\n  obtain \\<tau>2 where \\<tau>2_def: \"init' t \\<sigma> \\<gamma> \\<theta> def c2 \\<tau> \\<tau>2\"\n    using * by blast\n  hence ci2: \"context_invariant t \\<sigma> \\<gamma> \\<theta> def \\<tau>2\"\n    using init'_preserves_context_invariant[OF \\<tau>2_def ci] assms(4) by auto\n  have \\<tau>'_def: \"init' t \\<sigma> \\<gamma> \\<theta> def c2 \\<tau>1 \\<tau>'\"\n    using init'_sequential[OF assms(3)] *  \\<tau>1_def by auto\n  define tw1 where \"tw1 = worldline2 t \\<sigma> \\<theta> def \\<tau>1\"\n  hence \"tw, c1 \\<Rightarrow>\\<^sub>I tw1\"\n    using des \\<tau>1_def by (auto intro!: world_init_exec.intros)\n  hence \"R tw1\"\n    using assms(1) `P tw` unfolding init_hoare_valid_def by blast\n  then obtain theta1 where des2: \"destruct_worldline tw1 = (t, \\<sigma>, \\<gamma>, theta1, def, \\<tau>1)\" and\n    beh_same: \"\\<And>k s. signal_of (def s) \\<theta> s k = signal_of (def s) theta1 s k\"\n    using \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\\<close> ci1 des destruct_worldline_correctness3\n    destruct_worldline_ensure_non_stuttering_hist_raw tw1_def by blast\n  have \"context_invariant t \\<sigma> \\<gamma> theta1 def \\<tau>1\"\n    using des2 worldline2_constructible by fastforce\n  moreover have \"nonneg_delay_conc c2\"\n    using assms(4) by auto\n  moreover have \"init' t \\<sigma> \\<gamma> theta1 def c2 \\<tau>1 \\<tau>'\"\n    by (metis \\<open>\\<forall>s. non_stuttering (to_trans_raw_sig \\<tau>1) \\<sigma> s\\<close> \\<tau>'_def ci1 des des2\n    destruct_worldline_correctness2(5) destruct_worldline_ensure_non_stuttering_hist_raw tw1_def)\n  have \"worldline2 t \\<sigma> theta1 def \\<tau>' = worldline2 t \\<sigma> \\<theta> def \\<tau>'\"\n    using beh_same \\<tau>'_def ci1  unfolding worldline2_def worldline_raw_def by presburger\n  hence \"tw1, c2 \\<Rightarrow>\\<^sub>I tw'\"\n    using des2 \\<open>init' t \\<sigma> \\<gamma> theta1 def c2 \\<tau>1 \\<tau>'\\<close> w'_def world_init_exec.intros by blast\n  with `R tw1` show \"Q tw'\"\n    using assms(2) using init_hoare_valid_def by metis\nqed\n\nlemma parallelI_comp_commute':\n  assumes \"conc_stmt_wf (cs1 || cs2)\"\n  assumes \"init' t \\<sigma> \\<gamma> \\<theta> def (cs1 || cs2) \\<tau> \\<tau>'\"\n  shows \"init' t \\<sigma> \\<gamma> \\<theta> def (cs2 || cs1) \\<tau> \\<tau>'\"\nproof -\n  have \"disjnt (set (signals_from cs1)) (set (signals_from cs2))\"\n    using assms(1) unfolding conc_stmt_wf_def by (simp add: disjnt_def)\n  thus ?thesis\n    using van_tassel_second_prop' assms(2) init'.intros(2) by fastforce\nqed\n\nlemma world_init_exec_commute:\n  assumes \"tw, (cs1 || cs2) \\<Rightarrow>\\<^sub>I tw1\"\n  assumes \"tw, (cs2 || cs1) \\<Rightarrow>\\<^sub>I tw2\"\n  assumes \"conc_stmt_wf (cs1 || cs2)\"\n  shows \"tw1 = tw2\"\nproof -\n  obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> def \\<tau>' where \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and\n    \"init' t \\<sigma> \\<gamma> \\<theta> def (cs1 || cs2) \\<tau> \\<tau>'\" and \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw1\"\n    using assms(1)  by (smt world_init_exec_cases(2))\n  hence \"init' t \\<sigma> \\<gamma> \\<theta> def (cs2 || cs1) \\<tau> \\<tau>'\"\n    using parallelI_comp_commute'[OF assms(3)] by auto\n  thus ?thesis\n    using assms(2) \\<open>destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\\<close> \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw1\\<close>\n    by (smt fst_conv init'_deterministic snd_conv world_init_exec_cases(2))\nqed\n\nlemma soundness_init_hoare:\n  assumes \"\\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> c \\<lbrace>Q\\<rbrace>\"\n  assumes \"conc_stmt_wf c\" and \"nonneg_delay_conc c\"\n  shows   \"\\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> c \\<lbrace>Q\\<rbrace>\"\n  using assms\nproof (induction rule:init_hoare.induct)\n  case (SingleI P ss Q sl)\n  { fix tw  tw' :: \"nat \\<times> 'a worldline_init\"\n    assume as: \"P tw \\<and> (tw ,  process sl : ss \\<Rightarrow>\\<^sub>I tw')\"\n    then obtain t \\<sigma> \\<gamma> \\<theta> \\<tau> def \\<tau>' where des: \"destruct_worldline tw = (t, \\<sigma>, \\<gamma>, \\<theta>, def, \\<tau>)\" and \"P tw\" and\n      ex: \"init' t \\<sigma> \\<gamma> \\<theta> def (process sl : ss) \\<tau> \\<tau>'\" and \"worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\"\n      by (smt world_init_exec_cases(1))\n    have \"fst tw = t\"\n      by (metis (no_types, lifting) des destruct_worldline_def fst_conv)\n    have \"nonneg_delay ss\"\n      using SingleI by auto\n    have \"tw, ss \\<Rightarrow>\\<^sub>s tw'\"\n      using des \\<open>worldline2 t \\<sigma> \\<theta> def \\<tau>' = tw'\\<close> ex world_seq_exec.intros by blast\n    hence \"Q tw'\"\n      using soundness_hoare2[OF SingleI(1) `nonneg_delay ss`] `P tw` `fst tw = t`\n      unfolding seq_hoare_valid2_def by blast }\n  then show ?case\n    unfolding init_hoare_valid_def by auto\nnext\n  case (ParallelI P cs\\<^sub>1 R cs\\<^sub>2 Q)\n  hence \"conc_stmt_wf cs\\<^sub>1\" and \"conc_stmt_wf cs\\<^sub>2\"\n    by (simp add: conc_stmt_wf_def)+\n  moreover have \"nonneg_delay_conc cs\\<^sub>1\" and \"nonneg_delay_conc cs\\<^sub>2\"\n    using ParallelI by auto\n  ultimately have \" \\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs\\<^sub>1 \\<lbrace>R\\<rbrace>\" and \" \\<Turnstile>\\<^sub>I \\<lbrace>R\\<rbrace> cs\\<^sub>2 \\<lbrace>Q\\<rbrace>\"\n    using ParallelI by blast+\n  then show ?case\n    using parallelI_valid ParallelI by blast\nnext\n  case (ParallelI2 P cs\\<^sub>2 R cs\\<^sub>1 Q)\n  hence \"conc_stmt_wf cs\\<^sub>1\" and \"conc_stmt_wf cs\\<^sub>2\"\n    by (simp add: conc_stmt_wf_def)+\n  moreover have \"nonneg_delay_conc cs\\<^sub>1\" and \"nonneg_delay_conc cs\\<^sub>2\"\n    using ParallelI2 by auto\n  ultimately have cs2: \" \\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs\\<^sub>2 \\<lbrace>R\\<rbrace>\" and cs1: \" \\<Turnstile>\\<^sub>I \\<lbrace>R\\<rbrace> cs\\<^sub>1 \\<lbrace>Q\\<rbrace>\"\n    using ParallelI2 by blast+\n  have \"conc_stmt_wf (cs\\<^sub>2 || cs\\<^sub>1)\"\n    using ParallelI2(3) unfolding conc_stmt_wf_def by auto\n  moreover have \" nonneg_delay_conc (cs\\<^sub>2 || cs\\<^sub>1) \"\n    using ParallelI2(7) by auto\n  ultimately have \"\\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs\\<^sub>2 || cs\\<^sub>1 \\<lbrace>Q\\<rbrace>\"\n    using parallelI_valid[OF cs2 cs1]   by auto\n  thus ?case\n    using world_init_exec_commute\n    by (smt ParallelI2.hyps(3) init_hoare_valid_def parallelI_comp_commute' world_init_exec.intros\n    world_init_exec_cases(2))\nnext\n  case (ConseqI P' P c Q Q')\n  then show ?case  by (smt init_hoare_valid_def)\nnext\n  case (ConjI P cs Q1 Q2)\n  hence \"\\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>Q1\\<rbrace>\" and \"\\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>Q2\\<rbrace>\"\n    by blast+\n  then show ?case\n    unfolding init_hoare_valid_def by blast\nqed\n\ndefinition wp_init :: \"'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> 'signal assn2\" where\n  \"wp_init cs Q = (\\<lambda>tw. \\<forall>tw'. (tw, cs \\<Rightarrow>\\<^sub>I tw') \\<longrightarrow> Q tw')\"\n\nlemma wp_init_single:\n  \"wp_init (process sl : ss) Q = wp ss Q\"\n  apply (rule ext)\n  unfolding wp_init_def wp_def \n  by (smt init'_cases(1) world_init_exec_cases(1) world_init_exec_process world_seq_exec.intros)\n\nlemma wp_init_parallel:\n  assumes \"conc_stmt_wf (cs1 || cs2)\" and \"nonneg_delay_conc (cs1 || cs2)\"\n  shows   \"wp_init (cs1 || cs2) Q = wp_init cs1 (wp_init cs2 Q)\"\nproof (rule ext, rule)\n  fix x\n  have \"conc_stmt_wf cs1\" and \"conc_stmt_wf cs2\"\n    using assms  by (simp add: conc_stmt_wf_def)+\n  have \"nonneg_delay_conc cs1\" and \"nonneg_delay_conc cs2\"\n    using assms by auto\n  assume \"wp_init (cs1 || cs2) Q x \"\n  hence \"(\\<forall>tw'. x , cs1 || cs2 \\<Rightarrow>\\<^sub>I tw' \\<longrightarrow> Q tw')\"\n    unfolding wp_init_def by auto\n  thus\" wp_init cs1 (wp_init cs2 Q) x\"                     \n    unfolding wp_init_def sym[OF world_init_equality[OF assms]]\n    sym[OF world_init_equality[OF `conc_stmt_wf cs1` `nonneg_delay_conc cs1`]]\n    sym[OF world_init_equality[OF `conc_stmt_wf cs2` `nonneg_delay_conc cs2`]]\n    using world_init_exec_alt.intros(2) by blast\nnext\n  fix x\n  have \"conc_stmt_wf cs1\" and \"conc_stmt_wf cs2\"\n    using assms  by (simp add: conc_stmt_wf_def)+\n  have \"nonneg_delay_conc cs1\" and \"nonneg_delay_conc cs2\"\n    using assms by auto\n  assume \"wp_init cs1 (wp_init cs2 Q) x\"\n  hence \"\\<forall>tw tw'. x , cs1 \\<Rightarrow>\\<^sub>I tw \\<and> tw , cs2 \\<Rightarrow>\\<^sub>I tw' \\<longrightarrow> Q tw'\"\n    unfolding wp_init_def by meson\n  thus \"wp_init (cs1 || cs2) Q x\"\n    unfolding wp_init_def sym[OF world_init_equality[OF assms]]\n    sym[OF world_init_equality[OF `conc_stmt_wf cs1` `nonneg_delay_conc cs1`]]\n    sym[OF world_init_equality[OF `conc_stmt_wf cs2` `nonneg_delay_conc cs2`]]\n    by (metis (mono_tags, hide_lams) \\<open>\\<And>tw. world_init_exec tw (cs1 || cs2) = world_init_exec_alt tw\n    (cs1 || cs2)\\<close> \\<open>\\<And>tw. world_init_exec tw cs1 = world_init_exec_alt tw cs1\\<close> \\<open>\\<And>tw. world_init_exec\n    tw cs2 = world_init_exec_alt tw cs2\\<close> assms(1) assms(2) init_hoare_valid_def parallelI_valid\n    wp_init_def)\nqed\n\ninductive init_sim :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\" where\n  \"     world_init_exec tw cs tw'\n   \\<Longrightarrow>  init_sim tw cs (next_time_world tw', snd tw')\"\n\ninductive_cases init_sim_cases [elim!]: \"init_sim tw cs tw'\"\n\ninductive init_sim2 :: \"nat \\<times> 'signal worldline_init \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\" where\n  \"     world_init_exec tw cs tw'\n   \\<Longrightarrow>  init_sim2 tw cs (fst tw' + 1, snd tw')\"\n\nlemma progress_for_init_sim2:\n  assumes \"init_sim tw cs tw2\"\n  shows   \"\\<exists>tw'. init_sim2 tw cs tw'\"\nproof -\n  obtain tw' where \"tw, cs \\<Rightarrow>\\<^sub>I tw'\" and \"next_time_world tw' = fst tw2\" and \"snd tw' = snd tw2\"\n    using assms  by auto\n  thus ?thesis\n    using init_sim2.intros by blast\nqed\n\ninductive_cases init_sim2_cases [elim!]: \"init_sim2 tw cs tw'\"\n\nlemma fst_init_sim2:\n  assumes \"init_sim2 tw cs tw'\"\n  shows   \"fst tw' = fst tw + 1\"\n  using init_sim2_cases[OF assms] fst_world_init_exec\n  by (metis Suc_eq_plus1 fst_conv)\n\nlemma init_sim2_unaffected:\n  assumes \"init_sim2 tw cs tw'\"\n  assumes \"sig \\<notin> set (signals_from cs)\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"\\<And>k. wline_of tw sig k = wline_of tw' sig k\"\nproof (rule init_sim2_cases[OF assms(1)])\n  fix k tw2\n  assume \"tw' = (Suc (fst tw2), snd tw2)\" and \"tw, cs \\<Rightarrow>\\<^sub>I tw2\"\n  hence \"world_init_exec_alt tw cs tw2\"\n    using assms(3-4)  by (simp add: world_init_exec_imp_world_init_exec_alt)\n  thus \"wline_of tw sig k = wline_of tw' sig k\"\n    using world_init_exec_alt_unaffected \n    by (metis \\<open>tw' = (Suc (get_time tw2), snd tw2)\\<close> assms(2) assms(3) comp_def snd_conv)\nqed\n\ndefinition init_sim_valid :: \"'signal assn2 \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\" where\n  \"init_sim_valid P cs Q = (\\<forall>tw tw'. P tw \\<and> init_sim tw cs tw' \\<longrightarrow> Q tw')\"\n\ndefinition init_sim2_valid :: \"'signal assn2 \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\" where\n  \"init_sim2_valid P cs Q = (\\<forall>tw tw'. P tw \\<and> init_sim2 tw cs tw' \\<longrightarrow> Q tw')\"\n\ninductive\n  init_sim_hoare :: \"'signal assn2 \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\" where\nAssignI: \"\\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>\\<lambda>tw. Q (next_time_world tw, snd tw)\\<rbrace>  \\<Longrightarrow> init_sim_hoare P cs Q\" |\nConseqI_sim: \"\\<forall>tw. P' tw \\<longrightarrow> P tw \\<Longrightarrow> init_sim_hoare P cs Q \\<Longrightarrow> \\<forall>tw. Q tw \\<longrightarrow> Q' tw \\<Longrightarrow> init_sim_hoare P' cs Q'\" |\nConjI_sim: \"init_sim_hoare P cs Q1 \\<Longrightarrow> init_sim_hoare P cs Q2 \\<Longrightarrow> init_sim_hoare P cs (\\<lambda>tw. Q1 tw \\<and> Q2 tw)\"\n\ninductive\n  init_sim2_hoare :: \"'signal assn2 \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> 'signal assn2 \\<Rightarrow> bool\" where\nAssignI_suc: \"\\<turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>\\<lambda>tw. Q (fst tw + 1, snd tw)\\<rbrace>  \\<Longrightarrow> init_sim2_hoare P cs Q\" |\nConseqI_suc_sim: \"\\<forall>tw. P' tw \\<longrightarrow> P tw \\<Longrightarrow> init_sim2_hoare P cs Q \\<Longrightarrow> \\<forall>tw. Q tw \\<longrightarrow> Q' tw \\<Longrightarrow> init_sim2_hoare P' cs Q'\" |\nConjI_suc_sim: \"init_sim2_hoare P cs Q1 \\<Longrightarrow> init_sim2_hoare P cs Q2 \\<Longrightarrow> init_sim2_hoare P cs (\\<lambda>tw. Q1 tw \\<and> Q2 tw)\"\n\nlemma  strengthen_precondition_init_sim_hoare:\n  assumes \"\\<forall>w. P' w \\<longrightarrow> P w\" and \"init_sim_hoare P s Q\"\n  shows \"init_sim_hoare P' s Q\"\n  using assms by (blast intro: ConseqI_sim)\n\nlemma  strengthen_precondition_init_sim_hoare_suc:\n  assumes \"\\<forall>w. P' w \\<longrightarrow> P w\" and \"init_sim2_hoare P s Q\"\n  shows \"init_sim2_hoare P' s Q\"\n  using assms by (blast intro: ConseqI_suc_sim)\n\nlemma init_sim_hoare_soundness:\n  assumes \"init_sim_hoare P cs Q\"\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows \"init_sim_valid P cs Q\"\n  using assms\nproof (induction rule:init_sim_hoare.induct)\n  case (AssignI P cs Q)\n  have *: \"\\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>\\<lambda>tw. Q (next_time_world tw, snd tw)\\<rbrace>\"\n    using soundness_init_hoare[OF AssignI] by auto\n  { fix tw tw'\n    assume \"P tw\"\n    assume \"tw, cs \\<Rightarrow>\\<^sub>I tw'\"\n    hence \"Q (next_time_world tw', snd tw')\" (is ?imp1)\n      using * \\<open>P tw\\<close> unfolding init_hoare_valid_def by blast\n    have \"init_sim tw cs (next_time_world tw', snd tw')\" (is ?imp2)\n      using \\<open>tw, cs \\<Rightarrow>\\<^sub>I tw'\\<close>  by (simp add: init_sim.intros)\n    hence \"?imp1 \\<and> ?imp2\"\n      using \\<open>?imp1\\<close> by auto }\n  then show ?case\n    unfolding init_sim_valid_def by blast\nnext\n  case (ConseqI_sim P' P cs Q Q')\n  then show ?case\n    by (smt init_sim_valid_def)\nnext\n  case (ConjI_sim P cs Q1 Q2)\n  then show ?case  by (simp add: init_sim_valid_def)\nqed\n\nlemma init_sim2_hoare_soundness:\n  assumes \"init_sim2_hoare P cs Q\"\n  assumes \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows \"init_sim2_valid P cs Q\"\n  using assms\nproof (induction rule:init_sim2_hoare.induct)\n  case (AssignI_suc P cs Q)\n  have *: \"\\<Turnstile>\\<^sub>I \\<lbrace>P\\<rbrace> cs \\<lbrace>\\<lambda>tw. Q (fst tw + 1, snd tw)\\<rbrace>\"\n    using soundness_init_hoare[OF AssignI_suc] by auto\n  { fix tw tw'\n    assume \"P tw\"\n    assume \"tw, cs \\<Rightarrow>\\<^sub>I tw'\"\n    hence \"Q (fst tw' + 1, snd tw')\" (is ?imp1)\n      using * \\<open>P tw\\<close> unfolding init_hoare_valid_def by blast\n    have \"init_sim2 tw cs (fst tw' + 1, snd tw')\" (is ?imp2)\n      using \\<open>tw, cs \\<Rightarrow>\\<^sub>I tw'\\<close>   using init_sim2.intros by blast\n    hence \"?imp1 \\<and> ?imp2\"\n      using \\<open>?imp1\\<close> by auto }\n  then show ?case\n    unfolding init_sim2_valid_def by auto\nnext\n  case (ConseqI_suc_sim P' P cs Q Q')\n  then show ?case\n    by (smt init_sim2_valid_def)\nnext\n  case (ConjI_suc_sim P cs Q1 Q2)\n  then show ?case  by (simp add: init_sim2_valid_def)\nqed\n\nsubsection \\<open>Complete simulation = @{term \"init_sim\"} + @{term \"world_sim_fin\"}\\<close>\n\ninductive sim_fin :: \"'signal worldline_init \\<Rightarrow> nat \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\"\n  where\n  \"init_sim (0, w) cs tw  \\<Longrightarrow> tw, T, cs \\<Rightarrow>\\<^sub>S tw' \\<Longrightarrow> sim_fin w T cs tw'\"\n\ninductive_cases sim_fin_ic: \"sim_fin w T cs tw'\"\n\ninductive sim_fin2 :: \"'signal worldline_init \\<Rightarrow> nat \\<Rightarrow> 'signal conc_stmt \\<Rightarrow> nat \\<times> 'signal worldline_init \\<Rightarrow> bool\"\n  where\n  \"init_sim2 (0, w) cs tw  \\<Longrightarrow> tw, T, cs \\<Rightarrow>\\<^sub>S tw' \\<Longrightarrow> sim_fin2 w T cs tw'\"\n\ninductive_cases sim_fin2_ic: \"sim_fin2 w T cs tw'\"\n\nlemma fst_time_sim_fin2:\n  assumes \"sim_fin2 w T cs tw'\" shows   \"fst tw' = T\"\n  using assms world_maxtime_lt_fst_tres\n  by (induction rule: sim_fin2.inducts) blast\n\nlemma world_sim_fin2_alt_start_earlier:\n  assumes \"world_sim_fin2_alt (next_time_world tw_init, snd tw_init) T cs tw1\"\n  shows   \"world_sim_fin2_alt (fst tw_init + 1, snd tw_init) T cs tw1\"\n  using assms\nproof (induction \"T - (fst tw_init + 1)\" arbitrary: tw_init)\n  case 0\n  hence \"fst tw_init + 1 = T\" \n    by (metis One_nat_def Suc_eq_plus1 ab_semigroup_add_class.add_ac(1) discrete fst_conv\n    le_add_diff_inverse less_numeral_extra(3) less_trans_Suc next_time_world_at_least plus_1_eq_Suc\n    world_sim_fin2_alt.cases zero_less_diff)\n  then show ?case \n    by (metis \"0.prems\" Suc_eq_plus1 fst_conv less_not_refl2 less_trans_Suc next_time_world_at_least\n    world_sim_fin2_alt.simps)\nnext\n  case (Suc x) hence \"x = T - (fst tw_init + 2)\" and \"fst tw_init + 1 < T\" by linarith+\n  have \"fst tw_init + 1 = next_time_world tw_init \\<or> fst tw_init + 1 < next_time_world tw_init\"\n    using next_time_world_at_least Suc_lessI by fastforce\n  moreover\n  { assume \"fst tw_init + 1 = next_time_world tw_init\"\n    hence ?case\n      using Suc by fastforce }\n  moreover\n  { assume \"fst tw_init + 1 < next_time_world tw_init\"\n    hence der: \"derivative_raw (snd tw_init) (get_time tw_init) \\<noteq>  0\"\n      using less_not_refl2 next_time_world_alt_def2 by blast\n    hence empty: \"event_of (fst tw_init + 1, snd tw_init) = {}\"\n      using unchanged_until_next_time_world `fst tw_init + 1 < next_time_world tw_init`\n      unfolding event_of_alt_def \n      by (smt add_diff_cancel_right' add_is_0 comp_apply empty_Collect_eq fst_conv le_add1 nat_less_le snd_conv zero_less_one)\n    hence conc: \"world_conc_exec_alt (get_time tw_init + 1, snd tw_init) cs (get_time tw_init + 1, snd tw_init)\"\n      using empty_event_world_conc_exec_alt by blast\n    let ?tw = \"(fst tw_init + 1, snd tw_init)\"\n    have *: \"next_time_world tw_init = (LEAST n. get_time tw_init \\<le> n \\<and> (\\<lambda>s. wline_of tw_init s (get_time tw_init)) \\<noteq> (\\<lambda>s. wline_of tw_init s n))\"\n      using next_time_world_alt_def1[OF der] by auto\n    have exist: \"\\<exists>n\\<ge>get_time tw_init. (\\<lambda>s. wline_of tw_init s (get_time tw_init)) \\<noteq> (\\<lambda>s. wline_of tw_init s n)\"\n      using der unfolding derivative_raw_alt_def by auto\n    have \"\\<exists>s. wline_of tw_init s (fst tw_init) \\<noteq> wline_of tw_init s (next_time_world tw_init)\"\n      using LeastI_ex[OF exist] unfolding *[THEN sym] by auto\n    moreover have \"\\<forall>s. wline_of tw_init s (fst tw_init) = wline_of tw_init s (next_time_world tw_init - 1)\"\n      using not_less_Least *\n      by (metis (mono_tags, lifting) \\<open>get_time tw_init + 1 < next_time_world tw_init\\<close> add_gr_0\n      diff_less dual_order.strict_trans less_diff_conv less_le unchanged_until_next_time_world\n      zero_less_one)\n    ultimately have \"\\<exists>s. wline_of tw_init s (next_time_world tw_init - 1) \\<noteq> wline_of tw_init s (next_time_world tw_init)\"\n      by auto\n    have \"\\<exists>n\\<ge>get_time tw_init + 1.\n           (\\<lambda>s. wline_of tw_init s (get_time tw_init + 1)) \\<noteq> (\\<lambda>s. wline_of tw_init s n)\"\n      by (metis Suc_eq_plus1 \\<open>\\<exists>s. wline_of tw_init s (next_time_world tw_init - 1) \\<noteq> wline_of\n      tw_init s (next_time_world tw_init)\\<close> \\<open>\\<forall>s. wline_of tw_init s (get_time tw_init) = wline_of\n      tw_init s (next_time_world tw_init - 1)\\<close> \\<open>get_time tw_init + 1 < next_time_world tw_init\\<close>\n      le_add2 nat_less_le plus_1_eq_Suc unchanged_until_next_time_world)\n    hence \"next_time_world ?tw = (LEAST n. get_time tw_init + 1 \\<le> n \\<and> (\\<lambda>s. wline_of tw_init s (get_time tw_init + 1)) \\<noteq> (\\<lambda>s. wline_of tw_init s n))\"\n      unfolding next_time_world_alt_def Let_def by auto\n    also have  \"... =  next_time_world tw_init\"\n    proof (rule Least_equality)\n      show \"get_time tw_init + 1 \\<le> next_time_world tw_init \\<and> (\\<lambda>s. wline_of tw_init s (get_time tw_init + 1)) \\<noteq> (\\<lambda>s. wline_of tw_init s (next_time_world tw_init))\"\n        by (metis \\<open>\\<exists>s. wline_of tw_init s (next_time_world tw_init - 1) \\<noteq> wline_of tw_init s\n        (next_time_world tw_init)\\<close> \\<open>\\<forall>s. wline_of tw_init s (get_time tw_init) = wline_of tw_init s\n        (next_time_world tw_init - 1)\\<close> \\<open>get_time tw_init + 1 < next_time_world tw_init\\<close> le_add1\n        nat_less_le unchanged_until_next_time_world)\n    next\n      fix y\n      assume \"get_time tw_init + 1 \\<le> y \\<and> (\\<lambda>s. wline_of tw_init s (get_time tw_init + 1)) \\<noteq> (\\<lambda>s. wline_of tw_init s y)\"\n      thus \"next_time_world tw_init \\<le> y\"\n        by (metis (no_types, hide_lams) \\<open>get_time tw_init + 1 < next_time_world tw_init\\<close> discrete\n        nat_less_le not_less unchanged_until_next_time_world)\n    qed\n    finally have \"next_time_world ?tw = next_time_world tw_init\"\n      by auto\n    hence \"world_sim_fin2_alt (next_time_world ?tw, snd ?tw) T cs tw1\"\n      using Suc(3) by auto\n    have \"x = T - (fst ?tw + 1)\" using Suc  by simp\n    note IH = Suc(1)[OF this `world_sim_fin2_alt (next_time_world ?tw, snd ?tw) T cs tw1`]\n    hence ?case\n      using `fst tw_init + 1 < T` conc\n      by (metis snd_conv snd_swap swap_simp world_sim_fin2_alt.intros(1)) }\n  ultimately show ?case by auto\nqed\n \nlemma progress_for_sim_fin2:\n  assumes \"sim_fin w T cs tw1\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"\\<exists>tw'. sim_fin2 w T cs tw'\"\nproof -\n  obtain tw where \"init_sim (0, w) cs tw\" and \"tw, T, cs \\<Rightarrow>\\<^sub>S tw1\"\n    using assms sim_fin_ic by blast\n  then obtain tw_init where \"world_init_exec (0, w) cs tw_init\" and \"fst tw = next_time_world tw_init\" and \"snd tw = snd tw_init\"\n    by auto\n  obtain tw' where \"init_sim2 (0, w) cs tw'\"\n    using progress_for_init_sim2[OF `init_sim (0, w) cs tw`] by metis\n  have * : \"fst tw' = fst tw_init + 1 \\<and> snd tw' = snd tw_init\"\n    apply (rule init_sim2_cases[OF `init_sim2 (0, w) cs tw'`])\n    using `(0, w), cs \\<Rightarrow>\\<^sub>I tw_init` world_init_exec_deterministic \n    by (metis Suc_eq_plus1 fst_conv snd_conv)\n  hence \"fst tw' \\<le> fst tw\" and \"snd tw' = snd tw\"\n    by (metis \\<open>get_time tw = next_time_world tw_init\\<close> discrete next_time_world_at_least)\n       (simp add: \\<open>get_time tw' = get_time tw_init + 1 \\<and> snd tw' = snd tw_init\\<close> \\<open>snd tw = snd tw_init\\<close>)\n  have \"world_sim_fin2_alt (next_time_world tw_init, snd tw_init) T cs tw1\"\n    using `tw, T, cs \\<Rightarrow>\\<^sub>S tw1` \n    by (metis \\<open>get_time tw = next_time_world tw_init\\<close> \\<open>snd tw = snd tw_init\\<close> assms(2) assms(3)\n        prod.exhaust_sel world_sim_fin2_imp_world_sim_fin2_alt world_sim_fin_imp_fin2)\n  hence \"\\<exists>tw_res. world_sim_fin2_alt (fst tw_init + 1, snd tw_init) T cs tw_res\"\n    using world_sim_fin2_alt_start_earlier by blast\n  hence \"\\<exists>tw_res. world_sim_fin2 (fst tw_init + 1, snd tw_init) T cs tw_res\"\n    using assms(2) assms(3) world_sim_fin2_alt_progress by blast\n  then obtain tw_res where \"(fst tw_init + 1, snd tw_init), T, cs \\<Rightarrow>\\<^sub>S tw_res\"\n    using world_sim_fin2_imp_fin  using assms(2) assms(3) by blast\n  thus ?thesis\n    using `init_sim2 (0, w) cs tw' ` * \n    by (metis prod.exhaust_sel sim_fin2.intros)\nqed\n\nlemma sim_fin_eq_sim_fin2:\n  assumes \"sim_fin  w T cs tw1\"\n  assumes \"sim_fin2 w T cs tw2\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"tw1 = tw2\"\n  using assms\nproof - \n  obtain tw1_mid where \"init_sim (0, w) cs tw1_mid\" and \"tw1_mid, T, cs \\<Rightarrow>\\<^sub>S tw1\"\n    using sim_fin_ic[OF assms(1)] by blast\n  obtain tw2_mid where \"init_sim2 (0, w) cs tw2_mid\" and \"tw2_mid, T, cs \\<Rightarrow>\\<^sub>S tw2\"\n    using sim_fin2_ic[OF assms(2)] by blast\n  obtain tw_exec where \"world_init_exec (0, w) cs tw_exec\" and \"fst tw1_mid = next_time_world tw_exec\"\n    and \"fst tw2_mid = fst tw_exec + 1\" and \"snd tw1_mid = snd tw_exec\" and \"snd tw2_mid = snd tw_exec\"\n    using init_sim_cases[OF `init_sim (0, w) cs tw1_mid`] init_sim2_cases[OF `init_sim2 (0, w) cs tw2_mid`]\n    by (metis (no_types, hide_lams) Suc_eq_plus1 fst_conv snd_conv world_init_exec_deterministic)\n  hence \"world_sim_fin2_alt (next_time_world tw_exec, snd tw_exec)  T cs tw1\"\n    using `tw1_mid, T, cs \\<Rightarrow>\\<^sub>S tw1`\n    by (metis assms(3) assms(4) prod.exhaust_sel world_sim_fin2_imp_world_sim_fin2_alt world_sim_fin_imp_fin2) \n  moreover have \"world_sim_fin2_alt (fst tw_exec + 1, snd tw_exec) T cs tw2\"\n    using `tw2_mid, T, cs \\<Rightarrow>\\<^sub>S tw2` \n    by (metis \\<open>get_time tw2_mid = get_time tw_exec + 1\\<close> \\<open>snd tw2_mid = snd tw_exec\\<close> assms(3)\n    assms(4) prod.exhaust_sel world_sim_fin2_imp_world_sim_fin2_alt world_sim_fin_imp_fin2)\n  ultimately show ?thesis\n    using  world_sim_fin2_alt_start_earlier \n    using assms(3) assms(4) world_sim_fin2_alt_semi_det world_simp_fin2_alt_imp_world_sim_fin2 by\n    blast\nqed\n\nlemma sim_fin_imp_sim_fin2:\n  assumes \"sim_fin w T cs tw\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"sim_fin2 w T cs tw\"  \n  using progress_for_sim_fin2[OF assms] sim_fin_eq_sim_fin2[OF assms(1) _ assms(2-3)]\n  by auto\n\nlemma split_sim_fin2:\n  assumes \"sim_fin2 w T cs tw''\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  assumes \"0 < t\" and \"t < T\"\n  shows   \"\\<exists>tw'. sim_fin2 w t cs tw' \\<and> tw', T, cs \\<Rightarrow>\\<^sub>S tw''\"\nproof -\n  obtain tw where \"init_sim2 (0, w) cs tw \" and \" tw, T, cs \\<Rightarrow>\\<^sub>S tw''\"\n    using assms(1)  by (meson sim_fin2.cases)\n  have \"fst tw = 1\"\n    by (rule init_sim2_cases[OF `init_sim2 (0, w) cs tw`])(simp add: fst_world_init_exec)\n  hence \"fst tw \\<le> t\"\n    using `0 < t` by auto\n  have \"world_sim_fin2 tw T cs tw''\"\n    using `tw, T, cs \\<Rightarrow>\\<^sub>S tw''` assms  by (metis world_sim_fin_imp_fin2)\n  hence \"world_sim_fin2_alt tw T cs tw''\"\n    by (simp add: assms(2) assms(3) world_sim_fin2_imp_world_sim_fin2_alt)\n  then obtain tw2 where \"world_sim_fin2_alt tw t cs tw2\" and \"world_sim_fin2_alt tw2 T cs tw''\"\n    using split_world_sim_fin2_alt \n    by (metis \\<open>get_time tw \\<le> t\\<close> assms(5) nat_less_le world_sim_fin2_alt.simps)\n  hence \"sim_fin2 w t cs tw2\"\n    by (metis \\<open>init_sim2 (0, w) cs tw\\<close> assms(2) assms(3) sim_fin2.intros world_sim_fin2_alt_progress\n    world_sim_fin2_alt_semi_det world_sim_fin2_imp_fin world_sim_fin_imp_fin2)\n  moreover have \"tw2, T, cs \\<Rightarrow>\\<^sub>S tw''\"\n    using \\<open>world_sim_fin2_alt tw2 T cs tw''\\<close> assms(2) assms(3) world_sim_fin2_alt_progress\n    world_sim_fin2_alt_semi_det world_sim_fin2_imp_fin world_sim_fin_semi_equivalent by blast\n  ultimately show ?thesis\n    by blast\nqed  \n\nlemma premises_sim_fin:\n  assumes \"sim_fin w T cs tw'\"\n  shows \"\\<exists>tw. init_sim (0, w) cs tw \\<and> tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\n  using sim_fin_ic[OF assms(1)]  by metis\n\nlemma premises_sim_fin_obt:\n  assumes \"sim_fin w T cs tw'\"\n  obtains tw where \"init_sim (0, w) cs tw\" and \"tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\n  using premises_sim_fin[OF assms] by metis\n\nlemma sim_fin2_unaffected:\n  assumes \"sim_fin2 w T cs tw'\"\n  assumes \"sig \\<notin> set (signals_from cs)\"\n  assumes \"nonneg_delay_conc cs\" and \"conc_stmt_wf cs\"\n  shows   \"\\<And>k. wline_of (0, w) sig k = wline_of tw' sig k\"\nproof (rule sim_fin2_ic[OF assms(1)])\n  fix k tw\n  assume \"init_sim2 (0, w) cs tw\"\n  hence *: \"\\<And>k. wline_of (0, w) sig k = wline_of tw sig k\"\n    using init_sim2_unaffected assms by metis\n  assume \"tw, T, cs \\<Rightarrow>\\<^sub>S tw'\"\n  hence \"world_sim_fin2_alt tw T cs tw'\"\n    by (simp add: assms(3) assms(4) world_sim_fin2_imp_world_sim_fin2_alt world_sim_fin_imp_fin2)\n  hence \"\\<And>k. wline_of tw sig k = wline_of tw' sig k\"\n    using world_sim_fin2_alt_unaffected  by (metis assms(2) assms(3) assms(4))\n  thus \"wline_of (0, w) sig k = wline_of tw' sig k\"\n    using * by auto\nqed\n\nsubsection \\<open>The notion of typing for a worldline\\<close>\n\ndefinition wtyping :: \"'a tyenv \\<Rightarrow> 'a worldline \\<Rightarrow> bool\" where\n  \"wtyping \\<Gamma> w \\<equiv> (\\<forall>s t. type_of (w s t) = \\<Gamma> s)\"\n\ndefinition wityping :: \"'a tyenv \\<Rightarrow> 'a worldline_init \\<Rightarrow> bool\" where\n  \"wityping \\<Gamma> wi \\<equiv> styping \\<Gamma> (fst wi) \\<and> wtyping \\<Gamma> (snd wi)\"\n\nlemma wityping_ensure_styping:\n  \"wityping \\<Gamma> wi \\<Longrightarrow> styping \\<Gamma> (state_of_world wi t)\"\n  by (simp add: state_of_world_def styping_def wityping_def wtyping_def)\n\nlemma wityping_ensure_ttyping:\n  \"wityping \\<Gamma> wi \\<Longrightarrow> ttyping \\<Gamma> (derivative_hist_raw wi t)\"\n  by (simp add: derivative_hist_raw_def difference_raw_alt_def domIff wityping_def ttyping_def wtyping_def)\n\nlemma wityping_ensure_ttyping2:\n  \"wityping \\<Gamma> wi \\<Longrightarrow> ttyping \\<Gamma> (derivative_raw wi t)\"\n  by (auto simp add: derivative_raw_def difference_raw_alt_def Let_def domIff wityping_def ttyping_def wtyping_def)\n\nlemma worldline_upd_preserve_wityping:\n  assumes \"wityping \\<Gamma> wi\"\n  assumes \"type_of v = \\<Gamma> sig\"\n  shows   \"wityping \\<Gamma> (wi[ sig, t := v])\"\n  using assms  by (simp add: wityping_def worldline_upd_def wtyping_def)\n\nlemma worldline_inert_upd_preserve_wityping:\n  assumes \"wityping \\<Gamma> wi\"\n  assumes \"type_of v = \\<Gamma> sig\"\n  shows   \"wityping \\<Gamma> (wi[ sig, t, dly := v])\"\n  using assms unfolding wityping_def worldline_inert_upd_def wtyping_def by simp\n\nlemma worldline_inert_upd_preserve_wityping':\n  assumes \"wityping \\<Gamma> wi\"\n  assumes \"type_of v = \\<Gamma> sig\"\n  shows   \"wityping \\<Gamma> (VHDL_Hoare.worldline_inert_upd2 wi sig t dly v)\"\n  using assms\nproof (induction v)\n  case (Bv x)\n  then show ?case \n    unfolding wityping_def worldline_inert_upd2.simps worldline_inert_upd_def wtyping_def by auto\nnext\n  case (Lv x1a x2)\n  then show ?case \n    unfolding wityping_def worldline_inert_upd2.simps worldline_inert_upd_def wtyping_def by auto\nqed\n  \nlemma seq_stmt_preserve_wityping_hoare:\n  assumes \"seq_wt \\<Gamma> ss\"\n  shows \" \\<turnstile> [\\<lambda>tw. wityping \\<Gamma> (snd tw) ] ss [\\<lambda>tw. wityping \\<Gamma> (snd tw)]\"\n  using assms\nproof (induction rule:seq_wt.inducts)\n  case (1 \\<Gamma>)\n  then show ?case by (intro Null2)\nnext\n  case (2 \\<Gamma> s1 s2)\n  then show ?case by (auto)\nnext\n  case (3 \\<Gamma> g s1 s2)\n  then show ?case\n    by (intro If2) (rule strengthen_precondition, simp)+\nnext\n  case (4 \\<Gamma> exp sig dly)\n  hence \"\\<forall>tw x.   wityping \\<Gamma> (snd tw) \\<and> beval_world_raw2 tw exp x \\<longrightarrow> type_of x = \\<Gamma> sig\"\n    by (metis beval_raw_preserve_well_typedness beval_world_raw2_def beval_world_raw_cases\n    wityping_def wityping_ensure_styping wityping_ensure_ttyping)\n  then show ?case\n    by (intro Assign2_altI)\n       (simp add: worldline_upd_preserve_wityping worldline_upd2_def)\nnext\n  case (5 \\<Gamma> exp sig dly)\n  hence \"\\<forall>tw x.   wityping \\<Gamma> (snd tw) \\<and> beval_world_raw2 tw exp x \\<longrightarrow> type_of x = \\<Gamma> sig\"\n    by (metis beval_raw_preserve_well_typedness beval_world_raw2_def beval_world_raw_cases\n    wityping_def wityping_ensure_styping wityping_ensure_ttyping)\n  then show ?case\n    by (intro AssignI2_altI)\n       (simp add: worldline_inert_upd_preserve_wityping' worldline_inert_upd2_def)\nnext\n  case (6 \\<Gamma> exp ty)\n  then show ?case by simp\nnext\n  case (7 \\<Gamma> exp ty ss choices)\n  then show ?case by blast\nnext\n  case (8 \\<Gamma> exp ty exp' ss choices)\n  then show ?case\n    by (simp add: strengthen_precondition)\nqed\n\nlemma single_conc_stmt_preserve_wityping_hoare:\n  assumes \"seq_wt \\<Gamma> ss\"\n  shows \" \\<turnstile> \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw) \\<rbrace> process sl : ss \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (intro Single)\n   apply (rule strengthen_precondition)\n   apply (rule seq_stmt_preserve_wityping_hoare)\n  using assms conc_wt.cases apply fastforce\n  by blast\n\nlemma single_conc_stmt_preserve_wityping_init_hoare:\n  assumes \"seq_wt \\<Gamma> ss\"\n  shows \"\\<turnstile>\\<^sub>I \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>  process sl : ss \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (intro SingleI)\n  apply (rule seq_stmt_preserve_wityping_hoare)\n  using assms conc_wt.cases apply fastforce\n  done\n\nlemma conc_stmt_preserve_wityping_hoare:\n  assumes \"conc_wt \\<Gamma> cs\" and \"conc_stmt_wf cs\"\n  shows \" \\<turnstile> \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace> cs \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  using assms\nproof (induction rule: conc_wt.inducts)\n  case (1 \\<Gamma> ss sl)\n  then show ?case \n    using single_conc_stmt_preserve_wityping_hoare  by blast\nnext\n  case (2 \\<Gamma> cs1 cs2)\n  show ?case \n    apply (rule Parallel[OF 2(3) 2(4)])\n    using 2  by (simp add: conc_stmt_wf_def)+\nqed\n\nlemma conc_stmt_preserve_wityping_hoare_semantic:\n  assumes \"conc_wt \\<Gamma> cs\" and \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows \" \\<Turnstile> \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace> cs \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  using soundness_conc_hoare[OF conc_stmt_preserve_wityping_hoare] assms by blast\n\nlemma init_preserve_wityping:\n  assumes \"conc_wt \\<Gamma> cs\" and \"conc_stmt_wf cs\"\n  shows \"\\<turnstile>\\<^sub>I \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>  cs \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  using assms\nproof (induction rule:conc_wt.inducts)\n  case (1 \\<Gamma> ss sl)\n  then show ?case \n    using single_conc_stmt_preserve_wityping_init_hoare by auto\nnext\n  case (2 \\<Gamma> cs1 cs2)\n  show ?case \n    apply (rule ParallelI[OF 2(3) 2(4)])\n    using 2 by (simp add: conc_stmt_wf_def)+\nqed\n\nlemma init_preserve_wityping_semantic:\n  assumes \"conc_wt \\<Gamma> cs\" and \"conc_stmt_wf cs\" and \"nonneg_delay_conc cs\"\n  shows \"\\<Turnstile>\\<^sub>I \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>  cs \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  using soundness_init_hoare[OF init_preserve_wityping[OF assms(1-2)] assms(2-3)] by auto\n\nlemma single_conc_stmt_preserve_wityping_init_sim_hoare:\n  assumes \"seq_wt \\<Gamma> ss\"\n  shows \"init_sim_hoare (\\<lambda>tw. wityping \\<Gamma> (snd tw)) (process sl : ss) (\\<lambda>tw. wityping \\<Gamma> (snd tw))\"\n  apply (intro AssignI)\n  unfolding snd_conv apply (rule single_conc_stmt_preserve_wityping_init_hoare)\n  apply (rule assms)\n  done\n\nend", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/VHDL_Hoare_Complete.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.3181641099207703}}
{"text": "(*  Title:      HOL/Auth/n_moesi_lemma_inv__1_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_moesi Protocol Case Study*} \n\ntheory n_moesi_lemma_inv__1_on_rules imports n_moesi_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__1  p__Inv0 p__Inv2)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rule_t1  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rule_t2 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rul_t3 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rul_t4 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rul_t5 N i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rule_t1  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rule_t1Vsinv__1) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rule_t2 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rule_t2Vsinv__1) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rul_t3 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rul_t3Vsinv__1) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rul_t4 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rul_t4Vsinv__1) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rul_t5 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rul_t5Vsinv__1) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/moesi/n_moesi_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6959583250334526, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.318148103754555}}
{"text": "theory Impl_List_Playground_ChairNetwork_statefulpolicy_example\nimports \"../TopoS_Impl\"\nbegin\n\n\ntext{*An example of our chair network [simplified]*}\n\nabbreviation \"V\\<equiv>TopoS_Vertices.V\"\n\ntext{*Our access control view on the network*}\n  definition ChairNetwork_empty :: \"vString list_graph\" where\n    \"ChairNetwork_empty \\<equiv> \\<lparr> nodesL = [V ''WebSrv'', V ''FilesSrv'', V ''Printer'',\n                                V ''Students'',\n                                V ''Employees'',\n                                V ''Internet''],\n                      edgesL = [] \\<rparr>\"\n  \n  lemma \"valid_list_graph ChairNetwork_empty\" by eval\n\n\nsubsection{*Our security requirements*}\n  subsubsection{*We have a server with confidential data*}\n    definition ConfidentialChairData::\"(vString SecurityInvariant)\" where\n      \"ConfidentialChairData \\<equiv> new_configured_list_SecurityInvariant SINVAR_BLPtrusted_impl.SINVAR_LIB_BLPtrusted \\<lparr> \n          node_properties = [V ''FilesSrv'' \\<mapsto> \\<lparr> privacy_level = 1, trusted = False \\<rparr>,\n                             V ''Employees'' \\<mapsto> \\<lparr> privacy_level = 0, trusted = True \\<rparr>], \n          model_global_properties = () \n          \\<rparr>\"\n\n\n  subsubsection{* accessibly by employees and students*}\n    definition \"PrintingACL \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\<lparr> \n          node_properties = [V ''Printer'' \\<mapsto> Master [V ''Employees'', V ''Students''],\n                             V ''Employees'' \\<mapsto> Care,\n                             V ''Students'' \\<mapsto> Care], \n          model_global_properties = () \n          \\<rparr>\"\n\n  subsubsection{* Printers are information sinks *}\n    definition \"PrintingSink \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_Sink \\<lparr> \n          node_properties = [V ''Printer'' \\<mapsto> Sink], \n          model_global_properties = () \n          \\<rparr>\"\n\n\n\n  subsubsection{*Students and Employees may access each other but are not accessible from the outside*}\n    definition \"InternalSubnet \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_SubnetsInGW \\<lparr> \n          node_properties = [V ''Students'' \\<mapsto> Member, V ''Employees'' \\<mapsto> Member], \n          model_global_properties = () \n          \\<rparr>\"\n\n\n  subsubsection{* The files server is only accessibly by employees*}\n    definition \"FilesSrcACL \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\<lparr> \n          node_properties = [V ''FilesSrv'' \\<mapsto> Master [V ''Employees''],\n                             V ''Employees'' \\<mapsto> Care], \n          model_global_properties = () \n          \\<rparr>\"\n\n\ndefinition \"ChairSecurityRequirements = [ConfidentialChairData, PrintingACL, PrintingSink, InternalSubnet, FilesSrcACL]\"\n\nlemma \"\\<forall>m \\<in> set ChairSecurityRequirements. implc_sinvar m ChairNetwork_empty\" by eval\n\nvalue \"implc_get_offending_flows ChairSecurityRequirements ChairNetwork_empty\"\nvalue \"generate_valid_topology ChairSecurityRequirements ChairNetwork_empty\"\n\nvalue \"List.product (nodesL ChairNetwork_empty) (nodesL ChairNetwork_empty)\"\n\ndefinition \"ChairNetwork = generate_valid_topology ChairSecurityRequirements \n      \\<lparr>nodesL = nodesL ChairNetwork_empty, edgesL = List.product (nodesL ChairNetwork_empty) (nodesL ChairNetwork_empty) \\<rparr>\"\n\nvalue \"ChairNetwork\"\n\n\nML{*\nvizualize_graph @{context} @{term \"ChairSecurityRequirements\"} @{term \"ChairNetwork\"};\n*}\n\n\ndefinition \"ChairNetwork_stateful_IFS = \\<lparr> hostsL = nodesL ChairNetwork, flows_fixL = edgesL ChairNetwork, flows_stateL = filter_IFS_no_violations ChairNetwork ChairSecurityRequirements \\<rparr>\"\nvalue \"edgesL ChairNetwork\"\nvalue \"filter_IFS_no_violations ChairNetwork ChairSecurityRequirements\"\nvalue \"ChairNetwork_stateful_IFS\"\nlemma \"set (flows_stateL ChairNetwork_stateful_IFS) \\<subseteq> (set (flows_fixL ChairNetwork_stateful_IFS))\" by eval (*must always hold*)\nvalue \"(set (flows_fixL ChairNetwork_stateful_IFS)) - set (flows_stateL ChairNetwork_stateful_IFS)\"\n(*only problems: printers!!!*)\nvalue \"stateful_list_policy_to_list_graph ChairNetwork_stateful_IFS\"\nlemma \"set (filter_IFS_no_violations ChairNetwork [ConfidentialChairData]) = set (edgesL ChairNetwork)\" by eval\n\ndefinition \"ChairNetwork_stateful_ACS = \\<lparr> hostsL = nodesL ChairNetwork, flows_fixL = edgesL ChairNetwork, flows_stateL = filter_compliant_stateful_ACS ChairNetwork ChairSecurityRequirements \\<rparr>\"\nvalue \"edgesL ChairNetwork\"\nvalue \"filter_compliant_stateful_ACS ChairNetwork ChairSecurityRequirements\"\nvalue \"ChairNetwork_stateful_ACS\"\nlemma \"set (flows_stateL ChairNetwork_stateful_ACS) \\<subseteq> (set (flows_fixL ChairNetwork_stateful_ACS))\" by eval (*must always hold*)\nvalue \"(set (flows_fixL ChairNetwork_stateful_ACS)) - set (flows_stateL ChairNetwork_stateful_ACS)\"\n\n(*flows that are already allowed in both directions are not marked as stateful*)\nvalue \"((set (flows_fixL ChairNetwork_stateful_ACS)) - set (flows_stateL ChairNetwork_stateful_ACS)) - set (backlinks (flows_fixL ChairNetwork_stateful_ACS))\"\n\n(*the new backflows*)\nvalue \"set (edgesL (stateful_list_policy_to_list_graph ChairNetwork_stateful_ACS)) - (set (edgesL ChairNetwork))\"\n\n(*the resulting ACS graph*)\nvalue \"stateful_list_policy_to_list_graph ChairNetwork_stateful_ACS\"\n\n\nvalue \"generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements\"\nvalue \"generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements\"\nlemma \"set (flows_fixL (generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements)) = set (flows_fixL (generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements))\" by eval\nlemma \"set (flows_stateL (generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements)) = set (flows_stateL (generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements))\" by eval\n\n\ndefinition \"ChairNetwork_stateful = generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements\"\n\n\nML_val{*\nvisualize_edges @{context} @{term \"flows_fixL ChairNetwork_stateful\"} \n    [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL ChairNetwork_stateful\"})]; \n*}\n\n(*these requirements impose no restrictoins on the stateful flows*)\ndefinition \"ChairNetwork_stateful_v2 = generate_valid_stateful_policy_IFSACS ChairNetwork [ConfidentialChairData, PrintingACL,  InternalSubnet, FilesSrcACL]\"\nML_val{*\nvisualize_edges @{context} @{term \"flows_fixL ChairNetwork_stateful_v2\"} \n    [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL ChairNetwork_stateful_v2\"})]; \n*}\n\n(*The sink requirements imposes the restriction that the printer cannot answer*)\ndefinition \"ChairNetwork_stateful_v3 = generate_valid_stateful_policy_IFSACS ChairNetwork [PrintingSink]\"\nML_val{*\nvisualize_edges @{context} @{term \"flows_fixL ChairNetwork_stateful_v3\"} \n    [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL ChairNetwork_stateful_v3\"})]; \n*}\n\nsubsection{*An example of bad side-effects in access control policies*}\n\n  definition ACL_not_with::\"(vString SecurityInvariant)\" where\n    \"ACL_not_with \\<equiv> new_configured_list_SecurityInvariant SINVAR_ACLnotCommunicateWith_impl.SINVAR_LIB_ACLnotCommunicateWith \\<lparr> \n        node_properties = [V ''A'' \\<mapsto> {V ''C''},\n                           V ''B'' \\<mapsto> {},\n                           V ''C'' \\<mapsto> {}], \n        model_global_properties = () \n        \\<rparr>\"\n\n  definition simple_network :: \"vString list_graph\" where\n    \"simple_network \\<equiv> \\<lparr> nodesL = [V ''A'', V ''B'', V ''C''],\n                      edgesL = [(V ''B'', V ''A''), (V ''B'', V ''C'')] \\<rparr>\"\n  \n  lemma \"valid_list_graph ChairNetwork_empty\" by eval\n  lemma \"\\<forall>m \\<in> set [ACL_not_with]. implc_sinvar m simple_network\" by eval\n\n\n  lemma \"implc_get_offending_flows [ACL_not_with] simple_network = []\" by eval\n  lemma \"implc_get_offending_flows [ACL_not_with] \n    \\<lparr> nodesL = [V ''A'', V ''B'', V ''C''], edgesL = [(V ''B'', V ''A''), (V ''B'', V ''C''), (V ''A'', V ''B'')] \\<rparr> =\n      [[(V ''B'', V ''C'')], [(V ''A'', V ''B'')]]\" by eval\n  lemma \"implc_get_offending_flows [ACL_not_with] \n    \\<lparr> nodesL = [V ''A'', V ''B'', V ''C''], edgesL = [(V ''B'', V ''A''), (V ''B'', V ''C''), (V ''C'', V ''B'')] \\<rparr> =\n      []\" by eval\n\nvalue \"generate_valid_stateful_policy_IFSACS simple_network [ACL_not_with]\"\nvalue \"generate_valid_stateful_policy_IFSACS_2 simple_network [ACL_not_with]\"\n\n\n\n\n\n\n\n\nsubsection{*performance test*}\n(*6 minutes , about 1.8k edges in graph, most of the times, no requirements apply, simply added some nodes, edges to the chair network. topology is valid*)\n(*value \"generate_valid_stateful_policy_IFSACS biggraph ChairSecurityRequirements\"*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Network_Security_Policy_Verification/Examples/Impl_List_Playground_ChairNetwork_statefulpolicy_example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.607663184043154, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3180632758276254}}
{"text": "theory IICF_Array_Map_Total\nimports \"../Intf/IICF_Map\" IICF_Array\nbegin\n  text \\<open>\n    Map implementation where lookup is only valid for elements \n    already in the map.\n  \\<close>\n\n  type_synonym 'a amt1 = \"'a list\"\n\n  definition amt1_rel :: \"nat \\<Rightarrow> ('a amt1 \\<times> (nat\\<rightharpoonup>'a)) set\"\n    where \"amt1_rel N \\<equiv> {(xs,m). length xs = N \\<and> dom m \\<subseteq> {0..<N} \\<and> (\\<forall>k v. m k = Some v \\<longrightarrow> v=xs!k)}\"\n\n  definition amt1_init :: \"nat \\<Rightarrow> 'a::llvm_rep amt1 nres\" where \"amt1_init N \\<equiv> RETURN (replicate N init)\"\n  definition amt1_lookup :: \"nat \\<Rightarrow> 'a amt1 \\<Rightarrow> 'a nres\" \n    where \"amt1_lookup k m \\<equiv> mop_list_get m k\"\n    \n  definition amt1_update :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a amt1 \\<Rightarrow> 'a amt1 nres\"\n    where \"amt1_update k v m \\<equiv> mop_list_set m k v\"\n  \n  sepref_decl_op amt_empty: \"\\<lambda>(N::nat). Map.empty :: nat \\<rightharpoonup> _\" :: \"nat_rel \\<rightarrow> \\<langle>nat_rel,V\\<rangle> map_rel\" .\n  \n  lemma amt_fold_custom_empty:\n    \"op_map_empty = op_amt_empty N\"\n    \"Map.empty = op_amt_empty N\"\n    \"mop_map_empty = mop_amt_empty N\"\n    by auto\n  \n  \n  lemma amt1_empty_refine: \"(amt1_init,mop_amt_empty) \n    \\<in> nat_rel \\<rightarrow>\\<^sub>f\\<^sub>d (\\<lambda>N. \\<langle>amt1_rel N\\<rangle>nres_rel)\"\n    unfolding amt1_init_def\n    by (auto intro!: frefI nres_relI simp: amt1_rel_def in_br_conv fun_eq_iff)\n  \n  lemma amt1_lookup_refine: \n    \"(amt1_lookup, mop_map_the_lookup) \\<in> nbn_rel N \\<rightarrow> amt1_rel N \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"\n    apply (clarsimp simp: amt1_lookup_def)\n    apply (refine_vcg)\n    apply (auto simp: amt1_rel_def in_br_conv)\n    done\n    \n  lemma amt1_update_refine:\n    \"(amt1_update, mop_map_update) \n      \\<in> nbn_rel N \\<rightarrow>Id \\<rightarrow> amt1_rel N \\<rightarrow> \\<langle>amt1_rel N\\<rangle>nres_rel\"\n    unfolding amt1_update_def \n    apply (refine_vcg frefI)\n    by (auto simp: amt1_rel_def in_br_conv fun_eq_iff)\n    \n  \n    \n  context\n    fixes L :: \"'l::len2 itself\"  \n    (*notes [fcomp_norm_unfold] = snatb_rel_def[symmetric]*)\n  begin\n    \n    private abbreviation (input) \"amt2_assn \\<equiv> array_assn id_assn\"\n  \n    definition \"amt_assn V N \\<equiv> hr_comp \n      (hr_comp amt2_assn (amt1_rel N))\n      (\\<langle>nat_rel, the_pure V\\<rangle>map_rel)\"\n    lemmas [fcomp_norm_unfold] = amt_assn_def[symmetric]\n  \n    lemma amt_assn_fold'[fcomp_norm_unfold]: \n      \"hrr_comp nat_rel (\\<lambda>x _. hr_comp (IICF_Array.array_assn id_assn) (amt1_rel x))\n                        (\\<lambda>x. \\<langle>nat_rel, the_pure V\\<rangle>map_rel) = (\\<lambda>N _. amt_assn V N)\"\n      unfolding amt_assn_def \n      by (auto simp: fun_eq_iff hrr_comp_def pred_lift_extract_simps; smt non_dep_def)\n    \n\n    lemma amt_assn_intf[intf_of_assn]: \"intf_of_assn V TYPE('v) \\<Longrightarrow> intf_of_assn (amt_assn V N) (TYPE((nat,'v)i_map))\"\n      by simp\n        \n    sepref_definition amt_init_impl [llvm_inline] is \"amt1_init\"\n      :: \"(snat_assn' TYPE('l))\\<^sup>k \\<rightarrow>\\<^sub>a amt2_assn\"\n      unfolding amt1_init_def\n      supply [sepref_import_param] = IdI[of init]\n      apply (subst array_fold_custom_replicate)\n      by sepref\n      \n     \n    sepref_decl_impl (ismop) amt_empty: amt_init_impl.refine[FCOMP amt1_empty_refine] .\n    \n    sepref_definition amt_lookup_impl [llvm_inline] is \"uncurry amt1_lookup\" \n      :: \"(snat_assn' TYPE('l))\\<^sup>k *\\<^sub>a amt2_assn\\<^sup>k \\<rightarrow>\\<^sub>a id_assn\"\n      unfolding amt1_lookup_def\n      by sepref\n    sepref_decl_impl (ismop) amt_lookup_impl.refine[FCOMP amt1_lookup_refine] \n      uses mop_map_the_lookup.fref[where K=Id] .\n                                                            \n    sepref_definition amt_update_impl [llvm_inline] is \"uncurry2 amt1_update\"  \n      :: \"(snat_assn' TYPE('l))\\<^sup>k *\\<^sub>a id_assn\\<^sup>k *\\<^sub>a amt2_assn\\<^sup>d \\<rightarrow>\\<^sub>a amt2_assn\"\n      unfolding amt1_update_def\n      by sepref\n    sepref_decl_impl (ismop) amt_update_impl.refine[FCOMP amt1_update_refine] \n      uses mop_map_update.fref[where K=Id] .\n  \n  end    \n  \n  type_synonym ('v) amt = \"'v ptr\"\n  \n  schematic_goal [sepref_frame_free_rules]: \"MK_FREE (amt_assn N V) (?fr)\"\n    unfolding amt_assn_def\n    by sepref_dbg_side\n\n\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/sepref/IICF/Impl/IICF_Array_Map_Total.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548782017745, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.3180457714708673}}
{"text": "(*  Title:      HOL/Proofs/Lambda/ListBeta.thy\n    Author:     Tobias Nipkow\n    Copyright   1998 TU Muenchen\n*)\n\nsection {* Lifting beta-reduction to lists *}\n\ntheory ListBeta imports ListApplication ListOrder begin\n\ntext {*\n  Lifting beta-reduction to lists of terms, reducing exactly one element.\n*}\n\nabbreviation\n  list_beta :: \"dB list => dB list => bool\"  (infixl \"=>\" 50) where\n  \"rs => ss == step1 beta rs ss\"\n\nlemma head_Var_reduction:\n  \"Var n \\<degree>\\<degree> rs \\<rightarrow>\\<^sub>\\<beta> v \\<Longrightarrow> \\<exists>ss. rs => ss \\<and> v = Var n \\<degree>\\<degree> ss\"\n  apply (induct u == \"Var n \\<degree>\\<degree> rs\" v arbitrary: rs set: beta)\n     apply simp\n    apply (rule_tac xs = rs in rev_exhaust)\n     apply simp\n    apply (atomize, force intro: append_step1I)\n   apply (rule_tac xs = rs in rev_exhaust)\n    apply simp\n    apply (auto 0 3 intro: disjI2 [THEN append_step1I])\n  done\n\nlemma apps_betasE [elim!]:\n  assumes major: \"r \\<degree>\\<degree> rs \\<rightarrow>\\<^sub>\\<beta> s\"\n    and cases: \"!!r'. [| r \\<rightarrow>\\<^sub>\\<beta> r'; s = r' \\<degree>\\<degree> rs |] ==> R\"\n      \"!!rs'. [| rs => rs'; s = r \\<degree>\\<degree> rs' |] ==> R\"\n      \"!!t u us. [| r = Abs t; rs = u # us; s = t[u/0] \\<degree>\\<degree> us |] ==> R\"\n  shows R\nproof -\n  from major have\n   \"(\\<exists>r'. r \\<rightarrow>\\<^sub>\\<beta> r' \\<and> s = r' \\<degree>\\<degree> rs) \\<or>\n    (\\<exists>rs'. rs => rs' \\<and> s = r \\<degree>\\<degree> rs') \\<or>\n    (\\<exists>t u us. r = Abs t \\<and> rs = u # us \\<and> s = t[u/0] \\<degree>\\<degree> us)\"\n    apply (induct u == \"r \\<degree>\\<degree> rs\" s arbitrary: r rs set: beta)\n       apply (case_tac r)\n         apply simp\n        apply (simp add: App_eq_foldl_conv)\n        apply (split split_if_asm)\n         apply simp\n         apply blast\n        apply simp\n       apply (simp add: App_eq_foldl_conv)\n       apply (split split_if_asm)\n        apply simp\n       apply simp\n      apply (drule App_eq_foldl_conv [THEN iffD1])\n      apply (split split_if_asm)\n       apply simp\n       apply blast\n      apply (force intro!: disjI1 [THEN append_step1I])\n     apply (drule App_eq_foldl_conv [THEN iffD1])\n     apply (split split_if_asm)\n      apply simp\n      apply blast\n     apply (clarify, auto 0 3 intro!: exI intro: append_step1I)\n    done\n  with cases show ?thesis by blast\nqed\n\nlemma apps_preserves_beta [simp]:\n    \"r \\<rightarrow>\\<^sub>\\<beta> s ==> r \\<degree>\\<degree> ss \\<rightarrow>\\<^sub>\\<beta> s \\<degree>\\<degree> ss\"\n  by (induct ss rule: rev_induct) auto\n\nlemma apps_preserves_beta2 [simp]:\n    \"r ->> s ==> r \\<degree>\\<degree> ss ->> s \\<degree>\\<degree> ss\"\n  apply (induct set: rtranclp)\n   apply blast\n  apply (blast intro: apps_preserves_beta rtranclp.rtrancl_into_rtrancl)\n  done\n\nlemma apps_preserves_betas [simp]:\n    \"rs => ss \\<Longrightarrow> r \\<degree>\\<degree> rs \\<rightarrow>\\<^sub>\\<beta> r \\<degree>\\<degree> ss\"\n  apply (induct rs arbitrary: ss rule: rev_induct)\n   apply simp\n  apply simp\n  apply (rule_tac xs = ss in rev_exhaust)\n   apply simp\n  apply simp\n  apply (drule Snoc_step1_SnocD)\n  apply blast\n  done\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Proofs/Lambda/ListBeta.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.3179732016337714}}
{"text": "(*<*)\n(*\n * Copyright 2015, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory CIMP_one_place_buffer\nimports\n  \"../CIMP\"\nbegin\n\n(*>*)\nsection\\<open>Example: a one-place buffer \\label{sec:one_place_buffer}\\<close>\n\ntext\\<open>\n\nTo demonstrate the CIMP reasoning infrastructure, we treat the trivial\none-place buffer example of \\<^citet>\\<open>\\<open>\\S3.3\\<close> in \"DBLP:journals/toplas/LamportS84\"\\<close>. Note that the\nsemantics for our language is different to \\<^cite>\\<open>\"DBLP:journals/toplas/LamportS84\" using \"citeauthor\"\\<close>'s, who\ntreated a historical variant of CSP (i.e., not the one in \\<^cite>\\<open>\"Hoare:1985\"\\<close>).\n\nWe introduce some syntax for fixed-topology (static channel-based)\nscenarios.\n\n\\<close>\n\nabbreviation\n  rcv_syn :: \"'location \\<Rightarrow> 'channel \\<Rightarrow> ('val \\<Rightarrow> 'state \\<Rightarrow> 'state)\n           \\<Rightarrow> (unit, 'location, 'channel \\<times> 'val, 'state) com\" (\"\\<lbrace>_\\<rbrace>/ _\\<triangleright>_\" [0,0,81] 81)\nwhere\n  \"\\<lbrace>l\\<rbrace> ch\\<triangleright>f \\<equiv> \\<lbrace>l\\<rbrace> Response (\\<lambda>q s. if fst q = ch then {(f (snd q) s, ())} else {})\"\n\nabbreviation\n  snd_syn :: \"'location \\<Rightarrow> 'channel \\<Rightarrow> ('state \\<Rightarrow> 'val)\n          \\<Rightarrow> (unit, 'location, 'channel \\<times> 'val, 'state) com\" (\"\\<lbrace>_\\<rbrace>/ _\\<triangleleft>_\" [0,0,81] 81)\nwhere\n  \"\\<lbrace>l\\<rbrace> ch\\<triangleleft>f \\<equiv> \\<lbrace>l\\<rbrace> Request (\\<lambda>s. (ch, f s)) (\\<lambda>ans s. {s})\"\n\ntext\\<open>\n\nThese definitions largely follow \\<^citet>\\<open>\"DBLP:journals/toplas/LamportS84\"\\<close>. We have three processes\ncommunicating over two channels. We enumerate program locations.\n\n\\<close>\n\ndatatype ex_chname = \\<xi>12 | \\<xi>23\ntype_synonym ex_val = nat\ntype_synonym ex_ch = \"ex_chname \\<times> ex_val\"\ndatatype ex_loc = r12 | r23 | s23 | s12\ndatatype ex_proc = p1 | p2 | p3\n\ntype_synonym ex_pgm = \"(unit, ex_loc, ex_ch, ex_val) com\"\ntype_synonym ex_pred = \"(unit, ex_loc, ex_proc, ex_ch, ex_val) state_pred\"\ntype_synonym ex_state = \"(unit, ex_loc, ex_proc, ex_ch, ex_val) system_state\"\ntype_synonym ex_sys = \"(unit, ex_loc, ex_proc, ex_ch, ex_val) system\"\ntype_synonym ex_history = \"(ex_ch \\<times> unit) list\"\n\ntext\\<open>\n\nWe further specialise these for our particular example.\n\n\\<close>\n\nprimrec\n  ex_coms :: \"ex_proc \\<Rightarrow> ex_pgm\"\nwhere\n  \"ex_coms p1 = \\<lbrace>s12\\<rbrace> \\<xi>12\\<triangleleft>id\"\n| \"ex_coms p2 = LOOP DO \\<lbrace>r12\\<rbrace> \\<xi>12\\<triangleright>(\\<lambda>v _. v) ;; \\<lbrace>s23\\<rbrace> \\<xi>23\\<triangleleft>id OD\"\n| \"ex_coms p3 = \\<lbrace>r23\\<rbrace> \\<xi>23\\<triangleright>(\\<lambda>v _. v)\"\n\ntext\\<open>\n\nEach process starts with an arbitrary initial local state.\n\n\\<close>\n\nabbreviation ex_init :: \"(ex_proc \\<Rightarrow> ex_val) \\<Rightarrow> bool\" where\n  \"ex_init \\<equiv> \\<langle>True\\<rangle>\"\n\nabbreviation sys :: ex_sys where\n  \"sys \\<equiv> \\<lparr>PGMs = ex_coms, INIT = ex_init, FAIR = \\<langle>True\\<rangle>\\<rparr>\" (* FIXME add fairness hypotheses *)\n\ntext\\<open>\n\nThe following adapts Kai Engelhardt's, from his notes titled\n\\emph{Proving an Asynchronous Message Passing Program Correct},\n2011. The history variable tracks the causality of the system, which I\nfeel is missing in Lamport's treatment. We tack on Lamport's invariant\nso we can establish \\<open>Etern_pred\\<close>.\n\n\\<close>\n\nabbreviation\n  filter_on_channel :: \"ex_chname \\<Rightarrow> ex_state \\<Rightarrow> ex_val list\" (\"\\<downharpoonright>_\" [100] 101)\nwhere\n  \"\\<downharpoonright>ch \\<equiv> map (snd \\<circ> fst) \\<circ> filter ((=) ch \\<circ> fst \\<circ> fst) \\<circ> HST\"\n\ndefinition IL :: ex_pred where\n  \"IL = pred_conjoin [\n       at p1 s12 \\<^bold>\\<longrightarrow> LIST_NULL \\<downharpoonright>\\<xi>12\n     , terminated p1 \\<^bold>\\<longrightarrow> \\<downharpoonright>\\<xi>12 \\<^bold>= (\\<lambda>s. [s\\<down> p1])\n     , at p2 r12 \\<^bold>\\<longrightarrow> \\<downharpoonright>\\<xi>12 \\<^bold>= \\<downharpoonright>\\<xi>23\n     , at p2 s23 \\<^bold>\\<longrightarrow> \\<downharpoonright>\\<xi>12 \\<^bold>= \\<downharpoonright>\\<xi>23 \\<^bold>@ (\\<lambda>s. [s\\<down> p2]) \\<^bold>\\<and> (\\<lambda>s. s\\<down> p1 = s\\<down> p2)\n     , at p3 r23 \\<^bold>\\<longrightarrow> LIST_NULL \\<downharpoonright>\\<xi>23\n     , terminated p3 \\<^bold>\\<longrightarrow> \\<downharpoonright>\\<xi>23 \\<^bold>= (\\<lambda>s. [s\\<down> p2]) \\<^bold>\\<and> (\\<lambda>s. s\\<down> p1 = s\\<down> p3)\n     ]\"\n\ntext\\<open>\n\nIf @{const p3} terminates, then it has @{const p1}'s value. This is\nstronger than \\<^cite>\\<open>\"DBLP:journals/toplas/LamportS84\" using \"citeauthor\"\\<close>'s as we don't ask that the first\nprocess has also terminated.\n\n\\<close>\n\ndefinition Etern_pred :: ex_pred where\n  \"Etern_pred = (terminated p3 \\<^bold>\\<longrightarrow> (\\<lambda>s. s\\<down> p1 = s\\<down> p3))\"\n\ntext\\<open>\n\nProofs from here down.\n\n\\<close>\n\nlemma correct_system:\n  assumes \"IL sh\"\n  shows \"Etern_pred sh\"\nusing assms unfolding Etern_pred_def IL_def by simp\n\nlemma IL_p1: \"ex_coms, p1, lconst {} \\<turnstile> \\<lbrace>IL\\<rbrace> \\<lbrace>s12\\<rbrace> \\<xi>12\\<triangleleft>(\\<lambda>s. s)\"\napply (rule vcg.intros)\napply (rename_tac p')\napply (case_tac p'; clarsimp simp: IL_def atLs_def)\ndone\n\nlemma IL_p2: \"ex_coms, p2, lconst {r12} \\<turnstile> \\<lbrace>IL\\<rbrace> \\<lbrace>s23\\<rbrace> \\<xi>23\\<triangleleft>(\\<lambda>s. s)\"\napply (rule vcg.intros)\napply (rename_tac p')\napply (case_tac p'; clarsimp simp: IL_def)\ndone\n\nlemma IL: \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> IL\"\napply (rule VCG)\n apply (clarsimp simp: IL_def atLs_def dest!: initial_stateD)\napply (rename_tac p)\napply (case_tac p; clarsimp simp: IL_p1 IL_p2)\ndone\n\nlemma IL_valid: \"sys \\<Turnstile> \\<box>\\<lceil>IL\\<rceil>\"\nby (rule valid_prerun_lift[OF IL])\n\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/ConcurrentIMP/ex/CIMP_one_place_buffer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3179731936261763}}
{"text": "(*\n    Author:      David Sanan\n    Maintainer:  David Sanan, sanan at ntu edu sg\n    License:     LGPL\n*)\n\n(*  Title:      XVCGCon.thy\n    Author:     David Sanan, NTU\n\nCopyright (C) 2015-2016 David Sanan \nSome rights reserved, NTU\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\ntheory XVcgCon \nimports VcgCon\n\nbegin\n\n\ntext {* We introduce a syntactic variant of the let-expression so that we can\nsafely unfold it during verification condition generation. With the new\ntheorem attribute @{text \"vcg_simp\"} we can declare equalities to be used\nby the verification condition generator, while simplifying assertions.\n*}\n\nsyntax\n\"_Let'\" :: \"[letbinds, basicblock] => basicblock\"  (\"(LET (_)/ IN (_))\" 23)\n \ntranslations\n  \"_Let' (_binds b bs) e\"  == \"_Let' b (_Let' bs e)\"\n  \"_Let' (_bind x a) e\"    == \"CONST Let' a (%x. e)\"\n\n\nlemma Let'_unfold [vcg_simp]: \"Let' x f = f x\"\n  by (simp add: Let'_def Let_def)\n  \nlemma Let'_split_conv [vcg_simp]: \n  \"(Let' x  (\\<lambda>p. (case_prod (f p) (g p)))) = \n   (Let' x  (\\<lambda>p. (f p) (fst (g p)) (snd (g p))))\"\n  by (simp add: split_def)\n\nend", "meta": {"author": "CompSoftVer", "repo": "CSim", "sha": "816d36b7523796ace031c429003d82e9244eff9c", "save_path": "github-repos/isabelle/CompSoftVer-CSim", "path": "github-repos/isabelle/CompSoftVer-CSim/CSim-816d36b7523796ace031c429003d82e9244eff9c/CSimpl/XVcgCon.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.626124191181315, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.31795329279409257}}
{"text": "(*  Title:      HOL/Imperative_HOL/Ref.thy\n    Author:     John Matthews, Galois Connections; Alexander Krauss, Lukas Bulwahn & Florian Haftmann, TU Muenchen\n*)\n\nsection {* Monadic references *}\n\ntheory Ref\nimports Array\nbegin\n\ntext {*\n  Imperative reference operations; modeled after their ML counterparts.\n  See @{url \"http://caml.inria.fr/pub/docs/manual-caml-light/node14.15.html\"}\n  and @{url \"http://www.smlnj.org/doc/Conversion/top-level-comparison.html\"}\n*}\n\nsubsection {* Primitives *}\n\ndefinition present :: \"heap \\<Rightarrow> 'a\\<Colon>heap ref \\<Rightarrow> bool\" where\n  \"present h r \\<longleftrightarrow> addr_of_ref r < lim h\"\n\ndefinition get :: \"heap \\<Rightarrow> 'a\\<Colon>heap ref \\<Rightarrow> 'a\" where\n  \"get h = from_nat \\<circ> refs h TYPEREP('a) \\<circ> addr_of_ref\"\n\ndefinition set :: \"'a\\<Colon>heap ref \\<Rightarrow> 'a \\<Rightarrow> heap \\<Rightarrow> heap\" where\n  \"set r x = refs_update\n    (\\<lambda>h. h(TYPEREP('a) := ((h (TYPEREP('a))) (addr_of_ref r := to_nat x))))\"\n\ndefinition alloc :: \"'a \\<Rightarrow> heap \\<Rightarrow> 'a\\<Colon>heap ref \\<times> heap\" where\n  \"alloc x h = (let\n     l = lim h;\n     r = Ref l\n   in (r, set r x (h\\<lparr>lim := l + 1\\<rparr>)))\"\n\ndefinition noteq :: \"'a\\<Colon>heap ref \\<Rightarrow> 'b\\<Colon>heap ref \\<Rightarrow> bool\" (infix \"=!=\" 70) where\n  \"r =!= s \\<longleftrightarrow> TYPEREP('a) \\<noteq> TYPEREP('b) \\<or> addr_of_ref r \\<noteq> addr_of_ref s\"\n\n\nsubsection {* Monad operations *}\n\ndefinition ref :: \"'a\\<Colon>heap \\<Rightarrow> 'a ref Heap\" where\n  [code del]: \"ref v = Heap_Monad.heap (alloc v)\"\n\ndefinition lookup :: \"'a\\<Colon>heap ref \\<Rightarrow> 'a Heap\" (\"!_\" 61) where\n  [code del]: \"lookup r = Heap_Monad.tap (\\<lambda>h. get h r)\"\n\ndefinition update :: \"'a ref \\<Rightarrow> 'a\\<Colon>heap \\<Rightarrow> unit Heap\" (\"_ := _\" 62) where\n  [code del]: \"update r v = Heap_Monad.heap (\\<lambda>h. ((), set r v h))\"\n\ndefinition change :: \"('a\\<Colon>heap \\<Rightarrow> 'a) \\<Rightarrow> 'a ref \\<Rightarrow> 'a Heap\" where\n  \"change f r = do {\n     x \\<leftarrow> ! r;\n     let y = f x;\n     r := y;\n     return y\n   }\"\n\n\nsubsection {* Properties *}\n\ntext {* Primitives *}\n\nlemma noteq_sym: \"r =!= s \\<Longrightarrow> s =!= r\"\n  and unequal [simp]: \"r \\<noteq> r' \\<longleftrightarrow> r =!= r'\" -- \"same types!\"\n  by (auto simp add: noteq_def)\n\nlemma noteq_irrefl: \"r =!= r \\<Longrightarrow> False\"\n  by (auto simp add: noteq_def)\n\nlemma present_alloc_neq: \"present h r \\<Longrightarrow> r =!= fst (alloc v h)\"\n  by (simp add: present_def alloc_def noteq_def Let_def)\n\nlemma next_fresh [simp]:\n  assumes \"(r, h') = alloc x h\"\n  shows \"\\<not> present h r\"\n  using assms by (cases h) (auto simp add: alloc_def present_def Let_def)\n\nlemma next_present [simp]:\n  assumes \"(r, h') = alloc x h\"\n  shows \"present h' r\"\n  using assms by (cases h) (auto simp add: alloc_def set_def present_def Let_def)\n\nlemma get_set_eq [simp]:\n  \"get (set r x h) r = x\"\n  by (simp add: get_def set_def)\n\nlemma get_set_neq [simp]:\n  \"r =!= s \\<Longrightarrow> get (set s x h) r = get h r\"\n  by (simp add: noteq_def get_def set_def)\n\nlemma set_same [simp]:\n  \"set r x (set r y h) = set r x h\"\n  by (simp add: set_def)\n\nlemma not_present_alloc [simp]:\n  \"\\<not> present h (fst (alloc v h))\"\n  by (simp add: present_def alloc_def Let_def)\n\nlemma set_set_swap:\n  \"r =!= r' \\<Longrightarrow> set r x (set r' x' h) = set r' x' (set r x h)\"\n  by (simp add: noteq_def set_def fun_eq_iff)\n\nlemma alloc_set:\n  \"fst (alloc x (set r x' h)) = fst (alloc x h)\"\n  by (simp add: alloc_def set_def Let_def)\n\nlemma get_alloc [simp]:\n  \"get (snd (alloc x h)) (fst (alloc x' h)) = x\"\n  by (simp add: alloc_def Let_def)\n\nlemma set_alloc [simp]:\n  \"set (fst (alloc v h)) v' (snd (alloc v h)) = snd (alloc v' h)\"\n  by (simp add: alloc_def Let_def)\n\nlemma get_alloc_neq: \"r =!= fst (alloc v h) \\<Longrightarrow> \n  get (snd (alloc v h)) r  = get h r\"\n  by (simp add: get_def set_def alloc_def Let_def noteq_def)\n\nlemma lim_set [simp]:\n  \"lim (set r v h) = lim h\"\n  by (simp add: set_def)\n\nlemma present_alloc [simp]: \n  \"present h r \\<Longrightarrow> present (snd (alloc v h)) r\"\n  by (simp add: present_def alloc_def Let_def)\n\nlemma present_set [simp]:\n  \"present (set r v h) = present h\"\n  by (simp add: present_def fun_eq_iff)\n\nlemma noteq_I:\n  \"present h r \\<Longrightarrow> \\<not> present h r' \\<Longrightarrow> r =!= r'\"\n  by (auto simp add: noteq_def present_def)\n\n\ntext {* Monad operations *}\n\nlemma execute_ref [execute_simps]:\n  \"execute (ref v) h = Some (alloc v h)\"\n  by (simp add: ref_def execute_simps)\n\nlemma success_refI [success_intros]:\n  \"success (ref v) h\"\n  by (auto intro: success_intros simp add: ref_def)\n\nlemma effect_refI [effect_intros]:\n  assumes \"(r, h') = alloc v h\"\n  shows \"effect (ref v) h h' r\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_refE [effect_elims]:\n  assumes \"effect (ref v) h h' r\"\n  obtains \"get h' r = v\" and \"present h' r\" and \"\\<not> present h r\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_lookup [execute_simps]:\n  \"Heap_Monad.execute (lookup r) h = Some (get h r, h)\"\n  by (simp add: lookup_def execute_simps)\n\nlemma success_lookupI [success_intros]:\n  \"success (lookup r) h\"\n  by (auto intro: success_intros  simp add: lookup_def)\n\nlemma effect_lookupI [effect_intros]:\n  assumes \"h' = h\" \"x = get h r\"\n  shows \"effect (!r) h h' x\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_lookupE [effect_elims]:\n  assumes \"effect (!r) h h' x\"\n  obtains \"h' = h\" \"x = get h r\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_update [execute_simps]:\n  \"Heap_Monad.execute (update r v) h = Some ((), set r v h)\"\n  by (simp add: update_def execute_simps)\n\nlemma success_updateI [success_intros]:\n  \"success (update r v) h\"\n  by (auto intro: success_intros  simp add: update_def)\n\nlemma effect_updateI [effect_intros]:\n  assumes \"h' = set r v h\"\n  shows \"effect (r := v) h h' x\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_updateE [effect_elims]:\n  assumes \"effect (r' := v) h h' r\"\n  obtains \"h' = set r' v h\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_change [execute_simps]:\n  \"Heap_Monad.execute (change f r) h = Some (f (get h r), set r (f (get h r)) h)\"\n  by (simp add: change_def bind_def Let_def execute_simps)\n\nlemma success_changeI [success_intros]:\n  \"success (change f r) h\"\n  by (auto intro!: success_intros effect_intros simp add: change_def)\n\nlemma effect_changeI [effect_intros]: \n  assumes \"h' = set r (f (get h r)) h\" \"x = f (get h r)\"\n  shows \"effect (change f r) h h' x\"\n  by (rule effectI) (insert assms, simp add: execute_simps)  \n\nlemma effect_changeE [effect_elims]:\n  assumes \"effect (change f r') h h' r\"\n  obtains \"h' = set r' (f (get h r')) h\" \"r = f (get h r')\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma lookup_chain:\n  \"(!r \\<guillemotright> f) = f\"\n  by (rule Heap_eqI) (auto simp add: lookup_def execute_simps intro: execute_bind)\n\nlemma update_change [code]:\n  \"r := e = change (\\<lambda>_. e) r \\<guillemotright> return ()\"\n  by (rule Heap_eqI) (simp add: change_def lookup_chain)\n\n\ntext {* Non-interaction between imperative arrays and imperative references *}\n\nlemma array_get_set [simp]:\n  \"Array.get (set r v h) = Array.get h\"\n  by (simp add: Array.get_def set_def fun_eq_iff)\n\nlemma get_update [simp]:\n  \"get (Array.update a i v h) r = get h r\"\n  by (simp add: get_def Array.update_def Array.set_def)\n\nlemma alloc_update:\n  \"fst (alloc v (Array.update a i v' h)) = fst (alloc v h)\"\n  by (simp add: Array.update_def Array.get_def Array.set_def alloc_def Let_def)\n\nlemma update_set_swap:\n  \"Array.update a i v (set r v' h) = set r v' (Array.update a i v h)\"\n  by (simp add: Array.update_def Array.get_def Array.set_def set_def)\n\nlemma length_alloc [simp]: \n  \"Array.length (snd (alloc v h)) a = Array.length h a\"\n  by (simp add: Array.length_def Array.get_def alloc_def set_def Let_def)\n\nlemma array_get_alloc [simp]: \n  \"Array.get (snd (alloc v h)) = Array.get h\"\n  by (simp add: Array.get_def alloc_def set_def Let_def fun_eq_iff)\n\nlemma present_update [simp]: \n  \"present (Array.update a i v h) = present h\"\n  by (simp add: Array.update_def Array.set_def fun_eq_iff present_def)\n\nlemma array_present_set [simp]:\n  \"Array.present (set r v h) = Array.present h\"\n  by (simp add: Array.present_def set_def fun_eq_iff)\n\nlemma array_present_alloc [simp]:\n  \"Array.present h a \\<Longrightarrow> Array.present (snd (alloc v h)) a\"\n  by (simp add: Array.present_def alloc_def Let_def)\n\nlemma set_array_set_swap:\n  \"Array.set a xs (set r x' h) = set r x' (Array.set a xs h)\"\n  by (simp add: Array.set_def set_def)\n\nhide_const (open) present get set alloc noteq lookup update change\n\n\nsubsection {* Code generator setup *}\n\ntext {* Intermediate operation avoids invariance problem in @{text Scala} (similar to value restriction) *}\n\ndefinition ref' where\n  [code del]: \"ref' = ref\"\n\n\n\n\ntext {* SML / Eval *}\n\ncode_printing type_constructor ref \\<rightharpoonup> (SML) \"_/ ref\"\ncode_printing type_constructor ref \\<rightharpoonup> (Eval) \"_/ Unsynchronized.ref\"\ncode_printing constant Ref \\<rightharpoonup> (SML) \"raise/ (Fail/ \\\"bare Ref\\\")\"\ncode_printing constant ref' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ ref/ _)\"\ncode_printing constant ref' \\<rightharpoonup> (Eval) \"(fn/ ()/ =>/ Unsynchronized.ref/ _)\"\ncode_printing constant Ref.lookup \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ !/ _)\"\ncode_printing constant Ref.update \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ _/ :=/ _)\"\ncode_printing constant \"HOL.equal :: 'a ref \\<Rightarrow> 'a ref \\<Rightarrow> bool\" \\<rightharpoonup> (SML) infixl 6 \"=\"\n\ncode_reserved Eval Unsynchronized\n\n\ntext {* OCaml *}\n\ncode_printing type_constructor ref \\<rightharpoonup> (OCaml) \"_/ ref\"\ncode_printing constant Ref \\<rightharpoonup> (OCaml) \"failwith/ \\\"bare Ref\\\"\"\ncode_printing constant ref' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ ref/ _)\"\ncode_printing constant Ref.lookup \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ !/ _)\"\ncode_printing constant Ref.update \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ _/ :=/ _)\"\ncode_printing constant \"HOL.equal :: 'a ref \\<Rightarrow> 'a ref \\<Rightarrow> bool\" \\<rightharpoonup> (OCaml) infixl 4 \"=\"\n\ncode_reserved OCaml ref\n\n\ntext {* Haskell *}\n\ncode_printing type_constructor ref \\<rightharpoonup> (Haskell) \"Heap.STRef/ Heap.RealWorld/ _\"\ncode_printing constant Ref \\<rightharpoonup> (Haskell) \"error/ \\\"bare Ref\\\"\"\ncode_printing constant ref' \\<rightharpoonup> (Haskell) \"Heap.newSTRef\"\ncode_printing constant Ref.lookup \\<rightharpoonup> (Haskell) \"Heap.readSTRef\"\ncode_printing constant Ref.update \\<rightharpoonup> (Haskell) \"Heap.writeSTRef\"\ncode_printing constant \"HOL.equal :: 'a ref \\<Rightarrow> 'a ref \\<Rightarrow> bool\" \\<rightharpoonup> (Haskell) infix 4 \"==\"\ncode_printing class_instance ref :: HOL.equal \\<rightharpoonup> (Haskell) -\n\n\ntext {* Scala *}\n\ncode_printing type_constructor ref \\<rightharpoonup> (Scala) \"!Ref[_]\"\ncode_printing constant Ref \\<rightharpoonup> (Scala) \"!sys.error(\\\"bare Ref\\\")\"\ncode_printing constant ref' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Ref((_))\"\ncode_printing constant Ref.lookup \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Ref.lookup((_))\"\ncode_printing constant Ref.update \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Ref.update((_), (_))\"\ncode_printing constant \"HOL.equal :: 'a ref \\<Rightarrow> 'a ref \\<Rightarrow> bool\" \\<rightharpoonup> (Scala) infixl 5 \"==\"\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Imperative_HOL/Ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283035, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3179532857085878}}
{"text": "section \\<open>Explore and Enumerate Nodes of Nondeterministic Büchi Automata\\<close>\n\ntheory NBA_Translate\nimports NBA_Explicit\nbegin\n\n  subsection \\<open>Syntax\\<close>\n\n  (* TODO: this syntax has unnecessarily high inner binding strength, requiring extra parentheses\n    the regular let syntax correctly uses inner binding strength 0: (\"(2_ =/ _)\" 10) *)\n  no_syntax \"_do_let\" :: \"[pttrn, 'a] \\<Rightarrow> do_bind\" (\"(2let _ =/ _)\" [1000, 13] 13)\n  syntax \"_do_let\" :: \"[pttrn, 'a] \\<Rightarrow> do_bind\" (\"(2let _ =/ _)\" 13)\n\n  section \\<open>Image on Explicit Automata\\<close>\n\n  (* TODO: this should not be needed, only use nba_image *)\n  definition nbae_image where \"nbae_image f A \\<equiv> nbae (alphabete A) (f ` initiale A)\n    ((\\<lambda> (p, a, q). (f p, a, f q)) ` transitione A) (f ` acceptinge A)\"\n\n  lemma nbae_image_param[param]: \"(nbae_image, nbae_image) \\<in> (S \\<rightarrow> T) \\<rightarrow> \\<langle>L, S\\<rangle> nbae_rel \\<rightarrow> \\<langle>L, T\\<rangle> nbae_rel\"\n    unfolding nbae_image_def by parametricity\n\n  lemma nbae_image_id[simp]: \"nbae_image id = id\" unfolding nbae_image_def by auto\n  lemma nbae_image_nba_nbae: \"nbae_image f (nba_nbae A) = nbae\n    (alphabet A) (f ` initial A)\n    (\\<Union> p \\<in> nodes A. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p)\n    (f ` {p \\<in> nodes A. accepting A p})\"\n    unfolding nba_nbae_def nbae_image_def nbae.simps Set.filter_def by force\n\n  section \\<open>Exploration and Translation\\<close>\n\n  definition trans_spec where\n    \"trans_spec A f \\<equiv> \\<Union> p \\<in> nodes A. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p\"\n\n  definition trans_algo where\n    \"trans_algo N L S f \\<equiv>\n      FOREACH N (\\<lambda> p T. do {\n        ASSERT (p \\<in> N);\n        FOREACH L (\\<lambda> a T. do {\n          ASSERT (a \\<in> L);\n          FOREACH (S a p) (\\<lambda> q T. do {\n            ASSERT (q \\<in> S a p);\n            ASSERT ((f p, a, f q) \\<notin> T);\n            RETURN (insert (f p, a, f q) T) }\n          ) T }\n        ) T }\n      ) {}\"\n\n  lemma trans_algo_refine:\n    assumes \"finite (nodes A)\" \"finite (alphabet A)\" \"inj_on f (nodes A)\"\n    assumes \"N = nodes A\" \"L = alphabet A\" \"S = transition A\"\n    shows \"(trans_algo N L S f, SPEC (HOL.eq (trans_spec A f))) \\<in> \\<langle>Id\\<rangle> nres_rel\"\n  unfolding trans_algo_def trans_spec_def assms(4-6)\n  proof (refine_vcg FOREACH_rule_insert_eq)\n    show \"finite (nodes A)\" using assms(1) by this\n    show \"(\\<Union> p \\<in> nodes A. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p) =\n      (\\<Union> p \\<in> nodes A. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p)\" by rule\n    show \"(\\<Union> p \\<in> {}. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p) = {}\" by simp\n    fix T x\n    assume 1: \"T \\<subseteq> nodes A\" \"x \\<in> nodes A\" \"x \\<notin> T\"\n    show \"finite (alphabet A)\" using assms(2) by this\n    show \"(\\<Union> a \\<in> {}. f ` {x} \\<times> {a} \\<times> f ` transition A a x) \\<union>\n      (\\<Union> p \\<in> T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p) =\n      (\\<Union> p \\<in> T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p)\"\n      \"(\\<Union> a \\<in> alphabet A. f ` {x} \\<times> {a} \\<times> f ` transition A a x) \\<union>\n      (\\<Union> p \\<in> T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p) =\n      (\\<Union> p \\<in> insert x T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p)\" by auto\n    fix Ta xa\n    assume 2: \"Ta \\<subseteq> alphabet A\" \"xa \\<in> alphabet A\" \"xa \\<notin> Ta\"\n    show \"finite (transition A xa x)\" using 1 2 assms(1) by (meson infinite_subset nba.nodes_transition subsetI)\n    show \"(f ` {x} \\<times> {xa} \\<times> f ` transition A xa x) \\<union>\n      (\\<Union> a \\<in> Ta. f ` {x} \\<times> {a} \\<times> f ` transition A a x) \\<union>\n      (\\<Union> p \\<in> T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p) =\n      (\\<Union> a \\<in> insert xa Ta. f ` {x} \\<times> {a} \\<times> f ` transition A a x) \\<union>\n      (\\<Union> p \\<in> T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p)\"\n      by auto\n    show \"(f ` {x} \\<times> {xa} \\<times> f ` {}) \\<union>\n      (\\<Union> a \\<in> Ta. f ` {x} \\<times> {a} \\<times> f ` transition A a x) \\<union>\n      (\\<Union> p \\<in> T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p) =\n      (\\<Union> a \\<in> Ta. f ` {x} \\<times> {a} \\<times> f ` transition A a x) \\<union>\n      (\\<Union> p \\<in> T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p)\"\n      by auto\n    fix Tb xb\n    assume 3: \"Tb \\<subseteq> transition A xa x\" \"xb \\<in> transition A xa x\" \"xb \\<notin> Tb\"\n    show \"(f x, xa, f xb) \\<notin> f ` {x} \\<times> {xa} \\<times> f ` Tb \\<union>\n      (\\<Union> a \\<in> Ta. f ` {x} \\<times> {a} \\<times> f ` transition A a x) \\<union>\n      (\\<Union> p \\<in> T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p)\"\n      using 1 2 3 assms(3) by (blast dest: inj_onD)\n    show \"f ` {x} \\<times> {xa} \\<times> f ` insert xb Tb \\<union>\n      (\\<Union> a \\<in> Ta. f ` {x} \\<times> {a} \\<times> f ` transition A a x) \\<union>\n      (\\<Union> p \\<in> T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p) =\n      insert (f x, xa, f xb) (f ` {x} \\<times> {xa} \\<times> f ` Tb \\<union>\n      (\\<Union> a \\<in> Ta. f ` {x} \\<times> {a} \\<times> f ` transition A a x) \\<union>\n      (\\<Union> p \\<in> T. \\<Union> a \\<in> alphabet A. f ` {p} \\<times> {a} \\<times> f ` transition A a p))\"\n      by auto\n  qed\n\n  (* TODO: move this to nondeterministic automaton\n    there, it will have to be treated more elementarily\n    at least until we abstract from NBA_Refine to do that there aswell *)\n  definition nba_image :: \"('state\\<^sub>1 \\<Rightarrow> 'state\\<^sub>2) \\<Rightarrow> ('label, 'state\\<^sub>1) nba \\<Rightarrow> ('label, 'state\\<^sub>2) nba\" where\n    \"nba_image f A \\<equiv> nba\n      (alphabet A)\n      (f ` initial A)\n      (\\<lambda> a p. f ` transition A a (inv_into (nodes A) f p))\n      (\\<lambda> p. accepting A (inv_into (nodes A) f p))\"\n\n  lemma nba_image_rel[param]:\n    assumes \"inj_on f (nodes A)\"\n    shows \"(A, nba_image f A) \\<in> \\<langle>Id_on (alphabet A), br f (\\<lambda> p. p \\<in> nodes A)\\<rangle> nba_rel\"\n  proof -\n    have \"A = nba (alphabet A) (initial A) (transition A) (accepting A)\" by simp\n    also have \"(\\<dots>, nba_image f A) \\<in> \\<langle>Id_on (alphabet A), br f (\\<lambda> p. p \\<in> nodes A)\\<rangle> nba_rel\"\n      using assms unfolding nba_image_def\n      by (parametricity) (auto intro: nba_rel_eq simp: in_br_conv br_set_rel_alt)\n    finally show ?thesis by this\n  qed\n\n  lemma nba_image_nodes[simp]:\n    assumes \"inj_on f (nodes A)\"\n    shows \"nodes (nba_image f A) = f ` nodes A\"\n  proof -\n    have \"(nodes A, nodes (nba_image f A)) \\<in> \\<langle>br f (\\<lambda> p. p \\<in> nodes A)\\<rangle> set_rel\"\n      using assms by parametricity\n    then show ?thesis unfolding br_set_rel_alt by simp\n  qed\n  lemma nba_image_language[simp]:\n    assumes \"inj_on f (nodes A)\"\n    shows \"language (nba_image f A) = language A\"\n  proof -\n    have \"(language A, language (nba_image f A)) \\<in> \\<langle>\\<langle>Id_on (alphabet A)\\<rangle> stream_rel\\<rangle> set_rel\"\n      using assms by parametricity\n    then show ?thesis by simp\n  qed\n\n  lemma nba_image_nbae:\n    assumes \"inj_on f (nodes A)\"\n    shows \"nbae_image f (nba_nbae A) = nba_nbae (nba_image f A)\"\n    unfolding nbae_image_nba_nbae\n    unfolding nba_nbae_def\n    unfolding nba_image_nodes[OF assms]\n    unfolding nbae.simps\n    unfolding nba_image_def\n    unfolding nba.sel\n    using assms by auto\n\n  (* TODO: with this, maybe much of the nbae infrastructure is obsolete?\n    since now there is very little happening in terms of relations, maybe we can even make do\n    with just the abstraction function *)\n  (* TODO: maybe the specification for translation is just that the translated automaton\n    is related in \\<langle>Id_on (alphabet A), ???\\<rangle> nba_rel? *)\n  definition op_translate :: \"('label, 'state) nba \\<Rightarrow> ('label, nat) nbae nres\" where\n    \"op_translate A \\<equiv> SPEC (\\<lambda> B. \\<exists> f. inj_on f (nodes A) \\<and> B = nba_nbae (nba_image f A))\"\n\n  lemma op_translate_language:\n    assumes \"(RETURN Ai, op_translate A) \\<in> \\<langle>\\<langle>Id, nat_rel\\<rangle> nbaei_nbae_rel\\<rangle> nres_rel\"\n    shows \"language (nbae_nba (nbaei_nbae Ai)) = language A\"\n  proof -\n    (* TODO: can we leave all this inside the nres without explicit obtain? *)\n    obtain f where 1:\n      \"(Ai, nba_nbae (nba_image f A)) \\<in> \\<langle>Id, nat_rel\\<rangle> nbaei_nbae_rel\" \"inj_on f (nodes A)\"\n      using assms[unfolded in_nres_rel_iff op_translate_def, THEN RETURN_ref_SPECD]\n      by metis\n    let ?C = \"nba_image f A\"\n    have \"(nbae_nba (nbaei_nbae Ai), nbae_nba (id (nba_nbae ?C))) \\<in> \\<langle>Id, nat_rel\\<rangle> nba_rel\"\n      using 1(1) by parametricity auto\n    also have \"nbae_nba (id (nba_nbae ?C)) = (nbae_nba \\<circ> nba_nbae) ?C\" by simp\n    also have \"(\\<dots>, id ?C) \\<in> \\<langle>Id_on (alphabet ?C), Id_on (nodes ?C)\\<rangle> nba_rel\" by parametricity\n    finally have 2: \"(nbae_nba (nbaei_nbae Ai), ?C) \\<in>\n      \\<langle>Id_on (alphabet ?C), Id_on (nodes ?C)\\<rangle> nba_rel\" by simp\n    have \"(language (nbae_nba (nbaei_nbae Ai)), language ?C) \\<in>\n      \\<langle>\\<langle>Id_on (alphabet ?C)\\<rangle> stream_rel\\<rangle> set_rel\"\n      using 2 by parametricity\n    also have \"language ?C = language A\" using 1(2) by simp\n    finally show ?thesis by simp\n  qed\n\n  (* TODO: make separate implementations for \"nba_nbae\" and \"op_set_enumerate \\<bind> nbae_image\"\n    make sure to do regression tests along the way *)\n  (* TODO: since we have translate_impl, maybe just having a good nba_nbae implementation is enough? *)\n  schematic_goal to_nbaei_impl:\n    fixes S :: \"('statei \\<times> 'state) set\"\n    assumes [simp]: \"finite (nodes A)\"\n    assumes [autoref_ga_rules]: \"is_bounded_hashcode S seq bhc\"\n    assumes [autoref_ga_rules]: \"is_valid_def_hm_size TYPE('statei) hms\"\n    assumes [autoref_rules]: \"(seq, HOL.eq) \\<in> S \\<rightarrow> S \\<rightarrow> bool_rel\"\n    assumes [autoref_rules]: \"(Ai, A) \\<in> \\<langle>L, S\\<rangle> nbai_nba_rel\"\n    shows \"(?f :: ?'a, do {\n        let N = nodes A;\n        f \\<leftarrow> op_set_enumerate N;\n        ASSERT (dom f = N);\n        ASSERT (\\<forall> p \\<in> initial A. f p \\<noteq> None);\n        ASSERT (\\<forall> a \\<in> alphabet A. \\<forall> p \\<in> dom f. \\<forall> q \\<in> transition A a p. f q \\<noteq> None);\n        T \\<leftarrow> trans_algo N (alphabet A) (transition A) (\\<lambda> x. the (f x));\n        RETURN (nbae (alphabet A) ((\\<lambda> x. the (f x)) ` initial A) T\n          ((\\<lambda> x. the (f x)) ` {p \\<in> N. accepting A p}))\n      }) \\<in> ?R\"\n    unfolding trans_algo_def by (autoref_monadic (plain))\n  concrete_definition to_nbaei_impl uses to_nbaei_impl\n\n  context\n  begin\n\n    interpretation autoref_syn by this\n\n    lemma to_nbaei_impl_refine[autoref_rules]:\n      fixes S :: \"('statei \\<times> 'state) set\"\n      assumes \"SIDE_PRECOND (finite (nodes A))\"\n      assumes \"SIDE_GEN_ALGO (is_bounded_hashcode S seq bhc)\"\n      assumes \"SIDE_GEN_ALGO (is_valid_def_hm_size TYPE('statei) hms)\"\n      assumes \"GEN_OP seq HOL.eq (S \\<rightarrow> S \\<rightarrow> bool_rel)\"\n      assumes \"(Ai, A) \\<in> \\<langle>L, S\\<rangle> nbai_nba_rel\"\n      shows \"(RETURN (to_nbaei_impl seq bhc hms Ai),\n        (OP op_translate ::: \\<langle>L, S\\<rangle> nbai_nba_rel \\<rightarrow> \\<langle>\\<langle>L, nat_rel\\<rangle> nbaei_nbae_rel\\<rangle> nres_rel) $ A) \\<in>\n        \\<langle>\\<langle>L, nat_rel\\<rangle> nbaei_nbae_rel\\<rangle> nres_rel\"\n    proof -\n      have 1: \"finite (alphabet A)\"\n        using nbai_nba_param(2)[param_fo, OF assms(5)] list_set_rel_finite\n        unfolding finite_set_rel_def by auto\n      note to_nbaei_impl.refine[OF assms[unfolded autoref_tag_defs]]\n      also have \"(do {\n          let N = nodes A;\n          f \\<leftarrow> op_set_enumerate N;\n          ASSERT (dom f = N);\n          ASSERT (\\<forall> p \\<in> initial A. f p \\<noteq> None);\n          ASSERT (\\<forall> a \\<in> alphabet A. \\<forall> p \\<in> dom f. \\<forall> q \\<in> transition A a p. f q \\<noteq> None);\n          T \\<leftarrow> trans_algo N (alphabet A) (transition A) (\\<lambda> x. the (f x));\n          RETURN (nbae (alphabet A) ((\\<lambda> x. the (f x)) ` initial A) T ((\\<lambda> x. the (f x)) ` {p \\<in> N. accepting A p}))\n        }, do {\n          f \\<leftarrow> op_set_enumerate (nodes A);\n          T \\<leftarrow> SPEC (HOL.eq (trans_spec A (\\<lambda> x. the (f x))));\n          RETURN (nbae (alphabet A) ((\\<lambda> x. the (f x)) ` initial A) T ((\\<lambda> x. the (f x)) ` {p \\<in> nodes A. accepting A p}))\n        }) \\<in> \\<langle>Id\\<rangle> nres_rel\"\n        unfolding Let_def comp_apply op_set_enumerate_def using assms(1) 1\n        by (refine_vcg vcg0[OF trans_algo_refine]) (auto intro!: inj_on_map_the[unfolded comp_apply])\n      also have \"(do {\n          f \\<leftarrow> op_set_enumerate (nodes A);\n          T \\<leftarrow> SPEC (HOL.eq (trans_spec A (\\<lambda> x. the (f x))));\n          RETURN (nbae (alphabet A) ((\\<lambda> x. the (f x)) ` initial A) T ((\\<lambda> x. the (f x)) ` {p \\<in> nodes A. accepting A p}))\n        }, do {\n          f \\<leftarrow> op_set_enumerate (nodes A);\n          RETURN (nbae_image (the \\<circ> f) (nba_nbae A))\n        }) \\<in> \\<langle>Id\\<rangle> nres_rel\"\n        unfolding trans_spec_def nbae_image_nba_nbae by refine_vcg force\n      also have \"(do {\n          f \\<leftarrow> op_set_enumerate (nodes A);\n          RETURN (nbae_image (the \\<circ> f) (nba_nbae A))\n        }, do {\n          f \\<leftarrow> op_set_enumerate (nodes A);\n          RETURN (nba_nbae (nba_image (the \\<circ> f) A))\n        }) \\<in> \\<langle>Id\\<rangle> nres_rel\"\n        unfolding op_set_enumerate_def by (refine_vcg) (simp add: inj_on_map_the nba_image_nbae)\n      also have \"(do {\n          f \\<leftarrow> op_set_enumerate (nodes A);\n          RETURN (nba_nbae (nba_image (the \\<circ> f) A))\n        }, op_translate A) \\<in> \\<langle>Id\\<rangle> nres_rel\"\n        unfolding op_set_enumerate_def op_translate_def\n        by (refine_vcg) (metis Collect_mem_eq inj_on_map_the subset_Collect_conv)\n      finally show ?thesis unfolding nres_rel_comp by simp\n    qed\n\n  end\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Transition_Systems_and_Automata/Automata/NBA/NBA_Translate.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.6261241772283034, "lm_q1q2_score": 0.3179532857085877}}
{"text": "theory CallArityEnd2End\nimports ArityTransform CoCallAnalysisImpl\nbegin\n\nlocale CallArityEnd2End\nbegin\nsublocale CoCallAnalysisImpl.\n\nlemma fresh_var_eqE[elim_format]: \"fresh_var e = x \\<Longrightarrow> x \\<notin>  fv e\"\n  by (metis fresh_var_not_free)\n\nlemma example1:\n  fixes e :: exp\n  fixes f g x y z :: var\n  assumes Aexp_e: \"\\<And>a. Aexp e\\<cdot>a = esing x\\<cdot>(up\\<cdot>a) \\<squnion> esing y\\<cdot>(up\\<cdot>a)\"\n  assumes ccExp_e: \"\\<And>a. CCexp e\\<cdot>a = \\<bottom>\"\n  assumes [simp]: \"transform 1 e = e\"\n  assumes \"isVal e\"\n  assumes disj: \"y \\<noteq> f\" \"y \\<noteq> g\" \"x \\<noteq> y\" \"z \\<noteq> f\" \"z \\<noteq> g\" \"y \\<noteq> x\"\n  assumes fresh: \"atom z \\<sharp> e\"\n  shows \"transform 1 (let y be  App (Var f) g in (let x be e in (Var x))) = \n         let y be (Lam [z]. App (App (Var f) g) z) in (let x be (Lam [z]. App e z) in (Var x))\"\nproof-\n  from arg_cong[where f = edom, OF Aexp_e]\n  have \"x \\<in> fv e\" by simp (metis Aexp_edom' insert_subset)\n  hence [simp]: \"\\<not> nonrec [(x,e)]\"\n    by (simp add: nonrec_def)\n \n  from \\<open>isVal e\\<close>\n  have [simp]: \"thunks [(x, e)] = {}\"\n    by (simp add: thunks_Cons)\n\n  have [simp]: \"CCfix [(x, e)]\\<cdot>(esing x\\<cdot>(up\\<cdot>1) \\<squnion> esing y\\<cdot>(up\\<cdot>1), \\<bottom>) = \\<bottom>\"\n    unfolding CCfix_def\n    apply (simp add: fix_bottom_iff ccBindsExtra_simp)\n    apply (simp add: ccBind_eq disj ccExp_e)\n    done\n\n  have [simp]: \"Afix [(x, e)]\\<cdot>(esing x\\<cdot>(up\\<cdot>1)) = esing x\\<cdot>(up\\<cdot>1) \\<squnion> esing y\\<cdot>(up\\<cdot>1)\"\n    unfolding Afix_def\n    apply simp\n    apply (rule fix_eqI)\n    apply (simp add: disj Aexp_e)\n    apply (case_tac \"z x\")\n    apply (auto simp add: disj Aexp_e)\n    done\n\n  have [simp]: \"Aheap [(y, App (Var f) g)] (let x be e in Var x)\\<cdot>1 = esing y\\<cdot>((Aexp (let x be e in Var x )\\<cdot>1) y)\"\n    by (auto simp add:  Aheap_nonrec_simp ABind_nonrec_eq pure_fresh fresh_at_base disj)\n\n  have [simp]: \"(Aexp (let x be e in Var x)\\<cdot>1) = esing y\\<cdot>(up\\<cdot>1)\"\n    by (simp add: env_restr_join disj)\n    \n  have [simp]: \"Aheap [(x, e)] (Var x)\\<cdot>1 = esing x\\<cdot>(up\\<cdot>1)\"\n    by (simp add: env_restr_join disj)\n\n  have 1: \"1 = inc\\<cdot>0\" apply (simp add: inc_def) apply transfer apply simp done\n  \n  have [simp]: \"Aeta_expand 1 (App (Var f) g) = (Lam [z]. App (App (Var f) g) z)\"\n    apply (simp add: 1 del: exp_assn.eq_iff)\n    apply (subst change_Lam_Variable[of z \"fresh_var (App (Var f) g)\"])\n    apply (auto simp add: fresh_Pair fresh_at_base pure_fresh disj intro!: flip_fresh_fresh  elim!: fresh_var_eqE)\n    done\n\n  have [simp]: \"Aeta_expand 1 e = (Lam [z]. App e z)\"\n    apply (simp add: 1 del: exp_assn.eq_iff)\n    apply (subst change_Lam_Variable[of z \"fresh_var e\"])\n    apply (auto simp add: fresh_Pair fresh_at_base pure_fresh disj fresh intro!: flip_fresh_fresh  elim!: fresh_var_eqE)\n    done\n\n  show ?thesis\n    by (simp del: Let_eq_iff add: map_transform_Cons map_transform_Nil disj[symmetric])\nqed\n\nend\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/CallArityEnd2End.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6261241772283033, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.31795328570858766}}
{"text": "(*******************************************************************************\n\n  Project: Development of Security Protocols by Refinement\n\n  Module:  Refinement/a0i_agree.thy (Isabelle/HOL 2016-1)\n  ID:      $Id: a0i_agree.thy 134924 2017-05-24 17:23:15Z csprenge $\n  Author:  Christoph Sprenger, ETH Zurich <sprenger@inf.ethz.ch>\n  \n  One-Way authentication protocols\n  Initial Model: Injective agreement\n\n  Copyright (c) 2009-2016 Christoph Sprenger\n  Licence: LGPL\n\n*******************************************************************************)\n\nsection \\<open>Injective Agreement\\<close>\n\ntheory a0i_agree imports a0n_agree\nbegin\n\ntext \\<open>This refinement adds injectiveness to the agreement property.\\<close>\n\n\n(******************************************************************************)\nsubsection \\<open>State\\<close>\n(******************************************************************************)\n\ntext \\<open>The state and observations are the same as in the previous model.\\<close>\n\ntype_synonym\n  'd a0i_state = \"'d a0n_state\"\n\ntype_synonym\n  'd a0i_obs = \"'d a0n_obs\"\n\n\n(******************************************************************************)\nsubsection \\<open>Events\\<close>\n(******************************************************************************)\n\ntext \\<open>We just refine the commit event. Everything else remains the same.\\<close>\n\nabbreviation\n  a0i_init :: \"'ds a0n_state set\"\nwhere\n  \"a0i_init \\<equiv> a0n_init\"\n\nabbreviation\n  a0i_running :: \"[agent list, 'ds] \\<Rightarrow> ('ds a0i_state \\<times> 'ds a0i_state) set\"\nwhere \n  \"a0i_running \\<equiv> a0n_running\"\n\ndefinition \n  a0i_commit :: \n    \"[agent list, 'ds] \\<Rightarrow> ('ds a0i_state \\<times> 'ds a0i_state) set\"\nwhere \n  \"a0i_commit h d \\<equiv> {(s, s').\n    \\<comment> \\<open>guards:\\<close>\n    (set h \\<subseteq> good \\<longrightarrow> d \\<notin> corrupted s \\<longrightarrow>\n       signals s (Commit h d) < signals s (Running h d)) \\<and>\n\n    \\<comment> \\<open>actions:\\<close>\n    s' = s\\<lparr> \n      signals := (signals s)(Commit h d := signals s (Commit h d) + 1) \n    \\<rparr>\n  }\"\n\nabbreviation\n  a0i_corrupt :: \"'ds set \\<Rightarrow> ('ds a0i_state \\<times> 'ds a0i_state) set\"\nwhere \n  \"a0i_corrupt \\<equiv> a0n_corrupt\"\n\n\ntext \\<open>Transition system.\\<close>\n\ndefinition \n  a0i_trans :: \"('ds a0i_state \\<times> 'ds a0i_state) set\" where\n  \"a0i_trans \\<equiv> (\\<Union> h d ds.\n     a0i_running h d \\<union>\n     a0i_commit h d \\<union> \n     a0i_corrupt ds \\<union> \n     Id\n  )\"\n\ndefinition \n  a0i :: \"('ds a0i_state, 'ds a0i_obs) spec\" where\n  \"a0i \\<equiv> \\<lparr>\n    init = a0i_init,\n    trans = a0i_trans, \n    obs = id\n  \\<rparr>\"\n\nlemmas a0i_defs = \n  a0n_defs a0i_def a0i_trans_def a0i_commit_def\n\n\ntext \\<open>Any property is trivially observable.\\<close>\n\nlemma a0i_obs [simp]: \"obs a0i = id\"\nby (simp add: a0i_def)\n\nlemma a0i_anyP_observable [iff]: \"observable (obs a0i) P\"\nby (auto)  \n\n\n(******************************************************************************)\nsubsection \\<open>Invariants\\<close>\n(******************************************************************************)\n\nsubsubsection \\<open>Injective agreement.\\<close>\n(******************************************************************************)\n\ndefinition \n  a0i_inv1_iagree :: \"'ds a0i_state set\" \nwhere\n  \"a0i_inv1_iagree \\<equiv> {s. \\<forall>h d.\n     set h \\<subseteq> good \\<longrightarrow> d \\<notin> corrupted s \\<longrightarrow>\n       signals s (Commit h d) \\<le> signals s (Running h d)\n  }\"\n\nlemmas a0i_inv1_iagreeI = \n  a0i_inv1_iagree_def [THEN setc_def_to_intro, rule_format]\nlemmas a0i_inv1_iagreeE [elim] = \n  a0i_inv1_iagree_def [THEN setc_def_to_elim, rule_format]\nlemmas a0i_inv1_iagreeD = \n  a0i_inv1_iagree_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\n\nlemma PO_a0i_inv1_iagree_init [iff]:\n  \"init a0i \\<subseteq> a0i_inv1_iagree\"\nby (auto simp add: a0i_defs intro!: a0i_inv1_iagreeI)\n\nlemma PO_a0i_inv1_iagree_trans [iff]:\n  \"{a0i_inv1_iagree} trans a0i {> a0i_inv1_iagree}\"\napply (auto simp add: PO_hoare_defs a0i_defs intro!: a0i_inv1_iagreeI)\napply (auto dest: a0i_inv1_iagreeD intro: le_SucI)\ndone\n\nlemma PO_a0i_inv1_iagree [iff]: \"reach a0i \\<subseteq> a0i_inv1_iagree\"\nby (rule inv_rule_basic) (auto)\n\n\ntext \\<open>As an external invariant.\\<close>\n\nlemma PO_a0i_obs_inv1_iagree [iff]: \"oreach a0i \\<subseteq> a0i_inv1_iagree\"\napply (rule external_from_internal_invariant, fast) \napply (subst a0i_def, auto)\ndone\n\n\n(******************************************************************************)\nsubsection \\<open>Refinement\\<close>\n(******************************************************************************)\n\ndefinition\n  med0n0i :: \"'d a0i_obs \\<Rightarrow> 'd a0i_obs\"\nwhere\n  \"med0n0i \\<equiv> id\"\n\ndefinition\n  R0n0i :: \"('d a0n_state \\<times> 'd a0i_state) set\"\nwhere\n  \"R0n0i \\<equiv> Id\"\n\nlemma PO_a0i_running_refines_a0n_running:\n  \"{R0n0i} \n     (a0n_running h d), (a0i_running h d) \n   {> R0n0i}\"\nby (unfold R0n0i_def) (rule relhoare_refl)\n\nlemma PO_a0i_commit_refines_a0n_commit:\n  \"{R0n0i} \n     (a0n_commit h d), (a0i_commit h d) \n   {> R0n0i}\"\nby (auto simp add: PO_rhoare_defs R0n0i_def a0i_defs)\n\nlemma PO_a0i_corrupt_refines_a0n_corrupt:\n  \"{R0n0i} \n     (a0n_corrupt d), (a0i_corrupt d) \n   {> R0n0i}\"\nby (unfold R0n0i_def) (rule relhoare_refl)\n\nlemmas PO_a0i_trans_refines_a0n_trans = \n  PO_a0i_running_refines_a0n_running\n  PO_a0i_commit_refines_a0n_commit\n  PO_a0i_corrupt_refines_a0n_corrupt\n\n\ntext \\<open>All together now...\\<close>\n\nlemma PO_m1_refines_init_a0n [iff]:\n  \"init a0i \\<subseteq> R0n0i``(init a0n)\"\nby (auto simp add: R0n0i_def a0i_defs)\n\nlemma PO_m1_refines_trans_a0n [iff]:\n  \"{R0n0i} \n     (trans a0n), (trans a0i) \n   {> R0n0i}\"\nby (auto simp add: a0n_def a0n_trans_def a0i_def a0i_trans_def\n         intro!: PO_a0i_trans_refines_a0n_trans)\n\n\nlemma PO_obs_consistent [iff]:\n  \"obs_consistent R0n0i med0n0i a0n a0i\"\nby (auto simp add: obs_consistent_def R0n0i_def med0n0i_def a0i_def a0n_def)\n\nlemma PO_a0i_refines_a0n:\n  \"refines R0n0i med0n0i a0n a0i\"\nby (rule Refinement_basic) (auto)\n\n\n(******************************************************************************)\nsubsection \\<open>Derived invariants\\<close>\n(******************************************************************************)\n\nlemma iagree_implies_niagree [iff]: \"a0i_inv1_iagree \\<subseteq> a0n_inv1_niagree\"\napply (auto intro!: a0n_inv1_niagreeI)\napply (drule_tac d=d in a0i_inv1_iagreeD, auto) \ndone\n\n\ntext \\<open>Non-injective agreeement as internal and external invariants.\\<close>\n\nlemma PO_a0i_a0n_inv1_niagree [iff]: \"reach a0i \\<subseteq> a0n_inv1_niagree\"\nby (rule subset_trans, rule, rule)\n\nlemma PO_a0i_obs_a0n_inv1_niagree [iff]: \"oreach a0i \\<subseteq> a0n_inv1_niagree\"\nby (rule subset_trans, rule, rule)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Refinement/a0i_agree.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381667555713, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.31782058610821956}}
{"text": "(*  Title:       N2M\n    Authors:     Jasmin Blanchette, Andrei Popescu, Dmitriy Traytel\n    Maintainer:  Dmitriy Traytel <traytel at inf.ethz.ch>\n*)\n\nsection \\<open>Mutual View on Nested Datatypes\\<close>\n\n(*<*)\ntheory N2M\n  imports \"HOL-Library.BNF_Axiomatization\"\nbegin\n(*>*)\n\nnotation BNF_Def.convol (\"<_, _>\")\n\ndeclare [[bnf_internals]]\n\ndeclare [[typedef_overloaded]]\n\nbnf_axiomatization ('a, 'b) F0 [wits: \"'a \\<Rightarrow> ('a, 'b) F0\"]\nbnf_axiomatization ('a, 'b) G0 [wits: \"'a \\<Rightarrow> ('a, 'b) G0\"]\n\n\nsubsection \\<open>Nested Definition\\<close>\n\ndatatype 'a F = CF \"('a, 'a F) F0\"\ndatatype 'a G = CG \"('a, ('a G) F) G0\"\n\ntype_synonym ('b, 'c) F_pre_F = \"('c, 'b) F0\"\ntype_synonym ('c, 'a) G_pre_G = \"('a, 'c F) G0\"\n\nterm \"ctor_fold_F :: (('b, 'c) F_pre_F \\<Rightarrow> 'b) \\<Rightarrow> 'c F \\<Rightarrow> 'b\"\nterm \"ctor_fold_G :: (('c, 'a) G_pre_G \\<Rightarrow> 'c) \\<Rightarrow> 'a G \\<Rightarrow> 'c\"\nterm \"ctor_rec_F :: (('c F \\<times> 'b, 'c) F_pre_F \\<Rightarrow> 'b) \\<Rightarrow> 'c F \\<Rightarrow> 'b\"\nterm \"ctor_rec_G :: (('a G \\<times> 'c, 'a) G_pre_G \\<Rightarrow> 'c) \\<Rightarrow> 'a G \\<Rightarrow> 'c\"\nthm F.ctor_rel_induct\nthm G.ctor_rel_induct[unfolded rel_pre_G_def id_apply]\n\n\nsubsection \\<open>Isomorphic Mutual Definition\\<close>\n\ndatatype 'a G\\<^sub>M = CG \"('a, 'a GF\\<^sub>M) G0\"\n  and  'a GF\\<^sub>M = CF \"('a G\\<^sub>M, 'a GF\\<^sub>M) F0\"\n\ntype_synonym ('b, 'c) GF\\<^sub>M_pre_GF\\<^sub>M = \"('c, 'b) F0\"\ntype_synonym ('c, 'a) G\\<^sub>M_pre_G\\<^sub>M = \"('a, 'c) G0\"\n\nterm \"ctor_fold_G\\<^sub>M :: (('c, 'a) G\\<^sub>M_pre_G\\<^sub>M \\<Rightarrow> 'b) \\<Rightarrow> (('c, 'b) GF\\<^sub>M_pre_GF\\<^sub>M \\<Rightarrow> 'c) \\<Rightarrow> 'a G\\<^sub>M \\<Rightarrow> 'b\"\nterm \"ctor_fold_GF\\<^sub>M :: (('c, 'a) G\\<^sub>M_pre_G\\<^sub>M \\<Rightarrow> 'b) \\<Rightarrow> (('c, 'b) GF\\<^sub>M_pre_GF\\<^sub>M \\<Rightarrow> 'c) \\<Rightarrow> 'a GF\\<^sub>M \\<Rightarrow> 'c\"\nterm \"ctor_rec_G\\<^sub>M :: (('a GF\\<^sub>M \\<times> 'c, 'a) G\\<^sub>M_pre_G\\<^sub>M \\<Rightarrow> 'b) \\<Rightarrow> (('a GF\\<^sub>M \\<times> 'c, 'a G\\<^sub>M \\<times> 'b) GF\\<^sub>M_pre_GF\\<^sub>M \\<Rightarrow> 'c) \\<Rightarrow> 'a G\\<^sub>M \\<Rightarrow> 'b\"\nterm \"ctor_rec_GF\\<^sub>M :: (('a GF\\<^sub>M \\<times> 'c, 'a) G\\<^sub>M_pre_G\\<^sub>M \\<Rightarrow> 'b) \\<Rightarrow> (('a GF\\<^sub>M \\<times> 'c, 'a G\\<^sub>M \\<times> 'b) GF\\<^sub>M_pre_GF\\<^sub>M \\<Rightarrow> 'c) \\<Rightarrow> 'a GF\\<^sub>M \\<Rightarrow> 'c\"\nthm G\\<^sub>M_GF\\<^sub>M.ctor_rel_induct[unfolded rel_pre_G\\<^sub>M_def rel_pre_GF\\<^sub>M_def]\n\nsubsection \\<open>Mutualization\\<close>\n\nsubsubsection \\<open>Iterators\\<close>\n\ndefinition n2m_ctor_fold_G :: \"(('c, 'a) G\\<^sub>M_pre_G\\<^sub>M \\<Rightarrow> 'b) \\<Rightarrow> (('c, 'b) GF\\<^sub>M_pre_GF\\<^sub>M \\<Rightarrow> 'c) \\<Rightarrow> 'a G \\<Rightarrow> 'b\"\n  where \"n2m_ctor_fold_G s1 s2 = ctor_fold_G (s1 o\n    map_pre_G\\<^sub>M id (id :: unit \\<Rightarrow> unit) (ctor_fold_F (s2 o BNF_Composition.id_bnf o BNF_Composition.id_bnf)) o BNF_Composition.id_bnf o BNF_Composition.id_bnf)\"\ndefinition n2m_ctor_fold_G_F :: \"(('c, 'a) G\\<^sub>M_pre_G\\<^sub>M \\<Rightarrow> 'b) \\<Rightarrow> (('c, 'b) GF\\<^sub>M_pre_GF\\<^sub>M \\<Rightarrow> 'c) \\<Rightarrow> 'a G F \\<Rightarrow> 'c\"\n  where \"n2m_ctor_fold_G_F s1 s2 = ctor_fold_F (s2 o map_pre_GF\\<^sub>M (id :: unit \\<Rightarrow> unit) (n2m_ctor_fold_G s1 s2) id o BNF_Composition.id_bnf o BNF_Composition.id_bnf)\"\n\n\n\nlemma G_ctor_o_rec: \"ctor_rec_G s o ctor_G = s o map_pre_G id (BNF_Def.convol id (ctor_rec_G s))\"\n  unfolding fun_eq_iff o_apply G.ctor_rec by simp\nlemma F_ctor_o_rec: \"ctor_rec_F s o ctor_F = s o map_pre_F id (BNF_Def.convol id (ctor_rec_F s))\"\n  unfolding fun_eq_iff o_apply F.ctor_rec by simp\n\nlemma n2m_ctor_fold_G:\n  \"n2m_ctor_fold_G s1 s2 o ctor_G = s1 o map_pre_G\\<^sub>M id id (n2m_ctor_fold_G_F s1 s2) o BNF_Composition.id_bnf o BNF_Composition.id_bnf\"\n  unfolding n2m_ctor_fold_G_def n2m_ctor_fold_G_F_def\n    map_pre_G_def map_pre_F_def map_pre_G\\<^sub>M_def map_pre_GF\\<^sub>M_def\n    G_ctor_o_fold id_apply comp_id id_comp comp_assoc\n    rewriteL_comp_comp[OF type_copy_map_comp0_undo[OF BNF_Composition.type_definition_id_bnf_UNIV BNF_Composition.type_definition_id_bnf_UNIV BNF_Composition.type_definition_id_bnf_UNIV pre_G\\<^sub>M.map_comp0[unfolded map_pre_G\\<^sub>M_def]]]\n    F.ctor_fold_o_map\n    rewriteL_comp_comp[OF type_copy_Rep_o_Abs[OF BNF_Composition.type_definition_id_bnf_UNIV]] ..\n\nlemma n2m_ctor_fold_G_F:\n  \"n2m_ctor_fold_G_F s1 s2 o ctor_F = s2 o map_pre_GF\\<^sub>M id (n2m_ctor_fold_G s1 s2) (n2m_ctor_fold_G_F s1 s2) o BNF_Composition.id_bnf o BNF_Composition.id_bnf\"\n  unfolding n2m_ctor_fold_G_F_def map_pre_F_def map_pre_G\\<^sub>M_def map_pre_GF\\<^sub>M_def\n    F_ctor_o_fold id_apply comp_id id_comp comp_assoc\n    rewriteL_comp_comp[OF F0.map_comp0[symmetric]]\n    rewriteL_comp_comp[OF type_copy_Rep_o_Abs[OF BNF_Composition.type_definition_id_bnf_UNIV]] ..\n\nsubsubsection \\<open>Recursors\\<close>\n\ndefinition n2m_ctor_rec_G ::\n  \"(('a G F \\<times> 'c, 'a) G\\<^sub>M_pre_G\\<^sub>M \\<Rightarrow> 'b) \\<Rightarrow> (('a G F \\<times> 'c, 'a G \\<times> 'b) GF\\<^sub>M_pre_GF\\<^sub>M \\<Rightarrow> 'c) \\<Rightarrow> 'a G \\<Rightarrow> 'b\"\n  where \"n2m_ctor_rec_G s1 s2 =\n    ctor_rec_G (s1 o\n      map_pre_G\\<^sub>M id (id :: unit \\<Rightarrow> unit)\n        (BNF_Def.convol (map_F fst) (ctor_rec_F (s2 o map_pre_GF\\<^sub>M (id :: unit \\<Rightarrow> unit) id (map_prod (map_F fst) id) o BNF_Composition.id_bnf o BNF_Composition.id_bnf))) o\n      BNF_Composition.id_bnf o BNF_Composition.id_bnf)\"\n\ndefinition n2m_ctor_rec_G_F ::\n  \"(('a G F \\<times> 'c, 'a) G\\<^sub>M_pre_G\\<^sub>M \\<Rightarrow> 'b) \\<Rightarrow> (('a G F \\<times> 'c, 'a G \\<times> 'b) GF\\<^sub>M_pre_GF\\<^sub>M \\<Rightarrow> 'c) \\<Rightarrow> 'a G F \\<Rightarrow> 'c\"\n  where \"n2m_ctor_rec_G_F s1 s2 = ctor_rec_F (s2 o map_pre_GF\\<^sub>M (id :: unit \\<Rightarrow> unit) (BNF_Def.convol id (n2m_ctor_rec_G s1 s2)) id o BNF_Composition.id_bnf o BNF_Composition.id_bnf)\"\n\nlemma n2m_ctor_rec_G:\n  \"n2m_ctor_rec_G s1 s2 o ctor_G = s1 o map_pre_G\\<^sub>M id id (BNF_Def.convol id (n2m_ctor_rec_G_F s1 s2)) o BNF_Composition.id_bnf o BNF_Composition.id_bnf\"\n  unfolding n2m_ctor_rec_G_def n2m_ctor_rec_G_F_def\n    map_pre_G_def map_pre_F_def map_pre_G\\<^sub>M_def map_pre_GF\\<^sub>M_def\n    G_ctor_o_rec\n    id_apply comp_id id_comp comp_assoc map_prod.comp map_prod.id\n    fst_convol map_prod_o_convol convol_o\n    rewriteL_comp_comp[OF G0.map_comp0[symmetric]]\n    rewriteL_comp_comp[OF F0.map_comp0[symmetric]]\n    F.map_comp0[symmetric] F.map_id0\n    F.ctor_rec_o_map\n    rewriteL_comp_comp[OF type_copy_Rep_o_Abs[OF BNF_Composition.type_definition_id_bnf_UNIV]] ..\n\nlemma n2m_ctor_rec_G_F:\n  \"n2m_ctor_rec_G_F s1 s2 o ctor_F = s2 o map_pre_GF\\<^sub>M id (BNF_Def.convol id (n2m_ctor_rec_G s1 s2)) (BNF_Def.convol id (n2m_ctor_rec_G_F s1 s2)) o BNF_Composition.id_bnf o BNF_Composition.id_bnf\"\n  unfolding n2m_ctor_rec_G_F_def map_pre_F_def map_pre_G\\<^sub>M_def map_pre_GF\\<^sub>M_def\n    F_ctor_o_rec id_apply comp_id id_comp comp_assoc\n    rewriteL_comp_comp[OF F0.map_comp0[symmetric]]\n    rewriteL_comp_comp[OF type_copy_Rep_o_Abs[OF BNF_Composition.type_definition_id_bnf_UNIV]] ..\n\nsubsubsection \\<open>Induction\\<close>\n\nlemma n2m_rel_induct_G_G_F:\n  assumes IH1: \"\\<forall>x y. BNF_Def.vimage2p (BNF_Composition.id_bnf o BNF_Composition.id_bnf) (BNF_Composition.id_bnf o BNF_Composition.id_bnf) (rel_pre_G\\<^sub>M P R S) x y \\<longrightarrow> R (ctor_G x) (ctor_G y)\"\n    and     IH2: \"\\<forall>x y. BNF_Def.vimage2p (BNF_Composition.id_bnf o BNF_Composition.id_bnf) (BNF_Composition.id_bnf o BNF_Composition.id_bnf) (rel_pre_GF\\<^sub>M P R S) x y \\<longrightarrow> S (ctor_F x) (ctor_F y)\"\n  shows \"rel_G P \\<le> R \\<and> rel_F (rel_G P) \\<le> S\"\n  apply (rule context_conjI)\n  apply (rule G.ctor_rel_induct[unfolded rel_pre_G_def id_apply vimage2p_def o_apply])\n  apply (erule mp[OF spec2[OF IH1], OF vimage2p_mono[OF _ pre_G\\<^sub>M.rel_mono], unfolded vimage2p_def o_apply rel_pre_G\\<^sub>M_def type_definition.Abs_inverse[OF BNF_Composition.type_definition_id_bnf_UNIV UNIV_I]])\n  apply (rule order_refl)\n  apply (rule order_refl)\n  apply (rule F.ctor_rel_induct[unfolded rel_pre_F_def id_apply vimage2p_def o_apply])\n  apply (erule mp[OF spec2[OF IH2], unfolded vimage2p_def o_apply rel_pre_GF\\<^sub>M_def type_definition.Abs_inverse[OF BNF_Composition.type_definition_id_bnf_UNIV UNIV_I]])\n\n  apply (rule F.ctor_rel_induct[unfolded rel_pre_F_def id_apply vimage2p_def o_apply])\n  apply (erule mp[OF spec2[OF IH2], OF vimage2p_mono[OF _ pre_GF\\<^sub>M.rel_mono], unfolded vimage2p_def o_apply rel_pre_GF\\<^sub>M_def type_definition.Abs_inverse[OF BNF_Composition.type_definition_id_bnf_UNIV UNIV_I]])\n  apply (rule order_refl)\n  apply assumption\n  apply (rule order_refl)\n  done\n\nlemmas n2m_ctor_induct_G_G_F = spec[OF spec [OF\n      n2m_rel_induct_G_G_F[of \"(=)\" \"BNF_Def.Grp (Collect R) id\" \"BNF_Def.Grp (Collect S) id\" for R S,\n        unfolded G.rel_eq F.rel_eq eq_le_Grp_id_iff all_simps(1,2)[symmetric]]],\n    unfolded eq_alt pre_G\\<^sub>M.rel_Grp pre_GF\\<^sub>M.rel_Grp pre_G\\<^sub>M.map_id0 pre_GF\\<^sub>M.map_id0,\n    unfolded vimage2p_comp vimage2p_id comp_apply comp_id Grp_id_mono_subst\n    type_copy_vimage2p_Grp_Rep[OF BNF_Composition.type_definition_id_bnf_UNIV]\n    type_copy_Abs_o_Rep[OF BNF_Composition.type_definition_id_bnf_UNIV]\n    eqTrueI[OF subset_UNIV] simp_thms(22)\n    atomize_conjL[symmetric] atomize_all[symmetric] atomize_imp[symmetric],\n    unfolded subset_iff mem_Collect_eq]\n\n\nsection \\<open>Mutual View on Nested Coatatypes\\<close>\n\nbnf_axiomatization ('a, 'b) coF0\nbnf_axiomatization ('a, 'b) coG0\n\n\nsubsection \\<open>Nested definition\\<close>\n\ncodatatype 'a coF = CcoF \"('a, 'a coF) coF0\"\ncodatatype 'a coG = CcoG \"('a, ('a coG) coF) coG0\"\n\ntype_synonym ('b, 'c) coF_pre_coF = \"('c, 'b) coF0\"\ntype_synonym ('c, 'a) coG_pre_coG = \"('a, 'c coF) coG0\"\n\nterm \"dtor_unfold_coF :: ('b \\<Rightarrow> ('b, 'c) coF_pre_coF) \\<Rightarrow> 'b \\<Rightarrow> 'c coF\"\nterm \"dtor_unfold_coG :: ('c \\<Rightarrow> ('c, 'a) coG_pre_coG) \\<Rightarrow> 'c \\<Rightarrow> 'a coG\"\nterm \"dtor_corec_coF :: ('b \\<Rightarrow> ('c coF + 'b, 'c) coF_pre_coF) \\<Rightarrow> 'b \\<Rightarrow> 'c coF\"\nterm \"dtor_corec_coG :: ('c \\<Rightarrow> ('a coG + 'c, 'a) coG_pre_coG) \\<Rightarrow> 'c \\<Rightarrow> 'a coG\"\nthm coF.dtor_rel_coinduct\nthm coG.dtor_rel_coinduct[unfolded rel_pre_coG_def id_apply]\n\n\nsubsection \\<open>Isomorphic Mutual Definition\\<close>\n\ncodatatype 'a coG\\<^sub>M = CcoG \"('a, 'a coGcoF\\<^sub>M) coG0\"\n  and  'a coGcoF\\<^sub>M = CcoF \"('a coG\\<^sub>M, 'a coGcoF\\<^sub>M) coF0\"\n\ntype_synonym ('b, 'c) coGcoF\\<^sub>M_pre_coGcoF\\<^sub>M = \"('c, 'b) coF0\"\ntype_synonym ('c, 'a) coG\\<^sub>M_pre_coG\\<^sub>M = \"('a, 'c) coG0\"\n\nterm \"dtor_unfold_coG\\<^sub>M :: ('b \\<Rightarrow> ('c, 'a) coG\\<^sub>M_pre_coG\\<^sub>M) \\<Rightarrow> ('c \\<Rightarrow> ('c, 'b) coGcoF\\<^sub>M_pre_coGcoF\\<^sub>M) \\<Rightarrow> 'b \\<Rightarrow> 'a coG\\<^sub>M\"\nterm \"dtor_unfold_coGcoF\\<^sub>M :: ('b \\<Rightarrow> ('c, 'a) coG\\<^sub>M_pre_coG\\<^sub>M) \\<Rightarrow> ('c \\<Rightarrow> ('c, 'b) coGcoF\\<^sub>M_pre_coGcoF\\<^sub>M) \\<Rightarrow> 'c \\<Rightarrow> 'a coGcoF\\<^sub>M\"\nterm \"dtor_corec_coG\\<^sub>M :: ('b \\<Rightarrow> ('a coGcoF\\<^sub>M + 'c, 'a) coG\\<^sub>M_pre_coG\\<^sub>M) \\<Rightarrow> ('c \\<Rightarrow> ('a coGcoF\\<^sub>M + 'c, 'a coG\\<^sub>M + 'b) coGcoF\\<^sub>M_pre_coGcoF\\<^sub>M) \\<Rightarrow> 'b \\<Rightarrow> 'a coG\\<^sub>M\"\nterm \"dtor_corec_coGcoF\\<^sub>M :: ('b \\<Rightarrow> ('a coGcoF\\<^sub>M + 'c, 'a) coG\\<^sub>M_pre_coG\\<^sub>M) \\<Rightarrow> ('c \\<Rightarrow> ('a coGcoF\\<^sub>M + 'c, 'a coG\\<^sub>M + 'b) coGcoF\\<^sub>M_pre_coGcoF\\<^sub>M) \\<Rightarrow> 'c \\<Rightarrow> 'a coGcoF\\<^sub>M\"\nthm coG\\<^sub>M_coGcoF\\<^sub>M.dtor_rel_coinduct[unfolded rel_pre_coG\\<^sub>M_def rel_pre_coGcoF\\<^sub>M_def]\n\nsubsection \\<open>Mutualization\\<close>\n\nsubsubsection \\<open>Coiterators\\<close>\n\ndefinition n2m_dtor_unfold_coG :: \"('b \\<Rightarrow> ('c, 'a) coG\\<^sub>M_pre_coG\\<^sub>M) \\<Rightarrow> ('c \\<Rightarrow> ('c, 'b) coGcoF\\<^sub>M_pre_coGcoF\\<^sub>M) \\<Rightarrow> 'b \\<Rightarrow> 'a coG\"\n  where \"n2m_dtor_unfold_coG s1 s2 = dtor_unfold_coG (BNF_Composition.id_bnf o BNF_Composition.id_bnf o\n    map_pre_coG\\<^sub>M id (id :: unit \\<Rightarrow> unit) (dtor_unfold_coF (BNF_Composition.id_bnf o BNF_Composition.id_bnf o s2)) o s1)\"\ndefinition n2m_dtor_unfold_coG_coF :: \"('b \\<Rightarrow> ('c, 'a) coG\\<^sub>M_pre_coG\\<^sub>M) \\<Rightarrow> ('c \\<Rightarrow> ('c, 'b) coGcoF\\<^sub>M_pre_coGcoF\\<^sub>M) \\<Rightarrow> 'c \\<Rightarrow> 'a coG coF\"\n  where \"n2m_dtor_unfold_coG_coF s1 s2 = dtor_unfold_coF (BNF_Composition.id_bnf o BNF_Composition.id_bnf o map_pre_coGcoF\\<^sub>M (id :: unit \\<Rightarrow> unit) (n2m_dtor_unfold_coG s1 s2) id o s2)\"\n\nlemma coG_dtor_o_unfold: \"dtor_coG o dtor_unfold_coG s = map_pre_coG id (dtor_unfold_coG s) o s\"\n  unfolding fun_eq_iff o_apply coG.dtor_unfold by simp\nlemma coF_dtor_o_unfold: \"dtor_coF o dtor_unfold_coF s = map_pre_coF id (dtor_unfold_coF s) o s\"\n  unfolding fun_eq_iff o_apply coF.dtor_unfold by simp\n\nlemma coG_dtor_o_corec: \"dtor_coG o dtor_corec_coG s = map_pre_coG id (case_sum id (dtor_corec_coG s)) o s\"\n  unfolding fun_eq_iff o_apply coG.dtor_corec by simp\nlemma coF_dtor_o_corec: \"dtor_coF o dtor_corec_coF s = map_pre_coF id (case_sum id (dtor_corec_coF s)) o s\"\n  unfolding fun_eq_iff o_apply coF.dtor_corec by simp\n\nlemma n2m_dtor_unfold_coG:\n  \"dtor_coG o n2m_dtor_unfold_coG s1 s2 = BNF_Composition.id_bnf o BNF_Composition.id_bnf o map_pre_coG\\<^sub>M id id (n2m_dtor_unfold_coG_coF s1 s2) o s1\"\n  unfolding n2m_dtor_unfold_coG_def n2m_dtor_unfold_coG_coF_def\n    map_pre_coG_def map_pre_coF_def map_pre_coG\\<^sub>M_def map_pre_coGcoF\\<^sub>M_def\n    coG_dtor_o_unfold id_apply comp_id id_comp comp_assoc\n    rewriteL_comp_comp[OF type_copy_map_comp0_undo[OF BNF_Composition.type_definition_id_bnf_UNIV BNF_Composition.type_definition_id_bnf_UNIV BNF_Composition.type_definition_id_bnf_UNIV pre_coG\\<^sub>M.map_comp0[unfolded map_pre_coG\\<^sub>M_def]]]\n    coF.dtor_unfold_o_map\n    rewriteL_comp_comp[OF type_copy_Rep_o_Abs[OF BNF_Composition.type_definition_id_bnf_UNIV]] ..\n\nlemma n2m_dtor_unfold_coG_coF:\n  \"dtor_coF o n2m_dtor_unfold_coG_coF s1 s2 = BNF_Composition.id_bnf o BNF_Composition.id_bnf o map_pre_coGcoF\\<^sub>M id (n2m_dtor_unfold_coG s1 s2) (n2m_dtor_unfold_coG_coF s1 s2) o s2\"\n  unfolding n2m_dtor_unfold_coG_coF_def map_pre_coF_def map_pre_coG\\<^sub>M_def map_pre_coGcoF\\<^sub>M_def\n    coF_dtor_o_unfold id_apply comp_id id_comp comp_assoc\n    rewriteL_comp_comp[OF coF0.map_comp0[symmetric]]\n    rewriteL_comp_comp[OF type_copy_Rep_o_Abs[OF BNF_Composition.type_definition_id_bnf_UNIV]] ..\n\nsubsubsection \\<open>Corecursors\\<close>\n\ndefinition n2m_dtor_corec_coG ::\n  \"('b \\<Rightarrow> ('a coG coF + 'c, 'a) coG\\<^sub>M_pre_coG\\<^sub>M) \\<Rightarrow> ('c \\<Rightarrow> ('a coG coF + 'c, 'a coG + 'b) coGcoF\\<^sub>M_pre_coGcoF\\<^sub>M) \\<Rightarrow> 'b \\<Rightarrow> 'a coG\"\n  where \"n2m_dtor_corec_coG s1 s2 =\n    dtor_corec_coG (BNF_Composition.id_bnf o BNF_Composition.id_bnf o\n      map_pre_coG\\<^sub>M id (id :: unit \\<Rightarrow> unit)\n        (case_sum (map_coF Inl) (dtor_corec_coF (BNF_Composition.id_bnf o BNF_Composition.id_bnf o map_pre_coGcoF\\<^sub>M (id :: unit \\<Rightarrow> unit) id (map_sum (map_coF Inl) id) o s2))) o\n      s1)\"\n\ndefinition n2m_dtor_corec_coG_coF ::\n  \"('b \\<Rightarrow> ('a coG coF + 'c, 'a) coG\\<^sub>M_pre_coG\\<^sub>M) \\<Rightarrow> ('c \\<Rightarrow> ('a coG coF + 'c, 'a coG + 'b) coGcoF\\<^sub>M_pre_coGcoF\\<^sub>M) \\<Rightarrow> 'c \\<Rightarrow> 'a coG coF\"\n  where \"n2m_dtor_corec_coG_coF s1 s2 = dtor_corec_coF (BNF_Composition.id_bnf o BNF_Composition.id_bnf o map_pre_coGcoF\\<^sub>M (id :: unit \\<Rightarrow> unit) (case_sum id (n2m_dtor_corec_coG s1 s2)) id o s2)\"\n\nlemma n2m_dtor_corec_coG:\n  \"dtor_coG o n2m_dtor_corec_coG s1 s2 = BNF_Composition.id_bnf o BNF_Composition.id_bnf o map_pre_coG\\<^sub>M id id (case_sum id (n2m_dtor_corec_coG_coF s1 s2)) o s1\"\n  unfolding n2m_dtor_corec_coG_def n2m_dtor_corec_coG_coF_def\n    map_pre_coG_def map_pre_coF_def map_pre_coG\\<^sub>M_def map_pre_coGcoF\\<^sub>M_def\n    coG_dtor_o_corec\n    id_apply comp_id id_comp comp_assoc[symmetric] map_sum.comp map_sum.id\n    case_sum_o_inj(1) case_sum_o_map_sum o_case_sum\n    rewriteR_comp_comp[OF coG0.map_comp0[symmetric]]\n    rewriteR_comp_comp[OF coF0.map_comp0[symmetric]]\n    coF.map_comp0[symmetric] coF.map_id0\n    coF.dtor_corec_o_map\n    rewriteR_comp_comp[OF type_copy_Rep_o_Abs[OF BNF_Composition.type_definition_id_bnf_UNIV]] ..\n\nlemma n2m_dtor_corec_coG_coF:\n  \"dtor_coF o n2m_dtor_corec_coG_coF s1 s2 = BNF_Composition.id_bnf o BNF_Composition.id_bnf o map_pre_coGcoF\\<^sub>M id (case_sum id (n2m_dtor_corec_coG s1 s2)) (case_sum id (n2m_dtor_corec_coG_coF s1 s2)) o s2\"\n  unfolding n2m_dtor_corec_coG_coF_def map_pre_coF_def map_pre_coG\\<^sub>M_def map_pre_coGcoF\\<^sub>M_def\n    coF_dtor_o_corec id_apply comp_id id_comp comp_assoc\n    rewriteL_comp_comp[OF coF0.map_comp0[symmetric]]\n    rewriteL_comp_comp[OF type_copy_Rep_o_Abs[OF BNF_Composition.type_definition_id_bnf_UNIV]] ..\n\nsubsubsection \\<open>Coinduction\\<close>\n\nlemma n2m_rel_coinduct_coG_coG_coF:\n  assumes CIH1: \"\\<forall>x y. R x y \\<longrightarrow> BNF_Def.vimage2p (BNF_Composition.id_bnf o BNF_Composition.id_bnf) (BNF_Composition.id_bnf o BNF_Composition.id_bnf) (rel_pre_coG\\<^sub>M P R S) (dtor_coG x) (dtor_coG y)\"\n    and     CIH2: \"\\<forall>x y. S x y \\<longrightarrow> BNF_Def.vimage2p (BNF_Composition.id_bnf o BNF_Composition.id_bnf) (BNF_Composition.id_bnf o BNF_Composition.id_bnf) (rel_pre_coGcoF\\<^sub>M P R S) (dtor_coF x) (dtor_coF y)\"\n  shows \"R \\<le> rel_coG P \\<and> S \\<le> rel_coF (rel_coG P)\"\n  apply (rule context_conjI)\n  apply (rule coG.dtor_rel_coinduct[unfolded rel_pre_coG_def id_apply vimage2p_def o_apply])\n  apply (erule mp[OF spec2[OF CIH1], THEN vimage2p_mono[OF _ pre_coG\\<^sub>M.rel_mono], unfolded vimage2p_def o_apply rel_pre_coG\\<^sub>M_def type_definition.Abs_inverse[OF BNF_Composition.type_definition_id_bnf_UNIV UNIV_I]])\n  apply (rule order_refl)\n  apply (rule order_refl)\n  apply (rule coF.dtor_rel_coinduct[unfolded rel_pre_coF_def id_apply vimage2p_def o_apply])\n  apply (erule mp[OF spec2[OF CIH2], unfolded vimage2p_def o_apply rel_pre_coGcoF\\<^sub>M_def type_definition.Abs_inverse[OF BNF_Composition.type_definition_id_bnf_UNIV UNIV_I]])\n\n  apply (rule coF.dtor_rel_coinduct[unfolded rel_pre_coF_def id_apply vimage2p_def o_apply])\n  apply (erule mp[OF spec2[OF CIH2], THEN vimage2p_mono[OF _ pre_coGcoF\\<^sub>M.rel_mono], unfolded vimage2p_def o_apply rel_pre_coGcoF\\<^sub>M_def type_definition.Abs_inverse[OF BNF_Composition.type_definition_id_bnf_UNIV UNIV_I]])\n  apply (rule order_refl)\n  apply assumption\n  apply (rule order_refl)\n  done\n\nlemmas n2m_ctor_induct_coG_coG_coF = spec[OF spec[OF spec[OF spec[OF\n          n2m_rel_coinduct_coG_coG_coF[of _ \"(=)\",\n            unfolded coG.rel_eq coF.rel_eq le_fun_def le_bool_def all_simps(1,2)[symmetric]]]]]]\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BNF_Operations/N2M.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3178205775218163}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(*\n * Tactic for solving monadic equalities, such as:\n *\n * (liftE (return 3) = returnOk 3\n *\n * Theorems of the form:\n *\n *   ((a, s') \\<in> fst (A s)) = P a s s'\n *\n * and\n *\n *   snd (A s) = P s\n *\n * are added to the \"monad_eq\" set.\n *)\ntheory MonadEq\nimports \"Monad_WP/NonDetMonadVCG\"\nbegin\n\n(* Setup \"monad_eq\" attributes. *)\nML \\<open>\nstructure MonadEqThms = Named_Thms (\n    val name = Binding.name \"monad_eq\"\n    val description = \"monad equality-prover theorems\"\n    )\n\\<close>\nattribute_setup monad_eq = \\<open>\n  Attrib.add_del\n    (Thm.declaration_attribute MonadEqThms.add_thm)\n    (Thm.declaration_attribute MonadEqThms.del_thm)\\<close>\n  \"Monad equality-prover theorems\"\n\n(* Setup tactic. *)\n\nML \\<open>\nfun monad_eq_tac ctxt =\nlet\n  (* Set a simpset as being hidden, so warnings are not printed from it. *)\n  val ctxt' = Context_Position.set_visible false ctxt\nin\n  CHANGED (clarsimp_tac (ctxt' addsimps (MonadEqThms.get ctxt')) 1)\nend\n\\<close>\n\nmethod_setup monad_eq = \\<open>\n    Method.sections Clasimp.clasimp_modifiers >> (K (SIMPLE_METHOD o monad_eq_tac))\\<close>\n  \"prove equality on monads\"\n\nlemma monad_eq_simp_state [monad_eq]:\n  \"((A :: ('s, 'a) nondet_monad) s = B s') =\n      ((\\<forall>r t. (r, t) \\<in> fst (A s) \\<longrightarrow> (r, t) \\<in> fst (B s'))\n         \\<and> (\\<forall>r t. (r, t) \\<in> fst (B s') \\<longrightarrow> (r, t) \\<in> fst (A s))\n         \\<and> (snd (A s) = snd (B s')))\"\n  apply (auto intro!: set_eqI prod_eqI)\n  done\n\nlemma monad_eq_simp [monad_eq]:\n  \"((A :: ('s, 'a) nondet_monad) = B) =\n      ((\\<forall>r t s. (r, t) \\<in> fst (A s) \\<longrightarrow> (r, t) \\<in> fst (B s))\n         \\<and> (\\<forall>r t s. (r, t) \\<in> fst (B s) \\<longrightarrow> (r, t) \\<in> fst (A s))\n         \\<and> (\\<forall>x. snd (A x) = snd (B x)))\"\n  apply (auto intro!: set_eqI prod_eqI)\n  done\n\ndeclare in_monad [monad_eq]\ndeclare in_bindE [monad_eq]\n\n(* Test *)\nlemma \"returnOk 3 = liftE (return 3)\"\n  apply monad_eq\n  oops\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/MonadEq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3178205775218163}}
{"text": "(*  Title:       Lib.thy\n    License:     BSD 2-Clause. See LICENSE.\n    Author:      Timothy Bourke\n*)\n\nheader \"Generic functions and lemmas\"\n\ntheory Lib\nimports Main\nbegin\n\ndefinition\n  TT :: \"'a \\<Rightarrow> bool\"\nwhere\n  \"TT = (\\<lambda>_. True)\"\n\nlemma TT_True [intro, simp]: \"TT a\"\n  unfolding TT_def by simp\n\nlemma in_set_tl: \"x \\<in> set (tl xs) \\<Longrightarrow> x \\<in> set xs\"\n  by (metis Nil_tl insert_iff list.collapse set_simps(2))\n\nlemma nat_le_eq_or_lt [elim]:\n    fixes x :: nat\n  assumes \"x \\<le> y\"\n      and eq: \"x = y \\<Longrightarrow> P x y\"\n      and lt: \"x < y \\<Longrightarrow> P x y\"\n    shows \"P x y\"\n  using assms unfolding nat_less_le by auto\n\nlemma disjoint_commute:\n  \"(A \\<inter> B = {}) \\<Longrightarrow> (B \\<inter> A = {})\"\n  by auto\n\ndefinition\n  default :: \"('i \\<Rightarrow> 's) \\<Rightarrow> ('i \\<Rightarrow> 's option) \\<Rightarrow> ('i \\<Rightarrow> 's)\"\nwhere\n  \"default df f = (\\<lambda>i. case f i of None \\<Rightarrow> df i | Some s \\<Rightarrow> s)\"\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/AWN/Lib.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.3178205775218163}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Bisim_Pres\n  imports Weak_Late_Bisim_SC Weak_Late_Sim_Pres Strong_Late_Bisim_SC\nbegin\n\nlemma tauPres:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"\\<tau>.(P) \\<approx> \\<tau>.(Q)\"\nproof -\n  let ?X = \"{(\\<tau>.(P), \\<tau>.(Q)) | P Q. P \\<approx> Q}\"\n  from assms have \"(\\<tau>.(P), \\<tau>.(Q)) \\<in> ?X\" by auto\n  thus ?thesis\n    by(coinduct rule: weakBisimCoinduct)\n      (auto simp add: pi.inject intro:  Weak_Late_Sim_Pres.tauPres symmetric)\nqed\n\nlemma inputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   x :: name\n\n  assumes PSimQ: \"\\<forall>y. P[x::=y] \\<approx> Q[x::=y]\"\n  \n  shows \"a<x>.P \\<approx> a<x>.Q\"\nproof -\n  let ?X = \"{(a<x>.P, a<x>.Q) | a x P Q. \\<forall>y. P[x::=y] \\<approx> Q[x::=y]}\"\n  {\n    fix axP axQ p\n    assume \"(axP, axQ) \\<in> ?X\"\n    then obtain a x P Q where A: \"\\<forall>y. P[x::=y] \\<approx> Q[x::=y]\" and B: \"axP = a<x>.P\" and C: \"axQ = a<x>.Q\"\n      by auto\n    have \"\\<And>y. ((p::name prm) \\<bullet> P)[(p \\<bullet> x)::=y] \\<approx> (p \\<bullet> Q)[(p \\<bullet> x)::=y]\"\n    proof -\n      fix y\n      from A have \"P[x::=(rev p \\<bullet> y)] \\<approx> Q[x::=(rev p \\<bullet> y)]\"\n        by blast\n      hence \"(p \\<bullet> (P[x::=(rev p \\<bullet> y)])) \\<approx> p \\<bullet> (Q[x::=(rev p \\<bullet> y)])\"\n        by(rule eqvtI)\n      thus \"(p \\<bullet> P)[(p \\<bullet> x)::=y] \\<approx> (p \\<bullet> Q)[(p \\<bullet> x)::=y]\"\n        by(simp add: eqvts pt_pi_rev[OF pt_name_inst, OF at_name_inst])\n    qed\n    hence \"((p::name prm) \\<bullet> axP, p \\<bullet> axQ) \\<in> ?X\" using B C\n      by auto\n  }\n  hence \"eqvt ?X\" by(simp add: eqvt_def)\n\n  from PSimQ have \"(a<x>.P, a<x>.Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cSim P Q)\n    thus ?case using \\<open>eqvt ?X\\<close>\n      by(force intro: inputPres)\n  next\n    case(cSym P Q)\n    thus ?case\n      by(blast dest: symmetric)\n  qed\nqed\n\nlemma outputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"a{b}.(P) \\<approx> a{b}.(Q)\"\nproof -\n  let ?X = \"{(a{b}.(P), a{b}.(Q)) | a b P Q. P \\<approx> Q}\"\n  from assms have \"(a{b}.(P), a{b}.(Q)) \\<in> ?X\" by auto\n  thus ?thesis\n    by(coinduct rule: weakBisimCoinduct)\n      (auto simp add: pi.inject intro:  Weak_Late_Sim_Pres.outputPres symmetric)\nqed\n\n\n\n  shows \"<\\<nu>x>P \\<approx> <\\<nu>x>Q\"\nproof -\n  let ?X = \"{x. \\<exists>P Q. P \\<approx> Q \\<and> (\\<exists>a. x = (<\\<nu>a>P, <\\<nu>a>Q))}\"\n  from PBiSimQ have \"(<\\<nu>x>P, <\\<nu>x>Q) \\<in> ?X\" by blast\n  moreover have \"\\<And>P Q a. P \\<leadsto>\\<^sup>^<weakBisim> Q \\<Longrightarrow> <\\<nu>a>P \\<leadsto>\\<^sup>^<(?X \\<union> weakBisim)> <\\<nu>a>Q\"\n  proof -\n    fix P Q a\n    assume PSimQ: \"P \\<leadsto>\\<^sup>^<weakBisim> Q\"\n    moreover have \"\\<And>P Q a. P \\<approx> Q \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> ?X \\<union> weakBisim\" by blast\n    moreover have \"weakBisim \\<subseteq> ?X \\<union> weakBisim\" by blast\n    moreover have \"eqvt weakBisim\" by(rule eqvt)\n    moreover have \"eqvt (?X \\<union> weakBisim)\"\n      by(auto simp add: eqvt_def dest: eqvtI)+\n    ultimately show \"<\\<nu>a>P \\<leadsto>\\<^sup>^<(?X \\<union> weakBisim)> <\\<nu>a>Q\"\n      by(rule Weak_Late_Sim_Pres.resPres)\n  qed\n    \n  ultimately show ?thesis using PBiSimQ\n    by(coinduct rule: weakBisimCoinductAux, blast dest: unfoldE)\nqed\n\n\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"[a\\<frown>b]P \\<approx> [a\\<frown>b]Q\"\nproof -\n  let ?X = \"{([a\\<frown>b]P, [a\\<frown>b]Q) | a b P Q. P \\<approx> Q}\"\n  from assms have \"([a\\<frown>b]P, [a\\<frown>b]Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cSim P Q)\n    {\n      fix P Q a b\n      assume \"P \\<approx> Q\"\n      hence \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(rule unfoldE)\n      moreover {\n        fix P Q a\n        assume \"P \\<approx> Q\"\n        moreover have \"[a\\<frown>a]P \\<approx> P\" by(rule matchId)\n        ultimately have \"[a\\<frown>a]P \\<approx> Q\" by(blast intro: transitive)\n      }\n      moreover have \"weakBisim \\<subseteq> ?X \\<union> weakBisim\" by blast\n      ultimately have \"[a\\<frown>b]P \\<leadsto>\\<^sup>^<(?X \\<union> weakBisim)> [a\\<frown>b]Q\"\n        by(rule matchPres)\n    }\n    with \\<open>(P, Q) \\<in> ?X\\<close> show ?case by auto\n  next\n    case(cSym P Q)\n    thus ?case by(auto simp add: pi.inject dest: symmetric)\n  qed\nqed\n\nlemma mismatchPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"[a\\<noteq>b]P \\<approx> [a\\<noteq>b]Q\"\nproof -\n  let ?X = \"{([a\\<noteq>b]P, [a\\<noteq>b]Q) | a b P Q. P \\<approx> Q}\"\n  from assms have \"([a\\<noteq>b]P, [a\\<noteq>b]Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cSim P Q)\n    {\n      fix P Q a b\n      assume \"P \\<approx> Q\"\n      hence \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(rule unfoldE)\n      moreover {\n        fix P Q a b\n        assume \"P \\<approx> Q\" and \"(a::name) \\<noteq> b\"\n        note \\<open>P \\<approx> Q\\<close>\n        moreover from \\<open>a \\<noteq> b\\<close> have \"[a\\<noteq>b]P \\<approx> P\" by(rule mismatchId)\n        ultimately have \"[a\\<noteq>b]P \\<approx> Q\" by(blast intro: transitive)\n      }\n      moreover have \"weakBisim \\<subseteq> ?X \\<union> weakBisim\" by blast\n      ultimately have \"[a\\<noteq>b]P \\<leadsto>\\<^sup>^<(?X \\<union> weakBisim)> [a\\<noteq>b]Q\"\n        by(rule mismatchPres)\n    }\n    with \\<open>(P, Q) \\<in> ?X\\<close> show ?case by auto\n  next\n    case(cSym P Q)\n    thus ?case by(auto simp add: pi.inject dest: symmetric)\n  qed\nqed\n\nlemma parPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"P \\<parallel> R \\<approx> Q \\<parallel> R\"\nproof -\n  let ?ParSet = \"{(resChain lst (P \\<parallel> R), resChain lst (Q \\<parallel> R)) | lst P Q R. P \\<approx> Q}\"\n  have BC: \"\\<And>P Q. P \\<parallel> Q = resChain [] (P \\<parallel> Q)\" by auto\n  from assms have \"(P \\<parallel> R, Q \\<parallel> R) \\<in> ?ParSet\" by(blast intro: BC)\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cSim PR QR)\n    {\n      fix P Q R lst\n      assume \"P \\<approx> Q\"\n    \n      from eqvtI have \"eqvt (?ParSet \\<union> weakBisim)\"\n        by(auto simp add: eqvt_def, blast)\n      moreover have \"\\<And>P Q a. (P, Q) \\<in> ?ParSet \\<union> weakBisim \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> ?ParSet \\<union> weakBisim\"\n        by(blast intro: resChain.step[THEN sym] resPres)\n      moreover {\n        from \\<open>P \\<approx> Q\\<close> have \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(rule unfoldE)\n        moreover note \\<open>P \\<approx> Q\\<close>\n        moreover {\n          fix P Q R\n          assume \"P \\<approx> Q\"\n          moreover have \"P \\<parallel> R = resChain [] (P \\<parallel> R)\" by simp\n          moreover have \"Q \\<parallel> R = resChain [] (Q \\<parallel> R)\" by simp\n          ultimately have \"(P \\<parallel> R, Q \\<parallel> R) \\<in> ?ParSet \\<union> weakBisim\" by blast\n        }\n        moreover {\n          fix P Q a\n          assume A: \"(P, Q) \\<in> ?ParSet \\<union> weakBisim\"\n          hence \"(<\\<nu>a>P, <\\<nu>a>Q) \\<in> ?ParSet \\<union> weakBisim\" (is \"?goal\")\n            apply(auto intro: resPres)\n            by(rule_tac x=\"a#lst\" in exI) auto\n        }\n        ultimately have \"(P \\<parallel> R) \\<leadsto>\\<^sup>^<(?ParSet \\<union> weakBisim)> (Q \\<parallel> R)\" using eqvt \\<open>eqvt(?ParSet \\<union> weakBisim)\\<close>\n          by(rule Weak_Late_Sim_Pres.parPres)\n      }\n\n      ultimately have \"resChain lst (P \\<parallel> R) \\<leadsto>\\<^sup>^<(?ParSet \\<union> weakBisim)> resChain lst (Q \\<parallel> R)\"\n        by(rule resChainI)\n    }\n    with \\<open>(PR, QR) \\<in> ?ParSet\\<close> show ?case by blast\n  next\n    case(cSym PR QR)\n    thus ?case by(auto dest: symmetric)\n  qed\nqed\n\n\n\n  assumes PBisimQ: \"P \\<approx> Q\"\n\n  shows \"!P \\<approx> !Q\"\nproof -\n  let ?X = \"(bangRel weakBisim)\"\n  let ?Y = \"Strong_Late_Bisim.bisim O (bangRel weakBisim) O Strong_Late_Bisim.bisim\"\n\n  from eqvt Strong_Late_Bisim.bisimEqvt have eqvtY: \"eqvt ?Y\" by(blast intro: eqvtBangRel)\n  have XsubY: \"?X \\<subseteq> ?Y\" by(auto intro: Strong_Late_Bisim.reflexive)\n\n  have RelStay: \"\\<And>P Q. (P \\<parallel> !P, Q) \\<in> ?Y \\<Longrightarrow> (!P, Q) \\<in> ?Y\"\n  proof(auto)\n    fix P Q R T\n    assume PBisimQ: \"P \\<parallel> !P \\<sim> Q\" \n       and QBRR: \"(Q, R) \\<in> bangRel weakBisim\"\n       and RBisimT: \"R \\<sim> T\"\n    have \"!P \\<sim> Q\" \n    proof -\n      have \"!P \\<sim> P \\<parallel> !P\" by(rule Strong_Late_Bisim_SC.bangSC)\n      thus ?thesis using PBisimQ by(rule Strong_Late_Bisim.transitive)\n    qed\n    with QBRR RBisimT show \"(!P, T) \\<in> ?Y\" by blast\n  qed\n \n  have ParCompose: \"\\<And>P Q R T. \\<lbrakk>P \\<approx> Q; (R, T) \\<in> ?Y\\<rbrakk> \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> T) \\<in> ?Y\"\n  proof -\n    fix P Q R T\n    assume PBisimQ: \"P \\<approx> Q\"\n       and RYT:     \"(R, T) \\<in> ?Y\"\n    thus \"(P \\<parallel> R, Q \\<parallel> T) \\<in> ?Y\"\n    proof(auto)\n      fix T' R'\n      assume T'BisimT: \"T' \\<sim> T\" and RBisimR': \"R \\<sim> R'\"\n         and R'BRT': \"(R', T') \\<in> bangRel weakBisim\"\n      have \"P \\<parallel> R \\<sim> P \\<parallel> R'\"\n      proof -\n        from RBisimR' have \"R \\<parallel> P \\<sim> R' \\<parallel> P\" by(rule Strong_Late_Bisim_Pres.parPres)\n        moreover have \"P \\<parallel> R \\<sim> R \\<parallel> P\" and \"R' \\<parallel> P \\<sim> P \\<parallel> R'\" by(rule Strong_Late_Bisim_SC.parSym)+\n        ultimately show ?thesis by(blast intro: Strong_Late_Bisim.transitive)\n      qed\n      moreover from PBisimQ R'BRT' have \"(P \\<parallel> R', Q \\<parallel> T') \\<in> bangRel weakBisim\" by(rule BRPar)\n      moreover have \"Q \\<parallel> T' \\<sim> Q \\<parallel> T\"\n      proof -\n        from T'BisimT have \"T' \\<parallel> Q \\<sim> T \\<parallel> Q\" by(rule Strong_Late_Bisim_Pres.parPres)\n        moreover have \"Q \\<parallel> T' \\<sim> T' \\<parallel> Q\" and \"T \\<parallel> Q \\<sim> Q \\<parallel> T\" by(rule Strong_Late_Bisim_SC.parSym)+\n        ultimately show ?thesis by(blast intro: Strong_Late_Bisim.transitive)\n      qed\n      ultimately show ?thesis by blast\n    qed\n  qed\n\n  have ResCong: \"\\<And>P Q x. (P, Q) \\<in> ?Y \\<Longrightarrow> (<\\<nu>x>P, <\\<nu>x>Q) \\<in> ?Y\"\n    by(auto intro: BRRes Strong_Late_Bisim_Pres.resPres transitive)\n\n  from PBisimQ have \"(!P, !Q) \\<in> ?X\" by(rule BRBang)\n  moreover from eqvt have \"eqvt (bangRel weakBisim)\" by(rule eqvtBangRel)\n  ultimately show ?thesis\n  proof(coinduct rule: weakBisimTransitiveCoinduct)\n    case(cSim P Q)\n    from \\<open>(P, Q) \\<in> ?X\\<close>\n    show \"P \\<leadsto>\\<^sup>^<?Y> Q\"\n    proof(induct)\n      case(BRBang P Q)\n      have \"P \\<approx> Q\" by fact\n      moreover hence \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(blast dest: unfoldE)\n      moreover have \"\\<And>P Q. P \\<approx> Q \\<Longrightarrow> P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(blast dest: unfoldE)\n      moreover from Strong_Late_Bisim.bisimEqvt eqvt have \"eqvt ?Y\" by(blast intro: eqvtBangRel)\n\n      ultimately show \"!P \\<leadsto>\\<^sup>^<?Y> !Q\" using ParCompose ResCong RelStay XsubY\n        by(rule_tac Weak_Late_Sim_Pres.bangPres, simp_all)\n    next\n      case(BRPar P Q R T)\n      have PBiSimQ: \"P \\<approx> Q\" by fact\n      have RBangRelT: \"(R, T) \\<in> ?X\" by fact\n      have RSimT: \"R \\<leadsto>\\<^sup>^<?Y> T\" by fact\n      moreover from PBiSimQ  have \"P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(blast dest: unfoldE)\n      moreover from RBangRelT have \"(R, T) \\<in> ?Y\" by(blast intro: Strong_Late_Bisim.reflexive)\n      ultimately show \"P \\<parallel> R \\<leadsto>\\<^sup>^<?Y> Q \\<parallel> T\" using ParCompose ResCong eqvt eqvtY \\<open>P \\<approx> Q\\<close>\n        by(rule_tac Weak_Late_Sim_Pres.parCompose)\n    next\n      case(BRRes P Q x)\n      have \"P \\<leadsto>\\<^sup>^<?Y> Q\" by fact\n      thus \"<\\<nu>x>P \\<leadsto>\\<^sup>^<?Y> <\\<nu>x>Q\" using ResCong eqvtY XsubY\n        by(rule_tac Weak_Late_Sim_Pres.resPres, simp_all)\n    qed\n  next\n    case(cSym P Q)\n    thus ?case by(metis symmetric bangRelSymetric)\n  qed\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Late_Bisim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.3178205775218163}}
{"text": "\\<^marker>\\<open>creator \"Kevin Kappelmann\"\\<close>\nsubsubsection \\<open>Order Equivalence\\<close>\ntheory Transport_Natural_Functors_Order_Equivalence\n  imports\n    Transport_Natural_Functors_Base\nbegin\n\nlemma inflationary_on_in_dom_FrelI:\n  assumes \"inflationary_on (in_dom R1) R1 f1\"\n  and \"inflationary_on (in_dom R2) R2 f2\"\n  and \"inflationary_on (in_dom R3) R3 f3\"\n  defines \"R \\<equiv> Frel R1 R2 R3\"\n  shows \"inflationary_on (in_dom R) R (Fmap f1 f2 f3)\"\n  apply (unfold R_def)\n  apply (rule inflationary_onI)\n  apply (subst (asm) in_dom_Frel_eq_Fpred_in_dom)\n  apply (erule FpredE)\n  apply (subst Frel_Fmap_eq2)\n  apply (rule Frel_refl_strong)\n    apply (rule inflationary_onD[where ?R=R1] inflationary_onD[where ?R=R2]\n        inflationary_onD[where ?R=R3],\n      rule assms,\n      assumption+)+\n  done\n\nlemma inflationary_on_in_codom_FrelI:\n  assumes \"inflationary_on (in_codom R1) R1 f1\"\n  and \"inflationary_on (in_codom R2) R2 f2\"\n  and \"inflationary_on (in_codom R3) R3 f3\"\n  defines \"R \\<equiv> Frel R1 R2 R3\"\n  shows \"inflationary_on (in_codom R) R (Fmap f1 f2 f3)\"\n  apply (unfold R_def)\n  apply (rule inflationary_onI)\n  apply (subst (asm) in_codom_Frel_eq_Fpred_in_codom)\n  apply (erule FpredE)\n  apply (subst Frel_Fmap_eq2)\n  apply (rule Frel_refl_strong)\n    apply (rule inflationary_onD[where ?R=R1] inflationary_onD[where ?R=R2]\n        inflationary_onD[where ?R=R3],\n      rule assms,\n      assumption+)+\n  done\n\nlemma inflationary_on_in_field_FrelI:\n  assumes \"inflationary_on (in_field R1) R1 f1\"\n  and \"inflationary_on (in_field R2) R2 f2\"\n  and \"inflationary_on (in_field R3) R3 f3\"\n  defines \"R \\<equiv> Frel R1 R2 R3\"\n  shows \"inflationary_on (in_field R) R (Fmap f1 f2 f3)\"\n  apply (unfold R_def)\n  apply (subst in_field_eq_in_dom_sup_in_codom)\n  apply (subst inflationary_on_sup_eq)\n  apply (unfold inf_apply)\n  apply (subst inf_bool_def)\n  apply (rule conjI;\n    rule inflationary_on_in_dom_FrelI inflationary_on_in_codom_FrelI;\n    rule inflationary_on_if_le_pred_if_inflationary_on,\n    rule assms,\n    rule le_predI,\n    rule in_field_if_in_dom in_field_if_in_codom,\n    assumption)\n  done\n\nlemma deflationary_on_in_dom_FrelI:\n  assumes \"deflationary_on (in_dom R1) R1 f1\"\n  and \"deflationary_on (in_dom R2) R2 f2\"\n  and \"deflationary_on (in_dom R3) R3 f3\"\n  defines \"R \\<equiv> Frel R1 R2 R3\"\n  shows \"deflationary_on (in_dom R) R (Fmap f1 f2 f3)\"\n  apply (unfold R_def)\n  apply (subst deflationary_on_eq_inflationary_on_rel_inv)\n  apply (subst in_codom_rel_inv_eq_in_dom[symmetric])\n  apply (unfold Frel_rel_inv_eq_rel_inv_Frel[symmetric])\n  apply (rule inflationary_on_in_codom_FrelI;\n    subst deflationary_on_eq_inflationary_on_rel_inv[symmetric],\n    subst in_codom_rel_inv_eq_in_dom,\n    rule assms)\n  done\n\nlemma deflationary_on_in_codom_FrelI:\n  assumes \"deflationary_on (in_codom R1) R1 f1\"\n  and \"deflationary_on (in_codom R2) R2 f2\"\n  and \"deflationary_on (in_codom R3) R3 f3\"\n  defines \"R \\<equiv> Frel R1 R2 R3\"\n  shows \"deflationary_on (in_codom R) R (Fmap f1 f2 f3)\"\n  apply (unfold R_def)\n  apply (subst deflationary_on_eq_inflationary_on_rel_inv)\n  apply (subst in_dom_rel_inv_eq_in_codom[symmetric])\n  apply (unfold Frel_rel_inv_eq_rel_inv_Frel[symmetric])\n  apply (rule inflationary_on_in_dom_FrelI;\n    subst deflationary_on_eq_inflationary_on_rel_inv[symmetric],\n    subst in_dom_rel_inv_eq_in_codom,\n    rule assms)\n  done\n\nlemma deflationary_on_in_field_FrelI:\n  assumes \"deflationary_on (in_field R1) R1 f1\"\n  and \"deflationary_on (in_field R2) R2 f2\"\n  and \"deflationary_on (in_field R3) R3 f3\"\n  defines \"R \\<equiv> Frel R1 R2 R3\"\n  shows \"deflationary_on (in_field R) R (Fmap f1 f2 f3)\"\n  apply (unfold R_def)\n  apply (subst deflationary_on_eq_inflationary_on_rel_inv)\n  apply (subst in_field_rel_inv_eq[symmetric])\n  apply (unfold Frel_rel_inv_eq_rel_inv_Frel[symmetric])\n  apply (rule inflationary_on_in_field_FrelI;\n    subst deflationary_on_eq_inflationary_on_rel_inv[symmetric],\n    subst in_field_rel_inv_eq,\n    rule assms)\n  done\n\nlemma rel_equivalence_on_in_field_FrelI:\n  assumes \"rel_equivalence_on (in_field R1) R1 f1\"\n  and \"rel_equivalence_on (in_field R2) R2 f2\"\n  and \"rel_equivalence_on (in_field R3) R3 f3\"\n  defines \"R \\<equiv> Frel R1 R2 R3\"\n  shows \"rel_equivalence_on (in_field R) R (Fmap f1 f2 f3)\"\n  apply (unfold R_def)\n  apply (subst rel_equivalence_on_eq)\n  apply (unfold inf_apply)\n  apply (subst inf_bool_def)\n  apply (insert assms)\n  apply (elim rel_equivalence_onE)\n  apply (rule conjI;\n    rule inflationary_on_in_field_FrelI deflationary_on_in_field_FrelI;\n    assumption)\n  done\n\ncontext transport_natural_functor\nbegin\n\nlemmas inflationary_on_in_field_unitI = inflationary_on_in_field_FrelI\n  [of L1 \"\\<eta>\\<^sub>1\" L2 \"\\<eta>\\<^sub>2\" L3 \"\\<eta>\\<^sub>3\", folded transport_defs unit_eq_Fmap]\n\nlemmas deflationary_on_in_field_unitI = deflationary_on_in_field_FrelI\n  [of L1 \"\\<eta>\\<^sub>1\" L2 \"\\<eta>\\<^sub>2\" L3 \"\\<eta>\\<^sub>3\", folded transport_defs unit_eq_Fmap]\n\nlemmas rel_equivalence_on_in_field_unitI = rel_equivalence_on_in_field_FrelI\n  [of L1 \"\\<eta>\\<^sub>1\" L2 \"\\<eta>\\<^sub>2\" L3 \"\\<eta>\\<^sub>3\", folded transport_defs unit_eq_Fmap]\n\ninterpretation flip :\n  transport_natural_functor R1 L1 r1 l1 R2 L2 r2 l2 R3 L3 r3 l3\n  rewrites \"flip.unit \\<equiv> \\<epsilon>\" and \"flip.t1.unit \\<equiv> \\<epsilon>\\<^sub>1\"\n  and \"flip.t2.unit \\<equiv> \\<epsilon>\\<^sub>2\" and \"flip.t3.unit \\<equiv> \\<epsilon>\\<^sub>3\"\n  by (simp_all only: order_functors.flip_counit_eq_unit)\n\nlemma order_equivalenceI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"((\\<le>\\<^bsub>L3\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R3\\<^esub>)) l3 r3\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<equiv>\\<^sub>o (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  apply (insert assms)\n  apply (elim order_functors.order_equivalenceE)\n  apply (rule order_equivalenceI;\n    rule mono_wrt_rel_leftI\n      flip.mono_wrt_rel_leftI\n      rel_equivalence_on_in_field_unitI\n      flip.rel_equivalence_on_in_field_unitI;\n    assumption)\n  done\n\nend\n\n\nend", "meta": {"author": "kappelmann", "repo": "transport-isabelle", "sha": "b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff", "save_path": "github-repos/isabelle/kappelmann-transport-isabelle", "path": "github-repos/isabelle/kappelmann-transport-isabelle/transport-isabelle-b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff/Transport/Natural_Functors/Transport_Natural_Functors_Order_Equivalence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.3178205775218163}}
{"text": "(* @LICENSE(NICTA_CORE) *)\n\n(*  Author:     Rafal Kolanski, NICTA & UNSW \n\n    Definition of the mem_type class (types which we can store on the heap as\n    a sequence of bytes).\n*)\n\ntheory MemTypes\nimports MachineARM\nbegin\n\n(*XXX: someone removed this in the main repo, where should it go now?*)\ntype_synonym byte = \"8 word\"\n\ntype_synonym type_tag = string\n(*TODO: when working on structure types, this should be moved to where all the other stuff is defined (atomic/structure types etc) (XXX or removed when dropping the tagged heap *)\n\ntext \\<open>\n  The @{text \"mem_type\"} class represents a C-like values storable in memory.\n  They:\n   * must be convertable to a series of bytes, reversibly\n   * the number of bytes used must be constant for the type, irrespective\n     of value, so if we append its encoding to a byte stream, we know how\n     many bytes to take off again to decode, thus knowing where the ``rest''\n     of the stream is (e.g. encoding as part of a larger structure)\n   * must have a nonzero size in bytes that is smaller than both the physical\n     and virtual address spaces\n   * may require an alignment that divides the both the physical and virtual\n     address space sizes\n\\<close>\nclass mem_type = \n  (* \"size of value in bytes\" *)\n  fixes size_of :: \"'a itself \\<Rightarrow> nat\"\n  assumes some_size: \"0 < size_of (TYPE('a))\"\n  assumes max_size: \"size_of (TYPE('a)) < min memory_size addr_space_size\"\n\n  fixes to_bytes :: \"'a \\<Rightarrow> byte list\"\n  fixes from_bytes :: \"byte list \\<Rightarrow> 'a\"\n  assumes storable: \"from_bytes (to_bytes v) = v\"\n  assumes size_length: \"length (to_bytes v) = size_of TYPE('a)\"\n  assumes restorable: \"length bs = size_of TYPE('a)\n                       \\<Longrightarrow> to_bytes (from_bytes bs) = bs\"\n\n  (* \"required alignment of value in bytes\" *)\n  fixes align_of :: \"'a itself \\<Rightarrow> nat\"\n  assumes sane_alignment: \"align_of (TYPE('a)) dvd memory_size \\<and>\n                           align_of (TYPE('a)) dvd addr_space_size\"\n  (* \"a unique type tag for this type of value\" *)\n  fixes type_tag :: \"'a itself \\<Rightarrow> type_tag\"\n  (*XXX: redundant since tags removed, but could be useful otherwise *)\n\nbegin\n\ndefinition\n  mem_type_decode :: \"byte list \\<Rightarrow> ('a \\<times> byte list)\" where\n  \"mem_type_decode bs \\<equiv> let sz = size_of TYPE('a) in\n                       (from_bytes (take sz bs), drop sz bs)\"\n\nlemma snd_mem_type_decode:\n  \"snd (mem_type_decode bs) = drop (size_of TYPE('a)) bs\"\n  unfolding mem_type_decode_def Let_def\n  by simp (*XXX: unused?*)\n\nend\n\ntext \\<open>Extra mem\\_type lemmas.\\<close>\n\nlemma to_bytes_nil_all:\n  assumes a: \"to_bytes (x::'a::mem_type) = []\"\n  shows \"to_bytes (y::'a::mem_type) = []\"\nproof -\n  have \"length (to_bytes x) = length (to_bytes y)\"\n    by (simp add: size_length)\n  thus ?thesis using a by auto\nqed\n\n\ntext \\<open>\n  In order to make records mem_types, we need to disregard their ability to\n  be extended. When we discard the @{text \"more\"} part of a record for \n  encoding, we must somehow still reconstruct it after decoding. What we\n  really want is to have a class of records extending unit. A class containing\n  only unit isn't possible, but a class of types with only one member is\n  sufficient, as @{text \"undefined\"} is a reliable reconstruction of any\n  discarded extension.\n\\<close>\nclass unitary =\n  fixes the_value :: \"'a\" \n  assumes only_one_value: \"(x::'a) = y\" (* Unused. Required to fix 'a. *)\n(* XXX: this isn't currently used at Michael N's C parser uses L4 records which\n        don't support extending, but do support recursive records *)\n\ninstance unit :: unitary (* XXX: magically ignores one_value instantiation *)\n  by (intro_classes, simp)\n\nlemma \"x dvd memory_size \\<Longrightarrow> 0 < x\"\n  (*XXX: not sure we'll need this, but we definitely don't need it as an assumption on alignment*)\n  by (case_tac x, auto simp: memory_size)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "tlb", "sha": "88bb017dd96c3830baed93ba62e45b45050d1417", "save_path": "github-repos/isabelle/SEL4PROJ-tlb", "path": "github-repos/isabelle/SEL4PROJ-tlb/tlb-88bb017dd96c3830baed93ba62e45b45050d1417/Page_Tables/MemTypes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3178155013314366}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory Word_Lemmas_32_Internal\nimports Word_Lib_Sumo Machine_Word_32\nbegin\n\nlemmas sint_eq_uint_32 = sint_eq_uint_2pl[where 'a=32, simplified]\n\nlemmas sle_positive_32 = sle_le_2pl[where 'a=32, simplified]\n\nlemmas sless_positive_32 = sless_less_2pl[where 'a=32, simplified]\n\nlemma zero_le_sint_32:\n  \"\\<lbrakk> 0 \\<le> (a :: word32); a < 0x80000000 \\<rbrakk>\n   \\<Longrightarrow> 0 \\<le> sint a\"\n  by (clarsimp simp: sint_eq_uint_32 unat_less_helper)\n\nlemmas unat_add_simple = iffD1[OF unat_add_lem[where 'a = 32, folded word_bits_def]]\n\nlemma upto_enum_inc_1:\n  \"a < 2 ^ word_bits - 1\n   \\<Longrightarrow> [(0:: 'a :: len word) .e. 1 + a] = [0.e.a] @ [(1+a)]\"\n  using upper_trivial upto_enum_inc_1_len by force\n\nlemmas upt_enum_offset_trivial =\n  upt_enum_offset_trivial[where 'a=32, folded word_bits_def]\n\nlemmas unat32_eq_of_nat = unat_eq_of_nat[where 'a=32, folded word_bits_def]\n\ndeclare mask_32_max_word[simp]\n\nlemma le_32_mask_eq:\n  \"(bits :: word32) \\<le> 32 \\<Longrightarrow> bits && mask 6 = bits\"\n  by (fastforce elim: le_less_trans intro: less_mask_eq)\n\nlemmas scast_1_32[simp] = scast_1[where 'a=32]\n\nlemmas mask_32_id[simp] = mask_len_id[where 'a=32, folded word_bits_def]\n\nlemmas t2p_shiftr_32 = t2p_shiftr[where 'a=32, folded word_bits_def]\n\nlemma mask_eq1_nochoice:\n  \"(x :: word32) && 1 = x\n   \\<Longrightarrow> x = 0 \\<or> x = 1\"\n  using mask_eq1_nochoice len32 by force\n\nlemmas const_le_unat_word_32 = const_le_unat[where 'a=32, folded word_bits_def]\n\nlemmas createNewCaps_guard_helper =\n  createNewCaps_guard[where 'a=32, folded word_bits_def]\n\nlemma word_log2_max_word32[simp]:\n  \"word_log2 (w :: 32 word) < 32\"\n  using word_log2_max[where w=w]\n  by (simp add: word_size)\n\n(* FIXME: specialize using pow_sub_less_word *)\nlemma mapping_two_power_16_64_inequality:\n  assumes sz: \"sz \\<le> 4\" and len: \"unat (len :: word32) = 2 ^ sz\"\n  shows \"unat (len * 8 - 1) \\<le> 127\"\n  using pow_sub_less[where 'a=32 and b=3, simplified]\nproof -\n  have len2: \"len = 2 ^ sz\"\n    apply (rule word_unat.Rep_eqD, simp only: len)\n    using sz\n    apply simp\n    done\n\n  show ?thesis using two_power_increasing_less_1[where 'a=32 and n=\"sz + 3\" and m=7]\n    by (simp add: word_le_nat_alt sz power_add len2 field_simps bintrunc_Suc_numeral)\nqed\n\nlemmas pre_helper2_32 = pre_helper2[where 'a=32, folded word_bits_def]\n\nlemmas of_nat_shift_distinct_helper_machine =\n  of_nat_shift_distinct_helper[where 'a=32, folded word_bits_def]\n\nlemmas ptr_add_distinct_helper_32 =\n  ptr_add_distinct_helper[where 'a=32, folded word_bits_def]\n\nlemmas mask_out_eq_0_32 = mask_out_eq_0[where 'a=32, folded word_bits_def]\n\nlemmas neg_mask_mask_unat_32 = neg_mask_mask_unat[where 'a=32, folded word_bits_def]\n\nlemmas unat_less_iff_32 = unat_less_iff[where 'a=32, folded word_bits_def]\n\nlemmas is_aligned_no_overflow3_32 = is_aligned_no_overflow3[where 'a=32, folded word_bits_def]\n\nlemmas unat_ucast_16_32 = unat_signed_ucast_less_ucast[where 'a=16 and 'b=32, simplified]\n\n(* FIXME: generalize? *)\nlemma scast_mask_8:\n  \"scast (mask 8 :: sword32) = (mask 8 :: word32)\"\n  by (clarsimp simp: mask_eq)\n\nlemmas ucast_le_8_32_equiv = ucast_le_up_down_iff[where 'a=8 and 'b=32, simplified]\n\nlemma signed_unat_minus_one_32:\n  \"unat (-1 :: 32 signed word) = 4294967295\"\n  by (simp del: word_pow_0 diff_0 add: unat_sub_if' minus_one_word)\n\nlemmas two_bits_cases_32 = two_bits_cases[where 'a=32, simplified]\n\nlemmas word_ctz_not_minus_1_32 = word_ctz_not_minus_1[where 'a=32, simplified]\n\nlemmas sint_ctz_32 = sint_ctz[where 'a=32, simplified]\n\n(* FIXME: inline these? *)\nlemmas scast_specific_plus32 =\n  scast_of_nat_signed_to_unsigned_add[where 'a=32 and x=\"word_ctz x\" and y=\"0x20\" for x,\n                                      simplified]\nlemmas scast_specific_plus32_signed =\n  scast_of_nat_unsigned_to_signed_add[where 'a=32 and x=\"word_ctz x\" and y=\"0x20\" for x,\n                                      simplified]\n\nlemma neq_0_unat: \"x \\<noteq> 0 \\<Longrightarrow> 0 < unat x\" for x::machine_word\n  by (simp add: unat_gt_0)\n\nend", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Word_Lib/Word_Lemmas_32_Internal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3178154945239011}}
{"text": "section \"Program Verification Tactics\"\n\ntheory program_verification_tactics\n  imports \n    invariant_simps \n    unique_ids\n    single_invocation_correctness2\n    \"Case_Labeling.Case_Labeling\"\n    execution_invariants2\n    execution_invariants_s\n    execution_invariants_unused\n    crdt_specs\n    unique_ids_procedure_check\nbegin\n\ntext \"We define some tactics to generate proof obligations for showing a programs correctness.\nThis theory mainly adds nicer labels to already existing methods using the case labeling package.\"\n\n\ncontext begin\ninterpretation Labeling_Syntax .\n\nlemma increase_bound:\n  assumes \"\\<exists>bound. (checkCorrect2F ^^Suc bound) bot (progr, {}, S, i)\"\n  shows \"\\<exists>bound. (checkCorrect2F ^^bound) bot (progr, {}, S, i)\"\n  using assms by blast\n\n\n\nlemma DC_show_programCorrect:\n  fixes ct defines \"ct' \\<equiv> \\<lambda>pos name. (name, pos,[]) # ct\"\n  assumes invInitial: \"C\\<langle>Suc n1, ct' n1 ''invariant_initial_state'', n2: invariant_all' (initialState progr)\\<rangle>\"\n    and procedureCorrect: \"\\<And>S i. \\<lbrakk>B\\<langle>''in_initial_state'', n2: S\\<in>initialStates' progr i\\<rangle>\\<rbrakk> \n          \\<Longrightarrow> C\\<langle>Suc n2, (''procedure_correct'', n2, [VAR S, VAR i])#ct, n3: procedureCorrect S i\\<rangle>\"\n  shows \"C\\<langle>n1,ct,n3: programCorrect progr\\<rangle>\"\n  using assms\n  unfolding LABEL_simps\n  by (metis initialStates'_same procedureCorrect_def show_programCorrect_using_checkCorrect1)  \n\n\nlemma DC_show_procedureCorrect:\n  fixes ct defines \"ct' \\<equiv> \\<lambda>pos name. (name, pos,[]) # ct\"\n  assumes \"C\\<langle>Suc n1, ct' n1 ''after_invocation'', n2: invariant_all' S\\<rangle>\"\n    and  \"B\\<langle>''in_initial_state'', n2: invariant_all' S\\<rangle> \\<Longrightarrow> C\\<langle>Suc n2, (''execution'', n2, [])#ct, n3: execution_s_correct S i\\<rangle>\"\n  shows \"C\\<langle>n1,ct,n3: procedureCorrect S i\\<rangle>\"\n  using assms\n  unfolding LABEL_simps by (auto simp add: procedureCorrect_def)\n\n\n\n\n  lemma DC_final2:\n    assumes \"V\\<langle>(n,i,v), ct: a\\<rangle>\"\n    shows \"C\\<langle>inp,(n,i,v)#ct,Suc inp: a\\<rangle>\"\n    using assms unfolding LABEL_simps by auto\n\nlemma show_initial_state_prop:\n  assumes a1: \"Si\\<in>initialStates' progr i\"\nand a2: \"\\<And>S_pre proc initState impl.\n       \\<lbrakk>\n        B\\<langle>''Si_def'', n1 : Si = S_pre\n        \\<lparr>localState := localState S_pre(i \\<mapsto> initState), \n         currentProc := currentProc S_pre(i \\<mapsto> impl), \n         visibleCalls := visibleCalls S_pre(i \\<mapsto> {}),\n         invocOp := invocOp S_pre(i \\<mapsto> (proc))\\<rparr>\\<rangle>;\n        B\\<langle>''progr_def'', n1 : prog S_pre = progr\\<rangle>; \n        B\\<langle>''proc_initState'', n1 : initState = fst (procedure progr proc)\\<rangle>; \n        B\\<langle>''proc_impl'', n1 : impl = snd (procedure progr proc)\\<rangle>; \n        B\\<langle>''ids_in_args_are_knownIds'', n1 : uniqueIds proc \\<subseteq> knownIds S_pre\\<rangle>; \n        B\\<langle>''invariant_pre'', n1 : invariant_all' S_pre\\<rangle>;\n        B\\<langle>''wf_pre'', n1 : state_wellFormed S_pre\\<rangle>; \n        B\\<langle>''i_fresh'', n1 : invocOp S_pre i = None\\<rangle>; \n        B\\<langle>''no_uncommitted_txns'', n1 : \\<forall>tx. txStatus S_pre tx \\<noteq> Some Uncommitted\\<rangle>;\n        B\\<langle>''no_txns_in_i'', n1 : \\<forall>tx. txOrigin S_pre tx \\<noteq> Some i\\<rangle>\n        \\<rbrakk> \\<Longrightarrow> C\\<langle>Suc n1, (''show_P'', n1, [VAR S_pre, VAR proc, VAR  initState, VAR  impl])#ct, n2 :   P Si i\\<rangle>\"\n  shows \"C\\<langle>n1, ct, n : P Si i\\<rangle>\"\n  unfolding LABEL_simps \nproof -\n  from a1[unfolded initialStates'_def]\n  obtain S proc initState impl \n    where \"prog S = progr\"\n      and \"procedure progr proc = (initState, impl)\"\n      and \"uniqueIds proc \\<subseteq> knownIds S\"\n      and \"invariant_all' S\"\n      and \"state_wellFormed S\"\n      and \"invocOp S i = None\"\n      and \"\\<forall>tx. txStatus S tx \\<noteq> Some Uncommitted\"\n      and \"\\<forall>tx. txOrigin S tx \\<noteq> Some i\"\n      and \"Si = S\\<lparr>localState := localState S(i \\<mapsto> initState), currentProc := currentProc S(i \\<mapsto> impl), visibleCalls := visibleCalls S(i \\<mapsto> {}),\n             invocOp := invocOp S(i \\<mapsto> proc)\\<rparr>\"\n    by auto\n  note facts = this \n\n  show \"P Si i\"\n    apply (rule a2[unfolded LABEL_simps])\n    using facts by auto\n\nqed\n\nend\n\nmethod M_show_programCorrect = \n  ((rule Initial_Label, \n    rule DC_show_programCorrect;\n   (rule DC_final2 | rule DC_final)), \n   casify)\n\nmethod M_show_procedureCorrect = \n  ((rule Initial_Label, \n    rule DC_show_procedureCorrect;\n   (rule DC_final2 | rule DC_final)), \n   casify)\n\n\n\n\\<comment> \\<open>ony unfold definitions, when needed for evaluation:\\<close>\nlemma state_def[simp]:  \"S' ::= S \\<Longrightarrow> (currentProc S' i \\<triangleq> x) \\<longleftrightarrow> (currentProc S i \\<triangleq> x)\"  by (auto simp add: Def_def)\nlemma state_def_h1[simp]: \"S' ::= S \\<Longrightarrow>  ls_pc (the (localState S' i)) = ls_pc (the (localState S i))\" by (auto simp add: Def_def)\nlemma state_def_h2[simp]: \"S' ::= S \\<Longrightarrow>  (currentTx S' i = None) \\<longleftrightarrow> (currentTx S i = None)\"  by (auto simp add: Def_def)\nlemma state_def_currentProc[simp]: \"S' ::= S \\<Longrightarrow>  currentProc S' i = currentProc S i\" by (auto simp add: Def_def)\nlemma state_def_currentTx[simp]: \"S' ::= S \\<Longrightarrow> currentTx S' i = currentTx S i\"  by (auto simp add: Def_def)\n\nnamed_theorems language_construct_defs\n\nmethod show_procedures_cannot_guess_ids = \n  (((auto simp add: language_construct_defs bind_def       \n        uniqueIds_mapOp_def  uniqueIds_registerOp_def \n        split: if_splits)[1])?;\n    ((rule procedure_cannot_guess_ids.intros, force); show_procedures_cannot_guess_ids?)?)\n\n(* newId_def atomic_def beginAtomic_def call_def skip_def endAtomic_def return_def *)\n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/program_verification_tactics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.31781549452390107}}
{"text": "(*  Title:       Logging-independent Message Anonymity in the Relational Method\n    Author:      Pasquale Noce\n                 Software Engineer at HID Global, Italy\n                 pasquale dot noce dot lavoro at gmail dot com\n                 pasquale dot noce at hidglobal dot com\n*)\n\nsection \"Possibility of anonymity compromise for token pseudonymous identifiers\"\n\ntheory Possibility\n  imports Anonymity\nbegin\n\ntext \\<open>\n\\null\n\nThis section proves possibility properties @{text tok_id_identified}, @{text sec_id_identified},\nwhich altogether state that the spy can map a token pseudonymous identifier to the related token if\neither attack option described in section \\ref{Protocol} is viable. Both properties are proven by\nconstruction, namely by creating as many sample protocol runs such as to satisfy their conclusions\nif their assumptions are fulfilled.\n\n\\null\n\\<close>\n\ndefinition tok_id_pubk_prik :: \"agent_id \\<Rightarrow> agent_id \\<Rightarrow> state\" where\n\"tok_id_pubk_prik n m \\<equiv>\n  insert (Spy, \\<langle>n, ID n (Sec_PubKey m)\\<rangle>) s\\<^sub>0\"\n\ndefinition tok_id_hash :: \"agent_id \\<Rightarrow> agent_id \\<Rightarrow> state\" where\n\"tok_id_hash n m \\<equiv>\n  insert (Spy, \\<langle>n, Hash (ID n (Sec_PubKey m))\\<rangle>) (tok_id_pubk_prik n m)\"\n\n\nproposition tok_id_pubk_prik_rel:\n \"n \\<in> bad_tok_prik \\<Longrightarrow> s\\<^sub>0 \\<Turnstile> tok_id_pubk_prik n m\"\nby (subgoal_tac \"(s\\<^sub>0, tok_id_pubk_prik n m) \\<in> rel_id_pubk_prik\",\n rule r_into_rtrancl, auto simp: tok_id_pubk_prik_def rel_def image_def, blast)\n\nproposition tok_id_pubk_prik_msg:\n \"n \\<in> bad_tok_prik \\<Longrightarrow>\n    {ID n (Sec_PubKey m), Hash (ID n (Sec_PubKey m)),\n      \\<langle>n, ID n (Sec_PubKey m)\\<rangle>} \\<subseteq> spied (tok_id_pubk_prik n m)\"\nby (auto simp: tok_id_pubk_prik_def)\n\nproposition tok_id_hash_rel:\n \"n \\<in> bad_tok_prik \\<Longrightarrow> s\\<^sub>0 \\<Turnstile> tok_id_hash n m\"\nby (rule rtrancl_into_rtrancl, erule tok_id_pubk_prik_rel [of _ m],\n subgoal_tac \"(tok_id_pubk_prik n m, tok_id_hash n m) \\<in> rel_id_hash\",\n frule_tac [2] tok_id_pubk_prik_msg [of _ m], auto simp: tok_id_hash_def rel_def)\n\n\ntheorem tok_id_identified:\n \"n \\<in> bad_tok_prik \\<Longrightarrow> \\<exists>s. s\\<^sub>0 \\<Turnstile> s \\<and> \\<langle>n, Hash (ID n (Sec_PubKey m))\\<rangle> \\<in> spied s\"\nby (rule exI [of _ \"tok_id_hash n m\"], drule tok_id_hash_rel [of _ m],\n simp add: tok_id_hash_def)\n\n\ndefinition sec_pubk_less :: \"agent_id \\<Rightarrow> state\" where\n\"sec_pubk_less n \\<equiv>\n  insert (Spy, PubKey {Tok_PriK n, Rev_PriK}) s\\<^sub>0\"\n\ndefinition sec_id_pubk_less :: \"agent_id \\<Rightarrow> state\" where\n\"sec_id_pubk_less n \\<equiv>\n  insert (Spy, \\<langle>n, PubKey {Tok_PriK n, Rev_PriK}\\<rangle>) (sec_pubk_less n)\"\n\ndefinition sec_id_pubk_more :: \"agent_id \\<Rightarrow> agent_id \\<Rightarrow> state\" where\n\"sec_id_pubk_more n m \\<equiv>\n  insert (Spy, \\<langle>n, ID n (Sec_PubKey m)\\<rangle>) (sec_id_pubk_less n)\"\n\ndefinition sec_id_hash :: \"agent_id \\<Rightarrow> agent_id \\<Rightarrow> state\" where\n\"sec_id_hash n m \\<equiv>\n  insert (Spy, \\<langle>n, Hash (ID n (Sec_PubKey m))\\<rangle>) (sec_id_pubk_more n m)\"\n\n\nlemma sec_id_identified_1:\n \"{Tok_PriK n, Sec_PriK m, Rev_PriK} \\<noteq> {Tok_PriK n', Rev_PriK}\"\nby (simp add: set_eq_iff, rule exI [of _ \"Sec_PriK m\"], insert\n sec_prik_rev sec_prik_tok_prik, simp add: image_def, drule spec [of _ m], auto)\n\nlemma sec_id_identified_2:\n \"(Spy, PubKey {Tok_PriK n, Rev_PriK}) \\<notin> s\\<^sub>0\"\nby (insert tok_prik_rev sec_id_identified_1, simp add: image_def,\n drule spec [of _ n], auto simp: set_eq_iff)\n\nlemma sec_id_identified_3:\n \"{Tok_PriK n, Rev_PriK} =\n    {Tok_PriK n, Sec_PriK m, Rev_PriK} - {Sec_PriK m}\"\nby (insert sec_prik_rev sec_prik_tok_prik, auto)\n\nlemma sec_id_identified_4:\n \"PubK {Tok_PriK n, Sec_PriK m, Rev_PriK} =\n    PubK (insert (Sec_PriK m) {Tok_PriK n, Rev_PriK})\"\nby auto\n\nproposition sec_pubk_less_rel:\n \"\\<lbrakk>{m, m'} \\<subseteq> bad_sec_prik; (n, m) \\<notin> bad_id; (n, m') \\<in> bad_id\\<rbrakk> \\<Longrightarrow>\n    s\\<^sub>0 \\<Turnstile> sec_pubk_less n\"\nby (subgoal_tac \"(s\\<^sub>0, sec_pubk_less n) \\<in> rel_pubk_less\", rule r_into_rtrancl,\n simp add: rel_def, subst sec_pubk_less_def, subst sec_id_identified_3 [of _ m'],\n simp, (rule exI)+, subst insert_ident, subst sec_id_identified_3 [symmetric],\n insert sec_id_identified_2, auto)\n\nproposition sec_pubk_less_msg:\n \"\\<lbrakk>{m, m'} \\<subseteq> bad_sec_prik; (n, m) \\<notin> bad_id; (n, m') \\<in> bad_id\\<rbrakk> \\<Longrightarrow>\n    {Sec_PriKey m, Sec_PriKey m', PubKey {Tok_PriK n, Rev_PriK},\n      ID n (Sec_PubKey m), Hash (ID n (Sec_PubKey m)),\n      \\<langle>n, ID n (Sec_PubKey m')\\<rangle>} \\<subseteq> spied (sec_pubk_less n) \\<and>\n    {\\<langle>n, PubKey {Tok_PriK n, Rev_PriK}\\<rangle>, \\<langle>n, ID n (Sec_PubKey m)\\<rangle>,\n      \\<langle>n, Hash (ID n (Sec_PubKey m))\\<rangle>} \\<inter>\n      spied (sec_pubk_less n) = {}\"\nby (insert sec_id_identified_2, auto simp: sec_pubk_less_def image_def\n dest: sec_prik_eq)\n\nproposition sec_id_pubk_less_rel:\n \"\\<lbrakk>{m, m'} \\<subseteq> bad_sec_prik; (n, m) \\<notin> bad_id; (n, m') \\<in> bad_id\\<rbrakk> \\<Longrightarrow>\n    s\\<^sub>0 \\<Turnstile> sec_id_pubk_less n\"\nby (rule rtrancl_into_rtrancl, erule sec_pubk_less_rel, assumption+,\n subgoal_tac \"(sec_pubk_less n, sec_id_pubk_less n) \\<in> rel_id_pubk_less\",\n frule_tac [2] sec_pubk_less_msg, simp_all add: sec_id_pubk_less_def rel_def,\n (rule exI)+, subst sec_id_identified_3 [of _ m'], subst (asm) (1 2)\n sec_id_identified_3, subst insert_ident, insert sec_prik_tok_prik, auto)\n\nproposition sec_id_pubk_less_msg:\n \"\\<lbrakk>{m, m'} \\<subseteq> bad_sec_prik; (n, m) \\<notin> bad_id; (n, m') \\<in> bad_id\\<rbrakk> \\<Longrightarrow>\n    {Sec_PriKey m, ID n (Sec_PubKey m), Hash (ID n (Sec_PubKey m)),\n      \\<langle>n, PubKey {Tok_PriK n, Rev_PriK}\\<rangle>} \\<subseteq>\n      spied (sec_id_pubk_less n) \\<and>\n    {\\<langle>n, ID n (Sec_PubKey m)\\<rangle>, \\<langle>n, Hash (ID n (Sec_PubKey m))\\<rangle>} \\<inter>\n      spied (sec_id_pubk_less n) = {}\"\nby (drule sec_pubk_less_msg, insert sec_id_identified_1,\n auto simp: sec_id_pubk_less_def)\n\nproposition sec_id_pubk_more_rel:\n \"\\<lbrakk>{m, m'} \\<subseteq> bad_sec_prik; (n, m) \\<notin> bad_id; (n, m') \\<in> bad_id\\<rbrakk> \\<Longrightarrow>\n    s\\<^sub>0 \\<Turnstile> sec_id_pubk_more n m\"\nby (rule rtrancl_into_rtrancl, erule sec_id_pubk_less_rel, assumption+,\n subgoal_tac \"(sec_id_pubk_less n, sec_id_pubk_more n m) \\<in> rel_id_pubk_more\",\n frule_tac [2] sec_id_pubk_less_msg, simp_all add: sec_id_pubk_more_def rel_def,\n (rule exI)+, subst sec_id_identified_4, subst (asm) (1 3) sec_id_identified_4,\n subst insert_ident, simp_all)\n\nproposition sec_id_pubk_more_msg:\n \"\\<lbrakk>{m, m'} \\<subseteq> bad_sec_prik; (n, m) \\<notin> bad_id; (n, m') \\<in> bad_id\\<rbrakk> \\<Longrightarrow>\n    {ID n (Sec_PubKey m), Hash (ID n (Sec_PubKey m)),\n      \\<langle>n, ID n (Sec_PubKey m)\\<rangle>} \\<subseteq> spied (sec_id_pubk_more n m) \\<and>\n    \\<langle>n, Hash (ID n (Sec_PubKey m))\\<rangle> \\<notin> spied (sec_id_pubk_more n m)\"\nby (drule sec_id_pubk_less_msg, auto simp: sec_id_pubk_more_def)\n\nproposition sec_id_hash_rel:\n \"\\<lbrakk>{m, m'} \\<subseteq> bad_sec_prik; (n, m) \\<notin> bad_id; (n, m') \\<in> bad_id\\<rbrakk> \\<Longrightarrow>\n    s\\<^sub>0 \\<Turnstile> sec_id_hash n m\"\nby (rule rtrancl_into_rtrancl, erule sec_id_pubk_more_rel, assumption+,\n subgoal_tac \"(sec_id_pubk_more n m, sec_id_hash n m) \\<in> rel_id_hash\",\n frule_tac [2] sec_id_pubk_more_msg, auto simp: sec_id_hash_def rel_def)\n\n\ntheorem sec_id_identified:\n \"\\<lbrakk>{m, m'} \\<subseteq> bad_sec_prik; (n, m') \\<in> bad_id\\<rbrakk> \\<Longrightarrow>\n    \\<exists>s. s\\<^sub>0 \\<Turnstile> s \\<and> \\<langle>n, Hash (ID n (Sec_PubKey m))\\<rangle> \\<in> spied s\"\nby (cases \"(n, m) \\<in> bad_id\", blast, rule exI [of _ \"sec_id_hash n m\"],\n drule sec_id_hash_rel, simp_all add: sec_id_hash_def)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Logging_Independent_Anonymity/Possibility.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6406358411176238, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3178154877163656}}
{"text": "           (*-------------------------------------------*\n            |                                           |\n            |         Safety of Specifications          |\n            |                                           |\n            *-------------------------------------------*)\n\ntheory SeqCtrl_safe\nimports MBP_Spec CSP_semantics\nbegin\n\n(*************************************************************\n\n         1. SeqCtrl: safe order\n         2. \n         3. \n         4. \n\n *************************************************************)\n\n(* ----------------------------------------- *\n |                    lemmas                 |\n * ----------------------------------------- *)\n\nlemma Seq_blk:\n\"ALL a P' Blks Deps S. $Seq Blks Deps S ---a---> P'--> S <= Blks\n  --> (if (S = Blks) then (a = Ev finish & P' = STOP) \n  else (EX n. n:enable Blks Deps S & a = Ev (blk n) & \n  P' = $Seq Blks Deps (S Un {n})))\"\n  apply (auto)\n    apply (erule trn.cases, auto)+  (* all cases are checked for ||| *)\n  done\n\n\n\n(* ----------------------------------------- *\n |                    lemmas                 |\n * ----------------------------------------- *)\n\nlemma Seqctrl_safe_induct:\n\"ALL s k t P' S. \nk < length t -->\n       t = rem_tau s -->\n       S <= Blks -->\n       $Seq Blks Deps S ---s--->> P' -->\n       (EX n. t!k = blk n & src Blks Deps n <= dones t k Un S) | (t!k = finish & P' = STOP) \"\n\n  apply (rule allI)\n  apply (induct_tac s)\n   apply (simp)\n\n  apply (simp)\n  apply (rule allI)\n  apply (rule impI)\n  apply (rule allI)\n  apply (rule allI)\n  apply (rule impI)\n  apply (rename_tac a t k P' S)\n  apply (simp add: seq_trn_step)\n  apply (rule impI)\n  apply (erule exE)\n  apply (erule conjE)\n  apply (insert Seq_blk)\n  apply (drule_tac x=\"a\" in spec)\n  apply (drule_tac x=\"P1\" in spec)\n  apply (drule_tac x=\"Blks\" in spec)\n  apply (drule_tac x=\"Deps\" in spec)\n  apply (drule_tac x=\"S\" in spec)\n  apply (simp)\n  apply (case_tac \"S = Blks\")\n\n(*case S=Blks*)\n   apply (simp)\n   apply (rule disjI2)\n   apply (subgoal_tac \"t = [] & P' = STOP\")\n    apply (simp)\n   apply (simp add: stop_seq_trn)\n\n(*case ~S=Blks*)\n  apply (simp)\n  apply (elim exE conjE disjE)\n  apply (simp)\n\n(*case k=0*)\n  apply (case_tac \"k = 0\")\n   apply (simp)\n   apply (simp add:dones_def)\n  apply (simp add:enable_def)\n\n(*case k>0*)\n  apply (drule_tac x=\"k-1\" in spec)\n  apply (simp)\n  (*apply (drule mp)*)\n   apply(subgoal_tac \"EX k'. k = Suc k'\")\n    apply (erule exE)\n   apply (simp)\n\n  apply (drule_tac x=\"P'\" in spec)\n  apply (drule_tac x=\"insert n S\" in spec)\n   apply (simp)\n\n   apply (drule mp)\n   apply (simp add:enable_def)\n   apply (elim exE conjE disjE)\n    apply (rule disjI1)\n    apply (rule_tac x=\"na\" in exI)\n    apply (simp)\n\n    apply (rule order_trans)\n     apply (simp)\n    apply (simp only: dones_insert)\n\n  (* apply(rule disjI2)*)\n   apply (simp)\n\n   apply (simp add: gr0_implies_Suc)\n\n  done\n\nlemma Seqctrl_safe_event_induct:\n\"ALL s k t P' S. k < length t -->\n       t = rem_tau s -->\n       S <= Blks -->\n       $Seq Blks Deps S ---s--->> P' -->\n       (EX n. t!k = blk n) | (t!k = finish & P' = STOP)\"\n  apply (rule allI)\n  apply (induct_tac s)\n   apply (simp)\n\n  apply (simp)\n  apply (rule allI)\n  apply (rule impI)\n  apply (rule allI)\n  apply (rule allI)\n  apply (rule impI)\n  apply (rename_tac a t k P' S)\n  apply (simp add: seq_trn_step)\n  apply (rule impI)\n  apply (erule exE)\n  apply (erule conjE)\n  apply (insert Seq_blk)\n  apply (drule_tac x=\"a\" in spec)\n  apply (drule_tac x=\"P1\" in spec)\n  apply (drule_tac x=\"Blks\" in spec)\n  apply (drule_tac x=\"Deps\" in spec)\n  apply (drule_tac x=\"S\" in spec)\n  apply (simp)\n  apply (case_tac \"S = Blks\")\n\n(*case S=Blks*)\n   apply (simp)\n   apply (rule disjI2)\n  apply(subgoal_tac \"t = [] & P' = STOP\")\n    apply (simp)\n   apply (simp add: stop_seq_trn)\n  apply (simp)\n  apply (elim exE conjE disjE)\n  apply (simp)\n  apply (case_tac \"k = 0\")\n   apply (simp)\n  apply (drule_tac x=\"k-1\" in spec)\n  apply (simp)\n  apply (drule mp)\n   apply(subgoal_tac \"EX k'. k = Suc k'\")\n    apply (erule exE)\n    apply (simp)\n   apply (simp add: gr0_implies_Suc)\n  apply (drule_tac x=\"P'\" in spec)\n  apply (drule_tac x=\"insert n S\" in spec)\n  apply (simp)\n  apply (simp add:enable_def)\n  done\n\n  \n\nlemma Seqctrl_safe_event:\n\" t:traces(SeqCtrl Blks Deps) ==> k < length(t)\n ==> (EX n. t!k = blk n | t!k = finish)\"\n  apply(simp add: traces_def) \n  apply(erule exE)\n  apply(erule conjE)\n  apply(erule exE)\n  apply (rename_tac P')\n  apply (simp add: SeqCtrl_def)\n  apply (insert Seqctrl_safe_event_induct[of Blks Deps])\n  apply (drule_tac x=\"s\" in spec)\n  apply (drule_tac x=\"k\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (drule_tac x=\"P'\" in spec)\n  apply (drule_tac x=\"{}\" in spec)\n  apply (simp)\n  apply (elim exE conjE disjE)\n  apply (simp)\n  apply (simp)\n  done\n\n\n(* ----------------------------------------- *\n |          tamon Proposition 5.1             |\n * ----------------------------------------- *)\nlemma Seqctrl_safe:\n\"t:traces(SeqCtrl Blks Deps) ==> k < length(t) \n ==> (EX n. t!k = blk n & src Blks Deps n <= dones t k)\n | t!k = finish\"\n  apply (simp add:traces_def)\n  apply (elim exE conjE)\n  apply (simp add:SeqCtrl_def)\n  apply (insert Seqctrl_safe_induct  [of Blks Deps])\n  apply (drule_tac x=\"s\" in spec)\n  apply (drule_tac x=\"k\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (drule_tac x=\"x\" in spec)\n  apply (drule_tac x=\"{}\" in spec)\n  apply (simp)\n  apply (elim exE conjE disjE)\n   apply (simp)\n\n  apply (simp)\n  done\n\n\nend\n", "meta": {"author": "nu-manycore", "repo": "public", "sha": "94b6a68b8183e6b756f6ece0fa483b93ad8cc833", "save_path": "github-repos/isabelle/nu-manycore-public", "path": "github-repos/isabelle/nu-manycore-public/public-94b6a68b8183e6b756f6ece0fa483b93ad8cc833/MBP-Prover/SeqCtrl_safe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6723317123102956, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.3178000912169992}}
{"text": "(*\nTitle: WHATandWHERE-Security\nAuthors: Sylvia Grewe, Alexander Lux, Heiko Mantel, Jens Sauer\n*)\ntheory Parallel_Composition\nimports Up_To_Technique MWLs\nbegin\n\nlocale WHATWHERE_Secure_Programs =\nL : MWLs_semantics \"E\" \"BMap\"\n+ WWs : WHATWHERE \"MWLsSteps_det\" \"E\" \"pp\" \"DA\" \"lH\"\nfor E :: \"('exp, 'id, 'val) Evalfunction\"\nand BMap :: \"'val \\<Rightarrow> bool\"\nand DA :: \"('id, 'd::order) DomainAssignment\"\nand lH :: \"('d, 'exp) lHatches\"\nbegin\n\nlemma SdlHPPB_restricted_on_PP_is_SdlHPPB:\n  assumes SdlHPPB: \"SdlHPPB d PP R'\"\n  assumes inR': \"(V,V) \\<in> R'\"\n  assumes Rdef: \"R = {(V',V''). (V',V'') \\<in> R' \n    \\<and> set (PPV V') \\<subseteq> set (PPV V)\n    \\<and> set (PPV V'') \\<subseteq> set (PPV V)}\"\n  shows \"SdlHPPB d PP R\"\nproof (simp add: Strong_dlHPP_Bisimulation_def, auto)\n  from SdlHPPB have \"sym R'\" \n    by (simp add: Strong_dlHPP_Bisimulation_def)\n  with Rdef show \"sym R\" \n    by (simp add: sym_def)\nnext\n  from SdlHPPB have \"trans R'\" \n    by (simp add: Strong_dlHPP_Bisimulation_def)\n  with Rdef show \"trans R\" \n    by (simp add: trans_def, auto)\nnext\n  fix V' V''\n  assume inR_part: \"(V',V'') \\<in> R\"\n  with SdlHPPB Rdef show \"length V' = length V''\"\n    by (simp add: Strong_dlHPP_Bisimulation_def, auto)\nnext\n  fix V' V'' i\n  assume inR_part: \"(V',V'') \\<in> R\"\n  assume irange: \"i < length V'\"\n  assume notIDC: \n    \"\\<not> IDC d (V'!i) (htchLoc (pp (V'!i)))\"\n  with SdlHPPB inR_part irange Rdef \n  show \"NDC d (V'!i)\"\n    by (simp add: Strong_dlHPP_Bisimulation_def, auto)\nnext\n  fix V' V'' i \\<alpha> p m1 m1' m2\n  assume inR_part: \"(V',V'') \\<in> R\"\n  assume irange: \"i < length V'\"\n  assume step: \"\\<langle>V'!i,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m2\\<rangle>\"\n  assume dhequal: \"m1 \\<sim>\\<^bsub>d,(htchLocSet PP)\\<^esub> m1'\"\n  \n  from inR_part SdlHPPB Rdef have eqlen: \"length V' = length V''\"\n    by (simp add: Strong_dlHPP_Bisimulation_def, auto)\n  \n  from inR_part Rdef \n  have \"set (PPV V') \\<subseteq> set (PPV V) \\<and> set (PPV V'') \\<subseteq> set (PPV V)\"\n    by auto\n  \n  with irange PPc_in_PPV_version eqlen\n  have PPc_Vs_at_i: \n    \"set (PPc (V'!i)) \\<subseteq> set (PPV V) \\<and> set (PPc (V''!i)) \\<subseteq> set (PPV V)\"\n    by (metis subset_trans)\n  \n  from SdlHPPB inR_part Rdef irange step dhequal\n    strongdlHPPB_aux[of \"d\" \"PP\" \"R'\" \"i\" \n    \"V'\" \"V''\" \"m1\" \"\\<alpha>\" \"p\" \"m2\" \"m1'\"]\n  obtain p' \\<alpha>' m2' where stepreq: \"\\<langle>V''!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n    stepResultsinR p p' R' \\<and> (\\<alpha>,\\<alpha>') \\<in> R' \\<and>\n    dhequality_alternative d PP (pp (V'!i)) m2 m2'\"\n    by auto\n  have Rpp': \"stepResultsinR p p' R\"\n  proof -\n    {\n      fix c c'\n      assume step1: \"\\<langle>V'!i,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>Some c,m2\\<rangle>\"\n      assume step2: \"\\<langle>V''!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>Some c',m2'\\<rangle>\"\n      assume inR'_res: \"([c],[c']) \\<in> R'\"\n      \n      from PPc_Vs_at_i step1 step2 PPsc_of_step\n      have \"set (PPc c) \\<subseteq> set (PPV V) \\<and> set (PPc c') \\<subseteq> set (PPV V)\"\n        by (metis (no_types) option.sel xt1(6))\n      \n      with inR'_res Rdef have \"([c],[c']) \\<in> R\"\n        by auto\n    }\n    thus ?thesis      \n      by (metis step stepResultsinR_def stepreq)\n  qed\n             \n  have R\\<alpha>\\<alpha>': \"(\\<alpha>,\\<alpha>') \\<in> R\"\n  proof - \n    from PPc_Vs_at_i step stepreq PPs\\<alpha>_of_step have \n      \"set (PPV \\<alpha>) \\<subseteq> set (PPV V) \\<and> set (PPV \\<alpha>') \\<subseteq> set (PPV V)\"\n      by (metis (no_types) xt1(6))\n    with stepreq Rdef show ?thesis\n      by auto\n  qed\n  \n  from stepreq Rpp' R\\<alpha>\\<alpha>' show \n    \"\\<exists>p' \\<alpha>' m2'. \\<langle>V''!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n    stepResultsinR p p' R \\<and> (\\<alpha>,\\<alpha>') \\<in> R \\<and>\n    dhequality_alternative d PP (pp (V'!i)) m2 m2'\"\n    by auto\nqed\n\n\ntheorem parallel_composition:\n  \"\\<lbrakk> \\<forall>i < length V. WHATWHERE_Secure [V!i]; unique_PPV V \\<rbrakk>\n  \\<Longrightarrow> WHATWHERE_Secure V\"\nproof (simp add: WHATWHERE_Secure_def, induct V, auto)\n  fix d PP\n  from WHATWHERE_empty \n  show \"\\<exists>R. SdlHPPB d PP R \\<and> ([],[]) \\<in> R\"\n    by (simp add: WHATWHERE_Secure_def)\nnext\n  fix c V d PP\n  assume IH: \"\\<lbrakk> \\<forall>i < length V.\n    \\<forall>d PP. \\<exists>R. SdlHPPB d PP R \\<and> ([V!i],[V!i]) \\<in> R;\n    unique_PPV V \\<rbrakk>\n    \\<Longrightarrow> \\<forall>d PP. \\<exists>R. SdlHPPB d PP R \\<and> (V,V) \\<in> R\"\n  assume ISassump: \"\\<forall>i < Suc (length V).\n    \\<forall>d PP. \\<exists>R. SdlHPPB d PP R \\<and> ([(c#V)!i],[(c#V)!i]) \\<in> R\"\n  assume uniPPcV: \"unique_PPV (c#V)\"\n  \n  hence IHassump1: \"unique_PPV V\"\n    by (simp add: unique_PPV_def)\n\n  from uniPPcV have nocommonPP: \"set (PPc c) \\<inter> set (PPV V) = {}\"\n    by (simp add: unique_PPV_def)\n  \n  from ISassump have IHassump2: \"\\<forall>i < length V. \n    \\<forall>d PP. \\<exists>R. SdlHPPB d PP R \\<and> ([V!i],[V!i]) \\<in> R\"\n    by auto\n\n  with IHassump1 IH obtain RV' where RV'assump:\n    \"SdlHPPB d PP RV' \\<and> (V,V) \\<in> RV'\"\n    by blast\n\n  def RV \\<equiv> \"{(V',V''). (V',V'') \\<in> RV' \\<and> set (PPV V') \\<subseteq> set (PPV V)\n    \\<and> set (PPV V'') \\<subseteq> set (PPV V)}\"\n\n  with RV'assump RV_def SdlHPPB_restricted_on_PP_is_SdlHPPB\n  have SdlHPPRV: \"SdlHPPB d PP RV\"\n    by force\n\n  from ISassump obtain Rc' where Rc'assump: \n    \"SdlHPPB d PP Rc' \\<and> ([c],[c]) \\<in> Rc'\"\n    by (metis append_Nil drop_Nil neq0_conv not_Cons_self \n      nth_append_length Cons_nth_drop_Suc zero_less_Suc)\n \n  def Rc \\<equiv> \"{(V',V''). (V',V'') \\<in> Rc' \\<and> set (PPV V') \\<subseteq> set (PPc c)\n    \\<and> set (PPV V'') \\<subseteq> set (PPc c)}\"\n\n  with Rc'assump Rc_def SdlHPPB_restricted_on_PP_is_SdlHPPB\n  have SdlHPPRc: \"SdlHPPB d PP Rc\"\n    by force\n\n  from nocommonPP have \"Domain RV \\<inter> Domain Rc \\<subseteq> {[]}\"\n    by (simp add: RV_def Rc_def, auto,\n      metis Int_mono inf_commute inf_idem le_bot nocommonPP unique_V_uneq)\n\n  with commonArefl_subset_commonDomain\n  have Areflassump1: \"Arefl RV \\<inter> Arefl Rc \\<subseteq> {[]}\"\n    by force\n    \n  def R \\<equiv> \"{(V',V''). \\<exists>c c' W W'. V' = c#W \\<and> V'' = c'#W' \\<and> W \\<noteq> []\n    \\<and> W' \\<noteq> [] \\<and> ([c],[c']) \\<in> Rc \\<and> (W,W') \\<in> RV}\"\n\n  with RV_def RV'assump Rc_def Rc'assump have inR: \n    \"V \\<noteq> [] \\<Longrightarrow> (c#V,c#V) \\<in> R\"\n    by auto\n    \n  from R_def Rc_def RV_def nocommonPP\n  have \"Domain R \\<inter> Domain (Rc \\<union> RV) = {}\"\n    by (simp add: R_def Rc_def RV_def, auto,\n      metis inf_bot_right le_inf_iff subset_empty unique_V_uneq,\n      metis (hide_lams, no_types) inf_absorb1 inf_bot_right le_inf_iff unique_c_uneq)\n            \n  with commonArefl_subset_commonDomain\n  have Areflassump2: \"Arefl R \\<inter> Arefl (Rc \\<union> RV) \\<subseteq> {[]}\"\n    by force\n\n  have disjuptoR: \n    \"disj_dlHPP_Bisimulation_Up_To_R' d PP (Rc \\<union> RV) R\"\n    proof (simp add: disj_dlHPP_Bisimulation_Up_To_R'_def, auto)\n        from Areflassump1 SdlHPPRc SdlHPPRV Union_Strong_dlHPP_Bisim\n        show \"SdlHPPB d PP (Rc \\<union> RV)\"\n          by force\n      next\n        from SdlHPPRV have symRV: \"sym RV\"\n          by (simp add: Strong_dlHPP_Bisimulation_def)\n        from SdlHPPRc have symRc: \"sym Rc\"\n          by (simp add: Strong_dlHPP_Bisimulation_def)\n        with symRV R_def show \"sym R\"\n          by (simp add: sym_def, auto)\n      next\n        from SdlHPPRV have transRV: \"trans RV\"\n          by (simp add: Strong_dlHPP_Bisimulation_def)\n        from SdlHPPRc have transRc: \"trans Rc\"\n          by (simp add: Strong_dlHPP_Bisimulation_def)\n        show \"trans R\"\n           proof -\n            {\n            fix V V' V''\n            assume p1: \"(V,V') \\<in> R\"\n            assume p2: \"(V',V'') \\<in> R\"\n            have \"(V,V'') \\<in> R\"\n              proof -\n                from p1 R_def obtain c c' W W' where p1assump:\n                  \"V = c#W \\<and> V' = c'#W' \\<and> W \\<noteq> [] \\<and> W' \\<noteq> [] \\<and>\n                  ([c],[c']) \\<in> Rc \\<and> (W,W') \\<in> RV\"\n                  by auto\n                with p2 R_def obtain c'' W'' where p2assump:\n                  \"V'' = c''#W'' \\<and> W'' \\<noteq> [] \\<and>\n                  ([c'],[c'']) \\<in> Rc \\<and> (W',W'') \\<in> RV\"\n                  by auto\n                with p1assump transRc transRV have \n                  trans_assump: \"([c],[c'']) \\<in> Rc \\<and> (W,W'') \\<in> RV\"\n                  by (simp add: trans_def, blast)\n                with p1assump p2assump R_def show ?thesis\n                  by auto\n              qed\n             }\n            thus ?thesis unfolding trans_def by blast\n           qed\n      next\n        fix V V'\n        assume \"(V,V') \\<in> R\"\n        with R_def SdlHPPRV show \"length V = length V'\"\n          by (simp add: Strong_dlHPP_Bisimulation_def, auto)\n      next\n        fix V V' i\n        assume inR: \"(V,V') \\<in> R\"\n        assume irange: \"i < length V\"\n        assume notIDC: \"\\<not> IDC d (V!i) \n          (htchLoc (pp (V!i)))\"\n        from inR R_def obtain c c' W W' where VV'assump:\n          \"V = c#W \\<and> V'=c'#W' \\<and> W \\<noteq> [] \\<and> W' \\<noteq> [] \\<and>\n          ([c],[c']) \\<in> Rc \\<and> (W,W') \\<in> RV\"\n          by auto\n        -- \"Case separation for i\"\n        from VV'assump SdlHPPRc have Case_i0:\n          \"i = 0 \\<Longrightarrow> (NDC d (V!i) \\<or>\n            IDC d (V!i) (htchLoc (pp (V!i))))\"\n          by (simp add: Strong_dlHPP_Bisimulation_def, auto)\n\n        from VV'assump SdlHPPRV have \"\\<forall>i < length W. \n          (NDC d (W!i) \\<or>\n            IDC d (W!i) (htchLoc (pp (W!i))))\"\n          by (simp add: Strong_dlHPP_Bisimulation_def, auto)\n\n        with irange VV'assump have Case_in0:\n          \"i > 0 \\<Longrightarrow> (NDC d (V!i) \\<or> \n          IDC d (V!i) (htchLoc (pp (V!i))))\"\n          by simp\n        from notIDC Case_i0 Case_in0 \n        show \"NDC d (V!i)\"\n          by auto\n      next\n        fix V V' m1 m1' m2 \\<alpha> p i\n        assume inR: \"(V,V') \\<in> R\"\n        assume irange: \"i < length V\"\n        assume step: \"\\<langle>V!i,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m2\\<rangle>\"\n        assume dhequal: \"m1 \\<sim>\\<^bsub>d,(htchLocSet PP)\\<^esub> m1'\"\n        \n        from inR R_def obtain c c' W W' where VV'assump:\n          \"V = c#W \\<and> V'=c'#W' \\<and> W \\<noteq> [] \\<and> W' \\<noteq> [] \\<and>\n          ([c],[c']) \\<in> Rc \\<and> (W,W') \\<in> RV\"\n          by auto\n        -- \"Case separation for i\"\n        from VV'assump SdlHPPRc strongdlHPPB_aux[of \"d\" \"PP\" \n          \"Rc\" \"0\" \"[c]\" \"[c']\"] step dhequal\n        have Case_i0:\n          \"i = 0 \\<Longrightarrow> \\<exists>p' \\<alpha>' m2'.\n          \\<langle>V'!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n          stepResultsinR p p' (R \\<union> (Rc \\<union> RV)) \\<and>\n          ((\\<alpha>,\\<alpha>') \\<in> R \\<or> (\\<alpha>,\\<alpha>') \\<in> Rc \\<or> (\\<alpha>,\\<alpha>') \\<in> RV) \\<and>\n          dhequality_alternative d PP (pp (V!i)) m2 m2'\"\n          by (simp add: stepResultsinR_def, blast)\n\n        from step VV'assump irange have rewV: \n          \"i > 0 \\<Longrightarrow> (i-Suc 0) < length W \\<and> V!i = W!(i-Suc 0)\"\n          by simp\n\n        with irange VV'assump step dhequal SdlHPPRV \n          strongdlHPPB_aux[of \"d\" \"PP\" \"RV\" _ \"W\" \"W'\"]\n        have Case_in0:\n          \"i > 0 \\<Longrightarrow>  \\<exists>p' \\<alpha>' m2'.\n          \\<langle>V'!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n          stepResultsinR p p' (R \\<union> (Rc \\<union> RV)) \\<and>\n          ((\\<alpha>,\\<alpha>') \\<in> R \\<or> (\\<alpha>,\\<alpha>') \\<in> Rc \\<or> (\\<alpha>,\\<alpha>') \\<in> RV) \\<and>\n          dhequality_alternative d PP (pp (V!i)) m2 m2'\"\n          by (simp add: stepResultsinR_def, blast)\n        \n        from Case_i0 Case_in0 \n        show \"\\<exists>p' \\<alpha>' m2'.\n          \\<langle>V'!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n          stepResultsinR p p' (R \\<union> (Rc \\<union> RV)) \\<and>\n          ((\\<alpha>,\\<alpha>') \\<in> R \\<or> (\\<alpha>,\\<alpha>') \\<in> Rc \\<or> (\\<alpha>,\\<alpha>') \\<in> RV) \\<and>\n          dhequality_alternative d PP (pp (V!i)) m2 m2'\"\n          by auto\n      qed\n  with Areflassump2 Rc'assump Up_To_Technique\n  show \"\\<exists>R. SdlHPPB d PP R \\<and> (c#V, c#V) \\<in> R\"\n    by (metis UnCI inR)\n\nqed\n\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/WHATandWHERE_Security/Parallel_Composition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.3178000850101879}}
{"text": "(*  Title:      HOL/Auth/n_mutualExFsm_lemma_inv__3_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExFsm Protocol Case Study*} \n\ntheory n_mutualExFsm_lemma_inv__3_on_rules imports n_mutualExFsm_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0 p__Inv1. p__Inv0\\<le>N\\<and>p__Inv1\\<le>N\\<and>p__Inv0~=p__Inv1\\<and>f=inv__3  p__Inv0 p__Inv1)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_fsm  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_fsm  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_fsmVsinv__3) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExFsm/n_mutualExFsm_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056167854461, "lm_q2_score": 0.4610167793123158, "lm_q1q2_score": 0.3177814554123157}}
{"text": "(* @TAG(OTHER_LGPL) *)\n\n(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoarePartialDef.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Hoare Logic for Partial Correctness *}\ntheory HoarePartialDef imports Semantic begin\n\ntype_synonym ('s,'p) quadruple = \"('s assn \\<times> 'p \\<times> 's assn \\<times> 's assn)\"\n\nsubsection {* Validity of Hoare Tuples: @{text \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\ndefinition\n  valid :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n                (\"_\\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \\<forall>s t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> s \\<in> Normal ` P \\<longrightarrow> t \\<notin> Fault ` F  \n                      \\<longrightarrow>  t \\<in>  Normal ` Q \\<union> Abrupt ` A\"\n\ndefinition\n  cvalid::\n  \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n      's assn,('s,'p,'f) com,'s assn,'s assn] =>bool\"\n                (\"_,_\\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> (\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\<longrightarrow> \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\ndefinition\n  nvalid :: \"[('s,'p,'f) body,nat,'f set, \n                's assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n                (\"_\\<Turnstile>_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \\<forall>s t. \\<Gamma>\\<turnstile>\\<langle>c,s \\<rangle> =n\\<Rightarrow> t \\<longrightarrow> s \\<in> Normal ` P \\<longrightarrow> t \\<notin> Fault ` F \n                        \\<longrightarrow> t \\<in>  Normal ` Q \\<union> Abrupt ` A\"\n\n\ndefinition\n  cnvalid::\n  \"[('s,'p,'f) body,('s,'p) quadruple set,nat,'f set, \n     's assn,('s,'p,'f) com,'s assn,'s assn] \\<Rightarrow> bool\"\n                (\"_,_\\<Turnstile>_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> (\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\<longrightarrow> \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\nnotation (ascii)\n  valid  (\"_|='/_/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60) and\n  cvalid  (\"_,_|='/_/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60) and\n  nvalid  (\"_|=_:'/_/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60) and\n  cnvalid  (\"_,_|=_:'/_/ _ _ _,_\"  [61,60,60,60,1000, 20, 1000,1000] 60)\n\n\nsubsection {*Properties of Validity *}\n\nlemma valid_iff_nvalid: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A = (\\<forall>n. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A)\"\n  apply (simp only: valid_def nvalid_def exec_iff_execn )\n  apply (blast dest: exec_final_notin_to_execn)\n  done\n \nlemma cnvalid_to_cvalid: \"(\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A) \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (unfold cvalid_def cnvalid_def valid_iff_nvalid [THEN eq_reflection])\n  apply fast\n  done\n\nlemma nvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P; t\\<notin> Fault ` F\\<rbrakk> \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: nvalid_def)\n\nlemma validI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t;s \\<in> P; t\\<notin>Fault ` F\\<rbrakk> \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: valid_def)\n\nlemma cvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n          \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: cvalid_def valid_def)\n\nlemma cvalidD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A;\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n  \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  by (auto simp add: cvalid_def valid_def)\n\nlemma cnvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n   \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n          \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: cnvalid_def nvalid_def)\n\n\nlemma cnvalidD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A;\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n   \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P;\n   t\\<notin>Fault ` F\\<rbrakk> \n  \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  by (auto simp add: cnvalid_def nvalid_def)\n\nlemma nvalid_augment_Faults:\n  assumes validn:\"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F \\<subseteq> F'\"\n  shows \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F'\"\n  with F' have \"t \\<notin> Fault ` F\"\n    by blast\n  with exec P validn\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (auto simp add: nvalid_def)\nqed\n\nlemma valid_augment_Faults:\n  assumes validn:\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F \\<subseteq> F'\"\n  shows \"\\<Gamma>\\<Turnstile>\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F'\"\n  with F' have \"t \\<notin> Fault ` F\"\n    by blast\n  with exec P validn\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (auto simp add: valid_def)\nqed\n\nlemma nvalid_to_nvalid_strip:\n  assumes validn:\"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec_strip: \"strip F' \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F\"\n  from exec_strip obtain t' where\n    exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t'\" and\n    t': \"t' \\<in> Fault ` (-F') \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: execn_strip_to_execn)\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"t' \\<in> Fault ` F\")\n    case True\n    with t' F F' have False\n      by blast\n    thus ?thesis ..\n  next\n    case False\n    with exec P validn\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: nvalid_def)\n    moreover\n    from this t' have \"t'=t\"\n      by auto\n    ultimately show ?thesis\n      by simp\n  qed\nqed\n\n\nlemma valid_to_valid_strip:\n  assumes valid:\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec_strip: \"strip F' \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F\"\n  from exec_strip obtain t' where\n    exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t'\" and\n    t': \"t' \\<in> Fault ` (-F') \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: exec_strip_to_exec)\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"t' \\<in> Fault ` F\")\n    case True\n    with t' F F' have False\n      by blast\n    thus ?thesis ..\n  next\n    case False\n    with exec P valid\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: valid_def)\n    moreover\n    from this t' have \"t'=t\"\n      by auto\n    ultimately show ?thesis\n      by simp\n  qed\nqed\n\n\nsubsection {* The Hoare Rules: @{text \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\nlemma mono_WeakenContext: \"A \\<subseteq> B \\<Longrightarrow>\n        (\\<lambda>(P, c, Q, A'). (\\<Gamma>, \\<Theta>, F, P, c, Q, A') \\<in> A) x \\<longrightarrow>\n        (\\<lambda>(P, c, Q, A'). (\\<Gamma>, \\<Theta>, F, P, c, Q, A') \\<in> B) x\"\napply blast\ndone\n\n\ninductive \"hoarep\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n    's assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n    (\"(3_,_/\\<turnstile>\\<^bsub>'/_ \\<^esub>(_/ (_)/ _,/_))\" [60,60,60,1000,20,1000,1000]60)\n  for \\<Gamma>::\"('s,'p,'f) body\"\nwhere\n  Skip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. f s \\<in> Q} (Basic f) Q,A\"\n\n| Spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. (\\<forall>t. (s,t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s,t) \\<in> r)} (Spec r) Q,A\"\n\n| Seq: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Seq c\\<^sub>1 c\\<^sub>2) Q,A\"\n  \n| Cond: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c\\<^sub>1 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> - b) c\\<^sub>2 Q,A\\<rbrakk>\n         \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (While b c) (P \\<inter> - b),A\"\n\n| Guard: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) (Guard f g c) Q,A\"\n\n| Guarantee: \"\\<lbrakk>f \\<in> F; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec:\n  \"\\<lbrakk>(P,p,Q,A) \\<in> Specs;  \n    \\<forall>(P,p,Q,A) \\<in> Specs. p \\<in> dom \\<Gamma> \\<and> \\<Gamma>,\\<Theta>\\<union>Specs\\<turnstile>\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A \\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| DynCom:\n      \"\\<forall>s \\<in> P. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (c s) Q,A \n      \\<Longrightarrow> \n      \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n| Throw: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk> \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\<forall>s \\<in> P. \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A \n           \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"\\<lbrakk>(P,p,Q,A) \\<in> \\<Theta>\\<rbrakk>\n         \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| ExFalso: \"\\<lbrakk>\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A; \\<not> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  -- {* This is a hack rule that enables us to derive completeness for\n        an arbitrary context @{text \"\\<Theta>\"}, from completeness for an empty context.*}  \n\n\n\ntext {* Does not work, because of rule ExFalso, the context @{text \"\\<Theta>\"} is to blame.\n A weaker version with empty context can be derived from soundness \n and completeness later on. *}\nlemma hoare_strip_\\<Gamma>: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"strip (-F) \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv \nproof induct\n  case Skip thus ?case by (iprover intro: hoarep.Skip)\nnext\n  case Basic thus ?case by (iprover intro: hoarep.Basic)\nnext\n  case Spec thus ?case by (iprover intro: hoarep.Spec)\nnext\n  case Seq thus ?case by (iprover intro: hoarep.Seq)\nnext\n  case Cond thus ?case by (iprover intro: hoarep.Cond)\nnext\n  case While thus ?case by (iprover intro: hoarep.While)\nnext\n  case Guard thus ?case by (iprover intro: hoarep.Guard)\n(*next\n  case CallSpec thus ?case by (iprover intro: hoarep.CallSpec)\nnext\n  case (CallRec A Abr Abr' Init P Post Pre Procs Q R Result Return Z \\<Gamma> \\<Theta> init p\n         result return )\n  from CallRec.hyps\n  have \"\\<forall>p\\<in>Procs. \\<forall>Z. (strip \\<Gamma>),\\<Theta> \\<union>\n             (\\<Union>\\<^bsub>p\\<in>Procs\\<^esub>\n                 \\<Union>\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n                      Post p Z, Abr p Z)})\\<turnstile>\n            (Pre p Z) (the (\\<Gamma> p)) (R p Z),(Abr' p Z)\" by blast\n  hence \"\\<forall>p\\<in>Procs. \\<forall>Z. (strip \\<Gamma>),\\<Theta> \\<union>\n             (\\<Union>\\<^bsub>p\\<in>Procs\\<^esub>\n                 \\<Union>\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n                      Post p Z, Abr p Z)})\\<turnstile>\n            (Pre p Z) (the ((strip \\<Gamma>) p)) (R p Z),(Abr' p Z)\"\n    by (auto intro: hoarep.StripI)\n  then show ?case\n    apply - \n    apply (rule hoarep.CallRec)\n    apply (assumption | simp only:dom_strip)+\n    done*)\nnext\n  case DynCom \n  thus ?case\n    by - (rule hoarep.DynCom,best  elim!: ballE exE)\nnext\n  case Throw thus ?case by (iprover intro: hoarep.Throw)\nnext\n  case Catch thus ?case by (iprover intro: hoarep.Catch)\n(*next \n  case CONSEQ thus ?case apply (auto intro: hoarep.CONSEQ)*)\nnext\n  case Asm thus ?case by (iprover intro: hoarep.Asm)\nnext\n  case ExFalso\n  thus ?case\n    oops\n\nlemma hoare_augment_context: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"\\<And>\\<Theta>'. \\<Theta> \\<subseteq> \\<Theta>' \\<Longrightarrow> \\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n  case CallRec\n  case (CallRec P p Q A Specs \\<Theta> F \\<Theta>')\n  from CallRec.prems\n  have \"\\<Theta>\\<union>Specs\n       \\<subseteq> \\<Theta>'\\<union>Specs\"\n    by blast\n  with CallRec.hyps (2) \n  have \"\\<forall>(P,p,Q,A)\\<in>Specs.  p \\<in> dom \\<Gamma> \\<and> \\<Gamma>,\\<Theta>'\\<union>Specs \\<turnstile>\\<^bsub>/F\\<^esub> P  (the (\\<Gamma> p)) Q,A\"\n    by fastforce\n\n  with CallRec show ?case by - (rule hoarep.CallRec)\nnext\n  case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n  case (Conseq P \\<Theta> F c Q A \\<Theta>')\n  from Conseq\n  have \"\\<forall>s \\<in> P. \n         (\\<exists>P' Q' A'. \\<Gamma>,\\<Theta>' \\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A)\"\n    by blast\n  with Conseq show ?case by - (rule hoarep.Conseq)\nnext\n  case (ExFalso \\<Theta> F P c Q A \\<Theta>')\n  have valid_ctxt: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\" \"\\<Theta> \\<subseteq> \\<Theta>'\" by fact+\n  hence \"\\<forall>n. \\<Gamma>,\\<Theta>'\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n    by (simp add: cnvalid_def) blast\n  moreover have invalid: \"\\<not> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"  by fact\n  ultimately show ?case\n    by (rule hoarep.ExFalso)\nqed (blast intro: hoarep.intros)+\n\n\nsubsection {* Some Derived Rules *}\n\nlemma  Conseq': \"\\<forall>s. s \\<in> P \\<longrightarrow> \n            (\\<exists>P' Q' A'. \n              (\\<forall> Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\<and>\n                    (\\<exists>Z. s \\<in> P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A)))\n           \\<Longrightarrow>\n           \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\<lbrakk>\\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n              \\<forall>s. s \\<in> P \\<longrightarrow> (\\<exists> Z. s\\<in>P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A))\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule Conseq) blast\n\ntheorem conseqPrePost [trans]: \n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow>  Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq [where ?P'=\"\\<lambda>Z. P'\" and ?Q'=\"\\<lambda>Z. Q'\"]) auto\n\nlemma conseqPre [trans]: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q,A \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost [trans]: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q',A' \\<Longrightarrow> Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \n \\<Longrightarrow>   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq) auto\n\n\nlemma CallRec': \n  \"\\<lbrakk>p\\<in>Procs; Procs \\<subseteq> dom \\<Gamma>;\n   \\<forall>p\\<in>Procs. \n    \\<forall>Z. \\<Gamma>,\\<Theta> \\<union> (\\<Union>p\\<in>Procs. \\<Union>Z. {((P p Z),p,Q p Z,A p Z)})\n        \\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\\<rbrakk>\n   \\<Longrightarrow>\n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\<Union>p\\<in>Procs. \\<Union>Z. {((P p Z),p,Q p Z,A p Z)}\"])\napply  blast\napply blast\ndone\n\nend ", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/Simpl/HoarePartialDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011542032313, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3176299335587884}}
{"text": "theory flash20Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv20:  \n  (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_FAck ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n  fix s \n \n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma NI_InvVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_InvAck_1VsInv20:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6,auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_InvAck_1_HomeVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_InvAck_2VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_GetXVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') )  ( Const SHWB_ShWb ))    ( eqn ( IVar ( Global ''Dir_Pending'') )  ( Const false ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv20:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv20:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_GetVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_Get ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak1VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put1VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put2VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put3VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_PutVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Local_PutXAcksDoneVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_NakVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Nak_ClearVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Nak_HomeVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Nak_Home ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_GetX_NakVsInv20:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Remote_GetX_PutXVsInv20:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Remote_Get_Nak1VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Remote_Get_Nak2VsInv20:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n    \n\nlemma lemmaOnPtrAtGetX[intro]:\n  assumes  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n    and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX )) s\" and\n    a6:\"formEval   ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) )   (Const iInv2)) s \" and\n    a7:\"\\<forall>f. f \\<in> (invariants   N) \\<longrightarrow> formEval f s \"\n shows  \"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2) )  s\"\n proof(rule ccontr)\n  assume b0:\"\\<not>formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2) )  s\"\n  have b1:\"formEval (inv2 iInv1 iInv2) s\"\n    apply(cut_tac a7)\n    \n    apply(drule_tac x=\"inv2  iInv1 iInv2\" in spec)\n    apply(cut_tac a7 a2 a3 a4,simp)\n    done\n with b0 a5 a6 show False\n  by auto\nqed  \n\n\n\nlemma lemmaOnPtrAtGet[intro]:\n  assumes  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n    and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_Get )) s\" and\n    a6:\"formEval   ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) )   (Const iInv2)) s \" and\n    a7:\"\\<forall>f. f \\<in> (invariants   N) \\<longrightarrow> formEval f s \"\n shows  \"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2) )  s\"\n proof(rule ccontr)\n  assume b0:\"\\<not>formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2) )  s\"\n  have b1:\"formEval (inv3 iInv1 iInv2) s\"\n    apply(cut_tac a7)\n    \n    apply(drule_tac x=\"inv3  iInv1 iInv2\" in spec)\n    apply(cut_tac a7 a2 a3 a4,simp)\n    done\n with b0 a5 a6 show False\n  by auto\nqed  \n\nlemma lemmaOnPtr1[intro]:\n  assumes  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n    and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_Get )) s\" and\n    a6:\"formEval   ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) )   (Const iInv2)) s \" and\n    a7:\"\\<forall>f. f \\<in> (invariants   N) \\<longrightarrow> formEval f s \" and\n    b2:\"iInv1' \\<le> N\" and  b3:\"iInv2' \\<le> N\" and  b4:\"iInv1'~=iInv2'  \" \n    and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') )  ( Const UNI_Get )) s\" and\n    b6:\"formEval   ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') )   (Const iInv2')) s \" and\n    b7:\"iInv2\\<noteq>iInv2'\"\n shows False\n proof -\n  have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2) )  s\"\n    by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGet)\n  have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2') )  s\"\n    by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGet)\n with c1 b7  show False\n  by auto\nqed  \n\n\nlemma lemmaOnPtr2[intro]:\n  assumes  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n    and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX )) s\" and\n    a6:\"formEval   ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) )   (Const iInv2)) s \" and\n    a7:\"\\<forall>f. f \\<in> (invariants   N) \\<longrightarrow> formEval f s \" and\n    b2:\"iInv1' \\<le> N\" and  b3:\"iInv2' \\<le> N\" and  b4:\"iInv1'~=iInv2'  \" \n    and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') )  ( Const UNI_GetX )) s\" and\n    b6:\"formEval   ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') )   (Const iInv2')) s \" and\n    b7:\"iInv2\\<noteq>iInv2'\"\n shows False\n proof -\n  have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2) )  s\"\n    by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGetX)\n  have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2') )  s\"\n    by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGetX)\n with c1 b7  show False\n  by auto\nqed \n\n\nlemma lemmaOnPtr3[intro]:\n  assumes  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n    and a5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_Get )) s\" and\n    a6:\"formEval   ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) )   (Const iInv2)) s \" and\n    a7:\"\\<forall>f. f \\<in> (invariants   N) \\<longrightarrow> formEval f s \" and\n    b2:\"iInv1' \\<le> N\" and  b3:\"iInv2' \\<le> N\" and  b4:\"iInv1'~=iInv2'  \" \n    and b5:\"formEval ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1') )  ( Const UNI_GetX )) s\" and\n    b6:\"formEval   ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1') )   (Const iInv2')) s \" and\n    b7:\"iInv2\\<noteq>iInv2'\"\n shows False\n proof -\n  have c1:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2) )  s\"\n    by(metis a2 a3 a4 a5 a6 a7 lemmaOnPtrAtGet)\n  have c2:\"formEval ( eqn ( IVar ( Global ''Dir_HeadPtr'') )   (Const iInv2') )  s\"\n    by(metis b2 b3 b4 b5 b6 a7 lemmaOnPtrAtGetX)\n with c1 b7  show False\n  by auto\nqed      \n    \n    \n lemma NI_Remote_Get_Put2VsInv20Aux:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule'' s (inv20  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n      have \"invHoldForRule3' s (inv20  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\"  \n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n              \n      then have \"?P3 s\" by(rule weak3)\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n     have \"invHoldForRule3' s (inv20  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iRule2) )  ( Const CACHE_E ))  )    ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) )   (Const iInv2))  ) ) \" in exI,auto)\n \n        \n        done\n\n        then have \"?P3 s\" by(rule weak3)\n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)\"\n\n                  \n     have \"invHoldForRule3' s (inv20  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n        then have \"?P3 s\" by(rule weak3)\n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)\"\n\n                  \n       have \"invHoldForRule3' s (inv20  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( andForm ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iRule1) )  ( Const UNI_Get ))  \n          ( eqn ( IVar ( Para ''UniMsg_proc'' iInv1) )   (Const iInv2))  )    ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))  )  \n          ( eqn ( IVar ( Para ''UniMsg_proc'' iRule1) )   (Const iInv2))  ) ) \" in exI,auto)\n \n        \n        done\n\n        then have \"?P3 s\" by(rule weak3)\n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n           (*       have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done*)\n\n               \n      have \"?P3 s\"\n\n         \n       proof( unfold invHoldForRule3''_def,simp only:Let_def,( rule impI)+,                   rule ccontr)\n                    assume c1:\"\\<forall>f'. f' \\<in> invariants N \\<longrightarrow> formEval f' s\" and c2:\"formEval (pre (NI_Remote_Get_Put2 iRule1 iRule2)) s \"\n                    and c3:\"\\<not> formEval (substFormByStatement (inv20 iInv1 iInv2) (act (NI_Remote_Get_Put2 iRule1 iRule2))) s\"\n                   have d1:\" formEval (eqn (IVar (Para ''UniMsg_Cmd'' iInv1)) (Const UNI_GetX)) s\" by(cut_tac b1 c2 c3, auto)\n                   have d2:\"formEval (eqn (IVar (Para ''UniMsg_Cmd'' iRule1)) (Const UNI_Get)) s\" by(cut_tac a5 a6 b1 c2 c3, auto)\n                   have d3:\"formEval (eqn (IVar (Para ''UniMsg_proc'' iInv1)) (Const iInv2)) s\"  by(cut_tac b1 c2 c3, auto)\n                   have d4:\"formEval (eqn (IVar (Para ''UniMsg_proc'' iRule1)) (Const iRule2)) s\"  by(cut_tac b1 c2 c3, auto)\n                    show False thm lemmaOnPtr2\n                    apply(cut_tac a1 a2 a3 a4 a5 a6 b1 c1 c2 c3 d1 d2 d3 d4,blast )\n                    done\n                   qed\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\n \n    \n lemma NI_Remote_Get_Put2VsInv20:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\"\nby (metis NI_Remote_Get_Put2VsInv20Aux a2 a3 a4 a5 a6 local.a1 strengthEn) \n  \nlemma NI_Remote_PutVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutXVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_ReplaceVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_ReplaceHomeVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ReplaceHomeShrVldVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ReplaceShrVldVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_ShWbVsInv20:  \n  (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_ShWb N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n  fix s \n \n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma NI_WbVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (NI_Wb ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_GetX1VsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_GetX2VsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX1VsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX2VsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX3VsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX4VsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_Get_GetVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_Get_PutVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_PutXVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Local_PutX ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_ReplaceVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Local_Replace ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Remote_GetVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_GetXVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_PutXVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma PI_Remote_ReplaceVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma StoreVsInv20:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (Store  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma StoreHomeVsInv20:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv20  iInv1  iInv2 ) (StoreHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash20Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3176299335587883}}
{"text": "subsection \\<open>A restricted equality between KBO and WPO\\<close>\n\ntext \\<open>The remaining difficulty to make KBO an instance of WPO is the\n  different treatment of lexicographic comparisons, which is unrestricted in KBO,\n  but there is a length-restriction in WPO. \n  Therefore we will only show that KBO is an instance of WPO if we compare terms with \n  bounded arity.\\<close>\n\ntext \\<open>This restriction does however not prohibit us from lifting properties of WPO to KBO.\n  For instance, for several properties one can choose a large-enough bound restriction of WPO, \n  since there are only finitely many arities occurring in a property.\\<close>\n\ntheory KBO_as_WPO\n  imports \n    WPO \n    KBO_Transformation\nbegin\n\ndefinition bounded_arity :: \"nat \\<Rightarrow> ('f \\<times> nat)set \\<Rightarrow> bool\" where\n  \"bounded_arity b F = (\\<forall> (f,n) \\<in> F. n \\<le> b)\" \n\nlemma finite_funas_term[simp,intro]: \"finite (funas_term t)\" \n  by (induct t, auto)\n\ncontext weight_fun begin\n\ndefinition \"weight_le s t \\<equiv>\n  (vars_term_ms (SCF s) \\<subseteq># vars_term_ms (SCF t) \\<and> weight s \\<le> weight t)\"\n\ndefinition \"weight_less s t \\<equiv>\n  (vars_term_ms (SCF s) \\<subseteq># vars_term_ms (SCF t) \\<and> weight s < weight t)\"\n\nlemma weight_le_less_iff: \"weight_le s t \\<Longrightarrow> weight_less s t \\<longleftrightarrow> weight s < weight t\"\n  by (auto simp: weight_le_def weight_less_def)\n\nlemma weight_less_iff: \"weight_less s t \\<Longrightarrow> weight_le s t \\<and> weight s < weight t\"\n  by (auto simp: weight_le_def weight_less_def)\n\n\nabbreviation \"weight_NS \\<equiv> {(t,s). weight_le s t}\"\n\nabbreviation \"weight_S \\<equiv> {(t,s). weight_less s t}\"\n\nlemma weight_le_mono_one:\n  assumes S: \"weight_le s t\"\n  shows \"weight_le (Fun f (ss1 @ s # ss2)) (Fun f (ss1 @ t # ss2))\" (is \"weight_le ?s ?t\")\nproof -\n  from S have w: \"weight s \\<le> weight t\" and v: \"vars_term_ms (SCF s) \\<subseteq># vars_term_ms (SCF t)\" \n    by (auto simp: weight_le_def)\n  have v': \"vars_term_ms (SCF ?s) \\<subseteq># vars_term_ms (SCF ?t)\"\n    using mset_replicate_mono[OF v] by simp\n  have w': \"weight ?s \\<le> weight ?t\" using sum_list_replicate_mono[OF w] by simp\n  from v' w' show ?thesis by (auto simp: weight_le_def)\nqed\n\nlemma weight_le_ctxt: \"weight_le s t \\<Longrightarrow> weight_le (C\\<langle>s\\<rangle>) (C\\<langle>t\\<rangle>)\"\n  by (induct C, auto intro: weight_le_mono_one)\n\nlemma SCF_stable:\n  assumes \"vars_term_ms (SCF s) \\<subseteq># vars_term_ms (SCF t)\"\n  shows \"vars_term_ms (SCF (s \\<cdot> \\<sigma>)) \\<subseteq># vars_term_ms (SCF (t \\<cdot> \\<sigma>))\"\n  unfolding scf_term_subst\n  using vars_term_ms_subst_mono[OF assms].\n\nlemma SN_weight_S: \"SN weight_S\"\nproof-\n  from wf_inv_image[OF wf_less]\n  have wf: \"wf {(s,t). weight s < weight t}\" by (auto simp: inv_image_def)\n  show ?thesis\n    by (unfold SN_iff_wf, rule wf_subset[OF wf], auto simp: weight_less_def)\nqed\n\nlemma weight_less_imp_le: \"weight_less s t \\<Longrightarrow> weight_le s t\" by (simp add: weight_less_def weight_le_def)\n\nlemma weight_le_Var_Var: \"weight_le (Var x) (Var y) \\<longleftrightarrow> x = y\"\n  by (auto simp: weight_le_def)\nend\n\ncontext kbo begin\n\nlemma kbo_altdef:\n    \"kbo s t = (if weight_le t s\n      then if weight_less t s\n        then (True, True)\n        else (case s of\n          Var y \\<Rightarrow> (False, (case t of Var x \\<Rightarrow> x = y | Fun g ts \\<Rightarrow> ts = [] \\<and> least g))\n        | Fun f ss \\<Rightarrow> (case t of\n            Var x \\<Rightarrow> (True, True)\n          | Fun g ts \\<Rightarrow> if pr_strict (f, length ss) (g, length ts)\n            then (True, True)\n            else if pr_weak (f, length ss) (g, length ts)\n            then lex_ext_unbounded kbo ss ts\n            else (False, False)))\n      else (False, False))\"\n  by (simp add: weight_le_less_iff weight_le_def)\n\nend\n\ncontext admissible_kbo begin\n\nlemma weight_le_stable:\n  assumes \"weight_le s t\"\n  shows \"weight_le (s \\<cdot> \\<sigma>) (t \\<cdot> \\<sigma>)\"\n  using assms weight_stable_le SCF_stable by (auto simp: weight_le_def)\n\nlemma weight_less_stable:\n  assumes \"weight_less s t\"\n  shows \"weight_less (s \\<cdot> \\<sigma>) (t \\<cdot> \\<sigma>)\"\n  using assms weight_stable_lt SCF_stable by (auto simp: weight_less_def)\n\nlemma simple_arg_pos_weight: \"simple_arg_pos weight_NS (f,n) i\"\n  unfolding simple_arg_pos_def\nproof (intro allI impI, unfold snd_conv fst_conv)\n  fix ts :: \"('f,'a)term list\" \n  assume i: \"i < n\" and len: \"length ts = n\" \n  from id_take_nth_drop[OF i[folded len]] i[folded len]\n  obtain us vs where id: \"Fun f ts = Fun f (us @ ts ! i # vs)\" \n    and us: \"us = take i ts\" \n    and len: \"length us = i\" by auto\n  have \"length us < Suc (length us + length vs)\" by auto\n  from scf[OF this, of f] obtain j where [simp]: \"scf (f, Suc (length us + length vs)) (length us) = Suc j\"\n    by (rule lessE)\n  show \"(Fun f ts, ts ! i) \\<in> weight_NS\" \n    unfolding weight_le_def id by (auto simp: o_def)\nqed\n\nlemma weight_lemmas:\n  shows \"refl weight_NS\" and \"trans weight_NS\" and \"trans weight_S\"\n    and \"weight_NS O weight_S \\<subseteq> weight_S\" and \"weight_S O weight_NS \\<subseteq> weight_S\"\n  by (auto intro!: refl_onI transI simp: weight_le_def weight_less_def)\n\ninterpretation kbo': admissible_kbo w w0 pr_strict' pr_weak' least scf\n  by (rule admissible_kbo')\n\ncontext\n  assumes least_global: \"\\<And> f g. least f \\<Longrightarrow> pr_weak g (f,0)\"\n    and least_trans: \"\\<And> f g. least f \\<Longrightarrow> pr_weak (f,0) g \\<Longrightarrow> least (fst g) \\<and> snd g = 0\" \n  fixes n :: nat\nbegin\n\nlemma kbo_instance_of_wpo_with_assms: \"wpo_with_assms \n  weight_S weight_NS (\\<lambda>f g. (pr_strict f g, pr_weak f g))\n     (\\<lambda>(f, n). n = 0 \\<and> least f) full_status False (\\<lambda>f. False)\" \n  apply (unfold_locales)\n                      apply (auto simp: weight_lemmas SN_weight_S pr_SN pr_strict_irrefl\n      weight_less_stable weight_le_stable weight_le_mono_one weight_less_imp_le\n      simple_arg_pos_weight)\n                 apply (force dest: least_global least_trans simp: pr_strict)+\n            apply (auto simp: pr_strict least dest:pr_weak_trans)\n  done\n\ninterpretation wpo: wpo_with_assms\n  where S = weight_S and NS = weight_NS\n    and prc = \"\\<lambda>f g. (pr_strict f g, pr_weak f g)\" and prl = \"\\<lambda>(f,n). n = 0 \\<and> least f\"\n    and c = \"\\<lambda>_. Lex\"\n    and ssimple = False and large = \"\\<lambda>f. False\" and \\<sigma>\\<sigma> = full_status\n    and n = n \n  by (rule kbo_instance_of_wpo_with_assms)\n\nlemma kbo_as_wpo_with_assms: assumes \"bounded_arity n (funas_term t)\"\n  shows \"kbo s t = wpo.wpo s t\"\nproof -\n  define m where \"m = size s + size t\" \n  from m_def assms show ?thesis\n  proof (induct m arbitrary: s t rule: less_induct)\n    case (less m s t)\n    hence IH: \"size si + size ti < size s + size t \\<Longrightarrow> bounded_arity n (funas_term ti) \\<Longrightarrow> kbo si ti = wpo.wpo si ti\" for si ti :: \"('f,'a)term\" by auto\n    note wpo_sI = arg_cong[OF wpo.wpo.simps, of fst, THEN iffD2]\n    note wpo_nsI = arg_cong[OF wpo.wpo.simps, of snd, THEN iffD2]\n    note bounded = less(3)\n    show ?case\n    proof (cases s)\n      case s: (Var x)\n      have \"\\<not> weight_less t (Var x)\"\n        by (metis leD weight.simps(1) weight_le_less_iff weight_less_imp_le weight_w0)\n      thus ?thesis\n        by (cases t, auto simp add: s kbo_altdef wpo.wpo.simps, simp add: weight_le_def)\n    next\n      case s: (Fun f ss)\n      show ?thesis\n      proof (cases t)\n        case t: (Var y)\n        { assume \"weight_le t s\"\n          then have \"\\<exists>s' \\<in> set ss. weight_le t s'\"\n            apply (auto simp: s t weight_le_def)\n            by (metis scf set_scf_list weight_w0)\n          then obtain s' where s': \"s' \\<in> set ss\" and \"weight_le t s'\" by auto\n          from this(2) have \"wpo.wpo_ns s' t\"\n          proof (induct s')\n            case (Var x)\n            then show ?case by (auto intro!:wpo_nsI simp: t weight_le_Var_Var)\n          next\n            case (Fun f' ss')\n            from this(2) have \"\\<exists>s'' \\<in> set ss'. weight_le t s''\"\n              apply (auto simp: t weight_le_def)\n              by (metis scf set_scf_list weight_w0)\n            then obtain s'' where \"s'' \\<in> set ss'\" and \"weight_le t s''\" by auto\n            with Fun(1)[OF this] Fun(2)\n            show ?case by (auto intro!: wpo_nsI simp: t in_set_conv_nth)\n          qed\n          with s' have \"\\<exists>s' \\<in> set ss. wpo.wpo_ns s' t\" by auto\n        }\n        then \n        show ?thesis unfolding wpo.wpo.simps[of s t] kbo_altdef[of s t]\n          by (auto simp add: s t weight_less_iff set_conv_nth, auto)\n      next\n        case t: (Fun g ts)\n        {\n          fix j\n          assume \"j < length ts\" \n          hence \"ts ! j \\<in> set ts\" by auto\n          hence \"funas_term (ts ! j) \\<subseteq> funas_term t\" unfolding t by auto\n          with bounded have \"bounded_arity n (funas_term (ts ! j))\" unfolding bounded_arity_def by auto\n        } note bounded_tj = this\n        note IH_tj = IH[OF _ this]\n        show ?thesis\n        proof (cases \"\\<not> weight_le t s \\<or> weight_less t s\")\n          case True  \n          thus ?thesis unfolding wpo.wpo.simps[of s t] kbo_altdef[of s t]\n            unfolding s t by (auto simp: weight_less_iff)\n        next\n          case False\n          let ?f = \"(f,length ss)\" \n          let ?g = \"(g,length ts)\" \n          from False have wle: \"weight_le t s = True\" \"weight_less t s = False\" \n            \"(s, t) \\<in> weight_NS \\<longleftrightarrow> True\" \"(s, t) \\<in> weight_S \\<longleftrightarrow> False\" by auto\n          have lex: \"(Lex = Lex \\<and> Lex = Lex) = True\" by simp\n          have sig: \"set (wpo.\\<sigma> ?f) = {..<length ss}\"\n            \"set (wpo.\\<sigma> ?g) = {..<length ts}\" by auto\n          have map: \"map ((!) ss) (wpo.\\<sigma> ?f) = ss\"\n            \"map ((!) ts) (wpo.\\<sigma> ?g) = ts\"\n            by (auto simp: map_nth)\n          have sizes: \"i < length ss \\<Longrightarrow> size (ss ! i) < size s\" for i unfolding s\n            by (simp add: size_simp1)\n          have sizet: \"i < length ts \\<Longrightarrow> size (ts ! i) < size t\" for i unfolding t\n            by (simp add: size_simp1)\n          have wpo: \"wpo.wpo s t = \n             (if \\<exists>i\\<in>{..<length ss}. wpo.wpo_ns (ss ! i) t then (True, True)\n              else if pr_weak ?f ?g \\<and> (\\<forall>j\\<in>{..<length ts}. wpo.wpo_s s (ts ! j))\n              then if pr_strict ?f ?g then (True, True) else lex_ext wpo.wpo n ss ts\n              else (False, False))\" \n            unfolding wpo.wpo.simps[of s t]\n            unfolding s t term.simps split Let_def lex if_True sig map\n            unfolding s[symmetric] t[symmetric] wle if_True weight_less_iff if_False False snd_conv by auto\n          have \"kbo s t = (if pr_strict ?f ?g then (True, True)\n               else if pr_weak ?f ?g then lex_ext_unbounded kbo ss ts\n               else (False, False))\" \n            unfolding kbo_altdef[of s t]\n            unfolding s t term.simps split Let_def if_True \n            unfolding s[symmetric] t[symmetric] wle if_True weight_less_iff if_False by auto\n          also have \"lex_ext_unbounded kbo ss ts = lex_ext kbo n ss ts\" \n            using bounded[unfolded t] unfolding bounded_arity_def lex_ext_def by auto\n          also have \"\\<dots> = lex_ext wpo.wpo n ss ts\" \n            by (rule lex_ext_cong[OF refl refl refl], rule IH_tj, auto dest!: sizes sizet)\n          finally have kbo: \"kbo s t =\n              (if pr_strict ?f ?g then (True, True)\n               else if pr_weak ?f ?g then lex_ext wpo.wpo n ss ts\n               else (False, False))\" .\n          show ?thesis\n          proof (cases \"\\<exists>i\\<in>{..<length ss}. wpo.wpo_ns (ss ! i) t\")\n            case True\n            then obtain i where i: \"i < length ss\" and \"wpo.wpo_ns (ss ! i) t\" by auto\n            then obtain b where \"wpo.wpo (ss ! i) t = (b, True)\" by (cases \"wpo.wpo (ss ! i) t\", auto)\n            also have \"wpo.wpo (ss ! i) t = kbo (ss ! i) t\" using i by (intro IH[symmetric, OF _ bounded], auto dest: sizes)\n            finally have \"NS (ss ! i) t\" by simp\n            from kbo_supt_one[OF this]\n            have \"S (Fun f (take i ss @ ss ! i # drop (Suc i) ss)) t\" .\n            also have \"(take i ss @ ss ! i # drop (Suc i) ss) = ss\" using i by (metis id_take_nth_drop)\n            also have \"Fun f ss = s\" unfolding s by simp\n            finally have \"S s t\" .\n            with S_imp_NS[OF this]\n            have \"kbo s t = (True,True)\" by (cases \"kbo s t\", auto) \n            with True show ?thesis unfolding wpo by auto\n          next\n            case False\n            hence False: \"(\\<exists>i\\<in>{..<length ss}. wpo.wpo_ns (ss ! i) t) = False\" by simp\n            {\n              fix j\n              assume NS: \"NS s t\" \n              assume j: \"j < length ts\" \n              (* here we make use of proven properties of KBO: subterm-property and transitivity,\n                 perhaps there is a simple proof without already using these properties *)\n              from kbo_supt_one[OF NS_refl, of g \"take j ts\" \"ts ! j\" \"drop (Suc j) ts\"]\n              have S: \"S t (ts ! j)\" using id_take_nth_drop[OF j] unfolding t by auto\n              from kbo_trans[of s t \"ts ! j\"] NS S have \"S s (ts ! j)\" by auto\n              with S S_imp_NS[OF this]\n              have \"kbo s (ts ! j) = (True, True)\" by (cases \"kbo s (ts ! j)\", auto)\n              hence \"wpo.wpo_s s (ts ! j)\" \n                by (subst IH_tj[symmetric], insert sizet[OF j] j, auto)\n            }\n            thus ?thesis unfolding wpo kbo False if_False using lex_ext_stri_imp_nstri[of wpo.wpo n ss ts]\n              by (cases \"lex_ext wpo.wpo n ss ts\", auto simp: pr_strict split: if_splits)\n          qed\n        qed\n      qed\n    qed\n  qed\nqed\nend\n\ntext \\<open>This is the main theorem. It tells us that KBO can be seen as an instance of WPO, under mild preconditions:\n  the parameter $n$ for the lexicographic extension has to be chosen high enough to cover the arities of all \n  terms that should be compared.\\<close>\nlemma defines \"prec \\<equiv> ((\\<lambda>f g. (pr_strict' f g, pr_weak' f g)))\" \n  and \"prl \\<equiv> (\\<lambda>(f, n). n = 0 \\<and> least f)\" \n  shows \n    kbo_encoding_is_valid_wpo: \"wpo_with_assms weight_S weight_NS prec prl full_status False (\\<lambda>f. False)\"\n  and \n    kbo_as_wpo: \"bounded_arity n (funas_term t) \\<Longrightarrow> kbo s t = wpo.wpo n weight_S weight_NS prec prl full_status (\\<lambda>_. Lex) False (\\<lambda>f. False) s t\" \n  unfolding prec_def prl_def\n  subgoal by (intro admissible_kbo.kbo_instance_of_wpo_with_assms[OF admissible_kbo'] \n        least_pr_weak' least_pr_weak'_trans)\n  apply (subst kbo'_eq_kbo[symmetric])\n  apply (subst admissible_kbo.kbo_as_wpo_with_assms[OF admissible_kbo' least_pr_weak' least_pr_weak'_trans, symmetric], (auto)[3])\n  by auto\n\ntext \\<open>As a proof-of-concept we show that now properties of WPO can be used to prove these properties for KBO.\n  Here, as example we consider closure under substitutions and strong normalization, \n  but the following idea can be applied for several more properties:\n  if the property involves only terms where the arities are bounded, then just choose the parameter $n$ large enough.\n  This even works for strong normalization, since in an infinite chain of KBO-decreases $t_1 > t_2 > t_3 > ...$ all terms have\n  a weight of at most the weight of $t_1$, and this weight is also a bound on the arities.\\<close>\n\nlemma KBO_stable_via_WPO: \"S s t \\<Longrightarrow> S (s \\<cdot> (\\<sigma> :: ('f,'a) subst)) (t \\<cdot> \\<sigma>)\"\nproof -\n  let ?terms = \"{t, t \\<cdot> \\<sigma>}\" (* collect all rhss of comparisons *)\n  let ?prec = \"((\\<lambda>f g. (pr_strict' f g, pr_weak' f g)))\" \n  let ?prl = \"(\\<lambda>(f, n). n = 0 \\<and> least f)\" \n  have \"finite (\\<Union> (funas_term ` ?terms))\" \n    by auto\n  from finite_list[OF this] obtain F where F: \"set F = \\<Union> (funas_term ` ?terms)\" by auto\n  (* since there only finitely many symbols, we can take n as the maximal arity *)\n  define n where \"n = max_list (map snd F)\" \n\n  (* now get a WPO for this choice of n *)\n  interpret wpo: wpo_with_assms\n  where S = weight_S and NS = weight_NS\n    and prc = ?prec and prl = ?prl\n    and c = \"\\<lambda>_. Lex\"\n    and ssimple = False and large = \"\\<lambda>f. False\" and \\<sigma>\\<sigma> = full_status\n    and n = n \n    by (rule kbo_encoding_is_valid_wpo)\n\n  {\n    fix t\n    assume \"t \\<in> ?terms\" \n    hence \"funas_term t \\<subseteq> set F\" unfolding F by auto\n    hence \"bounded_arity n (funas_term t)\" unfolding bounded_arity_def \n      using max_list[of _ \"map snd F\", folded n_def] by fastforce\n  }\n  (* for all the terms we have that KBO = WPO *)\n  note kbo_as_wpo = kbo_as_wpo[OF this]\n\n  (* and finally transfer the existing property of WPO to KBO *)\n  from wpo.WPO_S_subst[of s t \\<sigma>]\n  show \"S s t \\<Longrightarrow> S (s \\<cdot> \\<sigma>) (t \\<cdot> \\<sigma>)\"\n    using kbo_as_wpo by auto\nqed\n\nlemma weight_is_arity_bound: \"weight t \\<le> b \\<Longrightarrow> bounded_arity b (funas_term t)\" \nproof (induct t)\n  case (Fun f ts)\n  have \"sum_list (map weight ts) \\<le> weight (Fun f ts)\" \n    using sum_list_scf_list[of ts \"scf (f,length ts)\", OF scf] by auto\n  also have \"\\<dots> \\<le> b\" using Fun by auto\n  finally have sum_b: \"sum_list (map weight ts) \\<le> b\" .\n  {\n    fix t\n    assume t: \"t \\<in> set ts\" \n    from split_list[OF this] have \"weight t \\<le> sum_list (map weight ts)\" by auto\n    with sum_b have \"bounded_arity b (funas_term t)\" using t Fun by auto\n  } note IH = this\n  have \"length ts = sum_list (map (\\<lambda> _. 1) ts)\" by (induct ts, auto)\n  also have \"\\<dots> \\<le> sum_list (map weight ts)\"\n    apply (rule sum_list_mono)\n    subgoal for t using weight_gt_0[of t] by auto\n    done\n  also have \"\\<dots> \\<le> b\" by fact\n  finally have len: \"length ts \\<le> b\" by auto\n  from IH len show ?case unfolding bounded_arity_def by auto\nqed (auto simp: bounded_arity_def)\n  \nlemma KBO_SN_via_WPO: \"SN {(s,t). S s t}\"\nproof \n  fix f :: \"nat \\<Rightarrow> ('f,'a)term\" \n  assume \"\\<forall>i. (f i, f (Suc i)) \\<in> {(s, t). S s t}\" \n  hence steps: \"S (f i) (f (Suc i))\" for i by auto\n  define n where \"n = weight (f 0)\"\n\n  have w_bound: \"weight (f i) \\<le> n\" for i\n  proof (induct i)\n    case (Suc i)\n    from steps[of i] have \"weight (f (Suc i)) \\<le> weight (f i)\" \n      unfolding kbo.simps[of \"f i\"] by (auto split: if_splits)\n    with Suc show ?case by simp\n  qed (auto simp: n_def)\n\n  let ?prec = \"((\\<lambda>f g. (pr_strict' f g, pr_weak' f g)))\" \n  let ?prl = \"(\\<lambda>(f, n). n = 0 \\<and> least f)\" \n\n  (* now get a WPO for this choice of n *)\n  interpret wpo: wpo_with_assms\n  where S = weight_S and NS = weight_NS\n    and prc = ?prec and prl = ?prl\n    and c = \"\\<lambda>_. Lex\"\n    and ssimple = False and large = \"\\<lambda>f. False\" and \\<sigma>\\<sigma> = full_status\n    and n = n \n    by (rule kbo_encoding_is_valid_wpo)\n\n  have \"kbo (f i) (f (Suc i)) = wpo.wpo (f i) (f (Suc i))\" for i\n    by (rule kbo_as_wpo[OF weight_is_arity_bound[OF w_bound]])\n  (* for all the terms in the infinite sequence f 0, f 1, ... \n     we have that KBO = WPO *)\n\n  (* and finally derive contradiction to SN-property of WPO *)\n  from steps[unfolded this] wpo.WPO_S_SN show False by auto\nqed\n\nend\n  \nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Weighted_Path_Order/KBO_as_WPO.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3176299335587883}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(*\n * Facts about recursive functions with measure parameter.\n * Any recursive functions from AutoCorres are monotonic in the measure,\n * which allows us to use the \"measure_call\" mechanism for calling them.\n *)\ntheory MonadMono\nimports\n  NonDetMonadEx\n  Monads.WhileLoopRulesCompleteness\n  Monads.OptionMonadWP\nbegin\n\n(*\n * Call function f by returning all of its possible results.\n * The call succeeds if any measure value succeeds.\n *)\ndefinition \"measure_call f \\<equiv>\n    \\<lambda>s. ({(r', s'). \\<exists>m. (r', s') \\<in> fst (f m s)}, \\<forall>m. snd (f m s))\"\n\n(*\n * monad_mono gives preconditions for functions so that measure_call will\n * return meaningful results.\n *\n * The preconditions are:\n *\n * - If the measure is increased, the function never returns fewer\n *   results. (Monotonicity condition)\n *\n * - If the function succeeds with some measure, it will not fail with\n *   a larger measure, and will return exactly the same results.\n *\n * The monotonicity condition is technically not needed, but all our\n * functions satisfy it anyway and it makes intermediate proofs easier.\n *)\ndefinition \"monad_mono f \\<equiv>\n     (\\<forall>(x :: nat) y s. x < y \\<longrightarrow>\n         (fst (f x s) \\<subseteq> fst (f y s) \\<and>\n          (\\<not> snd (f x s) \\<longrightarrow> \\<not> snd (f y s) \\<and> fst (f x s) = fst (f y s))))\"\n\n(* Basic monad_mono lemmas *)\nlemma monad_mono_incl: \"\\<lbrakk> monad_mono f; \\<not> snd (f m s) \\<rbrakk> \\<Longrightarrow> fst (f m' s) \\<subseteq> fst (f m s)\"\n  using less_linear[where x = m and y = m']\n  by (auto simp: monad_mono_def)\n\n(* wp rules for function calls *)\nlemma call_all_valid [wp]:\n    \"\\<lbrakk> \\<forall> m. valid P (x m) Q; monad_mono x \\<rbrakk> \\<Longrightarrow> valid P (measure_call x) Q\"\n  apply (clarsimp simp: valid_def measure_call_def monad_mono_def)\n  by blast\n\nlemma call_all_validNF [wp]:\n    \"\\<lbrakk>  validNF P (x m) Q; monad_mono x \\<rbrakk> \\<Longrightarrow> validNF P (measure_call x) Q\"\n  apply (clarsimp simp: measure_call_def validNF_def valid_def no_fail_def)\n  apply (metis in_mono split_conv monad_mono_incl)\n  done\n\n(* Alternative definition of monad_mono, suitable for induction *)\ndefinition \"monad_mono_step f m \\<equiv>\n  (\\<forall>s. fst (f m s) \\<subseteq> fst (f (Suc m) s) \\<and>\n       (\\<not> snd (f m s) \\<longrightarrow> \\<not> snd (f (Suc m) s) \\<and> fst (f m s) = fst (f (Suc m) s)))\"\n\nlemma monad_mono_alt_def: \"monad_mono f = (\\<forall>m. monad_mono_step f m)\"\n  apply (rule iffI)\n   apply (fastforce simp: monad_mono_def monad_mono_step_def)\n  apply (unfold monad_mono_def monad_mono_step_def)\n  apply clarify\n  apply (subst (asm) atomize_all[symmetric])+\n  proof -\n    fix x y :: nat\n    fix s\n    assume suc: \"\\<And>m s. fst (f m s) \\<subseteq> fst (f (Suc m) s) \\<and>\n              (\\<not> snd (f m s) \\<longrightarrow> \\<not> snd (f (Suc m) s) \\<and> fst (f m s) = fst (f (Suc m) s))\"\n       and less: \"x < y\"\n    thus \"fst (f x s) \\<subseteq> fst (f y s) \\<and>\n          (\\<not> snd (f x s) \\<longrightarrow> \\<not> snd (f y s) \\<and> fst (f x s) = fst (f y s))\"\n      apply (induct x)\n       apply (induct y)\n        apply blast\n       apply blast\n      (* induct bureaucracy... *)\n      proof -\n        fix x :: nat\n        assume less: \"Suc x < y\"\n        thus \"fst (f (Suc x) s) \\<subseteq> fst (f y s) \\<and>\n           (\\<not> snd (f (Suc x) s) \\<longrightarrow> \\<not> snd (f y s) \\<and> fst (f (Suc x) s) = fst (f y s))\"\n          apply (induct y)\n           apply blast\n          apply (case_tac \"Suc x < y\")\n           using suc apply blast\n          apply (case_tac \"Suc x = y\")\n           using suc apply blast\n          apply simp\n          done\n       qed\n  qed\n\nlemmas monad_mono_step = iffD2[OF monad_mono_alt_def, rule_format]\n\nlemma monad_mono_step_const: \"monad_mono_step (\\<lambda>_. f) m\"\n  by (simp add: monad_mono_step_def)\n\n(* nondet_monad rules *)\nlemma monad_mono_step_in_monad:\n  \"\\<lbrakk> monad_mono_step f m; (r', s') \\<in> fst (f m s) \\<rbrakk> \\<Longrightarrow> (r', s') \\<in> fst (f (Suc m) s)\"\n  apply (clarsimp simp: monad_mono_step_def)\n  apply blast\n  done\n\nlemma monad_mono_step_snd_monad:\n  \"\\<lbrakk> monad_mono_step f m; \\<not> snd (f m s) \\<rbrakk> \\<Longrightarrow> \\<not> snd (f (Suc m) s)\"\n  by (clarsimp simp: monad_mono_step_def)\n\nlemma monad_mono_step_bexI:\n  \"\\<lbrakk> monad_mono_step f m; (r', s') \\<in> fst (f m s); P r' s' \\<rbrakk> \\<Longrightarrow> \\<exists>(r', s') \\<in> fst (f (Suc m) s). P r' s'\"\n  apply (drule (1) monad_mono_step_in_monad)\n  apply force\n  done\n\nlemma monad_mono_stepI [intro]:\n  \"\\<lbrakk> \\<And>s r' s'. (r', s') \\<in> fst (f m s) \\<Longrightarrow> (r', s') \\<in> fst (f (Suc m) s);\n     \\<And>s. \\<not> snd (f m s) \\<Longrightarrow> \\<not> snd (f (Suc m) s);\n     \\<And>s r' s'. \\<lbrakk> \\<not> snd (f m s); \\<not> snd (f (Suc m) s); (r', s') \\<in> fst (f (Suc m) s) \\<rbrakk>\n                \\<Longrightarrow> (r', s') \\<in> fst (f m s)\n   \\<rbrakk> \\<Longrightarrow> monad_mono_step f m\"\n  apply (clarsimp simp: monad_mono_step_def)\n  apply fast\n  done\n\nlemma monad_mono_step_bind:\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. (f m) >>= (g m)) m\"\n  apply atomize\n  apply rule\n    apply (monad_eq)\n    apply (metis monad_mono_step_in_monad)\n   apply (monad_eq simp: Ball_def)\n   apply (metis monad_mono_step_def)\n  apply (monad_eq simp: Ball_def)\n  apply (unfold monad_mono_step_def)\n  apply blast\n  done\n\nlemma monad_mono_step_bindE:\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. (f m) >>=E (g m)) m\"\n  apply (unfold bindE_def)\n  apply (rule monad_mono_step_bind)\n   apply simp\n  apply (monad_eq simp: monad_mono_step_def NonDetMonad.lift_def\n      split: sum.splits)\n  done\n\nlemma monad_mono_step_liftE:\n  \"monad_mono_step f m \\<Longrightarrow> monad_mono_step (\\<lambda>m. liftE (f m)) m\"\n  apply (unfold liftE_def)\n  apply (erule monad_mono_step_bind)\n  apply (rule monad_mono_step_const)\n  done\n\nlemma monad_mono_step_handleE':\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. f m <handle2> g m) m\"\n  apply atomize\n  apply rule\n    apply (monad_eq)\n    apply (metis monad_mono_step_in_monad)\n   apply (monad_eq simp: Ball_def)\n   apply (metis monad_mono_step_def)\n  apply (monad_eq simp: Ball_def)\n  apply (fastforce simp: monad_mono_step_def)\n  done\n\nlemma monad_mono_step_handleE:\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. f m <handle> g m) m\"\n  by (simp add: handleE_def monad_mono_step_handleE')\n\nlemma monad_mono_step_condition:\n  \"\\<lbrakk> monad_mono_step f m; monad_mono_step g m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. condition C (f m) (g m)) m\"\n  apply rule\n    apply (monad_eq simp: monad_mono_step_def, blast)+\n  done\n\nlemma fst_whileLoop_is_exs_valid:\n  \"((a, b) \\<in> fst (whileLoop C B i s)) = \\<lbrace> \\<lambda>s'. s' = s \\<rbrace> whileLoop C B i \\<exists>\\<lbrace> \\<lambda>rv s. rv = a \\<and> s = b \\<rbrace>\"\n  by (clarsimp simp: exs_valid_def Bex_def)\n\nlemma not_snd_whileLoop_is_validNF:\n  \"(\\<not> snd (whileLoop C B i s)) = \\<lbrace> \\<lambda>s'. s' = s \\<rbrace> whileLoop C B i \\<lbrace> \\<lambda>_ _. True \\<rbrace>!\"\n  by (clarsimp simp: validNF_alt_def)\n\nlemma monad_mono_step_whileLoop:\n  assumes body_mono: \"\\<And>x. monad_mono_step (\\<lambda>m. B m x) m\"\n  shows \"monad_mono_step (\\<lambda>m. whileLoop C (B m) i) m\"\nproof -\n  {\n    fix a b s\n    have \"(a, b) \\<in> fst (whileLoop C (B m) i s) \\<Longrightarrow>\n             (a, b) \\<in> fst (whileLoop C (B (Suc m)) i s)\"\n      apply (clarsimp simp: fst_whileLoop_is_exs_valid)\n      apply (subst (asm) exs_valid_whileLoop_complete [symmetric])\n      apply (erule exE | erule conjE)+\n      apply (rule_tac T=T and R=R in exs_valid_whileLoop)\n         apply clarsimp\n        apply (cut_tac x=r in body_mono)\n        apply (clarsimp simp: monad_mono_step_def exs_valid_def split_def)\n        apply blast\n       apply simp\n      apply blast\n      done\n  }\n  note A = this\n\n  {\n    fix a b s\n    have \"\\<lbrakk> \\<not> snd (whileLoop C (B m) i s);\n                  (a, b) \\<in> fst (whileLoop C (B (Suc m)) i s) \\<rbrakk>\n              \\<Longrightarrow> (a, b) \\<in> fst (whileLoop C (B m) i s)\"\n      apply (clarsimp simp: fst_whileLoop_is_exs_valid)\n      apply (subst (asm) exs_valid_whileLoop_complete [symmetric])\n      apply (subst (asm) not_snd_whileLoop_complete)\n      apply (erule exE | erule conjE)+\n      apply (rule_tac T=\"\\<lambda>r s. T r s \\<and> I r s\" and R=Ra in exs_valid_whileLoop)\n         apply simp\n        apply (cut_tac x=r in body_mono)\n        apply (clarsimp simp: monad_mono_step_def exs_valid_def split_def Bex_def)\n        apply metis\n       apply simp\n      apply (clarsimp simp: exs_valid_def Bex_def)\n      done\n  }\n  note B = this\n\n  {\n    fix i s\n    have \"\\<lbrakk>\\<not> snd (whileLoop C (B m) i s) \\<rbrakk> \\<Longrightarrow>\n                  \\<not> snd (whileLoop C (B (Suc m)) i s)\"\n      apply (subst (asm) not_snd_whileLoop_complete)\n      apply (erule exE | erule conjE)+\n      apply (rule_tac I=\"I\" and R=R in not_snd_whileLoop)\n        apply clarsimp\n       apply (cut_tac x=r in body_mono)\n       apply (clarsimp simp: monad_mono_step_def validNF_alt_def)\n       apply blast\n      apply simp\n      done\n  }\n  note C = this\n\n  show ?thesis\n    apply (clarsimp simp: monad_mono_step_def)\n    apply (metis prod.exhaust subsetI subset_antisym A B C)\n    done\nqed\n\nlemma monad_mono_step_whileLoopE:\n  \"\\<lbrakk> \\<And>x. monad_mono_step (\\<lambda>m. B m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. whileLoopE C (B m) i) m\"\n  apply (unfold whileLoopE_def)\n  apply (subgoal_tac \"\\<And>x. monad_mono_step (\\<lambda>m. lift (B m) x) m\")\n  apply (erule monad_mono_step_whileLoop)\n  apply (unfold lift_def)\n  apply rule\n    apply (clarsimp split: prod.splits sum.splits)\n    apply (fastforce dest: monad_mono_step_in_monad)\n   apply (clarsimp split: prod.splits sum.splits simp: monad_mono_step_def)+\n  done\n\n\n(* measure_call for the option monad. *)\ndefinition \"measure_ocall f \\<equiv> \\<lambda>s. f (SOME m. f m s \\<noteq> None) s\"\n\ndefinition \"option_monad_mono f \\<equiv>\n  \\<forall>(x :: nat) y s. x < y \\<longrightarrow>\n    (case f y s of None \\<Rightarrow> f x s = None\n                 | Some r \\<Rightarrow> f x s = None \\<or> f x s = Some r)\"\n\nlemma option_monad_mono_eq:\n  \"(\\<And>m. f m = gets_the (f' m)) \\<Longrightarrow> monad_mono f = option_monad_mono f'\"\n  apply (clarsimp simp: monad_mono_def option_monad_mono_def gets_the_def\n                        gets_def get_def assert_opt_def return_def fail_def bind_def'\n                  split: option.splits)\n  apply (intro iff_allI iffI impI allI)\n   apply (metis option.collapse)\n  by fastforce\n\nlemma measure_ocall_ovalid [wp]:\n    \"\\<lbrakk> \\<forall> m. ovalid P (x m) Q; option_monad_mono x \\<rbrakk> \\<Longrightarrow> ovalid P (measure_ocall x) Q\"\n  by (clarsimp simp: ovalid_def measure_ocall_def option_monad_mono_def)\n\nlemma measure_ocall_ovalidNF [wp]:\n    \"\\<lbrakk> ovalidNF P (x m) Q; option_monad_mono x \\<rbrakk> \\<Longrightarrow> ovalidNF P (measure_ocall x) Q\"\n  apply (clarsimp simp: measure_ocall_def option_monad_mono_def ovalidNF_def)\n  apply (rule_tac a = m in someI2)\n   apply simp\n  apply (metis (lifting, full_types) linorder_neqE_nat option.distinct(1) option.simps(5))\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/MonadMono.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.31740136032921684}}
{"text": "(* Authors: Lammich, Wimmer *)\nsection \\<open>Generic Worklist Algorithm with Subsumption\\<close>\ntheory Worklist_Subsumption\n  imports \"../Sepref\"\nbegin\n\nsubsection \\<open>Utilities\\<close>\ndefinition take_from_set where\n  \"take_from_set s = ASSERT (s \\<noteq> {}) \\<then> SPEC (\\<lambda> (x, s'). x \\<in> s \\<and> s' = s - {x})\"\n\nlemma take_from_set_correct:\n  assumes \"s \\<noteq> {}\"\n  shows \"take_from_set s \\<le> SPEC (\\<lambda> (x, s'). x \\<in> s \\<and> s' = s - {x})\"\nusing assms unfolding take_from_set_def by simp\n\nlemmas [refine_vcg] = take_from_set_correct[THEN order.trans]\n\n\n\ndefinition take_from_mset where\n  \"take_from_mset s = ASSERT (s \\<noteq> {#}) \\<then> SPEC (\\<lambda> (x, s'). x \\<in># s \\<and> s' = s - {#x#})\"\n\nlemma take_from_mset_correct:\n  assumes \"s \\<noteq> {#}\"\n  shows \"take_from_mset s \\<le> SPEC (\\<lambda> (x, s'). x \\<in># s \\<and> s' = s - {#x#})\"\nusing assms unfolding take_from_mset_def by simp\n\nlemmas [refine_vcg] = take_from_mset_correct[THEN order.trans]\n\n\nlemma set_mset_mp: \"set_mset m \\<subseteq> s \\<Longrightarrow> n < count m x \\<Longrightarrow> x\\<in>s\" \n  by (meson count_greater_zero_iff le_less_trans subsetCE zero_le)\n\nlemma pred_not_lt_is_zero: \"(\\<not> n - Suc 0 < n) \\<longleftrightarrow> n=0\" by auto\n\n\nsubsection \\<open>Search Spaces\\<close>\ntext \\<open>\n  A search space consists of a step relation, a start state, \n  a final state predicate, and a subsumption preorder.\n\\<close>\nlocale Search_Space_Defs =\n  fixes E :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\" \\<comment> \\<open>Step relation\\<close>\n    and a\\<^sub>0 :: 'a                \\<comment> \\<open>Start state\\<close> \n    and F :: \"'a \\<Rightarrow> bool\"      \\<comment> \\<open>Final states\\<close>\n    and subsumes :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\" (infix \"\\<preceq>\" 50) \\<comment> \\<open>Subsumption preorder\\<close>\nbegin\n  definition reachable where\n    \"reachable = E\\<^sup>*\\<^sup>* a\\<^sub>0\"\n\n  definition \"F_reachable \\<equiv> \\<exists>a. reachable a \\<and> F a\"\n\nend\n\ntext \\<open>The set of reachable states must be finite, \n  subsumption must be a preorder, and be compatible with steps and final states.\\<close>\nlocale Search_Space = Search_Space_Defs +\n  assumes finite_reachable: \"finite {a. reachable a}\"\n\n  assumes refl[intro!, simp]: \"a \\<preceq> a\"\n      and trans[trans]: \"a \\<preceq> b \\<Longrightarrow> b \\<preceq> c \\<Longrightarrow> a \\<preceq> c\"\n\n  assumes mono: \"a \\<preceq> b \\<Longrightarrow> E a a' \\<Longrightarrow> reachable a \\<Longrightarrow> reachable b \\<Longrightarrow> \\<exists> b'. E b b' \\<and> a' \\<preceq> b'\"\n      and F_mono: \"a \\<preceq> a' \\<Longrightarrow> F a \\<Longrightarrow> F a'\"\nbegin\n\n  lemma start_reachable[intro!, simp]:\n    \"reachable a\\<^sub>0\"\n  unfolding reachable_def by simp\n\n  lemma step_reachable:\n    assumes \"reachable a\" \"E a a'\"\n    shows \"reachable a'\"\n  using assms unfolding reachable_def by simp\n\n\n  lemma finitely_branching:\n    assumes \"reachable a\"  \n    shows \"finite (Collect (E a))\"\n    by (metis assms finite_reachable finite_subset mem_Collect_eq step_reachable subsetI)\n    \n\n\nend\n\nsubsection \\<open>Worklist Algorithm\\<close>\n\nterm card\n\ncontext Search_Space_Defs begin\n  definition \"worklist_var = inv_image (finite_psupset (Collect reachable) <*lex*> measure size) (\\<lambda> (a, b,c). (a,b))\"\n  \n  definition \"worklist_inv_frontier passed wait = \n    (\\<forall> a \\<in> passed. \\<forall> a'. E a a' \\<longrightarrow> (\\<exists> b' \\<in> passed \\<union> set_mset wait. a' \\<preceq> b'))\"\n  \n  definition \"start_subsumed passed wait = (\\<exists> a \\<in> passed \\<union> set_mset wait. a\\<^sub>0 \\<preceq> a)\"\n\n  definition \"worklist_inv \\<equiv> \\<lambda> (passed, wait, brk).\n    passed \\<subseteq> Collect reachable \\<and>\n    (brk \\<longrightarrow> (\\<exists> f. reachable f \\<and> F f)) \\<and>\n    (\\<not> brk \\<longrightarrow> \n      worklist_inv_frontier passed wait \n    \\<and> (\\<forall> a \\<in> passed \\<union> set_mset wait. \\<not> F a) \n    \\<and> start_subsumed passed wait\n    \\<and> set_mset wait \\<subseteq> Collect reachable)\n    \"\n\n  definition \"add_succ_spec wait a \\<equiv> SPEC (\\<lambda>(wait',brk). \n    if \\<exists>a'. E a a' \\<and> F a' then \n      brk\n    else set_mset wait' = set_mset wait \\<union> {a' . E a a'} \\<and> \\<not>brk\n  )\"\n\n  definition worklist_algo where\n    \"worklist_algo = do\n      { \n        if F a\\<^sub>0 then RETURN True\n        else do {\n          let passed = {};\n          let wait = {#a\\<^sub>0#};\n          (passed, wait, brk) \\<leftarrow> WHILEIT worklist_inv (\\<lambda> (passed, wait, brk). \\<not> brk \\<and> wait \\<noteq> {#})\n            (\\<lambda> (passed, wait, brk). do\n              { \n                (a, wait) \\<leftarrow> take_from_mset wait;\n                ASSERT (reachable a);\n                if (\\<exists> a' \\<in> passed. a \\<preceq> a') then RETURN (passed, wait, brk) else\n                do\n                  {\n                    (wait,brk) \\<leftarrow> add_succ_spec wait a;\n                    let passed = insert a passed;\n                    RETURN (passed, wait, brk)\n                  }\n              }\n            )\n            (passed, wait, False);\n            RETURN brk\n        }\n      }\n    \"\n\nend\n\nsubsubsection \\<open>Correctness Proof\\<close>\n\ncontext Search_Space begin\n\n  lemma wf_worklist_var:\n    \"wf worklist_var\"\n  unfolding worklist_var_def by (auto simp: finite_reachable)\n\n  context\n  begin\n  \n  private lemma aux1:\n    assumes \"\\<forall>x\\<in>passed. \\<not> a \\<preceq> x\"\n        and \"passed \\<subseteq> Collect reachable\"\n        and \"reachable a\"\n    shows \"\n    ((insert a passed, wait', brk'),\n     passed, wait, brk)\n    \\<in> worklist_var\"\n  proof -\n    from assms have \"a \\<notin> passed\" by auto\n    with assms(2,3) show ?thesis\n    by (auto simp: worklist_inv_def worklist_var_def finite_psupset_def)\n  qed\n\n  private lemma aux2:\n    assumes\n      \"a' \\<in> passed\"\n      \"a \\<preceq> a'\"\n      \"a \\<in># wait\"\n      \"worklist_inv_frontier passed wait\"\n    shows \"worklist_inv_frontier passed (wait - {#a#})\"\n    using assms unfolding worklist_inv_frontier_def \n    using trans \n    apply clarsimp\n    by (metis (no_types, lifting) Un_iff count_eq_zero_iff count_single mset_contains_eq mset_un_cases)\n\n  private lemma aux5:\n    assumes\n      \"a' \\<in> passed\"\n      \"a \\<preceq> a'\"\n      \"a \\<in># wait\"\n      \"start_subsumed passed wait\"\n    shows \"start_subsumed passed (wait - {#a#})\"\n    using assms unfolding start_subsumed_def apply clarsimp\n    by (metis Un_iff insert_DiffM2 local.trans mset_right_cancel_elem)\n\n  private lemma aux3:\n    assumes\n      \"set_mset wait \\<subseteq> Collect reachable\"\n      \"a \\<in># wait\"\n      \"set_mset wait' = set_mset (wait - {#a#}) \\<union> Collect (E a)\"\n      \"worklist_inv_frontier passed wait\"\n    shows \"worklist_inv_frontier (insert a passed) wait'\"\n  proof -\n    from assms(1,2) have \"reachable a\"\n      by (simp add: subset_iff) \n    with finitely_branching have [simp, intro!]: \"finite (Collect (E a))\" . \n\n    from assms(2,3,4) show ?thesis unfolding worklist_inv_frontier_def\n      by (metis Un_iff insert_DiffM insert_iff local.refl mem_Collect_eq set_mset_add_mset_insert)\n  qed    \n\n  private lemma aux6:\n    assumes\n      \"a \\<in># wait\"\n      \"start_subsumed passed wait\"\n      \"set_mset wait' = set_mset (wait - {#a#}) \\<union> Collect (E a)\"\n    shows \"start_subsumed (insert a passed) wait'\"\n    using assms unfolding start_subsumed_def\n    by (metis Un_iff insert_DiffM insert_iff set_mset_add_mset_insert)\n\n  lemma aux4:\n    assumes \"worklist_inv_frontier passed {#}\" \"reachable x\" \"start_subsumed passed {#}\"\n            \"passed \\<subseteq> Collect reachable\"\n    shows \"\\<exists> x' \\<in> passed. x \\<preceq> x'\"\n  proof -\n    from \\<open>reachable x\\<close> have \"E\\<^sup>*\\<^sup>* a\\<^sub>0 x\" by (simp add: reachable_def)\n    from assms(3) obtain b where \"a\\<^sub>0 \\<preceq> b\" \"b \\<in> passed\" unfolding start_subsumed_def by auto\n    have \"\\<exists>x'. \\<exists> x''. E\\<^sup>*\\<^sup>* b x' \\<and> x \\<preceq> x' \\<and> x' \\<preceq> x'' \\<and> x'' \\<in> passed\" if\n                      \"E\\<^sup>*\\<^sup>* a x\" \"a \\<preceq> b\"    \"b \\<preceq> b'\"  \"b' \\<in> passed\"\n                      \"reachable a\" \"reachable b\" for a b b'\n    using that proof (induction arbitrary: b b' rule: converse_rtranclp_induct)\n      case base\n      then show ?case by auto\n    next\n      case (step a a1 b b')\n      from \\<open>E a a1\\<close> \\<open>a \\<preceq> b\\<close> \\<open>reachable a\\<close> \\<open>reachable b\\<close> obtain b1 where\n        \"E b b1\" \"a1 \\<preceq> b1\"\n      using mono by blast\n      then obtain b1' where \"E b' b1'\" \"b1 \\<preceq> b1'\" using assms(4) mono step.prems by blast\n      with \\<open>b' \\<in> passed\\<close> assms(1) obtain b1'' where \"b1'' \\<in> passed\" \"b1' \\<preceq> b1''\"\n      unfolding worklist_inv_frontier_def by auto\n      with \\<open>b1 \\<preceq> _\\<close> have \"b1 \\<preceq> b1''\" using trans by blast\n      with step.IH[OF \\<open>a1 \\<preceq> b1\\<close> this \\<open>b1'' \\<in> passed\\<close>] \\<open>reachable a\\<close> \\<open>E a a1\\<close> \\<open>reachable b\\<close> \\<open>E b b1\\<close>\n      obtain x' x'' where\n        \"E\\<^sup>*\\<^sup>* b1 x'\" \"x \\<preceq> x'\" \"x' \\<preceq> x''\" \"x'' \\<in> passed\"\n      by (auto intro: step_reachable)\n      moreover from \\<open>E b b1\\<close> \\<open>E\\<^sup>*\\<^sup>* b1 x'\\<close> have \"E\\<^sup>*\\<^sup>* b x'\" by auto\n      ultimately show ?case by auto\n    qed\n    from this[OF \\<open>E\\<^sup>*\\<^sup>* a\\<^sub>0 x\\<close> \\<open>a\\<^sub>0 \\<preceq> b\\<close> refl \\<open>b \\<in> _\\<close>] assms(4) \\<open>b \\<in> passed\\<close> show ?thesis\n    by (auto intro: trans)\n  qed\n\n  theorem worklist_algo_correct:\n    \"worklist_algo \\<le> SPEC (\\<lambda> brk. brk \\<longleftrightarrow> F_reachable)\"\n  proof - \n    note [simp] = size_Diff_submset pred_not_lt_is_zero\n    note [dest] = set_mset_mp\n    show ?thesis\n    unfolding worklist_algo_def add_succ_spec_def F_reachable_def\n      apply (refine_vcg wf_worklist_var)\n      (* F a\\<^sub>0*)\n      apply (auto; fail) []\n      (* Invar start*)\n      apply (auto simp: worklist_inv_def worklist_inv_frontier_def start_subsumed_def; fail)\n      (* Precondition for take-from-set *)\n      apply (simp; fail)\n      (* State is subsumed by passed*)\n        (* Assertion *)\n        apply (auto simp: worklist_inv_def; fail)\n        (*Invariant*)\n        apply (auto simp: worklist_inv_def aux2 aux5 \n              dest: in_diffD\n              split: if_split_asm; fail) []\n        (*Variant*)\n        apply (auto simp: worklist_inv_def worklist_var_def intro: finite_subset[OF _ finite_reachable]; fail)\n\n      (* Insert successors to wait *)  \n        (*Invariant*)\n        apply (clarsimp split: if_split_asm) (* Split on F in successors *)\n          (* Found final state *)\n          apply (clarsimp simp: worklist_inv_def; blast intro: step_reachable; fail)\n          (* No final state *)\n      apply (auto \n        simp: worklist_inv_def step_reachable aux3 aux6 finitely_branching\n        dest: in_diffD; fail)[]\n        (*Variant*)\n        apply (auto simp: worklist_inv_def aux1; fail)\n      (* I \\<and> \\<not>b \\<Longrightarrow> post *)  \n      using F_mono apply (fastforce simp: worklist_inv_def dest!: aux4)\n      done\n  qed  \n\n  lemmas [refine_vcg] = worklist_algo_correct[THEN order_trans]\n\n  end \\<comment> \\<open>Context\\<close>\n\nend \\<comment> \\<open>Search Space\\<close>\n\n\nsubsection \\<open>Towards an Implementation\\<close>\nlocale Worklist1_Defs = Search_Space_Defs +\n  fixes succs :: \"'a \\<Rightarrow> 'a list\"\n\nlocale Worklist1 = Worklist1_Defs + Search_Space +\n  assumes succs_correct: \"reachable a \\<Longrightarrow> set (succs a) = Collect (E a)\"\nbegin\n\n  definition \"add_succ1 wait a \\<equiv> nfoldli (succs a) (\\<lambda>(_,brk). \\<not>brk) (\\<lambda>a (wait,brk). if F a then RETURN (wait,True) else RETURN (wait + {#a#},False)) (wait, False)\"\n\n  lemma add_succ1_ref[refine]: \"\\<lbrakk>(wait,wait')\\<in>Id; (a,a')\\<in>b_rel Id reachable\\<rbrakk> \\<Longrightarrow> add_succ1 wait a \\<le> \\<Down>(Id \\<times>\\<^sub>r bool_rel) (add_succ_spec wait' a')\"\n    apply simp\n    unfolding add_succ_spec_def add_succ1_def\n    apply (refine_vcg nfoldli_rule[where I = \"\\<lambda>l1 _ (wait',brk). if brk then \\<exists>a'. E a a' \\<and> F a' else set_mset wait' = set_mset wait \\<union> set l1 \\<and> set l1 \\<inter> Collect F = {}\"])\n    apply (auto; fail)\n    using succs_correct[of a] apply (auto; fail)\n    using succs_correct[of a] apply (auto; fail)\n    apply (auto; fail)\n    using succs_correct[of a] apply (auto; fail)\n    done\n\n  definition worklist_algo1 where\n    \"worklist_algo1 = do\n      { \n        if F a\\<^sub>0 then RETURN True\n        else do {\n          let passed = {};\n          let wait = {#a\\<^sub>0#};\n          (passed, wait, brk) \\<leftarrow> WHILEIT worklist_inv (\\<lambda> (passed, wait, brk). \\<not> brk \\<and> wait \\<noteq> {#})\n            (\\<lambda> (passed, wait, brk). do\n              { \n                (a, wait) \\<leftarrow> take_from_mset wait;\n                if (\\<exists> a' \\<in> passed. a \\<preceq> a') then RETURN (passed, wait, brk) else\n                do\n                  {\n                    (wait,brk) \\<leftarrow> add_succ1 wait a;\n                    let passed = insert a passed;\n                    RETURN (passed, wait, brk)\n                  }\n              }\n            )\n            (passed, wait, False);\n            RETURN brk\n        }\n      }\n    \"\n\n  lemma worklist_algo1_ref[refine]: \"worklist_algo1 \\<le> \\<Down>Id worklist_algo\"  \n    unfolding worklist_algo1_def worklist_algo_def\n    apply (refine_rcg)\n    apply refine_dref_type\n    unfolding worklist_inv_def\n    apply auto\n    done\n\nend\n\n\nend \\<comment> \\<open>Theory\\<close>\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/Examples/Worklist_Subsumption.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.31734731771656466}}
{"text": "(*\n * Copyright (c) 2020, CleanQ Project - Systems Group, ETH Zurich\n * All rights reserved.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n *\n * See \"LICENSE\" for details.\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n\n\n(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory FastForward\nimports \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"ffq_queue.c\"\n\ninstall_C_file \"ffq_queue.c\"\n(* autocorres \"ffq_queue.c\" *)\n\ncontext ffq_queue begin\n\n(* C parser output. *)\nthm ffq_dequeue_body_def\nthm ffq_enqueue_body_def\nthm ffq_init_tx_body_def\nthm ffq_init_pair_body_def\n\n(* Dereference a pointer *)\nabbreviation \"deref s x \\<equiv> h_val (hrs_mem (t_hrs_' (globals s))) x\"\n\nabbreviation \"valid_buf rid offset len valid_data valid_len flags \\<equiv> rid \\<noteq> 0 \\<and> len \\<noteq> 0\"\n\ndefinition FFQ_DEFAULT_SIZE :: word16\n  where\n    \"FFQ_DEFAULT_SIZE = 64\"\n\ndefinition FFQ_SLOT_EMPTY :: word32\n  where\n    \"FFQ_SLOT_EMPTY = -1\"\n\ndefinition FFQ_SLOT_FULL :: word32\n  where\n    \"FFQ_SLOT_FULL = 1\"\n\ndefinition slot_empty :: \"ffq_slot_C \\<Rightarrow> bool\"\nwhere\n  \"slot_empty s \\<equiv> (empty_C s = FFQ_SLOT_EMPTY)\"\n\ndefinition slot_full :: \"ffq_slot_C \\<Rightarrow> bool\"\nwhere\n  \"slot_full s \\<equiv> (empty_C s = FFQ_SLOT_FULL)\"\n\n(* Check if the queue is empty *)\ndefinition queue_empty :: \"('b globals_scheme, 'c) state_scheme \\<Rightarrow> (ffq_queue_C ptr) \\<Rightarrow> bool\"\n  where\n    \"queue_empty s q \\<equiv> \\<forall>a\\<in>set (array_addrs ((slots_C (deref s q)) :: (ffq_slot_C ptr)) (unat FFQ_DEFAULT_SIZE)) . slot_empty (deref s a)\"\n\n(* Check if the queue is full *)\ndefinition queue_full :: \"('b globals_scheme, 'c) state_scheme \\<Rightarrow> (ffq_queue_C ptr) \\<Rightarrow> bool\"\n  where\n    \"queue_full s q \\<equiv> \\<forall>a\\<in>set (array_addrs ((slots_C (deref s q)) :: (ffq_slot_C ptr)) (unat FFQ_DEFAULT_SIZE)) . slot_full (deref s a)\"\n\n(* Queue is in a valid state i.e. setup correctly  *)\ndefinition queue_valid_state :: \"('b globals_scheme, 'c) state_scheme \\<Rightarrow> (ffq_queue_C ptr) \\<Rightarrow> bool\"\n  where\n    \"queue_valid_state s q \\<equiv> \\<forall>a\\<in>set (array_addrs ((slots_C (deref s q)) :: (ffq_slot_C ptr)) (unat FFQ_DEFAULT_SIZE)) . \n     slot_full (deref s a) | slot_empty (deref s a) \\<and> \n     pos_C (deref s q) \\<ge> 0 \\<and> pos_C (deref s q) \\<le> FFQ_DEFAULT_SIZE \\<and>\n     c_guard (slots_C (deref s q)) \\<and>\n     (direction_C (deref s q) = FFQ_DIRECTION_SEND \\<or> direction_C (deref s q) = FFQ_DIRECTION_RECV)\"\n\ndefinition next_pos :: \"word16 \\<Rightarrow> word16 \\<Rightarrow> word16\"\n  where\n    \"next_pos pos q_size = (if ((pos+1) = ucast(q_size)) then 0 else (pos+1))\"\n\ndefinition slot_at_pos :: \"(ffq_queue_C) \\<Rightarrow> word16 \\<Rightarrow> ffq_slot_C ptr\"\n  where\n    \"slot_at_pos q pos \\<equiv> (slots_C q)  +\\<^sub>p (unat pos)\"\n\nlemma ffq_dequeue_spec:\n  shows\n   (*- The queue is in a valid state\n     - save pos for later\n     - provided values are unequal null i.e. valid\n     - the direction of the queue is recv *)\n  \"\\<forall>t. \\<Gamma> \\<turnstile> \\<lbrace>t. queue_valid_state t q \\<and> \n            pos = pos_C (deref t q) \\<and>\n            c_guard q \\<and> c_guard rid \\<and> c_guard offset \\<and> c_guard len \\<and> c_guard valid_data \\<and> c_guard valid_len \\<and> c_guard flags \\<and>\n            direction_C (deref t q) = FFQ_DIRECTION_RECV\n          \\<rbrace>\n       \\<acute>ret__int :== PROC ffq_dequeue(q, rid, offset, len, valid_data, valid_len, flags)\n   \\<lbrace>t. queue_valid_state t q \\<and>\n    (empty_C (deref t (slot_at_pos (deref t q) pos)) = FFQ_SLOT_FULL) \\<and>\n     (\\<acute>ret__int \\<noteq> 0 \\<longrightarrow> (pos_C (deref t q)) = pos) \\<and> \n     (\\<acute>ret__int = 0 \\<and> pos_c (deref t q) = (next_pos pos FFQ_DEFAULT_SIZE)) \\<and>\n     valid_buf (deref t rid) (deref t offset) (deref t len) (deref t valid_data) (deref t valid_len) (deref t flags)\n   \\<rbrace>\"\n   (* Regardless of error or not\n      - queue is in a valid state\n      - slot at pos is marked as empty\n      First defined what happens on error (ret_int != 0) \n      -pos did not change\n      On Success\n      - pos was increased modulo size\n      - the return values are a valid buffer *)\n  oops\n\n\nlemma ffq_enqueue_spec:\n  shows\n   (* -Queue is in a valid state \n      - the values provided are valid \n      - we save the position pos to talk about it later\n      - the direction of the queue is send *)\n  \"\\<forall>t. \\<Gamma> \\<turnstile> \\<lbrace>t. queue_valid_state t q  \\<and>\n            valid_buf rid offset len valid_data valid_len flags \\<and> \n            pos = pos_C (deref t q) \\<and>\n            c_guard q \\<and> \n            direction_C (deref t q) = FFQ_DIRECTION_SEND \\<rbrace>\n       \\<acute>ret__int :== PROC ffq_enqueue(q, rid, offset, len, valid_data, valid_len, flags)\n   \\<lbrace>t. queue_valid_state t q \\<and>\n    ((\\<acute>ret__int \\<noteq> 0 \\<and> (pos_C (deref t q)) = pos) \\<or> (\\<acute>ret__int = 0 \\<and> pos_c (deref t q) = (next_pos pos FFQ_DEFAULT_SIZE)))\\<and>\n    (\\<acute>ret__int = 0 \\<longrightarrow> rid_C (deref t (slot_at_pos (deref t q) pos)) = rid \\<and> \n                       offset_C (deref t (slot_at_pos (deref t q) pos)) = offset \\<and>\n                       len_C (deref t (slot_at_pos (deref t q) pos)) = len \\<and>\n                       valid_data_C (deref t (slot_at_pos (deref t q) pos)) = valid_data \\<and>\n                       valid_len_C (deref t (slot_at_pos (deref t q) pos)) = valid_len \\<and>\n                       flags_C (deref t (slot_at_pos (deref t q) pos)) = flags) \\<and>\n    (empty_C (deref t (slot_at_pos (deref t q) pos)) = FFQ_SLOT_FULL)\n   \\<rbrace>\"\n   (* Regardless of error or not\n      - queue is in a valid state\n      - slot at pos is marked as full\n      First defined what happens on error (ret_int != 0) \n      -pos did not change\n      On Success\n      - pos was increased modulo size\n      - the slot previously pointed to by pos has now the values provided *)\n  oops\n  \n\nlemma init_rx_state_spec: \n  shows\n  \"\\<forall>t. \\<Gamma> \\<turnstile> \\<lbrace>t. (\\<forall>a\\<in>set (array_addrs (buf :: ffq_slot_C ptr) (unat FFQ_DEFAULT_SIZE)). c_guard a)\n          \\<and> c_guard q \\<and> c_guard buf \\<rbrace>\n       \\<acute>ret__int :== PROC ffq_init_rx(q, buf)\n   \\<lbrace>t. (queue_empty t q) \\<and> slots_C (deref t q) = buf \\<and> pos_C (deref t q) = 0 \\<and> direction_C (deref t q) = FFQ_DIRECTION_RECV \n    \\<and> size_C (deref t q) = FFQ_DEFAULT_SIZE \\<rbrace>\"\n  apply(vcg)\n  oops\n\nlemma init_tx_state_spec: \n  shows\n  \"\\<forall>t. \\<Gamma> \\<turnstile> \\<lbrace>t. (\\<forall>a\\<in>set (array_addrs (buf :: ffq_slot_C ptr) (unat FFQ_DEFAULT_SIZE)). c_guard a)\n          \\<and> c_guard q \\<and> c_guard buf \\<rbrace>\n       \\<acute>ret__int :== PROC ffq_init_tx(q, buf)\n   \\<lbrace>t. (queue_empty t q) \\<and> slots_C (deref t q) = buf \\<and> pos_C (deref t q) = 0 \\<and> direction_C (deref t q) = FFQ_DIRECTION_SEND\n    \\<and> size_C (deref t q) = FFQ_DEFAULT_SIZE \\<rbrace>\"\n  apply vcg\n  oops\n\nend\nend\n", "meta": {"author": "CleanQ-Project", "repo": "cleanq-proofs", "sha": "5212fcd2aceba0028bd1474e0553578a6091ca63", "save_path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs", "path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs/cleanq-proofs-5212fcd2aceba0028bd1474e0553578a6091ca63/refinements/FastForward.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6825737214979745, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.31732959570258995}}
{"text": "(*\n  Title: Dynamic Authorization Protocol - Message Transaction\n  Author: Felipe Rodopoulos de Oliveira\n*)\n\ntheory DAP_Transaction imports \"~~/src/HOL/Auth/Public\"\n\nbegin\n\ninductive_set daptrans :: \"event list set\" where\n  Nil: \"[] \\<in> daptrans\"\n\n  | DT1: \"\\<lbrakk> evs1 \\<in> daptrans \\<rbrakk>\n    \\<Longrightarrow> Says A Server (Number T) # evs1 \\<in> daptrans\"\n\n  | DT2: \"\\<lbrakk> evs2 \\<in> daptrans;\n          Says A Server Transaction \\<in> set evs2;\n          Nonce r \\<notin> used evs2;\n          r' = Crypt k2 (Nonce r);\n          k2 \\<in> symKeys;\n          h_s = Hash \\<lbrace> Transaction, r' \\<rbrace>\n        \\<rbrakk>\n    \\<Longrightarrow> Says Server A \\<lbrace> Transaction, r', h_s \\<rbrace> # evs2 \\<in> daptrans\"\n\n  | DT3: \"\\<lbrakk> evs3 \\<in> daptrans;\n          Says A Server Transaction \\<in> set evs3;\n          Says S A \\<lbrace> Transaction', r', h_s \\<rbrace> \\<in> set evs3;\n          h_u = Hash \\<lbrace> Transaction', r' \\<rbrace>;\n          h_s = h_u \n        \\<rbrakk> \n    \\<Longrightarrow> Says A Server (Nonce r) # evs3 \\<in> daptrans\"\n\n  | Fake: \"\\<lbrakk>evsf \\<in> daptrans; X \\<in> synth(analz(spies evsf))\\<rbrakk> \\<Longrightarrow> Says Spy B X # evsf \\<in> daptrans\"\n\n\nlemma Protocol_terminates :\n  \"\\<exists>r. \\<exists>evs \\<in> daptrans. Says A Server (Nonce r) \\<in> set evs\"\n  apply (intro exI bexI)\n  apply (rule_tac [2] daptrans.DT3)\n  apply (rule_tac [2] daptrans.DT2)\n  apply (rule_tac [2] daptrans.DT1)\n  apply (rule_tac [2] daptrans.Nil)\n  apply (possibility)\n  done\n\nend", "meta": {"author": "rodopoulos", "repo": "isabelling", "sha": "9a92853c98c76802ffc6acc6e535efe3ea7f4176", "save_path": "github-repos/isabelle/rodopoulos-isabelling", "path": "github-repos/isabelle/rodopoulos-isabelling/isabelling-9a92853c98c76802ffc6acc6e535efe3ea7f4176/security-protocols/dap/DAP_Transaction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.712232184238947, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.3173204738841973}}
{"text": "theory flash109Bra  imports flash109Rev\n \n  begin\nlemma onInv109:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv109 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv109 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv109 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash109Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7122321720225278, "lm_q2_score": 0.44552953503957266, "lm_q1q2_score": 0.3173204684414217}}
{"text": "theory HoareWithInvariant\n\nimports Main\n \"../lem/Evm\"\n \"../sep_algebra/EvmSep\"\n \"../sep_algebra/Sep_Tactics\"\n \"~~/src/HOL/Eisbach/Eisbach\"\nbegin\n\nlemma not_at_least_one :\n  \"\\<not> 1 \\<le> (aa :: 256 word) \\<Longrightarrow> aa = 0\"\napply(simp add:linorder_class.not_le)\ndone\n\nlemma unat_suc : \"unat (aa :: w256) = Suc n \\<Longrightarrow> unat (aa - 1) = n\"\napply(case_tac \"aa \\<ge> 1\")\n apply(simp add: uint_minus_simple_alt unat_def)\napply(drule not_at_least_one)\napply(simp)\ndone\n\n\n(* Following Magnus Myreen's thesis \"Formal verification of machine-code programs\" 3.2.4 *)  \n\ndatatype state_element =\n    StackHeightElm \"nat\"  (* considering making it int *)\n  | StackElm \"nat * w256\" (* position, value *)\n    (* The position is counted from the bottom *)\n    (* StackElement (0, 300) says the oldest element on the stack is 300 *)\n  | StorageElm \"w256 * w256\" (* index, value *)\n  | MemoryElm \"w256 * byte\" (* address, value *)\n  | LogElm \"nat * log_entry\" (* position, log *)\n    (* Log (0, entry) says that the first recorded log entry is 0 *)\n  | LogNumElm \"nat\" (* Number of recorded logs *)\n  | PcElm \"int\" (* program counter *)\n  | GasElm \"int\" (* remaining gas *)\n  | MemoryUsageElm \"int\" (* current memory usage *)\n  | CodeElm \"int * inst\" (* a position containing an instruction *)\n  | ThisAccountElm \"address\" (* The address of this account *)\n  | BalanceElm \"address * w256\" (* address, amount *)\n  | CallerElm \"address\"\n  | OriginElm \"address\"\n  | SentValueElm \"w256\"\n  | SentDataLengthElm \"nat\" (* considering making it int *)\n  | SentDataElm \"nat * byte\" (* position, content.  Considering making position an int *)\n  | ExtProgramSizeElm \"address * int\" (* address, size.  Considering making size an int *)\n  | ExtProgramElm \"address * nat * byte\" (* address, position, byte.  Considering making position an int *)\n  | ContractActionElm \"contract_action\" (* None indicates continued execution *)\n  | ContinuingElm \"bool\" (* True if the execution is still continuing *)\n  | BlockhashElm \"w256 * w256\"\n  | BlockNumberElm w256\n  | CoinbaseElm \"address\"\n  | TimestampElm \"w256\"\n  | DifficultyElm \"w256\"\n  | GaslimitElm \"w256\"\n  | GaspriceElm \"w256\"\n  | AccountExistenceElm \"address * bool\"\n\nabbreviation blockhash_as_elm :: \"(w256 \\<Rightarrow> w256) \\<Rightarrow> state_element set\"\nwhere \"blockhash_as_elm f == { BlockhashElm (n, h) | n h. f n = h}\"\n\nabbreviation block_info_as_set :: \"block_info \\<Rightarrow> state_element set\"\nwhere \"block_info_as_set b ==\n  blockhash_as_elm (block_blockhash b) \\<union> { CoinbaseElm (block_coinbase b),\n  TimestampElm (block_timestamp b), DifficultyElm (block_difficulty b),\n  GaslimitElm (block_gaslimit b), BlockNumberElm (block_number b) }\"\n\ndefinition account_existence_as_set :: \"(address \\<Rightarrow> bool) \\<Rightarrow> state_element set\"\nwhere\n\"account_existence_as_set f ==\n  { AccountExistenceElm (a, e) | a e. f a = e }\"\n\ndefinition contract_action_as_set :: \"contract_action \\<Rightarrow> state_element set\"\n  where \"contract_action_as_set act == { ContractActionElm act }\"\n\ndefinition memory_as_set :: \"memory \\<Rightarrow> state_element set\"\n  where\n    \"memory_as_set m == { MemoryElm (a, v) | a v. m a = v }\"\n\ndefinition storage_as_set :: \"storage \\<Rightarrow> state_element set\"\n  where\n    \"storage_as_set s == { StorageElm (i, v) | i v. s i = v}\"\n\ndefinition balance_as_set :: \"(address \\<Rightarrow> w256) \\<Rightarrow> state_element set\"\n  where\n    \"balance_as_set b == { BalanceElm (a, v) | a v. b a = v }\"\n\ndefinition stack_as_set :: \"w256 list \\<Rightarrow> state_element set\"\n  where\n    \"stack_as_set s == { StackHeightElm (length s) } \\<union>\n                       { StackElm (idx, v) | idx v. idx < length s \\<and> (rev s) ! idx = v }\"\n\ndefinition data_sent_as_set :: \"byte list \\<Rightarrow> state_element set\"\n  where\n    \"data_sent_as_set lst == { SentDataLengthElm (length lst) } \\<union>\n                             { SentDataElm (idx, v) | idx v. idx < length lst \\<and> lst ! idx = v }\"\n\ndefinition ext_program_as_set :: \"(address \\<Rightarrow> program) \\<Rightarrow> state_element set\"\n  where\n    \"ext_program_as_set ext ==\n      { ExtProgramSizeElm (adr, s) | adr s. program_length (ext adr) = s } \\<union>\n      { ExtProgramElm (adr, pos, b) | adr pos b. program_as_natural_map (ext adr) pos = b }\n    \"\n\ndefinition log_as_set :: \"log_entry list \\<Rightarrow> state_element set\"\n  where\n    \"log_as_set logs ==\n      { LogNumElm (length logs) } \\<union>\n      { LogElm (pos, l) | pos l. (rev logs) ! pos = l \\<and> pos < length logs}\n    \"\n\ndefinition program_as_set :: \"program \\<Rightarrow> state_element set\"\n  where\n    \"program_as_set prg ==\n      { CodeElm (pos, i) | pos i. program_content prg pos = Some i  } \\<union>\n      { CodeElm (pos, Misc STOP) | pos. program_content prg pos = None }\n    \"\n\ndefinition constant_ctx_as_set :: \"constant_ctx \\<Rightarrow> state_element set\"\n  where\n    \"constant_ctx_as_set c == program_as_set (cctx_program c) \\<union> { ThisAccountElm (cctx_this c) }\"\n\ndefinition variable_ctx_as_set :: \"variable_ctx \\<Rightarrow> state_element set\"\n  where\n    \"variable_ctx_as_set v ==\n       stack_as_set (vctx_stack v)\n    \\<union> memory_as_set (vctx_memory v)\n    \\<union> storage_as_set (vctx_storage v)\n    \\<union> balance_as_set (vctx_balance v)\n    \\<union> log_as_set (vctx_logs v)\n    \\<union> block_info_as_set (vctx_block v)\n    \\<union> data_sent_as_set (vctx_data_sent v)\n    \\<union> ext_program_as_set (vctx_ext_program v)\n    \\<union> account_existence_as_set (vctx_account_existence v)\n    \\<union> { MemoryUsageElm (vctx_memory_usage v)\n      , CallerElm (vctx_caller v)\n      , SentValueElm (vctx_value_sent v)\n      , OriginElm (vctx_origin v)\n      , GaspriceElm (vctx_gasprice v)\n      , GasElm (vctx_gas v)\n      , PcElm (vctx_pc v)\n      , SentDataLengthElm (length (vctx_data_sent v))\n      }\"\n\ndefinition contexts_as_set :: \"variable_ctx \\<Rightarrow> constant_ctx \\<Rightarrow> state_element set\"\n  where\n    \"contexts_as_set v c ==\n       constant_ctx_as_set c \\<union> variable_ctx_as_set v\"\n\ntype_synonym 'a set_pred = \"'a set \\<Rightarrow> bool\"\n\ntext \\<open>The old sep_commute and sep_assoc are now in sep_conj_ac and\n   sep_def should be replaced by the following sep_basic_simps \\<close>\n  \nlemmas sep_basic_simps =  sep_conj_def sep_set_conv\n\nlemma sep_eq_alts [sep_select]:\n  \"(\\<And>s. T s = (P \\<and>* R) s) \\<Longrightarrow> T s \\<and> A \\<Longrightarrow> (P \\<and>* R) s \\<and> A\"\n  \"(\\<And>s. T s = (P \\<and>* R) s) \\<Longrightarrow> T = B \\<Longrightarrow> (P \\<and>* R) = B\"\n  \"(\\<And>s. T s = (P \\<and>* R) s) \\<Longrightarrow> T = D \\<Longrightarrow> D = (P \\<and>* R)\"\n  by auto+\n    \nlemma sep_select_ext[sep_select]:\n   \"(\\<And>s. T s = (P \\<and>* R) s) \\<Longrightarrow> T s = B s \\<Longrightarrow> (P \\<and>* R) s = B s\"\n  \"(\\<And>s. T s = (P \\<and>* R) s) \\<Longrightarrow> T s = D s \\<Longrightarrow> D s = (P \\<and>* R) s\"\n  by auto+\n\nlemma sep_conj_first:\n  \"(A \\<and> (P \\<and>* R) s) = ((P \\<and>* R) s \\<and> A)\"\n  by (simp add: conj_commute)\n\ntext \\<open>Use the method sep_sep_iff to solve simple sep-logic\n  lemmas of the following form:\n  @{term \"(some_sep_prop n \\<and>* R) s = (SomeSepPropConst n \\<in> s \\<and> R (s - {SomeSepPropConst n}))\"}\\<close>\n\nlemma ex_conj_commute:\n  \"(\\<exists>v. P v \\<and> Q v) = (\\<exists>v. Q v \\<and> P v) \"\n  by (simp only: conj_commute)\n    \nmethod exI_pick_last_conj =\n  --\\<open>Group all conjs on the left and then commute to get the\n     last conjunction element in first position.\\<close>\n  (simp (no_asm) only: conj_assoc[symmetric],\n   subst ex_conj_commute)?,\n  ((rule exI, erule conjI, ((rule conjI[rotated])+; blast))|\n   (rule exI, rule exI, erule (1) conjI, ((rule conjI[rotated])+; blast)))\n\nmethod solve_sep_iff uses simp =\n  solves \\<open>(rule iffI;  clarsimp simp add: sep_basic_simps simp),\n  exI_pick_last_conj\\<close>\n\ntext \\<open>The sep_subst method takes rule of the form \"(some_sep_prop \\<and>* R) = _\"  and\n substitute the LHS with the RHS without having to put some_sep_prop in first pos in\nthe goal\n\nThis method should probably be rewritten in ML with a loop for\nperformance and to remove the current limitation of maximum 11\nnested conjunctions.\\<close>\n\nmethod sep_subst uses simp =\n ((sep_select 1, subst simp) |\n  (sep_select 2, subst simp) |\n  (sep_select 3, subst simp) |\n  (sep_select 4, subst simp) |\n  (sep_select 5, subst simp) |\n  (sep_select 6, subst simp) |\n  (sep_select 7, subst simp) |\n  (sep_select 8, subst simp) |\n  (sep_select 9, subst simp) |\n  (sep_select 10, subst simp))\n\nmethod sep_simp_aux =\n  simp only: sep_conj_first sep_conj_assoc conj_assoc\n\ntext \\<open>sep_simp_no_asm simplifies a sep logic formula in the conclusion of a goal.\nThe conclusion can contain normal conjunctions (e.g. @{term \"P \\<and> (a \\<and>* b) s \\<and> Q\"}),\nif so, sep_simp_no_asm will move the element with a sep-conjunction in first\nposition and apply all the simp rules pass as argument to it.\nThe simp rules passed as argument must be of the form @{term \"(some_sep_prop n \\<and>* R) s = (SomeSepPropConst n \\<in> s \\<and> R (s - {SomeSepPropConst n}))\"}\n\\<close>\nmethod sep_simp_no_asm uses simp =\n  ((sep_simp_aux,  (sep_subst simp: simp)?)+)[1] |\n  (sep_subst simp: simp, (solves \\<open>sep_simp_aux\\<close> (* e.g. solves with refl *))?)\n\ntext \\<open>Same as sep_simp_no_asm but for assumptions. sep_simp_asm can take several\nrules to simplify, it rule attempt to apply all of them, multiple times.\\<close>\n\nmethod sep_simp_asm uses simp =\n (simp only: sep_conj_assoc)?,\n ((sep_select_asm 1, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 2, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 3, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 4, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 5, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 6, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 7, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 8, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 9, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 10, subst (asm) simp, (erule conjE)+))+\n\nmethod sep_simp uses simp =\n  ((sep_simp_asm simp: simp, (sep_simp_no_asm simp: simp)?) |\n  (sep_simp_no_asm simp: simp, (sep_simp_asm simp: simp)?))[1]\n\nlemma sep_lc: \"(a ** b ** c) = (b ** a ** c)\"\n by (simp add: sep_conj_ac)\n\nlemma sep_three : \"(c ** a ** b) = (a ** b ** c)\"\n by (simp add: sep_conj_ac)\n\ndefinition emp :: \"'a set_pred\"\n  where\n    \"emp s == (s = 0)\"\n\nlemma emp_sep [simp] :\n  \"(emp \\<and>* r) = r\"\n  apply(simp add: emp_def  sep_conj_def)\n done\n\ndefinition pure :: \"bool \\<Rightarrow> 'a set_pred\"\n  where\n    \"pure b s == emp s \\<and> b\"\n\nnotation pure (\"\\<langle> _ \\<rangle>\")\n\ndefinition memory_usage :: \"int \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"memory_usage u s == (s = {MemoryUsageElm u})\"\n  \ndefinition stack_height :: \"nat \\<Rightarrow> state_element set \\<Rightarrow> bool\"\n  where\n    \"stack_height h s == (s = {StackHeightElm h})\"\n\ndefinition stack :: \"nat \\<Rightarrow> w256 \\<Rightarrow> state_element set \\<Rightarrow> bool\"\n  where\n    \"stack pos v s == (s = {StackElm (pos, v)})\"\n\ndefinition program_counter :: \"int \\<Rightarrow> state_element set \\<Rightarrow> bool\"\n  where\n    \"program_counter pos s == s = {PcElm pos}\"\n\ndefinition log_number :: \"nat \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"log_number n s == s = {LogNumElm n}\"\n\ndefinition logged :: \"nat \\<Rightarrow> log_entry \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"logged n l s == s = {LogElm (n, l)}\"\n\ndefinition account_existence :: \"address \\<Rightarrow> bool \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"account_existence a b s == s = {AccountExistenceElm (a, b)}\"\n\nlemma sep_logged:\n  \"(a ** logged n l) s =\n   (LogElm (n, l) \\<in> s \\<and> a (s - {LogElm (n, l)}))\"\n  by (solve_sep_iff simp: logged_def)\n\ndefinition gas_pred :: \"int \\<Rightarrow> state_element set \\<Rightarrow> bool\"\n  where\n    \"gas_pred g s == s = {GasElm g}\"\n\ndefinition gas_any :: \"state_element set \\<Rightarrow> bool\"\n  where\n    \"gas_any s == (\\<exists> g. s = {GasElm g})\"\n\nlemma gas_any_sep :\n  \"(gas_any ** rest) s =\n   (\\<exists> g. GasElm g \\<in> s \\<and> rest (s - {GasElm g}))\"\n  apply (rule iffI)\n   apply (fastforce simp: gas_any_def sep_basic_simps)\n  apply (clarsimp simp add: sep_basic_simps gas_any_def)\n  apply (rule_tac x=\"{GasElm g}\" in exI)\n  apply (exI_pick_last_conj)\n done    \n\nlemma sep_gas_any_sep:\n  \"(a ** gas_any ** rest) s =\n   (\\<exists> g. GasElm g \\<in> s \\<and> (a ** rest) (s - {GasElm g}))\"\n by (sep_simp simp: gas_any_sep)\n\nlemma sep_log_number_sep:\n  \"(log_number n \\<and>* R) s =\n   (LogNumElm n \\<in> s \\<and> R (s - {LogNumElm n}))\n  \"\n  by (solve_sep_iff simp: log_number_def)\n\ndefinition caller :: \"address \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"caller c s == s = {CallerElm c}\"\n\ndefinition storage :: \"w256 \\<Rightarrow> w256 \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"storage idx w s == s = {StorageElm (idx, w)}\"\n\n\ndefinition this_account :: \"address \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"this_account t s == s = {ThisAccountElm t}\"\n\ndefinition balance :: \"address \\<Rightarrow> w256 \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"balance adr v s == s = {BalanceElm (adr, v)}\"\n\ndefinition block_number_pred :: \"w256 \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"block_number_pred w s == s = {BlockNumberElm w}\"\n\ndefinition continuing :: \"state_element set \\<Rightarrow> bool\"\nwhere\n\"continuing s == s = { ContinuingElm True }\"\n\ndefinition not_continuing :: \"state_element set \\<Rightarrow> bool\"\nwhere\n\"not_continuing s == s = {ContinuingElm False}\"\n\ndefinition action :: \"contract_action \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"action act s == s = {ContractActionElm act}\"\n\n(* memory8, memory, calldata, and storage should be added here *)\n\ndefinition memory8 :: \"w256 \\<Rightarrow> byte \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"memory8 idx v s == s = {MemoryElm (idx ,v)}\"\n\nlemma memory8_sep :\n \"(memory8 idx v ** rest) s = (MemoryElm (idx, v) \\<in> s \\<and> rest (s - {MemoryElm (idx, v)}))\"\n by (solve_sep_iff simp: memory8_def)\n\nlemma sep_memory8_sep :\n\"(a ** memory8 idx v ** rest) s = (MemoryElm (idx, v) \\<in> s \\<and> (a ** rest) (s - {MemoryElm (idx, v)}))\"\nproof -\n  have \"(a ** memory8 idx v ** rest) s = (memory8 idx v ** a ** rest) s\"\n    by (metis sep_conj_assoc sep_conj_commute)\n  moreover have \"(memory8 idx v ** a ** rest) s = (MemoryElm (idx, v) \\<in> s \\<and> (a ** rest) (s - {MemoryElm (idx, v)}))\"\n    by (rule memory8_sep)\n  ultimately show ?thesis\n    by auto\nqed\n    \nfun memory_range :: \"w256 \\<Rightarrow> byte list \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n  \"memory_range begin [] = emp\"\n| \"memory_range begin (h # t) = (memory8 begin h ** memory_range (begin + 1) t)\"\n\nfun memory_range_elms :: \"w256 \\<Rightarrow> byte list \\<Rightarrow> state_element set\"\nwhere\n  \"memory_range_elms begin [] = {}\"\n| \"memory_range_elms begin (a # lst) = {MemoryElm (begin, a)} \\<union> memory_range_elms (begin + 1) lst\"\n\nlemma memory_range_elms_nil :\n  \"x \\<notin> memory_range_elms b []\"\napply(simp)\ndone\n\nlemma memory_range_elms_cons :\n  \"memory_range_elms b (a # lst) = {MemoryElm (b, a)} \\<union> memory_range_elms (b + 1) lst\"\napply(auto)\ndone\n\n(* prove a lemma about the above two definitions *)\n\n\nlemma stack_sound0 :\n  \"(stack pos w ** p) s \\<Longrightarrow> StackElm (pos, w) \\<in> s\"\nby (clarsimp simp add: sep_basic_simps stack_def)\n\nlemmas context_rw = contexts_as_set_def variable_ctx_as_set_def constant_ctx_as_set_def\n      stack_as_set_def memory_as_set_def\n      balance_as_set_def storage_as_set_def log_as_set_def program_as_set_def data_sent_as_set_def\n      ext_program_as_set_def account_existence_as_set_def\n\nlemma stack_sound1 :\n  \"StackElm (pos, w) \\<in> contexts_as_set var con \\<Longrightarrow> rev (vctx_stack var) ! pos = w\"\n  apply(simp add: context_rw)\n  done\n\nlemma stack_sem :\n  \"(stack pos w ** p) (contexts_as_set var con) \\<Longrightarrow> rev (vctx_stack var) ! pos = w\"\n  apply(drule stack_sound0)\n  apply(drule stack_sound1)\n  apply(simp)\n  done\n\ndefinition instruction_result_as_set :: \"constant_ctx \\<Rightarrow> instruction_result \\<Rightarrow> state_element set\"\n  where\n    \"instruction_result_as_set c rslt =\n        ( case rslt of\n          InstructionContinue v \\<Rightarrow> {ContinuingElm True} \\<union> contexts_as_set v c\n        | InstructionToEnvironment act v _ \\<Rightarrow> {ContinuingElm False, ContractActionElm act} \\<union> contexts_as_set v c\n        )\"\n\ndefinition code :: \"(int * inst) set \\<Rightarrow> state_element set \\<Rightarrow> bool\"\n  where\n    \"code f s == s = { CodeElm(pos, i) | pos i. (pos, i) \\<in> f }\"\n\naxiomatization hash2 :: \"w256 \\<Rightarrow> w256 \\<Rightarrow> w256\" where\nhash_inj :\n    \"hash2 b v1 = hash2 c v2 \\<Longrightarrow> b = c \\<or> hash2 b v1 = 0\"\nand hash_inj2 :\n   \"hash2 b v1 = hash2 c v2 \\<Longrightarrow> v1 = v2  \\<or> hash2 b v1 = 0\"\nand hash_compat :\n   \"hash2 a b \\<noteq> 0 \\<Longrightarrow> hash2 a b = keccak (word_rsplit a@ word_rsplit b)\"\n\ndefinition magic_filter :: \"8 word list \\<Rightarrow> bool\" where\n\"magic_filter lst = (\\<forall> a b.\n   (lst = word_rsplit a @ word_rsplit b) \\<longrightarrow>\n   hash2 a b \\<noteq> 0)\"\n\ndefinition failed_for_reasons :: \"failure_reason set \\<Rightarrow> instruction_result \\<Rightarrow> bool\"\nwhere\n\"failed_for_reasons allowed r =\n (allowed \\<noteq> {} \\<and>\n (\\<exists> reasons a b.\n              r = InstructionToEnvironment (ContractFail reasons) a b\n              \\<and> set reasons \\<subseteq> allowed))\"\n\n\ndefinition triple ::\n \"network \\<Rightarrow> failure_reason set \\<Rightarrow> (state_element set \\<Rightarrow> state_element set \\<Rightarrow> bool)\n          \\<Rightarrow> (state_element set \\<Rightarrow> bool) \\<Rightarrow> (int * inst) set \\<Rightarrow> (state_element set \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n  \"triple net allowed_failures reentrancy pre insts post ==\n    \\<forall> co_ctx presult rest stopper.\n       (pre ** code insts ** rest) (instruction_result_as_set co_ctx presult) \\<longrightarrow>\n       (\\<exists> k.\n         ((post ** code insts ** rest) (instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult)))\n         \\<or> failed_for_reasons allowed_failures (program_sem stopper co_ctx k net presult))\"\n\nlemma pure_sep : \"(((\\<langle> b \\<rangle>) ** rest) s) = (b \\<and> rest s)\"\n  by ( simp add: sep_conj_def pure_def emp_def )\n\nlemma continuing_sep:\n  \"(continuing ** rest) s = ((ContinuingElm True) \\<in> s \\<and> rest (s - {ContinuingElm True}))\"\n   by (solve_sep_iff simp: continuing_def)\n\n\nlemma sep_continuing_sep:\n  \"(a ** continuing ** b) s = ((ContinuingElm True) \\<in> s \\<and> (a ** b) (s - {ContinuingElm True}))\"\n by (rule iffI) (sep_simp simp: continuing_sep)+\n\n\nlemma storage_sep:\n  \"(storage idx w ** rest) s =\n   (StorageElm (idx, w) \\<in> s \\<and> rest (s - {StorageElm (idx, w)}))\"\n   by (solve_sep_iff simp: storage_def)\n\nlemma sep_storage:\n  \"(rest ** storage idx w) s =\n   (StorageElm (idx, w) \\<in> s \\<and> rest (s - {StorageElm (idx, w)}))\"\n  by (solve_sep_iff simp: storage_def)\n\n\nlemma stack_height_sep : \"(stack_height h ** rest) s =\n  (StackHeightElm h \\<in> s \\<and> rest (s - {StackHeightElm h})) \"\n  by (solve_sep_iff simp: stack_height_def)\n\nlemma sep_stack_height : \"(rest ** stack_height h) s =\n  (StackHeightElm h \\<in> s \\<and> rest (s - {StackHeightElm h})) \"\n  by (solve_sep_iff simp: stack_height_def)\n\nlemma sep_stack_height_sep: \"(a ** stack_height h ** rest) s =\n  (StackHeightElm h \\<in> s \\<and> (a ** rest) (s - {StackHeightElm h})) \"\n  by (sep_simp simp: stack_height_sep)\n\nlemma stack_sep : \"(stack p w ** rest) s =\n  (StackElm (p, w) \\<in> s \\<and> rest (s - {StackElm (p, w)}))\"\n  by (solve_sep_iff simp: stack_def)\n\nlemma sep_stack : \"(rest ** stack p w) s =\n  (StackElm (p, w) \\<in> s \\<and> rest (s - {StackElm (p, w)}))\"\n  by (solve_sep_iff simp: stack_def)\n\nlemma sep_stack_sep  : \"(a ** stack p w ** rest) s =\n  (StackElm (p, w) \\<in> s \\<and> (a ** rest) (s - {StackElm (p, w)}))\"\n  by (sep_simp simp: stack_sep)\n\n\nlemma program_counter_sep : \"(program_counter w ** rest) s =\n  (PcElm w \\<in> s \\<and> rest (s - {PcElm w}))\"\n  by (solve_sep_iff simp: program_counter_def)\n\nlemma sep_program_counter : \"(rest ** program_counter w) s =\n  (PcElm w \\<in> s \\<and> rest (s - {PcElm w}))\"\n  by (solve_sep_iff simp: program_counter_def)\n\n\nlemma sep_program_counter_sep : \"(a ** program_counter w ** rest) s =\n  (PcElm w \\<in> s \\<and> (a ** rest) (s - {PcElm w}))\"\n  by (sep_simp simp: program_counter_sep)\n\nlemma code_sep: \"(code pairs ** rest) s =\n  ({ CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs } \\<subseteq> s \\<and> (rest (s - { CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs })))\"\n  apply (rule iffI)\n    apply (rule conjI)\n  apply (clarsimp simp: code_def sep_basic_simps)\n   apply (clarsimp simp:  sep_basic_simps)\n    apply (erule back_subst[where P=rest])\n    apply(fastforce simp add: code_def)\n  apply (clarsimp simp: code_def sep_basic_simps)\n  apply exI_pick_last_conj\n done\n\nlemma sep_code : \"(rest ** code pairs) s =\n  ({ CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs } \\<subseteq> s \\<and> (rest (s - { CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs })))\"\n  by (sep_simp simp: code_sep)\n\nlemma sep_code_sep: \"(a ** code pairs ** rest) s =\n  ({ CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs } \\<subseteq> s \\<and> ((a ** rest) (s - { CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs })))\"\n  by (sep_simp simp: code_sep)\n\nlemma sep_sep_code : \"(a ** b ** code pairs) s =\n  ({ CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs } \\<subseteq> s \\<and> ((a ** b) (s - { CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs })))\"\n  by (sep_simp simp: code_sep)\n\n\nlemma gas_pred_sep : \"(gas_pred g ** rest) s =\n  ( GasElm g \\<in> s \\<and> rest (s - { GasElm g }) )\"\n  by (solve_sep_iff simp: gas_pred_def)\n\n\nlemma sep_gas_pred : \"(rest ** gas_pred g) s =\n  ( GasElm g \\<in> s \\<and> rest (s - { GasElm g }) )\"\n  by (solve_sep_iff simp: gas_pred_def)\n\nlemma sep_gas_pred_sep:\n  \"(a ** gas_pred g ** b) s =\n   ( GasElm g \\<in> s \\<and> (a ** b) (s - { GasElm g } ) )\"\n by (sep_simp simp: gas_pred_sep)\n\n\nlemma memory_usage_sep: \n  \"(memory_usage u ** rest) s =\n   (MemoryUsageElm u \\<in> s \\<and> rest (s - {MemoryUsageElm u}))\"\n  by (solve_sep_iff simp: memory_usage_def)\n\nlemma sep_memory_usage: \n  \"(rest ** memory_usage u) s =\n   (MemoryUsageElm u \\<in> s \\<and> rest (s - {MemoryUsageElm u}))\"\n by (solve_sep_iff simp: memory_usage_def)\n\nlemma sep_memory_usage_sep:\n  \"(a ** memory_usage u ** rest) s =\n   (MemoryUsageElm u \\<in> s \\<and> (a ** rest) (s - {MemoryUsageElm u}))\"\n\tby (sep_simp simp:  memory_usage_sep)\n\n\nlemma stackHeightElmEquiv: \"StackHeightElm h \\<in> contexts_as_set v c =\n  (length (vctx_stack v) = h)\n  \"\nby (auto simp add:context_rw)\n\nlemma stackElmEquiv: \"StackElm (pos, w) \\<in> contexts_as_set v c =\n  (pos < length (vctx_stack v) \\<and> rev (vctx_stack v) ! pos = w)\"\nby (auto simp add:context_rw)\n\nlemma pcElmEquiv : \"PcElm k \\<in> contexts_as_set va_ctx co_ctx =\n  (vctx_pc va_ctx = k)\"\nby (auto simp add:context_rw)\n\nlemma gasElmEquiv: \"GasElm g \\<in> contexts_as_set va_ctx co_ctx =\n  (vctx_gas va_ctx = g)\"\nby (auto simp add:context_rw)\n\nlemma codeElmEquiv:\n  \"CodeElm (pos, i) \\<in> contexts_as_set va_ctx co_ctx =\n   ((program_content (cctx_program co_ctx) pos = Some i) \\<or>\n   (program_content (cctx_program co_ctx) pos = None) \\<and> i = Misc STOP)\"\nby (auto simp add:context_rw)\n\nlemmas stateelm_equiv_simps = \n  stackHeightElmEquiv\n  stackElmEquiv\n  pcElmEquiv\n  gasElmEquiv\n  codeElmEquiv\n\nlemma insert_minus : \"a \\<noteq> b \\<Longrightarrow> insert a s - { b } = insert a (s - {b})\"\n  apply(simp add: insert_Diff_if)\n  done\n\nlemma pred_functional : \"p (s :: state_element set) \\<Longrightarrow> s = t \\<Longrightarrow> p t\"\napply(auto)\ndone\n\nlemma insert_functional : \"e = f \\<Longrightarrow> s = t \\<Longrightarrow> insert e s = insert f t\"\n  apply(auto)\n  done\n\nlemma lookup_over[simp] : \"(rev lista @ (aa # l)) ! length lista = aa\"\n\tby (metis length_rev nth_append_length)\n\nlemma lookup_over1[simp] : \"(rev lista @ (w # a # l)) ! Suc (length lista) = a\"\n(* sledgehammer *)\n\tby (metis add.left_neutral append.assoc append_Nil2 length_append length_rev list.size(3) list.size(4) nth_append_length plus_nat.simps(2) rev.simps(2) rev_append rev_rev_ident)\n\nlemma short_match[simp] :\n  \"idx < length lista \\<Longrightarrow> (rev lista @ l) ! idx = (rev lista @ m) ! idx\"\n(* sledgehammer *)\n\tby (simp add: nth_append)\n\t\t\n(**\n ** Inference rules about Hoare triples\n ** Following Magnus Myreen's thesis, 3.5\n **)\nlemma code_diff_union : \"(code (a \\<union> b)) = (code a ** (code (b - a)))\"\n  by (rule ext) \n     (auto simp: sep_basic_simps code_def)\n\nlemma code_diff_union' : \"(code (a \\<union> b)) = (code b ** (code (a - b)))\"\n  by (rule ext) \n     (auto simp: sep_basic_simps code_def)\n\n     \nlemma code_middle:\n  \"(p ** code (c_1 \\<union> c_2) ** rest) =\n   (p ** (code c_1 ** (code (c_2 - c_1))) ** rest)\"\n by (simp add: code_diff_union)\n\nlemma code_middle':\n  \"(p ** rest ** code (c_1 \\<union> c_2)) =\n   (p ** rest ** (code c_1 ** (code (c_2 - c_1))))\"\n by (simp add: code_diff_union)\n\nlemma shuffle3:\n  \"(p ** (code c_1 ** code (c_2 - c_1)) ** rest) =\n   (p ** code c_1 ** (code (c_2 - c_1) ** rest))\"\n by (metis sep_conj_assoc)\n\nlemma execution_continue:\n  \"(program_sem s co_ctx a net (program_sem s co_ctx b net presult) = program_sem s co_ctx (b + a) net presult)\"\napply(induction b arbitrary: presult)\n apply(simp add: program_sem.simps)\napply(simp add: program_sem.simps)\ndone\n\n(* Maybe it's better to organize program_sem as a function from program_result to program_result *)\nlemma triple_continue:\n\"triple net allowed ind q c r \\<Longrightarrow>\n no_assertion co_ctx \\<Longrightarrow>\n (q ** code c ** rest) (instruction_result_as_set co_ctx (program_sem s co_ctx k net presult)) \\<Longrightarrow>\n \\<exists> l. ((r ** code c ** rest) (instruction_result_as_set co_ctx (program_sem s co_ctx (k + l) net presult))\n      \\<or> failed_for_reasons allowed (program_sem s co_ctx (k + l) net presult))\"\napply(simp add: triple_def)\napply(drule_tac x = co_ctx in spec)\napply(drule_tac x = \"program_sem s co_ctx k net presult\" in spec)\napply(drule_tac x = rest in spec)\napply(simp)\napply(drule_tac x = s in spec)\napply (simp add:  sep_code_sep   execution_continue)\ndone\n\nlemma code_back:\n  \"(q ** code c_1 ** code (c_2 - c_1) ** rest) s = (q ** code (c_1 \\<union> c_2) ** rest) s\"\napply(simp only: code_middle shuffle3)\ndone\n\nlemma code_more:\n  \"(rest ** p ** code cL ** code (cR - cL)) s = (rest ** p ** code (cL \\<union> cR)) s\"\napply(simp add: code_middle')\ndone\n\nlemma code_union_comm :\n \"code (cR \\<union> cL) = code (cL \\<union> cR)\"\n  by (simp add: sup_commute)\n\nlemma code_union_s:\n  \"(q ** code (c_2 \\<union> c_1) ** rest) s \\<Longrightarrow> (q ** code (c_1 \\<union> c_2) ** rest) s\"\n(* sledgehammer *)\n\tby (simp add: sup_commute)\n\nlemma composition:\n  \"c = cL \\<union> cR \\<Longrightarrow> triple net F ind P cL Q \\<Longrightarrow> triple net F ind Q cR R \\<Longrightarrow> triple net F ind P c R\"\n  apply (simp (no_asm) add: triple_def)\n  apply clarsimp\n  apply (subst (asm) triple_def[where pre=P])\n  apply clarsimp\n  apply (rename_tac co_ctx presult rest stopper)\n  apply(drule_tac x = \"co_ctx\" in spec)\n  apply(drule_tac x = \"presult\" in spec)\n  apply(drule_tac x = \"code (cR - cL) ** rest\" in spec)\n  apply (erule impE)\n   apply(subgoal_tac \"(instruction_result_as_set co_ctx presult - {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL \\<or> (pos, i) \\<in> cR})\n    = (instruction_result_as_set co_ctx presult - {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL} -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cR \\<and> (pos, i) \\<notin> cL})\")\n    apply (simp add: code_back)\n   apply blast\n  apply(drule_tac x = stopper in spec)\n  apply(erule exE)\n  apply (subst (asm) triple_def[where pre=Q])\n  apply(drule_tac x = \"co_ctx\" in spec)\n  apply(drule_tac x = \"(program_sem stopper co_ctx k net presult)\" in spec)\n  apply(drule_tac x = \"code (cL - cR) ** rest\" in spec)\n  apply(erule disjE)\n   apply(drule_tac x = stopper in spec)\n   apply (erule impE)\n    apply(subgoal_tac \"(instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult) -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL} -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cR \\<and> (pos, i) \\<notin> cL}) =\n         (instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult) -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cR} -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL \\<and> (pos, i) \\<notin> cR})\")\n     apply (metis code_diff_union code_union_comm sep_three)\n    apply blast\n   apply(erule exE)\n   apply(rename_tac k l)\n   apply(rule_tac x = \"k + l\" in exI)\n   apply(erule disjE)\n   apply(rule disjI1)\n   apply(subgoal_tac \"\n   (instruction_result_as_set co_ctx (program_sem stopper co_ctx (k + l) net presult) -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cR} -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL \\<and> (pos, i) \\<notin> cR}) =\n   (instruction_result_as_set co_ctx (program_sem stopper co_ctx (k + l) net presult) -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL \\<or> (pos, i) \\<in> cR})\")\n    apply (simp add: code_back code_union_s execution_continue)\n   apply blast\n  apply auto\n using execution_continue by auto\n\n\n(** Frame **)\n\nlemma frame:\n \"triple net F ind P c Q \\<Longrightarrow> triple net F ind (P ** R) c (Q ** R)\"\n  apply (simp add: triple_def)\n  apply clarsimp\n  subgoal for co_ctx presult rest stopper\n  apply (drule spec[where x=co_ctx])\n  apply (drule spec2[where x=presult and y=\"R ** rest\"])\n  apply (simp del: sep_conj_assoc add: sep_conj_ac)\n  done\n done\n\n\nlemma imp_sepL:\n  \"(\\<forall>s. a s \\<longrightarrow> b s) \\<Longrightarrow>\n   (\\<forall>s. (a ** c) s \\<longrightarrow> (b ** c) s)\"\n  by (auto simp add: sep_basic_simps)\n\n\n\n\n\nlemma frame_backward:\n  \"triple net F ind P c Q \\<Longrightarrow> P' = (P ** R) \\<Longrightarrow> Q' = (Q ** R) \\<Longrightarrow>\n   triple net F ind P' c Q'\"\n  by (simp add: frame)\n\nlemma remove_true:\n \"(p ** \\<langle>True\\<rangle> ** rest) = (p ** rest)\"\n by (simp add: pure_def sep_conj_def emp_def)\n    \nlemma true_sep [simp] :\n  \"(p ** \\<langle>True\\<rangle>) = p\"\n by (simp add: pure_def sep_conj_def emp_def)\n\nlemma sep_true [simp] :\n  \"(\\<langle>True\\<rangle> ** p) = p\"\n by (simp add: pure_def sep_conj_def emp_def)\n\nlemma move_pure0 :\n  \"triple net reasons ind (p ** \\<langle> True \\<rangle>) c q \\<Longrightarrow>  triple net reasons ind p c q\"\napply(simp add: triple_def remove_true)\ndone\n\nlemma false_triple :\n  \"triple net reasons ind (p ** \\<langle> False \\<rangle>) c q\"\napply(simp add: triple_def sep_basic_simps pure_def)\ndone\n\nlemma get_pure:\n  \"((p ** \\<langle> b \\<rangle> ** rest) s) = (b \\<and> (p ** rest) s)\"\napply(auto simp add: sep_basic_simps pure_def emp_def)\ndone\n\nlemma move_pure: \"triple net reaons ind (p ** \\<langle> b \\<rangle>) c q = (b \\<longrightarrow> triple net reaons ind p c q)\"\napply(auto simp add: move_pure0 false_triple)\napply(case_tac b; auto simp: false_triple)\n  done\n\nlemma pure_sepD:\n  \"(\\<langle>P\\<rangle> ** R) s \\<Longrightarrow> R s\"\n  by (simp add: pure_def emp_def sep_basic_simps)\n    \nlemma move_pureL: \"triple net reaons ind (\\<langle> b \\<rangle> ** p) c q = (b \\<longrightarrow> triple net reaons ind p c q)\"\n by (metis move_pure sep_conj_commute)\n\nlemma tmp01:\n    \"(rest ** code c ** p x) (case presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {}) \\<Longrightarrow>\n    (rest ** code c ** (\\<lambda>s. \\<exists>x. p x s)) (case presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {})\"\n  apply (sep_cancel)+\n  apply blast\n  done\n\nlemma tmp0:\n       \"\\<forall>co_ctx. no_assertion co_ctx \\<longrightarrow>\n                (\\<forall>presult rest.\n                    ((\\<lambda>s. \\<exists>x. p x s) ** code c ** rest) (case presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {}) \\<longrightarrow>\n                    (\\<forall>stopper. \\<exists>k. (q ** code c ** rest) (case program_sem stopper co_ctx k net presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {}))) \\<Longrightarrow>\n       no_assertion co_ctx \\<Longrightarrow>\n       (p x ** code c ** rest) (case presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {}) \\<Longrightarrow>\n       \\<exists>k. (q ** code c ** rest) (case program_sem stopper co_ctx k net presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {})\"\napply(drule_tac x = co_ctx in spec)\napply(simp)\napply(drule_tac x = presult in spec)\napply(drule_tac x = rest in spec)\napply(subgoal_tac \"(rest ** code c ** (\\<lambda>s. \\<exists>x. p x s))\n     (case presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {})\")\n    (*\napply(rule tmp01)\napply(simp)\ndone*)\n    oops\n\n\nlemma preE0:\n  \"((\\<lambda>s. \\<exists>x. p x s) ** code c ** rest) s \\<Longrightarrow>\n   \\<exists> x. (p x ** code c ** rest) s\"\napply(auto simp only: sep_basic_simps)\n\tby blast\n\nlemma sep_impL :\n \"\\<forall> s. b s \\<longrightarrow> a s \\<Longrightarrow> \n (c ** b ** d) s \\<longrightarrow>\n (c ** a ** d) s\"\n  by (metis sep_basic_simps)\n\n\nlemma pre_imp:\n assumes \"\\<forall> s. (b s \\<longrightarrow> a s)\"\n and \" triple net reasons ind a c q\"\nshows\" triple net reasons ind b c q\"\nusing assms(2)\n  apply(auto simp add: triple_def)\n  apply(drule_tac x = co_ctx in spec)\n  apply(drule_tac x = presult in spec)\n  apply(drule_tac x = rest in spec)\n  apply (erule impE)\n   apply (sep_drule  assms(1)[rule_format])\n   apply blast\n  apply(subgoal_tac \"(rest ** a ** code c) (instruction_result_as_set co_ctx presult)\")\n   apply(simp )\n  apply (sep_rule sep_impL[OF assms(1), rule_format])\n  apply(simp add: code_sep sep_code_sep)\n done\n\nlemma preE1:\n\"((\\<lambda>s. \\<exists>x. p x s) ** rest) u\n=\n(\\<exists> x. (p x ** rest) u)\n\"\napply(auto simp add: sep_basic_simps)\ndone\n\nlemma preE00:\n  \"(rest ** code c ** p x) s \\<Longrightarrow>\n   (rest ** code c ** (\\<lambda>s. \\<exists>x. p x s)) s\"\n  apply (sep_cancel)+\n  apply blast\n done\n\nlemma preE : \"triple net reasons ind (\\<lambda> s. \\<exists> x. p x s) c q = (\\<forall> x. triple net reasons ind (p x) c q)\"\napply(auto simp add: triple_def preE1)\n apply(erule_tac x = co_ctx in allE)\n apply(drule_tac x = presult in spec)\n  apply(drule_tac x = rest in spec)\n  apply (erule impE)\n   apply blast\n apply(subgoal_tac \"(rest ** code c ** (\\<lambda>s. \\<exists>x. p x s)) (instruction_result_as_set co_ctx presult)\")\n   apply(simp)\n  apply(rule_tac x=x in preE00)\n  apply(simp)\n  apply (sep_simp simp: code_sep )\n  apply (simp add: sep_conj_commute)\ndone\n\n\n(** More rules to come **)\n\nlemma triple_tauto: \"triple net failures ind q e q\"\napply(simp add: triple_def; auto)\napply(rule_tac x = 0 in exI)\napply(simp add: program_sem.simps)\ndone\n\n\nlemma code_extension0: \"triple net failures ind p c_1 q \\<Longrightarrow> triple net failures ind q c_2 q \\<Longrightarrow>\n                        triple net failures ind p (c_1 \\<union> c_2) q\"\napply(rule_tac cL = c_1 and cR = c_2 in composition; auto)\ndone\n\nlemma code_extension : \"triple net failures ind p c q \\<Longrightarrow> triple net failures ind p (c \\<union> e) q\"\n\tby (simp add: composition triple_tauto)\n\nlemma code_extension_backward :\n  \"triple net failures ind p c' q \\<Longrightarrow> c' \\<subseteq> c \\<Longrightarrow> triple net failures ind p c q\" \nproof -\n assume \"triple net failures ind p c' q\"\n then have \"triple net failures ind p (c' \\<union> c) q\"\n  using code_extension by blast\n moreover assume \"c' \\<subseteq> c\"\n then have \"c = c' \\<union> c\"\n  by (auto)\n ultimately show \"triple net failures ind p c q\"\n  by auto\nqed\n\n\n\n(* Some rules about this if-then-else should be derivable. *)\n\ndefinition if_then_else :: \"int \\<Rightarrow> inst list \\<Rightarrow> inst list \\<Rightarrow> inst list \\<Rightarrow> inst list\"\nwhere\n\"if_then_else beginning cond then_case else_case =\n cond\n @ (* beginning + length cond *)\n [Stack (PUSH_N (word_rsplit (word_of_int (beginning + int (length cond) + 8 + int (length else_case)) :: 16 word))), Pc JUMPI] \n @ (* beginning + length cond + 4 *)\n else_case\n @ (* beginning + length cond + length else_case + 4 *)\n [Stack (PUSH_N (word_rsplit (word_of_int (beginning + int (length cond) + int (length else_case) + 9 + int (length then_case)) :: 16 word))), Pc JUMP]\n @ (* beginning + length cond + length else_case + 8 *)\n [Pc JUMPDEST]\n @ (* beginning + length cond + length else_case + 9 *)\n then_case\n @ (* beginning + length cond + length else_case + 9 + length then_case *)\n [Pc JUMPDEST]\n\"\n\n(* example of if_then_else *)\n\n(* loop *)\n\n  \n(* precondition / post condition pair *)\n\n(* What would be the type of precondition? *)\n(* instruction_result \\<Rightarrow> bool\n * In the precondition, the program counter is overwritten.\n *)\n\n(* validity of pre, program, post triples.\n * Failures are considered as success.\n *)\n\nbundle hoare_bundle = \nsep_logged[simp]\ngas_any_sep[simp]\nsep_gas_any_sep[simp]\nsep_log_number_sep[simp]\nmemory8_sep[simp]\npure_sep[simp]\ncontinuing_sep[simp]\nsep_continuing_sep[simp]\nstorage_sep[simp]\nsep_storage[simp]\nstack_height_sep[simp]\nsep_stack_height[simp]\nsep_stack_height_sep[simp]\nstack_sep[simp]\nsep_stack[simp]\nsep_stack_sep[simp]\nprogram_counter_sep[simp]\nsep_program_counter[simp]\nsep_program_counter_sep[simp]\ncode_sep[simp]\nsep_code[simp]\nsep_code_sep[simp]\nsep_sep_code[simp]\ngas_pred_sep[simp]\nsep_gas_pred[simp]\nsep_gas_pred_sep[simp]\nmemory_usage_sep[simp]\nsep_memory_usage[simp]\nsep_memory_usage_sep[simp]\nstackHeightElmEquiv[simp]\nstackElmEquiv[simp]\npcElmEquiv[simp]\ngasElmEquiv[simp]\ncodeElmEquiv[simp]\nlookup_over[simp]\nlookup_over1[simp]\nshort_match[simp]\nmemory_as_set_def[simp]\nstorage_as_set_def[simp]\nlog_as_set_def[simp]\nbalance_as_set_def[simp]\nnext_state_def[simp]\nexecution_continue[simp]\nsep_true[simp]\nfalse_triple[simp]\nget_pure[simp]\nmove_pure[simp]\nmove_pureL[simp]\nsep_code_sep[simp]\npreE1[simp]\nsep_code_sep[simp]\nsep_sep_code[simp]\n  \n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/HoareWithInvariant/HoareWithInvariant.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7577943712746406, "lm_q2_score": 0.4186969093556867, "lm_q1q2_score": 0.3172861611798278}}
{"text": "theory Bipartite_Vertex_Priorities\n  imports \n    Bipartite_Matching_LP\n    Measure_Misc\nbegin\n\nlemma funcset_update:\n  assumes \"Y \\<in> L - {i} \\<rightarrow> S\"\n  assumes \"y \\<in> S\"\n  shows \"Y(i := y) \\<in> L \\<rightarrow> S\"\n  using assms\n  by auto\n\nlocale bipartite_vertex_priorities = bipartite_matching_lp\nbegin\n\nabbreviation \"\\<U> \\<equiv> uniform_measure lborel {0..1::real}\"\nabbreviation \"\\<Y> \\<equiv> \\<Pi>\\<^sub>M i \\<in> L. \\<U>\"\n\nsublocale component_prob_space: prob_space \\<U>\n  by (auto intro: prob_space_uniform_measure)\n\nlemmas component_prob_space.prob_space_axioms[intro]\n\nsublocale prob_space \\<Y>\n  by (auto intro: prob_space_PiM)\n\nlemma prob_space_PiM_\\<U>:\n  \"prob_space (PiM I (\\<lambda>_. \\<U>))\"\n  by (auto intro: prob_space_PiM)\n\nlemma emeasure_space_PiM_\\<U>[simp]:\n  shows \"emeasure (PiM I (\\<lambda>_. \\<U>)) (space (PiM I (\\<lambda>_. \\<U>))) = 1\"\n  by (intro prob_space.emeasure_space_1 prob_space_PiM_\\<U>)\n\nlemma pair_sigma_finite_split_dim[intro]: \"pair_sigma_finite \\<U> (Pi\\<^sub>M (L - {i}) (\\<lambda>i. \\<U>))\"\n  by (intro pair_sigma_finite.intro prob_space_imp_sigma_finite prob_space_PiM) blast+\n\nlemmas pair_sigma_finite_split_dim'[intro] = pair_sigma_finite.pair_sigma_finite_swap[OF pair_sigma_finite_split_dim]\n\nlemma AE_PiM_subset_L_\\<U>_funcset:\n  assumes \"L' \\<subseteq> L\"\n  shows \"AE Y in \\<Pi>\\<^sub>M i \\<in> L'. \\<U>. Y \\<in> L' \\<rightarrow> {0..1}\"\n  using finite_L assms\n  by (intro AE_PiM_uniform_measure_PiE_countable)\n     (auto intro: countable_finite finite_subset)\n\nlemmas AE_\\<Y>_funcset = AE_PiM_subset_L_\\<U>_funcset[where L' = L, OF subset_refl]\n\nlemma AE_\\<U>_in_range: \"AE y in \\<U>. y \\<in> {0..1}\"\n  by (auto intro: AE_uniform_measureI)\n\nlemma AE_add_dim_in_range:\n  \"AE (y,Y) in (\\<U> \\<Otimes>\\<^sub>M Pi\\<^sub>M (L - {i}) (\\<lambda>i. \\<U>)). y \\<in> {0..1}\"\n  by (subst pair_sigma_finite.AE_pair_measure_swap)\n     (auto simp: case_prod_beta space_pair_measure intro!: pair_sigma_finite.AE_pair_measure AE_uniform_measureI)\n\nlemma AE_add_dim_funcset:\n  \"AE (y,Y) in (\\<U> \\<Otimes>\\<^sub>M Pi\\<^sub>M (L - {i}) (\\<lambda>i. \\<U>)). Y \\<in> L - {i} \\<rightarrow> {0..1}\"\n  using finite_L\n  by (auto intro!: pair_sigma_finite.AE_pair_measure AE_PiM_subset_L_\\<U>_funcset simp: case_prod_beta space_pair_measure)\n\nlemma AE_split_dim_funcset:\n  shows \"AE (y, Y) in \\<U> \\<Otimes>\\<^sub>M Pi\\<^sub>M (L - {i}) (\\<lambda>i. \\<U>). Y(i := y) \\<in> L \\<rightarrow> {0..1}\"\n  using AE_add_dim_in_range AE_add_dim_funcset\n  by eventually_elim auto\n\nlemma AE_\\<U>_funcset:\n  \"i \\<in> L \\<Longrightarrow> Y \\<in> L - {i} \\<rightarrow> {0..1} \\<Longrightarrow> AE y in \\<U>. Y(i:=y) \\<in> L \\<rightarrow> {0..1}\"\n  using AE_\\<U>_in_range\n  by eventually_elim auto\n\n\nend\n\nend", "meta": {"author": "cmadlener", "repo": "isabelle-online-matching-primal-dual", "sha": "a200eb7aa09f04b96d55b6f0f5ddedfdd239026a", "save_path": "github-repos/isabelle/cmadlener-isabelle-online-matching-primal-dual", "path": "github-repos/isabelle/cmadlener-isabelle-online-matching-primal-dual/isabelle-online-matching-primal-dual-a200eb7aa09f04b96d55b6f0f5ddedfdd239026a/Bipartite_Vertex_Priorities.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.3172179640459786}}
{"text": "theory Sepref_Acconstraint\n  imports Refine_Imperative_HOL.IICF TA.Timed_Automata\nbegin\n\nterm hn_ctxt\n\n  subsection \\<open>Refinement Assertion\\<close>\n  fun acconstraint_assn where\n(*\n    \"acconstraint_assn A (E1 x) (E1 x') = A x x'\"\n  | \"acconstraint_assn A (E2 x) (E2 x') = A x x'\"\n  | \"acconstraint_assn A (E3) (E3) = emp\"\n*)\n  \"acconstraint_assn A B (LT x y) (LT x' y') = A x x' * B y y'\"\n  | \"acconstraint_assn A B (LE x y) (LE x' y') = A x x' * B y y'\"\n  | \"acconstraint_assn A B (EQ x y) (EQ x' y') = A x x' * B y y'\"\n  | \"acconstraint_assn A B (GE x y) (GE x' y') = A x x' * B y y'\"\n  | \"acconstraint_assn A B (GT x y) (GT x' y') = A x x' * B y y'\"\n(*\n  | \"acconstraint_assn A (E5 x y) (E5 x' y') = bool_assn x x' * A y y'\"\n*)\n  | \"acconstraint_assn _ _ _ _ = false\"\n\n\n  fun acconstraint_relp where\n  \"acconstraint_relp A B (LT x y) (LT x' y') \\<longleftrightarrow> A x x' \\<and> B y y'\"\n  | \"acconstraint_relp A B (LE x y) (LE x' y') \\<longleftrightarrow> A x x' \\<and> B y y'\"\n  | \"acconstraint_relp A B (EQ x y) (EQ x' y') \\<longleftrightarrow> A x x' \\<and> B y y'\"\n  | \"acconstraint_relp A B (GE x y) (GE x' y') \\<longleftrightarrow> A x x' \\<and> B y y'\"\n  | \"acconstraint_relp A B (GT x y) (GT x' y') \\<longleftrightarrow> A x x' \\<and> B y y'\"\n  | \"acconstraint_relp _ _ _ _ \\<longleftrightarrow> False\"\n\n  definition [to_relAPP]: \"acconstraint_rel A B \\<equiv> p2rel (acconstraint_relp (rel2p A) (rel2p B))\"\n  \n  lemma aconstraint_assn_pure_conv[constraint_simps]:\n    \"acconstraint_assn (pure A) (pure B) \\<equiv> pure (\\<langle>A,B\\<rangle> acconstraint_rel)\"\n  apply (rule eq_reflection)\n  apply (intro ext)\n  subgoal for a b\n  apply (cases a; cases b; simp add: acconstraint_rel_def pure_def p2rel_def rel2p_def)\n  done\n  done\n\n  lemmas [sepref_import_rewrite, sepref_frame_normrel_eqs, fcomp_norm_unfold] =\n    aconstraint_assn_pure_conv[symmetric]\n\n  text \\<open>You might want to prove some properties\\<close>\n\n  text \\<open>A pure-rule is required to enable recovering of invalidated data that was not stored on the heap\\<close>\n  lemma acconstraint_assn_pure[constraint_rules]: \"is_pure A \\<Longrightarrow> is_pure B \\<Longrightarrow> is_pure (acconstraint_assn A B)\"\n    apply (auto simp: is_pure_iff_pure_assn)\n    apply (rename_tac x x')\n    apply (case_tac x; case_tac x'; simp add: pure_def)\n    done\n\n  text \\<open>An identitiy rule is required to easily prove trivial refinement theorems\\<close>    \n  lemma acconstraint_assn_id[simp]: \"acconstraint_assn id_assn id_assn = id_assn\"\n    apply (intro ext)\n    subgoal for x y by (cases x; cases y; simp add: pure_def)\n    done\n\n  text \\<open>With congruence condition\\<close>  \n  lemma acconstraint_match_cong[sepref_frame_match_rules]: \n    \"\\<lbrakk>\\<And>x y. \\<lbrakk>x\\<in>set1_acconstraint e; y\\<in>set1_acconstraint e'\\<rbrakk> \\<Longrightarrow> hn_ctxt A x y \\<Longrightarrow>\\<^sub>t hn_ctxt A' x y\\<rbrakk>\n    \\<Longrightarrow> \\<lbrakk>\\<And>x y. \\<lbrakk>x\\<in>set2_acconstraint e; y\\<in>set2_acconstraint e'\\<rbrakk> \\<Longrightarrow> hn_ctxt B x y \\<Longrightarrow>\\<^sub>t hn_ctxt B' x y\\<rbrakk>\n    \\<Longrightarrow> hn_ctxt (acconstraint_assn A B) e e' \\<Longrightarrow>\\<^sub>t hn_ctxt (acconstraint_assn A' B') e e'\"\n    by (cases e; cases e'; simp add: hn_ctxt_def entt_star_mono)\n      \n\n  lemma acconstraint_merge_cong[sepref_frame_merge_rules]:\n    assumes \"\\<And>x y. \\<lbrakk>x\\<in>set1_acconstraint e; y\\<in>set1_acconstraint e'\\<rbrakk> \\<Longrightarrow> hn_ctxt A x y \\<or>\\<^sub>A hn_ctxt A' x y \\<Longrightarrow>\\<^sub>t hn_ctxt Am x y\"\n    assumes \"\\<And>x y. \\<lbrakk>x\\<in>set2_acconstraint e; y\\<in>set2_acconstraint e'\\<rbrakk> \\<Longrightarrow> hn_ctxt B x y \\<or>\\<^sub>A hn_ctxt B' x y \\<Longrightarrow>\\<^sub>t hn_ctxt Bm x y\"\n    shows \"hn_ctxt (acconstraint_assn A B) e e' \\<or>\\<^sub>A hn_ctxt (acconstraint_assn A' B') e e' \\<Longrightarrow>\\<^sub>t hn_ctxt (acconstraint_assn Am Bm) e e'\"\n    apply (blast intro: entt_disjE acconstraint_match_cong entt_disjD1[OF assms(1)] entt_disjD2[OF assms(1)] entt_disjD1[OF assms(2)] entt_disjD2[OF assms(2)])\n    done\n\n  text \\<open>Propagating invalid\\<close>  \n  lemma entt_invalid_acconstraint: \"hn_invalid (acconstraint_assn A B) e e' \\<Longrightarrow>\\<^sub>t hn_ctxt (acconstraint_assn (invalid_assn A) (invalid_assn B)) e e'\"\n    apply (simp add: hn_ctxt_def invalid_assn_def[abs_def])\n    apply (rule enttI)\n    apply clarsimp\n    apply (cases e; cases e'; auto simp: mod_star_conv pure_def) \n    done\n\n  lemmas invalid_acconstraint_merge[sepref_frame_merge_rules] = gen_merge_cons[OF entt_invalid_acconstraint]\n\n  subsection \\<open>Constructors\\<close>  \n  text \\<open>Constructors need to be registered\\<close>\n  sepref_register LT LE EQ GE GT\n  \n  text \\<open>Refinement rules can be proven straightforwardly on the separation logic level (method @{method sepref_to_hoare})\\<close>\n  (*\n  lemma [sepref_fr_rules]: \"(return o E1,RETURN o E1) \\<in> A\\<^sup>d \\<rightarrow>\\<^sub>a acconstraint_assn A\"\n    by sepref_to_hoare sep_auto\n  lemma [sepref_fr_rules]: \"(return o E2,RETURN o E2) \\<in> A\\<^sup>d \\<rightarrow>\\<^sub>a acconstraint_assn A\"\n    by sepref_to_hoare sep_auto\n  lemma [sepref_fr_rules]: \"(uncurry0 (return E3),uncurry0 (RETURN E3)) \\<in> unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a acconstraint_assn A\"\n    by sepref_to_hoare sep_auto\n  *)\n  lemma [sepref_fr_rules]: \"(uncurry (return oo LT),uncurry (RETURN oo LT)) \\<in> A\\<^sup>d*\\<^sub>aB\\<^sup>d \\<rightarrow>\\<^sub>a acconstraint_assn A B\"\n    by sepref_to_hoare sep_auto\n  lemma [sepref_fr_rules]: \"(uncurry (return oo LE),uncurry (RETURN oo LE)) \\<in> A\\<^sup>d*\\<^sub>aB\\<^sup>d \\<rightarrow>\\<^sub>a acconstraint_assn A B\"\n    by sepref_to_hoare sep_auto\n  lemma [sepref_fr_rules]: \"(uncurry (return oo EQ),uncurry (RETURN oo EQ)) \\<in> A\\<^sup>d*\\<^sub>aB\\<^sup>d \\<rightarrow>\\<^sub>a acconstraint_assn A B\"\n    by sepref_to_hoare sep_auto\n  lemma [sepref_fr_rules]: \"(uncurry (return oo GE),uncurry (RETURN oo GE)) \\<in> A\\<^sup>d*\\<^sub>aB\\<^sup>d \\<rightarrow>\\<^sub>a acconstraint_assn A B\"\n    by sepref_to_hoare sep_auto\n  lemma [sepref_fr_rules]: \"(uncurry (return oo GT),uncurry (RETURN oo GT)) \\<in> A\\<^sup>d*\\<^sub>aB\\<^sup>d \\<rightarrow>\\<^sub>a acconstraint_assn A B\"\n    by sepref_to_hoare sep_auto\n  (*\n  lemma [sepref_fr_rules]: \"(uncurry (return oo E4),uncurry (RETURN oo E4)) \\<in> A\\<^sup>d*\\<^sub>aA\\<^sup>d \\<rightarrow>\\<^sub>a acconstraint_assn A\"\n    by sepref_to_hoare sep_auto\n  *)\n  (*\n  lemma [sepref_fr_rules]: \"(uncurry (return oo E5),uncurry (RETURN oo E5)) \\<in> bool_assn\\<^sup>k*\\<^sub>aA\\<^sup>d \\<rightarrow>\\<^sub>a acconstraint_assn A\"\n    by sepref_to_hoare (sep_auto simp: pure_def)\n  *)\n\n  subsection \\<open>Destructor\\<close>  \n  text \\<open>There is currently no automation for destructors, so all the registration boilerplate \n    needs to be done manually\\<close>\n\n  text \\<open>Set ups operation identification heuristics\\<close>\n  sepref_register case_acconstraint\n\n  text \\<open>In the monadify phase, this eta-expands to make visible all required arguments\\<close>\n  lemma [sepref_monadify_arity]: \"case_acconstraint \\<equiv> \\<lambda>\\<^sub>2f1 f2 f3 f4 f5 x. SP case_acconstraint$(\\<lambda>\\<^sub>2x. f1$x)$(\\<lambda>\\<^sub>2x. f2$x)$f3$(\\<lambda>\\<^sub>2x y. f4$x$y)$(\\<lambda>\\<^sub>2x y. f5$x$y)$x\"\n    by simp\n\n  text \\<open>This determines an evaluation order for the first-order operands\\<close>  \n  lemma [sepref_monadify_comb]: \"case_acconstraint$f1$f2$f3$f4$f5$x \\<equiv> (\\<bind>)$(EVAL$x)$(\\<lambda>\\<^sub>2x. SP case_acconstraint$f1$f2$f3$f4$f5$x)\" by simp\n\n  text \\<open>This enables translation of the case-distinction in a non-monadic context.\\<close>  \n  lemma [sepref_monadify_comb]: \"EVAL$(case_acconstraint$(\\<lambda>\\<^sub>2x y. f1 x y)$(\\<lambda>\\<^sub>2x y. f2 x y)$(\\<lambda>\\<^sub>2x y. f3 x y)$(\\<lambda>\\<^sub>2x y. f4 x y)$(\\<lambda>\\<^sub>2x y. f5 x y)$x) \n    \\<equiv> (\\<bind>)$(EVAL$x)$(\\<lambda>\\<^sub>2x. SP case_acconstraint$(\\<lambda>\\<^sub>2x y. EVAL $ f1 x y)$(\\<lambda>\\<^sub>2x y. EVAL $ f2 x y)$(\\<lambda>\\<^sub>2x y. EVAL $ f3 x y)$(\\<lambda>\\<^sub>2x y. EVAL $ f4 x y)$(\\<lambda>\\<^sub>2x y. EVAL $ f5 x y)$x)\"\n    apply (rule eq_reflection)\n    by (simp split: acconstraint.splits)\n\n  text \\<open>Auxiliary lemma, to lift simp-rule over \\<open>hn_ctxt\\<close>\\<close>  \n  lemma acconstraint_assn_ctxt: \"acconstraint_assn A B x y = z \\<Longrightarrow> hn_ctxt (acconstraint_assn A B) x y = z\"\n    by (simp add: hn_ctxt_def)\n\n  text \\<open>The cases lemma first extracts the refinement for the datatype from the precondition.\n    Next, it generate proof obligations to refine the functions for every case. \n    Finally the postconditions of the refinement are merged. \n\n    Note that we handle the\n    destructed values separately, to allow reconstruction of the original datatype after the case-expression.\n\n    Moreover, we provide (invalidated) versions of the original compound value to the cases,\n    which allows access to pure compound values from inside the case.\n    \\<close>  \n  lemma acconstraint_cases_hnr:\n    fixes A B and e :: \"('a,'b) acconstraint\" and e' :: \"('ai,'bi) acconstraint\"\n    defines [simp]: \"INVe \\<equiv> hn_invalid (acconstraint_assn A B) e e'\"\n    assumes FR: \"\\<Gamma> \\<Longrightarrow>\\<^sub>t hn_ctxt (acconstraint_assn A B) e e' * F\"\n    (*\n    assumes E1: \"\\<And>x1 x1a. \\<lbrakk>e = E1 x1; e' = E1 x1a\\<rbrakk> \\<Longrightarrow> hn_refine (hn_ctxt A x1 x1a * INVe * F) (f1' x1a) (hn_ctxt A1' x1 x1a * hn_ctxt XX1 e e' * \\<Gamma>1') R (f1 x1)\"\n    assumes E2: \"\\<And>x2 x2a. \\<lbrakk>e = E2 x2; e' = E2 x2a\\<rbrakk> \\<Longrightarrow> hn_refine (hn_ctxt A x2 x2a * INVe * F) (f2' x2a) (hn_ctxt A2' x2 x2a * hn_ctxt XX2 e e' * \\<Gamma>2') R (f2 x2)\"\n    assumes E3: \"\\<lbrakk>e = E3; e' = E3\\<rbrakk> \\<Longrightarrow> hn_refine F f3' \\<Gamma>3' R f3\"\n    *)\n    assumes LT: \"\\<And>x41 x42 x41a x42a.\n       \\<lbrakk>e = LT x41 x42; e' = LT x41a x42a\\<rbrakk>\n       \\<Longrightarrow> hn_refine\n            (hn_ctxt A x41 x41a * hn_ctxt B x42 x42a * INVe * F)\n            (f1' x41a x42a)\n            (hn_ctxt A1a' x41 x41a * hn_ctxt B1b' x42 x42a * hn_ctxt XX1 e e' * \\<Gamma>1') R\n            (f1 x41 x42)\"\n    assumes LE: \"\\<And>x41 x42 x41a x42a.\n       \\<lbrakk>e = LE x41 x42; e' = LE x41a x42a\\<rbrakk>\n       \\<Longrightarrow> hn_refine\n            (hn_ctxt A x41 x41a * hn_ctxt B x42 x42a * INVe * F)\n            (f2' x41a x42a)\n            (hn_ctxt A2a' x41 x41a * hn_ctxt B2b' x42 x42a * hn_ctxt XX2 e e' * \\<Gamma>2') R\n            (f2 x41 x42)\"\n    assumes EQ: \"\\<And>x41 x42 x41a x42a.\n       \\<lbrakk>e = EQ x41 x42; e' = EQ x41a x42a\\<rbrakk>\n       \\<Longrightarrow> hn_refine\n            (hn_ctxt A x41 x41a * hn_ctxt B x42 x42a * INVe * F)\n            (f3' x41a x42a)\n            (hn_ctxt A3a' x41 x41a * hn_ctxt B3b' x42 x42a * hn_ctxt XX3 e e' * \\<Gamma>3') R\n            (f3 x41 x42)\"\n    assumes GE: \"\\<And>x41 x42 x41a x42a.\n       \\<lbrakk>e = GE x41 x42; e' = GE x41a x42a\\<rbrakk>\n       \\<Longrightarrow> hn_refine\n            (hn_ctxt A x41 x41a * hn_ctxt B x42 x42a * INVe * F)\n            (f4' x41a x42a)\n            (hn_ctxt A4a' x41 x41a * hn_ctxt B4b' x42 x42a * hn_ctxt XX4 e e' * \\<Gamma>4') R\n            (f4 x41 x42)\"\n    assumes GT: \"\\<And>x41 x42 x41a x42a.\n       \\<lbrakk>e = GT x41 x42; e' = GT x41a x42a\\<rbrakk>\n       \\<Longrightarrow> hn_refine\n            (hn_ctxt A x41 x41a * hn_ctxt B x42 x42a * INVe * F)\n            (f5' x41a x42a)\n            (hn_ctxt A5a' x41 x41a * hn_ctxt B5b' x42 x42a * hn_ctxt XX5 e e' * \\<Gamma>5') R\n            (f5 x41 x42)\"\n    (*\n    assumes E5: \"\\<And>x51 x52 x51a x52a.\n       \\<lbrakk>e = E5 x51 x52; e' = E5 x51a x52a\\<rbrakk>\n       \\<Longrightarrow> hn_refine (hn_ctxt bool_assn x51 x51a * hn_ctxt A x52 x52a * INVe * F) (f5' x51a x52a)\n            (hn_ctxt bool_assn x51 x51a * hn_ctxt A5' x52 x52a * hn_ctxt XX5 e e' * \\<Gamma>5') R (f5 x51 x52)\"\n    *)\n    assumes MERGE1a[unfolded hn_ctxt_def]:\n      \"\\<And>x x'. hn_ctxt A1a' x x' \\<or>\\<^sub>A hn_ctxt A2a' x x' \\<or>\\<^sub>A hn_ctxt A3a' x x' \\<or>\\<^sub>A hn_ctxt A4a' x x' \\<or>\\<^sub>A hn_ctxt A5a' x x' \\<Longrightarrow>\\<^sub>t hn_ctxt A' x x'\"\n    assumes MERGE1b[unfolded hn_ctxt_def]:\n      \"\\<And>x x'. hn_ctxt B1b' x x' \\<or>\\<^sub>A hn_ctxt B2b' x x' \\<or>\\<^sub>A hn_ctxt B3b' x x' \\<or>\\<^sub>A hn_ctxt B4b' x x' \\<or>\\<^sub>A hn_ctxt B5b' x x' \\<Longrightarrow>\\<^sub>t hn_ctxt B' x x'\"\n    assumes MERGE2[unfolded hn_ctxt_def]: \"\\<Gamma>1' \\<or>\\<^sub>A \\<Gamma>2' \\<or>\\<^sub>A \\<Gamma>3' \\<or>\\<^sub>A \\<Gamma>4' \\<or>\\<^sub>A \\<Gamma>5' \\<Longrightarrow>\\<^sub>t \\<Gamma>'\"\n    shows \"hn_refine \\<Gamma> (case_acconstraint f1' f2' f3' f5' f4' e') (hn_ctxt (acconstraint_assn A' B') e e' * \\<Gamma>') R (case_acconstraint$(\\<lambda>\\<^sub>2x y. f1 x y)$(\\<lambda>\\<^sub>2x y. f2 x y)$(\\<lambda>\\<^sub>2x y. f3 x y)$(\\<lambda>\\<^sub>2x y. f5 x y)$(\\<lambda>\\<^sub>2x y. f4 x y)$e)\"\n    \n    apply (rule hn_refine_cons_pre[OF FR])\n    apply1 extract_hnr_invalids\n    apply (cases e; cases e'; simp add: acconstraint_assn.simps[THEN acconstraint_assn_ctxt])\n    subgoal \n      apply (rule hn_refine_cons[OF _ LT _ entt_refl]; assumption?)\n      applyS (simp add: hn_ctxt_def)\n      apply (rule entt_star_mono)\n      apply1 (rule entt_fr_drop)\n      apply (rule entt_star_mono)\n\n      apply1 (rule entt_trans[OF _ MERGE1a])\n      applyS (simp add: hn_ctxt_def entt_disjI1' entt_disjI2')\n\n      apply1 (rule entt_trans[OF _ MERGE1b])\n      applyS (simp add: hn_ctxt_def entt_disjI1' entt_disjI2')\n\n      apply1 (rule entt_trans[OF _ MERGE2])\n      applyS (simp add: entt_disjI1' entt_disjI2')\n    done\n    subgoal \n      apply (rule hn_refine_cons[OF _ LE _ entt_refl]; assumption?)\n      applyS (simp add: hn_ctxt_def)\n      apply (rule entt_star_mono)\n      apply1 (rule entt_fr_drop)\n      apply (rule entt_star_mono)\n\n      apply1 (rule entt_trans[OF _ MERGE1a])\n      applyS (simp add: hn_ctxt_def entt_disjI1' entt_disjI2')\n\n      apply1 (rule entt_trans[OF _ MERGE1b])\n      applyS (simp add: hn_ctxt_def entt_disjI1' entt_disjI2')\n\n      apply1 (rule entt_trans[OF _ MERGE2])\n      applyS (simp add: entt_disjI1' entt_disjI2')\n    done\n    subgoal \n      apply (rule hn_refine_cons[OF _ EQ _ entt_refl]; assumption?)\n      applyS (simp add: hn_ctxt_def)\n      apply (rule entt_star_mono)\n      apply1 (rule entt_fr_drop)\n      apply (rule entt_star_mono)\n\n      apply1 (rule entt_trans[OF _ MERGE1a])\n      applyS (simp add: hn_ctxt_def entt_disjI1' entt_disjI2')\n\n      apply1 (rule entt_trans[OF _ MERGE1b])\n      applyS (simp add: hn_ctxt_def entt_disjI1' entt_disjI2')\n\n      apply1 (rule entt_trans[OF _ MERGE2])\n      applyS (simp add: entt_disjI1' entt_disjI2')\n    done\n    subgoal\n      apply (rule hn_refine_cons[OF _ GT _ entt_refl]; assumption?)\n      applyS (simp add: hn_ctxt_def)\n      apply (rule entt_star_mono)\n      apply1 (rule entt_fr_drop)\n      apply (rule entt_star_mono)\n\n      apply1 (rule entt_trans[OF _ MERGE1a])\n      applyS (simp add: hn_ctxt_def entt_disjI1' entt_disjI2')\n\n      apply1 (rule entt_trans[OF _ MERGE1b])\n      applyS (simp add: hn_ctxt_def entt_disjI1' entt_disjI2')\n\n      apply1 (rule entt_trans[OF _ MERGE2])\n      applyS (simp add: entt_disjI1' entt_disjI2')\n    done\n    subgoal \n      apply (rule hn_refine_cons[OF _ GE _ entt_refl]; assumption?)\n      applyS (simp add: hn_ctxt_def)\n      apply (rule entt_star_mono)\n      apply1 (rule entt_fr_drop)\n      apply (rule entt_star_mono)\n\n      apply1 (rule entt_trans[OF _ MERGE1a])\n      applyS (simp add: hn_ctxt_def entt_disjI1' entt_disjI2')\n\n      apply1 (rule entt_trans[OF _ MERGE1b])\n      applyS (simp add: hn_ctxt_def entt_disjI1' entt_disjI2')\n\n      apply1 (rule entt_trans[OF _ MERGE2])\n      applyS (simp add: entt_disjI1' entt_disjI2')\n    done\n  done\n\n  text \\<open>After some more preprocessing (adding extra frame-rules for non-atomic postconditions, \n    and splitting the merge-terms into binary merges), this rule can be registered\\<close>\n  lemmas [sepref_comb_rules] = acconstraint_cases_hnr[sepref_prep_comb_rule]\n\n  subsection \\<open>Regression Test\\<close>\n(*\n\n  definition \"test \\<equiv> do {\n    let x = E1 True;\n\n    _ \\<leftarrow> case x of\n      E1 _ \\<Rightarrow> RETURN x  (* Access compound inside case *)\n    | _ \\<Rightarrow> RETURN E3;  \n\n    (* Now test with non-pure *)\n    let a = op_array_replicate 4 (3::nat);\n    let x = E5 False a;\n    \n    _ \\<leftarrow> case x of\n      E1 _ \\<Rightarrow> RETURN (0::nat)\n    | E2 _ \\<Rightarrow> RETURN 1\n    | E3 \\<Rightarrow> RETURN 0\n    | E4 _ _ \\<Rightarrow> RETURN 0\n    | E5 _ a \\<Rightarrow> mop_list_get a 0;\n\n    (* Rely on that compound still exists (it's components are only read in the case above) *)\n    case x of\n      E1 a \\<Rightarrow> do {mop_list_set a 0 0; RETURN (0::nat)}\n    | E2 _ \\<Rightarrow> RETURN 1\n    | E3 \\<Rightarrow> RETURN 0\n    | E4 _ _ \\<Rightarrow> RETURN 0\n    | E5 _ _ \\<Rightarrow> RETURN 0\n  }\"\n\n  sepref_definition foo is \"SYNTH (uncurry0 test) (unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a nat_assn)\"      \n    unfolding test_def\n    supply [[goals_limit=1]]\n    by sepref\n*)\n\nend\n", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/TA_Impl/Sepref_Acconstraint.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3171515554997104}}
{"text": "(*  Title:      HOL/Auth/n_moesi.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_moesi Protocol Case Study*} \n\ntheory n_moesi imports n_moesi_lemma_invs_on_rules n_moesi_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/moesi/n_moesi.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160666, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3171515482234447}}
{"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n *  Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory NAND_Hoare_Inert_Typed\n  imports VHDL_Hoare_Typed NAND_Femto\nbegin\n\nsubsection \\<open>Proving @{term \"nand3\"}: NAND with inert delay \\<close>\n\nabbreviation \"bval_of_wline tw sig n \\<equiv> bval_of (wline_of tw sig n)\"\nabbreviation \"lof_wline tw sig n \\<equiv> lval_of (wline_of tw sig n)\"\n\nlocale scalar_type_nand3 =\n  fixes \\<Gamma> :: \"sig tyenv\"\n  assumes \"\\<Gamma> A = Bty\" and \"\\<Gamma> B = Bty\" and \"\\<Gamma> C = Bty\"\nbegin\n\ntext \\<open>Invariant for NAND: at all times @{term \"i\"}, the signal @{term \"C :: sig\"} at @{term \"i\"} \nshould be the NAND value of @{term \"A :: sig\"} and @{term \"B :: sig\"} at time @{term \"i - 1\"}.\\<close>\n\ndefinition nand_inv :: \"sig assn2\" where\n  \"nand_inv \\<equiv> (\\<lambda>tw. bval_of_wline tw C (fst tw) \\<longleftrightarrow> \\<not> (bval_of_wline tw A (fst tw - 1) \\<and> bval_of_wline tw B (fst tw - 1)))\"\n\ndefinition nand_inv2 :: \"sig assn2\" where\n  \"nand_inv2 \\<equiv> (\\<lambda>tw. disjnt {A, B} (event_of tw) \\<longrightarrow> (\\<forall>i > fst tw. bval_of_wline tw C i \\<longleftrightarrow> bval_of_wline tw C (fst tw)))\"\n\nlemma nand_inv_next_time:\n  fixes tw\n  defines \"v \\<equiv> eval_world_raw2 tw (Bnand (Bsig A) (Bsig B))\"\n  defines \"tw' \\<equiv> tw\\<lbrakk>C, 1 :=\\<^sub>2 v\\<rbrakk>\"\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  shows   \"nand_inv (fst tw' + 1, snd tw')\"\nproof -\n  have bexpA: \"bexp_wt \\<Gamma> (Bsig A) Bty\" and bexpB: \"bexp_wt \\<Gamma> (Bsig B) Bty\" \n    using scalar_type_nand3_axioms unfolding scalar_type_nand3_def  by (metis bexp_wt.intros(3))+\n  have \"type_of v = Bty\"\n    using assms(3) bexpA bexpB bexp_wt.intros(9) type_of_eval_world_raw2 v_def by blast\n  hence \"bval_of_wline tw' C (fst tw + 1) \\<longleftrightarrow> bval_of v\"\n    unfolding tw'_def\n  proof (induction v)\n    case (Bv x)\n    have \"snd (snd tw) C (get_time tw) \\<noteq> Bv x \\<and> snd (snd tw) C (get_time tw + 1) = Bv x \\<Longrightarrow> \n          (GREATEST n. n \\<le> get_time tw + 1 \\<and> snd (snd tw) C (n - 1) \\<noteq> Bv x \\<and> snd (snd tw) C n = Bv x) \\<le> fst tw + 1\"\n      by (metis (mono_tags, lifting) GreatestI_ex_nat Suc_eq_plus1 add_diff_cancel_left' order_refl plus_1_eq_Suc)\n    then show ?case \n      unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps worldline_inert_upd_def\n      comp_def snd_conv by auto\n  next\n    case (Lv sign bs)\n    then show ?case\n      by auto\n  qed\n  also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw A (fst tw) \\<and> bval_of_wline tw B (fst tw))\"\n    using eval_world_raw_bv[OF bexpA `wityping \\<Gamma> (snd tw)`]  eval_world_raw_bv[OF bexpB `wityping \\<Gamma> (snd tw)`] \n    unfolding v_def by (auto split:val.split)(metis val.distinct(1))+ \n  finally show ?thesis\n    unfolding nand_inv_def tw'_def worldline_inert_upd2_def worldline_inert_upd_def \n    by (metis (no_types, hide_lams) One_nat_def add_implies_diff comp_def fst_conv not_less_less_Suc_eq not_less_zero order_refl snd_conv snd_worldline_inert_upd2 worldline_inert_upd2_def)\nqed\n\nlemma nand_inv2_next_time:\n  fixes tw v\n  defines \"tw' \\<equiv> tw\\<lbrakk>C, 1 :=\\<^sub>2 v\\<rbrakk>\"\n  shows   \"nand_inv2 (fst tw' + 1, snd tw')\"\nproof -\n  { assume \"disjnt {A, B} (event_of (fst tw' + 1, snd tw'))\"\n    have \"\\<And>j. fst tw + 1 < j \\<Longrightarrow> bval_of_wline tw' C j \\<longleftrightarrow> bval_of_wline tw' C (fst tw + 1)\"\n      unfolding tw'_def \n    proof (induction v)\n      case (Bv x)\n      then show ?case \n      proof (cases \"snd (snd tw) C (get_time tw) = Bv x \\<or> snd (snd tw) C (get_time tw + 1) \\<noteq> Bv x \")\n        case True\n        then show ?thesis \n          using Bv\n          unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps worldline_inert_upd_def\n          comp_def snd_conv by auto\n      next\n        case False\n        hence \"snd (snd tw) C (get_time tw) \\<noteq> Bv x \\<and> snd (snd tw) C (get_time tw + 1) = Bv x\"\n          by auto\n        hence \"(GREATEST n. n \\<le> get_time tw + 1 \\<and> snd (snd tw) C (n - 1) \\<noteq> Bv x \\<and> snd (snd tw) C n = Bv x) = fst tw + 1\"\n          using GreatestI_nat[where k=\"fst tw + 1\"] \n          by (metis (mono_tags, lifting) Greatest_equality Suc_eq_plus1 diff_Suc_1 le_eq_less_or_eq)\n        then show ?thesis\n          using Bv False\n          unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps worldline_inert_upd_def\n          comp_def snd_conv by auto\n      qed\n    next\n      case (Lv sign bs)\n      let ?w' = \"\\<lambda>b. snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)]\"\n      let ?time = \"LEAST n. get_time tw < n \\<and> n \\<le> get_time tw + 1 \\<and> (\\<exists>b\\<in>set [0..<length bs]. ?w' b C (n - 1) \\<noteq> ?w' b C n)\"\n      have *: \" bs = (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..<length bs])\"\n      proof (rule nth_equalityI)\n        show \"length bs = length (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..<length bs])\"\n          by auto\n      next\n        fix b\n        assume \"b < length bs\"\n        hence \"map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..<length bs] ! b = \n              bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))\"\n          by auto\n        have \"((snd (snd tw))(C := to_bit b \\<circ> snd (snd tw) C)) C (get_time tw)  \\<noteq> Bv (bs ! b) \\<and>\n             ((snd (snd tw))(C := to_bit b \\<circ> snd (snd tw) C)) C (get_time tw + 1) = Bv (bs ! b) \\<Longrightarrow> \n            ( GREATEST n.\n                  n \\<le> get_time tw + 1 \\<and>\n                  ((snd (snd tw))(C := to_bit b \\<circ> snd (snd tw) C)) C (n - 1) \\<noteq> Bv (bs ! b) \\<and>\n                  ((snd (snd tw))(C := to_bit b \\<circ> snd (snd tw) C)) C n = Bv (bs ! b)) = fst tw + 1\"\n          by (metis (mono_tags, lifting) Greatest_equality add_diff_cancel_right' le_eq_less_or_eq)\n        hence \"bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1)) = (bs ! b)\"\n          unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv by auto\n        thus \" bs ! b =\n        map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..<length bs] !\n        b \"\n          using \\<open>map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))) [0..<length bs] ! b = bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (fst tw + 1))\\<close> \n          by blast\n      qed\n      have **: \" bs = (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))) [0..<length bs])\"\n      proof (rule nth_equalityI)\n        show \"length bs = length (map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))) [0..<length bs])\"\n          by auto\n      next\n        fix b\n        assume \"b < length bs\"\n        hence \"map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))) [0..<length bs] ! b = \n              bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))\"\n          by auto\n        have \"((snd (snd tw))(C := to_bit b \\<circ> snd (snd tw) C)) C (get_time tw)  \\<noteq> Bv (bs ! b) \\<and>\n             ((snd (snd tw))(C := to_bit b \\<circ> snd (snd tw) C)) C (get_time tw + 1) = Bv (bs ! b) \\<Longrightarrow> \n            ( GREATEST n.\n                  n \\<le> get_time tw + 1 \\<and>\n                  ((snd (snd tw))(C := to_bit b \\<circ> snd (snd tw) C)) C (n - 1) \\<noteq> Bv (bs ! b) \\<and>\n                  ((snd (snd tw))(C := to_bit b \\<circ> snd (snd tw) C)) C n = Bv (bs ! b)) = fst tw + 1\"\n          by (metis (mono_tags, lifting) Greatest_equality add_diff_cancel_right' le_eq_less_or_eq)\n        hence \"bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j)) = (bs ! b)\"\n          unfolding to_worldline_init_bit_def worldline_inert_upd_def snd_conv \n          using Lv by auto\n        thus \" bs ! b =\n        map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))) [0..<length bs] !\n        b \"\n          using \\<open>map (\\<lambda>b. bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))) [0..<length bs] ! b = bval_of (snd to_worldline_init_bit (snd tw) C b[C, get_time tw, 1 := Bv (bs ! b)] C (j))\\<close> \n          by blast\n      qed\n      show ?case \n      proof (cases \"\\<exists>n>get_time tw. n \\<le> get_time tw + 1 \\<and> (\\<exists>b\\<in>set [0..<length bs]. ?w' b C (n - 1) \\<noteq> ?w' b C n)\")\n        case True\n        hence \"?time = fst tw + 1\"\n          by (metis (mono_tags, lifting) LeastI_ex antisym_conv1 discrete leD)\n        hence \"wline_of tw\\<lbrakk> C, 1 :=\\<^sub>2 Lv sign bs\\<rbrakk> C (get_time tw + 1) = Lv sign bs\"\n          using *[THEN sym] True unfolding worldline_inert_upd2_def VHDL_Hoare.worldline_inert_upd2.simps comp_def snd_conv fun_upd_def\n          by auto\n        moreover have \" wline_of tw\\<lbrakk> C, 1 :=\\<^sub>2 Lv sign bs\\<rbrakk> C j =  Lv sign bs\"\n          using Lv True \\<open>?time = fst tw + 1\\<close> **\n          unfolding worldline_inert_upd2_def comp_def snd_conv VHDL_Hoare.worldline_inert_upd2.simps\n            fun_upd_def by auto\n        ultimately show ?thesis\n          by auto\n      next\n        case False\n        then show ?thesis\n          using Lv * **\n          unfolding worldline_inert_upd2_def comp_def snd_conv VHDL_Hoare.worldline_inert_upd2.simps\n          fun_upd_def by auto \n      qed\n    qed }\n    thus \"nand_inv2 (fst tw' + 1, snd tw')\"\n      unfolding nand_inv2_def by (simp add: tw'_def worldline_inert_upd2_def)\nqed\n \nlemma pre_nand_conc_hoare':\n  \"\\<And>tw. nand_inv tw \\<and> nand_inv2 tw \\<and> disjnt {A, B} (event_of tw) \\<Longrightarrow> nand_inv (fst tw + 1, snd tw)\"\nproof -\n  fix tw\n  assume \"nand_inv tw \\<and> nand_inv2 tw \\<and> disjnt {A, B} (event_of tw)\"\n  hence \"nand_inv tw\" and \"nand_inv2 tw\" and \"disjnt {A, B} (event_of tw)\"\n    by auto\n  have \"bval_of_wline tw C (fst tw + 1) \\<longleftrightarrow> bval_of_wline tw C (fst tw)\"\n    using `nand_inv2 tw` `disjnt {A, B} (event_of tw)` unfolding nand_inv2_def \n    by (simp add: next_time_world_at_least) \n  also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw A (fst tw - 1) \\<and> bval_of_wline tw B (fst tw - 1))\"\n    using `nand_inv tw` unfolding nand_inv_def by auto\n  also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw A (fst tw) \\<and> bval_of_wline tw B (fst tw))\"\n    using `disjnt {A, B} (event_of tw)`  unfolding event_of_alt_def \n    by (smt diff_0_eq_0 disjnt_insert1 mem_Collect_eq)\n  finally show \"nand_inv (fst tw + 1, snd tw)\"\n    unfolding nand_inv_def by auto\nqed\n\nlemma nand_conc_hoare2:\n  \"\\<And>tw. nand_inv2 tw \\<and> disjnt {A, B} (event_of tw) \\<Longrightarrow> nand_inv2 (fst tw + 1, snd tw)\"\n  unfolding nand_inv2_def by auto\n\nlemma conc_stmt_wf_nand3:\n  \"conc_stmt_wf nand\"\n  unfolding nand_def conc_stmt_wf_def by auto  \n\nlemma nonneg_delay_conc_nand3:\n  \"nonneg_delay_conc nand\"\n  unfolding nand_def by auto\n\nlemma nonneg_delay_conc_nand3':\n  \"nonneg_delay_conc ( process {A, B} : Bassign_inert C (Bnand (Bsig A) (Bsig B)) 1)\"\n  using nonneg_delay_conc_nand3  by auto\n\nlemma conc_wt_nand3:\n  \"conc_wt \\<Gamma> nand\"\n  unfolding nand_def  by (metis bexp_wt.intros(3) bexp_wt.intros(9) conc_wt.intros(1) scalar_type_nand3_axioms\n  scalar_type_nand3_def seq_wt.intros(5))\n\nlemma conc_wt_nand3':\n  \"conc_wt \\<Gamma> ( process {A, B} : Bassign_inert C (Bnand (Bsig A) (Bsig B)) 1)\"\n  using conc_wt_nand3 unfolding nand_def by auto\n\nlemma nand_conc_sim2':\n  \"\\<Gamma> \\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. nand_inv tw \\<and> nand_inv2 tw\\<rbrace> nand \\<lbrace>\\<lambda>tw. nand_inv tw \\<and> nand_inv2 tw\\<rbrace>\"\n  apply (rule While_Suc)\n  apply (rule Conseq'[where P=\"wp3_conc \\<Gamma> nand (\\<lambda>tw. nand_inv  (fst tw + 1, snd tw) \\<and> \n                                                      nand_inv2 (fst tw + 1, snd tw))\", rotated])\n  apply (rule wp3_conc_is_pre, rule conc_stmt_wf_nand3, rule nonneg_delay_conc_nand3, rule conc_wt_nand3, simp)\n  unfolding nand_def  wp3_conc_single'[OF conc_wt_nand3' nonneg_delay_conc_nand3'] wp3_fun.simps\n  using nand_conc_hoare2 nand_inv2_next_time nand_inv_next_time pre_nand_conc_hoare' by presburger\n\ntext \\<open>Initialisation preserves the invariant\\<close>\n\nlemma seq_wt_nand3':\n  \"seq_wt \\<Gamma> (Bassign_inert C (Bnand (Bsig A) (Bsig B)) 1)\"\n  using conc_wt_nand3' by auto\n\nlemma nonneg_delay_nand3:\n  \" nonneg_delay (Bassign_inert C (Bnand (Bsig A) (Bsig B)) 1)\"\n  using nonneg_delay_conc_nand3' by auto\n\nlemma init_sat_nand_inv_comb:\n  \"init_sim2_hoare_wt \\<Gamma> (\\<lambda>tw. fst tw = 0) nand (\\<lambda>tw. nand_inv tw \\<and> nand_inv2 tw)\"\n  unfolding nand_def\n  apply (rule AssignI_suc, rule SingleI)\n  apply (rule Conseq3[where Q=\"\\<lambda>tw. nand_inv (fst tw + 1, snd tw) \\<and> nand_inv2 (fst tw + 1, snd tw)\", rotated])\n  apply (rule wp3_fun_is_pre[OF seq_wt_nand3' nonneg_delay_nand3], simp)\n  unfolding wp3_fun.simps using nand_inv_next_time nand_inv2_next_time by blast\n\nlemma nand_correctness:\n  assumes \"sim_fin2 w (i + 1) nand tw'\" and \"wityping \\<Gamma> w\"\n  shows \"bval_of_wline tw' C (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw' A i \\<and> bval_of_wline tw' B i)\"\n  using grand_correctness[OF assms conc_stmt_wf_nand3 conc_wt_nand3 nonneg_delay_conc_nand3 nand_conc_sim2' init_sat_nand_inv_comb]\n  unfolding nand_inv_def by (metis (no_types, lifting) add_diff_cancel_right' assms(1)\n  sim_fin2.cases world_maxtime_lt_fst_tres)\n\nend", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/NAND_Hoare_Inert_Typed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199008363969, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.3171515390668662}}
{"text": "theory Debt_Axiom_Doc\n  imports Main Debt_Axiom.Debt_Axiom\nbegin\n\nsection \\<open>Introduction over an Example\\<close>\n\ntext \\<open>Debt Axiom provides an approach to safely declare an axiom early, build anything above\n  the axiom, and later prove the validity of the previously declared axiom.\n  The declared axioms are not free, but require certificates later.\n  They are recorded in a ledger so we name them, \\<^emph>\\<open>debt axioms\\<close>.\n  A ML kernel validates the certificate and especially it does not depend on\n  any declared debt axioms, so the certification is valid and it is a safe way to declare axioms.\n  The ML kernel is tiny, consisting of 30 lines of code only, and depending only on\n  Isabelle's kernel.\n\n  It resembles Locale which enables local assumptions, but we do not use locales and they are\n  real axioms, so we circumvent the limitations of Locale like incomplete supports for some\n  Isabelle functions like syntax translation, and complexity of multi-dependence especially\n  when the hierarchy is complicated, and also performance cost during activating a huge locale\n  when using @{command context} command and \\<open>(in locale)\\<close> syntax.\n\n  An example usage of the library is building an extensible modular semantic library, where\n  we pre-build small snippets each of which formalizes a specific semantic feature,\n  and we assemble the snippets of all the semantic features of a target language\n  when we are going to formalize it.\n  Each snippet can be an Isabelle theory and in the final assembly we import only the features that\n  the target language needs.\n\n  If we follow a deep embedding approach where two semantic types are used to model the type\n    and the value of the language respectively, note,\n  in such a generic library supporting free plug-in of various semantic features,\n  the actual definition of the semantic types cannot be decided until the final target language\n  to be formalized is given, because the complete semantic features are not decided until\n  that time.\n\n\n  However, if we want the library to be really useful by providing some reasoning supports and\n    automatic mechanisms, we do need first the declarations of the semantic types,\n    and partial definition about the semantic feature concerned by the module,\n    so that we can provide some mechanisms for the feature.\n\n  The Debt Axiom package addresses\n  The tour starts from declaring semantic types used in our library to model the type\n    and the value of the language respectively.\n\n  Therefore, we just \\<^emph>\\<open>declare\\<close> the types in an \\<^emph>\\<open>unspecified\\<close> way.\n\\<close>\n\nunspecified_type VAL\n\ntext \\<open>They are unspecified meaning they are just declared but not finally defined.\nThe definition can be given later after the final target language is given and decides\nthe complete target semantic features.\n\nWe continue declare some basic infrastructure in the formalization.\n\\<open>typ_of\\<close> give the type of a\n\\<close>\n\n\ntext \\<open>Then we build a semantic module for integer value and its arithmetic.\nIn a new theory file for this feature, we declare the constructor of the integer model and also\nits destructor.\n\\<close>\n\ndebt_axiomatization mk_int :: \\<open>int \\<Rightarrow> VAL\\<close>\n               and dest_int :: \\<open>VAL \\<Rightarrow> int\\<close>\n              where mk_int_inj[simp]: \\<open>dest_int (mk_int i) = i\\<close>\n\ntext \\<open>\\<open>dest_int\\<close> should be the inverse function of \\<open>mk_int\\<close>. We declare this property by a debt\n  axiom, and require the final semantic assembly to discharge the proof of the axiom.\n  The @{command print_debt_axiom} now lists \\<open>dest_int\\<close> as an obligation debt.\n\\<close>\n\nprint_debt_axiom\n  \\<comment> \\<open>\\<open>\\<And>i. dest_int (mk_int i) = i\\<close>\\<close>\n\ntext \\<open>Formalization of instructions and various automation can be built above the semantic models.\\<close>\n\ndefinition \\<open>op_add va vb = mk_int (dest_int va + dest_int vb)\\<close>\n\nlemma \\<open>op_add (mk_int (1::int)) (op_add (mk_int 2) (mk_int 3)) = mk_int 6\\<close>\n  unfolding op_add_def by simp\n\ntext \\<open>Meantime, we may formalize array in another theory file.\\<close>\n\ndebt_axiomatization mk_array :: \\<open>VAL list \\<Rightarrow> VAL\\<close>\n              and dest_array :: \\<open>VAL \\<Rightarrow> VAL list\\<close>\n  where mk_array_inj[simp]: \\<open>dest_array (mk_array x) = x\\<close>\n\ndefinition \\<open>op_push v vL = mk_array (v # dest_array vL)\\<close>\ndefinition \\<open>op_peek vL = hd (dest_array vL)\\<close>\ndefinition \\<open>op_pop  vL = mk_array (tl (dest_array vL))\\<close>\n\nlemma \\<open>op_peek (op_push v L) = v\\<close>\n  unfolding op_peek_def op_push_def by simp\n\ntext \\<open>Now in the final theory file assembling the semantic modules,\n  we instantiate the unspecified constants and discharge the debt axioms.\\<close>\n\ndatatype val = V_int (dest_V_int: int) | V_array (dest_V_array: \\<open>val list\\<close>)\n\nspecify_type VAL[simp]: VAL = val\n\nprint_debt_axiom\n\nspecification (mk_int dest_int mk_array dest_array)\n  mk_int_def': \\<open>mk_int = VAL.inj o V_int\\<close>\n  dest_int_def': \\<open>dest_int = dest_V_int o VAL.prj\\<close>\n  mk_array_def': \\<open>mk_array = VAL.inj o V_array o map VAL.prj\\<close>\n  dest_array_def': \\<open>dest_array = map VAL.inj o dest_V_array o VAL.prj\\<close>\n  by auto\n\nlemma mk_int_inj': \\<open>dest_int (mk_int i) = i\\<close>\n  unfolding mk_int_def' dest_int_def' by simp\n\n\n\nlemma mk_array_inj': \\<open>dest_array (mk_array x) = x\\<close>\n  unfolding mk_array_def' dest_array_def' by simp\n\ndischarge_debt_axiom mk_int_inj : mk_int_inj'\n  and mk_array_inj : mk_array_inj'\n\nprint_debt_axiom \\<comment> \\<open>Good job! No debt axiom is recorded.\\<close>\n\n\ntext \\<open>It rejects impredicativeness properly thanking to the circular dependence checking by\n  Isabelle's kernel.\\<close>\n\nend", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Debt_Axiom/example/Debt_Axiom_Doc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5926665855647395, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.31713495863519137}}
{"text": "theory CFGExit_wf imports CFGExit CFG_wf begin\n\nsubsection {* New well-formedness lemmas using @{text \"(_Exit_)\"} *}\n\nlocale CFGExit_wf = CFGExit sourcenode targetnode kind valid_edge Entry \n    get_proc get_return_edges procs Main Exit +\n  CFG_wf sourcenode targetnode kind valid_edge Entry \n    get_proc get_return_edges procs Main Def Use ParamDefs ParamUses\n  for sourcenode :: \"'edge \\<Rightarrow> 'node\" and targetnode :: \"'edge \\<Rightarrow> 'node\"\n  and kind :: \"'edge \\<Rightarrow> ('var,'val,'ret,'pname) edge_kind\" \n  and valid_edge :: \"'edge \\<Rightarrow> bool\"\n  and Entry :: \"'node\" (\"'('_Entry'_')\")  and get_proc :: \"'node \\<Rightarrow> 'pname\"\n  and get_return_edges :: \"'edge \\<Rightarrow> 'edge set\"\n  and procs :: \"('pname \\<times> 'var list \\<times> 'var list) list\" and Main :: \"'pname\"\n  and Exit::\"'node\"  (\"'('_Exit'_')\") \n  and Def :: \"'node \\<Rightarrow> 'var set\" and Use :: \"'node \\<Rightarrow> 'var set\"\n  and ParamDefs :: \"'node \\<Rightarrow> 'var list\" \n  and ParamUses :: \"'node \\<Rightarrow> 'var set list\" +\n  assumes Exit_empty:\"Def (_Exit_) = {} \\<and> Use (_Exit_) = {}\"\n\nbegin\n\nlemma Exit_Use_empty [dest!]: \"V \\<in> Use (_Exit_) \\<Longrightarrow> False\"\nby(simp add:Exit_empty)\n\nlemma Exit_Def_empty [dest!]: \"V \\<in> Def (_Exit_) \\<Longrightarrow> False\"\nby(simp add:Exit_empty)\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/HRB-Slicing/StaticInter/CFGExit_wf.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3170799541460573}}
{"text": "theory ExclLemma\n  imports SafeRedCV ProcCVars ProcDef\nbegin\n  \ndefinition can_access where\n  \"can_access e x = (x \\<in> ref_vars e)\"\n  \n  (*thm proper_exp_def*)\n  \nlemma well_typed_deref_ex: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; x \\<notin> free_vars e; x \\<in> ref_vars e \\<rbrakk> \\<Longrightarrow> (\\<exists> z. (z, x) \\<in> deref_pairs e)\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n         apply (case_tac x2a)\n           apply (auto)\n    (* pair case. *)\n        apply (blast)\n       apply (blast)\n    (* if case. *)\n      apply (blast)\n     apply (blast)\n    apply (blast)\n    (* lam case. *)\n   apply (blast)\n    (* app case. *)\n  apply (blast)\n  done\n \nlemma well_typed_deref_ref_use: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; (x, y) \\<in> deref_pairs e \\<rbrakk> \\<Longrightarrow> x \\<in> ref_vars e\"     \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n      apply (case_tac x2a)\n        apply (auto)\n    (* other cases. *)  \n     apply (blast)\n    apply (blast)\n   apply (blast)\n  apply (blast)\n  done\n    \nlemma well_typed_deref_npv_use: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; (x, y) \\<in> deref_pairs e \\<rbrakk> \\<Longrightarrow> x \\<in> non_prim_vars env e\"  \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n          apply (case_tac x2a)\n            apply (auto)\n          apply (simp add: non_prim_vars_def)\n          apply (simp add: non_prim_entry_def)\n          apply (cut_tac tau_x=\"tau_x\" in var_value_unlim)\n            apply (auto)\n    (* other cases. *)\n         apply (simp add: non_prim_vars_def)\n        apply (simp add: non_prim_vars_def)\n       apply (simp add: non_prim_vars_def)\n      apply (simp add: non_prim_vars_def)\n     apply (simp add: non_prim_vars_def)\n    apply (simp add: non_prim_vars_def)\n    (* lam case *)\n    apply (case_tac \"x = x1a\")\n     apply (cut_tac e=\"e\" and x=\"x\" and env=\"add_env env x1a t1\" in well_typed_deref_ref_use)\n       apply (auto)\n    apply (simp add: non_prim_entry_def)\n    apply (case_tac \"\\<exists> t. add_env env x1a t1 x = Some t \\<and> req_type t \\<noteq> Prim\")\n     apply (simp add: add_env_def)\n    apply (auto)\n    (* app case *)\n   apply (simp add: non_prim_vars_def)\n  apply (simp add: non_prim_vars_def)\n  done\n    \nfun in_path where\n  \"in_path x [] = False\"\n| \"in_path x (y # t) = (x = y \\<or> in_path x t)\"  \n  \n  \n    (* if x \\<leadsto> z and y \\<leadsto> z, and x is in the path from y \\<leadsto> z, then y \\<leadsto> a \\<leadsto> x \\<leadsto> z *)\nlemma path_lookup_cross_ih: \"\\<lbrakk> path_lookup rs_map x l z; in_path x m; path_lookup rs_map y m z \\<rbrakk> \\<Longrightarrow>\n  (\\<exists> a m'. path_lookup rs_map y m' a \\<and> nres_lookup rs_map a x \\<noteq> NoPerm \\<and> path_lookup rs_map x l z \\<and> (a = y \\<or> in_path a m))\"\n  apply (induct m arbitrary: y)  \n   apply (auto)\n    (* case where x = a (the top of the path) *)\n   apply (case_tac \"rs_map y\")\n    apply (auto)\n   apply (rule_tac x=\"y\" in exI)\n   apply (auto)\n    apply (rule_tac x=\"[]\" in exI)\n    apply (simp)\n   apply (simp add: nres_lookup_def)\n    (* inductive case *)\n  apply (case_tac \"rs_map y\")\n   apply (auto)\n  apply (case_tac \"\\<exists>b. (\\<exists>m'. path_lookup rs_map a m' b) \\<and> nres_lookup rs_map b x \\<noteq> NoPerm \\<and> (b = a \\<or> in_path b m)\")\n   apply (erule_tac exE)\n   apply (auto)\n   apply (rule_tac x=\"a\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"[a]\" in exI)\n   apply (auto)\n  apply (rule_tac x=\"b\" in exI)\n  apply (auto)\n   apply (rule_tac x=\"a # m'\" in exI)\n  apply (auto)\n  done\n    \nlemma lookup_in_path: \"\\<lbrakk> in_path z l; path_lookup rs_map x l y \\<rbrakk> \\<Longrightarrow> (\\<exists> a. nres_lookup rs_map a z \\<noteq> NoPerm)\"    \n  apply (induct l arbitrary: x)\n   apply (auto)\n   apply (case_tac \"rs_map x\")\n    apply (auto)\n   apply (simp add: nres_lookup_def)\n   apply (rule_tac x=\"x\" in exI)\n   apply (auto)\n  apply (case_tac \"rs_map x\")\n   apply (auto)\n  done\n  \nlemma end_in_path: \"\\<lbrakk> x \\<noteq> y; path_lookup rs_map x l y \\<rbrakk> \\<Longrightarrow> in_path y l\"    \n  apply (induct l arbitrary: x)\n   apply (auto)\n  apply (case_tac \"rs_map x\")\n   apply (auto)\n  apply (case_tac \"a = y\")\n   apply (auto)\n  done\n    \n    (* if x \\<leadsto> z and y \\<leadsto> z, then x \\<leadsto> a \\<leadsto> c \\<leadsto> z, and y \\<leadsto> b \\<leadsto> c \\<leadsto> z, a \\<noteq> b *)\nlemma path_lookup_cross: \"\\<lbrakk> x \\<noteq> y; \\<not> in_path x m; \\<not> in_path y l; path_lookup rs_map x l z; path_lookup rs_map y m z \\<rbrakk> \\<Longrightarrow>\n  (\\<exists> a b c l' m' lx. a \\<noteq> b \\<and> path_lookup rs_map x l' a \\<and> path_lookup rs_map y m' b \\<and>\n    nres_lookup rs_map a c \\<noteq> NoPerm \\<and> nres_lookup rs_map b c \\<noteq> NoPerm \\<and> path_lookup rs_map c lx z)\"\n    (* we induct over the l, attempting to apply the induction lemma, when x is in_path m *)\n  apply (induct l arbitrary: x)\n   apply (auto)\n    (* empty list case is impossible, since z must be in m *)\n   apply (cut_tac y=\"z\" and l=\"m\" in end_in_path)\n     apply (auto)\n  apply (case_tac \"rs_map x\")\n   apply (auto)\n    (* if a is in_path m, by lemma we can get y \\<leadsto> ? \\<leadsto> a \\<leadsto> z. we can select x \\<leadsto> x \\<leadsto> a \\<leadsto> z, y \\<leadsto> ? \\<leadsto> a \\<leadsto> z *)\n  apply (case_tac \"in_path a m\")\n   apply (case_tac \"\\<not> (\\<exists>aa m'. path_lookup rs_map y m' aa \\<and> nres_lookup rs_map aa a \\<noteq> NoPerm \\<and> path_lookup rs_map a l z \\<and> (aa \\<noteq> x))\")\n    apply (cut_tac x=\"a\" and rs_map=\"rs_map\" and l=\"l\" and y=\"y\" and z=\"z\" and m=\"m\" in path_lookup_cross_ih)\n       apply (auto)\n   apply (rule_tac x=\"x\" in exI)\n   apply (rule_tac x=\"aaa\" in exI)\n   apply (auto)\n    apply (rule_tac x=\"[]\" in exI)\n    apply (auto)\n   apply (rule_tac x=\"a\" in exI)\n   apply (simp add: nres_lookup_def)\n   apply (case_tac \"rs_map aaa\")\n    apply (auto)\n    (* otherwise, we can induct. *)\n  apply (case_tac \"\\<exists>a' b. a' \\<noteq> b \\<and> (\\<exists>l'. path_lookup rs_map a l' a') \\<and>\n                          (\\<exists>m'. path_lookup rs_map y m' b) \\<and>\n                          (\\<exists>c. nres_lookup rs_map a' c \\<noteq> NoPerm \\<and> nres_lookup rs_map b c \\<noteq> NoPerm \\<and> (\\<exists>lx. path_lookup rs_map c lx z))\")\n   apply (erule_tac exE)\n   apply (auto)\n    (* - we take x \\<leadsto> a' \\<leadsto> c \\<leadsto> z, y \\<leadsto> b \\<leadsto> c \\<leadsto> z *)\n  apply (rule_tac x=\"a'\" in exI)\n  apply (rule_tac x=\"b\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"a # l'\" in exI)\n  apply (auto)\n  done\n    \nlemma wts_excl_dom_use_env: \"\\<lbrakk> well_typed_system env rs_map p_map s p_set; u \\<noteq> v; p_set u = Some e; p_set v = Some e';\n  p_map u = Some r_sa; p_map v = Some r_sb; well_typed env r_sa e UnitTy r_se r_xe; well_typed env r_sb e' UnitTy r_se' r_xe' \\<rbrakk> \\<Longrightarrow>\n  strong_disj_use_env (full_dom_use_env env rs_map e) (full_dom_use_env env rs_map e')\"\n    (* if this is not true, there is some z \\<leadsto> x, za \\<leadsto> x *)\n  apply (simp add: strong_disj_use_env_def)\n  apply (auto)\n  apply (simp add: full_dom_use_env_def)\n  apply (simp add: dom_use_env_def)\n  apply (case_tac \"\\<exists>l z. z \\<in> non_prim_vars env e' \\<and> path_lookup rs_map z l x\")\n   apply (auto)\n    (* we can establish r_sa za \\<noteq> None, and r_sb z \\<noteq> None *)\n  apply (case_tac \"r_sa za = NoPerm\")\n   apply (cut_tac x=\"za\" and ?r_s1.0=\"r_sa\" and e=\"e\" in well_typed_no_npv_use)\n     apply (auto)\n  apply (case_tac \"r_sb z = NoPerm\")    \n   apply (cut_tac x=\"z\" and ?r_s1.0=\"r_sb\" and e=\"e'\" in well_typed_no_npv_use)\n     apply (auto)\n    (* if z = za, we have a contradiction by map exclusion. *)\n  apply (case_tac \"z = za\")\n   apply (case_tac \"\\<not> disj_nres_map p_map\")\n    apply (simp add: well_typed_system_def)\n    apply (simp add: well_typed_proc_set_def)\n   apply (simp add: disj_nres_map_def)\n   apply (erule_tac x=\"u\" in allE)\n   apply (erule_tac x=\"v\" in allE)\n   apply (auto)\n   apply (simp add: strong_disj_use_env_def)\n   apply (erule_tac x=\"za\" in allE)\n   apply (simp add: nres_lookup_def)\n    (* if za is in l, we have a contradiction by map separation. *)\n  apply (case_tac \"in_path za l\")\n   apply (simp add: well_typed_system_def)\n   apply (auto)\n   apply (erule_tac x=\"u\" in allE)\n   apply (auto)\n   apply (cut_tac rs_map=\"rs_map\" and z=\"za\" and l=\"l\" in lookup_in_path)\n     apply (auto)\n   apply (simp add: sep_nres_map_def)\n   apply (erule_tac x=\"a\" in allE)\n   apply (simp add: strong_disj_use_env_def)\n   apply (erule_tac x=\"za\" in allE)\n   apply (auto)\n    (* similarly, we can show z is not in la *)\n  apply (case_tac \"in_path z la\")\n   apply (simp add: well_typed_system_def)\n   apply (auto)\n   apply (erule_tac x=\"v\" in allE)\n   apply (auto)\n   apply (cut_tac rs_map=\"rs_map\" and z=\"z\" and l=\"la\" in lookup_in_path)\n     apply (auto)\n   apply (simp add: sep_nres_map_def)\n   apply (erule_tac x=\"a\" in allE)\n   apply (simp add: strong_disj_use_env_def)\n   apply (erule_tac x=\"z\" in allE)\n   apply (auto)\n    (* otherwise we should be able to find a, b, c where z \\<leadsto> a \\<leadsto> c \\<leadsto> x and za \\<leadsto> b \\<leadsto> c \\<leadsto> x*)\n  apply (cut_tac rs_map=\"rs_map\" and x=\"z\" and y=\"za\" and z=\"x\" in path_lookup_cross)\n       apply (auto)\n    (* this is a contradiction by res map exclusion on the maps of a + b containing c *)\n  apply (case_tac \"\\<not> disj_nres_map rs_map\")\n   apply (simp add: well_typed_system_def)\n   apply (simp add: well_typed_state_def)\n   apply (simp add: valid_nres_map_def)\n  apply (simp add: disj_nres_map_def)\n  apply (erule_tac x=\"a\" in allE)\n  apply (erule_tac x=\"b\" in allE)\n  apply (auto)\n  apply (simp add: strong_disj_use_env_def)\n  apply (erule_tac x=\"c\" in allE)\n  apply (auto)\n  done\n    \n    \nlemma well_typed_no_dom_use: \"\\<lbrakk> well_typed_state s env rs_map; p_set u = Some e; p_map u = Some r_s;\n  well_typed env r_s e UnitTy r_se r_xe; x \\<in> ref_vars e; proper_exp rs_map e \\<rbrakk> \\<Longrightarrow> full_dom_use_env env rs_map e x \\<noteq> NoPerm\"\n    (* free_var case. in this case it is in the dominator since it is non-prim *)\n  apply (case_tac \"x \\<in> free_vars e\")\n   apply (case_tac \"env x = None\")\n    apply (cut_tac env=\"env\" and x=\"x\" and e=\"e\" in well_typed_fv_env_use)\n      apply (auto)\n   apply (case_tac \"x \\<notin> non_prim_vars env e\")\n    apply (cut_tac s=\"s\" and env=\"env\" and rs_map=\"rs_map\" in wts_mem_val_env)\n     apply (simp)\n    apply (simp add: mem_val_env_def)\n    apply (erule_tac x=\"x\" in allE)\n    apply (auto)\n    apply (simp add: non_prim_vars_def)\n    apply (simp add: non_prim_entry_def)\n    apply (case_tac y)\n          apply (auto)\n   apply (simp add: full_dom_use_env_def)\n   apply (simp add: dom_use_env_def)\n   apply (case_tac \"\\<exists> l z. z \\<in> non_prim_vars env e \\<and> path_lookup rs_map z l x\")\n    apply (auto)\n   apply (erule_tac x=\"[]\" in allE)\n   apply (erule_tac x=\"x\" in allE)\n   apply (auto)\n    (* otherwise, we presume that it has an owner with permissions in r_s. since e is proper, there is a lookup between them *)\n  apply (cut_tac x=\"x\" and e=\"e\" in well_typed_deref_ex)\n     apply (auto)\n  apply (simp add: proper_exp_def)\n  apply (erule_tac x=\"z\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (simp add: full_dom_use_env_def)\n  apply (simp add: dom_use_env_def)\n  apply (case_tac \"\\<exists> l z. z \\<in> non_prim_vars env e \\<and> path_lookup rs_map z l x\")\n   apply (auto)\n  apply (erule_tac x=\"l\" in allE)\n  apply (erule_tac x=\"z\" in allE)\n  apply (auto)\n  apply (cut_tac x=\"z\" and y=\"x\" and e=\"e\" in well_typed_deref_npv_use)\n    apply (auto)\n  done\n    \nlemma excl_safe_lemma: \"\\<lbrakk> well_typed_system env rs_map p_map s p_set; p_set u = Some e; can_access e x;\n  p_set v = Some e'; u \\<noteq> v \\<rbrakk> \\<Longrightarrow> \\<not> can_access e' x\"\n    (* prelim: p_map u + v has an entry *)\n  apply (case_tac \"p_map u = None \\<or> p_map v = None\")\n   apply (simp add: well_typed_system_def)\n   apply (simp add: well_typed_proc_set_def)\n   apply (simp add: full_nres_map_def)\n   apply (auto)\n    apply (erule_tac x=\"u\" in allE)\n    apply (auto)\n   apply (erule_tac x=\"v\" in allE)\n   apply (auto)\n    (* prelim: e must be well-typed + proper *)\n  apply (case_tac \"\\<not> (\\<exists> r_s rx. well_typed env y e UnitTy r_s rx \\<and> proper_exp rs_map e)\")\n   apply (simp add: well_typed_system_def)\n   apply (simp add: well_typed_proc_set_def)\n   apply (auto)\n    apply (erule_tac x=\"u\" in allE)\n    apply (auto)\n   apply (erule_tac x=\"u\" in allE)\n   apply (auto)\n    (* prelim: e' is also well-typed + proper *)\n  apply (case_tac \"\\<not> (\\<exists> r_s rx. well_typed env ya e' UnitTy r_s rx \\<and> proper_exp rs_map e')\")\n   apply (simp add: well_typed_system_def)\n   apply (simp add: well_typed_proc_set_def)\n   apply (auto)\n    apply (erule_tac x=\"v\" in allE)\n    apply (auto)\n   apply (erule_tac x=\"v\" in allE)\n   apply (auto)\n    (* from here, we know that x is in the completion of y + ya *)\n  apply (cut_tac env=\"env\" and rs_map=\"rs_map\" and e=\"e\" and x=\"x\" and r_s=\"y\" and s=\"s\" in well_typed_no_dom_use)\n        apply (auto)\n    apply (simp add: well_typed_system_def)\n   apply (simp add: can_access_def)\n  apply (cut_tac env=\"env\" and rs_map=\"rs_map\" and e=\"e'\" and x=\"x\" and r_s=\"ya\" and s=\"s\" in well_typed_no_dom_use)\n        apply (auto)\n    apply (simp add: well_typed_system_def)\n   apply (simp add: can_access_def)\n    (* this is a contradiction by dominator exlcusion *)\n  apply (cut_tac env=\"env\" and rs_map=\"rs_map\" and e=\"e\" and e'=\"e'\" and u=\"u\" and v=\"v\" and p_map=\"p_map\" and s=\"s\" and\n      p_set=\"p_set\" in wts_excl_dom_use_env)\n          apply (auto)\n  apply (simp add: strong_disj_use_env_def)\n  apply (auto)\n  done\n    \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/ExclLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3170799541460573}}
{"text": "(* Title: thys/TuringUnComputable_H2.thy\n   Author: Jian Xu, Xingyuan Zhang, and Christian Urban\n   Modifications: Sebastiaan Joosten\n \n   Further contributions and enhancements by Franz Regensburger (FABR) 02/2022 :\n\n   - Splitted and reordered theory file Uncomputable.thy into\n     several smaller theory files.\n\n   - Completed the proof of the undecidability of the Halting problem H2.\n\n     The original version by Jian Xu, Xingyuan Zhang, and Christian Urban\n     only formalizes a weaker version of the undecidability result.\n     Their formalization just shows that the set H2 is not\n     decidable by any composable (aka well-formed) Turing machine.\n\n     However, the set H2 might be decidable by some none composable TM.\n     We close this gap in the following and show that no Turing machine,\n     may it be composable or not, is able to decide the set H2.\n\n   - Corrected the presentation of the theory.\n\n     The entire hierarchy of theories formalized in HOL is based on the\n     principle of Conservative Theory Extension.\n\n     One major law of this principle is that for every locale there must be at least\n     one instance proof in order to ensure that the locale is inhabited (has models).\n\n     The original version of the theory TuringUnComputable_H2 intentionally used\n     locale axioms that have no model.\n     There is not a single valid reason to justify this miss-use of the locale concept!\n\n     In our version, we present the theory in accordance with the principle of\n     Conservative Theory Extension.\n *)\n\nsubsection \\<open>Existence of an uncomputable Function\\<close>\n\ntheory TuringUnComputable_H2\n  imports\n     CopyTM\n     DitherTM\n\nbegin\n\n(*\ndeclare adjust.simps[simp del]\n\ndeclare seq_tm.simps [simp del] \ndeclare shift.simps[simp del]\ndeclare composable_tm.simps[simp del]\ndeclare step.simps[simp del]\ndeclare steps.simps[simp del]\n*)\n\nsubsubsection \\<open>Undecidability of the General Halting Problem H, Variant 2, revised version\\<close>\n\ntext \\<open>\n  This variant of the decision problem H is discussed in the book\n  Computability and Logic by Boolos, Burgess and Jeffrey~\\<^cite>\\<open>\"Boolos07\"\\<close> in chapter 4.\n\n  The proof makes use of the TMs @{term \"tm_copy\"} and @{term \"tm_dither\"}.\n  In \\<^cite>\\<open>\"Boolos07\"\\<close>, the machines are called {\\em copy} and {\\em dither}.\n\\<close>\n\nfun dummy_code :: \"tprog0 \\<Rightarrow> nat\"  (* the witness for the instantiation of class hph2 *)\n  where \"dummy_code tp = 0\"\n\nlocale hph2 = \n\n  (* Interestingly, the detailed definition of the coding function @{text \"code\"}\n     for Turing machines does not affect the final result.\n\n     In the proof there is no need to appeal on properties of the coding function\n     like e.g. injectivity! *)\n\nfixes code :: \"instr list \\<Rightarrow> nat\" \n\n(* FABR Note about the old formalization:\n\n    * The first axiom states that the Turing machine H is well-formed (composable).\n    * However, this manifests a principle weakness of the old modelling of the locale!\n    *\n    * Due to this locale axiom, we only prove that there exists no composable TM H\n    * that is able to decide the Halting problem 'TMC_has_num_res M ns'\n    *\n    * See theories ComposableTMs.thy and HaltingProblems_K_H.thy for a fix by FABR.\n\n    These are the old locale axioms, which we do not use any longer.\n\n    assumes h_composable[intro]: \"composable_tm0 H\"\n\n    and h_case:\n    \"\\<And> M ns.  TMC_has_num_res M ns\n        \\<Longrightarrow> \\<lbrace>(\\<lambda>tap. tap = ([Bk], <(code M, ns)>))\\<rbrace> H \\<lbrace>(\\<lambda>tap. \\<exists>k. tap = (Bk \\<up> k, <0::nat>))\\<rbrace>\"\n\n    and nh_case:\n    \"\\<And> M ns. \\<not>  TMC_has_num_res M ns \n     \\<Longrightarrow> \\<lbrace>(\\<lambda>tap. tap = ([Bk], <(code M, ns)>))\\<rbrace> H \\<lbrace>(\\<lambda>tap. \\<exists>k. tap = (Bk \\<up> k, <1::nat>))\\<rbrace>\"\n\n    An additional weakness of these locale axioms are the post-conditions used:\n\n    \\<lbrace>(\\<lambda>tap. \\<exists>k. tap = (Bk \\<up> k, <0::nat>))\\<rbrace>\"\n    \\<lbrace>(\\<lambda>tap. \\<exists>k. tap = (Bk \\<up> k, <1::nat>))\\<rbrace>\"\n\n    These need to be relaxed into: \n\n    \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, <0::nat> @Bk\\<up>l)\\<rbrace>)\n    \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, <1::nat> @Bk\\<up>l)\\<rbrace>)\n\n    Otherwise, there might simply be no TM that is able to compute just the output\n    <0::nat> or <1:nat> without any further trailing blanks.\n\n*)\n\nbegin\n\ntext \\<open>The function @{term dummy_code} is a witness that the locale hph2 is inhabited.\n\nNote: there just has to be some function with the correct type since we did not\nspecify any axioms for the locale. The behaviour of the instance of the locale\nfunction code does not matter at all.\n\nThis detail differs from the locale hpk, where a locale axiom specifies that the\ncoding function has to be injective.\n\nObviously, the entire logical argument of the undecidability proof H2\nrelies on the combination of the machines @{term \"tm_copy\"} and @{term \"tm_dither\"}.\n\\<close>\n \ninterpretation dummy_code: hph2 \"dummy_code :: tprog0 \\<Rightarrow> nat\"\nproof unfold_locales\nqed\n\ntext \\<open>The next lemma plays a crucial role in the proof by contradiction.\nDue to our general results about trailing blanks on the left tape,\nwe are able to compensate for the additional blank, which is a mandatory\nby-product of the @{term \"tm_copy\"}.\n\\<close>\n\nlemma add_single_BK_to_left_tape:\n  \"\\<lbrace>\\<lambda>tap. tap = ([]  , <(m::nat, m)> ) \\<rbrace> p \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, r' @Bk\\<up>l )\\<rbrace>\n  \\<Longrightarrow>\n   \\<lbrace>\\<lambda>tap. tap = ([Bk], <(m     , m)> ) \\<rbrace> p \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, r' @Bk\\<up>l )\\<rbrace>\"\nproof -\n  assume    \"\\<lbrace>\\<lambda>tap. tap = ([], <(m::nat, m)> ) \\<rbrace> p \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, r' @Bk\\<up>l)\\<rbrace>\"\n  then have  \"\\<forall>z.\\<lbrace>\\<lambda>tap. tap = (Bk \\<up> z, <(m::nat, m)> ) \\<rbrace> p \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, r' @Bk\\<up>l)\\<rbrace>\"\n    using Hoare_halt_add_Bks_left_tape_L1 Hoare_halt_add_Bks_left_tape  by blast\n  then have  \"\\<lbrace>\\<lambda>tap. tap = (Bk \\<up> 1, <(m::nat, m)> ) \\<rbrace> p \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, r' @Bk\\<up>l)\\<rbrace>\"\n    by blast\n  then show ?thesis\n    by (simp add: Hoare_haltE Hoare_haltI)\nqed\n \ntext \\<open>Definition of the General Halting Problem H2.\\<close>\n\ndefinition H2 :: \"((instr list) \\<times> (nat list)) set\"  (* behold the type of the set *)\n  where\n     \"H2 \\<equiv> {(tm,nl). TMC_has_num_res tm nl }\"\n\ntext \\<open>No Turing Machine is able to decide the General Halting Problem H2.\\<close>\n\nlemma existence_of_decider_H2D0_for_H2_imp_False:\n  assumes \"\\<exists>H2D0'. (\\<forall>nl (tm::instr list).\n          ((tm,nl) \\<in> H2 \\<longrightarrow>\\<lbrace>\\<lambda>tap. tap = ([], <(code tm, nl)>)\\<rbrace> H2D0' \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc] @ Bk\\<up>l)\\<rbrace>)\n       \\<and>  ((tm,nl) \\<notin> H2 \\<longrightarrow>\\<lbrace>\\<lambda>tap. tap = ([], <(code tm, nl)>)\\<rbrace> H2D0' \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc, Oc] @Bk\\<up>l)\\<rbrace>) )\"\n  shows False\nproof -\n  from assms obtain H2D0' where\n    w_H2D0': \"(\\<forall>nl (tm::instr list).\n          ((tm,nl) \\<in> H2 \\<longrightarrow>\\<lbrace>\\<lambda>tap. tap = ([], <(code tm, nl)>)\\<rbrace> H2D0' \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc] @Bk\\<up>l)\\<rbrace>)\n       \\<and>  ((tm,nl) \\<notin> H2 \\<longrightarrow>\\<lbrace>\\<lambda>tap. tap = ([], <(code tm, nl)>)\\<rbrace> H2D0' \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc, Oc] @Bk\\<up>l)\\<rbrace>) )\"\n    by blast\n\n(* first, create a composable version of the arbitrary and thus potentially non-composable machine H2D0' *)\n\n  then have \"composable_tm0 (mk_composable0 H2D0') \\<and> (\\<forall>nl (tm::instr list).\n          ((tm,nl) \\<in> H2 \\<longrightarrow>\\<lbrace>\\<lambda>tap. tap = ([], <(code tm, nl)>)\\<rbrace> mk_composable0 H2D0' \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc] @Bk\\<up>l)\\<rbrace>)\n       \\<and>  ((tm,nl) \\<notin> H2 \\<longrightarrow>\\<lbrace>\\<lambda>tap. tap = ([], <(code tm, nl)>)\\<rbrace> mk_composable0 H2D0' \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc, Oc] @Bk\\<up>l)\\<rbrace>) )\"\n\n    by (auto simp add: Hoare_halt_tm_impl_Hoare_halt_mk_composable0_cell_list composable_tm0_mk_composable0 )\n\n  then have \"\\<exists>H2D0. composable_tm0 H2D0 \\<and> (\\<forall>nl (tm::instr list).\n          ((tm,nl) \\<in> H2 \\<longrightarrow>\\<lbrace>\\<lambda>tap. tap = ([], <(code tm, nl)>)\\<rbrace>  H2D0 \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc] @Bk\\<up>l)\\<rbrace>)\n       \\<and>  ((tm,nl) \\<notin> H2 \\<longrightarrow>\\<lbrace>\\<lambda>tap. tap = ([], <(code tm, nl)>)\\<rbrace> H2D0 \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc, Oc] @Bk\\<up>l)\\<rbrace>) )\"\n    by blast\n\n(* here we obtain the composable variant H2D0 of  H2D0' *)\n\n  then obtain H2D0 where w_H2D0: \"composable_tm0 H2D0 \\<and> (\\<forall>nl (tm::instr list).\n          ((tm,nl) \\<in> H2 \\<longrightarrow>\\<lbrace>\\<lambda>tap. tap = ([], <(code tm, nl)>)\\<rbrace>  H2D0 \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc] @Bk\\<up>l)\\<rbrace>)\n       \\<and>  ((tm,nl) \\<notin> H2 \\<longrightarrow>\\<lbrace>\\<lambda>tap. tap = ([], <(code tm, nl)>)\\<rbrace> H2D0 \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc, Oc] @Bk\\<up>l)\\<rbrace>) )\"\n    by blast\n\n(* define the culprit tm_contra from the diagonal by using tm_copy and tm_dither *)\n\n  define tm_contra where \"tm_contra = (tm_copy |+| H2D0 |+| tm_dither)\"\n\n  from w_H2D0 have H_composable: \"composable_tm0 (tm_copy |+| H2D0)\" by auto\n\n(* the stage is set: now, we derive the contradiction *)\n\n  show False\n  proof (cases \"(tm_contra, [code tm_contra]) \\<in> H2\")\n\n    case True  \n    then have \"(tm_contra, [code tm_contra]) \\<in> H2\" .\n\n    then have inH2: \"TMC_has_num_res tm_contra [code tm_contra]\"\n      by (auto simp add: H2_def)\n\n    show False  (* (tm_contra, [code tm_contra]) \\<in> H2  \\<Longrightarrow> (tm_contra, [code tm_contra]) \\<notin> H2 *)\n    proof -\n\n      (* assertions *)\n      define P1 where \"P1 \\<equiv> \\<lambda>tap. tap = ([]::cell list, <code tm_contra>)\"\n      define P2 where \"P2 \\<equiv> \\<lambda>tap. tap = ([Bk]::cell list, <(code tm_contra, code tm_contra)>)\"\n      define Q3 where \"Q3 \\<equiv> \\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc] @Bk\\<up>l)\"\n\n(* the play book for derivation of the contradiction,\n   for the case: (tm_contra, [code tm_contra]) \\<in> H2\n\n         \\<lbrace>P1\\<rbrace> tm_copy \\<lbrace>P2\\<rbrace>  \\<lbrace>P2\\<rbrace> H2D0 \\<lbrace>Q3\\<rbrace>\n         ---------------------------------\n         first: \\<lbrace>P1\\<rbrace> (tm_copy |+| H2D0) \\<lbrace>Q3\\<rbrace>    second: \\<lbrace>Q3\\<rbrace> tm_dither loops\n         -------------------------------------------------------------------\n                        \\<lbrace>P1\\<rbrace> tm_contra loops\n*)\n\n(* from \\<lbrace>P1\\<rbrace> tm_copy \\<lbrace>P2\\<rbrace>  \\<lbrace>P2\\<rbrace> H2D0 \\<lbrace>Q3\\<rbrace>   show  first: \\<lbrace>P1\\<rbrace> (tm_copy |+| H2D0) \\<lbrace>Q3\\<rbrace> *)\n\n      have first: \"\\<lbrace>P1\\<rbrace> (tm_copy |+| H2D0) \\<lbrace>Q3\\<rbrace>\" \n      proof (cases rule: Hoare_plus_halt)\n        case A_halt (* of tm_copy *)\n        show \"\\<lbrace>P1\\<rbrace> tm_copy \\<lbrace>P2\\<rbrace>\" unfolding P1_def P2_def tape_of_nat_def\n          by (rule tm_copy_correct)\n      next\n        case B_halt (* of H2D0 *)\n        from \\<open>(tm_contra, [code tm_contra]) \\<in> H2\\<close> and w_H2D0\n        have      \"\\<lbrace>\\<lambda>tap. tap = ([], <(code tm_contra, [code tm_contra])> ) \\<rbrace> H2D0 \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc] @Bk\\<up>l)\\<rbrace>\"          \n          by auto\n        then have \"\\<lbrace>\\<lambda>tap. tap = ([], <(code tm_contra, code tm_contra)  > ) \\<rbrace> H2D0 \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc] @Bk\\<up>l)\\<rbrace>\"\n          by (simp add: Hoare_haltE Hoare_haltI tape_of_list_def tape_of_prod_def)\n\n        then show \"\\<lbrace>P2\\<rbrace> H2D0 \\<lbrace>Q3\\<rbrace>\"\n          unfolding P2_def Q3_def\n          using add_single_BK_to_left_tape\n          by blast\n      next\n        show \"composable_tm0 tm_copy\" by auto\n      qed\n\n(* second: \\<lbrace>P3\\<rbrace> tm_dither loops *)\n\n      have second: \"\\<lbrace>Q3\\<rbrace> tm_dither \\<up>\" unfolding Q3_def\n        using tm_dither_loops''\n        by (simp add: tape_of_nat_def )\n\n(* from first and second show  \\<lbrace>P1\\<rbrace> tm_contra loops *)\n\n      have \"\\<lbrace>P1\\<rbrace> tm_contra \\<up>\" \n        unfolding tm_contra_def\n        by (rule Hoare_plus_unhalt[OF first second H_composable])\n\n(* from \\<lbrace>P1\\<rbrace> tm_contra \\<up>   show  \\<not>TMC_has_num_res tm_contra [code tm_contra] *)\n\n      then have \"\\<not>TMC_has_num_res tm_contra [code tm_contra]\"\n        unfolding P1_def\n        \n        by (metis (mono_tags) Hoare_halt_impl_not_Hoare_unhalt\n                  TMC_has_num_res_def inH2 tape_of_list_def tape_of_nat_list.simps(2))\n\n(* thus have contradiction *)\n\n      with inH2 show False by auto\n    qed\n\n  next\n\n    case False\n    then have \"(tm_contra, [code tm_contra]) \\<notin> H2\" .\n    then have not_inH2: \"\\<not>TMC_has_num_res tm_contra [code tm_contra]\"\n      by (auto simp add: H2_def)\n\n    show False  (* (tm_contra, [code tm_contra]) \\<notin> H2 \\<Longrightarrow> (tm_contra, [code tm_contra]) \\<in> H2 *)\n    proof -\n\n      (* assertions *)\n      define P1 where \"P1 \\<equiv> \\<lambda>tap. tap = ([]::cell list, <code tm_contra>)\"\n      define P2 where \"P2 \\<equiv> \\<lambda>tap. tap = ([Bk], <(code tm_contra, code tm_contra)>)\"\n      define P3 where \"P3 \\<equiv> \\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc, Oc] @Bk\\<up>l )\"\n\n(* the play book for derivation of the contradiction,\n   for the case: (tm_contra, [code tm_contra]) \\<notin> H2\n\n         \\<lbrace>P1\\<rbrace> tm_copy \\<lbrace>P2\\<rbrace>  \\<lbrace>P2\\<rbrace> H2D0 \\<lbrace>P3\\<rbrace> \n         --------------------------------\n         first: \\<lbrace>P1\\<rbrace> (tm_copy |+| H2D0) \\<lbrace>P3\\<rbrace>   second: \\<lbrace>P3\\<rbrace> tm_dither \\<lbrace>P3\\<rbrace>\n         ----------------------------------------------------------------\n                           \\<lbrace>P1\\<rbrace> tm_contra \\<lbrace>P3\\<rbrace>\n*)\n\n(* from \\<lbrace>P1\\<rbrace> tm_copy \\<lbrace>P2\\<rbrace>  \\<lbrace>P2\\<rbrace> H2D0 \\<lbrace>P3\\<rbrace>     show    first: \\<lbrace>P1\\<rbrace> (tm_copy |+| H2D0) \\<lbrace>P3\\<rbrace> *)\n\n      have first: \"\\<lbrace>P1\\<rbrace> (tm_copy |+| H2D0) \\<lbrace>P3\\<rbrace>\"\n      proof (cases rule: Hoare_plus_halt)\n        case A_halt (* of tm_copy *)\n        show \"\\<lbrace>P1\\<rbrace> tm_copy \\<lbrace>P2\\<rbrace>\" unfolding P1_def P2_def tape_of_nat_def\n          by (rule tm_copy_correct)\n      next\n        case B_halt (* of H2D0 *)\n        from \\<open>(tm_contra, [code tm_contra]) \\<notin> H2\\<close> and w_H2D0\n        have      \"\\<lbrace>\\<lambda>tap. tap = ([], <(code tm_contra, [code tm_contra])> ) \\<rbrace> H2D0 \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc, Oc] @Bk\\<up>l)\\<rbrace>\"            \n          by auto\n        then have \"\\<lbrace>\\<lambda>tap. tap = ([], <(code tm_contra, code tm_contra)  > ) \\<rbrace> H2D0 \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc, Oc] @Bk\\<up>l)\\<rbrace>\"\n          by (simp add: Hoare_haltE Hoare_haltI tape_of_list_def tape_of_prod_def)\n\n        then show \"\\<lbrace>P2\\<rbrace> H2D0 \\<lbrace>P3\\<rbrace>\"\n          unfolding P2_def P3_def\n          by (rule add_single_BK_to_left_tape)\n      next\n        show \"composable_tm0 tm_copy\" by simp\n      qed\n\n(* second: \\<lbrace>P3\\<rbrace> tm_dither \\<lbrace>P3\\<rbrace> *)\n\n      from tm_dither_halts\n      have \"\\<lbrace>\\<lambda>tap. tap = ([], [Oc, Oc])\\<rbrace> tm_dither \\<lbrace>\\<lambda>tap. \\<exists>k l. tap = (Bk \\<up> k, [Oc, Oc] @Bk\\<up>l)\\<rbrace>\"\n      proof -\n        have \"\\<forall>n. \\<exists>l. steps0 (1, Bk \\<up> n, [Oc, Oc]) tm_dither (Suc 1) = (0, Bk \\<up> n, [Oc, Oc] @Bk\\<up>l)\"\n          by (metis One_nat_def tm_dither_halts_aux Suc_1 append.right_neutral replicate.simps(1) )\n        then show ?thesis\n          using Hoare_halt_add_Bks_left_tape_L2 Hoare_halt_del_Bks_left_tape by blast          \n      qed\n\n      then have second: \"\\<lbrace>P3\\<rbrace> tm_dither \\<lbrace>P3\\<rbrace>\" unfolding P3_def       \n      proof -\n        have \"Oc # [Oc] = [Oc, Oc]\"\n          using One_nat_def replicate_Suc tape_of_nat_def by fastforce\n        then show \"\\<lbrace>\\<lambda>p. \\<exists>n na. p = (Bk \\<up> n, [Oc, Oc] @ Bk \\<up> na)\\<rbrace> tm_dither \\<lbrace>\\<lambda>p. \\<exists>n na. p = (Bk \\<up> n, [Oc, Oc] @ Bk \\<up> na)\\<rbrace>\"\n          using tm_dither_halts'' by presburger\n      qed\n\n(* from first and second show  \\<lbrace>P1\\<rbrace> tm_contra \\<lbrace>P3\\<rbrace> *)\n\n      with first have \"\\<lbrace>P1\\<rbrace> tm_contra \\<lbrace>P3\\<rbrace>\"\n        unfolding tm_contra_def\n      proof (rule Hoare_plus_halt)\n        from H_composable show \"composable_tm0 (tm_copy |+| H2D0)\" by auto\n      qed\n\n(* from  \\<lbrace>P1\\<rbrace> tm_contra \\<lbrace>P3\\<rbrace>    show    TMC_has_num_res tm_contra [code tm_contra] *)\n\n      then have \"TMC_has_num_res tm_contra [code tm_contra]\" unfolding P1_def P3_def\n        by (simp add: Hoare_haltE Hoare_haltI Hoare_halt_with_OcOc_imp_std_tap tape_of_list_def)\n\n(* thus have contradiction *)\n\n      with not_inH2\n      show ?thesis by auto\n    qed\n  qed\nqed\n\ntext \\<open>Note: since we did not formalize the concept of Turing Computable Functions and\n Characteristic Functions of sets yet, we are (at the moment) not able to formalize the existence\n of an  uncomputable function, namely the characteristic function of the set H2.\n\n Another caveat is the fact that the set H2 has type @{typ \"((instr list) \\<times> (nat list)) set\"}.\n This is in contrast to the classical formalization of decision problems, where the sets discussed\n only contain tuples respectively lists of natural numbers. \n  \\<close>\nend (* locale uncomputable *)\n\nend\n\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Universal_Turing_Machine/TuringUnComputable_H2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331606115021, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.31683088550776495}}
{"text": "(*\n\nCopyright (c) 2017, ETH Zurich\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\n   list of conditions and the following disclaimer.\n2. Redistributions in binary form must reproduce the above copyright notice,\n   this list of conditions and the following disclaimer in the documentation\n   and/or other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND\nON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\n\n(* ######################################################################### *) \nchapter \"Page Table Model for a software loaded TLB\"\n(* ######################################################################### *)\n\n  \n(*<*)\ntheory MipsTLBPageTable\n  imports Main Set MipsTLB\nbegin\n(*>*)  \n  \ntext \"A TLB is a cache for the translations stored in a page table. We now \n      provide a formal definition for a page table model to be used in \n      conjunction with the MIPS R4600 TLB model defined earlier.\"\n\n  \n(* ========================================================================= *)  \nsection \"Page Table Specification\"\n(* ========================================================================= *)\n\ntext \"We now define the page tabe specification followed by predicates that\n      ensure the validity. This page tables specification targets the \n      MIPS R4600 software loaded TLB and would need to be changed if a\n      different TLB model is to be used.\"\n  \n(* ------------------------------------------------------------------------- *)   \nsubsection \"Definition\"  \n(* ------------------------------------------------------------------------- *)   \n  \n  \ntext \"Conceptually the page table store the EntryLO as defined in the MIPS\n      R4600 TLB model. We therefore express the page table entry as a \n      partially defined function from a VPN and ASID to an EntryLO where\n      the result is undefined if either the ASID or VPN are outside of \n      their valid ranges as defined by the MIPS R4600 TLB model. Note,\n      we define the function to take the VPN argument before the ASID \n      to handle updates using global entries as we will see later.\"\n  \n  \nrecord MIPSPT = \n  entry :: \"VPN \\<Rightarrow> ASID \\<Rightarrow> TLBENTRYLO\"\n  \n\n    \n(* ------------------------------------------------------------------------- *)   \nsubsection \"Wellformed Page Table Entry\"  \n(* ------------------------------------------------------------------------- *)   \n  \ntext \"The MIPSPT entries are wellformed if their TLBENTRYLO is well formed. \n     Thus  we say that the all entries of the TLB are wellformed if all \n     corresponding TLBENTRYLO are wellformed too. Note that all entries \n     in the page tables are of the smallest page size, which is 4k.\"\n  \ndefinition MIPSPT_Entries_wellformed :: \"MIPSPT \\<Rightarrow> bool\"\n  where \"MIPSPT_Entries_wellformed pt =\n           (\\<forall>vpn as. TLBENTRYLOWellFormed ((entry pt) vpn as) MASK4K)\"\n\n(* ------------------------------------------------------------------------- *)\nsubsection \"No Global Page Table Entries\"\n(* ------------------------------------------------------------------------- *)\n    \ntext \"We restrict the page table from having global entries. The update function\n      of the page table will take care of updating all the entries for the\n      different ASIDs accordingly. \"\n  \ndefinition MIPSPT_Entries_not_global ::  \"MIPSPT \\<Rightarrow> bool\"\n  where \"MIPSPT_Entries_not_global pt = (\\<forall>vpn as. \\<not>(g ((entry pt) vpn as)))\"\n\n\n(* ------------------------------------------------------------------------- *)\nsubsection \"A Valid Page Table\"\n(* ------------------------------------------------------------------------- *)\n\ntext \"Consequently, we define the page table to be valid, if all its entries\n      are well formed as defined in the corresponding predicate and none of\n      its entries are marked global.\"\n\n  \ndefinition MIPSPT_valid :: \"MIPSPT \\<Rightarrow> bool\"\n  where \"MIPSPT_valid pt = ((MIPSPT_Entries_wellformed pt) \n                              \\<and> (MIPSPT_Entries_not_global pt))\"    \n    \n\ntext \"Therefore, a valid page table implies that for all ASID and VPN\n      the stored EntryLO is well formed and not global.\"\n  \nlemma MIPSPT_valid_wellformed:\n  \"\\<And>pt. MIPSPT_valid pt  \\<Longrightarrow> \n        \\<forall>vpn as. TLBENTRYLOWellFormed ((entry pt) vpn as) MASK4K\"\n  by(simp add:MIPSPT_valid_def MIPSPT_Entries_wellformed_def)\n  \nlemma MIPSPT_valid_not_global:\n  \"\\<And>pt. MIPSPT_valid pt \\<Longrightarrow> \\<forall>vpn as.\\<not> g ((entry pt) vpn as)\"\n  by(simp add:MIPSPT_valid_def MIPSPT_Entries_not_global_def)\n    \n    \n(* ========================================================================= *)  \nsection \"Page Table Operations\"\n(* ========================================================================= *)   \n\ntext \"We now define the abstract operations to initialize, read and write\n      the page table as defined above and proof assertions about the semantics\n      of the operations.\"\n       \n  \n(* ------------------------------------------------------------------------- *)   \nsubsection \"Initialization\"  \n(* ------------------------------------------------------------------------- *)   \n\ntext \"Logically, we model the initialization or creation of the page table\n      similar to allocating and zeroing region of memory and thus the\n      created page table will contain all NullEntryLo entries.\"\n  \ndefinition MIPSPT_create :: \"MIPSPT\"\n  where \"MIPSPT_create = \\<lparr> entry = (\\<lambda>_. \\<lambda>_. null_entry_lo) \\<rparr>\"\n\n\ntext \"Next we proof that when using the MIPSPT-create function from above,\n      the resulting page table is valid. For this purpose we show first that\n      all the entries are NullEntryLo and then use this lemma to show the \n      validity.\"\n  \nlemma MIPSPT_create_all_null:\n  \"\\<forall>vpn as. (entry (MIPSPT_create)) vpn as = null_entry_lo\"\n  by(auto simp:MIPSPT_create_def)      \n\nlemma MIPSPT_create_valid:\n  \"MIPSPT_valid (MIPSPT_create)\"    \n  by(simp add:MIPSPT_valid_def MIPSPT_Entries_wellformed_def \n              MIPSPT_create_all_null NullEntryLoWellFormed MIPSPT_create_def\n              MIPSPT_Entries_not_global_def NullEntryLo_not_global)\n  \n  \n\n(* ------------------------------------------------------------------------- *)   \nsubsection \"Read Operation\"  \n(* ------------------------------------------------------------------------- *)     \n\ntext \"The page table read operation returns the EntryLo for the supplied \n      ASID and VPN.  \"\n  \ndefinition MIPSPT_read :: \"ASID \\<Rightarrow> VPN \\<Rightarrow> MIPSPT \\<Rightarrow> TLBENTRYLO\"\n  where \"MIPSPT_read as vpn pt = (entry pt) vpn as\"\n\n    \ntext \"The page table reads the null entry for all entries of a newly created / \n      initialized page table and that those entries are wellformed if the\n      page table is valid.\"\n  \nlemma \"\\<forall>vpn as. MIPSPT_read as vpn (MIPSPT_create) = null_entry_lo\"\n  by(auto simp:MIPSPT_read_def MIPSPT_create_def)\n\nlemma MIPSPT_read_wellformed:\n  \"\\<And>pt. MIPSPT_valid pt \\<Longrightarrow> \n    (\\<forall> as vpn. TLBENTRYLOWellFormed (MIPSPT_read as vpn pt) MASK4K)\"\n  by(simp add:MIPSPT_valid_def MIPSPT_Entries_wellformed_def MIPSPT_read_def)\n    \n    \n(* ------------------------------------------------------------------------- *)   \nsubsection \"Write Operation\"  \n(* ------------------------------------------------------------------------- *)    \n\ntext \"The write operation updates the the entry function of the page table.\n      If the entry to be written is global, then the function is updated\n      for all the possible ASIDs and the entry is marked non-global.\"\n\n   \ndefinition MIPSPT_write :: \"ASID \\<Rightarrow> VPN \\<Rightarrow> TLBENTRYLO \\<Rightarrow> MIPSPT \\<Rightarrow> MIPSPT\"\n  where \"MIPSPT_write as vpn e pt = \n   (if g e then\n     \\<lparr> entry = (entry pt)(\n        vpn := \\<lambda>_. \\<lparr> pfn=(pfn e), v=(v e), d=(d e), g=False \\<rparr>\n       ) \\<rparr>\n    else \n     \\<lparr> entry = (entry pt)(vpn := ((entry pt) vpn)(as := e)) \\<rparr> )\"   \n    \n    \ntext \"Next we show that the write operation preserves the validity of the\n      page tables if the entry to be written is well formed. \"\n  \nlemma MIPSPT_write_valid:\n  \"\\<And>pt. MIPSPT_valid pt \\<and> (TLBENTRYLOWellFormed e MASK4K)\n               \\<Longrightarrow> MIPSPT_valid (MIPSPT_write as vpn e pt)\"    \n  apply(simp add:MIPSPT_write_def)\n  apply(cases \"g e\")\n   apply(simp_all add:MIPSPT_valid_def MIPSPT_Entries_wellformed_def \n                      MIPSPT_Entries_not_global_def)\n  apply(simp add:TLBENTRYLOWellFormed_def)\n  done   \n\n      \nparagraph \"Clearing of Entries\"    \n   \n    \ntext \"When a translation is removed the page table entry has to be cleared.\n      We can express this operation as a special case of the write operation\n      where we write the NullEntryLo to the ASID/VPN of the page table. \n      Likewise, all entries or global entries of the page table can be cleared.\"\n      \n\ndefinition MIPSPT_clear :: \"ASID \\<Rightarrow> VPN \\<Rightarrow> MIPSPT \\<Rightarrow> MIPSPT\"\n  where \"MIPSPT_clear as vpn pt = (MIPSPT_write as vpn null_entry_lo pt)\"\n    \ndefinition MIPSPT_clearglobal :: \"VPN \\<Rightarrow> MIPSPT \\<Rightarrow> MIPSPT\"\n  where \"MIPSPT_clearglobal vpn pt =  \n    \\<lparr> entry = (entry pt)(vpn := \\<lambda>_. null_entry_lo) \\<rparr>\"    \n    \ndefinition MIPSPT_clearall :: \"MIPSPT \\<Rightarrow> MIPSPT\"\n  where \"MIPSPT_clearall pt = pt \\<lparr> entry := (\\<lambda>_. \\<lambda>_ . null_entry_lo) \\<rparr>\"\n    \n    \ntext \"Any of the clear function above will return the NullEntryLo if\n      the entry is read back again.\"    \n  \n\nlemma MIPSPT_clear_is_null_entry:\n  \"MIPSPT_read as vpn (MIPSPT_clear as vpn pt) = null_entry_lo\"\n  by(auto simp:MIPSPT_read_def MIPSPT_clear_def MIPSPT_write_def \n               NullEntryLo_not_global)\n\nlemma MIPSPT_clearglobal_null_entry:\n  \"\\<forall>as. MIPSPT_read as vpn (MIPSPT_clearglobal vpn pt) = null_entry_lo\"\n  by(auto simp:MIPSPT_read_def MIPSPT_clearglobal_def MIPSPT_write_def \n               NullEntryLo_not_global)             \n  \nlemma MIPSPT_clearall_null_entry:\n  \"\\<forall>as vpn. MIPSPT_read as vpn (MIPSPT_clearall pt) = null_entry_lo\"\n  by(auto simp:MIPSPT_read_def MIPSPT_clearall_def MIPSPT_write_def \n               NullEntryLo_not_global)              \n             \ntext \"Furthermore, clearing the entire page table is equivalent to \n      create or initialize a new page table.\"\n\nlemma MIPSPT_clearall_is_create :\n  \"MIPSPT_clearall pt = MIPSPT_create\"\n  by(auto simp:MIPSPT_create_def MIPSPT_clearall_def) \n    \n    \ntext \"Next we show for all of the clear operation variants that the, the\n      resulting page table will remain valid.\"\n  \n  \nlemma MIPSPT_clear_valid:\n  \"\\<And>pt. MIPSPT_valid pt \\<Longrightarrow> MIPSPT_valid (MIPSPT_clear as vpn pt)\"\n  by(simp add:MIPSPT_clear_def MIPSPT_write_def NullEntryLo_not_global\n              MIPSPT_valid_def  MIPSPT_Entries_wellformed_def\n              NullEntryLoWellFormed MIPSPT_Entries_not_global_def)\n            \nlemma MIPSPT_clearglobal_valid:\n  \"\\<And>pt. MIPSPT_valid pt \\<Longrightarrow> MIPSPT_valid (MIPSPT_clearglobal vpn pt)\"    \n  by(auto simp:MIPSPT_clearglobal_def MIPSPT_valid_def \n               MIPSPT_Entries_wellformed_def NullEntryLoWellFormed \n               MIPSPT_Entries_not_global_def NullEntryLo_not_global)   \n\nlemma MIPSPT_clearall_valid :\n  \"\\<And>pt. MIPSPT_valid pt \\<Longrightarrow> MIPSPT_valid (MIPSPT_clearall pt)\"    \n  by(auto simp:MIPSPT_clearall_def MIPSPT_valid_def \n               MIPSPT_Entries_wellformed_def NullEntryLoWellFormed \n               MIPSPT_Entries_not_global_def NullEntryLo_not_global)  \n\n             \n(* ========================================================================= *)  \nsection \"Address Translation\"\n(* ========================================================================= *)  \n\n  \ntext \"The translate function takes an  ASID and VPN and produces a set of PFN\n      that the ASID-VPN-combination translates to. If the entry is marked as \n      not-valid then there is no translation.\"\n  \ndefinition MIPSPT_translate :: \"MIPSPT \\<Rightarrow> ASID \\<Rightarrow> VPN \\<Rightarrow> PFN set\"  \n  where \"MIPSPT_translate pt as vpn = \n      (if (v (MIPSPT_read as vpn pt)) then {(pfn (MIPSPT_read as vpn pt))} \n       else {})\"  \n    \n    \ntext \"Next we show that the translate function will always return an empty \n      or a singleton  set of a particular VPN. In particular, if the entry is \n      valid, then the singleton set is returned, otherwise the empty set.\"\n\nlemma MIPSPT_translate_set:\n  \"MIPSPT_translate (MIPSPT_write as vpn e pt) as vpn \\<subseteq> {(pfn e)}\"\n  by(auto simp add: MIPSPT_translate_def MIPSPT_write_def MIPSPT_read_def)\n  \nlemma MIPSPT_translate_set_valid:\n  \"\\<And>e. (v e) \\<Longrightarrow> MIPSPT_translate (MIPSPT_write as vpn e pt) as vpn = {(pfn e)}\"\n  by(auto simp add: MIPSPT_translate_def MIPSPT_write_def MIPSPT_read_def)\n\nlemma MIPSPT_translate_set_not_valid:\n  \"\\<And>e. \\<not>(v e) \\<Longrightarrow> MIPSPT_translate (MIPSPT_write as vpn e pt) as vpn = {}\"\n  by(auto simp add: MIPSPT_translate_def MIPSPT_write_def MIPSPT_read_def)    \n    \n    \ntext \"The translate function of a newly created or one of the clear operations \n      will result into an empty translation for all VPN.\"\n  \nlemma MIPSPT_translate_create_emtpy:\n  \"\\<forall>vpn as. MIPSPT_translate (MIPSPT_create) as vpn = {}\"\n  by(auto simp:MIPSPT_create_def MIPSPT_translate_def\n               MIPSPT_read_def null_entry_lo_def)      \n\nlemma MIPSPT_translate_clearall_emtpy:\n  \"\\<forall>vpn as. MIPSPT_translate (MIPSPT_clearall pt) as vpn = {}\"\n  by(auto simp:MIPSPT_clearall_def MIPSPT_translate_def\n               MIPSPT_read_def null_entry_lo_def)      \n\nlemma MIPSPT_translate_clearglobal_emtpy:\n  \"\\<forall>vpn as. MIPSPT_translate (MIPSPT_clearglobal vpn pt) as vpn = {}\"\n  by(auto simp:MIPSPT_clearglobal_def MIPSPT_translate_def MIPSPT_write_def\n               MIPSPT_read_def null_entry_lo_def)             \n             \nlemma MIPSPT_translate_clear_emtpy:\n  \"\\<forall>vpn as. MIPSPT_translate (MIPSPT_clear as vpn pt) as vpn = {}\"\n  by(auto simp:MIPSPT_clear_def MIPSPT_translate_def MIPSPT_write_def\n               MIPSPT_read_def null_entry_lo_def)\n             \n\n(* ========================================================================= *)  \nsection \"Creating of a TLB Entry\"\n(* ========================================================================= *)             \n\ntext \"From the page table we can now create an EntryPair for the MIPS R4600\n      TLB model by combining two adjacent entries in the page table. We \n      give a definition on how the TLB entry is created and then show that\n      all created entries will be well formed.\"\n  \n  \n(* ------------------------------------------------------------------------- *)   \nsubsection \"Maximum Number of Entries in the Page Table\"  \n(* ------------------------------------------------------------------------- *)     \n  \ntext \"To ensure that created MIPS TLB entries form the MIPSPT \n      are well formed, we define the maximum number of entries to be the number \n      of 4k pages the MIPS TLB supports to span its 1TB=256M x 4k address space.\n      This is needed as the MIPS TLB defines the range of valid VPN2\"\n  \ndefinition MIPSPT_EntriesMax :: nat\n  where \"MIPSPT_EntriesMax = 268435456\"\n  \n    \ntext \"The maximum number of entries defined above spans the 1TB VAS of the\n      MIPS TLB and hence is equal to the number of 4k pages.\"    \n  \nlemma \"MIPSPT_EntriesMax * 4096 = GB 1024\"\n  by(auto simp:MIPSPT_EntriesMax_def GB_def)\n    \nlemma \"MIPSPT_EntriesMax = page_count MASK4K\"\n  by(auto simp:MIPSPT_EntriesMax_def page_count_def MB_def)  \n\n    \n(* ------------------------------------------------------------------------- *)   \nsubsection \"TLB Entry Creation\"  \n(* ------------------------------------------------------------------------- *)      \n\n\ntext \"For a particular ASID and VPN we can create the TLB EntryPair as \n      in the following definition. Because the VPN of the EntryPair needs\n      to be even, we need to do a case distinction. We then create\n      the TLB EntryPair based on two consecutive entries in the page table.\"\n  \ndefinition MIPSPT_mk_tlbentry :: \"MIPSPT \\<Rightarrow> ASID \\<Rightarrow> VPN \\<Rightarrow> TLBENTRY\"\n  where \"MIPSPT_mk_tlbentry pt as vpn = \n        (if (even vpn) then\n            TLBENTRY.make MASK4K \\<lparr> region=0, vpn2=vpn, asid=as \\<rparr> \n                          ((entry pt) vpn as) ((entry pt) (vpn + 1) as) \n           else  \n            TLBENTRY.make MASK4K \\<lparr> region=0, vpn2=(vpn-1), asid=as \\<rparr> \n                          ((entry pt) (vpn - 1) as) ((entry pt) vpn as ))\"\n   \n(* ------------------------------------------------------------------------- *)   \nsubsection \"Queries on created TLB EntryPairs\"  \n(* ------------------------------------------------------------------------- *)  \n\ntext \"We provide lemmas to quickly obtain the fields of a  TLB EntryPair\n     created from a page table. \"  \n  \nparagraph \"ASID\" \ntext \"The ASID is the same as the creation function was invoked with.\"\n  \nlemma MIPSPT_TLBENTRY_asid_is :\n   \"(TLBENTRYHI.asid (hi (MIPSPT_mk_tlbentry pt as vpn))) = as\"\n  by(auto simp:MIPSPT_mk_tlbentry_def TLBENTRY.make_def)    \n\nparagraph \"Page Mask\" \ntext \"The page mask for all entries is always 4kB.\"             \n  \nlemma MIPSPT_TLBENTRY_mask_is:\n  \"(mask (MIPSPT_mk_tlbentry pt as vpn)) = MASK4K\"\n  by(auto simp:MIPSPT_mk_tlbentry_def TLBENTRY.make_def)\n\nparagraph \"VPN\" \ntext \"Depending whether the VPN was odd or even, the VPN2 of the entry is either\n      VPN or VPN - 1.\"      \n    \nlemma MIPSPT_TLBENTRY_vpn2_is_even :\n  \"\\<And>vpn as pt. even vpn \\<Longrightarrow> (vpn2 (hi (MIPSPT_mk_tlbentry pt as vpn))) = vpn\"\n  by(simp add:MIPSPT_mk_tlbentry_def TLBENTRY.make_def)\n             \nlemma MIPSPT_TLBENTRY_vpn2_is_odd :\n  \"\\<And>vpn as pt. odd vpn \n        \\<Longrightarrow> (vpn2 (hi (MIPSPT_mk_tlbentry pt as vpn))) = vpn - 1\"\n  by(simp add:MIPSPT_mk_tlbentry_def TLBENTRY.make_def)\n    \nlemma MIPSPT_TLBENTRY_vpn2_is :\n  \"\\<And>vpn as pt. (vpn2 (hi (MIPSPT_mk_tlbentry pt as vpn))) = \n          (if (even vpn) then vpn else (vpn -1 ))\"\n  by(simp add:MIPSPT_TLBENTRY_vpn2_is_odd MIPSPT_TLBENTRY_vpn2_is_even)\n    \nparagraph \"Minimum and Maximum VPN\" \ntext \"The minimum and maximum VPN an entry can have, depends on whether\n      the VPN is even or odd and can be obtained as follows.\"       \n\nlemma MIPSPT_TLBENTRY_Min4kVPN_even: \n  \"even vpn \\<Longrightarrow> EntryMin4KVPN (MIPSPT_mk_tlbentry pt as vpn) = vpn\"\n  by(simp add:MIPSPT_mk_tlbentry_def TLBENTRY.make_def EntryMin4KVPN_def)\n\nlemma MIPSPT_TLBENTRY_Max4kVPN_even: \n  \"even vpn \\<Longrightarrow> EntryMax4KVPN (MIPSPT_mk_tlbentry pt as vpn) = Suc vpn\"\n  by(simp add:MIPSPT_mk_tlbentry_def TLBENTRY.make_def EntryMax4KVPN_def)\n  \nlemma MIPSPT_TLBENTRY_Min4kVPN_odd: \n  \"odd vpn \\<Longrightarrow> EntryMin4KVPN1 (MIPSPT_mk_tlbentry pt as vpn) = vpn\"\n  by(simp add:MIPSPT_mk_tlbentry_def TLBENTRY.make_def EntryMin4KVPN1_def)\n\nparagraph \"Address Range\"\ntext \"The address range that an entry covers is given by the minimum and \n     maximum VPN multiplied by the page size\"\n  \nlemma MIPSPT_TLBENTRY_range_even :\n  \"\\<And>pt as vpn.  even vpn \n        \\<Longrightarrow> EntryRange (MIPSPT_mk_tlbentry pt as vpn) \n                   = {x. vpn * 4096 \\<le> x \\<and> x < (vpn + 2) * 4096}\"\n  by(simp add:EntryRange_def EntrySize_def EntryMinVA_def EntryMaxVA_def \n              MIPSPT_TLBENTRY_mask_is MIPSPT_TLBENTRY_vpn2_is_even KB_def, \n              auto)\n        \n    \n(* ------------------------------------------------------------------------- *)   \nsubsection \"The Created Entry is Well Formed\"  \n(* ------------------------------------------------------------------------- *)  \n  \ntext \"We must make sure that the TLB keeps valid when a created entry is\n      written into the TLB. For this we need to show that a created entry\n      from the page table will be well formed with respect to the MIPS\n      R4600 TLB model specification. We therefore show first that the\n      VPN will always be even and within valid bounds.\"\n  \nlemma MIPSPT_TLBENTRY_vpn2_even: \n  \"\\<forall>vpn. (even (vpn2 (hi (MIPSPT_mk_tlbentry pt as vpn))))\"\n  by(auto simp:MIPSPT_mk_tlbentry_def TLBENTRY.make_def)\n\n\nlemma VPNEvenBounds: \n  assumes limit: \"vpn < (Suc (Suc a))\"\n      and even: \" even vpn\"\n      and aeven : \"even a\"\n    shows  \"vpn \\<le> a\"\n  proof -\n    from limit have X0:\n      \"vpn \\<le> Suc a\"\n      by(auto)\n    also from even aeven have X2:\n      \"vpn \\<noteq> Suc a\"\n      by(auto)\n    also from even X0 X2 have X1:\n      \"vpn < (Suc a)\"\n      by(auto)\n    with X1 show ?thesis by(auto)\n  qed    \n  \n    \nlemma VPNWithinValidBounds: \n  assumes bound: \"vpn < MIPSPT_EntriesMax\"\n      and even: \"even vpn \"\n    shows \"(Suc vpn) < MIPSPT_EntriesMax\"\nproof -\n  have aeven: \n    \"even MIPSPT_EntriesMax\" \n    by(simp add:MIPSPT_EntriesMax_def)\n  with bound even aeven have X0: \n    \"vpn \\<le> MIPSPT_EntriesMax - 2\"\n    by(simp add:VPNEvenBounds)\n  from X0 have X1: \n    \"(Suc vpn) \\<le> (MIPSPT_EntriesMax - 1)\" \n    by(auto simp:MIPSPT_EntriesMax_def)\n  with X1 show ?thesis by(auto)\nqed    \n\n\ntext \"Next we use the lemmas from above to show that the created EntryPair will\n      have a valid EntryHi part. \"\n\nlemma MIPSPT_TLBENTRYHI_wellformed:\n  \"\\<And>vpn as pt. MIPSPT_valid pt \\<Longrightarrow> vpn < MIPSPT_EntriesMax \\<Longrightarrow> ASIDValid as \\<Longrightarrow>\n             TLBENTRYHIWellFormed (hi (MIPSPT_mk_tlbentry pt as vpn)) MASK4K\"\n  by(auto simp:MIPSPT_mk_tlbentry_def TLBENTRYHIWellFormed_def TLBENTRY.make_def \n               MIPSPT_valid_def VPN2Valid_def VPNMin_def VPN2Max_def MB_def \n               MIPSPT_EntriesMax_def VPNEvenBounds)    \n\n\ntext \"And finally we show that the created TLB EntryPair will always be \n      well formed.\"\n     \nlemma MIPSPT_TLBENTRY_wellformed:\n   \"\\<And>pt vpn as. MIPSPT_valid pt \\<Longrightarrow> vpn < MIPSPT_EntriesMax \\<Longrightarrow> ASIDValid as\n         \\<Longrightarrow> TLBENTRYWellFormed ( MIPSPT_mk_tlbentry pt as vpn)\"\n  apply(simp add:TLBENTRYWellFormed_def)\n  apply(simp add:MIPSPT_TLBENTRYHI_wellformed MIPSPT_TLBENTRY_mask_is)\n  apply(simp add:MIPSPT_valid_def MIPSPT_Entries_wellformed_def)\n  apply(simp add:MIPSPT_mk_tlbentry_def TLBENTRY.make_def)\n  done\n    \n    \n(* ------------------------------------------------------------------------- *)   \nsubsection \"Entry is not Global\"\n(* ------------------------------------------------------------------------- *)               \n\ntext \"If the page table was in a valid state, then the created TLB EntryPair\n      will be not global for any VPN and ASID.\" \n\n             \nlemma MIPSPT_TLBENTRY_not_global:\n  \"\\<And>pt. MIPSPT_valid pt\n          \\<Longrightarrow> \\<forall>vpn as. \\<not>EntryIsGlobal (MIPSPT_mk_tlbentry pt as vpn)\"\n  by(simp add:MIPSPT_valid_def MIPSPT_Entries_not_global_def\n                 EntryIsGlobal_def MIPSPT_mk_tlbentry_def TLBENTRY.make_def)\n             \n\n(* ------------------------------------------------------------------------- *)   \nsubsection \"Entry Match\"\n(* ------------------------------------------------------------------------- *)                \n    \ntext \"The ASID match function will always evaluate to true for a EntryPair if\n      the ASID is equal to the one used for creating the TLB EntryPair.\"    \n    \nlemma MIPSPT_TLBENTRY_asidmatch:\n  \"EntryASIDMatchA as  (MIPSPT_mk_tlbentry pte as vpn)\"\n  by(auto simp:EntryASIDMatchA_def MIPSPT_mk_tlbentry_def TLBENTRY.make_def)\n\nlemma \"\\<And>as1 as2. \\<forall> mpt vpn. \n       as1 = as2 \\<Longrightarrow>  EntryASIDMatch (MIPSPT_mk_tlbentry (pte mpt) as1 vpn)\n                                     (MIPSPT_mk_tlbentry (pte mpt) as2 vpn)\" \n   by(simp add: EntryASIDMatch_def)  \n\ntext \"The EntryPair will match on the first/second half if the VPN was the\n      same as used when creating the entry, and the VPN was odd or even\n      respectively. \"\n     \nlemma MIPSPT_TLBENTRY_match0_even :\n  \"even vpn \\<Longrightarrow> EntryMatchVPNASID0 vpn as (MIPSPT_mk_tlbentry pt as vpn)\"\n  by(simp add:EntryMatchVPNASID0_def MIPSPT_mk_tlbentry_def TLBENTRY.make_def\n              EntryVPNMatchV0_def EntryMin4KVPN_def EntryMin4KVPN1_def \n              EntryASIDMatchA_def)\n  \n\nlemma MIPSPT_TLBENTRY_match1_odd :\n  \"odd vpn \\<Longrightarrow> EntryMatchVPNASID1 vpn as (MIPSPT_mk_tlbentry pt as (vpn))\"\n  by(simp add:EntryMatchVPNASID1_def MIPSPT_mk_tlbentry_def TLBENTRY.make_def\n              EntryASIDMatchA_def EntryVPNMatchV1_def  EntryMin4KVPN1_def \n              EntryMax4KVPN_def)\n  \n\ntext \"Lastly, we show that for all ASID and VPNs there will be a match if\n      the same ASID or VPN has been used to create the TLB EntryPair.\"    \n    \nlemma MIPSPT_TLBENTRY_match :\n  \"EntryMatchVPNASID vpn as (MIPSPT_mk_tlbentry pt as vpn)\"\n  by(simp add:EntryMatchVPNASID_def MIPSPT_TLBENTRY_asidmatch EntryVPNMatchV_def\n              EntryMin4KVPN_def EntryMax4KVPN_def MIPSPT_TLBENTRY_mask_is\n              MIPSPT_mk_tlbentry_def TLBENTRY.make_def EntryASIDMatchA_def) \n\n    \n\n(* ------------------------------------------------------------------------- *)   \nsubsection \"Entry Equivalence\"\n(* ------------------------------------------------------------------------- *)              \n\ntext \"For two consecutive VPNs the entries are actually the same\"\n\nlemma MIPSPT_TLBENTRY_equal_odd:\n  \"odd vpn \\<Longrightarrow> (MIPSPT_mk_tlbentry pt as vpn)\n                   = (MIPSPT_mk_tlbentry pt as (vpn - 1))\"  \n  by(simp add:MIPSPT_mk_tlbentry_def)\n\nlemma MIPSPT_TLBENTRY_equal_even:\n  \"even vpn \\<Longrightarrow> (MIPSPT_mk_tlbentry pt as vpn) \n                   = (MIPSPT_mk_tlbentry pt as (vpn + 1))\"  \n  by(simp add:MIPSPT_mk_tlbentry_def)    \n\n(* ------------------------------------------------------------------------- *)   \nsubsection \"Translate Function\"\n(* ------------------------------------------------------------------------- *)      \n\ntext \"We can now simplify the translate function for a created TLB entry.\"  \n  \nlemma MIPSPT_TLBENTRY_translate_is :\n  \"(TLBENTRY_translate (MIPSPT_mk_tlbentry pte as vpn) as vpn) = \n   (if (v ((entry pte) vpn as)) then {(pfn ((entry  pte) vpn as))} else {})\"\n  apply(cases \"even vpn\", simp_all add:TLBENTRY_translate_def MIPSPT_TLBENTRY_match)\n   apply(simp_all add:MIPSPT_mk_tlbentry_def TLBENTRY.make_def EntryIsValid0_def\n                      EntryIsValid1_def EntryMin4KVPN_def EntryMin4KVPN1_def)\n  done  \n    \n        \n(*>*)\nend  \n(*<*)\n", "meta": {"author": "BarrelfishOS", "repo": "Isabelle-hardware-models", "sha": "a638383df9dd8db15805c59efb65724bc919df0a", "save_path": "github-repos/isabelle/BarrelfishOS-Isabelle-hardware-models", "path": "github-repos/isabelle/BarrelfishOS-Isabelle-hardware-models/Isabelle-hardware-models-a638383df9dd8db15805c59efb65724bc919df0a/theories/mipstlb/MipsTLBPageTable.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5312093733737562, "lm_q2_score": 0.5964331462646254, "lm_q1q2_score": 0.31683087788656955}}
{"text": "theory flash99Bra  imports flash99Rev\n \n  begin\nlemma onInv99:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv99 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv99 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv99 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash99Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.743168019989179, "lm_q2_score": 0.42632159254749036, "lm_q1q2_score": 0.31682857381215196}}
{"text": "theory SepLogic_Misc\nimports   DataRefinement\nbegin\n\n\n    \nsubsection \\<open>Relators\\<close> \n  \ndefinition nrest_rel where \n  nres_rel_def_internal: \"nrest_rel R \\<equiv> {(c,a). c \\<le> \\<Down>R a}\"\n\nlemma nrest_rel_def: \"\\<langle>R\\<rangle>nrest_rel \\<equiv> {(c,a). c \\<le> \\<Down>R a}\"\n  by (simp add: nres_rel_def_internal relAPP_def)\n\nlemma nrest_relD: \"(c,a)\\<in>\\<langle>R\\<rangle>nrest_rel \\<Longrightarrow> c \\<le>\\<Down>R a\" by (simp add: nrest_rel_def)\nlemma nrest_relI: \"c \\<le>\\<Down>R a \\<Longrightarrow> (c,a)\\<in>\\<langle>R\\<rangle>nrest_rel\" by (simp add: nrest_rel_def)\n\nlemma nrest_rel_comp: \"\\<langle>A\\<rangle>nrest_rel O \\<langle>B\\<rangle>nrest_rel = \\<langle>A O B\\<rangle>nrest_rel\"\n  by (auto simp: nrest_rel_def conc_fun_chain[symmetric] conc_trans)\n\nlemma pw_nrest_rel_iff: \"(a,b)\\<in>\\<langle>A\\<rangle>nrest_rel \\<longleftrightarrow> nofailT (\\<Down> A b) \\<longrightarrow> nofailT a \\<and> (\\<forall>x t. inresT a x t \\<longrightarrow> inresT (\\<Down> A b) x t)\"\n  by (simp add: pw_le_iff nrest_rel_def)\n    \n     \n\nlemma param_FAIL[param]: \"(FAILT,FAILT) \\<in> \\<langle>R\\<rangle>nrest_rel\"\n  by (auto simp: nrest_rel_def)\n \n\nlemma param_RETURN[param]: \n  \"(RETURNT,RETURNT) \\<in> R \\<rightarrow> \\<langle>R\\<rangle>nrest_rel\"\n  by (auto simp: nrest_rel_def RETURNT_refine)\n\nlemma param_bind[param]:\n  \"(bindT,bindT) \\<in> \\<langle>Ra\\<rangle>nrest_rel \\<rightarrow> (Ra\\<rightarrow>\\<langle>Rb\\<rangle>nrest_rel) \\<rightarrow> \\<langle>Rb\\<rangle>nrest_rel\"\n  by (auto simp: nrest_rel_def intro: bindT_refine dest: fun_relD)\n\n\nend", "meta": {"author": "maxhaslbeck", "repo": "NREST", "sha": "c3bc984b27cc8398405f3ebffb960e70640961fa", "save_path": "github-repos/isabelle/maxhaslbeck-NREST", "path": "github-repos/isabelle/maxhaslbeck-NREST/NREST-c3bc984b27cc8398405f3ebffb960e70640961fa/SepLogic_Misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757645879592642, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.3167921046412489}}
{"text": "theory CallArityEnd2End\nimports ArityTransform CoCallAnalysisImpl\nbegin\n\nlocale CallArityEnd2End\nbegin\nsublocale CoCallAnalysisImpl.\n\nlemma fresh_var_eqE[elim_format]: \"fresh_var e = x \\<Longrightarrow> x \\<notin>  fv e\"\n  by (metis fresh_var_not_free)\n\nlemma example1:\n  fixes e :: exp\n  fixes f g x y z :: var\n  assumes Aexp_e: \"\\<And>a. Aexp e\\<cdot>a = esing x\\<cdot>(up\\<cdot>a) \\<squnion> esing y\\<cdot>(up\\<cdot>a)\"\n  assumes ccExp_e: \"\\<And>a. CCexp e\\<cdot>a = \\<bottom>\"\n  assumes [simp]: \"transform 1 e = e\"\n  assumes \"isVal e\"\n  assumes disj: \"y \\<noteq> f\" \"y \\<noteq> g\" \"x \\<noteq> y\" \"z \\<noteq> f\" \"z \\<noteq> g\" \"y \\<noteq> x\"\n  assumes fresh: \"atom z \\<sharp> e\"\n  shows \"transform 1 (let y be  App (Var f) g in (let x be e in (Var x))) = \n         let y be (Lam [z]. App (App (Var f) g) z) in (let x be (Lam [z]. App e z) in (Var x))\"\nproof-\n  from arg_cong[where f = edom, OF Aexp_e]\n  have \"x \\<in> fv e\" by simp (metis Aexp_edom' insert_subset)\n  hence [simp]: \"\\<not> nonrec [(x,e)]\"\n    by (simp add: nonrec_def)\n \n  from `isVal e`\n  have [simp]: \"thunks [(x, e)] = {}\"\n    by (simp add: thunks_Cons)\n\n  have [simp]: \"CCfix [(x, e)]\\<cdot>(esing x\\<cdot>(up\\<cdot>1) \\<squnion> esing y\\<cdot>(up\\<cdot>1), \\<bottom>) = \\<bottom>\"\n    unfolding CCfix_def\n    apply (simp add: fix_bottom_iff ccBindsExtra_simp)\n    apply (simp add: ccBind_eq disj ccExp_e)\n    done\n\n  have [simp]: \"Afix [(x, e)]\\<cdot>(esing x\\<cdot>(up\\<cdot>1)) = esing x\\<cdot>(up\\<cdot>1) \\<squnion> esing y\\<cdot>(up\\<cdot>1)\"\n    unfolding Afix_def\n    apply simp\n    apply (rule fix_eqI)\n    apply (simp add: disj Aexp_e)\n    apply (case_tac \"z x\")\n    apply (auto simp add: disj Aexp_e)\n    done\n\n  have [simp]: \"Aheap [(y, App (Var f) g)] (let x be e in Var x)\\<cdot>1 = esing y\\<cdot>((Aexp (let x be e in Var x )\\<cdot>1) y)\"\n    by (auto simp add:  Aheap_nonrec_simp ABind_nonrec_eq pure_fresh fresh_at_base disj)\n\n  have [simp]: \"(Aexp (let x be e in Var x)\\<cdot>1) = esing y\\<cdot>(up\\<cdot>1)\"\n    by (simp add: env_restr_join disj)\n    \n  have [simp]: \"Aheap [(x, e)] (Var x)\\<cdot>1 = esing x\\<cdot>(up\\<cdot>1)\"\n    by (simp add: env_restr_join disj)\n\n  have 1: \"1 = inc\\<cdot>0\" apply (simp add: inc_def) apply transfer apply simp done\n  \n  have [simp]: \"Aeta_expand 1 (App (Var f) g) = (Lam [z]. App (App (Var f) g) z)\"\n    apply (simp add: 1 del: exp_assn.eq_iff)\n    apply (subst change_Lam_Variable[of z \"fresh_var (App (Var f) g)\"])\n    apply (auto simp add: fresh_Pair fresh_at_base pure_fresh disj intro!: flip_fresh_fresh  elim!: fresh_var_eqE)\n    done\n\n  have [simp]: \"Aeta_expand 1 e = (Lam [z]. App e z)\"\n    apply (simp add: 1 del: exp_assn.eq_iff)\n    apply (subst change_Lam_Variable[of z \"fresh_var e\"])\n    apply (auto simp add: fresh_Pair fresh_at_base pure_fresh disj fresh intro!: flip_fresh_fresh  elim!: fresh_var_eqE)\n    done\n\n  show ?thesis\n    by (simp del: Let_eq_iff add: map_transform_Cons map_transform_Nil disj[symmetric])\nqed\n\nend\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/CallArityEnd2End.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102775181399, "lm_q2_score": 0.5, "lm_q1q2_score": 0.31670513875906997}}
{"text": "(*  Title:      HOL/Auth/n_moesi_lemma_invs_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_moesi Protocol Case Study*} \n\ntheory n_moesi_lemma_invs_on_rules imports n_moesi_lemma_inv__1_on_rules n_moesi_lemma_inv__2_on_rules n_moesi_lemma_inv__3_on_rules\nbegin\nlemma invs_on_rules:\n  assumes a1: \"f \\<in> invariants N\" and a2: \"r \\<in> rules N\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have b1: \"(\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__1  p__Inv0 p__Inv2)\\<or>\n    (\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__2  p__Inv0 p__Inv2)\\<or>\n    (\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__3  p__Inv0 p__Inv2)\"\n  apply (cut_tac a1, auto) done\n    moreover {\n      assume c1: \"(\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__1  p__Inv0 p__Inv2)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac a2 c1, metis lemma_inv__1_on_rules) done\n    }\n\n    moreover {\n      assume c1: \"(\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__2  p__Inv0 p__Inv2)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac a2 c1, metis lemma_inv__2_on_rules) done\n    }\n\n    moreover {\n      assume c1: \"(\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__3  p__Inv0 p__Inv2)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac a2 c1, metis lemma_inv__3_on_rules) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/moesi/n_moesi_lemma_invs_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3167051318389201}}
{"text": "theory \"BAN_modified_Andrew_Secure_RPC_cert_auto\"\nimports\n  \"ESPLogic\"\nbegin\n\n(* section:  BAN modified Andrew Secure RPC  *)\n\n(* text: \n  Modeled after the model in the SPORE library.\n\n  Notable differences:\n\n    1. 'succ(x)' is invertible. Hence, we just model it as a tuple ('succ',x) of\n       a global constant 'succ' and the variable x.  This means that we only\n       exploit the tagging properties of 'succ', but do not assume any\n       information hiding.\n\n    2. Instead of implicit typing, we are using explicit global constants to\n       discern messages.\n\n  Note that when using a bidirectional key k[A,B] instead of the\n  uni-directional key k(A,B) that is different depending on the used direction\n  an attack becomes possible, as agreement on the agent identities is partially\n  lost. Adding the A identity in the first message fixes that flaw.\n *)\n\nrole A\nwhere \"A =\n  [ Send ''1'' <| sAV ''A'',\n                  PEnc <| sC ''1'', sN ''Na'' |> ( sK ''A'' ''B'' )\n               |>\n  , Recv ''2'' ( PEnc <| sC ''2'', <| sC ''succ'', sN ''Na'' |>, sMV ''Nb''\n                      |>\n                      ( sK ''A'' ''B'' )\n               )\n  , Send ''3'' ( PEnc <| sC ''3'', sC ''succ'', sMV ''Nb'' |>\n                      ( sK ''A'' ''B'' )\n               )\n  , Recv ''4'' ( PEnc <| sC ''4'', sMV ''Kab'', sMV ''Nbp'', sN ''Na'' |>\n                      ( sK ''A'' ''B'' )\n               )\n  ]\"\n\nrole B\nwhere \"B =\n  [ Recv ''1'' <| sMV ''A'',\n                  PEnc <| sC ''1'', sMV ''Na'' |> ( PSymK ( sMV ''A'' ) ( sAV ''B'' ) )\n               |>\n  , Send ''2'' ( PEnc <| sC ''2'', <| sC ''succ'', sMV ''Na'' |>, sN ''Nb''\n                      |>\n                      ( PSymK ( sMV ''A'' ) ( sAV ''B'' ) )\n               )\n  , Recv ''3'' ( PEnc <| sC ''3'', sC ''succ'', sN ''Nb'' |>\n                      ( PSymK ( sMV ''A'' ) ( sAV ''B'' ) )\n               )\n  , Send ''4'' ( PEnc <| sC ''4'', sN ''Kab'', sN ''Nbp'', sMV ''Na'' |>\n                      ( PSymK ( sMV ''A'' ) ( sAV ''B'' ) )\n               )\n  ]\"\n\nprotocol Andrew\nwhere \"Andrew = { A, B }\"\n\nlocale restricted_Andrew_state = Andrew_state\n\ntype_invariant Andrew_msc_typing for Andrew\nwhere \"Andrew_msc_typing = mk_typing\n  [ ((B, ''A''), (KnownT B_1))\n  , ((A, ''Kab''), (SumT (KnownT A_4) (NonceT B ''Kab'')))\n  , ((B, ''Na''), (SumT (KnownT B_1) (NonceT A ''Na'')))\n  , ((A, ''Nb''), (SumT (KnownT A_2) (NonceT B ''Nb'')))\n  , ((A, ''Nbp''), (SumT (KnownT A_4) (NonceT B ''Nbp'')))\n  ]\"\n\nsublocale Andrew_state < Andrew_msc_typing_state\nproof -\n  have \"(t,r,s) : approx Andrew_msc_typing\"\n  proof(cases rule: reachable_in_approxI_ext\n        [OF Andrew_msc_typing.monoTyp, completeness_cases_rule])\n    case (A_2_Nb t r s tid0)\n    then interpret state: Andrew_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_2_Nb\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''2'', {| LC ''succ'', LN ''Na'' tid0 |}, s(MV ''Nb'' tid0) |}\n            ( K ( s(AV ''A'' tid0) ) ( s(AV ''B'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (A_4_Kab t r s tid0)\n    then interpret state: Andrew_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_4_Kab\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''4'', s(MV ''Kab'' tid0), s(MV ''Nbp'' tid0), LN ''Na'' tid0\n            |}\n            ( K ( s(AV ''A'' tid0) ) ( s(AV ''B'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (A_4_Nbp t r s tid0)\n    then interpret state: Andrew_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_4_Nbp\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''4'', s(MV ''Kab'' tid0), s(MV ''Nbp'' tid0), LN ''Na'' tid0\n            |}\n            ( K ( s(AV ''A'' tid0) ) ( s(AV ''B'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (B_1_A t r s tid0)\n    then interpret state: Andrew_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = B_1_A\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (B_1_Na t r s tid0)\n    then interpret state: Andrew_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = B_1_Na\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''1'', s(MV ''Na'' tid0) |}\n            ( K ( s(MV ''A'' tid0) ) ( s(AV ''B'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  qed\n  thus \"Andrew_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext Andrew_state begin\n\n  (* This rule is unsafe in general, but OK here, \n     as we are only reasoning about static compromise. \n  *)\n  lemma static_longterm_key_reveal[dest!]:\n    \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n    by (auto intro: compr_predOrdI)\n\n  lemma longterm_private_key_secrecy:\n    assumes facts:\n      \"SK m : knows t\"\n      \"RLKR m ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"SK m\")\n\n  lemma longterm_sym_ud_key_secrecy:\n    assumes facts:\n      \"K m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"K m1 m2\")\n\n  lemma longterm_sym_bd_key_secrecy:\n    assumes facts:\n      \"Kbd m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n      \"m1 : Agent\"\n      \"m2 : Agent\"\n    shows \"False\"\n  proof -\n    from facts \n    have \"KShr (agents {m1, m2}) : knows t\"\n      by (auto simp: Kbd_def)\n    thus ?thesis using facts\n    proof (sources \"KShr (agents {m1, m2})\")\n    qed (auto simp: agents_def Agent_def)\n  qed\n\n  lemmas ltk_secrecy =\n    longterm_sym_ud_key_secrecy\n    longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n    longterm_sym_bd_key_secrecy\n    longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n    longterm_private_key_secrecy\n    longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection:  Security Properties  *)\n\nlemma (in restricted_Andrew_state) B_sec_Kab:\n  assumes facts:\n    \"roleMap r tid0 = Some B\"\n    \"RLKR(s(AV ''B'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n    \"LN ''Kab'' tid0 : knows t\"\n  shows \"False\"\nusing facts proof(sources! \" LN ''Kab'' tid0 \")\n  case B_4_Kab note_unified facts = this facts\n  thus ?thesis by (auto dest!: ltk_secrecy)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_Andrew_state) A_sec_Kab:\n  assumes facts:\n    \"roleMap r tid0 = Some A\"\n    \"RLKR(s(AV ''A'' tid0)) ~: reveals t\"\n    \"RLKR(s(AV ''B'' tid0)) ~: reveals t\"\n    \"( tid0, A_4 ) : steps t\"\n    \"s(MV ''Kab'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''4'', s(MV ''Kab'' tid0), s(MV ''Nbp'' tid0), LN ''Na'' tid0\n                       |}\n                       ( K ( s(AV ''A'' tid0) ) ( s(AV ''B'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (B_4_enc tid1) note_unified facts = this facts\n    thus ?thesis by (fastforce dest: B_sec_Kab intro: event_predOrdI)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_Andrew_state) A_noninjective_agreement:\n  assumes facts:\n    \"roleMap r tid1 = Some A\"\n    \"RLKR(s(AV ''A'' tid1)) ~: reveals t\"\n    \"RLKR(s(AV ''B'' tid1)) ~: reveals t\"\n    \"( tid1, A_4 ) : steps t\"\n  shows\n    \"(?  tid2.\n        roleMap r tid2 = Some B &\n        s(AV ''A'' tid1) = s(MV ''A'' tid2) &\n        s(AV ''B'' tid1) = s(AV ''B'' tid2) &\n        LN ''Na'' tid1 = s(MV ''Na'' tid2) &\n        s(MV ''Nbp'' tid1) = LN ''Nbp'' tid2 &\n        s(MV ''Kab'' tid1) = LN ''Kab'' tid2)\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''4'', s(MV ''Kab'' tid1), s(MV ''Nbp'' tid1), LN ''Na'' tid1\n                       |}\n                       ( K ( s(AV ''A'' tid1) ) ( s(AV ''B'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (B_4_enc tid2) note_unified facts = this facts\n    thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\n(* text: \nCompared to the original Andrew_Secure_RPC protocol, the nonce Na was \nadded in the last exchange. This allows the modified protocol to achieve\nagreement on the nonce Na which binds the responder to the session of A;\nthereby fixing a freshness flaw.\n *)\n\nlemma (in restricted_Andrew_state) B_noninjective_agreement:\n  assumes facts:\n    \"roleMap r tid1 = Some B\"\n    \"RLKR(s(AV ''B'' tid1)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid1)) ~: reveals t\"\n    \"( tid1, B_3 ) : steps t\"\n  shows\n    \"(?  tid2.\n        roleMap r tid2 = Some A &\n        s(MV ''A'' tid1) = s(AV ''A'' tid2) &\n        s(AV ''B'' tid1) = s(AV ''B'' tid2) &\n        s(MV ''Na'' tid1) = LN ''Na'' tid2 & LN ''Nb'' tid1 = s(MV ''Nb'' tid2))\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''3'', LC ''succ'', LN ''Nb'' tid1 |}\n                       ( K ( s(MV ''A'' tid1) ) ( s(AV ''B'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (A_3_enc tid2) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''2'', {| LC ''succ'', LN ''Na'' tid2 |}, LN ''Nb'' tid1 |}\n                         ( K ( s(AV ''A'' tid2) ) ( s(AV ''B'' tid1) ) ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (auto dest!: ltk_secrecy)\n    next\n      case (B_2_enc tid3) note_unified facts = this facts\n      thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\n(* text: \nThe protocol does not achieve agreement on the key because B cannot check if it\nhas been received.\n *)\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/spore/isabelle-proofs/BAN_modified_Andrew_Secure_RPC_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3167051318389201}}
{"text": "theory TickTock_Basic_Ops\n  imports TickTock_Core\nbegin\n\nsubsection {* Div *}\n\ndefinition DivTT :: \"'e ttobs list set\" (\"div\\<^sub>C\") where\n  \"div\\<^sub>C = {[]}\"\n\nlemma DivTT_wf: \"\\<forall> t\\<in>div\\<^sub>C. ttWF t\"\n  unfolding DivTT_def by auto\n\nlemma TT2_Div: \"TT2 div\\<^sub>C\"\n  using DivTT_wf unfolding DivTT_def by (rule_tac wf_TT2_induct, auto)\n\nlemma TT3w_Div: \"TT3w div\\<^sub>C\"\n  unfolding DivTT_def TT3w_def by auto\n\nlemma TT3_Div: \"TT3 div\\<^sub>C\"\n  by (simp add: DivTT_def TT3_def)\n\nlemma TT_Div: \"TT div\\<^sub>C\"\n  unfolding TT_defs DivTT_def by (auto simp add: tt_prefix_subset_antisym)\n\nsubsection {* Timed Stop *}\n\ndefinition StopTT :: \"'e ttobs list set\" (\"STOP\\<^sub>C\") where\n  \"STOP\\<^sub>C = {t. \\<exists> s\\<in>tocks({x. x \\<noteq> Tock}). t = s \\<or> (\\<exists> X. t = s @ [[X]\\<^sub>R] \\<and> Tock \\<notin> X)}\"\n  (*add_pretocks {x. x \\<noteq> Tock} ({t. \\<exists> Y. Tock \\<notin> Y \\<and> t = [[Y]\\<^sub>R]} \\<union> {[]})*)\n\nlemma StopTT_wf: \"\\<forall> t\\<in>STOP\\<^sub>C. ttWF t\"\n  unfolding StopTT_def apply (auto)\n  by (metis (full_types) mem_Collect_eq tocks_wf, metis (full_types) mem_Collect_eq tocks_append_wf ttWF.simps(2))\n\nlemma TT0_Stop: \"TT0 STOP\\<^sub>C\"\n  unfolding TT0_def StopTT_def by (auto, rule_tac x=\"[]\" in exI, auto simp add: empty_in_tocks)\n\nlemma TT1_Stop: \"TT1 STOP\\<^sub>C\"\n  unfolding TT1_def StopTT_def \n  apply auto\n  apply (smt mem_Collect_eq subsetCE tt_prefix_subset_tocks)\n  using tt_prefix_subset_tocks tt_prefix_subset_tocks_refusal \n  by (smt mem_Collect_eq subsetCE tt_prefix_subset_tocks_refusal2)\n\nlemma TT2w_Stop: \"TT2w STOP\\<^sub>C\"\n  unfolding TT2w_def StopTT_def\nproof auto\n  fix \\<rho> X Y\n  assume \"\\<rho> @ [[X]\\<^sub>R] \\<in> tocks {x. x \\<noteq> Tock}\"\n  then have \"False\"\n    using tocks.cases by (induct \\<rho> rule:ttWF.induct, auto)\n  then show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [[X \\<union> Y]\\<^sub>R] = s \\<or> \\<rho> = s \\<and> Tock \\<notin> X \\<and> Tock \\<notin> Y\"\n    by auto\nnext\n  fix \\<rho> :: \"'a ttobs list\"\n  fix X Y :: \"'a ttevent set\"\n  assume Tock_notin_X: \"Tock \\<notin> X\"\n  assume rho_tocks: \"\\<rho> \\<in> tocks {x. x \\<noteq> Tock}\"\n  from rho_tocks have setA: \"{e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\"\n    using tocks.cases by (auto, induct \\<rho> rule:ttWF.induct, auto)\n  from rho_tocks Tock_notin_X have setB: \"{e. e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {Tock}\"\n    by (auto, intro tocks_append_tocks, auto, metis (mono_tags, lifting) mem_Collect_eq subsetI tocks.empty_in_tocks tocks.tock_insert_in_tocks)\n  from setA setB have \"{e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {Tock}\"\n    by (auto)\n  also assume \"Y \\<inter> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\"\n  then have \"Tock \\<notin> Y\"\n    using calculation by (auto)\n  from this and rho_tocks show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [[X \\<union> Y]\\<^sub>R] = s \\<or> \\<rho> = s \\<and> Tock \\<notin> Y\"\n    by auto\nqed\n\nlemma TT2_Stop: \"TT2 STOP\\<^sub>C\"\nproof (rule_tac wf_TT2_induct, safe, simp_all add: StopTT_wf, unfold StopTT_def, safe, simp_all)\n  fix X Y :: \"'a ttevent set\"\n  assume \"[[X]\\<^sub>R] \\<in> tocks {x. x \\<noteq> Tock}\"\n  then show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. [[X \\<union> Y]\\<^sub>R] = s \\<or> [] = s \\<and> Tock \\<notin> X \\<and> Tock \\<notin> Y\"\n    using refusal_notin_tocks by auto\nnext\n  fix X Y Xa :: \"'a ttevent set\"\n  fix s\n  assume \"Y \\<inter> {e. e \\<noteq> Tock \\<and> [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> [[Xa]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\" \"Tock \\<notin> Xa\"\n  then have \"Tock \\<notin> Y\"\n    by (auto, smt CollectI disjoint_iff_not_equal subsetI tocks.empty_in_tocks tocks.tock_insert_in_tocks)\n  then show \"Tock \\<notin> Xa \\<Longrightarrow> \\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. [[Xa \\<union> Y]\\<^sub>R] = s \\<or> [] = s \\<and> Tock \\<notin> Y\"\n    using tocks.empty_in_tocks by blast\nnext\n  fix X Y :: \"'a ttevent set\"\n  fix \\<sigma>\n  assume assm1: \"Y \\<inter> {e. e \\<noteq> Tock \\<and> [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\"\n  assume assm2: \"[X]\\<^sub>R # [Tock]\\<^sub>E # \\<sigma> \\<in> tocks {x. x \\<noteq> Tock}\"\n  have Tock_notin_X: \"Tock \\<notin> X\"\n    by (metis (full_types) assm2 ttWFx_def ttWFx_tocks ttWFx_trace.simps(3) mem_Collect_eq)\n  have Tock_notin_Y: \"Tock \\<notin> Y\"\n    by (smt Int_def Tock_notin_X assm1 emptyE mem_Collect_eq subset_eq tocks.empty_in_tocks tocks.tock_insert_in_tocks)\n  have \"\\<sigma> \\<in> tocks {x. x \\<noteq> Tock}\"\n    using assm2 tocks.simps by auto\n  then show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. [X \\<union> Y]\\<^sub>R # [Tock]\\<^sub>E # \\<sigma> = s \\<or> (\\<exists>Xa. [X \\<union> Y]\\<^sub>R # [Tock]\\<^sub>E # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\"\n    by (metis (mono_tags, lifting) Tock_notin_X Tock_notin_Y mem_Collect_eq subsetI sup.bounded_iff tocks.tock_insert_in_tocks)\nnext\n  fix X Y Xa :: \"'a ttevent set\"\n  fix \\<sigma> s\n  assume assm1: \"Y \\<inter> {e. e \\<noteq> Tock \\<and> [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\"\n  assume assm2: \"[X]\\<^sub>R # [Tock]\\<^sub>E # \\<sigma> = s @ [[Xa]\\<^sub>R]\"\n  assume assm3: \"s \\<in> tocks {x. x \\<noteq> Tock}\"\n  assume assm4: \"Tock \\<notin> Xa\"\n  obtain s' where s'_assm: \"s = [X]\\<^sub>R # [Tock]\\<^sub>E # s'\"\n    by (metis assm2 butlast.simps(2) butlast_snoc ttobs.distinct(1) last.simps last_snoc list.distinct(1))\n  have Tock_notin_X: \"Tock \\<notin> X\"\n    using assm2 assm3 s'_assm by (auto, metis (full_types) ttWFx_def ttWFx_tocks ttWFx_trace.simps(3) mem_Collect_eq)\n  have Tock_notin_Y: \"Tock \\<notin> Y\"\n    by (smt Int_def Tock_notin_X assm1 emptyE mem_Collect_eq subset_eq tocks.empty_in_tocks tocks.tock_insert_in_tocks)\n  have \"s' \\<in> tocks {x. x \\<noteq> Tock}\"\n    using s'_assm assm3 tocks.cases by auto\n  then show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. [X \\<union> Y]\\<^sub>R # [Tock]\\<^sub>E # \\<sigma> = s \\<or> (\\<exists>Xa. [X \\<union> Y]\\<^sub>R # [Tock]\\<^sub>E # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\"\n    using assm2 assm4 s'_assm apply (rule_tac x=\"[X \\<union> Y]\\<^sub>R # [Tock]\\<^sub>E # s'\" in bexI, auto)\n    by (metis (mono_tags, lifting) Collect_mono Tock_notin_X Tock_notin_Y Un_def tocks.tock_insert_in_tocks)\nnext\n  fix X Y :: \"'a ttevent set\"\n  fix e \\<rho> \\<sigma>\n  assume \"[Event e]\\<^sub>E # \\<rho> @ [X]\\<^sub>R # \\<sigma> \\<in> tocks {x. x \\<noteq> Tock}\"\n  then show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. [Event e]\\<^sub>E # \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. [Event e]\\<^sub>E # \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\"\n    by (simp add: start_event_notin_tocks)\nnext\n  fix X Y Xa :: \"'a ttevent set\"\n  fix e \\<rho> \\<sigma> s\n  assume \"s \\<in> tocks {x. x \\<noteq> Tock}\" \"[Event e]\\<^sub>E # \\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R]\"\n  then have \"\\<exists> s'. [Event e]\\<^sub>E # \\<rho> @ [X]\\<^sub>R # s' \\<in> tocks {x. x \\<noteq> Tock}\"\n    by (metis Nil_is_append_conv butlast.simps(2) butlast_snoc list.distinct(1) start_event_notin_tocks)\n  then show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. [Event e]\\<^sub>E # \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. [Event e]\\<^sub>E # \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\"\n    by (simp add: start_event_notin_tocks)\nnext\n  fix X Y Z :: \"'a ttevent set\"\n  fix \\<rho> \\<sigma>\n  assume ind_hyp: \"(\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [X]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. \\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)) \\<and>\n        Y \\<inter> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {} \\<Longrightarrow>\n        \\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\" \n  assume assm1: \"Y \\<inter> {e. e \\<noteq> Tock \\<and> [Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or>\n                e = Tock \\<and> [Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\"\n  assume assm2: \"[Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [X]\\<^sub>R # \\<sigma> \\<in> tocks {x. x \\<noteq> Tock}\"\n  have 1: \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [X]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. \\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\"\n    using assm2 tocks.cases by auto\n  have 2: \"Y \\<inter> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\"\n    by (smt assm1 assm2 disjoint_iff_not_equal list.distinct(1) list.inject mem_Collect_eq tocks.cases tocks.tock_insert_in_tocks)\n  have \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\"\n    using \"1\" \"2\" ind_hyp by linarith\n  then show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. [Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. [Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\"\n    apply (auto, rule_tac x=\"[Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma>\" in bexI, simp_all, metis assm2 list.inject list.simps(3) tocks.simps)\n    by (smt Nil_is_append_conv append_butlast_last_id assm2 end_refusal_notin_tocks last.simps last_appendR list.distinct(1))\nnext\n  fix X Y Z Xa :: \"'a ttevent set\"\n  fix \\<rho> \\<sigma> s\n  assume ind_hyp: \"(\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [X]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. \\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)) \\<and>\n        Y \\<inter> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {} \\<Longrightarrow>\n        \\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\" \n  assume assm1: \"Y \\<inter> {e. e \\<noteq> Tock \\<and> [Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or>\n                e = Tock \\<and> [Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\"\n  assume assm2: \"[Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R]\"\n  assume assm3: \"s \\<in> tocks {x. x \\<noteq> Tock}\"\n  assume assm4: \"Tock \\<notin> Xa\"\n  have 1: \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [X]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. \\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\"\n    by (smt append_butlast_last_id assm2 assm3 assm4 butlast.simps(2) butlast_snoc last.simps last_snoc list.distinct(1) list.sel(3) tocks.simps)\n  have 2: \"Y \\<inter> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\"\n    by (smt assm1 assm2 assm3 butlast.simps(2) butlast_snoc disjoint_iff_not_equal list.distinct(1) list.inject mem_Collect_eq tocks.simps)\n  have 3: \"\\<exists>s'. s = [Z]\\<^sub>R # [Tock]\\<^sub>E # s'\"\n    using assm2 by (induct s rule:ttWF.induct, auto)\n  have \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\"\n    using \"1\" \"2\" ind_hyp by linarith\n  then show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. [Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>Xa. [Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R] \\<and> Tock \\<notin> Xa)\"\n    apply (auto, rule_tac x=\"[Z]\\<^sub>R # [Tock]\\<^sub>E # \\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma>\" in bexI, simp_all)\n    apply (metis (no_types, lifting) assm2 assm3 butlast.simps(2) butlast_snoc list.distinct(1) list.inject tocks.simps)\n    using 3 by (safe, (rule_tac x=\"[Z]\\<^sub>R # [Tock]\\<^sub>E # sa\" in bexI, simp_all, metis assm3 tt_subset.simps(1) tt_subset.simps(8) list.sel(1) tocks.simps)+)\nqed\n\nlemma ttWFx_Stop: \"ttWFx STOP\\<^sub>C\"\n  unfolding ttWFx_def\nproof (auto)\n  fix x\n  have \"\\<forall>s \\<in> tocks {x. x \\<noteq> Tock}. ttWFx_trace s\"\n    by (metis (mono_tags, lifting) ttWFx_def ttWFx_tocks mem_Collect_eq)\n  then show \"x \\<in> STOP\\<^sub>C \\<Longrightarrow> ttWFx_trace x\"\n    unfolding StopTT_def using ttWFx_append ttWFx_trace.simps(2) ttWF.simps(2) by (auto, blast)\nqed\n\nlemma TT3w_Stop: \"TT3w STOP\\<^sub>C\"\n  unfolding TT3w_def StopTT_def apply auto\n  apply (metis (mono_tags, lifting) TT3w_def TT3w_tocks ttevent.distinct(5) mem_Collect_eq)\n  apply (rule_tac x=\"add_Tick_refusal_trace s\" in bexI, auto)\n  apply (erule_tac x=\"X \\<union> {Tick}\" in allE, auto simp add: add_Tick_refusal_trace_end_refusal)\n  by (metis (mono_tags, lifting) TT3w_def TT3w_tocks ttevent.distinct(5) mem_Collect_eq)\n\nlemma TT3_Stop: \"TT3 STOP\\<^sub>C\"\n  using TT1_Stop TT1_TT3w_equiv_TT3 TT3w_Stop by blast\n\nlemma TT_Stop: \"TT STOP\\<^sub>C\"\n  unfolding TT_defs\nproof (auto)\n  fix x\n  show \"x \\<in> STOP\\<^sub>C \\<Longrightarrow> ttWF x\"\n    using StopTT_wf by auto\nnext\n  show \"STOP\\<^sub>C = {} \\<Longrightarrow> False\"\n    unfolding StopTT_def by (auto, erule_tac x=\"[]\" in allE, erule_tac x=\"[]\" in ballE, auto simp add: empty_in_tocks)\nnext\n  fix \\<rho> \\<sigma>\n  show \"\\<rho> \\<lesssim>\\<^sub>C \\<sigma> \\<Longrightarrow> \\<sigma> \\<in> STOP\\<^sub>C \\<Longrightarrow> \\<rho> \\<in> STOP\\<^sub>C\"\n    unfolding StopTT_def using tt_prefix_subset_tocks tt_prefix_subset_tocks_refusal by (auto, blast, fastforce)\nnext\n  fix \\<rho> X Y\n  show \"\\<rho> @ [[X]\\<^sub>R] \\<in> STOP\\<^sub>C \\<Longrightarrow>\n             Y \\<inter> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> STOP\\<^sub>C \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> STOP\\<^sub>C} = {} \\<Longrightarrow> \\<rho> @ [[X \\<union> Y]\\<^sub>R] \\<in> STOP\\<^sub>C\"\n    unfolding StopTT_def\n  proof auto\n    assume \"\\<rho> @ [[X]\\<^sub>R] \\<in> tocks {x. x \\<noteq> Tock}\"\n    then have \"False\"\n      using tocks.cases by (induct \\<rho> rule:ttWF.induct, auto)\n    then show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [[X \\<union> Y]\\<^sub>R] = s \\<or> \\<rho> = s \\<and> Tock \\<notin> X \\<and> Tock \\<notin> Y\"\n      by auto\n  next\n    assume Tock_notin_X: \"Tock \\<notin> X\"\n    assume rho_tocks: \"\\<rho> \\<in> tocks {x. x \\<noteq> Tock}\"\n    from rho_tocks have setA: \"{e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\"\n      using tocks.cases by (auto, induct \\<rho> rule:ttWF.induct, auto)\n    from rho_tocks Tock_notin_X have setB: \"{e. e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {Tock}\"\n      by (auto, intro tocks_append_tocks, auto, metis (mono_tags, lifting) mem_Collect_eq subsetI tocks.empty_in_tocks tocks.tock_insert_in_tocks)\n    from setA setB have \"{e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {Tock}\"\n      by (auto)\n    also assume \"Y \\<inter> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock} \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}} = {}\"\n    then have \"Tock \\<notin> Y\"\n      using calculation by (auto)\n    from this and rho_tocks show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> @ [[X \\<union> Y]\\<^sub>R] = s \\<or> \\<rho> = s \\<and> Tock \\<notin> Y\"\n      by auto\n  qed\nnext\n  fix x\n  have \"\\<forall>s \\<in> tocks {x. x \\<noteq> Tock}. ttWFx_trace s\"\n    by (metis (mono_tags, lifting) ttWFx_def ttWFx_tocks mem_Collect_eq)\n  then show \"x \\<in> STOP\\<^sub>C \\<Longrightarrow> ttWFx_trace x\"\n    unfolding StopTT_def using ttWFx_append ttWFx_trace.simps(2) ttWF.simps(2) by (auto, blast)\nqed\n\nsubsection {* Untimed Stop *}\n\ndefinition UntimedStopTT :: \"'e ttobs list set\" (\"STOP\\<^sub>U\") where\n  \"STOP\\<^sub>U = {t. t = [] \\<or> (\\<exists> X. t = [[X]\\<^sub>R])}\"\n\nlemma UntimedStopTT_wf: \"\\<forall> t\\<in>STOP\\<^sub>U. ttWF t\"\n  unfolding UntimedStopTT_def by auto\n\nlemma TT2_UntimedStop: \"TT2 STOP\\<^sub>U\"\n  unfolding UntimedStopTT_def TT2_def by (auto simp add: append_eq_Cons_conv)\n\nlemma TT3w_UntimedStop: \"TT3w STOP\\<^sub>U\"\n  unfolding UntimedStopTT_def TT3w_def by auto\n\nlemma TT3_UntimedStop: \"TT3 STOP\\<^sub>U\"\n  by (simp add: TT3_def UntimedStopTT_def append_eq_Cons_conv)\n\nlemma TT_UntimedStop: \"TT STOP\\<^sub>U\"\n  unfolding UntimedStopTT_def TT_defs apply (auto simp add: tt_prefix_subset_antisym)\n  by (metis tt_prefix_subset.simps(2) tt_prefix_subset.simps(4) tt_prefix_subset.simps(6) ttobs.exhaust list.exhaust)\n\nsubsection {* Skip *}\n\ndefinition SkipTT :: \"'e ttobs list set\" (\"SKIP\\<^sub>C\") where\n  \"SKIP\\<^sub>C = {[], [[Tick]\\<^sub>E]}\"\n  (*{[], [[Tick]\\<^sub>E]} \\<union> {t. \\<exists> Y. Tick \\<notin> Y \\<and> t = [[Y]\\<^sub>R]} \\<union> {t. \\<exists> n s. (t = s \\<or> t = s @ [[Tick]\\<^sub>E]) \\<and> s \\<in> ntock {x. x \\<noteq> Tick} n}*)\n\nlemma SkipTT_wf: \"\\<forall> t\\<in>SKIP\\<^sub>C. ttWF t\"\n  unfolding SkipTT_def by auto\n\nlemma TT2_Skip: \"TT2 SKIP\\<^sub>C\"\n  unfolding SkipTT_def TT2_def by (auto, metis Cons_eq_append_conv append_is_Nil_conv ttobs.distinct(1) list.inject list.simps(3))\n\nlemma TT3w_Skip: \"TT3w SKIP\\<^sub>C\"\n  unfolding SkipTT_def TT3w_def by auto\n\nlemma TT3_Skip: \"TT3 SKIP\\<^sub>C\"\n  unfolding SkipTT_def TT3_def by (auto, metis Cons_eq_append_conv append_is_Nil_conv list.inject list.simps(3) ttobs.distinct(1))\n\nlemma TT_Skip: \"TT SKIP\\<^sub>C\"\n  unfolding TT_defs SkipTT_def \n  apply (auto simp add: tt_prefix_subset_antisym)\n  apply (case_tac \\<rho> rule:ttWF.cases, auto)\n  done\n\nsubsection {* Wait *}\n\ndefinition WaitTT :: \"nat \\<Rightarrow> 'e ttobs list set\" (\"wait\\<^sub>C[_]\") where\n  \"wait\\<^sub>C[n] = \n    {t. \\<exists> s\\<in>tocks({x. x \\<noteq> Tock}). length (filter (\\<lambda> x. x = [Tock]\\<^sub>E) s) < n \\<and> (t = s \\<or> (\\<exists> X. Tock \\<notin> X \\<and> t = s @ [[X]\\<^sub>R]))}\n     \\<union> {t. \\<exists> s\\<in>tocks({x. x \\<noteq> Tock}). length (filter (\\<lambda> x. x = [Tock]\\<^sub>E) s) = n \\<and> (t = s \\<or> t = s @ [[Tick]\\<^sub>E])}\"\n  (*{t. \\<exists> s x. t = s @ x \\<and> x \\<in> {[], [[Tick]\\<^sub>E]} \\<and> s \\<in> ntock {x. x \\<noteq> Tock} n}*)\n\nlemma WaitTT_wf: \"\\<forall> t\\<in>wait\\<^sub>C[n]. ttWF t\"\n  unfolding WaitTT_def apply (auto simp add: tocks_wf tocks_append_wf)\n  apply (metis (full_types) mem_Collect_eq tocks_wf)\n  apply (metis (full_types) mem_Collect_eq tocks_append_wf ttWF.simps(2))\n  apply (metis (full_types) mem_Collect_eq tocks_wf)\n  by (metis (full_types) mem_Collect_eq tocks_append_wf ttWF.simps(3))\n\nlemma TT1_Wait: \"TT1 wait\\<^sub>C[n]\"\n  unfolding WaitTT_def TT1_def\nproof auto\n  fix \\<rho> \\<sigma> :: \"'a tttrace\"\n  assume assm1: \"\\<rho> \\<lesssim>\\<^sub>C \\<sigma>\"\n  assume assm2: \"\\<sigma> \\<in> tocks {x. x \\<noteq> Tock}\"\n  assume assm3: \"length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E] < n\"\n  from assm1 assm2 have 1: \"\\<rho> \\<in> {t. \\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. t = s \\<or> (\\<exists>Y. t = s @ [[Y]\\<^sub>R] \\<and> Y \\<subseteq> {x. x \\<noteq> Tock})}\"\n    using tt_prefix_subset_tocks by (smt mem_Collect_eq) \n  from assm1 have \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] \\<le> length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E]\"\n    using tt_prefix_subset_Tock_filter_length by auto\n  from this assm3 have 2: \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] < n\"\n    by auto\n  from 1 2 show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < n \\<and> (\\<rho> = s \\<or> (\\<exists>X. Tock \\<notin> X \\<and> \\<rho> = s @ [[X]\\<^sub>R]))\"\n    by (auto, rule_tac x=\"s\" in bexI, auto)\nnext\n  fix \\<rho> \\<sigma> :: \"'a tttrace\"\n  fix s X\n  assume assm1: \"\\<rho> \\<lesssim>\\<^sub>C s @ [[X]\\<^sub>R]\"\n  assume assm2: \"s \\<in> tocks {x. x \\<noteq> Tock}\"\n  assume assm3: \"length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < n\"\n  assume assm4: \"Tock \\<notin> X\"\n  from assm1 assm2 have 1: \"\\<exists>t\\<in>tocks {x. x \\<noteq> Tock}. \\<rho> = t \\<or> (\\<exists>Z. \\<rho> = t @ [[Z]\\<^sub>R] \\<and> (Z \\<subseteq> {x. x \\<noteq> Tock} \\<or> Z \\<subseteq> X))\"\n    using tt_prefix_subset_tocks_refusal by (metis (mono_tags, lifting) mem_Collect_eq) \n  from assm1 have \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] \\<le> length [x\\<leftarrow>s @ [[X]\\<^sub>R] . x = [Tock]\\<^sub>E]\"\n    using tt_prefix_subset_Tock_filter_length by blast\n  from this assm3 have 2: \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] < n\"\n    by auto\n  from 1 2 assm4 show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < n \\<and> (\\<rho> = s \\<or> (\\<exists>X. Tock \\<notin> X \\<and> \\<rho> = s @ [[X]\\<^sub>R]))\"\n    by (auto, rule_tac x=\"t\" in bexI, auto)\nnext\n  fix \\<rho> \\<sigma> :: \"'a tttrace\"\n  assume assm1: \"\\<rho> \\<lesssim>\\<^sub>C \\<sigma>\"\n  assume assm2: \"\\<sigma> \\<in> tocks {x. x \\<noteq> Tock}\"\n  assume assm3: \"\\<forall>s\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] = length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E] \\<longrightarrow> \\<rho> \\<noteq> s \\<and> \\<rho> \\<noteq> s @ [[Tick]\\<^sub>E]\"\n  thm tt_prefix_subset_tocks\n  from assm1 assm2 have 1: \"\\<rho> \\<in> {t. \\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. t = s \\<or> (\\<exists>Y. t = s @ [[Y]\\<^sub>R] \\<and> Y \\<subseteq> {x. x \\<noteq> Tock})}\"\n    using tt_prefix_subset_tocks by (smt mem_Collect_eq) \n  from assm1 have 2: \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] \\<le> length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E]\"\n    using tt_prefix_subset_Tock_filter_length by auto\n  from equal_Tocks_tocks_imp assm1 assm2 have \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] = length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E] \\<Longrightarrow> \\<rho> \\<in> tocks {x. x \\<noteq> Tock}\"\n    by auto\n  from this assm3 have \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] = length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E] \\<Longrightarrow> False\"\n    by auto\n  from this 2 have 3: \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] < length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E]\"\n    by (cases \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] = length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E]\", auto)\n  from 1 3 show \"\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}.\n     length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E] \\<and> (\\<rho> = s \\<or> (\\<exists>X. Tock \\<notin> X \\<and> \\<rho> = s @ [[X]\\<^sub>R]))\"\n    by (auto, rule_tac x=\"s\" in bexI, auto)\nnext\n  fix \\<rho> \\<sigma> :: \"'a tttrace\"\n  fix s\n  assume assm1: \"\\<rho> \\<lesssim>\\<^sub>C s @ [[Tick]\\<^sub>E]\"\n  assume assm2: \"s \\<in> tocks {x. x \\<noteq> Tock}\"\n  assume assm3: \"\\<forall>sa\\<in>tocks {x. x \\<noteq> Tock}.\n          length [x\\<leftarrow>sa . x = [Tock]\\<^sub>E] = length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] \\<longrightarrow> \\<rho> \\<noteq> sa \\<and> \\<rho> \\<noteq> sa @ [[Tick]\\<^sub>E]\"\n  obtain s' where s'_assms: \"s'\\<in>tocks {x. x \\<noteq> Tock}\" \"s' \\<lesssim>\\<^sub>C s\" \"\\<rho> = s' \\<or>\n            (\\<exists>Y. \\<rho> = s' @ [[Y]\\<^sub>R] \\<and> Y \\<subseteq> {x. x \\<noteq> Tock} \\<and> length [x\\<leftarrow>s' . x = [Tock]\\<^sub>E] < length [x\\<leftarrow>s . x = [Tock]\\<^sub>E]) \\<or>\n            \\<rho> = s' @ [[Tick]\\<^sub>E] \\<and> length [x\\<leftarrow>s' . x = [Tock]\\<^sub>E] = length [x\\<leftarrow>s . x = [Tock]\\<^sub>E]\"\n    using assm1 assm2 tt_prefix_subset_tocks_event[where e=\"Tick\", where X=\"{x. x \\<noteq> Tock}\", where s=s, where t=\\<rho>] by auto\n  then have \"length [x\\<leftarrow>s' . x = [Tock]\\<^sub>E] \\<noteq> length [x\\<leftarrow>s . x = [Tock]\\<^sub>E]\"\n    using assm3 less_le by (metis assm2 equal_Tocks_tocks_imp) \n  then show \"\\<exists>sa\\<in>tocks {x. x \\<noteq> Tock}.\n          length [x\\<leftarrow>sa . x = [Tock]\\<^sub>E] < length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] \\<and> (\\<rho> = sa \\<or> (\\<exists>X. Tock \\<notin> X \\<and> \\<rho> = sa @ [[X]\\<^sub>R]))\"\n    using tt_prefix_subset_Tock_filter_length order.not_eq_order_implies_strict s'_assms by (rule_tac x=\"s'\" in bexI, auto)\nqed\n\nlemma TT2_Wait: \"TT2 wait\\<^sub>C[n]\"\n  unfolding TT2_def\nproof auto\n  fix \\<rho> \\<sigma> :: \"'a ttobs list\"\n  fix X Y :: \"'a ttevent set\"\n  assume assm1: \"\\<rho> @ [X]\\<^sub>R # \\<sigma> \\<in> wait\\<^sub>C[n]\"\n  assume assm2: \"Y \\<inter> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> wait\\<^sub>C[n] \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> wait\\<^sub>C[n]} = {}\"\n  have 1: \"Tock \\<notin> X \\<and> (\\<forall> Z. Tock \\<notin> Z \\<longrightarrow> \\<rho> @ [Z]\\<^sub>R # \\<sigma> \\<in> wait\\<^sub>C[n])\"\n    using assm1 unfolding WaitTT_def\n  proof (auto)\n    show \"\\<rho> @ [X]\\<^sub>R # \\<sigma> \\<in> tocks {x. x \\<noteq> Tock} \\<Longrightarrow> Tock \\<in> X \\<Longrightarrow> False\"\n      using tocks_mid_refusal by fastforce\n  next\n    fix Z\n    assume \"\\<rho> @ [X]\\<^sub>R # \\<sigma> \\<in> tocks {x. x \\<noteq> Tock}\" \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] + length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E] < n\"\n    then show \"Tock \\<notin> Z \\<Longrightarrow>\\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < n \\<and> (\\<rho> @ [Z]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>X. Tock \\<notin> X \\<and> \\<rho> @ [Z]\\<^sub>R # \\<sigma> = s @ [[X]\\<^sub>R]))\"\n      using tocks_mid_refusal_change by (rule_tac x=\"\\<rho> @ [Z]\\<^sub>R # \\<sigma>\" in bexI, auto, fastforce)\n  next\n    fix s Xa\n    assume assm1: \"\\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R]\"\n    assume assm2: \"length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < n\"\n    assume assm3: \"s \\<in> tocks {x. x \\<noteq> Tock}\"\n    assume assm4: \"Tock \\<notin> Xa\"\n    have \"(\\<exists>\\<sigma>'. s = \\<rho> @ [X]\\<^sub>R # \\<sigma>') \\<or> (s = \\<rho> \\<and> X = Xa)\"\n      using assm1 by (metis butlast.simps(2) butlast_append butlast_snoc ttobs.inject(2) last_snoc list.distinct(1))\n    then show \"Tock \\<in> X \\<Longrightarrow> False\"\n      using assm3 assm4 tocks_mid_refusal by fastforce\n  next\n    fix s Xa Z\n    assume assm1: \"\\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R]\"\n    assume assm2: \"length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < n\"\n    assume assm3: \"s \\<in> tocks {x. x \\<noteq> Tock}\"\n    assume assm4: \"Tock \\<notin> Xa\"\n    have \"(\\<exists>\\<sigma>'. s = \\<rho> @ [X]\\<^sub>R # \\<sigma>') \\<or> (s = \\<rho> \\<and> X = Xa)\"\n      using assm1 by (metis butlast.simps(2) butlast_append butlast_snoc ttobs.inject(2) last_snoc list.distinct(1))\n    then show \"Tock \\<notin> Z \\<Longrightarrow> \\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < n \\<and> (\\<rho> @ [Z]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>X. Tock \\<notin> X \\<and> \\<rho> @ [Z]\\<^sub>R # \\<sigma> = s @ [[X]\\<^sub>R]))\"\n      using assm1 assm2 assm3 assm4 apply (auto, rule_tac x=\"\\<rho> @ [Z]\\<^sub>R # \\<sigma>'\" in bexI, auto)\n      using tocks_mid_refusal_change by fastforce\n  next\n    show \"\\<rho> @ [X]\\<^sub>R # \\<sigma> \\<in> tocks {x. x \\<noteq> Tock} \\<Longrightarrow> Tock \\<in> X \\<Longrightarrow> False\"\n      using tocks_mid_refusal by fastforce\n  next\n    fix Z :: \"'a ttevent set\"\n    assume \"\\<rho> @ [X]\\<^sub>R # \\<sigma> \\<in> tocks {x. x \\<noteq> Tock}\" \"n = length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] + length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E]\" \"Tock \\<notin> Z\"\n    then show \"\\<forall>s\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] = length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] + length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E] \\<longrightarrow>\n            \\<rho> @ [Z]\\<^sub>R # \\<sigma> \\<noteq> s \\<and> \\<rho> @ [Z]\\<^sub>R # \\<sigma> \\<noteq> s @ [[Tick]\\<^sub>E] \\<Longrightarrow>\n         \\<exists>s\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] + length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E] \\<and>\n            (\\<rho> @ [Z]\\<^sub>R # \\<sigma> = s \\<or> (\\<exists>X. Tock \\<notin> X \\<and> \\<rho> @ [Z]\\<^sub>R # \\<sigma> = s @ [[X]\\<^sub>R]))\"\n      using tocks_mid_refusal_change by (erule_tac x=\"\\<rho> @ [Z]\\<^sub>R # \\<sigma>\" in ballE, simp_all, fastforce)\n  next\n    fix s\n    assume \"\\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Tick]\\<^sub>E]\"\n    then obtain \\<sigma>' where \"s = \\<rho> @ [X]\\<^sub>R # \\<sigma>'\"\n      by (metis butlast.simps(2) butlast_append butlast_snoc ttobs.distinct(1) last_snoc list.distinct(1))\n    then show \"s \\<in> tocks {x. x \\<noteq> Tock} \\<Longrightarrow> Tock \\<in> X \\<Longrightarrow> False\"\n      using tocks_mid_refusal by fastforce\n  next\n    fix s :: \"'a ttobs list\"\n    fix Z :: \"'a ttevent set\"\n    assume assms: \"s \\<in> tocks {x. x \\<noteq> Tock}\" \"n = length [x\\<leftarrow>s . x = [Tock]\\<^sub>E]\" \"Tock \\<notin> Z\" \"\\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Tick]\\<^sub>E]\"\n    then obtain \\<sigma>' where \"s = \\<rho> @ [X]\\<^sub>R # \\<sigma>'\"\n      by (metis butlast.simps(2) butlast_append butlast_snoc ttobs.distinct(1) last_snoc list.distinct(1))\n    then show \"\\<forall>sa\\<in>tocks {x. x \\<noteq> Tock}.\n              length [x\\<leftarrow>sa . x = [Tock]\\<^sub>E] = length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] \\<longrightarrow> \\<rho> @ [Z]\\<^sub>R # \\<sigma> \\<noteq> sa \\<and> \\<rho> @ [Z]\\<^sub>R # \\<sigma> \\<noteq> sa @ [[Tick]\\<^sub>E] \\<Longrightarrow>\n           \\<exists>sa\\<in>tocks {x. x \\<noteq> Tock}.\n              length [x\\<leftarrow>sa . x = [Tock]\\<^sub>E] < length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] \\<and> (\\<rho> @ [Z]\\<^sub>R # \\<sigma> = sa \\<or> (\\<exists>X. Tock \\<notin> X \\<and> \\<rho> @ [Z]\\<^sub>R # \\<sigma> = sa @ [[X]\\<^sub>R]))\"\n      using assms apply (erule_tac x=\"\\<rho> @ [Z]\\<^sub>R # \\<sigma>'\" in ballE, auto)\n      using tocks_mid_refusal_change by fastforce\n  qed\n  also have \\<rho>_in_tocks: \"\\<rho> \\<in> tocks {x. x \\<noteq> Tock}\"\n    using assm1 unfolding WaitTT_def apply auto\n    using tocks_mid_refusal_front_in_tocks apply blast\n    apply (metis butlast.simps(2) butlast_append butlast_snoc list.distinct(1) tocks_mid_refusal_front_in_tocks)\n    using tocks_mid_refusal_front_in_tocks apply blast\n    by (metis butlast.simps(2) butlast_append butlast_snoc list.distinct(1) tocks_mid_refusal_front_in_tocks)\n  then have \"Tock \\<in> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> wait\\<^sub>C[n] \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> wait\\<^sub>C[n]}\"\n    unfolding WaitTT_def\n  proof auto\n    show \"\\<rho> \\<in> tocks {x. x \\<noteq> Tock} \\<Longrightarrow> \\<rho> @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\<notin> tocks {x. x \\<noteq> Tock} \\<Longrightarrow> False\"\n      by (metis (mono_tags, lifting) calculation mem_Collect_eq subset_eq tocks.simps tocks_append_tocks)\n  next\n    show \"\\<rho> \\<in> tocks {x. x \\<noteq> Tock} \\<Longrightarrow> \\<rho> @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\<notin> tocks {x. x \\<noteq> Tock} \\<Longrightarrow> Suc (length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E]) < n\"\n      by (metis (mono_tags, lifting) CollectI calculation subsetI tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks)\n  next\n    show \"\\<rho> \\<in> tocks {x. x \\<noteq> Tock} \\<Longrightarrow> Suc (length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E]) \\<noteq> n \\<Longrightarrow> \\<rho> @ [[X]\\<^sub>R, [Tock]\\<^sub>E] \\<in> tocks {x. x \\<noteq> Tock}\"\n      by (metis (mono_tags, lifting) calculation mem_Collect_eq subsetI tocks.empty_in_tocks tocks.tock_insert_in_tocks tocks_append_tocks)\n  next\n    show \"\\<rho> \\<in> tocks {x. x \\<noteq> Tock} \\<Longrightarrow> Suc (length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E]) \\<noteq> n \\<Longrightarrow> Suc (length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E]) < n\"\n      using assm1 unfolding WaitTT_def\n    proof auto\n      fix s Xa\n      assume \"\\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Xa]\\<^sub>R]\"\n      then obtain \\<sigma>' where \"s = \\<rho> @ [X]\\<^sub>R # \\<sigma>' \\<or> s = \\<rho>\"\n        by (metis butlast.simps(2) butlast_append butlast_snoc list.distinct(1))\n      then show \"Suc (length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E]) \\<noteq> n \\<Longrightarrow> length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < n \\<Longrightarrow> Suc (length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E]) < n\"\n        by auto\n    next\n      assume \"\\<rho> @ [X]\\<^sub>R # \\<sigma> \\<in> tocks {x. x \\<noteq> Tock}\"\n      then have \"\\<exists> \\<sigma>'. \\<sigma> = [Tock]\\<^sub>E # \\<sigma>'\"\n        by (metis \\<rho>_in_tocks list.inject list.simps(3) tocks.cases tocks_append_nontocks)\n      then show \"Suc 0 \\<noteq> length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E] \\<Longrightarrow> n = length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] + length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E] \\<Longrightarrow> Suc 0 < length [x\\<leftarrow>\\<sigma> . x = [Tock]\\<^sub>E]\"\n        by auto\n    next\n      fix s\n      assume assms: \"\\<rho> @ [X]\\<^sub>R # \\<sigma> = s @ [[Tick]\\<^sub>E]\" \"s \\<in> tocks {x. x \\<noteq> Tock}\"\n      then obtain \\<sigma>' where 1: \"s = \\<rho> @ [X]\\<^sub>R # \\<sigma>'\"\n        by (metis butlast.simps(2) butlast_append butlast_snoc ttobs.distinct(1) last.simps last_appendR list.distinct(1))\n      then have 2: \"\\<exists> \\<sigma>''. \\<sigma>' = [Tock]\\<^sub>E # \\<sigma>''\"\n        by (metis \\<rho>_in_tocks assms(2) list.inject list.simps(3) tocks.cases tocks_append_nontocks)\n      then show \"Suc (length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E]) \\<noteq> length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] \\<Longrightarrow> Suc (length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E]) < length [x\\<leftarrow>s . x = [Tock]\\<^sub>E]\"\n        using 1 by auto\n    qed\n  qed\n  then have \"Tock \\<notin> Y\"\n    using assm2 by auto\n  then show \"\\<rho> @ [X \\<union> Y]\\<^sub>R # \\<sigma> \\<in> wait\\<^sub>C[n]\"\n    using 1 by auto\nqed\n\nlemma TT3w_Wait: \"TT3w (wait\\<^sub>C[n])\"\n  unfolding WaitTT_def TT3w_def\nproof auto\n  fix s :: \"'a ttobs list\"\n  assume \"s \\<in> tocks {x. x \\<noteq> Tock}\" \"length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < n\"\n  then show \"\\<exists>sa\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>sa . x = [Tock]\\<^sub>E] < n \\<and>\n    (add_Tick_refusal_trace s = sa \\<or> (\\<exists>X. Tock \\<notin> X \\<and> add_Tick_refusal_trace s = sa @ [[X]\\<^sub>R]))\"\n  apply (rule_tac x=\"add_Tick_refusal_trace s\" in bexI, auto)\n  apply (metis add_Tick_refusal_trace_filter_Tock_same_length)\n  by (meson TT3w_def TT3w_tocks ttevent.simps(7) mem_Collect_eq)\nnext\n  fix s :: \"'a ttobs list\"\n  fix X :: \"'a ttevent set\"\n  assume \"s \\<in> tocks {x. x \\<noteq> Tock}\" \"length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] < n\" \"Tock \\<notin> X\"\n  then show \"\\<exists>sa\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>sa . x = [Tock]\\<^sub>E] < n \\<and>\n    (add_Tick_refusal_trace (s @ [[X]\\<^sub>R]) = sa \\<or> (\\<exists>Xa. Tock \\<notin> Xa \\<and> add_Tick_refusal_trace (s @ [[X]\\<^sub>R]) = sa @ [[Xa]\\<^sub>R]))\"\n  apply (rule_tac x=\"add_Tick_refusal_trace s\" in bexI, safe, simp_all)\n  apply (metis add_Tick_refusal_trace_filter_Tock_same_length)\n  apply (erule_tac x=\"X \\<union> {Tick}\" in allE, simp add: add_Tick_refusal_trace_end_refusal)\n  by (metis (mono_tags, lifting) TT3w_def TT3w_tocks ttevent.simps(7) mem_Collect_eq)\nnext\n  fix s :: \"'a ttobs list\"\n  assume \"s \\<in> tocks {x. x \\<noteq> Tock}\" \"n = length [x\\<leftarrow>s . x = [Tock]\\<^sub>E]\"\n  then show \"\\<forall>sa\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>sa . x = [Tock]\\<^sub>E] = length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] \\<longrightarrow>\n      add_Tick_refusal_trace s \\<noteq> sa \\<and> add_Tick_refusal_trace s \\<noteq> sa @ [[Tick]\\<^sub>E] \\<Longrightarrow>\n    \\<exists>sa\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>sa . x = [Tock]\\<^sub>E] < length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] \\<and>\n      (add_Tick_refusal_trace s = sa \\<or> (\\<exists>X. Tock \\<notin> X \\<and> add_Tick_refusal_trace s = sa @ [[X]\\<^sub>R]))\"\n    apply (erule_tac x=\"add_Tick_refusal_trace s\" in ballE, safe, simp_all)\n    apply (metis add_Tick_refusal_trace_filter_Tock_same_length)\n    by (meson TT3w_def TT3w_tocks ttevent.simps(7) mem_Collect_eq)\nnext\n  fix s :: \"'a ttobs list\"\n  assume \"s \\<in> tocks {x. x \\<noteq> Tock}\" \"n = length [x\\<leftarrow>s . x = [Tock]\\<^sub>E]\"\n  show \"\\<forall>sa\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>sa . x = [Tock]\\<^sub>E] = length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] \\<longrightarrow>\n      add_Tick_refusal_trace (s @ [[Tick]\\<^sub>E]) \\<noteq> sa \\<and> add_Tick_refusal_trace (s @ [[Tick]\\<^sub>E]) \\<noteq> sa @ [[Tick]\\<^sub>E] \\<Longrightarrow>\n    \\<exists>sa\\<in>tocks {x. x \\<noteq> Tock}. length [x\\<leftarrow>sa . x = [Tock]\\<^sub>E] < length [x\\<leftarrow>s . x = [Tock]\\<^sub>E] \\<and>\n      (add_Tick_refusal_trace (s @ [[Tick]\\<^sub>E]) = sa \\<or> (\\<exists>X. Tock \\<notin> X \\<and> add_Tick_refusal_trace (s @ [[Tick]\\<^sub>E]) = sa @ [[X]\\<^sub>R]))\"\n    apply (erule_tac x=\"add_Tick_refusal_trace s\" in ballE, safe)\n    apply (metis add_Tick_refusal_trace_filter_Tock_same_length)\n    using add_Tick_refusal_trace_end_event apply blast\n    by (metis (mono_tags, lifting) TT3w_def TT3w_tocks \\<open>s \\<in> tocks {x. x \\<noteq> Tock}\\<close> ttevent.simps(7) mem_Collect_eq)\nqed\n\nlemma TT3_Wait: \"TT3 wait\\<^sub>C[n]\"\n  by (simp add: TT1_TT3w_equiv_TT3 TT1_Wait TT3w_Wait)\n\nlemma TT_Wait: \"TT wait\\<^sub>C[n]\"\n  unfolding TT_defs\nproof auto\n  fix x\n  show \"x \\<in> wait\\<^sub>C[n] \\<Longrightarrow> ttWF x\"\n    using WaitTT_wf by auto\nnext\n  show \"wait\\<^sub>C[n] = {} \\<Longrightarrow> False\"\n    unfolding WaitTT_def using tocks.empty_in_tocks by fastforce\nnext\n  fix \\<rho> \\<sigma> :: \"'e ttobs list\"\n  show \"\\<rho> \\<lesssim>\\<^sub>C \\<sigma> \\<Longrightarrow> \\<sigma> \\<in> wait\\<^sub>C[n] \\<Longrightarrow> \\<rho> \\<in> wait\\<^sub>C[n]\"\n    using TT1_Wait TT1_def by blast\nnext\n  fix \\<rho> :: \"'e ttobs list\" \n  fix X Y :: \"'e ttevent set\"\n  assume assm1: \"\\<rho> @ [[X]\\<^sub>R] \\<in> wait\\<^sub>C[n]\"\n  assume assm2: \"Y \\<inter> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> wait\\<^sub>C[n] \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> wait\\<^sub>C[n]} = {}\"\n  from assm1 have 1: \"\\<rho>\\<in>tocks {x. x \\<noteq> Tock}\"\n    unfolding WaitTT_def using end_refusal_notin_tocks by blast\n  from assm1 have 2: \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] < n \\<and> Tock \\<notin> X\"\n    unfolding WaitTT_def using end_refusal_notin_tocks by blast\n  have 3: \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] < n \\<longrightarrow> Tock \\<notin> Y\"\n  proof auto\n    assume assm3: \"length [x\\<leftarrow>\\<rho> . x = [Tock]\\<^sub>E] < n\"\n    assume assm4: \"Tock \\<in> Y\"\n    have \"Tock \\<in> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> wait\\<^sub>C[n] \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> wait\\<^sub>C[n]}\"\n      unfolding WaitTT_def apply auto\n      apply (metis (mono_tags, lifting) \"1\" \"2\" assm3 less_not_refl mem_Collect_eq subset_iff tocks.simps tocks_append_tocks)\n      apply (metis (mono_tags, lifting) \"1\" \"2\" assm3 less_not_refl mem_Collect_eq subset_iff tocks.simps tocks_append_tocks)\n      apply (metis (mono_tags, lifting) \"1\" \"2\" assm3 less_not_refl mem_Collect_eq subset_iff tocks.simps tocks_append_tocks)\n      using Suc_lessI assm3 by blast\n    then have \"Tock \\<in> Y \\<inter> {e. e \\<noteq> Tock \\<and> \\<rho> @ [[e]\\<^sub>E] \\<in> wait\\<^sub>C[n] \\<or> e = Tock \\<and> \\<rho> @ [[X]\\<^sub>R, [e]\\<^sub>E] \\<in> wait\\<^sub>C[n]}\"\n      using assm4 by auto\n    then show \"False\"\n      using assm2 by auto\n  qed\n  show \"\\<rho> @ [[X \\<union> Y]\\<^sub>R] \\<in> wait\\<^sub>C[n]\"\n    using 1 2 3 unfolding WaitTT_def by auto\nnext\n  fix x\n  have \"\\<forall>x \\<in> tocks {x. x \\<noteq> Tock}. ttWFx_trace x\"\n    by (metis (mono_tags, lifting) ttWFx_def ttWFx_tocks mem_Collect_eq)\n  then show \"x \\<in> wait\\<^sub>C[n] \\<Longrightarrow> ttWFx_trace x\"\n    unfolding WaitTT_def apply auto\n    using ttWFx_append ttWFx_trace.simps(2) ttWF.simps(2) apply blast\n    using ttWFx_append ttWFx_trace.simps(2) ttWF.simps(3) apply blast\n    done\nqed\n\nsubsection {* Guard *}\n\ndefinition GuardTT :: \"bool \\<Rightarrow> 'e ttobs list set \\<Rightarrow> 'e ttobs list set\" (infixr \"&\\<^sub>C\" 61) where\n  \"g &\\<^sub>C P = {x\\<in>P. g} \\<union> {x\\<in>STOP\\<^sub>C. \\<not> g}\"\n\nlemma GuardTT_wf: \"\\<forall>t\\<in>P. ttWF t \\<Longrightarrow> \\<forall>t\\<in>(g &\\<^sub>C P). ttWF t\"\n  unfolding GuardTT_def using StopTT_wf by blast\n\nlemma TT0_Guard: \"TT0 P \\<Longrightarrow> TT0 (g &\\<^sub>C P)\"\n  using TT0_Stop unfolding TT0_def GuardTT_def by auto\n\nlemma TT1_Guard: \"TT1 P \\<Longrightarrow> TT1 (g &\\<^sub>C P)\"\n  using TT1_Stop unfolding TT1_def GuardTT_def by auto\n\nlemma TT2w_Guard: \"TT2w P \\<Longrightarrow> TT2w (g &\\<^sub>C P)\"\n  using TT2w_Stop unfolding TT2w_def GuardTT_def by (auto, blast+)\n\nlemma TT2_Guard: \"TT2 P \\<Longrightarrow> TT2 (g &\\<^sub>C P)\"\n  using TT2_Stop unfolding TT2_def GuardTT_def by (auto, blast+)\n\nlemma ttWFx_Guard: \"ttWFx P \\<Longrightarrow> ttWFx (g &\\<^sub>C P)\"\n  using ttWFx_Stop unfolding ttWFx_def GuardTT_def by blast\n\nlemma TT3w_Guard: \"TT3w P \\<Longrightarrow> TT3w (g &\\<^sub>C P)\"\n  using TT3w_Stop unfolding TT3w_def GuardTT_def by blast\n\nlemma TT3_Guard: \"TT3 P \\<Longrightarrow> TT3 (g &\\<^sub>C P)\"\n  by (metis (mono_tags, lifting) GuardTT_def TT3_Stop TT3_def UnE UnI1 UnI2 mem_Collect_eq)\n\nlemma TT_Guard: \"TT P \\<Longrightarrow> TT (g &\\<^sub>C P)\"\n  using GuardTT_wf TT0_Guard TT1_Guard TT2w_Guard ttWFx_Guard  unfolding TT_def GuardTT_def by auto\n\nlemma Guard_Union_dist:\n  \"X \\<noteq> {} \\<Longrightarrow> g &\\<^sub>C \\<Union>X = \\<Union>{P. \\<exists>Q. Q \\<in> X \\<and> P = g &\\<^sub>C Q}\"\n  unfolding GuardTT_def by auto\n\nend\n", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/TickTock/TickTock_Basic_Ops.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3167051318389201}}
{"text": "(*chapter\\<open>Equivalence of Operational and Denotational Semantics\\<close>*)\ntext\\<open>\\chapter[Semantics Equivalence]{Equivalence of the Operational and Denotational Semantics}\\<close>\n\ntheory Corecursive_Prop\n  imports\n    SymbolicPrimitive\n    Operational\n    Denotational\n\nbegin\n\nsection \\<open>Stepwise denotational interpretation of TESL atoms\\<close>\n\ntext \\<open>\n  In order to prove the equivalence of the denotational and operational semantics, \n  we need to be able to ignore the past (for which the constraints are encoded \n  in the context) and consider only the satisfaction of the constraints from\n  a given instant index.\n  For this purpose, we define an interpretation of TESL formulae for a suffix of a run.\n  That interpretation is closely related to the denotational semantics as\n  defined in the preceding chapters.\n\\<close>\nfun TESL_interpretation_atomic_stepwise\n    :: \\<open>('\\<tau>::linordered_field) TESL_atomic \\<Rightarrow> nat \\<Rightarrow> '\\<tau> run set\\<close> (\\<open>\\<lbrakk> _ \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> _\\<^esup>\\<close>)\nwhere\n  \\<open>\\<lbrakk> K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> i\\<^esup> =\n      {\\<rho>. \\<exists>n\\<ge>i. hamlet ((Rep_run \\<rho>) n K\\<^sub>1) \\<and> time ((Rep_run \\<rho>) n K\\<^sub>2) = \\<tau>}\\<close>\n| \\<open>\\<lbrakk> time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> i\\<^esup> =\n      {\\<rho>. \\<forall>n\\<ge>i. R (time ((Rep_run \\<rho>) n K\\<^sub>1), time ((Rep_run \\<rho>) n K\\<^sub>2))}\\<close>\n| \\<open>\\<lbrakk> master implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> i\\<^esup> =\n      {\\<rho>. \\<forall>n\\<ge>i. hamlet ((Rep_run \\<rho>) n master) \\<longrightarrow> hamlet ((Rep_run \\<rho>) n slave)}\\<close>\n| \\<open>\\<lbrakk> master implies not slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> i\\<^esup> =\n      {\\<rho>. \\<forall>n\\<ge>i. hamlet ((Rep_run \\<rho>) n master) \\<longrightarrow> \\<not> hamlet ((Rep_run \\<rho>) n slave)}\\<close>\n| \\<open>\\<lbrakk> master time-delayed by \\<delta>\\<tau> on measuring implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> i\\<^esup> =\n      {\\<rho>. \\<forall>n\\<ge>i. hamlet ((Rep_run \\<rho>) n master) \\<longrightarrow>\n               (let measured_time = time ((Rep_run \\<rho>) n measuring) in\n                \\<forall>m \\<ge> n. first_time \\<rho> measuring m (measured_time + \\<delta>\\<tau>)\n                         \\<longrightarrow> hamlet ((Rep_run \\<rho>) m slave)\n               )\n      }\\<close>\n| \\<open>\\<lbrakk> K\\<^sub>1 weakly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> i\\<^esup> =\n      {\\<rho>. \\<forall>n\\<ge>i. (run_tick_count \\<rho> K\\<^sub>2 n) \\<le> (run_tick_count \\<rho> K\\<^sub>1 n)}\\<close>\n| \\<open>\\<lbrakk> K\\<^sub>1 strictly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> i\\<^esup> =\n      {\\<rho>. \\<forall>n\\<ge>i. (run_tick_count \\<rho> K\\<^sub>2 n) \\<le> (run_tick_count_strictly \\<rho> K\\<^sub>1 n)}\\<close>\n| \\<open>\\<lbrakk> K\\<^sub>1 kills K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> i\\<^esup> =\n      {\\<rho>. \\<forall>n\\<ge>i. hamlet ((Rep_run \\<rho>) n K\\<^sub>1) \\<longrightarrow> (\\<forall>m\\<ge>n. \\<not> hamlet ((Rep_run \\<rho>) m K\\<^sub>2))}\\<close>\n\ntext \\<open>\n  The denotational interpretation of TESL formulae can be unfolded into the \n  stepwise interpretation.\n\\<close>\nlemma TESL_interp_unfold_stepwise_sporadicon:\n  \\<open>\\<lbrakk> K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L = \\<Union> {Y. \\<exists>n::nat. Y = \\<lbrakk> K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>}\\<close>\nby auto\n\nlemma TESL_interp_unfold_stepwise_tagrelgen:\n  \\<open>\\<lbrakk> time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\n    = \\<Inter> {Y. \\<exists>n::nat. Y = \\<lbrakk> time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>}\\<close>\nby auto\n\nlemma TESL_interp_unfold_stepwise_implies:\n  \\<open>\\<lbrakk> master implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\n    = \\<Inter> {Y. \\<exists>n::nat. Y = \\<lbrakk> master implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>}\\<close>\nby auto\n\nlemma TESL_interp_unfold_stepwise_implies_not:\n  \\<open>\\<lbrakk> master implies not slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\n    = \\<Inter> {Y. \\<exists>n::nat. Y = \\<lbrakk> master implies not slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>}\\<close>\nby auto\n\nlemma TESL_interp_unfold_stepwise_timedelayed:\n  \\<open>\\<lbrakk> master time-delayed by \\<delta>\\<tau> on measuring implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\n    = \\<Inter> {Y. \\<exists>n::nat.\n          Y = \\<lbrakk> master time-delayed by \\<delta>\\<tau> on measuring implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>}\\<close>\nby auto\n\nlemma TESL_interp_unfold_stepwise_weakly_precedes:\n  \\<open>\\<lbrakk> K\\<^sub>1 weakly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\n    = \\<Inter> {Y. \\<exists>n::nat. Y = \\<lbrakk> K\\<^sub>1 weakly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>}\\<close>\nby auto\n\nlemma TESL_interp_unfold_stepwise_strictly_precedes:\n  \\<open>\\<lbrakk> K\\<^sub>1 strictly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\n    = \\<Inter> {Y. \\<exists>n::nat. Y = \\<lbrakk> K\\<^sub>1 strictly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>}\\<close>\nby auto\n\nlemma TESL_interp_unfold_stepwise_kills:\n  \\<open>\\<lbrakk> master kills slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L = \\<Inter> {Y. \\<exists>n::nat. Y = \\<lbrakk> master kills slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>}\\<close>\nby auto\n\ntext \\<open>\n  Positive atomic formulae (the ones that create ticks from nothing) are unfolded\n  as the union of the stepwise interpretations.\n\\<close>\ntheorem TESL_interp_unfold_stepwise_positive_atoms:\n  assumes \\<open>positive_atom \\<phi>\\<close>\n    shows \\<open>\\<lbrakk> \\<phi>::'\\<tau>::linordered_field TESL_atomic \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\n            = \\<Union> {Y. \\<exists>n::nat. Y = \\<lbrakk> \\<phi> \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>}\\<close>\nproof -\n  from positive_atom.elims(2)[OF assms]\n    obtain u v w where \\<open>\\<phi> = (u sporadic v on w)\\<close> by blast\n  with TESL_interp_unfold_stepwise_sporadicon show ?thesis by simp\nqed\n\ntext \\<open>\n  Negative atomic formulae are unfolded\n  as the intersection of the stepwise interpretations.\n\\<close>\ntheorem TESL_interp_unfold_stepwise_negative_atoms:\n  assumes \\<open>\\<not> positive_atom \\<phi>\\<close>\n    shows \\<open>\\<lbrakk> \\<phi> \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L = \\<Inter> {Y. \\<exists>n::nat. Y = \\<lbrakk> \\<phi> \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>}\\<close>\nproof (cases \\<phi>)\n  case SporadicOn thus ?thesis using assms by simp\nnext\n  case TagRelation\n    thus ?thesis using TESL_interp_unfold_stepwise_tagrelgen by simp\nnext\n  case Implies\n    thus ?thesis using TESL_interp_unfold_stepwise_implies by simp\nnext\n  case ImpliesNot\n    thus ?thesis using TESL_interp_unfold_stepwise_implies_not by simp\nnext\n  case TimeDelayedBy\n    thus ?thesis using TESL_interp_unfold_stepwise_timedelayed by simp\nnext\n  case WeaklyPrecedes\n    thus ?thesis\n      using TESL_interp_unfold_stepwise_weakly_precedes by simp\nnext\n  case StrictlyPrecedes\n    thus ?thesis\n      using TESL_interp_unfold_stepwise_strictly_precedes by simp\nnext\n  case Kills\n    thus ?thesis\n      using TESL_interp_unfold_stepwise_kills by simp\nqed\n\ntext \\<open>\n  Some useful lemmas for reasoning on properties of sequences.\n\\<close>\nlemma forall_nat_expansion:\n  \\<open>(\\<forall>n \\<ge> (n\\<^sub>0::nat). P n) = (P n\\<^sub>0 \\<and> (\\<forall>n \\<ge> Suc n\\<^sub>0. P n))\\<close>\nproof -\n  have \\<open>(\\<forall>n \\<ge> (n\\<^sub>0::nat). P n) = (\\<forall>n. (n = n\\<^sub>0 \\<or> n > n\\<^sub>0) \\<longrightarrow> P n)\\<close>\n    using le_less by blast\n  also have \\<open>... = (P n\\<^sub>0 \\<and> (\\<forall>n > n\\<^sub>0. P n))\\<close> by blast\n  finally show ?thesis using Suc_le_eq by simp\nqed\n\nlemma exists_nat_expansion:\n  \\<open>(\\<exists>n \\<ge> (n\\<^sub>0::nat). P n) = (P n\\<^sub>0 \\<or> (\\<exists>n \\<ge> Suc n\\<^sub>0. P n))\\<close>\nproof -\n  have \\<open>(\\<exists>n \\<ge> (n\\<^sub>0::nat). P n) = (\\<exists>n. (n = n\\<^sub>0 \\<or> n > n\\<^sub>0) \\<and> P n)\\<close>\n    using le_less by blast\n  also have \\<open>... = (\\<exists>n. (P n\\<^sub>0) \\<or> (n > n\\<^sub>0 \\<and> P n))\\<close> by blast\n  finally show ?thesis using Suc_le_eq by simp\nqed\n\n\n\nlemma exists_nat_set_suc:\\<open>{x. \\<exists>m \\<ge> n. P x m} = {x. P x n} \\<union> {x. \\<exists>m \\<ge> Suc n. P x m}\\<close>\nproof\n  { fix x assume h:\\<open>x \\<in> {x. \\<exists>m \\<ge> n. P x m}\\<close>\n    hence \\<open>x \\<in> {x. \\<exists>m. (m = n \\<or> m \\<ge> Suc n) \\<and> P x m}\\<close>\n      using Suc_le_eq antisym_conv2 by fastforce\n    hence \\<open>x \\<in> {x. P x n} \\<union> {x. \\<exists>m \\<ge> Suc n. P x m}\\<close> by blast\n  } thus \\<open>{x. \\<exists>m \\<ge> n. P x m} \\<subseteq> {x. P x n} \\<union> {x. \\<exists>m \\<ge> Suc n. P x m}\\<close> ..\nnext\n  { fix x  assume h:\\<open>x \\<in> {x. P x n} \\<union> {x. \\<exists>m \\<ge> Suc n. P x m}\\<close>\n    hence \\<open>x \\<in> {x. \\<exists>m \\<ge> n. P x m}\\<close> using Suc_leD by blast\n  } thus \\<open>{x. P x n} \\<union> {x. \\<exists>m \\<ge> Suc n. P x m} \\<subseteq> {x. \\<exists>m \\<ge> n. P x m}\\<close> ..\nqed\n\nsection \\<open>Coinduction Unfolding Properties\\<close>\n\ntext \\<open>\n  The following lemmas show how  to shorten a suffix, i.e. to unfold one instant \n  in the construction of a run. They correspond to the rules of the operational \n  semantics.\n\\<close>\nlemma TESL_interp_stepwise_sporadicon_coind_unfold:\n  \\<open>\\<lbrakk> K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> =\n    \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>2 \\<Down> n @ \\<tau> \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m        \\<comment> \\<open>rule @{term sporadic_on_e2}\\<close>\n    \\<union> \\<lbrakk> K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>   \\<comment> \\<open>rule @{term sporadic_on_e1}\\<close>\nunfolding TESL_interpretation_atomic_stepwise.simps(1)\n          symbolic_run_interpretation_primitive.simps(1,6)\nusing exists_nat_set_suc[of \\<open>n\\<close> \\<open>\\<lambda>\\<rho> n. hamlet (Rep_run \\<rho> n K\\<^sub>1)\n                                     \\<and> time (Rep_run \\<rho> n K\\<^sub>2) = \\<tau>\\<close>]\nby (simp add: Collect_conj_eq)\n\n\nlemma TESL_interp_stepwise_tagrel_coind_unfold:\n  \\<open>\\<lbrakk> time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> =        \\<comment> \\<open>rule @{term tagrel_e}\\<close>\n     \\<lbrakk> \\<lfloor>\\<tau>\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>1, n), \\<tau>\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>2, n)\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n     \\<inter> \\<lbrakk> time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\nproof -\n  have \\<open>{\\<rho>. \\<forall>m\\<ge>n. R (time ((Rep_run \\<rho>) m K\\<^sub>1), time ((Rep_run \\<rho>) m K\\<^sub>2))}\n       = {\\<rho>. R (time ((Rep_run \\<rho>) n K\\<^sub>1), time ((Rep_run \\<rho>) n K\\<^sub>2))}\n       \\<inter> {\\<rho>. \\<forall>m\\<ge>Suc n. R (time ((Rep_run \\<rho>) m K\\<^sub>1), time ((Rep_run \\<rho>) m K\\<^sub>2))}\\<close>\n    using forall_nat_set_suc[of \\<open>n\\<close> \\<open>\\<lambda>x y. R (time ((Rep_run x) y K\\<^sub>1),\n                                       time ((Rep_run x) y K\\<^sub>2))\\<close>] by simp\n  thus ?thesis by auto\nqed\n\nlemma TESL_interp_stepwise_implies_coind_unfold:\n  \\<open>\\<lbrakk> master implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> =\n     (   \\<lbrakk> master \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m                     \\<comment> \\<open>rule @{term implies_e1}\\<close>\n       \\<union> \\<lbrakk> master \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> slave \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m)  \\<comment> \\<open>rule @{term implies_e2}\\<close>\n     \\<inter> \\<lbrakk> master implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\nproof -\n  have \\<open>{\\<rho>. \\<forall>m\\<ge>n. hamlet ((Rep_run \\<rho>) m master) \\<longrightarrow> hamlet ((Rep_run \\<rho>) m slave)}\n        = {\\<rho>. hamlet ((Rep_run \\<rho>) n master) \\<longrightarrow> hamlet ((Rep_run \\<rho>) n slave)}\n        \\<inter> {\\<rho>. \\<forall>m\\<ge>Suc n. hamlet ((Rep_run \\<rho>) m master)\n                     \\<longrightarrow> hamlet ((Rep_run \\<rho>) m slave)}\\<close>\n    using forall_nat_set_suc[of \\<open>n\\<close> \\<open>\\<lambda>x y. hamlet ((Rep_run x) y master)\n                                \\<longrightarrow> hamlet ((Rep_run x) y slave)\\<close>] by simp\n  thus ?thesis by auto\nqed\n\nlemma TESL_interp_stepwise_implies_not_coind_unfold:\n  \\<open>\\<lbrakk> master implies not slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> =\n     (    \\<lbrakk> master \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m                       \\<comment> \\<open>rule @{term implies_not_e1}\\<close>\n        \\<union> \\<lbrakk> master \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> slave \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m)  \\<comment> \\<open>rule @{term implies_not_e2}\\<close>\n     \\<inter> \\<lbrakk> master implies not slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\nproof -\n  have \\<open>{\\<rho>. \\<forall>m\\<ge>n. hamlet ((Rep_run \\<rho>) m master) \\<longrightarrow> \\<not> hamlet ((Rep_run \\<rho>) m slave)}\n       = {\\<rho>. hamlet ((Rep_run \\<rho>) n master) \\<longrightarrow> \\<not> hamlet ((Rep_run \\<rho>) n slave)}\n          \\<inter> {\\<rho>. \\<forall>m\\<ge>Suc n. hamlet ((Rep_run \\<rho>) m master)\n                     \\<longrightarrow> \\<not> hamlet ((Rep_run \\<rho>) m slave)}\\<close>\n    using forall_nat_set_suc[of \\<open>n\\<close> \\<open>\\<lambda>x y. hamlet ((Rep_run x) y master)\n                               \\<longrightarrow> \\<not>hamlet ((Rep_run x) y slave)\\<close>] by simp\n  thus ?thesis by auto\nqed\n\nlemma TESL_interp_stepwise_timedelayed_coind_unfold:\n  \\<open>\\<lbrakk> master time-delayed by \\<delta>\\<tau> on measuring implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> =\n     (     \\<lbrakk> master \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m               \\<comment> \\<open>rule @{term timedelayed_e1}\\<close>\n        \\<union> (\\<lbrakk> master \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> measuring @ n \\<oplus> \\<delta>\\<tau> \\<Rightarrow> slave \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m))\n                                             \\<comment> \\<open>rule @{term timedelayed_e2}\\<close>\n     \\<inter> \\<lbrakk> master time-delayed by \\<delta>\\<tau> on measuring implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\nproof -\n  let ?prop = \\<open>\\<lambda>\\<rho> m. hamlet ((Rep_run \\<rho>) m master) \\<longrightarrow>\n                 (let measured_time = time ((Rep_run \\<rho>) m measuring) in\n                  \\<forall>p \\<ge> m. first_time \\<rho> measuring p (measured_time + \\<delta>\\<tau>)\n                           \\<longrightarrow> hamlet ((Rep_run \\<rho>) p slave))\\<close>\n  have \\<open>{\\<rho>. \\<forall>m \\<ge> n. ?prop \\<rho> m} = {\\<rho>. ?prop \\<rho> n} \\<inter> {\\<rho>. \\<forall>m \\<ge> Suc n. ?prop \\<rho> m}\\<close>\n    using forall_nat_set_suc[of \\<open>n\\<close> ?prop] by blast\n  also have \\<open>... = {\\<rho>. ?prop \\<rho> n}\n              \\<inter> \\<lbrakk> master time-delayed by \\<delta>\\<tau> on measuring implies slave \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  finally show ?thesis by auto\nqed\n\nlemma TESL_interp_stepwise_weakly_precedes_coind_unfold:\n   \\<open>\\<lbrakk> K\\<^sub>1 weakly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> =                 \\<comment> \\<open>rule @{term weakly_precedes_e}\\<close>\n      \\<lbrakk> (\\<lceil>#\\<^sup>\\<le> K\\<^sub>2 n, #\\<^sup>\\<le> K\\<^sub>1 n\\<rceil> \\<in> (\\<lambda>(x,y). x\\<le>y)) \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \n      \\<inter> \\<lbrakk> K\\<^sub>1 weakly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\nproof -\n  have \\<open>{\\<rho>. \\<forall>p\\<ge>n. (run_tick_count \\<rho> K\\<^sub>2 p) \\<le> (run_tick_count \\<rho> K\\<^sub>1 p)}\n         = {\\<rho>. (run_tick_count \\<rho> K\\<^sub>2 n) \\<le> (run_tick_count \\<rho> K\\<^sub>1 n)}\n         \\<inter> {\\<rho>. \\<forall>p\\<ge>Suc n. (run_tick_count \\<rho> K\\<^sub>2 p) \\<le> (run_tick_count \\<rho> K\\<^sub>1 p)}\\<close>\n    using forall_nat_set_suc[of \\<open>n\\<close> \\<open>\\<lambda>\\<rho> n. (run_tick_count \\<rho> K\\<^sub>2 n)\n                                  \\<le> (run_tick_count \\<rho> K\\<^sub>1 n)\\<close>]\n    by simp\n  thus ?thesis by auto\nqed\n\nlemma TESL_interp_stepwise_strictly_precedes_coind_unfold:\n   \\<open>\\<lbrakk> K\\<^sub>1 strictly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> =               \\<comment> \\<open>rule @{term strictly_precedes_e}\\<close>\n      \\<lbrakk> (\\<lceil>#\\<^sup>\\<le> K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\<rceil> \\<in> (\\<lambda>(x,y). x\\<le>y)) \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n      \\<inter> \\<lbrakk> K\\<^sub>1 strictly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\nproof -\n  have \\<open>{\\<rho>. \\<forall>p\\<ge>n. (run_tick_count \\<rho> K\\<^sub>2 p) \\<le> (run_tick_count_strictly \\<rho> K\\<^sub>1 p)}\n         = {\\<rho>. (run_tick_count \\<rho> K\\<^sub>2 n) \\<le> (run_tick_count_strictly \\<rho> K\\<^sub>1 n)}\n         \\<inter> {\\<rho>. \\<forall>p\\<ge>Suc n. (run_tick_count \\<rho> K\\<^sub>2 p) \\<le> (run_tick_count_strictly \\<rho> K\\<^sub>1 p)}\\<close>\n    using forall_nat_set_suc[of \\<open>n\\<close> \\<open>\\<lambda>\\<rho> n. (run_tick_count \\<rho> K\\<^sub>2 n)\n                                  \\<le> (run_tick_count_strictly \\<rho> K\\<^sub>1 n)\\<close>]\n    by simp\n  thus ?thesis by auto\nqed\n\nlemma TESL_interp_stepwise_kills_coind_unfold:\n   \\<open>\\<lbrakk> K\\<^sub>1 kills K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> =\n      (   \\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m                        \\<comment> \\<open>rule @{term kills_e1}\\<close>\n        \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>2 \\<not>\\<Up> \\<ge> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m)    \\<comment> \\<open>rule @{term kills_e2}\\<close>\n      \\<inter> \\<lbrakk> K\\<^sub>1 kills K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\nproof -\n  let ?kills = \\<open>\\<lambda>n \\<rho>. \\<forall>p\\<ge>n. hamlet ((Rep_run \\<rho>) p K\\<^sub>1)\n                             \\<longrightarrow> (\\<forall>m\\<ge>p. \\<not> hamlet ((Rep_run \\<rho>) m K\\<^sub>2))\\<close>\n  let ?ticks = \\<open>\\<lambda>n \\<rho> c. hamlet ((Rep_run \\<rho>) n c)\\<close>\n  let ?dead = \\<open>\\<lambda>n \\<rho> c. \\<forall>m \\<ge> n. \\<not>hamlet ((Rep_run \\<rho>) m c)\\<close>\n  have \\<open>\\<lbrakk> K\\<^sub>1 kills K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> = {\\<rho>. ?kills n \\<rho>}\\<close> by simp\n  also have \\<open>... = ({\\<rho>. \\<not> ?ticks n \\<rho> K\\<^sub>1}  \\<inter> {\\<rho>. ?kills (Suc n) \\<rho>})\n                 \\<union> ({\\<rho>. ?ticks n \\<rho> K\\<^sub>1} \\<inter> {\\<rho>. ?dead n \\<rho> K\\<^sub>2})\\<close>\n  proof\n    { fix \\<rho>::\\<open>'\\<tau>::linordered_field run\\<close>\n      assume \\<open>\\<rho> \\<in> {\\<rho>. ?kills n \\<rho>}\\<close>\n      hence \\<open>?kills n \\<rho>\\<close> by simp\n      hence \\<open>(?ticks n \\<rho> K\\<^sub>1 \\<and> ?dead n \\<rho> K\\<^sub>2) \\<or> (\\<not>?ticks n \\<rho> K\\<^sub>1 \\<and> ?kills (Suc n) \\<rho>)\\<close>\n        using Suc_leD by blast\n      hence \\<open>\\<rho> \\<in> ({\\<rho>. ?ticks n \\<rho> K\\<^sub>1} \\<inter> {\\<rho>. ?dead n \\<rho> K\\<^sub>2})\n               \\<union> ({\\<rho>. \\<not> ?ticks n \\<rho> K\\<^sub>1} \\<inter> {\\<rho>. ?kills (Suc n) \\<rho>})\\<close>\n        by blast\n    } thus \\<open>{\\<rho>. ?kills n \\<rho>}\n           \\<subseteq> {\\<rho>. \\<not> ?ticks n \\<rho> K\\<^sub>1} \\<inter> {\\<rho>. ?kills (Suc n) \\<rho>} \n            \\<union> {\\<rho>. ?ticks n \\<rho> K\\<^sub>1} \\<inter> {\\<rho>. ?dead n \\<rho> K\\<^sub>2}\\<close> by blast\n  next\n    { fix \\<rho>::\\<open>'\\<tau>::linordered_field run\\<close>\n      assume \\<open>\\<rho> \\<in> ({\\<rho>. \\<not> ?ticks n \\<rho> K\\<^sub>1}  \\<inter> {\\<rho>. ?kills (Suc n) \\<rho>})\n                 \\<union> ({\\<rho>. ?ticks n \\<rho> K\\<^sub>1} \\<inter> {\\<rho>. ?dead n \\<rho> K\\<^sub>2})\\<close>\n      hence \\<open>\\<not> ?ticks n \\<rho> K\\<^sub>1 \\<and> ?kills (Suc n) \\<rho>\n             \\<or> ?ticks n \\<rho> K\\<^sub>1 \\<and> ?dead n \\<rho> K\\<^sub>2\\<close> by blast\n      moreover have \\<open>((\\<not> ?ticks n \\<rho> K\\<^sub>1) \\<and> (?kills (Suc n) \\<rho>)) \\<longrightarrow> ?kills n \\<rho>\\<close>\n        using dual_order.antisym not_less_eq_eq by blast\n      ultimately have \\<open>?kills n \\<rho> \\<or> ?ticks n \\<rho> K\\<^sub>1 \\<and> ?dead n \\<rho> K\\<^sub>2\\<close> by blast\n      hence \\<open>?kills n \\<rho>\\<close> using le_trans by blast\n    } thus \\<open>({\\<rho>. \\<not> ?ticks n \\<rho> K\\<^sub>1}  \\<inter> {\\<rho>. ?kills (Suc n) \\<rho>})\n                 \\<union> ({\\<rho>. ?ticks n \\<rho> K\\<^sub>1} \\<inter> {\\<rho>. ?dead n \\<rho> K\\<^sub>2})\n          \\<subseteq> {\\<rho>. ?kills n \\<rho>}\\<close> by blast\n  qed\n  also have \\<open>... = {\\<rho>. \\<not> ?ticks n \\<rho> K\\<^sub>1} \\<inter> {\\<rho>. ?kills (Suc n) \\<rho>}\n                 \\<union> {\\<rho>. ?ticks n \\<rho> K\\<^sub>1} \\<inter> {\\<rho>. ?dead n \\<rho> K\\<^sub>2} \\<inter> {\\<rho>. ?kills (Suc n) \\<rho>}\\<close>\n    using Collect_cong Collect_disj_eq by auto\n  also have \\<open>... = \\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>1 kills K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\n                 \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>2 \\<not>\\<Up> \\<ge> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n                 \\<inter> \\<lbrakk> K\\<^sub>1 kills K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  finally show ?thesis by blast\nqed\n\ntext \\<open>\n  The stepwise interpretation of a TESL formula is the intersection of the\n  interpretation of its atomic components.\n\\<close>\nfun TESL_interpretation_stepwise\n  ::\\<open>'\\<tau>::linordered_field TESL_formula \\<Rightarrow> nat \\<Rightarrow> '\\<tau> run set\\<close>\n  (\\<open>\\<lbrakk>\\<lbrakk> _ \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> _\\<^esup>\\<close>)\nwhere\n  \\<open>\\<lbrakk>\\<lbrakk> [] \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> = {\\<rho>. True}\\<close>\n| \\<open>\\<lbrakk>\\<lbrakk> \\<phi> # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> = \\<lbrakk> \\<phi> \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\\<close>\n\nlemma TESL_interpretation_stepwise_fixpoint:\n  \\<open>\\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> = \\<Inter> ((\\<lambda>\\<phi>. \\<lbrakk> \\<phi> \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>) ` set \\<Phi>)\\<close>\nby (induction \\<Phi>, simp, auto)\n\ntext \\<open>\n  The global interpretation of a TESL formula is its interpretation starting\n  at the first instant.\n\\<close>\nlemma TESL_interpretation_stepwise_zero:\n  \\<open>\\<lbrakk> \\<phi> \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L = \\<lbrakk> \\<phi> \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> 0\\<^esup>\\<close>\nby (induction \\<phi>, simp+)\n\n\n\nlemma TESL_interpretation_stepwise_cons_morph:\n  \\<open>\\<lbrakk> \\<phi> \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> = \\<lbrakk>\\<lbrakk> \\<phi> # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\\<close>\nby auto\n\ntheorem TESL_interp_stepwise_composition:\n  shows \\<open>\\<lbrakk>\\<lbrakk> \\<Phi>\\<^sub>1 @ \\<Phi>\\<^sub>2 \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> = \\<lbrakk>\\<lbrakk> \\<Phi>\\<^sub>1 \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi>\\<^sub>2 \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\\<close>\nby (induction \\<Phi>\\<^sub>1, simp, auto)\n\nsection \\<open>Interpretation of configurations\\<close>\n\ntext \\<open>\n  The interpretation of a configuration of the operational semantics abstract \n  machine is the intersection of:\n  \\<^item> the interpretation of its context (the past),\n  \\<^item> the interpretation of its present from the current instant,\n  \\<^item> the interpretation of its future from the next instant.\n\\<close>\nfun HeronConf_interpretation\n  ::\\<open>'\\<tau>::linordered_field config \\<Rightarrow> '\\<tau> run set\\<close>          (\\<open>\\<lbrakk> _ \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close> 71)\nwhere\n  \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n\nlemma HeronConf_interp_composition:\n   \\<open>\\<lbrakk> \\<Gamma>\\<^sub>1, n \\<turnstile> \\<Psi>\\<^sub>1 \\<triangleright> \\<Phi>\\<^sub>1 \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g \\<inter> \\<lbrakk> \\<Gamma>\\<^sub>2, n \\<turnstile> \\<Psi>\\<^sub>2 \\<triangleright> \\<Phi>\\<^sub>2 \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n     = \\<lbrakk> (\\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2), n \\<turnstile> (\\<Psi>\\<^sub>1 @ \\<Psi>\\<^sub>2) \\<triangleright> (\\<Phi>\\<^sub>1 @ \\<Phi>\\<^sub>2) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close>\n  using TESL_interp_stepwise_composition symrun_interp_expansion\nby (simp add: TESL_interp_stepwise_composition\n              symrun_interp_expansion inf_assoc inf_left_commute)\n\ntext \\<open>\n  When there are no remaining constraints on the present, the interpretation of\n  a configuration is the same as the configuration at the next instant of its future.\n  This corresponds to the introduction rule of the operational semantics.\n\\<close>\nlemma HeronConf_interp_stepwise_instant_cases:\n   \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> [] \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g = \\<lbrakk> \\<Gamma>, Suc n \\<turnstile> \\<Phi> \\<triangleright> [] \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close>\nproof -\n  have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> [] \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> [] \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  moreover have \\<open>\\<lbrakk> \\<Gamma>, Suc n \\<turnstile> \\<Phi> \\<triangleright> [] \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                  = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> [] \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  moreover have \\<open>\\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> [] \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\n                 = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> [] \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  ultimately show ?thesis by blast\nqed\n\ntext \\<open>\n  The following lemmas use the unfolding properties of the stepwise denotational \n  semantics to give rewriting rules for the interpretation of configurations that\n  match the elimination rules of the operational semantics.\n\\<close>\nlemma HeronConf_interp_stepwise_sporadicon_cases:\n   \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n    = \\<lbrakk> \\<Gamma>, n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n    \\<union> \\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<Down> n @ \\<tau>) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close>\nproof -\n  have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> (K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2) # \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n        = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  moreover have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                 =  \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                  \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  moreover have \\<open>\\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<Down> n @ \\<tau>) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                 =  \\<lbrakk>\\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<Down> n @ \\<tau>) # \\<Gamma>) \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n                  \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  ultimately show ?thesis\n  proof -\n    have \\<open>(\\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>2 \\<Down> n @ \\<tau> \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>)\n            \\<inter> (\\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>)\n          = \\<lbrakk> K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> (\\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m)\\<close>\n      using TESL_interp_stepwise_sporadicon_coind_unfold by blast\n    hence \\<open>\\<lbrakk>\\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<Down> n @ \\<tau>) # \\<Gamma>) \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n            \\<union> \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk> K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\n           = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 sporadic \\<tau> on K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\\<close> by auto\n    thus ?thesis by auto\n  qed\nqed\n\nlemma HeronConf_interp_stepwise_tagrel_cases:\n   \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n    = \\<lbrakk> ((\\<lfloor>\\<tau>\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>1, n), \\<tau>\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>2, n)\\<rfloor> \\<in> R) # \\<Gamma>), n\n        \\<turnstile> \\<Psi> \\<triangleright> ((time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close>\nproof -\n  have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> (time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R) # \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n        = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n        \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  moreover have \\<open>\\<lbrakk> ((\\<lfloor>\\<tau>\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>1, n), \\<tau>\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>2, n)\\<rfloor> \\<in> R) # \\<Gamma>), n\n                  \\<turnstile> \\<Psi> \\<triangleright> ((time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                 = \\<lbrakk>\\<lbrakk> (\\<lfloor>\\<tau>\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>1, n), \\<tau>\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>2, n)\\<rfloor> \\<in> R) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                 \\<inter> \\<lbrakk>\\<lbrakk> (time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  ultimately show ?thesis\n  proof -\n    have \\<open>\\<lbrakk> \\<lfloor>\\<tau>\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>1, n), \\<tau>\\<^sub>v\\<^sub>a\\<^sub>r(K\\<^sub>2, n)\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n          \\<inter> \\<lbrakk> time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\n          \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> = \\<lbrakk>\\<lbrakk> (time-relation \\<lfloor>K\\<^sub>1, K\\<^sub>2\\<rfloor> \\<in> R) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\\<close>\n      using TESL_interp_stepwise_tagrel_coind_unfold\n            TESL_interpretation_stepwise_cons_morph by blast\n    thus ?thesis by auto\n  qed\nqed\n\nlemma HeronConf_interp_stepwise_implies_cases:\n   \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((K\\<^sub>1 implies K\\<^sub>2) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n      = \\<lbrakk> ((K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 implies K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n      \\<union> \\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 implies K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close>\nproof -\n  have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> (K\\<^sub>1 implies K\\<^sub>2) # \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n        = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 implies K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  moreover have \\<open>\\<lbrakk> ((K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 implies K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 implies K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  moreover have \\<open>\\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 implies K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                =  \\<lbrakk>\\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<Up> n) # \\<Gamma>) \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                 \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 implies K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  ultimately show ?thesis\n  proof -\n    have f1: \\<open>(\\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>2 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m)\n                \\<inter> \\<lbrakk> K\\<^sub>1 implies K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup> \\<inter> (\\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>)\n              = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 implies K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n      using TESL_interp_stepwise_implies_coind_unfold\n            TESL_interpretation_stepwise_cons_morph by blast\n    have \\<open>\\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>2 \\<Up> n) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n         = (\\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>2 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m) \\<inter> \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\\<close>\n      by force\n    hence \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((K\\<^sub>1 implies K\\<^sub>2) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n      = (\\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>2 \\<Up> n) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m)\n        \\<inter> (\\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 implies K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>)\\<close>\n      using f1 by (simp add: inf_left_commute inf_assoc)\n    thus ?thesis by (simp add: Int_Un_distrib2 inf_assoc)\n  qed\nqed\n\nlemma HeronConf_interp_stepwise_implies_not_cases:\n   \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((K\\<^sub>1 implies not K\\<^sub>2) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n      = \\<lbrakk> ((K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 implies not K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n      \\<union> \\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<not>\\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 implies not K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close>\nproof -\n  have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> (K\\<^sub>1 implies not K\\<^sub>2) # \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n        = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 implies not K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  moreover have \\<open>\\<lbrakk> ((K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 implies not K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                  = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                  \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 implies not K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  moreover have \\<open>\\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<not>\\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 implies not K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                  = \\<lbrakk>\\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<not>\\<Up> n) # \\<Gamma>) \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                  \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 implies not K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  ultimately show ?thesis\n  proof -\n    have f1: \\<open>(\\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>2 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m)\n              \\<inter> \\<lbrakk> K\\<^sub>1 implies not K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\n              \\<inter> (\\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>)\n              = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 implies not K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n      using TESL_interp_stepwise_implies_not_coind_unfold\n            TESL_interpretation_stepwise_cons_morph by blast\n    have \\<open>\\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>2 \\<not>\\<Up> n) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n           = (\\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>2 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m) \\<inter> \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\\<close>\n      by force\n    then have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((K\\<^sub>1 implies not K\\<^sub>2) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                 = (\\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n                    \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>2 \\<not>\\<Up> n) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m) \\<inter> (\\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                    \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 implies not K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>)\\<close>\n      using f1 by (simp add: inf_left_commute inf_assoc)\n    thus ?thesis by (simp add: Int_Un_distrib2 inf_assoc)\n  qed\nqed\n\nlemma HeronConf_interp_stepwise_timedelayed_cases:\n  \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n    = \\<lbrakk> ((K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n    \\<union> \\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 @ n \\<oplus> \\<delta>\\<tau> \\<Rightarrow> K\\<^sub>3) # \\<Gamma>), n\n        \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close>\nproof -\n  have 1:\\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> (K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n         = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n          \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  moreover have \\<open>\\<lbrakk> ((K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma>), n\n                  \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                 = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                  \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  moreover have \\<open>\\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 @ n \\<oplus> \\<delta>\\<tau> \\<Rightarrow> K\\<^sub>3) # \\<Gamma>), n\n                  \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                 = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 @ n \\<oplus> \\<delta>\\<tau> \\<Rightarrow> K\\<^sub>3) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                  \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  ultimately show ?thesis\n  proof -\n    have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> (K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n      = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> (\\<lbrakk>\\<lbrakk> (K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n        \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>)\\<close>\n      using 1 by blast\n    hence \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> (K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n          = (\\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>2 @ n \\<oplus> \\<delta>\\<tau> \\<Rightarrow> K\\<^sub>3 \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m)\n            \\<inter> (\\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> (\\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n            \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>))\\<close>\n      using TESL_interpretation_stepwise_cons_morph\n            TESL_interp_stepwise_timedelayed_coind_unfold\n    proof -\n      have \\<open>\\<lbrakk>\\<lbrakk> (K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n            = (\\<lbrakk> K\\<^sub>1 \\<not>\\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> K\\<^sub>1 \\<Up> n \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> K\\<^sub>2 @ n \\<oplus> \\<delta>\\<tau> \\<Rightarrow> K\\<^sub>3 \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m)\n            \\<inter> \\<lbrakk> K\\<^sub>1 time-delayed by \\<delta>\\<tau> on K\\<^sub>2 implies K\\<^sub>3 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\\<close>\n        using TESL_interp_stepwise_timedelayed_coind_unfold\n              TESL_interpretation_stepwise_cons_morph by blast\n      then show ?thesis\n        by (simp add: Int_assoc Int_left_commute)\n    qed\n    then show ?thesis by (simp add: inf_assoc inf_sup_distrib2)\n  qed\nqed\n\nlemma HeronConf_interp_stepwise_weakly_precedes_cases:\n   \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n    = \\<lbrakk> ((\\<lceil>#\\<^sup>\\<le> K\\<^sub>2 n, #\\<^sup>\\<le> K\\<^sub>1 n\\<rceil> \\<in> (\\<lambda>(x,y). x\\<le>y)) # \\<Gamma>), n\n      \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close>\nproof -\n  have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> (K\\<^sub>1 weakly precedes K\\<^sub>2) # \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n        = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 weakly precedes K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n          \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  moreover have \\<open>\\<lbrakk> ((\\<lceil>#\\<^sup>\\<le> K\\<^sub>2 n, #\\<^sup>\\<le> K\\<^sub>1 n\\<rceil> \\<in> (\\<lambda>(x,y). x\\<le>y)) # \\<Gamma>), n\n                  \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 weakly precedes K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                = \\<lbrakk>\\<lbrakk> (\\<lceil>#\\<^sup>\\<le> K\\<^sub>2 n, #\\<^sup>\\<le> K\\<^sub>1 n\\<rceil> \\<in> (\\<lambda>(x,y). x\\<le>y)) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n                \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 weakly precedes K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  ultimately show ?thesis\n  proof -\n    have \\<open>\\<lbrakk> \\<lceil>#\\<^sup>\\<le> K\\<^sub>2 n, #\\<^sup>\\<le> K\\<^sub>1 n\\<rceil> \\<in> (\\<lambda>(x,y). x\\<le>y) \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n            \\<inter> \\<lbrakk> K\\<^sub>1 weakly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n          = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 weakly precedes K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\\<close>\n      using TESL_interp_stepwise_weakly_precedes_coind_unfold\n            TESL_interpretation_stepwise_cons_morph by blast\n    thus ?thesis by auto\n  qed\nqed\n\nlemma HeronConf_interp_stepwise_strictly_precedes_cases:\n   \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n    = \\<lbrakk> ((\\<lceil>#\\<^sup>\\<le> K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\<rceil> \\<in> (\\<lambda>(x,y). x\\<le>y)) # \\<Gamma>), n\n      \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close>\nproof -\n  have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> (K\\<^sub>1 strictly precedes K\\<^sub>2) # \\<Psi> \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n        = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 strictly precedes K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n          \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  moreover have \\<open>\\<lbrakk> ((\\<lceil>#\\<^sup>\\<le> K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\<rceil> \\<in> (\\<lambda>(x,y). x\\<le>y)) # \\<Gamma>), n\n                  \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 strictly precedes K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                = \\<lbrakk>\\<lbrakk> (\\<lceil>#\\<^sup>\\<le> K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\<rceil> \\<in> (\\<lambda>(x,y). x\\<le>y)) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n                \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 strictly precedes K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  ultimately show ?thesis\n  proof -\n    have \\<open>\\<lbrakk> \\<lceil>#\\<^sup>\\<le> K\\<^sub>2 n, #\\<^sup>< K\\<^sub>1 n\\<rceil> \\<in> (\\<lambda>(x,y). x\\<le>y) \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m\n            \\<inter> \\<lbrakk> K\\<^sub>1 strictly precedes K\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n          = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 strictly precedes K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\\<close>\n      using TESL_interp_stepwise_strictly_precedes_coind_unfold\n            TESL_interpretation_stepwise_cons_morph by blast\n    thus ?thesis by auto\n  qed\nqed\n\nlemma HeronConf_interp_stepwise_kills_cases:\n   \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((K\\<^sub>1 kills K\\<^sub>2) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n    = \\<lbrakk> ((K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 kills K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n    \\<union> \\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<not>\\<Up> \\<ge> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 kills K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\\<close>\nproof -\n  have \\<open>\\<lbrakk> \\<Gamma>, n \\<turnstile> ((K\\<^sub>1 kills K\\<^sub>2) # \\<Psi>) \\<triangleright> \\<Phi> \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n        = \\<lbrakk>\\<lbrakk> \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 kills K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close>\n    by simp\n  moreover have \\<open>\\<lbrakk> ((K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 kills K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 \\<not>\\<Up> n) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                  \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 kills K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  moreover have \\<open>\\<lbrakk> ((K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<not>\\<Up> \\<ge> n) # \\<Gamma>), n \\<turnstile> \\<Psi> \\<triangleright> ((K\\<^sub>1 kills K\\<^sub>2) # \\<Phi>) \\<rbrakk>\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>f\\<^sub>i\\<^sub>g\n                = \\<lbrakk>\\<lbrakk> (K\\<^sub>1 \\<Up> n) # (K\\<^sub>2 \\<not>\\<Up> \\<ge> n) # \\<Gamma> \\<rbrakk>\\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n                  \\<inter> \\<lbrakk>\\<lbrakk> (K\\<^sub>1 kills K\\<^sub>2) # \\<Phi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup>\\<close> by simp\n  ultimately show ?thesis\n    proof -\n      have \\<open>\\<lbrakk>\\<lbrakk> (K\\<^sub>1 kills K\\<^sub>2) # \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\n            = (\\<lbrakk> (K\\<^sub>1 \\<not>\\<Up> n) \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<union> \\<lbrakk> (K\\<^sub>1 \\<Up> n) \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m \\<inter> \\<lbrakk> (K\\<^sub>2 \\<not>\\<Up> \\<ge> n) \\<rbrakk>\\<^sub>p\\<^sub>r\\<^sub>i\\<^sub>m)\n              \\<inter> \\<lbrakk> (K\\<^sub>1 kills K\\<^sub>2) \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> Suc n\\<^esup> \\<inter> \\<lbrakk>\\<lbrakk> \\<Psi> \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<^bsup>\\<ge> n\\<^esup>\\<close>\n        using TESL_interp_stepwise_kills_coind_unfold\n              TESL_interpretation_stepwise_cons_morph by blast\n      thus ?thesis by auto\n    qed\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/TESL_Language/Corecursive_Prop.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3166402226127737}}
{"text": "(*<*)\n(*\n * Copyright 2015, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory CIMP_vcg\nimports\n  CIMP_lang\nbegin\n\n(*>*)\nsection\\<open> State-based invariants \\label{sec:cimp-invariants} \\<close>\n\ntext\\<open>\n\nWe provide a simple-minded verification condition generator (VCG) for this language, providing\nsupport for establishing state-based invariants. It is just one way of reasoning about CIMP programs\nand is proven sound wrt to the CIMP semantics.\n\nOur approach follows @{cite [cite_macro=citet]\n\"DBLP:journals/acta/Lamport80\" and \"DBLP:journals/toplas/LamportS84\"}\n(and the later @{cite [cite_macro=citet] \"Lamport:2002\"}) and closely\nrelated work by @{cite [cite_macro=citet] \"AptFrancezDeRoever:1980\"},\n@{cite [cite_macro=citet] \"CousotCousot:1980\"} and @{cite\n[cite_macro=citet] \"DBLP:journals/acta/LevinG81\"}, who suggest the\nincorporation of a history variable. @{cite [cite_macro=citet]\n\"CousotCousot:1980\"} apparently contains a completeness proof.\nLamport mentions that this technique was well-known in the mid-80s\nwhen he proposed the use of prophecy variables\\footnote{@{url\n\"https://lamport.azurewebsites.net/pubs/pubs.html\"}}. See also @{cite\n[cite_macro=citet] \"deRoeverEtAl:2001\"} for an extended discussion of\nsome of this.\n\n\\<close>\n\ndeclare small_step.intros[intro]\n\ninductive_cases small_step_inv:\n  \"(\\<lbrace>l\\<rbrace> Request action val # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(\\<lbrace>l\\<rbrace> Response action # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(\\<lbrace>l\\<rbrace> LocalOp R # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(\\<lbrace>l\\<rbrace> IF b THEN c FI # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(\\<lbrace>l\\<rbrace> IF b THEN c1 ELSE c2 FI # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(\\<lbrace>l\\<rbrace> WHILE b DO c OD # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(LOOP DO c OD # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n\nlemma small_step_stuck:\n  \"\\<not> ([], s) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> c'\"\nby (auto elim: small_step.cases)\n\ndeclare system_step.intros[intro]\n\ntext\\<open>\n\nBy default we ask the simplifier to rewrite @{const \"atS\"} using\nambient @{const \"AT\"} information.\n\n\\<close>\n\nlemma atS_state_weak_cong[cong]:\n  \"AT s p = AT s' p \\<Longrightarrow> atS p ls s \\<longleftrightarrow> atS p ls s'\"\nby (auto simp: atS_def)\n\ntext\\<open>\n\nWe provide an incomplete set of basic rules for label sets.\n\n\\<close>\n\nlemma atS_simps:\n  \"\\<not>atS p {} s\"\n  \"atS p {l} s \\<longleftrightarrow> at p l s\"\n  \"\\<lbrakk>at p l s; l \\<in> ls\\<rbrakk> \\<Longrightarrow> atS p ls s\"\n  \"(\\<forall>l. at p l s \\<longrightarrow> l \\<notin> ls) \\<Longrightarrow> \\<not>atS p ls s\"\nby (auto simp: atS_def)\n\nlemma atS_mono:\n  \"\\<lbrakk>atS p ls s; ls \\<subseteq> ls'\\<rbrakk> \\<Longrightarrow> atS p ls' s\"\nby (auto simp: atS_def)\n\nlemma atS_un:\n  \"atS p (l \\<union> l') s \\<longleftrightarrow> atS p l s \\<or> atS p l' s\"\nby (auto simp: atS_def)\n\nlemma atLs_disj_union[simp]:\n  \"(atLs p label0 \\<^bold>\\<or> atLs p label1) = atLs p (label0 \\<union> label1)\"\nunfolding atLs_def by simp\n\nlemma atLs_insert_disj:\n  \"atLs p (insert l label0) = (atL p l \\<^bold>\\<or> atLs p label0)\"\nby simp\n\nlemma small_step_terminated:\n  \"s \\<rightarrow>\\<^bsub>x\\<^esub> s' \\<Longrightarrow> atCs (fst s) = {} \\<Longrightarrow> atCs (fst s') = {}\"\nby (induct pred: small_step) auto\n\nlemma atC_not_empty:\n  \"atC c \\<noteq> {}\"\nby (induct c) auto\n\nlemma atCs_empty:\n  \"atCs cs = {} \\<longleftrightarrow> cs = []\"\nby (induct cs) (auto simp: atC_not_empty)\n\nlemma terminated_no_commands:\n  assumes \"terminated p sh\"\n  shows \"\\<exists>s. GST sh p = ([], s)\"\nusing assms unfolding atLs_def AT_def by (metis atCs_empty prod.collapse singletonD)\n\nlemma terminated_GST_stable:\n  assumes \"system_step q sh' sh\"\n  assumes \"terminated p sh\"\n  shows \"GST sh p = GST sh' p\"\nusing assms by (auto dest!: terminated_no_commands simp: small_step_stuck elim!: system_step.cases)\n\nlemma terminated_stable:\n  assumes \"system_step q sh' sh\"\n  assumes \"terminated p sh\"\n  shows \"terminated p sh'\"\nusing assms unfolding atLs_def AT_def\nby (fastforce split: if_splits prod.splits\n               dest: small_step_terminated\n              elim!: system_step.cases)\n\nlemma system_step_pls_nonempty:\n  assumes \"system_step pls sh' sh\"\n  shows \"pls \\<noteq> {}\"\nusing assms by cases simp_all\n\nlemma system_step_no_change:\n  assumes \"system_step ps sh' sh\"\n  assumes \"p \\<notin> ps\"\n  shows \"GST sh' p = GST sh p\"\nusing assms by cases simp_all\n\nlemma initial_stateD:\n  assumes \"initial_state sys s\"\n  shows \"AT (\\<lparr>GST = s, HST = []\\<rparr>) = atC \\<circ> PGMs sys \\<and> INIT sys (\\<lparr>GST = s, HST = []\\<rparr>)\\<down> \\<and> (\\<forall>p l. \\<not>taken p l \\<lparr>GST = s, HST = []\\<rparr>)\"\nusing assms unfolding initial_state_def split_def o_def LST_def AT_def taken_def by simp\n\nlemma initial_states_initial[iff]:\n  assumes \"initial_state sys s\"\n  shows \"at p l (\\<lparr>GST = s, HST = []\\<rparr>) \\<longleftrightarrow> l \\<in> atC (PGMs sys p)\"\nusing assms unfolding initial_state_def split_def AT_def by simp\n\ndefinition\n  reachable_state :: \"('answer, 'location, 'proc, 'question, 'state, 'ext) pre_system_ext\n                    \\<Rightarrow> ('answer, 'location, 'proc, 'question, 'state) state_pred\"\nwhere\n  \"reachable_state sys s \\<longleftrightarrow> (\\<exists>\\<sigma> i. prerun sys \\<sigma> \\<and> \\<sigma> i = s)\"\n\nlemma reachable_stateE:\n  assumes \"reachable_state sys sh\"\n  assumes \"\\<And>\\<sigma> i. prerun sys \\<sigma> \\<Longrightarrow> P (\\<sigma> i)\"\n  shows \"P sh\"\nusing assms unfolding reachable_state_def by blast\n\nlemma prerun_reachable_state:\n  assumes \"prerun sys \\<sigma>\"\n  shows \"reachable_state sys (\\<sigma> i)\"\nusing assms unfolding prerun_def LTL.defs system_step_reflclp_def reachable_state_def by auto\n\nlemma reachable_state_induct[consumes 1, case_names init LocalStep CommunicationStep, induct set: reachable_state]:\n  assumes r: \"reachable_state sys sh\"\n  assumes i: \"\\<And>s. initial_state sys s \\<Longrightarrow> P \\<lparr>GST = s, HST = []\\<rparr>\"\n  assumes l: \"\\<And>sh ls' p. \\<lbrakk>reachable_state sys sh; P sh; GST sh p \\<rightarrow>\\<^bsub>\\<tau>\\<^esub> ls'\\<rbrakk> \\<Longrightarrow> P \\<lparr>GST = (GST sh)(p := ls'), HST = HST sh\\<rparr>\"\n  assumes c: \"\\<And>sh ls1' ls2' p1 p2 \\<alpha> \\<beta>.\n                 \\<lbrakk>reachable_state sys sh; P sh;\n                 GST sh p1 \\<rightarrow>\\<^bsub>\\<guillemotleft>\\<alpha>, \\<beta>\\<guillemotright>\\<^esub> ls1'; GST sh p2 \\<rightarrow>\\<^bsub>\\<guillemotright>\\<alpha>, \\<beta>\\<guillemotleft>\\<^esub> ls2'; p1 \\<noteq> p2 \\<rbrakk>\n                    \\<Longrightarrow> P \\<lparr>GST = (GST sh)(p1 := ls1', p2 := ls2'), HST = HST sh @ [(\\<alpha>, \\<beta>)]\\<rparr>\"\n  shows \"P sh\"\nusing r\nproof(rule reachable_stateE)\n  fix \\<sigma> i assume \"prerun sys \\<sigma>\" show \"P (\\<sigma> i)\"\n  proof(induct i)\n    case 0 from \\<open>prerun sys \\<sigma>\\<close> show ?case\n      unfolding prerun_def by (metis (full_types) i old.unit.exhaust system_state.surjective)\n  next\n    case (Suc i) with \\<open>prerun sys \\<sigma>\\<close> show ?case\nunfolding prerun_def LTL.defs system_step_reflclp_def reachable_state_def\napply clarsimp\napply (drule_tac x=i in spec)\napply (erule disjE; clarsimp)\napply (erule system_step.cases; clarsimp)\n apply (metis (full_types) \\<open>prerun sys \\<sigma>\\<close> l old.unit.exhaust prerun_reachable_state system_state.surjective)\napply (metis (full_types) \\<open>prerun sys \\<sigma>\\<close> c old.unit.exhaust prerun_reachable_state system_state.surjective)\ndone\n  qed\nqed\n\nlemma prerun_valid_TrueI:\n  shows \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> \\<langle>True\\<rangle>\"\nunfolding prerun_valid_def by simp\n\nlemma prerun_valid_conjI:\n  assumes \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> P\"\n  assumes \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> Q\"\n  shows \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> P \\<^bold>\\<and> Q\"\nusing assms unfolding prerun_valid_def always_def by simp\n\nlemma valid_prerun_lift:\n  assumes \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> I\"\n  shows \"sys \\<Turnstile> \\<box>\\<lceil>I\\<rceil>\"\nusing assms unfolding prerun_valid_def valid_def run_def by blast\n\nlemma prerun_valid_induct:\n  assumes \"\\<And>\\<sigma>. prerun sys \\<sigma> \\<Longrightarrow> \\<lceil>I\\<rceil> \\<sigma>\"\n  assumes \"\\<And>\\<sigma>. prerun sys \\<sigma> \\<Longrightarrow> (\\<lceil>I\\<rceil> \\<^bold>\\<hookrightarrow> (\\<circle>\\<lceil>I\\<rceil>)) \\<sigma>\"\n  shows \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> I\"\nunfolding prerun_valid_def using assms by (simp add: always_induct)\n\nlemma prerun_validI:\n  assumes \"\\<And>s. reachable_state sys s \\<Longrightarrow> I s\"\n  shows \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> I\"\nunfolding prerun_valid_def using assms by (simp add: alwaysI prerun_reachable_state)\n\nlemma prerun_validE:\n  assumes \"reachable_state sys s\"\n  assumes \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> I\"\n  shows \"I s\"\nusing assms unfolding prerun_valid_def\nby (metis alwaysE reachable_stateE suffix_state_prop)\n\n\nsubsubsection\\<open>Relating reachable states to the initial programs \\label{sec:cimp-decompose-small-step}\\<close>\n\ntext\\<open>\n\nTo usefully reason about the control locations presumably embedded in\nthe single global invariant, we need to link the programs we have in\nreachable state \\<open>s\\<close> to the programs in the initial states. The\n\\<open>fragments\\<close> function decomposes the program into statements\nthat can be directly executed (\\S\\ref{sec:cimp-decompose}). We also\ncompute the locations we could be at after executing that statement as\na function of the process's local state.\n\nEliding the bodies of \\<open>IF\\<close> and \\<open>WHILE\\<close> statements\nyields smaller (but equivalent) proof obligations.\n\n\\<close>\n\ntype_synonym  ('answer, 'location, 'question, 'state) loc_comp\n  = \"'state \\<Rightarrow> 'location set\"\n\nfun lconst :: \"'location set \\<Rightarrow> ('answer, 'location, 'question, 'state) loc_comp\" where\n  \"lconst lp s = lp\"\n\ndefinition lcond :: \"'location set \\<Rightarrow> 'location set \\<Rightarrow> 'state bexp\n                   \\<Rightarrow> ('answer, 'location, 'question, 'state) loc_comp\" where\n  \"lcond lp lp' b s = (if b s then lp else lp')\"\n\nlemma lcond_split:\n  \"Q (lcond lp lp' b s) \\<longleftrightarrow> (b s \\<longrightarrow> Q lp) \\<and> (\\<not>b s \\<longrightarrow> Q lp')\"\nunfolding lcond_def by (simp split: if_splits)\n\nlemma lcond_split_asm:\n  \"Q (lcond lp lp' b s) \\<longleftrightarrow> \\<not> ((b s \\<and> \\<not>Q lp) \\<or> (\\<not>b s \\<and> \\<not> Q lp'))\"\nunfolding lcond_def by (simp split: if_splits)\n\nlemmas lcond_splits = lcond_split lcond_split_asm\n\nfun\n  fragments :: \"('answer, 'location, 'question, 'state) com\n              \\<Rightarrow> 'location set\n              \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n               \\<times> ('answer, 'location, 'question, 'state) loc_comp ) set\"\nwhere\n  \"fragments (\\<lbrace>l\\<rbrace> IF b THEN c FI) aft\n       = { (\\<lbrace>l\\<rbrace> IF b THEN c' FI, lcond (atC c) aft b) |c'. True }\n        \\<union> fragments c aft\"\n| \"fragments (\\<lbrace>l\\<rbrace> IF b THEN c1 ELSE c2 FI) aft\n       = { (\\<lbrace>l\\<rbrace> IF b THEN c1' ELSE c2' FI, lcond (atC c1) (atC c2) b) |c1' c2'. True }\n        \\<union> fragments c1 aft \\<union> fragments c2 aft\"\n| \"fragments (LOOP DO c OD) aft = fragments c (atC c)\"\n| \"fragments (\\<lbrace>l\\<rbrace> WHILE b DO c OD) aft\n       =  fragments c {l} \\<union> { (\\<lbrace>l\\<rbrace> WHILE b DO c' OD, lcond (atC c) aft b) |c'. True }\"\n| \"fragments (c1;; c2) aft = fragments c1 (atC c2) \\<union> fragments c2 aft\"\n| \"fragments (c1 \\<oplus> c2) aft = fragments c1 aft \\<union> fragments c2 aft\"\n| \"fragments c aft = { (c, lconst aft) }\"\n\nfun\n  fragmentsL :: \"('answer, 'location, 'question, 'state) com list\n               \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                 \\<times> ('answer, 'location, 'question, 'state) loc_comp ) set\"\nwhere\n  \"fragmentsL [] = {}\"\n| \"fragmentsL [c] = fragments c {}\"\n| \"fragmentsL (c # c' # cs) = fragments c (atC c') \\<union> fragmentsL (c' # cs)\"\n\nabbreviation\n  fragmentsLS :: \"('answer, 'location, 'question, 'state) local_state\n               \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                 \\<times> ('answer, 'location, 'question, 'state) loc_comp ) set\"\nwhere\n  \"fragmentsLS s \\<equiv> fragmentsL (cPGM s)\"\n\ntext\\<open>\n\nWe show that taking system steps preserves fragments.\n\n\\<close>\n\nlemma small_step_fragmentsLS:\n  assumes \"s \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> s'\"\n  shows \"fragmentsLS s' \\<subseteq> fragmentsLS s\"\nusing assms by induct (case_tac [!] cs, auto)\n\nlemma reachable_state_fragmentsLS:\n  assumes \"reachable_state sys sh\"\n  shows \"fragmentsLS (GST sh p) \\<subseteq> fragments (PGMs sys p) {}\"\nusing assms\nby (induct rule: reachable_state_induct)\n   (auto simp: initial_state_def dest: subsetD[OF small_step_fragmentsLS])\n\ninductive\n  basic_com :: \"('answer, 'location, 'question, 'state) com \\<Rightarrow> bool\"\nwhere\n  \"basic_com (\\<lbrace>l\\<rbrace> Request action val)\"\n| \"basic_com (\\<lbrace>l\\<rbrace> Response action)\"\n| \"basic_com (\\<lbrace>l\\<rbrace> LocalOp R)\"\n| \"basic_com (\\<lbrace>l\\<rbrace> IF b THEN c FI)\"\n| \"basic_com (\\<lbrace>l\\<rbrace> IF b THEN c1 ELSE c2 FI)\"\n| \"basic_com (\\<lbrace>l\\<rbrace> WHILE b DO c OD)\"\n\nlemma fragments_basic_com:\n  assumes \"(c', aft') \\<in> fragments c aft\"\n  shows \"basic_com c'\"\nusing assms by (induct c arbitrary: aft) (auto intro: basic_com.intros)\n\nlemma fragmentsL_basic_com:\n  assumes \"(c', aft') \\<in> fragmentsL cs\"\n  shows \"basic_com c'\"\nusing assms\napply (induct cs)\n apply simp\napply (case_tac cs)\n apply (auto simp: fragments_basic_com)\ndone\n\ntext\\<open>\n\nTo reason about system transitions we need to identify which basic\nstatement gets executed next. To that end we factor out the recursive\ncases of the @{term \"small_step\"} semantics into \\emph{contexts},\nwhich isolate the \\<open>basic_com\\<close> commands with immediate\nexternally-visible behaviour. Note that non-determinism means that\nmore than one \\<open>basic_com\\<close> can be enabled at a time.\n\nThe representation of evaluation contexts follows @{cite\n[cite_macro=citet] \"DBLP:journals/jar/Berghofer12\"}. This style of\noperational semantics was originated by @{cite [cite_macro=citet]\n\"FelleisenHieb:1992\"}.\n\n\\<close>\n\ntype_synonym ('answer, 'location, 'question, 'state) ctxt\n  = \"(('answer, 'location, 'question, 'state) com \\<Rightarrow> ('answer, 'location, 'question, 'state) com)\n   \\<times> (('answer, 'location, 'question, 'state) com \\<Rightarrow> ('answer, 'location, 'question, 'state) com list)\"\n\ninductive_set\n  ctxt :: \"('answer, 'location, 'question, 'state) ctxt set\"\nwhere\n  C_Hole: \"(id, \\<langle>[]\\<rangle>) \\<in> ctxt\"\n| C_Loop: \"(E, fctxt) \\<in> ctxt \\<Longrightarrow> (\\<lambda>c1. LOOP DO E c1 OD, \\<lambda>c1. fctxt c1 @ [LOOP DO E c1 OD]) \\<in> ctxt\"\n| C_Seq: \"(E, fctxt) \\<in> ctxt \\<Longrightarrow> (\\<lambda>c1. E c1;; c2, \\<lambda>c1. fctxt c1 @ [c2]) \\<in> ctxt\"\n| C_Choose1: \"(E, fctxt) \\<in> ctxt \\<Longrightarrow> (\\<lambda>c1. E c1 \\<oplus> c2, fctxt) \\<in> ctxt\"\n| C_Choose2: \"(E, fctxt) \\<in> ctxt \\<Longrightarrow> (\\<lambda>c2. c1 \\<oplus> E c2, fctxt) \\<in> ctxt\"\n\ntext\\<open>\n\nWe can decompose a small step into a context and a @{const \"basic_com\"}.\n\n\\<close>\n\nfun\n  decompose_com :: \"('answer, 'location, 'question, 'state) com\n                      \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                        \\<times> ('answer, 'location, 'question, 'state) ctxt ) set\"\nwhere\n  \"decompose_com (LOOP DO c1 OD) = { (c, \\<lambda>t. LOOP DO ictxt t OD, \\<lambda>t. fctxt t @ [LOOP DO ictxt t OD]) |c fctxt ictxt. (c, ictxt, fctxt) \\<in> decompose_com c1 }\"\n| \"decompose_com (c1;; c2) = { (c, \\<lambda>t. ictxt t;; c2, \\<lambda>t. fctxt t @ [c2]) |c fctxt ictxt. (c, ictxt, fctxt) \\<in> decompose_com c1 }\"\n| \"decompose_com (c1 \\<oplus> c2) = { (c, \\<lambda>t. ictxt t \\<oplus> c2, fctxt) |c fctxt ictxt. (c, ictxt, fctxt) \\<in> decompose_com c1 }\n                           \\<union> { (c, \\<lambda>t. c1 \\<oplus> ictxt t, fctxt) |c fctxt ictxt. (c, ictxt, fctxt) \\<in> decompose_com c2 }\"\n| \"decompose_com c = {(c, id, \\<langle>[]\\<rangle>)}\"\n\ndefinition\n  decomposeLS :: \"('answer, 'location, 'question, 'state) local_state\n               \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                 \\<times> (('answer, 'location, 'question, 'state) com \\<Rightarrow> ('answer, 'location, 'question, 'state) com)\n                 \\<times> (('answer, 'location, 'question, 'state) com \\<Rightarrow> ('answer, 'location, 'question, 'state) com list) ) set\"\nwhere\n  \"decomposeLS s = (case cPGM s of c # _ \\<Rightarrow> decompose_com c | _ \\<Rightarrow> {})\"\n\nlemma ctxt_inj:\n  assumes \"(E, fctxt) \\<in> ctxt\"\n  assumes \"E x = E y\"\n  shows \"x = y\"\nusing assms by (induct set: ctxt) auto\n\nlemma decompose_com_non_empty: \"decompose_com c \\<noteq> {}\"\nby (induct c) auto\n\nlemma decompose_com_basic_com:\n  assumes \"(c', ctxts) \\<in> decompose_com c\"\n  shows \"basic_com c'\"\nusing assms by (induct c arbitrary: c' ctxts) (auto intro: basic_com.intros)\n\nlemma decomposeLS_basic_com:\n  assumes \"(c', ctxts) \\<in> decomposeLS s\"\n  shows \"basic_com c'\"\nusing assms unfolding decomposeLS_def by (simp add: decompose_com_basic_com split: list.splits)\n\nlemma decompose_com_ctxt:\n  assumes \"(c', ctxts) \\<in> decompose_com c\"\n  shows \"ctxts \\<in> ctxt\"\nusing assms by (induct c arbitrary: c' ctxts) (auto intro: ctxt.intros)\n\nlemma decompose_com_ictxt:\n  assumes \"(c', ictxt, fctxt) \\<in> decompose_com c\"\n  shows \"ictxt c' = c\"\nusing assms by (induct c arbitrary: c' ictxt fctxt) auto\n\nlemma decompose_com_small_step:\n  assumes as: \"(c' # fctxt c' @ cs, s) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> s'\"\n  assumes ds: \"(c', ictxt, fctxt) \\<in> decompose_com c\"\n  shows \"(c # cs, s) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> s'\"\nusing decompose_com_ctxt[OF ds] as decompose_com_ictxt[OF ds]\nby (induct ictxt fctxt arbitrary: c cs)\n   (cases s', fastforce simp: fun_eq_iff dest: ctxt_inj)+\n\ntheorem context_decompose:\n  \"s \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> s' \\<longleftrightarrow> (\\<exists>(c, ictxt, fctxt) \\<in> decomposeLS s.\n                     cPGM s = ictxt c # tl (cPGM s)\n                   \\<and> (c # fctxt c @ tl (cPGM s), cTKN s, cLST s) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> s'\n                   \\<and> (\\<forall>l\\<in>atC c. cTKN s' = Some l))\" (is \"?lhs = ?rhs\")\nproof(rule iffI)\n  assume ?lhs then show ?rhs\n  unfolding decomposeLS_def\n  proof(induct rule: small_step.induct)\n    case (Choose1 c1 cs s \\<alpha> cs' s' c2) then show ?case\n      apply clarsimp\n      apply (rename_tac c ictxt fctxt)\n      apply (rule_tac x=\"(c, \\<lambda>t. ictxt t \\<oplus> c2, fctxt)\" in bexI)\n      apply auto\n      done\n  next\n    case (Choose2 c2 cs s \\<alpha> cs' s' c1) then show ?case\n      apply clarsimp\n      apply (rename_tac c ictxt fctxt)\n      apply (rule_tac x=\"(c, \\<lambda>t. c1 \\<oplus> ictxt t, fctxt)\" in bexI)\n      apply auto\n      done\n  qed fastforce+\nnext\n  assume ?rhs then show ?lhs\n    unfolding decomposeLS_def\n    by (cases s) (auto split: list.splits dest: decompose_com_small_step)\nqed\n\ntext\\<open>\n\nWhile we only use this result left-to-right (to decompose a small step\ninto a basic one), this equivalence shows that we lose no information\nin doing so.\n\nDecomposing a compound command preserves @{const \\<open>fragments\\<close>} too.\n\n\\<close>\n\nfun\n  loc_compC :: \"('answer, 'location, 'question, 'state) com\n                            \\<Rightarrow> ('answer, 'location, 'question, 'state) com list\n                            \\<Rightarrow> ('answer, 'location, 'question, 'state) loc_comp\"\nwhere\n  \"loc_compC (\\<lbrace>l\\<rbrace> IF b THEN c FI) cs = lcond (atC c) (atCs cs) b\"\n| \"loc_compC (\\<lbrace>l\\<rbrace> IF b THEN c1 ELSE c2 FI) cs = lcond (atC c1) (atC c2) b\"\n| \"loc_compC (LOOP DO c OD) cs = lconst (atC c)\"\n| \"loc_compC (\\<lbrace>l\\<rbrace> WHILE b DO c OD) cs = lcond (atC c) (atCs cs) b\"\n| \"loc_compC c cs = lconst (atCs cs)\"\n\nlemma decompose_fragments:\n  assumes \"(c, ictxt, fctxt) \\<in> decompose_com c0\"\n  shows \"(c, loc_compC c (fctxt c @ cs)) \\<in> fragments c0 (atCs cs)\"\nusing assms\nproof(induct c0 arbitrary: c ictxt fctxt cs)\n  case (Loop c01 c ictxt fctxt cs)\n  from Loop.prems Loop.hyps(1)[where cs=\"ictxt c # cs\"] show ?case by (auto simp: decompose_com_ictxt)\nnext\n  case (Seq c01 c02 c ictxt fctxt cs)\n  from Seq.prems Seq.hyps(1)[where cs=\"c02 # cs\"] show ?case by auto\nqed auto\n\n\n\nlemma at_decomposeLS:\n  assumes \"(c, ictxt, fctxt) \\<in> decomposeLS s\"\n  shows \"atC c \\<subseteq> atCs (cPGM s)\"\nusing assms unfolding decomposeLS_def by (auto simp: at_decompose split: list.splits)\n\nlemma decomposeLS_fragmentsLS:\n  assumes \"(c, ictxt, fctxt) \\<in> decomposeLS s\"\n  shows \"(c, loc_compC c (fctxt c @ tl (cPGM s))) \\<in> fragmentsLS s\"\nusing assms\nproof(cases \"cPGM s\")\n  case (Cons d ds)\n  with assms decompose_fragments[where cs=\"ds\"] show ?thesis\n    by (cases ds) (auto simp: decomposeLS_def)\nqed (simp add: decomposeLS_def)\n\nlemma small_step_loc_compC:\n  assumes \"basic_com c\"\n  assumes \"(c # cs, ls) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> ls'\"\n  shows \"loc_compC c cs (snd ls) = atCs (cPGM ls')\"\nusing assms by (fastforce elim: basic_com.cases elim!: small_step_inv split: lcond_splits)\n\ntext\\<open>\n\nThe headline result allows us to constrain the initial and final states\nof a given small step in terms of the original programs, provided the\ninitial state is reachable.\n\n\\<close>\n\ntheorem decompose_small_step:\n  assumes \"GST sh p \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> ps'\"\n  assumes \"reachable_state sys sh\"\n  obtains c cs aft\n    where \"(c, aft) \\<in> fragments (PGMs sys p) {}\"\n      and \"atC c \\<subseteq> atCs (cPGM (GST sh p))\"\n      and \"aft (cLST (GST sh p)) = atCs (cPGM ps')\"\n      and \"(c # cs, cTKN (GST sh p), cLST (GST sh p)) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> ps'\"\n      and \"\\<forall>l\\<in>atC c. cTKN ps' = Some l\"\nusing assms\napply -\napply (frule iffD1[OF context_decompose])\napply clarsimp\napply (frule decomposeLS_fragmentsLS)\napply (frule at_decomposeLS)\napply (frule (1) subsetD[OF reachable_state_fragmentsLS])\napply (frule decomposeLS_basic_com)\napply (frule (1) small_step_loc_compC)\napply simp\ndone\n\ntext\\<open>\n\nReasoning by induction over the reachable states\nwith @{thm [source] \"decompose_small_step\"} is quite tedious. We\nprovide a very simple VCG that generates friendlier local proof\nobligations in \\S\\ref{sec:vcg}.\n\n\\<close>\n\n\nsubsection\\<open>Simple-minded Hoare Logic/VCG for CIMP \\label{sec:vcg}\\<close>\n\ntext\\<open>\n\n\\label{sec:cimp-vcg}\n\nWe do not develop a proper Hoare logic or full VCG for CIMP: this\nmachinery merely packages up the subgoals that arise from induction\nover the reachable states (\\S\\ref{sec:cimp-invariants}). This is\nsomewhat in the spirit of @{cite [cite_macro=citet] \"Ridge:2009\"}.\n\nNote that this approach is not compositional: it consults the original\nsystem to find matching communicating pairs, and \\<open>aft\\<close>\ntracks the labels of possible successor statements. More serious Hoare\nlogics are provided by @{cite [cite_macro=citet]\n\"DBLP:journals/acta/Lamport80\" and \"DBLP:journals/toplas/LamportS84\"\nand \"CousotCousot89-IC\"}.\n\nIntuitively we need to discharge a proof obligation for either @{const\n\"Request\"}s or @{const \"Response\"}s but not both. Here we choose to\nfocus on @{const \"Request\"}s as we expect to have more local\ninformation available about these.\n\n\\<close>\n\ninductive\n  vcg :: \"('answer, 'location, 'proc, 'question, 'state) programs\n        \\<Rightarrow> 'proc\n        \\<Rightarrow> ('answer, 'location, 'question, 'state) loc_comp\n        \\<Rightarrow> ('answer, 'location, 'proc, 'question, 'state) state_pred\n        \\<Rightarrow> ('answer, 'location, 'question, 'state) com\n        \\<Rightarrow> ('answer, 'location, 'proc, 'question, 'state) state_pred\n        \\<Rightarrow> bool\" (\"_, _, _ \\<turnstile>/ \\<lbrace>_\\<rbrace>/ _/ \\<lbrace>_\\<rbrace>\" [11,0,0,0,0,0] 11)\nwhere\n  \"\\<lbrakk> \\<And>aft' action' s ps' p's' l' \\<beta> s' p'.\n      \\<lbrakk> pre s; (\\<lbrace>l'\\<rbrace> Response action', aft') \\<in> fragments (coms p') {}; p \\<noteq> p';\n        ps' \\<in> val \\<beta> (s\\<down> p); (p's', \\<beta>) \\<in> action' (action (s\\<down> p)) (s\\<down> p');\n        at p l s; at p' l' s;\n        AT s' = (AT s)(p := aft (s\\<down> p), p' := aft' (s\\<down> p'));\n        s'\\<down> = s\\<down>(p := ps', p' := p's');\n        taken p l s';\n        HST s' = HST s @ [(action (s\\<down> p), \\<beta>)];\n        \\<forall>p''\\<in>-{p,p'}. GST s' p'' = GST s p''\n      \\<rbrakk> \\<Longrightarrow> post s'\n   \\<rbrakk> \\<Longrightarrow> coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> Request action val \\<lbrace>post\\<rbrace>\"\n| \"\\<lbrakk> \\<And>s ps' s'.\n      \\<lbrakk> pre s; ps' \\<in> f (s\\<down> p);\n        at p l s;\n        AT s' = (AT s)(p := aft (s\\<down> p));\n        s'\\<down> = s\\<down>(p := ps');\n        taken p l s';\n        HST s' = HST s;\n        \\<forall>p''\\<in>-{p}. GST s' p'' = GST s p''\n      \\<rbrakk> \\<Longrightarrow> post s'\n   \\<rbrakk> \\<Longrightarrow> coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> LocalOp f \\<lbrace>post\\<rbrace>\"\n| \"\\<lbrakk> \\<And>s s'.\n      \\<lbrakk> pre s;\n        at p l s;\n        AT s' = (AT s)(p := aft (s\\<down> p));\n        s'\\<down> = s\\<down>;\n        taken p l s';\n        HST s' = HST s;\n        \\<forall>p''\\<in>-{p}. GST s' p'' = GST s p''\n      \\<rbrakk> \\<Longrightarrow> post s'\n   \\<rbrakk> \\<Longrightarrow> coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> IF b THEN t FI \\<lbrace>post\\<rbrace>\"\n| \"\\<lbrakk> \\<And>s s'.\n      \\<lbrakk> pre s;\n        at p l s;\n        AT s' = (AT s)(p := aft (s\\<down> p));\n        s'\\<down> = s\\<down>;\n        taken p l s';\n        HST s' = HST s;\n        \\<forall>p''\\<in>-{p}. GST s' p'' = GST s p''\n      \\<rbrakk> \\<Longrightarrow> post s'\n   \\<rbrakk> \\<Longrightarrow> coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> IF b THEN t ELSE e FI \\<lbrace>post\\<rbrace>\"\n| \"\\<lbrakk> \\<And>s s'.\n      \\<lbrakk> pre s;\n        at p l s;\n        AT s' = (AT s)(p := aft (s\\<down> p));\n        s'\\<down> = s\\<down>;\n        taken p l s';\n        HST s' = HST s;\n        \\<forall>p''\\<in>-{p}. GST s' p'' = GST s p''\n      \\<rbrakk> \\<Longrightarrow> post s'\n   \\<rbrakk> \\<Longrightarrow> coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> WHILE b DO c OD \\<lbrace>post\\<rbrace>\"\n\\<comment> \\<open>There are no proof obligations for the following commands, but including them makes some basic rules hold (\\S\\ref{sec:cimp:vcg_rules}):\\<close>\n| \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> Response action \\<lbrace>post\\<rbrace>\"\n| \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> c1 ;; c2 \\<lbrace>post\\<rbrace>\"\n| \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> LOOP DO c OD \\<lbrace>post\\<rbrace>\"\n| \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> c1 \\<oplus> c2 \\<lbrace>post\\<rbrace>\"\n\ntext\\<open>\n\nWe abbreviate invariance with one-sided validity syntax.\n\n\\<close>\n\nabbreviation valid_inv (\"_, _, _ \\<turnstile>/ \\<lbrace>_\\<rbrace>/ _\" [11,0,0,0,0] 11) where\n  \"coms, p, aft \\<turnstile> \\<lbrace>I\\<rbrace> c \\<equiv> coms, p, aft \\<turnstile> \\<lbrace>I\\<rbrace> c \\<lbrace>I\\<rbrace>\"\n\ninductive_cases vcg_inv:\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> Request action val \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> LocalOp f \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> IF b THEN t FI \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> IF b THEN t ELSE e FI \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> WHILE b DO c OD \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> LOOP DO c OD \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> Response action \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> c1 ;; c2 \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> Choose c1 c2 \\<lbrace>post\\<rbrace>\"\n\ntext\\<open>\n\nWe tweak @{const \"fragments\"} by omitting @{const \"Response\"}s,\nyielding fewer obligations\n\n\\<close>\n\nfun\n  vcg_fragments' :: \"('answer, 'location, 'question, 'state) com\n               \\<Rightarrow> 'location set\n               \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                 \\<times> ('answer, 'location, 'question, 'state) loc_comp ) set\"\nwhere\n  \"vcg_fragments' (\\<lbrace>l\\<rbrace> Response action) aft = {}\"\n| \"vcg_fragments' (\\<lbrace>l\\<rbrace> IF b THEN c FI) aft\n       = vcg_fragments' c aft\n       \\<union> { (\\<lbrace>l\\<rbrace> IF b THEN c' FI, lcond (atC c) aft b) |c'. True }\"\n| \"vcg_fragments' (\\<lbrace>l\\<rbrace> IF b THEN c1 ELSE c2 FI) aft\n       = vcg_fragments' c2 aft \\<union> vcg_fragments' c1 aft\n       \\<union> { (\\<lbrace>l\\<rbrace> IF b THEN c1' ELSE c2' FI, lcond (atC c1) (atC c2) b) |c1' c2'. True }\"\n| \"vcg_fragments' (LOOP DO c OD) aft = vcg_fragments' c (atC c)\"\n| \"vcg_fragments' (\\<lbrace>l\\<rbrace> WHILE b DO c OD) aft\n       = vcg_fragments' c {l} \\<union> { (\\<lbrace>l\\<rbrace> WHILE b DO c' OD, lcond (atC c) aft b) |c'. True }\"\n| \"vcg_fragments' (c1 ;; c2) aft = vcg_fragments' c2 aft \\<union> vcg_fragments' c1 (atC c2)\"\n| \"vcg_fragments' (c1 \\<oplus> c2) aft = vcg_fragments' c1 aft \\<union> vcg_fragments' c2 aft\"\n| \"vcg_fragments' c aft = {(c, lconst aft)}\"\n\nabbreviation\n  vcg_fragments :: \"('answer, 'location, 'question, 'state) com\n                  \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                    \\<times> ('answer, 'location, 'question, 'state) loc_comp ) set\"\nwhere\n  \"vcg_fragments c \\<equiv> vcg_fragments' c {}\"\n\nfun isResponse :: \"('answer, 'location, 'question, 'state) com \\<Rightarrow> bool\" where\n  \"isResponse (\\<lbrace>l\\<rbrace> Response action) \\<longleftrightarrow> True\"\n| \"isResponse _ \\<longleftrightarrow> False\"\n\nlemma fragments_vcg_fragments':\n  \"\\<lbrakk> (c, aft) \\<in> fragments c' aft'; \\<not>isResponse c \\<rbrakk> \\<Longrightarrow> (c, aft) \\<in> vcg_fragments' c' aft'\"\nby (induct c' arbitrary: aft') auto\n\nlemma vcg_fragments'_fragments:\n  \"vcg_fragments' c' aft' \\<subseteq> fragments c' aft'\" \nby (induct c' arbitrary: aft') (auto 10 0)\n\nlemma VCG_step:\n  assumes V: \"\\<And>p. \\<forall>(c, aft) \\<in> vcg_fragments (PGMs sys p). PGMs sys, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> c \\<lbrace>post\\<rbrace>\"\n  assumes S: \"system_step p sh' sh\"\n  assumes R: \"reachable_state sys sh\"\n  assumes P: \"pre sh\"\n  shows \"post sh'\"\nusing S\nproof cases\n  case LocalStep with P show ?thesis\n    apply -\n    apply (erule decompose_small_step[OF _ R])\n    apply (frule fragments_basic_com)\n    apply (erule basic_com.cases)\n    apply (fastforce dest!: fragments_vcg_fragments' V[rule_format]\n                      elim: vcg_inv elim!: small_step_inv\n                      simp: LST_def AT_def taken_def fun_eq_iff)+\n    done\nnext\n  case CommunicationStep with P show ?thesis\n    apply -\n    apply (erule decompose_small_step[OF _ R])\n    apply (erule decompose_small_step[OF _ R])\n    subgoal for c cs aft c' cs' aft'\n    apply (frule fragments_basic_com[where c'=c])\n    apply (frule fragments_basic_com[where c'=c'])\n    apply (elim basic_com.cases; clarsimp elim!: small_step_inv)\n    apply (drule fragments_vcg_fragments')\n    apply (fastforce dest!: V[rule_format]\n                      elim: vcg_inv elim!: small_step_inv\n                      simp: LST_def AT_def taken_def fun_eq_iff)+\n    done\n    done\nqed\n\ntext\\<open>\n\nThe user sees the conclusion of \\<open>V\\<close> for each element of @{const \\<open>vcg_fragments\\<close>}.\n\n\\<close>\n\nlemma VCG_step_inv_stable:\n  assumes V: \"\\<And>p. \\<forall>(c, aft) \\<in> vcg_fragments (PGMs sys p). PGMs sys, p, aft \\<turnstile> \\<lbrace>I\\<rbrace> c\"\n  assumes \"prerun sys \\<sigma>\"\n  shows \"(\\<lceil>I\\<rceil> \\<^bold>\\<hookrightarrow> \\<circle>\\<lceil>I\\<rceil>) \\<sigma>\"\napply (rule alwaysI)\napply clarsimp\napply (rule nextI)\napply clarsimp\nusing assms(2) unfolding prerun_def\napply clarsimp\napply (erule_tac i=i in alwaysE)\nunfolding system_step_reflclp_def\napply clarsimp\napply (erule disjE; clarsimp)\nusing VCG_step[where pre=I and post=I] V assms(2) prerun_reachable_state\napply blast\ndone\n\nlemma VCG:\n  assumes I: \"\\<forall>s. initial_state sys s \\<longrightarrow> I (\\<lparr>GST = s, HST = []\\<rparr>)\"\n  assumes V: \"\\<And>p. \\<forall>(c, aft) \\<in> vcg_fragments (PGMs sys p). PGMs sys, p, aft \\<turnstile> \\<lbrace>I\\<rbrace> c\"\n  shows \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> I\"\napply (rule prerun_valid_induct)\n apply (clarsimp simp: prerun_def state_prop_def)\n apply (metis (full_types) I old.unit.exhaust system_state.surjective)\nusing VCG_step_inv_stable[OF V] apply blast\ndone\n\nlemmas VCG_valid = valid_prerun_lift[OF VCG, of sys I] for sys I\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/ConcurrentIMP/CIMP_vcg.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.6187804337438501, "lm_q1q2_score": 0.3166402226127737}}
{"text": "theory Map_Extra\n  imports Main \"HOL-Library.Library\"\nbegin\n\nlemmas map_of_eq_Some_imp_key_in_fst_dom[intro] =\n  domI[of \"map_of xs\" for xs, unfolded dom_map_of_conv_image_fst]\n\nlemma very_weak_map_of_SomeI: \"k \\<in> fst ` set kvs \\<Longrightarrow> \\<exists>v. map_of kvs k = Some v\"\n  by (induction kvs) auto\n\nlemma map_of_fst_hd_neq_Nil[simp]:\n  assumes \"xs \\<noteq> []\"\n  shows \"map_of xs (fst (hd xs)) = Some (snd (hd xs))\"\n  using assms\n  by (cases xs) simp_all\n\ndefinition map_merge where\n  \"map_merge f m1 m2 x =\n    (case (m1 x, m2 x) of\n      (None, None) \\<Rightarrow> None\n    | (None, Some z) \\<Rightarrow> Some z\n    | (Some y, None) \\<Rightarrow> Some y\n    | (Some y, Some z) \\<Rightarrow> f y z)\"\n\nlemma option_case_cancel[simp]: \"(case opt of None \\<Rightarrow> x | Some _ \\<Rightarrow> x) = x\"\n  using option.case_eq_if\n  by (simp add: option.case_eq_if)\n\nlemma map_le_map_merge_Some_const:\n  \"f \\<subseteq>\\<^sub>m map_merge (\\<lambda>x y. Some x) f g\" and\n  \"g \\<subseteq>\\<^sub>m map_merge (\\<lambda>x y. Some y) f g\"\n  unfolding map_le_def atomize_conj\n  find_theorems \"_ &&& _\"\nproof (intro conjI ballI)\n  fix x\n  assume \"x \\<in> dom f\"\n  then obtain y where \"f x = Some y\"\n    by blast\n  then show \"f x = map_merge (\\<lambda>x y. Some x) f g x\"\n    unfolding map_merge_def\n    by simp\nnext\n  fix x\n  assume \"x \\<in> dom g\"\n  then obtain z where \"g x = Some z\"\n    by blast\n  then show \"g x = map_merge (\\<lambda>x. Some) f g x\"\n    unfolding map_merge_def\n    by (simp add: option.case_eq_if)\nqed\n\nend", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/Interpreter_Optimizations/Map_Extra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883735630721, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.31648924652011606}}
{"text": "chapter \\<open>Turing machines for reducing $\\NP$ languages to \\SAT{}\\label{s:Red_TM}\\<close>\n\ntheory Reduction_TM\n  imports Sat_TM_CNF Oblivious_2_Tape\nbegin\n\ntext \\<open>\nAt long last we are going to create a polynomial-time Turing machine that, for a\nfixed language $L\\in\\NP$, computes for every string $x$ a CNF formula $\\Phi$\nsuch that $x\\in L$ iff.\\ $\\Phi$ is satisfiable. This concludes the proof of the\nCook-Levin theorem.\n\nThe CNF formula $\\Phi$ is a conjunction of formulas $\\Phi_0, \\dots, \\Phi_9$, and\nthe previous chapter has provided us with Turing machines @{const tm_PHI0},\n@{const tm_PHI1}, etc.\\ that are supposed to generate these formulas. But only\nfor $\\Phi_9$ has this been proven yet. So our first task is to transfer the\nTuring machines @{const tm_PHI0}, $\\dots$, @{const tm_PHI8} into the locale\n@{locale reduction_sat_x} and show that they really do generate the CNF formulas\n$\\Phi_0, \\dots, \\Phi_8$.\n\nThe TMs require certain values on their tapes prior to starting. Therefore we\nbuild a Turing machine that computes these values. Then, in a final effort, we\ncombine all these TMs to create this article's biggest Turing machine.\n\\<close>\n\n\nsection \\<open>Turing machines for parts of $\\Phi$ revisited\\<close>\n\ntext \\<open>\nIn this section we restate the semantic lemmas @{text \"transforms_tm_PHI0\"}\netc.\\ of the Turing machines @{const tm_PHI0} etc.\\ in the context of the locale\n@{locale reduction_sat_x}. This means that the lemmas now have terms like @{term\n\"formula_n \\<Phi>\\<^sub>0\"} in them instead of more complicated expressions. It also means\nthat we more clearly see which values the tapes need to contain initially\nbecause they are now expressed in terms of values in the locale, such as $n$,\n$p(n)$, or $m'$.\n\n\\null\n\\<close>\n\ncontext reduction_sat_x\nbegin\n\nlemma tm_PHI0 [transforms_intros]:\n  fixes tps tps' :: \"tape list\" and j :: tapeidx and ttt k :: nat\n  assumes \"length tps = k\" and \"1 < j\" and \"j + 8 < k\"\n  assumes\n    \"tps ! 1 = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! j = (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 2) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 8) = (\\<lfloor>[]\\<rfloor>, 1)\"\n  assumes \"tps' = tps\n    [j := (\\<lfloor>Suc (Suc m')\\<rfloor>\\<^sub>N, 1),\n     j + 2 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1),\n     j + 6 := (\\<lfloor>nll_Psi (Suc (Suc m') * H) H 0\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n     1 := nlltape (formula_n \\<Phi>\\<^sub>0)]\"\n  assumes \"ttt = 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2\"\n  shows \"transforms (tm_PHI0 j) tps ttt tps'\"\nproof -\n  have \"nll_Psi (m' * H) H 1 = formula_n (\\<Psi> (\\<zeta>\\<^sub>0 0) 1)\"\n    using nll_Psi zeta0_def m' by simp\n  moreover have \"nll_Psi (H + m' * H) H 1 = formula_n (\\<Psi> (\\<zeta>\\<^sub>1 0) 1)\"\n    using nll_Psi zeta1_def m'\n    by (smt (verit) ab_semigroup_add_class.add_ac(1) add.commute add_cancel_left_right mult_2 mult_zero_left)\n  moreover have \"nll_Psi (Suc (Suc m') * H) H 0 = formula_n (\\<Psi> (\\<zeta>\\<^sub>2 0) 0)\"\n  proof -\n    have \"Suc (Suc m') * H = N + 2 * H\"\n      using m' by simp\n    moreover have \"Suc (Suc m') * H + H = N + (Suc 0) * Z\"\n      using m' Z_def by simp\n    ultimately have \"\\<zeta>\\<^sub>2 0 = [Suc (Suc m') * H..<Suc (Suc m') * H + H]\"\n      using zeta2_def by (metis Nat.add_0_right mult_zero_left)\n    then show ?thesis\n      using nll_Psi by simp\n  qed\n  ultimately have \"nll_Psi (m' * H) H 1 @ nll_Psi (H + m' * H) H 1 @ nll_Psi (Suc (Suc m') * H) H 0 =\n      formula_n \\<Phi>\\<^sub>0\"\n    using formula_n_def PHI0_def by simp\n  then show ?thesis\n    using transforms_tm_PHI0I[OF assms(1-3) H_ge_3 assms(4-13)] assms(14,15) by simp\nqed\n\nlemma tm_PHI1 [transforms_intros]:\n  fixes tps tps' :: \"tape list\" and j :: tapeidx and ttt k :: nat and nss :: \"nat list list\"\n  assumes \"length tps = k\" and \"1 < j\" and \"j + 7 < k\"\n  assumes\n    \"tps ! 1 = nlltape nss\"\n    \"tps ! j = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 2) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n  assumes \"tps' = tps\n    [j + 2 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n     j + 6 := (\\<lfloor>nll_Psi 0 H 1\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n     1 := nlltape (nss @ formula_n \\<Phi>\\<^sub>1)]\"\n  assumes \"ttt = 1875 * H ^ 4\"\n  shows \"transforms (tm_PHI1 j) tps ttt tps'\"\nproof -\n  have \"nll_Psi 0 H 1 = formula_n (\\<Psi> ([0..<H]) 1)\"\n    using nll_Psi by simp\n  then have \"nll_Psi 0 H 1 = formula_n (\\<Psi> (\\<gamma> 0) 1)\"\n    using gamma_def by simp\n  then have \"nll_Psi 0 H 1 = formula_n \\<Phi>\\<^sub>1\"\n    using PHI1_def by simp\n  then show ?thesis\n    using transforms_tm_PHI1I[OF assms(1-3) H_ge_3 assms(4-12)] assms(13,14) by simp\nqed\n\nlemma tm_PHI2 [transforms_intros]:\n  fixes tps tps' :: \"tape list\" and j :: tapeidx and ttt k :: nat and nss :: \"nat list list\"\n  assumes \"length tps = k\" and \"1 < j\" and \"j + 8 < k\"\n  assumes \"idx = n \"\n  assumes\n    \"tps ! 1 = nlltape nss\"\n    \"tps ! j = (\\<lfloor>idx\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 2) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 8) = (\\<lfloor>[]\\<rfloor>, 1)\"\n  assumes \"ttt = 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * idx * H))\\<^sup>2\"\n  assumes \"tps' = tps\n    [j := (\\<lfloor>2 * idx + 2\\<rfloor>\\<^sub>N, 1),\n     j + 2 := (\\<lfloor>3\\<rfloor>\\<^sub>N, 1),\n     j + 6 := (\\<lfloor>nll_Psi (Suc (Suc (2 * idx)) * H) H 3\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n     1 := nlltape (nss @ formula_n \\<Phi>\\<^sub>2)]\"\n  shows \"transforms (tm_PHI2 j) tps ttt tps'\"\nproof -\n  have \"nll_Psi (H + 2 * idx * H) H 3 @ nll_Psi (2 * H + 2 * idx * H) H 3 = formula_n \\<Phi>\\<^sub>2\"\n  proof -\n    have \"\\<gamma> (2 * n + 1) = [H + 2 * idx * H..<H + 2 * idx * H + H]\"\n      using assms(4) gamma_def by simp\n    moreover have \"\\<gamma> (2 * n + 2) = [2 * H + 2 * idx * H..<2 * H + 2 * idx * H + H]\"\n      using assms(4) gamma_def by simp\n    ultimately show \"nll_Psi (H + 2 * idx * H) H 3 @ nll_Psi (2 * H + 2 * idx * H) H 3 = formula_n \\<Phi>\\<^sub>2\"\n      using nll_Psi PHI2_def formula_n_def by simp\n  qed\n  then show ?thesis\n    using transforms_tm_PHI2I[OF assms(1-3) H_ge_3 assms(5-14)] assms(15,16) by simp\nqed\n\nlemma PHI3_correct: \"concat (map (\\<lambda>i. nll_Psi (H * (1 + 2 * i)) H 2) [0..<n]) = formula_n \\<Phi>\\<^sub>3\"\nproof -\n  have \"nll_Psi (H * (1 + 2 * i)) H 2 = formula_n (\\<Psi> (\\<gamma> (2*i+1)) 2)\" for i\n  proof -\n    have \"\\<gamma> (2 * i + 1) = [H * (1 + 2 * i)..<H * (1 + 2 * i) + H]\"\n      using gamma_def by (simp add: mult.commute)\n    then show ?thesis\n      using nll_Psi by simp\n  qed\n  then have \"concat (map (\\<lambda>i. nll_Psi (H * (1 + 2 * i)) H 2) [0..<n]) =\n      concat (map (\\<lambda>i. formula_n (\\<Psi> (\\<gamma> (2*i+1)) 2)) [0..<n])\"\n    by simp\n  also have \"... = formula_n (concat (map (\\<lambda>i. \\<Psi> (\\<gamma> (2*i+1)) 2) [0..<n]))\"\n    using concat_formula_n by simp\n  also have \"... = formula_n \\<Phi>\\<^sub>3\"\n    using PHI3_def by simp\n  finally show ?thesis .\nqed\n\nlemma tm_PHI3:\n  fixes tps tps' :: \"tape list\" and j :: tapeidx and ttt k :: nat and nss :: \"nat list list\"\n  assumes \"length tps = k\" and \"1 < j\" and \"j + 8 < k\"\n  assumes\n    \"tps ! 1 = nlltape nss\"\n    \"tps ! j = (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 2) = (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 8) = (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1)\"\n  assumes \"ttt = Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2))\"\n  assumes \"tps' = tps\n    [j := (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape (nss @ formula_n \\<Phi>\\<^sub>3),\n     j + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n  shows \"transforms (tm_PHI345 2 j) tps ttt tps'\"\n  using transforms_tm_PHI345I[OF assms(1,2,3) H_ge_3, of 2 2 nss 1 \"n \"] H_gr_2 assms PHI3_correct\n  by fastforce\n\nlemma PHI4_correct:\n  assumes \"idx = 2 * n + 2 + 1\" and \"kappa = 2\" and \"step = 2\" and \"numiter = p n\"\n  shows \"concat (map (\\<lambda>i. nll_Psi (H * (idx + step * i)) H kappa) [0..<numiter]) = formula_n \\<Phi>\\<^sub>4\"\nproof -\n  have \"nll_Psi (H * (idx + step * i)) H kappa = formula_n (\\<Psi> (\\<gamma> (2 * n + 2 + 2 * i + 1)) 2)\" for i\n  proof -\n    have \"\\<gamma> (2 * n + 2 + 2 * i + 1) = [H * (idx + step * i)..<H * (idx + step * i) + H]\"\n      using assms gamma_def by (simp add: add.commute mult.commute)\n    then show ?thesis\n      using nll_Psi assms by simp\n  qed\n  then have \"concat (map (\\<lambda>i. nll_Psi (H * (idx + step * i)) H kappa) [0..<numiter]) =\n      concat (map (\\<lambda>i. formula_n (\\<Psi> (\\<gamma> (2 * n + 2 + 2 * i + 1)) 2)) [0..<numiter])\"\n    by simp\n  also have \"... = formula_n (concat (map (\\<lambda>i. \\<Psi> (\\<gamma> (2 * n + 2 + 2 * i + 1)) 2) [0..<p n]))\"\n    using assms concat_formula_n by simp\n  also have \"... = formula_n \\<Phi>\\<^sub>4\"\n    using PHI4_def by simp\n  finally show ?thesis .\nqed\n\nlemma tm_PHI4:\n  fixes tps tps' :: \"tape list\" and j :: tapeidx and ttt step k :: nat and nss :: \"nat list list\"\n  assumes \"length tps = k\" and \"1 < j\" and \"j + 8 < k\" assumes\n    \"tps ! 1 = nlltape nss\"\n    \"tps ! j = (\\<lfloor>2 * n + 2 + 1\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 2) = (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 8) = (\\<lfloor>2 * n + 2 + 1 + 2 * p n\\<rfloor>\\<^sub>N, 1)\"\n  assumes \"ttt = Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (2 * n + 2 + 1 + 2 * p n))\\<^sup>2))\"\n  assumes \"tps' = tps\n    [j := (\\<lfloor>2 * n + 2 + 1 + 2 * p n\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape (nss @ formula_n \\<Phi>\\<^sub>4),\n     j + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n  shows \"transforms (tm_PHI345 2 j) tps ttt tps'\"\n  using transforms_tm_PHI345I[OF assms(1,2,3) H_ge_3, of 2 2 nss \"2 * n + 2 + 1\" \"p n\"] H_gr_2 assms PHI4_correct\n  by fastforce\n\nlemma PHI5_correct:\n  assumes \"idx = 2 * n + 2 * p n + 3\" and \"kappa = 0\" and \"step = 1\" and \"numiter = T' \"\n  shows \"concat (map (\\<lambda>i. nll_Psi (H * (idx + step * i)) H kappa) [0..<numiter]) = formula_n \\<Phi>\\<^sub>5\"\nproof -\n  have \"nll_Psi (H * (idx + step * i)) H kappa = formula_n (\\<Psi> (\\<gamma> (2 * n + 2 * p n + 3 + i)) 0)\" for i\n  proof -\n    have \"\\<gamma> (2 * n + 2 * p n + 3 + i) = [H * (idx + step * i)..<H * (idx + step * i) + H]\"\n      using assms gamma_def by (simp add: add.commute mult.commute)\n    then show ?thesis\n      using nll_Psi assms by simp\n  qed\n  then have \"concat (map (\\<lambda>i. nll_Psi (H * (idx + step * i)) H kappa) [0..<numiter]) =\n      concat (map (\\<lambda>i. formula_n (\\<Psi> (\\<gamma> (2 * n + 2 * p n + 3 + i)) 0)) [0..<numiter])\"\n    by simp\n  also have \"... = formula_n (concat (map (\\<lambda>i. \\<Psi> (\\<gamma> (2 * n + 2 * p n + 3 + i)) 0) [0..<T']))\"\n    using assms concat_formula_n by simp\n  also have \"... = formula_n \\<Phi>\\<^sub>5\"\n    using PHI5_def by simp\n  finally show ?thesis .\nqed\n\nlemma tm_PHI5:\n  fixes tps tps' :: \"tape list\" and j :: tapeidx and ttt k :: nat and nss :: \"nat list list\"\n  assumes \"length tps = k\" and \"1 < j\" and \"j + 8 < k\"\n  assumes\n    \"tps ! 1 = nlltape nss\"\n    \"tps ! j = (\\<lfloor>2 * n + 2 * p n + 3\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 2) = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 8) = (\\<lfloor>2 * n + 2 * p n + 3 + T'\\<rfloor>\\<^sub>N, 1)\"\n  assumes \"ttt = Suc T' * (9 + 1891 * (H ^ 4 * (nlength (2 * n + 2 * p n + 3 + T'))\\<^sup>2))\"\n  assumes \"tps' = tps\n    [j := (\\<lfloor>2 * n + 2 * p n + 3 + T'\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape (nss @ formula_n \\<Phi>\\<^sub>5),\n     j + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n  shows \"transforms (tm_PHI345 1 j) tps ttt tps'\"\n  using transforms_tm_PHI345I[OF assms(1,2,3) H_ge_3, of 0 1, OF _ _ assms(4-12)] H_gr_2 assms(13-) PHI5_correct\n  by fastforce\n\nlemma PHI6_correct:\n  \"concat (map (\\<lambda>i. nll_Psi (H * (2 + 2 * i)) H (xs ! i)) [0..<length xs]) = formula_n \\<Phi>\\<^sub>6\"\nproof -\n  have \"nll_Psi (H * (2 + 2 * i)) H (xs ! i) = formula_n (\\<Psi> (\\<gamma> (2 * i + 2)) (if x ! i then 3 else 2))\"\n    if \"i < length xs\" for i\n  proof -\n    have \"\\<gamma> (2 * i + 2) = [H * (2 + 2 * i)..<H * (2 + 2* i) + H]\"\n      using gamma_def by (simp add: mult.commute)\n    then have \"nll_Psi (H * (2 + 2 * i)) H (xs ! i) = formula_n (\\<Psi> (\\<gamma> (2 * i + 2)) (xs ! i))\"\n      using nll_Psi by simp\n    moreover have \"xs ! i = (if x ! i then 3 else 2)\"\n      using that by simp\n    ultimately show ?thesis\n      by simp\n  qed\n  then have \"map (\\<lambda>i. nll_Psi (H * (2 + 2 * i)) H (xs ! i)) [0..<length xs] =\n      map (\\<lambda>i. formula_n (\\<Psi> (\\<gamma> (2 * i + 2)) (if x ! i then 3 else 2))) [0..<length xs]\"\n    by simp\n  then have \"concat (map (\\<lambda>i. nll_Psi (H * (2 + 2 * i)) H (xs ! i)) [0..<length xs]) =\n      concat (map (\\<lambda>i. formula_n (\\<Psi> (\\<gamma> (2 * i + 2)) (if x ! i then 3 else 2))) [0..<length xs])\"\n    by metis\n  also have \"... = formula_n (concat (map (\\<lambda>i. \\<Psi> (\\<gamma> (2 * i + 2)) (if x ! i then 3 else 2)) [0..<length xs]))\"\n    using concat_formula_n by simp\n  also have \"... = formula_n (concat (map (\\<lambda>i. \\<Psi> (\\<gamma> (2 * i + 2)) (if x ! i then 3 else 2)) [0..<n]))\"\n    by simp\n  also have \"... = formula_n \\<Phi>\\<^sub>6\"\n    using PHI6_def by simp\n  finally show ?thesis .\nqed\n\nlemma tm_PHI6 [transforms_intros]:\n  fixes tps tps' :: \"tape list\" and j :: tapeidx and ttt k :: nat and nss :: \"nat list list\"\n  assumes \"length tps = k\" and \"1 < j\" and \"j + 7 < k\"\n  assumes\n    \"tps ! 1 = nlltape nss\"\n    \"tps ! 0 = (\\<lfloor>xs\\<rfloor>, 1)\"\n    \"tps ! j = (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 2) = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n  assumes \"tps' = tps\n    [0 := (\\<lfloor>xs\\<rfloor>, Suc n),\n     j := (\\<lfloor>2 + 2 * n\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape (nss @ formula_n \\<Phi>\\<^sub>6)]\"\n  assumes \"ttt = 133650 * H ^ 6 * n ^ 3 + 1\"\n  shows \"transforms (tm_PHI6 j) tps ttt tps'\"\n  using transforms_tm_PHI6I[OF assms(1,2,3) H_ge_3 bs_xs assms(4-13) _] assms(14,15) PHI6_correct\n  by simp\n\nlemma PHI7_correct:\n  assumes \"idx = 2 * n + 4\" and \"numiter = p n\"\n  shows \"concat (map (\\<lambda>i. nll_Upsilon (idx + 2 * i) H) [0..<numiter]) = formula_n \\<Phi>\\<^sub>7\"\nproof -\n  have \"nll_Upsilon (idx + 2 * i) H = formula_n (\\<Upsilon> (\\<gamma> (2*n + 4 + 2 * i)))\" for i\n  proof -\n    have \"nll_Upsilon (idx + 2 * i) H = formula_n (\\<Upsilon> [(idx + 2 * i)*H..<(idx + 2 * i)*H+H])\"\n      using nll_Upsilon[OF H_ge_3] by simp\n    also have \"... = formula_n (\\<Upsilon> (\\<gamma> (2 * n + 4 + 2 * i)))\"\n      using gamma_def assms(1) by (simp add: add.commute)\n    finally show ?thesis .\n  qed\n  then have \"concat (map (\\<lambda>i. nll_Upsilon (idx + 2 * i) H) [0..<numiter]) =\n      concat (map (\\<lambda>i. formula_n (\\<Upsilon> (\\<gamma> (2*n + 4 + 2 * i)))) [0..<numiter])\"\n    by simp\n  also have \"... = formula_n (concat (map (\\<lambda>i. \\<Upsilon> (\\<gamma> (2*n + 4 + 2 * i))) [0..<numiter]))\"\n    using concat_formula_n by simp\n  also have \"... = formula_n (concat (map (\\<lambda>i. \\<Upsilon> (\\<gamma> (2*n + 4 + 2 * i))) [0..<p n]))\"\n    using assms(2) by simp\n  also have \"... = formula_n \\<Phi>\\<^sub>7\"\n    using PHI7_def by simp\n  finally show ?thesis .\nqed\n\nlemma tm_PHI7 [transforms_intros]:\n  fixes tps tps' :: \"tape list\" and j :: tapeidx and ttt numiter k idx :: nat and nss :: \"nat list list\"\n  assumes \"length tps = k\" and \"1 < j\" and \"j + 6 < k\"\n  assumes\n    \"tps ! 1 = nlltape nss\"\n    \"tps ! j = (\\<lfloor>2 * n + 4\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 2) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 6) = (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1)\"\n  assumes \"ttt = p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 1\"\n  assumes \"tps' = tps\n    [j := (\\<lfloor>2 * n + 4 + 2 * p n\\<rfloor>\\<^sub>N, 1),\n     j + 6 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape (nss @ formula_n \\<Phi>\\<^sub>7)]\"\n  shows \"transforms (tm_PHI7 j) tps ttt tps'\"\n  using transforms_tm_PHI7I[OF assms(1,2,3) H_ge_3 assms(4-12)] assms(13) PHI7_correct\n  by simp\n\nlemma tm_PHI8 [transforms_intros]:\n  fixes tps tps' :: \"tape list\" and j :: tapeidx and ttt k idx :: nat and nss :: \"nat list list\"\n  assumes \"length tps = k\" and \"1 < j\" and \"j + 7 < k\"\n  assumes \"idx = 1 + 3 * T' + m' \"\n  assumes\n    \"tps ! 1 = nlltape nss\"\n    \"tps ! j = (\\<lfloor>1 + 3 * T' + m'\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    \"tps ! (j + 2) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    \"tps ! (j + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n  assumes \"tps' = tps\n      [1 := nlltape (nss @ formula_n \\<Phi>\\<^sub>8),\n       j + 2 := (\\<lfloor>3\\<rfloor>\\<^sub>N, 1),\n       j + 6 := (\\<lfloor>formula_n \\<Phi>\\<^sub>8\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n  assumes \"ttt = 18 + 1861 * H ^ 4 * (nlength (Suc (1 + 3 * T' + m')))\\<^sup>2\"\n  shows \"transforms (tm_PHI8 j) tps ttt tps'\"\nproof -\n  let ?idx = \"1 + 3 * T' + m' \"\n  have \"m' * H + T' * 3 * H + H = ?idx * H\"\n    using m' add_mult_distrib by simp\n  then have \"\\<zeta>\\<^sub>1 T' = [?idx * H..<?idx * H + H]\"\n    using zeta1_def Z_def m' by (metis ab_semigroup_add_class.add_ac(1) mult.assoc mult_2)\n  then have \"nll_Psi (?idx * H) H 3 = formula_n \\<Phi>\\<^sub>8\"\n    using PHI8_def nll_Psi by simp\n  then show ?thesis\n    using transforms_tm_PHI8I[OF assms(1-3) H_ge_3 assms(5-13) _ assms(15)] assms(14) by simp\nqed\n\nend  (* context reduction_sat_x *)\n\n\nsection \\<open>A Turing machine for initialization\\<close>\n\ntext \\<open>\nAs we have seen in the previous section, the Turing machines @{const tm_PHI0}\netc.\\ expect some tapes to contain certain values that depend on the verifier TM\n$M$. In this section we construct the TM @{term tm_PHI_init} that computes\ntheses values.\n\nThe TM expects the string $x$ on the input tape. Then it determines the length\n$n$ of $x$ and stores it on tape~11. Then it computes the value $p(n)$ and\nstores it on tape~15. Then it computes $m = 2n + 2p(n) + 2$ and stores it on\ntape~16. It then writes $\\mathbf{0}^m$ to tape~9 and runs @{const\ntm_list_headpos}, which writes the sequences of head positions for the input and\nwork/output tape of the verifier TM $M$ to tapes~4 and~7, respectively.  The\nlength of these lists determines $T'$, which is written to tape~17. From this\nand $m$ the TM computes $m'$ and writes it to tape~18. It then writes $H$, which\nis hard-coded, to tape~19 and finally $N = H\\cdot m'$ to tape~20.\n\nWe assume that the TM starts in a configuration where the input tape head and\nthe heads on tapes with index greater than 10 are positioned on cell number~1,\nwhereas all other tapes are on cell number~0 as usual.\nThe TM has no tape parameters, as all tapes are fixed to work with the final TM\nlater.\n\nAs with other TMs before, we will define and analyze the TM on the theory level\nand then transfer the semantics to the locale @{locale reduction_sat_x}.\n\\<close>\n\ndefinition tm_PHI_init :: \"nat \\<Rightarrow> machine \\<Rightarrow> (nat \\<Rightarrow> nat) \\<Rightarrow> machine\" where\n  \"tm_PHI_init G M p \\<equiv>\n     tm_right 9 ;;\n     tm_length_input 11 ;;\n     tm_polynomial p 11 ;;\n     tm_copyn 15 16 ;;\n     tm_add 11 16 ;;\n     tm_incr 16 ;;\n     tm_times2 16 ;;\n     tm_copyn 16 17 ;;\n     tm_write_replicate 2 17 9 ;;\n     tm_left 9 ;;\n     tm_list_headpos G M 2 ;;\n     tm_count 4 17 4 ;;\n     tm_decr 17 ;;\n     tm_copyn 16 18 ;;\n     tm_incr 18 ;;\n     tm_add 17 18 ;;\n     tm_setn 19 (max G (length M)) ;;\n     tm_mult 18 19 20\"\n\nlemma tm_PHI_init_tm:\n  fixes H k\n  assumes \"turing_machine 2 G M\" and \"k > 20\" and \"H \\<ge> Suc (length M)\" and \"H \\<ge> G\"\n  assumes \"H \\<ge> 5\"\n  shows \"turing_machine k H (tm_PHI_init G M p)\"\n  unfolding tm_PHI_init_def\n  using assms turing_machine_sequential_turing_machine tm_right_tm tm_length_input_tm tm_polynomial_tm\n    tm_copyn_tm tm_add_tm tm_incr_tm tm_times2_tm tm_write_replicate_tm tm_left_tm tm_list_headpos_tm\n    tm_count_tm tm_decr_tm tm_setn_tm tm_mult_tm\n  by simp\n\nlocale turing_machine_PHI_init =\n  fixes G :: nat and M :: machine and p :: \"nat \\<Rightarrow> nat\"\nbegin\n\ndefinition \"tm3 \\<equiv> tm_right 9\"\ndefinition \"tm4 \\<equiv> tm3 ;; tm_length_input 11\"\ndefinition \"tm5 \\<equiv> tm4 ;; tm_polynomial p 11\"\ndefinition \"tm6 \\<equiv> tm5 ;; tm_copyn 15 16\"\ndefinition \"tm7 \\<equiv> tm6 ;; tm_add 11 16\"\ndefinition \"tm8 \\<equiv> tm7 ;; tm_incr 16\"\ndefinition \"tm9 \\<equiv> tm8 ;; tm_times2 16\"\ndefinition \"tm10 \\<equiv> tm9 ;; tm_copyn 16 17\"\ndefinition \"tm11 \\<equiv> tm10 ;; tm_write_replicate 2 17 9\"\ndefinition \"tm12 \\<equiv> tm11 ;; tm_left 9\"\ndefinition \"tm13 \\<equiv> tm12 ;; tm_list_headpos G M 2\"\ndefinition \"tm14 \\<equiv> tm13 ;; tm_count 4 17 4\"\ndefinition \"tm15 \\<equiv> tm14 ;; tm_decr 17\"\ndefinition \"tm16 \\<equiv> tm15 ;; tm_copyn 16 18\"\ndefinition \"tm17 \\<equiv> tm16 ;; tm_incr 18\"\ndefinition \"tm18 \\<equiv> tm17 ;; tm_add 17 18\"\ndefinition \"tm19 \\<equiv> tm18 ;; tm_setn 19 (max G (length M))\"\ndefinition \"tm20 \\<equiv> tm19 ;; tm_mult 18 19 20\"\n\nlemma tm20_eq_tm_PHI_init: \"tm20 = tm_PHI_init G M p\"\n  unfolding tm20_def tm19_def tm18_def tm17_def tm16_def tm15_def tm14_def tm13_def tm12_def tm11_def\n  unfolding tm10_def tm9_def tm8_def tm7_def tm6_def tm5_def tm4_def tm3_def tm_PHI_init_def\n  by simp\n\ncontext\n  fixes k H thalt :: nat and tps0 :: \"tape list\" and xs zs :: \"symbol list\"\n  assumes poly_p: \"polynomial p\"\n    and M_tm: \"turing_machine 2 G M\"\n    and k: \"k = length tps0\" \"20 < k\"\n    and H: \"H = max G (length M)\"\n    and xs: \"bit_symbols xs\"\n    and zs: \"zs = 2 # 2 # replicate (2 * length xs + 2 * p (length xs)) 2\"\n  assumes thalt:\n    \"\\<forall>t<thalt. fst (execute M (start_config 2 zs) t) < length M\"\n    \"fst (execute M (start_config 2 zs) thalt) = length M\"\n  assumes tps0:\n    \"tps0 ! 0 = (\\<lfloor>xs\\<rfloor>, 1)\"\n    \"\\<And>i. 0 < i \\<Longrightarrow> i \\<le> 10 \\<Longrightarrow> tps0 ! i = (\\<lfloor>[]\\<rfloor>, 0)\"\n    \"\\<And>i. 10 < i \\<Longrightarrow> i < k \\<Longrightarrow> tps0 ! i = (\\<lfloor>[]\\<rfloor>, 1)\"\nbegin\n\nlemma G: \"G \\<ge> 4\"\n  using M_tm turing_machine_def by simp\n\nlemma H: \"H \\<ge> length M\" \"H \\<ge> G\"\n  using H by simp_all\n\ndefinition \"tps3 \\<equiv> tps0\n  [9 := (\\<lfloor>[]\\<rfloor>, 1)]\"\n\nlemma tm3 [transforms_intros]: \"transforms tm3 tps0 1 tps3\"\n  unfolding tm3_def by (tform tps: tps3_def tps0 k)\n\nabbreviation \"n \\<equiv> length xs\"\n\ndefinition \"tps4 \\<equiv> tps0\n  [9 := (\\<lfloor>[]\\<rfloor>, 1),\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm4 [transforms_intros]:\n  assumes \"ttt = 5 + 11 * (length xs)\\<^sup>2\"\n  shows \"transforms tm4 tps0 ttt tps4\"\n  unfolding tm4_def\nproof (tform tps: tps3_def tps4_def tps0 k time: assms)\n  show \"proper_symbols xs\"\n    using xs by auto\n  show \"tps3 ! 11 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using canrepr_0 tps3_def tps0 k by simp\nqed\n\ndefinition \"tps5 \\<equiv> tps0\n  [9 := (\\<lfloor>[]\\<rfloor>, 1),\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm5 [transforms_intros]:\n  assumes \"ttt = 5 + 11 * (length xs)\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength (length xs))\\<^sup>2)\"\n  shows \"transforms tm5 tps0 ttt tps5\"\n  unfolding tm5_def by (tform tps: canrepr_0 tps4_def tps5_def tps0 k poly_p time: assms)\n\ndefinition \"tps6 \\<equiv> tps0\n  [9 := (\\<lfloor>[]\\<rfloor>, 1),\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm6 [transforms_intros]:\n  assumes \"ttt = 19 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) + 3 * nlength (p n)\"\n  shows \"transforms tm6 tps0 ttt tps6\"\n  unfolding tm6_def\nproof (tform tps: tps5_def tps6_def tps0 k)\n  show \"tps5 ! 16 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using canrepr_0 k tps0 tps5_def by simp\n  show \"ttt = 5 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n      (14 + 3 * (nlength (p n) + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps7 \\<equiv> tps0\n  [9 := (\\<lfloor>[]\\<rfloor>, 1),\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>n + p n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm7 [transforms_intros]:\n  assumes \"ttt = 29 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n))\"\n  shows \"transforms tm7 tps0 ttt tps7\"\n  unfolding tm7_def by (tform tps: tps6_def tps7_def tps0 k assms)\n\ndefinition \"tps8 \\<equiv> tps0\n  [9 := (\\<lfloor>[]\\<rfloor>, 1),\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>Suc (n + p n)\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm8 [transforms_intros]:\n  assumes \"ttt = 34 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n)\"\n  shows \"transforms tm8 tps0 ttt tps8\"\n  unfolding tm8_def by (tform tps: tps7_def tps8_def tps0 k assms)\n\ndefinition \"tps9 \\<equiv> tps0\n  [9 := (\\<lfloor>[]\\<rfloor>, 1),\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm9 [transforms_intros]:\n  assumes \"ttt = 39 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n))\"\n  shows \"transforms tm9 tps0 ttt tps9\"\n  unfolding tm9_def by (tform tps: tps8_def tps9_def tps0 k assms)\n\ndefinition \"tps10 \\<equiv> tps0\n  [9 := (\\<lfloor>[]\\<rfloor>, 1),\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm10 [transforms_intros]:\n  assumes \"ttt = 53 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 3 * nlength (Suc (Suc (2 * n + 2 * p n)))\"\n  shows \"transforms tm10 tps0 ttt tps10\"\n  unfolding tm10_def\nproof (tform tps: tps9_def tps10_def tps0 k)\n  show \"tps9 ! 17 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tps9_def canrepr_0 tps0 k by simp\n  show \"ttt = 39 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n      3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) +\n      2 * nlength (n + p n) + 2 * nlength (Suc (n + p n)) +\n      (14 + 3 * (nlength (Suc (Suc (2 * n + 2 * p n))) + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps11 \\<equiv> tps0\n  [9 := (\\<lfloor>zs\\<rfloor>, 1),\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm11 [transforms_intros]:\n  assumes \"ttt = 57 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 3 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    Suc (Suc (2 * n + 2 * p n)) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n))))\"\n  shows \"transforms tm11 tps0 ttt tps11\"\n  unfolding tm11_def\nproof (tform tps: tps10_def tps11_def tps0 k time: assms)\n  show \"tps11 = tps10\n    [17 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1),\n     9 := (\\<lfloor>replicate (Suc (Suc (2 * n + 2 * p n))) 2\\<rfloor>, 1)]\"\n    unfolding tps11_def tps10_def using zs by (simp add: list_update_swap[of _ 9])\nqed\n\ndefinition \"tps12 \\<equiv> tps0\n  [9 := (\\<lfloor>zs\\<rfloor>, 0),\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm12 [transforms_intros]:\n  assumes \"ttt = 82 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 7 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n))))\"\n  shows \"transforms tm12 tps0 ttt tps12\"\n  unfolding tm12_def\nproof (tform tps: tps11_def tps12_def tps0 k time: assms)\n  have \"tps11 ! 9 |-| 1 = (\\<lfloor>zs\\<rfloor>, 0)\"\n    using tps11_def k by simp\n  then show \"tps12 = tps11[9 := tps11 ! 9 |-| 1]\"\n    unfolding tps12_def tps11_def by (simp add: list_update_swap[of _ 9])\nqed\n\nabbreviation exc :: \"nat \\<Rightarrow> config\" where\n  \"exc t \\<equiv> execute M (start_config 2 zs) t\"\n\ndefinition \"tps13 \\<equiv> tps0\n  [9 := exc thalt <!> 0,\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1),\n   3 := (\\<lfloor>exc thalt <#> 0\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   6 := (\\<lfloor>exc thalt <#> 1\\<rfloor>\\<^sub>N, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc t <#> 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   10 := exc thalt <!> 1]\"\n\nlemma tm13 [transforms_intros]:\n  assumes \"ttt = 82 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 7 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n    (27 + 27 * thalt) * (9 + 2 * nlength thalt)\"\n  shows \"transforms tm13 tps0 ttt tps13\"\n  unfolding tm13_def\nproof (tform)\n  show \"turing_machine 2 G M\"\n    using M_tm .\n  show \"2 + 9 \\<le> length tps12\"\n    using tps12_def k by simp\n  show \"\\<forall>t<thalt. fst (execute M (start_config 2 zs) t) < length M\"\n      \"fst (execute M (start_config 2 zs) thalt) = length M\"\n    using thalt .\n  show \"symbols_lt G zs\"\n  proof -\n    have \"zs = replicate (2 * n + 2 * p n + 2) 2\"\n      using zs by simp\n    then have \"\\<forall>i<length zs. zs ! i = 2\"\n      using nth_replicate by (metis length_replicate)\n    then show ?thesis\n      using G by simp\n  qed\n  show \"tps13 = tps12\n    [2 + 1 := (\\<lfloor>snd (exc thalt) :#: 0\\<rfloor>\\<^sub>N, 1),\n     2 + 2 := (\\<lfloor>map (\\<lambda>t. snd (exc t) :#: 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n     2 + 4 := (\\<lfloor>snd (exc thalt) :#: 1\\<rfloor>\\<^sub>N, 1),\n     2 + 5 := (\\<lfloor>map (\\<lambda>t. snd (exc t) :#: 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n     2 + 7 := exc thalt <!> 0, 2 + 8 := exc thalt <!> 1]\"\n    unfolding tps13_def tps12_def by (simp add: list_update_swap[of _ 9])\n  show \"tps12 ! 2 = \\<lceil>\\<triangleright>\\<rceil>\"\n    using tps12_def tps0 onesie_1 by simp\n  show \"tps12 ! (2 + 1) = (\\<lfloor>0\\<rfloor>\\<^sub>N, 0)\"\n    using tps12_def tps0 canrepr_0 by simp\n  show \"tps12 ! (2 + 2) = (\\<lfloor>[]\\<rfloor>\\<^sub>N\\<^sub>L, 0)\"\n    using tps12_def tps0 nlcontents_Nil by simp\n  show \"tps12 ! (2 + 3) = \\<lceil>\\<triangleright>\\<rceil>\"\n    using tps12_def tps0 onesie_1 by simp\n  show \"tps12 ! (2 + 4) = (\\<lfloor>0\\<rfloor>\\<^sub>N, 0)\"\n    using tps12_def tps0 canrepr_0 by simp\n  show \"tps12 ! (2 + 5) = (\\<lfloor>[]\\<rfloor>\\<^sub>N\\<^sub>L, 0)\"\n    using tps12_def tps0 nlcontents_Nil by simp\n  show \"tps12 ! (2 + 6) = \\<lceil>\\<triangleright>\\<rceil>\"\n    using tps12_def tps0 onesie_1 by simp\n  show \"tps12 ! (2 + 7) = (\\<lfloor>zs\\<rfloor>, 0)\"\n    using tps12_def k tps0 by simp\n  show \"tps12 ! (2 + 8) = (\\<lfloor>[]\\<rfloor>, 0)\"\n    using tps12_def tps0 by simp\n  show \"ttt = 82 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n      3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n      2 * nlength (Suc (n + p n)) + 7 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n      (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n      27 * Suc thalt * (9 + 2 * nlength thalt)\"\n    using assms by simp\nqed\n\ndefinition \"tpsA \\<equiv> tps0\n  [9 := exc thalt <!> 0,\n   3 := (\\<lfloor>exc thalt <#> 0\\<rfloor>\\<^sub>N, 1),\n   6 := (\\<lfloor>exc thalt <#> 1\\<rfloor>\\<^sub>N, 1),\n   10 := exc thalt <!> 1]\"\n\ndefinition \"tps14 \\<equiv> tps0\n  [9 := exc thalt <!> 0,\n   11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>Suc thalt\\<rfloor>\\<^sub>N, 1),\n   3 := (\\<lfloor>exc thalt <#> 0\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   6 := (\\<lfloor>exc thalt <#> 1\\<rfloor>\\<^sub>N, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc t <#> 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   10 := exc thalt <!> 1]\"\n\nlemma tm14:\n  assumes \"ttt = 87 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 7 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n    (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n    14 * (nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]))\\<^sup>2\"\n  shows \"transforms tm14 tps0 ttt tps14\"\n  unfolding tm14_def\nproof (tform)\n  show \"4 < length tps13\" \"17 < length tps13\"\n    using tps13_def k by (simp_all only: length_list_update)\n  show \"tps13 ! 4 = (\\<lfloor>map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1)\"\n    using tps13_def k by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps13 ! 17 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tps13_def k by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps14 = tps13\n      [17 := (\\<lfloor>length (map (\\<lambda>t. snd (exc t) :#: 0) [0..<Suc thalt])\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps14_def tps13_def by (simp add: list_update_swap[of 17])\n  show \"ttt = 82 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n      3 * nlength (p n) +\n      3 * max (nlength n) (nlength (p n)) +\n      2 * nlength (n + p n) +\n      2 * nlength (Suc (n + p n)) +\n      7 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n      (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n      (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n      (14 * (nllength (map (\\<lambda>t. snd (exc t) :#: 0) [0..<Suc thalt]))\\<^sup>2 + 5)\"\n    using assms by simp\nqed\n\ndefinition \"tps14' \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>Suc thalt\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc t <#> 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1)]\"\n\nlemma tps14': \"tps14' = tps14\"\n  unfolding tps14'_def tps14_def tpsA_def by (simp add: list_update_swap)\n\nlemma len_tpsA: \"length tpsA = k\"\n  using tpsA_def k by simp\n\nlemma tm14' [transforms_intros]:\n  assumes \"ttt = 87 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 7 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n    (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n    14 * (nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]))\\<^sup>2\"\n  shows \"transforms tm14 tps0 ttt tps14'\"\n  using tm14 tps14' assms by simp\n\ndefinition \"tps15 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>thalt\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc t <#> 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1)]\"\n\nlemma tm15 [transforms_intros]:\n  assumes \"ttt = 95 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 7 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n    (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n    14 * (nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]))\\<^sup>2 +\n    2 * nlength (Suc thalt)\"\n  shows \"transforms tm15 tps0 ttt tps15\"\n  unfolding tm15_def\nproof (tform tps: tps14'_def len_tpsA k time: assms)\n  show \"tps15 = tps14'[17 := (\\<lfloor>Suc thalt - 1\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps15_def tps14'_def by (simp add: list_update_swap)\nqed\n\ndefinition \"tps16 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>thalt\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc t <#> 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm16 [transforms_intros]:\n  assumes \"ttt = 109 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 10 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n    (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n    14 * (nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]))\\<^sup>2 +\n    2 * nlength (Suc thalt)\"\n  shows \"transforms tm16 tps0 ttt tps16\"\n  unfolding tm16_def\nproof (tform tps: tps15_def tps16_def k len_tpsA)\n  have \"tps15 ! 18 = tpsA ! 18\"\n    using tps15_def by simp\n  also have \"... = tps0 ! 18\"\n    using tpsA_def by simp\n  also have \"... = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tps0 canrepr_0 k by simp\n  finally show \"tps15 ! 18 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\" .\n  show \"ttt = 95 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n      3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) +\n      2 * nlength (n + p n) + 2 * nlength (Suc (n + p n)) +\n      7 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n      (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) + (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n      14 * (nllength\n        (map (\\<lambda>t. snd (exc t) :#: 0) [0..<thalt] @ [snd (exc thalt) :#: 0]))\\<^sup>2 +\n      2 * nlength (Suc thalt) + (14 + 3 * (nlength (Suc (Suc (2 * n + 2 * p n))) + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps17 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>thalt\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc t <#> 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>Suc (2 * Suc (n + p n))\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm17 [transforms_intros]:\n  assumes \"ttt = 114 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 10 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n    (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n    14 * (nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]))\\<^sup>2 +\n    2 * nlength (Suc thalt) + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))\"\n  shows \"transforms tm17 tps0 ttt tps17\"\n  unfolding tm17_def by (tform tps: tps16_def tps17_def k len_tpsA time: assms)\n\ndefinition \"tps18 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>thalt\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc t <#> 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>thalt + Suc (2 * Suc (n + p n))\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm18 [transforms_intros]:\n  assumes \"ttt = 124 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 10 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n    (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n    14 * (nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]))\\<^sup>2 +\n    2 * nlength (Suc thalt) + 2 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    3 * max (nlength thalt) (nlength (Suc (Suc (Suc (2 * n + 2 * p n)))))\"\n  shows \"transforms tm18 tps0 ttt tps18\"\n  unfolding tm18_def by (tform tps: tps17_def tps18_def k len_tpsA time: assms)\n\ndefinition \"tps19 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>thalt\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc t <#> 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>thalt + Suc (2 * Suc (n + p n))\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>max G (length M)\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm19 [transforms_intros]:\n  assumes \"ttt = 134 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 10 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n    (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n    14 * (nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]))\\<^sup>2 +\n    2 * nlength (Suc thalt) + 2 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    3 * max (nlength thalt) (nlength (Suc (Suc (Suc (2 * n + 2 * p n))))) +\n    2 * nlength (max G (length M))\"\n  shows \"transforms tm19 tps0 ttt tps19\"\n  unfolding tm19_def\nproof (tform tps: assms nlength_0)\n  have \"tps18 ! 19 = tpsA ! 19\"\n    using tps18_def by simp\n  also have \"... = tps0 ! 19\"\n    using tpsA_def by simp\n  also have \"... = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tps0 canrepr_0 k by simp\n  finally show \"tps18 ! 19 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\" .\n  show \"19 < length tps18\"\n    using tps18_def len_tpsA k by simp\n  show \"tps19 = tps18[19 := (\\<lfloor>max G (length M)\\<rfloor>\\<^sub>N, 1)]\"\n    using tps19_def tps18_def len_tpsA k by presburger\nqed\n\ndefinition \"tps20 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>thalt\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc t <#> 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>thalt + Suc (2 * Suc (n + p n))\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>max G (length M)\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>(thalt + Suc (2 * Suc (n + p n))) * max G (length M)\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm20:\n  assumes \"ttt = 138 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 10 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n    (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n    14 * (nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]))\\<^sup>2 +\n    2 * nlength (Suc thalt) + 2 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    3 * max (nlength thalt) (nlength (Suc (Suc (Suc (2 * n + 2 * p n))))) +\n    2 * nlength (max G (length M)) +\n    26 * (nlength (Suc (Suc (Suc (thalt + (2 * n + 2 * p n))))) + nlength (max G (length M))) *\n     (nlength (Suc (Suc (Suc (thalt + (2 * n + 2 * p n))))) + nlength (max G (length M)))\"\n  shows \"transforms tm20 tps0 ttt tps20\"\n  unfolding tm20_def\nproof (tform time: assms)\n  have \"tps19 ! 20 = tpsA ! 20\"\n    using tps19_def by simp\n  also have \"... = tps0 ! 20\"\n    using tpsA_def by simp\n  also have \"... = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tps0 canrepr_0 k by simp\n  finally show \"tps19 ! 20 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\" .\n  show \"tps20 = tps19\n      [20 := (\\<lfloor>Suc (Suc (Suc (thalt + (2 * n + 2 * p n)))) * max G (length M)\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps20_def tps19_def by (simp add: list_update_swap)\n  show \"18 < length tps19\" \"19 < length tps19\" \"20 < length tps19\"\n    using tps19_def k len_tpsA by (simp_all only: length_list_update)\n  have \"tps19 ! 18 = (\\<lfloor>thalt + Suc (2 * Suc (n + p n))\\<rfloor>\\<^sub>N, 1)\"\n    using tps19_def tpsA_def len_tpsA k tps0 by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps19 ! 18 = (\\<lfloor>Suc (Suc (Suc (thalt + (2 * n + 2 * p n))))\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  show \"tps19 ! 19 = (\\<lfloor>max G (length M)\\<rfloor>\\<^sub>N, 1)\"\n    using tps19_def tpsA_def len_tpsA k tps0 by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\nqed\n\nlemma tm20' [transforms_intros]:\n  assumes \"ttt = (2 * d_polynomial p + 826) * (max G (length M) + thalt + Suc (Suc (Suc (2 * n + 2 * p n)))) ^ 4\"\n  shows \"transforms tm20 tps0 ttt tps20\"\nproof -\n  let ?ttt = \"138 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) +\n    3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 10 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) +\n    (27 + 27 * thalt) * (9 + 2 * nlength thalt) +\n    14 * (nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]))\\<^sup>2 +\n    2 * nlength (Suc thalt) + 2 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    3 * max (nlength thalt) (nlength (Suc (Suc (Suc (2 * n + 2 * p n))))) +\n    2 * nlength (max G (length M)) +\n    26 * (nlength (Suc (Suc (Suc (thalt + (2 * n + 2 * p n))))) + nlength (max G (length M))) *\n     (nlength (Suc (Suc (Suc (thalt + (2 * n + 2 * p n))))) + nlength (max G (length M)))\"\n  let ?a = \"3 * nlength (p n) + 3 * max (nlength n) (nlength (p n)) + 2 * nlength (n + p n) +\n    2 * nlength (Suc (n + p n)) + 10 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) + (27 + 27 * thalt) * (9 + 2 * nlength thalt)\"\n  let ?b = \"2 * nlength (Suc thalt) + 2 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n    3 * max (nlength thalt) (nlength (Suc (Suc (Suc (2 * n + 2 * p n))))) +\n    2 * nlength (max G (length M)) +\n    26 * (nlength (Suc (Suc (Suc (thalt + (2 * n + 2 * p n))))) + nlength (max G (length M))) *\n     (nlength (Suc (Suc (Suc (thalt + (2 * n + 2 * p n))))) + nlength (max G (length M)))\"\n  let ?m = \"max G (length M) + thalt + Suc (Suc (Suc (2 * n + 2 * p n)))\"\n  define m where \"m = max G (length M) + thalt + Suc (Suc (Suc (2 * n + 2 * p n)))\"\n  note m_def [simp]\n  have **: \"y \\<le> y * m\" for y\n    by simp\n  have *: \"nlength y \\<le> m\" if \"y \\<le> m\" for y\n    using nlength_mono[OF that] nlength_mono by (meson dual_order.trans nlength_le_n)\n  have 1: \"nlength (p n) \\<le> m\"\n    using * by simp\n  have 2: \"max (nlength n) (nlength (p n)) \\<le> m\"\n    using * by simp\n  have 3: \"nlength (n + p n) \\<le> m\"\n    using * by simp\n  have 4: \"nlength (Suc (n + p n)) \\<le> m\"\n    using * by simp\n  have 5: \"nlength (Suc (Suc (2 * n + 2 * p n))) \\<le> m\"\n    using * by simp\n  have 6: \"nlength n \\<le> m\"\n    using * by simp\n  have 7: \"2 * n + 2 * p n \\<le> m\"\n    by simp\n  have 8: \"thalt \\<le> m\" \"nlength thalt \\<le> m\" \"nlength (Suc thalt) \\<le> m\"\n    using * by simp_all\n  have 10: \"max (nlength thalt) (nlength (Suc (Suc (Suc (2 * n + 2 * p n))))) \\<le> m\"\n    using * by simp\n  have 11: \"nlength (Suc (Suc (Suc (thalt + (2 * n + 2 * p n))))) \\<le> m\"\n    using * by simp\n  have 12: \"nlength (Suc (Suc (Suc (thalt + (2 * n + 2 * p n))))) + nlength (max G (length M)) \\<le> m\"\n    using * nlength_le_n by (smt (verit) ab_semigroup_add_class.add_ac(1) add.commute add_Suc_right add_le_mono m_def)\n  have 13: \"nlength (max G (length M)) \\<le> m\"\n    using 12 by simp\n  have 14: \"Suc (nlength thalt) \\<le> m\"\n  proof -\n    have \"nlength thalt \\<le> nlength m\"\n      using nlength_mono by simp\n    moreover have \"m \\<ge> 3\"\n      by simp\n    ultimately have \"nlength thalt < m\"\n      using nlength_less_n dual_order.strict_trans2 by blast\n    then show ?thesis\n      by simp\n  qed\n  have 15: \"Suc thalt \\<le> m\"\n    by simp\n\n  have \"?a \\<le> 20 * m +\n      (2 * n + 2 * p n) * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) + (27 + 27 * thalt) * (9 + 2 * nlength thalt)\"\n    using 1 2 3 4 5 by linarith\n  also have \"... \\<le> 20 * m + m * (12 + 2 * nlength (Suc (Suc (2 * n + 2 * p n)))) + (27 + 27 * thalt) * (9 + 2 * nlength thalt)\"\n    using 7 by (metis add.commute add_mono_thms_linordered_semiring(2) mult_Suc_right mult_le_cancel2)\n  also have \"... \\<le> 20 * m + m * (12 + 2 * m) + (27 + 27 * thalt) * (9 + 2 * nlength thalt)\"\n    using 5 by (meson add_left_mono add_mono_thms_linordered_semiring(3) mult_le_mono2)\n  also have \"... \\<le> 20 * m + m * (12 + 2 * m) + (27 + 27 * m) * (9 + 2 * m)\"\n    using 8 add_le_mono le_refl mult_le_mono by presburger\n  also have \"... \\<le> 20 * m + m * (12 * m + 2 * m) + (27 * m + 27 * m) * (9 + 2 * m)\"\n    using ** by (meson add_le_mono add_mono_thms_linordered_semiring(2) add_mono_thms_linordered_semiring(3) mult_le_mono1 mult_le_mono2)\n  also have \"... \\<le> 20 * m + m * (12 * m + 2 * m) + (27 * m + 27 * m) * (9 * m + 2 * m)\"\n    using ** by simp\n  also have \"... = 20 * m + m * 14 * m + 54 * m * 11 * m\"\n    by algebra\n  also have \"... = 20 * m + 14 * m ^ 2 + 594 * m ^ 2\"\n    by algebra\n  also have \"... = 20 * m + 608 * m ^ 2\"\n    by simp\n  also have \"... \\<le> 20 * m ^ 2 + 608 * m ^ 2\"\n    using linear_le_pow by (meson add_le_mono1 mult_le_mono2 zero_less_numeral)\n  also have \"... = 628 * m ^ 2\"\n    by simp\n  finally have part1: \"?a \\<le> 628 * m ^ 2\" .\n\n  have \"nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]) \\<le> Suc (nlength thalt) * Suc thalt\"\n  proof -\n    have \"exc t <#> 0 \\<le> thalt\" if \"t \\<le> thalt\" for t\n      using that M_tm head_pos_le_halting_time thalt(2) zero_less_numeral by blast\n    then have \"y \\<le> thalt\" if \"y \\<in> set (map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt])\" for y\n      using that by force\n    then have \"nllength (map (\\<lambda>t. exc t <#> 0) [0..<Suc thalt]) \\<le> Suc (nlength thalt) * Suc thalt\"\n        (is \"nllength ?ns \\<le> _\")\n      using nllength_le_len_mult_max[of ?ns thalt] by simp\n    then show ?thesis\n      by simp\n  qed\n  then have part2: \"nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]) \\<le> m * m\"\n    using 14 15 by (meson le_trans mult_le_mono)\n\n  have \"?b = 2 * nlength (Suc thalt) + 2 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n      3 * max (nlength thalt) (nlength (Suc (Suc (Suc (2 * n + 2 * p n))))) + 2 * nlength (max G (length M)) +\n      26 * (nlength (Suc (Suc (Suc (thalt + (2 * n + 2 * p n))))) + nlength (max G (length M))) ^ 2\"\n    by algebra\n  also have \"... \\<le> 2 * nlength (Suc thalt) + 2 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n      3 * max (nlength thalt) (nlength (Suc (Suc (Suc (2 * n + 2 * p n))))) + 2 * nlength (max G (length M)) +\n      26 * m ^ 2\"\n    using 12 by simp\n  also have \"... \\<le> 2 * nlength (Suc thalt) + 2 * nlength (Suc (Suc (2 * n + 2 * p n))) +\n      3 * m + 2 * nlength (max G (length M)) + 26 * m ^ 2\"\n    using 10 by linarith\n  also have \"... \\<le> 2 * m + 2 * m + 3 * m + 2 * m + 26 * m ^ 2\"\n    using 13 8 5 by simp\n  also have \"... = 9 * m + 26 * m ^ 2\"\n    by simp\n  also have \"... \\<le> 9 * m ^ 2 + 26 * m ^ 2\"\n    using linear_le_pow by (meson add_le_mono1 mult_le_mono2 zero_less_numeral)\n  also have \"... = 35 * m ^ 2\"\n    by simp\n  finally have part3: \"?b \\<le> 35 * m ^ 2\" .\n\n  have \"?ttt = 138 + 11 * n\\<^sup>2 + (d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2) + ?a +\n      14 * (nllength (map (\\<lambda>t. exc t <#> 0) [0..<thalt] @ [exc thalt <#> 0]))\\<^sup>2 + ?b\"\n    by simp\n  also have \"... \\<le> 138 + 11 * n\\<^sup>2 + d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2 + ?a + 14 * (m * m)\\<^sup>2 + ?b\"\n    using part2 by simp\n  also have \"... \\<le> 138 + 11 * n\\<^sup>2 + d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2 + ?a + 14 * (m * m)\\<^sup>2 + 35 * m ^ 2\"\n    using part3 by linarith\n  also have \"... \\<le> 138 + 11 * n\\<^sup>2 + d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2 + 628 * m ^ 2 + 14 * (m * m)\\<^sup>2 + 35 * m ^ 2\"\n    using part1 by linarith\n  also have \"... = 138 + 11 * n\\<^sup>2 + d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2 + 663 * m ^ 2 + 14 * m ^ 4\"\n    by algebra\n  also have \"... \\<le> 138 + 11 * m ^ 2 + d_polynomial p + d_polynomial p * (nlength n)\\<^sup>2 + 663 * m ^ 2 + 14 * m ^ 4\"\n    by simp\n  also have \"... \\<le> 138 + 11 * m ^ 2 + d_polynomial p + d_polynomial p * m ^ 2 + 663 * m ^ 2 + 14 * m ^ 4\"\n    using 6 by simp\n  also have \"... = 138 + d_polynomial p + d_polynomial p * m ^ 2 + 674 * m ^ 2 + 14 * m ^ 4\"\n    by simp\n  also have \"... \\<le> 138 + d_polynomial p + d_polynomial p * m ^ 4 + 674 * m ^ 2 + 14 * m ^ 4\"\n    using pow_mono'[of 2 4] by simp\n  also have \"... \\<le> 138 + d_polynomial p + d_polynomial p * m ^ 4 + 674 * m ^ 4 + 14 * m ^ 4\"\n    using pow_mono'[of 2 4] by simp\n  also have \"... = 138 + d_polynomial p + d_polynomial p * m ^ 4 + 688 * m ^ 4\"\n    by simp\n  also have \"... \\<le> 138 * m + d_polynomial p + d_polynomial p * m ^ 4 + 688 * m ^ 4\"\n    using ** by simp\n  also have \"... \\<le> 138 * m ^ 4 + d_polynomial p + d_polynomial p * m ^ 4 + 688 * m ^ 4\"\n    using linear_le_pow[of 4 m] by simp\n  also have \"... = d_polynomial p + d_polynomial p * m ^ 4 + 826 * m ^ 4\"\n    by simp\n  also have \"... \\<le> d_polynomial p * m + d_polynomial p * m ^ 4 + 826 * m ^ 4\"\n    using ** by simp\n  also have \"... \\<le> d_polynomial p * m ^ 4 + d_polynomial p * m ^ 4 + 826 * m ^ 4\"\n    using linear_le_pow[of 4 m] by (simp del: m_def)\n  also have \"... = 2 * d_polynomial p * m ^ 4 + 826 * m ^ 4\"\n    by simp\n  also have \"... = (2 * d_polynomial p + 826) * m ^ 4\"\n    by algebra\n  finally have \"?ttt \\<le> (2 * d_polynomial p + 826) * m ^ 4\" .\n  then have \"?ttt \\<le> ttt\"\n    using assms by simp\n  then show ?thesis\n    using tm20 transforms_monotone by fast\nqed\n\nend  (* context tps0 *)\n\nend  (* locale turing_machine_PHI_init *)\n\nlemma transforms_tm_PHI_initI:\n  fixes G :: nat and M :: machine and p :: \"nat \\<Rightarrow> nat\"\n  fixes k H thalt :: nat and tps tps' :: \"tape list\" and xs zs :: \"symbol list\"\n  assumes poly_p: \"polynomial p\"\n    and M_tm: \"turing_machine 2 G M\"\n    and k: \"k = length tps\" \"20 < k\"\n    and H: \"H = max G (length M)\"\n    and xs: \"bit_symbols xs\"\n    and zs: \"zs = 2 # 2 # replicate (2 * length xs + 2 * p (length xs)) 2\"\n  assumes thalt:\n    \"\\<forall>t<thalt. fst (execute M (start_config 2 zs) t) < length M\"\n    \"fst (execute M (start_config 2 zs) thalt) = length M\"\n  assumes tps0:\n    \"tps ! 0 = (\\<lfloor>xs\\<rfloor>, 1)\"\n    \"\\<And>i. 0 < i \\<Longrightarrow> i \\<le> 10 \\<Longrightarrow> tps ! i = (\\<lfloor>[]\\<rfloor>, 0)\"\n    \"\\<And>i. 10 < i \\<Longrightarrow> i < k \\<Longrightarrow> tps ! i = (\\<lfloor>[]\\<rfloor>, 1)\"\n  assumes \"ttt = (2 * d_polynomial p + 826) * (max G (length M) + thalt + Suc (Suc (Suc (2 * (length xs) + 2 * p (length xs))))) ^ 4\"\n  assumes \"tps' = tps\n      [9 := execute M (start_config 2 zs) thalt <!> 0,\n       3 := (\\<lfloor>execute M (start_config 2 zs) thalt <#> 0\\<rfloor>\\<^sub>N, 1),\n       6 := (\\<lfloor>execute M (start_config 2 zs) thalt <#> 1\\<rfloor>\\<^sub>N, 1),\n       10 := execute M (start_config 2 zs) thalt <!> 1,\n       11 := (\\<lfloor>length xs\\<rfloor>\\<^sub>N, 1),\n       15 := (\\<lfloor>p (length xs)\\<rfloor>\\<^sub>N, 1),\n       16 := (\\<lfloor>2 * Suc ((length xs) + p (length xs))\\<rfloor>\\<^sub>N, 1),\n       17 := (\\<lfloor>thalt\\<rfloor>\\<^sub>N, 1),\n       4 := (\\<lfloor>map (\\<lambda>t. execute M (start_config 2 zs) t <#> 0) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n       7 := (\\<lfloor>map (\\<lambda>t. execute M (start_config 2 zs) t <#> 1) [0..<Suc thalt]\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n       18 := (\\<lfloor>thalt + Suc (2 * Suc ((length xs) + p (length xs)))\\<rfloor>\\<^sub>N, 1),\n       19 := (\\<lfloor>max G (length M)\\<rfloor>\\<^sub>N, 1),\n       20 := (\\<lfloor>(thalt + Suc (2 * Suc ((length xs) + p (length xs)))) * max G (length M)\\<rfloor>\\<^sub>N, 1)]\"\n  shows \"transforms (tm_PHI_init G M p) tps ttt tps'\"\nproof -\n  interpret loc: turing_machine_PHI_init G M p .\n  note ctx = poly_p M_tm k H xs zs thalt tps0\n  have \"transforms loc.tm20 tps ttt (loc.tps20 thalt tps xs zs)\"\n    using assms loc.tm20'[OF ctx] loc.tps20_def[OF ctx] loc.tpsA_def[OF ctx]\n    by blast\n  then have \"transforms (tm_PHI_init G M p) tps ttt (loc.tps20 thalt tps xs zs)\"\n    using loc.tm20_eq_tm_PHI_init by simp\n  moreover have \"loc.tps20 thalt tps xs zs = tps'\"\n    using assms loc.tps20_def[OF ctx] loc.tpsA_def[OF ctx] by presburger\n  ultimately show ?thesis\n    by simp\nqed\n\ntext \\<open>\nNext we transfer the semantics of @{const tm_PHI_init} to the locale\n@{locale reduction_sat_x}.\n\\<close>\n\nlemma (in reduction_sat_x) tm_PHI_init [transforms_intros]:\n  fixes k :: nat and tps tps' :: \"tape list\"\n  assumes \"k = length tps\" and \"20 < k\"\n  assumes\n      \"tps ! 0 = (\\<lfloor>xs\\<rfloor>, 1)\"\n      \"\\<And>i. 0 < i \\<Longrightarrow> i \\<le> 10 \\<Longrightarrow> tps ! i = (\\<lfloor>[]\\<rfloor>, 0)\"\n      \"\\<And>i. 10 < i \\<Longrightarrow> i < k \\<Longrightarrow> tps ! i = (\\<lfloor>[]\\<rfloor>, 1)\"\n  assumes \"ttt = (2 * d_polynomial p + 826) * (H + T' + Suc (Suc (Suc (2 * n + 2 * p n)))) ^ 4\"\n  assumes \"tps' = tps\n      [9 := exc (zeros m) T' <!> 0,\n       3 := (\\<lfloor>exc (zeros m) T' <#> 0\\<rfloor>\\<^sub>N, 1),\n       6 := (\\<lfloor>exc (zeros m) T' <#> 1\\<rfloor>\\<^sub>N, 1),\n       10 := exc (zeros m) T' <!> 1,\n       11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n       15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n       16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n       17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n       4 := (\\<lfloor>map (\\<lambda>t. exc (zeros m) t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n       7 := (\\<lfloor>map (\\<lambda>t. exc (zeros m) t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n       18 := (\\<lfloor>T' + Suc (2 * Suc (n + p n))\\<rfloor>\\<^sub>N, 1),\n       19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n       20 := (\\<lfloor>(T' + Suc (2 * Suc (n + p n))) * H\\<rfloor>\\<^sub>N, 1)]\"\n  shows \"transforms (tm_PHI_init G M p) tps ttt tps'\"\nproof -\n  have nx: \"n = length xs\"\n    by simp\n  then have zeros_zs: \"zeros m = 2 # 2 # replicate (2 * length xs + 2 * p (length xs)) 2\"\n    using zeros m_def by simp\n  then have thalt:\n      \"\\<forall>t<T' . fst (exc (zeros m) t) < length M\"\n      \"fst (exc (zeros m) T') = length M\"\n    using less_TT TT T'_def by metis+\n  have H: \"H = max G (length M)\"\n    using H_def by simp\n  have ttt: \"ttt = (2 * d_polynomial p + 826) *\n      (max G (length M) + T' + Suc (Suc (Suc (2 * (length xs) + 2 * p (length xs))))) ^ 4\"\n    using H nx assms(6) by simp\n  have tps': \"tps' = tps\n      [9 := exc (zeros m) T' <!> 0,\n      3 := (\\<lfloor>snd (exc (zeros m) T') :#: 0\\<rfloor>\\<^sub>N, 1),\n      6 := (\\<lfloor>snd (exc (zeros m) T') :#: 1\\<rfloor>\\<^sub>N, 1),\n      10 := exc (zeros m) T' <!> 1, 11 := (\\<lfloor>length xs\\<rfloor>\\<^sub>N, 1),\n      15 := (\\<lfloor>p (length xs)\\<rfloor>\\<^sub>N, 1),\n      16 := (\\<lfloor>2 * Suc (length xs + p (length xs))\\<rfloor>\\<^sub>N, 1),\n      17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n      4 := (\\<lfloor>map (\\<lambda>t. snd (exc (zeros m) t) :#: 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n      7 := (\\<lfloor>map (\\<lambda>t. snd (exc (zeros m) t) :#: 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n      18 := (\\<lfloor>T' + Suc (2 * Suc (length xs + p (length xs)))\\<rfloor>\\<^sub>N, 1),\n      19 := (\\<lfloor>max G (length M)\\<rfloor>\\<^sub>N, 1),\n      20 := (\\<lfloor>(T' + Suc (2 * Suc (length xs + p (length xs)))) * max G (length M)\\<rfloor>\\<^sub>N, 1)]\"\n    using H nx assms(7) by presburger\n  show \"transforms (tm_PHI_init G M p) tps ttt tps'\"\n    using transforms_tm_PHI_initI[OF p tm_M assms(1,2) H bs_xs zeros_zs thalt assms(3,4,5) ttt tps'] .\nqed\n\n\nsection \\<open>The actual Turing machine computing the reduction\\<close>\n\ntext \\<open>\nIn this section we put everything together to build a Turing machine that given\na string $x$ outputs the CNF formula $\\Phi$ defined in Chapter~\\ref{s:Reducing}.\nIn principle this is just a sequence of the TMs @{const tm_PHI_init}, @{const\ntm_PHI0}, $\\dots$, @{const tm_PHI9}, where @{const tm_PHI345} occurs once for\neach of the formulas $\\Phi_3$, $\\Phi_4$, and $\\Phi_5$. All these TMs are linked\nby TMs that copy values prepared by @{const tm_PHI_init} to the tapes where the\nfollowing TM expects them. Also as the very first step the tape heads on tapes\n$0$ and $11$ and beyond must be moved one cell to the right to meet @{const\ntm_PHI_init}'s expectations.\n\nThe TM will have 110 tapes because we just allocate another batch of tapes for\nevery TM computing a $\\Phi_i$, rather than cleaning up and reusing tapes.\n\\<close>\n\ntext \\<open>\nThe Turing machine for computing $\\Phi$ is to be defined in the locale @{locale\nreduction_sat}. We save the space to write the TM in closed form.\n\\<close>\n\ncontext reduction_sat\nbegin\n\ndefinition \"tm1 \\<equiv> tm_right_many {i. i < 1 \\<or> 10 < i}\"\ndefinition \"tm2 \\<equiv> tm1 ;; tm_PHI_init G M p\"\n\ndefinition \"tm3 \\<equiv> tm2 ;; tm_copyn 18 21\"\ndefinition \"tm4 \\<equiv> tm3 ;; tm_copyn 19 22\"\ndefinition \"tm5 \\<equiv> tm4 ;; tm_right 1\"\ndefinition \"tm6 \\<equiv> tm5 ;; tm_PHI0 21\"\n\ndefinition \"tm7 \\<equiv> tm6 ;; tm_setn 29 H\"\ndefinition \"tm8 \\<equiv> tm7 ;; tm_PHI1 28\"\n\ndefinition \"tm9 \\<equiv> tm8 ;; tm_copyn 11 35\"\ndefinition \"tm10 \\<equiv> tm9 ;; tm_setn 36 H\"\ndefinition \"tm11 \\<equiv> tm10 ;; tm_PHI2 35\"\n\ndefinition \"tm12 \\<equiv> tm11 ;; tm_setn 42 1\"\ndefinition \"tm13 \\<equiv> tm12 ;; tm_setn 43 H\"\ndefinition \"tm14 \\<equiv> tm13 ;; tm_setn 44 2\"\ndefinition \"tm15 \\<equiv> tm14 ;; tm_copyn 11 50\"\ndefinition \"tm16 \\<equiv> tm15 ;; tm_times2incr 50\"\ndefinition \"tm17 \\<equiv> tm16 ;; tm_PHI345 2 42\"\n\ndefinition \"tm18 \\<equiv> tm17 ;; tm_setn 52 H\"\ndefinition \"tm19 \\<equiv> tm18 ;; tm_setn 53 2\"\ndefinition \"tm20 \\<equiv> tm19 ;; tm_copyn 11 51\"\ndefinition \"tm21 \\<equiv> tm20 ;; tm_times2 51\"\ndefinition \"tm22 \\<equiv> tm21 ;; tm_plus_const 3 51\"\ndefinition \"tm23 \\<equiv> tm22 ;; tm_copyn 16 59\"\ndefinition \"tm24 \\<equiv> tm23 ;; tm_incr 59\"\ndefinition \"tm25 \\<equiv> tm24 ;; tm_PHI345 2 51\"\n\ndefinition \"tm26 \\<equiv> tm25 ;; tm_setn 61 H\"\ndefinition \"tm27 \\<equiv> tm26 ;; tm_copyn 16 60\"\ndefinition \"tm28 \\<equiv> tm27 ;; tm_incr 60\"\ndefinition \"tm29 \\<equiv> tm28 ;; tm_copyn 60 68\"\ndefinition \"tm30 \\<equiv> tm29 ;; tm_add 17 68\"\ndefinition \"tm31 \\<equiv> tm30 ;; tm_PHI345 1 60\"\n\ndefinition \"tm32 \\<equiv> tm31 ;; tm_setn 69 2\"\ndefinition \"tm33 \\<equiv> tm32 ;; tm_setn 70 H\"\ndefinition \"tm34 \\<equiv> tm33 ;; tm_PHI6 69\"\n\ndefinition \"tm35 \\<equiv> tm34 ;; tm_copyn 11 77\"\ndefinition \"tm36 \\<equiv> tm35 ;; tm_times2 77\"\ndefinition \"tm37 \\<equiv> tm36 ;; tm_plus_const 4 77\"\ndefinition \"tm38 \\<equiv> tm37 ;; tm_setn 78 H\"\ndefinition \"tm39 \\<equiv> tm38 ;; tm_copyn 15 83\"\ndefinition \"tm40 \\<equiv> tm39 ;; tm_PHI7 77\"\n\ndefinition \"tm41 \\<equiv> tm40 ;; tm_copyn 18 84\"\ndefinition \"tm42 \\<equiv> tm41 ;; tm_add 17 84\"\ndefinition \"tm43 \\<equiv> tm42 ;; tm_add 17 84\"\ndefinition \"tm44 \\<equiv> tm43 ;; tm_add 17 84\"\ndefinition \"tm45 \\<equiv> tm44 ;; tm_incr 84\"\ndefinition \"tm46 \\<equiv> tm45 ;; tm_setn 85 H\"\ndefinition \"tm47 \\<equiv> tm46 ;; tm_PHI8 84\"\n\ndefinition \"tm48 \\<equiv> tm47 ;; tm_copyn 20 91\"\ndefinition \"tm49 \\<equiv> tm48 ;; tm_setn 92 H\"\ndefinition \"tm50 \\<equiv> tm49 ;; tm_setn 93 Z\"\ndefinition \"tm51 \\<equiv> tm50 ;; tm_copyn 17 94\"\ndefinition \"tm52 \\<equiv> tm51 ;; tm_set 95 (numlistlist (formula_n \\<psi>))\"\ndefinition \"tm53 \\<equiv> tm52 ;; tm_set 96 (numlistlist (formula_n \\<psi>'))\"\ndefinition \"tm54 \\<equiv> tm53 ;; tm_setn 97 1\"\ndefinition \"tm55 \\<equiv> tm54 ;; tm_PHI9 4 7 91\"\n\ndefinition \"tm56 \\<equiv> tm55 ;; tm_cr 1\"\ndefinition \"tm57 \\<equiv> tm56 ;; tm_cp_until 1 109 {0}\"\ndefinition \"tm58 \\<equiv> tm57 ;; tm_erase_cr 1\"\ndefinition \"tm59 \\<equiv> tm58 ;; tm_cr 109\"\ndefinition \"tm60 \\<equiv> tm59 ;; tm_binencode 109 1\"\n\ndefinition H' :: nat where\n  \"H' \\<equiv> Suc (Suc H)\"\n\nlemma H_gr_3: \"H > 3\"\n  using H_def tm_M turing_machine_def by auto\n\nlemma H': \"H' \\<ge> Suc (length M)\" \"H' \\<ge> G\" \"H' \\<ge> 6\"\n  using H'_def H_ge_length_M H_ge_G H_gr_3 by simp_all\n\nlemma tm40_tm: \"turing_machine 110 H' tm40\"\n  unfolding tm40_def tm39_def tm38_def tm37_def tm36_def tm35_def tm34_def tm33_def tm32_def tm31_def\n  unfolding tm30_def tm29_def tm28_def tm27_def tm26_def tm25_def tm24_def tm23_def tm22_def tm21_def\n  unfolding tm20_def tm19_def tm18_def tm17_def tm16_def tm15_def tm14_def tm13_def tm12_def tm11_def\n  unfolding tm10_def tm9_def tm8_def tm7_def tm6_def tm5_def tm4_def tm3_def tm2_def tm1_def\n  using H'\n    tm_copyn_tm tm_add_tm tm_incr_tm tm_times2_tm tm_setn_tm tm_times2incr_tm\n    tm_plus_const_tm tm_right_tm tm_right_many_tm\n    tm_PHI_init_tm[OF tm_M] tm_PHI0_tm tm_PHI1_tm tm_PHI2_tm tm_PHI345_tm tm_PHI6_tm tm_PHI7_tm\n  by simp\n\nlemma tm55_tm: \"turing_machine 110 H' tm55\"\n  unfolding tm55_def tm54_def tm53_def tm52_def tm51_def\n  unfolding tm50_def tm49_def tm48_def tm47_def tm46_def tm45_def tm44_def tm43_def tm42_def tm41_def\n  using tm40_tm H'\n    tm_copyn_tm tm_add_tm tm_incr_tm tm_setn_tm tm_set_tm[OF _ _ _ symbols_lt_numlistlist]\n    tm_PHI8_tm tm_PHI9_tm\n  by simp\n\nlemma tm60_tm: \"turing_machine 110 H' tm60\"\n  unfolding tm60_def tm59_def tm58_def tm57_def tm56_def\n  using tm55_tm H' tm_erase_cr_tm tm_cr_tm tm_cp_until_tm tm_binencode_tm\n  by simp\n\nend  (* locale reduction_sat *)\n\ntext \\<open>\nUnlike before, we prove the semantics inside locale @{locale reduction_sat_x} since we\nneed not be concerned with ``polluting'' the namespace of the locale. After all there\nwill not be any more Turing machines.\n\\<close>\n\ncontext reduction_sat_x\nbegin\n\ncontext\n  fixes tps0 :: \"tape list\"\n  assumes k: \"110 = length tps0\"\n  assumes tps0:\n      \"tps0 ! 0 = (\\<lfloor>xs\\<rfloor>, 0)\"\n      \"\\<And>i. 0 < i \\<Longrightarrow> i < 110\\<Longrightarrow> tps0 ! i = (\\<lfloor>[]\\<rfloor>, 0)\"\nbegin\n\ndefinition \"tps1 \\<equiv> map (\\<lambda>j. if j < 1 \\<or> 10 < j then tps0 ! j |+| 1 else tps0 ! j) [0..<110]\"\n\nlemma lentps1: \"length tps1 = 110\"\n  using tps1_def by simp\n\nlemma tps1:\n  \"0 < j \\<Longrightarrow> j < 10 \\<Longrightarrow> tps1 ! j = (\\<lfloor>[]\\<rfloor>, 0)\"\n  \"10 < j \\<Longrightarrow> j < 110 \\<Longrightarrow> tps1 ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tps1_def k tps0 by simp_all\n\nlemma tps1': \"tps1 ! 0 = (\\<lfloor>xs\\<rfloor>, 1)\"\nproof -\n  have \"tps1 ! 0 = tps0 ! 0 |+| 1\"\n    using tps1_def k lentps1\n    by (smt (verit, del_insts) add.right_neutral length_greater_0_conv length_map less_or_eq_imp_le list.size(3)\n      not_numeral_le_zero nth_map nth_upt zero_less_one)\n  then show ?thesis\n    using tps0 by simp\nqed\n\nlemma tm1 [transforms_intros]: \"transforms tm1 tps0 1 tps1\"\n  unfolding tm1_def by (tform tps: tps1_def tps0 k)\n\nabbreviation \"zs \\<equiv> zeros m\"\n\ndefinition \"tpsA \\<equiv> tps1\n  [9 := exc zs T' <!> 0,\n   3 := (\\<lfloor>exc zs T' <#> 0\\<rfloor>\\<^sub>N, 1),\n   6 := (\\<lfloor>exc zs T' <#> 1\\<rfloor>\\<^sub>N, 1),\n   10 := exc zs T' <!> 1]\"\n\nlemma tpsA:\n  \"tpsA ! 0 = (\\<lfloor>xs\\<rfloor>, 1)\"\n  \"tpsA ! 1 = (\\<lfloor>[]\\<rfloor>, 0)\"\n  \"10 < j \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsA ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsA_def tps1 tps1' by simp_all\n\nlemma lentpsA: \"length tpsA = 110\"\n  using tpsA_def tps1_def k by simp\n\ndefinition \"tps2 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma lentps2: \"length tps2 = 110\"\n  using tps2_def lentpsA by simp\n\nlemma tm2 [transforms_intros]:\n  assumes \"ttt = 1 + (2 * d_polynomial p + 826) * (H + m') ^ 4\"\n  shows \"transforms tm2 tps0 ttt tps2\"\n  unfolding tm2_def\nproof (tform tps: tps0 tps1_def k lentps1)\n  have m': \"m' = T' + Suc (2 * Suc (n + p n))\"\n    using m'_def by simp\n  show \"ttt = 1 + ((2 * d_polynomial p + 826) * (H + T' + Suc (Suc (Suc (2 * n + 2 * p n)))) ^ 4)\"\n    using assms m'\n    by (metis ab_semigroup_add_class.add_ac(1) add_2_eq_Suc distrib_left_numeral mult_Suc_right)\n  have m: \"m = 2 * Suc (n + p n)\"\n    using m_def by simp\n  show \"tps2 = tps1\n    [9 := exc zs T' <!> 0,\n     3 := (\\<lfloor>snd (exc zs T') :#: 0\\<rfloor>\\<^sub>N, 1),\n     6 := (\\<lfloor>snd (exc zs T') :#: 1\\<rfloor>\\<^sub>N, 1),\n     10 := exc zs T' <!> 1, 11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n     15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n     16 := (\\<lfloor>2 * Suc (n + p n)\\<rfloor>\\<^sub>N, 1),\n     17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n     4 := (\\<lfloor>map (\\<lambda>t. snd (exc zs t) :#: 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n     7 := (\\<lfloor>map (\\<lambda>t. snd (exc zs t) :#: 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n     18 := (\\<lfloor>T' + Suc (2 * Suc (n + p n))\\<rfloor>\\<^sub>N, 1),\n     19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n     20 := (\\<lfloor>(T' + Suc (2 * Suc (n + p n))) * H\\<rfloor>\\<^sub>N, 1)]\"\n    using tps2_def tpsA_def m m' by presburger\nqed\n\ndefinition \"tps3 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   21 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma lentps3: \"length tps3 = 110\"\n  using tps3_def lentpsA by simp\n\nlemma tm3 [transforms_intros]:\n  assumes \"ttt = 15 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m'\"\n  shows \"transforms tm3 tps0 ttt tps3\"\n  unfolding tm3_def\nproof (tform tps: lentps2 k assms tps2_def)\n  have \"tps2 ! 21 = tpsA ! 21\"\n    using tps2_def by simp\n  then show \"tps2 ! 21 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsA canrepr_0 k lentps1 by simp\n  show \"tps3 = tps2[21 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps3_def tps2_def by (simp only:)\n  show \"ttt = 1 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + (14 + 3 * (nlength m' + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps4 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   21 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   22 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma lentps4: \"length tps4 = 110\"\n  using tps4_def lentpsA by (simp only: length_list_update)\n\nlemma tm4 [transforms_intros]:\n  assumes \"ttt = 29 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 3 * nlength H\"\n  shows \"transforms tm4 tps0 ttt tps4\"\n  unfolding tm4_def\nproof (tform)\n  show \"19 < length tps3\" \"22 < length tps3\"\n   using lentps3 k by simp_all\n  show \"tps3 ! 19 = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps3_def lentps3 k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  have \"tps3 ! 22 = tpsA ! 22\"\n    unfolding tps3_def by simp\n  then show \"tps3 ! 22 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsA canrepr_0 k lentps1 by simp\n  show \"tps4 = tps3[22 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps4_def tps3_def by (simp only:)\n  show \"ttt = 15 + (2 * d_polynomial p + 826) * (H + m') ^ 4 +\n      3 * nlength m' + (14 + 3 * (nlength H + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps5 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   21 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   22 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   1 := (\\<lfloor>[]\\<rfloor>, 1)]\"\n\nlemma lentps5: \"length tps5 = 110\"\n  using tps5_def lentpsA by (simp only: length_list_update)\n\nlemma tm5 [transforms_intros]:\n  assumes \"ttt = 30 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 3 * nlength H\"\n  shows \"transforms tm5 tps0 ttt tps5\"\n  unfolding tm5_def\nproof (tform)\n  show \"1 < length tps4\"\n    using lentps4 k by simp\n  show \"ttt = 29 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 3 * nlength H + Suc 0\"\n    using assms by simp\n  have \"tps4 ! 1 = tpsA ! 1\"\n    using tps4_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then have \"tps4 ! 1 = (\\<lfloor>[]\\<rfloor>, 0)\"\n    using tpsA by simp\n  then have \"tps4 ! 1 |+| 1 = (\\<lfloor>[]\\<rfloor>, 1)\"\n    by simp\n  then show \"tps5 = tps4[1 := tps4 ! 1 |+| 1]\"\n    unfolding tps5_def tps4_def by (simp only: list_update_swap)\nqed\n\ndefinition \"tps6 \\<equiv> tpsA\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   21 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   22 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0),\n   21 := (\\<lfloor>Suc (Suc m')\\<rfloor>\\<^sub>N, 1),\n   21 + 2 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1),\n   21 + 6 := (\\<lfloor>nll_Psi (Suc (Suc m') * H) H 0\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma lentps6: \"length tps6 = 110\"\n  using tps6_def lentpsA by (simp only: length_list_update)\n\nlemma tm6 [transforms_intros]:\n  assumes \"ttt = 30 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 3 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2\"\n  shows \"transforms tm6 tps0 ttt tps6\"\n  unfolding tm6_def\nproof (tform)\n  show \"21 + 8 < length tps5\"\n    using k lentps5 by simp\n  show \"tps5 ! 1 = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tps5_def lentps5 k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  show \"tps5 ! 21 = (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1)\"\n    using tps5_def lentps5 k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  have *: \"21 + 1 = 22\"\n    by simp\n  show \"tps5 ! (21 + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps5_def lentps5 k by (simp only: * length_list_update nth_list_update_eq nth_list_update_neq)\n  have \"tps5 ! 23 = tpsA ! 23\"\n    using tps5_def by (simp only: nth_list_update_eq nth_list_update_neq)\n  then show \"tps5 ! (21 + 2) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsA k by simp\n  have \"tps5 ! 24 = tpsA ! 24\"\n    using tps5_def by (simp only: nth_list_update_eq nth_list_update_neq)\n  then show \"tps5 ! (21 + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsA k by simp\n  have \"tps5 ! 25 = tpsA ! 25\"\n    using tps5_def by (simp only: nth_list_update_eq nth_list_update_neq)\n  then show \"tps5 ! (21 + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsA k by simp\n  have \"tps5 ! 26 = tpsA ! 26\"\n    using tps5_def by (simp only: nth_list_update_eq nth_list_update_neq)\n  then show \"tps5 ! (21 + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsA k by simp\n  have \"tps5 ! 27 = tpsA ! 27\"\n    using tps5_def by (simp only: nth_list_update_eq nth_list_update_neq)\n  then show \"tps5 ! (21 + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsA k by simp\n  have \"tps5 ! 28 = tpsA ! 28\"\n    using tps5_def by (simp only: nth_list_update_eq nth_list_update_neq)\n  then show \"tps5 ! (21 + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsA k by simp\n  have \"tps5 ! 29 = tpsA ! 29\"\n    using tps5_def by (simp only: nth_list_update_eq nth_list_update_neq)\n  then show \"tps5 ! (21 + 8) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsA k by simp\n  show \"ttt = 30 + (2 * d_polynomial p + 826) * (H + m') ^ 4 +\n      3 * nlength m' + 3 * nlength H + 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2\"\n    using assms by simp\n  show \"tps6 = tps5\n    [21 := (\\<lfloor>Suc (Suc m')\\<rfloor>\\<^sub>N, 1),\n     21 + 2 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1),\n     21 + 6 := (\\<lfloor>nll_Psi (Suc (Suc m') * H) H 0\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n     1 := nlltape (formula_n \\<Phi>\\<^sub>0)]\"\n    unfolding tps6_def tps5_def by (simp only: list_update_swap[of 1] list_update_overwrite)\nqed\n\ndefinition \"tpsB \\<equiv> tpsA\n  [21 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   22 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   21 := (\\<lfloor>Suc (Suc m')\\<rfloor>\\<^sub>N, 1),\n   21 + 2 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1),\n   21 + 6 := (\\<lfloor>nll_Psi (Suc (Suc m') * H) H 0\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma tpsB: \"j > 27 \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsB ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsB_def tpsA by simp\n\nlemma lentpsB: \"length tpsB = 110\"\n  using lentpsA tpsB_def by simp\n\nlemma tps6: \"tps6 = tpsB\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0)]\"\n  unfolding tps6_def tpsB_def by (simp only: list_update_swap)\n\nlemma tps6': \"j > 27 \\<Longrightarrow> j < 110 \\<Longrightarrow> tps6 ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tps6 tpsB by (simp only: nth_list_update_neq)\n\ndefinition \"tps7 \\<equiv> tpsB\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0),\n   29 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm7 [transforms_intros]:\n  assumes \"ttt = 40 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 3 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 2 * nlength H\"\n  shows \"transforms tm7 tps0 ttt tps7\"\n  unfolding tm7_def\nproof (tform)\n  show \"29 < length tps6\"\n    using lentpsB k tps6 by (simp only: length_list_update)\n  show \"tps6 ! 29 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tps6' canrepr_0 k by simp\n  show \"tps7 = tps6[29 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps7_def using tps6 by (simp only: list_update_swap)\n  show \"ttt = 30 + (2 * d_polynomial p + 826) * (H + m') ^ 4 +\n      3 * nlength m' + 3 * nlength H + 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 +\n      (10 + 2 * nlength 0 + 2 * nlength H)\"\n    using assms by simp\nqed\n\ndefinition \"tps8 \\<equiv> tpsB\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1),\n   29 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   28 + 2 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n   28 + 6 := (\\<lfloor>nll_Psi 0 H 1\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma tm8 [transforms_intros]:\n  assumes \"ttt = 40 + (2 * d_polynomial p + 826) * (H + m') ^ 4 +\n    3 * nlength m' + 3 * nlength H + 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 +\n    2 * nlength H + 1875 * H ^ 4\"\n  shows \"transforms tm8 tps0 ttt tps8\"\n  unfolding tm8_def\nproof (tform)\n  show \"28 + 7 < length tps7\"\n    using lentpsB k tps7_def by (simp only: length_list_update)\n  show \"tps7 ! 1 = nlltape (formula_n \\<Phi>\\<^sub>0)\"\n    using tps7_def lentpsB k by (simp only: nth_list_update_eq nth_list_update_neq length_list_update)\n  show \"tps7 ! 28 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsB tps7_def canrepr_0 k by (simp only: nth_list_update_neq)\n  have \"tps7 ! 29 = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps7_def lentpsB k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps7 ! (28 + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps7 ! 30 = tpsB ! 30\"\n    using tps7_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps7 ! (28 + 2) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsB k by simp\n  have \"tps7 ! 31 = tpsB ! 31\"\n    using tps7_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps7 ! (28 + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsB k by simp\n  have \"tps7 ! 32 = tpsB ! 32\"\n    using tps7_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps7 ! (28 + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsB k by simp\n  have \"tps7 ! 33 = tpsB ! 33\"\n    using tps7_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps7 ! (28 + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsB k by simp\n  have \"tps7 ! 34 = tpsB ! 34\"\n    using tps7_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps7 ! (28 + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsB k by simp\n  have \"tps7 ! 35 = tpsB ! 35\"\n    using tps7_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps7 ! (28 + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsB k by simp\n  show \"ttt = 40 + (2 * d_polynomial p + 826) * (H + m') ^ 4 +\n      3 * nlength m' + 3 * nlength H + 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 +\n      2 * nlength H + 1875 * H ^ 4\"\n    using assms by simp\n  show \"tps8 = tps7\n    [28 + 2 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n     28 + 6 := (\\<lfloor>nll_Psi 0 H 1\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n     1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1)]\"\n    unfolding tps8_def tps7_def by (simp only: list_update_swap[of 1] list_update_overwrite)\nqed\n\ndefinition \"tpsC \\<equiv> tpsB\n  [29 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   28 + 2 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n   28 + 6 := (\\<lfloor>nll_Psi 0 H 1\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma tpsC: \"j > 34 \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsC ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsC_def tpsB by simp\n\nlemma lentpsC: \"length tpsC = 110\"\n  using lentpsB tpsC_def by simp\n\nlemma tps8: \"tps8 = tpsC\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1)]\"\n  unfolding tps8_def tpsC_def by (simp only: list_update_swap)\n\ndefinition \"tps9 \\<equiv> tpsC\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1),\n   35 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm9 [transforms_intros]:\n  assumes \"ttt = 54 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' +\n    5 * nlength H + 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    3 * nlength n\"\n  shows \"transforms tm9 tps0 ttt tps9\"\n  unfolding tm9_def\nproof (tform)\n  show \"11 < length tps8\" \"35 < length tps8\"\n    using lentpsC tps8 k by (simp_all only: length_list_update)\n  show \"tps8 ! 11 = (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)\"\n    using tps8 lentpsC k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  have \"tps8 ! 35 = tpsC ! 35\"\n    using tps8 by (simp only: nth_list_update_neq)\n  then show \"tps8 ! 35 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsC k canrepr_0 by simp\n  show \"tps9 = tps8[35 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps9_def tps8 by (simp only:)\n  show \"ttt = 40 + (2 * d_polynomial p + 826) * (H + m') ^ 4 +\n      3 * nlength m' + 3 * nlength H + 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 +\n      2 * nlength H + 1875 * H ^ 4 + (14 + 3 * (nlength n + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps10 \\<equiv> tpsC\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1),\n   35 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   36 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm10 [transforms_intros]:\n  assumes \"ttt = 64 + (2 * d_polynomial p + 826) * (H + m') ^ 4 +\n    3 * nlength m' + 5 * nlength H + 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 +\n    1875 * H ^ 4 + 3 * nlength n + 2 * nlength H\"\n  shows \"transforms tm10 tps0 ttt tps10\"\n  unfolding tm10_def\nproof (tform)\n  show \"36 < length tps9\"\n    using lentpsC tps9_def k by (simp_all only: length_list_update)\n  have \"tps9 ! 36 = tpsC ! 36\"\n    using tps9_def by (simp only: nth_list_update_neq)\n  then show \"tps9 ! 36 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsC k canrepr_0 by simp\n  show \"tps10 = tps9[36 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps10_def tps9_def by (simp only: list_update_swap)\n  show \"ttt = 54 + (2 * d_polynomial p + 826) * (H + m') ^ 4 +\n      3 * nlength m' + 5 * nlength H + 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 +\n      1875 * H ^ 4 + 3 * nlength n + (10 + 2 * nlength 0 + 2 * nlength H)\"\n    using assms by simp\nqed\n\ndefinition \"tps11 \\<equiv> tpsC\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1) @ formula_n \\<Phi>\\<^sub>2),\n   35 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   36 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   35 := (\\<lfloor>2 * n + 2\\<rfloor>\\<^sub>N, 1),\n   35 + 2 := (\\<lfloor>3\\<rfloor>\\<^sub>N, 1),\n   35 + 6 := (\\<lfloor>nll_Psi (Suc (Suc (2 * n)) * H) H 3\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma tm11 [transforms_intros]:\n  assumes \"ttt = 64 + (2 * d_polynomial p + 826) * (H + m') ^ 4 +\n    3 * nlength m' + 7 * nlength H + 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 +\n    1875 * H ^ 4 + 3 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2\"\n  shows \"transforms tm11 tps0 ttt tps11\"\n  unfolding tm11_def\nproof (tform)\n  show \"35 + 8 < length tps10\"\n    using lentpsC k tps10_def by (simp only: length_list_update)\n  show \"tps10 ! 1 = nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1)\"\n    using tps10_def lentpsC k by (simp only: nth_list_update_eq nth_list_update_neq length_list_update)\n  show \"tps10 ! 35 = (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)\"\n    using tps10_def lentpsC k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  have \"tps10 ! 36 = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps10_def lentpsC k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps10 ! (35 + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps10 ! 37 = tpsC ! 37\"\n    using tps10_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps10 ! (35 + 2) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsC k by simp\n  have \"tps10 ! 38 = tpsC ! 38\"\n    using tps10_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps10 ! (35 + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsC k by simp\n  have \"tps10 ! 39 = tpsC ! 39\"\n    using tps10_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps10 ! (35 + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsC k by simp\n  have \"tps10 ! 40 = tpsC ! 40\"\n    using tps10_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps10 ! (35 + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsC k by simp\n  have \"tps10 ! 41 = tpsC ! 41\"\n    using tps10_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps10 ! (35 + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsC k by simp\n  have \"tps10 ! 42 = tpsC ! 42\"\n    using tps10_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps10 ! (35 + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsC k by simp\n  have \"tps10 ! 43 = tpsC ! 43\"\n    using tps10_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps10 ! (35 + 8) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsC k by simp\n  show \"tps11 = tps10\n    [35 := (\\<lfloor>2 * n + 2\\<rfloor>\\<^sub>N, 1),\n     35 + 2 := (\\<lfloor>3\\<rfloor>\\<^sub>N, 1),\n     35 + 6 := (\\<lfloor>nll_Psi (Suc (Suc (2 * n)) * H) H 3\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n     1 := nlltape ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1) @ formula_n \\<Phi>\\<^sub>2)]\"\n    unfolding tps11_def tps10_def by (simp only: list_update_swap[of 1] list_update_overwrite)\n  show \"ttt = 64 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' +\n      5 * nlength H + 5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      3 * nlength n + 2 * nlength H + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2\"\n    using assms by simp\nqed\n\ndefinition \"tpsD \\<equiv> tpsC\n  [35 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   36 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   35 := (\\<lfloor>2 * n + 2\\<rfloor>\\<^sub>N, 1),\n   35 + 2 := (\\<lfloor>3\\<rfloor>\\<^sub>N, 1),\n   35 + 6 := (\\<lfloor>nll_Psi (Suc (Suc (2 * n)) * H) H 3\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma tpsD: \"41 < j \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsD ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsD_def tpsC by simp\n\nlemma lentpsD: \"length tpsD = 110\"\n  using lentpsC tpsD_def by simp\n\nlemma tps11: \"tps11 = tpsD\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1) @ formula_n \\<Phi>\\<^sub>2)]\"\n  unfolding tps11_def tpsD_def by (simp only: list_update_swap)\n\ndefinition \"tps12 \\<equiv> tpsD\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1) @ formula_n \\<Phi>\\<^sub>2),\n   42 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm12 [transforms_intros]:\n  assumes \"ttt = 76 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 7 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    3 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2\"\n  shows \"transforms tm12 tps0 ttt tps12\"\n  unfolding tm12_def\nproof (tform)\n  show \"42 < length tps11\"\n    using lentpsD tps11 k by (simp_all only: length_list_update)\n  have \"tps11 ! 42 = tpsD ! 42\"\n    using tps11 by (simp only: nth_list_update_neq)\n  then show \"tps11 ! 42 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsD k canrepr_0 by simp\n  show \"tps12 = tps11[42 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps12_def tps11 by (simp only:)\n  show \"ttt = 64 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 7 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      3 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      (10 + 2 * nlength 0 + 2 * nlength 1)\"\n    using canrepr_1 assms by simp\nqed\n\ndefinition \"tps13 \\<equiv> tpsD\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1) @ formula_n \\<Phi>\\<^sub>2),\n   42 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n   43 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm13 [transforms_intros]:\n  assumes \"ttt = 86 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 9 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    3 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2\"\n  shows \"transforms tm13 tps0 ttt tps13\"\n  unfolding tm13_def\nproof (tform)\n  show \"43 < length tps12\"\n    using lentpsD tps12_def k by (simp_all only: length_list_update)\n  have \"tps12 ! 43 = tpsD ! 43\"\n    using tps12_def by (simp only: nth_list_update_neq)\n  then show \"tps12 ! 43 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsD k canrepr_0 by simp\n  show \"tps13 = tps12[43 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps13_def tps12_def by (simp only:)\n  show \"ttt = 76 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 7 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 + 3 * nlength n +\n      3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      (10 + 2 * nlength 0 + 2 * nlength H)\"\n    using assms by simp\nqed\n\ndefinition \"tps14 \\<equiv> tpsD\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1) @ formula_n \\<Phi>\\<^sub>2),\n   42 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n   43 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   44 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm14 [transforms_intros]:\n  assumes \"ttt = 100 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 9 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    3 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2\"\n  shows \"transforms tm14 tps0 ttt tps14\"\n  unfolding tm14_def\nproof (tform)\n  show \"44 < length tps13\"\n    using lentpsD tps13_def k by (simp_all only: length_list_update)\n  have \"tps13 ! 44 = tpsD ! 44\"\n    using tps13_def by (simp only: nth_list_update_neq)\n  then show \"tps13 ! 44 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsD k canrepr_0 by simp\n  show \"tps14 = tps13[44 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps14_def tps13_def by (simp only:)\n  show \"ttt = 86 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 9 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      3 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      (10 + 2 * nlength 0 + 2 * nlength 2)\"\n    using nlength_2 assms by simp\nqed\n\ndefinition \"tps15 \\<equiv> tpsD\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1) @ formula_n \\<Phi>\\<^sub>2),\n   42 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n   43 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   44 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   50 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm15 [transforms_intros]:\n  assumes \"ttt = 114 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 9 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    6 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2\"\n  shows \"transforms tm15 tps0 ttt tps15\"\n  unfolding tm15_def\nproof (tform)\n  show \"11 < length tps14\" \"50 < length tps14\"\n    using lentpsD tps14_def k by (simp_all only: length_list_update)\n  show \"tps14 ! 11 = (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)\"\n    using tps14_def k lentpsD by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  have \"tps14 ! 50 = tpsD ! 50\"\n    using tps14_def by (simp only: nth_list_update_neq)\n  then show \"tps14 ! 50 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsD k canrepr_0 by simp\n  show \"tps15 = tps14[50 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps15_def tps14_def by (simp only:)\n  show \"ttt = 100 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 9 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      3 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      (14 + 3 * (nlength n + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps16 \\<equiv> tpsD\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1) @ formula_n \\<Phi>\\<^sub>2),\n   42 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n   43 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   44 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   50 := (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm16 [transforms_intros]:\n  assumes \"ttt = 126 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 9 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    10 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2\"\n  shows \"transforms tm16 tps0 ttt tps16\"\n  unfolding tm16_def\nproof (tform)\n  show \"2 \\<le> length tps15\" \"50 < length tps15\"\n    using lentpsD tps15_def k by (simp_all only: length_list_update)\n  show \"tps15 ! 50 = (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)\"\n    using tps15_def k lentpsD by (simp only: length_list_update nth_list_update_eq)\n  have \"tps16 = tps15[50 := (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps16_def tps15_def by (simp only: list_update_swap[of 1] list_update_overwrite)\n  then show \"tps16 = tps15[50 := (\\<lfloor>Suc (2 * n)\\<rfloor>\\<^sub>N, 1)]\"\n    by simp\n  show \"ttt = 114 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 9 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 + 6 * nlength n +\n      3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 + (12 + 4 * nlength n)\"\n    using assms by simp\nqed\n\ndefinition \"tps17 \\<equiv> tpsD\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3),\n   42 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n   43 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   44 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   50 := (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1),\n   42 := (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1),\n   42 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm17 [transforms_intros]:\n  assumes \"ttt = 126 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 9 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    10 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2))\"\n  shows \"transforms tm17 tps0 ttt tps17\"\n  unfolding tm17_def\nproof (tform transforms_intros: tm_PHI3)\n  show \"42 + 8 < length tps16\"\n    using lentpsD k tps16_def by (simp only: length_list_update)\n  show \"tps16 ! 1 = nlltape ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1) @ formula_n \\<Phi>\\<^sub>2)\"\n    using tps16_def lentpsD k by (simp only: nth_list_update_eq nth_list_update_neq length_list_update)\n  show \"tps16 ! 42 = (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)\"\n    using tps16_def lentpsD k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  have \"tps16 ! 43 = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps16_def lentpsD k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps16 ! (42 + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps16 ! 44 = (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)\"\n    using tps16_def lentpsD k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps16 ! (42 + 2) = (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps16 ! 45 = tpsD ! 45\"\n    using tps16_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps16 ! (42 + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsD k by simp\n  have \"tps16 ! 46 = tpsD ! 46\"\n    using tps16_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps16 ! (42 + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsD k by simp\n  have \"tps16 ! 47 = tpsD ! 47\"\n    using tps16_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps16 ! (42 + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsD k by simp\n  have \"tps16 ! 48 = tpsD ! 48\"\n    using tps16_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps16 ! (42 + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsD k by simp\n  have \"tps16 ! 49 = tpsD ! 49\"\n    using tps16_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps16 ! (42 + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsD k by simp\n  have \"tps16 ! 50 = (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1)\"\n    using tps16_def lentpsD k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps16 ! (42 + 8) = (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps17 = tps16\n    [42 := (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3),\n     42 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps17_def tps16_def by (simp only: list_update_swap[of 1] list_update_overwrite)\n  then show \"tps17 = tps16\n    [42 := (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape (((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1) @ formula_n \\<Phi>\\<^sub>2) @ formula_n \\<Phi>\\<^sub>3),\n     42 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n    by simp\n  show \"ttt = 126 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 9 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      10 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2))\"\n    using assms by simp\nqed\n\ndefinition \"tpsE \\<equiv> tpsD\n  [42 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n   43 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   44 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   50 := (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1),\n   42 := (\\<lfloor>1 + 2 * n\\<rfloor>\\<^sub>N, 1),\n   42 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tpsE: \"50 < j \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsE ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsE_def tpsD by simp\n\nlemma lentpsE: \"length tpsE = 110\"\n  using lentpsD tpsE_def by simp\n\nlemma tps17: \"tps17 = tpsE\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3)]\"\n  unfolding tps17_def tpsE_def by (simp only: list_update_swap)\n\ndefinition \"tps18 \\<equiv> tpsE\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3),\n   52 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm18 [transforms_intros]:\n  assumes \"ttt = 136 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    10 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2))\"\n  shows \"transforms tm18 tps0 ttt tps18\"\n  unfolding tm18_def\nproof (tform)\n  show \"52 < length tps17\"\n    using lentpsE tps17 k by (simp_all only: length_list_update)\n  have \"tps17 ! 52 = tpsE ! 52\"\n    using tps17 by (simp only: nth_list_update_neq)\n  then show \"tps17 ! 52 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsE k canrepr_0 by simp\n  show \"tps18 = tps17[52 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps18_def tps17 by (simp only:)\n  show \"ttt = 126 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 9 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      10 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) +\n      (10 + 2 * nlength 0 + 2 * nlength H)\"\n    using assms by simp\nqed\n\ndefinition \"tps19 \\<equiv> tpsE\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3),\n   52 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   53 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm19 [transforms_intros]:\n  assumes \"ttt = 150 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    10 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2))\"\n  shows \"transforms tm19 tps0 ttt tps19\"\n  unfolding tm19_def\nproof (tform)\n  show \"53 < length tps18\"\n    using lentpsE tps18_def k by (simp_all only: length_list_update)\n  have \"tps18 ! 53 = tpsE ! 53\"\n    using tps18_def by (simp only: nth_list_update_neq)\n  then show \"tps18 ! 53 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsE k canrepr_0 by simp\n  show \"tps19 = tps18[53 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps19_def tps18_def by (simp only:)\n  show \"ttt = 136 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      10 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) +\n      (10 + 2 * nlength 0 + 2 * nlength 2)\"\n    using assms nlength_2 by simp\nqed\n\ndefinition \"tps20 \\<equiv> tpsE\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3),\n   52 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   53 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   51 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm20 [transforms_intros]:\n  assumes \"ttt = 164 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      13 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2))\"\n  shows \"transforms tm20 tps0 ttt tps20\"\n  unfolding tm20_def\nproof (tform)\n  show \"11 < length tps19\" \"51 < length tps19\"\n    using lentpsE tps19_def k by (simp_all only: length_list_update)\n  show \"tps19 ! 11 = (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)\"\n    using tps19_def k lentpsE by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  have \"tps19 ! 51 = tpsE ! 51\"\n    using tps19_def by (simp only: nth_list_update_neq)\n  then show \"tps19 ! 51 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsE k canrepr_0 by simp\n  show \"tps20 = tps19[51 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps20_def tps19_def by (simp only:)\n  show \"ttt = 150 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      10 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) +\n      (14 + 3 * (nlength n + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps21 \\<equiv> tpsE\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3),\n   52 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   53 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   51 := (\\<lfloor>2 * n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm21 [transforms_intros]:\n  assumes \"ttt = 169 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2))\"\n  shows \"transforms tm21 tps0 ttt tps21\"\n  unfolding tm21_def\nproof (tform time: assms)\n  show \"51 < length tps20\"\n    using lentpsE tps20_def k by (simp only: length_list_update)\n  show \"tps20 ! 51 = (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)\"\n    using tps20_def k lentpsE by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  show \"tps21 = tps20[51 := (\\<lfloor>2 * n\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps21_def tps20_def by (simp only: list_update_overwrite)\nqed\n\ndefinition \"tps22 \\<equiv> tpsE\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3),\n   52 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   53 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   51 := (\\<lfloor>2 * n + 3\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm22 [transforms_intros]:\n  assumes \"ttt = 184 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3)\"\n  shows \"transforms tm22 tps0 ttt tps22\"\n  unfolding tm22_def\nproof (tform time: assms)\n  show \"51 < length tps21\"\n    using lentpsE tps21_def k by (simp only: length_list_update)\n  show \"tps21 ! 51 = (\\<lfloor>2 * n\\<rfloor>\\<^sub>N, 1)\"\n    using tps21_def k lentpsE by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  show \"tps22 = tps21[51 := (\\<lfloor>2 * n + 3\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps22_def tps21_def by (simp only: list_update_overwrite)\nqed\n\ndefinition \"tps23 \\<equiv> tpsE\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3),\n   52 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   53 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   51 := (\\<lfloor>2 * n + 3\\<rfloor>\\<^sub>N, 1),\n   59 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm23 [transforms_intros]:\n  assumes \"ttt = 198 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n    3 * nlength m\"\n  shows \"transforms tm23 tps0 ttt tps23\"\n  unfolding tm23_def\nproof (tform)\n  show \"16 < length tps22\" \"59 < length tps22\"\n    using lentpsE tps22_def k by (simp_all only: length_list_update)\n  show \"tps22 ! 16 = (\\<lfloor>m\\<rfloor>\\<^sub>N, 1)\"\n    using tps22_def k lentpsE by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  have \"tps22 ! 59 = tpsE ! 59\"\n    using tps22_def by (simp only: nth_list_update_neq)\n  then show \"tps22 ! 59 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsE k canrepr_0 by simp\n  show \"tps23 = tps22[59 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps23_def tps22_def by (simp only:)\n  show \"ttt = 184 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n      (14 + 3 * (nlength m + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps24 \\<equiv> tpsE\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3),\n   52 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   53 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   51 := (\\<lfloor>2 * n + 3\\<rfloor>\\<^sub>N, 1),\n   59 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm24 [transforms_intros]:\n  assumes \"ttt = 203 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n    5 * nlength m\"\n  shows \"transforms tm24 tps0 ttt tps24\"\n  unfolding tm24_def\nproof (tform time: assms)\n  show \"59 < length tps23\"\n    using lentpsE tps23_def k by (simp only: length_list_update)\n  have \"tps23 ! 59 = (\\<lfloor>m\\<rfloor>\\<^sub>N, 1)\"\n    using tps23_def k lentpsE by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps23 ! 59 = (\\<lfloor>m\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  show \"tps24 = tps23[59 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps24_def tps23_def by (simp only: list_update_overwrite)\nqed\n\ndefinition \"tps25 \\<equiv> tpsE\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4),\n   52 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   53 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   51 := (\\<lfloor>2 * n + 3\\<rfloor>\\<^sub>N, 1),\n   59 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1),\n   51 := (\\<lfloor>2 * n + 2 + 1 + 2 * p n\\<rfloor>\\<^sub>N, 1),\n   51 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm25 [transforms_intros]:\n  assumes \"ttt = 203 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n      5 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2))\"\n  shows \"transforms tm25 tps0 ttt tps25\"\n  unfolding tm25_def\nproof (tform transforms_intros: tm_PHI4)\n  show \"51 + 8 < length tps24\"\n    using lentpsE tps24_def k by (simp only: length_list_update)\n  show \"tps24 ! 1 = nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3)\"\n    using tps24_def lentpsE k by (simp only: nth_list_update_eq nth_list_update_neq length_list_update)\n  have \"tps24 ! 51 = (\\<lfloor>2 * n + 3\\<rfloor>\\<^sub>N, 1)\"\n    using tps24_def lentpsE k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps24 ! 51 = (\\<lfloor>2 * n + 2 + 1\\<rfloor>\\<^sub>N, 1)\"\n    by (metis add.assoc nat_1_add_1 numeral_Bit1 numerals(1))\n  have \"tps24 ! 52 = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps24_def lentpsE k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps24 ! (51 + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps24 ! 53 = (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)\"\n    using tps24_def lentpsE k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps24 ! (51 + 2) = (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps24 ! 54 = tpsE ! 54\"\n    using tps24_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps24 ! (51 + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsE k by simp\n  have \"tps24 ! 55 = tpsE ! 55\"\n    using tps24_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps24 ! (51 + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsE k by simp\n  have \"tps24 ! 56 = tpsE ! 56\"\n    using tps24_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps24 ! (51 + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsE k by simp\n  have \"tps24 ! 57 = tpsE ! 57\"\n    using tps24_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps24 ! (51 + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsE k by simp\n  have \"tps24 ! 58 = tpsE ! 58\"\n    using tps24_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps24 ! (51 + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsE k by simp\n  have \"tps24 ! 59 = (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1)\"\n    using tps24_def lentpsE k by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  moreover have *: \"Suc m = 2 * n + 2 + 1 + 2 * p n\"\n    using m_def by simp\n  ultimately show \"tps24 ! (51 + 8) = (\\<lfloor>2 * n + 2 + 1 + 2 * p n\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps25 = tps24\n    [51 := (\\<lfloor>2 * n + 2 + 1 + 2 * p n\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4),\n     51 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps25_def tps24_def by (simp only: list_update_swap list_update_overwrite)\n  then show \"tps25 = tps24\n    [51 := (\\<lfloor>2 * n + 2 + 1 + 2 * p n\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3) @ formula_n \\<Phi>\\<^sub>4),\n     51 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n    by simp\n  show \"ttt = 203 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n      5 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (2 * n + 2 + 1 + 2 * p n))\\<^sup>2))\"\n    using assms * by simp\nqed\n\ndefinition \"tpsF \\<equiv> tpsE\n  [52 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   53 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   51 := (\\<lfloor>2 * n + 3\\<rfloor>\\<^sub>N, 1),\n   59 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1),\n   51 := (\\<lfloor>2 * n + 2 + 1 + 2 * p n\\<rfloor>\\<^sub>N, 1),\n   51 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tpsF: \"59 < j \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsF ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsF_def tpsE by simp\n\nlemma lentpsF: \"length tpsF = 110\"\n  using lentpsE tpsF_def by simp\n\nlemma tps25: \"tps25 = tpsF\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4)]\"\n  unfolding tps25_def tpsF_def by (simp only: list_update_swap)\n\ndefinition \"tps26 \\<equiv> tpsF\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4),\n   61 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm26 [transforms_intros]:\n  assumes \"ttt = 213 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n    5 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2))\"\n  shows \"transforms tm26 tps0 ttt tps26\"\n  unfolding tm26_def\nproof (tform)\n  show \"61 < length tps25\"\n    using lentpsF tps25 k by (simp_all only: length_list_update)\n  have \"tps25 ! 61 = tpsF ! 61\"\n    using tps25 by (simp only: nth_list_update_neq)\n  then show \"tps25 ! 61 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsF k canrepr_0 by simp\n  show \"tps26 = tps25[61 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps26_def tps25 by (simp only:)\n  show \"ttt = 203 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 11 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n      5 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) +\n      (10 + 2 * nlength 0 + 2 * nlength H)\"\n    using assms by simp\nqed\n\ndefinition \"tps27 \\<equiv> tpsF\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4),\n   61 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   60 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm27 [transforms_intros]:\n  assumes \"ttt = 227 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n    8 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2))\"\n  shows \"transforms tm27 tps0 ttt tps27\"\n  unfolding tm27_def\nproof (tform)\n  show \"16 < length tps26\" \"60 < length tps26\"\n    using lentpsF tps26_def k by (simp_all only: length_list_update)\n  show \"tps26 ! 16 = (\\<lfloor>m\\<rfloor>\\<^sub>N, 1)\"\n    using tps26_def k lentpsF by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  have \"tps26 ! 60 = tpsF ! 60\"\n    using tps26_def by (simp only: nth_list_update_neq)\n  then show \"tps26 ! 60 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsF k canrepr_0 by simp\n  show \"tps27 = tps26[60 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps27_def tps26_def by (simp only:)\n  show \"ttt = 213 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n      5 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) +\n      (14 + 3 * (nlength m + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps28 \\<equiv> tpsF\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4),\n   61 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   60 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm28 [transforms_intros]:\n  assumes \"ttt = 232 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n    10 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2))\"\n  shows \"transforms tm28 tps0 ttt tps28\"\n  unfolding tm28_def\nproof (tform)\n  show \"60 < length tps27\"\n    using lentpsF tps27_def k by (simp_all only: length_list_update)\n  show \"tps27 ! 60 = (\\<lfloor>m\\<rfloor>\\<^sub>N, 1)\"\n    using tps27_def k lentpsF by (simp only: length_list_update nth_list_update_eq)\n  show \"tps28 = tps27[60 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps28_def tps27_def by (simp only: list_update_overwrite)\n  show \"ttt = 227 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n      8 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) +\n      (5 + 2 * nlength m)\"\n    using assms by simp\nqed\n\ndefinition \"tps29 \\<equiv> tpsF\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4),\n   61 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   60 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1),\n   68 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm29 [transforms_intros]:\n  assumes \"ttt = 246 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n    10 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) +\n    3 * nlength (Suc m)\"\n  shows \"transforms tm29 tps0 ttt tps29\"\n  unfolding tm29_def\nproof (tform)\n  show \"60 < length tps28\" \"68 < length tps28\"\n    using lentpsF tps28_def k by (simp_all only: length_list_update)\n  show \"tps28 ! 60 = (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1)\"\n    using tps28_def k lentpsF by (simp only: length_list_update nth_list_update_eq)\n  have \"tps28 ! 68 = tpsF ! 68\"\n    using tps28_def by (simp only: nth_list_update_neq)\n  then show \"tps28 ! 68 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsF k canrepr_0 by simp\n  show \"tps29 = tps28[68 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps29_def tps28_def by (simp only: list_update_overwrite)\n  show \"ttt = 232 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n      10 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) +\n      (14 + 3 * (nlength (Suc m) + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps30 \\<equiv> tpsF\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4),\n   61 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   60 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1),\n   68 := (\\<lfloor>T' + Suc m\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm30 [transforms_intros]:\n  assumes \"ttt = 256 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n    5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n    15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n    Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n    10 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) +\n    3 * nlength (Suc m) + 3 * max (nlength T') (nlength (Suc m))\"\n  shows \"transforms tm30 tps0 ttt tps30\"\n  unfolding tm30_def\nproof (tform)\n  show \"17 < length tps29\" \"68 < length tps29\"\n    using lentpsF tps29_def k by (simp_all only: length_list_update)\n  show \"tps29 ! 17 = (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1)\"\n    using tps29_def k lentpsF by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps29 ! 68 = (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1)\"\n    using tps29_def k lentpsF by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps30 = tps29[68 := (\\<lfloor>T' + Suc m\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps30_def tps29_def by (simp only: list_update_overwrite)\n  show \"ttt = 246 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n      10 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) +\n      3 * nlength (Suc m) + (3 * max (nlength T') (nlength (Suc m)) + 10)\"\n    using assms by simp\nqed\n\ndefinition \"tps31 \\<equiv> tpsF\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n         (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n          formula_n \\<Phi>\\<^sub>5),\n   61 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   60 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1),\n   68 := (\\<lfloor>T' + Suc m\\<rfloor>\\<^sub>N, 1),\n   60 := (\\<lfloor>Suc m + T'\\<rfloor>\\<^sub>N, 1),\n   60 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n\ndefinition \"ttt31 \\<equiv> 256 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n  5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n  15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n  Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n  10 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) +\n  3 * nlength (Suc m) + 3 * max (nlength T') (nlength (Suc m)) +\n  Suc T' * (9 + 1891 * (H ^ 4 * (nlength (Suc m + T'))\\<^sup>2))\"\n\nlemma le_N: \"y \\<le> 2 * n + 2 * p n + 3 + T' \\<Longrightarrow> y \\<le> N \"\n  using H_gr_2 m'_def N_eq\n  by (metis Suc_1 Suc_leI add_2_eq_Suc' add_leE le_trans mult_le_mono1 nat_mult_1)\n\nlemma n_le_N: \"n \\<le> N \"\n  using le_N by simp\n\nlemma H_le_N: \"H \\<le> N \"\n  using N_eq by simp\n\nlemma N_ge_1: \"N \\<ge> 1\"\n  using H_le_N H_ge_3 by simp\n\nlemma pow2_sum_le:\n  fixes a b :: nat\n  shows \"(a + b) ^ 2 \\<le> a ^ 2 + (2 * a + 1) * b ^ 2\"\nproof -\n  have \"(a + b) ^ 2 = a ^ 2 + 2 * a * b + b ^ 2\"\n    by algebra\n  also have \"... \\<le> a ^ 2 + 2 * a * b ^ 2 + b ^ 2\"\n    by (simp add: power2_nat_le_imp_le)\n  also have \"... = a ^ 2 + (2 * a + 1) * b ^ 2\"\n    by simp\n  finally show ?thesis .\nqed\n\nlemma ttt31: \"ttt31 \\<le> (32 * d_polynomial p + 222011) * H ^ 4 * N ^ 4\"\nproof -\n  have a: \"Suc T' * (9 + 1891 * (H ^ 4 * (nlength (Suc m + T'))\\<^sup>2)) \\<le> 1900 * H ^ 4 * N ^ 4\"\n  proof -\n    have \"Suc (2 * n + 2 * p n + 2) + T' \\<le> 2 * n + 2 * p n + 3 + T' \"\n      by simp\n    also have \"... \\<le> H * (2 * n + 2 * p n + 3 + T')\"\n      using H_gr_2 by simp\n    finally have \"Suc m + T' \\<le> N \"\n      unfolding N_eq m_def by simp\n    then have \"nlength (Suc m + T') \\<le> N \"\n      using nlength_le_n order.trans by auto\n    then have \"(nlength (Suc m + T')) ^ 2 \\<le> N ^ 2\"\n      by simp\n    then have \"H ^ 4 * (nlength (Suc m + T')) ^ 2 \\<le> H ^ 4 * N ^ 2\"\n      using mult_le_mono by simp\n    then have \"9 + 1891 * (H ^ 4 * (nlength (Suc m + T'))\\<^sup>2) \\<le> 9 + 1891 * H ^ 4 * N ^ 2\"\n      by simp\n    then have \"Suc T' * (9 + 1891 * (H ^ 4 * (nlength (Suc m + T'))\\<^sup>2)) \\<le> Suc T' * (9 + 1891 * H ^ 4 * N ^ 2)\"\n      using mult_le_mono2 by blast\n    also have \"... \\<le> N * (9 + 1891 * H ^ 4 * N ^ 2)\"\n    proof -\n      have \"Suc T' \\<le> N \"\n        using le_N by simp\n      then show ?thesis\n        using mult_le_mono1 by blast\n    qed\n    also have \"... = 9 * N + 1891 * H ^ 4 * N ^ 3\"\n      by algebra\n    also have \"... \\<le> 9 * N ^ 3 + 1891 * H ^ 4 * N ^ 3\"\n      using linear_le_pow by simp\n    also have \"... \\<le> 9 * N ^ 3 + 1891 * H ^ 4 * N ^ 4\"\n      using pow_mono'[of 3 4] by simp\n    also have \"... \\<le> 9 * N ^ 4 + 1891 * H ^ 4 * N ^ 4\"\n      using pow_mono'[of 3 4] by simp\n    also have \"... \\<le> 9 * H ^ 4 * N ^ 4 + 1891 * H ^ 4 * N ^ 4\"\n      using H_ge_3 by simp\n    also have \"... = 1900 * H ^ 4 * N ^ 4\"\n      by simp\n    finally show ?thesis .\n  qed\n\n  have b: \"5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 \\<le> 140675 * H ^ 4 * N ^ 4\"\n  proof -\n    have \"3 * H + m' * H \\<le> 2 * N \"\n      using N_eq m'_def by simp\n    then have \"nlength (3 * H + m' * H) \\<le> nlength (2 * N)\"\n      using nlength_mono by simp\n    also have \"... \\<le> Suc (nlength N)\"\n      using le_trans nlength_times2 by blast\n    also have \"... \\<le> Suc N\"\n      using nlength_le_n by simp\n    finally have \"nlength (3 * H + m' * H) \\<le> Suc N\" .\n    then have \"3 + nlength (3 * H + m' * H) \\<le> 4 + N \"\n      by simp\n    then have \"(3 + nlength (3 * H + m' * H)) ^ 2 \\<le> (4 + N) ^ 2\"\n      by simp\n    also have \"... \\<le> 16 + 9 * N ^ 2\"\n      using pow2_sum_le[of 4 \"N \"] by simp\n    finally have \"(3 + nlength (3 * H + m' * H)) ^ 2 \\<le> 16 + 9 * N ^ 2\" .\n    then have \"5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 \\<le> 5627 * H ^ 4 * (16 + 9 * N ^ 2)\"\n      by simp\n    also have \"... = 5627 * H ^ 4 * 16 + 5627 * H ^ 4 * 9 * N ^ 2\"\n      by algebra\n    also have \"... = 90032 * H ^ 4 + 50643 * H ^ 4 * N ^ 2\"\n      by simp\n    also have \"... \\<le> 90032 * H ^ 4 * N ^ 2 + 50643 * H ^ 4 * N ^ 2\"\n      using pow_mono' N_ge_1 by simp\n    also have \"... = 140675 * H ^ 4 * N ^ 2\"\n      by simp\n    also have \"... \\<le> 140675 * H ^ 4 * N ^ 4\"\n      using pow_mono' by simp\n    finally show ?thesis .\n  qed\n\n  have c: \"3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 \\<le> 60224 * H ^ 4 * N ^ 4\"\n  proof -\n    have \"3 * H \\<le> N \" and \"2 * n * H \\<le> N \"\n      using N_eq by simp_all\n    then have \"3 * H + 2 * n * H \\<le> 2 * N \"\n      by simp\n    then have \"nlength (3 * H + 2 * n * H) \\<le> 3 * H + 2 * n * H\"\n      using nlength_le_n by simp\n    then have \"nlength (3 * H + 2 * n * H) \\<le> H * (3 + 2 * n)\"\n      by (metis distrib_right mult.commute)\n    also have \"... \\<le> N \"\n      using N_eq by simp\n    finally have \"nlength (3 * H + 2 * n * H) \\<le> N \" .\n    then have \"3 + nlength (3 * H + 2 * n * H) \\<le> 3 + N \"\n      by simp\n    then have \"(3 + nlength (3 * H + 2 * n * H))\\<^sup>2 \\<le> (3 + N) ^ 2\"\n      by simp\n    also have \"... \\<le> 9 + 7 * N ^ 2\"\n      using pow2_sum_le[of 3 \"N \"] by simp\n    finally have \"(3 + nlength (3 * H + 2 * n * H))\\<^sup>2 \\<le> 9 + 7 * N ^ 2\" .\n    then have \"3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 \\<le> 3764 * H ^ 4 * (9 + 7 * N ^ 2)\"\n      by simp\n    also have \"... = 3764 * H ^ 4 * 9 + 3764 * H ^ 4 * 7 * N ^ 2\"\n      by algebra\n    also have \"... = 33876 * H ^ 4 + 26348 * H ^ 4 * N ^ 2\"\n      by simp\n    also have \"... \\<le> 33876 * H ^ 4 * N ^ 2 + 26348 * H ^ 4 * N ^ 2\"\n      using pow_mono' N_ge_1 by simp\n    also have \"... = 60224 * H ^ 4 * N ^ 2\"\n      by simp\n    also have \"... \\<le> 60224 * H ^ 4 * N ^ 4\"\n      using pow_mono' by simp\n    finally show ?thesis .\n  qed\n\n  have d: \"Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) \\<le> 1906 * H ^ 4 * N ^ 4\"\n  proof -\n    have \"Suc (p n) \\<le> N \"\n      using le_N by simp\n    then have \"Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) \\<le> N * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2))\"\n      using mult_le_mono1 by blast\n    also have \"... \\<le> N * (9 + 1897 * (H ^ 4 * (nlength N)\\<^sup>2))\"\n    proof -\n      have \"Suc m \\<le> N \"\n        using m_def le_N by simp\n      then show ?thesis\n        using H4_nlength H_ge_3 add_le_mono less_or_eq_imp_le mult_le_mono by presburger\n    qed\n    also have \"... \\<le> N * (9 + 1897 * (H ^ 4 * N\\<^sup>2))\"\n      using nlength_le_n by simp\n    also have \"... = N * 9 + N * 1897 * H ^ 4 * N ^ 2\"\n      by (simp add: add_mult_distrib2)\n    also have \"... \\<le> N ^ 3 * 9 + N * 1897 * H ^ 4 * N ^ 2\"\n      using linear_le_pow by simp\n    also have \"... \\<le> 9 * H ^ 4 * N ^ 3 + N * 1897 * H ^ 4 * N ^ 2\"\n      using H_ge_3 by simp\n    also have \"... = 9 * H ^ 4 * N ^ 3 + 1897 * H ^ 4 * N ^ 3\"\n      by algebra\n    also have \"... = 1906 * H ^ 4 * N ^ 3\"\n      by simp\n    also have \"... \\<le> 1906 * H ^ 4 * N ^ 4\"\n      using pow_mono' by simp\n    finally show ?thesis .\n  qed\n\n  have e: \"Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) \\<le> 1906 * H ^ 4 * N ^ 4\"\n  proof -\n    have \"nlength (1 + 2 * n) \\<le> N \"\n      using le_N nlength_le_n[of \"1 + 2 * n \"] by simp\n    then have \"(nlength (1 + 2 * n)) ^ 2 \\<le> N ^ 2\"\n      by simp\n    then have \"Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) \\<le> Suc n * (9 + 1897 * (H ^ 4 * N\\<^sup>2))\"\n      using add_le_mono less_or_eq_imp_le mult_le_mono2 by presburger\n    also have \"... = Suc n * (9 + 1897 * H ^ 4 * N\\<^sup>2)\"\n      by simp\n    also have \"... \\<le> N * (9 + 1897 * H ^ 4 * N ^ 2)\"\n      using mult_le_mono1[OF le_N[of \"Suc n\"]] by simp\n    also have \"... = N * 9 + 1897 * H ^ 4 * N ^ 3\"\n      by algebra\n    also have \"... \\<le> 9 * N ^ 3 + 1897 * H ^ 4 * N ^ 3\"\n      using linear_le_pow by simp\n    also have \"... \\<le> 9 * H ^ 4 * N ^ 3 + 1897 * H ^ 4 * N ^ 3\"\n      using H_ge_3 by simp\n    also have \"... = 1906 * H ^ 4 * N ^ 3\"\n      by simp\n    also have \"... \\<le> 1906 * H ^ 4 * N ^ 4\"\n      using pow_mono' by simp\n    finally show ?thesis .\n  qed\n\n  have nlength_le_GN: \"y \\<le> N \\<Longrightarrow> nlength y \\<le> H ^ 4 * N ^ 4\" for y\n  proof -\n    assume \"y \\<le> N \"\n    then have \"nlength y \\<le> N ^ 4\"\n      using nlength_le_n linear_le_pow H_ge_3 by (meson dual_order.trans zero_less_numeral)\n    also have \"... \\<le> H ^ 4 * N ^ 4\"\n      using H_gr_2 by simp\n    finally show ?thesis .\n  qed\n\n  have f: \"13 * nlength H \\<le> 13 * H ^ 4 * N ^ 4\"\n    using nlength_le_GN[of H] N_eq by simp\n  have g: \"15 * nlength n \\<le> 15 * H ^ 4 * N ^ 4\"\n    using nlength_le_GN[OF n_le_N] by simp\n  have h: \"6 * nlength (2 * n + 3) \\<le> 6 * H ^ 4 * N ^ 4\"\n    using nlength_le_GN le_N by simp\n  have i: \"10 * nlength m \\<le> 10 * H ^ 4 * N ^ 4\"\n    using m_def nlength_le_GN le_N by simp\n  have j: \"3 * nlength (Suc m) \\<le> 3 * H ^ 4 * N ^ 4\"\n    using m_def nlength_le_GN le_N by simp\n  have k: \"3 * max (nlength T') (nlength (Suc m)) \\<le> 3 * H ^ 4 * N ^ 4\"\n  proof -\n    have \"nlength T' \\<le> H ^ 4 * N ^ 4\"\n      using nlength_le_GN le_N by simp\n    moreover have \"nlength (Suc m) \\<le> H ^ 4 * N ^ 4\"\n      using m_def nlength_le_GN le_N by simp\n    ultimately show ?thesis\n      by simp\n  qed\n  have l: \"1875 * H ^ 4 \\<le> 1875 * H ^ 4 * N ^ 4\"\n    using N_ge_1 by simp\n  have m: \"3 * nlength m' \\<le> 3 * H ^ 4 * N ^ 4\"\n    using m'_def le_N le_refl nat_mult_le_cancel_disj nlength_le_GN by simp\n\n  have \"ttt31 \\<le> 256 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 1928 * H ^ 4 * N ^ 4 +\n      140675 * H ^ 4 * N ^ 4 + 60224 * H ^ 4 * N ^ 4 + 1906 * H ^ 4 * N ^ 4 + 1906 * H ^ 4 * N ^ 4 + 1900 * H ^ 4 * N ^ 4\"\n    using ttt31_def a b c d e m l k f h i g j by linarith\n  also have \"... = 256 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 208539 * H ^ 4 * N ^ 4\"\n    by simp\n  also have \"... \\<le> 256 + (2 * d_polynomial p + 826) * (N + N) ^ 4 + 208539 * H ^ 4 * N ^ 4\"\n  proof -\n    have \"H \\<le> N \"\n      using N_eq by simp\n    then show ?thesis\n      using le_N[of \"m'\"] m'_def by simp\n  qed\n  also have \"... = 256 + (2 * d_polynomial p + 826) * (2 * N) ^ 4 + 208539 * H ^ 4 * N ^ 4\"\n    by algebra\n  also have \"... = 256 + (2 * d_polynomial p + 826) * 16 * N ^ 4 + 208539 * H ^ 4 * N ^ 4\"\n    by simp\n  also have \"... \\<le> 256 + (2 * d_polynomial p + 826) * 16 * H ^ 4 * N ^ 4 + 208539 * H ^ 4 * N ^ 4\"\n    using H_ge_3 by simp\n  also have \"... = 256 + (32 * d_polynomial p + 13216) * H ^ 4 * N ^ 4 + 208539 * H ^ 4 * N ^ 4\"\n    by simp\n  also have \"... = 256 + (32 * d_polynomial p + 221755) * H ^ 4 * N ^ 4\"\n    by algebra\n  also have \"... \\<le> 256 * H ^ 4 + (32 * d_polynomial p + 221755) * H ^ 4 * N ^ 4\"\n    using H_gr_2 by simp\n  also have \"... \\<le> 256 * H ^ 4 * N ^ 4 + (32 * d_polynomial p + 221755) * H ^ 4 * N ^ 4\"\n    using N_ge_1 by simp\n  also have \"... = (32 * d_polynomial p + 222011) * H ^ 4 * N ^ 4\"\n    by algebra\n  finally show ?thesis .\nqed\n\nlemma tm31 [transforms_intros]: \"transforms tm31 tps0 ttt31 tps31\"\n  unfolding tm31_def\nproof (tform transforms_intros: tm_PHI5)\n  show \"60 + 8 < length tps30\"\n    using lentpsF tps30_def k by (simp_all only: length_list_update)\n  show \"tps30 ! 1 = nlltape (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4)\"\n    using tps30_def k lentpsF by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have *: \"2 * n + 2 * p n + 3 = Suc m\"\n    using m_def One_nat_def Suc_1 add_Suc_right numeral_3_eq_3 by presburger\n  have \"tps30 ! 60 = (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1)\"\n    using tps30_def k lentpsF by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps30 ! 60 = (\\<lfloor>2 * n + 2 * p n + 3\\<rfloor>\\<^sub>N, 1)\"\n    using * by presburger\n  have \"tps30 ! 61 = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps30_def k lentpsF by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps30 ! (60 + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps30 ! 62 = tpsF ! 62\"\n    using tps30_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps30 ! (60 + 2) = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsF k canrepr_0 by simp\n  have \"tps30 ! 63 = tpsF ! 63\"\n    using tps30_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps30 ! (60 + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsF k by simp\n  have \"tps30 ! 64 = tpsF ! 64\"\n    using tps30_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps30 ! (60 + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsF k by simp\n  have \"tps30 ! 65 = tpsF ! 65\"\n    using tps30_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps30 ! (60 + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsF k by simp\n  have \"tps30 ! 66 = tpsF ! 66\"\n    using tps30_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps30 ! (60 + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsF k by simp\n  have \"tps30 ! 67 = tpsF ! 67\"\n    using tps30_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps30 ! (60 + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsF k by simp\n  have \"tps30 ! 68 = (\\<lfloor>T' + Suc m\\<rfloor>\\<^sub>N, 1)\"\n    using tps30_def k lentpsF by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then have \"tps30 ! (60 + 8) = (\\<lfloor>Suc m + 1 * T'\\<rfloor>\\<^sub>N, 1)\"\n    by (metis add.commute add_One_commute nat_mult_1 numeral_plus_numeral semiring_norm(2) semiring_norm(4) semiring_norm(6) semiring_norm(7))\n  then show \"tps30 ! (60 + 8) = (\\<lfloor>2 * n + 2 * p n + 3 + T'\\<rfloor>\\<^sub>N, 1)\"\n    using * nat_mult_1 by presburger\n  have \"tps31 = tps30\n    [60 := (\\<lfloor>Suc m + T'\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape\n           (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n            formula_n \\<Phi>\\<^sub>5),\n     60 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps31_def tps30_def by (simp only: list_update_swap list_update_overwrite)\n  then show \"tps31 = tps30\n    [60 := (\\<lfloor>2 * n + 2 * p n + 3 + T'\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape\n           ((formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4) @\n            formula_n \\<Phi>\\<^sub>5),\n     60 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n    using * by (metis append_eq_appendI)\n  show \"ttt31 = 256 + (2 * d_polynomial p + 826) * (H + m') ^ 4 + 3 * nlength m' + 13 * nlength H +\n      5627 * H ^ 4 * (3 + nlength (3 * H + m' * H))\\<^sup>2 + 1875 * H ^ 4 +\n      15 * nlength n + 3764 * H ^ 4 * (3 + nlength (3 * H + 2 * n * H))\\<^sup>2 +\n      Suc n * (9 + 1897 * (H ^ 4 * (nlength (1 + 2 * n))\\<^sup>2)) + 6 * nlength (2 * n + 3) +\n      10 * nlength m + Suc (p n) * (9 + 1897 * (H ^ 4 * (nlength (Suc m))\\<^sup>2)) +\n      3 * nlength (Suc m) + 3 * max (nlength T') (nlength (Suc m)) +\n      Suc T' * (9 + 1891 * (H ^ 4 * (nlength (2 * n + 2 * p n + 3 + T'))\\<^sup>2))\"\n    using ttt31_def m_def One_nat_def Suc_1 add_Suc_right numeral_3_eq_3 by presburger\nqed\n\ndefinition \"tpsG \\<equiv> tpsF\n  [61 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   60 := (\\<lfloor>Suc m\\<rfloor>\\<^sub>N, 1),\n   68 := (\\<lfloor>T' + Suc m\\<rfloor>\\<^sub>N, 1),\n   60 := (\\<lfloor>Suc m + T'\\<rfloor>\\<^sub>N, 1),\n   60 + 3 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tpsG: \"68 < j \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsG ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsG_def tpsF by simp\n\nlemma lentpsG: \"length tpsG = 110\"\n  using lentpsF tpsG_def by simp\n\nlemma tps31: \"tps31 = tpsG\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5)]\"\n  unfolding tps31_def tpsG_def by (simp only: list_update_swap)\n\ndefinition \"tps32 \\<equiv> tpsG\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n         (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n          formula_n \\<Phi>\\<^sub>5),\n   69 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm32 [transforms_intros]:\n  assumes \"ttt = ttt31 + 14\"\n  shows \"transforms tm32 tps0 ttt tps32\"\n  unfolding tm32_def\nproof (tform)\n  show \"69 < length tps31\"\n    using lentpsF tps31_def k by (simp_all only: length_list_update)\n  have \"tps31 ! 69 = tpsF ! 69\"\n    using tps31_def by (simp only: nth_list_update_neq)\n  then show \"tps31 ! 69 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsF k canrepr_0 by simp\n  show \"tps32 = tps31[69 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps32_def tps31 by (simp only:)\n  show \"ttt = ttt31 + (10 + 2 * nlength 0 + 2 * nlength 2)\"\n    using assms nlength_2 by simp\nqed\n\ndefinition \"tps33 \\<equiv> tpsG\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n         (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n          formula_n \\<Phi>\\<^sub>5),\n   69 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   70 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm33 [transforms_intros]:\n  assumes \"ttt = ttt31 + 24 + 2 * nlength H\"\n  shows \"transforms tm33 tps0 ttt tps33\"\n  unfolding tm33_def\nproof (tform)\n  show \"70 < length tps32\"\n    using lentpsG tps32_def k by (simp_all only: length_list_update)\n  have \"tps32 ! 70 = tpsG ! 70\"\n    using tps32_def by (simp only: nth_list_update_neq)\n  then show \"tps32 ! 70 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsG k canrepr_0 by simp\n  show \"tps33 = tps32[70 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps33_def tps32_def by (simp only:)\n  show \"ttt = ttt31 + 14 + (10 + 2 * nlength 0 + 2 * nlength H)\"\n    using assms by simp\nqed\n\ndefinition \"tps34 \\<equiv> tpsG\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n         (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n          formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6),\n   69 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   70 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   0 := (\\<lfloor>xs\\<rfloor>, Suc n),\n   69 := (\\<lfloor>2 + 2 * n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm34 [transforms_intros]:\n  assumes \"ttt = ttt31 + 24 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1)\"\n  shows \"transforms tm34 tps0 ttt tps34\"\n  unfolding tm34_def\nproof (tform)\n  show \"69 + 7 < length tps33\"\n    using lentpsG tps33_def k by (simp_all only: length_list_update)\n  let ?nss = \"(formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @\n   formula_n \\<Phi>\\<^sub>4 @ formula_n \\<Phi>\\<^sub>5)\"\n  show \"tps33 ! 1 = nlltape ?nss\"\n    using tps33_def k lentpsG by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps33 ! 0 = tps1 ! 0\"\n    unfolding tps33_def tpsG_def tpsF_def tpsE_def tpsD_def tpsC_def tpsB_def tpsA_def\n    by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps33 ! 0 = (\\<lfloor>xs\\<rfloor>, 1)\"\n    using tps1' by simp\n  show \"tps33 ! 69 = (\\<lfloor>2\\<rfloor>\\<^sub>N, 1)\"\n    using tps33_def k lentpsG by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps33 ! 70 = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps33_def k lentpsG by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps33 ! (69 + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps33 ! 71 = tpsG ! 71\"\n    using tps33_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps33 ! (69 + 2) = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsG k canrepr_0 by simp\n  have \"tps33 ! 72 = tpsG ! 72\"\n    using tps33_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps33 ! (69 + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsG k by simp\n  have \"tps33 ! 73 = tpsG ! 73\"\n    using tps33_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps33 ! (69 + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsG k by simp\n  have \"tps33 ! 74 = tpsG ! 74\"\n    using tps33_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps33 ! (69 + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsG k by simp\n  have \"tps33 ! 75 = tpsG ! 75\"\n    using tps33_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps33 ! (69 + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsG k by simp\n  have \"tps33 ! 76 = tpsG ! 76\"\n    using tps33_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps33 ! (69 + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsG k by simp\n  show \"tps34 = tps33\n    [0 := (\\<lfloor>xs\\<rfloor>, Suc n),\n     69 := (\\<lfloor>2 + 2 * n\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape (?nss @ formula_n \\<Phi>\\<^sub>6)]\"\n    unfolding tps34_def tps33_def by (simp only: list_update_swap list_update_overwrite append_assoc)\n  show \"ttt = ttt31 + 24 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1)\"\n    using assms by simp\nqed\n\ndefinition \"tpsH \\<equiv> tpsG\n  [69 := (\\<lfloor>2\\<rfloor>\\<^sub>N, 1),\n   70 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   0 := (\\<lfloor>xs\\<rfloor>, Suc n),\n   69 := (\\<lfloor>2 + 2 * n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tpsH: \"76 < j \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsH ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsH_def tpsG by simp\n\nlemma lentpsH: \"length tpsH = 110\"\n  using lentpsG tpsH_def by simp\n\nlemma tps34: \"tps34 = tpsH\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6)]\"\n  unfolding tps34_def tpsH_def by (simp only: list_update_swap)\n\ndefinition \"tps35 \\<equiv> tpsH\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6),\n   77 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm35 [transforms_intros]:\n  assumes \"ttt = ttt31 + 38 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 3 * nlength n\"\n  shows \"transforms tm35 tps0 ttt tps35\"\n  unfolding tm35_def\nproof (tform)\n  show \"11 < length tps34\" \"77 < length tps34\"\n    using lentpsH tps34 k by (simp_all only: length_list_update)\n  show \"tps34 ! 11 = (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)\"\n    using tps34 k lentpsH by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps34 ! 77 = tpsH ! 77\"\n    using tps34 by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps34 ! 77 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsH k canrepr_0 by simp\n  show \"tps35 = tps34[77 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps35_def tps34 by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt31 + 24 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) +\n      (14 + 3 * (nlength n + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps36 \\<equiv> tpsH\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6),\n   77 := (\\<lfloor>2 * n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm36 [transforms_intros]:\n  assumes \"ttt = ttt31 + 43 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n\"\n  shows \"transforms tm36 tps0 ttt tps36\"\n  unfolding tm36_def\nproof (tform time: assms)\n  show \"77 < length tps35\"\n    using lentpsH tps35_def k by (simp_all only: length_list_update)\n  show \"tps35 ! 77 = (\\<lfloor>n\\<rfloor>\\<^sub>N, 1)\"\n    using tps35_def k lentpsH by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps36 = tps35[77 := (\\<lfloor>2 * n\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps36_def tps35_def by (simp only: list_update_swap[of 77] list_update_overwrite)\nqed\n\ndefinition \"tps37 \\<equiv> tpsH\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6),\n   77 := (\\<lfloor>2 * n + 4\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm37 [transforms_intros]:\n  assumes \"ttt = ttt31 + 63 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n    8 * nlength (2 * n + 4)\"\n  shows \"transforms tm37 tps0 ttt tps37\"\n  unfolding tm37_def\nproof (tform)\n  show \"77 < length tps36\"\n    using lentpsH tps36_def k by (simp_all only: length_list_update)\n  show \"tps36 ! 77 = (\\<lfloor>2 * n\\<rfloor>\\<^sub>N, 1)\"\n    using tps36_def k lentpsH by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps37 = tps36[77 := (\\<lfloor>2 * n + 4\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps37_def tps36_def by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt31 + 43 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) +\n      5 * nlength n + 4 * (5 + 2 * nlength (2 * n + 4))\"\n    using assms by simp\nqed\n\ndefinition \"tps38 \\<equiv> tpsH\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6),\n   77 := (\\<lfloor>2 * n + 4\\<rfloor>\\<^sub>N, 1),\n   78 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm38 [transforms_intros]:\n  assumes \"ttt = ttt31 + 73 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) +\n    5 * nlength n + 8 * nlength (2 * n + 4) + 2 * nlength H\"\n  shows \"transforms tm38 tps0 ttt tps38\"\n  unfolding tm38_def\nproof (tform)\n  show \"78 < length tps37\"\n    using lentpsH tps37_def k by (simp_all only: length_list_update)\n  have \"tps37 ! 78 = tpsH ! 78\"\n    using tps37_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps37 ! 78 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsH k canrepr_0 by simp\n  show \"tps38 = tps37[78 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps38_def tps37_def by (simp only: list_update_swap)\n  show \"ttt = ttt31 + 63 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) +\n      5 * nlength n + 8 * nlength (2 * n + 4) + (10 + 2 * nlength 0 + 2 * nlength H)\"\n    using assms by simp\nqed\n\ndefinition \"tps39 \\<equiv> tpsH\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6),\n   77 := (\\<lfloor>2 * n + 4\\<rfloor>\\<^sub>N, 1),\n   78 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   83 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm39 [transforms_intros]:\n  assumes \"ttt = ttt31 + 87 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n    8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n)\"\n  shows \"transforms tm39 tps0 ttt tps39\"\n  unfolding tm39_def\nproof (tform)\n  show \"15 < length tps38\" \"83 < length tps38\"\n    using lentpsH tps38_def k by (simp_all only: length_list_update)\n  show \"tps38 ! 15 = (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1)\"\n    using tps38_def k lentpsH by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps38 ! 83 = tpsH ! 83\"\n    using tps38_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps38 ! 83 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsH k canrepr_0 by simp\n  show \"tps39 = tps38[83 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps39_def tps38_def by (simp only: list_update_swap)\n  show \"ttt = ttt31 + 73 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n      8 * nlength (2 * n + 4) + 2 * nlength H + (14 + 3 * (nlength (p n) + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps40 \\<equiv> tpsH\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7),\n   77 := (\\<lfloor>2 * n + 4\\<rfloor>\\<^sub>N, 1),\n   78 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   83 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   77 := (\\<lfloor>2 * n + 4 + 2 * p n\\<rfloor>\\<^sub>N, 1),\n   77 + 6 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm40 [transforms_intros]:\n  assumes \"ttt = ttt31 + 88 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n    8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n    p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2\"\n  shows \"transforms tm40 tps0 ttt tps40\"\n  unfolding tm40_def\nproof (tform)\n  show \"77 + 6 < length tps39\"\n    using lentpsH tps39_def k by (simp_all only: length_list_update)\n  let ?nss = \"formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n      formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6\"\n  show \"tps39 ! 1 = nlltape ?nss\"\n    using tps39_def k lentpsH by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps39 ! 77 = (\\<lfloor>2 * n + 4\\<rfloor>\\<^sub>N, 1)\"\n    using tps39_def k lentpsH by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps39 ! 78 = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps39_def k lentpsH by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps39 ! (77 + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps39 ! 79 = tpsH ! 79\"\n    using tps39_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps39 ! (77 + 2) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsH k by simp\n  have \"tps39 ! 80 = tpsH ! 80\"\n    using tps39_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps39 ! (77 + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsH k by simp\n  have \"tps39 ! 81 = tpsH ! 81\"\n    using tps39_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps39 ! (77 + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsH k by simp\n  have \"tps39 ! 82 = tpsH ! 82\"\n    using tps39_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps39 ! (77 + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsH k by simp\n  have \"tps39 ! 83 = (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1)\"\n    using tps39_def k lentpsH by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps39 ! (77 + 6) = (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  show \"tps40 = tps39\n    [77 := (\\<lfloor>2 * n + 4 + 2 * p n\\<rfloor>\\<^sub>N, 1),\n     77 + 6 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1),\n     1 := nlltape (?nss @ formula_n \\<Phi>\\<^sub>7)]\"\n    unfolding tps40_def tps39_def by (simp only: list_update_swap list_update_overwrite append_assoc)\n  show \"ttt = ttt31 + 87 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n      8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n      (p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 1)\"\n    using assms by simp\nqed\n\ndefinition \"tpsI \\<equiv> tpsH\n  [77 := (\\<lfloor>2 * n + 4\\<rfloor>\\<^sub>N, 1),\n   78 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   83 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   77 := (\\<lfloor>2 * n + 4 + 2 * p n\\<rfloor>\\<^sub>N, 1),\n   77 + 6 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tpsI: \"83 < j \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsI ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsI_def tpsH by simp\n\nlemma lentpsI: \"length tpsI = 110\"\n  using lentpsH tpsI_def by simp\n\nlemma tps40: \"tps40 = tpsI\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7)]\"\n  unfolding tps40_def tpsI_def by (simp only: list_update_swap)\n\ndefinition \"tps41 \\<equiv> tpsI\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7),\n   84 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm41 [transforms_intros]:\n  assumes \"ttt = ttt31 + 102 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n    8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n    p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 +\n    3 * nlength m'\"\n  shows \"transforms tm41 tps0 ttt tps41\"\n  unfolding tm41_def\nproof (tform)\n  show \"18 < length tps40\" \"84 < length tps40\"\n    using lentpsI tps40 k by (simp_all only: length_list_update)\n  show \"tps40 ! 18 = (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1)\"\n    using tps40_def k lentpsH by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps40 ! 84 = tpsI ! 84\"\n    using tps40 by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps40 ! 84 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsI k canrepr_0 by simp\n  show \"tps41 = tps40[84 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps41_def tps40 by (simp only: list_update_swap)\n  show \"ttt = ttt31 + 88 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n      8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n      p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 +\n      (14 + 3 * (nlength m' + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps42 \\<equiv> tpsI\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7),\n   84 := (\\<lfloor>T' + m'\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm42 [transforms_intros]:\n  assumes \"ttt = ttt31 + 112 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n    8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n    p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 3 * nlength m' +\n    3 * max (nlength T') (nlength m')\"\n  shows \"transforms tm42 tps0 ttt tps42\"\n  unfolding tm42_def\nproof (tform)\n  show \"17 < length tps41\" \"84 < length tps41\"\n    using lentpsI tps41_def k by (simp_all only: length_list_update)\n  show \"tps41 ! 17 = (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1)\"\n    using tps41_def k lentpsI by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps41 ! 84 = (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1)\"\n    using tps41_def k lentpsI by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps42 = tps41[84 := (\\<lfloor>T' + m'\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps42_def tps41_def by (simp only: list_update_overwrite)\n  show \"ttt = ttt31 + 102 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n      8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n      p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 +\n      3 * nlength m' + (3 * max (nlength T') (nlength m') + 10)\"\n    using assms by simp\nqed\n\ndefinition \"tps43 \\<equiv> tpsI\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7),\n   84 := (\\<lfloor>2 * T' + m'\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm43 [transforms_intros]:\n  assumes \"ttt = ttt31 + 122 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n    8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n    p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 3 * nlength m' +\n    3 * max (nlength T') (nlength m') +\n    3 * max (nlength T') (nlength (T' + m'))\"\n  shows \"transforms tm43 tps0 ttt tps43\"\n  unfolding tm43_def\nproof (tform)\n  show \"17 < length tps42\" \"84 < length tps42\"\n    using lentpsI tps42_def k by (simp_all only: length_list_update)\n  show \"tps42 ! 17 = (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1)\"\n    using tps42_def k lentpsI by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps42 ! 84 = (\\<lfloor>T' + m'\\<rfloor>\\<^sub>N, 1)\"\n    using tps42_def k lentpsI by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps43 = tps42[84 := (\\<lfloor>2 * T' + m'\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps43_def tps42_def by (simp only: list_update_overwrite)\n  then show \"tps43 = tps42[84 := (\\<lfloor>T' + (T' + m')\\<rfloor>\\<^sub>N, 1)]\"\n    by (simp add: left_add_twice)\n  show \"ttt = ttt31 + 112 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n      8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n      p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 3 * nlength m' +\n      3 * max (nlength T') (nlength m') +\n      (3 * max (nlength T') (nlength (T' + m')) + 10)\"\n    using assms by simp\nqed\n\ndefinition \"tps44 \\<equiv> tpsI\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7),\n   84 := (\\<lfloor>3 * T' + m'\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm44 [transforms_intros]:\n  assumes \"ttt = ttt31 + 132 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n    8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n    p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 3 * nlength m' +\n    3 * max (nlength T') (nlength m') +\n    3 * max (nlength T') (nlength (T' + m')) +\n    3 * max (nlength T') (nlength (2 * T' + m'))\"\n  shows \"transforms tm44 tps0 ttt tps44\"\n  unfolding tm44_def\nproof (tform)\n  show \"17 < length tps43\" \"84 < length tps43\"\n    using lentpsI tps43_def k by (simp_all only: length_list_update)\n  show \"tps43 ! 17 = (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1)\"\n    using tps43_def k lentpsI by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps43 ! 84 = (\\<lfloor>2 * T' + m'\\<rfloor>\\<^sub>N, 1)\"\n    using tps43_def k lentpsI by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps44 = tps43[84 := (\\<lfloor>3 * T' + m'\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps44_def tps43_def by (simp only: list_update_overwrite)\n  then show \"tps44 = tps43[84 := (\\<lfloor>T' + (2 * T' + m')\\<rfloor>\\<^sub>N, 1)]\"\n    by (simp add: left_add_twice)\n  show \"ttt = ttt31 + 122 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n      8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n      p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 3 * nlength m' +\n      3 * max (nlength T') (nlength m') +\n      3 * max (nlength T') (nlength (T' + m')) +\n      (3 * max (nlength T') (nlength (2 * T' + m')) + 10)\"\n    using assms by simp\nqed\n\ndefinition \"tps45 \\<equiv> tpsI\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7),\n   84 := (\\<lfloor>1 + 3 * T' + m'\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm45 [transforms_intros]:\n  assumes \"ttt = ttt31 + 137 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n    8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n    p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 3 * nlength m' +\n    3 * max (nlength T') (nlength m') +\n    3 * max (nlength T') (nlength (T' + m')) +\n    3 * max (nlength T') (nlength (2 * T' + m')) +\n    2 * nlength (3 * T' + m')\"\n  shows \"transforms tm45 tps0 ttt tps45\"\n  unfolding tm45_def\nproof (tform)\n  show \"84 < length tps44\"\n    using lentpsI tps44_def k by (simp_all only: length_list_update)\n  show \"tps44 ! 84 = (\\<lfloor>3 * T' + m'\\<rfloor>\\<^sub>N, 1)\"\n    using tps44_def k lentpsI by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps45 = tps44[84 := (\\<lfloor>1 + 3 * T' + m'\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps45_def tps44_def by (simp only: list_update_overwrite)\n  then show \"tps45 = tps44[84 := (\\<lfloor>Suc (3 * T' + m')\\<rfloor>\\<^sub>N, 1)]\"\n    by simp\n  show \"ttt = ttt31 + 132 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n      8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n      p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 3 * nlength m' +\n      3 * max (nlength T') (nlength m') +\n      3 * max (nlength T') (nlength (T' + m')) +\n      3 * max (nlength T') (nlength (2 * T' + m')) +\n      (5 + 2 * nlength (3 * T' + m'))\"\n    using assms by simp\nqed\n\ndefinition \"tps46 \\<equiv> tpsI\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7),\n   84 := (\\<lfloor>1 + 3 * T' + m'\\<rfloor>\\<^sub>N, 1),\n   85 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm46 [transforms_intros]:\n  assumes \"ttt = ttt31 + 147 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n    8 * nlength (2 * n + 4) + 4 * nlength H + 3 * nlength (p n) +\n    p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 3 * nlength m' +\n    3 * max (nlength T') (nlength m') +\n    3 * max (nlength T') (nlength (T' + m')) +\n    3 * max (nlength T') (nlength (2 * T' + m')) +\n    2 * nlength (3 * T' + m')\"\n  shows \"transforms tm46 tps0 ttt tps46\"\n  unfolding tm46_def\nproof (tform)\n  show \"85 < length tps45\"\n    using lentpsI tps45_def k by (simp_all only: length_list_update)\n  have \"tps45 ! 85 = tpsI ! 85\"\n    using tps45_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps45 ! 85 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsI k canrepr_0 by simp\n  show \"tps46 = tps45[85 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps46_def tps45_def by (simp only:)\n  show \"ttt = ttt31 + 137 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n      8 * nlength (2 * n + 4) + 2 * nlength H + 3 * nlength (p n) +\n      p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 3 * nlength m' +\n      3 * max (nlength T') (nlength m') +\n      3 * max (nlength T') (nlength (T' + m')) +\n      3 * max (nlength T') (nlength (2 * T' + m')) +\n      2 * nlength (3 * T' + m') +\n      (10 + 2 * nlength 0 + 2 * nlength H)\"\n    using assms by simp\nqed\n\ndefinition \"tps47 \\<equiv> tpsI\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7 @ formula_n \\<Phi>\\<^sub>8),\n   84 := (\\<lfloor>1 + 3 * T' + m'\\<rfloor>\\<^sub>N, 1),\n   85 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   84 + 2 := (\\<lfloor>3\\<rfloor>\\<^sub>N, 1),\n   84 + 6 := (\\<lfloor>formula_n \\<Phi>\\<^sub>8\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\ndefinition \"ttt47 \\<equiv> ttt31 + 166 +\n    6 * nlength H +\n    133650 * H ^ 6 * n ^ 3 +\n    5 * nlength n +\n    8 * nlength (2 * n + 4) +\n    3 * nlength (p n) +\n    p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 +\n    3 * nlength m' +\n    3 * max (nlength T') (nlength m') +\n    3 * max (nlength T') (nlength (T' + m')) +\n    3 * max (nlength T') (nlength (2 * T' + m')) +\n    2 * nlength (3 * T' + m') +\n    1861 * H ^ 4 * (nlength (Suc (1 + 3 * T' + m')))\\<^sup>2\"\n\nlemma ttt47: \"ttt47 \\<le> (32 * d_polynomial p + 364343) * H ^ 6 * N ^ 4\"\nproof -\n  have nlength_le_GN: \"y \\<le> N \\<Longrightarrow> nlength y \\<le> H ^ 6 * N ^ 3\" for y\n  proof -\n    assume \"y \\<le> N \"\n    then have \"nlength y \\<le> N ^ 3\"\n      using nlength_le_n linear_le_pow H_ge_3 by (meson dual_order.trans zero_less_numeral)\n    also have \"... \\<le> H ^ 6 * N ^ 3\"\n      using H_gr_2 by simp\n    finally show ?thesis .\n  qed\n\n  have h: \"6 * nlength H \\<le> 6 * H ^ 6 * N ^ 3\"\n    using nlength_le_GN[OF H_le_N] by simp\n  have i: \"5 * nlength n \\<le> 5 * H ^ 6 * N ^ 3\"\n    using nlength_le_GN[OF n_le_N] by simp\n  have j: \"8 * nlength (2 * n + 4) \\<le> 8 * H ^ 6 * N ^ 3\"\n  proof -\n    have \"2 * n + 4 \\<le> 2 * n + H * 3\"\n      using H_ge_3 by simp\n    also have \"... \\<le> H * 2 * n + H * 3\"\n      using H_ge_3 by simp\n    also have \"... = H * (2 * n + 3)\"\n      by algebra\n    also have \"... \\<le> N \"\n      using N_eq by simp\n    finally have \"2 * n + 4 \\<le> N \" .\n    then have \"8 * nlength (2 * n + 4) \\<le> 8 * nlength N\"\n      using nlength_mono by simp\n    also have \"... \\<le> 8 * N \"\n      using nlength_le_n by simp\n    also have \"... \\<le> 8 * H ^ 6 * N \"\n      using H_ge_3 by simp\n    also have \"... \\<le> 8 * H ^ 6 * N ^ 3\"\n      using linear_le_pow by simp\n    finally show ?thesis .\n  qed\n  have k: \"3 * nlength (p n) \\<le> 3 * H ^ 6 * N ^ 3\"\n    using nlength_le_GN[OF le_N] by simp\n  have l: \"3 * nlength m' \\<le> 3 * H ^ 6 * N ^ 3\"\n    using nlength_le_GN[OF le_N] m'_def by simp\n  have g: \"3 * max (nlength T') (nlength m') \\<le> 3 * H ^ 6 * N ^ 3\"\n  proof -\n    have \"m' \\<le> N \"\n      using le_N m'_def by simp\n    moreover have \"T' \\<le> N \"\n      using le_N by simp\n    ultimately have \"max (nlength T') (nlength m') \\<le> nlength N\"\n      using max_nlength nlength_mono by simp\n    then have \"3 * max (nlength T') (nlength m') \\<le> 3 * N \"\n      using nlength_le_n by (meson le_trans mult_le_mono2)\n    also have \"... \\<le> 3 * H ^ 6 * N \"\n      using H_ge_3 by simp\n    also have \"... \\<le> 3 * H ^ 6 * N ^ 3\"\n      using linear_le_pow by simp\n    finally show ?thesis .\n  qed\n  have f: \"3 * max (nlength T') (nlength (T' + m')) \\<le> 6 * H ^ 6 * N ^ 3\"\n  proof -\n    have \"T' + m' \\<le> N + N \"\n      using N_eq m'_def H_gr_2 add_le_mono le_N less_or_eq_imp_le mult_le_mono trans_le_add2\n      by presburger\n    then have \"T' + m' \\<le> 2 * N \"\n      by simp\n    moreover have \"T' \\<le> N \"\n      using le_N by simp\n    ultimately have \"max (nlength T') (nlength (T' + m')) \\<le> nlength (2 * N)\"\n      using max_nlength nlength_mono by simp\n    then have \"3 * max (nlength T') (nlength (T' + m')) \\<le> 3 * (2 * N)\"\n      using nlength_le_n by (meson le_trans mult_le_mono2)\n    also have \"... = 6 * N \"\n      by simp\n    also have \"... \\<le> 6 * H ^ 6 * N \"\n      using H_ge_3 by simp\n    also have \"... \\<le> 6 * H ^ 6 * N ^ 3\"\n      using linear_le_pow by simp\n    finally show ?thesis .\n  qed\n  have e: \"3 * max (nlength T') (nlength (2 * T' + m')) \\<le> 6 * H ^ 6 * N ^ 3\"\n  proof -\n    have \"2 * T' + m' \\<le> N + N \"\n      using N_eq m'_def H_gr_2 add_le_mono le_N less_or_eq_imp_le mult_le_mono trans_le_add2\n      by presburger\n    then have \"2 * T' + m' \\<le> 2 * N \"\n      by simp\n    moreover have \"T' \\<le> N \"\n      using le_N by simp\n    ultimately have \"max (nlength T') (nlength (2 * T' + m')) \\<le> nlength (2 * N)\"\n      using max_nlength nlength_mono by simp\n    then have \"3 * max (nlength T') (nlength (2 * T' + m')) \\<le> 3 * (2 * N)\"\n      using nlength_le_n by (meson le_trans mult_le_mono2)\n    also have \"... = 6 * N \"\n      by simp\n    also have \"... \\<le> 6 * H ^ 6 * N \"\n      using H_ge_3 by simp\n    also have \"... \\<le> 6 * H ^ 6 * N ^ 3\"\n      using linear_le_pow by simp\n    finally show ?thesis .\n  qed\n  have d: \"2 * nlength (3 * T' + m') \\<le> 4 * H ^ 6 * N ^ 3\"\n  proof -\n    have \"3 * T' + m' \\<le> N + N \"\n      using N_eq H_ge_3 m'_def by (metis add_leE add_le_mono le_N le_refl mult_le_mono)\n    then have \"3 * T' + m' \\<le> 2 * N \"\n      by simp\n    then have \"nlength (3 * T' + m') \\<le> 2 * N \"\n      using nlength_le_n le_trans by blast\n    then have \"2 * nlength (3 * T' + m') \\<le> 4 * N \"\n      by simp\n    also have \"... \\<le> 4 * H ^ 6 * N \"\n      using H_ge_3 by simp\n    also have \"... \\<le> 4 * H ^ 6 * N ^ 3\"\n      using linear_le_pow by simp\n    finally show ?thesis .\n  qed\n  have c: \"6 * nlength H \\<le> 6 * H ^ 6 * N ^ 3\"\n  proof -\n    have \"6 * nlength H \\<le> 6 * H\"\n      using nlength_le_n by simp\n    also have \"... \\<le> 6 * H ^ 6\"\n      using linear_le_pow by simp\n    also have \"... \\<le> 6 * H ^ 6 * N ^ 3\"\n      using N_ge_1 by simp\n    finally show ?thesis .\n  qed\n  have a: \"p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 \\<le> 1028 * H ^ 6 * N ^ 3\"\n  proof -\n    have \"nlength (2 * n + 4 + 2 * p n) = nlength (2 * (n + 2 + p n))\"\n      by (metis distrib_left_numeral mult_2_right numeral_Bit0)\n    also have \"... \\<le> Suc (nlength (n + 2 + p n))\"\n      using nlength_times2 by blast\n    also have \"... \\<le> Suc (n + 2 + p n)\"\n      by (simp add: nlength_le_n)\n    also have \"... \\<le> N \"\n      using le_N by simp\n    finally have \"nlength (2 * n + 4 + 2 * p n) \\<le> N \" .\n    then have \"(nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 \\<le> (N + nlength H) ^ 2\"\n      by simp\n    also have \"... \\<le> (N + N) ^ 2\"\n      using H_le_N nlength_le_n by (meson add_left_mono le_trans power2_nat_le_eq_le)\n    also have \"... = (2 * N) ^ 2\"\n      by algebra\n    also have \"... = 4 * N ^ 2\"\n      by simp\n    finally have \"(nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 \\<le> 4 * N ^ 2\" .\n    then have \"p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 \\<le> p n * 257 * H * (4 * N ^ 2)\"\n      by simp\n    also have \"... \\<le> N * 257 * H * (4 * N ^ 2)\"\n      using le_N by simp\n    also have \"... = 1028 * H * N ^ 3\"\n      by algebra\n    also have \"... \\<le> 1028 * H ^ 6 * N ^ 3\"\n      using linear_le_pow by simp\n    finally show ?thesis .\n  qed\n  have b: \"1861 * H ^ 4 * (nlength (Suc (1 + 3 * T' + m')))\\<^sup>2 \\<le> 7444 * H ^ 6 * N ^ 3\"\n  proof -\n    have \"Suc (1 + 3 * T' + m') \\<le> 3 * (2 * n + 2 * p n + 3 + T') + m' \"\n      by simp\n    also have \"... \\<le> N + N \"\n      using N_eq H_ge_3 m'_def add_le_mono le_N le_refl mult_le_mono1 by presburger\n    also have \"... \\<le> 2 * N \"\n      by simp\n    finally have \"Suc (1 + 3 * T' + m') \\<le> 2 * N \" .\n    then have \"nlength (Suc (1 + 3 * T' + m')) \\<le> 2 * N \"\n      using nlength_le_n le_trans by blast\n    then have \"(nlength (Suc (1 + 3 * T' + m'))) ^ 2 \\<le> (2 * N) ^ 2\"\n      using power2_nat_le_eq_le by presburger\n    then have \"(nlength (Suc (1 + 3 * T' + m'))) ^ 2 \\<le> 4 * N ^ 2\"\n      by simp\n    then have \"1861 * H ^ 4 * (nlength (Suc (1 + 3 * T' + m')))\\<^sup>2 \\<le> 1861 * H ^ 4 * (4 * N ^ 2)\"\n      by simp\n    also have \"... = 7444 * H ^ 4 * N ^ 2\"\n      by simp\n    also have \"... \\<le> 7444 * H ^ 6 * N ^ 2\"\n      using pow_mono' by simp\n    also have \"... \\<le> 7444 * H ^ 6 * N ^ 3\"\n      using pow_mono' by simp\n    finally show ?thesis .\n  qed\n  have m: \"133650 * H ^ 6 * n ^ 3 \\<le> 133650 * H ^ 6 * N ^ 3\"\n    using n_le_N by simp\n\n  have \"ttt47 \\<le> ttt31 + 166 +\n      6 * H ^ 6 * N ^ 3 + 133650 * H ^ 6 * N ^ 3 + 5 * H ^ 6 * N ^ 3 +\n      8 * H ^ 6 * N ^ 3 + 3 * H ^ 6 * N ^ 3 + 1028 * H ^ 6 * N ^ 3 +\n      3 * H ^ 6 * N ^ 3 + 3 * H ^ 6 * N ^ 3 + 6 * H ^ 6 * N ^ 3 +\n      6 * H ^ 6 * N ^ 3 + 4 * H ^ 6 * N ^ 3 + 7444 * H ^ 6 * N ^ 3\"\n    using ttt47_def a b c d e f g h i j k l m by linarith\n  also have \"... = ttt31 + 166 + 142166 * H ^ 6 * N ^ 3\"\n    by simp\n  also have \"... \\<le> ttt31 + 166 * H ^ 6 + 142166 * H ^ 6 * N ^ 3\"\n    using H_ge_3 by simp\n  also have \"... \\<le> ttt31 + 166 * H ^ 6 * N ^ 3 + 142166 * H ^ 6 * N ^ 3\"\n    using N_ge_1 by simp\n  also have \"... = ttt31 + 142332 * H ^ 6 * N ^ 3\"\n    by simp\n  also have \"... \\<le> ttt31 + 142332 * H ^ 6 * N ^ 4\"\n    using pow_mono' by simp\n  also have \"... \\<le> (32 * d_polynomial p + 222011) * H ^ 4 * N ^ 4 + 142332 * H ^ 6 * N ^ 4\"\n    using ttt31 by simp\n  also have \"... \\<le> (32 * d_polynomial p + 222011) * H ^ 6 * N ^ 4 + 142332 * H ^ 6 * N ^ 4\"\n    using pow_mono' by simp\n  also have \"... = (32 * d_polynomial p + 364343) * H ^ 6 * N ^ 4\"\n    by algebra\n  finally show ?thesis .\nqed\n\nlemma tm47 [transforms_intros]: \"transforms tm47 tps0 ttt47 tps47\"\n  unfolding tm47_def\nproof (tform)\n  show \"84 + 7 < length tps46\"\n    using lentpsI tps46_def k by (simp_all only: length_list_update)\n  let ?nss = \"formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7\"\n  show \"tps46 ! 1 = nlltape ?nss\"\n    using tps46_def k lentpsI by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps46 ! 84 = (\\<lfloor>1 + 3 * T' + m'\\<rfloor>\\<^sub>N, 1)\"\n    using tps46_def k lentpsI by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps46 ! 85 = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps46_def k lentpsI by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps46 ! (84 + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps46 ! 86 = tpsI ! 86\"\n    using tps46_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps46 ! (84 + 2) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsI k by simp\n  have \"tps46 ! 87 = tpsI ! 87\"\n    using tps46_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps46 ! (84 + 3) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsI k by simp\n  have \"tps46 ! 88 = tpsI ! 88\"\n    using tps46_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps46 ! (84 + 4) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsI k by simp\n  have \"tps46 ! 89 = tpsI ! 89\"\n    using tps46_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps46 ! (84 + 5) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsI k by simp\n  have \"tps46 ! 90 = tpsI ! 90\"\n    using tps46_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps46 ! (84 + 6) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsI k by simp\n  have \"tps46 ! 91 = tpsI ! 91\"\n    using tps46_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps46 ! (84 + 7) = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsI k by simp\n  show \"tps47 = tps46\n      [1 := nlltape (?nss @ formula_n \\<Phi>\\<^sub>8),\n       84 + 2 := (\\<lfloor>3\\<rfloor>\\<^sub>N, 1),\n       84 + 6 := (\\<lfloor>formula_n \\<Phi>\\<^sub>8\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n    unfolding tps47_def tps46_def by (simp only: list_update_swap list_update_overwrite append_assoc)\n  show \"ttt47 = ttt31 + 147 + 2 * nlength H + (133650 * H ^ 6 * n ^ 3 + 1) + 5 * nlength n +\n      8 * nlength (2 * n + 4) + 4 * nlength H + 3 * nlength (p n) +\n      p n * 257 * H * (nlength (2 * n + 4 + 2 * p n) + nlength H)\\<^sup>2 + 3 * nlength m' +\n      3 * max (nlength T') (nlength m') +\n      3 * max (nlength T') (nlength (T' + m')) +\n      3 * max (nlength T') (nlength (2 * T' + m')) +\n      2 * nlength (3 * T' + m') +\n      (18 + 1861 * H ^ 4 * (nlength (Suc (1 + 3 * T' + m')))\\<^sup>2)\"\n    using ttt47_def by simp\nqed\n\ndefinition \"tpsJ \\<equiv> tpsI\n  [84 := (\\<lfloor>1 + 3 * T' + m'\\<rfloor>\\<^sub>N, 1),\n   85 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   84 + 2 := (\\<lfloor>3\\<rfloor>\\<^sub>N, 1),\n   84 + 6 := (\\<lfloor>formula_n \\<Phi>\\<^sub>8\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma tpsJ: \"90 < j \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsJ ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsJ_def tpsI by simp\n\nlemma lentpsJ: \"length tpsJ = 110\"\n  using lentpsI tpsJ_def by simp\n\nlemma tps47: \"tps47 = tpsJ\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7 @ formula_n \\<Phi>\\<^sub>8)]\"\n  unfolding tps47_def tpsJ_def by (simp only: list_update_swap)\n\ndefinition \"tps48 \\<equiv> tpsJ\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7 @ formula_n \\<Phi>\\<^sub>8),\n   91 := (\\<lfloor>N\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm48 [transforms_intros]:\n  assumes \"ttt = ttt47 + 14 + 3 * nlength N\"\n  shows \"transforms tm48 tps0 ttt tps48\"\n  unfolding tm48_def\nproof (tform)\n  show \"20 < length tps47\" \"91 < length tps47\"\n    using lentpsJ tps47 k by (simp_all only: length_list_update)\n  have \"tps47 ! 20 = (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1)\"\n    using tps47 k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps47 ! 20 = (\\<lfloor>N\\<rfloor>\\<^sub>N, 1)\"\n    using m' by simp\n  have \"tps47 ! 91 = tpsJ ! 91\"\n    using tps47 by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps47 ! 91 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsJ k canrepr_0 by simp\n  show \"tps48 = tps47[91 := (\\<lfloor>N\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps48_def tps47 by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt47 + (14 + 3 * (nlength N + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps49 \\<equiv> tpsJ\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7 @ formula_n \\<Phi>\\<^sub>8),\n   91 := (\\<lfloor>N\\<rfloor>\\<^sub>N, 1),\n   92 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm49 [transforms_intros]:\n  assumes \"ttt = ttt47 + 24 + 3 * nlength N + 2 * nlength H\"\n  shows \"transforms tm49 tps0 ttt tps49\"\n  unfolding tm49_def\nproof (tform)\n  show \"92 < length tps48\"\n    using lentpsJ tps48_def k by (simp_all only: length_list_update)\n  have \"tps48 ! 92 = tpsJ ! 92\"\n    using tps48_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps48 ! 92 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsJ k canrepr_0 by simp\n  show \"tps49 = tps48[92 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps49_def tps48_def by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt47 + 14 + 3 * nlength N + (10 + 2 * nlength 0 + 2 * nlength H)\"\n    using assms by simp\nqed\n\ndefinition \"tps50 \\<equiv> tpsJ\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7 @ formula_n \\<Phi>\\<^sub>8),\n   91 := (\\<lfloor>N\\<rfloor>\\<^sub>N, 1),\n   92 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   93 := (\\<lfloor>Z\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm50 [transforms_intros]:\n  assumes \"ttt = ttt47 + 34 + 3 * nlength N + 2 * nlength H + 2 * nlength Z\"\n  shows \"transforms tm50 tps0 ttt tps50\"\n  unfolding tm50_def\nproof (tform)\n  show \"93 < length tps49\"\n    using lentpsJ tps49_def k by (simp_all only: length_list_update)\n  have \"tps49 ! 93 = tpsJ ! 93\"\n    using tps49_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps49 ! 93 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsJ k canrepr_0 by simp\n  show \"tps50 = tps49[93 := (\\<lfloor>Z\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps50_def tps49_def by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt47 + 24 + 3 * nlength N + 2 * nlength H + (10 + 2 * nlength 0 + 2 * nlength Z)\"\n    using assms by simp\nqed\n\ndefinition \"tps51 \\<equiv> tpsJ\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7 @ formula_n \\<Phi>\\<^sub>8),\n   91 := (\\<lfloor>N\\<rfloor>\\<^sub>N, 1),\n   92 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   93 := (\\<lfloor>Z\\<rfloor>\\<^sub>N, 1),\n   94 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm51 [transforms_intros]:\n  assumes \"ttt = ttt47 + 48 + 3 * nlength N + 2 * nlength H + 2 * nlength Z + 3 * nlength T'\"\n  shows \"transforms tm51 tps0 ttt tps51\"\n  unfolding tm51_def\nproof (tform)\n  show \"17 < length tps50\" \"94 < length tps50\"\n    using lentpsJ tps50_def k by (simp_all only: length_list_update)\n  show \"tps50 ! 17 = (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1)\"\n    using tps50_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps50 ! 94 = tpsJ ! 94\"\n    using tps50_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps50 ! 94 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsJ k canrepr_0 by simp\n  show \"tps51 = tps50[94 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps51_def tps50_def by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt47 + 34 + 3 * nlength N + 2 * nlength H + 2 * nlength Z +\n      (14 + 3 * (nlength T' + nlength 0))\"\n    using assms by simp\nqed\n\ndefinition \"tps52 \\<equiv> tpsJ\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7 @ formula_n \\<Phi>\\<^sub>8),\n   91 := (\\<lfloor>N\\<rfloor>\\<^sub>N, 1),\n   92 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   93 := (\\<lfloor>Z\\<rfloor>\\<^sub>N, 1),\n   94 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   95 := (\\<lfloor>formula_n \\<psi>\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma tm52 [transforms_intros]:\n  assumes \"ttt = ttt47 + 58 + 3 * nlength N + 2 * nlength H + 2 * nlength Z +\n    3 * nlength T' + 2 * nlllength (formula_n \\<psi>)\"\n  shows \"transforms tm52 tps0 ttt tps52\"\n  unfolding tm52_def\nproof (tform)\n  show \"95 < length tps51\"\n    using lentpsJ tps51_def k by (simp_all only: length_list_update)\n  have \"tps51 ! 95 = tpsJ ! 95\"\n    using tps51_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then have *: \"tps51 ! 95 = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsJ k by simp\n  then show \"tps51 ::: 95 = \\<lfloor>[]\\<rfloor>\"\n    by simp\n  show \"clean_tape (tps51 ! 95)\"\n    using * by simp\n  show \"proper_symbols []\"\n    by simp\n  show \"proper_symbols (numlistlist (formula_n \\<psi>))\"\n    using proper_symbols_numlistlist by simp\n  have \"tps52 = tps51[95 := (\\<lfloor>formula_n \\<psi>\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n    unfolding tps52_def tps51_def by (simp only: list_update_swap list_update_overwrite)\n  then show \"tps52 = tps51[95 := (\\<lfloor>numlistlist (formula_n \\<psi>)\\<rfloor>, 1)]\"\n    using nllcontents_def by simp\n  show \"ttt = ttt47 + 48 + 3 * nlength N + 2 * nlength H + 2 * nlength Z +\n      3 * nlength T' + (8 + tps51 :#: 95 + 2 * length [] +\n      Suc (2 * length (numlistlist (formula_n \\<psi>))))\"\n    using assms * nlllength_def by simp\nqed\n\ndefinition \"tps53 \\<equiv> tpsJ\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7 @ formula_n \\<Phi>\\<^sub>8),\n   91 := (\\<lfloor>N\\<rfloor>\\<^sub>N, 1),\n   92 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   93 := (\\<lfloor>Z\\<rfloor>\\<^sub>N, 1),\n   94 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   95 := (\\<lfloor>formula_n \\<psi>\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n   96 := (\\<lfloor>formula_n \\<psi>'\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma tm53 [transforms_intros]:\n  assumes \"ttt = ttt47 + 68 + 3 * nlength N + 2 * nlength H + 2 * nlength Z + 3 * nlength T' +\n    2 * nlllength (formula_n \\<psi>) + 2 * length (numlistlist (formula_n \\<psi>'))\"\n  shows \"transforms tm53 tps0 ttt tps53\"\n  unfolding tm53_def\nproof (tform)\n  show \"96 < length tps52\"\n    using lentpsJ tps52_def k by (simp_all only: length_list_update)\n  have \"tps52 ! 96 = tpsJ ! 96\"\n    using tps52_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then have *: \"tps52 ! 96 = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsJ k by simp\n  then show \"tps52 ::: 96 = \\<lfloor>[]\\<rfloor>\"\n    by simp\n  show \"clean_tape (tps52 ! 96)\"\n    using * by simp\n  show \"proper_symbols []\"\n    by simp\n  show \"proper_symbols (numlistlist (formula_n \\<psi>'))\"\n    using proper_symbols_numlistlist by simp\n  have \"tps53 = tps52[96 := (\\<lfloor>formula_n \\<psi>'\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n    unfolding tps53_def tps52_def by (simp only: list_update_swap list_update_overwrite)\n  then show \"tps53 = tps52[96 := (\\<lfloor>numlistlist (formula_n \\<psi>')\\<rfloor>, 1)]\"\n    using nllcontents_def by simp\n  show \"ttt = ttt47 + 58 + 3 * nlength N + 2 * nlength H + 2 * nlength Z + 3 * nlength T' +\n      2 * nlllength (formula_n \\<psi>) +\n      (8 + tps52 :#: 96 + 2 * length [] + Suc (2 * length (numlistlist (formula_n \\<psi>'))))\"\n    using assms * nlllength_def by simp\nqed\n\ndefinition \"tps54 \\<equiv> tpsJ\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape\n      (formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7 @ formula_n \\<Phi>\\<^sub>8),\n   91 := (\\<lfloor>N\\<rfloor>\\<^sub>N, 1),\n   92 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   93 := (\\<lfloor>Z\\<rfloor>\\<^sub>N, 1),\n   94 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   95 := (\\<lfloor>formula_n \\<psi>\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n   96 := (\\<lfloor>formula_n \\<psi>'\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n   97 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tm54 [transforms_intros]:\n  assumes \"ttt = ttt47 + 80 + 3 * nlength N + 2 * nlength H + 2 * nlength Z + 3 * nlength T' +\n    2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>')\"\n  shows \"transforms tm54 tps0 ttt tps54\"\n  unfolding tm54_def\nproof (tform)\n  show \"97 < length tps53\"\n    using lentpsJ tps53_def k by (simp_all only: length_list_update)\n  have \"tps53 ! 97 = tpsJ ! 97\"\n    using tps53_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then show \"tps53 ! 97 = (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)\"\n    using tpsJ k canrepr_0 by simp\n  show \"tps54 = tps53[97 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps54_def tps53_def by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt47 + 68 + 3 * nlength N + 2 * nlength H + 2 * nlength Z + 3 * nlength T' +\n      2 * nlllength (formula_n \\<psi>) + 2 * length (numlistlist (formula_n \\<psi>')) +\n      (10 + 2 * nlength 0 + 2 * nlength 1)\"\n    using assms canrepr_1 nlllength_def by simp\nqed\n\ndefinition \"tps55 \\<equiv> tpsJ\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n PHI),\n   91 := (\\<lfloor>N\\<rfloor>\\<^sub>N, 1),\n   92 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   93 := (\\<lfloor>Z\\<rfloor>\\<^sub>N, 1),\n   94 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   95 := (\\<lfloor>formula_n \\<psi>\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n   96 := (\\<lfloor>formula_n \\<psi>'\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n   97 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n   91 + 6 := (\\<lfloor>Suc T'\\<rfloor>\\<^sub>N, 1),\n   91 + 3 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)]\"\n\ndefinition \"ttt55 \\<equiv> ttt47 + 80 + 3 * nlength N + 2 * nlength H + 2 * nlength Z +\n  3 * nlength T' + 2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') +\n  16114767 * 2 ^ (16 * Z) * N ^ 7\"\n\nlemma ttt55: \"ttt55 \\<le> ttt47 + 2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') +\n      16114857 * 2 ^ (16 * Z) * N ^ 7\"\nproof -\n  have nlength_le_ZN: \"y \\<le> N \\<Longrightarrow> nlength y \\<le> 2 ^ (16*Z)* N ^ 7\" for y\n  proof -\n    assume \"y \\<le> N \"\n    then have \"nlength y \\<le> N ^ 7\"\n      using nlength_le_n linear_le_pow H_ge_3 by (meson dual_order.trans zero_less_numeral)\n    also have \"... \\<le> 2 ^ (16*Z) * N ^ 7\"\n      by simp\n    finally show ?thesis .\n  qed\n\n  have \"3 * nlength N \\<le> 3 * 2 ^ (16*Z) * N ^ 7\"\n    using nlength_le_ZN by simp\n  moreover have \"2 * nlength H \\<le> 2 * 2 ^ (16*Z) * N ^ 7\"\n    using nlength_le_ZN[OF H_le_N] by simp\n  moreover have \"2 * nlength Z \\<le> 2 * 2 ^ (16*Z) * N ^ 7\"\n  proof -\n    have \"Z \\<le> N \"\n      using N_eq Z_def by simp\n    then show ?thesis\n      using nlength_le_ZN by simp\n  qed\n  moreover have \"3 * nlength T' \\<le> 3 * 2 ^ (16*Z) * N ^ 7\"\n    using nlength_le_ZN[OF le_N] by simp\n  moreover have \"80 \\<le> 80 * 2 ^ (16*Z) * N ^ 7\"\n    using N_ge_1 by simp\n  ultimately have \"ttt55 \\<le> ttt47 + 80 * 2 ^ (16*Z) * N ^ 7 + 3 * 2 ^ (16*Z) * N ^ 7 +\n      2 * 2 ^ (16*Z) * N ^ 7 + 2 * 2 ^ (16*Z) * N ^ 7 + 3 * 2 ^ (16*Z) * N ^ 7 +\n      2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') +\n      16114767 * 2 ^ (16 * Z) * N ^ 7\"\n    using ttt55_def by linarith\n  also have \"... = ttt47 + 2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') +\n      16114857 * 2 ^ (16 * Z) * N ^ 7\"\n    by simp\n  finally show ?thesis .\nqed\n\nlemma tm55 [transforms_intros]: \"transforms tm55 tps0 ttt55 tps55\"\n  unfolding tm55_def\nproof (tform)\n  show \"91 + 17 < length tps54\"\n    using lentpsJ tps54_def k by (simp_all only: length_list_update)\n  let ?nss = \"formula_n \\<Phi>\\<^sub>0 @ formula_n \\<Phi>\\<^sub>1 @ formula_n \\<Phi>\\<^sub>2 @ formula_n \\<Phi>\\<^sub>3 @ formula_n \\<Phi>\\<^sub>4 @\n       formula_n \\<Phi>\\<^sub>5 @ formula_n \\<Phi>\\<^sub>6 @ formula_n \\<Phi>\\<^sub>7 @ formula_n \\<Phi>\\<^sub>8\"\n  show \"tps54 ! 1 = nlltape ?nss\"\n    using tps54_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps54 ! 4 = (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1)\"\n    using tps54_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps54 ! 7 = (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1)\"\n    using tps54_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps54 ! 91 = (\\<lfloor>N\\<rfloor>\\<^sub>N, 1)\"\n    using tps54_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  have \"tps54 ! 92 = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    using tps54_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps54 ! (91 + 1) = (\\<lfloor>H\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps54 ! 93 = (\\<lfloor>Z\\<rfloor>\\<^sub>N, 1)\"\n    using tps54_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps54 ! (91 + 2) = (\\<lfloor>Z\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps54 ! 94 = (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1)\"\n    using tps54_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps54 ! (91 + 3) = (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  have \"tps54 ! 95 = (\\<lfloor>formula_n \\<psi>\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)\"\n    using tps54_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps54 ! (91 + 4) = (\\<lfloor>formula_n \\<psi>\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)\"\n    by simp\n  have \"tps54 ! 96 = (\\<lfloor>formula_n \\<psi>'\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)\"\n    using tps54_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps54 ! (91 + 5) = (\\<lfloor>formula_n \\<psi>'\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)\"\n    by simp\n  have \"tps54 ! 97 = (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)\"\n    using tps54_def k lentpsJ by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"tps54 ! (91 + 6) = (\\<lfloor>1\\<rfloor>\\<^sub>N, 1)\"\n    by simp\n  show \"tps54 ! (91 + i) = (\\<lfloor>[]\\<rfloor>, 1)\" if \"6 < i\" \"i < 17\" for i\n  proof -\n    have \"tps54 ! (91 + i) = tpsJ ! (91 + i)\"\n      using tps54_def that by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n    then show \"tps54 ! (91 + i) = (\\<lfloor>[]\\<rfloor>, 1)\"\n      using tpsJ k that by simp\n  qed\n  have \"tps55 = tps54\n      [1 := nlltape (formula_n PHI),\n       91 + 6 := (\\<lfloor>Suc T'\\<rfloor>\\<^sub>N, 1),\n       91 + 3 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)]\"\n    unfolding tps55_def tps54_def by (simp only: list_update_swap list_update_overwrite)\n  then show \"tps55 = tps54\n      [1 := nlltape (?nss @ formula_n (PHI9)),\n       91 + 6 := (\\<lfloor>Suc T'\\<rfloor>\\<^sub>N, 1),\n       91 + 3 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)]\"\n    using PHI_def formula_n_def by simp\n  show \"ttt55 = ttt47 + 80 + 3 * nlength N + 2 * nlength H + 2 * nlength Z +\n      3 * nlength T' + 2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') +\n      16114767 * 2 ^ (16 * Z) * N ^ 7\"\n    using ttt55_def by simp\nqed\n\nlemma tps0_start_config: \"(0, tps0) = start_config 110 xs\"\nproof\n  show \"fst (0, tps0) = fst (start_config 110 xs)\"\n    using start_config_def by simp\n  let ?tps = \"(\\<lambda>i. if i = 0 then \\<triangleright> else if i \\<le> length xs then xs ! (i - 1) else \\<box>, 0) #\n        replicate (110 - 1) (\\<lambda>i. if i = 0 then \\<triangleright> else \\<box>, 0)\"\n  have \"tps0 = ?tps\"\n  proof (rule nth_equalityI)\n    show \"length tps0 = length ?tps\"\n      using k by simp\n    show \"tps0 ! j = ?tps ! j\" if \"j < length tps0\" for j\n      using tps0 contents_def k that by (cases \"j = 0\") auto\n  qed\n  then show \"snd (0, tps0) = snd (start_config 110 xs)\"\n    using start_config_def by auto\nqed\n\nlemma tm55': \"snd (execute tm55 (start_config 110 xs) ttt55) = tps55\"\n  using tps0_start_config transforms_def transits_def tm55\n  by (smt (verit, best) execute_after_halting_ge prod.sel(1) prod.sel(2))\n\ndefinition \"tpsK \\<equiv> tpsJ\n  [91 := (\\<lfloor>N\\<rfloor>\\<^sub>N, 1),\n   92 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   93 := (\\<lfloor>Z\\<rfloor>\\<^sub>N, 1),\n   94 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   95 := (\\<lfloor>formula_n \\<psi>\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n   96 := (\\<lfloor>formula_n \\<psi>'\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n   97 := (\\<lfloor>1\\<rfloor>\\<^sub>N, 1),\n   91 + 6 := (\\<lfloor>Suc T'\\<rfloor>\\<^sub>N, 1),\n   91 + 3 := (\\<lfloor>0\\<rfloor>\\<^sub>N, 1)]\"\n\nlemma tpsK: \"97 < j \\<Longrightarrow> j < 110 \\<Longrightarrow> tpsK ! j = (\\<lfloor>[]\\<rfloor>, 1)\"\n  using tpsK_def tpsJ by simp\n\nlemma lentpsK: \"length tpsK = 110\"\n  using lentpsJ tpsK_def by simp\n\nlemma tps55: \"tps55 = tpsK\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n PHI)]\"\n  unfolding tps55_def tpsK_def by (simp only: list_update_swap)\n\ndefinition \"tps56 \\<equiv> tpsK\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma tm56 [transforms_intros]:\n  assumes \"ttt = ttt55 + tps55 :#: 1 + 2\"\n  shows \"transforms tm56 tps0 ttt tps56\"\n  unfolding tm56_def\nproof (tform)\n  show \"1 < length tps55\"\n    using lentpsJ tps55_def k by (simp_all only: length_list_update)\n  have *: \"tps55 ! 1 = nlltape (formula_n PHI)\"\n    using tps55 k lentpsK by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"clean_tape (tps55 ! 1)\"\n    using clean_tape_nllcontents by simp\n  have \"tps55 ! 1 |#=| 1 = (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)\"\n    using * by simp\n  then show \"tps56 = tps55[1 := tps55 ! 1 |#=| 1]\"\n    unfolding tps56_def tps55 by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt55 + (tps55 :#: 1 + 2)\"\n    using assms by simp\nqed\n\ndefinition \"tps57 \\<equiv> tpsK\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := nlltape (formula_n PHI),\n   109 := nlltape (formula_n PHI)]\"\n\nlemma tm57 [transforms_intros]:\n  assumes \"ttt = ttt55 + tps55 :#: 1 + 2 + Suc (nlllength (formula_n PHI))\"\n  shows \"transforms tm57 tps0 ttt tps57\"\n  unfolding tm57_def\nproof (tform)\n  show \"1 < length tps56\" \"109 < length tps56\"\n    using lentpsK tps56_def k by (simp_all only: length_list_update)\n  have *: \"tps56 ! 1 = (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)\"\n    using tps56_def k lentpsK by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  let ?n = \"nlllength (formula_n PHI)\"\n  show \"rneigh (tps56 ! 1) {0} ?n\"\n  proof (rule rneighI)\n    show \"(tps56 ::: 1) (tps56 :#: 1 + nlllength (formula_n PHI)) \\<in> {0}\"\n      using proper_symbols_numlistlist nllcontents_def * contents_outofbounds nlllength_def\n      by simp\n    have \"\\<And>n'. n' < ?n \\<Longrightarrow> (tps56 ::: 1) (1 + n') > 0\"\n      using proper_symbols_numlistlist nllcontents_def * contents_inbounds nlllength_def\n      by fastforce\n    then show \"\\<And>n'. n' < ?n \\<Longrightarrow> (tps56 ::: 1) (tps56 :#: 1 + n') \\<notin> {0}\"\n      using * by simp\n  qed\n  have \"tps56 ! 109 = tpsK ! 109\"\n    using tps56_def by (simp only: length_list_update nth_list_update_eq nth_list_update_neq)\n  then have **: \"tps56 ! 109 = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tpsK k by simp\n  have \"implant (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1) (\\<lfloor>[]\\<rfloor>, 1) ?n =\n    (\\<lfloor>[] @\n       take (nlllength (formula_n PHI))\n        (drop (1 - 1) (numlistlist (formula_n PHI)))\\<rfloor>,\n     Suc (length []) + nlllength (formula_n PHI))\"\n    using implant_contents[of 1 ?n \"numlistlist (formula_n PHI)\" \"[]\"] nlllength_def nllcontents_def\n    by simp\n  then have \"implant (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1) (\\<lfloor>[]\\<rfloor>, 1) ?n =\n     (\\<lfloor>take ?n (numlistlist (formula_n PHI))\\<rfloor>, Suc ?n)\"\n    by simp\n  also have \"... = (\\<lfloor>numlistlist (formula_n PHI)\\<rfloor>, Suc ?n)\"\n    using nlllength_def by simp\n  also have \"... = (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, Suc ?n)\"\n    using nllcontents_def by simp\n  finally have \"implant (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1) (\\<lfloor>[]\\<rfloor>, 1) ?n = (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, Suc ?n)\" .\n  then have \"implant (tps56 ! 1) (tps56 ! 109) ?n = (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, Suc ?n)\"\n    using * ** by simp\n  then have \"implant (tps56 ! 1) (tps56 ! 109) ?n = nlltape (formula_n PHI)\"\n    by simp\n  moreover have \"tps56 ! 1 |+| nlllength (formula_n PHI) = nlltape (formula_n PHI)\"\n    using * by simp\n  moreover have \"tps57 = tps56\n    [1 := nlltape (formula_n PHI),\n     109 := nlltape (formula_n PHI)]\"\n    unfolding tps57_def tps56_def by (simp only: list_update_swap[of 1] list_update_overwrite)\n  ultimately show \"tps57 = tps56\n    [1 := tps56 ! 1 |+| nlllength (formula_n PHI),\n     109 := implant (tps56 ! 1) (tps56 ! 109) (nlllength (formula_n PHI))]\"\n    by simp\n  show \"ttt = ttt55 + tps55 :#: 1 + 2 + Suc (nlllength (formula_n PHI))\"\n    using assms by simp\nqed\n\ndefinition \"tps58 \\<equiv> tpsK\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := (\\<lfloor>[]\\<rfloor>, 1),\n   109 := nlltape (formula_n PHI)]\"\n\nlemma tm58 [transforms_intros]:\n  assumes \"ttt = ttt55 + 9 + tps55 :#: 1 + 3 * nlllength (formula_n PHI) + tps57 :#: 1\"\n  shows \"transforms tm58 tps0 ttt tps58\"\n  unfolding tm58_def\nproof (tform)\n  show \"1 < length tps57\"\n    using lentpsK tps57_def k by (simp_all only: length_list_update)\n  let ?zs = \"numlistlist (formula_n PHI)\"\n  show \"proper_symbols ?zs\"\n    using proper_symbols_numlistlist by simp\n  have \"tps57 ! 1 = nlltape (formula_n PHI)\"\n    using tps57_def k lentpsK by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then have \"tps57 ! 1 = (\\<lfloor>numlistlist (formula_n PHI)\\<rfloor>, Suc (nlllength (formula_n PHI)))\"\n    using nlllength_def nllcontents_def by auto\n  then show \"tps57 ::: 1 = \\<lfloor>numlistlist (formula_n PHI)\\<rfloor>\"\n    by simp\n  show \"tps58 = tps57[1 := (\\<lfloor>[]\\<rfloor>, 1)]\"\n    unfolding tps58_def tps57_def by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt55 + tps55 :#: 1 + 2 + Suc (nlllength (formula_n PHI)) +\n      (tps57 :#: 1 + 2 * length (numlistlist (formula_n PHI)) + 6)\"\n    using assms nlllength_def by simp\nqed\n\ndefinition \"tps59 \\<equiv> tpsK\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := (\\<lfloor>[]\\<rfloor>, 1),\n   109 := (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)]\"\n\nlemma tm59 [transforms_intros]:\n  assumes \"ttt = ttt55 + 11 + tps55 :#: 1 + 3 * nlllength (formula_n PHI) + tps57 :#: 1 + tps58 :#: 109\"\n  shows \"transforms tm59 tps0 ttt tps59\"\n  unfolding tm59_def\nproof (tform)\n  show \"109 < length tps58\"\n    using lentpsK tps58_def k by (simp_all only: length_list_update)\n  have *: \"tps58 ! 109 = nlltape (formula_n PHI)\"\n    using tps58_def k lentpsK by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then show \"clean_tape (tps58 ! 109)\"\n    by (simp add: clean_tape_nllcontents)\n  have \"tps58 ! 109 |#=| 1 = (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1)\"\n    using * by simp\n  then show \"tps59 = tps58[109 := tps58 ! 109 |#=| 1]\"\n    unfolding tps59_def tps58_def by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt55 + 9 + tps55 :#: 1 + 3 * nlllength (formula_n PHI) + tps57 :#: 1 +\n      (tps58 :#: 109 + 2)\"\n    using assms by simp\nqed\n\ndefinition \"tps60 \\<equiv> tpsK\n  [11 := (\\<lfloor>n\\<rfloor>\\<^sub>N, 1),\n   15 := (\\<lfloor>p n\\<rfloor>\\<^sub>N, 1),\n   16 := (\\<lfloor>m\\<rfloor>\\<^sub>N, 1),\n   17 := (\\<lfloor>T'\\<rfloor>\\<^sub>N, 1),\n   4 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 0) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   7 := (\\<lfloor>map (\\<lambda>t. exc zs t <#> 1) [0..<Suc T']\\<rfloor>\\<^sub>N\\<^sub>L, 1),\n   18 := (\\<lfloor>m'\\<rfloor>\\<^sub>N, 1),\n   19 := (\\<lfloor>H\\<rfloor>\\<^sub>N, 1),\n   20 := (\\<lfloor>m' * H\\<rfloor>\\<^sub>N, 1),\n   1 := (\\<lfloor>[]\\<rfloor>, 1),\n   109 := (\\<lfloor>formula_n PHI\\<rfloor>\\<^sub>N\\<^sub>L\\<^sub>L, 1),\n   109 := (\\<lfloor>numlistlist (formula_n PHI)\\<rfloor>,\n       Suc (length (numlistlist (formula_n PHI)))),\n   1 := (\\<lfloor>binencode (numlistlist (formula_n PHI))\\<rfloor>,\n       Suc (2 * length (numlistlist (formula_n PHI))))]\"\n\nlemma tm60:\n  assumes \"ttt = ttt55 + 12 + tps55 :#: 1 + 12 * nlllength (formula_n PHI) + tps57 :#: 1 + tps58 :#: 109\"\n  shows \"transforms tm60 tps0 ttt tps60\"\n  unfolding tm60_def\nproof (tform)\n  show \"109 < length tps59\" \"1 < length tps59\"\n    using lentpsK tps59_def k by (simp_all only: length_list_update)\n  let ?zs = \"numlistlist (formula_n PHI)\"\n  show \"binencodable ?zs\"\n    using proper_symbols_numlistlist symbols_lt_numlistlist by fastforce\n  show \"tps59 ! 109 = (\\<lfloor>numlistlist (formula_n PHI)\\<rfloor>, 1)\"\n    using tps59_def k lentpsK nllcontents_def\n    by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps59 ! 1 = (\\<lfloor>[]\\<rfloor>, 1)\"\n    using tps59_def k lentpsK by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  show \"tps60 \\<equiv> tps59\n    [109 := (\\<lfloor>numlistlist (formula_n PHI)\\<rfloor>,\n        Suc (length (numlistlist (formula_n PHI)))),\n     1 := (\\<lfloor>binencode (numlistlist (formula_n PHI))\\<rfloor>,\n           Suc (2 * length (numlistlist (formula_n PHI))))]\"\n    unfolding tps60_def tps59_def by (simp only: list_update_swap list_update_overwrite)\n  show \"ttt = ttt55 + 11 + tps55 :#: 1 + 3 * nlllength (formula_n PHI) + tps57 :#: 1 +\n      tps58 :#: 109 + (9 * length (numlistlist (formula_n PHI)) + 1)\"\n    using assms nlllength_def by simp\nqed\n\ndefinition \"ttt60 \\<equiv> 16 * ttt55\"\n\nlemma tm60': \"transforms tm60 tps0 ttt60 tps60\"\nproof -\n  have tps55_head_1: \"tps55 :#: 1 \\<le> ttt55\"\n  proof -\n    have *: \"(1::nat) < 110\"\n      using k by simp\n    show ?thesis\n      using head_pos_le_time[OF tm55_tm *, of \"xs \" ttt55] tm55' k by simp\n  qed\n\n  let ?ttt = \"ttt55 + 12 + tps55 :#: 1 + 12 * nlllength (formula_n PHI) + tps57 :#: 1 + tps58 :#: 109\"\n  have 55: \"tps55 :#: 1 = Suc (nlllength (formula_n PHI))\"\n  proof -\n    have \"tps55 ! 1 = nlltape (formula_n PHI)\"\n      using tps55 k lentpsK by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n    then show ?thesis\n      by simp\n  qed\n  moreover have \"tps57 :#: 1 = Suc (nlllength (formula_n PHI))\"\n  proof -\n    have \"tps57 ! 1 = nlltape (formula_n PHI)\"\n      using tps57_def k lentpsK by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n    then show ?thesis\n      by simp\n  qed\n  moreover have \"tps58 :#: 109 = Suc (nlllength (formula_n PHI))\"\n  proof -\n    have \"tps58 ! 109 = nlltape (formula_n PHI)\"\n      using tps58_def k lentpsK by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n    then show ?thesis\n      by simp\n  qed\n  ultimately have \"?ttt = ttt55 + 12 + 3 * (Suc (nlllength (formula_n PHI))) + 12 * nlllength (formula_n PHI)\"\n    by simp\n  also have \"... = ttt55 + 15 + 15 * (nlllength (formula_n PHI))\"\n    by simp\n  also have \"... = ttt55 + 15 * (Suc (nlllength (formula_n PHI)))\"\n    by simp\n  also have \"... \\<le> ttt55 + 15 * ttt55\"\n    using tps55_head_1 55 by simp\n  also have \"... = 16 * ttt55\"\n    by simp\n  finally have \"?ttt \\<le> 16 * ttt55\" .\n  then show ?thesis\n    using tm60 transforms_monotone ttt60_def by simp\nqed\n\nlemma tm60_start_config: \"transforms tm60 (snd (start_config 110 (string_to_symbols x))) ttt60 tps60\"\n  using tm60' tps0_start_config by (metis prod.sel(2))\n\nend  (* context tps *)\n\nend  (* locale reduction_sat_x *)\n\ntext \\<open>\nThe time bound @{term ttt60} formally depends on the string $x$. But we need a bound\ndepending only on the length.\n\\<close>\n\ncontext reduction_sat\nbegin\n\ndefinition T60 :: \"nat \\<Rightarrow> nat\" where\n  \"T60 nn \\<equiv> reduction_sat_x.ttt60 M G p (replicate nn True)\"\n\nlemma T60:\n  fixes x :: string\n  shows \"T60 (length x) = reduction_sat_x.ttt60 M G p x\"\nproof -\n  interpret x: reduction_sat_x L M G T p x\n    by (simp add: reduction_sat_axioms reduction_sat_x.intro)\n\n  define tpsx :: \"tape list\" where \"tpsx = snd (start_config 110 (x.xs))\"\n  have x1: \"110 = length tpsx\"\n    using start_config_def tpsx_def by auto\n  have x2: \"tpsx ! 0 = (\\<lfloor>x.xs\\<rfloor>, 0)\"\n    using start_config_def tpsx_def by auto\n  have x3: \"\\<And>i. 0 < i \\<Longrightarrow> i < 110 \\<Longrightarrow> tpsx ! i = (\\<lfloor>[]\\<rfloor>, 0)\"\n    using start_config_def tpsx_def by auto\n\n  let ?y = \"replicate (length x) True\"\n  interpret y: reduction_sat_x L M G T p ?y\n    by (simp add: reduction_sat_axioms reduction_sat_x.intro)\n  define tpsy :: \"tape list\" where \"tpsy = snd (start_config 110 (y.xs))\"\n  have y1: \"110 = length tpsy\"\n    using start_config_def tpsy_def by auto\n  have y2: \"tpsy ! 0 = (\\<lfloor>y.xs\\<rfloor>, 0)\"\n    using start_config_def tpsy_def by auto\n  have y3: \"\\<And>i. 0 < i \\<Longrightarrow> i < 110 \\<Longrightarrow> tpsy ! i = (\\<lfloor>[]\\<rfloor>, 0)\"\n    using start_config_def tpsy_def by auto\n\n  have m: \"x.m = y.m\"\n    using x.m_def y.m_def by simp\n  have T': \"x.T' = y.T'\"\n    using x.T'_def y.T'_def m by simp\n  have m': \"x.m' = y.m'\"\n    using x.m'_def y.m'_def T' by simp\n  have N: \"x.N = y.N\"\n    using x.N_eq y.N_eq T' by simp\n\n  have \"x.ttt31 = y.ttt31\"\n    using x.ttt31_def[OF x1 x2 x3] y.ttt31_def[OF y1 y2 y3] T' m m' by simp\n  then have \"x.ttt47 = y.ttt47\"\n    using x.ttt47_def[OF x1 x2 x3] y.ttt47_def[OF y1 y2 y3] T' m m' by simp\n  then have \"x.ttt55 = y.ttt55\"\n    using x.ttt55_def[OF x1 x2 x3] y.ttt55_def[OF y1 y2 y3] T' m m' N by simp\n  then have \"x.ttt60 = y.ttt60\"\n    using x.ttt60_def[OF x1 x2 x3] y.ttt60_def[OF y1 y2 y3] by simp\n  then show \"T60 (length x) = reduction_sat_x.ttt60 M G p x\"\n  unfolding T60_def by simp\nqed\n\nlemma poly_T60: \"big_oh_poly T60\"\nproof -\n  define fN :: \"nat \\<Rightarrow> nat\" where\n    \"fN = (\\<lambda>nn. H * (2 * nn + 2 * p nn + 3 + TT (2 * nn + 2 * p nn + 2)))\"\n  define f where\n    \"f = (\\<lambda>nn. 16 * ((32 * d_polynomial p + 364343) * H ^ 6 * fN nn ^ 4 +\n      2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') + 16114857 * 2 ^ (16 * Z) * fN nn ^ 7))\"\n  have T60_upper: \"T60 nn \\<le> f nn\" for nn\n  proof -\n    define y where \"y = replicate nn True\"\n    then have leny: \"length y = nn\"\n      by simp\n    interpret y: reduction_sat_x _ _ _ _ _ y\n      by (simp add: reduction_sat_axioms reduction_sat_x.intro)\n    define tps0 :: \"tape list\" where \"tps0 = snd (start_config 110 y.xs)\"\n    have 1: \"110 = length tps0\"\n      using start_config_def tps0_def by auto\n    have 2: \"tps0 ! 0 = (\\<lfloor>y.xs\\<rfloor>, 0)\"\n      using start_config_def tps0_def by auto\n    have 3: \"\\<And>i. 0 < i \\<Longrightarrow> i < 110 \\<Longrightarrow> tps0 ! i = (\\<lfloor>[]\\<rfloor>, 0)\"\n      using start_config_def tps0_def by auto\n\n    have \"T60 nn = y.ttt60\"\n      by (simp add: y_def T60_def)\n    also have \"... \\<le> 16 * y.ttt55\"\n      using y.ttt60_def[OF 1 2 3] by simp\n    also have \"... \\<le> 16 * (y.ttt47 + 2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') + 16114857 * 2 ^ (16 * Z) * y.N ^ 7)\"\n      using y.ttt55[OF 1 2 3] by simp\n    also have \"... \\<le> 16 * ((32 * d_polynomial p + 364343) * H ^ 6 * y.N ^ 4 +\n        2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') + 16114857 * 2 ^ (16 * Z) * y.N ^ 7)\"\n      using y.ttt47[OF 1 2 3] by simp\n    also have \"... = 16 * ((32 * d_polynomial p + 364343) * H ^ 6 * fN nn ^ 4 +\n        2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') + 16114857 * 2 ^ (16 * Z) * fN nn ^ 7)\"\n    proof -\n      have \"y.N = fN nn\"\n        using y.N_eq y.T'_def y.m_def y_def fN_def by simp\n      then show ?thesis\n        by simp\n    qed\n    finally have \"T60 nn \\<le> 16 * ((32 * d_polynomial p + 364343) * H ^ 6 * fN nn ^ 4 +\n        2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') + 16114857 * 2 ^ (16 * Z) * fN nn ^ 7)\" .\n    then show ?thesis\n      using f_def by simp\n  qed\n\n  have *: \"big_oh_poly fN\"\n  proof -\n    have 5: \"big_oh_poly p\"\n      using big_oh_poly_polynomial[OF p] by simp\n    have 6: \"big_oh_poly TT\"\n      using T big_oh_poly_le TT_le by simp\n    have \"big_oh_poly (\\<lambda>nn. 2 * p nn + 2)\"\n      using 5 big_oh_poly_sum big_oh_poly_prod big_oh_poly_const\n      by presburger\n    moreover have \"big_oh_poly (\\<lambda>nn. 2 * nn)\"\n      using big_oh_poly_prod big_oh_poly_const big_oh_poly_id by simp\n    ultimately have \"big_oh_poly (\\<lambda>nn. 2 * nn + 2 * p nn + 2)\"\n      using big_oh_poly_sum by fastforce\n    then have \"big_oh_poly (TT \\<circ> (\\<lambda>nn. 2 * nn + 2 * p nn + 2))\"\n      using big_oh_poly_composition[OF _ 6] by simp\n    moreover have \"TT \\<circ> (\\<lambda>nn. 2 * nn + 2 * p nn + 2) = (\\<lambda>nn. TT (2 * nn + 2 * p nn + 2))\"\n      by auto\n    ultimately have \"big_oh_poly (\\<lambda>nn. TT (2 * nn + 2 * p nn + 2))\"\n      by simp\n    moreover have \"big_oh_poly (\\<lambda>nn. 2 * nn + 2 * p nn + 3)\"\n      using 5 big_oh_poly_prod big_oh_poly_const big_oh_poly_sum big_oh_poly_id by simp\n    ultimately have \"big_oh_poly (\\<lambda>nn. 2 * nn + 2 * p nn + 3 + TT (2 * nn + 2 * p nn + 2))\"\n      using big_oh_poly_sum by simp\n    then have \"big_oh_poly (\\<lambda>nn. H * (2 * nn + 2 * p nn + 3 + TT (2 * nn + 2 * p nn + 2)))\"\n      using big_oh_poly_prod big_oh_poly_const by simp\n    then show ?thesis\n      using fN_def by simp\n  qed\n  then have \"big_oh_poly (\\<lambda>n. fN n ^ 4)\"\n    using big_oh_poly_pow by simp\n  moreover have \"big_oh_poly (\\<lambda>n. (32 * d_polynomial p + 364343) * H ^ 6)\"\n    using big_oh_poly_prod big_oh_poly_const big_oh_poly_sum by simp\n  ultimately have \"big_oh_poly (\\<lambda>n. (32 * d_polynomial p + 364343) * H ^ 6 * fN n ^ 4)\"\n    using big_oh_poly_prod by simp\n  moreover have \"big_oh_poly (\\<lambda>n. 2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') + 16114857 * 2 ^ (16 * Z) * fN n ^ 7)\"\n    using big_oh_poly_pow * big_oh_poly_sum big_oh_poly_prod big_oh_poly_const\n    by simp\n  ultimately have \"big_oh_poly (\\<lambda>n. ((32 * d_polynomial p + 364343) * H ^ 6 * fN n ^ 4) +\n      (2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') + 16114857 * 2 ^ (16 * Z) * fN n ^ 7))\"\n    using big_oh_poly_sum by simp\n  moreover have \"(\\<lambda>n. ((32 * d_polynomial p + 364343) * H ^ 6 * fN n ^ 4) +\n      (2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') + 16114857 * 2 ^ (16 * Z) * fN n ^ 7)) =\n      (\\<lambda>n. (32 * d_polynomial p + 364343) * H ^ 6 * fN n ^ 4 +\n        2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') + 16114857 * 2 ^ (16 * Z) * fN n ^ 7)\"\n    by auto\n  ultimately have \"big_oh_poly (\\<lambda>n. (32 * d_polynomial p + 364343) * H ^ 6 * fN n ^ 4 +\n      2 * nlllength (formula_n \\<psi>) + 2 * nlllength (formula_n \\<psi>') + 16114857 * 2 ^ (16 * Z) * fN n ^ 7)\"\n    by simp\n  then have \"big_oh_poly f\"\n    using f_def big_oh_poly_prod big_oh_poly_const by blast\n  then show \"big_oh_poly T60\"\n    using T60_upper big_oh_poly_le by simp\nqed\n\ntext \\<open>\nThis is the function, in terms of bit strings, that maps $x$ to $\\Phi$.\n\\<close>\n\ndefinition freduce :: \"string \\<Rightarrow> string\" (\"f\\<^bsub>reduce\\<^esub>\") where\n  \"f\\<^bsub>reduce\\<^esub> x \\<equiv> formula_to_string (reduction_sat_x.PHI M G p x)\"\n\ntext \\<open>\nThe function $f_{reduce}$ many-one reduces $L$ to \\SAT{}.\n\\<close>\n\nlemma x_in_L: \"x \\<in> L \\<longleftrightarrow> f\\<^bsub>reduce\\<^esub> x \\<in> SAT\"\nproof\n  interpret x: reduction_sat_x\n    by (simp add: reduction_sat_axioms reduction_sat_x.intro)\n  show \"x \\<in> L \\<Longrightarrow> f\\<^bsub>reduce\\<^esub> x \\<in> SAT\"\n    using freduce_def SAT_def x.L_iff_satisfiable by auto\n  show \"f\\<^bsub>reduce\\<^esub> x \\<in> SAT \\<Longrightarrow> x \\<in> L\"\n  proof -\n    assume \"f\\<^bsub>reduce\\<^esub> x \\<in> SAT\"\n    then obtain phi where\n      phi: \"satisfiable phi\" \"f\\<^bsub>reduce\\<^esub> x = formula_to_string phi \"\n      using SAT_def freduce_def by auto\n\n    have \"formula_to_string (reduction_sat_x.PHI M G p x) = formula_to_string phi\"\n      using phi(2) freduce_def by simp\n    then have \"reduction_sat_x.PHI M G p x = phi\"\n      using formula_to_string_inj by simp\n    then have \"satisfiable (reduction_sat_x.PHI M G p x)\"\n      using phi(1) by simp\n    then show \"x \\<in> L\"\n      using x.L_iff_satisfiable by simp\n  qed\nqed\n\ntext \\<open>\nThe Turing machine @{const tm60} computes $f_{reduce}$ with time bound $T60$.\n\\<close>\n\nlemma computes_in_time_tm60: \"computes_in_time 110 tm60 f\\<^bsub>reduce\\<^esub> T60\"\nproof\n  fix x :: string\n\n  interpret x: reduction_sat_x _ _ _ _ _ x\n    by (simp add: reduction_sat_axioms reduction_sat_x.intro)\n\n  have \"binencodable (numlistlist (formula_n x.PHI))\"\n    by (metis One_nat_def Suc_1 Suc_leI le_refl proper_symbols_numlistlist symbols_lt_numlistlist)\n  then have *: \"bit_symbols (binencode (numlistlist (formula_n x.PHI)))\"\n    using bit_symbols_binencode by simp\n\n  define tps0 :: \"tape list\" where \"tps0 = snd (start_config 110 x.xs)\"\n  have 1: \"110 = length tps0\"\n    using start_config_def tps0_def by auto\n  have 2: \"tps0 ! 0 = (\\<lfloor>x.xs\\<rfloor>, 0)\"\n    using start_config_def tps0_def by auto\n  have 3: \"\\<And>i. 0 < i \\<Longrightarrow> i < 110 \\<Longrightarrow> tps0 ! i = (\\<lfloor>[]\\<rfloor>, 0)\"\n    using start_config_def tps0_def by auto\n  let ?tps = \"x.tps60 tps0\"\n  have \"length ?tps = 110\"\n    using x.tps60_def[OF 1 2 3] x.lentpsK[OF 1 2 3] by (simp_all only: length_list_update)\n  then have \"?tps ! 1 = (\\<lfloor>binencode (numlistlist (formula_n (x.PHI)))\\<rfloor>,\n      Suc (2 * length (numlistlist (formula_n x.PHI))))\"\n    using x.tps60_def[OF 1 2 3] by (simp only: length_list_update nth_list_update_neq nth_list_update_eq)\n  then have \"?tps ::: 1 = \\<lfloor>binencode (numlistlist (formula_n x.PHI))\\<rfloor>\"\n    by simp\n  also have \"... = string_to_contents (symbols_to_string (binencode (numlistlist (formula_n x.PHI))))\"\n    using bit_symbols_to_contents[OF *] by simp\n  also have \"... = string_to_contents (f\\<^bsub>reduce\\<^esub> x)\"\n    using freduce_def by auto\n  finally have **: \"?tps ::: 1 = string_to_contents (f\\<^bsub>reduce\\<^esub> x)\" .\n\n  have \"transforms tm60 tps0 x.ttt60 ?tps\"\n    using tps0_def x.tm60_start_config[OF 1 2 3] by simp\n  then have \"transforms tm60 (snd (start_config 110 x.xs)) (T60 (length x)) ?tps\"\n    using T60 tps0_def by simp\n\n  then show \"\\<exists>tps.\n      tps ::: 1 = string_to_contents (f\\<^bsub>reduce\\<^esub> x) \\<and>\n      transforms tm60 (snd (start_config 110 (string_to_symbols x))) (T60 (length x)) tps\"\n    using ** by auto\nqed\n\ntext \\<open>\nSince $T60$ is bounded by a polynomial, the previous three lemmas imply that $L$\nis polynomial-time many-one reducible to \\SAT{}.\n\\<close>\n\nlemma L_reducible_SAT: \"L \\<le>\\<^sub>p SAT\"\n  using reducible_def tm60_tm poly_T60 computes_in_time_tm60 x_in_L by fastforce\n\nend  (* locale reduction_sat *)\n\ntext \\<open>\nIn the locale @{locale reduction_sat} the language $L$ was chosen arbitrarily\nwith properties that we have proven $\\NP$ languages have. So we can now show\nthat \\SAT{} is $\\NP$-hard.\n\n\\null\n\\<close>\n\ntheorem NP_hard_SAT:\n  assumes \"L \\<in> \\<N>\\<P>\"\n  shows \"L \\<le>\\<^sub>p SAT\"\nproof -\n  obtain M G T p where\n    T: \"big_oh_poly T\" and\n    p: \"polynomial p\" and\n    tm_M: \"turing_machine 2 G M\" and\n    oblivious_M: \"oblivious M\" and\n    T_halt: \"\\<And>y. bit_symbols y \\<Longrightarrow> fst (execute M (start_config 2 y) (T (length y))) = length M\" and\n    cert: \"\\<And>x. x \\<in> L \\<longleftrightarrow> (\\<exists>u. length u = p (length x) \\<and> execute M (start_config 2 \\<langle>x; u\\<rangle>) (T (length \\<langle>x; u\\<rangle>)) <.> 1 = \\<one>)\"\n    using NP_imp_oblivious_2tape[OF assms] by metis\n\n  interpret red: reduction_sat L M G T p\n    using T p tm_M oblivious_M T_halt cert reduction_sat.intro by simp\n\n  show ?thesis\n    using red.L_reducible_SAT by simp\nqed\n\n\nsection \\<open>\\SAT{} is $\\NP$-complete\\label{s:complete}\\<close>\n\ntext \\<open>\nThe time has come to reap the fruits of our labor and show that \\SAT{} is\n$\\NP$-complete.\n\n\\null\n\\<close>\n\ntheorem NP_complete_SAT: \"NP_complete SAT\"\n  using NP_hard_SAT SAT_in_NP NP_complete_def by simp\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Cook_Levin/Reduction_TM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.3164892389779779}}
{"text": "section \"CRDT Specifications For Verification\"\ntheory crdt_specs_v\n  imports repliss_sem crdt_specs\nbegin\n\n\ntext \"The previous CRDT are not nice to work with when composed.\nThe problem is, that the specifications for maps and structs transform the context\npassed to embedded CRDTs.\nDuring this transformation the reverse direction is lost, so it is hard to reconstruct the original\ncalls from the calls in an embedded context.\nTherefore, we now use a different composition technique, where the mapping is explicitly passed down\ninto nested CRDTs.\"\n\ntext \"In the following type definition we have three type parameters:\n\n\\<^enum> op is the type of operations at the top level\n\\<^enum> opn is the type of nested operations, on which the specification works\n\\<^enum> res is the type of results \"\n\ntext_raw \\<open>\\DefineSnippet{ccrdtSpec}{\\<close>\ntype_synonym ('op, 'opn, 'res) cOperationResultSpec = \n        \"callId set                  \\<comment> \\<open>visible calls\\<close>\n      \\<Rightarrow> (callId \\<Rightarrow>'op)              \\<comment> \\<open>call information\\<close> \n      \\<Rightarrow> callId rel                  \\<comment> \\<open>happens-before\\<close>\n      \\<Rightarrow> ('opn \\<Rightarrow> 'op)               \\<comment> \\<open>mapping back\\<close>\n      \\<Rightarrow> 'res\n      \\<Rightarrow> bool\"\n\ntype_synonym ('op, 'opn, 'res) ccrdtSpec = \n        \"'opn \\<Rightarrow> ('op, 'opn, 'res) cOperationResultSpec\"\ntext_raw \\<open>}%EndSnippet\\<close>\n\n\n\ndefinition \n\"extract_op c_calls c \\<equiv> call_operation (the (c_calls c))\"\n\ntext \"The following function converts \"\n\ndefinition toplevel_spec :: \"('op, 'op, 'res) ccrdtSpec \\<Rightarrow>  ('op, 'res, 'a) operationContext_scheme \\<Rightarrow> callId set \\<Rightarrow> 'op \\<Rightarrow> 'res  \\<Rightarrow> bool\" where\n\"toplevel_spec S ctxt vis op  \\<equiv> S op vis (extract_op (calls ctxt)) (happensBefore ctxt) id\"\n\n\n\n\ntext \"There is a mapping between the composable CRDT specs above and the original specifications:\"\n\n\n\nlemma extract_op_def':\n\"extract_op (c_calls::('b \\<Rightarrow> ('a, 'c) call option)) c \n  = ( case c_calls c of Some (Call op r) \\<Rightarrow> op | _ \\<Rightarrow> call_operation (the (None :: ('a, 'c) call option)))\"\n  by (auto simp add: extract_op_def split: option.splits call.splits) \n\n\nlemma extract_op_eq:\n  assumes \"c\\<in>dom c_calls\"\n  shows \"extract_op c_calls c = oper \\<longleftrightarrow> (\\<exists>res. c_calls c \\<triangleq> Call oper res)\"\n  using assms by (auto simp add: extract_op_def' split: option.splits call.splits)\n\nlemma extract_op_eq':\n  assumes \"c\\<in>dom c_calls\"\n  shows \"extract_op c_calls c = oper \\<longleftrightarrow> (cOp c_calls c \\<triangleq> oper)\"\n  unfolding extract_op_eq[OF assms]\n  by (auto simp add: cOp_def)\n   (metis call.collapse)\n\n\n\n\n\nlemma calls_sub_context:\n  \"calls (sub_context C_in Cs ctxt) = \n(\\<lambda>c. (calls ctxt |` Cs) c \\<bind> (\\<lambda>call. case C_in (call_operation call) of None \\<Rightarrow> None | Some op' \\<Rightarrow> Some (Call op' (call_res call))))\n\"\n  by (auto simp add: sub_context_def restrict_ctxt_op_def restrict_ctxt_def fmap_map_values_def ctxt_restrict_calls_def \n      option_bind_def \n      split: option.splits call.splits)\n\nlemma happens_before_sub_context:\n  \"(x,y) \\<in> happensBefore (sub_context C_in Cs ctxt) \n\\<longleftrightarrow> ((x,y) \\<in> happensBefore ctxt \\<and> x\\<in>dom (calls (sub_context  C_in Cs ctxt)) \\<and> y\\<in>dom (calls (sub_context  C_in Cs ctxt)))\n\"\n  by (auto simp add: sub_context_def restrict_ctxt_op_def restrict_ctxt_def fmap_map_values_def\n ctxt_restrict_calls_def restrict_map_def restrict_relation_def option_bind_def \n split: if_splits option.splits call.splits)\n\n\nlemma dom_calls_sub_context_rewrite: \"(dom (map_map (calls ctxt) call_operation \\<ggreater> C_in) \\<inter> Cs)\n  = (dom (calls (sub_context C_in Cs ctxt)))\"\n  by (auto simp add: calls_sub_context option_bind_def map_chain_def restrict_map_def  split: option.splits if_splits)\n\n\n\nlemma extract_op_to_call:\n  assumes \"is_reverse C_in C_out\"\nand \"c\\<in>dom (calls (sub_context C_in Cs ctxt))\"\nshows \"extract_op (calls ctxt) c = C_out op\n\\<longleftrightarrow> (\\<exists>r. calls ctxt c \\<triangleq> Call (C_out op) r)\"\n  by (smt IntD2 assms(2) call.collapse call.sel(1) calls_sub_context domExists_simp domIff dom_calls_sub_context_rewrite extract_op_def is_none_bind is_none_simps(1) is_none_simps(2) option.sel restrict_in)\n\nlemma extract_op_into_sub_context:\n  assumes is_rev: \"is_reverse C_in C_out\"\nand in_dom: \"c\\<in>dom (calls (sub_context C_in Cs ctxt))\"\nshows \"extract_op (calls ctxt) c = C_out op\n\\<longleftrightarrow> (\\<exists>r. calls (sub_context C_in Cs ctxt) c \\<triangleq> Call op r)\"\n  using in_dom  by (auto simp add: calls_sub_context restrict_map_def option_bind_def\n call_operation_def extract_op_def is_rev is_reverse_2\n      split: option.splits if_splits call.splits)\n  (use is_rev is_reverse_1 in fastforce)\n\nlemma extract_op_into_sub_context':\n  assumes is_rev: \"is_reverse C_in C_out\"\nand in_dom: \"c\\<in>dom (calls (sub_context C_in Cs ctxt))\"\nshows \"extract_op (calls ctxt) c = C_out op\n\\<longleftrightarrow> Op (sub_context C_in Cs ctxt) c \\<triangleq> op\"\n  using extract_op_into_sub_context[OF is_rev in_dom] \n  by (auto simp add: cOp_def)\n   (metis call.collapse)\n\n\n\nlemma happens_before_into_sub_context:\n  assumes is_rev: \"is_reverse C_in C_out\"\nand in_dom_x: \"x\\<in>dom (calls (sub_context C_in Cs ctxt))\"\nand in_dom_y: \"y\\<in>dom (calls (sub_context C_in Cs ctxt))\"\nshows \"(x,y) \\<in> happensBefore ctxt\n\\<longleftrightarrow> (x,y) \\<in> happensBefore (sub_context C_in Cs ctxt)\"\n  using in_dom_x in_dom_y  by (auto simp add:  restrict_map_def option_bind_def\n call_operation_def extract_op_def is_rev is_reverse_2\n happens_before_sub_context\n      split: option.splits if_splits call.splits)\n\n\n\ntext_raw \\<open>\\DefineSnippet{crdt_spec_rel}{\\<close>\ndefinition crdt_spec_rel :: \"('opn, 'res) crdtSpec \\<Rightarrow> ('op, 'opn, 'res) ccrdtSpec \\<Rightarrow> bool\" where\n\"crdt_spec_rel spec cspec \\<equiv>                                                 \n\\<forall>C_in::'op \\<rightharpoonup> 'opn. \\<forall>C_out::'opn \\<Rightarrow> 'op.\n  is_reverse C_in C_out\n  \\<longrightarrow> \n  (\\<forall>ctxt (outer_op::'op) (op::'opn) r Cs. \n       C_in outer_op \\<triangleq> op\n    \\<longrightarrow> Cs \\<subseteq> (dom (calls ctxt))\n    \\<longrightarrow> operationContext_wf ctxt\n    \\<longrightarrow>\n       (spec op (sub_context C_in Cs ctxt) r\n    \\<longleftrightarrow> cspec op Cs (extract_op (calls ctxt))  (happensBefore ctxt) C_out r))\"\ntext_raw \\<open>}%EndSnippet\\<close>\n\n\nlemmas use_crdt_spec_rel = crdt_spec_rel_def[unfolded atomize_eq, THEN iffD1, rule_format]\nlemmas use_crdt_spec_rel1 = crdt_spec_rel_def[unfolded atomize_eq, THEN iffD1, rule_format, THEN iffD1]\nlemmas use_crdt_spec_rel2 = crdt_spec_rel_def[unfolded atomize_eq, THEN iffD1, rule_format, THEN iffD2]\n\nlemma use_crdt_spec_rel_toplevel:\n  assumes rel: \"crdt_spec_rel spec cspec\"\n    and wf: \"operationContext_wf ctxt\"\n  shows \"spec op ctxt r \n =  cspec op (dom (calls ctxt)) (extract_op (calls ctxt)) (happensBefore ctxt) id  r\"\nproof (fuzzy_rule use_crdt_spec_rel[OF rel])\n\n  have hb_wf: \"Field (happensBefore ctxt) \\<subseteq> dom (calls ctxt)\"\n    by (simp add: wf operationContext_wf_hb_field)\n\n\n  show \"is_reverse Some id\"\n    by (simp add: is_reverse_def)\n\n  show \"Some op \\<triangleq> op\"\n    by simp\n\n  show \"dom (calls ctxt) \\<subseteq> dom (calls ctxt)\"\n    by simp\n\n  have h1: \"calls (sub_context Some UNIV ctxt) =  calls ctxt \"\n    by (auto simp add: calls_sub_context)\n\n  have h2: \"happensBefore (sub_context Some UNIV ctxt) =  happensBefore ctxt \"\n    by (auto simp add: happens_before_sub_context calls_sub_context)\n      (meson FieldI1 FieldI2 domD hb_wf subsetD in_mono)+\n\n\n  from h1 h2\n  show \"sub_context Some (dom (calls ctxt)) ctxt = ctxt\"\n    by (simp add: ctxt_restrict_calls_def hb_wf restrict_map_noop restrict_relation_noop sub_context_def)\n\n  show \"operationContext_wf ctxt\" using `operationContext_wf ctxt` .\nqed\n\n\n\nlemma show_crdt_spec_rel:\n  assumes\n  a: \"\\<And>C_in C_out  ctxt outer_op op r Cs.\n\\<lbrakk>is_reverse C_in C_out; \noperationContext_wf ctxt;\n C_in outer_op \\<triangleq> op;\nCs \\<subseteq> dom (calls ctxt)\\<rbrakk> \\<Longrightarrow>\n     spec op (sub_context C_in Cs ctxt) r\n \\<longleftrightarrow> cspec op Cs (extract_op (calls ctxt))  (happensBefore ctxt) C_out  r \n\"\nshows \"crdt_spec_rel spec cspec\"\n  by (simp add: crdt_spec_rel_def assms dom_calls_sub_context_rewrite inf.absorb_iff2)\n\n\nlemma show_crdt_spec_rel':\n  assumes\n  a: \"\\<And>C_in C_out  ctxt outer_op op r Cs.\n\\<lbrakk>is_reverse C_in C_out; \noperationContext_wf ctxt;\n C_in outer_op \\<triangleq> op;\nCs \\<subseteq> dom (calls ctxt)\\<rbrakk> \\<Longrightarrow>\n     spec op (sub_context C_in Cs ctxt) r\n \\<longleftrightarrow> cspec op Cs (extract_op (calls ctxt))  (happensBefore ctxt) C_out  r \n\"\nshows \"crdt_spec_rel spec cspec\"\n  by (simp add: crdt_spec_rel_def assms dom_calls_sub_context_rewrite inf.absorb_iff2)\n\ndefinition convert_spec ::  \"('op, 'op, 'res) ccrdtSpec \\<Rightarrow> ('op, 'res) crdtSpec\" where\n\"convert_spec cspec op ctxt res \\<equiv> \n  cspec op (dom (calls ctxt)) (extract_op (calls ctxt)) (happensBefore ctxt) id  res\"\n\n\nlemma crdt_spec_rel_convert:\n  assumes rel: \"crdt_spec_rel spec cspec\"\n    and field: \"Field (happensBefore ctxt) \\<subseteq> dom (calls (ctxt))\"\n    and \"operationContext_wf ctxt\"\n  shows \"spec op ctxt r = convert_spec cspec op ctxt r\"\n  unfolding convert_spec_def\nproof -\n  show \"spec op ctxt r = cspec op (dom (calls ctxt)) (extract_op (calls ctxt)) (happensBefore ctxt) id  r\" \n  proof (fuzzy_rule use_crdt_spec_rel[OF rel])\n    show \"is_reverse Some id\"\n      by (simp add: is_reverse_def)\n    show \"Some op \\<triangleq> op\"\n      by simp\n    show \"dom (calls ctxt) \\<subseteq> dom (calls ctxt)\"\n      by (auto simp add: map_chain_def)\n    have h1: \"calls (sub_context Some UNIV ctxt) = calls ctxt \"\n      by (auto simp add: calls_sub_context)\n\n    have h2: \"happensBefore (sub_context Some UNIV ctxt) = happensBefore ctxt \"\n      using field by (auto simp add: happens_before_sub_context\n          FieldI1 FieldI2 h1 domD subset_h1)\n\n    from h1 h2\n    show \"sub_context Some (dom (calls ctxt)) ctxt = ctxt\"\n      by (simp add: ctxt_restrict_calls_def field restrict_map_noop restrict_relation_noop sub_context_def)\n\n\n    show \"operationContext_wf ctxt\"\n      by (simp add: assms)\n  qed\nqed\n\n\n\ndefinition ccrdtSpec_wf :: \"('op, 'opn, 'res) ccrdtSpec \\<Rightarrow> bool\" where\n\"ccrdtSpec_wf spec  \\<equiv> \n\\<forall>opr Cs Cs' op op' hb hb' C_out r. \nmap_same_on Cs' op op'\n\\<longrightarrow> rel_same_on Cs' hb hb'\n\\<longrightarrow> Cs' \\<subseteq> Cs\n\\<longrightarrow> (\\<forall>c\\<in>Cs. (\\<exists>y. C_out y = op c) \\<longrightarrow> c\\<in>Cs')\n\\<longrightarrow> (     spec opr Cs op  hb  C_out r \n     \\<longleftrightarrow>  spec opr Cs' op' hb' C_out r)\"\n\nlemmas use_ccrdtSpec_wf' = ccrdtSpec_wf_def[unfolded atomize_eq, THEN iffD1, rule_format]\nlemmas use_ccrdtSpec_wf'1 = use_ccrdtSpec_wf'[THEN iffD1]\nlemmas use_ccrdtSpec_wf'2 = use_ccrdtSpec_wf'[THEN iffD2]\n                                                                  \n\nlemma use_ccrdtSpec_wf:\n  assumes \"ccrdtSpec_wf spec\"\n    and \"map_same_on Cs op op'\"\n    and \"rel_same_on Cs hb hb'\"\n  shows \"spec opr Cs op hb C_out r = spec opr Cs op' hb' C_out r\"\n  using assms\n  by (rule use_ccrdtSpec_wf') auto\n\nlemmas use_ccrdtSpec_wf1 = use_ccrdtSpec_wf[THEN iffD1]\nlemmas use_ccrdtSpec_wf2 = use_ccrdtSpec_wf[THEN iffD2]\n\n\n\n\n\n\n\n\n\n\nend\n", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/crdt_specs_v.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3164892314358396}}
{"text": "(*  Title:      HOL/HOLCF/Powerdomains.thy\n    Author:     Brian Huffman\n*)\n\nsection \\<open>Powerdomains\\<close>\n\ntheory Powerdomains\nimports ConvexPD Domain\nbegin\n\nsubsection \\<open>Universal domain embeddings\\<close>\n\ndefinition \"upper_emb = udom_emb (\\<lambda>i. upper_map\\<cdot>(udom_approx i))\"\ndefinition \"upper_prj = udom_prj (\\<lambda>i. upper_map\\<cdot>(udom_approx i))\"\n\ndefinition \"lower_emb = udom_emb (\\<lambda>i. lower_map\\<cdot>(udom_approx i))\"\ndefinition \"lower_prj = udom_prj (\\<lambda>i. lower_map\\<cdot>(udom_approx i))\"\n\ndefinition \"convex_emb = udom_emb (\\<lambda>i. convex_map\\<cdot>(udom_approx i))\"\ndefinition \"convex_prj = udom_prj (\\<lambda>i. convex_map\\<cdot>(udom_approx i))\"\n\nlemma ep_pair_upper: \"ep_pair upper_emb upper_prj\"\n  unfolding upper_emb_def upper_prj_def\n  by (simp add: ep_pair_udom approx_chain_upper_map)\n\nlemma ep_pair_lower: \"ep_pair lower_emb lower_prj\"\n  unfolding lower_emb_def lower_prj_def\n  by (simp add: ep_pair_udom approx_chain_lower_map)\n\nlemma ep_pair_convex: \"ep_pair convex_emb convex_prj\"\n  unfolding convex_emb_def convex_prj_def\n  by (simp add: ep_pair_udom approx_chain_convex_map)\n\nsubsection \\<open>Deflation combinators\\<close>\n\ndefinition upper_defl :: \"udom defl \\<rightarrow> udom defl\"\n  where \"upper_defl = defl_fun1 upper_emb upper_prj upper_map\"\n\ndefinition lower_defl :: \"udom defl \\<rightarrow> udom defl\"\n  where \"lower_defl = defl_fun1 lower_emb lower_prj lower_map\"\n\ndefinition convex_defl :: \"udom defl \\<rightarrow> udom defl\"\n  where \"convex_defl = defl_fun1 convex_emb convex_prj convex_map\"\n\nlemma cast_upper_defl:\n  \"cast\\<cdot>(upper_defl\\<cdot>A) = upper_emb oo upper_map\\<cdot>(cast\\<cdot>A) oo upper_prj\"\nusing ep_pair_upper finite_deflation_upper_map\nunfolding upper_defl_def by (rule cast_defl_fun1)\n\nlemma cast_lower_defl:\n  \"cast\\<cdot>(lower_defl\\<cdot>A) = lower_emb oo lower_map\\<cdot>(cast\\<cdot>A) oo lower_prj\"\nusing ep_pair_lower finite_deflation_lower_map\nunfolding lower_defl_def by (rule cast_defl_fun1)\n\nlemma cast_convex_defl:\n  \"cast\\<cdot>(convex_defl\\<cdot>A) = convex_emb oo convex_map\\<cdot>(cast\\<cdot>A) oo convex_prj\"\nusing ep_pair_convex finite_deflation_convex_map\nunfolding convex_defl_def by (rule cast_defl_fun1)\n\nsubsection \\<open>Domain class instances\\<close>\n\ninstantiation upper_pd :: (\"domain\") \"domain\"\nbegin\n\ndefinition\n  \"emb = upper_emb oo upper_map\\<cdot>emb\"\n\ndefinition\n  \"prj = upper_map\\<cdot>prj oo upper_prj\"\n\ndefinition\n  \"defl (t::'a upper_pd itself) = upper_defl\\<cdot>DEFL('a)\"\n\ndefinition\n  \"(liftemb :: 'a upper_pd u \\<rightarrow> udom u) = u_map\\<cdot>emb\"\n\ndefinition\n  \"(liftprj :: udom u \\<rightarrow> 'a upper_pd u) = u_map\\<cdot>prj\"\n\ndefinition\n  \"liftdefl (t::'a upper_pd itself) = liftdefl_of\\<cdot>DEFL('a upper_pd)\"\n\ninstance proof\n  show \"ep_pair emb (prj :: udom \\<rightarrow> 'a upper_pd)\"\n    unfolding emb_upper_pd_def prj_upper_pd_def\n    by (intro ep_pair_comp ep_pair_upper ep_pair_upper_map ep_pair_emb_prj)\nnext\n  show \"cast\\<cdot>DEFL('a upper_pd) = emb oo (prj :: udom \\<rightarrow> 'a upper_pd)\"\n    unfolding emb_upper_pd_def prj_upper_pd_def defl_upper_pd_def cast_upper_defl\n    by (simp add: cast_DEFL oo_def cfun_eq_iff upper_map_map)\nqed (fact liftemb_upper_pd_def liftprj_upper_pd_def liftdefl_upper_pd_def)+\n\nend\n\ninstantiation lower_pd :: (\"domain\") \"domain\"\nbegin\n\ndefinition\n  \"emb = lower_emb oo lower_map\\<cdot>emb\"\n\ndefinition\n  \"prj = lower_map\\<cdot>prj oo lower_prj\"\n\ndefinition\n  \"defl (t::'a lower_pd itself) = lower_defl\\<cdot>DEFL('a)\"\n\ndefinition\n  \"(liftemb :: 'a lower_pd u \\<rightarrow> udom u) = u_map\\<cdot>emb\"\n\ndefinition\n  \"(liftprj :: udom u \\<rightarrow> 'a lower_pd u) = u_map\\<cdot>prj\"\n\ndefinition\n  \"liftdefl (t::'a lower_pd itself) = liftdefl_of\\<cdot>DEFL('a lower_pd)\"\n\ninstance proof\n  show \"ep_pair emb (prj :: udom \\<rightarrow> 'a lower_pd)\"\n    unfolding emb_lower_pd_def prj_lower_pd_def\n    by (intro ep_pair_comp ep_pair_lower ep_pair_lower_map ep_pair_emb_prj)\nnext\n  show \"cast\\<cdot>DEFL('a lower_pd) = emb oo (prj :: udom \\<rightarrow> 'a lower_pd)\"\n    unfolding emb_lower_pd_def prj_lower_pd_def defl_lower_pd_def cast_lower_defl\n    by (simp add: cast_DEFL oo_def cfun_eq_iff lower_map_map)\nqed (fact liftemb_lower_pd_def liftprj_lower_pd_def liftdefl_lower_pd_def)+\n\nend\n\ninstantiation convex_pd :: (\"domain\") \"domain\"\nbegin\n\ndefinition\n  \"emb = convex_emb oo convex_map\\<cdot>emb\"\n\ndefinition\n  \"prj = convex_map\\<cdot>prj oo convex_prj\"\n\ndefinition\n  \"defl (t::'a convex_pd itself) = convex_defl\\<cdot>DEFL('a)\"\n\ndefinition\n  \"(liftemb :: 'a convex_pd u \\<rightarrow> udom u) = u_map\\<cdot>emb\"\n\ndefinition\n  \"(liftprj :: udom u \\<rightarrow> 'a convex_pd u) = u_map\\<cdot>prj\"\n\ndefinition\n  \"liftdefl (t::'a convex_pd itself) = liftdefl_of\\<cdot>DEFL('a convex_pd)\"\n\ninstance proof\n  show \"ep_pair emb (prj :: udom \\<rightarrow> 'a convex_pd)\"\n    unfolding emb_convex_pd_def prj_convex_pd_def\n    by (intro ep_pair_comp ep_pair_convex ep_pair_convex_map ep_pair_emb_prj)\nnext\n  show \"cast\\<cdot>DEFL('a convex_pd) = emb oo (prj :: udom \\<rightarrow> 'a convex_pd)\"\n    unfolding emb_convex_pd_def prj_convex_pd_def defl_convex_pd_def cast_convex_defl\n    by (simp add: cast_DEFL oo_def cfun_eq_iff convex_map_map)\nqed (fact liftemb_convex_pd_def liftprj_convex_pd_def liftdefl_convex_pd_def)+\n\nend\n\nlemma DEFL_upper: \"DEFL('a::domain upper_pd) = upper_defl\\<cdot>DEFL('a)\"\nby (rule defl_upper_pd_def)\n\nlemma DEFL_lower: \"DEFL('a::domain lower_pd) = lower_defl\\<cdot>DEFL('a)\"\nby (rule defl_lower_pd_def)\n\nlemma DEFL_convex: \"DEFL('a::domain convex_pd) = convex_defl\\<cdot>DEFL('a)\"\nby (rule defl_convex_pd_def)\n\nsubsection \\<open>Isomorphic deflations\\<close>\n\nlemma isodefl_upper:\n  \"isodefl d t \\<Longrightarrow> isodefl (upper_map\\<cdot>d) (upper_defl\\<cdot>t)\"\napply (rule isodeflI)\napply (simp add: cast_upper_defl cast_isodefl)\napply (simp add: emb_upper_pd_def prj_upper_pd_def)\napply (simp add: upper_map_map)\ndone\n\nlemma isodefl_lower:\n  \"isodefl d t \\<Longrightarrow> isodefl (lower_map\\<cdot>d) (lower_defl\\<cdot>t)\"\napply (rule isodeflI)\napply (simp add: cast_lower_defl cast_isodefl)\napply (simp add: emb_lower_pd_def prj_lower_pd_def)\napply (simp add: lower_map_map)\ndone\n\nlemma isodefl_convex:\n  \"isodefl d t \\<Longrightarrow> isodefl (convex_map\\<cdot>d) (convex_defl\\<cdot>t)\"\napply (rule isodeflI)\napply (simp add: cast_convex_defl cast_isodefl)\napply (simp add: emb_convex_pd_def prj_convex_pd_def)\napply (simp add: convex_map_map)\ndone\n\nsubsection \\<open>Domain package setup for powerdomains\\<close>\n\nlemmas [domain_defl_simps] = DEFL_upper DEFL_lower DEFL_convex\nlemmas [domain_map_ID] = upper_map_ID lower_map_ID convex_map_ID\nlemmas [domain_isodefl] = isodefl_upper isodefl_lower isodefl_convex\n\nlemmas [domain_deflation] =\n  deflation_upper_map deflation_lower_map deflation_convex_map\n\nsetup \\<open>\n  fold Domain_Take_Proofs.add_rec_type\n    [(\\<^type_name>\\<open>upper_pd\\<close>, [true]),\n     (\\<^type_name>\\<open>lower_pd\\<close>, [true]),\n     (\\<^type_name>\\<open>convex_pd\\<close>, [true])]\n\\<close>\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/Powerdomains.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3164892314358396}}
{"text": "theory Fiction_Space\n  imports \"Phi_Semantics_Framework.Phi_Semantics_Framework\"\nbegin\n\nunspecified_type FIC \\<comment> \\<open>Deep representation of fictions\\<close>\ntype_synonym fiction_kind = \\<open>(FIC, resource) interp\\<close>\ntype_synonym fiction = \\<open>fiction_kind \\<Rightarrow> FIC\\<close>\ntype_synonym assn = \\<open>fiction set\\<close>\n\ndebt_axiomatization FIC_sort: \\<open>OFCLASS(FIC, sep_algebra_class)\\<close>\ninstance FIC :: sep_algebra using FIC_sort .\n\ndefinition INTERP :: \\<open>(fiction, resource) interp\\<close>\n  where \"INTERP = \\<F>_fun' id\"\n\n\n\ndefinition \"Fic_Space (f::fiction) \\<longleftrightarrow> finite (dom1 f)\"\n\ntext \\<open>Predicate \\<open>Fic_Space\\<close> characterizes instances of fictional spaces\n      --- the number of fiction kinds must be finite.\n      @{thm dom1_def}.\n      Recall unit \\<open>1\\<close> represents empty and none resource. In the case of \\<open>\\<alpha> option\\<close>,\n      \\<open>1 \\<triangleq> None\\<close>.\\<close>\n\nlemma Fic_Space_Un:\n  \\<open>a ## b \\<Longrightarrow> Fic_Space (a*b) \\<longleftrightarrow> Fic_Space a \\<and> Fic_Space b\\<close>\n  unfolding Fic_Space_def by (simp add: dom1_sep_mult_disjoint)\n\nlemma Fic_Space_1[simp]: \\<open>Fic_Space 1\\<close>\n  unfolding Fic_Space_def by simp\n\n\n\nclass fiction_kind = sep_algebra +\n  fixes FIC_inj :: \\<open>'a::sep_algebra \\<Rightarrow> FIC\\<close>\n    and FIC_prj :: \\<open>FIC \\<Rightarrow> 'a\\<close>\n  assumes \\<open>sep_inj_proj FIC_inj FIC_prj\\<close>\nbegin\n\nsublocale FK: sep_inj_proj FIC_inj FIC_prj\n  using fiction_kind_axioms[unfolded class.fiction_kind_def class.fiction_kind_axioms_def] by blast\n\nend\n\nterm FIC_inj\nthm FK.inject_inj\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nterm inject\n\nhide_const (open) inject project\n\ninterpretation xx: resource_kind_algebra name fiction_kind.inject fiction_kind.project\n\n\nend", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_System/Fiction_Space.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417487156366, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.31635556383251556}}
{"text": "(*  Title:      HOL/MicroJava/BV/LBVJVM.thy\n    Author:     Tobias Nipkow, Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nsection \\<open>LBV for the JVM \\label{sec:JVM}\\<close>\n\ntheory LBVJVM\nimports Typing_Framework_JVM\nbegin\n\ntype_synonym prog_cert = \"cname \\<Rightarrow> sig \\<Rightarrow> JVMType.state list\"\n\ndefinition check_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> JVMType.state list \\<Rightarrow> bool\" where\n  \"check_cert G mxs mxr n cert \\<equiv> check_types G mxs mxr cert \\<and> length cert = n+1 \\<and>\n                                 (\\<forall>i<n. cert!i \\<noteq> Err) \\<and> cert!n = OK None\"\n\ndefinition lbvjvm :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> exception_table \\<Rightarrow> \n             JVMType.state list \\<Rightarrow> instr list \\<Rightarrow> JVMType.state \\<Rightarrow> JVMType.state\" where\n  \"lbvjvm G maxs maxr rT et cert bs \\<equiv>\n  wtl_inst_list bs cert  (JVMType.sup G maxs maxr) (JVMType.le G maxs maxr) Err (OK None) (exec G maxs rT et bs) 0\"\n\ndefinition wt_lbv :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n             exception_table \\<Rightarrow> JVMType.state list \\<Rightarrow> instr list \\<Rightarrow> bool\" where\n  \"wt_lbv G C pTs rT mxs mxl et cert ins \\<equiv>\n   check_bounded ins et \\<and> \n   check_cert G mxs (1+size pTs+mxl) (length ins) cert \\<and>\n   0 < size ins \\<and> \n   (let start  = Some ([],(OK (Class C))#((map OK pTs))@(replicate mxl Err));\n        result = lbvjvm G mxs (1+size pTs+mxl) rT et cert ins (OK start)\n    in result \\<noteq> Err)\"\n\ndefinition wt_jvm_prog_lbv :: \"jvm_prog \\<Rightarrow> prog_cert \\<Rightarrow> bool\" where\n  \"wt_jvm_prog_lbv G cert \\<equiv>\n  wf_prog (\\<lambda>G C (sig,rT,(maxs,maxl,b,et)). wt_lbv G C (snd sig) rT maxs maxl et (cert C sig) b) G\"\n\ndefinition mk_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> exception_table \\<Rightarrow> instr list \n              \\<Rightarrow> method_type \\<Rightarrow> JVMType.state list\" where\n  \"mk_cert G maxs rT et bs phi \\<equiv> make_cert (exec G maxs rT et bs) (map OK phi) (OK None)\"\n\ndefinition prg_cert :: \"jvm_prog \\<Rightarrow> prog_type \\<Rightarrow> prog_cert\" where\n  \"prg_cert G phi C sig \\<equiv> let (C,rT,(maxs,maxl,ins,et)) = the (method (G,C) sig) in \n                           mk_cert G maxs rT et ins (phi C sig)\"\n \n  \nlemma wt_method_def2:\n  fixes pTs and mxl and G and mxs and rT and et and bs and phi \n  defines [simp]: \"mxr   \\<equiv> 1 + length pTs + mxl\"\n  defines [simp]: \"r     \\<equiv> sup_state_opt G\"\n  defines [simp]: \"app0  \\<equiv> \\<lambda>pc. app (bs!pc) G mxs rT pc et\"\n  defines [simp]: \"step0 \\<equiv> \\<lambda>pc. eff (bs!pc) G pc et\"\n\n  shows\n  \"wt_method G C pTs rT mxs mxl bs et phi = \n  (bs \\<noteq> [] \\<and> \n   length phi = length bs \\<and>\n   check_bounded bs et \\<and> \n   check_types G mxs mxr (map OK phi) \\<and>   \n   wt_start G C pTs mxl phi \\<and> \n   wt_app_eff r app0 step0 phi)\"\n  by (auto simp add: wt_method_def wt_app_eff_def wt_instr_def lesub_def\n           dest: check_bounded_is_bounded boundedD)\n\n\nlemma check_certD:\n  \"check_cert G mxs mxr n cert \\<Longrightarrow> cert_ok cert n Err (OK None) (states G mxs mxr)\"\n  apply (unfold cert_ok_def check_cert_def check_types_def)\n  apply (auto simp add: list_all_iff)\n  done\n\n\nlemma wt_lbv_wt_step:\n  assumes wf:  \"wf_prog wf_mb G\"\n  assumes lbv: \"wt_lbv G C pTs rT mxs mxl et cert ins\"\n  assumes C:   \"is_class G C\" \n  assumes pTs: \"set pTs \\<subseteq> types G\"\n  \n  defines [simp]: \"mxr \\<equiv> 1+length pTs+mxl\"\n\n  shows \"\\<exists>ts \\<in> list (size ins) (states G mxs mxr). \n            wt_step (JVMType.le G mxs mxr) Err (exec G mxs rT et ins) ts\n          \\<and> OK (Some ([],(OK (Class C))#((map OK pTs))@(replicate mxl Err))) <=_(JVMType.le G mxs mxr) ts!0\"\nproof -\n  let ?step = \"exec G mxs rT et ins\"\n  let ?r    = \"JVMType.le G mxs mxr\"\n  let ?f    = \"JVMType.sup G mxs mxr\"\n  let ?A    = \"states G mxs mxr\"\n\n  have \"semilat (JVMType.sl G mxs mxr)\" \n    by (rule semilat_JVM_slI, rule wf_prog_ws_prog, rule wf)\n  hence \"semilat (?A, ?r, ?f)\" by (unfold sl_triple_conv)\n  moreover\n  have \"top ?r Err\"  by (simp add: JVM_le_unfold)\n  moreover\n  have \"Err \\<in> ?A\" by (simp add: JVM_states_unfold)\n  moreover\n  have \"bottom ?r (OK None)\" \n    by (simp add: JVM_le_unfold bottom_def)\n  moreover\n  have \"OK None \\<in> ?A\" by (simp add: JVM_states_unfold)\n  moreover\n  from lbv\n  have \"bounded ?step (length ins)\" \n    by (clarsimp simp add: wt_lbv_def exec_def) \n       (intro bounded_lift check_bounded_is_bounded) \n  moreover\n  from lbv\n  have \"cert_ok cert (length ins) Err (OK None) ?A\" \n    by (unfold wt_lbv_def) (auto dest: check_certD)\n  moreover\n  from wf have \"pres_type ?step (length ins) ?A\" by (rule exec_pres_type)\n  moreover\n  let ?start = \"OK (Some ([],(OK (Class C))#(map OK pTs)@(replicate mxl Err)))\"\n  from lbv\n  have \"wtl_inst_list ins cert ?f ?r Err (OK None) ?step 0 ?start \\<noteq> Err\"\n    by (simp add: wt_lbv_def lbvjvm_def)    \n  moreover\n  from C pTs have \"?start \\<in> ?A\"\n    by (unfold JVM_states_unfold) (auto intro: list_appendI, force)\n  moreover\n  from lbv have \"0 < length ins\" by (simp add: wt_lbv_def)\n  ultimately\n  show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])\nqed\n  \nlemma wt_lbv_wt_method:\n  assumes wf:  \"wf_prog wf_mb G\"\n  assumes lbv: \"wt_lbv G C pTs rT mxs mxl et cert ins\"\n  assumes C:   \"is_class G C\" \n  assumes pTs: \"set pTs \\<subseteq> types G\"\n  \n  shows \"\\<exists>phi. wt_method G C pTs rT mxs mxl ins et phi\"\nproof -\n  let ?mxr   = \"1 + length pTs + mxl\"\n  let ?step  = \"exec G mxs rT et ins\"\n  let ?r     = \"JVMType.le G mxs ?mxr\"\n  let ?f     = \"JVMType.sup G mxs ?mxr\"\n  let ?A     = \"states G mxs ?mxr\"\n  let ?start = \"OK (Some ([],(OK (Class C))#(map OK pTs)@(replicate mxl Err)))\"\n  \n  from lbv have l: \"ins \\<noteq> []\" by (simp add: wt_lbv_def)\n  moreover\n  from wf lbv C pTs\n  obtain phi where \n    list:  \"phi \\<in> list (length ins) ?A\" and\n    step:  \"wt_step ?r Err ?step phi\" and    \n    start: \"?start <=_?r phi!0\" \n    by (blast dest: wt_lbv_wt_step)\n  from list have [simp]: \"length phi = length ins\" by simp\n  have \"length (map ok_val phi) = length ins\" by simp  \n  moreover\n  from l have 0: \"0 < length phi\" by simp\n  with step obtain phi0 where \"phi!0 = OK phi0\"\n    by (unfold wt_step_def) blast\n  with start 0\n  have \"wt_start G C pTs mxl (map ok_val phi)\"\n    by (simp add: wt_start_def JVM_le_Err_conv lesub_def)\n  moreover\n  from lbv  have chk_bounded: \"check_bounded ins et\"\n    by (simp add: wt_lbv_def)\n  moreover {\n    from list\n    have \"check_types G mxs ?mxr phi\"\n      by (simp add: check_types_def)\n    also from step\n    have [symmetric]: \"map OK (map ok_val phi) = phi\" \n      by (auto intro!: nth_equalityI simp add: wt_step_def)\n    finally have \"check_types G mxs ?mxr (map OK (map ok_val phi))\" .\n  }\n  moreover {  \n    let ?app = \"\\<lambda>pc. app (ins!pc) G mxs rT pc et\"\n    let ?eff = \"\\<lambda>pc. eff (ins!pc) G pc et\"\n\n    from chk_bounded\n    have \"bounded (err_step (length ins) ?app ?eff) (length ins)\"\n      by (blast dest: check_bounded_is_bounded boundedD intro: bounded_err_stepI)\n    moreover\n    from step\n    have \"wt_err_step (sup_state_opt G) ?step phi\"\n      by (simp add: wt_err_step_def JVM_le_Err_conv)\n    ultimately\n    have \"wt_app_eff (sup_state_opt G) ?app ?eff (map ok_val phi)\"\n      by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def)\n  }    \n  ultimately\n  have \"wt_method G C pTs rT mxs mxl ins et (map ok_val phi)\"\n    by - (rule wt_method_def2 [THEN iffD2], simp)\n  thus ?thesis ..\nqed\n\n\nlemma wt_method_wt_lbv:\n  assumes wf:  \"wf_prog wf_mb G\"\n  assumes wt:  \"wt_method G C pTs rT mxs mxl ins et phi\"\n  assumes C:   \"is_class G C\" \n  assumes pTs: \"set pTs \\<subseteq> types G\"\n  \n  defines [simp]: \"cert \\<equiv> mk_cert G mxs rT et ins phi\"\n\n  shows \"wt_lbv G C pTs rT mxs mxl et cert ins\"\nproof -\n  let ?mxr  = \"1 + length pTs + mxl\"\n  let ?step = \"exec G mxs rT et ins\"\n  let ?app  = \"\\<lambda>pc. app (ins!pc) G mxs rT pc et\"\n  let ?eff  = \"\\<lambda>pc. eff (ins!pc) G pc et\"\n  let ?r    = \"JVMType.le G mxs ?mxr\"\n  let ?f    = \"JVMType.sup G mxs ?mxr\"\n  let ?A    = \"states G mxs ?mxr\"\n  let ?phi  = \"map OK phi\"\n  let ?cert = \"make_cert ?step ?phi (OK None)\"\n\n  from wt have\n    0:          \"0 < length ins\" and\n    length:     \"length ins = length ?phi\" and\n    ck_bounded: \"check_bounded ins et\" and\n    ck_types:   \"check_types G mxs ?mxr ?phi\" and\n    wt_start:   \"wt_start G C pTs mxl phi\" and\n    app_eff:    \"wt_app_eff (sup_state_opt G) ?app ?eff phi\"\n    by (simp_all add: wt_method_def2)\n  \n  have \"semilat (JVMType.sl G mxs ?mxr)\" \n    by (rule semilat_JVM_slI) (rule wf_prog_ws_prog [OF wf])\n  hence \"semilat (?A, ?r, ?f)\" by (unfold sl_triple_conv)\n  moreover\n  have \"top ?r Err\"  by (simp add: JVM_le_unfold)\n  moreover\n  have \"Err \\<in> ?A\" by (simp add: JVM_states_unfold)\n  moreover\n  have \"bottom ?r (OK None)\" \n    by (simp add: JVM_le_unfold bottom_def)\n  moreover\n  have \"OK None \\<in> ?A\" by (simp add: JVM_states_unfold)\n  moreover\n  from ck_bounded\n  have bounded: \"bounded ?step (length ins)\" \n    by (clarsimp simp add: exec_def) \n       (intro bounded_lift check_bounded_is_bounded)\n  with wf\n  have \"mono ?r ?step (length ins) ?A\"\n    by (rule wf_prog_ws_prog [THEN exec_mono])\n  hence \"mono ?r ?step (length ?phi) ?A\" by (simp add: length)\n  moreover\n  from wf have \"pres_type ?step (length ins) ?A\" by (rule exec_pres_type)\n  hence \"pres_type ?step (length ?phi) ?A\" by (simp add: length)\n  moreover\n  from ck_types\n  have \"set ?phi \\<subseteq> ?A\" by (simp add: check_types_def) \n  hence \"\\<forall>pc. pc < length ?phi \\<longrightarrow> ?phi!pc \\<in> ?A \\<and> ?phi!pc \\<noteq> Err\" by auto\n  moreover \n  from bounded \n  have \"bounded (exec G mxs rT et ins) (length ?phi)\" by (simp add: length)\n  moreover\n  have \"OK None \\<noteq> Err\" by simp\n  moreover\n  from bounded length app_eff\n  have \"wt_err_step (sup_state_opt G) ?step ?phi\"\n    by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def)\n  hence \"wt_step ?r Err ?step ?phi\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  moreover \n  let ?start = \"OK (Some ([],(OK (Class C))#(map OK pTs)@(replicate mxl Err)))\"  \n  from 0 length have \"0 < length phi\" by auto\n  hence \"?phi!0 = OK (phi!0)\" by simp\n  with wt_start have \"?start <=_?r ?phi!0\"\n    by (clarsimp simp add: wt_start_def lesub_def JVM_le_Err_conv)\n  moreover\n  from C pTs have \"?start \\<in> ?A\"\n    by (unfold JVM_states_unfold) (auto intro: list_appendI, force)\n  moreover\n  have \"?start \\<noteq> Err\" by simp\n  moreover\n  note length \n  ultimately\n  have \"wtl_inst_list ins ?cert ?f ?r Err (OK None) ?step 0 ?start \\<noteq> Err\"\n    by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])\n  moreover\n  from 0 length have \"phi \\<noteq> []\" by auto\n  moreover\n  from ck_types\n  have \"check_types G mxs ?mxr ?cert\"\n    by (auto simp add: make_cert_def check_types_def JVM_states_unfold)\n  moreover\n  note ck_bounded 0 length\n  ultimately \n  show ?thesis \n    by (simp add: wt_lbv_def lbvjvm_def mk_cert_def \n      check_cert_def make_cert_def nth_append)\nqed  \n\n\n\ntheorem jvm_lbv_correct:\n  \"wt_jvm_prog_lbv G Cert \\<Longrightarrow> \\<exists>Phi. wt_jvm_prog G Phi\"\nproof -  \n  let ?Phi = \"\\<lambda>C sig. let (C,rT,(maxs,maxl,ins,et)) = the (method (G,C) sig) in \n              SOME phi. wt_method G C (snd sig) rT maxs maxl ins et phi\"\n    \n  assume \"wt_jvm_prog_lbv G Cert\"\n  hence \"wt_jvm_prog G ?Phi\"\n    apply (unfold wt_jvm_prog_def wt_jvm_prog_lbv_def)\n    apply (erule jvm_prog_lift)\n    apply (auto dest: wt_lbv_wt_method intro: someI)\n    done\n  thus ?thesis by blast\nqed\n\ntheorem jvm_lbv_complete:\n  \"wt_jvm_prog G Phi \\<Longrightarrow> wt_jvm_prog_lbv G (prg_cert G Phi)\"\n  apply (unfold wt_jvm_prog_def wt_jvm_prog_lbv_def)\n  apply (erule jvm_prog_lift)\n  apply (auto simp add: prg_cert_def intro: wt_method_wt_lbv)\n  done  \n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/MicroJava/BV/LBVJVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982315512489, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3163091199684811}}
{"text": "(*******************************************************************************\n\n  Project: Development of Security Protocols by Refinement\n\n  Module:   Key_establish/m1_keydist_iirn.thy (Isabelle/HOL 2016-1)\n  ID:       $Id: m1_keydist_inrn.thy 133854 2017-03-20 17:53:50Z csprenge $\n  Author:   Christoph Sprenger, ETH Zurich <sprenger@inf.ethz.ch>\n\n  Key distribution protocols\n  Level 1, 1st refinement: Abstract server-based key transport protocol with \n  initiator and responder roles. Provides non-injective server authentication \n  to the initiator and responder.\n\n  Copyright (c) 2009-2016 Christoph Sprenger\n  Licence: LGPL\n\n*******************************************************************************)\n\nsection \\<open>Abstract (n/n)-authenticated key transport (L1)\\<close>\n\ntheory m1_keydist_inrn imports m1_keydist \"../Refinement/a0i_agree\"\nbegin\n\ntext \\<open>We add authentication for the initiator and responder to the basic\nserver-based key transport protocol: \n\\begin{enumerate}\n\\item the initiator injectively agrees with the server on the key and some\nadditional data\n\\item the responder non-injectively agrees with the server on the key and \nsome additional data.\n\\end{enumerate}\nThe \"additional data\" is a parameter of this model.\\<close>\n\ndeclare option.split [split]\n(* declare option.split_asm [split] *)\n\n\n(******************************************************************************)\nsubsection \\<open>State\\<close>\n(******************************************************************************)\n\ntext \\<open>The state type remains the same, but in this model we will record\nnonces and timestamps in the run frame.\\<close>\n\ntype_synonym m1a_state = \"m1x_state\"\ntype_synonym m1a_obs = \"m1x_obs\"\n\ntype_synonym 'x m1a_pred = \"'x m1x_pred\"\ntype_synonym 'x m1a_trans = \"'x m1x_trans\"\n\n\ntext \\<open>We need some parameters regarding the list of freshness values\nstored by the server. These should be defined in further refinements.\\<close>\n\nconsts \n  is_len :: \"nat\"   \\<comment> \\<open>num of agreeing list elements for initiator-server\\<close>  \n  rs_len :: \"nat\"   \\<comment> \\<open>num of agreeing list elements for responder-server\\<close>\n\n\n(******************************************************************************)\nsubsection \\<open>Events\\<close>\n(******************************************************************************)\n\ndefinition         \\<comment> \\<open>by @{term \"A\"}, refines @{term \"m1x_step1\"}\\<close>\n  m1a_step1 :: \"[rid_t, agent, agent] \\<Rightarrow> 'x m1r_trans\"\nwhere\n  \"m1a_step1 \\<equiv> m1x_step1\"\n\ndefinition       \\<comment> \\<open>by @{term \"B\"}, refines @{term \"m1x_step2\"}\\<close>\n  m1a_step2 :: \"[rid_t, agent, agent] \\<Rightarrow> 'x m1r_trans\"\nwhere\n  \"m1a_step2 \\<equiv> m1x_step2\"\n\ndefinition       \\<comment> \\<open>by @{term \"Server\"}, refines @{term m1x_step3}\\<close>\n  m1a_step3 :: \"[rid_t, agent, agent, key, atom list] \\<Rightarrow> 'x m1r_trans\"\nwhere\n  \"m1a_step3 Rs A B Kab al \\<equiv> {(s, s1).\n     \\<comment> \\<open>guards:\\<close>\n     Rs \\<notin> dom (runs s) \\<and>                 \\<comment> \\<open>fresh run id\\<close>\n     Kab = sesK (Rs$sk) \\<and>                 \\<comment> \\<open>generate session key\\<close>\n\n     \\<comment> \\<open>actions:\\<close>\n     s1 = s\\<lparr> runs := (runs s)(Rs \\<mapsto> (Serv, [A, B], al)) \\<rparr>\n  }\"\n\ndefinition         \\<comment> \\<open>by @{text \"A\"}, refines @{term m1x_step4}\\<close>\n  m1a_step4 :: \"[rid_t, agent, agent, key, atom list] \\<Rightarrow> 'x m1a_trans\"\nwhere\n  \"m1a_step4 Ra A B Kab nla \\<equiv> {(s, s').\n     \\<comment> \\<open>guards:\\<close>\n     runs s Ra = Some (Init, [A, B], []) \\<and>\n     (Kab \\<notin> leak s \\<longrightarrow> (Kab, A) \\<in> azC (runs s)) \\<and>      \\<comment> \\<open>authorization guard\\<close>\n\n     \\<comment> \\<open>new guard for non-injective agreement with server on \\<open>(Kab, B, isl)\\<close>,\\<close>\n     \\<comment> \\<open>where \\<open>isl = take is_len nla\\<close>\\<close>\n     (A \\<notin> bad \\<longrightarrow> (\\<exists>Rs. Kab = sesK (Rs$sk) \\<and>\n        runs s Rs = Some (Serv, [A, B], take is_len nla))) \\<and>\n\n     \\<comment> \\<open>actions:\\<close>\n     s' = s\\<lparr> runs := (runs s)(Ra \\<mapsto> (Init, [A, B], aKey Kab # nla)) \\<rparr>\n  }\" \n\ndefinition         \\<comment> \\<open>by @{term \"B\"}, refines @{term m1x_step5}\\<close>\n  m1a_step5 :: \"[rid_t, agent, agent, key, atom list] \\<Rightarrow> 'x m1a_trans\"\nwhere\n  \"m1a_step5 Rb A B Kab nlb \\<equiv> {(s, s1). \n     \\<comment> \\<open>guards:\\<close>\n     runs s Rb = Some (Resp, [A, B], []) \\<and> \n     (Kab \\<notin> leak s \\<longrightarrow> (Kab, B) \\<in> azC (runs s)) \\<and>         \\<comment> \\<open>authorization guard\\<close>\n\n     \\<comment> \\<open>guard for non-injective agreement with server on \\<open>(Kab, A, rsl)\\<close>\\<close>\n     \\<comment> \\<open>where \\<open>rsl = take rs_len nlb\\<close>\\<close>\n     (B \\<notin> bad \\<longrightarrow> (\\<exists>Rs. Kab = sesK (Rs$sk) \\<and>\n        runs s Rs = Some (Serv, [A, B], take rs_len nlb))) \\<and>\n\n     \\<comment> \\<open>actions:\\<close>\n     s1 = s\\<lparr> runs := (runs s)(Rb \\<mapsto> (Resp, [A, B], aKey Kab # nlb)) \\<rparr>\n  }\"\n\ndefinition     \\<comment> \\<open>by attacker, refines @{term m1x_leak}\\<close>\n  m1a_leak :: \"rid_t \\<Rightarrow> 'x m1x_trans\"\nwhere\n  \"m1a_leak = m1x_leak\" \n\n\n(******************************************************************************)\nsubsection \\<open>Specification\\<close>\n(******************************************************************************)\n\ndefinition\n  m1a_init :: \"m1a_state set\"\nwhere\n  \"m1a_init \\<equiv> m1x_init\" \n\ndefinition \n  m1a_trans :: \"'x m1a_trans\" where\n  \"m1a_trans \\<equiv> (\\<Union>A B Ra Rb Rs Kab nls nla nlb.\n     m1a_step1 Ra A B \\<union>\n     m1a_step2 Rb A B \\<union>\n     m1a_step3 Rs A B Kab nls \\<union>\n     m1a_step4 Ra A B Kab nla \\<union>\n     m1a_step5 Rb A B Kab nlb \\<union>\n     m1a_leak Rs \\<union>\n     Id\n  )\"\n\ndefinition \n  m1a :: \"(m1a_state, m1a_obs) spec\" where\n  \"m1a \\<equiv> \\<lparr>\n     init = m1a_init,\n     trans = m1a_trans,\n     obs = id\n  \\<rparr>\" \n\nlemma init_m1a: \"init m1a = m1a_init\"\nby (simp add: m1a_def)\n\nlemma trans_m1a: \"trans m1a = m1a_trans\"\nby (simp add: m1a_def)\n\nlemma obs_m1a [simp]: \"obs m1a = id\"\nby (simp add: m1a_def)\n\nlemmas m1a_loc_defs = \n  m1a_def m1a_init_def m1a_trans_def\n  m1a_step1_def m1a_step2_def m1a_step3_def m1a_step4_def m1a_step5_def \n  m1a_leak_def\n\nlemmas m1a_defs = m1a_loc_defs m1x_defs\n\n\n(******************************************************************************)\nsubsection \\<open>Invariants\\<close>\n(******************************************************************************)\n\nsubsubsection \\<open>inv0: Finite domain\\<close>\n(*inv**************************************************************************)\n\ntext \\<open>There are only finitely many runs. This is needed to establish\nthe responder/initiator agreement.\\<close>\n\ndefinition \n  m1a_inv0_fin :: \"'x m1r_pred\"\nwhere\n  \"m1a_inv0_fin \\<equiv> {s. finite (dom (runs s))}\"\n\nlemmas m1a_inv0_finI = m1a_inv0_fin_def [THEN setc_def_to_intro, rule_format]\nlemmas m1a_inv0_finE [elim] = m1a_inv0_fin_def [THEN setc_def_to_elim, rule_format]\nlemmas m1a_inv0_finD = m1a_inv0_fin_def [THEN setc_def_to_dest, rule_format]\n\ntext \\<open>Invariance proof.\\<close>\n\nlemma PO_m1a_inv0_fin_init [iff]:\n  \"init m1a \\<subseteq> m1a_inv0_fin\"\nby (auto simp add: m1a_defs intro!: m1a_inv0_finI)\n\n\n\nlemma PO_m1a_inv0_fin [iff]: \"reach m1a \\<subseteq> m1a_inv0_fin\"\nby (rule inv_rule_incr, auto del: subsetI)\n\n\n(******************************************************************************)\nsubsection \\<open>Refinement of \\<open>m1x\\<close>\\<close>\n(******************************************************************************)\n\nsubsubsection \\<open>Simulation relation\\<close>\n(******************************************************************************)\n\ntext \\<open>Define run abstraction.\\<close>\n\nfun \n  rm1x1a :: \"role_t \\<Rightarrow> atom list \\<Rightarrow> atom list\"\nwhere\n  \"rm1x1a Init = take 1\"         \\<comment> \\<open>take \\<open>Kab\\<close> from \\<open>Kab # nla\\<close>\\<close>\n| \"rm1x1a Resp = take 1\"         \\<comment> \\<open>take \\<open>Kab\\<close> from \\<open>Kab # nlb\\<close>\\<close>\n| \"rm1x1a Serv = take 0\"         \\<comment> \\<open>drop all from \\<open>nls\\<close>\\<close>\n\nabbreviation\n  runs1x1a :: \"runs_t \\<Rightarrow> runs_t\" where \n  \"runs1x1a \\<equiv> map_runs rm1x1a\"\n\ntext \\<open>med1x1: The mediator function maps a concrete observation to an \nabstract one.\\<close>\n\ndefinition\n  med1x1a :: \"m1a_obs \\<Rightarrow> m1x_obs\" where\n  \"med1x1a t \\<equiv> \\<lparr> runs = runs1x1a (runs t), leak = leak t \\<rparr>\"\n\ntext \\<open>R1x1a: The simulation relation is defined in terms of the mediator\nfunction.\\<close>\n\ndefinition\n  R1x1a :: \"(m1x_state \\<times> m1a_state) set\" where\n  \"R1x1a \\<equiv> {(s, t). s = med1x1a t}\"\n\nlemmas R1x1a_defs = \n  R1x1a_def med1x1a_def \n\n\nsubsubsection \\<open>Refinement proof\\<close>\n(******************************************************************************)\n\nlemma PO_m1a_step1_refines_m1x_step1:\n  \"{R1x1a} \n     (m1x_step1 Ra A B), (m1a_step1 Ra A B) \n   {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs)\n\nlemma PO_m1a_step2_refines_m1x_step2:\n  \"{R1x1a} \n     (m1x_step2 Rb A B), (m1a_step2 Rb A B) \n   {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs)\n\nlemma PO_m1a_step3_refines_m1x_step3:\n  \"{R1x1a} \n     (m1x_step3 Rs A B Kab), (m1a_step3 Rs A B Kab nls)\n   {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs)\n\nlemma PO_m1a_step4_refines_m1x_step4:\n  \"{R1x1a} \n     (m1x_step4 Ra A B Kab), (m1a_step4 Ra A B Kab nla) \n   {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs map_runs_def)\n\nlemma PO_m1a_step5_refines_m1x_step5:\n  \"{R1x1a} \n     (m1x_step5 Rb A B Kab), (m1a_step5 Rb A B Kab nlb) \n   {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs map_runs_def)\n\nlemma PO_m1a_leak_refines_m1x_leak:\n  \"{R1x1a} \n     (m1x_leak Rs), (m1a_leak Rs) \n   {> R1x1a}\"\nby (auto simp add: PO_rhoare_defs R1x1a_defs m1a_defs map_runs_def)\n\n\ntext \\<open>All together now...\\<close>\n\nlemmas PO_m1a_trans_refines_m1x_trans = \n  PO_m1a_step1_refines_m1x_step1 PO_m1a_step2_refines_m1x_step2\n  PO_m1a_step3_refines_m1x_step3 PO_m1a_step4_refines_m1x_step4\n  PO_m1a_step5_refines_m1x_step5 PO_m1a_leak_refines_m1x_leak\n\n\nlemma PO_m1a_refines_init_m1x [iff]:\n  \"init m1a \\<subseteq>  R1x1a``(init m1x)\"\nby (auto simp add: R1x1a_defs m1a_defs)\n\nlemma PO_m1a_refines_trans_m1x [iff]:\n  \"{R1x1a} \n     (trans m1x), (trans m1a) \n   {> R1x1a}\"\napply (auto simp add: m1a_def m1a_trans_def m1x_def m1x_trans_def\n         intro!: PO_m1a_trans_refines_m1x_trans)\napply (force intro!: PO_m1a_trans_refines_m1x_trans)+\ndone\n\ntext \\<open>Observation consistency.\\<close>\n\nlemma obs_consistent_med1x1a [iff]: \n  \"obs_consistent R1x1a med1x1a m1x m1a\"\nby (auto simp add: obs_consistent_def R1x1a_def m1a_defs)\n\n\ntext \\<open>Refinement result.\\<close>\n\nlemma PO_m1a_refines_m1x [iff]: \n  \"refines R1x1a med1x1a m1x m1a\"\nby (rule Refinement_basic) (auto del: subsetI)\n\nlemma  m1a_implements_m1x [iff]: \"implements med1x1a m1x m1a\"\nby (rule refinement_soundness) (fast)\n\n\n(******************************************************************************)\nsubsection \\<open>Refinement of \\<open>a0n\\<close> for initiator/server\\<close>\n(******************************************************************************)\n\ntext \\<open>For the initiator, we get an non-injective agreement with the server on \nthe session key, the responder name, and the atom list @{term \"isl\"}.\\<close>\n\n\nsubsubsection \\<open>Simulation relation\\<close>\n(******************************************************************************)\n\ntext \\<open>We define two auxiliary functions to reconstruct the signals of the\ninitial model from completed initiator and server runs.\\<close>\n\ntype_synonym\n  issig = \"key \\<times> agent \\<times> atom list\"\n\nabbreviation\n  is_commit :: \"[runs_t, agent, agent, key, atom list] \\<Rightarrow> rid_t set\" \nwhere\n  \"is_commit runz A B Kab sl \\<equiv> {Ra. \\<exists>nla. \n     runz Ra = Some (Init, [A, B], aKey Kab # nla) \\<and> take is_len nla = sl\n  }\"\n\nfun\n  is_runs2sigs :: \"runs_t \\<Rightarrow> issig signal \\<Rightarrow> nat\"\nwhere\n  \"is_runs2sigs runz (Running [A, Sv] (Kab, B, sl)) = \n     (if \\<exists>Rs nls. Kab = sesK (Rs$sk) \\<and> \n         runz Rs = Some (Serv, [A, B], nls) \\<and> take is_len nls = sl\n      then 1 else 0)\"\n\n| \"is_runs2sigs runz (Commit [A, Sv] (Kab, B, sl)) = \n     card (is_commit runz A B Kab sl)\"\n\n| \"is_runs2sigs runz _ = 0\"\n\n\ntext \\<open>Simulation relation and mediator function. We map completed initiator \nand responder runs to commit and running signals, respectively.\\<close>\n\ndefinition \n  med_a0m1a_is :: \"m1a_obs \\<Rightarrow> issig a0i_obs\" where\n  \"med_a0m1a_is o1 \\<equiv> \\<lparr> signals = is_runs2sigs (runs o1), corrupted = {} \\<rparr>\"\n\ndefinition\n  R_a0m1a_is :: \"(issig a0i_state \\<times> m1a_state) set\" where\n  \"R_a0m1a_is \\<equiv> {(s, t). signals s = is_runs2sigs (runs t) \\<and> corrupted s = {} }\"\n\nlemmas R_a0m1a_is_defs = R_a0m1a_is_def med_a0m1a_is_def \n\n\nsubsubsection \\<open>Lemmas about the auxiliary functions\\<close>\n(******************************************************************************)\n\nlemma is_runs2sigs_empty [simp]: \n  \"runz = Map.empty \\<Longrightarrow> is_runs2sigs runz = (\\<lambda>s. 0)\"\nby (rule ext, erule rev_mp) \n   (rule is_runs2sigs.induct, auto)\n\nlemma is_commit_finite [simp, intro]:\n  \"finite (dom runz) \\<Longrightarrow> finite (is_commit runz A B Kab nls)\"\nby (auto intro: finite_subset dest: dom_lemmas)\n\n\ntext \\<open>Update lemmas\\<close>\n\nlemma is_runs2sigs_upd_init_none [simp]:\n  \"\\<lbrakk> Ra \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> is_runs2sigs (runz(Ra \\<mapsto> (Init, [A, B], []))) = is_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n   (rule is_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma is_runs2sigs_upd_resp_none [simp]:\n  \"\\<lbrakk> Rb \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> is_runs2sigs (runz(Rb \\<mapsto> (Resp, [A, B], []))) = is_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n   (rule is_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma is_runs2sigs_upd_serv [simp]:\n  \"\\<lbrakk> Rs \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> is_runs2sigs (runz(Rs \\<mapsto> (Serv, [A, B], nls))) = \n     (is_runs2sigs runz)(Running [A, Sv] (sesK (Rs$sk), B, take is_len nls) := 1)\"\nby (rule ext, erule rev_mp) \n   (rule is_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma is_runs2sigs_upd_init_some [simp]:\n  \"\\<lbrakk> runz Ra = Some (Init, [A, B], []); finite (dom runz); \n     ils = take is_len nla \\<rbrakk>\n  \\<Longrightarrow> is_runs2sigs (runz(Ra \\<mapsto> (Init, [A, B], aKey Kab # nla))) =\n     (is_runs2sigs runz)(\n        Commit [A, Sv] (Kab, B, ils) := \n          Suc (card (is_commit runz A B Kab ils)))\"\napply (rule ext, erule rev_mp, erule rev_mp, erule rev_mp)\napply (rename_tac s)\napply (rule_tac ?a0.0=runz and ?a1.0=s in is_runs2sigs.induct, auto)\n\\<comment> \\<open>1 subgoal\\<close>\napply (rename_tac runz)\napply (rule_tac s=\"card (insert Ra (is_commit runz A B Kab (take is_len nla)))\" \n      in trans, fast, auto)\ndone\n\nlemma is_runs2sigs_upd_resp_some [simp]:\n  \"\\<lbrakk> runz Rb = Some (Resp, [A, B], []) \\<rbrakk>\n  \\<Longrightarrow> is_runs2sigs (runz(Rb \\<mapsto> (Resp, [A, B], aKey Kab # nlb))) =\n     is_runs2sigs runz\" \nby (rule ext, erule rev_mp)\n   (rule is_runs2sigs.induct, auto dest: dom_lemmas)  \n\n\nsubsubsection \\<open>Refinement proof\\<close>\n(******************************************************************************)\n\nlemma PO_m1a_step1_refines_a0_is_skip:\n  \"{R_a0m1a_is} \n     Id, (m1a_step1 Ra A B) \n   {> R_a0m1a_is}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_is_defs m1a_defs)\n\nlemma PO_m1a_step2_refines_a0_is_skip:\n  \"{R_a0m1a_is} \n     Id, (m1a_step2 Rb A B) \n   {> R_a0m1a_is}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_is_defs m1a_defs)\n\nlemma PO_m1a_step3_refines_a0_is_running:\n  \"{R_a0m1a_is} \n     (a0n_running [A, Sv] (Kab, B, take is_len nls)), \n     (m1a_step3 Rs A B Kab nls) \n   {> R_a0m1a_is}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_is_defs a0i_defs m1a_defs\n         dest: dom_lemmas)\n\nlemma PO_m1a_step4_refines_a0_is_commit:\n  \"{R_a0m1a_is \\<inter> UNIV \\<times> m1a_inv0_fin} \n     (a0n_commit [A, Sv] (Kab, B, take is_len nla)), \n     (m1a_step4 Ra A B Kab nla) \n   {> R_a0m1a_is}\"\nby (simp add: PO_rhoare_defs R_a0m1a_is_defs a0i_defs m1a_defs, safe, auto)\n\nlemma PO_m1a_step5_refines_a0_is_skip:\n  \"{R_a0m1a_is} \n     Id, (m1a_step5 Rb A B Kab nlb) \n   {> R_a0m1a_is}\"\nby (simp add: PO_rhoare_defs R_a0m1a_is_defs m1a_defs, safe, auto)\n\nlemma PO_m1a_leak_refines_a0_is_skip:\n  \"{R_a0m1a_is} \n     Id, (m1a_leak Rs) \n   {> R_a0m1a_is}\"\nby (simp add: PO_rhoare_defs R_a0m1a_is_defs m1a_defs, safe, auto)\n\n\ntext \\<open>All together now...\\<close>\n\nlemmas PO_m1a_trans_refines_a0_is_trans = \n  PO_m1a_step1_refines_a0_is_skip PO_m1a_step2_refines_a0_is_skip\n  PO_m1a_step3_refines_a0_is_running PO_m1a_step4_refines_a0_is_commit\n  PO_m1a_step5_refines_a0_is_skip PO_m1a_leak_refines_a0_is_skip\n  \n\nlemma PO_m1a_refines_init_a0_is [iff]:\n  \"init m1a \\<subseteq>  R_a0m1a_is``(init a0n)\"\nby (auto simp add: R_a0m1a_is_defs a0n_defs m1a_defs)\n\nlemma PO_m1a_refines_trans_a0_is [iff]:\n  \"{R_a0m1a_is \\<inter> UNIV \\<times> m1a_inv0_fin} \n     (trans a0n), (trans m1a) \n   {> R_a0m1a_is}\"\nby (auto simp add: m1a_def m1a_trans_def a0n_def a0n_trans_def\n         intro!: PO_m1a_trans_refines_a0_is_trans)\n\nlemma obs_consistent_med_a0m1a_is [iff]: \n  \"obs_consistent R_a0m1a_is med_a0m1a_is a0n m1a\"\nby (auto simp add: obs_consistent_def R_a0m1a_is_def med_a0m1a_is_def \n                   a0n_def m1a_def)\n\ntext \\<open>Refinement result.\\<close>\n\nlemma PO_m1a_refines_a0_is [iff]: \n  \"refines (R_a0m1a_is \\<inter> UNIV \\<times> m1a_inv0_fin) med_a0m1a_is a0n m1a\"\nby (rule Refinement_using_invariants) (auto del: subsetI)\n\nlemma  m1a_implements_a0_is: \"implements med_a0m1a_is a0n m1a\"\nby (rule refinement_soundness) (fast)\n\n\n(******************************************************************************)\nsubsection \\<open>Refinement of \\<open>a0n\\<close> for responder/server\\<close>\n(******************************************************************************)\n\ntext \\<open>For the responder, we get a non-injective agreement with the server on \nthe session key, the initiator's name, and additional data.\\<close>\n\n\nsubsubsection \\<open>Simulation relation\\<close>\n(******************************************************************************)\n\ntext \\<open>We define two auxiliary functions to reconstruct the signals of the\ninitial model from completed responder and server runs.\\<close>\n\ntype_synonym\n  rssig = \"key \\<times> agent \\<times> atom list\"\n\nabbreviation\n  rs_commit :: \"[runs_t, agent, agent, key, atom list] \\<Rightarrow> rid_t set\" \nwhere\n  \"rs_commit runz A B Kab rsl \\<equiv> {Rb. \\<exists>nlb. \n     runz Rb = Some (Resp, [A, B], aKey Kab # nlb) \\<and> take rs_len nlb = rsl \n  }\"\n\nfun\n  rs_runs2sigs :: \"runs_t \\<Rightarrow> rssig signal \\<Rightarrow> nat\"\nwhere\n  \"rs_runs2sigs runz (Running [B, Sv] (Kab, A, rsl)) = \n     (if \\<exists>Rs nls. Kab = sesK (Rs$sk) \\<and>\n         runz Rs = Some (Serv, [A, B], nls) \\<and> take rs_len nls = rsl\n      then 1 else 0)\"\n\n| \"rs_runs2sigs runz (Commit [B, Sv] (Kab, A, rsl)) = \n     card (rs_commit runz A B Kab rsl)\"\n\n| \"rs_runs2sigs runz _ = 0\"\n\n\ntext \\<open>Simulation relation and mediator function. We map completed initiator \nand responder runs to commit and running signals, respectively.\\<close>\n\ndefinition \n  med_a0m1a_rs :: \"m1a_obs \\<Rightarrow> rssig a0n_obs\" where\n  \"med_a0m1a_rs o1 \\<equiv> \\<lparr> signals = rs_runs2sigs (runs o1), corrupted = {} \\<rparr>\"\n\ndefinition\n  R_a0m1a_rs :: \"(rssig a0n_state \\<times> m1a_state) set\" where\n  \"R_a0m1a_rs \\<equiv> {(s, t). signals s = rs_runs2sigs (runs t) \\<and> corrupted s = {} }\"\n\nlemmas R_a0m1a_rs_defs = R_a0m1a_rs_def med_a0m1a_rs_def \n\n\nsubsubsection \\<open>Lemmas about the auxiliary functions\\<close>\n(******************************************************************************)\n\ntext \\<open>Other lemmas\\<close>\n\nlemma rs_runs2sigs_empty [simp]: \n  \"runz = Map.empty \\<Longrightarrow> rs_runs2sigs runz = (\\<lambda>s. 0)\"\nby (rule ext, erule rev_mp) \n   (rule rs_runs2sigs.induct, auto)\n\nlemma rs_commit_finite [simp, intro]:\n  \"finite (dom runz) \\<Longrightarrow> finite (rs_commit runz A B Kab nls)\"\nby (auto intro: finite_subset dest: dom_lemmas)\n\n\ntext \\<open>Update lemmas\\<close>\n\nlemma rs_runs2sigs_upd_init_none [simp]:\n  \"\\<lbrakk> Ra \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> rs_runs2sigs (runz(Ra \\<mapsto> (Init, [A, B], []))) = rs_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n   (rule rs_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma rs_runs2sigs_upd_resp_none [simp]:\n  \"\\<lbrakk> Rb \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> rs_runs2sigs (runz(Rb \\<mapsto> (Resp, [A, B], []))) = rs_runs2sigs runz\"\nby (rule ext, erule rev_mp) \n   (rule rs_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma rs_runs2sigs_upd_serv [simp]:\n  \"\\<lbrakk> Rs \\<notin> dom runz \\<rbrakk>\n  \\<Longrightarrow> rs_runs2sigs (runz(Rs \\<mapsto> (Serv, [A, B], nls))) = \n     (rs_runs2sigs runz)(Running [B, Sv] (sesK (Rs$sk), A, take rs_len nls) := 1)\"\nby (rule ext, erule rev_mp) \n   (rule rs_runs2sigs.induct, auto dest: dom_lemmas)\n\nlemma rs_runs2sigs_upd_init_some [simp]:\n  \"\\<lbrakk> runz Ra = Some (Init, [A, B], []) \\<rbrakk>\n  \\<Longrightarrow> rs_runs2sigs (runz(Ra \\<mapsto> (Init, [A, B], aKey Kab # nl))) =\n     rs_runs2sigs runz\" \nby (rule ext, erule rev_mp)\n   (rule rs_runs2sigs.induct, auto dest: dom_lemmas)  \n\nlemma rs_runs2sigs_upd_resp_some [simp]:\n  \"\\<lbrakk> runz Rb = Some (Resp, [A, B], []); finite (dom runz);\n     rsl = take rs_len nlb \\<rbrakk>\n \\<Longrightarrow> rs_runs2sigs (runz(Rb \\<mapsto> (Resp, [A, B], aKey Kab # nlb))) =\n   (rs_runs2sigs runz)(\n      Commit [B, Sv] (Kab, A, rsl) := Suc (card (rs_commit runz A B Kab rsl)))\"\napply (rule ext, erule rev_mp, erule rev_mp, erule rev_mp) \napply (rule rs_runs2sigs.induct, auto dest: dom_lemmas)\n\\<comment> \\<open>1 subgoal\\<close>\napply (rename_tac runz)\napply (rule_tac s=\"card (insert Rb (rs_commit runz A B Kab (take rs_len nlb)))\" \n       in trans, fast, auto)\ndone\n\n\nsubsubsection \\<open>Refinement proof\\<close>\n(******************************************************************************)\n\nlemma PO_m1a_step1_refines_a0_rs_skip:\n  \"{R_a0m1a_rs} \n     Id, (m1a_step1 Ra A B) \n   {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs m1a_defs)\n\nlemma PO_m1a_step2_refines_a0_rs_skip:\n  \"{R_a0m1a_rs} \n     Id, (m1a_step2 Rb A B) \n   {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs m1a_defs)\n\nlemma PO_m1a_step3_refines_a0_rs_running:\n  \"{R_a0m1a_rs} \n     (a0n_running [B, Sv] (Kab, A, take rs_len nls)), \n     (m1a_step3 Rs A B Kab nls) \n   {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs a0n_defs m1a_defs\n         dest: dom_lemmas)\n\nlemma PO_m1a_step4_refines_a0_rs_skip:\n  \"{R_a0m1a_rs} \n     Id, (m1a_step4 Ra A B Kab nla) \n   {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs m1a_defs)\n\nlemma PO_m1a_step5_refines_a0_rs_commit:\n  \"{R_a0m1a_rs \\<inter> UNIV \\<times> m1a_inv0_fin} \n     (a0n_commit [B, Sv] (Kab, A, take rs_len nlb)), \n     (m1a_step5 Rb A B Kab nlb) \n   {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs a0n_defs m1a_defs)\n\nlemma PO_m1a_leak_refines_a0_rs_skip:\n  \"{R_a0m1a_rs} \n     Id, (m1a_leak Rs) \n   {> R_a0m1a_rs}\"\nby (auto simp add: PO_rhoare_defs R_a0m1a_rs_defs a0i_defs m1a_defs)\n\n\ntext \\<open>All together now...\\<close>\n\nlemmas PO_m1a_trans_refines_a0_rs_trans = \n  PO_m1a_step1_refines_a0_rs_skip PO_m1a_step2_refines_a0_rs_skip\n  PO_m1a_step3_refines_a0_rs_running PO_m1a_step4_refines_a0_rs_skip\n  PO_m1a_step5_refines_a0_rs_commit PO_m1a_leak_refines_a0_rs_skip\n\n\nlemma PO_m1a_refines_init_ra0n [iff]:\n  \"init m1a \\<subseteq>  R_a0m1a_rs``(init a0n)\"\nby (auto simp add: R_a0m1a_rs_defs a0n_defs m1a_defs)\n\nlemma PO_m1a_refines_trans_ra0n [iff]:\n  \"{R_a0m1a_rs \\<inter> UNIV \\<times> m1a_inv0_fin} \n     (trans a0n), (trans m1a) \n   {> R_a0m1a_rs}\"\nby (auto simp add: m1a_def m1a_trans_def a0n_def a0n_trans_def\n         intro!: PO_m1a_trans_refines_a0_rs_trans)\n\nlemma obs_consistent_med_a0m1a_rs [iff]: \n  \"obs_consistent (R_a0m1a_rs \\<inter> UNIV \\<times> m1a_inv0_fin) med_a0m1a_rs a0n m1a\"\nby (auto simp add: obs_consistent_def R_a0m1a_rs_def med_a0m1a_rs_def \n                   a0n_def m1a_def)\n\n\ntext \\<open>Refinement result.\\<close>\n\nlemma PO_m1a_refines_a0_rs [iff]: \n  \"refines (R_a0m1a_rs \\<inter> UNIV \\<times> m1a_inv0_fin) med_a0m1a_rs a0n m1a\"\nby (rule Refinement_using_invariants) (auto)\n\nlemma  m1a_implements_ra0n: \"implements med_a0m1a_rs a0n m1a\"\nby (rule refinement_soundness) (fast)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m1_keydist_inrn.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.31630911332824757}}
{"text": "(*<*)\ntheory KBPsAlg\nimports KBPsAuto DFS MapOps\nbegin\n(*>*)\n\nsubsection\\<open>An algorithm for automata synthesis\\<close>\n\ntext\\<open>\n\n\\label{sec:kbps-alg}\n\nWe now show how to construct the automaton defined by @{term\n\"mkAutoSim\"} (\\S\\ref{sec:kbps-automata-synthesis-alg}) using the DFS\nof \\S\\ref{sec:dfs}.\n\nFrom here on we assume that the environment consists of only a finite\nset of states:\n\n\\<close>\n\nlocale FiniteEnvironment =\n  Environment jkbp envInit envAction envTrans envVal envObs\n    for jkbp :: \"('a, 'p, 'aAct) JKBP\"\n    and envInit :: \"('s :: finite) list\"\n    and envAction :: \"'s \\<Rightarrow> 'eAct list\"\n    and envTrans :: \"'eAct \\<Rightarrow> ('a \\<Rightarrow> 'aAct) \\<Rightarrow> 's \\<Rightarrow> 's\"\n    and envVal :: \"'s \\<Rightarrow> 'p \\<Rightarrow> bool\"\n    and envObs :: \"'a \\<Rightarrow> 's \\<Rightarrow> 'obs\"\n\ntext_raw\\<open>\n\\begin{figure}[p]\n\\begin{isabellebody}%\n\\<close>\nlocale Algorithm =\n  FiniteEnvironment jkbp envInit envAction envTrans envVal envObs\n+ AlgSimIncrEnvironment jkbp envInit envAction envTrans envVal jview envObs\n               jviewInit jviewIncr\n               simf simRels simVal simAbs simObs simInit simTrans simAction\n    for jkbp :: \"('a, 'p, 'aAct) JKBP\"\n    and envInit :: \"('s :: finite) list\"\n    and envAction :: \"'s \\<Rightarrow> 'eAct list\"\n    and envTrans :: \"'eAct \\<Rightarrow> ('a \\<Rightarrow> 'aAct) \\<Rightarrow> 's \\<Rightarrow> 's\"\n    and envVal :: \"'s \\<Rightarrow> 'p \\<Rightarrow> bool\"\n    and jview :: \"('a, 's, 'tobs) JointView\"\n\n    and envObs :: \"'a \\<Rightarrow> 's \\<Rightarrow> 'obs\"\n    and jviewInit :: \"('a, 'obs, 'tobs) InitialIncrJointView\"\n    and jviewIncr :: \"('a, 'obs, 'tobs) IncrJointView\"\n\n    and simf :: \"'s Trace \\<Rightarrow> 'ss :: finite\"\n    and simRels :: \"'a \\<Rightarrow> 'ss Relation\"\n    and simVal :: \"'ss \\<Rightarrow> 'p \\<Rightarrow> bool\"\n\n    and simAbs :: \"'rep \\<Rightarrow> 'ss set\"\n\n    and simObs :: \"'a \\<Rightarrow> 'rep \\<Rightarrow> 'obs\"\n    and simInit :: \"'a \\<Rightarrow> 'obs \\<Rightarrow> 'rep\"\n    and simTrans :: \"'a \\<Rightarrow> 'rep \\<Rightarrow> 'rep list\"\n    and simAction :: \"'a \\<Rightarrow> 'rep \\<Rightarrow> 'aAct list\"\n\n+ fixes aOps :: \"('ma, 'rep, 'aAct list) MapOps\"\n    and tOps :: \"('mt, 'rep \\<times> 'obs, 'rep) MapOps\"\n\n  assumes aOps: \"MapOps simAbs jkbpSEC aOps\"\n      and tOps: \"MapOps (\\<lambda>k. (simAbs (fst k), snd k)) (jkbpSEC \\<times> UNIV) tOps\"\ntext_raw\\<open>\n  \\end{isabellebody}%\n  \\caption{The \\<open>Algorithm\\<close> locale.}\n  \\label{fig:kbps-alg-alg-locale}\n\\end{figure}\n\\<close>\n\ntext (in Algorithm) \\<open>\n\nThe @{term \"Algorithm\"} locale, shown in\nFigure~\\ref{fig:kbps-alg-alg-locale}, also extends the @{term\n\"AlgSimIncrEnvironment\"} locale with a pair of finite map operations:\n@{term \"aOps\"} is used to map automata states to lists of actions, and\n@{term \"tOps\"} handles simulated transitions. In both cases the maps\nare only required to work on the abstract domain of simulated\ncanonical traces. Note also that the space of simulated equivalence\nclasses of type @{typ \"'ss\"} must be finite, but there is no\nrestriction on the representation type @{typ \"'rep\"}.\n\nWe develop the algorithm for a single, fixed agent, which requires us\nto define a new locale @{term \"AlgorithmForAgent\"} that extends \\<open>Algorithm\\<close> with an extra parameter designating the agent:\n\n\\<close>\n\nlocale AlgorithmForAgent =\n  Algorithm jkbp envInit envAction envTrans envVal jview envObs\n            jviewInit jviewIncr\n            simf simRels simVal simAbs simObs simInit simTrans simAction\n            aOps tOps(*<*)\n    for jkbp :: \"('a, 'p, 'aAct) JKBP\"\n    and envInit :: \"('s :: finite) list\"\n    and envAction :: \"'s \\<Rightarrow> 'eAct list\"\n    and envTrans :: \"'eAct \\<Rightarrow> ('a \\<Rightarrow> 'aAct) \\<Rightarrow> 's \\<Rightarrow> 's\"\n    and envVal :: \"'s \\<Rightarrow> 'p \\<Rightarrow> bool\"\n    and jview :: \"('a, 's, 'tobs) JointView\"\n\n    and envObs :: \"'a \\<Rightarrow> 's \\<Rightarrow> 'obs\"\n    and jviewInit :: \"('a, 'obs, 'tobs) InitialIncrJointView\"\n    and jviewIncr :: \"('a, 'obs, 'tobs) IncrJointView\"\n\n    and simf :: \"'s Trace \\<Rightarrow> 'ss :: finite\"\n    and simRels :: \"'a \\<Rightarrow> 'ss Relation\"\n    and simVal :: \"'ss \\<Rightarrow> 'p \\<Rightarrow> bool\"\n\n    and simAbs :: \"'rep \\<Rightarrow> 'ss set\"\n\n    and simObs :: \"'a \\<Rightarrow> 'rep \\<Rightarrow> 'obs\"\n    and simInit :: \"'a \\<Rightarrow> 'obs \\<Rightarrow> 'rep\"\n    and simTrans :: \"'a \\<Rightarrow> 'rep \\<Rightarrow> 'rep list\"\n    and simAction :: \"'a \\<Rightarrow> 'rep \\<Rightarrow> 'aAct list\"\n\n    and aOps :: \"('ma, 'rep, 'aAct list) MapOps\"\n    and tOps :: \"('mt, 'rep \\<times> 'obs, 'rep) MapOps\"\n(*>*)\n\n  \\<comment> \\<open>...\\<close>\n+ fixes a :: \"'a\"\n\nsubsubsection\\<open>DFS operations\\<close>\n\ntext\\<open>\n\nWe represent the automaton under construction using a record:\n\n\\<close>\n\nrecord ('ma, 'mt) AlgState =\n  aActs :: \"'ma\"\n  aTrans :: \"'mt\"\n\ncontext AlgorithmForAgent\nbegin\n\ntext\\<open>\n\nWe instantiate the DFS theory with the following functions.\n\nA node is an equivalence class of represented simulated traces.\n\n\\<close>\n\ndefinition k_isNode :: \"'rep \\<Rightarrow> bool\" where\n  \"k_isNode ec \\<equiv> simAbs ec \\<in> sim_equiv_class a ` jkbpC\"\n\ntext\\<open>\n\nThe successors of a node are those produced by the simulated\ntransition function.\n\n\\<close>\n\nabbreviation k_succs :: \"'rep \\<Rightarrow> 'rep list\" where\n  \"k_succs \\<equiv> simTrans a\"\n\ntext\\<open>\n\nThe initial automaton has no transitions and no actions.\n\n\\<close>\n\ndefinition k_empt :: \"('ma, 'mt) AlgState\" where\n  \"k_empt \\<equiv> \\<lparr> aActs = empty aOps, aTrans = empty tOps \\<rparr>\"\n\ntext\\<open>\n\nWe use the domain of the action map to track the set of nodes the DFS\nhas visited.\n\n\\<close>\n\ndefinition k_memb :: \"'rep \\<Rightarrow> ('ma, 'mt) AlgState \\<Rightarrow> bool\" where\n  \"k_memb s A \\<equiv> isSome (lookup aOps (aActs A) s)\"\n\ntext\\<open>\n\nWe integrate a new equivalence class into the automaton by updating\nthe action and transition maps:\n\n\\<close>\n\ndefinition actsUpdate :: \"'rep \\<Rightarrow> ('ma, 'mt) AlgState \\<Rightarrow> 'ma\" where\n  \"actsUpdate ec A \\<equiv> update aOps ec (simAction a ec) (aActs A)\"\n\ndefinition transUpdate :: \"'rep \\<Rightarrow> 'rep \\<Rightarrow> 'mt \\<Rightarrow> 'mt\" where\n  \"transUpdate ec ec' at \\<equiv> update tOps (ec, simObs a ec') ec' at\"\n\ndefinition k_ins :: \"'rep \\<Rightarrow> ('ma, 'mt) AlgState \\<Rightarrow> ('ma, 'mt) AlgState\" where\n  \"k_ins ec A \\<equiv> \\<lparr> aActs = actsUpdate ec A,\n                   aTrans = foldr (transUpdate ec) (k_succs ec) (aTrans A) \\<rparr>\"\n\ntext\\<open>\n\nThe required properties are straightforward to show.\n\n\\<close>\n\n(*<*)\n\nlemma k_isNode_cong:\n  \"simAbs ec' = simAbs ec \\<Longrightarrow> k_isNode ec' \\<longleftrightarrow> k_isNode ec\"\n  unfolding k_isNode_def by simp\n\nlemma alg_MapOps_empty[simp]:\n  \"k_isNode ec \\<Longrightarrow> lookup aOps (empty aOps) ec = None\"\n  \"k_isNode (fst k) \\<Longrightarrow> lookup tOps (empty tOps) k = None\"\n  unfolding k_isNode_def\n  using MapOps_emptyD[OF _ aOps] MapOps_emptyD[OF _ tOps] by blast+\n\nlemma alg_aOps_lookup_update[simp]:\n  \"\\<lbrakk> k_isNode ec; k_isNode ec' \\<rbrakk> \\<Longrightarrow> lookup aOps (update aOps ec e M) ec' = (if simAbs ec' = simAbs ec then Some e else lookup aOps M ec')\"\n  unfolding k_isNode_def\n  using MapOps_lookup_updateD[OF _ _ aOps] by blast\n\nlemma alg_tOps_lookup_update[simp]:\n  \"\\<lbrakk> k_isNode (fst k); k_isNode (fst k') \\<rbrakk> \\<Longrightarrow> lookup tOps (update tOps k e M) k' = (if (simAbs (fst k'), snd k') = (simAbs (fst k), snd k) then Some e else lookup tOps M k')\"\n  unfolding k_isNode_def\n  using MapOps_lookup_updateD[OF _ _ tOps] by blast\n\nlemma k_succs_is_node[intro, simp]:\n  assumes x: \"k_isNode x\"\n  shows \"list_all k_isNode (k_succs x)\"\nproof -\n  from x obtain t\n    where tC: \"t \\<in> jkbpC\"\n      and sx: \"simAbs x = sim_equiv_class a t\"\n    unfolding k_isNode_def by blast\n  have F: \"\\<And>y. y \\<in> set (k_succs x) \\<Longrightarrow> simAbs y \\<in> simAbs ` set (k_succs x)\" by simp\n  show ?thesis\n    using simTrans[rule_format, where a=a and t=t] tC sx\n    unfolding k_isNode_def [abs_def]\n    apply (auto iff: list_all_iff)\n    apply (frule F)\n    apply (auto)\n    done\nqed\n\nlemma k_memb_empt[simp]:\n  \"k_isNode x \\<Longrightarrow> \\<not>k_memb x k_empt\"\n  unfolding k_memb_def k_empt_def by simp\n\n(*>*)\n\nsubsubsection\\<open>Algorithm invariant\\<close>\n\ntext\\<open>\n\nThe invariant for the automata construction is straightforward, viz\nthat at each step of the process the state represents an automaton\nthat concords with @{term \"mkAutoSim\"} on the visited equivalence\nclasses. We also need to know that the state has preserved the @{term\n\"MapOps\"} invariants.\n\n\\<close>\n\ndefinition k_invariant :: \"('ma, 'mt) AlgState \\<Rightarrow> bool\" where\n  \"k_invariant A \\<equiv>\n      (\\<forall>ec ec'. k_isNode ec \\<and> k_isNode ec' \\<and> simAbs ec' = simAbs ec\n        \\<longrightarrow> lookup aOps (aActs A) ec = lookup aOps (aActs A) ec')\n    \\<and> (\\<forall>ec ec' obs. k_isNode ec \\<and> k_isNode ec' \\<and> simAbs ec' = simAbs ec\n        \\<longrightarrow> lookup tOps (aTrans A) (ec, obs) = lookup tOps (aTrans A) (ec', obs))\n    \\<and> (\\<forall>ec. k_isNode ec \\<and> k_memb ec A\n        \\<longrightarrow> (\\<exists>acts. lookup aOps (aActs A) ec = Some acts\n                   \\<and> set acts = set (simAction a ec)))\n    \\<and> (\\<forall>ec obs. k_isNode ec \\<and> k_memb ec A\n              \\<and> obs \\<in> simObs a ` set (simTrans a ec)\n        \\<longrightarrow> (\\<exists>ec'. lookup tOps (aTrans A) (ec, obs) = Some ec'\n                  \\<and> simAbs ec' \\<in> simAbs ` set (simTrans a ec)\n                  \\<and> simObs a ec' = obs))\"\n(*<*)\n\nlemma k_invariantI[intro]:\n  \"\\<lbrakk> \\<And>ec ec'. \\<lbrakk> k_isNode ec; k_isNode ec'; simAbs ec' = simAbs ec \\<rbrakk>\n       \\<Longrightarrow> lookup aOps (aActs A) ec = lookup aOps (aActs A) ec';\n     \\<And>ec ec' obs. \\<lbrakk> k_isNode ec; k_isNode ec'; simAbs ec' = simAbs ec \\<rbrakk>\n       \\<Longrightarrow> lookup tOps (aTrans A) (ec, obs) = lookup tOps (aTrans A) (ec', obs);\n     \\<And>ec. \\<lbrakk> k_isNode ec; k_memb ec A \\<rbrakk>\n       \\<Longrightarrow> \\<exists>acts. lookup aOps (aActs A) ec = Some acts \\<and> set acts = set (simAction a ec);\n     \\<And>ec obs ecs'. \\<lbrakk> k_isNode ec; k_memb ec A; obs \\<in> simObs a ` set (simTrans a ec) \\<rbrakk>\n       \\<Longrightarrow> \\<exists>ec'. lookup tOps (aTrans A) (ec, obs) = Some ec'\n               \\<and> simAbs ec' \\<in> simAbs ` set (simTrans a ec)\n               \\<and> simObs a ec' = obs \\<rbrakk>\n  \\<Longrightarrow> k_invariant A\"\n  unfolding k_invariant_def by (simp (no_asm_simp))\n\nlemma k_invariantAOD:\n  \"\\<lbrakk> k_isNode ec; k_isNode ec'; simAbs ec' = simAbs ec; k_invariant A \\<rbrakk>\n     \\<Longrightarrow> lookup aOps (aActs A) ec = lookup aOps (aActs A) ec'\"\n  unfolding k_invariant_def by blast\n\nlemma k_invariantTOD:\n  \"\\<lbrakk> k_isNode ec; k_isNode ec'; simAbs ec' = simAbs ec; k_invariant A \\<rbrakk>\n     \\<Longrightarrow> lookup tOps (aTrans A) (ec, obs) = lookup tOps (aTrans A) (ec', obs)\"\n  unfolding k_invariant_def by blast\n\nlemma k_invariantAD:\n  \"\\<lbrakk> k_isNode ec; k_memb ec A; k_invariant A \\<rbrakk>\n     \\<Longrightarrow> \\<exists>acts. lookup aOps (aActs A) ec = Some acts \\<and> set acts = set (simAction a ec)\"\n  unfolding k_invariant_def by blast\n\nlemma k_invariantTD:\n  \"\\<lbrakk> k_isNode ec; k_memb ec A; obs \\<in> simObs a ` set (simTrans a ec); k_invariant A \\<rbrakk>\n     \\<Longrightarrow> \\<exists>ec'. lookup tOps (aTrans A) (ec, obs) = Some ec'\n             \\<and> simAbs ec' \\<in> simAbs ` set (simTrans a ec)\n             \\<and> simObs a ec' = obs\"\n  unfolding k_invariant_def by blast\n\nlemma k_invariant_empt[simp]:\n  \"k_invariant k_empt\"\n  apply rule\n  apply auto\n  apply (auto iff: k_empt_def)\n  done\n\nlemma k_invariant_step_new_aux:\n  assumes X: \"set X \\<subseteq> set (k_succs x)\"\n      and x: \"k_isNode x\"\n      and ec: \"k_isNode ec\"\n      and ec': \"simAbs ec' \\<in> simAbs ` set X\"\n      and S: \"simAbs ec = simAbs x\"\n  shows \"\\<exists>r. lookup tOps (foldr (transUpdate x) X Y) (ec, simObs a ec') = Some r\n           \\<and> simAbs r \\<in> simAbs ` set (k_succs ec)\n           \\<and> simObs a r = simObs a ec'\"\nusing X ec'\nproof(induct X arbitrary: Y)\n  case Nil thus ?case by simp\nnext\n  case (Cons y ys) show ?case\n  proof(cases \"simAbs ec' = simAbs y\")\n    case False with x ec S Cons show ?thesis\n      unfolding transUpdate_def\n      apply clarsimp\n      unfolding k_isNode_def\n      apply (erule imageE)+\n      apply (cut_tac a=a and t=ta and ec=x and ec'=ec in simTrans_simAbs_cong[symmetric])\n      apply simp_all\n      done\n  next\n    case True\n    with Cons have F: \"simAbs y \\<in> simAbs ` set (k_succs x)\"\n      by auto\n    from x obtain t\n      where tC: \"t \\<in> jkbpC\"\n        and x': \"simAbs x = sim_equiv_class a t\"\n      unfolding k_isNode_def by blast\n    from F obtain t' s\n      where \"simAbs y = sim_equiv_class a (t' \\<leadsto> s)\"\n        and tsC: \"t' \\<leadsto> s \\<in> jkbpC\"\n        and tt': \"jview a t = jview a t'\"\n      using simTrans[rule_format, where a=a and t=t] tC x' by auto\n    with Cons.hyps[where Y11=Y] Cons(2) Cons(3) True S x ec show ?thesis\n      unfolding transUpdate_def\n      apply auto\n      apply (subst simTrans_simAbs_cong[where t=t' and ec'=x])\n       apply blast\n\n       using x' tt'\n       apply auto[1]\n\n       apply simp\n\n       apply (rule image_eqI[where x=y])\n       apply simp\n       apply simp\n      using simObs[rule_format, where a=a and t=\"t'\\<leadsto>s\"]\n      apply simp\n      done\n  qed\nqed\n\nlemma k_invariant_step_new:\n  assumes x: \"k_isNode x\"\n      and ec: \"k_isNode ec\"\n      and ec': \"ec' \\<in> set (k_succs ec)\"\n      and S: \"simAbs ec = simAbs x\"\n  shows \"\\<exists>ec''. lookup tOps (aTrans (k_ins x A)) (ec, simObs a ec') = Some ec''\n              \\<and> simAbs ec'' \\<in> simAbs ` set (k_succs ec)\n              \\<and> simObs a ec'' = simObs a ec'\"\nproof -\n  from x ec'\n  have ec': \"simAbs ec' \\<in> simAbs ` set (k_succs x)\"\n    unfolding k_isNode_def\n    apply clarsimp\n    apply (subst simTrans_simAbs_cong[OF _ _ S, symmetric])\n    using S\n    apply auto\n    done\n  thus ?thesis\n    using k_invariant_step_new_aux[OF subset_refl x ec _ S, where ec'=ec']\n    unfolding k_ins_def\n    apply auto\n    done\nqed\n\nlemma k_invariant_step_old_aux:\n  assumes x: \"k_isNode x\"\n      and ec: \"k_isNode ec\"\n      and S: \"simAbs ec \\<noteq> simAbs x\"\n  shows \"lookup tOps (foldr (transUpdate x) X Y) (ec, obs)\n       = lookup tOps Y (ec, obs)\"\nproof(induct X)\n  case (Cons z zs) with x ec S show ?case\n    by (cases \"lookup tOps Y (ec, obs)\") (simp_all add: transUpdate_def)\nqed simp\n\nlemma k_invariant_step_old:\n  assumes x: \"k_isNode x\"\n      and ec: \"k_isNode ec\"\n      and S: \"simAbs ec \\<noteq> simAbs x\"\n  shows \"lookup tOps (aTrans (k_ins x A)) (ec, obs)\n       = lookup tOps (aTrans A) (ec, obs)\"\n  unfolding k_ins_def\n  using k_invariant_step_old_aux[OF x ec S]\n  by simp\n\nlemma k_invariant_frame:\n  assumes B: \"lookup tOps Y (ec, obs) = lookup tOps Y (ec', obs)\"\n      and x: \"k_isNode x\"\n      and ec: \"k_isNode ec\"\n      and ec': \"k_isNode ec'\"\n      and S: \"simAbs ec' = simAbs ec\"\n  shows \"lookup tOps (foldr (transUpdate x) X Y) (ec, obs) = lookup tOps (foldr (transUpdate x) X Y) (ec', obs)\"\n  apply (induct X)\n  unfolding transUpdate_def\n   using B\n   apply simp\n  using x ec ec' S\n  apply simp\n  done\n\nlemma k_invariant_step[simp]:\n  assumes N: \"k_isNode x\"\n      and I: \"k_invariant A\"\n      and M: \"\\<not> k_memb x A\"\n  shows \"k_invariant (k_ins x A)\"\n(*<*)\nproof\n  fix ec ec'\n  assume ec: \"k_isNode ec\" and ec': \"k_isNode ec'\" and X: \"simAbs ec' = simAbs ec\"\n  with N show \"lookup aOps (aActs (k_ins x A)) ec = lookup aOps (aActs (k_ins x A)) ec'\"\n    unfolding k_ins_def actsUpdate_def\n    using k_invariantAOD[OF ec ec' X I]\n    apply simp\n    done\nnext\n  fix ec ec' obs\n  assume ec: \"k_isNode ec\" and ec': \"k_isNode ec'\" and X: \"simAbs ec' = simAbs ec\"\n  show \"lookup tOps (aTrans (k_ins x A)) (ec, obs) = lookup tOps (aTrans (k_ins x A)) (ec', obs)\"\n    unfolding k_ins_def\n    using k_invariant_frame[OF k_invariantTOD[OF ec ec' X I] N ec ec' X]\n    apply simp\n    done\nnext\n  fix ec obs ecs'\n  assume n: \"k_isNode ec\"\n    and ec: \"k_memb ec (k_ins x A)\"\n    and obs: \"obs \\<in> simObs a ` set (simTrans a ec)\"\n  show \"\\<exists>ec'. lookup tOps (aTrans (k_ins x A)) (ec, obs) = Some ec'\n            \\<and> simAbs ec' \\<in> simAbs ` set (k_succs ec)\n            \\<and> simObs a ec' = obs\"\n  proof(cases \"simAbs ec = simAbs x\")\n    case True with N n obs show ?thesis\n      using k_invariant_step_new by auto\n  next\n    case False with I N n ec obs show ?thesis\n      apply (simp add: k_invariant_step_old)\n      apply (rule k_invariantTD)\n      apply simp_all\n      unfolding k_ins_def k_memb_def actsUpdate_def\n      apply simp\n      done\n  qed\nnext\n  fix ec\n  assume n: \"k_isNode ec\"\n     and ec: \"k_memb ec (k_ins x A)\"\n  show \"\\<exists>acts. lookup aOps (aActs (k_ins x A)) ec = Some acts \\<and> set acts = set (simAction a ec)\"\n  proof(cases \"simAbs ec = simAbs x\")\n    case True with aOps N n show ?thesis\n      unfolding k_ins_def actsUpdate_def\n      apply clarsimp\n      unfolding k_isNode_def\n      apply clarsimp\n      apply (erule jAction_simAbs_cong)\n      apply auto\n      done\n  next\n    case False with aOps N I M n ec show ?thesis\n      unfolding k_ins_def actsUpdate_def\n      apply simp\n      apply (rule k_invariantAD)\n      unfolding k_memb_def\n      apply simp_all\n      done\n  qed\nqed\n(*>*)\n\n(*>*)\n\ntext\\<open>\n\nShowing that the invariant holds of @{term \"k_empt\"} and is respected\nby @{term \"k_ins\"} is routine.\n\nThe initial frontier is the partition of the set of initial states\nunder the initial observation function.\n\n\\<close>\n\ndefinition (in Algorithm) k_frontier :: \"'a \\<Rightarrow> 'rep list\" where\n  \"k_frontier a \\<equiv> map (simInit a \\<circ> envObs a) envInit\"\n(*<*)\n\nlemma k_frontier_is_node[intro, simp]:\n  \"list_all k_isNode (k_frontier a)\"\n  unfolding k_frontier_def\n  by (auto iff: simInit list_all_iff k_isNode_def jviewInit jviewIncr)\n(*>*)\n\nend (* context AlgorithmForAgent *)\n\ntext\\<open>\n\nWe now instantiate the @{term \"DFS\"} locale with respect to the @{term\n\"AlgorithmForAgent\"} locale. The instantiated lemmas are given the\nmandatory prefix \\<open>KBPAlg\\<close> in the @{term \"AlgorithmForAgent\"}\nlocale.\n\n\\<close>\n\nsublocale AlgorithmForAgent\n        < KBPAlg: DFS k_succs k_isNode k_invariant k_ins k_memb k_empt simAbs\n\n(*<*)\n  apply (unfold_locales)\n  apply simp_all\n\n  unfolding k_memb_def k_ins_def actsUpdate_def\n  using aOps\n  apply (auto iff: isSome_eq)[1]\n\n  unfolding k_isNode_def\n  apply clarsimp\n  apply (erule simTrans_simAbs_cong)\n  apply auto\n  done\n(*>*)\n\ntext_raw\\<open>\n\\begin{figure}\n\\begin{isabellebody}%\n\\<close>\ndefinition\n  alg_dfs :: \"('ma, 'rep, 'aAct list) MapOps\n         \\<Rightarrow> ('mt, 'rep \\<times> 'obs, 'rep) MapOps\n         \\<Rightarrow> ('rep \\<Rightarrow> 'obs)\n         \\<Rightarrow> ('rep \\<Rightarrow> 'rep list)\n         \\<Rightarrow> ('rep \\<Rightarrow> 'aAct list)\n         \\<Rightarrow> 'rep list\n         \\<Rightarrow> ('ma, 'mt) AlgState\"\nwhere\n  \"alg_dfs aOps tOps simObs simTrans simAction \\<equiv>\n    let k_empt = \\<lparr> aActs = empty aOps, aTrans = empty tOps \\<rparr>;\n       k_memb = (\\<lambda>s A. isSome (lookup aOps (aActs A) s));\n       k_succs = simTrans;\n       actsUpdate = \\<lambda>ec A. update aOps ec (simAction ec) (aActs A);\n       transUpdate = \\<lambda>ec ec' at. update tOps (ec, simObs ec') ec' at;\n       k_ins = \\<lambda>ec A. \\<lparr> aActs = actsUpdate ec A,\n                         aTrans = foldr (transUpdate ec) (k_succs ec) (aTrans A) \\<rparr>\n     in gen_dfs k_succs k_ins k_memb k_empt\"\n\ntext\\<open>\\<close>\n\ndefinition\n  mkAlgAuto :: \"('ma, 'rep, 'aAct list) MapOps\n            \\<Rightarrow> ('mt, 'rep \\<times> 'obs, 'rep) MapOps\n            \\<Rightarrow> ('a \\<Rightarrow> 'rep \\<Rightarrow> 'obs)\n            \\<Rightarrow> ('a \\<Rightarrow> 'obs \\<Rightarrow> 'rep)\n            \\<Rightarrow> ('a \\<Rightarrow> 'rep \\<Rightarrow> 'rep list)\n            \\<Rightarrow> ('a \\<Rightarrow> 'rep \\<Rightarrow> 'aAct list)\n            \\<Rightarrow> ('a \\<Rightarrow> 'rep list)\n            \\<Rightarrow> ('a, 'obs, 'aAct, 'rep) JointProtocol\"\nwhere\n  \"mkAlgAuto aOps tOps simObs simInit simTrans simAction frontier \\<equiv> \\<lambda>a.\n    let auto = alg_dfs aOps tOps (simObs a) (simTrans a) (simAction a)\n                       (frontier a)\n     in \\<lparr> pInit = simInit a,\n          pTrans = \\<lambda>obs ec. the (lookup tOps (aTrans auto) (ec, obs)),\n          pAct = \\<lambda>ec. the (lookup aOps (aActs auto) ec) \\<rparr>\"\n\ntext_raw\\<open>\n  \\end{isabellebody}%\n  \\caption{The algorithm. The function @{term \"the\"} projects a value from the\n    @{typ \"'a option\"} type, diverging on @{term \"None\"}.}\n  \\label{fig:kbps-alg-algorithm}\n\\end{figure}\n\\<close>\n(*<*)\nlemma mkAutoSim_simps[simp]:\n  \"pInit (mkAlgAuto aOps tOps simObs simInit simTrans simAction frontier a) = simInit a\"\n  \"pTrans (mkAlgAuto aOps tOps simObs simInit simTrans simAction frontier a)\n = (\\<lambda>obs ec. the (lookup tOps (aTrans (alg_dfs aOps tOps (simObs a) (simTrans a) (simAction a) (frontier a))) (ec, obs)))\"\n  \"pAct (mkAlgAuto aOps tOps simObs simInit simTrans simAction frontier a)\n = (\\<lambda>ec. the (lookup aOps (aActs (alg_dfs aOps tOps (simObs a) (simTrans a) (simAction a) (frontier a))) ec))\"\n  unfolding mkAlgAuto_def\n  apply (simp_all add: Let_def)\n  done\n\n(* Later we want to show that a particular DFS implementation does the\nright thing. *)\n\ndefinition\n  alg_mk_auto :: \"('ma, 'rep, 'aAct list) MapOps\n                \\<Rightarrow> ('mt, 'rep \\<times> 'obs, 'rep) MapOps\n                \\<Rightarrow> ('obs \\<Rightarrow> 'rep)\n                \\<Rightarrow> ('ma, 'mt) AlgState\n                \\<Rightarrow> ('obs, 'aAct, 'rep) Protocol\"\nwhere\n  \"alg_mk_auto aOps tOps simInit k_dfs \\<equiv>\n    \\<lparr> pInit = simInit,\n      pTrans = \\<lambda>obs ec. the (lookup tOps (aTrans k_dfs) (ec, obs)),\n      pAct = \\<lambda>ec. the (lookup aOps (aActs k_dfs) ec)\n    \\<rparr>\"\n\n(*>*)\ncontext AlgorithmForAgent\nbegin\n\ntext\\<open>\n\nThe final algorithm, with the constants inlined, is shown in\nFigure~\\ref{fig:kbps-alg-algorithm}. The rest of this section shows\nits correctness.\n\nFirstly it follows immediately from \\<open>dfs_invariant\\<close> that the\ninvariant holds of the result of the DFS:\n\n\\<close>\n(*<*)\n\nabbreviation\n  \"k_dfs \\<equiv> KBPsAlg.alg_dfs aOps tOps (simObs a) (simTrans a) (simAction a) (k_frontier a)\"\n\n(* This is a syntactic nightmare. *)\n\nlemma k_dfs_gen_dfs_unfold[simp]:\n  \"k_dfs = gen_dfs k_succs k_ins k_memb k_empt (k_frontier a)\"\n  unfolding alg_dfs_def\n  apply (fold k_empt_def k_memb_def actsUpdate_def transUpdate_def)\n  apply (simp add: k_ins_def[symmetric])\n  done\n\n(*>*)\nlemma k_dfs_invariant: \"k_invariant k_dfs\"\n(*<*)\n  using KBPAlg.dfs_invariant[where S=\"k_empt\" and xs=\"k_frontier a\"]\n  by simp\n\n(*>*)\ntext\\<open>\n\nSecondly we can see that the set of reachable equivalence classes\ncoincides with the partition of @{term \"jkbpC\"} under the simulation\nand representation functions:\n\n\\<close>\n\nlemma k_reachable:\n  \"simAbs ` KBPAlg.reachable (set (k_frontier a)) = sim_equiv_class a ` jkbpC\"\n(*<*)(is \"?lhs = ?rhs\")\nproof\n  show \"?lhs \\<subseteq> ?rhs\"\n  proof\n    fix sx assume \"sx \\<in> ?lhs\"\n    then obtain x\n      where x: \"x \\<in> KBPAlg.reachable (set (k_frontier a))\"\n        and sx: \"simAbs x = sx\"\n      by auto\n    hence \"x \\<in> ({ (x, y). y \\<in> set (k_succs x) })\\<^sup>*\n                 `` set (map (simInit a \\<circ> envObs a) envInit)\"\n      unfolding KBPAlg.reachable_def k_frontier_def by simp\n    then obtain s iobs\n      where R: \"(simInit a iobs, x) \\<in> ({ (x, y). y \\<in> set (k_succs x)})\\<^sup>*\"\n        and sI: \"s \\<in> set envInit\"\n        and iobs: \"envObs a s = iobs\"\n      by auto\n    from R x have \"simAbs x \\<in> ?rhs\"\n    proof(induct arbitrary: sx rule: rtrancl_induct)\n      case base\n      with sI iobs show ?case by (auto simp: jviewInit simInit)\n    next\n      case (step x y)\n      with sI iobs\n      have \"simAbs x \\<in> sim_equiv_class a ` jkbpC\"\n        unfolding KBPAlg.reachable_def Image_def k_frontier_def\n        by auto\n      then obtain t\n        where tC: \"t \\<in> jkbpC\"\n          and F: \"simAbs x = sim_equiv_class a t\"\n        by auto\n      from step\n      have \"simAbs y \\<in> simAbs ` set (k_succs x)\" by auto\n      thus  ?case\n        using simTrans[rule_format, where a=a and t=t] tC F by auto\n    qed\n    with sx show \"sx \\<in> ?rhs\" by simp\n  qed\nnext\n  show \"?rhs \\<subseteq> ?lhs\"\n  proof\n    fix ec assume \"ec \\<in> ?rhs\"\n    then obtain t\n      where tC: \"t \\<in> jkbpC\"\n        and ec: \"ec = sim_equiv_class a t\"\n      by auto\n    thus \"ec \\<in> ?lhs\"\n    proof(induct t arbitrary: ec)\n      case (tInit s) thus ?case\n        unfolding KBPAlg.reachable_def (* FIXME ouch this is touchy *)\n        unfolding k_frontier_def\n        apply simp\n        apply (rule image_eqI[where x=\"simInit a (envObs a s)\"])\n         apply (simp add: simInit jviewInit)\n        apply (rule ImageI[where a=\"simInit a (envObs a s)\"])\n        apply auto\n        done\n    next\n      case (tStep t s)\n      hence tsC: \"t \\<leadsto> s \\<in> jkbpC\"\n        and ec: \"ec = sim_equiv_class a (t \\<leadsto> s)\"\n        and \"sim_equiv_class a t\n           \\<in> simAbs ` DFS.reachable k_succs (set (k_frontier a))\"\n        by auto\n      then obtain rect\n        where rect: \"rect \\<in> DFS.reachable k_succs (set (k_frontier a))\"\n          and srect: \"simAbs rect = sim_equiv_class a t\"\n        by auto\n      from tsC ec srect\n      have \"ec \\<in> simAbs ` set (simTrans a rect)\"\n        using simTrans[rule_format, where a=a and t=\"t\" and ec=\"rect\"] srect by auto\n      then obtain rec\n        where rec: \"ec = simAbs rec\"\n          and F: \"rec \\<in> set (simTrans a rect)\"\n        by auto\n      from rect obtain rec0\n        where rec0: \"rec0 \\<in> set (k_frontier a)\"\n          and rec0rect: \"(rec0, rect) \\<in> ({ (x, y). y \\<in> set (k_succs x)})\\<^sup>*\"\n        unfolding KBPAlg.reachable_def by auto\n      show ?case\n        apply -\n        apply (rule image_eqI[where x=\"rec\"])\n         apply (rule rec)\n        unfolding KBPAlg.reachable_def\n        apply (rule ImageI[where a=\"rec0\"])\n         apply (rule rtrancl_into_rtrancl[where b=\"rect\"])\n          apply (rule rec0rect)\n         apply clarsimp\n         apply (rule F)\n         apply (rule rec0)\n         done\n     qed\n   qed\nqed\n(*>*)\ntext\\<open>\n\nLeft to right follows from an induction on the reflexive, transitive\nclosure, and right to left by induction over canonical traces.\n\nThis result immediately yields the same result at the level of\nrepresentations:\n\n\\<close>\n\nlemma k_memb_rep:\n  assumes N: \"k_isNode rec\"\n  shows \"k_memb rec k_dfs\"\n(*<*)\nproof -\n  from N obtain rec'\n    where r: \"rec' \\<in> DFS.reachable k_succs (set (k_frontier a))\"\n      and rec': \"simAbs rec = simAbs rec'\"\n    unfolding k_isNode_def by (auto iff: k_reachable[symmetric])\n\n  from N k_isNode_cong[OF rec', symmetric]\n  have N': \"k_isNode rec'\"\n    unfolding k_isNode_def by auto\n\n  show \"k_memb rec k_dfs\"\n    using KBPAlg.reachable_imp_dfs[OF N' k_frontier_is_node r]\n    apply clarsimp\n    apply (subst k_memb_def)\n    apply (subst (asm) k_memb_def)\n    using k_invariantAOD[OF N' N rec' k_dfs_invariant, symmetric]\n    apply (cut_tac ec=y' and ec'=rec' in k_invariantAOD[OF _ _ _ k_dfs_invariant, symmetric])\n     apply simp_all\n\n     apply (cut_tac ec=rec' and ec'=y' in k_isNode_cong)\n     apply simp\n     using N'\n     apply simp\n     apply (rule N')\n     done\nqed\n(*>*)\n\nend (* context AlgorithmForAgent *)\n\ntext\\<open>\n\nThis concludes our agent-specific reasoning; we now show that the\nalgorithm works for all agents. The following command generalises all\nour lemmas in the @{term \"AlgorithmForAgent\"} to the @{term\n\"Algorithm\"} locale, giving them the mandatory prefix \\<open>KBP\\<close>:\n\n\\<close>\n\nsublocale Algorithm\n        < KBP: AlgorithmForAgent\n            jkbp envInit envAction envTrans envVal jview envObs\n            jviewInit jviewIncr simf simRels simVal simAbs simObs\n            simInit simTrans simAction aOps tOps a for a\n(*<*)\n  by unfold_locales\n(*>*)\n\ncontext Algorithm\nbegin\n\nabbreviation\n  \"k_mkAlgAuto \\<equiv>\n    mkAlgAuto aOps tOps simObs simInit simTrans simAction k_frontier\"\n(*<*)\n\nlemma k_mkAlgAuto_mkAutoSim_equiv:\n  assumes tC: \"t \\<in> jkbpC\"\n  shows \"simAbs (runJP k_mkAlgAuto t a) = simAbs (runJP mkAutoSim t a)\"\nusing tC\nproof(induct t)\n  case (tInit s) thus ?case by simp\nnext\n  case (tStep t s)\n  hence tC: \"t \\<in> jkbpC\" by blast\n\n  from tStep\n  have N: \"KBP.k_isNode a (runJP k_mkAlgAuto t a)\"\n    unfolding KBP.k_isNode_def\n    by (simp only: mkAutoSim_ec) auto\n\n  from tStep\n  have ect: \"simAbs (runJP k_mkAlgAuto t a) = sim_equiv_class a t\"\n    by (simp only: mkAutoSim_ec) auto\n\n  from tStep\n  have \"sim_equiv_class a (t \\<leadsto> s) \\<in> simAbs ` set (simTrans a (runJP k_mkAlgAuto t a))\"\n    using simTrans[rule_format, where a=a and t=t] tC ect by auto\n  then obtain ec\n    where ec: \"ec \\<in> set (simTrans a (runJP k_mkAlgAuto t a))\"\n      and sec: \"simAbs ec = sim_equiv_class a (t \\<leadsto> s)\"\n    by auto\n\n  from tStep\n  have F: \"envObs a s \\<in> simObs a ` set (simTrans a (runJP k_mkAlgAuto t a))\"\n    using simObs[rule_format, where a=a and t=\"t\\<leadsto>s\", symmetric] sec ec by auto\n  from KBP.k_memb_rep[OF N]\n  have E: \"KBP.k_memb (runJP k_mkAlgAuto t a) (KBP.k_dfs a)\" by blast\n\n  have G: \"simAbs (runJP k_mkAlgAuto (t \\<leadsto> s) a) = sim_equiv_class a (t \\<leadsto> s)\"\n    using KBP.k_invariantTD[OF N E F KBP.k_dfs_invariant]\n    apply (clarsimp simp: jviewIncr)\n    using simTrans[rule_format, where a=a and t=t and ec=\"runJP k_mkAlgAuto t a\"] tC ect\n    apply (subgoal_tac \"simAbs x \\<in> simAbs ` set (simTrans a (runJP k_mkAlgAuto t a))\")\n     apply (clarsimp simp: jviewIncr)\n     apply (cut_tac a=a and ec=ec' and t=\"t'\\<leadsto>sa\" in simObs[rule_format])\n      apply (simp add: jviewIncr)\n     apply simp\n    apply blast\n    done\n\n  from tStep show ?case by (simp only: G mkAutoSim_ec)\nqed\n\n(*>*)\ntext\\<open>\n\nRunning the automata produced by the DFS on a canonical trace @{term\n\"t\"} yields some representation of the expected equivalence class:\n\n\\<close>\n\nlemma k_mkAlgAuto_ec:\n  assumes tC: \"t \\<in> jkbpC\"\n  shows \"simAbs (runJP k_mkAlgAuto t a) = sim_equiv_class a t\"\n(*<*)\n  using k_mkAlgAuto_mkAutoSim_equiv[OF tC] mkAutoSim_ec[OF tC]\n  by simp\n\n(*>*)\ntext\\<open>\n\nThis involves an induction over the canonical trace @{term \"t\"}.\n\nThat the DFS and @{term \"mkAutoSim\"} yield the same actions on\ncanonical traces follows immediately from this result and the\ninvariant:\n\n\\<close>\n\nlemma k_mkAlgAuto_mkAutoSim_act_eq:\n  assumes tC: \"t \\<in> jkbpC\"\n  shows \"set \\<circ> actJP k_mkAlgAuto t = set \\<circ> actJP mkAutoSim t\"\n(*<*)\nproof\n  fix a\n  let ?ec = \"sim_equiv_class a t\"\n  let ?rec = \"runJP k_mkAlgAuto t a\"\n\n  from tC have E: \"?ec \\<in> sim_equiv_class a ` jkbpC\"\n    by auto\n\n  from tC E have N: \"KBP.k_isNode a (runJP k_mkAlgAuto t a)\"\n    unfolding KBP.k_isNode_def by (simp add: k_mkAlgAuto_ec[OF tC])\n\n  from KBP.k_memb_rep[OF N]\n  have E: \"KBP.k_memb ?rec (KBP.k_dfs a)\" by blast\n\n  obtain acts\n    where \"lookup aOps (aActs (KBP.k_dfs a)) ?rec = Some acts\"\n      and \"set acts = set (simAction a ?rec)\"\n    using KBP.k_invariantAD[OF N E KBP.k_dfs_invariant] by blast\n\n  thus \"(set \\<circ> actJP k_mkAlgAuto t) a = (set \\<circ> actJP mkAutoSim t) a\"\n    by (auto intro!: jAction_simAbs_cong[OF tC]\n               simp: k_mkAlgAuto_ec[OF tC] mkAutoSim_ec[OF tC])\nqed\n(*>*)\n\ntext\\<open>\n\nTherefore these two constructions are behaviourally equivalent, and so\nthe DFS generates an implementation of @{term \"jkbp\"} in the given\nenvironment:\n\n\\<close>\n\ntheorem k_mkAlgAuto_implements: \"implements k_mkAlgAuto\"\n(*<*)\nproof -\n  have \"behaviourally_equiv mkAutoSim k_mkAlgAuto\"\n    by rule (simp only: k_mkAlgAuto_mkAutoSim_act_eq)\n  with mkAutoSim_implements show ?thesis\n    by (simp add: behaviourally_equiv_implements)\nqed\n(*>*)\n\nend (* context Algorithm *)\n\ntext\\<open>\n\nClearly the automata generated by this algorithm are large. We discuss\nthis issue in \\S\\ref{sec:kbps-alg-auto-min}.\n\n\\FloatBarrier\n\n\\<close>\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/KBPs/KBPsAlg.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494678483918, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.31623421443846256}}
{"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchVSpaceEntries_AI\nimports \"../VSpaceEntries_AI\"\nbegin\n\n\ncontext Arch begin global_naming ARM (*FIXME: arch_split*)\n\nlemma a_type_pdD:\n  \"a_type ko = AArch APageDirectory \\<Longrightarrow> \\<exists>pd. ko = ArchObj (PageDirectory pd)\"\n  by (clarsimp)\n\nprimrec\n  pde_range_sz :: \"pde \\<Rightarrow> nat\"\nwhere\n    \"pde_range_sz (InvalidPDE) = 0\"\n  | \"pde_range_sz (SectionPDE ptr x y z) = 0\"\n  | \"pde_range_sz (SuperSectionPDE ptr x z) = 4\"\n  | \"pde_range_sz (PageTablePDE ptr x z) = 0\"\n\nprimrec\n  pte_range_sz :: \"pte \\<Rightarrow> nat\"\nwhere\n    \"pte_range_sz (InvalidPTE) = 0\"\n  | \"pte_range_sz (LargePagePTE ptr x y) = 4\"\n  | \"pte_range_sz (SmallPagePTE ptr x y) = 0\"\n\nprimrec\n  pde_range :: \"pde \\<Rightarrow> 12 word \\<Rightarrow> 12 word set\"\nwhere\n    \"pde_range (InvalidPDE) p = {}\"\n  | \"pde_range (SectionPDE ptr x y z) p = {p}\"\n  | \"pde_range (SuperSectionPDE ptr x z) p =\n     (if is_aligned p 4 then {x. x && ~~ mask 4 = p && ~~ mask 4} else {p})\"\n  | \"pde_range (PageTablePDE ptr x z) p = {p}\"\n\nprimrec\n  pte_range :: \"pte \\<Rightarrow> word8 \\<Rightarrow> word8 set\"\nwhere\n    \"pte_range (InvalidPTE) p = {}\"\n  | \"pte_range (LargePagePTE ptr x y) p =\n       (if is_aligned p 4 then {x. x && ~~ mask 4 = p && ~~ mask 4} else {p})\"\n  | \"pte_range (SmallPagePTE ptr x y) p = {p}\"\n\nabbreviation \"valid_pt_entries \\<equiv> \\<lambda>pt. valid_entries pte_range pt\"\n\nabbreviation \"valid_pd_entries \\<equiv> \\<lambda>pd. valid_entries pde_range pd\"\n\ndefinition\n  obj_valid_pdpt :: \"kernel_object \\<Rightarrow> bool\"\nwhere\n \"obj_valid_pdpt obj \\<equiv> case obj of\n    ArchObj (PageTable pt) \\<Rightarrow> valid_pt_entries pt \\<and> entries_align pte_range_sz pt\n  | ArchObj (PageDirectory pd) \\<Rightarrow> valid_pd_entries pd \\<and> entries_align pde_range_sz pd\n  | _ \\<Rightarrow> True\"\n\nlemmas obj_valid_pdpt_simps[simp]\n    = obj_valid_pdpt_def\n        [split_simps Structures_A.kernel_object.split\n                     arch_kernel_obj.split]\n\nabbreviation\n  valid_pdpt_objs :: \"'z state \\<Rightarrow> bool\"\nwhere\n \"valid_pdpt_objs s \\<equiv> \\<forall>x \\<in> ran (kheap s). obj_valid_pdpt x\"\n\nlemma valid_pdpt_init[iff]:\n  \"valid_pdpt_objs init_A_st\"\nproof -\n  have P: \"valid_pd_entries (global_pd :: 12 word \\<Rightarrow> _)\"\n    by (clarsimp simp: valid_entries_def)\n  also have Q: \"entries_align pde_range_sz (global_pd :: 12 word \\<Rightarrow> _)\"\n    by (clarsimp simp: entries_align_def)\n  thus ?thesis using P\n    by (auto simp: init_A_st_def init_kheap_def\n            elim!: ranE split: if_split_asm)\nqed\n\nlemma set_object_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and K (obj_valid_pdpt obj)\\<rbrace>\n      set_object ptr obj\n   \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: set_object_def get_object_def, wp)\n  apply (auto simp: fun_upd_def[symmetric] del: ballI elim: ball_ran_updI)\n  done\n\ncrunch valid_pdpt_objs[wp]: cap_insert, cap_swap_for_delete,empty_slot \"valid_pdpt_objs\"\n  (wp: crunch_wps simp: crunch_simps ignore:set_object)\n\ncrunch valid_pdpt_objs[wp]: flush_page \"valid_pdpt_objs\"\n  (wp: crunch_wps simp: crunch_simps)\n\nlemma shift_0x3C_set:\n  \"\\<lbrakk> is_aligned p 6; 8 \\<le> bits; bits < 32; len_of TYPE('a) = bits - 2 \\<rbrakk> \\<Longrightarrow>\n   (\\<lambda>x. ucast (x + p && mask bits >> 2) :: ('a :: len) word) ` set [0 :: word32 , 4 .e. 0x3C]\n        = {x. x && ~~ mask 4 = ucast (p && mask bits >> 2)}\"\n  apply (clarsimp simp: upto_enum_step_def word_shift_by_2 image_image)\n  apply (subst image_cong[where N=\"{x. x < 2 ^ 4}\"])\n    apply (safe, simp_all)[1]\n     apply (drule plus_one_helper2, simp_all)[1]\n    apply (drule word_le_minus_one_leq, simp_all)[1]\n   apply (rule_tac f=\"\\<lambda>x. ucast (x && mask bits >> 2)\" in arg_cong)\n   apply (rule trans[OF add.commute is_aligned_add_or], assumption)\n   apply (rule shiftl_less_t2n, simp_all)[1]\n  apply safe\n   apply (frule upper_bits_unset_is_l2p_32[THEN iffD2, rotated])\n    apply (simp add: word_bits_conv)\n   apply (rule word_eqI)\n   apply (simp add: word_ops_nth_size word_size nth_ucast nth_shiftr\n                    nth_shiftl neg_mask_test_bit\n                    word_bits_conv)\n   apply (safe, simp_all add: is_aligned_nth)[1]\n   apply (drule_tac x=\"Suc (Suc n)\" in spec)\n   apply simp\n  apply (rule_tac x=\"ucast x && mask 4\" in image_eqI)\n   apply (rule word_eqI[rule_format])\n   apply (drule_tac x=n in word_eqD)\n   apply (simp add: word_ops_nth_size word_size nth_ucast nth_shiftr\n                    nth_shiftl)\n   apply (safe, simp_all)\n  apply (rule order_less_le_trans, rule and_mask_less_size)\n   apply (simp_all add: word_size)\n  done\n\nlemma mapM_x_store_pte_updates:\n  \"\\<forall>x \\<in> set xs. f x && ~~ mask pt_bits = p \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. (\\<not> page_table_at p s \\<longrightarrow> Q s) \\<and>\n        (\\<forall>pt. ko_at (ArchObj (PageTable pt)) p s\n           \\<longrightarrow> Q (s \\<lparr> kheap := (kheap s) (p := Some (ArchObj (PageTable (\\<lambda>y. if y \\<in> (\\<lambda>x.\n         ucast (f x && mask pt_bits >> 2)) ` set xs then pte else pt y)))) \\<rparr>))\\<rbrace>\n     mapM_x (\\<lambda>x. store_pte (f x) pte) xs\n   \\<lbrace>\\<lambda>_. Q\\<rbrace>\"\n  apply (induct xs)\n   apply (simp add: mapM_x_Nil)\n   apply wp\n   apply (clarsimp simp: obj_at_def fun_upd_idem)\n  apply (simp add: mapM_x_Cons)\n  apply (rule hoare_seq_ext, assumption)\n  apply (thin_tac \"valid P f Q\" for P f Q)\n  apply (simp add: store_pte_def set_pt_def set_object_def)\n  apply (wp get_pt_wp get_object_wp)\n  apply (clarsimp simp: obj_at_def a_type_simps)\n  apply (erule rsubst[where P=Q])\n  apply (rule abstract_state.fold_congs[OF refl refl])\n  apply (rule ext, clarsimp)\n  apply (rule ext, clarsimp)\n  done\n\nlemma valid_pt_entries_invalid[simp]:\n  \"valid_pt_entries (\\<lambda>x. InvalidPTE)\"\n   by (simp add:valid_entries_def)\n\nlemma valid_pd_entries_invalid[simp]:\n  \"valid_pd_entries (\\<lambda>x. InvalidPDE)\"\n  by (simp add:valid_entries_def)\n\nlemma entries_align_pte_update:\n \"\\<lbrakk>entries_align pte_range_sz pt;\n  (\\<forall>y. (P y) \\<longrightarrow> is_aligned y (pte_range_sz pte))\\<rbrakk>\n  \\<Longrightarrow> entries_align pte_range_sz (\\<lambda>y. if (P y) then pte else pt y)\"\n  by (simp add:entries_align_def)\n\nlemma entries_align_pde_update:\n \"\\<lbrakk>entries_align pde_range_sz pd;\n  (\\<forall>y. (P y) \\<longrightarrow> is_aligned y (pde_range_sz pde))\\<rbrakk>\n  \\<Longrightarrow> entries_align pde_range_sz (\\<lambda>y. if (P y) then pde else pd y)\"\n  by (simp add:entries_align_def)\n\n\nlemma valid_pdpt_objs_pdD:\n  \"\\<lbrakk>valid_pdpt_objs s;\n    kheap s ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pd))\\<rbrakk>\n   \\<Longrightarrow> valid_pd_entries pd \\<and> entries_align pde_range_sz pd\"\n  by (fastforce simp:ran_def)\n\nlemma valid_pdpt_objs_ptD:\n  \"\\<lbrakk>valid_pdpt_objs s;\n    kheap s ptr = Some (ArchObj (arch_kernel_obj.PageTable pt))\\<rbrakk>\n   \\<Longrightarrow> valid_pt_entries pt \\<and> entries_align pte_range_sz pt\"\n  by (fastforce simp:ran_def)\n\nlemma mapM_x_store_invalid_pte_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and K (is_aligned p 6) \\<rbrace>\n     mapM_x (\\<lambda>x. store_pte (x + p) InvalidPTE) [0, 4 .e. 0x3C]\n   \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)+\n  apply (rule hoare_pre, rule_tac p=\"p && ~~ mask pt_bits\" in mapM_x_store_pte_updates)\n   apply clarsimp\n   apply (rule mask_out_first_mask_some[where n=6])\n    apply (drule_tac d=x in is_aligned_add_helper)\n     apply (drule subsetD[OF upto_enum_step_subset])\n     apply simp\n     apply (erule order_le_less_trans, simp)\n    apply (simp add: field_simps)\n   apply (simp add: pt_bits_def pageBits_def)\n  apply (clarsimp simp: ranI elim!: ranE split: if_split_asm)\n  apply (intro conjI)\n   apply (simp add: shift_0x3C_set pt_bits_def pageBits_def)\n   apply (rule valid_entries_overwrite_groups\n    [where S = \"{x. x && ~~ mask 4 = ucast (p && mask 10 >> 2)}\"])\n      apply (fastforce simp add: obj_at_def ran_def)\n     apply simp\n    apply clarsimp\n    apply (case_tac v)\n      apply (simp split:if_splits)+\n   apply (clarsimp)\n   apply (case_tac v, simp_all split:if_splits)\n    apply (intro conjI impI)\n     apply (rule disjointI)\n     apply (clarsimp)+\n  apply (rule entries_align_pte_update)\n   apply (clarsimp simp:obj_at_def)\n   apply (drule(1) valid_pdpt_objs_ptD)\n   apply simp\n  apply (simp)\n  done\n\nlemma mapM_x_store_pde_updates:\n  \"\\<forall>x \\<in> set xs. f x && ~~ mask pd_bits = p \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. (\\<not> page_directory_at p s \\<longrightarrow> Q s) \\<and>\n        (\\<forall>pd. ko_at (ArchObj (PageDirectory pd)) p s\n           \\<longrightarrow> Q (s \\<lparr> kheap := (kheap s) (p := Some (ArchObj (PageDirectory (\\<lambda>y. if y \\<in> (\\<lambda>x.\n         ucast (f x && mask pd_bits >> 2)) ` set xs then pde else pd y)))) \\<rparr>))\\<rbrace>\n     mapM_x (\\<lambda>x. store_pde (f x) pde) xs\n   \\<lbrace>\\<lambda>_. Q\\<rbrace>\"\n  apply (induct xs)\n   apply (simp add: mapM_x_Nil)\n   apply wp\n   apply (clarsimp simp: obj_at_def fun_upd_idem)\n  apply (simp add: mapM_x_Cons)\n  apply (rule hoare_seq_ext, assumption)\n  apply (thin_tac \"valid P f Q\" for P f Q)\n  apply (simp add: store_pde_def set_pd_def set_object_def)\n  apply (wp get_pd_wp get_object_wp)\n  apply (clarsimp simp: obj_at_def a_type_simps)\n  apply (erule rsubst[where P=Q])\n  apply (rule abstract_state.fold_congs[OF refl refl])\n  apply (rule ext, clarsimp)\n  apply (rule ext, clarsimp)\n  done\n\nlemma mapM_x_store_pde_valid_pdpt_objs:\n  \"\\<lbrace>valid_pdpt_objs and K (is_aligned p 6)\\<rbrace>\n     mapM_x (\\<lambda>x. store_pde (x + p) InvalidPDE) [0, 4 .e. 0x3C]\n   \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)+\n  apply (rule hoare_pre, rule_tac p=\"p && ~~ mask pd_bits\" in mapM_x_store_pde_updates)\n   apply clarsimp\n   apply (rule mask_out_first_mask_some[where n=6])\n    apply (drule_tac d=x in is_aligned_add_helper)\n     apply (drule subsetD[OF upto_enum_step_subset])\n     apply simp\n     apply (erule order_le_less_trans, simp)\n    apply (simp add: field_simps)\n   apply (simp add: pd_bits_def pageBits_def)\n  apply (clarsimp simp: ranI elim!: ranE split: if_split_asm)\n  apply (simp add: shift_0x3C_set pd_bits_def pageBits_def)\n  apply (rule conjI)\n   apply (rule_tac valid_entries_overwrite_groups\n    [where S = \"{x. x && ~~ mask 4 = ucast (p && mask 14 >> 2)}\"])\n      apply (fastforce simp add: obj_at_def ran_def)\n     apply fastforce\n    apply clarsimp\n    apply (case_tac v, simp_all split:if_splits)\n    apply clarsimp\n    apply (case_tac v, simp_all split:if_splits)\n   apply (intro conjI impI allI)\n   apply (rule disjointI)\n   apply clarsimp\n  apply (rule entries_align_pde_update)\n   apply (clarsimp simp:obj_at_def)\n   apply (drule valid_pdpt_objs_pdD)\n    apply (simp add:pd_bits_def pageBits_def)\n   apply simp\n  apply simp\n  done\n\nlemma store_invalid_pde_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and\n    (\\<lambda>s. \\<forall>pd. ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits) s\n      \\<longrightarrow> pde = InvalidPDE)\\<rbrace>\n       store_pde p pde \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: store_pde_def set_pd_def, wp get_object_wp)\n  apply (clarsimp simp: obj_at_def)\n   apply (intro conjI)\n   apply (rule valid_entries_overwrite_0, simp_all)\n   apply (fastforce simp: ran_def)\n  apply (simp add:fun_upd_def)\n  apply (rule entries_align_pde_update)\n   apply (drule(1) valid_pdpt_objs_pdD)\n   apply simp\n  apply simp\n  done\n\nlemma store_pde_non_master_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and\n        (\\<lambda>s. \\<forall>pd. ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits) s\n        \\<longrightarrow> (pde_range_sz (pd (ucast (p && mask pd_bits >> 2) && ~~ mask 4)) = 0\n        \\<and> pde_range_sz pde = 0))\\<rbrace>\n       store_pde p pde \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: store_pde_def set_pd_def, wp get_object_wp)\n  apply (clarsimp simp: obj_at_def)\n  apply (intro conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply (fastforce simp:ran_def)\n   apply (drule bspec)\n    apply fastforce\n   apply (case_tac \"pd pa\")\n    apply simp_all\n     apply (case_tac pde,simp_all)\n    apply (case_tac pde,simp_all)\n   apply (case_tac pde,simp_all)\n    apply (clarsimp simp: is_aligned_neg_mask_eq)+\n  apply (simp add:fun_upd_def)\n  apply (rule entries_align_pde_update)\n   apply (drule(1) valid_pdpt_objs_pdD,simp)\n  apply simp\n  done\n\nlemma store_invalid_pte_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and\n        (\\<lambda>s. \\<forall>pt. ko_at (ArchObj (PageTable pt)) (p && ~~ mask pt_bits) s\n        \\<longrightarrow> pte = InvalidPTE)\\<rbrace>\n       store_pte p pte \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: store_pte_def set_pt_def, wp get_object_wp)\n  apply (clarsimp simp: obj_at_def)\n   apply (intro conjI)\n   apply (rule valid_entries_overwrite_0, simp_all)\n   apply (fastforce simp: ran_def)\n  apply (simp add:fun_upd_def)\n  apply (rule entries_align_pte_update)\n   apply (drule (1) valid_pdpt_objs_ptD,simp)\n  apply simp\n  done\n\nlemma store_pte_non_master_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and\n        (\\<lambda>s. \\<forall>pt. ko_at (ArchObj (PageTable pt)) (p && ~~ mask pt_bits) s\n        \\<longrightarrow> (pte_range_sz (pt (ucast (p && mask pt_bits >> 2) && ~~ mask 4)) = 0\n        \\<and> pte_range_sz pte = 0))\\<rbrace>\n       store_pte p pte \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: store_pte_def set_pt_def, wp get_object_wp)\n  apply (clarsimp simp: obj_at_def)\n  apply (intro conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply (fastforce simp:ran_def)\n   apply (drule bspec)\n    apply fastforce\n   apply (case_tac \"pt pa\")\n     apply simp\n    apply (case_tac pte,simp_all)\n    apply (clarsimp simp: is_aligned_neg_mask_eq)\n   apply (case_tac pte,simp_all)\n  apply (simp add:fun_upd_def)\n  apply (rule entries_align_pte_update)\n   apply (drule (1) valid_pdpt_objs_ptD,simp)\n  apply simp\n  done\n\nlemma unmap_page_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> unmap_page sz asid vptr pptr \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: unmap_page_def mapM_discarded\n             cong: vmpage_size.case_cong)\n  apply (wp)\n    prefer 2\n    apply (rule valid_validE[OF find_pd_for_asid_inv])\n   apply (rule hoare_pre)\n    apply (wp get_object_wp get_pte_wp get_pde_wp lookup_pt_slot_inv_any\n              store_invalid_pte_valid_pdpt\n              store_invalid_pde_valid_pdpt\n              mapM_x_store_invalid_pte_valid_pdpt mapM_x_store_pde_valid_pdpt_objs\n                 | simp add: mapM_x_map\n                 | wpc | simp add: check_mapping_pptr_def)+\n   apply (simp add: fun_upd_def[symmetric] is_aligned_mask[symmetric])\n  apply assumption\n  done\n\ncrunch valid_pdpt_objs[wp]: flush_table \"valid_pdpt_objs\"\n  (wp: crunch_wps simp: crunch_simps)\n\ncrunch kheap[wp]: flush_table \"\\<lambda>s. P (kheap s)\"\n  (wp: crunch_wps simp: crunch_simps)\n\nlemma unmap_page_table_valid_pdpt_objs[wp]:\n  notes hoare_pre [wp_pre del]\n  shows \"\\<lbrace>valid_pdpt_objs\\<rbrace> unmap_page_table asid vptr pt \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: unmap_page_table_def)\n  apply (wp get_object_wp store_invalid_pde_valid_pdpt | wpc)+\n  apply (simp add: obj_at_def)\n  apply (simp add: page_table_mapped_def)\n  apply (wp get_pde_wp | wpc)+\n  apply simp\n  apply (rule hoare_post_impErr, rule valid_validE,\n         rule find_pd_for_asid_inv, simp_all)\n  done\n\nlemma set_simple_ko_valid_pdpt_objs[wp]:\n   \"\\<lbrace>\\<lambda>s. \\<forall>x\\<in>ran (kheap s). obj_valid_pdpt x\\<rbrace>\n       set_simple_ko param_a param_b param_c \\<lbrace>\\<lambda>_ s. \\<forall>x\\<in>ran (kheap s). obj_valid_pdpt x\\<rbrace>\"\n  unfolding set_simple_ko_def\n  by (wpsimp wp: set_object_valid_pdpt[THEN hoare_set_object_weaken_pre] get_object_wp\n           simp: a_type_def obj_valid_pdpt_def obj_at_def\n          split: kernel_object.splits)\n\ncrunch valid_pdpt_objs[wp]: finalise_cap, cap_swap_for_delete, empty_slot \"valid_pdpt_objs\"\n  (wp: crunch_wps select_wp preemption_point_inv simp: crunch_simps unless_def ignore:set_object)\n\nlemma preemption_point_valid_pdpt_objs[wp]:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> preemption_point \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  by (wp preemption_point_inv | simp)+\n\nlemmas cap_revoke_preservation_valid_pdpt_objs = cap_revoke_preservation[OF _,\n                                                          where E=valid_pdpt_objs,\n                                                          simplified, THEN validE_valid]\n\nlemmas rec_del_preservation_valid_pdpt_objs = rec_del_preservation[OF _ _ _ _,\n                                                    where P=valid_pdpt_objs, simplified]\n\ncrunch valid_pdpt_objs[wp]: cap_delete, cap_revoke \"valid_pdpt_objs\"\n  (rule: rec_del_preservation_valid_pdpt_objs cap_revoke_preservation_valid_pdpt_objs)\n\ncrunch valid_pdpt_objs[wp]: invalidate_tlb_by_asid, page_table_mapped\n   \"valid_pdpt_objs\"\n\nlemma mapM_x_copy_pde_updates:\n  \"\\<lbrakk> \\<forall>x \\<in> set xs. f x && ~~ mask pd_bits = 0; is_aligned p pd_bits;\n               is_aligned p' pd_bits \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. (\\<not> page_directory_at p s \\<longrightarrow> Q s) \\<and> (\\<not> page_directory_at p' s \\<longrightarrow> Q s) \\<and>\n        (\\<forall>pd pd'. ko_at (ArchObj (PageDirectory pd)) p s\n                \\<and> ko_at (ArchObj (PageDirectory pd')) p' s\n           \\<longrightarrow> Q (s \\<lparr> kheap := (kheap s) (p' := Some (ArchObj (PageDirectory (\\<lambda>y. if y \\<in> (\\<lambda>x.\n         ucast (f x && mask pd_bits >> 2)) ` set xs then pd y else pd' y)))) \\<rparr>))\\<rbrace>\n     mapM_x (\\<lambda>x. get_pde (p + f x) >>= store_pde (p' + f x)) xs\n   \\<lbrace>\\<lambda>_. Q\\<rbrace>\"\n  apply (induct xs)\n   apply (simp add: mapM_x_Nil)\n   apply wp\n   apply (clarsimp simp: obj_at_def fun_upd_idem dest!: a_type_pdD)\n  apply (simp add: mapM_x_Cons)\n  apply wp\n   apply (thin_tac \"valid P f Q\" for P f Q)\n   apply (simp add: store_pde_def set_pd_def set_object_def\n              cong: bind_cong split del: if_split)\n   apply (wp get_object_wp get_pde_wp)\n  apply (clarsimp simp: obj_at_def a_type_simps mask_out_add_aligned[symmetric]\n             split del: if_split)\n  apply (simp add: a_type_simps, safe)\n   apply (erule rsubst[where P=Q])\n   apply (rule abstract_state.fold_congs[OF refl refl])\n   apply (rule ext, clarsimp)\n   apply (rule ext, simp)\n  apply (erule rsubst[where P=Q])\n  apply (rule abstract_state.fold_congs[OF refl refl])\n  apply (rule ext, clarsimp)\n  apply (rule ext, simp add: mask_add_aligned)\n  done\n\nlemma copy_global_mappings_valid_pdpt_objs[wp]:\n  notes hoare_pre [wp_pre del]\n  shows\n  \"\\<lbrace>valid_pdpt_objs and valid_arch_state and pspace_aligned\n            and K (is_aligned p pd_bits)\\<rbrace>\n       copy_global_mappings p \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)\n  apply (simp add: copy_global_mappings_def)\n  apply wp\n   apply (rule_tac P=\"is_aligned global_pd pd_bits\" in hoare_gen_asm)\n   apply (rule mapM_x_copy_pde_updates, simp_all)\n   apply (clarsimp simp: mask_eq_x_eq_0[symmetric])\n   apply (rule less_mask_eq, rule shiftl_less_t2n,\n          simp_all add: pd_bits_def pageBits_def)[1]\n   apply (drule plus_one_helper2, simp+)\n  apply wp\n  apply (clarsimp simp: invs_aligned_pdD ranI\n                 elim!: ranE split: if_split_asm)\n  apply (intro conjI)\n   apply (rule_tac S=\"{x. ucast x \\<ge> (kernel_base >> 20)}\"\n                 in valid_entries_partial_copy)\n      apply (fastforce simp: obj_at_def ran_def)\n     apply (fastforce simp: obj_at_def ran_def)\n    apply (clarsimp simp:image_def)\n    apply (subst (asm) less_mask_eq)\n     apply (rule shiftl_less_t2n)\n      apply (simp add:pd_bits_def pageBits_def word_le_make_less)\n     apply (simp add:pd_bits_def pageBits_def)\n    apply (subst (asm) shiftl_shiftr1)\n     apply simp\n    apply (simp add:word_size)\n    apply (subst (asm) less_mask_eq)\n     apply (simp add:pd_bits_def pageBits_def le_less_trans)\n    apply (case_tac v)\n      apply (simp add:ucast_ucast_len pd_bits_def pageBits_def le_less_trans)+\n    apply (clarsimp split:if_splits)\n     apply (simp add:kernel_base_shift_cast_le)\n     apply (simp add:kernel_base_def)\n     apply (cut_tac y1 = xb and x1 = \"0xE00::12 word\" in ucast_le_migrate[THEN iffD1,rotated -1])\n        apply simp\n       apply (simp add:word_size le_less_trans)\n      apply (simp add:word_size)\n     apply (drule aligned_le_sharp[where n = 4 and a = \"0xE00::12 word\"])\n      apply (simp add:kernel_base_def is_aligned_def)\n     apply (erule order_trans)\n     apply (erule subst)\n     apply (simp add:word_and_le2)\n    apply (subst ucast_ucast_len)\n     apply (simp,word_bitwise)\n    apply simp\n   apply (clarsimp simp:image_def)\n   apply (rule disjointI)\n   apply clarsimp\n   apply (drule_tac x = \"ucast x\" in spec)\n   apply (erule impE)\n    apply (simp add:pd_bits_def pageBits_def)\n    apply word_bitwise\n   apply (subgoal_tac \"kernel_base >> 20 \\<le> ucast x\")\n    apply simp\n    apply (subst (asm) less_mask_eq)\n     apply (rule shiftl_less_t2n)\n      apply (simp add:pd_bits_def pageBits_def word_le_make_less)\n      apply word_bitwise\n     apply (simp add:pd_bits_def pageBits_def)\n    apply (subst (asm) shiftl_shiftr1)\n     apply simp\n    apply (simp add:word_size)\n    apply (subst (asm) less_mask_eq)\n     apply (rule less_le_trans[OF ucast_less])\n      apply simp\n     apply simp\n    apply word_bitwise\n   apply (case_tac v,simp_all)\n   apply (clarsimp split:if_splits)\n   apply (drule aligned_le_sharp[where n = 4])\n    apply (simp add:kernel_base_def is_aligned_def)\n   apply (simp add:word_size kernel_base_def pd_bits_def pageBits_def)\n   apply word_bitwise\n   apply simp\n  apply (clarsimp simp:obj_at_def)\n  apply (subst (asm) is_aligned_neg_mask_eq\n    [where p = p and n = pd_bits,symmetric])\n   apply simp\n  apply (drule(1) valid_pdpt_objs_pdD[rotated])+\n  apply (clarsimp simp:entries_align_def)\n  done\n\nlemma in_pte_rangeD:\n  \"x \\<in> pte_range v y \\<Longrightarrow> x && ~~ mask 4 = y && ~~ mask 4\"\n  by (case_tac v,simp_all split:if_splits)\n\nlemma in_pde_rangeD:\n  \"x \\<in> pde_range v y \\<Longrightarrow> x && ~~ mask 4 = y && ~~ mask 4\"\n  by (case_tac v,simp_all split:if_splits)\n\nlemma mapM_x_store_pte_valid_pdpt2:\n  \"\\<lbrace>valid_pdpt_objs and K (is_aligned ptr pt_bits)\\<rbrace>\n     mapM_x (\\<lambda>x. store_pte x InvalidPTE) [ptr, ptr + 4 .e. ptr + 2 ^ pt_bits - 1]\n   \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)+\n  apply (rule mapM_x_wp')\n  apply (simp add:store_pte_def set_pt_def)\n  apply (wp get_pt_wp get_object_wp)\n  apply (clarsimp simp: mask_in_range\n    split:Structures_A.kernel_object.splits\n    arch_kernel_obj.splits)\n  apply (rule conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply (fastforce simp:ran_def obj_at_def)\n   apply simp\n  apply (simp add:fun_upd_def obj_at_def)\n  apply (rule entries_align_pte_update)\n   apply (drule (1) valid_pdpt_objs_ptD,simp)\n  apply simp\n  done\n\nlemma mapM_x_store_pde_valid_pdpt2:\n  \"\\<lbrace>valid_pdpt_objs and K (is_aligned pd pd_bits)\\<rbrace>\n       mapM_x (\\<lambda>x. store_pde ((x << 2) + pd) pde.InvalidPDE)\n        [0.e.(kernel_base >> 20) - 1]\n       \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)\n  apply (rule mapM_x_wp')\n  apply (simp add:store_pde_def set_pd_def)\n  apply (wp get_pd_wp get_object_wp)\n  apply (clarsimp simp: mask_in_range\n    split:Structures_A.kernel_object.splits\n    arch_kernel_obj.splits)\n  apply (rule conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply (fastforce simp:ran_def obj_at_def)\n   apply simp\n  apply (simp add:fun_upd_def obj_at_def)\n  apply (rule entries_align_pde_update)\n   apply (drule (1) valid_pdpt_objs_pdD,simp)\n  apply simp\n  done\n\nlemma non_invalid_in_pde_range:\n  \"pde \\<noteq> InvalidPDE\n  \\<Longrightarrow> x \\<in> pde_range pde x\"\n  by (case_tac pde,simp_all)\n\nlemma non_invalid_in_pte_range:\n  \"pte \\<noteq> InvalidPTE\n  \\<Longrightarrow> x \\<in> pte_range pte x\"\n  by (case_tac pte,simp_all)\n\ncrunch valid_pdpt_objs[wp]: cancel_badged_sends \"valid_pdpt_objs\"\n  (simp: crunch_simps filterM_mapM wp: crunch_wps)\n\ncrunch valid_pdpt_objs[wp]: cap_move, cap_insert \"valid_pdpt_objs\"\n\nlemma invoke_cnode_valid_pdpt_objs[wp]:\n  \"\\<lbrace>valid_pdpt_objs and invs and valid_cnode_inv i\\<rbrace> invoke_cnode i \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: invoke_cnode_def)\n  apply (rule hoare_pre)\n   apply (wp get_cap_wp | wpc | simp split del: if_split)+\n  done\n\ncrunch valid_pdpt_objs[wp]: invoke_tcb \"valid_pdpt_objs\"\n  (wp: check_cap_inv crunch_wps simp: crunch_simps\n       ignore: check_cap_at)\n\nlemma invoke_domain_valid_pdpt_objs[wp]:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> invoke_domain t d \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  by (simp add: invoke_domain_def | wp)+\n\ncrunch valid_pdpt_objs[wp]: set_extra_badge, transfer_caps_loop \"valid_pdpt_objs\"\n  (rule: transfer_caps_loop_pres)\n\ncrunch valid_pdpt_objs[wp]: send_ipc, send_signal,\n    do_reply_transfer, invoke_irq_control, invoke_irq_handler \"valid_pdpt_objs\"\n  (wp: crunch_wps simp: crunch_simps\n         ignore: clearMemory const_on_failure set_object)\n\nlemma valid_pdpt_objs_trans_state[simp]: \"valid_pdpt_objs (trans_state f s) = valid_pdpt_objs s\"\n  apply (simp add: obj_valid_pdpt_def)\n  done\n\nlemma retype_region_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> retype_region ptr bits o_bits type dev \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: retype_region_def split del: if_split)\n  apply (wp | simp only: valid_pdpt_objs_trans_state trans_state_update[symmetric])+\n  apply (clarsimp simp: retype_addrs_fold foldr_upd_app_if ranI\n                 elim!: ranE split: if_split_asm simp del:fun_upd_apply)\n  apply (simp add: default_object_def default_arch_object_def\n            split: Structures_A.kernel_object.splits\n    Structures_A.apiobject_type.split aobject_type.split)+\n  apply (simp add:entries_align_def)\n  done\n\nlemma detype_valid_pdpt[elim!]:\n  \"valid_pdpt_objs s \\<Longrightarrow> valid_pdpt_objs (detype S s)\"\n  by (auto simp add: detype_def ran_def)\n\ncrunch valid_pdpt_objs[wp]: create_cap \"valid_pdpt_objs\"\n  (ignore: clearMemory simp: crunch_simps unless_def)\n\nlemma init_arch_objects_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and pspace_aligned and valid_arch_state\n           and K (\\<exists>us sz. orefs = retype_addrs ptr type n us\n               \\<and> range_cover ptr sz (obj_bits_api type us) n)\\<rbrace>\n     init_arch_objects type ptr n obj_sz orefs\n   \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)+\n  apply (clarsimp simp: init_arch_objects_def\n             split del: if_split)\n  apply (rule hoare_pre)\n   apply (wp | wpc)+\n     apply (rule_tac Q=\"\\<lambda>rv. valid_pdpt_objs and pspace_aligned and valid_arch_state\"\n                  in hoare_post_imp, simp)\n     apply (rule mapM_x_wp')\n     apply (rule hoare_pre, wp copy_global_mappings_valid_pdpt_objs)\n     apply clarsimp\n     apply (drule_tac sz=sz in retype_addrs_aligned)\n        apply (simp add:range_cover_def)\n       apply (drule range_cover.sz,simp add:word_bits_def)\n      apply (simp add:range_cover_def)\n     apply (clarsimp simp:obj_bits_api_def pd_bits_def pageBits_def\n       arch_kobj_size_def default_arch_object_def range_cover_def)+\n   apply wp\n  apply simp\n  done\n\nlemma delete_objects_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> delete_objects ptr bits \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  by (rule delete_objects_reduct) (wp detype_valid_pdpt)\n\ncrunch valid_pdpt[wp]: reset_untyped_cap \"valid_pdpt_objs\"\n  (wp: mapME_x_inv_wp crunch_wps simp: crunch_simps unless_def)\n\nlemma invoke_untyped_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and invs and ct_active\n          and valid_untyped_inv ui\\<rbrace>\n       invoke_untyped ui\n   \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_pre, rule invoke_untyped_Q)\n      apply (wp init_arch_objects_valid_pdpt | simp)+\n     apply (auto simp: post_retype_invs_def split: if_split_asm)[1]\n    apply (wp | simp)+\n  done\n\ncrunch valid_pdpt_objs[wp]: perform_asid_pool_invocation,\n     perform_asid_control_invocation \"valid_pdpt_objs\"\n  (ignore: delete_objects wp: delete_objects_valid_pdpt static_imp_wp)\n\nabbreviation (input)\n  \"safe_pt_range \\<equiv> \\<lambda>slots s. obj_at (\\<lambda>ko. \\<exists>pt. ko = ArchObj (PageTable pt)\n                                    \\<and> (\\<forall>x\\<in>set (tl slots). pt (ucast (x && mask pt_bits >> 2))\n                                      = pte.InvalidPTE))\n                              (hd slots && ~~ mask pt_bits) s\"\n\nabbreviation (input)\n  \"safe_pd_range \\<equiv> \\<lambda>slots s. obj_at (\\<lambda>ko. \\<exists>pd. ko = ArchObj (PageDirectory pd)\n                                    \\<and> (\\<forall>x\\<in>set (tl slots). pd (ucast (x && mask pd_bits >> 2))\n                                      = pde.InvalidPDE))\n                              (hd slots && ~~ mask pd_bits) s\"\n\ndefinition\n  \"page_inv_entries_pre entries \\<equiv>\n   let slots = (case entries of Inl (pte, slots) \\<Rightarrow> slots | Inr (pde, slots) \\<Rightarrow> slots)\n   in (if \\<exists>sl. slots = [sl]\n    then case entries of\n        Inl (pte, _) \\<Rightarrow> obj_at (\\<lambda>ko. \\<exists>pt pte. ko = ArchObj (PageTable pt)\n                     \\<and> pt (ucast (hd slots && mask pt_bits >> 2) && ~~ mask 4) = pte\n                     \\<and> pte_range_sz pte = 0)\n                 (hd slots && ~~ mask pt_bits)\n            and K (pte_range_sz pte = 0)\n      | Inr (pde, _) \\<Rightarrow> obj_at (\\<lambda>ko. \\<exists>pd pde. ko = ArchObj (PageDirectory pd)\n                     \\<and> pd (ucast (head slots && mask pd_bits >> 2) && ~~ mask 4)\n                            = pde \\<and> pde_range_sz pde = 0)\n                 (hd slots && ~~ mask pd_bits)\n           and K (pde_range_sz pde = 0)\n    else  (\\<lambda>s. (\\<exists>p. is_aligned p 6 \\<and> slots = map (\\<lambda>x. x + p) [0, 4 .e. 0x3C])))\n   and K (case entries of Inl (pte,slots) \\<Rightarrow> pte \\<noteq> InvalidPTE\n     | Inr (pde,slots) \\<Rightarrow> pde \\<noteq> InvalidPDE)\"\n\ndefinition\n  \"page_inv_entries_safe entries \\<equiv>\n   let slots = (case entries of Inl (pte, slots) \\<Rightarrow> slots | Inr (pde, slots) \\<Rightarrow> slots)\n   in if \\<exists>sl. slots = [sl]\n    then case entries of\n        Inl (pte, _) \\<Rightarrow> obj_at (\\<lambda>ko. \\<exists>pt pte. ko = ArchObj (PageTable pt)\n                     \\<and> pt (ucast (hd slots && mask pt_bits >> 2) && ~~ mask 4) = pte\n                     \\<and> pte_range_sz pte = 0)\n                 (hd slots && ~~ mask pt_bits)\n            and K (pte_range_sz pte = 0)\n      | Inr (pde, _) \\<Rightarrow> obj_at (\\<lambda>ko. \\<exists>pd pde. ko = ArchObj (PageDirectory pd)\n                     \\<and> pd (ucast (head slots && mask pd_bits >> 2) && ~~ mask 4)\n                            = pde \\<and> pde_range_sz pde = 0)\n                 (hd slots && ~~ mask pd_bits)\n           and K (pde_range_sz pde = 0)\n    else  (\\<lambda>s. (\\<exists>p. is_aligned p 6 \\<and> slots = map (\\<lambda>x. x + p) [0, 4 .e. 0x3C]\n                  \\<and> (case entries of\n                     Inl (pte, _) \\<Rightarrow> safe_pt_range slots s\n                   | Inr (pde, _) \\<Rightarrow> safe_pd_range slots s\n                     )))\"\n\ndefinition\n  \"page_inv_duplicates_valid iv \\<equiv> case iv of\n       PageMap asid cap ct_slot entries \\<Rightarrow>\n              page_inv_entries_safe entries\n     | _ \\<Rightarrow> \\<top>\"\n\nlemma pte_range_interD:\n \"pte_range pte p \\<inter> pte_range pte' p' \\<noteq> {}\n  \\<Longrightarrow> pte \\<noteq> InvalidPTE \\<and> pte' \\<noteq> InvalidPTE\n      \\<and> p && ~~ mask 4 = p' && ~~ mask 4\"\n  apply (drule int_not_emptyD)\n  apply (case_tac pte,simp_all split:if_splits)\n   apply (case_tac pte',simp_all split:if_splits)\n   apply clarsimp\n   apply (case_tac pte',simp_all split:if_splits)\n  apply (case_tac pte', simp_all split:if_splits)\n  done\n\nlemma pde_range_interD:\n \"pde_range pde p \\<inter> pde_range pde' p' \\<noteq> {}\n  \\<Longrightarrow> pde \\<noteq> InvalidPDE \\<and> pde' \\<noteq> InvalidPDE\n      \\<and> p && ~~ mask 4 = p' && ~~ mask 4\"\n  apply (drule int_not_emptyD)\n  apply (case_tac pde,simp_all split:if_splits)\n     apply (case_tac pde',simp_all split:if_splits)\n    apply (case_tac pde',simp_all split:if_splits)\n   apply clarsimp\n   apply (case_tac pde', simp_all split:if_splits)\n  apply (case_tac pde', simp_all split:if_splits)\n  done\n\nlemma pte_range_sz_le:\n  \"(pte_range_sz pte) \\<le> 4\"\n  by (case_tac pte,simp_all)\n\nlemma pde_range_sz_le:\n  \"(pde_range_sz pde) \\<le> 4\"\n  by (case_tac pde,simp_all)\n\n(* BUG , revisit the following lemmas , moved from ArchAcc_R.thy *)\nlemma mask_pd_bits_shift_ucast_align[simp]:\n  \"is_aligned (ucast (p && mask pd_bits >> 2)::12 word) 4 =\n   is_aligned ((p::word32) >> 2) 4\"\n  by (clarsimp simp: is_aligned_mask mask_def pd_bits) word_bitwise\n\nlemma mask_pt_bits_shift_ucast_align[simp]:\n  \"is_aligned (ucast (p && mask pt_bits >> 2)::word8) 4 =\n   is_aligned ((p::word32) >> 2) 4\"\n  by (clarsimp simp: is_aligned_mask mask_def pt_bits_def pageBits_def)\n     word_bitwise\n\nlemma ucast_pt_index:\n  \"\\<lbrakk>is_aligned (p::word32) 6\\<rbrakk>\n   \\<Longrightarrow> ucast ((pa && mask 4) + (ucast (p && mask pt_bits >> 2)::8 word))\n   =  ucast (pa && mask 4) + (p && mask pt_bits >> 2)\"\n  apply (simp add:is_aligned_mask mask_def pt_bits_def pageBits_def)\n  apply word_bitwise\n  apply (auto simp: carry_def)\n  done\n\nlemma store_pte_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and page_inv_entries_safe (Inl (pte, slots))\\<rbrace>\n       store_pte (hd slots) pte \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_name_pre_state)\n  apply (clarsimp simp:page_inv_entries_safe_def split:if_splits)\n   apply (clarsimp simp:store_pte_def set_pt_def)\n   apply (wp get_pt_wp get_object_wp)\n   apply (clarsimp simp:obj_at_def\n     split:pte.splits arch_kernel_obj.splits)\n  apply (rule conjI)\n    apply (drule(1) valid_pdpt_objs_ptD)\n    apply (rule valid_entries_overwrite_0)\n     apply simp\n    apply (case_tac pte)\n     apply simp+\n    apply (case_tac \"pta p\",simp_all)\n    apply (clarsimp simp: is_aligned_neg_mask_eq)\n   apply (simp add:fun_upd_def)\n   apply (rule entries_align_pte_update)\n    apply (drule (1) valid_pdpt_objs_ptD,simp)\n   apply simp\n  apply (simp add:hd_map_simp upto_enum_def upto_enum_step_def)\n  apply (clarsimp simp:store_pte_def set_pt_def)\n  apply (wp get_pt_wp get_object_wp)\n  apply (clarsimp simp:obj_at_def\n     split:pte.splits arch_kernel_obj.splits)\n  apply (drule(1) valid_pdpt_objs_ptD)\n  apply (rule conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply simp\n   apply (rule ccontr)\n   apply (drule pte_range_interD)\n   apply clarsimp\n   apply (simp add:ucast_neg_mask)\n   apply (subst (asm) is_aligned_neg_mask_eq[where n = 4])\n    apply (rule is_aligned_shiftr[OF is_aligned_andI1])\n    apply simp\n   apply (drule_tac x = \"((p && ~~ mask pt_bits)  + ((ucast pa) << 2))\" in bspec)\n    apply (clarsimp simp: tl_map_simp upto_0_to_n2 image_def)\n    apply (rule_tac x = \"unat (((ucast pa)::word32) - (p && mask pt_bits >> 2))\" in bexI)\n     apply (simp add:ucast_nat_def shiftl_t2n mask_out_sub_mask)\n     apply (subst shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])\n     apply (subst shiftr_shiftl1)\n      apply simp+\n     apply (subst is_aligned_neg_mask_eq)\n      apply (erule is_aligned_andI1[OF is_aligned_weaken])\n      apply simp\n     apply simp\n    apply simp\n    apply (drule_tac s = \"ucast (p && mask pt_bits >> 2)\" in sym)\n    apply (simp add:mask_out_sub_mask field_simps)\n    apply (drule_tac f = \"ucast::(word8\\<Rightarrow>word32)\" in arg_cong)\n    apply (simp add:ucast_pt_index)\n    apply (simp add:unat_ucast_8_32)\n    apply (rule conjI)\n     apply (subgoal_tac \"unat (pa && mask 4)\\<noteq> 0\")\n      apply simp\n     apply (simp add:unat_gt_0)\n    apply (rule unat_less_helper)\n    apply (rule le_less_trans[OF word_and_le1])\n    apply (simp add:mask_def)\n   apply (simp add:field_simps neg_mask_add_mask)\n   apply (thin_tac \"ucast y = x\" for y x)\n   apply (subst (asm) less_mask_eq[where n = pt_bits])\n    apply (rule shiftl_less_t2n)\n     apply (simp add:pt_bits_def pageBits_def)\n     apply word_bitwise\n    apply (simp add:pt_bits_def pageBits_def)\n   apply (subst (asm) shiftl_shiftr_id)\n    apply simp\n   apply (simp,word_bitwise)\n   apply (simp add:ucast_ucast_id)\n  apply (simp add:fun_upd_def entries_align_def)\n  apply (rule is_aligned_weaken[OF _ pte_range_sz_le])\n  apply (simp add:is_aligned_shiftr)\n  done\n\n\nlemma ucast_pd_index:\n  \"\\<lbrakk>is_aligned (p::word32) 6\\<rbrakk>\n   \\<Longrightarrow> ucast ((pa && mask 4) + (ucast (p && mask pd_bits >> 2)::12 word))\n   =  ucast (pa && mask 4) + (p && mask pd_bits >> 2)\"\n  apply (simp add:is_aligned_mask mask_def pd_bits_def pageBits_def)\n  apply word_bitwise\n  apply (auto simp:carry_def)\n  done\n\nlemma unat_ucast_12_32:\n  \"unat (ucast (x::(12 word))::word32) = unat x\"\n  apply (subst unat_ucast)\n  apply (rule mod_less)\n  apply (rule less_le_trans[OF unat_lt2p])\n  apply simp\n  done\n\nlemma store_pde_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and page_inv_entries_safe (Inr (pde, slots))\\<rbrace>\n       store_pde (hd slots) pde \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_name_pre_state)\n  apply (clarsimp simp:page_inv_entries_safe_def split:if_splits)\n   apply (clarsimp simp:store_pde_def set_pd_def)\n   apply (wp get_pd_wp get_object_wp)\n   apply (clarsimp simp:obj_at_def\n     split:pde.splits arch_kernel_obj.splits)\n   apply (drule(1) valid_pdpt_objs_pdD)\n   apply (rule conjI)\n    apply (rule valid_entries_overwrite_0)\n     apply simp\n    apply (case_tac pde,simp_all)\n     apply (case_tac \"pda p\",simp_all)\n     apply (clarsimp simp: is_aligned_neg_mask_eq)\n    apply (case_tac \"pda p\",simp_all)\n    apply (clarsimp simp: is_aligned_neg_mask_eq)\n   apply (simp add:fun_upd_def)\n   apply (rule entries_align_pde_update)\n    apply simp+\n  apply (simp add:hd_map_simp upto_enum_def upto_enum_step_def)\n  apply (clarsimp simp:store_pde_def set_pd_def)\n  apply (wp get_pd_wp get_object_wp)\n  apply (clarsimp simp:obj_at_def\n     split:pde.splits arch_kernel_obj.splits)\n  apply (drule(1) valid_pdpt_objs_pdD)\n  apply (rule conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply simp\n   apply (rule ccontr)\n   apply (drule pde_range_interD)\n   apply clarsimp\n   apply (simp add:ucast_neg_mask)\n   apply (subst (asm) is_aligned_neg_mask_eq[where n = 4])\n    apply (rule is_aligned_shiftr[OF is_aligned_andI1])\n    apply simp\n   apply (drule_tac x = \"((p && ~~ mask pd_bits)  + ((ucast pa) << 2))\" in bspec)\n    apply (clarsimp simp: tl_map_simp upto_0_to_n2 image_def)\n    apply (rule_tac x = \"unat (((ucast pa)::word32) - (p && mask pd_bits >> 2))\" in bexI)\n     apply (simp add:ucast_nat_def shiftl_t2n mask_out_sub_mask)\n     apply (subst shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])\n     apply (subst shiftr_shiftl1)\n      apply simp+\n     apply (subst is_aligned_neg_mask_eq)\n      apply (erule is_aligned_andI1[OF is_aligned_weaken])\n      apply simp\n     apply simp\n    apply simp\n    apply (drule_tac s = \"ucast (p && mask pd_bits >> 2)\" in sym)\n    apply (simp add:mask_out_sub_mask field_simps)\n    apply (drule_tac f = \"ucast::(12 word\\<Rightarrow>word32)\" in arg_cong)\n    apply (simp add:ucast_pd_index)\n    apply (simp add:unat_ucast_12_32)\n    apply (rule conjI)\n     apply (subgoal_tac \"unat (pa && mask 4)\\<noteq> 0\")\n      apply simp\n     apply (simp add:unat_gt_0)\n    apply (rule unat_less_helper)\n    apply (rule le_less_trans[OF word_and_le1])\n    apply (simp add:mask_def)\n   apply (simp add:field_simps neg_mask_add_mask)\n   apply (thin_tac \"ucast y = x\" for y x)\n   apply (subst (asm) less_mask_eq[where n = pd_bits])\n    apply (rule shiftl_less_t2n)\n     apply (simp add:pd_bits_def pageBits_def)\n     apply word_bitwise\n    apply (simp add:pd_bits_def pageBits_def)\n   apply (subst (asm) shiftl_shiftr_id)\n     apply simp\n    apply (simp,word_bitwise)\n   apply (simp add:ucast_ucast_id)\n  apply (simp add:entries_align_def)\n  apply (rule is_aligned_weaken[OF _ pde_range_sz_le])\n  apply (simp add:is_aligned_shiftr)\n  done\n\nlemma set_cap_page_inv_entries_safe:\n  \"\\<lbrace>page_inv_entries_safe x\\<rbrace> set_cap y z \\<lbrace>\\<lambda>_. page_inv_entries_safe x\\<rbrace>\"\n  apply (simp add:page_inv_entries_safe_def set_cap_def split_def\n    get_object_def set_object_def)\n  apply (wp | wpc)+\n  apply (case_tac x)\n  apply (auto simp:obj_at_def\n    Let_def split:if_splits option.splits)\n  done\n\ncrunch inv[wp]: pte_check_if_mapped, pde_check_if_mapped \"\\<lambda>s. P s\"\n\nlemma perform_page_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and valid_page_inv pinv and page_inv_duplicates_valid pinv\\<rbrace>\n        perform_page_invocation pinv \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: perform_page_invocation_def page_inv_duplicates_valid_def)\n  apply (cases pinv,\n         simp_all add: mapM_discarded page_inv_entries_safe_def\n            split: sum.split arch_cap.split option.split,\n         safe intro!: hoare_gen_asm hoare_gen_asm[unfolded K_def],\n         simp_all add: mapM_x_Nil mapM_x_Cons mapM_x_map)\n            apply (wp store_pte_valid_pdpt store_pde_valid_pdpt get_master_pte_wp get_master_pde_wp\n                      store_pte_non_master_valid_pdpt store_pde_non_master_valid_pdpt\n                      mapM_x_wp'[OF store_invalid_pte_valid_pdpt\n                        [where pte=pte.InvalidPTE, simplified]]\n                      mapM_x_wp'[OF store_invalid_pde_valid_pdpt\n                        [where pde=pde.InvalidPDE, simplified]]\n                      set_cap_page_inv_entries_safe\n                      hoare_vcg_imp_lift[OF set_cap_arch_obj_neg] hoare_vcg_all_lift\n                 | clarsimp simp: cte_wp_at_weakenE[OF _ TrueI] obj_at_def\n                                  pte_range_sz_def pde_range_sz_def swp_def valid_page_inv_def\n                                  valid_slots_def page_inv_entries_safe_def pte_check_if_mapped_def\n                                  pde_check_if_mapped_def\n                           split: pte.splits pde.splits\n                 | wp (once) hoare_drop_imps)+\n  done\n\ndefinition\n  \"pti_duplicates_valid iv \\<equiv>\n   case iv of PageTableMap cap ct_slot pde pd_slot\n     \\<Rightarrow> obj_at (\\<lambda>ko. \\<exists>pd pde. ko = ArchObj (PageDirectory pd)\n                     \\<and> pd (ucast (pd_slot && mask pd_bits >> 2) && ~~ mask 4)\n                            = pde \\<and> pde_range_sz pde = 0)\n                 (pd_slot && ~~ mask pd_bits)\n\n           and K (pde_range_sz pde = 0)\n  | _ \\<Rightarrow> \\<top>\"\n\n\ndefinition\n  \"invocation_duplicates_valid i \\<equiv>\n   case i of\n     InvokeArchObject (InvokePage pgi) \\<Rightarrow> page_inv_duplicates_valid pgi\n   | InvokeArchObject (InvokePageTable pti) \\<Rightarrow> pti_duplicates_valid pti\n   | _ \\<Rightarrow> \\<top>\"\n\nlemma perform_page_table_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and valid_pti pinv and pti_duplicates_valid pinv\\<rbrace>\n      perform_page_table_invocation pinv \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: perform_page_table_invocation_def split_def\n             cong: page_table_invocation.case_cong\n                   option.case_cong cap.case_cong arch_cap.case_cong)\n  apply (rule hoare_pre)\n   apply (wp store_pde_non_master_valid_pdpt hoare_vcg_ex_lift\n             set_cap_arch_obj mapM_x_store_pte_valid_pdpt2\n              | wpc\n              | simp add: swp_def\n              | strengthen all_imp_ko_at_from_ex_strg)+\n  apply (clarsimp simp: pti_duplicates_valid_def valid_pti_def)\n  apply (auto simp: obj_at_def cte_wp_at_caps_of_state valid_cap_simps\n                    cap_aligned_def pt_bits_def pageBits_def\n            intro!: inj_onI)\n  done\n\nlemma perform_page_directory_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and valid_pdi pinv\\<rbrace>\n      perform_page_directory_invocation pinv \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: perform_page_directory_invocation_def split_def)\n  apply (rule hoare_pre)\n   apply (wp | wpc | simp)+\n  done\n\nlemma perform_invocation_valid_pdpt[wp]:\n  \"\\<lbrace>invs and ct_active and valid_invocation i and valid_pdpt_objs\n           and invocation_duplicates_valid i\\<rbrace>\n      perform_invocation blocking call i\n         \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (cases i, simp_all)\n  apply (wp send_signal_interrupt_states | simp)+\n  apply (clarsimp simp: invocation_duplicates_valid_def)\n  apply (wp | wpc | simp)+\n  apply (simp add: arch_perform_invocation_def)\n  apply (rule hoare_pre)\n  apply (wp | wpc | simp)+\n  apply (auto simp: valid_arch_inv_def invocation_duplicates_valid_def)\n  done\n\nlemma neg_mask_pt_6_4:\n  \"(ptr && mask pt_bits >> 2) && ~~ mask 4 =\n   (ptr::word32) && ~~ mask 6 && mask pt_bits >> 2\"\n  apply (simp add:pt_bits_def pageBits_def)\n  apply word_bitwise\n  apply (simp add:word_size)\n  done\n\nlemma neg_mask_pd_6_4:\n  \"(ptr && mask pd_bits >> 2) && ~~ mask 4 =\n   (ptr::word32) && ~~ mask 6 && mask pd_bits >> 2\"\n  apply (simp add:pd_bits_def pageBits_def)\n  apply word_bitwise\n  apply (simp add:word_size)\n  done\n\nlemma mask_out_same_pt:\n  \"\\<lbrakk>is_aligned p 6; x < 2 ^ 6 \\<rbrakk> \\<Longrightarrow> p + x && ~~ mask pt_bits = p && ~~ mask pt_bits\"\n  apply (subst mask_lower_twice[symmetric,where n = 6])\n   apply (simp add:pt_bits_def pageBits_def)\n  apply (simp add:is_aligned_add_helper)\n  done\n\nlemma mask_out_same_pd:\n  \"\\<lbrakk>is_aligned p 6; x < 2 ^ 6 \\<rbrakk> \\<Longrightarrow> p + x && ~~ mask pd_bits = p && ~~ mask pd_bits\"\n  apply (subst mask_lower_twice[symmetric,where n = 6])\n   apply (simp add:pd_bits_def pageBits_def)\n  apply (simp add:is_aligned_add_helper)\n  done\n\nlemma ensure_safe_mapping_ensures[wp]:\n  \"\\<lbrace>valid_pdpt_objs and (case entries of (Inl (SmallPagePTE _ _ _, [_])) \\<Rightarrow> \\<top>\n                  | (Inl (SmallPagePTE _ _ _, _)) \\<Rightarrow> \\<bottom>\n                  | (Inl (LargePagePTE _ _ _, [])) \\<Rightarrow> \\<bottom>\n                  | (Inr (SectionPDE _ _ _ _, [_])) \\<Rightarrow> \\<top>\n                  | (Inr (SuperSectionPDE _ _ _, [])) \\<Rightarrow> \\<bottom>\n                  | (Inr (SectionPDE _ _ _ _, _)) \\<Rightarrow> \\<bottom>\n                  | _ \\<Rightarrow> page_inv_entries_pre entries)\\<rbrace>\n     ensure_safe_mapping entries\n   \\<lbrace>\\<lambda>rv. page_inv_entries_safe entries\\<rbrace>,-\"\n  proof -\n    have [simp]:\n      \"\\<And>s a. page_inv_entries_pre (Inl (pte.InvalidPTE, a)) s \\<Longrightarrow>\n      page_inv_entries_safe (Inl (pte.InvalidPTE, a)) s\"\n      apply (clarsimp simp:page_inv_entries_pre_def page_inv_entries_safe_def\n        split:if_splits)\n      done\n    have name_pre:\n      \"\\<And>F P Q. (\\<And>s. P s \\<Longrightarrow> \\<lbrace>(=) s \\<rbrace> F \\<lbrace>Q\\<rbrace>, -) \\<Longrightarrow> \\<lbrace>P\\<rbrace> F \\<lbrace>Q\\<rbrace>,-\"\n      apply (simp add:validE_R_def validE_def)\n      apply (rule hoare_name_pre_state)\n      apply assumption\n      done\n    have mask_neg_mask_order[simp]:\n      \"\\<And>a m n. a && ~~ mask m && mask n = a && mask n && ~~ mask m\"\n       by (simp add:word_bw_comms word_bw_lcs)\n    have align_entry_ptD:\n      \"\\<And>pt m x xb xc. \\<lbrakk>pt m = pte.LargePagePTE x xb xc; entries_align pte_range_sz pt\\<rbrakk>\n       \\<Longrightarrow> is_aligned m 4\"\n      apply (simp add:entries_align_def)\n      apply (drule_tac x = m in spec,simp)\n      done\n    have align_entry_pdD:\n      \"\\<And>pd m x xb xc. \\<lbrakk>pd m = pde.SuperSectionPDE x xb xc; entries_align pde_range_sz pd\\<rbrakk>\n       \\<Longrightarrow> is_aligned m 4\"\n      apply (simp add:entries_align_def)\n      apply (drule_tac x = m in spec,simp)\n      done\n    have pt_offset_bitwise[simp]:\"\\<And>a. (ucast ((a::word32) && mask pt_bits && ~~ mask 6  >> 2)::word8)\n      = (ucast (a  && mask pt_bits >> 2)::word8) && ~~ mask 4\"\n    apply (simp add:pt_bits_def pageBits_def mask_def)\n    apply word_bitwise\n    done\n    have pd_offset_bitwise[simp]:\"\\<And>a. (ucast ((a::word32) && mask pd_bits && ~~ mask 6  >> 2)::12 word)\n      = (ucast (a  && mask pd_bits >> 2)::12 word) && ~~ mask 4\"\n    apply (simp add:pt_bits_def pageBits_def mask_def pd_bits_def)\n    apply word_bitwise\n    done\n    have mask_neq_0:\n      \"\\<And>z zs xa p g. \\<lbrakk>[0 :: word32, 4 .e. 0x3C] = z # zs; xa \\<in> set zs; is_aligned p 6; 6 \\<le> g\\<rbrakk>\n         \\<Longrightarrow> (p + xa && mask g >> 2) && mask 4 \\<noteq> 0\"\n     apply (rule ccontr)\n      apply (simp add:is_aligned_mask[symmetric])\n       apply (drule is_aligned_shiftl[where n = 6 and m = 2,simplified])\n      apply (subst (asm) shiftr_shiftl1)\n       apply simp+\n      apply (subst (asm) is_aligned_neg_mask_eq)\n       apply (rule is_aligned_andI1)\n       apply (erule aligned_add_aligned)\n        apply (clarsimp simp :upto_enum_def upto_enum_step_def\n         Fun.comp_def upto_0_to_n2 is_aligned_mult_triv2[where n = 2,simplified])\n       apply simp\n      apply (simp add:is_aligned_mask mask_twice\n        pt_bits_def pageBits_def min_def)\n      apply (subst (asm) is_aligned_mask[symmetric])\n      apply (subst (asm) is_aligned_add_helper)\n       apply simp\n      apply (clarsimp simp :upto_enum_def upto_enum_step_def\n         Fun.comp_def upto_0_to_n2)\n      apply (subst shiftl_t2n\n        [where n = 2,simplified field_simps,simplified,symmetric])+\n      apply (rule shiftl_less_t2n[where m = 6,simplified])\n       apply (rule word_of_nat_less)\n       apply simp\n      apply simp\n     apply (clarsimp simp :upto_enum_def upto_enum_step_def\n         Fun.comp_def upto_0_to_n2)\n     apply (cut_tac x = \"of_nat x\" and n = 2 in word_power_nonzero_32)\n        apply (simp add:word_of_nat_less word_bits_def)+\n      apply (simp add: of_nat_neq_0)\n     apply simp\n     done\n    have neq_pt_offset: \"\\<And>z zs xa (p::word32). \\<lbrakk>[0 , 4 .e. 0x3C] = z # zs;\n        xa \\<in> set zs;is_aligned p 6 \\<rbrakk> \\<Longrightarrow>\n        ucast (p + xa && mask pt_bits >> 2) && ~~ mask 4 \\<noteq> ((ucast (p + xa && mask pt_bits >> 2))::word8)\"\n      apply (rule ccontr)\n      apply (simp add:mask_out_sub_mask ucast_and_mask[symmetric])\n      apply (drule arg_cong[where f = unat])\n      apply (simp add:unat_ucast)\n      apply (subst (asm) mod_less)\n       apply (rule unat_less_helper)\n       apply (rule le_less_trans[OF word_and_le1])\n       apply (simp add:mask_def)\n      apply (simp add:unat_eq_0)\n      apply (drule(2) mask_neq_0[of _ _ _ _ pt_bits])\n       apply (simp add:pt_bits_def pageBits_def)+\n      done\n    have neq_pd_offset: \"\\<And>z zs xa (p::word32). \\<lbrakk>[0 , 4 .e. 0x3C] = z # zs;\n        xa \\<in> set zs;is_aligned p 6 \\<rbrakk> \\<Longrightarrow>\n        ucast (p + xa && mask pd_bits >> 2) && ~~ mask 4 \\<noteq> ((ucast (p + xa && mask pd_bits >> 2)) :: 12 word)\"\n      apply (simp add:mask_out_sub_mask)\n      apply (rule ccontr)\n      apply (simp add:mask_out_sub_mask ucast_and_mask[symmetric])\n      apply (drule arg_cong[where f = unat])\n      apply (simp add:unat_ucast)\n      apply (subst (asm) mod_less)\n       apply (rule unat_less_helper)\n       apply (rule le_less_trans[OF word_and_le1])\n       apply (simp add:mask_def)\n      apply (simp add:unat_eq_0)\n      apply (drule(2) mask_neq_0[of _ _ _ _ pd_bits])\n       apply (simp add:pd_bits_def pageBits_def)+\n      done\n    have invalid_pteI:\n      \"\\<And>a pt x y z. \\<lbrakk>valid_pt_entries pt; (a && ~~ mask 4) \\<noteq> a;\n       pt (a && ~~ mask 4) = pte.LargePagePTE x y z \\<rbrakk>\n       \\<Longrightarrow> pt a = pte.InvalidPTE\"\n      apply (drule(1) valid_entriesD[rotated])\n      apply (case_tac \"pt a\"; simp add:mask_lower_twice is_aligned_neg_mask split:if_splits)\n      done\n    have invalid_pdeI:\n      \"\\<And>a pd x y z. \\<lbrakk>valid_pd_entries pd; (a && ~~ mask 4) \\<noteq> a;\n       pd (a && ~~ mask 4) = pde.SuperSectionPDE x y z \\<rbrakk>\n       \\<Longrightarrow> pd a = pde.InvalidPDE\"\n      apply (drule(1) valid_entriesD[rotated])\n      apply (case_tac \"pd a\",\n        simp_all add:mask_lower_twice is_aligned_neg_mask\n        split:if_splits)\n      done\n    have inj[simp]:\n      \"\\<And>p. is_aligned (p::word32) 6 \\<Longrightarrow> inj_on (\\<lambda>x. toEnum x * 4 + p) {Suc 0..<16}\"\n      apply (clarsimp simp:inj_on_def)\n      apply (subst (asm) shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])+\n      apply (drule arg_cong[where f = \"\\<lambda>x. x >> 2\"])\n      apply (simp add:shiftl_shiftr_id word_of_nat_less)\n      apply (simp add:of_nat_inj)\n      done\n\n  show ?thesis\n  apply (rule name_pre)\n  apply (case_tac entries)\n   apply (case_tac a, case_tac aa)\n     apply (simp add:page_inv_entries_pre_def page_inv_entries_safe_def\n       | wp | intro conjI impI)+\n     apply (simp split:list.splits add:page_inv_entries_pre_def)+\n    apply (rename_tac obj_ref vm_attributes cap_rights slot slots)\n    apply (elim conjE exE)\n    apply (subst mapME_x_Cons)\n    apply simp\n    apply wp\n     apply (rule_tac Q' = \"\\<lambda>r s. \\<forall>x \\<in> set slots. obj_at\n                (\\<lambda>ko. \\<exists>pt. ko = ArchObj (PageTable pt) \\<and>\n                 pt (ucast (x && mask pt_bits >> 2)) = pte.InvalidPTE)\n                (hd (slot # slots) && ~~ mask pt_bits) s\" in hoare_post_imp_R)\n      apply (wp mapME_x_accumulate_checks[where Q = \"\\<lambda>s. valid_pdpt_objs s\"] )\n          apply (wp get_master_pte_wp| wpc | simp)+\n         apply clarsimp\n         apply (frule_tac x = xa in mask_out_same_pt)\n          apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n          apply (erule notE)\n          apply (subst shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])\n          apply (rule shiftl_less_t2n[where m = 6,simplified])\n           apply (simp add:word_of_nat_less)\n          apply simp\n         apply (frule_tac x = z in mask_out_same_pt)\n          apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n         apply (clarsimp simp:field_simps obj_at_def\n           split:pte.splits)\n         apply (intro conjI impI)\n           apply (clarsimp)\n           apply (drule(1) valid_pdpt_objs_ptD)\n           apply (frule align_entry_ptD,simp)\n           apply (simp add:is_aligned_neg_mask_eq)\n          apply clarsimp\n          apply (drule(1) valid_pdpt_objs_ptD,clarify)\n          apply (erule(4) invalid_pteI[OF _ neq_pt_offset])\n         apply clarsimp\n         apply (drule(1) valid_pdpt_objs_ptD,clarify)\n         apply (frule align_entry_ptD,simp)\n         apply (simp add:is_aligned_neg_mask_eq)\n        apply (wp hoare_drop_imps |wpc|simp)+\n      apply (clarsimp simp:upto_enum_def upto_enum_step_def\n        upto_0_to_n2 Fun.comp_def distinct_map)\n     apply (intro exI conjI,fastforce+)\n     apply (simp add:obj_at_def hd_map_simp\n         upto_0_to_n2 upto_enum_def upto_enum_step_def)\n     apply (frule_tac x = 1 in bspec,fastforce+)\n    apply ((wp hoare_drop_imps |wpc|simp)+)[1]\n   apply (simp add:page_inv_entries_pre_def page_inv_entries_safe_def\n       | wp | intro conjI impI)+\n    apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton)\n    apply (wp get_master_pte_wp |wpc | simp)+\n    apply (clarsimp simp:obj_at_def split:pte.splits)\n   apply (clarsimp simp:page_inv_entries_safe_def split:list.splits)\n  apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton)\n  apply (case_tac b,case_tac a)\n     apply ((simp add:page_inv_entries_pre_def page_inv_entries_safe_def\n       | wp | intro conjI impI)+)[1]\n    apply simp\n    apply wp[1]\n   apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton)\n   apply (wp get_master_pde_wp | wpc | simp)+\n   apply (clarsimp simp:obj_at_def page_inv_entries_safe_def\n     split:pde.splits)\n  apply (simp split:list.splits if_splits\n    add:page_inv_entries_pre_def Let_def page_inv_entries_safe_def)\n  apply (elim conjE exE)\n  apply (subst mapME_x_Cons)\n  apply simp\n  apply wp\n   apply (rule_tac Q' = \"\\<lambda>r s. \\<forall>x \\<in> set x22. obj_at\n       (\\<lambda>ko. \\<exists>pd. ko = ArchObj (PageDirectory pd) \\<and>\n       pd (ucast (x && mask pd_bits >> 2)) = pde.InvalidPDE)\n       (hd (x21 # x22) && ~~ mask pd_bits) s\" in hoare_post_imp_R)\n    apply (wp mapME_x_accumulate_checks[where Q = \"\\<lambda>s. valid_pdpt_objs s\"] )\n        apply (wp get_master_pde_wp| wpc | simp)+\n       apply clarsimp\n       apply (frule_tac x = xa in mask_out_same_pd)\n        apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n        apply (erule notE)\n        apply (subst shiftl_t2n[where n = 2,simplified field_simps,simplified,symmetric])\n        apply (rule shiftl_less_t2n[where m = 6,simplified])\n         apply (simp add:word_of_nat_less)\n        apply simp\n       apply (frule_tac x = z in mask_out_same_pd)\n        apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n       apply (clarsimp simp:field_simps obj_at_def\n           split:pde.splits)\n       apply (drule(1) valid_pdpt_objs_pdD)\n       apply (intro conjI impI)\n          apply clarsimp\n          apply (frule(1) align_entry_pdD)\n          apply (simp add:is_aligned_neg_mask_eq)\n         apply clarsimp\n         apply (frule(1) align_entry_pdD)\n         apply (simp add:is_aligned_neg_mask_eq)\n        apply clarsimp\n        apply (frule(1) align_entry_pdD)\n        apply (simp add:is_aligned_neg_mask_eq)\n       apply clarsimp\n       apply (erule(4) invalid_pdeI[OF _ neq_pd_offset])\n      apply (wp hoare_drop_imps |wpc|simp)+\n    apply (clarsimp simp:upto_enum_def upto_enum_step_def\n        upto_0_to_n2 Fun.comp_def distinct_map)\n   apply (intro exI conjI,fastforce+)\n   apply (simp add:obj_at_def hd_map_simp\n     upto_0_to_n2 upto_enum_def upto_enum_step_def)\n   apply (frule_tac x = 1 in bspec,fastforce+)\n  apply (wp get_master_pde_wp | simp | wpc)+\n  done\nqed\n\nlemma create_mapping_entries_safe[wp]:\n  \"\\<lbrace>\\<exists>\\<rhd>pd and K (vmsz_aligned vptr sz) and K (is_aligned pd pd_bits)\n          and K (vptr < kernel_base)\n          and valid_vspace_objs and pspace_aligned and\n          (\\<exists>\\<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits))\\<rbrace>\n      create_mapping_entries ptr vptr sz rights attrib pd\n   \\<lbrace>\\<lambda>entries. case entries of (Inl (SmallPagePTE _ _ _, [_])) \\<Rightarrow> \\<top>\n                  | (Inl (SmallPagePTE _ _ _, _)) \\<Rightarrow> \\<bottom>\n                  | (Inl (LargePagePTE _ _ _, [])) \\<Rightarrow> \\<bottom>\n                  | (Inr (SectionPDE _ _ _ _, [_])) \\<Rightarrow> \\<top>\n                  | (Inr (SectionPDE _ _ _ _, _)) \\<Rightarrow> \\<bottom>\n                  | (Inr (SuperSectionPDE _ _ _, [])) \\<Rightarrow> \\<bottom>\n                  | _ \\<Rightarrow> page_inv_entries_pre entries\\<rbrace>,-\"\n  apply (cases sz, simp_all add: largePagePTE_offsets_def superSectionPDE_offsets_def)\n     defer 2\n     apply (wp | simp)+\n   apply (simp split:list.split)\n   apply (subgoal_tac \"lookup_pd_slot pd vptr \\<le> lookup_pd_slot pd vptr + 0x3C\")\n    apply (clarsimp simp:upto_enum_def not_less upto_enum_step_def\n      page_inv_entries_pre_def Let_def)\n    apply (clarsimp simp:upto_enum_step_def upto_enum_def\n                     map_eq_Cons_conv upt_eq_Cons_conv)\n    apply (drule_tac x = \"lookup_pd_slot pd vptr\" in spec)\n    apply (subst (asm) upto_0_to_n2)\n     apply simp\n    apply clarsimp\n    apply (drule lookup_pd_slot_aligned_6)\n     apply (simp add:pd_bits_def pageBits_def)\n    apply simp\n   apply clarsimp\n   apply (erule is_aligned_no_wrap'[OF lookup_pd_slot_aligned_6])\n    apply (simp add:pd_bits pageBits_def)\n   apply simp\n  apply (wp get_pde_wp | simp add:lookup_pt_slot_def | wpc)+\n  apply (clarsimp simp:upto_enum_def upto_enum_step_def\n    page_inv_entries_pre_def Let_def )\n  apply (drule_tac ref = refa in valid_vspace_objsD)\n    apply (simp add:obj_at_def)\n   apply simp\n  apply (simp)\n  apply (drule_tac x = \"ucast (lookup_pd_slot pd vptr && mask pd_bits >> 2)\"\n    in bspec)\n   apply simp\n   apply (erule(1) less_kernel_base_mapping_slots)\n  apply (clarsimp simp:not_less[symmetric] split:list.splits)\n  apply (clarsimp simp:page_inv_entries_pre_def\n    Let_def upto_enum_step_def upto_enum_def)\n  apply (subst (asm) upto_0_to_n2)\n   apply simp\n  apply (clarsimp simp:not_less[symmetric])\n  apply (subgoal_tac\n    \"(\\<exists>xa xb. pda (ucast (lookup_pd_slot pd vptr && mask pd_bits >> 2))\n     = pde.PageTablePDE x xa xb)\n     \\<longrightarrow> is_aligned (ptrFromPAddr x + ((vptr >> 12) && 0xFF << 2)) 6\")\n   apply clarsimp\n  apply clarsimp\n  apply (rule aligned_add_aligned)\n    apply (erule(1) pt_aligned)\n   apply (rule is_aligned_shiftl[OF is_aligned_andI1])\n   apply (rule is_aligned_shiftr)\n   apply (simp add:vmsz_aligned_def)\n  apply simp\n  done\n\ncrunch vspace_objs[wp]: find_pd_for_asid valid_vspace_objs\n\nlemma arch_decode_invocation_valid_pdpt[wp]:\n  \"\\<lbrace>invs and valid_cap (cap.ArchObjectCap cap) and valid_pdpt_objs\\<rbrace>\n   arch_decode_invocation label args cap_index slot cap excaps\n   \\<lbrace>invocation_duplicates_valid o Invocations_A.InvokeArchObject\\<rbrace>,-\"\nproof -\n  have bitwise:\"\\<And>a. (ucast (((a::word32) && ~~ mask 6) && mask 14 >> 2)::12 word)\n    = (ucast (a  && mask 14 >> 2)::12 word) && ~~ mask 4\"\n    apply (simp add: mask_def)\n    apply word_bitwise\n    done\n  have sz:\n    \"\\<And>vmpage_size. \\<lbrakk>args ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 < kernel_base;\n      vmsz_aligned (args ! 0) vmpage_size\\<rbrakk>\n     \\<Longrightarrow> args ! 0 < kernel_base\"\n    apply (rule le_less_trans[OF is_aligned_no_overflow])\n     apply (simp add: vmsz_aligned_def)\n    apply simp\n    done\n  show ?thesis\n    supply if_split[split del]\n    apply (simp add: arch_decode_invocation_def)\n    \\<comment> \\<open>Handle the easy cases first (trivial because of the post-condition invocation_duplicates_valid)\\<close>\n    apply (cases \"invocation_type label \\<notin> {ArchInvocationLabel ARMPageTableMap, ArchInvocationLabel ARMPageMap}\")\n     apply (wpsimp simp: invocation_duplicates_valid_def page_inv_duplicates_valid_def\n                         pti_duplicates_valid_def Let_def\n                   cong: if_cong)\n    \\<comment> \\<open>Handle the two interesting cases now\\<close>\n    apply (clarsimp; erule disjE; cases cap;\n           simp add: isPDFlushLabel_def isPageFlushLabel_def throwError_R')\n     \\<comment> \\<open>PageTableMap\\<close>\n     apply (wpsimp simp: Let_def get_master_pde_def invocation_duplicates_valid_def\n                         pti_duplicates_valid_def mask_lower_twice pd_bits_def bitwise pageBits_def\n                         obj_at_def\n                     wp: get_pde_wp hoare_drop_imps hoare_vcg_if_lift_ER split: if_splits)\n     apply (intro conjI; clarsimp)\n    \\<comment> \\<open>PageMap\\<close>\n    apply (rename_tac dev pg_ptr rights sz pg_map)\n    apply (wpsimp simp: Let_def invocation_duplicates_valid_def page_inv_duplicates_valid_def\n                    wp: ensure_safe_mapping_ensures[THEN hoare_post_imp_R]\n                        check_vp_wpR hoare_vcg_if_lift_ER find_pd_for_asid_lookup_pd_wp)\n    apply (fastforce simp: invs_psp_aligned page_directory_at_aligned_pd_bits\n                           word_not_le sz valid_cap_def valid_arch_cap_def lookup_pd_slot_eq\n                    split: if_splits)\n  done\nqed\n\nlemma decode_invocation_valid_pdpt[wp]:\n  \"\\<lbrace>invs and valid_cap cap and valid_pdpt_objs\\<rbrace>\n     decode_invocation label args cap_index slot cap excaps\n   \\<lbrace>invocation_duplicates_valid\\<rbrace>,-\"\n  apply (simp add: decode_invocation_def split del: if_split)\n  apply (rule hoare_pre)\n   apply (wp | wpc\n            | simp only: invocation_duplicates_valid_def o_def uncurry_def split_def\n                         Invocations_A.invocation.simps)+\n  apply clarsimp\n  done\n\ncrunch valid_pdpt_objs[wp]: handle_fault, reply_from_kernel \"valid_pdpt_objs\"\n  (simp: crunch_simps wp: crunch_wps)\n\n\nlemma invocation_duplicates_valid_exst_update[simp]:\n  \"invocation_duplicates_valid i (trans_state f s) = invocation_duplicates_valid i s\"\n  apply (clarsimp simp add: invocation_duplicates_valid_def pti_duplicates_valid_def page_inv_duplicates_valid_def page_inv_entries_safe_def split: sum.splits invocation.splits arch_invocation.splits kernel_object.splits page_table_invocation.splits page_invocation.splits)+\n  done\n\n\nlemma set_thread_state_duplicates_valid[wp]:\n  \"\\<lbrace>invocation_duplicates_valid i\\<rbrace> set_thread_state t st \\<lbrace>\\<lambda>rv. invocation_duplicates_valid i\\<rbrace>\"\n  apply (simp add: set_thread_state_def set_object_def get_object_def)\n  apply (wp|simp)+\n  apply (clarsimp simp: invocation_duplicates_valid_def pti_duplicates_valid_def\n                        page_inv_duplicates_valid_def page_inv_entries_safe_def\n                        Let_def\n                 dest!: get_tcb_SomeD\n                 split: Invocations_A.invocation.split arch_invocation.split_asm\n                        page_table_invocation.split\n                        page_invocation.split sum.split\n                        )\n  apply (auto simp add: obj_at_def page_inv_entries_safe_def)\n  done\n\nlemma handle_invocation_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and invs and ct_active\\<rbrace>\n        handle_invocation calling blocking \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: handle_invocation_def)\n  apply (wp syscall_valid set_thread_state_ct_st\n               | simp add: split_def | wpc\n               | wp (once) hoare_drop_imps)+\n  apply (auto simp: ct_in_state_def elim: st_tcb_ex_cap)\n  done\n\n\ncrunch valid_pdpt[wp]: handle_event, activate_thread,switch_to_thread,\n       switch_to_idle_thread \"valid_pdpt_objs\"\n  (simp: crunch_simps wp: crunch_wps alternative_valid select_wp OR_choice_weak_wp select_ext_weak_wp\n      ignore: without_preemption getActiveIRQ resetTimer ackInterrupt\n              getFAR getDFSR getIFSR OR_choice set_scheduler_action\n              clearExMonitor)\n\nlemma schedule_valid_pdpt[wp]: \"\\<lbrace>valid_pdpt_objs\\<rbrace> schedule :: (unit,unit) s_monad \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: schedule_def allActiveTCBs_def)\n  apply (wp alternative_wp select_wp)\n  apply simp\n  done\n\nlemma call_kernel_valid_pdpt[wp]:\n  \"\\<lbrace>invs and (\\<lambda>s. e \\<noteq> Interrupt \\<longrightarrow> ct_running s) and valid_pdpt_objs\\<rbrace>\n      (call_kernel e) :: (unit,unit) s_monad\n   \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (cases e, simp_all add: call_kernel_def)\n      apply (rule hoare_pre)\n       apply (wp | simp add: if_apply_def2 | wpc\n                 | rule conjI | clarsimp simp: ct_in_state_def\n                 | erule pred_tcb_weakenE\n                 | wp (once) hoare_drop_imps)+\n  done\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/ARM/ArchVSpaceEntries_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494550081925, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.31623420851891526}}
{"text": "header {* \\isaheader{Program Dependence Graph} *}\n\ntheory PDG imports \n  DataDependence \n  StandardControlDependence\n  WeakControlDependence\n  \"../Basic/CFGExit_wf\" \nbegin\n\nlocale PDG = \n  CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n  for sourcenode :: \"'edge \\<Rightarrow> 'node\" and targetnode :: \"'edge \\<Rightarrow> 'node\"\n  and kind :: \"'edge \\<Rightarrow> 'state edge_kind\" and valid_edge :: \"'edge \\<Rightarrow> bool\"\n  and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\<Rightarrow> 'var set\"\n  and Use :: \"'node \\<Rightarrow> 'var set\" and state_val :: \"'state \\<Rightarrow> 'var \\<Rightarrow> 'val\"\n  and Exit :: \"'node\" (\"'('_Exit'_')\") +\n  fixes control_dependence :: \"'node \\<Rightarrow> 'node \\<Rightarrow> bool\" \n(\"_ controls _ \" [51,0])\n  assumes Exit_not_control_dependent:\"n controls n' \\<Longrightarrow> n' \\<noteq> (_Exit_)\"\n  assumes control_dependence_path:\n  \"n controls n' \n  \\<Longrightarrow> \\<exists>as. CFG.path sourcenode targetnode valid_edge n as n' \\<and> as \\<noteq> []\"\n\nbegin\n\n\ninductive cdep_edge :: \"'node \\<Rightarrow> 'node \\<Rightarrow> bool\" \n    (\"_ \\<longrightarrow>\\<^bsub>cd\\<^esub> _\" [51,0] 80)\n  and ddep_edge :: \"'node \\<Rightarrow> 'var \\<Rightarrow> 'node \\<Rightarrow> bool\"\n    (\"_ -_\\<rightarrow>\\<^bsub>dd\\<^esub> _\" [51,0,0] 80)\n  and PDG_edge :: \"'node \\<Rightarrow> 'var option \\<Rightarrow> 'node \\<Rightarrow> bool\"\n\nwhere\n    (* Syntax *)\n  \"n \\<longrightarrow>\\<^bsub>cd\\<^esub> n' == PDG_edge n None n'\"\n  | \"n -V\\<rightarrow>\\<^bsub>dd\\<^esub> n' == PDG_edge n (Some V) n'\"\n\n    (* Rules *)\n  | PDG_cdep_edge:\n  \"n controls n' \\<Longrightarrow> n \\<longrightarrow>\\<^bsub>cd\\<^esub> n'\"\n\n  | PDG_ddep_edge:\n  \"n influences V in n' \\<Longrightarrow> n -V\\<rightarrow>\\<^bsub>dd\\<^esub> n'\"\n\n\ninductive PDG_path :: \"'node \\<Rightarrow> 'node \\<Rightarrow> bool\"\n(\"_ \\<longrightarrow>\\<^sub>d* _\" [51,0] 80) \n\nwhere PDG_path_Nil:\n  \"valid_node n \\<Longrightarrow> n \\<longrightarrow>\\<^sub>d* n\"\n\n  | PDG_path_Append_cdep:\n  \"\\<lbrakk>n \\<longrightarrow>\\<^sub>d* n''; n'' \\<longrightarrow>\\<^bsub>cd\\<^esub> n'\\<rbrakk> \\<Longrightarrow> n \\<longrightarrow>\\<^sub>d* n'\"\n\n  | PDG_path_Append_ddep:\n  \"\\<lbrakk>n \\<longrightarrow>\\<^sub>d* n''; n'' -V\\<rightarrow>\\<^bsub>dd\\<^esub> n'\\<rbrakk> \\<Longrightarrow> n \\<longrightarrow>\\<^sub>d* n'\"\n\n\nlemma PDG_path_cdep:\"n \\<longrightarrow>\\<^bsub>cd\\<^esub> n' \\<Longrightarrow> n \\<longrightarrow>\\<^sub>d* n'\"\napply -\napply(rule PDG_path_Append_cdep, rule PDG_path_Nil)\nby(auto elim!:PDG_edge.cases dest:control_dependence_path path_valid_node)\n\nlemma PDG_path_ddep:\"n -V\\<rightarrow>\\<^bsub>dd\\<^esub> n' \\<Longrightarrow> n \\<longrightarrow>\\<^sub>d* n'\"\napply -\napply(rule PDG_path_Append_ddep, rule PDG_path_Nil)\nby(auto elim!:PDG_edge.cases dest:path_valid_node simp:data_dependence_def)\n\nlemma PDG_path_Append:\n  \"\\<lbrakk>n'' \\<longrightarrow>\\<^sub>d* n'; n \\<longrightarrow>\\<^sub>d* n''\\<rbrakk> \\<Longrightarrow> n \\<longrightarrow>\\<^sub>d* n'\"\nby(induct rule:PDG_path.induct,auto intro:PDG_path.intros)\n\n\nlemma PDG_cdep_edge_CFG_path:\n  assumes \"n \\<longrightarrow>\\<^bsub>cd\\<^esub> n'\" obtains as where \"n -as\\<rightarrow>* n'\" and \"as \\<noteq> []\"\n  using `n \\<longrightarrow>\\<^bsub>cd\\<^esub> n'`\n  by(auto elim:PDG_edge.cases dest:control_dependence_path)\n\nlemma PDG_ddep_edge_CFG_path:\n  assumes \"n -V\\<rightarrow>\\<^bsub>dd\\<^esub> n'\" obtains as where \"n -as\\<rightarrow>* n'\" and \"as \\<noteq> []\"\n  using `n -V\\<rightarrow>\\<^bsub>dd\\<^esub> n'`\n  by(auto elim!:PDG_edge.cases simp:data_dependence_def)\n\n\n\n\nlemma PDG_path_Exit:\"\\<lbrakk>n \\<longrightarrow>\\<^sub>d* n'; n' = (_Exit_)\\<rbrakk> \\<Longrightarrow> n = (_Exit_)\"\napply(induct rule:PDG_path.induct)\nby(auto elim:PDG_edge.cases dest:Exit_not_control_dependent \n        simp:data_dependence_def)\n\n\nlemma PDG_path_not_inner:\n  \"\\<lbrakk>n \\<longrightarrow>\\<^sub>d* n'; \\<not> inner_node n'\\<rbrakk> \\<Longrightarrow> n = n'\"\nproof(induct rule:PDG_path.induct)\n  case (PDG_path_Nil n)\n  thus ?case by simp\nnext\n  case (PDG_path_Append_cdep n n'' n')\n  from `n'' \\<longrightarrow>\\<^bsub>cd\\<^esub> n'` `\\<not> inner_node n'` have False\n    apply -\n    apply(erule PDG_edge.cases) apply(auto simp:inner_node_def)\n      apply(fastforce dest:control_dependence_path path_valid_node)\n     apply(fastforce dest:control_dependence_path path_valid_node)\n    by(fastforce dest:Exit_not_control_dependent)\n  thus ?case by simp\nnext\n  case (PDG_path_Append_ddep n n'' V n')\n  from `n'' -V\\<rightarrow>\\<^bsub>dd\\<^esub> n'` `\\<not> inner_node n'` have False\n    apply -\n    apply(erule PDG_edge.cases) \n    by(auto dest:path_valid_node simp:inner_node_def data_dependence_def)\n  thus ?case by simp\nqed\n\n\nsubsection {* Definition of the static backward slice *}\n\ntext {* Node: instead of a single node, we calculate the backward slice of a set\n  of nodes. *}\n\ndefinition PDG_BS :: \"'node set \\<Rightarrow> 'node set\"\n  where \"PDG_BS S \\<equiv> {n'. \\<exists>n. n' \\<longrightarrow>\\<^sub>d* n \\<and> n \\<in> S \\<and> valid_node n}\"\n\n\nlemma PDG_BS_valid_node:\"n \\<in> PDG_BS S \\<Longrightarrow> valid_node n\"\n  by(auto elim:PDG_path_CFG_path dest:path_valid_node simp:PDG_BS_def \n          split:split_if_asm)\n\nlemma Exit_PDG_BS:\"n \\<in> PDG_BS {(_Exit_)} \\<Longrightarrow> n = (_Exit_)\"\n  by(fastforce dest:PDG_path_Exit simp:PDG_BS_def)\n\n\nend\n\n\nsubsection {* Instantiate static PDG *}\n\nsubsubsection {* Standard control dependence *}\n\nlocale StandardControlDependencePDG = \n  Postdomination sourcenode targetnode kind valid_edge Entry Exit +\n  CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n  for sourcenode :: \"'edge \\<Rightarrow> 'node\" and targetnode :: \"'edge \\<Rightarrow> 'node\"\n  and kind :: \"'edge \\<Rightarrow> 'state edge_kind\" and valid_edge :: \"'edge \\<Rightarrow> bool\"\n  and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\<Rightarrow> 'var set\"\n  and Use :: \"'node \\<Rightarrow> 'var set\" and state_val :: \"'state \\<Rightarrow> 'var \\<Rightarrow> 'val\"\n  and Exit :: \"'node\" (\"'('_Exit'_')\")\n\nbegin\n\nlemma PDG_scd:\n  \"PDG sourcenode targetnode kind valid_edge (_Entry_) \n       Def Use state_val (_Exit_) standard_control_dependence\"\nproof(unfold_locales)\n  fix n n' assume \"n controls\\<^sub>s n'\"\n  show \"n' \\<noteq> (_Exit_)\"\n  proof\n    assume \"n' = (_Exit_)\"\n    with `n controls\\<^sub>s n'` show False\n      by(fastforce intro:Exit_not_standard_control_dependent)\n  qed\nnext\n  fix n n' assume \"n controls\\<^sub>s n'\"\n  thus \"\\<exists>as. n -as\\<rightarrow>* n' \\<and> as \\<noteq> []\"\n    by(fastforce simp:standard_control_dependence_def)\nqed\n\n\n(*<*)\nlemmas PDG_cdep_edge = PDG.PDG_cdep_edge[OF PDG_scd]\nlemmas PDG_path_Nil = PDG.PDG_path_Nil[OF PDG_scd]\nlemmas PDG_path_Append = PDG.PDG_path_Append[OF PDG_scd]\nlemmas PDG_path_CFG_path = PDG.PDG_path_CFG_path[OF PDG_scd]\nlemmas PDG_path_cdep = PDG.PDG_path_cdep[OF PDG_scd]\nlemmas PDG_path_ddep = PDG.PDG_path_ddep[OF PDG_scd]\nlemmas PDG_path_not_inner = PDG.PDG_path_not_inner[OF PDG_scd]\nlemmas PDG_path_Exit = PDG.PDG_path_Exit[OF PDG_scd]\n\n\ndefinition PDG_BS_s :: \"'node set \\<Rightarrow> 'node set\" (\"PDG'_BS\")\n  where \"PDG_BS S \\<equiv> \n  PDG.PDG_BS sourcenode targetnode valid_edge Def Use standard_control_dependence S\"\n\n\n\nlemmas PDG_BS_def = PDG.PDG_BS_def[OF PDG_scd,simplified]\nlemmas PDG_BS_valid_node = PDG.PDG_BS_valid_node[OF PDG_scd,simplified]\nlemmas Exit_PDG_BS = PDG.Exit_PDG_BS[OF PDG_scd,simplified]\n(*>*)\n\nend\n\nsubsubsection {* Weak control dependence *}\n\nlocale WeakControlDependencePDG = \n  StrongPostdomination sourcenode targetnode kind valid_edge Entry Exit +\n  CFGExit_wf sourcenode targetnode kind valid_edge Entry Def Use state_val Exit\n  for sourcenode :: \"'edge \\<Rightarrow> 'node\" and targetnode :: \"'edge \\<Rightarrow> 'node\"\n  and kind :: \"'edge \\<Rightarrow> 'state edge_kind\" and valid_edge :: \"'edge \\<Rightarrow> bool\"\n  and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\<Rightarrow> 'var set\"\n  and Use :: \"'node \\<Rightarrow> 'var set\" and state_val :: \"'state \\<Rightarrow> 'var \\<Rightarrow> 'val\"\n  and Exit :: \"'node\" (\"'('_Exit'_')\")\n\nbegin\n\nlemma PDG_wcd:\n  \"PDG sourcenode targetnode kind valid_edge (_Entry_) \n       Def Use state_val (_Exit_) weak_control_dependence\"\nproof(unfold_locales)\n  fix n n' assume \"n weakly controls n'\"\n  show \"n' \\<noteq> (_Exit_)\"\n  proof\n    assume \"n' = (_Exit_)\"\n    with `n weakly controls n'` show False\n      by(fastforce intro:Exit_not_weak_control_dependent)\n  qed\nnext\n  fix n n' assume \"n weakly controls n'\"\n  thus \"\\<exists>as. n -as\\<rightarrow>* n' \\<and> as \\<noteq> []\"\n    by(fastforce simp:weak_control_dependence_def)\nqed\n\n(*<*)\nlemmas PDG_cdep_edge = PDG.PDG_cdep_edge[OF PDG_wcd]\nlemmas PDG_path_Nil = PDG.PDG_path_Nil[OF PDG_wcd]\nlemmas PDG_path_Append = PDG.PDG_path_Append[OF PDG_wcd]\nlemmas PDG_path_CFG_path = PDG.PDG_path_CFG_path[OF PDG_wcd]\nlemmas PDG_path_cdep = PDG.PDG_path_cdep[OF PDG_wcd]\nlemmas PDG_path_ddep = PDG.PDG_path_ddep[OF PDG_wcd]\nlemmas PDG_path_not_inner = PDG.PDG_path_not_inner[OF PDG_wcd]\nlemmas PDG_path_Exit = PDG.PDG_path_Exit[OF PDG_wcd]\n\n\ndefinition PDG_BS_w :: \"'node set \\<Rightarrow> 'node set\" (\"PDG'_BS\")\n  where \"PDG_BS S \\<equiv> \n  PDG.PDG_BS sourcenode targetnode valid_edge Def Use weak_control_dependence S\"\n\nlemma [simp]: \"PDG.PDG_BS sourcenode targetnode valid_edge Def Use \n  weak_control_dependence S = PDG_BS S\"\n  by(simp add:PDG_BS_w_def)\n\nlemmas PDG_BS_def = PDG.PDG_BS_def[OF PDG_wcd,simplified]\nlemmas PDG_BS_valid_node = PDG.PDG_BS_valid_node[OF PDG_wcd,simplified]\nlemmas Exit_PDG_BS = PDG.Exit_PDG_BS[OF PDG_wcd,simplified]\n(*>*)\n\nend\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/StaticIntra/PDG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802735722128, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.31616865315493975}}
{"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n *  Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Shift_Right_Hoare\n  imports VHDL_Hoare_Complete Bits_Int_Aux\nbegin\n\ndatatype sig = IN | OUT\n\ndefinition shiftr :: \"nat \\<Rightarrow> sig conc_stmt\" where\n  \"shiftr n \\<equiv> process {IN} : Bassign_trans OUT (Bshiftr (Bsig IN) n) 1\"\n\nlemma potential_tyenv:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bshiftl (Bsig IN) n) 1)\"\n  shows \"\\<exists>len>0. \\<Gamma> IN = Lty Uns len \\<and> \\<Gamma> OUT = Lty Uns len \\<or> \\<Gamma> IN = Lty Sig len \\<and> \\<Gamma> OUT = Lty Sig len\"\n  apply (rule seq_wt_cases(4)[OF assms])\n  by (metis bexp_wt_cases_shiftl bexp_wt_cases_slice(2))\n\nlocale unsigned_shift_right =\n  fixes \\<Gamma> :: \"sig tyenv\"\n  fixes len :: nat\n  fixes amount :: nat\n  assumes \"0 < len\"\n  assumes \"\\<Gamma> IN = Lty Uns len \\<and> \\<Gamma> OUT = Lty Uns len\"\nbegin\n\nlemma well_typed:\n  \"seq_wt \\<Gamma> (Bassign_trans OUT (Bshiftr (Bsig IN) n) 1)\"\n  by (rule seq_wt.intros(4))\n     (smt bexp_wt.intros(23) bexp_wt.intros(24) bexp_wt.intros(3) unsigned_shift_right_axioms\n     unsigned_shift_right_def)\n\nabbreviation \"lof_wline tw sig n \\<equiv> lval_of (wline_of tw sig n)\"\n\ntext \\<open>Here we factor out common expression in both inv1 and inv2. It is parametrised by the index\nwe are interested with for C (first argument) and A (the second argument). Note that the index\nwe are interested with for A should be the same as the index for B.\\<close>\n\ndefinition property :: \"nat \\<Rightarrow> nat \\<Rightarrow> sig assn2\" where\n  \"property idxc idx =\n      (\\<lambda>tw. lof_wline tw OUT idxc = take len (replicate amount False @ lof_wline tw IN idx))\"\n\ndefinition inv :: \"sig assn2\" where\n  \"inv tw \\<equiv> (\\<forall>i < fst tw. property (i + 1) i tw)\"\n\ndefinition inv2 :: \"sig assn2\" where\n  \"inv2 tw \\<equiv> (disjnt {IN} (event_of tw) \\<longrightarrow> (\\<forall>i \\<ge> fst tw. property (i + 1) (fst tw) tw))\"\n\nabbreviation \"next_world tw \\<equiv> (next_time_world tw, snd tw)\"\n\nlemma inv_next_time:\n  assumes \"inv tw\"\n  assumes \"beval_world_raw2 tw (Bshiftr (Bsig IN) amount) v\" and \"type_of v = Lty Uns len\"\n  defines \"tw' \\<equiv> tw[OUT, 1 :=\\<^sub>2 v]\"\n  shows   \"inv (next_time_world tw', snd tw')\"\n  unfolding inv_def\nproof (rule, rule)\n  fix i\n  assume \"i < fst (next_world tw')\"\n  hence \"i < next_time_world tw'\"\n    by auto\n  have \"fst tw' < next_time_world tw'\"\n    using next_time_world_at_least  using nat_less_le by blast\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  ultimately have \"fst tw < next_time_world tw'\"\n    by auto\n  hence \"i < fst tw \\<or> fst tw \\<le> i \\<and> i < next_time_world tw' - 1 \\<or> i = next_time_world tw' - 1\"\n    using \\<open>i < next_time_world tw'\\<close> by linarith\n  moreover\n  { assume \"i < fst tw\"\n    have \"lof_wline tw' OUT (i + 1) = lof_wline tw OUT (i + 1)\"\n      by (metis \\<open>i < get_time tw\\<close> add_mono1 tw'_def worldline_upd2_before_dly)\n    also have \"... = take len (replicate amount False @ lof_wline tw IN i)\"\n      using assms(1) \\<open>i < fst tw\\<close> unfolding inv_def property_def by auto\n    also have \"... = take len (replicate amount False @ lof_wline tw' IN i)\"\n      by (metis \\<open>i < get_time tw\\<close> add.commute trans_less_add2 tw'_def worldline_upd2_before_dly)\n    finally have \"property (i + 1) i (next_time_world tw', snd tw')\"\n      unfolding property_def by auto }\n  moreover\n  { assume \"fst tw \\<le> i \\<and> i < next_time_world tw' - 1\"\n    hence \"fst tw \\<le> i\" and \"i < next_time_world tw' - 1\"\n      by auto\n    hence \"lof_wline tw' OUT (i + 1) = lof_wline tw' OUT (fst tw + 1)\"\n      using unchanged_until_next_time_world\n      by (metis (mono_tags, lifting) Suc_eq_plus1 \\<open>get_time tw = get_time tw'\\<close> le_Suc_eq le_add1\n          le_less_trans less_diff_conv)\n    moreover have \"lof_wline tw' IN i = lof_wline tw' IN (fst tw)\"\n      using unchanged_until_next_time_world\n      by (metis \\<open>get_time tw = get_time tw'\\<close> \\<open>get_time tw \\<le> i\\<close> \\<open>i < next_time_world tw'\\<close>)\n    moreover have \"property (fst tw + 1) (fst tw) tw'\"\n    proof -\n      have assm2: \"beval_world_raw (snd tw) (fst tw) (Bshiftr (Bsig IN) amount) v\"\n        using assms(2) unfolding beval_world_raw2_def by auto\n      have \"wline_of tw' OUT (fst tw + 1) = v\"\n        unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n      also have \"... =  Lv Uns (take len (replicate amount False @ lof_wline tw IN (fst tw)))\"\n        apply (rule beval_world_raw_cases[OF assm2])\n        apply ( erule_tac[!] beval_cases)+\n        unfolding state_of_world_def\n        apply (metis assms(3) comp_eq_dest_lhs length_append length_replicate length_take min_minus\n               min_pm take_append take_replicate ty.inject type_of.simps(2) val.sel(3))\n        using assms(3) by auto\n      also have \"... =  Lv Uns (take len (replicate amount False @ lof_wline tw' IN (fst tw)))\"\n        by (metis less_add_one tw'_def worldline_upd2_before_dly)\n      finally show ?thesis\n        unfolding property_def bin_to_bl_def by auto\n    qed\n    ultimately have \"property (i + 1) i (next_world tw')\"\n      unfolding property_def by auto }\n  moreover\n  { assume \"i = next_time_world tw' - 1\"\n    hence \"lof_wline tw' OUT (i + 1) = lof_wline tw' OUT (next_time_world tw')\"\n      using \\<open>i < next_time_world tw'\\<close> by force\n    also have \"... = lof_wline tw' OUT (fst tw + 1)\"\n      using \\<open>fst tw < next_time_world tw'\\<close> unfolding tw'_def worldline_upd2_def\n      worldline_upd_def by auto\n    finally have \"lof_wline tw' OUT (i + 1) = lof_wline tw' OUT (fst tw + 1)\"\n      by auto\n    moreover have \"property (fst tw + 1) (fst tw) tw'\"\n    proof -\n      have assm2: \"beval_world_raw (snd tw) (fst tw) (Bshiftr (Bsig IN) amount) v\"\n        using assms(2) unfolding beval_world_raw2_def by auto\n      have \"wline_of tw' OUT (fst tw + 1) = v\"\n        unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n      also have \"... =  Lv Uns (take len (replicate amount False @ lof_wline tw IN (fst tw)))\"\n        apply (rule beval_world_raw_cases[OF assm2])\n        apply ( erule_tac[!] beval_cases)+\n        unfolding state_of_world_def\n        apply (metis assms(3) comp_eq_dest_lhs length_append length_replicate length_take min_minus\n               min_pm take_append take_replicate ty.inject type_of.simps(2) val.sel(3))\n        using assms(3) by auto\n      also have \"... =  Lv Uns (take len (replicate amount False @ lof_wline tw' IN (fst tw)))\"\n        by (metis less_add_one tw'_def worldline_upd2_before_dly)\n      finally show ?thesis\n        unfolding property_def bin_to_bl_def by auto\n    qed\n    moreover have \"lof_wline tw' IN i = lof_wline tw' IN (fst tw)\"\n      using unchanged_until_next_time_world\n      by (metis \\<open>get_time tw < next_time_world tw'\\<close> \\<open>get_time tw = get_time tw'\\<close> \\<open>i <\n      next_time_world tw'\\<close> \\<open>i = next_time_world tw' - 1\\<close> add_le_imp_le_diff discrete)+\n    ultimately have \"property (i + 1) i (next_world tw')\"\n      unfolding property_def by auto }\n  ultimately show \"property (i + 1) i (next_world tw')\"\n    by auto\nqed\n\nlemma type_correctness_length:\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  assumes \"beval_world_raw2 tw (Bshiftr (Bsig IN) amount) v\"\n  shows   \"type_of v = Lty Uns len\"\nproof -\n  have \"beval_world_raw (snd tw) (fst tw) (Bshiftr (Bsig IN) amount) v\"\n    using assms(2) unfolding beval_world_raw2_def by auto\n  have *: \"type_of (state_of_world (snd tw) (fst tw) IN) = Lty Uns len\"\n    using assms(1) unfolding wityping_def\n    by (metis state_of_world_def unsigned_shift_right_axioms unsigned_shift_right_def wtyping_def)\n  show ?thesis\n    apply (rule beval_world_raw_cases[OF \\<open>beval_world_raw (snd tw) (fst tw) (Bshiftr (Bsig IN) amount) v\\<close>])\n    apply (erule beval_cases)+\n    unfolding state_of_world_def\n    apply (metis \"*\" length_append length_replicate length_take min_minus min_pm state_of_world_def type_of.simps(2))\n    apply (erule beval_cases)+\n    apply (metis \"*\" signedness.distinct(5) state_of_world_def ty.inject type_of.simps(2))\n    done\nqed\n\nlemma seq_hoare_next_time:\n  \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans OUT (Bshiftr (Bsig IN) amount) 1\n     [\\<lambda>tw. inv (next_world tw)]\"\n  apply (rule Conseq2[where Q=\"\\<lambda>tw. inv (next_world tw) \\<and> wityping \\<Gamma> (snd tw)\", rotated 1], rule Assign2, simp)\n  using inv_next_time type_correctness_length\n  by (metis BassignE_hoare2 seq_stmt_preserve_wityping_hoare well_typed)\n\nlemma aux:\n  \"\\<And>tw. inv (next_world tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)\"\n  unfolding inv_def property_def by simp\n\nlemma seq_hoare_next_time_post:\n  \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans OUT (Bshiftr (Bsig IN) amount) 1\n     [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)]\"\n  apply (rule Conseq2[rotated])\n    apply (rule seq_hoare_next_time)\n  by (auto simp add: aux)\n\nlemma seq_hoare_next_time0:\n  \"\\<turnstile> [\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans OUT (Bshiftr (Bsig IN) amount) 1\n     [\\<lambda>tw. inv (next_world tw)]\"\n  apply (rule Conseq2[where Q=\"\\<lambda>tw. inv (next_world tw) \\<and> wityping \\<Gamma> (snd tw)\", rotated 1], rule Assign2, simp)\n  using inv_next_time type_correctness_length unfolding inv_def\n  by (metis BassignE_hoare2 gr_implies_not_zero seq_stmt_preserve_wityping_hoare well_typed)\n\nlemma conc_hoare:\n  \"\\<And>tw. inv tw \\<and> inv2 tw \\<and> disjnt {IN} (event_of tw) \\<Longrightarrow> inv (next_world tw)\"\nproof -\n  fix tw\n  assume \"inv tw \\<and> inv2 tw \\<and> disjnt {IN} (event_of tw)\"\n  hence \"inv tw\" and \"inv2 tw\" and \"disjnt {IN} (event_of tw)\"\n    by auto\n  { fix i\n    assume \"i < next_time_world tw\"\n    have \"fst tw < next_time_world tw\"\n      by (simp add: next_time_world_at_least)\n    have \"i < fst tw \\<or> fst tw \\<le> i\"\n      by auto\n    moreover\n    { assume \"i < fst tw\"\n      hence \"property (i + 1) i tw\"\n        using \\<open>inv tw\\<close> unfolding inv_def by auto\n      hence \"property (i + 1) i (next_world tw)\"\n        unfolding property_def by simp }\n    moreover\n    { assume \"fst tw \\<le> i\"\n      moreover have \"\\<forall>i \\<ge> fst tw. property (i + 1) (fst tw) tw\"\n        using \\<open>inv2 tw\\<close> \\<open>disjnt {IN} (event_of tw)\\<close> unfolding inv2_def\n        by auto\n      ultimately have \"property (i + 1) (fst tw) tw\"\n        by auto\n      hence \"property (i + 1) i tw\"\n        unfolding property_def\n        by (metis \\<open>get_time tw \\<le> i\\<close> \\<open>i < next_time_world tw\\<close> unchanged_until_next_time_world)\n      hence \"property (i + 1) i (next_world tw)\"\n        unfolding property_def by auto }\n    ultimately have \"property (i + 1) i (next_world tw)\"\n      by auto }\n  thus \"inv (next_world tw)\"\n    unfolding inv_def by auto\nqed\n\nlemma conc_hoare2:\n  \"\\<And>tw. inv tw \\<and> inv2 tw \\<and> disjnt {IN} (event_of tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv2 (j, snd tw)\"\nproof (rule)\n  fix tw :: \"nat \\<times> (sig \\<Rightarrow> val) \\<times> (sig \\<Rightarrow> nat \\<Rightarrow> val)\"\n  fix j\n  assume \"j \\<in> {fst tw <.. next_time_world tw}\"\n  assume \"inv tw \\<and> inv2 tw \\<and> disjnt {IN} (event_of tw)\"\n  hence \"inv tw\" and \"inv2 tw\" and \"disjnt {IN} (event_of tw)\"\n    by auto\n  { assume \"disjnt {IN} (event_of (j, snd tw))\"\n    hence *: \"lof_wline tw IN j = lof_wline tw IN (j - 1)\"\n      unfolding event_of_alt_def\n      by (smt comp_apply diff_0_eq_0 disjnt_insert1 fst_conv mem_Collect_eq snd_conv)\n    have \"fst tw < j\"\n      using \\<open>j \\<in> {get_time tw<..next_time_world tw}\\<close> by auto \n    { fix i\n      assume \"j \\<le> i\"\n      have \"property (i + 1) (fst tw) tw\"\n        using \\<open>inv2 tw\\<close> \\<open>disjnt {IN} (event_of tw)\\<close> unfolding inv2_def\n        using \\<open>get_time tw < j\\<close> \\<open>j \\<le> i\\<close> by auto\n      moreover have \"lof_wline tw IN (fst tw) = lof_wline tw IN (j - 1)\"\n        by (metis (no_types, lifting) One_nat_def \\<open>j \\<in> {get_time tw<..next_time_world tw}\\<close>\n        add.commute add_le_imp_le_diff diff_add discrete gr_implies_not0 greaterThanAtMost_iff\n        not_less_iff_gr_or_eq plus_1_eq_Suc unchanged_until_next_time_world)\n      ultimately have \"property (i + 1) j (j, snd tw)\"\n        unfolding property_def using *  by auto }\n    hence \"\\<forall>i\\<ge>j. property (i + 1) j (j, snd tw)\"\n      by auto }\n  thus \"inv2 (j, snd tw)\"\n    unfolding inv2_def by auto\nqed\n\nlemma inv2_next_time:\n  fixes tw\n  assumes \"beval_world_raw2 tw (Bshiftr (Bsig IN) amount) v\" and \"type_of v = Lty Uns len\"\n  defines \"tw' \\<equiv> tw[OUT, 1 :=\\<^sub>2 v]\"\n  shows   \"\\<forall>j \\<in> {fst tw' <.. next_time_world tw'}. inv2 (j, snd tw')\"\n  unfolding inv2_def\nproof (rule, rule, rule, rule)\n  fix i j\n  assume \"j \\<in> {fst tw' <.. next_time_world tw'}\"\n  assume \"disjnt {IN} (event_of (j, snd tw'))\"\n  hence \"IN \\<notin> event_of (j, snd tw')\"\n    by auto\n  assume \"fst (j, snd tw') \\<le> i\"\n  hence \"j \\<le> i\"\n    by auto\n  have \"fst tw' < j\"\n    using \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close> greaterThanAtMost_iff by blast\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def unfolding worldline_upd2_def by auto\n  ultimately have \"fst tw < j\"\n    by auto\n  have 0: \"wline_of (next_world tw') IN j = wline_of tw IN (fst tw)\"\n  proof -\n    have \"wline_of tw' IN j = wline_of tw' IN (j - 1)\"\n      using \\<open>IN \\<notin> event_of (j, snd tw')\\<close> unfolding event_of_alt_def\n      using \\<open>get_time tw' < j\\<close> by auto\n    also have \" ... = wline_of tw' IN (fst tw')\"\n      using unchanged_until_next_time_world\n      by (metis (no_types, lifting) Suc_diff_1 \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close>\n      gr_implies_not_zero greaterThanAtMost_iff le_0_eq less_Suc_eq_le not_less)\n    also have \"... = wline_of tw' IN (fst tw)\"\n      by (simp add: \\<open>get_time tw = get_time tw'\\<close>)\n    also have \"... = wline_of tw IN (fst tw)\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    finally show \"wline_of (next_world tw') IN j = wline_of tw IN (fst tw)\"\n      by auto\n  qed\n  have assm2: \"beval_world_raw (snd tw) (fst tw) (Bshiftr (Bsig IN) amount) v\"\n    using assms(1) unfolding beval_world_raw2_def by auto\n  have \"wline_of (next_world tw') OUT (i + 1) = v\"\n  proof -\n    have \"wline_of tw' OUT (i + 1) = v\"\n      using `fst tw < j` \\<open>j \\<le> i\\<close>\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    thus ?thesis\n      by auto\n  qed\n  also have \"lval_of ... = take len (replicate amount False @ lof_wline tw IN (fst tw))\"\n    apply (rule beval_world_raw_cases[OF assm2])\n    apply (erule_tac[!] beval_cases)+\n    apply (metis assms(2) comp_def length_append length_replicate length_take min_minus min_pm\n           state_of_world_def take_append take_replicate ty.inject type_of.simps(2) val.sel(3))\n    using assms(2) by auto\n  finally have \"property (i + 1) j (j, snd tw')\"\n    unfolding property_def using 0  by auto\n  thus \"property (i + 1) (get_time (j, snd tw')) (j, snd tw')\"\n    by auto\nqed\n\nlemma seq_hoare_next_time1:\n  shows \"\\<turnstile> [\\<lambda>tw. wityping \\<Gamma> (snd tw)] \n              Bassign_trans OUT (Bshiftr (Bsig IN) amount) 1 \n           [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv2 (j, snd tw)]\"\n  apply (rule Assign2_altI)\n  using inv2_next_time type_correctness_length by blast\n\nlemma conc_hoare3:\n  \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n        shiftr amount \n     \\<lbrace>\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw) \\<and> inv2 (j, snd tw)\\<rbrace>\"\n  unfolding shiftr_def\n  apply (rule Single)\n   apply (rule Conj_univ_qtfd)\n    apply (rule Conseq2[rotated])\n      apply (rule seq_hoare_next_time_post, simp, simp)\n   apply (rule Conseq2[rotated])\n     apply (rule seq_hoare_next_time1, simp, simp)\n  using conc_hoare conc_hoare2 aux by blast\n\nlemma seq_wt_sub:\n  \"seq_wt \\<Gamma> (Bassign_trans OUT (Bshiftr (Bsig IN) amount) 1)\"\n  using well_typed by blast\n\nlemma conc_hoare4:\n  \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n        shiftr amount \n     \\<lbrace>\\<lambda>tw. \\<forall>i\\<in>{get_time tw<..next_time_world tw}. (local.inv (i, snd tw) \\<and> inv2 (i, snd tw)) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule Conj2_univ_qtfd[where R=\"\\<lambda>tw. wityping \\<Gamma> (snd tw)\", unfolded snd_conv])\n   apply (rule conc_hoare3)\n  apply (rule strengthen_pre_conc_hoare[rotated])\n   apply (rule weaken_post_conc_hoare[rotated])\n    apply (unfold shiftr_def, rule single_conc_stmt_preserve_wityping_hoare)\n    apply (rule seq_wt_sub)\n  by auto\n\nlemma conc_sim':\n  \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n        shiftr amount \n      \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule While)\n  apply (unfold snd_conv, rule conc_hoare4)\n  done\n\nlemma conc_sim2:\n  \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> shiftr amount \\<lbrace>inv\\<rbrace>\"\n  using conc_sim' Conseq_sim by blast\n\nlemma init_sat_inv:\n  \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) (shiftr amount) (\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw))\"\n  unfolding shiftr_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conj)\n  unfolding snd_conv apply(rule seq_hoare_next_time0)\n  apply (rule strengthen_precondition2)\n  by (metis seq_stmt_preserve_wityping_hoare well_typed)\n\nlemma init_sat_inv2:\n  \"init_sim_hoare (\\<lambda>tw. wityping \\<Gamma> (snd tw)) (shiftr amount) inv2\"\n  unfolding shiftr_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conseq2[rotated])  \n  apply (rule seq_hoare_next_time1)\n  by (auto simp add: next_time_world_at_least)\n  \nlemma init_sat_inv_comb:\n  shows \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) (shiftr amount)  (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n  apply (rule ConjI_sim)\n  apply (rule init_sat_inv)\n  apply (rule ConseqI_sim[rotated])\n  apply (rule init_sat_inv2)\n  by blast+\n\nlemma correctness:\n  assumes \"sim_fin w (i + 1) (shiftr amount) tw'\" and \"wityping \\<Gamma> w\"\n  shows   \"property (i + 1) i tw'\"\nproof -\n  obtain tw where \"init_sim (0, w) (shiftr amount) tw\" and  \"tw, i + 1, shiftr amount \\<Rightarrow>\\<^sub>S tw'\"\n    using premises_sim_fin_obt[OF assms(1)] by auto\n  hence \"i + 1 = fst tw'\"\n    using world_maxtime_lt_fst_tres  by blast\n  have \"conc_stmt_wf (shiftr amount)\"\n    unfolding conc_stmt_wf_def shiftr_def by auto\n  moreover have \"nonneg_delay_conc (shiftr amount)\"\n    unfolding shiftr_def by auto\n  ultimately have \"init_sim_valid (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) (shiftr amount) (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n    using init_sim_hoare_soundness[OF init_sat_inv_comb]\n    by (metis (no_types, lifting) conc_wt_cases(1) init_sat_inv_comb\n    init_sim_hoare_soundness sub_def strengthen_precondition_init_sim_hoare)\n  hence \"inv tw \\<and> wityping \\<Gamma> (snd tw) \\<and> inv2 tw\"\n    using \\<open>init_sim (0, w) (shiftr amount) tw\\<close> fst_conv assms(2) unfolding init_sim_valid_def\n    by (metis snd_conv)\n  hence \"inv tw\" and \"inv2 tw\" and \"wityping \\<Gamma> (snd tw)\"\n    by auto\n  moreover have \"\\<Turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (local.inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> Shift_Right_Hoare.shiftr amount \\<lbrace>local.inv\\<rbrace>\"\n    using conc_sim_soundness[OF conc_sim2] \\<open>conc_stmt_wf (shiftr amount)\\<close> \\<open>nonneg_delay_conc (shiftr amount)\\<close>\n    by auto\n  ultimately have \"inv tw'\"\n    using \\<open>tw, i + 1, shiftr amount \\<Rightarrow>\\<^sub>S tw'\\<close> unfolding sim_hoare_valid_def by blast\n  with \\<open>i + 1 = fst tw'\\<close> show ?thesis\n    unfolding inv_def  by (metis less_add_one)\nqed\n\nlemma correctness_wityping:\n  assumes \"sim_fin w (i + 1) (shiftr amount) tw'\" and \"wityping \\<Gamma> w\"\n  shows   \"wityping \\<Gamma> (snd tw')\"\nproof -\n  obtain tw where \"init_sim (0, w) (shiftr amount) tw\" and  \"tw, i + 1, (shiftr amount) \\<Rightarrow>\\<^sub>S tw'\"\n    using premises_sim_fin_obt[OF assms(1)] by auto\n  hence \"i + 1 = fst tw'\"\n    using world_maxtime_lt_fst_tres  by blast\n  have \"conc_stmt_wf (shiftr amount)\"\n    unfolding conc_stmt_wf_def shiftr_def by auto\n  moreover have \"nonneg_delay_conc (shiftr amount)\"\n    unfolding shiftr_def by auto\n  ultimately have \"init_sim_valid (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) (shiftr amount) (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n    using init_sim_hoare_soundness[OF init_sat_inv_comb]\n    by (metis (no_types, lifting) conc_wt_cases(1) init_sat_inv_comb\n    init_sim_hoare_soundness sub_def strengthen_precondition_init_sim_hoare)\n  hence \"inv tw \\<and> wityping \\<Gamma> (snd tw) \\<and> inv2 tw\"\n    using \\<open>init_sim (0, w) (shiftr amount) tw\\<close> fst_conv assms(2) unfolding init_sim_valid_def\n    by (metis snd_conv)\n  hence \"inv tw\" and \"inv2 tw\" and \"wityping \\<Gamma> (snd tw)\"\n    by auto\n  moreover have \"\\<Turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw\\<rbrace> (shiftr amount) \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>\"\n    using conc_sim_soundness[OF conc_sim'] \\<open>conc_stmt_wf (shiftr amount)\\<close> \\<open>nonneg_delay_conc (shiftr amount)\\<close>\n    by (smt sim_hoare_valid_def)\n  ultimately show \"wityping \\<Gamma> (snd tw')\"\n    using \\<open>tw, i + 1, (shiftr amount) \\<Rightarrow>\\<^sub>S tw'\\<close> unfolding sim_hoare_valid_def by blast\nqed\n\ncorollary correctness2:\n  assumes \"sim_fin w (i + 1) (shiftr amount) tw'\" and \"wityping \\<Gamma> w\"\n  defines \"bsIN  \\<equiv> lof_wline tw' IN i\"\n  defines \"bsOUT \\<equiv> lof_wline tw' OUT (i + 1)\"\n  shows   \"(\\<Sum>i = 0..<length bsOUT. (int \\<circ> of_bool) (rev bsOUT ! i) * 2 ^ i) =\n          ((\\<Sum>i = 0..<length bsIN. (int \\<circ> of_bool) (rev bsIN  ! i) * 2 ^ i) div (2 ^ amount)) \"\nproof -\n  have \"wityping \\<Gamma> (snd tw')\"\n    using correctness_wityping[OF assms(1-2)] by auto\n  hence \"length bsIN = len\"\n    by (smt assms(3) o_apply ty.distinct(1) ty.inject type_of.elims unsigned_shift_right_axioms\n    unsigned_shift_right_def val.sel(3) wityping_def wtyping_def)\n  have \"property (i + 1) i tw'\" and \"wityping \\<Gamma> (snd tw')\"\n    using correctness[OF assms(1-2)] correctness_wityping[OF assms(1-2)] by auto\n  hence \"lof_wline tw' OUT (i + 1) = take len (replicate amount False @ lof_wline tw' IN i)\"\n    unfolding property_def by auto\n  hence \"bsOUT = take len (replicate amount False @ bsIN)\" (is \"_ = ?rhs\")\n    unfolding bsIN_def bsOUT_def by auto\n  hence \"bl_to_bin bsOUT = bl_to_bin ?rhs\"\n    by auto\n  also have \"... = (bin_rest ^^ amount) (bl_to_bin (replicate amount False @ bsIN))\"\n    using take_rest_bl2bin[where n=\"amount\"] \\<open>length bsIN = len\\<close>\n    by (metis add_diff_cancel_left' length_append length_replicate)\n  also have \"... = (bin_rest ^^ amount) (bl_to_bin bsIN)\"\n    using bl_to_bin_rep_F by auto\n  also have \"... = bl_to_bin bsIN div 2 ^ amount\"\n    unfolding bin_rest_compow by auto\n  finally have \"bl_to_bin bsOUT = bl_to_bin bsIN div 2 ^ amount\"\n    by auto\n  thus ?thesis\n    unfolding bl_to_bin_correctness by auto\nqed\n\nend\n\nlocale signed_shift_right =\n  fixes \\<Gamma> :: \"sig tyenv\"\n  fixes len :: nat\n  fixes amount :: nat\n  assumes \"0 < len\"\n  assumes \"\\<Gamma> IN = Lty Sig len \\<and> \\<Gamma> OUT = Lty Sig len\"\nbegin\n\nlemma well_typed:\n  \"seq_wt \\<Gamma> (Bassign_trans OUT (Bshiftr (Bsig IN) n) 1)\"\n  by (rule seq_wt.intros(4))\n     (metis bexp_wt.intros(24) bexp_wt.intros(3) signed_shift_right_axioms signed_shift_right_def)\n\nabbreviation \"lof_wline tw sig n \\<equiv> lval_of (wline_of tw sig n)\"\n\ntext \\<open>Here we factor out common expression in both inv1 and inv2. It is parametrised by the index\nwe are interested with for C (first argument) and A (the second argument). Note that the index\nwe are interested with for A should be the same as the index for B.\\<close>\n\ndefinition property :: \"nat \\<Rightarrow> nat \\<Rightarrow> sig assn2\" where\n  \"property idxc idx =\n      (\\<lambda>tw. let bs = lof_wline tw IN idx in lof_wline tw OUT idxc = take len (replicate amount (hd bs) @ bs))\"\n\ndefinition inv :: \"sig assn2\" where\n  \"inv tw \\<equiv> (\\<forall>i < fst tw. property (i + 1) i tw)\"\n\ndefinition inv2 :: \"sig assn2\" where\n  \"inv2 tw \\<equiv> (disjnt {IN} (event_of tw) \\<longrightarrow> (\\<forall>i \\<ge> fst tw. property (i + 1) (fst tw) tw))\"\n\nabbreviation \"next_world tw \\<equiv> (next_time_world tw, snd tw)\"\n\nlemma inv_next_time:\n  assumes \"inv tw\"\n  assumes \"beval_world_raw2 tw (Bshiftr (Bsig IN) amount) v\" and \"type_of v = Lty Sig len\"\n  defines \"tw' \\<equiv> tw[OUT, 1 :=\\<^sub>2 v]\"\n  shows   \"inv (next_time_world tw', snd tw')\"\n  unfolding inv_def\nproof (rule, rule)\n  fix i\n  assume \"i < fst (next_world tw')\"\n  hence \"i < next_time_world tw'\"\n    by auto\n  let ?bs = \"lof_wline tw IN i\"\n  let ?bs' = \"lof_wline tw' IN i\"\n  have \"fst tw' < next_time_world tw'\"\n    using next_time_world_at_least  using nat_less_le by blast\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  ultimately have \"fst tw < next_time_world tw'\"\n    by auto\n  hence \"i < fst tw \\<or> fst tw \\<le> i \\<and> i < next_time_world tw' - 1 \\<or> i = next_time_world tw' - 1\"\n    using \\<open>i < next_time_world tw'\\<close> by linarith\n  moreover\n  { assume \"i < fst tw\"\n    have \"lof_wline tw' OUT (i + 1) = lof_wline tw OUT (i + 1)\"\n      by (metis \\<open>i < get_time tw\\<close> add_mono1 tw'_def worldline_upd2_before_dly)\n    also have \"... = take len (replicate amount (hd ?bs) @ ?bs)\"\n      using assms(1) \\<open>i < fst tw\\<close> unfolding inv_def property_def Let_def by auto\n    also have \"... = take len (replicate amount (hd ?bs') @ ?bs')\"\n      by (metis \\<open>i < get_time tw\\<close> add.commute trans_less_add2 tw'_def worldline_upd2_before_dly)\n    finally have \"property (i + 1) i (next_time_world tw', snd tw')\"\n      unfolding property_def Let_def by auto }\n  moreover\n  { assume \"fst tw \\<le> i \\<and> i < next_time_world tw' - 1\"\n    hence \"fst tw \\<le> i\" and \"i < next_time_world tw' - 1\"\n      by auto\n    hence \"lof_wline tw' OUT (i + 1) = lof_wline tw' OUT (fst tw + 1)\"\n      using unchanged_until_next_time_world\n      by (metis (mono_tags, lifting) Suc_eq_plus1 \\<open>get_time tw = get_time tw'\\<close> le_Suc_eq le_add1\n          le_less_trans less_diff_conv)\n    moreover have \"lof_wline tw' IN i = lof_wline tw' IN (fst tw)\"\n      using unchanged_until_next_time_world\n      by (metis \\<open>get_time tw = get_time tw'\\<close> \\<open>get_time tw \\<le> i\\<close> \\<open>i < next_time_world tw'\\<close>)\n    moreover have \"property (fst tw + 1) (fst tw) tw'\"\n    proof -\n      have assm2: \"beval_world_raw (snd tw) (fst tw) (Bshiftr (Bsig IN) amount) v\"\n        using assms(2) unfolding beval_world_raw2_def by auto\n      have \"wline_of tw' OUT (fst tw + 1) = v\"\n        unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n      also have \"... =  Lv Sig (take len (replicate amount (hd (lof_wline tw IN (fst tw))) @ lof_wline tw IN (fst tw)))\"\n        apply (rule beval_world_raw_cases[OF assm2])\n        apply ( erule_tac[!] beval_cases)+\n        prefer 2\n        unfolding state_of_world_def\n        apply (metis (no_types, lifting) assms(3) comp_eq_dest_lhs length_append length_replicate\n               length_take min_minus min_pm take_append take_replicate ty.inject type_of.simps(2)\n               val.sel(3))\n        using assms(3) by auto\n      also have \"... =  Lv Sig (take len (replicate amount (hd (lof_wline tw' IN (fst tw))) @ lof_wline tw' IN (fst tw)))\"\n        by (metis less_add_one tw'_def worldline_upd2_before_dly)\n      finally show ?thesis\n        unfolding property_def bin_to_bl_def by auto\n    qed\n    ultimately have \"property (i + 1) i (next_world tw')\"\n      unfolding property_def by auto }\n  moreover\n  { assume \"i = next_time_world tw' - 1\"\n    hence \"lof_wline tw' OUT (i + 1) = lof_wline tw' OUT (next_time_world tw')\"\n      using \\<open>i < next_time_world tw'\\<close> by force\n    also have \"... = lof_wline tw' OUT (fst tw + 1)\"\n      using \\<open>fst tw < next_time_world tw'\\<close> unfolding tw'_def worldline_upd2_def\n      worldline_upd_def by auto\n    finally have \"lof_wline tw' OUT (i + 1) = lof_wline tw' OUT (fst tw + 1)\"\n      by auto\n    moreover have \"property (fst tw + 1) (fst tw) tw'\"\n    proof -\n      have assm2: \"beval_world_raw (snd tw) (fst tw) (Bshiftr (Bsig IN) amount) v\"\n        using assms(2) unfolding beval_world_raw2_def by auto\n      have \"wline_of tw' OUT (fst tw + 1) = v\"\n        unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n      also have \"... =  Lv Sig (take len (replicate amount (hd (lof_wline tw IN (fst tw))) @ lof_wline tw IN (fst tw)))\"\n        apply (rule beval_world_raw_cases[OF assm2])\n        apply ( erule_tac[!] beval_cases)+\n        prefer 2\n        unfolding state_of_world_def\n        apply (metis (no_types, lifting) assms(3) comp_eq_dest_lhs length_append length_replicate\n               length_take min_minus min_pm take_append take_replicate ty.inject type_of.simps(2)\n               val.sel(3))\n        using assms(3) by auto\n      also have \"... =  Lv Sig (take len (replicate amount (hd (lof_wline tw' IN (fst tw))) @ lof_wline tw' IN (fst tw)))\"\n        by (metis less_add_one tw'_def worldline_upd2_before_dly)\n      finally show ?thesis\n        unfolding property_def bin_to_bl_def by auto\n    qed\n    moreover have \"lof_wline tw' IN i = lof_wline tw' IN (fst tw)\"\n      using unchanged_until_next_time_world\n      by (metis \\<open>get_time tw < next_time_world tw'\\<close> \\<open>get_time tw = get_time tw'\\<close> \\<open>i <\n      next_time_world tw'\\<close> \\<open>i = next_time_world tw' - 1\\<close> add_le_imp_le_diff discrete)+\n    ultimately have \"property (i + 1) i (next_world tw')\"\n      unfolding property_def by auto }\n  ultimately show \"property (i + 1) i (next_world tw')\"\n    by auto\nqed\n\nlemma type_correctness_length:\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  assumes \"beval_world_raw2 tw (Bshiftr (Bsig IN) amount) v\"\n  shows   \"type_of v = Lty Sig len\"\nproof -\n  have \"beval_world_raw (snd tw) (fst tw) (Bshiftr (Bsig IN) amount) v\"\n    using assms(2) unfolding beval_world_raw2_def by auto\n  have *: \"type_of (state_of_world (snd tw) (fst tw) IN) = Lty Sig len\"\n    using assms(1) unfolding wityping_def\n    by (metis state_of_world_def signed_shift_right_axioms signed_shift_right_def wtyping_def)\n  show ?thesis\n    apply (rule beval_world_raw_cases[OF \\<open>beval_world_raw (snd tw) (fst tw) (Bshiftr (Bsig IN) amount) v\\<close>])\n    apply (erule beval_cases)+\n    unfolding state_of_world_def\n    apply (metis \"*\" length_append length_replicate length_take min_minus min_pm state_of_world_def type_of.simps(2))\n    apply (erule beval_cases)+\n    apply (metis \"*\" length_append length_replicate length_take min_minus min_pm state_of_world_def type_of.simps(2))\n    done\nqed\n\nlemma seq_hoare_next_time:\n  \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans OUT (Bshiftr (Bsig IN) amount) 1\n     [\\<lambda>tw. inv (next_world tw)]\"\n  apply (rule Conseq2[where Q=\"\\<lambda>tw. inv (next_world tw) \\<and> wityping \\<Gamma> (snd tw)\", rotated 1], rule Assign2, simp)\n  using inv_next_time type_correctness_length\n  by (metis BassignE_hoare2 seq_stmt_preserve_wityping_hoare well_typed)\n\nlemma aux:\n  \"\\<And>tw. inv (next_world tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)\"\n  unfolding inv_def property_def by simp\n\nlemma seq_hoare_next_time_post:\n  \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans OUT (Bshiftr (Bsig IN) amount) 1\n     [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)]\"\n  apply (rule Conseq2[rotated])\n    apply (rule seq_hoare_next_time)\n  by (auto simp add: aux)\n\nlemma seq_hoare_next_time0:\n  \"\\<turnstile> [\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans OUT (Bshiftr (Bsig IN) amount) 1\n     [\\<lambda>tw. inv (next_world tw)]\"\n  apply (rule Conseq2[where Q=\"\\<lambda>tw. inv (next_world tw) \\<and> wityping \\<Gamma> (snd tw)\", rotated 1], rule Assign2, simp)\n  using inv_next_time type_correctness_length unfolding inv_def\n  by (metis BassignE_hoare2 gr_implies_not_zero seq_stmt_preserve_wityping_hoare well_typed)\n\nlemma conc_hoare:\n  \"\\<And>tw. inv tw \\<and> inv2 tw \\<and> disjnt {IN} (event_of tw) \\<Longrightarrow> inv (next_world tw)\"\nproof -\n  fix tw\n  assume \"inv tw \\<and> inv2 tw \\<and> disjnt {IN} (event_of tw)\"\n  hence \"inv tw\" and \"inv2 tw\" and \"disjnt {IN} (event_of tw)\"\n    by auto\n  { fix i\n    assume \"i < next_time_world tw\"\n    have \"fst tw < next_time_world tw\"\n      by (simp add: next_time_world_at_least)\n    have \"i < fst tw \\<or> fst tw \\<le> i\"\n      by auto\n    moreover\n    { assume \"i < fst tw\"\n      hence \"property (i + 1) i tw\"\n        using \\<open>inv tw\\<close> unfolding inv_def by auto\n      hence \"property (i + 1) i (next_world tw)\"\n        unfolding property_def by simp }\n    moreover\n    { assume \"fst tw \\<le> i\"\n      moreover have \"\\<forall>i \\<ge> fst tw. property (i + 1) (fst tw) tw\"\n        using \\<open>inv2 tw\\<close> \\<open>disjnt {IN} (event_of tw)\\<close> unfolding inv2_def\n        by auto\n      ultimately have \"property (i + 1) (fst tw) tw\"\n        by auto\n      hence \"property (i + 1) i tw\"\n        unfolding property_def\n        by (metis \\<open>get_time tw \\<le> i\\<close> \\<open>i < next_time_world tw\\<close> unchanged_until_next_time_world)\n      hence \"property (i + 1) i (next_world tw)\"\n        unfolding property_def by auto }\n    ultimately have \"property (i + 1) i (next_world tw)\"\n      by auto }\n  thus \"inv (next_world tw)\"\n    unfolding inv_def by auto\nqed\n\nlemma conc_hoare2:\n  \"\\<And>tw. inv tw \\<and> inv2 tw \\<and> disjnt {IN} (event_of tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv2 (j, snd tw)\"\nproof (rule)\n  fix tw :: \"nat \\<times> (sig \\<Rightarrow> val) \\<times> (sig \\<Rightarrow> nat \\<Rightarrow> val)\"\n  fix j\n  assume \"j \\<in> {fst tw <.. next_time_world tw}\"\n  assume \"inv tw \\<and> inv2 tw \\<and> disjnt {IN} (event_of tw)\"\n  hence \"inv tw\" and \"inv2 tw\" and \"disjnt {IN} (event_of tw)\"\n    by auto\n  { assume \"disjnt {IN} (event_of (j, snd tw))\"\n    hence *: \"lof_wline tw IN j = lof_wline tw IN (j - 1)\"\n      unfolding event_of_alt_def\n      by (smt comp_apply diff_0_eq_0 disjnt_insert1 fst_conv mem_Collect_eq snd_conv)\n    have \"fst tw < j\"\n      using \\<open>j \\<in> {get_time tw<..next_time_world tw}\\<close> by auto \n    { fix i\n      assume \"j \\<le> i\"\n      have \"property (i + 1) (fst tw) tw\"\n        using \\<open>inv2 tw\\<close> \\<open>disjnt {IN} (event_of tw)\\<close> unfolding inv2_def\n        using \\<open>get_time tw < j\\<close> \\<open>j \\<le> i\\<close> by auto\n      moreover have \"lof_wline tw IN (fst tw) = lof_wline tw IN (j - 1)\"\n        by (metis (no_types, lifting) One_nat_def \\<open>j \\<in> {get_time tw<..next_time_world tw}\\<close>\n        add.commute add_le_imp_le_diff diff_add discrete gr_implies_not0 greaterThanAtMost_iff\n        not_less_iff_gr_or_eq plus_1_eq_Suc unchanged_until_next_time_world)\n      ultimately have \"property (i + 1) j (j, snd tw)\"\n        unfolding property_def using *  by auto }\n    hence \"\\<forall>i\\<ge>j. property (i + 1) j (j, snd tw)\"\n      by auto }\n  thus \"inv2 (j, snd tw)\"\n    unfolding inv2_def by auto\nqed\n\nlemma inv2_next_time:\n  fixes tw\n  assumes \"beval_world_raw2 tw (Bshiftr (Bsig IN) amount) v\" and \"type_of v = Lty Sig len\"\n  defines \"tw' \\<equiv> tw[OUT, 1 :=\\<^sub>2 v]\"\n  shows   \"\\<forall>j \\<in> {fst tw' <.. next_time_world tw'}. inv2 (j, snd tw')\"\n  unfolding inv2_def\nproof (rule, rule, rule, rule)\n  fix i j\n  assume \"j \\<in> {fst tw' <.. next_time_world tw'}\"\n  assume \"disjnt {IN} (event_of (j, snd tw'))\"\n  hence \"IN \\<notin> event_of (j, snd tw')\"\n    by auto\n  assume \"fst (j, snd tw') \\<le> i\"\n  hence \"j \\<le> i\"\n    by auto\n  have \"fst tw' < j\"\n    using \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close> greaterThanAtMost_iff by blast\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def unfolding worldline_upd2_def by auto\n  ultimately have \"fst tw < j\"\n    by auto\n  have 0: \"wline_of (next_world tw') IN j = wline_of tw IN (fst tw)\"\n  proof -\n    have \"wline_of tw' IN j = wline_of tw' IN (j - 1)\"\n      using \\<open>IN \\<notin> event_of (j, snd tw')\\<close> unfolding event_of_alt_def\n      using \\<open>get_time tw' < j\\<close> by auto\n    also have \" ... = wline_of tw' IN (fst tw')\"\n      using unchanged_until_next_time_world\n      by (metis (no_types, lifting) Suc_diff_1 \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close>\n      gr_implies_not_zero greaterThanAtMost_iff le_0_eq less_Suc_eq_le not_less)\n    also have \"... = wline_of tw' IN (fst tw)\"\n      by (simp add: \\<open>get_time tw = get_time tw'\\<close>)\n    also have \"... = wline_of tw IN (fst tw)\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    finally show \"wline_of (next_world tw') IN j = wline_of tw IN (fst tw)\"\n      by auto\n  qed\n  have assm2: \"beval_world_raw (snd tw) (fst tw) (Bshiftr (Bsig IN) amount) v\"\n    using assms(1) unfolding beval_world_raw2_def by auto\n  have \"wline_of (next_world tw') OUT (i + 1) = v\"\n  proof -\n    have \"wline_of tw' OUT (i + 1) = v\"\n      using `fst tw < j` \\<open>j \\<le> i\\<close>\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    thus ?thesis\n      by auto\n  qed\n  also have \"lval_of ... = take len (replicate amount (hd (lof_wline tw IN (fst tw))) @ lof_wline tw IN (fst tw))\"\n    apply (rule beval_world_raw_cases[OF assm2])\n    apply (erule_tac[!] beval_cases)+\n    prefer 2\n    apply (metis (no_types, lifting) assms(2) comp_def length_append length_replicate length_take min_minus min_pm state_of_world_def take_append take_replicate ty.inject type_of.simps(2) val.sel(3))\n    using assms(2) by auto\n  finally have \"property (i + 1) j (j, snd tw')\"\n    unfolding property_def using 0  by auto\n  thus \"property (i + 1) (get_time (j, snd tw')) (j, snd tw')\"\n    by auto\nqed\n\nlemma seq_hoare_next_time1:\n  shows \"\\<turnstile> [\\<lambda>tw. wityping \\<Gamma> (snd tw)] \n              Bassign_trans OUT (Bshiftr (Bsig IN) amount) 1 \n           [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv2 (j, snd tw)]\"\n  apply (rule Assign2_altI)\n  using inv2_next_time type_correctness_length by blast\n\nlemma conc_hoare3:\n  \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n        shiftr amount \n     \\<lbrace>\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw) \\<and> inv2 (j, snd tw)\\<rbrace>\"\n  unfolding shiftr_def\n  apply (rule Single)\n   apply (rule Conj_univ_qtfd)\n    apply (rule Conseq2[rotated])\n      apply (rule seq_hoare_next_time_post, simp, simp)\n   apply (rule Conseq2[rotated])\n     apply (rule seq_hoare_next_time1, simp, simp)\n  using conc_hoare conc_hoare2 aux by blast\n\nlemma seq_wt_sub:\n  \"seq_wt \\<Gamma> (Bassign_trans OUT (Bshiftr (Bsig IN) amount) 1)\"\n  using well_typed by blast\n\nlemma conc_hoare4:\n  \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n        shiftr amount \n     \\<lbrace>\\<lambda>tw. \\<forall>i\\<in>{get_time tw<..next_time_world tw}. (local.inv (i, snd tw) \\<and> inv2 (i, snd tw)) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule Conj2_univ_qtfd[where R=\"\\<lambda>tw. wityping \\<Gamma> (snd tw)\", unfolded snd_conv])\n   apply (rule conc_hoare3)\n  apply (rule strengthen_pre_conc_hoare[rotated])\n   apply (rule weaken_post_conc_hoare[rotated])\n    apply (unfold shiftr_def, rule single_conc_stmt_preserve_wityping_hoare)\n    apply (rule seq_wt_sub)\n  by auto\n\nlemma conc_sim':\n  \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n        shiftr amount \n      \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule While)\n  apply (unfold snd_conv, rule conc_hoare4)\n  done\n\nlemma conc_sim2:\n  \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> shiftr amount \\<lbrace>inv\\<rbrace>\"\n  using conc_sim' Conseq_sim by blast\n\nlemma init_sat_inv:\n  \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) (shiftr amount) (\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw))\"\n  unfolding shiftr_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conj)\n  unfolding snd_conv apply(rule seq_hoare_next_time0)\n  apply (rule strengthen_precondition2)\n  by (metis seq_stmt_preserve_wityping_hoare well_typed)\n\nlemma init_sat_inv2:\n  \"init_sim_hoare (\\<lambda>tw. wityping \\<Gamma> (snd tw)) (shiftr amount) inv2\"\n  unfolding shiftr_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conseq2[rotated])\n  apply (rule seq_hoare_next_time1)\n  by (auto simp add: next_time_world_at_least)\n\nlemma init_sat_inv_comb:\n  shows \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) (shiftr amount)  (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n  apply (rule ConjI_sim)\n  apply (rule init_sat_inv)\n  apply (rule ConseqI_sim[rotated])\n  apply (rule init_sat_inv2)\n  by blast+\n\nlemma correctness:\n  assumes \"sim_fin w (i + 1) (shiftr amount) tw'\" and \"wityping \\<Gamma> w\"\n  shows   \"property (i + 1) i tw'\"\nproof -\n  obtain tw where \"init_sim (0, w) (shiftr amount) tw\" and  \"tw, i + 1, shiftr amount \\<Rightarrow>\\<^sub>S tw'\"\n    using premises_sim_fin_obt[OF assms(1)] by auto\n  hence \"i + 1 = fst tw'\"\n    using world_maxtime_lt_fst_tres  by blast\n  have \"conc_stmt_wf (shiftr amount)\"\n    unfolding conc_stmt_wf_def shiftr_def by auto\n  moreover have \"nonneg_delay_conc (shiftr amount)\"\n    unfolding shiftr_def by auto\n  ultimately have \"init_sim_valid (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) (shiftr amount) (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n    using init_sim_hoare_soundness[OF init_sat_inv_comb]\n    by (metis (no_types, lifting) conc_wt_cases(1) init_sat_inv_comb\n    init_sim_hoare_soundness sub_def strengthen_precondition_init_sim_hoare)\n  hence \"inv tw \\<and> wityping \\<Gamma> (snd tw) \\<and> inv2 tw\"\n    using \\<open>init_sim (0, w) (shiftr amount) tw\\<close> fst_conv assms(2) unfolding init_sim_valid_def\n    by (metis snd_conv)\n  hence \"inv tw\" and \"inv2 tw\" and \"wityping \\<Gamma> (snd tw)\"\n    by auto\n  moreover have \"\\<Turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (local.inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> Shift_Right_Hoare.shiftr amount \\<lbrace>local.inv\\<rbrace>\"\n    using conc_sim_soundness[OF conc_sim2] \\<open>conc_stmt_wf (shiftr amount)\\<close> \\<open>nonneg_delay_conc (shiftr amount)\\<close>\n    by auto\n  ultimately have \"inv tw'\"\n    using \\<open>tw, i + 1, shiftr amount \\<Rightarrow>\\<^sub>S tw'\\<close> unfolding sim_hoare_valid_def by blast\n  with \\<open>i + 1 = fst tw'\\<close> show ?thesis\n    unfolding inv_def  by (metis less_add_one)\nqed\n\nlemma correctness_wityping:\n  assumes \"sim_fin w (i + 1) (shiftr amount) tw'\" and \"wityping \\<Gamma> w\"\n  shows   \"wityping \\<Gamma> (snd tw')\"\nproof -\n  obtain tw where \"init_sim (0, w) (shiftr amount) tw\" and  \"tw, i + 1, (shiftr amount) \\<Rightarrow>\\<^sub>S tw'\"\n    using premises_sim_fin_obt[OF assms(1)] by auto\n  hence \"i + 1 = fst tw'\"\n    using world_maxtime_lt_fst_tres  by blast\n  have \"conc_stmt_wf (shiftr amount)\"\n    unfolding conc_stmt_wf_def shiftr_def by auto\n  moreover have \"nonneg_delay_conc (shiftr amount)\"\n    unfolding shiftr_def by auto\n  ultimately have \"init_sim_valid (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) (shiftr amount) (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n    using init_sim_hoare_soundness[OF init_sat_inv_comb]\n    by (metis (no_types, lifting) conc_wt_cases(1) init_sat_inv_comb\n    init_sim_hoare_soundness sub_def strengthen_precondition_init_sim_hoare)\n  hence \"inv tw \\<and> wityping \\<Gamma> (snd tw) \\<and> inv2 tw\"\n    using \\<open>init_sim (0, w) (shiftr amount) tw\\<close> fst_conv assms(2) unfolding init_sim_valid_def\n    by (metis snd_conv)\n  hence \"inv tw\" and \"inv2 tw\" and \"wityping \\<Gamma> (snd tw)\"\n    by auto\n  moreover have \"\\<Turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw\\<rbrace> (shiftr amount) \\<lbrace>\\<lambda>tw. wityping \\<Gamma> (snd tw)\\<rbrace>\"\n    using conc_sim_soundness[OF conc_sim'] \\<open>conc_stmt_wf (shiftr amount)\\<close> \\<open>nonneg_delay_conc (shiftr amount)\\<close>\n    by (smt sim_hoare_valid_def)\n  ultimately show \"wityping \\<Gamma> (snd tw')\"\n    using \\<open>tw, i + 1, (shiftr amount) \\<Rightarrow>\\<^sub>S tw'\\<close> unfolding sim_hoare_valid_def by blast\nqed\n\ncorollary correctness2:\n  assumes \"sim_fin w (i + 1) (shiftr amount) tw'\" and \"wityping \\<Gamma> w\"\n  defines \"bsIN  \\<equiv> lof_wline tw' IN i\"\n  defines \"bsOUT \\<equiv> lof_wline tw' OUT (i + 1)\"\n  shows   \"sbl_to_bin bsOUT = sbl_to_bin bsIN div 2 ^ amount\" and \"length bsIN = len\" and \"length bsOUT = len\"\nproof -\n  have \"wityping \\<Gamma> (snd tw')\"\n    using correctness_wityping[OF assms(1-2)] by auto\n  thus \"length bsIN = len\"\n    by (smt assms(3) o_apply ty.distinct(1) ty.inject type_of.elims signed_shift_right_axioms\n        signed_shift_right_def val.sel(3) wityping_def wtyping_def)\n  have \"property (i + 1) i tw'\" and \"wityping \\<Gamma> (snd tw')\"\n    using correctness[OF assms(1-2)] correctness_wityping[OF assms(1-2)] by auto\n  hence \"lof_wline tw' OUT (i + 1) = take len (replicate amount (hd (lof_wline tw' IN i)) @ lof_wline tw' IN i)\"\n    unfolding property_def Let_def by auto\n  hence \"bsOUT = take len (replicate amount (hd (bsIN)) @ bsIN)\" (is \"_ = ?rhs\")\n    unfolding bsIN_def bsOUT_def by auto\n  hence \"sbl_to_bin bsOUT = sbl_to_bin ?rhs\"\n    by auto\n  also have \"... = (bin_rest ^^ amount) (sbl_to_bin (replicate amount (hd bsIN) @ bsIN))\"\n    using take_rest_sbl2bin[where n=\"amount\" and bl=\"replicate amount (hd bsIN) @ bsIN\"] \\<open>length bsIN = len\\<close>\n    signed_shift_right_axioms signed_shift_right_def by simp\n  also have \"... = (bin_rest ^^ amount) (sbl_to_bin bsIN)\"\n    using sbl_to_bin_replicate_app \\<open>length bsIN = len\\<close> signed_shift_right_axioms\n    signed_shift_right_def by auto\n  also have \"... = sbl_to_bin bsIN div 2 ^ amount\"\n    unfolding bin_rest_compow by auto\n  finally show \"sbl_to_bin bsOUT = sbl_to_bin bsIN div 2 ^ amount\"\n    by auto\n  show \"length bsOUT = len\"\n    using \\<open>bsOUT = take len (replicate amount (hd (bsIN)) @ bsIN)\\<close>\n    by (simp add: \\<open>length bsIN = len\\<close>)\nqed\n\ncorollary correctness3:\n  assumes \"sim_fin w (i + 1) (shiftr amount) tw'\" and \"wityping \\<Gamma> w\"\n  defines \"bsIN  \\<equiv> lof_wline tw' IN i\"\n  defines \"bsOUT \\<equiv> lof_wline tw' OUT (i + 1)\"\n  shows   \"- (int \\<circ> of_bool) (hd bsOUT) * 2 ^ (len - 1) + (\\<Sum>i = 0..<len - 1. (int \\<circ> of_bool) (rev (tl bsOUT) ! i) * 2 ^ i) =\n          (- (int \\<circ> of_bool) (hd bsIN ) * 2 ^ (len - 1) + (\\<Sum>i = 0..<len - 1. (int \\<circ> of_bool) (rev (tl bsIN ) ! i) * 2 ^ i)) div 2 ^ amount\"\nproof -\n  have 0: \"sbl_to_bin bsOUT = sbl_to_bin bsIN div 2 ^ amount\" and \"length bsIN = len\" and \"length bsOUT = len\"\n    using correctness2 assms by auto\n  have 1: \"bsIN = hd bsIN # tl bsIN\"\n    using \\<open>length bsIN = len\\<close> list.exhaust_sel signed_shift_right_axioms signed_shift_right_def by auto\n  have 2: \"bsOUT = hd bsOUT # tl bsOUT\"\n    using \\<open>length bsOUT = len\\<close> signed_shift_right_axioms signed_shift_right_def by auto\n  hence 3: \"sbl_to_bin bsOUT = - (int \\<circ> of_bool) (hd bsOUT) * 2 ^ (len - 1) + (\\<Sum>i = 0..<len - 1. (int \\<circ> of_bool) (rev (tl bsOUT) ! i) * 2 ^ i)\"\n    using sbl_to_bin_correctness\n    by (metis (no_types, lifting) \\<open>length bsOUT = len\\<close> length_tl sum.cong)\n  have 4: \"sbl_to_bin bsIN = - (int \\<circ> of_bool) (hd bsIN ) * 2 ^ (len - 1) + (\\<Sum>i = 0..<len-1. (int \\<circ> of_bool) (rev (tl bsIN ) ! i) * 2 ^ i)\"\n    using sbl_to_bin_correctness\n    by (metis (full_types) \"1\" \\<open>length bsIN = len\\<close> length_tl)\n  show ?thesis\n    using 0 unfolding 3 4 by auto\nqed\n\nend\n\nend\n\n", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Shift_Right_Hoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.6039318337259584, "lm_q1q2_score": 0.3161102111425952}}
{"text": "(*<*)\ntheory BD_Security_Unwinding\n  imports BD_Security_IO\nbegin\n(*>*)\n\nsection \\<open>Unwinding proof method\\<close>\n\ntext \\<open>This section formalizes the unwinding proof method for BD Security discussed in\n\\<^cite>\\<open>\\<open>Section 5.1\\<close> in \"cocon-CAV2014\"\\<close>\\<close>\n\ncontext BD_Security_IO\nbegin\n\ndefinition consume :: \"('state,'act,'out) trans \\<Rightarrow> 'value list \\<Rightarrow> 'value list \\<Rightarrow> bool\" where\n\"consume trn vl vl' \\<equiv>\n if \\<phi> trn then vl \\<noteq> [] \\<and> f trn = hd vl \\<and> vl' = tl vl\n else vl' = vl\"\n\ndefinition consumeList :: \"('state,'act,'out) trans trace \\<Rightarrow> 'value list \\<Rightarrow> 'value list \\<Rightarrow> bool\" where\n\"consumeList tr vl vl' \\<equiv> vl = (V tr) @ vl'\"\n\nlemma length_consume[simp]:\n\"consume trn vl vl' \\<Longrightarrow> length vl' < Suc (length vl)\"\nunfolding consume_def by (auto split: if_splits)\n\nlemma ex_consume_\\<phi>:\nassumes \"\\<not> \\<phi> trn\"\nobtains vl' where \"consume trn vl vl'\"\nusing assms unfolding consume_def by auto\n\nlemma ex_consume_NO:\nassumes \"vl \\<noteq> []\" and \"f trn = hd vl\"\nobtains vl' where \"consume trn vl vl'\"\nusing assms unfolding consume_def by (cases \"\\<phi> trn\") auto\n\n(* independent action: *)\ndefinition iaction where\n\"iaction \\<Delta> s vl s1 vl1 \\<equiv>\n \\<exists> al1 vl1'.\n   let tr1 = traceOf s1 al1; s1' = tgtOf (last tr1) in\n   list_ex \\<phi> tr1 \\<and> consumeList tr1 vl1 vl1' \\<and>\n   never \\<gamma> tr1\n   \\<and>\n   \\<Delta> s vl s1' vl1'\"\n\n(* Multi-step intro, reflecting the improved def: *)\nlemma iactionI_ms[intro?]:\nassumes s: \"sstep s1 al1 = (oul1, s1')\"\nand l: \"list_ex \\<phi> (traceOf s1 al1)\"\nand \"consumeList (traceOf s1 al1) vl1 vl1'\"\nand \"never \\<gamma> (traceOf s1 al1)\" and \"\\<Delta> s vl s1' vl1'\"\nshows \"iaction \\<Delta> s vl s1 vl1\"\nproof-\n  have \"al1 \\<noteq> []\" using l by auto\n  from sstep_tgtOf_traceOf[OF this s] assms\n  show ?thesis unfolding iaction_def by auto\nqed\n\nlemma sstep_eq_singleiff[simp]: \"sstep s1 [a1] = ([ou1], s1') \\<longleftrightarrow> step s1 a1 = (ou1, s1')\"\nusing sstep_Cons by auto\n\n(* The less expressive, single-step intro: *)\nlemma iactionI[intro?]:\nassumes \"step s1 a1 = (ou1, s1')\" and \"\\<phi> (Trans s1 a1 ou1 s1')\"\nand \"consume (Trans s1 a1 ou1 s1') vl1 vl1'\"\nand \"\\<not> \\<gamma> (Trans s1 a1 ou1 s1')\" and \"\\<Delta> s vl s1' vl1'\"\nshows \"iaction \\<Delta> s vl s1 vl1\"\nusing assms\nby (intro iactionI_ms[of _ \"[a1]\" \"[ou1]\"]) (auto simp: consume_def consumeList_def)\n\ndefinition match where\n\"match \\<Delta> s s1 vl1 a ou s' vl' \\<equiv>\n \\<exists> al1 vl1'.\n    let trn = Trans s a ou s'; tr1 = traceOf s1 al1; s1' = tgtOf (last tr1) in\n    al1 \\<noteq> [] \\<and> consumeList tr1 vl1 vl1' \\<and>\n    O tr1 = O [trn] \\<and>\n    \\<Delta> s' vl' s1' vl1'\"\n\nlemma matchI_ms[intro?]:\nassumes s: \"sstep s1 al1 = (oul1, s1')\"\nand l: \"al1 \\<noteq> []\"\nand \"consumeList (traceOf s1 al1) vl1 vl1'\"\nand \"O (traceOf s1 al1) = O [Trans s a ou s']\"\nand \"\\<Delta> s' vl' s1' vl1'\"\nshows \"match \\<Delta> s s1 vl1 a ou s' vl'\"\nproof-\n  from sstep_tgtOf_traceOf[OF l s] assms\n  show ?thesis unfolding match_def by (intro exI[of _ al1]) auto\nqed\n\nlemma matchI[intro?]:\nassumes \"validTrans (Trans s1 a1 ou1 s1')\"\nand \"consume (Trans s1 a1 ou1 s1') vl1 vl1'\" and \"\\<gamma> (Trans s a ou s') = \\<gamma> (Trans s1 a1 ou1 s1')\"\nand \"\\<gamma> (Trans s a ou s') \\<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a1 ou1 s1')\"\nand \"\\<Delta> s' vl' s1' vl1'\"\nshows \"match \\<Delta> s s1 vl1 a ou s' vl'\"\nusing assms by (intro matchI_ms[of s1 \"[a1]\" \"[ou1]\" s1'])\n               (auto simp: consume_def consumeList_def split: if_splits)\n\ndefinition ignore where\n\"ignore \\<Delta> s s1 vl1 a ou s' vl' \\<equiv>\n \\<not> \\<gamma> (Trans s a ou s') \\<and>\n \\<Delta> s' vl' s1 vl1\"\n\nlemma ignoreI[intro?]:\nassumes \"\\<not> \\<gamma> (Trans s a ou s')\" and \"\\<Delta> s' vl' s1 vl1\"\nshows \"ignore \\<Delta> s s1 vl1 a ou s' vl'\"\nunfolding ignore_def using assms by auto\n\n(* reaction: *)\ndefinition reaction where\n\"reaction \\<Delta> s vl s1 vl1 \\<equiv>\n \\<forall> a ou s' vl'.\n   let trn = Trans s a ou s' in\n   validTrans trn \\<and> \\<not> T trn \\<and>\n   consume trn vl vl'\n   \\<longrightarrow>\n   match \\<Delta> s s1 vl1 a ou s' vl'\n   \\<or>\n   ignore \\<Delta> s s1 vl1 a ou s' vl'\"\n\nlemma reactionI[intro?]:\nassumes\n\"\\<And>a ou s' vl'.\n   \\<lbrakk>step s a = (ou, s'); \\<not> T (Trans s a ou s');\n    consume (Trans s a ou s') vl vl'\\<rbrakk>\n   \\<Longrightarrow>\n   match \\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore \\<Delta> s s1 vl1 a ou s' vl'\"\nshows \"reaction \\<Delta> s vl s1 vl1\"\nusing assms unfolding reaction_def by auto\n\ndefinition \"exit\" :: \"'state \\<Rightarrow> 'value \\<Rightarrow> bool\" where\n\"exit s v \\<equiv> \\<forall> tr trn. validFrom s (tr ## trn) \\<and> never T (tr ## trn) \\<and> \\<phi> trn \\<longrightarrow> f trn \\<noteq> v\"\n\nlemma exit_coind:\nassumes K: \"K s\"\nand I: \"\\<And> trn. \\<lbrakk>K (srcOf trn); validTrans trn; \\<not> T trn\\<rbrakk>\n        \\<Longrightarrow> (\\<phi> trn \\<longrightarrow> f trn \\<noteq> v) \\<and> K (tgtOf trn)\"\nshows \"exit s v\"\nusing K unfolding exit_def proof(intro allI conjI impI)\n  fix tr trn assume \"K s\" and \"validFrom s (tr ## trn) \\<and> never T (tr ## trn) \\<and> \\<phi> trn\"\n  thus \"f trn \\<noteq> v\"\n  using I unfolding validFrom_def by (induction tr arbitrary: s trn)\n  (auto, metis neq_Nil_conv rotate1.simps(2) rotate1_is_Nil_conv valid_ConsE)\nqed\n\ndefinition noVal where\n\"noVal K v \\<equiv>\n \\<forall> s a ou s'. reachNT s \\<and> K s \\<and> step s a = (ou,s') \\<and> \\<phi> (Trans s a ou s') \\<longrightarrow> f (Trans s a ou s') \\<noteq> v\"\n\nlemma noVal_disj:\nassumes \"noVal Inv1 v\" and \"noVal Inv2 v\"\nshows \"noVal (\\<lambda> s. Inv1 s \\<or> Inv2 s) v\"\nusing assms unfolding noVal_def by metis\n\nlemma noVal_conj:\nassumes \"noVal Inv1 v\" and \"noVal Inv2 v\"\nshows \"noVal (\\<lambda> s. Inv1 s \\<and> Inv2 s) v\"\nusing assms unfolding noVal_def by blast\n\n(* Often encountered sufficient criterion for noVal: *)\ndefinition no\\<phi> where\n\"no\\<phi> K \\<equiv> \\<forall> s a ou s'. reachNT s \\<and> K s \\<and> step s a = (ou,s') \\<longrightarrow> \\<not> \\<phi> (Trans s a ou s')\"\n\nlemma no\\<phi>_noVal: \"no\\<phi> K \\<Longrightarrow> noVal K v\"\nunfolding no\\<phi>_def noVal_def by auto\n\n(* intro rule for quick inline checks: *)\nlemma exitI[consumes 2, induct pred: \"exit\"]:\nassumes rs: \"reachNT s\" and K: \"K s\"\nand I:\n\"\\<And> s a ou s'.\n   \\<lbrakk>reach s; reachNT s; step s a = (ou,s'); K s\\<rbrakk>\n   \\<Longrightarrow> (\\<phi> (Trans s a ou s') \\<longrightarrow> f (Trans s a ou s') \\<noteq> v) \\<and> K s'\"\nshows \"exit s v\"\nproof-\n  let ?K = \"\\<lambda> s. reachNT s \\<and> K s\"\n  show ?thesis using assms by (intro exit_coind[of ?K])\n  (metis reachNT_reach IO_Automaton.validTrans reachNT.Step trans.exhaust_sel)+\nqed\n\n(* intro rule for more elaborate checks: *)\nlemma exitI2:\nassumes rs: \"reachNT s\" and K: \"K s\"\nand \"invarNT K\" and \"noVal K v\"\nshows \"exit s v\"\nproof-\n  let ?K = \"\\<lambda> s. reachNT s \\<and> K s\"\n  show ?thesis using assms unfolding invarNT_def noVal_def apply(intro exit_coind[of ?K])\n  by metis (metis IO_Automaton.validTrans reachNT.Step trans.exhaust_sel)\nqed\n\n(* Binary version of the invariant: *)\ndefinition noVal2 where\n\"noVal2 K v \\<equiv>\n \\<forall> s a ou s'. reachNT s \\<and> K s v \\<and> step s a = (ou,s') \\<and> \\<phi> (Trans s a ou s') \\<longrightarrow> f (Trans s a ou s') \\<noteq> v\"\n\nlemma noVal2_disj:\nassumes \"noVal2 Inv1 v\" and \"noVal2 Inv2 v\"\nshows \"noVal2 (\\<lambda> s v. Inv1 s v \\<or> Inv2 s v) v\"\nusing assms unfolding noVal2_def by metis\n\nlemma noVal2_conj:\nassumes \"noVal2 Inv1 v\" and \"noVal2 Inv2 v\"\nshows \"noVal2 (\\<lambda> s v. Inv1 s v \\<and> Inv2 s v) v\"\nusing assms unfolding noVal2_def by blast\n\n\n\nlemma exitI_noVal2[consumes 2, induct pred: \"exit\"]:\nassumes rs: \"reachNT s\" and K: \"K s v\"\nand I:\n\"\\<And> s a ou s'.\n   \\<lbrakk>reach s; reachNT s; step s a = (ou,s'); K s v\\<rbrakk>\n   \\<Longrightarrow> (\\<phi> (Trans s a ou s') \\<longrightarrow> f (Trans s a ou s') \\<noteq> v) \\<and> K s' v\"\nshows \"exit s v\"\nproof-\n  let ?K = \"\\<lambda> s. reachNT s \\<and> K s v\"\n  show ?thesis using assms by (intro exit_coind[of ?K])\n  (metis reachNT_reach IO_Automaton.validTrans reachNT.Step trans.exhaust_sel)+\nqed\n\nlemma exitI2_noVal2:\nassumes rs: \"reachNT s\" and K: \"K s v\"\nand \"invarNT (\\<lambda> s. K s v)\" and \"noVal2 K v\"\nshows \"exit s v\"\nproof-\n  let ?K = \"\\<lambda> s. reachNT s \\<and> K s v\"\n  show ?thesis using assms unfolding invarNT_def noVal2_def\n  by (intro exit_coind[of ?K]) (metis IO_Automaton.validTrans reachNT.Step trans.exhaust_sel)+\nqed\n\n(* end binary version *)\n\nlemma exit_validFrom:\nassumes vl: \"vl \\<noteq> []\" and i: \"exit s (hd vl)\" and v: \"validFrom s tr\" and V: \"V tr = vl\"\nand T: \"never T tr\"\nshows False\nusing i v V T proof(induction tr arbitrary: s)\n  case Nil thus ?case by (metis V_simps(1) vl)\nnext\n  case (Cons trn tr s)\n  show ?case\n  proof(cases \"\\<phi> trn\")\n    case True\n    hence \"f trn = hd vl\" using Cons by (metis V_simps(3) hd_Cons_tl list.inject vl)\n    moreover have \"validFrom s [trn]\" using \\<open>validFrom s (trn # tr)\\<close>\n    unfolding validFrom_def by auto\n    ultimately show ?thesis using Cons True unfolding exit_def\n    by (elim allE[of _ \"[]\"]) auto\n  next\n    case False\n    hence \"V tr = vl\" using Cons by auto\n    moreover have \"never T tr\" by (metis Cons.prems list_all_simps)\n    moreover from \\<open>validFrom s (trn # tr)\\<close> have \"validFrom (tgtOf trn) tr\" and s: \"s = srcOf trn\"\n    by (metis list.distinct(1) validFrom_def valid_ConsE Cons.prems(2)\n              validFrom_def list.discI list.sel(1))+\n    moreover have \"exit (tgtOf trn) (hd vl)\" using \\<open>exit s (hd vl)\\<close>\n    unfolding exit_def s by simp\n    (metis (no_types) Cons.prems(2) Cons.prems(4) append_Cons list.sel(1)\n           list.distinct list_all_simps valid.Cons validFrom_def valid_ConsE)\n    ultimately show ?thesis using Cons(1) by auto\n  qed\nqed\n\ndefinition unwind where\n\"unwind \\<Delta> \\<equiv>\n \\<forall> s vl s1 vl1.\n   reachNT s \\<and> reach s1 \\<and> \\<Delta> s vl s1 vl1\n   \\<longrightarrow>\n   (vl \\<noteq> [] \\<and> exit s (hd vl))\n   \\<or>\n   iaction \\<Delta> s vl s1 vl1\n   \\<or>\n   ((vl \\<noteq> [] \\<or> vl1 = []) \\<and> reaction \\<Delta> s vl s1 vl1)\"\n\nlemma unwindI[intro?]:\nassumes\n\"\\<And> s vl s1 vl1.\n   \\<lbrakk>reachNT s; reach s1; \\<Delta> s vl s1 vl1\\<rbrakk>\n   \\<Longrightarrow>\n   (vl \\<noteq> [] \\<and> exit s (hd vl))\n   \\<or>\n   iaction \\<Delta> s vl s1 vl1\n   \\<or>\n   ((vl \\<noteq> [] \\<or> vl1 = []) \\<and> reaction \\<Delta> s vl s1 vl1)\"\nshows \"unwind \\<Delta>\"\nusing assms unfolding unwind_def by auto\n\nlemma unwind_trace:\nassumes unwind: \"unwind \\<Delta>\" and \"reachNT s\" and \"reach s1\" and \"\\<Delta> s vl s1 vl1\"\nand \"validFrom s tr\" and \"never T tr\" and \"V tr = vl\"\nshows \"\\<exists>tr1. validFrom s1 tr1 \\<and> O tr1 = O tr \\<and> V tr1 = vl1\"\nproof-\n  let ?S = \"\\<lambda> tr vl1.\n  \\<forall> s vl s1. reachNT s \\<and> reach s1 \\<and> \\<Delta> s vl s1 vl1 \\<and> validFrom s tr \\<and> never T tr \\<and> V tr = vl \\<longrightarrow>\n          (\\<exists>tr1. validFrom s1 tr1 \\<and> O tr1 = O tr \\<and> V tr1 = vl1)\"\n  let ?f = \"\\<lambda> tr vl1. length tr + length vl1\"\n  have \"?S tr vl1\"\n  proof(induct rule: measure_induct2[of ?f ?S])\n    case (IH tr vl1)\n    show ?case\n    proof(intro allI impI, elim conjE)\n      fix s vl s1 assume rs: \"reachNT s\" and rs1: \"reach s1\" and \\<Delta>: \"\\<Delta> s vl s1 vl1\"\n      and v: \"validFrom s tr\" and NT: \"never T tr\" and V: \"V tr = vl\"\n      hence \"(vl \\<noteq> [] \\<and> exit s (hd vl)) \\<or>\n             iaction \\<Delta> s vl s1 vl1 \\<or>\n             (reaction \\<Delta> s vl s1 vl1 \\<and> \\<not> iaction \\<Delta> s vl s1 vl1)\"\n      (is \"?exit \\<or> ?iact \\<or> ?react \\<and> _\")\n      using unwind unfolding unwind_def by metis\n      thus \"\\<exists>tr1. validFrom s1 tr1 \\<and> O tr1 = O tr \\<and> V tr1 = vl1\"\n      proof safe\n        assume \"vl \\<noteq> []\" and \"exit s (hd vl)\"\n        hence False using v V exit_validFrom NT by auto\n        thus ?thesis by auto\n      next\n        assume ?iact\n        thus ?thesis  unfolding iaction_def Let_def proof safe\n          fix al1 :: \"'act list\" and vl1'\n          let ?tr1 = \"traceOf s1 al1\"  let ?s1' = \"tgtOf (last ?tr1)\"\n          assume \\<phi>1: \"list_ex \\<phi> (traceOf s1 al1)\" and c: \"consumeList ?tr1 vl1 vl1'\"\n             and \\<gamma>: \"never \\<gamma> ?tr1\" and \\<Delta>: \"\\<Delta> s vl ?s1' vl1'\"\n          from \\<phi>1 have tr1: \"?tr1 \\<noteq> []\" and len_V1: \"length (V ?tr1) > 0\"\n            by (auto iff: list_ex_iff_length_V)\n          with c have \"length vl1' < length vl1\" unfolding consumeList_def by auto\n          moreover have \"reach ?s1'\" using rs1 tr1 by (intro validFrom_reach) auto\n          ultimately obtain tr1' where \"validFrom ?s1' tr1'\" and \"O tr1' = O tr\" and \"V tr1' = vl1'\"\n            using IH[of tr vl1'] rs \\<Delta> v NT V by auto\n          then show ?thesis using tr1 \\<gamma> c unfolding consumeList_def\n            by (intro exI[of _ \"?tr1 @ tr1'\"])\n               (auto simp: O_append O_Nil_never V_append validFrom_append)\n        qed\n      next\n        assume react: ?react and iact: \"\\<not> ?iact\"\n        show ?thesis\n        proof(cases tr)\n          case Nil note tr = Nil\n          hence vl: \"vl = []\" using V by simp\n          show ?thesis proof(cases vl1)\n            case Nil note vl1 = Nil\n            show ?thesis using IH[of tr vl1] \\<Delta> V NT V unfolding tr vl1 by auto\n          next\n            case Cons\n            hence False using vl unwind rs rs1 \\<Delta> iact unfolding unwind_def by auto\n            thus ?thesis by auto\n          qed\n        next\n          case (Cons trn tr') note tr = Cons\n          show ?thesis\n          proof(cases trn)\n            case (Trans ss a ou s') note trn = Trans let ?trn = \"Trans s a ou s'\"\n            have ss: \"ss = s\" using trn v unfolding tr validFrom_def by auto\n            have Ta: \"\\<not> T ?trn\" and s: \"s = srcOf trn\" and vtrans: \"validTrans ?trn\"\n            and v': \"validFrom s' tr'\" and NT': \"never T tr'\"\n            using v NT V unfolding tr validFrom_def trn by auto\n            have rs': \"reachNT s'\" using rs vtrans Ta by (auto intro: reachNT_PairI)\n            {assume \"\\<phi> ?trn\" hence \"vl \\<noteq> [] \\<and> f ?trn = hd vl\" using V unfolding tr trn ss by auto\n            }\n            then obtain vl' where c: \"consume ?trn vl vl'\"\n            using ex_consume_\\<phi> ex_consume_NO by metis\n            have V': \"V tr' = vl'\" using V c unfolding tr trn ss consume_def\n            by (cases \"\\<phi> ?trn\") (simp_all, metis list.sel(2-3))\n            have \"match \\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore \\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n            using react unfolding reaction_def using vtrans Ta c by auto\n            thus ?thesis proof safe\n              assume ?match\n              thus ?thesis unfolding match_def Let_def proof (elim exE conjE)\n                fix al1 :: \"'act list\" and vl1'\n                let ?tr = \"traceOf s1 al1\"\n                let ?s1' = \"tgtOf (last ?tr)\"\n                assume al1: \"al1 \\<noteq> []\"\n                   and c: \"consumeList ?tr vl1 vl1'\"\n                   and O: \"O ?tr = O [Trans s a ou s']\"\n                   and \\<Delta>: \"\\<Delta> s' vl' ?s1' vl1'\"\n                from c have len: \"length tr' + length vl1' < length tr + length vl1\"\n                  using tr unfolding consumeList_def by auto\n                have \"reach ?s1'\" using rs1 al1 by (intro validFrom_reach) auto\n                then obtain tr1' where \"validFrom ?s1' tr1'\" and \"O tr1' = O tr'\" and \"V tr1' = vl1'\"\n                  using IH[OF len] rs' \\<Delta> v' NT' V' tr by auto\n                then show ?thesis using c O al1 unfolding consumeList_def tr trn ss\n                  by (intro exI[of _ \"?tr @ tr1'\"])\n                     (cases \"\\<gamma> ?trn\"; auto simp: O_append O_Nil_never V_append validFrom_append)\n              qed\n            next\n              assume ?ignore\n              thus ?thesis unfolding ignore_def Let_def proof (elim exE conjE)\n                assume \\<gamma>: \"\\<not> \\<gamma> ?trn\" and \\<Delta>: \"\\<Delta> s' vl' s1 vl1\"\n                obtain tr1 where v1: \"validFrom s1 tr1\" and O: \"O tr1 = O tr'\" and V: \"V tr1 = vl1\"\n                using IH[of tr' vl1] rs' rs1 \\<Delta> v' NT' V' c unfolding tr by auto\n                show ?thesis\n                apply(intro exI[of _ tr1])\n                using v1 O V \\<gamma> unfolding tr trn ss by auto\n              qed\n            qed\n          qed\n        qed\n      qed\n    qed\n  qed\n  thus ?thesis using assms by auto\nqed\n\ntheorem unwind_secure:\nassumes init: \"\\<And> vl vl1. B vl vl1 \\<Longrightarrow> \\<Delta> istate vl istate vl1\"\nand unwind: \"unwind \\<Delta>\"\nshows secure\nusing assms unwind_trace unfolding secure_def by (blast intro: reach.Istate reachNT.Istate)\n\nend (* locale BD_Security_IO *)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Bounded_Deducibility_Security/BD_Security_Unwinding.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.31611021114259513}}
{"text": "theory ETCS_Wellordering\n  imports ETCS_Axioms ETCS_Comparison\nbegin\n\n\nlemma NOT_eq_pred_left_coproj:\n  assumes u_type[type_rule]: \"u \\<in>\\<^sub>c X \\<Coprod> Y\" and x_type[type_rule]: \"x \\<in>\\<^sub>c X\"\n  shows \"NOT \\<circ>\\<^sub>c eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>u, left_coproj X Y \\<circ>\\<^sub>c x\\<rangle> = ((NOT \\<circ>\\<^sub>c  eq_pred X \\<circ>\\<^sub>c \\<langle>id X, x \\<circ>\\<^sub>c \\<beta>\\<^bsub>X\\<^esub>\\<rangle>) \\<amalg> (\\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>Y\\<^esub>))  \\<circ>\\<^sub>c u\"\nproof- \n  have \"NOT \\<circ>\\<^sub>c eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>u, left_coproj X Y \\<circ>\\<^sub>c x\\<rangle> = NOT \\<circ>\\<^sub>c (((eq_pred X \\<circ>\\<^sub>c \\<langle>id X, x \\<circ>\\<^sub>c \\<beta>\\<^bsub>X\\<^esub>\\<rangle>) \\<amalg> (\\<f> \\<circ>\\<^sub>c \\<beta>\\<^bsub>Y\\<^esub>)) \\<circ>\\<^sub>c u)\"\n    by (simp add: eq_pred_left_coproj u_type x_type)\n  also have \"... = ( (NOT \\<circ>\\<^sub>c(eq_pred X \\<circ>\\<^sub>c \\<langle>id X, x \\<circ>\\<^sub>c \\<beta>\\<^bsub>X\\<^esub>\\<rangle>)) \\<amalg>  (NOT \\<circ>\\<^sub>c(\\<f> \\<circ>\\<^sub>c \\<beta>\\<^bsub>Y\\<^esub>))) \\<circ>\\<^sub>c u\"\n    by (typecheck_cfuncs, smt (z3) cfunc_coprod_comp comp_associative2)\n  also have \"... = ((NOT \\<circ>\\<^sub>c  eq_pred X \\<circ>\\<^sub>c \\<langle>id X, x \\<circ>\\<^sub>c \\<beta>\\<^bsub>X\\<^esub>\\<rangle>) \\<amalg> (\\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>Y\\<^esub>)  ) \\<circ>\\<^sub>c u\"\n    using NOT_false_is_true comp_associative2 by (typecheck_cfuncs, auto)\n    then show ?thesis\n    using calculation by auto\nqed\n\n\n\n\n\nlemma NOT_eq_pred_right_coproj:\n  assumes u_type[type_rule]: \"u \\<in>\\<^sub>c X \\<Coprod> Y\" and y_type[type_rule]: \"y \\<in>\\<^sub>c Y\"\n  shows \"NOT \\<circ>\\<^sub>c eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>u, right_coproj X Y \\<circ>\\<^sub>c y\\<rangle> = ((\\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>X\\<^esub>) \\<amalg> (NOT \\<circ>\\<^sub>c  eq_pred Y \\<circ>\\<^sub>c \\<langle>id Y, y \\<circ>\\<^sub>c \\<beta>\\<^bsub>Y\\<^esub>\\<rangle>)) \\<circ>\\<^sub>c u\"\nproof- \n  have \"NOT \\<circ>\\<^sub>c eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>u, right_coproj X Y \\<circ>\\<^sub>c y\\<rangle> = NOT \\<circ>\\<^sub>c (((\\<f> \\<circ>\\<^sub>c \\<beta>\\<^bsub>X\\<^esub>) \\<amalg> (eq_pred Y \\<circ>\\<^sub>c \\<langle>id Y, y \\<circ>\\<^sub>c \\<beta>\\<^bsub>Y\\<^esub>\\<rangle>)) \\<circ>\\<^sub>c u)\"\n    by (simp add: eq_pred_right_coproj u_type y_type)\n  also have \"... = (( (NOT \\<circ>\\<^sub>c(\\<f> \\<circ>\\<^sub>c \\<beta>\\<^bsub>X\\<^esub>)) \\<amalg> (NOT \\<circ>\\<^sub>c(eq_pred Y \\<circ>\\<^sub>c \\<langle>id Y, y \\<circ>\\<^sub>c \\<beta>\\<^bsub>Y\\<^esub>\\<rangle>))) \\<circ>\\<^sub>c u)\"\n    by (typecheck_cfuncs, smt (z3) cfunc_coprod_comp comp_associative2)\n  also have \"... = ((\\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>X\\<^esub>) \\<amalg> (NOT \\<circ>\\<^sub>c  eq_pred Y \\<circ>\\<^sub>c \\<langle>id Y, y \\<circ>\\<^sub>c \\<beta>\\<^bsub>Y\\<^esub>\\<rangle>)) \\<circ>\\<^sub>c u\"\n    by (typecheck_cfuncs, simp add: NOT_false_is_true comp_associative2)\n  then show ?thesis\n    using calculation by auto\nqed\n\n\n\n\nlemma eq_pred_func_pair:\n  assumes f1_type[type_rule]: \"f1: A \\<rightarrow> X\" \n  assumes f2_type[type_rule]: \"f2: A \\<rightarrow> X\"  \n  assumes g1_type[type_rule]: \"g1: A \\<rightarrow> Y\" \n  assumes g2_type[type_rule]: \"g2: A \\<rightarrow> Y\" \n  shows \"eq_pred (X\\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle>, \\<langle>f2, g2\\<rangle>\\<rangle> = \n         AND \\<circ>\\<^sub>c \\<langle>eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>,  eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>\\<rangle>\"\nproof(rule ccontr)\n  assume \"eq_pred (X \\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle>,\\<langle>f2,g2\\<rangle>\\<rangle> \\<noteq> AND \\<circ>\\<^sub>c \\<langle>eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>,eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>\\<rangle>\"\n  then obtain a where a_type[type_rule]: \"a \\<in>\\<^sub>c A\" and a_def: \"(eq_pred (X \\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle>,\\<langle>f2,g2\\<rangle>\\<rangle>) \\<circ>\\<^sub>c a \\<noteq> (AND \\<circ>\\<^sub>c \\<langle>eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>,eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>\\<rangle>) \\<circ>\\<^sub>c a\"\n    by (typecheck_cfuncs, meson  one_separator)\n  then show False \n  proof (cases \"(eq_pred (X \\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle>,\\<langle>f2,g2\\<rangle>\\<rangle>) \\<circ>\\<^sub>c a = \\<t>\")\n    assume a1: \"(eq_pred (X \\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle>,\\<langle>f2,g2\\<rangle>\\<rangle>) \\<circ>\\<^sub>c a = \\<t>\"\n    then have \"eq_pred (X \\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle>,\\<langle>f2,g2\\<rangle>\\<rangle> \\<circ>\\<^sub>c a  = \\<t>\"\n      by (typecheck_cfuncs, simp add: a1 comp_associative2)\n    then have \"eq_pred (X \\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle> \\<circ>\\<^sub>c a ,\\<langle>f2,g2\\<rangle> \\<circ>\\<^sub>c a\\<rangle>   = \\<t>\"\n      using  cfunc_prod_comp by (typecheck_cfuncs, force)\n    then have \"\\<langle>f1,g1\\<rangle> \\<circ>\\<^sub>c a =  \\<langle>f2, g2\\<rangle> \\<circ>\\<^sub>c a\"\n      by (typecheck_cfuncs, meson comp_type eq_pred_iff_eq)\n    then have \"\\<langle>f1 \\<circ>\\<^sub>c a,g1 \\<circ>\\<^sub>c a\\<rangle>  =  \\<langle>f2 \\<circ>\\<^sub>c a , g2\\<circ>\\<^sub>c a \\<rangle>\"\n      using  cfunc_prod_comp by (typecheck_cfuncs, force)\n    then have contradiction: \"(f1 \\<circ>\\<^sub>c a = f2 \\<circ>\\<^sub>c a) \\<and> (g1 \\<circ>\\<^sub>c a = g2 \\<circ>\\<^sub>c a)\"\n      using cart_prod_eq2 by (typecheck_cfuncs, auto)\n    have \"(AND \\<circ>\\<^sub>c \\<langle>eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>,eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>\\<rangle>) \\<circ>\\<^sub>c a = \\<f>\"\n      using a_def a1  by (typecheck_cfuncs, metis  true_false_only_truth_values)\n    then have \"AND \\<circ>\\<^sub>c \\<langle>eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>,eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>\\<rangle> \\<circ>\\<^sub>c a = \\<f>\"\n      by (typecheck_cfuncs, simp add:  comp_associative2)\n    then have \"AND \\<circ>\\<^sub>c \\<langle>(eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<circ>\\<^sub>c a, (eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>) \\<circ>\\<^sub>c a\\<rangle>  = \\<f>\"\n      using  cfunc_prod_comp by (typecheck_cfuncs, force)\n    then have \"(((eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<circ>\\<^sub>c a) = \\<f>) \\<or> (((eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>) \\<circ>\\<^sub>c a) = \\<f>)\"\n      by (typecheck_cfuncs, metis AND_true_true_is_true  true_false_only_truth_values)\n    then have \"((eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle> \\<circ>\\<^sub>c a) = \\<f>) \\<or> ((eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle> \\<circ>\\<^sub>c a) = \\<f>)\"\n      by (typecheck_cfuncs, simp add:  comp_associative2)\n    then have \"((eq_pred X \\<circ>\\<^sub>c \\<langle>f1 \\<circ>\\<^sub>c a,f2 \\<circ>\\<^sub>c a\\<rangle>) = \\<f>) \\<or> ((eq_pred Y \\<circ>\\<^sub>c \\<langle>g1 \\<circ>\\<^sub>c a, g2 \\<circ>\\<^sub>c a\\<rangle>) = \\<f>)\"\n      using  cfunc_prod_comp by (typecheck_cfuncs, force)\n    then have \"(f1 \\<circ>\\<^sub>c a \\<noteq> f2 \\<circ>\\<^sub>c a) \\<or> (g1 \\<circ>\\<^sub>c a \\<noteq> g2 \\<circ>\\<^sub>c a)\"\n      using  eq_pred_iff_eq_conv by (typecheck_cfuncs, blast)\n    then show False\n      by (simp add: contradiction)\n  next\n    assume \"(eq_pred (X \\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle>,\\<langle>f2,g2\\<rangle>\\<rangle>) \\<circ>\\<^sub>c a \\<noteq> \\<t>\"\n    then have a1: \"(eq_pred (X \\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle>,\\<langle>f2,g2\\<rangle>\\<rangle>) \\<circ>\\<^sub>c a = \\<f>\"\n      using true_false_only_truth_values by (typecheck_cfuncs, blast)\n    then have \"eq_pred (X \\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle>,\\<langle>f2,g2\\<rangle>\\<rangle> \\<circ>\\<^sub>c a = \\<f>\"\n      by (typecheck_cfuncs, simp add: a1 comp_associative2)\n    then have \"eq_pred (X \\<times>\\<^sub>c Y) \\<circ>\\<^sub>c \\<langle>\\<langle>f1,g1\\<rangle> \\<circ>\\<^sub>c a ,\\<langle>f2,g2\\<rangle> \\<circ>\\<^sub>c a\\<rangle>   = \\<f>\"\n      using  cfunc_prod_comp by (typecheck_cfuncs, force)\n    then have \"\\<langle>f1,g1\\<rangle> \\<circ>\\<^sub>c a \\<noteq>  \\<langle>f2, g2\\<rangle> \\<circ>\\<^sub>c a\"\n      using  eq_pred_iff_eq_conv by (typecheck_cfuncs, presburger)\n    then have \"\\<langle>f1 \\<circ>\\<^sub>c a,g1 \\<circ>\\<^sub>c a\\<rangle>  \\<noteq>  \\<langle>f2 \\<circ>\\<^sub>c a , g2\\<circ>\\<^sub>c a \\<rangle>\"\n      using  cfunc_prod_comp by (typecheck_cfuncs, force)\n    then have contradiction: \"(f1 \\<circ>\\<^sub>c a \\<noteq> f2 \\<circ>\\<^sub>c a) \\<or> (g1 \\<circ>\\<^sub>c a \\<noteq> g2 \\<circ>\\<^sub>c a)\"\n      using cart_prod_eq2 by (typecheck_cfuncs, auto)\n    have \"(AND \\<circ>\\<^sub>c \\<langle>eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>,eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>\\<rangle>) \\<circ>\\<^sub>c a = \\<t>\"\n      by (typecheck_cfuncs, metis  a1 a_def true_false_only_truth_values)\n    then have \"AND \\<circ>\\<^sub>c \\<langle>eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>,eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>\\<rangle> \\<circ>\\<^sub>c a = \\<t>\"\n      by (typecheck_cfuncs, simp add:  comp_associative2)\n    then have \"AND \\<circ>\\<^sub>c \\<langle>(eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<circ>\\<^sub>c a, (eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>) \\<circ>\\<^sub>c a\\<rangle>  = \\<t>\"\n      using  cfunc_prod_comp by (typecheck_cfuncs, force)\n    then have \"(((eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<circ>\\<^sub>c a) = \\<t>) \\<and> (((eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>) \\<circ>\\<^sub>c a) = \\<t>)\"\n      by (typecheck_cfuncs, metis AND_false_left_is_false AND_false_right_is_false  true_false_only_truth_values)\n    then have \"((eq_pred X \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle> \\<circ>\\<^sub>c a) = \\<t>) \\<and> ((eq_pred Y \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle> \\<circ>\\<^sub>c a) = \\<t>)\"\n      by (typecheck_cfuncs, simp add:  comp_associative2)\n    then have \"((eq_pred X \\<circ>\\<^sub>c \\<langle>f1 \\<circ>\\<^sub>c a,f2 \\<circ>\\<^sub>c a\\<rangle>) = \\<t>) \\<and> ((eq_pred Y \\<circ>\\<^sub>c \\<langle>g1 \\<circ>\\<^sub>c a, g2 \\<circ>\\<^sub>c a\\<rangle>) = \\<t>)\"\n      using  cfunc_prod_comp by (typecheck_cfuncs, force)\n    then have \"(f1 \\<circ>\\<^sub>c a = f2 \\<circ>\\<^sub>c a) \\<and> (g1 \\<circ>\\<^sub>c a = g2 \\<circ>\\<^sub>c a)\"\n      using  eq_pred_iff_eq by (typecheck_cfuncs, blast)  \n    then show False\n      using contradiction by blast\n  qed\nqed\n\n\nlemma eq_pred_func_copair:\n  assumes f1_type[type_rule]: \"f1: X \\<rightarrow> Z\" \n  assumes f2_type[type_rule]: \"f2: X \\<rightarrow> Z\"  \n  assumes g1_type[type_rule]: \"g1: Y \\<rightarrow> Z\" \n  assumes g2_type[type_rule]: \"g2: Y \\<rightarrow> Z\" \n  shows \"eq_pred Z \\<circ>\\<^sub>c \\<langle>(f1\\<amalg>g1), (f2\\<amalg>g2)\\<rangle> = \n        (eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>)\\<amalg>(eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)\"\nproof(rule ccontr)\n  assume \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle> \\<noteq> (eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)\"\n  then obtain xy where xy_type[type_rule]: \"xy \\<in>\\<^sub>c X \\<Coprod> Y\" and xy_def: \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle>) \\<circ>\\<^sub>c xy \\<noteq> ((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c xy\"\n    using  one_separator by (typecheck_cfuncs, blast)\n  show False\n  proof(cases \"\\<exists> x. x \\<in>\\<^sub>c X \\<and> xy = left_coproj X Y \\<circ>\\<^sub>c x\")\n    assume \"\\<exists>x. x \\<in>\\<^sub>c X \\<and> xy = left_coproj X Y \\<circ>\\<^sub>c x\"\n    then obtain x where x_type[type_rule]: \"x \\<in>\\<^sub>c X\" and x_def: \"xy = left_coproj X Y \\<circ>\\<^sub>c x\"\n      by blast\n    show False\n    proof(cases \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle>) \\<circ>\\<^sub>c xy = \\<t>\")\n      assume LHS_true: \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle>) \\<circ>\\<^sub>c xy = \\<t>\"\n      \n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle> \\<circ>\\<^sub>c xy = \\<t>\"\n        using  comp_associative2 by (typecheck_cfuncs, force)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>(f1 \\<amalg> g1),(f2 \\<amalg> g2)\\<rangle> \\<circ>\\<^sub>c (left_coproj X Y \\<circ>\\<^sub>c x))  = \\<t>\"\n        using LHS_true x_def by blast\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>(f1 \\<amalg> g1)\\<circ>\\<^sub>c (left_coproj X Y \\<circ>\\<^sub>c x) ,(f2 \\<amalg> g2) \\<circ>\\<^sub>c (left_coproj X Y \\<circ>\\<^sub>c x)\\<rangle> )  = \\<t>\"\n        using cfunc_prod_comp by (typecheck_cfuncs, auto)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>((f1 \\<amalg> g1)\\<circ>\\<^sub>c left_coproj X Y) \\<circ>\\<^sub>c x ,((f2 \\<amalg> g2) \\<circ>\\<^sub>c left_coproj X Y) \\<circ>\\<^sub>c x\\<rangle> )  = \\<t>\"\n        using  comp_associative2 by (typecheck_cfuncs, force)\n      then have contradiction: \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<circ>\\<^sub>c x ,f2 \\<circ>\\<^sub>c x\\<rangle>  = \\<t>\"\n        by (typecheck_cfuncs, metis  g1_type g2_type left_coproj_cfunc_coprod)\n      have \"((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c xy = \\<f>\"\n        by (typecheck_cfuncs, metis LHS_true true_false_only_truth_values xy_def)\n      then have f0: \"(((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c left_coproj X Y) \\<circ>\\<^sub>c x = \\<f>\"\n        using  comp_associative2 x_def by (typecheck_cfuncs, auto)\n      have \"((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c left_coproj X Y = eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>\"\n        using left_coproj_cfunc_coprod by (typecheck_cfuncs, presburger)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<circ>\\<^sub>c x = \\<f>\"\n        using f0 by presburger\n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle> \\<circ>\\<^sub>c x = \\<f>\"\n        by (typecheck_cfuncs, simp add:  comp_associative2)\n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<circ>\\<^sub>c x,f2  \\<circ>\\<^sub>c x\\<rangle> = \\<f>\"\n        using  cfunc_prod_comp by (typecheck_cfuncs, force)\n      then show False\n        using contradiction true_false_distinct by auto\n    next\n      assume \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle>) \\<circ>\\<^sub>c xy \\<noteq> \\<t>\"\n      then have LHS_false: \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle>) \\<circ>\\<^sub>c xy = \\<f>\"\n        using  true_false_only_truth_values by (typecheck_cfuncs, blast)\n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle> \\<circ>\\<^sub>c xy = \\<f>\"\n        using  comp_associative2 by (typecheck_cfuncs, force)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>(f1 \\<amalg> g1),(f2 \\<amalg> g2)\\<rangle> \\<circ>\\<^sub>c (left_coproj X Y \\<circ>\\<^sub>c x))  = \\<f>\"\n        using LHS_false x_def by blast\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>(f1 \\<amalg> g1)\\<circ>\\<^sub>c (left_coproj X Y \\<circ>\\<^sub>c x) ,(f2 \\<amalg> g2) \\<circ>\\<^sub>c (left_coproj X Y \\<circ>\\<^sub>c x)\\<rangle> )  = \\<f>\"\n        using cfunc_prod_comp by (typecheck_cfuncs, auto)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>((f1 \\<amalg> g1)\\<circ>\\<^sub>c left_coproj X Y) \\<circ>\\<^sub>c x ,((f2 \\<amalg> g2) \\<circ>\\<^sub>c left_coproj X Y) \\<circ>\\<^sub>c x\\<rangle> )  = \\<f>\"\n        using  comp_associative2 by (typecheck_cfuncs, force)\n      then have contradiction: \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<circ>\\<^sub>c x ,f2 \\<circ>\\<^sub>c x\\<rangle>   = \\<f>\"\n        by (typecheck_cfuncs, metis  g1_type g2_type left_coproj_cfunc_coprod)\n      have \"((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c xy = \\<t>\"\n        by (typecheck_cfuncs, metis LHS_false true_false_only_truth_values xy_def)\n      then have f0: \"(((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c left_coproj X Y) \\<circ>\\<^sub>c x = \\<t>\"\n        using  comp_associative2 x_def by (typecheck_cfuncs, auto)\n      have \"((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c left_coproj X Y = eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>\"\n        using left_coproj_cfunc_coprod by (typecheck_cfuncs, presburger)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<circ>\\<^sub>c x = \\<t>\"\n        using f0 by presburger\n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle> \\<circ>\\<^sub>c x = \\<t>\"\n        by (typecheck_cfuncs, simp add:  comp_associative2)\n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<circ>\\<^sub>c x,f2  \\<circ>\\<^sub>c x\\<rangle> = \\<t>\"\n        using  cfunc_prod_comp by (typecheck_cfuncs, force)\n      then show False\n        using contradiction true_false_distinct by auto\n    qed\n  next\n    assume \"\\<nexists>x. x \\<in>\\<^sub>c X \\<and> xy = left_coproj X Y \\<circ>\\<^sub>c x\"\n    then obtain y where y_type[type_rule]: \"y \\<in>\\<^sub>c Y\" and y_def: \" xy = right_coproj X Y \\<circ>\\<^sub>c y\"\n      using  coprojs_jointly_surj by (typecheck_cfuncs, blast)\n    show False\n    proof(cases \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle>) \\<circ>\\<^sub>c xy = \\<t>\")\n      assume LHS_true: \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle>) \\<circ>\\<^sub>c xy = \\<t>\"\n      \n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle> \\<circ>\\<^sub>c xy = \\<t>\"\n        using  comp_associative2 by (typecheck_cfuncs, force)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>(f1 \\<amalg> g1),(f2 \\<amalg> g2)\\<rangle> \\<circ>\\<^sub>c (right_coproj X Y \\<circ>\\<^sub>c y))  = \\<t>\"\n        using LHS_true y_def by blast\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>(f1 \\<amalg> g1)\\<circ>\\<^sub>c (right_coproj X Y \\<circ>\\<^sub>c y) ,(f2 \\<amalg> g2) \\<circ>\\<^sub>c (right_coproj X Y \\<circ>\\<^sub>c y)\\<rangle> )  = \\<t>\"\n        using cfunc_prod_comp by (typecheck_cfuncs, auto)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>((f1 \\<amalg> g1)\\<circ>\\<^sub>c right_coproj X Y) \\<circ>\\<^sub>c y ,((f2 \\<amalg> g2) \\<circ>\\<^sub>c right_coproj X Y) \\<circ>\\<^sub>c y\\<rangle> )  = \\<t>\"\n        using  comp_associative2 by (typecheck_cfuncs, force)\n      then have contradiction: \"eq_pred Z \\<circ>\\<^sub>c \\<langle>g1 \\<circ>\\<^sub>c y ,g2 \\<circ>\\<^sub>c y\\<rangle>  = \\<t>\"\n        by (typecheck_cfuncs, metis  f1_type f2_type right_coproj_cfunc_coprod)\n      have \"((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c xy = \\<f>\"\n        by (typecheck_cfuncs, metis LHS_true true_false_only_truth_values xy_def)\n      then have f0: \"(((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c right_coproj X Y) \\<circ>\\<^sub>c y = \\<f>\"\n        using  comp_associative2 y_def by (typecheck_cfuncs, auto)\n      have \"((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c right_coproj X Y = eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>\"\n        using right_coproj_cfunc_coprod by (typecheck_cfuncs, presburger)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>) \\<circ>\\<^sub>c y = \\<f>\"\n        using f0 by presburger\n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle> \\<circ>\\<^sub>cy = \\<f>\"\n        by (typecheck_cfuncs, simp add:  comp_associative2)\n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>g1 \\<circ>\\<^sub>c y,g2  \\<circ>\\<^sub>c y\\<rangle> = \\<f>\"\n        using  cfunc_prod_comp by (typecheck_cfuncs, force)\n      then show False\n        using contradiction true_false_distinct by auto\n    next\n      assume \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle>) \\<circ>\\<^sub>c xy \\<noteq> \\<t>\"\n      then have LHS_false: \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle>) \\<circ>\\<^sub>c xy = \\<f>\"\n        using  true_false_only_truth_values by (typecheck_cfuncs, blast)\n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>f1 \\<amalg> g1,f2 \\<amalg> g2\\<rangle> \\<circ>\\<^sub>c xy = \\<f>\"\n        using  comp_associative2 by (typecheck_cfuncs, force)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>(f1 \\<amalg> g1),(f2 \\<amalg> g2)\\<rangle> \\<circ>\\<^sub>c (right_coproj X Y \\<circ>\\<^sub>c y))  = \\<f>\"\n        using LHS_false y_def by blast\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>(f1 \\<amalg> g1)\\<circ>\\<^sub>c (right_coproj X Y \\<circ>\\<^sub>c y) ,(f2 \\<amalg> g2) \\<circ>\\<^sub>c (right_coproj X Y \\<circ>\\<^sub>c y)\\<rangle> )  = \\<f>\"\n        using cfunc_prod_comp by (typecheck_cfuncs, auto)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>((f1 \\<amalg> g1)\\<circ>\\<^sub>c right_coproj X Y) \\<circ>\\<^sub>c y ,((f2 \\<amalg> g2) \\<circ>\\<^sub>c right_coproj X Y) \\<circ>\\<^sub>c y\\<rangle> )  = \\<f>\"\n        using  comp_associative2 by (typecheck_cfuncs, force)\n      then have contradiction: \"eq_pred Z \\<circ>\\<^sub>c \\<langle>g1 \\<circ>\\<^sub>c y ,g2 \\<circ>\\<^sub>c y\\<rangle>   = \\<f>\"\n        by (typecheck_cfuncs, metis  f1_type f2_type right_coproj_cfunc_coprod)\n      have \"((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c xy = \\<t>\"\n        by (typecheck_cfuncs, metis LHS_false true_false_only_truth_values xy_def)\n      then have f0: \"(((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c right_coproj X Y) \\<circ>\\<^sub>c y = \\<t>\"\n        using  comp_associative2 y_def by (typecheck_cfuncs, auto)\n      have \"((eq_pred Z \\<circ>\\<^sub>c \\<langle>f1,f2\\<rangle>) \\<amalg> (eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>)) \\<circ>\\<^sub>c right_coproj X Y = eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>\"\n        using right_coproj_cfunc_coprod by (typecheck_cfuncs, presburger)\n      then have \"(eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle>) \\<circ>\\<^sub>c y = \\<t>\"\n        using f0 by presburger\n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>g1,g2\\<rangle> \\<circ>\\<^sub>c y = \\<t>\"\n        by (typecheck_cfuncs, simp add:  comp_associative2)\n      then have \"eq_pred Z \\<circ>\\<^sub>c \\<langle>g1 \\<circ>\\<^sub>c y, g2  \\<circ>\\<^sub>c y\\<rangle> = \\<t>\"\n        using  cfunc_prod_comp by (typecheck_cfuncs, force)\n      then show False\n        using contradiction true_false_distinct by auto\n    qed\n  qed\nqed\n\n\n\n\nlemma eq_pred_left_coproj2:\n  assumes a_type[type_rule]: \"f : A \\<rightarrow> X\" and b_type[type_rule]: \"g : A \\<rightarrow> X\"\n  shows \"eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>left_coproj X Y \\<circ>\\<^sub>c f, left_coproj X Y \\<circ>\\<^sub>c g\\<rangle> = eq_pred X \\<circ>\\<^sub>c \\<langle>f, g\\<rangle>\"\nproof(rule one_separator[where X = A, where Y = \\<Omega>])\n  show \"eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>left_coproj X Y \\<circ>\\<^sub>c f,left_coproj X Y \\<circ>\\<^sub>c g\\<rangle> : A \\<rightarrow> \\<Omega>\"\n    by typecheck_cfuncs\n  show \"eq_pred X \\<circ>\\<^sub>c \\<langle>f,g\\<rangle> : A \\<rightarrow> \\<Omega>\"\n    by typecheck_cfuncs\n  show \"\\<And>a. a \\<in>\\<^sub>c A \\<Longrightarrow> (eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>left_coproj X Y \\<circ>\\<^sub>c f,left_coproj X Y \\<circ>\\<^sub>c g\\<rangle>) \\<circ>\\<^sub>c a = (eq_pred X \\<circ>\\<^sub>c \\<langle>f,g\\<rangle>) \\<circ>\\<^sub>c a\"\n  proof - \n    fix a\n    assume a_type[type_rule]: \"a \\<in>\\<^sub>c A\"\n    have \"(eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>left_coproj X Y \\<circ>\\<^sub>c f,left_coproj X Y \\<circ>\\<^sub>c g\\<rangle>) \\<circ>\\<^sub>c a = \n           eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>left_coproj X Y \\<circ>\\<^sub>c f,left_coproj X Y \\<circ>\\<^sub>c g\\<rangle>  \\<circ>\\<^sub>c a\"\n      using comp_associative2 by (typecheck_cfuncs, force)\n    also have \"... = eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>left_coproj X Y \\<circ>\\<^sub>c f \\<circ>\\<^sub>c a,left_coproj X Y \\<circ>\\<^sub>c g \\<circ>\\<^sub>c a\\<rangle>\"\n      by (typecheck_cfuncs, simp add: cfunc_prod_comp comp_associative2)\n    also have \"... = (eq_pred X \\<circ>\\<^sub>c \\<langle>f,g\\<rangle>) \\<circ>\\<^sub>c a\"\n    proof(cases \"f \\<circ>\\<^sub>c a = g \\<circ>\\<^sub>c a\")\n      show \"f \\<circ>\\<^sub>c a = g \\<circ>\\<^sub>c a \\<Longrightarrow> eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>left_coproj X Y \\<circ>\\<^sub>c f \\<circ>\\<^sub>c a,left_coproj X Y \\<circ>\\<^sub>c g \\<circ>\\<^sub>c a\\<rangle> = (eq_pred X \\<circ>\\<^sub>c \\<langle>f,g\\<rangle>) \\<circ>\\<^sub>c a\"\n        by (typecheck_cfuncs, smt (z3)  cfunc_prod_comp comp_associative2 eq_pred_iff_eq)\n      show \"f \\<circ>\\<^sub>c a \\<noteq> g \\<circ>\\<^sub>c a \\<Longrightarrow> eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>left_coproj X Y \\<circ>\\<^sub>c f \\<circ>\\<^sub>c a,left_coproj X Y \\<circ>\\<^sub>c g \\<circ>\\<^sub>c a\\<rangle> = (eq_pred X \\<circ>\\<^sub>c \\<langle>f,g\\<rangle>) \\<circ>\\<^sub>c a\"\n        by (typecheck_cfuncs, smt (verit, best) cfunc_prod_comp comp_associative2 eq_pred_iff_eq_conv monomorphism_def3 left_coproj_are_monomorphisms)\n    qed\n    then show \"(eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>left_coproj X Y \\<circ>\\<^sub>c f,left_coproj X Y \\<circ>\\<^sub>c g\\<rangle>) \\<circ>\\<^sub>c a = (eq_pred X \\<circ>\\<^sub>c \\<langle>f,g\\<rangle>) \\<circ>\\<^sub>c a\"\n      using calculation by auto\n  qed\nqed\n\n\nlemma eq_pred_right_coproj2:\n  assumes a_type[type_rule]: \"f : A \\<rightarrow> Y\" and b_type[type_rule]: \"g : A \\<rightarrow> Y\"\n  shows \"eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>right_coproj X Y \\<circ>\\<^sub>c f, right_coproj X Y \\<circ>\\<^sub>c g\\<rangle> = eq_pred Y \\<circ>\\<^sub>c \\<langle>f, g\\<rangle>\"\nproof(rule one_separator[where X = A, where Y = \\<Omega>])\n  show \"eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>right_coproj X Y \\<circ>\\<^sub>c f,right_coproj X Y \\<circ>\\<^sub>c g\\<rangle> : A \\<rightarrow> \\<Omega>\"\n    by typecheck_cfuncs\n  show \"eq_pred Y \\<circ>\\<^sub>c \\<langle>f,g\\<rangle> : A \\<rightarrow> \\<Omega>\"\n    by typecheck_cfuncs\n  show \"\\<And>a. a \\<in>\\<^sub>c A \\<Longrightarrow> (eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>right_coproj X Y \\<circ>\\<^sub>c f,right_coproj X Y \\<circ>\\<^sub>c g\\<rangle>) \\<circ>\\<^sub>c a = (eq_pred Y \\<circ>\\<^sub>c \\<langle>f,g\\<rangle>) \\<circ>\\<^sub>c a\"\n  proof - \n    fix a\n    assume a_type[type_rule]: \"a \\<in>\\<^sub>c A\"\n    have \"(eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>right_coproj X Y \\<circ>\\<^sub>c f,right_coproj X Y \\<circ>\\<^sub>c g\\<rangle>) \\<circ>\\<^sub>c a = \n           eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>right_coproj X Y \\<circ>\\<^sub>c f,right_coproj X Y \\<circ>\\<^sub>c g\\<rangle>  \\<circ>\\<^sub>c a\"\n      using comp_associative2 by (typecheck_cfuncs, force)\n    also have \"... = eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>right_coproj X Y \\<circ>\\<^sub>c f \\<circ>\\<^sub>c a,right_coproj X Y \\<circ>\\<^sub>c g \\<circ>\\<^sub>c a\\<rangle>\"\n      by (typecheck_cfuncs, simp add: cfunc_prod_comp comp_associative2)\n    also have \"... = (eq_pred Y \\<circ>\\<^sub>c \\<langle>f,g\\<rangle>) \\<circ>\\<^sub>c a\"\n    proof(cases \"f \\<circ>\\<^sub>c a = g \\<circ>\\<^sub>c a\")\n      show \"f \\<circ>\\<^sub>c a = g \\<circ>\\<^sub>c a \\<Longrightarrow> eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>right_coproj X Y \\<circ>\\<^sub>c f \\<circ>\\<^sub>c a,right_coproj X Y \\<circ>\\<^sub>c g \\<circ>\\<^sub>c a\\<rangle> = (eq_pred Y \\<circ>\\<^sub>c \\<langle>f,g\\<rangle>) \\<circ>\\<^sub>c a\"\n        by (typecheck_cfuncs, smt (z3)  cfunc_prod_comp comp_associative2 eq_pred_iff_eq)\n      show \"f \\<circ>\\<^sub>c a \\<noteq> g \\<circ>\\<^sub>c a \\<Longrightarrow> eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>right_coproj X Y \\<circ>\\<^sub>c f \\<circ>\\<^sub>c a,right_coproj X Y \\<circ>\\<^sub>c g \\<circ>\\<^sub>c a\\<rangle> = (eq_pred Y \\<circ>\\<^sub>c \\<langle>f,g\\<rangle>) \\<circ>\\<^sub>c a\"\n        by (typecheck_cfuncs, smt (verit, best) cfunc_prod_comp comp_associative2 eq_pred_iff_eq_conv monomorphism_def3 right_coproj_are_monomorphisms)\n    qed\n    then show \"(eq_pred (X \\<Coprod> Y) \\<circ>\\<^sub>c \\<langle>right_coproj X Y \\<circ>\\<^sub>c f,right_coproj X Y \\<circ>\\<^sub>c g\\<rangle>) \\<circ>\\<^sub>c a = (eq_pred Y \\<circ>\\<^sub>c \\<langle>f,g\\<rangle>) \\<circ>\\<^sub>c a\"\n      using calculation by auto\n  qed\nqed\n\n\n      \n      \n  \n  \n\n\ntheorem well_ordering_principle:\n  assumes \"nonempty A\" \"(A, m) \\<subseteq>\\<^sub>c \\<nat>\\<^sub>c\"\n  shows \"\\<exists> a. a \\<in>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> (A, m) \\<and> (\\<forall> b. b \\<in>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> (A, m) \\<longrightarrow>  a \\<le>\\<^sub>\\<nat> b)\"\nproof(cases \"zero \\<in>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> (A, m)\")\n  show \"zero \\<in>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> (A, m) \\<Longrightarrow> \\<exists>a. a \\<in>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> (A, m) \\<and> (\\<forall>b. b \\<in>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> (A, m) \\<longrightarrow> a \\<le>\\<^sub>\\<nat> b)\"\n    unfolding leq_infix_def using relative_member_def zero_is_smallest by blast\nnext\n  assume no_zero: \" \\<not> zero \\<in>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> (A, m)\"\n  obtain \\<chi>\\<^sub>A where \\<chi>\\<^sub>A_def: \"\\<chi>\\<^sub>A = characteristic_func m\"\n    by simp\n  have \\<chi>\\<^sub>A_type[type_rule]: \"\\<chi>\\<^sub>A : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega>\"\n    using assms unfolding \\<chi>\\<^sub>A_def subobject_of_def2 by (auto, typecheck_cfuncs)\n\n  obtain q where q_def: \"q = (right_coproj \\<Omega> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c zero\"    (*I redefined q because we only need the special case when 0 is not an element of the set!*)\n    by simp\n  have q_type[type_rule]: \"q : one \\<rightarrow> \\<Omega> \\<Coprod> \\<nat>\\<^sub>c\"\n    unfolding q_def by typecheck_cfuncs\n\n  obtain f where f_def: \"f = (left_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<f> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<Omega>\\<^esub>) \\<amalg>\n    (((\\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c \\<times>\\<^sub>c one\\<^esub>) \\<bowtie>\\<^sub>f left_cart_proj \\<nat>\\<^sub>c one) \\<circ>\\<^sub>c\n  dist_prod_coprod_inv \\<nat>\\<^sub>c one one \\<circ>\\<^sub>c \\<langle>successor, case_bool \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c successor\\<rangle>)\"\n    by simp\n  have f_type[type_rule]: \"f : \\<Omega> \\<Coprod> \\<nat>\\<^sub>c \\<rightarrow> \\<Omega> \\<Coprod> \\<nat>\\<^sub>c\"\n    unfolding f_def by typecheck_cfuncs\n\n  obtain u where u_type[type_rule]: \"u: \\<nat>\\<^sub>c \\<rightarrow> \\<Omega> \\<Coprod> \\<nat>\\<^sub>c\" \n            and  u_zero: \"u \\<circ>\\<^sub>c zero = q\" \n            and  u_successor: \"f \\<circ>\\<^sub>c u = u \\<circ>\\<^sub>c successor\"\n    using natural_number_object_property2 by (typecheck_cfuncs, blast)\n\n  have \"FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>\n          eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c, right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c, left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp> = \\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub>\"\n  proof (rule natural_number_object_func_unique[where X=\\<Omega>, where f=\"id \\<Omega>\"])\n    show \"FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,\n        right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp> : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega>\"\n      by typecheck_cfuncs\n    show \"\\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega>\"\n      by typecheck_cfuncs\n    show \"id\\<^sub>c \\<Omega> : \\<Omega> \\<rightarrow> \\<Omega>\"\n      by typecheck_cfuncs\n\n\n\n    show \"(FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c  \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n                                         eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c  zero =\n      (\\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub>) \\<circ>\\<^sub>c zero\"\n        proof - \n          have \"(FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c  \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n                                         eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c  zero  = \n          FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c ((IMPLIES \\<circ>\\<^sub>c  \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n                                         eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)  \\<circ>\\<^sub>c  (id \\<nat>\\<^sub>c \\<times>\\<^sub>f zero))\\<^sup>\\<sharp>\"\n            by (typecheck_cfuncs, smt (z3) comp_associative2 sharp_comp)\n          also have \"... = \\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>one\\<^esub>\"\n          proof(rule all_true_implies_FORALL_true2)\n            show \"(IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>) \\<circ>\\<^sub>c\n                      id\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>f zero : \\<nat>\\<^sub>c \\<times>\\<^sub>c one \\<rightarrow> \\<Omega>\"\n              by typecheck_cfuncs\n            show \"\\<And> n_one. n_one \\<in>\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>c one \\<Longrightarrow>\n          ((IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>) \\<circ>\\<^sub>c  id\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>f zero) \\<circ>\\<^sub>c\n                     n_one = \\<t>\"\n            proof - \n              fix n_one \n              assume n_one_type[type_rule]: \"n_one \\<in>\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>c one\"\n              then obtain n where n_type[type_rule]: \"n \\<in>\\<^sub>c \\<nat>\\<^sub>c\" and n_def: \"n_one = \\<langle>n, id one\\<rangle>\"\n                by (typecheck_cfuncs, metis cart_prod_decomp one_unique_element)\n              have \"((IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>) \\<circ>\\<^sub>c  id\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>f zero) \\<circ>\\<^sub>c\n                     n_one = \n                    (IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>) \\<circ>\\<^sub>c  (id\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>f zero) \\<circ>\\<^sub>c\n                     n_one\"\n                using comp_associative2 by (typecheck_cfuncs, force)\n              also have \"... = (IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>) \\<circ>\\<^sub>c  \\<langle>n, zero\\<rangle>\"\n                by (typecheck_cfuncs, smt (z3) cfunc_cross_prod_comp_cfunc_prod id_left_unit2 id_right_unit2 id_type n_def)\n              also have \"... = IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle> \\<circ>\\<^sub>c  \\<langle>n, zero\\<rangle>\"\n                by (typecheck_cfuncs, simp add: comp_associative2)\n              also have \"... = IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c ,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle> \\<circ>\\<^sub>c  \\<langle>n, zero\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle> \\<circ>\\<^sub>c  \\<langle>n, zero\\<rangle>\\<rangle> \"\n                by (typecheck_cfuncs, smt (z3) cfunc_prod_comp comp_associative2)\n              also have \"... = IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c \\<circ>\\<^sub>c  \\<langle>n, zero\\<rangle>,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c \\<circ>\\<^sub>c  \\<langle>n, zero\\<rangle>\\<rangle> ,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c \\<circ>\\<^sub>c  \\<langle>n, zero\\<rangle>,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c \\<circ>\\<^sub>c  \\<langle>n, zero\\<rangle>\\<rangle> \\<rangle> \"\n                using cfunc_prod_comp comp_associative2 by (typecheck_cfuncs, force)\n              also have \"... = IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c zero,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c n\\<rangle> ,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>zero, n\\<rangle> \\<rangle>\"\n                using left_cart_proj_cfunc_prod right_cart_proj_cfunc_prod by (typecheck_cfuncs, presburger)\n              also have \"... = IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c zero, right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c n\\<rangle> ,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>zero, n\\<rangle>\\<rangle>\"\n                using u_zero q_def by auto\n              also have \"... = IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>zero, n\\<rangle> ,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>zero, n\\<rangle>\\<rangle>\"\n                by (typecheck_cfuncs, simp add: eq_pred_right_coproj2)\n              also have \"... = \\<t>\"\n                by (typecheck_cfuncs, metis IMPLIES_false_is_true_false true_false_only_truth_values)\n              then show \"((IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>) \\<circ>\\<^sub>c  id\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>f zero) \\<circ>\\<^sub>c\n                     n_one = \\<t>\"\n                using calculation by auto\n            qed\n          qed\n          also have \"... = (\\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub>) \\<circ>\\<^sub>c zero\"\n            using comp_associative2 terminal_func_comp by (typecheck_cfuncs, force)\n          then show ?thesis\n            using calculation by auto\n    qed\n\n\n\n\n\n\n    show \"(FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c successor\n        = id\\<^sub>c \\<Omega> \\<circ>\\<^sub>c FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>\"\n    proof (rule one_separator[where X=\"\\<nat>\\<^sub>c\", where Y=\\<Omega>])\n      show \"(FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,\n          right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c\n            successor : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega>\"\n        by typecheck_cfuncs\n      show \"id\\<^sub>c \\<Omega> \\<circ>\\<^sub>c FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c  \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c\n          \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp> : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega>\"\n        by typecheck_cfuncs\n    next\n      fix n\n      assume n_type[type_rule]: \"n \\<in>\\<^sub>c \\<nat>\\<^sub>c\"\n      show \"((FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c successor) \\<circ>\\<^sub>c n\n        = (id\\<^sub>c \\<Omega> \\<circ>\\<^sub>c FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c n\"\n      proof (cases \"((FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c successor) \\<circ>\\<^sub>c n = \\<t>\")\n        assume \"((FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c successor) \\<circ>\\<^sub>c n = \\<t>\"\n        \n\n\n\n\n        then have \"FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp> \\<circ>\\<^sub>c successor \\<circ>\\<^sub>c n = \\<t>\"\n          by (typecheck_cfuncs_prems, smt (z3) cfunc_type_def codomain_comp comp_associative)\n        then have \"FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c ((IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>) \\<circ>\\<^sub>c (id \\<nat>\\<^sub>c \\<times>\\<^sub>f (successor \\<circ>\\<^sub>c n)))\\<^sup>\\<sharp> = \\<t>\"\n          by (typecheck_cfuncs_prems, metis sharp_comp)\n        then have \"FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c ((IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>) \\<circ>\\<^sub>c \n          \\<langle>id \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c one, (successor \\<circ>\\<^sub>c n) \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c one\\<rangle>)\\<^sup>\\<sharp> = \\<t>\"\n          by (typecheck_cfuncs, metis cfunc_cross_prod_def2)\n        then have \"FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c ((IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>) \\<circ>\\<^sub>c \n          \\<langle>left_cart_proj \\<nat>\\<^sub>c one, (successor \\<circ>\\<^sub>c n) \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c one\\<rangle>)\\<^sup>\\<sharp> = \\<t>\"\n          by (typecheck_cfuncs, metis  id_left_unit2)\n        then have \"FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle> \\<circ>\\<^sub>c \n          \\<langle>left_cart_proj \\<nat>\\<^sub>c one, (successor \\<circ>\\<^sub>c n) \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c one\\<rangle>)\\<^sup>\\<sharp> = \\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>one\\<^esub>\"\n          by (typecheck_cfuncs, metis  cfunc_type_def comp_associative id_right_unit2 id_type one_unique_element)\n        then have \"\\<And> x y. x \\<in>\\<^sub>c \\<nat>\\<^sub>c \\<Longrightarrow> y \\<in>\\<^sub>c one \\<Longrightarrow>  IMPLIES \\<circ>\\<^sub>c \n          \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n          eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle> \\<circ>\\<^sub>c \n          \\<langle>left_cart_proj \\<nat>\\<^sub>c one, (successor \\<circ>\\<^sub>c n) \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c one\\<rangle> \\<circ>\\<^sub>c \\<langle>x, y\\<rangle> = \\<t>\"\n          oops\n \n\n\n\n          find_theorems \"left_cart_proj\"\n(*      have \"(FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n            \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n            eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c successor\n          = FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c ((IMPLIES \\<circ>\\<^sub>c \n            \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>,\n            eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>) \\<circ>\\<^sub>c (id \\<nat>\\<^sub>c \\<times>\\<^sub>f successor))\\<^sup>\\<sharp>\"\n        by (typecheck_cfuncs, smt (z3) comp_associative2 sharp_comp)\n      also have \"... = FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n            \\<langle>(eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>) \\<circ>\\<^sub>c (id \\<nat>\\<^sub>c \\<times>\\<^sub>f successor),\n            (eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c,left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>) \\<circ>\\<^sub>c (id \\<nat>\\<^sub>c \\<times>\\<^sub>f successor)\\<rangle>)\\<^sup>\\<sharp>\"\n        by (typecheck_cfuncs, smt (z3) cfunc_prod_comp comp_associative2)\n      also have \"... = FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n            \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>(u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c) \\<circ>\\<^sub>c (id \\<nat>\\<^sub>c \\<times>\\<^sub>f successor), \n              (right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c) \\<circ>\\<^sub>c (id \\<nat>\\<^sub>c \\<times>\\<^sub>f successor)\\<rangle>,\n            eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c  \\<circ>\\<^sub>c (id \\<nat>\\<^sub>c \\<times>\\<^sub>f successor), left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c \\<circ>\\<^sub>c (id \\<nat>\\<^sub>c \\<times>\\<^sub>f successor)\\<rangle>\\<rangle>)\\<^sup>\\<sharp>\"\n        by (typecheck_cfuncs, smt (z3) cfunc_prod_comp comp_associative2)\n      also have \"... = FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \n            \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>(u \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c) \\<circ>\\<^sub>c (id \\<nat>\\<^sub>c \\<times>\\<^sub>f successor), \n              (right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c) \\<circ>\\<^sub>c (id \\<nat>\\<^sub>c \\<times>\\<^sub>f successor)\\<rangle>,\n            eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>successor \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c , left_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>\\<rangle>)\\<^sup>\\<sharp>\"*)\n\n  have \"\\<And>n. n \\<in>\\<^sub>c \\<nat>\\<^sub>c \\<Longrightarrow> u \\<circ>\\<^sub>c n = right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c n \\<or> (\\<exists> \\<omega>. \\<omega> \\<in>\\<^sub>c \\<Omega> \\<and> u \\<circ>\\<^sub>c n = left_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<omega>)\"\n  proof auto\n    fix n\n    assume n_type[type_rule]: \"n \\<in>\\<^sub>c \\<nat>\\<^sub>c\"\n\n  obtain q' where q'_def: \"q' = \\<langle>\\<t>, zero\\<rangle>\"   (*I redefined q' because we only need the special case when 0 is not an element of the set!*)\n    by simp\n  have q'_type[type_rule]: \"q' : one \\<rightarrow> \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\"\n    unfolding q'_def by typecheck_cfuncs\n\n\n  \n  obtain f' where f'_def: \"f' = \\<langle>\n        AND \\<circ>\\<^sub>c \\<langle>left_cart_proj \\<Omega> \\<nat>\\<^sub>c, \\<chi>\\<^sub>A \\<circ>\\<^sub>c successor \\<circ>\\<^sub>c right_cart_proj \\<Omega> \\<nat>\\<^sub>c\\<rangle>, \n        successor \\<circ>\\<^sub>c right_cart_proj \\<Omega> \\<nat>\\<^sub>c\n      \\<rangle>\"\n    by simp\n  have f'_type[type_rule]: \"f' : \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c \\<rightarrow> \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\"\n    unfolding f'_def by typecheck_cfuncs\n\n  obtain v1 where v1_def: \"v1 = \\<langle>FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>leq, NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>)\\<^sup>\\<sharp>, id \\<nat>\\<^sub>c\\<rangle>\"\n    by simp\n  have v1_type[type_rule]: \"v1 : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\"\n    unfolding v1_def by typecheck_cfuncs\n\n  have v1z_eqs_q': \"v1 \\<circ>\\<^sub>c zero = q'\"\n  proof - \n    have f1: \"(FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>leq, NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c zero = \\<t>\"\n    proof - \n      have \"(FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>leq, NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c zero\n          = FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>leq, NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>)\\<^sup>\\<sharp> \\<circ>\\<^sub>c zero\"\n        by (typecheck_cfuncs, smt comp_associative2)\n      also have \"... = FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c((IMPLIES \\<circ>\\<^sub>c \\<langle>leq, NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>) \\<circ>\\<^sub>c (id (\\<nat>\\<^sub>c) \\<times>\\<^sub>f zero))\\<^sup>\\<sharp>\"\n        by (typecheck_cfuncs, metis sharp_comp)\n      also have \"... = \\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>one\\<^esub>\"\n      proof(rule all_true_implies_FORALL_true2)\n        show \"(IMPLIES \\<circ>\\<^sub>c \\<langle>leq,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>) \\<circ>\\<^sub>c id\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>f zero : \\<nat>\\<^sub>c \\<times>\\<^sub>c one \\<rightarrow> \\<Omega>\"\n          by typecheck_cfuncs\n      next  \n        show \"\\<And>xy. xy \\<in>\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>c one \\<Longrightarrow> ((IMPLIES \\<circ>\\<^sub>c \\<langle>leq,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>) \\<circ>\\<^sub>c id\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>f zero) \\<circ>\\<^sub>c xy = \\<t>\"\n        proof - \n          fix n_one\n          assume n_one_type[type_rule]: \"n_one \\<in>\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>c one\"\n          obtain n where n_def: \"n_one = \\<langle>n,id(one)\\<rangle>\" and n_type: \"n \\<in>\\<^sub>c \\<nat>\\<^sub>c\"\n            by (metis cart_prod_decomp id_type n_one_type terminal_func_unique)\n          have \"((IMPLIES \\<circ>\\<^sub>c \\<langle>leq,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>) \\<circ>\\<^sub>c id\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>f zero) \\<circ>\\<^sub>c n_one = \n                 (IMPLIES \\<circ>\\<^sub>c \\<langle>leq,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>) \\<circ>\\<^sub>c (id\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>f zero) \\<circ>\\<^sub>c n_one\"\n            by (typecheck_cfuncs, metis cfunc_type_def comp_associative)\n          also have \"... = (IMPLIES \\<circ>\\<^sub>c \\<langle>leq,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>) \\<circ>\\<^sub>c \\<langle>n, zero\\<rangle>\"\n            by (typecheck_cfuncs, smt (z3) cfunc_cross_prod_comp_cfunc_prod id_left_unit2 id_right_unit2 id_type n_def n_type)\n          also have \"... =  IMPLIES \\<circ>\\<^sub>c \\<langle>leq,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle> \\<circ>\\<^sub>c \\<langle>n, zero\\<rangle>\"\n            by (typecheck_cfuncs, metis comp_associative2 n_type)\n          also have \"... =  IMPLIES \\<circ>\\<^sub>c \\<langle>leq \\<circ>\\<^sub>c \\<langle>n, zero\\<rangle> ,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>n, zero\\<rangle> \\<rangle>\"\n            by (typecheck_cfuncs, smt (z3) cfunc_prod_comp comp_associative2 n_type)\n          also have \"... =  IMPLIES \\<circ>\\<^sub>c \\<langle>leq \\<circ>\\<^sub>c \\<langle>n, zero\\<rangle> ,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c zero\\<rangle>\"\n            using n_type right_cart_proj_cfunc_prod by (typecheck_cfuncs, presburger)\n          also have \"... =  IMPLIES \\<circ>\\<^sub>c \\<langle>leq \\<circ>\\<^sub>c \\<langle>n, zero\\<rangle> ,\\<t>\\<rangle>\"\n            by (typecheck_cfuncs, metis NOT_false_is_true \\<chi>\\<^sub>A_def assms(2) characteristic_func_true_relative_member no_zero subobject_of_def2 true_false_only_truth_values)\n          also have \"... =  \\<t>\"\n            by (typecheck_cfuncs, metis IMPLIES_false_is_true_false n_type true_false_only_truth_values)\n          then show \"((IMPLIES \\<circ>\\<^sub>c \\<langle>leq,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>) \\<circ>\\<^sub>c id\\<^sub>c \\<nat>\\<^sub>c \\<times>\\<^sub>f zero) \\<circ>\\<^sub>c n_one = \\<t>\"\n            by (simp add: calculation)\n        qed\n      qed\n      also have \"... = \\<t>\"\n        by (typecheck_cfuncs, metis id_right_unit2 id_type one_unique_element)\n      then show ?thesis\n        using calculation by auto\n    qed\n    have \"v1 \\<circ>\\<^sub>c zero = \\<langle>(FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>leq, NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>)\\<^sup>\\<sharp>) \\<circ>\\<^sub>c zero, id \\<nat>\\<^sub>c \\<circ>\\<^sub>c zero \\<rangle>\"\n      using cfunc_prod_comp v1_def by (typecheck_cfuncs, blast)\n    also have \"... = q'\"\n      by (typecheck_cfuncs, simp add: f1 id_left_unit2 q'_def)\n    then show ?thesis\n      by (simp add: calculation)\n  qed\n\n\n\n  obtain v2 where v2_def: \"v2 = \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u, right_coproj \\<Omega> \\<nat>\\<^sub>c\\<rangle>, id \\<nat>\\<^sub>c \\<rangle>\"\n    by simp\n  have v2_type[type_rule]: \"v2 : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\"\n    unfolding v2_def by typecheck_cfuncs\n\n\n  have v2z_eqs_q': \"v2 \\<circ>\\<^sub>c zero = q'\"\n  proof - \n    have \"v2 \\<circ>\\<^sub>c zero  = \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u, right_coproj \\<Omega> \\<nat>\\<^sub>c\\<rangle> \\<circ>\\<^sub>c zero , zero\\<rangle>\"\n      by (typecheck_cfuncs, smt (verit, best) cfunc_prod_comp comp_associative2 comp_type id_left_unit2 id_type v2_def)\n    also have \" ... = \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c zero , right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c zero\\<rangle>  , zero\\<rangle>\"\n      by (typecheck_cfuncs, simp add: cfunc_prod_comp)\n    also have \" ... = \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c zero , right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c zero\\<rangle>  , zero\\<rangle>\"\n      by (simp add: q_def u_zero)\n    also have \"... = \\<langle>\\<t>  , zero\\<rangle>\"\n      by (typecheck_cfuncs, metis eq_pred_iff_eq)\n    then show ?thesis\n      by (simp add: calculation q'_def)\n  qed\n\n\n\n\n\n\n  have \"v1 = v2\"\n  proof (rule natural_number_object_func_unique[where X=\"\\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\", where f=f'])\n    show \"v1 : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\" \"v2 : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\" \"f' : \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c \\<rightarrow> \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\"\n      by (typecheck_cfuncs, presburger)\n\n    show \"v1 \\<circ>\\<^sub>c zero = v2 \\<circ>\\<^sub>c zero\"\n      by (simp add: v1z_eqs_q' v2z_eqs_q')\n\n    show \"v1 \\<circ>\\<^sub>c successor = f' \\<circ>\\<^sub>c v1\"\n      sorry\n\n    show \"v2 \\<circ>\\<^sub>c successor = f' \\<circ>\\<^sub>c v2\"\n    proof(rule one_separator[where X = \"\\<nat>\\<^sub>c\", where Y = \"\\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\"])\n      show \"v2 \\<circ>\\<^sub>c successor : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\" \"f' \\<circ>\\<^sub>c v2 : \\<nat>\\<^sub>c \\<rightarrow> \\<Omega> \\<times>\\<^sub>c \\<nat>\\<^sub>c\"\n        by (typecheck_cfuncs, presburger)\n      show \"\\<And>n. n \\<in>\\<^sub>c \\<nat>\\<^sub>c \\<Longrightarrow> (v2 \\<circ>\\<^sub>c successor) \\<circ>\\<^sub>c n = (f' \\<circ>\\<^sub>c v2) \\<circ>\\<^sub>c n\"\n      proof - \n        fix n\n        assume n_type[type_rule]: \"n \\<in>\\<^sub>c \\<nat>\\<^sub>c\" \n      (*  assume case1: \"u \\<circ>\\<^sub>c  n = right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c  n\"    (*This is an assumption to try to make the calculations fall out easier*)\n*)\n\n\n        have \"(v2 \\<circ>\\<^sub>c successor) \\<circ>\\<^sub>c n = v2 \\<circ>\\<^sub>c (successor  \\<circ>\\<^sub>c n)\"\n          by (typecheck_cfuncs, simp add: comp_associative2)\n        also have \"... = \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u, right_coproj \\<Omega> \\<nat>\\<^sub>c\\<rangle>  \\<circ>\\<^sub>c (successor  \\<circ>\\<^sub>c n), id \\<nat>\\<^sub>c  \\<circ>\\<^sub>c (successor  \\<circ>\\<^sub>c n)\\<rangle>\"\n          by (typecheck_cfuncs, smt (verit, best) cfunc_prod_comp comp_associative2 comp_type v2_def) \n        also have \"... = \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c (successor  \\<circ>\\<^sub>c n), right_coproj \\<Omega> \\<nat>\\<^sub>c  \\<circ>\\<^sub>c (successor  \\<circ>\\<^sub>c n) \\<rangle>  ,  (successor  \\<circ>\\<^sub>c n)\\<rangle>\"\n          using cfunc_prod_comp id_left_unit2 by (typecheck_cfuncs, force)\n        also have \"... = \\<langle>((\\<f>  \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<Omega>\\<^esub>) \\<amalg> (eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>id \\<nat>\\<^sub>c , (successor  \\<circ>\\<^sub>c n)  \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub>\\<rangle>)) \\<circ>\\<^sub>c u \\<circ>\\<^sub>c (successor  \\<circ>\\<^sub>c n) ,  (successor  \\<circ>\\<^sub>c n)\\<rangle>\"\n          using eq_pred_right_coproj by (typecheck_cfuncs, presburger)\n        also have \"... = \\<langle>((\\<f>  \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<Omega>\\<^esub>) \\<amalg> (eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>id \\<nat>\\<^sub>c , (successor  \\<circ>\\<^sub>c n)  \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub>\\<rangle>)) \\<circ>\\<^sub>c (f \\<circ>\\<^sub>c u \\<circ>\\<^sub>c n) ,  (successor  \\<circ>\\<^sub>c n)\\<rangle>\"\n          by (typecheck_cfuncs, simp add: comp_associative2 u_successor)\n        also have \"... = \\<langle>(\\<f> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<Omega>\\<^esub>) \\<amalg> (eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<langle>id\\<^sub>c \\<nat>\\<^sub>c,(successor \\<circ>\\<^sub>c n) \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub>\\<rangle>) \\<circ>\\<^sub>c\n            (left_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c \\<f> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<Omega>\\<^esub>) \\<amalg>\n            (((\\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c \\<times>\\<^sub>c one\\<^esub>) \\<bowtie>\\<^sub>f left_cart_proj \\<nat>\\<^sub>c one) \\<circ>\\<^sub>c dist_prod_coprod_inv \\<nat>\\<^sub>c one one \\<circ>\\<^sub>c \\<langle>successor,case_bool \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c successor\\<rangle>) \\<circ>\\<^sub>c\n              u \\<circ>\\<^sub>c n,successor \\<circ>\\<^sub>c n\\<rangle>\"\n          unfolding f_def by simp\n        also have \"... = undefined\"\n        proof (cases \"u \\<circ>\\<^sub>c n = right_coproj\")\n        (*The above follows from the newly proved lemma!*)\n        thm f_def f'_def v2_def u_successor f_type \\<chi>\\<^sub>A_type\n\n\n\n\n\n\n\n\n\n(*\n        have \"(f' \\<circ>\\<^sub>c v2) \\<circ>\\<^sub>c n = f' \\<circ>\\<^sub>c (v2 \\<circ>\\<^sub>c n)\"\n          by (typecheck_cfuncs, simp add: comp_associative2)\n        also have \"... = f' \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u, right_coproj \\<Omega> \\<nat>\\<^sub>c\\<rangle> \\<circ>\\<^sub>c n , id \\<nat>\\<^sub>c \\<circ>\\<^sub>c n\\<rangle>\"\n          unfolding v2_def by (typecheck_cfuncs, smt (z3) cfunc_prod_comp comp_associative2)\n        also have \"... = f' \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c n, right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c n\\<rangle>  , n\\<rangle>\"\n          by (typecheck_cfuncs, simp add: cfunc_prod_comp id_left_unit2)\n        also have \"... =  \\<langle>AND \\<circ>\\<^sub>c \\<langle>left_cart_proj \\<Omega> \\<nat>\\<^sub>c, \\<chi>\\<^sub>A \\<circ>\\<^sub>c successor \\<circ>\\<^sub>c right_cart_proj \\<Omega> \\<nat>\\<^sub>c\\<rangle>, \n        successor \\<circ>\\<^sub>c right_cart_proj \\<Omega> \\<nat>\\<^sub>c \\<rangle> \\<circ>\\<^sub>c \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u \\<circ>\\<^sub>c n, right_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c n\\<rangle>  , n\\<rangle>\"\n          using f'_def by force\n        also have \"... =  \\<langle>AND \\<circ>\\<^sub>c \\<langle>left_cart_proj \\<Omega> \\<nat>\\<^sub>c, \\<chi>\\<^sub>A \\<circ>\\<^sub>c successor \\<circ>\\<^sub>c right_cart_proj \\<Omega> \\<nat>\\<^sub>c\\<rangle>, \n        successor \\<circ>\\<^sub>c right_cart_proj \\<Omega> \\<nat>\\<^sub>c \\<rangle> \\<circ>\\<^sub>c \\<langle>((\\<f> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<Omega>\\<^esub>) \\<amalg> (eq_pred \\<nat>\\<^sub>c \\<circ>\\<^sub>c  \\<langle>id \\<nat>\\<^sub>c , n \\<circ>\\<^sub>c \\<beta>\\<^bsub> \\<nat>\\<^sub>c\\<^esub>\\<rangle>)) \\<circ>\\<^sub>c (u \\<circ>\\<^sub>c n)   , n\\<rangle>\"\n          using eq_pred_right_coproj by (typecheck_cfuncs, presburger)\n        (*The above follows from the newly proved lemma!*)\n*)\n\n\n\n\n\n  qed\n  then have \"\\<And> n. n \\<in>\\<^sub>c \\<nat>\\<^sub>c \\<Longrightarrow> u \\<circ>\\<^sub>c n = left_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c n \\<equiv> (\\<forall>n'. n' \\<in>\\<^sub>c \\<nat>\\<^sub>c \\<longrightarrow> n' \\<le>\\<^sub>\\<nat> n \\<longrightarrow> \\<not> n' \\<in>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> (A, m))\"\n  proof -\n    fix n\n    assume n_type[type_rule]: \"n \\<in>\\<^sub>c \\<nat>\\<^sub>c\"\n\n    have \"\\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u,right_coproj \\<Omega> \\<nat>\\<^sub>c\\<rangle>,id\\<^sub>c \\<nat>\\<^sub>c\\<rangle> = \\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> \\<equiv> u \\<circ>\\<^sub>c n = left_coproj \\<Omega> \\<nat>\\<^sub>c \\<circ>\\<^sub>c n\"\n      sorry\n\n    have \"\\<langle>FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>leq,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>)\\<^sup>\\<sharp>,id\\<^sub>c \\<nat>\\<^sub>c\\<rangle> = \\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> \n          \\<equiv> \n        (\\<forall>n'. n' \\<in>\\<^sub>c \\<nat>\\<^sub>c \\<longrightarrow> n' \\<le>\\<^sub>\\<nat> n \\<longrightarrow> \\<not> n' \\<in>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> (A, m))\"\n      sorry\n\n    assume \"v1 = v2\"\n    then have \"\\<langle>FORALL \\<nat>\\<^sub>c \\<circ>\\<^sub>c (IMPLIES \\<circ>\\<^sub>c \\<langle>leq,NOT \\<circ>\\<^sub>c \\<chi>\\<^sub>A \\<circ>\\<^sub>c right_cart_proj \\<nat>\\<^sub>c \\<nat>\\<^sub>c\\<rangle>)\\<^sup>\\<sharp>,id\\<^sub>c \\<nat>\\<^sub>c\\<rangle> = \\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub> \n          \\<equiv>\n        \\<langle>eq_pred (\\<Omega> \\<Coprod> \\<nat>\\<^sub>c) \\<circ>\\<^sub>c \\<langle>u,right_coproj \\<Omega> \\<nat>\\<^sub>c\\<rangle>,id\\<^sub>c \\<nat>\\<^sub>c\\<rangle> = \\<t> \\<circ>\\<^sub>c \\<beta>\\<^bsub>\\<nat>\\<^sub>c\\<^esub>\"\n      unfolding v1_def v2_def by auto\n    \nend", "meta": {"author": "jameseb7", "repo": "Isabelle-ETCS", "sha": "ae81dc674faf7cca62b30ac53888b3d319160849", "save_path": "github-repos/isabelle/jameseb7-Isabelle-ETCS", "path": "github-repos/isabelle/jameseb7-Isabelle-ETCS/Isabelle-ETCS-ae81dc674faf7cca62b30ac53888b3d319160849/ETCS_Wellordering.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318194686359, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3161102036800225}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"Additional Syntax for Word Bit Operations\"\n\ntheory Word_Syntax\nimports\n  \"HOL-Word.WordBitwise\"\n  WordBitwise_Signed\n  Hex_Words\n  Norm_Words\nbegin\n\ntext \\<open>Additional bit and type syntax that forces word types.\\<close>\n\ntype_synonym word8 = \"8 word\"\ntype_synonym word16 = \"16 word\"\ntype_synonym word32 = \"32 word\"\ntype_synonym word64 = \"64 word\"\n\nlemma len8: \"len_of (x :: 8 itself) = 8\" by simp\nlemma len16: \"len_of (x :: 16 itself) = 16\" by simp\nlemma len32: \"len_of (x :: 32 itself) = 32\" by simp\nlemma len64: \"len_of (x :: 64 itself) = 64\" by simp\n\n\nabbreviation\n  wordNOT  :: \"'a::len0 word \\<Rightarrow> 'a word\"      (\"~~ _\" [70] 71)\nwhere\n  \"~~ x == NOT x\"\n\nabbreviation\n  wordAND  :: \"'a::len0 word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixr \"&&\" 64)\nwhere\n  \"a && b == a AND b\"\n\nabbreviation\n  wordOR   :: \"'a::len0 word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixr \"||\"  59)\nwhere\n  \"a || b == a OR b\"\n\nabbreviation\n  wordXOR  :: \"'a::len0 word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixr \"xor\" 59)\nwhere\n  \"a xor b == a XOR b\"\n\n(* testing for presence of word_bitwise *)\nlemma \"((x :: word32) >> 3) AND 7 = (x AND 56) >> 3\"\n  by word_bitwise\n\n(* FIXME: move to Word distribution *)\nlemma bin_nth_minus_Bit0[simp]:\n  \"0 < n \\<Longrightarrow> bin_nth (numeral (num.Bit0 w)) n = bin_nth (numeral w) (n - 1)\"\n  by (cases n; simp)\n\nlemma bin_nth_minus_Bit1[simp]:\n  \"0 < n \\<Longrightarrow> bin_nth (numeral (num.Bit1 w)) n = bin_nth (numeral w) (n - 1)\"\n  by (cases n; simp)\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/Word_Lib/Word_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3160922405286801}}
{"text": "(* Currently not used, but may be of general use. Keep in Aux! *)\ntheory On_Stack\nimports Collections.Refine_Dflt\nbegin\nsubsection \\<open>Implementation of a stack with efficient on-stack operation\\<close>\ntext \\<open>This generic implementation combines a stack implementation and\n  a set implementation that is used to keep track of the elements on the stack.\n  It requires a distinct stack, i.e., no duplicate elements on the stack.\n\n  Note that this generic implementation has to be instantiated to a\n  concrete stack-relation in order to avoid looping of the autoref-tool,\n  which otherwise tries to instantiate the stack-implementation with itself\n  indefinitely often.\n\\<close>\n\ndefinition stack_rel_internal_def: \"stack_rel lrel srel vrel \\<equiv> {\n  ((li,si),l). (li,l)\\<in>\\<langle>vrel\\<rangle>lrel \\<and> (si,set l)\\<in>\\<langle>vrel\\<rangle>srel \\<and> distinct l}\"\n\nlemma stack_rel_def: \"\\<langle>vrel\\<rangle>stack_rel lrel srel \\<equiv> {\n  ((li,si),l). (li,l)\\<in>\\<langle>vrel\\<rangle>lrel \\<and> (si,set l)\\<in>\\<langle>vrel\\<rangle>srel \\<and> distinct l}\"\n  unfolding stack_rel_internal_def relAPP_def by auto\n\n\nlemmas [autoref_rel_intf] \n  = REL_INTFI[of \"stack_rel lrel srel\" i_list for lrel srel]\n\ncontext \n  fixes lrel :: \"('xi \\<times> 'x) set \\<Rightarrow> ('xli \\<times> 'x list) set\"\n  and srel :: \"('xi \\<times> 'x) set \\<Rightarrow> ('xsi \\<times> 'x set) set\"\nbegin\n\ncontext begin interpretation autoref_syn .\n\nlemma autoref_stack_empty[OF GEN_OP_D GEN_OP_D]:\n  assumes \"(el,[])\\<in>\\<langle>vrel\\<rangle>lrel\"\n  assumes \"(es,{})\\<in>\\<langle>vrel\\<rangle>srel\"\n  shows \"((el,es),[]) \\<in> \\<langle>vrel\\<rangle>stack_rel lrel srel\"\n  using assms unfolding stack_rel_def\n  by auto\n\n\nprimrec stack_push::\"_::type\" \n  where \"stack_push push ins (el,es) v = (push el v, ins v es)\"\n\n\n\n\nlemma autoref_stack_sng:\n  assumes \"GEN_OP lsng op_list_singleton (vrel \\<rightarrow> \\<langle>vrel\\<rangle>lrel)\"\n  assumes \"GEN_OP sins insert (vrel \\<rightarrow> \\<langle>vrel\\<rangle>srel \\<rightarrow> \\<langle>vrel\\<rangle>srel)\"\n  assumes \"GEN_OP semp {} (\\<langle>vrel\\<rangle>srel)\"\n  shows \"(\\<lambda>v. (lsng v, sins v semp),op_list_singleton) \n    \\<in> vrel \\<rightarrow> \\<langle>vrel\\<rangle>stack_rel lrel srel\"\n  using assms\n  unfolding stack_rel_def autoref_tag_defs\n  by (fastforce simp: op_list_singleton_def[abs_def] dest: fun_relD)\n  \nprimrec stack_pop::\"_::type\" \n  where \"stack_pop lpop ltop del (el,es) \n    = (let v = ltop el; el = lpop el; es = del v es in (el,es))\"\n\nlemma autoref_stack_pop:\n  assumes POPR: \"\\<And>el l. \\<lbrakk> (el,l)\\<in>\\<langle>vrel\\<rangle>lrel; l\\<noteq>[] \\<rbrakk> \n    \\<Longrightarrow> (lpop el,(OP butlast ::: \\<langle>vrel\\<rangle>lrel \\<rightarrow> \\<langle>vrel\\<rangle>lrel)$l)\\<in> \\<langle>vrel\\<rangle>lrel\"\n  assumes TOPR: \"\\<And>el l. \\<lbrakk> (el,l)\\<in>\\<langle>vrel\\<rangle>lrel; l\\<noteq>[] \\<rbrakk> \n    \\<Longrightarrow> (ltop el,(OP last ::: \\<langle>vrel\\<rangle>lrel \\<rightarrow> vrel)$l)\\<in> vrel\"\n  assumes DELR: \"GEN_OP del op_set_delete (vrel \\<rightarrow> \\<langle>vrel\\<rangle>srel \\<rightarrow> \\<langle>vrel\\<rangle>srel)\"\n  assumes NE: \"SIDE_PRECOND (l \\<noteq> [])\"\n  assumes R: \"(si,l)\\<in>\\<langle>vrel\\<rangle>stack_rel lrel srel\"\n  shows \"(stack_pop lpop ltop del si,\n    (OP butlast ::: \\<langle>vrel\\<rangle>stack_rel lrel srel \\<rightarrow> \\<langle>vrel\\<rangle>stack_rel lrel srel)\n      $l) \\<in> \\<langle>vrel\\<rangle>stack_rel lrel srel\"\nproof -\n  note POPR TOPR DELR\n  note [param] = this[unfolded autoref_tag_defs]\n\n  have AUX: \"set (butlast l) = op_set_delete (last l) (set l)\"\n    using NE R unfolding stack_rel_def \n    by (cases l rule: rev_cases) auto\n\n  show ?thesis\n    using NE R unfolding stack_rel_def autoref_tag_defs\n    apply (clarsimp simp: distinct_butlast, intro conjI)\n    apply parametricity\n    apply (subst AUX)\n    apply parametricity\n    done\nqed\n\nlemma autoref_stack_set: \n  shows \"(snd, set) \\<in> \\<langle>vrel\\<rangle>stack_rel lrel srel \\<rightarrow> \\<langle>vrel\\<rangle>srel\"\n  unfolding stack_rel_def\n  by auto\n\nlemma autoref_stack_is_Nil: \n  assumes \"GEN_OP ini is_Nil (\\<langle>vrel\\<rangle>lrel \\<rightarrow> bool_rel)\"\n  shows \"(ini o fst, is_Nil) \\<in> \\<langle>vrel\\<rangle>stack_rel lrel srel \\<rightarrow> bool_rel\"\n  using assms unfolding stack_rel_def\n  by (auto dest: fun_relD)\n\nlemma autoref_stack_ltop: \n  assumes TOPR: \"\\<And>el l. \\<lbrakk> (el,l)\\<in>\\<langle>vrel\\<rangle>lrel; l\\<noteq>[] \\<rbrakk> \n    \\<Longrightarrow> (ltop el,(OP last ::: \\<langle>vrel\\<rangle>lrel \\<rightarrow> vrel)$l)\\<in> vrel\"\n  assumes NE: \"SIDE_PRECOND (l \\<noteq> [])\"\n  assumes R: \"(si,l)\\<in>\\<langle>vrel\\<rangle>stack_rel lrel srel\"\n  shows \"(ltop (fst si), (OP last ::: \\<langle>vrel\\<rangle>stack_rel lrel srel \\<rightarrow> vrel)$l) \\<in> vrel\"\n  using assms unfolding stack_rel_def\n  by (auto dest: fun_relD)\n\nlemmas stack_autoref_rules \n  = autoref_stack_empty autoref_stack_push autoref_stack_sng autoref_stack_pop\n    autoref_stack_set autoref_stack_is_Nil autoref_stack_ltop\n\nend\n\nend\n\nabbreviation \"as_ahs_stack_rel \\<equiv> stack_rel as_rel dflt_ahs_rel\"\nlemmas as_ahs_stack_rules \n  = stack_autoref_rules[where lrel = as_rel and srel = dflt_ahs_rel]\n\n\nschematic_goal \n  notes [autoref_rules] = as_ahs_stack_rules\n  shows \"(?c::?'c, set (butlast ([1::nat]@[2]))) \\<in> ?R\"\n  apply (autoref (trace,keep_goal))\n  done\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/DFS_Framework/Misc/On_Stack.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3160424181481997}}
{"text": "(*  Title:      HOL/TLA/Memory/ProcedureInterface.thy\n    Author:     Stephan Merz, University of Munich\n*)\n\nsection {* Procedure interface for RPC-Memory components *}\n\ntheory ProcedureInterface\nimports \"../TLA\" RPCMemoryParams\nbegin\n\ntypedecl ('a,'r) chan\n  (* type of channels with argument type 'a and return type 'r.\n     we model a channel as an array of variables (of type chan)\n     rather than a single array-valued variable because the\n     notation gets a little simpler.\n  *)\ntype_synonym ('a,'r) channel =\" (PrIds => ('a,'r) chan) stfun\"\n\nconsts\n  (* data-level functions *)\n  cbit          :: \"('a,'r) chan => bit\"\n  rbit          :: \"('a,'r) chan => bit\"\n  arg           :: \"('a,'r) chan => 'a\"\n  res           :: \"('a,'r) chan => 'r\"\n\n  (* state functions *)\n  caller        :: \"('a,'r) channel => (PrIds => (bit * 'a)) stfun\"\n  rtrner        :: \"('a,'r) channel => (PrIds => (bit * 'r)) stfun\"\n\n  (* state predicates *)\n  Calling   :: \"('a,'r) channel => PrIds => stpred\"\n\n  (* actions *)\n  ACall      :: \"('a,'r) channel => PrIds => 'a stfun => action\"\n  AReturn    :: \"('a,'r) channel => PrIds => 'r stfun => action\"\n\n  (* temporal formulas *)\n  PLegalCaller      :: \"('a,'r) channel => PrIds => temporal\"\n  LegalCaller       :: \"('a,'r) channel => temporal\"\n  PLegalReturner    :: \"('a,'r) channel => PrIds => temporal\"\n  LegalReturner     :: \"('a,'r) channel => temporal\"\n\n  (* slice through array-valued state function *)\n  slice        :: \"('a => 'b) stfun => 'a => 'b stfun\"\n\nsyntax\n  \"_slice\"    :: \"[lift, 'a] => lift\"      (\"(_!_)\" [70,70] 70)\n\n  \"_Call\"     :: \"['a, 'b, lift] => lift\"    (\"(Call _ _ _)\" [90,90,90] 90)\n  \"_Return\"   :: \"['a, 'b, lift] => lift\"    (\"(Return _ _ _)\" [90,90,90] 90)\n\ntranslations\n  \"_slice\"  ==  \"CONST slice\"\n\n  \"_Call\"   ==  \"CONST ACall\"\n  \"_Return\" ==  \"CONST AReturn\"\n\ndefs\n  slice_def:     \"(PRED (x!i)) s == x s i\"\n\n  caller_def:    \"caller ch   == %s p. (cbit (ch s p), arg (ch s p))\"\n  rtrner_def:    \"rtrner ch   == %s p. (rbit (ch s p), res (ch s p))\"\n\n  Calling_def:   \"Calling ch p  == PRED cbit< ch!p > ~= rbit< ch!p >\"\n  Call_def:      \"(ACT Call ch p v)   == ACT  ~ $Calling ch p\n                                     & (cbit<ch!p>$ ~= $rbit<ch!p>)\n                                     & (arg<ch!p>$ = $v)\"\n  Return_def:    \"(ACT Return ch p v) == ACT  $Calling ch p\n                                     & (rbit<ch!p>$ = $cbit<ch!p>)\n                                     & (res<ch!p>$ = $v)\"\n  PLegalCaller_def:      \"PLegalCaller ch p == TEMP\n                             Init(~ Calling ch p)\n                             & [][ ? a. Call ch p a ]_((caller ch)!p)\"\n  LegalCaller_def:       \"LegalCaller ch == TEMP (! p. PLegalCaller ch p)\"\n  PLegalReturner_def:    \"PLegalReturner ch p == TEMP\n                                [][ ? v. Return ch p v ]_((rtrner ch)!p)\"\n  LegalReturner_def:     \"LegalReturner ch == TEMP (! p. PLegalReturner ch p)\"\n\ndeclare slice_def [simp]\n\nlemmas Procedure_defs = caller_def rtrner_def Calling_def Call_def Return_def\n  PLegalCaller_def LegalCaller_def PLegalReturner_def LegalReturner_def\n\n(* Calls and returns change their subchannel *)\nlemma Call_changed: \"|- Call ch p v --> <Call ch p v>_((caller ch)!p)\"\n  by (auto simp: angle_def Call_def caller_def Calling_def)\n\nlemma Return_changed: \"|- Return ch p v --> <Return ch p v>_((rtrner ch)!p)\"\n  by (auto simp: angle_def Return_def rtrner_def Calling_def)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/TLA/Memory/ProcedureInterface.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3160270463246756}}
{"text": "(*  Title:      HOL/Auth/Yahalom_Bad.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n*)\n\nsection\\<open>The Yahalom Protocol: A Flawed Version\\<close>\n\ntheory Yahalom_Bad imports Public begin\n\ntext\\<open>\nDemonstrates of why Oops is necessary.  This protocol can be attacked because\nit doesn't keep NB secret, but without Oops it can be \"verified\" anyway.\nThe issues are discussed in lcp's LICS 2000 invited lecture.\n\\<close>\n\ninductive_set yahalom :: \"event list set\"\n  where\n         (*Initial trace is empty*)\n   Nil:  \"[] \\<in> yahalom\"\n\n         (*The spy MAY say anything he CAN say.  We do not expect him to\n           invent new nonces here, but he can also use NS1.  Common to\n           all similar protocols.*)\n | Fake: \"\\<lbrakk>evsf \\<in> yahalom;  X \\<in> synth (analz (knows Spy evsf))\\<rbrakk>\n          \\<Longrightarrow> Says Spy B X  # evsf \\<in> yahalom\"\n\n         (*A message that has been sent can be received by the\n           intended recipient.*)\n | Reception: \"\\<lbrakk>evsr \\<in> yahalom;  Says A B X \\<in> set evsr\\<rbrakk>\n               \\<Longrightarrow> Gets B X # evsr \\<in> yahalom\"\n\n         (*Alice initiates a protocol run*)\n | YM1:  \"\\<lbrakk>evs1 \\<in> yahalom;  Nonce NA \\<notin> used evs1\\<rbrakk>\n          \\<Longrightarrow> Says A B \\<lbrace>Agent A, Nonce NA\\<rbrace> # evs1 \\<in> yahalom\"\n\n         (*Bob's response to Alice's message.*)\n | YM2:  \"\\<lbrakk>evs2 \\<in> yahalom;  Nonce NB \\<notin> used evs2;\n             Gets B \\<lbrace>Agent A, Nonce NA\\<rbrace> \\<in> set evs2\\<rbrakk>\n          \\<Longrightarrow> Says B Server\n                  \\<lbrace>Agent B, Nonce NB, Crypt (shrK B) \\<lbrace>Agent A, Nonce NA\\<rbrace>\\<rbrace>\n                # evs2 \\<in> yahalom\"\n\n         (*The Server receives Bob's message.  He responds by sending a\n            new session key to Alice, with a packet for forwarding to Bob.*)\n | YM3:  \"\\<lbrakk>evs3 \\<in> yahalom;  Key KAB \\<notin> used evs3;  KAB \\<in> symKeys;\n             Gets Server\n                  \\<lbrace>Agent B, Nonce NB, Crypt (shrK B) \\<lbrace>Agent A, Nonce NA\\<rbrace>\\<rbrace>\n               \\<in> set evs3\\<rbrakk>\n          \\<Longrightarrow> Says Server A\n                   \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key KAB, Nonce NA, Nonce NB\\<rbrace>,\n                     Crypt (shrK B) \\<lbrace>Agent A, Key KAB\\<rbrace>\\<rbrace>\n                # evs3 \\<in> yahalom\"\n\n         (*Alice receives the Server's (?) message, checks her Nonce, and\n           uses the new session key to send Bob his Nonce.  The premise\n           A \\<noteq> Server is needed to prove Says_Server_not_range.*)\n | YM4:  \"\\<lbrakk>evs4 \\<in> yahalom;  A \\<noteq> Server;  K \\<in> symKeys;\n             Gets A \\<lbrace>Crypt(shrK A) \\<lbrace>Agent B, Key K, Nonce NA, Nonce NB\\<rbrace>, X\\<rbrace>\n                \\<in> set evs4;\n             Says A B \\<lbrace>Agent A, Nonce NA\\<rbrace> \\<in> set evs4\\<rbrakk>\n          \\<Longrightarrow> Says A B \\<lbrace>X, Crypt K (Nonce NB)\\<rbrace> # evs4 \\<in> yahalom\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare parts.Body  [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\ndeclare analz_into_parts [dest]\n\n\ntext\\<open>A \"possibility property\": there are traces that reach the end\\<close>\nlemma \"\\<lbrakk>A \\<noteq> Server; Key K \\<notin> used []; K \\<in> symKeys\\<rbrakk> \n       \\<Longrightarrow> \\<exists>X NB. \\<exists>evs \\<in> yahalom.\n              Says A B \\<lbrace>X, Crypt K (Nonce NB)\\<rbrace> \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] yahalom.Nil\n                    [THEN yahalom.YM1, THEN yahalom.Reception,\n                     THEN yahalom.YM2, THEN yahalom.Reception,\n                     THEN yahalom.YM3, THEN yahalom.Reception,\n                     THEN yahalom.YM4])\napply (possibility, simp add: used_Cons) \ndone\n\nsubsection\\<open>Regularity Lemmas for Yahalom\\<close>\n\nlemma Gets_imp_Says:\n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> yahalom\\<rbrakk> \\<Longrightarrow> \\<exists>A. Says A B X \\<in> set evs\"\nby (erule rev_mp, erule yahalom.induct, auto)\n\n(*Must be proved separately for each protocol*)\nlemma Gets_imp_knows_Spy:\n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> yahalom\\<rbrakk>  \\<Longrightarrow> X \\<in> knows Spy evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\ndeclare Gets_imp_knows_Spy [THEN analz.Inj, dest]\n\n\nsubsection\\<open>For reasoning about the encrypted portion of messages\\<close>\n\ntext\\<open>Lets us treat YM4 using a similar argument as for the Fake case.\\<close>\nlemma YM4_analz_knows_Spy:\n     \"\\<lbrakk>Gets A \\<lbrace>Crypt (shrK A) Y, X\\<rbrace> \\<in> set evs;  evs \\<in> yahalom\\<rbrakk>\n      \\<Longrightarrow> X \\<in> analz (knows Spy evs)\"\nby blast\n\nlemmas YM4_parts_knows_Spy =\n       YM4_analz_knows_Spy [THEN analz_into_parts]\n\n\ntext\\<open>Theorems of the form \\<^term>\\<open>X \\<notin> parts (knows Spy evs)\\<close> imply \n            that NOBODY sends messages containing X!\\<close>\n\ntext\\<open>Spy never sees a good agent's shared key!\\<close>\nlemma Spy_see_shrK [simp]:\n     \"evs \\<in> yahalom \\<Longrightarrow> (Key (shrK A) \\<in> parts (knows Spy evs)) = (A \\<in> bad)\"\napply (erule yahalom.induct, force,\n       drule_tac [6] YM4_parts_knows_Spy, simp_all, blast+)\ndone\n\nlemma Spy_analz_shrK [simp]:\n     \"evs \\<in> yahalom \\<Longrightarrow> (Key (shrK A) \\<in> analz (knows Spy evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"\\<lbrakk>Key (shrK A) \\<in> parts (knows Spy evs);  evs \\<in> yahalom\\<rbrakk> \\<Longrightarrow> A \\<in> bad\"\nby (blast dest: Spy_see_shrK)\n\ntext\\<open>Nobody can have used non-existent keys!\n    Needed to apply \\<open>analz_insert_Key\\<close>\\<close>\nlemma new_keys_not_used [simp]:\n    \"\\<lbrakk>Key K \\<notin> used evs; K \\<in> symKeys; evs \\<in> yahalom\\<rbrakk>\n     \\<Longrightarrow> K \\<notin> keysFor (parts (spies evs))\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n       frule_tac [6] YM4_parts_knows_Spy, simp_all)\ntxt\\<open>Fake\\<close>\napply (force dest!: keysFor_parts_insert, auto)\ndone\n\n\nsubsection\\<open>Secrecy Theorems\\<close>\n\n(****\n The following is to prove theorems of the form\n\n  Key K \\<in> analz (insert (Key KAB) (knows Spy evs)) \\<Longrightarrow>\n  Key K \\<in> analz (knows Spy evs)\n\n A more general formula must be proved inductively.\n****)\n\nsubsection\\<open>Session keys are not used to encrypt other session keys\\<close>\n\nlemma analz_image_freshK [rule_format]:\n \"evs \\<in> yahalom \\<Longrightarrow>\n   \\<forall>K KK. KK \\<subseteq> - (range shrK) \\<longrightarrow>\n          (Key K \\<in> analz (Key`KK \\<union> (knows Spy evs))) =\n          (K \\<in> KK | Key K \\<in> analz (knows Spy evs))\"\nby (erule yahalom.induct, \n    drule_tac [7] YM4_analz_knows_Spy, analz_freshK, spy_analz, blast) \n\nlemma analz_insert_freshK:\n     \"\\<lbrakk>evs \\<in> yahalom;  KAB \\<notin> range shrK\\<rbrakk> \\<Longrightarrow>\n      (Key K \\<in> analz (insert (Key KAB) (knows Spy evs))) =\n      (K = KAB | Key K \\<in> analz (knows Spy evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\n\ntext\\<open>The Key K uniquely identifies the Server's  message.\\<close>\nlemma unique_session_keys:\n     \"\\<lbrakk>Says Server A\n          \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace>, X\\<rbrace> \\<in> set evs;\n        Says Server A'\n          \\<lbrace>Crypt (shrK A') \\<lbrace>Agent B', Key K, na', nb'\\<rbrace>, X'\\<rbrace> \\<in> set evs;\n        evs \\<in> yahalom\\<rbrakk>\n     \\<Longrightarrow> A=A' \\<and> B=B' \\<and> na=na' \\<and> nb=nb'\"\napply (erule rev_mp, erule rev_mp)\napply (erule yahalom.induct, simp_all)\ntxt\\<open>YM3, by freshness, and YM4\\<close>\napply blast+\ndone\n\n\ntext\\<open>Crucial secrecy property: Spy does not see the keys sent in msg YM3\\<close>\nlemma secrecy_lemma:\n     \"\\<lbrakk>A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom\\<rbrakk>\n      \\<Longrightarrow> Says Server A\n            \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace>,\n              Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n           \\<in> set evs \\<longrightarrow>\n          Key K \\<notin> analz (knows Spy evs)\"\napply (erule yahalom.induct, force, drule_tac [6] YM4_analz_knows_Spy)\napply (simp_all add: pushes analz_insert_eq analz_insert_freshK, spy_analz)  (*Fake*)\napply (blast dest: unique_session_keys)  (*YM3*)\ndone\n\ntext\\<open>Final version\\<close>\nlemma Spy_not_see_encrypted_key:\n     \"\\<lbrakk>Says Server A\n            \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace>,\n              Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest: secrecy_lemma)\n\n\nsubsection\\<open>Security Guarantee for A upon receiving YM3\\<close>\n\ntext\\<open>If the encrypted message appears then it originated with the Server\\<close>\nlemma A_trusts_YM3:\n     \"\\<lbrakk>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace> \\<in> parts (knows Spy evs);\n         A \\<notin> bad;  evs \\<in> yahalom\\<rbrakk>\n       \\<Longrightarrow> Says Server A\n            \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace>,\n              Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n           \\<in> set evs\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n       frule_tac [6] YM4_parts_knows_Spy, simp_all)\ntxt\\<open>Fake, YM3\\<close>\napply blast+\ndone\n\ntext\\<open>The obvious combination of \\<open>A_trusts_YM3\\<close> with\n  \\<open>Spy_not_see_encrypted_key\\<close>\\<close>\nlemma A_gets_good_key:\n     \"\\<lbrakk>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace> \\<in> parts (knows Spy evs);\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest!: A_trusts_YM3 Spy_not_see_encrypted_key)\n\nsubsection\\<open>Security Guarantees for B upon receiving YM4\\<close>\n\ntext\\<open>B knows, by the first part of A's message, that the Server distributed\n  the key for A and B.  But this part says nothing about nonces.\\<close>\nlemma B_trusts_YM4_shrK:\n     \"\\<lbrakk>Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace> \\<in> parts (knows Spy evs);\n         B \\<notin> bad;  evs \\<in> yahalom\\<rbrakk>\n      \\<Longrightarrow> \\<exists>NA NB. Says Server A\n                      \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, Nonce NA, Nonce NB\\<rbrace>,\n                        Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n                     \\<in> set evs\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n       frule_tac [6] YM4_parts_knows_Spy, simp_all)\ntxt\\<open>Fake, YM3\\<close>\napply blast+\ndone\n\nsubsection\\<open>The Flaw in the Model\\<close>\n\ntext\\<open>Up to now, the reasoning is similar to standard Yahalom.  Now the\n    doubtful reasoning occurs.  We should not be assuming that an unknown\n    key is secure, but the model allows us to: there is no Oops rule to\n    let session keys become compromised.\\<close>\n\ntext\\<open>B knows, by the second part of A's message, that the Server distributed\n  the key quoting nonce NB.  This part says nothing about agent names.\n  Secrecy of K is assumed; the valid Yahalom proof uses (and later proves)\n  the secrecy of NB.\\<close>\nlemma B_trusts_YM4_newK [rule_format]:\n     \"\\<lbrakk>Key K \\<notin> analz (knows Spy evs);  evs \\<in> yahalom\\<rbrakk>\n      \\<Longrightarrow> Crypt K (Nonce NB) \\<in> parts (knows Spy evs) \\<longrightarrow>\n          (\\<exists>A B NA. Says Server A\n                      \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K,\n                                Nonce NA, Nonce NB\\<rbrace>,\n                        Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n                     \\<in> set evs)\"\napply (erule rev_mp)\napply (erule yahalom.induct, force,\n       frule_tac [6] YM4_parts_knows_Spy)\napply (analz_mono_contra, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>YM3\\<close>\napply blast\ntxt\\<open>A is uncompromised because NB is secure\n  A's certificate guarantees the existence of the Server message\\<close>\napply (blast dest!: Gets_imp_Says Crypt_Spy_analz_bad\n             dest: Says_imp_spies\n                   parts.Inj [THEN parts.Fst, THEN A_trusts_YM3])\ndone\n\n\ntext\\<open>B's session key guarantee from YM4.  The two certificates contribute to a\n  single conclusion about the Server's message.\\<close>\nlemma B_trusts_YM4:\n     \"\\<lbrakk>Gets B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>,\n                  Crypt K (Nonce NB)\\<rbrace> \\<in> set evs;\n         Says B Server\n           \\<lbrace>Agent B, Nonce NB, Crypt (shrK B) \\<lbrace>Agent A, Nonce NA\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom\\<rbrakk>\n       \\<Longrightarrow> \\<exists>na nb. Says Server A\n                   \\<lbrace>Crypt (shrK A) \\<lbrace>Agent B, Key K, na, nb\\<rbrace>,\n                     Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>\\<rbrace>\n             \\<in> set evs\"\nby (blast dest: B_trusts_YM4_newK B_trusts_YM4_shrK Spy_not_see_encrypted_key\n                unique_session_keys)\n\n\ntext\\<open>The obvious combination of \\<open>B_trusts_YM4\\<close> with \n  \\<open>Spy_not_see_encrypted_key\\<close>\\<close>\nlemma B_gets_good_key:\n     \"\\<lbrakk>Gets B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>,\n                  Crypt K (Nonce NB)\\<rbrace> \\<in> set evs;\n         Says B Server\n           \\<lbrace>Agent B, Nonce NB, Crypt (shrK B) \\<lbrace>Agent A, Nonce NA\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest!: B_trusts_YM4 Spy_not_see_encrypted_key)\n\n\n(*** Authenticating B to A: these proofs are not considered.\n     They are irrelevant to showing the need for Oops. ***)\n\n\n(*** Authenticating A to B using the certificate Crypt K (Nonce NB) ***)\n\ntext\\<open>Assuming the session key is secure, if both certificates are present then\n  A has said NB.  We can't be sure about the rest of A's message, but only\n  NB matters for freshness.\\<close>\nlemma A_Said_YM3_lemma [rule_format]:\n     \"evs \\<in> yahalom\n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs) \\<longrightarrow>\n          Crypt K (Nonce NB) \\<in> parts (knows Spy evs) \\<longrightarrow>\n          Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace> \\<in> parts (knows Spy evs) \\<longrightarrow>\n          B \\<notin> bad \\<longrightarrow>\n          (\\<exists>X. Says A B \\<lbrace>X, Crypt K (Nonce NB)\\<rbrace> \\<in> set evs)\"\napply (erule yahalom.induct, force,\n       frule_tac [6] YM4_parts_knows_Spy)\napply (analz_mono_contra, simp_all)\ntxt\\<open>Fake\\<close>\napply blast\ntxt\\<open>YM3: by \\<open>new_keys_not_used\\<close>, the message\n   \\<^term>\\<open>Crypt K (Nonce NB)\\<close> could not exist\\<close>\napply (force dest!: Crypt_imp_keysFor)\ntxt\\<open>YM4: was \\<^term>\\<open>Crypt K (Nonce NB)\\<close> the very last message?\n    If not, use the induction hypothesis\\<close>\napply (simp add: ex_disj_distrib)\ntxt\\<open>yes: apply unicity of session keys\\<close>\napply (blast dest!: Gets_imp_Says A_trusts_YM3 B_trusts_YM4_shrK\n                    Crypt_Spy_analz_bad\n             dest: Says_imp_knows_Spy [THEN parts.Inj] unique_session_keys)\ndone\n\ntext\\<open>If B receives YM4 then A has used nonce NB (and therefore is alive).\n  Moreover, A associates K with NB (thus is talking about the same run).\n  Other premises guarantee secrecy of K.\\<close>\nlemma YM4_imp_A_Said_YM3 [rule_format]:\n     \"\\<lbrakk>Gets B \\<lbrace>Crypt (shrK B) \\<lbrace>Agent A, Key K\\<rbrace>,\n                  Crypt K (Nonce NB)\\<rbrace> \\<in> set evs;\n         Says B Server\n           \\<lbrace>Agent B, Nonce NB, Crypt (shrK B) \\<lbrace>Agent A, Nonce NA\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> yahalom\\<rbrakk>\n      \\<Longrightarrow> \\<exists>X. Says A B \\<lbrace>X, Crypt K (Nonce NB)\\<rbrace> \\<in> set evs\"\nby (blast intro!: A_Said_YM3_lemma\n          dest: Spy_not_see_encrypted_key B_trusts_YM4 Gets_imp_Says)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/Yahalom_Bad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3160270463246756}}
{"text": "(*  Title:      HOL/HOLCF/IOA/RefCorrectness.thy\n    Author:     Olaf Müller\n*)\n\nsection \\<open>Correctness of Refinement Mappings in HOLCF/IOA\\<close>\n\ntheory RefCorrectness\nimports RefMappings\nbegin\n\ndefinition corresp_exC ::\n    \"('a, 's2) ioa \\<Rightarrow> ('s1 \\<Rightarrow> 's2) \\<Rightarrow> ('a, 's1) pairs \\<rightarrow> ('s1 \\<Rightarrow> ('a, 's2) pairs)\"\n  where \"corresp_exC A f =\n    (fix \\<cdot>\n      (LAM h ex.\n        (\\<lambda>s. case ex of\n          nil \\<Rightarrow> nil\n        | x ## xs \\<Rightarrow>\n            flift1 (\\<lambda>pr.\n              (SOME cex. move A cex (f s) (fst pr) (f (snd pr))) @@ ((h \\<cdot> xs) (snd pr))) \\<cdot> x)))\"\n\ndefinition corresp_ex ::\n    \"('a, 's2) ioa \\<Rightarrow> ('s1 \\<Rightarrow> 's2) \\<Rightarrow> ('a, 's1) execution \\<Rightarrow> ('a, 's2) execution\"\n  where \"corresp_ex A f ex = (f (fst ex), (corresp_exC A f \\<cdot> (snd ex)) (fst ex))\"\n\ndefinition is_fair_ref_map ::\n    \"('s1 \\<Rightarrow> 's2) \\<Rightarrow> ('a, 's1) ioa \\<Rightarrow> ('a, 's2) ioa \\<Rightarrow> bool\"\n  where \"is_fair_ref_map f C A \\<longleftrightarrow>\n    is_ref_map f C A \\<and> (\\<forall>ex \\<in> executions C. fair_ex C ex \\<longrightarrow> fair_ex A (corresp_ex A f ex))\"\n\ntext \\<open>\n  Axioms for fair trace inclusion proof support, not for the correctness proof\n  of refinement mappings!\n\n  Note: Everything is superseded by \\<^file>\\<open>LiveIOA.thy\\<close>.\n\\<close>\n\naxiomatization where\n  corresp_laststate:\n    \"Finite ex \\<Longrightarrow> laststate (corresp_ex A f (s, ex)) = f (laststate (s, ex))\"\n\naxiomatization where\n  corresp_Finite: \"Finite (snd (corresp_ex A f (s, ex))) = Finite ex\"\n\naxiomatization where\n  FromAtoC:\n    \"fin_often (\\<lambda>x. P (snd x)) (snd (corresp_ex A f (s, ex))) \\<Longrightarrow>\n      fin_often (\\<lambda>y. P (f (snd y))) ex\"\n\naxiomatization where\n  FromCtoA:\n    \"inf_often (\\<lambda>y. P (fst y)) ex \\<Longrightarrow>\n      inf_often (\\<lambda>x. P (fst x)) (snd (corresp_ex A f (s,ex)))\"\n\n\ntext \\<open>\n  Proof by case on \\<open>inf W\\<close> in ex: If so, ok. If not, only \\<open>fin W\\<close> in ex, ie.\n  there is an index \\<open>i\\<close> from which on no \\<open>W\\<close> in ex. But \\<open>W\\<close> inf enabled, ie at\n  least once after \\<open>i\\<close> \\<open>W\\<close> is enabled. As \\<open>W\\<close> does not occur after \\<open>i\\<close> and \\<open>W\\<close>\n  is \\<open>enabling_persistent\\<close>, \\<open>W\\<close> keeps enabled until infinity, ie. indefinitely\n\\<close>\n\naxiomatization where\n  persistent:\n    \"inf_often (\\<lambda>x. Enabled A W (snd x)) ex \\<Longrightarrow> en_persistent A W \\<Longrightarrow>\n      inf_often (\\<lambda>x. fst x \\<in> W) ex \\<or> fin_often (\\<lambda>x. \\<not> Enabled A W (snd x)) ex\"\n\naxiomatization where\n  infpostcond:\n    \"is_exec_frag A (s,ex) \\<Longrightarrow> inf_often (\\<lambda>x. fst x \\<in> W) ex \\<Longrightarrow>\n      inf_often (\\<lambda>x. set_was_enabled A W (snd x)) ex\"\n\n\nsubsection \\<open>\\<open>corresp_ex\\<close>\\<close>\n\nlemma corresp_exC_unfold:\n  \"corresp_exC A f =\n    (LAM ex.\n      (\\<lambda>s.\n        case ex of\n          nil \\<Rightarrow> nil\n        | x ## xs \\<Rightarrow>\n            (flift1 (\\<lambda>pr.\n              (SOME cex. move A cex (f s) (fst pr) (f (snd pr))) @@\n              ((corresp_exC A f \\<cdot> xs) (snd pr))) \\<cdot> x)))\"\n  apply (rule trans)\n  apply (rule fix_eq2)\n  apply (simp only: corresp_exC_def)\n  apply (rule beta_cfun)\n  apply (simp add: flift1_def)\n  done\n\nlemma corresp_exC_UU: \"(corresp_exC A f \\<cdot> UU) s = UU\"\n  apply (subst corresp_exC_unfold)\n  apply simp\n  done\n\nlemma corresp_exC_nil: \"(corresp_exC A f \\<cdot> nil) s = nil\"\n  apply (subst corresp_exC_unfold)\n  apply simp\n  done\n\nlemma corresp_exC_cons:\n  \"(corresp_exC A f \\<cdot> (at \\<leadsto> xs)) s =\n     (SOME cex. move A cex (f s) (fst at) (f (snd at))) @@\n     ((corresp_exC A f \\<cdot> xs) (snd at))\"\n  apply (rule trans)\n  apply (subst corresp_exC_unfold)\n  apply (simp add: Consq_def flift1_def)\n  apply simp\n  done\n\ndeclare corresp_exC_UU [simp] corresp_exC_nil [simp] corresp_exC_cons [simp]\n\n\nsubsection \\<open>Properties of move\\<close>\n\nlemma move_is_move:\n  \"is_ref_map f C A \\<Longrightarrow> reachable C s \\<Longrightarrow> (s, a, t) \\<in> trans_of C \\<Longrightarrow>\n    move A (SOME x. move A x (f s) a (f t)) (f s) a (f t)\"\n  apply (unfold is_ref_map_def)\n  apply (subgoal_tac \"\\<exists>ex. move A ex (f s) a (f t) \")\n  prefer 2\n  apply simp\n  apply (erule exE)\n  apply (rule someI)\n  apply assumption\n  done\n\nlemma move_subprop1:\n  \"is_ref_map f C A \\<Longrightarrow> reachable C s \\<Longrightarrow> (s, a, t) \\<in> trans_of C \\<Longrightarrow>\n    is_exec_frag A (f s, SOME x. move A x (f s) a (f t))\"\n  apply (cut_tac move_is_move)\n  defer\n  apply assumption+\n  apply (simp add: move_def)\n  done\n\nlemma move_subprop2:\n  \"is_ref_map f C A \\<Longrightarrow> reachable C s \\<Longrightarrow> (s, a, t) \\<in> trans_of C \\<Longrightarrow>\n    Finite ((SOME x. move A x (f s) a (f t)))\"\n  apply (cut_tac move_is_move)\n  defer\n  apply assumption+\n  apply (simp add: move_def)\n  done\n\nlemma move_subprop3:\n  \"is_ref_map f C A \\<Longrightarrow> reachable C s \\<Longrightarrow> (s, a, t) \\<in> trans_of C \\<Longrightarrow>\n     laststate (f s, SOME x. move A x (f s) a (f t)) = (f t)\"\n  apply (cut_tac move_is_move)\n  defer\n  apply assumption+\n  apply (simp add: move_def)\n  done\n\nlemma move_subprop4:\n  \"is_ref_map f C A \\<Longrightarrow> reachable C s \\<Longrightarrow> (s, a, t) \\<in> trans_of C \\<Longrightarrow>\n    mk_trace A \\<cdot> ((SOME x. move A x (f s) a (f t))) =\n      (if a \\<in> ext A then a \\<leadsto> nil else nil)\"\n  apply (cut_tac move_is_move)\n  defer\n  apply assumption+\n  apply (simp add: move_def)\n  done\n\n\nsubsection \\<open>TRACE INCLUSION Part 1: Traces coincide\\<close>\n\nsubsubsection \\<open>Lemmata for \\<open>\\<Longleftarrow>\\<close>\\<close>\n\ntext \\<open>Lemma 1.1: Distribution of \\<open>mk_trace\\<close> and \\<open>@@\\<close>\\<close>\n\nlemma mk_traceConc:\n  \"mk_trace C \\<cdot> (ex1 @@ ex2) = (mk_trace C \\<cdot> ex1) @@ (mk_trace C \\<cdot> ex2)\"\n  by (simp add: mk_trace_def filter_act_def MapConc)\n\n\ntext \\<open>Lemma 1 : Traces coincide\\<close>\n\nlemma lemma_1:\n  \"is_ref_map f C A \\<Longrightarrow> ext C = ext A \\<Longrightarrow>\n    \\<forall>s. reachable C s \\<and> is_exec_frag C (s, xs) \\<longrightarrow>\n      mk_trace C \\<cdot> xs = mk_trace A \\<cdot> (snd (corresp_ex A f (s, xs)))\"\n  supply if_split [split del]\n  apply (unfold corresp_ex_def)\n  apply (pair_induct xs simp: is_exec_frag_def)\n  text \\<open>cons case\\<close>\n  apply (auto simp add: mk_traceConc)\n  apply (frule reachable.reachable_n)\n  apply assumption\n  apply (auto simp add: move_subprop4 split: if_split)\n  done\n\n\nsubsection \\<open>TRACE INCLUSION Part 2: corresp_ex is execution\\<close>\n\nsubsubsection \\<open>Lemmata for \\<open>==>\\<close>\\<close>\n\ntext \\<open>Lemma 2.1\\<close>\n\nlemma lemma_2_1 [rule_format]:\n  \"Finite xs \\<longrightarrow>\n    (\\<forall>s. is_exec_frag A (s, xs) \\<and> is_exec_frag A (t, ys) \\<and>\n      t = laststate (s, xs) \\<longrightarrow> is_exec_frag A (s, xs @@ ys))\"\n  apply (rule impI)\n  apply Seq_Finite_induct\n  text \\<open>main case\\<close>\n  apply (auto simp add: split_paired_all)\n  done\n\n\ntext \\<open>Lemma 2 : \\<open>corresp_ex\\<close> is execution\\<close>\n\nlemma lemma_2:\n  \"is_ref_map f C A \\<Longrightarrow>\n    \\<forall>s. reachable C s \\<and> is_exec_frag C (s, xs) \\<longrightarrow>\n      is_exec_frag A (corresp_ex A f (s, xs))\"\n  apply (unfold corresp_ex_def)\n\n  apply simp\n  apply (pair_induct xs simp: is_exec_frag_def)\n\n  text \\<open>main case\\<close>\n  apply auto\n  apply (rule_tac t = \"f x2\" in lemma_2_1)\n\n  text \\<open>\\<open>Finite\\<close>\\<close>\n  apply (erule move_subprop2)\n  apply assumption+\n  apply (rule conjI)\n\n  text \\<open>\\<open>is_exec_frag\\<close>\\<close>\n  apply (erule move_subprop1)\n  apply assumption+\n  apply (rule conjI)\n\n  text \\<open>Induction hypothesis\\<close>\n  text \\<open>\\<open>reachable_n\\<close> looping, therefore apply it manually\\<close>\n  apply (erule_tac x = \"x2\" in allE)\n  apply simp\n  apply (frule reachable.reachable_n)\n  apply assumption\n  apply simp\n\n  text \\<open>\\<open>laststate\\<close>\\<close>\n  apply (erule move_subprop3 [symmetric])\n  apply assumption+\n  done\n\n\nsubsection \\<open>Main Theorem: TRACE -- INCLUSION\\<close>\n\ntheorem trace_inclusion:\n  \"ext C = ext A \\<Longrightarrow> is_ref_map f C A \\<Longrightarrow> traces C \\<subseteq> traces A\"\n\n  apply (unfold traces_def)\n\n  apply (simp add: has_trace_def2)\n  apply auto\n\n  text \\<open>give execution of abstract automata\\<close>\n  apply (rule_tac x = \"corresp_ex A f ex\" in bexI)\n\n  text \\<open>Traces coincide, Lemma 1\\<close>\n  apply (pair ex)\n  apply (erule lemma_1 [THEN spec, THEN mp])\n  apply assumption+\n  apply (simp add: executions_def reachable.reachable_0)\n\n  text \\<open>\\<open>corresp_ex\\<close> is execution, Lemma 2\\<close>\n  apply (pair ex)\n  apply (simp add: executions_def)\n  text \\<open>start state\\<close>\n  apply (rule conjI)\n  apply (simp add: is_ref_map_def corresp_ex_def)\n  text \\<open>\\<open>is_execution_fragment\\<close>\\<close>\n  apply (erule lemma_2 [THEN spec, THEN mp])\n  apply (simp add: reachable.reachable_0)\n  done\n\n\nsubsection \\<open>Corollary:  FAIR TRACE -- INCLUSION\\<close>\n\nlemma fininf: \"(~inf_often P s) = fin_often P s\"\n  by (auto simp: fin_often_def)\n\nlemma WF_alt: \"is_wfair A W (s, ex) =\n  (fin_often (\\<lambda>x. \\<not> Enabled A W (snd x)) ex \\<longrightarrow> inf_often (\\<lambda>x. fst x \\<in> W) ex)\"\n  by (auto simp add: is_wfair_def fin_often_def)\n\nlemma WF_persistent:\n  \"is_wfair A W (s, ex) \\<Longrightarrow> inf_often (\\<lambda>x. Enabled A W (snd x)) ex \\<Longrightarrow>\n    en_persistent A W \\<Longrightarrow> inf_often (\\<lambda>x. fst x \\<in> W) ex\"\n  apply (drule persistent)\n  apply assumption\n  apply (simp add: WF_alt)\n  apply auto\n  done\n\nlemma fair_trace_inclusion:\n  assumes \"is_ref_map f C A\"\n    and \"ext C = ext A\"\n    and \"\\<And>ex. ex \\<in> executions C \\<Longrightarrow> fair_ex C ex \\<Longrightarrow>\n      fair_ex A (corresp_ex A f ex)\"\n  shows \"fairtraces C \\<subseteq> fairtraces A\"\n  apply (insert assms)\n  apply (simp add: fairtraces_def fairexecutions_def)\n  apply auto\n  apply (rule_tac x = \"corresp_ex A f ex\" in exI)\n  apply auto\n\n  text \\<open>Traces coincide, Lemma 1\\<close>\n  apply (pair ex)\n  apply (erule lemma_1 [THEN spec, THEN mp])\n  apply assumption+\n  apply (simp add: executions_def reachable.reachable_0)\n\n  text \\<open>\\<open>corresp_ex\\<close> is execution, Lemma 2\\<close>\n  apply (pair ex)\n  apply (simp add: executions_def)\n  text \\<open>start state\\<close>\n  apply (rule conjI)\n  apply (simp add: is_ref_map_def corresp_ex_def)\n  text \\<open>\\<open>is_execution_fragment\\<close>\\<close>\n  apply (erule lemma_2 [THEN spec, THEN mp])\n  apply (simp add: reachable.reachable_0)\n  done\n\nlemma fair_trace_inclusion2:\n  \"inp C = inp A \\<Longrightarrow> out C = out A \\<Longrightarrow> is_fair_ref_map f C A \\<Longrightarrow>\n    fair_implements C A\"\n  apply (simp add: is_fair_ref_map_def fair_implements_def fairtraces_def fairexecutions_def)\n  apply auto\n  apply (rule_tac x = \"corresp_ex A f ex\" in exI)\n  apply auto\n\n  text \\<open>Traces coincide, Lemma 1\\<close>\n  apply (pair ex)\n  apply (erule lemma_1 [THEN spec, THEN mp])\n  apply (simp (no_asm) add: externals_def)\n  apply (auto)[1]\n  apply (simp add: executions_def reachable.reachable_0)\n\n  text \\<open>\\<open>corresp_ex\\<close> is execution, Lemma 2\\<close>\n  apply (pair ex)\n  apply (simp add: executions_def)\n  text \\<open>start state\\<close>\n  apply (rule conjI)\n  apply (simp add: is_ref_map_def corresp_ex_def)\n  text \\<open>\\<open>is_execution_fragment\\<close>\\<close>\n  apply (erule lemma_2 [THEN spec, THEN mp])\n  apply (simp add: reachable.reachable_0)\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/RefCorrectness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307806984445, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.31602703948754085}}
{"text": "(*  Title:      Containers/Mapping_Impl.thy\n    Author:     Andreas Lochbihler, KIT\n                René Thiemann, UIBK *)\n\ntheory Mapping_Impl imports \n  RBT_Mapping2\n  AssocList\n  \"HOL-Library.Mapping\"\n  Set_Impl\n  Containers_Generator\nbegin\n\nsection \\<open>Different implementations of maps\\<close>\n\ncode_identifier\n  code_module Mapping \\<rightharpoonup> (SML) Mapping_Impl\n| code_module Mapping_Impl \\<rightharpoonup> (SML) Mapping_Impl\n\nsubsection \\<open>Map implementations\\<close>\n\ndefinition Assoc_List_Mapping :: \"('a, 'b) alist \\<Rightarrow> ('a, 'b) mapping\"\nwhere [simp]: \"Assoc_List_Mapping al = Mapping.Mapping (DAList.lookup al)\"\n\ndefinition RBT_Mapping :: \"('a :: ccompare, 'b) mapping_rbt \\<Rightarrow> ('a, 'b) mapping\"\nwhere [simp]: \"RBT_Mapping t = Mapping.Mapping (RBT_Mapping2.lookup t)\"\n\ncode_datatype Assoc_List_Mapping RBT_Mapping Mapping\n\nsubsection \\<open>Map operations\\<close>\n\ndeclare [[code drop: Mapping.lookup]]\n\nlemma lookup_Mapping_code [code]:\n  \"Mapping.lookup (Assoc_List_Mapping al) = DAList.lookup al\"\n  \"Mapping.lookup (RBT_Mapping t) = RBT_Mapping2.lookup t\"\nby(simp_all)(transfer, rule)+\n\ndeclare [[code drop: Mapping.is_empty]]\n\nlemma is_empty_transfer [transfer_rule]:\n  includes lifting_syntax\n  shows \"(pcr_mapping (=) (=) ===> (=)) (\\<lambda>m. m = Map.empty) Mapping.is_empty\"\nunfolding mapping.pcr_cr_eq\napply(rule rel_funI)\napply(case_tac y)\napply(simp add: Mapping.is_empty_def cr_mapping_def Mapping_inverse Mapping.keys.rep_eq)\ndone\n\nlemma is_empty_Mapping [code]:\n  fixes t :: \"('a :: ccompare, 'b) mapping_rbt\" shows\n  \"Mapping.is_empty (Assoc_List_Mapping al) \\<longleftrightarrow> al = DAList.empty\"\n  \"Mapping.is_empty (RBT_Mapping t) \\<longleftrightarrow>\n  (case ID CCOMPARE('a) of None \\<Rightarrow> Code.abort (STR ''is_empty RBT_Mapping: ccompare = None'') (\\<lambda>_. Mapping.is_empty (RBT_Mapping t))\n                     | Some _ \\<Rightarrow> RBT_Mapping2.is_empty t)\"\napply(simp_all split: option.split)\n apply(transfer, case_tac al, simp_all)\napply(transfer, simp)\ndone\n\ndeclare [[code drop: Mapping.update]]\n\nlemma update_Mapping [code]:\n  fixes t :: \"('a :: ccompare, 'b) mapping_rbt\" shows\n  \"Mapping.update k v (Mapping m) = Mapping (m(k \\<mapsto> v))\"\n  \"Mapping.update k v (Assoc_List_Mapping al) = Assoc_List_Mapping (DAList.update k v al)\"\n  \"Mapping.update k v (RBT_Mapping t) =\n  (case ID CCOMPARE('a) of None \\<Rightarrow> Code.abort (STR ''update RBT_Mapping: ccompare = None'') (\\<lambda>_. Mapping.update k v (RBT_Mapping t))\n                     | Some _ \\<Rightarrow> RBT_Mapping (RBT_Mapping2.insert k v t))\" (is ?RBT)\nby(simp_all split: option.split)(transfer, simp)+\n\ndeclare [[code drop: Mapping.delete]]\n\nlemma delete_Mapping [code]:\n  fixes t :: \"('a :: ccompare, 'b) mapping_rbt\" shows\n  \"Mapping.delete k (Mapping m) = Mapping (m(k := None))\"\n  \"Mapping.delete k (Assoc_List_Mapping al) = Assoc_List_Mapping (AssocList.delete k al)\"\n  \"Mapping.delete k (RBT_Mapping t) = \n  (case ID CCOMPARE('a) of None \\<Rightarrow> Code.abort (STR ''delete RBT_Mapping: ccompare = None'') (\\<lambda>_. Mapping.delete k (RBT_Mapping t))\n                     | Some _ \\<Rightarrow> RBT_Mapping (RBT_Mapping2.delete k t))\"\nby(simp_all split: option.split)(transfer, simp)+\n\ndeclare [[code drop: Mapping.keys]]\n\ntheorem rbt_comp_lookup_map_const: \"rbt_comp_lookup c (RBT_Impl.map (\\<lambda>_. f) t) = map_option f \\<circ> rbt_comp_lookup c t\"\nby(induct t)(auto simp: fun_eq_iff split: order.split)\n\nlemma keys_Mapping [code]:\n  fixes t :: \"('a :: ccompare, 'b) mapping_rbt\" shows\n  \"Mapping.keys (Mapping m) = Collect (\\<lambda>k. m k \\<noteq> None)\" (is \"?Mapping\")\n  \"Mapping.keys (Assoc_List_Mapping al) = AssocList.keys al\" (is \"?Assoc_List\")\n  \"Mapping.keys (RBT_Mapping t) = RBT_set (RBT_Mapping2.map (\\<lambda>_ _. ()) t)\" (is \"?RBT\")\nproof -\n  show ?Mapping by transfer auto\n  show ?Assoc_List by simp(transfer, auto intro: rev_image_eqI)\n  show ?RBT\n    by(simp add: RBT_set_def, transfer, auto simp add: rbt_comp_lookup_map_const o_def)\nqed\n\ndeclare [[code drop: Mapping.size]]\n\nlemma Mapping_size_transfer [transfer_rule]:\n  includes lifting_syntax\n  shows \"(pcr_mapping (=) (=) ===> (=)) (card \\<circ> dom) Mapping.size\"\napply(rule rel_funI)\napply(case_tac y)\napply(simp add: Mapping.size_def Mapping.keys.rep_eq Mapping_inverse mapping.pcr_cr_eq cr_mapping_def)\ndone\n\nlemma size_Mapping [code]:\n  fixes t :: \"('a :: ccompare, 'b) mapping_rbt\" shows\n  \"Mapping.size (Assoc_List_Mapping al) = size al\"\n  \"Mapping.size (RBT_Mapping t) =\n  (case ID CCOMPARE('a) of None \\<Rightarrow> Code.abort (STR ''size RBT_Mapping: ccompare = None'') (\\<lambda>_. Mapping.size (RBT_Mapping t))\n                     | Some _ \\<Rightarrow> length (RBT_Mapping2.entries t))\"\napply(simp_all split: option.split)\napply(transfer, simp add: dom_map_of_conv_image_fst set_map[symmetric] distinct_card del: set_map)\napply transfer\napply(clarsimp simp add: size_eq_card_dom_lookup)\napply(simp add: linorder.rbt_lookup_keys[OF ID_ccompare] ord.is_rbt_rbt_sorted RBT_Impl.keys_def distinct_card linorder.distinct_entries[OF ID_ccompare] del: set_map)\ndone\n\n\ndeclare [[code drop: Mapping.tabulate]]\ndeclare tabulate_fold [code]\n\ndatatype mapping_impl = Mapping_IMPL\ndeclare\n  mapping_impl.eq.simps [code del]\n  mapping_impl.rec [code del]\n  mapping_impl.case [code del]\n\n\n\ndefinition mapping_Choose :: mapping_impl where [simp]: \"mapping_Choose = Mapping_IMPL\"\ndefinition mapping_Assoc_List :: mapping_impl where [simp]: \"mapping_Assoc_List = Mapping_IMPL\"\ndefinition mapping_RBT :: mapping_impl where [simp]: \"mapping_RBT = Mapping_IMPL\"\ndefinition mapping_Mapping :: mapping_impl where [simp]: \"mapping_Mapping = Mapping_IMPL\"\n\ncode_datatype mapping_Choose mapping_Assoc_List mapping_RBT mapping_Mapping\n\ndefinition mapping_empty_choose :: \"('a, 'b) mapping\" \nwhere [simp]: \"mapping_empty_choose = Mapping.empty\"\n\nlemma mapping_empty_choose_code [code]:\n  \"(mapping_empty_choose :: ('a :: ccompare, 'b) mapping) =\n   (case ID CCOMPARE('a) of Some _  \\<Rightarrow> RBT_Mapping RBT_Mapping2.empty\n    | None \\<Rightarrow> Assoc_List_Mapping DAList.empty)\"\nby(auto split: option.split simp add: DAList.lookup_empty[abs_def] Mapping.empty_def)\n\ndefinition mapping_impl_choose2 :: \"mapping_impl \\<Rightarrow> mapping_impl \\<Rightarrow> mapping_impl\"\nwhere [simp]: \"mapping_impl_choose2 = (\\<lambda>_ _. Mapping_IMPL)\"\n\nlemma mapping_impl_choose2_code [code]:\n  \"mapping_impl_choose2 x y = mapping_Choose\"\n  \"mapping_impl_choose2 mapping_Mapping mapping_Mapping = mapping_Mapping\"\n  \"mapping_impl_choose2 mapping_Assoc_List mapping_Assoc_List = mapping_Assoc_List\"\n  \"mapping_impl_choose2 mapping_RBT mapping_RBT = mapping_RBT\"\nby(simp_all)\n\ndefinition mapping_empty :: \"mapping_impl \\<Rightarrow> ('a, 'b) mapping\"\nwhere [simp]: \"mapping_empty = (\\<lambda>_. Mapping.empty)\"\n\nlemma mapping_empty_code [code]:\n  \"mapping_empty mapping_Choose = mapping_empty_choose\"\n  \"mapping_empty mapping_Mapping = Mapping (\\<lambda>_. None)\"\n  \"mapping_empty mapping_Assoc_List = Assoc_List_Mapping DAList.empty\"\n  \"mapping_empty mapping_RBT = RBT_Mapping RBT_Mapping2.empty\"\nby(simp_all add: Mapping.empty_def DAList.lookup_empty[abs_def])\n\nsubsection \\<open>Type classes\\<close>\n\nclass mapping_impl = \n  fixes mapping_impl :: \"('a, mapping_impl) phantom\"\n\nsyntax (input)\n  \"_MAPPING_IMPL\" :: \"type => logic\"  (\"(1MAPPING'_IMPL/(1'(_')))\")\n\nparse_translation \\<open>\nlet\n  fun mapping_impl_tr [ty] =\n     (Syntax.const @{syntax_const \"_constrain\"} $ Syntax.const @{const_syntax \"mapping_impl\"} $\n       (Syntax.const @{type_syntax phantom} $ ty $ Syntax.const @{type_syntax mapping_impl}))\n    | mapping_impl_tr ts = raise TERM (\"mapping_impl_tr\", ts);\nin [(@{syntax_const \"_MAPPING_IMPL\"}, K mapping_impl_tr)] end\n\\<close>\n\ndeclare [[code drop: Mapping.empty]]\n\nlemma Mapping_empty_code [code, code_unfold]: \n  \"(Mapping.empty :: ('a :: mapping_impl, 'b) mapping) =\n   mapping_empty (of_phantom MAPPING_IMPL('a))\"\nby simp\n\nsubsection \\<open>Generator for the @{class mapping_impl}-class\\<close>\n\ntext \\<open>\nThis generator registers itself at the derive-manager for the classes @{class mapping_impl}.\nHere, one can choose\nthe desired implementation via the parameter. \n\n\\begin{itemize}\n\\item \\texttt{instantiation type :: (type,\\ldots,type) (rbt,assoclist,mapping,choose, or arbitrary constant name) mapping-impl}\n\\end{itemize}\n\\<close>\n\n\ntext \\<open>\nThis generator can be used for arbitrary types, not just datatypes. \n\\<close>\n\nML_file \\<open>mapping_impl_generator.ML\\<close> \n\nderive (assoclist) mapping_impl unit bool\nderive (rbt) mapping_impl nat\nderive (mapping_RBT) mapping_impl int (* shows usage of constant names *)\nderive (assoclist) mapping_impl Enum.finite_1 Enum.finite_2 Enum.finite_3\nderive (rbt) mapping_impl integer natural\nderive (rbt) mapping_impl char\n\ninstantiation sum :: (mapping_impl, mapping_impl) mapping_impl begin\ndefinition \"MAPPING_IMPL('a + 'b) = Phantom('a + 'b) \n  (mapping_impl_choose2 (of_phantom MAPPING_IMPL('a)) (of_phantom MAPPING_IMPL('b)))\"\ninstance ..\nend\n\ninstantiation prod :: (mapping_impl, mapping_impl) mapping_impl begin\ndefinition \"MAPPING_IMPL('a * 'b) = Phantom('a * 'b) \n  (mapping_impl_choose2 (of_phantom MAPPING_IMPL('a)) (of_phantom MAPPING_IMPL('b)))\"\ninstance ..\nend\n\nderive (choose) mapping_impl list\nderive (rbt) mapping_impl String.literal\n\ninstantiation option :: (mapping_impl) mapping_impl begin\ndefinition \"MAPPING_IMPL('a option) = Phantom('a option) (of_phantom MAPPING_IMPL('a))\"\ninstance ..\nend\n\nderive (choose) mapping_impl set\n\ninstantiation phantom :: (type, mapping_impl) mapping_impl begin\ndefinition \"MAPPING_IMPL(('a, 'b) phantom) = Phantom (('a, 'b) phantom) \n  (of_phantom MAPPING_IMPL('b))\"\ninstance ..\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Containers/Mapping_Impl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3160234274941507}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   June 2005 (modified)    |\n            |                 August 2005 (modified)    |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_domain\nimports CSP_T.CSP_T_traces CSP_F_failures\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*********************************************************\n                        domF\n *********************************************************)\n\n(*--------------------------------*\n |             STOP               |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma STOP_T2 : \"HC_T2 (traces(STOP) (fstF o M), failures(STOP) M)\"\nby (simp add: HC_T2_def in_traces in_failures)\n\n(* F3 *)\n\nlemma STOP_F3 : \"HC_F3 (traces(STOP) (fstF o M), failures(STOP) M)\"\nby (simp add: HC_F3_def in_traces in_failures)\n\n(* T3_F4 *)\n\nlemma STOP_T3_F4 : \"HC_T3_F4 (traces(STOP) (fstF o M), failures(STOP) M)\"\nby (auto simp add: HC_T3_F4_def in_traces in_failures)\n\n(*** STOP_domF ***)\n\nlemma STOP_domF : \"(traces(STOP) (fstF o M), failures(STOP) M) : domF\"\napply (simp add: domF_iff)\napply (simp add: STOP_T2)\napply (simp add: STOP_F3)\napply (simp add: STOP_T3_F4)\ndone\n\n(*--------------------------------*\n |             SKIP               |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma SKIP_T2 : \"HC_T2 (traces(SKIP) (fstF o M), failures(SKIP) M)\"\nby (simp add: HC_T2_def in_traces in_failures)\n\n(* F3 *)\n\nlemma SKIP_F3 : \"HC_F3 (traces(SKIP) (fstF o M), failures(SKIP) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\nby (auto simp add: Evset_def)\n\n(* T3_F4 *)\n\nlemma SKIP_T3_F4 : \"HC_T3_F4 (traces(SKIP) (fstF o M), failures(SKIP) M)\"\nby (auto simp add: HC_T3_F4_def in_traces in_failures)\n\n(*** SKIP_domF ***)\n\nlemma SKIP_domF : \"(traces(SKIP) (fstF o M), failures(SKIP) M) : domF\"\napply (simp add: domF_iff)\napply (simp add: SKIP_T2)\napply (simp add: SKIP_F3)\napply (simp add: SKIP_T3_F4)\ndone\n\n(*--------------------------------*\n |              DIV               |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma DIV_T2 : \"HC_T2 (traces(DIV) (fstF o M), failures(DIV) M)\"\nby (simp add: HC_T2_def in_traces in_failures)\n\n(* F3 *)\n\nlemma DIV_F3 : \"HC_F3 (traces(DIV) (fstF o M), failures(DIV) M)\"\nby (simp add: HC_F3_def in_traces in_failures)\n\n(* T3_F4 *)\n\nlemma DIV_T3_F4 : \"HC_T3_F4 (traces(DIV) (fstF o M), failures(DIV) M)\"\nby (auto simp add: HC_T3_F4_def in_traces in_failures)\n\n(*** DIV_domF ***)\n\nlemma DIV_domF : \"(traces(DIV) (fstF o M), failures(DIV) M) : domF\"\napply (simp add: domF_iff)\napply (simp add: DIV_T2)\napply (simp add: DIV_F3)\napply (simp add: DIV_T3_F4)\ndone\n\n(*--------------------------------*\n |          Act_prefix            |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma Act_prefix_T2 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n    ==> HC_T2 (traces(a -> P) (fstF o M), failures(a -> P) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE, simp)\n\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\nby (force)\n\n(* F3 *)\n\nlemma Act_prefix_F3 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n    ==> HC_F3 (traces(a -> P) (fstF o M), failures(a -> P) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\n\napply (elim conjE disjE, simp)\napply (case_tac \"Ev a ~: Y\", simp)  (* show \"Ev a : Y --> contradict\" *)\napply (drule_tac x=\"Ev a\" in spec, simp)\napply (drule_tac x=\"<>\" in spec, simp)\n\napply (elim conjE exE, simp)\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"Y\" in spec)\napply (simp)\n\napply (drule mp)\n apply (intro allI impI)\n apply (drule_tac x=\"aa\" in spec, simp)\n apply (drule_tac x=\"sa ^^^ <aa>\" in spec)\napply (simp add: appt_assoc)\nby (simp)\n\n(* T3_F4 *)\n\nlemma Act_prefix_T3_F4 : \n  \"(traces(P) (fstF o M), failures(P) M) : domF\n    ==> HC_T3_F4 (traces(a -> P) (fstF o M), failures(a -> P) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (insert trace_nil_or_Tick_or_Ev)\napply (drule_tac x=\"s\" in spec)\n\napply (erule disjE, simp)   (* s ^^^ <Tick> = <> --> contradict *)\napply (erule disjE, simp)   (* s = <> --> contradict *)\napply (erule disjE, simp)   (* s = <Tick> --> contradict *)\n\napply (elim conjE exE)      (* s = [Ev a]t ^^^ sb *)\n\napply (simp add: domF_iff HC_T3_F4_def)\napply (elim conjE exE)\napply (drule_tac x=\"sb\" in spec)\napply (simp add: appt_assoc)\ndone\n\n(*** Act_prefix_domF ***)\n\nlemma Act_prefix_domF : \n  \"(traces(P) (fstF o M), failures(P) M) : domF\n    ==> (traces(a -> P) (fstF o M), failures(a -> P) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Act_prefix_T2)\napply (simp add: Act_prefix_F3)\napply (simp add: Act_prefix_T3_F4)\ndone\n\n(*--------------------------------*\n |        Ext_pre_choice          |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma Ext_pre_choice_T2 :\n  \"ALL a. (traces(Pf a) (fstF o M), failures(Pf a) M) : domF\n     ==> HC_T2 (traces(? :X -> Pf) (fstF o M), failures(? :X -> Pf) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE, simp)\n\napply (drule_tac x=\"a\" in spec)\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\nby (force)\n\n(* F3 *)\n\nlemma Ext_pre_choice_F3 :\n  \"ALL a. (traces(Pf a) (fstF o M), failures(Pf a) M) : domF\n     ==> HC_F3 (traces(? :X -> Pf) (fstF o M), failures(? :X -> Pf) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\n\napply (elim conjE disjE, simp)\n\n(* s = <> *)\napply (case_tac \"EX a. Ev a :Ev ` X Int (Xa Un Y)\")  (* show contradiction\" *)\n apply (elim conjE exE)\n apply (drule_tac x=\"Ev a\" in spec)\n apply (drule mp)\n  apply (simp)                      (* show \"Ev a : Y\" *)\n  apply (elim conjE disjE)\n  apply (fast)                      (* contradict *)\n  apply (simp)\n\n apply (drule_tac x=\"a\" in spec)\n apply (drule_tac x=\"a\" in spec)\n apply (simp)\n apply (drule_tac x=\"s\" in spec)\n apply (simp)\n apply (fast)                      (* contradict *)\napply (fast)                       (* Ev ` X Int (Xa Un Y) = {} *)\n\n(* s ~= <> *)\napply (elim conjE exE, simp)\napply (drule_tac x=\"a\" in spec)\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"Xa\" in spec)\napply (drule_tac x=\"Y\" in spec)\napply (simp)\n\napply (drule mp)\n apply (intro allI impI)\n apply (drule_tac x=\"aa\" in spec, simp)\n apply (drule_tac x=\"a\" in spec)\n apply (drule_tac x=\"sa ^^^ <aa>\" in spec)\n apply (simp add: appt_assoc)\nby (simp)\n\n(* T3_F4 *)\n\nlemma Ext_pre_choice_T3_F4 : \n  \"ALL a. (traces(Pf a) (fstF o M), failures(Pf a) M) : domF\n     ==> HC_T3_F4 (traces(? :X -> Pf) (fstF o M), failures(? :X -> Pf) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (insert trace_nil_or_Tick_or_Ev)\napply (drule_tac x=\"s\" in spec)\n\napply (erule disjE, simp)   (* contradict *)\napply (erule disjE, simp)   (* s = <> --> contradict *)\napply (erule disjE, simp)   (* s = <Tick> --> contradict *)\n\napply (elim conjE exE)      (* s = [Ev aa]t ^^^ sb *)\napply (drule_tac x=\"a\" in spec)\napply (simp add: domF_iff HC_T3_F4_def)\napply (elim conjE exE)\napply (drule_tac x=\"sb\" in spec)\napply (simp add: appt_assoc)\ndone\n\n(*** Ext_pre_choice_domF ***)\n\nlemma Ext_pre_choice_domF : \n  \"ALL a. (traces(Pf a) (fstF o M), failures(Pf a) M) : domF\n     ==> (traces(? :X -> Pf) (fstF o M), failures(? :X -> Pf) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Ext_pre_choice_T2)\napply (simp add: Ext_pre_choice_F3)\napply (simp add: Ext_pre_choice_T3_F4)\ndone\n\n(*--------------------------------*\n |          Ext_choice            |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma Ext_choice_T2 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T2 (traces(P [+] Q) (fstF o M), failures(P [+] Q) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\n\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"s\" in spec)\nby (fast)\n\n(* F3 *)\n\nlemma Ext_choice_F3 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_F3 (traces(P [+] Q) (fstF o M), failures(P [+] Q) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\n\napply (elim conjE disjE)\napply (simp_all add: domF_def HC_F3_def)\nby (auto simp add: Evset_def)\n\n(* T3_F4 *)\n\nlemma Ext_choice_T3_F4 : \n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T3_F4 (traces(P [+] Q) (fstF o M), failures(P [+] Q) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\n\napply (simp add: domF_iff HC_T3_F4_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"s\" in spec)\nby (auto)\n\n(*** Ext_choice_domF ***)\n\nlemma Ext_choice_domF : \n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> (traces(P [+] Q) (fstF o M), failures(P [+] Q) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Ext_choice_T2)\napply (simp add: Ext_choice_F3)\napply (simp add: Ext_choice_T3_F4)\ndone\n\n(*--------------------------------*\n |          Int_choice            |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma Int_choice_T2 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T2 (traces(P |~| Q) (fstF o M), failures(P |~| Q) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (simp add: domF_def HC_T2_def)\nby (auto)\n\n(* F3 *)\n\nlemma Int_choice_F3 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_F3 (traces(P |~| Q) (fstF o M), failures(P |~| Q) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (simp add: domF_def HC_F3_def)\nby (auto)\n\n(* T3_F4 *)\n\nlemma Int_choice_T3_F4 : \n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T3_F4 (traces(P |~| Q) (fstF o M), failures(P |~| Q) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (simp add: domF_iff HC_T3_F4_def)\nby (auto)\n\n(*** Int_choice_domF ***)\n\nlemma Int_choice_domF : \n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> (traces(P |~| Q) (fstF o M), failures(P |~| Q) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Int_choice_T2)\napply (simp add: Int_choice_F3)\napply (simp add: Int_choice_T3_F4)\ndone\n\n(*--------------------------------*\n |        Rep_int_choice          |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma Union_proc_T2:\n  \"ALL c. (Tf c, Ff c) : domF\n   ==> HC_T2 ({t. t = <> | (EX c:C. t :t Tf c)}t,\n                         {f. EX c:C. f :f Ff c}f)\"\napply (simp add: HC_T2_def)\napply (simp add: in_traces)\napply (simp add: in_failures)\napply (intro allI impI)\napply (elim conjE bexE exE)\napply (rule disjI2)\napply (drule_tac x=\"c\" in spec)\napply (rule_tac x=\"c\" in bexI)\napply (simp add: domF_def HC_T2_def)\nby (auto)\n\nlemma Rep_int_choice_T2 :\n  \"ALL c. (traces(Pf c) (fstF o M), failures(Pf c) M) : domF\n     ==> HC_T2 (traces(!! :C .. Pf) (fstF o M), failures(!! :C .. Pf) M)\"\napply (simp add: traces_iff failures_iff)\napply (simp add: Union_proc_T2)\ndone\n\n(* F3 *)\n\nlemma Union_proc_F3:\n  \"ALL c. (Tf c, Ff c) : domF\n   ==>\n   HC_F3 ({t. t = <> | (EX c:C. t :t Tf c)}t,\n          {f. EX c:C. f :f Ff c}f)\"\napply (simp add: HC_F3_def)\napply (simp add: in_traces)\napply (simp add: in_failures)\napply (intro allI)\napply (intro impI)\napply (elim conjE bexE)\napply (rule_tac x=\"c\" in bexI)\napply (drule_tac x=\"c\" in spec)\napply (rule domF_F3)\napply (auto)\ndone\n\nlemma Rep_int_choice_nat : \n  \"ALL c. (traces(Pf c) (fstF o M), failures(Pf c) M) : domF\n     ==> HC_F3 (traces(!! :C .. Pf) (fstF o M), failures(!! :C .. Pf) M)\"\napply (simp add: traces_iff failures_iff)\napply (simp add: Union_proc_F3)\ndone\n\n(* T3_F4 *)\n\nlemma Union_proc_T3_F4:\n  \"ALL c. (Tf c, Ff c) : domF\n   ==>\n   HC_T3_F4 ({t. t = <> | (EX c:C. t :t Tf c)}t,\n             {f. EX c:C. f :f Ff c}f)\"\napply (simp add: HC_T3_F4_def)\napply (simp add: in_traces)\napply (simp add: in_failures)\napply (auto)\napply (rule_tac x=\"c\" in bexI)\napply (rule domF_F4)\napply (simp_all)\napply (rule_tac x=\"c\" in bexI)\napply (rule domF_T3)\napply (simp_all)\ndone\n\nlemma Rep_int_choice_T3_F4 : \n  \"ALL c. (traces(Pf c) (fstF o M), failures(Pf c) M) : domF\n     ==> HC_T3_F4 (traces(!! :C .. Pf) (fstF o M),\n                   failures(!! :C .. Pf) M)\"\napply (simp add: traces_iff failures_iff)\napply (simp add: Union_proc_T3_F4)\ndone\n\n(*** F ***)\n\nlemma Union_proc_domF:\n  \"ALL c. (Tf c, Ff c) : domF\n   ==> ({t. t = <> | (EX c:C. t :t Tf c)}t,\n        {f. EX c:C. f :f Ff c}f) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Union_proc_T2)\napply (simp add: Union_proc_F3)\napply (simp add: Union_proc_T3_F4)\ndone\n\n(*** Rep_int_choice_domF ***)\n\nlemma Rep_int_choice_domF : \n  \"ALL c. (traces(Pf c) (fstF o M), failures(Pf c) M) : domF\n     ==> (traces(!! :C .. Pf) (fstF o M), failures(!! :C .. Pf) M) : domF\"\napply (simp add: traces_iff failures_iff)\napply (simp add: Union_proc_domF)\ndone\n\n(*--------------------------------*\n |               IF               |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma IF_T2 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ;\n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T2 (traces(IF b THEN P ELSE Q) (fstF o M), \n                failures(IF b THEN P ELSE Q) M)\"\nby (simp add: HC_T2_def in_traces in_failures domF_def)\n\n(* F3 *)\n\nlemma IF_F3 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ;\n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_F3 (traces(IF b THEN P ELSE Q) (fstF o M), failures(IF b THEN P ELSE Q) M)\"\nby (simp add: HC_F3_def in_traces in_failures domF_def)\n\n(* T3_F4 *)\n\nlemma IF_T3_F4 : \n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ;\n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T3_F4 (traces(IF b THEN P ELSE Q) (fstF o M), \n                   failures(IF b THEN P ELSE Q) M)\"\nby (simp add: HC_T3_F4_def in_traces in_failures domF_iff)\n\n(*** IF_domF ***)\n\nlemma IF_domF :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ;\n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> (traces(IF b THEN P ELSE Q) (fstF o M), \n          failures(IF b THEN P ELSE Q) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: IF_T2)\napply (simp add: IF_F3)\napply (simp add: IF_T3_F4)\ndone\n\n(*--------------------------------*\n |           Parallel             |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Parallel_T2 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T2 (traces(P |[X]| Q) (fstF o M), failures(P |[X]| Q) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI)\napply (rule_tac x=\"t\" in exI)\napply (simp)\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"t\" in spec)\n\napply (drule mp, rule_tac x=\"Y\" in exI, simp)\napply (drule mp, rule_tac x=\"Z\" in exI, simp)\nby (simp)\n\n(*** F3 ***)\n\nlemma Parallel_F3_lm1: \"X1 Un (X2 Un X3) - X = (X1 - X) Un (X2 - X) Un (X3 - X)\"\nby (auto)\n\nlemma Parallel_F3_lm2: \"[| X1 = X2 ; Y1 = Y2 |] ==> X1 Un Y1 = X2 Un Y2\"\nby (auto)\n\nlemma Parallel_F3 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_F3 (traces(P |[X]| Q) (fstF o M), failures(P |[X]| Q) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rename_tac u X12 Y X1 X2 s t)\n\n(* (u, X12) :f [[P |[X]| Q]]F *)\n(* (s, X1)  :f [[P]]F         *)\n(* (t, X2)  :f [[Q]]F         *)\n(*  X12 = X1 Un X2               *)\n\napply (rule_tac x=\n        \"X1 Un\n         ({a. a : Y & (a = Tick | a : Ev ` X) & s ^^^ <a> ~:t traces(P) (fstF o M)} Un\n          {a. a : Y & a ~= Tick & a ~: Ev ` X})\" in exI)       (* Z1 *)\napply (rule_tac x=\n        \"X2 Un\n         ({a. a : Y & (a = Tick | a : Ev ` X) & t ^^^ <a> ~:t traces(Q) (fstF o M)} Un\n          {a. a : Y & a ~= Tick & a ~: Ev ` X})\" in exI)       (* Z2 *)\n\napply (subgoal_tac \"noTick s & noTick t\", simp)\napply (rule conjI)\n\n(* show X12 Un Y = X1 Un Z1 Un Z2 *)\napply (rule equalityI)\n\n (* <= *)\n apply (rule subsetI, simp)\n apply (erule disjE, simp)\n apply (erule disjE, simp)\n apply (simp)\n\n apply (drule_tac x=\"x\" in spec, simp)\n apply (drule_tac x=\"s ^^^ <x>\" in spec)\n apply (drule_tac x=\"t ^^^ <x>\" in spec)\n\n  (* no sync *)\n  apply (case_tac \"x ~= Tick & x ~: Ev ` X\", simp)\n  (* sync *)\n  apply (simp add: par_tr_last)\n  apply (erule disjE, simp)\n  apply (force)\n\n  apply (rotate_tac -2)\n  apply (erule disjE, simp)\n  apply (force)\n  apply (simp)\n  apply (force)\n\n (* => *)\n apply (force)\n\napply (rule conjI)\n\n (* show X1 Un ... = X2 Un ... *)\n apply (simp add: Parallel_F3_lm1)\n apply (rule Parallel_F3_lm2)\n apply (rule Parallel_F3_lm2)\n apply (simp)\n apply (force)\n apply (simp)\n\n (* condition 2 *)\n apply (rule_tac x=\"s\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n apply (simp add: domF_def HC_F3_def)\n apply (elim conjE)\n apply (drule_tac x=\"s\" in spec)\n apply (drule_tac x=\"t\" in spec)\n apply (drule_tac x=\"X1\" in spec)\n apply (drule_tac x=\"X2\" in spec)\n apply (drule_tac x=\n   \"{a. a : Y & (a = Tick | a : Ev ` X) & s ^^^ <a> ~:t traces(P) (fstF o M)} Un\n    {a. a : Y & a ~= Tick & a ~: Ev ` X}\" in spec)\n apply (drule_tac x=\n   \"{a. a : Y & (a = Tick | a : Ev ` X) & t ^^^ <a> ~:t traces(Q) (fstF o M)} Un\n    {a. a : Y & a ~= Tick & a ~: Ev ` X}\" in spec)\n apply (simp)\n\n (* left *)\n apply (drule mp)\n  apply (intro allI impI)\n  apply (drule_tac x=\"a\" in spec, simp)\n  apply (drule_tac x=\"s ^^^ <a>\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (erule disjE)\n  apply (simp add: par_tr_last)\n  apply (fast)\n\n  apply (erule disjE, simp)\n  apply (simp add: HC_T2_def)\n  apply (drule_tac x=\"s\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (force)\n\n (* right *)\n apply (drule mp)\n  apply (intro allI impI)\n  apply (drule_tac x=\"a\" in spec, simp)\n  apply (drule_tac x=\"s\" in spec)\n  apply (drule_tac x=\"t ^^^ <a>\" in spec)\n  apply (erule disjE)\n  apply (simp add: par_tr_last)\n  apply (fast)\n\n  apply (erule disjE)\n  apply (simp add: HC_T2_def)\n  apply (drule_tac x=\"s\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (force)\n  apply (simp)\n apply (simp)\n\n(* notick s & notick t *)\napply (simp add: par_tr_noTick_decompo)\ndone\n\n(* T3_F4 *)\n\nlemma Parallel_T3_F4 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T3_F4 (traces(P |[X]| Q) (fstF o M), failures(P |[X]| Q) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (simp add: par_tr_last)\napply (elim conjE exE)\napply (rule conjI)\n\n (* F4 *)\n apply (rule_tac x=\"Evset\" in exI)\n apply (rule_tac x=\"Evset\" in exI)\n apply (simp)\n apply (rule_tac x=\"s'\" in exI)\n apply (rule_tac x=\"t'\" in exI)\n apply (simp add: domF_def HC_F4_def)\n\n (* T3 *)\n apply (rule allI)\n apply (rule_tac x=\"Xa\" in exI)\n apply (rule_tac x=\"Xa\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: domF_def HC_T3_def)\n apply (fast)\ndone\n\n(*** Parallel_domF ***)\n\nlemma Parallel_domF :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> (traces(P |[X]| Q) (fstF o M), failures(P |[X]| Q) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Parallel_T2)\napply (simp add: Parallel_F3)\napply (simp add: Parallel_T3_F4)\ndone\n\n(*--------------------------------*\n |            Hiding              |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Hiding_T2 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T2 (traces(P -- X) (fstF o M), failures(P -- X) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI)\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\nby (force)\n\n(*** F3 ***)\n\nlemma Hiding_F3 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_F3 (traces(P -- X) (fstF o M), failures(P -- X) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rename_tac t Y Z s)\napply (rule_tac x=\"s\" in exI, simp)\n\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"Ev ` X Un Y\" in spec)\napply (drule_tac x=\"Z - Ev ` X\" in spec)\napply (simp)\n\napply (drule mp)\n apply (intro allI impI)\n apply (drule_tac x=\"a\" in spec)\n apply (simp)\n\n apply (insert event_Tick_or_Ev)\n apply (drule_tac x=\"a\" in spec)\n apply (erule disjE)\n  (* Tick *)\n  apply (drule_tac x=\"s ^^^ <Tick>\" in spec)\n  apply (simp)\n  (* Ev *)\n  apply (elim conjE exE)\n  apply (drule_tac x=\"s ^^^ <Ev aa>\" in spec)\n  apply (simp)\n  apply (subgoal_tac \"aa ~: X\", simp_all)\n  apply (force)\n\napply (subgoal_tac \"Ev ` X Un Y Un (Z - Ev ` X) = Ev ` X Un (Y Un Z)\", simp)\nby (auto)\n\n(* T3_F4 *)\n\nlemma Hiding_T3_F4 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T3_F4 (traces(P -- X) (fstF o M), failures(P -- X) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (drule sym)\napply (simp add: hide_tr_decompo)\napply (elim conjE exE)\napply (rotate_tac -1)\napply (drule sym)\n\napply (subgoal_tac \"(EX t''. t' = t'' ^^^ <Tick> & sett t'' <= Ev ` X)\")\n apply (elim conjE exE)\n apply (simp)\n\n (* F4 *)\n apply (rule conjI)\n  apply (rule_tac x=\"s' ^^^ t''\" in exI)\n  apply (simp)\n  apply (subgoal_tac \"t'' --tr X = <>\", simp)\n   apply (simp add: domF_def HC_F4_def)\n   apply (elim conjE)\n   apply (drule_tac x=\"s' ^^^ t''\" in spec)\n   apply (subgoal_tac \"noTick t''\")\n    apply (simp add: appt_assoc)\n   apply (simp add: noTick_def)\n   apply (force)\n  apply (simp add: hide_tr_nilt_sett)\n\n (* T3 *)\n apply (rule allI)\n apply (rule_tac x=\"sa\" in exI, simp)\n apply (simp add: domF_def HC_T3_def)\n apply (elim conjE)\n apply (drule_tac x=\"s' ^^^ t''\" in spec, simp)\n apply (subgoal_tac \"noTick t''\")\n  apply (simp add: appt_assoc)\n apply (simp add: noTick_def)\n apply (force)\n\napply (auto simp add: hide_tr_Tick_sett)\ndone\n\n(*** Hiding_domF ***)\n\nlemma Hiding_domF :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> (traces(P -- X) (fstF o M), failures(P -- X) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Hiding_T2)\napply (simp add: Hiding_F3)\napply (simp add: Hiding_T3_F4)\ndone\n\n(*--------------------------------*\n |           Renaming             |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Renaming_T2 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T2 (traces(P [[r]]) (fstF o M), failures(P [[r]]) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI)\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\nby (force)\n\n(*** F3 ***)\n\nlemma Renaming_F3 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_F3 (traces(P [[r]]) (fstF o M), failures(P [[r]]) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI, simp)\n\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"[[r]]inv X\" in spec)\napply (drule_tac x=\"[[r]]inv Y\" in spec)\n\napply (drule mp)\n apply (simp add: ren_tr_noTick_right)\n apply (intro allI impI)\n apply (simp add: ren_inv_def)\n apply (erule bexE)\n apply (fold ren_inv_def)\n apply (drule_tac x=\"eb\" in spec, simp)\n\n  (* Tick *)\n  apply (erule disjE)\n  apply (drule_tac x=\" sa ^^^ <a>\" in spec)\n  apply (simp add: ren_tr_noTick_right)\n  (* Ev *)\n  apply (elim conjE exE)\n  apply (drule_tac x=\" sa ^^^ <Ev aa>\" in spec)\n  apply (simp add: ren_tr_noTick_right)\nby (simp)\n\n(* T3_F4 *)\n\nlemma Renaming_T3_F4 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T3_F4 (traces(P [[r]]) (fstF o M), failures(P [[r]]) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (simp add: ren_tr_appt_decompo)\napply (elim conjE exE)\napply (case_tac \"~ noTick s1\", simp)\napply (simp)\n\n (* F4 *)\n apply (rule conjI)\n apply (rule_tac x=\"s1\" in exI, simp)\n apply (simp add: domF_def HC_F4_def)\n apply (elim conjE)\n apply (drule_tac x=\"s1\" in spec, simp)\n apply (rule memF_F2, simp, simp)\n\n (* T3 *)\n apply (rule allI)\n apply (rule_tac x=\"s1 ^^^ <Tick>\" in exI)\n apply (simp add: domF_def HC_T3_def)\n apply (fast)\ndone\n\n(*** Renaming_domF ***)\n\nlemma Renaming_domF :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> (traces(P [[r]]) (fstF o M), failures(P [[r]]) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Renaming_T2)\napply (simp add: Renaming_F3)\napply (simp add: Renaming_T3_F4)\ndone\n\n(*--------------------------------*\n |           Seq_compo            |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Seq_compo_T2 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T2 (traces(P ;; Q) (fstF o M), failures(P ;; Q) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI)\napply (rule conjI)\n\n (* case 1 *)\n apply (intro impI)\n apply (rule disjI1)\n apply (rule_tac x=\"s\" in exI, simp)\n apply (simp add: domF_def HC_T2_def)\n apply (elim conjE)\n apply (drule_tac x=\"s\" in spec)\n apply (force)\n\n (* case 2 *)\n apply (intro impI)\n apply (elim conjE exE disjE)\n apply (rule disjI2)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: domF_def HC_T2_def)\n apply (elim conjE)\n apply (rotate_tac 4)\n apply (drule_tac x=\"t\" in spec)\n apply (force)\ndone\n\n(*** F3 ***)\n\nlemma Seq_compo_F3 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_F3 (traces(P ;; Q) (fstF o M), failures(P ;; Q) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE disjE)\n\n (* case 1 *)\n apply (simp add: domF_def HC_F3_def)\n apply (elim conjE)\n apply (drule_tac x=\"s\" in spec)\n apply (drule_tac x=\"insert Tick X\" in spec)\n apply (drule_tac x=\"Y-{Tick}\" in spec)\n apply (simp)\n apply (drule mp)\n  apply (intro allI impI)\n  apply (drule_tac x=\"a\" in spec, simp)\n  apply (simp add: not_Tick_to_Ev)\n  apply (elim conjE exE, simp)\n  apply (rotate_tac -3)\n  apply (drule_tac x=\"s ^^^ <Ev aa>\" in spec, simp)\n apply (subgoal_tac \n   \"insert Tick (X Un (Y - {Tick})) = insert Tick (X Un Y)\", simp)\n apply (force)\n\n (* case 2 *)\n apply (simp add: domF_def HC_F3_def)\n apply (elim conjE)\n apply (rotate_tac -2)\n apply (drule_tac x=\"t\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (drule_tac x=\"Y\" in spec)\n apply (simp)\n apply (drule mp)\n  apply (intro allI impI)\n  apply (drule_tac x=\"a\" in spec, simp)\n  apply (elim conjE)\n  apply (rotate_tac -1)\n  apply (drule_tac x=\"sa\" in spec)\n  apply (rotate_tac -1)\n  apply (drule_tac x=\"t ^^^ <a>\" in spec)\n  apply (simp add: appt_assoc)\n apply (rule disjI2)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\ndone\n\n(* T3_F4 *)\n\nlemma Seq_compo_T3_F4 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T3_F4 (traces(P ;; Q) (fstF o M), failures(P ;; Q) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE disjE)\n\n (* case 1 *)\n apply (elim conjE exE)\n apply (subgoal_tac \"noTick (s ^^^ <Tick>) ~= noTick (rmTick sa)\", simp)\n apply (simp (no_asm_use))\n apply (drule sym)\n apply (simp)\n\n (* case 2 *)\n apply (elim conjE exE)\n apply (case_tac \"~ noTick sa\", simp)\n apply (insert trace_last_nil_or_unnil)\n apply (drule_tac x=\"t\" in spec)\n apply (simp)\n  (* <> *)\n  apply (erule disjE)\n  apply (rotate_tac -5)\n  apply (drule_tac sym, simp)   (* contradict *)\n\n  (* ... <Tick> *)\n  apply (elim conjE exE, simp)\n  apply (simp add: appt_assoc_sym)\n  apply (erule conjE)\n  apply (rule conjI)\n\n   (* F4 *)\n   apply (rule disjI2)\n   apply (rule_tac x=\"sa\" in exI)\n   apply (rule_tac x=\"sb\" in exI)\n   apply (simp add: domF_def HC_F4_def)\n\n   (* T3 *)\n   apply (rule allI)\n   apply (rule_tac x=\"sa\" in exI)\n   apply (rule_tac x=\"t\" in exI)\n   apply (simp add: appt_assoc_sym domF_def HC_T3_def)\ndone\n\n(*** Seq_compo_domF ***)\n\nlemma Seq_compo_domF :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> (traces(P ;; Q) (fstF o M), failures(P ;; Q) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Seq_compo_T2)\napply (simp add: Seq_compo_F3)\napply (simp add: Seq_compo_T3_F4)\ndone\n\n(*--------------------------------*\n |          Depth_rest            |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Depth_rest_T2 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T2 (traces(P |. n) (fstF o M), failures(P |. n) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\nby (force)\n\n(*** F3 ***)\n\nlemma Depth_rest_F3 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_F3 (traces(P |. n) (fstF o M), failures(P |. n) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\n\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"Y\" in spec)\napply (simp)\napply (erule disjE)\napply (simp)\napply (simp)\napply (elim conjE exE)\napply (simp)\ndone\n\n(* T3_F4 *)\n\nlemma Depth_rest_T3_F4 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T3_F4 (traces(P |. n) (fstF o M), failures(P |. n) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (simp)\n\n (* F4 *)\n apply (rule conjI)\n apply (simp add: domF_def HC_F4_def)\n\n (* T3 *)\n apply (simp add: domF_def HC_T3_def)\n apply (case_tac \"Suc (lengtht s) < n\")\n apply (simp)\n apply (simp)\n apply (fast)\ndone\n\n(*** Depth_rest_domF ***)\n\nlemma Depth_rest_domF :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> (traces(P |. n) (fstF o M), failures(P |. n) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Depth_rest_T2)\napply (simp add: Depth_rest_F3)\napply (simp add: Depth_rest_T3_F4)\ndone\n\n(*--------------------------------*\n |        Proc_name_dom           |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Proc_name_T2 :\n  \"HC_T2 (traces ($p) (fstF o M), failures ($p) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim exE)\napply (simp add: pairF_domF_T2)\ndone\n\n(*** F3 ***)\n\nlemma Proc_name_F3 :\n  \"HC_F3 (traces ($p) (fstF o M), failures ($p) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (simp add: pairF_domF_F3)\ndone\n\n(* T3_F4 *)\n\nlemma Proc_name_T3_F4 :\n  \"HC_T3_F4 (traces ($p) (fstF o M), failures ($p) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (simp add: pairF_domF_T3)\napply (simp add: pairF_domF_F4)\ndone\n\n(*** Proc_name_domF ***)\n\nlemma Proc_name_domF :\n  \"(traces ($p) (fstF o M), failures ($p) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Proc_name_T2)\napply (simp add: Proc_name_F3)\napply (simp add: Proc_name_T3_F4)\ndone\n\n(*--------------------------------*\n |             proc               |\n *--------------------------------*)\n\ndeclare o_apply [simp del]\n\nlemma proc_domF[simp]: \"(traces(P) (fstF o M), failures(P) M) : domF\"\napply (induct_tac P)\napply (simp add: STOP_domF)\napply (simp add: SKIP_domF)\napply (simp add: DIV_domF)\napply (simp add: Act_prefix_domF)\napply (simp add: Ext_pre_choice_domF)\napply (simp add: Ext_choice_domF)\napply (simp add: Int_choice_domF)\napply (simp add: Rep_int_choice_domF)\napply (simp add: IF_domF)\napply (simp add: Parallel_domF)\napply (simp add: Hiding_domF)\napply (simp add: Renaming_domF)\napply (simp add: Seq_compo_domF)\napply (simp add: Depth_rest_domF)\napply (simp add: Proc_name_domF)\ndone\n\ndeclare o_apply [simp]\n\n(*--------------------------------*\n |          fstF sndF             |\n *--------------------------------*)\n\nlemma fstF_proc_domF[simp]:\n   \"fstF (traces(P) (fstF o M),, failures(P) M) = traces(P) (fstF o M)\"\nby (simp add: pairF)\n\nlemma sndF_proc_domF[simp]:\n   \"sndF (traces(P) (fstF o M),, failures(P) M) = failures(P) M\"\nby (simp add: pairF)\n\nlemma fstF_proc_domF2[simp]:\n   \"fstF (traces(P) (%x. fstF (M x)),, failures(P) M) = traces(P) (fstF o M)\"\napply (fold comp_def)\napply (simp)\ndone\n\nlemma sndF_proc_domF2[simp]:\n   \"sndF (traces(P) (%x. fstF (M x)),, failures(P) M) = failures(P) M\"\napply (fold comp_def)\napply (simp)\ndone\n\nlemma fstF_proc_domF_fun:\n   \"fstF o (%p. (traces(f p) (fstF o M),, failures(f p) M))\n     = (%p. traces(f p) (fstF o M))\"\napply (unfold comp_def)\napply (fold comp_def)\napply (simp add: fun_eq_iff)\ndone\n\nlemma sndF_proc_domF_fun:\n   \"sndF o (%p. (traces(f p) (fstF o M),, failures(f p) M))\n     = (%p.  failures(f p) M)\"\napply (unfold comp_def)\napply (fold comp_def)\napply (simp add: fun_eq_iff)\ndone\n\nlemma fstF_semFf[simp]: \"fstF ([[P]]Ff M) = traces(P) (fstF o M)\"\nby (simp add: semFf_def)\n\nlemma fstF_semF[simp]: \"fstF ([[P]]F) = traces(P) (fstF o MF)\"\nby (simp add: semF_def)\n\nlemma sndF_semFf[simp]: \"sndF ([[P]]Ff M) = failures(P) M\"\nby (simp add: semFf_def)\n\nlemma sndF_semF[simp]: \"sndF ([[P]]F) = failures(P) MF\"\nby (simp add: semF_def)\n\n(*** decomposition ***)\n\nlemma semFf_decompo:\n  \"([[P]]Ff M = SF) = ((traces P (fstF o M) = fstF SF) &\n                        failures P M = sndF SF)\"\napply (simp add: semFf_def)\napply (rule)\napply (drule sym)\napply (simp)\napply (simp)\ndone\n\nlemma semF_decompo:\n  \"([[P]]F = SF) = ((traces P (fstF o MF) = fstF SF) &\n                     failures P MF = sndF SF)\"\napply (simp add: semF_def)\napply (simp add: semFf_decompo)\ndone\n\nlemma semFf_decompo_fstF:\n  \"([[P]]Ff M = SF) ==> traces P (fstF o M) = fstF SF\"\nby (simp add: semFf_decompo)\n\nlemma semF_decompo_fstF:\n  \"([[P]]F = SF) ==> traces P (fstF o MF) = fstF SF\"\nby (simp add: semF_decompo)\n\nlemma semFf_decompo_sndF:\n  \"([[P]]Ff M = SF) ==>  failures P M = sndF SF\"\nby (simp add: semFf_decompo)\n\nlemma semF_decompo_sndF:\n  \"([[P]]F = SF) ==>  failures P MF = sndF SF\"\nby (simp add: semF_decompo)\n\n(*--------------------------------*\n |            [[$p]]Ff            |\n *--------------------------------*)\n\nlemma semFf_Proc_name: \"[[$p]]Ff = (%M. M p)\"\napply (simp add: semFf_def)\napply (simp add: traces_iff)\napply (simp add: failures_iff)\ndone\n\n(*--------------------------------*\n |          =F and <=F            |\n *--------------------------------*)\n\nlemma cspF_eqF_semantics:\n  \"(P =F[M1,M2] Q) = \n       ((traces P (fstF o M1) = traces Q (fstF o M2)) & \n        (failures P M1 = failures Q M2))\"\napply (simp add: eqF_def)\napply (simp add: semFf_def)\napply (simp add: eqF_decompo)\ndone\n\nlemma cspF_refF_semantics:\n  \"(P <=F[M1,M2] Q) = \n       ((traces Q (fstF o M2) <= traces P (fstF o M1)) & \n        (failures Q M2 <= failures P M1))\"\napply (simp add: refF_def)\napply (simp add: semFf_def)\napply (simp add: subdomF_decompo)\ndone\n\nlemmas cspF_semantics = cspF_eqF_semantics  cspF_refF_semantics\n\nlemma cspF_cspT_eqF_semantics:\n  \"(P =F[M1,M2] Q) = \n       ((P =T[fstF o M1,fstF o M2] Q) & \n        (failures P M1 = failures Q M2))\"\napply (simp add: cspF_eqF_semantics)\napply (simp add: eqT_def)\napply (simp add: semTf_def)\ndone\n\nlemma cspF_cspT_refF_semantics:\n  \"(P <=F[M1,M2] Q) = \n       ((P <=T[fstF o M1,fstF o M2] Q) & \n        (failures Q M2 <= failures P M1))\"\napply (simp add: cspF_refF_semantics)\napply (simp add: refT_def)\napply (simp add: semTf_def)\ndone\n\nlemmas cspF_cspT_semantics = cspF_cspT_eqF_semantics  cspF_cspT_refF_semantics\n\n(*--------------------------------*\n |            Timeout             |\n *--------------------------------*)\n\nlemma in_failures_Timeout1: \n  \"(f :f failures(P [> Q) M) =\n   (f :f failures(Q) M |\n   (EX s X. f = (s, X) & s ~= <> & (s, X) :f failures(P) M) |\n   (EX X. f = (<>, X) & X <= Evset & <Tick> :t traces(P) (fstF o M)))\"\napply (rule)\n\n(* <= *)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (simp add: in_traces)\n apply (rule disjI1)\n apply (rule domF_F2_F4, simp_all)\n\n (* <= *)\n apply (simp add: in_failures in_traces)\n apply (elim conjE exE disjE, simp_all)\n apply (auto elim: memF_pairE)\ndone\n\nlemma in_failures_Timeout2:\n  \"(f :f failures(P [>def Q) M) =\n   (f :f failures(Q) M |\n   (EX s X. f = (s, X) & s ~= <> & (s, X) :f failures(P) M) |\n   (EX X. f = (<>, X) & X <= Evset & <Tick> :t traces(P) (fstF o M)))\"\napply (simp add: Timeout_def)\napply (simp add: in_failures_Timeout1)\ndone\n\nlemmas in_failures_Timeout = in_failures_Timeout1 in_failures_Timeout2\n\n(*--------------------------------*\n |           Depth rest           |\n *--------------------------------*)\n\nlemma semFf_Depth_rest: \"[[P |. n]]Ff M = [[P]]Ff M .|. n\"\napply (simp add: semFf_def)\napply (simp add: traces.simps)\napply (simp add: failures.simps)\napply (simp add: rest_domF_def)\napply (simp add: restTF_def)\napply (simp add: pairF_def)\napply (simp add: Abs_domF_inverse)\napply (simp add: pair_restriction_def)\ndone\n\nlemma semF_Depth_rest: \"[[P |. n]]F = [[P]]F .|. n\"\napply (simp add: semF_def)\napply (simp add: semFf_Depth_rest)\ndone\n\n(*---------------------------------------------------*\n |         Healthiness conditions for proc           |\n *---------------------------------------------------*)\n\nlemma proc_T2:\n    \"(s, X) :f failures(P) M ==> s :t traces(P) (fstF o M)\"\napply (insert pairF_domF_T2[of \"s\" \"X\" \"(traces(P) (fstF o M),, failures(P) M)\"])\nby (simp)\n\nlemma proc_T3:\n  \"[| s ^^^ <Tick> :t traces(P) (fstF o M); noTick s |]\n   ==> (s ^^^ <Tick>, X) :f failures(P) M\"\napply (insert pairF_domF_T3[of \"s\" \"(traces(P) (fstF o M),, failures(P) M)\" \"X\"])\nby (simp)\n\nlemma proc_T3_Tick:\n  \"<Tick> :t traces(P) (fstF o M) ==> (<Tick>, X) :f failures(P) M\"\napply (insert proc_T3[of \"<>\" P M X])\nby (simp)\n\nlemma proc_F4:\n  \"[| s ^^^ <Tick> :t traces(P) (fstF o M) ; noTick s |]\n   ==> (s, Evset) :f failures(P) M\"\napply (insert pairF_domF_F4[of \"s\" \"(traces(P) (fstF o M),, failures(P) M)\"])\nby (simp)\n\nlemma proc_F3:\n  \"[| (s, X) :f failures(P) M ; noTick s ;\n      (ALL a. a : Y --> s ^^^ <a> ~:t  traces(P) (fstF o M)) |]\n   ==> (s, X Un Y) :f  failures(P) M\"\napply (insert pairF_domF_F3[of \"s\" \"X\" \"(traces(P) (fstF o M),, failures(P) M)\" \"Y\"])\nby (simp)\n\nlemma proc_F3I:\n  \"[| (s, X) :f failures(P) M ; noTick s ;\n      (ALL a. a : Y --> s ^^^ <a> ~:t traces(P) (fstF o M)) ;\n      Z = X Un Y |]\n   ==> (s, Z) :f failures(P) M\"\nby (simp add: proc_F3)\n\n(*** F2_F4 ***)\n\nlemma proc_F2_F4:\n  \"[| s ^^^ <Tick> :t traces(P) (fstF o M) ; noTick s ; X <= Evset|]\n   ==> (s, X) :f failures(P) M\"\napply (insert pairF_domF_F2_F4[of \"s\" \"(traces(P) (fstF o M),, failures(P) M)\" \"X\"])\nby (simp)\n\n(*** T2_T3 ***)\n\nlemma proc_T2_T3:\n  \"[| (s ^^^ <Tick>, X) :f failures(P) M ; noTick s |] \n  ==> (s ^^^ <Tick>, Y) :f failures(P) M\"\napply (rule proc_T3)\napply (rule proc_T2)\nby (simp_all)\n\n(*------------------------------------------------------*\n |   Union in domF  (used for generic internal choice   |\n *------------------------------------------------------*)\n\nlemma non_empty_UnionT_UnionF_T2:\n \"Ps ~= {} ==>\n  HC_T2 (UnionT {(traces P (fstF o M)) |P. P : Ps} , \n         UnionF {(failures P M) |P. P : Ps})\"\napply (simp add: HC_T2_def)\napply (intro allI impI)\napply (subgoal_tac \"{(traces P (fstF o M)) |P. P : Ps} ~= {}\")\napply (simp)\napply (elim conjE bexE exE)\napply (simp)\napply (rule_tac x=\"traces Pa (fstF o M)\" in exI)\napply (rule conjI)\napply (rule_tac x=\"Pa\" in exI)\napply (simp)\napply (simp add: proc_T2)\nby (auto)\n\nlemma non_empty_UnionT_UnionF_F3:\n \"Ps ~= {} ==>\n  HC_F3 (UnionT {(traces P (fstF o M)) |P. P : Ps} , \n         UnionF {(failures P M) |P. P : Ps})\"\napply (simp add: HC_F3_def)\napply (intro allI impI)\napply (subgoal_tac \"{(traces P (fstF o M)) |P. P : Ps} ~= {}\")\napply (simp)\napply (elim conjE exE)\napply (simp)\napply (rule_tac x=\"failures Pa M\" in exI)\napply (rule conjI)\napply (rule_tac x=\"Pa\" in exI)\napply (simp)\napply (rule proc_F3)\napply (simp_all)\napply (intro allI impI)\napply (drule_tac x=\"a\" in spec)\napply (simp)\napply (drule_tac x=\"traces Pa  (fstF o M)\" in spec)\napply (erule disjE)\napply (drule_tac x=\"Pa\" in spec)\napply (simp)\napply (simp)\napply (auto)\ndone\n\nlemma non_empty_UnionT_UnionF_T3_F4:\n \"Ps ~= {} ==>\n  HC_T3_F4 (UnionT {(traces P (fstF o M)) |P. P : Ps} , \n            UnionF {(failures P M) |P. P : Ps})\"\napply (simp add: HC_T3_F4_def)\napply (intro allI impI)\napply (subgoal_tac \"{(traces P (fstF o M)) |P. P : Ps} ~= {}\")\napply (simp)\napply (elim conjE bexE exE)\napply (simp)\napply (rule conjI)\n apply (rule_tac x=\"failures Pa M\" in exI)\n apply (rule conjI)\n apply (fast)\n apply (rule proc_F4)\n apply (simp_all)\n\n apply (rule allI)\n apply (rule_tac x=\"failures Pa M\" in exI)\n apply (rule conjI)\n apply (fast)\n apply (rule proc_T3)\n apply (simp_all)\nby (auto)\n\nlemma non_empty_UnionT_UnionF_domF:\n \"Ps ~= {} ==>\n  (UnionT {(traces P (fstF o M)) |P. P : Ps} , \n   UnionF {(failures P M) |P. P : Ps}) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: non_empty_UnionT_UnionF_T2)\napply (simp add: non_empty_UnionT_UnionF_F3)\napply (simp add: non_empty_UnionT_UnionF_T3_F4)\ndone\n\n(*------------------------------------------------------*\n |   Union in domF  (used for generic internal choice   |\n *------------------------------------------------------*)\n\nlemma UnionT_UnionF_T2:\n \"HC_T2 ({t. t = <> | (EX P:Ps. t :t traces(P) (fstF o M)) }t ,\n         {f. EX P:Ps. f :f failures(P) M}f )\"\napply (simp add: HC_T2_def)\napply (intro allI impI)\napply (simp add: in_traces_Union_proc)\napply (simp add: in_failures_Union_proc)\napply (elim conjE bexE exE)\napply (rule disjI2)\napply (rule_tac x=\"P\" in bexI)\napply (simp add: proc_T2)\napply (simp)\ndone\n\nlemma UnionT_UnionF_F3:\n \"HC_F3 ({t. t = <> | (EX P:Ps. t :t traces(P) (fstF o M)) }t ,\n         {f. EX P:Ps. f :f failures(P) M}f )\"\napply (simp add: HC_F3_def)\napply (intro allI impI)\napply (simp add: in_traces_Union_proc)\napply (simp add: in_failures_Union_proc)\napply (elim conjE bexE exE)\napply (simp)\napply (rule_tac x=\"P\" in bexI)\napply (rule proc_F3)\napply (simp_all)\ndone\n\nlemma UnionT_UnionF_T3_F4:\n \"HC_T3_F4 ({t. t = <> | (EX P:Ps. t :t traces(P) (fstF o M)) }t ,\n            {f. EX P:Ps. f :f failures(P) M}f )\"\napply (simp add: HC_T3_F4_def)\napply (intro allI impI)\napply (simp add: in_traces_Union_proc)\napply (simp add: in_failures_Union_proc)\napply (elim conjE bexE exE)\napply (simp)\napply (elim bexE)\napply (rule conjI)\n apply (rule_tac x=\"P\" in bexI)\n apply (rule proc_F4)\n apply (simp_all)\n\n apply (rule allI)\n apply (rule_tac x=\"P\" in bexI)\n apply (rule proc_T3)\n apply (simp_all)\ndone\n\nlemma UnionT_UnionF_domF:\n \"({t. t = <> | (EX P:Ps. t :t traces(P) (fstF o M)) }t ,\n            {f. EX P:Ps. f :f failures(P) M}f) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: UnionT_UnionF_T2)\napply (simp add: UnionT_UnionF_F3)\napply (simp add: UnionT_UnionF_T3_F4)\ndone\n\n(*-----------------------------------------*\n |              substitution               |\n *-----------------------------------------*)\n\nlemma semF_subst:\n  \"[[P<<f]]F = [[P]]Ff (%q. [[f q]]F)\"\napply (induct_tac P)\napply (simp add: semF_def semFf_def,\n       simp add: eqF_decompo,\n       simp add: traces_iff failures_iff)+\ndone\n\nlemma semF_subst_semFfun:\n  \"(%q. [[ (Pf q)<<f ]]F) = ([[Pf]]Ffun (%q. [[f q]]F))\"\napply (simp add: semFfun_def)\napply (simp add: fun_eq_iff)\napply (rule allI)\napply (simp add: semF_subst)\ndone\n\nlemma failrues_subst:\n  \"failures(P<<f) M = failures P (%q. [[f q]]Ff M)\"\napply (induct_tac P)\napply (simp_all add: semF_def semFf_def traces_iff failures_iff)+\napply (simp add: fstF_proc_domF_fun)\napply (simp add: traces_subst)\n\napply (simp add: fstF_proc_domF_fun)\napply (simp add: traces_subst)\ndone\n\n(*-----------------------------------------*\n |               semT -- semF              |\n *-----------------------------------------*)\n\nlemma semTfun_fstF_semFf:\n  \"[[Pf]]Tfun (fstF o M) p = fstF ([[Pf p]]Ff M)\"\napply (simp add: semTfun_def)\napply (simp add: semTf_def)\ndone\n\n(****************** to add them again ******************)\n\ndeclare disj_not1   [simp]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_domain.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3160234274941507}}
{"text": "\ntext\\<open>Facts about beta normalization involving theories\\<close>\n\ntheory BetaNormProof\n  imports BetaNorm Theory\nbegin\n\nlemma beta_preserves_term_ok': \"term_ok' \\<Sigma> r \\<Longrightarrow> r \\<rightarrow>\\<^sub>\\<beta> s \\<Longrightarrow> term_ok' \\<Sigma> s\"\nproof (induction r arbitrary: s)\n  case (Ct n T)\n  then show ?case \n    apply (simp add: tinstT_def split: option.splits)\n    (* Seems like I miss a simp rule for Ct*)\n    using beta_reducible.simps(7) beta_step_imp_beta_reducible by blast\nnext\n  case (Fv n T)\n  then show ?case \n    by auto\nnext\n  case (Bv n)\n  then show ?case \n    by auto\nnext\n  case (Abs R r)\n  then show ?case \n    by auto\nnext\n  case (App f u)\n  then show ?case \n    apply -\n    apply (ind_cases \"f $ u \\<rightarrow>\\<^sub>\\<beta> s\" for f u s)\n    using term_ok'_subst_bv2 term_ok'.simps(4) term_ok'.simps(5) apply blast\n    using term_ok'.simps(4) apply blast\n    using term_ok'.simps(4) apply blast\n    done\nqed\n\nlemma beta_preserves_term_ok: \"term_ok \\<Theta> r \\<Longrightarrow> r \\<rightarrow>\\<^sub>\\<beta> s \\<Longrightarrow> term_ok \\<Theta> s\"\nproof -\n  assume a1: \"term_ok \\<Theta> r\"\n  assume a2: \"r \\<rightarrow>\\<^sub>\\<beta> s\"\n  then have \"None \\<noteq> typ_of1 [] s\"\n    using a1 beta_preserves_typ_of1\n    by (metis has_typ1_imp_typ_of1 has_typ_def option.distinct(1) term_ok_def wt_term_def)\n  then show ?thesis\n    using a2 a1 beta_preserves_term_ok' has_typ_iff_typ_of wt_term_def typ_of_def\n    by (meson beta_preserves_typ_of term_ok_def wf_term_iff_term_ok')\nqed\n\nlemma beta_star_preserves_term_ok': \"r \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s \\<Longrightarrow> term_ok' \\<Sigma> r  \\<Longrightarrow> term_ok' \\<Sigma> s\"\n  by (induction rule: rtranclp.induct) (auto simp add: beta_preserves_term_ok')\n\ncorollary beta_star_preserves_term_ok: \"r \\<rightarrow>\\<^sub>\\<beta>\\<^sup>* s \\<Longrightarrow> term_ok thy r  \\<Longrightarrow> term_ok thy s\"\n  using beta_star_preserves_term_ok' beta_star_preserves_typ_of1 wt_term_def typ_of_def by auto\n                     \ncorollary term_ok_beta_norm: \"term_ok thy t \\<Longrightarrow> beta_norm t = Some t'\\<Longrightarrow> term_ok thy t'\"\n  using beta_norm_imp_beta_reds beta_star_preserves_term_ok by blast\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Metalogic_ProofChecker/BetaNormProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.31602342749415063}}
{"text": "(* Authors: Lammich, Wimmer *)\ntheory Recursion_Combinators\n  imports \"../../Refine_Imperative_HOL/IICF/IICF\"\n    \"../../Refine_Foreach\"\nbegin\n\ncontext\nbegin\n\nprivate definition for_comb where\n  \"for_comb f a0 n = nfoldli [0..<n + 1] (\\<lambda> x. True) (\\<lambda> k a. (f a k)) a0\"\n\nfun for_rec :: \"('a \\<Rightarrow> nat \\<Rightarrow> 'a nrest) \\<Rightarrow> 'a \\<Rightarrow> nat \\<Rightarrow> 'a nrest\" where\n  \"for_rec f a 0 = f a 0\" |\n  \"for_rec f a (Suc n) = for_rec f a n \\<bind> (\\<lambda> x. f x (Suc n))\"\n\n\n\nlemma nfoldli_simps':\n  \"nfoldli [] c f = RETURNT\" apply(rule ext) by auto\n\nprivate lemma for_comb_for_rec: \"for_comb f a n = for_rec f a n\"\nunfolding for_comb_def\nproof (induction f a n rule: for_rec.induct)\n  case 1 then show ?case by (auto simp: pw_eq_iff refine_pw_simps)\nnext\n  case IH: (2 a n)\n  from this[symmetric] show ?case apply (auto simp: nfoldli_append)\n    apply(rule antisym)    \n    subgoal by (auto intro!: bindT_mono simp add: nfoldli_simps')\n    subgoal by (auto intro!: bindT_mono simp add: nfoldli_simps')\n    done\nqed\n\nprivate definition for_rec2' where\n  \"for_rec2' f a n i j =\n    (if i = 0 then RETURNT a else for_rec (\\<lambda>a i. for_rec (\\<lambda> a. f a i) a n) a (i - 1))\n    \\<bind> (\\<lambda> a. for_rec (\\<lambda> a. f a i) a j)\"\n\nfun for_rec2 :: \"('a \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> 'a nrest) \\<Rightarrow> 'a \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> 'a nrest\" where\n  \"for_rec2 f a n 0 0 = f a 0 0\" |\n  \"for_rec2 f a n (Suc i) 0 = for_rec2 f a n i n \\<bind> (\\<lambda> a. f a (Suc i) 0)\" |\n  \"for_rec2 f a n i (Suc j) = for_rec2 f a n i j \\<bind> (\\<lambda> a. f a i (Suc j))\"\n\nprivate lemma for_rec2_for_rec2':\n  \"for_rec2 f a n i j = for_rec2' f a n i j\"\nunfolding for_rec2'_def\n apply (induction f a n i j rule: for_rec2.induct)\n apply simp_all\n subgoal for f a n i\n  apply (cases i)\n by auto\ndone\n\nfun for_rec3 :: \"('a \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> 'a nrest) \\<Rightarrow> 'a \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> 'a nrest\"\nwhere\n  \"for_rec3 f m n 0       0       0        = f m 0 0 0\" |\n  \"for_rec3 f m n (Suc k) 0       0        = for_rec3 f m n k n n \\<bind> (\\<lambda> a. f a (Suc k) 0 0)\" |\n  \"for_rec3 f m n k       (Suc i) 0        = for_rec3 f m n k i n \\<bind> (\\<lambda> a. f a k (Suc i) 0)\" |\n  \"for_rec3 f m n k       i       (Suc j)  = for_rec3 f m n k i j \\<bind> (\\<lambda> a. f a k i (Suc j))\"\n\nprivate definition for_rec3' where\n  \"for_rec3' f a n k i j =\n    (if k = 0 then RETURNT a else for_rec (\\<lambda>a k. for_rec2' (\\<lambda> a. f a k) a n n n) a (k - 1))\n    \\<bind> (\\<lambda> a. for_rec2' (\\<lambda> a. f a k) a n i j)\"\n\nprivate lemma for_rec3_for_rec3':\n  \"for_rec3 f a n k i j = for_rec3' f a n k i j\"\nunfolding for_rec3'_def\n apply (induction f a n k i j rule: for_rec3.induct)\n apply (simp_all add: for_rec2_for_rec2'[symmetric])\n subgoal for f a n k\n  apply (cases k)\n by auto\ndone\n\nprivate lemma for_rec2'_for_rec:\n  \"for_rec2' f a n n n =\n    for_rec (\\<lambda>a i. for_rec (\\<lambda> a. f a i) a n) a n\"\nunfolding for_rec2'_def by (cases n) auto\n\nprivate lemma for_rec3'_for_rec:\n  \"for_rec3' f a n n n n =\n    for_rec (\\<lambda> a k. for_rec (\\<lambda>a i. for_rec (\\<lambda> a. f a k i) a n) a n) a n\"\nunfolding for_rec3'_def for_rec2'_for_rec by (cases n) auto\n\ntheorem for_rec_eq:\n  \"for_rec f a n = nfoldli [0..<n + 1] (\\<lambda>x. True) (\\<lambda>k a. f a k) a\"\nusing for_comb_for_rec[unfolded for_comb_def, symmetric] .\n\ntheorem for_rec2_eq:\n  \"for_rec2 f a n n n =\n     nfoldli [0..<n + 1] (\\<lambda>x. True)\n           (\\<lambda>i. nfoldli [0..<n + 1] (\\<lambda>x. True) (\\<lambda>j a. f a i j)) a\"\nusing\n  for_rec2'_for_rec[\n    unfolded for_rec2_for_rec2'[symmetric], unfolded for_comb_for_rec[symmetric] for_comb_def\n  ] .\n\ntheorem for_rec3_eq:\n  \"for_rec3 f a n n n n =\n    nfoldli [0..<n + 1] (\\<lambda>x. True)\n     (\\<lambda>k. nfoldli [0..<n + 1] (\\<lambda>x. True)\n           (\\<lambda>i. nfoldli [0..<n + 1] (\\<lambda>x. True) (\\<lambda>j a. f a k i j)))\n     a\"\nusing\n  for_rec3'_for_rec[\n    unfolded for_rec3_for_rec3'[symmetric], unfolded for_comb_for_rec[symmetric] for_comb_def\n  ] .\n\nend\n\nlemmas [intf_of_assn] = intf_of_assnI[where R= \"is_mtx n\" and 'a= \"'b i_mtx\" for n]\n\ndeclare param_upt[sepref_import_param]\n\n\nend\n", "meta": {"author": "maxhaslbeck", "repo": "Sepreftime", "sha": "c1c987b45ec886d289ba215768182ac87b82f20d", "save_path": "github-repos/isabelle/maxhaslbeck-Sepreftime", "path": "github-repos/isabelle/maxhaslbeck-Sepreftime/Sepreftime-c1c987b45ec886d289ba215768182ac87b82f20d/Examples/FloydWarshall/Recursion_Combinators.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.31602342749415063}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory SubMonadLib\nimports\n  Monads.Empty_Fail\n  Corres_UL\nbegin\n\nlocale submonad_args =\n  fixes fetch :: \"'a \\<Rightarrow> 'b\"\n  fixes replace :: \"'b \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  fixes guard :: \"'a \\<Rightarrow> bool\"\n\n  assumes args:\n   \"\\<forall>x s. guard s \\<longrightarrow> fetch (replace x s) = x\"\n   \"\\<forall>x y s. replace x (replace y s) = replace x s\"\n   \"\\<forall>s. replace (fetch s) s = s\"\n\n  assumes replace_preserves_guard:\n   \"\\<And>s x. guard (replace x s) = guard s\"\n\ndefinition\n  submonad_fn :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow>\n                  ('b, 'c) nondet_monad \\<Rightarrow> ('a, 'c) nondet_monad\"\nwhere\n \"submonad_fn fetch replace guard m \\<equiv> do\n    stateAssert guard [];\n    substate \\<leftarrow> gets fetch;\n    (rv, substate') \\<leftarrow> select_f (m substate);\n    modify (replace substate');\n    return rv\n  od\"\n\nlocale submonad = submonad_args +\n  fixes fn :: \"('b, 'c) nondet_monad \\<Rightarrow> ('a, 'c) nondet_monad\"\n\n  assumes fn_is_sm: \"fn = submonad_fn fetch replace guard\"\n\nlemma (in submonad_args) argsD1:\n  \"\\<And>x s. guard s \\<Longrightarrow> fetch (replace x s) = x\"\n  by (simp add: args)\n\nlemma (in submonad) guarded_sm:\n  \"\\<And>s. guard s \\<Longrightarrow>\n   fn m s = (do\n     substate \\<leftarrow> gets fetch;\n     (rv, substate') \\<leftarrow> select_f (m substate);\n     modify (replace substate');\n     return rv\n   od) s\"\n  unfolding fn_is_sm submonad_fn_def\n  by (simp add: stateAssert_def get_def assert_def bind_def return_def)\n\nlemma modify_modify:\n  \"modify fn1 >>= (\\<lambda>x. modify fn2) = modify (fn2 \\<circ> fn1)\"\n  by (simp add: bind_def modify_def get_def put_def)\n\nlemma select_f_walk:\n  assumes m1: \"empty_fail m1\"\n  assumes S: \"fst S = {} \\<Longrightarrow> snd S\"\n  shows \"(do a \\<leftarrow> m1; b \\<leftarrow> select_f S; m2 a b od) = (do b \\<leftarrow> select_f S; a \\<leftarrow> m1; m2 a b od)\"\n  apply (rule ext)\n  apply (rule prod.expand)\n  apply (rule conjI)\n   apply (simp add: select_f_def bind_def split_def)\n   apply fastforce\n  apply (simp add: select_f_def bind_def split_def)\n  apply (case_tac \"fst S = {}\")\n   apply clarsimp\n   apply (case_tac \"fst (m1 x) = {}\")\n    apply (simp add: empty_failD [OF m1] S)\n   apply (frule S)\n   apply force\n  apply safe\n     apply clarsimp\n     apply force\n    apply force\n   apply clarsimp\n   apply force\n  apply clarsimp\n  apply (case_tac \"fst (m1 x) = {}\", simp add: empty_failD [OF m1])\n  apply force\n  done\n\nlemma stateAssert_stateAssert:\n  \"(stateAssert g [] >>= (\\<lambda>u. stateAssert g' [])) = stateAssert (g and g') []\"\n  by (simp add: ext stateAssert_def bind_def get_def assert_def fail_def return_def)\n\nlemma modify_stateAssert:\n  \"\\<lbrakk> \\<And>s x. g (r x s) = g s \\<rbrakk> \\<Longrightarrow>\n   (modify (r x) >>= (\\<lambda>u. stateAssert g []))\n            = (stateAssert g [] >>= (\\<lambda>u. modify (r x)))\"\n  by (simp add: ext stateAssert_def bind_def get_def assert_def fail_def\n                return_def modify_def put_def)\n\nlemma gets_stateAssert:\n  \"(gets f >>= (\\<lambda>x. stateAssert g' [] >>= (\\<lambda>u. m x)))\n            = (stateAssert g' [] >>= (\\<lambda>u. gets f >>= (\\<lambda>x. m x)))\"\n  by (simp add: ext stateAssert_def bind_def gets_def get_def\n                assert_def fail_def return_def)\n\nlemma select_f_stateAssert:\n  \"empty_fail m \\<Longrightarrow>\n   (select_f (m a) >>= (\\<lambda>x. stateAssert g [] >>= (\\<lambda>u. n x))) =\n   (stateAssert g [] >>= (\\<lambda>u. select_f (m a) >>= (\\<lambda>x. n x)))\"\n  apply (rule ext)\n  apply (clarsimp simp: stateAssert_def bind_def select_f_def get_def\n                        assert_def return_def fail_def split_def image_image)\n  apply (simp only: image_def)\n  apply (clarsimp simp: stateAssert_def bind_def select_f_def get_def\n                        assert_def return_def fail_def split_def image_image)\n  apply (simp only: image_def mem_simps empty_fail_def simp_thms)\n  apply fastforce\n  done\n\nlemma bind_select_f_bind':\n  shows \"(select_f (m s) >>= (\\<lambda>x. select_f (split n x))) = (select_f ((m >>= n) s))\"\n  apply (rule ext)\n  apply (force simp: select_f_def bind_def split_def)\n  done\n\nlemma bind_select_f_bind:\n  \"(select_f (m1 s) >>= (\\<lambda>x. select_f (m2 (fst x) (snd x)))) = (select_f ((m1 >>= m2) s))\"\n  by (insert bind_select_f_bind' [where m=m1 and n=m2 and s=s],\n      simp add: split_def)\n\nlemma select_from_gets: \"select_f (gets f s) = return (f s, s)\"\n  apply (rule ext)\n  apply (simp add: select_f_def return_def simpler_gets_def)\n  done\n\nlemma select_from_gets':\n  \"(select_f \\<circ> gets f) = (\\<lambda>s. return (f s, s))\"\n  apply (rule ext)\n  apply (simp add: o_def select_from_gets)\n  done\n\nlemma bind_subst_lift:\n  \"(f >>= g) = h \\<Longrightarrow> (do x \\<leftarrow> f; y \\<leftarrow> g x; j y od) = (h >>= j)\"\n  by (simp add: bind_assoc[symmetric])\n\nlemma modify_gets:\n  \"\\<lbrakk> \\<And>x s. g (r x s) = g s; \\<And>x s. g s \\<longrightarrow> f (r x s) = x \\<rbrakk>\n   \\<Longrightarrow> (modify (r x) >>= (\\<lambda>u. stateAssert g [] >>= (\\<lambda>u'. gets f)))\n            = (stateAssert g [] >>= (\\<lambda>u'. modify (r x) >>= (\\<lambda>u. return x)))\"\n  by (simp add: ext stateAssert_def assert_def modify_def bind_def get_def\n                put_def gets_def return_def fail_def)\n\nlemma (in submonad_args) gets_modify:\n  \"\\<And>s. guard s \\<Longrightarrow>\n   (do x \\<leftarrow> gets fetch; u \\<leftarrow> modify (replace x); f x od) s = ((gets fetch) >>= f) s\"\n  by (clarsimp simp: modify_def gets_def return_def bind_def\n                     put_def args get_def\n              split: option.split)\n\nlemma submonad_bind:\n  \"\\<lbrakk> submonad f r g m; submonad f r g m'; submonad f r g m'';\n     empty_fail a; \\<And>x. empty_fail (b x) \\<rbrakk> \\<Longrightarrow>\n   m (a >>= b) = (m' a) >>= (\\<lambda>rv. m'' (b rv))\"\n  apply (subst submonad.fn_is_sm, assumption)+\n  apply (clarsimp simp: submonad_def bind_assoc split_def submonad_fn_def)\n  apply (subst bind_subst_lift [OF modify_gets, unfolded bind_assoc])\n    apply (simp add: submonad_args.args submonad_args.replace_preserves_guard)+\n  apply (subst select_f_stateAssert, assumption)\n  apply (subst gets_stateAssert)\n  apply (subst bind_subst_lift [OF stateAssert_stateAssert])\n  apply (clarsimp simp: bind_assoc split_def select_f_walk empty_failD pred_conj_def\n                        bind_subst_lift[OF modify_modify] submonad_args.args o_def\n                        bind_subst_lift[OF bind_select_f_bind])\n  done\n\nlemma (in submonad) guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> (rv, s') \\<in> fst (fn m s) \\<rbrakk> \\<Longrightarrow> guard s'\"\n  unfolding fn_is_sm submonad_fn_def\n  by (clarsimp simp: stateAssert_def gets_def get_def bind_def modify_def put_def\n                     return_def select_f_def replace_preserves_guard in_monad)\n\nlemma fst_stateAssertD:\n  \"\\<And>s s' v. (v, s') \\<in> fst (stateAssert g [] s) \\<Longrightarrow> s' = s \\<and> g s\"\n  by (clarsimp simp: stateAssert_def in_monad)\n\nlemma(in submonad) guarded_gets:\n  \"\\<And>s. guard s \\<Longrightarrow> fn (gets f) s = gets (f \\<circ> fetch) s\"\n  apply (simp add: guarded_sm select_from_gets gets_modify)\n  apply (simp add: gets_def)\n  done\n\nlemma (in submonad) guarded_return:\n  \"\\<And>s. guard s \\<Longrightarrow> fn (return x) s = return x s\"\n  using args guarded_gets\n  by (fastforce simp: gets_def bind_def get_def)\n\nlemma (in submonad_args) submonad_fn_gets:\n  \"submonad_fn fetch replace guard (gets f) =\n   (stateAssert guard [] >>= (\\<lambda>u. gets (f \\<circ> fetch)))\"\n  apply (simp add: ext select_from_gets submonad_fn_def)\n  apply (rule bind_cong [OF refl])\n  apply (clarsimp simp: gets_modify dest!: fst_stateAssertD)\n  apply (simp add: gets_def)\n  done\n\nlemma(in submonad) gets:\n  \"fn (gets f) = (stateAssert guard [] >>= (\\<lambda>u. gets (f \\<circ> fetch)))\"\n  unfolding fn_is_sm submonad_fn_gets\n  by (rule refl)\n\nlemma (in submonad) return:\n  \"fn (return x) = (stateAssert guard [] >>= (\\<lambda>u. return x))\"\n  using args gets\n  by (fastforce simp: gets_def bind_def get_def)\n\nlemma (in submonad) mapM_guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> guard s; \\<exists>rv. (rv, s') \\<in> fst (mapM (fn \\<circ> m) xs s)\\<rbrakk> \\<Longrightarrow> guard s'\"\nproof (induct xs)\n  case Nil\n  thus ?case\n    by (simp add: mapM_def sequence_def return_def)\n  next\n  case (Cons x xs)\n  thus ?case\n    apply (clarsimp simp: o_def mapM_Cons return_def bind_def)\n    apply (drule guard_preserved)\n    apply fastforce\n    done\nqed\n\nlemma (in submonad) mapM_x_guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> guard s; \\<exists>rv. (rv, s') \\<in> fst (mapM_x (fn \\<circ> m) xs s)\\<rbrakk> \\<Longrightarrow> guard s'\"\nproof (induct xs)\n  case Nil\n  thus ?case\n    by (simp add: mapM_x_def sequence_x_def return_def)\n  next\n  case (Cons x xs)\n  thus ?case\n    apply (clarsimp simp: o_def mapM_x_Cons return_def bind_def)\n    apply (drule guard_preserved)\n    apply fastforce\n    done\nqed\n\nlemma (in submonad) stateAssert_fn:\n  \"stateAssert guard [] >>= (\\<lambda>u. fn m) = fn m\"\n  by (simp add: fn_is_sm submonad_fn_def pred_conj_def\n                bind_subst_lift [OF stateAssert_stateAssert])\n\nlemma (in submonad) fn_stateAssert:\n  \"fn m >>= (\\<lambda>x. stateAssert guard [] >>= (\\<lambda>u. n x)) = (fn m >>= n)\"\n  apply (simp add: fn_is_sm submonad_fn_def bind_assoc split_def)\n  apply (rule ext)\n  apply (rule bind_apply_cong [OF refl])+\n  apply (clarsimp simp: stateAssert_def bind_assoc in_monad select_f_def)\n  apply (drule iffD2 [OF replace_preserves_guard])\n  apply (fastforce simp: bind_def assert_def get_def return_def)\n  done\n\nlemma submonad_mapM:\n  assumes sm: \"submonad f r g sm\" and sm': \"submonad f r g sm'\"\n  assumes efm: \"\\<And>x. empty_fail (m x)\"\n  shows\n  \"(sm (mapM m l)) = (stateAssert g [] >>= (\\<lambda>u. mapM (sm' \\<circ> m) l))\"\nproof (induct l)\n  case Nil\n  thus ?case\n    by (simp add: mapM_def sequence_def bind_def submonad.return [OF sm])\n  next\n  case (Cons x xs)\n  thus ?case\n    using sm sm' efm\n    apply (simp add: mapM_Cons)\n    apply (simp add: bind_subst_lift [OF submonad.stateAssert_fn])\n    apply (simp add: bind_assoc submonad_bind submonad.return empty_fail_cond)\n    apply (subst submonad.fn_stateAssert [OF sm'])\n    apply (intro ext bind_apply_cong [OF refl])\n    apply (subgoal_tac \"g sta\")\n     apply (clarsimp simp: stateAssert_def bind_def get_def assert_def return_def)\n    apply (frule(1) submonad.guard_preserved)\n    apply (erule(1) submonad.mapM_guard_preserved, fastforce simp: o_def)\n    done\nqed\n\nlemma submonad_mapM_x:\n  assumes sm: \"submonad f r g sm\" and sm': \"submonad f r g sm'\"\n  assumes efm: \"\\<And>x. empty_fail (m x)\"\n  shows\n  \"(sm (mapM_x m l)) = (stateAssert g [] >>= (\\<lambda>u. mapM_x (sm' \\<circ> m) l))\"\nproof (induct l)\n  case Nil\n  thus ?case\n    by (simp add: mapM_x_def sequence_x_def bind_def submonad.return [OF sm])\n  next\n  case (Cons x xs)\n  thus ?case\n    using sm sm' efm\n    apply (simp add: mapM_x_Cons)\n    apply (simp add: bind_subst_lift [OF submonad.stateAssert_fn])\n    apply (simp add: bind_assoc submonad_bind submonad.return)\n    apply (subst submonad.fn_stateAssert [OF sm'])\n    apply (intro ext bind_apply_cong [OF refl])\n    apply (subgoal_tac \"g st\")\n     apply (clarsimp simp: stateAssert_def bind_def get_def assert_def return_def)\n    apply (frule(1) submonad.guard_preserved, simp)\n    done\nqed\n\nlemma corres_select:\n  \"(\\<forall>s' \\<in> S'. \\<exists>s \\<in> S. rvr s s') \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select S) (select S')\"\n  by (clarsimp simp: select_def corres_underlying_def)\n\nlemma corres_select_f:\n  \"\\<lbrakk> \\<forall>s' \\<in> fst S'. \\<exists>s \\<in> fst S. rvr s s'; nf' \\<Longrightarrow> \\<not> snd S' \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select_f S) (select_f S')\"\n  by (clarsimp simp: select_f_def corres_underlying_def)\n\nlemma corres_modify':\n  \"\\<lbrakk> (\\<forall>s s'. (s, s') \\<in> sr \\<longrightarrow> (f s, f' s') \\<in> sr); r () () \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' r \\<top> \\<top> (modify f) (modify f')\"\n  by (clarsimp simp: modify_def corres_underlying_def bind_def get_def put_def)\n\n(* FIXME: this should only be used for the lemma below *)\nlemma corres_select_f_stronger:\n  \"\\<lbrakk> \\<forall>s' \\<in> fst S'. \\<exists>s \\<in> fst S. rvr s s'; nf' \\<Longrightarrow> \\<not> snd S' \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select_f S) (select_f S')\"\n  by (clarsimp simp: select_f_def corres_underlying_def)\n\nlemma stateAssert_sp:\n  \"\\<lbrace>P\\<rbrace> stateAssert Q l \\<lbrace>\\<lambda>_. P and Q\\<rbrace>\"\n  by (clarsimp simp: valid_def stateAssert_def in_monad)\n\nlemma corres_submonad:\n  \"\\<lbrakk> submonad f r g fn; submonad f' r' g' fn';\n     \\<forall>s s'. (s, s') \\<in> sr \\<and> g s \\<and> g' s' \\<longrightarrow> (f s, f' s') \\<in> ssr;\n     \\<forall>s s' ss ss'. ((s, s') \\<in> sr \\<and> (ss, ss') \\<in> ssr) \\<longrightarrow> (r ss s, r' ss' s') \\<in> sr;\n     corres_underlying ssr False nf' rvr \\<top> \\<top> x x'\\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr False nf' rvr g g' (fn x) (fn' x')\"\n  apply (subst submonad.fn_is_sm, assumption)+\n  apply (clarsimp simp: submonad_fn_def)\n  apply (rule corres_underlying_split [OF _ _ stateAssert_sp stateAssert_sp])\n   apply (fastforce simp: corres_underlying_def stateAssert_def get_def\n                         assert_def return_def bind_def)\n  apply (rule corres_underlying_split [where r'=\"\\<lambda>x y. (x, y) \\<in> ssr\",\n                             OF _ _ hoare_post_taut hoare_post_taut])\n   apply clarsimp\n  apply (rule corres_underlying_split [where r'=\"\\<lambda>(x, x') (y, y'). rvr x y \\<and> (x', y') \\<in> ssr\",\n                             OF _ _ hoare_post_taut hoare_post_taut])\n   defer\n   apply clarsimp\n   apply (rule corres_underlying_split [where r'=dc, OF _ _ hoare_post_taut hoare_post_taut])\n    apply (simp add: corres_modify')\n   apply clarsimp\n  apply (rule corres_select_f_stronger)\n   apply (clarsimp simp: corres_underlying_def)\n   apply (drule (1) bspec, clarsimp)\n   apply (drule (1) bspec, simp)\n   apply blast\n  apply (clarsimp simp: corres_underlying_def)\n  apply (drule (1) bspec, clarsimp)\n  done\n\nlemma stateAssert_top [simp]:\n  \"stateAssert \\<top> l >>= f = f ()\"\n  by (clarsimp simp add: stateAssert_def get_def bind_def return_def)\n\nlemma stateAssert_A_top [simp]:\n  \"stateAssert \\<top> l = return ()\"\n  by (simp add: stateAssert_def get_def bind_def return_def)\n\ntext \\<open>Use of the submonad concept to demonstrate commutativity.\\<close>\n\nlemma gets_modify_comm:\n  \"\\<And> s. \\<lbrakk> g (f s) = g s \\<rbrakk> \\<Longrightarrow>\n   (do x \\<leftarrow> modify f; y \\<leftarrow> gets g; m x y od) s =\n   (do y \\<leftarrow> gets g; x \\<leftarrow> modify f; m x y od) s\"\n  by (simp add: modify_def gets_def get_def bind_def put_def return_def)\n\nlemma bind_subst_lhs_inv:\n  \"\\<And>s. \\<lbrakk> \\<And>x s'. P s' \\<Longrightarrow> (f x >>= g x) s' = h x s'; \\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>_. P\\<rbrace>; P s \\<rbrakk> \\<Longrightarrow>\n   (do x \\<leftarrow> a; y \\<leftarrow> f x; g x y od) s = (a >>= h) s\"\n  apply (rule bind_apply_cong [OF refl])\n  apply (drule(2) use_valid)\n  apply simp\n  done\n\nlemma gets_comm:\n  \"do x \\<leftarrow> gets f; y \\<leftarrow> gets g; m x y od = do y \\<leftarrow> gets g; x \\<leftarrow> gets f; m x y od\"\n  by (simp add: gets_def get_def return_def bind_def)\n\nlemma submonad_comm:\n  assumes x1: \"submonad_args f r g\" and x2: \"submonad_args f' r' g'\"\n  assumes y: \"m = submonad_fn f r g im\" \"m' = submonad_fn f' r' g' im'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"(do x \\<leftarrow> m; y \\<leftarrow> m'; n x y od) = (do y \\<leftarrow> m'; x \\<leftarrow> m; n x y od)\"\nproof -\n  have P: \"\\<And>x s. g s \\<Longrightarrow> f (r' x s) = f s\"\n    apply (subgoal_tac \"f (r' x (r (f s) s)) = f s\")\n     apply (simp add: submonad_args.args[OF x1])\n    apply (simp add: z[symmetric])\n    apply (subst(asm) gp [symmetric])\n    apply (fastforce dest: submonad_args.argsD1[OF x1])\n    done\n  have Q: \"\\<And>x s. g' s \\<Longrightarrow> f' (r x s) = f' s\"\n    apply (subgoal_tac \"f' (r x (r' (f' s) s)) = f' s\")\n     apply (simp add: submonad_args.args[OF x2])\n    apply (simp add: z)\n    apply (subst(asm) gp' [symmetric])\n    apply (fastforce dest: submonad_args.argsD1[OF x2])\n    done\n  note empty_failD [OF efim, simp]\n  note empty_failD [OF efim', simp]\n  note empty_fail_select_f[simp]\n  show ?thesis\n    apply (clarsimp simp: submonad_fn_def y bind_assoc split_def)\n    apply (subst bind_subst_lift [OF modify_stateAssert], rule gp gp')+\n    apply (simp add: bind_assoc)\n    apply (subst select_f_stateAssert, rule efim efim')+\n    apply (subst gets_stateAssert bind_subst_lift [OF stateAssert_stateAssert])+\n    apply (rule bind_cong)\n     apply (simp add: pred_conj_def conj_comms)\n    apply (simp add: bind_assoc select_f_walk[symmetric])\n    apply (clarsimp dest!: fst_stateAssertD)\n    apply (subst bind_assoc[symmetric],\n           subst bind_subst_lhs_inv [OF gets_modify_comm],\n           erule P Q, wp, simp, simp)+\n    apply (simp add: bind_assoc)\n    apply (simp add: select_f_walk[symmetric])\n    apply (subst gets_comm)\n    apply (rule bind_apply_cong [OF refl])+\n    apply (subst select_f_walk, simp, simp,\n           subst select_f_walk, simp, simp,\n           rule bind_apply_cong [OF refl])\n    apply (subst select_f_walk, simp, simp, rule bind_apply_cong [OF refl])\n    apply (clarsimp simp: simpler_gets_def select_f_def)\n    apply (simp add: bind_def get_def put_def modify_def z)\n    done\nqed\n\nlemma submonad_comm2:\n  assumes x1: \"submonad_args f r g\" and x2: \"m = submonad_fn f r g im\"\n  assumes y: \"submonad f' r' g' m'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"do x \\<leftarrow> m; y \\<leftarrow> m' im'; n x y od = do y \\<leftarrow> m' im'; x \\<leftarrow> m; n x y od\"\n  apply (rule submonad_comm[where f'=f' and r'=r', OF x1 _ x2 _ z])\n       apply (insert y)\n       apply (fastforce simp add: submonad_def)\n      apply (fastforce dest: submonad.fn_is_sm)\n     apply (simp add: efim efim' gp gp')+\n  done\n\nlemma submonad_bind_alt:\n  assumes x: \"submonad_args f r g\"\n  assumes y: \"a = submonad_fn f r g a'\" \"\\<And>rv. b rv = submonad_fn f r g (b' rv)\"\n  assumes efa: \"empty_fail a'\" and efb: \"\\<And>x. empty_fail (b' x)\"\n  shows      \"(a >>= b) = submonad_fn f r g (a' >>= b')\"\nproof -\n  have P: \"submonad f r g (submonad_fn f r g)\"\n    by (simp add: x submonad_def submonad_axioms_def)\n  have Q: \"b = (\\<lambda>rv. submonad_fn f r g (b' rv))\"\n    by (rule ext) fact+\n  show ?thesis\n    by (simp add: y Q submonad_bind [OF P P P efa efb])\nqed\n\nlemma submonad_singleton:\n  \"submonad_fn fetch replace \\<top> (\\<lambda>s. ({(rv s, s' s)}, False))\n     = (\\<lambda>s. ({(rv (fetch s), replace (s' (fetch s)) s)}, False))\"\n  apply (rule ext)\n  apply (simp add: submonad_fn_def bind_def gets_def\n                put_def get_def modify_def return_def\n                select_f_def UNION_eq)\n  done\n\nlemma gets_submonad:\n  \"\\<lbrakk> submonad_args fetch replace \\<top>; \\<And>s. f s = f' (fetch s); m = gets f' \\<rbrakk>\n   \\<Longrightarrow> gets f = submonad_fn fetch replace \\<top> m\"\n  apply (drule submonad_args.args(3))\n  apply (clarsimp simp add: simpler_gets_def submonad_singleton)\n  done\n\nlemma modify_submonad:\n  \"\\<lbrakk> \\<And>s. f s = replace (K_record (f' (fetch s))) s; m = modify f' \\<rbrakk>\n     \\<Longrightarrow> modify f = submonad_fn fetch (replace o K_record) \\<top> m\"\n  by (simp add: simpler_modify_def submonad_singleton)\n\nlemma fail_submonad:\n  \"fail = submonad_fn fetch replace \\<top> fail\"\n  by (simp add: submonad_fn_def simpler_gets_def return_def\n                simpler_modify_def select_f_def bind_def fail_def)\n\nlemma return_submonad:\n  \"submonad_args fetch replace guard \\<Longrightarrow>\n   return v = submonad_fn fetch replace \\<top> (return v)\"\n  by (simp add: return_def submonad_singleton submonad_args.args)\n\nlemma assert_opt_submonad:\n  \"submonad_args fetch replace \\<top> \\<Longrightarrow>\n   assert_opt v = submonad_fn fetch replace \\<top> (assert_opt v)\"\n  apply (case_tac v, simp_all add: assert_opt_def)\n   apply (rule fail_submonad)\n  apply (rule return_submonad)\n  apply assumption\n  done\n\nlemma is_stateAssert_gets:\n  \"\\<lbrakk> \\<forall>s. \\<lbrace>(=) s\\<rbrace> f \\<lbrace>\\<lambda>_. (=) s\\<rbrace>; \\<lbrace>\\<top>\\<rbrace> f \\<lbrace>\\<lambda>_. guard\\<rbrace>;\n     empty_fail f; no_fail guard f; \\<lbrace>guard\\<rbrace> f \\<lbrace>\\<lambda>rv s. fetch s = rv\\<rbrace> \\<rbrakk>\n    \\<Longrightarrow> f = do stateAssert guard []; gets fetch od\"\n  apply (rule ext)\n  apply (clarsimp simp: bind_def empty_fail_def valid_def no_fail_def\n                        stateAssert_def assert_def gets_def get_def\n                        return_def fail_def image_def split_def)\n  apply (case_tac \"f x\")\n  apply (intro conjI impI)\n   apply (drule_tac x=x in spec)+\n   apply (subgoal_tac \"\\<forall>xa\\<in>fst (f x). fst xa = fetch x \\<and> snd xa = x\")\n    apply fastforce\n   apply clarsimp\n  apply (drule_tac x=x in spec)+\n  apply fastforce\n  done\n\nlemma is_modify:\n  \"\\<And>s. \\<lbrakk> \\<lbrace>(=) s\\<rbrace> f \\<lbrace>\\<lambda>_. (=) (replace s)\\<rbrace>; empty_fail f;\n          no_fail guard f; guard s \\<rbrakk>\n    \\<Longrightarrow> f s = modify replace s\"\n  apply (clarsimp simp: bind_def empty_fail_def valid_def no_fail_def\n                        stateAssert_def assert_def modify_def get_def put_def\n                        return_def fail_def image_def split_def)\n  apply (case_tac \"f s\")\n  apply force\n  done\n\nlemma submonad_comm':\n  assumes sm1: \"submonad f r g m\" and sm2: \"submonad f' r' g' m'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"(do x \\<leftarrow> m im; y \\<leftarrow> m' im'; n x y od) =\n              (do y \\<leftarrow> m' im'; x \\<leftarrow> m im; n x y od)\"\n  apply (rule submonad_comm [where f'=f' and r'=r', OF _ _ _ _ z])\n         apply (insert sm1 sm2)\n         apply (fastforce dest: submonad.fn_is_sm simp: submonad_def)+\n     apply (simp add: efim efim' gp gp')+\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/SubMonadLib.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.31602342749415063}}
{"text": "theory Keep_Drop\n  imports Base\nbegin\n\ndefinition Keep_Drop where \n  \"Keep_Drop \\<Gamma> K D \\<equiv> \\<Gamma> \\<Longrightarrow>\\<^sub>A K * D\"\n\nlemma init:\n  assumes\n    \"\\<Gamma> \\<Longrightarrow>\\<^sub>A K * D\"\n  shows\n    \"Keep_Drop \\<Gamma> K D\"\n  unfolding Keep_Drop_def\n  using assms by simp\n\nlemma split:\n  assumes\n    \"\\<Gamma>\\<^sub>1 \\<Longrightarrow>\\<^sub>A K\\<^sub>1 * D\\<^sub>1\"\n    \"\\<Gamma>\\<^sub>2 \\<Longrightarrow>\\<^sub>A K\\<^sub>2 * D\\<^sub>2\"\n  shows \n    \"\\<Gamma>\\<^sub>1 * \\<Gamma>\\<^sub>2 \\<Longrightarrow>\\<^sub>A (K\\<^sub>1 * K\\<^sub>2) * (D\\<^sub>1 * D\\<^sub>2)\" \n  apply(sep_drule r: assms(1))\n  apply(sep_drule r: assms(2))\n  by sep_auto\n\nlemma keep: \n  assumes\n    \"\\<Gamma> \\<Longrightarrow>\\<^sub>A \\<Gamma>'\"\n  shows\n    \"\\<Gamma> \\<Longrightarrow>\\<^sub>A \\<Gamma>' * emp\"\n  using assms\n  by sep_auto\n\nlemma drop: \"\\<Gamma> \\<Longrightarrow>\\<^sub>A emp * \\<Gamma>\"\n  by simp\n\nmethod keep_drop_step methods keep_atom =\n  rule split | (rule keep, keep_atom) | rule drop\n\nmethod keep_drop methods keep_atom = \n  rule init, ((keep_drop_step keep_atom)+; fail)\n\nend\n", "meta": {"author": "balazstothofficial", "repo": "arrays-in-isabelle", "sha": "9d5dd28b0b3d245dae534d546879045a54b4244f", "save_path": "github-repos/isabelle/balazstothofficial-arrays-in-isabelle", "path": "github-repos/isabelle/balazstothofficial-arrays-in-isabelle/arrays-in-isabelle-9d5dd28b0b3d245dae534d546879045a54b4244f/Keep_Drop.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.31602341931947436}}
{"text": "(*  Title:      HOL/MicroJava/BV/JType.thy\n    Author:     Tobias Nipkow, Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nsection {* The Java Type System as Semilattice *}\n\ntheory JType\nimports \"../DFA/Semilattices\" \"../J/WellForm\"\nbegin\n\ndefinition super :: \"'a prog \\<Rightarrow> cname \\<Rightarrow> cname\" where\n  \"super G C == fst (the (class G C))\"\n\nlemma superI:\n  \"G \\<turnstile> C \\<prec>C1 D \\<Longrightarrow> super G C = D\"\n  by (unfold super_def) (auto dest: subcls1D)\n\ndefinition is_ref :: \"ty \\<Rightarrow> bool\" where\n  \"is_ref T == case T of PrimT t \\<Rightarrow> False | RefT r \\<Rightarrow> True\"\n\ndefinition sup :: \"'c prog \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> ty err\" where\n  \"sup G T1 T2 ==\n  case T1 of PrimT P1 \\<Rightarrow> (case T2 of PrimT P2 \\<Rightarrow> \n                         (if P1 = P2 then OK (PrimT P1) else Err) | RefT R \\<Rightarrow> Err)\n           | RefT R1 \\<Rightarrow> (case T2 of PrimT P \\<Rightarrow> Err | RefT R2 \\<Rightarrow> \n  (case R1 of NullT \\<Rightarrow> (case R2 of NullT \\<Rightarrow> OK NT | ClassT C \\<Rightarrow> OK (Class C))\n            | ClassT C \\<Rightarrow> (case R2 of NullT \\<Rightarrow> OK (Class C) \n                           | ClassT D \\<Rightarrow> OK (Class (exec_lub (subcls1 G) (super G) C D)))))\"\n\ndefinition subtype :: \"'c prog \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> bool\" where\n  \"subtype G T1 T2 == G \\<turnstile> T1 \\<preceq> T2\"\n\ndefinition is_ty :: \"'c prog \\<Rightarrow> ty \\<Rightarrow> bool\" where\n  \"is_ty G T == case T of PrimT P \\<Rightarrow> True | RefT R \\<Rightarrow>\n               (case R of NullT \\<Rightarrow> True | ClassT C \\<Rightarrow> (C, Object) \\<in> (subcls1 G)^*)\"\n\nabbreviation \"types G == Collect (is_type G)\"\n\ndefinition esl :: \"'c prog \\<Rightarrow> ty esl\" where\n  \"esl G == (types G, subtype G, sup G)\"\n\nlemma PrimT_PrimT: \"(G \\<turnstile> xb \\<preceq> PrimT p) = (xb = PrimT p)\"\n  by (auto elim: widen.cases)\n\nlemma PrimT_PrimT2: \"(G \\<turnstile> PrimT p \\<preceq> xb) = (xb = PrimT p)\"\n  by (auto elim: widen.cases)\n\nlemma is_tyI:\n  \"\\<lbrakk> is_type G T; ws_prog G \\<rbrakk> \\<Longrightarrow> is_ty G T\"\n  by (auto simp add: is_ty_def intro: subcls_C_Object \n           split: ty.splits ref_ty.splits)\n\nlemma is_type_conv: \n  \"ws_prog G \\<Longrightarrow> is_type G T = is_ty G T\"\nproof\n  assume \"is_type G T\" \"ws_prog G\" \n  thus \"is_ty G T\"\n    by (rule is_tyI)\nnext\n  assume wf: \"ws_prog G\" and\n         ty: \"is_ty G T\"\n\n  show \"is_type G T\"\n  proof (cases T)\n    case PrimT\n    thus ?thesis by simp\n  next\n    fix R assume R: \"T = RefT R\"\n    with wf\n    have \"R = ClassT Object \\<Longrightarrow> ?thesis\" by simp\n    moreover    \n    from R wf ty\n    have \"R \\<noteq> ClassT Object \\<Longrightarrow> ?thesis\"\n     by (auto simp add: is_ty_def is_class_def split_tupled_all\n               elim!: subcls1.cases\n               elim: converse_rtranclE\n               split: ref_ty.splits)\n    ultimately    \n    show ?thesis by blast\n  qed\nqed\n\nlemma order_widen:\n  \"acyclic (subcls1 G) \\<Longrightarrow> order (subtype G)\"\n  apply (unfold Semilat.order_def lesub_def subtype_def)\n  apply (auto intro: widen_trans)\n  apply (case_tac x)\n   apply (case_tac y)\n    apply (auto simp add: PrimT_PrimT)\n   apply (case_tac y)\n    apply simp\n  apply simp\n  apply (rename_tac ref_ty ref_tya, case_tac ref_ty)\n   apply (case_tac ref_tya)\n    apply simp\n   apply simp\n  apply (case_tac ref_tya)\n   apply simp\n  apply simp\n  apply (auto dest: acyclic_impl_antisym_rtrancl antisymD)\n  done\n\nlemma wf_converse_subcls1_impl_acc_subtype:\n  \"wf ((subcls1 G)^-1) \\<Longrightarrow> acc (subtype G)\"\napply (unfold Semilat.acc_def lesssub_def)\napply (drule_tac p = \"((subcls1 G)^-1) - Id\" in wf_subset)\n apply auto\napply (drule wf_trancl)\napply (simp add: wf_eq_minimal)\napply clarify\napply (unfold lesub_def subtype_def)\napply (rename_tac M T) \napply (case_tac \"EX C. Class C : M\")\n prefer 2\n apply (case_tac T)\n  apply (fastforce simp add: PrimT_PrimT2)\n apply simp\n apply (rename_tac ref_ty)\n apply (subgoal_tac \"ref_ty = NullT\")\n  apply simp\n  apply (rule_tac x = NT in bexI)\n   apply (rule allI)\n   apply (rule impI, erule conjE)\n   apply (drule widen_RefT)\n   apply clarsimp\n   apply (case_tac t)\n    apply simp\n   apply simp\n  apply simp\n apply (case_tac ref_ty)\n  apply simp\n apply simp\napply (erule_tac x = \"{C. Class C : M}\" in allE)\napply auto\napply (rename_tac D)\napply (rule_tac x = \"Class D\" in bexI)\n prefer 2\n apply assumption\napply clarify \napply (frule widen_RefT)\napply (erule exE)\napply (case_tac t)\n apply simp\napply simp\napply (insert rtrancl_r_diff_Id [symmetric, of \"subcls1 G\"])\napply simp\napply (erule rtrancl.cases)\n apply blast\napply (drule rtrancl_converseI)\napply (subgoal_tac \"(subcls1 G - Id)^-1 = (subcls1 G)^-1 - Id\")\n prefer 2\n apply (simp add: converse_Int) apply safe[1]\napply simp\napply (blast intro: rtrancl_into_trancl2)\ndone\n\nlemma closed_err_types:\n  \"\\<lbrakk> ws_prog G; single_valued (subcls1 G); acyclic (subcls1 G) \\<rbrakk> \n  \\<Longrightarrow> closed (err (types G)) (lift2 (sup G))\"\n  apply (unfold closed_def plussub_def lift2_def sup_def)\n  apply (auto split: err.split)\n  apply (drule is_tyI, assumption)\n  apply (auto simp add: is_ty_def is_type_conv simp del: is_type.simps \n              split: ty.split ref_ty.split)  \n  apply (blast dest!: is_lub_exec_lub is_lubD is_ubD intro!: is_ubI superI)\n  done\n\n\nlemma sup_subtype_greater:\n  \"\\<lbrakk> ws_prog G; single_valued (subcls1 G); acyclic (subcls1 G);\n      is_type G t1; is_type G t2; sup G t1 t2 = OK s \\<rbrakk> \n  \\<Longrightarrow> subtype G t1 s \\<and> subtype G t2 s\"\nproof -\n  assume ws_prog:       \"ws_prog G\"\n  assume single_valued: \"single_valued (subcls1 G)\"\n  assume acyclic:       \"acyclic (subcls1 G)\"\n \n  { fix c1 c2\n    assume is_class: \"is_class G c1\" \"is_class G c2\"\n    with ws_prog \n    obtain \n      \"G \\<turnstile> c1 \\<preceq>C Object\"\n      \"G \\<turnstile> c2 \\<preceq>C Object\"\n      by (blast intro: subcls_C_Object)\n    with ws_prog single_valued\n    obtain u where\n      \"is_lub ((subcls1 G)^* ) c1 c2 u\"\n      by (blast dest: single_valued_has_lubs)\n    moreover\n    note acyclic\n    moreover\n    have \"\\<forall>x y. G \\<turnstile> x \\<prec>C1 y \\<longrightarrow> super G x = y\"\n      by (blast intro: superI)\n    ultimately\n    have \"G \\<turnstile> c1 \\<preceq>C exec_lub (subcls1 G) (super G) c1 c2 \\<and>\n          G \\<turnstile> c2 \\<preceq>C exec_lub (subcls1 G) (super G) c1 c2\"\n      by (simp add: exec_lub_conv) (blast dest: is_lubD is_ubD)\n  } note this [simp]\n      \n  assume \"is_type G t1\" \"is_type G t2\" \"sup G t1 t2 = OK s\"\n  thus ?thesis\n    apply (unfold sup_def subtype_def) \n    apply (cases s)\n    apply (auto split: ty.split_asm ref_ty.split_asm split_if_asm)\n    done\nqed\n\nlemma sup_subtype_smallest:\n  \"\\<lbrakk> ws_prog G; single_valued (subcls1 G); acyclic (subcls1 G);\n      is_type G a; is_type G b; is_type G c; \n      subtype G a c; subtype G b c; sup G a b = OK d \\<rbrakk>\n  \\<Longrightarrow> subtype G d c\"\nproof -\n  assume ws_prog:       \"ws_prog G\"\n  assume single_valued: \"single_valued (subcls1 G)\"\n  assume acyclic:       \"acyclic (subcls1 G)\"\n\n  { fix c1 c2 D\n    assume is_class: \"is_class G c1\" \"is_class G c2\"\n    assume le: \"G \\<turnstile> c1 \\<preceq>C D\" \"G \\<turnstile> c2 \\<preceq>C D\"\n    from ws_prog is_class\n    obtain \n      \"G \\<turnstile> c1 \\<preceq>C Object\"\n      \"G \\<turnstile> c2 \\<preceq>C Object\"\n      by (blast intro: subcls_C_Object)\n    with ws_prog single_valued\n    obtain u where\n      lub: \"is_lub ((subcls1 G)^*) c1 c2 u\"\n      by (blast dest: single_valued_has_lubs)   \n    with acyclic\n    have \"exec_lub (subcls1 G) (super G) c1 c2 = u\"\n      by (blast intro: superI exec_lub_conv)\n    moreover\n    from lub le\n    have \"G \\<turnstile> u \\<preceq>C D\" \n      by (simp add: is_lub_def is_ub_def)\n    ultimately     \n    have \"G \\<turnstile> exec_lub (subcls1 G) (super G) c1 c2 \\<preceq>C D\"\n      by blast\n  } note this [intro]\n\n  have [dest!]:\n    \"\\<And>C T. G \\<turnstile> Class C \\<preceq> T \\<Longrightarrow> \\<exists>D. T=Class D \\<and> G \\<turnstile> C \\<preceq>C D\"\n    by (frule widen_Class, auto)\n\n  assume \"is_type G a\" \"is_type G b\" \"is_type G c\"\n         \"subtype G a c\" \"subtype G b c\" \"sup G a b = OK d\"\n  thus ?thesis\n    by (auto simp add: subtype_def sup_def \n             split: ty.split_asm ref_ty.split_asm split_if_asm)\nqed\n\nlemma sup_exists:\n  \"\\<lbrakk> subtype G a c; subtype G b c; sup G a b = Err \\<rbrakk> \\<Longrightarrow> False\"\n  by (auto simp add: PrimT_PrimT PrimT_PrimT2 sup_def subtype_def\n           split: ty.splits ref_ty.splits)\n\nlemma err_semilat_JType_esl_lemma:\n  \"\\<lbrakk> ws_prog G; single_valued (subcls1 G); acyclic (subcls1 G) \\<rbrakk> \n  \\<Longrightarrow> err_semilat (esl G)\"\nproof -\n  assume ws_prog:   \"ws_prog G\"\n  assume single_valued: \"single_valued (subcls1 G)\"\n  assume acyclic:   \"acyclic (subcls1 G)\"\n  \n  hence \"order (subtype G)\"\n    by (rule order_widen)\n  moreover\n  from ws_prog single_valued acyclic\n  have \"closed (err (types G)) (lift2 (sup G))\"\n    by (rule closed_err_types)\n  moreover\n\n  from ws_prog single_valued acyclic\n  have\n    \"(\\<forall>x\\<in>err (types G). \\<forall>y\\<in>err (types G). x <=_(Err.le (subtype G)) x +_(lift2 (sup G)) y) \\<and> \n     (\\<forall>x\\<in>err (types G). \\<forall>y\\<in>err (types G). y <=_(Err.le (subtype G)) x +_(lift2 (sup G)) y)\"\n    by (auto simp add: lesub_def plussub_def Err.le_def lift2_def sup_subtype_greater split: err.split)\n\n  moreover\n\n  from ws_prog single_valued acyclic \n  have\n    \"\\<forall>x\\<in>err (types G). \\<forall>y\\<in>err (types G). \\<forall>z\\<in>err (types G). \n    x <=_(Err.le (subtype G)) z \\<and> y <=_(Err.le (subtype G)) z \\<longrightarrow> x +_(lift2 (sup G)) y <=_(Err.le (subtype G)) z\"\n    by (unfold lift2_def plussub_def lesub_def Err.le_def)\n       (auto intro: sup_subtype_smallest sup_exists split: err.split)\n\n  ultimately\n  \n  show ?thesis\n    by (unfold esl_def semilat_def Err.sl_def) auto\nqed\n\nlemma single_valued_subcls1:\n  \"ws_prog G \\<Longrightarrow> single_valued (subcls1 G)\"\n  by (auto simp add: ws_prog_def unique_def single_valued_def\n    intro: subcls1I elim!: subcls1.cases)\n\ntheorem err_semilat_JType_esl:\n  \"ws_prog G \\<Longrightarrow> err_semilat (esl G)\"\n  by (frule acyclic_subcls1, frule single_valued_subcls1, rule err_semilat_JType_esl_lemma)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/MicroJava/BV/JType.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7154239957834733, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.31598346654228304}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n * Facts about recursive functions with measure parameter.\n * Any recursive functions from AutoCorres are monotonic in the measure,\n * which allows us to use the \"measure_call\" mechanism for calling them.\n *)\ntheory MonadMono\nimports\n  NonDetMonadEx\n  \"../lib/Monad_WP/OptionMonadWP\"\nbegin\n\n(*\n * Call function f by returning all of its possible results.\n * The call succeeds if any measure value succeeds.\n *)\ndefinition \"measure_call f \\<equiv>\n    \\<lambda>s. ({(r', s'). \\<exists>m. (r', s') \\<in> fst (f m s)}, \\<forall>m. snd (f m s))\"\n\n(*\n * monad_mono gives preconditions for functions so that measure_call will\n * return meaningful results.\n *\n * The preconditions are:\n *\n * - If the measure is increased, the function never returns fewer\n *   results. (Monotonicity condition)\n *\n * - If the function succeeds with some measure, it will not fail with\n *   a larger measure, and will return exactly the same results.\n *\n * The monotonicity condition is technically not needed, but all our\n * functions satisfy it anyway and it makes intermediate proofs easier.\n *)\ndefinition \"monad_mono f \\<equiv>\n     (\\<forall>(x :: nat) y s. x < y \\<longrightarrow>\n         (fst (f x s) \\<subseteq> fst (f y s) \\<and>\n          (\\<not> snd (f x s) \\<longrightarrow> \\<not> snd (f y s) \\<and> fst (f x s) = fst (f y s))))\"\n\n(* Basic monad_mono lemmas *)\nlemma monad_mono_incl: \"\\<lbrakk> monad_mono f; \\<not> snd (f m s) \\<rbrakk> \\<Longrightarrow> fst (f m' s) \\<subseteq> fst (f m s)\"\n  using less_linear[where x = m and y = m']\n  by (auto simp: monad_mono_def)\n\n(* wp rules for function calls *)\nlemma call_all_valid [wp]:\n    \"\\<lbrakk> \\<forall> m. valid P (x m) Q; monad_mono x \\<rbrakk> \\<Longrightarrow> valid P (measure_call x) Q\"\n  apply (clarsimp simp: valid_def measure_call_def monad_mono_def)\n  by blast\n\nlemma call_all_validNF [wp]:\n    \"\\<lbrakk>  validNF P (x m) Q; monad_mono x \\<rbrakk> \\<Longrightarrow> validNF P (measure_call x) Q\"\n  apply (clarsimp simp: measure_call_def validNF_def valid_def no_fail_def)\n  apply (metis in_mono split_conv monad_mono_incl)\n  done\n\n(* Alternative definition of monad_mono, suitable for induction *)\ndefinition \"monad_mono_step f m \\<equiv>\n  (\\<forall>s. fst (f m s) \\<subseteq> fst (f (Suc m) s) \\<and>\n       (\\<not> snd (f m s) \\<longrightarrow> \\<not> snd (f (Suc m) s) \\<and> fst (f m s) = fst (f (Suc m) s)))\"\n\nlemma monad_mono_alt_def: \"monad_mono f = (\\<forall>m. monad_mono_step f m)\"\n  apply (rule iffI)\n   apply (fastforce simp: monad_mono_def monad_mono_step_def)\n  apply (unfold monad_mono_def monad_mono_step_def)\n  apply clarify\n  apply (subst (asm) atomize_all[symmetric])+\n  proof -\n    fix x y :: nat\n    fix s\n    assume suc: \"\\<And>m s. fst (f m s) \\<subseteq> fst (f (Suc m) s) \\<and>\n              (\\<not> snd (f m s) \\<longrightarrow> \\<not> snd (f (Suc m) s) \\<and> fst (f m s) = fst (f (Suc m) s))\"\n       and less: \"x < y\"\n    thus \"fst (f x s) \\<subseteq> fst (f y s) \\<and>\n          (\\<not> snd (f x s) \\<longrightarrow> \\<not> snd (f y s) \\<and> fst (f x s) = fst (f y s))\"\n      apply (induct x)\n       apply (induct y)\n        apply blast\n       apply blast\n      (* induct bureaucracy... *)\n      proof -\n        fix x :: nat\n        assume less: \"Suc x < y\"\n        thus \"fst (f (Suc x) s) \\<subseteq> fst (f y s) \\<and>\n           (\\<not> snd (f (Suc x) s) \\<longrightarrow> \\<not> snd (f y s) \\<and> fst (f (Suc x) s) = fst (f y s))\"\n          apply (induct y)\n           apply blast\n          apply (case_tac \"Suc x < y\")\n           using suc apply blast\n          apply (case_tac \"Suc x = y\")\n           using suc apply blast\n          apply simp\n          done\n       qed\n  qed\n\nlemmas monad_mono_step = iffD2[OF monad_mono_alt_def, rule_format]\n\nlemma monad_mono_step_const: \"monad_mono_step (\\<lambda>_. f) m\"\n  by (simp add: monad_mono_step_def)\n\n(* nondet_monad rules *)\nlemma monad_mono_step_in_monad:\n  \"\\<lbrakk> monad_mono_step f m; (r', s') \\<in> fst (f m s) \\<rbrakk> \\<Longrightarrow> (r', s') \\<in> fst (f (Suc m) s)\"\n  apply (clarsimp simp: monad_mono_step_def)\n  apply blast\n  done\n\nlemma monad_mono_step_snd_monad:\n  \"\\<lbrakk> monad_mono_step f m; \\<not> snd (f m s) \\<rbrakk> \\<Longrightarrow> \\<not> snd (f (Suc m) s)\"\n  by (clarsimp simp: monad_mono_step_def)\n\nlemma monad_mono_step_bexI:\n  \"\\<lbrakk> monad_mono_step f m; (r', s') \\<in> fst (f m s); P r' s' \\<rbrakk> \\<Longrightarrow> \\<exists>(r', s') \\<in> fst (f (Suc m) s). P r' s'\"\n  apply (drule (1) monad_mono_step_in_monad)\n  apply force\n  done\n\nlemma monad_mono_stepI [intro]:\n  \"\\<lbrakk> \\<And>s r' s'. (r', s') \\<in> fst (f m s) \\<Longrightarrow> (r', s') \\<in> fst (f (Suc m) s);\n     \\<And>s. \\<not> snd (f m s) \\<Longrightarrow> \\<not> snd (f (Suc m) s);\n     \\<And>s r' s'. \\<lbrakk> \\<not> snd (f m s); \\<not> snd (f (Suc m) s); (r', s') \\<in> fst (f (Suc m) s) \\<rbrakk>\n                \\<Longrightarrow> (r', s') \\<in> fst (f m s)\n   \\<rbrakk> \\<Longrightarrow> monad_mono_step f m\"\n  apply (clarsimp simp: monad_mono_step_def)\n  apply fast\n  done\n\nlemma monad_mono_step_bind:\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. (f m) >>= (g m)) m\"\n  apply atomize\n  apply rule\n    apply (monad_eq)\n    apply (metis monad_mono_step_in_monad)\n   apply (monad_eq simp: Ball_def)\n   apply (metis monad_mono_step_def)\n  apply (monad_eq simp: Ball_def)\n  apply (unfold monad_mono_step_def)\n  apply blast\n  done\n\nlemma monad_mono_step_bindE:\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. (f m) >>=E (g m)) m\"\n  apply (unfold bindE_def)\n  apply (rule monad_mono_step_bind)\n   apply simp\n  apply (monad_eq simp: monad_mono_step_def NonDetMonad.lift_def\n      split: sum.splits)\n  done\n\nlemma monad_mono_step_liftE:\n  \"monad_mono_step f m \\<Longrightarrow> monad_mono_step (\\<lambda>m. liftE (f m)) m\"\n  apply (unfold liftE_def)\n  apply (erule monad_mono_step_bind)\n  apply (rule monad_mono_step_const)\n  done\n\nlemma monad_mono_step_handleE':\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. f m <handle2> g m) m\"\n  apply atomize\n  apply rule\n    apply (monad_eq)\n    apply (metis monad_mono_step_in_monad)\n   apply (monad_eq simp: Ball_def)\n   apply (metis monad_mono_step_def)\n  apply (monad_eq simp: Ball_def)\n  apply (fastforce simp: monad_mono_step_def)\n  done\n\nlemma monad_mono_step_handleE:\n  \"\\<lbrakk> monad_mono_step f m; \\<And>x. monad_mono_step (\\<lambda>m. g m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. f m <handle> g m) m\"\n  by (simp add: handleE_def monad_mono_step_handleE')\n\nlemma monad_mono_step_condition:\n  \"\\<lbrakk> monad_mono_step f m; monad_mono_step g m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. condition C (f m) (g m)) m\"\n  apply rule\n    apply (monad_eq simp: monad_mono_step_def, blast)+\n  done\n\nlemma fst_whileLoop_is_exs_valid:\n  \"((a, b) \\<in> fst (whileLoop C B i s)) = \\<lbrace> \\<lambda>s'. s' = s \\<rbrace> whileLoop C B i \\<exists>\\<lbrace> \\<lambda>rv s. rv = a \\<and> s = b \\<rbrace>\"\n  by (clarsimp simp: exs_valid_def Bex_def)\n\nlemma not_snd_whileLoop_is_validNF:\n  \"(\\<not> snd (whileLoop C B i s)) = \\<lbrace> \\<lambda>s'. s' = s \\<rbrace> whileLoop C B i \\<lbrace> \\<lambda>_ _. True \\<rbrace>!\"\n  by (clarsimp simp: validNF_alt_def)\n\nlemma monad_mono_step_whileLoop:\n  assumes body_mono: \"\\<And>x. monad_mono_step (\\<lambda>m. B m x) m\"\n  shows \"monad_mono_step (\\<lambda>m. whileLoop C (B m) i) m\"\nproof -\n  {\n    fix a b s\n    have \"(a, b) \\<in> fst (whileLoop C (B m) i s) \\<Longrightarrow>\n             (a, b) \\<in> fst (whileLoop C (B (Suc m)) i s)\"\n      apply (clarsimp simp: fst_whileLoop_is_exs_valid)\n      apply (subst (asm) exs_valid_whileLoop_complete [symmetric])\n      apply (erule exE | erule conjE)+\n      apply (rule_tac T=T and R=R in exs_valid_whileLoop)\n         apply clarsimp\n        apply (cut_tac x=r in body_mono)\n        apply (clarsimp simp: monad_mono_step_def exs_valid_def split_def)\n        apply blast\n       apply simp\n      apply blast\n      done\n  }\n  note A = this\n\n  {\n    fix a b s\n    have \"\\<lbrakk> \\<not> snd (whileLoop C (B m) i s);\n                  (a, b) \\<in> fst (whileLoop C (B (Suc m)) i s) \\<rbrakk>\n              \\<Longrightarrow> (a, b) \\<in> fst (whileLoop C (B m) i s)\"\n      apply (clarsimp simp: fst_whileLoop_is_exs_valid)\n      apply (subst (asm) exs_valid_whileLoop_complete [symmetric])\n      apply (subst (asm) not_snd_whileLoop_complete)\n      apply (erule exE | erule conjE)+\n      apply (rule_tac T=\"\\<lambda>r s. T r s \\<and> I r s\" and R=Ra in exs_valid_whileLoop)\n         apply simp\n        apply (cut_tac x=r in body_mono)\n        apply (clarsimp simp: monad_mono_step_def exs_valid_def split_def Bex_def)\n        apply metis\n       apply simp\n      apply (clarsimp simp: exs_valid_def Bex_def)\n      done\n  }\n  note B = this\n\n  {\n    fix i s\n    have \"\\<lbrakk>\\<not> snd (whileLoop C (B m) i s) \\<rbrakk> \\<Longrightarrow>\n                  \\<not> snd (whileLoop C (B (Suc m)) i s)\"\n      apply (subst (asm) not_snd_whileLoop_complete)\n      apply (erule exE | erule conjE)+\n      apply (rule_tac I=\"I\" and R=R in not_snd_whileLoop)\n        apply clarsimp\n       apply (cut_tac x=r in body_mono)\n       apply (clarsimp simp: monad_mono_step_def validNF_alt_def)\n       apply blast\n      apply simp\n      done\n  }\n  note C = this\n\n  show ?thesis\n    apply (clarsimp simp: monad_mono_step_def)\n    apply (metis prod.exhaust subsetI subset_antisym A B C)\n    done\nqed\n\nlemma monad_mono_step_whileLoopE:\n  \"\\<lbrakk> \\<And>x. monad_mono_step (\\<lambda>m. B m x) m \\<rbrakk>\n   \\<Longrightarrow> monad_mono_step (\\<lambda>m. whileLoopE C (B m) i) m\"\n  apply (unfold whileLoopE_def)\n  apply (subgoal_tac \"\\<And>x. monad_mono_step (\\<lambda>m. lift (B m) x) m\")\n  apply (erule monad_mono_step_whileLoop)\n  apply (unfold lift_def)\n  apply rule\n    apply (clarsimp split: prod.splits sum.splits)\n    apply (fastforce dest: monad_mono_step_in_monad)\n   apply (clarsimp split: prod.splits sum.splits simp: monad_mono_step_def)+\n  done\n\n\n(* measure_call for the option monad. *)\ndefinition \"measure_ocall f \\<equiv> \\<lambda>s. f (SOME m. f m s \\<noteq> None) s\"\n\ndefinition \"option_monad_mono f \\<equiv>\n  \\<forall>(x :: nat) y s. x < y \\<longrightarrow>\n    (case f y s of None \\<Rightarrow> f x s = None\n                 | Some r \\<Rightarrow> f x s = None \\<or> f x s = Some r)\"\n\nlemma option_monad_mono_eq:\n  \"(\\<And>m. f m = gets_the (f' m)) \\<Longrightarrow> monad_mono f = option_monad_mono f'\"\n  apply (clarsimp simp: monad_mono_def option_monad_mono_def gets_the_def\n    gets_def get_def assert_opt_def return_def fail_def bind_def' split: option.splits)\n  apply (rule iff_allI iff_impI)+\n  apply (rule_tac t = \"\\<forall>r. f' x s = Some r \\<longrightarrow> (\\<exists>r'. f' y s = Some r') \\<and> (\\<forall>r'. f' y s = Some r' \\<longrightarrow> r = r')\"\n              and s = \"\\<forall>r. f' x s = Some r \\<longrightarrow> f' y s = Some r\" in subst)\n   apply (force intro: iff_allI iff_impI)\n  apply (rule iffI)\n   apply (metis (hide_lams, no_types) option.exhaust)\n  apply force\n  done\n\nlemma measure_ocall_ovalid [wp]:\n    \"\\<lbrakk> \\<forall> m. ovalid P (x m) Q; option_monad_mono x \\<rbrakk> \\<Longrightarrow> ovalid P (measure_ocall x) Q\"\n  by (clarsimp simp: ovalid_def measure_ocall_def option_monad_mono_def)\n\nlemma measure_ocall_ovalidNF [wp]:\n    \"\\<lbrakk> ovalidNF P (x m) Q; option_monad_mono x \\<rbrakk> \\<Longrightarrow> ovalidNF P (measure_ocall x) Q\"\n  apply (clarsimp simp: measure_ocall_def option_monad_mono_def ovalidNF_def)\n  apply (rule_tac a = m in someI2)\n   apply simp\n  apply (metis (lifting, full_types) linorder_neqE_nat option.distinct(1) option.simps(5))\n  done\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/autocorres/MonadMono.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526660244837, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.31596647268953454}}
{"text": "section {* UTP variables *}\n\ntheory utp_urel_laws\n  imports \"utp_rel\"\nbegin\n  \nsubsection {* Unrestriction Laws *}\n\nlemma unrest_iuvar [unrest]: (*legacy assumes 1:\"mwb_lens x\"*) \n  \"out\\<alpha> \\<sharp> $x\" \n  by (simp add: out\\<alpha>_def, transfer, auto)\n \nlemma unrest_ouvar [unrest]: (*legacy need assumes 1:\"mwb_lens x\"*) \n  \"in\\<alpha> \\<sharp> $x\\<acute>\" \n  by (simp add: in\\<alpha>_def, transfer, auto)\n\nlemma unrest_semir_undash [unrest]:\n  fixes x :: \"('a, '\\<alpha>) uvar\"\n  assumes \"$x \\<sharp> P\"\n  shows \"$x \\<sharp> P ;; Q\"\n  using assms by transfer (rel_auto) \n\nlemma unrest_semir_dash [unrest]:\n  fixes x :: \"('a, '\\<alpha>) uvar\"\n  assumes \"$x\\<acute> \\<sharp> Q\"\n  shows \"$x\\<acute> \\<sharp> P ;; Q\"\n  using assms by transfer (rel_auto)\n\nlemma unrest_cond [unrest]:\n  \"\\<lbrakk> x \\<sharp> P; x \\<sharp> b; x \\<sharp> Q \\<rbrakk> \\<Longrightarrow> x \\<sharp> P \\<triangleleft> b \\<triangleright> Q \"\n  unfolding cond_def\n  by transfer' (rel_auto)\n\nlemma unrest_in\\<alpha>_var [unrest]:\n  \"\\<lbrakk> mwb_lens x; in\\<alpha> \\<sharp> (P :: ('\\<alpha>, '\\<beta>) rel) \\<rbrakk> \\<Longrightarrow> $x \\<sharp> P\"\n  by (pred_auto, simp add: in\\<alpha>_def, blast, metis in\\<alpha>_def lens.select_convs(2) old.prod.case)\n\nlemma unrest_out\\<alpha>_var [unrest]:\n  \"\\<lbrakk> mwb_lens x; out\\<alpha> \\<sharp> (P :: ('\\<alpha>, '\\<beta>) rel) \\<rbrakk> \\<Longrightarrow> $x\\<acute> \\<sharp> P\"\n  by (pred_auto, simp add: out\\<alpha>_def, blast, metis lens.select_convs(2) old.prod.case out\\<alpha>_def)\n\nlemma in\\<alpha>_uvar [simp]: \"vwb_lens in\\<alpha>\"\n  by (unfold_locales, auto simp add: in\\<alpha>_def)\n\nlemma out\\<alpha>_uvar [simp]: \"vwb_lens out\\<alpha>\"\n  by (unfold_locales, auto simp add: out\\<alpha>_def)\n\nlemma unrest_pre_out\\<alpha> [unrest]: \"out\\<alpha> \\<sharp> \\<lceil>b\\<rceil>\\<^sub><\"\n  by (transfer, auto simp add: out\\<alpha>_def)\n\nlemma unrest_post_in\\<alpha> [unrest]: \"in\\<alpha> \\<sharp> \\<lceil>b\\<rceil>\\<^sub>>\"\n  by (transfer, auto simp add: in\\<alpha>_def)\n\nlemma unrest_pre_in_var [unrest]:\n  \"x \\<sharp> p1 \\<Longrightarrow> $x \\<sharp> \\<lceil>p1\\<rceil>\\<^sub><\"\n  by (transfer, simp)\n\nlemma unrest_post_out_var [unrest]:\n  \"x \\<sharp> p1 \\<Longrightarrow> $x\\<acute> \\<sharp> \\<lceil>p1\\<rceil>\\<^sub>>\"\n  by (transfer, simp)\n\nlemma unrest_convr_out\\<alpha> [unrest]:\n  \"in\\<alpha> \\<sharp> p \\<Longrightarrow> out\\<alpha> \\<sharp> p\\<^sup>-\"\n  by (transfer, auto simp add: in\\<alpha>_def out\\<alpha>_def)\n\nlemma unrest_convr_in\\<alpha> [unrest]:\n  \"out\\<alpha> \\<sharp> p \\<Longrightarrow> in\\<alpha> \\<sharp> p\\<^sup>-\"\n  by (transfer, auto simp add: in\\<alpha>_def out\\<alpha>_def)\n\nlemma unrest_in_rel_var_res [unrest]:\n  \"vwb_lens x \\<Longrightarrow> $x \\<sharp> (P \\<restriction>\\<^sub>\\<alpha> x)\"\n  by (simp add: rel_var_res_def unrest)\n \nlemma unrest_out_rel_var_res [unrest]:\n  \"vwb_lens x \\<Longrightarrow> $x\\<acute> \\<sharp> (P \\<restriction>\\<^sub>\\<alpha> x)\"\n  by (simp add: rel_var_res_def unrest)\n\nsubsection {* Substitution laws *}\n\nlemma subst_seq_left [usubst]:\n  \"out\\<alpha> \\<sharp> \\<sigma> \\<Longrightarrow> \\<sigma> \\<dagger> (P ;; Q) = (\\<sigma> \\<dagger> P) ;; Q\"\n  by transfer (rel_auto, (metis (no_types, lifting) Pair_inject surjective_pairing)+)\n\nlemma subst_seq_right [usubst]:\n  \"in\\<alpha> \\<sharp> \\<sigma> \\<Longrightarrow> \\<sigma> \\<dagger> (P ;; Q) = P ;; (\\<sigma> \\<dagger> Q)\"\n  by transfer (rel_auto, (metis (no_types, lifting) Pair_inject surjective_pairing)+)\n\ntext {* The following laws support substitution in heterogeneous relations for polymorphically\n  types literal expressions. These cannot be supported more generically due to limitations\n  in HOL's type system. The laws are presented in a slightly strange way so as to be as \n  general as possible. *}\n\nlemma bool_seqr_laws [usubst]:\n  fixes x :: \"(bool \\<Longrightarrow> '\\<alpha>)\"\n  shows \n    \"\\<And> P Q \\<sigma>. \\<sigma>($x \\<mapsto>\\<^sub>s true) \\<dagger> (P ;; Q) = \\<sigma> \\<dagger> (P\\<lbrakk>true/$x\\<rbrakk> ;; Q)\"\n    \"\\<And> P Q \\<sigma>. \\<sigma>($x \\<mapsto>\\<^sub>s false) \\<dagger> (P ;; Q) = \\<sigma> \\<dagger> (P\\<lbrakk>false/$x\\<rbrakk> ;; Q)\"\n    \"\\<And> P Q \\<sigma>. \\<sigma>($x\\<acute> \\<mapsto>\\<^sub>s true) \\<dagger> (P ;; Q) = \\<sigma> \\<dagger> (P ;; Q\\<lbrakk>true/$x\\<acute>\\<rbrakk>)\"\n    \"\\<And> P Q \\<sigma>. \\<sigma>($x\\<acute> \\<mapsto>\\<^sub>s false) \\<dagger> (P ;; Q) = \\<sigma> \\<dagger> (P ;; Q\\<lbrakk>false/$x\\<acute>\\<rbrakk>)\"\n    by (transfer, rel_auto)+\n\nlemma zero_one_seqr_laws [usubst]:\n  fixes x :: \"(_ \\<Longrightarrow> '\\<alpha>)\"\n  shows \n    \"\\<And> P Q \\<sigma>. \\<sigma>($x \\<mapsto>\\<^sub>s 0) \\<dagger> (P ;; Q) = \\<sigma> \\<dagger> (P\\<lbrakk>0/$x\\<rbrakk> ;; Q)\"\n    \"\\<And> P Q \\<sigma>. \\<sigma>($x \\<mapsto>\\<^sub>s 1) \\<dagger> (P ;; Q) = \\<sigma> \\<dagger> (P\\<lbrakk>1/$x\\<rbrakk> ;; Q)\"\n    \"\\<And> P Q \\<sigma>. \\<sigma>($x\\<acute> \\<mapsto>\\<^sub>s 0) \\<dagger> (P ;; Q) = \\<sigma> \\<dagger> (P ;; Q\\<lbrakk>0/$x\\<acute>\\<rbrakk>)\"\n    \"\\<And> P Q \\<sigma>. \\<sigma>($x\\<acute> \\<mapsto>\\<^sub>s 1) \\<dagger> (P ;; Q) = \\<sigma> \\<dagger> (P ;; Q\\<lbrakk>1/$x\\<acute>\\<rbrakk>)\"\n    by (transfer, rel_auto)+\n\nlemma numeral_seqr_laws [usubst]:\n  fixes x :: \"(_ \\<Longrightarrow> '\\<alpha>)\"\n  shows \n    \"\\<And> P Q \\<sigma>. \\<sigma>($x \\<mapsto>\\<^sub>s numeral n) \\<dagger> (P ;; Q) = \\<sigma> \\<dagger> (P\\<lbrakk>numeral n/$x\\<rbrakk> ;; Q)\"\n    \"\\<And> P Q \\<sigma>. \\<sigma>($x\\<acute> \\<mapsto>\\<^sub>s numeral n) \\<dagger> (P ;; Q) = \\<sigma> \\<dagger> (P ;; Q\\<lbrakk>numeral n/$x\\<acute>\\<rbrakk>)\"\n  by (transfer, rel_auto)+    \n\nlemma usubst_condr [usubst]:\n  \"\\<sigma> \\<dagger> ( P \\<triangleleft> b \\<triangleright> Q) = (\\<sigma> \\<dagger> P \\<triangleleft> \\<sigma> \\<dagger> b \\<triangleright> \\<sigma> \\<dagger> Q)\"\n  unfolding cond_def\n  by rel_auto\n \nlemma subst_skip_r [usubst]:\n  \"out\\<alpha> \\<sharp> \\<sigma> \\<Longrightarrow> \\<sigma> \\<dagger> II = \\<langle>\\<lfloor>\\<sigma>\\<rfloor>\\<^sub>s\\<rangle>\\<^sub>a\"\n  by (rel_simp, (metis (mono_tags, lifting) prod.sel(1) sndI surjective_pairing)+)\n\nlemma usubst_upd_in_comp [usubst]:\n  \"\\<sigma>(&in\\<alpha>:x \\<mapsto>\\<^sub>s v) = \\<sigma>($x \\<mapsto>\\<^sub>s v)\"\n  by (simp add: fst_lens_def in\\<alpha>_def in_var_def)\n\nlemma usubst_upd_out_comp [usubst]:\n  \"\\<sigma>(&out\\<alpha>:x \\<mapsto>\\<^sub>s v) = \\<sigma>($x\\<acute> \\<mapsto>\\<^sub>s v)\"\n  by (simp add: out\\<alpha>_def out_var_def snd_lens_def)\n\nlemma subst_lift_upd [usubst]:\n  fixes x :: \"('a, '\\<alpha>) uvar\"\n  shows \"\\<lceil>\\<sigma>(x \\<mapsto>\\<^sub>s v)\\<rceil>\\<^sub>s = \\<lceil>\\<sigma>\\<rceil>\\<^sub>s($x \\<mapsto>\\<^sub>s \\<lceil>v\\<rceil>\\<^sub><)\"\n  by (simp add: alpha , simp add: fst_lens_def in\\<alpha>_def in_var_def)\n\nlemma subst_drop_upd [usubst]:\n  fixes x :: \"('a, '\\<alpha>) uvar\"\n  shows \"\\<lfloor>\\<sigma>($x \\<mapsto>\\<^sub>s v)\\<rfloor>\\<^sub>s = \\<lfloor>\\<sigma>\\<rfloor>\\<^sub>s(x \\<mapsto>\\<^sub>s \\<lfloor>v\\<rfloor>\\<^sub><)\"\n  by  (pred_simp , simp add: in\\<alpha>_def prod.case_eq_if)\n\nlemma subst_lift_pre [usubst]: \"\\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> \\<lceil>b\\<rceil>\\<^sub>< = \\<lceil>\\<sigma> \\<dagger> b\\<rceil>\\<^sub><\"\n  by (metis apply_subst_ext fst_lens_def fst_vwb_lens in\\<alpha>_def)\n\nlemma unrest_usubst_lift_in [unrest]:\n  \"x \\<sharp> P \\<Longrightarrow> $x \\<sharp> \\<lceil>P\\<rceil>\\<^sub>s\"\n  by (pred_simp, auto simp add: unrest_usubst_def in\\<alpha>_def)\n\nlemma unrest_usubst_lift_out [unrest]:\n  fixes x :: \"('a, '\\<alpha>) uvar\"\n  shows \"$x\\<acute> \\<sharp> \\<lceil>P\\<rceil>\\<^sub>s\"\n  by (pred_simp, auto simp add: unrest_usubst_def in\\<alpha>_def)\n\nsubsection {* Relation laws *}\n\ntext {* Homogeneous relations form a quantale. This allows us to import a large number of laws\n        from Struth and Armstrong's Kleene Algebra theory~\\cite{Armstrong2015}. *}\n\nabbreviation truer :: \"'\\<alpha> hrel\" (\"true\\<^sub>h\") where\n\"truer \\<equiv> true\"\n\nabbreviation falser :: \"'\\<alpha> hrel\" (\"false\\<^sub>h\") where\n\"falser \\<equiv> false\"\n\nlemma drop_pre_inv [simp]: \"\\<lbrakk> out\\<alpha> \\<sharp> p \\<rbrakk> \\<Longrightarrow> \\<lceil>\\<lfloor>p\\<rfloor>\\<^sub><\\<rceil>\\<^sub>< = p\"\n  by (pred_simp, auto simp add: out\\<alpha>_def lens_create_def fst_lens_def prod.case_eq_if)\n   \ntext {* Quantale laws for relations *}\n\nlemma seq_Sup_distl: \"P ;; (\\<Sqinter> A) = (\\<Sqinter> Q\\<in>A. P ;; Q)\"\n  by (transfer, rel_auto)\n    \nlemma seq_Sup_distr: \"(\\<Sqinter> A) ;; Q = (\\<Sqinter> P\\<in>A. P ;; Q)\"\n  by (transfer, auto)\n    \nlemma seq_UINF_distl: \"P ;; (\\<Sqinter> Q\\<in>A \\<bullet> F(Q)) = (\\<Sqinter> Q\\<in>A \\<bullet> P ;; F(Q))\"\n  by (simp add: USUP_as_Sup_collect seq_Sup_distl)\n\nlemma seq_UINF_distr: \"(\\<Sqinter> P\\<in>A \\<bullet> F(P)) ;; Q = (\\<Sqinter> P\\<in>A \\<bullet> F(P) ;; Q)\"\n  by  (simp add: USUP_as_Sup_collect seq_Sup_distr)\n\nlemma impl_seqr_mono: \"\\<lbrakk> `P \\<Rightarrow> Q`; `R \\<Rightarrow> S` \\<rbrakk> \\<Longrightarrow> `(P ;; R) \\<Rightarrow> (Q ;; S)`\"\n  by transfer (pred_blast)\n\nlemma seqr_mono:\n  \"\\<lbrakk> P\\<^sub>1 \\<sqsubseteq> P\\<^sub>2; Q\\<^sub>1 \\<sqsubseteq> Q\\<^sub>2 \\<rbrakk> \\<Longrightarrow> (P\\<^sub>1 ;; Q\\<^sub>1) \\<sqsubseteq> (P\\<^sub>2 ;; Q\\<^sub>2)\"\n  by transfer (rel_blast)\n\nlemma seqr_monotonic: \n  \"\\<lbrakk> mono P; mono Q \\<rbrakk> \\<Longrightarrow> mono (\\<lambda> X. P X ;; Q X)\"\n  by (simp add: mono_def, transfer ,rel_blast)\n\nlemma cond_mono:\n  \"\\<lbrakk> P\\<^sub>1 \\<sqsubseteq> P\\<^sub>2; Q\\<^sub>1 \\<sqsubseteq> Q\\<^sub>2 \\<rbrakk> \\<Longrightarrow> (P\\<^sub>1 \\<triangleleft> b \\<triangleright> Q\\<^sub>1) \\<sqsubseteq> (P\\<^sub>2 \\<triangleleft> b \\<triangleright> Q\\<^sub>2)\"\n  unfolding cond_def\n  by transfer (rel_auto)\n\nlemma cond_monotonic:\n  \"\\<lbrakk> mono P; mono Q \\<rbrakk> \\<Longrightarrow> mono (\\<lambda> X. P X \\<triangleleft> b \\<triangleright> Q X)\"\n  unfolding cond_def\n  by (simp add: mono_def, rel_blast)\n\nlemma spec_refine:\n  \"Q \\<sqsubseteq> (P \\<and> R) \\<Longrightarrow> (P \\<Rightarrow> Q) \\<sqsubseteq> R\"\n  by (rel_auto)\n\nlemma cond_skip: \"out\\<alpha> \\<sharp> b \\<Longrightarrow> (b \\<and> II) = (II \\<and> b\\<^sup>-)\"\n  by (rel_auto)\n\n\nlemma assigns_subst [usubst]:\n  \"\\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> \\<langle>\\<rho>\\<rangle>\\<^sub>a = \\<langle>\\<rho> \\<circ> \\<sigma>\\<rangle>\\<^sub>a\"\n  by transfer (rel_auto)\n\nlemma assigns_r_comp: \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; P) = (\\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> P)\"\n  by transfer rel_auto\n\nlemma assigns_r_feasible:\n  \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; true) = true\"\n  by (simp add: assigns_r_comp subst_true)\n\nlemma assign_subst [usubst]:\n  \"\\<lbrakk> mwb_lens x; mwb_lens y \\<rbrakk> \\<Longrightarrow> [$x \\<mapsto>\\<^sub>s \\<lceil>u\\<rceil>\\<^sub><] \\<dagger> (y :== v) = (x, y :== u, [x \\<mapsto>\\<^sub>s u] \\<dagger> v)\"\n  by rel_auto\n\nlemma assigns_idem: \"mwb_lens x \\<Longrightarrow> (x,x :== u,v) = (x :== v)\"\n  by (simp add: usubst)\n\nlemma assigns_comp: \"(\\<langle>f\\<rangle>\\<^sub>a ;; \\<langle>g\\<rangle>\\<^sub>a) = \\<langle>g \\<circ> f\\<rangle>\\<^sub>a\"\n  by (simp add: assigns_r_comp usubst)\n\nlemma assigns_r_conv:\n  \"bij f \\<Longrightarrow> \\<langle>f\\<rangle>\\<^sub>a\\<^sup>- = \\<langle>inv f\\<rangle>\\<^sub>a\"\n  by transfer (rel_auto, simp_all add: bij_is_inj bij_is_surj surj_f_inv_f)\n\nlemma assign_pred_transfer:\n  fixes x :: \"('a, '\\<alpha>) uvar\"\n  assumes \"$x \\<sharp> b\" \"out\\<alpha> \\<sharp> b\"\n  shows \"(b \\<and> x :== v) = (x :== v \\<and> b\\<^sup>-)\"\n  using assms by rel_blast\n\nlemma assigns_r_ufunc: \"ufunctional \\<langle>f\\<rangle>\\<^sub>a\"\n  by (rel_auto)\n\nlemma assigns_r_uinj: \"inj f \\<Longrightarrow> uinj \\<langle>f\\<rangle>\\<^sub>a\"\n  by (rel_simp, simp add: inj_eq)\n\nlemma assigns_r_swap_uinj:\n  \"\\<lbrakk> vwb_lens x; vwb_lens y; x \\<bowtie> y \\<rbrakk> \\<Longrightarrow> uinj (x,y :== &y,&x)\"\n  using assigns_r_uinj swap_usubst_inj by auto\n\nlemma skip_r_unfold:\n  \"vwb_lens x \\<Longrightarrow> II = ($x\\<acute> =\\<^sub>u $x \\<and> II\\<restriction>\\<^sub>\\<alpha>x)\"\n  by (rel_auto, metis mwb_lens.put_put vwb_lens_mwb vwb_lens_wb wb_lens.get_put)\n\nlemma skip_ra_unfold:\n  \"II\\<^bsub>x;y\\<^esub> = ($x\\<acute> =\\<^sub>u $x \\<and> II\\<^bsub>y\\<^esub>)\"\n  by (rel_auto)\n\nlemma skip_res_as_ra:\n  \"\\<lbrakk> vwb_lens y; x +\\<^sub>L y \\<approx>\\<^sub>L 1\\<^sub>L; x \\<bowtie> y \\<rbrakk> \\<Longrightarrow> II\\<restriction>\\<^sub>\\<alpha>x = II\\<^bsub>y\\<^esub>\"\n  apply (rel_auto)\n  apply (metis (no_types, lifting) lens_indep_def)\n  apply (metis vwb_lens.put_eq)\ndone\n\nlemma assign_unfold:\n  \"vwb_lens x \\<Longrightarrow> (x :== v) = ($x\\<acute> =\\<^sub>u \\<lceil>v\\<rceil>\\<^sub>< \\<and> II\\<restriction>\\<^sub>\\<alpha>x)\"\n  apply (rel_auto, auto simp add: comp_def)\n  using vwb_lens.put_eq by fastforce\n\nlemma seqr_and_distr_ufunc:\n  \"ufunctional P \\<Longrightarrow> (P ;; (Q \\<and> R)) = ((P ;; Q) \\<and> (P ;; R))\"\n  by rel_auto\n\nlemma seqr_and_distl_uinj:\n  \"uinj R \\<Longrightarrow> ((P \\<and> Q) ;; R) = ((P ;; R) \\<and> (Q ;; R))\"\n  by (rel_auto)\n\ntheorem precond_equiv:\n  \"P = (P ;; true) \\<longleftrightarrow> (out\\<alpha> \\<sharp> P)\"\n  by (rel_auto)\n\ntheorem postcond_equiv:\n  \"P = (true ;; P) \\<longleftrightarrow> (in\\<alpha> \\<sharp> P)\"\n  by (rel_auto)\n\nlemma precond_right_unit: \"out\\<alpha> \\<sharp> p \\<Longrightarrow> (p ;; true) = p\"\n  by (metis precond_equiv)\n\nlemma postcond_left_unit: \"in\\<alpha> \\<sharp> p \\<Longrightarrow> (true ;; p) = p\"\n  by (metis postcond_equiv)\n\ntheorem precond_left_zero:\n  assumes \"out\\<alpha> \\<sharp> p\" \"p \\<noteq> false\"\n  shows \"(true ;; p) = true\"\n  using assms\n  apply (simp add: out\\<alpha>_def upred_defs)\n  apply (transfer, auto simp add: relcomp_unfold, rule ext, auto)\n  apply (rename_tac p b)\n  apply (subgoal_tac \"\\<exists> b1 b2. p (b1, b2)\")\n  apply (auto)\ndone\n\nsubsection {* Converse laws *}\n\nlemma convr_invol [simp]: \"p\\<^sup>-\\<^sup>- = p\"\n  by pred_auto\n\nlemma lit_convr [simp]: \"\\<guillemotleft>v\\<guillemotright>\\<^sup>- = \\<guillemotleft>v\\<guillemotright>\"\n  by pred_auto\n\nlemma uivar_convr [simp]:\n  fixes x :: \"('a, '\\<alpha>) uvar\"\n  shows \"($x)\\<^sup>- = $x\\<acute>\"\n  by pred_auto\n\nlemma uovar_convr [simp]:\n  fixes x :: \"('a, '\\<alpha>) uvar\"\n  shows \"($x\\<acute>)\\<^sup>- = $x\"\n  by pred_auto\n\nlemma uop_convr [simp]: \"(uop f u)\\<^sup>- = uop f (u\\<^sup>-)\"\n  by (pred_auto)\n\nlemma bop_convr [simp]: \"(bop f u v)\\<^sup>- = bop f (u\\<^sup>-) (v\\<^sup>-)\"\n  by (pred_auto)\n\nlemma eq_convr [simp]: \"(p =\\<^sub>u q)\\<^sup>- = (p\\<^sup>- =\\<^sub>u q\\<^sup>-)\"\n  by (pred_auto)\n\nlemma not_convr [simp]: \"(\\<not> p)\\<^sup>- = (\\<not> p\\<^sup>-)\"\n  by (pred_auto)\n\nlemma disj_convr [simp]: \"(p \\<or> q)\\<^sup>- = (q\\<^sup>- \\<or> p\\<^sup>-)\"\n  by (pred_auto)\n\nlemma conj_convr [simp]: \"(p \\<and> q)\\<^sup>- = (q\\<^sup>- \\<and> p\\<^sup>-)\"\n  by (pred_auto)\n\nlemma seqr_convr [simp]: \"(p ;; q)\\<^sup>- = (q\\<^sup>- ;; p\\<^sup>-)\"\n  by rel_auto\n\nlemma pre_convr [simp]: \"\\<lceil>p\\<rceil>\\<^sub><\\<^sup>- = \\<lceil>p\\<rceil>\\<^sub>>\"\n  by (rel_auto)\n\nlemma post_convr [simp]: \"\\<lceil>p\\<rceil>\\<^sub>>\\<^sup>- = \\<lceil>p\\<rceil>\\<^sub><\"\n  by (rel_auto)\n\ntheorem seqr_pre_transfer: \"in\\<alpha> \\<sharp> q \\<Longrightarrow> ((P \\<and> q) ;; R) = (P ;; (q\\<^sup>- \\<and> R))\"\n  by (rel_auto)\n\ntheorem seqr_pre_transfer':\n  \"((P \\<and> \\<lceil>q\\<rceil>\\<^sub>>) ;; R) = (P ;; (\\<lceil>q\\<rceil>\\<^sub>< \\<and> R))\"\n  by (rel_auto)\n\ntheorem seqr_post_out: \"in\\<alpha> \\<sharp> r \\<Longrightarrow> (P ;; (Q \\<and> r)) = ((P ;; Q) \\<and> r)\"\n  by (rel_blast)\n\nlemma seqr_post_var_out:\n  fixes x :: \"(bool, '\\<alpha>) uvar\"\n  shows \"(P ;; (Q \\<and> $x\\<acute>)) = ((P ;; Q) \\<and> $x\\<acute>)\"\n  by (rel_auto)\n\ntheorem seqr_post_transfer: \"out\\<alpha> \\<sharp> q \\<Longrightarrow> (P ;; (q \\<and> R)) = ((P \\<and> q\\<^sup>-) ;; R)\"\n  by (simp add: seqr_pre_transfer unrest_convr_in\\<alpha>) \n\nlemma seqr_pre_out: \"out\\<alpha> \\<sharp> p \\<Longrightarrow> ((p \\<and> Q) ;; R) = (p \\<and> (Q ;; R))\"\n  by (rel_blast)\n\nlemma seqr_pre_var_out:\n  fixes x :: \"(bool, '\\<alpha>) uvar\"\n  shows \"(($x \\<and> P) ;; Q) = ($x \\<and> (P ;; Q))\"\n  by (rel_auto)\n\nlemma seqr_true_lemma:\n  \"(P = (\\<not> ((\\<not> P) ;; true))) = (P = (P ;; true))\"\n  by rel_auto\n\nlemma seqr_to_conj: \"\\<lbrakk> out\\<alpha> \\<sharp> P; in\\<alpha> \\<sharp> Q \\<rbrakk> \\<Longrightarrow> (P ;; Q) = (P \\<and> Q)\"\n  by (metis postcond_left_unit seqr_pre_out utp_pred.inf_top.right_neutral)\n    \nlemma shEx_lift_seq_1 [uquant_lift]:\n  \"((\\<^bold>\\<exists> x \\<bullet> P x) ;; Q) = (\\<^bold>\\<exists> x \\<bullet> (P x ;; Q))\"\n  by pred_auto\n\nlemma shEx_lift_seq_2 [uquant_lift]:\n  \"(P ;; (\\<^bold>\\<exists> x \\<bullet> Q x)) = (\\<^bold>\\<exists> x \\<bullet> (P ;; Q x))\"\n  by pred_auto\n\nsubsection {* Relational unrestriction *}\n\ntext {* Relational unrestriction states that a variable is unchanged by a relation. Eventually\n  I'd also like to have it state that the relation also does not depend on the variable's\n  initial value, but I'm not sure how to state that yet. For now we represent this by\n  the parametric healthiness condition RID. *}\n\ndefinition RID :: \"('a, '\\<alpha>) uvar \\<Rightarrow> '\\<alpha> hrel \\<Rightarrow> '\\<alpha> hrel\"\nwhere \"RID x P = ((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n\ndeclare RID_def [urel_defs]\n\nlemma RID_idem:\n  \"mwb_lens x \\<Longrightarrow> RID(x)(RID(x)(P)) = RID(x)(P)\"\n  by (rel_auto)\n\nlemma RID_mono:\n  \"P \\<sqsubseteq> Q \\<Longrightarrow> RID(x)(P) \\<sqsubseteq> RID(x)(Q)\"\n  by (rel_auto)\n\nlemma RID_skip_r:\n  \"vwb_lens x \\<Longrightarrow> RID(x)(II) = II\"\n  apply (rel_auto) using vwb_lens.put_eq by fastforce\n\nlemma RID_disj:\n  \"RID(x)(P \\<or> Q) = (RID(x)(P) \\<or> RID(x)(Q))\"\n  by (rel_auto)\n\nlemma RID_conj:\n  \"vwb_lens x \\<Longrightarrow> RID(x)(RID(x)(P) \\<and> RID(x)(Q)) = (RID(x)(P) \\<and> RID(x)(Q))\"\n  by (rel_auto)\n\nlemma RID_assigns_r_diff:\n  \"\\<lbrakk> vwb_lens x; x \\<sharp> \\<sigma> \\<rbrakk> \\<Longrightarrow> RID(x)(\\<langle>\\<sigma>\\<rangle>\\<^sub>a) = \\<langle>\\<sigma>\\<rangle>\\<^sub>a\"\n  apply (rel_auto)\n  apply (metis vwb_lens.put_eq)\n  apply (metis vwb_lens_wb wb_lens.get_put wb_lens_weak weak_lens.put_get)\ndone\n\nlemma RID_assign_r_same:\n  \"vwb_lens x \\<Longrightarrow> RID(x)(x :== v) = II\"\n  apply (rel_auto)\n  using vwb_lens.put_eq apply fastforce\ndone\n\nlemma RID_seq_left:\n  assumes \"vwb_lens x\"\n  shows \"RID(x)(RID(x)(P) ;; Q) = (RID(x)(P) ;; RID(x)(Q))\"\nproof -\n  have \"RID(x)(RID(x)(P) ;; Q) = ((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> ((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) \\<and> $x\\<acute> =\\<^sub>u $x) ;; Q) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n    by (simp add: RID_def usubst)\n  also from assms have \"... = ((((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) \\<and> (\\<exists> $x \\<bullet> $x\\<acute> =\\<^sub>u $x)) ;; (\\<exists> $x\\<acute> \\<bullet> Q)) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n    by (rel_auto)\n  also from assms have \"... = (((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) ;; (\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> Q)) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n    apply (rel_auto)\n    apply (metis vwb_lens.put_eq)\n    apply (metis mwb_lens.put_put vwb_lens_mwb)\n  done\n  also from assms have \"... = ((((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) \\<and> $x\\<acute> =\\<^sub>u $x) ;; (\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> Q)) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n    by (rel_simp, metis (full_types) mwb_lens.put_put vwb_lens_def wb_lens_weak weak_lens.put_get)\n  also have \"... = ((((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) \\<and> $x\\<acute> =\\<^sub>u $x) ;; ((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> Q) \\<and> $x\\<acute> =\\<^sub>u $x)) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n    by (rel_simp, fastforce)\n  also have \"... = ((((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) \\<and> $x\\<acute> =\\<^sub>u $x) ;; ((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> Q) \\<and> $x\\<acute> =\\<^sub>u $x)))\"\n    by (rel_auto)\n  also have \"... = (RID(x)(P) ;; RID(x)(Q))\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nlemma RID_seq_right:\n  assumes \"vwb_lens x\"\n  shows \"RID(x)(P ;; RID(x)(Q)) = (RID(x)(P) ;; RID(x)(Q))\"\nproof -\n  have \"RID(x)(P ;; RID(x)(Q)) = ((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P ;; ((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> Q) \\<and> $x\\<acute> =\\<^sub>u $x)) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n    by (simp add: RID_def usubst)\n  also from assms have \"... = (((\\<exists> $x \\<bullet>  P) ;; (\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> Q) \\<and> (\\<exists> $x\\<acute> \\<bullet> $x\\<acute> =\\<^sub>u $x)) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n    by (rel_auto)\n  also from assms have \"... = (((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) ;; (\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> Q)) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n    apply (rel_auto)\n    apply (metis vwb_lens.put_eq)\n    apply (metis mwb_lens.put_put vwb_lens_mwb)\n  done\n  also from assms have \"... = ((((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) \\<and> $x\\<acute> =\\<^sub>u $x) ;; (\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> Q)) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n    by (rel_simp, metis (full_types) mwb_lens.put_put vwb_lens_def wb_lens_weak weak_lens.put_get)\n  also have \"... = ((((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) \\<and> $x\\<acute> =\\<^sub>u $x) ;; ((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> Q) \\<and> $x\\<acute> =\\<^sub>u $x)) \\<and> $x\\<acute> =\\<^sub>u $x)\"\n    by (rel_simp, fastforce)\n  also have \"... = ((((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> P) \\<and> $x\\<acute> =\\<^sub>u $x) ;; ((\\<exists> $x \\<bullet> \\<exists> $x\\<acute> \\<bullet> Q) \\<and> $x\\<acute> =\\<^sub>u $x)))\"\n    by (rel_auto)\n  also have \"... = (RID(x)(P) ;; RID(x)(Q))\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\ndefinition unrest_relation :: \"('a, '\\<alpha>) uvar \\<Rightarrow> '\\<alpha> hrel \\<Rightarrow> bool\" (infix \"\\<sharp>\\<sharp>\" 20)\nwhere \"(x \\<sharp>\\<sharp> P) \\<longleftrightarrow> (P = RID(x)(P))\"\n\ndeclare unrest_relation_def [urel_defs]\n\nlemma skip_r_runrest [unrest]:\n  \"vwb_lens x \\<Longrightarrow> x \\<sharp>\\<sharp> II\"\n  by (simp add: RID_skip_r unrest_relation_def)\n\nlemma assigns_r_runrest:\n  \"\\<lbrakk> vwb_lens x; x \\<sharp> \\<sigma> \\<rbrakk> \\<Longrightarrow> x \\<sharp>\\<sharp> \\<langle>\\<sigma>\\<rangle>\\<^sub>a\"\n  by (simp add: RID_assigns_r_diff unrest_relation_def)\n\nlemma seq_r_runrest [unrest]:\n  assumes \"vwb_lens x\" \"x \\<sharp>\\<sharp> P\" \"x \\<sharp>\\<sharp> Q\"\n  shows \"x \\<sharp>\\<sharp> (P ;; Q)\"\n  by (metis RID_seq_left assms unrest_relation_def)\n\nlemma false_runrest [unrest]: \"x \\<sharp>\\<sharp> false\"\n  by (rel_auto)\n\nlemma and_runrest [unrest]: \"\\<lbrakk> vwb_lens x; x \\<sharp>\\<sharp> P; x \\<sharp>\\<sharp> Q \\<rbrakk> \\<Longrightarrow> x \\<sharp>\\<sharp> (P \\<and> Q)\"\n  by (metis RID_conj unrest_relation_def)\n\nlemma or_runrest [unrest]: \"\\<lbrakk> x \\<sharp>\\<sharp> P; x \\<sharp>\\<sharp> Q \\<rbrakk> \\<Longrightarrow> x \\<sharp>\\<sharp> (P \\<or> Q)\"\n  by (simp add: RID_disj unrest_relation_def)\n\nsubsection {* Alphabet laws *}\n\nlemma aext_cond [alpha]:\n  \"(P \\<triangleleft> b \\<triangleright> Q) \\<oplus>\\<^sub>p a = ((P \\<oplus>\\<^sub>p a) \\<triangleleft>(b \\<oplus>\\<^sub>p a)\\<triangleright>(Q \\<oplus>\\<^sub>p a))\"\n  by (rel_auto)\n\nlemma aext_seq [alpha]:\n  \"wb_lens a \\<Longrightarrow> ((P ;; Q) \\<oplus>\\<^sub>p (a \\<times>\\<^sub>L a)) = ((P \\<oplus>\\<^sub>p (a \\<times>\\<^sub>L a)) ;; (Q \\<oplus>\\<^sub>p (a \\<times>\\<^sub>L a)))\"\n  by (rel_simp, metis wb_lens_weak weak_lens.put_get)\n\n\nend\n", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/orca/utp/utp_urel_laws.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.31596646458854}}
{"text": "(* uses Isabelle2017 and autocorres version 1.0 *)\ntheory ShortestPathNegCVerification\n  imports \n  \"checker-verification/Library/Autocorres_Misc\"\n  \"checker-verification/Witness_Property/ShortestPathNeg\"\nbegin\n\n(* Parse the input file. *)\ninstall_C_file \"shortest_path_neg_checker.c\"\n\nautocorres \"shortest_path_neg_checker.c\"\n\ncontext shortest_path_neg_checker begin\n\nthm \"is_wellformed_body_def\"\nthm \"trian_body_def\"\nthm \"just_body_def\"\nthm \"check_basic_just_sp_body_def\"\n\nthm \"is_wellformed'_def\"\nthm \"trian'_def\"\nthm \"just'_def\"\nthm \"check_basic_just_sp'_def\"\n\n(*Implementation Graph Types*)\n\ntype_synonym IVertex = \"32 word\"\ntype_synonym IEdge_Id = \"32 word\"\ntype_synonym IEdge = \"IVertex \\<times> IVertex\"\ntype_synonym IPEdge = \"IVertex \\<Rightarrow> 32 word\" \ntype_synonym IEInt = \"IVertex \\<Rightarrow> (32 word \\<times> 32 signed word)\"\ntype_synonym ICost = \"IVertex \\<Rightarrow> 32 word\"\ntype_synonym IGraph = \"32 word \\<times> 32 word \\<times> (IEdge_Id \\<Rightarrow> IEdge)\"\n(*\nabbreviation \n  ivertex_cnt :: \"IGraph \\<Rightarrow> 32 word\"\nwhere \n  \"ivertex_cnt G \\<equiv> fst G\"\n\nabbreviation \n  iedge_cnt :: \"IGraph \\<Rightarrow> 32 word\"\nwhere \n  \"iedge_cnt G \\<equiv> fst (snd G)\"\n\nabbreviation \n  iedges :: \"IGraph \\<Rightarrow> IEdge_Id \\<Rightarrow> IEdge\"\nwhere \n  \"iedges G \\<equiv> snd (snd G)\"\n\nabbreviation \n  val :: \"IEInt \\<Rightarrow> IVertex \\<Rightarrow> 32 word\"\nwhere \n  \"val f v \\<equiv> fst (f v)\"\n\nfun \n  bool::\"32 signed word \\<Rightarrow> bool\" \nwhere \n  \"bool b = (if b=0 then False else True)\"\n\nabbreviation \n  is_inf ::  \"IEInt \\<Rightarrow> IVertex \\<Rightarrow> bool\"\nwhere \n  \"is_inf f v \\<equiv> bool (snd (f v))\"\n\n(* Make List - makes a list containing the result of a function *)\n\nfun \n  mk_list' :: \"nat \\<Rightarrow> (32 word \\<Rightarrow> 'b) \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list' n f = map f  (map of_nat [0..<n])\"\n\nfun \n  mk_list'_temp :: \"nat \\<Rightarrow> (32 word \\<Rightarrow> 'b) \\<Rightarrow> nat \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list'_temp 0 _ _ = []\" |\n  \"mk_list'_temp (Suc x) f i = (f (of_nat i)) # mk_list'_temp x f (Suc i)\"\n\n(* Make graph lists *)\nfun\n  mk_iedge_list :: \"IGraph \\<Rightarrow> IEdge list\"\nwhere \n  \"mk_iedge_list G = mk_list' (unat (iedge_cnt G)) (iedges G)\"\n\nfun \n  mk_inum_list :: \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> (32 word \\<times> 32 signed word) list\"\nwhere \n  \"mk_inum_list G num = mk_list' (unat (ivertex_cnt G)) num\"\n  \nfun \n  mk_ipedge_list :: \"IGraph \\<Rightarrow> IPEdge \\<Rightarrow> 32 word list\"\nwhere\n  \"mk_ipedge_list G pedge = mk_list' (unat (ivertex_cnt G)) pedge\"\n\nfun\n  mk_idist_list :: \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> (32 word \\<times> 32 signed word) list\"\nwhere\n  \"mk_idist_list G dis = mk_list' (unat (ivertex_cnt G)) dis\"\n\nfun\n  mk_icost_list :: \"IGraph \\<Rightarrow> ICost \\<Rightarrow> 32 word list\"\nwhere\n  \"mk_icost_list G cost = mk_list' (unat (iedge_cnt G)) cost\"\n\n(* Equate to Implementation *)\n\nlemma sint_ucast: \n  \"sint (ucast (x ::word32) :: sword32) = sint x\"\n  by (clarsimp simp: sint_uint uint_up_ucast is_up)\n\nfun\n  to_edge :: \"IEdge \\<Rightarrow> Edge_C\"\nwhere\n  \"to_edge (u,v) = Edge_C u v\"\n\nlemma s_C_pte[simp]:\n  \"first_C (to_edge e) = fst e\"\n  by (cases e) auto\n\nlemma t_C_pte[simp]:\n  \"second_C (to_edge e) = snd e\"\n  by (cases e) auto\n\nfun\n  to_eint :: \"(32 word \\<times> 32 signed word) \\<Rightarrow> EInt_C\"\nwhere\n  \"to_eint p = EInt_C (fst p) (snd p)\"\n\nlemma val_C_pte[simp]:\n  \"val_C (to_eint p) = fst p\"\n  by (case_tac \"p\") auto\n\nlemma isInf_C_pte[simp]:\n  \"isInf_C (to_eint p) = snd p\"\n  by (cases p) auto\n\ndefinition is_graph where\n  \"is_graph h iG p \\<equiv>\n    is_valid_Graph_C h p \\<and> \n    ivertex_cnt iG = num_vertices_C (heap_IGraph_C h p) \\<and> \n    iedge_cnt iG = num_edges_C (heap_IGraph_C h p) \\<and>\n    arrlist (heap_Edge_C h) (is_valid_IEdge_C h)\n      (map to_edge (mk_iedge_list iG)) (arcs_C (heap_IGraph_C h p))\"\n\ndefinition \n  \"is_numm h iG iN p \\<equiv> \n        arrlist (\\<lambda>p. heap_EInt_C h p) (\\<lambda>p. is_valid_EInt_C h p) \n        (map to_eint (mk_inum_list iG iN)) p\"\n\ndefinition\n  \"is_pedge h iG iP  (p:: 32 signed word ptr) \\<equiv> arrlist (\\<lambda>p. heap_w32 h (ptr_coerce p))\n        (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) (mk_ipedge_list iG iP) p\"\n\ndefinition\n  \"is_dist h iG iD p \\<equiv> \n        arrlist (\\<lambda>p. heap_EInt_C h p) (\\<lambda>p. is_valid_EInt_C h p) \n        (map to_eint (mk_idist_list iG iD)) p\"\n\n\ndefinition \n  \"is_cost h iG iC p \\<equiv> arrlist (\\<lambda>p. heap_w32 h (ptr_coerce p)) (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) (mk_icost_list iG iC) p\"\n\n(* Abstract Graph *)\n\ndefinition \n  no_loops :: \"('a, 'b) pre_digraph \\<Rightarrow> bool\" \nwhere\n  \"no_loops G \\<equiv> \\<forall>e \\<in> arcs G. tail G e \\<noteq> head G e\"\n\ndefinition \n  abs_IGraph :: \"IGraph \\<Rightarrow> (32 word, 32 word) pre_digraph\" \nwhere\n  \"abs_IGraph G \\<equiv> \\<lparr> verts = {0..<ivertex_cnt G}, arcs = {0..<iedge_cnt G},\n    tail = fst o iedges G, head = snd o iedges G \\<rparr>\"\n\nlemma verts_absI[simp]: \"verts (abs_IGraph G) = {0..<ivertex_cnt G}\"\n  and edges_absI[simp]: \"arcs (abs_IGraph G) = {0..<iedge_cnt G}\"\n  and start_absI[simp]: \"tail (abs_IGraph G) e = fst (iedges G e)\"\n  and target_absI[simp]: \"head (abs_IGraph G) e = snd (iedges G e)\"\n  by (auto simp: abs_IGraph_def)\n\ndefinition\n  abs_ICost :: \"(IEdge_Id \\<Rightarrow> 32 word) \\<Rightarrow> IEdge_Id \\<Rightarrow> real\"\nwhere\n  \"abs_ICost c e \\<equiv> real (unat (c e))\"\n\ndefinition\n  abs_IDist :: \"(32 word \\<Rightarrow> (32 word \\<times> 32 word)) \\<Rightarrow> 32 word \\<Rightarrow> ereal\"\nwhere\n  \"abs_IDist d v \\<equiv> if snd (d v) \\<noteq> 0 then \\<infinity> else \n         ereal (real (unat (fst (d v))))\"\n\ndefinition\n  abs_INum :: \"(32 word \\<Rightarrow> (32 word \\<times> 32 word)) \\<Rightarrow> 32 word \\<Rightarrow> enat\"\nwhere\n  \"abs_INum n v \\<equiv> if snd (n v) \\<noteq> 0 then \\<infinity> else enat (unat (fst (n v)))\"\n\ndefinition \n  abs_IPedge :: \"(32 word \\<Rightarrow> 32 word) \\<Rightarrow> 32 word \\<Rightarrow> 32 word option\" \nwhere\n  \"abs_IPedge p v \\<equiv> if sint (p v) < 0 then None else Some (p v)\"\n\nlemma None_abs_pedgeI[simp]: \n  \"((abs_IPedge p) v = None) = (sint (p v) < 0)\"\n  using abs_IPedge_def by auto\n\nlemma Some_abs_pedgeI[simp]: \n  \"(\\<exists>e. (abs_IPedge p) v = Some e) = (sint (p v) \\<ge> 0)\"\n  using None_not_eq None_abs_pedgeI \n  by (metis abs_IPedge_def linorder_not_le option.simps(3))\n    \n(*Helper Lemmas*)\n\nlemma wellformed_iGraph:\n  assumes \"wf_digraph (abs_IGraph G)\"\n  shows \"\\<And>e. e < iedge_cnt G \\<Longrightarrow> \n        fst (iedges G e) < ivertex_cnt G \\<and> \n        snd (iedges G e) < ivertex_cnt G\" \n  using assms unfolding wf_digraph_def by simp\n\nlemma unat_image_upto:\n  fixes n :: \"32 word\"\n  shows \"unat ` {0..<n} = {unat 0..<unat n}\" (is \"?A = ?B\")\nproof\n  show \"?B \\<subseteq> ?A\"  \n  proof \n    fix i assume a: \"i \\<in> ?B\"\n    then obtain i':: \"32 word\" where ii: \"i=  unat i'\"\n      by (metis atLeastLessThan_iff le_unat_uoi less_or_eq_imp_le)\n    then have \"i' \\<in> {0..<n}\" \n      using a word_less_nat_alt by auto\n    thus  \"i \\<in> ?A\" using ii by fast\n  qed\nnext\n  show \"?A \\<subseteq> ?B\"\n  proof\n     fix i assume a: \"i \\<in> ?A\"\n    then obtain i':: \"32 word\" where ii: \"i=  unat i'\" by blast\n    then have \"i' \\<in> {0..<n}\" using a by force\n    thus  \"i \\<in> ?B\"   \n      by (metis Un_iff atLeast0LessThan ii ivl_disj_un(8) \n          lessThan_iff unat_0 unat_mono word_zero_le)\n  qed\nqed\n\nlemma path_length:\n  assumes \"vpath p (abs_IGraph iG)\"\n  shows \"vwalk_length p < unat (ivertex_cnt iG)\" \nproof -\n  have pne: \"p \\<noteq> []\" and dp: \"distinct p\" using assms by fast+\n  have \"unat (ivertex_cnt iG) = card (unat ` {0..<(fst iG)})\"  \n    using unat_image_upto by simp\n  then have \"unat (ivertex_cnt iG) = card ((verts (abs_IGraph iG)))\"  \n     by (simp add: inj_on_def card_image)\n  hence \"length p  \\<le> unat (ivertex_cnt iG)\" \n      by (metis finite_code card_mono vwalk_def\n          distinct_card[OF dp] vpath_def assms)\n  hence \"length p - 1 < unat (ivertex_cnt iG)\" \n    by (metis pne Nat.diff_le_self le_neq_implies_less \n        less_imp_diff_less minus_eq one_neq_zero length_0_conv)\n  thus \"vwalk_length p < unat (fst iG)\"\n    using  assms \n    unfolding vpath_def vwalk_def by simp\nqed\n\nlemma ptr_coerce_ptr_add_uint[simp]:\n  \"ptr_coerce (p +\\<^sub>p uint x) =  p +\\<^sub>p  (uint x)\"\n  by auto\n\nlemma heap_ptr_coerce:\n  \"\\<lbrakk>arrlist (\\<lambda>p. h (ptr_coerce p)) (\\<lambda>p. v (ptr_coerce p)) \n  (map (iL \\<circ> of_nat) [0..<unat n]) l; i < n; 0 \\<le> i\\<rbrakk> \\<Longrightarrow>\n    iL i = h (ptr_coerce (l +\\<^sub>p int (unat i)))\" \n  apply (subgoal_tac \n  \"h (ptr_coerce (l +\\<^sub>p int (unat i))) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (drule arrlist_nth_value[where i=\"int (unat i)\"], (simp add:unat_mono)+)\n  done\n\nlemma arrlist_heap:\n  \"\\<lbrakk>arrlist h v (map (iL \\<circ> of_nat) [0..<unat n]) l; \n  i < n\\<rbrakk> \\<Longrightarrow>\n    iL i = h (l +\\<^sub>p int (unat i))\" \n  apply (subgoal_tac \n  \"h (l +\\<^sub>p int (unat i)) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (simp add: arrlist_nth_value unat_mono)\n  done\n\nlemma two_comp_arrlist_heap:\n  \"\\<lbrakk> arrlist h v (map (f \\<circ> (iL \\<circ> of_nat)) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> f (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_heap \n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n\nlemma two_comp_to_eint_arrlist_heap:\n  \"\\<lbrakk> arrlist h v (map (to_eint \\<circ> (iL \\<circ> of_nat)) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> to_eint (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_heap \n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n\nlemma two_comp_to_edge_arrlist_heap:\n  \"\\<lbrakk> arrlist h v (map (to_edge \\<circ> (iL \\<circ> of_nat)) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> to_edge (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_heap \n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n \nlemma head_heap:\n  \"\\<lbrakk>arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  snd ((iedges iG) e) = second_C (h (ep +\\<^sub>p (uint e)))\" \n  using two_comp_arrlist_heap to_edge.simps t_C_pte by (metis uint_nat)\n\nlemma tail_heap:\n  \"\\<lbrakk>arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  fst ((iedges iG) e) =  first_C (h (ep +\\<^sub>p  (uint e)))\" \n  using two_comp_arrlist_heap to_edge.simps s_C_pte uint_nat by metis\n\nlemma val_heap:\n  \"\\<lbrakk>arrlist h v (map (to_eint \\<circ> (f \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  val f e = val_C (h (ep +\\<^sub>p (uint e)))\" \n  using two_comp_arrlist_heap to_eint.simps val_C_pte by (metis uint_nat)\n\nlemma is_inf_heap:\n  \"\\<lbrakk>arrlist h v (map (to_eint \\<circ> (f \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  is_inf f e = bool (isInf_C (h (ep +\\<^sub>p (uint e))))\" \n  using two_comp_arrlist_heap to_eint.simps isInf_C_pte by (metis uint_nat)\n\nthm \"is_wellformed'_def\"\n*)\n\nabbreviation \n  ivertex_cnt :: \"IGraph \\<Rightarrow> 32 word\"\nwhere \n  \"ivertex_cnt G \\<equiv> fst G\"\n\nabbreviation \n  iedge_cnt :: \"IGraph \\<Rightarrow> 32 word\"\nwhere \n  \"iedge_cnt G \\<equiv> fst (snd G)\"\n\nabbreviation \n  iedges :: \"IGraph \\<Rightarrow> IEdge_Id \\<Rightarrow> IEdge\"\nwhere \n  \"iedges G \\<equiv> snd (snd G)\"\n\nabbreviation \n  val :: \"IEInt \\<Rightarrow> IVertex \\<Rightarrow> 32 word\"\nwhere \n  \"val f v \\<equiv> fst (f v)\"\n\nfun \n  bool::\"32 word \\<Rightarrow> bool\" \nwhere \n  \"bool b = (if b=0 then False else True)\"\n\nabbreviation \n  is_inf ::  \"IEInt \\<Rightarrow> IVertex \\<Rightarrow> 32 signed word\"\nwhere \n  \"is_inf f v \\<equiv> snd (f v)\"\n(*\nabbreviation \n  is_ninf_dist ::  \"IEInt \\<Rightarrow> IVertex \\<Rightarrow> 32 signed word\"\nwhere \n  \"is_ninf_dist f v \\<equiv> if (snd (f v))<0 then True else False\"\n\nvalue \"(-1::32 signed word) \\<le> 0\"\nabbreviation \n  is_inf_dist ::  \"IEInt \\<Rightarrow> IVertex \\<Rightarrow> bool\"\nwhere \n  \"is_inf_dist f v \\<equiv> if (snd (f v))>0 then True else False\"\n*)\n(* Make List - makes a list containing the result of a function *)\n\nfun \n  mk_list' :: \"nat \\<Rightarrow> (32 word \\<Rightarrow> 'b) \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list' n f = map f  (map of_nat [0..<n])\"\n\nfun \n  mk_list'_temp :: \"nat \\<Rightarrow> (32 word \\<Rightarrow> 'b) \\<Rightarrow> nat \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list'_temp 0 _ _ = []\" |\n  \"mk_list'_temp (Suc x) f i = (f (of_nat i)) # mk_list'_temp x f (Suc i)\"\n\n(* Make graph lists *)\nfun\n  mk_iedge_list :: \"IGraph \\<Rightarrow> IEdge list\"\nwhere \n  \"mk_iedge_list G = mk_list' (unat (iedge_cnt G)) (iedges G)\"\n\nfun \n  mk_inum_list :: \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> (32 word \\<times> 32 signed word) list\"\nwhere \n  \"mk_inum_list G num = mk_list' (unat (ivertex_cnt G)) num\"\n  \nfun \n  mk_ipedge_list :: \"IGraph \\<Rightarrow> IPEdge \\<Rightarrow> 32 word list\"\nwhere\n  \"mk_ipedge_list G pedge = mk_list' (unat (ivertex_cnt G)) pedge\"\n\nfun\n  mk_idist_list :: \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> (32 word \\<times> 32 signed word) list\"\nwhere\n  \"mk_idist_list G dis = mk_list' (unat (ivertex_cnt G)) dis\"\n\nfun\n  mk_icost_list :: \"IGraph \\<Rightarrow> ICost \\<Rightarrow> 32 word list\"\nwhere\n  \"mk_icost_list G cost = mk_list' (unat (iedge_cnt G)) cost\"\n\n(* Equate to Implementation *)\n\nlemma sint_ucast: \n  \"sint (ucast (x ::word32) :: sword32) = sint x\"\n  by (clarsimp simp: sint_uint uint_up_ucast is_up)\n\nlemma long_ucast:\n  \"unat (ucast (x ::word32) :: word64) = unat x\"\n  by (simp add: is_up uint_up_ucast unat_def)\n\nfun\n  to_edge :: \"IEdge \\<Rightarrow> Edge_C\"\nwhere\n  \"to_edge (u,v) = Edge_C u v\"\n\nlemma s_C_pte[simp]:\n  \"first_C (to_edge e) = fst e\"\n  by (cases e) auto\n\nlemma t_C_pte[simp]:\n  \"second_C (to_edge e) = snd e\"\n  by (cases e) auto\n\nfun cast_long :: \"32 word \\<Rightarrow> 64 word\"\n  where \n  \"cast_long x = ucast x\"\n\nfun\n  to_eint :: \"(32 word \\<times> 32 signed word) \\<Rightarrow> EInt_C\"\nwhere\n  \"to_eint p = EInt_C (fst p) (snd p)\"\n\nlemma val_C_pte[simp]:\n  \"val_C (to_eint p) = fst p\"\n  by (case_tac \"p\") auto\n\nlemma isInf_C_pte[simp]:\n  \"isInf_C (to_eint p) = snd p\"\n  by (cases p) auto\n\ndefinition is_graph where\n  \"is_graph h iG p \\<equiv>\n    is_valid_Graph_C h p \\<and> \n    ivertex_cnt iG = num_vertices_C (heap_Graph_C h p) \\<and> \n    iedge_cnt iG = num_edges_C (heap_Graph_C h p) \\<and>\n    arrlist (heap_Edge_C h) (is_valid_Edge_C h)\n      (map to_edge (mk_iedge_list iG)) (arcs_C (heap_Graph_C h p))\"\n\ndefinition \n  \"is_numm h iG iN p \\<equiv> \n        arrlist (\\<lambda>p. heap_EInt_C h p) (\\<lambda>p. is_valid_EInt_C h p) \n        (map to_eint (mk_inum_list iG iN)) p\"\n\ndefinition\n  \"is_pedge h iG iP  (p:: 32 signed word ptr) \\<equiv> arrlist (\\<lambda>p. heap_w32 h (ptr_coerce p))\n        (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) (mk_ipedge_list iG iP) p\"\n\ndefinition\n  \"is_dist h iG iD p \\<equiv> \n        arrlist (\\<lambda>p. heap_EInt_C h p) (\\<lambda>p. is_valid_EInt_C h p) \n        (map to_eint (mk_idist_list iG iD)) p\"\n\nfind_consts name:\"heap_w\"\n\ndefinition\n  \"is_cost h iG iC  (p:: 32 signed word ptr) \\<equiv> arrlist (\\<lambda>p. scast (heap_w32 h (ptr_coerce p)))\n        (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) (mk_icost_list iG iC) p\"\n\n(* Lemmas for unat and of_nat *)\nlemma eq_of_nat_conv:\n  assumes \"unat w1 = n\"\n  shows \"w2 = of_nat n \\<longleftrightarrow> w2 = w1\"\n  using assms by auto\n\n(* More Lemmas for unat and of_nat *)\nlemma less_unat_plus1: \n  assumes \"a < unat (b + 1)\"\n  shows \"a < unat b \\<or> a = unat b\"\n  apply (subgoal_tac  \"b + 1 \\<noteq> 0 \")\n  using assms unat_minus_one add_diff_cancel \n  by fastforce+\n\nlemma unat_minus_plus1_less:\n  fixes a b\n  assumes \"a < b\"\n  shows \"unat (b - (a + 1)) < unat (b - a)\"\n  by (metis (no_types) ab_semigroup_add_class.add_ac(1) right_minus_eq measure_unat\n      add_diff_cancel2 assms is_num_normalize(1) zadd_diff_inverse linorder_neq_iff)\n\n(* Abstract Graph *)\n\ndefinition \n  no_loops :: \"('a, 'b) pre_digraph \\<Rightarrow> bool\" \nwhere\n  \"no_loops G \\<equiv> \\<forall>e \\<in> arcs G. tail G e \\<noteq> head G e\"\n\ndefinition \n  abs_IGraph :: \"IGraph \\<Rightarrow> (32 word, 32 word) pre_digraph\" \nwhere\n  \"abs_IGraph G \\<equiv> \\<lparr> verts = {0..<ivertex_cnt G}, arcs = {0..<iedge_cnt G},\n    tail = fst o iedges G, head = snd o iedges G \\<rparr>\"\n\nlemma verts_absI[simp]: \"verts (abs_IGraph G) = {0..<ivertex_cnt G}\"\n  and edges_absI[simp]: \"arcs (abs_IGraph G) = {0..<iedge_cnt G}\"\n  and start_absI[simp]: \"tail (abs_IGraph G) e = fst (iedges G e)\"\n  and target_absI[simp]: \"head (abs_IGraph G) e = snd (iedges G e)\"\n  by (auto simp: abs_IGraph_def)\nterm sint\n\ndefinition\n  abs_ICost :: \"(IEdge_Id \\<Rightarrow> 32 word) \\<Rightarrow> IEdge_Id \\<Rightarrow> real\"\nwhere\n  \"abs_ICost c e \\<equiv>  (sint (c e))\"\n\ndefinition\n  abs_IDist :: \"(32 word \\<Rightarrow> (32 word \\<times> 32 signed word)) \\<Rightarrow> 32 word \\<Rightarrow> ereal\"\nwhere\n  \"abs_IDist d v \\<equiv> \n            if msb (snd (d v)) then MInfty else\n            if snd (d v) \\<noteq> 0 then PInfty else       \n              ereal (real (unat (fst (d v))))\"\n\ndefinition\n  abs_INum :: \"(32 word \\<Rightarrow> (32 word \\<times> 32 signed word)) \\<Rightarrow> 32 word \\<Rightarrow> enat\"\nwhere \n  \"abs_INum n v \\<equiv> if (snd (n v) \\<noteq> 0 \\<or> msb (snd (n v))) then \\<infinity> else enat (unat (fst (n v)))\"\n\ndefinition \n  abs_IPedge :: \"(32 word \\<Rightarrow> 32 word) \\<Rightarrow> 32 word \\<Rightarrow> 32 word option\" \nwhere\n  \"abs_IPedge p v \\<equiv> if msb (p v) then None else Some (p v)\"\n\nlemma None_abs_pedgeI[simp]: \n  \"((abs_IPedge p) v = None) = msb (p v)\"\n  using abs_IPedge_def by auto\n\nlemma Some_abs_pedgeI[simp]: \n  \"(\\<exists>e. (abs_IPedge p) v = Some e) = (~ (msb (p v)))\"\n  using None_not_eq None_abs_pedgeI \n  by (metis abs_IPedge_def)\n    \n(*Helper Lemmas*)\n\nlemma wellformed_iGraph:\n  assumes \"wf_digraph (abs_IGraph G)\"\n  shows \"\\<And>e. e < iedge_cnt G \\<Longrightarrow> \n        fst (iedges G e) < ivertex_cnt G \\<and> \n        snd (iedges G e) < ivertex_cnt G\" \n  using assms unfolding wf_digraph_def by simp\n\nlemma unat_image_upto:\n  fixes n :: \"32 word\"\n  shows \"unat ` {0..<n} = {unat 0..<unat n}\" (is \"?A = ?B\")\nproof\n  show \"?B \\<subseteq> ?A\"  \n  proof \n    fix i assume a: \"i \\<in> ?B\"\n    then obtain i':: \"32 word\" where ii: \"i=  unat i'\"\n      by (metis atLeastLessThan_iff le_unat_uoi less_or_eq_imp_le)\n    then have \"i' \\<in> {0..<n}\" \n      using a word_less_nat_alt by auto\n    thus  \"i \\<in> ?A\" using ii by fast\n  qed\nnext\n  show \"?A \\<subseteq> ?B\"\n  proof\n     fix i assume a: \"i \\<in> ?A\"\n    then obtain i':: \"32 word\" where ii: \"i=  unat i'\" by blast\n    then have \"i' \\<in> {0..<n}\" using a by force\n    thus  \"i \\<in> ?B\"   \n      by (metis Un_iff atLeast0LessThan ii ivl_disj_un(8) \n          lessThan_iff unat_0 unat_mono word_zero_le)\n  qed\nqed\n\n(* word lemmas*)\nlemma unat_simp: \n  \"\\<And>x y:: 32 word. unat (x + y) \\<ge> unat x \\<longleftrightarrow> \n      unat (x + y) = unat x + unat y\"\n  using unat_plus_simple word_le_nat_alt by blast\n\nlemma unat_simp_2:\n  \"\\<And>x y :: 32 word. unat (x + y) = unat x + unat y \\<longrightarrow> unat x + unat y \\<ge> unat x\"\n  by simp\n\nlemma unat_leq_plus:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"unat x \\<le> unat y + unat z\" \n  by (simp add: assms word_unat_less_le)\n\nlemma unat_leq_plus_64:\n  fixes x y z :: \"64 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"unat x \\<le> unat y + unat z\" \n  by (simp add: assms word_unat_less_le)\n\nlemma real_unat_leq_plus:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"real (unat x) \\<le> real (unat y) + real (unat z)\" \n  using assms unat_leq_plus by fastforce\n\nlemma real_unat_leq_plus_64:\n  fixes x y z :: \"64 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"real (unat x) \\<le> real (unat y) + real (unat z)\" \n  using assms unat_leq_plus_64 by fastforce\n\nlemma real_nat:\n  fixes x y z :: \"nat\"\n  assumes a1: \"real x \\<le> real y + real z\"\n  shows \"x \\<le> y + z\"\n  using assms by linarith\n\nlemma unat_leq_trian_plus:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"unat x \\<le> unat y + unat z\"\n  assumes a2: \"unat y + unat z \\<ge> unat y\"\n  assumes a3: \"unat (y + z) \\<ge> unat y\"\n  shows \"x \\<le> y + z\"\n  using a1 a3 unat_simp word_le_nat_alt by fastforce\n\nlemma unat_leq_plus_unats:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"unat x \\<le> unat (y + z)\"\n  shows \"x \\<le> y + z\"\nproof -\n  have f1: \"unat x \\<le> unat y + unat z\"\n    using a1 by (meson not_le unat_leq_plus word_less_nat_alt)\n  then show ?thesis\n    by (simp add: assms word_le_nat_alt)\nqed\n\nlemma unat_plus_leq_unats:\n  fixes y z :: \"32 word\"\n  assumes a1: \"unat y + unat z \\<le> unat (max_word :: 32 word)\"\n  shows \"unat y + unat z \\<le> unat (y + z)\"\n  using a1 \n  by unat_arith\n\nlemma trian_imp_valid:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"real (unat y) + real (unat z) \\<le> real (unat (max_word :: 32 word)) \\<and> real(unat x) \\<le> real (unat y) + real (unat z)\"\n  shows \"unat y + unat z \\<le> unat (max_word::32 word)\"\n  using a1 by linarith\n\nlemma c: \"UCAST(32 \\<rightarrow> 64) (x::word32) = cast_long x\"\n  by simp\n\nlemma cast_long_max: \"unat (cast_long (x::32 word)) \\<le> unat (max_word::word32)\"\n  using word_le_nat_alt long_ucast by auto\n\nlemma cast_long_max_extend: \"unat (cast_long (x::32 word)) \\<le> unat (max_word::word64)\"\n  using word_le_nat_alt by blast\n\nlemma trian_64_reverse:\n  fixes x y z :: \"word32\"\n  assumes a1: \"UCAST(32 \\<rightarrow> 64) x \\<le> UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z\"\n  shows \"unat x \\<le> unat y + unat z\"\n  by (metis (no_types, hide_lams) assms is_up len_of_word_comparisons(2) unat_leq_plus_64 \n            uint_up_ucast unat_def)\n\nlemma unat_plus_less_two_power_length:\n  assumes len: \"len_of TYPE('a::len) < len_of TYPE('b::len)\"\n  shows \"unat (C:: 'a word) + unat (D:: 'a word) < (2::nat) ^ LENGTH('b)\"\nproof -\n  have bounded: \"uint C < 2 ^ LENGTH('a)\" \"uint D < (2 :: int) ^ LENGTH('a)\"\n    by (insert uint_bounded)\nhave unat_bounded: \"unat C < 2 ^ LENGTH('a)\" \"unat D < (2 :: nat) ^ LENGTH('a)\"\n  by simp+\n  have suc_leq: \"Suc (len_of (TYPE('a)::'a itself)) \\<le> len_of (TYPE('b)::'b itself)\"\n    using len Suc_leI by blast\n  then have two_power_suc_leq: \"(2::nat) ^ (len_of (TYPE('a)::'a itself) + 1) \\<le> \n        2 ^ len_of (TYPE('b)::'b itself)\"\n    by (metis (no_types) One_nat_def add.right_neutral add_Suc_right \n             power_increasing_iff rel_simps(49) rel_simps(9))\n  have \"(2::nat) ^ (LENGTH ('a) + 1) = (2 ^ LENGTH ('a)) + (2 ^ LENGTH ('a))\" \n    by auto\n  then have \"unat (C:: 'a word) + unat (D:: 'a word) < (2::nat) ^ (LENGTH ('a) + 1)\"\n    using unat_bounded by linarith  \n  thus ?thesis using two_power_suc_leq \n    by linarith\nqed\n\nlemma abstract_val_ucast_add_strict_upcast:\n    \"\\<lbrakk> len_of TYPE('a::len) < len_of TYPE('b::len);\n       abstract_val P C' unat C; abstract_val P D' unat D \\<rbrakk>\n            \\<Longrightarrow>  abstract_val P (C' + D') unat \n                    ((ucast (C :: 'a word) :: 'b word) +\n                      ucast (D :: 'a word) :: 'b word)\"\n  apply (clarsimp simp: is_up unat_ucast_upcast ucast_def )\n  apply (clarsimp simp:  word_of_int_def unat_word_ariths(1))\n  apply (frule unat_plus_less_two_power_length[where C=C and D=D]) \n  by (metis Divides.mod_less add.right_neutral \n        unat_plus_less_two_power_length uint_inverse \n        uint_mod_same uint_nat unat_of_nat zero_less_numeral \n        zero_less_power)\n\nlemmas word_add_strict_up_cast_no_overflow_32_64 = \n      abstract_val_ucast_add_strict_upcast\n        [unfolded abstract_val_def,\n          OF word_abs_base(18) impI, where P=True, simplified]\nlemma word_add_cast_up_no_overflow: \n  \"unat y + unat z = unat (UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\"\n  using word_add_strict_up_cast_no_overflow_32_64 by blast\n  \nlemma add_ucast_no_overflow_64: (* add_ucast_no_overflow *)\n  fixes x y z :: \"word32\"\n  assumes a1: \"unat x \\<le> unat y + unat z\"\n  shows \"(UCAST(32 \\<rightarrow> 64) x) \\<le> (UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\"\n  apply (insert a1) \n  apply (subgoal_tac \"unat (UCAST(32 \\<rightarrow> 64) x) \\<le> \n                      unat (UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\")\n   using word_le_nat_alt apply blast\n  apply (subst word_add_cast_up_no_overflow[symmetric])\n  using long_ucast by auto\n\nlemma add_ucast_no_overflow_unat:\n  fixes x y z :: \"word32\"\n  shows \"(UCAST(32 \\<rightarrow> 64) x = UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z) = \n         (unat x = unat y + unat z)\"\nproof -\n  have \"(UCAST(32 \\<rightarrow> 64) x = UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z) \\<longrightarrow> \n         unat x = unat y + unat z\"\n    by (metis (mono_tags, hide_lams) is_up le_add_same_cancel1 \n              len_of_word_comparisons(2) add_ucast_no_overflow_64 uint_up_ucast unat_def \n              unat_plus_simple zero_le)\n  moreover \n  have \"unat x = unat y + unat z \\<longrightarrow> \n        (UCAST(32 \\<rightarrow> 64) x = UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\"\n    by (metis (mono_tags, hide_lams) is_up len_of_word_comparisons(2) \n              uint_up_ucast unat_def word_arith_nat_add word_unat.Rep_inverse)\n  ultimately show ?thesis by blast\nqed\n\n(* graph lemmas *)\nlemma path_length:\n  assumes \"vpath p (abs_IGraph iG)\"\n  shows \"vwalk_length p < unat (ivertex_cnt iG)\" \nproof -\n  have pne: \"p \\<noteq> []\" and dp: \"distinct p\" using assms by fast+\n  have \"unat (ivertex_cnt iG) = card (unat ` {0..<(fst iG)})\"  \n    using unat_image_upto by simp\n  then have \"unat (ivertex_cnt iG) = card ((verts (abs_IGraph iG)))\"  \n     by (simp add: inj_on_def card_image)\n  hence \"length p  \\<le> unat (ivertex_cnt iG)\" \n      by (metis finite_code card_mono vwalk_def\n          distinct_card[OF dp] vpath_def assms)\n  hence \"length p - 1 < unat (ivertex_cnt iG)\" \n    by (metis pne Nat.diff_le_self le_neq_implies_less \n        less_imp_diff_less minus_eq one_neq_zero length_0_conv)\n  thus \"vwalk_length p < unat (fst iG)\"\n    using  assms \n    unfolding vpath_def vwalk_def by simp\nqed\n\nlemma ptr_coerce_ptr_add_uint[simp]:\n  \"ptr_coerce (p +\\<^sub>p uint x) =  p +\\<^sub>p  (uint x)\"\n  by auto\n\nlemma heap_ptr_coerce:\n  \"\\<lbrakk>arrlist (\\<lambda>p. h (ptr_coerce p)) (\\<lambda>p. v (ptr_coerce p)) \n  (map (iL \\<circ> of_nat) [0..<unat n]) l; i < n; 0 \\<le> i\\<rbrakk> \\<Longrightarrow>\n    iL i = h (ptr_coerce (l +\\<^sub>p int (unat i)))\" \n  apply (subgoal_tac \n  \"h (ptr_coerce (l +\\<^sub>p int (unat i))) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (drule arrlist_nth_value[where i=\"int (unat i)\"], (simp add:unat_mono)+)\n  done\n\nlemma arrlist_heap:\n  \"\\<lbrakk>arrlist h v (map (iL \\<circ> of_nat) [0..<unat n]) l; \n  i < n\\<rbrakk> \\<Longrightarrow>\n    iL i = h (l +\\<^sub>p int (unat i))\" \n  apply (subgoal_tac \n  \"h (l +\\<^sub>p int (unat i)) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (simp add: arrlist_nth_value unat_mono)\n  done\n\nlemma two_comp_arrlist_heap:\n  \"\\<lbrakk> arrlist h v (map (f \\<circ> (iL \\<circ> of_nat)) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> f (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_heap \n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n\nlemma two_comp_to_eint_arrlist_heap:\n  \"\\<lbrakk> arrlist h v (map (to_eint \\<circ> (iL \\<circ> of_nat)) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> to_eint (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_heap \n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n\nlemma two_comp_to_edge_arrlist_heap:\n  \"\\<lbrakk> arrlist h v (map (to_edge \\<circ> (iL \\<circ> of_nat)) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> to_edge (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_heap \n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n \nlemma head_heap:\n  \"\\<lbrakk>arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  snd ((iedges iG) e) = second_C (h (ep +\\<^sub>p (uint e)))\" \n  using two_comp_arrlist_heap to_edge.simps t_C_pte by (metis uint_nat)\n\nlemma tail_heap:\n  \"\\<lbrakk>arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  fst ((iedges iG) e) =  first_C (h (ep +\\<^sub>p  (uint e)))\" \n  using two_comp_arrlist_heap to_edge.simps s_C_pte uint_nat by metis\n\nlemma val_heap:\n  \"\\<lbrakk>arrlist h v (map (to_eint \\<circ> (f \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  val f e = val_C (h (ep +\\<^sub>p (uint e)))\" \n  using two_comp_arrlist_heap to_eint.simps val_C_pte by (metis uint_nat)\n\nlemma is_inf_heap:\n  \"\\<lbrakk>arrlist h v (map (to_eint \\<circ> (f \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  is_inf f e =  (isInf_C (h (ep +\\<^sub>p (uint e))))\" \n  using two_comp_arrlist_heap to_eint.simps isInf_C_pte by (metis uint_nat)\n\ndefinition is_wellformed_inv :: \"IGraph \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"is_wellformed_inv G i \\<equiv> \\<forall>k < i. ivertex_cnt G > fst (iedges G k)\n        \\<and> ivertex_cnt G > snd (iedges G k)\"\n\nlemma is_wellformed_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g) \\<rbrace>\n   is_wellformed' g\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> is_wellformed_inv iG (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: is_wellformed'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> is_wellformed_inv iG ee \\<and> \n                   ee \\<le> iedge_cnt iG \\<and> \n                   is_graph s iG g\"])\n  apply (simp add: skipE_def)\n  apply wp\n  unfolding is_graph_def is_wellformed_inv_def\n    apply (subst if_bool_eq_conj)+\n    apply (simp split: if_split_asm, safe, simp_all add: arrlist_nth)\n         apply (rule_tac x = \"ee\" in exI)\n         apply (subgoal_tac \"num_vertices_C (heap_Graph_C s g) \\<le> fst (snd (snd iG) ee)\", force)\n         apply (subgoal_tac \"first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint ee)) = fst (snd (snd iG) ee)\", simp)\n         apply (subst tail_heap[where iG=iG], simp, blast+)\n        apply(rule_tac x = \"ee\" in exI)\n        apply (subgoal_tac \"num_vertices_C (heap_Graph_C s g) \\<le> snd (snd (snd iG) ee)\", force)\n        apply (subgoal_tac \"second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint ee)) = snd (snd (snd iG) ee)\", simp)\n        apply (subst head_heap[where iG=iG], simp, blast+)\n       apply (metis two_comp_arrlist_heap s_C_pte le_cases le_step uint_nat word_le_less_eq)\n      apply (metis head_heap le_step not_less)\n     apply (metis le_step word_not_le)\n    apply (metis (mono_tags, hide_lams) diff_diff_add diff_self_eq_0 eq_iff_diff_eq_0 measure_unat not_less0 word_less_nat_alt zero_less_diff)\n   apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n  apply wp \n  apply fast\n  done\n\ndefinition trian_inv :: \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> ICost \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"trian_inv G d c m \\<equiv> \n    \\<forall>i < m. \n     (is_inf d (fst (iedges G i)) = 0 \\<longrightarrow> \n      is_inf d (snd (iedges G i)) \\<le> 0  \\<and>\n       (is_inf d (snd (iedges G i)) = 0 \\<longrightarrow> \n        cast_long (val d (snd (iedges G i))) \\<le> \n        cast_long (val d (fst (iedges G i))) + cast_long (c i))) \\<and>\n     (is_inf d (fst (iedges G i)) < 0 \\<longrightarrow> \n     is_inf d (snd (iedges G i)) < 0)\"\n\nlemma trian_inv_step:\n  assumes i_less_max: \"i < (max_word::32 word)\"\n  shows \"trian_inv G d c (i + 1) \\<longleftrightarrow> (trian_inv G d c i \\<and>\n(is_inf d (fst (iedges G i)) = 0 \\<longrightarrow> \n      is_inf d (snd (iedges G i)) \\<le> 0  \\<and>\n       (is_inf d (snd (iedges G i)) = 0 \\<longrightarrow> \n        cast_long (val d (snd (iedges G i))) \\<le> \n        cast_long (val d (fst (iedges G i))) + cast_long (c i))) \\<and>\n     (is_inf d (fst (iedges G i)) < 0 \\<longrightarrow> \n     is_inf d (snd (iedges G i)) < 0))\"\n  unfolding trian_inv_def \n  apply (rule iffI)\n  using i_less_max less_le less_x_plus_1 \n  apply (fastforce) \n  by (force intro: le_step)\n\nlemma trian_inv_le:\n  assumes leq: \"j \\<le> i\" \n  assumes trian_i: \"trian_inv G d c i\"\n  shows \"trian_inv G d c j\"\n  using assms \n  by (induct j) (auto simp add: trian_inv_def)\n\nlemma cost_abs_C_equiv:\n  fixes ee :: \"32 word\" and s :: lifted_globals\n  assumes a1: \"arrlist (\\<lambda>p. heap_w32 s (ptr_coerce p)) (\\<lambda>p. is_valid_w32 s (ptr_coerce p))\n      (map (iC \\<circ> of_nat) [0..<unat (num_edges_C (heap_Graph_C s g))]) c\"\n  assumes a2: \"fst (snd iG) = num_edges_C (heap_Graph_C s g)\"\n  assumes a3: \"ee < num_edges_C (heap_Graph_C s g)\"\n  shows \"iC ee = heap_w32 s (c +\\<^sub>p int (unat (ee)))\"\nproof -\n  show ?thesis\n    using a1 a3 arrlist_heap heap_ptr_coerce \n    by fastforce  \nqed\n\nlemma enat_abs_C_equiv:\n  fixes ee :: \"32 word\" and s :: lifted_globals\n  assumes a1: \"ee < num_edges_C (heap_Graph_C s g)\"\n  assumes a2: \"arrlist (heap_EInt_C s) (is_valid_EInt_C s) (map (to_eint \\<circ> (iL \\<circ> of_nat)) [0..<unat (num_vertices_C (heap_Graph_C s g))]) l\"\n  assumes a3: \"fst iG = num_vertices_C (heap_Graph_C s g)\"\n  assumes a4: \"fst (snd iG) = num_edges_C (heap_Graph_C s g)\"\n  assumes a5: \"arrlist (heap_Edge_C s) (is_valid_Edge_C s) (map (to_edge \\<circ> (snd (snd iG) \\<circ> of_nat)) [0..<unat (num_edges_C (heap_Graph_C s g))]) (arcs_C (heap_Graph_C s g))\"\n  assumes a6: \"\\<forall>ee < num_edges_C (heap_Graph_C s g). fst (snd (snd iG) ee) < num_vertices_C (heap_Graph_C s g)\"\n  shows \"fst (iL (fst (snd (snd iG) ee))) = val_C (heap_EInt_C s (l +\\<^sub>p int (unat (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p int (unat ee)))))))\"\nproof -\n  show ?thesis using a6 a5 a4 a3 a2 a1 s_C_pte two_comp_to_edge_arrlist_heap two_comp_to_eint_arrlist_heap val_C_pte by metis\nqed\n\ndeclare if_bool_eq_conj [[simp add]]\n\nlemma is_inf_dist_fst_edges_eq:\n  \"\\<lbrakk>e < fst (snd iG); wf_digraph (abs_IGraph iG); is_graph s iG g; is_dist s iG iD d\\<rbrakk> \\<Longrightarrow>\n    isInf_C (heap_EInt_C s\n     (d +\\<^sub>p uint \n      (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p \n       uint e))))) = is_inf iD (fst (iedges iG e))\"\n  unfolding is_graph_def is_dist_def\n  apply simp \n  by (metis (no_types, hide_lams) isInf_C_pte s_C_pte \n      two_comp_arrlist_heap wellformed_iGraph uint_nat)\n\n \nlemma is_inf_dist_snd_edges_eq:\n  \"\\<lbrakk>e < fst (snd iG); wf_digraph (abs_IGraph iG); is_graph s iG g; is_dist s iG iD d\\<rbrakk> \\<Longrightarrow>\n    isInf_C (heap_EInt_C s\n     (d +\\<^sub>p uint \n      (second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p \n       uint e))))) = is_inf iD (snd (iedges iG e))\"\nunfolding is_graph_def is_dist_def\n  apply simp \n  by (metis (no_types, hide_lams) isInf_C_pte t_C_pte \n      two_comp_arrlist_heap wellformed_iGraph uint_nat)\n\nlemma val_dist_fst_edges_eq: \n  \"\\<lbrakk>e < fst (snd iG); \n    wf_digraph (abs_IGraph iG); \n    is_graph s iG g; \n    is_dist s iG iD d\\<rbrakk> \\<Longrightarrow>\n    val_C (heap_EInt_C s \n       (d +\\<^sub>p uint (first_C \n             (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint e))))) = \n    val iD (fst (iedges iG e))\"\nunfolding is_graph_def is_dist_def\n  apply simp \n  by (metis (no_types, hide_lams) s_C_pte two_comp_to_edge_arrlist_heap \n      two_comp_to_eint_arrlist_heap val_C_pte wellformed_iGraph uint_nat)\n\nlemma cost_eq: \n  \"\\<lbrakk>e < fst (snd iG); \n    wf_digraph (abs_IGraph iG); \n    is_graph s iG g; \n    is_cost s iG iC c\\<rbrakk> \\<Longrightarrow>\n    (*SCAST(32 signed \\<rightarrow> 64)\n              (UCAST(32 \\<rightarrow> 32 signed)*) (heap_w32 s (ptr_coerce (c +\\<^sub>p uint e))) = \n    (*UCAST(32 \\<rightarrow> 64)*) iC e\"\nunfolding is_graph_def is_cost_def\n  apply clarsimp\n  apply (rule heap_ptr_coerce[symmetric], simp_all) \n  apply (subst cost_abs_C_equiv, simp_all add: uint_nat)\n   \nterm\n\"UCAST(32 \\<rightarrow> 64)\n(val_C\n(heap_EInt_C s\n(d +\\<^sub>p\n   uint (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint ee)))))) \n\n+\n             SCAST(32 signed \\<rightarrow> 64)\n              (UCAST(32 \\<rightarrow> 32 signed) (heap_w32 s (ptr_coerce (c +\\<^sub>p uint ee))))\n\"\n\nterm \"\n                     UCAST(32 \\<rightarrow> 64) (fst (iD (snd (snd (snd iG) i))))\n                     \\<le> UCAST(32 \\<rightarrow> 64) (fst (iD (fst (snd (snd iG) i)))) \n+\n                        UCAST(32 \\<rightarrow> 64) (iC i)\n\"\nlemma trian_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c)\\<rbrace>\n   trian' g d c\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> trian_inv iG iD iC (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: trian'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> trian_inv iG iD iC ee \\<and> \n                   ee \\<le> iedge_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and> \n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_cost s iG iC c\"])\n  apply (simp add: skipE_def)\n  apply wp\n    apply (subst if_bool_eq_conj)+\n\n    apply (simp split: if_split_asm, simp_all add: arrlist_nth)\n    apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI)\n       apply fast\n      apply clarsimp\n      apply (subgoal_tac \"ee < fst (snd iG)\")\n       apply (cut_tac j=\"ee+1\" and i=\"fst (snd iG)\" in trian_inv_le)\n         apply (simp add: is_graph_def inc_le)\n        apply (blast intro: inc_le)\n       apply (subgoal_tac \"ee < (max_word::32 word)\") \n        apply (simp add: trian_inv_step)\n        apply (frule_tac e=ee in is_inf_dist_fst_edges_eq, simp_all)\n        apply clarsimp\n        apply (frule_tac e=ee in is_inf_dist_snd_edges_eq, simp_all)\n        apply clarsimp\n       apply (metis max_word_max not_le word_le_less_eq)\n      apply (simp add: is_graph_def)\n     apply (rule conjI, rule impI, \n            rule conjI, rule impI, \n            rule conjI, rule impI,\n            rule conjI)\n         apply fast\n       apply (unfold trian_inv_def is_dist_def is_cost_def is_graph_def)[1]\n       apply clarsimp\n       apply (rule_tac x=ee in exI)\n       apply safe[1]\n      apply (subst is_inf_heap, fastforce)\n         apply (metis wellformed_iGraph)\n        apply (subst tail_heap, fastforce, fastforce)\n        apply blast\n       apply (subgoal_tac \"UCAST(32 \\<rightarrow> 64) (fst (iD (snd (snd (snd iG) ee)))) = \n                           UCAST(32 \\<rightarrow> 64) \n                             (val_C (heap_EInt_C s \n                                (d +\\<^sub>p uint (second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p \n                              uint ee))))))\")\n        apply (subgoal_tac \"UCAST(32 \\<rightarrow> 64) (fst (iD (fst (snd (snd iG) ee)))) + \n                            UCAST(32 \\<rightarrow> 64) (iC ee) = \n                            UCAST(32 \\<rightarrow> 64) \n                              (val_C (heap_EInt_C s \n                                (d +\\<^sub>p uint (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p \n                              uint ee)))))) + SCAST(32 signed \\<rightarrow> 64) \nUCAST(32 \\<rightarrow> 64) (heap_w32 s (ptr_coerce (c +\\<^sub>p uint ee)))\")\n         apply fastforce\n        \n(*\n      apply (rule_tac x=ee in exI)\n      apply safe[1]\n       apply (metis is_inf_heap s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n      apply (subgoal_tac \"snd (iD (snd (snd (snd iG) ee))) = isInf_C (heap_EInt_C s (d +\\<^sub>p uint (second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint ee)))))\")\n       apply argo\n      apply (subst is_inf_heap, fastforce)\n       apply (subst head_heap, fastforce, fastforce)\n       apply (metis head_heap wellformed_iGraph)\n      apply (subst head_heap, fastforce, fastforce)\n      apply fast\n     apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI)\n        apply fast\n       apply (unfold trian_inv_def is_dist_def is_cost_def is_graph_def)[1]\n       apply clarsimp\n       apply (rule_tac x=ee in exI)\n       apply safe[1]\n        apply (subst is_inf_heap, fastforce)\n         apply (metis wellformed_iGraph)\n        apply (subst tail_heap, fastforce, fastforce)\n        apply blast\n       apply (subgoal_tac \"UCAST(32 \\<rightarrow> 64) (fst (iD (snd (snd (snd iG) ee)))) = \n                           UCAST(32 \\<rightarrow> 64) \n                             (val_C (heap_EInt_C s \n                                (d +\\<^sub>p uint (second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p \n                              uint ee))))))\")\n        apply (subgoal_tac \"UCAST(32 \\<rightarrow> 64) (fst (iD (fst (snd (snd iG) ee)))) + \n                            UCAST(32 \\<rightarrow> 64) (iC ee) = \n                            UCAST(32 \\<rightarrow> 64) \n                              (val_C (heap_EInt_C s \n                                (d +\\<^sub>p uint (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p \n                              uint ee)))))) + UCAST(32 \\<rightarrow> 64) (heap_w32 s (c +\\<^sub>p uint ee))\")\n         apply fastforce\n        apply (subst tail_heap, fastforce, fastforce)\n        apply (subst val_heap, fastforce)\n         apply (metis s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n        apply (simp add: cost_abs_C_equiv uint_nat)\n       apply (subst head_heap, fastforce, fastforce)\n       apply (subst val_heap, fastforce)\n        apply (metis t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n       apply blast\n      apply (rule conjI, rule impI, rule conjI)\n        apply fastforce\n       apply (rule conjI)\n        apply (subgoal_tac \" ee + 1 \\<le> fst (snd iG)\")\n         apply (subgoal_tac \"ee < (max_word::32 word)\") \n          apply (drule trian_inv_step[where d=iD and G=iG and c=iC])\n          apply clarsimp\n          apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1] \n          apply clarsimp\n          apply (subst tail_heap, fastforce, fastforce)\n          apply (subst head_heap, fastforce, fastforce)\n          apply (simp add: cost_abs_C_equiv)\n          apply (subst is_inf_heap, fastforce)\n           apply (metis t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n          apply (subst val_heap, fastforce)\n           apply (metis wellformed_iGraph)\n          apply (subst head_heap, fastforce, fastforce)\n          apply (subst val_heap, fastforce) \n           apply (metis s_C_pte two_comp_to_edge_arrlist_heap uint_nat wellformed_iGraph)\n          apply (rule conjI, blast, simp add: uint_nat)\n         apply (simp add:less_le not_le, meson less_le max_word_max not_le)\n        apply (simp add: inc_le is_graph_def, blast intro: inc_le)\n       apply (metis (mono_tags) inc_le is_graph_def unat_minus_plus1_less)\n      apply (rule conjI)\n       apply (unfold wf_digraph_def trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n       apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n       apply (metis s_C_pte two_comp_to_edge_arrlist_heap word_less_nat_alt)\n      apply (rule conjI)\n       apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n       apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n      apply (rule conjI)\n       apply (unfold wf_digraph_def trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n       apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n       apply (metis t_C_pte two_comp_to_edge_arrlist_heap word_less_nat_alt)\n      apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n     apply (unfold wf_digraph_def trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+) \n     apply (metis t_C_pte two_comp_to_edge_arrlist_heap word_less_nat_alt)\n    apply (rule conjI, rule impI, rule conjI)\n      apply fastforce\n     apply (rule conjI)\n      apply (subgoal_tac \" ee + 1 \\<le> fst (snd iG)\")\n       apply (subgoal_tac \"ee < (max_word::32 word)\") \n        apply (drule trian_inv_step[where d=iD and G=iG and c=iC])\n        apply clarsimp\n        apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1] \n        apply clarsimp\n        apply (subst tail_heap, fastforce, fastforce)\n        apply (subst head_heap, fastforce, fastforce)\n        apply (simp add: cost_abs_C_equiv)\n        apply (subst is_inf_heap, fastforce)\n         apply (metis t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n        apply (subst val_heap, fastforce)\n         apply (metis wellformed_iGraph)\n        apply (subst head_heap, fastforce, fastforce)\n        apply (subst val_heap, fastforce) \n         apply (metis s_C_pte two_comp_to_edge_arrlist_heap uint_nat wellformed_iGraph)\n        apply (rule conjI, metis is_inf_heap tail_heap wellformed_iGraph)\n        apply (metis is_inf_heap tail_heap wellformed_iGraph)\n       apply (simp add:less_le not_le, meson less_le max_word_max not_le)\n      apply (simp add: inc_le is_graph_def, blast intro: inc_le)\n     apply (metis (mono_tags) inc_le is_graph_def unat_minus_plus1_less)\n    apply (rule conjI)\n     apply (unfold wf_digraph_def trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n     apply (metis s_C_pte two_comp_to_edge_arrlist_heap word_less_nat_alt)\n    apply (rule conjI)\n     apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+) \n    apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n    apply (clarsimp simp: if_bool_eq_conj)+\n   apply (simp add: is_graph_def)\n  apply wp\n  apply (unfold trian_inv_def is_graph_def is_cost_def is_dist_def)[1]\n  apply force\n  done\n\n*)\n  sorry\n\n\nlemma is_wellformed_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g) \\<rbrace>\n   is_wellformed' g\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> is_wellformed_inv iG (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: is_wellformed'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> is_wellformed_inv iG ee \\<and> \n                   ee \\<le> iedge_cnt iG \\<and> \n                   is_graph s iG g\"])\n  apply (simp add: skipE_def)\n  apply wp\n  unfolding is_graph_def is_wellformed_inv_def\n    apply (subst if_bool_eq_conj)+\n    apply (simp split: if_split_asm, safe, simp_all add: arrlist_nth)\n         apply (rule_tac x = \"ee\" in exI)\n         apply (subgoal_tac \"num_vertices_C (heap_Graph_C s g) \\<le> fst (snd (snd iG) ee)\", force)\n         apply (subgoal_tac \"first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint ee)) = fst (snd (snd iG) ee)\", simp)\n         apply (subst tail_heap[where iG=iG], simp, blast+)\n        apply(rule_tac x = \"ee\" in exI)\n        apply (subgoal_tac \"num_vertices_C (heap_Graph_C s g) \\<le> snd (snd (snd iG) ee)\", force)\n        apply (subgoal_tac \"second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint ee)) = snd (snd (snd iG) ee)\", simp)\n        apply (subst head_heap[where iG=iG], simp, blast+)\n       apply (metis two_comp_arrlist_heap s_C_pte le_cases le_step uint_nat word_le_less_eq)\n      apply (metis head_heap le_step not_less)\n     apply (simp add: le_step word_not_le) (* slow *)\n  using le_step not_less \n     apply blast\n    apply (metis (mono_tags, hide_lams) diff_diff_add diff_self_eq_0 eq_iff_diff_eq_0 measure_unat not_less0 word_less_nat_alt zero_less_diff)\n   apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n  apply wp\n  apply fast\n  done\n(*\ndefinition trian_inv :: \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> ICost \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"trian_inv G d c m \\<equiv> \n    \\<forall>i < m. \n       ~ is_inf d (fst (iedges G i)) \\<and>\n       ~ is_inf d (snd (iedges G i)) \\<and>\n       val d (snd (iedges G i)) \\<le> val d (fst (iedges G i)) + c i\"\n\nlemma trian_inv_step:\n  assumes i_less_max: \"i < max_word\"\n  shows \"trian_inv G d c (i + 1) \\<longleftrightarrow> trian_inv G d c i \\<and>\n    ~ is_inf d (fst (iedges G i)) \\<and>\n    ~ is_inf d (snd (iedges G i)) \\<and>\n    val d (snd (iedges G i)) \\<le> val d (fst (iedges G i)) + c i\"\n  unfolding trian_inv_def \n  by (metis (no_types) i_less_max less_irrefl less_x_plus_1)\n\n*)\ndefinition trian_inv :: \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> ICost \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"trian_inv G d c m \\<equiv> \n    \\<forall>i < m. is_inf d (fst (iedges G i)) = 0 \\<longrightarrow> \n     (is_inf d (snd (iedges G i)) = 0 \\<and> \n      val d (fst (iedges G i)) + c i \\<ge> val d (fst (iedges G i)) \\<and>\n     val d (snd (iedges G i)) \\<le> val d (fst (iedges G i)) + c i)\"\n\nlemma trian_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c)\\<rbrace>\n   trian' g d c\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> trian_inv iG iD iC (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: trian'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> trian_inv iG iD iC ee \\<and> \n                   ee \\<le> iedge_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and> \n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_cost s iG iC c\"])\n  apply (simp add: skipE_def)\n  apply wp\n (* unfolding is_graph_def is_dist_def is_cost_def trian_inv_def*)\n    apply (subst if_bool_eq_conj)+\n    apply (simp split: if_split_asm, simp_all add: arrlist_nth)\n    apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI)\n       apply fast\n    apply (unfold trian_inv_def is_dist_def is_cost_def is_graph_def)[1]\n      apply clarsimp\n    apply (rule_tac x=\"ee \" in exI)\n                  apply (rule conjI, simp+)\n(*\n          apply (subst arrlist_heap[where l=c and iL=iC], blast+)\n           apply (subst val_heap, blast, metis wellformed_iGraph)+\n          apply (subst head_heap, blast, blast)+\n          apply (subst tail_heap, blast, blast)+\n          apply (simp add: uint_nat)\n\n         apply (subst arrlist_heap[where l=c and iL=iC], simp)\n  using le_step less_trans \n          apply blast\n         apply (subst val_heap, blast, metis (mono_tags, hide_lams) IGraph_C.exhaust le_step less_trans num_edges_C.num_edges_C_def wellformed_iGraph)+\n         apply (subst head_heap, blast)+\n  using le_step less_trans \n          apply blast\n         apply (subst tail_heap, blast)+\n  using le_step less_trans \n          apply blast\n         apply (subgoal_tac \"i < num_edges_C (heap_Graph_C s g)\")\n          apply (subgoal_tac \"\\<And>w. \\<not> w < num_edges_C (heap_Graph_C s g) \\<or> heap_w32 s (c +\\<^sub>p uint w) = iC w\")\n           apply (subgoal_tac \"\\<And>w. \\<not> w < num_edges_C (heap_Graph_C s g) \\<or> heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint w) = to_edge (snd (snd iG) w)\")\n            apply (subgoal_tac \"\\<And>w. \\<not> w < fst iG \\<or> val_C (heap_EInt_C s (d +\\<^sub>p uint w)) = fst (iD w)\")\n             apply (subgoal_tac \"\\<And>w. \\<not> w < num_edges_C (heap_Graph_C s g) \\<or> snd (snd (snd iG) w) < fst iG\")\n              apply (subgoal_tac \"\\<And>w. \\<not> w < num_edges_C (heap_Graph_C s g) \\<or> fst (snd (snd iG) w) < fst iG\")\n               apply (subgoal_tac \"val_C (heap_EInt_C s (d +\\<^sub>p int (unat (second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint i)))))) \\<le> val_C (heap_EInt_C s (d +\\<^sub>p int (unat (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint i)))))) + heap_w32 s (c +\\<^sub>p int (unat i))\")\n                apply (simp add: uint_nat)\n               apply (subgoal_tac \"\\<forall>w. val_C (heap_EInt_C s (d +\\<^sub>p int (unat w))) = fst (iD w) \\<or> \\<not> w < fst iG\")\n                apply (subgoal_tac \"val_C (heap_EInt_C s (d +\\<^sub>p int (unat (second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p int (unat i))))))) \\<le> val_C (heap_EInt_C s (d +\\<^sub>p int (unat (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p int (unat i))))))) + iC i\")\n                 apply (subgoal_tac \"val_C (heap_EInt_C s (d +\\<^sub>p int (unat (second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint i)))))) \\<le> val_C (heap_EInt_C s (d +\\<^sub>p int (unat (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint i)))))) + heap_w32 s (c +\\<^sub>p int (unat i))\")\n                  apply (simp add:uint_nat)+\n                apply (metis (no_types, hide_lams) le_step word_not_le)\n               apply (metis uint_nat)\n              apply (simp add: wf_digraph_def)\n             apply (simp add: wf_digraph_def)\n            apply (simp add: val_heap)\n           apply (simp add: two_comp_to_edge_arrlist_heap uint_nat)\n          apply (metis arrlist_heap uint_nat)\n  using le_step less_trans       \n         apply blast\n  using le_step not_less\n        apply blast\n        apply (metis (no_types, hide_lams) diff_diff_add eq_iff_diff_eq_0 measure_unat word_not_le)\n       apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n       apply (metis (full_types) tail_heap wellformed_iGraph uint_nat word_less_nat_alt)\n      apply (rule_tac i=\"uint ee\" in arrlist_nth_valid, simp+)\n      apply (simp add:uint_nat)  \n  using word_less_nat_alt\n      apply blast\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n     apply (metis head_heap wellformed_iGraph uint_nat word_less_nat_alt)\n    apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n   apply wp\n   apply fast\n  done*)\n  sorry\n\ndefinition just_inv :: \n  \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> ICost \\<Rightarrow> IVertex \\<Rightarrow> IEInt \\<Rightarrow> IPEdge \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"just_inv G d c s n p k \\<equiv>\n    \\<forall>v < k. v \\<noteq> s \\<and> (is_inf n v = 0) \\<longrightarrow> 0 \\<le> sint (p v) \\<and>\n      (\\<exists> e. e = p v \\<and> e < iedge_cnt G \\<and>\n        v = snd (iedges G e) \\<and>\n        val d v = val d (fst (iedges G e)) + c e \\<and>\n        val n v = val n (fst (iedges G e)) + 1)\"\n\nlemma just_inv_step:\n  assumes v_less_max: \"v < max_word\"\n  shows \"just_inv G d c s n p (v + 1) \\<longleftrightarrow> just_inv G d c s n p v\n    \\<and> (v \\<noteq> s \\<and>  (is_inf n v = 0) \\<longrightarrow> 0 \\<le> sint (p v) \\<and>\n      (\\<exists> e. e = p v \\<and> e < iedge_cnt G \\<and> \n        v = snd (iedges G e) \\<and>\n        val d v = val d (fst (iedges G e)) +  c e \\<and>\n        val n v = val n (fst (iedges G e)) +  1))\"\n  unfolding just_inv_def using v_less_max  \n  by (force simp: less_x_plus_1) \n  \nlemma just_inv_le:\n  assumes leq: \"j \\<le> i\" \n  assumes just_i: \"just_inv G d c s n p i\"\n  shows \"just_inv G d c s n p j\"\n  using assms \n  by (induct j) (auto simp add: just_inv_def)\n\nlemma not_just_verts:\n  fixes G R c d n p s v\n  assumes v_less_max: \"v < max_word\"\n  assumes \"v < ivertex_cnt G\"\n  assumes \"v \\<noteq> s \\<and> (is_inf n v = 0) \\<and> 0 \\<le> sint (p v) \\<and>\n        (iedge_cnt G \\<le> p v \\<or>\n        snd (iedges G (p v)) \\<noteq> v \\<or> \n        val d v \\<noteq> \n          val d (fst (iedges G (p v))) + c (p v) \\<or> \n        val n v \\<noteq> val n (fst (iedges G (p v))) + 1)\"\n  shows \"\\<not> just_inv G d c s n p (ivertex_cnt G)\"\nproof (rule notI)\n  assume jv: \"just_inv G d c s n p (ivertex_cnt G)\"\n  have \"just_inv G d c s n p (v + 1)\"\n    by (metis le_step order.asym word_not_le just_inv_le[OF _ jv] assms(2))\n  then have \"(v \\<noteq> s \\<and> (is_inf n v = 0) \\<longrightarrow> \n      (\\<exists> e. e = p v \\<and> e < iedge_cnt G \\<and> \n        v = snd (iedges G e) \\<and>\n        val d v = val d (fst (iedges G e)) + c e \\<and>\n        val n v = val n (fst (iedges G e)) + 1))\"\n    unfolding just_inv_def\n    using v_less_max just_inv_step\n    by (auto simp add : less_x_plus_1)\n  with assms show False by force\nqed\n\nlemma parent_dist_eq:\n  fixes vv :: \"32 word\" and s :: lifted_globals\n  assumes a1: \"arrlist (heap_EInt_C s) (is_valid_EInt_C s) (map (to_eint \\<circ> (iD \\<circ> of_nat)) [0..<unat (num_vertices_C (heap_Graph_C s g))]) d\"\n  assumes a2: \"fst iG = num_vertices_C (heap_Graph_C s g)\"\n  assumes a3: \"\\<not> num_edges_C (heap_Graph_C s g) \\<le> heap_w32 s (ptr_coerce (p +\\<^sub>p uint vv))\"\n  assumes a4: \"arrlist (\\<lambda>p. heap_w32 s (ptr_coerce p)) (\\<lambda>p. is_valid_w32 s (ptr_coerce p)) (map (iP \\<circ> of_nat) [0..<unat (num_vertices_C (heap_Graph_C s g))]) p\"\n  assumes a5: \"fst (snd iG) = num_edges_C (heap_Graph_C s g)\"\n  assumes a6: \"vv < num_vertices_C (heap_Graph_C s g)\"\n  assumes a7: \"arrlist (heap_Edge_C s) (is_valid_IEdge_C s) (map (to_edge \\<circ> (snd (snd iG) \\<circ> of_nat)) [0..<unat (num_edges_C (heap_Graph_C s g))]) (arcs_C (heap_Graph_C s g))\"\n  assumes a8: \"wf_digraph (abs_IGraph iG)\"\n  shows \"fst (iD (fst (snd (snd iG) (iP vv)))) = val_C (heap_EInt_C s (d +\\<^sub>p uint (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint (heap_w32 s (ptr_coerce (p +\\<^sub>p uint vv))))))))\"\nproof -\n  have \"\\<forall>w. heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat w))) = iP w \\<or> \\<not> w < fst iG\"\n    using a4 a2 by (metis (no_types) heap_ptr_coerce word_zero_le)\n  then show \"fst (iD (fst (snd (snd iG) (iP vv)))) = val_C (heap_EInt_C s (d +\\<^sub>p uint (first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint (heap_w32 s (ptr_coerce (p +\\<^sub>p uint vv))))))))\"\n    using a8 a7 a6 a5 a3 a2 a1 by (metis not_le tail_heap val_heap wellformed_iGraph uint_nat)\nqed\n\nlemma pedge_size:\n  fixes vv :: \"32 word\" and s :: lifted_globals and v :: \"32 word\"\n  assumes a1: \"arrlist (\\<lambda>p. heap_w32 s (ptr_coerce p)) (\\<lambda>p. is_valid_w32 s (ptr_coerce p)) (map (iP \\<circ> of_nat) [0..<unat (num_vertices_C (heap_Graph_C s g))]) p\"\n  assumes a2: \"fst iG = num_vertices_C (heap_Graph_C s g)\"\n  assumes a3: \"vv < num_vertices_C (heap_Graph_C s g)\"\n  assumes a4: \"v < vv + 1\"\n  assumes a5: \"\\<forall>v<vv. snd (iN v) = 0 \\<longrightarrow> v = sc \\<or> fst (iD v) = fst (iD (fst (snd (snd iG) (iP v)))) + iC (iP v) \\<and> v = snd (snd (snd iG) (iP v)) \\<and> iP v < num_edges_C (heap_Graph_C s g) \\<and> 0 \\<le> sint (iP v) \\<and> fst (iN v) = fst (iN (fst (snd (snd iG) (iP v)))) + 1\"\n  assumes a6: \"snd (iN v) = 0\"\n  assumes a7: \"v \\<noteq> sc\"\n  assumes a8: \"\\<not> num_edges_C (heap_Graph_C s g) \\<le> heap_w32 s (ptr_coerce (p +\\<^sub>p uint vv))\"\n  shows \"heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat v))) < num_edges_C (heap_Graph_C s g)\"\nproof -\n  have \"\\<forall>w. w < fst iG \\<or> \\<not> w < vv\"\n    using a3 a2 by force\n  then show \"heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat v))) < num_edges_C (heap_Graph_C s g)\"\n    using a8 a7 a6 a5 a4 a2 a1 by (metis (no_types) heap_ptr_coerce le_step not_le uint_nat word_zero_le)\nqed\n\nlemma first_edge_val:\n  fixes vv :: \"32 word\" and s :: lifted_globals and v :: \"32 word\"\n  assumes a1: \"arrlist (\\<lambda>p. heap_w32 s (ptr_coerce p)) (\\<lambda>p. is_valid_w32 s (ptr_coerce p)) (map (iP \\<circ> of_nat) [0..<unat (num_vertices_C (heap_Graph_C s g))]) p\"\n  assumes a2: \"fst iG = num_vertices_C (heap_Graph_C s g)\"\n  assumes a3: \"arrlist (heap_Edge_C s) (is_valid_IEdge_C s) (map (to_edge \\<circ> (snd (snd iG) \\<circ> of_nat)) [0..<unat (num_edges_C (heap_Graph_C s g))]) (arcs_C (heap_Graph_C s g))\"\n  assumes a4: \"fst (snd iG) = num_edges_C (heap_Graph_C s g)\"\n  assumes a5: \"wf_digraph (abs_IGraph iG)\"\n  assumes a6: \"\\<forall>v<vv. snd (iN v) = 0 \\<longrightarrow> v = sc \\<or> fst (iD v) = fst (iD (fst (snd (snd iG) (iP v)))) + iC (iP v) \\<and> v = snd (snd (snd iG) (iP v)) \\<and> iP v < num_edges_C (heap_Graph_C s g) \\<and> 0 \\<le> sint (iP v) \\<and> fst (iN v) = fst (iN (fst (snd (snd iG) (iP v)))) + 1\"\n  assumes a7: \"snd (iN v) = 0\"\n  assumes a8: \"v \\<noteq> sc\"\n  assumes a9: \"\\<not> num_edges_C (heap_Graph_C s g) \\<le> heap_w32 s (ptr_coerce (p +\\<^sub>p uint vv))\"\n  assumes a10: \"v < vv + 1\"\n  assumes \"vv < num_vertices_C (heap_Graph_C s g)\"\n  shows \"first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint (heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat v)))))) < num_vertices_C (heap_Graph_C s g)\"\nproof -\n  have \"\\<forall>w. heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat w))) = iP w \\<or> \\<not> w < fst iG\"\n    using a2 a1 by (metis (no_types) heap_ptr_coerce word_zero_le)\n  then show \"first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint (heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat v)))))) < num_vertices_C (heap_Graph_C s g)\"\n    using a10 a9 a8 a7 a6 a5 a4 a3 a2 by (metis le_step not_le tail_heap wellformed_iGraph uint_nat)\nqed\n\nlemma  word32_minus_comm: \"(x:: 32 word) - y - z = x - z - y\" by simp\n\nlemma just_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          sc < ivertex_cnt iG \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   just' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> just_inv iG iD iC sc iN iP (ivertex_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: just'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(vv, s). unat (ivertex_cnt iG - vv)\" and\n        I=\"\\<lambda>vv s. P s \\<and> just_inv iG iD iC sc iN iP vv \\<and>\n                   vv \\<le> ivertex_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and>\n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_cost s iG iC c \\<and>\n                   sc < ivertex_cnt iG \\<and>\n                   is_numm s iG iN n \\<and>\n                   is_pedge s iG iP p\"])\n  apply (simp add: skipE_def)\n  apply wp \n    prefer 2\n    apply (fastforce simp: is_graph_def intro: just_inv_le)\n   prefer 2 \n   apply wp\n   apply (fastforce simp: is_graph_def just_inv_def)\n   \n(*\n  apply (rule conjI)+\n  unfolding is_graph_def is_dist_def is_cost_def is_numm_def is_pedge_def just_inv_def\n    apply (subst if_bool_eq_conj)+\n    apply (simp split: if_split_asm, simp_all add: arrlist_nth)\n    apply (safe)*)(*\n                                        apply (rule_tac x=vv in exI)\n                                        apply (rule conjI, metis (no_types, lifting) not_le arrlist_heap sint_ucast uint_nat, simp)\n                                        apply (metis (no_types, hide_lams) bool.simps is_inf_heap)\n                                       apply (rule_tac x=vv in exI)sorry\n                                       apply (rule conjI, metis (no_types) heap_ptr_coerce not_le uint_nat word_zero_le, simp)\n                                       apply (metis isInf_C_pte two_comp_to_eint_arrlist_heap uint_nat)\n                                      apply (rule_tac x=vv in exI)\n                                      apply (rule conjI, metis (no_types) head_heap heap_ptr_coerce uint_nat word_zero_le, simp)\n                                      apply (metis isInf_C_pte two_comp_to_eint_arrlist_heap uint_nat)\n                                     apply (rule_tac x=vv in exI)\n                                     apply (rule conjI, simp)\n                                      apply (subgoal_tac \"fst (iD vv) \\<noteq> fst (iD (fst (snd (snd iG) (iP vv)))) + iC (iP vv)\")\n                                       apply blast\n                                      apply clarsimp\n                                      apply (erule notE[where R=False and P=\"val_C _ = val_C _ + _\"])\n                                      apply (frule_tac e=vv in val_heap[where f=iD], simp)\n                                      apply (subgoal_tac \"iC (iP vv) = heap_w32 s (c +\\<^sub>p uint (heap_w32 s (ptr_coerce (p +\\<^sub>p uint vv))))\") \n                                       apply (simp add: parent_dist_eq)\n                                      apply (subgoal_tac \"iP vv = (heap_w32 s (ptr_coerce (p +\\<^sub>p uint vv)))\")\n                                       apply (subgoal_tac \"\\<And>w. \\<not> w < num_edges_C (heap_Graph_C s g) \\<or> heap_w32 s (c +\\<^sub>p uint w) = iC w\")\n                                        apply (subgoal_tac \"\\<And>w. \\<not> w < num_edges_C (heap_Graph_C s g) \\<or> heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint w) = to_edge (snd (snd iG) w)\")\n                                         apply force\n                                        apply (simp add: two_comp_to_edge_arrlist_heap uint_nat)\n                                       apply (simp add: uint_nat)\n  using arrlist_heap\n                                       apply force\n                                      apply (metis (no_types) heap_ptr_coerce uint_nat word_zero_le)\n\n                                     apply (metis isInf_C_pte two_comp_to_eint_arrlist_heap uint_nat)\n                                    apply (rule_tac x=vv in exI)\n                                    apply (rule conjI, metis (no_types) heap_ptr_coerce tail_heap val_heap wellformed_iGraph uint_nat word_zero_le, simp)\n                                    apply (metis isInf_C_pte two_comp_to_eint_arrlist_heap uint_nat)\n                                   apply (subgoal_tac \"0 \\<le> sint (UCAST(32 \\<rightarrow> 32 signed) (heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat vv))))::32 signed word)\")\n                                    apply (subgoal_tac \"0 \\<le> sint (iP v)\")\n                                     apply blast\n  using heap_ptr_coerce le_step sint_ucast\n                                    apply fastforce\n                                   apply (simp add: uint_nat)\n                                  apply (metis (no_types) heap_ptr_coerce le_step not_le uint_nat word_zero_le)\n                                 apply (metis (no_types) head_heap heap_ptr_coerce le_step not_le uint_nat word_zero_le)\n                                apply (case_tac \"v = vv\")  \n                                 apply (subst heap_ptr_coerce[where l=p and iL=iP])\n                                    apply fast\n                                   apply metis\n                                  apply fastforce\n                                 apply (subst heap_ptr_coerce[where l=p and iL=iP])\n                                    apply fast\n                                   apply metis\n                                  apply fastforce \n                                 apply (subst arrlist_heap[where l=c and iL=iC])\n                                   apply simp\n                                  apply (metis (no_types) not_le uint_nat)\n                                 apply clarsimp\n                                 apply (subst tail_heap, blast)+\n                                  apply (simp add: pedge_size)\n                                 apply (subst val_heap, blast)+\n  using le_step less_trans\n                                  apply blast\n                                 apply (subst val_heap, blast)+\n                                  apply (simp add: first_edge_val)\n                                 apply (simp add: uint_nat)\n                                apply (subgoal_tac \"v < vv\")  \n                                 apply (frule_tac x=v in spec, clarsimp)\n  using le_step\n                                apply blast\n                               apply (subgoal_tac \"\\<forall>w. heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat w))) = iP w \\<or> \\<not> w < fst iG\")\n                                apply (metis (no_types, hide_lams) le_step not_le tail_heap val_heap wellformed_iGraph uint_nat)\n                               apply (metis heap_ptr_coerce word_zero_le)\n  using inc_le\n                              apply blast\n                             apply (subst unat_mono)\n                              apply (case_tac \"vv = sc\", simp_all)\n                            apply (case_tac \"num_vertices_C (heap_Graph_C s g) > 1\") \n                             apply (subgoal_tac \"num_vertices_C (heap_Graph_C s g) -  vv - 1 < num_vertices_C (heap_Graph_C s g) - vv\") \n                              apply (simp add: diff_diff_add)\n                             apply (metis add_0_left diff_add_cancel less_irrefl word_overflow)\n                            apply (metis (mono_tags, hide_lams) add.left_neutral not_le plus_one_helper word_gt_a_gt_0 word_le_less_eq)\n                           apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n                          apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n                          apply (metis (no_types, hide_lams) not_le s_C_pte wellformed_iGraph two_comp_to_edge_arrlist_heap word_less_nat_alt)\n                         apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n                        apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n                       apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n                       apply (metis (no_types, hide_lams) not_le s_C_pte wellformed_iGraph two_comp_to_edge_arrlist_heap word_less_nat_alt)\n                      apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n                     apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n                    apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n                   apply (metis le_step isInf_C_pte two_comp_to_eint_arrlist_heap)\n                  apply (subst heap_ptr_coerce[where l=p and iL=iP])\n                     apply fast\n                    apply (metis le_step wellformed_iGraph)\n                   apply fastforce\n                  apply (subgoal_tac \"\\<not> bool (isInf_C (heap_EInt_C s (n +\\<^sub>p uint vv))) \\<or> bool (snd (iN vv))\")\n                   apply (subgoal_tac \"heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat v))) < num_edges_C (heap_Graph_C s g)\")\n                    apply blast\n                   apply (metis (no_types) le_step bool.elims(2) bool.elims(3) heap_ptr_coerce wellformed_iGraph word_zero_le)\n  using is_inf_heap\n                  apply blast\n                 apply (subst heap_ptr_coerce[where l=p and iL=iP])\n                    apply fast\n                   apply (metis le_step wellformed_iGraph)\n                  apply fastforce\n                 apply (subgoal_tac \"\\<not> bool (isInf_C (heap_EInt_C s (n +\\<^sub>p uint vv))) \\<or> bool (snd (iN vv))\")\n                  apply (subgoal_tac \"v = snd (snd (snd iG) (heap_w32 s (ptr_coerce (p +\\<^sub>p int (unat v)))))\")\n                   apply metis\n                  apply (metis (no_types) le_step bool.elims(2) bool.elims(3) heap_ptr_coerce wellformed_iGraph word_zero_le)\n  using is_inf_heap \n                 apply blast\n                apply (metis (mono_tags, hide_lams) le_step isInf_C_pte two_comp_to_eint_arrlist_heap uint_nat)\n               apply (metis (no_types, hide_lams) le_step bool.simps is_inf_heap)\n  using inc_le\n              apply blast\n             apply (subst unat_mono)\n              apply (case_tac \"vv = sc\", simp_all)\n             apply (subgoal_tac \"num_vertices_C (heap_Graph_C s g) -  vv - 1 < num_vertices_C (heap_Graph_C s g) - vv\") \n              apply (simp add: diff_diff_add)\n             apply (metis add_0_left diff_add_cancel less_irrefl word_overflow) \n            apply (rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+)\n            apply (metis uint_nat word_less_def)\n           apply (rule_tac i=\"(uint vv)\" in arrlist_nth_valid, simp+)\n           apply (metis uint_nat word_less_def)\n  using le_step\n          apply blast\n  using le_step\n         apply blast\n        apply (metis (no_types, hide_lams) le_step)\n  using le_step\n       apply blast\n  using le_step\n      apply blast\n  using inc_le\n     apply blast\n    apply (case_tac \"num_vertices_C (heap_Graph_C s g) > 1\")\n     apply (rule unat_mono) \n     apply (subgoal_tac \"num_vertices_C (heap_Graph_C s g) -  sc - 1 < num_vertices_C (heap_Graph_C s g) - sc\") \n      apply (simp add: diff_diff_add)\n     apply (metis add_0_left diff_add_cancel less_irrefl word_overflow)\n    apply (metis (mono_tags, hide_lams) add.left_neutral cancel_comm_monoid_add_class.diff_cancel diff_zero not_le plus_one_helper word_gt_a_gt_0 word_le_less_eq word_less_nat_alt)\n   apply (rule arrlist_nth, (simp add: uint_nat unat_mono)+)\n  apply wp\n  apply fast\n  done*)sorry\n(*\n\nlemma just_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          sc < ivertex_cnt iG \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   just' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> just_inv iG iD iC sc iN iP (ivertex_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: just'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(vv, s). unat (ivertex_cnt iG - vv)\" and\n        I=\"\\<lambda>vv s. P s \\<and> just_inv iG iD iC sc iN iP vv \\<and>\n                   vv \\<le> ivertex_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and>\n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_cost s iG iC c \\<and>\n                   sc < ivertex_cnt iG \\<and>\n                   is_numm s iG iN n \\<and>\n                   is_pedge s iG iP p\"])\n  apply (simp add: skipE_def)\n  apply wp\n  unfolding is_graph_def is_dist_def is_cost_def is_numm_def is_pedge_def just_inv_def\n    apply (subst if_bool_eq_conj)+\n    apply (simp split: if_split_asm, simp_all add: arrlist_nth)\n    apply (safe)\n                                        apply (rule_tac x=vv in exI)\n                                        apply (rule conjI, metis (no_types, lifting) not_le arrlist_heap uint_nat, simp)\n                                        apply (metis (no_types, hide_lams) bool.simps is_inf_heap)\n                                       apply (rule_tac x=vv in exI)\n   sorry*)\n(*\ndefinition no_path_inv :: \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> IEInt \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"no_path_inv G d n k \\<equiv>  \\<forall>v < k. (is_inf d v \\<longleftrightarrow> is_inf n v)\"\n\n*)\n\nlemma wf_inv_is_wf_digraph:\n  \"wf_digraph (abs_IGraph G) = is_wellformed_inv G (ivertex_cnt G)\"\n  apply (rule iffI)\n  unfolding is_wellformed_inv_def\n   apply clarsimp\n\n  apply (frule_tac  wellformed_iGraph)\n  oops\n\nlemma shortest_path_pos_cost_pred_locale_eq_invariants:\n\"\\<And>G dist c s num pred. \n  (shortest_path_pos_cost_pred (abs_IGraph G) (abs_IDist dist) (abs_ICost c) s (abs_INum num) (abs_IPedge pred)) = \n    (wf_digraph (abs_IGraph G) \\<and> \n    trian_inv G dist c (ivertex_cnt G) \\<and> \n    just_inv G dist c s num pred (ivertex_cnt G) \\<and> \n    no_path_inv G dist num (ivertex_cnt G))\" \n  oops\n(*\n basic_just_sp_pred +\n  assumes s_in_G: \"s \\<in> verts G\"\n  assumes tail_val: \"dist s = 0\"\n  assumes no_path: \"\\<And>v. v \\<in> verts G \\<Longrightarrow> dist v = \\<infinity> \\<longleftrightarrow> num v = \\<infinity>\"\n  assumes pos_cost: \"\\<And>e. e \\<in> arcs G \\<Longrightarrow> 0 \\<le> c e\"\n*)\n\nlemma fin_digraph_is_wellformed_inv:\n  \"fin_digraph (abs_IGraph G) \\<longleftrightarrow> is_wellformed_inv G (iedge_cnt G)\"\n  unfolding is_wellformed_inv_def fin_digraph_def \n    fin_digraph_axioms_def wf_digraph_def no_loops_def \n  by auto\n\nlemma basic_just_sp_eq_invariants:\n\"\\<And>G dist c s enum pred. \n  basic_just_sp_pred \n      (abs_IGraph G) (abs_IDist dist) \n      (abs_ICost c) s (abs_INum enum) (abs_IPedge pred) \\<longleftrightarrow> \n    (is_wellformed_inv G (iedge_cnt G) \\<and> \n    (abs_IDist dist) s \\<le> 0 \\<and> \n    trian_inv G dist c (iedge_cnt G) \\<and> \n    just_inv G dist c s enum pred (ivertex_cnt G))\"\nproof -\n  fix G d c s n p \n  let ?aG = \"abs_IGraph G\"\n  let ?ad = \"abs_IDist d\"\n  let ?ac = \"abs_ICost c\"\n  let ?an = \"abs_INum n\"  \n  let ?ap = \"abs_IPedge p\"\n  have \"fin_digraph (abs_IGraph G) \\<longleftrightarrow> is_wellformed_inv G (iedge_cnt G)\"\n    by (rule fin_digraph_is_wellformed_inv)\n    moreover\n  have trian1: \"trian_inv G d c (iedge_cnt G) = \n   (\\<forall>e. e \\<in> arcs ?aG \\<longrightarrow> \n    is_inf d (tail ?aG e) = 0 \\<longrightarrow>\n    is_inf d (head ?aG e) = 0 \\<and>\n    val d (tail ?aG e) + c e \\<ge> val d (tail ?aG e) \\<and>\n    val d (head ?aG e) \\<le> val d (tail ?aG e) + c e)\"\n    by (simp add: trian_inv_def)\n  have \"trian_inv G d c (iedge_cnt G) =\n   (\\<forall>e. e \\<in> arcs ?aG \\<longrightarrow> \n   (* ?ad (tail ?aG e) \\<noteq> PInfty \\<longrightarrow>\n    ?ad (head ?aG e) \\<noteq> PInfty \\<and>*)\n    ?ad (tail ?aG e) +  ereal (?ac e) \\<ge> ?ad (tail ?aG e) \\<and>\n    ?ad (head ?aG e) \\<le> ?ad (tail ?aG e) + ereal (?ac e))\"\n    apply (subst trian1, clarsimp)\n    apply (simp add: abs_IDist_def abs_ICost_def)\n    apply (rule iffI; clarsimp)\n     apply (rule conjI)\n    sorry\n  moreover\n  have \"just_inv  G d c s n p (ivertex_cnt G) =\n    (\\<forall>v. v \\<in> verts ?aG \\<longrightarrow>\n      v \\<noteq> s \\<longrightarrow> ?an v \\<noteq> \\<infinity> \\<longrightarrow> \n      (\\<exists>e \\<in> arcs ?aG. e = the (?ap v) \\<and>\n      v = head ?aG e \\<and> \n      ?ad v = ?ad (tail ?aG e) + ereal (?ac e) \\<and> \n     ?an v = ?an (tail ?aG e) + enat 1))\"\n \n    sorry\nultimately\n   show \"?thesis G d c s n p\"\n   unfolding \n    basic_just_sp_pred_def \n    basic_just_sp_pred_axioms_def \n    basic_sp_def basic_sp_axioms_def\n   apply simp\n   apply safe\n\n   sorry\nqed\n\n\nlemma check_basic_just_sp_pred_eq_invariants':\n\"\\<And>G d c so n p. \n  basic_just_sp_pred (abs_IGraph iG) (abs_IDist iD) (real \\<circ> (unat \\<circ> iC)) sc (abs_INum iN) (abs_IPedge iP) = \n    (wf_digraph (abs_IGraph G) \\<and>\n    snd (d so) \\<noteq> 0 \\<and>\n    fst (d so) = 0 \\<and>\n    trian_inv G d c (ivertex_cnt G) \\<and>\n    just_inv G d c so n p (ivertex_cnt G))\"\n   apply (clarsimp simp: check_basic_just_sp'_def basic_just_sp_pred_def basic_just_sp_pred_axioms_def)\n \n  sorry\n\nlemma check_basic_just_sp_spc:\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          sc < ivertex_cnt iG \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   check_basic_just_sp' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> \n       basic_just_sp_pred (abs_IGraph iG) (abs_IDist iD) (abs_ICost iC) sc (abs_INum iN) (abs_IPedge iP))\\<rbrace>!\"\n  apply (clarsimp simp: check_basic_just_sp'_def basic_just_sp_pred_def basic_just_sp_pred_axioms_def)\n  apply wp\n  sorry\n\n\nend\n\nend", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/ShortestPathNegCVerification.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.31596646458854}}
{"text": "section\\<open>The Powerset Axiom in $M[G]$\\<close>\ntheory Powerset_Axiom\n  imports Renaming_Auto Separation_Axiom Pairing_Axiom Union_Axiom\nbegin\n\nsimple_rename \"perm_pow\" src \"[ss,p,l,o,fs,\\<chi>]\" tgt \"[fs,ss,sp,p,l,o,\\<chi>]\"\n\nlemma Collect_inter_Transset:\n  assumes\n    \"Transset(M)\" \"b \\<in> M\"\n  shows\n    \"{x\\<in>b . P(x)} = {x\\<in>b . P(x)} \\<inter> M\"\n  using assms unfolding Transset_def\n  by (auto)\n\ncontext G_generic  begin\n\nlemma name_components_in_M:\n  assumes \"<\\<sigma>,p>\\<in>\\<theta>\" \"\\<theta> \\<in> M\"\n  shows   \"\\<sigma>\\<in>M\" \"p\\<in>M\"\nproof -\n  from assms obtain a where\n    \"\\<sigma> \\<in> a\" \"p \\<in> a\" \"a\\<in><\\<sigma>,p>\"\n    unfolding Pair_def by auto\n  moreover from assms\n  have \"<\\<sigma>,p>\\<in>M\"\n    using transitivity by simp\n  moreover from calculation\n  have \"a\\<in>M\"\n    using transitivity by simp\n  ultimately\n  show \"\\<sigma>\\<in>M\" \"p\\<in>M\"\n    using transitivity by simp_all\nqed\n\nlemma sats_fst_snd_in_M:\n  assumes\n    \"A\\<in>M\" \"B\\<in>M\" \"\\<phi> \\<in> formula\" \"p\\<in>M\" \"l\\<in>M\" \"o\\<in>M\" \"\\<chi>\\<in>M\"\n    \"arity(\\<phi>) \\<le> 6\"\n  shows\n    \"{sq \\<in>A\\<times>B . sats(M,\\<phi>,[snd(sq),p,l,o,fst(sq),\\<chi>])} \\<in> M\"\n    (is \"?\\<theta> \\<in> M\")\nproof -\n  have \"6\\<in>nat\" \"7\\<in>nat\" by simp_all\n  let ?\\<phi>' = \"ren(\\<phi>)`6`7`perm_pow_fn\"\n  from \\<open>A\\<in>M\\<close> \\<open>B\\<in>M\\<close> have\n    \"A\\<times>B \\<in> M\"\n    using cartprod_closed by simp\n  from \\<open>arity(\\<phi>) \\<le> 6\\<close> \\<open>\\<phi>\\<in> formula\\<close> \\<open>6\\<in>_\\<close> \\<open>7\\<in>_\\<close>\n  have \"?\\<phi>' \\<in> formula\" \"arity(?\\<phi>')\\<le>7\"\n    unfolding perm_pow_fn_def\n    using  perm_pow_thm  arity_ren ren_tc Nil_type\n    by auto\n  with \\<open>?\\<phi>' \\<in> formula\\<close>\n  have 1: \"arity(Exists(Exists(And(pair_fm(0,1,2),?\\<phi>'))))\\<le>5\"     (is \"arity(?\\<psi>)\\<le>5\")\n    unfolding pair_fm_def upair_fm_def\n    using nat_simp_union pred_le arity_type by auto\n  {\n    fix sp\n    note \\<open>A\\<times>B \\<in> M\\<close>\n    moreover\n    assume \"sp \\<in> A\\<times>B\"\n    moreover from calculation\n    have \"fst(sp) \\<in> A\" \"snd(sp) \\<in> B\"\n      using fst_type snd_type by simp_all\n    ultimately\n    have \"sp \\<in> M\" \"fst(sp) \\<in> M\" \"snd(sp) \\<in> M\"\n      using  \\<open>A\\<in>M\\<close> \\<open>B\\<in>M\\<close> transitivity\n      by simp_all\n    note inM = \\<open>A\\<in>M\\<close> \\<open>B\\<in>M\\<close> \\<open>p\\<in>M\\<close> \\<open>l\\<in>M\\<close> \\<open>o\\<in>M\\<close> \\<open>\\<chi>\\<in>M\\<close>\n      \\<open>sp\\<in>M\\<close> \\<open>fst(sp)\\<in>M\\<close> \\<open>snd(sp)\\<in>M\\<close>\n    with 1 \\<open>sp \\<in> M\\<close> \\<open>?\\<phi>' \\<in> formula\\<close>\n    have \"M, [sp,p,l,o,\\<chi>]@[p] \\<Turnstile> ?\\<psi> \\<longleftrightarrow> M,[sp,p,l,o,\\<chi>] \\<Turnstile> ?\\<psi>\" (is \"M,?env0@ _\\<Turnstile>_ \\<longleftrightarrow> _\")\n      using arity_sats_iff[of ?\\<psi> \"[p]\" M ?env0] by auto\n    also from inM \\<open>sp \\<in> A\\<times>B\\<close>\n    have \"... \\<longleftrightarrow> sats(M,?\\<phi>',[fst(sp),snd(sp),sp,p,l,o,\\<chi>])\"\n      by auto\n    also from inM \\<open>\\<phi> \\<in> formula\\<close> \\<open>arity(\\<phi>) \\<le> 6\\<close>\n    have \"... \\<longleftrightarrow> sats(M,\\<phi>,[snd(sp),p,l,o,fst(sp),\\<chi>])\"\n      (is \"sats(_,_,?env1) \\<longleftrightarrow> sats(_,_,?env2)\")\n      using sats_iff_sats_ren[of \\<phi> 6 7 ?env2 M ?env1 perm_pow_fn] perm_pow_thm\n      unfolding perm_pow_fn_def by simp\n    finally\n    have \"sats(M,?\\<psi>,[sp,p,l,o,\\<chi>,p]) \\<longleftrightarrow> sats(M,\\<phi>,[snd(sp),p,l,o,fst(sp),\\<chi>])\"\n      by simp\n  }\n  then have\n    \"?\\<theta> = {sp\\<in>A\\<times>B . sats(M,?\\<psi>,[sp,p,l,o,\\<chi>,p])}\"\n    by auto\n  also from assms \\<open>A\\<times>B\\<in>M\\<close> have\n    \" ... \\<in> M\"\n  proof -\n    from 1\n    have \"arity(?\\<psi>) \\<le> 6\"\n      using leI by simp\n    moreover from \\<open>?\\<phi>' \\<in> formula\\<close>\n    have \"?\\<psi> \\<in> formula\"\n      by simp\n    moreover note assms \\<open>A\\<times>B\\<in>M\\<close>\n    ultimately \n    show \"{x \\<in> A\\<times>B . sats(M, ?\\<psi>, [x, p, l, o, \\<chi>, p])} \\<in> M\"\n      using separation_ax separation_iff\n      by simp\n  qed\n  finally show ?thesis .\nqed\n\nlemma Pow_inter_MG:\n  assumes\n    \"a\\<in>M[G]\"\n  shows\n    \"Pow(a) \\<inter> M[G] \\<in> M[G]\"\nproof -\n  from assms obtain \\<tau> where\n    \"\\<tau> \\<in> M\" \"val(G, \\<tau>) = a\"\n    using GenExtD by auto\n  let ?Q=\"Pow(domain(\\<tau>)\\<times>P) \\<inter> M\"\n  from \\<open>\\<tau>\\<in>M\\<close> \n  have \"domain(\\<tau>)\\<times>P \\<in> M\" \"domain(\\<tau>) \\<in> M\"\n    using domain_closed cartprod_closed P_in_M\n    by simp_all\n  then \n  have \"?Q \\<in> M\"\n  proof -\n    from power_ax \\<open>domain(\\<tau>)\\<times>P \\<in> M\\<close> obtain Q where\n      \"powerset(##M,domain(\\<tau>)\\<times>P,Q)\" \"Q \\<in> M\"\n      unfolding power_ax_def by auto\n    moreover from calculation \n    have \"z\\<in>Q \\<Longrightarrow> z\\<in>M\" for z\n      using transitivity by blast\n    ultimately\n    have \"Q = {a\\<in>Pow(domain(\\<tau>)\\<times>P) . a\\<in>M}\"\n      using \\<open>domain(\\<tau>)\\<times>P \\<in> M\\<close> powerset_abs[of \"domain(\\<tau>)\\<times>P\" Q]\n      by (simp flip: setclass_iff)\n    also \n    have \" ... = ?Q\"\n      by auto\n    finally \n    show ?thesis using \\<open>Q\\<in>M\\<close> by simp\n  qed\n  let\n    ?\\<pi>=\"?Q\\<times>{one}\"\n  let\n    ?b=\"val(G,?\\<pi>)\"\n  from \\<open>?Q\\<in>M\\<close> \n  have \"?\\<pi>\\<in>M\"\n    using one_in_P P_in_M transitivity\n    by (simp flip: setclass_iff)\n  from \\<open>?\\<pi>\\<in>M\\<close> \n  have \"?b \\<in> M[G]\"\n    using GenExtI by simp\n  have \"Pow(a) \\<inter> M[G] \\<subseteq> ?b\"\n  proof\n    fix c\n    assume \"c \\<in> Pow(a) \\<inter> M[G]\"\n    then obtain \\<chi> where\n      \"c\\<in>M[G]\" \"\\<chi> \\<in> M\" \"val(G,\\<chi>) = c\"\n      using GenExtD by auto\n    let ?\\<theta>=\"{sp \\<in>domain(\\<tau>)\\<times>P . snd(sp) \\<tturnstile> (Member(0,1)) [fst(sp),\\<chi>] }\"\n    have \"arity(forces(Member(0,1))) = 6\"\n      using arity_forces_at by auto\n    with \\<open>domain(\\<tau>) \\<in> M\\<close> \\<open>\\<chi> \\<in> M\\<close> \n    have \"?\\<theta> \\<in> M\"\n      using P_in_M one_in_M leq_in_M sats_fst_snd_in_M\n      by simp\n    then \n    have \"?\\<theta> \\<in> ?Q\"\n      by auto\n    then \n    have \"val(G,?\\<theta>) \\<in> ?b\"\n      using one_in_G one_in_P generic val_of_elem [of ?\\<theta> one ?\\<pi> G]\n      by auto\n    have \"val(G,?\\<theta>) = c\"\n    proof(intro equalityI subsetI)\n      fix x\n      assume \"x \\<in> val(G,?\\<theta>)\"\n      then obtain \\<sigma> p where\n        1: \"<\\<sigma>,p>\\<in>?\\<theta>\" \"p\\<in>G\" \"val(G,\\<sigma>) =  x\"\n        using elem_of_val_pair\n        by blast\n      moreover from \\<open><\\<sigma>,p>\\<in>?\\<theta>\\<close> \\<open>?\\<theta> \\<in> M\\<close>\n      have \"\\<sigma>\\<in>M\"\n        using name_components_in_M[of _ _ ?\\<theta>] by auto\n      moreover from 1 \n      have \"(p \\<tturnstile> (Member(0,1)) [\\<sigma>,\\<chi>])\" \"p\\<in>P\"\n        by simp_all\n      moreover \n      note \\<open>val(G,\\<chi>) = c\\<close>\n      ultimately \n      have \"sats(M[G],Member(0,1),[x,c])\"\n        using \\<open>\\<chi> \\<in> M\\<close> generic definition_of_forcing nat_simp_union\n        by auto\n      moreover \n      have \"x\\<in>M[G]\"\n        using \\<open>val(G,\\<sigma>) =  x\\<close> \\<open>\\<sigma>\\<in>M\\<close>  \\<open>\\<chi>\\<in>M\\<close> GenExtI by blast\n      ultimately \n      show \"x\\<in>c\"\n        using \\<open>c\\<in>M[G]\\<close> by simp\n    next\n      fix x\n      assume \"x \\<in> c\"\n      with \\<open>c \\<in> Pow(a) \\<inter> M[G]\\<close> \n      have \"x \\<in> a\" \"c\\<in>M[G]\" \"x\\<in>M[G]\"\n        using transitivity_MG\n        by auto\n      with \\<open>val(G, \\<tau>) = a\\<close> \n      obtain \\<sigma> where\n        \"\\<sigma>\\<in>domain(\\<tau>)\" \"val(G,\\<sigma>) =  x\"\n        using elem_of_val\n        by blast\n      moreover note \\<open>x\\<in>c\\<close> \\<open>val(G,\\<chi>) = c\\<close>\n      moreover from calculation \n      have \"val(G,\\<sigma>) \\<in> val(G,\\<chi>)\"\n        by simp\n      moreover note \\<open>c\\<in>M[G]\\<close> \\<open>x\\<in>M[G]\\<close>\n      moreover from calculation \n      have \"sats(M[G],Member(0,1),[x,c])\"\n        by simp\n      moreover \n      have \"Member(0,1)\\<in>formula\" by simp\n      moreover \n      have \"\\<sigma>\\<in>M\"\n      proof -\n        from \\<open>\\<sigma>\\<in>domain(\\<tau>)\\<close> \n        obtain p where \"<\\<sigma>,p> \\<in> \\<tau>\"\n          by auto\n        with \\<open>\\<tau>\\<in>M\\<close> \n        show ?thesis\n          using name_components_in_M by blast\n      qed\n      moreover note \\<open>\\<chi> \\<in> M\\<close>\n      ultimately \n      obtain p where \"p\\<in>G\" \"(p \\<tturnstile> Member(0,1) [\\<sigma>,\\<chi>])\"\n        using generic truth_lemma[of \"Member(0,1)\" \"G\" \"[\\<sigma>,\\<chi>]\" ] nat_simp_union\n        by auto\n      moreover from \\<open>p\\<in>G\\<close> \n      have \"p\\<in>P\"\n        using generic unfolding M_generic_def filter_def by blast\n      ultimately\n      have \"<\\<sigma>,p>\\<in>?\\<theta>\"\n        using \\<open>\\<sigma>\\<in>domain(\\<tau>)\\<close> by simp\n      with \\<open>val(G,\\<sigma>) =  x\\<close> \\<open>p\\<in>G\\<close> \n      show \"x\\<in>val(G,?\\<theta>)\"\n        using val_of_elem [of _ _ \"?\\<theta>\"] by auto\n    qed\n    with \\<open>val(G,?\\<theta>) \\<in> ?b\\<close> \n    show \"c\\<in>?b\" by simp\n  qed\n  then \n  have \"Pow(a) \\<inter> M[G] = {x\\<in>?b . x\\<subseteq>a & x\\<in>M[G]}\"\n    by auto\n  also from \\<open>a\\<in>M[G]\\<close> \n  have \" ... = {x\\<in>?b . sats(M[G],subset_fm(0,1),[x,a]) & x\\<in>M[G]}\"\n    using Transset_MG by force\n  also \n  have \" ... = {x\\<in>?b . sats(M[G],subset_fm(0,1),[x,a])} \\<inter> M[G]\"\n    by auto\n  also from \\<open>?b\\<in>M[G]\\<close> \n  have \" ... = {x\\<in>?b . sats(M[G],subset_fm(0,1),[x,a])}\"\n    using Collect_inter_Transset Transset_MG\n    by simp\n  also from \\<open>?b\\<in>M[G]\\<close> \\<open>a\\<in>M[G]\\<close>\n  have \" ... \\<in> M[G]\"\n    using Collect_sats_in_MG GenExtI nat_simp_union by simp\n  finally show ?thesis .\nqed\nend (* context: G_generic *)\n\n\ncontext G_generic begin\n\ninterpretation mgtriv: M_trivial \"##M[G]\"\n  using generic Union_MG pairing_in_MG zero_in_MG transitivity_MG\n  unfolding M_trivial_def M_trans_def M_trivial_axioms_def by (simp; blast)\n\n\ntheorem power_in_MG : \"power_ax(##(M[G]))\"\n  unfolding power_ax_def\nproof (intro rallI, simp only:setclass_iff rex_setclass_is_bex)\n  (* After simplification, we have to show that for every\n     a\\<in>M[G] there exists some x\\<in>M[G] with powerset(##M[G],a,x)\n  *)\n  fix a\n  assume \"a \\<in> M[G]\"\n  then\n  have \"(##M[G])(a)\" by simp\n  have \"{x\\<in>Pow(a) . x \\<in> M[G]} = Pow(a) \\<inter> M[G]\"\n    by auto\n  also from \\<open>a\\<in>M[G]\\<close> \n  have \" ... \\<in> M[G]\"\n    using Pow_inter_MG by simp\n  finally \n  have \"{x\\<in>Pow(a) . x \\<in> M[G]} \\<in> M[G]\" .\n  moreover from \\<open>a\\<in>M[G]\\<close> \\<open>{x\\<in>Pow(a) . x \\<in> M[G]} \\<in> _\\<close> \n  have \"powerset(##M[G], a, {x\\<in>Pow(a) . x \\<in> M[G]})\"\n    using mgtriv.powerset_abs[OF \\<open>(##M[G])(a)\\<close>]\n    by simp\n  ultimately \n  show \"\\<exists>x\\<in>M[G] . powerset(##M[G], a, x)\"\n    by auto\nqed\nend (* context: G_generic *)\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Forcing/Powerset_Axiom.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.31596646458854}}
{"text": "theory flash111Bra  imports flash111Rev\n \n  begin\nlemma onInv111:\n\n   assumes  \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv111 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX1VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_GetXVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ShWbVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX7VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak2VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX5VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_WbVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_GetVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_ReplaceVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_ReplaceShrVldVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_2VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak2VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_ReplaceVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_HomeVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put2VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX11VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX6VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put2VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_PutVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvAck_1_HomeVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Nak1VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak1VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak2VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10_homeVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak3VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX10VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX2VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_Get_Put1VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_PutXVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis StoreVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_FAckVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX3VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutXVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX8_homeVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put1VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis StoreHomeVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_NakVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_InvVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_PutXVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX4VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_NakVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Local_PutVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_Nak1VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_Nak_ClearVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_PutXVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Nak3VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis PI_Local_Get_GetVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_GetX_PutX9VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis PI_Remote_GetXVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac    b2 c2 )\n            by (metis NI_ReplaceHomeVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv111 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2  )\n            by (metis NI_Local_Get_Put3VsInv111 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash111Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7090191337850932, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.31588896500943314}}
{"text": "(*  Title:       LFP\n    Authors:     Jasmin Blanchette, Andrei Popescu, Dmitriy Traytel\n    Maintainer:  Dmitriy Traytel <traytel at inf.ethz.ch>\n*)\n\nsection \\<open>Least Fixpoint (a.k.a. Datatype)\\<close>\n\n(*<*)\ntheory LFP\n  imports \"HOL-Library.BNF_Axiomatization\"\nbegin\n(*>*)\n\nunbundle cardinal_syntax\n\nML \\<open>open Ctr_Sugar_Util\\<close>\nnotation BNF_Def.convol (\"<_ , _>\")\n\ntext \\<open>\n\\begin{tabular}{rcl}\n  'b1 &=& ('a, 'b1, 'b2) F1\\\\\n  'b2 &=& ('a, 'b1, 'b2) F2\n\\end{tabular}\n\nTo build a witness scenario, let us assume\n\n\\begin{tabular}{rcl}\n  ('a, 'b1, 'b2) F1 &=& 'a * 'b1 + 'a * 'b2\\\\\n  ('a, 'b1, 'b2) F2 &=& unit + 'b1 * 'b2\n\\end{tabular}\n\\<close>\n\ndeclare [[bnf_internals]]\nbnf_axiomatization (F1set1: 'a, F1set2: 'b1, F1set3: 'b2)  F1\n  [wits: \"'a \\<Rightarrow> 'b1 \\<Rightarrow> ('a, 'b1, 'b2) F1\" \"'a \\<Rightarrow> 'b2 \\<Rightarrow> ('a, 'b1, 'b2) F1\"]\n  for map: F1map rel: F1rel\nbnf_axiomatization (F2set1: 'a, F2set2: 'b1, F2set3: 'b2)  F2\n  [wits: \"('a, 'b1, 'b2) F2\"]\n  for map: F2map rel: F2rel\n\n\nabbreviation F1in :: \"'a1 set \\<Rightarrow> 'a2 set \\<Rightarrow> 'a3 set \\<Rightarrow> (('a1, 'a2, 'a3) F1) set\" where\n  \"F1in A1 A2 A3 \\<equiv> {x. F1set1 x \\<subseteq> A1 \\<and> F1set2 x \\<subseteq> A2 \\<and> F1set3 x \\<subseteq> A3}\"\nabbreviation F2in :: \"'a1 set \\<Rightarrow> 'a2 set \\<Rightarrow> 'a3 set \\<Rightarrow> (('a1, 'a2, 'a3) F2) set\" where\n  \"F2in A1 A2 A3 \\<equiv> {x. F2set1 x \\<subseteq> A1 \\<and> F2set2 x \\<subseteq> A2 \\<and> F2set3 x \\<subseteq> A3}\"\n\nlemma F1map_comp_id: \"F1map g1 g2 g3 (F1map id f2 f3 x) = F1map g1 (g2 o f2) (g3 o f3) x\"\n  apply (rule trans)\n   apply (rule F1.map_comp)\n  unfolding o_id\n  apply (rule refl)\n  done\n\nlemmas F1in_mono23 = F1.in_mono[OF subset_refl]\n\nlemma F1map_congL: \"\\<lbrakk>\\<forall>a \\<in> F1set2 x. f a = a; \\<forall>a \\<in> F1set3 x. g a = a\\<rbrakk> \\<Longrightarrow>\n  F1map id f g x = x\"\n  apply (rule trans)\n   apply (rule F1.map_cong0)\n     apply (rule refl)\n    apply (rule trans)\n     apply (erule bspec)\n     apply assumption\n    apply (rule sym)\n    apply (rule id_apply)\n   apply (rule trans)\n    apply (erule bspec)\n    apply assumption\n   apply (rule sym)\n   apply (rule id_apply)\n  apply (rule F1.map_id)\n  done\n\nlemma F2map_comp_id: \"F2map g1 g2 g3 (F2map id f2 f3 x) = F2map g1 (g2 o f2) (g3 o f3) x\"\n  apply (rule trans)\n   apply (rule F2.map_comp)\n  unfolding o_id\n  apply (rule refl)\n  done\n\nlemmas F2in_mono23 = F2.in_mono[OF subset_refl]\n\nlemma F2map_congL: \"\\<lbrakk>\\<forall>a \\<in> F2set2 x. f a = a; \\<forall>a \\<in> F2set3 x. g a = a\\<rbrakk> \\<Longrightarrow>\n  F2map id f g x = x\"\n  apply (rule trans)\n   apply (rule F2.map_cong0)\n     apply (rule refl)\n    apply (rule trans)\n     apply (erule bspec)\n     apply assumption\n    apply (rule sym)\n    apply (rule id_apply)\n   apply (rule trans)\n    apply (erule bspec)\n    apply assumption\n   apply (rule sym)\n   apply (rule id_apply)\n  apply (rule F2.map_id)\n  done\n\n\nsubsection\\<open>Algebra\\<close>\n\ndefinition alg where\n  \"alg B1 B2 s1 s2 =\n    ((\\<forall>x \\<in> F1in (UNIV :: 'a set) B1 B2. s1 x \\<in> B1) \\<and> (\\<forall>y \\<in> F2in (UNIV :: 'a set) B1 B2. s2 y \\<in> B2))\"\n\nlemma alg_F1set: \"\\<lbrakk>alg B1 B2 s1 s2; F1set2 x \\<subseteq> B1; F1set3 x \\<subseteq> B2\\<rbrakk> \\<Longrightarrow> s1 x \\<in> B1\"\n  apply (tactic \\<open>dtac @{context} @{thm iffD1[OF alg_def]} 1\\<close>)\n  apply (erule conjE)+\n  apply (erule bspec)\n  apply (rule CollectI)\n  apply (rule conjI[OF subset_UNIV])\n  apply (erule conjI)\n  apply assumption\n  done\n\nlemma alg_F2set: \"\\<lbrakk>alg B1 B2 s1 s2; F2set2 x \\<subseteq> B1; F2set3 x \\<subseteq> B2\\<rbrakk> \\<Longrightarrow> s2 x \\<in> B2\"\n  apply (tactic \\<open>dtac @{context} @{thm iffD1[OF alg_def]} 1\\<close>)\n  apply (erule conjE)+\n  apply (erule bspec)\n  apply (rule CollectI)\n  apply (rule conjI[OF subset_UNIV])\n  apply (erule conjI)\n  apply assumption\n  done\n\nlemma alg_not_empty:\n  \"alg B1 B2 s1 s2 \\<Longrightarrow> B1 \\<noteq> {} \\<and> B2 \\<noteq> {}\"\n  apply (rule conjI)\n   apply (rule notI)\n   apply (tactic \\<open>hyp_subst_tac @{context} 1\\<close>)\n   apply (frule alg_F1set)\n\n(* ORELSE of the following three possibilities *)\n\n     apply (rule subset_emptyI)\n     apply (erule F1.wit1 F1.wit2 F2.wit)\n\n    apply (rule subsetI)\n    apply (drule F1.wit1 F1.wit2 F2.wit)\n\n(**)\n    apply (tactic \\<open>hyp_subst_tac @{context} 1\\<close>)\n    apply (tactic \\<open>FIRST' (map (fn thm => rtac @{context} thm THEN' assume_tac @{context}) @{thms alg_F1set alg_F2set}) 1\\<close>)\n\n     apply (rule subset_emptyI)\n     apply (erule F1.wit1 F1.wit2 F2.wit)\n\n    apply (rule subsetI)\n    apply (drule F1.wit1 F1.wit2 F2.wit)\n    apply (erule FalseE)\n    (**)\n\n   apply (erule emptyE)\n\n  apply (rule notI)\n  apply (tactic \\<open>hyp_subst_tac @{context} 1\\<close>)\n  apply (drule alg_F2set)\n\n    apply (rule subsetI)\n    apply (rule FalseE)\n    apply (erule F1.wit1 F1.wit2 F2.wit)\n\n   apply (rule subset_emptyI)\n   apply (erule F1.wit1 F1.wit2 F2.wit)\n\n  apply (erule emptyE)\n  done\n\n\nsubsection \\<open>Morphism\\<close>\n\ndefinition mor where\n  \"mor B1 B2 s1 s2 B1' B2' s1' s2' f g =\n   (((\\<forall>a \\<in> B1. f a \\<in> B1') \\<and> (\\<forall>a \\<in> B2. g a \\<in> B2')) \\<and>\n   ((\\<forall>z \\<in> F1in (UNIV :: 'a set) B1 B2. f (s1 z) = s1' (F1map id f g z)) \\<and>\n     (\\<forall>z \\<in> F2in (UNIV :: 'a set) B1 B2. g (s2 z) = s2' (F2map id f g z))))\"\n\nlemma morE1: \"\\<lbrakk>mor B1 B2 s1 s2 B1' B2' s1' s2' f g; z \\<in> F1in UNIV B1 B2\\<rbrakk>\n   \\<Longrightarrow> f (s1 z) = s1' (F1map id f g z)\"\n  apply (tactic \\<open>dtac @{context} @{thm iffD1[OF mor_def]} 1\\<close>)\n  apply (erule conjE)+\n  apply (erule bspec)\n  apply assumption\n  done\n\nlemma morE2: \"\\<lbrakk>mor B1 B2 s1 s2 B1' B2' s1' s2' f g; z \\<in> F2in UNIV B1 B2\\<rbrakk>\n   \\<Longrightarrow> g (s2 z) = s2' (F2map id f g z)\"\n  apply (tactic \\<open>dtac @{context} @{thm iffD1[OF mor_def]} 1\\<close>)\n  apply (erule conjE)+\n  apply (erule bspec)\n  apply assumption\n  done\n\nlemma mor_incl: \"\\<lbrakk>B1 \\<subseteq> B1'; B2 \\<subseteq> B2'\\<rbrakk> \\<Longrightarrow> mor B1 B2 s1 s2 B1' B2' s1 s2 id id\"\n  apply (tactic \\<open>rtac @{context} (@{thm mor_def} RS iffD2) 1\\<close>)\n  apply (rule conjI)\n\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (erule subsetD)\n    apply (erule ssubst_mem[OF id_apply])\n\n   apply (rule ballI)\n   apply (erule subsetD)\n   apply (erule ssubst_mem[OF id_apply])\n\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (rule trans)\n    apply (rule id_apply)\n   apply (tactic \\<open>stac @{context} @{thm F1.map_id} 1\\<close>)\n   apply (rule refl)\n\n  apply (rule ballI)\n  apply (rule trans)\n   apply (rule id_apply)\n  apply (tactic \\<open>stac @{context} @{thm F2.map_id} 1\\<close>)\n  apply (rule refl)\n  done\n\nlemma mor_comp:\n  \"\\<lbrakk>mor B1 B2 s1 s2 B1' B2' s1' s2' f g;\n    mor B1' B2' s1' s2' B1'' B2'' s1'' s2'' f' g'\\<rbrakk> \\<Longrightarrow>\n   mor B1 B2 s1 s2 B1'' B2'' s1'' s2'' (f' o f) (g' o g)\"\n  apply (tactic \\<open>dtac @{context} (@{thm mor_def} RS iffD1) 1\\<close>)\n  apply (tactic \\<open>dtac @{context} (@{thm mor_def} RS iffD1) 1\\<close>)\n  apply (tactic \\<open>rtac @{context} (@{thm mor_def} RS iffD2) 1\\<close>)\n  apply (erule conjE)+\n  apply (rule conjI)\n\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (rule ssubst_mem[OF o_apply])\n    apply (erule bspec)\n    apply (erule bspec)\n    apply assumption\n\n   apply (rule ballI)\n   apply (rule ssubst_mem[OF o_apply])\n   apply (erule bspec)\n   apply (erule bspec)\n   apply assumption\n\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (rule trans[OF o_apply])\n   apply (rule trans)\n    apply (rule trans)\n     apply (drule bspec[rotated])\n      apply assumption\n     apply (erule arg_cong)\n    apply (erule CollectE conjE)+\n    apply (erule bspec)\n    apply (rule CollectI)\n    apply (rule conjI)\n     apply (rule subset_UNIV)\n    apply (rule conjI)\n     apply (rule ord_eq_le_trans)\n      apply (rule F1.set_map(2))\n     apply (rule image_subsetI)\n     apply (erule bspec)\n     apply (erule subsetD)\n     apply assumption\n    apply (rule ord_eq_le_trans)\n     apply (rule F1.set_map(3))\n    apply (rule image_subsetI)\n    apply (erule bspec)\n    apply (erule subsetD)\n    apply assumption\n   apply (rule arg_cong[OF F1map_comp_id])\n\n  apply (rule ballI)\n  apply (rule trans[OF o_apply])\n  apply (rule trans)\n   apply (rule trans)\n    apply (drule bspec[rotated])\n     apply assumption\n    apply (erule arg_cong)\n   apply (erule CollectE conjE)+\n   apply (erule bspec)\n   apply (rule CollectI)\n   apply (rule conjI)\n    apply (rule subset_UNIV)\n   apply (rule conjI)\n    apply (rule ord_eq_le_trans)\n     apply (rule F2.set_map(2))\n    apply (rule image_subsetI)\n    apply (erule bspec)\n    apply (erule subsetD)\n    apply assumption\n   apply (rule ord_eq_le_trans)\n    apply (rule F2.set_map(3))\n   apply (rule image_subsetI)\n   apply (erule bspec)\n   apply (erule subsetD)\n   apply assumption\n  apply (rule arg_cong[OF F2map_comp_id])\n  done\n\nlemma mor_cong: \"\\<lbrakk> f' = f; g' = g; mor B1 B2 s1 s2 B1' B2' s1' s2' f g\\<rbrakk> \\<Longrightarrow>\n  mor B1 B2 s1 s2 B1' B2' s1' s2' f' g'\"\n  apply (tactic \\<open>hyp_subst_tac @{context} 1\\<close>)\n  apply assumption\n  done\n\nlemma mor_str:\n  \"mor UNIV UNIV (F1map id s1 s2) (F2map id s1 s2) UNIV UNIV s1 s2 s1 s2\"\n  apply (rule iffD2)\n   apply (rule mor_def)\n  apply (rule conjI)\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (rule UNIV_I)\n   apply (rule ballI)\n   apply (rule UNIV_I)\n\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (rule refl)\n  apply (rule ballI)\n  apply (rule refl)\n  done\n\n\nsubsection\\<open>Bounds\\<close>\n\ntype_synonym bd_type_F1' = \"bd_type_F1 + (bd_type_F1, bd_type_F1, bd_type_F1) F1\"\ntype_synonym bd_type_F2' = \"bd_type_F2 + (bd_type_F2, bd_type_F2, bd_type_F2) F2\"\ntype_synonym SucFbd_type = \"((bd_type_F1' + bd_type_F2') set)\"\ntype_synonym 'a1 ASucFbd_type = \"(SucFbd_type \\<Rightarrow> ('a1 + bool))\"\n\nabbreviation \"F1bd' \\<equiv> bd_F1 +c |UNIV :: (bd_type_F1, bd_type_F1, bd_type_F1) F1 set|\"\nlemma F1set1_bd_incr: \"\\<And>x. |F1set1 x| \\<le>o F1bd'\"\n  by (rule ordLeq_transitive[OF F1.set_bd(1) ordLeq_csum1[OF F1.bd_Card_order]])\nlemma F1set2_bd_incr: \"\\<And>x. |F1set2 x| \\<le>o F1bd'\"\n  by (rule ordLeq_transitive[OF F1.set_bd(2) ordLeq_csum1[OF F1.bd_Card_order]])\nlemma F1set3_bd_incr: \"\\<And>x. |F1set3 x| \\<le>o F1bd'\"\n  by (rule ordLeq_transitive[OF F1.set_bd(3) ordLeq_csum1[OF F1.bd_Card_order]])\n\nlemmas F1bd'_Card_order = Card_order_csum\nlemmas F1bd'_Cinfinite = Cinfinite_csum1[OF F1.bd_Cinfinite]\nlemmas F1bd'_Cnotzero = Cinfinite_Cnotzero[OF F1bd'_Cinfinite]\nlemmas F1bd'_card_order = card_order_csum[OF F1.bd_card_order card_of_card_order_on]\n\nabbreviation \"F2bd' \\<equiv> bd_F2 +c |UNIV :: (bd_type_F2, bd_type_F2, bd_type_F2) F2 set|\"\nlemma F2set1_bd_incr: \"\\<And>x. |F2set1 x| \\<le>o F2bd'\"\n  by (rule ordLeq_transitive[OF F2.set_bd(1) ordLeq_csum1[OF F2.bd_Card_order]])\nlemma F2set2_bd_incr: \"\\<And>x. |F2set2 x| \\<le>o F2bd'\"\n  by (rule ordLeq_transitive[OF F2.set_bd(2) ordLeq_csum1[OF F2.bd_Card_order]])\nlemma F2set3_bd_incr: \"\\<And>x. |F2set3 x| \\<le>o F2bd'\"\n  by (rule ordLeq_transitive[OF F2.set_bd(3) ordLeq_csum1[OF F2.bd_Card_order]])\n\nlemmas F2bd'_Card_order = Card_order_csum\nlemmas F2bd'_Cinfinite = Cinfinite_csum1[OF F2.bd_Cinfinite]\nlemmas F2bd'_Cnotzero = Cinfinite_Cnotzero[OF F2bd'_Cinfinite]\nlemmas F2bd'_card_order = card_order_csum[OF F2.bd_card_order card_of_card_order_on]\n\nabbreviation SucFbd where \"SucFbd \\<equiv> cardSuc (F1bd' +c F2bd')\"\nabbreviation ASucFbd where \"ASucFbd \\<equiv> ( |UNIV| +c ctwo ) ^c SucFbd\"\n\nlemma F1set1_bd: \"|F1set1 x| \\<le>o bd_F1 +c bd_F2\"\n  apply (rule ordLeq_transitive)\n   apply (rule F1.set_bd(1))\n  apply (rule ordLeq_csum1)\n  apply (rule F1.bd_Card_order)\n  done\n\nlemma F1set2_bd: \"|F1set2 x| \\<le>o bd_F1 +c bd_F2\"\n  apply (rule ordLeq_transitive)\n   apply (rule F1.set_bd(2))\n  apply (rule ordLeq_csum1)\n  apply (rule F1.bd_Card_order)\n  done\n\nlemma F1set3_bd: \"|F1set3 x| \\<le>o bd_F1 +c bd_F2\"\n  apply (rule ordLeq_transitive)\n   apply (rule F1.set_bd(3))\n  apply (rule ordLeq_csum1)\n  apply (rule F1.bd_Card_order)\n  done\n\nlemma F2set1_bd: \"|F2set1 x| \\<le>o bd_F1 +c bd_F2\"\n  apply (rule ordLeq_transitive)\n   apply (rule F2.set_bd(1))\n  apply (rule ordLeq_csum2)\n  apply (rule F2.bd_Card_order)\n  done\n\nlemma F2set2_bd: \"|F2set2 x| \\<le>o bd_F1 +c bd_F2\"\n  apply (rule ordLeq_transitive)\n   apply (rule F2.set_bd(2))\n  apply (rule ordLeq_csum2)\n  apply (rule F2.bd_Card_order)\n  done\n\nlemma F2set3_bd: \"|F2set3 x| \\<le>o bd_F1 +c bd_F2\"\n  apply (rule ordLeq_transitive)\n   apply (rule F2.set_bd(3))\n  apply (rule ordLeq_csum2)\n  apply (rule F2.bd_Card_order)\n  done\n\nlemmas SucFbd_Card_order = cardSuc_Card_order[OF Card_order_csum]\nlemmas SucFbd_Cinfinite = Cinfinite_cardSuc[OF Cinfinite_csum1[OF F1bd'_Cinfinite]]\nlemmas SucFbd_Cnotzero = Cinfinite_Cnotzero[OF SucFbd_Cinfinite]\nlemmas worel_SucFbd = Card_order_wo_rel[OF SucFbd_Card_order]\nlemmas ASucFbd_Cinfinite = Cinfinite_cexp[OF ordLeq_csum2[OF Card_order_ctwo] SucFbd_Cinfinite]\n\n\nsubsection\\<open>Minimal Algebras\\<close>\n\n(* These are algebras generated by the empty set. *)\nabbreviation min_G1 where\n  \"min_G1 As1_As2 i \\<equiv> (\\<Union>j \\<in> underS SucFbd i. fst (As1_As2 j))\"\n\nabbreviation min_G2 where\n  \"min_G2 As1_As2 i \\<equiv> (\\<Union>j \\<in> underS SucFbd i. snd (As1_As2 j))\"\n\nabbreviation min_H where\n  \"min_H s1 s2 As1_As2 i \\<equiv>\n    (min_G1 As1_As2 i \\<union> s1 ` (F1in (UNIV :: 'a set) (min_G1 As1_As2 i) (min_G2 As1_As2 i)),\n    min_G2 As1_As2 i \\<union> s2 ` (F2in (UNIV :: 'a set) (min_G1 As1_As2 i) (min_G2 As1_As2 i)))\"\n\nabbreviation min_algs where\n  \"min_algs s1 s2 \\<equiv> wo_rel.worec SucFbd (min_H s1 s2)\"\n\ndefinition min_alg1 where\n  \"min_alg1 s1 s2 = (\\<Union>i \\<in> Field SucFbd. fst (min_algs s1 s2 i))\"\n\ndefinition min_alg2 where\n  \"min_alg2 s1 s2 = (\\<Union>i \\<in> Field SucFbd. snd (min_algs s1 s2 i))\"\n\nlemma min_algs:\n  \"i \\<in> Field SucFbd \\<Longrightarrow> min_algs s1 s2 i = min_H s1 s2 (min_algs s1 s2) i\"\n  apply (rule fun_cong[OF wo_rel.worec_fixpoint[OF worel_SucFbd]])\n  apply (rule iffD2)\n   apply (rule meta_eq_to_obj_eq)\n   apply (rule wo_rel.adm_wo_def[OF worel_SucFbd])\n  apply (rule allI)+\n  apply (rule impI)\n\n  apply (rule iffD2)\n   apply (rule prod.inject)\n  apply (rule conjI)\n\n   apply (rule arg_cong2[of _ _ _ _ \"(\\<union>)\"])\n    apply (rule SUP_cong)\n     apply (rule refl)\n    apply (drule bspec)\n     apply assumption\n    apply (erule arg_cong)\n\n   apply (rule image_cong)\n    apply (rule arg_cong2[of _ _ _ _ \"F1in UNIV\"])\n     apply (rule SUP_cong)\n      apply (rule refl)\n     apply (drule bspec)\n      apply assumption\n     apply (erule arg_cong)\n    apply (rule SUP_cong)\n     apply (rule refl)\n    apply (drule bspec)\n     apply assumption\n    apply (erule arg_cong)\n   apply (rule refl)\n\n  apply (rule arg_cong2[of _ _ _ _ \"(\\<union>)\"])\n   apply (rule SUP_cong)\n    apply (rule refl)\n   apply (drule bspec)\n    apply assumption\n   apply (erule arg_cong)\n\n  apply (rule image_cong)\n   apply (rule arg_cong2[of _ _ _ _ \"F2in UNIV\"])\n    apply (rule SUP_cong)\n     apply (rule refl)\n    apply (drule bspec)\n     apply assumption\n    apply (erule arg_cong)\n   apply (rule SUP_cong)\n    apply (rule refl)\n   apply (drule bspec)\n    apply assumption\n   apply (erule arg_cong)\n  apply (rule refl)\n  done\n\ncorollary min_algs1: \"i \\<in> Field SucFbd \\<Longrightarrow> fst (min_algs s1 s2 i) =\n  min_G1 (min_algs s1 s2) i \\<union>\n    s1 ` (F1in UNIV (min_G1 (min_algs s1 s2) i) (min_G2 (min_algs s1 s2) i))\"\n  apply (rule trans)\n   apply (erule arg_cong[OF min_algs])\n  apply (rule fst_conv)\n  done\n\ncorollary min_algs2: \"i \\<in> Field SucFbd \\<Longrightarrow> snd (min_algs s1 s2 i) =\n  min_G2 (min_algs s1 s2) i \\<union>\n    s2 ` (F2in UNIV (min_G1 (min_algs s1 s2) i) (min_G2 (min_algs s1 s2) i))\"\n  apply (rule trans)\n   apply (erule arg_cong[OF min_algs])\n  apply (rule snd_conv)\n  done\n\nlemma min_algs_mono1: \"relChain SucFbd (%i. fst (min_algs s1 s2 i))\"\n  apply (tactic \\<open>rtac @{context} @{thm iffD2[OF meta_eq_to_obj_eq[OF relChain_def]]} 1\\<close>)\n  apply (rule allI)+\n  apply (rule impI)\n  apply (rule case_split)\n   apply (rule xt1(3))\n    apply (rule min_algs1)\n    apply (erule FieldI2)\n   apply (rule subsetI)\n   apply (rule UnI1)\n   apply (rule UN_I)\n    apply (erule underS_I)\n    apply assumption\n   apply assumption\n  apply (rule equalityD1)\n  apply (drule notnotD)\n  apply (erule arg_cong)\n  done\n\nlemma min_algs_mono2: \"relChain SucFbd (%i. snd (min_algs s1 s2 i))\"\n  apply (tactic \\<open>rtac @{context} @{thm iffD2[OF meta_eq_to_obj_eq[OF relChain_def]]} 1\\<close>)\n  apply (rule allI)+\n  apply (rule impI)\n  apply (rule case_split)\n   apply (rule xt1(3))\n    apply (rule min_algs2)\n    apply (erule FieldI2)\n   apply (rule subsetI)\n   apply (rule UnI1)\n   apply (rule UN_I)\n    apply (erule underS_I)\n    apply assumption\n   apply assumption\n  apply (rule equalityD1)\n  apply (drule notnotD)\n  apply (erule arg_cong)\n  done\n\nlemma SucFbd_limit: \"\\<lbrakk>x1 \\<in> Field SucFbd & x2 \\<in> Field SucFbd\\<rbrakk>\n \\<Longrightarrow> \\<exists>y \\<in> Field SucFbd. (x1 \\<noteq> y \\<and> (x1, y) \\<in> SucFbd) \\<and> (x2 \\<noteq> y \\<and> (x2, y) \\<in> SucFbd)\"\n  apply (erule conjE)+\n  apply (rule rev_mp)\n   apply (rule Cinfinite_limit_finite)\n     apply (rule finite.insertI)\n     apply (rule finite.insertI)\n     apply (rule finite.emptyI)\n    apply (erule insert_subsetI)\n    apply (erule insert_subsetI)\n    apply (rule empty_subsetI)\n   apply (rule SucFbd_Cinfinite)\n  apply (rule impI)\n  apply (erule bexE)\n  apply (rule bexI)\n\n   apply (rule conjI)\n\n    apply (erule bspec)\n    apply (rule insertI1)\n\n   apply (erule bspec)\n   apply (rule insertI2)\n   apply (rule insertI1)\n  apply assumption\n  done\n\nlemma alg_min_alg: \"alg (min_alg1 s1 s2) (min_alg2 s1 s2) s1 s2\"\n  apply (tactic \\<open>rtac @{context} (@{thm alg_def} RS iffD2) 1\\<close>)\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (erule CollectE conjE)+\n\n   apply (rule bexE)\n    apply (rule cardSuc_UNION_Cinfinite)\n       apply (rule Cinfinite_csum1) (*TRY*)\n       apply (rule F1bd'_Cinfinite)\n      apply (rule min_algs_mono1)\n     apply (erule subset_trans[OF _ equalityD1[OF min_alg1_def]])\n    apply (rule ordLeq_transitive)\n     apply (rule F1set2_bd_incr)\n    apply (rule ordLeq_csum1) (*or refl *)\n    apply (rule F1bd'_Card_order)\n\n   apply (rule bexE)\n    apply (rule cardSuc_UNION_Cinfinite)\n       apply (rule Cinfinite_csum1) (*TRY*)\n       apply (rule F1bd'_Cinfinite)\n      apply (rule min_algs_mono2)\n     apply (erule subset_trans[OF _ equalityD1[OF min_alg2_def]])\n    apply (rule ordLeq_transitive)\n     apply (rule F1set3_bd_incr)\n    apply (rule ordLeq_csum1) (*or refl *)\n    apply (rule F1bd'_Card_order)\n\n   apply (rule bexE)\n    apply (rule SucFbd_limit)\n    apply (erule conjI)\n    apply assumption\n   apply (rule subsetD[OF equalityD2[OF min_alg1_def]])\n   apply (rule UN_I)\n    apply (erule thin_rl)\n    apply (erule thin_rl)\n    apply (erule thin_rl)\n    apply (erule thin_rl)\n    apply (erule thin_rl)\n    apply (erule thin_rl)\n    apply (erule thin_rl) (* m + 3 * n *)\n    apply assumption\n   apply (rule subsetD)\n    apply (rule equalityD2)\n    apply (rule min_algs1)\n    apply assumption\n   apply (rule UnI2)\n   apply (rule image_eqI)\n    apply (rule refl)\n   apply (rule CollectI)\n   apply (drule asm_rl)\n   apply (erule thin_rl)\n   apply (erule thin_rl)\n   apply (erule conjE)+\n\n   apply (rule conjI)\n    apply assumption\n\n   apply (rule conjI)\n    apply (erule subset_trans)\n    apply (rule subsetI)\n    apply (rule UN_I)\n     apply (erule underS_I)\n     apply assumption\n    apply assumption\n\n   apply (erule subset_trans)\n   apply (erule UN_upper[OF underS_I])\n   apply assumption\n\n(**)\n\n  apply (rule ballI)\n  apply (erule CollectE conjE)+\n\n  apply (rule bexE)\n   apply (rule cardSuc_UNION_Cinfinite)\n      apply (rule Cinfinite_csum1) (*TRY*)\n      apply (rule F1bd'_Cinfinite)\n     apply (rule min_algs_mono1)\n\n    apply (erule subset_trans[OF _ equalityD1[OF min_alg1_def]])\n   apply (rule ordLeq_transitive)\n    apply (rule F2set2_bd_incr)\n   apply (rule ordLeq_csum2)\n   apply (rule F2bd'_Card_order)\n\n  apply (rule bexE)\n   apply (rule cardSuc_UNION_Cinfinite)\n      apply (rule Cinfinite_csum1) (*TRY*)\n      apply (rule F1bd'_Cinfinite)\n     apply (rule min_algs_mono2)\n\n    apply (erule subset_trans[OF _ equalityD1[OF min_alg2_def]])\n   apply (rule ordLeq_transitive)\n    apply (rule F2set3_bd_incr)\n   apply (rule ordLeq_csum2)\n   apply (rule F2bd'_Card_order)\n\n  apply (rule bexE)\n   apply (rule SucFbd_limit)\n   apply (erule conjI)\n   apply assumption\n  apply (rule subsetD[OF equalityD2[OF min_alg2_def]])\n  apply (rule UN_I)\n   apply (erule thin_rl)\n   apply (erule thin_rl)\n   apply (erule thin_rl)\n   apply (erule thin_rl)\n   apply (erule thin_rl)\n   apply (erule thin_rl)\n   apply (erule thin_rl) (* m + 3 * n *)\n   apply assumption\n  apply (rule subsetD)\n   apply (rule equalityD2)\n   apply (rule min_algs2)\n   apply assumption\n  apply (rule UnI2)\n  apply (rule image_eqI)\n   apply (rule refl)\n  apply (rule CollectI)\n  apply (rule conjI)\n   apply assumption\n\n  apply (erule thin_rl)\n  apply (erule thin_rl)\n  apply (erule thin_rl)\n  apply (erule conjE)+\n  apply (rule conjI)\n   apply (erule subset_trans)\n   apply (rule UN_upper)\n   apply (erule underS_I)\n   apply assumption\n\n  apply (erule subset_trans)\n  apply (rule UN_upper)\n  apply (erule underS_I)\n  apply assumption\n  done\n\nlemmas SucFbd_ASucFbd = ordLess_ordLeq_trans[OF\n    ordLess_ctwo_cexp\n    cexp_mono1[OF ordLeq_csum2[OF Card_order_ctwo]],\n    OF SucFbd_Card_order SucFbd_Card_order]\n\nlemma card_of_min_algs:\n  fixes s1 :: \"('a, 'b, 'c) F1 \\<Rightarrow> 'b\" and s2 :: \"('a, 'b, 'c) F2 \\<Rightarrow> 'c\"\n  shows \"i \\<in> Field SucFbd \\<longrightarrow>\n  ( |fst (min_algs s1 s2 i)| \\<le>o (ASucFbd :: 'a ASucFbd_type rel) \\<and> |snd (min_algs s1 s2 i)| \\<le>o (ASucFbd :: 'a ASucFbd_type rel) )\"\n  apply (rule well_order_induct_imp[of _ \"%i. ( |fst (min_algs s1 s2 i)| \\<le>o ASucFbd \\<and> |snd (min_algs s1 s2 i)| \\<le>o ASucFbd )\", OF worel_SucFbd])\n  apply (rule impI)\n  apply (rule conjI)\n   apply (rule ordIso_ordLeq_trans)\n    apply (rule card_of_ordIso_subst)\n    apply (erule min_algs1)\n   apply (rule Un_Cinfinite_bound)\n\n     apply (rule UNION_Cinfinite_bound)\n\n       apply (rule ordLess_imp_ordLeq)\n       apply (rule ordLess_transitive)\n        apply (rule card_of_underS)\n         apply (rule SucFbd_Card_order)\n        apply assumption\n       apply (rule SucFbd_ASucFbd)\n\n      apply (rule ballI)\n      apply (erule allE)\n      apply (drule mp)\n       apply (erule underS_E)\n      apply (drule mp)\n       apply (erule underS_Field)\n      apply (erule conjE)+\n      apply assumption\n\n     apply (rule ASucFbd_Cinfinite)\n\n    apply (rule ordLeq_transitive)\n     apply (rule card_of_image)\n    apply (rule ordLeq_transitive)\n     apply (rule F1.in_bd)\n    apply (rule ordLeq_transitive)\n     apply (rule cexp_mono1)\n      apply (rule csum_mono1)\n      apply (rule csum_mono2) (* REPEAT m *)\n      apply (rule csum_cinfinite_bound)\n          apply (rule UNION_Cinfinite_bound)\n\n            apply (rule ordLess_imp_ordLeq)\n            apply (rule ordLess_transitive)\n             apply (rule card_of_underS)\n              apply (rule SucFbd_Card_order)\n             apply assumption\n            apply (rule SucFbd_ASucFbd)\n\n           apply (rule ballI)\n           apply (erule allE)\n           apply (drule mp)\n            apply (erule underS_E)\n           apply (drule mp)\n            apply (erule underS_Field)\n           apply (erule conjE)+\n           apply assumption\n\n          apply (rule ASucFbd_Cinfinite)\n\n         apply (rule UNION_Cinfinite_bound)\n\n           apply (rule ordLess_imp_ordLeq)\n           apply (rule ordLess_transitive)\n            apply (rule card_of_underS)\n             apply (rule SucFbd_Card_order)\n            apply assumption\n           apply (rule SucFbd_ASucFbd)\n\n          apply (rule ballI)\n          apply (erule allE)\n          apply (drule mp)\n           apply (erule underS_E)\n          apply (drule mp)\n           apply (erule underS_Field)\n          apply (erule conjE)+\n          apply assumption\n\n         apply (rule ASucFbd_Cinfinite)\n\n        apply (rule card_of_Card_order)\n       apply (rule card_of_Card_order)\n      apply (rule ASucFbd_Cinfinite)\n\n     apply (rule F1bd'_Card_order)\n    apply (rule ordIso_ordLeq_trans)\n     apply (rule cexp_cong1)\n      apply (rule ordIso_transitive)\n       apply (rule csum_cong1)\n       apply (rule ordIso_transitive)\n        apply (tactic \\<open>BNF_Tactics.mk_rotate_eq_tac @{context}\n           (rtac @{context} @{thm ordIso_refl} THEN'\n           FIRST' [rtac @{context} @{thm card_of_Card_order},\n           rtac @{context} @{thm Card_order_csum},\n           rtac @{context} @{thm Card_order_cexp}])\n           @{thm ordIso_transitive} @{thm csum_assoc} @{thm csum_com} @{thm csum_cong}\n           [1,2] [2,1] 1\\<close>)\n       apply (rule csum_absorb1)\n        apply (rule ASucFbd_Cinfinite)\n\n       apply (rule ordLeq_transitive)\n        apply (rule ordLeq_csum1)\n        apply (tactic \\<open>FIRST' [rtac @{context} @{thm Card_order_csum}, rtac @{context} @{thm card_of_Card_order}] 1\\<close>)\n       apply (rule ordLeq_cexp1)\n        apply (rule SucFbd_Cnotzero)\n       apply (rule Card_order_csum)\n      apply (rule csum_absorb1)\n       apply (rule ASucFbd_Cinfinite)\n      apply (rule ctwo_ordLeq_Cinfinite)\n      apply (rule ASucFbd_Cinfinite)\n     apply (rule F1bd'_Card_order)\n    apply (rule ordIso_imp_ordLeq)\n    apply (rule cexp_cprod_ordLeq)\n\n       apply (rule Card_order_csum)\n      apply (rule SucFbd_Cinfinite)\n     apply (rule F1bd'_Cnotzero)\n    apply (rule ordLeq_transitive)\n     apply (rule ordLeq_csum1)\n     apply (rule F1bd'_Card_order)\n    apply (rule cardSuc_ordLeq)\n    apply (rule Card_order_csum)\n\n   apply (rule ASucFbd_Cinfinite)\n\n  apply (rule ordIso_ordLeq_trans)\n   apply (rule card_of_ordIso_subst)\n   apply (erule min_algs2)\n  apply (rule Un_Cinfinite_bound)\n\n    apply (rule UNION_Cinfinite_bound)\n\n      apply (rule ordLess_imp_ordLeq)\n      apply (rule ordLess_transitive)\n       apply (rule card_of_underS)\n        apply (rule SucFbd_Card_order)\n       apply assumption\n      apply (rule SucFbd_ASucFbd)\n\n     apply (rule ballI)\n     apply (erule allE)\n     apply (drule mp)\n      apply (erule underS_E)\n     apply (drule mp)\n      apply (erule underS_Field)\n     apply (erule conjE)+\n     apply assumption\n\n    apply (rule ASucFbd_Cinfinite)\n\n   apply (rule ordLeq_transitive)\n    apply (rule card_of_image)\n   apply (rule ordLeq_transitive)\n    apply (rule F2.in_bd)\n   apply (rule ordLeq_transitive)\n    apply (rule cexp_mono1)\n     apply (rule csum_mono1)\n     apply (rule csum_mono2)\n     apply (rule csum_cinfinite_bound)\n         apply (rule UNION_Cinfinite_bound)\n\n           apply (rule ordLess_imp_ordLeq)\n           apply (rule ordLess_transitive)\n            apply (rule card_of_underS)\n             apply (rule SucFbd_Card_order)\n            apply assumption\n           apply (rule SucFbd_ASucFbd)\n\n          apply (rule ballI)\n          apply (erule allE)\n          apply (drule mp)\n           apply (erule underS_E)\n          apply (drule mp)\n           apply (erule underS_Field)\n          apply (erule conjE)+\n          apply assumption\n\n         apply (rule ASucFbd_Cinfinite)\n\n        apply (rule UNION_Cinfinite_bound)\n\n          apply (rule ordLess_imp_ordLeq)\n          apply (rule ordLess_transitive)\n           apply (rule card_of_underS)\n            apply (rule SucFbd_Card_order)\n           apply assumption\n          apply (rule SucFbd_ASucFbd)\n\n         apply (rule ballI)\n         apply (erule allE)\n         apply (drule mp)\n          apply (erule underS_E)\n         apply (drule mp)\n          apply (erule underS_Field)\n         apply (erule conjE)+\n         apply assumption\n\n        apply (rule ASucFbd_Cinfinite)\n\n       apply (rule card_of_Card_order)\n      apply (rule card_of_Card_order)\n     apply (rule ASucFbd_Cinfinite)\n\n    apply (rule F2bd'_Card_order)\n   apply (rule ordIso_ordLeq_trans)\n    apply (rule cexp_cong1)\n\n     apply (rule ordIso_transitive)\n      apply (rule csum_cong1)\n      apply (rule ordIso_transitive)\n       apply (tactic \\<open>BNF_Tactics.mk_rotate_eq_tac @{context}\n           (rtac @{context} @{thm ordIso_refl} THEN'\n           FIRST' [rtac @{context} @{thm card_of_Card_order},\n           rtac @{context} @{thm Card_order_csum},\n           rtac @{context} @{thm Card_order_cexp}])\n           @{thm ordIso_transitive} @{thm csum_assoc} @{thm csum_com} @{thm csum_cong}\n           [1,2] [2,1] 1\\<close>)\n      apply (rule csum_absorb1)\n       apply (rule ASucFbd_Cinfinite)\n\n      apply (rule ordLeq_transitive)\n       apply (rule ordLeq_csum1)\n       apply (tactic \\<open>FIRST' [rtac @{context} @{thm Card_order_csum}, rtac @{context} @{thm card_of_Card_order}] 1\\<close>)\n      apply (rule ordLeq_cexp1)\n       apply (rule SucFbd_Cnotzero)\n      apply (rule Card_order_csum)\n\n     apply (rule csum_absorb1)\n      apply (rule ASucFbd_Cinfinite)\n     apply (rule ctwo_ordLeq_Cinfinite)\n     apply (rule ASucFbd_Cinfinite)\n    apply (rule F2bd'_Card_order)\n   apply (rule ordIso_imp_ordLeq)\n   apply (rule cexp_cprod_ordLeq)\n      apply (rule Card_order_csum)\n     apply (rule SucFbd_Cinfinite)\n    apply (rule F2bd'_Cnotzero)\n   apply (rule ordLeq_transitive)\n    apply (rule ordLeq_csum2)\n    apply (rule F2bd'_Card_order)\n   apply (rule cardSuc_ordLeq)\n   apply (rule Card_order_csum)\n\n  apply (rule ASucFbd_Cinfinite)\n  done\n\nlemma card_of_min_alg1:\n  fixes s1 :: \"('a, 'b, 'c) F1 \\<Rightarrow> 'b\" and s2 :: \"('a, 'b, 'c) F2 \\<Rightarrow> 'c\"\n  shows \"|min_alg1 s1 s2| \\<le>o (ASucFbd :: 'a ASucFbd_type rel)\"\n  apply (rule ordIso_ordLeq_trans)\n   apply (rule card_of_ordIso_subst[OF min_alg1_def])\n  apply (rule UNION_Cinfinite_bound)\n\n    apply (rule ordIso_ordLeq_trans)\n     apply (rule card_of_Field_ordIso)\n     apply (rule SucFbd_Card_order)\n    apply (rule ordLess_imp_ordLeq)\n    apply (rule SucFbd_ASucFbd)\n\n   apply (rule ballI)\n   apply (drule rev_mp)\n    apply (rule card_of_min_algs)\n   apply (erule conjE)+\n   apply assumption\n  apply (rule ASucFbd_Cinfinite)\n  done\n\nlemma card_of_min_alg2:\n  fixes s1 :: \"('a, 'b, 'c) F1 \\<Rightarrow> 'b\" and s2 :: \"('a, 'b, 'c) F2 \\<Rightarrow> 'c\"\n  shows \"|min_alg2 s1 s2| \\<le>o (ASucFbd :: 'a ASucFbd_type rel)\"\n  apply (rule ordIso_ordLeq_trans)\n   apply (rule card_of_ordIso_subst[OF min_alg2_def])\n  apply (rule UNION_Cinfinite_bound)\n\n    apply (rule ordIso_ordLeq_trans)\n     apply (rule card_of_Field_ordIso)\n     apply (rule SucFbd_Card_order)\n    apply (rule ordLess_imp_ordLeq)\n    apply (rule SucFbd_ASucFbd)\n\n   apply (rule ballI)\n   apply (drule rev_mp)\n    apply (rule card_of_min_algs)\n   apply (erule conjE)+\n   apply assumption\n  apply (rule ASucFbd_Cinfinite)\n  done\n\nlemma least_min_algs: \"alg B1 B2 s1 s2 \\<Longrightarrow>\n  i \\<in> Field SucFbd \\<longrightarrow>\n    fst (min_algs s1 s2 i) \\<subseteq> B1 \\<and> snd (min_algs s1 s2 i) \\<subseteq> B2\"\n  apply (rule well_order_induct_imp[of _ \"%i. (fst (min_algs s1 s2 i) \\<subseteq> B1 \\<and> snd (min_algs s1 s2 i) \\<subseteq> B2)\", OF worel_SucFbd])\n  apply (rule impI)\n  apply (rule conjI)\n   apply (rule ord_eq_le_trans)\n    apply (erule min_algs1)\n   apply (rule Un_least)\n    apply (rule UN_least)\n    apply (erule allE)\n    apply (drule mp)\n     apply (erule underS_E)\n    apply (drule mp)\n     apply (erule underS_Field)\n    apply (erule conjE)+\n    apply assumption\n   apply (rule image_subsetI)\n   apply (erule CollectE conjE)+\n   apply (erule alg_F1set)\n\n    apply (erule subset_trans)\n    apply (rule UN_least)\n    apply (erule allE)\n    apply (drule mp)\n     apply (erule underS_E)\n    apply (drule mp)\n     apply (erule underS_Field)\n    apply (erule conjE)+\n    apply assumption\n\n   apply (erule subset_trans)\n   apply (rule UN_least)\n   apply (erule allE)\n   apply (drule mp)\n    apply (erule underS_E)\n   apply (drule mp)\n    apply (erule underS_Field)\n   apply (erule conjE)+\n   apply assumption\n\n  apply (rule ord_eq_le_trans)\n   apply (erule min_algs2)\n  apply (rule Un_least)\n   apply (rule UN_least)\n   apply (erule allE)\n   apply (drule mp)\n    apply (erule underS_E)\n   apply (drule mp)\n    apply (erule underS_Field)\n   apply (erule conjE)+\n   apply assumption\n  apply (rule image_subsetI)\n  apply (erule CollectE conjE)+\n  apply (erule alg_F2set)\n\n   apply (erule subset_trans)\n   apply (rule UN_least)\n   apply (erule allE)\n   apply (drule mp)\n    apply (erule underS_E)\n   apply (drule mp)\n    apply (erule underS_Field)\n   apply (erule conjE)+\n   apply assumption\n\n  apply (erule subset_trans)\n  apply (rule UN_least)\n  apply (erule allE)\n  apply (drule mp)\n   apply (erule underS_E)\n  apply (drule mp)\n   apply (erule underS_Field)\n  apply (erule conjE)+\n  apply assumption\n  done\n\nlemma least_min_alg1: \"alg B1 B2 s1 s2 \\<Longrightarrow> min_alg1 s1 s2 \\<subseteq> B1\"\n  apply (rule ord_eq_le_trans[OF min_alg1_def])\n  apply (rule UN_least)\n  apply (drule least_min_algs)\n  apply (drule mp)\n   apply assumption\n  apply (erule conjE)+\n  apply assumption\n  done\n\nlemma least_min_alg2: \"alg B1 B2 s1 s2 \\<Longrightarrow> min_alg2 s1 s2 \\<subseteq> B2\"\n  apply (rule ord_eq_le_trans[OF min_alg2_def])\n  apply (rule UN_least)\n  apply (drule least_min_algs)\n  apply (drule mp)\n   apply assumption\n  apply (erule conjE)+\n  apply assumption\n  done\n\nlemma mor_incl_min_alg:\n  \"alg B1 B2 s1 s2 \\<Longrightarrow>\n   mor (min_alg1 s1 s2) (min_alg2 s1 s2) s1 s2 B1 B2 s1 s2 id id\"\n  apply (rule mor_incl)\n   apply (erule least_min_alg1)\n  apply (erule least_min_alg2)\n  done\n\nsubsection \\<open>Initiality\\<close>\n\ntext\\<open>The following ``happens\" to be the type (for our particular construction)\nof the initial algebra carrier:\\<close>\n\ntype_synonym 'a1 F1init_type = \"('a1, 'a1 ASucFbd_type, 'a1 ASucFbd_type) F1 \\<Rightarrow> 'a1 ASucFbd_type\"\ntype_synonym 'a1 F2init_type = \"('a1, 'a1 ASucFbd_type, 'a1 ASucFbd_type) F2 \\<Rightarrow> 'a1 ASucFbd_type\"\n\ntypedef 'a1 IIT =\n  \"UNIV ::\n    (('a1 ASucFbd_type set \\<times> 'a1 ASucFbd_type set) \\<times> ('a1 F1init_type \\<times> 'a1 F2init_type)) set\"\n  by (rule exI) (rule UNIV_I)\n\n\nsubsection\\<open>Initial Algebras\\<close>\n\nabbreviation II :: \"'a1 IIT set\" where\n  \"II \\<equiv> {Abs_IIT ((B1, B2), (s1, s2)) |B1 B2 s1 s2. alg B1 B2 s1 s2}\"\ndefinition str_init1 where\n  \"str_init1 (dummy :: 'a1)\n    (y::('a1, 'a1 IIT \\<Rightarrow> 'a1 ASucFbd_type, 'a1 IIT \\<Rightarrow> 'a1 ASucFbd_type) F1)\n    (i :: 'a1 IIT) =\n      fst (snd (Rep_IIT i))\n        (F1map id (\\<lambda>f :: 'a1 IIT \\<Rightarrow> 'a1 ASucFbd_type. f i) (\\<lambda>f. f i) y)\"\ndefinition str_init2 where\n  \"str_init2 (dummy :: 'a1) y (i :: 'a1 IIT) =\n      snd (snd (Rep_IIT i)) (F2map id (\\<lambda>f. f i) (\\<lambda>f. f i) y)\"\nabbreviation car_init1 where\n  \"car_init1 dummy \\<equiv> min_alg1 (str_init1 dummy) (str_init2 dummy)\"\nabbreviation car_init2 where\n  \"car_init2 dummy \\<equiv> min_alg2 (str_init1 dummy) (str_init2 dummy)\"\n\nlemma alg_select:\n  \"\\<forall>i \\<in> II. alg (fst (fst (Rep_IIT i))) (snd (fst (Rep_IIT i)))\n                      (fst (snd (Rep_IIT i))) (snd (snd (Rep_IIT i)))\"\n  apply (rule ballI)\n  apply (erule CollectE exE conjE)+\n  apply (tactic \\<open>hyp_subst_tac @{context} 1\\<close>)\n  unfolding fst_conv snd_conv Abs_IIT_inverse[OF UNIV_I]\n  apply assumption\n  done\n\nlemma mor_select:\n  \"\\<lbrakk>i \\<in> II;\n    mor (fst (fst (Rep_IIT i))) (snd (fst (Rep_IIT i)))\n        (fst (snd (Rep_IIT i))) (snd (snd (Rep_IIT i))) UNIV UNIV s1' s2' f g\\<rbrakk> \\<Longrightarrow>\n  mor (car_init1 dummy) (car_init2 dummy) (str_init1 dummy) (str_init2 dummy) UNIV UNIV s1' s2' (f \\<circ> (\\<lambda>h. h i)) (g \\<circ> (\\<lambda>h. h i))\"\n  apply (rule mor_cong)\n    apply (rule sym)\n    apply (rule o_id)\n   apply (rule sym)\n   apply (rule o_id)\n  apply (tactic \\<open>rtac @{context} (Thm.permute_prems 0 1 @{thm mor_comp}) 1\\<close>)\n   apply (tactic \\<open>etac @{context} (Thm.permute_prems 0 1 @{thm mor_comp}) 1\\<close>)\n   apply (tactic \\<open>rtac @{context} (@{thm mor_def} RS iffD2) 1\\<close>)\n   apply (rule conjI)\n\n    apply (rule conjI)\n     apply (rule ballI)\n     apply (erule bspec[rotated])\n     apply (erule CollectE)\n     apply assumption\n\n    apply (rule ballI)\n    apply (erule bspec[rotated])\n    apply (erule CollectE)\n    apply assumption\n\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (rule str_init1_def)\n\n   apply (rule ballI)\n   apply (rule str_init2_def)\n\n  apply (rule mor_incl_min_alg)\n    (*alg_epi*)\n  apply (erule thin_rl)+\n  apply (tactic \\<open>rtac @{context} (@{thm alg_def} RS iffD2) 1\\<close>)\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (erule CollectE conjE)+\n   apply (rule CollectI)\n   apply (rule ballI)\n   apply (frule bspec[OF alg_select])\n   apply (rule ssubst_mem[OF str_init1_def])\n   apply (erule alg_F1set)\n\n    apply (rule ord_eq_le_trans)\n     apply (rule F1.set_map(2))\n    apply (rule subset_trans)\n     apply (erule image_mono)\n    apply (rule image_Collect_subsetI)\n    apply (erule bspec)\n    apply assumption\n\n   apply (rule ord_eq_le_trans)\n    apply (rule F1.set_map(3))\n   apply (rule subset_trans)\n    apply (erule image_mono)\n   apply (rule image_Collect_subsetI)\n   apply (erule bspec)\n   apply assumption\n\n\n  apply (rule ballI)\n  apply (erule CollectE conjE)+\n  apply (rule CollectI)\n  apply (rule ballI)\n  apply (frule bspec[OF alg_select])\n  apply (rule ssubst_mem[OF str_init2_def])\n  apply (erule alg_F2set)\n\n   apply (rule ord_eq_le_trans)\n    apply (rule F2.set_map(2))\n   apply (rule subset_trans)\n    apply (erule image_mono)\n   apply (rule image_Collect_subsetI)\n   apply (erule bspec)\n   apply assumption\n\n  apply (rule ord_eq_le_trans)\n   apply (rule F2.set_map(3))\n  apply (rule subset_trans)\n   apply (erule image_mono)\n  apply (rule image_Collect_subsetI)\n  apply (erule bspec)\n  apply assumption\n  done\n\nlemma init_unique_mor:\n  \"\\<lbrakk>a1 \\<in> car_init1 dummy; a2 \\<in> car_init2 dummy;\n    mor (car_init1 dummy) (car_init2 dummy) (str_init1 dummy) (str_init2 dummy) B1 B2 s1 s2 f1 f2;\n    mor (car_init1 dummy) (car_init2 dummy) (str_init1 dummy) (str_init2 dummy) B1 B2 s1 s2 g1 g2\\<rbrakk> \\<Longrightarrow>\n  f1 a1 = g1 a1 \\<and> f2 a2 = g2 a2\"\n  apply (rule conjI)\n   apply (erule prop_restrict)\n   apply (erule thin_rl)\n   apply (rule least_min_alg1)\n   apply (tactic \\<open>rtac @{context} (@{thm alg_def} RS iffD2) 1\\<close>)\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (rule CollectI)\n    apply (erule CollectE conjE)+\n    apply (rule conjI)\n\n     apply (rule alg_F1set[OF alg_min_alg])\n      apply (erule subset_trans)\n      apply (rule Collect_restrict)\n     apply (erule subset_trans)\n     apply (rule Collect_restrict)\n\n    apply (rule trans)\n     apply (erule morE1)\n     apply (rule subsetD)\n      apply (rule F1in_mono23)\n       apply (rule Collect_restrict)\n      apply (rule Collect_restrict)\n     apply (rule CollectI)\n     apply (rule conjI)\n      apply assumption\n     apply (rule conjI)\n      apply assumption\n     apply assumption\n\n    apply (rule trans)\n     apply (rule arg_cong[OF F1.map_cong0])\n       apply (rule refl)\n      apply (erule prop_restrict)\n      apply assumption\n     apply (erule prop_restrict)\n     apply assumption\n\n    apply (rule sym)\n    apply (erule morE1)\n    apply (rule subsetD)\n     apply (rule F1in_mono23)\n      apply (rule Collect_restrict)\n     apply (rule Collect_restrict)\n    apply (rule CollectI)\n    apply (rule conjI)\n     apply assumption\n    apply (rule conjI)\n     apply assumption\n    apply assumption\n\n   apply (rule ballI)\n   apply (rule CollectI)\n   apply (erule CollectE conjE)+\n   apply (rule conjI)\n\n    apply (rule alg_F2set[OF alg_min_alg])\n     apply (erule subset_trans)\n     apply (rule Collect_restrict)\n    apply (erule subset_trans)\n    apply (rule Collect_restrict)\n\n   apply (rule trans)\n    apply (erule morE2)\n    apply (rule subsetD)\n     apply (rule F2in_mono23)\n      apply (rule Collect_restrict)\n     apply (rule Collect_restrict)\n    apply (rule CollectI)\n    apply (rule conjI)\n     apply assumption\n    apply (rule conjI)\n     apply assumption\n    apply assumption\n\n   apply (rule trans)\n    apply (rule arg_cong[OF F2.map_cong0])\n      apply (rule refl)\n     apply (erule prop_restrict)\n     apply assumption\n    apply (erule prop_restrict)\n    apply assumption\n\n   apply (rule sym)\n   apply (erule morE2)\n   apply (rule subsetD)\n    apply (rule F2in_mono23)\n     apply (rule Collect_restrict)\n    apply (rule Collect_restrict)\n   apply (rule CollectI)\n   apply (rule conjI)\n    apply assumption\n   apply (rule conjI)\n    apply assumption\n   apply assumption\n\n\n  apply (erule thin_rl)\n  apply (erule prop_restrict)\n  apply (rule least_min_alg2)\n  apply (tactic \\<open>rtac @{context} (@{thm alg_def} RS iffD2) 1\\<close>)\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (rule CollectI)\n   apply (erule CollectE conjE)+\n   apply (rule conjI)\n\n    apply (rule alg_F1set[OF alg_min_alg])\n     apply (erule subset_trans)\n     apply (rule Collect_restrict)\n    apply (erule subset_trans)\n    apply (rule Collect_restrict)\n\n   apply (rule trans)\n    apply (erule morE1)\n    apply (rule subsetD)\n     apply (rule F1in_mono23)\n      apply (rule Collect_restrict)\n     apply (rule Collect_restrict)\n    apply (rule CollectI)\n    apply (rule conjI)\n     apply assumption\n    apply (rule conjI)\n     apply assumption\n    apply assumption\n\n   apply (rule trans)\n    apply (rule arg_cong[OF F1.map_cong0])\n      apply (rule refl)\n     apply (erule prop_restrict)\n     apply assumption\n    apply (erule prop_restrict)\n    apply assumption\n\n   apply (rule sym)\n   apply (erule morE1)\n   apply (rule subsetD)\n    apply (rule F1in_mono23)\n     apply (rule Collect_restrict)\n    apply (rule Collect_restrict)\n   apply (rule CollectI)\n   apply (rule conjI)\n    apply assumption\n   apply (rule conjI)\n    apply assumption\n   apply assumption\n\n  apply (rule ballI)\n  apply (rule CollectI)\n  apply (erule CollectE conjE)+\n  apply (rule conjI)\n\n   apply (rule alg_F2set[OF alg_min_alg])\n    apply (erule subset_trans)\n    apply (rule Collect_restrict)\n   apply (erule subset_trans)\n   apply (rule Collect_restrict)\n\n  apply (rule trans)\n   apply (erule morE2)\n   apply (rule subsetD)\n    apply (rule F2in_mono23)\n     apply (rule Collect_restrict)\n    apply (rule Collect_restrict)\n   apply (rule CollectI)\n   apply (rule conjI)\n    apply assumption\n   apply (rule conjI)\n    apply assumption\n   apply assumption\n\n  apply (rule trans)\n   apply (rule arg_cong[OF F2.map_cong0])\n     apply (rule refl)\n    apply (erule prop_restrict)\n    apply assumption\n   apply (erule prop_restrict)\n   apply assumption\n\n  apply (rule sym)\n  apply (erule morE2)\n  apply (rule subsetD)\n   apply (rule F2in_mono23)\n    apply (rule Collect_restrict)\n   apply (rule Collect_restrict)\n  apply (rule CollectI)\n  apply (rule conjI)\n   apply assumption\n  apply (rule conjI)\n   apply assumption\n  apply assumption\n  done\n\nabbreviation closed where\n  \"closed dummy phi1 phi2 \\<equiv> ((\\<forall>x \\<in> F1in UNIV (car_init1 dummy) (car_init2 dummy).\n   (\\<forall>z \\<in> F1set2 x. phi1 z) \\<and> (\\<forall>z \\<in> F1set3 x. phi2 z) \\<longrightarrow> phi1 (str_init1 dummy x)) \\<and>\n     (\\<forall>x \\<in> F2in UNIV (car_init1 dummy) (car_init2 dummy).\n   (\\<forall>z \\<in> F2set2 x. phi1 z) \\<and> (\\<forall>z \\<in> F2set3 x. phi2 z) \\<longrightarrow> phi2 (str_init2 dummy x)))\"\n\nlemma init_induct: \"closed dummy phi1 phi2 \\<Longrightarrow>\n  (\\<forall>x \\<in> car_init1 dummy. phi1 x) \\<and> (\\<forall>x \\<in> car_init2 dummy. phi2 x)\"\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (erule prop_restrict)\n   apply (rule least_min_alg1)\n   apply (tactic \\<open>rtac @{context} (@{thm alg_def} RS iffD2) 1\\<close>)\n\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (rule CollectI)\n    apply (erule CollectE conjE)+\n    apply (rule conjI)\n\n     apply (rule alg_F1set[OF alg_min_alg])\n      apply (erule subset_trans)\n      apply (rule Collect_restrict)\n     apply (erule subset_trans)\n     apply (rule Collect_restrict)\n\n    apply (rule mp)\n     apply (erule bspec)\n     apply (rule CollectI)\n     apply (rule conjI)\n      apply assumption\n     apply (rule conjI)\n      apply (erule subset_trans)\n      apply (rule Collect_restrict)\n     apply (erule subset_trans)\n     apply (rule Collect_restrict)\n\n    apply (rule conjI)\n     apply (rule ballI)\n     apply (erule prop_restrict)\n     apply assumption\n    apply (rule ballI)\n    apply (erule prop_restrict)\n    apply assumption\n\n\n   apply (rule ballI)\n   apply (rule CollectI)\n   apply (erule CollectE conjE)+\n   apply (rule conjI)\n\n    apply (rule alg_F2set[OF alg_min_alg])\n     apply (erule subset_trans)\n     apply (rule Collect_restrict)\n    apply (erule subset_trans)\n    apply (rule Collect_restrict)\n\n   apply (rule mp)\n    apply (erule bspec)\n    apply (rule CollectI)\n    apply (rule conjI)\n     apply assumption\n    apply (rule conjI)\n     apply (erule subset_trans)\n     apply (rule Collect_restrict)\n    apply (erule subset_trans)\n    apply (rule Collect_restrict)\n\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (erule prop_restrict)\n    apply assumption\n   apply (rule ballI)\n   apply (erule prop_restrict)\n   apply assumption\n\n  apply (rule ballI)\n  apply (erule prop_restrict)\n  apply (rule least_min_alg2)\n  apply (tactic \\<open>rtac @{context} (@{thm alg_def} RS iffD2) 1\\<close>)\n\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (rule CollectI)\n   apply (erule CollectE conjE)+\n   apply (rule conjI)\n\n    apply (rule alg_F1set[OF alg_min_alg])\n     apply (erule subset_trans)\n     apply (rule Collect_restrict)\n    apply (erule subset_trans)\n    apply (rule Collect_restrict)\n\n   apply (rule mp)\n    apply (erule bspec)\n    apply (rule CollectI)\n    apply (rule conjI)\n     apply assumption\n    apply (rule conjI)\n     apply (erule subset_trans)\n     apply (rule Collect_restrict)\n    apply (erule subset_trans)\n    apply (rule Collect_restrict)\n\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (erule prop_restrict)\n    apply assumption\n   apply (rule ballI)\n   apply (erule prop_restrict)\n   apply assumption\n\n\n  apply (rule ballI)\n  apply (rule CollectI)\n  apply (erule CollectE conjE)+\n  apply (rule conjI)\n\n   apply (rule alg_F2set[OF alg_min_alg])\n    apply (erule subset_trans)\n    apply (rule Collect_restrict)\n   apply (erule subset_trans)\n   apply (rule Collect_restrict)\n\n  apply (rule mp)\n   apply (erule bspec)\n   apply (rule CollectI)\n   apply (rule conjI)\n    apply assumption\n   apply (rule conjI)\n    apply (erule subset_trans)\n    apply (rule Collect_restrict)\n   apply (erule subset_trans)\n   apply (rule Collect_restrict)\n\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (erule prop_restrict)\n   apply assumption\n  apply (rule ballI)\n  apply (erule prop_restrict)\n  apply assumption\n  done\n\n\nsubsection \\<open>The datatype\\<close>\n\ntypedef (overloaded) 'a1 IF1 = \"car_init1 (undefined :: 'a1)\"\n  apply (rule iffD2)\n   apply (rule ex_in_conv)\n  apply (rule conjunct1)\n  apply (rule alg_not_empty)\n  apply (rule alg_min_alg)\n  done\n\ntypedef (overloaded) 'a1 IF2 = \"car_init2 (undefined :: 'a1)\"\n  apply (rule iffD2)\n   apply (rule ex_in_conv)\n  apply (rule conjunct2)\n  apply (rule alg_not_empty)\n  apply (rule alg_min_alg)\n  done\n\ndefinition ctor1 where \"ctor1 = Abs_IF1 o str_init1 undefined o F1map id Rep_IF1 Rep_IF2\"\ndefinition ctor2 where \"ctor2 = Abs_IF2 o str_init2 undefined o F2map id Rep_IF1 Rep_IF2\"\n\nlemma mor_Rep_IF:\n  \"mor (UNIV :: 'a IF1 set) (UNIV :: 'a IF2 set) ctor1 ctor2\n     (car_init1 undefined) (car_init2 undefined) (str_init1 undefined) (str_init2 undefined) Rep_IF1 Rep_IF2\"\n  unfolding mor_def ctor1_def ctor2_def o_apply\n  apply (rule conjI)\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (rule Rep_IF1)\n   apply (rule ballI)\n   apply (rule Rep_IF2)\n\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (rule Abs_IF1_inverse)\n   apply (rule alg_F1set[OF alg_min_alg])\n    apply (rule ord_eq_le_trans[OF F1.set_map(2)])\n    apply (rule image_subsetI)\n    apply (rule Rep_IF1)\n   apply (rule ord_eq_le_trans[OF F1.set_map(3)])\n   apply (rule image_subsetI)\n   apply (rule Rep_IF2)\n\n  apply (rule ballI)\n  apply (rule Abs_IF2_inverse)\n  apply (rule alg_F2set[OF alg_min_alg])\n   apply (rule ord_eq_le_trans[OF F2.set_map(2)])\n   apply (rule image_subsetI)\n   apply (rule Rep_IF1)\n  apply (rule ord_eq_le_trans[OF F2.set_map(3)])\n  apply (rule image_subsetI)\n  apply (rule Rep_IF2)\n  done\n\nlemma mor_Abs_IF:\n  \"mor (car_init1 undefined) (car_init2 undefined)\n    (str_init1 undefined) (str_init2 undefined) UNIV UNIV ctor1 ctor2 Abs_IF1 Abs_IF2\"\n  unfolding mor_def ctor1_def ctor2_def o_apply\n  apply (rule conjI)\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (rule UNIV_I)\n   apply (rule ballI)\n   apply (rule UNIV_I)\n\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (erule CollectE conjE)+\n   apply (rule sym[OF arg_cong[OF trans[OF F1map_comp_id F1map_congL]]])\n    apply (rule ballI[OF trans[OF o_apply]])\n    apply (erule Abs_IF1_inverse[OF subsetD])\n    apply assumption\n   apply (rule ballI[OF trans[OF o_apply]])\n   apply (erule Abs_IF2_inverse[OF subsetD])\n   apply assumption\n\n  apply (rule ballI)\n  apply (erule CollectE conjE)+\n  apply (rule sym[OF arg_cong[OF trans[OF F2map_comp_id F2map_congL]]])\n   apply (rule ballI[OF trans[OF o_apply]])\n   apply (erule Abs_IF1_inverse[OF subsetD])\n   apply assumption\n  apply (rule ballI[OF trans[OF o_apply]])\n  apply (erule Abs_IF2_inverse[OF subsetD])\n  apply assumption\n  done\n\nlemma copy:\n  \"\\<lbrakk>alg B1 B2 s1 s2; bij_betw f B1' B1; bij_betw g B2' B2\\<rbrakk> \\<Longrightarrow>\n   \\<exists>f' g'. alg B1' B2' f' g' \\<and> mor B1' B2' f' g' B1 B2 s1 s2 f g\"\n  apply (rule exI)+\n  apply (rule conjI)\n   apply (tactic \\<open>rtac @{context} (@{thm alg_def} RS iffD2) 1\\<close>)\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (erule CollectE conjE)+\n    apply (rule subsetD)\n     apply (rule equalityD1)\n     apply (erule bij_betw_imp_surj_on[OF bij_betw_the_inv_into])\n    apply (rule imageI)\n    apply (erule alg_F1set)\n     apply (rule ord_eq_le_trans)\n      apply (rule F1.set_map(2))\n     apply (rule subset_trans)\n      apply (erule image_mono)\n     apply (rule equalityD1)\n     apply (erule bij_betw_imp_surj_on)\n    apply (rule ord_eq_le_trans)\n     apply (rule F1.set_map(3))\n    apply (rule subset_trans)\n     apply (erule image_mono)\n    apply (rule equalityD1)\n    apply (erule bij_betw_imp_surj_on)\n\n   apply (rule ballI)\n   apply (erule CollectE conjE)+\n   apply (rule subsetD)\n    apply (rule equalityD1)\n    apply (erule bij_betw_imp_surj_on[OF bij_betw_the_inv_into])\n   apply (rule imageI)\n   apply (erule alg_F2set)\n    apply (rule ord_eq_le_trans)\n     apply (rule F2.set_map(2))\n    apply (rule subset_trans)\n     apply (erule image_mono)\n    apply (rule equalityD1)\n    apply (erule bij_betw_imp_surj_on)\n   apply (rule ord_eq_le_trans)\n    apply (rule F2.set_map(3))\n   apply (rule subset_trans)\n    apply (erule image_mono)\n   apply (rule equalityD1)\n   apply (erule bij_betw_imp_surj_on)\n\n  apply (tactic \\<open>rtac @{context} (@{thm mor_def} RS iffD2) 1\\<close>)\n  apply (rule conjI)\n   apply (rule conjI)\n    apply (erule bij_betwE)\n   apply (erule bij_betwE)\n\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (erule CollectE conjE)+\n   apply (erule f_the_inv_into_f_bij_betw)\n   apply (erule alg_F1set)\n    apply (rule ord_eq_le_trans)\n     apply (rule F1.set_map(2))\n    apply (rule subset_trans)\n     apply (erule image_mono)\n    apply (rule equalityD1)\n    apply (erule bij_betw_imp_surj_on)\n   apply (rule ord_eq_le_trans)\n    apply (rule F1.set_map(3))\n   apply (rule subset_trans)\n    apply (erule image_mono)\n   apply (rule equalityD1)\n   apply (erule bij_betw_imp_surj_on)\n\n  apply (rule ballI)\n  apply (erule CollectE conjE)+\n  apply (erule f_the_inv_into_f_bij_betw)\n  apply (erule alg_F2set)\n   apply (rule ord_eq_le_trans)\n    apply (rule F2.set_map(2))\n   apply (rule subset_trans)\n    apply (erule image_mono)\n   apply (rule equalityD1)\n   apply (erule bij_betw_imp_surj_on)\n  apply (rule ord_eq_le_trans)\n   apply (rule F2.set_map(3))\n  apply (rule subset_trans)\n   apply (erule image_mono)\n  apply (rule equalityD1)\n  apply (erule bij_betw_imp_surj_on)\n  done\n\nlemma init_ex_mor:\n  \"\\<exists>f g. mor UNIV UNIV ctor1 ctor2 UNIV UNIV s1 s2 f g\"\n  apply (insert ex_bij_betw[OF card_of_min_alg1, of s1 s2]\n      ex_bij_betw[OF card_of_min_alg2, of s1 s2])\n  apply (erule exE)+\n  apply (rule rev_mp)\n   apply (rule copy[OF alg_min_alg])\n    apply assumption\n   apply assumption\n  apply (rule impI)\n  apply (erule exE conjE)+\n\n  apply (rule exI)+\n  apply (rule mor_comp)\n   apply (rule mor_Rep_IF)\n  apply (rule mor_select)\n   apply (rule CollectI)\n   apply (rule exI)+\n   apply (rule conjI)\n    apply (rule refl)\n   apply assumption\n  unfolding fst_conv snd_conv Abs_IIT_inverse[OF UNIV_I]\n  apply (erule mor_comp)\n  apply (rule mor_incl)\n   apply (rule subset_UNIV)\n  apply (rule subset_UNIV)\n  done\n\ntext \\<open>Iteration\\<close>\n\nabbreviation fold where\n  \"fold s1 s2 \\<equiv> (SOME f. mor UNIV UNIV ctor1 ctor2 UNIV UNIV s1 s2 (fst f) (snd f))\"\n\ndefinition fold1 where \"fold1 s1 s2 = fst (fold s1 s2)\"\ndefinition fold2 where \"fold2 s1 s2 = snd (fold s1 s2)\"\n\nlemma mor_fold:\n  \"mor UNIV UNIV ctor1 ctor2 UNIV UNIV s1 s2 (fold1 s1 s2) (fold2 s1 s2)\"\n  unfolding fold1_def fold2_def\n  apply (rule rev_mp)\n   apply (rule init_ex_mor)\n  apply (rule impI)\n  apply (erule exE)\n  apply (erule exE)\n  apply (rule someI[of \"%(f :: ('a IF1 \\<Rightarrow> 'b) \\<times> ('a IF2 \\<Rightarrow> 'c)).\n  mor UNIV UNIV ctor1 ctor2 UNIV UNIV s1 s2 (fst f) (snd f)\"])\n  apply (erule mor_cong[OF fst_conv snd_conv])\n  done\n\nML \\<open>\n  val fold1 = rule_by_tactic @{context}\n    (rtac @{context} CollectI 1 THEN BNF_Util.CONJ_WRAP (K (rtac @{context} @{thm subset_UNIV} 1)) (1 upto 3))\n    @{thm morE1[OF mor_fold]}\n\n  val fold2 = rule_by_tactic @{context}\n    (rtac @{context} CollectI 1 THEN BNF_Util.CONJ_WRAP (K (rtac @{context} @{thm subset_UNIV} 1)) (1 upto 3))\n    @{thm morE2[OF mor_fold]}\n\\<close>\n\ntheorem fold1:\n  \"(fold1 s1 s2) (ctor1 x) = s1 (F1map id (fold1 s1 s2) (fold2 s1 s2) x)\"\n  apply (rule morE1)\n   apply (rule mor_fold)\n  apply (rule CollectI)\n  apply (rule conjI)\n   apply (rule subset_UNIV)\n  apply (rule conjI)\n   apply (rule subset_UNIV)\n  apply (rule subset_UNIV)\n  done\n\ntheorem fold2:\n  \"(fold2 s1 s2) (ctor2 x) = s2 (F2map id (fold1 s1 s2) (fold2 s1 s2) x)\"\n  apply (rule morE2)\n   apply (rule mor_fold)\n  apply (rule CollectI)\n  apply (rule conjI)\n   apply (rule subset_UNIV)\n  apply (rule conjI)\n   apply (rule subset_UNIV)\n  apply (rule subset_UNIV)\n  done\n\nlemma mor_UNIV: \"mor UNIV UNIV s1 s2 UNIV UNIV s1' s2' f g \\<longleftrightarrow>\n   f o s1 = s1' o F1map id f g \\<and> g o s2 = s2' o F2map id f g\"\n  apply (rule iffI)\n   apply (rule conjI)\n    apply (rule ext)\n    apply (rule trans)\n     apply (rule o_apply)\n    apply (rule trans)\n     apply (erule morE1)\n     apply (rule CollectI)\n     apply (rule conjI)\n      apply (rule subset_UNIV)\n     apply (rule conjI)\n      apply (rule subset_UNIV)\n     apply (rule subset_UNIV)\n    apply (rule sym[OF o_apply])\n\n   apply (rule ext)\n   apply (rule trans)\n    apply (rule o_apply)\n   apply (rule trans)\n    apply (erule morE2)\n    apply (rule CollectI)\n    apply (rule conjI)\n     apply (rule subset_UNIV)\n    apply (rule conjI)\n     apply (rule subset_UNIV)\n    apply (rule subset_UNIV)\n   apply (rule sym[OF o_apply])\n\n  apply (tactic \\<open>rtac @{context} (@{thm mor_def} RS iffD2) 1\\<close>)\n  apply (rule conjI)\n   apply (rule conjI)\n    apply (rule ballI)\n    apply (rule UNIV_I)\n   apply (rule ballI)\n   apply (rule UNIV_I)\n  apply (erule conjE)\n  apply (drule iffD1[OF fun_eq_iff])\n  apply (drule iffD1[OF fun_eq_iff])\n  apply (rule conjI)\n   apply (rule ballI)\n   apply (erule allE)+\n   apply (rule trans)\n    apply (erule trans[OF sym[OF o_apply]])\n   apply (rule o_apply)\n  apply (rule ballI)\n  apply (erule allE)+\n  apply (rule trans)\n   apply (erule trans[OF sym[OF o_apply]])\n  apply (rule o_apply)\n  done\n\nlemma fold_unique_mor: \"mor UNIV UNIV ctor1 ctor2 UNIV UNIV s1 s2 f g \\<Longrightarrow>\n  f = fold1 s1 s2 \\<and> g = fold2 s1 s2\"\n  apply (rule conjI)\n   apply (rule surj_fun_eq)\n    apply (rule type_definition.Abs_image[OF type_definition_IF1])\n   apply (rule ballI)\n   apply (rule conjunct1)\n   apply (rule init_unique_mor)\n      apply assumption\n     apply (rule Rep_IF2)\n    apply (rule mor_comp)\n     apply (rule mor_Abs_IF)\n    apply assumption\n   apply (rule mor_comp)\n    apply (rule mor_Abs_IF)\n   apply (rule mor_fold)\n\n  apply (rule surj_fun_eq)\n   apply (rule type_definition.Abs_image[OF type_definition_IF2])\n  apply (rule ballI)\n  apply (rule conjunct2)\n  apply (rule init_unique_mor)\n     apply (rule Rep_IF1)\n    apply assumption\n   apply (rule mor_comp)\n    apply (rule mor_Abs_IF)\n   apply assumption\n  apply (rule mor_comp)\n   apply (rule mor_Abs_IF)\n  apply (rule mor_fold)\n  done\n\nlemmas fold_unique = fold_unique_mor[OF iffD2[OF mor_UNIV], OF conjI]\n\nlemmas fold1_ctor = sym[OF conjunct1[OF fold_unique_mor[OF mor_incl[OF subset_UNIV subset_UNIV]]]]\nlemmas fold2_ctor = sym[OF conjunct2[OF fold_unique_mor[OF mor_incl[OF subset_UNIV subset_UNIV]]]]\n\ntext \\<open>Case distinction\\<close>\n\nlemmas ctor1_o_fold1 =\n  trans[OF conjunct1[OF fold_unique_mor[OF mor_comp[OF mor_fold mor_str]]] fold1_ctor]\nlemmas ctor2_o_fold2 =\n  trans[OF conjunct2[OF fold_unique_mor[OF mor_comp[OF mor_fold mor_str]]] fold2_ctor]\n\n(* unfold *)\ndefinition \"dtor1 = fold1 (F1map id ctor1 ctor2) (F2map id ctor1 ctor2)\"\ndefinition \"dtor2 = fold2 (F1map id ctor1 ctor2) (F2map id ctor1 ctor2)\"\n\nML \\<open>Local_Defs.fold @{context} @{thms dtor1_def} @{thm ctor1_o_fold1}\\<close>\nML \\<open>Local_Defs.fold @{context} @{thms dtor2_def} @{thm ctor2_o_fold2}\\<close>\n\nlemma ctor1_o_dtor1: \"ctor1 o dtor1 = id\"\n  unfolding dtor1_def\n  apply (rule ctor1_o_fold1)\n  done\n\nlemma ctor2_o_dtor2: \"ctor2 o dtor2 = id\"\n  unfolding dtor2_def\n  apply (rule ctor2_o_fold2)\n  done\nlemma dtor1_o_ctor1: \"dtor1 o ctor1 = id\"\n  apply (rule ext)\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF fun_cong[OF dtor1_def]])\n  apply (rule trans[OF fold1])\n  apply (rule trans[OF F1map_comp_id])\n  apply (rule trans[OF F1map_congL])\n    apply (rule ballI)\n    apply (rule trans[OF fun_cong[OF ctor1_o_fold1] id_apply])\n   apply (rule ballI)\n   apply (rule trans[OF fun_cong[OF ctor2_o_fold2] id_apply])\n  apply (rule sym[OF id_apply])\n  done\n\nlemma dtor2_o_ctor2: \"dtor2 o ctor2 = id\"\n  apply (rule ext)\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF fun_cong[OF dtor2_def]])\n  apply (rule trans[OF fold2])\n  apply (rule trans[OF F2map_comp_id])\n  apply (rule trans[OF F2map_congL])\n    apply (rule ballI)\n    apply (rule trans[OF fun_cong[OF ctor1_o_fold1] id_apply])\n   apply (rule ballI)\n   apply (rule trans[OF fun_cong[OF ctor2_o_fold2] id_apply])\n  apply (rule sym[OF id_apply])\n  done\n\nlemmas dtor1_ctor1 = pointfree_idE[OF dtor1_o_ctor1]\nlemmas dtor2_ctor2 = pointfree_idE[OF dtor2_o_ctor2]\nlemmas ctor1_dtor1 = pointfree_idE[OF ctor1_o_dtor1]\nlemmas ctor2_dtor2 = pointfree_idE[OF ctor2_o_dtor2]\n\nlemmas bij_dtor1 = o_bij[OF ctor1_o_dtor1 dtor1_o_ctor1]\nlemmas inj_dtor1 = bij_is_inj[OF bij_dtor1]\nlemmas surj_dtor1 = bij_is_surj[OF bij_dtor1]\nlemmas dtor1_nchotomy = surjD[OF surj_dtor1]\nlemmas dtor1_diff = inj_eq[OF inj_dtor1]\nlemmas dtor1_cases = exE[OF dtor1_nchotomy]\nlemmas bij_dtor2 = o_bij[OF ctor2_o_dtor2 dtor2_o_ctor2]\nlemmas inj_dtor2 = bij_is_inj[OF bij_dtor2]\nlemmas surj_dtor2 = bij_is_surj[OF bij_dtor2]\nlemmas dtor2_nchotomy = surjD[OF surj_dtor2]\nlemmas dtor2_diff = inj_eq[OF inj_dtor2]\nlemmas dtor2_cases = exE[OF dtor2_nchotomy]\n\nlemmas bij_ctor1 = o_bij[OF dtor1_o_ctor1 ctor1_o_dtor1]\nlemmas inj_ctor1 = bij_is_inj[OF bij_ctor1]\nlemmas surj_ctor1 = bij_is_surj[OF bij_ctor1]\nlemmas ctor1_nchotomy = surjD[OF surj_ctor1]\nlemmas ctor1_diff = inj_eq[OF inj_ctor1]\nlemmas ctor1_cases = exE[OF ctor1_nchotomy]\nlemmas bij_ctor2 = o_bij[OF dtor2_o_ctor2 ctor2_o_dtor2]\nlemmas inj_ctor2 = bij_is_inj[OF bij_ctor2]\nlemmas surj_ctor2 = bij_is_surj[OF bij_ctor2]\nlemmas ctor2_nchotomy = surjD[OF surj_ctor2]\nlemmas ctor2_diff = inj_eq[OF inj_ctor2]\nlemmas ctor2_cases = exE[OF ctor2_nchotomy]\n\ntext \\<open>Primitive recursion\\<close>\n\ndefinition rec1 where\n  \"rec1 s1 s2 = snd o fold1 (<ctor1 o F1map id fst fst, s1>) (<ctor2 o F2map id fst fst, s2>)\"\ndefinition rec2 where\n  \"rec2 s1 s2 = snd o fold2 (<ctor1 o F1map id fst fst, s1>) (<ctor2 o F2map id fst fst, s2>)\"\n\nlemma fold1_o_ctor1: \"fold1 s1 s2 \\<circ> ctor1 = s1 \\<circ> F1map id (fold1 s1 s2) (fold2 s1 s2)\"\n  by (tactic \\<open>rtac @{context} (BNF_Tactics.mk_pointfree2 @{context} @{thm fold1}) 1\\<close>)\nlemma fold2_o_ctor2: \"fold2 s1 s2 \\<circ> ctor2 = s2 \\<circ> F2map id (fold1 s1 s2) (fold2 s1 s2)\"\n  by (tactic \\<open>rtac @{context} (BNF_Tactics.mk_pointfree2 @{context} @{thm fold2}) 1\\<close>)\n\nlemmas fst_rec1_pair =\n  trans[OF conjunct1[OF fold_unique[OF\n        trans[OF o_assoc[symmetric] trans[OF arg_cong2[of _ _ _ _ \"(o)\", OF refl\n              trans[OF fold1_o_ctor1 convol_o]]], OF trans[OF fst_convol]]\n        trans[OF o_assoc[symmetric] trans[OF arg_cong2[of _ _ _ _ \"(o)\", OF refl\n              trans[OF fold2_o_ctor2 convol_o]]], OF trans[OF fst_convol]]]]\n    fold1_ctor, unfolded F1.map_comp0[of id, unfolded id_o] F2.map_comp0[of id, unfolded id_o] o_assoc,\n    OF refl refl]\nlemmas fst_rec2_pair =\n  trans[OF conjunct2[OF fold_unique[OF\n        trans[OF o_assoc[symmetric] trans[OF arg_cong2[of _ _ _ _ \"(o)\", OF refl\n              trans[OF fold1_o_ctor1 convol_o]]], OF trans[OF fst_convol]]\n        trans[OF o_assoc[symmetric] trans[OF arg_cong2[of _ _ _ _ \"(o)\", OF refl\n              trans[OF fold2_o_ctor2 convol_o]]], OF trans[OF fst_convol]]]]\n    fold2_ctor, unfolded F1.map_comp0[of id, unfolded id_o] F2.map_comp0[of id, unfolded id_o] o_assoc,\n    OF refl refl]\n\ntheorem rec1: \"rec1 s1 s2 (ctor1 x) = s1 (F1map id (<id, rec1 s1 s2>) (<id, rec2 s1 s2>) x)\"\n  unfolding rec1_def rec2_def o_apply fold1 snd_convol'\n    convol_expand_snd[OF fst_rec1_pair] convol_expand_snd[OF fst_rec2_pair] ..\n\ntheorem rec2: \"rec2 s1 s2 (ctor2 x) = s2 (F2map id (<id, rec1 s1 s2>) (<id, rec2 s1 s2>) x)\"\n  unfolding rec1_def rec2_def o_apply fold2 snd_convol'\n    convol_expand_snd[OF fst_rec1_pair] convol_expand_snd[OF fst_rec2_pair] ..\n\nlemma rec_unique:\n  \"f \\<circ> ctor1 = s1 \\<circ> F1map id <id , f> <id , g> \\<Longrightarrow>\n    g \\<circ> ctor2 = s2 \\<circ> F2map id <id , f> <id , g> \\<Longrightarrow> f = rec1 s1 s2 \\<and> g = rec2 s1 s2\"\n  unfolding rec1_def rec2_def convol_expand_snd'[OF fst_rec1_pair] convol_expand_snd'[OF fst_rec2_pair]\n  apply (rule fold_unique)\n   apply (unfold convol_o id_o o_id F1.map_comp0[symmetric] F2.map_comp0[symmetric]\n      F1.map_id0 F2.map_id0 o_assoc[symmetric] fst_convol)\n   apply (erule arg_cong2[of _ _ _ _ BNF_Def.convol, OF refl])\n  apply (erule arg_cong2[of _ _ _ _ BNF_Def.convol, OF refl])\n  done\n\n\ntext \\<open>Induction\\<close>\n\ntheorem ctor_induct:\n  \"\\<lbrakk>\\<And>x. (\\<And>a. a \\<in> F1set2 x \\<Longrightarrow> phi1 a) \\<Longrightarrow> (\\<And>a. a \\<in> F1set3 x \\<Longrightarrow> phi2 a) \\<Longrightarrow> phi1 (ctor1 x);\n  \\<And>x. (\\<And>a. a \\<in> F2set2 x \\<Longrightarrow> phi1 a) \\<Longrightarrow> (\\<And>a. a \\<in> F2set3 x \\<Longrightarrow> phi2 a) \\<Longrightarrow> phi2 (ctor2 x)\\<rbrakk> \\<Longrightarrow>\n  phi1 a \\<and> phi2 b\"\n  apply (rule mp)\n\n   apply (rule impI)\n   apply (erule conjE)\n   apply (rule conjI)\n    apply (rule iffD1[OF arg_cong[OF Rep_IF1_inverse]])\n    apply (erule bspec[OF _ Rep_IF1])\n   apply (rule iffD1[OF arg_cong[OF Rep_IF2_inverse]])\n   apply (erule bspec[OF _ Rep_IF2])\n  apply (rule init_induct)\n\n  apply (rule conjI)\n\n   apply (drule asm_rl)\n   apply (erule thin_rl)\n   apply (rule ballI)\n   apply (rule impI)\n   apply (rule iffD2[OF arg_cong[OF morE1[OF mor_Abs_IF]]])\n    apply assumption\n   apply (erule CollectE conjE)+\n   apply (drule meta_spec)\n   apply (drule meta_mp)\n    apply (rule iffD1[OF arg_cong[OF Rep_IF1_inverse]])\n    apply (erule bspec)\n    apply (drule rev_subsetD)\n     apply (rule equalityD1)\n     apply (rule F1.set_map(2))\n    apply (erule imageE)\n    apply (tactic \\<open>hyp_subst_tac @{context} 1\\<close>)\n    apply (rule ssubst_mem[OF Abs_IF1_inverse])\n     apply (erule subsetD)\n     apply assumption\n    apply assumption\n\n   apply (drule meta_mp)\n    apply (rule iffD1[OF arg_cong[OF Rep_IF2_inverse]])\n    apply (erule bspec)\n    apply (drule rev_subsetD)\n     apply (rule equalityD1)\n     apply (rule F1.set_map(3))\n    apply (erule imageE)\n    apply (tactic \\<open>hyp_subst_tac @{context} 1\\<close>)\n    apply (rule ssubst_mem[OF Abs_IF2_inverse])\n     apply (erule subsetD)\n     apply assumption\n    apply assumption\n\n   apply assumption\n\n  apply (erule thin_rl)\n  apply (drule asm_rl)\n  apply (rule ballI)\n  apply (rule impI)\n  apply (rule iffD2[OF arg_cong[OF morE2[OF mor_Abs_IF]]])\n   apply assumption\n  apply (erule CollectE conjE)+\n  apply (drule meta_spec)\n  apply (drule meta_mp)\n   apply (rule iffD1[OF arg_cong[OF Rep_IF1_inverse]])\n   apply (erule bspec)\n   apply (drule rev_subsetD)\n    apply (rule equalityD1)\n    apply (rule F2.set_map(2))\n   apply (erule imageE)\n   apply (tactic \\<open>hyp_subst_tac @{context} 1\\<close>)\n   apply (rule ssubst_mem[OF Abs_IF1_inverse])\n    apply (erule subsetD)\n    apply assumption\n   apply assumption\n\n  apply (drule meta_mp)\n   apply (rule iffD1[OF arg_cong[OF Rep_IF2_inverse]])\n   apply (erule bspec)\n   apply (drule rev_subsetD)\n    apply (rule equalityD1)\n    apply (rule F2.set_map(3))\n   apply (erule imageE)\n   apply (tactic \\<open>hyp_subst_tac @{context} 1\\<close>)\n   apply (rule ssubst_mem[OF Abs_IF2_inverse])\n    apply (erule subsetD)\n    apply assumption\n   apply assumption\n\n  apply assumption\n  done\n\ntheorem ctor_induct2:\n  \"\\<lbrakk>\\<And>x y. (\\<And>a b. a \\<in> F1set2 x \\<Longrightarrow> b \\<in> F1set2 y \\<Longrightarrow> phi1 a b) \\<Longrightarrow>\n      (\\<And>a b. a \\<in> F1set3 x \\<Longrightarrow> b \\<in> F1set3 y \\<Longrightarrow> phi2 a b) \\<Longrightarrow> phi1 (ctor1 x) (ctor1 y);\n    \\<And>x y. (\\<And>a b. a \\<in> F2set2 x \\<Longrightarrow> b \\<in> F2set2 y \\<Longrightarrow> phi1 a b) \\<Longrightarrow>\n      (\\<And>a b. a \\<in> F2set3 x \\<Longrightarrow> b \\<in> F2set3 y \\<Longrightarrow> phi2 a b) \\<Longrightarrow> phi2 (ctor2 x) (ctor2 y)\\<rbrakk> \\<Longrightarrow>\n   phi1 a1 b1 \\<and> phi2 a2 b2\"\n  apply (rule rev_mp)\n   apply (rule ctor_induct[of \"%a1. (\\<forall>x. phi1 a1 x)\" \"%a2. (\\<forall>y. phi2 a2 y)\" a1 a2])\n    apply (rule allI[OF conjunct1[OF ctor_induct[OF asm_rl TrueI]]])\n    apply (drule meta_spec2)\n    apply (erule thin_rl)\n    apply (tactic \\<open>(dtac @{context} @{thm meta_mp} THEN_ALL_NEW Goal.norm_hhf_tac @{context}) 1\\<close>)\n     apply (drule meta_spec)+\n     apply (erule meta_mp[OF spec])\n     apply assumption\n    apply (drule meta_mp)\n     apply (drule meta_spec)+\n     apply (erule meta_mp[OF spec])\n     apply assumption\n    apply assumption\n\n   apply (rule allI[OF conjunct2[OF ctor_induct[OF TrueI asm_rl]]])\n   apply (erule thin_rl)\n   apply (drule meta_spec2)\n   apply (drule meta_mp)\n    apply (drule meta_spec)+\n    apply (erule meta_mp[OF spec])\n    apply assumption\n   apply (erule meta_mp)\n   apply (drule meta_spec)+\n   apply (erule meta_mp[OF spec])\n   apply assumption\n\n  apply (rule impI)\n  apply (erule conjE allE)+\n  apply (rule conjI)\n   apply assumption\n  apply assumption\n  done\n\n\nsubsection \\<open>The Result as an BNF\\<close>\n\ntext\\<open>The map operator\\<close>\n\nabbreviation IF1map where \"IF1map f \\<equiv> fold1 (ctor1 o (F1map f id id)) (ctor2 o (F2map f id id))\"\nabbreviation IF2map where \"IF2map f \\<equiv> fold2 (ctor1 o (F1map f id id)) (ctor2 o (F2map f id id))\"\n\ntheorem IF1map:\n  \"(IF1map f) o ctor1 = ctor1 o (F1map f (IF1map f) (IF2map f))\"\n  apply (rule ext)\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF fold1])\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF arg_cong[OF F1map_comp_id]])\n  apply (rule trans[OF arg_cong[OF F1.map_cong0]])\n     apply (rule refl)\n    apply (rule trans[OF o_apply])\n    apply (rule id_apply)\n   apply (rule trans[OF o_apply])\n   apply (rule id_apply)\n  apply (rule sym[OF o_apply])\n  done\n\ntheorem IF2map:\n  \"(IF2map f) o ctor2 = ctor2 o (F2map f (IF1map f) (IF2map f))\"\n  apply (rule ext)\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF fold2])\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF arg_cong[OF F2map_comp_id]])\n  apply (rule trans[OF arg_cong[OF F2.map_cong0]])\n     apply (rule refl)\n    apply (rule trans[OF o_apply])\n    apply (rule id_apply)\n   apply (rule trans[OF o_apply])\n   apply (rule id_apply)\n  apply (rule sym[OF o_apply])\n  done\n\nlemmas IF1map_simps = o_eq_dest[OF IF1map]\nlemmas IF2map_simps = o_eq_dest[OF IF2map]\n\nlemma IFmap_unique:\n  \"\\<lbrakk>u o ctor1 = ctor1 o F1map f u v; v o ctor2 = ctor2 o F2map f u v\\<rbrakk> \\<Longrightarrow>\n    u = IF1map f \\<and> v = IF2map f\"\n  apply (rule fold_unique)\n  unfolding o_assoc[symmetric] F1.map_comp0[symmetric] F2.map_comp0[symmetric] id_o o_id\n   apply assumption\n  apply assumption\n  done\n\ntheorem IF1map_id: \"IF1map id = id\"\n  apply (rule sym)\n  apply (rule conjunct1[OF IFmap_unique])\n   apply (rule trans[OF id_o])\n   apply (rule trans[OF sym[OF o_id]])\n   apply (rule arg_cong[OF sym[OF F1.map_id0]])\n  apply (rule trans[OF id_o])\n  apply (rule trans[OF sym[OF o_id]])\n  apply (rule arg_cong[OF sym[OF F2.map_id0]])\n  done\n\ntheorem IF2map_id: \"IF2map id = id\"\n  apply (rule sym)\n  apply (rule conjunct2[OF IFmap_unique])\n   apply (rule trans[OF id_o])\n   apply (rule trans[OF sym[OF o_id]])\n   apply (rule arg_cong[OF sym[OF F1.map_id0]])\n  apply (rule trans[OF id_o])\n  apply (rule trans[OF sym[OF o_id]])\n  apply (rule arg_cong[OF sym[OF F2.map_id0]])\n  done\n\ntheorem IF1map_comp: \"IF1map (g o f) = IF1map g o IF1map f\"\n  apply (rule sym)\n  apply (rule conjunct1[OF IFmap_unique])\n   apply (rule ext)\n   apply (rule trans[OF o_apply])\n   apply (rule trans[OF o_apply])\n   apply (rule trans[OF arg_cong[OF IF1map_simps]])\n   apply (rule trans[OF IF1map_simps])\n   apply (rule trans[OF arg_cong[OF F1.map_comp]])\n   apply (rule sym[OF o_apply])\n  apply (rule ext)\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF arg_cong[OF IF2map_simps]])\n  apply (rule trans[OF IF2map_simps])\n  apply (rule trans[OF arg_cong[OF F2.map_comp]])\n  apply (rule sym[OF o_apply])\n  done\n\ntheorem IF2map_comp: \"IF2map (g o f) = IF2map g o IF2map f\"\n  apply (rule sym)\n  apply (tactic \\<open>rtac @{context} (Thm.permute_prems 0 1 @{thm conjunct2[OF IFmap_unique]}) 1\\<close>)\n   apply (rule ext)\n   apply (rule trans[OF o_apply])\n   apply (rule trans[OF o_apply])\n   apply (rule trans[OF arg_cong[OF IF2map_simps]])\n   apply (rule trans[OF IF2map_simps])\n   apply (rule trans[OF arg_cong[OF F2.map_comp]])\n   apply (rule sym[OF o_apply])\n  apply (rule ext)\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF arg_cong[OF IF1map_simps]])\n  apply (rule trans[OF IF1map_simps])\n  apply (rule trans[OF arg_cong[OF F1.map_comp]])\n  apply (rule sym[OF o_apply])\n  done\n\n\ntext\\<open>The bound\\<close>\n\nabbreviation IFbd where \"IFbd \\<equiv> bd_F1 +c bd_F2\"\n\ntheorem IFbd_card_order: \"card_order IFbd\"\n  apply (rule card_order_csum)\n   apply (rule F1.bd_card_order)\n  apply (rule F2.bd_card_order)\n  done\n\nlemma IFbd_Cinfinite: \"Cinfinite IFbd\"\n  apply (rule Cinfinite_csum1)\n  apply (rule F1.bd_Cinfinite)\n  done\n\nlemmas IFbd_cinfinite = conjunct1[OF IFbd_Cinfinite]\n\n\ntext \\<open>The set operator\\<close>\n\n(* \"IFcol\" stands for \"collect\"  *)\n\nabbreviation IF1col where \"IF1col \\<equiv> (\\<lambda>X. F1set1 X \\<union> (\\<Union>(F1set2 X) \\<union> \\<Union>(F1set3 X)))\"\nabbreviation IF2col where \"IF2col \\<equiv> (\\<lambda>X. F2set1 X \\<union> (\\<Union>(F2set2 X) \\<union> \\<Union>(F2set3 X)))\"\n\nabbreviation IF1set where \"IF1set \\<equiv> fold1 IF1col IF2col\"\nabbreviation IF2set where \"IF2set \\<equiv> fold2 IF1col IF2col\"\n\nabbreviation IF1in where \"IF1in A \\<equiv> {x. IF1set x \\<subseteq> A}\"\nabbreviation IF2in where \"IF2in A \\<equiv> {x. IF2set x \\<subseteq> A}\"\n\nlemma IF1set: \"IF1set o ctor1 = IF1col o (F1map id IF1set IF2set)\"\n  apply (rule ext)\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF fold1])\n  apply (rule sym[OF o_apply])\n  done\n\nlemma IF2set: \"IF2set o ctor2 = IF2col o (F2map id IF1set IF2set)\"\n  apply (rule ext)\n  apply (rule trans[OF o_apply])\n  apply (rule trans[OF fold2])\n  apply (rule sym[OF o_apply])\n  done\n\ntheorem IF1set_simps:\n  \"IF1set (ctor1 x) = F1set1 x \\<union> ((\\<Union>a \\<in> F1set2 x. IF1set a) \\<union> (\\<Union>a \\<in> F1set3 x. IF2set a))\"\n  apply (rule trans[OF o_eq_dest[OF IF1set]])\n  apply (rule arg_cong2[of _ _ _ _ \"(\\<union>)\"])\n   apply (rule trans[OF F1.set_map(1) trans[OF fun_cong[OF image_id] id_apply]])\n  apply (rule arg_cong2[of _ _ _ _ \"(\\<union>)\"])\n   apply (rule arg_cong[OF F1.set_map(2)])\n  apply (rule arg_cong[OF F1.set_map(3)])\n  done\n\ntheorem IF2set_simps:\n  \"IF2set (ctor2 x) = F2set1 x \\<union> ((\\<Union>a \\<in> F2set2 x. IF1set a) \\<union> (\\<Union>a \\<in> F2set3 x. IF2set a))\"\n  apply (rule trans[OF o_eq_dest[OF IF2set]])\n  apply (rule arg_cong2[of _ _ _ _ \"(\\<union>)\"])\n   apply (rule trans[OF F2.set_map(1) trans[OF fun_cong[OF image_id] id_apply]])\n  apply (rule arg_cong2[of _ _ _ _ \"(\\<union>)\"])\n   apply (rule arg_cong[OF F2.set_map(2)])\n  apply (rule arg_cong[OF F2.set_map(3)])\n  done\n\nlemmas F1set1_IF1set = xt1(3)[OF IF1set_simps Un_upper1]\nlemmas F1set2_IF1set = subset_trans[OF UN_upper subset_trans[OF Un_upper1 xt1(3)[OF IF1set_simps Un_upper2]]]\nlemmas F1set3_IF1set = subset_trans[OF UN_upper subset_trans[OF Un_upper2 xt1(3)[OF IF1set_simps Un_upper2]]]\n\nlemmas F2set1_IF2set = xt1(3)[OF IF2set_simps Un_upper1]\nlemmas F2set2_IF2set = subset_trans[OF UN_upper subset_trans[OF Un_upper1 xt1(3)[OF IF2set_simps Un_upper2]]]\nlemmas F2set3_IF2set = subset_trans[OF UN_upper subset_trans[OF Un_upper2 xt1(3)[OF IF2set_simps Un_upper2]]]\n\ntext \\<open>The BNF conditions for IF\\<close>\n\nlemma IFset_natural:\n  \"f ` (IF1set x) = IF1set (IF1map f x) \\<and> f ` (IF2set y) = IF2set (IF2map f y)\"\n  apply (rule ctor_induct[of _ _ x y])\n\n   apply (rule trans)\n    apply (rule image_cong)\n     apply (rule IF1set_simps)\n    apply (rule refl)\n   apply (rule sym)\n   apply (rule trans[OF arg_cong[of _ _ IF1set, OF IF1map_simps] trans[OF IF1set_simps]])\n\n   apply (rule sym)\n   apply (rule trans)\n    apply (rule image_Un)\n   apply (rule arg_cong2[of _ _ _ _ \"(\\<union>)\"])\n    apply (rule sym)\n    apply (rule F1.set_map(1))\n\n   apply (rule trans)\n    apply (rule image_Un)\n   apply (rule arg_cong2[of _ _ _ _ \"(\\<union>)\"])\n    apply (rule trans)\n     apply (rule image_UN)\n    apply (rule trans)\n     apply (rule SUP_cong)\n      apply (rule refl)\n     apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n    apply (rule sym)\n    apply (rule trans)\n     apply (rule SUP_cong)\n      apply (rule F1.set_map(2))\n     apply (rule refl)\n    apply (rule UN_simps(10))\n\n   apply (rule trans)\n    apply (rule image_UN)\n   apply (rule trans)\n    apply (rule SUP_cong)\n     apply (rule refl)\n    apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n   apply (rule sym)\n   apply (rule trans)\n    apply (rule SUP_cong)\n     apply (rule F1.set_map(3))\n    apply (rule refl)\n   apply (rule UN_simps(10))\n\n\n  apply (rule trans)\n   apply (rule image_cong)\n    apply (rule IF2set_simps)\n   apply (rule refl)\n  apply (rule sym)\n  apply (rule trans[OF arg_cong[of _ _ IF2set, OF IF2map_simps] trans[OF IF2set_simps]])\n\n  apply (rule sym)\n  apply (rule trans)\n   apply (rule image_Un)\n  apply (rule arg_cong2[of _ _ _ _ \"(\\<union>)\"])\n   apply (rule sym)\n   apply (rule F2.set_map(1))\n\n  apply (rule trans)\n   apply (rule image_Un)\n  apply (rule arg_cong2[of _ _ _ _ \"(\\<union>)\"])\n\n   apply (rule trans)\n    apply (rule image_UN)\n   apply (rule trans)\n    apply (rule SUP_cong)\n     apply (rule refl)\n    apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n   apply (rule sym)\n   apply (rule trans)\n    apply (rule SUP_cong)\n     apply (rule F2.set_map(2))\n    apply (rule refl)\n   apply (rule UN_simps(10))\n\n  apply (rule trans)\n   apply (rule image_UN)\n  apply (rule trans)\n   apply (rule SUP_cong)\n    apply (rule refl)\n   apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n  apply (rule sym)\n  apply (rule trans)\n   apply (rule SUP_cong)\n    apply (rule F2.set_map(3))\n   apply (rule refl)\n  apply (rule UN_simps(10))\n  done\n\ntheorem IF1set_natural: \"IF1set o (IF1map f) = image f o IF1set\"\n  apply (rule ext)\n  apply (rule trans)\n   apply (rule o_apply)\n  apply (rule sym)\n  apply (rule trans)\n   apply (rule o_apply)\n  apply (rule conjunct1)\n  apply (rule IFset_natural)\n  done\n\ntheorem IF2set_natural: \"IF2set o (IF2map f) = image f o IF2set\"\n  apply (rule ext)\n  apply (rule trans)\n   apply (rule o_apply)\n  apply (rule sym)\n  apply (rule trans)\n   apply (rule o_apply)\n  apply (rule conjunct2)\n  apply (rule IFset_natural)\n  done\n\nlemma IFmap_cong:\n  \"((\\<forall>a \\<in> IF1set x. f a = g a) \\<longrightarrow> IF1map f x = IF1map g x) \\<and>\n   ((\\<forall>a \\<in> IF2set y. f a = g a) \\<longrightarrow> IF2map f y = IF2map g y)\"\n  apply (rule ctor_induct[of _ _ x y])\n\n   apply (rule impI)\n   apply (rule trans)\n    apply (rule IF1map_simps)\n   apply (rule trans)\n    apply (rule arg_cong[OF F1.map_cong0])\n      apply (erule bspec)\n      apply (erule rev_subsetD)\n      apply (rule F1set1_IF1set)\n     apply (rule mp)\n      apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n     apply (rule ballI)\n     apply (erule bspec)\n     apply (erule rev_subsetD)\n     apply (erule F1set2_IF1set)\n    apply (rule mp)\n     apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n    apply (rule ballI)\n    apply (erule bspec)\n    apply (erule rev_subsetD)\n    apply (erule F1set3_IF1set)\n   apply (rule sym)\n   apply (rule IF1map_simps)\n\n  apply (rule impI)\n  apply (rule trans)\n   apply (rule IF2map_simps)\n  apply (rule trans)\n   apply (rule arg_cong[OF F2.map_cong0])\n     apply (erule bspec)\n     apply (erule rev_subsetD)\n     apply (rule F2set1_IF2set)\n    apply (rule mp)\n     apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n    apply (rule ballI)\n    apply (erule bspec)\n    apply (erule rev_subsetD)\n    apply (erule F2set2_IF2set)\n   apply (rule mp)\n    apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n   apply (rule ballI)\n   apply (erule bspec)\n   apply (erule rev_subsetD)\n   apply (erule F2set3_IF2set)\n  apply (rule sym)\n  apply (rule IF2map_simps)\n  done\n\ntheorem IF1map_cong:\n  \"(\\<And>a. a \\<in> IF1set x \\<Longrightarrow> f a = g a) \\<Longrightarrow> IF1map f x = IF1map g x\"\n  apply (rule mp)\n   apply (rule conjunct1)\n   apply (rule IFmap_cong)\n  apply (rule ballI)\n  apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>)\n  done\n\ntheorem IF2map_cong:\n  \"(\\<And>a. a \\<in> IF2set x \\<Longrightarrow> f a = g a) \\<Longrightarrow> IF2map f x = IF2map g x\"\n  apply (rule mp)\n   apply (rule conjunct2)\n   apply (rule IFmap_cong)\n  apply (rule ballI)\n  apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>)\n  done\n\nlemma IFset_bd:\n  \"|IF1set (x :: 'a IF1)| \\<le>o IFbd \\<and> |IF2set (y :: 'a IF2)| \\<le>o IFbd\"\n  apply (rule ctor_induct[of _ _ x y])\n\n   apply (rule ordIso_ordLeq_trans)\n    apply (rule card_of_ordIso_subst)\n    apply (rule IF1set_simps)\n   apply (rule Un_Cinfinite_bound)\n     apply (rule F1set1_bd)\n    apply (rule Un_Cinfinite_bound)\n      apply (rule UNION_Cinfinite_bound)\n        apply (rule F1set2_bd)\n       apply (rule ballI)\n       apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n      apply (rule IFbd_Cinfinite)\n     apply (rule UNION_Cinfinite_bound)\n       apply (rule F1set3_bd)\n      apply (rule ballI)\n      apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n     apply (rule IFbd_Cinfinite)\n    apply (rule IFbd_Cinfinite)\n   apply (rule IFbd_Cinfinite)\n\n  apply (rule ordIso_ordLeq_trans)\n   apply (rule card_of_ordIso_subst)\n   apply (rule IF2set_simps)\n  apply (rule Un_Cinfinite_bound)\n    apply (rule F2set1_bd)\n   apply (rule Un_Cinfinite_bound)\n     apply (rule UNION_Cinfinite_bound)\n       apply (rule F2set2_bd)\n      apply (rule ballI)\n      apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n     apply (rule IFbd_Cinfinite)\n    apply (rule UNION_Cinfinite_bound)\n      apply (rule F2set3_bd)\n     apply (rule ballI)\n     apply (tactic \\<open>Goal.assume_rule_tac @{context} 1\\<close>) (* IH *)\n    apply (rule IFbd_Cinfinite)\n   apply (rule IFbd_Cinfinite)\n  apply (rule IFbd_Cinfinite)\n  done\n\nlemmas IF1set_bd = conjunct1[OF IFset_bd]\nlemmas IF2set_bd = conjunct2[OF IFset_bd]\n\ndefinition IF1rel where\n  \"IF1rel R =\n     (BNF_Def.Grp (IF1in (Collect (case_prod R))) (IF1map fst))^--1 OO\n     (BNF_Def.Grp (IF1in (Collect (case_prod R))) (IF1map snd))\"\n\ndefinition IF2rel where\n  \"IF2rel R =\n     (BNF_Def.Grp (IF2in (Collect (case_prod R))) (IF2map fst))^--1 OO\n     (BNF_Def.Grp (IF2in (Collect (case_prod R))) (IF2map snd))\"\n\nlemma in_IF1rel:\n  \"IF1rel R x y \\<longleftrightarrow> (\\<exists> z. z \\<in> IF1in (Collect (case_prod R)) \\<and> IF1map fst z = x \\<and> IF1map snd z = y)\"\n  unfolding IF1rel_def by (rule predicate2_eqD[OF OO_Grp_alt])\n\nlemma in_IF2rel:\n  \"IF2rel R x y \\<longleftrightarrow> (\\<exists> z. z \\<in> IF2in (Collect (case_prod R)) \\<and> IF2map fst z = x \\<and> IF2map snd z = y)\"\n  unfolding IF2rel_def by (rule predicate2_eqD[OF OO_Grp_alt])\n\nlemma IF1rel_F1rel: \"IF1rel R (ctor1 a) (ctor1 b) \\<longleftrightarrow> F1rel R (IF1rel R) (IF2rel R) a b\"\n  apply (rule iffI)\n   apply (tactic \\<open>dtac @{context} (@{thm in_IF1rel[THEN iffD1]}) 1\\<close>)+\n   apply (erule exE conjE CollectE)+\n   apply (rule iffD2)\n    apply (rule F1.in_rel)\n   apply (rule exI)\n   apply (rule conjI)\n    apply (rule CollectI)\n    apply (rule conjI)\n     apply (rule ord_eq_le_trans)\n      apply (rule F1.set_map(1))\n     apply (rule ord_eq_le_trans)\n      apply (rule trans[OF fun_cong[OF image_id] id_apply])\n     apply (rule subset_trans)\n      apply (rule F1set1_IF1set)\n     apply (erule ord_eq_le_trans[OF arg_cong[OF ctor1_dtor1]])\n\n    apply (rule conjI)\n     apply (rule ord_eq_le_trans)\n      apply (rule F1.set_map(2))\n     apply (rule image_subsetI)\n     apply (rule CollectI)\n     apply (rule case_prodI)\n     apply (rule iffD2)\n      apply (rule in_IF1rel)\n     apply (rule exI)\n     apply (rule conjI)\n      apply (rule CollectI)\n      apply (erule subset_trans[OF F1set2_IF1set])\n      apply (erule ord_eq_le_trans[OF arg_cong[OF ctor1_dtor1]])\n     apply (rule conjI)\n      apply (rule refl)\n     apply (rule refl)\n\n    apply (rule ord_eq_le_trans)\n     apply (rule F1.set_map(3))\n    apply (rule image_subsetI)\n    apply (rule CollectI)\n    apply (rule case_prodI)\n    apply (rule iffD2)\n     apply (rule in_IF2rel)\n    apply (rule exI)\n    apply (rule conjI)\n     apply (rule CollectI)\n     apply (rule subset_trans)\n      apply (rule F1set3_IF1set)\n      apply assumption\n     apply (erule ord_eq_le_trans[OF arg_cong[OF ctor1_dtor1]])\n    apply (rule conjI)\n     apply (rule refl)\n    apply (rule refl)\n   apply (rule conjI)\n\n    apply (rule trans)\n     apply (rule F1.map_comp)\n    apply (rule trans)\n     apply (rule F1.map_cong0)\n       apply (rule fun_cong[OF o_id])\n      apply (rule trans)\n       apply (rule o_apply)\n      apply (rule fst_conv)\n     apply (rule trans)\n      apply (rule o_apply)\n     apply (rule fst_conv)\n    apply (rule iffD1[OF ctor1_diff])\n    apply (rule trans)\n     apply (rule sym)\n     apply (rule IF1map_simps)\n    apply (erule trans[OF arg_cong[OF ctor1_dtor1]])\n\n\n   apply (rule trans)\n    apply (rule F1.map_comp)\n   apply (rule trans)\n    apply (rule F1.map_cong0)\n      apply (rule fun_cong[OF o_id])\n     apply (rule trans)\n      apply (rule o_apply)\n     apply (rule snd_conv)\n    apply (rule trans)\n     apply (rule o_apply)\n    apply (rule snd_conv)\n   apply (rule iffD1[OF ctor1_diff])\n   apply (rule trans)\n    apply (rule sym)\n    apply (rule IF1map_simps)\n   apply (erule trans[OF arg_cong[OF ctor1_dtor1]])\n\n  apply (tactic \\<open>dtac @{context} (@{thm F1.in_rel[THEN iffD1]}) 1\\<close>)\n  apply (erule exE conjE CollectE)+\n  apply (rule iffD2)\n   apply (rule in_IF1rel)\n  apply (rule exI)\n  apply (rule conjI)\n   apply (rule CollectI)\n   apply (rule ord_eq_le_trans)\n    apply (rule IF1set_simps)\n   apply (rule Un_least)\n    apply (rule ord_eq_le_trans)\n     apply (rule box_equals[OF _ refl])\n      apply (rule F1.set_map(1))\n     apply (rule trans[OF fun_cong[OF image_id] id_apply])\n    apply assumption\n   apply (rule Un_least)\n    apply (rule ord_eq_le_trans)\n     apply (rule SUP_cong[OF _ refl])\n     apply (rule F1.set_map(2))\n    apply (rule UN_least)\n    apply (drule rev_subsetD)\n     apply (erule image_mono)\n    apply (erule imageE)\n    apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n    apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n    apply hypsubst\n    apply (tactic \\<open>dtac @{context} (@{thm in_IF1rel[THEN iffD1]}) 1\\<close>)\n    apply (drule someI_ex)\n    apply (erule conjE)+\n    apply (erule CollectD)\n\n   apply (rule ord_eq_le_trans)\n    apply (rule SUP_cong[OF _ refl])\n    apply (rule F1.set_map(3))\n   apply (rule UN_least)\n   apply (drule rev_subsetD)\n    apply (erule image_mono)\n   apply (erule imageE)\n   apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n   apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n   apply hypsubst\n   apply (tactic \\<open>dtac @{context} (@{thm in_IF2rel[THEN iffD1]}) 1\\<close>)\n   apply (drule someI_ex)\n   apply (erule conjE)+\n   apply (erule CollectD)\n\n  apply (rule conjI)\n   apply (rule trans)\n    apply (rule IF1map_simps)\n   apply (rule iffD2[OF ctor1_diff])\n   apply (rule trans)\n    apply (rule F1.map_comp)\n   apply (rule trans)\n    apply (rule F1.map_cong0)\n      apply (rule fun_cong[OF o_id])\n     apply (rule trans[OF o_apply])\n     apply (drule rev_subsetD)\n      apply assumption\n     apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n     apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n     apply hypsubst\n     apply (tactic \\<open>dtac @{context} (@{thm in_IF1rel[THEN iffD1]}) 1\\<close>)\n     apply (drule someI_ex)\n     apply (erule conjE)+\n     apply assumption\n    apply (rule trans[OF o_apply])\n    apply (drule rev_subsetD)\n     apply assumption\n    apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n    apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n    apply hypsubst\n    apply (tactic \\<open>dtac @{context} (@{thm in_IF2rel[THEN iffD1]}) 1\\<close>)\n    apply (drule someI_ex)\n    apply (erule conjE)+\n    apply assumption\n   apply assumption\n\n  apply (rule trans)\n   apply (rule IF1map_simps)\n  apply (rule iffD2[OF ctor1_diff])\n  apply (rule trans)\n   apply (rule F1.map_comp)\n  apply (rule trans)\n   apply (rule F1.map_cong0)\n     apply (rule fun_cong[OF o_id])\n    apply (rule trans[OF o_apply])\n    apply (drule rev_subsetD)\n     apply assumption\n    apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n    apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n    apply hypsubst\n    apply (tactic \\<open>dtac @{context} (@{thm in_IF1rel[THEN iffD1]}) 1\\<close>)\n    apply (drule someI_ex)\n    apply (erule conjE)+\n    apply assumption\n   apply (rule trans[OF o_apply])\n   apply (drule rev_subsetD)\n    apply assumption\n   apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n   apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n   apply hypsubst\n   apply (tactic \\<open>dtac @{context} (@{thm in_IF2rel[THEN iffD1]}) 1\\<close>)\n   apply (drule someI_ex)\n   apply (erule conjE)+\n   apply assumption\n  apply assumption\n  done\n\nlemma IF2rel_F2rel: \"IF2rel R (ctor2 a) (ctor2 b) \\<longleftrightarrow> F2rel R (IF1rel R) (IF2rel R) a b\"\n  apply (rule iffI)\n   apply (tactic \\<open>dtac @{context} (@{thm in_IF2rel[THEN iffD1]}) 1\\<close>)+\n   apply (erule exE conjE CollectE)+\n   apply (rule iffD2)\n    apply (rule F2.in_rel)\n   apply (rule exI)\n   apply (rule conjI)\n    apply (rule CollectI)\n    apply (rule conjI)\n     apply (rule ord_eq_le_trans)\n      apply (rule F2.set_map(1))\n     apply (rule ord_eq_le_trans)\n      apply (rule trans[OF fun_cong[OF image_id] id_apply])\n     apply (rule subset_trans)\n      apply (rule F2set1_IF2set)\n     apply (erule ord_eq_le_trans[OF arg_cong[OF ctor2_dtor2]])\n\n    apply (rule conjI)\n     apply (rule ord_eq_le_trans)\n      apply (rule F2.set_map(2))\n     apply (rule image_subsetI)\n     apply (rule CollectI)\n     apply (rule case_prodI)\n     apply (rule iffD2)\n      apply (rule in_IF1rel)\n     apply (rule exI)\n     apply (rule conjI)\n      apply (rule CollectI)\n      apply (rule subset_trans)\n       apply (rule F2set2_IF2set)\n       apply assumption\n      apply (erule ord_eq_le_trans[OF arg_cong[OF ctor2_dtor2]])\n     apply (rule conjI)\n      apply (rule refl)\n     apply (rule refl)\n\n    apply (rule ord_eq_le_trans)\n     apply (rule F2.set_map(3))\n    apply (rule image_subsetI)\n    apply (rule CollectI)\n    apply (rule case_prodI)\n    apply (rule iffD2)\n     apply (rule in_IF2rel)\n    apply (rule exI)\n    apply (rule conjI)\n     apply (rule CollectI)\n     apply (rule subset_trans)\n      apply (rule F2set3_IF2set)\n      apply assumption\n     apply (erule ord_eq_le_trans[OF arg_cong[OF ctor2_dtor2]])\n    apply (rule conjI)\n     apply (rule refl)\n    apply (rule refl)\n   apply (rule conjI)\n\n    apply (rule trans)\n     apply (rule F2.map_comp)\n    apply (rule trans)\n     apply (rule F2.map_cong0)\n       apply (rule fun_cong[OF o_id])\n      apply (rule trans)\n       apply (rule o_apply)\n      apply (rule fst_conv)\n     apply (rule trans)\n      apply (rule o_apply)\n     apply (rule fst_conv)\n    apply (rule iffD1[OF ctor2_diff])\n    apply (rule trans)\n     apply (rule sym)\n     apply (rule IF2map_simps)\n    apply (erule trans[OF arg_cong[OF ctor2_dtor2]])\n\n\n   apply (rule trans)\n    apply (rule F2.map_comp)\n   apply (rule trans)\n    apply (rule F2.map_cong0)\n      apply (rule fun_cong[OF o_id])\n     apply (rule trans)\n      apply (rule o_apply)\n     apply (rule snd_conv)\n    apply (rule trans)\n     apply (rule o_apply)\n    apply (rule snd_conv)\n   apply (rule iffD1[OF ctor2_diff])\n   apply (rule trans)\n    apply (rule sym)\n    apply (rule IF2map_simps)\n   apply (erule trans[OF arg_cong[OF ctor2_dtor2]])\n\n  apply (tactic \\<open>dtac @{context} (@{thm F2.in_rel[THEN iffD1]}) 1\\<close>)\n  apply (erule exE conjE CollectE)+\n  apply (rule iffD2)\n   apply (rule in_IF2rel)\n  apply (rule exI)\n  apply (rule conjI)\n   apply (rule CollectI)\n   apply (rule ord_eq_le_trans)\n    apply (rule IF2set_simps)\n   apply (rule Un_least)\n    apply (rule ord_eq_le_trans)\n     apply (rule trans)\n      apply (rule trans)\n       apply (rule arg_cong[OF dtor2_ctor2])\n      apply (rule F2.set_map(1))\n     apply (rule trans[OF fun_cong[OF image_id] id_apply])\n    apply assumption\n   apply (rule Un_least)\n    apply (rule ord_eq_le_trans)\n     apply (rule trans[OF arg_cong[OF dtor2_ctor2]])\n     apply (rule arg_cong[OF F2.set_map(2)])\n    apply (rule UN_least)\n    apply (drule rev_subsetD)\n     apply (erule image_mono)\n    apply (erule imageE)\n    apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n    apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n    apply (tactic \\<open>hyp_subst_tac @{context} 1\\<close>)\n    apply (tactic \\<open>dtac @{context} (@{thm in_IF1rel[THEN iffD1]}) 1\\<close>)\n    apply (drule someI_ex)\n    apply (erule conjE)+\n    apply (erule CollectD)\n\n   apply (rule ord_eq_le_trans)\n    apply (rule trans[OF arg_cong[OF dtor2_ctor2]])\n    apply (rule arg_cong[OF F2.set_map(3)])\n   apply (rule UN_least)\n   apply (drule rev_subsetD)\n    apply (erule image_mono)\n   apply (erule imageE)\n   apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n   apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n   apply hypsubst\n   apply (tactic \\<open>dtac @{context} (@{thm in_IF2rel[THEN iffD1]}) 1\\<close>)\n   apply (drule someI_ex)\n   apply (erule exE conjE)+\n   apply (erule CollectD)\n\n  apply (rule conjI)\n   apply (rule trans)\n    apply (rule arg_cong[OF dtor2_ctor2])\n   apply (rule trans)\n    apply (rule IF2map_simps)\n   apply (rule iffD2)\n    apply (rule ctor2_diff)\n   apply (rule trans)\n    apply (rule F2.map_comp)\n   apply (rule trans)\n    apply (rule F2.map_cong0)\n      apply (rule fun_cong[OF o_id])\n     apply (rule trans[OF o_apply])\n     apply (drule rev_subsetD)\n      apply assumption\n     apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n     apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n     apply hypsubst\n     apply (tactic \\<open>dtac @{context} (@{thm in_IF1rel[THEN iffD1]}) 1\\<close>)\n     apply (drule someI_ex)\n     apply (erule conjE)+\n     apply assumption\n    apply (rule trans[OF o_apply])\n    apply (drule rev_subsetD)\n     apply assumption\n    apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n    apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n    apply hypsubst\n    apply (tactic \\<open>dtac @{context} (@{thm in_IF2rel[THEN iffD1]}) 1\\<close>)\n    apply (drule someI_ex)\n    apply (erule conjE)+\n    apply assumption\n   apply assumption\n\n  apply (rule trans)\n   apply (rule arg_cong[OF dtor2_ctor2])\n  apply (rule trans)\n   apply (rule IF2map_simps)\n  apply (rule iffD2)\n   apply (rule ctor2_diff)\n  apply (rule trans)\n   apply (rule F2.map_comp)\n  apply (rule trans)\n   apply (rule F2.map_cong0)\n     apply (rule fun_cong[OF o_id])\n    apply (rule trans[OF o_apply])\n    apply (drule rev_subsetD)\n     apply assumption\n    apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n    apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n    apply hypsubst\n    apply (tactic \\<open>dtac @{context} (@{thm in_IF1rel[THEN iffD1]}) 1\\<close>)\n    apply (drule someI_ex)\n    apply (erule conjE)+\n    apply assumption\n   apply (rule trans[OF o_apply])\n   apply (drule rev_subsetD)\n    apply assumption\n   apply (drule ssubst_mem[OF surjective_pairing[symmetric]])\n   apply (erule CollectE case_prodE iffD1[OF prod.inject, elim_format] conjE)+\n   apply hypsubst\n   apply (tactic \\<open>dtac @{context} (@{thm in_IF2rel[THEN iffD1]}) 1\\<close>)\n   apply (drule someI_ex)\n   apply (erule conjE)+\n   apply assumption\n  apply assumption\n  done\n\nlemma Irel_induct:\n  assumes IH1: \"\\<forall>x y. F1rel P1 P2 P3 x y \\<longrightarrow> P2 (ctor1 x) (ctor1 y)\"\n    and     IH2: \"\\<forall>x y. F2rel P1 P2 P3 x y \\<longrightarrow> P3 (ctor2 x) (ctor2 y)\"\n  shows   \"IF1rel P1 \\<le> P2 \\<and> IF2rel P1 \\<le> P3\"\n  unfolding le_fun_def le_bool_def all_simps(1,2)[symmetric]\n  apply (rule allI)+\n  apply (rule ctor_induct2)\n   apply (rule impI)\n   apply (drule iffD1[OF IF1rel_F1rel])\n   apply (rule mp[OF spec2[OF IH1]])\n   apply (erule F1.rel_mono_strong0)\n     apply (rule ballI[OF ballI[OF imp_refl]])\n    apply (drule asm_rl)\n    apply (erule thin_rl)\n    apply (rule ballI[OF ballI])\n    apply assumption\n   apply (erule thin_rl)\n   apply (drule asm_rl)\n   apply (rule ballI[OF ballI])\n   apply assumption\n\n  apply (rule impI)\n  apply (drule iffD1[OF IF2rel_F2rel])\n  apply (rule mp[OF spec2[OF IH2]])\n  apply (erule F2.rel_mono_strong0)\n    apply (rule ballI[OF ballI[OF imp_refl]])\n   apply (drule asm_rl)\n   apply (erule thin_rl)\n   apply (rule ballI[OF ballI])\n   apply assumption\n  apply (erule thin_rl)\n  apply (drule asm_rl)\n  apply (rule ballI[OF ballI])\n  apply assumption\n  done\n\nlemma le_IFrel_Comp:\n  \"((IF1rel R OO IF1rel S) x1 y1 \\<longrightarrow> IF1rel (R OO S) x1 y1) \\<and>\n       ((IF2rel R OO IF2rel S) x2 y2 \\<longrightarrow> IF2rel (R OO S) x2 y2)\"\n  apply (rule ctor_induct2[of _ _ x1 y1 x2 y2])\n   apply (rule impI)\n   apply (erule nchotomy_relcomppE[OF ctor1_nchotomy])\n   apply (drule iffD1[OF IF1rel_F1rel])\n   apply (drule iffD1[OF IF1rel_F1rel])\n   apply (rule iffD2[OF IF1rel_F1rel])\n   apply (rule F1.rel_mono_strong0)\n      apply (rule iffD2[OF predicate2_eqD[OF F1.rel_compp]])\n      apply (rule relcomppI)\n       apply assumption\n      apply assumption\n     apply (rule ballI impI)+\n     apply assumption\n    apply (rule ballI)+\n    apply assumption\n   apply (rule ballI)+\n   apply assumption\n\n  apply (rule impI)\n  apply (erule nchotomy_relcomppE[OF ctor2_nchotomy])\n  apply (drule iffD1[OF IF2rel_F2rel])\n  apply (drule iffD1[OF IF2rel_F2rel])\n  apply (rule iffD2[OF IF2rel_F2rel])\n  apply (rule F2.rel_mono_strong0)\n     apply (rule iffD2[OF predicate2_eqD[OF F2.rel_compp]])\n     apply (rule relcomppI)\n      apply assumption\n     apply assumption\n    apply (rule ballI impI)+\n    apply assumption\n   apply (rule ballI)+\n   apply assumption\n  apply (rule ballI)+\n  apply assumption\n  done\n\nlemma le_IF1rel_Comp: \"IF1rel R1 OO IF1rel R2 \\<le> IF1rel (R1 OO R2)\"\n  by (rule predicate2I) (erule mp[OF conjunct1[OF le_IFrel_Comp]])\n\nlemma le_IF2rel_Comp: \"IF2rel R1 OO IF2rel R2 \\<le> IF2rel (R1 OO R2)\"\n  by (rule predicate2I) (erule mp[OF conjunct2[OF le_IFrel_Comp]])\n\ncontext includes lifting_syntax\nbegin\n\nlemma fold_transfer:\n  \"((F1rel R S T ===> S) ===> (F2rel R S T ===> T) ===> IF1rel R ===> S) fold1 fold1 \\<and>\n  ((F1rel R S T ===> S) ===> (F2rel R S T ===> T) ===> IF2rel R ===> T) fold2 fold2\"\n  unfolding rel_fun_def_butlast all_conj_distrib[symmetric] imp_conjR[symmetric]\n  unfolding rel_fun_iff_leq_vimage2p\n  apply (rule allI impI)+\n  apply (rule Irel_induct)\n   apply (rule allI impI vimage2pI)+\n   apply (unfold fold1 fold2) [1]\n   apply (erule predicate2D_vimage2p)\n   apply (rule rel_funD[OF rel_funD[OF rel_funD[OF rel_funD[OF F1.map_transfer]]]])\n      apply (rule id_transfer)\n     apply (rule vimage2p_rel_fun)\n    apply (rule vimage2p_rel_fun)\n   apply assumption\n\n\n  apply (rule allI impI vimage2pI)+\n  apply (unfold fold1 fold2) [1]\n  apply (erule predicate2D_vimage2p)\n  apply (rule rel_funD[OF rel_funD[OF rel_funD[OF rel_funD[OF F2.map_transfer]]]])\n     apply (rule id_transfer)\n    apply (rule vimage2p_rel_fun)\n   apply (rule vimage2p_rel_fun)\n  apply assumption\n  done\n\nend\n\ndefinition \"IF1wit x = ctor1 (wit2_F1 x (ctor2 wit_F2))\"\ndefinition \"IF2wit = ctor2 wit_F2\"\n\nlemma IF1wit: \"x \\<in> IF1set (IF1wit y) \\<Longrightarrow> x = y\"\n  unfolding IF1wit_def\n  by (elim UnE F1.wit2[elim_format] F2.wit[elim_format] UN_E FalseE |\n      rule refl |  hypsubst | assumption | unfold IF1set_simps IF2set_simps)+\n\nlemma IF2wit: \"x \\<in> IF2set IF2wit \\<Longrightarrow> False\"\n  unfolding IF2wit_def\n  by (elim UnE F2.wit[elim_format] UN_E FalseE |\n      rule refl |  hypsubst | assumption | unfold IF2set_simps)+\n\nML \\<open>\n  BNF_FP_Util.mk_xtor_co_iter_o_map_thms BNF_Util.Least_FP false 1 @{thm fold_unique}\n    @{thms IF1map IF2map} (map (BNF_Tactics.mk_pointfree2 @{context}) @{thms fold1 fold2})\n    @{thms F1.map_comp0[symmetric] F2.map_comp0[symmetric]} @{thms F1.map_cong0 F2.map_cong0}\n\\<close>\n\nML \\<open>\n  BNF_FP_Util.mk_xtor_co_iter_o_map_thms BNF_Util.Least_FP true 1 @{thm rec_unique}\n    @{thms IF1map IF2map} (map (BNF_Tactics.mk_pointfree2 @{context}) @{thms rec1 rec2})\n    @{thms F1.map_comp0[symmetric] F2.map_comp0[symmetric]} @{thms F1.map_cong0 F2.map_cong0}\n\\<close>\n\nbnf \"'a IF1\"\n  map: IF1map\n  sets: IF1set\n  bd: IFbd\n  wits: IF1wit\n  rel: IF1rel\n           apply -\n           apply (rule IF1map_id)\n          apply (rule IF1map_comp)\n         apply (erule IF1map_cong)\n        apply (rule IF1set_natural)\n       apply (rule IFbd_card_order)\n      apply (rule IFbd_cinfinite)\n     apply (rule IF1set_bd)\n    apply (rule le_IF1rel_Comp)\n   apply (rule IF1rel_def[unfolded OO_Grp_alt mem_Collect_eq])\n  apply (erule IF1wit)\n  done\n\nbnf \"'a IF2\"\n  map: IF2map\n  sets: IF2set\n  bd: IFbd\n  wits: IF2wit\n  rel: IF2rel\n           apply -\n           apply (rule IF2map_id)\n          apply (rule IF2map_comp)\n         apply (erule IF2map_cong)\n        apply (rule IF2set_natural)\n       apply (rule IFbd_card_order)\n      apply (rule IFbd_cinfinite)\n     apply (rule IF2set_bd)\n    apply (rule le_IF2rel_Comp)\n   apply (rule IF2rel_def[unfolded OO_Grp_alt mem_Collect_eq])\n  apply (erule IF2wit)\n  done\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BNF_Operations/LFP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.31587156461841076}}
{"text": "(*  Title:      HOL/Library/Phantom_Type.thy\n    Author:     Andreas Lochbihler\n*)\n\nsection {* A generic phantom type *}\n\ntheory Phantom_Type\nimports Main\nbegin\n\ndatatype ('a, 'b) phantom = phantom (of_phantom: 'b)\n\nlemma type_definition_phantom': \"type_definition of_phantom phantom UNIV\"\nby(unfold_locales) simp_all\n\nlemma phantom_comp_of_phantom [simp]: \"phantom \\<circ> of_phantom = id\"\n  and of_phantom_comp_phantom [simp]: \"of_phantom \\<circ> phantom = id\"\nby(simp_all add: o_def id_def)\n\nsyntax \"_Phantom\" :: \"type \\<Rightarrow> logic\" (\"(1Phantom/(1'(_')))\")\ntranslations\n  \"Phantom('t)\" => \"CONST phantom :: _ \\<Rightarrow> ('t, _) phantom\"\n\ntyped_print_translation {*\n  let\n    fun phantom_tr' ctxt (Type (@{type_name fun}, [_, Type (@{type_name phantom}, [T, _])])) ts =\n          list_comb\n            (Syntax.const @{syntax_const \"_Phantom\"} $ Syntax_Phases.term_of_typ ctxt T, ts)\n      | phantom_tr' _ _ _ = raise Match;\n  in [(@{const_syntax phantom}, phantom_tr')] end\n*}\n\nlemma of_phantom_inject [simp]:\n  \"of_phantom x = of_phantom y \\<longleftrightarrow> x = y\"\nby(cases x y rule: phantom.exhaust[case_product phantom.exhaust]) simp\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Library/Phantom_Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.31587155659187854}}
{"text": "section \\<open>Syntax and proof rules for stratified diagrams\\<close>\n\ntheory Ribbons_Stratified imports \n  Ribbons_Interfaces\n  Proofchain\nbegin\n\ntext \\<open>We define the syntax of stratified diagrams. We give proof rules \n  for stratified diagrams, and prove them sound with respect to the \n  ordinary rules of separation logic.\\<close>\n\nsubsection \\<open>Syntax of stratified diagrams\\<close>\n\ndatatype sdiagram = SDiagram \"(cell \\<times> interface) list\" \nand cell = \n  Filler \"interface\"\n| Basic \"interface\" \"command\" \"interface\"\n| Exists_sdia \"string\" \"sdiagram\"\n| Choose_sdia \"interface\" \"sdiagram\" \"sdiagram\" \"interface\"\n| Loop_sdia \"interface\" \"sdiagram\" \"interface\"\n\ndatatype_compat sdiagram cell\n\ntype_synonym row = \"cell \\<times> interface\"\n\ntext \\<open>Extracting the command from a stratified diagram.\\<close>\nfun\n  com_sdia :: \"sdiagram \\<Rightarrow> command\" and\n  com_cell :: \"cell \\<Rightarrow> command\"\nwhere\n  \"com_sdia (SDiagram \\<rho>s) = foldr (;;) (map (com_cell \\<circ> fst) \\<rho>s) Skip\"\n| \"com_cell (Filler P) = Skip\"\n| \"com_cell (Basic P c Q) = c\"\n| \"com_cell (Exists_sdia x D) = com_sdia D\"\n| \"com_cell (Choose_sdia P D E Q) = Choose (com_sdia D) (com_sdia E)\"\n| \"com_cell (Loop_sdia P D Q) = Loop (com_sdia D)\"\n\ntext \\<open>Extracting the program variables written by a stratified diagram.\\<close>\nfun\n  wr_sdia :: \"sdiagram \\<Rightarrow> string set\" and\n  wr_cell :: \"cell \\<Rightarrow> string set\" \nwhere\n  \"wr_sdia (SDiagram \\<rho>s) = (\\<Union>r \\<in> set \\<rho>s. wr_cell (fst r))\"\n| \"wr_cell (Filler P) = {}\"\n| \"wr_cell (Basic P c Q) = wr_com c\"\n| \"wr_cell (Exists_sdia x D) = wr_sdia D\"\n| \"wr_cell (Choose_sdia P D E Q) = wr_sdia D \\<union> wr_sdia E\"\n| \"wr_cell (Loop_sdia P D Q) = wr_sdia D\"\n\ntext \\<open>The program variables written by a stratified diagram correspond to\n  those written by the commands therein.\\<close>\nlemma wr_sdia_is_wr_com:\n  fixes \\<rho>s :: \"row list\"\n  and \\<rho> :: row\n  shows \"(wr_sdia D = wr_com (com_sdia D))\"\n  and \"(wr_cell \\<gamma> = wr_com (com_cell \\<gamma>))\"\n  and \"(\\<Union>\\<rho> \\<in> set \\<rho>s. wr_cell (fst \\<rho>)) \n    = wr_com (foldr (;;) (map (\\<lambda>(\\<gamma>,F). com_cell \\<gamma>) \\<rho>s) Skip)\"\n  and \"wr_cell (fst \\<rho>) = wr_com (com_cell (fst \\<rho>))\"\napply (induct D and \\<gamma> and \\<rho>s and \\<rho> rule: compat_sdiagram.induct compat_cell.induct\n  compat_cell_interface_prod_list.induct compat_cell_interface_prod.induct)\napply (auto simp add: wr_com_skip wr_com_choose\n  wr_com_loop wr_com_seq split_def o_def)\ndone\n\nsubsection \\<open>Proof rules for stratified diagrams\\<close>\n\ninductive \n  prov_sdia :: \"[sdiagram, interface, interface] \\<Rightarrow> bool\" and\n  prov_row :: \"[row, interface, interface] \\<Rightarrow> bool\" and\n  prov_cell :: \"[cell, interface, interface] \\<Rightarrow> bool\"\nwhere\n  SRibbon: \"prov_cell (Filler P) P P\"\n| SBasic: \"prov_triple (asn P, c, asn Q) \\<Longrightarrow> prov_cell (Basic P c Q) P Q\"\n| SExists: \"prov_sdia D P Q \n    \\<Longrightarrow> prov_cell (Exists_sdia x D) (Exists_int x P) (Exists_int x Q)\"\n| SChoice: \"\\<lbrakk> prov_sdia D P Q ; prov_sdia E P Q \\<rbrakk> \n    \\<Longrightarrow> prov_cell (Choose_sdia P D E Q) P Q\"\n| SLoop: \"prov_sdia D P P \\<Longrightarrow> prov_cell (Loop_sdia P D P) P P\"\n| SRow: \"\\<lbrakk> prov_cell \\<gamma> P Q ; wr_cell \\<gamma> \\<inter> rd_int F = {} \\<rbrakk>\n    \\<Longrightarrow> prov_row (\\<gamma>, F) (P \\<otimes> F) (Q \\<otimes> F)\"\n| SMain: \"\\<lbrakk> chain_all (\\<lambda>(P,\\<rho>,Q). prov_row \\<rho> P Q) \\<Pi> ; 0 < chainlen \\<Pi> \\<rbrakk>\n    \\<Longrightarrow> prov_sdia (SDiagram (comlist \\<Pi>)) (pre \\<Pi>) (post \\<Pi>)\"\n\nsubsection \\<open>Soundness\\<close>\n\nlemma soundness_strat_helper:\n  \"(prov_sdia D P Q \\<longrightarrow> prov_triple (asn P, com_sdia D, asn Q)) \\<and>\n   (prov_row \\<rho> P Q \\<longrightarrow> prov_triple (asn P, com_cell (fst \\<rho>), asn Q)) \\<and>\n   (prov_cell \\<gamma> P Q \\<longrightarrow> prov_triple (asn P, com_cell \\<gamma>, asn Q))\"\nproof (induct rule: prov_sdia_prov_row_prov_cell.induct)\n  case (SRibbon P)\n  show ?case by (auto simp add: prov_triple.skip)\nnext\n  case (SBasic P c Q)\n  thus ?case by auto\nnext\n  case (SExists D P Q x)\n  thus ?case by (auto simp add: prov_triple.exists)\nnext\n  case (SChoice D P Q E)\n  thus ?case by (auto simp add: prov_triple.choose)\nnext\n  case (SLoop D P)\n  thus ?case by (auto simp add: prov_triple.loop)\nnext\n  case (SRow \\<gamma> P Q F)\n  thus ?case\n  by (simp add: prov_triple.frame rd_int_is_rd_ass wr_sdia_is_wr_com(2))\nnext\n  case (SMain \\<Pi>)\n  thus ?case\n  apply (unfold com_sdia.simps)\n  apply (intro seq_fold[of _ \\<Pi>])\n  apply (simp_all add: len_comlist_chainlen)[3]\n  apply (induct \\<Pi>, simp)\n  apply (case_tac i, auto simp add: fst3_simp thd3_simp)\n  done\nqed\n  \ncorollary soundness_strat:\n  assumes \"prov_sdia D P Q\"\n  shows \"prov_triple (asn P, com_sdia D, asn Q)\"\nusing assms soundness_strat_helper by auto\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Ribbon_Proofs/Ribbons_Stratified.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.31587155659187854}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      Generalise.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2005-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\ntheory Generalise imports \"HOL-Statespace.DistinctTreeProver\"\nbegin\n\nlemma protectRefl: \"PROP Pure.prop (PROP C) \\<Longrightarrow> PROP Pure.prop (PROP C)\"\n  by (simp add: prop_def)\n\nlemma protectImp: \n assumes i: \"PROP Pure.prop (PROP P \\<Longrightarrow> PROP Q)\" \n shows \"PROP Pure.prop (PROP Pure.prop P \\<Longrightarrow> PROP Pure.prop Q)\"\nproof -\n  {\n    assume P: \"PROP Pure.prop P\"\n    from i [unfolded prop_def, OF P [unfolded prop_def]] \n    have \"PROP Pure.prop Q\"\n      by (simp add: prop_def)\n  }\n  note i' = this\n  show \"PROP ?thesis\" \n    apply (rule protectI)\n    apply (rule i')\n    apply assumption\n    done\nqed\n\n\nlemma generaliseConj: \n  assumes i1: \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\<Longrightarrow> PROP Pure.prop (Trueprop Q))\"\n  assumes i2: \"PROP Pure.prop (PROP Pure.prop (Trueprop P') \\<Longrightarrow> PROP Pure.prop (Trueprop Q'))\"\n  shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (P \\<and> P')) \\<Longrightarrow> (PROP Pure.prop (Trueprop (Q \\<and> Q'))))\"\n  using i1 i2\n  by (auto simp add: prop_def)\n\nlemma generaliseAll: \n assumes i: \"PROP Pure.prop (\\<And>s. PROP Pure.prop (Trueprop (P s)) \\<Longrightarrow> PROP Pure.prop (Trueprop (Q s)))\" \n shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (\\<forall>s. P s)) \\<Longrightarrow> PROP Pure.prop (Trueprop (\\<forall>s. Q s)))\"\n  using i\n  by (auto simp add: prop_def)\n\nlemma generalise_all: \n assumes i: \"PROP Pure.prop (\\<And>s. PROP Pure.prop (PROP P s) \\<Longrightarrow> PROP Pure.prop (PROP Q s))\" \n shows \"PROP Pure.prop ((PROP Pure.prop (\\<And>s. PROP P s)) \\<Longrightarrow> (PROP Pure.prop (\\<And>s. PROP Q s)))\"\n  using i\n  proof (unfold prop_def)\n    assume i1: \"\\<And>s. (PROP P s) \\<Longrightarrow> (PROP Q s)\"\n    assume i2: \"\\<And>s. PROP P s\"\n    show \"\\<And>s. PROP Q s\"\n      by (rule i1) (rule i2)\n  qed\n\nlemma generaliseTrans: \n  assumes i1: \"PROP Pure.prop (PROP P \\<Longrightarrow> PROP Q)\"\n  assumes i2: \"PROP Pure.prop (PROP Q \\<Longrightarrow> PROP R)\" \n  shows \"PROP Pure.prop (PROP P \\<Longrightarrow> PROP R)\"\n  using i1 i2\n  proof (unfold prop_def)\n    assume P_Q: \"PROP P \\<Longrightarrow> PROP Q\" \n    assume Q_R: \"PROP Q \\<Longrightarrow> PROP R\" \n    assume P: \"PROP P\"\n    show \"PROP R\"\n      by (rule Q_R [OF P_Q [OF P]])\n  qed\n\nlemma meta_spec:\n  assumes \"\\<And>x. PROP P x\"\n  shows \"PROP P x\" by fact\n\nlemma meta_spec_protect:\n  assumes g: \"\\<And>x. PROP P x\"\n  shows \"PROP Pure.prop (PROP P x)\"\nusing g\nby (auto simp add: prop_def)\n\nlemma generaliseImp: \n  assumes i: \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\<Longrightarrow> PROP Pure.prop (Trueprop Q))\"\n  shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (X \\<longrightarrow> P)) \\<Longrightarrow> PROP Pure.prop (Trueprop (X \\<longrightarrow> Q)))\"\n  using i\n  by (auto simp add: prop_def)\n\nlemma generaliseEx: \n assumes i: \"PROP Pure.prop (\\<And>s. PROP Pure.prop (Trueprop (P s)) \\<Longrightarrow> PROP Pure.prop (Trueprop (Q s)))\" \n shows \"PROP Pure.prop (PROP Pure.prop (Trueprop (\\<exists>s. P s)) \\<Longrightarrow> PROP Pure.prop (Trueprop (\\<exists>s. Q s)))\"\n  using i\n  by (auto simp add: prop_def)\n\n\nlemma generaliseRefl: \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\<Longrightarrow> PROP Pure.prop (Trueprop P))\"\n  by (auto simp add: prop_def)\n\nlemma generaliseRefl': \"PROP Pure.prop (PROP P \\<Longrightarrow> PROP P)\"\n  by (auto simp add: prop_def)\n\nlemma generaliseAllShift:\n  assumes i: \"PROP Pure.prop (\\<And>s. P \\<Longrightarrow> Q s)\"\n  shows \"PROP Pure.prop (PROP Pure.prop (Trueprop P) \\<Longrightarrow> PROP Pure.prop (Trueprop (\\<forall>s. Q s)))\"\n  using i\n  by (auto simp add: prop_def)\n\nlemma generalise_allShift:\n  assumes i: \"PROP Pure.prop (\\<And>s. PROP P \\<Longrightarrow> PROP Q s)\"\n  shows \"PROP Pure.prop (PROP Pure.prop (PROP P) \\<Longrightarrow> PROP Pure.prop (\\<And>s. PROP Q s))\"\n  using i\n  proof (unfold prop_def)\n    assume P_Q: \"\\<And>s. PROP P \\<Longrightarrow> PROP Q s\" \n    assume P: \"PROP P\"\n    show \"\\<And>s. PROP Q s\"\n      by (rule P_Q [OF P])\n  qed\n\n\nlemma generaliseImpl:\n  assumes i: \"PROP Pure.prop (PROP Pure.prop P \\<Longrightarrow> PROP Pure.prop Q)\"\n  shows \"PROP Pure.prop ((PROP Pure.prop (PROP X \\<Longrightarrow> PROP P)) \\<Longrightarrow> (PROP Pure.prop (PROP X \\<Longrightarrow> PROP Q)))\"\n  using i\n  proof (unfold prop_def)\n    assume i1: \"PROP P \\<Longrightarrow> PROP Q\"\n    assume i2: \"PROP X \\<Longrightarrow> PROP P\"\n    assume X: \"PROP X\"\n    show \"PROP Q\"\n      by (rule i1 [OF i2 [OF X]])\n  qed\n\n\nML_file \"generalise_state.ML\"\n\nend\n\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/Generalise.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3157387566926947}}
{"text": "(* Author: Johannes Hölzl <hoelzl@in.tum.de> *)\n\nsection \\<open>Markov Decision Processes\\<close>\n\ntheory Markov_Decision_Process\n  imports Discrete_Time_Markov_Chain\nbegin\n\ndefinition \"some_elem s = (SOME x. x \\<in> s)\"\n\nlemma some_elem_ne: \"s \\<noteq> {} \\<Longrightarrow> some_elem s \\<in> s\"\n  unfolding some_elem_def by (auto intro: someI)\n\nsubsection \\<open>Configurations\\<close>\n\ntext \\<open>\n\nWe want to construct a \\emph{non-free} codatatype\n  \\<open>'s cfg = Cfg (state: 's) (action: 's pmf) (cont: 's \\<Rightarrow> 's cfg)\\<close>.\nwith the restriction\n  @{term \"state (cont cfg s) = s\"}\n\n\\<close>\n\nhide_const cont\n\ncodatatype 's scheduler = Scheduler (action_sch: \"'s pmf\") (cont_sch: \"'s \\<Rightarrow> 's scheduler\")\n\nlemma equivp_rel_prod: \"equivp R \\<Longrightarrow> equivp Q \\<Longrightarrow> equivp (rel_prod R Q)\"\n  by (auto intro!: equivpI prod.rel_symp prod.rel_transp prod.rel_reflp elim: equivpE)\n\ncoinductive eq_scheduler :: \"'s scheduler \\<Rightarrow> 's scheduler \\<Rightarrow> bool\"\nwhere\n  \"\\<And>D. action_sch sc1 = D \\<Longrightarrow> action_sch sc2 = D \\<Longrightarrow>\n    (\\<forall>s\\<in>D. eq_scheduler (cont_sch sc1 s) (cont_sch sc2 s)) \\<Longrightarrow> eq_scheduler sc1 sc2\"\n\nlemma eq_scheduler_refl[intro]: \"eq_scheduler sc sc\"\n  by (coinduction arbitrary: sc) auto\n\nquotient_type 's cfg = \"'s \\<times> 's scheduler\" / \"rel_prod (=) eq_scheduler\"\nproof (intro equivp_rel_prod equivpI reflpI sympI transpI)\n  show \"eq_scheduler sc1 sc2 \\<Longrightarrow> eq_scheduler sc2 sc1\" for sc1 sc2 :: \"'s scheduler\"\n    by (coinduction arbitrary: sc1 sc2) (auto elim: eq_scheduler.cases)\n  show \"eq_scheduler sc1 sc2 \\<Longrightarrow> eq_scheduler sc2 sc3 \\<Longrightarrow> eq_scheduler sc1 sc3\"\n    for sc1 sc2 sc3 :: \"'s scheduler\"\n    by (coinduction arbitrary: sc1 sc2 sc3)\n       (subst (asm) (1 2) eq_scheduler.simps, auto)\nqed auto\n\nlift_definition state :: \"'s cfg \\<Rightarrow> 's\" is \"fst\"\n  by auto\n\nlift_definition action :: \"'s cfg \\<Rightarrow> 's pmf\" is \"\\<lambda>(s, sc). action_sch sc\"\n  by (force elim: eq_scheduler.cases)\n\nlift_definition cont :: \"'s cfg \\<Rightarrow> 's \\<Rightarrow> 's cfg\" is\n  \"\\<lambda>(s, sc) t. if t \\<in> action_sch sc then (t, cont_sch sc t) else\n    (t, cont_sch sc (some_elem (action_sch sc)))\"\n  apply (simp add: rel_prod_conv split: prod.splits)\n  apply (subst (asm) eq_scheduler.simps)\n  apply (auto simp: Let_def set_pmf_not_empty[THEN some_elem_ne])\n  done\n\nlift_definition Cfg :: \"'s \\<Rightarrow> 's pmf \\<Rightarrow> ('s \\<Rightarrow> 's cfg) \\<Rightarrow> 's cfg\" is\n  \"\\<lambda>s D c. (s, Scheduler D (\\<lambda>t. snd (c t)))\"\n  by (auto simp: rel_prod_conv split_beta' eq_scheduler.simps[of \"Scheduler _  _\"])\n\nlift_definition cfg_corec :: \"'s \\<Rightarrow> ('a \\<Rightarrow> 's pmf) \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> 'a)  \\<Rightarrow> 'a \\<Rightarrow> 's cfg\" is\n  \"\\<lambda>s D C x. (s, corec_scheduler D (\\<lambda>x s. Inr (C x s)) x)\"  .\n\n\n\nlemma state_Cfg[simp]: \"state (Cfg s d' c') = s\"\n  by transfer simp\n\nlemma action_Cfg[simp]: \"action (Cfg s d' c') = d'\"\n  by transfer simp\n\nlemma cont_Cfg[simp]: \"t \\<in> set_pmf d' \\<Longrightarrow> state (c' t) = t \\<Longrightarrow> cont (Cfg s d' c') t = c' t\"\n  by transfer (auto simp add: rel_prod_conv split: prod.split)\n\nlemma state_cfg_corec[simp]: \"state (cfg_corec s d c x) = s\"\n  by transfer auto\n\nlemma action_cfg_corec[simp]: \"action (cfg_corec s d c x) = d x\"\n  by transfer auto\n\nlemma cont_cfg_corec[simp]: \"t \\<in> set_pmf (d x) \\<Longrightarrow> cont (cfg_corec s d c x) t = cfg_corec t d c (c x t)\"\n  by transfer auto\n\nlemma cfg_coinduct[consumes 1, case_names state action cont, coinduct pred]:\n  \"X c d \\<Longrightarrow> (\\<And>c d. X c d \\<Longrightarrow> state c = state d) \\<Longrightarrow> (\\<And>c d. X c d \\<Longrightarrow> action c = action d) \\<Longrightarrow>\n    (\\<And>c d t. X c d \\<Longrightarrow> t \\<in> set_pmf (action c) \\<Longrightarrow> X (cont c t) (cont d t)) \\<Longrightarrow> c = d\"\nproof (transfer, clarsimp)\n  fix X :: \"('a \\<times> 'a scheduler) \\<Rightarrow> ('a \\<times> 'a scheduler) \\<Rightarrow> bool\" and B s1 s2 sc1 sc2\n  assume X: \"X (s1, sc1) (s2, sc2)\" and \"rel_fun cr_cfg (rel_fun cr_cfg (=)) X B\"\n    and 1: \"\\<And>s1 sc1 s2 sc2. X (s1, sc1) (s2, sc2) \\<Longrightarrow> s1 = s2\"\n    and 2: \"\\<And>s1 sc1 s2 sc2. X (s1, sc1) (s2, sc2) \\<Longrightarrow> action_sch sc1 = action_sch sc2\"\n    and 3: \"\\<And>s1 sc1 s2 sc2 t. X (s1, sc1) (s2, sc2) \\<Longrightarrow> t \\<in> set_pmf (action_sch sc2) \\<Longrightarrow>\n      X (t, cont_sch sc1 t) (t, cont_sch sc2 t)\"\n  from X show \"eq_scheduler sc1 sc2\"\n    by (coinduction arbitrary: s1 s2 sc1 sc2)\n       (blast dest: 2 3)\nqed\n\ncoinductive rel_cfg :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> 'a cfg \\<Rightarrow> 'b cfg \\<Rightarrow> bool\" for P :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\"\nwhere\n  \"P (state cfg1) (state cfg2) \\<Longrightarrow>\n    rel_pmf (\\<lambda>s t. rel_cfg P (cont cfg1 s) (cont cfg2 t)) (action cfg1) (action cfg2) \\<Longrightarrow>\n    rel_cfg P cfg1 cfg2\"\n\nlemma rel_cfg_state: \"rel_cfg P cfg1 cfg2 \\<Longrightarrow> P (state cfg1) (state cfg2)\"\n  by (auto elim: rel_cfg.cases)\n\nlemma rel_cfg_cont:\n  \"rel_cfg P cfg1 cfg2 \\<Longrightarrow>\n    rel_pmf (\\<lambda>s t. rel_cfg P (cont cfg1 s) (cont cfg2 t)) (action cfg1) (action cfg2)\"\n  by (auto elim: rel_cfg.cases)\n\nlemma rel_cfg_action:\n  assumes P: \"rel_cfg P cfg1 cfg2\" shows \"rel_pmf P (action cfg1) (action cfg2)\"\nproof (rule pmf.rel_mono_strong)\n  show \"rel_pmf (\\<lambda>s t. rel_cfg P (cont cfg1 s) (cont cfg2 t)) (action cfg1) (action cfg2)\"\n    using P by (rule rel_cfg_cont)\nqed (auto dest: rel_cfg_state)\n\nlemma rel_cfg_eq: \"rel_cfg (=) cfg1 cfg2 \\<longleftrightarrow> cfg1 = cfg2\"\nproof safe\n  show \"rel_cfg (=) cfg1 cfg2 \\<Longrightarrow> cfg1 = cfg2\"\n  proof (coinduction arbitrary: cfg1 cfg2)\n    case cont\n    have \"action cfg1 = action cfg2\"\n      using \\<open>rel_cfg (=) cfg1 cfg2\\<close> by (auto dest: rel_cfg_action simp: pmf.rel_eq)\n    then have \"rel_pmf (\\<lambda>s t. rel_cfg (=) (cont cfg1 s) (cont cfg2 t)) (action cfg1) (action cfg1)\"\n      using cont by (auto dest: rel_cfg_cont)\n    then have \"rel_pmf (\\<lambda>s t. rel_cfg (=) (cont cfg1 s) (cont cfg2 t) \\<and> s = t) (action cfg1) (action cfg1)\"\n      by (rule pmf.rel_mono_strong) (auto dest: rel_cfg_state)\n    then have \"pred_pmf (\\<lambda>s. rel_cfg (=) (cont cfg1 s) (cont cfg2 s)) (action cfg1)\"\n      unfolding pmf.pred_rel by (rule pmf.rel_mono_strong) (auto simp: eq_onp_def)\n    with \\<open>t \\<in> action cfg1\\<close> show ?case\n      by (auto simp: pmf.pred_set)\n  qed (auto dest: rel_cfg_state rel_cfg_action simp: pmf.rel_eq)\n  show \"rel_cfg (=) cfg2 cfg2\"\n    by (coinduction arbitrary: cfg2) (auto intro!: rel_pmf_reflI)\nqed\n\nsubsection \\<open>Configuration with Memoryless Scheduler\\<close>\n\ndefinition \"memoryless_on f s = cfg_corec s f (\\<lambda>_ t. t) s\"\n\nlemma\n  shows state_memoryless_on[simp]: \"state (memoryless_on f s) = s\"\n    and action_memoryless_on[simp]: \"action (memoryless_on f s) = f s\"\n    and cont_memoryless_on[simp]: \"t \\<in> (f s) \\<Longrightarrow> cont (memoryless_on f s) t = memoryless_on f t\"\n  by (simp_all add: memoryless_on_def)\n\ndefinition K_cfg :: \"'s cfg \\<Rightarrow> 's cfg pmf\" where\n  \"K_cfg cfg = map_pmf (cont cfg) (action cfg)\"\n\nlemma set_K_cfg: \"set_pmf (K_cfg cfg) = cont cfg ` set_pmf (action cfg)\"\n  by (simp add: K_cfg_def)\n\nlemma nn_integral_K_cfg: \"(\\<integral>\\<^sup>+cfg. f cfg \\<partial>K_cfg cfg) = (\\<integral>\\<^sup>+s. f (cont cfg s) \\<partial>action cfg)\"\n  by (simp add: K_cfg_def map_pmf_rep_eq nn_integral_distr)\n\nsubsection \\<open>MDP Kernel and Induced Configurations\\<close>\n\nlocale Markov_Decision_Process =\n  fixes K :: \"'s \\<Rightarrow> 's pmf set\"\n  assumes K_wf: \"\\<And>s. K s \\<noteq> {}\"\nbegin\n\ndefinition \"E = (SIGMA s:UNIV. \\<Union>D\\<in>K s. set_pmf D)\"\n\ncoinductive cfg_onp :: \"'s \\<Rightarrow> 's cfg \\<Rightarrow> bool\" where\n  \"\\<And>s. state cfg = s \\<Longrightarrow> action cfg \\<in> K s \\<Longrightarrow> (\\<And>t. t \\<in> action cfg \\<Longrightarrow> cfg_onp t (cont cfg t)) \\<Longrightarrow>\n    cfg_onp s cfg\"\n\ndefinition \"cfg_on s = {cfg. cfg_onp s cfg}\"\n\nlemma\n  shows cfg_onD_action[intro, simp]: \"cfg \\<in> cfg_on s \\<Longrightarrow> action cfg \\<in> K s\"\n    and cfg_onD_cont[intro, simp]: \"cfg \\<in> cfg_on s \\<Longrightarrow> t \\<in> action cfg \\<Longrightarrow> cont cfg t \\<in> cfg_on t\"\n    and cfg_onD_state[simp]: \"cfg \\<in> cfg_on s \\<Longrightarrow> state cfg = s\"\n    and cfg_onI: \"state cfg = s \\<Longrightarrow> action cfg \\<in> K s \\<Longrightarrow> (\\<And>t. t \\<in> action cfg \\<Longrightarrow> cont cfg t \\<in> cfg_on t) \\<Longrightarrow> cfg \\<in> cfg_on s\"\n  by (auto simp: cfg_on_def intro: cfg_onp.intros elim: cfg_onp.cases)\n\nlemma cfg_on_coinduct[coinduct set: cfg_on]:\n  assumes \"P s cfg\"\n  assumes \"\\<And>cfg s. P s cfg \\<Longrightarrow> state cfg = s\"\n  assumes \"\\<And>cfg s. P s cfg \\<Longrightarrow> action cfg \\<in> K s\"\n  assumes \"\\<And>cfg s t. P s cfg \\<Longrightarrow> t \\<in> action cfg \\<Longrightarrow> P t (cont cfg t)\"\n  shows \"cfg \\<in> cfg_on s\"\n  using assms cfg_onp.coinduct[of P s cfg] by (simp add: cfg_on_def)\n\nlemma memoryless_on_cfg_onI:\n  assumes \"\\<And>s. f s \\<in> K s\"\n  shows \"memoryless_on f s \\<in> cfg_on s\"\n  by (coinduction arbitrary: s) (auto intro: assms)\n\nlemma cfg_of_cfg_onI:\n  \"D \\<in> K s \\<Longrightarrow> (\\<And>t. t \\<in> D \\<Longrightarrow> c t \\<in> cfg_on t) \\<Longrightarrow> Cfg s D c \\<in> cfg_on s\"\n  by (rule cfg_onI) auto\n\ndefinition \"arb_act s = (SOME D. D \\<in> K s)\"\n\n\n\nlemma cfg_on_not_empty[intro, simp]: \"cfg_on s \\<noteq> {}\"\n  by (auto intro: memoryless_on_cfg_onI arb_actI)\n\nsublocale MC: MC_syntax K_cfg .\n\nabbreviation St :: \"'s stream measure\" where\n  \"St \\<equiv> stream_space (count_space UNIV)\"\n\nsubsection \\<open>Trace Space\\<close>\n\ndefinition \"T cfg = distr (MC.T cfg) St (smap state)\"\n\nsublocale T: prob_space \"T cfg\" for cfg\n  by (simp add: T_def MC.T.prob_space_distr)\n\nlemma space_T[simp]: \"space (T cfg) = space St\"\n  by (simp add: T_def)\n\nlemma sets_T[simp]: \"sets (T cfg) = sets St\"\n  by (simp add: T_def)\n\nlemma measurable_T1[simp]: \"measurable (T cfg) N = measurable St N\"\n  by (simp add: T_def)\n\nlemma measurable_T2[simp]: \"measurable N (T cfg) = measurable N St\"\n  by (simp add: T_def)\n\nlemma nn_integral_T:\n  assumes [measurable]: \"f \\<in> borel_measurable St\"\n  shows \"(\\<integral>\\<^sup>+X. f X \\<partial>T cfg) = (\\<integral>\\<^sup>+cfg'. (\\<integral>\\<^sup>+x. f (state cfg' ## x) \\<partial>T cfg') \\<partial>K_cfg cfg)\"\n  by (simp add: T_def MC.nn_integral_T[of _ cfg] nn_integral_distr)\n\nlemma T_eq:\n  \"T cfg = (measure_pmf (K_cfg cfg) \\<bind> (\\<lambda>cfg'. distr (T cfg') St (\\<lambda>\\<omega>. state cfg' ## \\<omega>)))\"\nproof (rule measure_eqI)\n  fix A assume \"A \\<in> sets (T cfg)\"\n  then show \"emeasure (T cfg) A =\n    emeasure (measure_pmf (K_cfg cfg) \\<bind> (\\<lambda>cfg'. distr (T cfg') St (\\<lambda>\\<omega>. state cfg' ## \\<omega>))) A\"\n    by (subst emeasure_bind[where N=St])\n       (auto simp: space_subprob_algebra nn_integral_distr nn_integral_indicator[symmetric] nn_integral_T[of _ cfg]\n             simp del: nn_integral_indicator intro!: prob_space_imp_subprob_space T.prob_space_distr)\nqed simp\n\nlemma T_memoryless_on: \"T (memoryless_on ct s) = MC_syntax.T ct s\"\nproof -\n  interpret ct: MC_syntax ct .\n  have \"T \\<circ> (memoryless_on ct) = MC_syntax.T ct\"\n  proof (rule ct.T_bisim[symmetric])\n    fix s show \"(T \\<circ> memoryless_on ct) s =\n        measure_pmf (ct s) \\<bind> (\\<lambda>s. distr ((T \\<circ> memoryless_on ct) s) St ((##) s))\"\n      by (auto simp add: T_eq[of \"memoryless_on ct s\"] K_cfg_def map_pmf_rep_eq bind_distr[where K=St]\n                         space_subprob_algebra T.prob_space_distr prob_space_imp_subprob_space\n               intro!: bind_measure_pmf_cong)\n  qed (simp_all, intro_locales)\n  then show ?thesis by (simp add: fun_eq_iff)\nqed\n\nlemma nn_integral_T_lfp:\n  assumes [measurable]: \"case_prod g \\<in> borel_measurable (count_space UNIV \\<Otimes>\\<^sub>M borel)\"\n  assumes cont_g: \"\\<And>s. sup_continuous (g s)\"\n  assumes int_g: \"\\<And>f cfg. f \\<in> borel_measurable (stream_space (count_space UNIV)) \\<Longrightarrow>\n    (\\<integral>\\<^sup>+\\<omega>. g (state cfg) (f \\<omega>) \\<partial>T cfg) = g (state cfg) (\\<integral>\\<^sup>+\\<omega>. f \\<omega> \\<partial>T cfg)\"\n  shows \"(\\<integral>\\<^sup>+\\<omega>. lfp (\\<lambda>f \\<omega>. g (shd \\<omega>) (f (stl \\<omega>))) \\<omega> \\<partial>T cfg) =\n    lfp (\\<lambda>f cfg. \\<integral>\\<^sup>+t. g (state t) (f t) \\<partial>K_cfg cfg) cfg\"\nproof (rule nn_integral_lfp)\n  show \"\\<And>s. sets (T s) = sets St\"\n      \"\\<And>F. F \\<in> borel_measurable St \\<Longrightarrow> (\\<lambda>a. g (shd a) (F (stl a))) \\<in> borel_measurable St\"\n    by auto\nnext\n  fix s and F :: \"'s stream \\<Rightarrow> ennreal\" assume \"F \\<in> borel_measurable St\"\n  then show \"(\\<integral>\\<^sup>+ a. g (shd a) (F (stl a)) \\<partial>T s) =\n           (\\<integral>\\<^sup>+ cfg. g (state cfg) (integral\\<^sup>N (T cfg) F) \\<partial>K_cfg s)\"\n    by (rewrite nn_integral_T) (simp_all add: int_g)\nqed (auto intro!: order_continuous_intros cont_g[THEN sup_continuous_compose])\n\nlemma emeasure_Collect_T:\n  assumes [measurable]: \"Measurable.pred St P\"\n  shows \"emeasure (T cfg) {x\\<in>space St. P x} =\n    (\\<integral>\\<^sup>+cfg'. emeasure (T cfg') {x\\<in>space St. P (state cfg' ## x)} \\<partial>K_cfg cfg)\"\n  using MC.emeasure_Collect_T[of \"\\<lambda>x. P (smap state x)\" cfg]\n  by (simp add: nn_integral_distr emeasure_Collect_distr T_def)\n\ndefinition E_sup :: \"'s \\<Rightarrow> ('s stream \\<Rightarrow> ennreal) \\<Rightarrow> ennreal\"\nwhere\n  \"E_sup s f = (\\<Squnion>cfg\\<in>cfg_on s. \\<integral>\\<^sup>+x. f x \\<partial>T cfg)\"\n\nlemma E_sup_const: \"0 \\<le> c \\<Longrightarrow> E_sup s (\\<lambda>_. c) = c\"\n  using T.emeasure_space_1 by (simp add: E_sup_def)\n\nlemma E_sup_mult_right:\n  assumes [measurable]: \"f \\<in> borel_measurable St\" and [simp]: \"0 \\<le> c\"\n  shows \"E_sup s (\\<lambda>x. c * f x) = c * E_sup s f\"\n  by (simp add: nn_integral_cmult E_sup_def SUP_mult_left_ennreal)\n\nlemma E_sup_mono:\n  \"(\\<And>\\<omega>. f \\<omega> \\<le> g \\<omega>) \\<Longrightarrow> E_sup s f \\<le> E_sup s g\"\n  unfolding E_sup_def by (intro SUP_subset_mono order_refl nn_integral_mono)\n\nlemma E_sup_add:\n  assumes [measurable]: \"f \\<in> borel_measurable St\" \"g \\<in> borel_measurable St\"\n  shows \"E_sup s (\\<lambda>x. f x + g x) \\<le> E_sup s f + E_sup s g\"\nproof -\n  have \"E_sup s (\\<lambda>x. f x + g x) = (\\<Squnion>cfg\\<in>cfg_on s. (\\<integral>\\<^sup>+x. f x \\<partial>T cfg) + (\\<integral>\\<^sup>+x. g x \\<partial>T cfg))\"\n    by (simp add: E_sup_def nn_integral_add)\n  also have \"\\<dots> \\<le> (\\<Squnion>cfg\\<in>cfg_on s. \\<integral>\\<^sup>+x. f x \\<partial>T cfg) + (\\<Squnion>cfg\\<in>cfg_on s. (\\<integral>\\<^sup>+x. g x \\<partial>T cfg))\"\n    by (auto simp: SUP_le_iff intro!: add_mono SUP_upper)\n  finally show ?thesis\n    by (simp add: E_sup_def)\nqed\n\nlemma E_sup_add_left:\n  assumes [measurable]: \"f \\<in> borel_measurable St\"\n  shows \"E_sup s (\\<lambda>x. f x + c) = E_sup s f + c\"\n  by (simp add: nn_integral_add E_sup_def T.emeasure_space_1[simplified] ennreal_SUP_add_left)\n\nlemma E_sup_add_right:\n  \"f \\<in> borel_measurable St \\<Longrightarrow> E_sup s (\\<lambda>x. c + f x) = c + E_sup s f\"\n  using E_sup_add_left[of f s c] by (simp add: add.commute)\n\nlemma E_sup_SUP:\n  assumes [measurable]: \"\\<And>i. f i \\<in> borel_measurable St\" and [simp]: \"incseq f\"\n  shows \"E_sup s (\\<lambda>x. \\<Squnion>i. f i x) = (\\<Squnion>i. E_sup s (f i))\"\n  by (auto simp add: E_sup_def nn_integral_monotone_convergence_SUP intro: SUP_commute)\n\nlemma E_sup_iterate:\n  assumes [measurable]: \"f \\<in> borel_measurable St\"\n  shows \"E_sup s f = (\\<Squnion>D\\<in>K s. \\<integral>\\<^sup>+ t. E_sup t (\\<lambda>\\<omega>. f (t ## \\<omega>)) \\<partial>measure_pmf D)\"\nproof -\n  let ?v = \"\\<lambda>t. \\<integral>\\<^sup>+x. f (state t ## x) \\<partial>T t\"\n  let ?p = \"\\<lambda>t. E_sup t (\\<lambda>\\<omega>. f (t ## \\<omega>))\"\n  have \"E_sup s f = (\\<Squnion>cfg\\<in>cfg_on s. \\<integral>\\<^sup>+t. ?v t \\<partial>K_cfg cfg)\"\n    unfolding E_sup_def by (intro SUP_cong refl) (subst nn_integral_T, simp_all add: cfg_on_def)\n  also have \"\\<dots> = (\\<Squnion>D\\<in>K s. \\<integral>\\<^sup>+t. ?p t \\<partial>measure_pmf D)\"\n  proof (intro antisym SUP_least)\n    fix cfg :: \"'s cfg\" assume cfg: \"cfg \\<in> cfg_on s\"\n    then show \"(\\<integral>\\<^sup>+ t. ?v t \\<partial>K_cfg cfg) \\<le> (SUP D\\<in>K s. \\<integral>\\<^sup>+t. ?p t \\<partial>measure_pmf D)\"\n      by (auto simp: E_sup_def nn_integral_K_cfg AE_measure_pmf_iff\n               intro!: nn_integral_mono_AE SUP_upper2)\n  next\n    fix D assume D: \"D \\<in> K s\" show \"(\\<integral>\\<^sup>+t. ?p t \\<partial>D) \\<le> (SUP cfg \\<in> cfg_on s. \\<integral>\\<^sup>+ t. ?v t \\<partial>K_cfg cfg)\"\n    proof cases\n      assume p_finite: \"\\<forall>t\\<in>D. ?p t < \\<infinity>\"\n      show ?thesis\n      proof (rule ennreal_le_epsilon)\n        fix e :: real assume \"0 < e\"\n        have \"\\<forall>t\\<in>D. \\<exists>cfg\\<in>cfg_on t. ?p t \\<le> ?v cfg + e\"\n        proof\n          fix t assume \"t \\<in> D\"\n          moreover have \"(SUP cfg \\<in> cfg_on t. ?v cfg) = ?p t\"\n            unfolding E_sup_def by (simp add: cfg_on_def)\n          ultimately have \"(SUP cfg \\<in> cfg_on t. ?v cfg) \\<noteq> \\<infinity>\"\n            using p_finite by auto\n          from SUP_approx_ennreal[OF \\<open>0<e\\<close> _ refl this]\n          show \"\\<exists>cfg\\<in>cfg_on t. ?p t \\<le> ?v cfg + e\"\n            by (auto simp add: E_sup_def intro: less_imp_le)\n        qed\n        then obtain cfg' where v_cfg': \"\\<And>t. t \\<in> D \\<Longrightarrow> ?p t \\<le> ?v (cfg' t) + e\" and\n          cfg_on_cfg': \"\\<And>t. t \\<in> D \\<Longrightarrow> cfg' t \\<in> cfg_on t\"\n          unfolding Bex_def bchoice_iff by blast\n\n        let ?cfg = \"Cfg s D cfg'\"\n        have cfg: \"K_cfg ?cfg = map_pmf cfg' D\"\n          by (auto simp add: K_cfg_def fun_eq_iff cfg_on_cfg' intro!: map_pmf_cong)\n\n        have \"(\\<integral>\\<^sup>+ t. ?p t \\<partial>D) \\<le> (\\<integral>\\<^sup>+t. ?v (cfg' t) + e \\<partial>D)\"\n          by (intro nn_integral_mono_AE) (simp add: v_cfg' AE_measure_pmf_iff)\n        also have \"\\<dots> = (\\<integral>\\<^sup>+t. ?v (cfg' t) \\<partial>D) + e\"\n          using \\<open>0 < e\\<close> measure_pmf.emeasure_space_1[of D]\n          by (subst nn_integral_add) (auto intro: cfg_on_cfg' )\n        also have \"(\\<integral>\\<^sup>+t. ?v (cfg' t) \\<partial>D) = (\\<integral>\\<^sup>+t. ?v t \\<partial>K_cfg ?cfg)\"\n          by (simp add: cfg map_pmf_rep_eq nn_integral_distr)\n        also have \"\\<dots> \\<le> (SUP cfg\\<in>cfg_on s. (\\<integral>\\<^sup>+t. ?v t \\<partial>K_cfg cfg))\"\n          by (auto intro!: SUP_upper intro!: cfg_of_cfg_onI D cfg_on_cfg')\n        finally show \"(\\<integral>\\<^sup>+ t. ?p t \\<partial>D) \\<le> (SUP cfg \\<in> cfg_on s. \\<integral>\\<^sup>+ t. ?v t \\<partial>K_cfg cfg) + e\"\n          by (blast intro: add_mono)\n      qed\n    next\n      assume \"\\<not> (\\<forall>t\\<in>D. ?p t < \\<infinity>)\"\n      then obtain t where \"t \\<in> D\" \"?p t = \\<infinity>\"\n        by (auto simp: not_less top_unique)\n      then have \"\\<infinity> = pmf (D) t * ?p t\"\n        by (auto simp: ennreal_mult_top set_pmf_iff)\n      also have \"\\<dots> = (SUP cfg \\<in> cfg_on t. pmf (D) t * ?v cfg)\"\n        unfolding E_sup_def\n        by (auto simp: SUP_mult_left_ennreal[symmetric])\n      also have \"\\<dots> \\<le> (SUP cfg \\<in> cfg_on s. \\<integral>\\<^sup>+ t. ?v t \\<partial>K_cfg cfg)\"\n        unfolding E_sup_def\n      proof (intro SUP_least SUP_upper2)\n        fix cfg :: \"'s cfg\" assume cfg: \"cfg \\<in> cfg_on t\"\n\n        let ?cfg = \"Cfg s D ((memoryless_on arb_act) (t := cfg))\"\n        have C: \"K_cfg ?cfg = map_pmf ((memoryless_on arb_act) (t := cfg)) D\"\n          by (auto simp add: K_cfg_def fun_eq_iff intro!: map_pmf_cong simp: cfg)\n\n        show \"?cfg \\<in> cfg_on s\"\n          by (auto intro!: cfg_of_cfg_onI D cfg memoryless_on_cfg_onI)\n        have \"ennreal (pmf (D) t) * (\\<integral>\\<^sup>+ x. f (state cfg ## x) \\<partial>T cfg) =\n          (\\<integral>\\<^sup>+t'. (\\<integral>\\<^sup>+ x. f (state cfg ## x) \\<partial>T cfg) * indicator {t} t' \\<partial>D)\"\n          by (auto simp add:  max_def emeasure_pmf_single intro: mult_ac)\n        also have \"\\<dots> = (\\<integral>\\<^sup>+cfg. ?v cfg * indicator {t} (state cfg) \\<partial>K_cfg ?cfg)\"\n          unfolding C using cfg\n          by (auto simp add: nn_integral_distr map_pmf_rep_eq split: split_indicator\n                   simp del: nn_integral_indicator_singleton\n                   intro!: nn_integral_cong)\n        also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+cfg. ?v cfg \\<partial>K_cfg ?cfg)\"\n          by (auto intro!: nn_integral_mono  split: split_indicator)\n        finally show \"ennreal (pmf (D) t) * (\\<integral>\\<^sup>+ x. f (state cfg ## x) \\<partial>T cfg)\n           \\<le> (\\<integral>\\<^sup>+ t. \\<integral>\\<^sup>+ x. f (state t ## x) \\<partial>T t \\<partial>K_cfg ?cfg)\" .\n      qed\n      finally show ?thesis\n        by (simp add: top_unique del: Sup_eq_top_iff SUP_eq_top_iff)\n    qed\n  qed\n  finally show ?thesis .\nqed\n\nlemma E_sup_bot: \"E_sup s \\<bottom> = 0\"\n  by (auto simp add: E_sup_def bot_ennreal)\n\nlemma E_sup_lfp:\n  fixes g\n  defines \"l \\<equiv> \\<lambda>f \\<omega>. g (shd \\<omega>) (f (stl \\<omega>))\"\n  assumes measurable_g[measurable]: \"case_prod g \\<in> borel_measurable (count_space UNIV \\<Otimes>\\<^sub>M borel)\"\n  assumes cont_g: \"\\<And>s. sup_continuous (g s)\"\n  assumes int_g: \"\\<And>f cfg. f \\<in> borel_measurable St \\<Longrightarrow>\n     (\\<integral>\\<^sup>+ \\<omega>. g (state cfg) (f \\<omega>) \\<partial>T cfg) = g (state cfg) (integral\\<^sup>N (T cfg) f)\"\n  shows \"(\\<lambda>s. E_sup s (lfp l)) = lfp (\\<lambda>f s. \\<Squnion>D\\<in>K s. \\<integral>\\<^sup>+t. g t (f t) \\<partial>measure_pmf D)\"\nproof (rule lfp_transfer_bounded[where \\<alpha>=\"\\<lambda>F s. E_sup s F\" and f=l and P=\"\\<lambda>f. f \\<in> borel_measurable St\"])\n  show \"sup_continuous (\\<lambda>f s. \\<Squnion>x\\<in>K s. \\<integral>\\<^sup>+ t. g t (f t) \\<partial>measure_pmf x)\"\n    using cont_g[THEN sup_continuous_compose] by (auto intro!: order_continuous_intros)\n  show \"sup_continuous l\"\n    using cont_g[THEN sup_continuous_compose] by (auto intro!: order_continuous_intros simp: l_def)\n  show \"\\<And>F. (\\<lambda>s. E_sup s \\<bottom>) \\<le> (\\<lambda>s. \\<Squnion>D\\<in>K s. \\<integral>\\<^sup>+ t. g t (F t) \\<partial>measure_pmf D)\"\n    using K_wf by (auto simp: E_sup_bot le_fun_def intro: SUP_upper2 )\nnext\n  fix f :: \"'s stream \\<Rightarrow> ennreal\" assume f: \"f \\<in> borel_measurable St\"\n  moreover\n  have \"E_sup s (\\<lambda>\\<omega>. g s (f \\<omega>)) = g s (E_sup s f)\" for s\n    unfolding E_sup_def using int_g[OF f]\n    by (subst SUP_sup_continuous_ennreal[OF cont_g, symmetric])\n       (auto intro!: SUP_cong simp del: cfg_onD_state dest: cfg_onD_state[symmetric])\n  ultimately show \"(\\<lambda>s. E_sup s (l f)) = (\\<lambda>s. \\<Squnion>D\\<in>K s. \\<integral>\\<^sup>+ t. g t (E_sup t f) \\<partial>measure_pmf D)\"\n    by (subst E_sup_iterate) (auto simp: l_def int_g fun_eq_iff intro!: SUP_cong nn_integral_cong)\nqed (auto simp: bot_fun_def l_def SUP_apply[abs_def] E_sup_SUP)\n\ndefinition \"P_sup s P = (\\<Squnion>cfg\\<in>cfg_on s. emeasure (T cfg) {x\\<in>space St. P x})\"\n\nlemma P_sup_eq_E_sup:\n  assumes [measurable]: \"Measurable.pred St P\"\n  shows \"P_sup s P = E_sup s (indicator {x\\<in>space St. P x})\"\n  by (auto simp add: P_sup_def E_sup_def intro!: SUP_cong nn_integral_cong)\n\nlemma P_sup_True[simp]: \"P_sup t (\\<lambda>\\<omega>. True) = 1\"\n  using T.emeasure_space_1\n  by (auto simp add: P_sup_def SUP_constant)\n\nlemma P_sup_False[simp]: \"P_sup t (\\<lambda>\\<omega>. False) = 0\"\n  by (auto simp add: P_sup_def SUP_constant)\n\nlemma P_sup_SUP:\n  fixes P :: \"nat \\<Rightarrow> 's stream \\<Rightarrow> bool\"\n  assumes \"mono P\" and P[measurable]: \"\\<And>i. Measurable.pred St (P i)\"\n  shows \"P_sup s (\\<lambda>x. \\<exists>i. P i x) = (\\<Squnion>i. P_sup s (P i))\"\nproof -\n  have \"P_sup s (\\<lambda>x. \\<Squnion>i. P i x) = (\\<Squnion>cfg\\<in>cfg_on s. emeasure (T cfg) (\\<Union>i. {x\\<in>space St. P i x}))\"\n    by (auto simp: P_sup_def intro!: SUP_cong arg_cong2[where f=emeasure])\n  also have \"\\<dots> = (\\<Squnion>cfg\\<in>cfg_on s. \\<Squnion>i. emeasure (T cfg) {x\\<in>space St. P i x})\"\n    using \\<open>mono P\\<close> by (auto intro!: SUP_cong SUP_emeasure_incseq[symmetric] simp: mono_def le_fun_def)\n  also have \"\\<dots> = (\\<Squnion>i. P_sup s (P i))\"\n    by (subst SUP_commute) (simp add: P_sup_def)\n  finally show ?thesis\n    by simp\nqed\n\nlemma P_sup_lfp:\n  assumes Q: \"sup_continuous Q\"\n  assumes f: \"f \\<in> measurable St M\"\n  assumes Q_m: \"\\<And>P. Measurable.pred M P \\<Longrightarrow> Measurable.pred M (Q P)\"\n  shows \"P_sup s (\\<lambda>x. lfp Q (f x)) = (\\<Squnion>i. P_sup s (\\<lambda>x. (Q ^^ i) \\<bottom> (f x)))\"\n  unfolding sup_continuous_lfp[OF Q]\n  apply simp\nproof (rule P_sup_SUP)\n  fix i show \"Measurable.pred St (\\<lambda>x. (Q ^^ i) \\<bottom> (f x))\"\n    apply (intro measurable_compose[OF f])\n    by (induct i) (auto intro!: Q_m)\nqed (intro mono_funpow sup_continuous_mono[OF Q] mono_compose[where f=f])\n\nlemma P_sup_iterate:\n  assumes [measurable]: \"Measurable.pred St P\"\n  shows \"P_sup s P = (\\<Squnion>D\\<in>K s. \\<integral>\\<^sup>+ t. P_sup t (\\<lambda>\\<omega>. P (t ## \\<omega>)) \\<partial>measure_pmf D)\"\nproof -\n  have [simp]: \"\\<And>x s. indicator {x \\<in> space St. P x} (x ## s) = indicator {s \\<in> space St. P (x ## s)} s\"\n    by (auto simp: space_stream_space split: split_indicator)\n  show ?thesis\n    using E_sup_iterate[of \"indicator {x\\<in>space St. P x}\" s] by (auto simp: P_sup_eq_E_sup)\nqed\n\ndefinition \"E_inf s f = (\\<Sqinter>cfg\\<in>cfg_on s. \\<integral>\\<^sup>+x. f x \\<partial>T cfg)\"\n\nlemma E_inf_const: \"0 \\<le> c \\<Longrightarrow> E_inf s (\\<lambda>_. c) = c\"\n  using T.emeasure_space_1 by (simp add: E_inf_def)\n\nlemma E_inf_mono:\n  \"(\\<And>\\<omega>. f \\<omega> \\<le> g \\<omega>) \\<Longrightarrow> E_inf s f \\<le> E_inf s g\"\n  unfolding E_inf_def by (intro INF_superset_mono order_refl nn_integral_mono)\n\nlemma E_inf_iterate:\n  assumes [measurable]: \"f \\<in> borel_measurable St\"\n  shows \"E_inf s f = (\\<Sqinter>D\\<in>K s. \\<integral>\\<^sup>+ t. E_inf t (\\<lambda>\\<omega>. f (t ## \\<omega>)) \\<partial>measure_pmf D)\"\nproof -\n  let ?v = \"\\<lambda>t. \\<integral>\\<^sup>+x. f (state t ## x) \\<partial>T t\"\n  let ?p = \"\\<lambda>t. E_inf t (\\<lambda>\\<omega>. f (t ## \\<omega>))\"\n  have \"E_inf s f = (\\<Sqinter>cfg\\<in>cfg_on s. \\<integral>\\<^sup>+t. ?v t \\<partial>K_cfg cfg)\"\n    unfolding E_inf_def by (intro INF_cong refl) (subst nn_integral_T, simp_all add: cfg_on_def)\n  also have \"\\<dots> = (\\<Sqinter>D\\<in>K s. \\<integral>\\<^sup>+t. ?p t \\<partial>measure_pmf D)\"\n  proof (intro antisym INF_greatest)\n    fix cfg :: \"'s cfg\" assume cfg: \"cfg \\<in> cfg_on s\"\n    then show \"(INF D\\<in>K s. \\<integral>\\<^sup>+t. ?p t \\<partial>measure_pmf D) \\<le> (\\<integral>\\<^sup>+ t. ?v t \\<partial>K_cfg cfg)\"\n      by (auto simp add: E_inf_def nn_integral_K_cfg AE_measure_pmf_iff intro!: nn_integral_mono_AE INF_lower2)\n  next\n    fix D assume D: \"D \\<in> K s\" show \"(INF cfg \\<in> cfg_on s. \\<integral>\\<^sup>+ t. ?v t \\<partial>K_cfg cfg) \\<le> (\\<integral>\\<^sup>+t. ?p t \\<partial>D)\"\n    proof (rule ennreal_le_epsilon)\n      fix e :: real assume \"0 < e\"\n      have \"\\<forall>t\\<in>D. \\<exists>cfg\\<in>cfg_on t. ?v cfg \\<le> ?p t + e\"\n      proof\n        fix t assume \"t \\<in> D\"\n        show \"\\<exists>cfg\\<in>cfg_on t. ?v cfg \\<le> ?p t + e\"\n        proof cases\n          assume \"?p t = \\<infinity>\" with cfg_on_not_empty[of t] show ?thesis\n            by (auto simp: top_add simp del: cfg_on_not_empty)\n        next\n          assume p_finite: \"?p t \\<noteq> \\<infinity>\"\n          note \\<open>t \\<in> D\\<close>\n          moreover have \"(INF cfg \\<in> cfg_on t. ?v cfg) = ?p t\"\n            unfolding E_inf_def by (simp add: cfg_on_def)\n          ultimately have \"(INF cfg \\<in> cfg_on t. ?v cfg) \\<noteq> \\<infinity>\"\n            using p_finite by auto\n          from INF_approx_ennreal[OF \\<open>0 < e\\<close> refl this]\n          show \"\\<exists>cfg\\<in>cfg_on t. ?v cfg \\<le> ?p t + e\"\n            by (auto simp: E_inf_def intro: less_imp_le)\n        qed\n      qed\n      then obtain cfg' where v_cfg': \"\\<And>t. t \\<in> D \\<Longrightarrow> ?v (cfg' t) \\<le> ?p t + e\" and\n        cfg_on_cfg': \"\\<And>t. t \\<in> D \\<Longrightarrow> cfg' t \\<in> cfg_on t\"\n        unfolding Bex_def bchoice_iff by blast\n\n      let ?cfg = \"Cfg s D cfg'\"\n\n      have cfg: \"K_cfg ?cfg = map_pmf cfg' D\"\n        by (auto simp add: K_cfg_def cfg_on_cfg' intro!: map_pmf_cong)\n\n      have \"?cfg \\<in> cfg_on s\"\n        by (auto intro: D cfg_on_cfg' cfg_of_cfg_onI)\n      then have \"(INF cfg \\<in> cfg_on s. \\<integral>\\<^sup>+ t. ?v t \\<partial>K_cfg cfg) \\<le> (\\<integral>\\<^sup>+ t. ?p t + e \\<partial>D)\"\n        by (rule INF_lower2) (auto simp: cfg map_pmf_rep_eq nn_integral_distr v_cfg' AE_measure_pmf_iff intro!: nn_integral_mono_AE)\n      also have \"\\<dots> = (\\<integral>\\<^sup>+ t. ?p t \\<partial>D) + e\"\n        using \\<open>0 < e\\<close> by (simp add: nn_integral_add measure_pmf.emeasure_space_1[simplified])\n      finally show \"(INF cfg \\<in> cfg_on s. \\<integral>\\<^sup>+ t. ?v t \\<partial>K_cfg cfg) \\<le> (\\<integral>\\<^sup>+ t. ?p t \\<partial>D) + e\" .\n    qed\n  qed\n  finally show ?thesis .\nqed\n\nlemma emeasure_T_const[simp]: \"emeasure (T s) (space St) = 1\"\n  using T.emeasure_space_1[of s] by simp\n\nlemma E_inf_greatest:\n  \"(\\<And>cfg. cfg \\<in> cfg_on s \\<Longrightarrow> x \\<le> (\\<integral>\\<^sup>+x. f x \\<partial>T cfg)) \\<Longrightarrow> x \\<le> E_inf s f\"\n  unfolding E_inf_def by (rule INF_greatest)\n\nlemma E_inf_lower2:\n  \"cfg \\<in> cfg_on s \\<Longrightarrow> (\\<integral>\\<^sup>+x. f x \\<partial>T cfg) \\<le> x \\<Longrightarrow> E_inf s f \\<le> x\"\n  unfolding E_inf_def by (rule INF_lower2)\n\ntext \\<open>\n  Maybe the following statement can be generalized to infinite @{term \"K s\"}.\n\\<close>\n\nlemma E_inf_lfp:\n  fixes g\n  defines \"l \\<equiv> \\<lambda>f \\<omega>. g (shd \\<omega>) (f (stl \\<omega>))\"\n  assumes measurable_g[measurable]: \"case_prod g \\<in> borel_measurable (count_space UNIV \\<Otimes>\\<^sub>M borel)\"\n  assumes cont_g: \"\\<And>s. sup_continuous (g s)\"\n  assumes int_g: \"\\<And>f cfg. f \\<in> borel_measurable St \\<Longrightarrow>\n     (\\<integral>\\<^sup>+ \\<omega>. g (state cfg) (f \\<omega>) \\<partial>T cfg) = g (state cfg) (integral\\<^sup>N (T cfg) f)\"\n  assumes K_finite: \"\\<And>s. finite (K s)\"\n  shows \"(\\<lambda>s. E_inf s (lfp l)) = lfp (\\<lambda>f s. \\<Sqinter>D\\<in>K s. \\<integral>\\<^sup>+t. g t (f t) \\<partial>measure_pmf D)\"\nproof (rule antisym)\n  let ?F = \"\\<lambda>F s. \\<Sqinter>D\\<in>K s. \\<integral>\\<^sup>+ t. g t (F t) \\<partial>measure_pmf D\"\n  let ?I = \"\\<lambda>D. (\\<integral>\\<^sup>+t. g t (lfp ?F t) \\<partial>measure_pmf D)\"\n  have mono_F: \"mono ?F\"\n    using sup_continuous_mono[OF cont_g]\n    by (force intro!: INF_mono nn_integral_mono monoI simp: mono_def le_fun_def)\n  define ct where \"ct s = (SOME D. D \\<in> K s \\<and> (lfp ?F s = ?I D))\" for s\n  { fix s\n    have \"finite (?I ` K s)\"\n      by (auto intro: K_finite)\n    then obtain D where \"D \\<in> K s\" \"?I D = Min (?I ` K s)\"\n      by (auto simp: K_wf dest!: Min_in)\n    note this(2)\n    also have \"\\<dots> = (INF D \\<in> K s. ?I D)\"\n      using K_wf by (subst Min_Inf) (auto intro: K_finite)\n    also have \"\\<dots> = lfp ?F s\"\n      by (rewrite in \"_ = \\<hole>\" lfp_unfold[OF mono_F]) auto\n    finally have \"\\<exists>D. D \\<in> K s \\<and> (lfp ?F s = ?I D)\"\n      using \\<open>D \\<in> K s\\<close> by auto\n    then have \"ct s \\<in> K s \\<and> (lfp ?F s = ?I (ct s))\"\n      unfolding ct_def by (rule someI_ex)\n    then have \"ct s \\<in> K s\" \"lfp ?F s = ?I (ct s)\"\n      by auto }\n  note ct = this\n  then have ct_cfg_on[simp]: \"\\<And>s. memoryless_on ct s \\<in> cfg_on s\"\n    by (intro memoryless_on_cfg_onI) simp\n  then show \"(\\<lambda>s. E_inf s (lfp l)) \\<le> lfp ?F\"\n  proof (intro le_funI, rule E_inf_lower2)\n    fix s\n    define P where \"P f cfg = \\<integral>\\<^sup>+ t. g (state t) (f t) \\<partial>K_cfg cfg\" for f cfg\n    have \"integral\\<^sup>N (T (memoryless_on ct s)) (lfp l) = lfp P (memoryless_on ct s)\"\n      unfolding P_def l_def using measurable_g cont_g int_g by (rule nn_integral_T_lfp)\n    also have \"\\<dots> = (SUP i. (P ^^ i) \\<bottom>) (memoryless_on ct s)\"\n      by (rewrite sup_continuous_lfp)\n         (auto intro!: order_continuous_intros cont_g[THEN sup_continuous_compose] simp: P_def)\n    also have \"\\<dots> = (SUP i. (P ^^ i) \\<bottom> (memoryless_on ct s))\"\n      by (simp add: image_comp)\n    also have \"\\<dots> \\<le> lfp ?F s\"\n    proof (rule SUP_least)\n      fix i show \"(P ^^ i) \\<bottom> (memoryless_on ct s) \\<le> lfp ?F s\"\n      proof (induction i arbitrary: s)\n        case 0 then show ?case\n          by simp\n      next\n        case (Suc n)\n        have \"(P ^^ Suc n) \\<bottom> (memoryless_on ct s) =\n          (\\<integral>\\<^sup>+ t. g t ((P ^^ n) \\<bottom> (memoryless_on ct t)) \\<partial>ct s)\"\n          by (auto simp add: P_def K_cfg_def AE_measure_pmf_iff intro!: nn_integral_cong_AE)\n        also have \"\\<dots> \\<le> (\\<integral>\\<^sup>+ t. g t (lfp ?F t) \\<partial>ct s)\"\n          by (intro nn_integral_mono sup_continuous_mono[OF cont_g, THEN monoD] Suc)\n        also have \"\\<dots> = lfp ?F s\"\n          by (rule  ct(2) [symmetric])\n        finally show ?case .\n      qed\n    qed\n    finally show \"integral\\<^sup>N (T (memoryless_on ct s)) (lfp l) \\<le> lfp ?F s\" .\n  qed\n\n  have cont_l: \"sup_continuous l\"\n    by (auto simp: l_def intro!: order_continuous_intros cont_g[THEN sup_continuous_compose])\n\n  show \"lfp ?F \\<le> (\\<lambda>s. E_inf s (lfp l))\"\n  proof (intro lfp_lowerbound le_funI)\n    fix s show \"(\\<Sqinter>x\\<in>K s. \\<integral>\\<^sup>+ t. g t (E_inf t (lfp l)) \\<partial>measure_pmf x) \\<le> E_inf s (lfp l)\"\n    proof (rewrite in \"_ \\<le> \\<hole>\" E_inf_iterate)\n      show l: \"lfp l \\<in> borel_measurable St\"\n        using cont_l by (rule borel_measurable_lfp) (simp add: l_def)\n      show \"(\\<Sqinter>D\\<in>K s. \\<integral>\\<^sup>+ t. g t (E_inf t (lfp l)) \\<partial>measure_pmf D) \\<le>\n        (\\<Sqinter>D\\<in>K s. \\<integral>\\<^sup>+ t. E_inf t (\\<lambda>\\<omega>. lfp l (t ## \\<omega>)) \\<partial>measure_pmf D)\"\n      proof (rule INF_mono nn_integral_mono bexI)+\n        fix t D assume \"D \\<in> K s\"\n        { fix cfg assume \"cfg \\<in> cfg_on t\"\n          have \"(\\<integral>\\<^sup>+ \\<omega>. g (state cfg) (lfp l \\<omega>) \\<partial>T cfg) = g (state cfg) (\\<integral>\\<^sup>+ \\<omega>. (lfp l \\<omega>) \\<partial>T cfg)\"\n            using l by (rule int_g)\n          with \\<open>cfg \\<in> cfg_on t\\<close> have *: \"(\\<integral>\\<^sup>+ \\<omega>. g t (lfp l \\<omega>) \\<partial>T cfg) = g t (\\<integral>\\<^sup>+ \\<omega>. (lfp l \\<omega>) \\<partial>T cfg)\"\n            by simp }\n        then\n        have *: \"g t (\\<Sqinter>cfg\\<in>cfg_on t. integral\\<^sup>N (T cfg) (lfp l)) \\<le> (\\<Sqinter>cfg\\<in>cfg_on t. \\<integral>\\<^sup>+ \\<omega>. g t (lfp l \\<omega>) \\<partial>T cfg)\"\n          apply simp\n          apply (rule INF_greatest)\n          apply (rule sup_continuous_mono[OF cont_g, THEN monoD])\n          apply (rule INF_lower)\n          apply assumption\n          done\n        show \"g t (E_inf t (lfp l)) \\<le> E_inf t (\\<lambda>\\<omega>. lfp l (t ## \\<omega>))\"\n          apply (rewrite in \"_ \\<le> \\<hole>\" lfp_unfold[OF sup_continuous_mono[OF cont_l]])\n          apply (rewrite in \"_ \\<le> \\<hole>\" l_def)\n          apply (simp add: E_inf_def *)\n          done\n      qed\n    qed\n  qed\nqed\n\ndefinition \"P_inf s P = (\\<Sqinter>cfg\\<in>cfg_on s. emeasure (T cfg) {x\\<in>space St. P x})\"\n\nlemma P_inf_eq_E_inf:\n  assumes [measurable]: \"Measurable.pred St P\"\n  shows \"P_inf s P = E_inf s (indicator {x\\<in>space St. P x})\"\n  by (auto simp add: P_inf_def E_inf_def intro!: SUP_cong nn_integral_cong)\n\nlemma P_inf_True[simp]: \"P_inf t (\\<lambda>\\<omega>. True) = 1\"\n  using T.emeasure_space_1\n  by (auto simp add: P_inf_def SUP_constant)\n\nlemma P_inf_False[simp]: \"P_inf t (\\<lambda>\\<omega>. False) = 0\"\n  by (auto simp add: P_inf_def SUP_constant)\n\n\n\nlemma P_inf_gfp:\n  assumes Q: \"inf_continuous Q\"\n  assumes f: \"f \\<in> measurable St M\"\n  assumes Q_m: \"\\<And>P. Measurable.pred M P \\<Longrightarrow> Measurable.pred M (Q P)\"\n  shows \"P_inf s (\\<lambda>x. gfp Q (f x)) = (\\<Sqinter>i. P_inf s (\\<lambda>x. (Q ^^ i) \\<top> (f x)))\"\n  unfolding inf_continuous_gfp[OF Q]\n  apply simp\nproof (rule P_inf_INF)\n  fix i show \"Measurable.pred St (\\<lambda>x. (Q ^^ i) \\<top> (f x))\"\n    apply (intro measurable_compose[OF f])\n    by (induct i) (auto intro!: Q_m)\nnext\n  show \"decseq (\\<lambda>i x. (Q ^^ i) \\<top> (f x))\"\n    using inf_continuous_mono[OF Q, THEN funpow_increasing[rotated]]\n    unfolding decseq_def le_fun_def by auto\nqed\n\nlemma P_inf_iterate:\n  assumes [measurable]: \"Measurable.pred St P\"\n  shows \"P_inf s P = (\\<Sqinter>D\\<in>K s. \\<integral>\\<^sup>+ t. P_inf t (\\<lambda>\\<omega>. P (t ## \\<omega>)) \\<partial>measure_pmf D)\"\nproof -\n  have [simp]: \"\\<And>x s. indicator {x \\<in> space St. P x} (x ## s) = indicator {s \\<in> space St. P (x ## s)} s\"\n    by (auto simp: space_stream_space split: split_indicator)\n  show ?thesis\n    using E_inf_iterate[of \"indicator {x\\<in>space St. P x}\" s] by (auto simp: P_inf_eq_E_inf)\nqed\n\nend\n\nsubsection \\<open>Finite MDPs\\<close>\n\nlocale Finite_Markov_Decision_Process = Markov_Decision_Process K for K :: \"'s \\<Rightarrow> 's pmf set\" +\n  fixes S :: \"'s set\"\n  assumes S_not_empty: \"S \\<noteq> {}\"\n  assumes S_finite: \"finite S\"\n  assumes K_closed: \"\\<And>s. s \\<in> S \\<Longrightarrow> (\\<Union>D\\<in>K s. set_pmf D) \\<subseteq> S\"\n  assumes K_finite: \"\\<And>s. s \\<in> S \\<Longrightarrow> finite (K s)\"\nbegin\n\nlemma action_closed: \"s \\<in> S \\<Longrightarrow> cfg \\<in> cfg_on s \\<Longrightarrow> t \\<in> action cfg \\<Longrightarrow> t \\<in> S\"\n  using cfg_onD_action[of cfg s] K_closed[of s] by auto\n\nlemma set_pmf_closed: \"s \\<in> S \\<Longrightarrow> D \\<in> K s \\<Longrightarrow> t \\<in> D \\<Longrightarrow> t \\<in> S\"\n  using K_closed by auto\n\nlemma Pi_closed: \"ct \\<in> Pi S K \\<Longrightarrow> s \\<in> S \\<Longrightarrow> t \\<in> ct s \\<Longrightarrow> t \\<in> S\"\n  using set_pmf_closed by auto\n\n\n\nlemma set_pmf_finite: \"s \\<in> S \\<Longrightarrow> D \\<in> K s \\<Longrightarrow> finite D\"\n  using K_closed by (intro finite_subset[OF _ S_finite]) auto\n\ndefinition \"valid_cfg = (\\<Union>s\\<in>S. cfg_on s)\"\n\nlemma valid_cfgI: \"s \\<in> S \\<Longrightarrow> cfg \\<in> cfg_on s \\<Longrightarrow> cfg \\<in> valid_cfg\"\n  by (auto simp: valid_cfg_def)\n\nlemma valid_cfgD: \"cfg \\<in> valid_cfg \\<Longrightarrow> cfg \\<in> cfg_on (state cfg)\"\n  by (auto simp: valid_cfg_def)\n\nlemma\n  shows valid_cfg_state_in_S: \"cfg \\<in> valid_cfg \\<Longrightarrow> state cfg \\<in> S\"\n    and valid_cfg_action: \"cfg \\<in> valid_cfg \\<Longrightarrow> s \\<in> action cfg \\<Longrightarrow> s \\<in> S\"\n    and valid_cfg_cont: \"cfg \\<in> valid_cfg \\<Longrightarrow> s \\<in> action cfg \\<Longrightarrow> cont cfg s \\<in> valid_cfg\"\n  by (auto simp: valid_cfg_def intro!: bexI[of _ s] intro: action_closed)\n\nlemma valid_K_cfg[intro]: \"cfg \\<in> valid_cfg \\<Longrightarrow> cfg' \\<in> K_cfg cfg \\<Longrightarrow> cfg' \\<in> valid_cfg\"\n  by (auto simp add: K_cfg_def valid_cfg_cont)\n\ndefinition \"simple ct = memoryless_on (\\<lambda>s. if s \\<in> S then ct s else arb_act s)\"\n\nlemma simple_cfg_on[simp]: \"ct \\<in> Pi S K \\<Longrightarrow> simple ct s \\<in> cfg_on s\"\n  by (auto simp: simple_def intro!: memoryless_on_cfg_onI)\n\nlemma simple_valid_cfg[simp]: \"ct \\<in> Pi S K \\<Longrightarrow> s \\<in> S \\<Longrightarrow> simple ct s \\<in> valid_cfg\"\n  by (auto intro: valid_cfgI)\n\nlemma cont_simple[simp]: \"s \\<in> S \\<Longrightarrow> t \\<in> set_pmf (ct s) \\<Longrightarrow> cont (simple ct s) t = simple ct t\"\n  by (simp add: simple_def)\n\nlemma state_simple[simp]: \"state (simple ct s) = s\"\n  by (simp add: simple_def)\n\nlemma action_simple[simp]: \"s \\<in> S \\<Longrightarrow> action (simple ct s) = ct s\"\n  by (simp add: simple_def)\n\nlemma simple_valid_cfg_iff: \"ct \\<in> Pi S K \\<Longrightarrow> simple ct s \\<in> valid_cfg \\<longleftrightarrow> s \\<in> S\"\n  using cfg_onD_state[of \"simple ct s\"] by (auto simp add: valid_cfg_def intro!: bexI[of _ s])\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Markov_Models/Markov_Decision_Process.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.546738151984614, "lm_q1q2_score": 0.3157387487413705}}
{"text": "section \\<open> Theory of Invariants \\<close>\n\ntheory utp_des_invariants\n  imports utp_des_theory\nbegin\n\ntext \\<open> The theory of invariants formalises operation and state invariants based on the theory\n  of designs. For more information, please see the associated paper~\\cite[Section~4]{Cavalcanti2012}. \\<close>\n\nsubsection \\<open> Operation Invariants \\<close>\n\ndefinition \"OIH(\\<psi>)(D) = (D \\<and> ($ok \\<and> \\<not> D\\<^sup>f \\<Rightarrow> \\<psi>))\"\n\ndeclare OIH_def [upred_defs]\n\nlemma OIH_design:\n  assumes \"D is H1_H2\"\n  shows \"OIH(\\<psi>)(D) = ((\\<not> D\\<^sup>f) \\<turnstile> (D\\<^sup>t \\<and> \\<psi>))\"\nproof -\n  from assms have \"OIH(\\<psi>)(D) = (((\\<not> D\\<^sup>f) \\<turnstile> D\\<^sup>t) \\<and> ($ok \\<and> \\<not> D\\<^sup>f \\<Rightarrow> \\<psi>))\"\n    by (metis H1_H2_commute H1_H2_is_design H1_idem Healthy_def' OIH_def)\n  also have \"... = (($ok \\<and> \\<not> D\\<^sup>f \\<Rightarrow> $ok\\<acute> \\<and> D\\<^sup>t) \\<and> ($ok \\<and> \\<not> D\\<^sup>f \\<Rightarrow> \\<psi>))\"\n    by (simp add: design_def)\n  also have \"... = ((\\<not> D\\<^sup>f) \\<turnstile> (D\\<^sup>t \\<and> \\<psi>))\"\n    by (pred_auto)\n  finally show ?thesis .\nqed\n\nlemma OIH_idem:\n  assumes \"D is H1_H2\" \"$ok\\<acute> \\<sharp> \\<psi>\"\n  shows \"OIH(\\<psi>)(OIH(\\<psi>)(D)) = OIH(\\<psi>)(D)\"\n  using assms\n  by (simp add: OIH_design design_is_H1_H2 unrest) (simp add: design_def usubst, rel_auto)\n\nlemma OIH_of_design:\n  \"$ok\\<acute> \\<sharp> P \\<Longrightarrow> OIH(\\<psi>)(P \\<turnstile> Q) = (P \\<turnstile> (Q \\<and> \\<psi>))\"\n  by (simp add: OIH_def design_def usubst, rel_auto)\n\nsubsection \\<open> State Invariants \\<close>\n\ndefinition \"ISH(\\<psi>)(D) = (D \\<or> ($ok \\<and> \\<not> D\\<^sup>f \\<and> \\<lceil>\\<psi>\\<rceil>\\<^sub>< \\<Rightarrow> $ok\\<acute> \\<and> D\\<^sup>t))\"\n\ndeclare ISH_def [upred_defs]\n\nlemma ISH_design: \"ISH(\\<psi>)(D) = (\\<not> D\\<^sup>f \\<and> \\<lceil>\\<psi>\\<rceil>\\<^sub><) \\<turnstile> D\\<^sup>t\"\n  by (rel_auto, metis+)\n\nlemma ISH_idem: \"ISH(\\<psi>)(ISH(\\<psi>)(D)) = ISH(\\<psi>)(D)\"\n  by (simp add: ISH_design usubst design_def, pred_auto)\n\nlemma ISH_of_design:\n  \"\\<lbrakk> $ok\\<acute> \\<sharp> P; $ok\\<acute> \\<sharp> Q \\<rbrakk> \\<Longrightarrow> ISH(\\<psi>)(P \\<turnstile> Q) = ((P \\<and> \\<lceil>\\<psi>\\<rceil>\\<^sub><) \\<turnstile> Q)\"\n  by (simp add: ISH_design design_def usubst, pred_auto)\n\ndefinition \"OSH(\\<psi>)(D) = (D \\<and> ($ok \\<and> \\<not> D\\<^sup>f \\<and> \\<lceil>\\<psi>\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>\\<psi>\\<rceil>\\<^sub>>))\"\n\ndeclare OSH_def [upred_defs]\n\nlemma OSH_as_OIH:\n  \"OSH(\\<psi>)(D) = OIH(\\<lceil>\\<psi>\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>\\<psi>\\<rceil>\\<^sub>>)(D)\"\n  by (simp add: OSH_def OIH_def, pred_auto)\n\nlemma OSH_design:\n  assumes \"D is H1_H2\"\n  shows \"OSH(\\<psi>)(D) = ((\\<not> D\\<^sup>f) \\<turnstile> (D\\<^sup>t \\<and> (\\<lceil>\\<psi>\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>\\<psi>\\<rceil>\\<^sub>>)))\"\n  by (simp add: OSH_as_OIH OIH_design assms)\n\nlemma OSH_of_design:\n  \"\\<lbrakk> $ok\\<acute> \\<sharp> P; $ok\\<acute> \\<sharp> Q \\<rbrakk> \\<Longrightarrow> OSH(\\<psi>)(P \\<turnstile> Q) = (P \\<turnstile> (Q \\<and> (\\<lceil>\\<psi>\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>\\<psi>\\<rceil>\\<^sub>>)))\"\n  by (simp add: OSH_design design_is_H1_H2 unrest, simp add: design_def usubst, pred_auto)\n\ndefinition \"SIH(\\<psi>) = ISH(\\<psi>) \\<circ> OSH(\\<psi>)\"\n\ndeclare SIH_def [upred_defs]\n\nlemma SIH_of_design:\n  \"\\<lbrakk> $ok\\<acute> \\<sharp> P; $ok\\<acute> \\<sharp> Q; ok \\<sharp> \\<psi> \\<rbrakk> \\<Longrightarrow> SIH(\\<psi>)(P \\<turnstile> Q) = ((P \\<and> \\<lceil>\\<psi>\\<rceil>\\<^sub><) \\<turnstile> (Q \\<and> \\<lceil>\\<psi>\\<rceil>\\<^sub>>))\"\n  by (simp add: SIH_def OSH_of_design ISH_of_design unrest, pred_auto)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/designs/utp_des_invariants.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3157387487413704}}
{"text": "theory Coll_Test\nimports \n  \"../../Refine_Dflt\" \n  \"Succ_Graph\"\nbegin\n\ndeclare [[autoref_trace_failed_id]]\n\ncontext begin interpretation autoref_syn .\n\nschematic_goal \"(?c::?'c,\n  RETURN (({(1::nat,2::nat),(3,4)}):::(\\<langle>\\<langle>nat_rel,nat_rel\\<rangle>prod_rel\\<rangle>(map2set_rel (ahm_rel ?bhc))) )\n)\\<in>?R\"\n  apply autoref_monadic\n  done\n\nterm dflt_ahs_rel\n\nschematic_goal \"(?c::?'c, \\<lambda>(a::'a::hashable) (b::'a::hashable).\n  ({(a,b)}:::\\<langle>?Rk::(?'b::hashable\\<times>_) set\\<rangle>dflt_ahs_rel)\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nsubsection \"Foreach-Loops\"\nschematic_goal \"(?c::?'c,\n  FOREACH {1,2,3::nat} (\\<lambda>i s. RETURN (i+s)) 0\n)\\<in>?R\"\n  apply autoref_monadic\n  done\n\nschematic_goal \"(?c::?'c,\n  FOREACH (map_to_set [1::nat\\<mapsto>True, 2\\<mapsto>False]) (\\<lambda>(k,v) s. RETURN (k+s)) 0\n)\\<in>?R\"\n  apply autoref_monadic\n  done\n\n(* TODO: generic algorithm for bounded hash code of sets! *)\nschematic_goal \"(?c::?'c,\n  FOREACH \n    (map_to_set ([{1::nat}\\<mapsto>True, {2}\\<mapsto>False]:::\\<langle>\\<langle>nat_rel\\<rangle>dflt_rs_rel,bool_rel\\<rangle>(rbt_map_rel ?cmp))) \n    (\\<lambda>(k,v) s. RETURN (v\\<and>s)) False\n)\\<in>?R\"\n  apply autoref_monadic\n  done\n\nsubsection \"Array Hash Map Tests\"\n\nschematic_goal\n  \"(?f::?'c, \\<lambda>m. (m)(1::nat\\<mapsto>2::nat)) \\<in> ?R\"\n  apply (autoref (keep_goal))\n  done\n\n\nschematic_goal\n  \"(?f::?'c, \\<lambda>m. (m:::\\<langle>Id,Id\\<rangle>dflt_ahm_rel)(1::nat\\<mapsto>2::nat)) \\<in> ?R\"\napply (autoref (keep_goal))\ndone\n\nschematic_goal\n  \"(?f::?'c, Map.empty:::\\<langle>Id,Id\\<rangle>dflt_ahm_rel) \\<in> ?R\"\napply (autoref)\ndone\n\nschematic_goal\n  fixes mi m\n  (* TODO: Obviously, we cannot override the tyREL-rule for \n    \"nat\\<rightharpoonup>nat\" with this: *)\n  assumes [autoref_rules]: \"(mi,m)\\<in>\\<langle>nat_rel,nat_rel\\<rangle>dflt_ahm_rel\"\n  shows \"(?f::?'c, \n    RETURN (card (dom (m:::\\<langle>nat_rel,nat_rel\\<rangle>dflt_ahm_rel)))) \\<in> ?R\"\n  apply (autoref_monadic)\n  done\n\n(* Optimizations *)\n\nsubsection \"List Map Tests\"\n\ndefinition foo::\"(nat\\<rightharpoonup>nat) nres\" where \"foo \\<equiv>\n  do {\n    let X = Map.empty;\n    ASSERT (1 \\<notin> dom X);\n    RETURN (X(1 \\<mapsto> 2))\n  }\"\n\nschematic_goal list_map_update_dj_test:\n  \"(?f::?'c, foo ::: \\<langle>\\<langle>Id,Id\\<rangle>list_map_rel\\<rangle>nres_rel) \\<in> ?R\"\n  unfolding foo_def \n  apply autoref_monadic\n  done\n\nschematic_goal \n  \"(?f::?'c, [1::nat \\<mapsto> 2::nat, 3\\<mapsto>4] ::: \\<langle>nat_rel,nat_rel\\<rangle>list_map_rel) \\<in> ?R\"\n  apply autoref\n  done\n\nschematic_goal list_map_test:\n  \"(?f::?'c, RETURN (([1 \\<mapsto> 2, 3::nat \\<mapsto> 4::nat]\n       :::\\<langle>nat_rel,nat_rel\\<rangle>list_map_rel) |`(-{1}))) \\<in> ?R\"\napply (autoref_monadic)\ndone\nconcrete_definition list_map_test uses list_map_test\nvalue list_map_test\n\n(* Why does this work:*)\nschematic_goal\n  \"(?f::?'c, RETURN (card (dom ([1 \\<mapsto> 2, 3::nat \\<mapsto> 4::nat]\n       :::\\<langle>nat_rel,nat_rel\\<rangle>list_map_rel)))) \\<in> ?R\"\napply (autoref_monadic)\ndone\n\n(* But this doesn't? This is not specific to list_map;\n   it doesn't work with dflt_rbt_rel either.*)\n(*schematic_lemma\n  \"(?f::?'c, RETURN (dom ([1 \\<mapsto> 2, 3::nat \\<mapsto> 4::nat]\n       :::\\<langle>nat_rel,nat_rel\\<rangle>list_map_rel))) \\<in> ?R\"\napply (autoref_monadic)\ndone*)\n\n\nsubsection \"Array-Map Tests\"\n\nterm \"{1,2::nat} \\<union> {3,4}\"\n\nschematic_goal array_set_test_code:\n  \"(?f::?'c, RETURN (({1,2::nat} \\<union> {3,4} \n       ::: \\<langle>nat_rel\\<rangle>iam_set_rel )))\\<in>?R\" \nby (autoref_monadic (trace))\n\nconcrete_definition array_set_test uses array_set_test_code\nprint_theorems\nvalue array_set_test\n\nschematic_goal\n  \"(?f::?'c, RETURN (({1} ::: \\<langle>nat_rel\\<rangle>dflt_rs_rel) = {}))\\<in>?R\" \napply (autoref_monadic (trace))\ndone\n\nschematic_goal\n  \"(?f::?'c, RETURN (card {1,2,3::nat}))\\<in>?R\" \napply (autoref_monadic (trace))\ndone\n\nschematic_goal\n  \"(?f::?'c, RETURN (\\<forall>x\\<in>{1,2,3::nat}. x<4))\\<in>?R\" \napply (autoref_monadic (trace))\ndone\n\nschematic_goal\n  \"(?f::?'c, RETURN (\\<exists>x\\<in>{1,2,3::nat}. x<4))\\<in>?R\" \napply (autoref_monadic (trace))\ndone\n\nschematic_goal\n  \"(?f::?'c, RETURN (({1} ::: \\<langle>nat_rel\\<rangle>iam_set_rel) = {}))\\<in>?R\" \n  apply (autoref_monadic (trace))\n  done\n\nschematic_goal\n  assumes [autoref_rules]: \"(f,f')\\<in>nat_rel\\<rightarrow>Rb\"\n  shows \"(?f::?'c,f' 3)\\<in>?R\"\n  by (autoref)\n\n\nschematic_goal \"(?f::?'c,\n  RETURN (({1,2::nat} \\<times> {3,4::nat}) ::: \\<langle>\\<langle>Id,Id\\<rangle>prod_rel\\<rangle>dflt_rs_rel)\n)\\<in>?R\"\n  by autoref_monadic\n\nschematic_goal \"(?f::?'c,\n  RETURN ({1,2::nat} \\<inter> ({3,4::nat}) ::: \\<langle>Id\\<rangle>list_set_rel)\n)\\<in>?R\"\n  by autoref_monadic\n\nschematic_goal \"(?f::?'c,\n  RETURN ({1,2::nat} \\<inter> ({3,4::nat}) ::: \\<langle>Id\\<rangle>dflt_rs_rel)\n)\\<in>?R\"\n  by autoref_monadic\n\nschematic_goal \"(?f::?'c,\n  RETURN (card (dom ([ 1::nat \\<mapsto> True, 2\\<mapsto>False ] ::: \\<langle>Id,Id\\<rangle>dflt_rm_rel )))\n)\\<in>?R\"\n  by autoref_monadic\n\ntext {* A hairy case for the operator identification heuristics for maps: *}\nschematic_goal \n  shows \"(?f::?'c,\n  \\<lambda>m (x::'a::linorder) (y::'b::linorder). case_option\n    None\n    (\\<lambda>m'. m' y)\n    (m x)\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\n\nschematic_goal \n  shows \"(?f::?'c,\n  \\<lambda>m (x::'a::hashable) (y::'b::hashable). case_option\n    None\n    (\\<lambda>m'. m' y)\n    (m x)\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\n\nschematic_goal \n  shows \"(?f::?'c,\n  \\<lambda>m (x::'a::hashable) (y::'b::linorder). case_option\n    None\n    (\\<lambda>m'. m' y)\n    (m (x:::Id))\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\n\nschematic_goal \"(?f::?'c,\n  {1,2::'a::numeral} \\<times> {3,4::'a}\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c,\n  {1,2::'a::{numeral,hashable}} \\<times> ({3,4::'a} ::: \\<langle>Id\\<rangle>dflt_ahs_rel)\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c,\n  {1,2::nat} \\<times> {3,4::nat}\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c,\n  {1,2::nat} \\<inter> {3,4::nat}\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c,\n  RETURN (({1,2::nat} \\<times> {3,4::nat}) ::: \\<langle>\\<langle>Id,Id\\<rangle>prod_rel\\<rangle>dflt_rs_rel)\n)\\<in>?R\"\n  by autoref_monadic\n\n(* TODO: ty_REL hint is ignored. Reason: Seems to not properly work with GAs! *)\nschematic_goal \n  notes [autoref_tyrel] = ty_REL[where 'a = \"(nat\\<times>nat) set\" \n    and R=\"\\<langle>\\<langle>Id,Id\\<rangle>prod_rel\\<rangle>dflt_rs_rel\"] \n  shows \"(?f::?'c,\n    RETURN (({1,2::nat} \\<times> {3,4::nat}))\n  )\\<in>?R\"\n  by autoref_monadic\n\n(* TODO: Iterator optimization does not capture \n    foldli ((map fst \\<circ> rbt_to_list) x)\npattern!\n*)\n\ntext {* We have an optimized version for add on red-black trees *}\nschematic_goal \"(?f::?'c,\n  [ 1::nat \\<mapsto> True, 2::nat \\<mapsto> False ] ++ [ 3::nat \\<mapsto> True, 4::nat \\<mapsto> False ]\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\ntext {* The optimized version is also transfered through the map2set converter *}\nschematic_goal \"(?f::?'c,\n  {1,2::nat} \\<union> {3,4}\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\ntext {* For list-sets, the generic version is used *}\nschematic_goal \"(?f::?'c,\n  {1,2::nat} \\<union> {3,4} ::: \\<langle>Id\\<rangle>list_set_rel\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\n\nlemma is_refgoal: \"(c,a)\\<in>R \\<Longrightarrow> (c,a)\\<in>R\" .\n\nschematic_goal \"(?f::?'c,\n  ({{1::nat}:::\\<langle>Id\\<rangle> map2set_rel dflt_rm_rel} ) \n  \\<union> ({{2,3,4,5,5,6,7,8,98,9,0}}) \n)\\<in>?R\"\n  by (autoref (keep_goal))\n\n\ntext {* The next two lemmas demonstrate optimization: The insert-operation\n  is translated by @{term \"op #\"} *}\nschematic_goal \"(?f::?'c, {1,2,3,4::nat}:::\\<langle>Id\\<rangle>list_set_rel\n  )\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \n  \"(?f::?'c, {{1},{2},{3},{4::nat}}:::\\<langle>?R'::(?'d\\<times>_) set\\<rangle>list_set_rel\n  )\\<in>?R\"\n  by (autoref (keep_goal))\n\n\nschematic_goal \"(?f::?'c,\n  SPEC (\\<lambda>x. x\\<in>({1,2,3::nat}:::\\<langle>Id\\<rangle>dflt_rs_rel)) \n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nschematic_goal \"(?f::?'c,\n  \\<lambda>s::nat set. {s} \\<union> {{1,2,3}} = {{1}}\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nschematic_goal \"(?f::?'c,\n  \\<forall>(k,v)\\<in>map_to_set [1::nat\\<mapsto>2::nat]. k>v\n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c, do {\n  let s = ({1,2,3::nat}:::\\<langle>Id\\<rangle>dflt_rs_rel);\n  FOREACH s (\\<lambda>n s. RETURN (n+s)) 0\n}\n)\\<in>?R\"\n  by autoref_monadic\n\nschematic_goal \"(?f::?'c, do {\n  let s = ({{1,2,3::nat}, {}, {1,2}});\n  FOREACH s (\\<lambda>n s. RETURN (n \\<union> s)) {}\n}\n)\\<in>?R\"\n  by (autoref_monadic)\n\nschematic_goal \"(?f::?'c,\n  ({{1::nat}} ) \n  \\<union> ({{2,3,4,5,5,6,7,8,98,9,0}}) \n)\\<in>?R\"\n  by (autoref (keep_goal))\n\nschematic_goal \"(?f::?'c,\n  SPEC (\\<lambda>x. x\\<in>({1,2,3::nat})) \n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nschematic_goal \"(?f::?'c,\n  \\<lambda>s::nat set. {s} \\<union> {{1,2,3}} = {{1}}\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nschematic_goal \"(?f::?'c,\n  \\<forall>(k,v)\\<in>map_to_set [1::nat\\<mapsto>2::nat]. k>v\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nschematic_goal \"(?f::?'c,\n  [ 1::nat \\<mapsto> [ 2::nat \\<mapsto> 3::nat, 1::nat \\<mapsto> 3::nat ] ]\n)\\<in>?R\"\n  apply (autoref (keep_goal))\n  done\n\nend\n\ntext {* Indirect Annotation *}\nconsts \n  rel_set1 :: rel_name\n  rel_set2 :: rel_name\n\n\ncontext begin interpretation autoref_syn .\n\ndefinition \n  \"algo \\<equiv> ( {1,2,3::nat}::#rel_set1, {1,2,3::nat}::#rel_set2 )\"\n\nschematic_goal \n  notes [autoref_rel_indirect] = \n    REL_INDIRECT[of rel_set1 \"\\<langle>Rk\\<rangle>list_set_rel\" for Rk]\n    REL_INDIRECT[of rel_set2 \"\\<langle>Rk\\<rangle>dflt_rs_rel\" for Rk]\n  shows \"(?f::?'c,algo) \\<in> ?R\"\n  unfolding algo_def\n  by (autoref)\n\nschematic_goal \n  notes [autoref_rel_indirect] = \n    REL_INDIRECT[of rel_set1 \"\\<langle>Rk\\<rangle>dflt_rs_rel\" for Rk]\n    REL_INDIRECT[of rel_set2 \"\\<langle>Rk\\<rangle>dflt_rs_rel\" for Rk]\n  shows \"(?f::?'c,algo) \\<in> ?R\"\n  unfolding algo_def\n  by (autoref)\n\n\n\ntext {* A witness of the red algorithm is a node on the stack and a path\n  to this node *}\ntype_synonym 'v red_witness = \"('v list \\<times> 'v) option\"\ntext {* Prepend node to red witness *}\nfun prep_wit_red :: \"'v \\<Rightarrow> 'v red_witness \\<Rightarrow> 'v red_witness\" where\n  \"prep_wit_red v None = None\"\n| \"prep_wit_red v (Some (p,u)) = Some (v#p,u)\"\n\ntext {* \n  Initial witness for node @{text \"u\"} with onstack successor @{text \"v\"} \n  *}\ndefinition red_init_witness :: \"'v \\<Rightarrow> 'v \\<Rightarrow> 'v red_witness\" where\n  \"red_init_witness u v = Some ([u],v)\"\n\ndefinition red_dfs where\n  \"red_dfs E onstack V u \\<equiv> \n    REC\\<^sub>T (\\<lambda>D (V,u). do {\n      let V=(insert u V);\n\n      (* Check whether we have a successor on stack *)\n      brk \\<leftarrow> FOREACH\\<^sub>C (E``{u}) (\\<lambda>brk. brk=None) \n        (\\<lambda>t _. if t\\<in>onstack then RETURN (red_init_witness u t) else RETURN None)\n        None;\n\n      (* Recurse for successors *)\n      case brk of\n        None \\<Rightarrow>\n          FOREACH\\<^sub>C ((E``{u})) (\\<lambda>(V,brk). brk=None)\n            (\\<lambda>t (V,_). \n              if t\\<notin>V then do {\n                (V,brk) \\<leftarrow> D (V,t);\n                RETURN (V,prep_wit_red u brk)\n              } else RETURN (V,None))\n            (V,None)\n      | _ \\<Rightarrow> RETURN (V,brk)\n    }) (V,u)\n  \"\n\nabbreviation \"i_red_witness \\<equiv> \\<langle>\\<langle>\\<langle>i_nat\\<rangle>\\<^sub>ii_list,i_nat\\<rangle>\\<^sub>ii_prod\\<rangle>\\<^sub>ii_option\"\nlemma [autoref_itype]:\n  \"red_init_witness ::\\<^sub>i i_nat \\<rightarrow>\\<^sub>i i_nat \\<rightarrow>\\<^sub>i i_red_witness\"\n  \"prep_wit_red ::\\<^sub>i i_nat \\<rightarrow>\\<^sub>i i_red_witness \\<rightarrow>\\<^sub>i i_red_witness\"\n  by auto\n\nabbreviation \"red_witness_rel \\<equiv> \\<langle>\\<langle>\\<langle>nat_rel\\<rangle>list_rel,nat_rel\\<rangle>prod_rel\\<rangle>option_rel\"\n\nlemma [autoref_rules_raw]:\n  \"(red_init_witness,red_init_witness) \\<in> nat_rel\\<rightarrow>nat_rel\\<rightarrow>red_witness_rel\"\n  \"(prep_wit_red,prep_wit_red) \\<in> nat_rel \\<rightarrow> red_witness_rel \\<rightarrow> red_witness_rel\"\n  by (auto)\n\n(*schematic_lemma \n  \"(?f, RECT (\\<lambda>D x. D x)) \\<in> (?R::(?'c\\<times>_) set)\"\n  apply (autoref (keep_goal))\n  done*)\n\nschematic_goal red_dfs_impl:\n  notes [[goals_limit = 1]]\n  fixes u'::\"nat\" and V'::\"nat set\"\n  assumes [autoref_rules]:\n    \"(u,u')\\<in>nat_rel\" \n    \"(V,V')\\<in>\\<langle>nat_rel\\<rangle>dflt_rs_rel\" \n    \"(onstack,onstack')\\<in>\\<langle>nat_rel\\<rangle>dflt_rs_rel\" \n    \"(E,E')\\<in>\\<langle>nat_rel\\<rangle>slg_rel\"\n  shows \"(?f, red_dfs E' onstack' V' u') \\<in> (?R::(?'c\\<times>_) set)\"\n  apply -\n  unfolding red_dfs_def\n  apply (autoref_monadic (trace))\n  done\n\nconcrete_definition red_dfs_impl for E onstack V u uses red_dfs_impl \n\nprepare_code_thms red_dfs_impl_def\n\nexport_code red_dfs_impl in SML\n\n\nend\nend\n", "meta": {"author": "andredidier", "repo": "phd", "sha": "113f7c8b360a3914a571db13d9513e313954f4b2", "save_path": "github-repos/isabelle/andredidier-phd", "path": "github-repos/isabelle/andredidier-phd/phd-113f7c8b360a3914a571db13d9513e313954f4b2/thesis/Collections/Examples/Autoref/Coll_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3157387487413704}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(*\nHoare reasoning and WP (weakest-precondition) generator rules for the option monad.\n\nThis list is almost certainly incomplete; add rules here as they are needed.\n*)\n\ntheory OptionMonadWP\nimports\n  OptionMonadND\n  WP\n  No_Fail\nbegin\n\n(* Hoare triples.\n   TODO: design a sensible syntax for them. *)\n\n(* Partial correctness. *)\ndefinition ovalid :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> 'a option) \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\" where\n  \"ovalid P f Q \\<equiv> \\<forall>s r. P s \\<and> f s = Some r \\<longrightarrow> Q r s\"\n(* Total correctness. *)\ndefinition ovalidNF :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> 'a option) \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\" where\n  \"ovalidNF P f Q \\<equiv> \\<forall>s. P s \\<longrightarrow> (f s \\<noteq> None \\<and> (\\<forall>r. f s = Some r \\<longrightarrow> Q r s))\"\n(* Termination. *)\ndefinition no_ofail where \"no_ofail P f \\<equiv> \\<forall>s. P s \\<longrightarrow> f s \\<noteq> None\"\n\n(*\nThis rule lets us apply ovalidNF machinery for proving no_ofail.\nHowever, we ought to eventually write working wp rules for no_ofail (see below).\n*)\nlemma no_ofail_is_ovalidNF: \"no_ofail P f \\<equiv> ovalidNF P f (\\<lambda>_ _. True)\"\n  by (simp add: no_ofail_def ovalidNF_def)\nlemma ovalidNF_combine: \"\\<lbrakk> ovalid P f Q; no_ofail P f \\<rbrakk> \\<Longrightarrow> ovalidNF P f Q\"\n  by (auto simp: ovalidNF_def ovalid_def no_ofail_def)\n\n(* use ovalid with f s = Some r *)\nlemma use_ovalidE:\n  \"\\<lbrakk>ovalid P f Q; P s; f s = Some r; Q r s \\<Longrightarrow> R\\<rbrakk> \\<Longrightarrow> R\"\n  by (clarsimp simp: ovalid_def)\n\nlemma use_ovalid:\n  \"\\<lbrakk>ovalid P f Q; f s = Some r; P s \\<rbrakk> \\<Longrightarrow> Q r s\"\n  by (clarsimp simp: ovalid_def)\n\n(* Annotating programs with loop invariant and measure. *)\ndefinition owhile_inv ::\n  \"('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> 'a option) \\<Rightarrow> 'a\n   \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> nat) \\<Rightarrow> 's \\<Rightarrow> 'a option\"\n  where \"owhile_inv C B x I M = owhile C B x\"\n\nlemmas owhile_add_inv = owhile_inv_def[symmetric]\n\n\n(* WP rules for ovalid. *)\nlemma obind_wp[wp]:\n  \"\\<lbrakk> \\<And>r. ovalid (R r) (g r) Q; ovalid P f R \\<rbrakk> \\<Longrightarrow> ovalid P (obind f g) Q\"\n  by (simp add: ovalid_def obind_def split: option.splits, fast)\n\nlemma oreturn_wp[wp]:\n  \"ovalid (P x) (oreturn x) P\"\n  by (simp add: ovalid_def)\n\nlemma ocondition_wp[wp]:\n  \"\\<lbrakk> ovalid L l Q; ovalid R r Q \\<rbrakk>\n   \\<Longrightarrow> ovalid (\\<lambda>s. if C s then L s else R s) (ocondition C l r) Q\"\n  by (auto simp: ovalid_def ocondition_def)\n\nlemma ofail_wp[wp]:\n  \"ovalid (\\<lambda>_. True) ofail Q\"\n  by (simp add: ovalid_def ofail_def)\n\nlemma ovalid_K_bind_wp[wp]:\n  \"ovalid P f Q \\<Longrightarrow> ovalid P (K_bind f x) Q\"\n  by simp\n\nlemma asks_wp[wp]:\n  \"ovalid (\\<lambda>s. P (f s) s) (asks f) P\"\n  by (simp add: split_def asks_def oreturn_def obind_def ovalid_def)\n\n(* more direct form *)\nlemma asks_SomeD:\n  \"\\<lbrakk>asks f s = Some r; Q (f s) s\\<rbrakk> \\<Longrightarrow> Q r s\"\n  by (rule use_ovalid[OF asks_wp])\n\nlemma ogets_wp[wp]:\n  \"ovalid (\\<lambda>s. P (f s) s) (ogets f) P\"\n  by wp\n\nlemma oguard_wp[wp]:\n  \"ovalid (\\<lambda>s. f s \\<longrightarrow> P () s) (oguard f) P\"\n  by (simp add: ovalid_def oguard_def)\n\nlemma oskip_wp[wp]:\n  \"ovalid (\\<lambda>s. P () s) oskip P\"\n  by (simp add: ovalid_def oskip_def)\n\nlemma ovalid_case_prod[wp]:\n  assumes \"(\\<And>x y. ovalid (P x y) (B x y) Q)\"\n  shows \"ovalid (case v of (x, y) \\<Rightarrow> P x y) (case v of (x, y) \\<Rightarrow> B x y) Q\"\n  using assms unfolding ovalid_def by auto\n\nlemma owhile_ovalid[wp]:\n  \"\\<lbrakk>\\<And>a. ovalid (\\<lambda>s. I a s \\<and> C a s) (B a) I;\n    \\<And>a s. \\<lbrakk>I a s; \\<not> C a s\\<rbrakk> \\<Longrightarrow> Q a s\\<rbrakk>\n   \\<Longrightarrow> ovalid (I a) (owhile_inv C B a I M) Q\"\n  unfolding owhile_inv_def owhile_def ovalid_def\n  apply clarify\n  apply (frule_tac I = \"\\<lambda>a. I a s\" in option_while_rule)\n  apply auto\n  done\n\ndefinition ovalid_property where \"ovalid_property P x = (\\<lambda>s f. (\\<forall>r. Some r = x s f \\<longrightarrow> P r s))\"\n\nlemma ovalid_is_triple[wp_trip]:\n  \"ovalid P f Q = triple_judgement P f (ovalid_property Q (\\<lambda>s f. f s))\"\n  by (auto simp: triple_judgement_def ovalid_def ovalid_property_def)\n\n\nlemma ovalid_wp_comb1[wp_comb]:\n  \"\\<lbrakk> ovalid P' f Q; ovalid P f Q'; \\<And>s. P s \\<Longrightarrow> P' s \\<rbrakk> \\<Longrightarrow> ovalid P f (\\<lambda>r s. Q r s \\<and> Q' r s)\"\n  by (simp add: ovalid_def)\n\nlemma ovalid_wp_comb2[wp_comb]:\n  \"\\<lbrakk> ovalid P f Q; \\<And>s. P' s \\<Longrightarrow> P s \\<rbrakk> \\<Longrightarrow> ovalid P' f Q\"\n  by (auto simp: ovalid_def)\n\nlemma ovalid_wp_comb3[wp_comb]:\n  \"\\<lbrakk> ovalid P f Q; ovalid P' f Q' \\<rbrakk> \\<Longrightarrow> ovalid (\\<lambda>s. P s \\<and> P' s) f (\\<lambda>r s. Q r s \\<and> Q' r s)\"\n  by (auto simp: ovalid_def)\n\n\n\n(* WP rules for ovalidNF. *)\nlemma obind_NF_wp[wp]:\n  \"\\<lbrakk> \\<And>r. ovalidNF (R r) (g r) Q; ovalidNF P f R \\<rbrakk> \\<Longrightarrow> ovalidNF P (obind f g) Q\"\n  by (auto simp: ovalidNF_def obind_def split: option.splits)\n\nlemma oreturn_NF_wp[wp]:\n  \"ovalidNF (P x) (oreturn x) P\"\n  by (simp add: ovalidNF_def oreturn_def)\n\nlemma ocondition_NF_wp[wp]:\n  \"\\<lbrakk> ovalidNF L l Q; ovalidNF R r Q \\<rbrakk>\n   \\<Longrightarrow> ovalidNF (\\<lambda>s. if C s then L s else R s) (ocondition C l r) Q\"\n  by (simp add: ovalidNF_def ocondition_def)\n\nlemma ofail_NF_wp[wp]:\n  \"ovalidNF (\\<lambda>_. False) ofail Q\"\n  by (simp add: ovalidNF_def ofail_def)\n\nlemma ovalidNF_K_bind_wp[wp]:\n  \"ovalidNF P f Q \\<Longrightarrow> ovalidNF P (K_bind f x) Q\"\n  by simp\n\nlemma ogets_NF_wp[wp]:\n  \"ovalidNF (\\<lambda>s. P (f s) s) (ogets f) P\"\n  by (simp add: ovalidNF_def ogets_def)\n\nlemma oguard_NF_wp[wp]:\n  \"ovalidNF (\\<lambda>s. f s \\<and> P () s) (oguard f) P\"\n  by (simp add: ovalidNF_def oguard_def)\n\nlemma oskip_NF_wp[wp]:\n  \"ovalidNF (\\<lambda>s. P () s) oskip P\"\n  by (simp add: ovalidNF_def oskip_def)\n\nlemma ovalid_NF_case_prod[wp]:\n  assumes \"(\\<And>x y. ovalidNF (P x y) (B x y) Q)\"\n  shows \"ovalidNF (case v of (x, y) \\<Rightarrow> P x y) (case v of (x, y) \\<Rightarrow> B x y) Q\"\n  using assms unfolding ovalidNF_def by auto\n\nlemma owhile_NF[wp]:\n  \"\\<lbrakk>\\<And>a. ovalidNF (\\<lambda>s. I a s \\<and> C a s) (B a) I;\n    \\<And>a m. ovalid (\\<lambda>s. I a s \\<and> C a s \\<and> M a s = m) (B a) (\\<lambda>r s. M r s < m);\n    \\<And>a s. \\<lbrakk>I a s; \\<not> C a s\\<rbrakk> \\<Longrightarrow> Q a s\\<rbrakk>\n   \\<Longrightarrow> ovalidNF (I a) (owhile_inv C B a I M) Q\"\n  unfolding owhile_inv_def ovalidNF_def ovalid_def\n  apply clarify\n  apply (rule_tac I = I and M = \"measure (\\<lambda>r. M r s)\" in owhile_rule)\n       apply fastforce\n      apply fastforce\n     apply fastforce\n    apply blast+\n  done\n\ndefinition ovalidNF_property where\n  \"ovalidNF_property P x = (\\<lambda>s f. (x s f \\<noteq> None \\<and> (\\<forall>r. Some r = x s f \\<longrightarrow> P r s)))\"\n\nlemma ovalidNF_is_triple[wp_trip]:\n  \"ovalidNF P f Q = triple_judgement P f (ovalidNF_property Q (\\<lambda>s f. f s))\"\n  by (auto simp: triple_judgement_def ovalidNF_def ovalidNF_property_def)\n\n\nlemma ovalidNF_wp_comb1[wp_comb]:\n  \"\\<lbrakk> ovalidNF P' f Q; ovalidNF P f Q'; \\<And>s. P s \\<Longrightarrow> P' s \\<rbrakk> \\<Longrightarrow> ovalidNF P f (\\<lambda>r s. Q r s \\<and> Q' r s)\"\n  by (simp add: ovalidNF_def)\n\nlemma ovalidNF_wp_comb2[wp_comb]:\n  \"\\<lbrakk> ovalidNF P f Q; \\<And>s. P' s \\<Longrightarrow> P s \\<rbrakk> \\<Longrightarrow> ovalidNF P' f Q\"\n  by (simp add: ovalidNF_def)\n\nlemma ovalidNF_wp_comb3[wp_comb]:\n  \"\\<lbrakk> ovalidNF P f Q; ovalidNF P' f Q' \\<rbrakk> \\<Longrightarrow> ovalidNF (\\<lambda>s. P s \\<and> P' s) f (\\<lambda>r s. Q r s \\<and> Q' r s)\"\n  by (simp add: ovalidNF_def)\n\n\n\n(* FIXME: WP rules for no_ofail, which might not be correct. *)\nlemma no_ofailD:\n  \"\\<lbrakk> no_ofail P m; P s \\<rbrakk> \\<Longrightarrow> \\<exists>y. m s = Some y\"\n  by (simp add: no_ofail_def)\n\nlemma no_ofail_obind2[simp]:\n  assumes f: \"no_ofail P f\"\n  assumes v: \"ovalid Q f R\"\n  assumes g: \"\\<And>r. no_ofail (R r) (g r)\"\n  shows \"no_ofail (P and Q) (f |>> g)\"\n  using v g\n  by (fastforce simp: no_ofail_def obind_def pred_conj_def ovalid_def dest: no_ofailD [OF f])\n\nlemma no_ofail_ofail[wp]:\n  \"no_ofail \\<bottom> ofail\"\n  by (simp add: no_ofail_def)\n\nlemma no_ofail_asks_simp[simp]:\n  \"no_ofail P (asks f)\"\n  unfolding asks_def get_def oreturn_def obind_def no_ofail_def\n  by simp\n\nlemma no_ofail_asks[wp]:\n  \"no_ofail \\<top> (asks f)\"\n  by simp\n\nlemma no_ofail_ogets[wp]:\n  \"no_ofail \\<top> (ogets f)\"\n  by simp\n\nlemma no_ofail_obind[wp]:\n  \"\\<lbrakk> \\<And>r. no_ofail (P r) (g r); no_ofail Q f; ovalid Q f P \\<rbrakk> \\<Longrightarrow> no_ofail Q (obind f g)\"\n  by (auto simp: no_ofail_def obind_def ovalid_def)\n\nlemma no_ofail_K_bind[wp]:\n  \"no_ofail P f \\<Longrightarrow> no_ofail P (K_bind f x)\"\n  by simp\n\nlemma no_ofail_oguard[wp]:\n  \"no_ofail (\\<lambda>s. f s) (oguard f)\"\n  by (auto simp: no_ofail_def oguard_def)\n\nlemma no_ofail_ocondition[wp]:\n  \"\\<lbrakk> no_ofail L l; no_ofail R r \\<rbrakk>\n     \\<Longrightarrow> no_ofail (\\<lambda>s. if C s then L s else R s) (ocondition C l r)\"\n  by (simp add: no_ofail_def ocondition_def)\n\nlemma no_ofail_oreturn[wp]:\n  \"no_ofail (\\<lambda>_. True) (oreturn x)\"\n  by (simp add: no_ofail_def oreturn_def)\n\nlemma no_ofail_oskip[wp]:\n  \"no_ofail (\\<lambda>_. True) oskip\"\n  by (simp add: no_ofail_def oskip_def)\n\nlemma no_ofail_oassert_opt[simp, wp]:\n  \"no_ofail (\\<lambda>_. P \\<noteq> None) (oassert_opt P)\"\n  by (simp add: no_ofail_def oassert_opt_def split: option.splits)\n\nlemma no_ofail_owhen[wp]:\n  \"(P \\<Longrightarrow> no_ofail Q f) \\<Longrightarrow> no_ofail (if P then Q else \\<top>) (owhen P f)\"\n  by (simp add: no_ofail_def owhen_def)\n\nlemma no_ofail_ounless[wp]:\n  \"(\\<not>P \\<Longrightarrow> no_ofail Q f) \\<Longrightarrow> no_ofail (if P then \\<top> else Q) (ounless P f)\"\n  by (simp add: no_ofail_def ounless_def)\n\nlemma no_ofail_oassert[simp, wp]:\n  \"no_ofail (\\<lambda>_. P) (oassert P)\"\n  by (simp add: oassert_def no_ofail_def)\n\nlemma no_ofail_gets_the:\n  \"no_ofail P f \\<Longrightarrow> no_fail P (gets_the (f :: ('s, 'a) lookup))\"\n  by (fastforce simp: no_ofail_def no_fail_def gets_the_def gets_def\n                      get_def assert_opt_def bind_def return_def fail_def\n               split: option.split)\n\nlemma no_ofail_is_triple[wp_trip]:\n  \"no_ofail P f = triple_judgement P f (\\<lambda>s f. f s \\<noteq> None)\"\n  by (auto simp: triple_judgement_def no_ofail_def)\n\nlemma no_ofail_wp_comb1[wp_comb]:\n  \"\\<lbrakk> no_ofail P f; \\<And>s. P' s \\<Longrightarrow> P s \\<rbrakk> \\<Longrightarrow> no_ofail P' f\"\n  by (simp add: no_ofail_def)\n\nlemma no_ofail_wp_comb2[wp_comb]:\n  \"\\<lbrakk> no_ofail P f; no_ofail P' f \\<rbrakk> \\<Longrightarrow> no_ofail (\\<lambda>s. P s \\<and> P' s) f\"\n  by (simp add: no_ofail_def)\n\n\n(* Lemmas relating ovalid and valid *)\nlemma ovalid_gets_the:\n  \"ovalid P f Q \\<Longrightarrow> \\<lbrace>P\\<rbrace> gets_the f \\<lbrace>Q\\<rbrace>\"\n  apply wpsimp\n  apply (fastforce dest: use_ovalid)\n  done\n\n\n(* Some extra lemmas for our predicates. *)\nlemma ovalid_grab_asm:\n  \"(G \\<Longrightarrow> ovalid P f Q) \\<Longrightarrow> ovalid (\\<lambda>s. G \\<and> P s) f Q\"\n  by (simp add: ovalid_def)\n\nlemma ovalidNF_grab_asm:\n  \"(G \\<Longrightarrow> ovalidNF P f Q) \\<Longrightarrow> ovalidNF (\\<lambda>s. G \\<and> P s) f Q\"\n  by (simp add: ovalidNF_def)\n\nlemma no_ofail_grab_asm:\n  \"(G \\<Longrightarrow> no_ofail P f) \\<Longrightarrow> no_ofail (\\<lambda>s. G \\<and> P s) f\"\n  by (simp add: no_ofail_def)\n\nlemma ovalid_assume_pre:\n  \"(\\<And>s. P s \\<Longrightarrow> ovalid P f Q) \\<Longrightarrow> ovalid P f Q\"\n  by (auto simp: ovalid_def)\n\nlemma ovalidNF_assume_pre:\n  \"(\\<And>s. P s \\<Longrightarrow> ovalidNF P f Q) \\<Longrightarrow> ovalidNF P f Q\"\n  by (simp add: ovalidNF_def)\n\nlemma no_ofail_assume_pre:\n  \"(\\<And>s. P s \\<Longrightarrow> no_ofail P f) \\<Longrightarrow> no_ofail P f\"\n  by (simp add: no_ofail_def)\n\nlemma ovalid_pre_imp:\n  \"\\<lbrakk> \\<And>s. P' s \\<Longrightarrow> P s; ovalid P f Q \\<rbrakk> \\<Longrightarrow> ovalid P' f Q\"\n  by (simp add: ovalid_def)\n\nlemma ovalidNF_pre_imp:\n  \"\\<lbrakk> \\<And>s. P' s \\<Longrightarrow> P s; ovalidNF P f Q \\<rbrakk> \\<Longrightarrow> ovalidNF P' f Q\"\n  by (simp add: ovalidNF_def)\n\nlemma no_ofail_pre_imp:\n  \"\\<lbrakk> \\<And>s. P' s \\<Longrightarrow> P s; no_ofail P f \\<rbrakk> \\<Longrightarrow> no_ofail P' f\"\n  by (simp add: no_ofail_def)\n\nlemma ovalid_post_imp:\n  \"\\<lbrakk> \\<And>r s. Q r s \\<Longrightarrow> Q' r s; ovalid P f Q \\<rbrakk> \\<Longrightarrow> ovalid P f Q'\"\n  by (simp add: ovalid_def)\n\nlemma ovalidNF_post_imp:\n  \"\\<lbrakk> \\<And>r s. Q r s \\<Longrightarrow> Q' r s; ovalidNF P f Q \\<rbrakk> \\<Longrightarrow> ovalidNF P f Q'\"\n  by (simp add: ovalidNF_def)\n\nlemma ovalid_post_imp_assuming_pre:\n  \"\\<lbrakk> \\<And>r s. \\<lbrakk> P s; Q r s \\<rbrakk> \\<Longrightarrow> Q' r s; ovalid P f Q \\<rbrakk> \\<Longrightarrow> ovalid P f Q'\"\n  by (simp add: ovalid_def)\n\nlemma ovalidNF_post_imp_assuming_pre:\n  \"\\<lbrakk> \\<And>r s. \\<lbrakk> P s; Q r s \\<rbrakk> \\<Longrightarrow> Q' r s; ovalidNF P f Q \\<rbrakk> \\<Longrightarrow> ovalidNF P f Q'\"\n  by (simp add: ovalidNF_def)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Monads/OptionMonadWP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.3157387487413704}}
{"text": "(*  Title:      JinjaThreads/Framework/LTS.thy\n    Author:     Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Labelled transition systems} *}\n\ntheory LTS\nimports\n  \"../Basic/Auxiliary\"\n  \"../../Coinductive/TLList\"\nbegin\n\nlemma rel_option_mono:\n  \"\\<lbrakk> rel_option R x y; \\<And>x y. R x y \\<Longrightarrow> R' x y \\<rbrakk> \\<Longrightarrow> rel_option R' x y\"\nby(cases x)(case_tac [!] y, auto)\n\nlemma nth_concat_conv:\n  \"n < length (concat xss) \n   \\<Longrightarrow> \\<exists>m n'. concat xss ! n = (xss ! m) ! n' \\<and> n' < length (xss ! m) \\<and> \n             m < length xss \\<and> n = (\\<Sum>i<m. length (xss ! i)) + n'\"\nusing lnth_lconcat_conv[of n \"llist_of (map llist_of xss)\"]\n  setsum_hom[where f = enat and h = \"\\<lambda>i. length (xss ! i)\"]\nby(clarsimp simp add: lconcat_llist_of zero_enat_def[symmetric]) blast\n\n\ndefinition flip :: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'c) \\<Rightarrow> 'b \\<Rightarrow> 'a \\<Rightarrow> 'c\"\nwhere \"flip f = (\\<lambda>b a. f a b)\"\n\ntext {* Create a dynamic list @{text \"flip_simps\"} of theorems for flip *}\nML {*\nstructure FlipSimpRules = Named_Thms\n(\n  val name = @{binding flip_simps}\n  val description = \"Simplification rules for flip in bisimulations\"\n)\n*}\nsetup {* FlipSimpRules.setup *}\n\nlemma flip_conv [flip_simps]: \"flip f b a = f a b\"\nby(simp add: flip_def)\n\nlemma flip_flip [flip_simps, simp]: \"flip (flip f) = f\"\nby(simp add: flip_def)\n\nlemma list_all2_flip [flip_simps]: \"list_all2 (flip P) xs ys = list_all2 P ys xs\"\nunfolding flip_def list_all2_conv_all_nth by auto\n\nlemma llist_all2_flip [flip_simps]: \"llist_all2 (flip P) xs ys = llist_all2 P ys xs\"\nunfolding flip_def llist_all2_conv_all_lnth by auto\n\nlemma rtranclp_flipD:\n  assumes \"(flip r)^** x y\"\n  shows \"r^** y x\" \nusing assms\nby(induct rule: rtranclp_induct)(auto intro: rtranclp.rtrancl_into_rtrancl simp add: flip_conv)\n\n\n\nlemma rel_prod_flip [flip_simps]:\n  \"rel_prod (flip R) (flip S) = flip (rel_prod R S)\"\nby(auto intro!: ext simp add: flip_def)\n\nlemma rel_option_flip [flip_simps]:\n  \"rel_option (flip R) = flip (rel_option R)\"\nby(simp add: fun_eq_iff rel_option_iff flip_def)\n\nlemma tllist_all2_flip [flip_simps]:\n  \"tllist_all2 (flip P) (flip Q) xs ys \\<longleftrightarrow> tllist_all2 P Q ys xs\"\nproof\n  assume \"tllist_all2 (flip P) (flip Q) xs ys\"\n  thus \"tllist_all2 P Q ys xs\"\n    by(coinduct rule: tllist_all2_coinduct)(auto dest: tllist_all2_is_TNilD tllist_all2_tfinite2_terminalD tllist_all2_thdD intro: tllist_all2_ttlI simp add: flip_def)\nnext\n  assume \"tllist_all2 P Q ys xs\"\n  thus \"tllist_all2 (flip P) (flip Q) xs ys\"\n    by(coinduct rule: tllist_all2_coinduct)(auto dest: tllist_all2_is_TNilD tllist_all2_tfinite2_terminalD tllist_all2_thdD intro: tllist_all2_ttlI simp add: flip_def)\nqed\n\nsubsection {* Labelled transition systems *}\n\ntype_synonym ('a, 'b) trsys = \"'a \\<Rightarrow> 'b \\<Rightarrow> 'a \\<Rightarrow> bool\"\n\nlocale trsys = \n  fixes trsys :: \"('s, 'tl) trsys\" (\"_/ -_\\<rightarrow>/ _\" [50, 0, 50] 60)\nbegin\n\nabbreviation Trsys :: \"('s, 'tl list) trsys\" (\"_/ -_\\<rightarrow>*/ _\" [50,0,50] 60)\nwhere \"\\<And>tl. s -tl\\<rightarrow>* s' \\<equiv> rtrancl3p trsys s tl s'\"\n\ncoinductive inf_step :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> bool\" (\"_ -_\\<rightarrow>* \\<infinity>\" [50, 0] 80)\nwhere inf_stepI: \"\\<lbrakk> trsys a b a'; a' -bs\\<rightarrow>* \\<infinity> \\<rbrakk> \\<Longrightarrow> a -LCons b bs\\<rightarrow>* \\<infinity>\"\n\ncoinductive inf_step_table :: \"'s \\<Rightarrow> ('s \\<times> 'tl \\<times> 's) llist \\<Rightarrow> bool\" (\"_ -_\\<rightarrow>*t \\<infinity>\" [50, 0] 80)\nwhere \n  inf_step_tableI:\n  \"\\<And>tl. \\<lbrakk> trsys s tl s'; s' -stls\\<rightarrow>*t \\<infinity> \\<rbrakk> \n  \\<Longrightarrow> s -LCons (s, tl, s') stls\\<rightarrow>*t \\<infinity>\"\n\ndefinition inf_step2inf_step_table :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> ('s \\<times> 'tl \\<times> 's) llist\"\nwhere\n  \"inf_step2inf_step_table s tls =\n   unfold_llist\n     (\\<lambda>(s, tls). lnull tls)\n     (\\<lambda>(s, tls). (s, lhd tls, SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>)) \n     (\\<lambda>(s, tls). (SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>, ltl tls))\n     (s, tls)\"\n\ncoinductive Rtrancl3p :: \"'s \\<Rightarrow> ('tl, 's) tllist \\<Rightarrow> bool\"\nwhere \n  Rtrancl3p_refl: \"Rtrancl3p a (TNil a)\"\n| Rtrancl3p_into_Rtrancl3p: \"\\<lbrakk> trsys a b a'; Rtrancl3p a' tr \\<rbrakk> \\<Longrightarrow> Rtrancl3p a (TCons b bs)\"\n\ncoinductive Runs :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> bool\"\nwhere\n  Stuck: \"(\\<And>tl s'. \\<not> s -tl\\<rightarrow> s') \\<Longrightarrow> Runs s LNil\"\n| Step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; Runs s' tls \\<rbrakk> \\<Longrightarrow> Runs s (LCons tl tls)\"\n\ncoinductive Runs_table :: \"'s \\<Rightarrow> ('s \\<times> 'tl \\<times> 's) llist \\<Rightarrow> bool\"\nwhere\n  Stuck: \"(\\<And>tl s'. \\<not> s -tl\\<rightarrow> s') \\<Longrightarrow> Runs_table s LNil\"\n| Step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; Runs_table s' stlss \\<rbrakk> \\<Longrightarrow> Runs_table s (LCons (s, tl, s') stlss)\"\n\ninductive_simps Runs_table_simps:\n  \"Runs_table s LNil\"\n  \"Runs_table s (LCons stls stlss)\"\n\nlemma inf_step_not_finite_llist:\n  assumes r: \"s -bs\\<rightarrow>* \\<infinity>\"\n  shows \"\\<not> lfinite bs\"\nproof\n  assume \"lfinite bs\" thus False using r\n    by(induct arbitrary: s rule: lfinite.induct)(auto elim: inf_step.cases)\nqed\n\nlemma inf_step2inf_step_table_LNil [simp]: \"inf_step2inf_step_table s LNil = LNil\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma inf_step2inf_step_table_LCons [simp]:\n  fixes tl shows\n  \"inf_step2inf_step_table s (LCons tl tls) =\n   LCons (s, tl, SOME s'. trsys s tl s' \\<and> s' -tls\\<rightarrow>* \\<infinity>) \n         (inf_step2inf_step_table (SOME s'. trsys s tl s' \\<and> s' -tls\\<rightarrow>* \\<infinity>) tls)\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma lnull_inf_step2inf_step_table [simp]: \n  \"lnull (inf_step2inf_step_table s tls) \\<longleftrightarrow> lnull tls\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma inf_step2inf_step_table_eq_LNil: \n  \"inf_step2inf_step_table s tls = LNil \\<longleftrightarrow> tls = LNil\"\nusing lnull_inf_step2inf_step_table unfolding lnull_def .\n\nlemma lhd_inf_step2inf_step_table [simp]:\n  \"\\<not> lnull tls\n  \\<Longrightarrow> lhd (inf_step2inf_step_table s tls) =\n      (s, lhd tls, SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>)\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma ltl_inf_step2inf_step_table [simp]:\n  \"ltl (inf_step2inf_step_table s tls) =\n   inf_step2inf_step_table (SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>) (ltl tls)\"\nby(cases tls) simp_all\n\nlemma lmap_inf_step2inf_step_table: \"lmap (fst \\<circ> snd) (inf_step2inf_step_table s tls) = tls\"\nby(coinduction arbitrary: s tls) auto\n\nlemma inf_step_imp_inf_step_table:\n  assumes \"s -tls\\<rightarrow>* \\<infinity>\"\n  shows \"\\<exists>stls. s -stls\\<rightarrow>*t \\<infinity> \\<and> tls = lmap (fst \\<circ> snd) stls\"\nproof -\n  from assms have \"s -inf_step2inf_step_table s tls\\<rightarrow>*t \\<infinity>\"\n  proof(coinduction arbitrary: s tls)\n    case (inf_step_table s tls)\n    thus ?case\n    proof cases\n      case (inf_stepI tl s' tls')\n      let ?s' = \"SOME s'. trsys s tl s' \\<and> s' -tls'\\<rightarrow>* \\<infinity>\"\n      have \"trsys s tl ?s' \\<and> ?s' -tls'\\<rightarrow>* \\<infinity>\" by(rule someI)(blast intro: inf_stepI)\n      thus ?thesis using `tls = LCons tl tls'` by auto\n    qed\n  qed\n  moreover have \"tls = lmap (fst \\<circ> snd) (inf_step2inf_step_table s tls)\"\n    by(simp only: lmap_inf_step2inf_step_table)\n  ultimately show ?thesis by blast\nqed\n\nlemma inf_step_table_imp_inf_step:\n  \"s-stls\\<rightarrow>*t \\<infinity> \\<Longrightarrow>s -lmap (fst \\<circ> snd) stls\\<rightarrow>* \\<infinity>\"\nproof(coinduction arbitrary: s stls rule: inf_step.coinduct)\n  case (inf_step s tls)\n  thus ?case by cases auto\nqed\n\nlemma rtrancl3p_into_Rtrancl3p:\n  \"rtrancl3p trsys a bs a' \\<Longrightarrow> Rtrancl3p a (tllist_of_llist a' (llist_of bs))\"\nby(induct rule: rtrancl3p_converse_induct)(auto intro: Rtrancl3p.intros)\n\nlemma Runs_table_into_Runs:\n  \"Runs_table s stlss \\<Longrightarrow> Runs s (lmap (\\<lambda>(s, tl, s'). tl) stlss)\"\nproof(coinduction arbitrary: s stlss)\n  case (Runs s tls)\n  thus ?case by (cases)auto\nqed\n\nlemma Runs_into_Runs_table:\n  assumes \"Runs s tls\"\n  obtains stlss\n  where \"tls = lmap (\\<lambda>(s, tl, s'). tl) stlss\"\n  and \"Runs_table s stlss\"\nproof -\n  def stlss \\<equiv> \"\\<lambda>s tls. unfold_llist\n    (\\<lambda>(s, tls). lnull tls)\n    (\\<lambda>(s, tls). (s, lhd tls, SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls)))\n    (\\<lambda>(s, tls). (SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls), ltl tls))\n    (s, tls)\"\n  have [simp]:\n    \"\\<And>s. stlss s LNil = LNil\"\n    \"\\<And>s tl tls. stlss s (LCons tl tls) = LCons (s, tl, SOME s'. s -tl\\<rightarrow> s' \\<and> Runs s' tls) (stlss (SOME s'. s -tl\\<rightarrow> s' \\<and> Runs s' tls) tls)\"\n    \"\\<And>s tls. lnull (stlss s tls) \\<longleftrightarrow> lnull tls\"\n    \"\\<And>s tls. \\<not> lnull tls \\<Longrightarrow> lhd (stlss s tls) = (s, lhd tls, SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls))\"\n    \"\\<And>s tls. \\<not> lnull tls \\<Longrightarrow> ltl (stlss s tls) = stlss (SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls)) (ltl tls)\"\n    by(simp_all add: stlss_def)\n  \n  from assms have \"tls = lmap (\\<lambda>(s, tl, s'). tl) (stlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case Eq_llist\n    thus ?case by cases(auto 4 3 intro: someI2)\n  qed\n  moreover\n  from assms have \"Runs_table s (stlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (Runs_table s stlss')\n    thus ?case\n    proof(cases)\n      case (Step s' tls' tl)\n      let ?P = \"\\<lambda>s'. s -tl\\<rightarrow> s' \\<and> Runs s' tls'\"\n      from `s -tl\\<rightarrow> s'` `Runs s' tls'` have \"?P s'\" ..\n      hence \"?P (Eps ?P)\" by(rule someI)\n      with Step have ?Step by auto\n      thus ?thesis ..\n    qed simp\n  qed\n  ultimately show ?thesis by(rule that)\nqed\n\nlemma Runs_lappendE:\n  assumes \"Runs \\<sigma> (lappend tls tls')\"\n  and \"lfinite tls\"\n  obtains \\<sigma>' where \"\\<sigma> -list_of tls\\<rightarrow>* \\<sigma>'\"\n  and \"Runs \\<sigma>' tls'\"\nproof(atomize_elim)\n  from `lfinite tls` `Runs \\<sigma> (lappend tls tls')`\n  show \"\\<exists>\\<sigma>'. \\<sigma> -list_of tls\\<rightarrow>* \\<sigma>' \\<and> Runs \\<sigma>' tls'\"\n  proof(induct arbitrary: \\<sigma>)\n    case lfinite_LNil thus ?case by(auto)\n  next\n    case (lfinite_LConsI tls tl)\n    from `Runs \\<sigma> (lappend (LCons tl tls) tls')`\n    show ?case unfolding lappend_code\n    proof(cases)\n      case (Step \\<sigma>')\n      from `Runs \\<sigma>' (lappend tls tls') \\<Longrightarrow> \\<exists>\\<sigma>''. \\<sigma>' -list_of tls\\<rightarrow>* \\<sigma>'' \\<and> Runs \\<sigma>'' tls'` `Runs \\<sigma>' (lappend tls tls')`\n      obtain \\<sigma>'' where \"\\<sigma>' -list_of tls\\<rightarrow>* \\<sigma>''\" \"Runs \\<sigma>'' tls'\" by blast\n      from `\\<sigma> -tl\\<rightarrow> \\<sigma>'` `\\<sigma>' -list_of tls\\<rightarrow>* \\<sigma>''`\n      have \"\\<sigma> -tl # list_of tls\\<rightarrow>* \\<sigma>''\" by(rule rtrancl3p_step_converse)\n      with `lfinite tls` have \"\\<sigma> -list_of (LCons tl tls)\\<rightarrow>* \\<sigma>''\" by(simp)\n      with `Runs \\<sigma>'' tls'` show ?thesis by blast\n    qed\n  qed\nqed\n\nlemma Trsys_into_Runs:\n  assumes \"s -tls\\<rightarrow>* s'\"\n  and \"Runs s' tls'\"\n  shows \"Runs s (lappend (llist_of tls) tls')\"\nusing assms\nby(induct rule: rtrancl3p_converse_induct)(auto intro: Runs.Step)\n\nend\n\nsubsection {* Labelled transition systems with internal actions *}\n\nlocale \\<tau>trsys = trsys +\n  constrains trsys :: \"('s, 'tl) trsys\"\n  fixes \\<tau>move :: \"('s, 'tl) trsys\"\nbegin\n\ninductive silent_move :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow> _\" [50, 50] 60)\nwhere [intro]: \"!!tl. \\<lbrakk> trsys s tl s'; \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> s'\"\n\ndeclare silent_move.cases [elim]\n\n\n\nabbreviation silent_moves :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow>* _\" [50, 50] 60)\nwhere \"silent_moves == silent_move^**\"\n\nabbreviation silent_movet :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow>+ _\" [50, 50] 60)\nwhere \"silent_movet == silent_move^++\"\n\ncoinductive \\<tau>diverge :: \"'s \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow> \\<infinity>\" [50] 60)\nwhere\n  \\<tau>divergeI: \"\\<lbrakk> s -\\<tau>\\<rightarrow> s'; s' -\\<tau>\\<rightarrow> \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\n\ncoinductive \\<tau>inf_step :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> bool\" (\"_ -\\<tau>-_\\<rightarrow>* \\<infinity>\" [50, 0] 60)\nwhere\n  \\<tau>inf_step_Cons: \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; s'' -\\<tau>-tls\\<rightarrow>* \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>-LCons tl tls\\<rightarrow>* \\<infinity>\"\n| \\<tau>inf_step_Nil: \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> s -\\<tau>-LNil\\<rightarrow>* \\<infinity>\"\n\ncoinductive \\<tau>inf_step_table :: \"'s \\<Rightarrow> ('s \\<times> 's \\<times> 'tl \\<times> 's) llist \\<Rightarrow> bool\" (\"_ -\\<tau>-_\\<rightarrow>*t \\<infinity>\" [50, 0] 80)\nwhere\n  \\<tau>inf_step_table_Cons:\n  \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; s'' -\\<tau>-tls\\<rightarrow>*t \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>-LCons (s, s', tl, s'') tls\\<rightarrow>*t \\<infinity>\"\n\n| \\<tau>inf_step_table_Nil:\n  \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> s -\\<tau>-LNil\\<rightarrow>*t \\<infinity>\"\n\ndefinition \\<tau>inf_step2\\<tau>inf_step_table :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> ('s \\<times> 's \\<times> 'tl \\<times> 's) llist\"\nwhere\n  \"\\<tau>inf_step2\\<tau>inf_step_table s tls =\n   unfold_llist\n     (\\<lambda>(s, tls). lnull tls)\n     (\\<lambda>(s, tls). let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n        in (s, s', lhd tls, s''))\n     (\\<lambda>(s, tls). let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n        in (s'', ltl tls))\n     (s, tls)\"\n\ndefinition silent_move_from :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's \\<Rightarrow> bool\"\nwhere \"silent_move_from s0 s1 s2 \\<longleftrightarrow> silent_moves s0 s1 \\<and> silent_move s1 s2\"\n\ninductive \\<tau>rtrancl3p :: \"'s \\<Rightarrow> 'tl list \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>-_\\<rightarrow>* _\" [50, 0, 50] 60)\nwhere\n  \\<tau>rtrancl3p_refl: \"\\<tau>rtrancl3p s [] s\"\n| \\<tau>rtrancl3p_step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; \\<not> \\<tau>move s tl s'; \\<tau>rtrancl3p s' tls s'' \\<rbrakk> \\<Longrightarrow> \\<tau>rtrancl3p s (tl # tls) s''\"\n| \\<tau>rtrancl3p_\\<tau>step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; \\<tau>move s tl s'; \\<tau>rtrancl3p s' tls s'' \\<rbrakk> \\<Longrightarrow> \\<tau>rtrancl3p s tls s''\"\n\ncoinductive \\<tau>Runs :: \"'s \\<Rightarrow> ('tl, 's option) tllist \\<Rightarrow> bool\" (\"_ \\<Down> _\" [50, 50] 51)\nwhere\n  Terminate: \"\\<lbrakk> s -\\<tau>\\<rightarrow>* s'; \\<And>tl s''. \\<not> s' -tl\\<rightarrow> s'' \\<rbrakk> \\<Longrightarrow> s \\<Down> TNil \\<lfloor>s'\\<rfloor>\" \n| Diverge: \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> s \\<Down> TNil None\"\n| Proceed: \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; s'' \\<Down> tls \\<rbrakk> \\<Longrightarrow> s \\<Down> TCons tl tls\"\n\ninductive_simps \\<tau>Runs_simps:\n  \"s \\<Down> TNil (Some s')\"\n  \"s \\<Down> TNil None\"\n  \"s \\<Down> TCons tl' tls\"\n\ncoinductive \\<tau>Runs_table :: \"'s \\<Rightarrow> ('tl \\<times> 's, 's option) tllist \\<Rightarrow> bool\"\nwhere \n  Terminate: \"\\<lbrakk> s -\\<tau>\\<rightarrow>* s'; \\<And>tl s''. \\<not> s' -tl\\<rightarrow> s'' \\<rbrakk> \\<Longrightarrow> \\<tau>Runs_table s (TNil \\<lfloor>s'\\<rfloor>)\"\n| Diverge: \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> \\<tau>Runs_table s (TNil None)\"\n| Proceed:\n  \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; \\<tau>Runs_table s'' tls \\<rbrakk> \n  \\<Longrightarrow> \\<tau>Runs_table s (TCons (tl, s'') tls)\"\n\ndefinition silent_move2 :: \"'s \\<Rightarrow> 'tl \\<Rightarrow> 's \\<Rightarrow> bool\"\nwhere \"\\<And>tl. silent_move2 s tl s' \\<longleftrightarrow> s -tl\\<rightarrow> s' \\<and> \\<tau>move s tl s'\"\n\nabbreviation silent_moves2 :: \"'s \\<Rightarrow> 'tl list \\<Rightarrow> 's \\<Rightarrow> bool\"\nwhere \"silent_moves2 \\<equiv> rtrancl3p silent_move2\"\n\ncoinductive \\<tau>Runs_table2 :: \"'s \\<Rightarrow> ('tl list \\<times> 's \\<times> 'tl \\<times> 's, ('tl list \\<times> 's) + 'tl llist) tllist \\<Rightarrow> bool\"\nwhere \n  Terminate: \"\\<lbrakk> silent_moves2 s tls s'; \\<And>tl s''. \\<not> s' -tl\\<rightarrow> s'' \\<rbrakk> \\<Longrightarrow> \\<tau>Runs_table2 s (TNil (Inl (tls, s')))\"\n| Diverge: \"trsys.inf_step silent_move2 s tls \\<Longrightarrow> \\<tau>Runs_table2 s (TNil (Inr tls))\"\n| Proceed:\n  \"\\<And>tl. \\<lbrakk> silent_moves2 s tls s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; \\<tau>Runs_table2 s'' tlsstlss \\<rbrakk> \n  \\<Longrightarrow> \\<tau>Runs_table2 s (TCons (tls, s', tl, s'') tlsstlss)\"\n\ninductive_simps \\<tau>Runs_table2_simps:\n  \"\\<tau>Runs_table2 s (TNil tlss)\"\n  \"\\<tau>Runs_table2 s (TCons tlsstls tlsstlss)\"\n\nlemma inf_step_table_all_\\<tau>_into_\\<tau>diverge:\n  \"\\<lbrakk> s -stls\\<rightarrow>*t \\<infinity>; \\<forall>(s, tl, s') \\<in> lset stls. \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof(coinduction arbitrary: s stls)\n  case (\\<tau>diverge s)\n  thus ?case by cases (auto simp add: silent_move_iff, blast)\nqed\n\nlemma inf_step_table_lappend_llist_ofD:\n  \"s -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>\n  \\<Longrightarrow> (s -map (fst \\<circ> snd) stls\\<rightarrow>* x) \\<and> (x -LCons (x, tl', x') xs\\<rightarrow>*t \\<infinity>)\"\nproof(induct stls arbitrary: s)\n  case Nil thus ?case by(auto elim: inf_step_table.cases intro: inf_step_table.intros rtrancl3p_refl)\nnext\n  case (Cons st stls)\n  note IH = `\\<And>s. s -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity> \\<Longrightarrow>\n                 s -map (fst \\<circ> snd) stls\\<rightarrow>* x \\<and> x -LCons (x, tl', x') xs\\<rightarrow>*t \\<infinity>`\n  from `s -lappend (llist_of (st # stls)) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>`\n  show ?case\n  proof cases\n    case (inf_step_tableI s' stls' tl)\n    hence [simp]: \"st = (s, tl, s')\" \"stls' = lappend (llist_of stls) (LCons (x, tl', x') xs)\"\n      and \"s -tl\\<rightarrow> s'\" \"s' -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>\" by simp_all\n    from IH[OF `s' -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>`]\n    have \"s' -map (fst \\<circ> snd) stls\\<rightarrow>* x\" \"x -LCons (x, tl', x') xs\\<rightarrow>*t \\<infinity>\" by auto\n    with `s -tl\\<rightarrow> s'` show ?thesis by(auto simp add: o_def intro: rtrancl3p_step_converse)\n  qed\nqed\n\nlemma inf_step_table_lappend_llist_of_\\<tau>_into_\\<tau>moves:\n  assumes \"lfinite stls\"\n  shows \"\\<lbrakk> s -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>; \\<forall>(s, tl, s')\\<in>lset stls. \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow>* x\"\nusing assms\nproof(induct arbitrary: s rule: lfinite.induct)\n  case lfinite_LNil thus ?case by(auto elim: inf_step_table.cases)\nnext\n  case (lfinite_LConsI stls st)\n  note IH = `\\<And>s. \\<lbrakk>s -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>; \\<forall>(s, tl, s')\\<in>lset stls. \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow>* x`\n  obtain s1 tl1 s1' where [simp]: \"st = (s1, tl1, s1')\" by(cases st)\n  from `s -lappend (LCons st stls) (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>`\n  show ?case\n  proof cases\n    case (inf_step_tableI X' STLS TL)\n    hence [simp]: \"s1 = s\" \"TL = tl1\" \"X' = s1'\" \"STLS = lappend stls (LCons (x, tl' x') xs)\"\n      and \"s -tl1\\<rightarrow> s1'\" and \"s1' -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>\" by simp_all\n    from `\\<forall>(s, tl, s')\\<in>lset (LCons st stls). \\<tau>move s tl s'` have \"\\<tau>move s tl1 s1'\" by simp\n    moreover\n    from IH[OF `s1' -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>`] `\\<forall>(s, tl, s')\\<in>lset (LCons st stls). \\<tau>move s tl s'`\n    have \"s1' -\\<tau>\\<rightarrow>* x\" by simp\n    ultimately show ?thesis using `s -tl1\\<rightarrow> s1'` by(auto intro: converse_rtranclp_into_rtranclp)\n  qed\nqed\n\n\nlemma inf_step_table_into_\\<tau>inf_step:\n  \"s -stls\\<rightarrow>*t \\<infinity> \\<Longrightarrow> s -\\<tau>-lmap (fst \\<circ> snd) (lfilter (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') stls)\\<rightarrow>* \\<infinity>\"\nproof(coinduction arbitrary: s stls)\n  case (\\<tau>inf_step s stls)\n  let ?P = \"\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s'\"\n  show ?case\n  proof(cases \"lfilter ?P stls\")\n    case LNil\n    with \\<tau>inf_step have ?\\<tau>inf_step_Nil\n      by(auto intro: inf_step_table_all_\\<tau>_into_\\<tau>diverge simp add: lfilter_eq_LNil)\n    thus ?thesis ..\n  next\n    case (LCons stls' xs)\n    obtain x tl x' where \"stls' = (x, tl, x')\" by(cases stls')\n    with LCons have stls: \"lfilter ?P stls = LCons (x, tl, x') xs\" by simp\n    from lfilter_eq_LConsD[OF this] obtain stls1 stls2\n      where stls1: \"stls = lappend stls1 (LCons (x, tl, x') stls2)\"\n      and \"lfinite stls1\"\n      and \\<tau>s: \"\\<forall>(s, tl, s')\\<in>lset stls1. \\<tau>move s tl s'\"\n      and n\\<tau>: \"\\<not> \\<tau>move x tl x'\" and xs: \"xs = lfilter ?P stls2\" by blast\n    from `lfinite stls1` \\<tau>inf_step \\<tau>s have \"s -\\<tau>\\<rightarrow>* x\" unfolding stls1\n      by(rule inf_step_table_lappend_llist_of_\\<tau>_into_\\<tau>moves)\n    moreover from `lfinite stls1` have \"llist_of (list_of stls1) = stls1\" by(simp add: llist_of_list_of)\n    with \\<tau>inf_step stls1 have \"s -lappend (llist_of (list_of stls1)) (LCons (x, tl, x') stls2)\\<rightarrow>*t \\<infinity>\" by simp\n    from inf_step_table_lappend_llist_ofD[OF this]\n    have \"x -LCons (x, tl, x') stls2\\<rightarrow>*t \\<infinity>\" ..\n    hence \"x -tl\\<rightarrow> x'\" \"x' -stls2\\<rightarrow>*t \\<infinity>\" by(auto elim: inf_step_table.cases)\n    ultimately have ?\\<tau>inf_step_Cons using xs n\\<tau> by(auto simp add: stls o_def)\n    thus ?thesis ..\n  qed\nqed\n\nlemma inf_step_into_\\<tau>inf_step:\n  assumes \"s -tls\\<rightarrow>* \\<infinity>\"\n  shows \"\\<exists>A. s -\\<tau>-lsublist tls A\\<rightarrow>* \\<infinity>\"\nproof -\n  from inf_step_imp_inf_step_table[OF assms]\n  obtain stls where \"s -stls\\<rightarrow>*t \\<infinity>\" and tls: \"tls = lmap (fst \\<circ> snd) stls\" by blast\n  from `s -stls\\<rightarrow>*t \\<infinity>` have \"s -\\<tau>-lmap (fst \\<circ> snd) (lfilter (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') stls)\\<rightarrow>* \\<infinity>\"\n    by(rule inf_step_table_into_\\<tau>inf_step)\n  hence \"s -\\<tau>-lsublist tls {n. enat n < llength stls \\<and> (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') (lnth stls n)}\\<rightarrow>* \\<infinity>\"\n    unfolding lfilter_conv_lsublist tls by simp\n  thus ?thesis by blast\nqed\n\nlemma silent_moves_into_\\<tau>rtrancl3p:\n  \"s -\\<tau>\\<rightarrow>* s' \\<Longrightarrow> s -\\<tau>-[]\\<rightarrow>* s'\"\nby(induct rule: converse_rtranclp_induct)(blast intro: \\<tau>rtrancl3p.intros)+\n\nlemma \\<tau>rtrancl3p_into_silent_moves:\n  \"s -\\<tau>-[]\\<rightarrow>* s' \\<Longrightarrow> s -\\<tau>\\<rightarrow>* s'\"\napply(induct s tls\\<equiv>\"[] :: 'tl list\" s' rule: \\<tau>rtrancl3p.induct)\napply(auto intro: converse_rtranclp_into_rtranclp)\ndone\n\nlemma \\<tau>rtrancl3p_Nil_eq_\\<tau>moves:\n  \"s -\\<tau>-[]\\<rightarrow>* s' \\<longleftrightarrow> s -\\<tau>\\<rightarrow>* s'\"\nby(blast intro: silent_moves_into_\\<tau>rtrancl3p \\<tau>rtrancl3p_into_silent_moves)\n\nlemma \\<tau>rtrancl3p_trans [trans]:\n  \"\\<lbrakk> s -\\<tau>-tls\\<rightarrow>* s'; s' -\\<tau>-tls'\\<rightarrow>* s'' \\<rbrakk> \\<Longrightarrow> s -\\<tau>-tls @ tls'\\<rightarrow>* s''\"\napply(induct rule: \\<tau>rtrancl3p.induct)\napply(auto intro: \\<tau>rtrancl3p.intros)\ndone\n\nlemma \\<tau>rtrancl3p_SingletonE:\n  fixes tl\n  assumes red: \"s -\\<tau>-[tl]\\<rightarrow>* s'''\"\n  obtains s' s'' where \"s -\\<tau>\\<rightarrow>* s'\" \"s' -tl\\<rightarrow> s''\" \"\\<not> \\<tau>move s' tl s''\" \"s'' -\\<tau>\\<rightarrow>* s'''\"\nproof(atomize_elim)\n  from red show \"\\<exists>s' s''. s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>\\<rightarrow>* s'''\"\n  proof(induct s tls\\<equiv>\"[tl]\" s''')\n    case (\\<tau>rtrancl3p_step s s' s'')\n    from `s -tl\\<rightarrow> s'` `\\<not> \\<tau>move s tl s'` `s' -\\<tau>-[]\\<rightarrow>* s''` show ?case\n      by(auto simp add: \\<tau>rtrancl3p_Nil_eq_\\<tau>moves)\n   next\n    case (\\<tau>rtrancl3p_\\<tau>step s s' s'' tl')\n    then obtain t' t'' where \"s' -\\<tau>\\<rightarrow>* t'\" \"t' -tl\\<rightarrow> t''\" \"\\<not> \\<tau>move t' tl t''\" \"t'' -\\<tau>\\<rightarrow>* s''\" by auto\n    moreover\n    from `s -tl'\\<rightarrow> s'` `\\<tau>move s tl' s'` have \"s -\\<tau>\\<rightarrow>* s'\" by blast\n    ultimately show ?case by(auto intro: rtranclp_trans)\n  qed\nqed\n\nlemma \\<tau>rtrancl3p_snocI:\n  \"\\<And>tl. \\<lbrakk> \\<tau>rtrancl3p s tls s''; s'' -\\<tau>\\<rightarrow>* s'''; s''' -tl\\<rightarrow> s'; \\<not> \\<tau>move s''' tl s' \\<rbrakk>\n  \\<Longrightarrow> \\<tau>rtrancl3p s (tls @ [tl]) s'\"\napply(erule \\<tau>rtrancl3p_trans)\napply(fold \\<tau>rtrancl3p_Nil_eq_\\<tau>moves)\napply(drule \\<tau>rtrancl3p_trans)\n apply(erule (1) \\<tau>rtrancl3p_step)\n apply(rule \\<tau>rtrancl3p_refl)\napply simp\ndone\n\nlemma \\<tau>diverge_rtranclp_silent_move:\n  \"\\<lbrakk> silent_move^** s s'; s' -\\<tau>\\<rightarrow> \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\nby(induct rule: converse_rtranclp_induct)(auto intro: \\<tau>divergeI)\n\nlemma \\<tau>diverge_trancl_coinduct [consumes 1, case_names \\<tau>diverge]:\n  assumes X: \"X s\"\n  and step: \"\\<And>s. X s \\<Longrightarrow> \\<exists>s'. silent_move^++ s s' \\<and> (X s' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>)\"\n  shows \"s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof -\n  from X have \"\\<exists>s'. silent_move^** s s' \\<and> X s'\" by blast\n  thus ?thesis\n  proof(coinduct)\n    case (\\<tau>diverge s)\n    then obtain s' where \"silent_move\\<^sup>*\\<^sup>* s s'\" \"X s'\" by blast\n    from step[OF `X s'`] obtain s'''\n      where \"silent_move^++ s' s'''\" \"X s''' \\<or> s''' -\\<tau>\\<rightarrow> \\<infinity>\" by blast\n    from `silent_move\\<^sup>*\\<^sup>* s s'` show ?case\n    proof(cases rule: converse_rtranclpE[consumes 1, case_names refl step])\n      case refl\n      moreover from tranclpD[OF `silent_move^++ s' s'''`] obtain s''\n        where \"silent_move s' s''\" \"silent_move^** s'' s'''\" by blast\n      ultimately show ?thesis using `silent_move^** s'' s'''` `X s''' \\<or> s''' -\\<tau>\\<rightarrow> \\<infinity>`\n        by(auto intro: \\<tau>diverge_rtranclp_silent_move)\n    next\n      case (step S)\n      moreover from `silent_move\\<^sup>*\\<^sup>* S s'` `silent_move^++ s' s'''`\n      have \"silent_move^** S s'''\" by(rule rtranclp_trans[OF _ tranclp_into_rtranclp])\n      ultimately show ?thesis using `X s''' \\<or> s''' -\\<tau>\\<rightarrow> \\<infinity>` by(auto intro: \\<tau>diverge_rtranclp_silent_move)\n    qed\n  qed\nqed\n\nlemma \\<tau>diverge_trancl_measure_coinduct [consumes 2, case_names \\<tau>diverge]:\n  assumes major: \"X s t\" \"wfP \\<mu>\"\n  and step: \"\\<And>s t. X s t \\<Longrightarrow> \\<exists>s' t'. (\\<mu> t' t \\<and> s' = s \\<or> silent_move^++ s s') \\<and> (X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>)\"\n  shows \"s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof -\n  { fix s t\n    assume \"X s t\"\n    with `wfP \\<mu>` have \"\\<exists>s' t'. silent_move^++ s s' \\<and> (X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>)\"\n    proof(induct arbitrary: s rule: wfP_induct[consumes 1])\n      case (1 t)\n      hence IH: \"\\<And>s' t'. \\<lbrakk> \\<mu> t' t; X s' t' \\<rbrakk> \\<Longrightarrow>\n                 \\<exists>s'' t''. silent_move^++ s' s'' \\<and> (X s'' t'' \\<or> s'' -\\<tau>\\<rightarrow> \\<infinity>)\" by blast\n      from step[OF `X s t`] obtain s' t'\n        where \"\\<mu> t' t \\<and> s' = s \\<or> silent_move\\<^sup>+\\<^sup>+ s s'\" \"X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>\" by blast\n      from `\\<mu> t' t \\<and> s' = s \\<or> silent_move\\<^sup>+\\<^sup>+ s s'` show ?case\n      proof\n        assume \"\\<mu> t' t \\<and> s' = s\"\n        hence  \"\\<mu> t' t\" and [simp]: \"s' = s\" by simp_all\n        from `X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>` show ?thesis\n        proof\n          assume \"X s' t'\"\n          from IH[OF `\\<mu> t' t` this] show ?thesis by simp\n        next\n          assume \"s' -\\<tau>\\<rightarrow> \\<infinity>\" thus ?thesis\n            by cases(auto simp add: silent_move_iff)\n        qed\n      next\n        assume \"silent_move\\<^sup>+\\<^sup>+ s s'\"\n        thus ?thesis using `X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>` by blast\n      qed\n    qed }\n  note X = this\n  from `X s t` have \"\\<exists>t. X s t\" ..\n  thus ?thesis\n  proof(coinduct rule: \\<tau>diverge_trancl_coinduct)\n    case (\\<tau>diverge s)\n    then obtain t where \"X s t\" ..\n    from X[OF this] show ?case by blast\n  qed\nqed\n\nlemma \\<tau>inf_step2\\<tau>inf_step_table_LNil [simp]: \"\\<tau>inf_step2\\<tau>inf_step_table s LNil = LNil\"\nby(simp add: \\<tau>inf_step2\\<tau>inf_step_table_def)\n\nlemma \\<tau>inf_step2\\<tau>inf_step_table_LCons [simp]:\n  fixes s tl ss tls\n  defines \"ss \\<equiv> SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls\\<rightarrow>* \\<infinity>\"\n  shows\n  \"\\<tau>inf_step2\\<tau>inf_step_table s (LCons tl tls) =\n   LCons (s, fst ss, tl, snd ss) (\\<tau>inf_step2\\<tau>inf_step_table (snd ss) tls)\"\nby(simp add: ss_def \\<tau>inf_step2\\<tau>inf_step_table_def split_beta)\n\nlemma lnull_\\<tau>inf_step2\\<tau>inf_step_table [simp]:\n  \"lnull (\\<tau>inf_step2\\<tau>inf_step_table s tls) \\<longleftrightarrow> lnull tls\"\nby(simp add: \\<tau>inf_step2\\<tau>inf_step_table_def)\n\nlemma lhd_\\<tau>inf_step2\\<tau>inf_step_table [simp]:\n  \"\\<not> lnull tls \\<Longrightarrow> lhd (\\<tau>inf_step2\\<tau>inf_step_table s tls) = \n  (let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n  in (s, s', lhd tls, s''))\"\nunfolding \\<tau>inf_step2\\<tau>inf_step_table_def Let_def by simp\n\nlemma ltl_\\<tau>inf_step2\\<tau>inf_step_table [simp]:\n  \"\\<not> lnull tls \\<Longrightarrow> ltl (\\<tau>inf_step2\\<tau>inf_step_table s tls) =\n  (let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n  in \\<tau>inf_step2\\<tau>inf_step_table s'' (ltl tls))\"\nunfolding \\<tau>inf_step2\\<tau>inf_step_table_def Let_def\nby(simp add: split_beta)\n\nlemma lmap_\\<tau>inf_step2\\<tau>inf_step_table: \"lmap (fst \\<circ> snd \\<circ> snd) (\\<tau>inf_step2\\<tau>inf_step_table s tls) = tls\"\nby(coinduction arbitrary: s tls)(auto simp add: split_beta)\n\nlemma \\<tau>inf_step_into_\\<tau>inf_step_table:\n  \"s -\\<tau>-tls\\<rightarrow>* \\<infinity> \\<Longrightarrow> s -\\<tau>-\\<tau>inf_step2\\<tau>inf_step_table s tls\\<rightarrow>*t \\<infinity>\"\nproof(coinduction arbitrary: s tls)\n  case (\\<tau>inf_step_table s tls)\n  thus ?case\n  proof(cases)\n    case (\\<tau>inf_step_Cons s' s'' tls' tl)\n    let ?ss = \"SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>\"\n    from \\<tau>inf_step_Cons have tls: \"tls = LCons tl tls'\" and \"s -\\<tau>\\<rightarrow>* s'\" \"s' -tl\\<rightarrow> s''\"\n      \"\\<not> \\<tau>move s' tl s''\" \"s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>\" by simp_all\n    hence \"(\\<lambda>(s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>) (s', s'')\" by simp\n    hence \"(\\<lambda>(s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>) ?ss\" by(rule someI)\n    with tls have ?\\<tau>inf_step_table_Cons by auto\n    thus ?thesis ..\n  next\n    case \\<tau>inf_step_Nil\n    then have ?\\<tau>inf_step_table_Nil by simp\n    thus ?thesis ..\n  qed\nqed\n\nlemma \\<tau>inf_step_imp_\\<tau>inf_step_table:\n  assumes \"s -\\<tau>-tls\\<rightarrow>* \\<infinity>\"\n  shows \"\\<exists>sstls. s -\\<tau>-sstls\\<rightarrow>*t \\<infinity> \\<and> tls = lmap (fst \\<circ> snd \\<circ> snd) sstls\"\nusing \\<tau>inf_step_into_\\<tau>inf_step_table[OF assms]\nby(auto simp only: lmap_\\<tau>inf_step2\\<tau>inf_step_table)\n\nlemma \\<tau>inf_step_table_into_\\<tau>inf_step:\n  \"s -\\<tau>-sstls\\<rightarrow>*t \\<infinity> \\<Longrightarrow> s -\\<tau>-lmap (fst \\<circ> snd \\<circ> snd) sstls\\<rightarrow>* \\<infinity>\"\nproof(coinduction arbitrary: s sstls)\n  case (\\<tau>inf_step s tls)\n  thus ?case by cases(auto simp add: o_def)\nqed\n\nlemma silent_move_fromI [intro]:\n  \"\\<lbrakk> silent_moves s0 s1; silent_move s1 s2 \\<rbrakk> \\<Longrightarrow> silent_move_from s0 s1 s2\"\nby(simp add: silent_move_from_def)\n\nlemma silent_move_fromE [elim]:\n  assumes \"silent_move_from s0 s1 s2\"\n  obtains \"silent_moves s0 s1\" \"silent_move s1 s2\"\nusing assms by(auto simp add: silent_move_from_def)\n\nlemma rtranclp_silent_move_from_imp_silent_moves:\n  assumes s'x: \"silent_move\\<^sup>*\\<^sup>* s' x\"\n  shows \"(silent_move_from s')^** x z \\<Longrightarrow> silent_moves s' z\"\nby(induct rule: rtranclp_induct)(auto intro: s'x)\n\nlemma \\<tau>diverge_not_wfP_silent_move_from:\n  assumes \"s -\\<tau>\\<rightarrow> \\<infinity>\"\n  shows \"\\<not> wfP (flip (silent_move_from s))\"\nproof\n  assume \"wfP (flip (silent_move_from s))\"\n  moreover def Q == \"{s'. silent_moves s s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>}\"\n  hence \"s \\<in> Q\" using `s -\\<tau>\\<rightarrow> \\<infinity>` by(auto)\n  ultimately have \"\\<exists>z\\<in>Q. \\<forall>y. silent_move_from s z y \\<longrightarrow> y \\<notin> Q\"\n    unfolding wfP_eq_minimal flip_simps by blast\n  then obtain z where \"z \\<in> Q\"\n    and min: \"\\<And>y. silent_move_from s z y \\<Longrightarrow> y \\<notin> Q\" by blast\n  from `z \\<in> Q` have \"silent_moves s z\" \"z -\\<tau>\\<rightarrow> \\<infinity>\" unfolding Q_def by auto\n  from `z -\\<tau>\\<rightarrow> \\<infinity>` obtain y where \"silent_move z y\" \"y -\\<tau>\\<rightarrow> \\<infinity>\" by cases auto\n  from `silent_moves s z` `silent_move z y` have \"silent_move_from s z y\" ..\n  hence \"y \\<notin> Q\" by(rule min)\n  moreover from `silent_moves s z` `silent_move z y` `y -\\<tau>\\<rightarrow> \\<infinity>`\n  have \"y \\<in> Q\" unfolding Q_def by auto\n  ultimately show False by contradiction\nqed\n\nlemma wfP_silent_move_from_unroll:\n  assumes wfPs': \"\\<And>s'. s -\\<tau>\\<rightarrow> s' \\<Longrightarrow> wfP (flip (silent_move_from s'))\"\n  shows \"wfP (flip (silent_move_from s))\"\n  unfolding wfP_eq_minimal flip_conv\nproof(intro allI impI)\n  fix Q and x :: 's\n  assume \"x \\<in> Q\"\n  show \"\\<exists>z\\<in>Q. \\<forall>y. silent_move_from s z y \\<longrightarrow> y \\<notin> Q\"\n  proof(cases \"\\<exists>s'. s -\\<tau>\\<rightarrow> s' \\<and> (\\<exists>x'. silent_moves s' x' \\<and> x' \\<in> Q)\")\n    case False\n    hence \"\\<forall>y. silent_move_from s x y \\<longrightarrow> \\<not> y \\<in> Q\"\n      by(cases \"x=s\")(auto, blast elim: converse_rtranclpE intro: rtranclp.rtrancl_into_rtrancl)\n    with `x \\<in> Q` show ?thesis by blast\n  next\n    case True\n    then obtain s' x' where \"s -\\<tau>\\<rightarrow> s'\" and \"silent_moves s' x'\" and \"x' \\<in> Q\"\n      by auto\n    from `s -\\<tau>\\<rightarrow> s'` have \"wfP (flip (silent_move_from s'))\" by(rule wfPs')\n    from this `x' \\<in> Q` obtain z where \"z \\<in> Q\" and min: \"\\<And>y. silent_move_from s' z y \\<Longrightarrow> \\<not> y \\<in> Q\"\n      and \"(silent_move_from s')^** x' z\"\n      by (rule wfP_minimalE) (unfold flip_simps, blast)\n    { fix y\n      assume \"silent_move_from s z y\"\n      with `(silent_move_from s')^** x' z` `silent_move^** s' x'`\n      have \"silent_move_from s' z y\"\n        by(blast intro: rtranclp_silent_move_from_imp_silent_moves)\n      hence \"\\<not> y \\<in> Q\" by(rule min) }\n    with `z \\<in> Q` show ?thesis by(auto simp add: intro!: bexI)\n  qed\nqed\n\nlemma not_wfP_silent_move_from_\\<tau>diverge:\n  assumes \"\\<not> wfP (flip (silent_move_from s))\"\n  shows \"s -\\<tau>\\<rightarrow> \\<infinity>\"\nusing assms\nproof(coinduct)\n  case (\\<tau>diverge s)\n  { assume wfPs': \"\\<And>s'. s -\\<tau>\\<rightarrow> s' \\<Longrightarrow> wfP (flip (silent_move_from s'))\"\n    hence \"wfP (flip (silent_move_from s))\" by(rule wfP_silent_move_from_unroll) }\n  with \\<tau>diverge have \"\\<exists>s'. s -\\<tau>\\<rightarrow> s' \\<and> \\<not> wfP (flip (silent_move_from s'))\" by auto\n  thus ?case by blast\nqed\n\nlemma \\<tau>diverge_neq_wfP_silent_move_from:\n  \"s -\\<tau>\\<rightarrow> \\<infinity> \\<noteq> wfP (flip (silent_move_from s))\"\nby(auto intro: not_wfP_silent_move_from_\\<tau>diverge dest: \\<tau>diverge_not_wfP_silent_move_from)\n\nlemma not_\\<tau>diverge_to_no_\\<tau>move:\n  assumes \"\\<not> s -\\<tau>\\<rightarrow> \\<infinity>\"\n  shows \"\\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> (\\<forall>s''. \\<not> s' -\\<tau>\\<rightarrow> s'')\"\nproof -\n  def S == s\n  from `\\<not> \\<tau>diverge s` have \"wfP (flip (silent_move_from S))\" unfolding S_def\n    using \\<tau>diverge_neq_wfP_silent_move_from[of s] by simp\n  moreover have \"silent_moves S s\" unfolding S_def ..\n  ultimately show ?thesis\n  proof(induct rule: wfP_induct')\n    case (wfP s)\n    note IH = `\\<And>y. \\<lbrakk>flip (silent_move_from S) y s; S -\\<tau>\\<rightarrow>* y \\<rbrakk>\n             \\<Longrightarrow> \\<exists>s'. y -\\<tau>\\<rightarrow>* s' \\<and> (\\<forall>s''. \\<not> s' -\\<tau>\\<rightarrow> s'')`\n    show ?case\n    proof(cases \"\\<exists>s'. silent_move s s'\")\n      case False thus ?thesis by auto\n    next\n      case True\n      then obtain s' where \"s -\\<tau>\\<rightarrow> s'\" ..\n      with `S -\\<tau>\\<rightarrow>* s` have \"flip (silent_move_from S) s' s\"\n        unfolding flip_conv by(rule silent_move_fromI)\n      moreover from `S -\\<tau>\\<rightarrow>* s` `s -\\<tau>\\<rightarrow> s'` have \"S -\\<tau>\\<rightarrow>* s'\" ..\n      ultimately have \"\\<exists>s''. s' -\\<tau>\\<rightarrow>* s'' \\<and> (\\<forall>s'''. \\<not> s'' -\\<tau>\\<rightarrow> s''')\" by(rule IH)\n      then obtain s'' where \"s' -\\<tau>\\<rightarrow>* s''\" \"\\<forall>s'''. \\<not> s'' -\\<tau>\\<rightarrow> s'''\" by blast\n      from `s -\\<tau>\\<rightarrow> s'` `s' -\\<tau>\\<rightarrow>* s''` have \"s -\\<tau>\\<rightarrow>* s''\" by(rule converse_rtranclp_into_rtranclp)\n      with `\\<forall>s'''. \\<not> s'' -\\<tau>\\<rightarrow> s'''` show ?thesis by blast\n    qed\n  qed\nqed\n\nlemma \\<tau>diverge_conv_\\<tau>Runs:\n  \"s -\\<tau>\\<rightarrow> \\<infinity> \\<longleftrightarrow> s \\<Down> TNil None\"\nby(auto intro: \\<tau>Runs.Diverge elim: \\<tau>Runs.cases)\n\nlemma \\<tau>inf_step_into_\\<tau>Runs:\n  \"s -\\<tau>-tls\\<rightarrow>* \\<infinity> \\<Longrightarrow> s \\<Down> tllist_of_llist None tls\"\nproof(coinduction arbitrary: s tls)\n  case (\\<tau>Runs s tls')\n  thus ?case by cases(auto simp add: \\<tau>diverge_conv_\\<tau>Runs)\nqed\n\nlemma \\<tau>_into_\\<tau>Runs:\n  \"\\<lbrakk> s -\\<tau>\\<rightarrow> s'; s' \\<Down> tls \\<rbrakk> \\<Longrightarrow> s \\<Down> tls\"\nby(blast elim: \\<tau>Runs.cases intro: \\<tau>Runs.intros \\<tau>diverge.intros converse_rtranclp_into_rtranclp)\n\nlemma \\<tau>rtrancl3p_into_\\<tau>Runs:\n  assumes \"s -\\<tau>-tls\\<rightarrow>* s'\"\n  and \"s' \\<Down> tls'\"\n  shows \"s \\<Down> lappendt (llist_of tls) tls'\"\nusing assms\nby induct(auto intro: \\<tau>Runs.Proceed \\<tau>_into_\\<tau>Runs)\n\nlemma \\<tau>Runs_table_into_\\<tau>Runs:\n  \"\\<tau>Runs_table s stlsss \\<Longrightarrow> s \\<Down> tmap fst id stlsss\"\nproof(coinduction arbitrary: s stlsss)\n  case (\\<tau>Runs s tls)\n  thus ?case by cases(auto simp add: o_def id_def)\nqed\n\ndefinition \\<tau>Runs2\\<tau>Runs_table :: \"'s \\<Rightarrow> ('tl, 's option) tllist \\<Rightarrow> ('tl \\<times> 's, 's option) tllist\"\nwhere\n  \"\\<tau>Runs2\\<tau>Runs_table s tls = unfold_tllist\n     (\\<lambda>(s, tls). is_TNil tls)\n     (\\<lambda>(s, tls). terminal tls)\n     (\\<lambda>(s, tls). (thd tls, SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls))\n     (\\<lambda>(s, tls). (SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls, ttl tls))\n     (s, tls)\"\n\nlemma is_TNil_\\<tau>Runs2\\<tau>Runs_table [simp]:\n  \"is_TNil (\\<tau>Runs2\\<tau>Runs_table s tls) \\<longleftrightarrow> is_TNil tls\"\n  thm unfold_tllist.disc\nby(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\n\nlemma thd_\\<tau>Runs2\\<tau>Runs_table [simp]:\n  \"\\<not> is_TNil tls \\<Longrightarrow>\n  thd (\\<tau>Runs2\\<tau>Runs_table s tls) =\n  (thd tls, SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls)\"\nby(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\n\n\n\nlemma terminal_\\<tau>Runs2\\<tau>Runs_table [simp]:\n  \"is_TNil tls \\<Longrightarrow> terminal (\\<tau>Runs2\\<tau>Runs_table s tls) = terminal tls\"\nby(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\n\nlemma \\<tau>Runs2\\<tau>Runs_table_simps [simp, nitpick_simp]:\n  \"\\<tau>Runs2\\<tau>Runs_table s (TNil so) = TNil so\"\n  \"\\<And>tl. \n   \\<tau>Runs2\\<tau>Runs_table s (TCons tl tls) =\n   (let s'' = SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' \\<Down> tls\n    in TCons (tl, s'') (\\<tau>Runs2\\<tau>Runs_table s'' tls))\"\n apply(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\napply(rule tllist.expand)\napply(simp_all)\ndone\n\nlemma \\<tau>Runs2\\<tau>Runs_table_inverse:\n  \"tmap fst id (\\<tau>Runs2\\<tau>Runs_table s tls) = tls\"\nby(coinduction arbitrary: s tls) auto\n \nlemma \\<tau>Runs_into_\\<tau>Runs_table:\n  assumes \"s \\<Down> tls\"\n  shows \"\\<exists>stlsss. tls = tmap fst id stlsss \\<and> \\<tau>Runs_table s stlsss\"\nproof(intro exI conjI)\n  from assms show \"\\<tau>Runs_table s (\\<tau>Runs2\\<tau>Runs_table s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (\\<tau>Runs_table s tls)\n    thus ?case\n    proof cases\n      case (Terminate s')\n      hence ?Terminate by simp\n      thus ?thesis ..\n    next\n      case Diverge\n      hence ?Diverge by simp\n      thus ?thesis by simp\n    next\n      case (Proceed s' s'' tls' tl)\n      let ?P = \"\\<lambda>s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' \\<Down> tls'\"\n      from Proceed have \"?P s''\" by auto\n      hence \"?P (Eps ?P)\" by(rule someI)\n      hence ?Proceed using `tls = TCons tl tls'`\n        by(auto simp add: split_beta)\n      thus ?thesis by simp\n    qed\n  qed\nqed(simp add: \\<tau>Runs2\\<tau>Runs_table_inverse)\n\nlemma \\<tau>Runs_lappendtE:\n  assumes \"\\<sigma> \\<Down> lappendt tls tls'\"\n  and \"lfinite tls\"\n  obtains \\<sigma>' where \"\\<sigma> -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>'\"\n  and \"\\<sigma>' \\<Down> tls'\"\nproof(atomize_elim)\n  from `lfinite tls` `\\<sigma> \\<Down> lappendt tls tls'`\n  show \"\\<exists>\\<sigma>'. \\<sigma> -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>' \\<and> \\<sigma>' \\<Down> tls'\"\n  proof(induct arbitrary: \\<sigma>)\n    case lfinite_LNil thus ?case by(auto intro: \\<tau>rtrancl3p_refl)\n  next\n    case (lfinite_LConsI tls tl)\n    from `\\<sigma> \\<Down> lappendt (LCons tl tls) tls'`\n    show ?case unfolding lappendt_LCons\n    proof(cases)\n      case (Proceed \\<sigma>' \\<sigma>'')\n      from `\\<sigma>'' \\<Down> lappendt tls tls' \\<Longrightarrow> \\<exists>\\<sigma>'''. \\<sigma>'' -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>''' \\<and> \\<sigma>''' \\<Down> tls'` `\\<sigma>'' \\<Down> lappendt tls tls'`\n      obtain \\<sigma>''' where \"\\<sigma>'' -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>'''\" \"\\<sigma>''' \\<Down> tls'\" by blast\n      from `\\<sigma>' -tl\\<rightarrow> \\<sigma>''` `\\<not> \\<tau>move \\<sigma>' tl \\<sigma>''` `\\<sigma>'' -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>'''`\n      have \"\\<sigma>' -\\<tau>-tl # list_of tls\\<rightarrow>* \\<sigma>'''\" by(rule \\<tau>rtrancl3p_step)\n      with `\\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>'` have \"\\<sigma> -\\<tau>-[] @ (tl # list_of tls)\\<rightarrow>* \\<sigma>'''\"\n        unfolding \\<tau>rtrancl3p_Nil_eq_\\<tau>moves[symmetric] by(rule \\<tau>rtrancl3p_trans)\n      with `lfinite tls` have \"\\<sigma> -\\<tau>-list_of (LCons tl tls)\\<rightarrow>* \\<sigma>'''\" by(simp add: list_of_LCons)\n      with `\\<sigma>''' \\<Down> tls'` show ?thesis by blast\n    qed\n  qed\nqed\n\nlemma \\<tau>Runs_total:\n  \"\\<exists>tls. \\<sigma> \\<Down> tls\"\nproof\n  let ?\\<tau>halt = \"\\<lambda>\\<sigma> \\<sigma>'. \\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>' \\<and> (\\<forall>tl \\<sigma>''. \\<not> \\<sigma>' -tl\\<rightarrow> \\<sigma>'')\"\n  let ?\\<tau>diverge = \"\\<lambda>\\<sigma>. \\<sigma> -\\<tau>\\<rightarrow> \\<infinity>\"\n  let ?proceed = \"\\<lambda>\\<sigma> (tl, \\<sigma>''). \\<exists>\\<sigma>'. \\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>' \\<and> \\<sigma>' -tl\\<rightarrow> \\<sigma>'' \\<and> \\<not> \\<tau>move \\<sigma>' tl \\<sigma>''\"\n\n  def tls == \"unfold_tllist\n     (\\<lambda>\\<sigma>. (\\<exists>\\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>') \\<or> ?\\<tau>diverge \\<sigma>)\n     (\\<lambda>\\<sigma>. if \\<exists>\\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>' then Some (SOME \\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>') else None)\n     (\\<lambda>\\<sigma>. fst (SOME tl\\<sigma>'. ?proceed \\<sigma> tl\\<sigma>'))\n     (\\<lambda>\\<sigma>. snd (SOME tl\\<sigma>'. ?proceed \\<sigma> tl\\<sigma>')) \\<sigma>\"\n  from meta_eq_to_obj_eq[OF this]\n  show \"\\<sigma> \\<Down> tls\"\n  proof(coinduct \\<sigma> tls rule: \\<tau>Runs.coinduct)\n    case (\\<tau>Runs \\<sigma> tls)\n    show ?case\n    proof(cases \"\\<exists>\\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>'\")\n      case True\n      hence \"?\\<tau>halt \\<sigma> (SOME \\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>')\" by(rule someI_ex)\n      hence ?Terminate using True unfolding \\<tau>Runs by simp\n      thus ?thesis ..\n    next\n      case False\n      note \\<tau>halt = this\n      show ?thesis\n      proof(cases \"?\\<tau>diverge \\<sigma>\")\n        case True\n        hence ?Diverge using False unfolding \\<tau>Runs by simp\n        thus ?thesis by simp\n      next\n        case False\n        from not_\\<tau>diverge_to_no_\\<tau>move[OF this]\n        obtain \\<sigma>' where \\<sigma>_\\<sigma>': \"\\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>'\"\n          and no_\\<tau>: \"\\<And>\\<sigma>''. \\<not> \\<sigma>' -\\<tau>\\<rightarrow> \\<sigma>''\" by blast\n        from \\<sigma>_\\<sigma>' \\<tau>halt obtain tl \\<sigma>'' where \"\\<sigma>' -tl\\<rightarrow> \\<sigma>''\" by auto\n        moreover with no_\\<tau>[of \\<sigma>''] have \"\\<not> \\<tau>move \\<sigma>' tl \\<sigma>''\" by auto\n        ultimately have \"?proceed \\<sigma> (tl, \\<sigma>'')\" using \\<sigma>_\\<sigma>' by auto\n        hence \"?proceed \\<sigma> (SOME tl\\<sigma>. ?proceed \\<sigma> tl\\<sigma>)\" by(rule someI)\n        hence ?Proceed using False \\<tau>halt unfolding \\<tau>Runs\n          by(subst unfold_tllist.code) fastforce\n        thus ?thesis by simp\n      qed\n    qed\n  qed\nqed\n\n\n\n\n\nlemma silent_moves2_into_silent_moves:\n  assumes \"silent_moves2 s tls s'\"\n  shows \"s -\\<tau>\\<rightarrow>* s'\"\nusing assms\nby(induct)(blast intro: silent_move2_into_silent_move rtranclp.rtrancl_into_rtrancl)+\n\nlemma silent_moves_into_silent_moves2:\n  assumes \"s -\\<tau>\\<rightarrow>* s'\"\n  shows \"\\<exists>tls. silent_moves2 s tls s'\"\nusing assms\nby(induct)(blast dest: silent_move_into_silent_move2 intro: rtrancl3p_step)+\n\n\n\nlemma \\<tau>diverge_into_inf_step_silent_move2:\n  assumes \"s -\\<tau>\\<rightarrow> \\<infinity>\"\n  obtains tls where \"trsys.inf_step silent_move2 s tls\"\nproof -\n  def tls \\<equiv> \"unfold_llist\n     (\\<lambda>_. False)\n     (\\<lambda>s. fst (SOME (tl, s'). silent_move2 s tl s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>))\n     (\\<lambda>s. snd (SOME (tl, s'). silent_move2 s tl s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>))\n     s\" (is \"?tls s\")\n  \n  with assms have \"s -\\<tau>\\<rightarrow> \\<infinity> \\<and> tls = ?tls s\" by simp\n  hence \"trsys.inf_step silent_move2 s tls\"\n  proof(coinduct rule: trsys.inf_step.coinduct[consumes 1, case_names inf_step, case_conclusion inf_step step])\n    case (inf_step s tls)\n    let ?P = \"\\<lambda>(tl, s'). silent_move2 s tl s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>\"\n    from inf_step obtain \"s -\\<tau>\\<rightarrow> \\<infinity>\" and tls: \"tls = ?tls s\" ..\n    from `s -\\<tau>\\<rightarrow> \\<infinity>` obtain s' where \"s -\\<tau>\\<rightarrow> s'\" \"s' -\\<tau>\\<rightarrow> \\<infinity>\" by cases\n    from `s -\\<tau>\\<rightarrow> s'` obtain tl where \"silent_move2 s tl s'\" \n      by(blast dest: silent_move_into_silent_move2)\n    with `s' -\\<tau>\\<rightarrow> \\<infinity>` have \"?P (tl, s')\" by simp\n    hence \"?P (Eps ?P)\" by(rule someI)\n    thus ?case using tls\n      by(subst (asm) unfold_llist.code)(auto)\n  qed\n  thus thesis by(rule that)\nqed\n\nlemma \\<tau>Runs_into_\\<tau>rtrancl3p:\n  assumes runs: \"s \\<Down> tlss\"\n  and fin: \"tfinite tlss\"\n  and terminal: \"terminal tlss = Some s'\"\n  shows \"\\<tau>rtrancl3p s (list_of (llist_of_tllist tlss)) s'\"\nusing fin runs terminal\nproof(induct arbitrary: s rule: tfinite_induct)\n  case TNil thus ?case by cases(auto intro: silent_moves_into_\\<tau>rtrancl3p)\nnext\n  case (TCons tl tlss)\n  from `s \\<Down> TCons tl tlss` obtain s'' s'''\n    where step: \"s -\\<tau>\\<rightarrow>* s''\"\n    and step2: \"s'' -tl\\<rightarrow> s'''\" \"\\<not> \\<tau>move s'' tl s'''\" \n    and \"s''' \\<Down> tlss\" by cases\n  from `terminal (TCons tl tlss) = \\<lfloor>s'\\<rfloor>` have \"terminal tlss = \\<lfloor>s'\\<rfloor>\" by simp\n  with `s''' \\<Down> tlss` have \"s''' -\\<tau>-list_of (llist_of_tllist tlss)\\<rightarrow>* s'\" by(rule TCons)\n  with step2 have \"s'' -\\<tau>-tl # list_of (llist_of_tllist tlss)\\<rightarrow>* s'\" by(rule \\<tau>rtrancl3p_step)\n  with step have \"s -\\<tau>-[] @ tl # list_of (llist_of_tllist tlss)\\<rightarrow>* s'\"\n    by(rule \\<tau>rtrancl3p_trans[OF silent_moves_into_\\<tau>rtrancl3p])\n  thus ?case using `tfinite tlss` by simp\nqed\n\nlemma \\<tau>Runs_terminal_stuck:\n  assumes Runs: \"s \\<Down> tlss\"\n  and fin: \"tfinite tlss\"\n  and terminal: \"terminal tlss = Some s'\"\n  and proceed: \"s' -tls\\<rightarrow> s''\"\n  shows False\nusing fin Runs terminal\nproof(induct arbitrary: s rule: tfinite_induct)\n  case TNil thus ?case using proceed by cases auto\nnext\n  case TCons thus ?case by(fastforce elim: \\<tau>Runs.cases)\nqed\n\nlemma Runs_table_silent_diverge:\n  \"\\<lbrakk> Runs_table s stlss; \\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'; \\<not> lfinite stlss \\<rbrakk>\n  \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof(coinduction arbitrary: s stlss)\n  case (\\<tau>diverge s)\n  thus ?case by cases(auto 5 2)\nqed\n\nlemma Runs_table_silent_rtrancl:\n  assumes \"lfinite stlss\"\n  and \"Runs_table s stlss\"\n  and \"\\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'\"\n  shows \"s -\\<tau>\\<rightarrow>* llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\" (is ?thesis1)\n  and \"llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss)) -tl'\\<rightarrow> s'' \\<Longrightarrow> False\" (is \"PROP ?thesis2\")\nproof -\n  from assms have \"?thesis1 \\<and> (llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss)) -tl'\\<rightarrow> s'' \\<longrightarrow> False)\"\n  proof(induct arbitrary: s)\n    case lfinite_LNil thus ?case by(auto elim: Runs_table.cases)\n  next\n    case (lfinite_LConsI stlss stls)\n    from `Runs_table s (LCons stls stlss)`\n    obtain tl s' where [simp]: \"stls = (s, tl, s')\"\n      and \"s -tl\\<rightarrow> s'\" and Run': \"Runs_table s' stlss\" by cases\n    from `\\<forall>(s, tl, s')\\<in>lset (LCons stls stlss). \\<tau>move s tl s'`\n    have \"\\<tau>move s tl s'\" and silent': \"\\<forall>(s, tl, s')\\<in>lset stlss. \\<tau>move s tl s'\" by simp_all\n    from `s -tl\\<rightarrow> s'` `\\<tau>move s tl s'` have \"s -\\<tau>\\<rightarrow> s'\" by auto\n    moreover from Run' silent'\n    have \"s' -\\<tau>\\<rightarrow>* llast (LCons s' (lmap (\\<lambda>(s, tl, s'). s') stlss)) \\<and>\n          (llast (LCons s' (lmap (\\<lambda>(s, tl, s'). s') stlss)) -tl'\\<rightarrow> s'' \\<longrightarrow> False)\"\n      by(rule lfinite_LConsI)\n    ultimately show ?case by(auto)\n  qed\n  thus ?thesis1 \"PROP ?thesis2\" by blast+\nqed\n\nlemma Runs_table_silent_lappendD:\n  fixes s stlss\n  defines \"s' \\<equiv> llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\"\n  assumes Runs: \"Runs_table s (lappend stlss stlss')\"\n  and fin: \"lfinite stlss\"\n  and silent: \"\\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'\"\n  shows \"s -\\<tau>\\<rightarrow>* s'\" (is ?thesis1)\n  and \"Runs_table s' stlss'\" (is ?thesis2)\n  and \"stlss' \\<noteq> LNil \\<Longrightarrow> s' = fst (lhd stlss')\" (is \"PROP ?thesis3\")\nproof -\n  from fin Runs silent\n  have \"?thesis1 \\<and> ?thesis2 \\<and> (stlss' \\<noteq> LNil \\<longrightarrow> s' = fst (lhd stlss'))\"\n    unfolding s'_def\n  proof(induct arbitrary: s)\n    case lfinite_LNil thus ?case\n      by(auto simp add: neq_LNil_conv Runs_table_simps)\n  next\n    case lfinite_LConsI thus ?case\n      by(clarsimp simp add: neq_LNil_conv Runs_table_simps)(blast intro: converse_rtranclp_into_rtranclp)\n  qed\n  thus ?thesis1 ?thesis2 \"PROP ?thesis3\" by simp_all\nqed\n\nlemma Runs_table_into_\\<tau>Runs:\n  fixes s stlss\n  defines \"tls \\<equiv> tmap (\\<lambda>(s, tl, s'). tl) id (tfilter None (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') (tllist_of_llist (Some (llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss)))) stlss))\"\n  (is \"_ \\<equiv> ?conv s stlss\")\n  assumes \"Runs_table s stlss\"\n  shows \"\\<tau>Runs s tls\"\nusing assms\nproof(coinduction arbitrary: s tls stlss)\n  case (\\<tau>Runs s tls stlss)\n  note tls = `tls = ?conv s stlss`\n    and Run = `Runs_table s stlss`\n  show ?case\n  proof(cases tls)\n    case (TNil so)[simp]\n    from tls\n    have silent: \"\\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'\"\n      by(auto simp add: TNil_eq_tmap_conv tfilter_empty_conv)\n    show ?thesis\n    proof(cases \"lfinite stlss\")\n      case False\n      with Run silent have \"s -\\<tau>\\<rightarrow> \\<infinity>\" by(rule Runs_table_silent_diverge)\n      hence ?Diverge using False tls by(simp add: TNil_eq_tmap_conv tfilter_empty_conv)\n      thus ?thesis by simp\n    next\n      case True\n      with Runs_table_silent_rtrancl[OF this Run silent]\n      have ?Terminate using tls\n        by(auto simp add: TNil_eq_tmap_conv tfilter_empty_conv terminal_tllist_of_llist split_def)\n      thus ?thesis by simp\n    qed\n  next\n    case (TCons tl tls')[simp]\n    from tls obtain s' s'' stlss' \n      where tl': \"tfilter None (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') (tllist_of_llist \\<lfloor>llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\\<rfloor> stlss) = TCons (s', tl, s'') stlss'\"\n      and tls': \"tls' = tmap (\\<lambda>(s, tl, s'). tl) id stlss'\"\n      by(simp add: TCons_eq_tmap_conv split_def id_def split_paired_Ex) blast\n    from tfilter_eq_TConsD[OF tl']\n    obtain stls\\<tau> rest\n      where stlss_eq: \"tllist_of_llist \\<lfloor>llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\\<rfloor> stlss = lappendt stls\\<tau> (TCons (s', tl, s'') rest)\"\n      and fin: \"lfinite stls\\<tau>\"\n      and silent: \"\\<forall>(s, tl, s')\\<in>lset stls\\<tau>. \\<tau>move s tl s'\"\n      and \"\\<not> \\<tau>move s' tl s''\"\n      and stlss': \"stlss' = tfilter None (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') rest\"\n      by(auto simp add: split_def)\n    from stlss_eq fin obtain rest'\n      where stlss: \"stlss = lappend stls\\<tau> rest'\"\n      and rest': \"tllist_of_llist \\<lfloor>llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\\<rfloor> rest' = TCons (s', tl, s'') rest\"\n      unfolding tllist_of_llist_eq_lappendt_conv by auto\n    hence \"rest' \\<noteq> LNil\" by clarsimp\n    from Run[unfolded stlss] fin silent\n    have \"s -\\<tau>\\<rightarrow>* llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stls\\<tau>))\"\n      and \"Runs_table (llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stls\\<tau>))) rest'\"\n      and \"llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stls\\<tau>)) = fst (lhd rest')\"\n      by(rule Runs_table_silent_lappendD)+(simp add: `rest' \\<noteq> LNil`)\n    moreover with rest' `rest' \\<noteq> LNil` stlss fin obtain rest''\n      where rest': \"rest' = LCons (s', tl, s'') rest''\"\n      and rest: \"rest = tllist_of_llist \\<lfloor>llast (LCons s'' (lmap (\\<lambda>(s, tl, s'). s') rest''))\\<rfloor> rest''\"\n      by(clarsimp simp add: neq_LNil_conv llast_LCons lmap_lappend_distrib)\n    ultimately have \"s -\\<tau>\\<rightarrow>* s'\" \"s' -tl\\<rightarrow> s''\" \"Runs_table s'' rest''\"\n      by(simp_all add: Runs_table_simps)\n    hence ?Proceed using `\\<not> \\<tau>move s' tl s''` tls' stlss' rest\n      by(auto simp add: id_def)\n    thus ?thesis by simp\n  qed\nqed\n\nlemma \\<tau>Runs_table2_into_\\<tau>Runs:\n  \"\\<tau>Runs_table2 s tlsstlss\n  \\<Longrightarrow> s \\<Down> tmap (\\<lambda>(tls, s', tl, s''). tl) (\\<lambda>x. case x of Inl (tls, s') \\<Rightarrow> Some s' | Inr _ \\<Rightarrow> None) tlsstlss\"\nusing assms\nproof(coinduction arbitrary: s tlsstlss)\n  case (\\<tau>Runs s tlsstlss)\n  thus ?case by cases(auto intro: silent_moves2_into_silent_moves inf_step_silent_move2_into_\\<tau>diverge)\nqed\n\nlemma \\<tau>Runs_into_\\<tau>Runs_table2:\n  assumes \"s \\<Down> tls\"\n  obtains tlsstlss\n  where \"\\<tau>Runs_table2 s tlsstlss\"\n  and \"tls = tmap (\\<lambda>(tls, s', tl, s''). tl) (\\<lambda>x. case x of Inl (tls, s') \\<Rightarrow> Some s' | Inr _ \\<Rightarrow> None) tlsstlss\"\nproof -\n  let ?terminal = \"\\<lambda>s tls. case terminal tls of \n          None \\<Rightarrow> Inr (SOME tls'. trsys.inf_step silent_move2 s tls')\n        | Some s' \\<Rightarrow> let tls' = SOME tls'. silent_moves2 s tls' s' in Inl (tls', s')\"\n  let ?P = \"\\<lambda>s tls (tls'', s', s''). silent_moves2 s tls'' s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls\"\n  def tlsstlss \\<equiv> \"\\<lambda>s tls. unfold_tllist\n      (\\<lambda>(s, tls). is_TNil tls)\n      (\\<lambda>(s, tls). ?terminal s tls)\n      (\\<lambda>(s, tls). let (tls'', s', s'') = Eps (?P s tls) in (tls'', s', thd tls, s''))\n      (\\<lambda>(s, tls). let (tls'', s', s'') = Eps (?P s tls) in (s'', ttl tls))\n      (s, tls)\"\n\n  have [simp]:\n    \"\\<And>s tls. is_TNil (tlsstlss s tls) \\<longleftrightarrow> is_TNil tls\"\n    \"\\<And>s tls. is_TNil tls \\<Longrightarrow> terminal (tlsstlss s tls) = ?terminal s tls\"\n    \"\\<And>s tls. \\<not> is_TNil tls \\<Longrightarrow> thd (tlsstlss s tls) = (let (tls'', s', s'') = Eps (?P s tls) in (tls'', s', thd tls, s''))\"\n    \"\\<And>s tls. \\<not> is_TNil tls \\<Longrightarrow> ttl (tlsstlss s tls) = (let (tls'', s', s'') = Eps (?P s tls) in tlsstlss s'' (ttl tls))\"\n    by(simp_all add: tlsstlss_def split_beta)\n\n  have [simp]:\n    \"\\<And>s. tlsstlss s (TNil None) = TNil (Inr (SOME tls'. trsys.inf_step silent_move2 s tls'))\"\n    \"\\<And>s s'. tlsstlss s (TNil (Some s')) = TNil (Inl (SOME tls'. silent_moves2 s tls' s', s'))\"\n    unfolding tlsstlss_def by simp_all\n\n  let ?conv = \"tmap (\\<lambda>(tls, s', tl, s''). tl) (\\<lambda>x. case x of Inl (tls, s') \\<Rightarrow> Some s' | Inr _ \\<Rightarrow> None)\"\n  from assms have \"\\<tau>Runs_table2 s (tlsstlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (\\<tau>Runs_table2 s tls)\n    thus ?case\n    proof(cases)\n      case (Terminate s')\n      let ?P = \"\\<lambda>tls'. silent_moves2 s tls' s'\"\n      from `s -\\<tau>\\<rightarrow>* s'` obtain tls' where \"?P tls'\" by(blast dest: silent_moves_into_silent_moves2)\n      hence \"?P (Eps ?P)\" by(rule someI)\n      with Terminate have ?Terminate by auto\n      thus ?thesis by simp\n    next\n      case Diverge\n      let ?P = \"\\<lambda>tls'. trsys.inf_step silent_move2 s tls'\"\n      from `s -\\<tau>\\<rightarrow> \\<infinity>` obtain tls' where \"?P tls'\" by(rule \\<tau>diverge_into_inf_step_silent_move2)\n      hence \"?P (Eps ?P)\" by(rule someI)\n      hence ?Diverge using `tls = TNil None` by simp\n      thus ?thesis by simp\n    next\n      case (Proceed s' s'' tls' tl)\n      from `s -\\<tau>\\<rightarrow>* s'` obtain tls'' where \"silent_moves2 s tls'' s'\"\n        by(blast dest: silent_moves_into_silent_moves2)\n      with Proceed have \"?P s tls (tls'', s', s'')\" by simp\n      hence \"?P s tls (Eps (?P s tls))\" by(rule someI)\n      hence ?Proceed using Proceed unfolding tlsstlss_def\n        by(subst unfold_tllist.code)(auto simp add: split_def)\n      thus ?thesis by simp\n    qed\n  qed\n  moreover\n  from assms have \"tls = ?conv (tlsstlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (Eq_tllist s tls)\n    thus ?case\n    proof(cases)\n      case (Proceed s' s'' tls' tl)\n      from `s -\\<tau>\\<rightarrow>* s'` obtain tls'' where \"silent_moves2 s tls'' s'\"\n        by(blast dest: silent_moves_into_silent_moves2)\n      with Proceed have \"?P s tls (tls'', s', s'')\" by simp\n      hence \"?P s tls (Eps (?P s tls))\" by(rule someI)\n      thus ?thesis using `tls = TCons tl tls'` by auto\n    qed auto\n  qed\n  ultimately show thesis by(rule that)\nqed\n\nlemma \\<tau>Runs_table2_into_Runs:\n  assumes \"\\<tau>Runs_table2 s tlsstlss\"\n  shows \"Runs s (lconcat (lappend (lmap (\\<lambda>(tls, s, tl, s'). llist_of (tls @ [tl])) (llist_of_tllist tlsstlss)) (LCons (case terminal tlsstlss of Inl (tls, s') \\<Rightarrow> llist_of tls | Inr tls \\<Rightarrow> tls) LNil)))\"\n  (is \"Runs _ (?conv tlsstlss)\")\nusing assms\nproof(coinduction arbitrary: s tlsstlss)\n  case (Runs s tlsstlss)\n  thus ?case\n  proof(cases)\n    case (Terminate tls' s')\n    from `silent_moves2 s tls' s'` show ?thesis\n    proof(cases rule: rtrancl3p_converseE)\n      case refl \n      hence ?Stuck using Terminate by simp\n      thus ?thesis ..\n    next\n      case (step tls'' tl s'')\n      from `silent_moves2 s'' tls'' s'` `\\<And>tl s''. \\<not> s' -tl\\<rightarrow> s''`\n      have \"\\<tau>Runs_table2 s'' (TNil (Inl (tls'', s')))\" ..\n      with `tls' = tl # tls''` `silent_move2 s tl s''` `tlsstlss = TNil (Inl (tls', s'))`\n      have ?Step by(auto simp add: silent_move2_def intro!: exI)\n      thus ?thesis ..\n    qed\n  next\n    case (Diverge tls')\n    from `trsys.inf_step silent_move2 s tls'`\n    obtain tl tls'' s' where \"silent_move2 s tl s'\" \n      and \"tls' = LCons tl tls''\" \"trsys.inf_step silent_move2 s' tls''\"\n      by(cases rule: trsys.inf_step.cases[consumes 1]) auto\n    from `trsys.inf_step silent_move2 s' tls''`\n    have \"\\<tau>Runs_table2 s' (TNil (Inr tls''))\" ..\n    hence ?Step using `tlsstlss = TNil (Inr tls')` `tls' = LCons tl tls''` `silent_move2 s tl s'`\n      by(auto simp add: silent_move2_def intro!: exI)\n    thus ?thesis ..\n  next\n    case (Proceed tls' s' s'' tlsstlss' tl)\n    from `silent_moves2 s tls' s'` have ?Step\n    proof(cases rule: rtrancl3p_converseE)\n      case refl with Proceed show ?thesis by auto\n    next\n      case (step tls'' tl' s''')\n      from `silent_moves2 s''' tls'' s'` `s' -tl\\<rightarrow> s''` `\\<not> \\<tau>move s' tl s''` `\\<tau>Runs_table2 s'' tlsstlss'`\n      have \"\\<tau>Runs_table2 s''' (TCons (tls'', s', tl, s'') tlsstlss')\" ..\n      with `tls' = tl' # tls''` `silent_move2 s tl' s'''` `tlsstlss = TCons (tls', s', tl, s'') tlsstlss'`\n      show ?thesis by(auto simp add: silent_move2_def intro!: exI)\n    qed\n    thus ?thesis ..\n  qed\nqed\n\nlemma \\<tau>Runs_table2_silentsD:\n  fixes tl\n  assumes Runs: \"\\<tau>Runs_table2 s tlsstlss\"\n  and tset: \"(tls, s', tl', s'') \\<in> tset tlsstlss\"\n  and set: \"tl \\<in> set tls\"\n  shows \"\\<exists>s''' s''''. silent_move2 s''' tl s''''\"\nusing tset Runs\nproof(induct arbitrary: s rule: tset_induct)\n  case (find tlsstlss')\n  from `\\<tau>Runs_table2 s (TCons (tls, s', tl', s'') tlsstlss')`\n  have \"silent_moves2 s tls s'\" by cases\n  thus ?case using set by induct auto\nnext\n  case step thus ?case by(auto simp add: \\<tau>Runs_table2_simps)\nqed\n\nlemma \\<tau>Runs_table2_terminal_silentsD:\n  assumes Runs: \"\\<tau>Runs_table2 s tlsstlss\"\n  and fin: \"lfinite (llist_of_tllist tlsstlss)\"\n  and terminal: \"terminal tlsstlss = Inl (tls, s'')\"\n  shows \"\\<exists>s'. silent_moves2 s' tls s''\"\nusing fin Runs terminal\nproof(induct \"llist_of_tllist tlsstlss\" arbitrary: tlsstlss s)\n  case lfinite_LNil thus ?case \n    by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nnext\n  case (lfinite_LConsI xs tlsstls)\n  thus ?case by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nqed\n\nlemma \\<tau>Runs_table2_terminal_inf_stepD:\n  assumes Runs: \"\\<tau>Runs_table2 s tlsstlss\"\n  and fin: \"lfinite (llist_of_tllist tlsstlss)\"\n  and terminal: \"terminal tlsstlss = Inr tls\"\n  shows \"\\<exists>s'. trsys.inf_step silent_move2 s' tls\"\nusing fin Runs terminal\nproof(induct \"llist_of_tllist tlsstlss\" arbitrary: s tlsstlss)\n  case lfinite_LNil thus ?case\n    by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nnext\n  case (lfinite_LConsI xs tlsstls)\n  thus ?case by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nqed\n\nlemma \\<tau>Runs_table2_lappendtD:\n  assumes Runs: \"\\<tau>Runs_table2 s (lappendt tlsstlss tlsstlss')\"\n  and fin: \"lfinite tlsstlss\"\n  shows \"\\<exists>s'. \\<tau>Runs_table2 s' tlsstlss'\"\nusing fin Runs\nby(induct arbitrary: s)(auto simp add: \\<tau>Runs_table2_simps)\n\nend\n\nlemma \\<tau>moves_False: \"\\<tau>trsys.silent_move r (\\<lambda>s ta s'. False) = (\\<lambda>s s'. False)\"\nby(auto simp add: \\<tau>trsys.silent_move_iff)\n\nlemma \\<tau>rtrancl3p_False_eq_rtrancl3p: \"\\<tau>trsys.\\<tau>rtrancl3p r (\\<lambda>s tl s'. False) = rtrancl3p r\"\nproof(intro ext iffI)\n  fix s tls s'\n  assume \"\\<tau>trsys.\\<tau>rtrancl3p r (\\<lambda>s tl s'. False) s tls s'\"\n  thus \"rtrancl3p r s tls s'\" by(rule \\<tau>trsys.\\<tau>rtrancl3p.induct)(blast intro: rtrancl3p_step_converse)+\nnext\n  fix s tls s'\n  assume \"rtrancl3p r s tls s'\"\n  thus \"\\<tau>trsys.\\<tau>rtrancl3p r (\\<lambda>s tl s'. False) s tls s'\"\n    by(induct rule: rtrancl3p_converse_induct)(auto intro: \\<tau>trsys.\\<tau>rtrancl3p.intros)\nqed\n\nlemma \\<tau>diverge_empty_\\<tau>move:\n  \"\\<tau>trsys.\\<tau>diverge r (\\<lambda>s ta s'. False) = (\\<lambda>s. False)\"\nby(auto intro!: ext elim: \\<tau>trsys.\\<tau>diverge.cases \\<tau>trsys.silent_move.cases)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Framework/LTS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.3157387487413704}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory Noninterference_Base\nimports \"Lib.Simulation\"\nbegin\n\ntext \\<open>\n  Toby's extended noninterference definitions to handle dynamic assignment,\n  that depends on the current state, of\n  the domain that each action is assigned to. This is the gory details\n  reported in the the CPP 2012 paper\n  \\emph{Noninterference for Operating System Kernels}.\n\\<close>\n\nsection \\<open>Generic systems\\<close>\n\nlemma un_eq:\n  \"\\<lbrakk>S = S'; T = T'\\<rbrakk> \\<Longrightarrow> S \\<union> T = S' \\<union> T'\"\n  by auto\n\nlemma Un_eq:\n  \"\\<lbrakk>\\<And> x y. \\<lbrakk>x \\<in> xs; y \\<in> ys\\<rbrakk> \\<Longrightarrow> P x = Q y; \\<exists> x. x \\<in> xs; \\<exists> y. y \\<in> ys\\<rbrakk>\n    \\<Longrightarrow> (\\<Union>x\\<in>xs. P x) = (\\<Union>y\\<in>ys. Q y)\"\n  by auto\n\nlemma Int_eq:\n  \"\\<lbrakk>\\<And> x y. \\<lbrakk>x \\<in> xs; y \\<in> ys\\<rbrakk> \\<Longrightarrow> P x = Q y; \\<exists> x. x \\<in> xs; \\<exists> y. y \\<in> ys\\<rbrakk>\n    \\<Longrightarrow> (\\<Inter>x\\<in>xs. P x) = (\\<Inter>y\\<in>ys. Q y)\"\n  by auto\n\nlemma Un_eq_Int:\n  assumes ex: \"\\<exists> x. x \\<in> xs\"\n  assumes ey: \"\\<exists> y. y \\<in> ys\"\n  assumes a: \"\\<And> x y. \\<lbrakk>x \\<in> xs; y \\<in> ys\\<rbrakk> \\<Longrightarrow> S x = S' y\"\n  shows \"(\\<Union>x\\<in>xs. S x) = (\\<Inter>x\\<in>ys. S' x)\"\n  apply(rule equalityI)\n   apply(clarsimp)\n   apply(drule a, assumption, simp)\n  apply clarsimp\n  apply(insert ex ey)\n  apply clarsimp\n  apply(frule a, assumption)\n  apply fastforce\n  done\n\nsubsection\\<open>Run function\\<close>\n\nprimrec Run :: \"('e \\<Rightarrow> ('s \\<times> 's) set) \\<Rightarrow> 'e list \\<Rightarrow> ('s \\<times> 's) set\"\nwhere\n  \"Run Stepf []     = Id\" |\n  \"Run Stepf (a#as) = Stepf a O Run Stepf as\"\n\n\nlemma Run_mid[rule_format]:\n  shows\n  \"(s,u) \\<in> Run Stepf (as @ bs) \\<longrightarrow> (\\<exists> t. (s,t) \\<in> Run Stepf as \\<and> (t,u) \\<in> Run Stepf bs)\"\n  proof(induct as arbitrary: s u bs)\n  case Nil show ?case\n   apply(clarsimp)\n   done\n  next\n  case (Cons a as) show ?case\n  apply(clarsimp simp: relcomp_def)\n  apply(drule \"Cons.hyps\"[rule_format])\n  apply fastforce\n  done\nqed\n\nlemma Run_trans:\n  \"\\<lbrakk>(s,t) \\<in> Run Stepf as; (t,u) \\<in> Run Stepf bs\\<rbrakk> \\<Longrightarrow> (s,u) \\<in> Run Stepf (as @ bs)\"\n  by (induct as arbitrary: bs s t u) auto\n\nlemma Run_app:\n  \"Run Stepf (as @ bs) = (Run Stepf as) O (Run Stepf bs)\"\n  apply(rule equalityI)\n   apply(fastforce dest: Run_mid)\n  apply(fastforce intro: Run_trans)\n  done\n\n\n\n\nsubsection \\<open>Base system locale\\<close>\n\ntext \\<open>An ADT with an initial state.\\<close>\nlocale system =\n  fixes A :: \"('a,'s,'e) data_type\"\n  and s0 :: \"'s\"  (* an initial state *)\nbegin\n\n(* State 's' is reachable from the initial state 's0'. *)\ndefinition reachable\nwhere\n  \"reachable s \\<equiv> \\<exists> js. s \\<in> execution A s0 js\"\n\ndefinition Step\nwhere\n  \"Step a \\<equiv> {(s,s') . s' \\<in> execution A s [a]}\"\n\n(* The system is \"observationally deterministic\": that is, the\n * observable part of the system is always deterministic. *)\ndefinition obs_det\nwhere\n  \"obs_det \\<equiv> \\<forall> s js. (\\<exists> s'. execution A s js = {s'})\"\n\nlemmas obs_detD = obs_det_def[THEN meta_eq_to_obj_eq, THEN iffD1, rule_format]\n\n(* The abstraction/concretisation functions \"Init\"/\"Fin\"\n * don't abstract away information. *)\ndefinition no_abs\nwhere\n  \"no_abs \\<equiv> \\<forall> x s as . reachable s \\<longrightarrow> x \\<in> steps (Simulation.Step A) (Init A s) as\n                        \\<longrightarrow> Init A (Fin A x) = {x}\"\n\nlemmas no_absD = no_abs_def[THEN meta_eq_to_obj_eq, THEN iffD1, rule_format]\n\nend\n\n\nsubsection \\<open>Enabled system\\<close>\n\ntext\\<open>\n  A system that is always enabled.\n\n  In particular, the system will never be in deadlock, and there\n  is always an enabled transition from every reachable state.\\<close>\n\nlocale enabled_system = system +\n  assumes enabled: \"(\\<exists> js. s \\<in> execution A s0 js) \\<Longrightarrow> \\<exists> s'. s' \\<in> execution A s js\"\nbegin\n\nlemma reachable_enabled:\n  \"reachable s \\<Longrightarrow> \\<exists> s'. s' \\<in> execution A s js\"\n  apply(simp add: reachable_def)\n  apply(erule enabled)\n  done\n\nlemma enabled_Step:\n  \"reachable s \\<Longrightarrow> \\<exists> s'. (s,s') \\<in> Step a\"\n  apply(simp add: Step_def, blast intro: reachable_enabled)\n  done\n\nend\n\nsubsection \\<open>Step system\\<close>\n\ntext \\<open>A Step system is a system for which a running\n   a sequence of events is equivalent to performing a sequence of individual\n   steps: one for each event in the sequence in turn. In other words\n   running [a,b,c,...] is the same than running [a] then running [b] then ...\n   This correspond to projecting to the observable state and deducing the real\n   state from that observable state on each event.\n\n   We define the unwinding conditions on this kind of system\\<close>\nlocale Step_system = system A s0\n  for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\"  +\n  assumes reachable_s0: \"reachable s0\"\n  assumes execution_Run: \"reachable s \\<Longrightarrow> execution A s as = {s'. (s,s') \\<in> Run Step as}\"\nbegin\n\nlemma execution_Run':\n  \"s \\<in> execution A s0 js \\<Longrightarrow> execution A s as = {s'. (s,s') \\<in> Run Step as}\"\n  apply(rule execution_Run)\n  apply(fastforce simp: reachable_def)\n  done\n\nlemma reachable_Run:\n  \"reachable s \\<Longrightarrow> \\<exists>as. (s0,s) \\<in> Run Step as\"\n  apply (clarsimp simp add: reachable_def)\n  apply (cut_tac as=js in execution_Run[OF reachable_s0])\n  apply blast\n  done\n\nlemma Run_reachable:\n  \"\\<exists>as. (s0,s) \\<in> Run Step as \\<Longrightarrow> reachable s\"\n  apply (clarsimp simp add: reachable_def)\n  apply (cut_tac as=as in execution_Run[OF reachable_s0])\n  apply blast\n  done\n\n\nlemma reachable_execution:\n  \"\\<lbrakk>reachable s; s' \\<in> execution A s js\\<rbrakk> \\<Longrightarrow> reachable s'\"\n  apply(clarsimp simp: reachable_def)\n  apply(rule_tac x=\"jsa @ js\" in exI)\n  apply(frule execution_Run'[where s=s and as=js])\n  apply(simp add: execution_Run[where s=s0, simplified reachable_s0])\n  apply(fastforce simp: Run_app)\n  done\n\nlemma reachable_Step:\n  \"\\<lbrakk>reachable s; (s,s') \\<in> Step a\\<rbrakk> \\<Longrightarrow> reachable s'\"\n  apply(erule reachable_execution)\n  apply(simp add: Step_def)\n  done\n\nlemma reachable_induct_helper:\n  assumes a:\n    \"\\<And>s s' a. \\<lbrakk>reachable s; P s; (s, s') \\<in> Step a\\<rbrakk> \\<Longrightarrow> P s'\"\n  shows \"\\<lbrakk>(s0, s1) \\<in> Run Step as; P s0\\<rbrakk> \\<Longrightarrow> P s1\"\n  apply (induct as arbitrary: s1 rule: rev_induct)\n   apply simp\n  apply(fastforce dest: Run_mid intro: a Run_reachable)\n  done\n\nlemma reachable_induct:\n  \"\\<lbrakk>(\\<And>s s' a. reachable s \\<Longrightarrow> (s,s') \\<in> (Step a) \\<Longrightarrow> P s \\<Longrightarrow> P s'); reachable s1; P s0\\<rbrakk> \\<Longrightarrow> P s1\"\n  apply (drule reachable_Run)\n  apply (elim exE)\n  apply (rule reachable_induct_helper)\n    apply simp+\n  done\n\nend\n\nsubsection \\<open>Init Fin system\\<close>\n\ntext \\<open>An Init Fin system a stronger kind of Step system where know directly\n   that Fin and Init behave nicely as nearly \"inverse\" of each other which imply\n   that projecting to observable state then deducing the original state behave\n   as expected in Step system.\n\\<close>\n\nlocale Init_Fin_system = system A s0\n  for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\"  +\n  assumes reachable_s0: \"reachable s0\"\n  assumes Fin_Init: \"reachable s \\<Longrightarrow> Fin A ` Init A s = {s}\"\n  assumes Init_Fin: \"reachable s \\<Longrightarrow> x \\<in> steps (Simulation.Step A) (Init A s) as \\<Longrightarrow>  x \\<in> Init A (Fin A x)\"\n  assumes obs_det_or_no_abs: \"obs_det \\<or> no_abs\"\nbegin\n\n\nlemma execution_subset_Run:\n  \"reachable s \\<Longrightarrow> execution A s as \\<subseteq> {s'. (s,s') \\<in> Run Step as}\"\n  apply(induct as arbitrary: s rule: rev_induct)\n   apply(simp add: execution_def steps_def Fin_Init)\n  apply(simp add: execution_def steps_def)\n  apply(rule subsetI)\n  apply clarsimp\n  apply(rule Run_trans)\n   apply blast\n  apply(cut_tac x=xc and s=s and as=xs in Init_Fin, (simp add: steps_def)+)\n  apply(clarsimp simp: Step_def execution_def steps_def)\n  apply blast\n  done\n\nlemma Run_subset_execution:\n  \"\\<lbrakk>no_abs; reachable s\\<rbrakk> \\<Longrightarrow> {s'. (s,s') \\<in> Run Step as} \\<subseteq> execution A s as\"\n  apply(induct as arbitrary: s rule: rev_induct)\n   apply(simp add: execution_def steps_def Fin_Init)\n  apply(simp add: execution_def steps_def)\n  apply(rule subsetI)\n  apply clarsimp\n  apply(drule Run_mid)\n  apply clarsimp\n  apply(drule_tac x=s in meta_spec)\n  apply clarsimp\n  apply(drule_tac subsetD)\n   apply blast\n  apply(clarsimp simp: Image_def image_def Step_def execution_def steps_def)\n  apply(rule_tac x=xc in exI)\n  apply clarsimp\n  apply(rule_tac x=xd in bexI)\n   apply assumption\n  apply(drule_tac x=xb in no_absD)\n    apply(simp add: steps_def Image_def)+\n  done\n\nlemma Run_det:\n  \"obs_det \\<Longrightarrow> \\<exists> s'. {s'. (s,s') \\<in> Run Step as} = {s'}\"\n  apply(induct as arbitrary: s rule: rev_induct)\n   apply simp\n  apply(simp add: Run_app relcomp_def)\n  apply(drule_tac x=s in meta_spec)\n  apply clarsimp\n  apply(drule_tac s=s' and js=\"[x]\" in obs_detD)\n  apply (clarsimp simp: Step_def)\n  apply(rule_tac x=\"s'a\" in exI)\n  apply (auto dest: equalityD1)\n  done\n\nlemma eq:\n  \"\\<lbrakk>S \\<subseteq> T; \\<exists> x. S = {x}; \\<exists> y. T = {y}\\<rbrakk> \\<Longrightarrow> S = T\"\n  apply blast\n  done\n\nlemma execution_Run:\n  \"reachable s \\<Longrightarrow> execution A s as = {s'. (s,s') \\<in> Run Step as}\"\n  apply(rule disjE[OF obs_det_or_no_abs])\n   apply(rule eq)\n     apply(erule execution_subset_Run)\n    apply(erule obs_detD)\n   apply(erule Run_det)\n  apply(rule equalityI)\n   apply(erule execution_subset_Run)\n  apply(erule (1) Run_subset_execution)\n  done\n\nend\n\nlemma Init_Fin_system_Step_system:\n  \"Init_Fin_system A s0 \\<Longrightarrow> Step_system A s0\"\n  apply(unfold_locales)\n   apply(erule Init_Fin_system.reachable_s0)\n  apply(erule (1) Init_Fin_system.execution_Run)\n  done\n\nsublocale Init_Fin_system \\<subseteq> Step_system\n  apply(rule Init_Fin_system_Step_system)\n  apply(unfold_locales)\n  done\n\nsubsection \\<open>Init inv Fin system\\<close>\n\ntext \\<open>Here we go one step further than the Init_Fin_system:\n  In this local Init and Fin are actually inverse of each other\n  Fin is injective\n  if s : range Fin A then Init A s = {s'} and Fin A s' = s else Init A s = {}.\n\n  The internal state space is thus just a restriction of the observable state space.\n\\<close>\n\n(* when Init is the inverse image of Fin, the above assumptions are met by a system\n   for which Fin is injective, or one that appears deterministic to an observer *)\nlocale Init_inv_Fin_system = system A s0\n  for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\" +\n  assumes Fin_Init_s0: \"s0 \\<in> Fin A ` Init A s0\"\n  assumes Init_inv_Fin: \"reachable s \\<Longrightarrow> Init A s = {s'. Fin A s' = s}\"\n  assumes Fin_inj: \"inj (Fin A)\"\nbegin\n\nlemma inv_and_inj: \"reachable s \\<Longrightarrow> Fin A i = s \\<Longrightarrow> Init A s = {i}\"\n  using Fin_inj Init_inv_Fin by (blast dest:injD)\n\nlemma s0_reachable:\n  \"reachable s0\"\n  apply(simp add: reachable_def)\n  apply(rule_tac x=\"[]\" in exI)\n  apply(simp add: execution_def steps_def)\n  using Fin_Init_s0.\n\nlemma foldl_foldl_Step:\n  \"\\<lbrakk>x \\<in> foldl (\\<lambda>S j. data_type.Step A j `` S) M as;\n   M \\<subseteq> foldl (\\<lambda>S j. data_type.Step A j `` S) B js\\<rbrakk>\n       \\<Longrightarrow> x \\<in> foldl (\\<lambda>S j. data_type.Step A j `` S)\n               (foldl (\\<lambda>S j. data_type.Step A j `` S) B js) as\"\n  apply(induct  as arbitrary: x M js B rule: rev_induct)\n   apply fastforce\n  apply simp\n  apply(erule ImageE)\n  apply(drule_tac x=xb in meta_spec)\n  apply(drule_tac x=M in meta_spec)\n  apply simp\n  apply(drule_tac x=js in meta_spec)\n  apply(drule_tac x=B in meta_spec, simp)\n  apply(blast)\n  done\n\nlemma reachable_Fin:\n  \"\\<lbrakk>reachable s;\n    x \\<in> steps (Simulation.Step A) (Init A s) as\\<rbrakk>\n   \\<Longrightarrow> reachable (Fin A x)\"\n  apply(cut_tac s=s in Init_inv_Fin, assumption)\n  apply(clarsimp simp: reachable_def execution_def steps_def)\n  apply(rule_tac x=\"js@as\" in exI)\n  apply(rule imageI)\n  apply(subgoal_tac \"{s'. Fin A s' = Fin A xa} = {xa}\")\n   apply simp\n   apply(erule foldl_foldl_Step)\n   apply blast\n  apply(blast dest: injD[OF Fin_inj])\n  done\n\nend\n\nlemma Init_inv_Fin_system_Init_Fin_system:\n  \"Init_inv_Fin_system A s0 \\<Longrightarrow> Init_Fin_system A s0\"\n  apply(unfold_locales)\n     apply(erule Init_inv_Fin_system.s0_reachable)\n    apply(simp add: Init_inv_Fin_system.Init_inv_Fin)\n    apply(simp add: image_def)\n    apply(fastforce simp: system.reachable_def execution_def)\n   apply(cut_tac s=\"Fin A x\" in Init_inv_Fin_system.Init_inv_Fin)\n     apply assumption\n    apply(blast intro: Init_inv_Fin_system.reachable_Fin)\n   apply simp\n  apply(rule disjI2)\n  apply(clarsimp simp: system.no_abs_def)\n  apply(frule Init_inv_Fin_system.Fin_inj)\n  apply(cut_tac s=\"Fin A x\" in Init_inv_Fin_system.Init_inv_Fin)\n    apply assumption\n   apply(blast intro: Init_inv_Fin_system.reachable_Fin)\n  apply simp\n  apply(fastforce dest: injD)\n  done\n\nsublocale Init_inv_Fin_system \\<subseteq> Init_Fin_system\n  apply(rule Init_inv_Fin_system_Init_Fin_system)\n  apply(unfold_locales)\n  done\n\n\n\nsection \\<open>Non interference\\<close>\n\nsubsection \\<open>Policy\\<close>\n\ntext\\<open>This local represent an whole infoflow policy with the all the field needed\n       for defining non leakage, non interference and non influence\\<close>\n\nlocale noninterference_policy =\n  fixes dom :: \"'e \\<Rightarrow> 's \\<Rightarrow> 'd\"        (* dynamic dom assignment *)\n  fixes uwr :: \"'d \\<Rightarrow> ('s \\<times> 's) set\"  (* unwinding relation *)\n  fixes policy :: \"('d \\<times> 'd) set\"     (* who can send info to whom *)\n  fixes out :: \"'d \\<Rightarrow> 's \\<Rightarrow> 'p\"        (* observable parts of d in state s *)\n  fixes schedDomain :: \"'d\"\n  assumes uwr_equiv_rel: \"equiv UNIV (uwr u)\"\n  assumes schedIncludesCurrentDom:\n    \"(s,t) \\<in> uwr schedDomain \\<Longrightarrow> dom e s = dom e t\"\n  assumes schedFlowsToAll:\n    \"(schedDomain,d) \\<in> policy\"\n  assumes schedNotGlobalChannel:\n    \"(x,schedDomain) \\<in> policy \\<Longrightarrow> x = schedDomain\"\nbegin\n\nabbreviation uwr2 :: \"'s \\<Rightarrow> 'd \\<Rightarrow> 's \\<Rightarrow> bool\" (\"(_/ \\<sim>_\\<sim>/ _)\" [50,100,50] 1000)\nwhere\n  \"s \\<sim>u\\<sim> t \\<equiv> (s,t) \\<in> uwr u\"\n\nabbreviation policy2 :: \"'d \\<Rightarrow> 'd \\<Rightarrow> bool\" (infix \"\\<leadsto>\" 50)\nwhere\n  \"u \\<leadsto> v \\<equiv> (u,v) \\<in> policy\"\n\nlemma uwr_refl:\n  \"s \\<sim>(u::'d)\\<sim> s\"\n  apply(cut_tac u=u in uwr_equiv_rel)\n  apply(clarsimp simp: equiv_def)\n  apply(blast dest: refl_onD)\n  done\n\nlemma uwr_sym:\n  \"x \\<sim>(u::'d)\\<sim> y \\<Longrightarrow> y \\<sim>u\\<sim> x\"\n  apply(cut_tac u=u in uwr_equiv_rel)\n  apply(clarsimp simp: equiv_def)\n  apply(blast dest: symD)\n  done\n\nlemma uwr_trans:\n  \"\\<lbrakk>x \\<sim>(u::'d)\\<sim> y; y \\<sim>u\\<sim> z\\<rbrakk> \\<Longrightarrow> x \\<sim>u\\<sim> z\"\n  apply(cut_tac u=u in uwr_equiv_rel)\n  apply(clarsimp simp: equiv_def)\n  apply(blast dest: transD)\n  done\n\ndefinition sameFor_dom :: \"'s \\<Rightarrow> 'd set \\<Rightarrow> 's \\<Rightarrow> bool\"  (\"(_/ \\<approx>_\\<approx>/ _)\" [50,100,50] 1000)\nwhere\n \"s \\<approx>us\\<approx> t \\<equiv> \\<forall>u\\<in>us. (s,t) \\<in> uwr u\"\n\nlemma sameFor_subset_dom: \"\\<lbrakk>s \\<approx>(x::'d set)\\<approx> t; y \\<subseteq> x\\<rbrakk> \\<Longrightarrow> s \\<approx>y\\<approx> t\"\n  by(fastforce simp: sameFor_dom_def)\n\n\nlemma sameFor_inter_domI: \"s \\<approx>(S::'d set)\\<approx> t \\<Longrightarrow> s \\<approx>(S \\<inter> B)\\<approx> t\"\n  by(auto simp: sameFor_dom_def)\n\n\nlemma sameFor_sym_dom:\n  \"s \\<approx>(S::'d set)\\<approx> t \\<Longrightarrow> t \\<approx>S\\<approx> s\"\n  by(auto simp: sameFor_dom_def uwr_sym)\n\nend\n\n\n\n\nsubsection \\<open>Non interference system\\<close>\n\nlocale noninterference_system = enabled_system A s0 +\n                                noninterference_policy dom uwr policy out schedDomain\n  for A :: \"('a,'s,'e) data_type\"\n  and s0 :: \"'s\"\n  and dom :: \"'e \\<Rightarrow> 's \\<Rightarrow> 'd\"\n  and uwr :: \"'d \\<Rightarrow> ('s \\<times> 's) set\"\n  and policy :: \"('d \\<times> 'd) set\"\n  and out :: \"'d \\<Rightarrow> 's \\<Rightarrow> 'p\"\n  and schedDomain :: \"'d\"\nbegin\n\n(* The set of domains (which carry out actions in the list \"as\") which\n * may influence \"u\", assuming we start in state \"s\". *)\nprimrec\n sources :: \"'e list \\<Rightarrow> 's \\<Rightarrow> 'd \\<Rightarrow> 'd set\"\nwhere\n sources_Nil: \"sources [] s u = {u}\"|\n sources_Cons: \"sources (a#as) s u = (\\<Union>{sources as s' u| s'. (s,s') \\<in> Step a}) \\<union>\n      {w. w = dom a s \\<and> (\\<exists> v s'. dom a s \\<leadsto> v \\<and> (s,s') \\<in> Step a \\<and> v \\<in> sources as s' u)}\"\n\ndeclare sources_Nil [simp del]\ndeclare sources_Cons [simp del]\n\n\n\ndefinition obs_equiv :: \"'s \\<Rightarrow> 'e list \\<Rightarrow> 's \\<Rightarrow> 'e list \\<Rightarrow> 'd \\<Rightarrow> bool\"\nwhere\n  \"obs_equiv s as t bs d \\<equiv> \\<forall> s' t'. s' \\<in> execution A s as \\<and> t' \\<in> execution A t bs \\<longrightarrow>\n                out d s' = out d t'\"\n\n\ndefinition uwr_equiv :: \"'s \\<Rightarrow> 'e list \\<Rightarrow> 's \\<Rightarrow> 'e list \\<Rightarrow> 'd \\<Rightarrow> bool\"\nwhere\n  \"uwr_equiv s as t bs d \\<equiv> \\<forall> s' t'. s' \\<in> execution A s as \\<and> t' \\<in> execution A t bs \\<longrightarrow>\n                s' \\<sim>d\\<sim> t'\"\n\n\n\ntext \\<open>Nonleakage\\<close>\ndefinition Nonleakage :: \"bool\"\nwhere\n  \"Nonleakage \\<equiv> \\<forall>as s u t. reachable s \\<and> reachable t \\<longrightarrow>\n     s \\<sim>schedDomain\\<sim> t \\<longrightarrow>\n     s \\<approx>(sources as s u)\\<approx> t \\<longrightarrow> obs_equiv s as t as u\"\n\ntext \\<open>A generalisation of Nonleakage.\\<close>\ndefinition Nonleakage_gen :: \"bool\"\nwhere\n  \"Nonleakage_gen \\<equiv> \\<forall>as s u t. reachable s \\<and> reachable t \\<longrightarrow>\n     s \\<sim>schedDomain\\<sim> t \\<longrightarrow>\n       s \\<approx>(sources as s u)\\<approx> t \\<longrightarrow> uwr_equiv s as t as u\"\n\n\n\n\nlemma uwr_equiv_sym:\n  \"uwr_equiv s as t bs u \\<Longrightarrow> uwr_equiv t bs s as u\"\n  apply(fastforce simp: uwr_equiv_def uwr_sym)\n  done\n\nlemma uwr_equiv_trans:\n  \"\\<lbrakk>reachable t; uwr_equiv s as t bs x; uwr_equiv t bs u cs x\\<rbrakk> \\<Longrightarrow> uwr_equiv s as u cs x\"\n  apply(clarsimp simp: uwr_equiv_def)\n  apply(cut_tac s=t and js=bs in reachable_enabled)\n   apply assumption\n  apply(blast intro: uwr_trans)\n  done\n\nprimrec gen_purge :: \"('e list \\<Rightarrow> 's \\<Rightarrow> 'd \\<Rightarrow> 'd set) \\<Rightarrow> 'd \\<Rightarrow> 'e list \\<Rightarrow> 's set \\<Rightarrow> 'e list\"\nwhere\n  Nil : \"gen_purge source_func u []     ss = []\" |\n  Cons: \"gen_purge source_func u (a#as) ss =\n            (if (\\<exists>s\\<in>ss. dom a s \\<in> source_func (a#as) s u) then\n               a#gen_purge source_func u as (\\<Union>s\\<in>ss. {s'. (s,s') \\<in> Step a})\n             else\n               gen_purge source_func u as ss)\"\n\n\n\ndefinition ipurge\nwhere\n \"ipurge \\<equiv> gen_purge sources\"\n\nlemma ipurge_Nil:\n  \"ipurge u [] ss = []\"\n  by(auto simp: ipurge_def)\n\nlemma ipurge_Cons:\n  \"ipurge u (a#as) ss =\n     (if (\\<exists> s\\<in>ss. dom a s \\<in> sources (a#as) s u) then\n         a#ipurge u as (\\<Union>s\\<in>ss. {s'. (s,s') \\<in> Step a})\n      else\n         ipurge u as ss)\"\n  by (auto simp: ipurge_def)\n\n\nlemma gen_purge_shortens:\n  \"length (gen_purge sf u as ss) \\<le> length as\"\n  apply(induct as arbitrary: ss)\n   apply(simp)\n  apply(clarsimp)\n  apply(rule le_trans)\n   apply assumption\n  apply simp\n  done\n\n\n\n\nlemma INT_cong':\n  assumes a: \"\\<And> x. Q x \\<Longrightarrow> P x = P' x\"\n  shows\n  \"\\<Inter>{P x|x. Q x} = \\<Inter>{P' x|x. Q x}\"\n  apply (auto simp: a)\n  done\n\n\ntext \\<open>Standard Noninterference\\<close>\n\ndefinition Noninterference :: \"bool\"\nwhere\n \"Noninterference \\<equiv>\n  \\<forall> u as s. reachable s \\<longrightarrow>\n         (obs_equiv s as s (ipurge u as {s}) u)\"\n\n\ntext \\<open>Strong Noninterference\\<close>\ndefinition Noninterference_strong :: \"bool\"\nwhere\n \"Noninterference_strong \\<equiv>\n  \\<forall> u as bs s. reachable s \\<longrightarrow>\n         (ipurge u as {s}) = (ipurge u bs {s}) \\<longrightarrow>\n         (obs_equiv s as s bs u)\"\n\n\n\nlemma obs_equiv_sym:\n  \"obs_equiv s as t bs u \\<Longrightarrow> obs_equiv t bs s as u\"\n  apply(clarsimp simp: obs_equiv_def)\n  done\n\nlemma obs_equiv_trans:\n  \"\\<lbrakk>reachable t; obs_equiv s as t bs u; obs_equiv t bs x cs u\\<rbrakk> \\<Longrightarrow> obs_equiv s as x cs u\"\n  apply(clarsimp simp: obs_equiv_def)\n  apply(cut_tac s=t and js=bs in reachable_enabled, assumption, blast)\n  done\n\nlemma Noninterference_Noninterference_strong:\n  \"\\<lbrakk>Noninterference\\<rbrakk> \\<Longrightarrow> Noninterference_strong\"\n  apply(clarsimp simp: Noninterference_def Noninterference_strong_def)\n  apply(drule_tac x=u in spec)\n  apply(frule_tac x=as in spec, drule_tac x=s in spec)\n  apply(drule_tac x=bs in spec, drule_tac x=s in spec)\n  apply clarsimp\n  apply(rule obs_equiv_trans)\n    apply assumption\n   apply assumption\n  apply(erule obs_equiv_sym)\n  done\n\n\ntext \\<open>Noninfluence -- the combination of Noninterference and\n   Nonleakage.\n\n   We add the assumption about equivalence wrt the scheduler's domain, as\n   is common in e.g. GVW.\\<close>\ndefinition Noninfluence  :: \"bool\"\nwhere\n \"Noninfluence \\<equiv>\n  \\<forall> u as s t. reachable s \\<and> reachable t \\<longrightarrow>\n      s \\<approx>(sources as s u)\\<approx> t \\<longrightarrow>  s \\<sim>schedDomain\\<sim> t \\<longrightarrow>\n         obs_equiv s as t (ipurge u as {t}) u\"\n\n\n\n\ndefinition Noninfluence_strong  :: \"bool\"\nwhere\n \"Noninfluence_strong \\<equiv>\n  \\<forall> u as bs s t. reachable s  \\<and> reachable t \\<longrightarrow>\n      s \\<approx>(sources as s u)\\<approx> t \\<longrightarrow>  s \\<sim>schedDomain\\<sim> t \\<longrightarrow>\n         ipurge u as {s} = ipurge u bs {s} \\<longrightarrow>\n         obs_equiv s as t bs u\"\n\n\n\n\nlemma notin_policyI:\n  \"\\<lbrakk>dom a s \\<notin> sources (a # list) s u; \\<exists> s'. (s,s') \\<in> Step a \\<and> ua \\<in> sources list s' u\\<rbrakk> \\<Longrightarrow>\n   (dom a s,ua) \\<notin> policy\"\n  apply(clarsimp simp: sources_Cons)\n  done\n\n\nlemma Noninfluence_strong_Noninterference_strong:\n  \"Noninfluence_strong \\<Longrightarrow> Noninterference_strong\"\n  apply(clarsimp simp: Noninfluence_strong_def Noninterference_strong_def)\n  apply(drule_tac x=u in spec, drule_tac x=as in spec, drule_tac x=bs in spec)\n  apply(fastforce simp: sameFor_dom_def uwr_refl)\n  done\n\nlemma Noninfluence_strong_Nonleakage:\n  \"Noninfluence_strong \\<Longrightarrow> Nonleakage\"\n  apply(clarsimp simp: Noninfluence_strong_def Nonleakage_def)\n  done\n\ntext \\<open>This stronger condition is needed\n   to make the induction proof work for Noninterference. It can be viewed\n   as a generalisation of Noninfluence; hence its name here.\n\\<close>\ndefinition Noninfluence_gen :: \"bool\"\nwhere\n \"Noninfluence_gen \\<equiv>\n  \\<forall> u as s ts. reachable s \\<and> (\\<forall> t \\<in> ts. reachable t) \\<longrightarrow>\n      (\\<forall>t \\<in> ts. s \\<approx>(sources as s u)\\<approx> t) \\<longrightarrow>  (\\<forall>t \\<in> ts. s \\<sim>schedDomain\\<sim> t) \\<longrightarrow>\n         (\\<forall>t \\<in> ts. uwr_equiv s as t (ipurge u as ts) u)\"\n\ndefinition Noninfluence_uwr  :: \"bool\"\nwhere\n \"Noninfluence_uwr \\<equiv>\n  \\<forall> u as s t. reachable s \\<and> reachable t \\<longrightarrow>\n      s \\<approx>(sources as s u)\\<approx> t \\<longrightarrow>  s \\<sim>schedDomain\\<sim> t \\<longrightarrow>\n         uwr_equiv s as t (ipurge u as {t}) u\"\n\ndefinition Noninfluence_strong_uwr :: \"bool\"\nwhere\n \"Noninfluence_strong_uwr \\<equiv>\n  \\<forall> u as bs s t. reachable s  \\<and> reachable t \\<longrightarrow>\n      s \\<approx>(sources as s u)\\<approx> t \\<longrightarrow>  s \\<sim>schedDomain\\<sim> t \\<longrightarrow>\n         ipurge u as {s} = ipurge u bs {s} \\<longrightarrow>\n         uwr_equiv s as t bs u\"\n\n\n\n\ndefinition output_consistent :: \"bool\"\nwhere\n  \"output_consistent \\<equiv> \\<forall> u s s'. s \\<sim>u\\<sim> s'  \\<longrightarrow> (out u s = out u s')\"\n\ndefinition confidentiality_u :: \"bool\"\nwhere\n  \"confidentiality_u \\<equiv> \\<forall> a u s t.  reachable s \\<and> reachable t \\<longrightarrow>\n    s \\<sim>schedDomain\\<sim> t \\<longrightarrow>\n    ((dom a s \\<leadsto> u) \\<longrightarrow> s \\<sim>dom a s\\<sim> t) \\<longrightarrow>\n      s \\<sim>u\\<sim> t \\<longrightarrow>\n      (\\<forall> s' t'. (s,s') \\<in> Step a \\<and> (t,t') \\<in> Step a \\<longrightarrow>\n        s' \\<sim>u\\<sim> t')\"\n\nlemma no_domain_visible_nondeterminism:\n  \"\\<lbrakk>confidentiality_u; reachable s; (s,s') \\<in> Step a; (s,s'') \\<in> Step a\\<rbrakk> \\<Longrightarrow> s' \\<sim>d\\<sim> s''\"\n  apply(clarsimp simp: confidentiality_u_def)\n  apply(fastforce intro: uwr_refl)\n  done\n\ndefinition integrity_u :: \"bool\"\nwhere\n  \"integrity_u \\<equiv> \\<forall> a u s. reachable  s \\<longrightarrow>\n   (dom a s,u) \\<notin> policy  \\<longrightarrow>\n   (\\<forall> s'. (s,s') \\<in> Step a \\<longrightarrow> s \\<sim>u\\<sim> s')\"\n\n(*<*)\n(* integrity_u actually guarantees this (seemingly) stronger condition *)\ndefinition integrity_u_more :: \"bool\"\nwhere\n  \"integrity_u_more \\<equiv> \\<forall> a u s. reachable s \\<longrightarrow>\n   (dom a s,u) \\<notin> policy \\<longrightarrow>\n   (\\<forall> s' t. s \\<sim>u\\<sim> t \\<and> (s,s') \\<in> Step a \\<longrightarrow> s' \\<sim>u\\<sim> t)\"\n\nlemma integrity_u_more:\n  \"integrity_u \\<Longrightarrow> integrity_u_more\"\n  apply(clarsimp simp: integrity_u_more_def integrity_u_def)\n  apply(blast dest: uwr_sym uwr_trans)\n  done\n(*>*)\n\nlemma integrity_uD:\n  \"\\<lbrakk>integrity_u; reachable s; (dom a s,u) \\<notin> policy;\n    s \\<sim>u\\<sim> t; (s,s') \\<in> Step a\\<rbrakk> \\<Longrightarrow>\n   s' \\<sim>u\\<sim> t\"\n  apply(drule integrity_u_more)\n  apply(simp add: integrity_u_more_def)\n  done\n\n\n\n\ntext \\<open>\n  A weaker version of @{prop confidentiality_u} that, with\n  @{prop integrity_u}, implies it.\n\\<close>\ndefinition confidentiality_u_weak\nwhere\n  \"confidentiality_u_weak \\<equiv> \\<forall> a u s t.  reachable s \\<and> reachable t \\<longrightarrow>\n    s \\<sim>schedDomain\\<sim> t \\<longrightarrow> dom a s \\<leadsto> u \\<longrightarrow> s \\<sim>(dom a s)\\<sim> t \\<longrightarrow>\n      s \\<sim>u\\<sim> t \\<longrightarrow>\n        (\\<forall> s' t'. (s,s') \\<in> Step a \\<and> (t,t') \\<in> Step a \\<longrightarrow> s' \\<sim>u\\<sim> t')\"\n\nlemma confidentiality_u_confidentiality_u_weak:\n  \"confidentiality_u \\<Longrightarrow> confidentiality_u_weak\"\n  apply (simp add: confidentiality_u_def confidentiality_u_weak_def)\n  apply blast\n  done\n\nlemma impCE':\n  \"\\<lbrakk>P \\<longrightarrow> Q; \\<lbrakk>P; Q\\<rbrakk> \\<Longrightarrow> R; \\<not> P \\<Longrightarrow> R\\<rbrakk> \\<Longrightarrow> R\"\n  apply auto\n  done\n\nlemma confidentiality_u_weak:\n  \"\\<lbrakk>confidentiality_u_weak; integrity_u\\<rbrakk> \\<Longrightarrow>\n  confidentiality_u\"\n  apply(clarsimp simp: confidentiality_u_def)\n  apply(erule impCE')\n   apply(subst (asm) confidentiality_u_weak_def, blast)\n  apply(frule integrity_uD, simp+)\n  apply(drule_tac s=t and t=\"s'\" in integrity_uD)\n      apply assumption\n     apply(drule_tac e=a in schedIncludesCurrentDom)\n     apply simp\n    apply(blast intro: uwr_sym)\n   apply assumption\n  apply(erule uwr_sym)\n  done\n\nlemma obs_equivI:\n  \"\\<lbrakk>output_consistent; uwr_equiv s as t bs ob\\<rbrakk> \\<Longrightarrow> obs_equiv s as t bs ob\"\n  apply(clarsimp simp: obs_equiv_def)\n  apply(auto simp: uwr_equiv_def output_consistent_def)\n  done\n\nlemma Noninfluence_uwr_Noninfluence:\n  \"\\<lbrakk>output_consistent; Noninfluence_uwr\\<rbrakk> \\<Longrightarrow> Noninfluence\"\n  apply(clarsimp simp: Noninfluence_def)\n  apply(erule obs_equivI)\n  apply(auto simp: Noninfluence_uwr_def)\n  done\n\nlemma Noninfluence_strong_uwr_Noninfluence_strong:\n  \"\\<lbrakk>output_consistent; Noninfluence_strong_uwr\\<rbrakk> \\<Longrightarrow> Noninfluence_strong\"\n  apply(clarsimp simp: Noninfluence_strong_def)\n  apply(erule obs_equivI)\n  apply(auto simp: Noninfluence_strong_uwr_def)\n  done\n\nlemma sched_equiv_preserved:\n  \"\\<lbrakk>confidentiality_u;  reachable s; reachable t;\n   s \\<sim>schedDomain\\<sim> t; (s,s') \\<in> Step a; (t,t') \\<in> Step a\\<rbrakk> \\<Longrightarrow>\n   s' \\<sim>schedDomain\\<sim> t'\"\n  apply(case_tac \"dom a s = schedDomain\")\n   apply(subst (asm) confidentiality_u_def)\n   apply(drule_tac x=a in spec)\n   apply(drule_tac x=schedDomain in spec)\n   apply(drule_tac x=s in spec)\n   apply(drule_tac x=t in spec)\n   apply simp\n  apply(subst (asm) confidentiality_u_def)\n  apply(blast intro: schedNotGlobalChannel)\n  done\n\nlemma sched_equiv_preserved_left:\n  \"\\<lbrakk>integrity_u; s \\<sim>schedDomain\\<sim> t;\n    dom a s \\<noteq> schedDomain; (s,s') \\<in> Step a; reachable s\\<rbrakk> \\<Longrightarrow>\n    s' \\<sim>schedDomain\\<sim> t\"\n  apply(blast intro: integrity_uD schedNotGlobalChannel)\n  done\n\nlemma Noninfluence_gen_Noninterference:\n  \"\\<lbrakk>output_consistent; Noninfluence_gen\\<rbrakk> \\<Longrightarrow> Noninterference\"\n  apply(clarsimp simp: Noninterference_def Noninfluence_gen_def)\n  apply(erule_tac x=u in allE)\n  apply(erule_tac x=as in allE)\n  apply(erule_tac x=s in allE)\n  apply(erule_tac x=\"{s}\" in allE)\n  apply(clarsimp simp: sameFor_dom_def uwr_refl)\n  apply(blast intro: obs_equivI)\n  done\n\nlemma Noninfluence_gen_Noninfluence:\n  \"\\<lbrakk>output_consistent; Noninfluence_gen\\<rbrakk> \\<Longrightarrow> Noninfluence\"\n  apply(clarsimp simp: Noninfluence_def Noninfluence_gen_def)\n  apply(erule_tac x=u in allE)\n  apply(erule_tac x=as in allE)\n  apply(erule_tac x=s in allE)\n  apply(erule_tac x=\"{t}\" in allE)\n  apply(blast intro: obs_equivI)\n  done\n\nlemma Noninfluence_gen_Noninfluence_uwr:\n  \"\\<lbrakk>Noninfluence_gen\\<rbrakk> \\<Longrightarrow> Noninfluence_uwr\"\n  apply(clarsimp simp: Noninfluence_uwr_def Noninfluence_gen_def)\n  done\n\nlemma Noninfluence_gen_Noninterference_strong:\n  \"\\<lbrakk>output_consistent; Noninfluence_gen\\<rbrakk> \\<Longrightarrow> Noninterference_strong\"\n  apply(rule Noninterference_Noninterference_strong)\n  apply(blast intro: Noninfluence_gen_Noninterference)\n  done\n\n\nend\n\nsubsection \\<open>Noninterference on enabled Step system : unwinding system\\<close>\n\nlocale enabled_Step_system = enabled_system A s0 + Step_system A s0\n  for A :: \"('a,'s,'e) data_type\" and s0 :: \"'s\"\n\n\n(* we define the unwinding conditions for any system *)\nlocale unwinding_system = enabled_Step_system A s0 +\n                          noninterference_policy dom uwr policy out schedDomain\n  for A :: \"('a,'s,'e) data_type\"\n  and s0 :: \"'s\"\n  and dom :: \"'e \\<Rightarrow> 's \\<Rightarrow> 'd\"\n  and uwr :: \"'d \\<Rightarrow> ('s \\<times> 's) set\"\n  and policy :: \"('d \\<times> 'd) set\"\n  and out :: \"'d \\<Rightarrow> 's \\<Rightarrow> 'p\"\n  and schedDomain :: \"'d\"\n\nsublocale unwinding_system \\<subseteq> noninterference_system\n  apply(unfold_locales)\n  done\n\ncontext unwinding_system begin\n\n\n\n\nlemma sources_refl:\n  \"reachable s \\<Longrightarrow> u \\<in> sources as s u\"\n  apply(induct as arbitrary: s)\n   apply(simp add: sources_Nil)\n  apply(simp add: sources_Cons)\n  apply(frule_tac a=a in enabled_Step)\n  apply (auto simp: reachable_Step)\n  done\n\n\n\nlemma schedDomain_in_sources_Cons:\n  \"reachable s \\<Longrightarrow> dom a s = schedDomain \\<Longrightarrow> dom a s \\<in> sources (a#as) s u\"\n  apply(unfold sources_Cons)\n  apply(erule ssubst)\n  apply(rule UnI2)\n  apply(clarsimp)\n  apply(rule_tac x=u in exI)\n  apply(safe)\n   apply(rule schedFlowsToAll)\n  apply(frule_tac a=a in enabled_Step)\n  apply(fastforce dest: sources_refl reachable_Step)\n  done\n\n\n\nlemma sources_eq':\n  \"confidentiality_u \\<and> s \\<sim>schedDomain\\<sim> t \\<and> reachable s \\<and> reachable t\n   \\<longrightarrow> sources as s u = sources as t u\"\n  proof (induct as arbitrary: s t)\n  case Nil show ?case\n   apply(simp add: sources_Nil)\n   done\n  next\n  case (Cons a as) show ?case\n  apply(clarsimp simp: sources_Cons)\n  apply(rule un_eq)\n   apply(simp only: Union_eq, simp only: UNION_eq[symmetric])\n   apply(rule Un_eq, clarsimp)\n     apply(metis \"Cons.hyps\"[rule_format] sched_equiv_preserved reachable_Step)\n    apply(fastforce intro: enabled_Step)\n   apply(fastforce intro: enabled_Step)\n  apply(clarsimp simp: schedIncludesCurrentDom)\n  apply(rule Collect_cong)\n  apply(rule conj_cong, rule refl)\n  apply(rule iff_exI)\n  apply(metis \"Cons.hyps\"[rule_format] sched_equiv_preserved reachable_Step enabled_Step)\n  done\n  qed\n\n\nlemma sources_eq:\n  \"\\<lbrakk>confidentiality_u; s \\<sim>schedDomain\\<sim> t; reachable s; reachable t\\<rbrakk> \\<Longrightarrow>\n  sources as s u = sources as t u\"\n  by(rule sources_eq'[rule_format], simp)\n\n\nlemma sameFor_sources_dom:\n  \"\\<lbrakk>s \\<approx>(sources (a#as) s u)\\<approx> t; dom a s \\<leadsto> x; x \\<in> sources as s' u; (s,s') \\<in> Step a\\<rbrakk> \\<Longrightarrow>\n   s \\<sim>(dom a s)\\<sim> t\"\n  apply(simp add: sameFor_dom_def)\n  apply(erule bspec)\n  apply(subst sources_Cons)\n  apply(rule UnI2)\n  apply blast\n  done\n\nlemma sources_unwinding_step:\n  \"\\<lbrakk>s \\<approx>(sources (a#as) s u)\\<approx> t; s \\<sim>schedDomain\\<sim> t; confidentiality_u;\n    (s,s') \\<in> Step a; (t,t') \\<in> Step a; reachable s; reachable t\\<rbrakk>  \\<Longrightarrow>\n    s' \\<approx>(sources as s' u)\\<approx> t'\"\n  apply(clarsimp simp: sameFor_dom_def sources_Cons)\n  apply(subst (asm) confidentiality_u_def)\n  apply(drule_tac x=a in spec)\n  apply(drule_tac x=ua in spec)\n  apply(drule_tac x=s in spec)\n  apply(drule_tac x=t in spec)\n  apply(fastforce intro: sameFor_sources_dom)\n  done\n\nlemma ipurge_eq'_helper:\n  \"\\<lbrakk>s \\<in> ss; dom a s \\<in> sources (a # as) s u; \\<forall>s\\<in>ts. dom a s \\<notin> sources (a # as) s u;\n   (\\<forall>s t. s \\<in> ss \\<and> t \\<in> ts \\<longrightarrow> s \\<sim>schedDomain\\<sim> t \\<and> reachable s \\<and> reachable t);\n   t \\<in> ts; confidentiality_u\\<rbrakk> \\<Longrightarrow>\n  False\"\n  apply(cut_tac s=s and t=t and as=as and u=u in sources_eq, simp+)\n  apply(clarsimp  simp: sources_Cons | safe)+\n  apply(rename_tac s')\n   apply(drule_tac x=t in bspec, simp)\n   apply clarsimp\n   apply(cut_tac s=t in enabled_Step, simp)\n   apply(erule exE, rename_tac t')\n   apply(drule_tac x=\"sources as t' u\" in spec)\n   apply(cut_tac s=s' and t=t' and u=u in sources_eq, simp+)\n      apply(fastforce elim: sched_equiv_preserved)\n     apply(fastforce intro: reachable_Step)\n    apply(fastforce intro: reachable_Step)\n   apply(fastforce simp: schedIncludesCurrentDom)\n  apply(drule_tac x=t in bspec, simp)\n  apply clarsimp\n  apply(rename_tac v s')\n  apply(drule_tac x=v in spec, erule impE, fastforce simp: schedIncludesCurrentDom)\n  apply(cut_tac s=t in enabled_Step[where a=a], simp, clarsimp, rename_tac t')\n  apply(cut_tac s=s' and t=t' and u=u in sources_eq, simp+)\n     apply(fastforce elim: sched_equiv_preserved)\n    apply(fastforce intro: reachable_Step)\n   apply(fastforce intro: reachable_Step)\n  apply(fastforce simp: schedIncludesCurrentDom)\n  done\n\n\n\nlemma ipurge_eq':\n  \"(\\<forall> s t. s\\<in>ss \\<and> t\\<in>ts \\<longrightarrow> s \\<sim>schedDomain\\<sim> t \\<and> reachable s \\<and> reachable t) \\<and>\n   (\\<exists> s. s \\<in> ss) \\<and> (\\<exists> t. t \\<in> ts) \\<and> confidentiality_u\n    \\<longrightarrow> ipurge u as ss = ipurge u as ts\"\n  proof (induct as arbitrary: ss ts)\n  case Nil show ?case\n   apply(simp add: ipurge_def)\n   done\n  next\n  case (Cons a as) show ?case\n   apply(clarsimp simp: ipurge_Cons schedIncludesCurrentDom)\n   apply(intro conjI impI)\n      apply(rule \"Cons.hyps\"[rule_format])\n      apply clarsimp\n      apply(metis sched_equiv_preserved reachable_Step enabled_Step)\n     apply clarsimp\n     apply(drule ipurge_eq'_helper, simp+)[1]\n    apply clarsimp\n    apply(drule ipurge_eq'_helper, (simp add: uwr_sym)+)[1]\n   apply(rule \"Cons.hyps\"[rule_format], auto)\n   done\n  qed\n\nlemma ipurge_eq:\n  \"\\<lbrakk>s \\<sim>schedDomain\\<sim> t; reachable s; reachable t;\n    confidentiality_u\\<rbrakk> \\<Longrightarrow>\n   ipurge u as {s} = ipurge u as {t}\"\n  by(rule ipurge_eq'[rule_format], simp)\n\nlemma Noninfluence_uwr_Noninfluence_strong_uwr:\n  \"\\<lbrakk>confidentiality_u; Noninfluence_uwr\\<rbrakk> \\<Longrightarrow> Noninfluence_strong_uwr\"\n  apply(clarsimp simp: Noninfluence_uwr_def Noninfluence_strong_uwr_def)\n  apply(frule_tac s=s and t=t and as=as and u=u in ipurge_eq)\n     apply assumption+\n  apply(frule_tac s=s and t=t and as=bs and u=u in ipurge_eq)\n     apply assumption+\n  apply clarsimp\n  apply(drule_tac x=u in spec)\n  apply(frule_tac x=as in spec)\n  apply(drule_tac x=s in spec, drule_tac x=t in spec)\n  apply(drule_tac x=bs in spec)\n  apply(drule_tac x=t in spec, drule_tac x=t in spec)\n  apply clarsimp\n  apply(rule_tac t=t in uwr_equiv_trans)\n    apply assumption\n   apply assumption\n  apply(rule uwr_equiv_sym)\n  apply(clarsimp simp: sameFor_dom_def uwr_refl)\n  done\n\nlemma Noninfluence_Noninfluence_strong:\n  \"\\<lbrakk>confidentiality_u; Noninfluence\\<rbrakk> \\<Longrightarrow> Noninfluence_strong\"\n  apply(clarsimp simp: Noninfluence_def Noninfluence_strong_def)\n  apply(frule_tac s=s and t=t and as=as and u=u in ipurge_eq)\n     apply assumption+\n  apply(frule_tac s=s and t=t and as=bs and u=u in ipurge_eq)\n     apply assumption+\n  apply clarsimp\n  apply(drule_tac x=u in spec)\n  apply(frule_tac x=as in spec)\n  apply(drule_tac x=s in spec, drule_tac x=t in spec)\n  apply(drule_tac x=bs in spec)\n  apply(drule_tac x=t in spec, drule_tac x=t in spec)\n  apply clarsimp\n  apply(rule_tac t=t in obs_equiv_trans)\n    apply assumption\n   apply assumption\n  apply(rule obs_equiv_sym)\n  apply(clarsimp simp: sameFor_dom_def uwr_refl)\n  done\n\n\nlemma dom_in_sources_Cons:\n  \"\\<lbrakk>confidentiality_u; reachable s; reachable t;\n    s \\<approx>(sources (a#as) s u)\\<approx> t; s \\<sim>schedDomain\\<sim> t;\n    (dom a s \\<in> sources (a#as) s u)\\<rbrakk> \\<Longrightarrow>\n    (dom a t \\<in> sources (a#as) t u)\"\n  apply(subgoal_tac \"dom a s = dom a t\")\n   apply(fastforce dest: sources_eq)\n  apply(blast intro: schedIncludesCurrentDom)\n  done\n\n\n\nlemma uwr_equiv_Cons_bothI:\n   \"\\<lbrakk>reachable s; reachable t;\n     \\<forall> s' t'. (s,s') \\<in> Step a \\<and> (t,t') \\<in> Step b \\<longrightarrow> uwr_equiv s' as t' bs u\\<rbrakk> \\<Longrightarrow>\n    uwr_equiv s (a # as) t (b # bs) u\"\n  apply(clarsimp simp: uwr_equiv_def)\n  apply(clarsimp simp: execution_Run)\n  apply(fastforce simp: execution_Run reachable_Step)\n  done\n\nlemma uwr_equiv_Cons_leftI:\n   \"\\<lbrakk>reachable s; \\<forall> s'. (s,s') \\<in> Step a \\<longrightarrow> uwr_equiv s' as t bs u\\<rbrakk> \\<Longrightarrow>\n    uwr_equiv s (a # as) t bs u\"\n  by(fastforce simp: uwr_equiv_def execution_Run reachable_Step)\n\n\nlemma notin_policyI':\n  \"\\<lbrakk>reachable s;\n    dom a s \\<notin> sources (a # list) s u; (s,s') \\<in> Step a; ua \\<in> sources list s' u\\<rbrakk> \\<Longrightarrow>\n   (dom a s,ua) \\<notin> policy\"\n  apply(rule notin_policyI)\n  apply auto\n  done\n\nlemma sources_eq_Step:\n  \"\\<lbrakk>integrity_u; confidentiality_u; reachable s; (s,s') \\<in> Step a; dom a s \\<noteq> schedDomain\\<rbrakk> \\<Longrightarrow>\n   (sources as s' u) = (sources as s u)\"\n  apply(rule sources_eq, simp+)\n    apply(rule_tac t=s and s=s and a=a in sched_equiv_preserved_left,\n          (simp add: uwr_refl reachable_Step)+)\n  done\n\nlemma sources_equiv_preserved_left:\n  \"\\<lbrakk>integrity_u; confidentiality_u; reachable s; reachable t; s \\<sim>schedDomain\\<sim> t;\n    dom a s \\<notin> sources (a#as) s u; s \\<approx>sources (a#as) s u\\<approx> t; (s,s') \\<in> Step a; dom a s \\<noteq> schedDomain\\<rbrakk>\n    \\<Longrightarrow> s' \\<approx>sources as s' u\\<approx> t\"\n  apply(clarsimp simp: sameFor_dom_def)\n  apply(rename_tac v)\n  apply(case_tac \"(dom a s, v) \\<in> policy\")\n   apply(fastforce simp: sources_Cons)\n  apply(fastforce dest: integrity_uD simp: sources_Cons)\n  done\n\nlemma Noninfluence_gen:\n  \"\\<lbrakk>confidentiality_u; integrity_u\\<rbrakk> \\<Longrightarrow> Noninfluence_gen\"\n  apply(subst Noninfluence_gen_def)\n  apply(intro allI)\n  proof -\n  assume conf: \"confidentiality_u\"\n  assume integ: \"integrity_u\"\n  fix u as s ts\n  show \"reachable s \\<and> Ball ts reachable \\<longrightarrow>\n          Ball ts (sameFor_dom s (sources as s u)) \\<longrightarrow> (\\<forall>t\\<in>ts. s \\<sim>schedDomain\\<sim> t)\n          \\<longrightarrow> (\\<forall>t\\<in>ts. uwr_equiv s as t (ipurge u as ts) u)\"\n    proof(induct as arbitrary: s ts)\n    case Nil\n    show ?case\n      apply(clarsimp simp: sameFor_dom_def ipurge_Nil sources_Nil uwr_equiv_def)\n      apply(clarsimp simp: execution_Run)\n      done\n    next\n    case (Cons a as)\n    show ?case\n  apply(clarsimp simp: ipurge_Cons | safe)+\n   apply(rule uwr_equiv_Cons_bothI)\n     apply assumption\n    apply blast\n   apply(clarify)\n   apply(rename_tac ta tb s' tb')\n   apply(rule Cons.hyps[rule_format])\n      apply(blast intro: reachable_Step)\n     apply(clarsimp)\n     apply(rename_tac tc' tc)\n     using conf apply(rule_tac s=s and t=tc and a=a in sources_unwinding_step, simp+)[1]\n    apply(clarsimp, rename_tac tc' tc)\n    apply(rule sched_equiv_preserved[OF conf], (auto simp: sources_refl))[1]\n   apply blast\n  apply(rename_tac ta)\n  apply(rule uwr_equiv_Cons_leftI, blast)\n  apply(clarsimp, rename_tac s')\n  apply(case_tac \"dom a s = schedDomain\")\n   apply(cut_tac s=s and a=a and as=as and u=u in schedDomain_in_sources_Cons, assumption+)\n   apply(metis schedIncludesCurrentDom sources_eq[OF conf])\n  apply(rule Cons.hyps[rule_format])\n     apply(blast intro: reachable_Step)\n    apply(rename_tac tb)\n    apply(rule_tac a=a in sources_equiv_preserved_left[OF integ conf], simp+)\n       apply(fastforce simp: schedIncludesCurrentDom sources_eq[OF conf])\n      apply blast\n     apply assumption\n    apply assumption\n   apply(rule_tac s=s and a=a in sched_equiv_preserved_left[OF integ], simp+)\n  done\n  qed\n  qed\n\nlemma Nonleakage_gen:\n  \"\\<lbrakk>confidentiality_u\\<rbrakk> \\<Longrightarrow> Nonleakage_gen\"\n  apply(subst Nonleakage_gen_def)\n  apply(rule allI)\n  apply(induct_tac as)\n   apply(simp add: sources_Nil uwr_equiv_def execution_Run sameFor_dom_def)\n  apply(clarsimp)\n  apply(rule uwr_equiv_Cons_bothI)\n    apply assumption\n   apply assumption\n  apply clarsimp\n  apply(drule_tac x=s' in spec, drule_tac x=u in spec, drule_tac x=t' in spec)\n  apply(clarsimp simp: reachable_Step)\n  apply(erule impE)\n   apply(blast intro: sched_equiv_preserved)\n  apply(erule mp)\n  apply(blast intro: sources_unwinding_step)\n  done\n\n\n\nlemma Noninterference:\n  \"\\<lbrakk>confidentiality_u_weak; output_consistent; integrity_u\\<rbrakk> \\<Longrightarrow>\n   Noninterference\"\n  apply(rule Noninfluence_gen_Noninterference)\n   apply assumption\n  apply(blast intro: Noninfluence_gen confidentiality_u_weak)\n  done\n\nlemma Noninterference_strong:\n  \"\\<lbrakk>confidentiality_u_weak; output_consistent; integrity_u\\<rbrakk> \\<Longrightarrow>\n   Noninterference_strong\"\n  apply(rule Noninfluence_gen_Noninterference_strong)\n   apply assumption\n  apply(blast intro: Noninfluence_gen confidentiality_u_weak)\n  done\n\n\n\nlemma Noninfluence:\n  \"\\<lbrakk>confidentiality_u_weak; output_consistent; integrity_u\\<rbrakk> \\<Longrightarrow>\n   Noninfluence\"\n  apply(rule Noninfluence_gen_Noninfluence)\n   apply assumption\n  apply(blast intro: Noninfluence_gen confidentiality_u_weak)\n  done\n\nlemma Noninfluence_strong:\n  \"\\<lbrakk>confidentiality_u_weak; output_consistent; integrity_u\\<rbrakk> \\<Longrightarrow>\n   Noninfluence_strong\"\n  apply(rule Noninfluence_Noninfluence_strong)\n   apply(blast intro: confidentiality_u_weak)\n  apply(blast intro: Noninfluence)\n  done\n\n\nlemma Noninfluence_uwr:\n  \"\\<lbrakk>confidentiality_u_weak; integrity_u\\<rbrakk> \\<Longrightarrow>\n   Noninfluence_uwr\"\n  apply(rule Noninfluence_gen_Noninfluence_uwr)\n  apply(blast intro: Noninfluence_gen confidentiality_u_weak)\n  done\n\nlemma Noninfluence_strong_uwr:\n  \"\\<lbrakk>confidentiality_u_weak; integrity_u\\<rbrakk> \\<Longrightarrow>\n   Noninfluence_strong_uwr\"\n  apply(rule Noninfluence_uwr_Noninfluence_strong_uwr)\n   apply(blast intro: confidentiality_u_weak)\n  apply(blast intro: Noninfluence_uwr)\n  done\n\nlemma sources_Step:\n  \"\\<lbrakk>reachable s; (dom a s, u) \\<notin> policy\\<rbrakk> \\<Longrightarrow>\n  sources [a] s u = {u}\"\n  apply(auto simp: sources_Cons sources_Nil enabled_Step dest: enabled_Step)\n  done\n\nlemma sources_Step_2:\n  \"\\<lbrakk>reachable s; (dom a s, u) \\<in> policy\\<rbrakk> \\<Longrightarrow>\n  sources [a] s u = {dom a s,u}\"\n  apply(auto simp: sources_Cons sources_Nil enabled_Step dest: enabled_Step)\n  done\n\nlemma execution_Nil:\n  \"reachable s \\<Longrightarrow> execution A s [] = {s}\"\n  apply(simp add: execution_Run)\n  done\n\nlemma Noninfluence_gen_confidentiality_u_weak:\n  \"Noninfluence_gen \\<Longrightarrow> confidentiality_u_weak\"\n  apply(clarsimp simp: Noninfluence_gen_def confidentiality_u_weak_def)\n  apply(drule_tac x=u in spec, drule_tac x=\"[a]\" in spec)\n  apply(drule_tac x=s in spec, drule_tac x=\"{t}\" in spec)\n  apply(simp add: sources_Step_2 sameFor_dom_def uwr_equiv_def Step_def ipurge_Cons ipurge_Nil\n           split: if_splits\n             add: schedIncludesCurrentDom)\n  done\n\nlemma Noninfluence_strong_uwr_confidentiality_u_weak:\n  \"Noninfluence_strong_uwr \\<Longrightarrow> confidentiality_u_weak\"\n  apply(clarsimp simp: Noninfluence_strong_uwr_def confidentiality_u_weak_def)\n  apply(drule_tac x=u in spec, drule_tac x=\"[a]\" in spec, drule_tac x=\"[a]\" in spec)\n  apply(drule_tac x=s in spec, drule_tac x=t in spec)\n  apply(simp add: sources_Step_2 sameFor_dom_def uwr_equiv_def Step_def)\n  done\n\nlemma Nonleakage_gen_confidentiality_u:\n  \"Nonleakage_gen \\<Longrightarrow> confidentiality_u\"\n  apply(clarsimp simp: Nonleakage_gen_def confidentiality_u_def)\n  apply(drule_tac x=\"[a]\" in spec, drule_tac x=s in spec)\n  apply(drule_tac x=u in spec, drule_tac x=t in spec)\n  apply(case_tac \"dom a s \\<leadsto> u\")\n   apply(simp add: sources_Step_2 uwr_equiv_def sameFor_dom_def Step_def)\n  apply(simp add: sources_Step uwr_equiv_def sameFor_dom_def Step_def)\n  done\n\nlemma Nonleakage_gen_equiv_confidentiality_u:\n  \"Nonleakage_gen = confidentiality_u\"\n  apply(blast intro: Nonleakage_gen_confidentiality_u Nonleakage_gen)\n  done\n\nlemma non_sched_doms_cannot_schedule:\n  \"\\<lbrakk>integrity_u; reachable s; dom a s \\<noteq> schedDomain; (s,s') \\<in> Step a\\<rbrakk> \\<Longrightarrow> s \\<sim>schedDomain\\<sim> s'\"\n  apply(drule_tac u=schedDomain in integrity_uD)\n      apply assumption\n     apply(erule contrapos_nn)\n     apply(erule schedNotGlobalChannel)\n    apply(rule uwr_refl)\n   apply assumption\n  apply(erule uwr_sym)\n  done\n\n\ntext \\<open>\n   In systems with just a single event, @{prop integrity_u} is a very strong\n   condition. It implies that once the scheduler is not\n   running, it can never run again.\n\n   This is one explanation for why seL4 (whose automaton has only a single\n   event) doesn't satisfy @{prop integrity_u}.\n\\<close>\nlemma integrity_u_and_single_event_systems:\n  \"\\<lbrakk>integrity_u; reachable s; dom a s \\<noteq> schedDomain; s' \\<in> execution A s as;\n    \\<forall> y::'e. y = a\\<rbrakk> \\<Longrightarrow> dom e s' \\<noteq> schedDomain\"\n  apply(frule_tac x=e in spec)\n  apply(erule ssubst)\n  apply(rule_tac P=\"\\<lambda>x. x \\<noteq> schedDomain\" in subst[rotated])\n   apply assumption\n  apply(induct as arbitrary: s s' a rule: rev_induct)\n   apply(simp add: execution_Run)\n  apply(simp add: execution_Run)\n  apply(drule Run_mid)\n  apply(erule exE, rename_tac t)\n  apply(drule_tac x=s in meta_spec)\n  apply(drule_tac x=t in meta_spec)\n  apply(drule_tac x=a in meta_spec)\n  apply simp\n  apply(rule schedIncludesCurrentDom)\n  apply(rule non_sched_doms_cannot_schedule)\n     apply assumption\n    apply(rule reachable_execution)\n     apply assumption\n    apply(fastforce simp: execution_Run)\n   apply assumption\n  apply(drule_tac x=x in spec)\n  apply blast\n  done\n\nend\n\n\nsubsection \\<open>Complete unwinding system\\<close>\n\ntext \\<open>The unwinding conditions are not only sound but also complete when policy is reflexive\\<close>\nlocale complete_unwinding_system = unwinding_system +\n  assumes  policy_refl:\n  \"(u,u) \\<in> policy\"\nbegin\n\nlemma Noninfluence_gen_integrity_u:\n  \"Noninfluence_gen \\<Longrightarrow> integrity_u\"\n  apply(clarsimp simp: Noninfluence_gen_def integrity_u_def)\n  apply(drule_tac x=u in spec, drule_tac x=\"[a]\" in spec)\n  apply(drule_tac x=s in spec, drule_tac x=\"{s}\" in spec)\n  apply(simp add: sources_Step sameFor_dom_def uwr_equiv_def Step_def ipurge_Cons ipurge_Nil\n           split: if_splits add: uwr_refl policy_refl execution_Nil uwr_sym)\n  done\n\n\nlemma Noninfluence_strong_uwr_integrity_u:\n  \"Noninfluence_strong_uwr \\<Longrightarrow> integrity_u\"\n  apply(clarsimp simp: Noninfluence_strong_uwr_def integrity_u_def)\n  apply(drule_tac x=u in spec, drule_tac x=\"[a]\" in spec, drule_tac x=\"[]\" in spec)\n  apply(drule_tac x=s in spec, drule_tac x=s in spec)\n  apply(simp add: sources_Step sameFor_dom_def uwr_refl uwr_equiv_def Step_def ipurge_Cons\n                  ipurge_Nil\n           split: if_splits)\n   apply(simp add: policy_refl)\n  apply(simp add: execution_Nil)\n  apply(blast intro: uwr_sym)\n  done\n\ntext \\<open>\n   @{prop Noninfluence_gen} actually turns out to be equivalent to @{prop Noninfluence_strong_uwr},\n   when the policy is reflexive. So the two unwinding conditions for integrity\n   and confidentiality actually turn out to be sound and sufficient for the\n   condition we were using them to prove in the first place.\n\\<close>\nlemma Noninfluence_gen_equiv_Noninfluence_strong_uwr:\n  \"Noninfluence_gen = Noninfluence_strong_uwr\"\n  apply(rule iffI)\n   apply(rule Noninfluence_strong_uwr)\n    apply(erule Noninfluence_gen_confidentiality_u_weak)\n   apply(erule Noninfluence_gen_integrity_u)\n  apply(rule Noninfluence_gen)\n   apply(rule confidentiality_u_weak)\n    apply(erule Noninfluence_strong_uwr_confidentiality_u_weak)\n   apply(erule Noninfluence_strong_uwr_integrity_u)+\n  done\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/infoflow/Noninterference_Base.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300573952052, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.3157118332835101}}
{"text": "theory Failures\n\nimports\n Main\n Failures_Core\n Failures_BasicOps\nbegin\n\ntext \\<open> The conjecture here is that there is a Galois connection between the F4 superset, and \n       a subset that doesn't observe it necessarily. \\<close>\n\ndefinition sf2f :: \"'a process \\<Rightarrow> 'a process\"\n  where \"sf2f P = \\<Sqinter>{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> P \\<sqsubseteq> (mkF24 Q)}\"\n\ntext \\<open> The following function is the actual one that matters. \\<close>\n\ndefinition sf25f :: \"'a process \\<Rightarrow> 'a process\"\n  where \"sf25f P = \\<Sqinter>{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> (mkF24 Q)}\"\n\ndefinition unmkF25 :: \"'a process \\<Rightarrow> 'a process\"\n  where \"unmkF25 P = \\<Sqinter>{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> P \\<sqsubseteq> (mkF25 Q)}\"\n\nlemma sf2f_mono:\n  assumes \"P \\<sqsubseteq> Q\"\n  shows \"sf2f P \\<sqsubseteq> sf2f Q\"\n  using assms unfolding sf2f_def IntChoice_def apply auto\n  by (smt SUP_least UN_I mem_Collect_eq prod.sel(1) prod.sel(2) refines_def refines_tran subsetI)\n\nlemma mkF24_mono:\n  assumes \"P \\<sqsubseteq> Q\"\n  shows \"mkF24 P \\<sqsubseteq> mkF24 Q\"\n  using assms unfolding mkF24_def traces_def refines_def by auto\n\ntext \\<open> Key theorem would be to show that applying mkF24 and sf2f yields the same? \\<close>\n\nlemma T1_dist_IntChoice_two_imp:\n  assumes \"T1 P\" \"T1 Q\"\n  shows \"T1 (\\<Sqinter>{P,Q})\"\n  using assms unfolding IntChoice_def apply auto\n  unfolding T1_def traces_def by auto\n\nlemma T0_closed_intChoice:\n  assumes \"T0 P\" \"T0 Q\"\n  shows \"T0 (P \\<sqinter> Q)\"\n  using assms unfolding intChoice_def T0_def traces_def by auto\n\nlemma T1_closed_intChoice:\n  assumes \"T1 P\" \"T1 Q\"\n  shows \"T1 (P \\<sqinter> Q)\"\n  using assms unfolding intChoice_def T1_def traces_def by auto\n\nlemma T2_closed_intChoice:\n  assumes \"T2 P\" \"T2 Q\"\n  shows \"T2 (P \\<sqinter> Q)\"\n  using assms unfolding intChoice_def T2_def traces_def by auto\n\nlemma F2_closed_intChoice:\n  assumes \"F2 P\" \"F2 Q\"\n  shows \"F2 (P \\<sqinter> Q)\"\n  using assms unfolding intChoice_def F2_def traces_def by auto\n\nlemma F3_closed_intChoice:\n  assumes \"F3 P\" \"F3 Q\"\n  shows \"F3 (P \\<sqinter> Q)\"\n  using assms unfolding intChoice_def F3_def traces_def apply auto\n  by (metis (mono_tags, lifting) Int_Collect Int_emptyI emptyE mem_Collect_eq)+\n\nlemma T1_IntChoice_dist_two_imp:\n  assumes \"T1 (\\<Sqinter>{P,Q})\"\n  shows \"T1 P \\<or> T1 Q\" \n  using assms unfolding IntChoice_def apply auto\n  unfolding T1_def traces_def \n  oops\n\nlemma T0_dist_IntChoice:\n  assumes \"T0`S = {True}\"\n  shows \"T0 (\\<Sqinter>S)\"\n  using assms unfolding IntChoice_def T0_def traces_def by auto\n\nlemma T1_dist_IntChoice:\n  assumes \"T1`S = {True}\"\n  shows \"T1 (\\<Sqinter>S)\"\n  using assms unfolding IntChoice_def T1_def traces_def apply safe\n   apply auto[1]\n  by (smt UN_iff imageI mem_Collect_eq singleton_conv2 snd_conv)\n\nlemma T2_closed_IntChoice:\n  assumes \"T2`S = {True}\"\n  shows \"T2 (\\<Sqinter>S)\"\n  using assms unfolding IntChoice_def \n  by (smt T2_def UN_iff fst_conv image_iff singleton_iff snd_conv traces_def)\n\nlemma F2_closed_IntChoice:\n  assumes \"F2`S = {True}\"\n  shows \"F2 (\\<Sqinter>S)\"\n  using assms unfolding IntChoice_def \n  by (smt F2_def UN_iff fst_conv image_iff singleton_iff snd_conv traces_def)\n\nlemma F3_closed_IntChoice:\n  assumes \"F3`S = {True}\"\n  shows \"F3 (\\<Sqinter>S)\"\n  using assms unfolding IntChoice_def F3_def apply safe\n  unfolding traces_def apply simp\n  by blast\n\nlemma F5_closed_IntChoice:\n  assumes \"F5`S = {True}\"\n  shows \"F5 (\\<Sqinter>S)\"\n  using assms unfolding IntChoice_def F5_def apply safe\n  unfolding traces_def apply simp\n  by blast\n\nlemma F6_closed_IntChoice:\n  assumes \"F6`S = {True}\"\n  shows \"F6 (\\<Sqinter>S)\"\n  using assms unfolding IntChoice_def F6_def apply safe\n  unfolding traces_def apply simp\n  by blast\n\nlemma \n  assumes \"traces(P) \\<noteq> {}\"\n  shows \"traces(sf2f P) \\<noteq> {}\"\n  using assms unfolding sf2f_def traces_def apply auto\n  oops\n\nabbreviation remTraceTick :: \"'a trace \\<Rightarrow> 'a trace\" where\n\"remTraceTick s == filter (\\<lambda>x. x\\<noteq>tick) s\"\n\ndefinition remTick :: \"'a process \\<Rightarrow> 'a process\" where\n\"remTick P = (fst P,remTraceTick`snd P)\"\n\nlemma Tick_last_prefix_remTraceTick:\n  assumes \"Tick_last t\"\n  shows \"prefix (remTraceTick t) t\"\n  using assms by(induct rule:Tick_last.induct, auto)\n\nlemma remTraceTick_no_last_tick:\n  \"s @ [tick] \\<noteq> remTraceTick x\"\n  apply (induct s, auto)\n  apply (induct x, auto)\n   apply (metis (mono_tags, lifting) filter_eq_ConsD list.inject)\n  apply (induct x, auto)\n  by (smt append.simps(1) append.simps(2) filter_eq_ConsD hd_Cons_tl list.inject not_Cons_self2)\n\nlemma mkF24_remTick_refines:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\"\n  shows \"P \\<sqsubseteq> mkF24(remTick(P))\"\n  apply (rule refines_rule)\n  using assms unfolding remTick_def mkF24_def traces_def apply auto\n  using remTraceTick_no_last_tick apply blast\n  using remTraceTick_no_last_tick apply blast\n  using T0_def T1_def Tick_last_prefix_remTraceTick traces_def by blast\n\nlemma Tick_last_remTraceTick:\n  \"Tick_last (remTraceTick x)\"\n  apply (induct x, auto)\n  by (case_tac a, auto)\n  \nlemma T0_remTick:\n  assumes \"T0 P\"\n  shows \"T0 (remTick(P))\"\n  using assms unfolding T0_def traces_def remTick_def using Tick_last_remTraceTick by auto\n\nlemma T0_remTick:\n  assumes \"T1 P\" \"T0 P\"\n  shows \"T1 (remTick(P))\"\n  using assms unfolding T0_def T1_def traces_def remTick_def oops\n\nlemma always_refines_Div:\n  assumes \"T1 P\" \n  shows \"\\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> mkF24 Q\"\n  using assms Div_top \n  by (metis F2_Div F3_Div F4_Div F5_Div F6_Div T0_Div T1_Div T2_Div mkF24_fixpoint_imp)\n\nlemma always_refines_F5_Div:\n  assumes \"T1 P\" \n  shows \"\\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> mkF24 Q\"\n  using assms Div_top\n  by (metis F2_Div F3_Div F4_Div F5_Div F6_Div T0_Div T1_Div T2_Div mkF24_fixpoint_imp)\n\nlemma T1_sf2f_ran:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"T1`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_Div by fastforce\n\nlemma T0_sf2f_ran:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"T0`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_Div by fastforce\n\nlemma T2_sf2f_ran:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"T2`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_Div by fastforce\n\nlemma F2_sf2f_ran:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"F2`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_Div by fastforce\n\nlemma F3_sf2f_ran:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"F3`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_Div by fastforce\n\n(* sf25 below *)\n\nlemma T1_sf25f_ran:\n  assumes \"T1 P\" \n  shows \"T1`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_F5_Div by fastforce\n\nlemma T0_sf25f_ran:\n  assumes \"T1 P\"\n  shows \"T0`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_F5_Div by fastforce\n\nlemma T2_sf25f_ran:\n  assumes \"T1 P\"\n  shows \"T2`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_F5_Div by fastforce\n\nlemma F2_sf25f_ran:\n  assumes \"T1 P\"\n  shows \"F2`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_F5_Div by fastforce\n\nlemma F3_sf25f_ran:\n  assumes \"T1 P\"\n  shows \"F3`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_F5_Div by fastforce\n\nlemma F5_sf25f_ran:\n  assumes \"T1 P\"\n  shows \"F5`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_F5_Div by fastforce\n\nlemma F6_sf25f_ran:\n  assumes \"T1 P\"\n  shows \"F6`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> mkF24 Q} = {True}\"\n  using assms apply auto\n  using always_refines_F5_Div by fastforce\n\nlemma T1_sf2f:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"T1 (sf2f P)\"\n  using assms unfolding sf2f_def using T1_sf2f_ran\n  by (metis (no_types, lifting) Collect_cong T1_dist_IntChoice)\n\nlemma T0_sf2f:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"T0 (sf2f P)\"\n  using assms unfolding sf2f_def using T0_sf2f_ran\n  by (metis (no_types, lifting) Collect_cong T0_dist_IntChoice)\n\nlemma T2_sf2f:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"T2 (sf2f P)\"\n  using assms unfolding sf2f_def using T2_sf2f_ran\n  by (metis (no_types, lifting) Collect_cong T2_closed_IntChoice)\n\nlemma F3_sf2f:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"F3 (sf2f P)\"\n  using assms unfolding sf2f_def using F3_sf2f_ran\n  by (metis (no_types, lifting) Collect_cong F3_closed_IntChoice)\n\n(* sf25 below *)\n\nlemma T1_sf25f:\n  assumes \"T1 P\"\n  shows \"T1 (sf25f P)\"\n  using assms unfolding sf25f_def using T1_sf25f_ran\n  by (metis (no_types, lifting) Collect_cong T1_dist_IntChoice)\n\nlemma T0_sf25f:\n  assumes \"T1 P\"\n  shows \"T0 (sf25f P)\"\n  using assms unfolding sf25f_def using T0_sf25f_ran\n  by (metis (no_types, lifting) Collect_cong T0_dist_IntChoice)\n\nlemma T2_sf25f:\n  assumes \"T1 P\"\n  shows \"T2 (sf25f P)\"\n  using assms unfolding sf25f_def using T2_sf25f_ran\n  by (metis (no_types, lifting) Collect_cong T2_closed_IntChoice)\n\nlemma F3_sf25f:\n  assumes \"T1 P\"\n  shows \"F3 (sf25f P)\"\n  using assms unfolding sf25f_def using F3_sf25f_ran\n  by (metis (no_types, lifting) Collect_cong F3_closed_IntChoice)\n\nlemma F5_sf25f:\n  assumes \"T1 P\"\n  shows \"F5 (sf25f P)\"\n  using assms unfolding sf25f_def using F5_sf25f_ran\n  by (metis (no_types, lifting) Collect_cong F5_closed_IntChoice)\n\nlemma F6_sf25f:\n  assumes \"T1 P\"\n  shows \"F6 (sf25f P)\"\n  using assms unfolding sf25f_def using F6_sf25f_ran\n  by (metis (no_types, lifting) Collect_cong F6_closed_IntChoice)\n\nlemma traces_eq_traces_mkF24:\n  shows \"traces P = traces (mkF24 P)\"\n  unfolding traces_def mkF24_def by auto\n\nlemma traces_eq_traces_mkF25:\n  shows \"traces P = traces (mkF25 P)\"\n  unfolding traces_def mkF25_def by auto\n\n(*\nlemma traces_eq_traces_unmkF25:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"traces P \\<subseteq> traces (unmkF25 P)\"\n  using assms\n  unfolding unmkF25_def mkF25_def refines_def IntChoice_def traces_def apply auto\n  by (smt Collect_cong F4_F2_imp_tick_failures UNIV_I case_prod_conv prod.collapse subsetI)*)\n\nlemma traces_eq_traces_sf2f:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"traces P \\<subseteq> traces (sf2f P)\"\n  using assms\n  unfolding sf2f_def mkF24_def refines_def IntChoice_def traces_def apply auto\n  by (smt Collect_cong F4_F2_imp_tick_failures UNIV_I case_prod_conv prod.collapse subsetI)\n\nlemma T0_empty_failures[simp]:\n  assumes \"T0 P\"\n  shows \"T0 ({}, snd P)\"\n  using assms unfolding T0_def traces_def by auto\n\nlemma T1_empty_failures[simp]:\n  assumes \"T1 P\"\n  shows \"T1({}, snd P)\"\n  using assms unfolding T1_def traces_def by auto\n\nlemma T2_empty_failures[simp]:\n  \"T2({}, snd P)\"\n  unfolding T2_def traces_def by auto\n\nlemma F2_empty_failures[simp]:\n  \"F2({}, snd P)\"\n  unfolding F2_def by auto\n\nlemma F3_empty_failures[simp]:\n  \"F3({}, snd P)\"\n  unfolding F3_def by auto\n\nlemma F5_empty_failures[simp]:\n  \"F5({}, snd P)\"\n  unfolding F5_def by auto\n\nlemma F6_empty_failures[simp]:\n  \"F6({}, snd P)\"\n  unfolding F6_def by auto\n\nlemma traces_imp_traces_sf25f:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"traces P \\<subseteq> traces (sf25f P)\"\n  using assms\n  unfolding sf25f_def IntChoice_def traces_def apply auto\n  apply (rule exI[where x=\"{}\"])\n  apply (rule exI[where x=\"snd P\"], auto)\n  unfolding mkFailuresF5_def mkF24_def traces_def refines_def traces_def apply auto\n  apply (metis F2_def F4_def insert_subset traces_def)\n  by (metis F2_def F4_def insert_subset subset_UNIV traces_def)\n\nlemma traces_sf25f_imp_traces:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \n  shows \"traces (sf25f P) \\<subseteq> traces P\"\n  using assms\n  unfolding sf25f_def mkF24_def refines_def IntChoice_def traces_def by auto\n\nlemma traces_sf2f_eq_traces:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"traces (sf2f P) \\<subseteq> traces P\"\n  using assms\n  unfolding sf2f_def mkF24_def refines_def IntChoice_def traces_def by auto\n\nlemma traces_sf2f_eq:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"traces (sf2f P) = traces P\"\n  by (simp add: assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) subset_antisym traces_eq_traces_sf2f traces_sf2f_eq_traces)\n\nlemma traces_sf25f_eq:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"traces (sf25f P) = traces P\"\n  by (simp add: antisym assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) traces_imp_traces_sf25f traces_sf25f_imp_traces)\n\nlemma mkF24_sf2f_refined:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\" \n  shows \"mkF24 (sf2f P) \\<sqsubseteq> P\"\nproof (rule refines_rule)\n  show \"fst P \\<subseteq> fst (mkF24 (sf2f P))\"\n    using assms unfolding mkF24_def apply auto\n    by (smt IntChoice_def UN_I assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) fst_conv le_sup_iff mem_Collect_eq mkF24_def mkF24_fixpoint_imp refines_refl sf2f_def subsetI subset_eq subset_iff traces_eq_traces_mkF24)\n\n  show \"snd P \\<subseteq> snd (mkF24 (sf2f P))\"\n    using assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) traces_def traces_eq_traces_mkF24 traces_eq_traces_sf2f by blast\nqed\n\nlemma mkF24_sf25f_refines:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\" \n  shows \"P \\<sqsubseteq> mkF24 (sf25f P)\"\nproof (rule refines_rule)\n  show \"snd (mkF24 (sf25f P)) \\<subseteq> snd P\"\n   using assms(1) assms(2) assms(3) assms(4) assms(5) traces_def traces_eq_traces_mkF24 traces_sf25f_imp_traces by blast\n    \n  show \"fst (mkF24 (sf25f P)) \\<subseteq> fst P\"\n    unfolding sf25f_def mkF24_def traces_def IntChoice_def apply auto\n      apply (simp add: refines_def subset_eq)\n        apply (metis (no_types, lifting) F2_def F4_def assms(4) assms(6) insert_Diff insert_subset refines_def snd_conv traces_def)\n        by (smt Un_subset_iff case_prodI2 fst_conv mem_Collect_eq refines_def subset_eq)\nqed\n\nlemma sf25f_mkF24_refined:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F5 P\" \"F6 P\" \n  shows \"sf25f (mkF24 P) \\<sqsubseteq> P\"\nproof (rule refines_rule)\n  show \"snd P \\<subseteq> snd (sf25f (mkF24 P))\"\n    by (metis F2_mkF24 F3_mkF24 F4_mkF24 T0_def T1_mkF24 T2_mkF24 assms(1) assms(2) assms(3) assms(4) assms(5) eq_iff traces_def traces_eq_traces_mkF24 traces_sf25f_eq)\n\n  show \"fst P \\<subseteq> fst (sf25f (mkF24 P))\"\n    unfolding sf25f_def mkF24_def traces_def IntChoice_def apply auto\n    using assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) assms(7) refines_refl by force\nqed\n\ntext \\<open> The following only holds because cardinality of 'a evt, when not tick is\n       non-zero? Otherwise they would map to the same. \\<close>\n\nlemma Stop_not_Skip_mkF24: \n  shows \"\\<not> mkF24 (StopF) \\<sqsubseteq> mkF24(SkipUF)\"\n  unfolding SkipUF_def StopF_def intChoice_def\n  unfolding refines_def mkF24_def traces_def by auto\n\nlemma F6_termination_not_F4:\n  assumes \"F6 P\" \"\\<exists>s. s@[tick] \\<in> snd P\"\n  shows \"\\<not> F4 P\"\n  using assms unfolding F6_def F4_def traces_def by auto\n\nlemma F4_termination_not_F6:\n  assumes \"F4 P\" \"\\<exists>s. s@[tick] \\<in> snd P\"\n  shows \"\\<not> F6 P\"\n  using assms unfolding F6_def F4_def traces_def by auto\n\nlemma mkF24_eq_1:\n  assumes \"(a, b) \\<in> fst Q\" \"(a, b) \\<notin> fst P\" \"(mkF24 P) \\<sqsubseteq> (mkF24 Q)\" \n  shows \"\\<exists>s. s @ [tick] \\<in> snd P \\<and> (a = s \\<and> b \\<subseteq> UNIV - {tick} \\<or> a = s @ [tick])\"\n  using assms unfolding mkF24_def refines_def traces_def by auto\n\nlemma mkF24_eq_2:\n  assumes \"(s, b) \\<notin> fst P\" \"s @ [tick] \\<in> snd Q\" \"b \\<subseteq> UNIV - {tick}\" \"(mkF24 P) \\<sqsubseteq> (mkF24 Q)\"\n  shows \"\\<exists>sa. sa @ [tick] \\<in> snd P \\<and> (s = sa \\<or> s = sa @ [tick])\"\n  using assms unfolding mkF24_def refines_def traces_def by auto\n\nlemma mkF24_eq_3:\n  assumes \"(s @ [tick], b) \\<notin> fst P\" \"s @ [tick] \\<in> snd Q\" \"(mkF24 P) \\<sqsubseteq> (mkF24 Q)\"\n  shows \"\\<exists>sa. sa @ [tick] \\<in> snd P \\<and> (s @ [tick] = sa \\<and> b \\<subseteq> UNIV - {tick} \\<or> s = sa)\"\n  using assms unfolding mkF24_def refines_def traces_def by auto\n\nlemma F235_mkF24_rev_mono:\n  assumes \"(mkF24 P) \\<sqsubseteq> (mkF24 Q)\" \"F2 Q\" \"F5 Q\" \"F6 Q\" \"F2 P\" \"F5 P\" \"F6 P\"\n  shows \"fst Q \\<subseteq> fst P\"\nproof -\n\n  have Q_mkF25: \"Q = mkF25 Q\"\n    by (simp add: F5_F2_imp_mkF25_fixpoint assms)\n\n  have P_mkF25: \"P = mkF25 P\"\n    by (simp add: F5_F2_imp_mkF25_fixpoint assms)\n\n   have \"fst (mkF25 Q) \\<subseteq> fst (mkF25 P)\"\n      unfolding mkF25_def traces_def apply auto\n      using assms mkF24_eq_1 \n      using F5_def F6_def by blast+\n\n   then have \"fst Q \\<subseteq> fst P\"\n     using Q_mkF25 P_mkF25 by auto\n\n   then show ?thesis .\n qed\n\nlemma sf25f_mkF24_refines:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F5 P\" \"F6 P\" \n  shows \"P \\<sqsubseteq> sf25f (mkF24 P)\"\nproof (rule refines_rule)\n  show \"snd (sf25f (mkF24 P)) \\<subseteq> snd P\"\n    by (metis F2_mkF24 F3_mkF24 F4_mkF24 T0_def T1_mkF24 T2_mkF24 assms(1) assms(2) assms(3) assms(4) assms(5) eq_iff traces_def traces_eq_traces_mkF24 traces_sf25f_eq)\n   \n  show \"fst (sf25f (mkF24 P)) \\<subseteq> fst P\"\n  proof -\n    have fst_sf25f:\"fst (sf25f (mkF24 P)) = {x. \\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> (mkF24 P) \\<sqsubseteq> (mkF24 Q) \\<and> x \\<in> (fst Q)}\"\n    proof -\n      have \"fst (sf25f (mkF24 P)) = fst (\\<Sqinter>{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> (mkF24 P) \\<sqsubseteq> (mkF24 Q)})\"\n        unfolding sf25f_def by auto\n      also have \"... = \\<Union>(fst`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> (mkF24 P) \\<sqsubseteq> (mkF24 Q)})\"\n        unfolding IntChoice_def by auto\n      also have \"... = \\<Union>({y. \\<exists>x. x \\<in> {Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> (mkF24 P) \\<sqsubseteq> (mkF24 Q)} \\<and> y = (fst x)})\"\n        by auto\n      also have \"... = \\<Union>({y. \\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> (mkF24 P) \\<sqsubseteq> (mkF24 Q) \\<and> y = (fst Q)})\"\n        by auto (* \\<Union>A = {x. \\<exists>B \\<in> A. x \\<in> B} *)\n      also have \"... = {x. \\<exists>B \\<in> {y. \\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> (mkF24 P) \\<sqsubseteq> (mkF24 Q) \\<and> y = (fst Q)}. x \\<in> B}\"\n        by auto\n      also have \"... = {x. \\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> (mkF24 P) \\<sqsubseteq> (mkF24 Q) \\<and> x \\<in> (fst Q)}\"\n        by auto\n      finally show ?thesis .\n    qed\n\n    \n    have \"{x. \\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> (mkF24 P) \\<sqsubseteq> (mkF24 Q) \\<and> x \\<in> (fst Q)} \\<subseteq> fst P\"\n      using assms F235_mkF24_rev_mono apply auto\n      by (smt fst_conv subset_eq F235_mkF24_rev_mono)\n\n    then have \"fst (sf25f (mkF24 P)) \\<subseteq> fst P\"\n      using fst_sf25f by auto\n\n    then show ?thesis .\n  qed\nqed\n\nlemma sf25f_mkF24_eq:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F5 P\" \"F6 P\" \n  shows \"sf25f (mkF24 P) = P\"\n  apply (rule refines_asym)\n   apply (simp add: assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) assms(7) sf25f_mkF24_refined)\n  using assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) assms(7) sf25f_mkF24_refines by blast\n\nlemma T0_mkFailuresF5_remTraceTick [simp]:\n  assumes \"T0 P\"\n  shows \"T0(mkFailuresF5 (fst P),remTraceTick`snd P)\"\n  using assms unfolding T0_def traces_def mkFailuresF5_def apply auto\n  using Tick_last_remTraceTick by blast\n                   \ndefinition mkF5_weak_failure where \"mkF5_weak_failure P == {(t,X). (t = [] \\<or> last t \\<noteq> tick) \\<and> (t,X) \\<in> P \\<and> (t,X\\<union>{tick}) \\<in> P}\"\n\ndefinition mkF5_weak :: \"'a process \\<Rightarrow> 'a process\"\n  where \"mkF5_weak P = (mkF5_weak_failure (fst P), snd P)\"\n\nlemma F5_mkF5_weak[simp]:\n  shows \"F5 (mkF5_weak P)\"\n  unfolding mkF5_weak_def F5_def mkF5_weak_failure_def by auto\n\nlemma T0_mkF5_weak_failure [simp]:\n  assumes \"T0 P\"\n  shows \"T0 (mkF5_weak_failure (fst P), snd P)\"\n  using assms unfolding T0_def traces_def by auto\n\nlemma T1_mkF5_weak_failure [simp]:\n  assumes \"T1 P\"\n  shows \"T1 (mkF5_weak_failure (fst P), snd P)\"\n  using assms unfolding T1_def traces_def by auto\n\nlemma T2_mkF5_weak_failure [simp]:\n  assumes \"T2 P\"\n  shows \"T2 (mkF5_weak_failure (fst P), snd P)\"\n  using assms unfolding T2_def traces_def mkF5_weak_failure_def by auto\n\nlemma F2_mkF5_weak_failure [simp]:\n  assumes \"F2 P\" \n  shows \"F2 (mkF5_weak_failure (fst P), snd P)\"\n  using assms unfolding F2_def traces_def mkF5_weak_failure_def apply auto\n  by blast+\n\nlemma F3_mkF5_weak_failure [simp]:\n  assumes \"F3 P\" \n  shows \"F3 (mkF5_weak_failure (fst P), snd P)\"\n  using assms unfolding F3_def traces_def mkF5_weak_failure_def apply auto\n  proof -\n    fix X :: \"'a evt set\" and Y :: \"'a evt set\"\n  assume a1: \"\\<forall>s X Y. (s, X) \\<in> fst P \\<and> Y \\<inter> {x. s @ [x] \\<in> snd P} = {} \\<longrightarrow> (s, X \\<union> Y) \\<in> fst P\"\n    assume a2: \"([], insert tick X) \\<in> fst P\"\n    assume \"Y \\<inter> {x. [x] \\<in> snd P} = {}\"\n    then have \"Y \\<inter> {e. [] @ [e] \\<in> snd P} \\<subseteq> {}\"\n  by simp\n    then have \"([], insert tick X \\<union> Y) \\<in> fst P\"\n      using a2 a1 by blast\n    then show \"([], insert tick (X \\<union> Y)) \\<in> fst P\"\n  by force\nnext\n  fix X Y :: \"'a evt set\" and s :: \"'a trace\"\n  assume as:\"\\<forall>s X Y. (s, X) \\<in> fst P \\<and> Y \\<inter> {x. s @ [x] \\<in> snd P} = {} \\<longrightarrow> (s, X \\<union> Y) \\<in> fst P\"\n  and as1:\"(s, X) \\<in> fst P\"\n  and as2:\"(s, insert tick X) \\<in> fst P\"\n  and as3:\"Y \\<inter> {x. s @ [x] \\<in> snd P} = {}\"\n  and as4:\"last s \\<noteq> tick\"\n  show \"(s, insert tick (X \\<union> Y)) \\<in> fst P\"\n    using as as1 as2 as3 as4 by (metis Un_insert_left)\nqed\n\nlemma F5_mkF5_weak_failure [simp]:\n  shows \"F5 (mkF5_weak_failure (fst P), snd P)\"\n  unfolding F5_def traces_def mkF5_weak_failure_def by auto\n\nlemma F6_mkF5_weak_failure [simp]:\n  shows \"F6 (mkF5_weak_failure (fst P), snd P)\"\n  unfolding F6_def traces_def mkF5_weak_failure_def by auto\n\nlemma mkF24_mkF5_weak_failure:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\"\n  shows \"P \\<sqsubseteq> mkF24 (mkF5_weak_failure (fst P), snd P)\"\n  using assms unfolding refines_def mkF24_def mkF5_weak_failure_def traces_def apply auto\n   apply (metis F2_def F4_def insert_subset traces_def)\n  by (metis F2_def F4_def insert_subset subset_UNIV traces_def)\n\nlemma UNIV_tick:\n  assumes \"(a,b) \\<in> fst P\" \"\\<not> b \\<subseteq> UNIV-{tick}\"\n  shows \"(a,b\\<union>{tick}) \\<in> fst P\"\n  using assms insert_absorb by fastforce\n\nlemma no_tick_then_refuse:\n  assumes \"F3 P\" \"(s,b) \\<in> fst P\" \"s @ [tick] \\<notin> snd P\"\n  shows \"(s,b\\<union>{tick}) \\<in> fst P\"\n  by (metis (no_types, lifting) F3_def Int_emptyI assms mem_Collect_eq singletonD traces_def)\n\nlemma mkF24_sf25f_refined:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\" \n  shows \"mkF24 (sf25f P) \\<sqsubseteq> P\"\nproof (rule refines_rule)\n  show \"snd P \\<subseteq> snd (mkF24 (sf25f P))\"\n    by (metis assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) order_refl traces_def traces_eq_traces_mkF24 traces_sf25f_eq)\n\n  show \"fst P \\<subseteq> fst (mkF24 (sf25f P))\"\n  proof -\n    have A:\"fst (mkF24 (sf25f P)) = {y. \\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> (mkF24 Q) \\<and> y \\<in> fst (mkF24 Q)}\"\n    proof -\n      have \"fst (mkF24 (sf25f P)) = fst (mkF24 (\\<Sqinter>{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> (mkF24 Q)}))\"\n        unfolding sf25f_def by auto\n      also have \"... = fst (\\<Sqinter>(mkF24`{Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> (mkF24 Q)}))\"\n        unfolding IntChoice_def mkF24_def traces_def refines_def apply auto\n        by blast+\n      also have \"... = fst (\\<Sqinter>({y. \\<exists>x. x \\<in> {Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> (mkF24 Q)} \\<and> y = mkF24 x}))\"\n        unfolding IntChoice_def traces_def refines_def by auto\n      also have \"... = \\<Union>({y. \\<exists>x. x \\<in> {Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> (mkF24 Q)} \\<and> y = fst (mkF24 x)})\"\n        unfolding IntChoice_def traces_def refines_def \n        apply auto \n        by blast\n      also have \"... = \\<Union>({y. \\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> (mkF24 Q) \\<and> y = fst (mkF24 Q)})\"\n        by auto\n      also have \"... = {y. \\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> (mkF24 Q) \\<and> y \\<in> fst (mkF24 Q)}\"\n        by auto\n      finally show ?thesis .\n    qed\n\n    have B:\"fst P \\<subseteq> {y. \\<exists>Q. T0 Q \\<and> T1 Q \\<and> T2 Q \\<and> F2 Q \\<and> F3 Q \\<and> F5 Q \\<and> F6 Q \\<and> P \\<sqsubseteq> (mkF24 Q) \\<and> y \\<in> fst (mkF24 Q)}\"\n      apply auto\n      using assms\n      apply (rule_tac x=\"mkF5_weak_failure (fst P)\" in exI)\n      apply (rule exI[where x=\"snd P\"])\n      apply auto\n      apply (simp add:mkF24_mkF5_weak_failure)\n      unfolding mkF24_def mkF5_weak_failure_def traces_def apply auto\n      apply (metis (full_types) T2_def append_butlast_last_id traces_def)\n      using UNIV_tick no_tick_then_refuse\n      by (metis Un_empty_right Un_insert_right) \n\n    have \"fst P \\<subseteq> fst (mkF24 (sf25f P))\"\n      using A B by auto\n    then show ?thesis .\n  qed\nqed\n\nlemma mkF24_sf25f_eq:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\" \n  shows \"mkF24 (sf25f P) = P\"\n  by (simp add: assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) mkF24_sf25f_refined mkF24_sf25f_refines refines_asym)\n\nlemma mkF24_sf2f_refines:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\" \n  shows \"P \\<sqsubseteq> mkF24 (sf2f P)\"\nproof (rule refines_rule)\n  show \"snd (mkF24 (sf2f P)) \\<subseteq> snd P\"\n    by (metis assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) order_refl traces_def traces_eq_traces_mkF24 traces_sf2f_eq)\n\n show \"fst (mkF24 (sf2f P)) \\<subseteq> fst P\"\n   by (smt IntChoice_def SUP_least UN_I UnCI Un_absorb2 assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) case_prodI2 case_prod_conv fst_conv mem_Collect_eq mkF24_def mkF24_fixpoint_imp refines_def refines_refl sf2f_def subset_iff surjective_pairing traces_def traces_eq_traces_mkF24 traces_sf2f_eq)\nqed\n\ntext \\<open> Therefore, our model of failures is just as expressive as stable failures. \\<close>\n\nlemma mkF24_sf2f_eq:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F4 P\" \n  shows \"mkF24 (sf2f P) = P\"\n  by (simp add: assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) mkF24_sf2f_refined mkF24_sf2f_refines refines_asym)\n\nlemma mkF25_unmkF25_refined:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F5 P\"\n  shows \"mkF25 (unmkF25 P) \\<sqsubseteq> P\"\nproof (rule refines_rule)\n  show \"fst P \\<subseteq> fst (mkF25 (unmkF25 P))\"\n    unfolding mkF25_def unmkF25_def IntChoice_def refines_def apply auto\n    proof -\n      fix a :: \"'a evt list\" and b :: \"'a evt set\"\n      assume a1: \"(a, b) \\<in> fst P\"\n      assume a2: \"\\<forall>aa ba. ba \\<subseteq> snd P \\<longrightarrow> {(t, X). \\<exists>Y. (t, Y) \\<in> aa \\<and> X \\<subseteq> insert tick Y} \\<subseteq> fst P \\<longrightarrow> aa \\<subseteq> fst P \\<longrightarrow> F3 (aa, ba) \\<longrightarrow> F2 (aa, ba) \\<longrightarrow> T2 (aa, ba) \\<longrightarrow> T1 (aa, ba) \\<longrightarrow> T0 (aa, ba) \\<longrightarrow> (a, b) \\<notin> aa\"\n      have f3: \"F3 (fst P, snd P)\"\n        by (metis assms(5) prod.collapse)\n      have f4: \"F2 (fst P, snd P)\"\n        by (metis assms(4) prod.collapse)\n      have f5: \"T2 (fst P, snd P)\"\n        by (simp add: assms(3))\n      have f6: \"T1 (fst P, snd P)\"\n        using assms(2) by fastforce\n      have f7: \"T0 (fst P, snd P)\"\n        by (simp add: assms(1))\n      have \"{(es, E). \\<exists>Ea. (es, Ea) \\<in> fst P \\<and> E \\<subseteq> insert tick Ea} \\<subseteq> fst P\"\n        using F5_F2_imp_tick_failures assms(4) assms(6) by blast\n      then show \"\\<exists>Y. (\\<exists>aa b. T0 (aa, b) \\<and> T1 (aa, b) \\<and> T2 (aa, b) \\<and> F2 (aa, b) \\<and> F3 (aa, b) \\<and> aa \\<subseteq> fst P \\<and> {(t, X). \\<exists>Y. (t, Y) \\<in> aa \\<and> X \\<subseteq> insert tick Y} \\<subseteq> fst P \\<and> b \\<subseteq> snd P \\<and> (a, Y) \\<in> aa) \\<and> b \\<subseteq> insert tick Y\"\n        using f7 f6 f5 f4 f3 a2 a1 by (meson subsetI)\n    qed\n    \n  show \"snd P \\<subseteq> snd (mkF25 (unmkF25 P))\"\n      unfolding mkF25_def unmkF25_def IntChoice_def refines_def apply auto\n      by (metis (mono_tags) F5_F2_imp_tick_failures assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) subset_refl surjective_pairing)\n  qed\n\nlemma mkF25_unmkF25_refines:\n  shows \"P \\<sqsubseteq> mkF25 (unmkF25 P)\"\nproof (rule refines_rule)\n  show \"fst (mkF25 (unmkF25 P)) \\<subseteq> fst P\"\n    unfolding mkF25_def unmkF25_def IntChoice_def refines_def by auto\n  show \"snd (mkF25 (unmkF25 P)) \\<subseteq> snd P\"\n    unfolding mkF25_def unmkF25_def IntChoice_def refines_def by auto\nqed\n\nlemma mkF25_unmkF25_eq:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\" \"F5 P\"\n  shows \"mkF25 (unmkF25 P) = P\"\n  by (simp add: assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) mkF25_unmkF25_refined mkF25_unmkF25_refines refines_asym)\n\nlemma unmkF25_mkF25_refined:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\"\n  shows \"unmkF25 (mkF25 P) \\<sqsubseteq> P\"\nproof (rule refines_rule)\n  show \"fst P \\<subseteq> fst (unmkF25 (mkF25 P))\"\n    unfolding mkF25_def unmkF25_def IntChoice_def refines_def apply auto\n    proof -\n      fix a :: \"'a evt list\" and b :: \"'a evt set\"\n      assume \"(a, b) \\<in> fst P\"\n      then have \"\\<exists>Pa. F3 (Pa, snd P) \\<and> F2 (Pa, snd P) \\<and> T2 (Pa, snd P) \\<and> T1 (Pa, snd P) \\<and> T0 (Pa, snd P) \\<and> (a, b) \\<in> Pa \\<and> Pa \\<subseteq> fst P \\<union> {(es, E). \\<exists>Ea. (es, Ea) \\<in> fst P \\<and> E \\<subseteq> insert tick Ea} \\<and> {(es, E). \\<exists>Ea. (es, Ea) \\<in> Pa \\<and> E \\<subseteq> insert tick Ea} \\<subseteq> fst P \\<union> {(es, E). \\<exists>Ea. (es, Ea) \\<in> fst P \\<and> E \\<subseteq> insert tick Ea}\"\n        using assms(1) assms(2) assms(3) assms(4) assms(5) by force\n      then show \"\\<exists>Pa E. T0 (Pa, E) \\<and> T1 (Pa, E) \\<and> T2 (Pa, E) \\<and> F2 (Pa, E) \\<and> F3 (Pa, E) \\<and> Pa \\<subseteq> fst P \\<union> {(es, E). \\<exists>Ea. (es, Ea) \\<in> fst P \\<and> E \\<subseteq> insert tick Ea} \\<and> {(es, E). \\<exists>Ea. (es, Ea) \\<in> Pa \\<and> E \\<subseteq> insert tick Ea} \\<subseteq> fst P \\<union> {(es, E). \\<exists>Ea. (es, Ea) \\<in> fst P \\<and> E \\<subseteq> insert tick Ea} \\<and> E \\<subseteq> snd P \\<and> (a, b) \\<in> Pa\"\n        by auto\n    qed\n\n  show \"snd P \\<subseteq> snd (unmkF25 (mkF25 P))\"\n    unfolding mkF25_def unmkF25_def IntChoice_def refines_def apply auto\n    proof -\n      fix x :: \"'a evt list\"\n      assume \"x \\<in> snd P\"\n      then have \"\\<exists>E. (((((x \\<in> E \\<and> E \\<subseteq> snd P) \\<and> T2 (fst P, E)) \\<and> T1 (fst P, E)) \\<and> T0 (fst P, E)) \\<and> F3 (fst P, E)) \\<and> F2 (fst P, E)\"\n        by (metis (full_types) assms(1) assms(2) assms(3) assms(4) assms(5) prod.collapse subset_refl)\n      then show \"\\<exists>Pa E. T0 (Pa, E) \\<and> T1 (Pa, E) \\<and> T2 (Pa, E) \\<and> F2 (Pa, E) \\<and> F3 (Pa, E) \\<and> Pa \\<subseteq> fst P \\<union> {(es, E). \\<exists>Ea. (es, Ea) \\<in> fst P \\<and> E \\<subseteq> insert tick Ea} \\<and> {(es, E). \\<exists>Ea. (es, Ea) \\<in> Pa \\<and> E \\<subseteq> insert tick Ea} \\<subseteq> fst P \\<union> {(es, E). \\<exists>Ea. (es, Ea) \\<in> fst P \\<and> E \\<subseteq> insert tick Ea} \\<and> E \\<subseteq> snd P \\<and> x \\<in> E\"\n        by blast\n    qed\n  qed\n\ntext \\<open> How about the other way around? \\<close>\n\nlemma \"fst (sf2f (mkF24 (({},{[],[tick]})))) = {}\"\n  unfolding sf2f_def mkF24_def traces_def IntChoice_def refines_def apply auto \n  apply (case_tac aa, auto)\n  oops\n\nlemma traces_sf2f_mkF24_eq:\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\"\n  shows \"traces (sf2f (mkF24 P)) = traces P\"\n  using assms \n  by (metis F2_mkF24 F3_mkF24 F4_mkF24 T0_def T1_mkF24 T2_mkF24 traces_eq_traces_mkF24 traces_sf2f_eq)\n\nlemma mkF24_traces_refines:\n  assumes \"(mkF24 P) \\<sqsubseteq> (mkF24 Q)\"\n  shows \"snd Q \\<subseteq> snd P\"\n  using assms unfolding mkF24_def traces_def apply auto\n  by (metis (no_types, lifting) in_mono refines_def snd_conv)\n\nlemma mkF24_dist_intChoice:\n  \"mkF24(P \\<sqinter> Q) = mkF24(P) \\<sqinter> mkF24(Q)\"\n  apply (rule refines_asym)\n  unfolding mkF24_def intChoice_def traces_def refines_def by auto\n\nlemma\n  assumes \"T0 P\" \"T1 P\" \"T2 P\" \"F2 P\" \"F3 P\"\n  shows \"sf2f(mkF24(P)) \\<sqsubseteq> P\"\nproof (rule refines_rule)\n  show \"snd P \\<subseteq> snd (sf2f (mkF24 P))\"\n    by (metis F2_mkF24 F3_mkF24 F4_mkF24 T0_def T1_mkF24 T2_mkF24 assms(1) assms(2) assms(3) assms(4) assms(5) eq_iff traces_def traces_eq_traces_mkF24 traces_sf2f_eq)\n\n  show \"fst P \\<subseteq> fst (sf2f (mkF24 P))\"\n    unfolding sf2f_def mkF24_def traces_def IntChoice_def apply auto\n    using assms(1) assms(2) assms(3) assms(4) assms(5) refines_refl by force\nqed\n\n(* Old below *)\n\ndefinition D1 :: \"'a process \\<Rightarrow> bool\"\n where \"D1 P \\<equiv> \\<forall>s t. s \\<in> (snd P) \\<longrightarrow> (s@t) \\<in> (snd P)\"\n \ndefinition D2 :: \"'a process \\<Rightarrow> bool\"\n where \"D2 P \\<equiv> \\<forall>s X. s \\<in> (snd P) \\<longrightarrow> (s, X) \\<in> (fst P)\"\n\ndefinition trace :: \"'a failure \\<Rightarrow> 'a trace\"\n where \"trace f = fst f\"\n\ndefinition fd2r :: \"('a failure) set \\<Rightarrow> ('a trace) set \\<Rightarrow> 'a prel\"\n where \"fd2r F D = { (s,s'). {the s,the s'} \\<subseteq> F \\<and> s \\<noteq> None \\<and> s' \\<noteq> None\n                             \\<and> (\\<exists>a. trace (the s') = (trace (the s) @ a))\n                             }\n                   \\<union> { (s,s'). trace (the s) \\<in> D \\<and> \n                               (s'=None \\<or> (\\<exists>a. trace (the s') = trace (the s) @ a)) } \\<union> { (None,None) }\"                               \n\ndefinition fdP2r :: \"'a process \\<Rightarrow> 'a prel\"\n where \"fdP2r P = fd2r (fst P) (snd P)\"\n                               \ndefinition divFailureStrict :: \"('a failure) set \\<Rightarrow> ('a trace) set \\<Rightarrow> ('a failure) set\"\n where \"divFailureStrict F D = F \\<union> {(s,X). s \\<in> D}\"\n \ndefinition divStrict :: \"('a trace) set \\<Rightarrow> ('a trace) set\"\n where \"divStrict D = D \\<union> {s'. \\<exists>s a. s' = s @ a \\<and> s \\<in> D}\"\n \ndefinition F2f :: \"('a failure) set \\<Rightarrow> bool\"\n where \"F2f F \\<equiv> \\<forall>s X Y. (s, X) \\<in> F \\<and> Y \\<subseteq> X \\<longrightarrow> (s, Y) \\<in> F\" \n \nsection {* Relational model*}\n\nsubsection {* Healthiness Conditions*}\n\ntext {* In a predicative style *}\n\ntext {* Prefix closure *} \n \ndefinition CR1H :: \"'a prel \\<Rightarrow> bool\"\n where \"CR1H R = (\\<forall>s s'. ((s,s') \\<in> R \\<and> s\\<noteq>None \\<and> s'\\<noteq>None) \\<longrightarrow> (\\<exists>t. trace (the s') = trace (the s) @ t))\"\n \ntext {* Divergence strictness*}\n\ndefinition CR2H :: \"'a prel \\<Rightarrow> bool\"\n where \"CR2H R = (\\<forall>s s'. ((s,None) \\<in> R \\<and> s \\<noteq> None \\<and> s' \\<noteq> None \n                  \\<and> trace (the s) = trace (the s')) \\<longrightarrow> (s',None) \\<in> R)\"\n                  \ntext {* None to None *}\n\ndefinition CR3H :: \"'a prel \\<Rightarrow> bool\"\n where \"CR3H R = (\\<forall>s. s \\<noteq> None \\<and> (None,s) \\<notin> R \\<and> (None,None) \\<in> R)\"\n \ntext {* Or in a fixed-point style *}\n\ndefinition R1H :: \"'a prel \\<Rightarrow> 'a prel\"\n where \"R1H R = { (s,s'). \\<exists>t.(s,s') \\<in> R \\<and> s \\<noteq> None \\<and> trace (the s') = trace (the s) @ t }\"\n\ndefinition R2H :: \"'a prel \\<Rightarrow> 'a prel\"\n where \"R2H R = { (s,s'). \\<exists>t. (s,None) \\<in> R \\<and> s \\<noteq> None \\<and> trace(the s') = trace (the s) @ t \\<or> (s,s') \\<in> R }\"\n \ndefinition R3H :: \"'a prel \\<Rightarrow> 'a prel\"\n where \"R3H R = R \\<union> {(None,None)}\"\n\nsubsection {* Linking from the relational model *}\n \ntext {* From a relation to a set of failures. *}\n\ndefinition r2f :: \"'a prel \\<Rightarrow> ('a failure) set\"\n where \"r2f R = { f. \\<exists>s s'. (s,s') \\<in> R \\<and> f = the s' \\<and> s \\<noteq> None \\<and> s' \\<noteq> None}\"\n \ntext {* From a relation to a set of divergences. *} \n \ndefinition r2d :: \"'a prel \\<Rightarrow> ('a trace) set\"\n where \"r2d R = { t. \\<exists>s. (s,None) \\<in> R \\<and> t = trace (the s) \\<and> s \\<noteq> None}\"\n \ntext {* From a relation to a CSP process. *} \n \ndefinition r2P :: \"'a prel \\<Rightarrow> 'a process\"\n where \"r2P R = (r2f R, r2d R)\"\n \nlemma \"CR1H(fd2r F D)\"\n apply (simp add:CR1H_def fd2r_def trace_def)\n by auto\n \nlemma \"CR2H(fd2r F D)\"\n apply (simp add:fd2r_def CR2H_def trace_def)\n by auto\n \nlemma\n assumes \"CR3H R\" \"CR2H R\" \"CR1H R\"\n shows \"fd2r (r2f R) (r2d R) = R\"\n using assms\n apply (simp add:CR3H_def CR2H_def CR1H_def r2f_def r2d_def fd2r_def trace_def)\n by blast\n \nlemma r2fd_is_F1:\n assumes \"CR3H R\" \"CR2H R\" \"CR1H R\"\n shows \"F1((r2f R),(r2d R))\"\n using assms unfolding CR1H_def CR2H_def CR3H_def\n by blast\n\nlemma r2fd_is_F2:\n assumes \"CR3H R\" \"CR2H R\" \"CR1H R\"\n shows \"F2((r2f R),(r2d R))\"\n using assms unfolding CR1H_def CR2H_def CR3H_def\n by blast\n\nlemma r2fd_is_F3:\n assumes \"CR3H R\" \"CR2H R\" \"CR1H R\"\n shows \"F3((r2f R),(r2d R))\"\n using assms unfolding CR1H_def CR2H_def CR3H_def\n by blast\n \nlemma r2fd_is_D1:\n assumes \"CR3H R\" \"CR2H R\" \"CR1H R\"\n shows \"D1((r2f R),(r2d R))\"\n using assms unfolding CR1H_def CR2H_def CR3H_def\n by blast\n \nlemma r2fd_is_D2:\n assumes \"CR3H R\" \"CR2H R\" \"CR1H R\"\n shows \"D2((r2f R),(r2d R))\"\n using assms unfolding CR1H_def CR2H_def CR3H_def\n by blast\n\nlemma r2f_fd2r:\nassumes \"divStrict D = D\" and \"divFailureStrict F D = F\"\nshows \"r2f (fd2r F D) = F\"\napply auto\napply (simp add:fd2r_def r2f_def trace_def)\napply auto\nusing assms unfolding divStrict_def divFailureStrict_def\napply (simp add:fd2r_def r2f_def)\napply blast\nusing assms unfolding divStrict_def divFailureStrict_def\napply (simp add:fd2r_def r2f_def)\nby (metis (no_types, lifting) append_Nil2 option.sel)\n\nlemma r2d_fd2r: \"r2d (fd2r F D) = D\"\napply auto \napply (simp add:fd2r_def r2d_def)\napply blast\napply (simp add:fd2r_def r2d_def)\nby (metis option.sel prod.sel(1) trace_def)\n\nlemma D1_is_divStrict:\n shows \"D1(P) = (divStrict (snd P) = (snd P))\"\n apply (simp add:divStrict_def D1_def)\n by blast\n \nlemma D2_is_divFailureStrict:\n shows \"D2(P) = (divFailureStrict (fst P) (snd P) = (fst P))\"\n apply (simp add:divFailureStrict_def D2_def)\n by blast\n\nlemma r2P_fdP2r:\n assumes \"D1(P)\" \"D2(P)\"\n shows \"r2P (fdP2r P) = P\"\n apply (simp add:r2P_def fdP2r_def)\n using assms\n by (simp add: D1_is_divStrict D2_is_divFailureStrict r2d_fd2r r2f_fd2r)\n\nlemma fdP2r_r2P:\n assumes \"CR3H R\"\n shows \"fdP2r (r2P R) = R\"\n using CR3H_def and assms by blast\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/Failures/Failures.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300449389326, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.3157118276857529}}
{"text": "(*\n * Copyright (c) 2020, CleanQ Project - Systems Group, ETH Zurich\n * All rights reserved.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n *\n * See \"LICENSE\" for details.\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n\n\nsection \\<open>CleanQ Abstract Ring Buffer Model\\<close>\n\ntext \\<open>\n  The second refinement is from unbounded lists to bounded buffer rings for transferring\n  ownership between two agents. As a consequence, the \\verb+enqueue+ operation may fail, \n  because there is no more space in the ring buffer. \n\\<close>\n\ntheory CleanQ_RBModel \n(*<*) \n  imports Main \n    CleanQ_ListModel\n    CleanQ_RB\n(*>*)  \nbegin\n\n(* ==================================================================================== *)\nsubsection \\<open>CleanQ Abstract Ring Buffer Model State\\<close>\n(* ==================================================================================== *)\n\ntext \\<open>\n  We take the state of the CleanQ list model and refine it to use a bounded, circular\n  buffer instead of the lists as transfer sets between the two agents. Again, there is\n  one queue (ring buffer) going from $X$ to $Y$ and another one, for the opposit\n  direction. Expressing the buffers owned by $X$ and $Y$ remain the same. \n\n  \\<^item> rSX: this is the set of buffers owned by X.\n  \\<^item> rSY: this is the set of buffers owned by Y.\n  \\<^item> rTXY: this is a descriptor ring of buffers in transfer from X to Y.\n  \\<^item> rTYX: this is a descriptor ring of buffers in transfer from Y to X.\n\\<close>\n\n\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>System State\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\n\ntext \\<open>\n  We now define the updated system state using \\verb+Cleanq_RB+  for the transfer sets\n  between $X$ and $Y$. \n \\<close>\n\nrecord 'a CleanQ_RB_State =\n  rSX  :: \"'a set\"\n  rSY  :: \"'a set\"\n  rTXY :: \"'a CleanQ_RB\"\n  rTYX :: \"'a CleanQ_RB\"\n\n\ntext \\<open>\n  Like the abstract list model,  we do not specify the representation of the buffer \n  elements. This can be a single, fixed-sized page frame, a variable-sized base-limit \n  segment, or a set of memory locations. \n\\<close>\n\n\n(*<*)\n(* Define some global variables to make Simpl/Complex proofs work *)\nrecord 'g CleanQ_RB_State_vars = \n  RingRB_'  :: \"nat CleanQ_RB_State\"\n(*>*)\n\n\n(* ==================================================================================== *)\nsubsection \\<open>State Lifting Function\\<close>\n(* ==================================================================================== *)\n\ntext \\<open>\n  The CleanQ RB model is a data refinement of the CleanQ List Model. We can define an\n  interpretation function. That lifts the CleanQ RB model state into the CleanQ\n  list model state by extracting a list of buffers as a subset of the ringbuffer. \n  We first define a function to convert the ringbuffer representation in to a list, which\n  we use the \\verb+nonzero_modulus+ locale to produce a list of indices into the bounded\n  buffer ring and apply them to the \\verb+ring+ function of the ringbuffer.\n\\<close>\n\n\ntext \\<open>\n  Then we use this conversion int he state lifting from the RB model to the list model.\n\\<close>\n\ndefinition CleanQ_RB2List :: \"'a CleanQ_RB_State  \\<Rightarrow> 'a CleanQ_List_State\"\n  where \"CleanQ_RB2List l = \\<lparr> lSX = rSX l, lSY = rSY l, \n                               lTXY = CleanQ_RB_list (rTXY l), \n                               lTYX = CleanQ_RB_list (rTYX l) \\<rparr>\"\n\n\n\n(* ==================================================================================== *)\nsubsection \\<open>CleanQ RB Model Invariants\\<close>\n(* ==================================================================================== *)\n\ntext \\<open>\n  We now revisit the invariants of the CleanQ list model and specify additional invariants\n  for the CleanQ Ring Buffer model. \n\\<close>\n\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>I1: Constant Union (Image)\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\<open>\n  The union of all sets is constant. We formulate this as an image for \n  \\verb+CleanQ_List+ where we take the set of the transfer lists and apply the \n  union.\n\\<close>\n\ndefinition I1_rb_img :: \"'a CleanQ_RB_State \\<Rightarrow> 'a set \\<Rightarrow> bool\"\n  where \"I1_rb_img rb K \\<longleftrightarrow> ((rSX rb) \\<union> (rSY rb) \n                                \\<union> set (CleanQ_RB_list (rTXY rb)) \n                                \\<union> set (CleanQ_RB_list (rTYX rb))) = K\"\n\ntext \\<open>\n  We can show that the image of the invariant satisfies the list invariant I1 when\n  we apply the lifting function \\verb+CleanQ_RB2List+ to the model state. We prove\n  this in the following lemma.\n\\<close>\n\nlemma I1_rb_img_lift:\n  \"I1_rb_img R K = I1_list_img (CleanQ_RB2List R) K\"\n  unfolding CleanQ_RB2List_def I1_rb_img_def I1_list_img_def  by(simp)\n\nlemma \"I1_rb_img R K = I1 (CleanQ_List2Set (CleanQ_RB2List R)) K\"\n  unfolding CleanQ_RB2List_def CleanQ_List2Set_def I1_rb_img_def I1_def by(simp)\n\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>I2: Pairwise Empty (Image)\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\<open>\n All pairwise intersections are empty. Again, we formulate this as an image for\n \\verb+CleanQ_RB+ by extracting the list of buffers from the ring.\n\\<close>\n\ndefinition I2_rb_img :: \"'a CleanQ_RB_State \\<Rightarrow> bool\"\n  where \"I2_rb_img rb \\<longleftrightarrow> rSX rb \\<inter> rSY rb = {} \n           \\<and> rSX rb \\<inter> set (CleanQ_RB_list (rTXY rb)) = {} \n           \\<and> rSX rb \\<inter> set (CleanQ_RB_list (rTYX rb)) = {} \n           \\<and> rSY rb \\<inter> set (CleanQ_RB_list (rTXY rb)) = {} \n           \\<and> rSY rb \\<inter> set (CleanQ_RB_list (rTYX rb)) = {} \n           \\<and> set (CleanQ_RB_list (rTXY rb)) \\<inter> set (CleanQ_RB_list (rTYX rb)) = {}\"\n\n\ntext \\<open>\n  Finally, we can show that the image of the Invariant I2 is equivalent to the list \n  version of this invariant, when we lift the CleanQ RB State to the CleanQ List State. \n  We prove this in the following lemma:\n\\<close>\n\nlemma I2_rb_img_lift:\n  \"I2_rb_img R = I2_list_img (CleanQ_RB2List R)\"\n  unfolding CleanQ_RB2List_def I2_rb_img_def I2_list_img_def by(simp)\n\n\nlemma \"I2_rb_img R = I2 (CleanQ_List2Set (CleanQ_RB2List R))\"\n  unfolding CleanQ_RB2List_def CleanQ_List2Set_def I2_rb_img_def I2_def by(simp)\n\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>I3: Distinct Transferlists\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\<open>\n  Next we provide an interpretation of the I3 invariant in the ring buffer representation. \n\\<close>\n\ndefinition I3_rb_img :: \"'a CleanQ_RB_State \\<Rightarrow> bool\"\n  where \"I3_rb_img st_list \\<longleftrightarrow> distinct (CleanQ_RB_list (rTXY st_list)) \n                             \\<and> distinct (CleanQ_RB_list (rTYX st_list))\"\n\n\nlemma I3_rb_img_lift:\n  \"I3_rb_img R = I3 (CleanQ_RB2List R)\"\n  unfolding CleanQ_RB2List_def I3_rb_img_def I3_def by(simp)\n\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>I4: Valid Ringbuffers\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\<open>\n  For well-defined outcomes, we need to have well-defined ringbuffers in the state. \n  We define this Invariant to be the conjunction of the \\verb+rb_valid+ predicates\n  for both ringbuffers in the state.\n\\<close>\n\ndefinition I4_rb_valid :: \"'a CleanQ_RB_State \\<Rightarrow> bool\"\n  where \"I4_rb_valid rb \\<longleftrightarrow> ((rb_valid (rTXY rb)) \\<and> (rb_valid (rTYX rb)))\"\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>Strong frame condition\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\<open>The strong frame condition fixed the full state except for the part which should\n      change. \\<close>\ndefinition frame_rb_strong :: \"'a CleanQ_RB_State \\<Rightarrow> 'a CleanQ_RB_State \\<Rightarrow> bool\"\n  where \"frame_rb_strong rb' rb \\<longleftrightarrow> rb' = rb \\<and> I4_rb_valid rb\"\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>All CleanQ RB Invariants\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\<open>\n  We combine all invariants for the abstract CleanQ RB model and define the unified \n  predicate \\verb+CleanQ_RB_Invariants+.\n\\<close>\n\ndefinition CleanQ_RB_Invariants :: \"'a set \\<Rightarrow> 'a CleanQ_RB_State \\<Rightarrow> bool\"\n  where \"CleanQ_RB_Invariants K rb \\<longleftrightarrow> I1_rb_img rb K \\<and> I2_rb_img rb \\<and> I3_rb_img rb\n                                       \\<and> I4_rb_valid rb\"\n\ntext \\<open>\n  Finally, we can show that when the CleanQ RB invariants are satisfied, this also\n  satisfies the set invariants.\n\\<close>\n\nlemma CleanQ_RB_Invariants_List_Invariants:\n  \"CleanQ_RB_Invariants K L \\<Longrightarrow> CleanQ_List_Invariants K (CleanQ_RB2List L)\"\n  by (simp add: CleanQ_List_Invariants_def CleanQ_RB_Invariants_def I1_rb_img_lift \n                I2_rb_img_lift I3_rb_img_lift)\n\n\nlemmas CleanQ_RB_Invariants_simp = I4_rb_valid_def I1_rb_img_def  I2_rb_img_def\n                                   I3_rb_img_def CleanQ_RB_Invariants_def\n  \n\n\n(* ==================================================================================== *)\nsubsection \\<open>State Transition Operations\\<close>\n(* ==================================================================================== *)\n\ntext \\<open>\n  We now formulate the state transition operations in terms of the CleanQ RB model\n  state. Again, the two agents can, independently from each other, perform one of \n  two operations, \\verb+enqueue+ and \\verb+dequeue+,  which trigger an ownership \n  transfer of buffer elements.  \n\\<close>\n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>Enqueue Operation\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\<open>\n  The \\verb+enqueue+ operation is analogous to the List operations except that the elements\n  are written into a slot in the descriptor ring and then the pointers adapted accordingly. \n\\<close>\n\ndefinition CleanQ_RB_enq_x :: \"'a \\<Rightarrow> 'a CleanQ_RB_State  \\<Rightarrow> 'a CleanQ_RB_State\"\n  where \"CleanQ_RB_enq_x b rb = rb \\<lparr> rSX := (rSX rb) - {b}, rTXY := rb_enq b (rTXY rb) \\<rparr>\"\n\n\ndefinition CleanQ_RB_enq_y :: \"'a \\<Rightarrow> 'a CleanQ_RB_State  \\<Rightarrow> 'a CleanQ_RB_State\"\n  where \"CleanQ_RB_enq_y b rb = rb \\<lparr> rSY := (rSY rb) - {b}, rTYX := rb_enq b (rTYX rb) \\<rparr>\"\n\ntext \\<open>\n  The enqueue operation cannot proceed if there is no space in the corresponding ring\n  buffer.\n\\<close>\n\ndefinition CleanQ_RB_enq_x_possible :: \"'a CleanQ_RB_State \\<Rightarrow> bool\"\n  where \"CleanQ_RB_enq_x_possible rb \\<longleftrightarrow> rb_can_enq (rTXY rb)\"\n\ndefinition CleanQ_RB_enq_y_possible :: \"'a CleanQ_RB_State \\<Rightarrow> bool\"\n  where \"CleanQ_RB_enq_y_possible rb \\<longleftrightarrow> rb_can_enq (rTYX rb)\"\n\n\ntext \\<open>\n  Next we can show that if we can enqueue something into the bounded ring buffer, \n  the system behaves exactly like the list model, by showing the commutative \n  of the lifting function and the enqueue operation.\n\\<close>\n\nlemma CleanQ_RB_enq_x_equal :\n  assumes can_enq: \"CleanQ_RB_enq_x_possible rb\" \n      and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"CleanQ_RB2List (CleanQ_RB_enq_x b rb) = CleanQ_List_enq_x b (CleanQ_RB2List rb)\"  \n  unfolding CleanQ_RB2List_def CleanQ_List_enq_x_def CleanQ_RB_enq_x_def\n  using can_enq invariants  CleanQ_RB_enq_x_possible_def rb_enq_list_add\n  by (auto simp add: CleanQ_RB_enq_x_possible_def rb_enq_list_add CleanQ_RB_Invariants_simp)\n\nlemma CleanQ_RB_enq_y_equal :\n  assumes can_enq: \"CleanQ_RB_enq_y_possible rb\" \n      and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"CleanQ_RB2List (CleanQ_RB_enq_y b rb) = CleanQ_List_enq_y b (CleanQ_RB2List rb)\"  \n  unfolding CleanQ_RB2List_def CleanQ_List_enq_y_def CleanQ_RB_enq_y_def\n  using can_enq invariants \n  by (simp add: CleanQ_RB_enq_y_possible_def rb_enq_list_add CleanQ_RB_Invariants_simp)\n\n\ntext \\<open>\n  We can now show where the buffer \\verb+b+ ends up precisely, when we enqueue it into\n  the ring buffer. A pre-requisit here, is that the buffer is owned by the agent, and\n  that there is space to enqueue the buffer. We do this for X and Y separately.\n\\<close>\n\nlemma CleanQ_RB_enq_x_result :\n  assumes X_owned: \"b \\<in> rSX rb\"  and  X_enq: \"rb' = CleanQ_RB_enq_x b rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"  \n    and can_enq:  \"CleanQ_RB_enq_x_possible rb\" \n  shows  \"b \\<notin> rSX rb' \\<and> b \\<notin> rSY rb' \\<and> b \\<notin> set (CleanQ_RB_list (rTYX rb')) \\<and>\n          b \\<in> set (CleanQ_RB_list (rTXY rb'))\"\nproof -\n  from can_enq invariants X_enq have X1:\n    \"b \\<notin> rSX rb'\"\n    unfolding CleanQ_RB_enq_x_def by(simp)\n    \n  from can_enq invariants X_enq have X2:\n    \"b \\<notin> rSY rb'\"\n    using invariants X_owned unfolding CleanQ_RB_enq_x_def\n    using CleanQ_RB_Invariants_def I2_rb_img_def by fastforce\n\n  from can_enq invariants X_enq have X3:\n    \" b \\<notin> set (CleanQ_RB_list (rTYX rb'))\"\n    using invariants X_owned unfolding CleanQ_RB_enq_x_def\n    using CleanQ_RB_Invariants_def I2_rb_img_def by fastforce\n\n    have X4:\n    \"b \\<in> set (CleanQ_RB_list (rTXY rb'))\"\n     apply (subst X_enq)\n      apply (simp add:CleanQ_RB_enq_x_def)\n      using CleanQ_RB_enq_x_possible_def can_enq invariants rb_enq_list_add \n      by (simp add: CleanQ_RB_enq_x_possible_def rb_enq_list_add CleanQ_RB_Invariants_def\n                    I4_rb_valid_def)\n          \n  show ?thesis\n    using X1 X2 X3 X4  by(auto)\nqed \n\n\nlemma CleanQ_RB_enq_y_result :\n  assumes Y_owned: \"b \\<in> rSY rb\"  and  Y_enq: \"rb' = CleanQ_RB_enq_y b rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"  \n    and can_enq:  \"CleanQ_RB_enq_y_possible rb\" \n  shows  \"b \\<notin> rSX rb' \\<and> b \\<notin> rSY rb' \\<and> b \\<notin> set (CleanQ_RB_list (rTXY rb')) \\<and>\n          b \\<in> set (CleanQ_RB_list (rTYX rb'))\"\nproof -\n  from can_enq invariants Y_enq have X1:\n    \"b \\<notin> rSY rb'\"\n    unfolding CleanQ_RB_enq_y_def by(simp)\n    \n  from can_enq invariants Y_enq have X2:\n    \"b \\<notin> rSX rb'\"\n    using invariants Y_owned unfolding CleanQ_RB_enq_y_def \n    using CleanQ_RB_Invariants_def I2_rb_img_def by fastforce\n\n  from can_enq invariants Y_enq have X3:\n    \" b \\<notin> set (CleanQ_RB_list (rTXY rb'))\"\n    using invariants Y_owned unfolding CleanQ_RB_enq_y_def\n    using CleanQ_RB_Invariants_def I2_rb_img_def by fastforce\n\n  have X4:\n    \"b \\<in> set (CleanQ_RB_list (rTYX rb'))\"\n     apply (subst Y_enq)\n      apply (simp add:CleanQ_RB_enq_y_def)\n    using CleanQ_RB_enq_y_possible_def can_enq invariants rb_enq_list_add\n      by (simp add: CleanQ_RB_enq_y_possible_def rb_enq_list_add CleanQ_RB_Invariants_def\n                    I4_rb_valid_def)\n          \n  show ?thesis\n    using X1 X2 X3 X4 X4 by(auto)\nqed \n\ntext \\<open>\n  The two operations \\verb+CleanQ_RB_enq_x+ and \\verb+CleanQ_RB_enq_y+ transition\n  the model state. Thus we need to prove that all invariants are preserved. We do this\n  Individually first, then do the union. Note, the proofs are symmetric. \n\\<close>\n\nlemma CleanQ_RB_enq_x_I1 :\n  fixes b\n  assumes Inv: \"CleanQ_RB_Invariants K rb\"  and  X_owned: \"b \\<in> rSX rb\" and\n          can_enq: \"CleanQ_RB_enq_x_possible rb\" and\n          X_enq: \"rb' = CleanQ_RB_enq_x b rb\"\n    shows \"I1_rb_img (rb') K\"\n  unfolding CleanQ_RB_enq_x_def \n  using Inv X_owned can_enq\n  by (metis CleanQ_List_State.select_convs(1) CleanQ_List_enq_x_I1 CleanQ_RB2List_def \n      CleanQ_RB_Invariants_simp CleanQ_RB_enq_x_equal I1_rb_img_lift X_enq)\n\nlemma CleanQ_RB_enq_y_I1 :\n  fixes b\n  assumes Inv: \"CleanQ_RB_Invariants K rb\"  and  Y_owned: \"b \\<in> rSY rb\" and\n          can_enq: \"CleanQ_RB_enq_y_possible rb\" and\n          Y_enq: \"rb' = CleanQ_RB_enq_y b rb\"\n    shows \"I1_rb_img (rb') K\"\n  unfolding CleanQ_RB_enq_y_def \n  by (metis CleanQ_RB_Invariants_simp CleanQ_List_State.select_convs(2) CleanQ_List_enq_y_I1 \n      CleanQ_RB2List_def CleanQ_RB_Invariants_List_Invariants CleanQ_RB_enq_y_equal I1_rb_img_lift Inv Y_enq Y_owned can_enq)\n\nlemma CleanQ_RB_enq_x_I2 :\n  assumes Inv: \"CleanQ_RB_Invariants K rb\"  and  X_owned: \"b \\<in> rSX rb\" and\n          X_enq: \"rb' = CleanQ_RB_enq_x b rb\" and\n          can_enq: \"CleanQ_RB_enq_x_possible rb\"\n    shows \"I2_rb_img (rb')\"\n  unfolding CleanQ_RB_enq_x_def\n  by (metis CleanQ_List_State.select_convs(1) CleanQ_List_enq_x_I2 CleanQ_RB2List_def \n     CleanQ_RB_Invariants_simp CleanQ_RB_enq_x_equal I2_rb_img_lift Inv X_enq X_owned can_enq)\n\nlemma CleanQ_RB_enq_y_I2 :\n  assumes Inv: \"CleanQ_RB_Invariants K rb\"  and  Y_owned: \"b \\<in> rSY rb\" and\n          Y_enq: \"rb' = CleanQ_RB_enq_y b rb\" and\n          can_enq: \"CleanQ_RB_enq_y_possible rb\"\n    shows \"I2_rb_img (rb')\"\n  unfolding CleanQ_RB_enq_y_def\n  by (metis CleanQ_RB_Invariants_simp CleanQ_List_State.select_convs(2) CleanQ_List_enq_y_I2 \n      CleanQ_RB2List_def CleanQ_RB_Invariants_List_Invariants CleanQ_RB_enq_y_equal I2_rb_img_lift Inv Y_enq Y_owned can_enq)\n\nlemma CleanQ_RB_enq_x_I3 :\n  fixes K rb rb'\n  assumes Inv: \"CleanQ_RB_Invariants K rb\"  and  X_owned: \"b \\<in> rSX rb\" and\n          X_enq: \"rb' = CleanQ_RB_enq_x b rb\" and\n          can_enq: \"CleanQ_RB_enq_x_possible rb\"\n  shows \"I3_rb_img (rb')\"\n  using can_enq X_enq Inv\nproof(auto simp:I3_rb_img_def)\n  from Inv X_owned have b_before: \"b \\<notin> set (CleanQ_RB_list (rTXY rb))\" \n    by (auto simp:CleanQ_RB_Invariants_simp)\n  from X_owned Inv X_enq can_enq CleanQ_RB_enq_x_result have b_after: \"b \\<in> set (CleanQ_RB_list (rTXY rb'))\"\n    by metis\n  from Inv b_before b_after have dist_before: \"distinct (CleanQ_RB_list (rTXY rb))\"  \n    by (simp add:CleanQ_RB_Invariants_simp)\n  from b_after dist_before have dist_after: \"distinct (CleanQ_RB_list (rTXY rb) @ [b])\"\n    by (simp add: b_before)\n  from can_enq Inv rb_enq_list_add have final: \"CleanQ_RB_list (rTXY rb) @ [b] = CleanQ_RB_list (rb_enq b (rTXY rb))\"\n    by (simp add: rb_enq_list_add CleanQ_RB_enq_x_possible_def CleanQ_RB_Invariants_simp)\n\n  show first: \"distinct (CleanQ_RB_list (rTXY (CleanQ_RB_enq_x b rb)))\" \n     using Inv X_enq can_enq X_owned dist_after final rb_enq_list_add\n    unfolding CleanQ_RB_enq_x_def\n    by simp\n\n  from CleanQ_RB_enq_x_result CleanQ_RB_enq_x_def X_enq have no_change: \"rTYX rb = rTYX rb'\"\n    by (simp add: CleanQ_RB_enq_x_def)\n  show \"distinct (CleanQ_RB_list (rTYX (CleanQ_RB_enq_x b rb)))\" using no_change\n    using Inv X_enq    by (auto simp:CleanQ_RB_Invariants_simp)\nqed\n\nlemma CleanQ_RB_enq_y_I3 :\n  fixes K rb rb'\n  assumes Inv: \"CleanQ_RB_Invariants K rb\"  and  Y_owned: \"b \\<in> rSY rb\" and\n          Y_enq: \"rb' = CleanQ_RB_enq_y b rb\" and\n          can_enq: \"CleanQ_RB_enq_y_possible rb\"\n  shows \"I3_rb_img (rb')\"\n  using can_enq Y_enq Inv\nproof(auto simp:I3_rb_img_def)\n  from Inv Y_owned have b_before: \"b \\<notin> set (CleanQ_RB_list (rTYX rb))\"\n     by (auto simp:CleanQ_RB_Invariants_simp)\n  from Y_owned Inv Y_enq can_enq CleanQ_RB_enq_y_result have b_after: \"b \\<in> set (CleanQ_RB_list (rTYX rb'))\"\n    by metis\n  from Inv b_before b_after have dist_before: \"distinct (CleanQ_RB_list (rTYX rb))\"  \n     by (auto simp:CleanQ_RB_Invariants_simp)\n  from b_after dist_before have dist_after: \"distinct (CleanQ_RB_list (rTYX rb) @ [b])\"\n    by (simp add: b_before)\n  from can_enq Inv rb_enq_list_add have final: \"CleanQ_RB_list (rTYX rb) @ [b] = CleanQ_RB_list (rb_enq b (rTYX rb))\"\n    by (simp add: rb_enq_list_add CleanQ_RB_enq_y_possible_def CleanQ_RB_Invariants_simp)\n\n  show first: \"distinct (CleanQ_RB_list (rTYX (CleanQ_RB_enq_y b rb)))\" using Inv Y_enq can_enq Y_owned dist_after final rb_enq_list_add\n    unfolding CleanQ_RB_enq_y_def\n    by simp\n\n  from CleanQ_RB_enq_y_result CleanQ_RB_enq_y_def Y_enq have no_change: \"rTXY rb = rTXY rb'\"\n    by (simp add: CleanQ_RB_enq_y_def)\n  show \"distinct (CleanQ_RB_list (rTXY (CleanQ_RB_enq_y b rb)))\" using no_change\n    using Inv Y_enq  by (auto simp:CleanQ_RB_Invariants_simp)\n\nqed\n\nlemma CleanQ_RB_enq_x_I4 :\n assumes Inv: \"CleanQ_RB_Invariants K rb\"  and  X_owned: \"b \\<in> rSX rb\" and\n         X_enq: \"rb' = CleanQ_RB_enq_x b rb\" and  can_enq: \"CleanQ_RB_enq_x_possible rb\"\n  shows \"I4_rb_valid rb'\"\n  apply(subst X_enq)\n  using can_enq unfolding CleanQ_RB_enq_x_def CleanQ_RB_list_def CleanQ_RB_enq_x_possible_def\n  using Inv by(simp add:rb_enq_remains_valid CleanQ_RB_Invariants_simp)\n\n\nlemma CleanQ_RB_enq_y_I4 :\n assumes Inv: \"CleanQ_RB_Invariants K rb\"  and  X_owned: \"b \\<in> rSY rb\" and\n         Y_enq: \"rb' = CleanQ_RB_enq_y b rb\" and  can_enq: \"CleanQ_RB_enq_y_possible rb\"\n  shows \"I4_rb_valid rb'\"\n  apply(subst Y_enq)\n  using can_enq unfolding CleanQ_RB_enq_y_def CleanQ_RB_list_def CleanQ_RB_enq_y_possible_def\n  using Inv by(simp add:rb_enq_remains_valid CleanQ_RB_Invariants_simp)\n\nlemma CleanQ_RB_enq_y_inv_all :\n assumes Inv: \"CleanQ_RB_Invariants K rb\"  and  Y_owned: \"b \\<in> rSY rb\" and\n         Y_enq: \"rb' = CleanQ_RB_enq_y b rb\" and  can_enq: \"CleanQ_RB_enq_y_possible rb\"\n  shows \"CleanQ_RB_Invariants K rb'\"\n  apply(subst Y_enq)\n  using can_enq unfolding CleanQ_RB_enq_y_def CleanQ_RB_list_def CleanQ_RB_enq_y_possible_def\n  by (metis CleanQ_RB_Invariants_simp CleanQ_RB_enq_y_I1 CleanQ_RB_enq_y_I2 CleanQ_RB_enq_y_I3 \n      CleanQ_RB_enq_y_I4 CleanQ_RB_enq_y_def Inv Y_owned can_enq)\n\nlemma CleanQ_RB_enq_x_inv_all :\n assumes Inv: \"CleanQ_RB_Invariants K rb\"  and  X_owned: \"b \\<in> rSX rb\" and\n         X_enq: \"rb' = CleanQ_RB_enq_x b rb\" and  can_enq: \"CleanQ_RB_enq_x_possible rb\"\n       shows \"CleanQ_RB_Invariants K rb'\"\n  apply(subst X_enq)\n  using can_enq unfolding CleanQ_RB_enq_x_def CleanQ_RB_list_def CleanQ_RB_enq_x_possible_def\n  by (metis CleanQ_RB_Invariants_simp  CleanQ_RB_enq_x_I1 CleanQ_RB_enq_x_I2 \n      CleanQ_RB_enq_x_I3 CleanQ_RB_enq_x_I4 CleanQ_RB_enq_x_def Inv X_owned can_enq)\n\n\nlemma CleanQ_RB_enq_x_buf_in_SX[simp]:\n  \"bx \\<in> rSX (CleanQ_RB_enq_y b rb) \\<longleftrightarrow> bx \\<in> rSX rb\"\n  unfolding CleanQ_RB_enq_y_def by(simp)\n  \nlemma CleanQ_RB_enq_y_buf_in_SY[simp]:\n  \"by \\<in> rSY (CleanQ_RB_enq_x b rb) \\<longleftrightarrow> by \\<in> rSY rb\"\n  unfolding CleanQ_RB_enq_x_def by(simp) \n\nlemma CleanQ_RB_enq_x_buf_notin_SY[simp]:\n  \"bx \\<notin> rSX (CleanQ_RB_enq_y b rb) \\<longleftrightarrow> bx \\<notin> rSX rb\"\n  unfolding CleanQ_RB_enq_y_def by(simp)\n\nlemma CleanQ_RB_enq_y_buf_notin_SX[simp]:\n  \"by \\<notin> rSY (CleanQ_RB_enq_x b rb) \\<longleftrightarrow> by \\<notin> rSY rb\"\n  unfolding CleanQ_RB_enq_x_def by(simp) \n\n(* ------------------------------------------------------------------------------------ *)\nsubsubsection \\<open>Dequeue Operation\\<close>\n(* ------------------------------------------------------------------------------------ *)\n\ntext \\<open>\n  The \\verb+dequeue+ operation is analogous to the List operations except that the elements\n  are read from a slot in the descriptor ring and then the pointers adapted accordingly. \n\\<close>\n\ndefinition CleanQ_RB_deq_x :: \"'a CleanQ_RB_State  \\<Rightarrow> 'a CleanQ_RB_State\"\n  where \"CleanQ_RB_deq_x rb = (let (b, rest) = rb_deq(rTYX rb) in \n                                  rb \\<lparr> rSX := (rSX rb) \\<union> {b}, rTYX := rest \\<rparr>)\"\n\ndefinition CleanQ_RB_deq_y :: \"'a CleanQ_RB_State  \\<Rightarrow> 'a CleanQ_RB_State\"\n  where \"CleanQ_RB_deq_y rb = (let (b, rest) = rb_deq(rTXY rb) in \n                                  rb \\<lparr> rSY := (rSY rb) \\<union> {b}, rTXY := rest \\<rparr>)\"\n\n\ntext \\<open>\n  The deqeueu operation cannot proceed if there is no element in the corresponding ring\n  buffer.\n\\<close>\n\ndefinition CleanQ_RB_deq_x_possible :: \"'a CleanQ_RB_State \\<Rightarrow> bool\"\n  where \"CleanQ_RB_deq_x_possible rb \\<longleftrightarrow> rb_can_deq (rTYX rb)\"\n\ndefinition CleanQ_RB_deq_y_possible :: \"'a CleanQ_RB_State \\<Rightarrow> bool\"\n  where \"CleanQ_RB_deq_y_possible rb \\<longleftrightarrow> rb_can_deq (rTXY rb)\"\n\n\nlemma CleanQ_RB_deq_x_equal :\n  assumes can_deq: \"CleanQ_RB_deq_x_possible rb\" \n      and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"CleanQ_RB2List (CleanQ_RB_deq_x rb) = CleanQ_List_deq_x (CleanQ_RB2List rb)\"  \n  unfolding CleanQ_RB2List_def CleanQ_RB_deq_x_def CleanQ_List_deq_x_def \n  using can_deq invariants \n  by (simp add: CleanQ_RB_deq_x_possible_def prod.case_eq_if rb_deq_list_tail \n                rb_deq_list_was_head rb_valid_def CleanQ_RB_Invariants_simp)\n\nlemma CleanQ_RB_deq_y_equal :\n  assumes can_deq: \"CleanQ_RB_deq_y_possible rb\" \n      and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"CleanQ_RB2List (CleanQ_RB_deq_y rb) = CleanQ_List_deq_y (CleanQ_RB2List rb)\"  \n  unfolding CleanQ_RB2List_def CleanQ_RB_deq_y_def CleanQ_List_deq_y_def \n  using can_deq invariants\n  by (simp add: CleanQ_RB_deq_y_possible_def prod.case_eq_if rb_deq_list_tail \n                rb_deq_list_was_head rb_valid_def CleanQ_RB_Invariants_simp)\n\nlemma CleanQ_RB_deq_x_no_change [simp]:\n    assumes can_deq: \"CleanQ_RB_deq_x_possible rb\"  and  X_deq: \"rb' = CleanQ_RB_deq_x rb\"\n  shows \"rSY rb' = rSY rb \\<and> rTXY rb' = rTXY rb\"\n  using can_deq X_deq unfolding CleanQ_RB_deq_x_def by (simp add: prod.case_eq_if)\n\nlemma CleanQ_RB_deq_x_buf_in_SY[simp]:\n  \"by \\<in> rSY (CleanQ_RB_deq_x rb) \\<longleftrightarrow> by \\<in> rSY rb\"\n  unfolding CleanQ_RB_deq_x_def by (simp add: prod.case_eq_if)\n  \nlemma CleanQ_RB_deq_y_buf_in_SX[simp]:\n  \"bx \\<in> rSX (CleanQ_RB_deq_y rb) \\<longleftrightarrow> bx \\<in> rSX rb\"\n  unfolding CleanQ_RB_deq_y_def by (simp add: prod.case_eq_if) \n\nlemma CleanQ_RB_deq_x_buf_notin_SY[simp]:\n  \"by \\<notin> rSY (CleanQ_RB_deq_x rb) \\<longleftrightarrow> by \\<notin> rSY rb\"\n  unfolding CleanQ_RB_deq_x_def by (simp add: prod.case_eq_if)\n  \nlemma CleanQ_RB_deq_y_buf_notin_SX[simp]:\n  \"bx \\<notin> rSX (CleanQ_RB_deq_y rb) \\<longleftrightarrow> bx \\<notin> rSX rb\"\n  unfolding CleanQ_RB_deq_y_def by (simp add: prod.case_eq_if) \n\n\n\nlemma CleanQ_RB_deq_x_subsets :\n  assumes can_deq: \"CleanQ_RB_deq_x_possible rb\"  and  X_deq: \"rb' = CleanQ_RB_deq_x rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\" \n  shows \"rSX rb \\<subset> rSX rb' \\<and> set (CleanQ_RB_list (rTYX rb')) \\<subset> set (CleanQ_RB_list (rTYX rb))\"\n  apply(subst X_deq)+\n  apply(simp add: CleanQ_RB_deq_x_def prod.case_eq_if)\n  using can_deq invariants \n  by (metis CleanQ_RB_Invariants_simp CleanQ_RB_deq_x_possible_def \n            dual_order.order_iff_strict insert_absorb \n            insert_disjoint(1) psubset_insert_iff rb_deq_list_was_in rb_deq_subset)\n\n\nlemma CleanQ_RB_deq_x_result :\n  assumes can_deq: \"CleanQ_RB_deq_x_possible rb\"  and  X_deq: \"rb' = CleanQ_RB_deq_x rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"  and buf: \"b = (rb_read_tail (rTYX rb))\"\n  shows  \"b \\<in> rSX rb' \\<and> b \\<notin> rSY rb' \\<and> b \\<notin> set (CleanQ_RB_list (rTYX rb')) \n          \\<and> b \\<notin> set (CleanQ_RB_list (rTXY rb')) \"\nproof -\n\n  have X1:\"b \\<in> rSX rb'\"\n    using buf X_deq unfolding CleanQ_RB_deq_x_def\n    by(auto simp:rb_deq_def prod.case_eq_if) \n\n  from invariants buf have X2a:\n    \"b \\<notin> rSY rb\" \n    apply(auto simp:rb_read_tail_def)\n    by (metis CleanQ_RB_deq_x_possible_def can_deq disjoint_iff_not_equal prod.sel(1) \n              rb_deq_def rb_deq_list_was_in rb_read_tail_def CleanQ_RB_Invariants_simp)\n\n  have X2:\"b \\<notin> rSY rb'\" \n    using invariants buf X_deq X2a unfolding CleanQ_RB_deq_x_def\n    by(auto simp add:rb_deq_def rb_read_tail_def)\n    \n\n  have X3a:\n    \"rTYX (let (b, rest) = rb_deq (rTYX rb) in rb\\<lparr>rSX := rSX rb \\<union> {b}, rTYX := rest\\<rparr>)\n       = snd (rb_deq (rTYX rb))\"\n    by (simp add: prod.case_eq_if)\n\n  have X3b:\n    \"b = (fst (rb_deq (rTYX rb)))\"\n    using buf unfolding rb_deq_def by simp\n\n  have X3:\"b \\<notin> set (CleanQ_RB_list (rTYX rb'))\"\n    apply(simp add: X_deq CleanQ_RB_deq_x_def prod.case_eq_if)\n    using can_deq invariants unfolding CleanQ_RB_deq_x_possible_def X3b\n    using CleanQ_RB_Invariants_def I3_rb_img_def I4_rb_valid_def rb_deq_list_not_in by blast\n\n  have X4a:\"b \\<notin> set (CleanQ_RB_list (rTXY rb))\"\n    using invariants buf \n    apply(auto simp:rb_read_tail_def)\n    by (metis CleanQ_RB_deq_x_possible_def buf can_deq disjoint_iff_not_equal \n              prod.sel(1) rb_deq_def rb_deq_list_was_in CleanQ_RB_Invariants_simp)\n\n  have X4:\"b \\<notin> set (CleanQ_RB_list (rTXY rb'))\"\n     using buf X_deq can_deq X4a unfolding CleanQ_RB_deq_x_def CleanQ_RB_deq_x_possible_def\n     by (metis CleanQ_List_State.ext_inject CleanQ_List_State.surjective \n               CleanQ_List_deq_x_upd CleanQ_RB2List_def CleanQ_RB_deq_x_equal  \n               X_deq can_deq invariants )\n    \n  show ?thesis using X1 X2 X3 X4 by(simp)   \nqed\n\n\nlemma CleanQ_RB_deq_y_result :\n  assumes can_deq: \"CleanQ_RB_deq_y_possible rb\"  and  Y_deq: \"rb' = CleanQ_RB_deq_y rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"  and buf: \"b = rb_read_tail (rTXY rb)\"\n  shows  \"b \\<notin> rSX rb' \\<and> b \\<in> rSY rb' \\<and> b \\<notin> set (CleanQ_RB_list (rTYX rb')) \n          \\<and> b \\<notin> set (CleanQ_RB_list (rTXY rb')) \"\nproof -\n  have X1:\"b \\<in> rSY rb'\"\n    using buf Y_deq unfolding CleanQ_RB_deq_y_def\n    by (simp add: rb_deq_def rb_read_tail_def)\n    \n  have X2:\"b \\<notin> rSX rb'\" \n    using invariants buf Y_deq unfolding CleanQ_RB_deq_y_def\n    by (metis (no_types, lifting) CleanQ_List_State.ext_inject CleanQ_List_State.surjective \n              CleanQ_List_deq_y_upd CleanQ_RB2List_def \n              CleanQ_RB_deq_y_possible_def CleanQ_RB_deq_y_equal  \n              Y_deq can_deq disjoint_iff_not_equal fstI rb_deq_def \n              rb_deq_list_was_in CleanQ_RB_Invariants_simp)\n  have X3:\"b \\<notin> set (CleanQ_RB_list (rTXY rb'))\"\n    using buf Y_deq can_deq unfolding CleanQ_RB_deq_y_def CleanQ_RB_deq_y_possible_def\n    apply(simp)\n    by (metis CleanQ_List_State.ext_inject CleanQ_List_State.surjective \n              CleanQ_List_deq_y_upd CleanQ_RB2List_def CleanQ_RB_Invariants_simp \n              CleanQ_RB_deq_y_equal Y_deq can_deq \n              fstI invariants rb_deq_def rb_deq_list_not_in rb_deq_list_tail rb_valid_def)\n    \n  have X4:\"b \\<notin> set (CleanQ_RB_list (rTYX rb'))\"\n     using buf Y_deq can_deq unfolding CleanQ_RB_deq_y_def CleanQ_RB_deq_y_possible_def\n    apply(simp)\n     by (metis CleanQ_List_State.ext_inject CleanQ_List_State.surjective \n               CleanQ_List_deq_y_upd CleanQ_RB2List_def CleanQ_RB_Invariants_simp\n               CleanQ_RB_deq_y_equal  Y_deq can_deq \n               disjoint_insert(1) fstI insert_Diff invariants rb_deq_def rb_deq_list_was_in )\n    \n  show ?thesis using X1 X2 X3 X4 by(simp) \nqed\n\nlemma CleanQ_RB_deq_y_no_change:\nassumes can_deq: \"CleanQ_RB_deq_y_possible rb\"  and  Y_deq: \"rb' = CleanQ_RB_deq_y rb\"\n  shows \"rSX rb' = rSX rb \\<and> rTYX rb' = rTYX rb\"\n  using can_deq Y_deq unfolding CleanQ_RB_deq_y_def by (simp add: prod.case_eq_if)\n\n\n\nlemma CleanQ_RB_deq_y_subsets :\n  assumes can_deq: \"CleanQ_RB_deq_y_possible rb\"  and  Y_deq: \"rb' = CleanQ_RB_deq_y rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\" \n  shows \"rSY rb \\<subset> rSY rb' \\<and> set (CleanQ_RB_list (rTXY rb')) \\<subset> set (CleanQ_RB_list (rTXY rb))\"\n  apply(subst Y_deq)+\n  apply(simp add: CleanQ_RB_deq_y_def prod.case_eq_if)\n  using can_deq invariants \n  by (metis CleanQ_RB_Invariants_simp CleanQ_RB_deq_y_possible_def  \n            dual_order.order_iff_strict insert_absorb \n            insert_disjoint(1) psubset_insert_iff rb_deq_list_was_in rb_deq_subset)\n\n  \n\n(* -------------------------------------------------------------------------------------*)\nsubsubsection \\<open>Invariants\\<close>\n(* -------------------------------------------------------------------------------------*)\n\n\nlemma CleanQ_RB_deq_x_I1 :\n  assumes can_deq: \"CleanQ_RB_deq_x_possible rb\"  and  X_deq: \"rb' = CleanQ_RB_deq_x rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"I1_rb_img rb' K\"\nproof -\n  have X1: \n    \"rSY rb' = rSY rb \\<and> rTXY rb' = rTXY rb\"\n    using can_deq X_deq by(simp add:CleanQ_RB_deq_x_no_change CleanQ_RB_Invariants_simp)\n\n  have X2:\n    \"rSX rb' \\<union> set (CleanQ_RB_list (rTYX rb')) = rSX rb \\<union> set (CleanQ_RB_list (rTYX rb))\"\n    apply(subst X_deq)+\n    apply(simp add:CleanQ_RB_deq_x_def prod.case_eq_if)\n    by (metis (no_types, lifting) CleanQ_RB_Invariants_simp \n              CleanQ_RB_deq_x_possible_def  Un_insert_right \n              can_deq empty_set insert_absorb insert_is_Un insert_not_empty invariants \n              list.simps(15) list_set_hd_tl_union rb_deq_list_tail rb_deq_list_was_head \n              rb_deq_list_was_in set_append rb_valid_def)\n\n  show ?thesis\n    using X1 X2 invariants by(auto simp:CleanQ_RB_Invariants_simp)\nqed\n\nlemma CleanQ_RB_deq_y_I1 :\n  assumes can_deq: \"CleanQ_RB_deq_y_possible rb\"  and  Y_deq: \"rb' = CleanQ_RB_deq_y rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"I1_rb_img rb' K\"\nproof -\n  \n  have X1: \n    \"rSX rb' = rSX rb \\<and> rTYX rb' = rTYX rb\"\n    using can_deq Y_deq CleanQ_RB_deq_y_no_change by(auto)\n\n  have X2:\n    \"rSY rb' \\<union> set (CleanQ_RB_list (rTXY rb')) = rSY rb \\<union> set (CleanQ_RB_list (rTXY rb))\"\n    apply(subst Y_deq)+\n    apply(simp add:CleanQ_RB_deq_y_def prod.case_eq_if)\n    by (metis (no_types, lifting) CleanQ_RB_Invariants_simp \n              CleanQ_RB_deq_y_possible_def  Un_insert_right \n              can_deq empty_set insert_absorb insert_is_Un insert_not_empty invariants \n              list.simps(15) list_set_hd_tl_union rb_deq_list_tail rb_deq_list_was_head \n              rb_deq_list_was_in set_append rb_valid_def)\n\n  show \"?thesis\"\n    using X1 X2 invariants by(auto simp:CleanQ_RB_Invariants_simp)\nqed\n\n\n\nlemma CleanQ_RB_deq_x_I2 :\n  assumes can_deq: \"CleanQ_RB_deq_x_possible rb\"  and  X_deq: \"rb' = CleanQ_RB_deq_x rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"I2_rb_img rb'\"\nproof -\n  have X1:\n    \"rSX rb' \\<inter> rSY rb' = {}\"\n    apply(subst X_deq)+\n    apply(simp add:CleanQ_RB_deq_x_def prod.case_eq_if) \n     using invariants\n     by (metis CleanQ_RB_Invariants_simp CleanQ_RB_deq_x_possible_def \n                IntI can_deq empty_iff \n                rb_deq_list_was_in)\n  (* ok that one should be rephrased... *)\n  have X2: \"rSX rb' \\<inter> set (CleanQ_RB_list (rTXY rb')) = {}\"\n    apply(subst X_deq)+\n    apply(simp add:CleanQ_RB_deq_x_def prod.case_eq_if)\n    using can_deq invariants\n    by (metis CleanQ_RB_Invariants_simp CleanQ_RB_deq_x_possible_def \n               insert_Diff insert_disjoint(1) \n              rb_deq_list_was_in)\n\n  (* ok that one should be rephrased... *)\n  have X3: \"rSX rb' \\<inter> set (CleanQ_RB_list (rTYX rb')) = {}\"\n    apply(subst X_deq)+\n    apply(simp add:CleanQ_RB_deq_x_def prod.case_eq_if)\n    using can_deq invariants\n    by (smt CleanQ_RB_Invariants_simp CleanQ_RB_deq_x_possible_def Int_commute Int_iff empty_set insert_Diff \n            insert_disjoint(1) list_set_hd_tl_subtract rb_deq_list_not_in rb_deq_list_tail \n            rb_deq_list_was_head rb_deq_list_was_in rb_valid_def)\n\n  have X4: \"rSY rb' \\<inter> set (CleanQ_RB_list (rTXY rb')) = {}\" \n    using can_deq X_deq invariants CleanQ_RB_deq_x_no_change\n    by (metis CleanQ_RB_Invariants_simp)\n\n  have X5: \"rSY rb' \\<inter> set (CleanQ_RB_list (rTYX rb')) = {}\"\n    using can_deq X_deq invariants CleanQ_RB_deq_x_no_change CleanQ_RB_deq_x_subsets\n    by (metis (no_types, lifting) CleanQ_RB_Invariants_simp  \n              inf.strict_order_iff inf_bot_right inf_left_commute)\n   \n  have X6: \"set (CleanQ_RB_list (rTXY rb')) \\<inter> set (CleanQ_RB_list (rTYX rb')) = {}\"\n    using can_deq X_deq invariants CleanQ_RB_deq_x_no_change CleanQ_RB_deq_x_subsets\n    by (metis (no_types, lifting) CleanQ_RB_Invariants_simp  \n              inf.strict_order_iff inf_bot_right inf_left_commute)\n\n  from X1 X2 X3 X4 X5 X6  show \"I2_rb_img rb'\"\n    by(auto simp:CleanQ_RB_Invariants_simp)\nqed\n\nlemma CleanQ_RB_deq_y_I2 :\n  assumes can_deq: \"CleanQ_RB_deq_y_possible rb\"  and  Y_deq: \"rb' = CleanQ_RB_deq_y rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"I2_rb_img rb'\"\nproof -\n  have X1:\n    \"rSX rb' \\<inter> rSY rb' = {}\"\n    apply(subst Y_deq)+\n    apply(simp add:CleanQ_RB_deq_y_def prod.case_eq_if) \n     using invariants\n     by (metis CleanQ_RB_Invariants_simp CleanQ_RB_deq_y_possible_def \n                 IntI can_deq empty_iff \n                rb_deq_list_was_in)\n\n  (* ok that one should be rephrased... *)\n  have X2: \"rSX rb' \\<inter> set (CleanQ_RB_list (rTXY rb')) = {}\"\n    apply(subst Y_deq)+\n    apply(simp add:CleanQ_RB_deq_y_def prod.case_eq_if)\n    using can_deq invariants\n    by (smt CleanQ_RB_Invariants_simp CleanQ_RB_deq_y_possible_def \n        disjoint_iff_not_equal\n        psubsetD rb_deq_subset)\n\n  (* ok that one should be rephrased... *)\n  have X3: \"rSX rb' \\<inter> set (CleanQ_RB_list (rTYX rb')) = {}\"\n    using can_deq invariants CleanQ_RB_deq_y_no_change\n    by (metis CleanQ_RB_Invariants_simp Y_deq)\n\n  have X4: \"rSY rb' \\<inter> set (CleanQ_RB_list (rTYX rb')) = {}\"\n    apply(subst Y_deq)+\n    apply(simp add:CleanQ_RB_deq_y_def prod.case_eq_if)\n    using can_deq invariants\n    by (metis CleanQ_RB_Invariants_simp  CleanQ_RB_deq_y_possible_def \n              disjoint_insert(1) insert_Diff rb_deq_list_was_in)\n\n  have X5: \"rSY rb' \\<inter> set (CleanQ_RB_list (rTXY rb')) = {}\" \n    apply(subst Y_deq)+\n    apply(simp add:CleanQ_RB_deq_y_def prod.case_eq_if)\n    using can_deq invariants\n    by (smt CleanQ_RB_Invariants_simp  CleanQ_RB_deq_y_possible_def \n            Int_commute Int_iff empty_set insert_Diff \n            insert_disjoint(1) list_set_hd_tl_subtract rb_deq_list_not_in rb_deq_list_tail \n            rb_deq_list_was_head rb_deq_list_was_in rb_valid_def)\n\n\n  have X6: \"set (CleanQ_RB_list (rTXY rb')) \\<inter> set (CleanQ_RB_list (rTYX rb')) = {}\"\n    using can_deq Y_deq invariants CleanQ_RB_deq_y_no_change CleanQ_RB_deq_y_subsets\n    by (smt CleanQ_RB_Invariants_simp  disjoint_iff_not_equal psubsetD)\n\n  from X1 X2 X3 X4 X5 X6  show \"I2_rb_img rb'\"\n    by(auto simp:CleanQ_RB_Invariants_simp)\nqed\n\n\nlemma CleanQ_RB_deq_x_I3 :\n  assumes can_deq: \"CleanQ_RB_deq_x_possible rb\"  and  X_deq: \"rb' = CleanQ_RB_deq_x rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"I3_rb_img rb'\"\n  using can_deq X_deq invariants\n  by (metis CleanQ_List_deq_x_I3 CleanQ_RB_Invariants_simp\n            CleanQ_RB_deq_x_equal I3_rb_img_lift)\n\nlemma CleanQ_RB_deq_y_I3 :\n  assumes can_deq: \"CleanQ_RB_deq_y_possible rb\"  and  Y_deq: \"rb' = CleanQ_RB_deq_y rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"I3_rb_img rb'\"\n  using can_deq Y_deq invariants\n  by (metis CleanQ_List_deq_y_I3 CleanQ_RB_Invariants_simp\n            CleanQ_RB_deq_y_equal I3_rb_img_lift)\n\nlemma CleanQ_RB_deq_x_I4 :\n  assumes can_deq: \"CleanQ_RB_deq_x_possible rb\"  and  X_deq: \"rb' = CleanQ_RB_deq_x rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"I4_rb_valid rb'\"\n  apply(subst X_deq)\n  unfolding CleanQ_RB_deq_x_def CleanQ_RB_deq_x_possible_def \n  using can_deq invariants\n  by(simp add: CleanQ_RB_deq_x_possible_def rb_deq_remains_valid prod.case_eq_if CleanQ_RB_Invariants_simp) \n\nlemma CleanQ_RB_deq_y_I4 :\n  assumes can_deq: \"CleanQ_RB_deq_y_possible rb\"  and  Y_deq: \"rb' = CleanQ_RB_deq_y rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"I4_rb_valid rb'\"\n  apply(subst Y_deq)\n  unfolding CleanQ_RB_deq_y_def CleanQ_RB_deq_y_possible_def \n  using can_deq invariants\n  by(simp add: CleanQ_RB_deq_y_possible_def rb_deq_remains_valid prod.case_eq_if CleanQ_RB_Invariants_simp) \n\nlemma CleanQ_RB_deq_x_all_inv :\n  assumes can_deq: \"CleanQ_RB_deq_x_possible rb\"  and  X_deq: \"rb' = CleanQ_RB_deq_x rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"CleanQ_RB_Invariants K rb'\"\n  apply(subst X_deq)\n  unfolding CleanQ_RB_deq_x_possible_def\n  using can_deq invariants CleanQ_RB_deq_x_I4 CleanQ_RB_deq_x_I3 CleanQ_RB_deq_x_I2 CleanQ_RB_deq_x_I1\n  unfolding CleanQ_RB_deq_x_def\n  using CleanQ_RB_Invariants_def by fastforce\n\nlemma CleanQ_RB_deq_y_all_inv :\n  assumes can_deq: \"CleanQ_RB_deq_y_possible rb\"  and  Y_deq: \"rb' = CleanQ_RB_deq_y rb\"\n    and invariants : \"CleanQ_RB_Invariants K rb\"\n  shows \"CleanQ_RB_Invariants K rb'\"\n  apply(subst Y_deq)\n  unfolding CleanQ_RB_deq_y_possible_def\n  using can_deq invariants CleanQ_RB_deq_y_I4 CleanQ_RB_deq_y_I3 CleanQ_RB_deq_y_I2 CleanQ_RB_deq_y_I1\n  unfolding CleanQ_RB_deq_y_def\n  using CleanQ_RB_Invariants_def by fastforce\n\n\n(* ==================================================================================== *)\nsubsection \\<open>Other Lemmas\\<close>\n(* ==================================================================================== *)\n\nlemma CleanQ_RB_deq_y_enq_x_possible [simp]:\n  \"CleanQ_RB_Invariants K rb \\<Longrightarrow> CleanQ_RB_deq_y_possible rb  \n        \\<Longrightarrow> CleanQ_RB_enq_x_possible (CleanQ_RB_deq_y rb)\"\n  unfolding CleanQ_RB_enq_x_possible_def CleanQ_RB_deq_y_def CleanQ_RB_deq_y_possible_def\n  by (simp add: CleanQ_RB_Invariants_def  I4_rb_valid_def prod.case_eq_if)\n\nlemma CleanQ_RB_enq_y_enq_x_possible [simp]:\n  \"CleanQ_RB_Invariants K rb \\<Longrightarrow> CleanQ_RB_enq_y_possible rb  \n        \\<Longrightarrow> CleanQ_RB_enq_x_possible (CleanQ_RB_enq_y b rb) = CleanQ_RB_enq_x_possible rb\"\n  unfolding CleanQ_RB_enq_x_possible_def CleanQ_RB_deq_y_def CleanQ_RB_deq_y_possible_def\n  by (simp add: CleanQ_RB_enq_y_def)\n  \n\nlemma CleanQ_RB_deq_y_deq_x_possible [simp]:\n  \"CleanQ_RB_Invariants K rb \\<Longrightarrow> \n        CleanQ_RB_deq_x_possible (CleanQ_RB_deq_y rb) = CleanQ_RB_deq_x_possible rb\"\n  unfolding CleanQ_RB_deq_x_possible_def CleanQ_RB_deq_y_def \n  by (simp add: CleanQ_RB_Invariants_def  I4_rb_valid_def prod.case_eq_if)\n\nlemma CleanQ_RB_deq_x_enq_y_possible [simp]:\n  \"CleanQ_RB_Invariants K rb \\<Longrightarrow> CleanQ_RB_deq_x_possible rb \n        \\<Longrightarrow> CleanQ_RB_enq_y_possible (CleanQ_RB_deq_x rb)\"\n  unfolding CleanQ_RB_deq_x_possible_def CleanQ_RB_deq_x_def CleanQ_RB_enq_y_possible_def\n  by (simp add: CleanQ_RB_Invariants_def I4_rb_valid_def case_prod_beta)\n\nlemma CleanQ_RB_deq_y_enq_y_possible [simp]:\n  \"CleanQ_RB_Invariants K rb \\<Longrightarrow> CleanQ_RB_enq_y_possible (CleanQ_RB_deq_y rb) \n                                      = CleanQ_RB_enq_y_possible rb\"\n  unfolding CleanQ_RB_enq_y_possible_def CleanQ_RB_deq_y_def \n  by (simp add: CleanQ_RB_Invariants_def  I4_rb_valid_def prod.case_eq_if)\n\nlemma CleanQ_RB_enq_y_deq_x_possible [simp]:\n  \"CleanQ_RB_Invariants K rb \\<Longrightarrow> CleanQ_RB_enq_y_possible rb \n        \\<Longrightarrow> CleanQ_RB_deq_x_possible (CleanQ_RB_enq_y b rb)\"\n  unfolding CleanQ_RB_enq_y_possible_def CleanQ_RB_deq_x_possible_def  CleanQ_RB_enq_y_def\n  by (simp add: CleanQ_RB_Invariants_def I4_rb_valid_def)\n\nlemma CleanQ_RB_enq_x_deq_y_possible [simp]:\n  \"CleanQ_RB_Invariants K rb \\<Longrightarrow> CleanQ_RB_enq_x_possible rb  \n        \\<Longrightarrow> CleanQ_RB_deq_y_possible (CleanQ_RB_enq_x b rb)\"\n  unfolding CleanQ_RB_enq_x_possible_def CleanQ_RB_deq_y_possible_def  CleanQ_RB_enq_x_def\n  by (simp add: CleanQ_RB_Invariants_def I4_rb_valid_def)\n\nlemma CleanQ_RB_enq_y_deq_y_possible [simp]:\n  \"CleanQ_RB_Invariants K rb \\<Longrightarrow> CleanQ_RB_enq_y_possible rb  \n        \\<Longrightarrow>  CleanQ_RB_deq_y_possible (CleanQ_RB_enq_y b rb) = CleanQ_RB_deq_y_possible rb\"\n  by (simp add: CleanQ_RB_deq_y_possible_def CleanQ_RB_enq_y_def)\n\n\nend ", "meta": {"author": "CleanQ-Project", "repo": "cleanq-proofs", "sha": "5212fcd2aceba0028bd1474e0553578a6091ca63", "save_path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs", "path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs/cleanq-proofs-5212fcd2aceba0028bd1474e0553578a6091ca63/CleanQ/CleanQ_RBModel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.6076631698328917, "lm_q1q2_score": 0.3156939732931831}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory IndirectCalls\n\nimports\n  \"PrettyProgs\"\n\nbegin\n\ndefinition\n  lookup_proc :: \"(string \\<Rightarrow> 'proc_addr) \\<Rightarrow> ('proc_id \\<rightharpoonup> string)\n    \\<Rightarrow> 'proc_addr \\<Rightarrow> 'proc_id\"\nwhere\n  \"lookup_proc symtab naming x\n    = (THE pid. naming pid \\<noteq> None \\<and> symtab (the (naming pid)) = x)\"\n\ndefinition\n  lookup_proc_safe :: \"(string \\<Rightarrow> 'proc_addr) \\<Rightarrow> ('proc_id \\<rightharpoonup> string)\n    \\<Rightarrow> 'proc_addr \\<Rightarrow> bool\"\nwhere\n  \"lookup_proc_safe symtab naming x\n    = (card {pid. naming pid \\<noteq> None \\<and> symtab (the (naming pid)) = x} = 1)\"\n\ndefinition\n  procs_consistent :: \"(string \\<Rightarrow> 'proc_addr) \\<Rightarrow> ('proc_nm \\<rightharpoonup> string)\n    \\<Rightarrow> bool\"\nwhere\n  \"procs_consistent symtab naming\n    = (finite (dom naming)\n        \\<and> (\\<forall>x y nm nm'. naming x = Some nm \\<and> naming y = Some nm'\n            \\<and> symtab nm = symtab nm'\n                \\<longrightarrow> x = y))\"\n\nlemma procs_consistent_eq:\n  \"\\<lbrakk> naming proc = Some nm; procs_consistent symtab naming; addr = symtab nm \\<rbrakk>\n    \\<Longrightarrow> lookup_proc symtab naming addr = proc\"\n  apply (clarsimp simp: procs_consistent_def lookup_proc_def)\n  apply (rule the_equality)\n   apply clarsimp\n  apply clarsimp\n  done\n\nlemma procs_consistent_safe:\n  \"\\<lbrakk> naming proc = Some nm; procs_consistent symtab naming; addr = symtab nm \\<rbrakk>\n    \\<Longrightarrow> lookup_proc_safe symtab naming addr\"\n  apply (clarsimp simp: procs_consistent_def lookup_proc_safe_def)\n  apply (rule trans, rule arg_cong[where f=card and y=\"{proc}\"])\n   apply auto\n  done\n\n(* lemma hoare_indirect_call_procs_consistent:\n  \"\\<lbrakk> naming proc = Some nm;\n        \\<Gamma> \\<turnstile> P (call initf proc ret c) Q, A \\<rbrakk>\n    \\<Longrightarrow> \\<Gamma> \\<turnstile> ({s. procs_consistent symtab naming \\<and> x_fn s = symtab nm} \\<inter> P)\n            (dynCall initf (\\<lambda>s. lookup_proc symtab naming (x_fn s))\n                    ret c) Q, A\"\n  apply (rule hoare_complete, drule hoare_sound)\n  apply (clarsimp simp: cvalid_def HoarePartialDef.valid_def)\n  apply (erule exec_dynCall_Normal_elim)\n  apply (simp add: procs_consistent_eq)\n  apply blast\n  done *)\n\nend\n\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/CParser/tools/c-parser/IndirectCalls.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.31569397329318305}}
{"text": "(*  \n    Author:      Sebastiaan Joosten\n                 René Thiemann \n                 Akihisa Yamada\n    License:     BSD\n*)\nsection \\<open>Real Algebraic Numbers\\<close>\n\ntext \\<open>Whereas we previously only proved the closure properties of algebraic numbers, this\n  theory adds the numeric computations that are required to separate the roots, and to\n  pick unique representatives of algebraic numbers. \n\n  The development is split into three major parts. First, an ambiguous representation of \n  algebraic numbers is used, afterwards another layer is used with special treatment of rational numbers\n  which still does not admit unique representatives, and finally, a quotient type is created modulo \n  the equivalence.\n  \n  The theory also contains a code-setup to implement real numbers via real algebraic numbers.\\<close>\n\n\ntext \\<open>The results are taken from the textbook \\<^cite>\\<open>\\<open>pages 329ff\\<close> in \"AlgNumbers\"\\<close>.\\<close>\n\n\ntheory Real_Algebraic_Numbers\nimports \n  Algebraic_Numbers_Pre_Impl\nbegin\n\n(*TODO: move *)\nlemma ex1_imp_Collect_singleton: \"(\\<exists>!x. P x) \\<and> P x \\<longleftrightarrow> Collect P = {x}\"\nproof(intro iffI conjI, unfold conj_imp_eq_imp_imp)\n  assume \"Ex1 P\" \"P x\" then show \"Collect P = {x}\" by blast\nnext\n  assume Px: \"Collect P = {x}\"\n  then have \"P y \\<longleftrightarrow> x = y\" for y by auto\n  then show \"Ex1 P\" by auto\n  from Px show \"P x\" by auto\nqed\n\nlemma ex1_Collect_singleton[consumes 2]:\n  assumes \"\\<exists>!x. P x\" and \"P x\" and \"Collect P = {x} \\<Longrightarrow> thesis\" shows thesis\n  by (rule assms(3), subst ex1_imp_Collect_singleton[symmetric], insert assms(1,2), auto)\n\nlemma ex1_iff_Collect_singleton: \"P x \\<Longrightarrow> (\\<exists>!x. P x) \\<longleftrightarrow> Collect P = {x}\"\n  by (subst ex1_imp_Collect_singleton[symmetric], auto)\n\nlemma bij_imp_card: assumes bij: \"bij f\" shows \"card {x. P (f x)} = card {x. P x}\"\nunfolding bij_imp_Collect_image[OF bij] bij_imp_card_image[OF bij_imp_bij_inv[OF bij]]..\n\nlemma bij_add: \"bij (\\<lambda>x. x + y :: 'a :: group_add)\" (is ?g1)\n  and bij_minus: \"bij (\\<lambda>x. x - y :: 'a)\" (is ?g2)\n  and inv_add[simp]: \"Hilbert_Choice.inv (\\<lambda>x. x + y) = (\\<lambda>x. x - y)\" (is ?g3)\n  and inv_minus[simp]: \"Hilbert_Choice.inv (\\<lambda>x. x - y) = (\\<lambda>x. x + y)\" (is ?g4)\nproof-\n  have 1: \"(\\<lambda>x. x - y) \\<circ> (\\<lambda>x. x + y) = id\" and 2: \"(\\<lambda>x. x + y) \\<circ> (\\<lambda>x. x - y) = id\" by auto\n  from o_bij[OF 1 2] show ?g1.\n  from o_bij[OF 2 1] show ?g2.\n  from inv_unique_comp[OF 2 1] show ?g3.\n  from inv_unique_comp[OF 1 2] show ?g4.\nqed\n\nlemmas ex1_shift[simp] = bij_imp_ex1_iff[OF bij_add] bij_imp_ex1_iff[OF bij_minus]\n\nlemma ex1_the_shift:\n  assumes ex1: \"\\<exists>!y :: 'a :: group_add. P y\"\n  shows \"(THE x. P (x + d)) = (THE y. P y) - d\"\n    and \"(THE x. P (x - d)) = (THE y. P y) + d\"\n  unfolding bij_ex1_imp_the_shift[OF bij_add ex1] bij_ex1_imp_the_shift[OF bij_minus ex1] by auto\n\nlemma card_shift_image[simp]:\n  shows \"card ((\\<lambda>x :: 'a :: group_add. x + d) ` X) = card X\"\n    and \"card ((\\<lambda>x. x - d) ` X) = card X\"\n  by (auto simp: bij_imp_card_image[OF bij_add] bij_imp_card_image[OF bij_minus])\n\nlemma irreducible_root_free:\n  fixes p :: \"'a :: {idom,comm_ring_1} poly\"\n  assumes irr: \"irreducible p\" shows \"root_free p\"\nproof (cases \"degree p\" \"1::nat\" rule: linorder_cases)\n  case greater\n  {\n    fix x\n    assume \"poly p x = 0\"\n    hence \"[:-x,1:] dvd p\" using poly_eq_0_iff_dvd by blast\n    then obtain r where p: \"p = r * [:-x,1:]\" by (elim dvdE, auto)\n    have deg: \"degree [:-x,1:] = 1\" by simp\n    have dvd: \"\\<not> [:-x,1:] dvd 1\" by (auto simp: poly_dvd_1)\n    from greater have \"degree r \\<noteq> 0\" using degree_mult_le[of r \"[:-x,1:]\", unfolded deg, folded p] by auto\n    then have \"\\<not> r dvd 1\" by (auto simp: poly_dvd_1)\n    with p irr irreducibleD[OF irr p] dvd have False by auto\n  }\n  thus ?thesis unfolding root_free_def by auto\nnext\n  case less then have deg: \"degree p = 0\" by auto\n  from deg obtain p0 where p: \"p = [:p0:]\" using degree0_coeffs by auto\n  with irr have \"p \\<noteq> 0\" by auto\n  with p have \"poly p x \\<noteq> 0\" for x by auto\n  thus ?thesis by (auto simp: root_free_def)\nqed (auto simp: root_free_def)\n\n\n(* **************************************************************** *)\nsubsection \\<open>Real Algebraic Numbers -- Innermost Layer\\<close>\n\ntext \\<open>We represent a real algebraic number \\<open>\\<alpha>\\<close> by a tuple (p,l,r):\n    \\<open>\\<alpha>\\<close> is the unique root in the interval [l,r]\n    and l and r have the same sign. We always assume that p is normalized, i.e.,\n    p is the unique irreducible and positive content-free polynomial \n    which represents the algebraic number.\n\n  This representation clearly admits duplicate representations for the same number, e.g.\n  (...,x-3, 3,3) is equivalent to (...,x-3,2,10).\\<close>\n\nsubsubsection \\<open>Basic Definitions\\<close>\n\ntype_synonym real_alg_1 = \"int poly \\<times> rat \\<times> rat\"\n\nfun poly_real_alg_1 :: \"real_alg_1 \\<Rightarrow> int poly\" where \"poly_real_alg_1 (p,_,_) = p\"\nfun rai_ub :: \"real_alg_1 \\<Rightarrow> rat\" where \"rai_ub (_,_,r) = r\"\nfun rai_lb :: \"real_alg_1 \\<Rightarrow> rat\" where \"rai_lb (_,l,_) = l\"\n\nabbreviation \"roots_below p x \\<equiv> {y :: real. y \\<le> x \\<and> ipoly p y = 0}\"\n\nabbreviation(input) unique_root :: \"real_alg_1 \\<Rightarrow> bool\" where\n  \"unique_root plr \\<equiv> (\\<exists>! x. root_cond plr x)\"\n\nabbreviation the_unique_root :: \"real_alg_1 \\<Rightarrow> real\" where\n  \"the_unique_root plr \\<equiv> (THE x. root_cond plr x)\"\n\nabbreviation real_of_1 where \"real_of_1 \\<equiv> the_unique_root\"\n\nlemma root_condI[intro]:\n  assumes \"of_rat (rai_lb plr) \\<le> x\" and \"x \\<le> of_rat (rai_ub plr)\" and \"ipoly (poly_real_alg_1 plr) x = 0\"\n  shows \"root_cond plr x\"\n  using assms by (auto simp: root_cond_def)\n\n\n\nlemma\n  assumes ur: \"unique_root plr\"\n  defines \"x \\<equiv> the_unique_root plr\" and \"p \\<equiv> poly_real_alg_1 plr\" and \"l \\<equiv> rai_lb plr\" and \"r \\<equiv> rai_ub plr\"\n  shows unique_rootD: \"of_rat l \\<le> x\" \"x \\<le> of_rat r\" \"ipoly p x = 0\" \"root_cond plr x\"\n        \"x = y \\<longleftrightarrow> root_cond plr y\" \"y = x \\<longleftrightarrow> root_cond plr y\"\n    and the_unique_root_eqI: \"root_cond plr y \\<Longrightarrow> y = x\" \"root_cond plr y \\<Longrightarrow> x = y\"\nproof -\n  from ur show x: \"root_cond plr x\" unfolding x_def by (rule theI')\n  have \"plr = (p,l,r)\" by (cases plr, auto simp: p_def l_def r_def)\n  from x[unfolded this] show \"of_rat l \\<le> x\" \"x \\<le> of_rat r\" \"ipoly p x = 0\" by auto\n  from x ur\n  show \"root_cond plr y \\<Longrightarrow> y = x\" and \"root_cond plr y \\<Longrightarrow> x = y\"\n   and \"x = y \\<longleftrightarrow> root_cond plr y\" and \"y = x \\<longleftrightarrow> root_cond plr y\" by auto\nqed\n\nlemma unique_rootE:\n  assumes ur: \"unique_root plr\"\n  defines \"x \\<equiv> the_unique_root plr\" and \"p \\<equiv> poly_real_alg_1 plr\" and \"l \\<equiv> rai_lb plr\" and \"r \\<equiv> rai_ub plr\"\n  assumes main: \"of_rat l \\<le> x \\<Longrightarrow> x \\<le> of_rat r \\<Longrightarrow> ipoly p x = 0 \\<Longrightarrow> root_cond plr x \\<Longrightarrow>\n        (\\<And>y. x = y \\<longleftrightarrow> root_cond plr y) \\<Longrightarrow> (\\<And>y. y = x \\<longleftrightarrow> root_cond plr y) \\<Longrightarrow> thesis\"\n  shows thesis by (rule main, unfold x_def p_def l_def r_def; rule unique_rootD[OF ur])\n\nlemma unique_rootI:\n  assumes \"\\<And> y. root_cond plr y \\<Longrightarrow> x = y\" \"root_cond plr x\"\n  shows \"unique_root plr\" using assms by blast\n\ndefinition invariant_1 :: \"real_alg_1 \\<Rightarrow> bool\" where\n  \"invariant_1 tup \\<equiv> case tup of (p,l,r) \\<Rightarrow>\n    unique_root (p,l,r) \\<and> sgn l = sgn r \\<and> poly_cond p\"\n\n\nlemma invariant_1I:\n  assumes \"unique_root plr\" and \"sgn (rai_lb plr) = sgn (rai_ub plr)\" and \"poly_cond (poly_real_alg_1 plr)\"\n  shows \"invariant_1 plr\"\n  using assms by (auto simp: invariant_1_def)\n\nlemma\n  assumes \"invariant_1 plr\"\n  defines \"x \\<equiv> the_unique_root plr\" and \"p \\<equiv> poly_real_alg_1 plr\" and \"l \\<equiv> rai_lb plr\" and \"r \\<equiv> rai_ub plr\"\n  shows invariant_1D: \"root_cond plr x\"\n    \"sgn l = sgn r\" \"sgn x = of_rat (sgn r)\" \"unique_root plr\" \"poly_cond p\" \"degree p > 0\" \"primitive p\"\n    and invariant_1_root_cond: \"\\<And> y. root_cond plr y \\<longleftrightarrow> y = x\"\nproof -\n  let ?l = \"of_rat l :: real\"\n  let ?r = \"of_rat r :: real\"\n  have plr: \"plr = (p,l,r)\" by (cases plr, auto simp: p_def l_def r_def)\n  from assms\n  show ur: \"unique_root plr\" and sgn: \"sgn l = sgn r\" and pc: \"poly_cond p\" by (auto simp: invariant_1_def)\n  from ur show rc: \"root_cond plr x\" by (auto simp add: x_def plr intro: theI')\n  from this[unfolded plr] have x: \"ipoly p x = 0\" and bnd: \"?l \\<le> x\" \"x \\<le> ?r\" by auto\n  show \"sgn x = of_rat (sgn r)\"\n  proof (cases \"0::real\" \"x\" rule:linorder_cases)\n    case less\n    with bnd(2) have \"0 < ?r\" by arith\n    thus ?thesis using less by simp\n  next\n    case equal\n    with bnd have \"?l \\<le> 0\" \"?r \\<ge> 0\" by auto\n    hence \"l \\<le> 0\" \"r \\<ge> 0\" by auto\n    with \\<open>sgn l = sgn r\\<close> have \"l = 0\" \"r = 0\" unfolding sgn_rat_def by (auto split: if_splits)\n    with rc[unfolded plr]\n    show ?thesis by auto\n  next\n    case greater\n    with bnd(1) have \"?l < 0\" by arith\n    thus ?thesis unfolding \\<open>sgn l = sgn r\\<close>[symmetric] using greater by simp\n  qed\n  from the_unique_root_eqI[OF ur] rc\n  show \"\\<And> y. root_cond plr y \\<longleftrightarrow> y = x\" by metis\n  {\n    assume \"degree p = 0\"\n    with poly_zero[OF x, simplified] sgn bnd have \"p = 0\" by auto\n    with pc have \"False\" by auto\n  }\n  then show \"degree p > 0\" by auto\n  with pc show \"primitive p\" by (intro irreducible_imp_primitive, auto)\nqed\n\nlemma invariant_1E[elim]:\n  assumes \"invariant_1 plr\"\n  defines \"x \\<equiv> the_unique_root plr\" and \"p \\<equiv> poly_real_alg_1 plr\" and \"l \\<equiv> rai_lb plr\" and \"r \\<equiv> rai_ub plr\"\n  assumes main: \"root_cond plr x \\<Longrightarrow>\n      sgn l = sgn r \\<Longrightarrow> sgn x = of_rat (sgn r) \\<Longrightarrow> unique_root plr \\<Longrightarrow> poly_cond p \\<Longrightarrow> degree p > 0 \\<Longrightarrow>\n      primitive p \\<Longrightarrow> thesis\"\n  shows thesis apply (rule main)\n  using assms(1) unfolding x_def p_def l_def r_def by (auto dest: invariant_1D)\n\nlemma invariant_1_realI:\n  fixes plr :: real_alg_1\n  defines \"p \\<equiv> poly_real_alg_1 plr\" and \"l \\<equiv> rai_lb plr\" and \"r \\<equiv> rai_ub plr\"\n  assumes x: \"root_cond plr x\" and \"sgn l = sgn r\"\n      and ur: \"unique_root plr\"\n      and \"poly_cond p\"\n  shows \"invariant_1 plr \\<and> real_of_1 plr = x\"\n  using the_unique_root_eqI[OF ur x] assms by (cases plr, auto intro: invariant_1I)\n    \nlemma real_of_1_0:\n  assumes \"invariant_1 (p,l,r)\"\n  shows [simp]: \"the_unique_root (p,l,r) = 0 \\<longleftrightarrow> r = 0\"\n    and [dest]: \"l = 0 \\<Longrightarrow> r = 0\"\n    and [intro]: \"r = 0 \\<Longrightarrow> l = 0\"\n  using assms by (auto simp: sgn_0_0)\n\n\nlemma invariant_1_pos: assumes rc: \"invariant_1 (p,l,r)\"\n  shows [simp]:\"the_unique_root (p,l,r) > 0 \\<longleftrightarrow> r > 0\" (is \"?x > 0 \\<longleftrightarrow> _\")\n    and [simp]:\"the_unique_root (p,l,r) < 0 \\<longleftrightarrow> r < 0\"\n    and [simp]:\"the_unique_root (p,l,r) \\<le> 0 \\<longleftrightarrow> r \\<le> 0\"\n    and [simp]:\"the_unique_root (p,l,r) \\<ge> 0 \\<longleftrightarrow> r \\<ge> 0\"\n    and [intro]: \"r > 0 \\<Longrightarrow> l > 0\"\n    and [dest]: \"l > 0 \\<Longrightarrow> r > 0\"\n    and [intro]: \"r < 0 \\<Longrightarrow> l < 0\"\n    and [dest]: \"l < 0 \\<Longrightarrow> r < 0\"\nproof(atomize(full),goal_cases)\n  case 1\n  let ?r = \"real_of_rat\"\n  from assms[unfolded invariant_1_def]\n  have ur: \"unique_root (p,l,r)\" and sgn: \"sgn l = sgn r\" by auto\n  from unique_rootD(1-2)[OF ur] have le: \"?r l \\<le> ?x\" \"?x \\<le> ?r r\" by auto\n  from rc show ?case\n  proof (cases r \"0::rat\" rule:linorder_cases)\n    case greater\n    with sgn have \"sgn l = 1\" by simp\n    hence l0: \"l > 0\" by (auto simp: sgn_1_pos)\n    hence \"?r l > 0\" by auto\n    hence \"?x > 0\" using le(1) by arith\n    with greater l0 show ?thesis by auto\n  next\n    case equal\n    with real_of_1_0[OF rc] show ?thesis by auto\n  next\n    case less\n    hence \"?r r < 0\" by auto\n    with le(2) have \"?x < 0\" by arith\n    with less sgn show ?thesis by (auto simp: sgn_1_neg)\n  qed\nqed\n\ndefinition invariant_1_2 where\n  \"invariant_1_2 rai \\<equiv> invariant_1 rai \\<and> degree (poly_real_alg_1 rai) > 1\"\n\ndefinition poly_cond2 where \"poly_cond2 p \\<equiv> poly_cond p \\<and> degree p > 1\"\n\nlemma poly_cond2I[intro!]: \"poly_cond p \\<Longrightarrow> degree p > 1 \\<Longrightarrow> poly_cond2 p\" by (simp add: poly_cond2_def)\n\nlemma poly_cond2D:\n  assumes \"poly_cond2 p\"\n  shows \"poly_cond p\" and \"degree p > 1\" using assms by (auto simp: poly_cond2_def)\n\nlemma poly_cond2E[elim!]:\n  assumes \"poly_cond2 p\" and \"poly_cond p \\<Longrightarrow> degree p > 1 \\<Longrightarrow> thesis\" shows thesis\n  using assms by (auto simp: poly_cond2_def)\n\nlemma invariant_1_2_poly_cond2: \"invariant_1_2 rai \\<Longrightarrow> poly_cond2 (poly_real_alg_1 rai)\"\n  unfolding invariant_1_def invariant_1_2_def poly_cond2_def by auto\n\nlemma invariant_1_2I[intro!]:\n  assumes \"invariant_1 rai\" and \"degree (poly_real_alg_1 rai) > 1\" shows \"invariant_1_2 rai\"\n  using assms by (auto simp: invariant_1_2_def)\n\nlemma invariant_1_2E[elim!]:\n  assumes \"invariant_1_2 rai\"\n      and \"invariant_1 rai \\<Longrightarrow> degree (poly_real_alg_1 rai) > 1 \\<Longrightarrow> thesis\"\n  shows thesis using assms[unfolded invariant_1_2_def] by auto\n\n\nlemma invariant_1_2_realI:\n  fixes plr :: real_alg_1\n  defines \"p \\<equiv> poly_real_alg_1 plr\" and \"l \\<equiv> rai_lb plr\" and \"r \\<equiv> rai_ub plr\"\n  assumes x: \"root_cond plr x\" and sgn: \"sgn l = sgn r\" and ur: \"unique_root plr\" and p: \"poly_cond2 p\"\n  shows \"invariant_1_2 plr \\<and> real_of_1 plr = x\"\n  using invariant_1_realI[OF x] p sgn ur unfolding p_def l_def r_def by auto\n  \nsubsection \\<open>Real Algebraic Numbers = Rational + Irrational Real Algebraic Numbers\\<close>\n\ntext \\<open>In the next representation of real algebraic numbers, we distinguish between\n  rational and irrational numbers. The advantage is that whenever we only work on\n  rational numbers, there is not much overhead involved in comparison to the \n  existing implementation of real numbers which just supports the rational numbers.\n  For irrational numbers we additionally store the number of the root, counting from\n  left to right. For instance $-\\sqrt{2}$ and $\\sqrt{2}$ would be root number 1 and 2\n  of $x^2 - 2$.\\<close>\n\nsubsubsection \\<open>Definitions and Algorithms on Raw Type\\<close>\ndatatype real_alg_2 = Rational rat | Irrational nat real_alg_1\n\n  \nfun invariant_2 :: \"real_alg_2 \\<Rightarrow> bool\" where \n  \"invariant_2 (Irrational n rai) = (invariant_1_2 rai\n    \\<and> n = card(roots_below (poly_real_alg_1 rai) (real_of_1 rai)))\"\n| \"invariant_2 (Rational r) = True\"\n  \nfun real_of_2 :: \"real_alg_2 \\<Rightarrow> real\" where\n  \"real_of_2 (Rational r) = of_rat r\"\n| \"real_of_2 (Irrational n rai) = real_of_1 rai\"\n\ndefinition of_rat_2 :: \"rat \\<Rightarrow> real_alg_2\" where\n  [code_unfold]: \"of_rat_2 = Rational\"\n\nlemma of_rat_2: \"real_of_2 (of_rat_2 x) = of_rat x\" \"invariant_2 (of_rat_2 x)\"\n  by (auto simp: of_rat_2_def)\n\n(* Invariant type *)\ntypedef real_alg_3 = \"Collect invariant_2\" \n  morphisms rep_real_alg_3 Real_Alg_Invariant \n  by (rule exI[of _ \"Rational 0\"], auto)\n\nsetup_lifting type_definition_real_alg_3\n\nlift_definition real_of_3 :: \"real_alg_3 \\<Rightarrow> real\" is real_of_2 .\n\n(* *************** *)\nsubsubsection \\<open>Definitions and Algorithms on Quotient Type\\<close>\n\nquotient_type real_alg = real_alg_3 / \"\\<lambda> x y. real_of_3 x = real_of_3 y\"\n  morphisms rep_real_alg Real_Alg_Quotient\n  by (auto simp: equivp_def) metis\n\n(* real_of *)\nlift_definition real_of :: \"real_alg \\<Rightarrow> real\" is real_of_3 .\n\nlemma real_of_inj: \"(real_of x = real_of y) = (x = y)\"\n  by (transfer, simp)\n\n(* ********************** *)\nsubsubsection \\<open>Sign\\<close>\n\ndefinition sgn_1 :: \"real_alg_1 \\<Rightarrow> rat\" where\n  \"sgn_1 x = sgn (rai_ub x)\" \n\nlemma sgn_1: \"invariant_1 x \\<Longrightarrow> real_of_rat (sgn_1 x) = sgn (real_of_1 x)\"\n  unfolding sgn_1_def by auto\n\nlemma sgn_1_inj: \"invariant_1 x \\<Longrightarrow> invariant_1 y \\<Longrightarrow> real_of_1 x = real_of_1 y \\<Longrightarrow> sgn_1 x = sgn_1 y\"\n  by (auto simp: sgn_1_def elim!: invariant_1E)\n\n(* ********************** *)\nsubsubsection \\<open>Normalization: Bounds Close Together\\<close>\n\nlemma unique_root_lr: assumes ur: \"unique_root plr\" shows \"rai_lb plr \\<le> rai_ub plr\" (is \"?l \\<le> ?r\")\nproof -\n  let ?p = \"poly_real_alg_1 plr\"\n  from ur[unfolded root_cond_def]\n  have ex1: \"\\<exists>! x :: real. of_rat ?l \\<le> x \\<and> x \\<le> of_rat ?r \\<and> ipoly ?p x = 0\" by (cases plr, simp)\n  then obtain x :: real where bnd: \"of_rat ?l \\<le> x\" \"x \\<le> of_rat ?r\" and rt: \"ipoly ?p x = 0\" by auto\n  from bnd have \"real_of_rat ?l \\<le> of_rat ?r\" by linarith\n  thus \"?l \\<le> ?r\" by (simp add: of_rat_less_eq)\nqed\n\nlocale map_poly_zero_hom_0 = base: zero_hom_0\nbegin\n  sublocale zero_hom_0 \"map_poly hom\" by (unfold_locales,auto)\nend\ninterpretation of_int_poly_hom:\n  map_poly_zero_hom_0 \"of_int :: int \\<Rightarrow> 'a :: {ring_1, ring_char_0}\" ..\n\n\nlemma roots_below_the_unique_root:\n  assumes ur: \"unique_root (p,l,r)\"\n  shows \"roots_below p (the_unique_root (p,l,r)) = roots_below p (of_rat r)\" (is \"roots_below p ?x = _\")\nproof-\n  from ur have rc: \"root_cond (p,l,r) ?x\" by (auto dest!: unique_rootD)\n  with ur have x: \"{x. root_cond (p,l,r) x} = {?x}\" by (auto intro: the_unique_root_eqI)\n  from rc have \"?x \\<in> {y. ?x \\<le> y \\<and> y \\<le> of_rat r \\<and> ipoly p y = 0}\" by auto\n  with rc have l1x: \"... = {?x}\" by (intro equalityI, fold x(1), force, simp add: x)\n\n  have rb:\"roots_below p (of_rat r) = roots_below p ?x \\<union> {y. ?x < y \\<and> y \\<le> of_rat r \\<and> ipoly p y = 0}\"\n    using rc by auto\n  have emp: \"\\<And>x. the_unique_root (p, l, r) < x \\<Longrightarrow>\n                  x \\<notin> {ra. ?x \\<le> ra \\<and> ra \\<le> real_of_rat r \\<and> ipoly p ra = 0}\"\n    using l1x by auto\n  with rb show ?thesis by auto\nqed\n\nlemma unique_root_sub_interval:\n  assumes ur: \"unique_root (p,l,r)\"\n      and rc: \"root_cond (p,l',r') (the_unique_root (p,l,r))\"\n      and between: \"l \\<le> l'\" \"r' \\<le> r\"\n  shows \"unique_root (p,l',r')\"\n    and \"the_unique_root (p,l',r') = the_unique_root (p,l,r)\"\nproof -\n  from between have ord: \"real_of_rat l \\<le> of_rat l'\" \"real_of_rat r' \\<le> of_rat r\" by (auto simp: of_rat_less_eq)\n  from rc have lr': \"real_of_rat l' \\<le> of_rat r'\" by auto\n  with ord have lr: \"real_of_rat l \\<le> real_of_rat r\" by auto\n  show \"\\<exists>!x. root_cond (p, l', r') x\"\n  proof (rule, rule rc)\n    fix y\n    assume \"root_cond (p,l',r') y\"\n    with ord have \"root_cond (p,l,r) y\" by (auto intro!:root_condI)\n    from the_unique_root_eqI[OF ur this] show \"y = the_unique_root (p,l,r)\" by simp\n  qed\n  from the_unique_root_eqI[OF this rc] \n  show \"the_unique_root (p,l',r') = the_unique_root (p,l,r)\" by simp\nqed\n\nlemma invariant_1_sub_interval:\n  assumes rc: \"invariant_1 (p,l,r)\"\n      and sub: \"root_cond (p,l',r') (the_unique_root (p,l,r))\"\n      and between: \"l \\<le> l'\" \"r' \\<le> r\"\n  shows \"invariant_1 (p,l',r')\" and \"real_of_1 (p,l',r') = real_of_1 (p,l,r)\"\nproof -\n  let ?r = real_of_rat\n  note rcD = invariant_1D[OF rc]\n  from rc\n  have ur: \"unique_root (p, l', r')\"\n    and id: \"the_unique_root (p, l', r') = the_unique_root (p, l, r)\"\n    by (atomize(full), intro conjI unique_root_sub_interval[OF _ sub between], auto)\n  show \"real_of_1 (p,l',r') = real_of_1 (p,l,r)\"\n    using id by simp\n  from rcD(1)[unfolded split] have \"?r l \\<le> ?r r\" by auto\n  hence lr: \"l \\<le> r\" by (auto simp: of_rat_less_eq)\n  from unique_rootD[OF ur] have \"?r l' \\<le> ?r r'\" by auto\n  hence lr': \"l' \\<le> r'\" by (auto simp: of_rat_less_eq)\n  have \"sgn l' = sgn r'\"\n  proof (cases \"r\" \"0::rat\" rule: linorder_cases)\n    case less\n    with lr lr' between have \"l < 0\" \"l' < 0\" \"r' < 0\" \"r < 0\" by auto\n    thus ?thesis unfolding sgn_rat_def by auto\n  next\n    case equal with rcD(2) have \"l = 0\" using sgn_0_0 by auto\n    with equal between lr' have \"l' = 0\" \"r' = 0\" by auto then show ?thesis by auto\n  next\n    case greater\n    with rcD(4) have \"sgn r = 1\" unfolding sgn_rat_def by (cases \"r = 0\", auto)\n    with rcD(2) have \"sgn l = 1\" by simp\n    hence l: \"l > 0\" unfolding sgn_rat_def by (cases \"l = 0\"; cases \"l < 0\"; auto)\n    with lr lr' between have \"l > 0\" \"l' > 0\" \"r' > 0\" \"r > 0\" by auto\n    thus ?thesis unfolding sgn_rat_def by auto\n  qed\n  with between ur rc show \"invariant_1 (p,l',r')\" by (auto simp add: invariant_1_def id)\nqed\n\nlemma rational_root_free_degree_iff: assumes rf: \"root_free (map_poly rat_of_int p)\" and rt: \"ipoly p x = 0\"\n  shows \"(x \\<in> \\<rat>) = (degree p = 1)\"\nproof \n  assume \"x \\<in> \\<rat>\"\n  then obtain y where x: \"x = of_rat y\" (is \"_ = ?x\") unfolding Rats_def by blast\n  from rt[unfolded x] have \"poly (map_poly rat_of_int p) y = 0\" by simp\n  with rf show \"degree p = 1\" unfolding root_free_def by auto\nnext\n  assume \"degree p = 1\"\n  from degree1_coeffs[OF this]\n  obtain a b where p: \"p = [:a,b:]\" and b: \"b \\<noteq> 0\" by auto\n  from rt[unfolded p hom_distribs] have \"of_int a + x * of_int b = 0\" by auto\n  from arg_cong[OF this, of \"\\<lambda> x. (x - of_int a) / of_int b\"]\n  have \"x = - of_rat (of_int a) / of_rat (of_int b)\" using b by auto\n  also have \"\\<dots> = of_rat (- of_int a / of_int b)\" unfolding of_rat_minus of_rat_divide ..\n  finally show \"x \\<in> \\<rat>\" by auto\nqed\n\nlemma rational_poly_cond_iff: assumes \"poly_cond p\" and \"ipoly p x = 0\" and \"degree p > 1\"\n  shows \"(x \\<in> \\<rat>) = (degree p = 1)\"\nproof (rule rational_root_free_degree_iff[OF _ assms(2)])\n  from poly_condD[OF assms(1)] irreducible_connect_rev[of p] assms(3)\n  have p: \"irreducible\\<^sub>d p\" by auto\n  from irreducible\\<^sub>d_int_rat[OF this]\n  have \"irreducible (map_poly rat_of_int p)\" by simp\n  thus \"root_free (map_poly rat_of_int p)\" by (rule irreducible_root_free) \nqed\n\nlemma poly_cond_degree_gt_1: assumes \"poly_cond p\" \"degree p > 1\" \"ipoly p x = 0\"\n  shows \"x \\<notin> \\<rat>\" \n  using rational_poly_cond_iff[OF assms(1,3)] assms(2) by simp\n\nlemma poly_cond2_no_rat_root: assumes \"poly_cond2 p\" \n  shows \"ipoly p (real_of_rat x) \\<noteq> 0\"\n  using poly_cond_degree_gt_1[of p \"real_of_rat x\"] assms by auto\n\ncontext \n  fixes p :: \"int poly\"\n  and x :: \"rat\"\nbegin\n\nlemma gt_rat_sign_change:\n  assumes ur: \"unique_root plr\"\n  defines \"p \\<equiv> poly_real_alg_1 plr\" and \"l \\<equiv> rai_lb plr\" and \"r \\<equiv> rai_ub plr\"\n  assumes p: \"poly_cond2 p\" and in_interval: \"l \\<le> y\" \"y \\<le> r\"\n  shows \"(sgn (ipoly p y) = sgn (ipoly p r)) = (of_rat y > the_unique_root plr)\" \nproof -\n  have plr: \"plr = (p,l,r)\" by (cases plr, auto simp: p_def l_def r_def)\n  show ?thesis\n  proof (rule gt_rat_sign_change_square_free[OF ur plr _ in_interval])\n    note nz = poly_cond2_no_rat_root[OF p]\n    from nz[of y] show \"ipoly p y \\<noteq> 0\" by auto\n    from nz[of r] show \"ipoly p r \\<noteq> 0\" by auto\n    from p have \"irreducible p\" by auto\n    thus \"square_free p\" by (rule irreducible_imp_square_free)\n  qed\nqed\n  \ndefinition tighten_poly_bounds :: \"rat \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow> rat \\<times> rat \\<times> rat\" where\n  \"tighten_poly_bounds l r sr = (let m = (l + r) / 2; sm = sgn (ipoly p m) in \n    if sm = sr\n     then (l,m,sm) else (m,r,sr))\"\n\nlemma tighten_poly_bounds: assumes res: \"tighten_poly_bounds l r sr = (l',r',sr')\"\n  and ur: \"unique_root (p,l,r)\"\n  and p:  \"poly_cond2 p\"   \n  and sr: \"sr = sgn (ipoly p r)\" \n  shows \"root_cond (p,l',r') (the_unique_root (p,l,r))\" \"l \\<le> l'\" \"l' \\<le> r'\" \"r' \\<le> r\" \n    \"(r' - l') = (r - l) / 2\" \"sr' = sgn (ipoly p r')\" \nproof -\n  let ?x = \"the_unique_root (p,l,r)\"\n  let ?x' = \"the_unique_root (p,l',r')\"\n  let ?m = \"(l + r) / 2\"\n  note d = tighten_poly_bounds_def Let_def\n  from unique_root_lr[OF ur] have lr: \"l \\<le> r\" by auto\n  thus \"l \\<le> l'\" \"l' \\<le> r'\" \"r' \\<le> r\" \"(r' - l') = (r - l) / 2\" \"sr' = sgn (ipoly p r')\"\n    using res sr unfolding d by (auto split: if_splits)\n  hence \"l \\<le> ?m\" \"?m \\<le> r\" by auto\n  note le = gt_rat_sign_change[OF ur,simplified,OF p this]\n  note urD = unique_rootD[OF ur]\n  show \"root_cond (p,l',r') ?x\"\n  proof (cases \"sgn (ipoly p ?m) = sgn (ipoly p r)\")\n    case *: False\n    with res sr have id: \"l' = ?m\" \"r' = r\" unfolding d by auto\n    from *[unfolded le] urD show ?thesis unfolding id by auto\n  next\n    case *: True \n    with res sr have id: \"l' = l\" \"r' = ?m\" unfolding d by auto\n    from *[unfolded le] urD show ?thesis unfolding id by auto\n  qed\nqed\n\npartial_function (tailrec) tighten_poly_bounds_epsilon :: \"rat \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow> rat \\<times> rat \\<times> rat\" where\n  [code]: \"tighten_poly_bounds_epsilon l r sr = (if r - l \\<le> x then (l,r,sr) else\n    (case tighten_poly_bounds l r sr of (l',r',sr') \\<Rightarrow> tighten_poly_bounds_epsilon l' r' sr'))\"\n    \npartial_function (tailrec) tighten_poly_bounds_for_x :: \"rat \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow>\n  rat \\<times> rat \\<times> rat\" where \n  [code]: \"tighten_poly_bounds_for_x l r sr = (if x < l \\<or> r < x then (l, r, sr) else\n     (case tighten_poly_bounds l r sr of (l',r',sr') \\<Rightarrow> tighten_poly_bounds_for_x l' r' sr'))\"\n\nlemma tighten_poly_bounds_epsilon:\n  assumes ur: \"unique_root (p,l,r)\"\n  defines u: \"u \\<equiv> the_unique_root (p,l,r)\"\n  assumes p: \"poly_cond2 p\"\n      and res: \"tighten_poly_bounds_epsilon l r sr = (l',r',sr')\"\n      and sr: \"sr = sgn (ipoly p r)\" \n      and x: \"x > 0\"\n  shows \"l \\<le> l'\" \"r' \\<le> r\" \"root_cond (p,l',r') u\" \"r' - l' \\<le> x\" \"sr' = sgn (ipoly p r')\" \nproof -\n  let ?u = \"the_unique_root (p,l,r)\"\n  define delta where \"delta = x / 2\"\n  have delta: \"delta > 0\" unfolding delta_def using x by auto\n  let ?dist = \"\\<lambda> (l,r,sr). r - l\"\n  let ?rel = \"inv_image {(x, y). 0 \\<le> y \\<and> delta_gt delta x y} ?dist\"\n  note SN = SN_inv_image[OF delta_gt_SN[OF delta], of ?dist]\n  note simps = res[unfolded tighten_poly_bounds_for_x.simps[of l r]]\n  let ?P = \"\\<lambda> (l,r,sr). unique_root (p,l,r) \\<longrightarrow> u = the_unique_root (p,l,r) \n    \\<longrightarrow> tighten_poly_bounds_epsilon l r sr = (l',r',sr') \n    \\<longrightarrow> sr = sgn (ipoly p r)\n    \\<longrightarrow> l \\<le> l' \\<and> r' \\<le> r \\<and> r' - l' \\<le> x \\<and> root_cond (p,l',r') u \\<and> sr' = sgn (ipoly p r')\"\n  have \"?P (l,r,sr)\"\n  proof (induct rule: SN_induct[OF SN])\n    case (1 lr)\n    obtain l r sr where lr: \"lr = (l,r,sr)\" by (cases lr, auto)\n    show ?case unfolding lr split\n    proof (intro impI)\n      assume ur: \"unique_root (p, l, r)\"\n        and u: \"u = the_unique_root (p, l, r)\"\n        and res: \"tighten_poly_bounds_epsilon l r sr = (l', r', sr')\"\n        and sr: \"sr = sgn (ipoly p r)\" \n      note tur = unique_rootD[OF ur]\n      note simps = tighten_poly_bounds_epsilon.simps[of l r sr]\n      show \"l \\<le> l' \\<and> r' \\<le> r \\<and> r' - l' \\<le> x \\<and> root_cond (p, l', r') u \\<and> sr' = sgn (ipoly p r')\"\n      proof (cases \"r - l \\<le> x\")\n        case True\n        with res[unfolded simps] ur tur(4) u sr\n        show ?thesis by auto\n      next\n        case False \n        hence x: \"r - l > x\" by auto\n        let ?tight = \"tighten_poly_bounds l r sr\"\n        obtain L R SR where tight: \"?tight = (L,R,SR)\" by (cases ?tight, auto)\n        note tighten = tighten_poly_bounds[OF tight[unfolded sr] ur p]\n        from unique_root_sub_interval[OF ur tighten(1-2,4)] p\n        have ur': \"unique_root (p,L,R)\" \"u = the_unique_root (p,L,R)\" unfolding u by auto\n        from res[unfolded simps tight] False sr have \"tighten_poly_bounds_epsilon L R SR = (l',r',sr')\" by auto\n        note IH = 1[of \"(L,R,SR)\", unfolded tight split lr, rule_format, OF _ ur' this]\n        have \"L \\<le> l' \\<and> r' \\<le> R \\<and> r' - l' \\<le> x \\<and> root_cond (p, l', r') u \\<and> sr' = sgn (ipoly p r')\"\n          by (rule IH, insert tighten False, auto simp: delta_gt_def delta_def)\n        thus ?thesis using tighten by auto\n      qed\n    qed\n  qed\n  from this[unfolded split u, rule_format, OF ur refl res sr] \n  show \"l \\<le> l'\" \"r' \\<le> r\" \"root_cond (p,l',r') u\" \"r' - l' \\<le> x\" \"sr' = sgn (ipoly p r')\" using u by auto\nqed\n\nlemma tighten_poly_bounds_for_x:\n  assumes ur: \"unique_root (p,l,r)\"\n  defines u: \"u \\<equiv> the_unique_root (p,l,r)\"\n  assumes p: \"poly_cond2 p\" \n      and res: \"tighten_poly_bounds_for_x l r sr = (l',r',sr')\"\n      and sr: \"sr = sgn (ipoly p r)\" \n  shows \"l \\<le> l'\" \"l' \\<le> r'\" \"r' \\<le> r\" \"root_cond (p,l',r') u\" \"\\<not> (l' \\<le> x \\<and> x \\<le> r')\" \"sr' = sgn (ipoly p r')\" \"unique_root (p,l',r')\"\nproof -\n  let ?u = \"the_unique_root (p,l,r)\"\n  let ?x = \"real_of_rat x\"\n  define delta where \"delta = abs ((u - ?x) / 2)\"\n  let ?p = \"real_of_int_poly p\"\n  note ru = unique_rootD[OF ur]\n  {\n    assume \"u = ?x\"\n    note u = this[unfolded u]\n    from poly_cond2_no_rat_root[OF p] ur have False by (elim unique_rootE, auto simp: u)\n  }\n  hence delta: \"delta > 0\" unfolding delta_def by auto\n  let ?dist = \"\\<lambda> (l,r,sr). real_of_rat (r - l)\"\n  let ?rel = \"inv_image {(x, y). 0 \\<le> y \\<and> delta_gt delta x y} ?dist\"\n  note SN = SN_inv_image[OF delta_gt_SN[OF delta], of ?dist]\n  note simps = res[unfolded tighten_poly_bounds_for_x.simps[of l r]]\n  let ?P = \"\\<lambda> (l,r,sr). unique_root (p,l,r) \\<longrightarrow> u = the_unique_root (p,l,r) \n    \\<longrightarrow> tighten_poly_bounds_for_x l r sr = (l',r',sr') \n    \\<longrightarrow> sr = sgn (ipoly p r)\n    \\<longrightarrow> l \\<le> l' \\<and> r' \\<le> r \\<and> \\<not> (l' \\<le> x \\<and> x \\<le> r') \\<and> root_cond (p,l',r') u \\<and> sr' = sgn (ipoly p r')\"\n  have \"?P (l,r,sr)\"\n  proof (induct rule: SN_induct[OF SN])\n    case (1 lr)\n    obtain l r sr where lr: \"lr = (l,r,sr)\" by (cases lr, auto)\n    let ?l = \"real_of_rat l\"\n    let ?r = \"real_of_rat r\"\n    show ?case unfolding lr split\n    proof (intro impI)\n      assume ur: \"unique_root (p, l, r)\"\n        and u: \"u = the_unique_root (p, l, r)\"\n        and res: \"tighten_poly_bounds_for_x l r sr = (l', r', sr')\"\n        and sr: \"sr = sgn (ipoly p r)\" \n      note tur = unique_rootD[OF ur]\n      note simps = tighten_poly_bounds_for_x.simps[of l r]\n      show \"l \\<le> l' \\<and> r' \\<le> r \\<and> \\<not> (l' \\<le> x \\<and> x \\<le> r') \\<and> root_cond (p, l', r') u \\<and> sr' = sgn (ipoly p r')\"\n      proof (cases \"x < l \\<or> r < x\")\n        case True\n        with res[unfolded simps] ur tur(4) u sr\n        show ?thesis by auto\n      next\n        case False \n        hence x: \"?l \\<le> ?x\" \"?x \\<le> ?r\" by (auto simp: of_rat_less_eq)\n        let ?tight = \"tighten_poly_bounds l r sr\"\n        obtain L R SR where tight: \"?tight = (L,R,SR)\" by (cases ?tight, auto)\n        note tighten = tighten_poly_bounds[OF tight ur p sr]\n        from unique_root_sub_interval[OF ur tighten(1-2,4)] p\n        have ur': \"unique_root (p,L,R)\" \"u = the_unique_root (p,L,R)\" unfolding u by auto\n        from res[unfolded simps tight] False have \"tighten_poly_bounds_for_x L R SR = (l',r',sr')\" by auto\n        note IH = 1[of ?tight, unfolded tight split lr, rule_format, OF _ ur' this]\n        let ?DIFF = \"real_of_rat (R - L)\" let ?diff = \"real_of_rat (r - l)\"\n        have diff0: \"0 \\<le> ?DIFF\" using tighten(3)\n          by (metis cancel_comm_monoid_add_class.diff_cancel diff_right_mono of_rat_less_eq of_rat_hom.hom_zero)\n        have *: \"r - l - (r - l) / 2 = (r - l) / 2\" by (auto simp: field_simps)\n        have \"delta_gt delta ?diff ?DIFF = (abs (u - of_rat x) \\<le> real_of_rat (r - l) * 1)\"\n          unfolding delta_gt_def tighten(5) delta_def of_rat_diff[symmetric] * by (simp add: hom_distribs)\n        also have \"real_of_rat (r - l) * 1 = ?r - ?l\" \n          unfolding of_rat_divide of_rat_mult of_rat_diff by auto\n        also have \"abs (u - of_rat x) \\<le> ?r - ?l\" using x ur by (elim unique_rootE, auto simp: u)\n        finally have delta: \"delta_gt delta ?diff ?DIFF\" .\n        have \"L \\<le> l' \\<and> r' \\<le> R \\<and> \\<not> (l' \\<le> x \\<and> x \\<le> r') \\<and> root_cond (p, l', r') u \\<and> sr' = sgn (ipoly p r')\"\n          by (rule IH, insert delta diff0 tighten(6), auto)\n        with \\<open>l \\<le> L\\<close> \\<open>R \\<le> r\\<close> show ?thesis by auto\n      qed\n    qed\n  qed\n  from this[unfolded split u, rule_format, OF ur refl res sr] \n  show *: \"l \\<le> l'\" \"r' \\<le> r\" \"root_cond (p,l',r') u\" \"\\<not> (l' \\<le> x \\<and> x \\<le> r')\" \"sr' = sgn (ipoly p r')\" unfolding u \n    by auto\n  from *(3)[unfolded split] have \"real_of_rat l' \\<le> of_rat r'\" by auto\n  thus \"l' \\<le> r'\" unfolding of_rat_less_eq .\n  show \"unique_root (p,l',r')\" using ur *(1-3) p poly_condD(5) u unique_root_sub_interval(1) by blast\nqed\nend\n\ndefinition real_alg_precision :: rat where\n  \"real_alg_precision \\<equiv> Rat.Fract 1 2\"\n\nlemma real_alg_precision: \"real_alg_precision > 0\" \n  by eval\n\ndefinition normalize_bounds_1_main :: \"rat \\<Rightarrow> real_alg_1 \\<Rightarrow> real_alg_1\" where\n  \"normalize_bounds_1_main eps rai = (case rai of (p,l,r) \\<Rightarrow>\n    let (l',r',sr') = tighten_poly_bounds_epsilon p eps l r (sgn (ipoly p r));\n        fr = rat_of_int (floor r');\n        (l'',r'',_) = tighten_poly_bounds_for_x p fr l' r' sr'\n    in (p,l'',r''))\"\n\ndefinition normalize_bounds_1 :: \"real_alg_1 \\<Rightarrow> real_alg_1\" where \n  \"normalize_bounds_1 = (normalize_bounds_1_main real_alg_precision)\"\n\ncontext\n  fixes p q and l r :: rat\n  assumes cong: \"\\<And> x. real_of_rat l \\<le> x \\<Longrightarrow> x \\<le> of_rat r \\<Longrightarrow> (ipoly p x = (0 :: real)) = (ipoly q x = 0)\"\nbegin\nlemma root_cond_cong: \"root_cond (p,l,r) = root_cond (q,l,r)\"\n  by (intro ext, insert cong, auto simp: root_cond_def)\n\nlemma the_unique_root_cong: \n  \"the_unique_root (p,l,r) = the_unique_root (q,l,r)\"\n  unfolding root_cond_cong ..\n\nlemma unique_root_cong: \n  \"unique_root (p,l,r) = unique_root (q,l,r)\"\n  unfolding root_cond_cong ..\nend\n\nlemma normalize_bounds_1_main: assumes eps: \"eps > 0\" and rc: \"invariant_1_2 x\"\n  defines y: \"y \\<equiv> normalize_bounds_1_main eps x\"\n  shows \"invariant_1_2 y \\<and> (real_of_1 y = real_of_1 x)\"\nproof -\n  obtain p l r where x: \"x = (p,l,r)\" by (cases x) auto\n  note rc = rc[unfolded x]\n  obtain l' r' sr' where tb: \"tighten_poly_bounds_epsilon p eps l r (sgn (ipoly p r)) = (l',r',sr')\" \n    by (cases rule: prod_cases3, auto)\n  let ?fr = \"rat_of_int (floor r')\"\n  obtain l'' r'' sr'' where tbx: \"tighten_poly_bounds_for_x p ?fr l' r' sr' = (l'',r'',sr'')\"\n    by (cases rule: prod_cases3, auto)\n  from y[unfolded normalize_bounds_1_main_def x] tb tbx\n  have y: \"y = (p, l'', r'')\" \n    by (auto simp: Let_def)\n  from rc have \"unique_root (p, l, r)\" and p2: \"poly_cond2 p\" by auto\n  from tighten_poly_bounds_epsilon[OF this tb refl eps]\n  have bnd: \"l \\<le> l'\" \"r' \\<le> r\" and rc': \"root_cond (p, l', r') (the_unique_root (p, l, r))\" \n    and eps: \"r' - l' \\<le> eps\" (* currently not relevant for lemma *)\n    and sr': \"sr' = sgn (ipoly p r')\" by auto\n  from invariant_1_sub_interval[OF _ rc' bnd] rc\n  have inv': \"invariant_1 (p, l', r')\" and eq: \"real_of_1 (p, l', r') = real_of_1 (p, l, r)\" by auto\n  have bnd: \"l' \\<le> l''\" \"r'' \\<le> r'\" and rc': \"root_cond (p, l'', r'') (the_unique_root (p, l', r'))\"\n    by (rule tighten_poly_bounds_for_x[OF _ p2 tbx sr'], fact invariant_1D[OF inv'])+\n  from invariant_1_sub_interval[OF inv' rc' bnd] p2 eq\n  show ?thesis unfolding y x by auto\nqed\n\nlemma normalize_bounds_1: assumes x: \"invariant_1_2 x\"\n  shows \"invariant_1_2 (normalize_bounds_1 x) \\<and> (real_of_1 (normalize_bounds_1 x) = real_of_1 x)\" \nproof(cases x)\n  case xx:(fields p l r)\n  let ?res = \"(p,l,r)\"\n  have norm: \"normalize_bounds_1 x = (normalize_bounds_1_main real_alg_precision ?res)\" \n    unfolding normalize_bounds_1_def by (simp add: xx)\n  from x have x: \"invariant_1_2 ?res\" \"real_of_1 ?res = real_of_1 x\" unfolding xx by auto\n  from normalize_bounds_1_main[OF real_alg_precision x(1)] x(2-)\n  show ?thesis unfolding normalize_bounds_1_def xx by auto\nqed\n  \nlemma normalize_bound_1_poly: \"poly_real_alg_1 (normalize_bounds_1 rai) = poly_real_alg_1 rai\" \n  unfolding normalize_bounds_1_def normalize_bounds_1_main_def Let_def\n  by (auto split: prod.splits)\n\ndefinition real_alg_2_main :: \"root_info \\<Rightarrow> real_alg_1 \\<Rightarrow> real_alg_2\" where \n  \"real_alg_2_main ri rai \\<equiv> let p = poly_real_alg_1 rai\n     in (if degree p = 1 then Rational (Rat.Fract (- coeff p 0) (coeff p 1))\n       else (case normalize_bounds_1 rai of (p',l,r) \\<Rightarrow>\n       Irrational (root_info.number_root ri r) (p',l,r)))\"\n\ndefinition real_alg_2 :: \"real_alg_1 \\<Rightarrow> real_alg_2\" where \n  \"real_alg_2 rai \\<equiv> let p = poly_real_alg_1 rai\n     in (if degree p = 1 then Rational (Rat.Fract (- coeff p 0) (coeff p 1))\n       else (case normalize_bounds_1 rai of (p',l,r) \\<Rightarrow>\n       Irrational (root_info.number_root (root_info p) r) (p',l,r)))\"\n\nlemma degree_1_ipoly: assumes \"degree p = Suc 0\"\n  shows \"ipoly p x = 0 \\<longleftrightarrow> (x = real_of_rat (Rat.Fract (- coeff p 0) (coeff p 1)))\"\nproof -\n  from roots1[of \"map_poly real_of_int p\"] assms\n  have \"ipoly p x = 0 \\<longleftrightarrow> x \\<in> {roots1 (real_of_int_poly p)}\" by auto\n  also have \"\\<dots> = (x = real_of_rat (Rat.Fract (- coeff p 0) (coeff p 1)))\" \n    unfolding Fract_of_int_quotient roots1_def hom_distribs\n    by auto\n  finally show ?thesis .\nqed\n\nlemma invariant_1_degree_0:\n  assumes inv: \"invariant_1 rai\"\n  shows \"degree (poly_real_alg_1 rai) \\<noteq> 0\" (is \"degree ?p \\<noteq> 0\")\nproof (rule notI)\n  assume deg: \"degree ?p = 0\"\n  from inv have \"ipoly ?p (real_of_1 rai) = 0\" by auto\n  with deg have \"?p = 0\" by (meson less_Suc0 representsI represents_degree)\n  with inv show False by auto\nqed\n\nlemma real_alg_2_main:\n  assumes inv: \"invariant_1 rai\"\n  defines [simp]: \"p \\<equiv> poly_real_alg_1 rai\"\n  assumes ric: \"irreducible (poly_real_alg_1 rai) \\<Longrightarrow> root_info_cond ri (poly_real_alg_1 rai)\" \n  shows \"invariant_2 (real_alg_2_main ri rai)\" \"real_of_2 (real_alg_2_main ri rai) = real_of_1 rai\"\nproof (atomize(full))\n  define l r where [simp]: \"l \\<equiv> rai_lb rai\" and [simp]: \"r \\<equiv> rai_ub rai\"\n  show \"invariant_2 (real_alg_2_main ri rai) \\<and> real_of_2 (real_alg_2_main ri rai) = real_of_1 rai\" \n    unfolding id using invariant_1D\n  proof (cases \"degree p\" \"Suc 0\" rule: linorder_cases)\n    case deg: equal\n    hence id: \"real_alg_2_main ri rai = Rational (Rat.Fract (- coeff p 0) (coeff p 1))\" \n      unfolding real_alg_2_main_def Let_def by auto\n    note rc = invariant_1D[OF inv]\n    from degree_1_ipoly[OF deg, of \"the_unique_root rai\"] rc(1)\n    show ?thesis unfolding id by auto\n  next\n    case deg: greater\n    with inv have inv: \"invariant_1_2 rai\" unfolding p_def by auto\n    define rai' where \"rai' = normalize_bounds_1 rai\"\n    have rai': \"real_of_1 rai = real_of_1 rai'\" and inv': \"invariant_1_2 rai'\" \n      unfolding rai'_def using normalize_bounds_1[OF inv] by auto\n    obtain p' l' r' where \"rai' = (p',l',r')\" by (cases rai')\n    with arg_cong[OF rai'_def, of poly_real_alg_1, unfolded normalize_bound_1_poly] split\n    have split: \"rai' = (p,l',r')\" by auto\n    from inv'[unfolded split]\n    have \"poly_cond p\" by auto\n    from poly_condD[OF this] have irr: \"irreducible p\" by simp\n    from ric irr have ric: \"root_info_cond ri p\" by auto\n    have id: \"real_alg_2_main ri rai = (Irrational (root_info.number_root ri r') rai')\" \n      unfolding real_alg_2_main_def Let_def using deg split rai'_def\n      by (auto simp: rai'_def rai')\n    show ?thesis unfolding id using rai' root_info_condD(2)[OF ric] \n         inv'[unfolded split]\n      apply (elim invariant_1_2E invariant_1E) using inv'\n      by(auto simp: split roots_below_the_unique_root)\n  next\n    case deg: less then have \"degree p = 0\" by auto\n    from this invariant_1_degree_0[OF inv] have \"p = 0\" by simp\n    with inv show ?thesis by auto\n  qed\nqed\n\nlemma real_alg_2: assumes \"invariant_1 rai\" \n  shows \"invariant_2 (real_alg_2 rai)\" \"real_of_2 (real_alg_2 rai) = real_of_1 rai\"\nproof -\n  have deg: \"0 < degree (poly_real_alg_1 rai)\" using assms by auto\n  have \"real_alg_2 rai = real_alg_2_main (root_info (poly_real_alg_1 rai)) rai\" \n    unfolding real_alg_2_def real_alg_2_main_def Let_def by auto\n  from real_alg_2_main[OF assms root_info, folded this, simplified] deg\n  show \"invariant_2 (real_alg_2 rai)\" \"real_of_2 (real_alg_2 rai) = real_of_1 rai\" by auto\nqed\n\nlemma invariant_2_realI:\n  fixes plr :: real_alg_1\n  defines \"p \\<equiv> poly_real_alg_1 plr\" and \"l \\<equiv> rai_lb plr\" and \"r \\<equiv> rai_ub plr\"\n  assumes x: \"root_cond plr x\" and sgn: \"sgn l = sgn r\"\n      and ur: \"unique_root plr\"\n      and p: \"poly_cond p\"\n  shows \"invariant_2 (real_alg_2 plr) \\<and> real_of_2 (real_alg_2 plr) = x\"\n  using invariant_1_realI[OF x,folded p_def l_def r_def] sgn ur p\n    real_alg_2[of plr] by auto\n\n(* ********************* *)\nsubsubsection \\<open>Comparisons\\<close>\n\nfun compare_rat_1 :: \"rat \\<Rightarrow> real_alg_1 \\<Rightarrow> order\" where\n  \"compare_rat_1 x (p,l,r) = (if x < l then Lt else if x > r then Gt else\n      if sgn (ipoly p x) = sgn(ipoly p r) then Gt else Lt)\" \n  \nlemma compare_rat_1: assumes rai: \"invariant_1_2 y\" \n  shows \"compare_rat_1 x y = compare (of_rat x) (real_of_1 y)\" \nproof-\n  define p l r where \"p \\<equiv> poly_real_alg_1 y\" \"l \\<equiv> rai_lb y\" \"r \\<equiv> rai_ub y\"\n  then have y [simp]: \"y = (p,l,r)\" by (cases y, auto)\n  from rai have ur: \"unique_root y\" by auto\n  show ?thesis \n  proof (cases \"x < l \\<or> x > r\")\n    case True\n    {\n      assume xl: \"x < l\" \n      hence \"real_of_rat x < of_rat l\" unfolding of_rat_less by auto\n      with rai have \"of_rat x < the_unique_root y\" by (auto elim!: invariant_1E)\n      with xl rai have ?thesis by (cases y, auto simp: compare_real_def comparator_of_def)\n    }\n    moreover\n    {\n      assume xr: \"\\<not> x < l\" \"x > r\" \n      hence \"real_of_rat x > of_rat r\" unfolding of_rat_less by auto\n      with rai have \"of_rat x > the_unique_root y\" by (auto elim!: invariant_1E)\n      with xr rai have ?thesis by (cases y, auto simp: compare_real_def comparator_of_def)\n    }\n    ultimately show ?thesis using True by auto\n  next\n    case False\n    have 0: \"ipoly p (real_of_rat x) \\<noteq> 0\" by (rule poly_cond2_no_rat_root, insert rai, auto)\n    with rai have diff: \"real_of_1 y \\<noteq> of_rat x\" by (auto elim!: invariant_1E)\n    have \"\\<And> P. (1 < degree (poly_real_alg_1 y) \\<Longrightarrow> \\<exists>!x. root_cond y x \\<Longrightarrow> poly_cond p \\<Longrightarrow> P) \\<Longrightarrow> P\"\n       using poly_real_alg_1.simps y rai invariant_1_2E invariant_1E by metis\n    from this[OF gt_rat_sign_change] False\n    have left: \"compare_rat_1 x y = (if real_of_rat x \\<le> the_unique_root y then Lt else Gt)\"\n      by (auto simp:poly_cond2_def)\n    also have \"\\<dots> = compare (real_of_rat x) (real_of_1 y)\" using diff\n      by (auto simp: compare_real_def comparator_of_def)\n    finally show ?thesis .\n  qed\nqed\n  \nlemma cf_pos_0[simp]: \"\\<not> cf_pos 0\" \n  unfolding cf_pos_def by auto\n\n\n(* ********************* *)\nsubsubsection\\<open>Negation\\<close>\n\nfun uminus_1 :: \"real_alg_1 \\<Rightarrow> real_alg_1\" where\n  \"uminus_1 (p,l,r) = (abs_int_poly (poly_uminus p), -r, -l)\"\n\nlemma uminus_1: assumes x: \"invariant_1 x\"\n  defines y: \"y \\<equiv> uminus_1 x\"\n  shows \"invariant_1 y \\<and> (real_of_1 y = - real_of_1 x)\"\nproof (cases x)\n  case plr: (fields p l r)\n  from x plr have inv: \"invariant_1 (p,l,r)\" by auto\n  note * = invariant_1D[OF this]\n  from plr have x: \"x = (p,l,r)\" by simp\n  let ?p = \"poly_uminus p\"\n  let ?mp = \"abs_int_poly ?p\"\n  have y: \"y = (?mp, -r , -l)\" \n    unfolding y plr by (simp add: Let_def)\n  {\n    fix y\n    assume \"root_cond (?mp, - r, - l) y\"\n    hence mpy: \"ipoly ?mp y = 0\" and bnd: \"- of_rat r \\<le> y\" \"y \\<le> - of_rat l\"\n      unfolding root_cond_def by (auto simp: of_rat_minus)\n    from mpy have id: \"ipoly p (- y) = 0\" by auto\n    from bnd have bnd: \"of_rat l \\<le> - y\" \"-y \\<le> of_rat r\" by auto\n    from id bnd have \"root_cond (p, l, r) (-y)\" unfolding root_cond_def by auto\n    with inv x have \"real_of_1 x = -y\" by (auto intro!: the_unique_root_eqI)\n    then have \"-real_of_1 x = y\" by auto\n  } note inj = this\n  have rc: \"root_cond (?mp, - r, - l) (- real_of_1 x)\"\n    using * unfolding root_cond_def y x by (auto simp: of_rat_minus sgn_minus_rat)\n  from inj rc have ur': \"unique_root (?mp, -r, -l)\" by (auto intro: unique_rootI)\n  with rc have the: \"- real_of_1 x = the_unique_root (?mp, -r, -l)\" by (auto intro: the_unique_root_eqI)\n  have xp: \"p represents (real_of_1 x)\" using * unfolding root_cond_def split represents_def x by auto\n  from * have mon: \"lead_coeff ?mp > 0\" by (unfold pos_poly_abs_poly, auto)\n  from poly_uminus_irreducible * have mi: \"irreducible ?mp\" by auto\n  from mi mon have pc': \"poly_cond ?mp\" by (auto simp: cf_pos_def)\n  from poly_condD[OF pc'] have irr: \"irreducible ?mp\" by auto\n  show ?thesis unfolding y apply (intro invariant_1_realI ur' rc) using pc' inv by auto\nqed\n\nlemma uminus_1_2:\n  assumes x: \"invariant_1_2 x\"\n  defines y: \"y \\<equiv> uminus_1 x\"\n  shows \"invariant_1_2 y \\<and> (real_of_1 y = - real_of_1 x)\"\nproof -\n  from x have \"invariant_1 x\" by auto\n  from uminus_1[OF this] have *: \"real_of_1 y = - real_of_1 x\" \n    \"invariant_1 y\" unfolding y by auto\n  obtain p l r where id: \"x = (p,l,r)\" by (cases x)\n  from x[unfolded id] have \"degree p > 1\" by auto\n  moreover have \"poly_real_alg_1 y = abs_int_poly (poly_uminus p)\"\n    unfolding y id uminus_1.simps split Let_def by auto\n  ultimately have \"degree (poly_real_alg_1 y) > 1\" by simp\n  with * show ?thesis by auto\nqed\n  \nfun uminus_2 :: \"real_alg_2 \\<Rightarrow> real_alg_2\" where\n  \"uminus_2 (Rational r) = Rational (-r)\"\n| \"uminus_2 (Irrational n x) = real_alg_2 (uminus_1 x)\"\n\nlemma uminus_2: assumes \"invariant_2 x\" \n  shows \"real_of_2 (uminus_2 x) = uminus (real_of_2 x)\"\n  \"invariant_2 (uminus_2 x)\"\n  using assms real_alg_2 uminus_1 by (atomize(full), cases x, auto simp: hom_distribs)\n\ndeclare uminus_1.simps[simp del]\n\n\nlift_definition uminus_3 :: \"real_alg_3 \\<Rightarrow> real_alg_3\" is uminus_2 \n  by (auto simp: uminus_2)\n\nlemma uminus_3: \"real_of_3 (uminus_3 x) = - real_of_3 x\"\n  by (transfer, auto simp: uminus_2)\n    \ninstantiation real_alg :: uminus\nbegin\nlift_definition uminus_real_alg :: \"real_alg \\<Rightarrow> real_alg\" is uminus_3\n  by (simp add: uminus_3)\ninstance ..\nend\n\nlemma uminus_real_alg: \"- (real_of x) = real_of (- x)\"\n  by (transfer, rule uminus_3[symmetric])\n\n(* ********************* *)\nsubsubsection\\<open>Inverse\\<close>\n\nfun inverse_1 :: \"real_alg_1 \\<Rightarrow> real_alg_2\" where\n  \"inverse_1 (p,l,r) = real_alg_2 (abs_int_poly (reflect_poly p), inverse r, inverse l)\"\n\nlemma invariant_1_2_of_rat: assumes rc: \"invariant_1_2 rai\" \n  shows \"real_of_1 rai \\<noteq> of_rat x\" \nproof -\n  obtain p l r where rai: \"rai = (p, l, r)\" by (cases rai, auto)\n  from rc[unfolded rai]\n  have \"poly_cond2 p\" \"ipoly p (the_unique_root (p, l, r)) = 0\" by (auto elim!: invariant_1E)\n  from poly_cond2_no_rat_root[OF this(1), of x] this(2) show ?thesis unfolding rai by auto\nqed\n  \nlemma inverse_1:\n  assumes rcx: \"invariant_1_2 x\"\n  defines y: \"y \\<equiv> inverse_1 x\"\n  shows \"invariant_2 y \\<and> (real_of_2 y = inverse (real_of_1 x))\"\nproof (cases x)\n  case x: (fields p l r)\n  from x rcx have rcx: \"invariant_1_2 (p,l,r)\" by auto\n  from invariant_1_2_poly_cond2[OF rcx] have pc2: \"poly_cond2 p\" by simp\n  have x0: \"real_of_1 (p,l,r) \\<noteq> 0\" using invariant_1_2_of_rat[OF rcx, of 0] x by auto\n  let ?x = \"real_of_1 (p,l,r)\"\n  let ?mp = \"abs_int_poly (reflect_poly p)\"\n  from x0 rcx have lr0: \"l \\<noteq> 0\" and \"r \\<noteq> 0\" by auto\n  from x0 rcx have y: \"y = real_alg_2 (?mp, inverse r, inverse l)\"\n    unfolding y x Let_def inverse_1.simps by auto\n  from rcx have mon: \"lead_coeff ?mp > 0\" by (unfold lead_coeff_abs_int_poly, auto)\n  {\n    fix y\n    assume \"root_cond (?mp, inverse r, inverse l) y\"\n    hence mpy: \"ipoly ?mp y = 0\" and bnd: \"inverse (of_rat r) \\<le> y\" \"y \\<le> inverse (of_rat l)\"\n      unfolding root_cond_def by (auto simp: of_rat_inverse)\n    from sgn_real_mono[OF bnd(1)] sgn_real_mono[OF bnd(2)] \n    have \"sgn (of_rat r) \\<le> sgn y\" \"sgn y \\<le> sgn (of_rat l)\"\n      by (simp_all add: algebra_simps)\n    with rcx have sgn: \"sgn (inverse (of_rat r)) = sgn y\" \"sgn y = sgn (inverse (of_rat l))\" \n      unfolding sgn_inverse inverse_sgn\n      by (auto simp add: real_of_rat_sgn intro: order_antisym)\n    from sgn[simplified, unfolded real_of_rat_sgn] lr0 have \"y \\<noteq> 0\" by (auto simp:sgn_0_0)\n    with mpy have id: \"ipoly p (inverse y) = 0\" by (auto simp: ipoly_reflect_poly)\n    from inverse_le_sgn[OF sgn(1) bnd(1)] inverse_le_sgn[OF sgn(2) bnd(2)]\n    have bnd: \"of_rat l \\<le> inverse y\" \"inverse y \\<le> of_rat r\" by auto\n    from id bnd have \"root_cond (p,l,r) (inverse y)\" unfolding root_cond_def by auto\n    from rcx this x0 have \"?x = inverse y\" by auto\n    then have \"inverse ?x = y\" by auto\n  } note inj = this\n  have rc: \"root_cond (?mp, inverse r, inverse l) (inverse ?x)\"\n    using rcx x0 apply (elim invariant_1_2E invariant_1E)\n    by (simp add: root_cond_def of_rat_inverse real_of_rat_sgn inverse_le_iff_sgn ipoly_reflect_poly)\n  from inj rc have ur: \"unique_root (?mp, inverse r, inverse l)\" by (auto intro: unique_rootI)\n  with rc have the: \"the_unique_root (?mp, inverse r, inverse l) = inverse ?x\" by (auto intro: the_unique_root_eqI)\n  have xp: \"p represents ?x\" unfolding split represents_def using rcx by (auto elim!: invariant_1E)\n  from reflect_poly_irreducible[OF _ xp x0] poly_condD rcx\n  have mi: \"irreducible ?mp\" by auto\n  from mi mon have un: \"poly_cond ?mp\" by (auto simp: poly_cond_def)\n  show ?thesis using rcx rc ur unfolding y\n    by (intro invariant_2_realI, auto simp: x y un)\nqed\n  \nfun inverse_2 :: \"real_alg_2 \\<Rightarrow> real_alg_2\" where\n  \"inverse_2 (Rational r) = Rational (inverse r)\"\n| \"inverse_2 (Irrational n x) = inverse_1 x\"\n\nlemma inverse_2: assumes \"invariant_2 x\"\n  shows \"real_of_2 (inverse_2 x) = inverse (real_of_2 x)\"\n  \"invariant_2 (inverse_2 x)\"\n    using assms\n    by (atomize(full), cases x, auto simp: real_alg_2 inverse_1 hom_distribs)\n\nlift_definition inverse_3 :: \"real_alg_3 \\<Rightarrow> real_alg_3\" is inverse_2 \n  by (auto simp: inverse_2)\n\nlemma inverse_3: \"real_of_3 (inverse_3 x) = inverse (real_of_3 x)\"\n  by (transfer, auto simp: inverse_2)\n  \n\n(* ********************* *)\nsubsubsection\\<open>Floor\\<close>\n\nfun floor_1 :: \"real_alg_1 \\<Rightarrow> int\" where\n  \"floor_1 (p,l,r) = (let\n    (l',r',sr') = tighten_poly_bounds_epsilon p (1/2) l r (sgn (ipoly p r));\n    fr = floor r';\n    fl = floor l';\n    fr' = rat_of_int fr\n    in (if fr = fl then fr else\n    let (l'',r'',sr'') = tighten_poly_bounds_for_x p fr' l' r' sr'\n    in if fr' < l'' then fr else fl))\"\n\nlemma floor_1: assumes \"invariant_1_2 x\"\n  shows \"floor (real_of_1 x) = floor_1 x\"\nproof (cases x)\n  case (fields p l r)\n  obtain l' r' sr' where tbe: \"tighten_poly_bounds_epsilon p (1 / 2) l r (sgn (ipoly p r)) = (l',r',sr')\" \n    by (cases rule: prod_cases3, auto)    \n  let ?fr = \"floor r'\"\n  let ?fl = \"floor l'\"\n  let ?fr' = \"rat_of_int ?fr\"\n  obtain l'' r'' sr'' where tbx: \"tighten_poly_bounds_for_x p ?fr' l' r' sr' = (l'',r'',sr'')\" \n    by (cases rule: prod_cases3, auto)    \n  note rc = assms[unfolded fields]\n  hence rc1: \"invariant_1 (p,l,r)\" by auto\n  have id: \"floor_1 x = ((if ?fr = ?fl then ?fr \n    else if ?fr' < l'' then ?fr else ?fl))\"\n    unfolding fields floor_1.simps tbe Let_def split tbx by simp\n  let ?x = \"real_of_1 x\" \n  have x: \"?x = the_unique_root (p,l,r)\" unfolding fields by simp\n  have bnd: \"l \\<le> l'\" \"r' \\<le> r\" \"r' - l' \\<le> 1 / 2\"\n    and rc': \"root_cond (p, l', r') (the_unique_root (p, l, r))\" \n    and sr': \"sr' = sgn (ipoly p r')\"\n    by (atomize(full), intro conjI tighten_poly_bounds_epsilon[OF _ _ tbe refl],insert rc,auto elim!: invariant_1E)\n  let ?r = real_of_rat\n  from rc'[folded x, unfolded split]\n  have ineq: \"?r l' \\<le> ?x\" \"?x \\<le> ?r r'\" \"?r l' \\<le> ?r r'\" by auto\n  hence lr': \"l' \\<le> r'\" unfolding of_rat_less_eq by simp\n  have flr: \"?fl \\<le> ?fr\"\n    by (rule floor_mono[OF lr'])\n  from invariant_1_sub_interval[OF rc1 rc' bnd(1,2)] \n  have rc': \"invariant_1 (p, l', r')\"\n    and id': \"the_unique_root (p, l', r') = the_unique_root (p, l, r)\" by auto\n  with rc have rc2': \"invariant_1_2 (p, l', r')\" by auto\n  have x: \"?x = the_unique_root (p,l',r')\"\n    unfolding fields using id' by simp\n  {\n    assume \"?fr \\<noteq> ?fl\"\n    with flr have flr: \"?fl \\<le> ?fr - 1\" by simp\n    have \"?fr' \\<le> r'\"  \"l' \\<le> ?fr'\" using flr bnd by linarith+\n  } note fl_diff = this\n  show ?thesis\n  proof (cases \"?fr = ?fl\")\n    case True\n    hence id1: \"floor_1 x = ?fr\" unfolding id by auto\n    from True have id: \"floor (?r l') = floor (?r r')\"\n      by simp\n    have \"floor ?x \\<le> floor (?r r')\"\n      by (rule floor_mono[OF ineq(2)])\n    moreover have \"floor (?r l') \\<le> floor ?x\"\n      by (rule floor_mono[OF ineq(1)])\n    ultimately have \"floor ?x = floor (?r r')\"\n      unfolding id by (simp add: id)\n    then show ?thesis by (simp add: id1)\n  next\n    case False\n    with id have id: \"floor_1 x = (if ?fr' < l'' then ?fr else ?fl)\" by simp\n    from rc2' have \"unique_root (p,l',r')\" \"poly_cond2 p\" by auto\n    from tighten_poly_bounds_for_x[OF this tbx sr']\n    have ineq': \"l' \\<le> l''\" \"r'' \\<le> r'\" and lr'': \"l'' \\<le> r''\" and rc'': \"root_cond (p,l'',r'') ?x\"\n      and fr': \"\\<not> (l'' \\<le> ?fr' \\<and> ?fr' \\<le> r'')\" unfolding x by auto\n    from rc''[unfolded split]\n    have ineq'': \"?r l'' \\<le> ?x\" \"?x \\<le> ?r r''\" by auto\n    from False have \"?fr \\<noteq> ?fl\" by auto\n    note fr = fl_diff[OF this]\n    show ?thesis\n    proof (cases \"?fr' < l''\")\n      case True\n      with id have id: \"floor_1 x = ?fr\" by simp \n      have \"floor ?x \\<le> ?fr\" using floor_mono[OF ineq(2)] by simp\n      moreover\n      from True have \"?r ?fr' < ?r l''\" unfolding of_rat_less .\n      with ineq''(1) have \"?r ?fr' \\<le> ?x\" by simp\n      from floor_mono[OF this]\n      have \"?fr \\<le> floor ?x\" by simp \n      ultimately show ?thesis unfolding id by auto\n    next\n      case False\n      with id have id: \"floor_1 x = ?fl\" by simp\n      from False have \"l'' \\<le> ?fr'\" by auto\n      from floor_mono[OF ineq(1)] have \"?fl \\<le> floor ?x\" by simp\n      moreover have \"floor ?x \\<le> ?fl\"\n      proof -\n        from False fr' have fr': \"r'' < ?fr'\" by auto\n        hence \"floor r'' < ?fr\" by linarith\n        with floor_mono[OF ineq''(2)] \n        have \"floor ?x \\<le> ?fr - 1\" by auto\n        also have \"?fr - 1 = floor (r' - 1)\" by simp\n        also have \"\\<dots> \\<le> ?fl\"\n          by (rule floor_mono, insert bnd, auto)\n        finally show ?thesis .\n      qed\n      ultimately show ?thesis unfolding id by auto\n    qed\n  qed\nqed\n\n(* ********************* *)\nsubsubsection\\<open>Generic Factorization and Bisection Framework\\<close>\n\nlemma card_1_Collect_ex1: assumes \"card (Collect P) = 1\"\n  shows \"\\<exists>! x. P x\"\nproof -\n  from assms[unfolded card_eq_1_iff] obtain x where \"Collect P = {x}\" by auto\n  thus ?thesis\n    by (intro ex1I[of _ x], auto)\nqed\n\nfun sub_interval :: \"rat \\<times> rat \\<Rightarrow> rat \\<times> rat \\<Rightarrow> bool\" where\n  \"sub_interval (l,r) (l',r') = (l' \\<le> l \\<and> r \\<le> r')\"\n\nfun in_interval :: \"rat \\<times> rat \\<Rightarrow> real \\<Rightarrow> bool\" where \n  \"in_interval (l,r) x = (of_rat l \\<le> x \\<and> x \\<le> of_rat r)\" \n\ndefinition converges_to :: \"(nat \\<Rightarrow> rat \\<times> rat) \\<Rightarrow> real \\<Rightarrow> bool\" where\n  \"converges_to f x \\<equiv> (\\<forall> n. in_interval (f n) x \\<and> sub_interval (f (Suc n)) (f n))\n   \\<and> (\\<forall> (eps :: real) > 0. \\<exists> n l r. f n = (l,r) \\<and> of_rat r - of_rat l \\<le> eps)\"\n\ncontext\n  fixes bnd_update :: \"'a \\<Rightarrow> 'a\" \n  and bnd_get :: \"'a \\<Rightarrow> rat \\<times> rat\"\nbegin\n\ndefinition at_step :: \"(nat \\<Rightarrow> rat \\<times> rat) \\<Rightarrow> nat \\<Rightarrow> 'a \\<Rightarrow> bool\" where\n  \"at_step f n a \\<equiv> \\<forall> i. bnd_get ((bnd_update ^^ i) a) = f (n + i)\"\n\npartial_function (tailrec) select_correct_factor_main\n  :: \"'a \\<Rightarrow> (int poly \\<times> root_info)list \\<Rightarrow> (int poly \\<times> root_info)list\n    \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow> nat \\<Rightarrow> (int poly \\<times> root_info) \\<times> rat \\<times> rat\" where\n  [code]: \"select_correct_factor_main bnd todo old l r n = (case todo of Nil\n    \\<Rightarrow> if n = 1 then (hd old, l, r) else let bnd' = bnd_update bnd in (case bnd_get bnd' of (l,r) \\<Rightarrow> \n      select_correct_factor_main bnd' old [] l r 0)\n   | Cons (p,ri) todo \\<Rightarrow> let m = root_info.l_r ri l r in \n      if m = 0 then select_correct_factor_main bnd todo old l r n\n      else select_correct_factor_main bnd todo ((p,ri) # old) l r (n + m))\"\n\ndefinition select_correct_factor :: \"'a \\<Rightarrow> (int poly \\<times> root_info)list \\<Rightarrow>\n    (int poly \\<times> root_info) \\<times> rat \\<times> rat\" where\n  \"select_correct_factor init polys = (case bnd_get init of (l,r) \\<Rightarrow>\n    select_correct_factor_main init polys [] l r 0)\"\n\nlemma select_correct_factor_main: assumes conv: \"converges_to f x\"\n  and at: \"at_step f i a\"\n  and res: \"select_correct_factor_main a todo old l r n = ((q,ri_fin),(l_fin,r_fin))\"\n  and bnd: \"bnd_get a = (l,r)\"\n  and ri: \"\\<And> q ri. (q,ri) \\<in> set todo \\<union> set old \\<Longrightarrow> root_info_cond ri q\"\n  and q0: \"\\<And> q ri. (q,ri) \\<in> set todo \\<union> set old \\<Longrightarrow> q \\<noteq> 0\"\n  and ex: \"\\<exists>q. q \\<in> fst ` set todo \\<union> fst ` set old \\<and> ipoly q x = 0\"\n  and dist: \"distinct (map fst (todo @ old))\"\n  and old: \"\\<And> q ri. (q,ri) \\<in> set old \\<Longrightarrow> root_info.l_r ri l r \\<noteq> 0\"\n  and un: \"\\<And> x :: real. (\\<exists>q. q \\<in> fst ` set todo \\<union> fst ` set old \\<and> ipoly q x = 0) \\<Longrightarrow> \n    \\<exists>!q. q \\<in> fst ` set todo \\<union> fst ` set old \\<and> ipoly q x = 0\"\n  and n: \"n = sum_list (map (\\<lambda> (q,ri). root_info.l_r ri l r) old)\"\n  shows \"unique_root (q,l_fin,r_fin) \\<and> (q,ri_fin) \\<in> set todo \\<union> set old \\<and> x = the_unique_root (q,l_fin,r_fin)\"\nproof -\n  define orig where \"orig = set todo \\<union> set old\"\n  have orig: \"set todo \\<union> set old \\<subseteq> orig\" unfolding orig_def by auto\n  let ?rts = \"{x :: real. \\<exists> q ri. (q,ri) \\<in> orig \\<and> ipoly q x = 0}\"\n  define rts where \"rts = ?rts\"\n  let ?h = \"\\<lambda> (x,y). abs (x - y)\" \n  let ?r = real_of_rat\n  have rts: \"?rts = (\\<Union> ((\\<lambda> (q,ri). {x. ipoly q x = 0}) ` set (todo @ old)))\" unfolding orig_def by auto\n  have \"finite rts\" unfolding rts rts_def\n    using finite_ipoly_roots[OF q0] finite_set[of \"todo @ old\"] by auto  \n  hence fin: \"finite (rts \\<times> rts - Id)\" by auto   \n  define diffs where \"diffs = insert 1 {abs (x - y) | x y. x \\<in> rts \\<and> y \\<in> rts \\<and> x \\<noteq> y}\"\n  have \"finite {abs (x - y) | x y. x \\<in> rts \\<and> y \\<in> rts \\<and> x \\<noteq> y}\"\n    by (rule subst[of _ _ finite, OF _ finite_imageI[OF fin, of ?h]], auto)\n  hence diffs: \"finite diffs\" \"diffs \\<noteq> {}\" unfolding diffs_def by auto\n  define eps where \"eps = Min diffs / 2\"\n  have \"\\<And> x. x \\<in> diffs \\<Longrightarrow> x > 0\" unfolding diffs_def by auto\n  with Min_gr_iff[OF diffs] have eps: \"eps > 0\" unfolding eps_def by auto\n  note conv = conv[unfolded converges_to_def] \n  from conv eps obtain N L R where \n    N: \"f N = (L,R)\" \"?r R - ?r L \\<le> eps\" by auto\n  obtain pair where pair: \"pair = (todo,i)\" by auto\n  define rel where \"rel = measures [ \\<lambda> (t,i). N - i, \\<lambda> (t :: (int poly \\<times> root_info) list,i). length t]\"\n  have wf: \"wf rel\" unfolding rel_def by simp\n  show ?thesis\n    using at res bnd ri q0 ex dist old un n pair orig\n  proof (induct pair arbitrary: todo i old a l r n rule: wf_induct[OF wf])\n    case (1 pair todo i old a l r n)\n    note IH = 1(1)[rule_format]\n    note at = 1(2)\n    note res = 1(3)[unfolded select_correct_factor_main.simps[of _ todo]]\n    note bnd = 1(4)\n    note ri = 1(5)\n    note q0 = 1(6)\n    note ex = 1(7)\n    note dist = 1(8)\n    note old = 1(9)\n    note un = 1(10)\n    note n = 1(11)\n    note pair = 1(12)\n    note orig = 1(13)\n    from at[unfolded at_step_def, rule_format, of 0] bnd have fi: \"f i = (l,r)\" by auto\n    with conv have inx: \"in_interval (f i) x\" by blast\n    hence lxr: \"?r l \\<le> x\" \"x \\<le> ?r r\" unfolding fi by auto\n    from order.trans[OF this] have lr: \"l \\<le> r\" unfolding of_rat_less_eq .\n    show ?case \n    proof (cases todo)\n      case (Cons rri tod)\n      obtain s ri where rri: \"rri = (s,ri)\" by force\n      with Cons have todo: \"todo = (s,ri) # tod\" by simp\n      note res = res[unfolded todo list.simps split Let_def]\n      from root_info_condD(1)[OF ri[of s ri, unfolded todo] lr]\n      have ri': \"root_info.l_r ri l r = card {x. root_cond (s, l, r) x}\" by auto\n      from q0 have s0: \"s \\<noteq> 0\" unfolding todo by auto\n      from finite_ipoly_roots[OF s0] have fins: \"finite {x. root_cond (s, l, r) x}\" \n        unfolding root_cond_def by auto\n      have rel: \"((tod,i), pair) \\<in> rel\" unfolding rel_def pair todo by simp\n      show ?thesis\n      proof (cases \"root_info.l_r ri l r = 0\")\n        case True\n        with res have res: \"select_correct_factor_main a tod old l r n = ((q, ri_fin), l_fin, r_fin)\" by auto\n        from ri'[symmetric, unfolded True] fins have empty: \"{x. root_cond (s, l, r) x} = {}\" by simp\n        from ex lxr empty have ex': \"(\\<exists>q. q \\<in> fst ` set tod \\<union> fst ` set old \\<and> ipoly q x = 0)\"\n          unfolding todo root_cond_def split by auto\n        have \"unique_root (q, l_fin, r_fin) \\<and> (q, ri_fin) \\<in> set tod \\<union> set old \\<and> \n          x = the_unique_root (q, l_fin, r_fin)\"\n        proof (rule IH[OF rel at res bnd ri _ ex' _ _ _ n refl], goal_cases)\n          case (5 y) thus ?case using un[of y] unfolding todo by auto\n        next\n          case 2 thus ?case using q0 unfolding todo by auto\n        qed (insert dist old orig, auto simp: todo)\n        thus ?thesis unfolding todo by auto\n      next\n        case False\n        with res have res: \"select_correct_factor_main a tod ((s, ri) # old) l r \n          (n + root_info.l_r ri l r) = ((q, ri_fin), l_fin, r_fin)\" by auto\n        from ex have ex': \"\\<exists>q. q \\<in> fst ` set tod \\<union> fst ` set ((s, ri) # old) \\<and> ipoly q x = 0\"\n          unfolding todo by auto\n        from dist have dist: \"distinct (map fst (tod @ (s, ri) # old))\" unfolding todo by auto\n        have id: \"set todo \\<union> set old = set tod \\<union> set ((s, ri) # old)\" unfolding todo by simp\n        show ?thesis unfolding id\n        proof (rule IH[OF rel at res bnd ri _ ex' dist], goal_cases)\n          case 4 thus ?case using un unfolding todo by auto\n        qed (insert old False orig, auto simp: q0 todo n)\n      qed\n    next\n      case Nil\n      note res = res[unfolded Nil list.simps Let_def]\n      from ex[unfolded Nil] lxr obtain s where \"s \\<in> fst ` set old \\<and> root_cond (s,l,r) x\"\n        unfolding root_cond_def by auto\n      then obtain q1 ri1 old' where old': \"old = (q1,ri1) # old'\" using id by (cases old, auto)\n      let ?ri = \"root_info.l_r ri1 l r\"\n      from old[unfolded old'] have 0: \"?ri \\<noteq> 0\" by auto\n      from n[unfolded old'] 0 have n0: \"n \\<noteq> 0\" by auto\n      from ri[unfolded old'] have ri': \"root_info_cond ri1 q1\" by auto\n      show ?thesis\n      proof (cases \"n = 1\")\n        case False\n        with n0 have n1: \"n > 1\" by auto\n        obtain l' r' where bnd': \"bnd_get (bnd_update a) = (l',r')\" by force        \n        with res False have res: \"select_correct_factor_main (bnd_update a) old [] l' r' 0 =\n          ((q, ri_fin), l_fin, r_fin)\" by auto\n        have at': \"at_step f (Suc i) (bnd_update a)\" unfolding at_step_def\n        proof (intro allI, goal_cases)\n          case (1 n)\n          have id: \"(bnd_update ^^ Suc n) a = (bnd_update ^^ n) (bnd_update a)\"\n            by (induct n, auto)\n          from at[unfolded at_step_def, rule_format, of \"Suc n\"]\n          show ?case unfolding id by simp\n        qed\n        from 0[unfolded root_info_condD(1)[OF ri' lr]] obtain y1 where y1: \"root_cond (q1,l,r) y1\" \n          by (cases \"Collect (root_cond (q1, l, r)) = {}\", auto)\n        from n1[unfolded n old'] \n        have \"?ri > 1 \\<or> sum_list (map (\\<lambda> (q,ri). root_info.l_r ri l r) old') \\<noteq> 0\"\n          by (cases \"sum_list (map (\\<lambda> (q,ri). root_info.l_r ri l r) old')\", auto)\n        hence \"\\<exists> q2 ri2 y2. (q2,ri2) \\<in> set old \\<and> root_cond (q2,l,r) y2 \\<and> y1 \\<noteq> y2\"\n        proof\n          assume \"?ri > 1\"\n          with root_info_condD(1)[OF ri' lr] have \"card {x. root_cond (q1, l, r) x} > 1\" by simp\n          from card_gt_1D[OF this] y1 obtain y2 where \"root_cond (q1,l,r) y2\" and \"y1 \\<noteq> y2\" by auto\n          thus ?thesis unfolding old' by auto\n        next\n          assume \"sum_list (map (\\<lambda> (q,ri). root_info.l_r ri l r) old') \\<noteq> 0\"\n          then obtain q2 ri2 where mem: \"(q2,ri2) \\<in> set old'\" and ri2: \"root_info.l_r ri2 l r \\<noteq> 0\" by auto\n          with q0 ri have \"root_info_cond ri2 q2\" unfolding old' by auto\n          from ri2[unfolded root_info_condD(1)[OF this lr]] obtain y2 where y2: \"root_cond (q2,l,r) y2\"\n            by (cases \"Collect (root_cond (q2, l, r)) = {}\", auto)\n          from dist[unfolded old'] split_list[OF mem] have diff: \"q1 \\<noteq> q2\" by auto\n          from y1 have q1: \"q1 \\<in> fst ` set todo \\<union> fst ` set old \\<and> ipoly q1 y1 = 0\"\n            unfolding old' root_cond_def by auto\n          from y2 have q2: \"q2 \\<in> fst ` set todo \\<union> fst ` set old \\<and> ipoly q2 y2 = 0\"\n            unfolding old' root_cond_def using mem by force\n          have \"y1 \\<noteq> y2\"\n          proof\n            assume id: \"y1 = y2\"\n            from q1 have \"\\<exists> q1. q1 \\<in> fst ` set todo \\<union> fst ` set old \\<and> ipoly q1 y1 = 0\" by blast\n            from un[OF this] q1 q2[folded id] have \"q1 = q2\" by auto\n            with diff show False by simp\n          qed\n          with mem y2 show ?thesis unfolding old' by auto\n        qed\n        then obtain q2 ri2 y2 where \n          mem2: \"(q2,ri2) \\<in> set old\" and y2: \"root_cond (q2,l,r) y2\" and diff: \"y1 \\<noteq> y2\" by auto\n        from mem2 orig have \"(q1,ri1) \\<in> orig\" \"(q2,ri2) \\<in> orig\"  unfolding old' by auto\n        with y1 y2 diff have \"abs (y1 - y2) \\<in> diffs\" unfolding diffs_def rts_def root_cond_def by auto\n        from Min_le[OF diffs(1) this] have \"abs (y1 - y2) \\<ge> 2 * eps\" unfolding eps_def by auto\n        with eps have eps: \"abs (y1 - y2) > eps\" by auto\n        from y1 y2 have l: \"of_rat l \\<le> min y1 y2\" unfolding root_cond_def by auto\n        from y1 y2 have r: \"of_rat r \\<ge> max y1 y2\" unfolding root_cond_def by auto\n        from l r eps have eps: \"of_rat r - of_rat l > eps\" by auto\n        have \"i < N\" \n        proof (rule ccontr)\n          assume \"\\<not> i < N\"\n          hence \"\\<exists> k. i = N + k\" by presburger\n          then obtain k where i: \"i = N + k\" by auto\n          {\n            fix k l r\n            assume \"f (N + k) = (l,r)\"\n            hence \"of_rat r - of_rat l \\<le> eps\"\n            proof (induct k arbitrary: l r)\n              case 0\n              with N show ?case by auto\n            next\n              case (Suc k l r)\n              obtain l' r' where f: \"f (N + k) = (l',r')\" by force\n              from Suc(1)[OF this] have IH: \"?r r' - ?r l' \\<le> eps\" by auto\n              from f Suc(2) conv[THEN conjunct1, rule_format, of \"N + k\"] \n              have \"?r l \\<ge> ?r l'\" \"?r r \\<le> ?r r'\"\n                by (auto simp: of_rat_less_eq)\n              thus ?case using IH by auto\n            qed\n          } note * = this\n          from at[unfolded at_step_def i, rule_format, of 0] bnd  have \"f (N + k) = (l,r)\" by auto\n          from *[OF this] eps\n          show False by auto\n        qed\n        hence rel: \"((old, Suc i), pair) \\<in> rel\" unfolding pair rel_def by auto\n        from dist have dist: \"distinct (map fst (old @ []))\" unfolding Nil by auto\n        have id: \"set todo \\<union> set old = set old \\<union> set []\" unfolding Nil by auto\n        show ?thesis unfolding id\n        proof (rule IH[OF rel at' res bnd' ri _ _ dist _ _ _ refl], goal_cases)\n          case 2 thus ?case using q0 by auto\n        qed (insert ex un orig Nil, auto)\n      next\n        case True\n        with res old' have id: \"q = q1\" \"ri_fin = ri1\" \"l_fin = l\" \"r_fin = r\" by auto\n        from n[unfolded True old'] 0 have 1: \"?ri = 1\" \n          by (cases ?ri; cases \"?ri - 1\", auto)\n        from root_info_condD(1)[OF ri' lr] 1 have \"card {x. root_cond (q1,l,r) x} = 1\" by auto\n        from card_1_Collect_ex1[OF this]\n        have unique: \"unique_root (q1,l,r)\" .\n        from ex[unfolded Nil old'] consider (A) \"ipoly q1 x = 0\" \n          | (B) q where \"q \\<in> fst ` set old'\" \"ipoly q x = 0\" by auto\n        hence \"x = the_unique_root (q1,l,r)\"\n        proof (cases)\n          case A\n          with lxr have \"root_cond (q1,l,r) x\" unfolding root_cond_def by auto\n          from the_unique_root_eqI[OF unique this] show ?thesis by simp\n        next\n          case (B q)\n          with lxr have \"root_cond (q,l,r) x\" unfolding root_cond_def by auto\n          hence empty: \"{x. root_cond (q,l,r) x} \\<noteq> {}\" by auto\n          from B(1) obtain ri' where mem: \"(q,ri') \\<in> set old'\" by force\n          from q0[unfolded old'] mem have q0: \"q \\<noteq> 0\" by auto\n          from finite_ipoly_roots[OF this] have \"finite {x. root_cond (q,l,r) x}\" \n            unfolding root_cond_def by auto\n          with empty have card: \"card {x. root_cond (q,l,r) x} \\<noteq> 0\" by simp\n          from ri[unfolded old'] mem have \"root_info_cond ri' q\" by auto\n          from root_info_condD(1)[OF this lr] card have \"root_info.l_r ri' l r \\<noteq> 0\" by auto\n          with n[unfolded True old'] 1 split_list[OF mem] have False by auto\n          thus ?thesis by simp\n        qed\n        thus ?thesis unfolding id using unique ri' unfolding old' by auto\n      qed\n    qed\n  qed\nqed\n\nlemma select_correct_factor: assumes \n      conv: \"converges_to (\\<lambda> i. bnd_get ((bnd_update ^^ i) init)) x\"\n  and res: \"select_correct_factor init polys = ((q,ri),(l,r))\"\n  and ri: \"\\<And> q ri. (q,ri) \\<in> set polys \\<Longrightarrow> root_info_cond ri q\"\n  and q0: \"\\<And> q ri. (q,ri) \\<in> set polys \\<Longrightarrow> q \\<noteq> 0\"\n  and ex: \"\\<exists>q. q \\<in> fst ` set polys \\<and> ipoly q x = 0\"\n  and dist: \"distinct (map fst polys)\"\n  and un: \"\\<And> x :: real. (\\<exists>q. q \\<in> fst ` set polys \\<and> ipoly q x = 0) \\<Longrightarrow> \n    \\<exists>!q. q \\<in> fst ` set polys \\<and> ipoly q x = 0\"\n  shows \"unique_root (q,l,r) \\<and> (q,ri) \\<in> set polys \\<and> x = the_unique_root (q,l,r)\"\nproof -\n  obtain l' r' where init: \"bnd_get init = (l',r')\" by force\n  from res[unfolded select_correct_factor_def init split]\n  have res: \"select_correct_factor_main init polys [] l' r' 0 = ((q, ri), l, r)\" by auto\n  have at: \"at_step (\\<lambda> i. bnd_get ((bnd_update ^^ i) init)) 0 init\" unfolding at_step_def by auto\n  have \"unique_root (q,l,r) \\<and> (q,ri) \\<in> set polys \\<union> set [] \\<and> x = the_unique_root (q,l,r)\"\n    by (rule select_correct_factor_main[OF conv at res init ri], insert dist un ex q0, auto)\n  thus ?thesis by auto\nqed\n\ndefinition real_alg_2' :: \"root_info \\<Rightarrow> int poly \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow> real_alg_2\" where\n  [code del]: \"real_alg_2' ri p l r = (\n    if degree p = 1 then Rational (Rat.Fract (- coeff p 0) (coeff p 1)) else\n    real_alg_2_main ri (case tighten_poly_bounds_for_x p 0 l r (sgn (ipoly p r)) of\n              (l',r',sr') \\<Rightarrow> (p, l', r')))\"\n\nlemma real_alg_2'_code[code]: \"real_alg_2' ri p l r =\n (if degree p = 1 then Rational (Rat.Fract (- coeff p 0) (coeff p 1))\n     else case normalize_bounds_1\n        (case tighten_poly_bounds_for_x p 0 l r (sgn (ipoly p r)) of (l', r', sr') \\<Rightarrow> (p, l', r')) \n     of (p', l, r) \\<Rightarrow> Irrational (root_info.number_root ri r) (p', l, r))\"  \n  unfolding real_alg_2'_def real_alg_2_main_def\n  by (cases \"tighten_poly_bounds_for_x p 0 l r (sgn (ipoly p r))\", simp add: Let_def)\n    \ndefinition real_alg_2'' :: \"root_info \\<Rightarrow> int poly \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow> real_alg_2\" where\n  \"real_alg_2'' ri p l r = (case normalize_bounds_1\n        (case tighten_poly_bounds_for_x p 0 l r (sgn (ipoly p r)) of (l', r', sr') \\<Rightarrow> (p, l', r')) \n     of (p', l, r) \\<Rightarrow> Irrational (root_info.number_root ri r) (p', l, r))\" \n\nlemma real_alg_2'': \"degree p \\<noteq> 1 \\<Longrightarrow> real_alg_2'' ri p l r = real_alg_2' ri p l r\" \n  unfolding real_alg_2'_code real_alg_2''_def by auto\n  \nlemma poly_cond_degree_0_imp_no_root:\n  fixes x :: \"'b :: {comm_ring_1,ring_char_0}\"\n  assumes pc: \"poly_cond p\" and deg: \"degree p = 0\" shows \"ipoly p x \\<noteq> 0\"\nproof\n  from pc have \"p \\<noteq> 0\" by auto\n  moreover assume \"ipoly p x = 0\"\n    note poly_zero[OF this]\n  ultimately show False using deg by auto\nqed\n\nlemma real_alg_2':\n  assumes ur: \"unique_root (q,l,r)\" and pc: \"poly_cond q\" and ri: \"root_info_cond ri q\"\n  shows \"invariant_2 (real_alg_2' ri q l r) \\<and> real_of_2 (real_alg_2' ri q l r) = the_unique_root (q,l,r)\" (is \"_ \\<and> _ = ?x\")\nproof (cases \"degree q\" \"Suc 0\" rule: linorder_cases)\n  case deg: less\n  then have \"degree q = 0\" by auto\n  from poly_cond_degree_0_imp_no_root[OF pc this] ur have False by force\n  then show ?thesis by auto\nnext\n  case deg: equal\n  hence id: \"real_alg_2' ri q l r = Rational (Rat.Fract (- coeff q 0) (coeff q 1))\" \n    unfolding real_alg_2'_def by auto\n  show ?thesis unfolding id using degree_1_ipoly[OF deg]\n    using unique_rootD(4)[OF ur] by auto\nnext\n  case deg: greater\n  with pc have pc2: \"poly_cond2 q\" by auto\n  let ?rai = \"real_alg_2' ri q l r\"\n  let ?r = real_of_rat\n  obtain l' r' sr' where tight: \"tighten_poly_bounds_for_x q 0 l r (sgn (ipoly q r)) = (l',r',sr')\" \n    by (cases rule: prod_cases3, auto)\n  let ?rai' = \"(q, l', r')\" \n  have rai': \"?rai = real_alg_2_main ri ?rai'\"\n    unfolding real_alg_2'_def using deg tight by auto\n  hence rai: \"real_of_1 ?rai' = the_unique_root (q,l',r')\" by auto\n  note tight = tighten_poly_bounds_for_x[OF ur pc2 tight refl]\n  let ?x = \"the_unique_root (q, l, r)\"\n  from tight have tight: \"root_cond (q,l',r') ?x\" \"l \\<le> l'\" \"l' \\<le> r'\" \"r' \\<le> r\" \"l' > 0 \\<or> r' < 0\" by auto\n  from unique_root_sub_interval[OF ur tight(1) tight(2,4)] poly_condD[OF pc]\n  have ur': \"unique_root (q, l', r')\" and x: \"?x = the_unique_root (q,l',r')\" by auto\n  from tight(2-) have sgn: \"sgn l' = sgn r'\" by auto\n  show ?thesis unfolding rai' using real_alg_2_main[of ?rai' ri] invariant_1_realI[of ?rai' ?x]\n    by (auto simp: tight(1) sgn pc ri ur')\nqed\n\ndefinition select_correct_factor_int_poly :: \"'a \\<Rightarrow> int poly \\<Rightarrow> real_alg_2\" where\n  \"select_correct_factor_int_poly init p \\<equiv> \n     let qs = factors_of_int_poly p;\n         polys = map (\\<lambda> q. (q, root_info q)) qs;\n         ((q,ri),(l,r)) = select_correct_factor init polys\n      in real_alg_2' ri q l r\"\n\nlemma select_correct_factor_int_poly: assumes \n      conv: \"converges_to (\\<lambda> i. bnd_get ((bnd_update ^^ i) init)) x\"\n  and rai: \"select_correct_factor_int_poly init p = rai\"\n  and x: \"ipoly p x = 0\"\n  and p: \"p \\<noteq> 0\"\n  shows \"invariant_2 rai \\<and> real_of_2 rai = x\"\nproof -\n  obtain qs where fact: \"factors_of_int_poly p = qs\" by auto\n  define polys where \"polys = map (\\<lambda> q. (q, root_info q)) qs\"\n  obtain q ri l r where res: \"select_correct_factor init polys = ((q,ri),(l,r))\"\n    by (cases \"select_correct_factor init polys\", auto)\n  have fst: \"map fst polys = qs\" \"fst ` set polys = set qs\" unfolding polys_def map_map o_def \n    by force+\n  note fact' = factors_of_int_poly[OF fact]\n  note rai = rai[unfolded select_correct_factor_int_poly_def Let_def fact, \n    folded polys_def, unfolded res split]\n  from fact' fst have dist: \"distinct (map fst polys)\" by auto\n  from fact'(2)[OF p, of x] x fst \n  have ex: \"\\<exists>q. q \\<in> fst ` set polys \\<and> ipoly q x = 0\" by auto\n  {\n    fix q ri\n    assume \"(q,ri) \\<in> set polys\"\n    hence ri: \"ri = root_info q\" and q: \"q \\<in> set qs\" unfolding polys_def by auto\n    from fact'(1)[OF q] have *: \"lead_coeff q > 0\" \"irreducible q\" \"degree q > 0\" by auto\n    from * have q0: \"q \\<noteq> 0\" by auto\n    from root_info[OF *(2-3)] ri have ri: \"root_info_cond ri q\" by auto\n    note ri q0 *\n  } note polys = this\n  have \"unique_root (q, l, r) \\<and> (q, ri) \\<in> set polys \\<and> x = the_unique_root (q, l, r)\"\n    by (rule select_correct_factor[OF conv res polys(1) _ ex dist, unfolded fst, OF _ _ fact'(3)[OF p]],\n    insert fact'(2)[OF p] polys(2), auto)\n  hence ur: \"unique_root (q,l,r)\" and mem: \"(q,ri) \\<in> set polys\" and x: \"x = the_unique_root (q,l,r)\" by auto\n  note polys = polys[OF mem]\n  from polys(3-4) have ty: \"poly_cond q\" by (simp add: poly_cond_def)\n  show ?thesis unfolding x rai[symmetric] by (intro real_alg_2' ur ty polys(1))\nqed\nend\n\n(* ********************* *)\nsubsubsection\\<open>Addition\\<close>\n\nlemma ipoly_0_0[simp]: \"ipoly f (0::'a::{comm_ring_1,ring_char_0}) = 0 \\<longleftrightarrow> poly f 0 = 0\"\n  unfolding poly_0_coeff_0 by simp\n\nlemma add_rat_roots_below[simp]: \"roots_below (poly_add_rat r p) x = (\\<lambda>y. y + of_rat r) ` roots_below p (x - of_rat r)\"\nproof (unfold add_rat_roots image_def, intro Collect_eqI, goal_cases)\n  case (1 y) then show ?case by (auto intro: exI[of _ \"y - real_of_rat r\"])\nqed\n\nlemma add_rat_root_cond:\n  shows \"root_cond (cf_pos_poly (poly_add_rat m p),l,r) x = root_cond (p, l - m, r - m) (x - of_rat m)\"\n  by (unfold root_cond_def, auto simp add: add_rat_roots hom_distribs)\n\nlemma add_rat_unique_root: \"unique_root (cf_pos_poly (poly_add_rat m p), l, r) = unique_root (p, l-m, r-m)\"\n  by (auto simp: add_rat_root_cond)\n\nfun add_rat_1 :: \"rat \\<Rightarrow> real_alg_1 \\<Rightarrow> real_alg_1\" where\n  \"add_rat_1 r1 (p2,l2,r2) = (\n    let p = cf_pos_poly (poly_add_rat r1 p2);\n      (l,r,sr) = tighten_poly_bounds_for_x p 0 (l2+r1) (r2+r1) (sgn (ipoly p (r2+r1)))\n    in\n    (p,l,r))\"\n\nlemma poly_real_alg_1_add_rat[simp]:\n  \"poly_real_alg_1 (add_rat_1 r y) = cf_pos_poly (poly_add_rat r (poly_real_alg_1 y))\"\n  by (cases y, auto simp: Let_def split: prod.split)\n\nlemma sgn_cf_pos:\n  assumes \"lead_coeff p > 0\" shows \"sgn (ipoly (cf_pos_poly p) (x::'a::linordered_field)) = sgn (ipoly p x)\"\nproof (cases \"p = 0\")\n  case True with assms show ?thesis by auto\nnext\n  case False\n  from cf_pos_poly_main False obtain d where p': \"Polynomial.smult d (cf_pos_poly p) = p\" by auto\n  have \"d > 0\"\n  proof (rule zero_less_mult_pos2)\n    from False assms have \"0 < lead_coeff p\" by (auto simp: cf_pos_def)\n    also from p' have \"\\<dots> = d * lead_coeff (cf_pos_poly p)\" by (metis lead_coeff_smult)\n    finally show \"0 < \\<dots>\".\n    show \"lead_coeff (cf_pos_poly p) > 0\" using False by (unfold lead_coeff_cf_pos_poly)\n  qed\n  moreover from p' have \"ipoly p x = of_int d * ipoly (cf_pos_poly p) x\"\n    by (fold poly_smult of_int_hom.map_poly_hom_smult, auto)\n  ultimately show ?thesis by (auto simp: sgn_mult[where 'a='a])\nqed\n\nlemma add_rat_1: fixes r1 :: rat assumes inv_y: \"invariant_1_2 y\"\n  defines \"z \\<equiv> add_rat_1 r1 y\"\n  shows \"invariant_1_2 z \\<and> (real_of_1 z = of_rat r1 + real_of_1 y)\"\nproof (cases y)\n  case y_def: (fields p2 l2 r2)\n  define p where \"p \\<equiv> cf_pos_poly (poly_add_rat r1 p2)\"\n  obtain l r sr where lr: \"tighten_poly_bounds_for_x p 0 (l2+r1) (r2+r1) (sgn (ipoly p (r2+r1))) = (l,r,sr)\"\n    by (metis surj_pair)\n  from lr have z: \"z = (p,l,r)\" by (auto simp: y_def z_def p_def Let_def)\n  from inv_y have ur: \"unique_root (p, l2 + r1, r2 + r1)\"\n    by (auto simp: p_def add_rat_root_cond y_def add_rat_unique_root)\n  from inv_y[unfolded y_def invariant_1_2_def,simplified] have pc2: \"poly_cond2 p\"\n    unfolding p_def\n    apply (intro poly_cond2I poly_add_rat_irreducible poly_condI, unfold lead_coeff_cf_pos_poly)\n    apply (auto elim!: invariant_1E)\n   done\n  note main = tighten_poly_bounds_for_x[OF ur pc2 lr refl, simplified]\n  then have \"sgn l = sgn r\" unfolding sgn_if apply simp apply linarith done\n  from invariant_1_2_realI[OF main(4) _ main(7), simplified, OF this pc2] main(1-3) ur\n  show ?thesis by (auto simp: z p_def y_def add_rat_root_cond ex1_the_shift)\nqed\n\nfun tighten_poly_bounds_binary :: \"int poly \\<Rightarrow> int poly \\<Rightarrow> (rat \\<times> rat \\<times> rat) \\<times> rat \\<times> rat \\<times> rat \\<Rightarrow> (rat \\<times> rat \\<times> rat) \\<times> rat \\<times> rat \\<times> rat\"  where\n  \"tighten_poly_bounds_binary cr1 cr2 ((l1,r1,sr1),(l2,r2,sr2)) = \n     (tighten_poly_bounds cr1 l1 r1 sr1, tighten_poly_bounds cr2 l2 r2 sr2)\"\n\nlemma tighten_poly_bounds_binary:\n  assumes ur: \"unique_root (p1,l1,r1)\" \"unique_root (p2,l2,r2)\" and pt: \"poly_cond2 p1\" \"poly_cond2 p2\" \n  defines \"x \\<equiv> the_unique_root (p1,l1,r1)\" and \"y \\<equiv> the_unique_root (p2,l2,r2)\"\n  assumes bnd: \"\\<And> l1 r1 l2 r2 l r sr1 sr2. I l1 \\<Longrightarrow> I l2 \\<Longrightarrow> root_cond (p1,l1,r1) x \\<Longrightarrow> root_cond (p2,l2,r2) y \\<Longrightarrow>\n      bnd ((l1,r1,sr1),(l2,r2,sr2)) = (l,r) \\<Longrightarrow> of_rat l \\<le> f x y \\<and> f x y \\<le> of_rat r\"\n  and approx: \"\\<And> l1 r1 l2 r2 l1' r1' l2' r2' l l' r r' sr1 sr2 sr1' sr2'. \n    I l1 \\<Longrightarrow> I l2 \\<Longrightarrow>\n    l1 \\<le> r1 \\<Longrightarrow> l2 \\<le> r2 \\<Longrightarrow> \n    (l,r) = bnd ((l1,r1,sr1), (l2,r2,sr2)) \\<Longrightarrow>\n    (l',r') = bnd ((l1',r1',sr1'), (l2',r2',sr2')) \\<Longrightarrow>\n    (l1',r1') \\<in> {(l1,(l1+r1)/2),((l1+r1)/2,r1)} \\<Longrightarrow>\n    (l2',r2') \\<in> {(l2,(l2+r2)/2),((l2+r2)/2,r2)} \\<Longrightarrow>\n    (r' - l') \\<le> 3/4 * (r - l) \\<and> l \\<le> l' \\<and> r' \\<le> r\"\n  and I_mono: \"\\<And> l l'. I l \\<Longrightarrow> l \\<le> l' \\<Longrightarrow> I l'\"\n  and I: \"I l1\" \"I l2\" \n  and sr: \"sr1 = sgn (ipoly p1 r1)\" \"sr2 = sgn (ipoly p2 r2)\"\n  shows \"converges_to (\\<lambda> i. bnd ((tighten_poly_bounds_binary p1 p2 ^^ i) ((l1,r1,sr1),(l2,r2,sr2))))\n     (f x y)\"\nproof -\n  let ?upd = \"tighten_poly_bounds_binary p1 p2\"\n  define upd where \"upd = ?upd\"\n  define init where \"init = ((l1, r1, sr1), l2, r2, sr2)\"\n  let ?g = \"(\\<lambda>i. bnd ((upd ^^ i) init))\"\n  obtain l r where bnd_init: \"bnd init = (l,r)\" by force\n  note ur1 = unique_rootD[OF ur(1)]\n  note ur2 = unique_rootD[OF ur(2)]\n  from ur1(4) ur2(4) x_def y_def\n  have rc1: \"root_cond (p1,l1,r1) x\" and rc2: \"root_cond (p2,l2,r2) y\" by auto\n  define g where \"g = ?g\"\n  {\n    fix i L1 R1 L2 R2 L R j SR1 SR2\n    assume \"((upd ^^ i)) init = ((L1,R1,SR1),(L2,R2,SR2))\" \"g i = (L,R)\"\n    hence \"I L1 \\<and> I L2 \\<and> root_cond (p1,L1,R1) x \\<and> root_cond (p2,L2,R2) y \\<and>\n      unique_root (p1, L1, R1) \\<and> unique_root (p2, L2, R2) \\<and> in_interval (L,R) (f x y) \\<and> \n      (i = Suc j \\<longrightarrow> sub_interval (g i) (g j) \\<and> (R - L \\<le> 3/4 * (snd (g j) - fst (g j))))\n      \\<and> SR1 = sgn (ipoly p1 R1) \\<and> SR2 = sgn (ipoly p2 R2)\"\n    proof (induct i arbitrary: L1 R1 L2 R2 L R j SR1 SR2)\n      case 0\n      thus ?case using I rc1 rc2 ur bnd[of l1 l2 r1 r2 sr1 sr2 L R] g_def sr unfolding init_def by auto\n    next\n      case (Suc i)\n      obtain l1 r1 l2 r2 sr1 sr2 where updi: \"(upd ^^ i) init = ((l1, r1, sr1), l2, r2, sr2)\" by (cases \"(upd ^^ i) init\", auto)\n      obtain l r where bndi: \"bnd ((l1, r1, sr1), l2, r2, sr2) = (l,r)\" by force\n      hence gi: \"g i = (l,r)\" using updi unfolding g_def by auto\n      have \"(upd ^^ Suc i) init = upd ((l1, r1, sr1), l2, r2, sr2)\" using updi by simp\n      from Suc(2)[unfolded this] have upd: \"upd ((l1, r1, sr1), l2, r2, sr2) = ((L1, R1, SR1), L2, R2, SR2)\" .\n      from upd updi Suc(3) have bndsi: \"bnd ((L1, R1, SR1), L2, R2, SR2) = (L,R)\" by (auto simp: g_def)\n      from Suc(1)[OF updi gi] have I: \"I l1\" \"I l2\" \n        and rc: \"root_cond (p1,l1,r1) x\" \"root_cond (p2,l2,r2) y\"\n        and ur: \"unique_root (p1, l1, r1)\" \"unique_root (p2, l2, r2)\"\n        and sr: \"sr1 = sgn (ipoly p1 r1)\" \"sr2 = sgn (ipoly p2 r2)\" \n        by auto\n      from upd[unfolded upd_def] \n      have tight: \"tighten_poly_bounds p1 l1 r1 sr1 = (L1, R1, SR1)\" \"tighten_poly_bounds p2 l2 r2 sr2 = (L2, R2, SR2)\"\n        by auto\n      note tight1 = tighten_poly_bounds[OF tight(1) ur(1) pt(1) sr(1)]\n      note tight2 = tighten_poly_bounds[OF tight(2) ur(2) pt(2) sr(2)]\n      from tight1 have lr1: \"l1 \\<le> r1\" by auto\n      from tight2 have lr2: \"l2 \\<le> r2\" by auto\n      note ur1 = unique_rootD[OF ur(1)]\n      note ur2 = unique_rootD[OF ur(2)]\n      from tight1 I_mono[OF I(1)] have I1: \"I L1\" by auto\n      from tight2 I_mono[OF I(2)] have I2: \"I L2\" by auto\n      note ur1 = unique_root_sub_interval[OF ur(1) tight1(1,2,4)]\n      note ur2 = unique_root_sub_interval[OF ur(2) tight2(1,2,4)]\n      from rc(1) ur ur1 have x: \"x = the_unique_root (p1,L1,R1)\" by (auto intro!:the_unique_root_eqI)\n      from rc(2) ur ur2 have y: \"y = the_unique_root (p2,L2,R2)\" by (auto intro!:the_unique_root_eqI)\n      from unique_rootD[OF ur1(1)] x have x: \"root_cond (p1,L1,R1) x\" by auto\n      from unique_rootD[OF ur2(1)] y have y: \"root_cond (p2,L2,R2) y\" by auto\n      from tight(1) have half1: \"(L1, R1) \\<in> {(l1, (l1 + r1) / 2), ((l1 + r1) / 2, r1)}\"\n        unfolding tighten_poly_bounds_def Let_def by (auto split: if_splits)\n      from tight(2) have half2: \"(L2, R2) \\<in> {(l2, (l2 + r2) / 2), ((l2 + r2) / 2, r2)}\"\n        unfolding tighten_poly_bounds_def Let_def by (auto split: if_splits)\n      from approx[OF I lr1 lr2 bndi[symmetric] bndsi[symmetric] half1 half2]\n      have \"R - L \\<le> 3 / 4 * (r - l) \\<and> l \\<le> L \\<and> R \\<le> r\" .\n      hence \"sub_interval (g (Suc i)) (g i)\" \"R - L \\<le> 3/4 * (snd (g i) - fst (g i))\" \n        unfolding gi Suc(3) by auto\n      with bnd[OF I1 I2 x y bndsi]\n      show ?case using I1 I2 x y ur1 ur2 tight1(6) tight2(6) by auto\n    qed\n  } note invariants = this\n  define L where \"L = (\\<lambda> i. fst (g i))\"\n  define R where \"R = (\\<lambda> i. snd (g i))\"\n  {\n    fix i\n    obtain l1 r1 l2 r2 sr1 sr2 where updi: \"(upd ^^ i) init = ((l1, r1, sr1), l2, r2, sr2)\" by (cases \"(upd ^^ i) init\", auto)\n    obtain l r where bnd': \"bnd ((l1, r1, sr1), l2, r2, sr2) = (l,r)\" by force\n    have gi: \"g i = (l,r)\" unfolding g_def updi bnd' by auto\n    hence id: \"l = L i\" \"r = R i\" unfolding L_def R_def by auto\n    from invariants[OF updi gi[unfolded id]] \n    have \"in_interval (L i, R i) (f x y)\" \n      \"\\<And> j. i = Suc j \\<Longrightarrow> sub_interval (g i) (g j) \\<and> R i - L i \\<le> 3 / 4 * (R j - L j)\"\n      unfolding L_def R_def by auto\n  } note * = this\n  {\n    fix i\n    from *(1)[of i] *(2)[of \"Suc i\", OF refl]\n    have \"in_interval (g i) (f x y)\" \"sub_interval (g (Suc i)) (g i)\" \n      \"R (Suc i) - L (Suc i) \\<le> 3 / 4 * (R i - L i)\" unfolding L_def R_def by auto\n  } note * = this\n  show ?thesis unfolding upd_def[symmetric] init_def[symmetric] g_def[symmetric]\n    unfolding converges_to_def \n  proof (intro conjI allI impI, rule *(1), rule *(2))\n    fix eps :: real\n    assume eps: \"0 < eps\"\n    let ?r = real_of_rat \n    define r where \"r = (\\<lambda> n. ?r (R n))\" \n    define l where \"l = (\\<lambda> n. ?r (L n))\"\n    define diff where \"diff = (\\<lambda> n. r n - l n)\" \n    {\n      fix n\n      from *(3)[of n] have \"?r (R (Suc n) - L (Suc n)) \\<le> ?r (3 / 4 * (R n - L n))\"\n        unfolding of_rat_less_eq by simp\n      also have \"?r (R (Suc n) - L (Suc n)) = (r (Suc n) - l (Suc n))\"\n        unfolding of_rat_diff r_def l_def by simp\n      also have \"?r (3 / 4 * (R n - L n)) = 3 / 4 * (r n - l n)\" \n        unfolding r_def l_def by (simp add: hom_distribs)\n      finally have \"diff (Suc n) \\<le> 3 / 4 * diff n\" unfolding diff_def .\n    } note * = this\n    {\n      fix i\n      have \"diff i \\<le> (3/4)^i * diff 0\" \n      proof (induct i)\n        case (Suc i)\n        from Suc *[of i] show ?case by auto\n      qed auto\n    }\n    then obtain c where *: \"\\<And> i. diff i \\<le> (3/4)^i * c\" by auto\n    have \"\\<exists> n. diff n \\<le> eps\"\n    proof (cases \"c \\<le> 0\")\n      case True\n      with *[of 0] eps show ?thesis by (intro exI[of _ 0], auto)\n    next\n      case False  \n      hence c: \"c > 0\" by auto\n      with eps have \"inverse c * eps > 0\" by auto\n      from exp_tends_to_zero[of \"3/4 :: real\", OF _ _ this] obtain n where \n        \"(3/4) ^ n \\<le> inverse c * eps\" by auto\n      from mult_right_mono[OF this, of c] c\n      have \"(3/4) ^ n * c \\<le> eps\" by (auto simp: field_simps)\n      with *[of n] show ?thesis by (intro exI[of _ n], auto)\n    qed\n    then obtain n where \"?r (R n) - ?r (L n) \\<le> eps\" unfolding l_def r_def diff_def by blast\n    thus \"\\<exists>n l r. g n = (l, r) \\<and> ?r r - ?r l \\<le> eps\" unfolding L_def R_def by (intro exI[of _ n], force)\n  qed\nqed\n\nfun add_1 :: \"real_alg_1 \\<Rightarrow> real_alg_1 \\<Rightarrow> real_alg_2\" where\n  \"add_1 (p1,l1,r1) (p2,l2,r2) = (\n     select_correct_factor_int_poly\n       (tighten_poly_bounds_binary p1 p2)\n       (\\<lambda> ((l1,r1,sr1),(l2,r2,sr2)). (l1 + l2, r1 + r2))\n       ((l1,r1,sgn (ipoly p1 r1)),(l2,r2, sgn (ipoly p2 r2))) \n       (poly_add p1 p2))\"\n\nlemma add_1:\n  assumes x: \"invariant_1_2 x\" and y: \"invariant_1_2 y\"\n  defines z: \"z \\<equiv> add_1 x y\"\n  shows \"invariant_2 z \\<and> (real_of_2 z = real_of_1 x + real_of_1 y)\"\nproof (cases x)\n  case xt: (fields p1 l1 r1)\n  show ?thesis\n  proof (cases y)\n    case yt: (fields p2 l2 r2)\n    let ?x = \"real_of_1 (p1, l1, r1)\"\n    let ?y = \"real_of_1 (p2, l2, r2)\"\n    let ?p = \"poly_add p1 p2\"\n    note x = x[unfolded xt]\n    note y = y[unfolded yt]\n    from x have ax: \"p1 represents ?x\" unfolding represents_def by (auto elim!: invariant_1E)\n    from y have ay: \"p2 represents ?y\" unfolding represents_def by (auto elim!: invariant_1E)\n    let ?bnd = \"(\\<lambda>((l1, r1, sr1 :: rat), l2 :: rat, r2 :: rat, sr2 :: rat). (l1 + l2, r1 + r2))\"\n    define bnd where \"bnd = ?bnd\"\n    have \"invariant_2 z \\<and> real_of_2 z = ?x + ?y\"\n    proof (intro select_correct_factor_int_poly)\n      from represents_add[OF ax ay]\n      show \"?p \\<noteq> 0\" \"ipoly ?p (?x + ?y) = 0\" by auto\n      from z[unfolded xt yt]\n      show sel: \"select_correct_factor_int_poly\n          (tighten_poly_bounds_binary p1 p2)\n          bnd \n          ((l1,r1,sgn (ipoly p1 r1)),(l2,r2, sgn (ipoly p2 r2))) \n          (poly_add p1 p2) = z\" by (auto simp: bnd_def)\n      have ur1: \"unique_root (p1,l1,r1)\" \"poly_cond2 p1\" using x by auto\n      have ur2: \"unique_root (p2,l2,r2)\" \"poly_cond2 p2\" using y by auto\n      show \"converges_to\n        (\\<lambda>i. bnd ((tighten_poly_bounds_binary p1 p2 ^^ i)\n        ((l1,r1,sgn (ipoly p1 r1)),(l2,r2, sgn (ipoly p2 r2))))) (?x + ?y)\"\n        by (intro tighten_poly_bounds_binary ur1 ur2; force simp: bnd_def hom_distribs)\n    qed\n    thus ?thesis unfolding xt yt .\n  qed\nqed\n\ndeclare add_rat_1.simps[simp del]\ndeclare add_1.simps[simp del]\n\n(* ********************* *)\nsubsubsection\\<open>Multiplication\\<close>\n  \ncontext\nbegin\nprivate fun mult_rat_1_pos :: \"rat \\<Rightarrow> real_alg_1 \\<Rightarrow> real_alg_2\" where\n  \"mult_rat_1_pos r1 (p2,l2,r2) = real_alg_2 (cf_pos_poly (poly_mult_rat r1 p2), l2*r1, r2*r1)\"\n\nprivate fun mult_1_pos :: \"real_alg_1 \\<Rightarrow> real_alg_1 \\<Rightarrow> real_alg_2\" where\n  \"mult_1_pos (p1,l1,r1) (p2,l2,r2) =\n      select_correct_factor_int_poly \n        (tighten_poly_bounds_binary p1 p2)\n        (\\<lambda> ((l1,r1,sr1),(l2,r2,sr2)). (l1 * l2, r1 * r2))\n        ((l1,r1,sgn (ipoly p1 r1)),(l2,r2, sgn (ipoly p2 r2))) \n        (poly_mult p1 p2)\"\n\nfun mult_rat_1 :: \"rat \\<Rightarrow> real_alg_1 \\<Rightarrow> real_alg_2\" where\n  \"mult_rat_1 x y = \n    (if x < 0 then uminus_2 (mult_rat_1_pos (-x) y)\n      else if x = 0 then Rational 0 else (mult_rat_1_pos x y))\"\n\nfun mult_1 :: \"real_alg_1 \\<Rightarrow> real_alg_1 \\<Rightarrow> real_alg_2\" where\n  \"mult_1 x y = (case (x,y) of ((p1,l1,r1),(p2,l2,r2)) \\<Rightarrow>\n   if r1 > 0 then\n     if r2 > 0 then mult_1_pos x y\n     else uminus_2 (mult_1_pos x (uminus_1 y))\n   else if r2 > 0 then uminus_2 (mult_1_pos (uminus_1 x) y)\n     else mult_1_pos (uminus_1 x) (uminus_1 y))\"\n\nlemma mult_rat_1_pos: fixes r1 :: rat assumes r1: \"r1 > 0\" and y: \"invariant_1 y\"\n  defines z: \"z \\<equiv> mult_rat_1_pos r1 y\"\n  shows \"invariant_2 z \\<and> (real_of_2 z = of_rat r1 * real_of_1 y)\" \nproof -\n  obtain p2 l2 r2 where yt: \"y = (p2,l2,r2)\" by (cases y, auto)\n  let ?x = \"real_of_rat r1\"\n  let ?y = \"real_of_1 (p2, l2, r2)\"\n  let ?p = \"poly_mult_rat r1 p2\"\n  let ?mp = \"cf_pos_poly ?p\"\n  note y = y[unfolded yt]\n  note yD = invariant_1D[OF y]\n  from yD r1 have p: \"?p \\<noteq> 0\" and r10: \"r1 \\<noteq> 0\" by auto\n  hence mp: \"?mp \\<noteq> 0\" by simp\n  from yD(1)\n  have rt: \"ipoly p2 ?y = 0\" and bnd: \"of_rat l2 \\<le> ?y\" \"?y \\<le> of_rat r2\" by auto\n  from rt r1 have rt: \"ipoly ?mp (?x * ?y) = 0\" by (auto simp add: field_simps ipoly_mult_rat[OF r10])\n  from yD(5) have irr: \"irreducible p2\"\n    unfolding represents_def using y unfolding root_cond_def split by auto\n  from poly_mult_rat_irreducible[OF this _ r10] yD\n  have irr: \"irreducible ?mp\" by simp\n  from p have mon: \"cf_pos ?mp\" by auto\n  obtain l r where lr: \"l = l2 * r1\" \"r = r2 * r1\" by force\n  from bnd r1 have bnd: \"of_rat l \\<le> ?x * ?y\" \"?x * ?y \\<le> of_rat r\" unfolding lr of_rat_mult by auto\n  with rt have rc: \"root_cond (?mp,l,r) (?x * ?y)\" unfolding root_cond_def by auto\n  have ur: \"unique_root (?mp,l,r)\"\n  proof (rule ex1I, rule rc)\n    fix z\n    assume \"root_cond (?mp,l,r) z\"\n    from this[unfolded root_cond_def split] have bndz: \"of_rat l \\<le> z\" \"z \\<le> of_rat r\" \n      and rt: \"ipoly ?mp z = 0\" by auto\n    have \"fst (quotient_of r1) \\<noteq> 0\" using quotient_of_div[of r1] r10 by (cases \"quotient_of r1\", auto)\n    with rt have rt: \"ipoly p2 (z * inverse ?x) = 0\" by (auto simp: ipoly_mult_rat[OF r10])\n    from bndz r1 have \"of_rat l2 \\<le> z * inverse ?x\" \"z * inverse ?x \\<le> of_rat r2\" unfolding lr of_rat_mult\n      by (auto simp: field_simps)\n    with rt have \"root_cond (p2,l2,r2) (z * inverse ?x)\" unfolding root_cond_def by auto\n    also note invariant_1_root_cond[OF y]\n    finally have \"?y = z * inverse ?x\" by auto\n    thus \"z = ?x * ?y\" using r1 by auto\n  qed\n  from r1 have sgnr: \"sgn r = sgn r2\" unfolding lr \n    by (cases \"r2 = 0\"; cases \"r2 < 0\"; auto simp: mult_neg_pos mult_less_0_iff)\n  from r1 have sgnl: \"sgn l = sgn l2\" unfolding lr \n    by (cases \"l2 = 0\"; cases \"l2 < 0\"; auto simp: mult_neg_pos mult_less_0_iff)\n  from the_unique_root_eqI[OF ur rc] have xy: \"?x * ?y = the_unique_root (?mp,l,r)\" by auto\n  from z[unfolded yt, simplified, unfolded Let_def lr[symmetric] split]\n  have z: \"z = real_alg_2 (?mp, l, r)\" by simp\n  have yp2: \"p2 represents ?y\" using yD unfolding root_cond_def split represents_def by auto\n  with irr mon have pc: \"poly_cond ?mp\" by (auto simp: poly_cond_def cf_pos_def)\n  have rc: \"invariant_1 (?mp, l, r)\" unfolding z using yD(2) pc ur \n    by (auto simp add: invariant_1_def ur mp sgnr sgnl)\n  show ?thesis unfolding z using real_alg_2[OF rc]\n    unfolding yt xy unfolding z by simp\nqed\n\nlemma mult_1_pos: assumes x: \"invariant_1_2 x\" and y: \"invariant_1_2 y\"\n  defines z: \"z \\<equiv> mult_1_pos x y\"\n  assumes pos: \"real_of_1 x > 0\" \"real_of_1 y > 0\"\n  shows \"invariant_2 z \\<and> (real_of_2 z = real_of_1 x * real_of_1 y)\" \nproof -\n  obtain p1 l1 r1 where xt: \"x = (p1,l1,r1)\" by (cases x, auto)\n  obtain p2 l2 r2 where yt: \"y = (p2,l2,r2)\" by (cases y, auto)\n  let ?x = \"real_of_1 (p1, l1, r1)\"\n  let ?y = \"real_of_1 (p2, l2, r2)\"\n  let ?r = \"real_of_rat\"\n  let ?p = \"poly_mult p1 p2\"\n  note x = x[unfolded xt]\n  note y = y[unfolded yt]\n  from x y have basic: \"unique_root (p1, l1, r1)\" \"poly_cond2 p1\" \"unique_root (p2, l2, r2)\" \"poly_cond2 p2\" by auto\n  from basic have irr1: \"irreducible p1\" and irr2: \"irreducible p2\" by auto\n  from x have ax: \"p1 represents ?x\" unfolding represents_def by (auto elim!:invariant_1E)\n  from y have ay: \"p2 represents ?y\" unfolding represents_def by (auto elim!:invariant_1E)\n  from ax ay pos[unfolded xt yt] have axy: \"?p represents (?x * ?y)\"\n    by (intro represents_mult represents_irr_non_0[OF irr2], auto)\n  from representsD[OF this] have p: \"?p \\<noteq> 0\" and rt: \"ipoly ?p (?x * ?y) = 0\" .\n  from x pos(1)[unfolded xt] have \"?r r1 > 0\" unfolding split by auto\n  hence \"sgn r1 = 1\" unfolding sgn_rat_def by (auto split: if_splits)\n  with x have \"sgn l1 = 1\" by auto\n  hence l1_pos: \"l1 > 0\" unfolding sgn_rat_def by (cases \"l1 = 0\"; cases \"l1 < 0\"; auto)\n  from y pos(2)[unfolded yt] have \"?r r2 > 0\" unfolding split by auto\n  hence \"sgn r2 = 1\" unfolding sgn_rat_def by (auto split: if_splits)\n  with y have \"sgn l2 = 1\" by auto\n  hence l2_pos: \"l2 > 0\" unfolding sgn_rat_def by (cases \"l2 = 0\"; cases \"l2 < 0\"; auto)\n  let ?bnd = \"(\\<lambda>((l1, r1, sr1 :: rat), l2 :: rat, r2 :: rat, sr2 :: rat). (l1 * l2, r1 * r2))\"\n  define bnd where \"bnd = ?bnd\"\n  obtain z' where sel: \"select_correct_factor_int_poly\n        (tighten_poly_bounds_binary p1 p2)\n        bnd \n        ((l1,r1,sgn (ipoly p1 r1)),(l2,r2, sgn (ipoly p2 r2))) \n        ?p = z'\" by auto\n  have main: \"invariant_2 z' \\<and> real_of_2 z' = ?x * ?y\"\n  proof (rule select_correct_factor_int_poly[OF _ sel rt p])\n    {\n      fix l1 r1 l2 r2 l1' r1' l2' r2' l l' r r' :: rat\n      let ?m1 = \"(l1+r1)/2\" let ?m2 = \"(l2+r2)/2\"\n      define d1 where \"d1 = r1 - l1\" \n      define d2 where \"d2 = r2 - l2\"\n      let ?M1 = \"l1 + d1/2\" let ?M2 = \"l2 + d2/2\"\n      assume le: \"l1 > 0\" \"l2 > 0\" \"l1 \\<le> r1\" \"l2 \\<le> r2\" and id: \"(l, r) = (l1 * l2, r1 * r2)\"\n        \"(l', r') = (l1' * l2', r1' * r2')\" \n        and mem: \"(l1', r1') \\<in> {(l1, ?m1), (?m1, r1)}\"\n          \"(l2', r2') \\<in> {(l2, ?m2), (?m2, r2)}\"\n      hence id: \"l = l1 * l2\" \"r = (l1 + d1) * (l2 + d2)\" \"l' = l1' * l2'\" \"r' = r1' * r2'\" \n        \"r1 = l1 + d1\" \"r2 = l2 + d2\" and id': \"?m1 = ?M1\" \"?m2 = ?M2\"\n        unfolding d1_def d2_def by (auto simp: field_simps)\n      define l1d1 where \"l1d1 = l1 + d1\"\n      from le have ge0: \"d1 \\<ge> 0\" \"d2 \\<ge> 0\" \"l1 \\<ge> 0\" \"l2 \\<ge> 0\" unfolding d1_def d2_def by auto\n      have \"4 * (r' - l') \\<le> 3 * (r - l)\" \n      proof (cases \"l1' = l1 \\<and> r1' = ?M1 \\<and> l2' = l2 \\<and> r2' = ?M2\")\n        case True\n        hence id2: \"l1' = l1\" \"r1' = ?M1\" \"l2' = l2\" \"r2' = ?M2\" by auto\n        show ?thesis unfolding id id2 unfolding ring_distribs using ge0 by simp \n      next\n        case False note 1 = this\n        show ?thesis\n        proof (cases \"l1' = l1 \\<and> r1' = ?M1 \\<and> l2' = ?M2 \\<and> r2' = r2\")\n          case True\n          hence id2: \"l1' = l1\" \"r1' = ?M1\" \"l2' = ?M2\" \"r2' = r2\" by auto\n          show ?thesis unfolding id id2 unfolding ring_distribs using ge0 by simp\n        next\n          case False note 2 = this\n          show ?thesis\n          proof (cases \"l1' = ?M1 \\<and> r1' = r1 \\<and> l2' = l2 \\<and> r2' = ?M2\")\n            case True\n            hence id2: \"l1' = ?M1\" \"r1' = r1\" \"l2' = l2\" \"r2' = ?M2\" by auto\n          show ?thesis unfolding id id2 unfolding ring_distribs using ge0 by simp\n          next\n            case False note 3 = this\n            from 1 2 3 mem have id2: \"l1' = ?M1\" \"r1' = r1\" \"l2' = ?M2\" \"r2' = r2\"\n              unfolding id' by auto\n          show ?thesis unfolding id id2 unfolding ring_distribs using ge0 by simp\n          qed\n        qed\n      qed\n      hence \"r' - l' \\<le> 3 / 4 * (r - l)\" by simp\n    } note decr = this\n    show \"converges_to\n        (\\<lambda>i. bnd ((tighten_poly_bounds_binary p1 p2 ^^ i)\n        ((l1,r1,sgn (ipoly p1 r1)),(l2,r2, sgn (ipoly p2 r2))))) (?x * ?y)\"\n    proof (intro tighten_poly_bounds_binary[where f = \"(*)\" and I = \"\\<lambda> l. l > 0\"]\n      basic l1_pos l2_pos, goal_cases)\n      case (1 L1 R1 L2 R2 L R)\n      hence \"L = L1 * L2\" \"R = R1 * R2\" unfolding bnd_def by auto\n      hence id: \"?r L = ?r L1 * ?r L2\" \"?r R = ?r R1 * ?r R2\" by (auto simp: hom_distribs)\n      from 1(3-4) have le: \"?r L1 \\<le> ?x\" \"?x \\<le> ?r R1\" \"?r L2 \\<le> ?y\" \"?y \\<le> ?r R2\" \n        unfolding root_cond_def by auto\n      from 1(1-2) have lt: \"0 < ?r L1\" \"0 < ?r L2\" by auto\n      from mult_mono[OF le(1,3), folded id] lt le have L: \"?r L \\<le> ?x * ?y\" by linarith\n      have R: \"?x * ?y \\<le> ?r R\"\n        by (rule mult_mono[OF le(2,4), folded id], insert lt le, linarith+)\n      show ?case using L R by blast\n    next\n      case (2 l1 r1 l2 r2 l1' r1' l2' r2' l l' r r')\n      from 2(5-6) have lr: \"l = l1 * l2\" \"r = r1 * r2\" \"l' = l1' * l2'\" \"r' = r1' * r2'\"\n        unfolding bnd_def by auto      \n      from 2(1-4) have le: \"0 < l1\" \"0 < l2\" \"l1 \\<le> r1\" \"l2 \\<le> r2\" by auto\n      from 2(7-8) le have le': \"l1 \\<le> l1'\" \"r1' \\<le> r1\" \"l2 \\<le> l2'\" \"r2' \\<le> r2\" \"0 < r2'\" \"0 < r2\" by auto\n      from mult_mono[OF le'(1,3), folded lr] le le' have l: \"l \\<le> l'\" by auto\n      have r: \"r' \\<le> r\" by (rule mult_mono[OF le'(2,4), folded lr], insert le le', linarith+)\n      have \"r' - l' \\<le> 3 / 4 * (r - l)\"\n        by (rule decr[OF _ _ _ _ _ _ 2(7-8)], insert le le' lr, auto)\n      thus ?case using l r by blast\n    qed auto\n  qed\n  have z': \"z' = z\" unfolding z[unfolded xt yt, simplified, unfolded bnd_def[symmetric] sel]\n    by auto\n  from main[unfolded this] show ?thesis unfolding xt yt by simp\nqed\n  \nlemma mult_1: assumes x: \"invariant_1_2 x\" and y: \"invariant_1_2 y\"\n  defines z[simp]: \"z \\<equiv> mult_1 x y\"\n  shows \"invariant_2 z \\<and> (real_of_2 z = real_of_1 x * real_of_1 y)\" \nproof -\n  obtain p1 l1 r1 where xt[simp]: \"x = (p1,l1,r1)\" by (cases x)\n  obtain p2 l2 r2 where yt[simp]: \"y = (p2,l2,r2)\" by (cases y)\n  let ?xt = \"(p1, l1, r1)\"\n  let ?yt = \"(p2, l2, r2)\"\n  let ?x = \"real_of_1 ?xt\"\n  let ?y = \"real_of_1 ?yt\"\n  let ?mxt = \"uminus_1 ?xt\"\n  let ?myt = \"uminus_1 ?yt\"\n  let ?mx = \"real_of_1 ?mxt\"\n  let ?my = \"real_of_1 ?myt\"\n  let ?r = \"real_of_rat\"\n  from invariant_1_2_of_rat[OF x, of 0] have x0: \"?x < 0 \\<or> ?x > 0\" by auto\n  from invariant_1_2_of_rat[OF y, of 0] have y0: \"?y < 0 \\<or> ?y > 0\" by auto\n  from uminus_1_2[OF x] have mx: \"invariant_1_2 ?mxt\" and [simp]: \"?mx = - ?x\" by auto\n  from uminus_1_2[OF y] have my: \"invariant_1_2 ?myt\" and [simp]: \"?my = - ?y\" by auto\n  have id: \"r1 > 0 \\<longleftrightarrow> ?x > 0\" \"r1 < 0 \\<longleftrightarrow> ?x < 0\" \"r2 > 0 \\<longleftrightarrow> ?y > 0\" \"r2 < 0 \\<longleftrightarrow> ?y < 0\"\n    using x y by auto\n  show ?thesis\n  proof (cases \"?x > 0\")\n    case x0: True\n    show ?thesis \n    proof (cases \"?y > 0\")\n      case y0: True\n      with x y x0 mult_1_pos[OF x y] show ?thesis by auto\n    next\n      case False\n      with y0 have y0: \"?y < 0\" by auto\n      with x0 have z: \"z = uminus_2 (mult_1_pos ?xt ?myt)\"\n        unfolding z xt yt mult_1.simps split id by simp\n      from x0 y0 mult_1_pos[OF x my] uminus_2[of \"mult_1_pos ?xt ?myt\"]\n      show ?thesis unfolding z by simp\n    qed\n  next\n    case False\n    with x0 have x0: \"?x0 < 0\" by simp\n    show ?thesis\n    proof (cases \"?y > 0\")\n      case y0: True\n      with x0 x y id have z: \"z = uminus_2 (mult_1_pos ?mxt ?yt)\" by simp\n      from x0 y0 mult_1_pos[OF mx y] uminus_2[of \"mult_1_pos ?mxt ?yt\"]\n      show ?thesis unfolding z by auto\n    next\n      case False\n      with y0 have y0: \"?y < 0\" by simp\n      with x0 x y have z: \"z = mult_1_pos ?mxt ?myt\" by auto\n      with x0 y0 x y mult_1_pos[OF mx my]\n      show ?thesis unfolding z by auto\n    qed\n  qed\nqed\n  \n\nlemma mult_rat_1: fixes x assumes y: \"invariant_1 y\"  \n  defines z: \"z \\<equiv> mult_rat_1 x y\"\n  shows \"invariant_2 z \\<and> (real_of_2 z = of_rat x * real_of_1 y)\" \nproof (cases y)\n  case yt: (fields p2 l2 r2)\n  let ?yt = \"(p2, l2, r2)\"\n  let ?x = \"real_of_rat x\"\n  let ?y = \"real_of_1 ?yt\"\n  let ?myt = \"mult_rat_1_pos (- x) ?yt\"\n  note y = y[unfolded yt]\n  note z = z[unfolded yt]\n  show ?thesis\n  proof(cases x \"0::rat\" rule:linorder_cases)\n    case x: greater\n    with z have z: \"z = mult_rat_1_pos x ?yt\" by simp\n    from mult_rat_1_pos[OF x y] \n    show ?thesis unfolding yt z by auto\n  next\n    case less\n    then have x: \"- x > 0\" by auto\n    hence z: \"z = uminus_2 ?myt\" unfolding z by simp\n    from mult_rat_1_pos[OF x y] have rc: \"invariant_2 ?myt\"\n      and rr: \"real_of_2 ?myt = - ?x * ?y\" by (auto simp: hom_distribs)\n    from uminus_2[OF rc] rr show ?thesis unfolding z[symmetric] unfolding yt[symmetric]\n      by simp\n  qed (auto simp: z)\nqed\nend\n  \ndeclare mult_1.simps[simp del]\ndeclare mult_rat_1.simps[simp del]\n\n(* ********************* *)\nsubsubsection\\<open>Root\\<close>\n\ndefinition ipoly_root_delta :: \"int poly \\<Rightarrow> real\" where\n  \"ipoly_root_delta p = Min (insert 1 { abs (x - y) | x y. ipoly p x = 0 \\<and> ipoly p y = 0 \\<and> x \\<noteq> y}) / 4\"\n\nlemma ipoly_root_delta: assumes \"p \\<noteq> 0\"\n  shows \"ipoly_root_delta p > 0\"\n    \"2 \\<le> card (Collect (root_cond (p, l, r))) \\<Longrightarrow> ipoly_root_delta p \\<le> real_of_rat (r - l) / 4\"\nproof -\n  let ?z = \"0 :: real\"\n  let ?R = \"{x. ipoly p x = ?z}\"\n  let ?set = \"{ abs (x - y) | x y. ipoly p x = ?z  \\<and> ipoly p y = 0 \\<and> x \\<noteq> y}\"\n  define S where \"S = insert 1 ?set\"\n  from finite_ipoly_roots[OF assms] have finR: \"finite ?R\" and fin: \"finite (?R \\<times> ?R)\" by auto\n  have \"finite ?set\"\n    by (rule finite_subset[OF _ finite_imageI[OF fin, of \"\\<lambda> (x,y). abs (x - y)\"]], force)\n  hence fin: \"finite S\" and ne: \"S \\<noteq> {}\" and pos: \"\\<And> x. x \\<in> S \\<Longrightarrow> x > 0\" unfolding S_def by auto\n  have delta: \"ipoly_root_delta p = Min S / 4\" unfolding ipoly_root_delta_def S_def ..\n  have pos: \"Min S > 0\" using fin ne pos by auto\n  show \"ipoly_root_delta p > 0\" unfolding delta using pos by auto\n  let ?S = \"Collect (root_cond (p, l, r))\"\n  assume \"2 \\<le> card ?S\"\n  hence 2: \"Suc (Suc 0) \\<le> card ?S\" by simp\n  from 2[unfolded card_le_Suc_iff[of _ ?S]] obtain x T where \n    ST: \"?S = insert x T\" and xT: \"x \\<notin> T\" and 1: \"Suc 0 \\<le> card T\" by auto\n  from 1[unfolded card_le_Suc_iff[of _ T]] obtain y where yT: \"y \\<in> T\" by auto\n  from ST xT yT have x: \"x \\<in> ?S\" and y: \"y \\<in> ?S\" and xy: \"x \\<noteq> y\" by auto\n  hence \"abs (x - y) \\<in> S\" unfolding S_def root_cond_def[abs_def] by auto\n  with fin have \"Min S \\<le> abs (x - y)\" by auto\n  with pos have le: \"Min S / 2 \\<le> abs (x - y) / 2\" by auto\n  from x y have \"abs (x - y) \\<le> of_rat r - of_rat l\" unfolding root_cond_def[abs_def] by auto\n  also have \"\\<dots> = of_rat (r - l)\" by (auto simp: of_rat_diff)\n  finally have \"abs (x - y) / 2 \\<le> of_rat (r - l) / 2\" by auto\n  with le show \"ipoly_root_delta p \\<le> real_of_rat (r - l) / 4\" unfolding delta by auto\nqed\n\nlemma sgn_less_eq_1_rat: fixes a b :: rat\n  shows \"sgn a = 1 \\<Longrightarrow> a \\<le> b \\<Longrightarrow> sgn b = 1\" \n  by (metis (no_types, opaque_lifting) not_less one_neq_neg_one one_neq_zero order_trans sgn_rat_def)\n\nlemma sgn_less_eq_1_real: fixes a b :: real\n  shows \"sgn a = 1 \\<Longrightarrow> a \\<le> b \\<Longrightarrow> sgn b = 1\" \n  by (metis (no_types, opaque_lifting) not_less one_neq_neg_one one_neq_zero order_trans sgn_real_def)\n\ndefinition compare_1_rat :: \"real_alg_1 \\<Rightarrow> rat \\<Rightarrow> order\" where\n  \"compare_1_rat rai = (let p = poly_real_alg_1 rai in\n    if degree p = 1 then let x = Rat.Fract (- coeff p 0) (coeff p 1)\n     in (\\<lambda> y. compare y x)\n    else (\\<lambda> y. compare_rat_1 y rai))\" \n\nlemma compare_real_of_rat: \"compare (real_of_rat x) (of_rat y) = compare x y\" \n  unfolding compare_rat_def compare_real_def comparator_of_def of_rat_less by auto\n\nlemma compare_1_rat: assumes rc: \"invariant_1 y\"\n  shows \"compare_1_rat y x = compare (of_rat x) (real_of_1 y)\"\nproof (cases \"degree (poly_real_alg_1 y)\" \"Suc 0\" rule: linorder_cases)\n  case less with invariant_1_degree_0[OF rc] show ?thesis by auto\nnext\n  case deg: greater\n  with rc have rc: \"invariant_1_2 y\" by auto\n  from deg compare_rat_1[OF rc, of x]\n  show ?thesis unfolding compare_1_rat_def by auto\nnext\n  case deg: equal\n  obtain p l r where y: \"y = (p,l,r)\" by (cases y)\n  note rc = invariant_1D[OF rc[unfolded y]]\n  from deg have p: \"degree p = Suc 0\" \n    and id: \"compare_1_rat y x = compare x (Rat.Fract (- coeff p 0) (coeff p 1))\" \n    unfolding compare_1_rat_def by (auto simp: Let_def y)\n  from rc(1)[unfolded split] have \"ipoly p (real_of_1 y) = 0\" \n    unfolding y by auto\n  with degree_1_ipoly[OF p, of \"real_of_1 y\"] \n  have id': \"real_of_1 y = real_of_rat (Rat.Fract (- coeff p 0) (coeff p 1))\" by simp\n  show ?thesis unfolding id id' compare_real_of_rat ..\nqed\n  \ncontext\n  fixes n :: nat\nbegin\nprivate definition initial_lower_bound :: \"rat \\<Rightarrow> rat\" where \n  \"initial_lower_bound l = (if l \\<le> 1 then l else of_int (root_rat_floor n l))\"\n\nprivate definition initial_upper_bound :: \"rat \\<Rightarrow> rat\" where\n  \"initial_upper_bound r = (of_int (root_rat_ceiling n r))\"\n  \ncontext\n  fixes cmpx :: \"rat \\<Rightarrow> order\" \nbegin  \nfun tighten_bound_root :: \n  \"rat \\<times> rat \\<Rightarrow> rat \\<times> rat\" where\n  \"tighten_bound_root (l',r') = (let \n      m' = (l' + r') / 2;\n      m = m' ^ n      \n      in case cmpx m of \n         Eq \\<Rightarrow> (m',m')\n       | Lt \\<Rightarrow> (m',r')\n       | Gt \\<Rightarrow> (l',m'))\" \n  \nlemma tighten_bound_root: assumes sgn: \"sgn il = 1\" \"real_of_1 x \\<ge> 0\" and\n  il: \"real_of_rat il \\<le> root n (real_of_1 x)\" and \n  ir: \"root n (real_of_1 x) \\<le> real_of_rat ir\" and\n  rai: \"invariant_1 x\" and\n  cmpx: \"cmpx = compare_1_rat x\" and\n  n: \"n \\<noteq> 0\" \nshows \"converges_to (\\<lambda> i. (tighten_bound_root ^^ i) (il, ir))\n     (root n (real_of_1 x))\" (is \"converges_to ?f ?x\")\n  unfolding converges_to_def\nproof (intro conjI impI allI)\n  {\n    fix x :: real\n    have \"x \\<ge> 0 \\<Longrightarrow> (root n x) ^ n = x\" using n by simp\n  } note root_exp_cancel = this\n  {\n    fix x :: real\n    have \"x \\<ge> 0 \\<Longrightarrow> root n (x ^ n) = x\" using n\n      using real_root_pos_unique by blast\n  } note root_exp_cancel' = this\n  from il ir have \"real_of_rat il \\<le> of_rat ir\" by auto\n  hence ir_il: \"il \\<le> ir\" by (auto simp: of_rat_less_eq)\n  from n have n': \"n > 0\" by auto\n  {\n    fix i\n    have \"in_interval (?f i) ?x \\<and> sub_interval (?f i) (il,ir) \\<and> (i \\<noteq> 0 \\<longrightarrow> sub_interval (?f i) (?f (i - 1))) \n      \\<and> snd (?f i) - fst (?f i) \\<le> (ir - il) / 2^i\"\n    proof (induct i)\n      case 0\n      show ?case using il ir by auto\n    next\n      case (Suc i)\n      obtain l' r' where id: \"(tighten_bound_root ^^ i) (il, ir) = (l',r')\" \n        by (cases \"(tighten_bound_root ^^ i) (il, ir)\", auto)\n      let ?m' = \"(l' + r') / 2\" \n      let ?m = \"?m' ^ n\" \n      define m where \"m = ?m\" \n      note IH = Suc[unfolded id split snd_conv fst_conv] \n      from IH have \"sub_interval (l', r') (il, ir)\" by auto\n      hence ill': \"il \\<le> l'\" \"r' \\<le> ir\" by auto\n      with sgn have l'0: \"l' > 0\" using sgn_1_pos sgn_less_eq_1_rat by blast\n      from IH have lr'x: \"in_interval (l', r') ?x\" by auto\n      hence lr'': \"real_of_rat l' \\<le> of_rat r'\" by auto\n      hence lr': \"l' \\<le> r'\" unfolding of_rat_less_eq .\n      with l'0 have r'0: \"r' > 0\" by auto\n      note compare = compare_1_rat[OF rai, of ?m, folded cmpx]\n      from IH have *: \"r' - l' \\<le> (ir - il) / 2 ^ i\" by auto\n      have \"r' - (l' + r') / 2 = (r' - l') / 2\" by (simp add: field_simps)\n      also have \"\\<dots> \\<le> (ir - il) / 2 ^ i / 2\" using * \n        by (rule divide_right_mono, auto)  \n      finally have size: \"r' - (l' + r') / 2 \\<le> (ir - il) / (2 * 2 ^ i)\" by simp\n      also have \"r' - (l' + r') / 2 = (l' + r') / 2 - l'\" by auto\n      finally have size': \"(l' + r') / 2 - l' \\<le> (ir - il) / (2 * 2 ^ i)\" by simp\n      have \"root n (real_of_rat ?m) = root n ((real_of_rat ?m') ^ n)\" by (simp add: hom_distribs)\n      also have \"\\<dots> = real_of_rat ?m'\" \n        by (rule root_exp_cancel', insert l'0 lr', auto)\n      finally have root: \"root n (of_rat ?m) = of_rat ?m'\" .\n      show ?case \n      proof (cases \"cmpx ?m\")\n        case Eq\n        from compare[unfolded Eq] have \"real_of_1 x = of_rat ?m\" \n          unfolding compare_real_def comparator_of_def by (auto split: if_splits)\n        from arg_cong[OF this, of \"root n\"] have \"?x = root n (of_rat ?m)\" .\n        also have \"\\<dots> = root n  (real_of_rat ?m') ^ n\"\n          using n real_root_power by (auto simp: hom_distribs)\n        also have \"\\<dots> = of_rat ?m'\" \n          by (rule root_exp_cancel, insert IH sgn(2) l'0 r'0, auto)\n        finally have x: \"?x = of_rat ?m'\"  .\n        show ?thesis using x id Eq lr' ill' ir_il by (auto simp: Let_def)\n      next\n        case Lt \n        from compare[unfolded Lt] have lt: \"of_rat ?m \\<le> real_of_1 x\" \n          unfolding compare_real_def comparator_of_def by (auto split: if_splits)\n        have id'': \"?f (Suc i) = (?m',r')\" \"?f (Suc i - 1) = (l',r')\"  \n          using Lt id by (auto simp add: Let_def)\n        from real_root_le_mono[OF n' lt] \n        have \"of_rat ?m' \\<le> ?x\" unfolding root by simp\n        with lr'x lr'' have ineq': \"real_of_rat l' + real_of_rat r' \\<le> ?x * 2\" by (auto simp: hom_distribs)\n        show ?thesis unfolding id'' \n          by (auto simp: Let_def hom_distribs, insert size ineq' lr' ill' lr'x ir_il, auto)\n      next\n        case Gt\n        from compare[unfolded Gt] have lt: \"of_rat ?m \\<ge> real_of_1 x\" \n          unfolding compare_real_def comparator_of_def by (auto split: if_splits)\n        have id'': \"?f (Suc i) = (l',?m')\" \"?f (Suc i - 1) = (l',r')\"  \n          using Gt id by (auto simp add: Let_def)\n        from real_root_le_mono[OF n' lt] \n        have \"?x \\<le> of_rat ?m'\" unfolding root by simp\n        with lr'x lr'' have ineq': \"?x * 2 \\<le> real_of_rat l' + real_of_rat r'\" by (auto simp: hom_distribs)\n        show ?thesis unfolding id'' \n          by (auto simp: Let_def hom_distribs, insert size' ineq' lr' ill' lr'x ir_il, auto)\n      qed\n    qed\n  } note main = this\n  fix i\n  from main[of i] show \"in_interval (?f i) ?x\" by auto\n  from main[of \"Suc i\"] show \"sub_interval (?f (Suc i)) (?f i)\" by auto\n  fix eps :: real\n  assume eps: \"0 < eps\" \n  define c where \"c = eps / (max (real_of_rat (ir - il)) 1)\" \n  have c0: \"c > 0\" using eps unfolding c_def by auto    \n  from exp_tends_to_zero[OF _ _ this, of \"1/2\"] obtain i where c: \"(1/2)^i \\<le> c\" by auto\n  obtain l' r' where fi: \"?f i = (l',r')\" by force\n  from main[of i, unfolded fi] have le: \"r' - l' \\<le> (ir - il) / 2 ^ i\" by auto\n  have iril: \"real_of_rat (ir - il) \\<ge> 0\" using ir_il by (auto simp: of_rat_less_eq)\n  show \"\\<exists>n la ra. ?f n = (la, ra) \\<and> real_of_rat ra - real_of_rat la \\<le> eps\" \n  proof (intro conjI exI, rule fi)\n    have \"real_of_rat r' - of_rat l' = real_of_rat (r' - l')\" by (auto simp: hom_distribs)\n    also have \"\\<dots> \\<le> real_of_rat ((ir - il) / 2 ^ i)\" using le unfolding of_rat_less_eq .\n    also have \"\\<dots> = (real_of_rat (ir - il)) * ((1/2) ^ i)\" by (simp add: field_simps hom_distribs)\n    also have \"\\<dots> \\<le> (real_of_rat (ir - il)) * c\" \n      by (rule mult_left_mono[OF c iril])\n    also have \"\\<dots> \\<le> eps\"\n    proof (cases \"real_of_rat (ir - il) \\<le> 1\")\n      case True\n      hence \"c = eps\" unfolding c_def by (auto simp: hom_distribs)\n      thus ?thesis using eps True by auto\n    next\n      case False\n      hence \"max (real_of_rat (ir - il)) 1 = real_of_rat (ir - il)\" \"real_of_rat (ir - il) \\<noteq> 0\" \n        by (auto simp: hom_distribs)\n      hence \"(real_of_rat (ir - il)) * c = eps\" unfolding c_def by auto\n      thus ?thesis by simp\n    qed\n    finally show \"real_of_rat r' - of_rat l' \\<le> eps\" .\n  qed\nqed\nend\n\nprivate fun root_pos_1 :: \"real_alg_1 \\<Rightarrow> real_alg_2\" where\n  \"root_pos_1 (p,l,r) = (\n      (select_correct_factor_int_poly \n        (tighten_bound_root (compare_1_rat (p,l,r)))\n        (\\<lambda> x. x)\n        (initial_lower_bound l, initial_upper_bound r)\n        (poly_nth_root n p)))\"\n\nfun root_1 :: \"real_alg_1 \\<Rightarrow> real_alg_2\" where\n\"root_1 (p,l,r) = (\n  if n = 0 \\<or> r = 0 then Rational 0\n  else if r > 0 then root_pos_1 (p,l,r)\n  else uminus_2 (root_pos_1 (uminus_1 (p,l,r))))\"\n\ncontext\n  assumes n: \"n \\<noteq> 0\"\nbegin\n\nlemma initial_upper_bound: assumes x: \"x > 0\" and xr: \"x \\<le> of_rat r\"\n  shows \"sgn (initial_upper_bound r) = 1\" \"root n x \\<le> of_rat (initial_upper_bound r)\"\nproof -\n  have n: \"n > 0\" using n by auto\n  note d = initial_upper_bound_def\n  let ?r = \"initial_upper_bound r\"\n  from x xr have r0: \"r > 0\" by (meson not_less of_rat_le_0_iff order_trans)\n  hence \"of_rat r > (0 :: real)\" by auto\n  hence \"root n (of_rat r) > 0\" using n by simp\n  hence \"1 \\<le> ceiling (root n (of_rat r))\" by auto\n  hence \"(1 :: rat) \\<le> of_int (ceiling (root n (of_rat r)))\" by linarith\n  also have \"\\<dots> = ?r\" unfolding d by simp\n  finally show \"sgn ?r = 1\" unfolding sgn_rat_def by auto\n  have \"root n x \\<le> root n (of_rat r)\"\n    unfolding real_root_le_iff[OF n] by (rule xr)\n  also have \"\\<dots> \\<le> of_rat ?r\" unfolding d by simp\n  finally show \"root n x \\<le> of_rat ?r\" .\nqed\n\nlemma initial_lower_bound: assumes l: \"l > 0\" and lx: \"of_rat l \\<le> x\"\n  shows \"sgn (initial_lower_bound l) = 1\" \"of_rat (initial_lower_bound l) \\<le> root n x\"\nproof -\n  have n: \"n > 0\" using n by auto\n  note d = initial_lower_bound_def\n  let ?l = \"initial_lower_bound l\"\n  from l lx have x0: \"x > 0\" by (meson not_less of_rat_le_0_iff order_trans)\n  have \"sgn ?l = 1 \\<and> of_rat ?l \\<le> root n x\"\n  proof (cases \"l \\<le> 1\")\n    case True\n    hence ll: \"?l = l\" and l0: \"of_rat l \\<ge> (0 :: real)\" and l1: \"of_rat l \\<le> (1 :: real)\" \n      using l unfolding True d by auto\n    have sgn: \"sgn ?l = 1\" using l unfolding ll by auto\n    have \"of_rat ?l = of_rat l\" unfolding ll by simp\n    also have \"of_rat l \\<le> root n (of_rat l)\" using real_root_increasing[OF _ _ l0 l1, of 1 n] n\n      by (cases \"n = 1\", auto)\n    also have \"\\<dots> \\<le> root n x\" using lx unfolding real_root_le_iff[OF n] .\n    finally show ?thesis using sgn by auto\n  next\n    case False\n    hence l: \"(1 :: real) \\<le> of_rat l\" and ll: \"?l = of_int (floor (root n (of_rat l)))\" \n      unfolding d by auto\n    hence \"root n 1 \\<le> root n (of_rat l)\"\n      unfolding real_root_le_iff[OF n] by auto\n    hence \"1 \\<le> root n (of_rat l)\" using n by auto\n    from floor_mono[OF this] have \"1 \\<le> ?l\"\n      using one_le_floor unfolding ll by fastforce\n    hence sgn: \"sgn ?l = 1\" by simp\n    have \"of_rat ?l \\<le> root n (of_rat l)\" unfolding ll by simp\n    also have \"\\<dots> \\<le> root n x\" using lx unfolding real_root_le_iff[OF n] .\n    finally have \"of_rat ?l \\<le> root n x\" .\n    with sgn show ?thesis by auto\n  qed\n  thus \"sgn ?l = 1\" \"of_rat ?l \\<le> root n x\" by auto\nqed\n\nlemma root_pos_1:\n  assumes x: \"invariant_1 x\" and pos: \"rai_ub x > 0\"\n  defines y: \"y \\<equiv> root_pos_1 x\"\n  shows \"invariant_2 y \\<and> real_of_2 y = root n (real_of_1 x)\"\nproof (cases x)\n  case (fields p l r)\n  let ?l = \"initial_lower_bound l\"\n  let ?r = \"initial_upper_bound r\"\n  from x fields have rai: \"invariant_1 (p,l,r)\" by auto\n  note * = invariant_1D[OF this]\n  let ?x = \"the_unique_root (p,l,r)\"\n  from pos[unfolded fields] *\n  have sgnl: \"sgn l = 1\" by auto\n  from sgnl have l0: \"l > 0\" by (unfold sgn_1_pos)\n  hence ll0: \"real_of_rat l > 0\" by auto\n  from * have lx: \"of_rat l \\<le> ?x\" by auto\n  with ll0 have x0: \"?x > 0\" by linarith\n  note il = initial_lower_bound[OF l0 lx]\n  from * have \"?x \\<le> of_rat r\" by auto\n  note iu = initial_upper_bound[OF x0 this]\n  let ?p = \"poly_nth_root n p\"\n  from x0 have id: \"root n ?x ^ n = ?x\" using n real_root_pow_pos by blast\n  have rc: \"root_cond (?p, ?l, ?r) (root n ?x)\"\n    using il iu * by (intro root_condI, auto simp: ipoly_nth_root id)\n  hence root: \"ipoly ?p (root n (real_of_1 x)) = 0\" \n    unfolding root_cond_def fields by auto\n  from * have \"p \\<noteq> 0\" by auto\n  hence p': \"?p \\<noteq> 0\" using poly_nth_root_0[of n p] n by auto\n  have tbr: \"0 \\<le> real_of_1 x\"\n            \"real_of_rat (initial_lower_bound l) \\<le> root n (real_of_1 x)\"\n            \"root n (real_of_1 x) \\<le> real_of_rat (initial_upper_bound r)\"\n     using x0 il(2) iu(2) fields by auto\n  from select_correct_factor_int_poly[OF tighten_bound_root[OF il(1)[folded fields] tbr x refl n] refl root p']\n  show ?thesis by (simp add: y fields)\nqed\n\nend\n\nlemma root_1: assumes x: \"invariant_1 x\"\n  defines y: \"y \\<equiv> root_1 x\"\n  shows \"invariant_2 y \\<and> (real_of_2 y = root n (real_of_1 x))\"\nproof (cases \"n = 0 \\<or> rai_ub x = 0\")\n  case True\n  with x have \"n = 0 \\<or> real_of_1 x = 0\" by (cases x, auto)\n  then have \"root n (real_of_1 x) = 0\" by auto\n  then show ?thesis unfolding y root_1.simps\n    using x by (cases x, auto)\nnext\n  case False with x have n: \"n \\<noteq> 0\" and x0: \"real_of_1 x \\<noteq> 0\" by (simp, cases x, auto)\n  note rt = root_pos_1\n  show ?thesis\n  proof (cases \"rai_ub x\" \"0::rat\" rule:linorder_cases)\n    case greater\n    with rt[OF n x this] n show ?thesis by (unfold y, cases x, simp)\n  next\n    case less\n    let ?um = \"uminus_1\"\n    let ?rt = \"root_pos_1\"\n    from n less y x0 have y: \"y = uminus_2 (?rt (?um x))\" by (cases x, auto)\n    from uminus_1[OF x] have umx: \"invariant_1 (?um x)\" and umx2: \"real_of_1 (?um x) = - real_of_1 x\" by auto\n    with x less have \"0 < rai_ub (uminus_1 x)\"\n      by (cases x, auto simp: uminus_1.simps Let_def)\n    from rt[OF n umx this] umx2 have rumx: \"invariant_2 (?rt (?um x))\" \n      and rumx2: \"real_of_2 (?rt (?um x)) = root n (- real_of_1 x)\"\n      by auto\n    from uminus_2[OF rumx] rumx2 y real_root_minus show ?thesis by auto\n  next\n    case equal with x0 x show ?thesis by (cases x, auto)\n  qed\nqed\nend\n  \ndeclare root_1.simps[simp del]\n\n(* ********************** *)\nsubsubsection \\<open>Embedding of Rational Numbers\\<close>\n\ndefinition of_rat_1 :: \"rat \\<Rightarrow> real_alg_1\" where\n  \"of_rat_1 x \\<equiv> (poly_rat x,x,x)\"\n\nlemma of_rat_1:\n  shows \"invariant_1 (of_rat_1 x)\" and \"real_of_1 (of_rat_1 x) = of_rat x\"\n  unfolding of_rat_1_def\nby (atomize(full), intro invariant_1_realI unique_rootI poly_condI, auto )\n\nfun info_2 :: \"real_alg_2 \\<Rightarrow> rat + int poly \\<times> nat\" where\n  \"info_2 (Rational x) = Inl x\"\n| \"info_2 (Irrational n (p,l,r)) = Inr (p,n)\" \n    \nlemma info_2_card: assumes rc: \"invariant_2 x\"\n  shows \"info_2 x = Inr (p,n) \\<Longrightarrow> poly_cond p \\<and> ipoly p (real_of_2 x) = 0 \\<and> degree p \\<ge> 2 \n    \\<and> card (roots_below p (real_of_2 x)) = n\"\n    \"info_2 x = Inl y \\<Longrightarrow> real_of_2 x = of_rat y\" \nproof (atomize(full), goal_cases)\n  case 1\n  show ?case\n  proof (cases x)\n    case (Irrational m rai)\n    then obtain q l r where x: \"x = Irrational m (q,l,r)\" by (cases rai, auto)\n    show ?thesis\n    proof (cases \"q = p \\<and> m = n\")\n      case False\n      thus ?thesis using x by auto\n    next\n      case True\n      with x have x: \"x = Irrational n (p,l,r)\" by auto\n      from rc[unfolded x, simplified] have inv: \"invariant_1_2 (p,l,r)\" and \n        n: \"card (roots_below p (real_of_2 x)) = n\" and 1: \"degree p \\<noteq> 1\" \n        by (auto simp: x)\n      from inv have \"degree p \\<noteq> 0\" unfolding irreducible_def by auto\n      with 1 have \"degree p \\<ge> 2\" by linarith\n      thus ?thesis unfolding n using inv x by (auto elim!: invariant_1E)\n    qed\n  qed auto\nqed\n  \nlemma real_of_2_Irrational: \"invariant_2 (Irrational n rai) \\<Longrightarrow> real_of_2 (Irrational n rai) \\<noteq> of_rat x\" \nproof\n  assume \"invariant_2 (Irrational n rai)\" and rat: \"real_of_2 (Irrational n rai) = real_of_rat x\" \n  hence \"real_of_1 rai \\<in> \\<rat>\" \"invariant_1_2 rai\" by auto\n  from invariant_1_2_of_rat[OF this(2)] rat show False by auto\nqed\n            \nlemma info_2: assumes \n    ix: \"invariant_2 x\" and iy: \"invariant_2 y\"\n  shows \"info_2 x = info_2 y \\<longleftrightarrow> real_of_2 x = real_of_2 y\"\nproof (cases x)\n  case x: (Irrational n1 rai1)\n  note ix = ix[unfolded x]\n  show ?thesis\n  proof (cases y)\n    case (Rational y)\n    with real_of_2_Irrational[OF ix, of y] show ?thesis unfolding x by (cases rai1, auto)\n  next\n    case y: (Irrational n2 rai2)\n    obtain p1 l1 r1 where rai1: \"rai1 = (p1,l1,r1)\" by (cases rai1)\n    obtain p2 l2 r2 where rai2: \"rai2 = (p2,l2,r2)\" by (cases rai2)\n    let ?rx = \"the_unique_root (p1,l1,r1)\"\n    let ?ry = \"the_unique_root (p2,l2,r2)\"\n    have id: \"(info_2 x = info_2 y) = (p1 = p2 \\<and> n1 = n2)\" \n      \"(real_of_2 x = real_of_2 y) = (?rx = ?ry)\" \n      unfolding x y rai1 rai2 by auto\n    from ix[unfolded x rai1]\n    have ix: \"invariant_1 (p1, l1, r1)\" and deg1: \"degree p1 > 1\" and n1: \"n1 = card (roots_below p1 ?rx)\" by auto\n    note Ix = invariant_1D[OF ix]\n    from deg1 have p1_0: \"p1 \\<noteq> 0\" by auto\n    from iy[unfolded y rai2] \n    have iy: \"invariant_1 (p2, l2, r2)\" and \"degree p2 > 1\" and n2: \"n2 = card (roots_below p2 ?ry)\"  by auto\n    note Iy = invariant_1D[OF iy]\n    show ?thesis unfolding id\n    proof\n      assume eq: \"?rx = ?ry\" \n      from Ix\n      have algx: \"p1 represents ?rx \\<and> irreducible p1 \\<and> lead_coeff p1 > 0\" unfolding represents_def by auto\n      from iy\n      have algy: \"p2 represents ?rx \\<and> irreducible p2 \\<and> lead_coeff p2 > 0\" unfolding represents_def eq by (auto elim!: invariant_1E)\n      from algx have \"algebraic ?rx\" unfolding algebraic_altdef_ipoly by auto\n      note unique = algebraic_imp_represents_unique[OF this]\n      with algx algy have id: \"p2 = p1\" by auto\n      from eq id n1 n2 show \"p1 = p2 \\<and> n1 = n2\" by auto\n    next\n      assume \"p1 = p2 \\<and> n1 = n2\" \n      hence id: \"p1 = p2\" \"n1 = n2\" by auto\n      hence card: \"card (roots_below p1 ?rx) = card (roots_below p1 ?ry)\" unfolding n1 n2 by auto\n      show \"?rx = ?ry\"\n      proof (cases ?rx ?ry rule: linorder_cases)\n        case less\n        have \"roots_below p1 ?rx = roots_below p1 ?ry\"\n        proof (intro card_subset_eq finite_subset[OF _ ipoly_roots_finite] card)\n          from less show \"roots_below p1 ?rx \\<subseteq> roots_below p1 ?ry\" by auto\n        qed (insert p1_0, auto)\n        then show ?thesis using id less unique_rootD(3)[OF Iy(4)] by (auto simp: less_eq_real_def)\n      next\n        case equal\n        then show ?thesis by (simp add: id)\n      next\n        case greater\n        have \"roots_below p1 ?ry = roots_below p1 ?rx\"\n        proof (intro card_subset_eq card[symmetric] finite_subset[OF _ ipoly_roots_finite[OF p1_0]])\n          from greater show \"roots_below p1 ?ry \\<subseteq> roots_below p1 ?rx\" by auto\n        qed auto\n        hence \"roots_below p2 ?ry = roots_below p2 ?rx\" unfolding id by auto\n        thus ?thesis using id greater unique_rootD(3)[OF Ix(4)] by (auto simp: less_eq_real_def)\n      qed\n    qed\n  qed\nnext\n  case x: (Rational x)\n  show ?thesis\n  proof (cases y)\n    case (Rational y)\n    thus ?thesis using x by auto\n  next\n    case y: (Irrational n rai)\n    with real_of_2_Irrational[OF iy[unfolded y], of x] show ?thesis unfolding x by (cases rai, auto)\n  qed\nqed\n  \nlemma info_2_unique: \"invariant_2 x \\<Longrightarrow> invariant_2 y \\<Longrightarrow> \n  real_of_2 x = real_of_2 y \\<Longrightarrow> info_2 x = info_2 y\"\n  using info_2 by blast\n  \nlemma info_2_inj: \"invariant_2 x \\<Longrightarrow> invariant_2 y \\<Longrightarrow> info_2 x = info_2 y \\<Longrightarrow>\n  real_of_2 x = real_of_2 y\"\n  using info_2 by blast    \n\ncontext\n  fixes cr1 cr2 :: \"rat \\<Rightarrow> rat \\<Rightarrow> nat\"\nbegin\npartial_function (tailrec) compare_1 :: \"int poly \\<Rightarrow> int poly \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow> rat \\<Rightarrow> order\" where\n  [code]: \"compare_1 p1 p2 l1 r1 sr1 l2 r2 sr2 = (if r1 < l2 then Lt else if r2 < l1 then Gt \n    else let \n      (l1',r1',sr1') = tighten_poly_bounds p1 l1 r1 sr1;\n      (l2',r2',sr2') = tighten_poly_bounds p2 l2 r2 sr2\n    in compare_1 p1 p2 l1' r1' sr1' l2' r2' sr2')\n    \"\n  \nlemma compare_1:\n  assumes ur1: \"unique_root (p1,l1,r1)\"\n  and ur2: \"unique_root (p2,l2,r2)\"\n  and pc: \"poly_cond2 p1\" \"poly_cond2 p2\"\n  and diff: \"the_unique_root (p1,l1,r1) \\<noteq> the_unique_root (p2,l2,r2)\"\n  and sr: \"sr1 = sgn (ipoly p1 r1)\" \"sr2 = sgn (ipoly p2 r2)\" \n shows \"compare_1 p1 p2 l1 r1 sr1 l2 r2 sr2 = compare (the_unique_root (p1,l1,r1)) (the_unique_root (p2,l2,r2))\"\nproof -\n  let ?r = real_of_rat\n  {\n    fix d x y\n    assume d: \"d = (r1 - l1) + (r2 - l2)\" and xy: \"x = the_unique_root (p1,l1,r1)\" \"y = the_unique_root (p2,l2,r2)\"\n    define delta where \"delta = abs (x - y) / 4\"\n    have delta: \"delta > 0\" and diff: \"x \\<noteq> y\" unfolding delta_def using diff xy by auto\n    let ?rel' = \"{(x, y). 0 \\<le> y \\<and> delta_gt delta x y}\"\n    let ?rel = \"inv_image ?rel' ?r\"\n    have SN: \"SN ?rel\" by (rule SN_inv_image[OF delta_gt_SN[OF delta]])\n    from d ur1 ur2 \n    have ?thesis unfolding xy[symmetric] using xy sr\n    proof (induct d arbitrary: l1 r1 l2 r2 sr1 sr2 rule: SN_induct[OF SN])\n      case (1 d l1 r1 l2 r2)\n      note IH = 1(1)\n      note d = 1(2)\n      note ur = 1(3-4)\n      note xy = 1(5-6)\n      note sr = 1(7-8)\n      note simps = compare_1.simps[of p1 p2 l1 r1 sr1 l2 r2 sr2]\n      note urx = unique_rootD[OF ur(1), folded xy]\n      note ury = unique_rootD[OF ur(2), folded xy]\n      show ?case (is \"?l = _\")\n      proof (cases \"r1 < l2\")\n        case True\n        hence l: \"?l = Lt\" and lt: \"?r r1 < ?r l2\" unfolding simps of_rat_less by auto\n        show ?thesis unfolding l using lt True urx(2) ury(1) \n          by (auto simp: compare_real_def comparator_of_def)\n      next\n        case False note le = this\n        show ?thesis\n        proof (cases \"r2 < l1\")\n          case True\n          with le have l: \"?l = Gt\" and lt: \"?r r2 < ?r l1\" unfolding simps of_rat_less by auto\n          show ?thesis unfolding l using lt True ury(2) urx(1) \n            by (auto simp: compare_real_def comparator_of_def)\n        next\n          case False\n          obtain l1' r1' sr1' where tb1: \"tighten_poly_bounds p1 l1 r1 sr1 = (l1',r1',sr1')\" \n            by (cases rule: prod_cases3, auto)\n          obtain l2' r2' sr2' where tb2: \"tighten_poly_bounds p2 l2 r2 sr2 = (l2',r2',sr2')\" \n            by (cases rule: prod_cases3, auto)            \n          from False le tb1 tb2 have l: \"?l = compare_1 p1 p2 l1' r1' sr1' l2' r2' sr2'\" unfolding simps \n            by auto\n          from tighten_poly_bounds[OF tb1 ur(1) pc(1) sr(1)]\n          have rc1: \"root_cond (p1, l1', r1') (the_unique_root (p1, l1, r1))\" \n            and bnd1: \"l1 \\<le> l1'\" \"l1' \\<le> r1'\" \"r1' \\<le> r1\" and d1: \"r1' - l1' = (r1 - l1) / 2\" \n            and sr1: \"sr1' = sgn (ipoly p1 r1')\" by auto\n          from pc have \"p1 \\<noteq> 0\" \"p2 \\<noteq> 0\" by auto\n          from unique_root_sub_interval[OF ur(1) rc1 bnd1(1,3)] xy ur this\n          have ur1: \"unique_root (p1, l1', r1')\" and x: \"x = the_unique_root (p1, l1', r1')\" by (auto intro!: the_unique_root_eqI)\n          from tighten_poly_bounds[OF tb2 ur(2) pc(2) sr(2)]\n          have rc2: \"root_cond (p2, l2', r2') (the_unique_root (p2, l2, r2))\" \n            and bnd2: \"l2 \\<le> l2'\" \"l2' \\<le> r2'\" \"r2' \\<le> r2\" and d2: \"r2' - l2' = (r2 - l2) / 2\" \n            and sr2: \"sr2' = sgn (ipoly p2 r2')\" by auto\n          from unique_root_sub_interval[OF ur(2) rc2 bnd2(1,3)] xy ur pc\n          have ur2: \"unique_root (p2, l2', r2')\" and y: \"y = the_unique_root (p2, l2', r2')\" by auto\n          define d' where \"d' = d/2\"\n          have d': \"d' = r1' - l1' + (r2' - l2')\" unfolding d'_def d d1 d2 by (simp add: field_simps)\n          have d'0: \"d' \\<ge> 0\" using bnd1 bnd2 unfolding d' by auto\n          have dd: \"d - d' = d/2\" unfolding d'_def by simp\n          have \"abs (x - y) \\<le> 2 * ?r d\"\n          proof (rule ccontr)\n            assume \"\\<not> ?thesis\"\n            hence lt: \"2 * ?r d < abs (x - y)\" by auto\n            have \"r1 - l1 \\<le> d\" \"r2 - l2 \\<le> d\" unfolding d using bnd1 bnd2 by auto\n            from this[folded of_rat_less_eq[where 'a = real]] lt \n            have \"?r (r1 - l1) < abs (x - y) / 2\" \"?r (r2 - l2) < abs (x - y) / 2\" \n              and dd: \"?r r1 - ?r l1 \\<le> ?r d\" \"?r r2 - ?r l2 \\<le> ?r d\" by (auto simp: of_rat_diff)\n            from le have \"r1 \\<ge> l2\" by auto hence r1l2: \"?r r1 \\<ge> ?r l2\" unfolding of_rat_less_eq by auto\n            from False have \"r2 \\<ge> l1\" by auto hence r2l1: \"?r r2 \\<ge> ?r l1\" unfolding of_rat_less_eq by auto            \n            show False\n            proof (cases \"x \\<le> y\")\n              case True\n              from urx(1-2) dd(1) have \"?r r1 \\<le> x + ?r d\" by auto \n              with r1l2 have \"?r l2 \\<le> x + ?r d\" by auto\n              with True lt ury(2) dd(2) show False by auto\n            next\n              case False\n              from ury(1-2) dd(2) have \"?r r2 \\<le> y + ?r d\" by auto \n              with r2l1 have \"?r l1 \\<le> y + ?r d\" by auto\n              with False lt urx(2) dd(1) show False by auto\n            qed              \n          qed\n          hence dd': \"delta_gt delta (?r d) (?r d')\"\n             unfolding delta_gt_def delta_def using dd by (auto simp: hom_distribs)\n          show ?thesis unfolding l\n            by (rule IH[OF _ d' ur1 ur2 x y sr1 sr2], insert d'0 dd', auto)\n        qed\n      qed\n    qed\n  }\n  thus ?thesis by auto\nqed\nend\n  \n(* **************************************************************** *)  \n\nfun real_alg_1 :: \"real_alg_2 \\<Rightarrow> real_alg_1\" where\n  \"real_alg_1 (Rational r) = of_rat_1 r\"\n| \"real_alg_1 (Irrational n rai) = rai\"\n  \nlemma real_alg_1: \"real_of_1 (real_alg_1 x) = real_of_2 x\"\n  by (cases x, auto simp: of_rat_1)\n    \ndefinition root_2 :: \"nat \\<Rightarrow> real_alg_2 \\<Rightarrow> real_alg_2\" where\n  \"root_2 n x = root_1 n (real_alg_1 x)\"\n\nlemma root_2: assumes \"invariant_2 x\"\n  shows \"real_of_2 (root_2 n x) = root n (real_of_2 x)\"\n  \"invariant_2 (root_2 n x)\"\nproof (atomize(full), cases x, goal_cases)\n  case (1 y)\n  from of_rat_1[of y] root_1[of \"of_rat_1 y\" n] assms 1 real_alg_2\n  show ?case by (simp add: root_2_def)\nnext\n  case (2 i rai)\n  from root_1[of rai n] assms 2 real_alg_2 \n  show ?case by (auto simp: root_2_def)\nqed\n  \nfun add_2 :: \"real_alg_2 \\<Rightarrow> real_alg_2 \\<Rightarrow> real_alg_2\" where\n  \"add_2 (Rational r) (Rational q) = Rational (r + q)\"\n| \"add_2 (Rational r) (Irrational n x) = Irrational n (add_rat_1 r x)\"\n| \"add_2 (Irrational n x) (Rational q) = Irrational n (add_rat_1 q x)\"\n| \"add_2 (Irrational n x) (Irrational m y) = add_1 x y\"\n\nlemma add_2: assumes x: \"invariant_2 x\" and y: \"invariant_2 y\" \n  shows \"invariant_2 (add_2 x y)\" (is ?g1)\n    and \"real_of_2 (add_2 x y) = real_of_2 x + real_of_2 y\" (is ?g2)\n  using assms add_rat_1 add_1\n  by (atomize (full), (cases x; cases y), auto simp: hom_distribs)\n\nfun mult_2 :: \"real_alg_2 \\<Rightarrow> real_alg_2 \\<Rightarrow> real_alg_2\" where\n  \"mult_2 (Rational r) (Rational q) = Rational (r * q)\"\n| \"mult_2 (Rational r) (Irrational n y) = mult_rat_1 r y\"\n| \"mult_2 (Irrational n x) (Rational q) = mult_rat_1 q x\"\n| \"mult_2 (Irrational n x) (Irrational m y) = mult_1 x y\"\n\nlemma mult_2: assumes \"invariant_2 x\" \"invariant_2 y\"\n  shows \"real_of_2 (mult_2 x y) = real_of_2 x * real_of_2 y\"\n  \"invariant_2 (mult_2 x y)\"\n  using assms\n  by (atomize(full), (cases x; cases y; auto simp: mult_rat_1 mult_1 hom_distribs))\n\nfun to_rat_2 :: \"real_alg_2 \\<Rightarrow> rat option\" where\n  \"to_rat_2 (Rational r) = Some r\"\n| \"to_rat_2 (Irrational n rai) = None\"\n\nlemma to_rat_2: assumes rc: \"invariant_2 x\" \n  shows \"to_rat_2 x = (if real_of_2 x \\<in> \\<rat> then Some (THE q. real_of_2 x = of_rat q) else None)\"\nproof (cases x)\n  case (Irrational n rai)\n  from real_of_2_Irrational[OF rc[unfolded this]] show ?thesis\n    unfolding Irrational Rats_def by auto\nqed simp \n  \nfun equal_2 :: \"real_alg_2 \\<Rightarrow> real_alg_2 \\<Rightarrow> bool\" where\n  \"equal_2 (Rational r) (Rational q) = (r = q)\" \n| \"equal_2 (Irrational n (p,_)) (Irrational m (q,_)) = (p = q \\<and> n = m)\"\n| \"equal_2 (Rational r) (Irrational _ yy) = False\"\n| \"equal_2 (Irrational _ xx) (Rational q) = False\"\n\nlemma equal_2[simp]: assumes rc: \"invariant_2 x\" \"invariant_2 y\" \n  shows \"equal_2 x y = (real_of_2 x = real_of_2 y)\"\n  using info_2[OF rc]\n  by (cases x; cases y, auto)\n\nfun compare_2 :: \"real_alg_2 \\<Rightarrow> real_alg_2 \\<Rightarrow> order\" where \n  \"compare_2 (Rational r) (Rational q) = (compare r q)\"\n| \"compare_2 (Irrational n (p,l,r)) (Irrational m (q,l',r')) = (if p = q \\<and> n = m then Eq\n    else compare_1 p q l r (sgn (ipoly p r)) l' r' (sgn (ipoly q r')))\" \n| \"compare_2 (Rational r) (Irrational _ xx) = (compare_rat_1 r xx)\"\n| \"compare_2 (Irrational _ xx) (Rational r) = (invert_order (compare_rat_1 r xx))\"  \n\n\n\nfun sgn_2 :: \"real_alg_2 \\<Rightarrow> rat\" where\n  \"sgn_2 (Rational r) = sgn r\"\n| \"sgn_2 (Irrational n rai) = sgn_1 rai\"\n\nlemma sgn_2: \"invariant_2 x \\<Longrightarrow> real_of_rat (sgn_2 x) = sgn (real_of_2 x)\" \n  using sgn_1 by (cases x, auto simp: real_of_rat_sgn)\n\nfun floor_2 :: \"real_alg_2 \\<Rightarrow> int\" where\n  \"floor_2 (Rational r) = floor r\"\n| \"floor_2 (Irrational n rai) = floor_1 rai\"\n\nlemma floor_2: \"invariant_2 x \\<Longrightarrow> floor_2 x = floor (real_of_2 x)\"\n  by (cases x, auto simp: floor_1)\n  \n(* *************** *)\nsubsubsection \\<open>Definitions and Algorithms on Type with Invariant\\<close>\n\nlift_definition of_rat_3 :: \"rat \\<Rightarrow> real_alg_3\" is of_rat_2\n  by (auto simp: of_rat_2)\n\n\n    \nlemma of_rat_3: \"real_of_3 (of_rat_3 x) = of_rat x\"\n  by (transfer, auto simp: of_rat_2)\n\nlift_definition root_3 :: \"nat \\<Rightarrow> real_alg_3 \\<Rightarrow> real_alg_3\" is root_2 \n  by (auto simp: root_2)\n\nlemma root_3: \"real_of_3 (root_3 n x) = root n (real_of_3 x)\"\n  by (transfer, auto simp: root_2)\n\nlift_definition equal_3 :: \"real_alg_3 \\<Rightarrow> real_alg_3 \\<Rightarrow> bool\" is equal_2 .\n\nlemma equal_3: \"equal_3 x y = (real_of_3 x = real_of_3 y)\"\n  by (transfer, auto)  \n\nlift_definition compare_3 :: \"real_alg_3 \\<Rightarrow> real_alg_3 \\<Rightarrow> order\" is compare_2 .\n\nlemma compare_3: \"compare_3 x y = (compare (real_of_3 x) (real_of_3 y))\"\n  by (transfer, auto simp: compare_2)  \n    \nlift_definition add_3 :: \"real_alg_3 \\<Rightarrow> real_alg_3 \\<Rightarrow> real_alg_3\" is add_2 \n  by (auto simp: add_2)\n\nlemma add_3: \"real_of_3 (add_3 x y) = real_of_3 x + real_of_3 y\"\n  by (transfer, auto simp: add_2)\n\nlift_definition mult_3 :: \"real_alg_3 \\<Rightarrow> real_alg_3 \\<Rightarrow> real_alg_3\" is mult_2 \n  by (auto simp: mult_2)\n\nlemma mult_3: \"real_of_3 (mult_3 x y) = real_of_3 x * real_of_3 y\"\n  by (transfer, auto simp: mult_2)\n\nlift_definition sgn_3 :: \"real_alg_3 \\<Rightarrow> rat\" is sgn_2 . \n\nlemma sgn_3: \"real_of_rat (sgn_3 x) = sgn (real_of_3 x)\" \n  by (transfer, auto simp: sgn_2)\n\nlift_definition to_rat_3 :: \"real_alg_3 \\<Rightarrow> rat option\" is to_rat_2 .\n\nlemma to_rat_3: \"to_rat_3 x = \n  (if real_of_3 x \\<in> \\<rat> then Some (THE q. real_of_3 x = of_rat q) else None)\"\n  by (transfer, simp add: to_rat_2)\n\nlift_definition floor_3 :: \"real_alg_3 \\<Rightarrow> int\" is floor_2 .\n\nlemma floor_3: \"floor_3 x = floor (real_of_3 x)\"\n  by (transfer, auto simp: floor_2)\n\n(* *************** *)\n(* info *)\n\nlift_definition info_3 :: \"real_alg_3 \\<Rightarrow> rat + int poly \\<times> nat\" is info_2 .  \n\nlemma info_3_fun: \"real_of_3 x = real_of_3 y \\<Longrightarrow> info_3 x = info_3 y\"\n  by (transfer, intro info_2_unique, auto)\n\nlift_definition info_real_alg :: \"real_alg \\<Rightarrow> rat + int poly \\<times> nat\" is info_3\n  by (metis info_3_fun)\n    \nlemma info_real_alg: \n  \"info_real_alg x = Inr (p,n) \\<Longrightarrow> p represents (real_of x) \\<and> card {y. y \\<le> real_of x \\<and> ipoly p y = 0} = n \\<and> irreducible p\" \n  \"info_real_alg x = Inl q \\<Longrightarrow> real_of x = of_rat q\" \nproof (atomize(full), transfer, transfer, goal_cases)\n  case (1 x p n q)\n  from 1 have x: \"invariant_2 x\" by auto\n  note info = info_2_card[OF this]\n  show ?case \n  proof (cases x)\n    case irr: (Irrational m rai)\n    from info(1)[of p n]\n    show ?thesis unfolding irr by (cases rai, auto simp: poly_cond_def)\n  qed (insert 1 info, auto)\nqed\n    \n(* add *)\ninstantiation real_alg :: plus\nbegin\nlift_definition plus_real_alg :: \"real_alg \\<Rightarrow> real_alg \\<Rightarrow> real_alg\" is add_3\n  by (simp add: add_3)\ninstance ..\nend\n\nlemma plus_real_alg: \"(real_of x) + (real_of y) = real_of (x + y)\"\n  by (transfer, rule add_3[symmetric])\n\n(* minus *)\ninstantiation real_alg :: minus\nbegin\ndefinition minus_real_alg :: \"real_alg \\<Rightarrow> real_alg \\<Rightarrow> real_alg\" where\n  \"minus_real_alg x y = x + (-y)\"\ninstance ..\nend\n\nlemma minus_real_alg: \"(real_of x) - (real_of y) = real_of (x - y)\"\n  unfolding minus_real_alg_def minus_real_def uminus_real_alg plus_real_alg  ..  \n\n(* of_rat *)\nlift_definition of_rat_real_alg :: \"rat \\<Rightarrow> real_alg\" is of_rat_3 .\n\nlemma of_rat_real_alg: \"real_of_rat x = real_of (of_rat_real_alg x)\"\n  by (transfer, rule of_rat_3[symmetric])\n\n(* zero *)\ninstantiation real_alg :: zero\nbegin\ndefinition zero_real_alg :: \"real_alg\" where \"zero_real_alg \\<equiv> of_rat_real_alg 0\"\ninstance ..\nend\n\nlemma zero_real_alg: \"0 = real_of 0\"\n  unfolding zero_real_alg_def by (simp add: of_rat_real_alg[symmetric])\n\n(* one *)\ninstantiation real_alg :: one\nbegin\ndefinition one_real_alg :: \"real_alg\" where \"one_real_alg \\<equiv> of_rat_real_alg 1\"\ninstance ..\nend\n\nlemma one_real_alg: \"1 = real_of 1\"\n  unfolding one_real_alg_def by (simp add: of_rat_real_alg[symmetric])\n\n(* times *)\ninstantiation real_alg :: times\nbegin\nlift_definition times_real_alg :: \"real_alg \\<Rightarrow> real_alg \\<Rightarrow> real_alg\" is mult_3\n  by (simp add: mult_3)\ninstance ..\nend\n\nlemma times_real_alg: \"(real_of x) * (real_of y) = real_of (x * y)\"\n  by (transfer, rule mult_3[symmetric])\n\n(* inverse *)\ninstantiation real_alg :: inverse\nbegin\nlift_definition inverse_real_alg :: \"real_alg \\<Rightarrow> real_alg\" is inverse_3\n  by (simp add: inverse_3)\ndefinition divide_real_alg :: \"real_alg \\<Rightarrow> real_alg \\<Rightarrow> real_alg\" where\n  \"divide_real_alg x y = x * inverse y\" (* TODO: better to use poly_div *)\ninstance ..\nend\n\nlemma inverse_real_alg: \"inverse (real_of x) = real_of (inverse x)\"\n  by (transfer, rule inverse_3[symmetric])\n\nlemma divide_real_alg: \"(real_of x) / (real_of y) = real_of (x / y)\"\n  unfolding divide_real_alg_def times_real_alg[symmetric] divide_real_def inverse_real_alg ..\n\n(* group *)\ninstance real_alg :: ab_group_add\n  apply intro_classes\n  apply (transfer, unfold add_3, force)\n  apply (unfold zero_real_alg_def, transfer, unfold add_3 of_rat_3, force)\n  apply (transfer, unfold add_3 of_rat_3, force)\n  apply (transfer, unfold add_3 uminus_3 of_rat_3, force)\n  apply (unfold minus_real_alg_def, force)\ndone\n\n(* field *)\ninstance real_alg :: field\n  apply intro_classes\n  apply (transfer, unfold mult_3, force)\n  apply (transfer, unfold mult_3, force)\n  apply (unfold one_real_alg_def, transfer, unfold mult_3 of_rat_3, force)\n  apply (transfer, unfold mult_3 add_3, force simp: field_simps)\n  apply (unfold zero_real_alg_def, transfer, unfold of_rat_3, force)\n  apply (transfer, unfold mult_3 inverse_3 of_rat_3, force simp: field_simps)\n  apply (unfold divide_real_alg_def, force)\n  apply (transfer, unfold inverse_3 of_rat_3, force)\ndone\n\n(* numeral *)\ninstance real_alg :: numeral ..  \n\n(* root *)\nlift_definition root_real_alg :: \"nat \\<Rightarrow> real_alg \\<Rightarrow> real_alg\" is root_3\n  by (simp add: root_3)\n\nlemma root_real_alg: \"root n (real_of x) = real_of (root_real_alg n x)\"\n  by (transfer, rule root_3[symmetric])\n\n(* sgn *)\nlift_definition sgn_real_alg_rat :: \"real_alg \\<Rightarrow> rat\" is sgn_3\n  by (insert sgn_3, metis to_rat_of_rat)\n\nlemma sgn_real_alg_rat: \"real_of_rat (sgn_real_alg_rat x) = sgn (real_of x)\" \n  by (transfer, auto simp: sgn_3)\n\ninstantiation real_alg :: sgn\nbegin\ndefinition sgn_real_alg :: \"real_alg \\<Rightarrow> real_alg\" where\n  \"sgn_real_alg x = of_rat_real_alg (sgn_real_alg_rat x)\"\ninstance ..\nend\n\nlemma sgn_real_alg: \"sgn (real_of x) = real_of (sgn x)\"\n  unfolding sgn_real_alg_def of_rat_real_alg[symmetric]\n  by (transfer, simp add: sgn_3)\n\n(* equal *)\ninstantiation real_alg :: equal\nbegin\nlift_definition equal_real_alg :: \"real_alg \\<Rightarrow> real_alg \\<Rightarrow> bool\" is equal_3 \n  by (simp add: equal_3)\ninstance \nproof\n  fix x y :: real_alg\n  show \"equal_class.equal x y = (x = y)\"\n    by (transfer, simp add: equal_3)\nqed\nend\n\nlemma equal_real_alg: \"HOL.equal (real_of x) (real_of y) = (x = y)\"\n  unfolding equal_real_def by (transfer, auto)\n\n(* comparisons *)\ninstantiation real_alg :: ord \nbegin\n\ndefinition less_real_alg :: \"real_alg \\<Rightarrow> real_alg \\<Rightarrow> bool\" where\n  [code del]: \"less_real_alg x y = (real_of x < real_of y)\"\n\ndefinition less_eq_real_alg :: \"real_alg \\<Rightarrow> real_alg \\<Rightarrow> bool\" where\n  [code del]: \"less_eq_real_alg x y = (real_of x \\<le> real_of y)\"\n\ninstance ..\nend    \n\nlemma less_real_alg: \"less (real_of x) (real_of y) = (x < y)\" unfolding less_real_alg_def ..\nlemma less_eq_real_alg: \"less_eq (real_of x) (real_of y) = (x \\<le> y)\" unfolding less_eq_real_alg_def ..\n\ninstantiation real_alg :: compare_order\nbegin\n\nlift_definition compare_real_alg :: \"real_alg \\<Rightarrow> real_alg \\<Rightarrow> order\" is compare_3\n  by (simp add: compare_3)\n\nlemma compare_real_alg: \"compare (real_of x) (real_of y) = (compare x y)\"\n  by (transfer, simp add: compare_3)\n\ninstance\nproof (intro_classes, unfold compare_real_alg[symmetric, abs_def])\n  show \"le_of_comp (\\<lambda>x y. compare (real_of x) (real_of y)) = (\\<le>)\" \n    by (intro ext, auto simp: compare_real_def comparator_of_def le_of_comp_def less_eq_real_alg_def)\n  show \"lt_of_comp (\\<lambda>x y. compare (real_of x) (real_of y)) = (<)\"\n    by (intro ext, auto simp: compare_real_def comparator_of_def lt_of_comp_def less_real_alg_def)\n  show \"comparator (\\<lambda>x y. compare (real_of x) (real_of y))\" \n    unfolding comparator_def \n  proof (intro conjI impI allI)\n    fix x y z :: \"real_alg\"\n    let ?r = real_of\n    note rc = comparator_compare[where 'a = real, unfolded comparator_def]\n    from rc show \"invert_order (compare (?r x) (?r y)) = compare (?r y) (?r x)\" by blast\n    from rc show \"compare (?r x) (?r y) = Lt \\<Longrightarrow> compare (?r y) (?r z) = Lt \\<Longrightarrow> compare (?r x) (?r z) = Lt\" by blast\n    assume \"compare (?r x) (?r y) = Eq\"\n    with rc have \"?r x = ?r y\" by blast\n    thus \"x = y\" unfolding real_of_inj .\n  qed\nqed\nend\n  \nlemma less_eq_real_alg_code[code]: \n  \"(less_eq :: real_alg \\<Rightarrow> real_alg \\<Rightarrow> bool) = le_of_comp compare\"\n  \"(less :: real_alg \\<Rightarrow> real_alg \\<Rightarrow> bool) = lt_of_comp compare\"\n  by (rule ord_defs(1)[symmetric], rule ord_defs(2)[symmetric])\n\ninstantiation real_alg :: abs\nbegin\n\ndefinition abs_real_alg :: \"real_alg \\<Rightarrow> real_alg\" where\n  \"abs_real_alg x = (if real_of x < 0 then uminus x else x)\"\ninstance ..\nend\n\nlemma abs_real_alg: \"abs (real_of x) = real_of (abs x)\"\n  unfolding abs_real_alg_def abs_real_def if_distrib\n  by (auto simp: uminus_real_alg)\n\nlemma sgn_real_alg_sound: \"sgn x = (if x = 0 then 0 else if 0 < real_of x then 1 else - 1)\"\n  (is \"_ = ?r\")\nproof -\n  have \"real_of (sgn x) = sgn (real_of x)\" by (simp add: sgn_real_alg)\n  also have \"\\<dots> = real_of ?r\" unfolding sgn_real_def if_distrib \n  by (auto simp: less_real_alg_def \n    zero_real_alg_def one_real_alg_def of_rat_real_alg[symmetric] equal_real_alg[symmetric]\n    equal_real_def uminus_real_alg[symmetric])\n  finally show \"sgn x = ?r\" unfolding equal_real_alg[symmetric] equal_real_def by simp\nqed\n\nlemma real_of_of_int: \"real_of_rat (rat_of_int z) = real_of (of_int z)\"\nproof (cases \"z \\<ge> 0\")\n  case True\n  define n where \"n = nat z\"\n  from True have z: \"z = int n\" unfolding n_def by simp\n  show ?thesis unfolding z\n    by (induct n, auto simp: zero_real_alg plus_real_alg[symmetric] one_real_alg hom_distribs)\nnext\n  case False\n  define n where \"n = nat (-z)\"\n  from False have z: \"z = - int n\" unfolding n_def by simp\n  show ?thesis unfolding z\n    by (induct n, auto simp: zero_real_alg plus_real_alg[symmetric] one_real_alg uminus_real_alg[symmetric]\n      minus_real_alg[symmetric] hom_distribs)\nqed\n\ninstance real_alg :: linordered_field\n  apply standard\n     apply (unfold less_eq_real_alg_def plus_real_alg[symmetric], force)\n    apply (unfold abs_real_alg_def less_real_alg_def zero_real_alg[symmetric], rule refl)\n   apply (unfold less_real_alg_def times_real_alg[symmetric], force)\n  apply (rule sgn_real_alg_sound)\n  done\n\ninstantiation real_alg :: floor_ceiling\nbegin\nlift_definition floor_real_alg :: \"real_alg \\<Rightarrow> int\" is floor_3\n  by (auto simp: floor_3)\n\nlemma floor_real_alg: \"floor (real_of x) = floor x\"\n  by (transfer, auto simp: floor_3)\n\ninstance \nproof\n  fix x :: real_alg\n  show \"of_int \\<lfloor>x\\<rfloor> \\<le> x \\<and> x < of_int (\\<lfloor>x\\<rfloor> + 1)\" unfolding floor_real_alg[symmetric]\n    using floor_correct[of \"real_of x\"] unfolding less_eq_real_alg_def less_real_alg_def\n    real_of_of_int[symmetric] by (auto simp: hom_distribs)\n  hence \"x \\<le> of_int (\\<lfloor>x\\<rfloor> + 1)\" by auto\n  thus \"\\<exists>z. x \\<le> of_int z\" by blast\nqed\nend\n\ninstantiation real_alg ::\n  \"{unique_euclidean_ring, normalization_euclidean_semiring, normalization_semidom_multiplicative}\"\nbegin\n\ndefinition [simp]: \"normalize_real_alg = (normalize_field :: real_alg \\<Rightarrow> _)\"\ndefinition [simp]: \"unit_factor_real_alg = (unit_factor_field :: real_alg \\<Rightarrow> _)\"\ndefinition [simp]: \"modulo_real_alg = (mod_field :: real_alg \\<Rightarrow> _)\"\ndefinition [simp]: \"euclidean_size_real_alg = (euclidean_size_field :: real_alg \\<Rightarrow> _)\"\ndefinition [simp]: \"division_segment (x :: real_alg) = 1\"\n\ninstance\n  by standard\n    (simp_all add: dvd_field_iff field_split_simps split: if_splits)\n\nend\n\ninstantiation real_alg :: euclidean_ring_gcd\nbegin\n\ndefinition gcd_real_alg :: \"real_alg \\<Rightarrow> real_alg \\<Rightarrow> real_alg\" where\n  \"gcd_real_alg = Euclidean_Algorithm.gcd\"\ndefinition lcm_real_alg :: \"real_alg \\<Rightarrow> real_alg \\<Rightarrow> real_alg\" where\n  \"lcm_real_alg = Euclidean_Algorithm.lcm\"\ndefinition Gcd_real_alg :: \"real_alg set \\<Rightarrow> real_alg\" where\n \"Gcd_real_alg = Euclidean_Algorithm.Gcd\"\ndefinition Lcm_real_alg :: \"real_alg set \\<Rightarrow> real_alg\" where\n \"Lcm_real_alg = Euclidean_Algorithm.Lcm\"\n\ninstance by standard (simp_all add: gcd_real_alg_def lcm_real_alg_def Gcd_real_alg_def Lcm_real_alg_def)\n\nend\n\ninstance real_alg :: field_gcd ..\n\ndefinition min_int_poly_real_alg :: \"real_alg \\<Rightarrow> int poly\" where\n  \"min_int_poly_real_alg x = (case info_real_alg x of Inl r \\<Rightarrow> poly_rat r | Inr (p,_) \\<Rightarrow> p)\"\n\nlemma min_int_poly_real_alg_real_of: \"min_int_poly_real_alg x = min_int_poly (real_of x)\"\nproof (cases \"info_real_alg x\")\n  case (Inl r)\n  show ?thesis unfolding info_real_alg(2)[OF Inl] min_int_poly_real_alg_def Inl\n    by (simp add: min_int_poly_of_rat)\nnext\n  case (Inr pair)\n  then obtain p n where Inr: \"info_real_alg x = Inr (p,n)\" by (cases pair, auto)\n  hence \"poly_cond p\" by (transfer, transfer, auto simp: info_2_card)\n  hence \"min_int_poly (real_of x) = p\" using info_real_alg(1)[OF Inr]\n    by (intro min_int_poly_unique, auto)\n  thus ?thesis unfolding min_int_poly_real_alg_def Inr by simp\nqed\n\nlemma min_int_poly_real_code: \"min_int_poly_real (real_of x) = min_int_poly_real_alg x\"\n  by (simp add: min_int_poly_real_alg_real_of)\n\n\nlemma min_int_poly_real_of: \"min_int_poly (real_of x) = min_int_poly x\" \nproof (rule min_int_poly_unique[OF _ min_int_poly_irreducible lead_coeff_min_int_poly_pos]) \n  show \"min_int_poly x represents real_of x\" oops (* TODO: this gives an implementation of min-int-poly \n    on type real-alg\nqed\n\nlemma min_int_poly_real_alg_code_unfold [code_unfold]: \"min_int_poly = min_int_poly_real_alg\"\n  by (intro ext, unfold min_int_poly_real_alg_real_of, simp add: min_int_poly_real_of) *)\n\n\ndefinition real_alg_of_real :: \"real \\<Rightarrow> real_alg\" where\n  \"real_alg_of_real x = (if (\\<exists> y. x = real_of y) then (THE y. x = real_of y) else 0)\" \n\nlemma real_alg_of_real_code[code]: \"real_alg_of_real (real_of x) = x\"\n  using real_of_inj unfolding real_alg_of_real_def by auto\n\nlift_definition to_rat_real_alg_main :: \"real_alg \\<Rightarrow> rat option\" is to_rat_3\n  by (simp add: to_rat_3)\n\nlemma to_rat_real_alg_main: \"to_rat_real_alg_main x = (if real_of x \\<in> \\<rat> then \n  Some (THE q. real_of x = of_rat q) else None)\"\n  by (transfer, simp add: to_rat_3)\n\ndefinition to_rat_real_alg :: \"real_alg \\<Rightarrow> rat\" where\n  \"to_rat_real_alg x = (case to_rat_real_alg_main x of Some q \\<Rightarrow> q | None \\<Rightarrow> 0)\"\n\ndefinition is_rat_real_alg :: \"real_alg \\<Rightarrow> bool\" where\n  \"is_rat_real_alg x = (case to_rat_real_alg_main x of Some q \\<Rightarrow> True | None \\<Rightarrow> False)\"\n\nlemma is_rat_real_alg: \"is_rat (real_of x) = (is_rat_real_alg x)\"\n  unfolding is_rat_real_alg_def is_rat to_rat_real_alg_main by auto\n\nlemma to_rat_real_alg: \"to_rat (real_of x) = (to_rat_real_alg x)\"\n  unfolding to_rat to_rat_real_alg_def to_rat_real_alg_main by auto\n\nlemma algebraic_real_code[code]: \"algebraic_real (real_of x) = True\" \nproof (cases \"info_real_alg x\")\n  case (Inl r)\n  show ?thesis using info_real_alg(2)[OF Inl] by (auto simp: algebraic_of_rat)\nnext\n  case (Inr pair)\n  then obtain p n where Inr: \"info_real_alg x = Inr (p,n)\" by (cases pair, auto)\n  from info_real_alg(1)[OF Inr] have \"p represents (real_of x)\" by auto\n  thus ?thesis by (auto simp: algebraic_altdef_ipoly)\nqed\n\nsubsection \\<open>Real Algebraic Numbers as Implementation for Real Numbers\\<close>\n\nlemmas real_alg_code_eqns =  \n  one_real_alg\n  zero_real_alg\n  uminus_real_alg\n  root_real_alg\n  minus_real_alg\n  plus_real_alg\n  times_real_alg\n  inverse_real_alg\n  divide_real_alg\n  equal_real_alg\n  less_real_alg\n  less_eq_real_alg\n  compare_real_alg\n  sgn_real_alg\n  abs_real_alg\n  floor_real_alg\n  is_rat_real_alg\n  to_rat_real_alg\n  min_int_poly_real_code\n\ncode_datatype real_of\n\ndeclare [[code drop:\n  \"plus :: real \\<Rightarrow> real \\<Rightarrow> real\"\n  \"uminus :: real \\<Rightarrow> real\"\n  \"minus :: real \\<Rightarrow> real \\<Rightarrow> real\"\n  \"times :: real \\<Rightarrow> real \\<Rightarrow> real\"\n  \"inverse :: real \\<Rightarrow> real\"\n  \"divide :: real \\<Rightarrow> real \\<Rightarrow> real\"\n  \"floor :: real \\<Rightarrow> int\"\n  \"HOL.equal :: real \\<Rightarrow> real \\<Rightarrow> bool\"\n  \"compare :: real \\<Rightarrow> real \\<Rightarrow> order\"\n  \"less_eq :: real \\<Rightarrow> real \\<Rightarrow> bool\"\n  \"less :: real \\<Rightarrow> real \\<Rightarrow> bool\"\n  \"0 :: real\"\n  \"1 :: real\"\n  \"sgn :: real \\<Rightarrow> real\"\n  \"abs :: real \\<Rightarrow> real\"\n  min_int_poly_real\n  root]]\n\ndeclare real_alg_code_eqns [code equation]\n\nlemma Ratreal_code[code]:\n  \"Ratreal = real_of \\<circ> of_rat_real_alg\"\n  by (transfer, transfer) (simp add: fun_eq_iff of_rat_2)\n\nlemma real_of_post[code_post]: \"real_of (Real_Alg_Quotient (Real_Alg_Invariant (Rational x))) = of_rat x\" \nproof (transfer)\n  fix x\n  show \"real_of_3 (Real_Alg_Invariant (Rational x)) = real_of_rat x\" \n    by (simp add: Real_Alg_Invariant_inverse real_of_3.rep_eq)\nqed  \n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Algebraic_Numbers/Real_Algebraic_Numbers.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.6076631698328916, "lm_q1q2_score": 0.31569397329318305}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoarePartialProps.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Properties of Partial Correctness Hoare Logic *}\n\ntheory HoarePartialProps imports HoarePartialDef begin\n\nsubsection {* Soundness *}\n\nlemma hoare_cnvalid: \n assumes hoare: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\<And>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nusing hoare\nproof (induct)\n  case (Skip \\<Theta> F P A)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Skip P,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> P\"\n    thus \"t \\<in> Normal ` P \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext\n  case (Basic \\<Theta> F f P A)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> {s. f s \\<in> P} (Basic f) P,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> {s. f s \\<in> P}\"\n    thus \"t \\<in> Normal ` P \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext \n  case (Spec \\<Theta> F r Q A)\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {s. (\\<forall>t. (s, t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s, t) \\<in> r)} Spec r Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> {s. (\\<forall>t. (s, t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s, t) \\<in> r)}\"\n    from exec P\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext\n  case (Seq \\<Theta> F P c1 R A c2 Q)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c1 R,A\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> R c2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    assume P: \"s \\<in> P\"\n    from exec P obtain r where\n      exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> r\" and exec_c2:  \"\\<Gamma>\\<turnstile>\\<langle>c2,r\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    with t_notin_F have \"r \\<notin> Fault ` F\"\n      by (auto dest: execn_Fault_end)\n    with valid_c1 ctxt exec_c1 P\n    have r: \"r\\<in>Normal ` R \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n    show \"t\\<in>Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases r)\n      case (Normal r')\n      with exec_c2 r\n      show \"t\\<in>Normal ` Q \\<union> Abrupt ` A\"\n        apply -\n        apply (rule cnvalidD [OF valid_c2 ctxt _ _ t_notin_F])\n        apply auto\n        done\n    next\n      case (Abrupt r')\n      with exec_c2 have \"t=Abrupt r'\"\n        by (auto elim: execn_elim_cases)\n      with Abrupt r show ?thesis\n        by auto\n    next\n      case Fault with r show ?thesis by blast\n    next\n      case Stuck with r show ?thesis by blast\n    qed\n  qed\nnext\n  case (Cond \\<Theta> F P b c1 Q A c2)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> b) c1 Q,A\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> - b) c2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Cond b c1 c2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases \"s\\<in>b\")\n      case True\n      with exec have \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by cases auto\n      with P True \n      show ?thesis\n        by - (rule cnvalidD [OF valid_c1 ctxt _ _ t_notin_F],auto)\n    next\n      case False\n      with exec P have \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by cases auto\n      with P False \n      show ?thesis\n        by - (rule cnvalidD [OF valid_c2 ctxt _ _ t_notin_F],auto)\n    qed\n  qed\nnext\n  case (While \\<Theta> F P b c A n)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P While b c (P \\<inter> - b),A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    show \"t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt ` A\"\n    proof (cases \"s \\<in> b\")\n      case True\n      {\n        fix d::\"('b,'a,'c) com\" fix s t \n        assume exec: \"\\<Gamma>\\<turnstile>\\<langle>d,s\\<rangle> =n\\<Rightarrow> t\"\n        assume d: \"d=While b c\"\n        assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n        from exec d ctxt\n        have \"\\<lbrakk>s \\<in> Normal ` P; t \\<notin> Fault ` F\\<rbrakk>\n               \\<Longrightarrow> t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt`A\"\n        proof (induct)\n          case (WhileTrue s b' c' n r t)\n          have t_notin_F: \"t \\<notin> Fault ` F\" by fact\n          have eqs: \"While b' c' = While b c\" by fact\n          note valid_c\n          moreover have ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n          moreover from WhileTrue\n          obtain \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> r\" and\n            \"\\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> t\" and\n            \"Normal s \\<in> Normal `(P \\<inter> b)\" by auto\n          moreover with t_notin_F have \"r \\<notin> Fault ` F\"\n            by (auto dest: execn_Fault_end)\n          ultimately\n          have r: \"r \\<in> Normal ` P \\<union> Abrupt ` A\"\n            by - (rule cnvalidD,auto)\n          from this _ ctxt\n          show \"t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt ` A \"\n          proof (cases r)\n            case (Normal r')\n            with r ctxt eqs t_notin_F\n            show ?thesis\n              by - (rule WhileTrue.hyps,auto)\n          next\n            case (Abrupt r')\n            have \"\\<Gamma>\\<turnstile>\\<langle>While b' c',r\\<rangle> =n\\<Rightarrow> t\" by fact\n            with Abrupt have \"t=r\"\n              by (auto dest: execn_Abrupt_end) \n            with r Abrupt show ?thesis\n              by blast\n          next\n            case Fault with r show ?thesis by blast\n          next\n            case Stuck with r show ?thesis by blast\n          qed   \n        qed auto\n      }\n      with exec ctxt P t_notin_F\n      show ?thesis\n        by auto\n    next\n      case False\n      with exec P have \"t=Normal s\"\n        by cases auto\n      with P False\n      show ?thesis\n        by auto\n    qed\n  qed\nnext\n  case (Guard \\<Theta> F g P c Q A f)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) Guard f g c  Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    assume P:\"s \\<in> (g \\<inter> P)\"\n    from exec P have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    from valid_c ctxt this P t_notin_F\n    show  \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (rule cnvalidD)    \n  qed\nnext\n  case (Guarantee f F \\<Theta> g P c Q A)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\" by fact\n  have f_F: \"f \\<in> F\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Guard f g c  Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    assume P:\"s \\<in> P\"\n    from exec f_F t_notin_F have g: \"s \\<in> g\"\n      by cases auto\n    with P have P': \"s \\<in> g \\<inter> P\"\n      by blast\n    from exec P g have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    from valid_c ctxt this P' t_notin_F\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n  qed\nnext\n  case (CallRec P p Q A Specs \\<Theta> F)\n  have p: \"(P,p,Q,A) \\<in> Specs\" by fact\n  have valid_body:\n    \"\\<forall>(P,p,Q,A) \\<in> Specs. p \\<in> dom \\<Gamma> \\<and> (\\<forall>n. \\<Gamma>,\\<Theta> \\<union> Specs \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A)\"\n    using CallRec.hyps by blast\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P Call p Q,A\"\n  proof -\n    {\n      fix n\n      have \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\n        \\<Longrightarrow> \\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n      proof (induct n)\n        case 0\n        show \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>0:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (fastforce elim!: execn_elim_cases simp add: nvalid_def)\n      next\n        case (Suc m)\n        have hyp: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\n              \\<Longrightarrow> \\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n        have \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n        hence ctxt_m: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (fastforce simp add: nvalid_def intro: execn_Suc)\n        hence valid_Proc:\n          \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (rule hyp)\n        let ?\\<Theta>'= \"\\<Theta> \\<union> Specs\"\n        from valid_Proc ctxt_m\n        have \"\\<forall>(P, p, Q, A)\\<in>?\\<Theta>'. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by fastforce\n        with valid_body\n        have valid_body_m: \n          \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<forall>n. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A\"\n          by (fastforce simp add: cnvalid_def)\n        show \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n        proof (clarify)\n          fix P p Q A assume p: \"(P,p,Q,A) \\<in> Specs\"\n          show \"\\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          proof (rule nvalidI)\n            fix s t\n            assume exec_call: \n              \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> =Suc m\\<Rightarrow> t\"\n            assume Pre: \"s \\<in> P\"\n            assume t_notin_F: \"t \\<notin> Fault ` F\"\n            from exec_call\n            show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n            proof (cases)\n              fix bdy m' \n              assume m: \"Suc m = Suc m'\"\n              assume bdy: \"\\<Gamma> p = Some bdy\"\n              assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =m'\\<Rightarrow> t\"\n              from Pre valid_body_m exec_body bdy m p t_notin_F\n              show ?thesis\n                by (fastforce simp add: nvalid_def)\n            next\n              assume \"\\<Gamma> p = None\"\n              with valid_body p have False by auto\n              thus ?thesis ..\n            qed\n          qed\n        qed\n      qed\n    }\n    with p show ?thesis\n      by (fastforce simp add: cnvalid_def)\n  qed\nnext\n  case (DynCom P \\<Theta> F c Q A)\n  hence valid_c: \"\\<forall>s\\<in>P. (\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (c s) Q,A)\" by auto\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P DynCom c Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    assume P: \"s \\<in> P\"\n    assume t_notin_Fault: \"t \\<notin> Fault ` F\"\n    from exec show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases)\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c s,Normal s\\<rangle> =n\\<Rightarrow> t\"      \n      from cnvalidD [OF valid_c [rule_format, OF P] ctxt this P t_notin_Fault]\n      show ?thesis .\n    qed\n  qed\nnext\n  case (Throw \\<Theta> F A Q)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> A Throw Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> A\"\n    then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by cases simp\n  qed\nnext\n  case (Catch \\<Theta> F P c\\<^sub>1 Q R c\\<^sub>2 A)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    assume P: \"s \\<in> P\"\n    assume t_notin_Fault: \"t \\<notin> Fault ` F\"\n    from exec show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases)\n      fix s'\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\" \n      assume exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      from cnvalidD [OF valid_c1 ctxt exec_c1 P ] \n      have \"Abrupt s' \\<in> Abrupt ` R\"\n        by auto\n      with cnvalidD [OF valid_c2 ctxt _ _ t_notin_Fault] exec_c2\n      show ?thesis\n        by fastforce\n    next\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      assume notAbr: \"\\<not> isAbr t\"\n      from cnvalidD [OF valid_c1 ctxt exec_c1 P t_notin_Fault] \n      have \"t \\<in> Normal ` Q \\<union> Abrupt ` R\" .\n      with notAbr\n      show ?thesis\n        by auto\n    qed\n  qed\nnext\n  case (Conseq P \\<Theta> F c Q A)\n  hence adapt: \"\\<forall>s \\<in> P. (\\<exists>P' Q' A'. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'  \\<and>\n                          s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A)\"\n    by blast\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof -\n      from P adapt obtain P' Q' A' Z  where\n        spec: \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'\" and\n        P': \"s \\<in> P'\"  and  strengthen: \"Q' \\<subseteq> Q \\<and> A' \\<subseteq> A\"\n        by auto\n      from spec [rule_format] ctxt exec P' t_notin_F  \n      have \"t \\<in> Normal ` Q' \\<union> Abrupt ` A'\"\n        by (rule cnvalidD)\n      with strengthen show ?thesis\n        by blast\n    qed\n  qed\nnext\n  case (Asm P p Q A \\<Theta> F)\n  have asm: \"(P, p, Q, A) \\<in> \\<Theta>\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    from asm ctxt have \"\\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Call p Q,A\" by auto\n    moreover\n    assume \"s \\<in> P\" \"t \\<notin> Fault ` F\"\n    ultimately\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      using exec\n      by (auto simp add: nvalid_def)\n  qed\nnext\n  case ExFalso thus ?case by iprover\nnext\n  case (Await \\<Theta> F P g c Q A)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> g) c Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P  Await g c  Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Await g c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    assume P:\"s \\<in> P\" \n    from exec have B: \"s \\<in> g\"\n    by (meson execn_Normal_elim_cases(11)) \n    from P B have PB: \"s \\<in> (P \\<inter> g)\" by auto\n    from exec P have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    from valid_c ctxt this PB t_notin_F    \n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"    \n    by (rule cnvalidD)\n  qed\nqed\n\n\n\nsubsection {* Completeness *}\n\nlemma MGT_valid:\n\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n   {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t}, {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof (rule validI) \n  fix s t\n  assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t\" \n         \"s \\<in> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))}\"\n         \"t \\<notin> Fault ` F\"\n  thus \"t \\<in> Normal ` {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t} \\<union> \n            Abrupt ` {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (cases t) (auto simp add: final_notin_def)\nqed\n\ntext {* The consequence rule where the existential @{term Z} is instantiated\nto @{term s}. Usefull in proof of @{text \"MGT_lemma\"}.*}\nlemma ConseqMGT: \n  assumes modif: \"\\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\n  assumes impl: \"\\<And>s. s \\<in> P \\<Longrightarrow> s \\<in> P' s \\<and> (\\<forall>t. t \\<in> Q' s \\<longrightarrow> t \\<in> Q) \\<and> \n                                            (\\<forall>t. t \\<in> A' s \\<longrightarrow> t \\<in> A)\"\n  shows \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl \nby -  (rule conseq [OF modif],blast)\n\n\nlemma Seq_NoFaultStuckD1: \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nproof (rule final_notinI)\n  fix t\n  assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t\"\n  show \"t \\<notin> {Stuck} \\<union> Fault `  F\"\n  proof \n    assume \"t \\<in> {Stuck} \\<union> Fault `  F\"\n    moreover\n    {\n      assume \"t = Stuck\"\n      with exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Stuck\"\n        by (auto intro: exec_Seq')\n      with noabort have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    moreover \n    {\n      assume \"t \\<in> Fault ` F\"\n      then obtain f where \n      t: \"t=Fault f\" and f: \"f \\<in> F\"\n        by auto\n      from t exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Fault f\"\n        by (auto intro: exec_Seq')\n      with noabort f have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    ultimately show False by auto\n  qed\nqed\n\nlemma Seq_NoFaultStuckD2: \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<forall>t. \\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> t\\<notin> ({Stuck} \\<union> Fault `  F) \\<longrightarrow> \n             \\<Gamma>\\<turnstile>\\<langle>c2,t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nusing noabort\nby (auto simp add: final_notin_def intro: exec_Seq')\n\n\nlemma MGT_implies_complete:\n  assumes MGT: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  assumes valid: \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  using MGT\n  apply (rule ConseqMGT) \n  apply (insert valid)\n  apply (auto simp add: valid_def intro!: final_notinI)\n  done\n\ntext {* Equipped only with the classic consequence rule @{thm \"conseqPrePost\"}\n        we can only derive this syntactically more involved version\n        of completeness. But semantically it is equivalent to the \"real\" one\n        (see below) *}\nlemma MGT_implies_complete':\n  assumes MGT: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                       {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  assumes valid: \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  using MGT [rule_format, of Z]\n  apply (rule conseqPrePost)\n  apply (insert valid)\n  apply   (fastforce simp add: valid_def final_notin_def)\n  apply  (fastforce simp add: valid_def)\n  apply (fastforce simp add: valid_def)\n  done\n\ntext {* Semantic equivalence of both kind of formulations *}\nlemma valid_involved_to_valid:\n  assumes valid: \n    \"\\<forall>Z. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  shows \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  using valid\n  apply (simp add: valid_def)\n  apply clarsimp\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"Normal x\" in allE)\n  apply (erule_tac x=t in allE)\n  apply fastforce\n  done\n\ntext {* The sophisticated consequence rule allow us to do this \n        semantical transformation on the hoare-level, too. \n        The magic is, that it allow us to\n        choose the instance of @{term Z} under the assumption of an state @{term \"s \\<in> P\"} *}\nlemma\n  assumes deriv: \n    \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule ConseqMGT [OF deriv])\n  apply auto\n  done\n\nlemma valid_to_valid_involved:\n  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow>\n   \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\nby (simp add: valid_def Collect_conv_if)\n\nlemma\n  assumes deriv: \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  apply (rule conseqPrePost [OF deriv])\n  apply auto\n  done\n\nlemma conseq_extract_state_indep_prop: \n  assumes state_indep_prop:\"\\<forall>s \\<in> P. R\" \n  assumes to_show: \"R \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule Conseq)\n  apply (clarify)\n  apply (rule_tac x=\"P\" in exI)\n  apply (rule_tac x=\"Q\" in exI)\n  apply (rule_tac x=\"A\" in exI)\n  using state_indep_prop to_show\n  by blast\n\n\nlemma MGT_lemma:\n  assumes MGT_Calls: \n    \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> \n       {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n        (Call p)\n       {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n       {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  shows \"\\<And>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c \n             {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof (induct c)\n  case Skip\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Skip\n           {t. \\<Gamma>\\<turnstile>\\<langle>Skip,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>Skip,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Skip [THEN conseqPre])\n       (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\nnext\n  case (Basic f)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Basic f\n           {t. \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal Z\\<rangle> \\<Rightarrow> Normal t}, \n           {t. \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Basic [THEN conseqPre])\n       (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\nnext\n  case (Spec r)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Spec r\n           {t. \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal Z\\<rangle> \\<Rightarrow> Normal t}, \n           {t. \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    apply (rule hoarep.Spec [THEN conseqPre])\n    apply (clarsimp simp add: final_notin_def)\n    apply (case_tac \"\\<exists>t. (Z,t) \\<in> r\")\n    apply (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\n    done\nnext\n  case (Seq c1 c2) \n  have hyp_c1: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Seq.hyps by iprover\n  have hyp_c2: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c2 \n                          {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                          {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Seq.hyps by iprover\n  from hyp_c1 \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n              {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t \\<and> \n                  \\<Gamma>\\<turnstile>\\<langle>c2,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT)\n       (auto dest: Seq_NoFaultStuckD1 [simplified] Seq_NoFaultStuckD2 [simplified]\n             intro: exec.Seq)\n  thus \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   Seq c1 c2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule hoarep.Seq )\n    show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t \\<and> \n                      \\<Gamma>\\<turnstile>\\<langle>c2,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   c2\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    proof (rule ConseqMGT [OF hyp_c2],safe)\n      fix r t\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal r\" \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal r\\<rangle> \\<Rightarrow> Normal t\"\n      then show \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        by (iprover intro: exec.intros)\n    next\n      fix r t\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal r\" \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal r\\<rangle> \\<Rightarrow> Abrupt t\"\n      then show \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n        by (iprover intro: exec.intros)\n    qed\n  qed\nnext\n  case (Cond b c1 c2) \n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n                 {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Cond.hyps by iprover  \n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\\<inter>b)\n                   c1 \n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    by (rule ConseqMGT)\n       (fastforce intro: exec.CondTrue simp add: final_notin_def)\n  moreover\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c2 \n                    {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Cond.hyps by iprover  \n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>({s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\\<inter>-b)\n                  c2 \n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    by (rule ConseqMGT)\n       (fastforce intro: exec.CondFalse simp add: final_notin_def)\n  ultimately\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                 Cond b c1 c2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Cond)       \nnext\n  case (While b c)\n  let ?unroll = \"({(s,t). s\\<in>b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t})\\<^sup>*\"\n  let ?P' = \"\\<lambda>Z. {t. (Z,t)\\<in>?unroll \\<and> \n                    (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                         \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                             (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}\"\n  let ?A' = \"\\<lambda>Z. {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                While b c\n              {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule ConseqMGT [where ?P'=\"?P'\" \n                         and ?Q'=\"\\<lambda>Z. ?P' Z \\<inter> - b\" and ?A'=\"?A'\"])\n    show \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?P' Z) (While b c) (?P' Z \\<inter> - b),(?A' Z)\"\n    proof (rule allI, rule hoarep.While)\n      fix Z\n      from While \n      have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\n                        {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                        {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" by iprover\n      then show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?P' Z  \\<inter> b) c (?P' Z),(?A' Z)\"\n      proof (rule ConseqMGT)\n        fix s\n        assume  \"s\\<in> {t. (Z, t) \\<in> ?unroll \\<and> \n                      (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                           \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                               (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                    \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}\n                   \\<inter> b\"\n        then obtain \n          Z_s_unroll: \"(Z,s) \\<in> ?unroll\" and\n          noabort:\"\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                        \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                            (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u)\" and\n          s_in_b: \"s\\<in>b\" \n          by blast\n        show \"s \\<in> {t. t = s \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \\<and>\n        (\\<forall>t. t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t} \\<longrightarrow>\n             t \\<in> {t. (Z, t) \\<in> ?unroll \\<and> \n                  (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow>  e\\<in>b \n                       \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                           (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}) \\<and> \n         (\\<forall>t. t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Abrupt t} \\<longrightarrow>\n             t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t})\"\n          (is \"?C1 \\<and> ?C2 \\<and> ?C3\")\n        proof (intro conjI)\n          from Z_s_unroll noabort s_in_b show ?C1 by blast\n        next\n          {\n            fix t \n            assume s_t: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t\"\n            moreover\n            from Z_s_unroll s_t s_in_b \n            have \"(Z, t) \\<in> ?unroll\"\n              by (blast intro: rtrancl_into_rtrancl)\n            moreover note noabort\n            ultimately \n            have \"(Z, t) \\<in> ?unroll \\<and> \n                  (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                        \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                            (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))\"\n              by iprover\n          }\n          then show ?C2 by blast\n        next\n          {\n            fix t\n            assume s_t:  \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Abrupt t\" \n            from Z_s_unroll noabort s_t s_in_b \n            have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n              by blast\n          } thus ?C3 by simp\n        qed\n      qed\n    qed\n  next\n    fix s\n    assume P: \"s \\<in> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n    hence WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n      by auto\n    show \"s \\<in> ?P' s \\<and> \n    (\\<forall>t. t\\<in>(?P' s \\<inter> - b)\\<longrightarrow>\n         t\\<in>{t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t})\\<and>\n    (\\<forall>t. t\\<in>?A' s \\<longrightarrow> t\\<in>?A' Z)\"\n    proof (intro conjI)\n      {\n        fix e\n        assume \"(Z,e) \\<in> ?unroll\" \"e \\<in> b\"\n        from this WhileNoFault\n        have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n               (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                    \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u)\" (is \"?Prop Z e\")\n        proof (induct rule: converse_rtrancl_induct [consumes 1])\n          assume e_in_b: \"e \\<in> b\"\n          assume WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n          with e_in_b WhileNoFault\n          have cNoFault: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n            by (auto simp add: final_notin_def intro: exec.intros)\n          moreover\n          {\n            fix u assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n            with e_in_b have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n              by (blast intro: exec.intros)\n          }\n          ultimately\n          show \"?Prop e e\"\n            by iprover\n        next\n          fix Z r\n          assume e_in_b: \"e\\<in>b\" \n          assume WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n          assume hyp: \"\\<lbrakk>e\\<in>b;\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\\<rbrakk>\n                       \\<Longrightarrow> ?Prop r e\"\n          assume Z_r:\n            \"(Z, r) \\<in> {(Z, r). Z \\<in> b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r}\"\n          with WhileNoFault\n          have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n            by (auto simp add: final_notin_def intro: exec.intros)\n          from hyp [OF e_in_b this] obtain\n            cNoFault: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\" and\n            Abrupt_r: \"\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u \\<longrightarrow> \n                            \\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Abrupt u\"\n            by simp\n          \n           {\n            fix u assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n            with Abrupt_r have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Abrupt u\" by simp\n            moreover from  Z_r obtain\n              \"Z \\<in> b\"  \"\\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r\"\n              by simp\n            ultimately have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u\"\n              by (blast intro: exec.intros)\n          }\n          with cNoFault show \"?Prop Z e\"\n            by iprover\n        qed\n      }\n      with P show \"s \\<in> ?P' s\"\n        by blast\n    next\n      {\n        fix t\n        assume \"termination\": \"t \\<notin> b\"\n        assume \"(Z, t) \\<in> ?unroll\"\n        hence \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        proof (induct rule: converse_rtrancl_induct [consumes 1])\n          from \"termination\" \n          show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal t\\<rangle> \\<Rightarrow> Normal t\"\n            by (blast intro: exec.WhileFalse)\n        next\n          fix Z r\n          assume first_body: \n                 \"(Z, r) \\<in> {(s, t). s \\<in> b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t}\"\n          assume \"(r, t) \\<in> ?unroll\"\n          assume rest_loop: \"\\<Gamma>\\<turnstile>\\<langle>While b c, Normal r\\<rangle> \\<Rightarrow> Normal t\"\n          show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n          proof -\n            from first_body obtain\n              \"Z \\<in> b\" \"\\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r\"\n              by fast\n            moreover\n            from rest_loop have\n              \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Normal t\"\n              by fast\n            ultimately show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n              by (rule exec.WhileTrue)\n          qed\n        qed\n      }\n      with P\n      show \"(\\<forall>t. t\\<in>(?P' s \\<inter> - b)\n            \\<longrightarrow>t\\<in>{t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t})\"\n        by blast\n    next\n      from P show \"\\<forall>t. t\\<in>?A' s \\<longrightarrow> t\\<in>?A' Z\" by simp\n    qed\n  qed\nnext\n  case (Call p)\n  let ?P = \"{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n  from noStuck_Call have \"\\<forall>s \\<in> ?P. p \\<in> dom \\<Gamma>\"\n    by (fastforce simp add: final_notin_def )\n  then show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ?P (Call p)\n               {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule conseq_extract_state_indep_prop)\n    assume p_definied: \"p \\<in> dom \\<Gamma>\"\n    with MGT_Calls show\n      \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \n                 \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n                  (Call p)\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Call  p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      by (auto)\n  qed\nnext\n  case (DynCom c)\n  have hyp: \n    \"\\<And>s'. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c s',Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c s'\n      {t. \\<Gamma>\\<turnstile>\\<langle>c s',Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>c s',Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using DynCom by simp\n  have hyp':\n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c Z\n        {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT [OF hyp])\n       (fastforce simp add: final_notin_def intro: exec.intros)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n               DynCom c\n             {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n             {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    apply (rule hoarep.DynCom)\n    apply (clarsimp)\n    apply (rule hyp' [simplified])\n    done\nnext  \n  case (Guard f g c)\n  have hyp_c: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Guard by iprover\n  show ?case\n  proof (cases \"f \\<in> F\")\n    case True \n    from hyp_c\n    have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>(g \\<inter> {s. s = Z \\<and> \n                    \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (- F))}) \n             c\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      apply (rule ConseqMGT)\n      apply (insert True)\n      apply (auto simp add: final_notin_def intro: exec.intros)\n      done\n    from True this\n    show ?thesis      \n      by (rule conseqPre [OF Guarantee]) auto\n  next              \n    case False\n    from hyp_c\n    have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> \n           (g \\<inter> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}) \n           c\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      apply (rule ConseqMGT)\n      apply clarify\n      apply (frule Guard_noFaultStuckD [OF _ False])\n      apply (auto simp add: final_notin_def intro: exec.intros)\n      done\n    then show ?thesis\n      apply (rule conseqPre [OF hoarep.Guard])\n      apply clarify\n      apply (frule Guard_noFaultStuckD [OF _ False])\n      apply auto\n      done\n  qed\nnext\n  case Throw\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Throw\n              {t. \\<Gamma>\\<turnstile>\\<langle>Throw,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Throw,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule conseqPre [OF hoarep.Throw]) (blast intro: exec.intros)\nnext\n  case (Catch c\\<^sub>1 c\\<^sub>2)\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>1\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Catch.hyps by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>1\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t \\<and> \n                   \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n    by (rule ConseqMGT)\n       (fastforce intro: exec.intros simp add: final_notin_def)\n  moreover\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>2\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Catch.hyps by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow>Abrupt s \\<and> \n                   \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n               c\\<^sub>2\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT)\n       (fastforce intro: exec.intros  simp add: final_notin_def)\n  ultimately\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   Catch c\\<^sub>1 c\\<^sub>2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Catch)\nnext\n  case (Await b c)\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Await.hyps by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Await b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\\<inter>b)\n                   c\n                {t. \\<Gamma>\\<turnstile>\\<langle>Await b c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                {t. \\<Gamma>\\<turnstile>\\<langle>Await b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    by (rule ConseqMGT)\n       (fastforce intro: exec.AwaitTrue simp add: final_notin_def)\n  thus ?case using hoarep.Await by blast      \nqed\n\nlemma MGT_Calls: \n \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \n     \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n            (Call p)\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof - \n  {\n    fix p Z \n    assume defined: \"p \\<in> dom \\<Gamma>\"\n    have \n      \"\\<Gamma>,(\\<Union>p\\<in>dom \\<Gamma>. \\<Union>Z. \n          {({s. s=Z \\<and> \n             \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))},\n             p,\n             {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n             {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t})})\n       \\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n          (the (\\<Gamma> p))\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      (is \"\\<Gamma>,?\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (?Pre p Z) (the (\\<Gamma> p)) (?Post p Z),(?Abr p Z)\")\n    proof -\n      have MGT_Calls:\n       \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \\<Gamma>,?\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> \n        {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n         (Call p)\n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n        by (intro ballI allI, rule HoarePartialDef.Asm,auto)\n      have \"\\<forall>Z. \\<Gamma>,?\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p) ,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault`(-F))} \n                        (the (\\<Gamma> p))\n                        {t. \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                        {t. \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n        by (iprover intro: MGT_lemma [OF MGT_Calls])\n      thus \"\\<Gamma>,?\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?Pre p Z) (the (\\<Gamma> p)) (?Post p Z),(?Abr p Z)\"\n        apply (rule ConseqMGT)\n        apply (clarify,safe)\n      proof -\n        assume \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n        with defined show \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\" \n          by (fastforce simp add: final_notin_def \n                intro: exec.intros)\n      next\n        fix t\n        assume \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        with defined \n        show \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>Normal t\"\n          by  (auto intro: exec.Call)\n      next\n        fix t\n        assume \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n        with defined \n        show \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>Abrupt t\"\n          by  (auto intro: exec.Call)\n      qed\n    qed\n  }\n  then show ?thesis\n    apply -\n    apply (intro ballI allI)\n    apply (rule CallRec' [where Procs=\"dom \\<Gamma>\"  and \n      P=\"\\<lambda>p Z. {s. s=Z \\<and> \n                  \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"and\n      Q=\"\\<lambda>p Z. \n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t}\" and\n      A=\"\\<lambda>p Z. \n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"] )\n    apply simp+\n    done\nqed\n\ntheorem hoare_complete: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow> \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (iprover intro: MGT_implies_complete MGT_lemma [OF MGT_Calls])\n\nlemma hoare_complete': \n  assumes cvalid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (cases \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\")\n  case True\n  hence \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n    by (rule hoare_complete)\n  thus \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P c Q,A\"\n    by (rule hoare_augment_context) simp\nnext\n  case False\n  with cvalid\n  show ?thesis\n    by (rule ExFalso)\nqed\n  \n\nlemma hoare_strip_\\<Gamma>: \n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nproof (rule hoare_complete)\n  from hoare_sound [OF deriv] have \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n    by (simp add: cvalid_def)\n  from this F'\n  show \"strip F' \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n    by (rule valid_to_valid_strip)\nqed\n\n\nsubsection {* And Now: Some Useful Rules *}\n \nsubsubsection {* Consequence *}\n\n\nlemma LiberalConseq_sound:\nfixes F::\"'f set\" \nassumes cons: \"\\<forall>s \\<in> P. \\<forall>(t::('s,'f) xstate). \\<exists>P' Q' A'. (\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A') \\<and>\n                ((s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from P cons obtain P' Q' A' where\n      spec: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'\" and\n      adapt: \"(s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      apply -\n      apply (drule (1) bspec)\n      apply (erule_tac x=t in allE)\n      apply (elim exE conjE)\n      apply iprover\n      done\n    from exec spec ctxt t_notin_F\n    have \"s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A'\"\n      by (simp add: cnvalid_def nvalid_def)\n    with adapt show ?thesis\n      by simp\n  qed\nqed\n\nlemma LiberalConseq:\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<forall>(t::('s,'f) xstate). \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                ((s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule hoare_complete')\napply (rule allI)\napply (rule LiberalConseq_sound)\nusing cons\napply (clarify)\napply (drule (1) bspec)\napply (erule_tac x=t in allE)\napply clarify\napply (rule_tac x=P' in exI)\napply (rule_tac x=Q' in exI)\napply (rule_tac x=A' in exI)\napply (rule conjI)\napply (blast intro: hoare_cnvalid)\napply assumption\ndone\n\nlemma \"\\<forall>s \\<in> P. \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A \n           \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule LiberalConseq)\n  apply (rule ballI)\n  apply (drule (1) bspec)\n  apply clarify\n  apply (rule_tac x=P' in exI)\n  apply (rule_tac x=Q' in exI)\n  apply (rule_tac x=A' in exI)\n  apply auto\n  done\n\nlemma\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                (\\<forall>(t::('s,'f) xstate). (s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\n  apply (rule Conseq)\n  apply (rule ballI)\n  apply (insert cons)\n  apply (drule (1) bspec)\n  apply clarify\n  apply (rule_tac x=P' in exI)\n  apply (rule_tac x=Q' in exI)\n  apply (rule_tac x=A' in exI)\n  apply (rule conjI)\n  apply  assumption\n  (* no way to get s \\<in> P' *)\n  oops\n\nlemma LiberalConseq':\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                (\\<forall>(t::('s,'f) xstate). (s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule LiberalConseq)\napply (rule ballI)\napply (rule allI)\napply (insert cons)\napply (drule (1) bspec)\napply clarify\napply (rule_tac x=P' in exI)\napply (rule_tac x=Q' in exI)\napply (rule_tac x=A' in exI)\napply iprover\ndone\n\nlemma LiberalConseq'':\nfixes F:: \"'f set\"\nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s (t::('s,'f) xstate). \n                 (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in> Normal ` Q' Z \\<union> Abrupt ` A' Z)\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule LiberalConseq)\napply (rule ballI)\napply (rule allI)\napply (insert cons)\napply (erule_tac x=s in allE)\napply (erule_tac x=t in allE)\napply (case_tac \"t \\<in> Normal ` Q \\<union> Abrupt ` A\")\napply (insert spec)\napply  iprover\napply auto\ndone\n\nprimrec procs:: \"('s,'p,'f) com \\<Rightarrow> 'p set\"\nwhere\n\"procs Skip = {}\" |\n\"procs (Basic f) = {}\" |\n\"procs (Seq c\\<^sub>1 c\\<^sub>2)  = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\" |\n\"procs (Cond b c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\" |\n\"procs (While b c) = procs c\" |\n\"procs (Call p) = {p}\" |\n\"procs (DynCom c) = (\\<Union>s. procs (c s))\" |\n\"procs (Guard f g c) = procs c\" |\n\"procs Throw = {}\" |\n\"procs (Catch c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\" |\n\"procs (Await b c) = (procs c)\"\n\nprimrec noSpec:: \"('s,'p,'f) com \\<Rightarrow> bool\"\nwhere\n\"noSpec Skip = True\" |\n\"noSpec (Basic f) = True\" |\n\"noSpec (Spec r) = False\" |\n\"noSpec (Seq c\\<^sub>1 c\\<^sub>2)  = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\" |\n\"noSpec (Cond b c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\" |\n\"noSpec (While b c) = noSpec c\" |\n\"noSpec (Call p) = True\" |\n\"noSpec (DynCom c) = (\\<forall>s. noSpec (c s))\" |\n\"noSpec (Guard f g c) = noSpec c\" |\n\"noSpec Throw = True\" |\n\"noSpec (Catch c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\" |\n\"noSpec (Await b c) = noSpec c\"\n\nlemma exec_noSpec_no_Stuck:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes noSpec_c: \"noSpec c\"\n assumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\n assumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\n assumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\n assumes s_no_Stuck: \"s\\<noteq>Stuck\"\n shows \"t\\<noteq>Stuck\"\n  using exec noSpec_c procs_subset s_no_Stuck\n  proof (induct) \n    case (Call p bdy s t) with noSpec_\\<Gamma> procs_subset_\\<Gamma> show ?case \n      apply -\n      apply (drule bspec [where x=p])\n      apply  fastforce\n      apply (drule bspec [where x=p])\n      apply (auto)\n      done\n  qed fastforce+\n\nlemma execn_noSpec_no_Stuck:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes noSpec_c: \"noSpec c\"\n assumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\n assumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\n assumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\n assumes s_no_Stuck: \"s\\<noteq>Stuck\"\n shows \"t\\<noteq>Stuck\"\n  using exec noSpec_c procs_subset s_no_Stuck\n  proof (induct)\n     case (Call p bdy n s t) with noSpec_\\<Gamma> procs_subset_\\<Gamma> show ?case \n      apply -\n      apply (drule bspec [where x=p])\n      apply  fastforce\n      apply (drule bspec [where x=p])\n      apply (auto)\n      done\n  qed fastforce+\n\n\n\nlemma LiberalConseq_noguards_nothrows_sound:\nassumes spec: \"\\<forall>Z. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s t. (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in>  Q' Z )\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Q )\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from execn_noguards_no_Fault [OF exec noguards_c noguards_\\<Gamma>]\n     execn_nothrows_no_Abrupt [OF exec nothrows_c nothrows_\\<Gamma> ]\n     execn_noSpec_no_Stuck [OF exec  \n              noSpec_c  noSpec_\\<Gamma> procs_subset \n      procs_subset_\\<Gamma>]                            \n    obtain t' where t: \"t=Normal t'\"\n      by (cases t) auto\n    with exec spec ctxt\n    have \"(\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t' \\<in>  Q' Z)\"\n      by (unfold  cnvalid_def nvalid_def) blast\n    with cons P t show ?thesis\n      by simp\n  qed\nqed\n\n\nlemma LiberalConseq_noguards_nothrows:\nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s t. (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in>  Q' Z )\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Q )\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule hoare_complete')\napply (rule allI)\napply (rule LiberalConseq_noguards_nothrows_sound \n             [OF _ cons noguards_c noguards_\\<Gamma> nothrows_c nothrows_\\<Gamma> \n                 noSpec_c noSpec_\\<Gamma> \n                 procs_subset procs_subset_\\<Gamma>])\napply (insert spec)\napply (intro allI)\napply (erule_tac x=Z in allE)\nby (rule hoare_cnvalid)\n\nlemma \nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=fst Z \\<and> P s (snd Z)} c {t. Q (fst Z) (snd Z) t},{}\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=\\<sigma>} c {t. \\<forall>l. P \\<sigma> l \\<longrightarrow> Q \\<sigma> l t},{}\"\napply (rule allI)\napply (rule LiberalConseq_noguards_nothrows\n              [OF spec _ noguards_c noguards_\\<Gamma> nothrows_c nothrows_\\<Gamma>\n                  noSpec_c noSpec_\\<Gamma> \n                  procs_subset procs_subset_\\<Gamma>])\napply auto\ndone\n\nsubsubsection {* Modify Return *}\n\nlemma ProcModifyReturn_sound:\n  assumes valid_call: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n  assumes valid_modif: \n    \"\\<forall>\\<sigma>. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \n  assumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\n  assumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\n  shows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  then have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from exec\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.Call)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = \n      Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\"  .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\" \n      \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> p = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    then have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\n\nlemma ProcModifyReturn:\n  assumes spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n  assumes result_conform:\n      \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes return_conform:\n      \"\\<forall>s t. t \\<in> ModifAbr (init s) \n             \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes modifies_spec:  \n  \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule ProcModifyReturn_sound \n          [where Modif=Modif and ModifAbr=ModifAbr, \n            OF _ _ result_conform return_conform] )\nusing spec\napply (blast intro: hoare_cnvalid)\nusing modifies_spec\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma ProcModifyReturnSameFaults_sound:\n  assumes valid_call: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n  assumes valid_modif: \n    \"\\<forall>\\<sigma>. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \n  assumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\n  assumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\n  shows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from exec\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy \n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = \n      Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also \n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n \\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\"  and\n      t: \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    from cnvalidD [OF valid_call [rule_format] ctxt this P] t t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> p = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    then have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\n\nlemma ProcModifyReturnSameFaults:\n  assumes spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n  assumes result_conform:\n      \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes return_conform:\n  \"\\<forall>s t. t \\<in> ModifAbr (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes modifies_spec:  \n  \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule ProcModifyReturnSameFaults_sound \n          [where Modif=Modif and ModifAbr=ModifAbr, \n         OF _ _ result_conform return_conform])\nusing spec\napply (blast intro: hoare_cnvalid)\nusing modifies_spec\napply (blast intro: hoare_cnvalid)\ndone\n\nsubsubsection {* DynCall *}\n  \nlemma dynProcModifyReturn_sound:\nassumes valid_call: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  then have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  assume P: \"s \\<in> P\"\n  with valid_modif \n  have valid_modif': \"\\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n    by blast\n  from exec\n  have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by (cases rule: execn_dynCall_Normal_elim)\n  then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n\\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\" \n      \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> (p s) = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    hence \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma dynProcModifyReturn:\nassumes dyn_call: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nassumes modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>.  \n       \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule dynProcModifyReturn_sound [where Modif=Modif and ModifAbr=ModifAbr,\n          OF hoare_cnvalid [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_cnvalid [OF modif [rule_format]])\napply assumption\ndone\n\nlemma dynProcModifyReturnSameFaults_sound:\nassumes valid_call: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \\<longrightarrow> return' s t = return s t\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  assume P: \"s \\<in> P\"\n  with valid_modif \n  have valid_modif': \"\\<forall>\\<sigma>. \\<forall>n. \n    \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n    by blast\n  from exec\n  have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by (cases rule: execn_dynCall_Normal_elim)\n  then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n \\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.Call)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n \\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\"  and\n      t: \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this P] t t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> (p s) = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    hence \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma dynProcModifyReturnSameFaults:\nassumes dyn_call: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nassumes modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule dynProcModifyReturnSameFaults_sound \n        [where Modif=Modif and ModifAbr=ModifAbr,\n           OF hoare_cnvalid [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_cnvalid [OF modif [rule_format]])\napply assumption\ndone\n\n\nsubsubsection {* Conjunction of Postcondition *}\n\nlemma PostConjI_sound:\nassumes valid_Q: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\" \nassumes valid_R: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c R,B\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from valid_Q [rule_format] ctxt exec P t_notin_F have \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (rule cnvalidD)\n  moreover\n  from valid_R [rule_format] ctxt exec P t_notin_F have \"t \\<in> Normal ` R \\<union> Abrupt ` B\"\n    by (rule cnvalidD)\n  ultimately show \"t \\<in> Normal ` (Q \\<inter> R) \\<union> Abrupt ` (A \\<inter> B)\"\n    by blast\nqed\n\nlemma PostConjI: \n  assumes deriv_Q: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  assumes deriv_R: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c R,B\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule PostConjI_sound)\nusing deriv_Q\napply (blast intro: hoare_cnvalid)\nusing deriv_R\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma Merge_PostConj_sound: \n  assumes validF: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validG: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/G\\<^esub> P' c R,X\"\n  assumes F_G: \"F \\<subseteq> G\"\n  assumes P_P': \"P \\<subseteq> P'\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> X)\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  with F_G have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/G\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  with P_P' have P': \"s \\<in> P'\"\n    by auto\n  assume t_noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` (Q \\<inter> R) \\<union> Abrupt ` (A \\<inter> X)\"\n  proof -\n    from cnvalidD [OF validF [rule_format] ctxt exec P t_noFault]\n    have \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\n    moreover from this have \"t \\<notin> Fault ` G\"\n      by auto\n    from cnvalidD [OF validG [rule_format] ctxt' exec P' this]\n    have \"t \\<in> Normal ` R \\<union> Abrupt ` X\" .\n    ultimately show ?thesis by auto\n  qed\nqed\n\nlemma Merge_PostConj: \n  assumes validF: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validG: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/G\\<^esub> P' c R,X\"\n  assumes F_G: \"F \\<subseteq> G\"\n  assumes P_P': \"P \\<subseteq> P'\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> X)\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule Merge_PostConj_sound [OF _ _ F_G P_P'])\nusing validF apply (blast intro:hoare_cnvalid)\nusing validG apply (blast intro:hoare_cnvalid)\ndone\n\nsubsubsection {* Weaken Context *}\n\n\nlemma WeakenContext_sound:\n  assumes valid_c: \"\\<forall>n. \\<Gamma>,\\<Theta>'\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes valid_ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>'. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  with valid_ctxt\n  have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>'. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    by (simp add: cnvalid_def)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from valid_c [rule_format] ctxt' exec P t_notin_F\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (rule cnvalidD)\nqed\n\nlemma WeakenContext: \n  assumes deriv_c: \"\\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  assumes deriv_ctxt: \"\\<forall>(P,p,Q,A)\\<in>\\<Theta>'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule WeakenContext_sound)\nusing deriv_c\napply (blast intro: hoare_cnvalid)\nusing deriv_ctxt\napply (blast intro: hoare_cnvalid)\ndone\n\nsubsubsection {* Guards and Guarantees *}\n\nlemma SplitGuards_sound:\nassumes valid_c1: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\nassumes valid_c2: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\nassumes c: \"(c\\<^sub>1 \\<inter>\\<^sub>g c\\<^sub>2) = Some c\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case Normal\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    case Abrupt\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    case (Fault f)\n    with exec inter_guards_execn_Fault [OF c]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    then show ?thesis\n    proof (cases rule: disjE [consumes 1])\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      from Fault cnvalidD [OF valid_c1 [rule_format] ctxt this P] t_notin_F\n      show ?thesis\n        by blast\n    next\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      from Fault cnvalidD [OF valid_c2 [rule_format] ctxt this P] t_notin_F\n      show ?thesis\n        by blast\n    qed\n  next\n    case Stuck\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma SplitGuards: \n  assumes c: \"(c\\<^sub>1 \\<inter>\\<^sub>g c\\<^sub>2) = Some c\" \n  assumes deriv_c1: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\" \n  assumes deriv_c2: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule SplitGuards_sound [OF _ _ c])\nusing deriv_c1\napply (blast intro: hoare_cnvalid)\nusing deriv_c2\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma CombineStrip_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes valid_strip: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  hence ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case (Normal t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Normal \n    show ?thesis\n      by auto\n  next\n    case (Abrupt t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Abrupt \n    show ?thesis\n      by auto\n  next\n    case (Fault f)\n    show ?thesis\n    proof (cases \"f \\<in> F\")\n      case True\n      hence \"f \\<notin> -F\" by simp\n      with exec Fault\n      have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards (-F) c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" \n        by (auto intro: execn_to_execn_strip_guards_Fault)\n      from cnvalidD [OF valid_strip [rule_format] ctxt this P] Fault\n      have False\n        by auto\n      thus ?thesis ..\n    next\n      case False\n      with cnvalidD [OF valid [rule_format] ctxt' exec P] Fault\n      show ?thesis\n        by auto\n    qed\n  next\n    case Stuck\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Stuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma CombineStrip: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes deriv_strip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule CombineStrip_sound)\napply  (iprover intro: hoare_cnvalid [OF deriv])\napply (iprover intro: hoare_cnvalid [OF deriv_strip])\ndone\n\nlemma GuardsFlip_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validFlip: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  hence ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  from ctxt have ctxtFlip: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/-F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case (Normal t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Normal \n    show ?thesis\n      by auto\n  next\n    case (Abrupt t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Abrupt \n    show ?thesis\n      by auto\n  next\n    case (Fault f)\n    show ?thesis\n    proof (cases \"f \\<in> F\")\n      case True\n      hence \"f \\<notin> -F\" by simp\n      with cnvalidD [OF validFlip [rule_format] ctxtFlip exec P] Fault\n      have False\n        by auto\n      thus ?thesis ..\n    next\n      case False\n      with cnvalidD [OF valid [rule_format] ctxt' exec P] Fault\n      show ?thesis\n        by auto\n    qed\n  next\n    case Stuck\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Stuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma GuardsFlip: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes derivFlip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule GuardsFlip_sound)\napply  (iprover intro: hoare_cnvalid [OF deriv])\napply (iprover intro: hoare_cnvalid [OF derivFlip])\ndone\n\nlemma MarkGuardsI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_mark_guards_to_execn [OF exec] obtain t' where\n    exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n    t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n    by blast\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from cnvalidD [OF valid [rule_format] ctxt exec_c P]\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by blast\n    with t'_noFault\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma MarkGuardsI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"  \napply (rule hoare_complete')\napply (rule allI)\napply (rule MarkGuardsI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MarkGuardsD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"isFault t\")\n    case True\n    with execn_to_execn_mark_guards_Fault [OF exec ]\n    obtain f' where \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> Fault f'\"\n      by (fastforce elim: isFaultE)\n    from cnvalidD [OF valid [rule_format] ctxt this P]\n    have False\n      by auto\n    thus ?thesis ..\n  next\n    case False\n    from execn_to_execn_mark_guards [OF exec False]\n    obtain f' where \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    from cnvalidD [OF valid [rule_format] ctxt this P]\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma MarkGuardsD: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MarkGuardsD_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MergeGuardsI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  from execn_merge_guards_to_execn [OF exec_merge] \n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" .\n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec P t_notin_F]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma MergeGuardsI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MergeGuardsI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MergeGuardsD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_to_execn_merge_guards [OF exec] \n  have exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\".\n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_merge P t_notin_F]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\n\n\n\nlemma SubsetGuards_sound: \n  assumes c_c': \"c \\<subseteq>\\<^sub>g c'\"\n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c' Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_to_execn_subseteq_guards [OF c_c' exec] obtain t' where\n    exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n    t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n    by blast\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_c' P] t'_noFault t_noFault\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by auto\nqed\n\nlemma SubsetGuards: \n  assumes c_c': \"c \\<subseteq>\\<^sub>g c'\"\n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c' Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule SubsetGuards_sound [OF c_c'])\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma NormalizeD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  hence exec_norm: \"\\<Gamma>\\<turnstile>\\<langle>normalize c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    by (rule execn_to_execn_normalize)\n  assume P: \"s \\<in> P\" \n  assume noFault: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_norm P noFault]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma NormalizeD: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule NormalizeD_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma NormalizeI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume \"\\<Gamma>\\<turnstile>\\<langle>normalize c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  hence exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    by (rule execn_normalize_to_execn)\n  assume P: \"s \\<in> P\" \n  assume noFault: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec P noFault]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma NormalizeI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule NormalizeI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\n\nsubsubsection {* Restricting the Procedure Environment *}\n\nlemma nvalid_restrict_to_nvalid:\nassumes valid_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from execn_to_execn_restrict [OF exec]\n    obtain t' where\n      exec_res: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n      t_Fault: \"\\<forall>f. t = Fault f \\<longrightarrow> t' \\<in> {Fault f, Stuck}\" and\n      t'_notStuck: \"t'\\<noteq>Stuck \\<longrightarrow> t'=t\"\n      by blast\n    from t_Fault t_notin_F t'_notStuck have \"t' \\<notin> Fault ` F\"\n      by (cases t') auto\n    with valid_c exec_res P \n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: nvalid_def)\n    with t'_notStuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma valid_restrict_to_valid:\nassumes valid_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from exec_to_exec_restrict [OF exec]\n    obtain t' where\n      exec_res: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t'\" and\n      t_Fault: \"\\<forall>f. t = Fault f \\<longrightarrow> t' \\<in> {Fault f, Stuck}\" and\n      t'_notStuck: \"t'\\<noteq>Stuck \\<longrightarrow> t'=t\"\n      by blast\n    from t_Fault t_notin_F t'_notStuck have \"t' \\<notin> Fault ` F\"\n      by (cases t') auto\n    with valid_c exec_res P\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: valid_def)\n    with t'_notStuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma augment_procs:\nassumes deriv_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule hoare_complete)\n  apply (rule valid_restrict_to_valid)\n  apply (insert hoare_sound [OF deriv_c])\n  by (simp add: cvalid_def)\n\nlemma augment_Faults:\nassumes deriv_c: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes F: \"F \\<subseteq> F'\"\nshows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F'\\<^esub> P c Q,A\"\n  apply (rule hoare_complete)\n  apply (rule valid_augment_Faults [OF _ F])\n  apply (insert hoare_sound [OF deriv_c])\n  by (simp add: cvalid_def)\n\nend", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/HoarePartialProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.315693973293183}}
{"text": "(*\nCopyright 2018\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*)\ntheory BitVector_Rewriting\n  imports\n    reassembly_rewriting.Take_Bits_Rewriting\n    reassembly_manual_execution.BitVectors\nbegin\n\n\nsubsection \\<open>Logical Operators\\<close>\n\nlemma bv_to_bool_bool_to_bv:\n  shows \"bv_to_bool (bool_to_bv b) = b\"\n  by (cases b,auto simp add: bv_to_bool_def)\n\nlemma snd_bool_to_bv:\n  shows \"snd (bool_to_bv b) = 1\"\n  by (cases b,auto)\n\nlemma bv_to_bool_True:\n  shows \"bv_to_bool (1, 1) = True\"\n  by (auto simp add: bv_to_bool_def)\n\nlemma bv_to_bool_True_Suc0:\n  shows \"bv_to_bool (1, Suc 0) = True\"\n  by (auto simp add: bv_to_bool_def)\n\nlemma bv_to_bool_False:\n  shows \"bv_to_bool (0, 1) = False\"\n  by (auto simp add: bv_to_bool_def)\n\nlemma bv_to_bool_False_Suc0:\n  shows \"bv_to_bool (0, Suc 0) = False\"\n  by (auto simp add: bv_to_bool_def)\n\n\n\nsubsection \\<open>Concatenation and slicing\\<close>\n\n\n\nlemmas bv_slice_simps[simp] =\n  bv_slice.simps[of \"numeral h\" \"numeral l\" \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" \"numeral w\" 0]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" \"numeral w\" 1]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 0            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 0            0]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 0            1]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 1            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 1            0]\n  bv_slice.simps[of \"numeral h\" \"numeral l\" 1            1]\n  bv_slice.simps[of \"numeral h\" 0            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 0            \"numeral w\" 0]\n  bv_slice.simps[of \"numeral h\" 0            \"numeral w\" 1]\n  bv_slice.simps[of \"numeral h\" 0            0            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 0            0            0]\n  bv_slice.simps[of \"numeral h\" 0            0            1]\n  bv_slice.simps[of \"numeral h\" 0            1            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 0            1            0]\n  bv_slice.simps[of \"numeral h\" 0            1            1]\n  bv_slice.simps[of \"numeral h\" 1            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 1            \"numeral w\" 0]\n  bv_slice.simps[of \"numeral h\" 1            \"numeral w\" 1]\n  bv_slice.simps[of \"numeral h\" 1            0            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 1            0            0]\n  bv_slice.simps[of \"numeral h\" 1            0            1]\n  bv_slice.simps[of \"numeral h\" 1            1            \"numeral s\"]\n  bv_slice.simps[of \"numeral h\" 1            1            0]\n  bv_slice.simps[of \"numeral h\" 1            1            1]\n  bv_slice.simps[of 0           \"numeral l\" \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 0           \"numeral l\" \"numeral w\" 0]\n  bv_slice.simps[of 0           \"numeral l\" \"numeral w\" 1]\n  bv_slice.simps[of 0           \"numeral l\" 0            \"numeral s\"]\n  bv_slice.simps[of 0           \"numeral l\" 0            0]\n  bv_slice.simps[of 0           \"numeral l\" 0            1]\n  bv_slice.simps[of 0           \"numeral l\" 1            \"numeral s\"]\n  bv_slice.simps[of 0           \"numeral l\" 1            0]\n  bv_slice.simps[of 0           \"numeral l\" 1            1]\n  bv_slice.simps[of 0           0            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 0           0            \"numeral w\" 0]\n  bv_slice.simps[of 0           0            \"numeral w\" 1]\n  bv_slice.simps[of 0           0            0            \"numeral s\"]\n  bv_slice.simps[of 0           0            0            0]\n  bv_slice.simps[of 0           0            0            1]\n  bv_slice.simps[of 0           0            1            \"numeral s\"]\n  bv_slice.simps[of 0           0            1            0]\n  bv_slice.simps[of 0           0            1            1]\n  bv_slice.simps[of 0           1            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 0           1            \"numeral w\" 0]\n  bv_slice.simps[of 0           1            \"numeral w\" 1]\n  bv_slice.simps[of 0           1            0            \"numeral s\"]\n  bv_slice.simps[of 0           1            0            0]\n  bv_slice.simps[of 0           1            0            1]\n  bv_slice.simps[of 0           1            1            \"numeral s\"]\n  bv_slice.simps[of 0           1            1            0]\n  bv_slice.simps[of 0           1            1            1]\n  bv_slice.simps[of 1           \"numeral l\" \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 1           \"numeral l\" \"numeral w\" 0]\n  bv_slice.simps[of 1           \"numeral l\" \"numeral w\" 1]\n  bv_slice.simps[of 1           \"numeral l\" 0            \"numeral s\"]\n  bv_slice.simps[of 1           \"numeral l\" 0            0]\n  bv_slice.simps[of 1           \"numeral l\" 0            1]\n  bv_slice.simps[of 1           \"numeral l\" 1            \"numeral s\"]\n  bv_slice.simps[of 1           \"numeral l\" 1            0]\n  bv_slice.simps[of 1           \"numeral l\" 1            1]\n  bv_slice.simps[of 1           0            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 1           0            \"numeral w\" 0]\n  bv_slice.simps[of 1           0            \"numeral w\" 1]\n  bv_slice.simps[of 1           0            0            \"numeral s\"]\n  bv_slice.simps[of 1           0            0            0]\n  bv_slice.simps[of 1           0            0            1]\n  bv_slice.simps[of 1           0            1            \"numeral s\"]\n  bv_slice.simps[of 1           0            1            0]\n  bv_slice.simps[of 1           0            1            1]\n  bv_slice.simps[of 1           1            \"numeral w\" \"numeral s\"]\n  bv_slice.simps[of 1           1            \"numeral w\" 0]\n  bv_slice.simps[of 1           1            \"numeral w\" 1]\n  bv_slice.simps[of 1           1            0            \"numeral s\"]\n  bv_slice.simps[of 1           1            0            0]\n  bv_slice.simps[of 1           1            0            1]\n  bv_slice.simps[of 1           1            1            \"numeral s\"]\n  bv_slice.simps[of 1           1            1            0]\n  bv_slice.simps[of 1           1            1            1]\n  for h l w s\n\nlemmas bv_cat_simps[simp] =\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" \"numeral w1\" 0]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" \"numeral w1\" 1]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 0            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 0            0]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 0            1]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 1            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 1            0]\n  bv_cat.simps[of \"numeral w0\" \"numeral s0\" 1            1]\n  bv_cat.simps[of \"numeral w0\" 0            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 0            \"numeral w1\" 0]\n  bv_cat.simps[of \"numeral w0\" 0            \"numeral w1\" 1]\n  bv_cat.simps[of \"numeral w0\" 0            0            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 0            0            0]\n  bv_cat.simps[of \"numeral w0\" 0            0            1]\n  bv_cat.simps[of \"numeral w0\" 0            1            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 0            1            0]\n  bv_cat.simps[of \"numeral w0\" 0            1            1]\n  bv_cat.simps[of \"numeral w0\" 1            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 1            \"numeral w1\" 0]\n  bv_cat.simps[of \"numeral w0\" 1            \"numeral w1\" 1]\n  bv_cat.simps[of \"numeral w0\" 1            0            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 1            0            0]\n  bv_cat.simps[of \"numeral w0\" 1            0            1]\n  bv_cat.simps[of \"numeral w0\" 1            1            \"numeral s1\"]\n  bv_cat.simps[of \"numeral w0\" 1            1            0]\n  bv_cat.simps[of \"numeral w0\" 1            1            1]\n  bv_cat.simps[of 0           \"numeral s0\" \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 0           \"numeral s0\" \"numeral w1\" 0]\n  bv_cat.simps[of 0           \"numeral s0\" \"numeral w1\" 1]\n  bv_cat.simps[of 0           \"numeral s0\" 0            \"numeral s1\"]\n  bv_cat.simps[of 0           \"numeral s0\" 0            0]\n  bv_cat.simps[of 0           \"numeral s0\" 0            1]\n  bv_cat.simps[of 0           \"numeral s0\" 1            \"numeral s1\"]\n  bv_cat.simps[of 0           \"numeral s0\" 1            0]\n  bv_cat.simps[of 0           \"numeral s0\" 1            1]\n  bv_cat.simps[of 0           0            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 0           0            \"numeral w1\" 0]\n  bv_cat.simps[of 0           0            \"numeral w1\" 1]\n  bv_cat.simps[of 0           0            0            \"numeral s1\"]\n  bv_cat.simps[of 0           0            0            0]\n  bv_cat.simps[of 0           0            0            1]\n  bv_cat.simps[of 0           0            1            \"numeral s1\"]\n  bv_cat.simps[of 0           0            1            0]\n  bv_cat.simps[of 0           0            1            1]\n  bv_cat.simps[of 0           1            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 0           1            \"numeral w1\" 0]\n  bv_cat.simps[of 0           1            \"numeral w1\" 1]\n  bv_cat.simps[of 0           1            0            \"numeral s1\"]\n  bv_cat.simps[of 0           1            0            0]\n  bv_cat.simps[of 0           1            0            1]\n  bv_cat.simps[of 0           1            1            \"numeral s1\"]\n  bv_cat.simps[of 0           1            1            0]\n  bv_cat.simps[of 0           1            1            1]\n  bv_cat.simps[of 1           \"numeral s0\" \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 1           \"numeral s0\" \"numeral w1\" 0]\n  bv_cat.simps[of 1           \"numeral s0\" \"numeral w1\" 1]\n  bv_cat.simps[of 1           \"numeral s0\" 0            \"numeral s1\"]\n  bv_cat.simps[of 1           \"numeral s0\" 0            0]\n  bv_cat.simps[of 1           \"numeral s0\" 0            1]\n  bv_cat.simps[of 1           \"numeral s0\" 1            \"numeral s1\"]\n  bv_cat.simps[of 1           \"numeral s0\" 1            0]\n  bv_cat.simps[of 1           \"numeral s0\" 1            1]\n  bv_cat.simps[of 1           0            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 1           0            \"numeral w1\" 0]\n  bv_cat.simps[of 1           0            \"numeral w1\" 1]\n  bv_cat.simps[of 1           0            0            \"numeral s1\"]\n  bv_cat.simps[of 1           0            0            0]\n  bv_cat.simps[of 1           0            0            1]\n  bv_cat.simps[of 1           0            1            \"numeral s1\"]\n  bv_cat.simps[of 1           0            1            0]\n  bv_cat.simps[of 1           0            1            1]\n  bv_cat.simps[of 1           1            \"numeral w1\" \"numeral s1\"]\n  bv_cat.simps[of 1           1            \"numeral w1\" 0]\n  bv_cat.simps[of 1           1            \"numeral w1\" 1]\n  bv_cat.simps[of 1           1            0            \"numeral s1\"]\n  bv_cat.simps[of 1           1            0            0]\n  bv_cat.simps[of 1           1            0            1]\n  bv_cat.simps[of 1           1            1            \"numeral s1\"]\n  bv_cat.simps[of 1           1            1            0]\n  bv_cat.simps[of 1           1            1            1]\n  for w0 s0 w1 s1\n\nlemma size_bv_cat:\n  shows \"snd (bv_cat a b) = snd a + snd b\"\n  by (cases a,cases b,auto simp add: bv_cat.simps)\n\nlemma size_bv_slice:\n  shows \"snd (bv_slice h l a) = h + 1 - l\"\n  by (cases a,auto simp add: bv_slice.simps)\n\nlemma bv_cat_prepend_0:\n  fixes a :: \"'a::len word\"\n  assumes \"s < LENGTH('a)\"\n  shows \"bv_cat (0, s') (a,s) = (if s = 0 then 0 else \\<langle>s-1,0\\<rangle>a,s + s')\"\nproof(cases \"s = 0\")\n  case True\n  thus ?thesis\n    by (auto simp add: bv_cat.simps)\nnext\n  case False\n  {\n    fix b :: \"'a::len word\"\n    assume b: \"b=0\"\n    {\n      fix n::nat\n      assume n: \"n < LENGTH('a)\"\n      {\n        fix x h l :: nat\n        {\n          fix m :: nat\n          assume m: \"m < LENGTH('a)\"\n          hence \"\\<not> b !! (LENGTH('a) - 1 - m)\"\n            using b\n            by auto\n          hence \"\\<not> to_bl b ! m\"\n            using m\n            by (auto simp add: unfold_test_bit split: if_split_asm)\n        }\n        hence \"\\<not>((\\<langle>h,l\\<rangle>b)::'a::len word) !! x\"\n          apply (cases \"x < LENGTH('a)\";cases \"h < LENGTH('a)\")\n          apply (auto simp add: test_bit_of_take_bits)[1]\n          using b apply simp\n          by (auto simp add: take_bits_def test_bit_bl word_size rev_nth word_rep_drop min_def nth_append)\n      }\n      note 1 = this\n      have \"(fst (bv_cat (b, s') (a,s))) !! n= ((\\<langle>s-1,0\\<rangle>a):: 'a::len word)!!n\"\n        using assms n 1 False\n        apply (auto split: if_split_asm simp add: test_bit_of_take_bits bv_cat.simps word_ao_nth nth_shiftl)\n        using b nth_0 by blast\n    }\n    hence \"(fst (bv_cat (b, s') (a,s))) = ((\\<langle>s-1,0\\<rangle>a):: 'a::len word)\"\n      and \"(snd (bv_cat (b, s') (a,s))) = (s+s')\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size bv_cat.simps)+\n  }\n  thus ?thesis\n    using False\n    apply auto\n    by (metis prod.exhaust_sel)\nqed\n\n\n\n\n\nlemma test_bit_of_bv_cat:\n  fixes a b :: \"'a ::len0 word \\<times> nat\"\n  assumes \"snd a \\<le> LENGTH('a)\"\n      and \"snd b \\<le> LENGTH('a)\"\n      and \"i < LENGTH('a)\"\n    shows \"fst (bv_cat a b) !! i = (if i \\<ge> snd b then (fst a) !! (i - snd b) else (fst b) !! i)\"\n  using assms\n  by (cases a, cases b,auto simp add: bv_cat.simps test_bit_of_take_bits word_ao_nth nth_shiftl word_size split: if_split_asm)\n\nlemma test_bit_of_bv_slice:\n  assumes \"h < \\<M>\"\n  shows \"fst (bv_slice h l a) !! n = (if n < Suc h - l then fst a!!(l+n) else False)\"\n  using assms\n  apply (cases a, cases \"n < \\<M>\",auto simp add: bv_slice.simps test_bit_of_take_bits)\n  by (simp add: word_size test_bit_bin')\n\n\n\nlemma bv_slice_bv_cat:\nassumes \"h < \\<M>\"\n    and \"snd a \\<le> \\<M>\"\n    and \"snd b \\<le> \\<M>\"\n  shows \"bv_slice h l (bv_cat a b) =\n        (if h \\<ge> snd b then\n          (if l \\<ge> snd b then\n            bv_slice (h - snd b) (l - snd b) a\n           else\n            bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b))\n        else\n          (if l \\<ge> snd b then\n               (0,0)\n           else\n              bv_slice h l b))\"\nproof(cases \"h \\<ge> snd b\")\n  case True\n  note h = this\n  show ?thesis\n  proof(cases \"l \\<ge> snd b\")\n    case True\n    {\n      fix i :: nat\n      assume \"i < \\<M>\"\n      hence \"fst (bv_slice h l (bv_cat a b)) !! i = fst (bv_slice (h - snd b) (l - snd b) a) !! i\"\n        using h True assms\n        by (auto simp add: bv_cat.simps test_bit_of_bv_slice nth_ucast test_bit_of_bv_cat split: if_split_asm)\n    }\n    hence \"fst (bv_slice h l (bv_cat a b)) = fst (bv_slice (h - snd b) (l - snd b) a)\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n    moreover\n    have \"snd (bv_slice h l (bv_cat a b)) = snd (bv_slice (h - snd b) (l - snd b) a)\"\n      using True h\n      by (cases a, cases b,auto simp add: size_bv_slice)\n    ultimately\n    show ?thesis\n      using True h\n      apply (auto)\n      by (metis prod.exhaust_sel)\n  next\n    case False\n    {\n      fix i :: nat\n      assume \"i < \\<M>\"\n      hence \"fst (bv_slice h l (bv_cat a b)) !! i = fst (bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b)) !! i\"\n        using h False assms\n        apply (auto simp add: bv_cat.simps nth_ucast test_bit_of_bv_slice test_bit_of_bv_cat word_ao_nth nth_shiftl size_bv_slice split: if_split_asm)\n        by (simp add: Groups.add_ac(2))+\n    }\n    hence \"fst (bv_slice h l (bv_cat a b)) = fst (bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b))\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n    moreover\n    have \"snd (bv_slice h l (bv_cat a b)) = snd (bv_cat (bv_slice (h - snd b) 0 a) (bv_slice (snd b - 1) l b))\"\n      using False h\n      by (cases a, cases b,auto simp add: size_bv_slice size_bv_cat)\n    ultimately\n    show ?thesis\n      using False h\n      apply (auto)\n      by (metis prod.exhaust_sel)\n  qed\nnext\n  case False\n  note h = this\n  show ?thesis\n  proof(cases \"l \\<ge> snd b\")\n    case True\n    {\n      fix i :: nat\n      assume \"i < \\<M>\"\n      hence \"fst (bv_slice h l (bv_cat a b)) !! i = (0::longword) !! i\"\n        using h True assms\n        by (auto simp add: bv_cat.simps nth_ucast test_bit_of_bv_slice test_bit_of_bv_cat split: if_split_asm)\n    }\n    hence \"fst (bv_slice h l (bv_cat a b)) = 0\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n    moreover\n    have \"snd (bv_slice h l (bv_cat a b)) = 0\"\n      using True h\n      by (cases a, cases b,auto simp add: size_bv_slice size_bv_cat)\n    ultimately\n    show ?thesis\n      using True h\n      apply (auto)\n      by (metis prod.exhaust_sel)\n  next\n    case False\n    {\n      fix i :: nat\n      assume \"i < \\<M>\"\n      hence \"fst (bv_slice h l (bv_cat a b)) !! i = fst (bv_slice h l b) !! i\"\n        using h False assms\n        by (auto simp add: bv_cat.simps nth_ucast test_bit_of_bv_slice test_bit_of_bv_cat split: if_split_asm)\n    }\n    hence \"fst (bv_slice h l (bv_cat a b)) = fst (bv_slice h l b)\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n    moreover\n    have \"snd (bv_slice h l (bv_cat a b)) = snd (bv_slice h l b)\"\n      using False h\n      by (cases a, cases b,auto simp add: size_bv_slice size_bv_cat)\n    ultimately\n    show ?thesis\n      using False h\n      apply (auto)\n      by (metis prod.exhaust_sel)\n  qed\nqed\n\n\n\ndefinition \"bv_cat' \\<equiv> bv_cat\"\nlemma take_bits_bv_cat:\n  fixes a b :: \"'b ::len0 word \\<times> nat\"\n  assumes \"h < LENGTH('b)\"\n      and \"snd a \\<le> LENGTH('b)\"\n      and \"snd b \\<le> LENGTH('b)\"\n    shows \"((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) =\n        (if h \\<ge> snd b then\n          (if l \\<ge> snd b then\n            \\<langle>h - snd b,l - snd b\\<rangle>fst a\n           else\n            ((\\<langle>h,l\\<rangle> (fst (bv_cat' a b)))::'a::len0 word))\n        else\n          (if l \\<ge> snd b then\n               0\n           else\n              \\<langle>h,l\\<rangle> (fst b)))\"\nproof(cases \"h \\<ge> snd b\")\n  case True\n  note h = this\n  show ?thesis\n  proof(cases \"l \\<ge> snd b\")\n    case True\n    {\n      fix i :: nat\n      assume \"i < LENGTH('a)\"\n      hence \"((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) !! i = ((\\<langle>h - snd b,l - snd b\\<rangle>fst a)::'a::len0 word) !! i\"\n        using h True assms\n        by (auto simp add: bv_cat.simps test_bit_of_take_bits nth_ucast test_bit_of_bv_cat split: if_split_asm)\n    }\n    hence \"((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) = ((\\<langle>h - snd b,l - snd b\\<rangle>fst a)::'a::len0 word)\"\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n    thus ?thesis\n      using True h\n      by auto\n  next\n    case False\n    thus ?thesis\n      using h\n      by (auto simp add: bv_cat'_def)\n  qed\nnext\n  case False\n  note h = this\n  show ?thesis\n  proof(cases \"l \\<ge> snd b\")\n    case True\n    {\n      fix i :: nat\n      assume \"i < LENGTH('a)\"\n      hence \"((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) !! i = (0::'a::len0 word) !! i\"\n        using h True assms\n        by (auto simp add: bv_cat.simps nth_ucast test_bit_of_take_bits test_bit_of_bv_cat split: if_split_asm)\n    }\n    thus ?thesis\n      using True h\n      apply (auto)\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n  next\n    case False\n    {\n      fix i :: nat\n      assume \"i < LENGTH('a)\"\n      hence \"((\\<langle>h,l\\<rangle> (fst (bv_cat a b)))::'a::len0 word) !! i = (\\<langle>h,l\\<rangle> (fst b)::'a::len0 word) !! i\"\n        using h False assms\n        by (auto simp add: bv_cat.simps nth_ucast test_bit_of_take_bits test_bit_of_bv_cat split: if_split_asm)\n\n    }\n    thus ?thesis\n      using False h\n      apply (auto)\n      apply (intro word_eqI)\n      by (auto simp add: word_size)\n  qed\nqed\n\n\nlemma take_bits_bv_slice:\n  assumes \"h < \\<M>\"\n      and \"h' < \\<M>\"\n  shows \"\\<langle>h,l\\<rangle>fst (bv_slice h' l' a) =  \\<langle>(if Suc h - l < Suc h' - (l + l') then h + l' else h'),l + l'\\<rangle>fst a\"\n  using assms\n  by (cases a,auto simp add: bv_slice.simps)\n\nlemma bv_slice_take_bits:\n  assumes \"h < \\<M>\"\n      and \"h' < LENGTH('a)\"\n  fixes a ::\"'a::len0 word\"\n  shows \"bv_slice h l (\\<langle>h',l'\\<rangle>a, s) = (\\<langle>(if Suc h - l < Suc h' - (l + l') then h + l' else h'),l + l'\\<rangle>a, h + 1 - l)\"\n  using assms\n  by (auto simp add: bv_slice.simps)\n\nlemma bv_slice_bit32:\n  fixes a :: longword\n  assumes \"s \\<ge> 32\"\n  shows \"bv_slice 31 0 (a,s) = (ucast ((\\<langle>31,0\\<rangle>a)::32 word), 32)\"\n  using assms\n  by (auto simp add: bv_slice.simps)\n\nlemma bv_slice_bit16:\n  fixes a :: longword\n  assumes \"s \\<ge> 16\"\n  shows \"bv_slice 15 0 (a,s) = (ucast ((\\<langle>15,0\\<rangle>a)::16 word), 16)\"\n  using assms\n  by (auto simp add: bv_slice.simps)\n\nlemma bv_slice_bit8:\n  fixes a :: longword\n  assumes \"s \\<ge> 8\"\n  shows \"bv_slice 7 0 (a,s) = (ucast ((\\<langle>7,0\\<rangle>a)::8 word), 8)\"\n  using assms\n  by (auto simp add: bv_slice.simps)\n\nsubsection \\<open>Arithmetic\\<close>\n\nlemma BV_Add_bit64:\n  fixes a b :: longword\n    shows \"(a,64) +\\<^sup>b\\<^sup>v (b,64) = (ucast (((\\<langle>63,0\\<rangle>a)::64 word) + \\<langle>63,0\\<rangle>b), 64)\"\nproof-\n  have \"(a,64) +\\<^sup>b\\<^sup>v (b,64) = (\\<langle>63,0\\<rangle>(a + b), 64)\"\n    by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n  also have \"... = (ucast ((\\<langle>63,0\\<rangle>(a + b))::64 word), 64)\"\n    by (subst ucast_take_bits,simp,simp,simp)\n  also have \"... = (ucast (((\\<langle>63,0\\<rangle>a)::64 word) + \\<langle>63,0\\<rangle>b), 64)\"\n    by (subst take_bits_plus,simp,simp,simp)\n  finally\n  show ?thesis\n    by auto\nqed\n\nlemma BV_Add_bit33:\n  fixes a b :: longword\n    shows \"(a,33) +\\<^sup>b\\<^sup>v (b,33) = (ucast (((\\<langle>32,0\\<rangle>a)::33 word) + \\<langle>32,0\\<rangle>b), 33)\"\nproof-\n  have \"(a,33) +\\<^sup>b\\<^sup>v (b,33) = (\\<langle>32,0\\<rangle>(a + b), 33)\"\n    by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n  also have \"... = (ucast ((\\<langle>32,0\\<rangle>(a + b))::33 word), 33)\"\n    by (subst ucast_take_bits,simp,simp,simp)\n  also have \"... = (ucast (((\\<langle>32,0\\<rangle>a)::33 word) + \\<langle>32,0\\<rangle>b), 33)\"\n    by (subst take_bits_plus,simp,simp,simp)\n  finally\n  show ?thesis\n    by auto\nqed\n\nlemma BV_Add_bit65:\n  fixes a b :: longword\n    shows \"(a,65) +\\<^sup>b\\<^sup>v (b,65) = (ucast (((\\<langle>64,0\\<rangle>a)::65 word) + \\<langle>64,0\\<rangle>b), 65)\"\nproof-\n  have \"(a,65) +\\<^sup>b\\<^sup>v (b,65) = (\\<langle>64,0\\<rangle>(a + b), 65)\"\n    by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n  also have \"... = (ucast ((\\<langle>64,0\\<rangle>(a + b))::65 word), 65)\"\n    by (subst ucast_take_bits,simp,simp,simp)\n  also have \"... = (ucast (((\\<langle>64,0\\<rangle>a)::65 word) + \\<langle>64,0\\<rangle>b), 65)\"\n    by (subst take_bits_plus,simp,simp,simp)\n  finally\n  show ?thesis\n    by auto\nqed\n\nlemma BV_Add_bit17:\n  fixes a b :: longword\n    shows \"(a,17) +\\<^sup>b\\<^sup>v (b,17) = (ucast (((\\<langle>16,0\\<rangle>a)::17 word) + \\<langle>16,0\\<rangle>b), 17)\"\nproof-\n  have \"(a,17) +\\<^sup>b\\<^sup>v (b,17) = (\\<langle>16,0\\<rangle>(a + b), 17)\"\n    by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n  also have \"... = (ucast ((\\<langle>16,0\\<rangle>(a + b))::17 word), 17)\"\n    by (subst ucast_take_bits,simp,simp,simp)\n  also have \"... = (ucast (((\\<langle>16,0\\<rangle>a)::17 word) + \\<langle>16,0\\<rangle>b), 17)\"\n    by (subst take_bits_plus,simp,simp,simp)\n  finally\n  show ?thesis\n    by auto\nqed\n\nlemma BV_Add_bit9:\n  fixes a b :: longword\n    shows \"(a,9) +\\<^sup>b\\<^sup>v (b,9) = (ucast (((\\<langle>8,0\\<rangle>a)::9 word) + \\<langle>8,0\\<rangle>b), 9)\"\nproof-\n  have \"(a,9) +\\<^sup>b\\<^sup>v (b,9) = (\\<langle>8,0\\<rangle>(a + b), 9)\"\n    by (cases a;cases b;auto simp add: exec_BV_Plus_def case_prod_unfold)\n  also have \"... = (ucast ((\\<langle>8,0\\<rangle>(a + b))::9 word), 9)\"\n    by (subst ucast_take_bits,simp,simp,simp)\n  also have \"... = (ucast (((\\<langle>8,0\\<rangle>a)::9 word) + \\<langle>8,0\\<rangle>b), 9)\"\n    by (subst take_bits_plus,simp,simp,simp)\n  finally\n  show ?thesis\n    by auto\nqed\n\nsubsection \\<open>Floating Point operations\\<close>\n\ncontext abstract_float\nbegin\n\n\nlemma BV_Plus_bit64:\n  fixes a b :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fplus\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>b, 64) = (\\<langle>63,0\\<rangle>(a +\\<^sup>f b), 64)\"\n  by (auto simp add: exec_BV_Plus_Double_def)\n\nlemma BV_Plus_bit64_numeral:\n  fixes a :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fplus\\<^sup>b\\<^sup>v (numeral n, 64) = (\\<langle>63,0\\<rangle>(a +\\<^sup>f \\<langle>63,0\\<rangle>((numeral n)::longword)), 64)\"\n  by (auto simp add: exec_BV_Plus_Double_def)\n\nlemma BV_Sub_bit64:\n  fixes a b :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fsub\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>b, 64) = (\\<langle>63,0\\<rangle>(a -\\<^sup>f b), 64)\"\n  by (auto simp add: exec_BV_Sub_Double_def)\n\nlemma BV_Sub_bit64_numeral:\n  fixes a :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fsub\\<^sup>b\\<^sup>v (numeral n, 64) = (\\<langle>63,0\\<rangle>(a -\\<^sup>f \\<langle>63,0\\<rangle>((numeral n)::longword)), 64)\"\n  by (auto simp add: exec_BV_Sub_Double_def)\n\nlemma BV_Mult_bit64:\n  fixes a b :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fmult\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>b, 64) = (\\<langle>63,0\\<rangle>(a *\\<^sup>f b), 64)\"\n  by (auto simp add: exec_BV_Mul_Double_def)\n\nlemma BV_Mult_bit64_numeral_r:\n  fixes a :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fmult\\<^sup>b\\<^sup>v (numeral n, 64) = (\\<langle>63,0\\<rangle>(a *\\<^sup>f \\<langle>63,0\\<rangle>((numeral n)::longword)), 64)\"\n  by (auto simp add: exec_BV_Mul_Double_def)\nlemma BV_Mult_bit64_numeral_l:\n  fixes a :: \"64 word\"\n  shows \"(numeral n, 64) fmult\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>a, 64) = (\\<langle>63,0\\<rangle>(\\<langle>63,0\\<rangle>((numeral n)::longword) *\\<^sup>f a), 64)\"\n  by (auto simp add: exec_BV_Mul_Double_def)\nlemma BV_Mult_bit64_0_l:\n  fixes a :: \"64 word\"\n  shows \"(0, 64) fmult\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>a, 64) = (\\<langle>63,0\\<rangle>(0\\<^sup>+ *\\<^sup>f a), 64)\"\n  by (auto simp add: exec_BV_Mul_Double_def plus_zero_def)\nlemma BV_Mult_bit64_0_r:\n  fixes a :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fmult\\<^sup>b\\<^sup>v (0, 64) = (\\<langle>63,0\\<rangle>(a *\\<^sup>f 0\\<^sup>+), 64)\"\n  by (auto simp add: exec_BV_Mul_Double_def plus_zero_def)\n\n\nlemma BV_Div_bit64:\n  fixes a b :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fdiv\\<^sup>b\\<^sup>v (\\<langle>63,0\\<rangle>b, 64) = (\\<langle>63,0\\<rangle>(a div\\<^sup>f b), 64)\"\n  by (auto simp add: exec_BV_Div_Double_def)\n\nlemma BV_Div_bit64_numeral:\n  fixes a :: \"64 word\"\n  shows \"(\\<langle>63,0\\<rangle>a, 64) fdiv\\<^sup>b\\<^sup>v (numeral n, 64) = (\\<langle>63,0\\<rangle>(a div\\<^sup>f \\<langle>63,0\\<rangle>((numeral n)::longword)), 64)\"\n  by (auto simp add: exec_BV_Div_Double_def)\n\nend\n\n\n\nsubsection \\<open>Simplification rules\\<close>\n\n\nlemmas (in abstract_float) bit_vector_simps =\n    bv_slice_bv_cat take_bits_bv_slice bv_slice_take_bits take_bits_bv_cat bv_slice_bit32\n    bv_cat_prepend_0 size_bv_cat size_bv_slice\n    bv_to_bool_bool_to_bv snd_bool_to_bv\n    bv_to_bool_True bv_to_bool_True_Suc0\n    bv_to_bool_False bv_to_bool_False_Suc0\n    BV_Add_bit65 BV_Add_bit64 BV_Add_bit33\n    bv_slice_bit16 bv_slice_bit8 BV_Add_bit17 BV_Add_bit9\n    BV_Plus_bit64 BV_Plus_bit64_numeral\n    BV_Sub_bit64 BV_Sub_bit64_numeral\n    BV_Mult_bit64 BV_Mult_bit64_numeral_r BV_Mult_bit64_numeral_l BV_Mult_bit64_0_l BV_Mult_bit64_0_r\n    BV_Div_bit64 BV_Div_bit64_numeral\n\nend\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/safecomp2019_artifact/old_work/isabelle/BitVector_Rewriting.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813031051514763, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.31556811218090247}}
{"text": "theory HeapLang\nimports \n  Main\n  Locations\nbegin\n\nsection \\<open> HeapLang Definition \\<close>\ntext \\<open> The basic language definition \\<close>\ntext \\<open> Based on \\<^url>\\<open>https://gitlab.mpi-sws.org/iris/iris/-/blob/master/iris_heap_lang/lang.v\\<close> \\<close>\n\ntype_synonym proph_id = nat\n\n(*\n  Binder type for anonymous and named binders, \n  cf. https://gitlab.mpi-sws.org/iris/stdpp/-/blob/master/theories/binders.v \n*)\ntype_synonym binder_t = \"string option\" \n\n(* Literals *)\ndatatype base_lit =\n  LitInt int | LitBool bool | LitUnit | LitPoison | LitLoc loc | LitProphecy proph_id\n\n(* Unary operator symbols*)\ndatatype un_op =\n  NegOp | MinusUnOp\n\n(* Binary Operator Symbols *)\ndatatype bin_op =\n  PlusOp | MinusOp | MultOp | QuotOp | RemOp | AndOp | OrOp | XorOp | ShiftLOp\n  | ShiftROp | LeOp | LtOp | EqOp | OffsetOp\n\n(* Expressions and values *)\ndatatype expr =\n  (* Values *)\n  Val val\n  (* Base lambda calculus *)\n  | Var string\n  | Rec binder_t binder_t expr\n  | App expr expr\n  (* Base types and their operations *)\n  | UnOp un_op expr\n  | BinOp bin_op expr expr\n  | If expr expr expr\n  (* Products *)\n  | Pair expr expr\n  | Fst expr\n  | Snd expr\n  (* Sums *)\n  | InjL expr\n  | InjR expr\n  | Case expr expr expr\n  (* Concurrency *)\n  | Fork expr\n  (* Heap *)\n  | AllocN expr expr (* array length (positive number), initial value *)\n  | Free expr\n  | Load expr\n  | Store expr expr\n  | CmpXchg expr expr expr (* Compare-exchange *)\n  | Xchg expr expr (* exchange *)\n  | FAA expr expr (* Fetch-and-add *)\n  (* Prophecy *)\n  | NewProph\n  | Resolve expr expr expr (* wrapped expr, proph, val *)\nand val =\n  LitV base_lit\n  | RecV binder_t binder_t expr\n  | PairV val val\n  | InjLV val\n  | InjRV val\n\ndeclare [[coercion Val]]\n  \n(* An observation associates a prophecy variable (identifier) to a pair of values. *)\ntype_synonym observation = \"proph_id * val * val\"\n\nabbreviation \"of_val \\<equiv> Val\"\n\nfun to_val :: \"expr \\<Rightarrow> val option\" where\n  \"to_val (Val v) = Some v\"\n| \"to_val _ = None\"\n\nlemma to_val_cases: \"to_val x = Some v \\<Longrightarrow> x = Val v\"\nby (induction x, auto)\n\nfun lit_is_unboxed :: \"base_lit \\<Rightarrow> bool\" where\n  \"lit_is_unboxed (LitProphecy _) = False\"\n| \"lit_is_unboxed LitPoison = False\"\n| \"lit_is_unboxed _ = True\"\n\nfun val_is_unboxed :: \"val \\<Rightarrow> bool\" where\n  \"val_is_unboxed (LitV l) = lit_is_unboxed l\"\n| \"val_is_unboxed (InjLV (LitV l)) = lit_is_unboxed l\"\n| \"val_is_unboxed (InjRV (LitV l)) = lit_is_unboxed l\"\n| \"val_is_unboxed _ = False\"\n\ndefinition vals_compare_safe :: \"val \\<Rightarrow> val \\<Rightarrow> bool\" where \n  \"vals_compare_safe v1 v2 = (val_is_unboxed v1 \\<or> val_is_unboxed v2)\"\n\n(** Evaluation contexts *)\ndatatype ectx_item =\n  AppLCtx val\n  | AppRCtx expr\n  | UnOpCtx un_op\n  | BinOpLCtx bin_op val\n  | BinOpRCtx bin_op expr\n  | IfCtx expr expr\n  | PairLCtx val\n  | PairRCtx expr\n  | FstCtx\n  | SndCtx\n  | InjLCtx\n  | InjRCtx\n  | CaseCtx expr expr\n  | AllocNLCtx val\n  | AllocNRCtx expr\n  | FreeCtx\n  | LoadCtx\n  | StoreLCtx val\n  | StoreRCtx expr\n  | XchgLCtx val\n  | XchgRCtx expr\n  | CmpXchgLCtx val val\n  | CmpXchgMCtx expr val\n  | CmpXchgRCtx expr expr\n  | FaaLCtx val\n  | FaaRCtx expr\n  | ResolveLCtx ectx_item val val\n  | ResolveMCtx expr val\n  | ResolveRCtx expr expr\n\nfun fill_item :: \"ectx_item \\<Rightarrow> expr \\<Rightarrow> expr\" where\n  \"fill_item (AppLCtx v2) e = App e (of_val v2)\"\n| \"fill_item (AppRCtx e1) e = App e1 e\"\n| \"fill_item (UnOpCtx op) e = UnOp op e\"\n| \"fill_item (BinOpLCtx op v2) e = BinOp op e (Val v2)\"\n| \"fill_item (BinOpRCtx op e1) e = BinOp op e1 e\"\n| \"fill_item (IfCtx e1 e2) e = If e e1 e2\"\n| \"fill_item (PairLCtx v2) e = Pair e (Val v2)\"\n| \"fill_item (PairRCtx e1) e = Pair e1 e\"\n| \"fill_item FstCtx e = Fst e\"\n| \"fill_item SndCtx e = Snd e\"\n| \"fill_item InjLCtx e = InjL e\"\n| \"fill_item InjRCtx e = InjR e\"\n| \"fill_item (CaseCtx e1 e2) e = Case e e1 e2\"\n| \"fill_item (AllocNLCtx v2) e = AllocN e (Val v2)\"\n| \"fill_item (AllocNRCtx e1) e = AllocN e1 e\"\n| \"fill_item FreeCtx e = Free e\"\n| \"fill_item LoadCtx e = Load e\"\n| \"fill_item (StoreLCtx v2) e = Store e (Val v2)\"\n| \"fill_item (StoreRCtx e1) e = Store e1 e\"\n| \"fill_item (XchgLCtx v2) e = Xchg e (Val v2)\"\n| \"fill_item (XchgRCtx e1) e = Xchg e1 e\"\n| \"fill_item (CmpXchgLCtx v1 v2) e = CmpXchg e (Val v1) (Val v2)\"\n| \"fill_item (CmpXchgMCtx e0 v2) e = CmpXchg e0 e (Val v2)\"\n| \"fill_item (CmpXchgRCtx e0 e1) e = CmpXchg e0 e1 e\"\n| \"fill_item (FaaLCtx v2) e = FAA e (Val v2)\"\n| \"fill_item (FaaRCtx e1) e = FAA e1 e\"\n| \"fill_item (ResolveLCtx K v1 v2) e = Resolve (fill_item K e) (Val v1) (Val v2)\"\n| \"fill_item (ResolveMCtx ex v2) e = Resolve ex e (Val v2)\"\n| \"fill_item (ResolveRCtx ex e1) e = Resolve ex e1 e\"\n\nfun subst :: \"string \\<Rightarrow> val \\<Rightarrow> expr \\<Rightarrow> expr\" where\n  \"subst _ _ (Val v) = Val v\"\n| \"subst x v (Var y) = (if x=y then Val v else Var y)\"\n| \"subst x v (Rec f y e) = Rec f y (if (Some x \\<noteq> f \\<and> Some x \\<noteq> y) then subst x v e else e)\"\n| \"subst x v (App e1 e2) = App (subst x v e1) (subst x v e2)\"\n| \"subst x v (UnOp op e) = UnOp op (subst x v e)\"\n| \"subst x v (BinOp op e1 e2) = BinOp op (subst x v e1) (subst x v e2)\"\n| \"subst x v (If e0 e1 e2) = If (subst x v e0) (subst x v e1) (subst x v e2)\"\n| \"subst x v (Pair e1 e2) = Pair (subst x v e1) (subst x v e2)\"\n| \"subst x v (Fst e) = Fst (subst x v e)\"\n| \"subst x v (Snd e) = Snd (subst x v e)\"\n| \"subst x v (InjL e) = InjL (subst x v e)\"\n| \"subst x v (InjR e) = InjR (subst x v e)\"\n| \"subst x v (Case e0 e1 e2) = Case (subst x v e0) (subst x v e1) (subst x v e2)\"\n| \"subst x v (Fork e) = Fork (subst x v e)\"\n| \"subst x v (AllocN e1 e2) = AllocN (subst x v e1) (subst x v e2)\"\n| \"subst x v (Free e) = Free (subst x v e)\"\n| \"subst x v (Load e) = Load (subst x v e)\"\n| \"subst x v (Xchg e1 e2) = Xchg (subst x v e1) (subst x v e2)\"\n| \"subst x v (Store e1 e2) = Store (subst x v e1) (subst x v e2)\"\n| \"subst x v (CmpXchg e0 e1 e2) = CmpXchg (subst x v e0) (subst x v e1) (subst x v e2)\"\n| \"subst x v (FAA e1 e2) = FAA (subst x v e1) (subst x v e2)\"\n| \"subst _ _ NewProph = NewProph\"\n| \"subst x v (Resolve ex e1 e2) = Resolve (subst x v ex) (subst x v e1) (subst x v e2)\"\n\ndefinition subst' :: \"binder_t \\<Rightarrow> val \\<Rightarrow> expr \\<Rightarrow> expr\" where\n  \"subst' mx v = (case mx of Some x \\<Rightarrow> subst x v | None \\<Rightarrow> (\\<lambda>x. x))\"\n\n(* The stepping relation *)\nfun un_op_eval :: \"un_op \\<Rightarrow> val \\<Rightarrow> val option\" where\n  \"un_op_eval NegOp (LitV (LitBool b)) = Some (LitV (LitBool (\\<not> b)))\"\n| \"un_op_eval NegOp (LitV (LitInt n)) = Some (LitV (LitInt (not n)))\"\n| \"un_op_eval MinusUnOp (LitV (LitInt n)) = Some (LitV (LitInt (- n)))\"\n| \"un_op_eval _ _ = None\"\n\nfun bin_op_eval_int :: \"bin_op \\<Rightarrow> int \\<Rightarrow> int \\<Rightarrow> base_lit option\" where\n  \"bin_op_eval_int PlusOp n1 n2 = Some (LitInt (n1 + n2))\"\n| \"bin_op_eval_int MinusOp n1 n2 = Some (LitInt (n1 - n2))\"\n| \"bin_op_eval_int MultOp n1 n2 = Some (LitInt (n1 * n2))\"\n| \"bin_op_eval_int QuotOp n1 n2 = Some (LitInt (n1 div n2))\"\n| \"bin_op_eval_int RemOp n1 n2 = Some (LitInt (n1 mod n2))\"\n| \"bin_op_eval_int AndOp n1 n2 = Some (LitInt (and n1 n2))\"\n| \"bin_op_eval_int OrOp n1 n2 = Some (LitInt (or n1 n2))\"\n| \"bin_op_eval_int XorOp n1 n2 = Some (LitInt (xor n1 n2))\"\n| \"bin_op_eval_int ShiftLOp n1 n2 = Some (LitInt (push_bit (nat n1) n2))\"\n| \"bin_op_eval_int ShiftROp n1 n2 = Some (LitInt (drop_bit (nat n1) n2))\"\n| \"bin_op_eval_int LeOp n1 n2 = Some (LitBool (n1 \\<le> n2))\"\n| \"bin_op_eval_int LtOp n1 n2 = Some (LitBool (n1 < n2))\"\n| \"bin_op_eval_int EqOp n1 n2 = Some (LitBool (n1 = n2))\"\n| \"bin_op_eval_int OffsetOp _ _ = None\" (* Pointer arithmetic *)\n\nfun bin_op_eval_bool :: \"bin_op \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> base_lit option\" where\n  \"bin_op_eval_bool AndOp b1 b2 = Some (LitBool (b1 \\<and> b2))\"\n| \"bin_op_eval_bool OrOp b1 b2 = Some (LitBool (b1 \\<or> b2))\"\n| \"bin_op_eval_bool XorOp b1 b2 = Some (LitBool ((\\<not>b1\\<and>b2)\\<or>(b1\\<and>\\<not>b2)))\"\n| \"bin_op_eval_bool EqOp b1 b2 = Some (LitBool (b1 = b2))\"\n| \"bin_op_eval_bool _ _ _ = None\"\n\nfun bin_op_eval_loc :: \"bin_op \\<Rightarrow> loc \\<Rightarrow> base_lit \\<Rightarrow> base_lit option\" where\n  \"bin_op_eval_loc OffsetOp l (LitInt off) = Some (LitLoc (l+\\<^sub>\\<iota>off))\"\n| \"bin_op_eval_loc _ _ _ = None\"\n\n\ndefinition bin_op_eval :: \"bin_op \\<Rightarrow> val \\<Rightarrow> val \\<Rightarrow> val option\" where\n  \"bin_op_eval op v1 v2 = \n  (if (op = EqOp) then\n      if (vals_compare_safe v1 v2) then\n        Some (LitV (LitBool (v1 = v2)))\n      else\n        None\n   else (case (v1, v2) of\n      (LitV (LitInt n1), LitV (LitInt n2)) \\<Rightarrow> map_option LitV (bin_op_eval_int op n1 n2)\n      | (LitV (LitBool b1), LitV (LitBool b2)) \\<Rightarrow> map_option LitV (bin_op_eval_bool op b1 b2)\n      | (LitV (LitLoc l1), LitV v2) \\<Rightarrow> map_option LitV (bin_op_eval_loc op l1 v2)\n      | (_, _) \\<Rightarrow> None)\n    )\"\nend", "meta": {"author": "firefighterduck", "repo": "isariris", "sha": "d02268e1e11cf681cae70b366b52843cbd90cc49", "save_path": "github-repos/isabelle/firefighterduck-isariris", "path": "github-repos/isabelle/firefighterduck-isariris/isariris-d02268e1e11cf681cae70b366b52843cbd90cc49/HeapLang/HeapLang.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3155078364227857}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory AbstractArrays\nimports\n  \"CParser.TypHeapLib\"\n  \"Word_Lib.WordSetup\"\nbegin\n\n(*\n * Return a list of addresses that contain an element for an array at location\n * \"p\" of length \"n\".\n *)\nprimrec\n  array_addrs :: \"('a::mem_type) ptr \\<Rightarrow> nat \\<Rightarrow> 'a ptr list\"\nwhere\n  \"array_addrs _ 0 = []\"\n| \"array_addrs p (Suc n) = p # (array_addrs (p +\\<^sub>p 1) n)\"\n\ndeclare array_addrs.simps(2) [simp del]\n\n(* The first element is in the array if the array has non-zero length. *)\nlemma hd_in_array_addrs [simp]:\n  \"(x \\<in> set (array_addrs x n)) = (n > 0)\"\n  by (case_tac n, auto simp: array_addrs.simps(2))\n\nlemma array_addrs_1 [simp]:\n  \"array_addrs p (Suc 0) = [p]\"\n  \"array_addrs p 1 = [p]\"\n  by (auto simp: array_addrs.simps(2))\n\n(* All array elements are aligned if the array itself is aligned. *)\nlemma array_addrs_ptr_aligned:\n     \"\\<lbrakk> x \\<in> set (array_addrs p n); ptr_aligned p \\<rbrakk> \\<Longrightarrow> ptr_aligned x\"\n  apply (induct n arbitrary: x p)\n   apply clarsimp\n  apply (clarsimp simp: array_addrs.simps(2))\n  apply (erule disjE)\n   apply clarsimp\n  apply atomize\n  apply (drule_tac x=x in spec)\n  apply (drule_tac x=\"p +\\<^sub>p 1\" in spec)\n  apply (clarsimp simp: ptr_aligned_plus)\n  done\n\n(* Split off the last element in an array. *)\nlemma set_array_addrs_unfold_last:\n  shows \"set (array_addrs a (Suc n)) = set (array_addrs a n) \\<union> {(a :: ('a::mem_type) ptr) +\\<^sub>p int n}\"\n    (is \"?LHS a n = ?RHS a n\")\nproof (induct n arbitrary: a)\n  fix a\n  show \"?LHS a 0 = ?RHS a 0\"\n    by clarsimp\nnext\n  fix a n\n  assume induct: \"\\<And>a. ?LHS a n = ?RHS a n\"\n  show \"?LHS a (Suc n) = ?RHS a (Suc n)\"\n  apply (subst array_addrs.simps(2))\n  apply (subst set_simps)\n  apply (subst induct [where a=\"a +\\<^sub>p 1\"])\n  apply (subst array_addrs.simps(2))\n  apply (subst set_simps)\n  apply (clarsimp simp: CTypesDefs.ptr_add_def field_simps insert_commute)\n  done\nqed\n\n(* Alternative representation of the set of array elements. *)\nlemma set_array_addrs:\n  \"set (array_addrs (p :: ('a::mem_type) ptr) n)\n           = {x. \\<exists>k. x = p +\\<^sub>p int k \\<and> k < n }\"\n  apply (induct n arbitrary: p)\n   apply (clarsimp simp: not_less)\n  apply (subst set_array_addrs_unfold_last)\n  apply atomize\n  apply (drule_tac x=p in spec)\n  apply (erule ssubst)\n  apply (rule set_eqI)\n  apply (rule iffI)\n   apply clarsimp\n   apply (erule disjE)\n    apply clarsimp\n    apply force\n   apply force\n  apply clarsimp\n  apply (drule_tac x=k in spec)\n  apply (clarsimp simp: not_less)\n  apply (subgoal_tac \"k = n\")\n   apply clarsimp\n  apply clarsimp\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/AbstractArrays.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3155078364227857}}
{"text": "theory Sep_Algebra_Add\n  imports \"Separation_Algebra.Separation_Algebra\" \"Separation_Algebra.Sep_Heap_Instance\"\n    Product_Separation_Algebra\nbegin\n\ndefinition puree :: \"bool \\<Rightarrow> 'h::sep_algebra \\<Rightarrow> bool\" (\"\\<up>\") where \"puree P \\<equiv> \\<lambda>h. h=0 \\<and> P\"\n\nlemma puree_alt: \"\\<up>\\<Phi> = (\\<langle>\\<Phi>\\<rangle> and \\<box>)\"\n  by (auto simp: puree_def sep_empty_def)\n\nlemma pure_alt: \"\\<langle>\\<Phi>\\<rangle> = (\\<up>\\<Phi> ** sep_true)\"\n  apply (clarsimp simp: puree_def)\nproof -\n  { fix aa :: 'a\n    obtain aaa :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'a\" where\n      ff1: \"\\<And>p pa a pb pc aa. (\\<not> (p \\<and>* pa) a \\<or> p (aaa p pb) \\<or> (pb \\<and>*\npa) a) \\<and> (\\<not> pb (aaa p pb) \\<or> \\<not> (p \\<and>* pc) aa \\<or> (pb \\<and>* pc) aa)\"\n      by (metis (no_types) sep_globalise)\n    then have \"\\<exists>p. ((\\<lambda>a. a = 0) \\<and>* p) aa\"\n      by (metis (full_types) sep_conj_commuteI sep_conj_sep_emptyE\nsep_empty_def)\n    then have \"\\<not> \\<Phi> \\<or> \\<Phi> \\<and> ((\\<lambda>a. a = 0) \\<and>* (\\<lambda>a. True)) aa\"\n      using ff1 by (metis (no_types) sep_conj_commuteI) }\n  then show \"(\\<lambda>a. \\<Phi>) = (\\<lambda>a. \\<Phi> \\<and> ((\\<lambda>a. (a::'a) = 0) \\<and>* (\\<lambda>a. True)) a)\"\n    by blast\nqed\n  \nabbreviation NO_PURE :: \"bool \\<Rightarrow> ('h::sep_algebra \\<Rightarrow> bool) \\<Rightarrow> bool\" \n  where \"NO_PURE X Q \\<equiv> (NO_MATCH (\\<langle>X\\<rangle>::'h\\<Rightarrow>bool) Q \\<and> NO_MATCH ((\\<up>X)::'h\\<Rightarrow>bool) Q)\"\n\nnamed_theorems sep_simplify \\<open>Assertion simplifications\\<close>\n\nlemma sep_reorder[sep_simplify]:  \n  \"((a \\<and>* b) \\<and>* c) = (a \\<and>* b \\<and>* c)\"\n  \"(NO_PURE X a) \\<Longrightarrow> (a ** b) = (b ** a)\"\n  \"(NO_PURE X b) \\<Longrightarrow> (b \\<and>* a \\<and>* c) = (a \\<and>* b \\<and>* c)\"\n  \"(Q ** \\<langle>P\\<rangle>) = (\\<langle>P\\<rangle> ** Q)\"\n  \"(Q ** \\<up>P) = (\\<up>P ** Q)\"\n  \"NO_PURE X Q \\<Longrightarrow> (Q ** \\<langle>P\\<rangle> ** F) = (\\<langle>P\\<rangle> ** Q ** F)\"\n  \"NO_PURE X Q \\<Longrightarrow> (Q ** \\<up>P ** F) = (\\<up>P ** Q ** F)\"\n  by (simp_all add: sep.add_ac)\n\nlemma sep_combine1[simp]:\n  \"(\\<up>P ** \\<up>Q) = \\<up>(P\\<and>Q)\"\n  \"(\\<langle>P\\<rangle> ** \\<langle>Q\\<rangle>) = \\<langle>P\\<and>Q\\<rangle>\"\n  \"(\\<up>P ** \\<langle>Q\\<rangle>) = \\<langle>P\\<and>Q\\<rangle>\"\n  \"(\\<langle>P\\<rangle> ** \\<up>Q) = \\<langle>P\\<and>Q\\<rangle>\"\n  apply (auto simp add: sep_conj_def puree_def intro!: ext)\n  apply (rule_tac x=0 in exI)\n  apply simp\n  done\n\nlemma sep_combine2[simp]:\n  \"(\\<up>P ** \\<up>Q ** F) = (\\<up>(P\\<and>Q) ** F)\"\n  \"(\\<langle>P\\<rangle> ** \\<langle>Q\\<rangle> ** F) = (\\<langle>P\\<and>Q\\<rangle> ** F)\"\n  \"(\\<up>P ** \\<langle>Q\\<rangle> ** F) = (\\<langle>P\\<and>Q\\<rangle> ** F)\"\n  \"(\\<langle>P\\<rangle> ** \\<up>Q ** F) = (\\<langle>P\\<and>Q\\<rangle> ** F)\"\n  apply (subst sep.add_assoc[symmetric]; simp)+\n  done\n\nlemma sep_extract_pure[simp]:\n  \"NO_MATCH True P \\<Longrightarrow> (\\<langle>P\\<rangle> ** Q) h = (P \\<and> (sep_true ** Q) h)\"\n  \"(\\<up>P ** Q) h = (P \\<and> Q h)\"\n  \"\\<up>True = \\<box>\"\n  \"\\<up>False = sep_false\"\n  using sep_conj_sep_true_right apply fastforce\n  by (auto simp: puree_def sep_empty_def[symmetric])\n\nlemma sep_pure_front2[simp]: \n  \"(\\<up>P ** A ** \\<up>Q ** F) = (\\<up>(P \\<and> Q) ** F ** A)\"\n  apply (simp add: sep_reorder)\n  done\n\nlemma ex_h_simps[simp]: \n  \"Ex (\\<up>\\<Phi>) \\<longleftrightarrow> \\<Phi>\"\n  \"Ex (\\<up>\\<Phi> ** P) \\<longleftrightarrow> (\\<Phi> \\<and> Ex P)\"\n  apply (cases \\<Phi>; auto)\n  apply auto\n  done\n  \nlemma\n  fixes h :: \"('a \\<Rightarrow> 'b option) * nat\"\n  shows \"(P ** Q ** H) h = (Q ** H ** P) h\"\n  by (simp add: sep_conj_ac)\n    \n(* map_le *)\nlemma map_le_substate_conv: \"map_le = sep_substate\"\n  unfolding map_le_def sep_substate_def sep_disj_fun_def plus_fun_def domain_def dom_def none_def apply (auto intro!: ext)\n  subgoal for m1 m2 apply(rule exI[where x=\"%x. if (\\<exists>y. m1 x = Some y) then None else m2 x\"])\n    by auto\n  by blast\n\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Hoare_Time/SepLogAdd/Sep_Algebra_Add.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6261241772283033, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3155078364227856}}
{"text": "(*  Title:      HOL/Auth/n_mutualExFsm_lemma_inv__5_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExFsm Protocol Case Study*} \n\ntheory n_mutualExFsm_lemma_inv__5_on_rules imports n_mutualExFsm_lemma_on_inv__5\nbegin\nsection{*All lemmas on causal relation between inv__5*}\nlemma lemma_inv__5_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0 p__Inv1. p__Inv0\\<le>N\\<and>p__Inv1\\<le>N\\<and>p__Inv0~=p__Inv1\\<and>f=inv__5  p__Inv0 p__Inv1)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_fsm  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_fsm  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_fsmVsinv__5) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExFsm/n_mutualExFsm_lemma_inv__5_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6959583250334526, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.3154513565463555}}
{"text": "(*  Title:      HOL/HOLCF/IOA/Traces.thy\n    Author:     Olaf Müller\n*)\n\nsection \\<open>Executions and Traces of I/O automata in HOLCF\\<close>\n\ntheory Traces\nimports Sequence Automata\nbegin\n\ndefault_sort type\n\ntype_synonym ('a, 's) pairs = \"('a \\<times> 's) Seq\"\ntype_synonym ('a, 's) execution = \"'s \\<times> ('a, 's) pairs\"\ntype_synonym 'a trace = \"'a Seq\"\ntype_synonym ('a, 's) execution_module = \"('a, 's) execution set \\<times> 'a signature\"\ntype_synonym 'a schedule_module = \"'a trace set \\<times> 'a signature\"\ntype_synonym 'a trace_module = \"'a trace set \\<times> 'a signature\"\n\n\nsubsection \\<open>Executions\\<close>\n\ndefinition is_exec_fragC :: \"('a, 's) ioa \\<Rightarrow> ('a, 's) pairs \\<rightarrow> 's \\<Rightarrow> tr\"\n  where \"is_exec_fragC A =\n    (fix \\<cdot>\n      (LAM h ex.\n        (\\<lambda>s.\n          case ex of\n            nil \\<Rightarrow> TT\n          | x ## xs \\<Rightarrow> flift1 (\\<lambda>p. Def ((s, p) \\<in> trans_of A) andalso (h \\<cdot> xs) (snd p)) \\<cdot> x)))\"\n\ndefinition is_exec_frag :: \"('a, 's) ioa \\<Rightarrow> ('a, 's) execution \\<Rightarrow> bool\"\n  where \"is_exec_frag A ex \\<longleftrightarrow> (is_exec_fragC A \\<cdot> (snd ex)) (fst ex) \\<noteq> FF\"\n\ndefinition executions :: \"('a, 's) ioa \\<Rightarrow> ('a, 's) execution set\"\n  where \"executions ioa = {e. fst e \\<in> starts_of ioa \\<and> is_exec_frag ioa e}\"\n\n\nsubsection \\<open>Schedules\\<close>\n\ndefinition filter_act :: \"('a, 's) pairs \\<rightarrow> 'a trace\"\n  where \"filter_act = Map fst\"\n\ndefinition has_schedule :: \"('a, 's) ioa \\<Rightarrow> 'a trace \\<Rightarrow> bool\"\n  where \"has_schedule ioa sch \\<longleftrightarrow> (\\<exists>ex \\<in> executions ioa. sch = filter_act \\<cdot> (snd ex))\"\n\ndefinition schedules :: \"('a, 's) ioa \\<Rightarrow> 'a trace set\"\n  where \"schedules ioa = {sch. has_schedule ioa sch}\"\n\n\nsubsection \\<open>Traces\\<close>\n\ndefinition has_trace :: \"('a, 's) ioa \\<Rightarrow> 'a trace \\<Rightarrow> bool\"\n  where \"has_trace ioa tr \\<longleftrightarrow> (\\<exists>sch \\<in> schedules ioa. tr = Filter (\\<lambda>a. a \\<in> ext ioa) \\<cdot> sch)\"\n\ndefinition traces :: \"('a, 's) ioa \\<Rightarrow> 'a trace set\"\n  where \"traces ioa \\<equiv> {tr. has_trace ioa tr}\"\n\ndefinition mk_trace :: \"('a, 's) ioa \\<Rightarrow> ('a, 's) pairs \\<rightarrow> 'a trace\"\n  where \"mk_trace ioa = (LAM tr. Filter (\\<lambda>a. a \\<in> ext ioa) \\<cdot> (filter_act \\<cdot> tr))\"\n\n\nsubsection \\<open>Fair Traces\\<close>\n\ndefinition laststate :: \"('a, 's) execution \\<Rightarrow> 's\"\n  where \"laststate ex =\n    (case Last \\<cdot> (snd ex) of\n      UU \\<Rightarrow> fst ex\n    | Def at \\<Rightarrow> snd at)\"\n\ntext \\<open>A predicate holds infinitely (finitely) often in a sequence.\\<close>\ndefinition inf_often :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a Seq \\<Rightarrow> bool\"\n  where \"inf_often P s \\<longleftrightarrow> Infinite (Filter P \\<cdot> s)\"\n\ntext \\<open>Filtering \\<open>P\\<close> yields a finite or partial sequence.\\<close>\ndefinition fin_often :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a Seq \\<Rightarrow> bool\"\n  where \"fin_often P s \\<longleftrightarrow> \\<not> inf_often P s\"\n\n\nsubsection \\<open>Fairness of executions\\<close>\n\ntext \\<open>\n  Note that partial execs cannot be \\<open>wfair\\<close> as the inf_often predicate in the\n  else branch prohibits it. However they can be \\<open>sfair\\<close> in the case when all\n  \\<open>W\\<close> are only finitely often enabled: Is this the right model?\n\n  See \\<^file>\\<open>LiveIOA.thy\\<close> for solution conforming with the literature and\n  superseding this one.\n\\<close>\n\ndefinition is_wfair :: \"('a, 's) ioa \\<Rightarrow> 'a set \\<Rightarrow> ('a, 's) execution \\<Rightarrow> bool\"\n  where \"is_wfair A W ex \\<longleftrightarrow>\n    (inf_often (\\<lambda>x. fst x \\<in> W) (snd ex) \\<or>\n      inf_often (\\<lambda>x. \\<not> Enabled A W (snd x)) (snd ex))\"\n\ndefinition wfair_ex :: \"('a, 's) ioa \\<Rightarrow> ('a, 's) execution \\<Rightarrow> bool\"\n  where \"wfair_ex A ex \\<longleftrightarrow>\n    (\\<forall>W \\<in> wfair_of A.\n      if Finite (snd ex)\n      then \\<not> Enabled A W (laststate ex)\n      else is_wfair A W ex)\"\n\ndefinition is_sfair :: \"('a, 's) ioa \\<Rightarrow> 'a set \\<Rightarrow> ('a, 's) execution \\<Rightarrow> bool\"\n  where \"is_sfair A W ex \\<longleftrightarrow>\n    (inf_often (\\<lambda>x. fst x \\<in> W) (snd ex) \\<or>\n      fin_often (\\<lambda>x. Enabled A W (snd x)) (snd ex))\"\n\ndefinition sfair_ex :: \"('a, 's)ioa \\<Rightarrow> ('a, 's) execution \\<Rightarrow> bool\"\n  where \"sfair_ex A ex \\<longleftrightarrow>\n    (\\<forall>W \\<in> sfair_of A.\n      if Finite (snd ex)\n      then \\<not> Enabled A W (laststate ex)\n      else is_sfair A W ex)\"\n\ndefinition fair_ex :: \"('a, 's) ioa \\<Rightarrow> ('a, 's) execution \\<Rightarrow> bool\"\n  where \"fair_ex A ex \\<longleftrightarrow> wfair_ex A ex \\<and> sfair_ex A ex\"\n\n\ntext \\<open>Fair behavior sets.\\<close>\n\ndefinition fairexecutions :: \"('a, 's) ioa \\<Rightarrow> ('a, 's) execution set\"\n  where \"fairexecutions A = {ex. ex \\<in> executions A \\<and> fair_ex A ex}\"\n\ndefinition fairtraces :: \"('a, 's) ioa \\<Rightarrow> 'a trace set\"\n  where \"fairtraces A = {mk_trace A \\<cdot> (snd ex) | ex. ex \\<in> fairexecutions A}\"\n\n\nsubsection \\<open>Implementation\\<close>\n\nsubsubsection \\<open>Notions of implementation\\<close>\n\ndefinition ioa_implements :: \"('a, 's1) ioa \\<Rightarrow> ('a, 's2) ioa \\<Rightarrow> bool\"  (infixr \"=<|\" 12)\n  where \"(ioa1 =<| ioa2) \\<longleftrightarrow>\n    (inputs (asig_of ioa1) = inputs (asig_of ioa2) \\<and>\n     outputs (asig_of ioa1) = outputs (asig_of ioa2)) \\<and>\n    traces ioa1 \\<subseteq> traces ioa2\"\n\ndefinition fair_implements :: \"('a, 's1) ioa \\<Rightarrow> ('a, 's2) ioa \\<Rightarrow> bool\"\n  where \"fair_implements C A \\<longleftrightarrow>\n    inp C = inp A \\<and> out C = out A \\<and> fairtraces C \\<subseteq> fairtraces A\"\n\nlemma implements_trans: \"A =<| B \\<Longrightarrow> B =<| C \\<Longrightarrow> A =<| C\"\n  by (auto simp add: ioa_implements_def)\n\n\nsubsection \\<open>Modules\\<close>\n\nsubsubsection \\<open>Execution, schedule and trace modules\\<close>\n\ndefinition Execs :: \"('a, 's) ioa \\<Rightarrow> ('a, 's) execution_module\"\n  where \"Execs A = (executions A, asig_of A)\"\n\ndefinition Scheds :: \"('a, 's) ioa \\<Rightarrow> 'a schedule_module\"\n  where \"Scheds A = (schedules A, asig_of A)\"\n\ndefinition Traces :: \"('a, 's) ioa \\<Rightarrow> 'a trace_module\"\n  where \"Traces A = (traces A, asig_of A)\"\n\nlemmas [simp del] = HOL.ex_simps HOL.all_simps split_paired_Ex\ndeclare Let_def [simp]\nsetup \\<open>map_theory_claset (fn ctxt => ctxt delSWrapper \"split_all_tac\")\\<close>\n\nlemmas exec_rws = executions_def is_exec_frag_def\n\n\nsubsection \\<open>Recursive equations of operators\\<close>\n\nsubsubsection \\<open>\\<open>filter_act\\<close>\\<close>\n\nlemma filter_act_UU: \"filter_act \\<cdot> UU = UU\"\n  by (simp add: filter_act_def)\n\nlemma filter_act_nil: \"filter_act \\<cdot> nil = nil\"\n  by (simp add: filter_act_def)\n\nlemma filter_act_cons: \"filter_act \\<cdot> (x \\<leadsto> xs) = fst x \\<leadsto> filter_act \\<cdot> xs\"\n  by (simp add: filter_act_def)\n\ndeclare filter_act_UU [simp] filter_act_nil [simp] filter_act_cons [simp]\n\n\nsubsubsection \\<open>\\<open>mk_trace\\<close>\\<close>\n\nlemma mk_trace_UU: \"mk_trace A \\<cdot> UU = UU\"\n  by (simp add: mk_trace_def)\n\nlemma mk_trace_nil: \"mk_trace A \\<cdot> nil = nil\"\n  by (simp add: mk_trace_def)\n\nlemma mk_trace_cons:\n  \"mk_trace A \\<cdot> (at \\<leadsto> xs) =\n    (if fst at \\<in> ext A\n     then fst at \\<leadsto> mk_trace A \\<cdot> xs\n     else mk_trace A \\<cdot> xs)\"\n  by (simp add: mk_trace_def)\n\ndeclare mk_trace_UU [simp] mk_trace_nil [simp] mk_trace_cons [simp]\n\n\nsubsubsection \\<open>\\<open>is_exec_fragC\\<close>\\<close>\n\nlemma is_exec_fragC_unfold:\n  \"is_exec_fragC A =\n    (LAM ex.\n      (\\<lambda>s.\n        case ex of\n          nil \\<Rightarrow> TT\n        | x ## xs \\<Rightarrow>\n            (flift1 (\\<lambda>p. Def ((s, p) \\<in> trans_of A) andalso (is_exec_fragC A\\<cdot>xs) (snd p)) \\<cdot> x)))\"\n  apply (rule trans)\n  apply (rule fix_eq4)\n  apply (rule is_exec_fragC_def)\n  apply (rule beta_cfun)\n  apply (simp add: flift1_def)\n  done\n\nlemma is_exec_fragC_UU: \"(is_exec_fragC A \\<cdot> UU) s = UU\"\n  apply (subst is_exec_fragC_unfold)\n  apply simp\n  done\n\nlemma is_exec_fragC_nil: \"(is_exec_fragC A \\<cdot> nil) s = TT\"\n  apply (subst is_exec_fragC_unfold)\n  apply simp\n  done\n\nlemma is_exec_fragC_cons:\n  \"(is_exec_fragC A \\<cdot> (pr \\<leadsto> xs)) s =\n    (Def ((s, pr) \\<in> trans_of A) andalso (is_exec_fragC A \\<cdot> xs) (snd pr))\"\n  apply (rule trans)\n  apply (subst is_exec_fragC_unfold)\n  apply (simp add: Consq_def flift1_def)\n  apply simp\n  done\n\ndeclare is_exec_fragC_UU [simp] is_exec_fragC_nil [simp] is_exec_fragC_cons [simp]\n\n\nsubsubsection \\<open>\\<open>is_exec_frag\\<close>\\<close>\n\nlemma is_exec_frag_UU: \"is_exec_frag A (s, UU)\"\n  by (simp add: is_exec_frag_def)\n\nlemma is_exec_frag_nil: \"is_exec_frag A (s, nil)\"\n  by (simp add: is_exec_frag_def)\n\nlemma is_exec_frag_cons:\n  \"is_exec_frag A (s, (a, t) \\<leadsto> ex) \\<longleftrightarrow> (s, a, t) \\<in> trans_of A \\<and> is_exec_frag A (t, ex)\"\n  by (simp add: is_exec_frag_def)\n\ndeclare is_exec_frag_UU [simp] is_exec_frag_nil [simp] is_exec_frag_cons [simp]\n\n\nsubsubsection \\<open>\\<open>laststate\\<close>\\<close>\n\nlemma laststate_UU: \"laststate (s, UU) = s\"\n  by (simp add: laststate_def)\n\nlemma laststate_nil: \"laststate (s, nil) = s\"\n  by (simp add: laststate_def)\n\nlemma laststate_cons: \"Finite ex \\<Longrightarrow> laststate (s, at \\<leadsto> ex) = laststate (snd at, ex)\"\n  apply (simp add: laststate_def)\n  apply (cases \"ex = nil\")\n  apply simp\n  apply simp\n  apply (drule Finite_Last1 [THEN mp])\n  apply assumption\n  apply defined\n  done\n\ndeclare laststate_UU [simp] laststate_nil [simp] laststate_cons [simp]\n\nlemma exists_laststate: \"Finite ex \\<Longrightarrow> \\<forall>s. \\<exists>u. laststate (s, ex) = u\"\n  by Seq_Finite_induct\n\n\nsubsection \\<open>\\<open>has_trace\\<close> \\<open>mk_trace\\<close>\\<close>\n\n(*alternative definition of has_trace tailored for the refinement proof, as it does not\n  take the detour of schedules*)\nlemma has_trace_def2: \"has_trace A b \\<longleftrightarrow> (\\<exists>ex \\<in> executions A. b = mk_trace A \\<cdot> (snd ex))\"\n  apply (unfold executions_def mk_trace_def has_trace_def schedules_def has_schedule_def [abs_def])\n  apply auto\n  done\n\n\nsubsection \\<open>Signatures and executions, schedules\\<close>\n\ntext \\<open>\n  All executions of \\<open>A\\<close> have only actions of \\<open>A\\<close>. This is only true because of\n  the predicate \\<open>state_trans\\<close> (part of the predicate \\<open>IOA\\<close>): We have no\n  dependent types. For executions of parallel automata this assumption is not\n  needed, as in \\<open>par_def\\<close> this condition is included once more. (See Lemmas\n  1.1.1c in CompoExecs for example.)\n\\<close>\n\nlemma execfrag_in_sig:\n  \"is_trans_of A \\<Longrightarrow> \\<forall>s. is_exec_frag A (s, xs) \\<longrightarrow> Forall (\\<lambda>a. a \\<in> act A) (filter_act \\<cdot> xs)\"\n  apply (pair_induct xs simp: is_exec_frag_def Forall_def sforall_def)\n  text \\<open>main case\\<close>\n  apply (auto simp add: is_trans_of_def)\n  done\n\nlemma exec_in_sig:\n  \"is_trans_of A \\<Longrightarrow> x \\<in> executions A \\<Longrightarrow> Forall (\\<lambda>a. a \\<in> act A) (filter_act \\<cdot> (snd x))\"\n  apply (simp add: executions_def)\n  apply (pair x)\n  apply (rule execfrag_in_sig [THEN spec, THEN mp])\n  apply auto\n  done\n\nlemma scheds_in_sig: \"is_trans_of A \\<Longrightarrow> x \\<in> schedules A \\<Longrightarrow> Forall (\\<lambda>a. a \\<in> act A) x\"\n  apply (unfold schedules_def has_schedule_def [abs_def])\n  apply (fast intro!: exec_in_sig)\n  done\n\n\nsubsection \\<open>Executions are prefix closed\\<close>\n\n(*only admissible in y, not if done in x!*)\nlemma execfrag_prefixclosed: \"\\<forall>x s. is_exec_frag A (s, x) \\<and> y \\<sqsubseteq> x \\<longrightarrow> is_exec_frag A (s, y)\"\n  apply (pair_induct y simp: is_exec_frag_def)\n  apply (intro strip)\n  apply (Seq_case_simp x)\n  apply (pair a)\n  apply auto\n  done\n\nlemmas exec_prefixclosed =\n  conjI [THEN execfrag_prefixclosed [THEN spec, THEN spec, THEN mp]]\n\n(*second prefix notion for Finite x*)\nlemma exec_prefix2closed [rule_format]:\n  \"\\<forall>y s. is_exec_frag A (s, x @@ y) \\<longrightarrow> is_exec_frag A (s, x)\"\n  apply (pair_induct x simp: is_exec_frag_def)\n  apply (intro strip)\n  apply (Seq_case_simp s)\n  apply (pair a)\n  apply auto\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/HOLCF/IOA/Traces.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6959583250334526, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.3154513565463555}}
{"text": "theory Example_NetModel\nimports \"../TopoS_Interface\" \"../TopoS_Helper\"\nbegin\n\ntext{* A toy example that defines a valid network security requirement model *}\n\ndefinition default_node_properties :: \"bool\"\n  where  \"default_node_properties \\<equiv> False\"\n\nfun sinvar :: \"'v graph \\<Rightarrow> ('v \\<Rightarrow> bool) \\<Rightarrow> bool\" where\n  \"sinvar G nP = (\\<forall> (e1,e2) \\<in> (edges G). (nP e1) \\<and> (nP e2))\"\n\n(* we will not define receiver_violation!! Works for both! *)\n\n\n\n\n \n-- \"The preliminaries: mostly, sinvar is monotonic\"\ninterpretation SecurityInvariant_preliminaries\nwhere sinvar = sinvar\n  apply unfold_locales\n    apply(frule_tac finite_distinct_list[OF wf_graph.finiteE])\n    apply(erule_tac exE)\n    apply(rename_tac list_edges)\n    apply(rule_tac ff=\"list_edges\" in SecurityInvariant_withOffendingFlows.mono_imp_set_offending_flows_not_empty[OF sinvar_mono])\n       apply(auto)[6]\n  apply(auto simp add: SecurityInvariant_withOffendingFlows.is_offending_flows_def graph_ops)[2]\n  apply(fact SecurityInvariant_withOffendingFlows.sinvar_mono_imp_is_offending_flows_mono[OF sinvar_mono])\ndone\n\n\n-- \"With generic target focus\"\ninterpretation Example_NetModel: SecurityInvariant\nwhere default_node_properties = default_node_properties\nand sinvar = sinvar\nand receiver_violation = receiver_violation (*yep, that's a variable*)\n  unfolding default_node_properties_def\n  apply unfold_locales\n\n   -- \"Secure bydefault\"\n   apply(simp)\n   apply (simp add: SecurityInvariant_withOffendingFlows.set_offending_flows_def\n       SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n       SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n   apply (simp add: graph_ops)\n   apply (simp split: prod.split_asm prod.split)\n   apply blast\n\n -- \"Uniqueness\"\n apply(simp add:default_node_properties_def)\n apply (simp add: SecurityInvariant_withOffendingFlows.set_offending_flows_def\n     SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n     SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n apply (simp add: graph_ops)\n apply (simp split: prod.split_asm prod.split)\n -- \"proof by counter example: assume False is not the unique default parameter\"\n apply(rule_tac x=\"\\<lparr> nodes={vertex_1}, edges = {(vertex_1,vertex_1)} \\<rparr>\" in exI, simp)\n apply(rule conjI)\n  apply(simp add: wf_graph_def; fail)\n apply(rule_tac x=\"(\\<lambda> x. default_node_properties)(vertex_1 := False)\" in exI, simp add:default_node_properties_def)\n apply(case_tac receiver_violation)\n  apply(simp_all)\n  apply(rule_tac x=\"{(vertex_1,vertex_1)}\" in exI, simp)+\ndone\n\n\ntext{*And we end up with a totally useless network security requirement model. I hope this was instructive.*}\n\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/Examples/Example_NetModel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6959583124210896, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.31545135082965253}}
{"text": "(* Title: Misc_CryptHOL.thy\n  Author: Andreas Lochbihler, ETH Zurich *)\n\nsection \\<open>Miscellaneous library additions\\<close>\n\ntheory Misc_CryptHOL imports \n  Probabilistic_While.While_SPMF\n  \"HOL-Library.Rewrite\"\n  \"HOL-Library.Simps_Case_Conv\"\n  \"HOL-Library.Type_Length\"\n  \"HOL-Eisbach.Eisbach\"\n  Coinductive.TLList\n  Monad_Normalisation.Monad_Normalisation\n  Monomorphic_Monad.Monomorphic_Monad\nbegin\n\nhide_const (open) Henstock_Kurzweil_Integration.negligible\n\nsubsection \\<open>HOL\\<close>\n\nlemma asm_rl_conv: \"(PROP P \\<Longrightarrow> PROP P) \\<equiv> Trueprop True\"\nby(rule equal_intr_rule) iprover+\n\nnamed_theorems if_distribs \"Distributivity theorems for If\"\n\nlemma if_mono_cong: \"\\<lbrakk>b \\<Longrightarrow> x \\<le> x'; \\<not> b \\<Longrightarrow> y \\<le> y' \\<rbrakk> \\<Longrightarrow> If b x y \\<le> If b x' y'\"\nby simp\n\n\n\nlemma if_False_eq: \"\\<lbrakk> b \\<Longrightarrow> False; e = e' \\<rbrakk> \\<Longrightarrow> If b t e = e'\"\nby auto\n\nlemma imp_OO_imp [simp]: \"(\\<longrightarrow>) OO (\\<longrightarrow>) = (\\<longrightarrow>)\"\nby auto\n\nlemma inj_on_fun_updD: \"\\<lbrakk> inj_on (f(x := y)) A; x \\<notin> A \\<rbrakk> \\<Longrightarrow> inj_on f A\"\nby(auto simp add: inj_on_def split: if_split_asm)\n\nlemma disjoint_notin1: \"\\<lbrakk> A \\<inter> B = {}; x \\<in> B \\<rbrakk> \\<Longrightarrow> x \\<notin> A\" by auto\n\nlemma Least_le_Least:\n  fixes x :: \"'a :: wellorder\"\n  assumes \"Q x\"\n  and Q: \"\\<And>x. Q x \\<Longrightarrow> \\<exists>y\\<le>x. P y\"\n  shows \"Least P \\<le> Least Q\"\nproof -\n  obtain f :: \"'a \\<Rightarrow> 'a\" where \"\\<forall>a. \\<not> Q a \\<or> f a \\<le> a \\<and> P (f a)\" using Q by moura\n  moreover have \"Q (Least Q)\" using \\<open>Q x\\<close> by(rule LeastI)\n  ultimately show ?thesis by (metis (full_types) le_cases le_less less_le_trans not_less_Least)\nqed\n\nsubsection \\<open>Relations\\<close>\n\ninductive Imagep :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> 'b \\<Rightarrow> bool\"\n  for R P\nwhere ImagepI: \"\\<lbrakk> P x; R x y \\<rbrakk> \\<Longrightarrow> Imagep R P y\"\n\nlemma r_r_into_tranclp: \"\\<lbrakk> r x y; r y z \\<rbrakk> \\<Longrightarrow> r^++ x z\"\nby(rule tranclp.trancl_into_trancl)(rule tranclp.r_into_trancl)\n\nlemma transp_tranclp_id:\n  assumes \"transp R\"\n  shows \"tranclp R = R\"\nproof(intro ext iffI)\n  fix x y\n  assume \"R^++ x y\"\n  thus \"R x y\" by induction(blast dest: transpD[OF assms])+\nqed simp\n\nlemma transp_inv_image: \"transp r \\<Longrightarrow> transp (\\<lambda>x y. r (f x) (f y))\"\nusing trans_inv_image[where r=\"{(x, y). r x y}\" and f = f]\nby(simp add: transp_trans inv_image_def)\n\nlemma Domainp_conversep: \"Domainp R\\<inverse>\\<inverse> = Rangep R\"\nby(auto)\n\nlemma bi_unique_rel_set_bij_betw:\n  assumes unique: \"bi_unique R\"\n  and rel: \"rel_set R A B\"\n  shows \"\\<exists>f. bij_betw f A B \\<and> (\\<forall>x\\<in>A. R x (f x))\"\nproof -\n  from assms obtain f where f: \"\\<And>x. x \\<in> A \\<Longrightarrow> R x (f x)\" and B: \"\\<And>x. x \\<in> A \\<Longrightarrow> f x \\<in> B\"\n    apply(atomize_elim)\n    apply(fold all_conj_distrib)\n    apply(subst choice_iff[symmetric])\n    apply(auto dest: rel_setD1)\n    done\n  have \"inj_on f A\" by(rule inj_onI)(auto dest!: f dest: bi_uniqueDl[OF unique])\n  moreover have \"f ` A = B\" using rel\n    by(auto 4 3 intro: B dest: rel_setD2 f bi_uniqueDr[OF unique])\n  ultimately have \"bij_betw f A B\" unfolding bij_betw_def ..\n  thus ?thesis using f by blast\nqed\n\ndefinition restrict_relp :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> ('b \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> 'b \\<Rightarrow> bool\"\n  (\"_ \\<upharpoonleft> (_ \\<otimes> _)\" [53, 54, 54] 53)\nwhere \"restrict_relp R P Q = (\\<lambda>x y. R x y \\<and> P x \\<and> Q y)\"\n\nlemma restrict_relp_apply [simp]: \"(R \\<upharpoonleft> P \\<otimes> Q) x y \\<longleftrightarrow> R x y \\<and> P x \\<and> Q y\"\nby(simp add: restrict_relp_def)\n\nlemma restrict_relpI [intro?]: \"\\<lbrakk> R x y; P x; Q y \\<rbrakk> \\<Longrightarrow> (R \\<upharpoonleft> P \\<otimes> Q) x y\"\nby(simp add: restrict_relp_def)\n\nlemma restrict_relpE [elim?, cases pred]:\n  assumes \"(R \\<upharpoonleft> P \\<otimes> Q) x y\"\n  obtains (restrict_relp) \"R x y\" \"P x\" \"Q y\"\nusing assms by(simp add: restrict_relp_def)\n\nlemma conversep_restrict_relp [simp]: \"(R \\<upharpoonleft> P \\<otimes> Q)\\<inverse>\\<inverse> = R\\<inverse>\\<inverse> \\<upharpoonleft> Q \\<otimes> P\"\nby(auto simp add: fun_eq_iff)\n\nlemma restrict_relp_restrict_relp [simp]: \"R \\<upharpoonleft> P \\<otimes> Q \\<upharpoonleft> P' \\<otimes> Q' = R \\<upharpoonleft> inf P P' \\<otimes> inf Q Q'\"\nby(auto simp add: fun_eq_iff)\n\nlemma restrict_relp_cong:\n  \"\\<lbrakk> P = P'; Q = Q'; \\<And>x y. \\<lbrakk> P x; Q y \\<rbrakk> \\<Longrightarrow> R x y = R' x y \\<rbrakk> \\<Longrightarrow> R \\<upharpoonleft> P \\<otimes> Q = R' \\<upharpoonleft> P' \\<otimes> Q'\"\nby(auto simp add: fun_eq_iff)\n\nlemma restrict_relp_cong_simp:\n  \"\\<lbrakk> P = P'; Q = Q'; \\<And>x y. P x =simp=> Q y =simp=> R x y = R' x y \\<rbrakk> \\<Longrightarrow> R \\<upharpoonleft> P \\<otimes> Q = R' \\<upharpoonleft> P' \\<otimes> Q'\"\nby(rule restrict_relp_cong; simp add: simp_implies_def)\n\nlemma restrict_relp_parametric [transfer_rule]:\n  includes lifting_syntax shows\n  \"((A ===> B ===> (=)) ===> (A ===> (=)) ===> (B ===> (=)) ===> A ===> B ===> (=)) restrict_relp restrict_relp\"\nunfolding restrict_relp_def[abs_def] by transfer_prover\n\nlemma restrict_relp_mono: \"\\<lbrakk> R \\<le> R'; P \\<le> P'; Q \\<le> Q' \\<rbrakk> \\<Longrightarrow> R \\<upharpoonleft> P \\<otimes> Q \\<le> R' \\<upharpoonleft> P' \\<otimes> Q'\"\nby(simp add: le_fun_def)\n\nlemma restrict_relp_mono': \n  \"\\<lbrakk> (R \\<upharpoonleft> P \\<otimes> Q) x y; \\<lbrakk> R x y; P x; Q y \\<rbrakk> \\<Longrightarrow> R' x y &&& P' x &&& Q' y \\<rbrakk>\n  \\<Longrightarrow> (R' \\<upharpoonleft> P' \\<otimes> Q') x y\"\nby(auto dest: conjunctionD1 conjunctionD2)\n\nlemma restrict_relp_DomainpD: \"Domainp (R \\<upharpoonleft> P \\<otimes> Q) x \\<Longrightarrow> Domainp R x \\<and> P x\"\nby(auto simp add: Domainp.simps)\n\nlemma restrict_relp_True: \"R \\<upharpoonleft> (\\<lambda>_. True) \\<otimes> (\\<lambda>_. True) = R\"\nby(simp add: fun_eq_iff)\n\nlemma restrict_relp_False1: \"R \\<upharpoonleft> (\\<lambda>_. False) \\<otimes> Q = bot\"\nby(simp add: fun_eq_iff)\n\nlemma restrict_relp_False2: \"R \\<upharpoonleft> P \\<otimes> (\\<lambda>_. False) = bot\"\nby(simp add: fun_eq_iff)\n\ndefinition rel_prod2 :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> ('c \\<times> 'b) \\<Rightarrow> bool\"\nwhere \"rel_prod2 R a = (\\<lambda>(c, b). R a b)\"\n\nlemma rel_prod2_simps [simp]: \"rel_prod2 R a (c, b) \\<longleftrightarrow> R a b\"\nby(simp add: rel_prod2_def)\n\nlemma restrict_rel_prod:\n  \"rel_prod (R \\<upharpoonleft> I1 \\<otimes> I2) (S \\<upharpoonleft> I1' \\<otimes> I2') = rel_prod R S \\<upharpoonleft> pred_prod I1 I1' \\<otimes> pred_prod I2 I2'\"\nby(auto simp add: fun_eq_iff)\n\nlemma restrict_rel_prod1:\n  \"rel_prod (R \\<upharpoonleft> I1 \\<otimes> I2) S = rel_prod R S \\<upharpoonleft> pred_prod I1 (\\<lambda>_. True) \\<otimes> pred_prod I2 (\\<lambda>_. True)\"\nby(simp add: restrict_rel_prod[symmetric] restrict_relp_True)\n\nlemma restrict_rel_prod2:\n  \"rel_prod R (S \\<upharpoonleft> I1 \\<otimes> I2) = rel_prod R S \\<upharpoonleft> pred_prod (\\<lambda>_. True) I1 \\<otimes> pred_prod (\\<lambda>_. True) I2\"\nby(simp add: restrict_rel_prod[symmetric] restrict_relp_True)\n\nsubsection \\<open>Pairs\\<close>\n\nlemma split_apfst [simp]: \"case_prod h (apfst f xy) = case_prod (h \\<circ> f) xy\"\nby(cases xy) simp\n\ndefinition corec_prod :: \"('s \\<Rightarrow> 'a) \\<Rightarrow> ('s \\<Rightarrow> 'b) \\<Rightarrow> 's \\<Rightarrow> 'a \\<times> 'b\"\nwhere \"corec_prod f g = (\\<lambda>s. (f s, g s))\"\n\nlemma corec_prod_apply: \"corec_prod f g s = (f s, g s)\"\nby(simp add: corec_prod_def)\n\nlemma corec_prod_sel [simp]:\n  shows fst_corec_prod: \"fst (corec_prod f g s) = f s\"\n  and snd_corec_prod: \"snd (corec_prod f g s) = g s\"\nby(simp_all add: corec_prod_apply)\n\nlemma apfst_corec_prod [simp]: \"apfst h (corec_prod f g s) = corec_prod (h \\<circ> f) g s\"\nby(simp add: corec_prod_apply)\n\nlemma apsnd_corec_prod [simp]: \"apsnd h (corec_prod f g s) = corec_prod f (h \\<circ> g) s\"\nby(simp add: corec_prod_apply)\n\nlemma map_corec_prod [simp]: \"map_prod f g (corec_prod h k s) = corec_prod (f \\<circ> h) (g \\<circ> k) s\"\nby(simp add: corec_prod_apply)\n\nlemma split_corec_prod [simp]: \"case_prod h (corec_prod f g s) = h (f s) (g s)\"\nby(simp add: corec_prod_apply)\n\nsubsection \\<open>Sums\\<close>\n\nlemma islE:\n  assumes \"isl x\"\n  obtains l where \"x = Inl l\"\nusing assms by(cases x) auto\n\nlemma Inl_in_Plus [simp]: \"Inl x \\<in> A <+> B \\<longleftrightarrow> x \\<in> A\"\nby auto\n\nlemma Inr_in_Plus [simp]: \"Inr x \\<in> A <+> B \\<longleftrightarrow> x \\<in> B\"\nby auto\n\nlemma Inl_eq_map_sum_iff: \"Inl x = map_sum f g y \\<longleftrightarrow> (\\<exists>z. y = Inl z \\<and> x = f z)\"\nby(cases y) auto\n\nlemma Inr_eq_map_sum_iff: \"Inr x = map_sum f g y \\<longleftrightarrow> (\\<exists>z. y = Inr z \\<and> x = g z)\"\nby(cases y) auto\n\nsubsection \\<open>Option\\<close>\n\ndeclare is_none_bind [simp]\n\nlemma case_option_collapse: \"case_option x (\\<lambda>_. x) y = x\"\nby(simp split: option.split)\n\nlemma indicator_single_Some: \"indicator {Some x} (Some y) = indicator {x} y\"\nby(simp split: split_indicator)\n\nsubsubsection \\<open>Predicator and relator\\<close>\n\nlemma option_pred_mono_strong:\n  \"\\<lbrakk> pred_option P x; \\<And>a. \\<lbrakk> a \\<in> set_option x; P a \\<rbrakk> \\<Longrightarrow> P' a \\<rbrakk> \\<Longrightarrow> pred_option P' x\"\nby(fact option.pred_mono_strong)\n\nlemma option_pred_map [simp]: \"pred_option P (map_option f x) = pred_option (P \\<circ> f) x\"\nby(fact option.pred_map)\n\nlemma option_pred_o_map [simp]: \"pred_option P \\<circ> map_option f = pred_option (P \\<circ> f)\"\nby(simp add: fun_eq_iff)\n\nlemma option_pred_bind [simp]: \"pred_option P (Option.bind x f) = pred_option (pred_option P \\<circ> f) x\"\nby(simp add: pred_option_def)\n\nlemma pred_option_conj [simp]:\n  \"pred_option (\\<lambda>x. P x \\<and> Q x) = (\\<lambda>x. pred_option P x \\<and> pred_option Q x)\"\nby(auto simp add: pred_option_def)\n\nlemma pred_option_top [simp]:\n  \"pred_option (\\<lambda>_. True) = (\\<lambda>_. True)\"\nby(fact option.pred_True)\n\nlemma rel_option_restrict_relpI [intro?]:\n  \"\\<lbrakk> rel_option R x y; pred_option P x; pred_option Q y \\<rbrakk> \\<Longrightarrow> rel_option (R \\<upharpoonleft> P \\<otimes> Q) x y\"\nby(erule option.rel_mono_strong) simp\n\nlemma rel_option_restrict_relpE [elim?]:\n  assumes \"rel_option (R \\<upharpoonleft> P \\<otimes> Q) x y\"\n  obtains \"rel_option R x y\" \"pred_option P x\" \"pred_option Q y\"\nproof\n  show \"rel_option R x y\" using assms by(auto elim!: option.rel_mono_strong)\n  have \"pred_option (Domainp (R \\<upharpoonleft> P \\<otimes> Q)) x\" using assms by(fold option.Domainp_rel) blast\n  then show \"pred_option P x\" by(rule option_pred_mono_strong)(blast dest!: restrict_relp_DomainpD)\n  have \"pred_option (Domainp (R \\<upharpoonleft> P \\<otimes> Q)\\<inverse>\\<inverse>) y\" using assms\n    by(fold option.Domainp_rel)(auto simp only: option.rel_conversep Domainp_conversep)\n  then show \"pred_option Q y\" by(rule option_pred_mono_strong)(auto dest!: restrict_relp_DomainpD)\nqed\n\nlemma rel_option_restrict_relp_iff:\n  \"rel_option (R \\<upharpoonleft> P \\<otimes> Q) x y \\<longleftrightarrow> rel_option R x y \\<and> pred_option P x \\<and> pred_option Q y\"\nby(blast intro: rel_option_restrict_relpI elim: rel_option_restrict_relpE)\n\nlemma option_rel_map_restrict_relp:\n  shows option_rel_map_restrict_relp1:\n  \"rel_option (R \\<upharpoonleft> P \\<otimes> Q) (map_option f x) = rel_option (R \\<circ> f \\<upharpoonleft> P \\<circ> f \\<otimes> Q) x\"\n  and option_rel_map_restrict_relp2:\n  \"rel_option (R \\<upharpoonleft> P \\<otimes> Q) x (map_option g y) = rel_option ((\\<lambda>x. R x \\<circ> g) \\<upharpoonleft> P \\<otimes> Q \\<circ> g) x y\"\nby(simp_all add: option.rel_map restrict_relp_def fun_eq_iff)\n\nsubsubsection \\<open>Orders on option\\<close>\n\nabbreviation le_option :: \"'a option \\<Rightarrow> 'a option \\<Rightarrow> bool\"\nwhere \"le_option \\<equiv> ord_option (=)\"\n\nlemma le_option_bind_mono:\n  \"\\<lbrakk> le_option x y; \\<And>a. a \\<in> set_option x \\<Longrightarrow> le_option (f a) (g a) \\<rbrakk>\n  \\<Longrightarrow> le_option (Option.bind x f) (Option.bind y g)\"\nby(cases x) simp_all\n\nlemma le_option_refl [simp]: \"le_option x x\"\nby(cases x) simp_all\n\n\nlemma le_option_conv_option_ord: \"le_option = option_ord\"\nby(auto simp add: fun_eq_iff flat_ord_def elim: ord_option.cases)\n\ndefinition pcr_Some :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> 'b option \\<Rightarrow> bool\"\nwhere \"pcr_Some R x y \\<longleftrightarrow> (\\<exists>z. y = Some z \\<and> R x z)\"\n\nlemma pcr_Some_simps [simp]: \"pcr_Some R x (Some y) \\<longleftrightarrow> R x y\"\nby(simp add: pcr_Some_def)\n\nlemma pcr_SomeE [cases pred]:\n  assumes \"pcr_Some R x y\"\n  obtains (pcr_Some) z where \"y = Some z\" \"R x z\"\nusing assms by(auto simp add: pcr_Some_def)\n\nsubsubsection \\<open>Filter for option\\<close>\n\nfun filter_option :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a option \\<Rightarrow> 'a option\"\nwhere\n  \"filter_option P None = None\"\n| \"filter_option P (Some x) = (if P x then Some x else None)\"\n\nlemma set_filter_option [simp]: \"set_option (filter_option P x) = {y \\<in> set_option x. P y}\"\nby(cases x) auto\n\nlemma filter_map_option: \"filter_option P (map_option f x) = map_option f (filter_option (P \\<circ> f) x)\"\nby(cases x) simp_all\n\nlemma is_none_filter_option [simp]: \"Option.is_none (filter_option P x) \\<longleftrightarrow> Option.is_none x \\<or> \\<not> P (the x)\"\nby(cases x) simp_all\n\nlemma filter_option_eq_Some_iff [simp]: \"filter_option P x = Some y \\<longleftrightarrow> x = Some y \\<and> P y\"\nby(cases x) auto\n\nlemma Some_eq_filter_option_iff [simp]: \"Some y = filter_option P x \\<longleftrightarrow> x = Some y \\<and> P y\"\nby(cases x) auto\n\nlemma filter_conv_bind_option: \"filter_option P x = Option.bind x (\\<lambda>y. if P y then Some y else None)\"\nby(cases x) simp_all\n\nsubsubsection \\<open>Assert for option\\<close>\n\nprimrec assert_option :: \"bool \\<Rightarrow> unit option\" where\n  \"assert_option True = Some ()\"\n| \"assert_option False = None\"\n\nlemma set_assert_option_conv: \"set_option (assert_option b) = (if b then {()} else {})\"\nby(simp)\n\nlemma in_set_assert_option [simp]: \"x \\<in> set_option (assert_option b) \\<longleftrightarrow> b\"\nby(cases b) simp_all\n\n\nsubsubsection \\<open>Join on options\\<close>\n\ndefinition join_option :: \"'a option option \\<Rightarrow> 'a option\"\nwhere \"join_option x = (case x of Some y \\<Rightarrow> y | None \\<Rightarrow> None)\"\n\nsimps_of_case join_simps [simp, code]: join_option_def\n\nlemma set_join_option [simp]: \"set_option (join_option x) = \\<Union>(set_option ` set_option x)\"\nby(cases x)(simp_all)\n\nlemma in_set_join_option: \"x \\<in> set_option (join_option (Some (Some x)))\"\nby simp\n\nlemma map_join_option: \"map_option f (join_option x) = join_option (map_option (map_option f) x)\"\nby(cases x) simp_all\n\nlemma bind_conv_join_option: \"Option.bind x f = join_option (map_option f x)\"\nby(cases x) simp_all\n\nlemma join_conv_bind_option: \"join_option x = Option.bind x id\"\nby(cases x) simp_all\n\nlemma join_option_parametric [transfer_rule]:\n  includes lifting_syntax shows\n  \"(rel_option (rel_option R) ===> rel_option R) join_option join_option\"\nunfolding join_conv_bind_option[abs_def] by transfer_prover\n\nlemma join_option_eq_Some [simp]: \"join_option x = Some y \\<longleftrightarrow> x = Some (Some y)\"\nby(cases x) simp_all\n\nlemma Some_eq_join_option [simp]: \"Some y = join_option x \\<longleftrightarrow> x = Some (Some y)\"\nby(cases x) auto\n\nlemma join_option_eq_None: \"join_option x = None \\<longleftrightarrow> x = None \\<or> x = Some None\"\nby(cases x) simp_all\n\nlemma None_eq_join_option: \"None = join_option x \\<longleftrightarrow> x = None \\<or> x = Some None\"\nby(cases x) auto\n\nsubsubsection \\<open>Zip on options\\<close>\n\nfunction zip_option :: \"'a option \\<Rightarrow> 'b option \\<Rightarrow> ('a \\<times> 'b) option\"\nwhere\n  \"zip_option (Some x) (Some y) = Some (x, y)\"\n| \"zip_option _ None = None\"\n| \"zip_option None _ = None\"\nby pat_completeness auto\ntermination by lexicographic_order\n\nlemma zip_option_eq_Some_iff [iff]:\n  \"zip_option x y = Some (a, b) \\<longleftrightarrow> x = Some a \\<and> y = Some b\"\nby(cases \"(x, y)\" rule: zip_option.cases) simp_all\n\nlemma set_zip_option [simp]:\n  \"set_option (zip_option x y) = set_option x \\<times> set_option y\"\nby auto\n\nlemma zip_map_option1: \"zip_option (map_option f x) y = map_option (apfst f) (zip_option x y)\"\nby(cases \"(x, y)\" rule: zip_option.cases) simp_all\n\nlemma zip_map_option2: \"zip_option x (map_option g y) = map_option (apsnd g) (zip_option x y)\"\nby(cases \"(x, y)\" rule: zip_option.cases) simp_all\n\nlemma map_zip_option:\n  \"map_option (map_prod f g) (zip_option x y) = zip_option (map_option f x) (map_option g y)\"\nby(simp add: zip_map_option1 zip_map_option2 option.map_comp apfst_def apsnd_def o_def prod.map_comp)\n\nlemma zip_conv_bind_option:\n  \"zip_option x y = Option.bind x (\\<lambda>x. Option.bind y (\\<lambda>y. Some (x, y)))\"\nby(cases \"(x, y)\" rule: zip_option.cases) simp_all\n\nlemma zip_option_parametric [transfer_rule]:\n  includes lifting_syntax shows\n  \"(rel_option R ===> rel_option Q ===> rel_option (rel_prod R Q)) zip_option zip_option\"\nunfolding zip_conv_bind_option[abs_def] by transfer_prover\n\nlemma rel_option_eqI [simp]: \"rel_option (=) x x\"\nby(simp add: option.rel_eq)\n\nsubsubsection \\<open>Binary supremum on @{typ \"'a option\"}\\<close>\n\nprimrec sup_option :: \"'a option \\<Rightarrow> 'a option \\<Rightarrow> 'a option\"\nwhere\n  \"sup_option x None = x\"\n| \"sup_option x (Some y) = (Some y)\"\n\nlemma sup_option_idem [simp]: \"sup_option x x = x\"\nby(cases x) simp_all\n\nlemma sup_option_assoc: \"sup_option (sup_option x y) z = sup_option x (sup_option y z)\"\nby(cases z) simp_all\n\nlemma sup_option_left_idem: \"sup_option x (sup_option x y) = sup_option x y\"\nby(rewrite sup_option_assoc[symmetric])(simp)\n\nlemmas sup_option_ai = sup_option_assoc sup_option_left_idem\n\nlemma sup_option_None [simp]: \"sup_option None y = y\"\nby(cases y) simp_all\n\nsubsubsection \\<open>Maps\\<close>\n\nlemma map_add_apply: \"(m1 ++ m2) x = sup_option (m1 x) (m2 x)\"\nby(simp add: map_add_def split: option.split)\n\nlemma map_le_map_upd2: \"\\<lbrakk> f \\<subseteq>\\<^sub>m g; \\<And>y'. f x = Some y' \\<Longrightarrow> y' = y \\<rbrakk> \\<Longrightarrow> f \\<subseteq>\\<^sub>m g(x \\<mapsto> y)\"\nby(cases \"x \\<in> dom f\")(auto simp add: map_le_def Ball_def)\n\nlemma eq_None_iff_not_dom: \"f x = None \\<longleftrightarrow> x \\<notin> dom f\"\nby auto\n\nlemma card_ran_le_dom: \"finite (dom m) \\<Longrightarrow> card (ran m) \\<le> card (dom m)\"\nby(simp add: ran_alt_def card_image_le)\n\nlemma dom_subset_ran_iff:\n  assumes \"finite (ran m)\"\n  shows \"dom m \\<subseteq> ran m \\<longleftrightarrow> dom m = ran m\"\nproof\n  assume le: \"dom m \\<subseteq> ran m\"\n  then have \"card (dom m) \\<le> card (ran m)\" by(simp add: card_mono assms)\n  moreover have \"card (ran m) \\<le> card (dom m)\" by(simp add: finite_subset[OF le assms] card_ran_le_dom)\n  ultimately show \"dom m = ran m\" using card_subset_eq[OF assms le] by simp\nqed simp\n\ntext \\<open>\n  We need a polymorphic constant for the empty map such that \\<open>transfer_prover\\<close>\n  can use a custom transfer rule for @{const Map.empty}\n\\<close>\ndefinition Map_empty where [simp]: \"Map_empty \\<equiv> Map.empty\"\n\n\n\nlemma map_le_fun_upd2: \"\\<lbrakk> f \\<subseteq>\\<^sub>m g; x \\<notin> dom f \\<rbrakk> \\<Longrightarrow> f \\<subseteq>\\<^sub>m g(x := y)\"\nby(auto simp add: map_le_def)\n\nlemma map_eqI: \"\\<forall>x\\<in>dom m \\<union> dom m'. m x = m' x \\<Longrightarrow> m = m'\"\nby(auto simp add: fun_eq_iff domIff intro: option.expand)\n\n\nsubsection \\<open>Countable\\<close>\n\nlemma countable_lfp:\n  assumes step: \"\\<And>Y. countable Y \\<Longrightarrow> countable (F Y)\"\n  and cont: \"Order_Continuity.sup_continuous F\"\n  shows \"countable (lfp F)\"\nby(subst sup_continuous_lfp[OF cont])(simp add: countable_funpow[OF step])\n\nlemma countable_lfp_apply:\n  assumes step: \"\\<And>Y x. (\\<And>x. countable (Y x)) \\<Longrightarrow> countable (F Y x)\"\n  and cont: \"Order_Continuity.sup_continuous F\"\n  shows \"countable (lfp F x)\"\nproof -\n  { fix n\n    have \"\\<And>x. countable ((F ^^ n) bot x)\"\n      by(induct n)(auto intro: step) }\n  thus ?thesis using cont by(simp add: sup_continuous_lfp)\nqed\n\n\nsubsection \\<open> Extended naturals \\<close>\n\nlemma idiff_enat_eq_enat_iff: \"x - enat n = enat m \\<longleftrightarrow> (\\<exists>k. x = enat k \\<and> k - n = m)\"\n  by (cases x) simp_all\n\nlemma eSuc_SUP: \"A \\<noteq> {} \\<Longrightarrow> eSuc (\\<Squnion> (f ` A)) = (\\<Squnion>x\\<in>A. eSuc (f x))\"\n  by (subst eSuc_Sup) (simp_all add: image_comp)\n\nlemma ereal_of_enat_1: \"ereal_of_enat 1 = ereal 1\"\n  by (simp add: one_enat_def)\n\nlemma ennreal_real_conv_ennreal_of_enat: \"ennreal (real n) = ennreal_of_enat n\"\n  by (simp add: ennreal_of_nat_eq_real_of_nat)\n\nlemma enat_add_sub_same2: \"b \\<noteq> \\<infinity> \\<Longrightarrow> a + b - b = (a :: enat)\"\n  by (cases a; cases b) simp_all\n\nlemma enat_sub_add: \"y \\<le> x \\<Longrightarrow> x - y + z = x + z - (y :: enat)\"\n  by (cases x; cases y; cases z) simp_all\n\nlemma SUP_enat_eq_0_iff [simp]: \"\\<Squnion> (f ` A) = (0 :: enat) \\<longleftrightarrow> (\\<forall>x\\<in>A. f x = 0)\"\n  by (simp add: bot_enat_def [symmetric])\n\nlemma SUP_enat_add_left:\n  assumes \"I \\<noteq> {}\"\n  shows \"(SUP i\\<in>I. f i + c :: enat) = (SUP i\\<in>I. f i) + c\" (is \"?lhs = ?rhs\")\nproof(cases \"c\", rule antisym)\n  case (enat n)\n  show \"?lhs \\<le> ?rhs\" by(auto 4 3 intro: SUP_upper intro: SUP_least)\n  have \"(SUP i\\<in>I. f i) \\<le> ?lhs - c\" using enat \n    by(auto simp add: enat_add_sub_same2 intro!: SUP_least order_trans[OF _ SUP_upper[THEN enat_minus_mono1]])\n  note add_right_mono[OF this, of c]\n  also have \"\\<dots> + c \\<le> ?lhs\" using assms\n    by(subst enat_sub_add)(auto intro: SUP_upper2 simp add: enat_add_sub_same2 enat)\n  finally show \"?rhs \\<le> ?lhs\" .\nqed(simp add: assms SUP_constant)\n\nlemma SUP_enat_add_right:\n  assumes \"I \\<noteq> {}\"\n  shows \"(SUP i\\<in>I. c + f i :: enat) = c + (SUP i\\<in>I. f i)\"\nusing SUP_enat_add_left[OF assms, of f c]\nby(simp add: add.commute)\n\nlemma iadd_SUP_le_iff: \"n + (SUP x\\<in>A. f x :: enat) \\<le> y \\<longleftrightarrow> (if A = {} then n \\<le> y else \\<forall>x\\<in>A. n + f x \\<le> y)\"\nby(simp add: bot_enat_def SUP_enat_add_right[symmetric] SUP_le_iff)\n\nlemma SUP_iadd_le_iff: \"(SUP x\\<in>A. f x :: enat) + n \\<le> y \\<longleftrightarrow> (if A = {} then n \\<le> y else \\<forall>x\\<in>A. f x + n \\<le> y)\"\nusing iadd_SUP_le_iff[of n f A y] by(simp add: add.commute)\n\n\nsubsection \\<open>Extended non-negative reals\\<close>\n\nlemma (in finite_measure) nn_integral_indicator_neq_infty: \n  \"f -` A \\<in> sets M \\<Longrightarrow> (\\<integral>\\<^sup>+ x. indicator A (f x) \\<partial>M) \\<noteq> \\<infinity>\"\nunfolding ennreal_indicator[symmetric]\napply(rule integrableD)\napply(rule integrable_const_bound[where B=1])\napply(simp_all add: indicator_vimage[symmetric])\ndone\n\nlemma (in finite_measure) nn_integral_indicator_neq_top: \n  \"f -` A \\<in> sets M \\<Longrightarrow> (\\<integral>\\<^sup>+ x. indicator A (f x) \\<partial>M) \\<noteq> \\<top>\"\nby(drule nn_integral_indicator_neq_infty) simp\n\nlemma nn_integral_indicator_map:\n  assumes [measurable]: \"f \\<in> measurable M N\" \"{x\\<in>space N. P x} \\<in> sets N\"\n  shows \"(\\<integral>\\<^sup>+x. indicator {x\\<in>space N. P x} (f x) \\<partial>M) = emeasure M {x\\<in>space M. P (f x)}\"\n  using assms(1)[THEN measurable_space] \n  by (subst nn_integral_indicator[symmetric])\n     (auto intro!: nn_integral_cong split: split_indicator simp del: nn_integral_indicator)\n\n\nsubsection \\<open>BNF material\\<close>\n\nlemma transp_rel_fun: \"\\<lbrakk> is_equality Q; transp R \\<rbrakk> \\<Longrightarrow> transp (rel_fun Q R)\"\nby(rule transpI)(auto dest: transpD rel_funD simp add: is_equality_def)\n\nlemma rel_fun_inf: \"inf (rel_fun Q R) (rel_fun Q R') = rel_fun Q (inf R R')\"\nby(rule antisym)(auto elim: rel_fun_mono dest: rel_funD)\n\nlemma reflp_fun1: includes lifting_syntax shows \"\\<lbrakk> is_equality A; reflp B \\<rbrakk> \\<Longrightarrow> reflp (A ===> B)\"\nby(simp add: reflp_def rel_fun_def is_equality_def)\n\nlemma type_copy_id': \"type_definition (\\<lambda>x. x) (\\<lambda>x. x) UNIV\"\nby unfold_locales simp_all\n\nlemma type_copy_id: \"type_definition id id UNIV\"\nby(simp add: id_def type_copy_id')\n\nlemma GrpE [cases pred]:\n  assumes \"BNF_Def.Grp A f x y\"\n  obtains (Grp) \"y = f x\" \"x \\<in> A\"\nusing assms\nby(simp add: Grp_def)\n\nlemma rel_fun_Grp_copy_Abs:\n  includes lifting_syntax\n  assumes \"type_definition Rep Abs A\"\n  shows \"rel_fun (BNF_Def.Grp A Abs) (BNF_Def.Grp B g) = BNF_Def.Grp {f. f ` A \\<subseteq> B} (Rep ---> g)\"\nproof -\n  interpret type_definition Rep Abs A by fact\n  show ?thesis\n    by(auto simp add: rel_fun_def Grp_def fun_eq_iff Abs_inverse Rep_inverse intro!: Rep)\nqed\n\nlemma rel_set_Grp:\n  \"rel_set (BNF_Def.Grp A f) = BNF_Def.Grp {B. B \\<subseteq> A} (image f)\"\nby(auto simp add: rel_set_def BNF_Def.Grp_def fun_eq_iff)\n\nlemma rel_set_comp_Grp:\n  \"rel_set R = (BNF_Def.Grp {x. x \\<subseteq> {(x, y). R x y}} ((`) fst))\\<inverse>\\<inverse> OO BNF_Def.Grp {x. x \\<subseteq> {(x, y). R x y}} ((`) snd)\"\napply(auto 4 4 del: ext intro!: ext simp add: BNF_Def.Grp_def intro!: rel_setI intro: rev_bexI)\napply(simp add: relcompp_apply)\nsubgoal for A B\n  apply(rule exI[where x=\"A \\<times> B \\<inter> {(x, y). R x y}\"])\n  apply(auto 4 3 dest: rel_setD1 rel_setD2 intro: rev_image_eqI)\n  done\ndone\n\nlemma Domainp_Grp: \"Domainp (BNF_Def.Grp A f) = (\\<lambda>x. x \\<in> A)\"\nby(auto simp add: fun_eq_iff Grp_def)\n\nlemma pred_prod_conj [simp]:\n  shows pred_prod_conj1: \"\\<And>P Q R. pred_prod (\\<lambda>x. P x \\<and> Q x) R = (\\<lambda>x. pred_prod P R x \\<and> pred_prod Q R x)\"\n  and pred_prod_conj2: \"\\<And>P Q R. pred_prod P (\\<lambda>x. Q x \\<and> R x) = (\\<lambda>x. pred_prod P Q x \\<and> pred_prod P R x)\"\nby(auto simp add: pred_prod.simps)\n\nlemma pred_sum_conj [simp]:\n  shows pred_sum_conj1: \"\\<And>P Q R. pred_sum (\\<lambda>x. P x \\<and> Q x) R = (\\<lambda>x. pred_sum P R x \\<and> pred_sum Q R x)\"\n  and pred_sum_conj2: \"\\<And>P Q R. pred_sum P (\\<lambda>x. Q x \\<and> R x) = (\\<lambda>x. pred_sum P Q x \\<and> pred_sum P R x)\"\nby(auto simp add: pred_sum.simps fun_eq_iff)\n\nlemma pred_list_conj [simp]: \"list_all (\\<lambda>x. P x \\<and> Q x) = (\\<lambda>x. list_all P x \\<and> list_all Q x)\"\nby(auto simp add: list_all_def)\n\nlemma pred_prod_top [simp]:\n  \"pred_prod (\\<lambda>_. True) (\\<lambda>_. True) = (\\<lambda>_. True)\"\nby(simp add: pred_prod.simps fun_eq_iff)\n\nlemma rel_fun_conversep: includes lifting_syntax shows\n  \"(A^--1 ===> B^--1) = (A ===> B)^--1\"\nby(auto simp add: rel_fun_def fun_eq_iff)\n\nlemma left_unique_Grp [iff]:\n  \"left_unique (BNF_Def.Grp A f) \\<longleftrightarrow> inj_on f A\"\nunfolding Grp_def left_unique_def by(auto simp add: inj_on_def)\n\nlemma right_unique_Grp [simp, intro!]: \"right_unique (BNF_Def.Grp A f)\"\nby(simp add: Grp_def right_unique_def)\n\nlemma bi_unique_Grp [iff]:\n  \"bi_unique (BNF_Def.Grp A f) \\<longleftrightarrow> inj_on f A\"\nby(simp add: bi_unique_alt_def)\n\nlemma left_total_Grp [iff]:\n  \"left_total (BNF_Def.Grp A f) \\<longleftrightarrow> A = UNIV\"\nby(auto simp add: left_total_def Grp_def)\n\nlemma right_total_Grp [iff]:\n  \"right_total (BNF_Def.Grp A f) \\<longleftrightarrow> f ` A = UNIV\"\nby(auto simp add: right_total_def BNF_Def.Grp_def image_def)\n\nlemma bi_total_Grp [iff]:\n  \"bi_total (BNF_Def.Grp A f) \\<longleftrightarrow> A = UNIV \\<and> surj f\"\nby(auto simp add: bi_total_alt_def)\n\nlemma left_unique_vimage2p [simp]:\n  \"\\<lbrakk> left_unique P; inj f \\<rbrakk> \\<Longrightarrow> left_unique (BNF_Def.vimage2p f g P)\"\nunfolding vimage2p_Grp by(intro left_unique_OO) simp_all\n\nlemma right_unique_vimage2p [simp]:\n  \"\\<lbrakk> right_unique P; inj g \\<rbrakk> \\<Longrightarrow> right_unique (BNF_Def.vimage2p f g P)\"\nunfolding vimage2p_Grp by(intro right_unique_OO) simp_all\n\nlemma bi_unique_vimage2p [simp]:\n  \"\\<lbrakk> bi_unique P; inj f; inj g \\<rbrakk> \\<Longrightarrow> bi_unique (BNF_Def.vimage2p f g P)\"\nunfolding bi_unique_alt_def by simp\n\nlemma left_total_vimage2p [simp]:\n  \"\\<lbrakk> left_total P; surj g \\<rbrakk> \\<Longrightarrow> left_total (BNF_Def.vimage2p f g P)\"\nunfolding vimage2p_Grp by(intro left_total_OO) simp_all\n\nlemma right_total_vimage2p [simp]:\n  \"\\<lbrakk> right_total P; surj f \\<rbrakk> \\<Longrightarrow> right_total (BNF_Def.vimage2p f g P)\"\nunfolding vimage2p_Grp by(intro right_total_OO) simp_all\n\nlemma bi_total_vimage2p [simp]:\n  \"\\<lbrakk> bi_total P; surj f; surj g \\<rbrakk> \\<Longrightarrow> bi_total (BNF_Def.vimage2p f g P)\"\nunfolding bi_total_alt_def by simp\n\nlemma vimage2p_eq [simp]:\n  \"inj f \\<Longrightarrow> BNF_Def.vimage2p f f (=) = (=)\"\nby(auto simp add: vimage2p_def fun_eq_iff inj_on_def)\n\nlemma vimage2p_conversep: \"BNF_Def.vimage2p f g R^--1 = (BNF_Def.vimage2p g f R)^--1\"\nby(simp add: vimage2p_def fun_eq_iff)\n\nsubsection \\<open>Transfer and lifting material\\<close>\n\ncontext includes lifting_syntax begin\n\nlemma monotone_parametric [transfer_rule]:\n  assumes [transfer_rule]: \"bi_total A\"\n  shows \"((A ===> A ===> (=)) ===> (B ===> B ===> (=)) ===> (A ===> B) ===> (=)) monotone monotone\"\nunfolding monotone_def[abs_def] by transfer_prover\n\nlemma fun_ord_parametric [transfer_rule]:\n  assumes [transfer_rule]: \"bi_total C\"\n  shows \"((A ===> B ===> (=)) ===> (C ===> A) ===> (C ===> B) ===> (=)) fun_ord fun_ord\"\nunfolding fun_ord_def[abs_def] by transfer_prover\n\nlemma Plus_parametric [transfer_rule]:\n  \"(rel_set A ===> rel_set B ===> rel_set (rel_sum A B)) (<+>) (<+>)\"\nunfolding Plus_def[abs_def] by transfer_prover\n\nlemma pred_fun_parametric [transfer_rule]:\n  assumes [transfer_rule]: \"bi_total A\"\n  shows \"((A ===> (=)) ===> (B ===> (=)) ===> (A ===> B) ===> (=)) pred_fun pred_fun\"\nunfolding pred_fun_def by(transfer_prover)\n\nlemma rel_fun_eq_OO: \"((=) ===> A) OO ((=) ===> B) = ((=) ===> A OO B)\"\nby(clarsimp simp add: rel_fun_def fun_eq_iff relcompp.simps) metis\n\nend\n\nlemma Quotient_set_rel_eq:\n  includes lifting_syntax\n  assumes \"Quotient R Abs Rep T\"\n  shows \"(rel_set T ===> rel_set T ===> (=)) (rel_set R) (=)\"\nproof(rule rel_funI iffI)+\n  fix A B C D\n  assume AB: \"rel_set T A B\" and CD: \"rel_set T C D\"\n  have *: \"\\<And>x y. R x y = (T x (Abs x) \\<and> T y (Abs y) \\<and> Abs x = Abs y)\"\n    \"\\<And>a b. T a b \\<Longrightarrow> Abs a = b\"\n    using assms unfolding Quotient_alt_def by simp_all\n\n  { assume [simp]: \"B = D\"\n    thus \"rel_set R A C\"\n      by(auto 4 4 intro!: rel_setI dest: rel_setD1[OF AB, simplified] rel_setD2[OF AB, simplified] rel_setD2[OF CD] rel_setD1[OF CD] simp add: * elim!: rev_bexI)\n  next\n    assume AC: \"rel_set R A C\"\n    show \"B = D\"\n      apply safe\n       apply(drule rel_setD2[OF AB], erule bexE)\n       apply(drule rel_setD1[OF AC], erule bexE)\n       apply(drule rel_setD1[OF CD], erule bexE)\n       apply(simp add: *)\n      apply(drule rel_setD2[OF CD], erule bexE)\n      apply(drule rel_setD2[OF AC], erule bexE)\n      apply(drule rel_setD1[OF AB], erule bexE)\n      apply(simp add: *)\n      done\n  }\nqed\n\nlemma Domainp_eq: \"Domainp (=) = (\\<lambda>_. True)\"\nby(simp add: Domainp.simps fun_eq_iff)\n\nlemma rel_fun_eq_onpI: \"eq_onp (pred_fun P Q) f g \\<Longrightarrow> rel_fun (eq_onp P) (eq_onp Q) f g\"\nby(auto simp add: eq_onp_def rel_fun_def)\n\nlemma bi_unique_eq_onp: \"bi_unique (eq_onp P)\"\nby(simp add: bi_unique_def eq_onp_def)\n\nlemma rel_fun_eq_conversep: includes lifting_syntax shows \"(A\\<inverse>\\<inverse> ===> (=)) = (A ===> (=))\\<inverse>\\<inverse>\"\nby(auto simp add: fun_eq_iff rel_fun_def)\n\n\nsubsection \\<open>Arithmetic\\<close>\n\nlemma abs_diff_triangle_ineq2: \"\\<bar>a - b :: _ :: ordered_ab_group_add_abs\\<bar> \\<le> \\<bar>a - c\\<bar> + \\<bar>c - b\\<bar>\"\nby(rule order_trans[OF _ abs_diff_triangle_ineq]) simp\n\nlemma (in ordered_ab_semigroup_add) add_left_mono_trans:\n  \"\\<lbrakk> x \\<le> a + b; b \\<le> c \\<rbrakk> \\<Longrightarrow> x \\<le> a + c\"\nby(erule order_trans)(rule add_left_mono)\n\nlemma of_nat_le_one_cancel_iff [simp]:\n  fixes n :: nat shows \"real n \\<le> 1 \\<longleftrightarrow> n \\<le> 1\"\nby linarith\n\nlemma (in linordered_semidom) mult_right_le: \"c \\<le> 1 \\<Longrightarrow> 0 \\<le> a \\<Longrightarrow> c * a \\<le> a\"\nby(subst mult.commute)(rule mult_left_le)\n\nsubsection \\<open>Chain-complete partial orders and \\<open>partial_function\\<close>\\<close>\n\nlemma fun_ordD: \"fun_ord ord f g \\<Longrightarrow> ord (f x) (g x)\"\nby(simp add: fun_ord_def)\n\nlemma parallel_fixp_induct_strong:\n  assumes ccpo1: \"class.ccpo luba orda (mk_less orda)\"\n  and ccpo2: \"class.ccpo lubb ordb (mk_less ordb)\"\n  and adm: \"ccpo.admissible (prod_lub luba lubb) (rel_prod orda ordb) (\\<lambda>x. P (fst x) (snd x))\"\n  and f: \"monotone orda orda f\"\n  and g: \"monotone ordb ordb g\"\n  and bot: \"P (luba {}) (lubb {})\"\n  and step: \"\\<And>x y. \\<lbrakk> orda x (ccpo.fixp luba orda f); ordb y (ccpo.fixp lubb ordb g); P x y \\<rbrakk> \\<Longrightarrow> P (f x) (g y)\"\n  shows \"P (ccpo.fixp luba orda f) (ccpo.fixp lubb ordb g)\"\nproof -\n  let ?P=\"\\<lambda>x y. orda x (ccpo.fixp luba orda f) \\<and> ordb y (ccpo.fixp lubb ordb g) \\<and> P x y\"\n  show ?thesis using ccpo1 ccpo2 _ f g\n  proof(rule parallel_fixp_induct[where P=\"?P\", THEN conjunct2, THEN conjunct2])\n    note [cont_intro] = \n      admissible_leI[OF ccpo1] ccpo.mcont_const[OF ccpo1]\n      admissible_leI[OF ccpo2] ccpo.mcont_const[OF ccpo2]\n    show \"ccpo.admissible (prod_lub luba lubb) (rel_prod orda ordb) (\\<lambda>xy. ?P (fst xy) (snd xy))\"\n      using adm by simp\n    show \"?P (luba {}) (lubb {})\" using bot by(auto intro: ccpo.ccpo_Sup_least ccpo1 ccpo2 chain_empty)\n    show \"?P (f x) (g y)\" if \"?P x y\" for x y using that\n      apply(subst ccpo.fixp_unfold[OF ccpo1 f])\n      apply(subst ccpo.fixp_unfold[OF ccpo2 g])\n      apply(auto intro: step monotoneD[OF f] monotoneD[OF g])\n      done\n  qed\nqed\n\nlemma parallel_fixp_induct_strong_uc:\n  assumes a: \"partial_function_definitions orda luba\"\n  and b: \"partial_function_definitions ordb lubb\"\n  and F: \"\\<And>x. monotone (fun_ord orda) orda (\\<lambda>f. U1 (F (C1 f)) x)\"\n  and G: \"\\<And>y. monotone (fun_ord ordb) ordb (\\<lambda>g. U2 (G (C2 g)) y)\"\n  and eq1: \"f \\<equiv> C1 (ccpo.fixp (fun_lub luba) (fun_ord orda) (\\<lambda>f. U1 (F (C1 f))))\"\n  and eq2: \"g \\<equiv> C2 (ccpo.fixp (fun_lub lubb) (fun_ord ordb) (\\<lambda>g. U2 (G (C2 g))))\"\n  and inverse: \"\\<And>f. U1 (C1 f) = f\"\n  and inverse2: \"\\<And>g. U2 (C2 g) = g\"\n  and adm: \"ccpo.admissible (prod_lub (fun_lub luba) (fun_lub lubb)) (rel_prod (fun_ord orda) (fun_ord ordb)) (\\<lambda>x. P (fst x) (snd x))\"\n  and bot: \"P (\\<lambda>_. luba {}) (\\<lambda>_. lubb {})\"\n  and step: \"\\<And>f' g'. \\<lbrakk> \\<And>x. orda (U1 f' x) (U1 f x); \\<And>y. ordb (U2 g' y) (U2 g y); P (U1 f') (U2 g') \\<rbrakk> \\<Longrightarrow> P (U1 (F f')) (U2 (G g'))\"\n  shows \"P (U1 f) (U2 g)\"\napply(unfold eq1 eq2 inverse inverse2)\napply(rule parallel_fixp_induct_strong[OF partial_function_definitions.ccpo[OF a] partial_function_definitions.ccpo[OF b] adm])\nusing F apply(simp add: monotone_def fun_ord_def)\nusing G apply(simp add: monotone_def fun_ord_def)\napply(simp add: fun_lub_def bot)\napply(rule step; simp add: inverse inverse2 eq1 eq2 fun_ordD)\ndone\n\nlemmas parallel_fixp_induct_strong_1_1 = parallel_fixp_induct_strong_uc[\n  of _ _ _ _ \"\\<lambda>x. x\" _ \"\\<lambda>x. x\" \"\\<lambda>x. x\" _ \"\\<lambda>x. x\",\n  OF _ _ _ _ _ _ refl refl]\n\nlemmas parallel_fixp_induct_strong_2_2 = parallel_fixp_induct_strong_uc[\n  of _ _ _ _ \"case_prod\" _ \"curry\" \"case_prod\" _ \"curry\",\n  where P=\"\\<lambda>f g. P (curry f) (curry g)\",\n  unfolded case_prod_curry curry_case_prod curry_K,\n  OF _ _ _ _ _ _ refl refl,\n  split_format (complete), unfolded prod.case]\n  for P\n\nlemma fixp_induct_option': \\<comment> \\<open>Stronger induction rule\\<close>\n  fixes F :: \"'c \\<Rightarrow> 'c\" and\n    U :: \"'c \\<Rightarrow> 'b \\<Rightarrow> 'a option\" and\n    C :: \"('b \\<Rightarrow> 'a option) \\<Rightarrow> 'c\" and\n    P :: \"'b \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  assumes mono: \"\\<And>x. mono_option (\\<lambda>f. U (F (C f)) x)\"\n  assumes eq: \"f \\<equiv> C (ccpo.fixp (fun_lub (flat_lub None)) (fun_ord option_ord) (\\<lambda>f. U (F (C f))))\"\n  assumes inverse2: \"\\<And>f. U (C f) = f\"\n  assumes step: \"\\<And>g x y. \\<lbrakk> \\<And>x y. U g x = Some y \\<Longrightarrow> P x y; U (F g) x = Some y; \\<And>x. option_ord (U g x) (U f x) \\<rbrakk> \\<Longrightarrow> P x y\"\n  assumes defined: \"U f x = Some y\"\n  shows \"P x y\"\nusing step defined option.fixp_strong_induct_uc[of U F C, OF mono eq inverse2 option_admissible, of P]\nunfolding fun_lub_def flat_lub_def fun_ord_def\nby(simp (no_asm_use)) blast\n\ndeclaration \\<open>Partial_Function.init \"option'\" @{term option.fixp_fun}\n  @{term option.mono_body} @{thm option.fixp_rule_uc} @{thm option.fixp_induct_uc}\n  (SOME @{thm fixp_induct_option'})\\<close>\n\nlemma bot_fun_least [simp]: \"(\\<lambda>_. bot :: 'a :: order_bot) \\<le> x\"\nby(fold bot_fun_def) simp\n\nlemma fun_ord_conv_rel_fun: \"fun_ord = rel_fun (=)\"\nby(simp add: fun_ord_def fun_eq_iff rel_fun_def)\n\ninductive finite_chains :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  for ord\nwhere finite_chainsI: \"(\\<And>Y. Complete_Partial_Order.chain ord Y \\<Longrightarrow> finite Y) \\<Longrightarrow> finite_chains ord\"\n\nlemma finite_chainsD: \"\\<lbrakk> finite_chains ord; Complete_Partial_Order.chain ord Y \\<rbrakk> \\<Longrightarrow> finite Y\"\nby(rule finite_chains.cases)\n\nlemma finite_chains_flat_ord [simp, intro!]: \"finite_chains (flat_ord x)\"\nproof\n  fix Y\n  assume chain: \"Complete_Partial_Order.chain (flat_ord x) Y\"\n  show \"finite Y\"\n  proof(cases \"\\<exists>y \\<in> Y. y \\<noteq> x\")\n    case True\n    then obtain y where y: \"y \\<in> Y\" and yx: \"y \\<noteq> x\" by blast\n    hence \"Y \\<subseteq> {x, y}\" by(auto dest: chainD[OF chain] simp add: flat_ord_def)\n    thus ?thesis by(rule finite_subset) simp\n  next\n    case False\n    hence \"Y \\<subseteq> {x}\" by auto\n    thus ?thesis by(rule finite_subset) simp\n  qed\nqed    \n\nlemma mcont_finite_chains:\n  assumes finite: \"finite_chains ord\"\n  and mono: \"monotone ord ord' f\"\n  and ccpo: \"class.ccpo lub ord (mk_less ord)\"\n  and ccpo': \"class.ccpo lub' ord' (mk_less ord')\"\n  shows \"mcont lub ord lub' ord' f\"\nproof(intro mcontI contI)\n  fix Y\n  assume chain: \"Complete_Partial_Order.chain ord Y\" and Y: \"Y \\<noteq> {}\"\n  from finite chain have fin: \"finite Y\" by(rule finite_chainsD)\n  from ccpo chain fin Y have lub: \"lub Y \\<in> Y\" by(rule ccpo.in_chain_finite)\n\n  interpret ccpo': ccpo lub' ord' \"mk_less ord'\" by(rule ccpo')\n\n  have chain': \"Complete_Partial_Order.chain ord' (f ` Y)\" using chain\n    by(rule chain_imageI)(rule monotoneD[OF mono])\n\n  have \"ord' (f (lub Y)) (lub' (f ` Y))\" using chain'\n    by(rule ccpo'.ccpo_Sup_upper)(simp add: lub)\n  moreover\n  have \"ord' (lub' (f ` Y)) (f (lub Y))\" using chain'\n    by(rule ccpo'.ccpo_Sup_least)(blast intro: monotoneD[OF mono] ccpo.ccpo_Sup_upper[OF ccpo chain])\n  ultimately show \"f (lub Y) = lub' (f ` Y)\" by(rule ccpo'.antisym)\nqed(fact mono)  \n\nlemma rel_fun_curry: includes lifting_syntax shows\n  \"(A ===> B ===> C) f g \\<longleftrightarrow> (rel_prod A B ===> C) (case_prod f) (case_prod g)\"\nby(auto simp add: rel_fun_def)\n\nlemma (in ccpo) Sup_image_mono:\n  assumes ccpo: \"class.ccpo luba orda lessa\"\n  and mono: \"monotone orda (\\<le>) f\"\n  and chain: \"Complete_Partial_Order.chain orda A\"\n  and \"A \\<noteq> {}\"\n  shows \"Sup (f ` A) \\<le> (f (luba A))\"\nproof(rule ccpo_Sup_least)\n  from chain show \"Complete_Partial_Order.chain (\\<le>) (f ` A)\"\n    by(rule chain_imageI)(rule monotoneD[OF mono])\n  fix x\n  assume \"x \\<in> f ` A\"\n  then obtain y where \"x = f y\" \"y \\<in> A\" by blast\n  from \\<open>y \\<in> A\\<close> have \"orda y (luba A)\" by(rule ccpo.ccpo_Sup_upper[OF ccpo chain])\n  hence \"f y \\<le> f (luba A)\" by(rule monotoneD[OF mono])\n  thus \"x \\<le> f (luba A)\" using \\<open>x = f y\\<close> by simp\nqed\n\nlemma (in ccpo) admissible_le_mono:\n  assumes \"monotone (\\<le>) (\\<le>) f\"\n  shows \"ccpo.admissible Sup (\\<le>) (\\<lambda>x. x \\<le> f x)\"\nproof(rule ccpo.admissibleI)\n  fix Y\n  assume chain: \"Complete_Partial_Order.chain (\\<le>) Y\"\n    and Y: \"Y \\<noteq> {}\"\n    and le [rule_format]: \"\\<forall>x\\<in>Y. x \\<le> f x\"\n  have \"\\<Squnion>Y \\<le> \\<Squnion>(f ` Y)\" using chain\n    by(rule ccpo_Sup_least)(rule order_trans[OF le]; blast intro!: ccpo_Sup_upper chain_imageI[OF chain] intro: monotoneD[OF assms])\n  also have \"\\<dots> \\<le> f (\\<Squnion>Y)\"\n    by(rule Sup_image_mono[OF _ assms chain Y, where lessa=\"(<)\"]) unfold_locales\n  finally show \"\\<Squnion>Y \\<le> \\<dots>\" .\nqed\n\nlemma (in ccpo) fixp_induct_strong2:\n  assumes adm: \"ccpo.admissible Sup (\\<le>) P\"\n  and mono: \"monotone (\\<le>) (\\<le>) f\"\n  and bot: \"P (\\<Squnion>{})\"\n  and step: \"\\<And>x. \\<lbrakk> x \\<le> ccpo_class.fixp f; x \\<le> f x; P x \\<rbrakk> \\<Longrightarrow> P (f x)\"\n  shows \"P (ccpo_class.fixp f)\"\nproof(rule fixp_strong_induct[where P=\"\\<lambda>x. x \\<le> f x \\<and> P x\", THEN conjunct2])\n  show \"ccpo.admissible Sup (\\<le>) (\\<lambda>x. x \\<le> f x \\<and> P x)\"\n    using admissible_le_mono adm by(rule admissible_conj)(rule mono)\nnext\n  show \"\\<Squnion>{} \\<le> f (\\<Squnion>{}) \\<and> P (\\<Squnion>{})\"\n    by(auto simp add: bot chain_empty intro: ccpo_Sup_least)\nnext\n  fix x\n  assume \"x \\<le> ccpo_class.fixp f\" \"x \\<le> f x \\<and> P x\"\n  thus \"f x \\<le> f (f x) \\<and> P (f x)\"\n    by(auto dest: monotoneD[OF mono] intro: step)\nqed(rule mono)\n\ncontext partial_function_definitions begin\n\nlemma fixp_induct_strong2_uc:\n  fixes F :: \"'c \\<Rightarrow> 'c\"\n    and U :: \"'c \\<Rightarrow> 'b \\<Rightarrow> 'a\"\n    and C :: \"('b \\<Rightarrow> 'a) \\<Rightarrow> 'c\"\n    and P :: \"('b \\<Rightarrow> 'a) \\<Rightarrow> bool\"\n  assumes mono: \"\\<And>x. mono_body (\\<lambda>f. U (F (C f)) x)\"\n    and eq: \"f \\<equiv> C (fixp_fun (\\<lambda>f. U (F (C f))))\"\n    and inverse: \"\\<And>f. U (C f) = f\"\n    and adm: \"ccpo.admissible lub_fun le_fun P\"\n    and bot: \"P (\\<lambda>_. lub {})\"\n    and step: \"\\<And>f'. \\<lbrakk> le_fun (U f') (U f); le_fun (U f') (U (F f')); P (U f') \\<rbrakk> \\<Longrightarrow> P (U (F f'))\"\n  shows \"P (U f)\"\nunfolding eq inverse\napply (rule ccpo.fixp_induct_strong2[OF ccpo adm])\napply (insert mono, auto simp: monotone_def fun_ord_def bot fun_lub_def)[2]\napply (rule_tac f'5=\"C x\" in step)\napply (simp_all add: inverse eq)\ndone\n\nend\n\nlemmas parallel_fixp_induct_2_4 = parallel_fixp_induct_uc[\n  of _ _ _ _ \"case_prod\" _ \"curry\" \"\\<lambda>f. case_prod (case_prod (case_prod f))\" _ \"\\<lambda>f. curry (curry (curry f))\",\n  where P=\"\\<lambda>f g. P (curry f) (curry (curry (curry g)))\",\n  unfolded case_prod_curry curry_case_prod curry_K,\n  OF _ _ _ _ _ _ refl refl]\n  for P\n  \nlemma (in ccpo) fixp_greatest:\n  assumes f: \"monotone (\\<le>) (\\<le>) f\"\n    and ge: \"\\<And>y. f y \\<le> y \\<Longrightarrow> x \\<le> y\"\n  shows \"x \\<le> ccpo.fixp Sup (\\<le>) f\"\n  by(rule ge)(simp add: fixp_unfold[OF f, symmetric])\n\nlemma fixp_rolling:\n  assumes \"class.ccpo lub1 leq1 (mk_less leq1)\"\n    and \"class.ccpo lub2 leq2 (mk_less leq2)\"\n    and f: \"monotone leq1 leq2 f\"\n    and g: \"monotone leq2 leq1 g\"\n  shows \"ccpo.fixp lub1 leq1 (\\<lambda>x. g (f x)) = g (ccpo.fixp lub2 leq2 (\\<lambda>x. f (g x)))\"\nproof -\n  interpret c1: ccpo lub1 leq1 \"mk_less leq1\" by fact\n  interpret c2: ccpo lub2 leq2 \"mk_less leq2\" by fact\n  show ?thesis\n  proof(rule c1.antisym)\n    have fg: \"monotone leq2 leq2 (\\<lambda>x. f (g x))\" using f g by(rule monotone2monotone) simp_all\n    have gf: \"monotone leq1 leq1 (\\<lambda>x. g (f x))\" using g f by(rule monotone2monotone) simp_all\n    show \"leq1 (c1.fixp (\\<lambda>x. g (f x))) (g (c2.fixp (\\<lambda>x. f (g x))))\" using gf\n      by(rule c1.fixp_lowerbound)(subst (2) c2.fixp_unfold[OF fg], simp)\n    show \"leq1 (g (c2.fixp (\\<lambda>x. f (g x)))) (c1.fixp (\\<lambda>x. g (f x)))\" using gf\n    proof(rule c1.fixp_greatest)\n      fix u\n      assume u: \"leq1 (g (f u)) u\"\n      have \"leq1 (g (c2.fixp (\\<lambda>x. f (g x)))) (g (f u))\"\n        by(intro monotoneD[OF g] c2.fixp_lowerbound[OF fg] monotoneD[OF f u])\n      then show \"leq1 (g (c2.fixp (\\<lambda>x. f (g x)))) u\" using u by(rule c1.order_trans)\n    qed\n  qed\nqed\n\nlemma fixp_lfp_parametric_eq:\n  includes lifting_syntax\n  assumes f: \"\\<And>x. lfp.mono_body (\\<lambda>f. F f x)\"\n  and g: \"\\<And>x. lfp.mono_body (\\<lambda>f. G f x)\"\n  and param: \"((A ===> (=)) ===> A ===> (=)) F G\"\n  shows \"(A ===> (=)) (lfp.fixp_fun F) (lfp.fixp_fun G)\"\nusing f g\nproof(rule parallel_fixp_induct_1_1[OF complete_lattice_partial_function_definitions complete_lattice_partial_function_definitions _ _ reflexive reflexive, where P=\"(A ===> (=))\"])\n  show \"ccpo.admissible (prod_lub lfp.lub_fun lfp.lub_fun) (rel_prod lfp.le_fun lfp.le_fun) (\\<lambda>x. (A ===> (=)) (fst x) (snd x))\"\n    unfolding rel_fun_def by simp\n  show \"(A ===> (=)) (\\<lambda>_. \\<Squnion>{}) (\\<lambda>_. \\<Squnion>{})\" by auto\n  show \"(A ===> (=)) (F f) (G g)\" if \"(A ===> (=)) f g\" for f g\n    using that by(rule rel_funD[OF param])\nqed\n\nlemma mono2mono_map_option[THEN option.mono2mono, simp, cont_intro]:\n  shows monotone_map_option: \"monotone option_ord option_ord (map_option f)\"\nby(rule monotoneI)(auto simp add: flat_ord_def)\n\nlemma mcont2mcont_map_option[THEN option.mcont2mcont, simp, cont_intro]:\n  shows mcont_map_option: \"mcont (flat_lub None) option_ord (flat_lub None) option_ord (map_option f)\"\nby(rule mcont_finite_chains[OF _ _ flat_interpretation[THEN ccpo] flat_interpretation[THEN ccpo]]) simp_all\n\nlemma mono2mono_set_option [THEN lfp.mono2mono]:\n  shows monotone_set_option: \"monotone option_ord (\\<subseteq>) set_option\"\nby(auto intro!: monotoneI simp add: option_ord_Some1_iff)\n\n\n\nlemma eadd_gfp_partial_function_mono [partial_function_mono]:\n  \"\\<lbrakk> monotone (fun_ord (\\<ge>)) (\\<ge>) f; monotone (fun_ord (\\<ge>)) (\\<ge>) g \\<rbrakk>\n  \\<Longrightarrow> monotone (fun_ord (\\<ge>)) (\\<ge>) (\\<lambda>x. f x + g x :: enat)\"\nby(rule mono2mono_gfp_eadd)\n\nlemma map_option_mono [partial_function_mono]:\n  \"mono_option B \\<Longrightarrow> mono_option (\\<lambda>f. map_option g (B f))\"\nunfolding map_conv_bind_option by(rule bind_mono) simp_all\n\n\nsubsection \\<open>Folding over finite sets\\<close>\n\nlemma (in comp_fun_commute) fold_invariant_remove [consumes 1, case_names start step]:\n  assumes fin: \"finite A\"\n  and start: \"I A s\"\n  and step: \"\\<And>x s A'. \\<lbrakk> x \\<in> A'; I A' s; A' \\<subseteq> A \\<rbrakk> \\<Longrightarrow> I (A' - {x}) (f x s)\"\n  shows \"I {} (Finite_Set.fold f s A)\"\nproof -\n  define A' where \"A' == A\"\n  with fin start have \"finite A'\" \"A' \\<subseteq> A\" \"I A' s\" by simp_all\n  thus \"I {} (Finite_Set.fold f s A')\"\n  proof(induction arbitrary: s)\n    case empty thus ?case by simp\n  next\n    case (insert x A')\n    let ?A' = \"insert x A'\"\n    have \"x \\<in> ?A'\" \"I ?A' s\" \"?A' \\<subseteq> A\" using insert by auto\n    hence \"I (?A' - {x}) (f x s)\" by(rule step)\n    with insert have \"A' \\<subseteq> A\" \"I A' (f x s)\" by auto\n    hence \"I {} (Finite_Set.fold f (f x s) A')\" by(rule insert.IH)\n    thus ?case using insert by(simp add: fold_insert2 del: fold_insert)\n  qed\nqed\n\nlemma (in comp_fun_commute) fold_invariant_insert [consumes 1, case_names start step]:\n  assumes fin: \"finite A\"\n  and start: \"I {} s\"\n  and step: \"\\<And>x s A'. \\<lbrakk> I A' s; x \\<notin> A'; x \\<in> A; A' \\<subseteq> A \\<rbrakk> \\<Longrightarrow> I (insert x A') (f x s)\"\n  shows \"I A (Finite_Set.fold f s A)\"\nusing fin start\nproof(rule fold_invariant_remove[where I=\"\\<lambda>A'. I (A - A')\" and A=A and s=s, simplified])\n  fix x s A'\n  assume *: \"x \\<in> A'\" \"I (A - A') s\" \"A' \\<subseteq> A\"\n  hence \"x \\<notin> A - A'\" \"x \\<in> A\" \"A - A' \\<subseteq> A\" by auto\n  with \\<open>I (A - A') s\\<close> have \"I (insert x (A - A')) (f x s)\" by(rule step)\n  also have \"insert x (A - A') = A - (A' - {x})\" using * by auto\n  finally show \"I \\<dots> (f x s)\" .\nqed\n\nlemma (in comp_fun_idem) fold_set_union:\n  assumes \"finite A\" \"finite B\"\n  shows \"Finite_Set.fold f z (A \\<union> B) = Finite_Set.fold f (Finite_Set.fold f z A) B\"\nusing assms(2,1) by induction simp_all\n\n\nsubsection \\<open>Parametrisation of transfer rules\\<close>\n\nattribute_setup transfer_parametric = \\<open> \n  Attrib.thm >> (fn parametricity =>\n    Thm.rule_attribute [] (fn context => fn transfer_rule =>\n      let\n        val ctxt = Context.proof_of context;\n        val thm' = Lifting_Term.parametrize_transfer_rule ctxt transfer_rule\n      in Lifting_Def.generate_parametric_transfer_rule ctxt thm' parametricity\n      end\n      handle Lifting_Term.MERGE_TRANSFER_REL msg => error (Pretty.string_of msg)\n      ))\n\\<close> \"combine transfer rule with parametricity theorem\"\n\nsubsection \\<open>Lists\\<close>\n\nlemma nth_eq_tlI: \"xs ! n = z \\<Longrightarrow> (x # xs) ! Suc n = z\"\nby simp\n\nlemma list_all2_append':\n  \"length us = length vs \\<Longrightarrow> list_all2 P (xs @ us) (ys @ vs) \\<longleftrightarrow> list_all2 P xs ys \\<and> list_all2 P us vs\"\nby(auto simp add: list_all2_append1 list_all2_append2 dest: list_all2_lengthD)\n\ndefinition disjointp :: \"('a \\<Rightarrow> bool) list \\<Rightarrow> bool\"\nwhere \"disjointp xs = disjoint_family_on (\\<lambda>n. {x. (xs ! n) x}) {0..<length xs}\"\n\nlemma disjointpD:\n  \"\\<lbrakk> disjointp xs; (xs ! n) x; (xs ! m) x; n < length xs; m < length xs \\<rbrakk> \\<Longrightarrow> n = m\"\nby(auto 4 3 simp add: disjointp_def disjoint_family_on_def)\n\nlemma disjointpD':\n  \"\\<lbrakk> disjointp xs; P x; Q x; xs ! n = P; xs ! m = Q; n < length xs; m < length xs \\<rbrakk> \\<Longrightarrow> n = m\"\nby(auto 4 3 simp add: disjointp_def disjoint_family_on_def)\n\nsubsubsection \\<open>List of a given length\\<close>\n\ninductive_set nlists :: \"'a set \\<Rightarrow> nat \\<Rightarrow> 'a list set\" for A n\nwhere nlists: \"\\<lbrakk> set xs \\<subseteq> A; length xs = n \\<rbrakk> \\<Longrightarrow> xs \\<in> nlists A n\"\nhide_fact (open) nlists\n\nlemma nlists_alt_def: \"nlists A n = {xs. set xs \\<subseteq> A \\<and> length xs = n}\"\nby(auto simp add: nlists.simps)\n\nlemma nlists_empty: \"nlists {} n = (if n = 0 then {[]} else {})\"\nby(auto simp add: nlists_alt_def)\n\nlemma nlists_empty_gt0 [simp]: \"n > 0 \\<Longrightarrow> nlists {} n = {}\"\nby(simp add: nlists_empty)\n\nlemma nlists_0 [simp]: \"nlists A 0 = {[]}\"\nby(auto simp add: nlists_alt_def)\n\n\n\nlemma Nil_in_nlists [simp]: \"[] \\<in> nlists A n \\<longleftrightarrow> n = 0\"\nby(auto simp add: nlists_alt_def)\n\nlemma Cons_in_nlists_iff: \"x # xs \\<in> nlists A n \\<longleftrightarrow> (\\<exists>n'. n = Suc n' \\<and> x \\<in> A \\<and> xs \\<in> nlists A n')\"\nby(cases n) simp_all\n\nlemma in_nlists_Suc_iff: \"xs \\<in> nlists A (Suc n) \\<longleftrightarrow> (\\<exists>x xs'. xs = x # xs' \\<and> x \\<in> A \\<and> xs' \\<in> nlists A n)\"\nby(cases xs) simp_all\n\nlemma nlists_Suc: \"nlists A (Suc n) = (\\<Union>x\\<in>A. (#) x ` nlists A n)\"\nby(auto 4 3 simp add: in_nlists_Suc_iff intro: rev_image_eqI)\n\nlemma replicate_in_nlists [simp, intro]: \"x \\<in> A \\<Longrightarrow> replicate n x \\<in> nlists A n\"\nby(simp add: nlists_alt_def set_replicate_conv_if)\n\nlemma nlists_eq_empty_iff [simp]: \"nlists A n = {} \\<longleftrightarrow> n > 0 \\<and> A = {}\"\nusing replicate_in_nlists by(cases n)(auto)\n\nlemma finite_nlists [simp]: \"finite A \\<Longrightarrow> finite (nlists A n)\"\nby(induction n)(simp_all add: nlists_Suc)\n\nlemma finite_nlistsD: \n  assumes \"finite (nlists A n)\"\n  shows \"finite A \\<or> n = 0\"\nproof(rule disjCI)\n  assume \"n \\<noteq> 0\"\n  then obtain n' where n: \"n = Suc n'\" by(cases n)auto\n  then have \"A = hd ` nlists A n\" by(auto 4 4 simp add: nlists_Suc intro: rev_image_eqI rev_bexI)\n  also have \"finite \\<dots>\" using assms ..\n  finally show \"finite A\" .\nqed\n\nlemma finite_nlists_iff: \"finite (nlists A n) \\<longleftrightarrow> finite A \\<or> n = 0\"\nby(auto dest: finite_nlistsD)\n\nlemma card_nlists: \"card (nlists A n) = card A ^ n\"\nproof(induction n)\n  case (Suc n)\n  have \"card (\\<Union>x\\<in>A. (#) x ` nlists A n) = card A * card (nlists A n)\"\n  proof(cases \"finite A\")\n    case True\n    then show ?thesis by(subst card_UN_disjoint)(auto simp add: card_image inj_on_def)\n  next\n    case False\n    hence \"\\<not> finite (\\<Union>x\\<in>A. (#) x ` nlists A n)\"\n      unfolding nlists_Suc[symmetric] by(auto dest: finite_nlistsD)\n    then show ?thesis using False by simp\n  qed\n  then show ?case using Suc.IH by(simp add: nlists_Suc)\nqed simp\n\nlemma in_nlists_UNIV: \"xs \\<in> nlists UNIV n \\<longleftrightarrow> length xs = n\"\nby(simp add: nlists_alt_def)\n\nsubsubsection \\<open> The type of lists of a given length \\<close>\n\ntypedef (overloaded) ('a, 'b :: len0) nlist = \"nlists (UNIV :: 'a set) (LENGTH('b))\"\nproof\n  show \"replicate LENGTH('b) undefined \\<in> ?nlist\" by simp\nqed\n\nsetup_lifting type_definition_nlist\n\nsubsection \\<open>Streams and infinite lists\\<close>\n\nprimrec sprefix :: \"'a list \\<Rightarrow> 'a stream \\<Rightarrow> bool\" where\n  sprefix_Nil: \"sprefix [] ys = True\"\n| sprefix_Cons: \"sprefix (x # xs) ys \\<longleftrightarrow> x = shd ys \\<and> sprefix xs (stl ys)\"\n\nlemma sprefix_append: \"sprefix (xs @ ys) zs \\<longleftrightarrow> sprefix xs zs \\<and> sprefix ys (sdrop (length xs) zs)\"\nby(induct xs arbitrary: zs) simp_all\n\nlemma sprefix_stake_same [simp]: \"sprefix (stake n xs) xs\"\nby(induct n arbitrary: xs) simp_all\n\nlemma sprefix_same_imp_eq:\n  assumes \"sprefix xs ys\" \"sprefix xs' ys\"\n  and \"length xs = length xs'\"\n  shows \"xs = xs'\"\nusing assms(3,1,2) by(induct arbitrary: ys rule: list_induct2) auto\n\nlemma sprefix_shift_same [simp]:\n  \"sprefix xs (xs @- ys)\"\nby(induct xs) simp_all\n\nlemma sprefix_shift [simp]:\n  \"length xs \\<le> length ys \\<Longrightarrow> sprefix xs (ys @- zs) \\<longleftrightarrow> prefix xs ys\"\nby(induct xs arbitrary: ys)(simp, case_tac ys, auto)\n\nlemma prefixeq_stake2 [simp]: \"prefix xs (stake n ys) \\<longleftrightarrow> length xs \\<le> n \\<and> sprefix xs ys\"\nproof(induct xs arbitrary: n ys)\n  case (Cons x xs)\n  thus ?case by(cases ys n rule: stream.exhaust[case_product nat.exhaust]) auto\nqed simp\n\nlemma tlength_eq_infinity_iff: \"tlength xs = \\<infinity> \\<longleftrightarrow> \\<not> tfinite xs\"\nincluding tllist.lifting by transfer(simp add: llength_eq_infty_conv_lfinite)\n\nsubsection \\<open>Monomorphic monads\\<close>\n\ncontext includes lifting_syntax begin\nlocal_setup \\<open>Local_Theory.map_background_naming (Name_Space.mandatory_path \"monad\")\\<close>\n\ndefinition bind_option :: \"'m fail \\<Rightarrow> 'a option \\<Rightarrow> ('a \\<Rightarrow> 'm) \\<Rightarrow> 'm\"\nwhere \"bind_option fail x f = (case x of None \\<Rightarrow> fail | Some x' \\<Rightarrow> f x')\" for fail\n\nsimps_of_case bind_option_simps [simp]: bind_option_def\n\nlemma bind_option_parametric [transfer_rule]:\n  \"(M ===> rel_option B ===> (B ===> M) ===> M) bind_option bind_option\"\nunfolding bind_option_def by transfer_prover\n\nlemma bind_option_K:\n  \"\\<And>monad. (x = None \\<Longrightarrow> m = fail) \\<Longrightarrow> bind_option fail x (\\<lambda>_. m) = m\"\nby(cases x) simp_all\n\nend\n\nlemma bind_option_option [simp]: \"monad.bind_option None = Option.bind\"\nby(simp add: monad.bind_option_def fun_eq_iff split: option.split)\n\ncontext monad_fail_hom begin\n\nlemma hom_bind_option: \"h (monad.bind_option fail1 x f) = monad.bind_option fail2 x (h \\<circ> f)\"\nby(cases x)(simp_all)\n\nend\n\nlemma bind_option_set [simp]: \"monad.bind_option fail_set = (\\<lambda>x f. \\<Union> (f ` set_option x))\"\nby(simp add: monad.bind_option_def fun_eq_iff split: option.split)\n\nlemma run_bind_option_stateT [simp]:\n  \"\\<And>more. run_state (monad.bind_option (fail_state fail) x f) s = \n  monad.bind_option fail x (\\<lambda>y. run_state (f y) s)\"\nby(cases x) simp_all\n\nlemma run_bind_option_envT [simp]:\n  \"\\<And>more. run_env (monad.bind_option (fail_env fail) x f) s = \n  monad.bind_option fail x (\\<lambda>y. run_env (f y) s)\"\nby(cases x) simp_all\n\n\nsubsection \\<open>Measures\\<close>\n\ndeclare sets_restrict_space_count_space [measurable_cong]\n\nlemma (in sigma_algebra) sets_Collect_countable_Ex1:\n  \"(\\<And>i :: 'i :: countable. {x \\<in> \\<Omega>. P i x} \\<in> M) \\<Longrightarrow> {x \\<in> \\<Omega>. \\<exists>!i. P i x} \\<in> M\"\nusing sets_Collect_countable_Ex1'[of \"UNIV :: 'i set\"] by simp\n\nlemma pred_countable_Ex1 [measurable]:\n  \"(\\<And>i :: _ :: countable. Measurable.pred M (\\<lambda>x. P i x))\n  \\<Longrightarrow> Measurable.pred M (\\<lambda>x. \\<exists>!i. P i x)\"\nunfolding pred_def by(rule sets.sets_Collect_countable_Ex1)\n\nlemma measurable_snd_count_space [measurable]: \n  \"A \\<subseteq> B \\<Longrightarrow> snd \\<in> measurable (M1 \\<Otimes>\\<^sub>M count_space A) (count_space B)\"\nby(auto simp add: measurable_def space_pair_measure snd_vimage_eq_Times Times_Int_Times)\n\nsubsection \\<open>Sequence space\\<close>\n\nlemma (in sequence_space) nn_integral_split:\n  assumes f[measurable]: \"f \\<in> borel_measurable S\"\n  shows \"(\\<integral>\\<^sup>+\\<omega>. f \\<omega> \\<partial>S) = (\\<integral>\\<^sup>+\\<omega>. (\\<integral>\\<^sup>+\\<omega>'. f (comb_seq i \\<omega> \\<omega>') \\<partial>S) \\<partial>S)\"\nby (subst PiM_comb_seq[symmetric, where i=i])\n   (simp add: nn_integral_distr P.nn_integral_fst[symmetric])\n\nlemma (in sequence_space) prob_Collect_split:\n  assumes f[measurable]: \"{x\\<in>space S. P x} \\<in> sets S\"\n  shows \"\\<P>(x in S. P x) = (\\<integral>\\<^sup>+x. \\<P>(x' in S. P (comb_seq i x x')) \\<partial>S)\"\nproof -\n  have \"\\<P>(x in S. P x) = (\\<integral>\\<^sup>+x. (\\<integral>\\<^sup>+x'. indicator {x\\<in>space S. P x} (comb_seq i x x') \\<partial>S) \\<partial>S)\"\n    using nn_integral_split[of \"indicator {x\\<in>space S. P x}\"] by (auto simp: emeasure_eq_measure)\n  also have \"\\<dots> = (\\<integral>\\<^sup>+x. \\<P>(x' in S. P (comb_seq i x x')) \\<partial>S)\"\n    by (intro nn_integral_cong) (auto simp: emeasure_eq_measure nn_integral_indicator_map)\n  finally show ?thesis .\nqed\n\nsubsection \\<open>Probability mass functions\\<close>\n\nlemma measure_map_pmf_conv_distr:\n  \"measure_pmf (map_pmf f p) = distr (measure_pmf p) (count_space UNIV) f\"\nby(fact map_pmf_rep_eq)\n\nabbreviation coin_pmf :: \"bool pmf\" where \"coin_pmf \\<equiv> pmf_of_set UNIV\"\n\ntext \\<open>The rule @{thm [source] rel_pmf_bindI} is not complete as a program logic.\\<close>\nnotepad begin\n  define x where \"x = pmf_of_set {True, False}\"\n  define y where \"y = pmf_of_set {True, False}\"\n  define f where \"f x = pmf_of_set {True, False}\" for x :: bool\n  define g :: \"bool \\<Rightarrow> bool pmf\" where \"g = return_pmf\"\n  define P :: \"bool \\<Rightarrow> bool \\<Rightarrow> bool\" where \"P = (=)\"\n  have \"rel_pmf P (bind_pmf x f) (bind_pmf y g)\"\n    by(simp add: P_def f_def[abs_def] g_def y_def bind_return_pmf' pmf.rel_eq)\n  have \"\\<not> R x y\" if \"\\<And>x y. R x y \\<Longrightarrow> rel_pmf P (f x) (g y)\" for R x y\n    \\<comment> \\<open>Only the empty relation satisfies @{thm [source] rel_pmf_bindI}'s second premise.\\<close>\n  proof\n    assume \"R x y\"\n    hence \"rel_pmf P (f x) (g y)\" by(rule that)\n    thus False by(auto simp add: P_def f_def g_def rel_pmf_return_pmf2)\n  qed\n  define R where \"R x y = False\" for x y :: bool\n  have \"\\<not> rel_pmf R x y\" by(simp add: R_def[abs_def])\nend\n\nlemma pred_rel_pmf:\n  \"\\<lbrakk> pred_pmf P p; rel_pmf R p q \\<rbrakk> \\<Longrightarrow> pred_pmf (Imagep R P) q\"\nunfolding pred_pmf_def\napply(rule ballI)\napply(unfold rel_pmf.simps)\napply(erule exE conjE)+\napply hypsubst\napply(unfold pmf.set_map)\napply(erule imageE, hypsubst)\napply(drule bspec)\n apply(erule rev_image_eqI)\n apply(rule refl)\napply(erule Imagep.intros)\napply(erule allE)+\n apply(erule mp)\napply(unfold prod.collapse)\napply assumption\ndone\n\nlemma pmf_rel_mono': \"\\<lbrakk> rel_pmf P x y; P \\<le> Q \\<rbrakk> \\<Longrightarrow> rel_pmf Q x y\"\nby(drule pmf.rel_mono) (auto)\n\nlemma rel_pmf_eqI [simp]: \"rel_pmf (=) x x\"\nby(simp add: pmf.rel_eq)\n\nlemma rel_pmf_bind_reflI:\n  \"(\\<And>x. x \\<in> set_pmf p \\<Longrightarrow> rel_pmf R (f x) (g x))\n  \\<Longrightarrow> rel_pmf R (bind_pmf p f) (bind_pmf p g)\"\nby(rule rel_pmf_bindI[where R=\"\\<lambda>x y. x = y \\<and> x \\<in> set_pmf p\"])(auto intro: rel_pmf_reflI)\n\nlemma pmf_pred_mono_strong:\n  \"\\<lbrakk> pred_pmf P p; \\<And>a. \\<lbrakk> a \\<in> set_pmf p; P a \\<rbrakk> \\<Longrightarrow> P' a \\<rbrakk> \\<Longrightarrow> pred_pmf P' p\"\nby(simp add: pred_pmf_def)\n\nlemma rel_pmf_restrict_relpI [intro?]:\n  \"\\<lbrakk> rel_pmf R x y; pred_pmf P x; pred_pmf Q y \\<rbrakk> \\<Longrightarrow> rel_pmf (R \\<upharpoonleft> P \\<otimes> Q) x y\"\nby(erule pmf.rel_mono_strong)(simp add: pred_pmf_def)\n\nlemma rel_pmf_restrict_relpE [elim?]:\n  assumes \"rel_pmf (R \\<upharpoonleft> P \\<otimes> Q) x y\"\n  obtains \"rel_pmf R x y\" \"pred_pmf P x\" \"pred_pmf Q y\"\nproof\n  show \"rel_pmf R x y\" using assms by(auto elim!: pmf.rel_mono_strong)\n  have \"pred_pmf (Domainp (R \\<upharpoonleft> P \\<otimes> Q)) x\" using assms by(fold pmf.Domainp_rel) blast\n  then show \"pred_pmf P x\" by(rule pmf_pred_mono_strong)(blast dest!: restrict_relp_DomainpD)\n  have \"pred_pmf (Domainp (R \\<upharpoonleft> P \\<otimes> Q)\\<inverse>\\<inverse>) y\" using assms\n    by(fold pmf.Domainp_rel)(auto simp only: pmf.rel_conversep Domainp_conversep)\n  then show \"pred_pmf Q y\" by(rule pmf_pred_mono_strong)(auto dest!: restrict_relp_DomainpD)\nqed\n\nlemma rel_pmf_restrict_relp_iff:\n  \"rel_pmf (R \\<upharpoonleft> P \\<otimes> Q) x y \\<longleftrightarrow> rel_pmf R x y \\<and> pred_pmf P x \\<and> pred_pmf Q y\"\nby(blast intro: rel_pmf_restrict_relpI elim: rel_pmf_restrict_relpE)\n\nlemma rel_pmf_OO_trans [trans]:\n  \"\\<lbrakk> rel_pmf R p q; rel_pmf S q r \\<rbrakk> \\<Longrightarrow> rel_pmf (R OO S) p r\"\nunfolding pmf.rel_compp by blast\n\nlemma pmf_pred_map [simp]: \"pred_pmf P (map_pmf f p) = pred_pmf (P \\<circ> f) p\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_bind [simp]: \"pred_pmf P (bind_pmf p f) = pred_pmf (pred_pmf P \\<circ> f) p\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_return [simp]: \"pred_pmf P (return_pmf x) = P x\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_of_set [simp]: \"\\<lbrakk> finite A; A \\<noteq> {} \\<rbrakk> \\<Longrightarrow> pred_pmf P (pmf_of_set A) = Ball A P\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_of_multiset [simp]: \"M \\<noteq> {#} \\<Longrightarrow> pred_pmf P (pmf_of_multiset M) = Ball (set_mset M) P\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_cond [simp]:\n  \"set_pmf p \\<inter> A \\<noteq> {} \\<Longrightarrow> pred_pmf P (cond_pmf p A) = pred_pmf (\\<lambda>x. x \\<in> A \\<longrightarrow> P x) p\"\nby(auto simp add: pred_pmf_def)\n\nlemma pred_pmf_pair [simp]:\n  \"pred_pmf P (pair_pmf p q) = pred_pmf (\\<lambda>x. pred_pmf (P \\<circ> Pair x) q) p\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_join [simp]: \"pred_pmf P (join_pmf p) = pred_pmf (pred_pmf P) p\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_bernoulli [simp]: \"\\<lbrakk> 0 < p; p < 1 \\<rbrakk> \\<Longrightarrow> pred_pmf P (bernoulli_pmf p) = All P\"\nby(simp add: pred_pmf_def)\n\nlemma pred_pmf_geometric [simp]: \"\\<lbrakk> 0 < p; p < 1 \\<rbrakk> \\<Longrightarrow> pred_pmf P (geometric_pmf p) = All P\"\nby(simp add: pred_pmf_def set_pmf_geometric)\n\nlemma pred_pmf_poisson [simp]: \"0 < rate \\<Longrightarrow> pred_pmf P (poisson_pmf rate) = All P\"\nby(simp add: pred_pmf_def)\n\nlemma pmf_rel_map_restrict_relp: \n  shows pmf_rel_map_restrict_relp1: \"rel_pmf (R \\<upharpoonleft> P \\<otimes> Q) (map_pmf f p) = rel_pmf (R \\<circ> f \\<upharpoonleft> P \\<circ> f \\<otimes> Q) p\"\n  and pmf_rel_map_restrict_relp2: \"rel_pmf (R \\<upharpoonleft> P \\<otimes> Q) p (map_pmf g q) = rel_pmf ((\\<lambda>x. R x \\<circ> g) \\<upharpoonleft> P \\<otimes> Q \\<circ> g) p q\"\nby(simp_all add: pmf.rel_map restrict_relp_def fun_eq_iff)\n\nlemma pred_pmf_conj [simp]: \"pred_pmf (\\<lambda>x. P x \\<and> Q x) = (\\<lambda>x. pred_pmf P x \\<and> pred_pmf Q x)\"\nby(auto simp add: pred_pmf_def)\n\nlemma pred_pmf_top [simp]:\n  \"pred_pmf (\\<lambda>_. True) = (\\<lambda>_. True)\"\nby(simp add: pred_pmf_def)\n\nlemma rel_pmf_of_setI:\n  assumes A: \"A \\<noteq> {}\" \"finite A\"\n  and B: \"B \\<noteq> {}\" \"finite B\"\n  and card: \"\\<And>X. X \\<subseteq> A \\<Longrightarrow> card B * card X \\<le> card A * card {y\\<in>B. \\<exists>x\\<in>X. R x y}\"\n  shows \"rel_pmf R (pmf_of_set A) (pmf_of_set B)\"\napply(rule rel_pmf_measureI)\nusing assms\napply(clarsimp simp add: measure_pmf_of_set card_gt_0_iff field_simps of_nat_mult[symmetric] simp del: of_nat_mult)\napply(subst mult.commute)\napply(erule meta_allE)\napply(erule meta_impE)\n prefer 2\n apply(erule order_trans)\napply(auto simp add: card_gt_0_iff intro: card_mono)\ndone\n\nsubsection \\<open>Subprobability mass functions\\<close>\n\nlemma ord_spmf_return_spmf1: \"ord_spmf R (return_spmf x) p \\<longleftrightarrow> lossless_spmf p \\<and> (\\<forall>y\\<in>set_spmf p. R x y)\"\nby(auto simp add: rel_pmf_return_pmf1 ord_option.simps in_set_spmf lossless_iff_set_pmf_None Ball_def) (metis option.exhaust)\n\nlemma ord_spmf_conv:\n  \"ord_spmf R = rel_spmf R OO ord_spmf (=)\"\napply(subst pmf.rel_compp[symmetric])\napply(rule arg_cong[where f=\"rel_pmf\"])  \napply(rule ext)+\napply(auto elim!: ord_option.cases option.rel_cases intro: option.rel_intros)\ndone\n\nlemma ord_spmf_expand:\n  \"NO_MATCH (=) R \\<Longrightarrow> ord_spmf R = rel_spmf R OO ord_spmf (=)\"\nby(rule ord_spmf_conv)\n\nlemma ord_spmf_eqD_measure: \"ord_spmf (=) p q \\<Longrightarrow> measure (measure_spmf p) A \\<le> measure (measure_spmf q) A\"\nby(drule ord_spmf_eqD_measure_spmf)(simp add: le_measure measure_spmf.emeasure_eq_measure)\n\nlemma ord_spmf_measureD:\n  assumes \"ord_spmf R p q\"\n  shows \"measure (measure_spmf p) A \\<le> measure (measure_spmf q) {y. \\<exists>x\\<in>A. R x y}\"\n    (is \"?lhs \\<le> ?rhs\")\nproof -\n  from assms obtain p' where *: \"rel_spmf R p p'\" and **: \"ord_spmf (=) p' q\"\n    by(auto simp add: ord_spmf_expand)\n  have \"?lhs \\<le> measure (measure_spmf p') {y. \\<exists>x\\<in>A. R x y}\" using * by(rule rel_spmf_measureD)\n  also have \"\\<dots> \\<le> ?rhs\" using ** by(rule ord_spmf_eqD_measure)\n  finally show ?thesis .\nqed\n\nlemma ord_spmf_bind_pmfI1:\n  \"(\\<And>x. x \\<in> set_pmf p \\<Longrightarrow> ord_spmf R (f x) q) \\<Longrightarrow> ord_spmf R (bind_pmf p f) q\"\n  apply(rewrite at \"ord_spmf _ _ \\<hole>\" bind_return_pmf[symmetric, where f=\"\\<lambda>_ :: unit. q\"])\n  apply(rule rel_pmf_bindI[where R=\"\\<lambda>x y. x \\<in> set_pmf p\"])\n  apply(simp_all add: rel_pmf_return_pmf2)\n  done\n  \nlemma ord_spmf_bind_spmfI1:\n  \"(\\<And>x. x \\<in> set_spmf p \\<Longrightarrow> ord_spmf R (f x) q) \\<Longrightarrow> ord_spmf R (bind_spmf p f) q\"\nunfolding bind_spmf_def by(rule ord_spmf_bind_pmfI1)(auto split: option.split simp add: in_set_spmf)\n\nlemma spmf_of_set_empty: \"spmf_of_set {} = return_pmf None\"\nby(simp add: spmf_of_set_def)\n\nlemma rel_spmf_of_setI:\n  assumes card: \"\\<And>X. X \\<subseteq> A \\<Longrightarrow> card B * card X \\<le> card A * card {y\\<in>B. \\<exists>x\\<in>X. R x y}\"\n  and eq: \"(finite A \\<and> A \\<noteq> {}) \\<longleftrightarrow> (finite B \\<and> B \\<noteq> {})\"\n  shows \"rel_spmf R (spmf_of_set A) (spmf_of_set B)\"\nusing eq by(clarsimp simp add: spmf_of_set_def card rel_pmf_of_setI simp del: spmf_of_pmf_pmf_of_set cong: conj_cong)\n\nlemmas map_bind_spmf = map_spmf_bind_spmf\n\nlemma nn_integral_measure_spmf_conv_measure_pmf:\n  assumes [measurable]: \"f \\<in> borel_measurable (count_space UNIV)\"\n  shows \"nn_integral (measure_spmf p) f = nn_integral (restrict_space (measure_pmf p) (range Some)) (f \\<circ> the)\"\nby(simp add: measure_spmf_def nn_integral_distr o_def)\n\nlemma nn_integral_spmf_neq_infinity: \"(\\<integral>\\<^sup>+ x. spmf p x \\<partial>count_space UNIV) \\<noteq> \\<infinity>\"\nusing nn_integral_measure_spmf[where f=\"\\<lambda>_. 1\", of p, symmetric] by simp\n\nlemma return_pmf_bind_option:\n  \"return_pmf (Option.bind x f) = bind_spmf (return_pmf x) (return_pmf \\<circ> f)\"\nby(cases x) simp_all\n\nlemma rel_spmf_pos_distr: \"rel_spmf A OO rel_spmf B \\<le> rel_spmf (A OO B)\"\nunfolding option.rel_compp pmf.rel_compp ..\n\nlemma rel_spmf_OO_trans [trans]:\n  \"\\<lbrakk> rel_spmf R p q; rel_spmf S q r \\<rbrakk> \\<Longrightarrow> rel_spmf (R OO S) p r\"\nby(rule rel_spmf_pos_distr[THEN predicate2D]) auto\n\nlemma map_spmf_eq_map_spmf_iff: \"map_spmf f p = map_spmf g q \\<longleftrightarrow> rel_spmf (\\<lambda>x y. f x = g y) p q\"\nby(simp add: spmf_rel_eq[symmetric] spmf_rel_map)\n\nlemma map_spmf_eq_map_spmfI: \"rel_spmf (\\<lambda>x y. f x = g y) p q \\<Longrightarrow> map_spmf f p = map_spmf g q\"\nby(simp add: map_spmf_eq_map_spmf_iff)\n\nlemma spmf_rel_mono_strong:\n  \"\\<lbrakk>rel_spmf A f g; \\<And>x y. \\<lbrakk> x \\<in> set_spmf f; y \\<in> set_spmf g; A x y \\<rbrakk> \\<Longrightarrow> B x y \\<rbrakk> \\<Longrightarrow> rel_spmf B f g\"\napply(erule pmf.rel_mono_strong)\napply(erule option.rel_mono_strong)\nby(clarsimp simp add: in_set_spmf)\n\nlemma set_spmf_eq_empty: \"set_spmf p = {} \\<longleftrightarrow> p = return_pmf None\"\nby auto (metis restrict_spmf_empty restrict_spmf_trivial)\n\n\nlemma measure_pair_spmf_times:\n  \"measure (measure_spmf (pair_spmf p q)) (A \\<times> B) = measure (measure_spmf p) A * measure (measure_spmf q) B\"\nproof -\n  have \"emeasure (measure_spmf (pair_spmf p q)) (A \\<times> B) = (\\<integral>\\<^sup>+ x. ennreal (spmf (pair_spmf p q) x) * indicator (A \\<times> B) x \\<partial>count_space UNIV)\"\n    by(simp add: nn_integral_spmf[symmetric] nn_integral_count_space_indicator)\n  also have \"\\<dots> = (\\<integral>\\<^sup>+ x. (\\<integral>\\<^sup>+ y. (ennreal (spmf p x) * indicator A x) * (ennreal (spmf q y) * indicator B y) \\<partial>count_space UNIV) \\<partial>count_space UNIV)\"\n    by(subst nn_integral_fst_count_space[symmetric])(auto intro!: nn_integral_cong split: split_indicator simp add: ennreal_mult)\n  also have \"\\<dots> = (\\<integral>\\<^sup>+ x. ennreal (spmf p x) * indicator A x * emeasure (measure_spmf q) B \\<partial>count_space UNIV)\"\n    by(simp add: nn_integral_cmult nn_integral_spmf[symmetric] nn_integral_count_space_indicator)\n  also have \"\\<dots> = emeasure (measure_spmf p) A * emeasure (measure_spmf q) B\"\n    by(simp add: nn_integral_multc)(simp add: nn_integral_spmf[symmetric] nn_integral_count_space_indicator)\n  finally show ?thesis by(simp add: measure_spmf.emeasure_eq_measure ennreal_mult[symmetric])\nqed\n\nlemma lossless_spmfD_set_spmf_nonempty: \"lossless_spmf p \\<Longrightarrow> set_spmf p \\<noteq> {}\"\nusing set_pmf_not_empty[of p] by(auto simp add: set_spmf_def bind_UNION lossless_iff_set_pmf_None)\n\nlemma set_spmf_return_pmf: \"set_spmf (return_pmf x) = set_option x\"\nby(cases x) simp_all\n\nlemma bind_spmf_pmf_assoc: \"bind_spmf (bind_pmf p f) g = bind_pmf p (\\<lambda>x. bind_spmf (f x) g)\"\nby(simp add: bind_spmf_def bind_assoc_pmf)\n\nlemma bind_spmf_of_set:  \"\\<lbrakk> finite A; A \\<noteq> {} \\<rbrakk> \\<Longrightarrow> bind_spmf (spmf_of_set A) f = bind_pmf (pmf_of_set A) f\"\nby(simp add: spmf_of_set_def del: spmf_of_pmf_pmf_of_set)\n\nlemma bind_spmf_map_pmf:\n  \"bind_spmf (map_pmf f p) g = bind_pmf p (\\<lambda>x. bind_spmf (return_pmf (f x)) g)\"\nby(simp add: map_pmf_def bind_spmf_def bind_assoc_pmf)\n\nlemma rel_spmf_eqI [simp]: \"rel_spmf (=) x x\"\nby(simp add: option.rel_eq)\n\nlemma set_spmf_map_pmf: \"set_spmf (map_pmf f p) = (\\<Union>x\\<in>set_pmf p. set_option (f x))\" (* Move up *)\nby(simp add: set_spmf_def bind_UNION)\n\nlemma ord_spmf_return_spmf [simp]: \"ord_spmf (=) (return_spmf x) p \\<longleftrightarrow> p = return_spmf x\"\nproof -\n  have \"p = return_spmf x \\<Longrightarrow> ord_spmf (=) (return_spmf x) p\" by simp\n  thus ?thesis\n    by (metis (no_types) ord_option_eq_simps(2) rel_pmf_return_pmf1 rel_pmf_return_pmf2 spmf.leq_antisym)\nqed\n\ndeclare\n  set_bind_spmf [simp]\n  set_spmf_return_pmf [simp]\n\nlemma bind_spmf_pmf_commute:\n  \"bind_spmf p (\\<lambda>x. bind_pmf q (f x)) = bind_pmf q (\\<lambda>y. bind_spmf p (\\<lambda>x. f x y))\"\nunfolding bind_spmf_def \nby(subst bind_commute_pmf)(auto intro: bind_pmf_cong[OF refl] split: option.split)\n\nlemma return_pmf_map_option_conv_bind:\n  \"return_pmf (map_option f x) = bind_spmf (return_pmf x) (return_spmf \\<circ> f)\"\nby(cases x) simp_all\n\nlemma lossless_return_pmf_iff [simp]: \"lossless_spmf (return_pmf x) \\<longleftrightarrow> x \\<noteq> None\"\nby(cases x) simp_all\n\nlemma lossless_map_pmf: \"lossless_spmf (map_pmf f p) \\<longleftrightarrow> (\\<forall>x \\<in> set_pmf p. f x \\<noteq> None)\"\nusing image_iff by(fastforce simp add: lossless_iff_set_pmf_None)\n\nlemma bind_pmf_spmf_assoc:\n  \"g None = return_pmf None\n  \\<Longrightarrow> bind_pmf (bind_spmf p f) g = bind_spmf p (\\<lambda>x. bind_pmf (f x) g)\"\nby(auto simp add: bind_spmf_def bind_assoc_pmf bind_return_pmf fun_eq_iff intro!: arg_cong2[where f=bind_pmf] split: option.split)\n\nabbreviation pred_spmf :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a spmf \\<Rightarrow> bool\"\nwhere \"pred_spmf P \\<equiv> pred_pmf (pred_option P)\"\n\nlemma pred_spmf_def: \"pred_spmf P p \\<longleftrightarrow> (\\<forall>x\\<in>set_spmf p. P x)\"\nby(auto simp add: pred_pmf_def pred_option_def set_spmf_def)\n\nlemma spmf_pred_mono_strong:\n  \"\\<lbrakk> pred_spmf P p; \\<And>a. \\<lbrakk> a \\<in> set_spmf p; P a \\<rbrakk> \\<Longrightarrow> P' a \\<rbrakk> \\<Longrightarrow> pred_spmf P' p\"\nby(simp add: pred_spmf_def)\n\nlemma spmf_Domainp_rel: \"Domainp (rel_spmf R) = pred_spmf (Domainp R)\"\nby(simp add: pmf.Domainp_rel option.Domainp_rel)\n\nlemma rel_spmf_restrict_relpI [intro?]:\n  \"\\<lbrakk> rel_spmf R p q; pred_spmf P p; pred_spmf Q q \\<rbrakk> \\<Longrightarrow> rel_spmf (R \\<upharpoonleft> P \\<otimes> Q) p q\"\nby(erule spmf_rel_mono_strong)(simp add: pred_spmf_def)\n\nlemma rel_spmf_restrict_relpE [elim?]:\n  assumes \"rel_spmf (R \\<upharpoonleft> P \\<otimes> Q) x y\"\n  obtains \"rel_spmf R x y\" \"pred_spmf P x\" \"pred_spmf Q y\"\nproof\n  show \"rel_spmf R x y\" using assms by(auto elim!: spmf_rel_mono_strong)\n  have \"pred_spmf (Domainp (R \\<upharpoonleft> P \\<otimes> Q)) x\" using assms by(fold spmf_Domainp_rel) blast\n  then show \"pred_spmf P x\" by(rule spmf_pred_mono_strong)(blast dest!: restrict_relp_DomainpD)\n  have \"pred_spmf (Domainp (R \\<upharpoonleft> P \\<otimes> Q)\\<inverse>\\<inverse>) y\" using assms\n    by(fold spmf_Domainp_rel)(auto simp only: spmf_rel_conversep Domainp_conversep)\n  then show \"pred_spmf Q y\" by(rule spmf_pred_mono_strong)(auto dest!: restrict_relp_DomainpD)\nqed\n\nlemma rel_spmf_restrict_relp_iff:\n  \"rel_spmf (R \\<upharpoonleft> P \\<otimes> Q) x y \\<longleftrightarrow> rel_spmf R x y \\<and> pred_spmf P x \\<and> pred_spmf Q y\"\nby(blast intro: rel_spmf_restrict_relpI elim: rel_spmf_restrict_relpE)\n\nlemma spmf_pred_map: \"pred_spmf P (map_spmf f p) = pred_spmf (P \\<circ> f) p\"\nby(simp)\n\nlemma pred_spmf_bind [simp]: \"pred_spmf P (bind_spmf p f) = pred_spmf (pred_spmf P \\<circ> f) p\"\nby(simp add: pred_spmf_def bind_UNION)\n\nlemma pred_spmf_return: \"pred_spmf P (return_spmf x) = P x\"\nby simp\n\nlemma pred_spmf_return_pmf_None: \"pred_spmf P (return_pmf None)\"\nby simp\n\nlemma pred_spmf_spmf_of_pmf [simp]: \"pred_spmf P (spmf_of_pmf p) = pred_pmf P p\"\nunfolding pred_spmf_def by(simp add: pred_pmf_def)\n\nlemma pred_spmf_of_set [simp]: \"pred_spmf P (spmf_of_set A) = (finite A \\<longrightarrow> Ball A P)\"\nby(auto simp add: pred_spmf_def set_spmf_of_set)\n\nlemma pred_spmf_assert_spmf [simp]: \"pred_spmf P (assert_spmf b) = (b \\<longrightarrow> P ())\"\nby(cases b) simp_all\n\nlemma pred_spmf_pair [simp]:\n  \"pred_spmf P (pair_spmf p q) = pred_spmf (\\<lambda>x. pred_spmf (P \\<circ> Pair x) q) p\"\nby(simp add: pred_spmf_def)\n\nlemma set_spmf_try [simp]:\n  \"set_spmf (try_spmf p q) = set_spmf p \\<union> (if lossless_spmf p then {} else set_spmf q)\"\nby(auto simp add: try_spmf_def set_spmf_bind_pmf in_set_spmf lossless_iff_set_pmf_None split: option.splits)(metis option.collapse)\n\nlemma try_spmf_bind_out1:\n  \"(\\<And>x. lossless_spmf (f x)) \\<Longrightarrow> bind_spmf (TRY p ELSE q) f = TRY (bind_spmf p f) ELSE (bind_spmf q f)\"\n  apply(clarsimp simp add: bind_spmf_def try_spmf_def bind_assoc_pmf bind_return_pmf intro!: bind_pmf_cong[OF refl] split: option.split)\n  apply(rewrite in \"\\<hole> = _\" bind_return_pmf'[symmetric])\n  apply(rule bind_pmf_cong[OF refl])\n  apply(clarsimp split: option.split simp add: lossless_iff_set_pmf_None)\n  done\n\nlemma pred_spmf_try [simp]:\n  \"pred_spmf P (try_spmf p q) = (pred_spmf P p \\<and> (\\<not> lossless_spmf p \\<longrightarrow> pred_spmf P q))\"\nby(auto simp add: pred_spmf_def)\n\nlemma pred_spmf_cond [simp]:\n  \"pred_spmf P (cond_spmf p A) = pred_spmf (\\<lambda>x. x \\<in> A \\<longrightarrow> P x) p\"\nby(auto simp add: pred_spmf_def)\n\nlemma spmf_rel_map_restrict_relp: \n  shows spmf_rel_map_restrict_relp1: \"rel_spmf (R \\<upharpoonleft> P \\<otimes> Q) (map_spmf f p) = rel_spmf (R \\<circ> f \\<upharpoonleft> P \\<circ> f \\<otimes> Q) p\"\n  and spmf_rel_map_restrict_relp2: \"rel_spmf (R \\<upharpoonleft> P \\<otimes> Q) p (map_spmf g q) = rel_spmf ((\\<lambda>x. R x \\<circ> g) \\<upharpoonleft> P \\<otimes> Q \\<circ> g) p q\"\nby(simp_all add: spmf_rel_map restrict_relp_def)\n\nlemma pred_spmf_conj: \"pred_spmf (\\<lambda>x. P x \\<and> Q x) = (\\<lambda>x. pred_spmf P x \\<and> pred_spmf Q x)\"\nby simp\n\n\nlemma spmf_of_pmf_parametric [transfer_rule]: \n  includes lifting_syntax shows\n  \"(rel_pmf A ===> rel_spmf A) spmf_of_pmf spmf_of_pmf\"\nunfolding spmf_of_pmf_def[abs_def] by transfer_prover\n\nlemma mono2mono_return_pmf[THEN spmf.mono2mono, simp, cont_intro]: (* Move to SPMF *)\n  shows monotone_return_pmf: \"monotone option_ord (ord_spmf (=)) return_pmf\"\nby(rule monotoneI)(auto simp add: flat_ord_def)\n\nlemma mcont2mcont_return_pmf[THEN spmf.mcont2mcont, simp, cont_intro]:  (* Move to SPMF *)\n  shows mcont_return_pmf: \"mcont (flat_lub None) option_ord lub_spmf (ord_spmf (=)) return_pmf\"\nby(rule mcont_finite_chains[OF _ _ flat_interpretation[THEN ccpo] ccpo_spmf]) simp_all\n\nlemma pred_spmf_top: (* Move up *)\n  \"pred_spmf (\\<lambda>_. True) = (\\<lambda>_. True)\"\nby(simp)\n\nlemma rel_spmf_restrict_relpI' [intro?]:\n  \"\\<lbrakk> rel_spmf (\\<lambda>x y. P x \\<longrightarrow> Q y \\<longrightarrow> R x y) p q; pred_spmf P p; pred_spmf Q q \\<rbrakk> \\<Longrightarrow> rel_spmf (R \\<upharpoonleft> P \\<otimes> Q) p q\"\nby(erule spmf_rel_mono_strong)(simp add: pred_spmf_def)\n\nlemma set_spmf_map_pmf_MATCH [simp]:\n  assumes \"NO_MATCH (map_option g) f\"\n  shows \"set_spmf (map_pmf f p) = (\\<Union>x\\<in>set_pmf p. set_option (f x))\"\nby(rule set_spmf_map_pmf)\n\nlemma rel_spmf_bindI':\n  \"\\<lbrakk> rel_spmf A p q; \\<And>x y. \\<lbrakk> A x y; x \\<in> set_spmf p; y \\<in> set_spmf q \\<rbrakk> \\<Longrightarrow> rel_spmf B (f x) (g y) \\<rbrakk>\n  \\<Longrightarrow> rel_spmf B (p \\<bind> f) (q \\<bind> g)\"\napply(rule rel_spmf_bindI[where R=\"\\<lambda>x y. A x y \\<and> x \\<in> set_spmf p \\<and> y \\<in> set_spmf q\"])\n apply(erule spmf_rel_mono_strong; simp)\napply simp\ndone\n\n\nsubsubsection \\<open>Embedding of @{typ \"'a option\"} into @{typ \"'a spmf\"}\\<close>\n\ntext \\<open>This theoretically follows from the embedding between @{typ \"_ id\"} into @{typ \"_ prob\"} and the isomorphism\n  between @{typ \"(_, _ prob) optionT\"} and @{typ \"_ spmf\"}, but we would only get the monomorphic\n  version via this connection. So we do it directly.\n\\<close>\n\nlemma bind_option_spmf_monad [simp]: \"monad.bind_option (return_pmf None) x = bind_spmf (return_pmf x)\"\nby(cases x)(simp_all add: fun_eq_iff)\n\nlocale option_to_spmf begin\n\ntext \\<open>\n  We have to get the embedding into the lifting package such that we can use the parametrisation of transfer rules.\n\\<close>\n\ndefinition the_pmf :: \"'a pmf \\<Rightarrow> 'a\" where \"the_pmf p = (THE x. p = return_pmf x)\"\n\nlemma the_pmf_return [simp]: \"the_pmf (return_pmf x) = x\"\nby(simp add: the_pmf_def)\n\nlemma type_definition_option_spmf: \"type_definition return_pmf the_pmf {x. \\<exists>y :: 'a option. x = return_pmf y}\"\nby unfold_locales(auto)\n\ncontext begin\nprivate setup_lifting type_definition_option_spmf\nabbreviation cr_spmf_option where \"cr_spmf_option \\<equiv> cr_option\"\nabbreviation pcr_spmf_option where \"pcr_spmf_option \\<equiv> pcr_option\"\nlemmas Quotient_spmf_option = Quotient_option\n  and cr_spmf_option_def = cr_option_def\n  and pcr_spmf_option_bi_unique = option.bi_unique\n  and Domainp_pcr_spmf_option = option.domain\n  and Domainp_pcr_spmf_option_eq = option.domain_eq\n  and Domainp_pcr_spmf_option_par = option.domain_par\n  and Domainp_pcr_spmf_option_left_total = option.domain_par_left_total\n  and pcr_spmf_option_left_unique = option.left_unique\n  and pcr_spmf_option_cr_eq = option.pcr_cr_eq\n  and pcr_spmf_option_return_pmf_transfer = option.rep_transfer\n  and pcr_spmf_option_right_total = option.right_total\n  and pcr_spmf_option_right_unique = option.right_unique\n  and pcr_spmf_option_def = pcr_option_def\nbundle spmf_option_lifting = [[Lifting.lifting_restore_internal \"Misc_CryptHOL.option.lifting\"]]\nend\n\n\ncontext includes lifting_syntax begin\n\nlemma return_option_spmf_transfer [transfer_parametric return_spmf_parametric, transfer_rule]:\n  \"((=) ===> cr_spmf_option) return_spmf Some\"\nby(rule rel_funI)(simp add: cr_spmf_option_def)\n\nlemma map_option_spmf_transfer [transfer_parametric map_spmf_parametric, transfer_rule]:\n  \"(((=) ===> (=)) ===> cr_spmf_option ===> cr_spmf_option) map_spmf map_option\"\nunfolding rel_fun_eq by(auto simp add: rel_fun_def cr_spmf_option_def)\n\nlemma fail_option_spmf_transfer [transfer_parametric return_spmf_None_parametric, transfer_rule]:\n  \"cr_spmf_option (return_pmf None) None\"\nby(simp add: cr_spmf_option_def)\n\nlemma bind_option_spmf_transfer [transfer_parametric bind_spmf_parametric, transfer_rule]:\n  \"(cr_spmf_option ===> ((=) ===> cr_spmf_option) ===> cr_spmf_option) bind_spmf Option.bind\"\napply(clarsimp simp add: rel_fun_def cr_spmf_option_def)\nsubgoal for x f g by(cases x; simp)\ndone\n\nlemma set_option_spmf_transfer [transfer_parametric set_spmf_parametric, transfer_rule]:\n  \"(cr_spmf_option ===> rel_set (=)) set_spmf set_option\"\nby(clarsimp simp add: rel_fun_def cr_spmf_option_def rel_set_eq)\n\nlemma rel_option_spmf_transfer [transfer_parametric rel_spmf_parametric, transfer_rule]:\n  \"(((=) ===> (=) ===> (=)) ===> cr_spmf_option ===> cr_spmf_option ===> (=)) rel_spmf rel_option\"\nunfolding rel_fun_eq by(simp add: rel_fun_def cr_spmf_option_def)\n\nend\n\nend\n\nlocale option_le_spmf begin\n\ntext \\<open>\n  Embedding where only successful computations in the option monad are related to Dirac spmf.\n\\<close>\n\ndefinition cr_option_le_spmf :: \"'a option \\<Rightarrow> 'a spmf \\<Rightarrow> bool\"\nwhere \"cr_option_le_spmf x p \\<longleftrightarrow> ord_spmf (=) (return_pmf x) p\"\n\ncontext includes lifting_syntax begin\n\nlemma return_option_le_spmf_transfer [transfer_rule]:\n  \"((=) ===> cr_option_le_spmf) (\\<lambda>x. x) return_pmf\"\nby(rule rel_funI)(simp add: cr_option_le_spmf_def ord_option_reflI)\n\nlemma map_option_le_spmf_transfer [transfer_rule]:\n  \"(((=) ===> (=)) ===> cr_option_le_spmf ===> cr_option_le_spmf) map_option map_spmf\"\nunfolding rel_fun_eq\napply(clarsimp simp add: rel_fun_def cr_option_le_spmf_def rel_pmf_return_pmf1 ord_option_map1 ord_option_map2)\nsubgoal for f x p y by(cases x; simp add: ord_option_reflI)\ndone\n\nlemma bind_option_le_spmf_transfer [transfer_rule]:\n  \"(cr_option_le_spmf ===> ((=) ===> cr_option_le_spmf) ===> cr_option_le_spmf) Option.bind bind_spmf\"\napply(clarsimp simp add: rel_fun_def cr_option_le_spmf_def)\nsubgoal for x p f g by(cases x; auto 4 3 simp add: rel_pmf_return_pmf1 set_pmf_bind_spmf)\ndone\n\nend\n\nend\n\ninterpretation rel_spmf_characterisation by unfold_locales(rule rel_pmf_measureI)\n\nlemma if_distrib_bind_spmf1 [if_distribs]:\n  \"bind_spmf (if b then x else y) f = (if b then bind_spmf x f else bind_spmf y f)\"\nby simp\n\nlemma if_distrib_bind_spmf2 [if_distribs]:\n  \"bind_spmf x (\\<lambda>y. if b then f y else g y) = (if b then bind_spmf x f else bind_spmf x g)\"\nby simp\n\nlemma rel_spmf_if_distrib [if_distribs]:\n  \"rel_spmf R (if b then x else y) (if b then x' else y') \\<longleftrightarrow>\n  (b \\<longrightarrow> rel_spmf R x x') \\<and> (\\<not> b \\<longrightarrow> rel_spmf R y y')\"\nby(simp)\n\nlemma if_distrib_map_spmf [if_distribs]:\n  \"map_spmf f (if b then p else q) = (if b then map_spmf f p else map_spmf f q)\"\nby simp\n\nlemma if_distrib_restrict_spmf1 [if_distribs]:\n  \"restrict_spmf (if b then p else q) A = (if b then restrict_spmf p A else restrict_spmf q A)\"\nby simp\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CryptHOL/Misc_CryptHOL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.6113819732941511, "lm_q1q2_score": 0.3152407215445012}}
{"text": "theory FlatCutEnv\n  imports PermEnvMisc LiftEnv NormEnv\nbegin\n\n  (* ##### cut-family lemmas *)  \n    \ndefinition cut_use_env where\n  \"cut_use_env r_s = (\\<lambda> x. if r_s x = UsePerm then NoPerm else r_s x)\"\n    \nlemma self_cut_leq_use_env: \"leq_use_env (cut_use_env r_s) r_s\"  \n  apply (simp add: leq_use_env_def)\n  apply (simp add: cut_use_env_def)\n  apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n\nlemma cut_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (cut_use_env r_x) r_s\"      \n  apply (rule_tac r_sb=\"r_x\" in trans_leq_use_env)\n   apply (auto)\n  apply (rule_tac self_cut_leq_use_env)\n  done\n  \nlemma strong_cut_use_env: \"strong_use_env (cut_use_env r_s)\"\n  apply (simp add: strong_use_env_def)\n  apply (simp add: cut_use_env_def)\n  done\n  \nlemma mini_disj_strong_use_env: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_ex); strong_use_env r_ex \\<rbrakk> \\<Longrightarrow> mini_disj_use_env r_x r_ex\"  \n  apply (simp add: leq_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  apply (simp add: strong_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n  apply (case_tac \"r_s x\")\n  apply (auto)\n  done\n  \nlemma diff_cut_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (diff_use_env r_x (cut_use_env r_ex)) (diff_use_env r_s r_ex)\"\n  apply (simp add: leq_use_env_def)\n  apply (simp add: cut_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: neg_use_env_def)\n  apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n    apply (case_tac \"r_x x\")\n      apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n  apply (case_tac \"r_ex x\")\n    apply (auto)\n   apply (case_tac \"r_x x\")\n     apply (auto)\n    apply (case_tac \"r_s x\")\n      apply (auto)\n  apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done      \n \nlemma dist_diff_leq_use_env_cut: \"\\<lbrakk> leq_use_env r_x r_s; leq_use_env (cut_use_env r_exb) r_exa \\<rbrakk> \\<Longrightarrow> leq_use_env (diff_use_env r_x r_exa) (diff_use_env r_s r_exb)\"\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: minus_use_env_def)\n  apply (simp add: neg_use_env_def)\n  apply (simp add: cut_use_env_def)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n   apply (case_tac \"r_exa x\")\n     apply (auto)\n    apply (case_tac \"r_exb x\")\n      apply (auto)\n     apply (case_tac \"r_s x\")\n       apply (auto)\n    apply (case_tac \"r_s x\")\n      apply (auto)\n   apply (case_tac \"r_exb x\")\n     apply (auto)\n    apply (case_tac \"r_s x\")\n      apply (auto)\n   apply (case_tac \"r_s x\")\n     apply (auto)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  apply (case_tac \"r_exa x\")\n    apply (auto)\n   apply (case_tac \"r_exb x\")\n     apply (auto)\n  apply (case_tac \"r_exb x\")\n    apply (auto)\n  done    \n    \nlemma lift_cut_leq_use_env: \"\\<lbrakk> is_own r; leq_use_env r_x (lift_use_env r_s r) \\<rbrakk> \\<Longrightarrow> leq_use_env r_x (cut_use_env (lift_use_env r_s r))\"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: cut_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  apply (simp add: is_own_def)\n  apply (case_tac \"r_s x\")\n    apply (auto)\n  done\n  \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/FlatCutEnv.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.31524072154450117}}
{"text": "(******************************************************************************)\n(* Project: Isabelle/UTP: Unifying Theories of Programming in Isabelle/HOL    *)\n(* File: uname.thy                                                            *)\n(* Authors: Frank Zeyda and Simon Foster (University of York, UK)             *)\n(* Emails: frank.zeyda@gmail.com and simon.foster@york.ac.uk                  *)\n(******************************************************************************)\n(* LAST REVIEWED: 09 Jun 2022 *)\n\nsection \\<open>Variable Names\\<close>\n\ntext \\<open>Note that I decided to remove the feature of multiple dashes.\\<close>\n\ntheory uname\nimports uconsts \"../utils/Strings\"\nbegin\n\ntext \\<open>We are going to use the floor brackets for parsing names.\\<close>\n\nno_notation floor (\"\\<lfloor>_\\<rfloor>\")\n\nsubsection \\<open>Name Type\\<close>\n\ntext \\<open>\n  Names are encoded by records that consist of a name string, a dashing flag,\n  and a string for a subscript. Dashed variables have a @{const True} flag,\n  and undecorated variables have an empty string as a subscript. In principle,\n  names can be made extensible because records are extensible. The framework\n  currently does not take advantage of this. We use @{type String.literal}\n  rather than @{type string} as this gives us freedom in how we instantiate\n  an ordering on strings. (We note that @{type string} is just a synonym for\n  type @{typ \"char list\"} and therefore the ordering on @{type string} is\n  already determined by the orderings defined for lists. This turned out to\n  be an issue when integrating the axiomatic value model with Isabelle/UTP.\n\\<close>\n\ntext \\<open>\\todo{Add support for extensible names throughout the framework}.\\<close>\n\nrecord uname =\n  name_str::\"string_t\"\n  dashed::\"bool\"\n  subscript::\"string_t\"\n\nsubsection \\<open>Constructors\\<close>\n\nabbreviation MkName :: \"string \\<Rightarrow> bool \\<Rightarrow> string \\<Rightarrow> uname\" where\n\"MkName n d s \\<equiv> \\<lparr>name_str = String.implode n, dashed = d, subscript = String.implode s\\<rparr>\"\n\nabbreviation (input) MkPlain :: \"string \\<Rightarrow> uname\" where\n\"MkPlain n \\<equiv> MkName n False ''''\"\n\nsubsection \\<open>Restrictions\\<close>\n\ndefinition UNDASHED_uname :: \"'more uname_ext set\" where\n[vars]: \"UNDASHED_uname = {n. \\<not> dashed n}\"\n\nadhoc_overloading UNDASHED UNDASHED_uname\n\ndefinition DASHED_uname :: \"'more uname_ext set\" where\n[vars]: \"DASHED_uname = {n. dashed n}\"\n\nadhoc_overloading DASHED DASHED_uname\n\nsubsection \\<open>Operators\\<close>\n\ndefinition dash_uname :: \"'more uname_ext \\<Rightarrow> 'more uname_ext\" where\n[vars]: \"dash_uname = (dashed_update (\\<lambda>_. True))\"\n\nadhoc_overloading dash dash_uname\n\ndefinition undash_uname :: \"'more uname_ext \\<Rightarrow> 'more uname_ext\" where\n[vars]: \"undash_uname = (dashed_update (\\<lambda>_. False))\"\n\nadhoc_overloading undash undash_uname\n\nsubsection \\<open>Subscripts\\<close>\n\nsubsubsection \\<open>No Subscript\\<close>\n\ntext \\<open>An empty string indicates the absence of a subscript.\\<close>\n\nsyntax \"_NoSub\" :: \"string\" (\"NoSub\")\n\ntranslations \"NoSub\" \\<rightharpoonup> \"(CONST String.implode) []\"\n\nsubsubsection \\<open>Add Subscript\\<close>\n\ntext \\<open>The definition below ensures that subscripting is an involution.\\<close>\n\ndefinition subscr_change ::\n  \"string \\<Rightarrow> 'more uname_ext \\<Rightarrow> 'more uname_ext\" where\n\"subscr_change s' = (subscript_update\n  (\\<lambda>s. if s = NoSub then String.implode s' else\n       if s = String.implode s' then NoSub else s))\"\n\ndefinition subscr_uname ::\n  \"'more uname_ext \\<Rightarrow> string \\<Rightarrow> 'more uname_ext\" where\n[vars]: \"subscr_uname n s = (subscr_change s n)\"\n\nadhoc_overloading subscr_uname subscr\n\nparagraph \\<open>Theorems\\<close>\n\ninterpretation invol_subscr :\n  invol \"subscr_change s\"\napply (unfold_locales)\napply (unfold subscr_change_def)\napply (rule ext)\napply (clarsimp)\ndone\n\nsubsection \\<open>Parsing and Printing\\<close>\n\nsubsubsection \\<open>Name Syntax\\<close>\n\nsyntax \"_uname\" :: \"id \\<Rightarrow> uname\" (\"\\<lfloor>_\\<rfloor>\")\n\nsubsubsection \\<open>Parser Options\\<close>\n\ntext \\<open>Option @{text disable_uname_pp} disables pretty-printing of names.\\<close>\n\nML \\<open>\n  val (disable_uname_pp, disable_uname_pp_setup) =\n    Attrib.config_bool @{binding disable_uname_pp} (K false);\n\\<close>\n\nsetup disable_uname_pp_setup\n\nsubsubsection \\<open>Translations\\<close>\n\nML_file \"uname.ML\"\n\nparse_translation \\<open>[(@{syntax_const \"_uname\"}, K Name_Parser.uname_tr)]\\<close>\nprint_translation \\<open>[(@{const_syntax \"MkName\"}, Name_Printer.MkName_tr')]\\<close>\n\nsubsection \\<open>Instantiations\\<close>\n\nsubsubsection \\<open>Countability\\<close>\n\ndefinition uname_to_nat :: \"'more::countable uname_ext \\<Rightarrow> nat\" where\n\"uname_to_nat n = to_nat (name_str n, dashed n, subscript n, more n)\"\n\ninstance uname_ext :: (countable) countable\napply (intro_classes)\napply (rule_tac x = \"uname_to_nat\" in exI)\napply (rule injI)\napply (unfold uname_to_nat_def)\napply (erule asmE)\napply (induct_tac x)\napply (induct_tac y)\napply (clarsimp)\ndone\n\nsubsubsection \\<open>Infinity\\<close>\n\ntheorem infinite_uname_ext [simp]:\n\"infinite (UNIV :: 'a uname_ext set)\"\napply (insert infinite_literal)\napply (erule_tac f = \"name_str\" in infinite_transfer)\napply (unfold image_def)\napply (clarsimp)\napply (rule_tac x = \"name_str_update (\\<lambda>_. x) undefined\" in exI)\napply (simp)\ndone\n\ninstance uname_ext :: (type) infinite\napply (intro_classes)\napply (rule infinite_uname_ext)\ndone\n\nsubsubsection \\<open>Linear Order\\<close>\n\ntext \\<open>Names are ordered lexically by their record fields.\\<close>\n\ninstantiation uname_ext :: (ord) ord\nbegin\ndefinition less_eq_uname_ext :: \"'a uname_ext \\<Rightarrow> 'a uname_ext \\<Rightarrow> bool\" where\n\"(less_eq_uname_ext n1 n2) \\<longleftrightarrow>\n    name_str n1 < name_str n2 \\<or>\n    name_str n1 \\<le> name_str n2 \\<and> dashed n1 < dashed n2 \\<or>\n    name_str n1 \\<le> name_str n2 \\<and> dashed n1 \\<le> dashed n2 \\<and> subscript n1 < subscript n2 \\<or>\n    name_str n1 \\<le> name_str n2 \\<and> dashed n1 \\<le> dashed n2 \\<and> subscript n1 \\<le> subscript n2 \\<and> more n1 \\<le> more n2\"\n\ndefinition less_uname_ext :: \"'a uname_ext \\<Rightarrow> 'a uname_ext \\<Rightarrow> bool\" where\n\"(less_uname_ext n1 n2) \\<longleftrightarrow> (n1 \\<le> n2 \\<and> \\<not> n2 \\<le> n1)\"\ninstance ..\nend\n\ninstance uname_ext :: (order) order\napply (intro_classes)\n\\<comment> \\<open>Subgoal 1\\<close>\napply (simp add: less_uname_ext_def)\n\\<comment> \\<open>Subgoal 2\\<close>\napply (simp add: less_eq_uname_ext_def)\n\\<comment> \\<open>Subgoal 3\\<close>\napply (smt (z3) less_eq_uname_ext_def order_le_less_trans order_less_le_trans order_less_trans order_trans)\n\\<comment> \\<open>Subgoal 4\\<close>\napply (metis leD less_eq_uname_ext_def not_less_iff_gr_or_eq order_antisym uname.equality)\ndone\n\ninstance uname_ext :: (linorder) linorder\napply (intro_classes)\napply (unfold less_eq_uname_ext_def less_uname_ext_def)\napply force\ndone\n\ninstance uname_ext :: (linorder) normalise\napply (intro_classes)\ndone\n\nsubsection \\<open>Proof Support\\<close>\n\ntext \\<open>The simplifications below evaluate inequalities on names.\\<close>\n\ndeclare less_eq_char_def [simp]\ndeclare less_char_def [simp]\ndeclare less_eq_literal.rep_eq [simp]\ndeclare less_literal.rep_eq [simp]\ndeclare less_eq_uname_ext_def [simp]\ndeclare less_uname_ext_def [simp]\n\nsubsection \\<open>Theorems\\<close>\n\ntext \\<open>\\fixme{Should the following be a default simplification?}\\<close>\n\nlemma uname_less_iff (*[simp]*):\n\"(n1 :: uname) < (n2 :: uname) \\<longleftrightarrow>\n (name_str n1 < name_str n2) \\<or>\n (name_str n1 = name_str n2 \\<and> dashed n1 < dashed n2) \\<or>\n (name_str n1 = name_str n2 \\<and> dashed n1 = dashed n2 \\<and>\n  subscript n1 < subscript n2)\"\napply (induct_tac n1)\napply (induct_tac n2)\napply (clarsimp)\napply (metis less_asym' less_eq_literal.rep_eq less_literal.rep_eq linorder_cases not_less)\ndone\n\ntext \\<open>\\fixme{Are the three lemmas below really needed / desirable?}\\<close>\n\nlemma name_str_neq_dest (*[simp]*):\n\"name_str x \\<noteq> name_str y \\<Longrightarrow> x \\<noteq> y\"\napply (auto)\ndone\n\nlemma dashes_neq_dest (*[simp]*):\n\"dashes x \\<noteq> dashes y \\<Longrightarrow> x \\<noteq> y\"\napply (auto)\ndone\n\nlemma subscript_neq_dest (*[simp]*):\n\"subscript x \\<noteq> subscript y \\<Longrightarrow> x \\<noteq> y\"\napply (auto)\ndone\n\nsubsection \\<open>Experiments\\<close>\n\nlemma\n\"f(\\<lfloor>c\\<rfloor> := (30::nat), \\<lfloor>b\\<rfloor> := (20::nat), \\<lfloor>a\\<rfloor> := (10::nat)) =\n f(\\<lfloor>b\\<rfloor> := (20::nat), \\<lfloor>a\\<rfloor> := (10::nat), \\<lfloor>c\\<rfloor> := (30::nat))\"\n\\<comment> \\<open>This seems to take a little more time... An Isabelle2016-1 issue?\\<close>\napply (fun_upd_normalise_tac)\napply (rule refl)\ndone\n\nlemma\n\"f(\\<lfloor>c\\<rfloor> := (30::nat), \\<lfloor>b\\<rfloor> := (20::nat), \\<lfloor>a\\<rfloor> := (10::nat)) =\n f(\\<lfloor>b\\<rfloor> := (20::nat), \\<lfloor>a\\<rfloor> := (10::nat), \\<lfloor>c\\<rfloor> := (30::nat))\"\n\\<comment> \\<open>This seems to take a little more time... An Isabelle2016-1 issue?\\<close>\napply (simp add: fun_upd_normalise)\ndone\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/axiomatic/theories/core/uname.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984434543458, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.31511365724104956}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoarePartialProps.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\<open>Properties of Partial Correctness Hoare Logic\\<close>\n\ntheory HoarePartialProps imports HoarePartialDef begin\n\nsubsection \\<open>Soundness\\<close>\n\nlemma hoare_cnvalid: \n assumes hoare: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\<And>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nusing hoare\nproof (induct)\n  case (Skip \\<Theta> F P A)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Skip P,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> P\"\n    thus \"t \\<in> Normal ` P \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext\n  case (Basic \\<Theta> F f P A)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> {s. f s \\<in> P} (Basic f) P,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> {s. f s \\<in> P}\"\n    thus \"t \\<in> Normal ` P \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext \n  case (Spec \\<Theta> F r Q A)\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {s. (\\<forall>t. (s, t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s, t) \\<in> r)} Spec r Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> {s. (\\<forall>t. (s, t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s, t) \\<in> r)}\"\n    from exec P\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext\n  case (Seq \\<Theta> F P c1 R A c2 Q)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c1 R,A\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> R c2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    assume P: \"s \\<in> P\"\n    from exec P obtain r where\n      exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> r\" and exec_c2:  \"\\<Gamma>\\<turnstile>\\<langle>c2,r\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    with t_notin_F have \"r \\<notin> Fault ` F\"\n      by (auto dest: execn_Fault_end)\n    with valid_c1 ctxt exec_c1 P\n    have r: \"r\\<in>Normal ` R \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n    show \"t\\<in>Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases r)\n      case (Normal r')\n      with exec_c2 r\n      show \"t\\<in>Normal ` Q \\<union> Abrupt ` A\"\n        apply -\n        apply (rule cnvalidD [OF valid_c2 ctxt _ _ t_notin_F])\n        apply auto\n        done\n    next\n      case (Abrupt r')\n      with exec_c2 have \"t=Abrupt r'\"\n        by (auto elim: execn_elim_cases)\n      with Abrupt r show ?thesis\n        by auto\n    next\n      case Fault with r show ?thesis by blast\n    next\n      case Stuck with r show ?thesis by blast\n    qed\n  qed\nnext\n  case (Cond \\<Theta> F P b c1 Q A c2)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> b) c1 Q,A\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> - b) c2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Cond b c1 c2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases \"s\\<in>b\")\n      case True\n      with exec have \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by cases auto\n      with P True \n      show ?thesis\n        by - (rule cnvalidD [OF valid_c1 ctxt _ _ t_notin_F],auto)\n    next\n      case False\n      with exec P have \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by cases auto\n      with P False \n      show ?thesis\n        by - (rule cnvalidD [OF valid_c2 ctxt _ _ t_notin_F],auto)\n    qed\n  qed\nnext\n  case (While \\<Theta> F P b c A n)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P While b c (P \\<inter> - b),A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    show \"t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt ` A\"\n    proof (cases \"s \\<in> b\")\n      case True\n      {\n        fix d::\"('b,'a,'c) com\" fix s t \n        assume exec: \"\\<Gamma>\\<turnstile>\\<langle>d,s\\<rangle> =n\\<Rightarrow> t\"\n        assume d: \"d=While b c\"\n        assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n        from exec d ctxt\n        have \"\\<lbrakk>s \\<in> Normal ` P; t \\<notin> Fault ` F\\<rbrakk>\n               \\<Longrightarrow> t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt`A\"\n        proof (induct)\n          case (WhileTrue s b' c' n r t)\n          have t_notin_F: \"t \\<notin> Fault ` F\" by fact\n          have eqs: \"While b' c' = While b c\" by fact\n          note valid_c\n          moreover have ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n          moreover from WhileTrue\n          obtain \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> r\" and\n            \"\\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> t\" and\n            \"Normal s \\<in> Normal `(P \\<inter> b)\" by auto\n          moreover with t_notin_F have \"r \\<notin> Fault ` F\"\n            by (auto dest: execn_Fault_end)\n          ultimately\n          have r: \"r \\<in> Normal ` P \\<union> Abrupt ` A\"\n            by - (rule cnvalidD,auto)\n          from this _ ctxt\n          show \"t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt ` A \"\n          proof (cases r)\n            case (Normal r')\n            with r ctxt eqs t_notin_F\n            show ?thesis\n              by - (rule WhileTrue.hyps,auto)\n          next\n            case (Abrupt r')\n            have \"\\<Gamma>\\<turnstile>\\<langle>While b' c',r\\<rangle> =n\\<Rightarrow> t\" by fact\n            with Abrupt have \"t=r\"\n              by (auto dest: execn_Abrupt_end) \n            with r Abrupt show ?thesis\n              by blast\n          next\n            case Fault with r show ?thesis by blast\n          next\n            case Stuck with r show ?thesis by blast\n          qed   \n        qed auto\n      }\n      with exec ctxt P t_notin_F\n      show ?thesis\n        by auto\n    next\n      case False\n      with exec P have \"t=Normal s\"\n        by cases auto\n      with P False\n      show ?thesis\n        by auto\n    qed\n  qed\nnext\n  case (Guard \\<Theta> F g P c Q A f)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) Guard f g c  Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    assume P:\"s \\<in> (g \\<inter> P)\"\n    from exec P have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    from valid_c ctxt this P t_notin_F\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n  qed\nnext\n  case (Guarantee f F \\<Theta> g P c Q A)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\" by fact\n  have f_F: \"f \\<in> F\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Guard f g c  Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    assume P:\"s \\<in> P\"\n    from exec f_F t_notin_F have g: \"s \\<in> g\"\n      by cases auto\n    with P have P': \"s \\<in> g \\<inter> P\"\n      by blast\n    from exec P g have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    from valid_c ctxt this P' t_notin_F\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n  qed\nnext\n  case (CallRec P p Q A Specs \\<Theta> F)\n  have p: \"(P,p,Q,A) \\<in> Specs\" by fact\n  have valid_body:\n    \"\\<forall>(P,p,Q,A) \\<in> Specs. p \\<in> dom \\<Gamma> \\<and> (\\<forall>n. \\<Gamma>,\\<Theta> \\<union> Specs \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A)\"\n    using CallRec.hyps by blast\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P Call p Q,A\"\n  proof -\n    {\n      fix n\n      have \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\n        \\<Longrightarrow> \\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n      proof (induct n)\n        case 0\n        show \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>0:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (fastforce elim!: execn_elim_cases simp add: nvalid_def)\n      next\n        case (Suc m)\n        have hyp: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\n              \\<Longrightarrow> \\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n        have \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n        hence ctxt_m: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (fastforce simp add: nvalid_def intro: execn_Suc)\n        hence valid_Proc:\n          \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (rule hyp)\n        let ?\\<Theta>'= \"\\<Theta> \\<union> Specs\"\n        from valid_Proc ctxt_m\n        have \"\\<forall>(P, p, Q, A)\\<in>?\\<Theta>'. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by fastforce\n        with valid_body\n        have valid_body_m: \n          \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<forall>n. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A\"\n          by (fastforce simp add: cnvalid_def)\n        show \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n        proof (clarify)\n          fix P p Q A assume p: \"(P,p,Q,A) \\<in> Specs\"\n          show \"\\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          proof (rule nvalidI)\n            fix s t\n            assume exec_call: \n              \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> =Suc m\\<Rightarrow> t\"\n            assume Pre: \"s \\<in> P\"\n            assume t_notin_F: \"t \\<notin> Fault ` F\"\n            from exec_call\n            show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n            proof (cases)\n              fix bdy m' \n              assume m: \"Suc m = Suc m'\"\n              assume bdy: \"\\<Gamma> p = Some bdy\"\n              assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =m'\\<Rightarrow> t\"\n              from Pre valid_body_m exec_body bdy m p t_notin_F\n              show ?thesis\n                by (fastforce simp add: nvalid_def)\n            next\n              assume \"\\<Gamma> p = None\"\n              with valid_body p have False by auto\n              thus ?thesis ..\n            qed\n          qed\n        qed\n      qed\n    }\n    with p show ?thesis\n      by (fastforce simp add: cnvalid_def)\n  qed\nnext\n  case (DynCom P \\<Theta> F c Q A)\n  hence valid_c: \"\\<forall>s\\<in>P. (\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (c s) Q,A)\" by auto\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P DynCom c Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    assume P: \"s \\<in> P\"\n    assume t_notin_Fault: \"t \\<notin> Fault ` F\"\n    from exec show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases)\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c s,Normal s\\<rangle> =n\\<Rightarrow> t\"      \n      from cnvalidD [OF valid_c [rule_format, OF P] ctxt this P t_notin_Fault]\n      show ?thesis .\n    qed\n  qed\nnext\n  case (Throw \\<Theta> F A Q)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> A Throw Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> A\"\n    then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by cases simp\n  qed\nnext\n  case (Catch \\<Theta> F P c\\<^sub>1 Q R c\\<^sub>2 A)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    assume P: \"s \\<in> P\"\n    assume t_notin_Fault: \"t \\<notin> Fault ` F\"\n    from exec show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases)\n      fix s'\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\" \n      assume exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      from cnvalidD [OF valid_c1 ctxt exec_c1 P ] \n      have \"Abrupt s' \\<in> Abrupt ` R\"\n        by auto\n      with cnvalidD [OF valid_c2 ctxt _ _ t_notin_Fault] exec_c2\n      show ?thesis\n        by fastforce\n    next\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      assume notAbr: \"\\<not> isAbr t\"\n      from cnvalidD [OF valid_c1 ctxt exec_c1 P t_notin_Fault] \n      have \"t \\<in> Normal ` Q \\<union> Abrupt ` R\" .\n      with notAbr\n      show ?thesis\n        by auto\n    qed\n  qed\nnext\n  case (Conseq P \\<Theta> F c Q A)\n  hence adapt: \"\\<forall>s \\<in> P. (\\<exists>P' Q' A'. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'  \\<and>\n                          s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A)\"\n    by blast\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof -\n      from P adapt obtain P' Q' A' Z  where\n        spec: \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'\" and\n        P': \"s \\<in> P'\"  and  strengthen: \"Q' \\<subseteq> Q \\<and> A' \\<subseteq> A\"\n        by auto\n      from spec [rule_format] ctxt exec P' t_notin_F  \n      have \"t \\<in> Normal ` Q' \\<union> Abrupt ` A'\"\n        by (rule cnvalidD)\n      with strengthen show ?thesis\n        by blast\n    qed\n  qed\nnext\n  case (Asm P p Q A \\<Theta> F)\n  have asm: \"(P, p, Q, A) \\<in> \\<Theta>\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    from asm ctxt have \"\\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Call p Q,A\" by auto\n    moreover\n    assume \"s \\<in> P\" \"t \\<notin> Fault ` F\"\n    ultimately\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      using exec\n      by (auto simp add: nvalid_def)\n  qed\nnext\n  case ExFalso thus ?case by iprover\nqed\n\n\n\nsubsection \\<open>Completeness\\<close>\n\nlemma MGT_valid:\n\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n   {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t}, {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof (rule validI) \n  fix s t\n  assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t\" \n         \"s \\<in> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))}\"\n         \"t \\<notin> Fault ` F\"\n  thus \"t \\<in> Normal ` {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t} \\<union> \n            Abrupt ` {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (cases t) (auto simp add: final_notin_def)\nqed\n\ntext \\<open>The consequence rule where the existential @{term Z} is instantiated\nto @{term s}. Usefull in proof of \\<open>MGT_lemma\\<close>.\\<close>\nlemma ConseqMGT: \n  assumes modif: \"\\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\n  assumes impl: \"\\<And>s. s \\<in> P \\<Longrightarrow> s \\<in> P' s \\<and> (\\<forall>t. t \\<in> Q' s \\<longrightarrow> t \\<in> Q) \\<and> \n                                            (\\<forall>t. t \\<in> A' s \\<longrightarrow> t \\<in> A)\"\n  shows \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl \nby -  (rule conseq [OF modif],blast)\n\n\nlemma Seq_NoFaultStuckD1: \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nproof (rule final_notinI)\n  fix t\n  assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t\"\n  show \"t \\<notin> {Stuck} \\<union> Fault `  F\"\n  proof \n    assume \"t \\<in> {Stuck} \\<union> Fault `  F\"\n    moreover\n    {\n      assume \"t = Stuck\"\n      with exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Stuck\"\n        by (auto intro: exec_Seq')\n      with noabort have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    moreover \n    {\n      assume \"t \\<in> Fault ` F\"\n      then obtain f where \n      t: \"t=Fault f\" and f: \"f \\<in> F\"\n        by auto\n      from t exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Fault f\"\n        by (auto intro: exec_Seq')\n      with noabort f have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    ultimately show False by auto\n  qed\nqed\n\nlemma Seq_NoFaultStuckD2: \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<forall>t. \\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> t\\<notin> ({Stuck} \\<union> Fault `  F) \\<longrightarrow> \n             \\<Gamma>\\<turnstile>\\<langle>c2,t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nusing noabort\nby (auto simp add: final_notin_def intro: exec_Seq')\n\n\nlemma MGT_implies_complete:\n  assumes MGT: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  assumes valid: \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  using MGT\n  apply (rule ConseqMGT) \n  apply (insert valid)\n  apply (auto simp add: valid_def intro!: final_notinI)\n  done\n\ntext \\<open>Equipped only with the classic consequence rule @{thm \"conseqPrePost\"}\n        we can only derive this syntactically more involved version\n        of completeness. But semantically it is equivalent to the \"real\" one\n        (see below)\\<close>\nlemma MGT_implies_complete':\n  assumes MGT: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                       {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  assumes valid: \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  using MGT [rule_format, of Z]\n  apply (rule conseqPrePost)\n  apply (insert valid)\n  apply   (fastforce simp add: valid_def final_notin_def)\n  apply  (fastforce simp add: valid_def)\n  apply (fastforce simp add: valid_def)\n  done\n\ntext \\<open>Semantic equivalence of both kind of formulations\\<close>\nlemma valid_involved_to_valid:\n  assumes valid: \n    \"\\<forall>Z. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  shows \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  using valid\n  apply (simp add: valid_def)\n  apply clarsimp\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"Normal x\" in allE)\n  apply (erule_tac x=t in allE)\n  apply fastforce\n  done\n\ntext \\<open>The sophisticated consequence rule allow us to do this \n        semantical transformation on the hoare-level, too. \n        The magic is, that it allow us to\n        choose the instance of @{term Z} under the assumption of an state @{term \"s \\<in> P\"}\\<close>\nlemma\n  assumes deriv: \n    \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule ConseqMGT [OF deriv])\n  apply auto\n  done\n\nlemma valid_to_valid_involved:\n  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow>\n   \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\nby (simp add: valid_def Collect_conv_if)\n\nlemma\n  assumes deriv: \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  apply (rule conseqPrePost [OF deriv])\n  apply auto\n  done\n\nlemma conseq_extract_state_indep_prop: \n  assumes state_indep_prop:\"\\<forall>s \\<in> P. R\" \n  assumes to_show: \"R \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule Conseq)\n  apply (clarify)\n  apply (rule_tac x=\"P\" in exI)\n  apply (rule_tac x=\"Q\" in exI)\n  apply (rule_tac x=\"A\" in exI)\n  using state_indep_prop to_show\n  by blast\n\n\nlemma MGT_lemma:\n  assumes MGT_Calls: \n    \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> \n       {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n        (Call p)\n       {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n       {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  shows \"\\<And>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c \n             {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof (induct c)\n  case Skip\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Skip\n           {t. \\<Gamma>\\<turnstile>\\<langle>Skip,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>Skip,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Skip [THEN conseqPre])\n       (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\nnext\n  case (Basic f)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Basic f\n           {t. \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal Z\\<rangle> \\<Rightarrow> Normal t}, \n           {t. \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Basic [THEN conseqPre])\n       (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\nnext\n  case (Spec r)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Spec r\n           {t. \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal Z\\<rangle> \\<Rightarrow> Normal t}, \n           {t. \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    apply (rule hoarep.Spec [THEN conseqPre])\n    apply (clarsimp simp add: final_notin_def)\n    apply (case_tac \"\\<exists>t. (Z,t) \\<in> r\")\n    apply (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\n    done\nnext\n  case (Seq c1 c2) \n  have hyp_c1: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Seq.hyps by iprover\n  have hyp_c2: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c2 \n                          {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                          {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Seq.hyps by iprover\n  from hyp_c1 \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n              {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t \\<and> \n                  \\<Gamma>\\<turnstile>\\<langle>c2,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT)\n       (auto dest: Seq_NoFaultStuckD1 [simplified] Seq_NoFaultStuckD2 [simplified]\n             intro: exec.Seq)\n  thus \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   Seq c1 c2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule hoarep.Seq )\n    show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t \\<and> \n                      \\<Gamma>\\<turnstile>\\<langle>c2,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   c2\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    proof (rule ConseqMGT [OF hyp_c2],safe)\n      fix r t\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal r\" \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal r\\<rangle> \\<Rightarrow> Normal t\"\n      then show \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        by (iprover intro: exec.intros)\n    next\n      fix r t\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal r\" \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal r\\<rangle> \\<Rightarrow> Abrupt t\"\n      then show \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n        by (iprover intro: exec.intros)\n    qed\n  qed\nnext\n  case (Cond b c1 c2) \n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n                 {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Cond.hyps by iprover  \n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\\<inter>b)\n                   c1 \n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    by (rule ConseqMGT)\n       (fastforce intro: exec.CondTrue simp add: final_notin_def)\n  moreover\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c2 \n                    {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Cond.hyps by iprover  \n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>({s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\\<inter>-b)\n                  c2 \n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    by (rule ConseqMGT)\n       (fastforce intro: exec.CondFalse simp add: final_notin_def)\n  ultimately\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                 Cond b c1 c2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Cond)       \nnext\n  case (While b c)\n  let ?unroll = \"({(s,t). s\\<in>b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t})\\<^sup>*\"\n  let ?P' = \"\\<lambda>Z. {t. (Z,t)\\<in>?unroll \\<and> \n                    (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                         \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                             (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}\"\n  let ?A' = \"\\<lambda>Z. {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                While b c\n              {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule ConseqMGT [where ?P'=\"?P'\" \n                         and ?Q'=\"\\<lambda>Z. ?P' Z \\<inter> - b\" and ?A'=\"?A'\"])\n    show \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?P' Z) (While b c) (?P' Z \\<inter> - b),(?A' Z)\"\n    proof (rule allI, rule hoarep.While)\n      fix Z\n      from While \n      have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\n                        {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                        {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" by iprover\n      then show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?P' Z  \\<inter> b) c (?P' Z),(?A' Z)\"\n      proof (rule ConseqMGT)\n        fix s\n        assume  \"s\\<in> {t. (Z, t) \\<in> ?unroll \\<and> \n                      (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                           \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                               (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                    \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}\n                   \\<inter> b\"\n        then obtain \n          Z_s_unroll: \"(Z,s) \\<in> ?unroll\" and\n          noabort:\"\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                        \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                            (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u)\" and\n          s_in_b: \"s\\<in>b\" \n          by blast\n        show \"s \\<in> {t. t = s \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \\<and>\n        (\\<forall>t. t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t} \\<longrightarrow>\n             t \\<in> {t. (Z, t) \\<in> ?unroll \\<and> \n                  (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow>  e\\<in>b \n                       \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                           (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}) \\<and> \n         (\\<forall>t. t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Abrupt t} \\<longrightarrow>\n             t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t})\"\n          (is \"?C1 \\<and> ?C2 \\<and> ?C3\")\n        proof (intro conjI)\n          from Z_s_unroll noabort s_in_b show ?C1 by blast\n        next\n          {\n            fix t \n            assume s_t: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t\"\n            moreover\n            from Z_s_unroll s_t s_in_b \n            have \"(Z, t) \\<in> ?unroll\"\n              by (blast intro: rtrancl_into_rtrancl)\n            moreover note noabort\n            ultimately \n            have \"(Z, t) \\<in> ?unroll \\<and> \n                  (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                        \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                            (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))\"\n              by iprover\n          }\n          then show ?C2 by blast\n        next\n          {\n            fix t\n            assume s_t:  \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Abrupt t\" \n            from Z_s_unroll noabort s_t s_in_b \n            have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n              by blast\n          } thus ?C3 by simp\n        qed\n      qed\n    qed\n  next\n    fix s\n    assume P: \"s \\<in> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n    hence WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n      by auto\n    show \"s \\<in> ?P' s \\<and> \n    (\\<forall>t. t\\<in>(?P' s \\<inter> - b)\\<longrightarrow>\n         t\\<in>{t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t})\\<and>\n    (\\<forall>t. t\\<in>?A' s \\<longrightarrow> t\\<in>?A' Z)\"\n    proof (intro conjI)\n      {\n        fix e\n        assume \"(Z,e) \\<in> ?unroll\" \"e \\<in> b\"\n        from this WhileNoFault\n        have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n               (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                    \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u)\" (is \"?Prop Z e\")\n        proof (induct rule: converse_rtrancl_induct [consumes 1])\n          assume e_in_b: \"e \\<in> b\"\n          assume WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n          with e_in_b WhileNoFault\n          have cNoFault: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n            by (auto simp add: final_notin_def intro: exec.intros)\n          moreover\n          {\n            fix u assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n            with e_in_b have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n              by (blast intro: exec.intros)\n          }\n          ultimately\n          show \"?Prop e e\"\n            by iprover\n        next\n          fix Z r\n          assume e_in_b: \"e\\<in>b\" \n          assume WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n          assume hyp: \"\\<lbrakk>e\\<in>b;\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\\<rbrakk>\n                       \\<Longrightarrow> ?Prop r e\"\n          assume Z_r:\n            \"(Z, r) \\<in> {(Z, r). Z \\<in> b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r}\"\n          with WhileNoFault\n          have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n            by (auto simp add: final_notin_def intro: exec.intros)\n          from hyp [OF e_in_b this] obtain\n            cNoFault: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\" and\n            Abrupt_r: \"\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u \\<longrightarrow> \n                            \\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Abrupt u\"\n            by simp\n          \n           {\n            fix u assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n            with Abrupt_r have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Abrupt u\" by simp\n            moreover from  Z_r obtain\n              \"Z \\<in> b\"  \"\\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r\"\n              by simp\n            ultimately have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u\"\n              by (blast intro: exec.intros)\n          }\n          with cNoFault show \"?Prop Z e\"\n            by iprover\n        qed\n      }\n      with P show \"s \\<in> ?P' s\"\n        by blast\n    next\n      {\n        fix t\n        assume \"termination\": \"t \\<notin> b\"\n        assume \"(Z, t) \\<in> ?unroll\"\n        hence \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        proof (induct rule: converse_rtrancl_induct [consumes 1])\n          from \"termination\" \n          show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal t\\<rangle> \\<Rightarrow> Normal t\"\n            by (blast intro: exec.WhileFalse)\n        next\n          fix Z r\n          assume first_body: \n                 \"(Z, r) \\<in> {(s, t). s \\<in> b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t}\"\n          assume \"(r, t) \\<in> ?unroll\"\n          assume rest_loop: \"\\<Gamma>\\<turnstile>\\<langle>While b c, Normal r\\<rangle> \\<Rightarrow> Normal t\"\n          show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n          proof -\n            from first_body obtain\n              \"Z \\<in> b\" \"\\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r\"\n              by fast\n            moreover\n            from rest_loop have\n              \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Normal t\"\n              by fast\n            ultimately show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n              by (rule exec.WhileTrue)\n          qed\n        qed\n      }\n      with P\n      show \"(\\<forall>t. t\\<in>(?P' s \\<inter> - b)\n            \\<longrightarrow>t\\<in>{t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t})\"\n        by blast\n    next\n      from P show \"\\<forall>t. t\\<in>?A' s \\<longrightarrow> t\\<in>?A' Z\" by simp\n    qed\n  qed\nnext\n  case (Call p)\n  let ?P = \"{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n  from noStuck_Call have \"\\<forall>s \\<in> ?P. p \\<in> dom \\<Gamma>\"\n    by (fastforce simp add: final_notin_def )\n  then show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ?P (Call p)\n               {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule conseq_extract_state_indep_prop)\n    assume p_definied: \"p \\<in> dom \\<Gamma>\"\n    with MGT_Calls show\n      \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \n                 \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n                  (Call p)\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Call  p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      by (auto)\n  qed\nnext\n  case (DynCom c)\n  have hyp: \n    \"\\<And>s'. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c s',Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c s'\n      {t. \\<Gamma>\\<turnstile>\\<langle>c s',Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>c s',Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using DynCom by simp\n  have hyp':\n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c Z\n        {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT [OF hyp])\n       (fastforce simp add: final_notin_def intro: exec.intros)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n               DynCom c\n             {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n             {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    apply (rule hoarep.DynCom)\n    apply (clarsimp)\n    apply (rule hyp' [simplified])\n    done\nnext  \n  case (Guard f g c)\n  have hyp_c: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Guard by iprover\n  show ?case\n  proof (cases \"f \\<in> F\")\n    case True \n    from hyp_c\n    have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>(g \\<inter> {s. s = Z \\<and> \n                    \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (- F))}) \n             c\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      apply (rule ConseqMGT)\n      apply (insert True)\n      apply (auto simp add: final_notin_def intro: exec.intros)\n      done\n    from True this\n    show ?thesis      \n      by (rule conseqPre [OF Guarantee]) auto\n  next\n    case False\n    from hyp_c\n    have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> \n           (g \\<inter> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}) \n           c\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      apply (rule ConseqMGT)\n      apply clarify\n      apply (frule Guard_noFaultStuckD [OF _ False])\n      apply (auto simp add: final_notin_def intro: exec.intros)\n      done\n    then show ?thesis\n      apply (rule conseqPre [OF hoarep.Guard])\n      apply clarify\n      apply (frule Guard_noFaultStuckD [OF _ False])\n      apply auto\n      done\n  qed\nnext\n  case Throw\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Throw\n              {t. \\<Gamma>\\<turnstile>\\<langle>Throw,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Throw,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule conseqPre [OF hoarep.Throw]) (blast intro: exec.intros)\nnext\n  case (Catch c\\<^sub>1 c\\<^sub>2)\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>1\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Catch.hyps by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>1\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t \\<and> \n                   \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n    by (rule ConseqMGT)\n       (fastforce intro: exec.intros simp add: final_notin_def)\n  moreover\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>2\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Catch.hyps by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow>Abrupt s \\<and> \n                   \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n               c\\<^sub>2\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT)\n       (fastforce intro: exec.intros  simp add: final_notin_def)\n  ultimately\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   Catch c\\<^sub>1 c\\<^sub>2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Catch)\nqed\n\nlemma MGT_Calls: \n \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \n     \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n            (Call p)\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof - \n  {\n    fix p Z \n    assume defined: \"p \\<in> dom \\<Gamma>\"\n    have \n      \"\\<Gamma>,(\\<Union>p\\<in>dom \\<Gamma>. \\<Union>Z. \n          {({s. s=Z \\<and> \n             \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))},\n             p,\n             {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n             {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t})})\n       \\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n          (the (\\<Gamma> p))\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      (is \"\\<Gamma>,?\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (?Pre p Z) (the (\\<Gamma> p)) (?Post p Z),(?Abr p Z)\")\n    proof -\n      have MGT_Calls:\n       \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \\<Gamma>,?\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> \n        {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n         (Call p)\n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n        by (intro ballI allI, rule HoarePartialDef.Asm,auto)\n      have \"\\<forall>Z. \\<Gamma>,?\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p) ,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault`(-F))} \n                        (the (\\<Gamma> p))\n                        {t. \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                        {t. \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n        by (iprover intro: MGT_lemma [OF MGT_Calls])\n      thus \"\\<Gamma>,?\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?Pre p Z) (the (\\<Gamma> p)) (?Post p Z),(?Abr p Z)\"\n        apply (rule ConseqMGT)\n        apply (clarify,safe)\n      proof -\n        assume \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n        with defined show \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\" \n          by (fastforce simp add: final_notin_def \n                intro: exec.intros)\n      next\n        fix t\n        assume \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        with defined \n        show \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>Normal t\"\n          by  (auto intro: exec.Call)\n      next\n        fix t\n        assume \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n        with defined \n        show \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>Abrupt t\"\n          by  (auto intro: exec.Call)\n      qed\n    qed\n  }\n  then show ?thesis\n    apply -\n    apply (intro ballI allI)\n    apply (rule CallRec' [where Procs=\"dom \\<Gamma>\"  and \n      P=\"\\<lambda>p Z. {s. s=Z \\<and> \n                  \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"and\n      Q=\"\\<lambda>p Z. \n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t}\" and\n      A=\"\\<lambda>p Z. \n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"] )\n    apply simp+\n    done\nqed\n\ntheorem hoare_complete: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow> \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (iprover intro: MGT_implies_complete MGT_lemma [OF MGT_Calls])\n\nlemma hoare_complete': \n  assumes cvalid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (cases \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\")\n  case True\n  hence \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n    by (rule hoare_complete)\n  thus \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P c Q,A\"\n    by (rule hoare_augment_context) simp\nnext\n  case False\n  with cvalid\n  show ?thesis\n    by (rule ExFalso)\nqed\n  \n\nlemma hoare_strip_\\<Gamma>: \n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nproof (rule hoare_complete)\n  from hoare_sound [OF deriv] have \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n    by (simp add: cvalid_def)\n  from this F'\n  show \"strip F' \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n    by (rule valid_to_valid_strip)\nqed\n\n\nsubsection \\<open>And Now: Some Useful Rules\\<close>\n \nsubsubsection \\<open>Consequence\\<close>\n\n\nlemma LiberalConseq_sound:\nfixes F::\"'f set\" \nassumes cons: \"\\<forall>s \\<in> P. \\<forall>(t::('s,'f) xstate). \\<exists>P' Q' A'. (\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A') \\<and>\n                ((s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from P cons obtain P' Q' A' where\n      spec: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'\" and\n      adapt: \"(s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      apply -\n      apply (drule (1) bspec)\n      apply (erule_tac x=t in allE)\n      apply (elim exE conjE)\n      apply iprover\n      done\n    from exec spec ctxt t_notin_F\n    have \"s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A'\"\n      by (simp add: cnvalid_def nvalid_def)\n    with adapt show ?thesis\n      by simp\n  qed\nqed\n\nlemma LiberalConseq:\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<forall>(t::('s,'f) xstate). \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                ((s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule hoare_complete')\napply (rule allI)\napply (rule LiberalConseq_sound)\nusing cons\napply (clarify)\napply (drule (1) bspec)\napply (erule_tac x=t in allE)\napply clarify\napply (rule_tac x=P' in exI)\napply (rule_tac x=Q' in exI)\napply (rule_tac x=A' in exI)\napply (rule conjI)\napply (blast intro: hoare_cnvalid)\napply assumption\ndone\n\nlemma \"\\<forall>s \\<in> P. \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A \n           \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule LiberalConseq)\n  apply (rule ballI)\n  apply (drule (1) bspec)\n  apply clarify\n  apply (rule_tac x=P' in exI)\n  apply (rule_tac x=Q' in exI)\n  apply (rule_tac x=A' in exI)\n  apply auto\n  done\n\nlemma\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                (\\<forall>(t::('s,'f) xstate). (s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\n  apply (rule Conseq)\n  apply (rule ballI)\n  apply (insert cons)\n  apply (drule (1) bspec)\n  apply clarify\n  apply (rule_tac x=P' in exI)\n  apply (rule_tac x=Q' in exI)\n  apply (rule_tac x=A' in exI)\n  apply (rule conjI)\n  apply  assumption\n  (* no way to get s \\<in> P' *)\n  oops\n\nlemma LiberalConseq':\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                (\\<forall>(t::('s,'f) xstate). (s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule LiberalConseq)\napply (rule ballI)\napply (rule allI)\napply (insert cons)\napply (drule (1) bspec)\napply clarify\napply (rule_tac x=P' in exI)\napply (rule_tac x=Q' in exI)\napply (rule_tac x=A' in exI)\napply iprover\ndone\n\nlemma LiberalConseq'':\nfixes F:: \"'f set\"\nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s (t::('s,'f) xstate). \n                 (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in> Normal ` Q' Z \\<union> Abrupt ` A' Z)\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule LiberalConseq)\napply (rule ballI)\napply (rule allI)\napply (insert cons)\napply (erule_tac x=s in allE)\napply (erule_tac x=t in allE)\napply (case_tac \"t \\<in> Normal ` Q \\<union> Abrupt ` A\")\napply (insert spec)\napply  iprover\napply auto\ndone\n\nprimrec procs:: \"('s,'p,'f) com \\<Rightarrow> 'p set\"\nwhere\n\"procs Skip = {}\" |\n\"procs (Basic f) = {}\" |\n\"procs (Seq c\\<^sub>1 c\\<^sub>2)  = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\" |\n\"procs (Cond b c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\" |\n\"procs (While b c) = procs c\" |\n\"procs (Call p) = {p}\" |\n\"procs (DynCom c) = (\\<Union>s. procs (c s))\" |\n\"procs (Guard f g c) = procs c\" |\n\"procs Throw = {}\" |\n\"procs (Catch c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\"\n\nprimrec noSpec:: \"('s,'p,'f) com \\<Rightarrow> bool\"\nwhere\n\"noSpec Skip = True\" |\n\"noSpec (Basic f) = True\" |\n\"noSpec (Spec r) = False\" |\n\"noSpec (Seq c\\<^sub>1 c\\<^sub>2)  = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\" |\n\"noSpec (Cond b c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\" |\n\"noSpec (While b c) = noSpec c\" |\n\"noSpec (Call p) = True\" |\n\"noSpec (DynCom c) = (\\<forall>s. noSpec (c s))\" |\n\"noSpec (Guard f g c) = noSpec c\" |\n\"noSpec Throw = True\" |\n\"noSpec (Catch c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\"\n\nlemma exec_noSpec_no_Stuck:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes noSpec_c: \"noSpec c\"\n assumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\n assumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\n assumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\n assumes s_no_Stuck: \"s\\<noteq>Stuck\"\n shows \"t\\<noteq>Stuck\"\nusing exec noSpec_c procs_subset s_no_Stuck proof induct\n  case (Call p bdy s t) with noSpec_\\<Gamma> procs_subset_\\<Gamma> show ?case\n    by (auto dest!: bspec [of _ _ p])\nnext\n  case (DynCom c s t) then show ?case\n   by auto blast\nqed auto\n\nlemma execn_noSpec_no_Stuck:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes noSpec_c: \"noSpec c\"\n assumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\n assumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\n assumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\n assumes s_no_Stuck: \"s\\<noteq>Stuck\"\n shows \"t\\<noteq>Stuck\"\nusing exec noSpec_c procs_subset s_no_Stuck proof induct\n  case (Call p bdy n s t) with noSpec_\\<Gamma> procs_subset_\\<Gamma> show ?case\n    by (auto dest!: bspec [of _ _ p])\nnext\n  case (DynCom c s t) then show ?case\n    by auto blast\nqed auto\n\nlemma LiberalConseq_noguards_nothrows_sound:\nassumes spec: \"\\<forall>Z. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s t. (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in>  Q' Z )\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Q )\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from execn_noguards_no_Fault [OF exec noguards_c noguards_\\<Gamma>]\n     execn_nothrows_no_Abrupt [OF exec nothrows_c nothrows_\\<Gamma> ]\n     execn_noSpec_no_Stuck [OF exec  \n              noSpec_c  noSpec_\\<Gamma> procs_subset \n      procs_subset_\\<Gamma>]                            \n    obtain t' where t: \"t=Normal t'\"\n      by (cases t) auto\n    with exec spec ctxt\n    have \"(\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t' \\<in>  Q' Z)\"\n      by (unfold  cnvalid_def nvalid_def) blast\n    with cons P t show ?thesis\n      by simp\n  qed\nqed\n\n\nlemma LiberalConseq_noguards_nothrows:\nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s t. (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in>  Q' Z )\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Q )\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule hoare_complete')\napply (rule allI)\napply (rule LiberalConseq_noguards_nothrows_sound \n             [OF _ cons noguards_c noguards_\\<Gamma> nothrows_c nothrows_\\<Gamma> \n                 noSpec_c noSpec_\\<Gamma> \n                 procs_subset procs_subset_\\<Gamma>])\napply (insert spec)\napply (intro allI)\napply (erule_tac x=Z in allE)\nby (rule hoare_cnvalid)\n\nlemma \nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=fst Z \\<and> P s (snd Z)} c {t. Q (fst Z) (snd Z) t},{}\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=\\<sigma>} c {t. \\<forall>l. P \\<sigma> l \\<longrightarrow> Q \\<sigma> l t},{}\"\napply (rule allI)\napply (rule LiberalConseq_noguards_nothrows\n              [OF spec _ noguards_c noguards_\\<Gamma> nothrows_c nothrows_\\<Gamma>\n                  noSpec_c noSpec_\\<Gamma> \n                  procs_subset procs_subset_\\<Gamma>])\napply auto\ndone\n\nsubsubsection \\<open>Modify Return\\<close>\n\nlemma ProcModifyReturn_sound:\n  assumes valid_call: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n  assumes valid_modif: \n    \"\\<forall>\\<sigma>. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \n  assumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\n  assumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\n  shows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  then have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from exec\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.Call)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = \n      Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\"  .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\" \n      \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> p = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    then have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\n\nlemma ProcModifyReturn:\n  assumes spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n  assumes result_conform:\n      \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes return_conform:\n      \"\\<forall>s t. t \\<in> ModifAbr (init s) \n             \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes modifies_spec:  \n  \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule ProcModifyReturn_sound \n          [where Modif=Modif and ModifAbr=ModifAbr, \n            OF _ _ result_conform return_conform] )\nusing spec\napply (blast intro: hoare_cnvalid)\nusing modifies_spec\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma ProcModifyReturnSameFaults_sound:\n  assumes valid_call: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n  assumes valid_modif: \n    \"\\<forall>\\<sigma>. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \n  assumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\n  assumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\n  shows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from exec\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy \n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = \n      Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also \n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n \\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\"  and\n      t: \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    from cnvalidD [OF valid_call [rule_format] ctxt this P] t t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> p = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    then have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\n\nlemma ProcModifyReturnSameFaults:\n  assumes spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n  assumes result_conform:\n      \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes return_conform:\n  \"\\<forall>s t. t \\<in> ModifAbr (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes modifies_spec:  \n  \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule ProcModifyReturnSameFaults_sound \n          [where Modif=Modif and ModifAbr=ModifAbr, \n         OF _ _ result_conform return_conform])\nusing spec\napply (blast intro: hoare_cnvalid)\nusing modifies_spec\napply (blast intro: hoare_cnvalid)\ndone\n\nsubsubsection \\<open>DynCall\\<close>\n  \nlemma dynProcModifyReturn_sound:\nassumes valid_call: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  then have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  assume P: \"s \\<in> P\"\n  with valid_modif \n  have valid_modif': \"\\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n    by blast\n  from exec\n  have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by (cases rule: execn_dynCall_Normal_elim)\n  then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n\\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\" \n      \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> (p s) = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    hence \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma dynProcModifyReturn:\nassumes dyn_call: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nassumes modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>.  \n       \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule dynProcModifyReturn_sound [where Modif=Modif and ModifAbr=ModifAbr,\n          OF hoare_cnvalid [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_cnvalid [OF modif [rule_format]])\napply assumption\ndone\n\nlemma dynProcModifyReturnSameFaults_sound:\nassumes valid_call: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \\<longrightarrow> return' s t = return s t\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  assume P: \"s \\<in> P\"\n  with valid_modif \n  have valid_modif': \"\\<forall>\\<sigma>. \\<forall>n. \n    \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n    by blast\n  from exec\n  have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by (cases rule: execn_dynCall_Normal_elim)\n  then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n \\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.Call)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n \\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\"  and\n      t: \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this P] t t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> (p s) = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    hence \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma dynProcModifyReturnSameFaults:\nassumes dyn_call: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nassumes modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule dynProcModifyReturnSameFaults_sound \n        [where Modif=Modif and ModifAbr=ModifAbr,\n           OF hoare_cnvalid [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_cnvalid [OF modif [rule_format]])\napply assumption\ndone\n\n\nsubsubsection \\<open>Conjunction of Postcondition\\<close>\n\nlemma PostConjI_sound:\nassumes valid_Q: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\" \nassumes valid_R: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c R,B\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from valid_Q [rule_format] ctxt exec P t_notin_F have \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (rule cnvalidD)\n  moreover\n  from valid_R [rule_format] ctxt exec P t_notin_F have \"t \\<in> Normal ` R \\<union> Abrupt ` B\"\n    by (rule cnvalidD)\n  ultimately show \"t \\<in> Normal ` (Q \\<inter> R) \\<union> Abrupt ` (A \\<inter> B)\"\n    by blast\nqed\n\nlemma PostConjI: \n  assumes deriv_Q: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  assumes deriv_R: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c R,B\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule PostConjI_sound)\nusing deriv_Q\napply (blast intro: hoare_cnvalid)\nusing deriv_R\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma Merge_PostConj_sound: \n  assumes validF: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validG: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/G\\<^esub> P' c R,X\"\n  assumes F_G: \"F \\<subseteq> G\"\n  assumes P_P': \"P \\<subseteq> P'\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> X)\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  with F_G have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/G\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  with P_P' have P': \"s \\<in> P'\"\n    by auto\n  assume t_noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` (Q \\<inter> R) \\<union> Abrupt ` (A \\<inter> X)\"\n  proof -\n    from cnvalidD [OF validF [rule_format] ctxt exec P t_noFault]\n    have *: \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\n    then have \"t \\<notin> Fault ` G\"\n      by auto\n    from cnvalidD [OF validG [rule_format] ctxt' exec P' this]\n    have \"t \\<in> Normal ` R \\<union> Abrupt ` X\" .\n    with * show ?thesis by auto\n  qed\nqed\n\nlemma Merge_PostConj: \n  assumes validF: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validG: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/G\\<^esub> P' c R,X\"\n  assumes F_G: \"F \\<subseteq> G\"\n  assumes P_P': \"P \\<subseteq> P'\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> X)\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule Merge_PostConj_sound [OF _ _ F_G P_P'])\nusing validF apply (blast intro:hoare_cnvalid)\nusing validG apply (blast intro:hoare_cnvalid)\ndone\n\nsubsubsection \\<open>Weaken Context\\<close>\n\n\nlemma WeakenContext_sound:\n  assumes valid_c: \"\\<forall>n. \\<Gamma>,\\<Theta>'\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes valid_ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>'. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  with valid_ctxt\n  have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>'. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    by (simp add: cnvalid_def)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from valid_c [rule_format] ctxt' exec P t_notin_F\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (rule cnvalidD)\nqed\n\nlemma WeakenContext: \n  assumes deriv_c: \"\\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  assumes deriv_ctxt: \"\\<forall>(P,p,Q,A)\\<in>\\<Theta>'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule WeakenContext_sound)\nusing deriv_c\napply (blast intro: hoare_cnvalid)\nusing deriv_ctxt\napply (blast intro: hoare_cnvalid)\ndone\n\nsubsubsection \\<open>Guards and Guarantees\\<close>\n\nlemma SplitGuards_sound:\nassumes valid_c1: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\nassumes valid_c2: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\nassumes c: \"(c\\<^sub>1 \\<inter>\\<^sub>g c\\<^sub>2) = Some c\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case Normal\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    case Abrupt\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    case (Fault f)\n    with exec inter_guards_execn_Fault [OF c]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    then show ?thesis\n    proof (cases rule: disjE [consumes 1])\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      from Fault cnvalidD [OF valid_c1 [rule_format] ctxt this P] t_notin_F\n      show ?thesis\n        by blast\n    next\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      from Fault cnvalidD [OF valid_c2 [rule_format] ctxt this P] t_notin_F\n      show ?thesis\n        by blast\n    qed\n  next\n    case Stuck\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma SplitGuards: \n  assumes c: \"(c\\<^sub>1 \\<inter>\\<^sub>g c\\<^sub>2) = Some c\" \n  assumes deriv_c1: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\" \n  assumes deriv_c2: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule SplitGuards_sound [OF _ _ c])\nusing deriv_c1\napply (blast intro: hoare_cnvalid)\nusing deriv_c2\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma CombineStrip_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes valid_strip: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  hence ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case (Normal t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Normal \n    show ?thesis\n      by auto\n  next\n    case (Abrupt t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Abrupt \n    show ?thesis\n      by auto\n  next\n    case (Fault f)\n    show ?thesis\n    proof (cases \"f \\<in> F\")\n      case True\n      hence \"f \\<notin> -F\" by simp\n      with exec Fault\n      have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards (-F) c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" \n        by (auto intro: execn_to_execn_strip_guards_Fault)\n      from cnvalidD [OF valid_strip [rule_format] ctxt this P] Fault\n      have False\n        by auto\n      thus ?thesis ..\n    next\n      case False\n      with cnvalidD [OF valid [rule_format] ctxt' exec P] Fault\n      show ?thesis\n        by auto\n    qed\n  next\n    case Stuck\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Stuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma CombineStrip: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes deriv_strip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule CombineStrip_sound)\napply  (iprover intro: hoare_cnvalid [OF deriv])\napply (iprover intro: hoare_cnvalid [OF deriv_strip])\ndone\n\nlemma GuardsFlip_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validFlip: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  hence ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  from ctxt have ctxtFlip: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/-F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case (Normal t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Normal \n    show ?thesis\n      by auto\n  next\n    case (Abrupt t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Abrupt \n    show ?thesis\n      by auto\n  next\n    case (Fault f)\n    show ?thesis\n    proof (cases \"f \\<in> F\")\n      case True\n      hence \"f \\<notin> -F\" by simp\n      with cnvalidD [OF validFlip [rule_format] ctxtFlip exec P] Fault\n      have False\n        by auto\n      thus ?thesis ..\n    next\n      case False\n      with cnvalidD [OF valid [rule_format] ctxt' exec P] Fault\n      show ?thesis\n        by auto\n    qed\n  next\n    case Stuck\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Stuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma GuardsFlip: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes derivFlip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule GuardsFlip_sound)\napply  (iprover intro: hoare_cnvalid [OF deriv])\napply (iprover intro: hoare_cnvalid [OF derivFlip])\ndone\n\nlemma MarkGuardsI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_mark_guards_to_execn [OF exec] obtain t' where\n    exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n    t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n    by blast\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from cnvalidD [OF valid [rule_format] ctxt exec_c P]\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by blast\n    with t'_noFault\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma MarkGuardsI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"  \napply (rule hoare_complete')\napply (rule allI)\napply (rule MarkGuardsI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MarkGuardsD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"isFault t\")\n    case True\n    with execn_to_execn_mark_guards_Fault [OF exec ]\n    obtain f' where \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> Fault f'\"\n      by (fastforce elim: isFaultE)\n    from cnvalidD [OF valid [rule_format] ctxt this P]\n    have False\n      by auto\n    thus ?thesis ..\n  next\n    case False\n    from execn_to_execn_mark_guards [OF exec False]\n    obtain f' where \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    from cnvalidD [OF valid [rule_format] ctxt this P]\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma MarkGuardsD: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MarkGuardsD_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MergeGuardsI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  from execn_merge_guards_to_execn [OF exec_merge] \n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" .\n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec P t_notin_F]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma MergeGuardsI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MergeGuardsI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MergeGuardsD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_to_execn_merge_guards [OF exec] \n  have exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\".\n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_merge P t_notin_F]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\n\n\n\nlemma SubsetGuards_sound: \n  assumes c_c': \"c \\<subseteq>\\<^sub>g c'\"\n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c' Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_to_execn_subseteq_guards [OF c_c' exec] obtain t' where\n    exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n    t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n    by blast\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_c' P] t'_noFault t_noFault\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by auto\nqed\n\nlemma SubsetGuards: \n  assumes c_c': \"c \\<subseteq>\\<^sub>g c'\"\n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c' Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule SubsetGuards_sound [OF c_c'])\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma NormalizeD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  hence exec_norm: \"\\<Gamma>\\<turnstile>\\<langle>normalize c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    by (rule execn_to_execn_normalize)\n  assume P: \"s \\<in> P\" \n  assume noFault: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_norm P noFault]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma NormalizeD: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule NormalizeD_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma NormalizeI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume \"\\<Gamma>\\<turnstile>\\<langle>normalize c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  hence exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    by (rule execn_normalize_to_execn)\n  assume P: \"s \\<in> P\" \n  assume noFault: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec P noFault]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma NormalizeI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule NormalizeI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\n\nsubsubsection \\<open>Restricting the Procedure Environment\\<close>\n\nlemma nvalid_restrict_to_nvalid:\nassumes valid_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from execn_to_execn_restrict [OF exec]\n    obtain t' where\n      exec_res: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n      t_Fault: \"\\<forall>f. t = Fault f \\<longrightarrow> t' \\<in> {Fault f, Stuck}\" and\n      t'_notStuck: \"t'\\<noteq>Stuck \\<longrightarrow> t'=t\"\n      by blast\n    from t_Fault t_notin_F t'_notStuck have \"t' \\<notin> Fault ` F\"\n      by (cases t') auto\n    with valid_c exec_res P \n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: nvalid_def)\n    with t'_notStuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma valid_restrict_to_valid:\nassumes valid_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from exec_to_exec_restrict [OF exec]\n    obtain t' where\n      exec_res: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t'\" and\n      t_Fault: \"\\<forall>f. t = Fault f \\<longrightarrow> t' \\<in> {Fault f, Stuck}\" and\n      t'_notStuck: \"t'\\<noteq>Stuck \\<longrightarrow> t'=t\"\n      by blast\n    from t_Fault t_notin_F t'_notStuck have \"t' \\<notin> Fault ` F\"\n      by (cases t') auto\n    with valid_c exec_res P\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: valid_def)\n    with t'_notStuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma augment_procs:\nassumes deriv_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule hoare_complete)\n  apply (rule valid_restrict_to_valid)\n  apply (insert hoare_sound [OF deriv_c])\n  by (simp add: cvalid_def)\n\nlemma augment_Faults:\nassumes deriv_c: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes F: \"F \\<subseteq> F'\"\nshows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F'\\<^esub> P c Q,A\"\n  apply (rule hoare_complete)\n  apply (rule valid_augment_Faults [OF _ F])\n  apply (insert hoare_sound [OF deriv_c])\n  by (simp add: cvalid_def)\n\nend\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/HoarePartialProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5888891451980404, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.31511365623073984}}
{"text": "(*\n * Copyright Florian Haftmann\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\nsection \\<open>Ancient comprehensive Word Library\\<close>\n\ntheory Word_Lib_Sumo\nimports\n  \"HOL-Library.Word\"\n  Aligned\n  Ancient_Numeral\n  Bit_Comprehension\n  Bits_Int\n  Bitwise_Signed\n  Bitwise\n  Enumeration_Word\n  Generic_set_bit\n  Hex_Words\n  Least_significant_bit\n  More_Arithmetic\n  More_Divides\n  More_Sublist\n  Even_More_List\n  More_Misc\n  Strict_part_mono\n  Legacy_Aliases\n  Most_significant_bit\n  Next_and_Prev\n  Norm_Words\n  Reversed_Bit_Lists\n  Rsplit\n  Signed_Words\n  Traditional_Infix_Syntax\n  Typedef_Morphisms\n  Type_Syntax\n  Word_EqI\n  Word_Lemmas\n  Word_8\n  Word_16\n  Word_32\n  Word_Syntax\n  Signed_Division_Word\n  More_Word_Operations\n  Many_More\nbegin\n\ndeclare word_induct2[induct type]\ndeclare word_nat_cases[cases type]\n\ndeclare signed_take_bit_Suc [simp]\n\n(* these generate take_bit terms, which we often don't want for concrete lengths *)\nlemmas of_int_and_nat = unsigned_of_nat unsigned_of_int signed_of_int signed_of_nat\n\nbundle no_take_bit\nbegin\n  declare of_int_and_nat[simp del]\nend\n\nlemmas bshiftr1_def = bshiftr1_eq\nlemmas is_down_def = is_down_eq\nlemmas is_up_def = is_up_eq\nlemmas mask_def = mask_eq\nlemmas scast_def = scast_eq\nlemmas shiftl1_def = shiftl1_eq\nlemmas shiftr1_def = shiftr1_eq\nlemmas sshiftr1_def = sshiftr1_eq\nlemmas sshiftr_def = sshiftr_eq_funpow_sshiftr1\nlemmas to_bl_def = to_bl_eq\nlemmas ucast_def = ucast_eq\nlemmas unat_def = unat_eq_nat_uint\nlemmas word_cat_def = word_cat_eq\nlemmas word_reverse_def = word_reverse_eq_of_bl_rev_to_bl\nlemmas word_roti_def = word_roti_eq_word_rotr_word_rotl\nlemmas word_rotl_def = word_rotl_eq\nlemmas word_rotr_def = word_rotr_eq\nlemmas word_sle_def = word_sle_eq\nlemmas word_sless_def = word_sless_eq\n\nlemmas uint_0 = uint_nonnegative\nlemmas uint_lt = uint_bounded\nlemmas uint_mod_same = uint_idem\nlemmas of_nth_def = word_set_bits_def\n\nlemmas of_nat_word_eq_iff = word_of_nat_eq_iff\nlemmas of_nat_word_eq_0_iff = word_of_nat_eq_0_iff\nlemmas of_int_word_eq_iff = word_of_int_eq_iff\nlemmas of_int_word_eq_0_iff = word_of_int_eq_0_iff\n\nlemmas word_next_def = word_next_unfold\n\nlemmas word_prev_def = word_prev_unfold\n\nlemmas is_aligned_def = is_aligned_iff_dvd_nat\n\nlemma shiftl_transfer [transfer_rule]:\n  includes lifting_syntax\n  shows \"(pcr_word ===> (=) ===> pcr_word) (<<) (<<)\"\n  by (unfold shiftl_eq_push_bit) transfer_prover\n\nlemmas word_and_max_simps =\n  word8_and_max_simp\n  word16_and_max_simp\n  word32_and_max_simp\n\nlemma distinct_lemma: \"f x \\<noteq> f y \\<Longrightarrow> x \\<noteq> y\" by auto\n\nlemmas and_bang = word_and_nth\n\nlemmas sdiv_int_def = signed_divide_int_def\nlemmas smod_int_def = signed_modulo_int_def\n\n(* shortcut for some specific lengths *)\nlemma word_fixed_sint_1[simp]:\n  \"sint (1::8 word) = 1\"\n  \"sint (1::16 word) = 1\"\n  \"sint (1::32 word) = 1\"\n  \"sint (1::64 word) = 1\"\n  by (auto simp: sint_word_ariths)\n\ndeclare of_nat_diff [simp]\n\n(* Haskellish names/syntax *)\nnotation (input)\n  test_bit (\"testBit\")\n\nlemmas cast_simps = cast_simps ucast_down_bl\n\n(* shadows the slightly weaker Word.nth_ucast *)\nlemma nth_ucast:\n  \"(ucast (w::'a::len word)::'b::len word) !! n =\n   (w !! n \\<and> n < min LENGTH('a) LENGTH('b))\"\n  by transfer (simp add: bit_take_bit_iff ac_simps)\n\nend\n", "meta": {"author": "ethereum", "repo": "yul-isabelle", "sha": "4d760a0dabfeab19efc772330be1059021208ad9", "save_path": "github-repos/isabelle/ethereum-yul-isabelle", "path": "github-repos/isabelle/ethereum-yul-isabelle/yul-isabelle-4d760a0dabfeab19efc772330be1059021208ad9/Word_Lib/Word_Lib_Sumo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3151136562307398}}
{"text": "(*\n * Copyright Florian Haftmann\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\nsection \\<open>Ancient comprehensive Word Library\\<close>\n\ntheory Word_Lib_Sumo\nimports\n  \"HOL-Library.Word\"\n  Aligned\n  Bit_Comprehension\n  Bit_Shifts_Infix_Syntax\n  Bits_Int\n  Bitwise_Signed\n  Bitwise\n  Enumeration_Word\n  Generic_set_bit\n  Hex_Words\n  Least_significant_bit\n  More_Arithmetic\n  More_Divides\n  More_Sublist\n  Even_More_List\n  More_Misc\n  Strict_part_mono\n  Legacy_Aliases\n  Most_significant_bit\n  Next_and_Prev\n  Norm_Words\n  Reversed_Bit_Lists\n  Rsplit\n  Signed_Words\n  Syntax_Bundles\n  Typedef_Morphisms\n  Type_Syntax\n  Word_EqI\n  Word_Lemmas\n  Word_8\n  Word_16\n  Word_32\n  Word_Syntax\n  Signed_Division_Word\n  More_Word_Operations\n  Many_More\nbegin\n\nunbundle bit_projection_infix_syntax\n\ndeclare word_induct2[induct type]\ndeclare word_nat_cases[cases type]\n\ndeclare signed_take_bit_Suc [simp]\n\n(* these generate take_bit terms, which we often don't want for concrete lengths *)\nlemmas of_int_and_nat = unsigned_of_nat unsigned_of_int signed_of_int signed_of_nat\n\nbundle no_take_bit\nbegin\n  declare of_int_and_nat[simp del]\nend\n\nlemmas bshiftr1_def = bshiftr1_eq\nlemmas is_down_def = is_down_eq\nlemmas is_up_def = is_up_eq\nlemmas mask_def = mask_eq\nlemmas scast_def = scast_eq\nlemmas shiftl1_def = shiftl1_eq\nlemmas shiftr1_def = shiftr1_eq\nlemmas sshiftr1_def = sshiftr1_eq\nlemmas sshiftr_def = sshiftr_eq_funpow_sshiftr1\nlemmas to_bl_def = to_bl_eq\nlemmas ucast_def = ucast_eq\nlemmas unat_def = unat_eq_nat_uint\nlemmas word_cat_def = word_cat_eq\nlemmas word_reverse_def = word_reverse_eq_of_bl_rev_to_bl\nlemmas word_roti_def = word_roti_eq_word_rotr_word_rotl\nlemmas word_rotl_def = word_rotl_eq\nlemmas word_rotr_def = word_rotr_eq\nlemmas word_sle_def = word_sle_eq\nlemmas word_sless_def = word_sless_eq\n\nlemmas uint_0 = uint_nonnegative\nlemmas uint_lt = uint_bounded\nlemmas uint_mod_same = uint_idem\nlemmas of_nth_def = word_set_bits_def\n\nlemmas of_nat_word_eq_iff = word_of_nat_eq_iff\nlemmas of_nat_word_eq_0_iff = word_of_nat_eq_0_iff\nlemmas of_int_word_eq_iff = word_of_int_eq_iff\nlemmas of_int_word_eq_0_iff = word_of_int_eq_0_iff\n\nlemmas word_next_def = word_next_unfold\n\nlemmas word_prev_def = word_prev_unfold\n\nlemmas is_aligned_def = is_aligned_iff_dvd_nat\n\nlemmas word_and_max_simps =\n  word8_and_max_simp\n  word16_and_max_simp\n  word32_and_max_simp\n\nlemma distinct_lemma: \"f x \\<noteq> f y \\<Longrightarrow> x \\<noteq> y\" by auto\n\nlemmas and_bang = word_and_nth\n\nlemmas sdiv_int_def = signed_divide_int_def\nlemmas smod_int_def = signed_modulo_int_def\n\n(* shortcut for some specific lengths *)\nlemma word_fixed_sint_1[simp]:\n  \"sint (1::8 word) = 1\"\n  \"sint (1::16 word) = 1\"\n  \"sint (1::32 word) = 1\"\n  \"sint (1::64 word) = 1\"\n  by (auto simp: sint_word_ariths)\n\ndeclare of_nat_diff [simp]\n\n(* Haskellish names/syntax *)\nnotation (input)\n  bit (\"testBit\")\n\nlemmas cast_simps = cast_simps ucast_down_bl\n\n(* shadows the slightly weaker Word.nth_ucast *)\nlemma nth_ucast:\n  \"(ucast (w::'a::len word)::'b::len word) !! n =\n   (w !! n \\<and> n < min LENGTH('a) LENGTH('b))\"\n  by (auto simp add: bit_simps not_le dest: bit_imp_le_length)\n\nend\n", "meta": {"author": "zabihullah331", "repo": "barakzai", "sha": "793257c1d71ec75a299fc6b5843af756ead2afb0", "save_path": "github-repos/isabelle/zabihullah331-barakzai", "path": "github-repos/isabelle/zabihullah331-barakzai/barakzai-793257c1d71ec75a299fc6b5843af756ead2afb0/thys/Word_Lib/Word_Lib_Sumo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.315113648509158}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n   Miscellaneous library definitions and lemmas.\n*)\n\nchapter \"Library\"\n\ntheory Lib\nimports Main\nbegin\n\n(* FIXME: eliminate *)\nlemma hd_map_simp:\n  \"b \\<noteq> [] \\<Longrightarrow> hd (map a b) = a (hd b)\"\n  by (rule hd_map)\n\n\n\n(* FIXME: could be added to Set.thy *)\nlemma Collect_eq:\n  \"{x. P x} = {x. Q x} \\<longleftrightarrow> (\\<forall>x. P x = Q x)\"\n  by (rule iffI) auto\n\n(* FIXME: move next to HOL.iff_allI *)\nlemma iff_impI: \"\\<lbrakk>P \\<Longrightarrow> Q = R\\<rbrakk> \\<Longrightarrow> (P \\<longrightarrow> Q) = (P \\<longrightarrow> R)\" by blast\n\ndefinition\n  fun_app :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b\" (infixr \"$\" 10) where\n  \"f $ x \\<equiv> f x\"\n\ndeclare fun_app_def [iff]\n\nlemma fun_app_cong[fundef_cong]:\n  \"\\<lbrakk> f x = f' x' \\<rbrakk> \\<Longrightarrow> (f $ x) = (f' $ x')\"\n  by simp\n\nlemma fun_app_apply_cong[fundef_cong]:\n  \"f x y = f' x' y' \\<Longrightarrow> (f $ x) y = (f' $ x') y'\"\n  by simp\n\nlemma if_apply_cong[fundef_cong]:\n  \"\\<lbrakk> P = P'; x = x'; P' \\<Longrightarrow> f x' = f' x'; \\<not> P' \\<Longrightarrow> g x' = g' x' \\<rbrakk>\n     \\<Longrightarrow> (if P then f else g) x = (if P' then f' else g') x'\"\n  by simp\n\nlemma case_prod_apply_cong[fundef_cong]:\n  \"\\<lbrakk> f (fst p) (snd p) s = f' (fst p') (snd p') s' \\<rbrakk> \\<Longrightarrow> case_prod f p s = case_prod f' p' s'\"\n  by (simp add: split_def)\n\ndefinition\n  pred_conj :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool)\" (infixl \"and\" 35)\nwhere\n  \"pred_conj P Q \\<equiv> \\<lambda>x. P x \\<and> Q x\"\n\ndefinition\n  pred_disj :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool)\" (infixl \"or\" 30)\nwhere\n  \"pred_disj P Q \\<equiv> \\<lambda>x. P x \\<or> Q x\"\n\ndefinition\n  pred_neg :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> bool)\" (\"not _\" [40] 40)\nwhere\n  \"pred_neg P \\<equiv> \\<lambda>x. \\<not> P x\"\n\ndefinition \"K \\<equiv> \\<lambda>x y. x\"\n\ndefinition\n  zipWith :: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'c) \\<Rightarrow> 'a list \\<Rightarrow> 'b list \\<Rightarrow> 'c list\" where\n  \"zipWith f xs ys \\<equiv> map (case_prod f) (zip xs ys)\"\n\nprimrec\n  delete :: \"'a \\<Rightarrow> 'a list \\<Rightarrow> 'a list\"\nwhere\n  \"delete y [] = []\"\n| \"delete y (x#xs) = (if y=x then xs else x # delete y xs)\"\n\nprimrec\n  find :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> 'a option\"\nwhere\n  \"find f [] = None\"\n| \"find f (x # xs) = (if f x then Some x else find f xs)\"\n\ndefinition\n \"swp f \\<equiv> \\<lambda>x y. f y x\"\n\nprimrec (nonexhaustive)\n  theRight :: \"'a + 'b \\<Rightarrow> 'b\" where\n  \"theRight (Inr x) = x\"\n\nprimrec (nonexhaustive)\n  theLeft :: \"'a + 'b \\<Rightarrow> 'a\" where\n  \"theLeft (Inl x) = x\"\n\ndefinition\n \"isLeft x \\<equiv> (\\<exists>y. x = Inl y)\"\n\ndefinition\n \"isRight x \\<equiv> (\\<exists>y. x = Inr y)\"\n\ndefinition\n \"const x \\<equiv> \\<lambda>y. x\"\n\nlemma tranclD2:\n  \"(x, y) \\<in> R\\<^sup>+ \\<Longrightarrow> \\<exists>z. (x, z) \\<in> R\\<^sup>* \\<and> (z, y) \\<in> R\"\n  by (erule tranclE) auto\n\nlemma linorder_min_same1 [simp]:\n  \"(min y x = y) = (y \\<le> (x::'a::linorder))\"\n  by (auto simp: min_def linorder_not_less)\n\nlemma linorder_min_same2 [simp]:\n  \"(min x y = y) = (y \\<le> (x::'a::linorder))\"\n  by (auto simp: min_def linorder_not_le)\n\ntext \\<open>A combinator for pairing up well-formed relations.\n        The divisor function splits the population in halves,\n        with the True half greater than the False half, and\n        the supplied relations control the order within the halves.\\<close>\n\ndefinition\n  wf_sum :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<times> 'a) set \\<Rightarrow> ('a \\<times> 'a) set \\<Rightarrow> ('a \\<times> 'a) set\"\nwhere\n  \"wf_sum divisor r r' \\<equiv>\n     ({(x, y). \\<not> divisor x \\<and> \\<not> divisor y} \\<inter> r')\n   \\<union>  {(x, y). \\<not> divisor x \\<and> divisor y}\n   \\<union> ({(x, y). divisor x \\<and> divisor y} \\<inter> r)\"\n\nlemma wf_sum_wf:\n  \"\\<lbrakk> wf r; wf r' \\<rbrakk> \\<Longrightarrow> wf (wf_sum divisor r r')\"\n  apply (simp add: wf_sum_def)\n  apply (rule wf_Un)+\n      apply (erule wf_Int2)\n     apply (rule wf_subset\n             [where r=\"measure (\\<lambda>x. If (divisor x) 1 0)\"])\n      apply simp\n     apply clarsimp\n    apply blast\n   apply (erule wf_Int2)\n  apply blast\n  done\n\nabbreviation(input)\n \"option_map == map_option\"\n\nlemmas option_map_def = map_option_case\n\nlemma False_implies_equals [simp]:\n  \"((False \\<Longrightarrow> P) \\<Longrightarrow> PROP Q) \\<equiv> PROP Q\"\n  apply (rule equal_intr_rule)\n   apply (erule meta_mp)\n   apply simp\n  apply simp\n  done\n\nlemma split_paired_Ball:\n  \"(\\<forall>x \\<in> A. P x) = (\\<forall>x y. (x,y) \\<in> A \\<longrightarrow> P (x,y))\"\n  by auto\n\nlemma split_paired_Bex:\n  \"(\\<exists>x \\<in> A. P x) = (\\<exists>x y. (x,y) \\<in> A \\<and> P (x,y))\"\n  by auto\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Planarity_Certificates/l4v/lib/Lib.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.315113648509158}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Memcpy\nimports\n  \"../../../c-parser/CTranslation\"\n  \"../../AutoCorres\"\nbegin\n\n(* Helper for noticing when you accidentally haven't constrained an of_nat *)\nabbreviation \"of_nat32 \\<equiv> of_nat::(nat \\<Rightarrow> word32)\"\n\nlemma byte_ptr_guarded:\n    \"ptr_val (x::8 word ptr) \\<noteq> 0 \\<Longrightarrow> c_guard x\"\n  unfolding c_guard_def c_null_guard_def ptr_aligned_def\n  by (clarsimp simp: intvl_Suc)\n\n(* FIXME: MOVE *)\nlemma ptr_add_coerce: \"ptr_val (((ptr_coerce x)::('a::{c_type}) ptr) +\\<^sub>p a) = (ptr_val x) + (of_int a * of_nat (size_of TYPE('a)))\"\n  apply (case_tac x)\n  apply (clarsimp simp: CTypesDefs.ptr_add_def)\n  done\n\n(* FIXME: MOVE *)\n(* Casting a valid pointer to char* and incrementing it by a value less than\n * the size of the underlying type does not give us NULL.\n *)\nlemma ptr_contained:\"\\<lbrakk> c_guard (x::('a::c_type) ptr); size_of TYPE('a) = sz;\n                       0 \\<le> i; i < int sz; (y::8 word ptr) = ptr_coerce x\\<rbrakk> \\<Longrightarrow> c_guard (y +\\<^sub>p i)\"\n  apply (rule byte_ptr_guarded)\n  unfolding c_guard_def c_null_guard_def ptr_add_def\n  apply simp\n  apply (clarsimp simp: CTypesDefs.ptr_add_def intvl_def)\n  apply (erule allE [where x=\"nat i\"])\n  apply (clarsimp simp: nat_less_iff of_nat_nat)\n  done\n\ninstall_C_file \"memcpy.c\"\n\n(* FIXME: MOVE *)\nlemma squash_auxupd_id[polish]:\n  \"modify (t_hrs_'_update (hrs_htd_update id)) = skip\"\n  by (monad_eq simp: skip_def id_def hrs_htd_update_def)\n\nautocorres [no_heap_abs=memcpy memcpy_int] \"memcpy.c\"\n\n(* Dereference a pointer *)\nabbreviation \"deref s x \\<equiv> h_val (hrs_mem (t_hrs_' s)) x\"\n\n(* char* cast *)\nabbreviation \"byte_cast x \\<equiv> ((ptr_coerce x)::8 word ptr)\"\n\ncontext memcpy begin\n\nlemma memcpy_char:\n  \"\\<lbrace> \\<lambda>s. c_guard (x::8 word ptr) \\<and>\n         c_guard (y::8 word ptr) \\<and>\n         unat sz = size_of TYPE(8 word) \\<and>\n         P (deref s x) \\<and>\n         x \\<noteq> y\\<rbrace>\n      memcpy' (ptr_coerce y) (ptr_coerce x) sz\n   \\<lbrace>\\<lambda> _ s. P (deref s y) \\<rbrace>!\"\n  (* Evaluate sz *)\n  apply clarsimp\n\n  unfolding memcpy'_def\n  apply (clarsimp simp:skip_def)\n  apply wp\n\n  (* Unroll the loop twice *)\n  apply (subst whileLoop_unroll, wp)\n     apply (subst whileLoop_unroll, wp)\n\n  (* The remaining loop is never encountered *)\n       apply (rule validNF_false_pre)\n      apply wp\n\n  (* Finally we're left with the single assignment *)\n  apply (clarsimp simp:hrs_mem_update h_val_heap_update)\n  apply unat_arith\n done\n\nlemma of_nat_prop_exp: \"n < 32 \\<Longrightarrow> of_nat (2 ^ n) = 2 ^ (of_nat n)\"\n  by clarsimp\n\nlemma memcpy_word:\n  \"\\<lbrace> \\<lambda>s. c_guard (x::32 word ptr) \\<and>\n         c_guard (y::32 word ptr) \\<and>\n         unat sz = size_of TYPE(32 word) \\<and>\n         P (deref s x) \\<and>\n         x \\<noteq> y \\<rbrace>\n      memcpy' (ptr_coerce y) (ptr_coerce x) sz\n   \\<lbrace> \\<lambda>_ s. P (deref s y) \\<rbrace>!\"\n  apply clarsimp\n  unfolding memcpy'_def apply (clarsimp simp:skip_def)\n  apply (rule validNF_assume_pre)\n  apply (subgoal_tac \"{ptr_val x ..+ unat sz} \\<inter> {ptr_val y ..+ unat sz} = {}\")\n   apply (subst whileLoop_add_inv [where\n     I=\"\\<lambda>i s.  unat i \\<le> unat sz \\<and>\n                (\\<forall>a < i. deref s (byte_cast x +\\<^sub>p uint a) = deref s (byte_cast y +\\<^sub>p uint a)) \\<and>\n                P (deref s x)\" and\n     M=\"\\<lambda>(i, s). unat sz - unat i\"])\n   apply (wp validNF_whileLoop_inv_measure_twosteps)\n      apply clarsimp\n      apply (rule conjI, unat_arith)\n      apply (rule conjI, clarsimp)\n       apply (case_tac \"a = i\")\n        apply (clarsimp)\n        apply (erule_tac x=i in allE)\n        apply (clarsimp simp:hrs_mem_update h_val_heap_update)\n        apply (subst h_val_heap_same)\n            apply (rule ptr_retyp_h_t_valid)\n            apply simp\n           apply (rule ptr_retyp_disjoint)\n            apply (rule ptr_retyp_h_t_valid)\n            apply simp\n           apply (clarsimp simp:ptr_add_def intvl_def CTypesDefs.ptr_add_def)\n          apply simp\n         apply (clarsimp simp: CTypesDefs.ptr_add_def field_of_t_simple)\n         apply (drule field_of_t_simple)\n         apply clarsimp\n        apply simp\n       apply (subgoal_tac \"a < i\")\n        apply (clarsimp simp:hrs_mem_update)\n        apply (subst h_val_heap_update_disjoint)\n\n         (* The current goal should be obvious to unat_arith, but for some reason isn't *)\n         apply (clarsimp simp:ptr_add_def intvl_def disjoint_iff_not_equal)\n         apply (erule_tac x=\"ptr_val x + a\" in allE, clarsimp)\n         apply (erule impE)\n          apply (rule_tac x=\"unat a\" in exI, clarsimp)\n          apply unat_arith\n          \n         apply (erule_tac x=\"ptr_val y + i\" and\n                          P=\"\\<lambda>ya. (\\<exists>k. ya = ptr_val y + of_nat k \\<and> k < 4) \\<longrightarrow> ptr_val y + i \\<noteq> ya\" in allE, clarsimp)\n         apply (erule_tac x=\"unat i\" in allE, clarsimp)\n          apply unat_arith\n         apply (clarsimp simp:CTypesDefs.ptr_add_def)\n        apply (subst h_val_heap_update_disjoint)\n         (* Similar goal to the previous irritation, but this time Isabelle decides to play ball *)\n         apply (clarsimp simp:ptr_add_def intvl_def ptr_val_def disjoint_iff_not_equal)\n        apply (clarsimp simp:CTypesDefs.ptr_add_def)\n       apply (clarsimp simp:CTypesDefs.ptr_add_def)\n      apply unat_arith\n\n      apply (rule conjI)\n       apply (subst hrs_mem_update)+\n       apply (subst h_val_heap_update_disjoint)\n        apply (clarsimp simp: disjoint_iff_not_equal)\n        apply (clarsimp simp:CTypesDefs.ptr_add_def intvl_def)\n        apply (erule_tac x=\"ptr_val x + of_nat k\" in allE)\n        apply (erule impE)\n         apply (rule_tac x=\"k\" in exI)\n         apply simp\n        apply (erule_tac x=\"ptr_val y + i\" and\n                         P=\"\\<lambda>ya. (\\<exists>k. ya = ptr_val y + of_nat k \\<and> k < 4) \\<longrightarrow> ptr_val x + of_nat k \\<noteq> ya\" in allE)\n        apply (erule impE)\n         apply (rule_tac x=\"unat i\" in exI)\n         apply simp\n         apply unat_arith\n        apply simp\n       apply simp\n\n      (* Yet more tedium that unat_arith doesn't like *)\n      apply (rule conjI)\n       apply (rule byte_ptr_guarded,\n              clarsimp simp:CTypesDefs.ptr_add_def c_guard_def c_null_guard_def intvl_def,\n              (erule_tac x=\"unat i\" in allE)+,\n              clarsimp,\n              unat_arith)+\n\n     apply wp\n     apply unat_arith\n    apply clarsimp\n    apply (subgoal_tac \"deref sa x = deref sa y\")\n     apply clarsimp\n    apply (clarsimp simp: h_val_def)[1]\n    apply (rule arg_cong[where f=from_bytes])\n    apply (subst numeral_eqs(3))+\n    apply simp\n    apply (rule_tac x=0 in allE, assumption, erule impE, unat_arith)\n    apply (rule_tac x=1 in allE, assumption, erule impE, unat_arith)\n    apply (rule_tac x=2 in allE, assumption, erule impE, unat_arith)\n    apply (rule_tac x=3 in allE, assumption, erule impE, unat_arith)\n    apply (simp add:CTypesDefs.ptr_add_def)\n    apply (simp add: add.commute from_bytes_eq)\n   apply clarsimp\n  apply (clarsimp simp:intvl_def disjoint_iff_not_equal)\n  apply (drule_tac x=x and y=y and j=\"of_nat k\" and i=\"of_nat ka\" and n=2 in neq_imp_bytes_disjoint)\n        apply assumption\n       apply (case_tac \"k = 0\", clarsimp) (* insert \"k > 0\" *)\n       apply (clarsimp simp:unat_of_nat_len)\n      apply (case_tac \"ka = 0\", clarsimp)\n      apply (clarsimp simp:unat_of_nat_len)\n     apply assumption\n    apply clarsimp+\n  done\n\ntext {* The bytes at the pointer @{term p} are @{term bs}. *}\ndefinition\n  bytes_at :: \"'a globals_scheme \\<Rightarrow> 'b::c_type ptr \\<Rightarrow> word8 list \\<Rightarrow> bool\"\nwhere\n  \"bytes_at s p bs \\<equiv> length bs = 0 \\<or>\n                      (length bs \\<le> UINT_MAX \\<and> (\\<forall>i \\<in> {0..(length bs - 1)}. deref s (byte_cast p +\\<^sub>p (of_nat i)) = bs ! i))\"\n\nlemma bytes_at_none[simp]: \"bytes_at s p []\"\n  by (clarsimp simp:bytes_at_def)\n\ntext {* The bytes of typed pointer @{term p} are @{term bs}. *}\ndefinition\n  bytes_of :: \"'a globals_scheme \\<Rightarrow> 'b::c_type ptr \\<Rightarrow> word8 list \\<Rightarrow> bool\"\nwhere\n  \"bytes_of s p bs \\<equiv> length bs = size_of TYPE('b) \\<and> bytes_at s p bs\"\n\ntext {* The bytes at a char pointer are just it dereferenced. *}\nlemma bytes_of_char[simp]: \"bytes_of s (p::8word ptr) bs = (length bs = 1 \\<and> deref s p = hd bs)\"\n  apply (clarsimp simp:bytes_of_def bytes_at_def)\n  apply (rule iffI)\n   apply clarsimp\n   apply (erule disjE)\n    apply clarsimp+\n   apply (rule hd_conv_nth[symmetric])\n   apply clarsimp+\n  apply (clarsimp simp:UINT_MAX_def)\n  apply (subgoal_tac \"hd bs = bs ! 0\")\n   apply simp\n  apply (rule hd_conv_nth)\n  apply clarsimp\n  done\n\ntext {* A pointer does not wrap around memory. *}\ndefinition\n  no_wrap :: \"'a::c_type ptr \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"no_wrap p sz \\<equiv> 0 \\<notin> {ptr_val p ..+ sz}\"\n\ntext {* Two pointers do not overlap. *}\ndefinition\n  no_overlap :: \"'a::c_type ptr \\<Rightarrow> 'b::c_type ptr \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"no_overlap p q sz \\<equiv> {ptr_val p ..+ sz} \\<inter> {ptr_val q ..+ sz} = {}\"\n\nlemma no_overlap_sym: \"no_overlap x y = no_overlap y x\"\n  apply (rule ext)\n  apply (clarsimp simp:no_overlap_def)\n  by blast\n\n(* FIXME: MOVE *)\nlemma h_val_not_id:\n  fixes x :: \"'a::mem_type ptr\"\n    and y :: \"'b::mem_type ptr\"\n  shows \"{ptr_val x..+size_of TYPE('a)} \\<inter> {ptr_val y..+size_of TYPE('b)} = {}\n     \\<Longrightarrow> h_val (hrs_mem (hrs_mem_update (heap_update x v) s)) y = h_val (hrs_mem s) y\"\n  apply (subst hrs_mem_heap_update[symmetric])\n  apply (subst h_val_heap_update_disjoint)\n   apply blast\n  apply clarsimp\n  done\n\ndefinition\n  update_bytes :: \"'a globals_scheme \\<Rightarrow> 'b::mem_type ptr \\<Rightarrow> word8 list \\<Rightarrow> 'a globals_scheme\"\nwhere\n  \"update_bytes s p bs \\<equiv> s\\<lparr>t_hrs_' := hrs_mem_update (heap_update_list (ptr_val p) bs) (t_hrs_' s)\\<rparr>\"\n\nlemma the_horse_says_neigh: \"(s\\<lparr>t_hrs_' := x\\<rparr> = s\\<lparr>t_hrs_' := y\\<rparr>) = (x = y)\"\n by (metis (erased, lifting) globals.cases_scheme globals.select_convs(1) globals.update_convs(1))\n\nlemma upto_singleton[simp]:\"[x..x] = [x]\"\n  by (simp add: upto_rec1)\n\nlemma update_bytes_ignore_ptr_coerce[simp]: \"update_bytes s (ptr_coerce p) = update_bytes s p\"\n  by (clarsimp simp:update_bytes_def intro!:ext)\n\nlemma hrs_mem_update_commute:\n  \"f \\<circ> g = g \\<circ> f \\<Longrightarrow> hrs_mem_update f (hrs_mem_update g s) = hrs_mem_update g (hrs_mem_update f s)\"\n  by (metis (no_types, lifting) comp_eq_elim hrs_htd_def hrs_htd_mem_update hrs_mem_def hrs_mem_f prod.collapse)\n\nlemma hrs_mem_update_collapse:\n  \"hrs_mem_update f (hrs_mem_update g s) = hrs_mem_update (f \\<circ> g) s\"\n  by (metis comp_eq_dest_lhs hrs_htd_def hrs_htd_mem_update hrs_mem_def hrs_mem_f prod.collapse)\n\nlemma update_bytes_reorder:\n  \"{ptr_val p..+length cs} \\<inter> {ptr_val q..+length bs} = {} \\<Longrightarrow>\n      update_bytes (update_bytes s q bs) p cs = update_bytes (update_bytes s p cs) q bs\"\n  apply (clarsimp simp:update_bytes_def)\n  apply (subst the_horse_says_neigh)\n  apply (subst hrs_mem_update_commute)\n   apply (clarsimp intro!:ext)\n   apply (subst heap_update_list_commute)\n    apply clarsimp+\n  done\n\nlemma lt_step_down: \"\\<lbrakk>(x::nat) < y; x = y - 1 \\<longrightarrow> P; x < y - 1 \\<longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by force\n\n(* XXX: This proof makes me sad. *)\nlemma under_uint_imp_no_overflow: \"x < UINT_MAX \\<Longrightarrow> ((of_nat x)::word32) + 1 \\<noteq> 0\"\n  apply (induct x)\n   apply (clarsimp simp:UINT_MAX_def)+\n  apply unat_arith\n  apply (clarsimp simp:UINT_MAX_def)\n  apply (cut_tac y=x and z=\"(of_nat (UINT_MAX - 1))::word32\" in le_unat_uoi)\n   apply (clarsimp simp:UINT_MAX_def)+\n  done\n\nlemma heap_update_list_append3:\n  \"1 + length ys < 2 ^ word_bits \\<Longrightarrow>\n    heap_update_list s (y # ys) hp = heap_update_list s [y] (heap_update_list (s + 1) ys hp)\"\n  apply clarsimp\n  apply (subst heap_update_list_append2[where xs=\"[y]\", simplified])\n   apply clarsimp+\n  done\n\nlemma hrs_mem_update_cong': \"f = g \\<Longrightarrow> hrs_mem_update f s = hrs_mem_update g s\"\n  by presburger\n\nlemma update_bytes_append: \"length bs \\<le> UINT_MAX \\<Longrightarrow>\n  update_bytes s p (b # bs) = update_bytes (update_bytes s p [b]) (byte_cast p +\\<^sub>p 1) bs\"\n  apply (clarsimp simp:update_bytes_def)\n  apply (subst the_horse_says_neigh)\n  apply (subst hrs_mem_update_commute)\n   apply (rule ext)+\n   apply simp\n   apply (case_tac \"xa = ptr_val p\")\n    apply (clarsimp simp:fun_upd_def)\n    apply (subst heap_update_nmem_same)\n     apply (clarsimp simp:intvl_def ptr_add_def)\n     apply (subgoal_tac \"k < UINT_MAX\")\n      prefer 2\n      apply unat_arith\n     apply (drule under_uint_imp_no_overflow)\n     apply unat_arith\n    apply clarsimp\n   apply (subst heap_update_list_update)\n    apply simp\n   apply (clarsimp simp:fun_upd_def)\n  apply (subst hrs_mem_update_collapse)\n  apply (rule hrs_mem_update_cong')\n  apply (clarsimp simp:ptr_add_def) \n  apply (rule ext)\n  apply (cut_tac xs=\"[b]\" and ys=bs and s=\"ptr_val p\" and hp=x in heap_update_list_append)\n  apply (clarsimp simp:fun_upd_def intro!:ext)\n  apply (rule conjI)\n   apply clarsimp\n   apply (subst heap_update_nmem_same)\n    apply (clarsimp simp:ptr_add_def intvl_def)\n    apply (subgoal_tac \"k < UINT_MAX\")\n     prefer 2\n     apply unat_arith\n    apply (drule under_uint_imp_no_overflow)\n    apply unat_arith\n   apply clarsimp\n  apply clarsimp\n  apply (case_tac \"xa \\<in> {ptr_val p + 1..+length bs}\")\n  apply (subst heap_update_mem_same_point)\n    apply simp\n   apply (subgoal_tac \"addr_card = UINT_MAX + 1\")\n    apply clarsimp\n   apply (clarsimp simp:addr_card UINT_MAX_def)\n  apply (subst heap_update_mem_same_point)\n    apply simp\n   apply (subgoal_tac \"addr_card = UINT_MAX + 1\")\n    apply clarsimp\n   apply (clarsimp simp:addr_card UINT_MAX_def)\n  apply clarsimp\n  apply (subst heap_update_nmem_same)\n   apply clarsimp\n  apply (subst heap_update_nmem_same)\n   apply clarsimp+\n  done\n\nlemma update_bytes_postpend: \"length bs = x + 1 \\<Longrightarrow>\n  update_bytes s p bs = update_bytes (update_bytes s p (take x bs)) (byte_cast p +\\<^sub>p (of_nat x)) [bs ! x]\"\n  apply (clarsimp simp:update_bytes_def)\n  apply (subst the_horse_says_neigh)\n  apply (clarsimp simp:ptr_add_def)\n  apply (subst heap_update_list_concat_fold_hrs_mem)\n   apply clarsimp+\n  by (metis append_eq_conv_conj append_self_conv hd_drop_conv_nth2 lessI take_hd_drop)\n  \nlemma h_val_not_id_general:\n  fixes y :: \"'a::mem_type ptr\"\n  shows \"\\<forall>i \\<in> {0..+size_of TYPE('a)}. \\<forall>g. f g (ptr_val y + i) = g (ptr_val y + i)\n     \\<Longrightarrow> h_val (hrs_mem (hrs_mem_update f s)) y = h_val (hrs_mem s) y\"\n  apply (subst hrs_mem_update)\n  apply (clarsimp simp:h_val_def)\n  apply (subgoal_tac \"heap_list (f (hrs_mem s)) (size_of TYPE('a)) (ptr_val y) =\n                      heap_list (hrs_mem s) (size_of TYPE('a)) (ptr_val y)\")\n   apply clarsimp\n  apply (cut_tac h=\"f (hrs_mem s)\" and p=\"ptr_val y\" and n=\"size_of TYPE('a)\"\n                 and h'=\"hrs_mem s\" in heap_list_h_eq2)\n   apply (erule_tac x=\"x - ptr_val y\" in  ballE)\n    apply clarsimp\n   apply (clarsimp simp:intvl_def)+\n  done\n\nlemma h_val_not_id_list:\n  fixes y :: \"'a::mem_type ptr\"\n  shows \"{x..+length vs} \\<inter> {ptr_val y..+size_of TYPE('a)} = {}\n     \\<Longrightarrow> h_val (hrs_mem (hrs_mem_update (heap_update_list x vs) s)) y = h_val (hrs_mem s) y\"\n  apply (subst h_val_not_id_general)\n   apply clarsimp\n   apply (metis (erased, hide_lams) disjoint_iff_not_equal heap_update_nmem_same intvlD intvlI\n          monoid_add_class.add.left_neutral)\n  apply clarsimp\n  done\n\nlemma h_val_id_update_bytes:\n  fixes q :: \"'a::mem_type ptr\"\n  shows \"{ptr_val q..+size_of TYPE('a)} \\<inter> {ptr_val p..+length bs} = {}\n          \\<Longrightarrow> deref (update_bytes s p bs) q = deref s q\"\n  apply (clarsimp simp:update_bytes_def)\n  apply (subst h_val_not_id_list)\n   apply blast\n  by simp\n\nlemma bytes_at_len: \"bytes_at s p bs \\<Longrightarrow> length bs \\<le> UINT_MAX\"\n  by (clarsimp simp:bytes_at_def, fastforce)\n\n(* Another sad proof. *)\nlemma le_uint_max_imp_id: \"x \\<le> UINT_MAX \\<Longrightarrow> unat ((of_nat x)::word32) = x\"\n  apply (induct x)\n   apply (clarsimp simp:UINT_MAX_def)+\n  apply unat_arith\n  apply clarsimp\n  done\n\nlemma update_bytes_id: \"update_bytes s p [] = s\"\n  apply (clarsimp simp:update_bytes_def)\n  apply (subst heap_update_list_base')\n  by (simp add: hrs_mem_update_id3)\n\nlemma a_horse_by_any_other_name: \"t_hrs_'_update f s = s\\<lparr>t_hrs_' := f (t_hrs_' s)\\<rparr>\"\n  by auto\n\nlemma heap_update_list_singleton: \"heap_update_list p [x] = heap_update (Ptr p) x\"\n  apply (rule ext)\n  by (metis heap_update_def ptr_val.simps to_bytes_word8)\n\nlemma update_bytes_eq: \"\\<lbrakk>s = s'; p = p'; bs = bs'\\<rbrakk> \\<Longrightarrow> update_bytes s p bs = update_bytes s' p' bs'\"\n  by clarsimp\n\ntext {*\n  Memcpy does what it says on the box.\n*}\nlemma memcpy_wp':\n  fixes src :: \"'a::mem_type ptr\"\n    and dst :: \"'b::mem_type ptr\"\n  shows \"\\<forall>s0 bs.\n  \\<lbrace>\\<lambda>s. s = s0 \\<and> c_guard src \\<and> c_guard dst \\<and> sz = of_nat (length bs) \\<and> bytes_at s src bs \\<and>\n       no_wrap src (unat sz) \\<and> no_wrap dst (unat sz) \\<and> no_overlap src dst (unat sz)\\<rbrace>\n    memcpy' (ptr_coerce dst) (ptr_coerce src) sz\n  \\<lbrace>\\<lambda>r s. r = ptr_coerce dst \\<and> bytes_at s dst bs \\<and> s = update_bytes s0 dst bs\\<rbrace>!\"\n  apply (rule allI)+\n  apply (rule validNF_assume_pre)\n  unfolding memcpy'_def\n  apply clarsimp\n  apply (subst whileLoop_add_inv[where\n    I=\"\\<lambda>i s. unat i \\<le> unat sz \\<and>\n             bytes_at s dst (take (unat i) bs) \\<and>\n             bytes_at s src bs \\<and>\n             s = update_bytes s0 dst (take (unat i) bs)\" and\n    M=\"\\<lambda>(i, s). unat sz - unat i\"])\n  apply wp\n    apply clarsimp\n    apply (rule conjI)\n     apply unat_arith\n    apply (rule conjI)\n     apply (simp add:bytes_at_def)\n     apply (case_tac \"bs = []\")\n      apply (rule disjI1)\n      apply clarsimp\n     apply (rule disjI2)\n     apply clarsimp\n     apply (rule conjI)\n      apply unat_arith\n     apply clarsimp\n     apply (case_tac \"unat i = ia\")\n      apply clarsimp\n      apply (subgoal_tac \"int (unat i) = uint i\")\n       prefer 2\n       apply (subst uint_nat)\n       apply simp\n      apply simp\n      apply (subst h_val_id)\n      apply (subst h_val_id_update_bytes)\n       apply (clarsimp simp:no_overlap_def ptr_add_def)\n       apply (subgoal_tac \"{ptr_val src + i..+Suc 0} \\<subseteq> {ptr_val src..+unat (of_nat32 (length bs))}\")\n        prefer 2\n        apply (clarsimp simp:intvl_def)\n        apply (rule_tac x=\"unat i\" in exI)\n        apply unat_arith\n       apply (subgoal_tac \"{ptr_val dst..+unat i} \\<subseteq> {ptr_val dst..+unat (of_nat32 (length bs))}\")\n        prefer 2\n        apply (clarsimp simp:intvl_def)\n        apply (rule_tac x=ka in exI)\n        apply unat_arith\n       apply blast\n      apply (erule_tac x=\"unat i\" and P=\"\\<lambda>x. deref s0 (byte_cast src +\\<^sub>p int x) = bs ! x\" in ballE)\n       apply clarsimp\n       apply (subst nth_take)\n        apply unat_arith\n       apply simp\n      apply (erule disjE)\n       apply clarsimp+\n     apply (erule disjE)\n      apply (subgoal_tac \"length bs \\<noteq> 0\")\n       prefer 2\n       apply clarsimp\n      apply (case_tac \"unat i = 0\")\n       apply unat_arith\n      apply linarith\n     apply (subst h_val_not_id)\n      apply (clarsimp simp:ptr_add_def intvl_def)\n      (* Isabelle, why do you have to make it so hard? *)\n      apply (erule_tac P=\"unat (of_nat ia) = ia\" in notE)\n      apply (cut_tac y=ia and z=\"(of_nat UINT_MAX)::word32\" in le_unat_uoi)\n       apply (subgoal_tac \"unat ((of_nat UINT_MAX)::word32) = UINT_MAX\")\n        prefer 2\n        apply (simp add:UINT_MAX_def)\n       apply unat_arith\n      apply clarsimp\n     apply clarsimp\n     apply (erule_tac x=ia and A=\"{0..min (length bs) (unat i) - Suc 0}\" in ballE)\n      apply clarsimp\n      apply (subst nth_take, unat_arith)+\n      apply simp\n     apply clarsimp\n     apply unat_arith\n    apply (rule conjI)\n     apply (clarsimp simp:bytes_at_def)\n     apply (subst h_val_not_id)\n      apply (clarsimp simp:no_overlap_def)\n      apply (subgoal_tac \"ptr_val (byte_cast dst +\\<^sub>p uint i) \\<in> {ptr_val dst..+unat (of_nat (length bs))}\")\n       prefer 2\n       apply (clarsimp simp:ptr_add_def intvl_def)\n       apply (rule_tac x=\"unat i\" in exI)\n       apply clarsimp\n       apply unat_arith\n      (* More or less symmetric subgoal *)\n      apply (subgoal_tac \"ptr_val (byte_cast src +\\<^sub>p int ia) \\<in> {ptr_val src..+unat ((of_nat (length bs))::word32)}\")\n       prefer 2\n       apply (clarsimp simp:ptr_add_def intvl_def)\n       apply (rule_tac x=ia in exI)\n       apply clarsimp\n       apply (subgoal_tac \"unat ((of_nat (length bs))::word32) = length bs\")\n        apply clarsimp\n        apply arith\n       apply (cut_tac y=\"length bs\" and z=\"(of_nat UINT_MAX)::word32\" in le_unat_uoi)\n        apply (clarsimp simp:UINT_MAX_def)\n       apply arith\n      apply (clarsimp simp:intvl_def ptr_add_def)\n      apply blast\n     apply clarsimp\n    apply (rule conjI)\n     apply (subst h_val_id_update_bytes)\n      apply (clarsimp simp:no_overlap_def ptr_add_def)\n      apply (subgoal_tac \"{ptr_val src + i..+Suc 0} \\<subseteq> {ptr_val src..+unat (of_nat32 (length bs))}\")\n       prefer 2\n       apply (clarsimp simp:intvl_def)\n       apply (rule_tac x=\"unat i\" in exI)\n       apply unat_arith\n      apply (subgoal_tac \"{ptr_val dst..+min (length bs) (unat i)} \\<subseteq> {ptr_val dst..+unat (of_nat32 (length bs))}\")\n       prefer 2\n       apply (clarsimp simp:intvl_def)\n       apply (rule_tac x=ka in exI)\n       apply unat_arith\n      apply blast\n     apply (subgoal_tac \"deref s0 (byte_cast src +\\<^sub>p uint i) = bs ! (unat i)\")\n      apply clarsimp\n      apply (subgoal_tac \"update_bytes s0 dst (take (unat (i + 1)) bs) =\n                          update_bytes (update_bytes s0 dst (take (unat i) bs)) (byte_cast dst +\\<^sub>p uint i) [bs ! unat i]\")\n       apply clarsimp\n       apply (subgoal_tac\n               \"\\<forall>s'. t_hrs_'_update (hrs_mem_update (heap_update (byte_cast dst +\\<^sub>p uint i) (bs ! unat i))) s' =\n                     update_bytes s' (byte_cast dst +\\<^sub>p uint i) [bs ! unat i]\")\n        apply fast\n       apply (clarsimp simp:update_bytes_def)\n       apply (subst a_horse_by_any_other_name)\n       apply (subst the_horse_says_neigh)\n       apply (clarsimp simp:ptr_add_def)\n       apply (subst heap_update_list_singleton)\n       apply simp\n      apply (cut_tac s=s0 and p=dst and bs=\"take (unat (i + 1)) bs\" and x=\"unat i\"\n                     in update_bytes_postpend)\n       apply (subgoal_tac \"unat (i + 1) \\<le> length bs\")\n        apply clarsimp\n        apply unat_arith\n       apply (subgoal_tac \"unat i < length bs\")\n        apply unat_arith\n       apply (rule unat_less_helper)\n       apply simp\n      apply clarsimp\n      apply (rule update_bytes_eq)\n        apply (subgoal_tac \"min (unat i) (unat (i + 1)) = unat i\")\n         apply clarsimp\n        apply clarsimp\n        apply unat_arith\n       apply (clarsimp simp:ptr_add_def)\n      apply clarsimp\n      apply (rule nth_take)\n      apply unat_arith\n     apply (clarsimp simp:bytes_at_def)\n     apply (erule disjE)\n      apply clarsimp\n     apply clarsimp\n     apply (erule_tac x=\"unat i\" in ballE)\n      apply (subst (asm) uint_nat[symmetric])\n      apply simp\n     apply clarsimp\n     apply (subgoal_tac \"unat i < length bs\")\n      prefer 2\n      apply (rule unat_less_helper)\n      apply simp\n     apply unat_arith\n    apply (rule conjI)\n     apply unat_arith\n    apply (rule conjI)\n     apply (rule byte_ptr_guarded)\n     apply (clarsimp simp:no_wrap_def intvl_def ptr_add_def)\n     apply (erule_tac x=\"unat i\" in allE)\n     apply clarsimp\n    apply (rule byte_ptr_guarded)\n    apply (clarsimp simp:no_wrap_def intvl_def ptr_add_def)\n    apply (erule_tac x=\"unat i\" and\n                     P=\"\\<lambda>x. ptr_val dst + ((of_nat x)::word32) = 0 \\<longrightarrow> \\<not> x < unat ((of_nat (length bs))::word32)\"\n                    in allE)\n    apply clarsimp\n   apply clarsimp\n   apply (rule conjI)\n    apply (subgoal_tac \"unat i = length bs\")\n     apply clarsimp\n    apply (case_tac \"length bs = 0\")\n     apply clarsimp\n    apply (subgoal_tac \"length bs \\<le> UINT_MAX\")\n     prefer 2\n     apply (clarsimp simp:bytes_at_def)\n    (* XXX: We keep introducing this subgoal; we should do it once and for all up top. *)\n    apply (subgoal_tac \"unat ((of_nat (length bs))::word32) = length bs\")\n     prefer 2\n     apply (cut_tac y=\"length bs\" and z=\"(of_nat UINT_MAX)::word32\" in le_unat_uoi)\n      apply (clarsimp simp:UINT_MAX_def)\n     apply clarsimp+\n    apply unat_arith\n   (* insert a bunch a tedium... *)\n   apply (subgoal_tac \"unat i = length bs\")\n    prefer 2\n    apply (drule bytes_at_len)\n    apply (subgoal_tac \"unat (of_nat32 (length bs)) = length bs\")\n     prefer 2\n     apply (rule le_uint_max_imp_id)\n     apply simp\n    apply unat_arith\n   apply clarsimp\n  apply (simp add:update_bytes_id)\n  done\n\nlemma validNF_make_schematic_post':\n  \"(\\<forall>s0 x. \\<lbrace> \\<lambda>s. P s0 x s \\<rbrace> f \\<lbrace> \\<lambda>rv s. Q s0 x rv s \\<rbrace>!) \\<Longrightarrow>\n   \\<lbrace> \\<lambda>s. \\<exists>s0 x. P s0 x s \\<and> (\\<forall>rv s'. Q s0 x rv s' \\<longrightarrow> Q' rv s') \\<rbrace> f \\<lbrace> Q'\\<rbrace>!\"\n  by (auto simp add: valid_def validNF_def no_fail_def split: prod.splits)\n\nlemmas memcpy_wp = memcpy_wp'[THEN validNF_make_schematic_post', simplified]\n\nlemma h_val_not_id_update_bytes:\n  fixes q :: \"'a::mem_type ptr\"\n  shows \"\\<lbrakk>ptr_val p = ptr_val q; length bs = size_of TYPE('a)\\<rbrakk> \\<Longrightarrow>\n            deref (update_bytes s p bs) q = from_bytes bs\"\n  apply (clarsimp simp:update_bytes_def h_val_def)\n  apply (subst hrs_mem_update)\n  apply (cut_tac p=\"ptr_val q\" and v=bs and h=\"hrs_mem (t_hrs_' s)\" in heap_list_update)\n   apply clarsimp\n   apply (metis less_imp_le max_size)\n  by clarsimp\n\ntext {*\n  Test that we can use memcpy in a compositional proof. The following proof can be done much more\n  pleasantly, but we're just trying to check that the memcpy WP lemma is usable.\n  TODO: This relies on disabling heap abstraction for the calling function as well. We should be\n  able to phrase an exec_concrete WP lemma over memcpy that lets us prove properties about\n  heap-abstracted callers. This will need AutoCorres support to connect is_valid_* with\n  c_guard/no_overlap/no_wrap.\n*}\n\ndefinition\n  memcpy_int_spec :: \"sword32 ptr \\<Rightarrow> sword32 ptr \\<Rightarrow> bool\"\nwhere\n  \"memcpy_int_spec dst src \\<equiv>\n    \\<forall>x. \\<lbrace>\\<lambda>s. deref s src = x \\<and>\n             {ptr_val src..+4} \\<inter> {ptr_val dst..+4} = {} \\<and>\n             c_guard src \\<and> c_guard dst \\<and>\n             no_wrap src 4 \\<and> no_wrap dst 4\\<rbrace>\n          memcpy_int' dst src\n        \\<lbrace>\\<lambda>_ s. deref s dst = x\\<rbrace>!\"\n\nlemma memcpy_int_wp'[unfolded memcpy_int_spec_def]: \"memcpy_int_spec dst src\"\n  unfolding memcpy_int_spec_def\n  apply (rule allI)\n  unfolding memcpy_int'_def\n  apply (wp memcpy_wp)\n  apply clarsimp\n  apply (rule_tac x=\"[deref s (byte_cast src),\n                      deref s (byte_cast src +\\<^sub>p 1),\n                      deref s (byte_cast src +\\<^sub>p 2),\n                      deref s (byte_cast src +\\<^sub>p 3)]\" in exI)\n  apply (clarsimp simp:bytes_at_def no_overlap_def UINT_MAX_def)\n  apply (rule conjI)\n   apply clarsimp\n   apply (case_tac \"i = 0\", clarsimp)\n   apply (case_tac \"i = 1\", clarsimp)\n   apply (case_tac \"i = 2\", clarsimp)\n   apply (case_tac \"i = 3\", clarsimp)\n   apply clarsimp\n  apply clarsimp\n  apply (subst h_val_not_id_update_bytes)\n    apply clarsimp+\n  apply (clarsimp simp:h_val_def)\n  apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 4 (ptr_val src) = \n                      deref s (byte_cast src) # (heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1))\")\n   prefer 2\n   apply (clarsimp simp:h_val_def)\n   apply (metis Suc_numeral from_bytes_eq heap_list_rec semiring_norm(2) semiring_norm(8))\n  apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1) = \n                      deref s (byte_cast src +\\<^sub>p 1) # (heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2))\")\n   prefer 2\n   apply (clarsimp simp:h_val_def ptr_add_def)\n   apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 1\" and n=2 in heap_list_rec)\n   apply clarsimp\n   apply (simp add: add.commute from_bytes_eq)\n  apply clarsimp\n  apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2) = \n                      deref s (byte_cast src +\\<^sub>p 2) # (heap_list (hrs_mem (t_hrs_' s)) 1 (ptr_val src + 3))\")\n   prefer 2\n   apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 2\" and n=3 in heap_list_rec)\n   apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n   apply (metis (no_types, hide_lams) Suc_eq_plus1 heap_list_base heap_list_rec is_num_normalize(1)\n                monoid_add_class.add.left_neutral one_add_one one_plus_numeral semiring_norm(3))\n  apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n  done\n\ntext {* memcpying a typed variable is equivalent to assignment. *}\nlemma memcpy_type_wp':\n  fixes dst :: \"'a::mem_type ptr\"\n    and src :: \"'a::mem_type ptr\"\n  shows \"\\<forall>s0 bs.\n   \\<lbrace>\\<lambda>s. s = s0 \\<and> c_guard dst \\<and> c_guard src \\<and> sz = of_nat (size_of TYPE('a)) \\<and>\n        no_overlap dst src (unat sz) \\<and> no_wrap dst (unat sz) \\<and> no_wrap src (unat sz) \\<and>\n        bytes_of s src bs\\<rbrace>\n     memcpy' (ptr_coerce dst) (ptr_coerce src) sz\n   \\<lbrace>\\<lambda>r s. r = ptr_coerce dst \\<and> bytes_of s dst bs \\<and> s = update_bytes s0 dst bs\\<rbrace>!\"\n  apply (rule allI)+\n  apply (wp memcpy_wp)\n  apply clarsimp\n  apply (rule_tac x=bs in exI)\n  apply clarsimp\n  apply (subst no_overlap_sym)\n  apply (clarsimp simp:bytes_of_def)\n  done\n\nlemmas memcpy_type_wp = memcpy_type_wp'[THEN validNF_make_schematic_post', simplified]\n\ntext {* Confirm that we can also prove memcpy_int using the previous generic lemma. *}\nlemma memcpy_int_wp''[unfolded memcpy_int_spec_def]: \"memcpy_int_spec dst src\"\n  unfolding memcpy_int_spec_def memcpy_int'_def\n  apply (rule allI)\n  apply (wp memcpy_type_wp)\n  (* Remainder mostly clagged from the original proof above. *)\n  apply clarsimp\n  apply (rule conjI, clarsimp simp:no_overlap_def, blast)\n  apply (rule_tac x=\"[deref s (byte_cast src),\n                      deref s (byte_cast src +\\<^sub>p 1),\n                      deref s (byte_cast src +\\<^sub>p 2),\n                      deref s (byte_cast src +\\<^sub>p 3)]\" in exI)\n  apply (rule conjI)\n   apply (clarsimp simp:bytes_of_def bytes_at_def UINT_MAX_def)\n   apply (case_tac \"i = 0\", clarsimp)\n   apply (case_tac \"i = 1\", clarsimp)\n   apply (case_tac \"i = 2\", clarsimp)\n   apply (case_tac \"i = 3\", clarsimp)\n   apply clarsimp\n  apply clarsimp\n  apply (subst h_val_not_id_update_bytes, clarsimp+)\n  apply (clarsimp simp:h_val_def)\n  apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 4 (ptr_val src) = \n                      deref s (byte_cast src) # (heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1))\")\n   prefer 2\n   apply (clarsimp simp:h_val_def from_bytes_eq)\n   apply (subst heap_list_rec[symmetric])\n   apply simp\n  apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 3 (ptr_val src + 1) = \n                      deref s (byte_cast src +\\<^sub>p 1) # (heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2))\")\n   prefer 2\n   apply (clarsimp simp:h_val_def ptr_add_def)\n   apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 1\" and n=2 in heap_list_rec)\n   apply (clarsimp simp: from_bytes_eq)\n   apply (metis add.commute)\n  apply clarsimp\n  apply (subgoal_tac \"heap_list (hrs_mem (t_hrs_' s)) 2 (ptr_val src + 2) = \n                      deref s (byte_cast src +\\<^sub>p 2) # (heap_list (hrs_mem (t_hrs_' s)) 1 (ptr_val src + 3))\")\n   prefer 2\n   apply (cut_tac h=\"hrs_mem (t_hrs_' s)\" and p=\"ptr_val src + 2\" and n=3 in heap_list_rec)\n   apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n   apply (metis (no_types, hide_lams) Suc_eq_plus1 heap_list_base heap_list_rec is_num_normalize(1)\n                monoid_add_class.add.left_neutral one_add_one one_plus_numeral semiring_norm(3))\n  apply (clarsimp simp:h_val_def ptr_add_def from_bytes_eq)\n  done\n\nlemma bytes_of_imp_at[simp]: \"bytes_of s x bs \\<Longrightarrow> bytes_at s x bs\"\n  by (clarsimp simp:bytes_of_def bytes_at_def)\n\nlemma bytes_at_imp_of:\n  fixes x :: \"'a::mem_type ptr\"\n  shows \"\\<lbrakk>bytes_at s x bs; length bs = size_of TYPE('a)\\<rbrakk> \\<Longrightarrow> bytes_of s x bs\"\n  by (clarsimp simp:bytes_of_def bytes_at_def)\n\ntext {*\n  Memcpying from a source to a destination via an intermediary does what it should. This is close to\n  the desirable property we want for CAmkES systems; i.e. that copying into your IPC buffer on one\n  side and then out on the other gives you back what you put in. Note that the type of the\n  intermediate pointer is irrelevant and we don't need to assume that the source and final\n  destination do not overlap.\n*}\nlemma memcpy_seq:\n  fixes x :: \"'a::mem_type ptr\"\n    and y :: \"'b::mem_type ptr\"\n    and z :: \"'a::mem_type ptr\"\n  shows \"\\<forall>s0 bs.\n   \\<lbrace>\\<lambda>s. s = s0 \\<and> sz = of_nat (size_of TYPE('a)) \\<and>\n        c_guard x \\<and> c_guard y \\<and> c_guard z \\<and>\n        no_wrap x (unat sz) \\<and> no_wrap y (unat sz) \\<and> no_wrap z (unat sz) \\<and>\n        no_overlap x y (unat sz) \\<and> no_overlap y z (unat sz) \\<and>\n        bytes_of s x bs\\<rbrace>\n    do memcpy' (ptr_coerce y) (ptr_coerce x) sz;\n       memcpy' (ptr_coerce z) (ptr_coerce y) sz\n    od\n   \\<lbrace>\\<lambda>r s. r = ptr_coerce z \\<and> bytes_of s z bs\\<rbrace>!\"\n  apply (rule allI)+\n  apply (wp memcpy_wp)\n  apply clarsimp\n  apply (rule_tac x=bs in exI)\n  apply clarsimp\n  apply (rule conjI, clarsimp simp:bytes_of_def)\n  apply clarsimp\n  apply (rule_tac x=bs in exI)\n  apply (rule conjI, clarsimp simp:bytes_of_def)\n  apply clarsimp\n  apply (rule bytes_at_imp_of)\n   apply (clarsimp simp:bytes_of_def)+\n  done\n\nlemma update_ti_eq:\n  fixes x :: \"'a::mem_type\"\n    and y :: 'a\n  shows \"\\<lbrakk>length bs = size_of TYPE('a); bs = bs'\\<rbrakk>\n          \\<Longrightarrow> update_ti_t (typ_info_t TYPE('a)) bs x = update_ti_t (typ_info_t TYPE('a)) bs' y\"\n  by (clarsimp simp:upd)\n\nlemma from_bytes_cong: \"x = y \\<Longrightarrow> from_bytes x = from_bytes y\"\n  by simp\n\ndeclare from_bytes_eq [simp]\n\ntext {*\n  If you dereference a pointer, the value you get is the same as the underlying bytes backing that\n  memory.\n*}\nlemma val_eq_bytes:\n  fixes x :: \"'a::mem_type ptr\"\n  shows \"deref s x = from_bytes (map (\\<lambda>off. deref s (byte_cast x +\\<^sub>p of_nat off)) [0..<size_of TYPE('a)])\"\n  apply (clarsimp simp:h_val_def ptr_add_def)\n  apply (rule from_bytes_cong)\n  apply (rule nth_equalityI)\n   apply clarsimp+\n  apply (subst heap_list_nth)\n   apply clarsimp+\n  done\n\nlemma extract_list_elem: \"i < n \\<Longrightarrow> f i = (map f [0..<n]) ! i\"\n  apply (induct i)\n   apply clarsimp+\n  done\n\nlemma update_deref:\n  fixes x :: \"'a::mem_type ptr\"\n  shows \"size_of TYPE('a) = length bs \\<Longrightarrow> deref (update_bytes s x bs) x = from_bytes bs\"\n  apply (clarsimp simp:update_bytes_def)\n  apply (subst hrs_mem_update)\n  apply (clarsimp simp:h_val_def)\n  apply (subst heap_list_update)\n   apply (metis less_imp_le max_size)\n  apply clarsimp\n  done\n\ntext {*\n  The memcpy_int proof can now be completed more elegantly. Note that the body of this proof is more\n  generic than the previous attempts and doesn't involve manually reasoning about each byte.\n*}\nlemma memcpy_int_wp'''[unfolded memcpy_int_spec_def]: \"memcpy_int_spec dst src\"\n  unfolding memcpy_int_spec_def memcpy_int'_def\n  apply (rule allI)\n  apply (wp memcpy_type_wp)\n  apply clarsimp\n  apply (rule conjI, clarsimp simp:no_overlap_def, blast)\n  apply (rule_tac x=\"map (\\<lambda>i. deref s (byte_cast src +\\<^sub>p of_nat i)) [0..<size_of TYPE(32sword)]\" in exI)\n  apply (rule conjI)\n   apply (clarsimp simp:bytes_of_def bytes_at_def UINT_MAX_def)+\n  apply (subst update_deref)\n   apply clarsimp\n  apply (cut_tac s=s and x=src in val_eq_bytes)\n  apply clarsimp\n  done\n\nlemma bytes_at_heap_list:\n  fixes x :: \"'a::mem_type ptr\"\n  shows \"\\<lbrakk>n \\<le> UINT_MAX; no_wrap x n\\<rbrakk>\n          \\<Longrightarrow> bytes_at s x (heap_list (hrs_mem (t_hrs_' s)) n (ptr_val x))\"\n  apply (clarsimp simp:bytes_at_def ptr_add_def h_val_def)\n  apply (subst heap_list_nth)\n   apply unat_arith\n  apply clarsimp\n  done\n\ntext {*\n  A collection of useful type-generic implications for moving from the abstract heap to the concrete\n  heap.\n*}\ndefinition\n  is_valid_imp_c_guard :: \"(lifted_globals \\<Rightarrow> 'b::mem_type ptr \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n  \"is_valid_imp_c_guard is_valid \\<equiv> \\<forall>s p. is_valid (lift_global_heap s) p \\<longrightarrow> c_guard p\"\ndefinition\n  is_valid_imp_no_null :: \"(lifted_globals \\<Rightarrow> 'b::mem_type ptr \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n  \"is_valid_imp_no_null is_valid \\<equiv>\n     \\<forall>s p. is_valid (lift_global_heap s) p \\<longrightarrow> 0 \\<notin> {ptr_val p..of_nat (size_of TYPE('b))}\"\ndefinition\n  is_valid_imp_no_wrap :: \"(lifted_globals \\<Rightarrow> 'b::mem_type ptr \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n  \"is_valid_imp_no_wrap is_valid \\<equiv>\n     \\<forall>s p. is_valid (lift_global_heap s) p \\<longrightarrow> no_wrap p (size_of TYPE('b))\"\ndefinition\n  is_valid_imp_no_overlap :: \"(lifted_globals \\<Rightarrow> 'b::mem_type ptr \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n  \"is_valid_imp_no_overlap is_valid \\<equiv>\n     \\<forall>s p q. is_valid (lift_global_heap s) p \\<and> is_valid (lift_global_heap s) q \\<and> p \\<noteq> q\n               \\<longrightarrow> no_overlap p q (size_of TYPE('b))\"\ndefinition\n  is_valid_imp_heap_ptr_valid :: \"(lifted_globals \\<Rightarrow> 'b::mem_type ptr \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n  \"is_valid_imp_heap_ptr_valid is_valid \\<equiv>\n     \\<forall>s p. is_valid (lift_global_heap s) p \\<longrightarrow> heap_ptr_valid (hrs_htd (t_hrs_' s)) p\"\n\ntext {* We can easily discharge these for a given type. *}\nlemma is_valid_w32_imp_c_guard[unfolded is_valid_imp_c_guard_def, simplified]:\n    \"is_valid_imp_c_guard is_valid_w32\"\n  unfolding is_valid_imp_c_guard_def\n  apply clarsimp\n  apply (subst (asm) lifted_globals_ext_simps)\n  apply clarsimp\n  apply (rule simple_lift_c_guard, force)\n  done\n\nlemma is_valid_w32_imp_no_null[unfolded is_valid_imp_no_null_def, simplified]:\n    \"is_valid_imp_no_null is_valid_w32\"\n  unfolding is_valid_imp_no_null_def\n  apply clarsimp\n  apply (subst (asm) lifted_globals_ext_simps)\n  apply clarsimp\n  apply (drule simple_lift_c_guard)\n  apply (clarsimp simp:c_guard_def c_null_guard_def intvl_def)\n  by force\n\nlemma is_valid_w32_imp_no_wrap[unfolded is_valid_imp_no_wrap_def, simplified]:\n    \"is_valid_imp_no_wrap is_valid_w32\"\n  unfolding is_valid_imp_no_wrap_def no_wrap_def\n  apply clarsimp\n  apply (subst (asm) lifted_globals_ext_simps)\n  apply clarsimp\n  apply (drule simple_lift_c_guard)\n  apply (clarsimp simp:c_guard_def c_null_guard_def intvl_def)\n  done\n\nlemma is_valid_w32_imp_no_overlap[unfolded is_valid_imp_no_overlap_def, simplified]:\n    \"is_valid_imp_no_overlap is_valid_w32\"\n  unfolding is_valid_imp_no_overlap_def no_wrap_def\n  apply clarsimp\n  apply (subst (asm) lifted_globals_ext_simps)+\n  apply clarsimp\n  apply (drule simple_lift_heap_ptr_valid)+\n  apply (clarsimp simp:no_overlap_def)\n  apply (cut_tac p=p and q=q and d=\"hrs_htd (t_hrs_' s)\" in heap_ptr_valid_neq_disjoint)\n     apply clarsimp+\n  done\n\nlemma is_valid_w32_imp_heap_ptr_valid[unfolded is_valid_imp_heap_ptr_valid_def, simplified]:\n    \"is_valid_imp_heap_ptr_valid is_valid_w32\"\n  unfolding is_valid_imp_heap_ptr_valid_def\n  apply clarsimp\n  apply (subst (asm) lifted_globals_ext_simps)\n  apply clarsimp\n  by (rule simple_lift_heap_ptr_valid, force)\n\ntext {*\n  With that support in place, we can now prove a heap-abstracted call to memcpy of a type in a\n  reasonably generic way. Note that we leverage the relationship between\n  is_valid_*/lift_global_heap/simple_lift to transfer assumptions across the boundary between the\n  abstract and concrete heaps.\n*}\nlemma\n  fixes dst :: \"32word ptr\"\n    and src :: \"32word ptr\"\n  shows \"\\<forall>s0 x.\n   \\<lbrace>\\<lambda>s. s = s0 \\<and> is_valid_w32 s dst \\<and> is_valid_w32 s src \\<and> sz = of_nat (size_of TYPE(32word)) \\<and>\n        heap_w32 s src = x \\<and> dst \\<noteq> src\\<rbrace>\n     exec_concrete lift_global_heap (memcpy' (ptr_coerce dst) (ptr_coerce src) sz)\n   \\<lbrace>\\<lambda>r s. r = ptr_coerce dst \\<and> heap_w32 s dst = x\\<rbrace>!\"\n  apply (rule allI)+\n  apply (wp memcpy_wp)\n  apply (clarsimp simp:is_valid_w32_imp_c_guard\n                       is_valid_w32_imp_no_wrap\n                       is_valid_w32_imp_no_overlap)\n  apply (rule_tac x=\"map (\\<lambda>i. deref s (byte_cast src +\\<^sub>p of_nat i)) [0..<size_of TYPE(32word)]\" in exI)\n  apply clarsimp\n  apply (rule conjI)\n   apply (clarsimp simp:bytes_at_def UINT_MAX_def)\n  apply clarsimp\n  apply (subst lifted_globals_ext_simps(3))+\n  apply (clarsimp simp:simple_lift_def is_valid_w32_imp_heap_ptr_valid)\n  apply (rule conjI)\n   apply clarsimp\n   apply (subst update_deref)\n    apply clarsimp+\n   apply (cut_tac s=s and x=src in val_eq_bytes)\n   apply clarsimp\n  apply (clarsimp simp:update_bytes_def is_valid_w32_imp_heap_ptr_valid)\n  done\n\ntext {*\n  Let's do the same instantiation for a structure. Note that the proof text for the following lemmas\n  is identical to the word 32 instantiation above. These could be straightforwardly abstracted into\n  a locale which could be automatically interpreted with the use of generated proofs.\n*}\nlemma is_valid_my_structure_imp_c_guard[unfolded is_valid_imp_c_guard_def, simplified]:\n    \"is_valid_imp_c_guard is_valid_my_structure_C\"\n  unfolding is_valid_imp_c_guard_def\n  apply clarsimp\n  apply (subst (asm) lifted_globals_ext_simps)\n  apply clarsimp\n  apply (rule simple_lift_c_guard, force)\n  done\n\nlemma is_valid_my_structure_imp_no_null[unfolded is_valid_imp_no_null_def, simplified]:\n    \"is_valid_imp_no_null is_valid_my_structure_C\"\n  unfolding is_valid_imp_no_null_def\n  apply clarsimp\n  apply (subst (asm) lifted_globals_ext_simps)\n  apply clarsimp\n  apply (drule simple_lift_c_guard)\n  apply (clarsimp simp:c_guard_def c_null_guard_def intvl_def)\n  by force\n\nlemma is_valid_my_structure_imp_no_wrap[unfolded is_valid_imp_no_wrap_def, simplified]:\n    \"is_valid_imp_no_wrap is_valid_my_structure_C\"\n  unfolding is_valid_imp_no_wrap_def no_wrap_def\n  apply clarsimp\n  apply (subst (asm) lifted_globals_ext_simps)\n  apply clarsimp\n  apply (drule simple_lift_c_guard)\n  apply (clarsimp simp:c_guard_def c_null_guard_def intvl_def)\n  done\n\nlemma is_valid_my_structure_imp_no_overlap[unfolded is_valid_imp_no_overlap_def, simplified]:\n    \"is_valid_imp_no_overlap is_valid_my_structure_C\"\n  unfolding is_valid_imp_no_overlap_def no_wrap_def\n  apply clarsimp\n  apply (subst (asm) lifted_globals_ext_simps)+\n  apply clarsimp\n  apply (drule simple_lift_heap_ptr_valid)+\n  apply (clarsimp simp:no_overlap_def)\n  apply (cut_tac p=p and q=q and d=\"hrs_htd (t_hrs_' s)\" in heap_ptr_valid_neq_disjoint)\n     apply clarsimp+\n  done\n\nlemma is_valid_my_structure_imp_heap_ptr_valid[unfolded is_valid_imp_heap_ptr_valid_def, simplified]:\n    \"is_valid_imp_heap_ptr_valid is_valid_my_structure_C\"\n  unfolding is_valid_imp_heap_ptr_valid_def\n  apply clarsimp\n  apply (subst (asm) lifted_globals_ext_simps)\n  apply clarsimp\n  by (rule simple_lift_heap_ptr_valid, force)\n\ntext {*\n  Again, we can now trivially transfer Hoare triple properties.\n*}\nlemma\n  fixes dst :: \"my_structure_C ptr\"\n    and src :: \"my_structure_C ptr\"\n  shows \"\\<forall>s0 x.\n   \\<lbrace>\\<lambda>s. s = s0 \\<and> is_valid_my_structure_C s dst \\<and> is_valid_my_structure_C s src \\<and>\n        heap_my_structure_C s src = x \\<and> dst \\<noteq> src\\<rbrace>\n     memcpy_struct' dst src\n   \\<lbrace>\\<lambda>r s. r = dst \\<and> heap_my_structure_C s dst = x\\<rbrace>!\"\n  apply (rule allI)+\n  unfolding memcpy_struct'_def\n  apply (wp memcpy_wp)\n  apply (clarsimp simp:is_valid_my_structure_imp_c_guard)\n  apply (rule_tac x=\"map (\\<lambda>i. deref s (byte_cast src +\\<^sub>p of_nat i)) [0..<size_of TYPE(my_structure_C)]\" in exI)\n  apply (clarsimp simp:is_valid_my_structure_imp_no_wrap is_valid_my_structure_imp_no_overlap)\n  apply (rule conjI)\n   apply (clarsimp simp:bytes_at_def UINT_MAX_def)\n  apply clarsimp\n  apply (subst lifted_globals_ext_simps)+\n  apply (clarsimp simp:simple_lift_def is_valid_my_structure_imp_heap_ptr_valid)\n  apply (rule conjI)\n   apply clarsimp\n   apply (subst update_deref)\n    apply clarsimp\n   apply (cut_tac s=s and x=src in val_eq_bytes)\n   apply clarsimp\n  apply (clarsimp simp:update_bytes_def is_valid_my_structure_imp_heap_ptr_valid)\n  done\n\nend\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/autocorres/tests/examples/Memcpy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056040203135, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.3151069007126393}}
{"text": "theory ExpandLogicPhase\n  imports Canonicalizations.Common\nbegin\n\nphase ExpandLogicPhase\n  terminating size\nbegin\n\nlemma ExpandShortCircuitVal:\n  assumes \"x \\<noteq> UndefVal \\<and> y \\<noteq> UndefVal\"\n  assumes \"val[(x || y)] \\<noteq> UndefVal\"\n  shows \"val[((x || y) ? t : f)] = val[(x ? t : (y ? t : f))]\"\n  using assms apply (cases x; cases y; auto)\n  using or_eq_0_iff by blast+\n\noptimization ExpandShortCircuit:\n  \"((x || y) ? t : f) \\<longmapsto> (x ? t : (y ? t : f))\"\n  defer apply simp\n  using ExpandShortCircuitVal \n  apply (smt (verit, ccfv_threshold) ConditionalExpr ConditionalExprE bin_eval.simps(7) evaltree_not_undef intval_conditional.elims unfold_binary)\n  sorry\n\n\nlemma swap_branches:\n  assumes \"x \\<noteq> UndefVal \\<and> \\<not>x \\<noteq> UndefVal\"\n  shows \"val[(\\<not>x) ? t : f] = val[x ? f : t]\"\n  using assms\n  by simp\n\n\noptimization ExpandShortCircuitXNeg:\n  \"(((\\<not>x) || y) ? t : f) \\<longmapsto> (x ? (y ? t : f) : t)\"\n  defer apply simp\n  apply (rule allI)+ apply (rule impI)\n  using ExpandShortCircuit(1) unfolding rewrite_preservation.simps le_expr_def\n  \n  using swap_branches\n  sorry\n  \n  (*apply (smt (verit, ccfv_threshold) ConditionalExpr ConditionalExprE ExpandShortCircuit(1) intval_logic_negation.elims le_expr_def rewrite_preservation.simps(1) unary_eval.simps(4) unfold_unary val_to_bool.simps(1) val_to_bool.simps(2) zero_neq_one)\n  sorry*)\n\noptimization ExpandShortCircuitYNeg:\n  \"((x || (\\<not>y)) ? t : f) \\<longmapsto> (x ? t : (y ? f : t))\"\n  defer apply simp\n  apply (rule allI)+ apply (rule impI)\n  using ExpandShortCircuitVal\n  sorry\n\noptimization ExpandShortCircuitXYNeg:\n  \"(((\\<not>x) || (\\<not>y)) ? t : f) \\<longmapsto> (x ? (y ? f : t) : t)\"\n  defer apply simp\n  apply (rule allI)+ apply (rule impI)\n  using ExpandShortCircuitVal swap_branches \n  sorry\n\nend\n\nend", "meta": {"author": "uqcyber", "repo": "veriopt-releases", "sha": "4ffab3c91bbd699772889dbf263bb6d2582256d7", "save_path": "github-repos/isabelle/uqcyber-veriopt-releases", "path": "github-repos/isabelle/uqcyber-veriopt-releases/veriopt-releases-4ffab3c91bbd699772889dbf263bb6d2582256d7/Optimizations/Phases/ExpandLogicPhase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.5, "lm_q1q2_score": 0.31488731065087294}}
{"text": "section \\<open>Rewriting\\<close>\ntheory Rewriting\n  imports Terms_Positions\nbegin\n\nsubsection \\<open>Basic rewrite definitions\\<close>\n\nsubsubsection \\<open>Rewrite steps with implicit signature declaration (encoded in the type)\\<close>\n\ninductive_set rrstep :: \"('f, 'v) term rel \\<Rightarrow> ('f, 'v) term rel\" for \\<R> where\n  [intro]: \"(l, r) \\<in> \\<R> \\<Longrightarrow> (l \\<cdot> \\<sigma>, r \\<cdot> \\<sigma>) \\<in> rrstep \\<R>\"\n\ninductive_set rstep :: \"('f, 'v) term rel \\<Rightarrow> ('f, 'v) term rel\" for \\<R> where\n  \"(s, t) \\<in> rrstep \\<R> \\<Longrightarrow> (C\\<langle>s\\<rangle>, C\\<langle>t\\<rangle>) \\<in> rstep \\<R>\"\n\n\nsubsubsection \\<open>Restrict relations to terms induced by a given signature\\<close>\n\ndefinition \"sig_step \\<F> \\<R> = Restr \\<R> (Collect (\\<lambda> s. funas_term s \\<subseteq> \\<F>))\"\n\nsubsubsection \\<open>Rewriting under a given signature/restricted to ground terms\\<close>\n\nabbreviation \"srrstep \\<F> \\<R> \\<equiv> sig_step \\<F> (rrstep \\<R>)\"\nabbreviation \"srstep \\<F> \\<R> \\<equiv> sig_step \\<F> (rstep \\<R>)\"\nabbreviation \"gsrstep \\<F> \\<R> \\<equiv> Restr (sig_step \\<F> (rstep \\<R>)) (Collect ground)\"\n\n\nsubsubsection \\<open>Rewriting sequences involving a root step\\<close>\n\nabbreviation (input) relto :: \"'a rel \\<Rightarrow> 'a rel \\<Rightarrow> 'a rel\" where\n  \"relto R S \\<equiv> S^* O R O S^*\"\ndefinition \"srsteps_with_root_step \\<F> \\<R> \\<equiv> relto (sig_step \\<F> (rrstep \\<R>)) (srstep \\<F> \\<R>)\"\n\n\nsubsection \\<open>Monotonicity laws\\<close>\n\nlemma Restr_mono: \"Restr r A \\<subseteq> r\" by auto\n\nlemma Restr_trancl_mono_set: \"(Restr r A)\\<^sup>+ \\<subseteq> A \\<times> A\"\n  by (simp add: trancl_subset_Sigma)\n\nlemma rrstep_rstep_mono: \"rrstep \\<R> \\<subseteq> rstep \\<R>\"\n  by (auto intro: rstep.intros[where ?C = \\<box>, simplified])\n\nlemma sig_step_mono:\n  \"\\<F> \\<subseteq> \\<G> \\<Longrightarrow> sig_step \\<F> \\<R> \\<subseteq> sig_step \\<G> \\<R>\"\n  by (auto simp: sig_step_def)\n\nlemma sig_step_mono2:\n  \"\\<R> \\<subseteq> \\<L> \\<Longrightarrow> sig_step \\<F> \\<R> \\<subseteq> sig_step \\<F> \\<L>\"\n  by (auto simp: sig_step_def)\n\nlemma srrstep_monp:\n  \"\\<F> \\<subseteq> \\<G> \\<Longrightarrow> srrstep \\<F> \\<R> \\<subseteq> srrstep \\<G> \\<R>\"\n  by (simp add: sig_step_mono)\n\nlemma srstep_monp:\n  \"\\<F> \\<subseteq> \\<G> \\<Longrightarrow> srstep \\<F> \\<R> \\<subseteq> srstep \\<G> \\<R>\"\n  by (simp add: sig_step_mono)\n\nlemma srsteps_monp:\n  \"\\<F> \\<subseteq> \\<G> \\<Longrightarrow> (srstep \\<F> \\<R>)\\<^sup>+ \\<subseteq> (srstep \\<G> \\<R>)\\<^sup>+\"\n  by (simp add: sig_step_mono trancl_mono_set)\n\nlemma srsteps_eq_monp:\n  \"\\<F> \\<subseteq> \\<G> \\<Longrightarrow> (srstep \\<F> \\<R>)\\<^sup>* \\<subseteq> (srstep \\<G> \\<R>)\\<^sup>*\"\n  by (meson rtrancl_mono sig_step_mono subrelI subsetD trancl_into_rtrancl)\n  \nlemma srsteps_with_root_step_sig_mono:\n   \"\\<F> \\<subseteq> \\<G> \\<Longrightarrow> srsteps_with_root_step \\<F> \\<R> \\<subseteq> srsteps_with_root_step \\<G> \\<R>\"\n  unfolding srsteps_with_root_step_def\n  by (simp add: relcomp_mono srrstep_monp srsteps_eq_monp)\n\n\nsubsection \\<open>Introduction, elimination, and destruction rules for @{const sig_step}, @{const rstep}, @{const rrstep},\n   @{const srrstep}, and @{const srstep}\\<close>\n\nlemma sig_stepE [elim, consumes 1]:\n  \"(s, t) \\<in> sig_step \\<F> \\<R> \\<Longrightarrow> \\<lbrakk>(s, t) \\<in> \\<R> \\<Longrightarrow> funas_term s \\<subseteq> \\<F> \\<Longrightarrow> funas_term t \\<subseteq> \\<F> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (auto simp: sig_step_def)\n\nlemma sig_stepI [intro]:\n  \"funas_term s \\<subseteq> \\<F> \\<Longrightarrow> funas_term t \\<subseteq> \\<F> \\<Longrightarrow> (s, t) \\<in> \\<R> \\<Longrightarrow> (s, t) \\<in> sig_step \\<F> \\<R>\"\n  by (auto simp: sig_step_def)\n\nlemma rrstep_subst [elim, consumes 1]:\n  assumes \"(s, t) \\<in> rrstep \\<R>\"\n  obtains l r \\<sigma> where \"(l, r) \\<in> \\<R>\" \"s = l \\<cdot> \\<sigma>\" \"t = r \\<cdot> \\<sigma>\" using assms\n  by (meson rrstep.simps)\n  \nlemma rstep_imp_C_s_r:\n  assumes \"(s, t) \\<in> rstep \\<R>\"\n  shows \"\\<exists>C \\<sigma> l r. (l,r) \\<in> \\<R> \\<and> s = C\\<langle>l\\<cdot>\\<sigma>\\<rangle> \\<and> t = C\\<langle>r\\<cdot>\\<sigma>\\<rangle>\"using assms\n  by (metis rrstep.cases rstep.simps)\n\n  \nlemma rstep_imp_C_s_r' [elim, consumes 1]:\n  assumes \"(s, t) \\<in> rstep \\<R>\"\n  obtains C l r \\<sigma> where \"(l,r) \\<in> \\<R>\" \"s = C\\<langle>l\\<cdot>\\<sigma>\\<rangle>\" \"t = C\\<langle>r\\<cdot>\\<sigma>\\<rangle>\" using assms\n  using rstep_imp_C_s_r by blast\n\nlemma rrstep_basicI [intro]:\n  \"(l, r) \\<in> \\<R> \\<Longrightarrow> (l, r) \\<in> rrstep \\<R>\"\n  by (metis rrstepp.intros rrstepp_rrstep_eq subst_apply_term_empty)\n\nlemma rstep_ruleI [intro]:\n  \"(l, r) \\<in> \\<R> \\<Longrightarrow> (l, r) \\<in> rstep \\<R>\"\n  using rrstep_rstep_mono by blast\n\nlemma rstepI [intro]:\n  \"(l, r) \\<in> \\<R> \\<Longrightarrow> s = C\\<langle>l \\<cdot> \\<sigma>\\<rangle> \\<Longrightarrow> t = C\\<langle>r \\<cdot> \\<sigma>\\<rangle> \\<Longrightarrow> (s, t) \\<in> rstep \\<R>\"\n  by (simp add: rrstep.intros rstep.intros)\n\nlemma rstep_substI [intro]:\n  \"(s, t) \\<in> rstep \\<R> \\<Longrightarrow> (s \\<cdot> \\<sigma>, t \\<cdot> \\<sigma>) \\<in> rstep \\<R>\"\n  by (auto elim!: rstep_imp_C_s_r' simp flip: subst_subst_compose)\n\nlemma rstep_ctxtI [intro]:\n  \"(s, t) \\<in> rstep \\<R> \\<Longrightarrow> (C\\<langle>s\\<rangle>, C\\<langle>t\\<rangle>) \\<in> rstep \\<R>\"\n  by (auto elim!: rstep_imp_C_s_r' simp flip: ctxt_ctxt_compose)\n\nlemma srrstepD:\n  \"(s, t) \\<in> srrstep \\<F> \\<R> \\<Longrightarrow> (s, t) \\<in> rrstep \\<R> \\<and> funas_term s \\<subseteq> \\<F> \\<and> funas_term t \\<subseteq> \\<F>\"\n  by (auto simp: sig_step_def)\n\nlemma srstepD:\n  \"(s, t) \\<in> (srstep \\<F> \\<R>) \\<Longrightarrow> (s, t) \\<in> rstep \\<R> \\<and> funas_term s \\<subseteq> \\<F> \\<and> funas_term t \\<subseteq> \\<F>\"\n  by (auto simp: sig_step_def)\n\nlemma srstepsD:\n  \"(s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>+ \\<Longrightarrow> (s, t) \\<in> (rstep \\<R>)\\<^sup>+ \\<and> funas_term s \\<subseteq> \\<F> \\<and> funas_term t \\<subseteq> \\<F>\"\n  unfolding sig_step_def using trancl_mono_set[OF Restr_mono] \n  by (auto simp: sig_step_def dest: subsetD[OF Restr_trancl_mono_set])\n\n\nsubsubsection \\<open>Transitive and relfexive closure distribution over @{const sig_step}\\<close>\n\nlemma funas_rel_converse:\n  \"funas_rel \\<R> \\<subseteq> \\<F> \\<Longrightarrow> funas_rel (\\<R>\\<inverse>) \\<subseteq> \\<F>\" unfolding funas_rel_def\n  by auto\n\nlemma rstep_term_to_sig_r:\n  assumes \"(s, t) \\<in> rstep \\<R>\" and \"funas_rel \\<R> \\<subseteq> \\<F>\" and \"funas_term s \\<subseteq> \\<F>\"\n  shows \"(s, term_to_sig \\<F> v t) \\<in> rstep \\<R>\"\nproof -\n  from assms(1) obtain C l r \\<sigma> where\n    *: \"s = C\\<langle>l \\<cdot> \\<sigma>\\<rangle>\" \"t = C\\<langle>r \\<cdot> \\<sigma>\\<rangle>\" \"(l, r) \\<in> \\<R>\" by auto\n  from assms(2, 3) *(3) have \"funas_ctxt C \\<subseteq> \\<F>\" \"funas_term l \\<subseteq> \\<F>\" \"funas_term r \\<subseteq> \\<F>\"\n    by (auto simp: *(1) funas_rel_def funas_term_subst subset_eq)\n  then have \"(term_to_sig \\<F> v s, term_to_sig \\<F> v t) \\<in> rstep \\<R>\" using *(3)\n    by (auto simp: *(1, 2) funas_ctxt_ctxt_well_def_hole_path)\n  then show ?thesis using assms(3) by auto\nqed\n\nlemma rstep_term_to_sig_l:\n  assumes \"(s, t) \\<in> rstep \\<R>\" and \"funas_rel \\<R> \\<subseteq> \\<F>\" and \"funas_term t \\<subseteq> \\<F>\"\n  shows \"(term_to_sig \\<F> v s, t) \\<in> rstep \\<R>\"\nproof -\n  from assms(1) obtain C l r \\<sigma> where\n    *: \"s = C\\<langle>l \\<cdot> \\<sigma>\\<rangle>\" \"t = C\\<langle>r \\<cdot> \\<sigma>\\<rangle>\" \"(l, r) \\<in> \\<R>\" by auto\n  from assms(2, 3) *(3) have \"funas_ctxt C \\<subseteq> \\<F>\" \"funas_term l \\<subseteq> \\<F>\" \"funas_term r \\<subseteq> \\<F>\"\n    by (auto simp: *(2) funas_rel_def funas_term_subst subset_eq)\n  then have \"(term_to_sig \\<F> v s, term_to_sig \\<F> v t) \\<in> rstep \\<R>\" using *(3)\n    by (auto simp: *(1, 2) funas_ctxt_ctxt_well_def_hole_path)\n  then show ?thesis using assms(3) by auto\nqed\n\nlemma rstep_trancl_sig_step_r:\n  assumes \"(s, t) \\<in> (rstep \\<R>)\\<^sup>+\" and \"funas_rel \\<R> \\<subseteq> \\<F>\" and \"funas_term s \\<subseteq> \\<F>\"\n  shows \"(s, term_to_sig \\<F> v t) \\<in> (srstep \\<F> \\<R>)\\<^sup>+\" using assms\nproof (induct)\n  case (base t)\n  then show ?case using subsetD[OF fuans_term_term_to_sig, of _ \\<F> v]\n    by (auto simp: rstep_term_to_sig_r sig_step_def intro!: r_into_trancl)\nnext\n  case (step t u)\n  then have st: \"(s, term_to_sig \\<F> v t) \\<in> (srstep \\<F> \\<R>)\\<^sup>+\" by auto\n  from step(2) obtain  C l r \\<sigma> where\n    *: \"t = C\\<langle>l \\<cdot> \\<sigma>\\<rangle>\" \"u = C\\<langle>r \\<cdot> \\<sigma>\\<rangle>\" \"(l, r) \\<in> \\<R>\" by auto\n  show ?case\n  proof (cases \"ctxt_well_def_hole_path \\<F> C\")\n    case True\n    from *(3) step(4) have \"funas_term l \\<subseteq> \\<F>\" \"funas_term r \\<subseteq> \\<F>\" by (auto simp: funas_rel_def)\n    then have \"(term_to_sig \\<F> v t, term_to_sig \\<F> v u) \\<in> rstep \\<R>\"\n      using True step(2) *(3) unfolding *\n      by auto\n    then have \"(term_to_sig \\<F> v t, term_to_sig \\<F> v u) \\<in> srstep \\<F> \\<R>\"\n      by (auto simp:_ sig_step_def)\n    then show ?thesis using st by auto\n  next\n    case False\n    then have \"term_to_sig \\<F> v t = term_to_sig \\<F> v u\" unfolding * by auto\n    then show ?thesis using st by auto\n  qed\nqed\n\nlemma rstep_trancl_sig_step_l:\n  assumes \"(s, t) \\<in> (rstep \\<R>)\\<^sup>+\" and \"funas_rel \\<R> \\<subseteq> \\<F>\" and \"funas_term t \\<subseteq> \\<F>\"\n  shows \"(term_to_sig \\<F> v s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>+\" using assms\nproof (induct rule: converse_trancl_induct)\n  case (base t)\n  then show ?case using subsetD[OF fuans_term_term_to_sig, of _ \\<F> v]\n    by (auto simp: rstep_term_to_sig_l sig_step_def intro!: r_into_trancl)\nnext\n  case (step s u)\n  then have st: \"(term_to_sig \\<F> v u, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>+\" by auto\n  from step(1) obtain C l r \\<sigma> where\n    *: \"s = C\\<langle>l \\<cdot> \\<sigma>\\<rangle>\" \"u = C\\<langle>r \\<cdot> \\<sigma>\\<rangle>\" \"(l, r) \\<in> \\<R>\" by auto\n  show ?case\n  proof (cases \"ctxt_well_def_hole_path \\<F> C\")\n    case True\n    from *(3) step(4) have \"funas_term l \\<subseteq> \\<F>\" \"funas_term r \\<subseteq> \\<F>\" by (auto simp: funas_rel_def)\n    then have \"(term_to_sig \\<F> v s, term_to_sig \\<F> v u) \\<in> rstep \\<R>\"\n      using True step(2) *(3) unfolding *\n      by auto\n    then have \"(term_to_sig \\<F> v s, term_to_sig \\<F> v u) \\<in> srstep \\<F> \\<R>\"\n      by (auto simp:_ sig_step_def)\n    then show ?thesis using st by auto\n  next\n    case False\n    then have \"term_to_sig \\<F> v s = term_to_sig \\<F> v u\" unfolding * by auto\n    then show ?thesis using st by auto\n  qed\nqed\n\nlemma rstep_srstepI [intro]:\n  \"funas_rel \\<R> \\<subseteq> \\<F> \\<Longrightarrow> funas_term s \\<subseteq> \\<F> \\<Longrightarrow> funas_term t \\<subseteq> \\<F> \\<Longrightarrow> (s, t) \\<in> rstep \\<R> \\<Longrightarrow> (s, t) \\<in> srstep \\<F> \\<R>\"\n  by blast\n\nlemma rsteps_srstepsI [intro]:\n  \"funas_rel \\<R> \\<subseteq> \\<F> \\<Longrightarrow> funas_term s \\<subseteq> \\<F> \\<Longrightarrow> funas_term t \\<subseteq> \\<F> \\<Longrightarrow> (s, t) \\<in> (rstep \\<R>)\\<^sup>+ \\<Longrightarrow> (s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>+\"\n  using rstep_trancl_sig_step_r[of s t \\<R> \\<F>]\n  by auto\n\n\nlemma rsteps_eq_srsteps_eqI [intro]:\n  \"funas_rel \\<R> \\<subseteq> \\<F> \\<Longrightarrow> funas_term s \\<subseteq> \\<F> \\<Longrightarrow> funas_term t \\<subseteq> \\<F> \\<Longrightarrow> (s, t) \\<in> (rstep \\<R>)\\<^sup>* \\<Longrightarrow> (s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\"\n  by (auto simp add: rtrancl_eq_or_trancl)\n\nlemma rsteps_eq_relcomp_srsteps_eq_relcompI [intro]:\n  assumes \"funas_rel \\<R> \\<subseteq> \\<F>\" \"funas_rel \\<S> \\<subseteq> \\<F>\"\n    and funas: \"funas_term s \\<subseteq> \\<F>\" \"funas_term t \\<subseteq> \\<F>\"\n    and steps: \"(s, t) \\<in> (rstep \\<R>)\\<^sup>* O (rstep \\<S>)\\<^sup>*\"\n  shows \"(s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>* O (srstep \\<F> \\<S>)\\<^sup>*\"\nproof -\n  from steps obtain u where \"(s, u) \\<in> (rstep \\<R>)\\<^sup>*\" \"(u, t) \\<in> (rstep \\<S>)\\<^sup>*\" by auto\n  then have \"(s, term_to_sig \\<F> v u) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\" \"(term_to_sig \\<F> v u, t) \\<in> (srstep \\<F> \\<S>)\\<^sup>*\"\n    using rstep_trancl_sig_step_l[OF _ assms(2) funas(2), of u v]\n    using rstep_trancl_sig_step_r[OF _ assms(1) funas(1), of u v] funas\n    by (auto simp: rtrancl_eq_or_trancl)\n  then show ?thesis by auto\nqed    \n\n\nsubsubsection \\<open>Distributivity laws\\<close>\n\nlemma rstep_smycl_dist:\n  \"(rstep \\<R>)\\<^sup>\\<leftrightarrow> = rstep (\\<R>\\<^sup>\\<leftrightarrow>)\"\n  by (auto simp: sig_step_def)\n\nlemma sig_step_symcl_dist:\n  \"(sig_step \\<F> \\<R>)\\<^sup>\\<leftrightarrow> = sig_step \\<F> (\\<R>\\<^sup>\\<leftrightarrow>)\"\n  by (auto simp: sig_step_def)\n\nlemma srstep_symcl_dist:\n  \"(srstep \\<F> \\<R>)\\<^sup>\\<leftrightarrow> = srstep \\<F> (\\<R>\\<^sup>\\<leftrightarrow>)\"\n  by (auto simp: sig_step_def)\n\nlemma Restr_smycl_dist:\n  \"(Restr \\<R> \\<A>)\\<^sup>\\<leftrightarrow> = Restr (\\<R>\\<^sup>\\<leftrightarrow>) \\<A>\"\n  by auto\n\nlemmas rew_symcl_inwards = rstep_smycl_dist sig_step_symcl_dist srstep_symcl_dist Restr_smycl_dist\nlemmas rew_symcl_outwards = rew_symcl_inwards[symmetric]\n\nlemma rstep_converse_dist:\n  \"(rstep \\<R>)\\<inverse> = rstep (\\<R>\\<inverse>)\"\n  by auto\n\nlemma srrstep_converse_dist:\n  \"(srrstep \\<F> \\<R>)\\<inverse> = srrstep \\<F> (\\<R>\\<inverse>)\"\n  by (fastforce simp: sig_step_def)\n\nlemma sig_step_converse_rstep:\n  \"(srstep \\<F> \\<R>)\\<inverse> = sig_step \\<F> ((rstep \\<R>)\\<inverse>)\"\n  by (meson converse.simps set_eq_subset sig_stepE(1) sig_stepE sig_stepI subrelI)\n\nlemma srstep_converse_dist:\n  \"(srstep \\<F> \\<R>)\\<inverse> = srstep \\<F> (\\<R>\\<inverse>)\"\n  by (auto simp: sig_step_def)\n\nlemma Restr_converse: \"(Restr \\<R> A)\\<inverse> = Restr (\\<R>\\<inverse>) A\"\n  by auto\n\nlemmas rew_converse_inwards = rstep_converse_dist srrstep_converse_dist sig_step_converse_rstep\n   srstep_converse_dist Restr_converse trancl_converse[symmetric] rtrancl_converse[symmetric]\nlemmas rew_converse_outwards = rew_converse_inwards[symmetric]\n\nlemma sig_step_rsteps_dist:\n  \"funas_rel \\<R> \\<subseteq> \\<F> \\<Longrightarrow> sig_step \\<F> ((rstep \\<R>)\\<^sup>+) = (srstep \\<F> \\<R>)\\<^sup>+\"\n  by (auto elim!: sig_stepE dest: srstepsD)\n\nlemma sig_step_rsteps_eq_dist:\n  \"funas_rel \\<R> \\<subseteq> \\<F> \\<Longrightarrow> sig_step \\<F> ((rstep \\<R>)\\<^sup>+) \\<union> Id = (srstep \\<F> \\<R>)\\<^sup>*\"\n  by (auto simp: rtrancl_eq_or_trancl sig_step_rsteps_dist)\n\nlemma sig_step_conversion_dist:\n  \"(srstep \\<F> \\<R>)\\<^sup>\\<leftrightarrow>\\<^sup>* = (srstep \\<F> (\\<R>\\<^sup>\\<leftrightarrow>))\\<^sup>*\"\n  by (auto simp: rtrancl_eq_or_trancl sig_step_rsteps_dist conversion_def srstep_symcl_dist)\n\nlemma gsrstep_conversion_dist:\n  \"(gsrstep \\<F> \\<R>)\\<^sup>\\<leftrightarrow>\\<^sup>* = (gsrstep \\<F> (\\<R>\\<^sup>\\<leftrightarrow>))\\<^sup>*\"\n  by (auto simp: conversion_def rew_symcl_inwards)\n                                                                                         \nlemma sig_step_grstep_dist:\n  \"gsrstep \\<F> \\<R> = sig_step \\<F> (Restr (rstep \\<R>) (Collect ground))\"\n  by (auto simp: sig_step_def)\n\nsubsection \\<open>Substitution closure of @{const srstep}\\<close>\n\nlemma srstep_subst_closed:\n  assumes \"(s, t) \\<in> srstep \\<F> \\<R>\" \"\\<And> x. funas_term (\\<sigma> x) \\<subseteq> \\<F>\"\n  shows \"(s \\<cdot> \\<sigma>, t \\<cdot> \\<sigma>) \\<in> srstep \\<F> \\<R>\" using assms\n  by (auto simp: sig_step_def funas_term_subst)\n\nlemma srsteps_subst_closed:\n  assumes \"(s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>+\" \"\\<And> x. funas_term (\\<sigma> x) \\<subseteq> \\<F>\"\n  shows \"(s \\<cdot> \\<sigma>, t \\<cdot> \\<sigma>) \\<in> (srstep \\<F> \\<R>)\\<^sup>+\" using assms(1)\nproof (induct rule: trancl.induct)\n  case (r_into_trancl s t) show ?case\n    using srstep_subst_closed[OF r_into_trancl assms(2)]\n    by auto\nnext\n  case (trancl_into_trancl s t u)\n  from trancl_into_trancl(2) show ?case\n    using srstep_subst_closed[OF trancl_into_trancl(3) assms(2)]\n    by (meson rtrancl_into_trancl1 trancl_into_rtrancl)  \nqed\n\nlemma srsteps_eq_subst_closed:\n  assumes \"(s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\" \"\\<And> x. funas_term (\\<sigma> x) \\<subseteq> \\<F>\"\n  shows \"(s \\<cdot> \\<sigma>, t \\<cdot> \\<sigma>) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\" using assms srsteps_subst_closed\n  by (metis rtrancl_eq_or_trancl)\n\nlemma srsteps_eq_subst_relcomp_closed:\n  assumes \"(s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>* O (srstep \\<F> \\<S>)\\<^sup>*\" \"\\<And> x. funas_term (\\<sigma> x) \\<subseteq> \\<F>\"\n  shows \"(s \\<cdot> \\<sigma>, t \\<cdot> \\<sigma>) \\<in> (srstep \\<F> \\<R>)\\<^sup>* O (srstep \\<F> \\<S>)\\<^sup>*\"\nproof -\n  from assms(1) obtain u where \"(s, u) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\" \"(u, t) \\<in> (srstep \\<F> \\<S>)\\<^sup>*\" by auto\n  then have \"(s \\<cdot> \\<sigma>, u \\<cdot> \\<sigma>) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\" \"(u \\<cdot> \\<sigma>, t \\<cdot> \\<sigma>) \\<in> (srstep \\<F> \\<S>)\\<^sup>*\"\n    using assms srsteps_eq_subst_closed\n    by metis+\n  then show ?thesis by auto\nqed\n\n\nsubsection \\<open>Context closure of @{const srstep}\\<close>\n\nlemma srstep_ctxt_closed:\n  assumes \"funas_ctxt C \\<subseteq> \\<F>\" and \"(s, t) \\<in> srstep \\<F> \\<R>\"\n  shows \"(C\\<langle>s\\<rangle>, C\\<langle>t\\<rangle>) \\<in> srstep \\<F> \\<R>\" using assms\n  by (intro sig_stepI) (auto dest: srstepD)\n\nlemma srsteps_ctxt_closed:\n  assumes \"funas_ctxt C \\<subseteq> \\<F>\" and \"(s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>+\"\n  shows \"(C\\<langle>s\\<rangle>, C\\<langle>t\\<rangle>) \\<in> (srstep \\<F> \\<R>)\\<^sup>+\" using assms(2) srstep_ctxt_closed[OF assms(1)]\n  by (induct) force+\n\nlemma srsteps_eq_ctxt_closed:\n  assumes \"funas_ctxt C \\<subseteq> \\<F>\" and \"(s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\"\n  shows \"(C\\<langle>s\\<rangle>, C\\<langle>t\\<rangle>) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\" using srsteps_ctxt_closed[OF assms(1)] assms(2)\n  by (metis rtrancl_eq_or_trancl)\n\nlemma sig_steps_join_ctxt_closed:\n  assumes \"funas_ctxt C \\<subseteq> \\<F>\" and \"(s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>\\<down>\"\n  shows \"(C\\<langle>s\\<rangle>, C\\<langle>t\\<rangle>) \\<in> (srstep \\<F> \\<R>)\\<^sup>\\<down>\" using srsteps_eq_ctxt_closed[OF assms(1)] assms(2)\n  unfolding join_def rew_converse_inwards\n  by auto\n                                 \n\ntext \\<open>The following lemma shows that every rewrite sequence either contains a root step or is root stable\\<close>\n\nlemma nsrsteps_with_root_step_step_on_args:\n  assumes \"(s, t) \\<in> (srstep \\<F> \\<R>)\\<^sup>+\" \"(s, t) \\<notin> srsteps_with_root_step \\<F> \\<R>\"\n  shows \"\\<exists> f ss ts. s = Fun f ss \\<and> t = Fun f ts \\<and> length ss = length ts \\<and>\n    (\\<forall> i < length ts. (ss ! i, ts ! i) \\<in> (srstep \\<F> \\<R>)\\<^sup>*)\" using assms\nproof (induct)\n  case (base t)\n  obtain C l r \\<sigma> where [simp]: \"s = C\\<langle>l \\<cdot> \\<sigma>\\<rangle>\" \"t = C\\<langle>r \\<cdot> \\<sigma>\\<rangle>\" and r: \"(l, r) \\<in> \\<R>\"\n    using base(1) unfolding sig_step_def\n    by blast\n  then have funas: \"funas_ctxt C \\<subseteq> \\<F>\" \"funas_term (l \\<cdot> \\<sigma>) \\<subseteq> \\<F>\" \"funas_term (r \\<cdot> \\<sigma>) \\<subseteq> \\<F>\"\n    using base(1) by (auto simp: sig_step_def)\n  from funas(2-) r have \"(l \\<cdot> \\<sigma>, r \\<cdot> \\<sigma>) \\<in> srrstep \\<F> \\<R>\"\n    by (auto simp: sig_step_def)\n  then have \"C = Hole \\<Longrightarrow> False\" using base(2) r\n    by (auto simp: srsteps_with_root_step_def)\n  then obtain f ss D ts where [simp]: \"C = More f ss D ts\" by (cases C) auto\n  have \"(D\\<langle>l \\<cdot> \\<sigma>\\<rangle>, D\\<langle>r \\<cdot> \\<sigma>\\<rangle>) \\<in> (srstep \\<F> \\<R>)\" using base(1) r funas\n    by (auto simp: sig_step_def)\n  then show ?case using funas by (auto simp: nth_append_Cons)\nnext\n  case (step t u) show ?case\n  proof (cases \"(s, t) \\<in> srsteps_with_root_step \\<F> \\<R> \\<or> (t, u) \\<in> sig_step \\<F> (rrstep \\<R>)\")\n    case True then show ?thesis using step(1, 2, 4)\n      by (auto simp add: relcomp3_I rtrancl.rtrancl_into_rtrancl srsteps_with_root_step_def)\n  next\n    case False\n    obtain C l r \\<sigma> where *[simp]: \"t = C\\<langle>l \\<cdot> \\<sigma>\\<rangle>\" \"u = C\\<langle>r \\<cdot> \\<sigma>\\<rangle>\" and r: \"(l, r) \\<in> \\<R>\"\n      using step(2) unfolding sig_step_def by blast\n    then have funas: \"funas_ctxt C \\<subseteq> \\<F>\" \"funas_term (l \\<cdot> \\<sigma>) \\<subseteq> \\<F>\" \"funas_term (r \\<cdot> \\<sigma>) \\<subseteq> \\<F>\"\n      using step(2) by (auto simp: sig_step_def)\n    from False have \"C \\<noteq> Hole\" using funas r by (force simp: sig_step_def)\n    then obtain f ss D ts where c[simp]: \"C = More f ss D ts\" by (cases C) auto\n    from step(3, 1) False obtain g sss tss where\n      **[simp]: \"s = Fun g sss\" \"t = Fun g tss\" and l: \"length sss = length tss\" and\n      inv: \"\\<forall> i < length tss. (sss ! i, tss ! i) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\"\n      by auto\n    have [simp]: \"g = f\" and lc: \"Suc (length ss + length ts) = length sss\"\n      using l *(1) unfolding c using **(2) by auto\n    then have \"\\<forall> i < Suc (length ss + length ts). ((ss @ D\\<langle>l \\<cdot> \\<sigma>\\<rangle> # ts) ! i, (ss @ D\\<langle>r \\<cdot> \\<sigma>\\<rangle> # ts) ! i) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\"\n      using * funas r by (auto simp: nth_append_Cons r_into_rtrancl rstep.intros rstepI sig_stepI)\n    then have \"i < length tss \\<Longrightarrow> (sss ! i, (ss @ D\\<langle>r \\<cdot> \\<sigma>\\<rangle> # ts) ! i) \\<in> (srstep \\<F> \\<R>)\\<^sup>*\" for i\n      using inv * l lc funas **\n      by (auto simp: nth_append_Cons simp del: ** * split!: if_splits)\n    then show ?thesis using inv l lc * unfolding c\n      by auto\n  qed\nqed\n\nlemma rstep_to_pos_replace:\n  assumes \"(s, t) \\<in> rstep \\<R>\"\n  shows \"\\<exists> p l r \\<sigma>. p \\<in> poss s \\<and> (l, r) \\<in> \\<R> \\<and> s |_ p = l \\<cdot> \\<sigma> \\<and> t = s[p \\<leftarrow> r \\<cdot> \\<sigma>]\"\nproof -\n  from assms obtain C l r \\<sigma> where st: \"(l, r) \\<in> \\<R>\" \"s = C\\<langle>l \\<cdot> \\<sigma>\\<rangle>\" \"t = C\\<langle>r \\<cdot> \\<sigma>\\<rangle>\"\n    using rstep_imp_C_s_r by fastforce\n  from st(2, 3) have *: \"t = s[hole_pos C \\<leftarrow> r \\<cdot> \\<sigma>]\" by simp\n  from this st show ?thesis unfolding *\n    by (intro exI[of _ \"hole_pos C\"]) auto\nqed\n\nlemma pos_replace_to_rstep:\n  assumes \"p \\<in> poss s\" \"(l, r) \\<in> \\<R>\" \n    and \"s |_ p = l \\<cdot> \\<sigma>\" \"t = s[p \\<leftarrow> r \\<cdot> \\<sigma>]\"\n  shows \"(s, t) \\<in> rstep \\<R>\"\n  using assms(1, 3-) replace_term_at_subt_at_id [of s p]\n  by (intro rstepI[OF assms(2), of s \"ctxt_at_pos s p\" \\<sigma>])\n     (auto simp add: ctxt_of_pos_term_apply_replace_at_ident)\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Rewrite_Properties_Reduction/Rewriting/Rewriting.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.531209388216861, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.31483006197816854}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\nsection \"Words of Length 16\"\n\ntheory Word_16\nimports\n  More_Word\n  Signed_Words\nbegin\n\nlemma len16: \"len_of (x :: 16 itself) = 16\" by simp\n\ncontext\n  includes bit_operations_syntax\nbegin\n\nlemma word16_and_max_simp:\n  \\<open>x AND 0xFFFF = x\\<close> for x :: \\<open>16 word\\<close>\n  using word_and_full_mask_simp [of x]\n  by (simp add: numeral_eq_Suc mask_Suc_exp)\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Word_Lib/Word_16.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.31483005318115603}}
{"text": "(*\n * @TAG(OTHER_LGPL)\n *)\n\n(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoarePartialDef.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Hoare Logic for Partial Correctness *}\ntheory HoarePartialDef imports Semantic begin\n\ntype_synonym ('s,'p) quadruple = \"('s assn \\<times> 'p \\<times> 's assn \\<times> 's assn)\"\n\nsubsection {* Validity of Hoare Tuples: @{text \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\ndefinition\n  valid :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n                (\"_\\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \\<forall>s t. \\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> s \\<in> Normal ` P \\<longrightarrow> t \\<notin> Fault ` F  \n                      \\<longrightarrow>  t \\<in>  Normal ` Q \\<union> Abrupt ` A\"\n\ndefinition\n  cvalid::\n  \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n      's assn,('s,'p,'f) com,'s assn,'s assn] =>bool\"\n                (\"_,_\\<Turnstile>\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> (\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\<longrightarrow> \\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\ndefinition\n  nvalid :: \"[('s,'p,'f) body,nat,'f set, \n                's assn,('s,'p,'f) com,'s assn,'s assn] => bool\"\n                (\"_\\<Turnstile>_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \\<forall>s t. \\<Gamma>\\<turnstile>\\<langle>c,s \\<rangle> =n\\<Rightarrow> t \\<longrightarrow> s \\<in> Normal ` P \\<longrightarrow> t \\<notin> Fault ` F \n                        \\<longrightarrow> t \\<in>  Normal ` Q \\<union> Abrupt ` A\"\n\n\ndefinition\n  cnvalid::\n  \"[('s,'p,'f) body,('s,'p) quadruple set,nat,'f set, \n     's assn,('s,'p,'f) com,'s assn,'s assn] \\<Rightarrow> bool\"\n                (\"_,_\\<Turnstile>_:\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,60,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> (\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\<longrightarrow> \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\nnotation (ascii)\n  valid  (\"_|='/_/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60) and\n  cvalid  (\"_,_|='/_/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60) and\n  nvalid  (\"_|=_:'/_/ _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60) and\n  cnvalid  (\"_,_|=_:'/_/ _ _ _,_\"  [61,60,60,60,1000, 20, 1000,1000] 60)\n\n\nsubsection {*Properties of Validity *}\n\nlemma valid_iff_nvalid: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A = (\\<forall>n. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A)\"\n  apply (simp only: valid_def nvalid_def exec_iff_execn )\n  apply (blast dest: exec_final_notin_to_execn)\n  done\n \nlemma cnvalid_to_cvalid: \"(\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A) \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (unfold cvalid_def cnvalid_def valid_iff_nvalid [THEN eq_reflection])\n  apply fast\n  done\n\nlemma nvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P; t\\<notin> Fault ` F\\<rbrakk> \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: nvalid_def)\n\nlemma validI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t;s \\<in> P; t\\<notin>Fault ` F\\<rbrakk> \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: valid_def)\n\nlemma cvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n          \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: cvalid_def valid_def)\n\nlemma cvalidD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A;\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n  \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  by (auto simp add: cvalid_def valid_def)\n\nlemma cnvalidI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n   \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P;t\\<notin>Fault ` F\\<rbrakk> \n          \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: cnvalid_def nvalid_def)\n\n\nlemma cnvalidD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A;\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A;\n   \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t;s \\<in> P;\n   t\\<notin>Fault ` F\\<rbrakk> \n  \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  by (auto simp add: cnvalid_def nvalid_def)\n\nlemma nvalid_augment_Faults:\n  assumes validn:\"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F \\<subseteq> F'\"\n  shows \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F'\"\n  with F' have \"t \\<notin> Fault ` F\"\n    by blast\n  with exec P validn\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (auto simp add: nvalid_def)\nqed\n\nlemma valid_augment_Faults:\n  assumes validn:\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F \\<subseteq> F'\"\n  shows \"\\<Gamma>\\<Turnstile>\\<^bsub>/F'\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F'\"\n  with F' have \"t \\<notin> Fault ` F\"\n    by blast\n  with exec P validn\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (auto simp add: valid_def)\nqed\n\nlemma nvalid_to_nvalid_strip:\n  assumes validn:\"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec_strip: \"strip F' \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F\"\n  from exec_strip obtain t' where\n    exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> =n\\<Rightarrow> t'\" and\n    t': \"t' \\<in> Fault ` (-F') \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: execn_strip_to_execn)\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"t' \\<in> Fault ` F\")\n    case True\n    with t' F F' have False\n      by blast\n    thus ?thesis ..\n  next\n    case False\n    with exec P validn\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: nvalid_def)\n    moreover\n    from this t' have \"t'=t\"\n      by auto\n    ultimately show ?thesis\n      by simp\n  qed\nqed\n\n\nlemma valid_to_valid_strip:\n  assumes valid:\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec_strip: \"strip F' \\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume F: \"t \\<notin> Fault ` F\"\n  from exec_strip obtain t' where\n    exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t'\" and\n    t': \"t' \\<in> Fault ` (-F') \\<longrightarrow> t'=t\" \"\\<not> isFault t' \\<longrightarrow> t'=t\"\n    by (blast dest: exec_strip_to_exec)\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"t' \\<in> Fault ` F\")\n    case True\n    with t' F F' have False\n      by blast\n    thus ?thesis ..\n  next\n    case False\n    with exec P valid\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: valid_def)\n    moreover\n    from this t' have \"t'=t\"\n      by auto\n    ultimately show ?thesis\n      by simp\n  qed\nqed\n\n\nsubsection {* The Hoare Rules: @{text \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\nlemma mono_WeakenContext: \"A \\<subseteq> B \\<Longrightarrow>\n        (\\<lambda>(P, c, Q, A'). (\\<Gamma>, \\<Theta>, F, P, c, Q, A') \\<in> A) x \\<longrightarrow>\n        (\\<lambda>(P, c, Q, A'). (\\<Gamma>, \\<Theta>, F, P, c, Q, A') \\<in> B) x\"\napply blast\ndone\n\n\ninductive \"hoarep\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n    's assn,('s,'p,'f) com, 's assn,'s assn] => bool\"\n    (\"(3_,_/\\<turnstile>\\<^bsub>'/_ \\<^esub>(_/ (_)/ _,/_))\" [60,60,60,1000,20,1000,1000]60)\n  for \\<Gamma>::\"('s,'p,'f) body\"\nwhere\n  Skip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. f s \\<in> Q} (Basic f) Q,A\"\n\n| Spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. (\\<forall>t. (s,t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s,t) \\<in> r)} (Spec r) Q,A\"\n\n| Seq: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Seq c\\<^sub>1 c\\<^sub>2) Q,A\"\n  \n| Cond: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c\\<^sub>1 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> - b) c\\<^sub>2 Q,A\\<rbrakk>\n         \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (While b c) (P \\<inter> - b),A\"\n\n| Guard: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) (Guard f g c) Q,A\"\n\n| Guarantee: \"\\<lbrakk>f \\<in> F; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec:\n  \"\\<lbrakk>(P,p,Q,A) \\<in> Specs;  \n    \\<forall>(P,p,Q,A) \\<in> Specs. p \\<in> dom \\<Gamma> \\<and> \\<Gamma>,\\<Theta>\\<union>Specs\\<turnstile>\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A \\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| DynCom:\n      \"\\<forall>s \\<in> P. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (c s) Q,A \n      \\<Longrightarrow> \n      \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n| Throw: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk> \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\<forall>s \\<in> P. \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A \n           \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"\\<lbrakk>(P,p,Q,A) \\<in> \\<Theta>\\<rbrakk>\n         \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| ExFalso: \"\\<lbrakk>\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A; \\<not> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  -- {* This is a hack rule that enables us to derive completeness for\n        an arbitrary context @{text \"\\<Theta>\"}, from completeness for an empty context.*}  \n\n\n\ntext {* Does not work, because of rule ExFalso, the context @{text \"\\<Theta>\"} is to blame.\n A weaker version with empty context can be derived from soundness \n and completeness later on. *}\nlemma hoare_strip_\\<Gamma>: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"strip (-F) \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv \nproof induct\n  case Skip thus ?case by (iprover intro: hoarep.Skip)\nnext\n  case Basic thus ?case by (iprover intro: hoarep.Basic)\nnext\n  case Spec thus ?case by (iprover intro: hoarep.Spec)\nnext\n  case Seq thus ?case by (iprover intro: hoarep.Seq)\nnext\n  case Cond thus ?case by (iprover intro: hoarep.Cond)\nnext\n  case While thus ?case by (iprover intro: hoarep.While)\nnext\n  case Guard thus ?case by (iprover intro: hoarep.Guard)\n(*next\n  case CallSpec thus ?case by (iprover intro: hoarep.CallSpec)\nnext\n  case (CallRec A Abr Abr' Init P Post Pre Procs Q R Result Return Z \\<Gamma> \\<Theta> init p\n         result return )\n  from CallRec.hyps\n  have \"\\<forall>p\\<in>Procs. \\<forall>Z. (strip \\<Gamma>),\\<Theta> \\<union>\n             (\\<Union>\\<^bsub>p\\<in>Procs\\<^esub>\n                 \\<Union>\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n                      Post p Z, Abr p Z)})\\<turnstile>\n            (Pre p Z) (the (\\<Gamma> p)) (R p Z),(Abr' p Z)\" by blast\n  hence \"\\<forall>p\\<in>Procs. \\<forall>Z. (strip \\<Gamma>),\\<Theta> \\<union>\n             (\\<Union>\\<^bsub>p\\<in>Procs\\<^esub>\n                 \\<Union>\\<^bsub>Z\\<^esub> {(Pre p Z, Call (Init p) p (Return p) (Result p),\n                      Post p Z, Abr p Z)})\\<turnstile>\n            (Pre p Z) (the ((strip \\<Gamma>) p)) (R p Z),(Abr' p Z)\"\n    by (auto intro: hoarep.StripI)\n  then show ?case\n    apply - \n    apply (rule hoarep.CallRec)\n    apply (assumption | simp only:dom_strip)+\n    done*)\nnext\n  case DynCom \n  thus ?case\n    by - (rule hoarep.DynCom,best  elim!: ballE exE)\nnext\n  case Throw thus ?case by (iprover intro: hoarep.Throw)\nnext\n  case Catch thus ?case by (iprover intro: hoarep.Catch)\n(*next \n  case CONSEQ thus ?case apply (auto intro: hoarep.CONSEQ)*)\nnext\n  case Asm thus ?case by (iprover intro: hoarep.Asm)\nnext\n  case ExFalso\n  thus ?case\n    oops\n\nlemma hoare_augment_context: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"\\<And>\\<Theta>'. \\<Theta> \\<subseteq> \\<Theta>' \\<Longrightarrow> \\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n  case CallRec\n  case (CallRec P p Q A Specs \\<Theta> F \\<Theta>')\n  from CallRec.prems\n  have \"\\<Theta>\\<union>Specs\n       \\<subseteq> \\<Theta>'\\<union>Specs\"\n    by blast\n  with CallRec.hyps (2) \n  have \"\\<forall>(P,p,Q,A)\\<in>Specs.  p \\<in> dom \\<Gamma> \\<and> \\<Gamma>,\\<Theta>'\\<union>Specs \\<turnstile>\\<^bsub>/F\\<^esub> P  (the (\\<Gamma> p)) Q,A\"\n    by fastforce\n\n  with CallRec show ?case by - (rule hoarep.CallRec)\nnext\n  case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n  case (Conseq P \\<Theta> F c Q A \\<Theta>')\n  from Conseq\n  have \"\\<forall>s \\<in> P. \n         (\\<exists>P' Q' A'. \\<Gamma>,\\<Theta>' \\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A)\"\n    by blast\n  with Conseq show ?case by - (rule hoarep.Conseq)\nnext\n  case (ExFalso \\<Theta> F P c Q A \\<Theta>')\n  have valid_ctxt: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\" \"\\<Theta> \\<subseteq> \\<Theta>'\" by fact+\n  hence \"\\<forall>n. \\<Gamma>,\\<Theta>'\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n    by (simp add: cnvalid_def) blast\n  moreover have invalid: \"\\<not> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"  by fact\n  ultimately show ?case\n    by (rule hoarep.ExFalso)\nqed (blast intro: hoarep.intros)+\n\n\nsubsection {* Some Derived Rules *}\n\nlemma  Conseq': \"\\<forall>s. s \\<in> P \\<longrightarrow> \n            (\\<exists>P' Q' A'. \n              (\\<forall> Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\<and>\n                    (\\<exists>Z. s \\<in> P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A)))\n           \\<Longrightarrow>\n           \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\<lbrakk>\\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n              \\<forall>s. s \\<in> P \\<longrightarrow> (\\<exists> Z. s\\<in>P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A))\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule Conseq) blast\n\ntheorem conseqPrePost [trans]: \n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow>  Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq [where ?P'=\"\\<lambda>Z. P'\" and ?Q'=\"\\<lambda>Z. Q'\"]) auto\n\nlemma conseqPre [trans]: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q,A \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost [trans]: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q',A' \\<Longrightarrow> Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \n \\<Longrightarrow>   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq) auto\n\n\nlemma CallRec': \n  \"\\<lbrakk>p\\<in>Procs; Procs \\<subseteq> dom \\<Gamma>;\n   \\<forall>p\\<in>Procs. \n    \\<forall>Z. \\<Gamma>,\\<Theta> \\<union> (\\<Union>p\\<in>Procs. \\<Union>Z. {((P p Z),p,Q p Z,A p Z)})\n        \\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\\<rbrakk>\n   \\<Longrightarrow>\n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\<Union>p\\<in>Procs. \\<Union>Z. {((P p Z),p,Q p Z,A p Z)}\"])\napply  blast\napply blast\ndone\n\nend ", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/hoare-package/HoarePartialDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.31483005318115603}}
{"text": "(*  Title:      HOL/Imperative_HOL/Heap.thy\n    Author:     John Matthews, Galois Connections; Alexander Krauss, TU Muenchen\n*)\n\nsection \\<open>A polymorphic heap based on cantor encodings\\<close>\n\ntheory Heap\nimports Main \"~~/src/HOL/Library/Countable\"\nbegin\n\nsubsection \\<open>Representable types\\<close>\n\ntext \\<open>The type class of representable types\\<close>\n\nclass heap = typerep + countable\n\ninstance unit :: heap ..\n\ninstance bool :: heap ..\n\ninstance nat :: heap ..\n\ninstance prod :: (heap, heap) heap ..\n\ninstance sum :: (heap, heap) heap ..\n\ninstance list :: (heap) heap ..\n\ninstance option :: (heap) heap ..\n\ninstance int :: heap ..\n\ninstance String.literal :: heap ..\n\ninstance typerep :: heap ..\n\n\nsubsection \\<open>A polymorphic heap with dynamic arrays and references\\<close>\n\ntext \\<open>\n  References and arrays are developed in parallel,\n  but keeping them separate makes some later proofs simpler.\n\\<close>\n\ntype_synonym addr = nat \\<comment> \"untyped heap references\"\ntype_synonym heap_rep = nat \\<comment> \"representable values\"\n\nrecord heap =\n  arrays :: \"typerep \\<Rightarrow> addr \\<Rightarrow> heap_rep list\"\n  refs :: \"typerep \\<Rightarrow> addr \\<Rightarrow> heap_rep\"\n  lim  :: addr\n\ndefinition empty :: heap where\n  \"empty = \\<lparr>arrays = (\\<lambda>_ _. []), refs = (\\<lambda>_ _. 0), lim = 0\\<rparr>\"\n\ndatatype 'a array = Array addr \\<comment> \"note the phantom type 'a\"\ndatatype 'a ref = Ref addr \\<comment> \"note the phantom type 'a\"\n\nprimrec addr_of_array :: \"'a array \\<Rightarrow> addr\" where\n  \"addr_of_array (Array x) = x\"\n\nprimrec addr_of_ref :: \"'a ref \\<Rightarrow> addr\" where\n  \"addr_of_ref (Ref x) = x\"\n\nlemma addr_of_array_inj [simp]:\n  \"addr_of_array a = addr_of_array a' \\<longleftrightarrow> a = a'\"\n  by (cases a, cases a') simp_all\n\nlemma addr_of_ref_inj [simp]:\n  \"addr_of_ref r = addr_of_ref r' \\<longleftrightarrow> r = r'\"\n  by (cases r, cases r') simp_all\n\ninstance array :: (type) countable\n  by (rule countable_classI [of addr_of_array]) simp\n\ninstance ref :: (type) countable\n  by (rule countable_classI [of addr_of_ref]) simp\n\ntext \\<open>Syntactic convenience\\<close>\n\nsetup \\<open>\n  Sign.add_const_constraint (@{const_name Array}, SOME @{typ \"nat \\<Rightarrow> 'a::heap array\"})\n  #> Sign.add_const_constraint (@{const_name Ref}, SOME @{typ \"nat \\<Rightarrow> 'a::heap ref\"})\n  #> Sign.add_const_constraint (@{const_name addr_of_array}, SOME @{typ \"'a::heap array \\<Rightarrow> nat\"})\n  #> Sign.add_const_constraint (@{const_name addr_of_ref}, SOME @{typ \"'a::heap ref \\<Rightarrow> nat\"})\n\\<close>\n\nhide_const (open) empty\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Imperative_HOL/Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.31475066901944776}}
{"text": "(*<*)\n(*\n * Copyright 2015, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory CIMP_vcg\nimports\n  CIMP_lang\nbegin\n\n(*>*)\nsection\\<open> State-based invariants \\label{sec:cimp-invariants} \\<close>\n\ntext\\<open>\n\nWe provide a simple-minded verification condition generator (VCG) for this language, providing\nsupport for establishing state-based invariants. It is just one way of reasoning about CIMP programs\nand is proven sound wrt to the CIMP semantics.\n\nOur approach follows \\<^citet>\\<open>\"DBLP:journals/acta/Lamport80\" and \"DBLP:journals/toplas/LamportS84\"\\<close>\n(and the later \\<^citet>\\<open>\"Lamport:2002\"\\<close>) and closely\nrelated work by \\<^citet>\\<open>\"AptFrancezDeRoever:1980\"\\<close>,\n\\<^citet>\\<open>\"CousotCousot:1980\"\\<close> and \\<^citet>\\<open>\"DBLP:journals/acta/LevinG81\"\\<close>, who suggest the\nincorporation of a history variable. \\<^citet>\\<open>\"CousotCousot:1980\"\\<close> apparently contains a completeness proof.\nLamport mentions that this technique was well-known in the mid-80s\nwhen he proposed the use of prophecy variables\\footnote{@{url\n\"https://lamport.azurewebsites.net/pubs/pubs.html\"}}. See also \\<^citet>\\<open>\"deRoeverEtAl:2001\"\\<close> for an extended discussion of\nsome of this.\n\n\\<close>\n\ndeclare small_step.intros[intro]\n\ninductive_cases small_step_inv:\n  \"(\\<lbrace>l\\<rbrace> Request action val # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(\\<lbrace>l\\<rbrace> Response action # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(\\<lbrace>l\\<rbrace> LocalOp R # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(\\<lbrace>l\\<rbrace> IF b THEN c FI # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(\\<lbrace>l\\<rbrace> IF b THEN c1 ELSE c2 FI # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(\\<lbrace>l\\<rbrace> WHILE b DO c OD # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n  \"(LOOP DO c OD # cs, ls) \\<rightarrow>\\<^bsub>a\\<^esub> s'\"\n\nlemma small_step_stuck:\n  \"\\<not> ([], s) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> c'\"\nby (auto elim: small_step.cases)\n\ndeclare system_step.intros[intro]\n\ntext\\<open>\n\nBy default we ask the simplifier to rewrite @{const \"atS\"} using\nambient @{const \"AT\"} information.\n\n\\<close>\n\nlemma atS_state_weak_cong[cong]:\n  \"AT s p = AT s' p \\<Longrightarrow> atS p ls s \\<longleftrightarrow> atS p ls s'\"\nby (auto simp: atS_def)\n\ntext\\<open>\n\nWe provide an incomplete set of basic rules for label sets.\n\n\\<close>\n\nlemma atS_simps:\n  \"\\<not>atS p {} s\"\n  \"atS p {l} s \\<longleftrightarrow> at p l s\"\n  \"\\<lbrakk>at p l s; l \\<in> ls\\<rbrakk> \\<Longrightarrow> atS p ls s\"\n  \"(\\<forall>l. at p l s \\<longrightarrow> l \\<notin> ls) \\<Longrightarrow> \\<not>atS p ls s\"\nby (auto simp: atS_def)\n\nlemma atS_mono:\n  \"\\<lbrakk>atS p ls s; ls \\<subseteq> ls'\\<rbrakk> \\<Longrightarrow> atS p ls' s\"\nby (auto simp: atS_def)\n\nlemma atS_un:\n  \"atS p (l \\<union> l') s \\<longleftrightarrow> atS p l s \\<or> atS p l' s\"\nby (auto simp: atS_def)\n\nlemma atLs_disj_union[simp]:\n  \"(atLs p label0 \\<^bold>\\<or> atLs p label1) = atLs p (label0 \\<union> label1)\"\nunfolding atLs_def by simp\n\nlemma atLs_insert_disj:\n  \"atLs p (insert l label0) = (atL p l \\<^bold>\\<or> atLs p label0)\"\nby simp\n\nlemma small_step_terminated:\n  \"s \\<rightarrow>\\<^bsub>x\\<^esub> s' \\<Longrightarrow> atCs (fst s) = {} \\<Longrightarrow> atCs (fst s') = {}\"\nby (induct pred: small_step) auto\n\nlemma atC_not_empty:\n  \"atC c \\<noteq> {}\"\nby (induct c) auto\n\nlemma atCs_empty:\n  \"atCs cs = {} \\<longleftrightarrow> cs = []\"\nby (induct cs) (auto simp: atC_not_empty)\n\nlemma terminated_no_commands:\n  assumes \"terminated p sh\"\n  shows \"\\<exists>s. GST sh p = ([], s)\"\nusing assms unfolding atLs_def AT_def by (metis atCs_empty prod.collapse singletonD)\n\nlemma terminated_GST_stable:\n  assumes \"system_step q sh' sh\"\n  assumes \"terminated p sh\"\n  shows \"GST sh p = GST sh' p\"\nusing assms by (auto dest!: terminated_no_commands simp: small_step_stuck elim!: system_step.cases)\n\nlemma terminated_stable:\n  assumes \"system_step q sh' sh\"\n  assumes \"terminated p sh\"\n  shows \"terminated p sh'\"\nusing assms unfolding atLs_def AT_def\nby (fastforce split: if_splits prod.splits\n               dest: small_step_terminated\n              elim!: system_step.cases)\n\nlemma system_step_pls_nonempty:\n  assumes \"system_step pls sh' sh\"\n  shows \"pls \\<noteq> {}\"\nusing assms by cases simp_all\n\nlemma system_step_no_change:\n  assumes \"system_step ps sh' sh\"\n  assumes \"p \\<notin> ps\"\n  shows \"GST sh' p = GST sh p\"\nusing assms by cases simp_all\n\nlemma initial_stateD:\n  assumes \"initial_state sys s\"\n  shows \"AT (\\<lparr>GST = s, HST = []\\<rparr>) = atC \\<circ> PGMs sys \\<and> INIT sys (\\<lparr>GST = s, HST = []\\<rparr>)\\<down> \\<and> (\\<forall>p l. \\<not>taken p l \\<lparr>GST = s, HST = []\\<rparr>)\"\nusing assms unfolding initial_state_def split_def o_def LST_def AT_def taken_def by simp\n\nlemma initial_states_initial[iff]:\n  assumes \"initial_state sys s\"\n  shows \"at p l (\\<lparr>GST = s, HST = []\\<rparr>) \\<longleftrightarrow> l \\<in> atC (PGMs sys p)\"\nusing assms unfolding initial_state_def split_def AT_def by simp\n\ndefinition\n  reachable_state :: \"('answer, 'location, 'proc, 'question, 'state, 'ext) pre_system_ext\n                    \\<Rightarrow> ('answer, 'location, 'proc, 'question, 'state) state_pred\"\nwhere\n  \"reachable_state sys s \\<longleftrightarrow> (\\<exists>\\<sigma> i. prerun sys \\<sigma> \\<and> \\<sigma> i = s)\"\n\nlemma reachable_stateE:\n  assumes \"reachable_state sys sh\"\n  assumes \"\\<And>\\<sigma> i. prerun sys \\<sigma> \\<Longrightarrow> P (\\<sigma> i)\"\n  shows \"P sh\"\nusing assms unfolding reachable_state_def by blast\n\nlemma prerun_reachable_state:\n  assumes \"prerun sys \\<sigma>\"\n  shows \"reachable_state sys (\\<sigma> i)\"\nusing assms unfolding prerun_def LTL.defs system_step_reflclp_def reachable_state_def by auto\n\nlemma reachable_state_induct[consumes 1, case_names init LocalStep CommunicationStep, induct set: reachable_state]:\n  assumes r: \"reachable_state sys sh\"\n  assumes i: \"\\<And>s. initial_state sys s \\<Longrightarrow> P \\<lparr>GST = s, HST = []\\<rparr>\"\n  assumes l: \"\\<And>sh ls' p. \\<lbrakk>reachable_state sys sh; P sh; GST sh p \\<rightarrow>\\<^bsub>\\<tau>\\<^esub> ls'\\<rbrakk> \\<Longrightarrow> P \\<lparr>GST = (GST sh)(p := ls'), HST = HST sh\\<rparr>\"\n  assumes c: \"\\<And>sh ls1' ls2' p1 p2 \\<alpha> \\<beta>.\n                 \\<lbrakk>reachable_state sys sh; P sh;\n                 GST sh p1 \\<rightarrow>\\<^bsub>\\<guillemotleft>\\<alpha>, \\<beta>\\<guillemotright>\\<^esub> ls1'; GST sh p2 \\<rightarrow>\\<^bsub>\\<guillemotright>\\<alpha>, \\<beta>\\<guillemotleft>\\<^esub> ls2'; p1 \\<noteq> p2 \\<rbrakk>\n                    \\<Longrightarrow> P \\<lparr>GST = (GST sh)(p1 := ls1', p2 := ls2'), HST = HST sh @ [(\\<alpha>, \\<beta>)]\\<rparr>\"\n  shows \"P sh\"\nusing r\nproof(rule reachable_stateE)\n  fix \\<sigma> i assume \"prerun sys \\<sigma>\" show \"P (\\<sigma> i)\"\n  proof(induct i)\n    case 0 from \\<open>prerun sys \\<sigma>\\<close> show ?case\n      unfolding prerun_def by (metis (full_types) i old.unit.exhaust system_state.surjective)\n  next\n    case (Suc i) with \\<open>prerun sys \\<sigma>\\<close> show ?case\nunfolding prerun_def LTL.defs system_step_reflclp_def reachable_state_def\napply clarsimp\napply (drule_tac x=i in spec)\napply (erule disjE; clarsimp)\napply (erule system_step.cases; clarsimp)\n apply (metis (full_types) \\<open>prerun sys \\<sigma>\\<close> l old.unit.exhaust prerun_reachable_state system_state.surjective)\napply (metis (full_types) \\<open>prerun sys \\<sigma>\\<close> c old.unit.exhaust prerun_reachable_state system_state.surjective)\ndone\n  qed\nqed\n\nlemma prerun_valid_TrueI:\n  shows \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> \\<langle>True\\<rangle>\"\nunfolding prerun_valid_def by simp\n\nlemma prerun_valid_conjI:\n  assumes \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> P\"\n  assumes \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> Q\"\n  shows \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> P \\<^bold>\\<and> Q\"\nusing assms unfolding prerun_valid_def always_def by simp\n\nlemma valid_prerun_lift:\n  assumes \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> I\"\n  shows \"sys \\<Turnstile> \\<box>\\<lceil>I\\<rceil>\"\nusing assms unfolding prerun_valid_def valid_def run_def by blast\n\nlemma prerun_valid_induct:\n  assumes \"\\<And>\\<sigma>. prerun sys \\<sigma> \\<Longrightarrow> \\<lceil>I\\<rceil> \\<sigma>\"\n  assumes \"\\<And>\\<sigma>. prerun sys \\<sigma> \\<Longrightarrow> (\\<lceil>I\\<rceil> \\<^bold>\\<hookrightarrow> (\\<circle>\\<lceil>I\\<rceil>)) \\<sigma>\"\n  shows \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> I\"\nunfolding prerun_valid_def using assms by (simp add: always_induct)\n\nlemma prerun_validI:\n  assumes \"\\<And>s. reachable_state sys s \\<Longrightarrow> I s\"\n  shows \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> I\"\nunfolding prerun_valid_def using assms by (simp add: alwaysI prerun_reachable_state)\n\nlemma prerun_validE:\n  assumes \"reachable_state sys s\"\n  assumes \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> I\"\n  shows \"I s\"\nusing assms unfolding prerun_valid_def\nby (metis alwaysE reachable_stateE suffix_state_prop)\n\n\nsubsubsection\\<open>Relating reachable states to the initial programs \\label{sec:cimp-decompose-small-step}\\<close>\n\ntext\\<open>\n\nTo usefully reason about the control locations presumably embedded in\nthe single global invariant, we need to link the programs we have in\nreachable state \\<open>s\\<close> to the programs in the initial states. The\n\\<open>fragments\\<close> function decomposes the program into statements\nthat can be directly executed (\\S\\ref{sec:cimp-decompose}). We also\ncompute the locations we could be at after executing that statement as\na function of the process's local state.\n\nEliding the bodies of \\<open>IF\\<close> and \\<open>WHILE\\<close> statements\nyields smaller (but equivalent) proof obligations.\n\n\\<close>\n\ntype_synonym  ('answer, 'location, 'question, 'state) loc_comp\n  = \"'state \\<Rightarrow> 'location set\"\n\nfun lconst :: \"'location set \\<Rightarrow> ('answer, 'location, 'question, 'state) loc_comp\" where\n  \"lconst lp s = lp\"\n\ndefinition lcond :: \"'location set \\<Rightarrow> 'location set \\<Rightarrow> 'state bexp\n                   \\<Rightarrow> ('answer, 'location, 'question, 'state) loc_comp\" where\n  \"lcond lp lp' b s = (if b s then lp else lp')\"\n\nlemma lcond_split:\n  \"Q (lcond lp lp' b s) \\<longleftrightarrow> (b s \\<longrightarrow> Q lp) \\<and> (\\<not>b s \\<longrightarrow> Q lp')\"\nunfolding lcond_def by (simp split: if_splits)\n\nlemma lcond_split_asm:\n  \"Q (lcond lp lp' b s) \\<longleftrightarrow> \\<not> ((b s \\<and> \\<not>Q lp) \\<or> (\\<not>b s \\<and> \\<not> Q lp'))\"\nunfolding lcond_def by (simp split: if_splits)\n\nlemmas lcond_splits = lcond_split lcond_split_asm\n\nfun\n  fragments :: \"('answer, 'location, 'question, 'state) com\n              \\<Rightarrow> 'location set\n              \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n               \\<times> ('answer, 'location, 'question, 'state) loc_comp ) set\"\nwhere\n  \"fragments (\\<lbrace>l\\<rbrace> IF b THEN c FI) aft\n       = { (\\<lbrace>l\\<rbrace> IF b THEN c' FI, lcond (atC c) aft b) |c'. True }\n        \\<union> fragments c aft\"\n| \"fragments (\\<lbrace>l\\<rbrace> IF b THEN c1 ELSE c2 FI) aft\n       = { (\\<lbrace>l\\<rbrace> IF b THEN c1' ELSE c2' FI, lcond (atC c1) (atC c2) b) |c1' c2'. True }\n        \\<union> fragments c1 aft \\<union> fragments c2 aft\"\n| \"fragments (LOOP DO c OD) aft = fragments c (atC c)\"\n| \"fragments (\\<lbrace>l\\<rbrace> WHILE b DO c OD) aft\n       =  fragments c {l} \\<union> { (\\<lbrace>l\\<rbrace> WHILE b DO c' OD, lcond (atC c) aft b) |c'. True }\"\n| \"fragments (c1;; c2) aft = fragments c1 (atC c2) \\<union> fragments c2 aft\"\n| \"fragments (c1 \\<oplus> c2) aft = fragments c1 aft \\<union> fragments c2 aft\"\n| \"fragments c aft = { (c, lconst aft) }\"\n\nfun\n  fragmentsL :: \"('answer, 'location, 'question, 'state) com list\n               \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                 \\<times> ('answer, 'location, 'question, 'state) loc_comp ) set\"\nwhere\n  \"fragmentsL [] = {}\"\n| \"fragmentsL [c] = fragments c {}\"\n| \"fragmentsL (c # c' # cs) = fragments c (atC c') \\<union> fragmentsL (c' # cs)\"\n\nabbreviation\n  fragmentsLS :: \"('answer, 'location, 'question, 'state) local_state\n               \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                 \\<times> ('answer, 'location, 'question, 'state) loc_comp ) set\"\nwhere\n  \"fragmentsLS s \\<equiv> fragmentsL (cPGM s)\"\n\ntext\\<open>\n\nWe show that taking system steps preserves fragments.\n\n\\<close>\n\nlemma small_step_fragmentsLS:\n  assumes \"s \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> s'\"\n  shows \"fragmentsLS s' \\<subseteq> fragmentsLS s\"\nusing assms by induct (case_tac [!] cs, auto)\n\nlemma reachable_state_fragmentsLS:\n  assumes \"reachable_state sys sh\"\n  shows \"fragmentsLS (GST sh p) \\<subseteq> fragments (PGMs sys p) {}\"\nusing assms\nby (induct rule: reachable_state_induct)\n   (auto simp: initial_state_def dest: subsetD[OF small_step_fragmentsLS])\n\ninductive\n  basic_com :: \"('answer, 'location, 'question, 'state) com \\<Rightarrow> bool\"\nwhere\n  \"basic_com (\\<lbrace>l\\<rbrace> Request action val)\"\n| \"basic_com (\\<lbrace>l\\<rbrace> Response action)\"\n| \"basic_com (\\<lbrace>l\\<rbrace> LocalOp R)\"\n| \"basic_com (\\<lbrace>l\\<rbrace> IF b THEN c FI)\"\n| \"basic_com (\\<lbrace>l\\<rbrace> IF b THEN c1 ELSE c2 FI)\"\n| \"basic_com (\\<lbrace>l\\<rbrace> WHILE b DO c OD)\"\n\nlemma fragments_basic_com:\n  assumes \"(c', aft') \\<in> fragments c aft\"\n  shows \"basic_com c'\"\nusing assms by (induct c arbitrary: aft) (auto intro: basic_com.intros)\n\nlemma fragmentsL_basic_com:\n  assumes \"(c', aft') \\<in> fragmentsL cs\"\n  shows \"basic_com c'\"\nusing assms\napply (induct cs)\n apply simp\napply (case_tac cs)\n apply (auto simp: fragments_basic_com)\ndone\n\ntext\\<open>\n\nTo reason about system transitions we need to identify which basic\nstatement gets executed next. To that end we factor out the recursive\ncases of the @{term \"small_step\"} semantics into \\emph{contexts},\nwhich isolate the \\<open>basic_com\\<close> commands with immediate\nexternally-visible behaviour. Note that non-determinism means that\nmore than one \\<open>basic_com\\<close> can be enabled at a time.\n\nThe representation of evaluation contexts follows \\<^citet>\\<open>\"DBLP:journals/jar/Berghofer12\"\\<close>. This style of\noperational semantics was originated by \\<^citet>\\<open>\"FelleisenHieb:1992\"\\<close>.\n\n\\<close>\n\ntype_synonym ('answer, 'location, 'question, 'state) ctxt\n  = \"(('answer, 'location, 'question, 'state) com \\<Rightarrow> ('answer, 'location, 'question, 'state) com)\n   \\<times> (('answer, 'location, 'question, 'state) com \\<Rightarrow> ('answer, 'location, 'question, 'state) com list)\"\n\ninductive_set\n  ctxt :: \"('answer, 'location, 'question, 'state) ctxt set\"\nwhere\n  C_Hole: \"(id, \\<langle>[]\\<rangle>) \\<in> ctxt\"\n| C_Loop: \"(E, fctxt) \\<in> ctxt \\<Longrightarrow> (\\<lambda>c1. LOOP DO E c1 OD, \\<lambda>c1. fctxt c1 @ [LOOP DO E c1 OD]) \\<in> ctxt\"\n| C_Seq: \"(E, fctxt) \\<in> ctxt \\<Longrightarrow> (\\<lambda>c1. E c1;; c2, \\<lambda>c1. fctxt c1 @ [c2]) \\<in> ctxt\"\n| C_Choose1: \"(E, fctxt) \\<in> ctxt \\<Longrightarrow> (\\<lambda>c1. E c1 \\<oplus> c2, fctxt) \\<in> ctxt\"\n| C_Choose2: \"(E, fctxt) \\<in> ctxt \\<Longrightarrow> (\\<lambda>c2. c1 \\<oplus> E c2, fctxt) \\<in> ctxt\"\n\ntext\\<open>\n\nWe can decompose a small step into a context and a @{const \"basic_com\"}.\n\n\\<close>\n\nfun\n  decompose_com :: \"('answer, 'location, 'question, 'state) com\n                      \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                        \\<times> ('answer, 'location, 'question, 'state) ctxt ) set\"\nwhere\n  \"decompose_com (LOOP DO c1 OD) = { (c, \\<lambda>t. LOOP DO ictxt t OD, \\<lambda>t. fctxt t @ [LOOP DO ictxt t OD]) |c fctxt ictxt. (c, ictxt, fctxt) \\<in> decompose_com c1 }\"\n| \"decompose_com (c1;; c2) = { (c, \\<lambda>t. ictxt t;; c2, \\<lambda>t. fctxt t @ [c2]) |c fctxt ictxt. (c, ictxt, fctxt) \\<in> decompose_com c1 }\"\n| \"decompose_com (c1 \\<oplus> c2) = { (c, \\<lambda>t. ictxt t \\<oplus> c2, fctxt) |c fctxt ictxt. (c, ictxt, fctxt) \\<in> decompose_com c1 }\n                           \\<union> { (c, \\<lambda>t. c1 \\<oplus> ictxt t, fctxt) |c fctxt ictxt. (c, ictxt, fctxt) \\<in> decompose_com c2 }\"\n| \"decompose_com c = {(c, id, \\<langle>[]\\<rangle>)}\"\n\ndefinition\n  decomposeLS :: \"('answer, 'location, 'question, 'state) local_state\n               \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                 \\<times> (('answer, 'location, 'question, 'state) com \\<Rightarrow> ('answer, 'location, 'question, 'state) com)\n                 \\<times> (('answer, 'location, 'question, 'state) com \\<Rightarrow> ('answer, 'location, 'question, 'state) com list) ) set\"\nwhere\n  \"decomposeLS s = (case cPGM s of c # _ \\<Rightarrow> decompose_com c | _ \\<Rightarrow> {})\"\n\nlemma ctxt_inj:\n  assumes \"(E, fctxt) \\<in> ctxt\"\n  assumes \"E x = E y\"\n  shows \"x = y\"\nusing assms by (induct set: ctxt) auto\n\nlemma decompose_com_non_empty: \"decompose_com c \\<noteq> {}\"\nby (induct c) auto\n\nlemma decompose_com_basic_com:\n  assumes \"(c', ctxts) \\<in> decompose_com c\"\n  shows \"basic_com c'\"\nusing assms by (induct c arbitrary: c' ctxts) (auto intro: basic_com.intros)\n\nlemma decomposeLS_basic_com:\n  assumes \"(c', ctxts) \\<in> decomposeLS s\"\n  shows \"basic_com c'\"\nusing assms unfolding decomposeLS_def by (simp add: decompose_com_basic_com split: list.splits)\n\nlemma decompose_com_ctxt:\n  assumes \"(c', ctxts) \\<in> decompose_com c\"\n  shows \"ctxts \\<in> ctxt\"\nusing assms by (induct c arbitrary: c' ctxts) (auto intro: ctxt.intros)\n\nlemma decompose_com_ictxt:\n  assumes \"(c', ictxt, fctxt) \\<in> decompose_com c\"\n  shows \"ictxt c' = c\"\nusing assms by (induct c arbitrary: c' ictxt fctxt) auto\n\nlemma decompose_com_small_step:\n  assumes as: \"(c' # fctxt c' @ cs, s) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> s'\"\n  assumes ds: \"(c', ictxt, fctxt) \\<in> decompose_com c\"\n  shows \"(c # cs, s) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> s'\"\nusing decompose_com_ctxt[OF ds] as decompose_com_ictxt[OF ds]\nby (induct ictxt fctxt arbitrary: c cs)\n   (cases s', fastforce simp: fun_eq_iff dest: ctxt_inj)+\n\ntheorem context_decompose:\n  \"s \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> s' \\<longleftrightarrow> (\\<exists>(c, ictxt, fctxt) \\<in> decomposeLS s.\n                     cPGM s = ictxt c # tl (cPGM s)\n                   \\<and> (c # fctxt c @ tl (cPGM s), cTKN s, cLST s) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> s'\n                   \\<and> (\\<forall>l\\<in>atC c. cTKN s' = Some l))\" (is \"?lhs = ?rhs\")\nproof(rule iffI)\n  assume ?lhs then show ?rhs\n  unfolding decomposeLS_def\n  proof(induct rule: small_step.induct)\n    case (Choose1 c1 cs s \\<alpha> cs' s' c2) then show ?case\n      apply clarsimp\n      apply (rename_tac c ictxt fctxt)\n      apply (rule_tac x=\"(c, \\<lambda>t. ictxt t \\<oplus> c2, fctxt)\" in bexI)\n      apply auto\n      done\n  next\n    case (Choose2 c2 cs s \\<alpha> cs' s' c1) then show ?case\n      apply clarsimp\n      apply (rename_tac c ictxt fctxt)\n      apply (rule_tac x=\"(c, \\<lambda>t. c1 \\<oplus> ictxt t, fctxt)\" in bexI)\n      apply auto\n      done\n  qed fastforce+\nnext\n  assume ?rhs then show ?lhs\n    unfolding decomposeLS_def\n    by (cases s) (auto split: list.splits dest: decompose_com_small_step)\nqed\n\ntext\\<open>\n\nWhile we only use this result left-to-right (to decompose a small step\ninto a basic one), this equivalence shows that we lose no information\nin doing so.\n\nDecomposing a compound command preserves @{const \\<open>fragments\\<close>} too.\n\n\\<close>\n\nfun\n  loc_compC :: \"('answer, 'location, 'question, 'state) com\n                            \\<Rightarrow> ('answer, 'location, 'question, 'state) com list\n                            \\<Rightarrow> ('answer, 'location, 'question, 'state) loc_comp\"\nwhere\n  \"loc_compC (\\<lbrace>l\\<rbrace> IF b THEN c FI) cs = lcond (atC c) (atCs cs) b\"\n| \"loc_compC (\\<lbrace>l\\<rbrace> IF b THEN c1 ELSE c2 FI) cs = lcond (atC c1) (atC c2) b\"\n| \"loc_compC (LOOP DO c OD) cs = lconst (atC c)\"\n| \"loc_compC (\\<lbrace>l\\<rbrace> WHILE b DO c OD) cs = lcond (atC c) (atCs cs) b\"\n| \"loc_compC c cs = lconst (atCs cs)\"\n\nlemma decompose_fragments:\n  assumes \"(c, ictxt, fctxt) \\<in> decompose_com c0\"\n  shows \"(c, loc_compC c (fctxt c @ cs)) \\<in> fragments c0 (atCs cs)\"\nusing assms\nproof(induct c0 arbitrary: c ictxt fctxt cs)\n  case (Loop c01 c ictxt fctxt cs)\n  from Loop.prems Loop.hyps(1)[where cs=\"ictxt c # cs\"] show ?case by (auto simp: decompose_com_ictxt)\nnext\n  case (Seq c01 c02 c ictxt fctxt cs)\n  from Seq.prems Seq.hyps(1)[where cs=\"c02 # cs\"] show ?case by auto\nqed auto\n\n\n\nlemma at_decomposeLS:\n  assumes \"(c, ictxt, fctxt) \\<in> decomposeLS s\"\n  shows \"atC c \\<subseteq> atCs (cPGM s)\"\nusing assms unfolding decomposeLS_def by (auto simp: at_decompose split: list.splits)\n\nlemma decomposeLS_fragmentsLS:\n  assumes \"(c, ictxt, fctxt) \\<in> decomposeLS s\"\n  shows \"(c, loc_compC c (fctxt c @ tl (cPGM s))) \\<in> fragmentsLS s\"\nusing assms\nproof(cases \"cPGM s\")\n  case (Cons d ds)\n  with assms decompose_fragments[where cs=\"ds\"] show ?thesis\n    by (cases ds) (auto simp: decomposeLS_def)\nqed (simp add: decomposeLS_def)\n\nlemma small_step_loc_compC:\n  assumes \"basic_com c\"\n  assumes \"(c # cs, ls) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> ls'\"\n  shows \"loc_compC c cs (snd ls) = atCs (cPGM ls')\"\nusing assms by (fastforce elim: basic_com.cases elim!: small_step_inv split: lcond_splits)\n\ntext\\<open>\n\nThe headline result allows us to constrain the initial and final states\nof a given small step in terms of the original programs, provided the\ninitial state is reachable.\n\n\\<close>\n\ntheorem decompose_small_step:\n  assumes \"GST sh p \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> ps'\"\n  assumes \"reachable_state sys sh\"\n  obtains c cs aft\n    where \"(c, aft) \\<in> fragments (PGMs sys p) {}\"\n      and \"atC c \\<subseteq> atCs (cPGM (GST sh p))\"\n      and \"aft (cLST (GST sh p)) = atCs (cPGM ps')\"\n      and \"(c # cs, cTKN (GST sh p), cLST (GST sh p)) \\<rightarrow>\\<^bsub>\\<alpha>\\<^esub> ps'\"\n      and \"\\<forall>l\\<in>atC c. cTKN ps' = Some l\"\nusing assms\napply -\napply (frule iffD1[OF context_decompose])\napply clarsimp\napply (frule decomposeLS_fragmentsLS)\napply (frule at_decomposeLS)\napply (frule (1) subsetD[OF reachable_state_fragmentsLS])\napply (frule decomposeLS_basic_com)\napply (frule (1) small_step_loc_compC)\napply simp\ndone\n\ntext\\<open>\n\nReasoning by induction over the reachable states\nwith @{thm [source] \"decompose_small_step\"} is quite tedious. We\nprovide a very simple VCG that generates friendlier local proof\nobligations in \\S\\ref{sec:vcg}.\n\n\\<close>\n\n\nsubsection\\<open>Simple-minded Hoare Logic/VCG for CIMP \\label{sec:vcg}\\<close>\n\ntext\\<open>\n\n\\label{sec:cimp-vcg}\n\nWe do not develop a proper Hoare logic or full VCG for CIMP: this\nmachinery merely packages up the subgoals that arise from induction\nover the reachable states (\\S\\ref{sec:cimp-invariants}). This is\nsomewhat in the spirit of \\<^citet>\\<open>\"Ridge:2009\"\\<close>.\n\nNote that this approach is not compositional: it consults the original\nsystem to find matching communicating pairs, and \\<open>aft\\<close>\ntracks the labels of possible successor statements. More serious Hoare\nlogics are provided by \\<^citet>\\<open>\"DBLP:journals/acta/Lamport80\" and \"DBLP:journals/toplas/LamportS84\"\nand \"CousotCousot89-IC\"\\<close>.\n\nIntuitively we need to discharge a proof obligation for either @{const\n\"Request\"}s or @{const \"Response\"}s but not both. Here we choose to\nfocus on @{const \"Request\"}s as we expect to have more local\ninformation available about these.\n\n\\<close>\n\ninductive\n  vcg :: \"('answer, 'location, 'proc, 'question, 'state) programs\n        \\<Rightarrow> 'proc\n        \\<Rightarrow> ('answer, 'location, 'question, 'state) loc_comp\n        \\<Rightarrow> ('answer, 'location, 'proc, 'question, 'state) state_pred\n        \\<Rightarrow> ('answer, 'location, 'question, 'state) com\n        \\<Rightarrow> ('answer, 'location, 'proc, 'question, 'state) state_pred\n        \\<Rightarrow> bool\" (\"_, _, _ \\<turnstile>/ \\<lbrace>_\\<rbrace>/ _/ \\<lbrace>_\\<rbrace>\" [11,0,0,0,0,0] 11)\nwhere\n  \"\\<lbrakk> \\<And>aft' action' s ps' p's' l' \\<beta> s' p'.\n      \\<lbrakk> pre s; (\\<lbrace>l'\\<rbrace> Response action', aft') \\<in> fragments (coms p') {}; p \\<noteq> p';\n        ps' \\<in> val \\<beta> (s\\<down> p); (p's', \\<beta>) \\<in> action' (action (s\\<down> p)) (s\\<down> p');\n        at p l s; at p' l' s;\n        AT s' = (AT s)(p := aft (s\\<down> p), p' := aft' (s\\<down> p'));\n        s'\\<down> = s\\<down>(p := ps', p' := p's');\n        taken p l s';\n        HST s' = HST s @ [(action (s\\<down> p), \\<beta>)];\n        \\<forall>p''\\<in>-{p,p'}. GST s' p'' = GST s p''\n      \\<rbrakk> \\<Longrightarrow> post s'\n   \\<rbrakk> \\<Longrightarrow> coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> Request action val \\<lbrace>post\\<rbrace>\"\n| \"\\<lbrakk> \\<And>s ps' s'.\n      \\<lbrakk> pre s; ps' \\<in> f (s\\<down> p);\n        at p l s;\n        AT s' = (AT s)(p := aft (s\\<down> p));\n        s'\\<down> = s\\<down>(p := ps');\n        taken p l s';\n        HST s' = HST s;\n        \\<forall>p''\\<in>-{p}. GST s' p'' = GST s p''\n      \\<rbrakk> \\<Longrightarrow> post s'\n   \\<rbrakk> \\<Longrightarrow> coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> LocalOp f \\<lbrace>post\\<rbrace>\"\n| \"\\<lbrakk> \\<And>s s'.\n      \\<lbrakk> pre s;\n        at p l s;\n        AT s' = (AT s)(p := aft (s\\<down> p));\n        s'\\<down> = s\\<down>;\n        taken p l s';\n        HST s' = HST s;\n        \\<forall>p''\\<in>-{p}. GST s' p'' = GST s p''\n      \\<rbrakk> \\<Longrightarrow> post s'\n   \\<rbrakk> \\<Longrightarrow> coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> IF b THEN t FI \\<lbrace>post\\<rbrace>\"\n| \"\\<lbrakk> \\<And>s s'.\n      \\<lbrakk> pre s;\n        at p l s;\n        AT s' = (AT s)(p := aft (s\\<down> p));\n        s'\\<down> = s\\<down>;\n        taken p l s';\n        HST s' = HST s;\n        \\<forall>p''\\<in>-{p}. GST s' p'' = GST s p''\n      \\<rbrakk> \\<Longrightarrow> post s'\n   \\<rbrakk> \\<Longrightarrow> coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> IF b THEN t ELSE e FI \\<lbrace>post\\<rbrace>\"\n| \"\\<lbrakk> \\<And>s s'.\n      \\<lbrakk> pre s;\n        at p l s;\n        AT s' = (AT s)(p := aft (s\\<down> p));\n        s'\\<down> = s\\<down>;\n        taken p l s';\n        HST s' = HST s;\n        \\<forall>p''\\<in>-{p}. GST s' p'' = GST s p''\n      \\<rbrakk> \\<Longrightarrow> post s'\n   \\<rbrakk> \\<Longrightarrow> coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> WHILE b DO c OD \\<lbrace>post\\<rbrace>\"\n\\<comment> \\<open>There are no proof obligations for the following commands, but including them makes some basic rules hold (\\S\\ref{sec:cimp:vcg_rules}):\\<close>\n| \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> Response action \\<lbrace>post\\<rbrace>\"\n| \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> c1 ;; c2 \\<lbrace>post\\<rbrace>\"\n| \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> LOOP DO c OD \\<lbrace>post\\<rbrace>\"\n| \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> c1 \\<oplus> c2 \\<lbrace>post\\<rbrace>\"\n\ntext\\<open>\n\nWe abbreviate invariance with one-sided validity syntax.\n\n\\<close>\n\nabbreviation valid_inv (\"_, _, _ \\<turnstile>/ \\<lbrace>_\\<rbrace>/ _\" [11,0,0,0,0] 11) where\n  \"coms, p, aft \\<turnstile> \\<lbrace>I\\<rbrace> c \\<equiv> coms, p, aft \\<turnstile> \\<lbrace>I\\<rbrace> c \\<lbrace>I\\<rbrace>\"\n\ninductive_cases vcg_inv:\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> Request action val \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> LocalOp f \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> IF b THEN t FI \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> IF b THEN t ELSE e FI \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> WHILE b DO c OD \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> LOOP DO c OD \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> \\<lbrace>l\\<rbrace> Response action \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> c1 ;; c2 \\<lbrace>post\\<rbrace>\"\n  \"coms, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> Choose c1 c2 \\<lbrace>post\\<rbrace>\"\n\ntext\\<open>\n\nWe tweak @{const \"fragments\"} by omitting @{const \"Response\"}s,\nyielding fewer obligations\n\n\\<close>\n\nfun\n  vcg_fragments' :: \"('answer, 'location, 'question, 'state) com\n               \\<Rightarrow> 'location set\n               \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                 \\<times> ('answer, 'location, 'question, 'state) loc_comp ) set\"\nwhere\n  \"vcg_fragments' (\\<lbrace>l\\<rbrace> Response action) aft = {}\"\n| \"vcg_fragments' (\\<lbrace>l\\<rbrace> IF b THEN c FI) aft\n       = vcg_fragments' c aft\n       \\<union> { (\\<lbrace>l\\<rbrace> IF b THEN c' FI, lcond (atC c) aft b) |c'. True }\"\n| \"vcg_fragments' (\\<lbrace>l\\<rbrace> IF b THEN c1 ELSE c2 FI) aft\n       = vcg_fragments' c2 aft \\<union> vcg_fragments' c1 aft\n       \\<union> { (\\<lbrace>l\\<rbrace> IF b THEN c1' ELSE c2' FI, lcond (atC c1) (atC c2) b) |c1' c2'. True }\"\n| \"vcg_fragments' (LOOP DO c OD) aft = vcg_fragments' c (atC c)\"\n| \"vcg_fragments' (\\<lbrace>l\\<rbrace> WHILE b DO c OD) aft\n       = vcg_fragments' c {l} \\<union> { (\\<lbrace>l\\<rbrace> WHILE b DO c' OD, lcond (atC c) aft b) |c'. True }\"\n| \"vcg_fragments' (c1 ;; c2) aft = vcg_fragments' c2 aft \\<union> vcg_fragments' c1 (atC c2)\"\n| \"vcg_fragments' (c1 \\<oplus> c2) aft = vcg_fragments' c1 aft \\<union> vcg_fragments' c2 aft\"\n| \"vcg_fragments' c aft = {(c, lconst aft)}\"\n\nabbreviation\n  vcg_fragments :: \"('answer, 'location, 'question, 'state) com\n                  \\<Rightarrow> ( ('answer, 'location, 'question, 'state) com\n                    \\<times> ('answer, 'location, 'question, 'state) loc_comp ) set\"\nwhere\n  \"vcg_fragments c \\<equiv> vcg_fragments' c {}\"\n\nfun isResponse :: \"('answer, 'location, 'question, 'state) com \\<Rightarrow> bool\" where\n  \"isResponse (\\<lbrace>l\\<rbrace> Response action) \\<longleftrightarrow> True\"\n| \"isResponse _ \\<longleftrightarrow> False\"\n\nlemma fragments_vcg_fragments':\n  \"\\<lbrakk> (c, aft) \\<in> fragments c' aft'; \\<not>isResponse c \\<rbrakk> \\<Longrightarrow> (c, aft) \\<in> vcg_fragments' c' aft'\"\nby (induct c' arbitrary: aft') auto\n\nlemma vcg_fragments'_fragments:\n  \"vcg_fragments' c' aft' \\<subseteq> fragments c' aft'\" \nby (induct c' arbitrary: aft') (auto 10 0)\n\nlemma VCG_step:\n  assumes V: \"\\<And>p. \\<forall>(c, aft) \\<in> vcg_fragments (PGMs sys p). PGMs sys, p, aft \\<turnstile> \\<lbrace>pre\\<rbrace> c \\<lbrace>post\\<rbrace>\"\n  assumes S: \"system_step p sh' sh\"\n  assumes R: \"reachable_state sys sh\"\n  assumes P: \"pre sh\"\n  shows \"post sh'\"\nusing S\nproof cases\n  case LocalStep with P show ?thesis\n    apply -\n    apply (erule decompose_small_step[OF _ R])\n    apply (frule fragments_basic_com)\n    apply (erule basic_com.cases)\n    apply (fastforce dest!: fragments_vcg_fragments' V[rule_format]\n                      elim: vcg_inv elim!: small_step_inv\n                      simp: LST_def AT_def taken_def fun_eq_iff)+\n    done\nnext\n  case CommunicationStep with P show ?thesis\n    apply -\n    apply (erule decompose_small_step[OF _ R])\n    apply (erule decompose_small_step[OF _ R])\n    subgoal for c cs aft c' cs' aft'\n    apply (frule fragments_basic_com[where c'=c])\n    apply (frule fragments_basic_com[where c'=c'])\n    apply (elim basic_com.cases; clarsimp elim!: small_step_inv)\n    apply (drule fragments_vcg_fragments')\n    apply (fastforce dest!: V[rule_format]\n                      elim: vcg_inv elim!: small_step_inv\n                      simp: LST_def AT_def taken_def fun_eq_iff)+\n    done\n    done\nqed\n\ntext\\<open>\n\nThe user sees the conclusion of \\<open>V\\<close> for each element of @{const \\<open>vcg_fragments\\<close>}.\n\n\\<close>\n\nlemma VCG_step_inv_stable:\n  assumes V: \"\\<And>p. \\<forall>(c, aft) \\<in> vcg_fragments (PGMs sys p). PGMs sys, p, aft \\<turnstile> \\<lbrace>I\\<rbrace> c\"\n  assumes \"prerun sys \\<sigma>\"\n  shows \"(\\<lceil>I\\<rceil> \\<^bold>\\<hookrightarrow> \\<circle>\\<lceil>I\\<rceil>) \\<sigma>\"\napply (rule alwaysI)\napply clarsimp\napply (rule nextI)\napply clarsimp\nusing assms(2) unfolding prerun_def\napply clarsimp\napply (erule_tac i=i in alwaysE)\nunfolding system_step_reflclp_def\napply clarsimp\napply (erule disjE; clarsimp)\nusing VCG_step[where pre=I and post=I] V assms(2) prerun_reachable_state\napply blast\ndone\n\nlemma VCG:\n  assumes I: \"\\<forall>s. initial_state sys s \\<longrightarrow> I (\\<lparr>GST = s, HST = []\\<rparr>)\"\n  assumes V: \"\\<And>p. \\<forall>(c, aft) \\<in> vcg_fragments (PGMs sys p). PGMs sys, p, aft \\<turnstile> \\<lbrace>I\\<rbrace> c\"\n  shows \"sys \\<Turnstile>\\<^bsub>pre\\<^esub> I\"\napply (rule prerun_valid_induct)\n apply (clarsimp simp: prerun_def state_prop_def)\n apply (metis (full_types) I old.unit.exhaust system_state.surjective)\nusing VCG_step_inv_stable[OF V] apply blast\ndone\n\nlemmas VCG_valid = valid_prerun_lift[OF VCG, of sys I] for sys I\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/ConcurrentIMP/CIMP_vcg.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5117166047041654, "lm_q2_score": 0.6150878555160665, "lm_q1q2_score": 0.31475066901944776}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"32-Bit Machine Word Setup\"\n\ntheory Word_Setup_32\nimports Word_Enum\nbegin\n\ntext \\<open>This theory defines standard platform-specific word size and alignment.\\<close>\n\ndefinition\n  word_bits :: nat where\n  \"word_bits \\<equiv> len_of TYPE(32)\"\n\ndefinition\n  word_size :: \"'a :: numeral\" where\n  \"word_size \\<equiv> 4\"\n\nlemma word_bits_conv[code]:\n  \"word_bits = 32\" unfolding word_bits_def by simp\n\nlemma word_bits_word_size_conv:\n  \"word_bits = word_size * 8\"\n  unfolding word_bits_def word_size_def by simp\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/lib/Word_Lib/Word_Setup_32.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160664, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3147506690194477}}
{"text": "theory Fibonacci\n  imports \"../DP_Lifting\" \"../DP_CRelVS\" \"../DP_Proof\"\nbegin\n  \n  (*\nfun fib :: \"nat \\<Rightarrow> int option\" where\n  \"fib 0 = Some 0\"\n| \"fib (Suc 0) = Some 1\"\n| \"fib (Suc (Suc n)) = (case (fib (Suc n), fib n) of (Some f1, Some f0) \\<Rightarrow> Some (f1 + f0) | _ \\<Rightarrow> None)\"\nterm 0 (**)\n*)\n\nfun fib :: \"nat \\<Rightarrow> int option\" where\n  \"fib 0 = Some 0\"\n| \"fib (Suc 0) = Some 1\"\n| \"fib (Suc (Suc n)) = case_prod\n      (\\<lambda>of1 of0. case_option\n        None\n        (\\<lambda>f1. case_option\n          None\n          (\\<lambda>f0. Some (f1 + f0))\n          of0)\n        of1)\n      (Pair (fib (Suc n)) (fib n))\"\n\nML_file \\<open>../Transform.ML\\<close>\nlocal_setup \\<open>\nlift_fun NONE;\n\\<close>\n\ninterpretation fib: dp_consistency fib .\n\nlemma fib\\<^sub>T_correct:\n  \"fib.consistentDP fib\\<^sub>T\"\n  by (dp_match induct: fib\\<^sub>T.induct simp: fib.simps simp\\<^sub>T: fib\\<^sub>T.simps)\n\ndefinition fib\\<^sub>T_entry :: \"nat \\<Rightarrow> int option\" where\n  \"fib\\<^sub>T_entry n \\<equiv> fst (runState (fib\\<^sub>T n) Mapping.empty)\"\n\nlemma fib\\<^sub>T_entry_correct:\n  \"fib\\<^sub>T_entry = fib\"\n  unfolding fib\\<^sub>T_entry_def using fib.consistentDP_entry[OF fib\\<^sub>T_correct] ..\n\nlemma Let_absorb:\n  \"(let (a, b) = (let (c, d) = x in (p c d, q c d)) in f a b)\n = (let (c, d) = x; (a, b) = (p c d, q c d) in f a b)\"\n  by (auto simp: Let_def split: prod.splits)\n\nlemma Let_absorb2:\n  \"(let (a, b) = (let (c, d) = x; (e, f) = y c d in (p c d e f, q c d e f)) in g a b)\n = (let (c, d) = x; (e, f) = y c d; (a, b) = (p c d e f, q c d e f) in g a b)\"\n  by (auto simp: Let_def split: prod.splits)\n\nlemma Let_unfold_pair:\n  \"(let (a, b) = (x, y) in f a b) = f x y\"\n  by (auto simp: Let_def split: prod.splits)\n\nlemma Let_split_pair:\n  \"(let (a, b) = (x, y) in f a b) = (let a=x; b=y in f a b)\"\n  by auto\n\nlemma runState_option:\n  \"runState (case x of None \\<Rightarrow> f0 | Some y \\<Rightarrow> ifSome f1 y) M\n = (case x of None \\<Rightarrow> runState f0 M | Some y \\<Rightarrow> runState (ifSome f1 y) M)\"\n  by (auto split: option.split)\n\n\ndefinition \"runState' \\<equiv> runState\"\n\n\nschematic_goal fib\\<^sub>T_simp1:\n  \"runState (fib\\<^sub>T 0) M = ?x\"\n  apply (subst fib\\<^sub>T.simps(1))\n  apply (subst checkmem_def)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst get_def)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst bind_def)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst bind_def)\n  apply (subst get_def)\n  apply (subst state.sel)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst bind_def)\n  apply (subst put_def)\n  apply (subst state.sel)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst runState_option)\n  apply (subst state.sel)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (rule refl)\n  done\n\nschematic_goal fib\\<^sub>T_simp2:\n  \"runState (fib\\<^sub>T (Suc 0)) M = ?x\"\n  apply (subst fib\\<^sub>T.simps(2))\n  apply (subst checkmem_def)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst get_def)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst bind_def)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst bind_def)\n  apply (subst get_def)\n  apply (subst state.sel)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst bind_def)\n  apply (subst put_def)\n  apply (subst state.sel)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst runState_option)\n  apply (subst state.sel)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (rule refl)\n  done\n\nschematic_goal fib\\<^sub>T_simp3:\n  \"runState (fib\\<^sub>T (Suc (Suc n))) M = ?x\"\n  apply (subst fib\\<^sub>T.simps(3))\n  apply (subst checkmem_def)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst get_def)\n  apply (subst state.sel)\n  apply (subst Let_def)\n  apply (subst prod.case)\n  apply (subst fun_app_lifted_def)\n  apply (subst bind_def)\n  apply (subst case_prod\\<^sub>T_def)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst Let_def)\n  apply (subst prod.case)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst Let_def)\n  apply (subst prod.case)\n  apply (subst unlift_33_def)\n  apply (subst fun_app_lifted_def)\n  apply (subst bind_def)\n  apply (subst return_def)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst state.sel)\n  apply (subst return_def)\n  apply (subst Let_unfold_pair)\n  apply (subst state.collapse)\n  apply (subst bind_def)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst state.sel)\n  apply (subst bind_def)\n  apply (subst fun_app_lifted_def)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst state.collapse)\n  apply (subst fun_app_lifted_def)\n  apply (subst bind_def)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst state.collapse)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst fun_app_lifted_def)\n  apply (subst bind_def)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst state.collapse)\n  apply (subst fun_app_lifted_def)\n  apply (subst bind_def)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst Let_absorb)\n  apply (subst Let_unfold_pair)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst state.sel)\n  apply (subst Let_absorb2)\n  apply (subst Let_unfold_pair)\n  apply (subst prod.case)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst Let_absorb2)\n  apply (subst Let_split_pair)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst bind_def)\n  apply (subst state.sel)\n  apply (subst put_def)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst get_def)\n  apply (subst state.sel)\n  apply (subst Let_unfold_pair)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (subst runState_option)\n  apply (subst state.sel)\n  apply (subst return_def)\n  apply (subst state.sel)\n  apply (unfold runState'_def[symmetric])\n  apply (rule refl)\n  done\n\nlemmas fib\\<^sub>T_runState_simps[code_unfold] =\n  fib\\<^sub>T_simp1 fib\\<^sub>T_simp2 fib\\<^sub>T_simp3\n\nfun fib\\<^sub>T' :: \"nat \\<Rightarrow> (nat, int option) mapping \\<Rightarrow> (int option \\<times> (nat, int option) mapping)\" where\n  \"fib\\<^sub>T' 0 M = runState (fib\\<^sub>T 0) M\"\n| \"fib\\<^sub>T' (Suc 0) M = runState (fib\\<^sub>T (Suc 0)) M\"\n| \"fib\\<^sub>T' (Suc (Suc n)) M = runState (fib\\<^sub>T (Suc (Suc n))) M\"\n\nlemma runState'_fold[code_unfold]:\n  \"runState' (fib\\<^sub>T n) M = fib\\<^sub>T' n M\"\n  unfolding runState'_def by (induction rule: fib\\<^sub>T'.induct) auto\n\ndefinition fib\\<^sub>T'_entry where\n  \"fib\\<^sub>T'_entry n \\<equiv> fst (fib\\<^sub>T' n Mapping.empty)\"\n\nlemma fib\\<^sub>T'_entry_correct:\n  \"fib\\<^sub>T'_entry = fib\"\n  apply (unfold fib\\<^sub>T_entry_correct[symmetric])\n  unfolding fib\\<^sub>T'_entry_def fib\\<^sub>T_entry_def\n  apply (rule ext)\n  apply (rule arg_cong[where f=fst])\n  apply (induct_tac rule: fib\\<^sub>T'.induct)\n    apply auto\n  done\n\nexport_code fib\\<^sub>T'_entry in SML\n\nend", "meta": {"author": "exprosic", "repo": "hiwi", "sha": "4cc57f6a1bab0ca84fe6e3093c54dfea9d0d4da6", "save_path": "github-repos/isabelle/exprosic-hiwi", "path": "github-repos/isabelle/exprosic-hiwi/hiwi-4cc57f6a1bab0ca84fe6e3093c54dfea9d0d4da6/scratch/dp/example/Fibonacci.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5117166047041652, "lm_q1q2_score": 0.3147506690194477}}
{"text": "theory Hopcroft_Tarjan_3\n  imports\n    Hopcroft_Tarjan\nbegin\n\ntype_synonym ('a, 'b) component = \"('a, 'b) Directed_Multigraph.edge list\"\n\nrecord ('b, 't, 'g, 'a) state =\n  root :: 'b\n  tree :: 't\n  multigraph :: 'g\n  ESTACK :: \"('a, 'b) Directed_Multigraph.edge list\"\n  Cs :: \"('a, 'b) component list\"\n\nlocale path_search =\n  other\n  where other = other +\n    T: Map\n  where empty = T_empty\n    and update = T_update\n    and delete = T_delete\n    and lookup = T_lookup\n    and invar = T_invar +\n    P: Incidence_Structure\n  where insert = insert\n  for other :: \"('a::linorder, 'b::linorder) Multigraph.edge \\<Rightarrow> 'b \\<Rightarrow> 'b\"\n    and T_empty\n    and T_update :: \"'b \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 't \\<Rightarrow> 't\"\n    and T_delete\n    and T_lookup\n    and T_invar\n    and insert :: \"'b \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 'g \\<Rightarrow> 'g\" +\n  fixes algorithm_5 :: \"('b \\<Rightarrow> nat) \\<Rightarrow> ('a, 'b) Directed_Multigraph.edge \\<Rightarrow> ('b, 't, 'g, 'a) state \\<Rightarrow> ('b, 't, 'g, 'a) state\"\n  fixes algorithm_6 :: \"('b \\<Rightarrow> nat) \\<Rightarrow> ('a, 'b) Directed_Multigraph.edge \\<Rightarrow> ('b, 't, 'g, 'a) state \\<Rightarrow> ('b, 't, 'g, 'a) state\"\n  assumes root_algorithm_5: \"root (algorithm_5 N e \\<sigma>) = root \\<sigma>\"\n  assumes root_algorithm_6: \"root (algorithm_6 N e \\<sigma>) = root \\<sigma>\"\nbegin\n\ndefinition tree_arc_2 where\n  \"tree_arc_2 e \\<sigma> \\<equiv> tree.tree_arc (T_lookup (tree \\<sigma>)) e\"\n\ndefinition incidence_2 where\n  \"incidence_2 G \\<equiv> Directed_Multigraph.incidence (\\<lambda>v. incidence v G)\"\n\n(*\nfunction (domintros) path_search where\n  \"path_search N e \\<sigma> =\n   (if tree_arc_2 e \\<sigma>\n    then let \\<sigma>1 = fold (path_search N) (incidence_2 (multigraph \\<sigma>) (head e)) \\<sigma>;\n             \\<sigma>2 = \\<sigma>1\\<lparr>ESTACK := e # ESTACK \\<sigma>1\\<rparr>;\n             \\<sigma>3 = algorithm_5 N e \\<sigma>2;\n             \\<sigma>4 = algorithm_6 N e \\<sigma>3\n         in \\<sigma>4\n    else \\<sigma>\\<lparr>ESTACK := e # ESTACK \\<sigma>\\<rparr>)\"\n  by auto\nthm path_search.pinduct\n*)\n\nfunction (domintros) path_search where\n  \"path_search N v \\<sigma> =\n   fold\n    (\\<lambda>e \\<sigma>'.\n        if tree_arc_2 e \\<sigma>\n        then let \\<sigma>1 = path_search N (head e) \\<sigma>';\n                 \\<sigma>2 = \\<sigma>1\\<lparr>ESTACK := e # ESTACK \\<sigma>1\\<rparr>;\n                 \\<sigma>3 = algorithm_5 N e \\<sigma>2;\n                 \\<sigma>4 = algorithm_6 N e \\<sigma>3\n             in \\<sigma>4\n        else \\<sigma>'\\<lparr>ESTACK := e # ESTACK \\<sigma>'\\<rparr>)\n    (incidence_2 (multigraph \\<sigma>) v)\n    \\<sigma>\"\n  by auto\nthm path_search.pinduct\n\ndefinition traverse_tree_arc where\n  \"traverse_tree_arc N e \\<sigma> \\<equiv>\n   let \\<sigma>1 = path_search N (head e) \\<sigma>;\n       \\<sigma>2 = \\<sigma>1\\<lparr>ESTACK := e # ESTACK \\<sigma>1\\<rparr>;\n       \\<sigma>3 = algorithm_5 N e \\<sigma>2;\n       \\<sigma>4 = algorithm_6 N e \\<sigma>3\n   in \\<sigma>4\"\n\ndefinition traverse_frond where\n  \"traverse_frond N e \\<sigma> = \\<sigma>\\<lparr>ESTACK := e # ESTACK \\<sigma>\\<rparr>\"\n\ndefinition traverse_edge where\n  \"traverse_edge N e \\<sigma> \\<equiv>\n   if tree_arc_2 e \\<sigma> then traverse_tree_arc N e \\<sigma>\n   else traverse_frond N e \\<sigma>\"\n\nend\n\nlocale algorithm_3_pre = path_search\n  where T_update = T_update\n    and insert = insert\n  for T_update :: \"'b::linorder \\<Rightarrow> 'a::linorder \\<times> 'b \\<Rightarrow> 't \\<Rightarrow> 't\"\n    and insert :: \"'b \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 'g \\<Rightarrow> 'g\"\nbegin\n\ndefinition init where\n  \"init r T P \\<equiv>\n   \\<lparr>root = r,\n    tree = T,\n    multigraph = P,\n    ESTACK = [],\n    Cs = []\\<rparr>\"\n\ndefinition algorithm_3 where\n  \"algorithm_3 r T P N \\<equiv>\n   let \\<sigma> = path_search N r (init r T P)\n   in ESTACK \\<sigma> # Cs \\<sigma>\"\n\nend\n\nlocale algorithm_3 = algorithm_3_pre\n  where T_update = T_update\n    and insert = insert\n  for T_update :: \"'b::linorder \\<Rightarrow> 'a::linorder \\<times> 'b \\<Rightarrow> 't \\<Rightarrow> 't\"\n    and insert :: \"'b \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 'g \\<Rightarrow> 'g\" +\n  fixes T :: \"'g \\<Rightarrow> 'b \\<Rightarrow> 't\"\n  fixes N :: \"'g \\<Rightarrow> 'b \\<Rightarrow> 'b \\<Rightarrow> nat\"\n  fixes I :: \"'g \\<Rightarrow> 'b \\<Rightarrow> 'g\"\n  assumes steps_1_2_3_high_3:\n    \"\\<lbrakk> biconnected_multigraph other (P.E G); r \\<in> Multigraph.V (P.E G) \\<rbrakk> \\<Longrightarrow>\n     steps_1_2_3_high_3 other r (\\<lambda>v. incidence v (I G r)) (N G r) (P.E G) (T_lookup (T G r))\"\nbegin\n\ndefinition algorithm_3' :: \"'g \\<Rightarrow> 'b \\<Rightarrow> ('a, 'b) Multigraph.edge list list\" where\n  \"algorithm_3' G r \\<equiv> map (map undirect) (algorithm_3 r (T G r) (I G r) (N G r))\"\n\nend\n\nsubsection \\<open>Verification of the correctness of the algorithm\\<close>\n\nsubsubsection \\<open>Assumptions on the input\\<close>\n\nlocale path_search_valid_input = path_search\n  where T_update = T_update\n    and insert = insert\n  for T_update :: \"'b::linorder \\<Rightarrow> 'a::linorder \\<times> 'b \\<Rightarrow> 't \\<Rightarrow> 't\"\n    and insert :: \"'b \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 'g \\<Rightarrow> 'g\" +\n  fixes N :: \"'b \\<Rightarrow> nat\"\n  fixes v :: 'b\n  assumes \"0 \\<le> N v\"\nbegin\n\nabbreviation path_search' where\n  \"path_search' \\<equiv> path_search N v\"\n\nabbreviation traverse_edge' where\n  \"traverse_edge' \\<equiv> traverse_edge N\"\n\nabbreviation traverse_tree_arc' where\n  \"traverse_tree_arc' \\<equiv> traverse_tree_arc N\"\n\nabbreviation traverse_frond' where\n  \"traverse_frond' \\<equiv> traverse_frond N\"\n\nend\n\nlocale algorithm_3_pre_valid_input = algorithm_3_pre\n  where T_update = T_update\n    and insert = insert\n  for T_update :: \"'b::linorder \\<Rightarrow> 'a::linorder \\<times> 'b \\<Rightarrow> 't \\<Rightarrow> 't\"\n    and insert :: \"'b \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 'g \\<Rightarrow> 'g\" +\n  fixes r :: 'b\n  fixes T :: 't\n  fixes P :: 'g\n  fixes N :: \"'b \\<Rightarrow> nat\"\n  assumes steps_1_2_3_high_2: \"steps_1_2_3_high_2 r (\\<lambda>v. incidence v P) (T_lookup T) N\"\nbegin\nsublocale path_search_valid_input\n  where N = N\n    and v = r\n  sorry\nend\n\nabbreviation (in algorithm_3_pre) algorithm_3_pre_valid_input' where\n  \"algorithm_3_pre_valid_input' \\<equiv>\n   algorithm_3_pre_valid_input\n    empty delete incidence invar\n    other\n    T_empty T_delete T_lookup T_invar\n    algorithm_5\n    algorithm_6\n    T_update\n    insert\"\n\nlocale algorithm_3_valid_input = algorithm_3\n  where T_update = T_update\n    and insert = insert\n  for T_update :: \"'b::linorder \\<Rightarrow> 'a::linorder \\<times> 'b \\<Rightarrow> 't \\<Rightarrow> 't\"\n    and insert :: \"'b \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 'g \\<Rightarrow> 'g\" +\n  fixes G :: 'g\n  fixes r :: 'b\n  assumes biconnected_multigraph: \"biconnected_multigraph other (P.E G)\"\n  assumes r_mem_V: \"r \\<in> Multigraph.V (P.E G)\"\nbegin\nsublocale algorithm_3_pre_valid_input\n  where T = \"T G r\"\n    and P = \"I G r\"\n    and N = \"N G r\"\n  sorry\nend\n\nabbreviation (in algorithm_3) algorithm_3_valid_input' where\n  \"algorithm_3_valid_input' \\<equiv>\n   algorithm_3_valid_input\n    empty delete incidence invar\n    other\n    T_empty T_delete T_lookup T_invar\n    algorithm_5\n    algorithm_6\n    T\n    N\n    I\n    T_update\n    insert\"\n\nsubsubsection \\<open>Loop invariants\\<close>\n\nlocale path_search_invar = path_search_valid_input\n  where T_update = T_update\n    and insert = insert\n  for T_update :: \"'b::linorder \\<Rightarrow> 'a::linorder \\<times> 'b \\<Rightarrow> 't \\<Rightarrow> 't\"\n    and insert :: \"'b \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 'g \\<Rightarrow> 'g\" +\n  fixes \\<sigma> :: \"('b, 't, 'g, 'a) state\"\n    (* QUESTION: Use P.E instead? *)\n  assumes finite_multigraph: \"finite (undirect ` P.A (multigraph \\<sigma>))\"\n  assumes simple_multigraph: \"simple (undirect ` P.A (multigraph \\<sigma>))\"\n  assumes finite_Cs: \"Ball (set (map set (map (map undirect) (Cs \\<sigma>)))) finite\"\n  assumes no_separation_pair_Cs: \"\\<forall>G\\<in>set (map set (map (map undirect) (Cs \\<sigma>))). \\<not> (\\<exists>a b. is_separation_pair G a b)\"\n    (* TODO: Order. *)\n  assumes palm_tree_2: \"palm_tree_2 (root \\<sigma>) (T_lookup (tree \\<sigma>)) (\\<lambda>v. incidence v (multigraph \\<sigma>))\"\nbegin\nend\n\nabbreviation (in path_search) path_search_invar' where\n  \"path_search_invar' N v \\<equiv>\n   path_search_invar\n    empty delete incidence invar\n    other\n    T_empty T_delete T_lookup T_invar\n    algorithm_5\n    algorithm_6\n    N\n    v\n    T_update\n    insert\"\n\nabbreviation (in path_search_valid_input) path_search_invar'' where\n  \"path_search_invar'' \\<equiv> path_search_invar' N v\"\n\nlemma (in algorithm_3_pre_valid_input) path_search_invar_init:\n  shows \"path_search_invar' N r (init r T P)\"\n  sorry\n\nsubsubsection \\<open>Termination\\<close>\n\nlemma (in path_search_valid_input) path_search_dom:\n  assumes \"path_search_invar'' \\<sigma>\"\n  shows \"path_search_dom (N, v, \\<sigma>)\"\n  sorry\n\nlemma (in path_search_invar) path_search_dom:\n  shows \"path_search_dom (N, v, \\<sigma>)\"\n  using path_search_invar_axioms\n  by (intro path_search_dom)\n\nlemma (in path_search) path_search_simps:\n  assumes \"path_search_invar' N v \\<sigma>\"\n  shows\n    \"path_search N v \\<sigma> =\n     fold (traverse_edge N) (incidence_2 (multigraph \\<sigma>) v) \\<sigma>\"\n  unfolding traverse_edge_def traverse_tree_arc_def traverse_frond_def\n  using assms\n  by (intro path_search_invar.path_search_dom path_search.psimps)\n\nlemma (in path_search) path_search_induct:\n  assumes \"path_search_invar' N v \\<sigma>\"\n  assumes\n    \"\\<And>N v \\<sigma>.\n        (\\<And>e \\<sigma>'.\n            e \\<in> set (incidence_2 (multigraph \\<sigma>) v) \\<Longrightarrow>\n            tree_arc_2 e \\<sigma> \\<Longrightarrow>\n            P N (head e) \\<sigma>') \\<Longrightarrow>\n        P N v \\<sigma>\"\n  shows \"P N v \\<sigma>\"\n  using assms\n  by (blast intro: path_search_invar.path_search_dom path_search.pinduct)\n\nsubsubsection \\<open>Correctness\\<close>\n\nlemma root_fold:\n  assumes \"\\<And>e \\<sigma>. e \\<in> set l \\<Longrightarrow> root (f e \\<sigma>) = root \\<sigma>\"\n  shows \"root (fold f l \\<sigma>) = root \\<sigma>\"\n  using assms\nproof (induct l arbitrary: \\<sigma>)\n  case Nil\n  thus ?case\n    by fastforce\nnext\n  case (Cons e es)\n  have \"root (fold f (e # es) \\<sigma>) = root (fold f es (f e \\<sigma>))\"\n    by fastforce\n  also have \"... = root (f e \\<sigma>)\"\n    using Cons.prems\n    by (intro Cons.hyps) simp\n  also have \"... = root \\<sigma>\"\n    by (intro Cons.prems) simp\n  finally show ?case\n    .\nqed\n\nlemma (in path_search) root_traverse_edge:\n  assumes\n    \"tree_arc_2 e \\<sigma> \\<Longrightarrow>\n     root (path_search N (head e) \\<sigma>) =\n     root \\<sigma>\"\n  shows \"root (traverse_edge N e \\<sigma>) = root \\<sigma>\"\nproof (cases \"tree_arc_2 e \\<sigma>\")\n  case True\n  hence\n    \"root (traverse_edge N e \\<sigma>) =\n     root (path_search N (head e) \\<sigma>)\"\n    by (simp add: traverse_edge_def traverse_tree_arc_def Let_def root_algorithm_6 root_algorithm_5)\n  also have \"... = root \\<sigma>\"\n    using True\n    by (intro assms)\n  finally show ?thesis\n    .\nnext\n  case False\n  thus ?thesis\n    by (simp add: traverse_edge_def traverse_frond_def)\nqed\n\nlemma (in path_search_valid_input) root_path_search:\n  assumes \"path_search_invar'' \\<sigma>\"\n  shows \"root (path_search N v \\<sigma>) = root \\<sigma>\"\n  using assms\nproof (induct rule: path_search_induct[OF assms])\n  case (1 N v \\<sigma>)\n  then show ?case sorry\nqed\n\n(**)\n\nlemma (in path_search_valid_input) path_search_correct:\n  assumes \"path_search_invar'' \\<sigma>\"\n  shows\n    \"let \\<sigma>' = path_search N v \\<sigma>\n     in are_split_components\n         (undirect ` P.A (multigraph \\<sigma>))\n         (map set (map (map undirect) (ESTACK \\<sigma>' # Cs \\<sigma>')))\"\n  sorry\n\nlemma (in algorithm_3_pre_valid_input) algorithm_3_correct:\n  shows \"are_split_components (undirect ` P.A P) (map set (map (map undirect) (algorithm_3 r T P N)))\"\n  using path_search_invar_init\n  by (auto simp add: algorithm_3_def Let_def init_def dest: path_search_correct)\n\nlemma (in algorithm_3_valid_input) image_undirect_A_eq_E:\n  shows \"undirect ` P.A (I G r) = P.E G\"\n  sorry\n\nlemma (in algorithm_3_valid_input) algorithm_3'_correct:\n  shows \"are_split_components (P.E G) (map set (algorithm_3' G r))\"\n  unfolding image_undirect_A_eq_E[symmetric] algorithm_3'_def\n  using algorithm_3_correct\n  .\n\nlemma (in algorithm_3) algorithm_3'_correct:\n  assumes \"algorithm_3_valid_input' G r\"\n  shows \"are_split_components (P.E G) (map set (algorithm_3' G r))\"\n  using assms\n  by (intro algorithm_3_valid_input.algorithm_3'_correct)\n\nend", "meta": {"author": "mitjakrebs", "repo": "master-s-thesis", "sha": "103462c6116a90004f6c0654748bccaf4bfd67be", "save_path": "github-repos/isabelle/mitjakrebs-master-s-thesis", "path": "github-repos/isabelle/mitjakrebs-master-s-thesis/master-s-thesis-103462c6116a90004f6c0654748bccaf4bfd67be/Hopcroft_Tarjan/Hopcroft_Tarjan_3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947425132315, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.314662960143282}}
{"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory SerialS\nimports\n  PleSle\nbegin  \ntype_synonym U8 = \"8 word\"\ntype_synonym U16 = \"16 word\"\ntype_synonym U32 = \"32 word\"\ntype_synonym U64 = \"64 word\"\n\nlemma sle32_length:\n  \"length (sle32 x) = 4\"\n  by (simp add: sle32_def length_word_rsplit_exp_size' word_size)\n\nlemma ple32_word_rcat_eq1:\n  \"ple32 (sle32 x @ xs) 0 = x\"\n  apply (simp only: ple32_def unat_0)\n  apply (subst drop_0)\n  apply (cut_tac x=x in sle32_length)\n  apply (simp add: sle32_def word_rcat_rsplit)\n  done\n  \nlemma ple32_word_rcat_eq2:\n \"length ys = (unat n) \\<Longrightarrow> ple32 (ys @ sle32 x @ xs) n = x\"\n  by (simp add: ple32_def ple32_word_rcat_eq1[simplified ple32_def, simplified])\n\nlemmas ple32_word_rcat_eq = ple32_word_rcat_eq1 ple32_word_rcat_eq2\n\nlemma sle64_length:\n  \"length (sle64 x) = 8\"\n  by (simp add: sle64_def length_word_rsplit_exp_size' word_size)\n  \nlemma ple64_word_rcat_eq1:\n  \"ple64 (sle64 x @ xs) 0 = x\"\n  apply (simp only: ple64_def unat_0)\n  apply (subst drop_0)\n  apply (cut_tac x=x in sle64_length)\n  apply (simp add: sle64_def word_rcat_rsplit)\n done\n  \nlemma ple64_word_rcat_eq2:\n \"length ys = (unat n) \\<Longrightarrow> ple64 (ys @ sle64 x @ xs) n = x\"\n  by (simp add: ple64_def ple64_word_rcat_eq1[simplified ple64_def, simplified])\n\nlemmas ple64_word_rcat_eq = ple64_word_rcat_eq1 ple64_word_rcat_eq2\n\ndefinition pObjDel :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> U64 ObjDel\"\nwhere\n  \"pObjDel data' offs' \\<equiv> ObjDel.make (ple64 data' offs') (* id *)\n  (* End 4 bytes *)\"\n       \ndefinition sObjDel :: \"ObjDel\\<^sub>T \\<Rightarrow> U8 list\"\nwhere\n  \"sObjDel odel \\<equiv> (sle64 $ ObjDel.id\\<^sub>f odel) (* id *) (* End 8 bytes *)\"\n\nlemma objDel_inverse:\n \"pObjDel (sObjDel odel) 0 = odel\"\n  apply(simp add: pObjDel_def sObjDel_def)\n  apply(simp add: ObjDel.defs)\n  using ple64_word_rcat_eq[where xs=Nil]\n  by simp\n\ndefinition pObjData :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> U32 \\<Rightarrow> ObjData\\<^sub>T\"\nwhere\n  \"pObjData data offs olen \\<equiv>\n   ObjData.make (ple64 data offs) (* id *)\n     (WordArrayT.make $ slice (unat (offs + 8)) (unat (offs + 8) + unat (olen - bilbyFsObjHeaderSize - bilbyFsObjDataHeaderSize)) data)\"\n\ndefinition sObjData :: \"ObjData\\<^sub>T \\<Rightarrow> U32 \\<Rightarrow> U8 list\"\nwhere\n  \"sObjData odata len \\<equiv> (sle64 $ ObjData.id\\<^sub>f odata) @ take (unat len) (\\<alpha>wa (ObjData.odata\\<^sub>f odata))\"\n\nlemma length_sle32: \n \"length ((sle32 (x::U32))::U8 list) = 4\"\nby (simp add: Word.length_word_rsplit_exp_size' Word.word_size sle32_def )\n\nlemma length_sle64: \n \"length ((sle64 (x::U64))::U8 list) = 8\"\nby (simp add: Word.length_word_rsplit_exp_size' Word.word_size sle64_def )\n\nlemma objData_inverse:\n  \"unat (len - bilbyFsObjHeaderSize - bilbyFsObjDataHeaderSize) = length (\\<alpha>wa (odata\\<^sub>f odata)) \\<Longrightarrow>\n  len - bilbyFsObjHeaderSize - bilbyFsObjDataHeaderSize < len \\<Longrightarrow>\n  pObjData (sObjData odata len) 0 len = odata\"\n  apply(simp add: pObjData_def)\n  apply(simp add: sObjData_def)\n  apply(simp add: ObjData.defs)\n  apply(simp add: ple64_word_rcat_eq length_sle64 slice_def)\n  apply (subgoal_tac \"unat len \\<ge> length (\\<alpha>wa (odata\\<^sub>f odata)) \")\n   apply (simp add:  wordarray_make')\n  apply unat_arith\n done\n\ndefinition\n pu8 :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> U8\"\nwhere\n \"pu8 xs offs =  word_rcat (slice (unat offs) (unat offs+1) xs)\"\n \ndefinition pObjDentry :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> ObjDentry\\<^sub>T\"\nwhere\n \"pObjDentry data offs \\<equiv>\n   let nlen = ple16 data (offs+6)\n   in ObjDentry.make\n    (ple32 data (offs+0)) (* ino *)\n    (pu8 data (offs+4))  (* dtype *)\n    (* 1 byte padding *)\n    nlen  (* nlen *)\n    (WordArrayT.make $ slice (unat (offs+ 8)) (unat (offs + 8) + unat nlen) data)  (* name *)\"\n\ndefinition pArrObjDentry :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> U32 \\<Rightarrow> (ObjDentry\\<^sub>T Array \\<times> 32 word \\<times> 32 word list)\"\nwhere\n \"pArrObjDentry data offs nb_dentry =\n    (case (fold      \n    (\\<lambda>_ (xs,doffs,offslist).\n      let dentry = pObjDentry data doffs ;\n          newoffs = doffs +  8 + wordarray_length (ObjDentry.name\\<^sub>f dentry)\n      in (xs@[Option\\<^sub>1\\<^sub>1.Some dentry], newoffs, offslist@ [newoffs])) [0..<unat nb_dentry] ([], offs, []))\n   of (xs, doffs, offslist) \\<Rightarrow> (ArrayT.make (xs@ [Option\\<^sub>1\\<^sub>1.None ()]), doffs, offslist))\"\n\ndefinition pObjDentarr :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> U32 \\<Rightarrow> ObjDentarr\\<^sub>T\"\nwhere\n\"pObjDentarr data offs olen \\<equiv>\n let nb_dentry = ple32 data (offs+8)\n in ObjDentarr.make\n     (ple64 data offs) (* id *)\n     (nb_dentry) (* nb_dentry *)\n     (fst (pArrObjDentry (take (unat (offs+olen-bilbyFsObjHeaderSize)) data) (offs+bilbyFsObjDentarrHeaderSize) nb_dentry))\n     \"\n\ndefinition pObjDentarrSize :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> U32 \\<Rightarrow> U32\"\nwhere\n\"pObjDentarrSize data offs olen \\<equiv>\n let nb_dentry = ple32 data (offs+8)\n in (fst (snd (pArrObjDentry (take (unat (offs+olen-bilbyFsObjHeaderSize)) data) (offs+bilbyFsObjDentarrHeaderSize) nb_dentry)))\n \"\n\ndefinition pObjSuper :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> ObjSuper\\<^sub>T\"\nwhere\n  \"pObjSuper data offs \\<equiv>\n   ObjSuper.make\n     (ple32 data offs) (* nb_eb *)\n     (ple32 data (offs+4)) (* eb_size *)\n     (ple32 data (offs+8)) (* io_size *)\n     (ple32 data (offs+12)) (* nb_reserved_gc *)\n     (ple32 data (offs+16)) (* nb_reserved_del *)\n     (ple32 data (offs+20)) (* cur_eb *)\n     (ple32 data (offs+24)) (* cur_offs *)\n     (ple32 data (offs+28)) (* last_inum *)\n     (ple64 data (offs+32)) (* next_sqnum *)\n     \"\n\n(* TODO: we do not have pObjSumEntry . Probably we need it.*)\ndefinition sObjSumEntry :: \"ObjSumEntry\\<^sub>T \\<Rightarrow> U8 list\"\nwhere\n \"sObjSumEntry ose \\<equiv> \n   (sle64 $ ObjSumEntry.id\\<^sub>f ose)\n @ (sle64 $ ObjSumEntry.sqnum\\<^sub>f ose)\n @ (sle32 $ ObjSumEntry.len\\<^sub>f ose)\n @ (sle32 $ ObjSumEntry.del_flags_and_offs\\<^sub>f ose)\n @ (sle16 $ ObjSumEntry.count\\<^sub>f ose)\"\n\nconsts sObjSuper :: \"ObjSuper\\<^sub>T \\<Rightarrow> U8 list\" \n\ntype_synonym Buffer\\<^sub>T = \"(U8 WordArray, U32) Buffer\"\n\ndefinition bounded :: \"Buffer\\<^sub>T \\<Rightarrow> U8 list\"\nwhere\n \"bounded buf = take (unat (bound\\<^sub>f buf)) (WordArrayT.\\<alpha>wa (data\\<^sub>f buf))\"\n\ndefinition wellformed_buf :: \"Buffer\\<^sub>T \\<Rightarrow> bool\"\nwhere\n \"wellformed_buf buf \\<equiv> unat (bound\\<^sub>f buf) \\<le> List.length (\\<alpha>wa (Buffer.data\\<^sub>f buf))\"\n\nlemma elem_take_n:\n \"i<n \\<Longrightarrow> (take n xs ! i) = xs ! i\"\n by simp\n\nlemma deserialise_le32_bounded_ret:\nassumes bounded:\n  \"bbuf = bounded buf\"\nassumes valid_offs:\n  \"unat offs + 3 < length (bounded buf)\"\nshows\n  \"deserialise_le32 (buf, offs) = ple32 bbuf offs\"\napply (simp add: bounded)\nusing valid_offs\n  apply (subgoal_tac \"(\\<forall>i\\<in>{0..3}. unat (offs+i) < length (bounded buf))\")\n   prefer 2\n   apply unat_arith\n  apply (simp add: bounded_def)\n  apply (clarsimp simp: wordarray_get_ret[where arr=\"data\\<^sub>f buf\"] ple32_def \n                        deserialise_le32_def u8_to_u32_is_ucast)\n  apply (subgoal_tac \"\\<forall>j\\<in>{1..3}. (unat (offs + j) > 0)\")\n   prefer 2\n   apply clarsimp\n   apply (drule_tac x=j in bspec, simp)\n   apply unat_arith\n  apply (subst take_drop_decomp, (simp+))+\n  apply (subst unatSuc[symmetric], (simp add: unat_gt_0[symmetric] add.commute[where b=offs]))+\n  apply simp\n  apply (rule trans, rule word_rcat_rsplit[symmetric])\n  apply (rule arg_cong[where f=word_rcat])\n  apply (subst word_rsplit_upt[where n=4], simp add: word_size)\n   apply simp\n  apply (simp add: upt_rec shiftr_over_or_dist shiftl_shiftr1 shiftl_shiftr2 word_size)\n  apply (safe intro!: word_eqI, simp_all add: word_size word_ops_nth_size nth_ucast\n        nth_shiftr nth_shiftl add.commute[where b=offs] test_bit_out_of_bounds)\n done\n \nlemma deserialise_le64_bounded_ret:\nassumes bounded:\n  \"bbuf = bounded buf\"\nassumes valid_offs:\n  \"unat offs + 7 < length (bounded buf)\"\nshows\n  \"deserialise_le64 (buf, offs) = ple64 bbuf offs\"\napply (simp add: bounded)\nusing valid_offs\n  apply (subgoal_tac \"(\\<forall>i\\<in>{0..7}. unat (offs+i) < length (bounded buf))\")\n   prefer 2\n   apply unat_arith\n  apply (simp add: bounded_def)\n  apply (clarsimp simp: wordarray_get_ret[where arr=\"data\\<^sub>f buf\"] ple64_def \n                       deserialise_le64_def u8_to_u64_is_ucast)\n  apply (subgoal_tac \"\\<forall>j\\<in>{1..7}. (unat (offs + j) > 0)\")\n   prefer 2\n   apply clarsimp\n   apply (drule_tac x=j in bspec, simp)\n   apply unat_arith\n  (* feel free to improve this apply script..*)\n  apply (subst take_drop_decomp, (simp+))+\n  apply (subst unatSuc[symmetric], (simp add: unat_gt_0[symmetric] add.commute[where b=offs]))+\n  apply simp\n  apply (rule trans, rule word_rcat_rsplit[symmetric])\n  apply (rule arg_cong[where f=word_rcat])\n  apply (subst word_rsplit_upt[where n=8], simp add: word_size)\n   apply simp\n  apply (simp add: upt_rec shiftr_over_or_dist shiftl_shiftr1 shiftl_shiftr2 word_size)\n  apply (safe intro!: word_eqI, simp_all add: word_size word_ops_nth_size nth_ucast\n        nth_shiftr nth_shiftl add.commute[where b=offs] test_bit_out_of_bounds)\n  done\n\ndefinition buf_unchanged :: \"Buffer\\<^sub>T \\<Rightarrow> Buffer\\<^sub>T \\<Rightarrow> U32 \\<Rightarrow> U32 \\<Rightarrow> bool\"\nwhere\n \"buf_unchanged newbuf oldbuf offs' l \\<equiv> take (unat offs') (\\<alpha>wa (data\\<^sub>f newbuf)) = take (unat offs') (\\<alpha>wa (data\\<^sub>f oldbuf)) \\<and>\n  drop (unat offs' + unat l) (\\<alpha>wa (data\\<^sub>f newbuf)) = drop (unat offs' + unat l) (\\<alpha>wa (data\\<^sub>f oldbuf)) \\<and>\n  bound\\<^sub>f newbuf = bound\\<^sub>f oldbuf\"\n\nlemma bounded_le_length:\n  \"(length $ bounded  x) \\<le> length (\\<alpha>wa $ data\\<^sub>f x)\"\n  by (simp add: bounded_def)\n\nlemmas serialise_le64_simps = ArrA.make_def ElemA.make_def ElemAO.make_def ArrayUseValueP.defs\n                              setu8_def[unfolded sanitizers] wordarray_make bounded_def\n                             serialise_u8_def[unfolded tuple_simps sanitizers]\n(*\nlemma serialise_le64_ret:\nassumes valid_offs:\n  \"unat offs + 7 < length (bounded buf)\"\nassumes ret:\n  \"P (buf\\<lparr>data\\<^sub>f := WordArrayT.make (\\<alpha>wa (data\\<^sub>f buf)[\n      unat offs := u64_to_u8 v,\n      unat (offs+1) := u64_to_u8 (v >> 8),\n      unat (offs+2) := u64_to_u8 (v >> 16),\n      unat (offs+3) := u64_to_u8 (v >> 24),\n      unat (offs+4) := u64_to_u8 (v >> 32),\n      unat (offs+5) := u64_to_u8 (v >> 40),\n      unat (offs+6) := u64_to_u8 (v >> 48),\n      unat (offs+7) := u64_to_u8 (v >> 56)])\\<rparr>)\"\nnotes  wa_modify_ret = wordarray_modify_ret[rotated - 1, simplified Let_def ArrayUseValueP.defs ArrA.defs]\nshows\n  \"P (serialise_le64 (buf, offs, v))\"\n  unfolding serialise_le64_def[unfolded tuple_simps sanitizers]\n  apply (simp add: serialise_le64_simps Let_def)\n  apply (rule wa_modify_ret[where index=\"offs\"], simp add: serialise_le64_simps)\n    apply (rule wa_modify_ret[where index=\"offs+1\"], simp add: serialise_le64_simps)\n      apply (rule wa_modify_ret[where index=\"offs+2\"], simp add: serialise_le64_simps)\n        apply (rule wa_modify_ret[where index=\"offs+3\"], simp add: serialise_le64_simps)\n          apply (rule  wa_modify_ret[where index=\"offs+4\"], simp add: serialise_le64_simps)\n            apply (rule wa_modify_ret[where index=\"offs+5\"], simp add: serialise_le64_simps)\n              apply (rule wa_modify_ret[where index=\"offs+6\"], simp add: serialise_le64_simps)\n                apply (rule wa_modify_ret[where index=\"offs+7\"], simp add: serialise_le64_simps)\n                  using ret apply simp\n                 using valid_offs \n                 apply ((simp add: serialise_le64_simps) , unat_arith?)+\n done\n*)\nlemma take_irrelevance:\n  \"P (xs!(unat (x + y))) \\<Longrightarrow> unat (x + y) < unat z \\<Longrightarrow>\n   P ((take (unat z) xs)!(unat (x + y)))\" \n   by auto\n\nlemma unat_space:\nassumes \"unat (x + y) < z\"\nand \"unat (x + y) > unat x\"\nand \"y' \\<le> y\"\nshows \"unat (x + y') < z\"\nproof -\n  have \"\\<And>x\\<^sub>1. unat (x + y) \\<le> x\\<^sub>1 \\<or> \\<not> z \\<le> x\\<^sub>1\"\n  using assms(1)  by fastforce\n  thus ?thesis using assms\n  by (metis antisym_conv leI less_not_sym word_le_nat_alt word_plus_mono_right)\nqed\n\nlemma ple32_ret:\n  assumes 1:\"unat offs < unat (offs + 3)\"\n  assumes 2:\"unat (offs + 3) < (length $ bounded buf)\"\n  assumes 3:\"P(ple32 (bounded buf) offs)\"\n  shows \"P (deserialise_le32 (buf, offs))\"\n  proof -\n    from 1 2 have 4:\"unat offs + 3 < (length $ bounded buf)\" by (unat_arith, auto?)\n    show ?thesis\n    apply(subst deserialise_le32_bounded_ret)\n       apply simp\n      using 1 2 apply unat_arith\n      apply auto[1]\n     using 1 2 apply unat_arith\n    using 3 apply auto\n    done\n  qed\n\nlemma ple64_ret:\n  assumes 1:\"unat offs < unat (offs + 7)\"\n  assumes 2:\"unat (offs + 7) < (length $ bounded buf)\"\n  assumes 3:\"P (ple64 (bounded buf) offs)\"\n  shows \"P (deserialise_le64 (buf, offs))\"\n  proof -\n    from 1 2 have 4:\"unat offs + 7 < (length $ bounded buf)\" by (unat_arith, auto?)\n    show ?thesis\n    apply(subst deserialise_le64_bounded_ret)\n       apply simp\n      using 1 2 apply unat_arith\n      apply auto[1]\n     using 1 2 apply unat_arith\n    using 3 apply auto\n    done\n  qed\n\nlemma offs_le:\n assumes \"offs < offs+n\"\n assumes \"unat (offs + n) \\<le> ntake\"\n shows   \"unat offs < ntake\"\n using assms by unat_arith\n\nlemma word_add_eq_unat:\n assumes \"(offs::('a::len word)) < offs + n\"\n assumes \"i < n\"\n shows   \"unat (offs + i) = unat offs  + unat i\"\nusing assms by unat_arith\n\nlemma ple16_eq_slice2:\n assumes \"offs < offs + 2\" \n assumes \"unat offs + 2 \\<le> length xs\"\n shows   \"ple16 xs offs = ple16 (slice (unat offs) (unat offs + 2) xs) 0\"\n using assms by (simp add:  slice_def ple16_def drop_take word_add_eq_unat)\n\nlemma ple32_eq_slice4:\n assumes \"offs < offs + 4\" \n assumes \"unat offs + 4 \\<le> length xs\"\n shows   \"ple32 xs offs = ple32 (slice (unat offs) (unat offs + 4) xs) 0\"\n using assms by (simp add:  slice_def ple32_def drop_take word_add_eq_unat)\n\nlemma ple64_eq_slice8:\n assumes \"offs < offs + 8\" \n assumes \"unat offs + 8 \\<le> length xs\"\n shows   \"ple64 xs offs = ple64 (slice (unat offs) (unat offs + 8) xs) 0\"\n using assms by (simp add:  slice_def ple64_def drop_take word_add_eq_unat)\n\ndefinition pObjInode :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> ObjInode\\<^sub>T\"\nwhere\n \"pObjInode data offs \\<equiv>\n     ObjInode.make\n       (((ple64 data offs) AND (NOT (bilbyFsOidMaskAll OR u32_to_u64(word32Max)))) OR bilbyFsOidMaskInode) (* id *)\n       (ple64 data (offs+8)) (* size *)\n       (ple64 data (offs+16)) (* atime *)\n       (ple64 data (offs+24)) (* ctime *)\n       (ple64 data (offs+32)) (* mtime *)\n       (ple32 data (offs+40)) (* nlink *)\n       (ple32 data (offs+44)) (* uid *)\n       (ple32 data (offs+48)) (* gid *)\n       (ple32 data (offs+52)) (* mode *)\n       (ple32 data (offs+56)) (* flags *)\n       (* End 60 bytes *)\"\n\ndefinition sObjInode :: \"ObjInode\\<^sub>T \\<Rightarrow> U8 list\"\nwhere\n \"sObjInode odata \\<equiv> \n   (sle64 $ ObjInode.id\\<^sub>f odata) \n @ (sle64 $ ObjInode.size\\<^sub>f odata) \n @ (sle64 $ ObjInode.atime_sec\\<^sub>f odata)\n @ (sle64 $ ObjInode.ctime_sec\\<^sub>f odata)\n @ (sle64 $ ObjInode.mtime_sec\\<^sub>f odata)\n @ (sle32 $ ObjInode.nlink\\<^sub>f odata)\n @ (sle32 $ ObjInode.uid\\<^sub>f odata)\n @ (sle32 $ ObjInode.gid\\<^sub>f odata)\n @ (sle32 $ ObjInode.mode\\<^sub>f odata)\n @ (sle32 $ ObjInode.flags\\<^sub>f odata)  (* End 60 bytes *)\"\n\ndefinition pObjHeader :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> Obj\\<^sub>T\"\nwhere\n \"pObjHeader data offs \\<equiv>\n     Obj.make\n       (ple32 data offs)      (* magic *)\n       (ple32 data (offs+4))  (* crc *)\n       (ple64 data (offs+8))  (* sqnum *)\n       (offs)                    (* offs not stored on medium *) (* changed back to offs, otherwise this doesnt correspond to the code*)\n       (ple32 data (offs+16)) (* len *)\n       (* 2 padding bytes *)\n       (data!unat (offs+22))  (* trans *)\n       (data!unat (offs+23))  (* otype *)\n       undefined               (* ounion *)\n       (* End 24 bytes *)\"\n\ndefinition sObjHeader :: \"Obj\\<^sub>T \\<Rightarrow> U8 list\"\nwhere\n  \"sObjHeader obj \\<equiv>\n   (sle32 $ Obj.magic\\<^sub>f obj)\n @ (sle32 $ Obj.crc\\<^sub>f obj)\n @ (sle64 $ Obj.sqnum\\<^sub>f obj)\n @ (sle32 $ Obj.len\\<^sub>f obj)\n @ [bilbyFsPadByte]\n @ [bilbyFsPadByte]\n @ [Obj.trans\\<^sub>f obj]\n @ [Obj.otype\\<^sub>f obj] (* End 24 bytes *)\"\n\nlemma ObjHeader_inverse:\n  \"pObjHeader (sObjHeader obj@xs) 0 = (obj\\<lparr> Obj.ounion\\<^sub>f := undefined, Obj.offs\\<^sub>f := 0\\<rparr>) \"\n   apply(clarsimp simp: pObjHeader_def sObjHeader_def)\n   apply(clarsimp simp: Obj.defs)\n   apply(clarsimp simp: ple32_word_rcat_eq length_sle32 length_sle64)\n   apply(clarsimp simp: bilbyFsObjHeaderSize_def bilbyFsPadByte_def)\n   proof -\n     let ?magic = \"sle32 (magic\\<^sub>f obj)\"\n     let ?crc = \"sle32 (crc\\<^sub>f obj)\"\n     let ?sqnum = \"sle64 (Obj.sqnum\\<^sub>f obj)\"\n     let ?len = \"sle32 (Obj.len\\<^sub>f obj)\"\n     let ?tail = \"0x42 # 0x42 # trans\\<^sub>f obj # otype\\<^sub>f obj # xs\"\n\n     have append_assoc_intro : \"\\<And>P ys1 ys2 xs. \n       P ((ys1 @ ys2) @ xs) \\<Longrightarrow> P (ys1 @ (ys2 @ xs))\" by auto\n\n     have sqnum: \"ple64 (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) 8 = (Obj.sqnum\\<^sub>f obj)\"\n     apply(rule append_assoc_intro)\n     apply(rule ple64_word_rcat_eq)\n     apply(subst List.length_append)\n     using length_sle32 by auto\n\n     have len: \"ple32 (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) 16 = Obj.len\\<^sub>f obj\"\n     apply(rule append_assoc_intro[of _ \"?magic\"])\n     apply(rule append_assoc_intro[of _ \"?magic @ ?crc\"])\n     apply(rule append_assoc_intro[of _ \"?magic @ ?crc @ ?sqnum\"])\n     apply(rule ple32_word_rcat_eq)\n     using length_sle32 length_sle64 by auto\n\n     have trans:\"(?magic @ ?crc @ ?sqnum @ ?len @ ?tail) ! 22 = Obj.trans\\<^sub>f obj\"\n     proof -\n       have \"length (?magic @ ?crc @ ?sqnum @ ?len @ (66::8 word) # [66::8 word]) = 22\"\n       using length_sle32 length_sle64 by simp\n       from this show ?thesis\n       by (metis (erased, hide_lams) append_Cons append_Nil append_assoc nth_append_length)\n     qed\n\n     have otype:\"(?magic @ ?crc @ ?sqnum @ ?len @ ?tail) ! 23 = Obj.otype\\<^sub>f obj\"\n     proof -\n       have \"length (?magic @ ?crc @ ?sqnum @ ?len @ (66::8 word) # (66::8 word) # [trans\\<^sub>f obj]) = 23\"\n       using length_sle32 length_sle64 by simp\n       from this show ?thesis\n       by (metis (erased, hide_lams) append_Cons append_Nil append_assoc nth_append_length)\n     qed\n\n     from sqnum len trans otype\n     show \n       \"\\<lparr>magic\\<^sub>f = magic\\<^sub>f obj, crc\\<^sub>f = crc\\<^sub>f obj,\n         sqnum\\<^sub>f = ple64 (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) 8,\n         offs\\<^sub>f = 0,\n         len\\<^sub>f = ple32 (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) 16,\n         trans\\<^sub>f = (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) ! 22,\n         otype\\<^sub>f = (?magic @ ?crc @ ?sqnum @ ?len @ ?tail) ! 23,\n         ounion\\<^sub>f = undefined\\<rparr> = obj\\<lparr>ounion\\<^sub>f := undefined, Obj.offs\\<^sub>f := 0\\<rparr>\"\n      by auto\n   qed\n\nlemmas pObjHeader_simp =\n  pObjHeader_def Let_def Obj.make_def bilbyFsObjHeaderSize_def\n\ndefinition is_valid_ObjHeader :: \"Obj\\<^sub>T \\<Rightarrow> U8 list \\<Rightarrow> bool\"\nwhere\n \"is_valid_ObjHeader obj data \\<equiv>\n    magic\\<^sub>f obj = bilbyFsMagic \\<and>\n    (unat $ Obj.len\\<^sub>f obj) \\<le> length data \\<and>\n    trans\\<^sub>f obj \\<in> {bilbyFsTransIn, bilbyFsTransCommit} \\<and>\n    is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj)\"\n\nlemma is_len_and_type_ok_hdr_szD:\n  \"is_len_and_type_ok (otype, olen) \\<Longrightarrow> bilbyFsObjHeaderSize \\<le> olen\"\n by (auto simp add: \n         is_len_and_type_ok_def[unfolded sanitizers tuple_simps] \n        bilbyFsObjHeaderSize_def\n        prod.case_eq_if split: if_splits)\n  unat_arith+\n\nlemma is_valid_ObjHeader_len_facts:\n \"is_valid_ObjHeader obj data \\<Longrightarrow> unat bilbyFsObjHeaderSize \\<le> length data \\<and>\n   bilbyFsObjHeaderSize \\<le> Obj.len\\<^sub>f obj\"\n  apply (clarsimp simp: is_valid_ObjHeader_def)\n  apply (drule is_len_and_type_ok_hdr_szD)\n  apply unat_arith\n done\n\n\nlemmas otype_simps =\n  bilbyFsObjTypeInode_def\n  bilbyFsObjTypeData_def\n  bilbyFsObjTypeDentarr_def\n  bilbyFsObjTypeDel_def\n  bilbyFsObjTypePad_def\n  bilbyFsObjTypeSuper_def\n  bilbyFsObjTypeSum_def\n\nlemma is_len_and_type_ok_otype_valD:\n  \"is_len_and_type_ok (otype, olen) \\<Longrightarrow> otype \\<in> {bilbyFsObjTypeInode,bilbyFsObjTypeData,bilbyFsObjTypeDentarr,bilbyFsObjTypeDel,bilbyFsObjTypePad,bilbyFsObjTypeSuper,bilbyFsObjTypeSum} \"\n by (auto simp add: \n         is_len_and_type_ok_def[unfolded sanitizers tuple_simps] \n         otype_simps  split: if_splits)\n\ndefinition is_valid_Obj :: \"Obj\\<^sub>T \\<Rightarrow> bool\"\nwhere\n \"is_valid_Obj obj \\<equiv> \n    if otype\\<^sub>f obj = bilbyFsObjTypePad then \\<exists>v. ounion\\<^sub>f obj = TObjPad v else\n    if otype\\<^sub>f obj = bilbyFsObjTypeInode then \\<exists>v. ounion\\<^sub>f obj = TObjInode v else\n    if otype\\<^sub>f obj = bilbyFsObjTypeData then \\<exists>v. ounion\\<^sub>f obj = TObjData v else\n    if otype\\<^sub>f obj = bilbyFsObjTypeDentarr then \\<exists>v. ounion\\<^sub>f obj = TObjDentarr v else\n    if otype\\<^sub>f obj = bilbyFsObjTypeDel then \\<exists>v. ounion\\<^sub>f obj = TObjDel v else\n    True\"\n\n\nlemma is_valid_ObjHeader_len:\n  \"is_valid_ObjHeader obj data \\<Longrightarrow> bilbyFsObjHeaderSize \\<le> Obj.len\\<^sub>f obj\"\n  apply (clarsimp simp add: is_valid_ObjHeader_def)\n  apply (erule is_len_and_type_ok_hdr_szD)\n done\n\nlemma is_valid_ObjHeader_len_unat:\n  \"is_valid_ObjHeader obj data \\<Longrightarrow> unat bilbyFsObjHeaderSize \\<le> unat (Obj.len\\<^sub>f obj)\"\n by (drule is_valid_ObjHeader_len) unat_arith\n\nlemma is_valid_ObjHeader_buf_len:\n  \"is_valid_ObjHeader obj data \\<Longrightarrow>\n   (unat $ Obj.len\\<^sub>f obj) \\<le> length data \\<and>\n  unat bilbyFsObjHeaderSize \\<le> length data\"\n  apply (clarsimp simp add: is_valid_ObjHeader_def)\n  apply (drule is_len_and_type_ok_hdr_szD)\n  apply unat_arith\n done\n\ndefinition sObjPad :: \"U32 \\<Rightarrow> U8 list\"\nwhere\n  \"sObjPad olen \\<equiv> replicate (unat (olen - bilbyFsObjHeaderSize)) bilbyFsPadByte\"\n\nconsts pObjSummary :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> ObjSummary\\<^sub>T\"\nconsts pObjPad :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> unit\"\n\ndefinition pObjUnion :: \"U8 list \\<Rightarrow> U8 \\<Rightarrow> U32 \\<Rightarrow> U32 \\<Rightarrow> ObjUnion\\<^sub>T\"\nwhere\n \"pObjUnion data otype olen offs  \\<equiv>\n   if otype = bilbyFsObjTypePad then\n    TObjPad ()\n   else if otype = bilbyFsObjTypeData then\n    TObjData (pObjData data offs olen)\n   else if otype = bilbyFsObjTypeInode then\n    TObjInode (pObjInode data offs)\n   else if otype = bilbyFsObjTypeDentarr then\n    TObjDentarr (pObjDentarr data offs olen)\n   else if otype = bilbyFsObjTypeDel then\n    TObjDel (pObjDel data offs)\n   else if otype = bilbyFsObjTypeSuper then\n    TObjSuper (pObjSuper data offs)\n   else (*if otype = bilbyFsObjTypeSum then\n    TObjSummary (pObjSummary data offs) *) (* see comments in: serial.cogent for deserialise_ObjUnion:*)\n    TObjPad ()\"\n\ndefinition pObj :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> Obj\\<^sub>T\"\nwhere\n \"pObj data offs \\<equiv>\n   let obj = pObjHeader data offs\n   in obj \\<lparr>ounion\\<^sub>f:= pObjUnion (take (unat offs + unat (Obj.len\\<^sub>f obj)) data) (otype\\<^sub>f  obj) (Obj.len\\<^sub>f obj) (offs+bilbyFsObjHeaderSize)\\<rparr>\"\n\ntext {* This could be implemented in Cogent instead *}\ndefinition serialise_size_summary_Obj :: \"ObjSummary\\<^sub>T \\<Rightarrow> U32\"\nwhere\n \"serialise_size_summary_Obj summary \\<equiv>\n   bilbyFsObjHeaderSize + serialise_size_ObjSummary (nb_sum_entry\\<^sub>f summary)\"\n\ndefinition os_sum_sz :: \"OstoreState\\<^sub>T \\<Rightarrow> U32\"\nwhere\n \"os_sum_sz ostore_st \\<equiv> serialise_size_summary_Obj (summary\\<^sub>f ostore_st)\"\n\ndefinition bilbyFsMinObjSize :: U32\nwhere\n \"bilbyFsMinObjSize \\<equiv> bilbyFsObjHeaderSize + 8\"\n\nlemma deserialise_u8_ret:\nassumes wf: \"wellformed_buf buf\"\nassumes valid_offs:\n  \"offs < bound\\<^sub>f buf\"\nshows\n  \"deserialise_u8 (buf, offs) =  (\\<alpha>wa $ data\\<^sub>f buf) ! (unat offs)\"\nusing valid_offs wordarray_get_ret[where arr=\"data\\<^sub>f buf\" and index=offs]\n  wf[simplified wellformed_buf_def]\n  apply  (simp add: deserialise_u8_def)\n  apply (erule meta_impE)\n   apply unat_arith\n  apply simp\n done\n\nlemmas objheaders_simps = bilbyFsMagic_def\n    bilbyFsObjTypeInode_def bilbyFsObjTypeData_def\n                  bilbyFsObjTypeDentarr_def bilbyFsObjTypeDel_def bilbyFsObjTypePad_def\n                  bilbyFsObjTypeSuper_def bilbyFsObjTypeSum_def\n    bilbyFsTransIn_def bilbyFsTransCommit_def is_valid_ObjHeader_def pObjHeader_def\n    Obj.make_def  \n\nlemma deserialise_ObjHeader_ret:\n  assumes wf: \"wellformed_buf buf\"\n  assumes bound: \"offs + bilbyFsObjHeaderSize \\<le> bound\\<^sub>f buf\"\n  assumes no_of: \"offs < offs + bilbyFsObjHeaderSize\"\n  assumes err: \"\\<And>obj. P (obj, Error eInval)\"\n  assumes suc:\n  \"\\<And>obj offs'. \\<lbrakk>  is_valid_ObjHeader (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs) (bounded buf) ;\n    \\<exists>v. obj\\<lparr>ounion\\<^sub>f:=v\\<rparr> = pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs;\n    offs' = offs + bilbyFsObjHeaderSize;\n    offs + Obj.len\\<^sub>f obj \\<le> bound\\<^sub>f buf;\n    offs < offs + Obj.len\\<^sub>f obj\\<rbrakk> \\<Longrightarrow> \n   P (obj, Success (offs'))\"\n notes bilbyFsObjHeaderSize_def[simp]\n  shows \"P (deserialise_ObjHeader (buf, offs, obj))\"\nproof -\n  have des_u8: \n    \"deserialise_u8 (buf, offs + 23) =  (\\<alpha>wa $ data\\<^sub>f buf) ! unat (offs + 23)\"  \n    \"deserialise_u8 (buf, offs + 22) =  (\\<alpha>wa $ data\\<^sub>f buf) ! unat (offs + 22)\"\n    using bound no_of\n    by - ((subst deserialise_u8_ret[OF wf]), (unat_arith, simp+))+\n\n  have des_le64:\n    \"deserialise_le64 (buf, offs + 8) = (ple64 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 8))\"\n  apply (rule ple64_ret)\n    using no_of\n    apply (simp add: )\n    apply (simp add: unat_arith_simps, unat_arith)\n   using bound wf no_of\n   apply (simp add: bounded_def wellformed_buf_def unat_arith_simps)\n   apply unat_arith\n  apply (simp add: bounded_def)\n  apply (subst  ple64_take)\n    using bound no_of\n    apply (simp add: bounded_def unat_arith_simps)\n    apply unat_arith\n   using wf bound no_of\n   apply (simp add: wellformed_buf_def unat_arith_simps)\n  apply unat_arith\n  apply simp\n done\n\n have des_le32:\n    \"deserialise_le32 (buf, offs) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) offs)\"  \n    \"deserialise_le32 (buf, offs+4) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 4))\"  \n    \"deserialise_le32 (buf, offs+16) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 16))\"\nML_prf{*\nfun solve_deserialise_le32 ctxt = \n  let \n  val add_simp = Simplifier.add_simp;\n  fun add_simps ctxt [] = ctxt\n   |  add_simps ctxt (thm::thms) = add_simps (add_simp thm ctxt) thms;\n  val simp = Simplifier.asm_full_simp_tac;\n  val unat = (unat_arith_tac ctxt 1);\n\n  val ple32 = Method.rule_tac ctxt @{thms ple32_ret} [] 1;\n  val wf_bounded_unat = @{thms wellformed_buf_def bounded_def unat_arith_simps};\n  val simp_wf_bounded_unat = simp (add_simps ctxt wf_bounded_unat) 1;\n  val simp_bounded = simp (add_simp @{thm bounded_def} ctxt) 1;\n  val ple32_take = Method.rule_tac ctxt @{thms ple32_take} [] 1;\n  val simp_unat_plus = REPEAT_DETERM_N 2 ( simp_wf_bounded_unat THEN unat);\n  in\n    DETERM (ple32 THEN  simp_unat_plus )\n    THEN (simp_bounded THEN ple32_take THEN simp_unat_plus)\n  end\n*}\n    using wf bound no_of\n    by - (tactic {* solve_deserialise_le32  @{context} *})+\n    \n  show ?thesis\n  unfolding deserialise_ObjHeader_def[unfolded tuple_simps sanitizers]\n  apply (clarsimp simp:Let_def err[simplified eInval_def])\n  apply (frule is_len_and_type_ok_hdr_szD)\n  apply (rule suc)\n       apply (clarsimp simp: objheaders_simps buf_simps des_le32 des_u8 )\n       apply (subgoal_tac \"\\<exists>v. ple32 (\\<alpha>wa (data\\<^sub>f buf)) (offs + 0x10) = v\")\n        prefer 2\n        apply clarsimp\n       apply (erule exE, simp add: bounded_def)\n       using bound no_of wf apply (simp add: wellformed_buf_def)\n      apply (rule conjI)\n       apply unat_arith\n      apply (unat_arith)\n     apply (rule_tac x=undefined in exI) \n     apply (simp add: pObjHeader_def Obj.defs buf_simps des_le32 des_u8 des_le64)\n    apply (simp)\n   apply (simp, unat_arith)+\n done\nqed\n\ndefinition\n  sObjUnion :: \"ObjUnion\\<^sub>T \\<Rightarrow> U8 \\<Rightarrow> U32 \\<Rightarrow> U8 list\"\nwhere\n \"sObjUnion (ou::ObjUnion\\<^sub>T) (otype::U8) (olen::U32) \\<equiv> \n  case ou of\n    TObjDentarr odent \\<Rightarrow> undefined (* TODO: no dentarr support for now *)\n  | TObjInode oinod \\<Rightarrow> sObjInode oinod\n  | TObjData odata \\<Rightarrow> sObjData odata olen\n  | TObjDel odel \\<Rightarrow> sObjDel odel\n  | TObjSuper osup \\<Rightarrow> sObjSuper osup\n  | TObjSummary g \\<Rightarrow> undefined (* TODO: sObjSummary is undefined*)\n  | TObjPad opad \\<Rightarrow>  sObjPad olen\"\n\nlemmas bilbyFsObjTypes = \n  bilbyFsObjTypePad_def\n  bilbyFsObjTypeInode_def\n  bilbyFsObjTypeData_def\n  bilbyFsObjTypeDentarr_def\n  bilbyFsObjTypeDel_def\n  bilbyFsObjTypeSuper_def\n  bilbyFsObjTypeSum_def\n\nlemma ObjUnion_inverse:\n \"\\<And>v. ounion = TObjPad v \\<Longrightarrow> otype = bilbyFsObjTypePad \\<Longrightarrow>\n pObjUnion (sObjUnion ounion otype olen @ xs) otype olen 0 = ounion\"\n by (simp add: sObjUnion_def pObjUnion_def )\n\nlemma length_sObjUnion:\n \"\\<And>v. ounion = TObjPad v \\<Longrightarrow> otype = bilbyFsObjTypePad \\<Longrightarrow>\n  olen \\<ge> bilbyFsObjHeaderSize  \\<Longrightarrow>\n    length (sObjUnion ounion otype olen) = unat olen - unat bilbyFsObjHeaderSize\"\n  apply (simp add: sObjUnion_def sObjPad_def )\n  apply unat_arith\n done\n\n\ndefinition sObj :: \"Obj\\<^sub>T \\<Rightarrow> U8 list\"\nwhere\n \"sObj obj \\<equiv> sObjHeader obj @ sObjUnion (ounion\\<^sub>f obj) (otype\\<^sub>f obj) (Obj.len\\<^sub>f obj)\"\n\nlemma length_sObjHeader:\n \"length (sObjHeader obj) = unat bilbyFsObjHeaderSize\"\n by (simp add: sObjHeader_def length_sle32 length_sle64 bilbyFsObjHeaderSize_def)\n \nlemma length_sObj:\n  \"Obj.len\\<^sub>f obj \\<ge> bilbyFsObjHeaderSize \\<Longrightarrow>\n   otype\\<^sub>f obj = bilbyFsObjTypePad \\<Longrightarrow> \n   is_valid_Obj obj \\<Longrightarrow>\n   length (sObj obj) = unat (Obj.len\\<^sub>f obj)\"\n  apply (clarsimp simp add: is_valid_Obj_def split:if_splits)\n  apply (drule (2)  length_sObjUnion)\n  apply (simp add: sObj_def length_sObjHeader word_le_nat_alt)\n done\n\nlemma Obj_inverse:\n \"otype\\<^sub>f obj = bilbyFsObjTypePad \\<Longrightarrow>\n   is_valid_Obj obj \\<Longrightarrow>\n   Obj.offs\\<^sub>f obj = 0 \\<Longrightarrow>\n   pObj (sObj obj @ xs) 0 = obj\"\n unfolding pObj_def sObj_def Let_def\n  apply (simp add: ObjHeader_inverse)\n  apply (clarsimp simp: is_valid_Obj_def)\n  apply (frule (1) ObjUnion_inverse)\n  apply (simp add: pObjUnion_def sObjHeader_def word_le_nat_alt length_sObjHeader)\n done\n\nlemma buf_sub_slice_len_simplified:\n  \"length v1 = unat j \\<Longrightarrow> unat (offs :: 32 word) < length (\\<alpha>wa (data\\<^sub>f buf)) \\<Longrightarrow>\n    unat (offs + j) \\<le> length (\\<alpha>wa (data\\<^sub>f buf)) \\<Longrightarrow>\n    unat offs < unat (offs + j) \\<Longrightarrow>\n     length (take (unat offs) (\\<alpha>wa (data\\<^sub>f buf)) @\n              v1 @\n              drop (unat (offs + j)) (\\<alpha>wa (data\\<^sub>f buf))) = length (\\<alpha>wa (data\\<^sub>f buf))\"\n    by simp unat_arith\n \nlemma buf_sub_slice_absorb:\n  assumes len1: \"length v1 = unat j\"\n  and     len2: \"length v2 = unat (k-j)\"\n  and   j_less: \"j \\<le> k\"\n  and     j_nz: \"j > 0\"\n  and    no_of: \"unat offs < unat (offs + k)\"\n  and   len_ge: \"unat (offs + k) \\<le> length (\\<alpha>wa (data\\<^sub>f buf))\"\n  shows \"(buf_sub_slice (buf \\<lparr>data\\<^sub>f := WordArrayT.make\n      (buf_sub_slice buf offs (offs + j) v1)\\<rparr>)\n                               (offs + j) (offs + k)\n                               v2) =\n             buf_sub_slice buf offs (offs + k) (v1 @ v2)\"\n  proof -\n    have j_sub: \"unat (offs + j) - unat offs = unat j\"\n      using no_of j_less by unat_arith\n    have j_max: \"unat (offs + j) \\<ge> unat offs\"\n      using no_of j_less by unat_arith\n    have k_j_sub: \"unat (offs + k) - unat (offs + j) = unat (k - j)\"\n      using no_of j_less by unat_arith\n    have k_sub: \"(unat (offs + k) - unat offs) = unat k\"\n      using no_of by unat_arith\n    have k_max: \"(unat (offs + k)) \\<ge> (unat offs)\"\n      using no_of by unat_arith\n    have k_j_max: \"(unat (offs + k)) \\<ge> (unat (offs + j))\"\n      using no_of j_less by unat_arith\n    have xx: \"\\<And>x v. data\\<^sub>f (x\\<lparr>data\\<^sub>f := v\\<rparr>) = v\"\n      by simp\n    have len_ge': \" unat offs < length (\\<alpha>wa (data\\<^sub>f buf))\"\n      using len_ge no_of by unat_arith\n    have len_ge'': \" unat (offs + j) \\<le> length (\\<alpha>wa (data\\<^sub>f buf))\"\n      using len_ge no_of j_less by unat_arith\n    have no_of': \"unat offs < unat (offs + j)\"\n      using no_of j_less j_nz by unat_arith\n    have len_app: \"length (v1 @ v2) = unat k\"\n      using len1 len2 j_less by unat_arith\n    have take_prefix: \"(take (unat (offs + j))\n           (take (unat offs) (\\<alpha>wa (data\\<^sub>f buf)) @\n            v1 @ drop (unat (offs + j)) (\\<alpha>wa (data\\<^sub>f buf)))) \n         = take (unat offs) (\\<alpha>wa (data\\<^sub>f buf)) @\n            v1\" \n        using len1 no_of' len_ge' j_sub by simp\n    have drop_prefix: \"drop (unat (offs + k))\n           (take (unat offs) (\\<alpha>wa (data\\<^sub>f buf)) @\n            v1 @ drop (unat (offs + j)) (\\<alpha>wa (data\\<^sub>f buf))) \n             = drop (unat (offs + k))(\\<alpha>wa (data\\<^sub>f buf))\"\n        apply (subgoal_tac \"(unat k - unat j + unat (offs + j)) = unat (offs + k)\")\n         prefer 2\n         using no_of j_less apply unat_arith\n        using len1 len_ge' k_sub j_less no_of apply simp\n        by unat_arith\n    thus ?thesis\n      unfolding buf_sub_slice_def \n      using j_sub j_max k_j_sub k_sub k_max k_j_max apply (simp only: max_absorb1)\n      using len1\n      apply (subst take_append[where n=\"unat j\"])+\n      apply (simp only: diff_self_eq_0 take_0 append_Nil2)\n      using len2 apply (subst take_append[where n=\"unat (k-j)\"])+\n      apply (simp only: diff_self_eq_0 take_0 append_Nil2)\n      using len_app apply (subst take_append[where n=\"unat k\"])\n      apply (simp only: diff_self_eq_0 take_0 append_Nil2)\n      using len1 k_j_sub apply (simp only:)\n      apply (simp only:  xx wordarray_make Util.fun_app_def)\n      using len1 len2 len_app apply (simp only: take_all[where n=\"unat j\"]\n                                        take_all[where n=\"unat k\"]\n                                        take_all[where n=\"unat (k-j)\"])\n      using len1 len_ge len_ge' len_ge'' no_of' len_app no_of\n      by (simp add: buf_sub_slice_len_simplified take_prefix drop_prefix)\n   qed\n\nlemma serialise_u8_ret':\n    notes  wa_modify_ret = wordarray_modify_ret[rotated - 1, simplified Let_def]\n    assumes no_of: \"offs < offs + 1\"\n       and len_ge: \"unat offs + 1 \\<le> length (\\<alpha>wa (data\\<^sub>f buf))\"\n    shows \"serialise_u8 (buf, offs, v) = \n      buf \\<lparr>data\\<^sub>f := WordArrayT.make (buf_sub_slice buf offs (offs + 1) [v])\\<rparr>\"\n   proof -\n    have offs_sub: \"(unat (offs + 1) - unat offs) = 1\" using no_of by unat_arith\n    have no_of_unat: \" unat offs < unat (offs + 1)\" using no_of by (simp add: word_less_nat_alt)\n    show ?thesis\n    unfolding serialise_u8_def[unfolded sanitizers] Let_def\n  using no_of len_ge\n  apply simp\n  apply (rule wa_modify_ret[where index=\"offs\" and varr=\"(data\\<^sub>f buf)\"])\n   prefer 2\n   apply (unat_arith)\n  apply (simp_all  add:ArrA.defs ElemAO.defs  ElemA.defs\n                  setu8_def[unfolded tuple_simps sanitizers] wordarray_make buf_simps\n                  min_absorb1 min_absorb2)\n  apply (rule arg_cong[where f=\"\\<lambda>v. Buffer.data\\<^sub>f_update v buf\"])\n  apply (rule ext)\n  apply (rule arg_cong[where f=\"WordArrayT.make\"])\n  apply (simp only: list_eq_iff_nth_eq)\n  apply (clarsimp simp: buf_sub_slice_length)\n  apply (simp add: buf_sub_slice_def min_absorb1 min_absorb2)\n  apply (case_tac \"i=unat offs\")\n   apply (simp only: append_assoc[symmetric] nth_append)\n   apply (simp add: min_absorb1 min_absorb2)\n   apply unat_arith\n  apply (case_tac \"i < unat offs\")\n   apply (simp add: min_absorb1 offs_sub max_absorb1 no_of no_of_unat nth_append)\n  apply (simp add: min_absorb1 offs_sub max_absorb1)\n  apply (subgoal_tac \"(max (unat (offs + 1)) (unat offs)) = unat (offs + 1)\")\n   prefer 2\n   using no_of_unat apply auto[1]\n  apply (clarsimp simp add: nth_append nth_Cons split: nat.splits)\n  apply (subst nth_drop)\n   apply unat_arith\n  apply (subgoal_tac \"unat (offs + 1) = unat offs + 1\")\n   prefer 2\n   using no_of_unat offs_sub apply simp\n  apply simp\n  apply (subgoal_tac \"i = Suc (unat offs + x2)\")\n   apply simp\n  apply unat_arith\n done\n qed\n\nlemma serialise_ObjHeader_ret:\n  assumes no_overflow: \"offs \\<le> offs + bilbyFsObjHeaderSize\"\n  and     is_valid_obj: \"is_valid_ObjHeader obj (drop (unat offs) (\\<alpha>wa (data\\<^sub>f buf)))\"\n  and     suc: \"\\<And>buf' offs'. \n   offs' = offs + bilbyFsObjHeaderSize \\<Longrightarrow>\n   buf' = buf\\<lparr>data\\<^sub>f := WordArrayT.make (buf_sub_slice buf offs (offs +bilbyFsObjHeaderSize) (sObjHeader obj))\\<rparr> \\<Longrightarrow>\n    P (buf', offs')\"\n  shows\n   \"P (serialise_ObjHeader (buf, offs, obj))\" \n   proof -\n    have offs_le_length: \"unat offs \\<le> length (\\<alpha>wa (data\\<^sub>f buf))\"\n      using is_valid_ObjHeader_len_facts[OF is_valid_obj]\n      by (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def) unat_arith\n   have offs_sub_le: \"(unat (offs + bilbyFsObjHeaderSize) - unat offs) \\<le> (length (\\<alpha>wa (data\\<^sub>f buf)) - unat offs)\"\n      using is_valid_obj is_valid_ObjHeader_len_facts[OF is_valid_obj]\n      by (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def) unat_arith\n   have offs_len_sub_eq: \"unat (offs + bilbyFsObjHeaderSize) - unat offs = unat (bilbyFsObjHeaderSize)\"\n      using no_overflow by unat_arith\n   have offs_obj_len_le_length: \"unat (offs + bilbyFsObjHeaderSize) \\<le> length (\\<alpha>wa (data\\<^sub>f buf))\"\n     using is_valid_obj offs_sub_le is_valid_ObjHeader_len_facts[OF is_valid_obj]\n     by (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def) unat_arith\n   have offs_obj_len_le_length': \"(unat (offs + bilbyFsObjHeaderSize) -\n                (unat offs + unat bilbyFsObjHeaderSize)) \\<le> (length (\\<alpha>wa (data\\<^sub>f buf)) -\n                   (unat offs + unat bilbyFsObjHeaderSize))\"\n      using offs_obj_len_le_length by unat_arith   \n   have offs_plus_eq: \" (unat (offs + bilbyFsObjHeaderSize) = (unat offs + unat bilbyFsObjHeaderSize))\"\n      using no_overflow by unat_arith\n   show ?thesis\n  unfolding serialise_ObjHeader_def[unfolded sanitizers tuple_simps]\n  apply (simp add: Let_def)\n  apply (rule suc)\n   apply (simp add: bilbyFsObjHeaderSize_def)\n  apply (simp add: buf_sub_slice_def wordarray_make)\n  apply (simp add:  min_absorb1 offs_le_length offs_sub_le)\n  apply (simp add: offs_len_sub_eq length_sObjHeader\n                    offs_obj_len_le_length' offs_plus_eq)\n  using no_overflow apply (simp add: word_le_nat_alt max_absorb1 bilbyFsObjHeaderSize_def)\n  using no_overflow offs_obj_len_le_length apply (simp add: bilbyFsObjHeaderSize_def)\n  apply (subst serialise_le32_ret[where v=\"magic\\<^sub>f obj\"])\n    apply ((unat_arith, auto)+)[2]\n  apply (subst serialise_le32_ret[where v=\"crc\\<^sub>f obj\"])\n     apply ((unat_arith, auto)+)[1]\n    apply (simp add: buf_sub_slice_length wordarray_make)\n    apply (unat_arith, auto)[1]\n   apply (simp)\n   apply (subst add.commute[where a=8])\n   apply (subst buf_sub_slice_absorb[where offs=offs and j=4 and k=8, simplified])\n       apply (simp add: length_sle32)+\n     apply unat_arith \n     apply auto[1]\n    apply unat_arith \n    apply auto[1]\n   apply (subst serialise_le64_ret)\n     apply (unat_arith, auto)[1]\n\n    apply (simp add: buf_sub_slice_length wordarray_make)\n    apply (unat_arith, auto)[1]\n   apply simp\n   apply (subst add.commute[where a=\"0x10\"])\n   apply (subst buf_sub_slice_absorb)\n         apply (simp add: length_sle32 length_sle64)+\n     apply ((unat_arith, auto)+)[2]\n   apply (subst serialise_le32_ret)\n     apply ((unat_arith, auto)+)[1]\n    apply (simp add: buf_sub_slice_length wordarray_make)\n    apply (unat_arith, auto)[1]\n   apply (simp)\n   apply (subst add.commute[where a=\"0x14\"])\n   apply (subst buf_sub_slice_absorb)\n           apply (simp add: length_sle32 length_sle64)+\n      apply ((unat_arith, auto)+)[2]\n   apply (subst serialise_u8_ret'[where offs=\"offs + 0x14\"])\n     apply (unat_arith, auto)[1]\n    apply (simp add: buf_sub_slice_length wordarray_make)\n    apply (unat_arith, auto)[1]\n   apply (simp)\n   apply (subst add.commute[where a=\"0x15\"])\n   apply (subst buf_sub_slice_absorb)\n         apply (simp add: length_sle32 length_sle64)+\n     apply ((unat_arith, auto)+)[2]\n    apply (subst serialise_u8_ret'[where offs=\"offs + 0x15\"])\n     apply (unat_arith, auto)[1]\n    apply (simp add: buf_sub_slice_length wordarray_make)\n    apply (unat_arith, auto)[1]\n   apply (simp)\n   apply (subst add.commute[where a=\"0x16\"])\n   apply (subst buf_sub_slice_absorb)\n         apply (simp add: length_sle32 length_sle64)+\n     apply ((unat_arith, auto)+)[2] \n   apply (subst serialise_u8_ret'[where offs=\"offs + 0x16\"])\n     apply (unat_arith, auto)[1]\n    apply (simp add: buf_sub_slice_length wordarray_make)\n    apply (unat_arith, auto)[1]\n   apply (simp)\n   apply (subst add.commute[where a=\"0x17\"])\n   apply (subst buf_sub_slice_absorb)\n         apply (simp add: length_sle32 length_sle64)+\n     apply ((unat_arith, auto)+)[2] \n   apply (subst serialise_u8_ret'[where offs=\"offs + 0x17\"])\n     apply (unat_arith, auto)[1]\n    apply (simp add: buf_sub_slice_length wordarray_make)\n    apply (unat_arith, auto)[1]\n   apply (simp)\n   apply (subst add.commute[where a=\"0x18\"])\n   apply (subst buf_sub_slice_absorb)\n         apply (simp add: length_sle32 length_sle64)+\n     apply ((unat_arith, auto)+)[2]\n  \n  apply (simp add: sObjHeader_def bilbyFsPadByte_def)\n  apply (unfold buf_sub_slice_def)\n  apply (simp add: offs_len_sub_eq[unfolded bilbyFsObjHeaderSize_def, simplified])\n  apply (simp add: length_sle32 length_sle64)\n  apply (subgoal_tac \"(length (\\<alpha>wa (data\\<^sub>f buf)) - unat offs) \\<ge> 24\")\n   prefer 2\n   using offs_len_sub_eq bilbyFsObjHeaderSize_def apply (unat_arith, auto)[1]\n  apply simp\n  apply (subgoal_tac \"(unat (offs + 0x18)) > (unat offs)\")\n   prefer 2\n   using no_overflow apply (unat_arith, auto)[1]\n  apply (simp add: max_absorb1)\n  apply (rule arg_cong[where f=\"\\<lambda>v. Buffer.data\\<^sub>f_update v buf\"])\n  apply (rule ext)\n  apply (rule arg_cong[where f=\"WordArrayT.make\"])\n  apply simp\n  by (subst take_all, \n          (simp add: length_sle32 length_sle64 | (unat_arith, auto)[1])+)+\nqed\n  \nlemmas ObjUnion_splits = ObjUnion\\<^sub>1\\<^sub>1\\<^sub>1\\<^sub>1\\<^sub>1\\<^sub>1\\<^sub>1.splits ObjUnion\\<^sub>1\\<^sub>1\\<^sub>0\\<^sub>1\\<^sub>1\\<^sub>1\\<^sub>1.splits ObjUnion\\<^sub>1\\<^sub>1\\<^sub>0\\<^sub>0\\<^sub>1\\<^sub>1\\<^sub>1.splits\n\nlemma take_drop_decomp:\"x \\<ge> a \\<Longrightarrow> take (x - a) (drop a xs) @ drop x xs = drop a xs\"\n  by (subst take_drop_append[where b=\"x-a\" and xs=xs], simp)\n\nlemma serialise_ObjPad_ret:\n  assumes no_overflow: \"offs \\<le> offs + (olen - bilbyFsObjHeaderSize)\"\n  and     no_underflow: \"olen - bilbyFsObjHeaderSize \\<ge> 0\"\n  and     bound: \"offs+ (olen - bilbyFsObjHeaderSize) \\<le> bound\\<^sub>f buf \\<and> unat (bound\\<^sub>f buf) \\<le> length (\\<alpha>wa (data\\<^sub>f buf))\" \n  and     suc: \"\\<And>buf' offs'. \n   offs' = offs + olen - bilbyFsObjHeaderSize \\<Longrightarrow>\n   buf' = buf\\<lparr>data\\<^sub>f := WordArrayT.make (buf_sub_slice buf offs (offs + (olen - bilbyFsObjHeaderSize)) (sObjPad olen))\\<rparr> \\<Longrightarrow>\n    P (buf', offs')\"\n  shows\n   \"P (serialise_ObjPad (buf, offs, olen))\"\n   proof -\n   \n    have offs_le_bound: \"offs \\<le> bound\\<^sub>f buf\"\n      using bound no_overflow by unat_arith\n    have sub1: \"(unat (olen - 0x18)) \\<le> (unat (bound\\<^sub>f buf) - unat offs)\"\n      using bound no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n      by unat_arith\n    have sub2: \"(unat (offs + (olen - 0x18)) - unat offs) = unat (olen - 0x18)\"\n      using bound no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n      by unat_arith (* takes ages *)\n    have sub3: \"unat (olen - 0x18) \\<le> (length (\\<alpha>wa (data\\<^sub>f buf)) - unat offs)\"\n      using bound no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n      by unat_arith\n    have sub4: \"(unat (offs + (olen - 0x18)) - (unat offs + unat (olen - 0x18))) = 0\"\n      using bound no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n      by unat_arith\n    have sub5: \"(unat offs +\n            (unat (olen - 0x18) + length (\\<alpha>wa (data\\<^sub>f buf))) -\n            unat (offs + (olen - 0x18))) = length (\\<alpha>wa (data\\<^sub>f buf))\"\n      using bound no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n      by unat_arith\n    have no_of_unat: \"unat offs \\<le> (unat (offs + (olen - 0x18)))\"\n      using no_overflow no_underflow by (simp add: bilbyFsObjHeaderSize_def word_le_nat_alt)\n    have assoc: \"(unat (offs + (olen - 0x18))) = unat offs + unat (olen - 0x18)\"\n      using no_overflow no_underflow by (simp add: bilbyFsObjHeaderSize_def) unat_arith\n   show ?thesis\n    unfolding serialise_ObjPad_def[unfolded sanitizers tuple_simps]\n  apply (simp add: Let_def split: ObjUnion_splits)\n  apply (rule suc)\n   apply (simp add: bilbyFsObjHeaderSize_def)\n  apply (subst buf_memset_eq)\n    using bound apply simp\n   using no_overflow  apply  (simp add: bilbyFsObjHeaderSize_def)\n  apply (rule arg_cong[where f=\"\\<lambda>v. Buffer.data\\<^sub>f_update v buf\"])\n  apply (rule ext)\n  apply (rule arg_cong[where f=\"WordArrayT.make\"])\n  using bound offs_le_bound apply (clarsimp simp: buf_sub_slice_def bilbyFsObjHeaderSize_def)\n  apply (simp add: sObjPad_def bilbyFsPadByte_def buf_simps\n                    min_absorb1 min_absorb2 word_le_nat_alt sub1 sub2 sub3 sub4 sub5\n                    bilbyFsObjHeaderSize_def no_of_unat max_absorb1 assoc)\n   \n  apply (subst take_drop_decomp)\n   using no_overflow no_underflow apply (clarsimp simp: bilbyFsObjHeaderSize_def)\n  apply simp\n done\n qed\n   \nlemma serialise_ObjUnion_ret:\n  assumes no_overflow: \"offs \\<le> offs + (olen - bilbyFsObjHeaderSize)\"\n  and     otype: \"otype = bilbyFsObjTypePad\"\n  and     ounion: \"\\<And>v. ounion = TObjPad v\"\n  and     olen: \" 0 \\<le> olen - bilbyFsObjHeaderSize\"\n  and     bound: \"offs + (olen - bilbyFsObjHeaderSize) \\<le> bound\\<^sub>f buf \\<and> unat (bound\\<^sub>f buf) \\<le> length (\\<alpha>wa (data\\<^sub>f buf))\" \n  and     suc: \"\\<And>buf' offs'. \n   offs' = offs + olen - bilbyFsObjHeaderSize \\<Longrightarrow>\n   buf' = buf\\<lparr>data\\<^sub>f := WordArrayT.make (buf_sub_slice buf offs (offs + (olen - bilbyFsObjHeaderSize)) (sObjUnion ounion otype olen))\\<rparr> \\<Longrightarrow>\n    P (buf', offs')\"\n  shows\n   \"P (serialise_ObjUnion (buf, offs, ounion, olen))\"\n  unfolding serialise_ObjUnion_def[unfolded sanitizers tuple_simps]\n  using ounion apply (simp add: Let_def split: ObjUnion_splits)\n  apply (rule serialise_ObjPad_ret)\n    using no_overflow apply simp\n    using olen apply simp\n    using bound apply simp\n   apply (rule suc, simp)\n  apply (simp add: sObjUnion_def)\n done\n\nlemma data\\<^sub>f_of_data\\<^sub>f_update:\n  \"data\\<^sub>f (x\\<lparr>data\\<^sub>f := v\\<rparr>) = v\"\n by simp\n\nlemma serialise_Obj_ret:\n  assumes no_overflow: \"offs \\<le> offs + Obj.len\\<^sub>f obj\"\n  and     is_valid_obj: \"is_valid_ObjHeader obj (drop (unat offs) (\\<alpha>wa (data\\<^sub>f buf)))\"\n  and     otype: \"otype\\<^sub>f obj = bilbyFsObjTypePad\"\n  and     ounion: \"\\<And>v. ounion\\<^sub>f obj = TObjPad v\"\n  and     bound: \" offs + Obj.len\\<^sub>f obj \\<le> bound\\<^sub>f buf \\<and>\n           unat (bound\\<^sub>f buf) \\<le> length (\\<alpha>wa (data\\<^sub>f buf))\"\n  and     suc: \"\\<And>buf'. \n   buf' = buf\\<lparr>data\\<^sub>f := WordArrayT.make (buf_sub_slice buf offs (offs + Obj.len\\<^sub>f obj) (sObj obj))\\<rparr> \\<Longrightarrow>\n    P (buf', offs + Obj.len\\<^sub>f obj)\"\n  shows\n   \"P (serialise_Obj (buf, offs, obj))\"\n   unfolding serialise_Obj_def[unfolded tuple_simps sanitizers]\n  apply (simp add: Let_def)\n  apply (rule serialise_ObjHeader_ret)\n    using no_overflow is_valid_obj apply (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def)\n    apply (frule is_len_and_type_ok_hdr_szD, simp add: bilbyFsObjHeaderSize_def)\n    apply unat_arith\n   using is_valid_obj apply assumption\n  apply simp\n  apply (rule serialise_ObjUnion_ret)\n       using is_valid_obj no_overflow apply (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def )\n       apply (frule  is_len_and_type_ok_hdr_szD)\n       apply (simp add: bilbyFsObjHeaderSize_def)\n       apply unat_arith\n      apply (rule otype)\n     using ounion apply simp\n    using is_valid_obj no_overflow apply (clarsimp simp: is_valid_ObjHeader_def bilbyFsObjHeaderSize_def)\n   using bound apply (simp add: wordarray_make buf_sub_slice_length)\n  apply simp\n apply (rule suc)\n    apply (rule arg_cong[where f=\"\\<lambda>v. Buffer.data\\<^sub>f_update v buf\"])\n   apply (rule ext)\n   apply (rule arg_cong[where f=\"WordArrayT.make\"])\n   apply (thin_tac x for x)+\n   apply (subst buf_sub_slice_absorb)\n         apply (simp  add: length_sObjHeader)\n        apply (subst length_sObjUnion[OF ounion otype])\n        using is_valid_obj apply (clarsimp simp: is_valid_ObjHeader_def is_len_and_type_ok_hdr_szD)\n       using is_valid_obj no_overflow apply (clarsimp simp: is_valid_ObjHeader_def  unat_plus_simple)\n       apply (drule is_len_and_type_ok_hdr_szD)\n       apply (unat_arith)\n       apply (simp add: is_len_and_type_ok_hdr_szD)\n      apply(simp add: bilbyFsObjHeaderSize_def)\n     using no_overflow is_valid_obj apply (clarsimp simp: is_valid_ObjHeader_def  bilbyFsObjHeaderSize_def)\n     apply (simp add:  is_len_and_type_ok_def otype otype_simps)\n     apply (unat_arith)\n    using bound is_valid_obj apply (clarsimp simp: is_valid_ObjHeader_def)\n    apply unat_arith\n   apply (simp add: sObj_def)\n done\n\nlemma binNot_NOT: \"binNot (x::64 word) = NOT x\"\n  unfolding  binNot_def[unfolded Let_def]\n  by (rule subst[where s=\"-1\"], fastforce, fastforce)\n\nlemma deserialise_ObjDel_ret:\n  assumes bound: \"unat offs + 8 \\<le> length (\\<alpha>wa $ data\\<^sub>f buf)\"\n  assumes err: \"P (Error (eInval, ex))\"\n  assumes offs: \"offs < offs + 8\"\n  assumes suc:\n   \"\\<And>obj offs'. \\<lbrakk> \n    obj = pObjDel (\\<alpha>wa $ data\\<^sub>f buf) offs;\n    ObjDel.id\\<^sub>f obj AND NOT bilbyFsOidMaskAll \\<in> \n      { bilbyFsOidMaskData, bilbyFsOidMaskInode,bilbyFsOidMaskDentarr};\n    offs' = offs + 8\\<rbrakk> \\<Longrightarrow> \n   P (Success (ex, obj, offs'))\"\n  shows \"P (deserialise_ObjDel (ex, buf, offs))\"\nproof - \n  have des_le64: \"deserialise_le64 (buf, offs) = ple64 (\\<alpha>wa $ data\\<^sub>f buf) offs\"\n   using bound offs\n   by (fastforce intro!: deserialise_le64_ret simp: unat_arith_simps)\n  show ?thesis\n  unfolding deserialise_ObjDel_def[unfolded tuple_simps sanitizers] \n  apply (clarsimp simp: Let_def err[simplified eInval_def])\n  by (fastforce\n     intro: suc\n     simp: Let_def binNot_NOT bilbyFsOidMaskData_def des_le64 bilbyFsOidMaskAll_def\n      bilbyFsOidMaskInode_def bilbyFsOidMaskDentarr_def pObjDel_def ObjDel.make_def)\nqed\n\nlemma deserialise_ObjInode_ret:\n  assumes bound: \"unat offs + 60 \\<le> length (\\<alpha>wa $ data\\<^sub>f buf)\"\n  assumes offs: \"offs < offs + 60\"\n  assumes err: \"\\<And>ex e. e \\<in> {eInval, eNoMem} \\<Longrightarrow> P (Error (e, ex))\"\n  assumes suc:\n   \"\\<And>ex oi offs'. \\<lbrakk> \n    oi = pObjInode (\\<alpha>wa (data\\<^sub>f buf)) offs;\n    offs' = offs + 60\\<rbrakk> \\<Longrightarrow> \n   P (Success (ex, oi, offs'))\"\n  shows \"P (deserialise_ObjInode (ex, buf, offs))\"\nproof -\n  have des_le64:\n    \"deserialise_le64 (buf, offs) = (ple64 (\\<alpha>wa $ data\\<^sub>f buf) offs)\"\n    \"deserialise_le64 (buf, offs + 8) = (ple64 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 8))\"\n    \"deserialise_le64 (buf, offs + 16) = (ple64 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 16))\"\n    \"deserialise_le64 (buf, offs + 24) = (ple64 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 24))\"\n    \"deserialise_le64 (buf, offs + 32) = (ple64 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 32))\"\n     using bound offs\n     by - (simp,rule deserialise_le64_ret[simplified];\n                  (simp add: unat_arith_simps, unat_arith?))+\n  have des_le32:\n   \"deserialise_le32 (buf, offs + 40) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 40))\"\n   \"deserialise_le32 (buf, offs + 44) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 44))\"\n   \"deserialise_le32 (buf, offs + 48) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 48))\"\n   \"deserialise_le32 (buf, offs + 52) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 52))\"\n   \"deserialise_le32 (buf, offs + 56) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 56))\"\n     using bound offs\n     by - (simp,rule deserialise_le32_ret[simplified];\n                  (simp add: unat_arith_simps, unat_arith?))+\n\n  show ?thesis\n  unfolding deserialise_ObjInode_def[unfolded tuple_simps sanitizers] \n  by (fastforce \n     intro: suc err\n     split: R\\<^sub>1\\<^sub>1.split\n     simp: eInval_def eNoMem_def binNot_NOT Let_def bilbyFsOidMaskAll_def des_le32\n      bilbyFsOidMaskInode_def word32Max_def pObjInode_def ObjInode.make_def des_le64)\nqed\n\nlemma deserialise_ObjSuper_ret:\n  assumes bound: \"unat offs + 40 \\<le> length (\\<alpha>wa $ data\\<^sub>f buf)\"\n  assumes offs: \"offs \\<le> offs + 40\" (* added by Yutaka on 11th.*)\n  assumes err: \"\\<And>ex. P (Error (eNoMem, ex))\"\n  assumes suc:\n   \"\\<And>ex osup offs'. \\<lbrakk> \n    osup = pObjSuper (\\<alpha>wa (data\\<^sub>f buf)) offs;\n    offs' = offs + 40\\<rbrakk> \\<Longrightarrow> \n   P (Success (ex, osup, offs'))\"\n  shows \"P (deserialise_ObjSuper (ex, buf, offs))\"\nproof -\n  have des_le64:\n    \"deserialise_le64 (buf, offs + 32) = (ple64 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 32))\"\n     using bound offs\n     by - (simp,rule deserialise_le64_ret[simplified];\n                  (simp add: unat_arith_simps, unat_arith?))\n  have des_le32:\n   \"deserialise_le32 (buf, offs) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) offs)\"\n   \"deserialise_le32 (buf, offs + 4) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 4))\"\n   \"deserialise_le32 (buf, offs + 8) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 8))\"\n   \"deserialise_le32 (buf, offs + 12) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 12))\"\n   \"deserialise_le32 (buf, offs + 16) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 16))\"\n   \"deserialise_le32 (buf, offs + 20) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 20))\"\n   \"deserialise_le32 (buf, offs + 24) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 24))\"\n   \"deserialise_le32 (buf, offs + 28) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 28))\"\n     using bound offs\n     by - (simp,rule deserialise_le32_ret[simplified];\n                  (simp add: unat_arith_simps, unat_arith?))+\n\n  show ?thesis\n  unfolding deserialise_ObjSuper_def[unfolded tuple_simps sanitizers] \n  by (fastforce \n     intro: suc err[unfolded eNoMem_def] \n     split: R\\<^sub>1\\<^sub>1.split \n     simp: pObjSuper_def ObjSuper.make_def des_le32 des_le64)\nqed\n\nlemma slice_Cons_helper:\n  \"i < length xs \\<Longrightarrow>\n    xs \\<noteq> [] \\<Longrightarrow>\n    drop i xs = \n    (xs !  i) # drop ( (i + 1)) xs\" \n    apply (cases xs, simp_all)\n    by (metis (no_types, hide_lams) drop_Suc_Cons Cons_nth_drop_Suc length_Cons)\n\nlemma slice_singleton:\n \"f < length xs \\<Longrightarrow> slice f (Suc f) xs = [xs ! f]\"\n unfolding slice_def by (simp add:drop_take list_eq_iff_nth_eq)\n\nlemma take_n_minus_1_append:\n  \"0<n \\<Longrightarrow> xs \\<noteq> [] \\<Longrightarrow> n \\<le> length xs \\<Longrightarrow>\n take (n - Suc 0) xs @ [xs ! (n - Suc 0)] = take n xs\"\n  apply (simp only: list_eq_iff_nth_eq)\n  apply clarsimp\n  apply (case_tac \"(length xs) < (n - Suc 0)\")\n   apply (clarsimp simp add: min_absorb2)+\n  by (metis One_nat_def Suc_pred' elem_take_n le0 le_less_trans diff_le_self\n  less_not_refl linorder_neqE_nat diff_Suc_less take_Suc_conv_app_nth)\n\nlemma take_n_minus_1_append_eq:\n  \"v = xs ! (unat (n - 1)) \\<Longrightarrow> unat n  \\<le> length xs \\<Longrightarrow> n> 0 \\<Longrightarrow>\n  take (unat ((n::U32) - 1)) xs @ [v] = take (unat n) xs\"\n  apply (simp add: list_eq_iff_nth_eq min_absorb2 unat_arith_simps)\n  apply clarsimp\n  apply (subst take_n_minus_1_append)\n     apply simp+\n  apply (case_tac xs, simp_all)\n done\n\nlemma slice_n_minus_1_append_last:\n \"unat acc + unat n \\<le> length xs \\<Longrightarrow>\n  (n::U32) > 0 \\<Longrightarrow>\n  acc \\<le> acc + n \\<Longrightarrow>\n  slice (unat acc) (unat acc + unat (n - 1)) xs @\n  [xs ! unat (acc + (n - 1))] =\n  slice (unat acc) (unat acc + unat n) xs\"\n  apply (simp add:  slice_def list_eq_iff_nth_eq)\n  apply (subgoal_tac \"(length xs) \\<ge> (unat acc + unat (n - 1))\")\n   prefer 2\n   apply unat_arith\n  apply (rule conjI)\n   apply (simp add: min_absorb1 min_absorb2)\n  apply (clarsimp simp: drop_take min_absorb1 min_absorb2 )\n  apply (subst take_n_minus_1_append_eq)\n     apply simp\n     apply (rule arg_cong[where f=\"nth xs\"]) \n     apply unat_arith (* takes long *)\n    apply simp+\n done\n\nlemma map_deserialise_waU8_map_eq_slice_apply:\n  assumes nonempty: \"xs \\<noteq> []\"\n  assumes \"length xs = unat (n:: 32 word)\"\n  assumes n_gr_0: \"n > 0\"\n  assumes no_overflow: \"acc \\<le> acc + n\"\n  assumes bound: \"unat acc + length xs \\<le> length (\\<alpha>wa d)\"\n  shows \"\n    (mapAccumObs 0 (length xs) deserialise_waU8_map xs acc d) =\n (FunBucket.slice (unat acc) (unat acc + (length xs)) (\\<alpha>wa d), acc + n)\"\n  using assms\n  apply (clarsimp simp: mapAccumObs_def ElemAO.make_def\n        deserialise_waU8_map_def[unfolded tuple_simps sanitizers] slice_def[where frm=0])\n  apply (induct \"xs\" arbitrary: n rule: rev_nonempty_induct)\n   apply (drule sym, simp add: slice_singleton wordarray_get_ret unat_arith_simps)\n  apply (drule_tac x=\"n - 1\" in meta_spec)\n  apply (erule meta_impE)\n   apply unat_arith\n  apply (erule meta_impE)\n   apply (subgoal_tac \"unat n \\<ge> 2\")\n   apply unat_arith\n   apply (case_tac xs, simp, simp)\n  apply (erule meta_impE)\n   apply unat_arith\n  apply (erule meta_impE)\n   apply unat_arith\n  apply (simp add: prod.case_eq_if)\n  apply (rule wordarray_get_ret')\n   apply unat_arith (* takes a while *)\n  apply (simp only: slice_n_minus_1_append_last)\n done\n\nlemma map_deserialise_waU8_map_eq_slice:\n  assumes n_gr_0: \"n > 0\"\n  assumes no_overflow: \"acc \\<le> acc + n\"\n  assumes bound: \"unat acc + unat n \\<le> length (\\<alpha>wa d)\"\n  assumes \"length xs = unat (n:: 32 word)\"\n  shows \"\n    fst (mapAccumObs 0 (unat n) deserialise_waU8_map xs acc d) =\n     (FunBucket.slice (unat acc) (unat acc + unat n ) (\\<alpha>wa d))\"\n  using map_deserialise_waU8_map_eq_slice_apply[THEN arg_cong[where f=fst]]\n        assms\n by (subgoal_tac \"xs \\<noteq> []\") (fastforce simp: unat_arith_simps)+\n\nlemma deserialise_wordarray_U8_ret:\n  assumes err: \"\\<And>ex. P (Error (eNoMem, ex))\"\n  assumes suc:                       \n   \"\\<And>ex wa. \n   offs \\<le> offs + len \\<longrightarrow> unat offs + unat len \\<le> length (\\<alpha>wa $ data\\<^sub>f buf) \\<longrightarrow> \n   wa = WordArrayT.make (slice (unat offs) (unat offs + unat len) (\\<alpha>wa (data\\<^sub>f buf))) \\<Longrightarrow> \n   P (Success (ex, wa))\"\n  shows \"P (deserialise_wordarray_U8 (ex, buf, offs, len))\"\n  unfolding deserialise_wordarray_U8_def[unfolded tuple_simps sanitizers] \n  apply (simp add: Let_def)\n  apply (rule wordarray_create_ret)\n   apply simp\n   apply (simp add: err[unfolded eNoMem_def])\n  apply (rename_tac ex' wa)\n  apply  simp\n  apply (rule wordarray_copy_ret)\n  apply (simp add:Let_def prod.case_eq_if)\n  apply (rule suc)\n  apply clarsimp\n done\n\nlemma deserialise_ObjData_ret:\n  assumes offs_no_of: \"offs \\<le> offs + (olen - bilbyFsObjHeaderSize)\"\n  assumes buf_len: \"unat (offs + (olen - bilbyFsObjHeaderSize)) \\<le> length (\\<alpha>wa (data\\<^sub>f buf))\"\n  assumes olen: \"is_len_and_type_ok (bilbyFsObjTypeData, olen)\"\n  assumes err: \"\\<And>ex e. e \\<in> {eInval, eNoMem} \\<Longrightarrow> P (Error (e, ex))\"\n  assumes suc:\n   \"\\<And>ex od offs' . \\<lbrakk>\n   ObjData.id\\<^sub>f od AND NOT bilbyFsOidMaskAll OR bilbyFsOidMaskData = ObjData.id\\<^sub>f od;\n     od = pObjData (\\<alpha>wa (data\\<^sub>f buf)) offs olen;\n    offs' = offs + olen - bilbyFsObjHeaderSize\\<rbrakk> \\<Longrightarrow> \n   P (Success (ex, od, offs'))\"\n  shows \"P (deserialise_ObjData (ex, buf, offs, olen))\"\n  proof -\n\n   have hdr_le_olen: \"bilbyFsObjDataHeaderSize \\<le> (olen - bilbyFsObjHeaderSize)\"\n    using olen\n    by (simp add: is_len_and_type_ok_def[unfolded sanitizers tuple_simps] otype_simps\n      bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def) unat_arith\n\n  have offs_pl_hdr_le_offs_pl_olen:\n  \"offs + bilbyFsObjDataHeaderSize \\<le> offs + (olen - bilbyFsObjHeaderSize)\"\n   using hdr_le_olen offs_no_of\n   by (simp add: bilbyFsObjDataHeaderSize_def bilbyFsObjHeaderSize_def word_plus_mono_right)\n\n\n  have offs_pl_hdr_no_of:\n   \"offs < offs + bilbyFsObjDataHeaderSize\"\n    using offs_no_of  hdr_le_olen\n    by (simp add: bilbyFsObjDataHeaderSize_def bilbyFsObjHeaderSize_def)\n       unat_arith\n\n  have offs_pl_hdr_le_buf_len:\n   \"unat offs + unat bilbyFsObjDataHeaderSize \\<le> length (\\<alpha>wa (data\\<^sub>f buf))\"\n   using  buf_len hdr_le_olen offs_pl_hdr_no_of offs_pl_hdr_le_offs_pl_olen\n   by (simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def)\n      unat_arith\n\n  have unat_offs_pl_olen_etc_eq: \"unat (offs + (olen - bilbyFsObjHeaderSize)) = unat (offs + 8) + unat (0xFFFFFFE0 + olen)\"\n   using olen hdr_le_olen offs_pl_hdr_no_of offs_pl_hdr_le_offs_pl_olen\n   apply (simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def)\n   apply (simp add: is_len_and_type_ok_def[unfolded sanitizers tuple_simps] otype_simps bilbyFsObjHeaderSize_def)\n   apply (subgoal_tac \"unat (offs + (olen - 0x18)) = unat (offs + 8) + unat (olen - 0x18 - 8)\")\n    apply unat_arith\n   apply (simp add: unat_arith_simps)\n   apply unat_arith\n  done\n\n  show ?thesis\n  unfolding deserialise_ObjData_def[unfolded tuple_simps sanitizers] \n  apply (clarsimp simp: Let_def err[unfolded eNoMem_def eInval_def] binNot_NOT)\n  apply (rule deserialise_wordarray_U8_ret)\n    apply (simp add: err)\n   apply (erule impE)\n    using offs_pl_hdr_no_of apply (simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def add.commute add.assoc)\n    apply (subgoal_tac \"olen + 0xFFFFFFE8 = olen - 0x18\") (* Oh! Beloved words <3 *)\n     prefer 2\n     apply simp\n   apply (simp only:)\n   apply simp\n   using offs_pl_hdr_le_offs_pl_olen apply (simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def )\n  apply simp\n  apply (rule suc)\n    apply simp\n    apply (simp add: bilbyFsOidMaskAll_def bilbyFsOidMaskData_def\n      pObjData_def ObjData.make_def bilbyFsObjHeaderSize_def)\n   apply (simp add: Let_def  pObjData_def ObjData.make_def bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def)\n  apply (subst deserialise_le64_ret)\n    using offs_pl_hdr_le_buf_len[simplified bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def]\n    apply (simp add:)\n   using offs_pl_hdr_no_of\n    apply (simp add: bilbyFsObjDataHeaderSize_def)\n   apply (erule impE)\n    using buf_len unat_offs_pl_olen_etc_eq\n    apply simp\n   apply simp\n  apply (simp add: bilbyFsObjHeaderSize_def)\n done\nqed\n\nlemma deserialise_ObjPad_ret:\n  assumes err: \"P (Error (eInval, ex))\"\n  assumes suc: \"\\<And> out offs' .\n    \\<lbrakk> olen - bilbyFsObjHeaderSize \\<le> olen ; \n      out=(); \n      offs' = offs + (olen - bilbyFsObjHeaderSize) \\<rbrakk> \\<Longrightarrow> \n    P (Success (ex, out, offs'))\"\n  shows \"P (deserialise_ObjPad (ex, buf, offs, olen))\"\n  unfolding deserialise_ObjPad_def[unfolded tuple_simps sanitizers]\n  by (auto simp: Let_def err[unfolded eInval_def] suc[unfolded bilbyFsObjHeaderSize_def] split: R\\<^sub>1\\<^sub>1.split)\n\nlemma no_offs_overflow:\n  assumes wellformed_buf: \"wellformed_buf buf\"\n  assumes no_overflow: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes offs_bound: \"offs \\<le> (bound\\<^sub>f buf)\"\n  assumes \"n < bilbyFsMaxEbSize\"\n  assumes \"m < bilbyFsMaxEbSize\"\n  shows \"offs + n \\<le> offs + n + m\"\n  using assms\n  by (auto simp add: bilbyFsMaxEbSize_def wellformed_buf_def unat_arith_simps)\n\nlemma no_offs_overflow_le:\n  assumes wellformed_buf: \"wellformed_buf buf\"\n  assumes no_overflow: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes offs_bound: \"offs \\<le> (bound\\<^sub>f buf)\"\n  assumes \"n < bilbyFsMaxEbSize\"\n  assumes \"m < bilbyFsMaxEbSize\"\n  assumes \"m > 0\"\n  shows \"offs + n < offs + n + m\"\n  using assms\n  by (auto simp add: bilbyFsMaxEbSize_def wellformed_buf_def unat_arith_simps)\n\nlemma conc_offs_no_of:\n  assumes wellformed_buf: \"wellformed_buf buf\"\n  assumes no_overflow: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes offs_bound: \"offs \\<le> (bound\\<^sub>f buf)\"\n  assumes \"m < bilbyFsMaxEbSize\"\n  assumes \"m > 0\"\n  shows \"offs < offs + m\"\n  using assms\n  by (auto simp add: bilbyFsMaxEbSize_def wellformed_buf_def unat_arith_simps)\n\nlemma slice_take:\n  \"m \\<le> l \\<Longrightarrow> \n  slice n m (take l xs) = slice n m xs\"\n  by (simp add: slice_def)\n\nlemma deserialise_pu8_ret:\nassumes valid_offs:\n  \"unat offs + 1 < length (\\<alpha>wa $ data\\<^sub>f buf)\"\nassumes no_of:\n  \"offs < offs + 1\"\nshows\n  \"deserialise_u8 (buf, offs) = (pu8 (\\<alpha>wa $ data\\<^sub>f buf) offs)\"\nproof -\n  from no_of have no_of': \"offs \\<le> offs + 1\" by simp\n  hence offs_pl_1: \"unat (offs + 1) = unat offs + 1\" by (simp add: unat_plus_simple)\n  show ?thesis\nusing valid_offs\n  apply (clarsimp simp:  wordarray_get_ret[where arr=\"data\\<^sub>f buf\"]\n                        deserialise_u8_def pu8_def)\n  apply (rule trans, rule word_rcat_rsplit[symmetric])\n  apply (rule arg_cong[where f=word_rcat])\n  apply (subst word_rsplit_upt[where n=1], simp add: word_size)\n   apply (simp)\n  apply (simp add: slice_def)\n  apply (simp add: ucast_def)\n  apply (subst Cons_nth_drop_Suc[symmetric])\n   apply simp\n  apply simp\n done\nqed\n\nlemma pu8_take:\n assumes offs:\"offs < offs+1\"\n assumes ntake:\"unat (offs + 1) \\<le> ntake\"\n shows   \"pu8 (take ntake ys) offs = pu8 ys offs\"\n  apply (simp add: pu8_def)\n  apply (rule arg_cong[where f=\"word_rcat\"])\n  apply (rule slice_take)\n using ntake offs by unat_arith\n\nlemma deserialise_ObjDentry_ret:\n  assumes wellformed_buf: \"wellformed_buf buf\"\n  assumes no_buf_overflow: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes bound: \"end_offs \\<le> bound\\<^sub>f buf\"\n  assumes off_less_end_offs: \"offs  \\<le> end_offs\"\n  assumes err:\n     \"\\<And>ex e. e \\<in> {eInval, eNoMem} \\<Longrightarrow> P (Error (e, ex))\"\n  assumes suc:\n   \"\\<And>ex dentry offs'. \\<lbrakk>\n      unat offs + 8 + unat (wordarray_length (name\\<^sub>f dentry)) \\<le> unat (bound\\<^sub>f buf);\n      wordarray_length (name\\<^sub>f dentry) \\<le> bilbyFsMaxNameLen + 1;\n      offs + 8 + wordarray_length (name\\<^sub>f dentry) \\<le> end_offs ;\n      dentry = pObjDentry (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) offs ;\n      offs' = offs + 8 + wordarray_length (name\\<^sub>f dentry);\n      offs' \\<le> (bound\\<^sub>f buf)\n        \\<rbrakk> \\<Longrightarrow>\n      P (Success (ex, dentry, offs'))\"\n  shows \"P (deserialise_ObjDentry (ex, buf, offs, end_offs))\"\nproof -\n  {\n    fix ex' dentry offs'\n    assume des_suc: \"unat offs + 8 \\<le> unat (bound\\<^sub>f buf)\"\n    \n    then have offs_ok:\"\\<forall>n\\<in>{0..7}. unat (offs + n)  < length (\\<alpha>wa $ data\\<^sub>f buf)\"\n    proof -\n      from wellformed_buf[unfolded wellformed_buf_def] des_suc\n      have \"unat offs + 8 \\<le> length (\\<alpha>wa $ data\\<^sub>f buf)\"\n      by unat_arith\n      \n      thus ?thesis\n      by unat_arith\n    qed\n    \n    from des_suc have deserialises:\n      \"deserialise_le32 (buf, offs)     = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) offs)\"\n      \"deserialise_u8   (buf, offs + 4) = (pu8 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 4))\"\n      \"deserialise_le16 (buf, offs + 6) = (ple16 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 6))\"\n      apply clarsimp\n        apply(rule deserialise_le32_ret[simplified])\n         using assms[simplified bilbyFsMaxEbSize_def wellformed_buf_def]\n         apply unat_arith \n        using assms[simplified bilbyFsMaxEbSize_def ]\n        apply unat_arith\n        apply (subst deserialise_pu8_ret)\n          using offs_ok des_suc wellformed_buf\n          apply (simp add: wellformed_buf_def, unat_arith)\n         using des_suc\n         apply unat_arith\n        apply simp+\n      apply(rule deserialise_le16_ret[simplified])\n       using offs_ok des_suc wellformed_buf apply (simp add: wellformed_buf_def, unat_arith)\n      using des_suc\n      apply unat_arith\n     done\n  }\n  note deserialises = this\n\n  have offs_le_bound: \"offs  \\<le> bound\\<^sub>f buf\"\n   using off_less_end_offs bound by simp\n\n  have const_offs_no_of: \"\\<And>n. n < bilbyFsMaxEbSize \\<Longrightarrow> 0 < n \\<Longrightarrow> offs < offs + n\"\n   apply (rule conc_offs_no_of[OF wellformed_buf no_buf_overflow, unfolded bilbyFsMaxEbSize_def, simplified])\n   using offs_le_bound by (simp add:bilbyFsMaxEbSize_def)+\n  note no_of_8 = no_offs_overflow[OF wellformed_buf no_buf_overflow offs_le_bound, where m=8 and n=0, unfolded bilbyFsMaxEbSize_def, simplified, simplified unat_plus_simple]\n  show ?thesis\n  unfolding deserialise_ObjDentry_def[simplified tuple_simps sanitizers]\n  apply (clarsimp simp: Let_def err[unfolded eNoMem_def eInval_def])\n  apply (subst (asm) not_less)+\n  apply (rule deserialise_wordarray_U8_ret)\n  apply (clarsimp simp add: err)\n  apply(clarsimp simp add: err eNoMem_def Let_def prod.case_eq_if split: R\\<^sub>1\\<^sub>1.splits)\n  apply (erule impE)\n   apply (rule no_offs_overflow[OF wellformed_buf no_buf_overflow])\n     using off_less_end_offs bound apply fastforce\n    apply (simp add: bilbyFsMaxEbSize_def)+\n   apply unat_arith\n  apply (subgoal_tac \"unat offs + unat (8::32word) + unat (u16_to_u32 (deserialise_le16 (buf, offs + 6))) \\<le> unat end_offs\")\n   prefer 2\n   apply (subst add.assoc)\n   apply (subst unat_plus_simple[THEN iffD1, symmetric])\n    apply (simp add: unat_arith_simps)\n   apply (subst unat_plus_simple[THEN iffD1, symmetric])\n    apply (rule no_offs_overflow[OF wellformed_buf no_buf_overflow, where n=0, simplified])\n      using off_less_end_offs bound apply fastforce\n     apply (simp add: bilbyFsMaxEbSize_def)+\n    apply (simp add: unat_arith_simps)\n   apply (simp add: word_le_nat_alt[symmetric] add.assoc)\n  apply (erule impE)\n   using bound wellformed_buf[unfolded wellformed_buf_def] \n   apply (simp add: unat_arith_simps)\n   apply unat_arith\n  apply (subgoal_tac \"unat offs + 8 \\<le> unat (bound\\<^sub>f buf)\")\n   prefer 2 \n   apply (subst unat_plus_simple[THEN iffD1, symmetric, \n                 where y=\"8::32word\", simplified])\n    apply (rule no_offs_overflow[OF wellformed_buf no_buf_overflow, \n                 where n=0, simplified])\n      using off_less_end_offs bound apply fastforce\n     apply (simp add: bilbyFsMaxEbSize_def)+ \n   apply (subst word_le_nat_alt[symmetric])\n   apply (cut_tac no_offs_overflow[OF wellformed_buf no_buf_overflow, \n       where offs=offs and n=8 and m=\"u16_to_u32 (deserialise_le16 (buf, offs + 6))\"])\n      using off_less_end_offs bound apply (simp_all add: bilbyFsMaxEbSize_def)\n   apply unat_arith\n  apply (simp add: deserialises) \n  apply (subgoal_tac \"wordarray_length (WordArrayT.make\n         (FunBucket.slice (unat (offs + 8)) \n          (unat (offs + 8) + unat (u16_to_u32 (ple16 (\\<alpha>wa (data\\<^sub>f buf)) (offs + 6))))\n          (\\<alpha>wa (data\\<^sub>f buf)))) \\<le> u16_to_u32 (ple16 (\\<alpha>wa (data\\<^sub>f buf)) (offs + 6))\")\n   prefer 2\n   apply (subst wordarray_length_ofnat)\n    apply (simp add: wordarray_length_ret)\n   apply (subst wordarray_make)\n   apply (simp add: slice_length)\n   apply (subst min.absorb1, simp_all) \n    using wellformed_buf[unfolded wellformed_buf_def]  no_buf_overflow[unfolded bilbyFsMaxEbSize_def]\n    apply (simp add: unat_arith_simps)\n  apply (subgoal_tac \n        \"unat (u16_to_u32 (ple16 (\\<alpha>wa (data\\<^sub>f buf)) (offs + 6))) = \n              unat (ple16 (\\<alpha>wa (data\\<^sub>f buf)) (offs + 6))\")\n   prefer 2 \n   apply (fastforce intro: uint_up_ucast simp: eq_nat_nat_iff unat_def is_up u16_to_u32_is_ucast)\n  apply (rule suc)  \n       apply (simp_all add: Let_def pObjDentry_def ObjDentry.make_def bilbyFsMaxNameLen_def)\n     using bound apply unat_arith\n    using wellformed_buf[unfolded wellformed_buf_def]  no_buf_overflow[unfolded bilbyFsMaxEbSize_def]\n    apply (simp add: unat_arith_simps)\n   apply (simp add: ple16_take ple32_take const_offs_no_of bilbyFsMaxEbSize_def plus_no_overflow_unat_lift[OF const_offs_no_of[unfolded bilbyFsMaxEbSize_def, simplified]])\n   apply (subst ple16_take)\n     apply (rule no_offs_overflow_le[OF wellformed_buf no_buf_overflow offs_le_bound])\n       apply (simp add: bilbyFsMaxEbSize_def)+\n    using no_of_8\n    apply (simp add: add.commute)\n\n   apply (subst ple16_take)\n     apply (rule no_offs_overflow_le[OF wellformed_buf no_buf_overflow offs_le_bound])\n       apply (simp add: bilbyFsMaxEbSize_def)+\n    using no_of_8\n    apply (simp add: add.commute)\n   apply (subst pu8_take)\n   using no_offs_overflow[OF wellformed_buf no_buf_overflow offs_le_bound, where m=5 and n=0, unfolded bilbyFsMaxEbSize_def, simplified]\n     no_offs_overflow[OF wellformed_buf no_buf_overflow offs_le_bound, where m=4 and n=0, unfolded bilbyFsMaxEbSize_def, simplified]\n   apply (simp add: add.commute unat_plus_simple)\n   apply unat_arith\n    using no_of_8\n     no_offs_overflow[OF wellformed_buf no_buf_overflow offs_le_bound, where m=5 and n=0, unfolded bilbyFsMaxEbSize_def, simplified]\n    apply (fastforce simp add: unat_plus_simple add.commute)\n   apply (subst ObjDentry.surjective, simp)\n   apply (rule arg_cong[where f=WordArrayT.make])\n   apply (rule slice_take[symmetric], simp)\n  apply (rule word_unat.Rep_eqD)\n  apply (simp add: wordarray_length_ret wordarray_make length_slice)\n  using no_of_8 wellformed_buf\n  apply (simp add: wellformed_buf_def)\n  apply unat_arith\n done\nqed\n\nlemma loop_deserialise_ObjDentry_ret:\n  assumes wellformed_buf: \"wellformed_buf buf\"\n  assumes no_buf_overflow: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes bound: \"end_offs \\<le> bound\\<^sub>f buf\"\n  assumes off_less_end_offs: \"offs  \\<le> end_offs\"\n  assumes st_offs: \"st_offs \\<le> offs\"\n  shows \"case loop_deserialise_ObjDentry (OptElemAO.make dentry (ex, offs) (buf, end_offs)) of\n            Break (none, e, ex) \\<Rightarrow> none= Option\\<^sub>1\\<^sub>1.None () \\<and> e = eInval \n          | Iterate (optdentry, ex, offs') \\<Rightarrow>\n             \\<exists>dentry. optdentry = Option\\<^sub>1\\<^sub>1.Some dentry \\<and>\n                unat offs + 8 + unat (wordarray_length (name\\<^sub>f dentry)) \\<le> unat (bound\\<^sub>f buf)  \\<and>\n                wordarray_length (name\\<^sub>f dentry) \\<le> bilbyFsMaxNameLen + 1  \\<and>\n                offs + 8 + wordarray_length (name\\<^sub>f dentry) \\<le> end_offs  \\<and>\n                dentry = pObjDentry (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) offs  \\<and>\n                offs' = offs + 8 + wordarray_length (name\\<^sub>f dentry) \\<and>\n                offs' \\<le> (bound\\<^sub>f buf)\"\n  unfolding loop_deserialise_ObjDentry_def[unfolded tuple_simps sanitizers]\n  apply (clarsimp simp: Let_def OptElemAO.make_def)\n  apply (rule deserialise_ObjDentry_ret[OF assms(1-4)])\n  by (clarsimp simp: eInval_def)+\n\nlemma slice_Cons:\n  \"frm < length xs \\<Longrightarrow> frm < to\n    \\<Longrightarrow> slice frm to xs = xs ! frm # slice (Suc frm) to xs\"\n  apply (simp add: slice_def)\n  apply (subst slice_Cons_helper[where i=frm], simp_all)\n  apply clarsimp\n  done\n\nlemma slice_list_update:\n  \"n < length xs\n    \\<Longrightarrow> slice i j (xs[n := x]) = (if n < i then slice i j xs\n        else if n \\<ge> j then slice i j xs\n        else (slice i j xs)[n - i := x])\"\n  by (simp add: slice_def drop_list_update take_list_update)\n\nlemma mapAccumObsOpt_step:\n  assumes frm: \"frm < to\" \"frm < length xs\"\n  shows \"mapAccumObsOpt frm to fn xs vacc obs =\n        (case fn (OptElemAO.make (xs ! frm) vacc obs)\n         of Iterate (oelem, acc) \\<Rightarrow> \n             mapAccumObsOpt (Suc frm) to fn (xs [frm := oelem]) acc obs\n         | Break (oelem, d) \\<Rightarrow> Break (xs [frm := oelem], d))\"\nproof -\n  let ?folder = \"(\\<lambda>elem. case_LoopResult\\<^sub>1\\<^sub>1 (\\<lambda>(ys, d). Break (ys @ [elem], d))\n                               (\\<lambda>(ys, acc).\n                                   case fn (OptElemAO.make elem acc obs) of\n                                  Break (oelem, d) \\<Rightarrow> Break (ys @ [oelem], d)\n                                | Iterate (oelem, acc) \\<Rightarrow> Iterate (ys @ [oelem], acc)))\"\n\n  { fix xs ys d\n  have fold_break: \"fold ?folder xs (Break (ys, d))\n        = Break (ys @ xs, d)\"\n    by (induct xs arbitrary: ys d, simp_all)\n  }\n  note fold_break = this\n\n  have fold_iterate_Cons: \"\\<And>xs. \\<forall>y ys acc. fold ?folder xs (Iterate (y # ys, acc))\n        = (case (fold ?folder xs (Iterate (ys, acc)))\n            of Iterate (zs, acc) \\<Rightarrow> Iterate (y # zs, acc)\n          | Break (zs, d) \\<Rightarrow> Break (y # zs, d))\"\n    apply (induct_tac xs, simp_all)\n    apply clarsimp\n    apply (case_tac \"fn (OptElemAO.make a acc obs)\")\n     apply (clarsimp simp add: fold_break)\n    apply clarsimp\n    done\n\n  from frm have drop_helper: \"\\<And>x xs. drop (to - frm) (x # xs) = drop (to - Suc frm) xs\"\n    apply (cases \"to - frm\", simp_all)\n    apply (cases to, simp_all)\n    apply (cases frm, simp_all)\n    apply (metis Suc_diff_Suc Suc_inject)\n    done\n\n  show ?thesis using frm\n    apply (simp add: mapAccumObsOpt_def)\n    apply (simp add: slice_Cons)\n    apply (cases \"fn (OptElemAO.make (xs ! frm) vacc obs)\")\n     apply (clarsimp simp: fold_break)\n     apply (simp add: slice_def upd_conv_take_nth_drop max_absorb2)\n     apply (subst append_take_drop_id\n                  [where xs=\"drop (Suc frm) xs\" and n=\"to -frm - 1\", \n                    simplified take_drop, symmetric])\n     apply simp\n    apply (clarsimp simp: mapAccumObsOpt_def slice_list_update take_list_update)\n    apply (simp add: fold_iterate_Cons)\n    apply (simp split: LoopResult\\<^sub>1\\<^sub>1.split)\n    apply (clarsimp simp: slice_def upd_conv_take_nth_drop min_absorb2 max_absorb2\n                          drop_helper)\n    done\n qed\n\nlemma mapAccumObsOpt_n_n:\n  \"mapAccumObsOpt n n fn xs vacc obs = Iterate (xs, vacc)\"\n  by (clarsimp simp: mapAccumObsOpt_def slice_n_n)\n\nlemma mapAccumObsOpt_frm_eq_len:\n  \"frm = length xs \\<Longrightarrow> mapAccumObsOpt frm to fn xs vacc obs = Iterate (xs @ [], vacc)\"\n  by (clarsimp simp: mapAccumObsOpt_def slice_def)\n\nlemma snd_fold_simp:\n \"snd (fold (\\<lambda>_ (a, b). (f a b, f' b)) xs (a,b)) =\n  fold (\\<lambda>_ b. f' b) xs b\"\n  by (induct xs arbitrary: a b, simp_all) \n\nlemma fst_fold_append_simp:\n  \"fst (fold (\\<lambda>_ (xs, n). (xs @ [f n], f' n)) ls (f n' # xs, f' n)) = \n   f n' # fst (fold (\\<lambda>_ (xs, n). (xs @ [f n], f' n)) ls (xs, f' n)) \"\n   by (induct ls arbitrary: n xs, simp_all)\n\nlemma snd_snd_fold_simp:\n  \"(snd (fold (\\<lambda>_ (xs, doffs, offslist). (f xs doffs, f' doffs, f'' doffs offslist))  ls (xs, n, offslist))) =\n    fold (\\<lambda>_ (doffs, offslist).  (f' doffs, f'' doffs offslist)) ls (n, offslist)\" \n  by (induct ls arbitrary: xs n offslist, simp_all) \n\nlemma snd_fold_append_gen_simp:\n \"snd (fold (\\<lambda>_ (x, xs). (f' x, xs @ [f x])) ls (x, xs @ ys)) =\n   xs @ snd (fold (\\<lambda>_ (x, xs). (f' x, xs @ [f x])) ls (x, ys))\"\n  by (induct ls arbitrary: x ys, simp_all)\n\nlemma snd_fold_append_simp:\n \"snd (fold (\\<lambda>_ (x, xs). (f' x, xs @ [f x])) ls (x, xs)) =\n   xs @ snd (fold (\\<lambda>_ (x, xs). (f' x, xs @ [f x])) ls (x, []))\"\n using snd_fold_append_gen_simp[where ys=Nil, simplified] .\n\nlemma fst_fold_triple_simp:\n \"fst (fold (\\<lambda>_ (a, b, c). (f a b, f' b, f'' b c)) ns (a, b, c)) =\n  fst (fold (\\<lambda>_ (a, b). (f a b, f' b)) ns (a, b))\"\n  by (induct  ns arbitrary: a b c, simp_all)\n\nlemma fst_snd_fold_triple_simp:\n \"fst (snd (fold (\\<lambda>_ (a, b, c). (f a b, f' b, f'' b c)) ns (a, b, c))) =\n  snd (fold (\\<lambda>_ (a, b). (f a b, f' b)) ns (a, b))\"\n  by (induct  ns arbitrary: a b c, simp_all)\n\ndefinition dentarr_offs_list_drop :: \"U8 list \\<Rightarrow> U32 \\<Rightarrow> nat list \\<Rightarrow> U32 \\<Rightarrow> (32 word list)\"\nwhere\n \"dentarr_offs_list_drop data ost entriesno offs =\n    snd (fold (\\<lambda>_ (doffs, offslist).\n      let dentry = pObjDentry (drop (unat offs) data) (doffs - offs);\n          newoffs = doffs + 8 + wordarray_length (ObjDentry.name\\<^sub>f dentry)\n       in (newoffs, offslist @ [newoffs]))\n      entriesno (ost, []))\n\"\ndefinition\n  dentarr_offs_list_drop_end_offs_pred\nwhere\n \"dentarr_offs_list_drop_end_offs_pred data ost entriesno offs end_offs \\<equiv>\n \\<forall>v\\<in>set (dentarr_offs_list_drop data ost entriesno offs).\n   v \\<le> end_offs\"\n\ndefinition\n \"dentarr_offs_list data ost entriesno \\<equiv> \n  (snd (fold (\\<lambda>_ (doffs, offslist).\n     let dentry = pObjDentry data doffs;\n         newoffs = doffs + 8 + wordarray_length (ObjDentry.name\\<^sub>f dentry)\n     in (newoffs, offslist @ [newoffs]))\n   entriesno (ost, [])))\"\n\ndefinition\n  dentarr_offs_list_end_offs_pred\nwhere\n \"dentarr_offs_list_end_offs_pred data ost entriesno end_offs \\<equiv>\n \\<forall>v\\<in>set (dentarr_offs_list data ost entriesno).\n   v \\<le> end_offs\"\n\ndefinition\n  dentarr_otype_end_offs_pred\nwhere\n \"dentarr_otype_end_offs_pred otype data offs end_offs \\<equiv>\n (otype = bilbyFsObjTypeDentarr \\<longrightarrow>\n (let nbentry = ple32 data (offs + 8)\n in dentarr_offs_list_end_offs_pred data (offs+bilbyFsObjDentarrHeaderSize) [0..<unat nbentry] end_offs))\"\n\nlemmas dentarr_end_offs_simps = dentarr_offs_list_def dentarr_offs_list_end_offs_pred_def\n  dentarr_otype_end_offs_pred_def\n\ndefinition\n  dentarr_otype_drop_end_offs_pred\nwhere\n \"dentarr_otype_drop_end_offs_pred otype data offs end_offs \\<equiv>\n (otype = bilbyFsObjTypeDentarr \\<longrightarrow>\n  (let nbentry = ple32 data (offs+8)\n  in dentarr_offs_list_drop_end_offs_pred data (offs+bilbyFsObjDentarrHeaderSize)\n  [0..<unat nbentry] offs end_offs))\n\"\ndefinition\n  dentarr_otype_drop_end_offs_st_pred\nwhere\n \"dentarr_otype_drop_end_offs_st_pred otype data offs st_offs end_offs \\<equiv>\n (otype = bilbyFsObjTypeDentarr \\<longrightarrow>\n  (let nbentry = ple32 data (offs+8)\n  in dentarr_offs_list_drop_end_offs_pred data (offs+bilbyFsObjDentarrHeaderSize)\n  [0..<unat nbentry] st_offs end_offs))\n\"\n\nlemmas dentarr_drop_end_offs_simps = dentarr_offs_list_drop_def dentarr_offs_list_drop_end_offs_pred_def\n  dentarr_otype_drop_end_offs_pred_def dentarr_otype_drop_end_offs_st_pred_def\n\nlemma ple32_eq_slice:\n assumes \"offs < offs + 4\" \n assumes \"unat offs + 4 \\<le> length xs\"\n assumes \"offs + 4 < end_offs\"\n shows   \"ple32 xs offs = ple32 (slice (unat offs) (unat end_offs) xs) 0\"\n using assms \n  apply (simp add:  slice_def ple32_def drop_take word_add_eq_unat)\n  apply (drule less_to_le, simp add: unat_plus_simple word_less_nat_alt)\n done\n\nlemma split_upt_on_l_n:\n  \"n < m \\<Longrightarrow> l \\<le> n \\<Longrightarrow> [l ..< m] = [l ..< n] @ [n] @ [Suc n ..< m]\"\n  apply (subst upt_add_eq_append')\n  apply simp+\n  apply (simp add: upt_conv_Cons)\n  done\n\nlemma unat_plus_simple_imp:\n \"x \\<le> (x::'a::len word) + y \\<Longrightarrow> (unat (x + y) = unat x + unat y)\"\n by (simp add: unat_plus_simple)\n\nlemma pObjDentry_drop_eq:\n assumes offs_le_ost: \"offs \\<le> ost\"\n and     ost_no_of8: \" ost < ost + 8\"\n and     ost_le_offs_olen: \" ost \\<le> end_offs\"\n and     offs_olen_ys: \"unat end_offs \\<le> length ys\"\n and     ys_le_max: \" length ys \\<le> unat bilbyFsMaxEbSize\"\n and     end_offs: \"end_offs_nat = unat end_offs\"\n shows \" pObjDentry (take end_offs_nat ys) ost = pObjDentry (drop (unat offs) (take end_offs_nat ys)) (ost - offs)\"\nproof -\n have ost_4_nat: \"unat (ost + 4) = unat ost + 4\"\n   using ost_no_of8 by (simp add: unat_arith_simps) unat_arith\n\n have ost_le_max: \"ost \\<le> bilbyFsMaxEbSize\" using ys_le_max offs_olen_ys ost_le_offs_olen\n  by unat_arith\n\n hence offs_le_max: \"offs \\<le> bilbyFsMaxEbSize\"\n  using offs_le_ost by unat_arith\n\n\n have ost_minus_offs_bound: \"ost - offs \\<le> bilbyFsMaxEbSize\"\n  using  offs_le_ost ost_le_max\n  by unat_arith\n\n have ost_no_ofs: \"ost < ost + 4\" \"ost < ost + 6\" using ost_no_of8\n   by (clarsimp simp add: unat_arith_simps , unat_arith)+\n\n hence ost_offs_x: \"unat (ost - offs + 4) = unat ost - unat offs + 4\"\n                   \"unat (ost - offs + 6) = unat ost - unat offs + 6\"\n                   \"unat (ost - offs + 8) = unat ost - unat offs + 8\"\n   using offs_le_ost offs_le_ost[simplified word_le_nat_alt] ost_4_nat \n   ost_minus_offs_bound\n   apply (simp_all add: bilbyFsMaxEbSize_def)\n   apply ((drule plus_no_overflow_unat_lift)+, \n      (subst unat_plus_simple_imp,\n       simp only: word_le_nat_alt, unat_arith,subst unat_sub, simp+))\n\n   apply ((drule plus_no_overflow_unat_lift)+, \n      (subst unat_plus_simple_imp,\n       simp only: word_le_nat_alt, unat_arith,subst unat_sub, simp+))\n\n   apply ((drule plus_no_overflow_unat_lift)+)\n   apply (subst unat_plus_simple_imp)\n   apply (simp only: word_le_nat_alt word_less_nat_alt)\n   using offs_le_max[simplified bilbyFsMaxEbSize_def word_le_nat_alt]\n   ost_no_of8\n\n   apply (simp only:unat_arith_simps)\n   apply unat_arith\n  apply (subst unat_sub, simp+)\n done\n\n have offs_cancel: \"(unat ost - unat offs + 4 + unat offs) = unat ost + 4\" \n                   \"(unat ost - unat offs + 6 + unat offs) = unat ost + 6\"\n                   \"(unat ost - unat offs + 8 + unat offs) = unat ost + 8\"\n  using offs_le_ost[simplified word_less_nat_alt] by unat_arith+\n\n have ple16_eq: \"ple16 (take end_offs_nat ys) (ost + 6) = ple16 (drop (unat offs) (take end_offs_nat ys)) (ost - offs + 6)\"\n   apply (simp add: ple16_def)\n   apply (rule arg_cong[where f=word_rcat])\n   apply (rule arg_cong[where f=rev])\n   apply (rule arg_cong[where f=\"take 2\"])\n   apply (fastforce simp add: ost_offs_x offs_cancel less_to_le[OF ost_no_ofs(2), simplified unat_plus_simple])\n  done\n\n have offs_cancel': \"\\<forall>v. unat ost - unat offs + 8 + unat v + unat offs = unat ost + 8 + unat v\"\n  using offs_le_ost[simplified word_less_nat_alt]\n  by unat_arith\n\n show ?thesis\n  apply (simp add: pObjDentry_def Let_def ObjDentry.make_def)\n  apply (rule conjI)\n   apply (simp add: ple32_def)\n   apply (rule arg_cong[where f=word_rcat])\n   apply (rule arg_cong[where f=rev])\n   apply (rule arg_cong[where f=\"take 4\"])\n   apply (subst unat_sub[OF offs_le_ost])\n   using offs_le_ost\n   apply (subst add_diff_assoc2, fastforce simp: word_le_nat_alt)\n   apply fastforce\n  apply (rule conjI)\n   apply (simp add: pu8_def )\n   apply (rule arg_cong[where f=word_rcat])\n   apply (simp only: slice_def drop_take Util.fun_app_def)\n   using ost_offs_x ost_4_nat\n   apply simp\n   apply (simp add: take_drop offs_cancel)\n   apply (subst add.commute, fastforce simp only: offs_cancel)\n  apply (simp add: ple16_eq )\n  apply (rule arg_cong[where f=WordArrayT.make])\n  apply (subgoal_tac \"\\<exists>v. ple16 (drop (unat offs) (take (unat offs + unat (Obj.len\\<^sub>f obj)) ys)) (ost - offs + 6) = v\")\n   apply (erule exE)\n   apply (simp only: ost_offs_x less_to_le[OF ost_no_of8, simplified unat_plus_simple])\n   apply (simp add: slice_def take_drop )\n   apply (simp add: offs_cancel offs_cancel')+\n  done\nqed\n\nlemma wa_length_ObjDentry_name_le:\n \"unat (wordarray_length (ObjDentry.name\\<^sub>f (pObjDentry xs ost))) \\<le> length xs\"\n by (simp add: pObjDentry_def Let_def ObjDentry.make_def wordarray_make wordarray_length_ret slice_def)\n\nlemma wa_length_ObjDentry_name_le_len:\n \"unat (wordarray_length (ObjDentry.name\\<^sub>f (pObjDentry xs ost))) \\<le> unat (ple16 xs (ost + 6))\"\n by (simp add: pObjDentry_def Let_def ObjDentry.make_def wordarray_make wordarray_length_ret slice_def)\n\nlemma dentarr_end_offs_list_induct_helper:\n assumes diff: \"Suc diff = unat to - frm\"\n and     ih: \"dentarr_offs_list_end_offs_pred (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) (offs + 8 +\n     wordarray_length\n      (ObjDentry.name\\<^sub>f (pObjDentry (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) offs)))\n    [Suc frm..<unat to] end_offs\"\n and cur: \"   offs + 8 +\n   wordarray_length (ObjDentry.name\\<^sub>f (pObjDentry (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) offs))\n   \\<le> end_offs\"\n shows\n \"dentarr_offs_list_end_offs_pred (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) offs [frm..<unat to] end_offs\"\nproof -\n  have frm_lt_to: \"frm < unat to\" using diff by unat_arith\n  show ?thesis\n  apply (clarsimp simp: dentarr_end_offs_simps )\n  apply (subst (asm) upt_rec, simp add: frm_lt_to Let_def) \n  apply (subst (asm)  snd_fold_append_simp)\n  apply clarsimp\n  apply (erule disjE)\n   using cur apply simp\n  using ih apply (simp add: dentarr_end_offs_simps Let_def)\n done\nqed\n\nlemma offs_pl_8_name_of:\n  \" wellformed_buf buf \\<Longrightarrow>\n    length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize \\<Longrightarrow>\n    offs + 8 + wordarray_length (ObjDentry.name\\<^sub>f (pObjDentry (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) offs)) \\<le> bound\\<^sub>f buf \\<Longrightarrow>\n    offs \\<le> bilbyFsMaxEbSize  \\<Longrightarrow>\n    offs < offs + 8\"\n apply (simp add: bilbyFsMaxEbSize_def)\n using wa_length_ObjDentry_name_le[where xs=\"(take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf)))\" and ost=offs]\n apply (clarsimp simp add: wellformed_buf_def)\n apply (simp add: unat_arith_simps)\ndone\n\nlemma mapAccumObsOpt_loop_deserialise_ObjDentry_ret:\n  assumes wellformed_buf: \"wellformed_buf buf\"\n  assumes no_buf_overflow: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes bound: \"end_offs \\<le> bound\\<^sub>f buf\"\n  assumes off_less_end_offs: \"offs  \\<le> end_offs\"\n  assumes frm: \"frm \\<le> unat (to::word32)\" \"unat to \\<le> length ys\" \n  assumes st_offs: \"st_offs \\<le> offs\"\n  shows \n  \"let list_spec = \n      case (fold (\\<lambda>_ (xs, doffs, offslist).\n             let dentry = pObjDentry (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) doffs ;\n                 newoffs = doffs +  8 + wordarray_length (ObjDentry.name\\<^sub>f dentry)\n             in (xs@[Option\\<^sub>1\\<^sub>1.Some dentry], \n                newoffs, offslist @ [newoffs])) \n           [frm..<unat to] ([], offs, [])) \n         of (xs, offs) \\<Rightarrow> ((take frm ys) @ xs @ (drop (unat to) ys), offs);\n      data = take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf)) in\n  (case mapAccumObsOpt frm (unat to) loop_deserialise_ObjDentry \n     ys (ex, offs) (buf, end_offs) of\n       Break (ys, d, ex) \\<Rightarrow> \n        d \\<in> {eInval, eNoMem}\n     | Iterate (ys, ex, offs') \\<Rightarrow> \n        \n        (ys, ex, offs') = (fst list_spec, ex, fst (snd list_spec)) \\<and>\n        offs' \\<le> end_offs \\<and>\n        dentarr_offs_list_end_offs_pred data offs [frm..<unat to] end_offs \\<and>\n        dentarr_offs_list_drop_end_offs_pred data offs [frm..<unat to] st_offs end_offs)\"\n  using assms\n  proof (induct \"unat to - frm\" arbitrary: frm ys ex offs)\n  case 0\n  thus ?case\n   by (simp add: dentarr_end_offs_simps mapAccumObsOpt_n_n dentarr_drop_end_offs_simps)\nnext   \n  case (Suc diff) \n  note IH = this(1) and rest = this(2-)\n\n  have offs_le_max: \"offs \\<le> bilbyFsMaxEbSize\"\n   using rest by (simp add: unat_arith_simps wellformed_buf_def) \n\n  hence offs_pl_8: \"offs < offs + 8\"\n   by (simp add: bilbyFsMaxEbSize_def unat_arith_simps)\n\n  have offs_pl_8_pl_name:\n  \"offs + 8 \\<le> offs + 8 + wordarray_length (ObjDentry.name\\<^sub>f (pObjDentry (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) offs))\"\n   using wa_length_ObjDentry_name_le[where xs=\"take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))\" and ost=offs] rest offs_le_max\n     less_to_le[OF offs_pl_8]\n   by (simp add: wellformed_buf_def bilbyFsMaxEbSize_def unat_arith_simps)\n\n  have pObjDentry_eq: \n  \"pObjDentry (drop (unat st_offs) (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf)))) (offs - st_offs) = pObjDentry (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) offs\"\n      using rest offs_pl_8 by (fastforce intro: pObjDentry_drop_eq[symmetric,where end_offs=end_offs and offs=st_offs]\n                                simp add: wellformed_buf_def word_le_nat_alt)\n  \n  from rest show ?case\n  apply (subst mapAccumObsOpt_step, simp, simp)\n  apply (clarsimp simp: Let_def split: LoopResult\\<^sub>1\\<^sub>1.split)\n  apply (rule conjI)\n   using loop_deserialise_ObjDentry_ret[OF wellformed_buf no_buf_overflow bound , \n    where dentry=\"ys ! frm\" and  ex = ex and offs=offs]\n   apply fastforce\n  apply clarsimp\n  apply (rename_tac elem ex' offs')\n  apply (cut_tac \n            frm=\"Suc frm\" and \n            ys= \"ys[frm := elem]\" and    \n            ex =ex' and offs = offs' in IH[OF _ wellformed_buf no_buf_overflow bound], simp_all)\n    apply(cut_tac loop_deserialise_ObjDentry_ret[OF wellformed_buf no_buf_overflow bound ,\n          where dentry=\"ys ! frm\" and  ex = ex and offs=offs and st_offs=st_offs], simp_all)\n   apply(cut_tac loop_deserialise_ObjDentry_ret[OF wellformed_buf no_buf_overflow bound ,\n      where dentry=\"ys ! frm\" and  ex = ex and offs=offs and st_offs=st_offs], simp_all)\n   apply clarsimp\n   using  offs_pl_8_pl_name less_to_le[OF offs_pl_8]\n   apply (fastforce simp add:  unat_plus_simple word_le_nat_alt)\n  apply (clarsimp simp: Let_def)\n  apply (rule conjI)\n   apply fastforce\n  apply (clarsimp simp: Let_def)\n  apply (rename_tac ex'')\n  apply (thin_tac \"mapAccumObsOpt _ _ _ _ _ _ = _\")\n  apply(cut_tac loop_deserialise_ObjDentry_ret[OF wellformed_buf no_buf_overflow bound, \n      where dentry=\"ys ! frm\" and  ex = ex and offs=offs], simp_all)\n\n  apply (clarsimp simp: Let_def fst_fold_triple_simp fst_snd_fold_triple_simp prod.case_eq_if)\n  apply (rule conjI)\n   apply (simp add: upt_conv_Cons[where i = frm])\n   apply (subst take_Suc_conv_app_nth, simp)\n   apply (simp add: take_list_update prod.case_eq_if snd_fold_simp)\n   apply (subst fst_fold_append_simp[where xs=\"[]\", simplified, symmetric]) \n   apply fastforce\n\n  apply (rule conjI)\n   apply (simp add: snd_fold_simp)\n    apply (case_tac \"[frm..<unat to]\")\n     apply (fastforce+)\n   apply (rename_tac l ls)\n   apply (subgoal_tac \"[Suc frm..<unat to] = ls\")\n    prefer 2\n    apply (subst (asm) upt_rec[where i=frm], case_tac \"frm = unat to\"; fastforce)\n   apply simp\n\n  apply (rule conjI)\n   apply (erule (2) dentarr_end_offs_list_induct_helper)\n\n  apply (simp add: dentarr_offs_list_drop_end_offs_pred_def)\n  apply clarsimp\n  apply (rename_tac offs')\n  apply (simp add:  snd_fold_simp)\n  apply (case_tac \"offs' = offs + 8 + wordarray_length (ObjDentry.name\\<^sub>f (pObjDentry (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) offs))\")\n   apply simp\n\n  apply (simp add: dentarr_offs_list_drop_def)\n  apply (subst (asm) split_upt_on_l_n[where l=frm and n=frm, simplified], fastforce)\n  apply (simp add: Let_def)\n  apply (subst (asm) snd_fold_append_simp[where xs=\"[_]\"])\n  apply (erule_tac x=\"offs' \" in ballE, fastforce)\n  apply (fastforce simp add: pObjDentry_eq)\n  done\nqed \n\nlemma replicate_simp:\n  \"replicate (unat to + 1 - unat to) (Option\\<^sub>1\\<^sub>1.None ()) = [Option\\<^sub>1\\<^sub>1.None ()]\"\n  by (simp add: unat_arith_simps)\n\nlemma mapAccumObsOpt_loop_deserialise_ObjDentry_array_ret:\n  assumes wellformed_buf: \"wellformed_buf buf\"\n  assumes no_buf_overflow: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes bound: \"end_offs \\<le> bound\\<^sub>f buf\"\n  assumes off_less_end_offs: \"offs  \\<le> end_offs\"\n  assumes st_offs: \"st_offs \\<le> offs\"\n  shows\n  \"let data = take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf));\n       arr_spec = pArrObjDentry data offs to in \n   (case mapAccumObsOpt 0 (unat to) loop_deserialise_ObjDentry \n      (replicate (unat to + 1) (Option\\<^sub>1\\<^sub>1.None ())) (ex, offs) (buf, end_offs) of\n        LoopResult\\<^sub>1\\<^sub>1.Break (ys, d, ex) \\<Rightarrow> \n         d \\<in> {eInval, eNoMem}\n      | LoopResult\\<^sub>1\\<^sub>1.Iterate (ys, ex, offs') \\<Rightarrow> \n         (ys, ex, offs') = (\\<alpha>a (fst arr_spec), ex, fst (snd arr_spec)) \\<and> \n         offs' \\<le> end_offs \\<and>\n        dentarr_offs_list_end_offs_pred data offs [0..<unat to] end_offs \\<and>\n        dentarr_offs_list_drop_end_offs_pred data offs [0..<unat to] st_offs end_offs)\"\n  unfolding pArrObjDentry_def Let_def\n  apply (clarsimp simp: array_make split: LoopResult\\<^sub>1\\<^sub>1.splits prod.splits)\n  using mapAccumObsOpt_loop_deserialise_ObjDentry_ret[OF assms(1-4), simplified Let_def, \n       where frm=0 and to=to and ex=ex  and st_offs=st_offs and\n       ys=\"replicate (unat to + 1)(Option\\<^sub>1\\<^sub>1.None ())\", simplified take_0 drop_replicate replicate_simp]\n   st_offs\n  apply (clarsimp split: LoopResult\\<^sub>1\\<^sub>1.splits) \n done\n\nlemma array_map_loop_deserialise_ObjDentry_ret:\n  assumes wellformed_buf: \"wellformed_buf buf\"\n  assumes no_buf_overflow: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes bound: \"end_offs \\<le> bound\\<^sub>f buf\"\n  assumes off_less_end_offs: \"offs  \\<le> end_offs\"\n  assumes st_offs: \"st_offs \\<le> offs\"\n  shows \"case array_map (ArrayMapP.make (ArrayT.make (replicate (unat to + 1) (Option\\<^sub>1\\<^sub>1.None ())))\n                   0 to loop_deserialise_ObjDentry (ex, offs) (buf, end_offs)) of\n         LoopResult\\<^sub>1\\<^sub>1.Break (arr, err, ex) \\<Rightarrow> err \\<in> {eInval, eNoMem}\n       | LoopResult\\<^sub>1\\<^sub>1.Iterate (arr, ex', offs') \\<Rightarrow>\n                  let data = take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf));\n                      (parr, poffs, poffslist) = pArrObjDentry data offs to;\n                      ostlist = pArrObjDentry data offs to\n                  in\n                   arr = parr \\<and> offs' = poffs \\<and>\n                  offs' \\<le> end_offs \\<and>\n        dentarr_offs_list_end_offs_pred data offs [0..<unat to] end_offs \\<and>\n        dentarr_offs_list_drop_end_offs_pred data offs [0..<unat to] st_offs end_offs\"\n  apply (clarsimp simp: ArrayMapP.make_def array_make array_map_ret)\n  using assms mapAccumObsOpt_loop_deserialise_ObjDentry_array_ret\n  [unfolded Let_def, where to=to and buf=buf and ex=ex and offs=offs and end_offs=end_offs and st_offs=st_offs]\n  by (clarsimp simp: array_make' Let_def split: LoopResult\\<^sub>1\\<^sub>1.splits)\n\nlemma deserialise_Array_ObjDentry_ret:\n  assumes wellformed_buf: \"wellformed_buf buf\"\n  assumes no_buf_overflow: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes bound: \"end_offs \\<le> bound\\<^sub>f buf\"\n  assumes off_less_end_offs: \"offs  \\<le> end_offs\"\n  assumes st_offs: \"st_offs \\<le> offs\"\n  assumes offs_pl_8_no_of: \"offs \\<le> offs + 8\"\n  assumes offs_pl_8_le_end_offs: \"offs + 8 \\<le> end_offs\"\n  assumes err: \"\\<And>ex e. e \\<in> {eInval, eNoMem} \\<Longrightarrow> P (Error (e, ex))\"\n  assumes suc:\n   \"\\<And>ex arr offs' offslist data.\n    \\<lbrakk> (arr, offs',offslist) = (pArrObjDentry (take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf))) offs nb_dentry);\n       offs' \\<le>  end_offs;\n       data = take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf));\n        dentarr_offs_list_end_offs_pred data offs [0..<unat nb_dentry] end_offs;\n        dentarr_offs_list_drop_end_offs_pred data offs [0..<unat nb_dentry] st_offs end_offs \\<rbrakk> \\<Longrightarrow>\n      P (Success (ex, arr, offs'))\"\n  shows \"P (deserialise_Array_ObjDentry (ex, buf, offs, nb_dentry, end_offs))\"\n  unfolding deserialise_Array_ObjDentry_def[unfolded tuple_simps sanitizers]\n  apply (simp add: Let_def)\n  apply (rule array_create_ret)\n   apply (simp add: err[unfolded eNoMem_def])\n  apply (rename_tac ex' arr a)\n  apply (subgoal_tac \"unat nb_dentry + 1 = unat (nb_dentry+1) \")\n   apply (clarsimp simp: prod.case_eq_if id_def Let_def split: LoopResult\\<^sub>1\\<^sub>1.splits)\n   apply (subgoal_tac \"a = ArrayT.make (replicate (unat (nb_dentry + 1)) (Option\\<^sub>1\\<^sub>1.None ()))\", simp)\n    apply (cut_tac ex=ex' in array_map_loop_deserialise_ObjDentry_ret[OF assms(1-5), where to = nb_dentry])\n    apply (clarsimp simp: Let_def err split: LoopResult\\<^sub>1\\<^sub>1.splits)\n    apply (rename_tac offslist a ex'' offs')\n    apply (rule suc)\n     apply simp+\n   apply (metis array_make')\n  apply unat_arith\n done\n\nlemma word_add_diff_assoc:\n \"(a::'a:: len0 word) + b - c = a + (b - c)\"\n by simp\n\nmethod offs_olen_of_solver =\n  (((drule less_to_le)?, simp add: word_add_diff_assoc unat_plus_simple),\n   (simp only: unat_arith_simps)?, simp? ; unat_arith)\n\nlemma deserialise_ObjDentarr_ret:\n  assumes wf: \"wellformed_buf buf\"\n  assumes buf_len: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes err: \"\\<And>ex e. e \\<in> {eInval, eNoMem} \\<Longrightarrow> P (Error (e, ex))\"\n  assumes offs_bound: \"offs + olen - bilbyFsObjHeaderSize \\<le> (bound\\<^sub>f buf)\"\n  assumes offs_olen: \"offs < offs + olen - bilbyFsObjHeaderSize\"\n  assumes olen: \"bilbyFsObjHeaderSize + bilbyFsObjDentarrHeaderSize + bilbyFsObjDentryHeaderSize \\<le> olen\"\n  assumes st_offs: \"st_offs \\<le> offs\"\n  assumes suc:\n  \"\\<And>ex dentarr offs'. \\<lbrakk>\n  dentarr = pObjDentarr (\\<alpha>wa (data\\<^sub>f buf)) offs olen;\n  offs' = pObjDentarrSize (\\<alpha>wa (data\\<^sub>f buf)) offs olen;\n  let end_offs = offs + olen - bilbyFsObjHeaderSize;\n  data = take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf));\n  nb_dentry = ple32 (\\<alpha>wa (data\\<^sub>f buf)) (offs+8) in\n  dentarr_offs_list_end_offs_pred data (offs+bilbyFsObjDentarrHeaderSize) [0..<unat nb_dentry] end_offs \\<and>\n  dentarr_offs_list_drop_end_offs_pred data (offs+bilbyFsObjDentarrHeaderSize) [0..<unat nb_dentry] st_offs end_offs;\n  offs' \\<le> offs + olen - bilbyFsObjHeaderSize\n  \\<rbrakk> \\<Longrightarrow>\n  P (Success (ex, dentarr, offs'))\"\n notes bilbyFsObjDentarrHeaderSize_def[simp] bilbyFsObjHeaderSize_def[simp]\n       bilbyFsObjDentryHeaderSize_def[simp]\n  shows \"P (deserialise_ObjDentarr (ex, buf, offs, olen))\"\n  proof -\n\n  have offs_no_of: \"offs < offs + bilbyFsObjDentarrHeaderSize\"\n    using olen and offs_olen by simp unat_arith\n\n   have bound_max: \"bound\\<^sub>f buf \\<le> bilbyFsMaxEbSize\"\n     using wf and buf_len by (simp add: wellformed_buf_def) unat_arith\n\n   have offs_bound':  \"offs < bilbyFsMaxEbSize\"\n     using offs_bound offs_olen bound_max offs_no_of by simp\n\n   have offs_hdr_no_of: \"offs < offs + bilbyFsObjDentarrHeaderSize\"\n     using offs_bound' by (simp add: bilbyFsMaxEbSize_def unat_arith_simps)\n\n  have offs_pl_hdr_le_len: \"unat offs + unat bilbyFsObjDentarrHeaderSize \\<le> length (\\<alpha>wa $ data\\<^sub>f buf)\"\n   using offs_bound wf offs_no_of offs_olen olen\n   by (simp add: wellformed_buf_def) unat_arith\n  have deserialises:\n    \"deserialise_le32 (buf, offs + 8) = (ple32 (\\<alpha>wa $ data\\<^sub>f buf) (offs + 8))\"\n    \"deserialise_le64 (buf, offs) = (ple64 (\\<alpha>wa $ data\\<^sub>f buf) offs)\"\n       using offs_pl_hdr_le_len apply (clarsimp simp:)\n       apply (rule deserialise_le32_ret[simplified])\n         using offs_hdr_no_of apply unat_arith\n       using offs_hdr_no_of apply (simp add: unat_arith_simps)\n       apply unat_arith\n\n     using offs_pl_hdr_le_len apply (clarsimp)\n     apply (rule deserialise_le64_ret[simplified])\n    using offs_hdr_no_of  apply unat_arith\n   using offs_hdr_no_of apply (simp add: unat_arith_simps)\n   apply unat_arith\n  done\n  show ?thesis\n  unfolding deserialise_ObjDentarr_def[unfolded tuple_simps sanitizers]\n   apply (clarsimp simp: Let_def err[unfolded eInval_def])\n   apply (subgoal_tac \"\\<exists>v. olen - bilbyFsObjHeaderSize = v \\<and> bilbyFsObjDentarrHeaderSize + bilbyFsObjDentryHeaderSize \\<le> v\")\n    apply (erule exE)\n    apply (erule conjE)\n    apply (rule deserialise_Array_ObjDentry_ret[OF assms(1,2), where st_offs=st_offs,\n             simplified])\n         using offs_bound apply simp\n        subgoal using offs_olen olen by - offs_olen_of_solver\n       subgoal for v\n        using st_offs  offs_olen by - offs_olen_of_solver\n      subgoal for v\n       using offs_olen by - offs_olen_of_solver\n     subgoal for v\n      using offs_olen by (simp add: word_add_diff_assoc add.commute)\n                         (rule word_plus_mono_right; simp)\n    subgoal for v _ e by (fastforce intro: err)\n   subgoal for v ex arr offs' offslist\n    apply (case_tac \"R\\<^sub>1\\<^sub>1.Success (ex, arr, offs')\", simp_all)\n    apply (clarsimp simp: Let_def err[unfolded eNoMem_def] split: R\\<^sub>1\\<^sub>1.split)\n    apply (rule suc)\n        subgoal\n        apply (simp add: pObjDentarr_def Let_def)\n        apply (subst ObjDentarr.surjective, simp add: ObjDentarr.make_def deserialises prod_eq_iff)\n        done\n       subgoal by (clarsimp simp add: prod_eq_iff pObjDentarrSize_def deserialises)\n      subgoal by (simp add: Let_def deserialises)\n     subgoal by simp\n   done\n  subgoal using olen by (simp) unat_arith\n  done\nqed\n\nlemmas pObjUnion_def' = \n  pObjUnion_def[unfolded otype_simps, simplified]\n\nlemmas len_otype_ok = is_len_and_type_ok_def[unfolded sanitizers tuple_simps]\n\nlemma olen_bound_trivial:\n \"   0x28 \\<le> (olen::U32) \\<Longrightarrow>\n    offs + olen - 0x18 \\<le> bound\\<^sub>f buf \\<Longrightarrow>\n    offs \\<le> offs + olen - 0x18 \\<Longrightarrow> offs + 0x10 \\<le> bound\\<^sub>f buf\"\n  by unat_arith\n\nlemma offs_trivial:\n \"(offs::U32) \\<le> offs + olen - 0x18 \\<Longrightarrow>\n    0x28 \\<le> olen \\<Longrightarrow>\n    offs < offs + 0x10\"\n by unat_arith\n\nlemma unat_obj_len_minus_hdrsz:\n  assumes len_otype_rel: \"bilbyFsObjHeaderSize \\<le> olen\"\n  assumes offs_no_of: \"offs \\<le> offs + olen - bilbyFsObjHeaderSize\"\nshows\n \"unat (offs + olen - bilbyFsObjHeaderSize) = unat offs + unat olen - unat bilbyFsObjHeaderSize\"\n using assms\n by (simp add: bilbyFsObjHeaderSize_def word_add_diff_assoc  unat_plus_simple) (simp add: unat_arith_simps)\n \n\nlemma deserialise_ObjUnion_ret:\n  assumes wf: \"wellformed_buf buf\"\n  assumes no_buf_overflow: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes bound: \"offs + olen - bilbyFsObjHeaderSize \\<le> bound\\<^sub>f buf\"\n  assumes len_otype_rel: \"is_len_and_type_ok (otype, olen)\"\n  assumes offs_no_of: \"offs \\<le> offs + olen - bilbyFsObjHeaderSize\"\n  assumes offs_no_underflow: \"offs - bilbyFsObjHeaderSize \\<le> offs\"\n  assumes err:\n  \"\\<And>ex e. e \\<in> {eInval, eNoMem} \\<Longrightarrow> P (Error (e, ex))\"\n  assumes suc:\n  \"\\<And>ex ounion offs'. ounion = pObjUnion ((*take (unat (offs + olen))*) (\\<alpha>wa (data\\<^sub>f buf))) otype olen offs  \\<Longrightarrow>\n   offs' \\<le> (offs + olen - bilbyFsObjHeaderSize) \\<Longrightarrow>\n  let end_offs = offs + olen - bilbyFsObjHeaderSize;\n  data = take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf));\n  nb_dentry = ple32 (\\<alpha>wa (data\\<^sub>f buf)) (offs+8) in\n  dentarr_otype_end_offs_pred otype data offs end_offs \\<and>\n  dentarr_otype_drop_end_offs_st_pred otype data offs (offs - bilbyFsObjHeaderSize) end_offs \n  \\<Longrightarrow>\n   P (Success (ex, ounion, offs'))\"\n  notes suc_simps = len_otype_ok Let_def  pObjUnion_def' suc add.commute bilbyFsObjHeaderSize_def\n          otype_simps dentarr_end_offs_simps  dentarr_drop_end_offs_simps\n  shows \"P (deserialise_ObjUnion (ex, buf, offs, (otype, olen)))\"\n  unfolding deserialise_ObjUnion_def[unfolded tuple_simps, simplified sanitizers]\n  using is_len_and_type_ok_hdr_szD[OF len_otype_rel] \n  apply (clarsimp simp: Let_def)\n  apply (rule conjI)\n   apply clarsimp\n   apply (rule deserialise_ObjSuper_ret, simp)\n      using len_otype_rel offs_no_of bound wf\n      apply (simp add: len_otype_ok Let_def prod.case_eq_if wellformed_buf_def bilbyFsObjHeaderSize_def)\n      apply unat_arith\n     using len_otype_rel offs_no_of bound wf\n     apply (simp add: len_otype_ok Let_def prod.case_eq_if wellformed_buf_def bilbyFsObjHeaderSize_def)\n     apply unat_arith\n    apply (simp add: err)\n\n   using len_otype_rel\n   apply (simp add: suc_simps)\n  apply clarsimp\n  apply (rule conjI)\n   apply clarsimp\n   apply (rule deserialise_ObjDel_ret, simp)\n      using len_otype_rel offs_no_of bound wf\n      apply (simp add: len_otype_ok Let_def prod.case_eq_if wellformed_buf_def bilbyFsObjHeaderSize_def)\n      apply unat_arith\n     apply (simp add: err)\n      using len_otype_rel offs_no_of bound wf\n      apply (simp add: len_otype_ok Let_def prod.case_eq_if wellformed_buf_def bilbyFsObjHeaderSize_def)\n      apply unat_arith\n   using len_otype_rel\n   apply (simp add: suc_simps)\n\n  apply clarsimp\n  apply (rule conjI)\n   apply clarsimp\n   apply (rule deserialise_ObjDentarr_ret[OF wf no_buf_overflow, where st_offs =\"offs - bilbyFsObjHeaderSize\"])\n        apply (simp add: err)\n       using bound  offs_no_of len_otype_rel \n       apply (simp add: len_otype_ok Let_def prod.case_eq_if wellformed_buf_def bilbyFsObjHeaderSize_def)\n      using offs_no_of len_otype_rel \n      apply (simp add: len_otype_ok bilbyFsObjHeaderSize_def )\n      apply (simp add: word_add_diff_assoc unat_plus_simple word_less_nat_alt )\n      apply unat_arith\n     using  len_otype_rel\n     apply (simp add: len_otype_ok bilbyFsObjHeaderSize_def bilbyFsObjDentryHeaderSize_def bilbyFsObjDentarrHeaderSize_def)\n     using offs_no_underflow apply simp\n   apply (simp add: suc pObjUnion_def' )\n   apply (rule suc)\n      apply (clarsimp simp add: pObjUnion_def')+\n   apply (simp add: dentarr_otype_drop_end_offs_st_pred_def dentarr_otype_end_offs_pred_def dentarr_otype_drop_end_offs_pred_def\n        bilbyFsObjTypeDentarr_def Let_def)\n   apply clarsimp\n   apply (subgoal_tac \"ple32 (take (unat (offs + olen - bilbyFsObjHeaderSize)) (\\<alpha>wa (data\\<^sub>f buf))) (offs + 8) = ple32 (\\<alpha>wa (data\\<^sub>f buf)) (offs + 8)\")\n    apply simp\n   apply (subgoal_tac \"\\<exists>v. olen - bilbyFsObjHeaderSize = v\")\n    apply (erule exE)\n    apply (subst ple32_take)\n(* <automate?> *)\n      using len_otype_rel \n      apply (simp add: len_otype_ok bilbyFsObjHeaderSize_def)\n      using offs_no_of apply (simp add: word_add_diff_assoc  bilbyFsObjHeaderSize_def)\n      apply (simp add: word_add_diff_assoc unat_plus_simple word_less_nat_alt word_le_nat_alt add.commute)\n      apply (subst (asm) add.commute)\n      using offs_no_of apply (simp add: bilbyFsObjHeaderSize_def) apply (simp add: word_add_diff_assoc word_le_nat_alt)\n      apply (simp only: unat_arith_simps)\n      apply unat_arith\n    apply (simp add: bilbyFsObjHeaderSize_def word_add_diff_assoc)\n     using offs_no_of \n     apply (simp add: bilbyFsObjHeaderSize_def word_add_diff_assoc word_less_nat_alt  add.commute)\n     apply (subst (asm) add.commute, simp add: unat_plus_simple)\n     using offs_no_of apply (simp add: bilbyFsObjHeaderSize_def)\n     apply (simp add: word_add_diff_assoc)\n     using len_otype_rel\n      apply (simp add: len_otype_ok)\n     apply (subgoal_tac \"offs \\<le> offs + 0xC\")\n      apply (simp add: unat_plus_simple add.commute, simp only: word_le_nat_alt)\n      apply unat_arith\n     apply (simp add: unat_plus_simple add.commute, simp only: word_le_nat_alt)\n     apply unat_arith\n(* </automate?> *)\n    apply simp\n   apply (fastforce)\n  apply clarsimp\n  apply (rule conjI)\n   apply clarsimp\n   apply (rule deserialise_ObjData_ret[OF ])\n       using offs_no_of \n       apply (simp only: diff_conv_add_uminus)\n       apply (simp only: add.assoc)\n      using bound wf offs_no_of apply (simp add: bilbyFsObjHeaderSize_def\n        wellformed_buf_def diff_conv_add_uminus add.assoc)\n      apply unat_arith\n     using len_otype_rel   apply (simp add: otype_simps)\n    apply (simp add: err)\n   apply simp\n   apply (simp add: suc_simps)\n\n  apply (clarsimp)\n  apply (rule conjI)\n   apply clarsimp\n   apply (rule deserialise_ObjInode_ret)\n      using len_otype_rel offs_no_of bound\n         bound wf offs_no_of\n       apply (simp add: bilbyFsObjHeaderSize_def wellformed_buf_def )\n     using len_otype_rel  apply (simp add: otype_simps len_otype_ok)\n       apply unat_arith\n     using len_otype_rel  apply (simp add: otype_simps len_otype_ok)\n       using  offs_no_of\n       apply (simp add: bilbyFsObjHeaderSize_def)\n       apply unat_arith\n     apply (simp add: err)\n     using len_otype_rel  apply (simp add: otype_simps len_otype_ok)\n    apply (simp add: suc_simps)\n  apply clarsimp\n  apply (rule deserialise_ObjPad_ret)\n   apply (simp add:err)  \n  apply (simp add: suc_simps add_diff_eq)+\n done\n\nlemma pObjDel_take:\n \"is_valid_ObjHeader (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs) (bounded buf) \\<Longrightarrow>\n       offs + Obj.len\\<^sub>f obj \\<le> bound\\<^sub>f buf \\<Longrightarrow>\n       is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\<Longrightarrow>\n       offs < offs + Obj.len\\<^sub>f obj \\<Longrightarrow>\n       otype\\<^sub>f obj = 3 \\<Longrightarrow>\n       \\<exists>v. obj\\<lparr>ounion\\<^sub>f := v\\<rparr> = pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs \\<Longrightarrow>\n   pObjDel (\\<alpha>wa (data\\<^sub>f buf)) (offs + bilbyFsObjHeaderSize) =\n      pObjDel (take (unat (offs + Obj.len\\<^sub>f obj)) (\\<alpha>wa (data\\<^sub>f buf))) (offs + bilbyFsObjHeaderSize)\"\n  apply (simp add: pObjDel_def)\n  apply (frule is_valid_ObjHeader_buf_len, clarify)\n  apply (subst ple64_take, (simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)\n  apply simp\ndone\n\nlemma pObjSuper_take:\n \"is_valid_ObjHeader (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs) (bounded buf) \\<Longrightarrow>\n       offs + Obj.len\\<^sub>f obj \\<le> bound\\<^sub>f buf \\<Longrightarrow>\n       is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\<Longrightarrow>\n       offs < offs + Obj.len\\<^sub>f obj \\<Longrightarrow>\n       otype\\<^sub>f obj = 4 \\<Longrightarrow>\n       \\<exists>v. obj\\<lparr>ounion\\<^sub>f := v\\<rparr> = pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs \\<Longrightarrow>\n    pObjSuper (\\<alpha>wa (data\\<^sub>f buf)) (offs + bilbyFsObjHeaderSize) =\n     pObjSuper (take (unat (offs + Obj.len\\<^sub>f obj)) (\\<alpha>wa (data\\<^sub>f buf))) (offs + bilbyFsObjHeaderSize)\"\n  apply (simp add: pObjSuper_def)\n  apply (frule is_valid_ObjHeader_buf_len, clarify)\n  apply (subst ple64_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])\n  apply (subst ple32_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n  apply simp\n done\n\nlemma pObjInode_take:\n \"is_valid_ObjHeader (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs) (bounded buf) \\<Longrightarrow>\n       offs + Obj.len\\<^sub>f obj \\<le> bound\\<^sub>f buf \\<Longrightarrow>\n       is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\<Longrightarrow>\n       offs < offs + Obj.len\\<^sub>f obj \\<Longrightarrow>\n       otype\\<^sub>f obj = 0 \\<Longrightarrow>\n       \\<exists>v. obj\\<lparr>ounion\\<^sub>f := v\\<rparr> = pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs \\<Longrightarrow>\n    pObjInode (\\<alpha>wa (data\\<^sub>f buf)) (offs + bilbyFsObjHeaderSize) =\n     pObjInode (take (unat (offs + Obj.len\\<^sub>f obj)) (\\<alpha>wa (data\\<^sub>f buf))) (offs + bilbyFsObjHeaderSize)\"\n  apply (simp add: pObjInode_def)\n  apply (frule is_valid_ObjHeader_buf_len, clarify)\n  apply (subst ple64_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n  apply (subst ple32_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n  apply simp\n done\n\nlemma pObjDentarr_take:\n \"is_valid_ObjHeader (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs) (bounded buf) \\<Longrightarrow>\n       offs + Obj.len\\<^sub>f obj \\<le> bound\\<^sub>f buf \\<Longrightarrow>\n       is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\<Longrightarrow>\n       offs < offs + Obj.len\\<^sub>f obj \\<Longrightarrow>\n       otype\\<^sub>f obj = 2 \\<Longrightarrow>\n       \\<exists>v. obj\\<lparr>ounion\\<^sub>f := v\\<rparr> = pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs \\<Longrightarrow>\n    pObjDentarr (\\<alpha>wa (data\\<^sub>f buf)) (offs + bilbyFsObjHeaderSize) (Obj.len\\<^sub>f obj) =\n     pObjDentarr (take (unat (offs + Obj.len\\<^sub>f obj)) (\\<alpha>wa (data\\<^sub>f buf))) (offs + bilbyFsObjHeaderSize) (Obj.len\\<^sub>f obj)\"\n  apply (simp add: pObjDentarr_def)\n  apply (frule is_valid_ObjHeader_buf_len, clarify)\n  apply (subst ple64_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n  apply (subst ple32_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n  apply (simp add: Let_def) \n done\n\n\nlemma pObjData_take:\n\"is_valid_ObjHeader (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs) (bounded buf) \\<Longrightarrow>\n       offs + Obj.len\\<^sub>f obj \\<le> bound\\<^sub>f buf \\<Longrightarrow>\n       is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\<Longrightarrow>\n       offs < offs + Obj.len\\<^sub>f obj \\<Longrightarrow>\n       otype\\<^sub>f obj = 1 \\<Longrightarrow>\n       \\<exists>v. obj\\<lparr>ounion\\<^sub>f := v\\<rparr> = pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs \\<Longrightarrow>\npObjData (\\<alpha>wa (data\\<^sub>f buf)) (offs + bilbyFsObjHeaderSize) (Obj.len\\<^sub>f obj) =\n    pObjData (take (unat (offs + Obj.len\\<^sub>f obj)) (\\<alpha>wa (data\\<^sub>f buf))) (offs + bilbyFsObjHeaderSize)\n     (Obj.len\\<^sub>f obj)\"\n   apply (simp add: pObjData_def)\n  apply (subst ple64_take, ((simp add: otype_simps len_otype_ok bilbyFsObjHeaderSize_def, unat_arith)+)[2])+\n    apply (simp add: otype_simps len_otype_ok)\n    apply (subst slice_take)\n      apply (frule is_valid_ObjHeader_len)\n      apply (subgoal_tac \" unat (Obj.len\\<^sub>f obj - bilbyFsObjHeaderSize - bilbyFsObjDataHeaderSize) =  unat (Obj.len\\<^sub>f obj) - unat bilbyFsObjHeaderSize - unat bilbyFsObjDataHeaderSize\")\n       apply (subgoal_tac \"unat (offs + Obj.len\\<^sub>f obj) = unat offs + unat ( Obj.len\\<^sub>f obj)\")\n         apply simp\n         apply (simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def)\n         apply unat_arith\n        apply (simp add: word_less_nat_alt unat_plus_simple[symmetric], unat_arith)\n      apply (subst unat_sub, simp add: bilbyFsObjHeaderSize_def bilbyFsObjDataHeaderSize_def, unat_arith)+\n    apply simp+\n done\n\nlemma pObjUnion_take:\n \"is_valid_ObjHeader (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs) (bounded buf) \\<Longrightarrow>\n       offs + Obj.len\\<^sub>f obj \\<le> bound\\<^sub>f buf \\<Longrightarrow>\n       is_len_and_type_ok (otype\\<^sub>f obj, Obj.len\\<^sub>f obj) \\<Longrightarrow>\n       offs < offs + Obj.len\\<^sub>f obj \\<Longrightarrow>\n       \\<exists>v. obj\\<lparr>ounion\\<^sub>f := v\\<rparr> = pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs \\<Longrightarrow>\n      pObjUnion (\\<alpha>wa (data\\<^sub>f buf)) (otype\\<^sub>f obj) (Obj.len\\<^sub>f obj) (offs + bilbyFsObjHeaderSize) = \n      pObjUnion (take (unat (offs + Obj.len\\<^sub>f obj)) (\\<alpha>wa (data\\<^sub>f buf))) (otype\\<^sub>f obj) (Obj.len\\<^sub>f obj) (offs + bilbyFsObjHeaderSize)\"\n  apply (simp add: pObjUnion_def')\n  apply (case_tac \"otype\\<^sub>f obj = 0\")\n   apply (simp add: pObjInode_take)\n  apply (case_tac \"otype\\<^sub>f obj = 1\")\n   apply (simp add: pObjData_take)\n  apply (case_tac \"otype\\<^sub>f obj = 2\")\n   apply (simp add: pObjDentarr_take)\n  apply (case_tac \"otype\\<^sub>f obj = 3\")\n   apply (simp add: pObjDel_take)\n  apply (case_tac \"otype\\<^sub>f obj = 4\")\n   apply (simp add: pObjSuper_take)\n  apply simp\n done\n\nlemmas Obj_ext_eq_expand = trans[OF _ Obj.ext_inject,\n    OF arg_cong2[where f=\"op =\"], OF refl Obj.surjective]\n\nlemma deserialise_Obj_ret:\n  assumes wf: \"wellformed_buf buf\"\n  assumes buf_len: \"length (\\<alpha>wa $ data\\<^sub>f buf) \\<le> unat bilbyFsMaxEbSize\"\n  assumes bound: \"offs + bilbyFsObjHeaderSize \\<le> bound\\<^sub>f buf\"\n  assumes no_of: \"offs < offs + bilbyFsObjHeaderSize\"\n  assumes err: \"\\<And>ex e. e \\<in> {eInval, eNoMem} \\<Longrightarrow> P (Error (e, ex))\"\n  assumes suc:\n   \"\\<And>ex obj offs'. \\<lbrakk> \n    is_valid_ObjHeader (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs) (\\<alpha>wa (data\\<^sub>f buf)) ;\n\n    let end_offs = offs + (Obj.len\\<^sub>f obj);\n    data = take (unat end_offs) (\\<alpha>wa (data\\<^sub>f buf));\n    nb_dentry = ple32 (\\<alpha>wa (data\\<^sub>f buf)) (offs+8) in\n    dentarr_otype_end_offs_pred (Obj.otype\\<^sub>f obj) data (offs + bilbyFsObjHeaderSize) end_offs \\<and>\n    dentarr_otype_drop_end_offs_st_pred (Obj.otype\\<^sub>f obj) data (offs + bilbyFsObjHeaderSize) offs end_offs;\n    obj = pObj (\\<alpha>wa (data\\<^sub>f buf)) offs;\n    offs' \\<le> offs + Obj.len\\<^sub>f obj \\<rbrakk> \\<Longrightarrow> \n\n   P (Success (ex, obj, offs'))\"\n  notes bilbyFsObjHeaderSize_def[simp]\n  shows \"P (deserialise_Obj (ex, buf, offs))\"\n  unfolding deserialise_Obj_def[unfolded tuple_simps sanitizers]\n  apply (clarsimp simp: err eNoMem_def split: R\\<^sub>1\\<^sub>1.split)\n  apply (rule deserialise_ObjHeader_ret[OF wf bound no_of])\n   apply (simp add: err)\n  apply simp\n  apply (rule deserialise_ObjUnion_ret[OF wf buf_len])\n      apply (simp)\n     apply (clarsimp, drule sym[where t=\"pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs\"])\n     apply (clarsimp simp  add: is_valid_ObjHeader_def)\n    apply simp\n    apply (drule is_valid_ObjHeader_len)\n    apply (clarsimp, drule sym[where t=\"pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs\"])\n    apply (drule arg_cong[where f=Obj.len\\<^sub>f])\n    using no_of bound\n    apply simp\n    apply  (simp only: word_le_nat_alt plus_no_overflow_unat_lift)\n   apply (drule is_valid_ObjHeader_len)\n    apply (clarsimp, drule sym[where t=\"pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs\"])\n    apply (drule arg_cong[where f=Obj.len\\<^sub>f])\n   apply (clarsimp simp add: )\n   apply unat_arith\n   apply (simp add: err)\n\n  apply simp\n  apply (rule suc)\n       apply (clarsimp simp add: is_valid_ObjHeader_def bounded_def)\n      apply simp\n   apply (clarsimp simp add: pObj_def Let_def)\n   apply (drule sym[where t=\"pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs\"])\n   apply (subst pObjUnion_take[simplified], (fastforce simp add: is_valid_ObjHeader_def)+)\n   apply (rename_tac obj offs' v)\n   apply (subgoal_tac \"pObjUnion (take (unat (offs + Obj.len\\<^sub>f obj)) (\\<alpha>wa (data\\<^sub>f buf))) (otype\\<^sub>f obj)\n              (Obj.len\\<^sub>f obj) (offs + 0x18) = pObjUnion\n           (take (unat offs + unat (Obj.len\\<^sub>f (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs))) (\\<alpha>wa (data\\<^sub>f buf)))\n           (otype\\<^sub>f (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs))\n           (Obj.len\\<^sub>f (pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs)) (offs + 0x18)\")\n    apply simp\n   apply (case_tac \"pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs\", case_tac obj, simp)\n   apply (case_tac \"pObjHeader (\\<alpha>wa (data\\<^sub>f buf)) offs\", case_tac obj, simp)\n   apply (simp add: plus_no_overflow_unat_lift)+\n done\n\nlemma pObjHeader_take:\n \"is_valid_ObjHeader (pObjHeader xs (ObjAddr.offs\\<^sub>f oaddr)) xs \\<Longrightarrow>\nis_obj_addr_consistent (pObj (take (unat (ObjAddr.offs\\<^sub>f oaddr) + unat (ObjAddr.len\\<^sub>f oaddr)) xs)\n          (ObjAddr.offs\\<^sub>f oaddr)) oaddr \\<Longrightarrow>\n  ObjAddr.offs\\<^sub>f oaddr < ObjAddr.offs\\<^sub>f oaddr + bilbyFsObjHeaderSize \\<Longrightarrow>\n  bilbyFsObjHeaderSize \\<le> ObjAddr.len\\<^sub>f oaddr \\<Longrightarrow>\n   pObjHeader xs (ObjAddr.offs\\<^sub>f oaddr) = pObjHeader (take (unat (ObjAddr.offs\\<^sub>f oaddr) + unat (ObjAddr.len\\<^sub>f oaddr)) xs) (ObjAddr.offs\\<^sub>f oaddr)\"\n\n  apply (simp add: pObjHeader_def)\n  apply (subst ple32_take, ((simp add: bilbyFsObjHeaderSize_def, unat_arith, fastforce? )[2])+)+\n  apply (subst ple64_take, ((simp add: bilbyFsObjHeaderSize_def, unat_arith, fastforce? )[2])+)+\n  apply (subst nth_take,   (simp add: bilbyFsObjHeaderSize_def, unat_arith))+\n  apply (rule refl)\ndone\n\nend\n\n", "meta": {"author": "crizkallah", "repo": "cogent", "sha": "cb16e8169d4389e32dc4aecf4eb9f57173264006", "save_path": "github-repos/isabelle/crizkallah-cogent", "path": "github-repos/isabelle/crizkallah-cogent/cogent-cb16e8169d4389e32dc4aecf4eb9f57173264006/impl/fs/bilby/proof/spec/SerialS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947425132315, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.31466296014328193}}
{"text": "theory FO_Proofs_Very_Slow\n  imports FO_Proofs0\nbegin\n\n(* This file contains a proof that runs *very* slowly.\n   Since this file will be loaded each time qrhl-tool starts up,\n   we have commented the proof out and replaced it by \"sorry\".\n   To check the proof, simply remove the \"sorry\" and comment the \n   proof back in. *)\n\nlemma queryH_invariant_vc:\n  fixes Hq1 :: \"ciph \\<Rightarrow> key\" and H1 :: \"msg \\<Rightarrow> key\"\n  assumes [simp]: \"declared_qvars \\<lbrakk>Gin1,tmp_Gin2,Gout1,tmp_Gout2,quantA1,quantA2,Hin1,Hout1,Hin2,Hout2,Gin2,Gout2\\<rbrakk>\"\n  (* Copy & paste of subgoal in QRHL tool *)\n  shows \"\\<CC>\\<ll>\\<aa>[H1 = mk_Hq Hq2 H02 G2 pk2] \\<sqinter> \n(Uoracle H1\\<guillemotright>\\<lbrakk>Hin1, Hout1\\<rbrakk> \\<cdot> \\<lbrakk>quantA1, Hin1, Hout1, Gin1, Gout1\\<rbrakk> \\<equiv>\\<qq> \n\\<lbrakk>quantA2, Hin2, Hout2, tmp_Gin2, tmp_Gout2\\<rbrakk>) \\<sqinter> Span {ket 0}\\<guillemotright>\\<lbrakk>Gout2\\<rbrakk> \\<le> \\<CC>\\<ll>\\<aa>[isometry comm_op] \\<sqinter> \n((comm_op\\<guillemotright>\\<lbrakk>Hin2, Gin2\\<rbrakk>)* \\<cdot> (\\<CC>\\<ll>\\<aa>[isometry (Uoracle G2)] \\<sqinter> ((Uoracle G2\\<guillemotright>\\<lbrakk>Gin2, Gout2\\<rbrakk>)* \\<cdot> \n(\\<CC>\\<ll>\\<aa>[isometry (Uoracle (\\<lambda>(m, g). mk_Hq' Hq2 H02 g pk2 m))] \\<sqinter> ((Uoracle (\\<lambda>(m, g). mk_Hq' \nHq2 H02 g pk2 m)\\<guillemotright>variable_concat \\<lbrakk>Gin2, Gout2\\<rbrakk> \\<lbrakk>Hout2\\<rbrakk>)* \\<cdot> (\\<CC>\\<ll>\\<aa>[isometry (Uoracle G2)] \\<sqinter> \n((Uoracle G2\\<guillemotright>\\<lbrakk>Gin2, Gout2\\<rbrakk>)* \\<cdot> (\\<CC>\\<ll>\\<aa>[isometry comm_op] \\<sqinter> ((comm_op\\<guillemotright>\\<lbrakk>Hin2, Gin2\\<rbrakk>)* \\<cdot> \n(\\<CC>\\<ll>\\<aa>[H1 = mk_Hq Hq2 H02 G2 pk2] \\<sqinter> \\<lbrakk>quantA1, Hin1, Hout1, Gin1, Gout1\\<rbrakk> \\<equiv>\\<qq> \n\\<lbrakk>quantA2, Hin2, Hout2, tmp_Gin2, tmp_Gout2\\<rbrakk> \\<sqinter> (comm_op\\<guillemotright>\\<lbrakk>Hin2, Gin2\\<rbrakk> \\<cdot> \\<top>))) \\<sqinter> \n(Uoracle G2\\<guillemotright>\\<lbrakk>Gin2, Gout2\\<rbrakk> \\<cdot> \\<top>))) \\<sqinter> (Uoracle (\\<lambda>(m, g). mk_Hq' Hq2 H02 g pk2 m)\\<guillemotright>variable_concat\n \\<lbrakk>Gin2, Gout2\\<rbrakk> \\<lbrakk>Hout2\\<rbrakk> \\<cdot> \\<top>))) \\<sqinter> (Uoracle G2\\<guillemotright>\\<lbrakk>Gin2, Gout2\\<rbrakk> \\<cdot> \\<top>))) \\<sqinter> (comm_op\\<guillemotright>\\<lbrakk>Hin2, Gin2\\<rbrakk> \\<cdot> \\<top>)))\"\n    (is \"Cla[?class] \\<sqinter> _ \\<sqinter> _ \\<le> ?post\")\n\n  sorry\n\n(*\nproof (cases ?class)\n  case True\n  (* define cla where \"cla = ((classA1, c1, K'1, b1, in_pk1, in_cstar1, Kstar1) = (classA2, c2, K'2, b2, in_pk2, in_cstar2, Kstar2) \\<and> G1 = G2 \\<and> H1 = (\\<lambda>m. Hq2 (encrT G2 pk2 m)) \\<and> Hq1 = Hq2 \\<and> cstar1 = adv_cstar2)\" *)\n  define h1 where \"h1 = Uoracle H1\\<guillemotright>\\<lbrakk>Hin1, Hout1\\<rbrakk>\"\n  define qeq where \"qeq = \\<lbrakk>quantA1, Hin1, Hout1, Gin1, Gout1\\<rbrakk> \\<equiv>\\<qq> \\<lbrakk>quantA2, Hin2, Hout2, tmp_Gin2, tmp_Gout2\\<rbrakk>\"\n  define ket0 where \"ket0 = Span {ket 0}\\<guillemotright>\\<lbrakk>Gout2\\<rbrakk>\"\n\n  obtain UoracleH where UoracleH1: \"Uoracle H1\\<guillemotright>\\<lbrakk>Hin1, Hout1\\<rbrakk> = UoracleH\\<guillemotright>\\<lbrakk>quantA1, Hin1, Hout1, Gin1, Gout1\\<rbrakk>\"\n    and UoracleH2: \"Uoracle H1\\<guillemotright>\\<lbrakk>Hin2, Hout2\\<rbrakk> = UoracleH\\<guillemotright>\\<lbrakk>quantA2, Hin2, Hout2, tmp_Gin2, tmp_Gout2\\<rbrakk>\"\n    apply (atomize_elim, rule exI)\n    apply (subst lift_extendL[symmetric, where Q=\"\\<lbrakk>Hin1, Hout1, Gin1, Gout1\\<rbrakk>\"], simp)\n    apply (subst lift_extendL[symmetric, where Q=\"\\<lbrakk>Hin2, Hout2, tmp_Gin2, tmp_Gout2\\<rbrakk>\"], simp)\n    apply (subst assoc_op_lift'[where Q=\"\\<lbrakk>Hin1\\<rbrakk>\"])\n    apply (subst assoc_op_lift'[where Q=\"\\<lbrakk>Hin2\\<rbrakk>\"])\n    apply (subst lift_extendR[symmetric, where Q=\"\\<lbrakk>Hin1, Hout1\\<rbrakk>\"], simp)\n    apply (subst lift_extendR[symmetric, where Q=\"\\<lbrakk>Hin2, Hout2\\<rbrakk>\"], simp)\n    by simp\n  have UoracleH_sa[simp]: \"UoracleH* = UoracleH\"\n    apply (subst lift_eqOp[symmetric, where Q=\"\\<lbrakk>quantA1, Hin1, Hout1, Gin1, Gout1\\<rbrakk>\"])\n    by (simp_all add: UoracleH1[symmetric] adjoint_lift[symmetric])\n  have unitary_UoracleH[simp]: \"unitary UoracleH\"\n    unfolding unitary_def apply simp\n    apply (subst lift_eqOp[symmetric, where Q=\"\\<lbrakk>quantA1, Hin1, Hout1, Gin1, Gout1\\<rbrakk>\"], simp)\n    by (simp flip: lift_timesOp UoracleH1, simp)\n  have move_Cla_up: \"unitary A \\<Longrightarrow> A \\<cdot> (Cla[X] \\<sqinter> S) = Cla[X] \\<sqinter> (A \\<cdot> S)\" for A X S\n    by simp\n\n  have conj_True: \"(True \\<and> True) = True\" by simp\n\n  have Cla_True': \"x = True \\<Longrightarrow> Cla[x] = top\" for x by simp\n\n  define comm1 UG2 UHq2\n    where \"comm1 = comm_op\\<guillemotright>\\<lbrakk>Hin2, Gin2\\<rbrakk>\"\n      (* and \"comm2 = comm_op\\<guillemotright>\\<lbrakk>Gout2, Gout2\\<rbrakk>\" *)\n      and \"UG2 = Uoracle G2\\<guillemotright>\\<lbrakk>Gin2, Gout2\\<rbrakk>\"\n      and \"UHq2 = Uoracle (\\<lambda>(m, g). mk_Hq' Hq2 H02 g pk2 m)\\<guillemotright>variable_concat \\<lbrakk>Gin2, Gout2\\<rbrakk> \\<lbrakk>Hout2\\<rbrakk>\"\n  (* Simplifier should be able to do this automatically, but runs too long *)\n  have post: \"?post = \n    ((comm1 \\<cdot> UG2 \\<cdot> UHq2 \\<cdot> UG2 \\<cdot> comm1)* \\<cdot> (qeq))\" (is \"_ = (applyOpSpace (?op* ) _)\")\n    unfolding comm1_def UG2_def UHq2_def\n    apply (subst Cla_True', simp add: True)+\n    apply (simp only: inf_top_left inf_top_right)\n    apply (subst unitary_image, simp)+\n    apply (simp only: inf_top_left inf_top_right)\n    apply (simp only: adjoint_lift adj_comm_op Uoracle_selfadjoint times_adjoint)\n    apply (simp only: timesOp_assoc_clinear_space[symmetric] timesOp_assoc[symmetric])\n    by (simp only: qeq_def)\n\n  have move: \"S \\<le> U* \\<cdot> T\" if \"U \\<cdot> S \\<le> T\" and [simp]: \"unitary U\" for T :: \"'z subspace\" and U and S :: \"'y subspace\"\n    using applyOpSpace_mono[OF that(1), where A=\"U*\"]\n    by (simp flip: timesOp_assoc_clinear_space)\n\n  let ?h2 = \"Uoracle H1\\<guillemotright>\\<lbrakk>Hin2, Hout2\\<rbrakk>\"\n\n  define Q where \"Q = \\<lbrakk>quantA1, quantA2, Hin1, Hout1, Gin1, Gout1, Hin2, Hout2, Gin2, Gout2, tmp_Gin2, tmp_Gout2\\<rbrakk>\"\n  have distinct_Q: \"distinct_qvars Q\"\n    unfolding Q_def by simp\n  have pred_local: \"predicate_local ((h1 \\<cdot> qeq) \\<sqinter> ket0) Q\" \n    unfolding qeq_def ket0_def Q_def h1_def by auto\n  have op_local: \"operator_local (comm1 \\<cdot> UG2 \\<cdot> UHq2 \\<cdot> UG2 \\<cdot> comm1) Q\" \n    unfolding Q_def comm1_def UG2_def UHq2_def by auto\n  have h1_local: \"operator_local (Uoracle H1\\<guillemotright>\\<lbrakk>Hin2, Hout2\\<rbrakk>) Q\"\n    unfolding Q_def by auto\n\n  let ?basis = \"{ket (a1,a2,hin1,hout1,gin1,gout1,hin2,hout2,gin2,0,qh_gin2,qh_gout2) | a1 a2 hin1 hout1 gin1 gout1 hin2 hout2 gin2 qh_gin2 qh_gout2. True}\"\n  have span_basis: \"liftSpace (Span ?basis) Q = ket0\"\n  proof -\n    have 1: \"Span ?basis \n      = Span (range ket) \\<otimes> Span (range ket) \\<otimes> Span (range ket) \\<otimes> Span (range ket) \\<comment> \\<open>a1,a2,hin1,hout1\\<close>\n       \\<otimes> Span (range ket) \\<otimes> Span (range ket) \\<otimes> Span (range ket) \\<otimes> Span (range ket) \\<comment> \\<open>gin1,gout1,hin2,hout2\\<close>\n       \\<otimes> Span (range ket) \\<otimes> Span {ket 0} \\<otimes> Span (range ket) \\<otimes> Span (range ket)\"\n      unfolding span_tensor\n      apply (auto simp: ket_product image_def simp flip: ex_simps(2))\n      by meson\n    have 2: \"\\<dots> \\<guillemotright> Q = ket0\"\n      unfolding ket0_def Q_def\n      by (auto simp: tensor_lift)\n    show ?thesis \n      unfolding 1 2 by simp\n  qed\n\n  have eq: \"applyOp ?op (lift_vector x Q \\<psi>') = applyOp ?h2 (lift_vector x Q \\<psi>')\" if \"x \\<in> ?basis\" and \"\\<psi>' \\<in> lift_rest Q\" for x \\<psi>'\n  proof -\n    from that obtain a1 a2 hin1 hout1 gin1 gout1 hin2 hout2 gin2 qh_gin2 qh_gout2\n      where x: \"x = ket (a1, a2, hin1, hout1, gin1, gout1, hin2, hout2, gin2, 0, qh_gin2, qh_gout2)\"\n      by auto\n\n    have \"comm1 \\<cdot> lift_vector x Q \\<psi>'\n       = lift_vector (ket (a1, a2, hin1, hout1, gin1, gout1, gin2, hout2, hin2, 0, qh_gin2, qh_gout2)) Q \\<psi>'\"\n      unfolding comm1_def \n      apply (rewrite at \"comm_op \\<guillemotright> _\" reorder_variables_hint_def[symmetric, where R=\"Q\"])\n      unfolding Q_def\n      using [[simp_depth_limit=80]] apply simp\n      by (simp add: x applyOp_lift times_applyOp ket_product tensorOp_applyOp_distr)\n\n    also have \"UG2 \\<cdot> \\<dots> = lift_vector (ket (a1, a2, hin1, hout1, gin1, gout1, gin2, hout2, hin2, G2 hin2, qh_gin2, qh_gout2)) Q \\<psi>'\"\n      unfolding UG2_def \n      apply (rewrite at \"Uoracle _ \\<guillemotright> _\" reorder_variables_hint_def[symmetric, where R=\"Q\"])\n      unfolding Q_def\n      using [[simp_depth_limit=80]] apply simp\n      apply (simp add: applyOp_lift times_applyOp ket_product tensorOp_applyOp_distr)\n      by -\n\n    also have \"UHq2 \\<cdot> \\<dots> = lift_vector (ket (a1, a2, hin1, hout1, gin1, gout1, gin2, hout2 + mk_Hq' Hq2 H02 (G2 hin2) pk2 hin2, hin2, G2 hin2, qh_gin2, qh_gout2)) Q \\<psi>'\"\n    (* also have \"UHq2 \\<cdot> \\<dots> = lift_vector (ket (a1, a2, hin1, hout1, gin1, gout1, gin2, hout2 + mk_Hq' Hq2 H02 (G2 hin2) pk2 hin2, hin2, G2 hin2, gout2)) Q \\<psi>'\" *)\n      unfolding UHq2_def \n      apply (rewrite at \"Uoracle _ \\<guillemotright> _\" reorder_variables_hint_def[symmetric, where R=\"Q\"])\n      unfolding Q_def\n      using [[simp_depth_limit=80]] apply simp\n      apply (simp add: applyOp_lift times_applyOp ket_product tensorOp_applyOp_distr)\n      apply (simp flip: ket_product)\n      apply (simp add: encrT_def applyOp_lift times_applyOp ket_product tensorOp_applyOp_distr)\n      by -\n\n    also have \"\\<dots> = lift_vector (ket (a1, a2, hin1, hout1, gin1, gout1, gin2, hout2 + H1 hin2, hin2, G2 hin2, qh_gin2, qh_gout2)) Q \\<psi>'\"\n    (* also have \"\\<dots> = lift_vector (ket (a1, a2, hin1, hout1, gin1, gout1, gin2, hout2 + H1 hin2, hin2, G2 hin2, gout2)) Q \\<psi>'\" *)\n      by (simp add: True mk_Hq_def mk_Hq'_def encrT_def msg_spaceT_def)\n\n    also have \"UG2 \\<cdot> \\<dots> = lift_vector (ket (a1, a2, hin1, hout1, gin1, gout1, gin2, hout2 + H1 hin2, hin2, 0, qh_gin2, qh_gout2)) Q \\<psi>'\"\n    (* also have \"UG2 \\<cdot> \\<dots> = lift_vector (ket (a1, a2, hin1, hout1, gin1, gout1, gin2, hout2 + H1 hin2, hin2, 0, gout2)) Q \\<psi>'\" *)\n      unfolding UG2_def \n      apply (rewrite at \"Uoracle _ \\<guillemotright> _\" reorder_variables_hint_def[symmetric, where R=\"Q\"])\n      unfolding Q_def\n      using [[simp_depth_limit=80]] apply simp\n      apply (simp add: applyOp_lift times_applyOp ket_product tensorOp_applyOp_distr)\n      by -\n\n    also have \"comm1 \\<cdot> \\<dots> = lift_vector (ket (a1, a2, hin1, hout1, gin1, gout1, hin2, hout2 + H1 hin2, gin2, 0, qh_gin2, qh_gout2)) Q \\<psi>'\"\n    (* also have \"comm1 \\<cdot> \\<dots> = lift_vector (ket (a1, a2, hin1, hout1, gin1, gout1, hin2, hout2 + H1 hin2, gin2, gout2, 0)) Q \\<psi>'\" *)\n      unfolding comm1_def \n      apply (rewrite at \"comm_op \\<guillemotright> _\" reorder_variables_hint_def[symmetric, where R=\"Q\"])\n      unfolding Q_def\n      using [[simp_depth_limit=80]] apply simp\n      by (simp add: applyOp_lift times_applyOp ket_product tensorOp_applyOp_distr)\n\n    also have \"\\<dots> = Uoracle H1\\<guillemotright>\\<lbrakk>Hin2, Hout2\\<rbrakk> \\<cdot> lift_vector x Q \\<psi>'\"\n      apply (rewrite at \"Uoracle _ \\<guillemotright> _\" reorder_variables_hint_def[symmetric, where R=\"Q\"])\n      unfolding Q_def\n      using [[simp_depth_limit=80]] apply simp\n      apply (simp add: x applyOp_lift times_applyOp ket_product tensorOp_applyOp_distr)\n      by -\n\n    finally show ?thesis\n      by (simp add: times_applyOp)\n  qed\n\n  have \"?op \\<cdot> (applyOpSpace h1 qeq \\<sqinter> ket0) = ?h2 \\<cdot> (applyOpSpace h1 qeq \\<sqinter> ket0)\"\n    using distinct_Q pred_local op_local h1_local \n    apply (rule applyOpSpace_eq'[where Q=Q and G=\"?basis\"])\n     apply (rule eq)\n      apply simp\n     apply simp\n    by (subst span_basis, simp)\n\n  also have \"\\<dots> \\<le> qeq\"\n    unfolding h1_def ket0_def qeq_def\n    unfolding  UoracleH1 UoracleH2 \n    by (simp del: UoracleH_sa)\n  finally have \"?op \\<cdot> (applyOpSpace h1 qeq \\<sqinter> ket0) \\<le> qeq\"\n    by assumption\n  then have \"applyOpSpace h1 qeq \\<sqinter> ket0 \\<le> ?op* \\<cdot> qeq\"\n    apply (rule move) by (simp add: comm1_def UG2_def UHq2_def)\n  then show ?thesis\n    apply (subst post) \n    apply (subst eqTrueI[OF True])\n    by (simp only: classical_true inf_top_left h1_def ket0_def qeq_def)\nnext\n  case False\n  show ?thesis\n    apply (simp only: False classical_false inf_bot_left)\n    by simp\nqed\n*)\n\nend\n", "meta": {"author": "dominique-unruh", "repo": "hksu-verification", "sha": "66b28f0e955bd54113eb316247208e94ec60be6a", "save_path": "github-repos/isabelle/dominique-unruh-hksu-verification", "path": "github-repos/isabelle/dominique-unruh-hksu-verification/hksu-verification-66b28f0e955bd54113eb316247208e94ec60be6a/FO_Proofs_Very_Slow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702761768249, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.31458026424802493}}
{"text": "(*  Title:      HOL/Auth/n_deadlock_lemma_inv__1_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_deadlock Protocol Case Study*}*) \n\ntheory n_deadlock_lemma_inv__1_on_rules imports n_deadlock_lemma_on_inv__1\nbegin\nsection{*All lemmas on causal relation between inv__1*}\nlemma lemma_inv__1_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__1  p__Inv3 p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_TryVsinv__1) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_CritVsinv__1) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_ExitVsinv__1) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_IdleVsinv__1) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_deadlock/n_deadlock_lemma_inv__1_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.7122321720225278, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.3145737241482345}}
{"text": "(*  Title:      HOL/Auth/Guard/Proto.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2002  University of Cambridge\n*)\n\nsection{*Other Protocol-Independent Results*}\n\ntheory Proto imports Guard_Public begin\n\nsubsection{*protocols*}\n\ntype_synonym rule = \"event set * event\"\n\nabbreviation\n  msg' :: \"rule => msg\" where\n  \"msg' R == msg (snd R)\"\n\ntype_synonym proto = \"rule set\"\n\ndefinition wdef :: \"proto => bool\" where\n\"wdef p == ALL R k. R:p --> Number k:parts {msg' R}\n--> Number k:parts (msg`(fst R))\"\n\nsubsection{*substitutions*}\n\nrecord subs =\n  agent   :: \"agent => agent\"\n  nonce :: \"nat => nat\"\n  nb    :: \"nat => msg\"\n  key   :: \"key => key\"\n\nprimrec apm :: \"subs => msg => msg\" where\n  \"apm s (Agent A) = Agent (agent s A)\"\n| \"apm s (Nonce n) = Nonce (nonce s n)\"\n| \"apm s (Number n) = nb s n\"\n| \"apm s (Key K) = Key (key s K)\"\n| \"apm s (Hash X) = Hash (apm s X)\"\n| \"apm s (Crypt K X) = (\nif (EX A. K = pubK A) then Crypt (pubK (agent s (agt K))) (apm s X)\nelse if (EX A. K = priK A) then Crypt (priK (agent s (agt K))) (apm s X)\nelse Crypt (key s K) (apm s X))\"\n| \"apm s {|X,Y|} = {|apm s X, apm s Y|}\"\n\nlemma apm_parts: \"X:parts {Y} ==> apm s X:parts {apm s Y}\"\napply (erule parts.induct, simp_all, blast)\napply (erule parts.Fst)\napply (erule parts.Snd)\nby (erule parts.Body)+\n\nlemma Nonce_apm [rule_format]: \"Nonce n:parts {apm s X} ==>\n(ALL k. Number k:parts {X} --> Nonce n ~:parts {nb s k}) -->\n(EX k. Nonce k:parts {X} & nonce s k = n)\"\nby (induct X, simp_all, blast)\n\nlemma wdef_Nonce: \"[| Nonce n:parts {apm s X}; R:p; msg' R = X; wdef p;\nNonce n ~:parts (apm s `(msg `(fst R))) |] ==>\n(EX k. Nonce k:parts {X} & nonce s k = n)\"\napply (erule Nonce_apm, unfold wdef_def)\napply (drule_tac x=R in spec, drule_tac x=k in spec, clarsimp simp: image_eq_UN)\napply (drule_tac x=x in bspec, simp)\napply (drule_tac Y=\"msg x\" and s=s in apm_parts, simp)\nby (blast dest: parts_parts)\n\nprimrec ap :: \"subs => event => event\" where\n  \"ap s (Says A B X) = Says (agent s A) (agent s B) (apm s X)\"\n| \"ap s (Gets A X) = Gets (agent s A) (apm s X)\"\n| \"ap s (Notes A X) = Notes (agent s A) (apm s X)\"\n\nabbreviation\n  ap' :: \"subs => rule => event\" where\n  \"ap' s R == ap s (snd R)\"\n\nabbreviation\n  apm' :: \"subs => rule => msg\" where\n  \"apm' s R == apm s (msg' R)\"\n\nabbreviation\n  priK' :: \"subs => agent => key\" where\n  \"priK' s A == priK (agent s A)\"\n\nabbreviation\n  pubK' :: \"subs => agent => key\" where\n  \"pubK' s A == pubK (agent s A)\"\n\nsubsection{*nonces generated by a rule*}\n\ndefinition newn :: \"rule => nat set\" where\n\"newn R == {n. Nonce n:parts {msg (snd R)} & Nonce n ~:parts (msg`(fst R))}\"\n\nlemma newn_parts: \"n:newn R ==> Nonce (nonce s n):parts {apm' s R}\"\nby (auto simp: newn_def dest: apm_parts)\n\nsubsection{*traces generated by a protocol*}\n\ndefinition ok :: \"event list => rule => subs => bool\" where\n\"ok evs R s == ((ALL x. x:fst R --> ap s x:set evs)\n& (ALL n. n:newn R --> Nonce (nonce s n) ~:used evs))\"\n\ninductive_set\n  tr :: \"proto => event list set\"\n  for p :: proto\nwhere\n\n  Nil [intro]: \"[]:tr p\"\n\n| Fake [intro]: \"[| evsf:tr p; X:synth (analz (spies evsf)) |]\n  ==> Says Spy B X # evsf:tr p\"\n\n| Proto [intro]: \"[| evs:tr p; R:p; ok evs R s |] ==> ap' s R # evs:tr p\"\n\nsubsection{*general properties*}\n\nlemma one_step_tr [iff]: \"one_step (tr p)\"\napply (unfold one_step_def, clarify)\nby (ind_cases \"ev # evs:tr p\" for ev evs, auto)\n\ndefinition has_only_Says' :: \"proto => bool\" where\n\"has_only_Says' p == ALL R. R:p --> is_Says (snd R)\"\n\nlemma has_only_Says'D: \"[| R:p; has_only_Says' p |]\n==> (EX A B X. snd R = Says A B X)\"\nby (unfold has_only_Says'_def is_Says_def, blast)\n\nlemma has_only_Says_tr [simp]: \"has_only_Says' p ==> has_only_Says (tr p)\"\napply (unfold has_only_Says_def)\napply (rule allI, rule allI, rule impI)\napply (erule tr.induct)\napply (auto simp: has_only_Says'_def ok_def)\nby (drule_tac x=a in spec, auto simp: is_Says_def)\n\nlemma has_only_Says'_in_trD: \"[| has_only_Says' p; list @ ev # evs1 \\<in> tr p |]\n==> (EX A B X. ev = Says A B X)\"\nby (drule has_only_Says_tr, auto)\n\nlemma ok_not_used: \"[| Nonce n ~:used evs; ok evs R s;\nALL x. x:fst R --> is_Says x |] ==> Nonce n ~:parts (apm s `(msg `(fst R)))\"\napply (unfold ok_def, clarsimp simp: image_eq_UN)\napply (drule_tac x=x in spec, drule_tac x=x in spec)\nby (auto simp: is_Says_def dest: Says_imp_spies not_used_not_spied parts_parts)\n\nlemma ok_is_Says: \"[| evs' @ ev # evs:tr p; ok evs R s; has_only_Says' p;\nR:p; x:fst R |] ==> is_Says x\"\napply (unfold ok_def is_Says_def, clarify)\napply (drule_tac x=x in spec, simp)\napply (subgoal_tac \"one_step (tr p)\")\napply (drule trunc, simp, drule one_step_Cons, simp)\napply (drule has_only_SaysD, simp+)\nby (clarify, case_tac x, auto)\n\nsubsection{*types*}\n\ntype_synonym keyfun = \"rule => subs => nat => event list => key set\"\n\ntype_synonym secfun = \"rule => nat => subs => key set => msg\"\n\nsubsection{*introduction of a fresh guarded nonce*}\n\ndefinition fresh :: \"proto => rule => subs => nat => key set => event list\n=> bool\" where\n\"fresh p R s n Ks evs == (EX evs1 evs2. evs = evs2 @ ap' s R # evs1\n& Nonce n ~:used evs1 & R:p & ok evs1 R s & Nonce n:parts {apm' s R}\n& apm' s R:guard n Ks)\"\n\nlemma freshD: \"fresh p R s n Ks evs ==> (EX evs1 evs2.\nevs = evs2 @ ap' s R # evs1 & Nonce n ~:used evs1 & R:p & ok evs1 R s\n& Nonce n:parts {apm' s R} & apm' s R:guard n Ks)\"\nby (unfold fresh_def, blast)\n\nlemma freshI [intro]: \"[| Nonce n ~:used evs1; R:p; Nonce n:parts {apm' s R};\nok evs1 R s; apm' s R:guard n Ks |]\n==> fresh p R s n Ks (list @ ap' s R # evs1)\"\nby (unfold fresh_def, blast)\n\nlemma freshI': \"[| Nonce n ~:used evs1; (l,r):p;\nNonce n:parts {apm s (msg r)}; ok evs1 (l,r) s; apm s (msg r):guard n Ks |]\n==> fresh p (l,r) s n Ks (evs2 @ ap s r # evs1)\"\nby (drule freshI, simp+)\n\nlemma fresh_used: \"[| fresh p R' s' n Ks evs; has_only_Says' p |]\n==> Nonce n:used evs\"\napply (unfold fresh_def, clarify)\napply (drule has_only_Says'D)\nby (auto intro: parts_used_app)\n\nlemma fresh_newn: \"[| evs' @ ap' s R # evs:tr p; wdef p; has_only_Says' p;\nNonce n ~:used evs; R:p; ok evs R s; Nonce n:parts {apm' s R} |]\n==> EX k. k:newn R & nonce s k = n\"\napply (drule wdef_Nonce, simp+)\napply (frule ok_not_used, simp+)\napply (clarify, erule ok_is_Says, simp+)\napply (clarify, rule_tac x=k in exI, simp add: newn_def image_eq_UN)\napply (clarify, drule_tac Y=\"msg x\" and s=s in apm_parts)\napply (drule ok_not_used, simp+)\nby (clarify, erule ok_is_Says, simp_all add: image_eq_UN)\n\nlemma fresh_rule: \"[| evs' @ ev # evs:tr p; wdef p; Nonce n ~:used evs;\nNonce n:parts {msg ev} |] ==> EX R s. R:p & ap' s R = ev\"\napply (drule trunc, simp, ind_cases \"ev # evs:tr p\", simp)\nby (drule_tac x=X in in_sub, drule parts_sub, simp, simp, blast+)\n\nlemma fresh_ruleD: \"[| fresh p R' s' n Ks evs; keys R' s' n evs <= Ks; wdef p;\nhas_only_Says' p; evs:tr p; ALL R k s. nonce s k = n --> Nonce n:used evs -->\nR:p --> k:newn R --> Nonce n:parts {apm' s R} --> apm' s R:guard n Ks -->\napm' s R:parts (spies evs) --> keys R s n evs <= Ks --> P |] ==> P\"\napply (frule fresh_used, simp)\napply (unfold fresh_def, clarify)\napply (drule_tac x=R' in spec)\napply (drule fresh_newn, simp+, clarify)\napply (drule_tac x=k in spec)\napply (drule_tac x=s' in spec)\napply (subgoal_tac \"apm' s' R':parts (spies (evs2 @ ap' s' R' # evs1))\")\napply (case_tac R', drule has_only_Says'D, simp, clarsimp)\napply (case_tac R', drule has_only_Says'D, simp, clarsimp)\napply (rule_tac Y=\"apm s' X\" in parts_parts, blast)\nby (rule parts.Inj, rule Says_imp_spies, simp, blast)\n\nsubsection{*safe keys*}\n\ndefinition safe :: \"key set => msg set => bool\" where\n\"safe Ks G == ALL K. K:Ks --> Key K ~:analz G\"\n\nlemma safeD [dest]: \"[| safe Ks G; K:Ks |] ==> Key K ~:analz G\"\nby (unfold safe_def, blast)\n\nlemma safe_insert: \"safe Ks (insert X G) ==> safe Ks G\"\nby (unfold safe_def, blast)\n\nlemma Guard_safe: \"[| Guard n Ks G; safe Ks G |] ==> Nonce n ~:analz G\"\nby (blast dest: Guard_invKey)\n\nsubsection{*guardedness preservation*}\n\ndefinition preserv :: \"proto => keyfun => nat => key set => bool\" where\n\"preserv p keys n Ks == (ALL evs R' s' R s. evs:tr p -->\nGuard n Ks (spies evs) --> safe Ks (spies evs) --> fresh p R' s' n Ks evs -->\nkeys R' s' n evs <= Ks --> R:p --> ok evs R s --> apm' s R:guard n Ks)\"\n\nlemma preservD: \"[| preserv p keys n Ks; evs:tr p; Guard n Ks (spies evs);\nsafe Ks (spies evs); fresh p R' s' n Ks evs; R:p; ok evs R s;\nkeys R' s' n evs <= Ks |] ==> apm' s R:guard n Ks\"\nby (unfold preserv_def, blast)\n\nlemma preservD': \"[| preserv p keys n Ks; evs:tr p; Guard n Ks (spies evs);\nsafe Ks (spies evs); fresh p R' s' n Ks evs; (l,Says A B X):p;\nok evs (l,Says A B X) s; keys R' s' n evs <= Ks |] ==> apm s X:guard n Ks\"\nby (drule preservD, simp+)\n\nsubsection{*monotonic keyfun*}\n\ndefinition monoton :: \"proto => keyfun => bool\" where\n\"monoton p keys == ALL R' s' n ev evs. ev # evs:tr p -->\nkeys R' s' n evs <= keys R' s' n (ev # evs)\"\n\nlemma monotonD [dest]: \"[| keys R' s' n (ev # evs) <= Ks; monoton p keys;\nev # evs:tr p |] ==> keys R' s' n evs <= Ks\"\nby (unfold monoton_def, blast)\n\nsubsection{*guardedness theorem*}\n\nlemma Guard_tr [rule_format]: \"[| evs:tr p; has_only_Says' p;\npreserv p keys n Ks; monoton p keys; Guard n Ks (initState Spy) |] ==>\nsafe Ks (spies evs) --> fresh p R' s' n Ks evs --> keys R' s' n evs <= Ks -->\nGuard n Ks (spies evs)\"\napply (erule tr.induct)\n(* Nil *)\napply simp\n(* Fake *)\napply (clarify, drule freshD, clarsimp)\napply (case_tac evs2)\n(* evs2 = [] *)\napply (frule has_only_Says'D, simp)\napply (clarsimp, blast)\n(* evs2 = aa # list *)\napply (clarsimp, rule conjI)\napply (blast dest: safe_insert)\n(* X:guard n Ks *)\napply (rule in_synth_Guard, simp, rule Guard_analz)\napply (blast dest: safe_insert)\napply (drule safe_insert, simp add: safe_def)\n(* Proto *)\napply (clarify, drule freshD, clarify)\napply (case_tac evs2)\n(* evs2 = [] *)\napply (frule has_only_Says'D, simp)\napply (frule_tac R=R' in has_only_Says'D, simp)\napply (case_tac R', clarsimp, blast)\n(* evs2 = ab # list *)\napply (frule has_only_Says'D, simp)\napply (clarsimp, rule conjI)\napply (drule Proto, simp+, blast dest: safe_insert)\n(* apm s X:guard n Ks *)\napply (frule Proto, simp+)\napply (erule preservD', simp+)\napply (blast dest: safe_insert)\napply (blast dest: safe_insert)\nby (blast, simp, simp, blast)\n\nsubsection{*useful properties for guardedness*}\n\nlemma newn_neq_used: \"[| Nonce n:used evs; ok evs R s; k:newn R |]\n==> n ~= nonce s k\"\nby (auto simp: ok_def)\n\nlemma ok_Guard: \"[| ok evs R s; Guard n Ks (spies evs); x:fst R; is_Says x |]\n==> apm s (msg x):parts (spies evs) & apm s (msg x):guard n Ks\"\napply (unfold ok_def is_Says_def, clarify)\napply (drule_tac x=\"Says A B X\" in spec, simp)\nby (drule Says_imp_spies, auto intro: parts_parts)\n\nlemma ok_parts_not_new: \"[| Y:parts (spies evs); Nonce (nonce s n):parts {Y};\nok evs R s |] ==> n ~:newn R\"\nby (auto simp: ok_def dest: not_used_not_spied parts_parts)\n\nsubsection{*unicity*}\n\ndefinition uniq :: \"proto => secfun => bool\" where\n\"uniq p secret == ALL evs R R' n n' Ks s s'. R:p --> R':p -->\nn:newn R --> n':newn R' --> nonce s n = nonce s' n' -->\nNonce (nonce s n):parts {apm' s R} --> Nonce (nonce s n):parts {apm' s' R'} -->\napm' s R:guard (nonce s n) Ks --> apm' s' R':guard (nonce s n) Ks -->\nevs:tr p --> Nonce (nonce s n) ~:analz (spies evs) -->\nsecret R n s Ks:parts (spies evs) --> secret R' n' s' Ks:parts (spies evs) -->\nsecret R n s Ks = secret R' n' s' Ks\"\n\nlemma uniqD: \"[| uniq p secret; evs: tr p; R:p; R':p; n:newn R; n':newn R';\nnonce s n = nonce s' n'; Nonce (nonce s n) ~:analz (spies evs);\nNonce (nonce s n):parts {apm' s R}; Nonce (nonce s n):parts {apm' s' R'};\nsecret R n s Ks:parts (spies evs); secret R' n' s' Ks:parts (spies evs);\napm' s R:guard (nonce s n) Ks; apm' s' R':guard (nonce s n) Ks |] ==>\nsecret R n s Ks = secret R' n' s' Ks\"\nby (unfold uniq_def, blast)\n\ndefinition ord :: \"proto => (rule => rule => bool) => bool\" where\n\"ord p inff == ALL R R'. R:p --> R':p --> ~ inff R R' --> inff R' R\"\n\nlemma ordD: \"[| ord p inff; ~ inff R R'; R:p; R':p |] ==> inff R' R\"\nby (unfold ord_def, blast)\n\ndefinition uniq' :: \"proto => (rule => rule => bool) => secfun => bool\" where\n\"uniq' p inff secret == ALL evs R R' n n' Ks s s'. R:p --> R':p -->\ninff R R' --> n:newn R --> n':newn R' --> nonce s n = nonce s' n' -->\nNonce (nonce s n):parts {apm' s R} --> Nonce (nonce s n):parts {apm' s' R'} -->\napm' s R:guard (nonce s n) Ks --> apm' s' R':guard (nonce s n) Ks -->\nevs:tr p --> Nonce (nonce s n) ~:analz (spies evs) -->\nsecret R n s Ks:parts (spies evs) --> secret R' n' s' Ks:parts (spies evs) -->\nsecret R n s Ks = secret R' n' s' Ks\"\n\nlemma uniq'D: \"[| uniq' p inff secret; evs: tr p; inff R R'; R:p; R':p; n:newn R;\nn':newn R'; nonce s n = nonce s' n'; Nonce (nonce s n) ~:analz (spies evs);\nNonce (nonce s n):parts {apm' s R}; Nonce (nonce s n):parts {apm' s' R'};\nsecret R n s Ks:parts (spies evs); secret R' n' s' Ks:parts (spies evs);\napm' s R:guard (nonce s n) Ks; apm' s' R':guard (nonce s n) Ks |] ==>\nsecret R n s Ks = secret R' n' s' Ks\"\nby (unfold uniq'_def, blast)\n\nlemma uniq'_imp_uniq: \"[| uniq' p inff secret; ord p inff |] ==> uniq p secret\"\napply (unfold uniq_def)\napply (rule allI)+\napply (case_tac \"inff R R'\")\napply (blast dest: uniq'D)\nby (auto dest: ordD uniq'D intro: sym)\n\nsubsection{*Needham-Schroeder-Lowe*}\n\ndefinition a :: agent where \"a == Friend 0\"\ndefinition b :: agent where \"b == Friend 1\"\ndefinition a' :: agent where \"a' == Friend 2\"\ndefinition b' :: agent where \"b' == Friend 3\"\ndefinition Na :: nat where \"Na == 0\"\ndefinition Nb :: nat where \"Nb == 1\"\n\nabbreviation\n  ns1 :: rule where\n  \"ns1 == ({}, Says a b (Crypt (pubK b) {|Nonce Na, Agent a|}))\"\n\nabbreviation\n  ns2 :: rule where\n  \"ns2 == ({Says a' b (Crypt (pubK b) {|Nonce Na, Agent a|})},\n    Says b a (Crypt (pubK a) {|Nonce Na, Nonce Nb, Agent b|}))\"\n\nabbreviation\n  ns3 :: rule where\n  \"ns3 == ({Says a b (Crypt (pubK b) {|Nonce Na, Agent a|}),\n    Says b' a (Crypt (pubK a) {|Nonce Na, Nonce Nb, Agent b|})},\n    Says a b (Crypt (pubK b) (Nonce Nb)))\"\n\ninductive_set ns :: proto where\n  [iff]: \"ns1:ns\"\n| [iff]: \"ns2:ns\"\n| [iff]: \"ns3:ns\"\n\nabbreviation (input)\n  ns3a :: event where\n  \"ns3a == Says a b (Crypt (pubK b) {|Nonce Na, Agent a|})\"\n\nabbreviation (input)\n  ns3b :: event where\n  \"ns3b == Says b' a (Crypt (pubK a) {|Nonce Na, Nonce Nb, Agent b|})\"\n\ndefinition keys :: \"keyfun\" where\n\"keys R' s' n evs == {priK' s' a, priK' s' b}\"\n\nlemma \"monoton ns keys\"\nby (simp add: keys_def monoton_def)\n\ndefinition secret :: \"secfun\" where\n\"secret R n s Ks ==\n(if R=ns1 then apm s (Crypt (pubK b) {|Nonce Na, Agent a|})\nelse if R=ns2 then apm s (Crypt (pubK a) {|Nonce Na, Nonce Nb, Agent b|})\nelse Number 0)\"\n\ndefinition inf :: \"rule => rule => bool\" where\n\"inf R R' == (R=ns1 | (R=ns2 & R'~=ns1) | (R=ns3 & R'=ns3))\"\n\nlemma inf_is_ord [iff]: \"ord ns inf\"\napply (unfold ord_def inf_def)\napply (rule allI)+\napply (rule impI)\napply (simp add: split_paired_all)\nby (rule impI, erule ns.cases, simp_all)+\n\nsubsection{*general properties*}\n\nlemma ns_has_only_Says' [iff]: \"has_only_Says' ns\"\napply (unfold has_only_Says'_def)\napply (rule allI, rule impI)\napply (simp add: split_paired_all)\nby (erule ns.cases, auto)\n\nlemma newn_ns1 [iff]: \"newn ns1 = {Na}\"\nby (simp add: newn_def)\n\nlemma newn_ns2 [iff]: \"newn ns2 = {Nb}\"\nby (auto simp: newn_def Na_def Nb_def)\n\nlemma newn_ns3 [iff]: \"newn ns3 = {}\"\nby (auto simp: newn_def)\n\nlemma ns_wdef [iff]: \"wdef ns\"\nby (auto simp: wdef_def elim: ns.cases)\n\nsubsection{*guardedness for NSL*}\n\nlemma \"uniq ns secret ==> preserv ns keys n Ks\"\napply (unfold preserv_def)\napply (rule allI)+\napply (rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule fresh_ruleD, simp, simp, simp, simp)\napply (rule allI)+\napply (rule impI, rule impI, rule impI)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* fresh with NS1 *)\napply (rule impI, rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule ns.cases)\n(* NS1 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (rule No_Nonce, simp)\n(* NS2 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (case_tac \"nonce sa Na = nonce s Na\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s b\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns1 and R'=ns1 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def keys_def, blast)\napply (rule No_Nonce, simp)\n(* NS3 *)\napply clarsimp\napply (case_tac \"nonce sa Na = nonce s Nb\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule_tac x=ns3b in ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s a\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns1 and R'=ns2 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def, rule No_Nonce, simp)\n(* fresh with NS2 *)\napply (rule impI, rule impI, rule impI, rule impI, rule impI, rule impI)\napply (erule ns.cases)\n(* NS1 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (rule No_Nonce, simp)\n(* NS2 *)\napply clarsimp\napply (frule newn_neq_used, simp, simp)\napply (case_tac \"nonce sa Nb = nonce s Na\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s b\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns2 and R'=ns1 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def, rule No_Nonce, simp)\n(* NS3 *)\napply clarsimp\napply (case_tac \"nonce sa Nb = nonce s Nb\")\napply (frule Guard_safe, simp)\napply (frule Crypt_guard_invKey, simp)\napply (frule_tac x=ns3b in ok_Guard, simp, simp, simp, clarsimp)\napply (frule_tac K=\"pubK' s a\" in Crypt_guard_invKey, simp)\napply (frule_tac R=ns2 and R'=ns2 and Ks=Ks and s=sa and s'=s in uniqD, simp+)\napply (simp add: secret_def, simp add: secret_def, force, force)\napply (simp add: secret_def keys_def, blast)\napply (rule No_Nonce, simp)\n(* fresh with NS3 *)\nby simp\n\nsubsection{*unicity for NSL*}\n\nlemma \"uniq' ns inf secret\"\napply (unfold uniq'_def)\napply (rule allI)+\napply (simp add: split_paired_all)\napply (rule impI, erule ns.cases)\n(* R = ns1 *)\napply (rule impI, erule ns.cases)\n(* R' = ns1 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule Crypt_insert_synth, simp, simp, simp)\napply (drule Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (clarify, simp add: secret_def)\napply (erule disjE, erule disjE, clarsimp)\napply (drule ok_parts_not_new, simp, simp, simp)\napply (clarify, drule ok_parts_not_new, simp, simp, simp)\n(* ns2 *)\napply (simp add: secret_def)\n(* ns3 *)\napply (simp add: secret_def)\n(* R' = ns2 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule Crypt_insert_synth, simp, simp, simp)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (clarify, simp add: secret_def)\napply (drule_tac s=sa and n=Na in ok_parts_not_new, simp, simp, simp)\n(* ns2 *)\napply (clarify, simp add: secret_def)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\n(* ns3 *)\napply (simp add: secret_def)\n(* R' = ns3 *)\napply simp\n(* R = ns2 *)\napply (rule impI, erule ns.cases)\n(* R' = ns1 *)\napply (simp only: inf_def, blast)\n(* R' = ns2 *)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, rule impI, rule impI, rule impI)\napply (rule impI, erule tr.induct)\n(* Nil *)\napply (simp add: secret_def)\n(* Fake *)\napply (clarify, simp add: secret_def)\napply (drule notin_analz_insert)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp)\napply (drule_tac n=\"nonce s' Nb\" in Crypt_insert_synth, simp, simp, simp, simp)\n(* Proto *)\napply (erule_tac P=\"ok evsa R sa\" in rev_mp)\napply (simp add: split_paired_all)\napply (erule ns.cases)\n(* ns1 *)\napply (simp add: secret_def)\n(* ns2 *)\napply (clarify, simp add: secret_def)\napply (erule disjE, erule disjE, clarsimp, clarsimp)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\napply (erule disjE, clarsimp)\napply (drule_tac s=sa and n=Nb in ok_parts_not_new, simp, simp, simp)\nby (simp_all add: secret_def)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/Guard/Proto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.596433160611502, "lm_q2_score": 0.5273165233795672, "lm_q1q2_score": 0.3145090606819443}}
{"text": "theory StackCorrectness\nimports StackConversion \"../01Expression/02SmallStep/SmallStepEvaluate\" \"../Utilities/Iterate\"\nbegin\n\nlemma complete': \"e \\<leadsto> e' \\<Longrightarrow> unstack_state rs \\<Sigma> = e \\<Longrightarrow> \\<exists>\\<Sigma>'. \\<Sigma> \\<leadsto>\\<^sub>s \\<Sigma>' \\<and> unstack_state rs \\<Sigma>' = e'\"\n  proof (induction e e' rule: evaluate.induct) \n  case (ev_app1 e\\<^sub>1 e\\<^sub>1' e\\<^sub>2)\n    thus ?case by simp \n  next case ev_app2 \n    thus ?case by simp \n  next case ev_app_let\n    thus ?case by simp \n  next case ev_let1\n    thus ?case by simp \n  next case ev_let2\n    thus ?case by simp \n  next case ev_let3\n    thus ?case by simp \n  next case ev_proj1\n    thus ?case by simp \n  next case ev_proj2 \n    thus ?case by simp \n  next case ev_proj_let\n    thus ?case by simp \n  next case ev_case1 \n    thus ?case by simp \n  next case ev_case2\n    thus ?case by simp \n  next case ev_case_let\n    thus ?case by simp \n  next case ev_unfold1\n    thus ?case by simp \n  next case ev_unfold2\n    thus ?case by simp \n  next case ev_unfold_let\n    thus ?case by simp \n  next case ev_tyapp1\n    thus ?case by simp \n  next case ev_tyapp2\n    thus ?case by simp \n  next case ev_tyapp_let\n    thus ?case by simp \n  next case ev_tylet\n    thus ?case by simp \n  qed \n\nlemma complete: \"iter (op \\<leadsto>) e e' \\<Longrightarrow> unstack_state rs \\<Sigma> = e \\<Longrightarrow>\n    \\<exists>\\<Sigma>'. iter (op \\<leadsto>\\<^sub>s) \\<Sigma> \\<Sigma>' \\<and> unstack_state rs \\<Sigma>' = e'\"\n  proof (induction e e' arbitrary: \\<Sigma> rule: iter.induct)\n  case iter_refl\n    thus ?case by (metis iter.iter_refl)\n  next case (iter_step e e' e'')\n    then obtain \\<Sigma>' where \"\\<Sigma> \\<leadsto>\\<^sub>s \\<Sigma>' \\<and> unstack_state rs \\<Sigma>' = e'\" by (metis complete')\n    moreover with iter_step obtain \\<Sigma>'' where \"iter (op \\<leadsto>\\<^sub>s) \\<Sigma>' \\<Sigma>'' \\<and> unstack_state rs \\<Sigma>'' = e''\" \n      by fastforce\n    ultimately have \"iter (op \\<leadsto>\\<^sub>s) \\<Sigma> \\<Sigma>'' \\<and> unstack_state rs \\<Sigma>'' = e''\" by fastforce\n    thus ?case by fastforce\n  qed\n\nlemma sound': \"\\<Sigma> \\<leadsto>\\<^sub>s \\<Sigma>' \\<Longrightarrow> unstack_state rs \\<Sigma> = e \\<Longrightarrow> \n    \\<exists>rs' e'. unstack_state rs' \\<Sigma>' = e' \\<and> (e \\<leadsto> e' \\<or> e = e')\"\n  proof (induction \\<Sigma> \\<Sigma>' arbitrary: e rule: EvaluateStack.evaluate.induct)\n  case (ev_var x s h)\n    hence \"unstack rs s (Var x) h = e\" by simp\n\n\n    have \"e \\<leadsto> unstack rs' (SRef x # s) (lookup\\<^sub>h h x) h \\<or> \n      e = unstack rs' (SRef x # s) (lookup\\<^sub>h h x) h\" by simp\n    thus ?case by fastforce\n  next case (ev_abs t e\\<^sub>1 s h)\n    hence \"unstack rs s (Abs t e\\<^sub>1) h = e\" by simp\n    thus ?case by fastforce\n  next case (ev_app e\\<^sub>1 e\\<^sub>2 s h)\n    hence \"unstack ([] # rs) (SApp e\\<^sub>2 # s) e\\<^sub>1 h = e\" by simp\n    thus ?case by fastforce\n  next case (ev_let e\\<^sub>1 e\\<^sub>2 s h)\n    hence \"unstack rs s (Let e\\<^sub>1 e\\<^sub>2) h = e\" by simp\n\n\n    have \"e \\<leadsto> unstack rs' s (subst\\<^sub>x\\<^sub>e 0 (length\\<^sub>h h) e\\<^sub>2) (extend\\<^sub>h h e\\<^sub>1) \\<or>\n      unstack rs' s (subst\\<^sub>x\\<^sub>e 0 (length\\<^sub>h h) e\\<^sub>2) (extend\\<^sub>h h e\\<^sub>1) = e\" by simp\n    thus ?case by fastforce\n  next case (ev_rec xs s h)\n    hence \"unstack rs s (Rec xs) h = e\" by simp\n    thus ?case by fastforce\n  next case (ev_proj e\\<^sub>1 l s h)\n    hence \"unstack ([] # rs) (SProj l # s) e\\<^sub>1 h = e\" by simp\n    thus ?case by fastforce\n  next case (ev_inj l ts x s h)\n    hence \"unstack rs s (Inj l ts x) h = e\" by simp\n    thus ?case by fastforce\n  next case (ev_case e\\<^sub>1 t cs s h)\n    hence \"unstack ([] # rs) (SCase t cs # s) e\\<^sub>1 h = e\" by simp\n    thus ?case by fastforce\n  next case (ev_fold t x s h) \n    hence \"unstack rs s (Fold t x) h = e\" by simp\n    thus ?case by fastforce\n  next case (ev_unfold t e\\<^sub>1 s h) \n    hence \"unstack ([] # rs) (SUnfold t # s) e\\<^sub>1 h = e\" by simp\n    thus ?case by fastforce\n  next case (ev_tyabs k e\\<^sub>1 s h)\n    hence \"unstack rs s (TyAbs k e\\<^sub>1) h = e\" by simp\n    thus ?case by fastforce\n  next case (ev_tyapp e\\<^sub>1 t s h)\n    hence \"unstack ([] # rs) (STyApp t # s) e\\<^sub>1 h = e\" by simp\n    thus ?case by fastforce\n  next case (ev_tylet t e\\<^sub>1 s h)\n    hence \"unstack rs s (TyLet t e\\<^sub>1) h = e\" by simp\n\n    have \"e \\<leadsto> unstack rs' s (subst\\<^sub>t\\<^sub>e 0 t e\\<^sub>1) h \\<or> e = unstack rs' s (subst\\<^sub>t\\<^sub>e 0 t e\\<^sub>1) h\" by simp\n    thus ?case by fastforce\n  next case ret_ref \n    thus ?case by simp\n  next case ret_app \n    thus ?case by simp\n  next case ret_proj \n    thus ?case by simp\n  next case ret_case \n    thus ?case by simp\n  next case ret_unfold \n    thus ?case by simp\n  next case ret_tyapp \n    thus ?case by simp\n  qed \n\nlemma sound: \"iter (op \\<leadsto>\\<^sub>s) \\<Sigma> \\<Sigma>' \\<Longrightarrow> unstack_state rs \\<Sigma> = e \\<Longrightarrow> \n    \\<exists>rs'. iter (op \\<leadsto>) e (unstack_state rs' \\<Sigma>')\"\n  proof (induction \\<Sigma> \\<Sigma>' arbitrary: e rs rule: iter.induct)\n  case (iter_refl \\<Sigma>)\n    moreover have \"iter (op \\<leadsto>) (unstack_state rs \\<Sigma>) (unstack_state rs \\<Sigma>)\" by simp\n    ultimately show ?case by fastforce\n  next case (iter_step \\<Sigma> \\<Sigma>' \\<Sigma>'')\n    then obtain rs' e' where \"unstack_state rs' \\<Sigma>' = e' \\<and> (e \\<leadsto> e' \\<or> e = e')\" by (metis sound')\n    moreover with iter_step obtain rs'' where \"iter (op \\<leadsto>) e' (unstack_state rs'' \\<Sigma>'')\" by fastforce\n    ultimately have \"iter (op \\<leadsto>) e (unstack_state rs'' \\<Sigma>'')\" by fastforce\n    thus ?case by fastforce\n  qed\n\nend", "meta": {"author": "xtreme-james-cooper", "repo": "LazyCompiler", "sha": "3b95c3550e0cce4966aaf45c7eb38f2cbc2bfbfa", "save_path": "github-repos/isabelle/xtreme-james-cooper-LazyCompiler", "path": "github-repos/isabelle/xtreme-james-cooper-LazyCompiler/LazyCompiler-3b95c3550e0cce4966aaf45c7eb38f2cbc2bfbfa/02Stack/StackCorrectness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5273165233795672, "lm_q1q2_score": 0.3145090531165992}}
{"text": "(*  Title:      JinjaThreads/Framework/LTS.thy\n    Author:     Andreas Lochbihler\n*)\n\nsection \\<open>Labelled transition systems\\<close>\n\ntheory LTS\nimports\n  \"../Basic/Auxiliary\"\n  Coinductive.TLList\nbegin\n\nno_notation floor (\"\\<lfloor>_\\<rfloor>\")\n\nlemma rel_option_mono:\n  \"\\<lbrakk> rel_option R x y; \\<And>x y. R x y \\<Longrightarrow> R' x y \\<rbrakk> \\<Longrightarrow> rel_option R' x y\"\nby(cases x)(case_tac [!] y, auto)\n\nlemma nth_concat_conv:\n  \"n < length (concat xss) \n   \\<Longrightarrow> \\<exists>m n'. concat xss ! n = (xss ! m) ! n' \\<and> n' < length (xss ! m) \\<and> \n             m < length xss \\<and> n = (\\<Sum>i<m. length (xss ! i)) + n'\"\nusing lnth_lconcat_conv[of n \"llist_of (map llist_of xss)\"]\n  sum_hom[where f = enat and h = \"\\<lambda>i. length (xss ! i)\"]\nby(clarsimp simp add: lconcat_llist_of zero_enat_def[symmetric]) blast\n\n\ndefinition flip :: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'c) \\<Rightarrow> 'b \\<Rightarrow> 'a \\<Rightarrow> 'c\"\nwhere \"flip f = (\\<lambda>b a. f a b)\"\n\ntext \\<open>Create a dynamic list \\<open>flip_simps\\<close> of theorems for flip\\<close>\nML \\<open>\nstructure FlipSimpRules = Named_Thms\n(\n  val name = @{binding flip_simps}\n  val description = \"Simplification rules for flip in bisimulations\"\n)\n\\<close>\nsetup \\<open>FlipSimpRules.setup\\<close>\n\nlemma flip_conv [flip_simps]: \"flip f b a = f a b\"\nby(simp add: flip_def)\n\nlemma flip_flip [flip_simps, simp]: \"flip (flip f) = f\"\nby(simp add: flip_def)\n\nlemma list_all2_flip [flip_simps]: \"list_all2 (flip P) xs ys = list_all2 P ys xs\"\nunfolding flip_def list_all2_conv_all_nth by auto\n\nlemma llist_all2_flip [flip_simps]: \"llist_all2 (flip P) xs ys = llist_all2 P ys xs\"\nunfolding flip_def llist_all2_conv_all_lnth by auto\n\nlemma rtranclp_flipD:\n  assumes \"(flip r)^** x y\"\n  shows \"r^** y x\" \nusing assms\nby(induct rule: rtranclp_induct)(auto intro: rtranclp.rtrancl_into_rtrancl simp add: flip_conv)\n\n\n\nlemma rel_prod_flip [flip_simps]:\n  \"rel_prod (flip R) (flip S) = flip (rel_prod R S)\"\nby(auto intro!: ext simp add: flip_def)\n\nlemma rel_option_flip [flip_simps]:\n  \"rel_option (flip R) = flip (rel_option R)\"\nby(simp add: fun_eq_iff rel_option_iff flip_def)\n\nlemma tllist_all2_flip [flip_simps]:\n  \"tllist_all2 (flip P) (flip Q) xs ys \\<longleftrightarrow> tllist_all2 P Q ys xs\"\nproof\n  assume \"tllist_all2 (flip P) (flip Q) xs ys\"\n  thus \"tllist_all2 P Q ys xs\"\n    by(coinduct rule: tllist_all2_coinduct)(auto dest: tllist_all2_is_TNilD tllist_all2_tfinite2_terminalD tllist_all2_thdD intro: tllist_all2_ttlI simp add: flip_def)\nnext\n  assume \"tllist_all2 P Q ys xs\"\n  thus \"tllist_all2 (flip P) (flip Q) xs ys\"\n    by(coinduct rule: tllist_all2_coinduct)(auto dest: tllist_all2_is_TNilD tllist_all2_tfinite2_terminalD tllist_all2_thdD intro: tllist_all2_ttlI simp add: flip_def)\nqed\n\nsubsection \\<open>Labelled transition systems\\<close>\n\ntype_synonym ('a, 'b) trsys = \"'a \\<Rightarrow> 'b \\<Rightarrow> 'a \\<Rightarrow> bool\"\n\nlocale trsys = \n  fixes trsys :: \"('s, 'tl) trsys\" (\"_/ -_\\<rightarrow>/ _\" [50, 0, 50] 60)\nbegin\n\nabbreviation Trsys :: \"('s, 'tl list) trsys\" (\"_/ -_\\<rightarrow>*/ _\" [50,0,50] 60)\nwhere \"\\<And>tl. s -tl\\<rightarrow>* s' \\<equiv> rtrancl3p trsys s tl s'\"\n\ncoinductive inf_step :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> bool\" (\"_ -_\\<rightarrow>* \\<infinity>\" [50, 0] 80)\nwhere inf_stepI: \"\\<lbrakk> trsys a b a'; a' -bs\\<rightarrow>* \\<infinity> \\<rbrakk> \\<Longrightarrow> a -LCons b bs\\<rightarrow>* \\<infinity>\"\n\ncoinductive inf_step_table :: \"'s \\<Rightarrow> ('s \\<times> 'tl \\<times> 's) llist \\<Rightarrow> bool\" (\"_ -_\\<rightarrow>*t \\<infinity>\" [50, 0] 80)\nwhere \n  inf_step_tableI:\n  \"\\<And>tl. \\<lbrakk> trsys s tl s'; s' -stls\\<rightarrow>*t \\<infinity> \\<rbrakk> \n  \\<Longrightarrow> s -LCons (s, tl, s') stls\\<rightarrow>*t \\<infinity>\"\n\ndefinition inf_step2inf_step_table :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> ('s \\<times> 'tl \\<times> 's) llist\"\nwhere\n  \"inf_step2inf_step_table s tls =\n   unfold_llist\n     (\\<lambda>(s, tls). lnull tls)\n     (\\<lambda>(s, tls). (s, lhd tls, SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>)) \n     (\\<lambda>(s, tls). (SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>, ltl tls))\n     (s, tls)\"\n\ncoinductive Rtrancl3p :: \"'s \\<Rightarrow> ('tl, 's) tllist \\<Rightarrow> bool\"\nwhere \n  Rtrancl3p_stop: \"(\\<And>tl s'. \\<not> s -tl\\<rightarrow> s') \\<Longrightarrow>  Rtrancl3p s (TNil s)\"\n| Rtrancl3p_into_Rtrancl3p: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; Rtrancl3p s' tlss \\<rbrakk> \\<Longrightarrow> Rtrancl3p s (TCons tl tlss)\"\n  \ninductive_simps Rtrancl3p_simps:\n  \"Rtrancl3p s (TNil s')\"\n  \"Rtrancl3p s (TCons tl' tlss)\"\n\ninductive_cases Rtrancl3p_cases:\n  \"Rtrancl3p s (TNil s')\"\n  \"Rtrancl3p s (TCons tl' tlss)\"\n\ncoinductive Runs :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> bool\"\nwhere\n  Stuck: \"(\\<And>tl s'. \\<not> s -tl\\<rightarrow> s') \\<Longrightarrow> Runs s LNil\"\n| Step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; Runs s' tls \\<rbrakk> \\<Longrightarrow> Runs s (LCons tl tls)\"\n\ncoinductive Runs_table :: \"'s \\<Rightarrow> ('s \\<times> 'tl \\<times> 's) llist \\<Rightarrow> bool\"\nwhere\n  Stuck: \"(\\<And>tl s'. \\<not> s -tl\\<rightarrow> s') \\<Longrightarrow> Runs_table s LNil\"\n| Step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; Runs_table s' stlss \\<rbrakk> \\<Longrightarrow> Runs_table s (LCons (s, tl, s') stlss)\"\n\ninductive_simps Runs_table_simps:\n  \"Runs_table s LNil\"\n  \"Runs_table s (LCons stls stlss)\"\n\nlemma inf_step_not_finite_llist:\n  assumes r: \"s -bs\\<rightarrow>* \\<infinity>\"\n  shows \"\\<not> lfinite bs\"\nproof\n  assume \"lfinite bs\" thus False using r\n    by(induct arbitrary: s rule: lfinite.induct)(auto elim: inf_step.cases)\nqed\n\nlemma inf_step2inf_step_table_LNil [simp]: \"inf_step2inf_step_table s LNil = LNil\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma inf_step2inf_step_table_LCons [simp]:\n  fixes tl shows\n  \"inf_step2inf_step_table s (LCons tl tls) =\n   LCons (s, tl, SOME s'. trsys s tl s' \\<and> s' -tls\\<rightarrow>* \\<infinity>) \n         (inf_step2inf_step_table (SOME s'. trsys s tl s' \\<and> s' -tls\\<rightarrow>* \\<infinity>) tls)\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma lnull_inf_step2inf_step_table [simp]: \n  \"lnull (inf_step2inf_step_table s tls) \\<longleftrightarrow> lnull tls\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma inf_step2inf_step_table_eq_LNil: \n  \"inf_step2inf_step_table s tls = LNil \\<longleftrightarrow> tls = LNil\"\nusing lnull_inf_step2inf_step_table unfolding lnull_def .\n\nlemma lhd_inf_step2inf_step_table [simp]:\n  \"\\<not> lnull tls\n  \\<Longrightarrow> lhd (inf_step2inf_step_table s tls) =\n      (s, lhd tls, SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>)\"\nby(simp add: inf_step2inf_step_table_def)\n\nlemma ltl_inf_step2inf_step_table [simp]:\n  \"ltl (inf_step2inf_step_table s tls) =\n   inf_step2inf_step_table (SOME s'. trsys s (lhd tls) s' \\<and> s' -ltl tls\\<rightarrow>* \\<infinity>) (ltl tls)\"\nby(cases tls) simp_all\n\nlemma lmap_inf_step2inf_step_table: \"lmap (fst \\<circ> snd) (inf_step2inf_step_table s tls) = tls\"\nby(coinduction arbitrary: s tls) auto\n\nlemma inf_step_imp_inf_step_table:\n  assumes \"s -tls\\<rightarrow>* \\<infinity>\"\n  shows \"\\<exists>stls. s -stls\\<rightarrow>*t \\<infinity> \\<and> tls = lmap (fst \\<circ> snd) stls\"\nproof -\n  from assms have \"s -inf_step2inf_step_table s tls\\<rightarrow>*t \\<infinity>\"\n  proof(coinduction arbitrary: s tls)\n    case (inf_step_table s tls)\n    thus ?case\n    proof cases\n      case (inf_stepI tl s' tls')\n      let ?s' = \"SOME s'. trsys s tl s' \\<and> s' -tls'\\<rightarrow>* \\<infinity>\"\n      have \"trsys s tl ?s' \\<and> ?s' -tls'\\<rightarrow>* \\<infinity>\" by(rule someI)(blast intro: inf_stepI)\n      thus ?thesis using \\<open>tls = LCons tl tls'\\<close> by auto\n    qed\n  qed\n  moreover have \"tls = lmap (fst \\<circ> snd) (inf_step2inf_step_table s tls)\"\n    by(simp only: lmap_inf_step2inf_step_table)\n  ultimately show ?thesis by blast\nqed\n\nlemma inf_step_table_imp_inf_step:\n  \"s-stls\\<rightarrow>*t \\<infinity> \\<Longrightarrow>s -lmap (fst \\<circ> snd) stls\\<rightarrow>* \\<infinity>\"\nproof(coinduction arbitrary: s stls rule: inf_step.coinduct)\n  case (inf_step s tls)\n  thus ?case by cases auto\nqed\n\nlemma Runs_table_into_Runs:\n  \"Runs_table s stlss \\<Longrightarrow> Runs s (lmap (\\<lambda>(s, tl, s'). tl) stlss)\"\nproof(coinduction arbitrary: s stlss)\n  case (Runs s tls)\n  thus ?case by (cases)auto\nqed\n\nlemma Runs_into_Runs_table:\n  assumes \"Runs s tls\"\n  obtains stlss\n  where \"tls = lmap (\\<lambda>(s, tl, s'). tl) stlss\"\n  and \"Runs_table s stlss\"\nproof -\n  define stlss where \"stlss s tls = unfold_llist\n    (\\<lambda>(s, tls). lnull tls)\n    (\\<lambda>(s, tls). (s, lhd tls, SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls)))\n    (\\<lambda>(s, tls). (SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls), ltl tls))\n    (s, tls)\"\n    for s tls\n  have [simp]:\n    \"\\<And>s. stlss s LNil = LNil\"\n    \"\\<And>s tl tls. stlss s (LCons tl tls) = LCons (s, tl, SOME s'. s -tl\\<rightarrow> s' \\<and> Runs s' tls) (stlss (SOME s'. s -tl\\<rightarrow> s' \\<and> Runs s' tls) tls)\"\n    \"\\<And>s tls. lnull (stlss s tls) \\<longleftrightarrow> lnull tls\"\n    \"\\<And>s tls. \\<not> lnull tls \\<Longrightarrow> lhd (stlss s tls) = (s, lhd tls, SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls))\"\n    \"\\<And>s tls. \\<not> lnull tls \\<Longrightarrow> ltl (stlss s tls) = stlss (SOME s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls)) (ltl tls)\"\n    by(simp_all add: stlss_def)\n  \n  from assms have \"tls = lmap (\\<lambda>(s, tl, s'). tl) (stlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case Eq_llist\n    thus ?case by cases(auto 4 3 intro: someI2)\n  qed\n  moreover\n  from assms have \"Runs_table s (stlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (Runs_table s stlss')\n    thus ?case\n    proof(cases)\n      case (Step s' tls' tl)\n      let ?P = \"\\<lambda>s'. s -tl\\<rightarrow> s' \\<and> Runs s' tls'\"\n      from \\<open>s -tl\\<rightarrow> s'\\<close> \\<open>Runs s' tls'\\<close> have \"?P s'\" ..\n      hence \"?P (Eps ?P)\" by(rule someI)\n      with Step have ?Step by auto\n      thus ?thesis ..\n    qed simp\n  qed\n  ultimately show ?thesis by(rule that)\nqed\n\nlemma Runs_lappendE:\n  assumes \"Runs \\<sigma> (lappend tls tls')\"\n  and \"lfinite tls\"\n  obtains \\<sigma>' where \"\\<sigma> -list_of tls\\<rightarrow>* \\<sigma>'\"\n  and \"Runs \\<sigma>' tls'\"\nproof(atomize_elim)\n  from \\<open>lfinite tls\\<close> \\<open>Runs \\<sigma> (lappend tls tls')\\<close>\n  show \"\\<exists>\\<sigma>'. \\<sigma> -list_of tls\\<rightarrow>* \\<sigma>' \\<and> Runs \\<sigma>' tls'\"\n  proof(induct arbitrary: \\<sigma>)\n    case lfinite_LNil thus ?case by(auto)\n  next\n    case (lfinite_LConsI tls tl)\n    from \\<open>Runs \\<sigma> (lappend (LCons tl tls) tls')\\<close>\n    show ?case unfolding lappend_code\n    proof(cases)\n      case (Step \\<sigma>')\n      from \\<open>Runs \\<sigma>' (lappend tls tls') \\<Longrightarrow> \\<exists>\\<sigma>''. \\<sigma>' -list_of tls\\<rightarrow>* \\<sigma>'' \\<and> Runs \\<sigma>'' tls'\\<close> \\<open>Runs \\<sigma>' (lappend tls tls')\\<close>\n      obtain \\<sigma>'' where \"\\<sigma>' -list_of tls\\<rightarrow>* \\<sigma>''\" \"Runs \\<sigma>'' tls'\" by blast\n      from \\<open>\\<sigma> -tl\\<rightarrow> \\<sigma>'\\<close> \\<open>\\<sigma>' -list_of tls\\<rightarrow>* \\<sigma>''\\<close>\n      have \"\\<sigma> -tl # list_of tls\\<rightarrow>* \\<sigma>''\" by(rule rtrancl3p_step_converse)\n      with \\<open>lfinite tls\\<close> have \"\\<sigma> -list_of (LCons tl tls)\\<rightarrow>* \\<sigma>''\" by(simp)\n      with \\<open>Runs \\<sigma>'' tls'\\<close> show ?thesis by blast\n    qed\n  qed\nqed\n\nlemma Trsys_into_Runs:\n  assumes \"s -tls\\<rightarrow>* s'\"\n  and \"Runs s' tls'\"\n  shows \"Runs s (lappend (llist_of tls) tls')\"\nusing assms\nby(induct rule: rtrancl3p_converse_induct)(auto intro: Runs.Step)\n\nlemma rtrancl3p_into_Rtrancl3p:\n  \"\\<lbrakk> rtrancl3p trsys a bs a'; \\<And>b a''. \\<not> a' -b\\<rightarrow> a'' \\<rbrakk> \\<Longrightarrow> Rtrancl3p a (tllist_of_llist a' (llist_of bs))\"\n  by(induct rule: rtrancl3p_converse_induct)(auto intro: Rtrancl3p.intros)\n    \nlemma Rtrancl3p_into_Runs:\n  \"Rtrancl3p s tlss \\<Longrightarrow> Runs s (llist_of_tllist tlss)\"\nby(coinduction arbitrary: s tlss rule: Runs.coinduct)(auto elim: Rtrancl3p.cases)\n\nlemma Runs_into_Rtrancl3p:\n  assumes \"Runs s tls\"\n  obtains tlss where \"tls = llist_of_tllist tlss\" \"Rtrancl3p s tlss\"\nproof\n  let ?Q = \"\\<lambda>s tls s'. s -lhd tls\\<rightarrow> s' \\<and> Runs s' (ltl tls)\"\n  define tlss where \"tlss = corec_tllist \n    (\\<lambda>(s, tls). lnull tls) (\\<lambda>(s, tls). s)\n    (\\<lambda>(s, tls). lhd tls)\n    (\\<lambda>_. False) undefined (\\<lambda>(s, tls). (SOME s'. ?Q s tls s', ltl tls))\"\n  have [simp]:\n    \"tlss (s, LNil) = TNil s\"\n    \"tlss (s, LCons tl tls) = TCons tl (tlss (SOME s'. ?Q s (LCons tl tls) s', tls))\"\n    for s tl tls by(auto simp add: tlss_def intro: tllist.expand)\n\n  show \"tls = llist_of_tllist (tlss (s, tls))\" using assms\n    by(coinduction arbitrary: s tls)(erule Runs.cases; fastforce intro: someI2)\n      \n  show \"Rtrancl3p s (tlss (s, tls))\" using assms\n    by(coinduction arbitrary: s tls)(erule Runs.cases; simp; iprover intro: someI2[where Q=\"trsys _ _\"] someI2[where Q=\"\\<lambda>s'. Runs s' _\"])\nqed\n\nlemma fixes tl\n  assumes \"Rtrancl3p s tlss\" \"tfinite tlss\"\n  shows Rtrancl3p_into_Trsys: \"Trsys s (list_of (llist_of_tllist tlss)) (terminal tlss)\"\n    and terminal_Rtrancl3p_final: \"\\<not> terminal tlss -tl\\<rightarrow> s'\"\nusing assms(2,1) by(induction arbitrary: s rule: tfinite_induct)(auto simp add: Rtrancl3p_simps intro: rtrancl3p_step_converse)\n\nend\n  \nsubsection \\<open>Labelled transition systems with internal actions\\<close>\n\nlocale \\<tau>trsys = trsys +\n  constrains trsys :: \"('s, 'tl) trsys\"\n  fixes \\<tau>move :: \"('s, 'tl) trsys\"\nbegin\n\ninductive silent_move :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow> _\" [50, 50] 60)\nwhere [intro]: \"!!tl. \\<lbrakk> trsys s tl s'; \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> s'\"\n\ndeclare silent_move.cases [elim]\n\n\n\nabbreviation silent_moves :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow>* _\" [50, 50] 60)\nwhere \"silent_moves == silent_move^**\"\n\nabbreviation silent_movet :: \"'s \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow>+ _\" [50, 50] 60)\nwhere \"silent_movet == silent_move^++\"\n\ncoinductive \\<tau>diverge :: \"'s \\<Rightarrow> bool\" (\"_ -\\<tau>\\<rightarrow> \\<infinity>\" [50] 60)\nwhere\n  \\<tau>divergeI: \"\\<lbrakk> s -\\<tau>\\<rightarrow> s'; s' -\\<tau>\\<rightarrow> \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\n\ncoinductive \\<tau>inf_step :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> bool\" (\"_ -\\<tau>-_\\<rightarrow>* \\<infinity>\" [50, 0] 60)\nwhere\n  \\<tau>inf_step_Cons: \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; s'' -\\<tau>-tls\\<rightarrow>* \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>-LCons tl tls\\<rightarrow>* \\<infinity>\"\n| \\<tau>inf_step_Nil: \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> s -\\<tau>-LNil\\<rightarrow>* \\<infinity>\"\n\ncoinductive \\<tau>inf_step_table :: \"'s \\<Rightarrow> ('s \\<times> 's \\<times> 'tl \\<times> 's) llist \\<Rightarrow> bool\" (\"_ -\\<tau>-_\\<rightarrow>*t \\<infinity>\" [50, 0] 80)\nwhere\n  \\<tau>inf_step_table_Cons:\n  \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; s'' -\\<tau>-tls\\<rightarrow>*t \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>-LCons (s, s', tl, s'') tls\\<rightarrow>*t \\<infinity>\"\n\n| \\<tau>inf_step_table_Nil:\n  \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> s -\\<tau>-LNil\\<rightarrow>*t \\<infinity>\"\n\ndefinition \\<tau>inf_step2\\<tau>inf_step_table :: \"'s \\<Rightarrow> 'tl llist \\<Rightarrow> ('s \\<times> 's \\<times> 'tl \\<times> 's) llist\"\nwhere\n  \"\\<tau>inf_step2\\<tau>inf_step_table s tls =\n   unfold_llist\n     (\\<lambda>(s, tls). lnull tls)\n     (\\<lambda>(s, tls). let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n        in (s, s', lhd tls, s''))\n     (\\<lambda>(s, tls). let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n        in (s'', ltl tls))\n     (s, tls)\"\n\ndefinition silent_move_from :: \"'s \\<Rightarrow> 's \\<Rightarrow> 's \\<Rightarrow> bool\"\nwhere \"silent_move_from s0 s1 s2 \\<longleftrightarrow> silent_moves s0 s1 \\<and> silent_move s1 s2\"\n\ninductive \\<tau>rtrancl3p :: \"'s \\<Rightarrow> 'tl list \\<Rightarrow> 's \\<Rightarrow> bool\" (\"_ -\\<tau>-_\\<rightarrow>* _\" [50, 0, 50] 60)\nwhere\n  \\<tau>rtrancl3p_refl: \"\\<tau>rtrancl3p s [] s\"\n| \\<tau>rtrancl3p_step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; \\<not> \\<tau>move s tl s'; \\<tau>rtrancl3p s' tls s'' \\<rbrakk> \\<Longrightarrow> \\<tau>rtrancl3p s (tl # tls) s''\"\n| \\<tau>rtrancl3p_\\<tau>step: \"\\<And>tl. \\<lbrakk> s -tl\\<rightarrow> s'; \\<tau>move s tl s'; \\<tau>rtrancl3p s' tls s'' \\<rbrakk> \\<Longrightarrow> \\<tau>rtrancl3p s tls s''\"\n\ncoinductive \\<tau>Runs :: \"'s \\<Rightarrow> ('tl, 's option) tllist \\<Rightarrow> bool\" (\"_ \\<Down> _\" [50, 50] 51)\nwhere\n  Terminate: \"\\<lbrakk> s -\\<tau>\\<rightarrow>* s'; \\<And>tl s''. \\<not> s' -tl\\<rightarrow> s'' \\<rbrakk> \\<Longrightarrow> s \\<Down> TNil \\<lfloor>s'\\<rfloor>\" \n| Diverge: \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> s \\<Down> TNil None\"\n| Proceed: \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; s'' \\<Down> tls \\<rbrakk> \\<Longrightarrow> s \\<Down> TCons tl tls\"\n\ninductive_simps \\<tau>Runs_simps:\n  \"s \\<Down> TNil (Some s')\"\n  \"s \\<Down> TNil None\"\n  \"s \\<Down> TCons tl' tls\"\n\ncoinductive \\<tau>Runs_table :: \"'s \\<Rightarrow> ('tl \\<times> 's, 's option) tllist \\<Rightarrow> bool\"\nwhere \n  Terminate: \"\\<lbrakk> s -\\<tau>\\<rightarrow>* s'; \\<And>tl s''. \\<not> s' -tl\\<rightarrow> s'' \\<rbrakk> \\<Longrightarrow> \\<tau>Runs_table s (TNil \\<lfloor>s'\\<rfloor>)\"\n| Diverge: \"s -\\<tau>\\<rightarrow> \\<infinity> \\<Longrightarrow> \\<tau>Runs_table s (TNil None)\"\n| Proceed:\n  \"\\<And>tl. \\<lbrakk> s -\\<tau>\\<rightarrow>* s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; \\<tau>Runs_table s'' tls \\<rbrakk> \n  \\<Longrightarrow> \\<tau>Runs_table s (TCons (tl, s'') tls)\"\n\ndefinition silent_move2 :: \"'s \\<Rightarrow> 'tl \\<Rightarrow> 's \\<Rightarrow> bool\"\nwhere \"\\<And>tl. silent_move2 s tl s' \\<longleftrightarrow> s -tl\\<rightarrow> s' \\<and> \\<tau>move s tl s'\"\n\nabbreviation silent_moves2 :: \"'s \\<Rightarrow> 'tl list \\<Rightarrow> 's \\<Rightarrow> bool\"\nwhere \"silent_moves2 \\<equiv> rtrancl3p silent_move2\"\n\ncoinductive \\<tau>Runs_table2 :: \"'s \\<Rightarrow> ('tl list \\<times> 's \\<times> 'tl \\<times> 's, ('tl list \\<times> 's) + 'tl llist) tllist \\<Rightarrow> bool\"\nwhere \n  Terminate: \"\\<lbrakk> silent_moves2 s tls s'; \\<And>tl s''. \\<not> s' -tl\\<rightarrow> s'' \\<rbrakk> \\<Longrightarrow> \\<tau>Runs_table2 s (TNil (Inl (tls, s')))\"\n| Diverge: \"trsys.inf_step silent_move2 s tls \\<Longrightarrow> \\<tau>Runs_table2 s (TNil (Inr tls))\"\n| Proceed:\n  \"\\<And>tl. \\<lbrakk> silent_moves2 s tls s'; s' -tl\\<rightarrow> s''; \\<not> \\<tau>move s' tl s''; \\<tau>Runs_table2 s'' tlsstlss \\<rbrakk> \n  \\<Longrightarrow> \\<tau>Runs_table2 s (TCons (tls, s', tl, s'') tlsstlss)\"\n\ninductive_simps \\<tau>Runs_table2_simps:\n  \"\\<tau>Runs_table2 s (TNil tlss)\"\n  \"\\<tau>Runs_table2 s (TCons tlsstls tlsstlss)\"\n\nlemma inf_step_table_all_\\<tau>_into_\\<tau>diverge:\n  \"\\<lbrakk> s -stls\\<rightarrow>*t \\<infinity>; \\<forall>(s, tl, s') \\<in> lset stls. \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof(coinduction arbitrary: s stls)\n  case (\\<tau>diverge s)\n  thus ?case by cases (auto simp add: silent_move_iff, blast)\nqed\n\nlemma inf_step_table_lappend_llist_ofD:\n  \"s -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>\n  \\<Longrightarrow> (s -map (fst \\<circ> snd) stls\\<rightarrow>* x) \\<and> (x -LCons (x, tl', x') xs\\<rightarrow>*t \\<infinity>)\"\nproof(induct stls arbitrary: s)\n  case Nil thus ?case by(auto elim: inf_step_table.cases intro: inf_step_table.intros rtrancl3p_refl)\nnext\n  case (Cons st stls)\n  note IH = \\<open>\\<And>s. s -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity> \\<Longrightarrow>\n                 s -map (fst \\<circ> snd) stls\\<rightarrow>* x \\<and> x -LCons (x, tl', x') xs\\<rightarrow>*t \\<infinity>\\<close>\n  from \\<open>s -lappend (llist_of (st # stls)) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>\\<close>\n  show ?case\n  proof cases\n    case (inf_step_tableI s' stls' tl)\n    hence [simp]: \"st = (s, tl, s')\" \"stls' = lappend (llist_of stls) (LCons (x, tl', x') xs)\"\n      and \"s -tl\\<rightarrow> s'\" \"s' -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>\" by simp_all\n    from IH[OF \\<open>s' -lappend (llist_of stls) (LCons (x, tl', x') xs)\\<rightarrow>*t \\<infinity>\\<close>]\n    have \"s' -map (fst \\<circ> snd) stls\\<rightarrow>* x\" \"x -LCons (x, tl', x') xs\\<rightarrow>*t \\<infinity>\" by auto\n    with \\<open>s -tl\\<rightarrow> s'\\<close> show ?thesis by(auto simp add: o_def intro: rtrancl3p_step_converse)\n  qed\nqed\n\nlemma inf_step_table_lappend_llist_of_\\<tau>_into_\\<tau>moves:\n  assumes \"lfinite stls\"\n  shows \"\\<lbrakk> s -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>; \\<forall>(s, tl, s')\\<in>lset stls. \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow>* x\"\nusing assms\nproof(induct arbitrary: s rule: lfinite.induct)\n  case lfinite_LNil thus ?case by(auto elim: inf_step_table.cases)\nnext\n  case (lfinite_LConsI stls st)\n  note IH = \\<open>\\<And>s. \\<lbrakk>s -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>; \\<forall>(s, tl, s')\\<in>lset stls. \\<tau>move s tl s' \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow>* x\\<close>\n  obtain s1 tl1 s1' where [simp]: \"st = (s1, tl1, s1')\" by(cases st)\n  from \\<open>s -lappend (LCons st stls) (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>\\<close>\n  show ?case\n  proof cases\n    case (inf_step_tableI X' STLS TL)\n    hence [simp]: \"s1 = s\" \"TL = tl1\" \"X' = s1'\" \"STLS = lappend stls (LCons (x, tl' x') xs)\"\n      and \"s -tl1\\<rightarrow> s1'\" and \"s1' -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>\" by simp_all\n    from \\<open>\\<forall>(s, tl, s')\\<in>lset (LCons st stls). \\<tau>move s tl s'\\<close> have \"\\<tau>move s tl1 s1'\" by simp\n    moreover\n    from IH[OF \\<open>s1' -lappend stls (LCons (x, tl' x') xs)\\<rightarrow>*t \\<infinity>\\<close>] \\<open>\\<forall>(s, tl, s')\\<in>lset (LCons st stls). \\<tau>move s tl s'\\<close>\n    have \"s1' -\\<tau>\\<rightarrow>* x\" by simp\n    ultimately show ?thesis using \\<open>s -tl1\\<rightarrow> s1'\\<close> by(auto intro: converse_rtranclp_into_rtranclp)\n  qed\nqed\n\n\nlemma inf_step_table_into_\\<tau>inf_step:\n  \"s -stls\\<rightarrow>*t \\<infinity> \\<Longrightarrow> s -\\<tau>-lmap (fst \\<circ> snd) (lfilter (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') stls)\\<rightarrow>* \\<infinity>\"\nproof(coinduction arbitrary: s stls)\n  case (\\<tau>inf_step s stls)\n  let ?P = \"\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s'\"\n  show ?case\n  proof(cases \"lfilter ?P stls\")\n    case LNil\n    with \\<tau>inf_step have ?\\<tau>inf_step_Nil\n      by(auto intro: inf_step_table_all_\\<tau>_into_\\<tau>diverge simp add: lfilter_eq_LNil)\n    thus ?thesis ..\n  next\n    case (LCons stls' xs)\n    obtain x tl x' where \"stls' = (x, tl, x')\" by(cases stls')\n    with LCons have stls: \"lfilter ?P stls = LCons (x, tl, x') xs\" by simp\n    from lfilter_eq_LConsD[OF this] obtain stls1 stls2\n      where stls1: \"stls = lappend stls1 (LCons (x, tl, x') stls2)\"\n      and \"lfinite stls1\"\n      and \\<tau>s: \"\\<forall>(s, tl, s')\\<in>lset stls1. \\<tau>move s tl s'\"\n      and n\\<tau>: \"\\<not> \\<tau>move x tl x'\" and xs: \"xs = lfilter ?P stls2\" by blast\n    from \\<open>lfinite stls1\\<close> \\<tau>inf_step \\<tau>s have \"s -\\<tau>\\<rightarrow>* x\" unfolding stls1\n      by(rule inf_step_table_lappend_llist_of_\\<tau>_into_\\<tau>moves)\n    moreover from \\<open>lfinite stls1\\<close> have \"llist_of (list_of stls1) = stls1\" by(simp add: llist_of_list_of)\n    with \\<tau>inf_step stls1 have \"s -lappend (llist_of (list_of stls1)) (LCons (x, tl, x') stls2)\\<rightarrow>*t \\<infinity>\" by simp\n    from inf_step_table_lappend_llist_ofD[OF this]\n    have \"x -LCons (x, tl, x') stls2\\<rightarrow>*t \\<infinity>\" ..\n    hence \"x -tl\\<rightarrow> x'\" \"x' -stls2\\<rightarrow>*t \\<infinity>\" by(auto elim: inf_step_table.cases)\n    ultimately have ?\\<tau>inf_step_Cons using xs n\\<tau> by(auto simp add: stls o_def)\n    thus ?thesis ..\n  qed\nqed\n\nlemma inf_step_into_\\<tau>inf_step:\n  assumes \"s -tls\\<rightarrow>* \\<infinity>\"\n  shows \"\\<exists>A. s -\\<tau>-lnths tls A\\<rightarrow>* \\<infinity>\"\nproof -\n  from inf_step_imp_inf_step_table[OF assms]\n  obtain stls where \"s -stls\\<rightarrow>*t \\<infinity>\" and tls: \"tls = lmap (fst \\<circ> snd) stls\" by blast\n  from \\<open>s -stls\\<rightarrow>*t \\<infinity>\\<close> have \"s -\\<tau>-lmap (fst \\<circ> snd) (lfilter (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') stls)\\<rightarrow>* \\<infinity>\"\n    by(rule inf_step_table_into_\\<tau>inf_step)\n  hence \"s -\\<tau>-lnths tls {n. enat n < llength stls \\<and> (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') (lnth stls n)}\\<rightarrow>* \\<infinity>\"\n    unfolding lfilter_conv_lnths tls by simp\n  thus ?thesis by blast\nqed\n\nlemma silent_moves_into_\\<tau>rtrancl3p:\n  \"s -\\<tau>\\<rightarrow>* s' \\<Longrightarrow> s -\\<tau>-[]\\<rightarrow>* s'\"\nby(induct rule: converse_rtranclp_induct)(blast intro: \\<tau>rtrancl3p.intros)+\n\nlemma \\<tau>rtrancl3p_into_silent_moves:\n  \"s -\\<tau>-[]\\<rightarrow>* s' \\<Longrightarrow> s -\\<tau>\\<rightarrow>* s'\"\napply(induct s tls\\<equiv>\"[] :: 'tl list\" s' rule: \\<tau>rtrancl3p.induct)\napply(auto intro: converse_rtranclp_into_rtranclp)\ndone\n\nlemma \\<tau>rtrancl3p_Nil_eq_\\<tau>moves:\n  \"s -\\<tau>-[]\\<rightarrow>* s' \\<longleftrightarrow> s -\\<tau>\\<rightarrow>* s'\"\nby(blast intro: silent_moves_into_\\<tau>rtrancl3p \\<tau>rtrancl3p_into_silent_moves)\n\nlemma \\<tau>rtrancl3p_trans [trans]:\n  \"\\<lbrakk> s -\\<tau>-tls\\<rightarrow>* s'; s' -\\<tau>-tls'\\<rightarrow>* s'' \\<rbrakk> \\<Longrightarrow> s -\\<tau>-tls @ tls'\\<rightarrow>* s''\"\napply(induct rule: \\<tau>rtrancl3p.induct)\napply(auto intro: \\<tau>rtrancl3p.intros)\ndone\n\nlemma \\<tau>rtrancl3p_SingletonE:\n  fixes tl\n  assumes red: \"s -\\<tau>-[tl]\\<rightarrow>* s'''\"\n  obtains s' s'' where \"s -\\<tau>\\<rightarrow>* s'\" \"s' -tl\\<rightarrow> s''\" \"\\<not> \\<tau>move s' tl s''\" \"s'' -\\<tau>\\<rightarrow>* s'''\"\nproof(atomize_elim)\n  from red show \"\\<exists>s' s''. s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>\\<rightarrow>* s'''\"\n  proof(induct s tls\\<equiv>\"[tl]\" s''')\n    case (\\<tau>rtrancl3p_step s s' s'')\n    from \\<open>s -tl\\<rightarrow> s'\\<close> \\<open>\\<not> \\<tau>move s tl s'\\<close> \\<open>s' -\\<tau>-[]\\<rightarrow>* s''\\<close> show ?case\n      by(auto simp add: \\<tau>rtrancl3p_Nil_eq_\\<tau>moves)\n   next\n    case (\\<tau>rtrancl3p_\\<tau>step s s' s'' tl')\n    then obtain t' t'' where \"s' -\\<tau>\\<rightarrow>* t'\" \"t' -tl\\<rightarrow> t''\" \"\\<not> \\<tau>move t' tl t''\" \"t'' -\\<tau>\\<rightarrow>* s''\" by auto\n    moreover\n    from \\<open>s -tl'\\<rightarrow> s'\\<close> \\<open>\\<tau>move s tl' s'\\<close> have \"s -\\<tau>\\<rightarrow>* s'\" by blast\n    ultimately show ?case by(auto intro: rtranclp_trans)\n  qed\nqed\n\nlemma \\<tau>rtrancl3p_snocI:\n  \"\\<And>tl. \\<lbrakk> \\<tau>rtrancl3p s tls s''; s'' -\\<tau>\\<rightarrow>* s'''; s''' -tl\\<rightarrow> s'; \\<not> \\<tau>move s''' tl s' \\<rbrakk>\n  \\<Longrightarrow> \\<tau>rtrancl3p s (tls @ [tl]) s'\"\napply(erule \\<tau>rtrancl3p_trans)\napply(fold \\<tau>rtrancl3p_Nil_eq_\\<tau>moves)\napply(drule \\<tau>rtrancl3p_trans)\n apply(erule (1) \\<tau>rtrancl3p_step)\n apply(rule \\<tau>rtrancl3p_refl)\napply simp\ndone\n\nlemma \\<tau>diverge_rtranclp_silent_move:\n  \"\\<lbrakk> silent_move^** s s'; s' -\\<tau>\\<rightarrow> \\<infinity> \\<rbrakk> \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\nby(induct rule: converse_rtranclp_induct)(auto intro: \\<tau>divergeI)\n\nlemma \\<tau>diverge_trancl_coinduct [consumes 1, case_names \\<tau>diverge]:\n  assumes X: \"X s\"\n  and step: \"\\<And>s. X s \\<Longrightarrow> \\<exists>s'. silent_move^++ s s' \\<and> (X s' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>)\"\n  shows \"s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof -\n  from X have \"\\<exists>s'. silent_move^** s s' \\<and> X s'\" by blast\n  thus ?thesis\n  proof(coinduct)\n    case (\\<tau>diverge s)\n    then obtain s' where \"silent_move\\<^sup>*\\<^sup>* s s'\" \"X s'\" by blast\n    from step[OF \\<open>X s'\\<close>] obtain s'''\n      where \"silent_move^++ s' s'''\" \"X s''' \\<or> s''' -\\<tau>\\<rightarrow> \\<infinity>\" by blast\n    from \\<open>silent_move\\<^sup>*\\<^sup>* s s'\\<close> show ?case\n    proof(cases rule: converse_rtranclpE[consumes 1, case_names refl step])\n      case refl\n      moreover from tranclpD[OF \\<open>silent_move^++ s' s'''\\<close>] obtain s''\n        where \"silent_move s' s''\" \"silent_move^** s'' s'''\" by blast\n      ultimately show ?thesis using \\<open>silent_move^** s'' s'''\\<close> \\<open>X s''' \\<or> s''' -\\<tau>\\<rightarrow> \\<infinity>\\<close>\n        by(auto intro: \\<tau>diverge_rtranclp_silent_move)\n    next\n      case (step S)\n      moreover from \\<open>silent_move\\<^sup>*\\<^sup>* S s'\\<close> \\<open>silent_move^++ s' s'''\\<close>\n      have \"silent_move^** S s'''\" by(rule rtranclp_trans[OF _ tranclp_into_rtranclp])\n      ultimately show ?thesis using \\<open>X s''' \\<or> s''' -\\<tau>\\<rightarrow> \\<infinity>\\<close> by(auto intro: \\<tau>diverge_rtranclp_silent_move)\n    qed\n  qed\nqed\n\nlemma \\<tau>diverge_trancl_measure_coinduct [consumes 2, case_names \\<tau>diverge]:\n  assumes major: \"X s t\" \"wfP \\<mu>\"\n  and step: \"\\<And>s t. X s t \\<Longrightarrow> \\<exists>s' t'. (\\<mu> t' t \\<and> s' = s \\<or> silent_move^++ s s') \\<and> (X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>)\"\n  shows \"s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof -\n  { fix s t\n    assume \"X s t\"\n    with \\<open>wfP \\<mu>\\<close> have \"\\<exists>s' t'. silent_move^++ s s' \\<and> (X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>)\"\n    proof(induct arbitrary: s rule: wfP_induct[consumes 1])\n      case (1 t)\n      hence IH: \"\\<And>s' t'. \\<lbrakk> \\<mu> t' t; X s' t' \\<rbrakk> \\<Longrightarrow>\n                 \\<exists>s'' t''. silent_move^++ s' s'' \\<and> (X s'' t'' \\<or> s'' -\\<tau>\\<rightarrow> \\<infinity>)\" by blast\n      from step[OF \\<open>X s t\\<close>] obtain s' t'\n        where \"\\<mu> t' t \\<and> s' = s \\<or> silent_move\\<^sup>+\\<^sup>+ s s'\" \"X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>\" by blast\n      from \\<open>\\<mu> t' t \\<and> s' = s \\<or> silent_move\\<^sup>+\\<^sup>+ s s'\\<close> show ?case\n      proof\n        assume \"\\<mu> t' t \\<and> s' = s\"\n        hence  \"\\<mu> t' t\" and [simp]: \"s' = s\" by simp_all\n        from \\<open>X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>\\<close> show ?thesis\n        proof\n          assume \"X s' t'\"\n          from IH[OF \\<open>\\<mu> t' t\\<close> this] show ?thesis by simp\n        next\n          assume \"s' -\\<tau>\\<rightarrow> \\<infinity>\" thus ?thesis\n            by cases(auto simp add: silent_move_iff)\n        qed\n      next\n        assume \"silent_move\\<^sup>+\\<^sup>+ s s'\"\n        thus ?thesis using \\<open>X s' t' \\<or> s' -\\<tau>\\<rightarrow> \\<infinity>\\<close> by blast\n      qed\n    qed }\n  note X = this\n  from \\<open>X s t\\<close> have \"\\<exists>t. X s t\" ..\n  thus ?thesis\n  proof(coinduct rule: \\<tau>diverge_trancl_coinduct)\n    case (\\<tau>diverge s)\n    then obtain t where \"X s t\" ..\n    from X[OF this] show ?case by blast\n  qed\nqed\n\nlemma \\<tau>inf_step2\\<tau>inf_step_table_LNil [simp]: \"\\<tau>inf_step2\\<tau>inf_step_table s LNil = LNil\"\nby(simp add: \\<tau>inf_step2\\<tau>inf_step_table_def)\n\nlemma \\<tau>inf_step2\\<tau>inf_step_table_LCons [simp]:\n  fixes s tl ss tls\n  defines \"ss \\<equiv> SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls\\<rightarrow>* \\<infinity>\"\n  shows\n  \"\\<tau>inf_step2\\<tau>inf_step_table s (LCons tl tls) =\n   LCons (s, fst ss, tl, snd ss) (\\<tau>inf_step2\\<tau>inf_step_table (snd ss) tls)\"\nby(simp add: ss_def \\<tau>inf_step2\\<tau>inf_step_table_def split_beta)\n\nlemma lnull_\\<tau>inf_step2\\<tau>inf_step_table [simp]:\n  \"lnull (\\<tau>inf_step2\\<tau>inf_step_table s tls) \\<longleftrightarrow> lnull tls\"\nby(simp add: \\<tau>inf_step2\\<tau>inf_step_table_def)\n\nlemma lhd_\\<tau>inf_step2\\<tau>inf_step_table [simp]:\n  \"\\<not> lnull tls \\<Longrightarrow> lhd (\\<tau>inf_step2\\<tau>inf_step_table s tls) = \n  (let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n  in (s, s', lhd tls, s''))\"\nunfolding \\<tau>inf_step2\\<tau>inf_step_table_def Let_def by simp\n\nlemma ltl_\\<tau>inf_step2\\<tau>inf_step_table [simp]:\n  \"\\<not> lnull tls \\<Longrightarrow> ltl (\\<tau>inf_step2\\<tau>inf_step_table s tls) =\n  (let (s', s'') = SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -lhd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (lhd tls) s'' \\<and> s'' -\\<tau>-ltl tls\\<rightarrow>* \\<infinity>\n  in \\<tau>inf_step2\\<tau>inf_step_table s'' (ltl tls))\"\nunfolding \\<tau>inf_step2\\<tau>inf_step_table_def Let_def\nby(simp add: split_beta)\n\nlemma lmap_\\<tau>inf_step2\\<tau>inf_step_table: \"lmap (fst \\<circ> snd \\<circ> snd) (\\<tau>inf_step2\\<tau>inf_step_table s tls) = tls\"\nby(coinduction arbitrary: s tls)(auto simp add: split_beta)\n\nlemma \\<tau>inf_step_into_\\<tau>inf_step_table:\n  \"s -\\<tau>-tls\\<rightarrow>* \\<infinity> \\<Longrightarrow> s -\\<tau>-\\<tau>inf_step2\\<tau>inf_step_table s tls\\<rightarrow>*t \\<infinity>\"\nproof(coinduction arbitrary: s tls)\n  case (\\<tau>inf_step_table s tls)\n  thus ?case\n  proof(cases)\n    case (\\<tau>inf_step_Cons s' s'' tls' tl)\n    let ?ss = \"SOME (s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>\"\n    from \\<tau>inf_step_Cons have tls: \"tls = LCons tl tls'\" and \"s -\\<tau>\\<rightarrow>* s'\" \"s' -tl\\<rightarrow> s''\"\n      \"\\<not> \\<tau>move s' tl s''\" \"s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>\" by simp_all\n    hence \"(\\<lambda>(s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>) (s', s'')\" by simp\n    hence \"(\\<lambda>(s', s''). s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' -\\<tau>-tls'\\<rightarrow>* \\<infinity>) ?ss\" by(rule someI)\n    with tls have ?\\<tau>inf_step_table_Cons by auto\n    thus ?thesis ..\n  next\n    case \\<tau>inf_step_Nil\n    then have ?\\<tau>inf_step_table_Nil by simp\n    thus ?thesis ..\n  qed\nqed\n\nlemma \\<tau>inf_step_imp_\\<tau>inf_step_table:\n  assumes \"s -\\<tau>-tls\\<rightarrow>* \\<infinity>\"\n  shows \"\\<exists>sstls. s -\\<tau>-sstls\\<rightarrow>*t \\<infinity> \\<and> tls = lmap (fst \\<circ> snd \\<circ> snd) sstls\"\nusing \\<tau>inf_step_into_\\<tau>inf_step_table[OF assms]\nby(auto simp only: lmap_\\<tau>inf_step2\\<tau>inf_step_table)\n\nlemma \\<tau>inf_step_table_into_\\<tau>inf_step:\n  \"s -\\<tau>-sstls\\<rightarrow>*t \\<infinity> \\<Longrightarrow> s -\\<tau>-lmap (fst \\<circ> snd \\<circ> snd) sstls\\<rightarrow>* \\<infinity>\"\nproof(coinduction arbitrary: s sstls)\n  case (\\<tau>inf_step s tls)\n  thus ?case by cases(auto simp add: o_def)\nqed\n\nlemma silent_move_fromI [intro]:\n  \"\\<lbrakk> silent_moves s0 s1; silent_move s1 s2 \\<rbrakk> \\<Longrightarrow> silent_move_from s0 s1 s2\"\nby(simp add: silent_move_from_def)\n\nlemma silent_move_fromE [elim]:\n  assumes \"silent_move_from s0 s1 s2\"\n  obtains \"silent_moves s0 s1\" \"silent_move s1 s2\"\nusing assms by(auto simp add: silent_move_from_def)\n\nlemma rtranclp_silent_move_from_imp_silent_moves:\n  assumes s'x: \"silent_move\\<^sup>*\\<^sup>* s' x\"\n  shows \"(silent_move_from s')^** x z \\<Longrightarrow> silent_moves s' z\"\nby(induct rule: rtranclp_induct)(auto intro: s'x)\n\nlemma \\<tau>diverge_not_wfP_silent_move_from:\n  assumes \"s -\\<tau>\\<rightarrow> \\<infinity>\"\n  shows \"\\<not> wfP (flip (silent_move_from s))\"\nproof\n  assume \"wfP (flip (silent_move_from s))\"\n  moreover define Q where \"Q = {s'. silent_moves s s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>}\"\n  hence \"s \\<in> Q\" using \\<open>s -\\<tau>\\<rightarrow> \\<infinity>\\<close> by(auto)\n  ultimately have \"\\<exists>z\\<in>Q. \\<forall>y. silent_move_from s z y \\<longrightarrow> y \\<notin> Q\"\n    unfolding wfP_eq_minimal flip_simps by blast\n  then obtain z where \"z \\<in> Q\"\n    and min: \"\\<And>y. silent_move_from s z y \\<Longrightarrow> y \\<notin> Q\" by blast\n  from \\<open>z \\<in> Q\\<close> have \"silent_moves s z\" \"z -\\<tau>\\<rightarrow> \\<infinity>\" unfolding Q_def by auto\n  from \\<open>z -\\<tau>\\<rightarrow> \\<infinity>\\<close> obtain y where \"silent_move z y\" \"y -\\<tau>\\<rightarrow> \\<infinity>\" by cases auto\n  from \\<open>silent_moves s z\\<close> \\<open>silent_move z y\\<close> have \"silent_move_from s z y\" ..\n  hence \"y \\<notin> Q\" by(rule min)\n  moreover from \\<open>silent_moves s z\\<close> \\<open>silent_move z y\\<close> \\<open>y -\\<tau>\\<rightarrow> \\<infinity>\\<close>\n  have \"y \\<in> Q\" unfolding Q_def by auto\n  ultimately show False by contradiction\nqed\n\nlemma wfP_silent_move_from_unroll:\n  assumes wfPs': \"\\<And>s'. s -\\<tau>\\<rightarrow> s' \\<Longrightarrow> wfP (flip (silent_move_from s'))\"\n  shows \"wfP (flip (silent_move_from s))\"\n  unfolding wfP_eq_minimal flip_conv\nproof(intro allI impI)\n  fix Q and x :: 's\n  assume \"x \\<in> Q\"\n  show \"\\<exists>z\\<in>Q. \\<forall>y. silent_move_from s z y \\<longrightarrow> y \\<notin> Q\"\n  proof(cases \"\\<exists>s'. s -\\<tau>\\<rightarrow> s' \\<and> (\\<exists>x'. silent_moves s' x' \\<and> x' \\<in> Q)\")\n    case False\n    hence \"\\<forall>y. silent_move_from s x y \\<longrightarrow> \\<not> y \\<in> Q\"\n      by(cases \"x=s\")(auto, blast elim: converse_rtranclpE intro: rtranclp.rtrancl_into_rtrancl)\n    with \\<open>x \\<in> Q\\<close> show ?thesis by blast\n  next\n    case True\n    then obtain s' x' where \"s -\\<tau>\\<rightarrow> s'\" and \"silent_moves s' x'\" and \"x' \\<in> Q\"\n      by auto\n    from \\<open>s -\\<tau>\\<rightarrow> s'\\<close> have \"wfP (flip (silent_move_from s'))\" by(rule wfPs')\n    from this \\<open>x' \\<in> Q\\<close> obtain z where \"z \\<in> Q\" and min: \"\\<And>y. silent_move_from s' z y \\<Longrightarrow> \\<not> y \\<in> Q\"\n      and \"(silent_move_from s')^** x' z\"\n      by (rule wfP_minimalE) (unfold flip_simps, blast)\n    { fix y\n      assume \"silent_move_from s z y\"\n      with \\<open>(silent_move_from s')^** x' z\\<close> \\<open>silent_move^** s' x'\\<close>\n      have \"silent_move_from s' z y\"\n        by(blast intro: rtranclp_silent_move_from_imp_silent_moves)\n      hence \"\\<not> y \\<in> Q\" by(rule min) }\n    with \\<open>z \\<in> Q\\<close> show ?thesis by(auto simp add: intro!: bexI)\n  qed\nqed\n\nlemma not_wfP_silent_move_from_\\<tau>diverge:\n  assumes \"\\<not> wfP (flip (silent_move_from s))\"\n  shows \"s -\\<tau>\\<rightarrow> \\<infinity>\"\nusing assms\nproof(coinduct)\n  case (\\<tau>diverge s)\n  { assume wfPs': \"\\<And>s'. s -\\<tau>\\<rightarrow> s' \\<Longrightarrow> wfP (flip (silent_move_from s'))\"\n    hence \"wfP (flip (silent_move_from s))\" by(rule wfP_silent_move_from_unroll) }\n  with \\<tau>diverge have \"\\<exists>s'. s -\\<tau>\\<rightarrow> s' \\<and> \\<not> wfP (flip (silent_move_from s'))\" by auto\n  thus ?case by blast\nqed\n\nlemma \\<tau>diverge_neq_wfP_silent_move_from:\n  \"s -\\<tau>\\<rightarrow> \\<infinity> \\<noteq> wfP (flip (silent_move_from s))\"\nby(auto intro: not_wfP_silent_move_from_\\<tau>diverge dest: \\<tau>diverge_not_wfP_silent_move_from)\n\nlemma not_\\<tau>diverge_to_no_\\<tau>move:\n  assumes \"\\<not> s -\\<tau>\\<rightarrow> \\<infinity>\"\n  shows \"\\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> (\\<forall>s''. \\<not> s' -\\<tau>\\<rightarrow> s'')\"\nproof -\n  define S where \"S = s\"\n  from \\<open>\\<not> \\<tau>diverge s\\<close> have \"wfP (flip (silent_move_from S))\" unfolding S_def\n    using \\<tau>diverge_neq_wfP_silent_move_from[of s] by simp\n  moreover have \"silent_moves S s\" unfolding S_def ..\n  ultimately show ?thesis\n  proof(induct rule: wfP_induct')\n    case (wfP s)\n    note IH = \\<open>\\<And>y. \\<lbrakk>flip (silent_move_from S) y s; S -\\<tau>\\<rightarrow>* y \\<rbrakk>\n             \\<Longrightarrow> \\<exists>s'. y -\\<tau>\\<rightarrow>* s' \\<and> (\\<forall>s''. \\<not> s' -\\<tau>\\<rightarrow> s'')\\<close>\n    show ?case\n    proof(cases \"\\<exists>s'. silent_move s s'\")\n      case False thus ?thesis by auto\n    next\n      case True\n      then obtain s' where \"s -\\<tau>\\<rightarrow> s'\" ..\n      with \\<open>S -\\<tau>\\<rightarrow>* s\\<close> have \"flip (silent_move_from S) s' s\"\n        unfolding flip_conv by(rule silent_move_fromI)\n      moreover from \\<open>S -\\<tau>\\<rightarrow>* s\\<close> \\<open>s -\\<tau>\\<rightarrow> s'\\<close> have \"S -\\<tau>\\<rightarrow>* s'\" ..\n      ultimately have \"\\<exists>s''. s' -\\<tau>\\<rightarrow>* s'' \\<and> (\\<forall>s'''. \\<not> s'' -\\<tau>\\<rightarrow> s''')\" by(rule IH)\n      then obtain s'' where \"s' -\\<tau>\\<rightarrow>* s''\" \"\\<forall>s'''. \\<not> s'' -\\<tau>\\<rightarrow> s'''\" by blast\n      from \\<open>s -\\<tau>\\<rightarrow> s'\\<close> \\<open>s' -\\<tau>\\<rightarrow>* s''\\<close> have \"s -\\<tau>\\<rightarrow>* s''\" by(rule converse_rtranclp_into_rtranclp)\n      with \\<open>\\<forall>s'''. \\<not> s'' -\\<tau>\\<rightarrow> s'''\\<close> show ?thesis by blast\n    qed\n  qed\nqed\n\nlemma \\<tau>diverge_conv_\\<tau>Runs:\n  \"s -\\<tau>\\<rightarrow> \\<infinity> \\<longleftrightarrow> s \\<Down> TNil None\"\nby(auto intro: \\<tau>Runs.Diverge elim: \\<tau>Runs.cases)\n\nlemma \\<tau>inf_step_into_\\<tau>Runs:\n  \"s -\\<tau>-tls\\<rightarrow>* \\<infinity> \\<Longrightarrow> s \\<Down> tllist_of_llist None tls\"\nproof(coinduction arbitrary: s tls)\n  case (\\<tau>Runs s tls')\n  thus ?case by cases(auto simp add: \\<tau>diverge_conv_\\<tau>Runs)\nqed\n\nlemma \\<tau>_into_\\<tau>Runs:\n  \"\\<lbrakk> s -\\<tau>\\<rightarrow> s'; s' \\<Down> tls \\<rbrakk> \\<Longrightarrow> s \\<Down> tls\"\nby(blast elim: \\<tau>Runs.cases intro: \\<tau>Runs.intros \\<tau>diverge.intros converse_rtranclp_into_rtranclp)\n\nlemma \\<tau>rtrancl3p_into_\\<tau>Runs:\n  assumes \"s -\\<tau>-tls\\<rightarrow>* s'\"\n  and \"s' \\<Down> tls'\"\n  shows \"s \\<Down> lappendt (llist_of tls) tls'\"\nusing assms\nby induct(auto intro: \\<tau>Runs.Proceed \\<tau>_into_\\<tau>Runs)\n\nlemma \\<tau>Runs_table_into_\\<tau>Runs:\n  \"\\<tau>Runs_table s stlsss \\<Longrightarrow> s \\<Down> tmap fst id stlsss\"\nproof(coinduction arbitrary: s stlsss)\n  case (\\<tau>Runs s tls)\n  thus ?case by cases(auto simp add: o_def id_def)\nqed\n\ndefinition \\<tau>Runs2\\<tau>Runs_table :: \"'s \\<Rightarrow> ('tl, 's option) tllist \\<Rightarrow> ('tl \\<times> 's, 's option) tllist\"\nwhere\n  \"\\<tau>Runs2\\<tau>Runs_table s tls = unfold_tllist\n     (\\<lambda>(s, tls). is_TNil tls)\n     (\\<lambda>(s, tls). terminal tls)\n     (\\<lambda>(s, tls). (thd tls, SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls))\n     (\\<lambda>(s, tls). (SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls, ttl tls))\n     (s, tls)\"\n\nlemma is_TNil_\\<tau>Runs2\\<tau>Runs_table [simp]:\n  \"is_TNil (\\<tau>Runs2\\<tau>Runs_table s tls) \\<longleftrightarrow> is_TNil tls\"\n  thm unfold_tllist.disc\nby(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\n\nlemma thd_\\<tau>Runs2\\<tau>Runs_table [simp]:\n  \"\\<not> is_TNil tls \\<Longrightarrow>\n  thd (\\<tau>Runs2\\<tau>Runs_table s tls) =\n  (thd tls, SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls)\"\nby(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\n\n\n\nlemma terminal_\\<tau>Runs2\\<tau>Runs_table [simp]:\n  \"is_TNil tls \\<Longrightarrow> terminal (\\<tau>Runs2\\<tau>Runs_table s tls) = terminal tls\"\nby(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\n\nlemma \\<tau>Runs2\\<tau>Runs_table_simps [simp, nitpick_simp]:\n  \"\\<tau>Runs2\\<tau>Runs_table s (TNil so) = TNil so\"\n  \"\\<And>tl. \n   \\<tau>Runs2\\<tau>Runs_table s (TCons tl tls) =\n   (let s'' = SOME s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' \\<Down> tls\n    in TCons (tl, s'') (\\<tau>Runs2\\<tau>Runs_table s'' tls))\"\n apply(simp add: \\<tau>Runs2\\<tau>Runs_table_def)\napply(rule tllist.expand)\napply(simp_all)\ndone\n\nlemma \\<tau>Runs2\\<tau>Runs_table_inverse:\n  \"tmap fst id (\\<tau>Runs2\\<tau>Runs_table s tls) = tls\"\nby(coinduction arbitrary: s tls) auto\n \nlemma \\<tau>Runs_into_\\<tau>Runs_table:\n  assumes \"s \\<Down> tls\"\n  shows \"\\<exists>stlsss. tls = tmap fst id stlsss \\<and> \\<tau>Runs_table s stlsss\"\nproof(intro exI conjI)\n  from assms show \"\\<tau>Runs_table s (\\<tau>Runs2\\<tau>Runs_table s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (\\<tau>Runs_table s tls)\n    thus ?case\n    proof cases\n      case (Terminate s')\n      hence ?Terminate by simp\n      thus ?thesis ..\n    next\n      case Diverge\n      hence ?Diverge by simp\n      thus ?thesis by simp\n    next\n      case (Proceed s' s'' tls' tl)\n      let ?P = \"\\<lambda>s''. \\<exists>s'. s -\\<tau>\\<rightarrow>* s' \\<and> s' -tl\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' tl s'' \\<and> s'' \\<Down> tls'\"\n      from Proceed have \"?P s''\" by auto\n      hence \"?P (Eps ?P)\" by(rule someI)\n      hence ?Proceed using \\<open>tls = TCons tl tls'\\<close>\n        by(auto simp add: split_beta)\n      thus ?thesis by simp\n    qed\n  qed\nqed(simp add: \\<tau>Runs2\\<tau>Runs_table_inverse)\n\nlemma \\<tau>Runs_lappendtE:\n  assumes \"\\<sigma> \\<Down> lappendt tls tls'\"\n  and \"lfinite tls\"\n  obtains \\<sigma>' where \"\\<sigma> -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>'\"\n  and \"\\<sigma>' \\<Down> tls'\"\nproof(atomize_elim)\n  from \\<open>lfinite tls\\<close> \\<open>\\<sigma> \\<Down> lappendt tls tls'\\<close>\n  show \"\\<exists>\\<sigma>'. \\<sigma> -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>' \\<and> \\<sigma>' \\<Down> tls'\"\n  proof(induct arbitrary: \\<sigma>)\n    case lfinite_LNil thus ?case by(auto intro: \\<tau>rtrancl3p_refl)\n  next\n    case (lfinite_LConsI tls tl)\n    from \\<open>\\<sigma> \\<Down> lappendt (LCons tl tls) tls'\\<close>\n    show ?case unfolding lappendt_LCons\n    proof(cases)\n      case (Proceed \\<sigma>' \\<sigma>'')\n      from \\<open>\\<sigma>'' \\<Down> lappendt tls tls' \\<Longrightarrow> \\<exists>\\<sigma>'''. \\<sigma>'' -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>''' \\<and> \\<sigma>''' \\<Down> tls'\\<close> \\<open>\\<sigma>'' \\<Down> lappendt tls tls'\\<close>\n      obtain \\<sigma>''' where \"\\<sigma>'' -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>'''\" \"\\<sigma>''' \\<Down> tls'\" by blast\n      from \\<open>\\<sigma>' -tl\\<rightarrow> \\<sigma>''\\<close> \\<open>\\<not> \\<tau>move \\<sigma>' tl \\<sigma>''\\<close> \\<open>\\<sigma>'' -\\<tau>-list_of tls\\<rightarrow>* \\<sigma>'''\\<close>\n      have \"\\<sigma>' -\\<tau>-tl # list_of tls\\<rightarrow>* \\<sigma>'''\" by(rule \\<tau>rtrancl3p_step)\n      with \\<open>\\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>'\\<close> have \"\\<sigma> -\\<tau>-[] @ (tl # list_of tls)\\<rightarrow>* \\<sigma>'''\"\n        unfolding \\<tau>rtrancl3p_Nil_eq_\\<tau>moves[symmetric] by(rule \\<tau>rtrancl3p_trans)\n      with \\<open>lfinite tls\\<close> have \"\\<sigma> -\\<tau>-list_of (LCons tl tls)\\<rightarrow>* \\<sigma>'''\" by(simp add: list_of_LCons)\n      with \\<open>\\<sigma>''' \\<Down> tls'\\<close> show ?thesis by blast\n    qed\n  qed\nqed\n\nlemma \\<tau>Runs_total:\n  \"\\<exists>tls. \\<sigma> \\<Down> tls\"\nproof\n  let ?\\<tau>halt = \"\\<lambda>\\<sigma> \\<sigma>'. \\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>' \\<and> (\\<forall>tl \\<sigma>''. \\<not> \\<sigma>' -tl\\<rightarrow> \\<sigma>'')\"\n  let ?\\<tau>diverge = \"\\<lambda>\\<sigma>. \\<sigma> -\\<tau>\\<rightarrow> \\<infinity>\"\n  let ?proceed = \"\\<lambda>\\<sigma> (tl, \\<sigma>''). \\<exists>\\<sigma>'. \\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>' \\<and> \\<sigma>' -tl\\<rightarrow> \\<sigma>'' \\<and> \\<not> \\<tau>move \\<sigma>' tl \\<sigma>''\"\n\n  define tls where \"tls = unfold_tllist\n     (\\<lambda>\\<sigma>. (\\<exists>\\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>') \\<or> ?\\<tau>diverge \\<sigma>)\n     (\\<lambda>\\<sigma>. if \\<exists>\\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>' then Some (SOME \\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>') else None)\n     (\\<lambda>\\<sigma>. fst (SOME tl\\<sigma>'. ?proceed \\<sigma> tl\\<sigma>'))\n     (\\<lambda>\\<sigma>. snd (SOME tl\\<sigma>'. ?proceed \\<sigma> tl\\<sigma>')) \\<sigma>\"\n  then show \"\\<sigma> \\<Down> tls\"\n  proof(coinduct \\<sigma> tls rule: \\<tau>Runs.coinduct)\n    case (\\<tau>Runs \\<sigma> tls)\n    show ?case\n    proof(cases \"\\<exists>\\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>'\")\n      case True\n      hence \"?\\<tau>halt \\<sigma> (SOME \\<sigma>'. ?\\<tau>halt \\<sigma> \\<sigma>')\" by(rule someI_ex)\n      hence ?Terminate using True unfolding \\<tau>Runs by simp\n      thus ?thesis ..\n    next\n      case False\n      note \\<tau>halt = this\n      show ?thesis\n      proof(cases \"?\\<tau>diverge \\<sigma>\")\n        case True\n        hence ?Diverge using False unfolding \\<tau>Runs by simp\n        thus ?thesis by simp\n      next\n        case False\n        from not_\\<tau>diverge_to_no_\\<tau>move[OF this]\n        obtain \\<sigma>' where \\<sigma>_\\<sigma>': \"\\<sigma> -\\<tau>\\<rightarrow>* \\<sigma>'\"\n          and no_\\<tau>: \"\\<And>\\<sigma>''. \\<not> \\<sigma>' -\\<tau>\\<rightarrow> \\<sigma>''\" by blast\n        from \\<sigma>_\\<sigma>' \\<tau>halt obtain tl \\<sigma>'' where \"\\<sigma>' -tl\\<rightarrow> \\<sigma>''\" by auto\n        moreover with no_\\<tau>[of \\<sigma>''] have \"\\<not> \\<tau>move \\<sigma>' tl \\<sigma>''\" by auto\n        ultimately have \"?proceed \\<sigma> (tl, \\<sigma>'')\" using \\<sigma>_\\<sigma>' by auto\n        hence \"?proceed \\<sigma> (SOME tl\\<sigma>. ?proceed \\<sigma> tl\\<sigma>)\" by(rule someI)\n        hence ?Proceed using False \\<tau>halt unfolding \\<tau>Runs\n          by(subst unfold_tllist.code) fastforce\n        thus ?thesis by simp\n      qed\n    qed\n  qed\nqed\n\n\n\n\n\nlemma silent_moves2_into_silent_moves:\n  assumes \"silent_moves2 s tls s'\"\n  shows \"s -\\<tau>\\<rightarrow>* s'\"\nusing assms\nby(induct)(blast intro: silent_move2_into_silent_move rtranclp.rtrancl_into_rtrancl)+\n\nlemma silent_moves_into_silent_moves2:\n  assumes \"s -\\<tau>\\<rightarrow>* s'\"\n  shows \"\\<exists>tls. silent_moves2 s tls s'\"\nusing assms\nby(induct)(blast dest: silent_move_into_silent_move2 intro: rtrancl3p_step)+\n\n\n\nlemma \\<tau>diverge_into_inf_step_silent_move2:\n  assumes \"s -\\<tau>\\<rightarrow> \\<infinity>\"\n  obtains tls where \"trsys.inf_step silent_move2 s tls\"\nproof -\n  define tls where \"tls = unfold_llist\n     (\\<lambda>_. False)\n     (\\<lambda>s. fst (SOME (tl, s'). silent_move2 s tl s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>))\n     (\\<lambda>s. snd (SOME (tl, s'). silent_move2 s tl s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>))\n     s\" (is \"_ = ?tls s\")\n  \n  with assms have \"s -\\<tau>\\<rightarrow> \\<infinity> \\<and> tls = ?tls s\" by simp\n  hence \"trsys.inf_step silent_move2 s tls\"\n  proof(coinduct rule: trsys.inf_step.coinduct[consumes 1, case_names inf_step, case_conclusion inf_step step])\n    case (inf_step s tls)\n    let ?P = \"\\<lambda>(tl, s'). silent_move2 s tl s' \\<and> s' -\\<tau>\\<rightarrow> \\<infinity>\"\n    from inf_step obtain \"s -\\<tau>\\<rightarrow> \\<infinity>\" and tls: \"tls = ?tls s\" ..\n    from \\<open>s -\\<tau>\\<rightarrow> \\<infinity>\\<close> obtain s' where \"s -\\<tau>\\<rightarrow> s'\" \"s' -\\<tau>\\<rightarrow> \\<infinity>\" by cases\n    from \\<open>s -\\<tau>\\<rightarrow> s'\\<close> obtain tl where \"silent_move2 s tl s'\" \n      by(blast dest: silent_move_into_silent_move2)\n    with \\<open>s' -\\<tau>\\<rightarrow> \\<infinity>\\<close> have \"?P (tl, s')\" by simp\n    hence \"?P (Eps ?P)\" by(rule someI)\n    thus ?case using tls\n      by(subst (asm) unfold_llist.code)(auto)\n  qed\n  thus thesis by(rule that)\nqed\n\nlemma \\<tau>Runs_into_\\<tau>rtrancl3p:\n  assumes runs: \"s \\<Down> tlss\"\n  and fin: \"tfinite tlss\"\n  and terminal: \"terminal tlss = Some s'\"\n  shows \"\\<tau>rtrancl3p s (list_of (llist_of_tllist tlss)) s'\"\nusing fin runs terminal\nproof(induct arbitrary: s rule: tfinite_induct)\n  case TNil thus ?case by cases(auto intro: silent_moves_into_\\<tau>rtrancl3p)\nnext\n  case (TCons tl tlss)\n  from \\<open>s \\<Down> TCons tl tlss\\<close> obtain s'' s'''\n    where step: \"s -\\<tau>\\<rightarrow>* s''\"\n    and step2: \"s'' -tl\\<rightarrow> s'''\" \"\\<not> \\<tau>move s'' tl s'''\" \n    and \"s''' \\<Down> tlss\" by cases\n  from \\<open>terminal (TCons tl tlss) = \\<lfloor>s'\\<rfloor>\\<close> have \"terminal tlss = \\<lfloor>s'\\<rfloor>\" by simp\n  with \\<open>s''' \\<Down> tlss\\<close> have \"s''' -\\<tau>-list_of (llist_of_tllist tlss)\\<rightarrow>* s'\" by(rule TCons)\n  with step2 have \"s'' -\\<tau>-tl # list_of (llist_of_tllist tlss)\\<rightarrow>* s'\" by(rule \\<tau>rtrancl3p_step)\n  with step have \"s -\\<tau>-[] @ tl # list_of (llist_of_tllist tlss)\\<rightarrow>* s'\"\n    by(rule \\<tau>rtrancl3p_trans[OF silent_moves_into_\\<tau>rtrancl3p])\n  thus ?case using \\<open>tfinite tlss\\<close> by simp\nqed\n\nlemma \\<tau>Runs_terminal_stuck:\n  assumes Runs: \"s \\<Down> tlss\"\n  and fin: \"tfinite tlss\"\n  and terminal: \"terminal tlss = Some s'\"\n  and proceed: \"s' -tls\\<rightarrow> s''\"\n  shows False\nusing fin Runs terminal\nproof(induct arbitrary: s rule: tfinite_induct)\n  case TNil thus ?case using proceed by cases auto\nnext\n  case TCons thus ?case by(fastforce elim: \\<tau>Runs.cases)\nqed\n\nlemma Runs_table_silent_diverge:\n  \"\\<lbrakk> Runs_table s stlss; \\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'; \\<not> lfinite stlss \\<rbrakk>\n  \\<Longrightarrow> s -\\<tau>\\<rightarrow> \\<infinity>\"\nproof(coinduction arbitrary: s stlss)\n  case (\\<tau>diverge s)\n  thus ?case by cases(auto 5 2)\nqed\n\nlemma Runs_table_silent_rtrancl:\n  assumes \"lfinite stlss\"\n  and \"Runs_table s stlss\"\n  and \"\\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'\"\n  shows \"s -\\<tau>\\<rightarrow>* llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\" (is ?thesis1)\n  and \"llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss)) -tl'\\<rightarrow> s'' \\<Longrightarrow> False\" (is \"PROP ?thesis2\")\nproof -\n  from assms have \"?thesis1 \\<and> (llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss)) -tl'\\<rightarrow> s'' \\<longrightarrow> False)\"\n  proof(induct arbitrary: s)\n    case lfinite_LNil thus ?case by(auto elim: Runs_table.cases)\n  next\n    case (lfinite_LConsI stlss stls)\n    from \\<open>Runs_table s (LCons stls stlss)\\<close>\n    obtain tl s' where [simp]: \"stls = (s, tl, s')\"\n      and \"s -tl\\<rightarrow> s'\" and Run': \"Runs_table s' stlss\" by cases\n    from \\<open>\\<forall>(s, tl, s')\\<in>lset (LCons stls stlss). \\<tau>move s tl s'\\<close>\n    have \"\\<tau>move s tl s'\" and silent': \"\\<forall>(s, tl, s')\\<in>lset stlss. \\<tau>move s tl s'\" by simp_all\n    from \\<open>s -tl\\<rightarrow> s'\\<close> \\<open>\\<tau>move s tl s'\\<close> have \"s -\\<tau>\\<rightarrow> s'\" by auto\n    moreover from Run' silent'\n    have \"s' -\\<tau>\\<rightarrow>* llast (LCons s' (lmap (\\<lambda>(s, tl, s'). s') stlss)) \\<and>\n          (llast (LCons s' (lmap (\\<lambda>(s, tl, s'). s') stlss)) -tl'\\<rightarrow> s'' \\<longrightarrow> False)\"\n      by(rule lfinite_LConsI)\n    ultimately show ?case by(auto)\n  qed\n  thus ?thesis1 \"PROP ?thesis2\" by blast+\nqed\n\nlemma Runs_table_silent_lappendD:\n  fixes s stlss\n  defines \"s' \\<equiv> llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\"\n  assumes Runs: \"Runs_table s (lappend stlss stlss')\"\n  and fin: \"lfinite stlss\"\n  and silent: \"\\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'\"\n  shows \"s -\\<tau>\\<rightarrow>* s'\" (is ?thesis1)\n  and \"Runs_table s' stlss'\" (is ?thesis2)\n  and \"stlss' \\<noteq> LNil \\<Longrightarrow> s' = fst (lhd stlss')\" (is \"PROP ?thesis3\")\nproof -\n  from fin Runs silent\n  have \"?thesis1 \\<and> ?thesis2 \\<and> (stlss' \\<noteq> LNil \\<longrightarrow> s' = fst (lhd stlss'))\"\n    unfolding s'_def\n  proof(induct arbitrary: s)\n    case lfinite_LNil thus ?case\n      by(auto simp add: neq_LNil_conv Runs_table_simps)\n  next\n    case lfinite_LConsI thus ?case\n      by(clarsimp simp add: neq_LNil_conv Runs_table_simps)(blast intro: converse_rtranclp_into_rtranclp)\n  qed\n  thus ?thesis1 ?thesis2 \"PROP ?thesis3\" by simp_all\nqed\n\nlemma Runs_table_into_\\<tau>Runs:\n  fixes s stlss\n  defines \"tls \\<equiv> tmap (\\<lambda>(s, tl, s'). tl) id (tfilter None (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') (tllist_of_llist (Some (llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss)))) stlss))\"\n  (is \"_ \\<equiv> ?conv s stlss\")\n  assumes \"Runs_table s stlss\"\n  shows \"\\<tau>Runs s tls\"\nusing assms\nproof(coinduction arbitrary: s tls stlss)\n  case (\\<tau>Runs s tls stlss)\n  note tls = \\<open>tls = ?conv s stlss\\<close>\n    and Run = \\<open>Runs_table s stlss\\<close>\n  show ?case\n  proof(cases tls)\n    case [simp]: (TNil so)\n    from tls\n    have silent: \"\\<forall>(s, tl, s') \\<in> lset stlss. \\<tau>move s tl s'\"\n      by(auto simp add: TNil_eq_tmap_conv tfilter_empty_conv)\n    show ?thesis\n    proof(cases \"lfinite stlss\")\n      case False\n      with Run silent have \"s -\\<tau>\\<rightarrow> \\<infinity>\" by(rule Runs_table_silent_diverge)\n      hence ?Diverge using False tls by(simp add: TNil_eq_tmap_conv tfilter_empty_conv)\n      thus ?thesis by simp\n    next\n      case True\n      with Runs_table_silent_rtrancl[OF this Run silent]\n      have ?Terminate using tls\n        by(auto simp add: TNil_eq_tmap_conv tfilter_empty_conv terminal_tllist_of_llist split_def)\n      thus ?thesis by simp\n    qed\n  next\n    case [simp]: (TCons tl tls')\n    from tls obtain s' s'' stlss' \n      where tl': \"tfilter None (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') (tllist_of_llist \\<lfloor>llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\\<rfloor> stlss) = TCons (s', tl, s'') stlss'\"\n      and tls': \"tls' = tmap (\\<lambda>(s, tl, s'). tl) id stlss'\"\n      by(simp add: TCons_eq_tmap_conv split_def id_def split_paired_Ex) blast\n    from tfilter_eq_TConsD[OF tl']\n    obtain stls\\<tau> rest\n      where stlss_eq: \"tllist_of_llist \\<lfloor>llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\\<rfloor> stlss = lappendt stls\\<tau> (TCons (s', tl, s'') rest)\"\n      and fin: \"lfinite stls\\<tau>\"\n      and silent: \"\\<forall>(s, tl, s')\\<in>lset stls\\<tau>. \\<tau>move s tl s'\"\n      and \"\\<not> \\<tau>move s' tl s''\"\n      and stlss': \"stlss' = tfilter None (\\<lambda>(s, tl, s'). \\<not> \\<tau>move s tl s') rest\"\n      by(auto simp add: split_def)\n    from stlss_eq fin obtain rest'\n      where stlss: \"stlss = lappend stls\\<tau> rest'\"\n      and rest': \"tllist_of_llist \\<lfloor>llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stlss))\\<rfloor> rest' = TCons (s', tl, s'') rest\"\n      unfolding tllist_of_llist_eq_lappendt_conv by auto\n    hence \"rest' \\<noteq> LNil\" by clarsimp\n    from Run[unfolded stlss] fin silent\n    have \"s -\\<tau>\\<rightarrow>* llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stls\\<tau>))\"\n      and \"Runs_table (llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stls\\<tau>))) rest'\"\n      and \"llast (LCons s (lmap (\\<lambda>(s, tl, s'). s') stls\\<tau>)) = fst (lhd rest')\"\n      by(rule Runs_table_silent_lappendD)+(simp add: \\<open>rest' \\<noteq> LNil\\<close>)\n    moreover with rest' \\<open>rest' \\<noteq> LNil\\<close> stlss fin obtain rest''\n      where rest': \"rest' = LCons (s', tl, s'') rest''\"\n      and rest: \"rest = tllist_of_llist \\<lfloor>llast (LCons s'' (lmap (\\<lambda>(s, tl, s'). s') rest''))\\<rfloor> rest''\"\n      by(clarsimp simp add: neq_LNil_conv llast_LCons lmap_lappend_distrib)\n    ultimately have \"s -\\<tau>\\<rightarrow>* s'\" \"s' -tl\\<rightarrow> s''\" \"Runs_table s'' rest''\"\n      by(simp_all add: Runs_table_simps)\n    hence ?Proceed using \\<open>\\<not> \\<tau>move s' tl s''\\<close> tls' stlss' rest\n      by(auto simp add: id_def)\n    thus ?thesis by simp\n  qed\nqed\n\nlemma \\<tau>Runs_table2_into_\\<tau>Runs:\n  \"\\<tau>Runs_table2 s tlsstlss\n  \\<Longrightarrow> s \\<Down> tmap (\\<lambda>(tls, s', tl, s''). tl) (\\<lambda>x. case x of Inl (tls, s') \\<Rightarrow> Some s' | Inr _ \\<Rightarrow> None) tlsstlss\"\nproof(coinduction arbitrary: s tlsstlss)\n  case (\\<tau>Runs s tlsstlss)\n  thus ?case by cases(auto intro: silent_moves2_into_silent_moves inf_step_silent_move2_into_\\<tau>diverge)\nqed\n\nlemma \\<tau>Runs_into_\\<tau>Runs_table2:\n  assumes \"s \\<Down> tls\"\n  obtains tlsstlss\n  where \"\\<tau>Runs_table2 s tlsstlss\"\n  and \"tls = tmap (\\<lambda>(tls, s', tl, s''). tl) (\\<lambda>x. case x of Inl (tls, s') \\<Rightarrow> Some s' | Inr _ \\<Rightarrow> None) tlsstlss\"\nproof -\n  let ?terminal = \"\\<lambda>s tls. case terminal tls of \n          None \\<Rightarrow> Inr (SOME tls'. trsys.inf_step silent_move2 s tls')\n        | Some s' \\<Rightarrow> let tls' = SOME tls'. silent_moves2 s tls' s' in Inl (tls', s')\"\n  let ?P = \"\\<lambda>s tls (tls'', s', s''). silent_moves2 s tls'' s' \\<and> s' -thd tls\\<rightarrow> s'' \\<and> \\<not> \\<tau>move s' (thd tls) s'' \\<and> s'' \\<Down> ttl tls\"\n  define tlsstlss where \"tlsstlss s tls = unfold_tllist\n      (\\<lambda>(s, tls). is_TNil tls)\n      (\\<lambda>(s, tls). ?terminal s tls)\n      (\\<lambda>(s, tls). let (tls'', s', s'') = Eps (?P s tls) in (tls'', s', thd tls, s''))\n      (\\<lambda>(s, tls). let (tls'', s', s'') = Eps (?P s tls) in (s'', ttl tls))\n      (s, tls)\"\n    for s tls\n\n  have [simp]:\n    \"\\<And>s tls. is_TNil (tlsstlss s tls) \\<longleftrightarrow> is_TNil tls\"\n    \"\\<And>s tls. is_TNil tls \\<Longrightarrow> terminal (tlsstlss s tls) = ?terminal s tls\"\n    \"\\<And>s tls. \\<not> is_TNil tls \\<Longrightarrow> thd (tlsstlss s tls) = (let (tls'', s', s'') = Eps (?P s tls) in (tls'', s', thd tls, s''))\"\n    \"\\<And>s tls. \\<not> is_TNil tls \\<Longrightarrow> ttl (tlsstlss s tls) = (let (tls'', s', s'') = Eps (?P s tls) in tlsstlss s'' (ttl tls))\"\n    by(simp_all add: tlsstlss_def split_beta)\n\n  have [simp]:\n    \"\\<And>s. tlsstlss s (TNil None) = TNil (Inr (SOME tls'. trsys.inf_step silent_move2 s tls'))\"\n    \"\\<And>s s'. tlsstlss s (TNil (Some s')) = TNil (Inl (SOME tls'. silent_moves2 s tls' s', s'))\"\n    unfolding tlsstlss_def by simp_all\n\n  let ?conv = \"tmap (\\<lambda>(tls, s', tl, s''). tl) (\\<lambda>x. case x of Inl (tls, s') \\<Rightarrow> Some s' | Inr _ \\<Rightarrow> None)\"\n  from assms have \"\\<tau>Runs_table2 s (tlsstlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (\\<tau>Runs_table2 s tls)\n    thus ?case\n    proof(cases)\n      case (Terminate s')\n      let ?P = \"\\<lambda>tls'. silent_moves2 s tls' s'\"\n      from \\<open>s -\\<tau>\\<rightarrow>* s'\\<close> obtain tls' where \"?P tls'\" by(blast dest: silent_moves_into_silent_moves2)\n      hence \"?P (Eps ?P)\" by(rule someI)\n      with Terminate have ?Terminate by auto\n      thus ?thesis by simp\n    next\n      case Diverge\n      let ?P = \"\\<lambda>tls'. trsys.inf_step silent_move2 s tls'\"\n      from \\<open>s -\\<tau>\\<rightarrow> \\<infinity>\\<close> obtain tls' where \"?P tls'\" by(rule \\<tau>diverge_into_inf_step_silent_move2)\n      hence \"?P (Eps ?P)\" by(rule someI)\n      hence ?Diverge using \\<open>tls = TNil None\\<close> by simp\n      thus ?thesis by simp\n    next\n      case (Proceed s' s'' tls' tl)\n      from \\<open>s -\\<tau>\\<rightarrow>* s'\\<close> obtain tls'' where \"silent_moves2 s tls'' s'\"\n        by(blast dest: silent_moves_into_silent_moves2)\n      with Proceed have \"?P s tls (tls'', s', s'')\" by simp\n      hence \"?P s tls (Eps (?P s tls))\" by(rule someI)\n      hence ?Proceed using Proceed unfolding tlsstlss_def\n        by(subst unfold_tllist.code)(auto simp add: split_def)\n      thus ?thesis by simp\n    qed\n  qed\n  moreover\n  from assms have \"tls = ?conv (tlsstlss s tls)\"\n  proof(coinduction arbitrary: s tls)\n    case (Eq_tllist s tls)\n    thus ?case\n    proof(cases)\n      case (Proceed s' s'' tls' tl)\n      from \\<open>s -\\<tau>\\<rightarrow>* s'\\<close> obtain tls'' where \"silent_moves2 s tls'' s'\"\n        by(blast dest: silent_moves_into_silent_moves2)\n      with Proceed have \"?P s tls (tls'', s', s'')\" by simp\n      hence \"?P s tls (Eps (?P s tls))\" by(rule someI)\n      thus ?thesis using \\<open>tls = TCons tl tls'\\<close> by auto\n    qed auto\n  qed\n  ultimately show thesis by(rule that)\nqed\n\nlemma \\<tau>Runs_table2_into_Runs:\n  assumes \"\\<tau>Runs_table2 s tlsstlss\"\n  shows \"Runs s (lconcat (lappend (lmap (\\<lambda>(tls, s, tl, s'). llist_of (tls @ [tl])) (llist_of_tllist tlsstlss)) (LCons (case terminal tlsstlss of Inl (tls, s') \\<Rightarrow> llist_of tls | Inr tls \\<Rightarrow> tls) LNil)))\"\n  (is \"Runs _ (?conv tlsstlss)\")\nusing assms\nproof(coinduction arbitrary: s tlsstlss)\n  case (Runs s tlsstlss)\n  thus ?case\n  proof(cases)\n    case (Terminate tls' s')\n    from \\<open>silent_moves2 s tls' s'\\<close> show ?thesis\n    proof(cases rule: rtrancl3p_converseE)\n      case refl \n      hence ?Stuck using Terminate by simp\n      thus ?thesis ..\n    next\n      case (step tls'' tl s'')\n      from \\<open>silent_moves2 s'' tls'' s'\\<close> \\<open>\\<And>tl s''. \\<not> s' -tl\\<rightarrow> s''\\<close>\n      have \"\\<tau>Runs_table2 s'' (TNil (Inl (tls'', s')))\" ..\n      with \\<open>tls' = tl # tls''\\<close> \\<open>silent_move2 s tl s''\\<close> \\<open>tlsstlss = TNil (Inl (tls', s'))\\<close>\n      have ?Step by(auto simp add: silent_move2_def intro!: exI)\n      thus ?thesis ..\n    qed\n  next\n    case (Diverge tls')\n    from \\<open>trsys.inf_step silent_move2 s tls'\\<close>\n    obtain tl tls'' s' where \"silent_move2 s tl s'\" \n      and \"tls' = LCons tl tls''\" \"trsys.inf_step silent_move2 s' tls''\"\n      by(cases rule: trsys.inf_step.cases[consumes 1]) auto\n    from \\<open>trsys.inf_step silent_move2 s' tls''\\<close>\n    have \"\\<tau>Runs_table2 s' (TNil (Inr tls''))\" ..\n    hence ?Step using \\<open>tlsstlss = TNil (Inr tls')\\<close> \\<open>tls' = LCons tl tls''\\<close> \\<open>silent_move2 s tl s'\\<close>\n      by(auto simp add: silent_move2_def intro!: exI)\n    thus ?thesis ..\n  next\n    case (Proceed tls' s' s'' tlsstlss' tl)\n    from \\<open>silent_moves2 s tls' s'\\<close> have ?Step\n    proof(cases rule: rtrancl3p_converseE)\n      case refl with Proceed show ?thesis by auto\n    next\n      case (step tls'' tl' s''')\n      from \\<open>silent_moves2 s''' tls'' s'\\<close> \\<open>s' -tl\\<rightarrow> s''\\<close> \\<open>\\<not> \\<tau>move s' tl s''\\<close> \\<open>\\<tau>Runs_table2 s'' tlsstlss'\\<close>\n      have \"\\<tau>Runs_table2 s''' (TCons (tls'', s', tl, s'') tlsstlss')\" ..\n      with \\<open>tls' = tl' # tls''\\<close> \\<open>silent_move2 s tl' s'''\\<close> \\<open>tlsstlss = TCons (tls', s', tl, s'') tlsstlss'\\<close>\n      show ?thesis by(auto simp add: silent_move2_def intro!: exI)\n    qed\n    thus ?thesis ..\n  qed\nqed\n\nlemma \\<tau>Runs_table2_silentsD:\n  fixes tl\n  assumes Runs: \"\\<tau>Runs_table2 s tlsstlss\"\n  and tset: \"(tls, s', tl', s'') \\<in> tset tlsstlss\"\n  and set: \"tl \\<in> set tls\"\n  shows \"\\<exists>s''' s''''. silent_move2 s''' tl s''''\"\nusing tset Runs\nproof(induct arbitrary: s rule: tset_induct)\n  case (find tlsstlss')\n  from \\<open>\\<tau>Runs_table2 s (TCons (tls, s', tl', s'') tlsstlss')\\<close>\n  have \"silent_moves2 s tls s'\" by cases\n  thus ?case using set by induct auto\nnext\n  case step thus ?case by(auto simp add: \\<tau>Runs_table2_simps)\nqed\n\nlemma \\<tau>Runs_table2_terminal_silentsD:\n  assumes Runs: \"\\<tau>Runs_table2 s tlsstlss\"\n  and fin: \"lfinite (llist_of_tllist tlsstlss)\"\n  and terminal: \"terminal tlsstlss = Inl (tls, s'')\"\n  shows \"\\<exists>s'. silent_moves2 s' tls s''\"\nusing fin Runs terminal\nproof(induct \"llist_of_tllist tlsstlss\" arbitrary: tlsstlss s)\n  case lfinite_LNil thus ?case \n    by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nnext\n  case (lfinite_LConsI xs tlsstls)\n  thus ?case by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nqed\n\nlemma \\<tau>Runs_table2_terminal_inf_stepD:\n  assumes Runs: \"\\<tau>Runs_table2 s tlsstlss\"\n  and fin: \"lfinite (llist_of_tllist tlsstlss)\"\n  and terminal: \"terminal tlsstlss = Inr tls\"\n  shows \"\\<exists>s'. trsys.inf_step silent_move2 s' tls\"\nusing fin Runs terminal\nproof(induct \"llist_of_tllist tlsstlss\" arbitrary: s tlsstlss)\n  case lfinite_LNil thus ?case\n    by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nnext\n  case (lfinite_LConsI xs tlsstls)\n  thus ?case by(cases tlsstlss)(auto simp add: \\<tau>Runs_table2_simps)\nqed\n\nlemma \\<tau>Runs_table2_lappendtD:\n  assumes Runs: \"\\<tau>Runs_table2 s (lappendt tlsstlss tlsstlss')\"\n  and fin: \"lfinite tlsstlss\"\n  shows \"\\<exists>s'. \\<tau>Runs_table2 s' tlsstlss'\"\nusing fin Runs\nby(induct arbitrary: s)(auto simp add: \\<tau>Runs_table2_simps)\n\nend\n\nlemma \\<tau>moves_False: \"\\<tau>trsys.silent_move r (\\<lambda>s ta s'. False) = (\\<lambda>s s'. False)\"\nby(auto simp add: \\<tau>trsys.silent_move_iff)\n\nlemma \\<tau>rtrancl3p_False_eq_rtrancl3p: \"\\<tau>trsys.\\<tau>rtrancl3p r (\\<lambda>s tl s'. False) = rtrancl3p r\"\nproof(intro ext iffI)\n  fix s tls s'\n  assume \"\\<tau>trsys.\\<tau>rtrancl3p r (\\<lambda>s tl s'. False) s tls s'\"\n  thus \"rtrancl3p r s tls s'\" by(rule \\<tau>trsys.\\<tau>rtrancl3p.induct)(blast intro: rtrancl3p_step_converse)+\nnext\n  fix s tls s'\n  assume \"rtrancl3p r s tls s'\"\n  thus \"\\<tau>trsys.\\<tau>rtrancl3p r (\\<lambda>s tl s'. False) s tls s'\"\n    by(induct rule: rtrancl3p_converse_induct)(auto intro: \\<tau>trsys.\\<tau>rtrancl3p.intros)\nqed\n\nlemma \\<tau>diverge_empty_\\<tau>move:\n  \"\\<tau>trsys.\\<tau>diverge r (\\<lambda>s ta s'. False) = (\\<lambda>s. False)\"\nby(auto intro!: ext elim: \\<tau>trsys.\\<tau>diverge.cases \\<tau>trsys.silent_move.cases)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Framework/LTS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5964331462646255, "lm_q1q2_score": 0.31450905311659916}}
{"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n *  Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Indexing_Hoare\n  imports VHDL_Hoare_Complete\nbegin\n\ndatatype sig = IN | OUT\n\ndefinition index :: \"sig conc_stmt\" where\n  \"index \\<equiv> process {IN} : Bassign_trans OUT (Bindex IN 3) 1\"\n\nabbreviation \"bof_wline tw sig n \\<equiv> bval_of (wline_of tw sig n)\"\nabbreviation \"lof_wline tw sig n \\<equiv> lval_of (wline_of tw sig n)\"\n\ndefinition inv :: \"sig assn2\" where\n  \"inv tw \\<equiv> (\\<forall>i < fst tw. bof_wline tw OUT (i + 1) = (lof_wline tw IN i) ! 3)\"\n\ndefinition inv' :: \"sig assn2\" where\n  \"inv' tw = (disjnt {IN} (event_of tw) \\<longrightarrow> (\\<forall>i\\<ge>fst tw. bof_wline tw OUT (i + 1) = (lof_wline tw IN (fst tw)) ! 3))\"\n\nlemma potential_tyenv:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows   \"\\<exists>ki len. 3 < len \\<and> \\<Gamma> IN = Lty ki len \\<and> \\<Gamma> OUT = Bty\"\nproof (rule seq_wt_cases(4)[OF assms])\n  assume \"bexp_wt \\<Gamma> (Bindex IN 3) (\\<Gamma> OUT)\"\n  then obtain ki len where \"bexp_wt \\<Gamma> (Bsig IN) (Lty ki len) \\<and> 3 < len \\<and> \\<Gamma> OUT = Bty\"\n    by (meson bexp_wt_cases_slice(3))\n  hence \"\\<Gamma> IN = Lty ki len\" and \"\\<Gamma> OUT = Bty\" and \"3 < len\"\n    by (metis bexp_wt_cases_slice(2))+\n  thus ?thesis\n    by blast\nqed\n\nlemma inv_next_time:\n  assumes \"inv tw\"\n  assumes \"beval_world_raw2 tw (Bindex IN 3) x\" and \"type_of x = Bty\"\n  defines \"tw' \\<equiv> tw[OUT, 1 :=\\<^sub>2 x]\"\n  shows   \"\\<forall>k \\<in> {fst tw' <.. next_time_world tw'}. inv (k, snd tw')\"\n  unfolding inv_def\nproof (rule, rule, rule)\n  fix k\n  assume \"k \\<in> {fst tw' <.. next_time_world tw'}\"\n  hence \"fst tw < k\"\n    by (simp add: tw'_def worldline_upd2_def)\n  fix i\n  assume \"i < fst (k, snd tw')\"\n  hence \"i < k\"\n    by auto\n  hence \"i < fst tw \\<or> fst tw \\<le> i \\<and> i < k - 1 \\<or> i = k - 1\"\n    by linarith\n  moreover\n  { assume \"i < fst tw\"\n    hence \"wline_of tw' OUT (i + 1) = wline_of tw OUT (i + 1)\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    hence \"bof_wline (k, snd tw') OUT (i + 1) =  bof_wline tw OUT (i + 1)\"\n      by simp\n    also have \"... = (lof_wline tw IN i) ! 3\"\n      using assms(1) \\<open>i < fst tw\\<close> unfolding inv_def by auto\n    also have \"... = (lof_wline (k, snd tw') IN i) ! 3\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    finally have \"bof_wline (k, snd tw') OUT (i + 1) =\n                 (lof_wline (k, snd tw') IN i) ! 3\"\n      by auto }\n  moreover\n  { assume \"fst tw \\<le> i \\<and> i < k - 1\"\n    hence \"bof_wline tw' OUT (i + 1) = bof_wline tw' OUT (fst tw + 1)\"\n      using unchanged_until_next_time_world\n      by (smt \\<open>k \\<in> {get_time tw'<..next_time_world tw'}\\<close> dual_order.strict_trans1\n      greaterThanAtMost_iff le_add1 less_diff_conv not_le prod.exhaust_sel prod.inject tw'_def\n      worldline_upd2_def)\n    also have \"... = bval_of x\"\n      using assms(4)  by (metis worldline_upd2_at_dly)\n    also have \"... = lof_wline tw IN (fst tw) ! 3\"\n    proof -\n      have assm2: \"beval_world_raw (snd tw) (fst tw) (Bindex IN 3) x\"\n        using assms(2) unfolding beval_world_raw2_def by auto\n      have \"\\<not> is_Bv (wline_of tw IN (fst tw))\"\n        apply (rule beval_world_raw_cases[OF assm2], erule beval_cases)\n        by (metis beval_cases(1) comp_apply state_of_world_def val.disc(2))\n      then obtain ki where \"state_of_world (snd tw) (fst tw) IN = Lv ki (lof_wline tw IN (fst tw))\"\n        unfolding state_of_world_def  by (metis comp_def val.collapse(2))\n      show ?thesis\n        apply (rule beval_world_raw_cases[OF assm2])\n        apply (erule beval_cases)+\n        using \\<open>state_of_world (snd tw) (fst tw) IN = Lv ki (lof_wline tw IN (fst tw))\\<close> by simp\n    qed\n    also have \"... = lof_wline (k, snd tw') IN i ! 3\"\n      by (smt \\<open>get_time tw \\<le> i \\<and> i < k - 1\\<close> \\<open>i < k\\<close> \\<open>k \\<in> {get_time tw'<..next_time_world tw'}\\<close>\n      comp_def dual_order.strict_trans1 fst_conv greaterThanAtMost_iff sig.simps(2) snd_conv tw'_def\n      unchanged_until_next_time_world worldline_upd2_def worldline_upd_def)\n    finally have \"bof_wline (k, snd tw') OUT (i + 1) =\n                 (lof_wline (k, snd tw') IN i) ! 3\"\n      by auto }\n  moreover\n  { assume \"i = k - 1\"\n    hence \"bof_wline tw' OUT (i + 1) = bof_wline tw' OUT (k)\"\n      using \\<open>get_time tw < k\\<close> by auto\n    also have \"... = bof_wline tw' OUT (fst tw' + 1)\"\n      by (smt Suc_eq_plus1 \\<open>get_time tw < k\\<close> comp_apply less_Suc_eq order.asym prod.sel(1) snd_conv\n      tw'_def worldline_upd2_def worldline_upd_def)\n    also have \"... = bof_wline tw' OUT (fst tw + 1)\"\n      by (simp add: tw'_def worldline_upd2_def)\n    also have \"... = bval_of x\"\n      using assms(4)  by (metis worldline_upd2_at_dly)\n    also have \"... = lof_wline tw IN (fst tw) ! 3\"\n    proof -\n      have assm2: \"beval_world_raw (snd tw) (fst tw) (Bindex IN 3) x\"\n        using assms(2) unfolding beval_world_raw2_def by auto\n      have \"\\<not> is_Bv (wline_of tw IN (fst tw))\"\n        apply (rule beval_world_raw_cases[OF assm2], erule beval_cases)\n        by (metis beval_cases(1) comp_apply state_of_world_def val.disc(2))\n      then obtain ki where \"state_of_world (snd tw) (fst tw) IN = Lv ki (lof_wline tw IN (fst tw))\"\n        unfolding state_of_world_def by (metis comp_def val.collapse(2))\n      show ?thesis\n        apply (rule beval_world_raw_cases[OF assm2])\n        apply (erule beval_cases)+\n        using \\<open>state_of_world (snd tw) (fst tw) IN = Lv ki (lof_wline tw IN (fst tw))\\<close> by simp\n    qed\n    also have \"... = lof_wline (k, snd tw') IN i ! 3\"\n      by (smt \\<open>i < k\\<close> \\<open>i = k - 1\\<close> \\<open>k \\<in> {get_time tw'<..next_time_world tw'}\\<close> add_le_imp_le_diff\n      comp_def discrete dual_order.strict_trans1 fst_conv greaterThanAtMost_iff sig.simps(2)\n      snd_conv tw'_def unchanged_until_next_time_world worldline_upd2_def worldline_upd_def)\n    finally have \"bof_wline (k, snd tw') OUT (i + 1) =\n                 (lof_wline (k, snd tw') IN i) ! 3\"\n      by auto }\n  ultimately show \"bof_wline (k, snd tw') OUT (i + 1) = lof_wline (k, snd tw') IN i ! 3\"\n    by auto\nqed\n\nlemma type_correctness_length:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  assumes \"beval_world_raw2 tw (Bindex IN 3) x\"\n  shows   \"type_of x = Bty\"\nproof -\n  obtain ki len where \"\\<Gamma> IN = Lty ki len\" and \"3 < len\"\n    using potential_tyenv[OF assms(1)] by auto\n  have *: \"beval_world_raw (snd tw) (fst tw) (Bindex IN 3) x\"\n    using assms(3) unfolding beval_world_raw2_def by auto\n  have \"type_of (state_of_world (snd tw) (fst tw) IN) = Lty ki len\"\n    using assms(2) unfolding wityping_def\n    by (simp add: \\<open>\\<Gamma> IN = Lty ki len\\<close> state_of_world_def wtyping_def)\n  hence **: \"\\<And>bs. state_of_world (snd tw) (fst tw) IN = Lv ki bs \\<Longrightarrow> length bs = len\"\n    by simp\n  show ?thesis\n    apply (rule beval_world_raw_cases[OF *])\n    apply (erule beval_cases)+\n    using \\<open>3 < len\\<close> **  by simp\nqed\n\nlemma index_seq_hoare_next_time:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows   \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)] Bassign_trans OUT (Bindex IN 3) 1 \n             [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)]\"\n  apply (rule Assign2_altI)\n  using inv_next_time type_correctness_length[OF assms] by blast\n\nlemma index_seq_hoare_next_time0:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows   \"\\<turnstile> [\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)] Bassign_trans OUT (Bindex IN 3) 1 [\\<lambda>tw. inv (next_time_world tw, snd tw)]\"\n  apply (rule Assign2_altI)\n  using inv_next_time type_correctness_length[OF assms]  Indexing_Hoare.inv_def gr_implies_not_zero\n  by (metis greaterThanAtMost_iff next_time_world_at_least order_refl)\n\nlemma index_conc_hoare:\n  \"\\<And>tw. inv tw \\<and> inv' tw \\<and> disjnt {IN} (event_of tw) \\<Longrightarrow> \\<forall>i \\<in> {fst tw <.. next_time_world tw}. inv (i, snd tw)\"\n  by (smt Indexing_Hoare.inv_def comp_apply dual_order.strict_trans1 fst_conv greaterThanAtMost_iff\n  inv'_def not_less snd_conv unchanged_until_next_time_world)\n\nlemma index_conc_hoare2:\n  \"\\<And>tw. inv tw \\<and> inv' tw \\<and> disjnt {IN} (event_of tw) \\<Longrightarrow> \\<forall>i \\<in> {fst tw <.. next_time_world tw}. inv' (i, snd tw)\"\n  unfolding inv_def inv'_def\n  by (smt Suc_diff_1 comp_apply diff_less disjnt_insert1 event_of_alt_def fst_conv\n  gr_implies_not_zero greaterThanAtMost_iff le_Suc_eq le_less_trans less_le mem_Collect_eq\n  nat_neq_iff snd_conv unchanged_until_next_time_world zero_less_one)\n\nlemma inv'_next_time:\n  fixes tw\n  assumes \"beval_world_raw2 tw (Bindex IN 3) x\" and \"type_of x = Bty\"\n  defines \"tw' \\<equiv> tw[OUT, 1 :=\\<^sub>2 x]\"\n  shows   \"\\<forall>j \\<in> {fst tw' <.. next_time_world tw'}. inv' (j, snd tw')\"\n  unfolding inv'_def\nproof (rule, rule, rule, rule)\n  fix i j\n  assume \"j \\<in> {fst tw' <.. next_time_world tw'}\"\n  assume \"disjnt {IN} (event_of (j, snd tw'))\"\n  hence \"IN \\<notin> event_of (j, snd tw')\"\n    by auto\n  assume \"fst (j, snd tw') \\<le> i\"\n  hence \"j \\<le> i\"\n    by auto\n  have \"fst tw' < j\"\n    using next_time_world_at_least \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close> greaterThanAtMost_iff\n    by blast\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def unfolding worldline_upd2_def by auto\n  ultimately have \"fst tw < j\"\n    by auto\n  have \"wline_of (j, snd tw') OUT (i + 1) = wline_of tw' OUT (i + 1)\"\n    by auto\n  also have \"... = x\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def using \\<open>j \\<le> i\\<close> \\<open>fst tw < j\\<close>\n    by auto\n  also have \"bval_of ... = lof_wline tw IN (fst tw) ! 3\"\n  proof -\n    have assm: \"beval_world_raw (snd tw) (fst tw) (Bindex IN 3) x\"\n      using assms(1) unfolding beval_world_raw2_def by auto\n    show ?thesis\n      apply (rule beval_world_raw_cases[OF assm])\n      apply (erule beval_cases)+\n      by (metis comp_apply state_of_world_def val.sel(1) val.sel(3))\n  qed\n  also have \"... = lof_wline tw IN (fst tw') ! 3\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = lof_wline tw' IN (j) ! 3\"\n  proof -\n    have \"wline_of tw' IN j = wline_of tw' IN (j - 1)\"\n      using \\<open>IN \\<notin> event_of (j, snd tw')\\<close> unfolding event_of_alt_def\n      using \\<open>get_time tw < j\\<close> by auto\n    also have \"... = wline_of tw' IN (fst tw')\"\n      using unchanged_until_next_time_world\n      by (metis (no_types, lifting) Suc_diff_1 \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close>\n      gr_implies_not_zero greaterThanAtMost_iff le_0_eq less_Suc_eq_le not_less)\n    also have \"... = wline_of tw' IN (fst tw)\"\n      by (simp add: \\<open>get_time tw = get_time tw'\\<close>)\n    also have \"... = wline_of tw IN (fst tw)\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by simp\n    finally have \"wline_of tw' IN j = wline_of tw IN (fst tw)\"\n      by auto\n    thus ?thesis\n      using \\<open>fst tw = fst tw'\\<close> by simp\n  qed\n  also have \"... = lof_wline (j, snd tw') IN j ! 3\"\n    by auto\n  finally show \"bof_wline (j, snd tw') OUT (i + 1) = lof_wline (j, snd tw') IN (get_time (j, snd tw')) ! 3\"\n    by simp\nqed\n\nlemma index_seq_hoare_next_time1:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows   \"\\<turnstile> [\\<lambda>tw. wityping \\<Gamma> (snd tw)] \n                  Bassign_trans OUT (Bindex IN 3) 1 \n             [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv' (j, snd tw)]\"\n  apply (rule Assign2_altI)\n  using inv'_next_time type_correctness_length[OF assms]  by blast\n\nlemma index_conc_hoare3:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n              index \n           \\<lbrace>\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw) \\<and> inv' (j, snd tw)\\<rbrace>\"\n  unfolding index_def\n  apply (rule Single)\n   apply (rule Conj_univ_qtfd)\n    apply (rule Conseq2[rotated])\n      apply (rule index_seq_hoare_next_time[OF assms])\n     apply blast+\n   apply (rule Conseq2[rotated])\n     apply(rule index_seq_hoare_next_time1[OF assms])\n    apply blast+\n  using index_conc_hoare index_conc_hoare2 by blast\n\nlemma index_conc_hoare4:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n              index \n           \\<lbrace>\\<lambda>tw. \\<forall>i \\<in> {fst tw <.. next_time_world tw}. (inv (i, snd tw) \\<and> inv' (i, snd tw)) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule Conj2_univ_qtfd[where S=\"\\<lambda>tw. {fst tw <.. next_time_world tw}\" and Q=\"\\<lambda>tw. inv tw \\<and> inv' tw\" and R=\"\\<lambda>tw. wityping \\<Gamma> (snd tw)\",\n                        unfolded snd_conv])\n   apply (rule weaken_post_conc_hoare[OF _ index_conc_hoare3[OF assms]], simp)\n  apply (rule strengthen_pre_conc_hoare[rotated])\n  apply (rule weaken_post_conc_hoare[rotated])\n  unfolding index_def apply (rule single_conc_stmt_preserve_wityping_hoare[OF assms])\n  by auto\n\nlemma index_conc_sim':\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows   \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> index \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule While)\n  apply (unfold snd_conv, rule index_conc_hoare4[OF assms])\n  done\n\nlemma index_conc_sim2':\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows   \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv' tw\\<rbrace> index \\<lbrace>inv\\<rbrace>\"\n  using index_conc_sim' Conseq_sim assms by smt\n\nlemma init_sat_index_inv:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows   \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) index (\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw))\"\n  unfolding index_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conj)\n  unfolding snd_conv apply (rule index_seq_hoare_next_time0[OF assms])\n  apply (rule strengthen_precondition2)\n  by (metis assms seq_stmt_preserve_wityping_hoare)\n\nlemma init_sat_index_inv2:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows \"init_sim_hoare (\\<lambda>tw. wityping \\<Gamma> (snd tw)) index inv'\"\n  unfolding index_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conseq2[rotated])\n  apply (rule index_seq_hoare_next_time1[OF assms])\n  by (auto simp add: next_time_world_at_least)\n\nlemma init_sat_slicer_inv_comb:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n  shows   \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) index (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv' tw)\"\n  apply (rule ConjI_sim)\n  apply (rule init_sat_index_inv[OF assms])\n  apply (rule ConseqI_sim[rotated])\n  apply (rule init_sat_index_inv2[OF assms])\n  by blast+\n\nlemma slicer_correctness:\n  assumes \"sim_fin w (i + 1) index tw'\" and \"wityping \\<Gamma> w\"\n  assumes \"conc_wt \\<Gamma> index\"\n  shows   \"bof_wline tw' OUT (i + 1) = lof_wline tw' IN i ! 3\"\nproof -\n  obtain tw where \"init_sim (0, w) index tw\" and  \"tw, i + 1, index \\<Rightarrow>\\<^sub>S tw'\"\n    using premises_sim_fin_obt[OF assms(1)] by auto\n  hence \"i + 1 = fst tw'\"\n    using world_maxtime_lt_fst_tres  by blast\n  have \"conc_stmt_wf index\"\n    unfolding conc_stmt_wf_def index_def by auto\n  moreover have \"nonneg_delay_conc index\"\n    unfolding index_def by auto\n  ultimately have \"init_sim_valid (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) index (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv' tw)\"\n    using init_sim_hoare_soundness[OF init_sat_slicer_inv_comb]\n    by (metis (no_types, lifting) assms(3) conc_wt_cases(1) init_sat_slicer_inv_comb\n    init_sim_hoare_soundness index_def strengthen_precondition_init_sim_hoare)\n  hence \"inv tw \\<and> wityping \\<Gamma> (snd tw) \\<and> inv' tw\"\n    using \\<open>init_sim (0, w) index tw\\<close> fst_conv assms(2) unfolding init_sim_valid_def\n    by (metis snd_conv)\n  hence \"inv tw\" and \"inv' tw\" and \"wityping \\<Gamma> (snd tw)\"\n    by auto\n  moreover have \"seq_wt \\<Gamma> (Bassign_trans OUT (Bindex IN 3) 1)\"\n    using assms(3) unfolding index_def by auto\n  moreover hence \"\\<Turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv' tw\\<rbrace> index \\<lbrace>inv\\<rbrace>\"\n    using conc_sim_soundness[OF index_conc_sim2'] \\<open>conc_stmt_wf index\\<close> \\<open>nonneg_delay_conc index\\<close>\n    by auto\n  ultimately have \"inv tw'\"\n    using \\<open>tw, i + 1, index \\<Rightarrow>\\<^sub>S tw'\\<close> unfolding sim_hoare_valid_def by blast\n  with \\<open>i + 1 = fst tw'\\<close> show ?thesis\n    unfolding inv_def  by (metis less_add_one)\nqed\n\nend\n", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Indexing_Hoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165085228825, "lm_q2_score": 0.5964331462646255, "lm_q1q2_score": 0.31450904425558}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      XVcgEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader \"Examples for Parallel Assignments\"\n\ntheory XVcgEx \nimports \"../XVcg\"\n\nbegin\n\nrecord \"globals\" =\n  \"G_'\"::\"nat\"\n  \"H_'\"::\"nat\"\n\nrecord 'g vars = \"'g state\" +\n  A_' :: nat\n  B_' :: nat\n  C_' :: nat\n  I_' :: nat\n  M_' :: nat\n  N_' :: nat\n  R_' :: nat\n  S_' :: nat\n  Arr_' :: \"nat list\"\n  Abr_':: string\n\nterm \"BASIC\n         \\<acute>A :== x,\n         \\<acute>B :== y        \n      END\"\n\nterm \"BASIC\n         \\<acute>G :== \\<acute>H,\n         \\<acute>H :== \\<acute>G        \n      END\"\n\nterm \"BASIC\n        LET (x,y) = (\\<acute>A,b);\n            z = \\<acute>B\n        IN \\<acute>A :== x,\n           \\<acute>G :== \\<acute>A + y + z\n      END\"\n\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>A = 0\\<rbrace> \n      \\<lbrace>\\<acute>A < 0\\<rbrace> \\<longmapsto> BASIC\n       LET (a,b,c) = foo \\<acute>A\n       IN \n            \\<acute>A :== a,\n            \\<acute>B :== b,\n            \\<acute>C :== c\n      END\n      \\<lbrace>\\<acute>A = x \\<and> \\<acute>B = y \\<and> \\<acute>C = c\\<rbrace>\"\napply vcg\noops\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>A = 0\\<rbrace> \n      \\<lbrace>\\<acute>A < 0\\<rbrace> \\<longmapsto> BASIC\n       LET (a,b,c) = foo \\<acute>A\n       IN \n            \\<acute>A :== a,\n            \\<acute>G :== b + \\<acute>B,\n            \\<acute>H :== c\n      END\n      \\<lbrace>\\<acute>A = x \\<and> \\<acute>G = y \\<and> \\<acute>H = c\\<rbrace>\"\napply vcg\noops\n\ndefinition foo:: \"nat \\<Rightarrow> (nat \\<times> nat \\<times> nat)\"\n  where \"foo n = (n,n+1,n+2)\"\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>A = 0\\<rbrace> \n      \\<lbrace>\\<acute>A < 0\\<rbrace> \\<longmapsto> BASIC\n       LET (a,b,c) = foo \\<acute>A\n       IN \n            \\<acute>A :== a,\n            \\<acute>G :== b + \\<acute>B,\n            \\<acute>H :== c\n      END\n      \\<lbrace>\\<acute>A = x \\<and> \\<acute>G = y \\<and> \\<acute>H = c\\<rbrace>\"\napply (vcg add: foo_def snd_conv fst_conv)\noops\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Simpl/ex/XVcgEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850278370112, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.3144480752901155}}
{"text": "theory Hoare\n\nimports Main\n \"../lem/Evm\"\n \"../sep_algebra/EvmSep\"\n \"../sep_algebra/Sep_Tactics\"\n \"~~/src/HOL/Eisbach/Eisbach\"\nbegin\n\nlemma not_at_least_one :\n  \"\\<not> 1 \\<le> (aa :: 256 word) \\<Longrightarrow> aa = 0\"\napply(simp add:linorder_class.not_le)\ndone\n\nlemma unat_suc : \"unat (aa :: w256) = Suc n \\<Longrightarrow> unat (aa - 1) = n\"\napply(case_tac \"aa \\<ge> 1\")\n apply(simp add: uint_minus_simple_alt unat_def)\napply(drule not_at_least_one)\napply(simp)\ndone\n\n\n(* Following Magnus Myreen's thesis \"Formal verification of machine-code programs\" 3.2.4 *)  \n\ndatatype state_element =\n    StackHeightElm \"nat\"  (* considering making it int *)\n  | StackElm \"nat * w256\" (* position, value *)\n    (* The position is counted from the bottom *)\n    (* StackElement (0, 300) says the oldest element on the stack is 300 *)\n  | StorageElm \"w256 * w256\" (* index, value *)\n  | MemoryElm \"w256 * byte\" (* address, value *)\n  | LogElm \"nat * log_entry\" (* position, log *)\n    (* Log (0, entry) says that the first recorded log entry is 0 *)\n  | LogNumElm \"nat\" (* Number of recorded logs *)\n  | PcElm \"int\" (* program counter *)\n  | GasElm \"int\" (* remaining gas *)\n  | MemoryUsageElm \"int\" (* current memory usage *)\n  | CodeElm \"int * inst\" (* a position containing an instruction *)\n  | ThisAccountElm \"address\" (* The address of this account *)\n  | BalanceElm \"address * w256\" (* address, amount *)\n  | CallerElm \"address\"\n  | OriginElm \"address\"\n  | SentValueElm \"w256\"\n  | SentDataElm \"byte list\"\n  | ExtProgramSizeElm \"address * int\" (* address, size.  Considering making size an int *)\n  | ExtProgramElm \"address * nat * byte\" (* address, position, byte.  Considering making position an int *)\n  | ContractActionElm \"contract_action\" (* None indicates continued execution *)\n  | ContinuingElm \"bool\" (* True if the execution is still continuing *)\n  | BlockhashElm \"w256 * w256\"\n  | BlockNumberElm w256\n  | CoinbaseElm \"address\"\n  | TimestampElm \"w256\"\n  | DifficultyElm \"w256\"\n  | GaslimitElm \"w256\"\n  | GaspriceElm \"w256\"\n  | AccountExistenceElm \"address * bool\"\n\nabbreviation blockhash_as_elm :: \"(w256 \\<Rightarrow> w256) \\<Rightarrow> state_element set\"\nwhere \"blockhash_as_elm f == { BlockhashElm (n, h) | n h. f n = h}\"\n\nabbreviation block_info_as_set :: \"block_info \\<Rightarrow> state_element set\"\nwhere \"block_info_as_set b ==\n  blockhash_as_elm (block_blockhash b) \\<union> { CoinbaseElm (block_coinbase b),\n  TimestampElm (block_timestamp b), DifficultyElm (block_difficulty b),\n  GaslimitElm (block_gaslimit b), BlockNumberElm (block_number b) }\"\n\ndefinition account_existence_as_set :: \"(address \\<Rightarrow> bool) \\<Rightarrow> state_element set\"\nwhere\n\"account_existence_as_set f ==\n  { AccountExistenceElm (a, e) | a e. f a = e }\"\n\ndefinition contract_action_as_set :: \"contract_action \\<Rightarrow> state_element set\"\n  where \"contract_action_as_set act == { ContractActionElm act }\"\n\ndefinition memory_as_set :: \"memory \\<Rightarrow> state_element set\"\n  where\n    \"memory_as_set m == { MemoryElm (a, v) | a v. m a = v }\"\n\ndefinition storage_as_set :: \"storage \\<Rightarrow> state_element set\"\n  where\n    \"storage_as_set s == { StorageElm (i, v) | i v. s i = v}\"\n\ndefinition balance_as_set :: \"(address \\<Rightarrow> w256) \\<Rightarrow> state_element set\"\n  where\n    \"balance_as_set b == { BalanceElm (a, v) | a v. b a = v }\"\n\ndefinition stack_as_set :: \"w256 list \\<Rightarrow> state_element set\"\n  where\n    \"stack_as_set s == { StackHeightElm (length s) } \\<union>\n                       { StackElm (idx, v) | idx v. idx < length s \\<and> (rev s) ! idx = v }\"\n\ndefinition ext_program_as_set :: \"(address \\<Rightarrow> program) \\<Rightarrow> state_element set\"\n  where\n    \"ext_program_as_set ext ==\n      { ExtProgramSizeElm (adr, s) | adr s. program_length (ext adr) = s } \\<union>\n      { ExtProgramElm (adr, pos, b) | adr pos b. program_as_natural_map (ext adr) pos = b }\n    \"\n\ndefinition log_as_set :: \"log_entry list \\<Rightarrow> state_element set\"\n  where\n    \"log_as_set logs ==\n      { LogNumElm (length logs) } \\<union>\n      { LogElm (pos, l) | pos l. (rev logs) ! pos = l \\<and> pos < length logs}\n    \"\n\ndefinition program_as_set :: \"program \\<Rightarrow> state_element set\"\n  where\n    \"program_as_set prg ==\n      { CodeElm (pos, i) | pos i. program_content prg pos = Some i  } \\<union>\n      { CodeElm (pos, Misc STOP) | pos. program_content prg pos = None }\n    \"\n\ndefinition constant_ctx_as_set :: \"constant_ctx \\<Rightarrow> state_element set\"\n  where\n    \"constant_ctx_as_set c == program_as_set (cctx_program c) \\<union> { ThisAccountElm (cctx_this c) }\"\n\ndefinition variable_ctx_as_set :: \"variable_ctx \\<Rightarrow> state_element set\"\n  where\n    \"variable_ctx_as_set v ==\n       stack_as_set (vctx_stack v)\n    \\<union> memory_as_set (vctx_memory v)\n    \\<union> storage_as_set (vctx_storage v)\n    \\<union> balance_as_set (vctx_balance v)\n    \\<union> log_as_set (vctx_logs v)\n    \\<union> block_info_as_set (vctx_block v)\n    \\<union> ext_program_as_set (vctx_ext_program v)\n    \\<union> account_existence_as_set (vctx_account_existence v)\n    \\<union> { MemoryUsageElm (vctx_memory_usage v)\n      , CallerElm (vctx_caller v)\n      , SentValueElm (vctx_value_sent v)\n      , OriginElm (vctx_origin v)\n      , GaspriceElm (vctx_gasprice v)\n      , GasElm (vctx_gas v)\n      , PcElm (vctx_pc v)\n      , SentDataElm (vctx_data_sent v)\n      }\"\n\ndefinition contexts_as_set :: \"variable_ctx \\<Rightarrow> constant_ctx \\<Rightarrow> state_element set\"\n  where\n    \"contexts_as_set v c ==\n       constant_ctx_as_set c \\<union> variable_ctx_as_set v\"\n\ntype_synonym 'a set_pred = \"'a set \\<Rightarrow> bool\"\n\ntext \\<open>The old sep_commute and sep_assoc are now in sep_conj_ac and\n   sep_def should be replaced by the following sep_basic_simps \\<close>\n  \nlemmas sep_basic_simps =  sep_conj_def sep_set_conv\n\nlemma sep_eq_alts [sep_select]:\n  \"(\\<And>s. T s = (P \\<and>* R) s) \\<Longrightarrow> T s \\<and> A \\<Longrightarrow> (P \\<and>* R) s \\<and> A\"\n  \"(\\<And>s. T s = (P \\<and>* R) s) \\<Longrightarrow> T = B \\<Longrightarrow> (P \\<and>* R) = B\"\n  \"(\\<And>s. T s = (P \\<and>* R) s) \\<Longrightarrow> T = D \\<Longrightarrow> D = (P \\<and>* R)\"\n  by auto+\n    \nlemma sep_select_ext[sep_select]:\n   \"(\\<And>s. T s = (P \\<and>* R) s) \\<Longrightarrow> T s = B s \\<Longrightarrow> (P \\<and>* R) s = B s\"\n  \"(\\<And>s. T s = (P \\<and>* R) s) \\<Longrightarrow> T s = D s \\<Longrightarrow> D s = (P \\<and>* R) s\"\n  by auto+\n\nlemma sep_conj_first:\n  \"(A \\<and> (P \\<and>* R) s) = ((P \\<and>* R) s \\<and> A)\"\n  by (simp add: conj_commute)\n\ntext \\<open>Use the method sep_sep_iff to solve simple sep-logic\n  lemmas of the following form:\n  @{term \"(some_sep_prop n \\<and>* R) s = (SomeSepPropConst n \\<in> s \\<and> R (s - {SomeSepPropConst n}))\"}\\<close>\n\nlemma ex_conj_commute:\n  \"(\\<exists>v. P v \\<and> Q v) = (\\<exists>v. Q v \\<and> P v) \"\n  by (simp only: conj_commute)\n    \nmethod exI_pick_last_conj =\n  --\\<open>Group all conjs on the left and then commute to get the\n     last conjunction element in first position.\\<close>\n  (simp (no_asm) only: conj_assoc[symmetric],\n   subst ex_conj_commute)?,\n  ((rule exI, erule conjI, ((rule conjI[rotated])+; blast))|\n   (rule exI, rule exI, erule (1) conjI, ((rule conjI[rotated])+; blast)))\n\nmethod solve_sep_iff uses simp =\n  solves \\<open>(rule iffI;  clarsimp simp add: sep_basic_simps simp),\n  exI_pick_last_conj\\<close>\n\ntext \\<open>The sep_subst method takes rule of the form \"(some_sep_prop \\<and>* R) = _\"  and\n substitute the LHS with the RHS without having to put some_sep_prop in first pos in\nthe goal\n\nThis method should probably be rewritten in ML with a loop for\nperformance and to remove the current limitation of maximum 11\nnested conjunctions.\\<close>\n\nmethod sep_subst uses simp =\n ((sep_select 1, subst simp) |\n  (sep_select 2, subst simp) |\n  (sep_select 3, subst simp) |\n  (sep_select 4, subst simp) |\n  (sep_select 5, subst simp) |\n  (sep_select 6, subst simp) |\n  (sep_select 7, subst simp) |\n  (sep_select 8, subst simp) |\n  (sep_select 9, subst simp) |\n  (sep_select 10, subst simp))\n\nmethod sep_simp_aux =\n  simp only: sep_conj_first sep_conj_assoc conj_assoc\n\ntext \\<open>sep_simp_no_asm simplifies a sep logic formula in the conclusion of a goal.\nThe conclusion can contain normal conjunctions (e.g. @{term \"P \\<and> (a \\<and>* b) s \\<and> Q\"}),\nif so, sep_simp_no_asm will move the element with a sep-conjunction in first\nposition and apply all the simp rules pass as argument to it.\nThe simp rules passed as argument must be of the form @{term \"(some_sep_prop n \\<and>* R) s = (SomeSepPropConst n \\<in> s \\<and> R (s - {SomeSepPropConst n}))\"}\n\\<close>\nmethod sep_simp_no_asm uses simp =\n  ((sep_simp_aux,  (sep_subst simp: simp)?)+)[1] |\n  (sep_subst simp: simp, (solves \\<open>sep_simp_aux\\<close> (* e.g. solves with refl *))?)\n\ntext \\<open>Same as sep_simp_no_asm but for assumptions. sep_simp_asm can take several\nrules to simplify, it rule attempt to apply all of them, multiple times.\\<close>\n\nmethod sep_simp_asm uses simp =\n (simp only: sep_conj_assoc)?,\n ((sep_select_asm 1, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 2, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 3, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 4, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 5, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 6, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 7, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 8, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 9, subst (asm) simp, (erule conjE)+) |\n  (sep_select_asm 10, subst (asm) simp, (erule conjE)+))+\n\nmethod sep_simp uses simp =\n  ((sep_simp_asm simp: simp, (sep_simp_no_asm simp: simp)?) |\n  (sep_simp_no_asm simp: simp, (sep_simp_asm simp: simp)?))[1]\n\nlemma sep_lc: \"(a ** b ** c) = (b ** a ** c)\"\n by (simp add: sep_conj_ac)\n\nlemma sep_three : \"(c ** a ** b) = (a ** b ** c)\"\n by (simp add: sep_conj_ac)\n\ndefinition emp :: \"'a set_pred\"\n  where\n    \"emp s == (s = 0)\"\n\nlemma emp_sep [simp] :\n  \"(emp \\<and>* r) = r\"\n  apply(simp add: emp_def  sep_conj_def)\n done\n\ndefinition pure :: \"bool \\<Rightarrow> 'a set_pred\"\n  where\n    \"pure b s == emp s \\<and> b\"\n\nnotation pure (\"\\<langle> _ \\<rangle>\")\n\ndefinition memory_usage :: \"int \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"memory_usage u s == (s = {MemoryUsageElm u})\"\n  \ndefinition stack_height :: \"nat \\<Rightarrow> state_element set \\<Rightarrow> bool\"\n  where\n    \"stack_height h s == (s = {StackHeightElm h})\"\n\ndefinition stack :: \"nat \\<Rightarrow> w256 \\<Rightarrow> state_element set \\<Rightarrow> bool\"\n  where\n    \"stack pos v s == (s = {StackElm (pos, v)})\"\n\ndefinition program_counter :: \"int \\<Rightarrow> state_element set \\<Rightarrow> bool\"\n  where\n    \"program_counter pos s == s = {PcElm pos}\"\n\ndefinition log_number :: \"nat \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"log_number n s == s = {LogNumElm n}\"\n\ndefinition logged :: \"nat \\<Rightarrow> log_entry \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"logged n l s == s = {LogElm (n, l)}\"\n\ndefinition account_existence :: \"address \\<Rightarrow> bool \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"account_existence a b s == s = {AccountExistenceElm (a, b)}\"\n\nlemma sep_logged:\n  \"(a ** logged n l) s =\n   (LogElm (n, l) \\<in> s \\<and> a (s - {LogElm (n, l)}))\"\n  by (solve_sep_iff simp: logged_def)\n\ndefinition gas_pred :: \"int \\<Rightarrow> state_element set \\<Rightarrow> bool\"\n  where\n    \"gas_pred g s == s = {GasElm g}\"\n\ndefinition gas_any :: \"state_element set \\<Rightarrow> bool\"\n  where\n    \"gas_any s == (\\<exists> g. s = {GasElm g})\"\n\nlemma gas_any_sep :\n  \"(gas_any ** rest) s =\n   (\\<exists> g. GasElm g \\<in> s \\<and> rest (s - {GasElm g}))\"\n  apply (rule iffI)\n   apply (fastforce simp: gas_any_def sep_basic_simps)\n  apply (clarsimp simp add: sep_basic_simps gas_any_def)\n  apply (rule_tac x=\"{GasElm g}\" in exI)\n  apply (exI_pick_last_conj)\n done    \n\nlemma sep_gas_any_sep:\n  \"(a ** gas_any ** rest) s =\n   (\\<exists> g. GasElm g \\<in> s \\<and> (a ** rest) (s - {GasElm g}))\"\n by (sep_simp simp: gas_any_sep)\n\nlemma sep_log_number_sep:\n  \"(log_number n \\<and>* R) s =\n   (LogNumElm n \\<in> s \\<and> R (s - {LogNumElm n}))\n  \"\n  by (solve_sep_iff simp: log_number_def)\n\ndefinition caller :: \"address \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"caller c s == s = {CallerElm c}\"\n\ndefinition storage :: \"w256 \\<Rightarrow> w256 \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"storage idx w s == s = {StorageElm (idx, w)}\"\n\n\ndefinition this_account :: \"address \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"this_account t s == s = {ThisAccountElm t}\"\n\ndefinition balance :: \"address \\<Rightarrow> w256 \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"balance adr v s == s = {BalanceElm (adr, v)}\"\n\ndefinition block_number_pred :: \"w256 \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"block_number_pred w s == s = {BlockNumberElm w}\"\n\ndefinition continuing :: \"state_element set \\<Rightarrow> bool\"\nwhere\n\"continuing s == s = { ContinuingElm True }\"\n\ndefinition not_continuing :: \"state_element set \\<Rightarrow> bool\"\nwhere\n\"not_continuing s == s = {ContinuingElm False}\"\n\ndefinition action :: \"contract_action \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"action act s == s = {ContractActionElm act}\"\n\n(* memory8, memory, calldata, and storage should be added here *)\n\ndefinition memory8 :: \"w256 \\<Rightarrow> byte \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n\"memory8 idx v s == s = {MemoryElm (idx ,v)}\"\n\nlemma memory8_sep :\n \"(memory8 idx v ** rest) s = (MemoryElm (idx, v) \\<in> s \\<and> rest (s - {MemoryElm (idx, v)}))\"\n by (solve_sep_iff simp: memory8_def)\n\nlemma sep_memory8_sep :\n\"(a ** memory8 idx v ** rest) s = (MemoryElm (idx, v) \\<in> s \\<and> (a ** rest) (s - {MemoryElm (idx, v)}))\"\nproof -\n  have \"(a ** memory8 idx v ** rest) s = (memory8 idx v ** a ** rest) s\"\n    by (metis sep_conj_assoc sep_conj_commute)\n  moreover have \"(memory8 idx v ** a ** rest) s = (MemoryElm (idx, v) \\<in> s \\<and> (a ** rest) (s - {MemoryElm (idx, v)}))\"\n    by (rule memory8_sep)\n  ultimately show ?thesis\n    by auto\nqed\n    \nfun memory_range :: \"w256 \\<Rightarrow> byte list \\<Rightarrow> state_element set \\<Rightarrow> bool\"\nwhere\n  \"memory_range begin [] = emp\"\n| \"memory_range begin (h # t) = (memory8 begin h ** memory_range (begin + 1) t)\"\n\nfun memory_range_elms :: \"w256 \\<Rightarrow> byte list \\<Rightarrow> state_element set\"\nwhere\n  \"memory_range_elms begin [] = {}\"\n| \"memory_range_elms begin (a # lst) = {MemoryElm (begin, a)} \\<union> memory_range_elms (begin + 1) lst\"\n\nlemma memory_range_elms_nil :\n  \"x \\<notin> memory_range_elms b []\"\napply(simp)\ndone\n\nlemma memory_range_elms_cons :\n  \"memory_range_elms b (a # lst) = {MemoryElm (b, a)} \\<union> memory_range_elms (b + 1) lst\"\napply(auto)\ndone\n\n(* prove a lemma about the above two definitions *)\n\n\nlemma stack_sound0 :\n  \"(stack pos w ** p) s \\<Longrightarrow> StackElm (pos, w) \\<in> s\"\nby (clarsimp simp add: sep_basic_simps stack_def)\n\nlemmas context_rw = contexts_as_set_def variable_ctx_as_set_def constant_ctx_as_set_def\n      stack_as_set_def memory_as_set_def\n      balance_as_set_def storage_as_set_def log_as_set_def program_as_set_def\n      ext_program_as_set_def account_existence_as_set_def\n\nlemma stack_sound1 :\n  \"StackElm (pos, w) \\<in> contexts_as_set var con \\<Longrightarrow> rev (vctx_stack var) ! pos = w\"\n  apply(simp add: context_rw)\n  done\n\nlemma stack_sem :\n  \"(stack pos w ** p) (contexts_as_set var con) \\<Longrightarrow> rev (vctx_stack var) ! pos = w\"\n  apply(drule stack_sound0)\n  apply(drule stack_sound1)\n  apply(simp)\n  done\n\ndefinition instruction_result_as_set :: \"constant_ctx \\<Rightarrow> instruction_result \\<Rightarrow> state_element set\"\n  where\n    \"instruction_result_as_set c rslt =\n        ( case rslt of\n          InstructionContinue v \\<Rightarrow> {ContinuingElm True} \\<union> contexts_as_set v c\n        | InstructionToEnvironment act v _ \\<Rightarrow> {ContinuingElm False, ContractActionElm act} \\<union> contexts_as_set v c\n        )\"\n\ndefinition code :: \"(int * inst) set \\<Rightarrow> state_element set \\<Rightarrow> bool\"\n  where\n    \"code f s == s = { CodeElm(pos, i) | pos i. (pos, i) \\<in> f }\"\n\naxiomatization hash2 :: \"w256 \\<Rightarrow> w256 \\<Rightarrow> w256\" where\nhash_inj :\n    \"hash2 b v1 = hash2 c v2 \\<Longrightarrow> b = c \\<or> hash2 b v1 = 0\"\nand hash_inj2 :\n   \"hash2 b v1 = hash2 c v2 \\<Longrightarrow> v1 = v2  \\<or> hash2 b v1 = 0\"\nand hash_compat :\n   \"hash2 a b \\<noteq> 0 \\<Longrightarrow> hash2 a b = keccak (word_rsplit a@ word_rsplit b)\"\n\ndefinition magic_filter :: \"8 word list \\<Rightarrow> bool\" where\n\"magic_filter lst = (\\<forall> a b.\n   (lst = word_rsplit a @ word_rsplit b) \\<longrightarrow>\n   hash2 a b \\<noteq> 0)\"\n\ndefinition failed_for_reasons :: \"failure_reason set \\<Rightarrow> instruction_result \\<Rightarrow> bool\"\nwhere\n\"failed_for_reasons allowed r =\n (allowed \\<noteq> {} \\<and>\n (\\<exists> reasons a b.\n              r = InstructionToEnvironment (ContractFail reasons) a b\n              \\<and> set reasons \\<subseteq> allowed))\"\n\ndefinition triple ::\n \"network \\<Rightarrow> failure_reason set \\<Rightarrow> (state_element set \\<Rightarrow> bool) \\<Rightarrow> (int * inst) set \\<Rightarrow> (state_element set \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n  \"triple net allowed_failures pre insts post ==\n    \\<forall> co_ctx presult rest stopper.\n       (pre ** code insts ** rest) (instruction_result_as_set co_ctx presult) \\<longrightarrow>\n       (\\<exists> k.\n         ((post ** code insts ** rest) (instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult)))\n         \\<or> failed_for_reasons allowed_failures (program_sem stopper co_ctx k net presult))\"\n\nlemma pure_sep : \"(((\\<langle> b \\<rangle>) ** rest) s) = (b \\<and> rest s)\"\n  by ( simp add: sep_conj_def pure_def emp_def )\n\nlemma continuing_sep:\n  \"(continuing ** rest) s = ((ContinuingElm True) \\<in> s \\<and> rest (s - {ContinuingElm True}))\"\n   by (solve_sep_iff simp: continuing_def)\n\n\nlemma sep_continuing_sep:\n  \"(a ** continuing ** b) s = ((ContinuingElm True) \\<in> s \\<and> (a ** b) (s - {ContinuingElm True}))\"\n by (rule iffI) (sep_simp simp: continuing_sep)+\n\n\nlemma storage_sep:\n  \"(storage idx w ** rest) s =\n   (StorageElm (idx, w) \\<in> s \\<and> rest (s - {StorageElm (idx, w)}))\"\n   by (solve_sep_iff simp: storage_def)\n\nlemma sep_storage:\n  \"(rest ** storage idx w) s =\n   (StorageElm (idx, w) \\<in> s \\<and> rest (s - {StorageElm (idx, w)}))\"\n  by (solve_sep_iff simp: storage_def)\n\n\nlemma stack_height_sep : \"(stack_height h ** rest) s =\n  (StackHeightElm h \\<in> s \\<and> rest (s - {StackHeightElm h})) \"\n  by (solve_sep_iff simp: stack_height_def)\n\nlemma sep_stack_height : \"(rest ** stack_height h) s =\n  (StackHeightElm h \\<in> s \\<and> rest (s - {StackHeightElm h})) \"\n  by (solve_sep_iff simp: stack_height_def)\n\nlemma sep_stack_height_sep: \"(a ** stack_height h ** rest) s =\n  (StackHeightElm h \\<in> s \\<and> (a ** rest) (s - {StackHeightElm h})) \"\n  by (sep_simp simp: stack_height_sep)\n\nlemma stack_sep : \"(stack p w ** rest) s =\n  (StackElm (p, w) \\<in> s \\<and> rest (s - {StackElm (p, w)}))\"\n  by (solve_sep_iff simp: stack_def)\n\nlemma sep_stack : \"(rest ** stack p w) s =\n  (StackElm (p, w) \\<in> s \\<and> rest (s - {StackElm (p, w)}))\"\n  by (solve_sep_iff simp: stack_def)\n\nlemma sep_stack_sep  : \"(a ** stack p w ** rest) s =\n  (StackElm (p, w) \\<in> s \\<and> (a ** rest) (s - {StackElm (p, w)}))\"\n  by (sep_simp simp: stack_sep)\n\n\nlemma program_counter_sep : \"(program_counter w ** rest) s =\n  (PcElm w \\<in> s \\<and> rest (s - {PcElm w}))\"\n  by (solve_sep_iff simp: program_counter_def)\n\nlemma sep_program_counter : \"(rest ** program_counter w) s =\n  (PcElm w \\<in> s \\<and> rest (s - {PcElm w}))\"\n  by (solve_sep_iff simp: program_counter_def)\n\n\nlemma sep_program_counter_sep : \"(a ** program_counter w ** rest) s =\n  (PcElm w \\<in> s \\<and> (a ** rest) (s - {PcElm w}))\"\n  by (sep_simp simp: program_counter_sep)\n\nlemma code_sep: \"(code pairs ** rest) s =\n  ({ CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs } \\<subseteq> s \\<and> (rest (s - { CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs })))\"\n  apply (rule iffI)\n    apply (rule conjI)\n  apply (clarsimp simp: code_def sep_basic_simps)\n   apply (clarsimp simp:  sep_basic_simps)\n    apply (erule back_subst[where P=rest])\n    apply(fastforce simp add: code_def)\n  apply (clarsimp simp: code_def sep_basic_simps)\n  apply exI_pick_last_conj\n done\n\nlemma sep_code : \"(rest ** code pairs) s =\n  ({ CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs } \\<subseteq> s \\<and> (rest (s - { CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs })))\"\n  by (sep_simp simp: code_sep)\n\nlemma sep_code_sep: \"(a ** code pairs ** rest) s =\n  ({ CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs } \\<subseteq> s \\<and> ((a ** rest) (s - { CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs })))\"\n  by (sep_simp simp: code_sep)\n\nlemma sep_sep_code : \"(a ** b ** code pairs) s =\n  ({ CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs } \\<subseteq> s \\<and> ((a ** b) (s - { CodeElm(pos, i) | pos i. (pos, i) \\<in> pairs })))\"\n  by (sep_simp simp: code_sep)\n\n\nlemma gas_pred_sep : \"(gas_pred g ** rest) s =\n  ( GasElm g \\<in> s \\<and> rest (s - { GasElm g }) )\"\n  by (solve_sep_iff simp: gas_pred_def)\n\n\nlemma sep_gas_pred : \"(rest ** gas_pred g) s =\n  ( GasElm g \\<in> s \\<and> rest (s - { GasElm g }) )\"\n  by (solve_sep_iff simp: gas_pred_def)\n\nlemma sep_gas_pred_sep:\n  \"(a ** gas_pred g ** b) s =\n   ( GasElm g \\<in> s \\<and> (a ** b) (s - { GasElm g } ) )\"\n by (sep_simp simp: gas_pred_sep)\n\n\nlemma memory_usage_sep: \n  \"(memory_usage u ** rest) s =\n   (MemoryUsageElm u \\<in> s \\<and> rest (s - {MemoryUsageElm u}))\"\n  by (solve_sep_iff simp: memory_usage_def)\n\nlemma sep_memory_usage: \n  \"(rest ** memory_usage u) s =\n   (MemoryUsageElm u \\<in> s \\<and> rest (s - {MemoryUsageElm u}))\"\n by (solve_sep_iff simp: memory_usage_def)\n\nlemma sep_memory_usage_sep:\n  \"(a ** memory_usage u ** rest) s =\n   (MemoryUsageElm u \\<in> s \\<and> (a ** rest) (s - {MemoryUsageElm u}))\"\n\tby (sep_simp simp:  memory_usage_sep)\n\ndefinition sent_data :: \"byte list \\<Rightarrow> state_element set \\<Rightarrow> bool\" where\n\"sent_data d s = (s = {SentDataElm d})\"\n\nlemma sent_data_sep:\n  \"(sent_data d ** rest) s =\n   (SentDataElm d \\<in> s \\<and> rest (s - {SentDataElm d}))\"\nby (solve_sep_iff simp: sent_data_def)\n\ndefinition sent_value :: \"256 word \\<Rightarrow> state_element set \\<Rightarrow> bool\" where\n\"sent_value v s = (s = {SentValueElm v})\"\n\nlemma sent_value_sep:\n  \"(sent_value v ** rest) s =\n   (SentValueElm v \\<in> s \\<and> rest (s - {SentValueElm v}))\"\nby (solve_sep_iff simp: sent_value_def)\n\nlemma stackHeightElmEquiv: \"StackHeightElm h \\<in> contexts_as_set v c =\n  (length (vctx_stack v) = h)\n  \"\nby (auto simp add:context_rw)\n\nlemma stackElmEquiv: \"StackElm (pos, w) \\<in> contexts_as_set v c =\n  (pos < length (vctx_stack v) \\<and> rev (vctx_stack v) ! pos = w)\"\nby (auto simp add:context_rw)\n\nlemma pcElmEquiv : \"PcElm k \\<in> contexts_as_set va_ctx co_ctx =\n  (vctx_pc va_ctx = k)\"\nby (auto simp add:context_rw)\n\nlemma gasElmEquiv: \"GasElm g \\<in> contexts_as_set va_ctx co_ctx =\n  (vctx_gas va_ctx = g)\"\nby (auto simp add:context_rw)\n\nlemma codeElmEquiv:\n  \"CodeElm (pos, i) \\<in> contexts_as_set va_ctx co_ctx =\n   ((program_content (cctx_program co_ctx) pos = Some i) \\<or>\n   (program_content (cctx_program co_ctx) pos = None) \\<and> i = Misc STOP)\"\nby (auto simp add:context_rw)\n\nlemmas stateelm_equiv_simps = \n  stackHeightElmEquiv\n  stackElmEquiv\n  pcElmEquiv\n  gasElmEquiv\n  codeElmEquiv\n\nlemma insert_minus : \"a \\<noteq> b \\<Longrightarrow> insert a s - { b } = insert a (s - {b})\"\n  apply(simp add: insert_Diff_if)\n  done\n\nlemma pred_functional : \"p (s :: state_element set) \\<Longrightarrow> s = t \\<Longrightarrow> p t\"\napply(auto)\ndone\n\nlemma insert_functional : \"e = f \\<Longrightarrow> s = t \\<Longrightarrow> insert e s = insert f t\"\n  apply(auto)\n  done\n\nlemma lookup_over[simp] : \"(rev lista @ (aa # l)) ! length lista = aa\"\n\tby (metis length_rev nth_append_length)\n\nlemma lookup_over1[simp] : \"(rev lista @ (w # a # l)) ! Suc (length lista) = a\"\n(* sledgehammer *)\n\tby (metis add.left_neutral append.assoc append_Nil2 length_append length_rev list.size(3) list.size(4) nth_append_length plus_nat.simps(2) rev.simps(2) rev_append rev_rev_ident)\n\nlemma short_match[simp] :\n  \"idx < length lista \\<Longrightarrow> (rev lista @ l) ! idx = (rev lista @ m) ! idx\"\n(* sledgehammer *)\n\tby (simp add: nth_append)\n\t\t\n(**\n ** Inference rules about Hoare triples\n ** Following Magnus Myreen's thesis, 3.5\n **)\nlemma code_diff_union : \"(code (a \\<union> b)) = (code a ** (code (b - a)))\"\n  by (rule ext) \n     (auto simp: sep_basic_simps code_def)\n\nlemma code_diff_union' : \"(code (a \\<union> b)) = (code b ** (code (a - b)))\"\n  by (rule ext) \n     (auto simp: sep_basic_simps code_def)\n\n     \nlemma code_middle:\n  \"(p ** code (c_1 \\<union> c_2) ** rest) =\n   (p ** (code c_1 ** (code (c_2 - c_1))) ** rest)\"\n by (simp add: code_diff_union)\n\nlemma code_middle':\n  \"(p ** rest ** code (c_1 \\<union> c_2)) =\n   (p ** rest ** (code c_1 ** (code (c_2 - c_1))))\"\n by (simp add: code_diff_union)\n\nlemma shuffle3:\n  \"(p ** (code c_1 ** code (c_2 - c_1)) ** rest) =\n   (p ** code c_1 ** (code (c_2 - c_1) ** rest))\"\n by (metis sep_conj_assoc)\n\nlemma execution_continue:\n  \"(program_sem s co_ctx a net (program_sem s co_ctx b net presult) = program_sem s co_ctx (b + a) net presult)\"\napply(induction b arbitrary: presult)\n apply(simp add: program_sem.simps)\napply(simp add: program_sem.simps)\ndone\n\n(* Maybe it's better to organize program_sem as a function from program_result to program_result *)\nlemma triple_continue:\n\"triple net allowed q c r \\<Longrightarrow>\n no_assertion co_ctx \\<Longrightarrow>\n (q ** code c ** rest) (instruction_result_as_set co_ctx (program_sem s co_ctx k net presult)) \\<Longrightarrow>\n \\<exists> l. ((r ** code c ** rest) (instruction_result_as_set co_ctx (program_sem s co_ctx (k + l) net presult))\n      \\<or> failed_for_reasons allowed (program_sem s co_ctx (k + l) net presult))\"\napply(simp add: triple_def)\napply(drule_tac x = co_ctx in spec)\napply(drule_tac x = \"program_sem s co_ctx k net presult\" in spec)\napply(drule_tac x = rest in spec)\napply(simp)\napply(drule_tac x = s in spec)\napply (simp add:  sep_code_sep   execution_continue)\ndone\n\nlemma code_back:\n  \"(q ** code c_1 ** code (c_2 - c_1) ** rest) s = (q ** code (c_1 \\<union> c_2) ** rest) s\"\napply(simp only: code_middle shuffle3)\ndone\n\nlemma code_more:\n  \"(rest ** p ** code cL ** code (cR - cL)) s = (rest ** p ** code (cL \\<union> cR)) s\"\napply(simp add: code_middle')\ndone\n\nlemma code_union_comm :\n \"code (cR \\<union> cL) = code (cL \\<union> cR)\"\n  by (simp add: sup_commute)\n\nlemma code_union_s:\n  \"(q ** code (c_2 \\<union> c_1) ** rest) s \\<Longrightarrow> (q ** code (c_1 \\<union> c_2) ** rest) s\"\n(* sledgehammer *)\n\tby (simp add: sup_commute)\n\nlemma composition:\n  \"c = cL \\<union> cR \\<Longrightarrow> triple net F P cL Q \\<Longrightarrow> triple net F Q cR R \\<Longrightarrow> triple net F P c R\"\n  apply (simp (no_asm) add: triple_def)\n  apply clarsimp\n  apply (subst (asm) triple_def[where pre=P])\n  apply clarsimp\n  apply (rename_tac co_ctx presult rest stopper)\n  apply(drule_tac x = \"co_ctx\" in spec)\n  apply(drule_tac x = \"presult\" in spec)\n  apply(drule_tac x = \"code (cR - cL) ** rest\" in spec)\n  apply (erule impE)\n   apply(subgoal_tac \"(instruction_result_as_set co_ctx presult - {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL \\<or> (pos, i) \\<in> cR})\n    = (instruction_result_as_set co_ctx presult - {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL} -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cR \\<and> (pos, i) \\<notin> cL})\")\n    apply (simp add: code_back)\n   apply blast\n  apply(drule_tac x = stopper in spec)\n  apply(erule exE)\n  apply (subst (asm) triple_def[where pre=Q])\n  apply(drule_tac x = \"co_ctx\" in spec)\n  apply(drule_tac x = \"(program_sem stopper co_ctx k net presult)\" in spec)\n  apply(drule_tac x = \"code (cL - cR) ** rest\" in spec)\n  apply(erule disjE)\n   apply(drule_tac x = stopper in spec)\n   apply (erule impE)\n    apply(subgoal_tac \"(instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult) -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL} -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cR \\<and> (pos, i) \\<notin> cL}) =\n         (instruction_result_as_set co_ctx (program_sem stopper co_ctx k net presult) -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cR} -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL \\<and> (pos, i) \\<notin> cR})\")\n     apply (metis code_diff_union code_union_comm sep_three)\n    apply blast\n   apply(erule exE)\n   apply(rename_tac k l)\n   apply(rule_tac x = \"k + l\" in exI)\n   apply(erule disjE)\n   apply(rule disjI1)\n   apply(subgoal_tac \"\n   (instruction_result_as_set co_ctx (program_sem stopper co_ctx (k + l) net presult) -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cR} -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL \\<and> (pos, i) \\<notin> cR}) =\n   (instruction_result_as_set co_ctx (program_sem stopper co_ctx (k + l) net presult) -\n         {CodeElm (pos, i) |pos i. (pos, i) \\<in> cL \\<or> (pos, i) \\<in> cR})\")\n    apply (simp add: code_back code_union_s execution_continue)\n   apply blast\n  apply auto\n using execution_continue by auto\n\n\n(** Frame **)\n\nlemma frame:\n \"triple net F P c Q \\<Longrightarrow> triple net F (P ** R) c (Q ** R)\"\n  apply (simp add: triple_def)\n  apply clarsimp\n  subgoal for co_ctx presult rest stopper\n  apply (drule spec[where x=co_ctx])\n  apply (drule spec2[where x=presult and y=\"R ** rest\"])\n  apply (simp del: sep_conj_assoc add: sep_conj_ac)\n  done\n done\n\n\nlemma imp_sepL:\n  \"(\\<forall>s. a s \\<longrightarrow> b s) \\<Longrightarrow>\n   (\\<forall>s. (a ** c) s \\<longrightarrow> (b ** c) s)\"\n  by (auto simp add: sep_basic_simps)\n\n\n\n\n\nlemma frame_backward:\n  \"triple net F P c Q \\<Longrightarrow> P' = (P ** R) \\<Longrightarrow> Q' = (Q ** R) \\<Longrightarrow>\n   triple net F P' c Q'\"\n  by (simp add: frame)\n\nlemma remove_true:\n \"(p ** \\<langle>True\\<rangle> ** rest) = (p ** rest)\"\n by (simp add: pure_def sep_conj_def emp_def)\n    \nlemma true_sep [simp] :\n  \"(p ** \\<langle>True\\<rangle>) = p\"\n by (simp add: pure_def sep_conj_def emp_def)\n\nlemma sep_true [simp] :\n  \"(\\<langle>True\\<rangle> ** p) = p\"\n by (simp add: pure_def sep_conj_def emp_def)\n\nlemma move_pure0 :\n  \"triple net reasons (p ** \\<langle> True \\<rangle>) c q \\<Longrightarrow>  triple net reasons p c q\"\napply(simp add: triple_def remove_true)\ndone\n\nlemma false_triple :\n  \"triple net reasons (p ** \\<langle> False \\<rangle>) c q\"\napply(simp add: triple_def sep_basic_simps pure_def)\ndone\n\nlemma get_pure:\n  \"((p ** \\<langle> b \\<rangle> ** rest) s) = (b \\<and> (p ** rest) s)\"\napply(auto simp add: sep_basic_simps pure_def emp_def)\ndone\n\nlemma move_pure: \"triple net reaons (p ** \\<langle> b \\<rangle>) c q = (b \\<longrightarrow> triple net reaons p c q)\"\napply(auto simp add: move_pure0 false_triple)\napply(case_tac b; auto simp: false_triple)\n  done\n\nlemma pure_sepD:\n  \"(\\<langle>P\\<rangle> ** R) s \\<Longrightarrow> R s\"\n  by (simp add: pure_def emp_def sep_basic_simps)\n    \nlemma move_pureL: \"triple net reaons (\\<langle> b \\<rangle> ** p) c q = (b \\<longrightarrow> triple net reaons p c q)\"\n by (metis move_pure sep_conj_commute)\n\nlemma tmp01:\n    \"(rest ** code c ** p x) (case presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {}) \\<Longrightarrow>\n    (rest ** code c ** (\\<lambda>s. \\<exists>x. p x s)) (case presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {})\"\n  apply (sep_cancel)+\n  apply blast\n  done\n\nlemma tmp0:\n       \"\\<forall>co_ctx. no_assertion co_ctx \\<longrightarrow>\n                (\\<forall>presult rest.\n                    ((\\<lambda>s. \\<exists>x. p x s) ** code c ** rest) (case presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {}) \\<longrightarrow>\n                    (\\<forall>stopper. \\<exists>k. (q ** code c ** rest) (case program_sem stopper co_ctx k net presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {}))) \\<Longrightarrow>\n       no_assertion co_ctx \\<Longrightarrow>\n       (p x ** code c ** rest) (case presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {}) \\<Longrightarrow>\n       \\<exists>k. (q ** code c ** rest) (case program_sem stopper co_ctx k net presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {})\"\napply(drule_tac x = co_ctx in spec)\napply(simp)\napply(drule_tac x = presult in spec)\napply(drule_tac x = rest in spec)\napply(subgoal_tac \"(rest ** code c ** (\\<lambda>s. \\<exists>x. p x s))\n     (case presult of InstructionContinue v \\<Rightarrow> contexts_as_set v co_ctx | _ \\<Rightarrow> {})\")\n    (*\napply(rule tmp01)\napply(simp)\ndone*)\n    oops\n\n\nlemma preE0:\n  \"((\\<lambda>s. \\<exists>x. p x s) ** code c ** rest) s \\<Longrightarrow>\n   \\<exists> x. (p x ** code c ** rest) s\"\napply(auto simp only: sep_basic_simps)\n\tby blast\n\nlemma sep_impL :\n \"\\<forall> s. b s \\<longrightarrow> a s \\<Longrightarrow> \n (c ** b ** d) s \\<longrightarrow>\n (c ** a ** d) s\"\n  by (metis sep_basic_simps)\n\n\nlemma pre_imp:\n assumes \"\\<forall> s. (b s \\<longrightarrow> a s)\"\n and \" triple net reasons a c q\"\nshows\" triple net reasons b c q\"\nusing assms(2)\n  apply(auto simp add: triple_def)\n  apply(drule_tac x = co_ctx in spec)\n  apply(drule_tac x = presult in spec)\n  apply(drule_tac x = rest in spec)\n  apply (erule impE)\n   apply (sep_drule  assms(1)[rule_format])\n   apply blast\n  apply(subgoal_tac \"(rest ** a ** code c) (instruction_result_as_set co_ctx presult)\")\n   apply(simp )\n  apply (sep_rule sep_impL[OF assms(1), rule_format])\n  apply(simp add: code_sep sep_code_sep)\n done\n\nlemma preE1:\n\"((\\<lambda>s. \\<exists>x. p x s) ** rest) u\n=\n(\\<exists> x. (p x ** rest) u)\n\"\napply(auto simp add: sep_basic_simps)\ndone\n\nlemma preE00:\n  \"(rest ** code c ** p x) s \\<Longrightarrow>\n   (rest ** code c ** (\\<lambda>s. \\<exists>x. p x s)) s\"\n  apply (sep_cancel)+\n  apply blast\n done\n\nlemma preE : \"triple net reasons (\\<lambda> s. \\<exists> x. p x s) c q = (\\<forall> x. triple net reasons (p x) c q)\"\napply(auto simp add: triple_def preE1)\n apply(erule_tac x = co_ctx in allE)\n apply(drule_tac x = presult in spec)\n  apply(drule_tac x = rest in spec)\n  apply (erule impE)\n   apply blast\n apply(subgoal_tac \"(rest ** code c ** (\\<lambda>s. \\<exists>x. p x s)) (instruction_result_as_set co_ctx presult)\")\n   apply(simp)\n  apply(rule_tac x=x in preE00)\n  apply(simp)\n  apply (sep_simp simp: code_sep )\n  apply (simp add: sep_conj_commute)\ndone\n\n\n(** More rules to come **)\n\nlemma triple_tauto: \"triple net failures q e q\"\napply(simp add: triple_def; auto)\napply(rule_tac x = 0 in exI)\napply(simp add: program_sem.simps)\ndone\n\n\nlemma code_extension0: \"triple net failures p c_1 q \\<Longrightarrow> triple net failures q c_2 q \\<Longrightarrow> triple net failures p (c_1 \\<union> c_2) q\"\napply(rule_tac cL = c_1 and cR = c_2 in composition; auto)\ndone\n\nlemma code_extension : \"triple net failures p c q \\<Longrightarrow> triple net failures p (c \\<union> e) q\"\n\tby (simp add: composition triple_tauto)\n\nlemma code_extension_backward :\n  \"triple net failures p c' q \\<Longrightarrow> c' \\<subseteq> c \\<Longrightarrow> triple net failures p c q\" \nproof -\n assume \"triple net failures p c' q\"\n then have \"triple net failures p (c' \\<union> c) q\"\n  using code_extension by blast\n moreover assume \"c' \\<subseteq> c\"\n then have \"c = c' \\<union> c\"\n  by (auto)\n ultimately show \"triple net failures p c q\"\n  by auto\nqed\n\n\n\n(* Some rules about this if-then-else should be derivable. *)\n\ndefinition if_then_else :: \"int \\<Rightarrow> inst list \\<Rightarrow> inst list \\<Rightarrow> inst list \\<Rightarrow> inst list\"\nwhere\n\"if_then_else beginning cond then_case else_case =\n cond\n @ (* beginning + length cond *)\n [Stack (PUSH_N (word_rsplit (word_of_int (beginning + int (length cond) + 8 + int (length else_case)) :: 16 word))), Pc JUMPI] \n @ (* beginning + length cond + 4 *)\n else_case\n @ (* beginning + length cond + length else_case + 4 *)\n [Stack (PUSH_N (word_rsplit (word_of_int (beginning + int (length cond) + int (length else_case) + 9 + int (length then_case)) :: 16 word))), Pc JUMP]\n @ (* beginning + length cond + length else_case + 8 *)\n [Pc JUMPDEST]\n @ (* beginning + length cond + length else_case + 9 *)\n then_case\n @ (* beginning + length cond + length else_case + 9 + length then_case *)\n [Pc JUMPDEST]\n\"\n\n(* example of if_then_else *)\n\n(* loop *)\n\n  \n(* precondition / post condition pair *)\n\n(* What would be the type of precondition? *)\n(* instruction_result \\<Rightarrow> bool\n * In the precondition, the program counter is overwritten.\n *)\n\n(* validity of pre, program, post triples.\n * Failures are considered as success.\n *)\n\nbundle hoare_bundle = \nsep_logged[simp]\ngas_any_sep[simp]\nsep_gas_any_sep[simp]\nsep_log_number_sep[simp]\nmemory8_sep[simp]\npure_sep[simp]\ncontinuing_sep[simp]\nsep_continuing_sep[simp]\nstorage_sep[simp]\nsep_storage[simp]\nstack_height_sep[simp]\nsep_stack_height[simp]\nsep_stack_height_sep[simp]\nstack_sep[simp]\nsep_stack[simp]\nsep_stack_sep[simp]\nprogram_counter_sep[simp]\nsep_program_counter[simp]\nsep_program_counter_sep[simp]\ncode_sep[simp]\nsep_code[simp]\nsep_code_sep[simp]\nsep_sep_code[simp]\ngas_pred_sep[simp]\nsep_gas_pred[simp]\nsep_gas_pred_sep[simp]\nmemory_usage_sep[simp]\nsep_memory_usage[simp]\nsep_memory_usage_sep[simp]\nstackHeightElmEquiv[simp]\nstackElmEquiv[simp]\npcElmEquiv[simp]\ngasElmEquiv[simp]\ncodeElmEquiv[simp]\nlookup_over[simp]\nlookup_over1[simp]\nshort_match[simp]\nmemory_as_set_def[simp]\nstorage_as_set_def[simp]\nlog_as_set_def[simp]\nbalance_as_set_def[simp]\nnext_state_def[simp]\nexecution_continue[simp]\nsep_true[simp]\nfalse_triple[simp]\nget_pure[simp]\nmove_pure[simp]\nmove_pureL[simp]\nsep_code_sep[simp]\npreE1[simp]\nsep_code_sep[simp]\nsep_sep_code[simp]\n  \n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/Hoare/Hoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7371581510799252, "lm_q2_score": 0.42632159254749036, "lm_q1q2_score": 0.31426643692775724}}
{"text": "section {* Host Properties *}\n\ntheory Wasm_Axioms imports Wasm begin\n\nlemma old_mem_size_def:\n  shows \"mem_size m = length (Rep_mem_rep (fst m)) div Ki64\"\n  unfolding mem_size_def mem_rep_length_def mem_length_def\n  by (simp split: prod.splits)\n\n(* these were originally axioms, but memory now has a concrete representation in the model *)\nlemma mem_grow_size:\n  assumes \"mem_grow m n = Some m'\"\n  shows \"(mem_size m + n) = mem_size m'\"\n  using assms Abs_mem_rep_inverse\n  unfolding mem_grow_def old_mem_size_def mem_append_def mem_rep_append_def bytes_replicate_def\n  by (auto simp add: Ki64_def Let_def split: prod.splits if_splits)\n\nlemma mem_grow_max1:\n  assumes \"mem_grow m n = Some m'\"\n  shows \"mem_max m = mem_max m'\"\n  using assms Abs_mem_rep_inverse\n  unfolding mem_grow_def mem_max_def mem_append_def \n  by (auto simp add: Ki64_def Let_def split: prod.splits if_splits)\n\nlemma mem_grow_max2:\n  assumes \"mem_grow m n = Some m'\"\n  shows \"pred_option ((\\<le>) (mem_size m')) (mem_max m')\"\n  using assms Abs_mem_rep_inverse\n  unfolding mem_grow_def mem_max_def mem_append_def\n  by (auto simp add: assms mem_grow_size Let_def split: prod.splits if_splits)\n\nlemma mem_grow_length:\n  assumes \"mem_grow m n = Some m'\"\n  shows \"(mem_length m + (n * Ki64)) = mem_length m'\"\n  using assms Abs_mem_rep_inverse\n        bytes_replicate_def mem_rep_append.rep_eq mem_rep_length.rep_eq\n  unfolding mem_grow_def mem_length_def old_mem_size_def mem_rep_append_def mem_append_def bytes_replicate_def\n  by (auto simp add: Let_def split: prod.splits if_splits)\n\nlemma mem_grow_byte_at_m:\n  assumes \"k < mem_length m\"\n          \"(mem_grow m n) = Some m'\"\n  shows \"byte_at m' k = byte_at m k\"\n  using assms\n  unfolding mem_rep_byte_at.rep_eq mem_length_def mem_rep_length.rep_eq mem_grow_def\n            mem_rep_append.rep_eq mem_append_def mem_rep_append_def mem_size_def byte_at_def\n  by (auto simp add: Abs_mem_rep_inverse nth_append Let_def split: prod.splits if_splits)\n\nlemma mem_grow_byte_at_m_n:\n  assumes \"k \\<ge> mem_length m\"\n          \"(mem_grow m n) = Some m'\"\n          \"k < mem_length m'\"\n  shows \"byte_at m' k = (zero_byte::byte)\"\n  using assms\n  unfolding mem_rep_byte_at.rep_eq mem_length_def mem_rep_length.rep_eq mem_grow_def\n            mem_rep_append.rep_eq mem_append_def mem_rep_append_def mem_size_def byte_at_def\n  by (auto simp add: Abs_mem_rep_inverse nth_append Let_def split: prod.splits if_splits)\n\nlemma load_size:\n  \"(load m n off l = None) = (mem_length m < (off + n + l))\"\n  unfolding load_def\n  by (cases \"n + off + l \\<le> mem_length m\") auto\n\nlemma load_packed_size:\n  \"(load_packed sx m n off lp l = None) = (mem_length m < (off + n + lp))\"\n  using load_size\n  unfolding load_packed_def\n  by (cases \"n + off + l \\<le> mem_length m\") auto  \n\nlemma store_size1:\n  \"(store m n off v l = None) = (mem_length m < (off + n + l))\"\n  unfolding store_def\n  by (cases \"n + off + l \\<le> mem_length m\") auto\n\nlemma store_size:\n  assumes \"(store m n off v l = Some m')\"\n  shows \"mem_size m = mem_size m'\"\n  using assms Abs_mem_rep_inverse mem_rep_length.rep_eq\n  unfolding store_def mem_rep_write_bytes_def write_bytes_def \n            bytes_takefill_def\n  apply (cases \"n + off + l \\<le> mem_length m\") \n  apply(auto simp add: old_mem_size_def mem_length_def split: prod.splits)\n  done\n\nlemma store_max:\n  assumes \"(store m n off v l = Some m')\"\n  shows \"mem_max m = mem_max m'\"\n  using assms Abs_mem_rep_inverse\n  unfolding store_def mem_max_def write_bytes_def\n  by (auto split: if_splits prod.splits)\n\nlemma store_length:\n  assumes \"(store m n off v l = Some m')\"\n  shows \"mem_length m = mem_length m'\"\n  using assms Abs_mem_rep_inverse mem_rep_length.rep_eq\n  unfolding store_def mem_rep_write_bytes_def write_bytes_def \n            bytes_takefill_def\n  apply (cases \"n + off + l \\<le> mem_length m\") \n  apply(auto simp add: old_mem_size_def mem_length_def split: prod.splits)\n  done\n\nlemma store_packed_size1:\n  \"(store_packed m n off v l = None) = (mem_length m < (off + n + l))\"\n  using store_size1\n  unfolding store_packed_def\n  by simp\n\nlemma store_packed_size:\n  assumes \"(store_packed m n off v l = Some m')\"\n  shows \"mem_size m = mem_size m'\"\n  using assms store_size\n  unfolding store_packed_def\n  by simp\n\nlemma store_packed_max:\n  assumes \"(store_packed m n off v l = Some m')\"\n  shows \"mem_max m = mem_max m'\"\n  using assms store_max\n  unfolding store_packed_def\n  by simp\n\naxiomatization where\n  wasm_deserialise_type:\"typeof (wasm_deserialise bs t) = t\"\n\naxiomatization where\n    host_apply_preserve_store1:\"host_apply s (t1s _> t2s) f vs hs (Some (s', vs')) \\<Longrightarrow> store_extension s s'\"\nand host_apply_preserve_store2:\"host_apply s (t1s _> t2s) f vs hs (Some (s', vs')) \\<Longrightarrow> store_typing s \\<Longrightarrow> store_typing s'\"\nand host_apply_respect_type:\"list_all2 types_agree t1s vs \\<Longrightarrow> host_apply s (t1s _> t2s) f vs hs (Some (s', vs')) \\<Longrightarrow> list_all2 types_agree t2s vs'\"\n\nlemma host_apply_preserve_store:\n  assumes \"host_apply s (t1s _> t2s) f vs hs (Some (s', vs'))\"\n          \"store_typing s\"\n  shows \"store_extension s s' \\<and> store_typing s'\"\n  using assms host_apply_preserve_store1 host_apply_preserve_store2\n  by blast\n\nend", "meta": {"author": "WasmCert", "repo": "WasmCert-Isabelle", "sha": "f61ec8eab5d551347a268e858e83b7ac7da0d8b5", "save_path": "github-repos/isabelle/WasmCert-WasmCert-Isabelle", "path": "github-repos/isabelle/WasmCert-WasmCert-Isabelle/WasmCert-Isabelle-f61ec8eab5d551347a268e858e83b7ac7da0d8b5/WebAssembly/Wasm_Axioms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.31416402489226614}}
{"text": "theory inSumUpData\n\nimports bundle.SB\n  begin\n\ntypedef inSumUp=\"{cin}\"\n  by auto\n\n\ninstantiation inSumUp::\"{somechan,finite}\"\nbegin\ndefinition \"Rep = Rep_inSumUp\"\ninstance\n  apply(standard)\n  apply(auto simp add: Rep_inSumUp_def cEmpty_def)\n  apply(auto simp add: ctype_empty_iff)\n  using ctype_empty_iff\n  apply (metis Rep_inSumUp cMsg.simps ex_in_conv insertE insert_iff)\n  apply (meson Rep_inSumUp_inject injI) using cMsg.elims Rep_inSumUp apply simp\n  using type_definition.Abs_image type_definition_inSumUp typedef_finite_UNIV by fastforce\nend\n\ndefinition \"SumUpin \\<equiv> Abs_inSumUp cin\"\n\nfree_constructors inSumUp for \"SumUpin\"\n  by (metis(full_types) Abs_inSumUp_cases singletonD)\n\nlemma Andin1_rep [simp]: \"Rep (SumUpin) = cin\"\n  using Rep_inSumUp Rep_inSumUp_def by auto\n\nfun inSumUpChan::\"('bool::type \\<Rightarrow> 'a::type) \\<Rightarrow> 'bool \\<Rightarrow> inSumUp \\<Rightarrow> 'a\" where\n\"inSumUpChan Cc1 bool SumUpin = Cc1 bool\"\n\nabbreviation \"buildSumUpinSBE \\<equiv> inSumUpChan (Untimed o \\<N>)\" \n\nlemma buildsumUpin_ctype: \"buildSumUpinSBE a c \\<in> ctype (Rep c)\"\n  sorry\n\nlemma buildsumUpin_inj: \"inj buildSumUpinSBE\"\n  sorry\n\nlemma buildsumUpin_range: \"range (\\<lambda>a. buildSumUpinSBE a c) = ctype (Rep c)\"\n  sorry\n\nlemma buildsumUpin_surj: assumes \"sbElem_well (Some sbe)\"\n  shows \"sbe \\<in> range buildSumUpinSBE\"\nproof -\n  have ctypewell:\"\\<And> c. sbe c\\<in> ctype (Rep c)\"\n    using assms by auto\n  hence \"\\<And>c. sbe c \\<in> range (\\<lambda>a. buildSumUpinSBE a c)\"\n    by (simp add: buildsumUpin_range)\n  hence \"\\<exists>prod. sbe = buildSumUpinSBE prod\"\n    apply(subst fun_eq_iff,auto)\n    sorry\n  thus ?thesis\n    by auto\nqed\n\nabbreviation \"buildSumUpinSB \\<equiv> inSumUpChan (Rep_cfun (smap ((Untimed o \\<N>))))\" \n\nend", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/demo/sumUp/inSumUpData.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3141508004314963}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory fncall\nimports \"CParser.CTranslation\"\nbegin\n\ndeclare sep_conj_ac [simp add]\n\nprimrec\n  fac :: \"nat \\<Rightarrow> nat\"\nwhere\n  \"fac 0 = 1\"\n| \"fac (Suc n) = (Suc n) * fac n\"\n\nML \\<open>\n\nval ast = IsarInstall.get_Csyntax @{theory} \"fncall.c\"\n\n\\<close>\n\nexternal_file \"fncall.c\"\ninstall_C_file \"fncall.c\"\n\ncontext fncall\nbegin\n\n\nthm \"\\<Gamma>_def\"\nthm has_bogus_spec_'proc_def\nthm has_bogus_spec_impl\nthm f_impl\nthm g_impl\nthm h_impl\nthm i_impl\nthm calls_bogus_impl\nthm f_body_def\nthm g_body_def\nthm fact_body_def\n\nthm fact_'proc_def\n\nthm has_bogus_spec_modifies\nthm g_modifies\nthm f_modifies\nthm fact_modifies\n\nterm \"f_body\"\nterm \"\\<Gamma>\"\nterm \"fact_body\"\nterm \"f_'proc\"\n\nend\n\nprint_locale fncall_global_addresses\n\nprint_locale g_modifies\nthm g_modifies_def\n\nprint_locale f_spec\nthm f_spec_def\n\nlemma (in g_modifies)\n  shows \"\\<Gamma> \\<turnstile> \\<lbrace> \\<acute>t_hrs = t \\<rbrace> \\<acute>ret__int :== PROC g() \\<lbrace> \\<acute>t_hrs = t \\<rbrace>\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\n\nlemma (in fncall_global_addresses) f_impl_result:\n  \"\\<Gamma> f_'proc = Some f_body\"\n  apply (rule f_impl)\n  done\n\nlemma (in fncall_global_addresses) g_spec:\n  shows\n  \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== PROC g() \\<lbrace> \\<acute>ret__int = 257 \\<rbrace>\"\n  apply vcg\n  done\n\nlemma (in fncall_global_addresses) foo:\n  shows\n   \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== PROC f(n) \\<lbrace> \\<acute>ret__int = 1 \\<rbrace>\"\napply vcg\napply (simp )\ndone\n\nlemma (in f_spec) foo :\nshows\n  \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== CALL f(\\<acute>n) \\<lbrace> \\<acute>ret__int = 1 \\<rbrace>\"\n\napply vcg\ndone\n\nlemma (in fncall_global_addresses) bar:\nshows \"\\<Gamma> \\<turnstile> \\<lbrace> 1\\<le> \\<acute>n & \\<acute>n \\<le> 12 \\<rbrace> \\<acute>ret__int :== CALL fact(\\<acute>n) \\<lbrace> \\<acute>ret__int = of_nat (fac (unat \\<acute>n)) \\<rbrace>\"\napply vcg\napply unat_arith\noops\n\nlemma (in fncall_global_addresses) baz:\nshows \"\\<Gamma> \\<turnstile>\\<^bsub>/UNIV\\<^esub> \\<lbrace> \\<acute>t_hrs = t \\<rbrace> \\<acute>ret__int :== PROC i() \\<lbrace> \\<acute>t_hrs = t \\<rbrace>\"\napply (hoare_rule HoarePartial.ProcRec1)\napply (vcg spec=modifies)\ndone\n\nlocale ih = i_modifies + h_modifies\nlemma (in ih) qux:\nshows \"\\<forall>t. \\<Gamma> \\<turnstile> \\<lbrace>\\<acute>t_hrs = t\\<rbrace> \\<acute>ret__int :== CALL i() \\<lbrace> t = \\<acute>t_hrs \\<rbrace>\"\napply vcg\noops\n\nlocale ff = f_spec + f_modifies\n(* this lemma is bogus, because f does actually modify the globals *)\nlemma (in ff) bogus1:\nshows \"\\<forall>t. \\<Gamma> \\<turnstile> \\<lbrace> \\<acute>t_hrs = t \\<rbrace> \\<acute>ret__int :== CALL f(\\<acute>n) \\<lbrace> t = \\<acute>t_hrs \\<rbrace>\"\napply vcg\napply simp\ndone\n\nlemma (in has_bogus_spec_spec) bogus2:\nshows \"\\<Gamma> \\<turnstile> \\<lbrace> \\<acute>n = 42 \\<rbrace> \\<acute>ret__int :== CALL has_bogus_spec() \\<lbrace> \\<acute>ret__int = 4 \\<rbrace>\"\napply vcg\ndone\n\nlemma (in fncall_global_addresses) toldyou:\nshows \"\\<Gamma> \\<turnstile> \\<lbrace> \\<acute>n = 42 \\<rbrace> \\<acute>ret__int :== CALL has_bogus_spec() \\<lbrace> \\<acute>ret__int = 3 \\<rbrace>\"\napply vcg\ndone\n\nlemma (in has_bogus_spec_spec) bogus3:\nshows \"\\<Gamma> \\<turnstile> \\<lbrace> \\<acute>n = 42 \\<rbrace> \\<acute>ret__int :== CALL calls_bogus() \\<lbrace> \\<acute>ret__int = 4 \\<rbrace>\"\napply vcg\ndone\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/CParser/tools/c-parser/testfiles/fncall.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3141508004314963}}
{"text": "(*  Title:      HOL/Auth/n_mutualEx.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx imports n_mutualEx_lemma_invs_on_rules n_mutualEx_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mutualEx/n_mutualEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3141508004314963}}
{"text": "section\\<open>LTL for EFSMs\\<close>\ntext\\<open>This theory builds off the \\texttt{Linear\\_Temporal\\_Logic\\_on\\_Streams} theory from the HOL\nlibrary and defines functions to ease the expression of LTL properties over EFSMs. Since the LTL\noperators effectively act over traces of models we must find a way to express models as streams.\\<close>\n\ntheory EFSM_LTL\nimports \"EFSM.EFSM\" \"HOL-Library.Linear_Temporal_Logic_on_Streams\"\nbegin\n\ntext_raw\\<open>\\snip{statedef}{1}{2}{%\\<close>\nrecord state =\n  statename :: \"nat option\"\n  datastate :: registers\n  action :: action\n  \"output\" :: outputs\ntext_raw\\<open>}%endsnip\\<close>\n\ntext_raw\\<open>\\snip{whitebox}{1}{2}{%\\<close>\ntype_synonym whitebox_trace = \"state stream\"\ntext_raw\\<open>}%endsnip\\<close>\n\ntype_synonym property = \"whitebox_trace \\<Rightarrow> bool\"\n\nabbreviation label :: \"state \\<Rightarrow> String.literal\" where\n  \"label s \\<equiv> fst (action s)\"\n\nabbreviation inputs :: \"state \\<Rightarrow> value list\" where\n  \"inputs s \\<equiv> snd (action s)\"\n\ntext_raw\\<open>\\snip{ltlStep}{1}{2}{%\\<close>\nfun ltl_step :: \"transition_matrix \\<Rightarrow> cfstate option \\<Rightarrow> registers \\<Rightarrow> action \\<Rightarrow> (nat option \\<times> outputs \\<times> registers)\" where\n  \"ltl_step _ None r _ = (None, [], r)\" |\n  \"ltl_step e (Some s) r (l, i) = (let possibilities = possible_steps e s r l i in\n                   if possibilities = {||} then (None, [], r)\n                   else\n                     let (s', t) = Eps (\\<lambda>x. x |\\<in>| possibilities) in\n                     (Some s', (evaluate_outputs t i r), (evaluate_updates t i r))\n                  )\"\ntext_raw\\<open>}%endsnip\\<close>\n\nlemma ltl_step_singleton:\n\"\\<exists>t. possible_steps e n r (fst v) (snd v) = {|(aa, t)|} \\<and> evaluate_outputs t (snd v) r  = b \\<and> evaluate_updates t (snd v) r = c\\<Longrightarrow>\nltl_step e (Some n) r v = (Some aa, b, c)\"\n  apply (cases v)\n  by auto\n\nlemma ltl_step_none: \"possible_steps e s r a b = {||} \\<Longrightarrow> ltl_step e (Some s) r (a, b) = (None, [], r)\"\n  by simp\n\nlemma ltl_step_none_2: \"possible_steps e s r (fst ie) (snd ie) = {||} \\<Longrightarrow> ltl_step e (Some s) r ie = (None, [], r)\"\n  by (metis ltl_step_none prod.exhaust_sel)\n\nlemma ltl_step_alt: \"ltl_step e (Some s) r t = (\n  let possibilities = possible_steps e s r (fst t) (snd t) in\n  if possibilities = {||} then\n    (None, [], r)\n  else\n  let (s', t') = Eps (\\<lambda>x. x |\\<in>| possibilities) in\n  (Some s', (apply_outputs (Outputs t') (join_ir (snd t) r)), (apply_updates (Updates t') (join_ir (snd t) r) r))\n)\"\n  by (case_tac t, simp add: Let_def)\n\nlemma ltl_step_some:\n  assumes \"possible_steps e s r l i = {|(s', t)|}\"\n      and \"evaluate_outputs t i r = p\"\n      and \"evaluate_updates t i r = r'\"\n    shows \"ltl_step e (Some s) r (l, i) = (Some s', p, r')\"\n  by (simp add: assms)\n\nlemma ltl_step_cases:\n  assumes invalid: \"P (None, [], r)\"\n      and valid: \"\\<forall>(s', t) |\\<in>| (possible_steps e s r l i). P (Some s', (evaluate_outputs t i r), (evaluate_updates t i r))\"\n    shows \"P (ltl_step e (Some s) r (l, i))\"\n  apply simp\n  apply (case_tac \"possible_steps e s r l i\")\n   apply (simp add: invalid)\n  apply simp\n  apply (case_tac \"SOME xa. xa = x \\<or> xa |\\<in>| S'\")\n  apply simp\n  apply (insert assms(2))\n  apply (simp add: fBall_def Ball_def fmember_def)\n  by (metis (mono_tags, lifting) fst_conv prod.case_eq_if snd_conv someI_ex)\n\ntext\\<open>The \\texttt{make\\_full\\_observation} function behaves similarly to \\texttt{observe\\_execution}\nfrom the \\texttt{EFSM} theory. The main difference in behaviour is what is recorded. While the\nobserve execution function simply observes an execution of the EFSM to produce the corresponding\noutput for each action, the intention here is to record every detail of execution, including the\nvalues of internal variables.\n\nThinking of each action as a step forward in time, there are five components which characterise\na given point in the execution of an EFSM. At each point, the model has a current control state and\ndata state. Each action has a label and some input parameters, and its execution may produce\nsome observableoutput. It is therefore sufficient to provide a stream of 5-tuples containing the\ncurrent control state, data state, the label and inputs of the action, and computed output. The\nmake full observation function can then be defined as in Figure 9.1, with an additional\nfunction watch defined on top of this which starts the make full observation off in the\ninitial control state with the empty data state.\n\nCareful inspection of the definition reveals another way that \\texttt{make\\_full\\_observation}\ndiffers from \\texttt{observe\\_execution}. Rather than taking a cfstate, it takes a cfstate option.\nThe reason for this is that we need to make our EFSM models complete. That is, we need them to be\nable to respond to every action from every state like a DFA. If a model does not recognise a given\naction in a given state, we cannot simply stop processing because we are working with necessarily\ninfinite traces. Since these traces are generated by observing action sequences, the make full\nobservation function must keep processing whether there is a viable transition or not.\n\nTo support this, the make full observation adds an implicit ``sink state'' to every EFSM it\nprocesses by lifting control flow state indices from \\texttt{nat} to \\texttt{nat option} such that\nstate $n$ is seen as state \\texttt{Some} $n$. The control flow state \\texttt{None} represents a sink\nstate. If a model is unable to recognise a particular action from its current state, it moves into\nthe \\texttt{None} state. From here, the behaviour is constant for the rest of the time --- the\ncontrol flow state remains None; the data state does not change, and no output is produced.\\<close>\n\ntext_raw\\<open>\\snip{makeFullObservation}{1}{2}{%\\<close>\nprimcorec make_full_observation :: \"transition_matrix \\<Rightarrow> cfstate option \\<Rightarrow> registers \\<Rightarrow> outputs \\<Rightarrow> action stream \\<Rightarrow> whitebox_trace\" where\n  \"make_full_observation e s d p i = (\n    let (s', o', d') = ltl_step e s d (shd i) in\n    \\<lparr>statename = s, datastate = d, action=(shd i), output = p\\<rparr>##(make_full_observation e s' d' o' (stl i))\n  )\"\ntext_raw\\<open>}%endsnip\\<close>\n\ntext_raw\\<open>\\snip{watch}{1}{2}{%\\<close>\nabbreviation watch :: \"transition_matrix \\<Rightarrow> action stream \\<Rightarrow> whitebox_trace\" where\n  \"watch e i \\<equiv> (make_full_observation e (Some 0) <> [] i)\"\ntext_raw\\<open>}%endsnip\\<close>\n\nsubsection\\<open>Expressing Properties\\<close>\ntext\\<open>In order to simplify the expression and understanding of properties, this theory defines a\nnumber of named functions which can be used to express certain properties of EFSMs.\\<close>\n\nsubsubsection\\<open>State Equality\\<close>\ntext\\<open>The \\textsc{state\\_eq} takes a cfstate option representing a control flow state index and\nreturns true if this is the control flow state at the head of the full observation.\\<close>\n\nabbreviation state_eq :: \"cfstate option \\<Rightarrow> whitebox_trace \\<Rightarrow> bool\" where\n  \"state_eq v s \\<equiv> statename (shd s) = v\"\n\nlemma state_eq_holds: \"state_eq s = holds (\\<lambda>x. statename x = s)\"\n  apply (rule ext)\n  by (simp add: holds_def)\n\nlemma state_eq_None_not_Some: \"state_eq None s \\<Longrightarrow> \\<not> state_eq (Some n) s\"\n  by simp\n\nsubsubsection\\<open>Label Equality\\<close>\ntext\\<open>The \\textsc{label\\_eq} function takes a string and returns true if this is equal to the label\nat the head of the full observation.\\<close>\n\nabbreviation \"label_eq v s \\<equiv> fst (action (shd s)) = (String.implode v)\"\n\nlemma watch_label: \"label_eq l (watch e t) = (fst (shd t) = String.implode l)\"\n  by (simp add: )\n\nsubsubsection\\<open>Input Equality\\<close>\ntext\\<open>The \\textsc{input\\_eq} function takes a value list and returns true if this is equal to the\ninput at the head of the full observation.\\<close>\n\nabbreviation \"input_eq v s \\<equiv> inputs (shd s) = v\"\n\nsubsubsection\\<open>Action Equality\\<close>\ntext\\<open>The \\textsc{action\\_eq} function takes a (label, value list) pair and returns true if this is\nequal to the action at the head of the full observation. This effectively combines\n\\texttt{label\\_eq} and \\texttt{input\\_eq} into one function.\\<close>\n\nabbreviation \"action_eq e \\<equiv> label_eq (fst e) aand input_eq (snd e)\"\n\nsubsubsection\\<open>Output Equality\\<close>\ntext\\<open>The \\textsc{output\\_eq} function takes a takes a value option list and returns true if this is\nequal to the output at the head of the full observation.\\<close>\n\nabbreviation \"output_eq v s \\<equiv> output (shd s) = v\"\n\ntext_raw\\<open>\\snip{ltlVName}{1}{2}{%\\<close>\ndatatype ltl_vname = Ip nat | Op nat | Rg nat\ntext_raw\\<open>}%endsnip\\<close>\n\nsubsubsection\\<open>Checking Arbitrary Expressions\\<close>\ntext\\<open>The \\textsc{check\\_exp} function takes a guard expression and returns true if the guard\nexpression evaluates to true in the given state.\\<close>\n\ntype_synonym ltl_gexp = \"ltl_vname gexp\"\n\ndefinition join_iro :: \"value list \\<Rightarrow> registers \\<Rightarrow> outputs \\<Rightarrow> ltl_vname datastate\" where\n  \"join_iro i r p = (\\<lambda>x. case x of\n    Rg n \\<Rightarrow> r $ n |\n    Ip n \\<Rightarrow> Some (i ! n) |\n    Op n \\<Rightarrow> p ! n\n  )\"\n\nlemma join_iro_R [simp]: \"join_iro i r p (Rg n) = r $ n\"\n  by (simp add: join_iro_def)\n\nabbreviation \"check_exp g s \\<equiv> (gval g (join_iro (snd (action (shd s))) (datastate (shd s)) (output (shd s))) = trilean.true)\"\n\nlemma alw_ev: \"alw f = not (ev (\\<lambda>s. \\<not>f s))\"\n  by simp\n\nlemma alw_state_eq_smap:\n  \"alw (state_eq s) ss = alw (\\<lambda>ss. shd ss = s) (smap statename ss)\"\n  apply standard\n   apply (simp add: alw_iff_sdrop )\n  by (simp add: alw_mono alw_smap )\n\nsubsection\\<open>Sink State\\<close>\ntext\\<open>Once the sink state is entered, it cannot be left and there are no outputs or updates\nhenceforth.\\<close>\n\nlemma shd_state_is_none: \"(state_eq None) (make_full_observation e None r p t)\"\n  by (simp add: )\n\nlemma unfold_observe_none: \"make_full_observation e None d p t = (\\<lparr>statename = None, datastate = d, action=(shd t), output = p\\<rparr>##(make_full_observation e None d [] (stl t)))\"\n  by (simp add: stream.expand)\n\nlemma once_none_always_none_aux:\n  assumes \"\\<exists> p r i. j = (make_full_observation e None r p) i\"\n  shows \"alw (state_eq None) j\"\n  using assms apply coinduct\n  apply (simp add: )\n  by fastforce\n\nlemma once_none_always_none: \"alw (state_eq None) (make_full_observation e None r p t)\"\n  using once_none_always_none_aux by blast\n\nlemma once_none_nxt_always_none: \"alw (nxt (state_eq None)) (make_full_observation e None r p t)\"\n  using once_none_always_none\n  by (simp add: alw_iff_sdrop del: sdrop.simps)\n\nlemma snth_sconst: \"(\\<forall>i. s !! i = h) = (s = sconst h)\"\n  by (metis funpow_code_def id_funpow sdrop_simps(1) sdrop_siterate siterate.simps(1) smap_alt smap_sconst snth.simps(1) stream.map_id)\n\nlemma alw_sconst: \"(alw (\\<lambda>xs. shd xs = h) t) = (t = sconst h)\"\n  by (simp add: snth_sconst[symmetric] alw_iff_sdrop)\n\nlemma smap_statename_None: \"smap statename (make_full_observation e None r p i) = sconst None\"\n  by (meson EFSM_LTL.alw_sconst alw_state_eq_smap once_none_always_none)\n\nlemma alw_not_some: \"alw (\\<lambda>xs. statename (shd xs) \\<noteq> Some s) (make_full_observation e None r p t)\"\n  by (metis (mono_tags, lifting) alw_mono once_none_always_none option.distinct(1) )\n\nlemma state_none: \"((state_eq None) impl nxt (state_eq None)) (make_full_observation e s r p t)\"\n  by (simp add: )\n\nlemma state_none_2:\n  \"(state_eq None) (make_full_observation e s r p t) \\<Longrightarrow>\n   (state_eq None) (make_full_observation e s r p (stl t))\"\n  by (simp add: )\n\nlemma no_output_none_aux:\n  assumes \"\\<exists> p r i. j = (make_full_observation e None r []) i\"\n  shows \"alw (output_eq []) j\"\n  using assms apply coinduct\n  apply simp\n  by fastforce\n\nlemma no_output_none: \"nxt (alw (output_eq [])) (make_full_observation e None r p t)\"\n  using no_output_none_aux by auto\n\nlemma nxt_alw: \"nxt (alw P) s \\<Longrightarrow> alw (nxt P) s\"\n  by (simp add: alw_iff_sdrop)\n\nlemma no_output_none_nxt: \"alw (nxt (output_eq [])) (make_full_observation e None r p t)\"\n  using nxt_alw no_output_none by blast\n\nlemma no_output_none_if_empty: \"alw (output_eq []) (make_full_observation e None r [] t)\"\n  by (metis (mono_tags, lifting) alw_nxt make_full_observation.simps(1) no_output_none state.select_convs(4))\n\nlemma no_updates_none_aux:\n  assumes \"\\<exists> p i. j = (make_full_observation e None r p) i\"\n  shows \"alw (\\<lambda>x. datastate (shd x) = r) j\"\n  using assms apply coinduct\n  by fastforce\n\nlemma no_updates_none: \"alw (\\<lambda>x. datastate (shd x) = r) (make_full_observation e None r p t)\"\n  using no_updates_none_aux by blast\n\nlemma action_components: \"(label_eq l aand input_eq i) s = (action (shd s) = (String.implode l, i))\"\n  by (metis fst_conv prod.collapse snd_conv)\n\nend\n", "meta": {"author": "jmafoster1", "repo": "efsm-isabelle", "sha": "fde322562b98c9b4618c112e36a6ac5b9a056610", "save_path": "github-repos/isabelle/jmafoster1-efsm-isabelle", "path": "github-repos/isabelle/jmafoster1-efsm-isabelle/efsm-isabelle-fde322562b98c9b4618c112e36a6ac5b9a056610/EFSM_LTL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5234203489363239, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.31415080043149624}}
{"text": "theory Calc_Mem_Imp_Hoare_Example\n  imports Calc_Mem_Imp \"../../Hoare/Hoare_Step\" \"../../Hoare/Hoare_Lift\" \n    \"../../Language_Components/Mem/Mem_Simple\"\n    \"../../Lifter/Auto_Lifter_Proofs\" \"../../Composition/Composition_Lifter\"\n    \"Calc_Mem_Imp_Hoare\"\nbegin\n\n(* final definitions that perhaps should be in mem_simple (TODO) *)\n\n\n(* Deriving a set of Hoare logic rules useful for reasoning about imperative code in Imp.\n * then, proceeding with an example.\n *)\n\nabbreviation sems where\n\"sems \\<equiv> {calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l}\"\n\nabbreviation sems_nos where\n\"sems_nos \\<equiv> {calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l}\"\n\ndefinition sem_final' :: \"syn \\<Rightarrow> ('s, _) state \\<Rightarrow> ('s, _) state\" where\n\"sem_final' =\n  pcomps [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l]\"\n\n\n(*lemma idea:\n  - if, for each syntax, we can show one function is dominant\n  - then we know sups_pres\n  - maybe this is actually the best way to do it.\n  - what about building this argument up from sub-sets?\n    - might be ok if all languages leave things unchanged for other syntax.\n*)\n(*\nlemma dominant_sups_pres2 ::\n  assumes \"f \\<downharpoonleft> {} x\"\n*)  \n\n(*\nok, so... how can we do this?\nsups_pres of e.g. calc and mem...\n- dominance\n- need a nice way to \"walk the tree\" of liftings and compare priorities\n*)\n\n(*\n(* New idea: have a lifting for use in theorems about the state. *)\n(* in this case we can just use mem_lift1 I think. *)\n\nlemma calc_sem_l_valid :\n  \"\"\n*)\n\nlemma sups_pres_calc :\n  \"sups_pres {calc_sem_l} (\\<lambda> _ . ok_S)\"\n  using sups_pres_singletonI\n  by auto\n\nlemma pres :\n\"sups_pres sems (\\<lambda> _ . ok_S)\"\n  by(rule sups_pres_finite_all; auto)\n\n(* concrete state *)\ntype_synonym cstate = \"(syn, unit) Mem_Simple.state\"\n\ndefinition start_state :: \"syn gensyn \\<Rightarrow> (syn, unit) Mem_Simple.state\" where\n\"start_state prog =\n  ( Swr [prog]\n  , mdp 0 (Some (mdt None))\n  , Swr 0, Swr 0, Swr 0, Swr 0\n  , Swr empty\n  , ())\"\n\ndefinition state_mem where\n\"state_mem st =\n  (case st of\n    (_, _, _, _, _, _, m, _) \\<Rightarrow> m)\"\n\ndefinition prog_mini :: \"syn gensyn\" where\n\"prog_mini =  G (Sc (Cnum 42)) []\n\"\n\n(* first test: a simple arithmetic *)\ndefinition prog0 :: \"syn gensyn\" where\n\"prog0 =\n  G (Ss Sseq)\n  [ G (Sc (Cnum 42)) []\n  , G (Sm (Swrite (STR ''A'') Reg_c)) []\n  ]\"\n\ndefinition prog00 :: \"syn gensyn\" where\n\"prog00 =\n  G (Sb (Seqz)) []\n  \"\n\n\n(* multiplication as repeated addition *)\n(* start with c = 0\n * add arg1 to c\n * decrement arg2 *)\n\ndefinition prog1 :: \"int \\<Rightarrow> int \\<Rightarrow> syn gensyn\" where\n\"prog1 i1 i2 =\n  G (Ss Sseq)\n  [ G (Sc (Cnum i1)) []\n  , G (Sm (Swrite (STR ''arg1'') (Reg_c))) []\n  , G (Sc (Cnum i2)) []\n  , G (Sm (Swrite (STR ''arg2'') (Reg_c))) []\n  , G (Sc (Cnum 1)) []\n  , G (Sm (Swrite (STR ''one'') (Reg_c))) []\n  , G (Sc (Cnum 0)) []\n  , G (Sm (Swrite (STR ''acc'') (Reg_c))) []\n\n  , G (Sm (Sread (STR ''arg2'') (Reg_c))) []\n  , G (Sb Sgtz) []\n\n  , G (Si SwhileC)\n    [ G (Ss Sseq)\n      [G (Sm (Sread (STR ''arg1'') (Reg_a))) []\n      , G (Sm (Sread (STR ''acc'') (Reg_b))) []\n      , G (Sc Cadd) []\n      , G (Sm (Swrite (STR ''acc'') (Reg_c))) []\n      , G (Sm (Sread (STR ''arg2'') (Reg_a))) []\n      , G (Sm (Sread (STR ''one'') (Reg_b))) []\n      , G (Sc Csub) []\n      , G (Sm (Swrite (STR ''arg2'') (Reg_c))) []\n      , G (Sm (Sread (STR ''arg2'') (Reg_c))) []\n      , G (Sb Sgtz) []\n      ]\n    ]\n  ]\n\"\n\n(*\nterm \"sem_run sem_final\"\n\nvalue \"sem_run sem_final 100 (start_state prog0)\"\n\nvalue \"sem_run (pcomps [calc_sem_l, mem_sem_l, seq_sem_l, cond_sem_l]) 100 (start_state prog_mini)\"\n\n\nvalue \"sem_run sem_final 100 (start_state prog_mini)\"\n\nvalue \"sem_run sem_final 100 (start_state (prog1 2 3))\"\n*)\n\n\ndefinition oalist_check' :: \"('a :: linorder * 'b md_triv option md_prio) list \\<Rightarrow> bool\"\n  where\n\"oalist_check' l =\n  list_all\n    (\\<lambda> x . case x of\n      (k, mdp _ (Some (mdt _))) \\<Rightarrow> True\n      | _ \\<Rightarrow> False ) l\"\n\nlift_definition oalist_check :: \"('a :: linorder, 'b md_triv option md_prio) oalist \\<Rightarrow> bool\"\nis oalist_check' .\n\nfun oalist_unwrap' ::\n\"('a :: linorder * 'b md_triv option md_prio) list \\<Rightarrow>\n ('a :: linorder * 'b) list option\"\nwhere\n\"oalist_unwrap' [] = Some []\"\n| \"oalist_unwrap' (h#t) =\n  (case h of\n    (k, mdp _ (Some (mdt v))) \\<Rightarrow>\n      (case oalist_unwrap' t of\n        Some t' \\<Rightarrow> Some ((k, v)#t')\n        | None \\<Rightarrow> None)\n    | _ \\<Rightarrow> None)\"\n\nlemma oalist_unwrap'_keys :\n  \"oalist_unwrap' l = Some l' \\<Longrightarrow>\n   map fst l = map fst l'\"\nproof(induction l arbitrary: l')\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons a l)\n  then show ?case \n    by(auto split: prod.splits option.splits md_triv.splits md_prio.splits)\nqed\n\nlift_definition oalist_unwrap ::\n\"('a :: linorder, 'b md_triv option md_prio) oalist \\<Rightarrow> \n ('a :: linorder, 'b ) oalist option\"\nis oalist_unwrap' \nproof-\n  fix list :: \"('a :: linorder * 'b md_triv option md_prio) list\"\n  assume H : \"strict_order (map fst list)\"\n  \n  show \"pred_option (\\<lambda>xs. strict_order (map fst xs))\n        (oalist_unwrap' list)\"\n    using H oalist_unwrap'_keys[of list]\n    by(auto simp add: pred_option_def)\nqed\n\n\nlemma prog1_spec :\n  assumes Hi1 : \"0 < i1\" (* TODO: this should be \\<le>, but for (i think) a technical reason this makes things hard (existential quantifier related problems) *)\n  assumes Hi2 : \"0 \\<le> i2\"\n\n(* prog1 *)\n(*\narg1 := i1\narg2 := i2\none := 1\nacc := 0\nwhile (arg2 > 0) {\n  acc := acc + arg1\n  arg2 := arg2 - one\n}\n\n*)\n\nshows \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, (_ :: {Okay, Bogus, Mergeableb, Pordps})) state))| {~ (\\<lambda> st . st \\<in> ok_S) ~}\n                   [prog1 i1 i2]\n                   {~ (\\<lambda> st . st \\<in> ok_S \\<and>\n                      (case st of\n                        (reg_flag, reg_c, reg_a, reg_b, mem, xz) \\<Rightarrow>\n                          (case mem of\n                            (mdp p (Some (mdt mem'))) \\<Rightarrow> get mem'(STR ''acc'') = Some (i1 * i2)\n                            | _ \\<Rightarrow> False)))\n  ~}\"\n(*\n  using HTS_imp_HT''[where l' = calc_trans, where x = \"Calc_Mem_Imp.syn.Sc (Cnum i1)\"\n        , unfolded calc_trans.simps, OF HCalc_Cnum]\n*)\nproof-\n  fix gs P z l\n\n  have 1: \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, ('x )) state))| {~(\\<lambda> st . st \\<in> ok_S) ~}\n[ G (Sc (Cnum i1)) []] \n  {~(\\<lambda> st . st \\<in> ok_S \\<and> \n    (case st of (reg_flag, reg_c, reg_a, reg_b, mem, xz) \\<Rightarrow>\n      (case reg_c of mdp p reg_c' \\<Rightarrow> reg_c' = Some (mdt i1))))~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, ('x)) state))| {~ ?P0 ~}\n[ G (Sc (Cnum i1)) []] \n  {~ ?P1~}\")\n\n    apply(rule HT'Conseq)\n      apply(rule_tac P' = \"\\<lambda> _ . True\" in Calc_Final)\n       apply(fast) apply(fast)\n    apply(force  simp add: calc_lift'_def schem_lift_defs merge_l_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S)\n     apply(fast)\n    apply(force  simp add: calc_lift'_def schem_lift_defs merge_l_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S)\n    done\n\n  have 2 : \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, ('x)) state))| \n    {~ ?P1 ~}\n    [G (Sm (Swrite (STR ''arg1'') (Reg_c))) []]\n{~(\\<lambda>st. st \\<in> ok_S \\<and> (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow>\n                      (case m of\n                        mdp p (Some (mdt m')) \\<Rightarrow> get m' (STR ''arg1'') = Some i1\n                         | _ \\<Rightarrow> False)))~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P1 ~}\n    [G (Sm (Swrite (STR ''arg1'') (Reg_c))) []]\n  {~ ?P2 ~}\")\n\n\n    apply(rule HT'Conseq)\n      apply(rule_tac\n P = ?P1\nand P' = \"\\<lambda> st . case st of (_, x, _, _) \\<Rightarrow> x = i1\"\nin  Mem_Write_Final\n;\nfastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\nLNew_def)\n\n\n\n     apply(fast)\n\n      apply(fastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def) \n\n\n    done\n\n(* TODO: need assumption about mem being empty? *)\n  have 3: \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?P2~}\n[ G (Sc (Cnum i2)) []] \n  {~(\\<lambda> st . ?P2 st \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b, mem, xz) \\<Rightarrow>\n      (case reg_c of mdp p reg_c' \\<Rightarrow> reg_c' = Some (mdt i2))))~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?P2 ~}\n[ G (Sc (Cnum i2)) []] \n  {~ ?P3~}\")\n    apply(rule HT'Conseq)\n      apply(rule_tac P = ?P2 and P' = \"\\<lambda> _ . True\" in Calc_Final)\n       apply(fast) apply(fast) \n\n      apply(fastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def) \n\n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n    done\n\n  have 4 : \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P3 ~}\n    [G (Sm (Swrite (STR ''arg2'') (Reg_c))) []]\n{~(\\<lambda>st. st \\<in> ok_S \\<and> (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow>\n                      (case m of\n                        mdp p (Some (mdt m')) \\<Rightarrow> \n                          get m' (STR ''arg1'') = Some i1 \\<and> get m' (STR ''arg2'') = Some i2\n                         | _ \\<Rightarrow> False)))~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P3 ~}\n    [G (Sm (Swrite (STR ''arg2'') (Reg_c))) []]\n  {~ ?P4 ~}\")\n\n    apply(rule HT'Conseq)\n      apply(rule_tac P = ?P3\nand P' = \"\\<lambda> st . case st of (_, x, _, _, m) \\<Rightarrow> x = i2 \\<and> get m (STR ''arg1'') = Some i1\"\n  in Mem_Write_Final)\n       apply(fast) \n\n      apply(fastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n(* YOU ARE HERE. *)\n(* wat *)\n  apply(auto simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq\nsplit:md_triv.splits) \n    done\n\n  have 5 : \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P4 ~}\n    [G (Calc_Mem_Imp.syn.Sc (Cnum 1)) []]\n{~(\\<lambda>st. st \\<in> ok_S \\<and> ?P4 st \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b, mem, xz) \\<Rightarrow>\n      (case reg_c of mdp p reg_c \\<Rightarrow> reg_c = Some (mdt 1))))~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P4 ~}\n    _\n  {~ ?P5 ~}\")\n\n    apply(rule HT'Conseq)\n      apply(rule_tac P = ?P4\nand P' = \"\\<lambda> _ . True\"\n  in Calc_Final)\n       apply(fast) \n\n      apply(fastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n    done\n\n  have 6 : \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P5 ~}\n    [G (Calc_Mem_Imp.syn.Sm (Swrite STR ''one'' Reg_c)) []]\n{~(\\<lambda>st. st \\<in> ok_S \\<and> (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow>\n                      (case m of\n                        mdp p (Some (mdt m')) \\<Rightarrow> \n                          get m' (STR ''arg1'') = Some i1 \\<and> get m' (STR ''arg2'') = Some i2 \\<and> get m' (STR ''one'') = Some 1\n                         | _ \\<Rightarrow> False)))~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P5 ~}\n    _\n  {~ ?P6 ~}\")\n\n    apply(rule HT'Conseq)\n    apply(rule_tac P = ?P5\nand P' = \"\\<lambda> st . case st of (_, x, _, _, m) \\<Rightarrow> x = 1 \\<and> get m (STR ''arg1'') = Some i1 \\<and> get m (STR ''arg2'') = Some i2\"\nin Mem_Write_Final)\n       apply(fast) \n\n      apply(fastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq\nsplit: md_triv.splits) \n\n    done\n\n  have 7 : \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, ('x)) state))| \n    {~ ?P6 ~}\n    [G (Calc_Mem_Imp.syn.Sc (Cnum 0)) []]\n{~(\\<lambda>st. st \\<in> ok_S \\<and> ?P6 st \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b, mem, xz) \\<Rightarrow>\n      (case reg_c of mdp p reg_c \\<Rightarrow> reg_c = Some (mdt 0))))~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P6 ~}\n    _\n  {~ ?P7 ~}\")\n    apply(rule HT'Conseq)\n      apply(rule_tac P = ?P6\nand P' = \"\\<lambda> _ . True\"\n  in Calc_Final)\n       apply(fast) \n\n      apply(fastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n\n    done\n\n  have 8 : \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P7 ~}\n    [G (Calc_Mem_Imp.syn.Sm (Swrite STR ''acc'' Reg_c)) []]\n{~(\\<lambda>st. st \\<in> ok_S \\<and> (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow>\n                      (case m of\n                        mdp p (Some (mdt m')) \\<Rightarrow> \n                          get m' (STR ''arg1'') = Some i1 \\<and> get m' (STR ''arg2'') = Some i2 \\<and> get m' (STR ''one'') = Some 1 \\<and> get m' (STR ''acc'') = Some 0\n                         | _ \\<Rightarrow> False)))~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P7 ~}\n    _\n  {~ ?P8 ~}\")\n\n    apply(rule HT'Conseq)\n    apply(rule_tac P = ?P7\nand P' = \"\\<lambda> st . case st of (_, x, _, _, m) \\<Rightarrow> x = 0 \\<and> get m (STR ''arg1'') = Some i1 \n          \\<and> get m (STR ''arg2'') = Some i2\n          \\<and> get m (STR ''one'') = Some 1\"\n        \nin Mem_Write_Final)\n       apply(fast) \n\n      apply(fastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(force simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(auto simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq) \n\n    done\n\n(* TODO: we need to strengthen mem_read_final\nalong the same lines as mem_write_final. *)\n  have 9 : \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P8 ~}\n    [G (Calc_Mem_Imp.syn.Sm (Sread STR ''arg2'' Reg_c)) []]\n{~ (\\<lambda> st . st \\<in> ok_S \\<and> (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow>\n                      (case m of\n                        mdp p (Some (mdt m')) \\<Rightarrow> \n                          get m' (STR ''arg1'') = Some i1 \\<and> get m' (STR ''arg2'') = Some i2 \\<and> get m' (STR ''one'') = Some 1 \\<and> get m' (STR ''acc'') = Some 0\n                         | _ \\<Rightarrow> False) \\<and>\n                      (case reg_c of \n                        mdp p (Some (mdt x)) \\<Rightarrow> x = i2\n                        | _ \\<Rightarrow> False))) ~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P8 ~}\n    _\n  {~ ?P9 ~}\")\n\n    apply(rule HT'Conseq)\n    apply(rule_tac P = ?P8\nand P' = \"\\<lambda> st . (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m) \\<Rightarrow>\n                      get m (STR ''arg1'') = Some i1 \n          \\<and> get m (STR ''arg2'') = Some i2\n          \\<and> get m (STR ''one'') = Some 1\n          \\<and> get m (STR ''acc'') = Some 0)\"\nin Mem_Read_Final)\n\n       apply(fast) \n\n      apply(fastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n      apply(fastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n(*\n  apply(fastforce simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def oalist_map_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n*)\n\n    apply(clarify)\n\n  apply(simp add: calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq\nsplit: md_triv.splits) \n\n    apply(clarify)\n\n    apply(simp split: md_prio.splits md_triv.splits option.splits)\n\n\n    done\n\n(* establishing the invariant. *)\n(*\ninvariant: acc = i1 * (arg2 - i2)\n*)\n\n\n  have 10 : \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| \n    {~ ?P9 ~}\n    [G (Sb Sgtz) []]\n    {~ (\\<lambda> st . st \\<in> ok_S \\<and> (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow>\n                      (case m of\n                        mdp p (Some (mdt m')) \\<Rightarrow> \n                          get m' (STR ''arg1'') = Some i1 \\<and> get m' (STR ''arg2'') = Some i2 \\<and> get m' (STR ''one'') = Some 1 \\<and> get m' (STR ''acc'') = Some 0 \\<and>\n                         (case reg_flag of\n                          mdp p (Some (mdt reg_flag')) \\<Rightarrow>\n                            (reg_flag' = 0 \\<and> i2 \\<le> 0) \\<or> (reg_flag' = 1 \\<and> i2 > 0)\n                          | _ \\<Rightarrow> False)\n                         | _ \\<Rightarrow> False))) ~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))|{~ ?P9 ~}\n    [G (Sb Sgtz) []]\n    {~ ?P10 ~}\")\n    apply(rule HT'Conseq)\n    apply(rule_tac P = ?P9 and P' = \"\\<lambda> st . (case st of (b, x) \\<Rightarrow> x = i2)\"\nin Cond_Final)\n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n    apply(clarify)\n  apply(simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def cond_sem_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n    apply(clarify)\n    apply(case_tac \"(0 < i2)\")\n  apply(simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def cond_sem_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def cond_sem_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n    done\n\n  obtain Inv :: \"('x :: {Bogus,Okay,Mergeableb,Pordc_all, Pordps}) Mem_Simple.state1 \\<Rightarrow> bool\" where Inv_def :\n  \"Inv = (\\<lambda> st . st \\<in> ok_S \\<and> (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow>\n                      (case m of\n                        mdp p (Some (mdt m')) \\<Rightarrow> \n                          (\\<exists> (idx :: int) . get m' (STR ''arg1'') = Some i1 \\<and> \n                                       get m' (STR ''arg2'') = Some idx \\<and>\n                                       get m' (STR ''one'') = Some 1 \\<and>\n                                       get m' (STR ''acc'') = Some (i1 * (i2 - idx)) \\<and>\n                                       i2 \\<ge> idx \\<and>\n                                       (case reg_flag of mdp p (Some (mdt reg_flag')) \\<Rightarrow>\n                                         ((reg_flag' = 1 \\<and> idx > 0) \\<or> (reg_flag' = 0 \\<and> idx = 0))\n                                         | _ \\<Rightarrow> False))\n                        | _ \\<Rightarrow> False)))\"\n    by simp\n\n\n  have Inv_10 :\n    \"\\<And> st . (?P10 st) \\<Longrightarrow>\n  Inv st\"\n    using Hi2 unfolding Inv_def\n    by(auto split: md_triv.splits md_prio.splits option.splits)\n\n(* while loop body *)\n  have Body1 : \n\"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ (\\<lambda> st . \n                  Inv st \\<and>\n                  (case st of (mdp p (Some (mdt reg_flag')), _) \\<Rightarrow>\n                    reg_flag' \\<noteq> 0\n                   | _ \\<Rightarrow> False)) ~}\n  [G (Calc_Mem_Imp.syn.Sm (Sread STR ''arg1'' Reg_a)) []]\n  {~ (\\<lambda> st . st \\<in> ok_S \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case reg_a of\n        mdp p (Some (mdt reg_a')) \\<Rightarrow> reg_a' = i1 \\<and>\n        (case m of\n          mdp p (Some (mdt m')) \\<Rightarrow> \n            (\\<exists> idx . \nget m' (STR ''arg1'') = Some i1 \\<and>\nget m' (STR ''arg2'') = Some idx \\<and>\n                     get m' (STR ''one'') = Some 1 \\<and>\n                     get m' (STR ''acc'') = Some (i1 * (i2 - idx)) \\<and>\n                     i2 \\<ge> idx \\<and>idx > 0)\n          | _ \\<Rightarrow> False)\n        | _ \\<Rightarrow> False))) ~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?B0 ~} _ {~ ?B1 ~}\")\n    apply(rule HT'Conseq)\n    apply(rule_tac P = ?B0\nand P' = \"\\<lambda> st . (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m) \\<Rightarrow>\n                     reg_flag = 1 \\<and>\n                     (\\<exists> (idx :: int) . get m (STR ''arg1'') = Some i1 \\<and> \n                                 get m (STR ''arg2'') = Some idx \\<and>\n                                 get m (STR ''one'') = Some 1 \\<and>\n                                 get m (STR ''acc'') = Some (i1 * (i2 - idx)) \\<and>\n                                 i2 \\<ge> idx \\<and>idx > 0))\"\nin Mem_Read_Final)\n\n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force  simp add: Inv_def cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n \n  apply(force  simp add: Inv_def cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n  apply(fastforce simp add: Inv_def cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def cond_sem_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits option.splits) \n \n    done\n\n(*\n(\\<lambda> st . st \\<in> ok_S \\<and> (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow>\n                      (case m of\n                        mdp p (Some (mdt m')) \\<Rightarrow> \n                          (\\<exists> idx . get m' (STR ''arg1'') = Some i1 \\<and> \n                                       get m' (STR ''arg2'') = Some idx \\<and>\n                                       get m' (STR ''one'') = Some 1 \\<and>\n                                       get m' (STR ''acc'') = Some (i1 * (i2 - idx)) \\<and>\n                                       i2 \\<ge> idx \\<and>idx \\<ge> 0))))\n*)\n  have Body2 :\n\"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?B1 ~}\n  [G (Calc_Mem_Imp.syn.Sm (Sread STR ''acc'' Reg_b)) []]\n  {~ (\\<lambda> st . ?B1 st \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case reg_b of\n        mdp p (Some (mdt reg_b')) \\<Rightarrow> \n        (case m of\n          mdp p (Some (mdt m')) \\<Rightarrow>\n            (\\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = i1 * (i2 - idx) \\<and> \n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some idx \\<and>\n            get m' (STR ''acc'') = Some (i1 * (i2 - idx)))\n                      | _ \\<Rightarrow> False)\n                    | _ \\<Rightarrow> False))) ~}\"\n\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ _ ~} _ {~ ?B2 ~}\")\n    apply(rule HT'Conseq)\n    apply(rule_tac P = ?B1\nand P' = \"\\<lambda> st . (case st of\n                     (reg_flag, reg_c, reg_a, reg_b,  m) \\<Rightarrow>\n                     (\\<exists> idx . get m (STR ''arg1'') = Some i1 \\<and> i1 = reg_a \\<and>\n                                 get m (STR ''arg2'') = Some idx \\<and>\n                                 get m (STR ''one'') = Some 1 \\<and>\n                                 get m (STR ''acc'') = Some (i1 * (i2 - idx)) \\<and>\n                                 i2 \\<ge> idx \\<and>idx > 0))\"\nin Mem_Read_Final)\n\n\n  apply(force  simp add: Inv_def cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def cond_sem_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n    apply(clarify)\n\n  apply(simp add: Inv_def cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n      apply(clarify)\n  apply(simp add: Inv_def cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n     apply(clarify)\n  apply(simp add: Inv_def cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n    apply(clarify)\n\n     apply(\n simp add: Inv_def cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits option.splits) \n\n    apply(clarify)\n    apply(blast)\n\n    done\n\n\n  have Body3 :\n(*\n\"|(sem_final :: (syn \\<Rightarrow> (syn, (_ :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, (_ :: {Okay, Bogus, Mergeableb, Pordps})) state))| {~ ?B2 ~}\n  [G (Calc_Mem_Imp.syn.Sc Cadd) []]\n  {~ (\\<lambda> st . st \\<in> ok_S \\<and>(case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case (reg_a, reg_b, reg_c) of\n        (mdp _ (Some (mdt reg_a')), mdp _ (Some (mdt reg_b')), mdp _ (Some (mdt reg_c'))) \\<Rightarrow> \n        (case m of\n          mdp p (Some (mdt m')) \\<Rightarrow>\n            (\\<exists> idx . reg_c' = i1 * (i2 - idx) + i1 \\<and>\n                     reg_a' = i1 \\<and> reg_b' = i1 * (i2 - idx) \\<and>  get m' (STR ''acc'') = Some (i1 * (i2 - idx)) \\<and>\n                     i2 \\<ge> idx \\<and> idx \\<ge> 0)\n          | _ \\<Rightarrow> False)\n        | _ \\<Rightarrow> False))) ~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, (_ :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, (_ :: {Okay, Bogus, Mergeableb, Pordps})) state))| {~ _ ~} _ {~ ?B3 ~}\")\n*)\n(*\n\"|(sem_final :: (syn \\<Rightarrow> (syn, (_ :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, (_ :: {Okay, Bogus, Mergeableb, Pordps})) state))| {~ ?B2 ~}\n  [G (Calc_Mem_Imp.syn.Sc Cadd) []]\n  {~ (\\<lambda> st . ?B2 st \\<and>(case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case (reg_a, reg_b, reg_c) of\n        (mdp _ (Some (mdt reg_a')), mdp _ (Some (mdt reg_b')), mdp _ (Some (mdt reg_c'))) \\<Rightarrow> \n        (case m of\n          mdp p (Some (mdt m')) \\<Rightarrow>\n            (\\<exists> (idx :: int) . reg_c' = i1 + i1 * (i2 - idx) \\<and>\n                     reg_a' = i1 \\<and> reg_b' = i1 * (i2 - idx) \\<and>  \n                     get m' (STR ''acc'') = Some (i1 * (i2 - idx)) \\<and>\n                     get m' (STR ''arg2'') = Some idx \\<and>\n                     i2 \\<ge> idx \\<and> idx \\<ge> 0)\n          | _ \\<Rightarrow> False)\n        | _ \\<Rightarrow> False))) ~}\"\n*)\n(*\n\"|(sem_final :: (syn \\<Rightarrow> (syn, (_ :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, (_ :: {Okay, Bogus, Mergeableb, Pordps})) state))| {~ ?B2 ~}\n  [G (Calc_Mem_Imp.syn.Sc Cadd) []]\n  {~ (\\<lambda> st . ?B2 st \\<and>(case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case (reg_a, reg_b, reg_c) of\n        (mdp _ (Some (mdt reg_a')), mdp _ (Some (mdt reg_b')), mdp _ (Some (mdt reg_c'))) \\<Rightarrow> \n        reg_a' = i1 \\<and>\n         (\\<exists> (idx :: int) . i2 \\<ge> idx \\<and> idx > 0 \\<and> reg_b' = i1 * (i2 - idx) \\<and> reg_c' = i1 + i1 * (i2 - idx))\n        | _ \\<Rightarrow> False))) ~}\"\n*)\n(*maybe we need a different calc rule(unchanged stuff *)\n\"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?B2 ~}\n  [G (Calc_Mem_Imp.syn.Sc Cadd) []]\n  {~ (\\<lambda> st . ?B2 st \\<and>(case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case (reg_a, reg_b, reg_c) of\n        (mdp _ (Some (mdt reg_a')), mdp _ (Some (mdt reg_b')), mdp _ (Some (mdt reg_c'))) \\<Rightarrow> \n        reg_c' = reg_a' + reg_b'\n                | _ \\<Rightarrow> False))) ~}\"\n\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ _ ~} _ {~ ?B3 ~}\")\n\n    apply(rule HT'Conseq)\n(*\n    apply(rule_tac P = ?B2\nand P' = \"\\<lambda> _ . True\"\nin Calc_Final)\n*)\n(* TODO: looks like we actually do need a fact about the rest of the state\nremaining unchanged. (this is in cases like arith, for instance, we need\nto show a sort of \"frame\" where everything not in calc is unchanged *)\n\n(*\n    apply(rule_tac P = ?B2\nand P' = \"\\<lambda> st . case st of (reg_a, reg_b, reg_c) \\<Rightarrow>\n          reg_a = i1 \\<and>\n          (\\<exists> (idx :: int) . i2 \\<ge> idx \\<and> idx > 0 \\<and> reg_b = i1 * (i2 - idx))\"\nin Calc_Final)\n*)\n    apply(rule_tac Add_Final_Strong[of \"?B2\" \"\\<lambda> st . case st of (reg_a, reg_b, reg_c) \\<Rightarrow>\n          reg_a = i1 \\<and>\n          (\\<exists> (idx :: int) . i2 \\<ge> idx \\<and> idx > 0 \\<and> reg_b = i1 * (i2 - idx))\"])\n\n\n(*\n    apply(rule_tac P = ?B2\nand P' = \"\\<lambda> st . case st of (reg_a, reg_b, reg_c) \\<Rightarrow>\n          reg_a = i1 \\<and>\n          (\\<exists> (idx :: int) . i2 \\<ge> idx \\<and> idx > 0 \\<and> reg_b = i1 * (i2 - idx) \\<and>\n          (\\<forall> st_big st0 . ?B2 st_big \\<longrightarrow> \n             (case LOut mem_lift1 (Sread STR ''acc'' Reg_b) st_big of\n                     (reg_flag, reg_c, reg_a, reg_b',  m) \\<Rightarrow>\n(reg_b = reg_b' \\<longrightarrow>\n                     get m (STR ''arg2'') = Some idx))))\"\nin Add_Final)\n*)\n\n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n    apply(insert Hi2)\n    apply(insert Hi1)\n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n      apply(clarify)\n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n      apply(clarify)\n\n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n    apply(clarify)\n\n\n    apply(simp)\n    apply(insert Hi2)\n    apply(insert Hi1)\n\n  apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits) \n\n    apply(clarify)\n    apply(simp (no_asm_simp))\n(* begin experiment *)\n\n\n(* end experiment *)\n  apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def split: md_triv.splits\n) \n    done\n\n\n  have Body4 :\n\"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?B3 ~}\n  [G (Calc_Mem_Imp.syn.Sm (Swrite STR ''acc'' Reg_c)) []]\n  {~ (\\<lambda> st .  st \\<in> ok_S \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case (reg_a, reg_b, reg_c, m) of\n        (mdp _ (Some (mdt reg_a')), mdp _ (Some (mdt reg_b')), mdp _ (Some (mdt reg_c')), mdp _ (Some (mdt m'))) \\<Rightarrow> \n        \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = i1 * (i2 - idx) \\<and> reg_c' = i1 + i1 * (i2 - idx) \\<and> reg_a' = i1 \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some idx \\<and>\n            get m' (STR ''one'') = Some (1) \\<and>\n            get m' (STR ''acc'') = Some ( i1 + i1 * (i2 - idx))\n        | _ \\<Rightarrow> False))) ~}\"\n\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ _ ~} _ {~ ?B4 ~}\")\n\n    apply(rule HT'Conseq)\n(*\n    apply(rule_tac P = ?B2\nand P' = \"\\<lambda> _ . True\"\nin Calc_Final)\n*)\n    apply(rule_tac P = ?B3\nand P' = \"\\<lambda> st . case st of (reg_flag', reg_c', reg_a', reg_b', m') \\<Rightarrow>\n            \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = i1 * (i2 - idx) \\<and> reg_c' = i1 + i1 * (i2 - idx) \\<and> reg_a' = i1 \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some idx \\<and>\n            get m' (STR ''acc'') = Some ( i1 * (i2 - idx)) \\<and>\n get m' (STR ''one'') = Some (1)\"\nin Mem_Write_Final)\n\n\n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq get_update\nsplit: md_triv.splits) \n    done\n\n  have Body5 : \n    \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?B4 ~}\n  [G (Calc_Mem_Imp.syn.Sm (Sread STR ''arg2'' Reg_a)) []]\n  {~ (\\<lambda> st .  st \\<in> ok_S \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case (reg_a, reg_b, reg_c, m) of\n        (mdp _ (Some (mdt reg_a')), mdp _ (Some (mdt reg_b')), mdp _ (Some (mdt reg_c')), mdp _ (Some (mdt m'))) \\<Rightarrow> \n        \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = i1 * (i2 - idx) \\<and> reg_c' = i1 + i1 * (i2 - idx) \\<and> reg_a' = idx \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some idx \\<and>\n            get m' (STR ''one'') = Some (1) \\<and>\n            get m' (STR ''acc'') = Some ( i1 + i1 * (i2 - idx))\n        | _ \\<Rightarrow> False))) ~}\"\n\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ _ ~} _ {~ ?B5 ~}\")\n    apply(rule HT'Conseq)\n    apply(rule_tac P = ?B4\nand P' = \"\\<lambda> st . case st of (reg_flag', reg_c', reg_a', reg_b', m') \\<Rightarrow>\n            \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = i1 * (i2 - idx) \\<and> reg_c' = i1 + i1 * (i2 - idx) \\<and> reg_a' = i1 \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some idx \\<and>\n            get m' (STR ''acc'') = Some (i1 + i1 * (i2 - idx)) \\<and>\n get m' (STR ''one'') = Some (1)\"\nin Mem_Read_Final)\n\n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq get_update\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq get_update\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq get_update\nsplit: md_triv.splits) \n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n      apply(clarify)\n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n      apply(clarify)\n\n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n    apply(auto split: option.splits)\n    done\n\n\n  have Body6 :\n    \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?B5 ~}\n  [G (Calc_Mem_Imp.syn.Sm (Sread STR ''one'' Reg_b)) []]\n  {~ (\\<lambda> st .  st \\<in> ok_S \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case (reg_a, reg_b, reg_c, m) of\n        (mdp _ (Some (mdt reg_a')), mdp _ (Some (mdt reg_b')), mdp _ (Some (mdt reg_c')), mdp _ (Some (mdt m'))) \\<Rightarrow> \n        \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = 1 \\<and> reg_c' = i1 + i1 * (i2 - idx) \\<and> reg_a' = idx \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some idx \\<and>\n            get m' (STR ''one'') = Some (1) \\<and>\n            get m' (STR ''acc'') = Some ( i1 + i1 * (i2 - idx))\n        | _ \\<Rightarrow> False))) ~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ _ ~} _ {~ ?B6 ~}\")\n    apply(rule HT'Conseq)\n    apply(rule_tac P = ?B5\nand P' = \"\\<lambda> st . case st of (reg_flag', reg_c', reg_a', reg_b', m') \\<Rightarrow>\n            \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = i1 * (i2 - idx) \\<and> reg_c' = i1 + i1 * (i2 - idx) \\<and> reg_a' = idx \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some idx \\<and>\n            get m' (STR ''acc'') = Some (i1 + i1 * (i2 - idx)) \\<and>\n get m' (STR ''one'') = Some (1)\"\nin Mem_Read_Final)\n\n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq get_update\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def\noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq get_update\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq get_update\nsplit: md_triv.splits) \n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n      apply(clarify)\n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n      apply(clarify)\n\n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n    apply(auto split: option.splits)\n    done\n\n  have Body7 :\n    \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?B6 ~}\n  [G (Calc_Mem_Imp.syn.Sc Csub) []]\n  {~ (\\<lambda> st .  st \\<in> ok_S \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case (reg_a, reg_b, reg_c, m) of\n        (mdp _ (Some (mdt reg_a')), mdp _ (Some (mdt reg_b')), mdp _ (Some (mdt reg_c')), mdp _ (Some (mdt m'))) \\<Rightarrow> \n        \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = 1 \\<and> reg_c' = idx - 1 \\<and> reg_a' = idx \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some idx \\<and>\n            get m' (STR ''one'') = Some (1) \\<and>\n            get m' (STR ''acc'') = Some ( i1 + i1 * (i2 - idx))\n        | _ \\<Rightarrow> False))) ~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ _ ~} _ {~ ?B7 ~}\")\n    apply(rule HT'Conseq)\n    apply(rule_tac P = ?B6\nand P' = \"\\<lambda> st . case st of (reg_a', reg_b', reg_c') \\<Rightarrow>\n            \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = 1  \\<and> reg_a' = idx\"\nin Sub_Final_Strong)\n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n\n    apply(insert Hi2)\n    apply(insert Hi1)\n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n      apply(clarify)\n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits md_prio.splits)\n     apply(clarify)\n\n    apply(simp)\n    apply(clarify)\n    apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits)\n    apply(clarify)\n\n\n  apply(simp add: Inv_def cond_lift'_def calc_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def \nsplit: md_triv.splits) \n\n    done\n\n    have Body8 :\n    \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?B7 ~}\n  [G (Calc_Mem_Imp.syn.Sm (Swrite STR ''arg2'' Reg_c)) []]\n  {~ (\\<lambda> st .  st \\<in> ok_S \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case (reg_a, reg_b, reg_c, m) of\n        (mdp _ (Some (mdt reg_a')), mdp _ (Some (mdt reg_b')), mdp _ (Some (mdt reg_c')), mdp _ (Some (mdt m'))) \\<Rightarrow> \n        \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = 1 \\<and> reg_c' = idx - 1 \\<and> reg_a' = idx \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some (idx - 1) \\<and>\n            get m' (STR ''one'') = Some (1) \\<and>\n            get m' (STR ''acc'') = Some ( i1 + i1 * (i2 - idx))\n        | _ \\<Rightarrow> False))) ~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ _ ~} _ {~ ?B8 ~}\")\n      apply(rule_tac HT'Conseq)\n    apply(rule_tac P = ?B7\nand P' = \"\\<lambda> st . case st of (reg_flag', reg_c', reg_a', reg_b', m') \\<Rightarrow>\n            \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = 1 \\<and> reg_c' = idx - 1 \\<and> reg_a' = idx \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some idx \\<and>\n            get m' (STR ''acc'') = Some ( i1 + i1 * (i2 - idx))\\<and>\n get m' (STR ''one'') = Some (1)\"\nin Mem_Write_Final)\n\n\n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def get_update_neq get_delete_neq get_update\nsplit: md_triv.splits) \n      done\n\n    have Body9 :\n    \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn,'x) state))| {~ ?B8 ~}\n  [G (Calc_Mem_Imp.syn.Sm (Sread STR ''arg2'' Reg_c)) []]\n  {~ (\\<lambda> st .  st \\<in> ok_S \\<and> (case st of (reg_flag, reg_c, reg_a, reg_b,  m, xz) \\<Rightarrow> \n      (case (reg_a, reg_b, reg_c, m) of\n        (mdp _ (Some (mdt reg_a')), mdp _ (Some (mdt reg_b')), mdp _ (Some (mdt reg_c')), mdp _ (Some (mdt m'))) \\<Rightarrow> \n        \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = 1 \\<and> reg_c' = idx - 1 \\<and> reg_a' = idx \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some (idx - 1) \\<and>\n            get m' (STR ''one'') = Some (1) \\<and>\n            get m' (STR ''acc'') = Some ( i1 + i1 * (i2 - idx))\n        | _ \\<Rightarrow> False))) ~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ _ ~} _ {~ ?B9 ~}\")\n      apply(rule_tac HT'Conseq)\n    apply(rule_tac P = ?B8\nand P' = \"\\<lambda> st . case st of (reg_flag', reg_c', reg_a', reg_b', m') \\<Rightarrow>\n            \\<exists> (idx :: int) . i2 \\<ge>  idx \\<and> idx > 0 \\<and> reg_b' = 1 \\<and> reg_c' = idx - 1 \\<and> reg_a' = idx \\<and>\n            get m' (STR ''arg1'') = Some i1 \\<and>\n            get m' (STR ''arg2'') = Some (idx - 1) \\<and>\n            get m' (STR ''acc'') = Some ( i1 + i1 * (i2 - idx))\\<and>\n get m' (STR ''one'') = Some (1)\"\nin Mem_Read_Final)\n\n\n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(simp add: Inv_def cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n\n    apply(clarify)\n\n     apply(\n simp add: Inv_def cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits option.splits) \n\n      done\n\n    have Helper : \"\\<And> (x :: int) (y :: int) . x + x * y = x * (1 + y)\"\n    proof-\n      fix x y :: int\n      show \"x + x * y = x * (1 + y)\"\n        using int_distrib\n        by auto\n    qed\n\n    have Body10:\n    \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ ?B9 ~}\n  [G (Sb Sgtz) []]\n  {~ Inv ~}\"\n(is \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ _ ~} _ {~ _ ~}\")\n      apply(rule_tac HT'Conseq)\n        apply(rule_tac\nP = ?B9 and\nP' = \"\\<lambda> st . (case st of (b, x) \\<Rightarrow> \\<exists> idx . i2 \\<ge>  idx \\<and> idx > 0 \\<and> x = (idx - 1))\" in\n Gtz_Final_Strong)\n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(force simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n  apply(simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def cond_sem_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def\nsplit: md_triv.splits) \n      apply(clarify)\n  apply(simp add: cond_lift'_def schem_lift_defs merge_l_def mem_lift1_def\nmem_sem_lifting_inner_def Inv_def\nfst_l_def snd_l_def prio_l_def option_l_def triv_l_def \noption_ok_S prod_ok_S prio_ok_S triv_ok_S oalist_ok_S\n LNew_def int_distrib\nsplit: md_triv.splits) \n      done\n\n      have Conclusion :\n        \"\\<And> st . Inv st \\<Longrightarrow> \n         get_cond st = Some False \\<Longrightarrow>\n    (case st of (_, _, _, _, mdp p (Some (mdt m')), _) \\<Rightarrow> get m' (STR ''acc'') = Some (i1 * i2)\n     | _ \\<Rightarrow> False\n      )\"\n    using Hi1 Hi2 unfolding Inv_def\n    apply(auto simp add: get_cond_def split: md_triv.splits md_prio.splits)\n    apply(case_tac x2a; simp)\n    apply(case_tac a; simp)\n    apply(case_tac x2; simp)\n    apply(case_tac ad; simp)\n    apply(case_tac \"xa = 0\"; simp)\n    done\n\n\n  show \"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~ (\\<lambda> st . st \\<in> ok_S) ~}\n                   [prog1 i1 i2]\n                   {~ (\\<lambda> st . st \\<in> ok_S \\<and>\n                      (case st of\n                        (reg_flag, reg_c, reg_a, reg_b, mem, xz) \\<Rightarrow>\n                          (case mem of\n                            (mdp p (Some (mdt mem'))) \\<Rightarrow> get mem'(STR ''acc'') = Some (i1 * i2)\n                            | _ \\<Rightarrow> False)))\n  ~}\"\n    unfolding prog1_def\n  proof(rule HxSeq)\n    show \"(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state)) = pcomps [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l]\"\n      using sem_final_def by simp\n  next\n    show \"seq_sem_l_gen seq_trans = seq_sem_l_gen seq_trans\"\n      by simp\n  next\n    show \"sups_pres (set [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l]) (\\<lambda>_. ok_S)\"\n      by(rule sups_pres_finite_all; auto)\n  next\n    show \"seq_sem_l \\<in> set [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l]\"\n      by auto\n  next\n    show \"seq_sem_l_gen\n     seq_trans \\<downharpoonleft> set [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l] {Ss Sseq}\"\n      using seq_dom unfolding sems_def seq_sem_l_def\n      by(auto)\n  next    \n    show \"seq_trans (Ss Sseq) = Sseq\"\n      by auto\n  next\n    show \n\"|(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state))| {~(\\<lambda>st. st \\<in> ok_S)~} [G (Sc (Cnum i1)) [],\n      G (Sm (Swrite STR ''arg1'' Reg_c)) [], G (Sc (Cnum i2)) [],\n      G (Sm (Swrite STR ''arg2'' Reg_c)) [], G (Sc (Cnum 1)) [],\n      G (Sm (Swrite STR ''one'' Reg_c)) [], G (Sc (Cnum 0)) [],\n      G (Sm (Swrite STR ''acc'' Reg_c)) [],\n      G (Sm (Sread STR ''arg2'' Reg_c)) [], G (Sb Sgtz) [],\n      G (Si SwhileC)\n       [G (Ss Sseq)\n         [G (Sm (Sread STR ''arg1'' Reg_a)) [],\n          G (Sm (Sread STR ''acc'' Reg_b)) [], G (Sc Cadd) [],\n          G (Sm (Swrite STR ''acc'' Reg_c)) [],\n          G (Sm (Sread STR ''arg2'' Reg_a)) [],\n          G (Sm (Sread STR ''one'' Reg_b)) [], G (Sc Csub) [],\n          G (Sm (Swrite STR ''arg2'' Reg_c)) [],\n          G (Sm (Sread STR ''arg2'' Reg_c)) [],\n          G (Sb Sgtz)\n           []]]] {~(\\<lambda>st. st \\<in> ok_S \\<and>\n                          (case st of\n                           (reg_flag, reg_c, reg_a, reg_b,\n                            mdp p None, xz) \\<Rightarrow>\n                             False\n                           | (reg_flag, reg_c, reg_a, reg_b,\n                              mdp p (Some (mdt mem')), xz) \\<Rightarrow>\n                               get mem' STR ''acc'' =\n                               Some (i1 * i2)))~}\"\n      apply(rule HT'Cons)\n(* TODO: is our loop invariant correct? *)\n\n       apply(rule 1)\n      apply(rule HT'Cons)\n       apply(rule 2)\n      apply(rule HT'Cons)\n       apply(rule 3)\n      apply(rule HT'Cons)\n       apply(rule 4)\n      apply(rule HT'Cons)\n       apply(rule 5)\n      apply(rule HT'Cons)\n       apply(rule 6)\n      apply(rule HT'Cons)\n       apply(rule 7)\n      apply(rule HT'Cons)\n       apply(rule 8)\n      apply(rule HT'Cons)\n       apply(rule 9)\n      apply(rule HT'Cons)\n       apply(rule 10)\n\n    proof(rule_tac HT'Conseq[OF HxWhileC, where P' = Inv])\n      show \"(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn, 'x) state)) = pcomps [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l]\"\n        using sem_final_def by simp\n    next\n      show \"lift_map_t_s imp_trans imp_sem_lifting_gen imp_toggle imp_ctl_sem = lift_map_t_s imp_trans imp_sem_lifting_gen imp_toggle imp_ctl_sem\"\n        unfolding imp_sem_lifting_spec_def\n        by simp\n    next\n      show \"imp_toggle (Si SwhileC) = True\"\n        by simp\n    next\n      show \"sups_pres (set [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l])\n     (\\<lambda>_. ok_S)\"\n        by(rule sups_pres_finite_all; auto)\n    next\n      show \"imp_sem_l \\<in> set [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l]\"\n        by simp\n    next\n      show \"lift_map_t_s imp_trans imp_sem_lifting_gen imp_toggle\n      imp_ctl_sem \\<downharpoonleft> set [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l,\n                        seq_sem_l] {Si SwhileC}\"\n      proof(rule dominant_syn_subset)\n        show \"lift_map_t_s imp_trans imp_sem_lifting_gen imp_toggle\n         imp_ctl_sem \\<downharpoonleft> set [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l,\n                            seq_sem_l] {x. imp_toggle x = True}\"\n          using imp_dom_all unfolding imp_sem_l_def imp_sem_lifting_spec_def sems_def\n          by auto\n      next\n        show \"{Si SwhileC} \\<subseteq> {x. imp_toggle x = True}\"\n          by simp\n      qed\n    next\n      show \"imp_trans (Si SwhileC) = SwhileC\" by simp\n    next\n(*      show \"\\<And> st . (Inv) st \\<Longrightarrow> get_cond st \\<noteq> None\" *)\n      show \"|sem_final| {~(\\<lambda>st. Inv st \\<and>\n                         get_cond st =\n                         Some\n                          True)~} [G (Ss Sseq)\n                                    [G (Sm (Sread STR ''arg1'' Reg_a)) [],\n                                     G (Sm (Sread STR ''acc'' Reg_b)) [], G (Sc Cadd) [],\n                                     G (Sm (Swrite STR ''acc'' Reg_c)) [],\n                                     G (Sm (Sread STR ''arg2'' Reg_a)) [],\n                                     G (Sm (Sread STR ''one'' Reg_b)) [], G (Sc Csub) [],\n                                     G (Sm (Swrite STR ''arg2'' Reg_c)) [],\n                                     G (Sm (Sread STR ''arg2'' Reg_c)) [],\n                                     G (Sb Sgtz) []]] {~Inv~}\"\n      proof(rule HxSeq)\n        show \"(sem_final :: (syn \\<Rightarrow> (syn, ('x :: {Okay, Bogus, Mergeableb, Pordps, Pordc_all})) state \\<Rightarrow> (syn,'x) state)) = pcomps [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l]\"\n          using sem_final_def by simp\n      next\n        show \"seq_sem_l_gen seq_trans = seq_sem_l_gen seq_trans\"\n          by simp\n      next\n        show \"sups_pres (set [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l]) (\\<lambda>_. ok_S)\"\n          by(rule sups_pres_finite_all; auto)\n      next\n        show \"seq_sem_l \\<in> set [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l]\"\n          by auto\n      next\n        show \"seq_sem_l_gen\n         seq_trans \\<downharpoonleft> set [calc_sem_l, mem_sem_l, cond_sem_l, imp_sem_l, seq_sem_l] {Ss Sseq}\"\n          using seq_dom unfolding sems_def seq_sem_l_def\n          by(auto)\n      next    \n        show \"seq_trans (Ss Sseq) = Sseq\"\n          by auto\n      next\n        show \"|sem_final| {~(\\<lambda>st. Inv st \\<and>\n                             get_cond st =\n                             Some\n                              True)~} [G (Sm (Sread STR ''arg1'' Reg_a)) [],\n                                       G (Sm (Sread STR ''acc'' Reg_b)) [], G (Sc Cadd) [],\n                                       G (Sm (Swrite STR ''acc'' Reg_c)) [],\n                                       G (Sm (Sread STR ''arg2'' Reg_a)) [],\n                                       G (Sm (Sread STR ''one'' Reg_b)) [], G (Sc Csub) [],\n                                       G (Sm (Swrite STR ''arg2'' Reg_c)) [],\n                                       G (Sm (Sread STR ''arg2'' Reg_c)) [],\n                                       G (Sb Sgtz) []] {~Inv~}\"\n          apply(rule HT'Cons[of _ _ _ ?B1])\n           apply(rule HT'Conseq[where Q' = ?B1])\n             apply(rule Body1)\n    \n            apply(case_tac st; clarsimp)\n            apply(case_tac ae; clarsimp)\n            apply(case_tac x2; clarsimp)\n             apply(simp add: get_cond_def)\n          apply(case_tac a; clarsimp)\n            apply(simp add: get_cond_def )\n    \n          apply(fastforce)\n    \n          apply(rule HT'Cons)\n           apply(rule Body2)\n          apply(rule HT'Cons)\n            apply(rule Body3)\n          apply(rule HT'Cons)\n          apply(rule Body4)\n          apply(rule HT'Cons)\n          apply(rule Body5)\n          apply(rule HT'Cons)\n          apply(rule Body6)\n          apply(rule HT'Cons)\n          apply(rule Body7)\n          apply(rule HT'Cons)\n          apply(rule Body8)\n          apply(rule HT'Cons)\n          apply(rule Body9)\n          apply(rule HT'Cons)\n          apply(rule Body10)\n          apply(rule HT'Nil)\n          done\n      qed\n    next\n      fix st\n      assume \"Inv st\"\n      then show \"get_cond st \\<noteq> None\"\n        unfolding Inv_def\n        by(auto simp add: get_cond_def\n          ok_S_defs\n           split: md_prio.splits option.splits md_triv.splits)\n    next\n      fix p p' x rest\n      assume \"Inv (mdp p x, rest)\" \n      then show \"Inv (mdp p' x, rest)\"\n        apply(simp add: Inv_def)\n        apply(auto split: prod.splits md_prio.splits option.splits md_triv.splits)\n\n         apply(simp add: Inv_def ok_S_defs split: md_prio.splits option.splits md_triv.splits)\n\n        apply(rule_tac x = idx in exI)\n        apply(drule_tac x = p in spec)\n        apply(clarsimp)\n        apply(drule_tac x = x2 in spec)\n        apply(case_tac x2)\n         apply(clarsimp)\n         apply(fastforce simp add: Inv_def ok_S_defs split: md_prio.splits option.splits md_triv.splits)\n\n        apply(clarsimp)\n        apply(case_tac x2a)\n        apply(clarsimp)\n        done\n    next\n      fix st\n      show \"st \\<in> ok_S \\<and>\n          (case st of (reg_flag, reg_c, reg_a, reg_b, mdp p None, xz) \\<Rightarrow> False\n           | (reg_flag, reg_c, reg_a, reg_b, mdp p (Some (mdt m')), xz) \\<Rightarrow>\n               get m' STR ''arg1'' = Some i1 \\<and>\n               get m' STR ''arg2'' = Some i2 \\<and>\n               get m' STR ''one'' = Some 1 \\<and>\n               get m' STR ''acc'' = Some 0 \\<and>\n               (case reg_flag of mdp p None \\<Rightarrow> False\n                | mdp p (Some (mdt reg_flag')) \\<Rightarrow> reg_flag' = 0 \\<and> i2 \\<le> 0 \\<or> reg_flag' = 1 \\<and> 0 < i2)) \\<Longrightarrow>\n          Inv st\"\n        unfolding Inv_def\n        using Hi1 Hi2\n        by(cases st; auto split: md_prio.splits option.splits md_triv.splits)\n    next\n      fix st\n      assume \"Inv st \\<and> get_cond st = Some False\"\n\n      hence Fin : \"Inv st\" \"get_cond st = Some False\"\n        by auto\n\n      have Ok : \"st \\<in> ok_S\"\n        using Fin(1)\n        by(auto simp add: Inv_def)\n\n      show \"st \\<in> ok_S \\<and>\n          (case st of (reg_flag, reg_c, reg_a, reg_b, mdp p None, xz) \\<Rightarrow> False\n           | (reg_flag, reg_c, reg_a, reg_b, mdp p (Some (mdt mem')), xz) \\<Rightarrow>\n               get mem' STR ''acc'' = Some (i1 * i2))\"\n        using Conclusion[OF Fin(1) Fin(2)] Ok\n        by auto\n    qed\n  qed\nqed\nend", "meta": {"author": "mmalvarez", "repo": "Gazelle", "sha": "0a80144107b3ec7487725bd88d658843beb6cb82", "save_path": "github-repos/isabelle/mmalvarez-Gazelle", "path": "github-repos/isabelle/mmalvarez-Gazelle/Gazelle-0a80144107b3ec7487725bd88d658843beb6cb82/Languages/Imp/Calc_Mem_Imp_Hoare_Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.3138783242166127}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Sep_Attribs\nimports Separation_Algebra Sep_Tactic_Helpers\nbegin\n\ntext{* Beyond the tactics above, there is also a set of attributes implemented to make proving\n       things in separation logic easier. These rules should be considered internals and are not\n       intended for direct use. *}\n\n\nlemma sep_curry_atomised: \"\\<lbrakk>(\\<And>s. (P \\<and>* Q) s \\<longrightarrow> R s); P s \\<rbrakk> \\<Longrightarrow> (Q \\<longrightarrow>* R) s\"\n  by (clarsimp simp: sep_conj_sep_impl)\n\nlemma sep_remove_pure_imp_sep_imp: \"( P \\<longrightarrow>* (\\<lambda>s. P' \\<longrightarrow> Q s)) s \\<Longrightarrow> P' \\<Longrightarrow> (P \\<longrightarrow>* Q) s\"\n  by (clarsimp)\n\nlemma sep_backward: \"\\<lbrakk>\\<And>s. P s \\<longrightarrow> (Q \\<and>* T) s; (P \\<and>* (Q \\<longrightarrow>* R)) s \\<rbrakk> \\<Longrightarrow> (T \\<and>* R) s\"\n  by (metis sep_conj_commute sep_conj_impl1 sep_mp_frame)\n\nlemma sep_remove_conj: \"\\<lbrakk>(P \\<and>* R) s ; Q\\<rbrakk> \\<Longrightarrow> ((\\<lambda>s. P s \\<and> Q) \\<and>* R) s \"\n  apply (clarsimp)\n  done\n\nlemma curry: \"(P \\<longrightarrow> Q \\<longrightarrow> R) \\<Longrightarrow> (P \\<and> Q) \\<longrightarrow> R\"\n  apply (safe)\n  done\n\n\nML {*\nlocal\n  fun atomize_thm ctxt thm = Conv.fconv_rule (Object_Logic.atomize ctxt) thm\n  fun setup_simpset ctxt = put_simpset HOL_basic_ss ctxt addsimps [(sym OF [@{thm sep_conj_assoc}])]\n  fun simp ctxt thm = simplify (setup_simpset ctxt) thm\n\n  fun REPEAT_TRYOF_N _ thm2 0 = thm2\n    | REPEAT_TRYOF_N thm1 thm2 n = REPEAT_TRYOF_N thm1 (thm1 OF [thm2]) (n-1)\n\n  fun REPEAT_TRYOF'_N thm1 _    0 = thm1\n    | REPEAT_TRYOF'_N thm1 thm2 n = REPEAT_TRYOF'_N (thm1 OF [thm2]) thm2 (n-1)\n\n  fun attribute_thm ctxt thm  thm' = \n    REPEAT_TRYOF_N @{thm sep_remove_pure_imp_sep_imp} (thm OF [atomize_thm ctxt thm']) (Thm.nprems_of thm' - 1)\n\n  fun attribute_thm' thm ctxt thm' =\n    thm OF [REPEAT_TRYOF_N @{thm curry} (thm' |> atomize_thm ctxt o simp ctxt) (Thm.nprems_of thm' - 1)]\n\nin\n\n(*\n By attributing a theorem with [sep_curry], we can now take a rule (A \\<and>* B) \\<Longrightarrow> C and turn it into A \\<Longrightarrow> (B \\<longrightarrow>* C)\n*)\n\nfun sep_curry_inner ctxt = attribute_thm ( ctxt) @{thm sep_curry_atomised}\nval sep_curry = Thm.rule_attribute [] (fn ctxt => sep_curry_inner (Context.proof_of ctxt))\n\n(*\n The attribute sep_back takes a rule of the form A \\<Longrightarrow> B and returns a rule (A \\<and>* (B \\<longrightarrow>* R)) \\<Longrightarrow> R.\n The R then matches with any conclusion. If the theorem is of form (A \\<and>* B) \\<Longrightarrow> C, it is advised to\n use sep_curry on the theorem first, and then sep_back. This aids sep_cancel in simplifying the result.\n*)\n\nfun backward ctxt thm =\n  REPEAT_TRYOF'_N (attribute_thm' @{thm sep_backward} ctxt thm) @{thm sep_remove_conj} (Thm.nprems_of thm - 1)\n\nfun backward' ctxt thm = backward (Context.proof_of ctxt) thm\n\nval sep_backward = Thm.rule_attribute [] (backward')\n\nend\n*}\n\nattribute_setup sep_curry =  {* Scan.succeed sep_curry *}\nattribute_setup sep_backward =  {* Scan.succeed sep_backward *}\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/sep_algebra/Sep_Attribs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3138783160255456}}
{"text": "section \\<open>Operation Identification Phase\\<close>\ntheory Sepref_Id_Op\nimports \n  Main \n  Automatic_Refinement.Refine_Lib\n  Automatic_Refinement.Autoref_Tagging\n  \"Refine_Imperative_HOL.Named_Theorems_Rev\"\nbegin\n\ntext \\<open>\n  The operation identification phase is adapted from the Autoref tool.\n  The basic idea is to have a type system, which works on so called \n  interface types (also called conceptual types). Each conceptual type\n  denotes an abstract data type, e.g., set, map, priority queue.\n  \n  Each abstract operation, which must be a constant applied to its arguments,\n  is assigned a conceptual type. Additionally, there is a set of \n  {\\emph pattern rewrite rules},\n  which are applied to subterms before type inference takes place, and \n  which may be backtracked over. \n  This way, encodings of abstract operations in Isabelle/HOL, like \n  @{term [source] \"\\<lambda>_. None\"} for the empty map, \n  or @{term [source] \"fun_upd m k (Some v)\"} for map update, can be rewritten\n  to abstract operations, and get properly typed.\n\\<close>\n\nsubsection \"Proper Protection of Term\"\ntext \\<open> The following constants are meant to encode abstraction and \n  application as proper HOL-constants, and thus avoid strange effects with\n  HOL's higher-order unification heuristics and automatic \n  beta and eta-contraction.\n\n  The first step of operation identification is to protect the term\n  by replacing all function applications and abstractions be \n  the constants defined below.\n\\<close>\n\ndefinition [simp]: \"PROTECT2 x (y::prop) \\<equiv> x\"\nconsts DUMMY :: \"prop\"\n\nabbreviation PROTECT2_syn (\"'(#_#')\") where \"PROTECT2_syn t \\<equiv> PROTECT2 t DUMMY\"\n\nabbreviation (input)ABS2 :: \"('a\\<Rightarrow>'b)\\<Rightarrow>'a\\<Rightarrow>'b\" (binder \"\\<lambda>\\<^sub>2\" 10)\n  where \"ABS2 f \\<equiv> (\\<lambda>x. PROTECT2 (f x) DUMMY)\"\n\nlemma beta: \"(\\<lambda>\\<^sub>2x. f x)$x \\<equiv> f x\" by simp\n\ntext \\<open>\n  Another version of @{const \"APP\"}. Treated like @{const APP} by our tool.\n  Required to avoid infinite pattern rewriting in some cases, e.g., map-lookup.\n\\<close>\n\ndefinition APP' (infixl \"$''\" 900) where [simp, autoref_tag_defs]: \"f$'a \\<equiv> f a\"\n\ntext \\<open>\n  Sometimes, whole terms should be protected from being processed by our tool.\n  For example, our tool should not look into numerals. For this reason,\n  the @{text \"PR_CONST\"} tag indicates terms that our tool shall handle as\n  atomic constants, an never look into them.\n\n  The special form @{text \"UNPROTECT\"} can be used inside pattern rewrite rules.\n  It has the effect to revert the protection from its argument, and then wrap\n  it into a @{text \"PR_CONST\"}.\n\\<close>\ndefinition [simp, autoref_tag_defs]: \"PR_CONST x \\<equiv> x\" \\<comment> \\<open>Tag to protect constant\\<close>\ndefinition [simp, autoref_tag_defs]: \"UNPROTECT x \\<equiv> x\" \\<comment> \\<open>Gets \n  converted to @{term PR_CONST}, after unprotecting its content\\<close>\n\n\nsubsection {* Operation Identification *}\n\ntext \\<open> Indicator predicate for conceptual typing of a constant \\<close>\ndefinition intf_type :: \"'a \\<Rightarrow> 'b itself \\<Rightarrow> bool\" (infix \"::\\<^sub>i\" 10) where\n  [simp]: \"c::\\<^sub>iI \\<equiv> True\"\n\nlemma itypeI: \"c::\\<^sub>iI\" by simp\nlemma itypeI': \"intf_type c TYPE('T)\" by (rule itypeI)\n\nlemma itype_self: \"(c::'a) ::\\<^sub>i TYPE('a)\" by simp\n\ndefinition CTYPE_ANNOT :: \"'b \\<Rightarrow> 'a itself \\<Rightarrow> 'b\" (infix \":::\\<^sub>i\" 10) where\n  [simp]: \"c:::\\<^sub>iI \\<equiv> c\"\n\ntext \\<open> Wrapper predicate for an conceptual type inference \\<close>\ndefinition ID :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'c itself \\<Rightarrow> bool\" \n  where [simp]: \"ID t t' T \\<equiv> t=t'\"\n\nsubsubsection {* Conceptual Typing Rules *}\n\nlemma ID_unfold_vars: \"ID x y T \\<Longrightarrow> x\\<equiv>y\" by simp\nlemma ID_PR_CONST_trigger: \"ID (PR_CONST x) y T \\<Longrightarrow> ID (PR_CONST x) y T\" .\n\nlemma pat_rule:\n  \"\\<lbrakk> p\\<equiv>p'; ID p' t' T \\<rbrakk> \\<Longrightarrow> ID p t' T\" by simp\n\nlemma app_rule:\n  \"\\<lbrakk> ID f f' TYPE('a\\<Rightarrow>'b); ID x x' TYPE('a)\\<rbrakk> \\<Longrightarrow> ID (f$x) (f'$x') TYPE('b)\"\n  by simp\n\nlemma app'_rule:\n  \"\\<lbrakk> ID f f' TYPE('a\\<Rightarrow>'b); ID x x' TYPE('a)\\<rbrakk> \\<Longrightarrow> ID (f$'x) (f'$x') TYPE('b)\"\n  by simp\n\nlemma abs_rule:\n  \"\\<lbrakk> \\<And>x x'. ID x x' TYPE('a) \\<Longrightarrow> ID (t x) (t' x x') TYPE('b) \\<rbrakk> \\<Longrightarrow>\n    ID (\\<lambda>\\<^sub>2x. t x) (\\<lambda>\\<^sub>2x'. t' x' x') TYPE('a\\<Rightarrow>'b)\"\n  by simp\n\nlemma id_rule: \"c::\\<^sub>iI \\<Longrightarrow> ID c c I\" by simp\n\nlemma annot_rule: \"ID t t' I \\<Longrightarrow> ID (t:::\\<^sub>iI) t' I\"\n  by simp\n\nlemma fallback_rule:\n  \"ID (c::'a) c TYPE('c)\"\n  by simp\n\nlemma unprotect_rl1: \"ID (PR_CONST x) t T \\<Longrightarrow> ID (UNPROTECT x) t T\"\n  by simp\n\nsubsection \\<open> ML-Level code \\<close>\nML \\<open>\ninfix 0 THEN_ELSE_COMB'\n\nsignature ID_OP_TACTICAL = sig\n  val SOLVE_FWD: tactic' -> tactic'\n  val DF_SOLVE_FWD: bool -> tactic' -> tactic'\nend\n\nstructure Id_Op_Tactical :ID_OP_TACTICAL = struct\n\n  fun SOLVE_FWD tac i st = SOLVED' (\n    tac \n    THEN_ALL_NEW_FWD (SOLVE_FWD tac)) i st\n\n\n  (* Search for solution with DFS-strategy. If dbg-flag is given,\n    return sequence of stuck states if no solution is found.\n  *)\n  fun DF_SOLVE_FWD dbg tac = let\n    val stuck_list_ref = Unsynchronized.ref []\n\n    fun stuck_tac _ st = if dbg then (\n      stuck_list_ref := st :: !stuck_list_ref;\n      Seq.empty\n    ) else Seq.empty\n\n    fun rec_tac i st = (\n        (tac THEN_ALL_NEW_FWD (SOLVED' rec_tac))\n        ORELSE' stuck_tac\n      ) i st\n\n    fun fail_tac _ _ = if dbg then\n      Seq.of_list (rev (!stuck_list_ref))\n    else Seq.empty\n  in\n    rec_tac ORELSE' fail_tac    \n  end\n\nend\n\\<close>\n\n\nnamed_theorems_rev id_rules \"Operation identification rules\"\nnamed_theorems_rev pat_rules \"Operation pattern rules\"\nnamed_theorems_rev def_pat_rules \"Definite operation pattern rules (not backtracked over)\"\n\n\n\nML \\<open>\n\n  structure Id_Op = struct\n\n    fun id_a_conv cnv ct = case Thm.term_of ct of\n      @{mpat \"ID _ _ _\"} => Conv.fun_conv (Conv.fun_conv (Conv.arg_conv cnv)) ct\n    | _ => raise CTERM(\"id_a_conv\",[ct])\n\n    fun \n      protect env (@{mpat \"?t:::\\<^sub>i?I\"}) = let\n        val t = protect env t\n      in \n        @{mk_term env: \"?t:::\\<^sub>i?I\"}\n      end\n    | protect _ (t as @{mpat \"PR_CONST _\"}) = t\n    | protect env (t1$t2) = let\n        val t1 = protect env t1\n        val t2 = protect env t2\n      in\n        @{mk_term env: \"?t1.0 $ ?t2.0\"}\n      end\n    | protect env (Abs (x,T,t)) = let\n        val env' = T::env\n        val t = protect env' t\n        val t = @{mk_term env': \"PROTECT2 ?t DUMMY\"}\n      in\n        Abs (x,T,t)\n      end\n    (* TODO: Avoiding mk_term with loose vars under \\<lambda>! Fix that!\n    | protect env (Abs (x,T,t)) = let\n        val t = protect (T::env) t\n      in\n        @{mk_term env: \"\\<lambda>v_x::?'v_T. PROTECT2 ?t DUMMY\"}\n      end\n    *)  \n    | protect _ t = t\n\n    fun protect_conv ctxt = Refine_Util.f_tac_conv ctxt\n      (protect []) \n      (simp_tac \n        (put_simpset HOL_basic_ss ctxt addsimps @{thms PROTECT2_def APP_def}) 1)\n\n    fun unprotect_conv ctxt\n      = Simplifier.rewrite (put_simpset HOL_basic_ss ctxt \n        addsimps @{thms PROTECT2_def APP_def})\n\n    fun do_unprotect_tac ctxt =\n      resolve_tac ctxt @{thms unprotect_rl1} THEN'\n      CONVERSION (Refine_Util.HOL_concl_conv (fn ctxt => id_a_conv (unprotect_conv ctxt)) ctxt)\n\n    val cfg_id_debug = \n      Attrib.setup_config_bool @{binding id_debug} (K false)\n\n    val cfg_id_trace_fallback = \n      Attrib.setup_config_bool @{binding id_trace_fallback} (K false)\n\n    fun dest_id_rl thm = case Thm.concl_of thm of\n      @{mpat (typs) \"Trueprop (?c::\\<^sub>iTYPE(?'v_T))\"} => (c,T)\n    | _ => raise THM(\"dest_id_rl\",~1,[thm])\n\n    \n    val add_id_rule = snd oo Thm.proof_attributes [Named_Theorems_Rev.add @{named_theorems_rev id_rules}]\n\n    datatype id_tac_mode = Init | Step | Normal | Solve\n\n    fun id_tac ss ctxt = let\n      open Id_Op_Tactical\n      val certT = Thm.ctyp_of ctxt\n      val cert = Thm.cterm_of ctxt\n\n      val thy = Proof_Context.theory_of ctxt\n\n      val id_rules = Named_Theorems_Rev.get ctxt @{named_theorems_rev id_rules}\n      val pat_rules = Named_Theorems_Rev.get ctxt @{named_theorems_rev pat_rules}\n      val def_pat_rules = Named_Theorems_Rev.get ctxt @{named_theorems_rev def_pat_rules}\n\n      val rl_net = Tactic.build_net (\n        (pat_rules |> map (fn thm => thm RS @{thm pat_rule})) \n        @ @{thms annot_rule app_rule app'_rule abs_rule} \n        @ (id_rules |> map (fn thm => thm RS @{thm id_rule}))\n      )\n\n      val def_rl_net = Tactic.build_net (\n        (def_pat_rules |> map (fn thm => thm RS @{thm pat_rule}))\n      )  \n\n      val id_pr_const_rename_tac = \n          resolve_tac ctxt @{thms ID_PR_CONST_trigger} THEN'\n          Subgoal.FOCUS (fn { context=ctxt, prems, ... } => \n            let\n              fun is_ID @{mpat \"Trueprop (ID _ _ _)\"} = true | is_ID _ = false\n              val prems = filter (Thm.prop_of #> is_ID) prems\n              val eqs = map (fn thm => thm RS @{thm ID_unfold_vars}) prems\n              val conv = Conv.rewrs_conv eqs\n              val conv = fn ctxt => (Conv.top_sweep_conv (K conv) ctxt)\n              val conv = fn ctxt => Conv.fun2_conv (Conv.arg_conv (conv ctxt))\n              val conv = Refine_Util.HOL_concl_conv conv ctxt\n            in CONVERSION conv 1 end \n          ) ctxt THEN'\n          resolve_tac ctxt @{thms id_rule} THEN'\n          resolve_tac ctxt id_rules \n\n      val ityping = id_rules \n        |> map dest_id_rl\n        |> filter (is_Const o #1)\n        |> map (apfst (#1 o dest_Const))\n        |> Symtab.make_list\n\n      val has_type = Symtab.defined ityping\n\n      fun mk_fallback name cT =\n        case try (Sign.the_const_constraint thy) name of\n          SOME T => try (Thm.instantiate' \n                          [SOME (certT cT), SOME (certT T)] [SOME (cert (Const (name,cT)))])\n                        @{thm fallback_rule} \n        | NONE => NONE\n\n      fun trace_fallback thm = \n        Config.get ctxt cfg_id_trace_fallback       \n        andalso let \n          open Pretty\n          val p = block [str \"ID_OP: Applying fallback rule: \", Thm.pretty_thm ctxt thm]\n        in \n          string_of p |> tracing; \n          false\n        end  \n\n      val fallback_tac = CONVERSION Thm.eta_conversion THEN' IF_EXGOAL (fn i => fn st =>\n        case Logic.concl_of_goal (Thm.prop_of st) i of\n          @{mpat \"Trueprop (ID (mpaq_STRUCT (mpaq_Const ?name ?cT)) _ _)\"} => (\n            if not (has_type name) then \n              case mk_fallback name cT of\n                SOME thm => (trace_fallback thm; resolve_tac ctxt [thm] i st)\n              | NONE => Seq.empty  \n            else Seq.empty\n          )\n        | _ => Seq.empty)\n\n      val init_tac = CONVERSION (\n        Refine_Util.HOL_concl_conv (fn ctxt => (id_a_conv (protect_conv ctxt))) \n          ctxt\n      )\n\n      val step_tac = (FIRST' [\n        assume_tac ctxt, \n        eresolve_tac ctxt @{thms id_rule},\n        resolve_from_net_tac ctxt def_rl_net, \n        resolve_from_net_tac ctxt rl_net, \n        id_pr_const_rename_tac,\n        do_unprotect_tac ctxt, \n        fallback_tac])\n\n      val solve_tac = DF_SOLVE_FWD (Config.get ctxt cfg_id_debug) step_tac  \n\n    in\n      case ss of\n        Init => init_tac \n      | Step => step_tac \n      | Normal => init_tac THEN' solve_tac\n      | Solve => solve_tac\n\n    end\n\n  end\n\n\\<close>\n\nsubsection \\<open>Default Setup\\<close>\n\nsubsubsection \\<open>Numerals\\<close> \n(* TODO: Either remove, or also add numerals 0 and 1! *)\nlemma pat_numeral[def_pat_rules]: \"numeral$x \\<equiv> UNPROTECT (numeral$x)\" by simp\n\nlemma id_nat_const[id_rules]: \"(PR_CONST (a::nat)) ::\\<^sub>i TYPE(nat)\" by simp\nlemma id_int_const[id_rules]: \"(PR_CONST (a::int)) ::\\<^sub>i TYPE(int)\" by simp\n\n(*subsection \\<open>Example\\<close>\nschematic_lemma \n  \"ID (\\<lambda>a b. (b(1::int\\<mapsto>2::nat) |`(-{3})) a, Map.empty, \\<lambda>a. case a of None \\<Rightarrow> Some a | Some _ \\<Rightarrow> None) (?c) (?T::?'d itself)\"\n  (*\"TERM (?c,?T)\"*)\n  using [[id_debug]]\n  apply (tactic {* Id_Op.id_tac Id_Op.Normal @{context} 1  *})  \n  done\n*)\n\nend\n\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/sepref/Sepref_Id_Op.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.566018520554724, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.313840552268191}}
{"text": "section\\<open>The Axiom of Infinity in $M[G]$\\<close>\ntheory Infinity_Axiom\n  imports Pairing_Axiom Union_Axiom Separation_Axiom\nbegin\n\ncontext G_generic begin\n\ninterpretation mg_triv: M_trivial\"##M[G]\"\n  using transitivity_MG zero_in_MG generic Union_MG pairing_in_MG\n  by unfold_locales auto\n\nlemma infinity_in_MG : \"infinity_ax(##M[G])\"\nproof -\n  from infinity_ax obtain I where\n    Eq1: \"I\\<in>M\" \"0 \\<in> I\" \"\\<forall>y\\<in>M. y \\<in> I \\<longrightarrow> succ(y) \\<in> I\"\n    unfolding infinity_ax_def  by auto\n  then\n  have \"check(I) \\<in> M\"\n    using check_in_M by simp\n  then\n  have \"I\\<in> M[G]\"\n    using valcheck generic one_in_G one_in_P GenExtI[of \"check(I)\" G] by simp\n  with \\<open>0\\<in>I\\<close>\n  have \"0\\<in>M[G]\" using transitivity_MG by simp\n  with \\<open>I\\<in>M\\<close>\n  have \"y \\<in> M\" if \"y \\<in> I\" for y\n    using  transitivity[OF _ \\<open>I\\<in>M\\<close>] that by simp\n  with \\<open>I\\<in>M[G]\\<close>\n  have \"succ(y) \\<in> I \\<inter> M[G]\" if \"y \\<in> I\" for y\n    using that Eq1 transitivity_MG by blast\n  with Eq1 \\<open>I\\<in>M[G]\\<close> \\<open>0\\<in>M[G]\\<close>\n  show ?thesis\n    unfolding infinity_ax_def by auto\nqed\n\nend (* G_generic' *)\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Forcing/Infinity_Axiom.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.3137805488189715}}
{"text": "theory DP_CRelVS_Ext\n  imports \"transform/Transform_Cmd\"\nbegin\n\nnotation fun_app_lifted (infixl \".\" 999)\nnotation Transfer.Rel (\"Rel\")\n\nthm map_cong\nlemma mapT_cong:\n  assumes \"xs = ys\" \"\\<And>x. x\\<in>set ys \\<Longrightarrow> f x = g x\"\n  shows \"map\\<^sub>T . \\<langle>f\\<rangle> . \\<langle>xs\\<rangle> = map\\<^sub>T . \\<langle>g\\<rangle> . \\<langle>ys\\<rangle>\"\n  unfolding map\\<^sub>T_def \n  unfolding assms(1)\n  using assms(2) by (induction ys) (auto simp: return_app_return)\n\nthm fold_cong\nlemma foldT_cong:\n  assumes \"xs = ys\" \"\\<And>x. x\\<in>set ys \\<Longrightarrow> f x = g x\"\n  shows \"fold\\<^sub>T . \\<langle>f\\<rangle> . \\<langle>xs\\<rangle> = fold\\<^sub>T . \\<langle>g\\<rangle> . \\<langle>ys\\<rangle>\"\n  unfolding fold\\<^sub>T_def\n  unfolding assms(1)\n  using assms(2) by (induction ys) (auto simp: return_app_return)\n\n\nlemma abs_unit_cong:\n  (* for lazy checkmem *)\n  assumes \"x = y\"\n  shows \"(\\<lambda>_::unit. x) = (\\<lambda>_. y)\"\n  using assms ..\n\nlemma App_cong:\n  assumes \"f x = g y\"\n  shows \"App f x = App g y\"\n  unfolding App_def using assms .\n\nlemmas [fundef_cong] =\n  return_app_return_cong\n  ifT_cong\n  mapT_cong\n  foldT_cong\n  abs_unit_cong\n  App_cong\n\ncontext dp_consistency begin\ncontext includes lifting_syntax begin\n\nnamed_theorems dp_match_rule\n\nlemma refl2:\n  \"is_equality R \\<Longrightarrow> Rel R x x\"\n  unfolding is_equality_def Rel_def by simp\n\nlemma rel_fun2:\n  assumes \"is_equality R0\" \"\\<And>x. Rel R1 (f x) (g x)\"\n  shows \"Rel (rel_fun R0 R1) f g\"\n  using assms unfolding is_equality_def Rel_def by auto\n\nthm if_cong\nlemma if\\<^sub>T_cong2:\n  assumes \"Rel (=) b c\" \"c \\<Longrightarrow> Rel (crel_vs R) x x\\<^sub>T\" \"\\<not>c \\<Longrightarrow> Rel (crel_vs R) y y\\<^sub>T\"\n  shows \"Rel (crel_vs R) (if (Wrap b) then x else y) (if\\<^sub>T \\<langle>c\\<rangle> x\\<^sub>T y\\<^sub>T)\"\n  using assms unfolding if\\<^sub>T_def left_identity Rel_def Wrap_def\n  by (auto split: if_split)\n\nlemma if\\<^sub>T_cong2':\n  assumes \"c \\<Longrightarrow> Rel (crel_vs R) x x\\<^sub>T\" \"\\<not>c \\<Longrightarrow> Rel (crel_vs R) y y\\<^sub>T\"\n  shows \"Rel (crel_vs R) (if Wrap c then x else y) (if\\<^sub>T \\<langle>c\\<rangle> x\\<^sub>T y\\<^sub>T)\"\n  apply (rule if\\<^sub>T_cong2[OF _ assms])\n    apply (auto simp: Rel_def)\n  done\n\n(*\n\nthm map_cong\nlemma map1T_cong:\n  assumes \"xs = ys\" \"\\<And>x. x\\<in>set ys \\<Longrightarrow> f\\<^sub>T . \\<langle>x\\<rangle> = g\\<^sub>T . \\<langle>x\\<rangle>\"\n  shows \"map1\\<^sub>T . f\\<^sub>T . \\<langle>xs\\<rangle> = map1\\<^sub>T . g\\<^sub>T . \\<langle>ys\\<rangle>\"\n  unfolding map1\\<^sub>T_def \n  unfolding assms(1)\n  using assms(2) apply (induction ys) apply (auto simp: return_app_return)\n  subgoal\n    apply (rule state.expand)\n    apply (rule ext)\n    unfolding fun_app_lifted_def\n    unfolding bind_def return_def\n    apply (auto split: prod.splits)\n*)\nlemma map\\<^sub>T_transfer2:\n  \"Rel (crel_vs ((R0 ===>\\<^sub>T R1) ===>\\<^sub>T list_all2 R0 ===>\\<^sub>T list_all2 R1)) map map\\<^sub>T\"\n  unfolding Rel_def by (fact map\\<^sub>T_transfer)\n\nlemma map\\<^sub>T_cong2:\n  assumes\n    \"is_equality R\"\n    \"Rel R xs ys\"\n    \"\\<And>x. x\\<in>set ys \\<Longrightarrow> Rel (crel_vs S) (f x) (f\\<^sub>T' x)\"\n  shows \"Rel (crel_vs (list_all2 S)) (App (App map (Wrap f)) (Wrap xs)) (map\\<^sub>T . \\<langle>f\\<^sub>T'\\<rangle> . \\<langle>ys\\<rangle>)\"\n  unfolding map\\<^sub>T_def\n  unfolding return_app_return\n  unfolding assms(2)[unfolded Rel_def assms(1)[unfolded is_equality_def]]\n  using assms(3)\n  unfolding Rel_def Wrap_def App_def\n  apply (induction ys)\n  apply (tactic \\<open>Transform_Tactic.unfold_dp_defs_tac @{context} true true 1\\<close>)\n  subgoal premises by transfer_prover\n  subgoal premises prems for a ys\n    apply (tactic \\<open>Transform_Tactic.unfold_dp_defs_tac @{context} true true 1\\<close>)\n    apply (unfold return_app_return Wrap_App_Wrap)\n    supply [transfer_rule] =\n      prems(2)[OF list.set_intros(1)]\n      prems(1)[OF prems(2)[OF list.set_intros(2)], simplified]\n    by transfer_prover\n  done\n\nlemma map\\<^sub>T_cong2':\n  assumes\n    \"\\<And>x. x\\<in>set xs \\<Longrightarrow> Rel (crel_vs S) (f x) (f\\<^sub>T' x)\"\n  shows \"Rel (crel_vs (list_all2 S)) (map f xs) (map\\<^sub>T . \\<langle>f\\<^sub>T'\\<rangle> . \\<langle>xs\\<rangle>)\"\n  apply (rule map\\<^sub>T_cong2[OF is_equality_eq _ assms, unfolded Wrap_def App_def])\n   apply (auto simp: Rel_def)\n  done\n\n\nlemma fold\\<^sub>T_transfer2:\n  \"Rel (crel_vs ((R0 ===>\\<^sub>T R1 ===>\\<^sub>T R1) ===>\\<^sub>T list_all2 R0 ===>\\<^sub>T R1 ===>\\<^sub>T R1)) fold fold\\<^sub>T\"\n  unfolding Rel_def by (fact fold\\<^sub>T_transfer)\n\nlemma fold\\<^sub>T_cong2:\n  assumes\n    \"is_equality R\"\n    \"Rel R xs ys\"\n    \"\\<And>x. x\\<in>set ys \\<Longrightarrow> Rel (crel_vs (S ===> crel_vs S)) (f x) (f\\<^sub>T' x)\"\n  shows\n    \"Rel (crel_vs (S ===> crel_vs S)) (fold f xs) (fold\\<^sub>T . \\<langle>f\\<^sub>T'\\<rangle> . \\<langle>ys\\<rangle>)\"\n  unfolding fold\\<^sub>T_def\n  unfolding return_app_return\n  unfolding assms(2)[unfolded Rel_def assms(1)[unfolded is_equality_def]]\n  using assms(3)\n  unfolding Rel_def\n  apply (induction ys)\n  apply (tactic \\<open>Transform_Tactic.unfold_dp_defs_tac @{context} true true 1\\<close>)\n  subgoal premises by transfer_prover\n  subgoal premises prems for a ys\n    apply (tactic \\<open>Transform_Tactic.unfold_dp_defs_tac @{context} true true 1\\<close>)\n    apply (unfold return_app_return Wrap_App_Wrap)\n    supply [transfer_rule] =\n      prems(2)[OF list.set_intros(1)]\n      prems(1)[OF prems(2)[OF list.set_intros(2)], simplified]\n    by transfer_prover\n  done\n\nthm BNF_Fixpoint_Base.case_prod_transfer\nlemma prod_case_transfer2:\n  assumes\n    \"Rel (R0 ===> R1 ===> crel_vs S) f g\"\n  shows \"Rel (rel_prod R0 R1 ===> crel_vs S) (case_prod f) (case_prod g)\"\n  supply [transfer_rule] = assms[unfolded Rel_def]\n  unfolding Rel_def by transfer_prover\n\nlemma prod_case_cong2:\n  assumes\n    \"is_equality R\"\n    \"Rel R x y\"\n    \"\\<And>u v. y = (u, v) \\<Longrightarrow> Rel (crel_vs S) (f u v) (g u v)\"\n  shows \"Rel (crel_vs S) (case_prod f x) (\\<langle>case_prod g\\<rangle> . \\<langle>y\\<rangle>)\"\n  unfolding return_app_return\n  using assms by (auto simp: is_equality_def Rel_def split: prod.split)\n\nthm option.case_transfer\nlemma option_case_transfer2:\n  assumes\n    \"Rel (crel_vs S) f0 g0\"\n    \"Rel (R ===> crel_vs S) f1 g1\"\n  shows \"Rel (rel_option R ===> crel_vs S) (case_option f0 f1) (case_option g0 g1)\"\n  supply [transfer_rule] = assms[unfolded Rel_def]\n  unfolding Rel_def by transfer_prover\n\nthm option.case_cong\nlemma option_case_cong2:\n  assumes\n    \"is_equality R\"\n    \"Rel R x y\"\n    \"y = None \\<Longrightarrow> Rel (crel_vs S) f0 g0\"\n    \"\\<And>x2. y = Some x2 \\<Longrightarrow> Rel (crel_vs S) (f1 x2) (g1 x2)\"\n  shows \"Rel (crel_vs S) (case_option f0 f1 x) (\\<langle>case_option g0 g1\\<rangle> . \\<langle>y\\<rangle>)\"\n  unfolding return_app_return\n  using assms by (auto simp: is_equality_def Rel_def split: option.split)\n\n\nthm list.case_transfer\nlemma list_case_transfer2:\n  assumes\n    \"Rel (crel_vs S) f0 g0\"\n    \"Rel (R ===> list_all2 R ===> crel_vs S) f1 g1\"\n  shows \"Rel (list_all2 R ===> crel_vs S) (case_list f0 f1) (case_list g0 g1)\"\n  supply [transfer_rule] = assms[unfolded Rel_def]\n  unfolding Rel_def by transfer_prover\n\n\nthm list.case_cong\nlemma list_case_cong2:\n  assumes\n    \"is_equality R\"\n    \"Rel R x y\"\n    \"x = Nil \\<Longrightarrow> Rel (crel_vs S) f0 g0\" \n    \"\\<And>x2 x2s. x = x2#x2s \\<Longrightarrow> Rel (crel_vs S) (f1 x2 x2s) (g1 x2 x2s)\"\n  shows \"Rel (crel_vs S) (case_list f0 f1 x) (\\<langle>case_list g0 g1\\<rangle> . \\<langle>y\\<rangle>)\"\n  unfolding return_app_return\n  using assms by (auto simp: is_equality_def Rel_def split: list.split)\n\nlemmas [dp_match_rule] =\n  map\\<^sub>T_cong2\n  fold\\<^sub>T_cong2\n  if\\<^sub>T_cong2\n\nlemmas [dp_match_rule] =\n  prod_case_cong2\n  prod_case_transfer2\n  option_case_cong2\n  option_case_transfer2\n  list_case_cong2\n  list_case_transfer2\n\nlemmas [dp_match_rule] =\n  crel_vs_return\n  crel_vs_fun_app\n  rel_fun2\n  refl2\n\nlemmas [dp_match_rule] =\n  map\\<^sub>T_transfer2\n  fold\\<^sub>T_transfer2\n\nthm dp_match_rule\n\nend (* lifting_syntax *)\nend (* dp_consistency *)\n\nno_notation fun_app_lifted (infixl \".\" 999)\nno_notation Transfer.Rel (\"Rel\")\nend (* theory *)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Monad_Memo_DP/state_monad/DP_CRelVS_Ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073802837478, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.31376507554289673}}
{"text": "(*  Title:       Variations on a Theme\n *  Author:      Sophie Tourret <stourret at mpi-inf.mpg.de>, 2018-2020 *)\n\nsection \\<open>Variations on a Theme\\<close>\n\ntext \\<open>In this section, section 2.4 of the report is covered, demonstrating\n  that various notions of redundancy are equivalent.\\<close>\n\ntheory Calculus_Variations\n  imports Calculus\nbegin\n\nlocale reduced_calculus = calculus Bot Inf entails Red_I Red_F\n  for\n    Bot :: \"'f set\" and\n    Inf :: \\<open>'f inference set\\<close> and\n    entails :: \"'f set \\<Rightarrow> 'f set \\<Rightarrow> bool\" (infix \"\\<Turnstile>\" 50) and\n    Red_I :: \"'f set \\<Rightarrow> 'f inference set\" and\n    Red_F :: \"'f set \\<Rightarrow> 'f set\"\n + assumes\n   inf_in_red_inf: \"Inf_between UNIV (Red_F N) \\<subseteq> Red_I N\"\nbegin\n\n(* lem:reduced-rc-implies-sat-equiv-reduced-sat *)\nlemma sat_eq_reduc_sat: \"saturated N \\<longleftrightarrow> reduc_saturated N\"\nproof\n  fix N\n  assume \"saturated N\"\n  then show \"reduc_saturated N\"\n    using Red_I_without_red_F saturated_without_red_F\n    unfolding saturated_def reduc_saturated_def\n    by blast\nnext\n  fix N\n  assume red_sat_n: \"reduc_saturated N\"\n  show \"saturated N\" unfolding saturated_def\n    using red_sat_n inf_in_red_inf unfolding reduc_saturated_def Inf_from_def Inf_between_def\n    by blast\nqed\n\nend\n\nlocale reducedly_statically_complete_calculus = calculus +\n  assumes reducedly_statically_complete:\n    \"B \\<in> Bot \\<Longrightarrow> reduc_saturated N \\<Longrightarrow> N \\<Turnstile> {B} \\<Longrightarrow> \\<exists>B'\\<in>Bot. B' \\<in> N\"\n\nlocale reducedly_statically_complete_reduced_calculus = reduced_calculus +\n  assumes reducedly_statically_complete:\n    \"B \\<in> Bot \\<Longrightarrow> reduc_saturated N \\<Longrightarrow> N \\<Turnstile> {B} \\<Longrightarrow> \\<exists>B'\\<in>Bot. B' \\<in> N\"\nbegin\n\nsublocale reducedly_statically_complete_calculus\n  by (simp add: calculus_axioms reducedly_statically_complete\n    reducedly_statically_complete_calculus_axioms.intro\n    reducedly_statically_complete_calculus_def)\n\n(* cor:reduced-rc-implies-st-ref-comp-equiv-reduced-st-ref-comp 1/2 *)\nsublocale statically_complete_calculus\nproof\n  fix B N\n  assume\n    bot_elem: \\<open>B \\<in> Bot\\<close> and\n    saturated_N: \"saturated N\" and\n    refut_N: \"N \\<Turnstile> {B}\"\n  have reduc_saturated_N: \"reduc_saturated N\" using saturated_N sat_eq_reduc_sat by blast\n  show \"\\<exists>B'\\<in>Bot. B' \\<in> N\" using reducedly_statically_complete[OF bot_elem reduc_saturated_N refut_N] .\nqed\n\nend\n\ncontext reduced_calculus\nbegin\n\n(* cor:reduced-rc-implies-st-ref-comp-equiv-reduced-st-ref-comp 2/2 *)\nlemma stat_ref_comp_imp_red_stat_ref_comp:\n  \"statically_complete_calculus Bot Inf entails Red_I Red_F \\<Longrightarrow>\n   reducedly_statically_complete_calculus Bot Inf entails Red_I Red_F\"\nproof\n  fix B N\n  assume\n    stat_ref_comp: \"statically_complete_calculus Bot Inf (\\<Turnstile>) Red_I Red_F\" and\n    bot_elem: \\<open>B \\<in> Bot\\<close> and\n    saturated_N: \"reduc_saturated N\" and\n    refut_N: \"N \\<Turnstile> {B}\"\n  have reduc_saturated_N: \"saturated N\" using saturated_N sat_eq_reduc_sat by blast\n  show \"\\<exists>B'\\<in>Bot. B' \\<in> N\"\n    using statically_complete_calculus.statically_complete[OF stat_ref_comp\n      bot_elem reduc_saturated_N refut_N] .\nqed\n\nend\n\ncontext calculus\nbegin\n\ndefinition Red_Red_I :: \"'f set \\<Rightarrow> 'f inference set\" where\n  \"Red_Red_I N = Red_I N \\<union> Inf_between UNIV (Red_F N)\"\n\nlemma reduced_calc_is_calc: \"calculus Bot Inf entails Red_Red_I Red_F\"\nproof\n  fix N\n  show \"Red_Red_I N \\<subseteq> Inf\"\n    unfolding Red_Red_I_def Inf_between_def Inf_from_def using Red_I_to_Inf by auto\nnext\n  fix B N\n  assume\n    b_in: \"B \\<in> Bot\" and\n    n_entails: \"N \\<Turnstile> {B}\"\n  show \"N - Red_F N \\<Turnstile> {B}\"\n    by (simp add: Red_F_Bot b_in n_entails)\nnext\n  fix N N' :: \"'f set\"\n  assume \"N \\<subseteq> N'\"\n  then show \"Red_F N \\<subseteq> Red_F N'\" by (simp add: Red_F_of_subset)\nnext\n  fix N N' :: \"'f set\"\n  assume n_in: \"N \\<subseteq> N'\"\n  then have \"Inf_from (UNIV - (Red_F N')) \\<subseteq> Inf_from (UNIV - (Red_F N))\"\n    using Red_F_of_subset[OF n_in] unfolding Inf_from_def by auto\n  then have \"Inf_between UNIV (Red_F N) \\<subseteq> Inf_between UNIV (Red_F N')\"\n    unfolding Inf_between_def by auto\n  then show \"Red_Red_I N \\<subseteq> Red_Red_I N'\"\n    unfolding Red_Red_I_def using Red_I_of_subset[OF n_in] by blast\nnext\n  fix N N' :: \"'f set\"\n  assume \"N' \\<subseteq> Red_F N\"\n  then show \"Red_F N \\<subseteq> Red_F (N - N')\" by (simp add: Red_F_of_Red_F_subset)\nnext\n  fix N N' :: \"'f set\"\n  assume np_subs: \"N' \\<subseteq> Red_F N\"\n  have \"Red_F N \\<subseteq> Red_F (N - N')\" by (simp add: Red_F_of_Red_F_subset np_subs)\n  then have \"Inf_from (UNIV - (Red_F (N - N'))) \\<subseteq> Inf_from (UNIV - (Red_F N))\"\n    by (metis Diff_subset Red_F_of_subset eq_iff)\n  then have \"Inf_between UNIV (Red_F N) \\<subseteq> Inf_between UNIV (Red_F (N - N'))\"\n    unfolding Inf_between_def by auto\n  then show \"Red_Red_I N \\<subseteq> Red_Red_I (N - N')\"\n    unfolding Red_Red_I_def using Red_I_of_Red_F_subset[OF np_subs] by blast\nnext\n  fix \\<iota> N\n  assume \"\\<iota> \\<in> Inf\"\n    \"concl_of \\<iota> \\<in> N\"\n  then show \"\\<iota> \\<in> Red_Red_I N\"\n    by (simp add: Red_I_of_Inf_to_N Red_Red_I_def)\nqed\n\nlemma inf_subs_reduced_red_inf: \"Inf_between UNIV (Red_F N) \\<subseteq> Red_Red_I N\"\n  unfolding Red_Red_I_def by simp\n\n(* lem:red'-is-reduced-redcrit *)\ntext \\<open>The following is a lemma and not a sublocale as was previously used in similar cases.\n  Here, a sublocale cannot be used because it would create an infinitely descending\n  chain of sublocales. \\<close>\nlemma reduc_calc: \"reduced_calculus Bot Inf entails Red_Red_I Red_F\"\n  using inf_subs_reduced_red_inf reduced_calc_is_calc\n  by (simp add: reduced_calculus.intro reduced_calculus_axioms_def)\n\ninterpretation reduc_calc: reduced_calculus Bot Inf entails Red_Red_I Red_F\n  by (fact reduc_calc)\n\n(* lem:saturation-red-vs-red'-1 *)\nlemma sat_imp_red_calc_sat: \"saturated N \\<Longrightarrow> reduc_calc.saturated N\"\n  unfolding saturated_def reduc_calc.saturated_def Red_Red_I_def by blast\n\n(* lem:saturation-red-vs-red'-2 1/2 (i) \\<longleftrightarrow> (ii) *)\nlemma red_sat_eq_red_calc_sat: \"reduc_saturated N \\<longleftrightarrow> reduc_calc.saturated N\"\nproof\n  assume red_sat_n: \"reduc_saturated N\"\n  show \"reduc_calc.saturated N\"\n    unfolding reduc_calc.saturated_def\n  proof\n    fix \\<iota>\n    assume i_in: \"\\<iota> \\<in> Inf_from N\"\n    show \"\\<iota> \\<in> Red_Red_I N\"\n      using i_in red_sat_n\n      unfolding reduc_saturated_def Inf_between_def Inf_from_def Red_Red_I_def by blast\n  qed\nnext\n  assume red_sat_n: \"reduc_calc.saturated N\"\n  show \"reduc_saturated N\"\n    unfolding reduc_saturated_def\n  proof\n    fix \\<iota>\n    assume i_in: \"\\<iota> \\<in> Inf_from (N - Red_F N)\"\n    show \"\\<iota> \\<in> Red_I N\"\n      using i_in red_sat_n\n      unfolding Inf_from_def reduc_calc.saturated_def Red_Red_I_def Inf_between_def by blast\n  qed\nqed\n\n(* lem:saturation-red-vs-red'-2 2/2 (i) \\<longleftrightarrow> (iii) *)\nlemma red_sat_eq_sat: \"reduc_saturated N \\<longleftrightarrow> saturated (N - Red_F N)\"\n  unfolding reduc_saturated_def saturated_def by (simp add: Red_I_without_red_F)\n\n(* thm:reduced-stat-ref-compl 1/3 (i) \\<longleftrightarrow> (iii) *)\ntheorem stat_is_stat_red: \"statically_complete_calculus Bot Inf entails Red_I Red_F \\<longleftrightarrow>\n  statically_complete_calculus Bot Inf entails Red_Red_I Red_F\"\nproof\n  assume\n    stat_ref1: \"statically_complete_calculus Bot Inf entails Red_I Red_F\"\n  show \"statically_complete_calculus Bot Inf entails Red_Red_I Red_F\"\n    using reduc_calc.calculus_axioms\n    unfolding statically_complete_calculus_def statically_complete_calculus_axioms_def\n  proof\n    show \"\\<forall>B N. B \\<in> Bot \\<longrightarrow> reduc_calc.saturated N \\<longrightarrow> N \\<Turnstile> {B} \\<longrightarrow> (\\<exists>B'\\<in>Bot. B' \\<in> N)\"\n    proof (clarify)\n      fix B N\n      assume\n        b_in: \"B \\<in> Bot\" and\n        n_sat: \"reduc_calc.saturated N\" and\n        n_imp_b: \"N \\<Turnstile> {B}\"\n      have \"saturated (N - Red_F N)\" using red_sat_eq_red_calc_sat[of N] red_sat_eq_sat[of N] n_sat by blast\n      moreover have \"(N - Red_F N) \\<Turnstile> {B}\" using n_imp_b b_in by (simp add: reduc_calc.Red_F_Bot)\n      ultimately show \"\\<exists>B'\\<in>Bot. B'\\<in> N\"\n        using stat_ref1 by (meson DiffD1 b_in statically_complete_calculus.statically_complete)\n    qed\n  qed\nnext\n  assume\n    stat_ref3: \"statically_complete_calculus Bot Inf entails Red_Red_I Red_F\"\n  show \"statically_complete_calculus Bot Inf entails Red_I Red_F\"\n    unfolding statically_complete_calculus_def statically_complete_calculus_axioms_def\n    using calculus_axioms\n  proof\n    show \"\\<forall>B N. B \\<in> Bot \\<longrightarrow> saturated N \\<longrightarrow> N \\<Turnstile> {B} \\<longrightarrow> (\\<exists>B'\\<in>Bot. B' \\<in> N)\"\n    proof clarify\n      fix B N\n      assume\n        b_in: \"B \\<in> Bot\" and\n        n_sat: \"saturated N\" and\n        n_imp_b: \"N \\<Turnstile> {B}\"\n      then show \"\\<exists>B'\\<in> Bot. B' \\<in> N\"\n        using stat_ref3 sat_imp_red_calc_sat[OF n_sat]\n        by (meson statically_complete_calculus.statically_complete)\n    qed\n  qed\nqed\n\n(* thm:reduced-stat-ref-compl 2/3 (iv) \\<longleftrightarrow> (iii) *)\ntheorem red_stat_red_is_stat_red:\n  \"reducedly_statically_complete_calculus Bot Inf entails Red_Red_I Red_F \\<longleftrightarrow>\n   statically_complete_calculus Bot Inf entails Red_Red_I Red_F\"\n  using reduc_calc.stat_ref_comp_imp_red_stat_ref_comp\n  by (metis reduc_calc.sat_eq_reduc_sat reducedly_statically_complete_calculus.axioms(2)\n    reducedly_statically_complete_calculus_axioms_def reduced_calc_is_calc\n    statically_complete_calculus.intro statically_complete_calculus_axioms.intro)\n\n(* thm:reduced-stat-ref-compl 3/3 (ii) \\<longleftrightarrow> (iii) *)\ntheorem red_stat_is_stat_red:\n  \"reducedly_statically_complete_calculus Bot Inf entails Red_I Red_F \\<longleftrightarrow>\n   statically_complete_calculus Bot Inf entails Red_Red_I Red_F\"\n  using reduc_calc.calculus_axioms calculus_axioms red_sat_eq_red_calc_sat\n  unfolding statically_complete_calculus_def statically_complete_calculus_axioms_def\n    reducedly_statically_complete_calculus_def reducedly_statically_complete_calculus_axioms_def\n  by blast\n\nlemma sup_red_f_in_red_liminf:\n  \"chain derive Ns \\<Longrightarrow> Sup_llist (lmap Red_F Ns) \\<subseteq> Red_F (Liminf_llist Ns)\"\nproof\n  fix N\n  assume\n    deriv: \"chain derive Ns\" and\n    n_in_sup: \"N \\<in> Sup_llist (lmap Red_F Ns)\"\n  obtain i0 where i_smaller: \"enat i0 < llength Ns\" and n_in: \"N \\<in> Red_F (lnth Ns i0)\"\n    using n_in_sup by (metis Sup_llist_imp_exists_index llength_lmap lnth_lmap)\n  have \"Red_F (lnth Ns i0) \\<subseteq> Red_F (Liminf_llist Ns)\"\n    using i_smaller by (simp add: deriv Red_F_subset_Liminf)\n  then show \"N \\<in> Red_F (Liminf_llist Ns)\"\n    using n_in by fast\nqed\n\nlemma sup_red_inf_in_red_liminf:\n  \"chain derive Ns \\<Longrightarrow> Sup_llist (lmap Red_I Ns) \\<subseteq> Red_I (Liminf_llist Ns)\"\nproof\n  fix \\<iota>\n  assume\n    deriv: \"chain derive Ns\" and\n    i_in_sup: \"\\<iota> \\<in> Sup_llist (lmap Red_I Ns)\"\n  obtain i0 where i_smaller: \"enat i0 < llength Ns\" and n_in: \"\\<iota> \\<in> Red_I (lnth Ns i0)\"\n    using i_in_sup unfolding Sup_llist_def by auto\n  have \"Red_I (lnth Ns i0) \\<subseteq> Red_I (Liminf_llist Ns)\"\n    using i_smaller by (simp add: deriv Red_I_subset_Liminf)\n  then show \"\\<iota> \\<in> Red_I (Liminf_llist Ns)\"\n    using n_in by fast\nqed\n\ndefinition reduc_fair :: \"'f set llist \\<Rightarrow> bool\" where\n  \"reduc_fair Ns \\<longleftrightarrow>\n   Inf_from (Liminf_llist Ns - Sup_llist (lmap Red_F Ns)) \\<subseteq> Sup_llist (lmap Red_I Ns)\"\n\n(* lem:red-fairness-implies-red-saturation *)\nlemma reduc_fair_imp_Liminf_reduc_sat:\n  \"chain derive Ns \\<Longrightarrow> reduc_fair Ns \\<Longrightarrow> reduc_saturated (Liminf_llist Ns)\"\n  unfolding reduc_saturated_def\nproof -\n  fix Ns\n  assume\n    deriv: \"chain derive Ns\" and\n    red_fair: \"reduc_fair Ns\"\n  have \"Inf_from (Liminf_llist Ns - Red_F (Liminf_llist Ns))\n    \\<subseteq> Inf_from (Liminf_llist Ns - Sup_llist (lmap Red_F Ns))\"\n    using sup_red_f_in_red_liminf[OF deriv] unfolding Inf_from_def by blast\n  then have \"Inf_from (Liminf_llist Ns - Red_F (Liminf_llist Ns)) \\<subseteq> Sup_llist (lmap Red_I Ns)\"\n    using red_fair unfolding reduc_fair_def by simp\n  then show \"Inf_from (Liminf_llist Ns - Red_F (Liminf_llist Ns)) \\<subseteq> Red_I (Liminf_llist Ns)\"\n    using sup_red_inf_in_red_liminf[OF deriv] by fast\nqed\n\nend\n\nlocale reducedly_dynamically_complete_calculus = calculus +\n  assumes\n    reducedly_dynamically_complete: \"B \\<in> Bot \\<Longrightarrow> chain derive Ns \\<Longrightarrow> reduc_fair Ns \\<Longrightarrow>\n      lhd Ns \\<Turnstile> {B} \\<Longrightarrow> \\<exists>i \\<in> {i. enat i < llength Ns}. \\<exists> B'\\<in>Bot. B' \\<in> lnth Ns i\"\nbegin\n\nsublocale reducedly_statically_complete_calculus\nproof\n  fix B N\n  assume\n    bot_elem: \\<open>B \\<in> Bot\\<close> and\n    saturated_N: \"reduc_saturated N\" and\n    refut_N: \"N \\<Turnstile> {B}\"\n  define Ns where \"Ns = LCons N LNil\"\n  have[simp]: \\<open>\\<not> lnull Ns\\<close> by (auto simp: Ns_def)\n  have deriv_D: \\<open>chain (\\<rhd>) Ns\\<close> by (simp add: chain.chain_singleton Ns_def)\n  have liminf_is_N: \"Liminf_llist Ns = N\" by (simp add: Ns_def Liminf_llist_LCons)\n  have head_D: \"N = lhd Ns\" by (simp add: Ns_def)\n  have \"Sup_llist (lmap Red_F Ns) = Red_F N\" by (simp add: Ns_def)\n  moreover have \"Sup_llist (lmap Red_I Ns) = Red_I N\" by (simp add: Ns_def)\n  ultimately have fair_D: \"reduc_fair Ns\"\n    using saturated_N liminf_is_N unfolding reduc_fair_def reduc_saturated_def\n    by (simp add: reduc_fair_def reduc_saturated_def liminf_is_N)\n  obtain i B' where B'_is_bot: \\<open>B' \\<in> Bot\\<close> and B'_in: \"B' \\<in> lnth Ns i\" and \\<open>i < llength Ns\\<close>\n    using reducedly_dynamically_complete[of B Ns] bot_elem fair_D head_D saturated_N deriv_D refut_N\n    by auto\n  then have \"i = 0\"\n    by (auto simp: Ns_def enat_0_iff)\n  show \\<open>\\<exists>B'\\<in>Bot. B' \\<in> N\\<close>\n    using B'_is_bot B'_in unfolding \\<open>i = 0\\<close> head_D[symmetric] Ns_def by auto\nqed\n\nend\n\nsublocale reducedly_statically_complete_calculus \\<subseteq> reducedly_dynamically_complete_calculus\nproof\n  fix B Ns\n  assume\n    bot_elem: \\<open>B \\<in> Bot\\<close> and\n    deriv: \\<open>chain (\\<rhd>) Ns\\<close> and\n    fair: \\<open>reduc_fair Ns\\<close> and\n    unsat: \\<open>lhd Ns \\<Turnstile> {B}\\<close>\n    have non_empty: \\<open>\\<not> lnull Ns\\<close> using chain_not_lnull[OF deriv] .\n    have subs: \\<open>lhd Ns \\<subseteq> Sup_llist Ns\\<close>\n      using lhd_subset_Sup_llist[of Ns] non_empty by (simp add: lhd_conv_lnth)\n    have \\<open>Sup_llist Ns \\<Turnstile> {B}\\<close>\n      using unsat subset_entailed[OF subs] entails_trans[of \"Sup_llist Ns\" \"lhd Ns\"] by auto\n    then have Sup_no_Red: \\<open>Sup_llist Ns - Red_F (Sup_llist Ns) \\<Turnstile> {B}\\<close>\n      using bot_elem Red_F_Bot by auto\n    have Sup_no_Red_in_Liminf: \\<open>Sup_llist Ns - Red_F (Sup_llist Ns) \\<subseteq> Liminf_llist Ns\\<close>\n      using deriv Red_in_Sup by auto\n    have Liminf_entails_Bot: \\<open>Liminf_llist Ns \\<Turnstile> {B}\\<close>\n      using Sup_no_Red subset_entailed[OF Sup_no_Red_in_Liminf] entails_trans by blast\n    have \\<open>reduc_saturated (Liminf_llist Ns)\\<close>\n    using deriv fair reduc_fair_imp_Liminf_reduc_sat unfolding reduc_saturated_def\n      by auto\n   then have \\<open>\\<exists>B'\\<in>Bot. B' \\<in> Liminf_llist Ns\\<close>\n     using bot_elem reducedly_statically_complete Liminf_entails_Bot\n     by auto\n   then show \\<open>\\<exists>i\\<in>{i. enat i < llength Ns}. \\<exists>B'\\<in>Bot. B' \\<in> lnth Ns i\\<close>\n     unfolding Liminf_llist_def by auto\nqed\n\ncontext calculus\nbegin\n\nlemma dyn_equiv_stat: \"dynamically_complete_calculus Bot Inf entails Red_I Red_F =\n  statically_complete_calculus Bot Inf entails Red_I Red_F\"\nproof\n  assume \"dynamically_complete_calculus Bot Inf entails Red_I Red_F\"\n  then interpret dynamically_complete_calculus Bot Inf entails Red_I Red_F\n    by simp\n  show \"statically_complete_calculus Bot Inf entails Red_I Red_F\"\n    by (simp add: statically_complete_calculus_axioms)\nnext\n  assume \"statically_complete_calculus Bot Inf entails Red_I Red_F\"\n  then interpret statically_complete_calculus Bot Inf entails Red_I Red_F\n    by simp\n  show \"dynamically_complete_calculus Bot Inf entails Red_I Red_F\"\n    by (simp add: dynamically_complete_calculus_axioms)\nqed\n\nlemma red_dyn_equiv_red_stat:\n  \"reducedly_dynamically_complete_calculus Bot Inf entails Red_I Red_F =\n   reducedly_statically_complete_calculus Bot Inf entails Red_I Red_F\"\nproof\n  assume \"reducedly_dynamically_complete_calculus Bot Inf entails Red_I Red_F\"\n  then interpret reducedly_dynamically_complete_calculus Bot Inf entails Red_I Red_F\n    by simp\n  show \"reducedly_statically_complete_calculus Bot Inf entails Red_I Red_F\"\n    by (simp add: reducedly_statically_complete_calculus_axioms)\nnext\n  assume \"reducedly_statically_complete_calculus Bot Inf entails Red_I Red_F\"\n  then interpret reducedly_statically_complete_calculus Bot Inf entails Red_I Red_F\n    by simp\n  show \"reducedly_dynamically_complete_calculus Bot Inf entails Red_I Red_F\"\n    by (simp add: reducedly_dynamically_complete_calculus_axioms)\nqed\n\ninterpretation reduc_calc: reduced_calculus Bot Inf entails Red_Red_I Red_F\n  by (fact reduc_calc)\n\n(* thm:reduced-dyn-ref-compl 1/3 (v) \\<longleftrightarrow> (vii) *)\ntheorem dyn_ref_eq_dyn_ref_red:\n  \"dynamically_complete_calculus Bot Inf entails Red_I Red_F \\<longleftrightarrow>\n   dynamically_complete_calculus Bot Inf entails Red_Red_I Red_F\"\n  using dyn_equiv_stat stat_is_stat_red reduc_calc.dyn_equiv_stat by meson\n\n(* thm:reduced-dyn-ref-compl 2/3 (viii) \\<longleftrightarrow> (vii) *)\ntheorem red_dyn_ref_red_eq_dyn_ref_red:\n  \"reducedly_dynamically_complete_calculus Bot Inf entails Red_Red_I Red_F \\<longleftrightarrow>\n   dynamically_complete_calculus Bot Inf entails Red_Red_I Red_F\"\n  using red_dyn_equiv_red_stat dyn_equiv_stat red_stat_red_is_stat_red\n  by (simp add: reduc_calc.dyn_equiv_stat reduc_calc.red_dyn_equiv_red_stat)\n\n(* thm:reduced-dyn-ref-compl 3/3 (vi) \\<longleftrightarrow> (vii) *)\ntheorem red_dyn_ref_eq_dyn_ref_red:\n  \"reducedly_dynamically_complete_calculus Bot Inf entails Red_I Red_F \\<longleftrightarrow>\n   dynamically_complete_calculus Bot Inf entails Red_Red_I Red_F\"\n  using red_dyn_equiv_red_stat dyn_equiv_stat red_stat_is_stat_red\n    reduc_calc.dyn_equiv_stat reduc_calc.red_dyn_equiv_red_stat\n  by blast\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Saturation_Framework/Calculus_Variations.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3137650671384207}}
{"text": "header {* Common Proof Methods and Idioms *} \ntheory Idioms \nimports \"../Sep_Main\" \"Open_List\" Circ_List Hash_Set_Impl\nbegin \ntext_raw{*\\label{thy:ex:idioms}*}\n\n  text {*\n    This theory gives a short documentation of common proof techniques and \n    idioms for the separation logic framework. For this purpose, it presents\n    some proof snippets (inspired by the other example theories), and heavily\n    comments on them.\n    *}\n\n  subsection {* The Method @{text \"sep_auto\"}*}\n  text {* The most versatile method of our framework is @{text \"sep_auto\"},\n    which integrates the verification condition generator, the entailment\n    solver and some pre- and postprocessing tactics based on the simplifier \n    and classical reasoner. It can be applied to a Hoare-triple or entailment\n    subgoal, and will try to solve it, and any emerging new goals. It stops\n    when the goal is either solved or it gets stuck somewhere. *}\n\n  text {* As a simple example for @{text \"sep_auto\"} consider the following\n    program that does some operations on two circular lists: *}\n  definition \"test \\<equiv> do {\n    l1 \\<leftarrow> cs_empty;\n    l2 \\<leftarrow> cs_empty;\n    l1 \\<leftarrow> cs_append ''a'' l1;\n    l2 \\<leftarrow> cs_append ''c'' l2;\n    l1 \\<leftarrow> cs_append ''b'' l1;\n    l2 \\<leftarrow> cs_append ''e'' l2;\n    l2 \\<leftarrow> cs_prepend ''d'' l2;\n    l2 \\<leftarrow> cs_rotate l2;\n    return (l1,l2)\n  }\"\n  \n  text {* The @{text \"sep_auto\"} method does all the \n    necessary frame-inference automatically, and thus manages to prove\n    the following lemma in one step: *}\n  lemma \"<emp> \n    test \n    <\\<lambda>(l1,l2). cs_list [''a'',''b''] l1 \n      * cs_list [''c'',''e'',''d''] l2>\\<^sub>t\"\n    unfolding test_def\n    apply (sep_auto)\n    done\n\n  text {* @{text \"sep_auto\"} accepts all the section-options of the classical\n    reasoner and simplifier, e.g., @{text \"simp add/del:\"}, @{text \"intro:\"}.\n    Moreover, it has some more section options, the most useful being \n    @{text \"heap add/del:\"} to add or remove Hoare-rules that are applied\n    with frame-inference. A complete documentation of the accepted options can\n    be found in Section~\\ref{sec:auto:overview}.\n    *}\n\n  text {* As a typical example, consider the following proof: *}\n  lemma complete_ht_rehash: \n    \"<is_hashtable l ht> ht_rehash ht \n    <\\<lambda>r. is_hashtable l ht * is_hashtable (ls_rehash l) r>\"\n  proof -\n    have LEN: \" l \\<noteq> [] \\<Longrightarrow> Suc 0 < 2 * length l\" by (cases l) auto\n    show ?thesis\n      apply (rule cons_pre_rule[OF ht_imp_len])\n      unfolding ht_rehash_def\n      apply (sep_auto \n        heap: complete_ht_new_sz complete_ht_copy\n        simp: ls_rehash_def LEN\n      ) -- \"Here we add a heap-rule, and some simp-rules\"\n      done\n  qed\n\n  subsection {* Applying Single Rules *}\n  text {* \\paragraph{Hoare Triples} In this example, we show how to do\n    a proof step-by-step. *}\n\n  lemma\n    \"<os_list xs n> os_prepend x n <os_list (x # xs)>\"\n    unfolding os_prepend_def\n    txt {* The rules to deconstruct compound statements are contained in the\n      @{text \"sep_decon_rules\"} collection *}\n    thm sep_decon_rules\n    apply (rule sep_decon_rules)\n    txt {* The rules for statement that deend on the heap are\n      contained in the @{text sep_heap_rules} collection. The\n      @{text \"fi_rule\"}-lemma prepares frame inference for them *}\n    apply (rule sep_heap_rules[THEN fi_rule])\n    apply frame_inference -- \"This method does the frame-inference\"\n    \n    txt {* The consequence rule comes in three versions, \n      @{text \"const_rule\"}, @{text \"cons_pre_rule\"}, \n      and @{text \"cons_post_rule\"}*}\n    apply (rule cons_post_rule) \n    apply (rule sep_decon_rules)\n\n    txt {* A simplification unfolds @{text \"os_list\"} and extract the\n      pure part of the assumption *}\n    apply (clarsimp)\n\n    txt {* We can use @{text \"ent_ex_postI\"} to manually introduce \n      existentials in entailsments *}\n    apply (rule_tac x=xa in ent_ex_postI)\n    apply (rule_tac x=n in ent_ex_postI)\n    txt {* The simplifier has a setup for assertions, so it will do the rest *}\n    apply simp\n    done\n\n  text {* Note that the proof above can be done with @{text \"sep_auto\"},\n    the \"Swiss army knife\" of our framework *}\n  lemma\n    \"<os_list xs n> os_prepend x n <os_list (x # xs)>\"\n    unfolding os_prepend_def by sep_auto\n\n  text {* \\paragraph{Entailment} This example presents an actual proof\n    from the circular list theory, where we have to manually apply a\n    rule and give some hints to frame inference *}\n  lemma cs_append_rule: \n    \"<cs_list l p> cs_append x p <cs_list (l@[x])>\"\n    apply (cases p)\n    apply (sep_auto simp: cs_append.simps)\n\n    apply (sep_auto simp: cs_append.simps heap: lseg_append)\n    txt {* At this point, we are left with an entailment subgoal that sep-auto\n      cannot solve. A closer look reveals that we could use the rule\n      @{text \"lseg_append\"}. \n      \n      With the @{text \"ent_frame_fwd\"}-rule, we can manually apply a rule to\n      solve an entailment, involving frame inference. In this case, we have\n      the additional problem that frame-inference guesses\n      a wrong instantiation, and is not able to infer the frame.\n      So we have to pre-instantiate the rule, as done below. *}\n    apply (rule_tac s1=pp in ent_frame_fwd[OF lseg_append])\n    apply frame_inference -- \"Now frame-inference is able to infer the frame\"\n\n    txt {* Now we are left with a trivial entailment, modulo commutativity of\n      star. This can be handled by the entailment solver: *}\n    apply solve_entails\n    done\n\n\n\n  subsection {* Functions with Explicit Recursion *}\n  text {* If the termination argument of a function depends on one of\n    its parameters, we can use the function package. For example, \n    the following function inserts elements from a list into a hash-set: *}\n\n  fun ins_from_list \n    :: \"('x::{heap,hashable}) list \\<Rightarrow> 'x hashset \\<Rightarrow> 'x hashset Heap\" \n    where\n    \"ins_from_list [] hs = return hs\" |\n    \"ins_from_list (x # l) hs = do { hs \\<leftarrow> hs_ins x hs; ins_from_list l hs }\"\n\n  text {* Proofs over such functions are usually done by structural\n    induction on the explicit parameter, in this case, on the list *}\n  lemma ins_from_list_correct:\n    \"<is_hashset s hs> ins_from_list l hs <is_hashset (s\\<union>set l)>\\<^sub>t\"\n  proof (induction l arbitrary: hs s)\n    case (Cons x l) \n    txt {* In the induction step, the induction hypothesis has to be \n      declared as a heap-rule, as @{text \"sep_auto\"} currently does not\n      look for potential heap-rules among the premises of the subgoal *}\n    show ?case by (sep_auto heap: Cons.IH)\n  qed sep_auto\n\n\n  subsection {*\n    Functions with Recursion Involving the Heap\n    *}\n  text {* If the termination argument of a function depends on data stored on\n    the heap, @{text \"partial_function\"} is a useful tool.\n\n    Note that, despite the name, proving a Hoare-Triple @{text \"<\\<dots>> \\<dots> <\\<dots>>\"}\n    for something defined with @{text \"partial_function\"} implies total \n    correctness.\n    *}\n\n  text {* In the following example, we compute the sum of a list, using an\n    iterator. Note that the partial-function package does not provide a\n    code generator setup by default, so we have to add a @{text \"[code]\"}\n    attribute manually*}\n  partial_function (heap) os_sum' :: \"int os_list_it \\<Rightarrow> int \\<Rightarrow> int Heap\" \n    where [code]:\n    \"os_sum' it s = do {\n      b \\<leftarrow> os_it_has_next it;\n      if b then do {\n        (x,it') \\<leftarrow> os_it_next it;\n        os_sum' it' (s+x)\n      } else return s\n    }\"\n\n  text {* The proof that the function is correct can be done by induction\n    over the representation of the list that we still have to iterate over.\n    Note that for iterators over sets, we need induction on finite sets,\n    cf. also @{text \"To_List_Ga.thy\"} *}\n\n  lemma os_sum'_rule: \n    \"<os_is_it l p l' it> \n    os_sum' it s \n    <\\<lambda>r. os_list l p * \\<up>(r = s + listsum l')>\\<^sub>t\"\n  proof (induct l' arbitrary: it s)\n    case Nil thus ?case\n      txt {* To unfold the definition of a partial function, we have to use \n        @{text \"subst\"}. Note that @{text \"simp\"} would loop, unfolding the\n        function arbitrarily deep *}\n      apply (subst os_sum'.simps)\n      txt {* @{text \"sep_auto\"} accepts all the section parameters that \n        @{text \"auto\"} does, eg. @{text \"intro: \"} *}\n      apply (sep_auto intro: os.quit_iteration)\n      done\n  next\n    case (Cons x l')\n    show ?case\n      apply (subst os_sum'.simps)\n      txt {* Additionally, @{text \"sep_auto\"} accepts some more section \n        parameters. The most common one, @{text \"heap: \"}, declares rules \n        to be used with frame inference. See Section~\\ref{sec:auto:overview}\n        for a complete overview.*}\n      apply (sep_auto heap: Cons.hyps)\n      done\n  qed\n\n\n  subsection {* Precision Proofs *}\n  text {*\n    Precision lemmas show that an assertion uniquely determines some of its\n    parameters. Our example shows that two list segments from the same start \n    pointer and with the same list, also have to end at the same end pointer.\n    *}\n  \n  lemma lseg_prec3: \n    \"\\<forall>q q'. h \\<Turnstile> (lseg l p q * F1) \\<and>\\<^sub>A (lseg l p q' * F2) \\<longrightarrow> q=q'\"\n    apply (intro allI)\n  proof (induct l arbitrary: p F1 F2)\n    case Nil thus ?case \n      apply simp -- \"A precision solver for references and arrays is included\n        in the standard simplifier setup. Building a general precision solver\n        remains future work.\"\n      by metis -- \"Unfortunately, the simplifier cannot cope with arbitrarily  \n        directed equations, so we have to use some more powerful tool\"\n  next\n    case (Cons x l)\n    show ?case\n      apply clarsimp\n  \n      apply (subgoal_tac \"na=n\")\n  \n      txt {* The @{text \"prec_frame\"} and @{text \"prec_frame'\"} rules are \n        useful to do precision proofs *}\n      apply (erule prec_frame'[OF Cons.hyps])\n      apply frame_inference\n      apply frame_inference\n  \n      apply (drule prec_frame[OF sngr_prec])\n      apply frame_inference\n      apply frame_inference\n      apply simp\n      done\n  qed\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Separation_Logic_Imperative_HOL/Examples/Idioms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3137650671384207}}
{"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\<open>\\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> and \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close>: cospan and span\\<close>\ntheory CZH_ECAT_SS\n  imports CZH_ECAT_Small_Functor\nbegin\n\n\n\nsubsection\\<open>Background\\<close>\n\n\ntext\\<open>\nGeneral information about \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> and \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close> (also known as \ncospans and spans, respectively) can be found in in Chapters III-3 and III-4 \nin \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close>, as well as \nnLab \\<^cite>\\<open>\"noauthor_nlab_nodate\"\\<close>\\footnote{\n\\url{https://ncatlab.org/nlab/show/cospan}\n}\\footnote{\\url{https://ncatlab.org/nlab/show/span}}.\n\\<close>\n\nnamed_theorems cat_ss_cs_simps\nnamed_theorems cat_ss_cs_intros\n\nnamed_theorems cat_ss_elem_simps\n\ndefinition \\<oo>\\<^sub>S\\<^sub>S where [cat_ss_elem_simps]: \"\\<oo>\\<^sub>S\\<^sub>S = 0\"\ndefinition \\<aa>\\<^sub>S\\<^sub>S where [cat_ss_elem_simps]: \"\\<aa>\\<^sub>S\\<^sub>S = 1\\<^sub>\\<nat>\"\ndefinition \\<bb>\\<^sub>S\\<^sub>S where [cat_ss_elem_simps]: \"\\<bb>\\<^sub>S\\<^sub>S = 2\\<^sub>\\<nat>\"\ndefinition \\<gg>\\<^sub>S\\<^sub>S where [cat_ss_elem_simps]: \"\\<gg>\\<^sub>S\\<^sub>S = 3\\<^sub>\\<nat>\"\ndefinition \\<ff>\\<^sub>S\\<^sub>S where [cat_ss_elem_simps]: \"\\<ff>\\<^sub>S\\<^sub>S = 4\\<^sub>\\<nat>\"\n\nlemma cat_ss_ineq:\n  shows cat_ss_\\<aa>\\<bb>[cat_ss_cs_intros]: \"\\<aa>\\<^sub>S\\<^sub>S \\<noteq> \\<bb>\\<^sub>S\\<^sub>S\"\n    and cat_ss_\\<aa>\\<oo>[cat_ss_cs_intros]: \"\\<aa>\\<^sub>S\\<^sub>S \\<noteq> \\<oo>\\<^sub>S\\<^sub>S\"\n    and cat_ss_\\<bb>\\<oo>[cat_ss_cs_intros]: \"\\<bb>\\<^sub>S\\<^sub>S \\<noteq> \\<oo>\\<^sub>S\\<^sub>S\"\n    and cat_ss_\\<gg>\\<ff>[cat_ss_cs_intros]: \"\\<gg>\\<^sub>S\\<^sub>S \\<noteq> \\<ff>\\<^sub>S\\<^sub>S\"\n    and cat_ss_\\<gg>\\<aa>[cat_ss_cs_intros]: \"\\<gg>\\<^sub>S\\<^sub>S \\<noteq> \\<aa>\\<^sub>S\\<^sub>S\"\n    and cat_ss_\\<gg>\\<bb>[cat_ss_cs_intros]: \"\\<gg>\\<^sub>S\\<^sub>S \\<noteq> \\<bb>\\<^sub>S\\<^sub>S\"\n    and cat_ss_\\<gg>\\<oo>[cat_ss_cs_intros]: \"\\<gg>\\<^sub>S\\<^sub>S \\<noteq> \\<oo>\\<^sub>S\\<^sub>S\"\n    and cat_ss_\\<ff>\\<aa>[cat_ss_cs_intros]: \"\\<ff>\\<^sub>S\\<^sub>S \\<noteq> \\<aa>\\<^sub>S\\<^sub>S\"\n    and cat_ss_\\<ff>\\<bb>[cat_ss_cs_intros]: \"\\<ff>\\<^sub>S\\<^sub>S \\<noteq> \\<bb>\\<^sub>S\\<^sub>S\"\n    and cat_ss_\\<ff>\\<oo>[cat_ss_cs_intros]: \"\\<ff>\\<^sub>S\\<^sub>S \\<noteq> \\<oo>\\<^sub>S\\<^sub>S\"\n  unfolding cat_ss_elem_simps by simp_all\n\nlemma (in \\<Z>) \n  shows cat_ss_\\<aa>[cat_ss_cs_intros]: \"\\<aa>\\<^sub>S\\<^sub>S \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and cat_ss_\\<bb>[cat_ss_cs_intros]: \"\\<bb>\\<^sub>S\\<^sub>S \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and cat_ss_\\<oo>[cat_ss_cs_intros]: \"\\<oo>\\<^sub>S\\<^sub>S \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and cat_ss_\\<gg>[cat_ss_cs_intros]: \"\\<gg>\\<^sub>S\\<^sub>S \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and cat_ss_\\<ff>[cat_ss_cs_intros]: \"\\<ff>\\<^sub>S\\<^sub>S \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n  unfolding cat_ss_elem_simps by simp_all\n\n\n\nsubsection\\<open>Composable arrows in \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> and \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close>\\<close>\n\nabbreviation cat_scospan_composable :: V\n  where \"cat_scospan_composable \\<equiv> \n    (set {\\<oo>\\<^sub>S\\<^sub>S} \\<times>\\<^sub>\\<bullet> set {\\<oo>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S}) \\<union>\\<^sub>\\<circ> \n    (set {\\<gg>\\<^sub>S\\<^sub>S, \\<aa>\\<^sub>S\\<^sub>S} \\<times>\\<^sub>\\<bullet> set {\\<aa>\\<^sub>S\\<^sub>S}) \\<union>\\<^sub>\\<circ> \n    (set {\\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S} \\<times>\\<^sub>\\<bullet> set {\\<bb>\\<^sub>S\\<^sub>S})\"\n\nabbreviation cat_sspan_composable :: V\n  where \"cat_sspan_composable \\<equiv> (cat_scospan_composable)\\<inverse>\\<^sub>\\<bullet>\"\n\n\ntext\\<open>Rules.\\<close>\n\nlemma cat_scospan_composable_\\<oo>\\<oo>[cat_ss_cs_intros]:\n  assumes \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n  using assms by auto\n\nlemma cat_scospan_composable_\\<oo>\\<gg>[cat_ss_cs_intros]:\n  assumes \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n  using assms by auto\n\nlemma cat_scospan_composable_\\<oo>\\<ff>[cat_ss_cs_intros]:\n  assumes \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n  using assms by auto\n\nlemma cat_scospan_composable_\\<gg>\\<aa>[cat_ss_cs_intros]:\n  assumes \"g = \\<gg>\\<^sub>S\\<^sub>S\" and \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n  using assms by auto\n\nlemma cat_scospan_composable_\\<ff>\\<bb>[cat_ss_cs_intros]:\n  assumes \"g = \\<ff>\\<^sub>S\\<^sub>S\" and \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n  using assms by auto\n\nlemma cat_scospan_composable_\\<aa>\\<aa>[cat_ss_cs_intros]:\n  assumes \"g = \\<aa>\\<^sub>S\\<^sub>S\" and \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n  using assms by auto\n\nlemma cat_scospan_composable_\\<bb>\\<bb>[cat_ss_cs_intros]:\n  assumes \"g = \\<bb>\\<^sub>S\\<^sub>S\" and \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n  using assms by auto\n\nlemma cat_scospan_composableE:\n  assumes \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n  obtains \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\" \n        | \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n        | \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n        | \"g = \\<gg>\\<^sub>S\\<^sub>S\" and \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n        | \"g = \\<ff>\\<^sub>S\\<^sub>S\" and \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n        | \"g = \\<aa>\\<^sub>S\\<^sub>S\" and \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n        | \"g = \\<bb>\\<^sub>S\\<^sub>S\" and \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  using assms that by auto\n\nlemma cat_sspan_composable_\\<oo>\\<oo>[cat_ss_cs_intros]:\n  assumes \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\"\n  using assms by auto\n\nlemma cat_sspan_composable_\\<gg>\\<oo>[cat_ss_cs_intros]:\n  assumes \"g = \\<gg>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\"\n  using assms by auto\n\nlemma cat_sspan_composable_\\<ff>\\<oo>[cat_ss_cs_intros]:\n  assumes \"g = \\<ff>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\"\n  using assms by auto\n\nlemma cat_sspan_composable_\\<aa>\\<gg>[cat_ss_cs_intros]:\n  assumes \"g = \\<aa>\\<^sub>S\\<^sub>S\" and \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\"\n  using assms by auto\n\nlemma cat_sspan_composable_\\<bb>\\<ff>[cat_ss_cs_intros]:\n  assumes \"g = \\<bb>\\<^sub>S\\<^sub>S\" and \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\"\n  using assms by auto\n\nlemma cat_sspan_composable_\\<aa>\\<aa>[cat_ss_cs_intros]:\n  assumes \"g = \\<aa>\\<^sub>S\\<^sub>S\" and \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\"\n  using assms by auto\n\nlemma cat_sspan_composable_\\<bb>\\<bb>[cat_ss_cs_intros]:\n  assumes \"g = \\<bb>\\<^sub>S\\<^sub>S\" and \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\"\n  using assms by auto\n\nlemma cat_sspan_composableE:\n  assumes \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\"\n  obtains \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\" \n        | \"g = \\<gg>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n        | \"g = \\<ff>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n        | \"g = \\<aa>\\<^sub>S\\<^sub>S\" and \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n        | \"g = \\<bb>\\<^sub>S\\<^sub>S\" and \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n        | \"g = \\<aa>\\<^sub>S\\<^sub>S\" and \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n        | \"g = \\<bb>\\<^sub>S\\<^sub>S\" and \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  using assms that by auto\n\n\n\nsubsection\\<open>Categories \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> and \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close>\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\n\ntext\\<open>See Chapter III-3 and Chapter III-4 in \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close>.\\<close>\n\ndefinition the_cat_scospan :: V (\\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<close>)\n  where \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C =\n    [\n      set {\\<aa>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S},\n      set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S},\n      (\n        \\<lambda>x\\<in>\\<^sub>\\<circ>set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S}. \n         if x = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | x = \\<gg>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<ff>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> \\<oo>\\<^sub>S\\<^sub>S\n      ),\n      (\n        \\<lambda>x\\<in>\\<^sub>\\<circ>set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S}. \n         if x = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> \\<oo>\\<^sub>S\\<^sub>S\n      ),\n      (\n        \\<lambda>gf\\<in>\\<^sub>\\<circ>cat_scospan_composable. \n         if gf = [\\<oo>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S]\\<^sub>\\<circ> \\<Rightarrow> \\<gg>\\<^sub>S\\<^sub>S\n          | gf = [\\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S]\\<^sub>\\<circ> \\<Rightarrow> \\<ff>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> gf\\<lparr>0\\<rparr>\n      ),\n      vid_on (set {\\<aa>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S})\n    ]\\<^sub>\\<circ>\"\n\ndefinition the_cat_sspan :: V (\\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<close>)\n  where \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C =\n    [\n      set {\\<aa>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S},\n      set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S},\n      (\n        \\<lambda>x\\<in>\\<^sub>\\<circ>set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S}. \n         if x = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> \\<oo>\\<^sub>S\\<^sub>S\n      ),\n      (\n        \\<lambda>x\\<in>\\<^sub>\\<circ>set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S}. \n         if x = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | x = \\<gg>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<ff>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> \\<oo>\\<^sub>S\\<^sub>S\n      ),\n      (\n        \\<lambda>gf\\<in>\\<^sub>\\<circ>cat_sspan_composable. \n         if gf = [\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S]\\<^sub>\\<circ> \\<Rightarrow> \\<gg>\\<^sub>S\\<^sub>S\n          | gf = [\\<bb>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S]\\<^sub>\\<circ> \\<Rightarrow> \\<ff>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> gf\\<lparr>0\\<rparr>\n      ),\n      vid_on (set {\\<aa>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S})\n    ]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma the_cat_scospan_components: \n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr> = set {\\<aa>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S}\"\n    and \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Arr\\<rparr> = set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S}\"\n    and \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr> = \n      (\n        \\<lambda>x\\<in>\\<^sub>\\<circ>set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S}. \n         if x = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | x = \\<gg>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<ff>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> \\<oo>\\<^sub>S\\<^sub>S\n      )\"\n    and \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr> = \n      (\n        \\<lambda>x\\<in>\\<^sub>\\<circ>set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S}. \n         if x = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> \\<oo>\\<^sub>S\\<^sub>S\n      )\"\n    and \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Comp\\<rparr> =\n      (\n        \\<lambda>gf\\<in>\\<^sub>\\<circ>cat_scospan_composable. \n         if gf = [\\<oo>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S]\\<^sub>\\<circ> \\<Rightarrow> \\<gg>\\<^sub>S\\<^sub>S\n          | gf = [\\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S]\\<^sub>\\<circ> \\<Rightarrow> \\<ff>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> gf\\<lparr>0\\<rparr>\n      )\"\n    and \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>CId\\<rparr> = vid_on (set {\\<aa>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S})\"\n  unfolding the_cat_scospan_def dg_field_simps by (simp_all add: nat_omega_simps)\n\nlemma the_cat_sspan_components: \n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Obj\\<rparr> = set {\\<aa>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S}\"\n    and \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Arr\\<rparr> = set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S}\"\n    and \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Dom\\<rparr> =\n      (\n        \\<lambda>x\\<in>\\<^sub>\\<circ>set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S}. \n         if x = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> \\<oo>\\<^sub>S\\<^sub>S\n      )\"\n    and \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Cod\\<rparr> =\n      (\n        \\<lambda>x\\<in>\\<^sub>\\<circ>set {\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S}. \n         if x = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | x = \\<gg>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\\<^sub>S\\<^sub>S\n          | x = \\<ff>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> \\<oo>\\<^sub>S\\<^sub>S\n      )\"\n    and \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Comp\\<rparr> =\n      (\n        \\<lambda>gf\\<in>\\<^sub>\\<circ>cat_sspan_composable. \n         if gf = [\\<aa>\\<^sub>S\\<^sub>S, \\<gg>\\<^sub>S\\<^sub>S]\\<^sub>\\<circ> \\<Rightarrow> \\<gg>\\<^sub>S\\<^sub>S\n          | gf = [\\<bb>\\<^sub>S\\<^sub>S, \\<ff>\\<^sub>S\\<^sub>S]\\<^sub>\\<circ> \\<Rightarrow> \\<ff>\\<^sub>S\\<^sub>S\n          | otherwise \\<Rightarrow> gf\\<lparr>0\\<rparr>\n      )\"\n    and \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>CId\\<rparr> = vid_on (set {\\<aa>\\<^sub>S\\<^sub>S, \\<bb>\\<^sub>S\\<^sub>S, \\<oo>\\<^sub>S\\<^sub>S})\"\n  unfolding the_cat_sspan_def dg_field_simps by (simp_all add: nat_omega_simps)\n\n\ntext\\<open>Elementary properties.\\<close>\n\nlemma the_cat_scospan_components_vsv[cat_ss_cs_intros]: \"vsv (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C)\"\n  unfolding the_cat_scospan_def by auto\n\nlemma the_cat_sspan_components_vsv[cat_ss_cs_intros]: \"vsv (\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C)\"\n  unfolding the_cat_sspan_def by auto\n\n\nsubsubsection\\<open>Objects\\<close>\n\nlemma the_cat_scospan_Obj_\\<oo>I[cat_ss_cs_intros]:\n  assumes \"a = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n  using assms unfolding the_cat_scospan_components by simp\n\nlemma the_cat_scospan_Obj_\\<aa>I[cat_ss_cs_intros]:\n  assumes \"a = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n  using assms unfolding the_cat_scospan_components by simp\n\nlemma the_cat_scospan_Obj_\\<bb>I[cat_ss_cs_intros]:\n  assumes \"a = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n  using assms unfolding the_cat_scospan_components by simp\n\nlemma the_cat_scospan_ObjE:\n  assumes \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n  obtains \\<open>a = \\<oo>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<aa>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<bb>\\<^sub>S\\<^sub>S\\<close>\n  using assms unfolding the_cat_scospan_components by auto\n\nlemma the_cat_sspan_Obj_\\<oo>I[cat_ss_cs_intros]:\n  assumes \"a = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n  using assms unfolding the_cat_sspan_components by simp\n\nlemma the_cat_sspan_Obj_\\<aa>I[cat_ss_cs_intros]:\n  assumes \"a = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n  using assms unfolding the_cat_sspan_components by simp\n\nlemma the_cat_sspan_Obj_\\<bb>I[cat_ss_cs_intros]:\n  assumes \"a = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n  using assms unfolding the_cat_sspan_components by simp\n\nlemma the_cat_sspan_ObjE:\n  assumes \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n  obtains \\<open>a = \\<oo>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<aa>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<bb>\\<^sub>S\\<^sub>S\\<close>\n  using assms unfolding the_cat_sspan_components by auto\n\n\nsubsubsection\\<open>Arrows\\<close>\n\nlemma the_cat_scospan_Arr_\\<aa>I[cat_ss_cs_intros]:\n  assumes \"a = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  using assms unfolding the_cat_scospan_components by simp\n\nlemma the_cat_scospan_Arr_\\<bb>I[cat_ss_cs_intros]:\n  assumes \"a = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  using assms unfolding the_cat_scospan_components by simp\n\nlemma the_cat_scospan_Arr_\\<oo>I[cat_ss_cs_intros]:\n  assumes \"a = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  using assms unfolding the_cat_scospan_components by simp\n\nlemma the_cat_scospan_Arr_\\<gg>I[cat_ss_cs_intros]:\n  assumes \"a = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  using assms unfolding the_cat_scospan_components by simp\n\nlemma the_cat_scospan_Arr_\\<ff>I[cat_ss_cs_intros]:\n  assumes \"a = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  using assms unfolding the_cat_scospan_components by simp\n\nlemma the_cat_scospan_ArrE:\n  assumes \"f \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  obtains \\<open>f = \\<aa>\\<^sub>S\\<^sub>S\\<close> | \\<open>f = \\<bb>\\<^sub>S\\<^sub>S\\<close> | \\<open>f = \\<oo>\\<^sub>S\\<^sub>S\\<close> | \\<open>f = \\<gg>\\<^sub>S\\<^sub>S\\<close> | \\<open>f = \\<ff>\\<^sub>S\\<^sub>S\\<close> \n  using assms unfolding the_cat_scospan_components by auto\n\nlemma the_cat_sspan_Arr_\\<aa>I[cat_ss_cs_intros]:\n  assumes \"a = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  using assms unfolding the_cat_sspan_components by simp\n\nlemma the_cat_sspan_Arr_\\<bb>I[cat_ss_cs_intros]:\n  assumes \"a = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  using assms unfolding the_cat_sspan_components by simp\n\nlemma the_cat_sspan_Arr_\\<oo>I[cat_ss_cs_intros]:\n  assumes \"a = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  using assms unfolding the_cat_sspan_components by simp\n\nlemma the_cat_sspan_Arr_\\<gg>I[cat_ss_cs_intros]:\n  assumes \"a = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  using assms unfolding the_cat_sspan_components by simp\n\nlemma the_cat_sspan_Arr_\\<ff>I[cat_ss_cs_intros]:\n  assumes \"a = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  using assms unfolding the_cat_sspan_components by simp\n\nlemma the_cat_sspan_ArrE:\n  assumes \"f \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  obtains \\<open>f = \\<aa>\\<^sub>S\\<^sub>S\\<close> | \\<open>f = \\<bb>\\<^sub>S\\<^sub>S\\<close> | \\<open>f = \\<oo>\\<^sub>S\\<^sub>S\\<close> | \\<open>f = \\<gg>\\<^sub>S\\<^sub>S\\<close> | \\<open>f = \\<ff>\\<^sub>S\\<^sub>S\\<close> \n  using assms unfolding the_cat_sspan_components by auto\n\n\nsubsubsection\\<open>Domain\\<close>\n\nmk_VLambda the_cat_scospan_components(3)\n  |vsv the_cat_scospan_Dom_vsv[cat_ss_cs_intros]|\n  |vdomain the_cat_scospan_Dom_vdomain[cat_ss_cs_simps]|\n\nlemma the_cat_scospan_Dom_app_\\<aa>[cat_ss_cs_simps]:\n  assumes \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>f\\<rparr> = \\<aa>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_scospan_components assms by simp\n\nlemma the_cat_scospan_Dom_app_\\<bb>[cat_ss_cs_simps]:\n  assumes \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>f\\<rparr> = \\<bb>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_scospan_components assms by simp\n\nlemma the_cat_scospan_Dom_app_\\<oo>[cat_ss_cs_simps]:\n  assumes \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>f\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_scospan_components assms using cat_ss_ineq by auto\n\nlemma the_cat_scospan_Dom_app_\\<gg>[cat_ss_cs_simps]:\n  assumes \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>f\\<rparr> = \\<aa>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_scospan_components assms using cat_ss_ineq by auto\n\nlemma the_cat_scospan_Dom_app_\\<ff>[cat_ss_cs_simps]:\n  assumes \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>f\\<rparr> = \\<bb>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_scospan_components assms using cat_ss_ineq by auto\n\nmk_VLambda the_cat_sspan_components(3)\n  |vsv the_cat_sspan_Dom_vsv[cat_ss_cs_intros]|\n  |vdomain the_cat_sspan_Dom_vdomain[cat_ss_cs_simps]|\n\nlemma the_cat_sspan_Dom_app_\\<aa>[cat_ss_cs_simps]:\n  assumes \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>f\\<rparr> = \\<aa>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_sspan_components assms by simp\n\nlemma the_cat_sspan_Dom_app_\\<bb>[cat_ss_cs_simps]:\n  assumes \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>f\\<rparr> = \\<bb>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_sspan_components assms by simp\n\nlemma the_cat_sspan_Dom_app_\\<oo>[cat_ss_cs_simps]:\n  assumes \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>f\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_sspan_components assms using cat_ss_ineq by auto\n\nlemma the_cat_sspan_Dom_app_\\<gg>[cat_ss_cs_simps]:\n  assumes \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>f\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_sspan_components assms using cat_ss_ineq by auto\n\nlemma the_cat_sspan_Dom_app_\\<ff>[cat_ss_cs_simps]:\n  assumes \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>f\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_sspan_components assms using cat_ss_ineq by auto\n\n\nsubsubsection\\<open>Codomain\\<close>\n\nmk_VLambda the_cat_scospan_components(4)\n  |vsv the_cat_scospan_Cod_vsv[cat_ss_cs_intros]|\n  |vdomain the_cat_scospan_Cod_vdomain[cat_ss_cs_simps]|\n\nlemma the_cat_scospan_Cod_app_\\<aa>[cat_ss_cs_simps]:\n  assumes \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>f\\<rparr> = \\<aa>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_scospan_components assms by simp\n\nlemma the_cat_scospan_Cod_app_\\<bb>[cat_ss_cs_simps]:\n  assumes \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>f\\<rparr> = \\<bb>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_scospan_components assms by simp\n\nlemma the_cat_scospan_Cod_app_\\<oo>[cat_ss_cs_simps]:\n  assumes \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>f\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_scospan_components assms using cat_ss_ineq by auto\n\nlemma the_cat_scospan_Cod_app_\\<gg>[cat_ss_cs_simps]:\n  assumes \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>f\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_scospan_components assms using cat_ss_ineq by auto\n\nlemma the_cat_scospan_Cod_app_\\<ff>[cat_ss_cs_simps]:\n  assumes \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>f\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_scospan_components assms using cat_ss_ineq by auto\n\nmk_VLambda the_cat_sspan_components(4)\n  |vsv the_cat_sspan_Cod_vsv[cat_ss_cs_intros]|\n  |vdomain the_cat_sspan_Cod_vdomain[cat_ss_cs_simps]|\n\nlemma the_cat_sspan_Cod_app_\\<aa>[cat_ss_cs_simps]:\n  assumes \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>f\\<rparr> = \\<aa>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_sspan_components assms by simp\n\nlemma the_cat_sspan_Cod_app_\\<bb>[cat_ss_cs_simps]:\n  assumes \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>f\\<rparr> = \\<bb>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_sspan_components assms by simp\n\nlemma the_cat_sspan_Cod_app_\\<oo>[cat_ss_cs_simps]:\n  assumes \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>f\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_sspan_components assms using cat_ss_ineq by auto\n\nlemma the_cat_sspan_Cod_app_\\<gg>[cat_ss_cs_simps]:\n  assumes \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>f\\<rparr> = \\<aa>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_sspan_components assms using cat_ss_ineq by auto\n\nlemma the_cat_sspan_Cod_app_\\<ff>[cat_ss_cs_simps]:\n  assumes \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>f\\<rparr> = \\<bb>\\<^sub>S\\<^sub>S\"\n  unfolding the_cat_sspan_components assms using cat_ss_ineq by auto\n\n\nsubsubsection\\<open>Composition\\<close>\n\nmk_VLambda the_cat_scospan_components(5)\n  |vsv the_cat_scospan_Comp_vsv[cat_ss_cs_intros]|\n  |vdomain the_cat_scospan_Comp_vdomain[cat_ss_cs_simps]|\n\nlemma the_cat_scospan_Comp_app_\\<aa>\\<aa>[cat_ss_cs_simps]:\n  assumes \"g = \\<aa>\\<^sub>S\\<^sub>S\" and \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\"\nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\" by auto\n  with assms show \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\"\n    unfolding the_cat_scospan_components(5) by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_scospan_Comp_app_\\<bb>\\<bb>[cat_ss_cs_simps]:\n  assumes \"g = \\<bb>\\<^sub>S\\<^sub>S\" and \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\"\nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\" by auto\n  with assms show \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\"\n    unfolding the_cat_scospan_components(5) by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_scospan_Comp_app_\\<oo>\\<oo>[cat_ss_cs_simps]:\n  assumes \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\"\nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\" by auto\n  with assms show \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\"\n    unfolding the_cat_scospan_components(5) by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_scospan_Comp_app_\\<oo>\\<gg>[cat_ss_cs_simps]:\n  assumes \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\" \nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\" by auto\n  then show \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\" \n    unfolding the_cat_scospan_components(5) assms by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_scospan_Comp_app_\\<oo>\\<ff>[cat_ss_cs_simps]:\n  assumes \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\" \nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\" by auto\n  then show \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\" \n    unfolding the_cat_scospan_components(5) assms by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_scospan_Comp_app_\\<gg>\\<aa>[cat_ss_cs_simps]:\n  assumes \"g = \\<gg>\\<^sub>S\\<^sub>S\" and \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = g\"  \nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\" by auto\n  then show \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = g\" \n    unfolding the_cat_scospan_components(5) assms \n    using cat_ss_ineq\n    by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_scospan_Comp_app_\\<ff>\\<bb>[cat_ss_cs_simps]:\n  assumes \"g = \\<ff>\\<^sub>S\\<^sub>S\" and \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = g\"  \nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\" by auto\n  then show \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = g\" \n    unfolding the_cat_scospan_components(5) assms \n    using cat_ss_ineq\n    by (auto simp: nat_omega_simps)\nqed\n\nmk_VLambda the_cat_sspan_components(5)\n  |vsv the_cat_sspan_Comp_vsv[cat_ss_cs_intros]|\n  |vdomain the_cat_sspan_Comp_vdomain[cat_ss_cs_simps]|\n\nlemma the_cat_sspan_Comp_app_\\<aa>\\<aa>[cat_ss_cs_simps]:\n  assumes \"g = \\<aa>\\<^sub>S\\<^sub>S\" and \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f\"\nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\" by auto\n  with assms show \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f\"\n    unfolding the_cat_sspan_components(5) by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_sspan_Comp_app_\\<bb>\\<bb>[cat_ss_cs_simps]:\n  assumes \"g = \\<bb>\\<^sub>S\\<^sub>S\" and \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f\"\nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\" by auto\n  with assms show \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f\"\n    unfolding the_cat_sspan_components(5) by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_sspan_Comp_app_\\<oo>\\<oo>[cat_ss_cs_simps]:\n  assumes \"g = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f\"\nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\" by auto\n  with assms show \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = g\" \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f\"\n    unfolding the_cat_sspan_components(5) by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_sspan_Comp_app_\\<aa>\\<gg>[cat_ss_cs_simps]:\n  assumes \"g = \\<aa>\\<^sub>S\\<^sub>S\" and \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f\" \nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\" by auto\n  then show \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f\" \n    unfolding the_cat_sspan_components(5) assms by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_sspan_Comp_app_\\<bb>\\<ff>[cat_ss_cs_simps]:\n  assumes \"g = \\<bb>\\<^sub>S\\<^sub>S\" and \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f\" \nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\" by auto\n  then show \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f\" \n    unfolding the_cat_sspan_components(5) assms by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_sspan_Comp_app_\\<gg>\\<oo>[cat_ss_cs_simps]:\n  assumes \"g = \\<gg>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = g\"  \nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\" by auto\n  then show \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = g\" \n    unfolding the_cat_sspan_components(5) assms \n    using cat_ss_ineq\n    by (auto simp: nat_omega_simps)\nqed\n\nlemma the_cat_sspan_Comp_app_\\<ff>\\<oo>[cat_ss_cs_simps]:\n  assumes \"g = \\<ff>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = g\"  \nproof-\n  from assms have \"[g, f]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_sspan_composable\" by auto\n  then show \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = g\" \n    unfolding the_cat_sspan_components(5) assms \n    using cat_ss_ineq\n    by (auto simp: nat_omega_simps)\nqed\n\n\nsubsubsection\\<open>Identity\\<close>\n\nmk_VLambda the_cat_scospan_components(6)[folded VLambda_vid_on]\n  |vsv the_cat_scospan_CId_vsv[cat_ss_cs_intros]|\n  |vdomain the_cat_scospan_CId_vdomain[cat_ss_cs_simps]|\n  |app the_cat_scospan_CId_app[cat_ss_cs_simps]|\n\nmk_VLambda the_cat_sspan_components(6)[folded VLambda_vid_on]\n  |vsv the_cat_sspan_CId_vsv[cat_ss_cs_intros]|\n  |vdomain the_cat_sspan_CId_vdomain[cat_ss_cs_simps]|\n  |app the_cat_sspan_CId_app[cat_ss_cs_simps]|\n\n\nsubsubsection\\<open>Arrow with a domain and a codomain\\<close>\n\nlemma the_cat_scospan_is_arr_\\<aa>\\<aa>\\<aa>[cat_ss_cs_intros]:\n  assumes \"a' = \\<aa>\\<^sub>S\\<^sub>S\" and \"b' = \\<aa>\\<^sub>S\\<^sub>S\" and \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"f : a' \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b'\"\nproof(intro is_arrI, unfold assms)\n  show \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>\\<aa>\\<^sub>S\\<^sub>S\\<rparr> = \\<aa>\\<^sub>S\\<^sub>S\" \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>\\<aa>\\<^sub>S\\<^sub>S\\<rparr> = \\<aa>\\<^sub>S\\<^sub>S\"\n    by (cs_concl cs_simp: cat_ss_cs_simps)+\nqed (auto simp: the_cat_scospan_components)\n\nlemma the_cat_scospan_is_arr_\\<bb>\\<bb>\\<bb>[cat_ss_cs_intros]:\n  assumes \"a' = \\<bb>\\<^sub>S\\<^sub>S\" and \"b' = \\<bb>\\<^sub>S\\<^sub>S\" and \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"f : a' \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b'\"\nproof(intro is_arrI, unfold assms)\n  show \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>\\<bb>\\<^sub>S\\<^sub>S\\<rparr> = \\<bb>\\<^sub>S\\<^sub>S\" \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>\\<bb>\\<^sub>S\\<^sub>S\\<rparr> = \\<bb>\\<^sub>S\\<^sub>S\"\n    by (cs_concl cs_simp: cat_ss_cs_simps)+\nqed (auto simp: the_cat_scospan_components)\n\nlemma the_cat_scospan_is_arr_\\<oo>\\<oo>\\<oo>[cat_ss_cs_intros]:\n  assumes \"a' = \\<oo>\\<^sub>S\\<^sub>S\" and \"b' = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"f : a' \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b'\"\nproof(intro is_arrI, unfold assms)\n  show \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>\\<oo>\\<^sub>S\\<^sub>S\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\" \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>\\<oo>\\<^sub>S\\<^sub>S\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n    by (cs_concl cs_simp: cat_ss_cs_simps)+\nqed (auto simp: the_cat_scospan_components)\n\nlemma the_cat_scospan_is_arr_\\<aa>\\<oo>\\<gg>[cat_ss_cs_intros]:\n  assumes \"a' = \\<aa>\\<^sub>S\\<^sub>S\" and \"b' = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"f : a' \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b'\"\nproof(intro is_arrI, unfold assms)\n  show \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>\\<gg>\\<^sub>S\\<^sub>S\\<rparr> = \\<aa>\\<^sub>S\\<^sub>S\" \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>\\<gg>\\<^sub>S\\<^sub>S\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n    by (cs_concl cs_simp: cat_ss_cs_simps)+\nqed (auto simp: the_cat_scospan_components)\n\nlemma the_cat_scospan_is_arr_\\<bb>\\<oo>\\<ff>[cat_ss_cs_intros]:\n  assumes \"a' = \\<bb>\\<^sub>S\\<^sub>S\" and \"b' = \\<oo>\\<^sub>S\\<^sub>S\" and \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"f : a' \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b'\"\nproof(intro is_arrI, unfold assms)\n  show \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>\\<lparr>\\<ff>\\<^sub>S\\<^sub>S\\<rparr> = \\<bb>\\<^sub>S\\<^sub>S\" \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>\\<lparr>\\<ff>\\<^sub>S\\<^sub>S\\<rparr> = \\<oo>\\<^sub>S\\<^sub>S\"\n    by (cs_concl cs_shallow cs_simp: cat_ss_cs_simps)+\nqed (auto simp: the_cat_scospan_components)\n\nlemma the_cat_scospan_is_arrE:\n  assumes \"f' : a' \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b'\"\n  obtains \"a' = \\<aa>\\<^sub>S\\<^sub>S\" and \"b' = \\<aa>\\<^sub>S\\<^sub>S\" and \"f' = \\<aa>\\<^sub>S\\<^sub>S\"\n        | \"a' = \\<bb>\\<^sub>S\\<^sub>S\" and \"b' = \\<bb>\\<^sub>S\\<^sub>S\" and \"f' = \\<bb>\\<^sub>S\\<^sub>S\"\n        | \"a' = \\<oo>\\<^sub>S\\<^sub>S\" and \"b' = \\<oo>\\<^sub>S\\<^sub>S\" and \"f' = \\<oo>\\<^sub>S\\<^sub>S\"\n        | \"a' = \\<aa>\\<^sub>S\\<^sub>S\" and \"b' = \\<oo>\\<^sub>S\\<^sub>S\" and \"f' = \\<gg>\\<^sub>S\\<^sub>S\"\n        | \"a' = \\<bb>\\<^sub>S\\<^sub>S\" and \"b' = \\<oo>\\<^sub>S\\<^sub>S\" and \"f' = \\<ff>\\<^sub>S\\<^sub>S\"\nproof-\n  note f = is_arrD[OF assms]\n  from f(1) consider (\\<aa>\\<^sub>S\\<^sub>S) \\<open>f' = \\<aa>\\<^sub>S\\<^sub>S\\<close> \n                   | (\\<bb>\\<^sub>S\\<^sub>S) \\<open>f' = \\<bb>\\<^sub>S\\<^sub>S\\<close> \n                   | (\\<oo>\\<^sub>S\\<^sub>S) \\<open>f' = \\<oo>\\<^sub>S\\<^sub>S\\<close> \n                   | (\\<gg>\\<^sub>S\\<^sub>S) \\<open>f' = \\<gg>\\<^sub>S\\<^sub>S\\<close> \n                   | (\\<ff>\\<^sub>S\\<^sub>S) \\<open>f' = \\<ff>\\<^sub>S\\<^sub>S\\<close> \n    by (elim the_cat_scospan_ArrE)\n  then show ?thesis\n  proof cases\n    case \\<aa>\\<^sub>S\\<^sub>S\n    moreover from f(2,3)[unfolded \\<aa>\\<^sub>S\\<^sub>S, symmetric] have \"a' = \\<aa>\\<^sub>S\\<^sub>S\" \"b' = \\<aa>\\<^sub>S\\<^sub>S\"\n      by (simp_all add: cat_ss_cs_simps)\n    ultimately show ?thesis using that by auto\n  next\n    case \\<bb>\\<^sub>S\\<^sub>S\n    moreover from f(2,3)[unfolded \\<bb>\\<^sub>S\\<^sub>S, symmetric] have \"a' = \\<bb>\\<^sub>S\\<^sub>S\" \"b' = \\<bb>\\<^sub>S\\<^sub>S\"\n      by (simp_all add: cat_ss_cs_simps)\n    ultimately show ?thesis using that by auto\n  next\n    case \\<oo>\\<^sub>S\\<^sub>S\n    moreover from f(2,3)[unfolded \\<oo>\\<^sub>S\\<^sub>S, symmetric] have \"a' = \\<oo>\\<^sub>S\\<^sub>S\" \"b' = \\<oo>\\<^sub>S\\<^sub>S\"\n      by (simp_all add: cat_ss_cs_simps)\n    ultimately show ?thesis using that by auto\n  next\n    case \\<gg>\\<^sub>S\\<^sub>S\n    moreover have \"a' = \\<aa>\\<^sub>S\\<^sub>S\" \"b' = \\<oo>\\<^sub>S\\<^sub>S\"\n      by (simp_all add: f(2,3)[unfolded \\<gg>\\<^sub>S\\<^sub>S, symmetric] cat_ss_cs_simps)\n    ultimately show ?thesis using that by auto\n  next\n    case \\<ff>\\<^sub>S\\<^sub>S\n    moreover have \"a' = \\<bb>\\<^sub>S\\<^sub>S\" \"b' = \\<oo>\\<^sub>S\\<^sub>S\"\n      by (simp_all add: f(2,3)[unfolded \\<ff>\\<^sub>S\\<^sub>S, symmetric] cat_ss_cs_simps)\n    ultimately show ?thesis using that by auto\n  qed\nqed\n\n\nsubsubsection\\<open>\\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> is a finite category\\<close>\n\nlemma (in \\<Z>) finite_category_the_cat_scospan[cat_ss_cs_intros]:\n  \"finite_category \\<alpha> (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C)\"\nproof(intro finite_categoryI'' tiny_categoryI'')\n  show \"vfsequence (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C)\" unfolding the_cat_scospan_def by simp\n  show \"vcard (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C) = 6\\<^sub>\\<nat>\"\n    unfolding the_cat_scospan_def by (simp_all add: nat_omega_simps)\n  show \"\\<R>\\<^sub>\\<circ> (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Dom\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\" by (auto simp: the_cat_scospan_components)\n  show \"\\<R>\\<^sub>\\<circ> (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Cod\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\" by (auto simp: the_cat_scospan_components)\n  show \"(gf \\<in>\\<^sub>\\<circ> \\<D>\\<^sub>\\<circ> (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Comp\\<rparr>)) =\n    (\\<exists>g f b c a. gf = [g, f]\\<^sub>\\<circ> \\<and> g : b \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> c \\<and> f : a \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b)\"\n    for gf\n    unfolding the_cat_scospan_Comp_vdomain\n  proof\n    assume prems: \"gf \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n    then obtain g f where gf_def: \"gf = [g, f]\\<^sub>\\<circ>\" by auto\n    from prems show \n      \"\\<exists>g f b c a. gf = [g, f]\\<^sub>\\<circ> \\<and> g : b \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> c \\<and> f : a \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b\"\n      unfolding gf_def\n      by (*slow*)\n        (\n          cases rule: cat_scospan_composableE; \n          (intro exI conjI)?; \n          cs_concl_step?;\n          (simp only:)?,\n          all\\<open>intro is_arrI, unfold the_cat_scospan_components(2)\\<close>\n        )\n        (cs_concl cs_simp: cat_ss_cs_simps V_cs_simps cs_intro: V_cs_intros)+\n  next\n    assume prems: \n      \"\\<exists>g f b' c' a'. gf = [g, f]\\<^sub>\\<circ> \\<and> g : b' \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> c' \\<and> f : a' \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b'\"\n    then obtain g f b c a\n      where gf_def: \"gf = [g, f]\\<^sub>\\<circ>\"\n        and g: \"g : b \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> c\"\n        and f: \"f : a \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b\"\n      by clarsimp\n    from g f show \"gf \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n      unfolding gf_def \n      by (elim the_cat_scospan_is_arrE) (auto simp: cat_ss_cs_intros)\n  qed\n  show \"\\<D>\\<^sub>\\<circ> (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>CId\\<rparr>) = \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n    by (simp add: cat_ss_cs_simps the_cat_scospan_components)\n  show \"g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f : a \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> c\"\n    if \"g : b \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> c\" and \"f : a \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b\" for b c g a f\n    using that\n    by (elim the_cat_scospan_is_arrE; simp only:)\n      (\n        all\\<open>\n          solves\\<open>simp add: cat_ss_ineq cat_ss_ineq[symmetric]\\<close> |\n          cs_concl cs_simp: cat_ss_cs_simps cs_intro: cat_ss_cs_intros\n        \\<close>\n      )\n  show \"h \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = h \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> (g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f)\"\n    if \"h : c \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> d\" and \"g : b \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> c\" and \"f : a \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b\"\n    for c d h b g a f\n    using that \n    by (elim the_cat_scospan_is_arrE; simp only:) (*slow*)\n      (\n        all\\<open>\n          solves\\<open>simp only: cat_ss_ineq cat_ss_ineq[symmetric]\\<close> | \n          cs_concl cs_simp: cat_ss_cs_simps cs_intro: cat_ss_cs_intros\n          \\<close>\n      )\n  show \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>CId\\<rparr>\\<lparr>a\\<rparr> : a \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> a\" if \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\" for a\n    using that\n    by (elim the_cat_scospan_ObjE) \n      (\n        all\\<open>\n          cs_concl \n            cs_simp: V_cs_simps cat_ss_cs_simps\n            cs_intro: V_cs_intros cat_ss_cs_intros\n        \\<close>\n      )\n  show \"\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>CId\\<rparr>\\<lparr>b\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f = f\" if \"f : a \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b\" for a b f\n    using that \n    by (elim the_cat_scospan_is_arrE) (*slow*)\n      (\n        cs_concl \n          cs_simp: V_cs_simps cat_ss_cs_simps \n          cs_intro: V_cs_intros cat_ss_cs_intros\n      )+\n  show \"f \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>CId\\<rparr>\\<lparr>b\\<rparr> = f\" if \"f : b \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> c\" for b c f\n    using that \n    by (elim the_cat_scospan_is_arrE)\n      (\n        cs_concl \n          cs_simp: V_cs_simps cat_ss_cs_simps \n          cs_intro: V_cs_intros cat_ss_cs_intros\n      )+\nqed \n  (\n    cs_concl \n      cs_simp: V_cs_simps cat_ss_cs_simps the_cat_scospan_components(1,2) \n      cs_intro: cat_cs_intros cat_ss_cs_intros V_cs_intros \n  )+\n\nlemmas [cat_ss_cs_intros] = \\<Z>.finite_category_the_cat_scospan\n\n\nsubsubsection\\<open>Duality for \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> and \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close>\\<close>\n\nlemma the_cat_scospan_op[cat_op_simps]: \"op_cat (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C) = \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\"\nproof-\n  have dom_lhs: \"\\<D>\\<^sub>\\<circ> (op_cat (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C)) = 6\\<^sub>\\<nat>\" \n    unfolding op_cat_def by (simp add: nat_omega_simps)\n  have dom_rhs: \"\\<D>\\<^sub>\\<circ> (\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C) = 6\\<^sub>\\<nat>\" \n    unfolding the_cat_sspan_def by (simp add: nat_omega_simps)\n  show ?thesis\n  proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n    show \"a \\<in>\\<^sub>\\<circ> 6\\<^sub>\\<nat> \\<Longrightarrow> op_cat (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C)\\<lparr>a\\<rparr> = \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>a\\<rparr>\" for a\n    proof\n      (\n        elim_in_numeral,\n        fold dg_field_simps,\n        unfold op_cat_components;\n        rule sym\n      )\n      show \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Comp\\<rparr> = fflip (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Comp\\<rparr>)\"\n      proof(rule vsv_eqI, unfold cat_ss_cs_simps vdomain_fflip)\n        fix gf assume prems: \"gf \\<in>\\<^sub>\\<circ> cat_sspan_composable\"\n        then obtain g f where gf_def: \"gf = [g, f]\\<^sub>\\<circ>\" by auto\n        from prems have fg: \"[f, g]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n          unfolding gf_def by auto\n        have [cat_ss_cs_simps]: \"g \\<circ>\\<^sub>A\\<^bsub>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<^esub> f = f \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> g\"\n          if \"[f, g]\\<^sub>\\<circ> \\<in>\\<^sub>\\<circ> cat_scospan_composable\"\n          using that\n          by (elim cat_scospan_composableE; simp only:)\n            (cs_concl cs_simp: cat_ss_cs_simps cs_intro: cat_ss_cs_intros)+\n        from fg show \n          \"\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Comp\\<rparr>\\<lparr>gf\\<rparr> = fflip (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Comp\\<rparr>)\\<lparr>gf\\<rparr>\"\n          unfolding gf_def \n          by (cs_concl cs_shallow cs_simp: cat_ss_cs_simps fflip_app)\n      qed (auto intro: fflip_vsv cat_ss_cs_intros)\n    qed (unfold the_cat_sspan_components the_cat_scospan_components, simp_all)\n  qed (auto intro: cat_op_intros cat_ss_cs_intros)\nqed\n\nlemma (in \\<Z>) the_cat_sspan_op[cat_op_simps]: \"op_cat (\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C) = \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\"\nproof-\n  interpret scospan: finite_category \\<alpha> \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<close> \n    by (rule finite_category_the_cat_scospan)\n  interpret sspan: finite_category \\<alpha> \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<close>\n    by (rule scospan.finite_category_op[unfolded cat_op_simps])\n  from the_cat_scospan_op have \"op_cat (\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C) = op_cat (op_cat (\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C))\" \n    by simp\n  also have \"\\<dots> = \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\" by (cs_concl cs_shallow cs_simp: cat_op_simps)\n  finally show ?thesis by auto\nqed\n\nlemmas [cat_op_simps] = \\<Z>.the_cat_sspan_op\n\n\nsubsubsection\\<open>\\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close> is a finite category\\<close>\n\nlemma (in \\<Z>) finite_category_the_cat_sspan[cat_ss_cs_intros]:\n  \"finite_category \\<alpha> (\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C)\"\nproof-\n  interpret scospan: finite_category \\<alpha> \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<close>\n    by (rule finite_category_the_cat_scospan)\n  show ?thesis by (rule scospan.finite_category_op[unfolded cat_op_simps])\nqed\n\n\nsubsection\\<open>Local assumptions for functors from \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> and \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close>\\<close>\n\n\ntext\\<open>\nThe functors from \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> and \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close> are introduced as\nconvenient abstractions for the definition of the \npullbacks and the pushouts (e.g., see Chapter III-3 and \nChapter III-4 in \\<^cite>\\<open>\"mac_lane_categories_2010\"\\<close>).\n\\<close>\n\n\nsubsubsection\\<open>Definitions and elementary properties\\<close>\n\nlocale cf_scospan = category \\<alpha> \\<CC> for \\<alpha> \\<aa> \\<gg> \\<oo> \\<ff> \\<bb> \\<CC> +\n  assumes cf_scospan_\\<gg>[cat_ss_cs_intros]: \"\\<gg> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<oo>\"\n    and cf_scospan_\\<ff>[cat_ss_cs_intros]: \"\\<ff> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<oo>\"\n\nlemma (in cf_scospan) cf_scospan_\\<gg>'[cat_ss_cs_intros]:\n  assumes \"a = \\<aa>\" and \"b = \\<oo>\"\n  shows \"\\<gg> : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\"\n  unfolding assms by (rule cf_scospan_\\<gg>)\n\nlemma (in cf_scospan) cf_scospan_\\<gg>''[cat_ss_cs_intros]:\n  assumes \"g = \\<gg>\" and \"b = \\<oo>\"\n  shows \"g : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\"\n  unfolding assms by (rule cf_scospan_\\<gg>) \n\nlemma (in cf_scospan) cf_scospan_\\<gg>'''[cat_ss_cs_intros]:\n  assumes \"g = \\<gg>\" and \"a = \\<aa>\"\n  shows \"g : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<oo>\"\n  unfolding assms by (rule cf_scospan_\\<gg>) \n\nlemma (in cf_scospan) cf_scospan_\\<ff>'[cat_ss_cs_intros]:\n  assumes \"a = \\<bb>\" and \"b = \\<oo>\"\n  shows \"\\<ff> : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\"\n  unfolding assms by (rule cf_scospan_\\<ff>) \n\nlemma (in cf_scospan) cf_scospan_\\<ff>''[cat_ss_cs_intros]:\n  assumes \"f = \\<ff>\" and \"b = \\<oo>\"\n  shows \"f : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\"\n  unfolding assms by (rule cf_scospan_\\<ff>) \n\nlemma (in cf_scospan) cf_scospan_\\<ff>'''[cat_ss_cs_intros]:\n  assumes \"g = \\<ff>\" and \"b = \\<bb>\"\n  shows \"g : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<oo>\"\n  unfolding assms by (rule cf_scospan_\\<ff>) \n\nlocale cf_sspan = category \\<alpha> \\<CC> for \\<alpha> \\<aa> \\<gg> \\<oo> \\<ff> \\<bb> and \\<CC> +\n  assumes cf_sspan_\\<gg>[cat_ss_cs_intros]: \"\\<gg> : \\<oo> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n    and cf_sspan_\\<ff>[cat_ss_cs_intros]: \"\\<ff> : \\<oo> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n\nlemma (in cf_sspan) cf_sspan_\\<gg>'[cat_ss_cs_intros]:\n  assumes \"a = \\<oo>\" and \"b = \\<aa>\"\n  shows \"\\<gg> : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\"\n  unfolding assms by (rule cf_sspan_\\<gg>) \n\nlemma (in cf_sspan) cf_sspan_\\<gg>''[cat_ss_cs_intros]:\n  assumes \"g = \\<gg>\" and \"a = \\<aa>\"\n  shows \"g : \\<oo> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> a\"\n  unfolding assms by (rule cf_sspan_\\<gg>) \n\nlemma (in cf_sspan) cf_sspan_\\<gg>'''[cat_ss_cs_intros]:\n  assumes \"g = \\<gg>\" and \"a = \\<oo>\"\n  shows \"g : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n  unfolding assms by (rule cf_sspan_\\<gg>) \n\nlemma (in cf_sspan) cf_sspan_\\<ff>'[cat_ss_cs_intros]:\n  assumes \"a = \\<oo>\" and \"b = \\<bb>\"\n  shows \"\\<ff> : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\"\n  unfolding assms by (rule cf_sspan_\\<ff>) \n\nlemma (in cf_sspan) cf_sspan_\\<ff>''[cat_ss_cs_intros]:\n  assumes \"f = \\<ff>\" and \"b = \\<bb>\"\n  shows \"f : \\<oo> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> b\"\n  unfolding assms by (rule cf_sspan_\\<ff>) \n\nlemma (in cf_sspan) cf_sspan_\\<ff>'''[cat_ss_cs_intros]:\n  assumes \"f = \\<ff>\" and \"b = \\<oo>\"\n  shows \"f : b \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n  unfolding assms by (rule cf_sspan_\\<ff>) \n\n\ntext\\<open>Rules.\\<close>\n\nlemmas (in cf_scospan) [cat_ss_cs_intros] = cf_scospan_axioms\n\nmk_ide rf cf_scospan_def[unfolded cf_scospan_axioms_def]\n  |intro cf_scospanI|\n  |dest cf_scospanD[dest]|\n  |elim cf_scospanE[elim]|\n\nlemmas [cat_ss_cs_intros] = cf_scospanD(1)\n\nlemmas (in cf_sspan) [cat_ss_cs_intros] = cf_sspan_axioms\n\nmk_ide rf cf_sspan_def[unfolded cf_sspan_axioms_def]\n  |intro cf_sspanI|\n  |dest cf_sspanD[dest]|\n  |elim cf_sspanE[elim]|\n\n\ntext\\<open>Duality.\\<close>\n\nlemma (in cf_scospan) cf_sspan_op[cat_op_intros]: \n  \"cf_sspan \\<alpha> \\<aa> \\<gg> \\<oo> \\<ff> \\<bb> (op_cat \\<CC>)\"\n  by (intro cf_sspanI, unfold cat_op_simps)\n    (cs_concl cs_intro: cat_cs_intros cat_op_intros cat_ss_cs_intros)+ \n\nlemmas [cat_op_intros] = cf_scospan.cf_sspan_op\n\nlemma (in cf_sspan) cf_scospan_op[cat_op_intros]: \n  \"cf_scospan \\<alpha> \\<aa> \\<gg> \\<oo> \\<ff> \\<bb> (op_cat \\<CC>)\"\n  by (intro cf_scospanI, unfold cat_op_simps)\n    (cs_concl cs_intro: cat_cs_intros cat_op_intros cat_ss_cs_intros)+ \n\nlemmas [cat_op_intros] = cf_sspan.cf_scospan_op\n\n\n\nsubsection\\<open>Functors from \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> and \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close>\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition the_cf_scospan :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V\" \n  (\\<open>\\<langle>_\\<rightarrow>_\\<rightarrow>_\\<leftarrow>_\\<leftarrow>_\\<rangle>\\<^sub>C\\<^sub>F\\<index>\\<close> [51, 51, 51, 51, 51] 999)\n  where \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub> =\n    [\n      (\n        \\<lambda>a\\<in>\\<^sub>\\<circ>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>.\n         if a = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\n          | a = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\n          | otherwise \\<Rightarrow> \\<oo>\n      ),\n      (\n        \\<lambda>f\\<in>\\<^sub>\\<circ>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Arr\\<rparr>.\n         if f = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<aa>\\<rparr>\n          | f = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<bb>\\<rparr>\n          | f = \\<gg>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<gg>\n          | f = \\<ff>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<ff>\n          | otherwise \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<oo>\\<rparr>\n      ),\n      \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C,\n      \\<CC>\n    ]\\<^sub>\\<circ>\"\n\ndefinition the_cf_sspan :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V\" \n  (\\<open>\\<langle>_\\<leftarrow>_\\<leftarrow>_\\<rightarrow>_\\<rightarrow>_\\<rangle>\\<^sub>C\\<^sub>F\\<index>\\<close> [51, 51, 51, 51, 51] 999)\n  where \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub> =\n    [\n      (\n        \\<lambda>a\\<in>\\<^sub>\\<circ>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Obj\\<rparr>.\n         if a = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\n          | a = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\n          | otherwise \\<Rightarrow> \\<oo>\n      ),\n      (\n        \\<lambda>f\\<in>\\<^sub>\\<circ>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Arr\\<rparr>.\n         if f = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<aa>\\<rparr>\n          | f = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<bb>\\<rparr>\n          | f = \\<gg>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<gg>\n          | f = \\<ff>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<ff>\n          | otherwise \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<oo>\\<rparr>\n      ),\n      \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C,\n      \\<CC>\n    ]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma the_cf_scospan_components:\n  shows \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr> =\n    (\n      \\<lambda>a\\<in>\\<^sub>\\<circ>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>.\n       if a = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\n        | a = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\n        | otherwise \\<Rightarrow> \\<oo>\n    )\"\n    and \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr> =\n      (\n        \\<lambda>f\\<in>\\<^sub>\\<circ>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Arr\\<rparr>.\n         if f = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<aa>\\<rparr>\n          | f = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<bb>\\<rparr>\n          | f = \\<gg>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<gg>\n          | f = \\<ff>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<ff>\n          | otherwise \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<oo>\\<rparr>\n      )\"\n    and [cat_ss_cs_simps]: \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>HomDom\\<rparr> = \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\"\n    and [cat_ss_cs_simps]: \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>HomCod\\<rparr> = \\<CC>\"\n  unfolding the_cf_scospan_def dghm_field_simps by (simp_all add: nat_omega_simps)\n\nlemma the_cf_sspan_components:\n  shows \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr> =\n    (\n      \\<lambda>a\\<in>\\<^sub>\\<circ>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Obj\\<rparr>.\n       if a = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<aa>\n        | a = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<bb>\n        | otherwise \\<Rightarrow> \\<oo>\n    )\"\n    and \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr> =\n      (\n        \\<lambda>f\\<in>\\<^sub>\\<circ>\\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Arr\\<rparr>.\n         if f = \\<aa>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<aa>\\<rparr>\n          | f = \\<bb>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<bb>\\<rparr>\n          | f = \\<gg>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<gg>\n          | f = \\<ff>\\<^sub>S\\<^sub>S \\<Rightarrow> \\<ff>\n          | otherwise \\<Rightarrow> \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<oo>\\<rparr>\n      )\"\n    and [cat_ss_cs_simps]: \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>HomDom\\<rparr> = \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\"\n    and [cat_ss_cs_simps]: \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>HomCod\\<rparr> = \\<CC>\"\n  unfolding the_cf_sspan_def dghm_field_simps \n  by (simp_all add: nat_omega_simps)\n\n\ntext\\<open>Elementary properties.\\<close>\n\nlemma the_cf_scospan_components_vsv[cat_ss_cs_intros]: \"vsv (\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>)\"\n  unfolding the_cf_scospan_def by auto\n\nlemma the_cf_sspan_components_vsv[cat_ss_cs_intros]: \"vsv (\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>)\"\n  unfolding the_cf_sspan_def by auto\n\n\nsubsubsection\\<open>Object map.\\<close>\n\nmk_VLambda the_cf_scospan_components(1)\n  |vsv the_cf_scospan_ObjMap_vsv[cat_ss_cs_intros]|\n  |vdomain the_cf_scospan_ObjMap_vdomain[cat_ss_cs_simps]|\n  |app the_cf_scospan_ObjMap_app|\n\nlemma the_cf_scospan_ObjMap_app_\\<aa>[cat_ss_cs_simps]:\n  assumes \"x = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>x\\<rparr> = \\<aa>\"\n  by \n    (\n      cs_concl \n        cs_simp: the_cf_scospan_ObjMap_app V_cs_simps assms\n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_scospan) the_cf_scospan_ObjMap_app_\\<bb>[cat_ss_cs_simps]:\n  assumes \"x = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>x\\<rparr> = \\<bb>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_scospan_ObjMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_scospan) the_cf_scospan_ObjMap_app_\\<oo>[cat_ss_cs_simps]:\n  assumes \"x = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>x\\<rparr> = \\<oo>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_scospan_ObjMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_scospan) the_cf_scospan_ObjMap_vrange:\n  \"\\<R>\\<^sub>\\<circ> (\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\nproof\n  (\n    intro vsv.vsv_vrange_vsubset, \n    unfold the_cf_scospan_ObjMap_vdomain, \n    intro the_cf_scospan_ObjMap_vsv\n  )\n  fix a assume \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n  then consider \\<open>a = \\<aa>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<bb>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<oo>\\<^sub>S\\<^sub>S\\<close> \n    unfolding the_cat_scospan_components by auto\n  then show \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    by cases \n      (\n        cs_concl \n          cs_simp: cat_ss_cs_simps cs_intro: cat_cs_intros cat_ss_cs_intros\n      )+\nqed\n\nmk_VLambda the_cf_sspan_components(1)\n  |vsv the_cf_sspan_ObjMap_vsv[cat_ss_cs_intros]|\n  |vdomain the_cf_sspan_ObjMap_vdomain[cat_ss_cs_simps]|\n  |app the_cf_sspan_ObjMap_app|\n\nlemma the_cf_sspan_ObjMap_app_\\<aa>[cat_ss_cs_simps]:\n  assumes \"x = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>x\\<rparr> = \\<aa>\"\n  by \n    (\n      cs_concl  \n        cs_simp: the_cf_sspan_ObjMap_app V_cs_simps assms\n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_sspan) the_cf_sspan_ObjMap_app_\\<bb>[cat_ss_cs_simps]:\n  assumes \"x = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>x\\<rparr> = \\<bb>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_sspan_ObjMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_sspan) the_cf_sspan_ObjMap_app_\\<oo>[cat_ss_cs_simps]:\n  assumes \"x = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>x\\<rparr> = \\<oo>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_sspan_ObjMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_sspan) the_cf_sspan_ObjMap_vrange:\n  \"\\<R>\\<^sub>\\<circ> (\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\nproof\n  (\n    intro vsv.vsv_vrange_vsubset, \n    unfold the_cf_sspan_ObjMap_vdomain, \n    intro the_cf_sspan_ObjMap_vsv\n  )\n  fix a assume \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\"\n  then consider \\<open>a = \\<aa>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<bb>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<oo>\\<^sub>S\\<^sub>S\\<close> \n    unfolding the_cat_sspan_components by auto\n  then show \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    by cases \n      (\n        cs_concl  \n          cs_simp: cat_ss_cs_simps cs_intro: cat_cs_intros cat_ss_cs_intros\n      )+\nqed\n\n\nsubsubsection\\<open>Arrow map.\\<close>\n\nmk_VLambda the_cf_scospan_components(2)\n  |vsv the_cf_scospan_ArrMap_vsv[cat_ss_cs_intros]|\n  |vdomain the_cf_scospan_ArrMap_vdomain[cat_ss_cs_simps]|\n  |app the_cf_scospan_ArrMap_app|\n\nlemma (in cf_scospan) the_cf_scospan_ArrMap_app_\\<oo>[cat_ss_cs_simps]:\n  assumes \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<oo>\\<rparr>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_scospan_ArrMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_scospan) the_cf_scospan_ArrMap_app_\\<aa>[cat_ss_cs_simps]:\n  assumes \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<aa>\\<rparr>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl\n        cs_simp: V_cs_simps the_cf_scospan_ArrMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_scospan) the_cf_scospan_ArrMap_app_\\<bb>[cat_ss_cs_simps]:\n  assumes \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<bb>\\<rparr>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_scospan_ArrMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_scospan) the_cf_scospan_ArrMap_app_\\<gg>[cat_ss_cs_simps]:\n  assumes \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = \\<gg>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl \n        cs_simp: V_cs_simps the_cf_scospan_ArrMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_scospan) the_cf_scospan_ArrMap_app_\\<ff>[cat_ss_cs_simps]:\n  assumes \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = \\<ff>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_scospan_ArrMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_scospan) the_cf_scospan_ArrMap_vrange:\n  \"\\<R>\\<^sub>\\<circ> (\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr>\"\nproof\n  (\n    intro vsv.vsv_vrange_vsubset, \n    unfold the_cf_scospan_ArrMap_vdomain, \n    intro the_cf_scospan_ArrMap_vsv\n  )\n  fix a assume \"a \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  then consider \\<open>a = \\<aa>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<bb>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<oo>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<gg>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<ff>\\<^sub>S\\<^sub>S\\<close> \n    unfolding the_cat_scospan_components by auto\n  then show \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>a\\<rparr> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr>\"\n    by cases \n      (\n        cs_concl  \n          cs_simp: cat_ss_cs_simps cs_intro: cat_cs_intros cat_ss_cs_intros\n      )+\nqed\n\nmk_VLambda the_cf_sspan_components(2)\n  |vsv the_cf_sspan_ArrMap_vsv[cat_ss_cs_intros]|\n  |vdomain the_cf_sspan_ArrMap_vdomain[cat_ss_cs_simps]|\n  |app the_cf_sspan_ArrMap_app|\n\nlemma (in cf_sspan) the_cf_sspan_ArrMap_app_\\<oo>[cat_ss_cs_simps]:\n  assumes \"f = \\<oo>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<oo>\\<rparr>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_sspan_ArrMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_sspan) the_cf_sspan_ArrMap_app_\\<aa>[cat_ss_cs_simps]:\n  assumes \"f = \\<aa>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<aa>\\<rparr>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl \n        cs_simp: V_cs_simps the_cf_sspan_ArrMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_sspan) the_cf_sspan_ArrMap_app_\\<bb>[cat_ss_cs_simps]:\n  assumes \"f = \\<bb>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<bb>\\<rparr>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_sspan_ArrMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_sspan) the_cf_sspan_ArrMap_app_\\<gg>[cat_ss_cs_simps]:\n  assumes \"f = \\<gg>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = \\<gg>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_sspan_ArrMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_sspan) the_cf_sspan_ArrMap_app_\\<ff>[cat_ss_cs_simps]:\n  assumes \"f = \\<ff>\\<^sub>S\\<^sub>S\"\n  shows \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> = \\<ff>\"\n  using cat_ss_ineq\n  by \n    (\n      cs_concl  \n        cs_simp: V_cs_simps the_cf_sspan_ArrMap_app assms \n        cs_intro: cat_ss_cs_intros\n    )\n\nlemma (in cf_sspan) the_cf_sspan_ArrMap_vrange:\n  \"\\<R>\\<^sub>\\<circ> (\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>) \\<subseteq>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr>\"\nproof\n  (\n    intro vsv.vsv_vrange_vsubset,\n    unfold the_cf_sspan_ArrMap_vdomain,\n    intro the_cf_sspan_ArrMap_vsv\n  )\n  fix a assume \"a \\<in>\\<^sub>\\<circ> \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\\<lparr>Arr\\<rparr>\"\n  then consider \\<open>a = \\<aa>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<bb>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<oo>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<gg>\\<^sub>S\\<^sub>S\\<close> | \\<open>a = \\<ff>\\<^sub>S\\<^sub>S\\<close> \n    unfolding the_cat_sspan_components by auto\n  then show \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>a\\<rparr> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Arr\\<rparr>\"\n    by cases\n      (\n        cs_concl \n          cs_simp: cat_ss_cs_simps cs_intro: cat_cs_intros cat_ss_cs_intros\n      )+\nqed\n\n\nsubsubsection\\<open>Functor from \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> is a functor\\<close>\n\nlemma (in cf_scospan) cf_scospan_the_cf_scospan_is_tm_functor:\n  \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub> : \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof(intro is_functor.cf_is_tm_functor_if_HomDom_finite_category is_functorI')\n  show \"vfsequence (\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>)\" \n    unfolding the_cf_scospan_def by auto\n  show \"vcard (\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>) = 4\\<^sub>\\<nat>\"\n    unfolding the_cf_scospan_def by (simp add: nat_omega_simps)\n  show \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr> :\n    \\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>a\\<rparr> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>b\\<rparr>\"\n    if \"f : a \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b\" for a b f\n    using that\n    by (cases rule: the_cat_scospan_is_arrE; simp only:)\n      (\n        cs_concl  \n          cs_simp: cat_ss_cs_simps cs_intro: cat_cs_intros cat_ss_cs_intros\n      )+\n  show \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>g \\<circ>\\<^sub>A\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> f\\<rparr> =\n    \\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>g\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>f\\<rparr>\"\n    if \"g : b \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> c\" and \"f : a \\<mapsto>\\<^bsub>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<^esub> b\" for b c g a f\n    using that\n    by (elim the_cat_scospan_is_arrE) (*very slow*)\n      (\n        all\\<open>simp only:\\<close>, \n        all\\<open>\n          solves\\<open>simp add: cat_ss_ineq cat_ss_ineq[symmetric]\\<close> | \n          cs_concl  \n            cs_simp: cat_cs_simps cat_ss_cs_simps \n            cs_intro: cat_cs_intros cat_ss_cs_intros\n          \\<close>\n      )\n  show \n    \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ArrMap\\<rparr>\\<lparr>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>CId\\<rparr>\\<lparr>c\\<rparr>\\<rparr> =\n      \\<CC>\\<lparr>CId\\<rparr>\\<lparr>\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>\\<lparr>ObjMap\\<rparr>\\<lparr>c\\<rparr>\\<rparr>\"\n    if \"c \\<in>\\<^sub>\\<circ> \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<lparr>Obj\\<rparr>\" for c\n    using that\n    by (elim the_cat_scospan_ObjE; simp only:)\n      (\n        cs_concl\n          cs_simp: V_cs_simps cat_ss_cs_simps \n          cs_intro: V_cs_intros cat_ss_cs_intros\n      )+\n\nqed\n  (\n    cs_concl \n      cs_simp: cat_ss_cs_simps\n      cs_intro: \n        the_cf_scospan_ObjMap_vrange\n        cat_ss_cs_intros cat_cs_intros cat_small_cs_intros\n  )+\n\nlemma (in cf_scospan) cf_scospan_the_cf_scospan_is_tm_functor':\n  assumes \"\\<AA>' = \\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\" and \"\\<CC>' = \\<CC>\"\n  shows \"\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub> : \\<AA>' \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>'\"\n  unfolding assms by (rule cf_scospan_the_cf_scospan_is_tm_functor)\n\nlemmas [cat_ss_cs_intros] = cf_scospan.cf_scospan_the_cf_scospan_is_tm_functor\n\n\nsubsubsection\\<open>Duality for the functors from \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<close> and \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close>\\<close>\n\nlemma op_cf_cf_scospan[cat_op_simps]: \n  \"op_cf (\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>) = \\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>op_cat \\<CC>\\<^esub>\"\nproof-\n  have dom_lhs: \"\\<D>\\<^sub>\\<circ> (op_cf (\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>)) = 4\\<^sub>\\<nat>\" \n    unfolding op_cf_def by (simp add: nat_omega_simps)\n  have dom_rhs: \"\\<D>\\<^sub>\\<circ> (\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>op_cat \\<CC>\\<^esub>) = 4\\<^sub>\\<nat>\" \n    unfolding the_cf_sspan_def by (simp add: nat_omega_simps)\n  show ?thesis\n  proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n    show \"op_cf (\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>)\\<lparr>a\\<rparr> = \\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>op_cat \\<CC>\\<^esub>\\<lparr>a\\<rparr>\"\n      if \"a \\<in>\\<^sub>\\<circ> 4\\<^sub>\\<nat>\" for a\n      using that\n      by \n        (\n          elim_in_numeral, \n          fold dghm_field_simps, \n          unfold cat_op_simps the_cf_sspan_components the_cf_scospan_components\n        )\n        (\n          simp_all add: \n            the_cat_scospan_components(1,2)\n            the_cat_sspan_components(1,2)\n            cat_op_simps\n        )\n  qed (auto intro: cat_op_intros cat_ss_cs_intros)\nqed\n\nlemma (in \\<Z>) op_cf_cf_scospan[cat_op_simps]: \n  \"op_cf (\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>) = \\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>op_cat \\<CC>\\<^esub>\"\nproof-\n  have dom_lhs: \"\\<D>\\<^sub>\\<circ> (op_cf (\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>)) = 4\\<^sub>\\<nat>\" \n    unfolding op_cf_def by (simp add: nat_omega_simps)\n  have dom_rhs: \"\\<D>\\<^sub>\\<circ> (\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>op_cat \\<CC>\\<^esub>) = 4\\<^sub>\\<nat>\" \n    unfolding the_cf_scospan_def by (simp add: nat_omega_simps)\n  show ?thesis\n  proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n    show \"op_cf (\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub>)\\<lparr>a\\<rparr> = \\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>op_cat \\<CC>\\<^esub>\\<lparr>a\\<rparr>\"\n      if \"a \\<in>\\<^sub>\\<circ> 4\\<^sub>\\<nat>\" for a\n      using that\n      by \n        (\n          elim_in_numeral, \n          fold dghm_field_simps, \n          unfold cat_op_simps the_cf_sspan_components the_cf_scospan_components\n        )\n        (\n          simp_all add: \n            the_cat_scospan_components(1,2)\n            the_cat_sspan_components(1,2)\n            cat_op_simps\n        )\n  qed (auto intro: cat_op_intros cat_ss_cs_intros)\nqed\n\nlemmas [cat_op_simps] = \\<Z>.op_cf_cf_scospan\n\n\nsubsubsection\\<open>Functor from \\<open>\\<leftarrow>\\<bullet>\\<rightarrow>\\<close> is a functor\\<close>\n\nlemma (in cf_sspan) cf_sspan_the_cf_sspan_is_tm_functor:\n  \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub> : \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof-\n  interpret scospan: cf_scospan \\<alpha> \\<aa> \\<gg> \\<oo> \\<ff> \\<bb> \\<open>op_cat \\<CC>\\<close> by (rule cf_scospan_op)\n  interpret scospan:\n    is_tm_functor \\<alpha> \\<open>\\<rightarrow>\\<bullet>\\<leftarrow>\\<^sub>C\\<close> \\<open>op_cat \\<CC>\\<close> \\<open>\\<langle>\\<aa>\\<rightarrow>\\<gg>\\<rightarrow>\\<oo>\\<leftarrow>\\<ff>\\<leftarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>op_cat \\<CC>\\<^esub>\\<close>\n    by (rule scospan.cf_scospan_the_cf_scospan_is_tm_functor)\n  show ?thesis by (rule scospan.is_tm_functor_op[unfolded cat_op_simps])\nqed\n\nlemma (in cf_sspan) cf_sspan_the_cf_sspan_is_tm_functor':\n  assumes \"\\<AA>' = \\<leftarrow>\\<bullet>\\<rightarrow>\\<^sub>C\" and \"\\<CC>' = \\<CC>\"\n  shows \"\\<langle>\\<aa>\\<leftarrow>\\<gg>\\<leftarrow>\\<oo>\\<rightarrow>\\<ff>\\<rightarrow>\\<bb>\\<rangle>\\<^sub>C\\<^sub>F\\<^bsub>\\<CC>\\<^esub> : \\<AA>' \\<mapsto>\\<mapsto>\\<^sub>C\\<^sub>.\\<^sub>t\\<^sub>m\\<^bsub>\\<alpha>\\<^esub> \\<CC>'\"\n  unfolding assms by (rule cf_sspan_the_cf_sspan_is_tm_functor)\n\nlemmas [cat_ss_cs_intros] = cf_sspan.cf_sspan_the_cf_sspan_is_tm_functor\n\ntext\\<open>\\newpage\\<close>\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Elementary_Categories/czh_ecategories/CZH_ECAT_SS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352403, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3137650671384206}}
{"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n *  Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Mult_NAND_NOR\n  imports VHDL_Hoare_Complete \nbegin\n\ntext \\<open>Define the new datatype for the all signals occurred in a multiplexer. A multiplexer has three\ninputs: in0, in1, and a selector.\\<close>\n\ndatatype sig = IN0 | IN1 | SEL | OUT | TEMP0 | TEMP1\n\nabbreviation mux2_seq :: \"sig seq_stmt\" where\n  \"mux2_seq \\<equiv> Bcomp\n              (Bassign_trans TEMP0 (Bnand (Bsig IN0) (Bsig IN1)) 1)\n              (Bcomp\n                (Bassign_trans TEMP1 (Bnor  (Bsig IN0) (Bsig IN1)) 1)\n                (Bguarded (Bsig SEL)\n                  (Bassign_trans OUT (Bsig TEMP0) 1)\n                  (Bassign_trans OUT (Bsig TEMP1) 1)))\"\n\n\\<comment> \\<open>We put suffix 2 because it only selects between two inputs\\<close>\ndefinition mux2 :: \"sig conc_stmt\" where\n  \"mux2 = process {IN0, IN1, SEL, TEMP0, TEMP1} : mux2_seq\"\n\nlemma potential_tyenv:\n  assumes \"seq_wt \\<Gamma> mux2_seq\"\n  shows \"\\<exists>ki len. \\<Gamma> IN0 = Bty \\<and> \\<Gamma> IN1 = Bty \\<and> \\<Gamma> SEL = Bty \\<and> \\<Gamma> OUT = Bty \\<and> \\<Gamma> TEMP0 = Bty \\<and> \\<Gamma> TEMP1 = Bty\n             \\<or> \\<Gamma> IN0 = Lty ki len \\<and> \\<Gamma> IN1 = Lty ki len \\<and> \\<Gamma> SEL = Bty \\<and> \\<Gamma> OUT = Lty ki len \\<and> \\<Gamma> TEMP0 = Lty ki len \\<and> \\<Gamma> TEMP1 = Lty ki len\"\n  apply (rule seq_wt_cases(2)[OF assms])\nproof  (erule seq_wt_cases)+\n  assume \"bexp_wt \\<Gamma> (Bsig SEL) Bty\"\n  assume \"bexp_wt \\<Gamma> (Bnand (Bsig IN0) (Bsig IN1)) (\\<Gamma> TEMP0)\"\n  hence \"\\<Gamma> IN0 = \\<Gamma> TEMP0 \\<and> \\<Gamma> IN1 = \\<Gamma> TEMP0\"\n    by (metis bexp_wt_cases(4) bexp_wt_cases_slice(2))\n  assume \"bexp_wt \\<Gamma> (Bsig TEMP0) (\\<Gamma> OUT) \"\n  hence \"\\<Gamma> TEMP0 = \\<Gamma> OUT\"\n    by (rule bexp_wt_cases_all) auto\n  assume \"bexp_wt \\<Gamma> (Bsig TEMP1) (\\<Gamma> OUT) \"\n  hence \"\\<Gamma> TEMP1 = \\<Gamma> OUT\"\n    by (rule bexp_wt_cases_all) auto\n  have \"\\<Gamma> SEL = Bty\"\n    by (rule bexp_wt_cases_all[OF \\<open>bexp_wt \\<Gamma> (Bsig SEL) Bty\\<close>]) auto\n  obtain ki len where \"\\<Gamma> OUT = Bty \\<or> \\<Gamma> OUT = Lty ki len\"\n    using ty.exhaust by meson\n  moreover\n  { assume \"\\<Gamma> OUT = Bty\"\n    hence \"\\<Gamma> TEMP0 = Bty\"\n      by (simp add: \\<open>\\<Gamma> TEMP0 = \\<Gamma> OUT\\<close>)\n    moreover have \"\\<Gamma> TEMP1 = Bty\"\n      using \\<open>\\<Gamma> TEMP1 = \\<Gamma> OUT\\<close> \\<open>\\<Gamma> OUT = Bty\\<close> by auto\n    ultimately have ?thesis\n      using \\<open>\\<Gamma> OUT = Bty\\<close> \\<open>\\<Gamma> SEL = Bty\\<close> \\<open>\\<Gamma> IN0 = \\<Gamma> TEMP0 \\<and> \\<Gamma> IN1 = \\<Gamma> TEMP0\\<close> by auto }\n  moreover\n  { assume \"\\<Gamma> OUT = Lty ki len\"\n    moreover hence \"\\<Gamma> TEMP0 = Lty ki len\" and \"\\<Gamma> TEMP1 = Lty ki len\"\n      using \\<open>\\<Gamma> TEMP0 = \\<Gamma> OUT\\<close> \\<open>\\<Gamma> TEMP1 = \\<Gamma> OUT\\<close> by auto\n    ultimately have ?thesis\n      using \\<open>\\<Gamma> SEL = Bty\\<close> \\<open>\\<Gamma> IN0 = \\<Gamma> TEMP0 \\<and> \\<Gamma> IN1 = \\<Gamma> TEMP0\\<close> by auto }\n  ultimately show ?thesis\n    by auto\nqed\n\nabbreviation \"bval_of_wline tw sig t \\<equiv> bval_of (wline_of tw sig t)\"\n\nlocale scalar_type = \n  fixes \\<Gamma> :: \"sig tyenv\"\n  assumes \"\\<Gamma> IN0 = Bty\" and \"seq_wt \\<Gamma> mux2_seq\"\nbegin\n\ndefinition mux2_inv :: \"sig assn2\" where\n  \"mux2_inv \\<equiv> \\<lambda>tw. (\\<forall>i < fst tw. (bval_of_wline tw OUT   (i + 1) = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i))\n                               \\<and> (bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i))\n                               \\<and> (bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i)))\"\n\ndefinition mux2_inv' :: \"sig assn2\" where\n  \"mux2_inv' \\<equiv> (\\<lambda>tw. disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of tw) \\<longrightarrow>\n                  (\\<forall>i\\<ge>fst tw. (bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL (fst tw) then bval_of_wline tw TEMP0 (fst tw)  else bval_of_wline tw TEMP1 (fst tw)))\n                            \\<and> (bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 (fst tw) \\<and> bval_of_wline tw IN1 (fst tw)))\n                            \\<and> (bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 (fst tw) \\<or> bval_of_wline tw IN1 (fst tw)))                             \n                  ))\"\n\nsubsection \\<open>Proving that the sequential component preserves @{term \"mux2_inv\"}\\<close>\n\nlemma nonneg_delay_mux2_seq:\n  \"nonneg_delay mux2_seq\" by auto\n\nlemma nonneg_delay_mux2_seq_next:\n  \"nonneg_delay  (Bcomp (Bassign_trans TEMP1 (Bnor (Bsig IN0) (Bsig IN1)) 1) \n                        (Bguarded (Bsig SEL) (Bassign_trans OUT (Bsig TEMP0) 1) (Bassign_trans OUT (Bsig TEMP1) 1)))\"\n  by auto\n\ntheorem mux2_seq_hoare_next_time:\n  \"\\<turnstile> [\\<lambda>tw. mux2_inv tw \\<and> wityping \\<Gamma> (snd tw)] \n        mux2_seq\n     [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. mux2_inv (j, snd tw)]\"\n  apply (rule Conseq2[where P= \"wp mux2_seq (\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. mux2_inv (j, snd tw))\" and \n                            Q= \"\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. mux2_inv (j, snd tw)\", rotated])\n    apply (rule wp_is_pre, simp, simp)\n  unfolding wp_bcomp[OF nonneg_delay_mux2_seq] wp_bcomp[OF nonneg_delay_mux2_seq_next] wp_guarded wp_trans[OF zero_less_one]\nproof (rule+, unfold if_bool_eq_conj, rule, rule_tac[!] impI, rule_tac[!] allI, rule_tac[!] impI, rule_tac[!] ballI)\n  fix tw x xa xb xc j\n  assume assms1: \"mux2_inv tw \\<and> wityping \\<Gamma> (snd tw) \"\n  define tw2 where \"tw2 = tw  [TEMP0, 1 :=\\<^sub>2 x ]\"\n  define tw3 where \"tw3 = tw2 [TEMP1, 1 :=\\<^sub>2 xa]\"\n  define tw4 where \"tw4 = tw3 [OUT  , 1 :=\\<^sub>2 xc]\"\n  assume \"beval_world_raw2 tw (Bnand (Bsig IN0) (Bsig IN1)) x\"\n  have assms2: \"beval_world_raw (snd tw) (get_time tw) (Bnand (Bsig IN0) (Bsig IN1)) x\"\n    using \\<open>beval_world_raw2 tw (Bnand (Bsig IN0) (Bsig IN1)) x\\<close> unfolding beval_world_raw2_def  by auto\n  have \"bexp_wt \\<Gamma> (Bnand (Bsig IN0) (Bsig IN1)) Bty\" and \"bexp_wt \\<Gamma> (Bnor (Bsig IN0) (Bsig IN1)) Bty\"\n    using assms1 scalar_type_axioms potential_tyenv unfolding scalar_type_def \n    by (metis seq_wt_cases(2) seq_wt_cases(4))+  \n  have \"type_of x = Bty\"\n    by (rule beval_world_raw_cases[OF assms2]) (meson \\<open>bexp_wt \\<Gamma> (Bnand (Bsig IN0) (Bsig IN1)) Bty\\<close> assms1 beval_raw_preserve_well_typedness\n    wityping_def wityping_ensure_styping wityping_ensure_ttyping)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x] (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n  hence  \"beval_world_raw2 tw2 (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n    unfolding tw2_def by auto\n  hence assms3: \"beval_world_raw (snd tw2) (get_time tw2) (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n    unfolding beval_world_raw2_def  by auto\n  have \"type_of xa = Bty\"\n    apply (rule beval_world_raw_cases[OF assms3]) \n    by (smt Suc_eq_plus1 \\<open>type_of x = Bty\\<close> assms2 beval_cases(1) beval_cases(10) beval_cases(9)\n    beval_world_raw_cases comp_apply lessI prod.sel(1) state_of_world_def tw2_def ty.distinct(1)\n    type_of.elims val.distinct(1) worldline_upd2_before_dly worldline_upd2_def)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig SEL) xb \\<and> is_Bv xb\"\n  hence  \"beval_world_raw2 tw3 (Bsig SEL) xb \\<and> is_Bv xb\"\n    unfolding tw3_def tw2_def by auto\n  assume \"bval_of xb\"\n  have \"bval_of_wline tw SEL (fst tw)\"\n    by (metis (no_types, lifting) \\<open>beval_world_raw2 tw3 (Bsig SEL) xb \\<and> is_Bv xb\\<close> \\<open>bval_of xb\\<close>\n    beval_world_raw2_Bsig beval_world_raw2_deterministic eq_fst_iff less_add_one tw2_def tw3_def\n    worldline_upd2_before_dly worldline_upd2_def)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig TEMP0) xc\"\n  hence  \"beval_world_raw (snd tw3) (fst tw3) (Bsig TEMP0) xc\"\n    unfolding tw3_def tw2_def beval_world_raw2_def by auto\n  assume *: \"j \\<in> {get_time tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa][ OUT, 1 :=\\<^sub>2 xc]<..next_time_world tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa][ OUT, 1 :=\\<^sub>2 xc]}\"\n  have \"j \\<in> {fst tw4 <.. next_time_world tw4}\"\n    using * unfolding tw4_def tw3_def tw2_def by auto\n  have \"fst tw4 < j\"\n    using next_time_world_at_least  using nat_less_le \n    using \\<open>j \\<in> {get_time tw4<..next_time_world tw4}\\<close> by auto\n  moreover have \"fst tw = fst tw4\"\n    unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n  ultimately have \"fst tw < j\"\n    by auto\n  have 0: \"bval_of_wline tw4 SEL (fst tw)= bval_of_wline tw SEL (fst tw)\" and 1: \"wline_of tw TEMP0 (fst tw) = wline_of tw4 TEMP0 (fst tw)\"\n   and 2: \"wline_of tw TEMP1 (fst tw) =  wline_of tw4 TEMP1 (fst tw)\"\n    unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by simp+\n  have \"\\<forall>i < j. (bval_of_wline tw4 OUT   (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i))\n              \\<and> (bval_of_wline tw4 TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i))\n              \\<and> (bval_of_wline tw4 TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i))\"\n  proof (rule, rule)\n    fix i\n    assume \"i < j\"\n    have \"i < fst tw \\<or> fst tw \\<le> i \\<and> i < j - 1 \\<or> i = j - 1\"\n      using next_time_world_at_least \\<open>i  < j\\<close> \\<open>get_time tw = get_time tw4\\<close>  by linarith\n    moreover\n    { assume \"i < fst tw\"\n      have \"(bval_of_wline tw OUT   (i + 1) = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i))\n          \\<and> (bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i))\n          \\<and> (bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i))\"\n        using assms1 \\<open>i < fst tw\\<close> unfolding mux2_inv_def by auto\n      hence \" bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i) \\<and>\n              bval_of_wline tw4 TEMP0 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i)) \\<and>\n              bval_of_wline tw4 TEMP1 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i))\"\n        unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def using \\<open>i < fst tw\\<close> by auto }\n    moreover\n    { assume \"fst tw \\<le> i \\<and> i < j - 1\" hence \"fst tw \\<le> i\" and \"i < j - 1\"  \n        by auto\n      hence \"(wline_of tw4 OUT (i + 1) = wline_of tw4 OUT (fst tw + 1)) \\<and> (wline_of tw4 TEMP0 (i + 1) = wline_of tw4 TEMP0 (fst tw + 1)) \n           \\<and> (wline_of tw4 TEMP1 (i + 1) = wline_of tw4 TEMP1 (fst tw + 1))\"\n        using unchanged_until_next_time_world by (smt \\<open>get_time tw = get_time tw4\\<close> \\<open>j \\<in> {get_time\n        tw4<..next_time_world tw4}\\<close> dual_order.strict_trans1 greaterThanAtMost_iff le_add1\n        less_diff_conv not_less)\n      moreover have \"wline_of tw4 TEMP1 i = wline_of tw4 TEMP1 (fst tw)\" and \"wline_of tw4 TEMP0 i = wline_of tw4 TEMP0 (fst tw)\"\n          and \"wline_of tw4 SEL i = wline_of tw4 SEL (fst tw)\" and \"wline_of tw4 IN0 i = wline_of tw4 IN0 (fst tw)\" and \n              \"wline_of tw4 IN1 i = wline_of tw4 IN1 (fst tw)\"\n        using unchanged_until_next_time_world \\<open>fst tw \\<le> i \\<and> i < j - 1\\<close>\n        by (metis (no_types, lifting) \\<open>get_time tw = get_time tw4\\<close> \\<open>i < j\\<close> \\<open>j \\<in> {get_time tw4<..next_time_world tw4}\\<close> dual_order.strict_trans1 greaterThanAtMost_iff)+\n      moreover have \"bval_of_wline tw4 OUT (fst tw + 1) =\n                      (if bval_of_wline tw4 SEL (fst tw) then bval_of_wline tw4 TEMP0 (fst tw) else bval_of_wline tw4 TEMP1 (fst tw))\"\n      proof -\n        have \"wline_of tw4 OUT (fst tw + 1) = xc\"\n          using \\<open>fst tw \\<le> i \\<and> i < j - 1\\<close> unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n        also have \"... = wline_of tw TEMP0 (fst tw)\"\n          by (metis \\<open>beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig TEMP0) xc\\<close>\n          beval_world_raw2_Bsig beval_world_raw2_deterministic fst_conv less_add_one\n          worldline_upd2_before_dly worldline_upd2_def)\n        also have \" ... = (if bval_of_wline tw SEL (fst tw) then wline_of tw TEMP0 (fst tw) else wline_of tw TEMP1 (fst tw))\"\n          using \\<open>bval_of_wline tw SEL (fst tw)\\<close> by auto\n        \\<comment> \\<open>notice the change from @{term \"tw\"} to @{term \"tw4\"}\\<close>\n        also have \"... = (if bval_of_wline tw4 SEL (fst tw) then wline_of tw4 TEMP0 (fst tw) else wline_of tw4 TEMP1 (fst tw))\"\n          using 0 1 2 by auto\n        finally show ?thesis \n          by auto\n      qed \n      moreover have \"bval_of_wline tw4 TEMP0 (fst tw + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<and> bval_of_wline tw4 IN1 (fst tw))\"\n      proof -\n        have \"wline_of tw4 TEMP0 (fst tw + 1) = x\"\n          unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n        also have \"bval_of ... \\<longleftrightarrow> (\\<not> (bval_of_wline tw IN0 (fst tw) \\<and> bval_of_wline tw IN1 (fst tw)))\"\n          apply (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n          apply (smt beval_cases(1) comp_apply state_of_world_def val.sel(1))\n          using \\<open>type_of x = Bty\\<close> by simp\n        also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<and> bval_of_wline tw4 IN1 (fst tw))\"\n          unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by simp\n        finally show ?thesis\n          by simp\n      qed  \n      moreover have \"bval_of_wline tw4 TEMP1 (fst tw + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<or> bval_of_wline tw4 IN1 (fst tw))\"\n      proof -\n        have \"wline_of tw4 TEMP1 (fst tw + 1) = xa\"\n          unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n        also have \"bval_of ... \\<longleftrightarrow> (\\<not> (bval_of_wline tw2 IN0 (fst tw2) \\<or> bval_of_wline tw2 IN1 (fst tw2)))\"\n          apply (rule beval_world_raw_cases[OF assms3], erule beval_cases(10))          \n           apply (metis beval_cases(1) comp_apply state_of_world_def val.sel(1))\n          using \\<open>type_of xa = Bty\\<close> by simp\n        also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<or> bval_of_wline tw4 IN1 (fst tw))\"\n          unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto \n        finally show ?thesis\n          by simp\n      qed \n      ultimately have \"bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i) \\<and>\n              bval_of_wline tw4 TEMP0 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i)) \\<and>\n              bval_of_wline tw4 TEMP1 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i))\"\n        by auto }\n    moreover\n    { assume \"i = j - 1\"\n      hence \"wline_of tw4 OUT (i + 1) = wline_of tw4 OUT j\"\n        using \\<open>i < j\\<close> by auto\n      also have \"... = wline_of tw4 OUT (fst tw + 1)\"\n        using \\<open>fst tw < j\\<close> unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n      also have \"bval_of ... = (if bval_of_wline tw4 SEL (fst tw) then bval_of_wline tw4 TEMP0 (fst tw) else bval_of_wline tw4 TEMP1 (fst tw))\"\n      proof -\n        have \"wline_of tw4 OUT (fst tw + 1) = wline_of tw TEMP0 (fst tw)\"\n          apply (rule beval_world_raw_cases[OF \\<open>beval_world_raw (snd tw3) (fst tw3) (Bsig TEMP0) xc\\<close>], erule beval_cases)\n          by (metis (mono_tags) \"1\" \\<open>get_time tw = get_time tw4\\<close> comp_apply fst_conv less_add_one\n          state_of_world_def tw4_def worldline_upd2_at_dly worldline_upd2_before_dly\n          worldline_upd2_def)\n        \\<comment> \\<open>notice that we use @{term \"tw4\"} on the else part; no point of using @{term \"tw\"}\\<close>\n        show ?thesis \n          using \"0\" \"1\" \\<open>bval_of_wline tw SEL (get_time tw)\\<close> \\<open>wline_of tw4 OUT (get_time tw + 1) =\n          wline_of tw TEMP0 (get_time tw)\\<close> by auto\n      qed\n      also have \"... = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i)\"\n        by (smt One_nat_def Suc_lessI \\<open>get_time tw = get_time tw4\\<close> \\<open>i < j\\<close> \\<open>i = j - 1\\<close> \\<open>j \\<in>\n        {get_time tw4<..next_time_world tw4}\\<close> add.right_neutral add_Suc_right greaterThanAtMost_iff\n        less_Suc_eq_le less_add_one less_diff_conv not_less_eq unchanged_until_next_time_world)\n      finally have \"bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i)\"\n        by auto \n      moreover have \"bval_of_wline tw4 TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i)\"\n      proof -\n        have \"wline_of tw4 TEMP0 (i + 1) = wline_of tw4 TEMP0 j\"\n          using \\<open>i = j - 1\\<close> \\<open>i < j\\<close> by auto\n        also have \"... = wline_of tw4 TEMP0 (fst tw + 1)\"\n          using \\<open>fst tw < j\\<close> unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n        also have \"bval_of ... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<and> bval_of_wline tw4 IN1 (fst tw))\"\n        proof -\n          have \"wline_of tw4 TEMP0 (fst tw + 1) = x\"\n            unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n          also have \"bval_of ... \\<longleftrightarrow> (\\<not> (bval_of_wline tw IN0 (fst tw) \\<and> bval_of_wline tw IN1 (fst tw)))\"\n            apply (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n            apply (smt beval_cases(1) comp_apply state_of_world_def val.sel(1))\n            using \\<open>type_of x = Bty\\<close> by auto\n          also have \"... \\<longleftrightarrow> (\\<not> (bval_of_wline tw4 IN0 (fst tw) \\<and> bval_of_wline tw4 IN1 (fst tw)))\"\n            unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto \n          finally show ?thesis\n            by simp\n        qed        \n        finally show ?thesis\n          by (smt One_nat_def Suc_lessI \\<open>get_time tw = get_time tw4\\<close> \\<open>i < j\\<close> \\<open>i = j - 1\\<close> \\<open>j \\<in>\n          {get_time tw4<..next_time_world tw4}\\<close> add.right_neutral add_Suc_right\n          greaterThanAtMost_iff less_Suc_eq_le less_add_one less_diff_conv not_less_eq\n          unchanged_until_next_time_world)\n      qed\n      moreover have \"bval_of_wline tw4 TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i)\"\n      proof -\n        have \"wline_of tw4 TEMP1 (i + 1) = wline_of tw4 TEMP1 j\"\n          using \\<open>i = j - 1\\<close> \\<open>i < j\\<close> by auto\n        also have \"... = wline_of tw4 TEMP1 (fst tw + 1)\"\n          using \\<open>fst tw < j\\<close> unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n        also have \"bval_of ... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<or> bval_of_wline tw4 IN1 (fst tw))\"\n        proof -\n          have \"wline_of tw4 TEMP1 (fst tw + 1) = xa\"\n            unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n          also have \"bval_of ... \\<longleftrightarrow> (\\<not> (bval_of_wline tw2 IN0 (fst tw2) \\<or> bval_of_wline tw2 IN1 (fst tw2)))\"\n            apply (rule beval_world_raw_cases[OF assms3], erule beval_cases)\n            apply (smt beval_cases(1) comp_apply state_of_world_def val.sel(1))\n            using \\<open>type_of xa = Bty\\<close> by auto\n          also have \"... \\<longleftrightarrow> (\\<not> (bval_of_wline tw4 IN0 (fst tw) \\<or> bval_of_wline tw4 IN1 (fst tw)))\"\n            unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto \n          finally show ?thesis\n            by simp\n        qed        \n        finally show ?thesis\n          by (smt One_nat_def Suc_lessI \\<open>get_time tw = get_time tw4\\<close> \\<open>i < j\\<close> \\<open>i = j - 1\\<close> \\<open>j \\<in>\n          {get_time tw4<..next_time_world tw4}\\<close> add.right_neutral add_Suc_right\n          greaterThanAtMost_iff less_Suc_eq_le less_add_one less_diff_conv not_less_eq\n          unchanged_until_next_time_world)\n      qed\n      ultimately have \"bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i) \\<and>\n              bval_of_wline tw4 TEMP0 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i)) \\<and>\n              bval_of_wline tw4 TEMP1 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i))\"\n        by auto }\n    ultimately show \"bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i) \\<and>\n              bval_of_wline tw4 TEMP0 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i)) \\<and>\n              bval_of_wline tw4 TEMP1 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i))\"\n      by auto \n  qed\n  thus \"mux2_inv (j, snd tw4)\"\n    unfolding mux2_inv_def by auto\nnext\n  fix tw x xa xb xc j\n  assume assms1: \"mux2_inv tw \\<and> wityping \\<Gamma> (snd tw) \"\n  define tw2 where \"tw2 = tw  [TEMP0, 1 :=\\<^sub>2 x ]\"\n  define tw3 where \"tw3 = tw2 [TEMP1, 1 :=\\<^sub>2 xa]\"\n  define tw4 where \"tw4 = tw3 [OUT  , 1 :=\\<^sub>2 xc]\"\n  assume \"beval_world_raw2 tw (Bnand (Bsig IN0) (Bsig IN1)) x\"\n  have assms2: \"beval_world_raw (snd tw) (get_time tw) (Bnand (Bsig IN0) (Bsig IN1)) x\"\n    using \\<open>beval_world_raw2 tw (Bnand (Bsig IN0) (Bsig IN1)) x\\<close> unfolding beval_world_raw2_def  by auto\n  have \"bexp_wt \\<Gamma> (Bnand (Bsig IN0) (Bsig IN1)) Bty\" and \"bexp_wt \\<Gamma> (Bnor (Bsig IN0) (Bsig IN1)) Bty\"\n    using assms1 scalar_type_axioms potential_tyenv unfolding scalar_type_def \n    by (metis seq_wt_cases(2) seq_wt_cases(4))+  \n  have \"type_of x = Bty\"\n    by (rule beval_world_raw_cases[OF assms2]) (meson \\<open>bexp_wt \\<Gamma> (Bnand (Bsig IN0) (Bsig IN1)) Bty\\<close> assms1 beval_raw_preserve_well_typedness\n    wityping_def wityping_ensure_styping wityping_ensure_ttyping)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x] (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n  hence  \"beval_world_raw2 tw2 (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n    unfolding tw2_def by auto\n  hence assms3: \"beval_world_raw (snd tw2) (get_time tw2) (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n    unfolding beval_world_raw2_def  by auto\n  have \"type_of xa = Bty\"\n    apply (rule beval_world_raw_cases[OF assms3]) \n    by (smt Suc_eq_plus1 \\<open>type_of x = Bty\\<close> assms2 beval_cases(1) beval_cases(10) beval_cases(9)\n    beval_world_raw_cases comp_apply lessI prod.sel(1) state_of_world_def tw2_def ty.distinct(1)\n    type_of.elims val.distinct(1) worldline_upd2_before_dly worldline_upd2_def)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig SEL) xb \\<and> is_Bv xb\"\n  hence  \"beval_world_raw2 tw3 (Bsig SEL) xb \\<and> is_Bv xb\"\n    unfolding tw3_def tw2_def by auto\n  assume \"\\<not> bval_of xb\"\n  have \"\\<not> bval_of_wline tw SEL (fst tw)\"\n    by (metis (no_types, lifting) \\<open>beval_world_raw2 tw3 (Bsig SEL) xb \\<and> is_Bv xb\\<close> \\<open>\\<not> bval_of xb\\<close>\n    beval_world_raw2_Bsig beval_world_raw2_deterministic eq_fst_iff less_add_one tw2_def tw3_def\n    worldline_upd2_before_dly worldline_upd2_def)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig TEMP1) xc\"\n  hence  \"beval_world_raw (snd tw3) (fst tw3) (Bsig TEMP1) xc\"\n    unfolding tw3_def tw2_def beval_world_raw2_def by auto\n  assume *: \"j \\<in> {get_time tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa][ OUT, 1 :=\\<^sub>2 xc]<..next_time_world tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa][ OUT, 1 :=\\<^sub>2 xc]}\"\n  have \"j \\<in> {fst tw4 <.. next_time_world tw4}\"\n    using * unfolding tw4_def tw3_def tw2_def by auto\n  have \"fst tw4 < j\"\n    using next_time_world_at_least  using nat_less_le \n    using \\<open>j \\<in> {get_time tw4<..next_time_world tw4}\\<close> by auto\n  moreover have \"fst tw = fst tw4\"\n    unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n  ultimately have \"fst tw < j\"\n    by auto\n  have 0: \"bval_of_wline tw4 SEL (fst tw)= bval_of_wline tw SEL (fst tw)\" and 1: \"wline_of tw TEMP0 (fst tw) = wline_of tw4 TEMP0 (fst tw)\"\n   and 2: \"wline_of tw TEMP1 (fst tw) =  wline_of tw4 TEMP1 (fst tw)\"\n    unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by simp+\n  have \"\\<forall>i < j. (bval_of_wline tw4 OUT   (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i))\n              \\<and> (bval_of_wline tw4 TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i))\n              \\<and> (bval_of_wline tw4 TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i))\"\n  proof (rule, rule)\n    fix i\n    assume \"i < j\"\n    have \"i < fst tw \\<or> fst tw \\<le> i \\<and> i < j - 1 \\<or> i = j - 1\"\n      using next_time_world_at_least \\<open>i  < j\\<close> \\<open>get_time tw = get_time tw4\\<close>  by linarith\n    moreover\n    { assume \"i < fst tw\"\n      have \"(bval_of_wline tw OUT   (i + 1) = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i))\n          \\<and> (bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i))\n          \\<and> (bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i))\"\n        using assms1 \\<open>i < fst tw\\<close> unfolding mux2_inv_def by auto\n      hence \" bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i) \\<and>\n              bval_of_wline tw4 TEMP0 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i)) \\<and>\n              bval_of_wline tw4 TEMP1 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i))\"\n        unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def using \\<open>i < fst tw\\<close> by auto }\n    moreover\n    { assume \"fst tw \\<le> i \\<and> i < j - 1\" hence \"fst tw \\<le> i\" and \"i < j - 1\"  \n        by auto\n      hence \"(wline_of tw4 OUT (i + 1) = wline_of tw4 OUT (fst tw + 1)) \\<and> (wline_of tw4 TEMP0 (i + 1) = wline_of tw4 TEMP0 (fst tw + 1)) \n           \\<and> (wline_of tw4 TEMP1 (i + 1) = wline_of tw4 TEMP1 (fst tw + 1))\"\n        using unchanged_until_next_time_world by (smt \\<open>get_time tw = get_time tw4\\<close> \\<open>j \\<in> {get_time\n        tw4<..next_time_world tw4}\\<close> dual_order.strict_trans1 greaterThanAtMost_iff le_add1\n        less_diff_conv not_less)\n      moreover have \"wline_of tw4 TEMP1 i = wline_of tw4 TEMP1 (fst tw)\" and \"wline_of tw4 TEMP0 i = wline_of tw4 TEMP0 (fst tw)\"\n          and \"wline_of tw4 SEL i = wline_of tw4 SEL (fst tw)\" and \"wline_of tw4 IN0 i = wline_of tw4 IN0 (fst tw)\" and \n              \"wline_of tw4 IN1 i = wline_of tw4 IN1 (fst tw)\"\n        using unchanged_until_next_time_world \\<open>fst tw \\<le> i \\<and> i < j - 1\\<close>\n        by (metis (no_types, lifting) \\<open>get_time tw = get_time tw4\\<close> \\<open>i < j\\<close> \\<open>j \\<in> {get_time tw4<..next_time_world tw4}\\<close> dual_order.strict_trans1 greaterThanAtMost_iff)+\n      moreover have \"bval_of_wline tw4 OUT (fst tw + 1) =\n                      (if bval_of_wline tw4 SEL (fst tw) then bval_of_wline tw4 TEMP0 (fst tw) else bval_of_wline tw4 TEMP1 (fst tw))\"\n      proof -\n        have \"wline_of tw4 OUT (fst tw + 1) = xc\"\n          using \\<open>fst tw \\<le> i \\<and> i < j - 1\\<close> unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n        also have \"... = wline_of tw TEMP1 (fst tw)\"\n          by (metis \\<open>beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig TEMP1) xc\\<close>\n          beval_world_raw2_Bsig beval_world_raw2_deterministic fst_conv less_add_one\n          worldline_upd2_before_dly worldline_upd2_def)\n        also have \" ... = (if bval_of_wline tw SEL (fst tw) then wline_of tw TEMP0 (fst tw) else wline_of tw TEMP1 (fst tw))\"\n          using \\<open>\\<not> bval_of_wline tw SEL (fst tw)\\<close> by auto\n        \\<comment> \\<open>notice the change from @{term \"tw\"} to @{term \"tw4\"}\\<close>\n        also have \"... = (if bval_of_wline tw4 SEL (fst tw) then wline_of tw4 TEMP0 (fst tw) else wline_of tw4 TEMP1 (fst tw))\"\n          using 0 1 2 by auto\n        finally show ?thesis \n          by auto\n      qed \n      moreover have \"bval_of_wline tw4 TEMP0 (fst tw + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<and> bval_of_wline tw4 IN1 (fst tw))\"\n      proof -\n        have \"wline_of tw4 TEMP0 (fst tw + 1) = x\"\n          unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n        also have \"bval_of ... \\<longleftrightarrow> (\\<not> (bval_of_wline tw IN0 (fst tw) \\<and> bval_of_wline tw IN1 (fst tw)))\"\n          apply (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n          apply (smt beval_cases(1) comp_apply state_of_world_def val.sel(1))\n          using \\<open>type_of x = Bty\\<close> by simp\n        also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<and> bval_of_wline tw4 IN1 (fst tw))\"\n          unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by simp\n        finally show ?thesis\n          by simp\n      qed  \n      moreover have \"bval_of_wline tw4 TEMP1 (fst tw + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<or> bval_of_wline tw4 IN1 (fst tw))\"\n      proof -\n        have \"wline_of tw4 TEMP1 (fst tw + 1) = xa\"\n          unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n        also have \"bval_of ... \\<longleftrightarrow> (\\<not> (bval_of_wline tw2 IN0 (fst tw2) \\<or> bval_of_wline tw2 IN1 (fst tw2)))\"\n          apply (rule beval_world_raw_cases[OF assms3], erule beval_cases(10))          \n           apply (metis beval_cases(1) comp_apply state_of_world_def val.sel(1))\n          using \\<open>type_of xa = Bty\\<close> by simp\n        also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<or> bval_of_wline tw4 IN1 (fst tw))\"\n          unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto \n        finally show ?thesis\n          by simp\n      qed \n      ultimately have \"bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i) \\<and>\n              bval_of_wline tw4 TEMP0 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i)) \\<and>\n              bval_of_wline tw4 TEMP1 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i))\"\n        by auto }\n    moreover\n    { assume \"i = j - 1\"\n      hence \"wline_of tw4 OUT (i + 1) = wline_of tw4 OUT j\"\n        using \\<open>i < j\\<close> by auto\n      also have \"... = wline_of tw4 OUT (fst tw + 1)\"\n        using \\<open>fst tw < j\\<close> unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n      also have \"bval_of ... = (if bval_of_wline tw4 SEL (fst tw) then bval_of_wline tw4 TEMP0 (fst tw) else bval_of_wline tw4 TEMP1 (fst tw))\"\n      proof -\n        have \"wline_of tw4 OUT (fst tw + 1) = wline_of tw TEMP1 (fst tw)\"\n          apply (rule beval_world_raw_cases[OF \\<open>beval_world_raw (snd tw3) (fst tw3) (Bsig TEMP1) xc\\<close>], erule beval_cases)\n          by (metis (mono_tags) \"2\" \\<open>get_time tw = get_time tw4\\<close> comp_apply fst_conv less_add_one\n          state_of_world_def tw4_def worldline_upd2_at_dly worldline_upd2_before_dly\n          worldline_upd2_def)\n        \\<comment> \\<open>notice that we use @{term \"tw4\"} on the else part; no point of using @{term \"tw\"}\\<close>\n        thus ?thesis \n          using \"0\" \"1\" \\<open>\\<not> bval_of_wline tw SEL (get_time tw)\\<close>  using \"2\" by auto          \n      qed\n      also have \"... = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i)\"\n        by (smt One_nat_def Suc_lessI \\<open>get_time tw = get_time tw4\\<close> \\<open>i < j\\<close> \\<open>i = j - 1\\<close> \\<open>j \\<in>\n        {get_time tw4<..next_time_world tw4}\\<close> add.right_neutral add_Suc_right greaterThanAtMost_iff\n        less_Suc_eq_le less_add_one less_diff_conv not_less_eq unchanged_until_next_time_world)\n      finally have \"bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i)\"\n        by auto \n      moreover have \"bval_of_wline tw4 TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i)\"\n      proof -\n        have \"wline_of tw4 TEMP0 (i + 1) = wline_of tw4 TEMP0 j\"\n          using \\<open>i = j - 1\\<close> \\<open>i < j\\<close> by auto\n        also have \"... = wline_of tw4 TEMP0 (fst tw + 1)\"\n          using \\<open>fst tw < j\\<close> unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n        also have \"bval_of ... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<and> bval_of_wline tw4 IN1 (fst tw))\"\n        proof -\n          have \"wline_of tw4 TEMP0 (fst tw + 1) = x\"\n            unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n          also have \"bval_of ... \\<longleftrightarrow> (\\<not> (bval_of_wline tw IN0 (fst tw) \\<and> bval_of_wline tw IN1 (fst tw)))\"\n            apply (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n            apply (smt beval_cases(1) comp_apply state_of_world_def val.sel(1))\n            using \\<open>type_of x = Bty\\<close> by auto\n          also have \"... \\<longleftrightarrow> (\\<not> (bval_of_wline tw4 IN0 (fst tw) \\<and> bval_of_wline tw4 IN1 (fst tw)))\"\n            unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto \n          finally show ?thesis\n            by simp\n        qed        \n        finally show ?thesis\n          by (smt One_nat_def Suc_lessI \\<open>get_time tw = get_time tw4\\<close> \\<open>i < j\\<close> \\<open>i = j - 1\\<close> \\<open>j \\<in>\n          {get_time tw4<..next_time_world tw4}\\<close> add.right_neutral add_Suc_right\n          greaterThanAtMost_iff less_Suc_eq_le less_add_one less_diff_conv not_less_eq\n          unchanged_until_next_time_world)\n      qed\n      moreover have \"bval_of_wline tw4 TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i)\"\n      proof -\n        have \"wline_of tw4 TEMP1 (i + 1) = wline_of tw4 TEMP1 j\"\n          using \\<open>i = j - 1\\<close> \\<open>i < j\\<close> by auto\n        also have \"... = wline_of tw4 TEMP1 (fst tw + 1)\"\n          using \\<open>fst tw < j\\<close> unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n        also have \"bval_of ... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 (fst tw) \\<or> bval_of_wline tw4 IN1 (fst tw))\"\n        proof -\n          have \"wline_of tw4 TEMP1 (fst tw + 1) = xa\"\n            unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n          also have \"bval_of ... \\<longleftrightarrow> (\\<not> (bval_of_wline tw2 IN0 (fst tw2) \\<or> bval_of_wline tw2 IN1 (fst tw2)))\"\n            apply (rule beval_world_raw_cases[OF assms3], erule beval_cases)\n            apply (smt beval_cases(1) comp_apply state_of_world_def val.sel(1))\n            using \\<open>type_of xa = Bty\\<close> by auto\n          also have \"... \\<longleftrightarrow> (\\<not> (bval_of_wline tw4 IN0 (fst tw) \\<or> bval_of_wline tw4 IN1 (fst tw)))\"\n            unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto \n          finally show ?thesis\n            by simp\n        qed        \n        finally show ?thesis\n          by (smt One_nat_def Suc_lessI \\<open>get_time tw = get_time tw4\\<close> \\<open>i < j\\<close> \\<open>i = j - 1\\<close> \\<open>j \\<in>\n          {get_time tw4<..next_time_world tw4}\\<close> add.right_neutral add_Suc_right\n          greaterThanAtMost_iff less_Suc_eq_le less_add_one less_diff_conv not_less_eq\n          unchanged_until_next_time_world)\n      qed\n      ultimately have \"bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i) \\<and>\n              bval_of_wline tw4 TEMP0 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i)) \\<and>\n              bval_of_wline tw4 TEMP1 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i))\"\n        by auto }\n    ultimately show \"bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline tw4 SEL i then bval_of_wline tw4 TEMP0 i else bval_of_wline tw4 TEMP1 i) \\<and>\n              bval_of_wline tw4 TEMP0 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<and> bval_of_wline tw4 IN1 i)) \\<and>\n              bval_of_wline tw4 TEMP1 (i + 1) = (\\<not> (bval_of_wline tw4 IN0 i \\<or> bval_of_wline tw4 IN1 i))\"\n      by auto \n  qed\n  thus \"mux2_inv (j, snd tw4)\"\n    unfolding mux2_inv_def by auto\nqed\n\ntheorem mux2_seq_hoare_next_time_wityping:\n  shows\"\n   \\<turnstile> [\\<lambda>tw. mux2_inv tw \\<and> wityping \\<Gamma> (snd tw)] mux2_seq\n     [\\<lambda>tw. mux2_inv (next_time_world tw, snd tw) \\<and> wityping \\<Gamma> (snd tw)]\"\n  apply (rule Conj)\n   apply (rule Conseq2[rotated])\n     apply (rule mux2_seq_hoare_next_time)\n    apply (simp add: next_time_world_at_least)\n  apply simp\n  apply (rule strengthen_precondition2)\n  apply (rule seq_stmt_preserve_wityping_hoare)\n  using scalar_type_axioms unfolding scalar_type_def by auto\n\ntheorem mux2_seq_hoare_next_time0:\n  \"\\<turnstile> [\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)] mux2_seq\n     [\\<lambda>tw. mux2_inv (next_time_world tw, snd tw)]\"\n  apply (rule Conseq2[where P=\"\\<lambda>tw. mux2_inv tw \\<and> wityping \\<Gamma> (snd tw)\" and Q=\"\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. mux2_inv (j, snd tw)\"])\n    apply (simp add: mux2_inv_def)\n  apply (rule mux2_seq_hoare_next_time)\n  by (simp add: next_time_world_at_least)\n\ntheorem mux2_seq_hoare_next_time0_wityping:\n  shows\n  \"\\<turnstile> [\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)] mux2_seq\n     [\\<lambda>tw. mux2_inv (next_time_world tw, snd tw) \\<and> wityping \\<Gamma> (snd tw)]\"\n  apply (rule Conj)\n   apply (rule mux2_seq_hoare_next_time0)\n  apply (rule strengthen_precondition2)\n  apply (rule seq_stmt_preserve_wityping_hoare)\n  using scalar_type_axioms unfolding scalar_type_def by auto\n\nsubsection \\<open>Proving that the sequential component preserves @{term \"mux2_inv'\"}\\<close>\n\nlemma input_signals_unchanged:\n  fixes tw any\n  assumes \"beval_world_raw2 tw (Bsig any) v\"\n  defines \"tw' \\<equiv> tw[ OUT, 1 :=\\<^sub>2 v]\"\n  defines \"t' \\<equiv> next_time_world tw'\"\n  assumes \"disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of (t', snd tw'))\"\n  shows \"\\<And>s. s \\<in> {IN0, IN1, SEL, TEMP0, TEMP1} \\<Longrightarrow> wline_of tw' s t' = wline_of tw s (fst tw)\"\nproof -\n  fix s\n  assume \"s \\<in> {IN0, IN1, SEL, TEMP0, TEMP1}\"\n  have \"fst tw' < t'\"\n    using next_time_world_at_least unfolding t'_def by blast\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def unfolding worldline_upd2_def by auto\n  ultimately have \"fst tw < t'\"\n    by auto\n  have \"wline_of tw' s t' = wline_of tw s t'\"\n    using \\<open>s \\<in> {IN0, IN1, SEL, TEMP0, TEMP1}\\<close> unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  also have \"... = wline_of tw s (t' - 1)\"\n    using \\<open>disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of (t', snd tw'))\\<close> \\<open>fst tw < t'\\<close>\n    unfolding event_of_alt_def  tw'_def worldline_upd2_def worldline_upd_def using \\<open>s \\<in> {IN0, IN1, SEL, TEMP0, TEMP1}\\<close>\n    by auto\n  also have \"... = wline_of tw s (fst tw)\"\n  proof -\n    have \"fst tw' \\<le> t' - 1\" and \"t' - 1 < t'\"\n      using \\<open>fst tw' < t'\\<close> by auto\n    hence \"wline_of tw' s (t' - 1) = wline_of tw' s (fst tw')\"\n      using unchanged_until_next_time_world[where tw=\"tw'\"] unfolding t'_def by blast\n    moreover have \"wline_of tw' s (t' - 1) = wline_of tw s (t' - 1)\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def  using \\<open>s \\<in> {IN0, IN1, SEL, TEMP0, TEMP1}\\<close> by auto\n    moreover have \"wline_of tw' s (fst tw') = wline_of tw s (fst tw')\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    ultimately show ?thesis\n      using \\<open>fst tw = fst tw'\\<close> by auto\n  qed\n  finally show \"wline_of tw' s t' = wline_of tw s (fst tw)\"\n    by auto\nqed\n\ntheorem mux2_seq_hoare_next_time':\n  \"\\<turnstile> [\\<lambda>tw. wityping \\<Gamma> (snd tw)] \n        mux2_seq \n     [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. mux2_inv' (j, snd tw)]\"\n  apply (rule Conseq2[where P= \"wp mux2_seq (\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. mux2_inv' (j, snd tw))\" and \n                            Q= \"\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. mux2_inv' (j, snd tw)\", rotated])\n    apply (rule wp_is_pre, simp, simp)\n  unfolding wp_bcomp[OF nonneg_delay_mux2_seq] wp_bcomp[OF nonneg_delay_mux2_seq_next] wp_guarded wp_trans[OF zero_less_one]\nproof (rule+, unfold if_bool_eq_conj, rule, rule_tac[!] impI, rule_tac[!] allI, rule_tac[!] impI, rule_tac[!] ballI)\n  fix tw :: \"nat \\<times> (sig \\<Rightarrow> val) \\<times> (sig \\<Rightarrow> nat \\<Rightarrow> val)\"\n  fix x xa xb xc j\n  assume assms1: \"wityping \\<Gamma> (snd tw) \"\n  define tw2 where \"tw2 = tw  [TEMP0, 1 :=\\<^sub>2 x ]\"\n  define tw3 where \"tw3 = tw2 [TEMP1, 1 :=\\<^sub>2 xa]\"\n  define tw4 where \"tw4 = tw3 [OUT  , 1 :=\\<^sub>2 xc]\"\n  assume \"beval_world_raw2 tw (Bnand (Bsig IN0) (Bsig IN1)) x\"\n  have assms2: \"beval_world_raw (snd tw) (get_time tw) (Bnand (Bsig IN0) (Bsig IN1)) x\"\n    using \\<open>beval_world_raw2 tw (Bnand (Bsig IN0) (Bsig IN1)) x\\<close> unfolding beval_world_raw2_def  by auto\n  have \"bexp_wt \\<Gamma> (Bnand (Bsig IN0) (Bsig IN1)) Bty\" and \"bexp_wt \\<Gamma> (Bnor (Bsig IN0) (Bsig IN1)) Bty\"\n    using assms1 scalar_type_axioms potential_tyenv unfolding scalar_type_def \n    by (metis seq_wt_cases(2) seq_wt_cases(4))+  \n  have \"type_of x = Bty\"\n    by (rule beval_world_raw_cases[OF assms2]) (meson \\<open>bexp_wt \\<Gamma> (Bnand (Bsig IN0) (Bsig IN1)) Bty\\<close> assms1 beval_raw_preserve_well_typedness\n    wityping_def wityping_ensure_styping wityping_ensure_ttyping)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x] (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n  hence  \"beval_world_raw2 tw2 (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n    unfolding tw2_def by auto\n  hence assms3: \"beval_world_raw (snd tw2) (get_time tw2) (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n    unfolding beval_world_raw2_def  by auto\n  have \"type_of xa = Bty\"\n    apply (rule beval_world_raw_cases[OF assms3]) \n    by (smt Suc_eq_plus1 \\<open>type_of x = Bty\\<close> assms2 beval_cases(1) beval_cases(10) beval_cases(9)\n    beval_world_raw_cases comp_apply lessI prod.sel(1) state_of_world_def tw2_def ty.distinct(1)\n    type_of.elims val.distinct(1) worldline_upd2_before_dly worldline_upd2_def)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig SEL) xb \\<and> is_Bv xb\"\n  hence  \"beval_world_raw2 tw3 (Bsig SEL) xb \\<and> is_Bv xb\"\n    unfolding tw3_def tw2_def by auto\n  assume \"bval_of xb\"\n  have \"bval_of_wline tw SEL (fst tw)\"\n    by (metis (no_types, lifting) \\<open>beval_world_raw2 tw3 (Bsig SEL) xb \\<and> is_Bv xb\\<close> \\<open>bval_of xb\\<close>\n    beval_world_raw2_Bsig beval_world_raw2_deterministic eq_fst_iff less_add_one tw2_def tw3_def\n    worldline_upd2_before_dly worldline_upd2_def)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig TEMP0) xc\"\n  hence  \"beval_world_raw (snd tw3) (fst tw3) (Bsig TEMP0) xc\"\n    unfolding tw3_def tw2_def beval_world_raw2_def by auto\n  assume *: \"j \\<in> {get_time tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa][ OUT, 1 :=\\<^sub>2 xc]<..next_time_world tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa][ OUT, 1 :=\\<^sub>2 xc]}\"\n  have \"j \\<in> {fst tw4 <.. next_time_world tw4}\"\n    using * unfolding tw4_def tw3_def tw2_def by auto\n  have \"fst tw4 < j\"\n    using next_time_world_at_least  using nat_less_le \n    using \\<open>j \\<in> {get_time tw4<..next_time_world tw4}\\<close> by auto\n  moreover have \"fst tw = fst tw4\"\n    unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n  ultimately have \"fst tw < j\"\n    by auto\n  have \"mux2_inv' (j, snd tw4)\"\n    unfolding mux2_inv'_def\n  proof (rule, rule, rule)\n    fix i\n    assume \"disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of (j, snd tw4)) \"\n    assume \"fst (j, snd tw4) \\<le> i\" hence \"j \\<le> i\" by auto\n    have *: \"\\<And>s. s \\<in> {IN0, IN1, SEL, TEMP0, TEMP1} \\<Longrightarrow> wline_of tw4 s j = wline_of tw3 s (fst tw3)\"\n      using \\<open>disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of (j, snd tw4))\\<close>\n      input_signals_unchanged unfolding tw4_def\n      by (smt \"*\" Pair_inject \\<open>beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig TEMP0)\n      xc\\<close> antisym_conv1 greaterThanAtMost_iff less_add_one less_imp_le_nat prod.collapse tw2_def\n      tw3_def unchanged_until_next_time_world worldline_upd2_before_dly worldline_upd2_def)\n    have \"wline_of tw4 OUT (i + 1) = xc\"\n      unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def \n      using \\<open>get_time tw = get_time tw4\\<close> \\<open>get_time tw4 < j\\<close> \\<open>j \\<le> i\\<close> by auto\n    also have \"bval_of ... = bval_of_wline tw TEMP0 (fst tw)\"\n      apply (rule beval_world_raw_cases[OF \\<open>beval_world_raw (snd tw3) (fst tw3) (Bsig TEMP0) xc\\<close>], erule beval_cases)\n      unfolding tw3_def tw2_def\n      by (metis (mono_tags) Suc_eq_plus1 comp_apply eq_fst_iff lessI state_of_world_def worldline_upd2_before_dly worldline_upd2_def)\n    also have \"... = (if bval_of_wline tw SEL (fst tw) then bval_of_wline tw TEMP0 (fst tw) else bval_of_wline tw TEMP1 (fst tw))\"\n      using \\<open>bval_of_wline tw SEL (fst tw)\\<close>  by (simp add: state_of_world_def)\n    also have \"... = (if bval_of_wline tw3 SEL (fst tw3) then bval_of_wline tw3 TEMP0 (fst tw3) else bval_of_wline tw3 TEMP1 (fst tw3))\"\n      using \\<open>bval_of_wline tw SEL (fst tw)\\<close>  unfolding tw3_def tw2_def worldline_upd2_def worldline_upd_def \n      by auto\n    also have \"... = (if bval_of_wline tw4 SEL j then bval_of_wline tw4 TEMP0 j else bval_of_wline tw4 TEMP1 j)\"\n      using * by auto\n    finally have temp1: \"bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline (j, snd tw4) SEL (get_time (j, snd tw4)) then bval_of_wline (j, snd tw4) TEMP0 (get_time (j, snd tw4))\n          else bval_of_wline (j, snd tw4) TEMP1 (get_time (j, snd tw4)))\"\n      by auto\n\n    have \"wline_of tw4 TEMP0 (i + 1) = x\"\n      unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def \n      using \\<open>get_time tw = get_time tw4\\<close> \\<open>get_time tw4 < j\\<close> \\<open>j \\<le> i\\<close> by auto    \n    also have \"bval_of ... \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 (fst tw) \\<and> bval_of_wline tw IN1 (fst tw))\"\n      apply (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n      apply (metis beval_cases(1) comp_apply state_of_world_def val.sel(1))\n      using \\<open>type_of x = Bty\\<close> by auto\n    also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw3 IN0 (fst tw3) \\<and> bval_of_wline tw3 IN1 (fst tw3))\"\n      unfolding tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n    also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 j \\<and> bval_of_wline tw4 IN1 j)\"\n      using * by auto\n    finally have temp2: \"bval_of_wline (j, snd tw4) TEMP0 (i + 1) =\n         (\\<not> (bval_of_wline (j, snd tw4) IN0 (get_time (j, snd tw4)) \\<and> bval_of_wline (j, snd tw4) IN1 (get_time (j, snd tw4))))\"\n      by auto\n\n    have \"wline_of tw4 TEMP1 (i + 1) = xa\"\n      unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def \n      using \\<open>get_time tw = get_time tw4\\<close> \\<open>get_time tw4 < j\\<close> \\<open>j \\<le> i\\<close> by auto    \n    also have \"bval_of ... \\<longleftrightarrow> \\<not> (bval_of_wline tw2 IN0 (fst tw2) \\<or> bval_of_wline tw2 IN1 (fst tw2))\"\n      apply (rule beval_world_raw_cases[OF assms3], erule beval_cases)\n      apply (metis beval_cases(1) comp_apply state_of_world_def val.sel(1))\n      using \\<open>type_of xa = Bty\\<close> by auto\n    also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw3 IN0 (fst tw3) \\<or> bval_of_wline tw3 IN1 (fst tw3))\"\n      unfolding tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n    also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 j \\<or> bval_of_wline tw4 IN1 j)\"\n      using * by auto\n    finally have temp3: \"bval_of_wline (j, snd tw4) TEMP1 (i + 1) =\n         (\\<not> (bval_of_wline (j, snd tw4) IN0 (get_time (j, snd tw4)) \\<or> bval_of_wline (j, snd tw4) IN1 (get_time (j, snd tw4))))\"\n      by auto\n    show \"bval_of_wline (j, snd tw4) OUT (i + 1) =\n         (if bval_of_wline (j, snd tw4) SEL (get_time (j, snd tw4)) then bval_of_wline (j, snd tw4) TEMP0 (get_time (j, snd tw4))\n          else bval_of_wline (j, snd tw4) TEMP1 (get_time (j, snd tw4))) \\<and>\n         bval_of_wline (j, snd tw4) TEMP0 (i + 1) =\n         (\\<not> (bval_of_wline (j, snd tw4) IN0 (get_time (j, snd tw4)) \\<and> bval_of_wline (j, snd tw4) IN1 (get_time (j, snd tw4)))) \\<and>\n         bval_of_wline (j, snd tw4) TEMP1 (i + 1) = (\\<not> (bval_of_wline (j, snd tw4) IN0 (get_time (j, snd tw4)) \\<or> bval_of_wline (j, snd tw4) IN1 (get_time (j, snd tw4))))\"\n      using temp1 temp2 temp3 by auto\n  qed\n  thus \"mux2_inv' (j, snd tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa][ OUT, 1 :=\\<^sub>2 xc])\"\n    unfolding tw4_def tw3_def tw2_def by auto\nnext\n  fix tw :: \"nat \\<times> (sig \\<Rightarrow> val) \\<times> (sig \\<Rightarrow> nat \\<Rightarrow> val)\"\n  fix x xa xb xc j\n  assume assms1: \"wityping \\<Gamma> (snd tw) \"\n  define tw2 where \"tw2 = tw  [TEMP0, 1 :=\\<^sub>2 x ]\"\n  define tw3 where \"tw3 = tw2 [TEMP1, 1 :=\\<^sub>2 xa]\"\n  define tw4 where \"tw4 = tw3 [OUT  , 1 :=\\<^sub>2 xc]\"\n  assume \"beval_world_raw2 tw (Bnand (Bsig IN0) (Bsig IN1)) x\"\n  have assms2: \"beval_world_raw (snd tw) (get_time tw) (Bnand (Bsig IN0) (Bsig IN1)) x\"\n    using \\<open>beval_world_raw2 tw (Bnand (Bsig IN0) (Bsig IN1)) x\\<close> unfolding beval_world_raw2_def  by auto\n  have \"bexp_wt \\<Gamma> (Bnand (Bsig IN0) (Bsig IN1)) Bty\" and \"bexp_wt \\<Gamma> (Bnor (Bsig IN0) (Bsig IN1)) Bty\"\n    using assms1 scalar_type_axioms potential_tyenv unfolding scalar_type_def \n    by (metis seq_wt_cases(2) seq_wt_cases(4))+  \n  have \"type_of x = Bty\"\n    by (rule beval_world_raw_cases[OF assms2]) (meson \\<open>bexp_wt \\<Gamma> (Bnand (Bsig IN0) (Bsig IN1)) Bty\\<close> assms1 beval_raw_preserve_well_typedness\n    wityping_def wityping_ensure_styping wityping_ensure_ttyping)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x] (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n  hence  \"beval_world_raw2 tw2 (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n    unfolding tw2_def by auto\n  hence assms3: \"beval_world_raw (snd tw2) (get_time tw2) (Bnor (Bsig IN0) (Bsig IN1)) xa\"\n    unfolding beval_world_raw2_def  by auto\n  have \"type_of xa = Bty\"\n    apply (rule beval_world_raw_cases[OF assms3]) \n    by (smt Suc_eq_plus1 \\<open>type_of x = Bty\\<close> assms2 beval_cases(1) beval_cases(10) beval_cases(9)\n    beval_world_raw_cases comp_apply lessI prod.sel(1) state_of_world_def tw2_def ty.distinct(1)\n    type_of.elims val.distinct(1) worldline_upd2_before_dly worldline_upd2_def)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig SEL) xb \\<and> is_Bv xb\"\n  hence  \"beval_world_raw2 tw3 (Bsig SEL) xb \\<and> is_Bv xb\"\n    unfolding tw3_def tw2_def by auto\n  assume \"\\<not> bval_of xb\"\n  have \"\\<not> bval_of_wline tw SEL (fst tw)\"\n    by (metis (no_types, lifting) \\<open>beval_world_raw2 tw3 (Bsig SEL) xb \\<and> is_Bv xb\\<close> \\<open>\\<not> bval_of xb\\<close>\n    beval_world_raw2_Bsig beval_world_raw2_deterministic eq_fst_iff less_add_one tw2_def tw3_def\n    worldline_upd2_before_dly worldline_upd2_def)\n  assume \"beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig TEMP1) xc\"\n  hence  \"beval_world_raw (snd tw3) (fst tw3) (Bsig TEMP1) xc\"\n    unfolding tw3_def tw2_def beval_world_raw2_def by auto\n  assume *: \"j \\<in> {get_time tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa][ OUT, 1 :=\\<^sub>2 xc]<..next_time_world tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa][ OUT, 1 :=\\<^sub>2 xc]}\"\n  have \"j \\<in> {fst tw4 <.. next_time_world tw4}\"\n    using * unfolding tw4_def tw3_def tw2_def by auto\n  have \"fst tw4 < j\"\n    using next_time_world_at_least  using nat_less_le \n    using \\<open>j \\<in> {get_time tw4<..next_time_world tw4}\\<close> by auto\n  moreover have \"fst tw = fst tw4\"\n    unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n  ultimately have \"fst tw < j\"\n    by auto\n  have \"mux2_inv' (j, snd tw4)\"\n    unfolding mux2_inv'_def\n  proof (rule, rule, rule)\n    fix i\n    assume \"disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of (j, snd tw4)) \"\n    assume \"fst (j, snd tw4) \\<le> i\" hence \"j \\<le> i\" by auto\n    have *: \"\\<And>s. s \\<in> {IN0, IN1, SEL, TEMP0, TEMP1} \\<Longrightarrow> wline_of tw4 s j = wline_of tw3 s (fst tw3)\"\n      using \\<open>disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of (j, snd tw4))\\<close>\n      input_signals_unchanged unfolding tw4_def\n      by (smt \"*\" Pair_inject \\<open>beval_world_raw2 tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa] (Bsig TEMP1)\n      xc\\<close> antisym_conv1 greaterThanAtMost_iff less_add_one less_imp_le_nat prod.collapse tw2_def\n      tw3_def unchanged_until_next_time_world worldline_upd2_before_dly worldline_upd2_def)\n    have \"wline_of tw4 OUT (i + 1) = xc\"\n      unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def \n      using \\<open>get_time tw = get_time tw4\\<close> \\<open>get_time tw4 < j\\<close> \\<open>j \\<le> i\\<close> by auto\n    also have \"bval_of ... = bval_of_wline tw TEMP1 (fst tw)\"\n      apply (rule beval_world_raw_cases[OF \\<open>beval_world_raw (snd tw3) (fst tw3) (Bsig TEMP1) xc\\<close>], erule beval_cases)\n      unfolding tw3_def tw2_def\n      by (metis (mono_tags) Suc_eq_plus1 comp_apply eq_fst_iff lessI state_of_world_def worldline_upd2_before_dly worldline_upd2_def)\n    also have \"... = (if bval_of_wline tw SEL (fst tw) then bval_of_wline tw TEMP0 (fst tw) else bval_of_wline tw TEMP1 (fst tw))\"\n      using \\<open>\\<not> bval_of_wline tw SEL (fst tw)\\<close>  by (simp add: state_of_world_def)\n    also have \"... = (if bval_of_wline tw3 SEL (fst tw3) then bval_of_wline tw3 TEMP0 (fst tw3) else bval_of_wline tw3 TEMP1 (fst tw3))\"\n      using \\<open>\\<not> bval_of_wline tw SEL (fst tw)\\<close>  unfolding tw3_def tw2_def worldline_upd2_def worldline_upd_def \n      by auto\n    also have \"... = (if bval_of_wline tw4 SEL j then bval_of_wline tw4 TEMP0 j else bval_of_wline tw4 TEMP1 j)\"\n      using * by auto\n    finally have temp1: \"bval_of_wline tw4 OUT (i + 1) = (if bval_of_wline (j, snd tw4) SEL (get_time (j, snd tw4)) then bval_of_wline (j, snd tw4) TEMP0 (get_time (j, snd tw4))\n          else bval_of_wline (j, snd tw4) TEMP1 (get_time (j, snd tw4)))\"\n      by auto\n\n    have \"wline_of tw4 TEMP0 (i + 1) = x\"\n      unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def \n      using \\<open>get_time tw = get_time tw4\\<close> \\<open>get_time tw4 < j\\<close> \\<open>j \\<le> i\\<close> by auto    \n    also have \"bval_of ... \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 (fst tw) \\<and> bval_of_wline tw IN1 (fst tw))\"\n      apply (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n      apply (metis beval_cases(1) comp_apply state_of_world_def val.sel(1))\n      using \\<open>type_of x = Bty\\<close> by auto\n    also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw3 IN0 (fst tw3) \\<and> bval_of_wline tw3 IN1 (fst tw3))\"\n      unfolding tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n    also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 j \\<and> bval_of_wline tw4 IN1 j)\"\n      using * by auto\n    finally have temp2: \"bval_of_wline (j, snd tw4) TEMP0 (i + 1) =\n         (\\<not> (bval_of_wline (j, snd tw4) IN0 (get_time (j, snd tw4)) \\<and> bval_of_wline (j, snd tw4) IN1 (get_time (j, snd tw4))))\"\n      by auto\n\n    have \"wline_of tw4 TEMP1 (i + 1) = xa\"\n      unfolding tw4_def tw3_def tw2_def worldline_upd2_def worldline_upd_def \n      using \\<open>get_time tw = get_time tw4\\<close> \\<open>get_time tw4 < j\\<close> \\<open>j \\<le> i\\<close> by auto    \n    also have \"bval_of ... \\<longleftrightarrow> \\<not> (bval_of_wline tw2 IN0 (fst tw2) \\<or> bval_of_wline tw2 IN1 (fst tw2))\"\n      apply (rule beval_world_raw_cases[OF assms3], erule beval_cases)\n      apply (metis beval_cases(1) comp_apply state_of_world_def val.sel(1))\n      using \\<open>type_of xa = Bty\\<close> by auto\n    also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw3 IN0 (fst tw3) \\<or> bval_of_wline tw3 IN1 (fst tw3))\"\n      unfolding tw3_def tw2_def worldline_upd2_def worldline_upd_def by auto\n    also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw4 IN0 j \\<or> bval_of_wline tw4 IN1 j)\"\n      using * by auto\n    finally have temp3: \"bval_of_wline (j, snd tw4) TEMP1 (i + 1) =\n         (\\<not> (bval_of_wline (j, snd tw4) IN0 (get_time (j, snd tw4)) \\<or> bval_of_wline (j, snd tw4) IN1 (get_time (j, snd tw4))))\"\n      by auto\n    show \"bval_of_wline (j, snd tw4) OUT (i + 1) =\n         (if bval_of_wline (j, snd tw4) SEL (get_time (j, snd tw4)) then bval_of_wline (j, snd tw4) TEMP0 (get_time (j, snd tw4))\n          else bval_of_wline (j, snd tw4) TEMP1 (get_time (j, snd tw4))) \\<and>\n         bval_of_wline (j, snd tw4) TEMP0 (i + 1) =\n         (\\<not> (bval_of_wline (j, snd tw4) IN0 (get_time (j, snd tw4)) \\<and> bval_of_wline (j, snd tw4) IN1 (get_time (j, snd tw4)))) \\<and>\n         bval_of_wline (j, snd tw4) TEMP1 (i + 1) = (\\<not> (bval_of_wline (j, snd tw4) IN0 (get_time (j, snd tw4)) \\<or> bval_of_wline (j, snd tw4) IN1 (get_time (j, snd tw4))))\"\n      using temp1 temp2 temp3 by auto\n  qed\n  thus \"mux2_inv' (j, snd tw[ TEMP0, 1 :=\\<^sub>2 x][ TEMP1, 1 :=\\<^sub>2 xa][ OUT, 1 :=\\<^sub>2 xc])\"\n    unfolding tw4_def tw3_def tw2_def by auto\nqed\n\ntheorem mux2_seq_hoare_next_time'_wityping:\n    \"\\<turnstile> [\\<lambda>tw. wityping \\<Gamma> (snd tw)] mux2_seq\n     [\\<lambda>tw. (\\<forall>j \\<in> {fst tw <.. next_time_world tw}. mux2_inv' (j, snd tw)) \\<and> wityping \\<Gamma> (snd tw)]\"\n  apply (rule Conj)\n   apply (rule mux2_seq_hoare_next_time')\n  apply (rule seq_stmt_preserve_wityping_hoare)\n  using scalar_type_axioms unfolding scalar_type_def by auto\n\nsubsection \\<open>Proving that the concurrent component\\<close>\n\nlemma mux2_inv_conc_hoare:\n  \"\\<And>tw. mux2_inv tw \\<and> mux2_inv' tw \\<and> disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of tw) \\<Longrightarrow> \\<forall>k \\<in> {fst tw <.. next_time_world tw}. mux2_inv (k, snd tw)\"\nproof (rule)\n  fix k\n  fix tw :: \"nat \\<times> (sig \\<Rightarrow> val) \\<times> (sig \\<Rightarrow> nat \\<Rightarrow> val)\"\n  assume \"k \\<in> {fst tw <.. next_time_world tw}\"\n  assume \"mux2_inv tw \\<and> mux2_inv' tw \\<and> disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of tw)\"\n  hence \"mux2_inv tw\" and \"mux2_inv' tw\" and \"disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of tw)\"\n    by auto\n  hence *: \"\\<forall>i < fst tw. bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i)\" and \n        star2:   \"\\<forall>i < fst tw. bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i)\" and \n        star3: \"\\<forall>i < fst tw. bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i)\"\n    unfolding mux2_inv_def by auto\n  have **: \"\\<forall>i\\<ge>fst tw. i < next_time_world tw \\<longrightarrow> (\\<forall>s. wline_of tw s i = wline_of tw s (fst tw))\"\n    using unchanged_until_next_time_world by blast\n  have ***: \"(\\<forall>i\\<ge> fst tw. bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL (fst tw) then bval_of_wline tw TEMP0 (fst tw) else bval_of_wline tw TEMP1 (fst tw)))\" and\n       tstar2: \"(\\<forall>i\\<ge> fst tw. bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 (fst tw) \\<and> bval_of_wline tw IN1 (fst tw)))\" and\n       tstar3: \"(\\<forall>i\\<ge> fst tw. bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 (fst tw) \\<or> bval_of_wline tw IN1 (fst tw)))\" \n    using \\<open>mux2_inv' tw\\<close> \\<open>disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of tw)\\<close> unfolding mux2_inv'_def by auto\n\n  \\<comment> \\<open>obtain the value of A and B at time fst tw\\<close>\n  have  \"wline_of tw SEL (fst tw) = wline_of tw SEL (fst tw - 1)\" and \"wline_of tw IN0 (fst tw) = wline_of tw IN0 (fst tw - 1)\"\n    and \"wline_of tw IN1 (fst tw) = wline_of tw IN1 (fst tw - 1)\" and \"wline_of tw TEMP0 (fst tw) = wline_of tw TEMP0 (fst tw - 1)\"\n    and \"wline_of tw TEMP1 (fst tw) = wline_of tw TEMP1 (fst tw - 1)\"\n    using \\<open>disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of tw)\\<close> unfolding event_of_alt_def\n    by (smt diff_0_eq_0 disjnt_insert1 mem_Collect_eq)+\n { fix i\n    assume \"i < k\"\n    have \"i < fst tw \\<or> fst tw \\<le> i\"\n      by auto\n    moreover\n    { assume \"i < fst tw\"\n      hence \"bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i)\"\n        using * by auto \n      moreover have \"bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i)\"\n        using star2 \\<open>i < fst tw\\<close> by auto\n      moreover have \"bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i)\"\n        using star3 \\<open>i < fst tw\\<close> by auto \n      ultimately have \" (bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i))\n                      \\<and> (bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i))\n                      \\<and> (bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i))\"\n        by auto }\n    moreover\n    { assume \"fst tw \\<le> i\"\n      hence \"bval_of_wline tw OUT (i + 1) = bval_of_wline tw OUT (fst tw + 1)\"\n        using *** by auto\n      also have \"... = (if bval_of_wline tw SEL (fst tw) then bval_of_wline tw TEMP0 (fst tw) else bval_of_wline tw TEMP1 (fst tw))\"\n        using *** \\<open>fst tw \\<le> i\\<close> by auto\n      also have \"... = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i)\"\n        using ** \\<open>i < k\\<close> \\<open>fst tw \\<le> i\\<close> less_imp_le_nat \n        by (smt \\<open>k \\<in> {get_time tw<..next_time_world tw}\\<close> dual_order.strict_trans1\n            greaterThanAtMost_iff)\n      finally have temp1: \"bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i)\"\n        by auto \n      \n      have \"bval_of_wline tw TEMP0 (i + 1) = bval_of_wline tw TEMP0 (fst tw + 1)\"\n        using tstar2 \\<open>fst tw \\<le> i\\<close> by auto\n      also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 (fst tw) \\<and> bval_of_wline tw IN1 (fst tw))\"\n        using tstar2 \\<open>fst tw \\<le> i\\<close> by auto\n      also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i)\"\n        using ** \\<open>i < k\\<close> \\<open>fst tw \\<le> i\\<close> \n        by (smt \\<open>k \\<in> {get_time tw<..next_time_world tw}\\<close> dual_order.strict_trans1 greaterThanAtMost_iff)\n      finally have temp2: \"bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i)\"\n        by auto\n\n      have \"bval_of_wline tw TEMP1 (i + 1) = bval_of_wline tw TEMP1 (fst tw + 1)\"\n        using tstar3 \\<open>fst tw \\<le> i\\<close> by auto\n      also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 (fst tw) \\<or> bval_of_wline tw IN1 (fst tw))\"\n        using tstar3 \\<open>fst tw \\<le> i\\<close> by auto\n      also have \"... \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i)\"\n        using ** \\<open>i < k\\<close> \\<open>fst tw \\<le> i\\<close> \n        by (smt \\<open>k \\<in> {get_time tw<..next_time_world tw}\\<close> dual_order.strict_trans1 greaterThanAtMost_iff)\n      finally have temp3: \"bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i)\"\n        by auto\n      have \" (bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i))\n                      \\<and> (bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i))\n                      \\<and> (bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i))\"\n        using temp1 temp2 temp3 by auto }\n    ultimately have \"(bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i))\n                      \\<and> (bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i))\n                      \\<and> (bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i))\"\n      by auto }\n  hence \"\\<And>i. i < k \\<Longrightarrow> (bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL i then bval_of_wline tw TEMP0 i else bval_of_wline tw TEMP1 i))\n                      \\<and> (bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<and> bval_of_wline tw IN1 i))\n                      \\<and> (bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 i \\<or> bval_of_wline tw IN1 i))\"\n    by auto\n  thus \" mux2_inv (k, snd tw)\"\n    unfolding mux2_inv_def by auto\nqed\n\nlemma mux2_inv'_conc_hoare:\n  \"\\<And>tw. mux2_inv tw \\<and> mux2_inv' tw \\<and> disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. mux2_inv' (j, snd tw)\"\nproof (rule)\n  fix tw :: \"nat \\<times> (sig \\<Rightarrow> val) \\<times> (sig \\<Rightarrow> nat \\<Rightarrow> val)\"\n  fix j\n  assume \"j \\<in> {fst tw <.. next_time_world tw}\"\n  assume \"mux2_inv tw \\<and> mux2_inv' tw \\<and> disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of tw)\"\n  hence \"mux2_inv tw\" and \"mux2_inv' tw\" and \"disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of tw)\"\n    by auto\n  hence 0: \"    (\\<forall>i\\<ge>get_time tw.\n        bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL (get_time tw) then bval_of_wline tw TEMP0 (get_time tw) else bval_of_wline tw TEMP1 (get_time tw)) \\<and>\n        bval_of_wline tw TEMP0 (i + 1) = (\\<not> (bval_of_wline tw IN0 (get_time tw) \\<and> bval_of_wline tw IN1 (get_time tw))) \\<and>\n        bval_of_wline tw TEMP1 (i + 1) = (\\<not> (bval_of_wline tw IN0 (get_time tw) \\<or> bval_of_wline tw IN1 (get_time tw))))\"\n    unfolding mux2_inv'_def by auto\n  have 1: \"\\<forall>i\\<ge>fst tw. i < next_time_world tw \\<longrightarrow> (\\<forall>s. wline_of tw s i = wline_of tw s (fst tw))\"\n    using unchanged_until_next_time_world by blast\n  { assume \"disjnt {IN0, IN1, SEL, TEMP0, TEMP1} (event_of (j, snd tw))\"\n    hence *: \"wline_of tw IN0 j = wline_of tw IN0 (j - 1)\" and **: \"wline_of tw IN1 j = wline_of tw IN1 (j - 1)\"\n        and ***: \"wline_of tw SEL j = wline_of tw SEL (j - 1)\" and ****: \"wline_of tw TEMP0 j = wline_of tw TEMP0 (j - 1)\"\n        and *****: \"wline_of tw TEMP1 j = wline_of tw TEMP1 (j - 1)\"\n      unfolding event_of_alt_def\n      by (smt comp_apply diff_is_0_eq' disjnt_insert1 fst_conv le_numeral_extra(1) mem_Collect_eq snd_conv)+\n    have \"fst tw < j\"\n      using \\<open>j \\<in> {get_time tw<..next_time_world tw}\\<close> by auto\n    { fix i\n      assume \"j \\<le> i\"\n      hence \"bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL (fst tw) then bval_of_wline tw TEMP0 (fst tw) else bval_of_wline tw TEMP1 (fst tw))\"\n        using 0 \\<open>fst tw < j\\<close> by auto\n      moreover have \"wline_of tw IN0 (fst tw) = wline_of tw IN0 (j - 1)\" and \"wline_of tw IN1 (fst tw) = wline_of tw IN1 (j - 1)\"\n        and \"wline_of tw SEL (fst tw) = wline_of tw SEL (j - 1)\" and \"wline_of tw TEMP0 (fst tw) = wline_of tw TEMP0 (j - 1)\" and \n            \"wline_of tw TEMP1 (fst tw) = wline_of tw TEMP1 (j - 1)\"\n        using 1\n        by (metis (no_types, lifting) \\<open>j \\<in> {get_time tw<..next_time_world tw}\\<close> add_le_cancel_right\n        diff_add diff_is_0_eq' discrete gr_implies_not_zero greaterThanAtMost_iff\n        le_numeral_extra(4) neq0_conv)+\n      ultimately have \"bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL j then bval_of_wline tw TEMP0 j else bval_of_wline tw TEMP1 j)\"\n        using * ** *** **** ***** by auto \n      moreover have \"bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 j \\<and> bval_of_wline tw IN1 j)\"\n        using \"*\" \"**\" \"0\" \\<open>get_time tw < j\\<close> \\<open>j \\<le> i\\<close> \\<open>wline_of tw IN0 (get_time tw) = wline_of tw\n        IN0 (j - 1)\\<close> \\<open>wline_of tw IN1 (get_time tw) = wline_of tw IN1 (j - 1)\\<close> by auto\n      moreover have \"bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 j \\<or> bval_of_wline tw IN1 j)\"\n        using \"*\" \"**\" \"0\" \\<open>get_time tw < j\\<close> \\<open>j \\<le> i\\<close> \\<open>wline_of tw IN0 (get_time tw) = wline_of tw IN0 (j - 1)\\<close> \\<open>wline_of tw IN1 (get_time tw) = wline_of tw IN1 (j - 1)\\<close> by auto\n      ultimately have \"(bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL j then bval_of_wline tw TEMP0 j else bval_of_wline tw TEMP1 j)) \\<and>\n                       (bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 j \\<and> bval_of_wline tw IN1 j)) \\<and>\n                       (bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 j \\<or> bval_of_wline tw IN1 j))\"\n        by auto }\n    hence \"(\\<forall>i\\<ge>j. (bval_of_wline tw OUT (i + 1) = (if bval_of_wline tw SEL j then bval_of_wline tw TEMP0 j else bval_of_wline tw TEMP1 j)) \\<and>\n                       (bval_of_wline tw TEMP0 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 j \\<and> bval_of_wline tw IN1 j)) \\<and>\n                       (bval_of_wline tw TEMP1 (i + 1) \\<longleftrightarrow> \\<not> (bval_of_wline tw IN0 j \\<or> bval_of_wline tw IN1 j)))\"\n      by auto }\n  thus \"mux2_inv' (j, snd tw)\"\n    unfolding mux2_inv'_def by auto\nqed\n\nlemma mux2_conc_hoare_without:\n  \"\\<turnstile> \\<lbrace>\\<lambda>tw. (mux2_inv tw \\<and> mux2_inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\n        mux2\n     \\<lbrace>\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. mux2_inv  (j, snd tw)  \\<and> mux2_inv' (j, snd tw)\\<rbrace>\"\n  unfolding mux2_def\n  apply (rule Single)\n   apply (rule Conj_univ_qtfd)\n    apply (rule Conseq2[rotated])\n      apply (rule mux2_seq_hoare_next_time)\n     apply simp\n    apply simp\n   apply(rule Conseq2[rotated])\n     apply (rule mux2_seq_hoare_next_time')\n    apply simp\n   apply simp       \n  using mux2_inv_conc_hoare mux2_inv'_conc_hoare by blast\n\nlemma mux2_conc_hoare:\n  \"\\<turnstile> \\<lbrace>\\<lambda>tw. (mux2_inv tw \\<and> mux2_inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\n        mux2\n     \\<lbrace>\\<lambda>tw. \\<forall>i\\<in>{get_time tw<..next_time_world tw}. (mux2_inv (i, snd tw) \\<and> mux2_inv' (i, snd tw)) \\<and> wityping \\<Gamma> (snd (i, snd tw))\\<rbrace>\"\n  apply (rule Conj2_univ_qtfd)\n   apply (rule weaken_post_conc_hoare[OF _ mux2_conc_hoare_without], blast)\n  apply (rule strengthen_pre_conc_hoare[rotated])\n   apply (rule weaken_post_conc_hoare[rotated])\n  unfolding mux2_def apply (rule single_conc_stmt_preserve_wityping_hoare[where \\<Gamma>=\"\\<Gamma>\"])\n  using scalar_type_axioms unfolding scalar_type_def by auto\n\nsubsection \\<open>Simulation preserves the invariant\\<close>\n\nlemma mux2_conc_sim:\n    \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (mux2_inv tw \\<and> mux2_inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n            mux2 \n        \\<lbrace>\\<lambda>tw. (mux2_inv tw \\<and> mux2_inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule While)\n  apply (unfold snd_conv, rule mux2_conc_hoare[unfolded snd_conv])\n  done\n\nlemma mux2_conc_sim':\n  shows \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (mux2_inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> mux2_inv' tw\\<rbrace> mux2 \\<lbrace>mux2_inv'\\<rbrace>\"\n  apply (rule Conseq_sim[where Q=\"\\<lambda>tw. (mux2_inv tw \\<and> mux2_inv' tw) \\<and> wityping \\<Gamma> (snd tw)\" and\n                               P=\"\\<lambda>tw. (mux2_inv tw \\<and> mux2_inv' tw) \\<and> wityping \\<Gamma> (snd tw)\"])\n  by (blast intro: mux2_conc_sim)+\n\nsubsection \\<open>Initialisation preserves the invariant\\<close>\n\nlemma init_sat_mux2_inv:\n  \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) mux2 (mux2_inv)\"\n  unfolding mux2_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule weaken_postcondition[OF mux2_seq_hoare_next_time0_wityping])\n  done\n\nlemma init_sat_mux_inv':\n  \"init_sim_hoare (\\<lambda>tw. wityping \\<Gamma> (snd tw)) mux2 mux2_inv'\"\n  unfolding mux2_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conseq2[rotated])\n    apply (rule mux2_seq_hoare_next_time'_wityping)\n   apply (simp add: next_time_world_at_least)\n  by auto\n\nlemma init_sat_nand_mux_inv_comb:\n   \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) mux2 (\\<lambda>tw. mux2_inv tw \\<and> mux2_inv' tw)\"\n  apply (rule ConjI_sim)\n   apply (rule init_sat_mux2_inv)\n  apply (rule ConseqI_sim[where P=\"\\<lambda>tw. wityping \\<Gamma> (snd tw)\"])\n  apply (simp, rule init_sat_mux_inv', simp)\n  done\n\nlemma init_sat_nand_mux_inv_comb_wityping:\n  shows \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) mux2 (\\<lambda>tw. (mux2_inv tw \\<and> mux2_inv' tw) \\<and> wityping \\<Gamma> (snd tw))\"\n  apply (rule ConjI_sim)\n   apply (rule ConseqI_sim[rotated])\n     apply (rule init_sat_nand_mux_inv_comb)\n    apply simp\n   apply simp\n  apply (rule strengthen_precondition_init_sim_hoare[rotated])\n  unfolding mux2_def apply (rule single_conc_stmt_preserve_wityping_init_sim_hoare)\n  using scalar_type_axioms unfolding scalar_type_def by auto\n\nlemma mux2_correctness:\n  assumes \"sim_fin w (i + 1) mux2 tw'\" and \"wityping \\<Gamma> w\"\n  assumes \"conc_wt \\<Gamma> mux2\"\n  shows \"\n     bval_of_wline tw' OUT (i + 1) = (if bval_of_wline tw' SEL i then bval_of_wline tw' TEMP0 i else bval_of_wline tw' TEMP1 i) \\<and>\n     bval_of_wline tw' TEMP0 (i + 1) = (\\<not> (bval_of_wline tw' IN0 i \\<and> bval_of_wline tw' IN1 i)) \\<and>\n     bval_of_wline tw' TEMP1 (i + 1) = (\\<not> (bval_of_wline tw' IN0 i \\<or> bval_of_wline tw' IN1 i))\"\nproof -\n  obtain tw where \"init_sim (0, w) mux2 tw\" and  \"tw, i + 1, mux2 \\<Rightarrow>\\<^sub>S tw'\"\n    using premises_sim_fin_obt[OF assms(1)] by auto\n  hence \"i + 1 = fst tw'\"\n    using world_maxtime_lt_fst_tres  by blast\n  have \"conc_stmt_wf mux2\"\n    unfolding conc_stmt_wf_def mux2_def by auto\n  moreover have \"nonneg_delay_conc mux2\"\n    unfolding mux2_def by auto\n  ultimately have \"init_sim_valid (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) mux2 (\\<lambda>tw. mux2_inv tw \\<and> mux2_inv' tw \\<and> wityping \\<Gamma> (snd tw))\"\n    using init_sim_hoare_soundness[OF init_sat_nand_mux_inv_comb_wityping]  by auto\n  hence \"mux2_inv tw \\<and> mux2_inv' tw \\<and> wityping \\<Gamma> (snd tw)\"\n    using \\<open>init_sim (0, w) mux2 tw\\<close> fst_conv assms(2) unfolding init_sim_valid_def\n    by (metis (full_types) snd_conv)\n  hence \"mux2_inv tw\" and \"mux2_inv' tw\" and \"wityping \\<Gamma> (snd tw)\"\n    by auto\n  moreover have \"\\<Turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (mux2_inv tw \\<and> mux2_inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> mux2 \\<lbrace>\\<lambda>tw. (mux2_inv tw \\<and> mux2_inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n    using conc_sim_soundness[OF mux2_conc_sim] \\<open>conc_stmt_wf mux2\\<close> \\<open>nonneg_delay_conc mux2\\<close>\n    by simp\n  ultimately have \"mux2_inv tw'\"\n    using \\<open>tw, i + 1, mux2 \\<Rightarrow>\\<^sub>S tw'\\<close> unfolding sim_hoare_valid_def by blast\n  hence \"\\<forall>i<get_time tw'.\n     bval_of_wline tw' OUT (i + 1) = (if bval_of_wline tw' SEL i then bval_of_wline tw' TEMP0 i else bval_of_wline tw' TEMP1 i) \\<and>\n     bval_of_wline tw' TEMP0 (i + 1) = (\\<not> (bval_of_wline tw' IN0 i \\<and> bval_of_wline tw' IN1 i)) \\<and>\n     bval_of_wline tw' TEMP1 (i + 1) = (\\<not> (bval_of_wline tw' IN0 i \\<or> bval_of_wline tw' IN1 i))\"\n    unfolding mux2_inv_def by auto\n  with \\<open>i + 1 = fst tw'\\<close> show ?thesis\n    by (metis less_add_one)\nqed\n\nend", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Mult_NAND_NOR.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5195213368305399, "lm_q2_score": 0.6039318337259584, "lm_q1q2_score": 0.31375547361182926}}
{"text": "(*  Title:      HOL/Auth/n_flash_nodata_cub.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_flash_nodata_cub Protocol Case Study*} \n\ntheory n_flash_nodata_cub imports n_flash_nodata_cub_lemma_invs_on_rules n_flash_nodata_cub_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/flash_without_data/n_flash_nodata_cub.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318194686359, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3137554572192785}}
{"text": "(*\n    File:        LTermDef.thy\n    Time-stamp:  <2015-12-25T15:39:57Z>\n    Author:      JRF\n    Web:         http://jrf.cocolog-nifty.com/software/2016/01/post.html\n    Logic Image: ZF (of Isabelle2015)\n*)\n\ntheory LTermDef imports Sum Nth OccGraft LVariable begin\n\nconsts\n  LTerm :: i\n  LTag :: i\n\ndatatype\n  LTerm = LVar ( \"x: LVariable\" )\n        | LLam ( \"x: LVariable\", \"M: LTerm\")\n        | LApp ( \"M: LTerm\", \"N: LTerm\")\n\ndatatype\n  LTag = TLVar ( \"x: LVariable\" )\n       | TLLam ( \"x: LVariable\" )\n       | TLApp\n\ndefinition LArity :: \"i=>i\" where\n\"LArity(T) == LTag_case(%x. 0, %x. 1, 2, T)\"\n\ndefinition LTerm_cons :: \"[i, i]=>i\" where\n\"LTerm_cons(T, l) == LTag_case(%x. LVar(x),\n                               %x. LLam(x, nth(0, l)),\n                               LApp(nth(0, l), nth(1, l)), T)\"\n\ndefinition LOcc :: \"i=>i\" where\n  \"LOcc(M) == LTerm_rec(\n            %x. Occ_cons(TLVar(x), []),\n            %x N r. Occ_cons(TLLam(x), [r]),\n            %M N rm rn. Occ_cons(TLApp, [rm, rn]), M)\"\n\ndefinition LOccinv :: \"i=>i\" where\n\"LOccinv(x) == THE M. M: LTerm & x = LOcc(M)\"\n\ndefinition LSub :: \"i=>i\" where\n\"LSub(M) == {<l, LOccinv(Occ_Subtree(l, LOcc(M)))>. <l, T>: LOcc(M)}\"\n\ndefinition Lsubterm :: \"[i, i]=>i\" where\n\"Lsubterm(M, l) == THE N. <l, N>: LSub(M)\"\n\ndefinition Lgraft :: \"[i, i, i]=>i\" where\n\"Lgraft(x, W, y) == LOccinv(Occ_Graft(LOcc(x), W, LOcc(y)))\"\n\nlemma LTerm_rec_type:\n  assumes \"M: LTerm\"\n  and \"!!x. [| x: LVariable |] ==> c(x): C(LVar(x))\"\n  and \"!!x M r. [| x:LVariable;  M: LTerm;  r: C(M) |] ==>\n                   h(x,M,r): C(LLam(x,M))\"\n  and \"!!x M N rm rn. [| M: LTerm;  N: LTerm;\n         rm: C(M); rn: C(N) |] ==> k(M,N,rm,rn): C(LApp(M,N))\"\n  shows \"LTerm_rec(c,h,k,M) : C(M)\"\napply (rule assms(1) [THEN LTerm.induct])\napply (simp_all add: assms)\ndone\n\nlemma LTerm_cons_eqns:\n  \"LTerm_cons(TLVar(x), []) = LVar(x)\"\n  \"LTerm_cons(TLLam(x), [M]) = LLam(x, M)\"\n  \"LTerm_cons(TLApp, [M, N]) = LApp(M, N)\"\napply (simp_all add: LTerm_cons_def)\ndone\n\nlemma LArity_eqns:\n  \"LArity(TLVar(x)) = 0\"\n  \"LArity(TLLam(x)) = 1\"\n  \"LArity(TLApp) = 2\"\napply (simp_all add: LArity_def)\ndone\n\nlemma LOcc_eqns:\n  \"LOcc(LVar(x)) = Occ_cons(TLVar(x), [])\"\n  \"LOcc(LLam(x, M)) = Occ_cons(TLLam(x), [LOcc(M)])\"\n  \"LOcc(LApp(M, N)) = Occ_cons(TLApp, [LOcc(M), LOcc(N)])\"\napply (simp_all add: LOcc_def)\ndone\n\nlemma LTerm_Term_cons_intrs:\n  \"x: LVariable ==> LTerm_cons(TLVar(x), []): LTerm\"\n  \"[| x: LVariable;  M: LTerm |] ==> LTerm_cons(TLLam(x), [M]): LTerm\"\n  \"[| M: LTerm; N: LTerm |] ==> LTerm_cons(TLApp, [M, N]): LTerm\"\napply (simp_all add: LTerm_cons_eqns)\napply (assumption | rule LTerm.intros)+\ndone\n\nlemma LArity_type:\n  \"T: LTag ==> LArity(T): nat\"\napply (erule LTag.cases)\napply (simp_all add: LArity_eqns)\ndone\n\nlemma LTerm_Occ_cons_cond:\n  \"Occ_cons_cond(LTerm, LOcc, LTag, LArity)\"\napply (rule Occ_cons_condI)\napply (elim LTag.cases)\napply (simp_all add: LArity_eqns)\napply (elim LTag.cases)\napply (simp_all add: LArity_eqns)\n\napply (rule bexI)\napply (rule LOcc_eqns)\napply (typecheck add: LTerm.intros)\n\napply (elim bexE conjE)\napply (erule nth_0E)\napply assumption\napply simp\napply simp\napply (rule bexI)\napply (rule LOcc_eqns)\napply (typecheck add: LTerm.intros)\n\napply (elim bexE conjE)\napply (erule nth_0E)\napply assumption\napply simp\napply simp\napply (erule nth_0E)\napply assumption\napply simp\napply simp\napply (rule bexI)\napply (rule LOcc_eqns)\napply (typecheck add: LTerm.intros)\ndone\n\nlemma LTerm_Occ_ind_cond:\n  \"Occ_ind_cond(LTerm, LOcc, LTag, LArity, LTerm_cons)\"\napply (rule Occ_ind_condI)\napply (erule LTerm.induct)\n\napply (drule bspec)\napply (drule_tac [2] bspec)\napply (drule_tac [3] mp)\napply (erule_tac [4] LTerm_cons_eqns [THEN subst])\napply (typecheck add: LTag.intros)\napply (simp add: LTerm_cons_eqns LArity_eqns LOcc_eqns)\napply (typecheck add: LTerm.intros)\n\napply (drule bspec)\napply (drule_tac [2] bspec)\napply (drule_tac [3] mp)\napply (erule_tac [4] LTerm_cons_eqns [THEN subst])\napply (typecheck add: LTag.intros)\napply (simp add: LTerm_cons_eqns LArity_eqns LOcc_eqns)\napply (typecheck add: LTerm.intros)\n\napply (drule bspec)\napply (drule_tac [2] bspec)\napply (drule_tac [3] mp)\napply (erule_tac [4] LTerm_cons_eqns [THEN subst])\napply (typecheck add: LTag.intros)\napply (simp add: LTerm_cons_eqns LArity_eqns LOcc_eqns)\napply (typecheck add: LTerm.intros)\n\ndone\n\nlemma LTerm_Term_cons_inj_cond:\n  \"Term_cons_inj_cond(LTerm, LTag, LArity, LTerm_cons)\"\napply (rule Term_cons_inj_condI)\napply (rule iffI)\napply (elim LTag.cases)\nprefer 10\napply (elim LTag.cases)\napply (simp_all add: LTerm_cons_def LArity_def)\ndone\n\nlemmas LTerm_Term_cons_typechecks = (* nth_typechecks *)\n    LTerm_Term_cons_intrs LTag.intros\n    LArity_type Occ_ind_cond_Occ_domain [OF LTerm_Occ_ind_cond]\n    Occ_ind_cond_Occ_in_Occ_range [OF LTerm_Occ_ind_cond]\n    PowI succI1 succI2\n\ndeclare LTerm_Term_cons_typechecks [TC]\n\nlemmas LTerm_Term_cons_simps = LArity_eqns (* LTerm_cons_eqns [THEN sym] *)\n\ndeclare LTerm_Term_cons_simps [simp]\n\nlemmas LTerm_cons_eqns_sym = LTerm_cons_eqns [THEN sym]\n\nend\n", "meta": {"author": "JRF-2018", "repo": "isabelle_TheLambda", "sha": "e89eff1cbbf26da9bc6a3af603ae9d099d97c1ad", "save_path": "github-repos/isabelle/JRF-2018-isabelle_TheLambda", "path": "github-repos/isabelle/JRF-2018-isabelle_TheLambda/isabelle_TheLambda-e89eff1cbbf26da9bc6a3af603ae9d099d97c1ad/legacy2015/LTermDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6224593171945416, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3136610908376477}}
{"text": "theory Proof\nimports Base Main\nbegin\n\nchapter \\<open>Proofs \\label{ch:proofs}\\<close>\n\ntext \\<open>\n  Proof commands perform transitions of Isar/VM machine\n  configurations, which are block-structured, consisting of a stack of\n  nodes with three main components: logical proof context, current\n  facts, and open goals.  Isar/VM transitions are typed according to\n  the following three different modes of operation:\n\n  \\begin{description}\n\n  \\item @{text \"proof(prove)\"} means that a new goal has just been\n  stated that is now to be \\emph{proven}; the next command may refine\n  it by some proof method, and enter a sub-proof to establish the\n  actual result.\n\n  \\item @{text \"proof(state)\"} is like a nested theory mode: the\n  context may be augmented by \\emph{stating} additional assumptions,\n  intermediate results etc.\n\n  \\item @{text \"proof(chain)\"} is intermediate between @{text\n  \"proof(state)\"} and @{text \"proof(prove)\"}: existing facts (i.e.\\\n  the contents of the special ``@{fact_ref this}'' register) have been\n  just picked up in order to be used when refining the goal claimed\n  next.\n\n  \\end{description}\n\n  The proof mode indicator may be understood as an instruction to the\n  writer, telling what kind of operation may be performed next.  The\n  corresponding typings of proof commands restricts the shape of\n  well-formed proof texts to particular command sequences.  So dynamic\n  arrangements of commands eventually turn out as static texts of a\n  certain structure.\n\n  \\Appref{ap:refcard} gives a simplified grammar of the (extensible)\n  language emerging that way from the different types of proof\n  commands.  The main ideas of the overall Isar framework are\n  explained in \\chref{ch:isar-framework}.\n\\<close>\n\n\nsection \\<open>Proof structure\\<close>\n\nsubsection \\<open>Formal notepad\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"notepad\"} & : & @{text \"local_theory \\<rightarrow> proof(state)\"} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command notepad} @'begin'\n    ;\n    @@{command end}\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command \"notepad\"}~@{keyword \"begin\"} opens a proof state\n  without any goal statement.  This allows to experiment with Isar,\n  without producing any persistent result.\n\n  The notepad can be closed by @{command \"end\"} or discontinued by\n  @{command \"oops\"}.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Blocks\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"next\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"{\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"}\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n  \\end{matharray}\n\n  While Isar is inherently block-structured, opening and closing\n  blocks is mostly handled rather casually, with little explicit\n  user-intervention.  Any local goal statement automatically opens\n  \\emph{two} internal blocks, which are closed again when concluding\n  the sub-proof (by @{command \"qed\"} etc.).  Sections of different\n  context within a sub-proof may be switched via @{command \"next\"},\n  which is just a single block-close followed by block-open again.\n  The effect of @{command \"next\"} is to reset the local proof context;\n  there is no goal focus involved here!\n\n  For slightly more advanced applications, there are explicit block\n  parentheses as well.  These typically achieve a stronger forward\n  style of reasoning.\n\n  \\begin{description}\n\n  \\item @{command \"next\"} switches to a fresh block within a\n  sub-proof, resetting the local context to the initial one.\n\n  \\item @{command \"{\"} and @{command \"}\"} explicitly open and close\n  blocks.  Any current facts pass through ``@{command \"{\"}''\n  unchanged, while ``@{command \"}\"}'' causes any result to be\n  \\emph{exported} into the enclosing context.  Thus fixed variables\n  are generalized, assumptions discharged, and local definitions\n  unfolded (cf.\\ \\secref{sec:proof-context}).  There is no difference\n  of @{command \"assume\"} and @{command \"presume\"} in this mode of\n  forward reasoning --- in contrast to plain backward reasoning with\n  the result exported at @{command \"show\"} time.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Omitting proofs\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"oops\"} & : & @{text \"proof \\<rightarrow> local_theory | theory\"} \\\\\n  \\end{matharray}\n\n  The @{command \"oops\"} command discontinues the current proof\n  attempt, while considering the partial proof text as properly\n  processed.  This is conceptually quite different from ``faking''\n  actual proofs via @{command_ref \"sorry\"} (see\n  \\secref{sec:proof-steps}): @{command \"oops\"} does not observe the\n  proof structure at all, but goes back right to the theory level.\n  Furthermore, @{command \"oops\"} does not produce any result theorem\n  --- there is no intended claim to be able to complete the proof\n  in any way.\n\n  A typical application of @{command \"oops\"} is to explain Isar proofs\n  \\emph{within} the system itself, in conjunction with the document\n  preparation tools of Isabelle described in \\chref{ch:document-prep}.\n  Thus partial or even wrong proof attempts can be discussed in a\n  logically sound manner.  Note that the Isabelle {\\LaTeX} macros can\n  be easily adapted to print something like ``@{text \"\\<dots>\"}'' instead of\n  the keyword ``@{command \"oops\"}''.\n\\<close>\n\n\nsection \\<open>Statements\\<close>\n\nsubsection \\<open>Context elements \\label{sec:proof-context}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"fix\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"assume\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"presume\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"def\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n  \\end{matharray}\n\n  The logical proof context consists of fixed variables and\n  assumptions.  The former closely correspond to Skolem constants, or\n  meta-level universal quantification as provided by the Isabelle/Pure\n  logical framework.  Introducing some \\emph{arbitrary, but fixed}\n  variable via ``@{command \"fix\"}~@{text x}'' results in a local value\n  that may be used in the subsequent proof as any other variable or\n  constant.  Furthermore, any result @{text \"\\<turnstile> \\<phi>[x]\"} exported from\n  the context will be universally closed wrt.\\ @{text x} at the\n  outermost level: @{text \"\\<turnstile> \\<And>x. \\<phi>[x]\"} (this is expressed in normal\n  form using Isabelle's meta-variables).\n\n  Similarly, introducing some assumption @{text \\<chi>} has two effects.\n  On the one hand, a local theorem is created that may be used as a\n  fact in subsequent proof steps.  On the other hand, any result\n  @{text \"\\<chi> \\<turnstile> \\<phi>\"} exported from the context becomes conditional wrt.\\\n  the assumption: @{text \"\\<turnstile> \\<chi> \\<Longrightarrow> \\<phi>\"}.  Thus, solving an enclosing goal\n  using such a result would basically introduce a new subgoal stemming\n  from the assumption.  How this situation is handled depends on the\n  version of assumption command used: while @{command \"assume\"}\n  insists on solving the subgoal by unification with some premise of\n  the goal, @{command \"presume\"} leaves the subgoal unchanged in order\n  to be proved later by the user.\n\n  Local definitions, introduced by ``@{command \"def\"}~@{text \"x \\<equiv>\n  t\"}'', are achieved by combining ``@{command \"fix\"}~@{text x}'' with\n  another version of assumption that causes any hypothetical equation\n  @{text \"x \\<equiv> t\"} to be eliminated by the reflexivity rule.  Thus,\n  exporting some result @{text \"x \\<equiv> t \\<turnstile> \\<phi>[x]\"} yields @{text \"\\<turnstile>\n  \\<phi>[t]\"}.\n\n  @{rail \\<open>\n    @@{command fix} (@{syntax vars} + @'and')\n    ;\n    (@@{command assume} | @@{command presume}) (@{syntax props} + @'and')\n    ;\n    @@{command def} (def + @'and')\n    ;\n    def: @{syntax thmdecl}? \\<newline>\n      @{syntax name} ('==' | '\\<equiv>') @{syntax term} @{syntax term_pat}?\n  \\<close>}\n\n  \\begin{description}\n  \n  \\item @{command \"fix\"}~@{text x} introduces a local variable @{text\n  x} that is \\emph{arbitrary, but fixed.}\n  \n  \\item @{command \"assume\"}~@{text \"a: \\<phi>\"} and @{command\n  \"presume\"}~@{text \"a: \\<phi>\"} introduce a local fact @{text \"\\<phi> \\<turnstile> \\<phi>\"} by\n  assumption.  Subsequent results applied to an enclosing goal (e.g.\\\n  by @{command_ref \"show\"}) are handled as follows: @{command\n  \"assume\"} expects to be able to unify with existing premises in the\n  goal, while @{command \"presume\"} leaves @{text \\<phi>} as new subgoals.\n  \n  Several lists of assumptions may be given (separated by\n  @{keyword_ref \"and\"}; the resulting list of current facts consists\n  of all of these concatenated.\n  \n  \\item @{command \"def\"}~@{text \"x \\<equiv> t\"} introduces a local\n  (non-polymorphic) definition.  In results exported from the context,\n  @{text x} is replaced by @{text t}.  Basically, ``@{command\n  \"def\"}~@{text \"x \\<equiv> t\"}'' abbreviates ``@{command \"fix\"}~@{text\n  x}~@{command \"assume\"}~@{text \"x \\<equiv> t\"}'', with the resulting\n  hypothetical equation solved by reflexivity.\n  \n  The default name for the definitional equation is @{text x_def}.\n  Several simultaneous definitions may be given at the same time.\n\n  \\end{description}\n\n  The special name @{fact_ref prems} refers to all assumptions of the\n  current context as a list of theorems.  This feature should be used\n  with great care!  It is better avoided in final proof texts.\n\\<close>\n\n\nsubsection \\<open>Term abbreviations \\label{sec:term-abbrev}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"let\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{keyword_def \"is\"} & : & syntax \\\\\n  \\end{matharray}\n\n  Abbreviations may be either bound by explicit @{command\n  \"let\"}~@{text \"p \\<equiv> t\"} statements, or by annotating assumptions or\n  goal statements with a list of patterns ``@{text \"(\\<IS> p\\<^sub>1 \\<dots>\n  p\\<^sub>n)\"}''.  In both cases, higher-order matching is invoked to\n  bind extra-logical term variables, which may be either named\n  schematic variables of the form @{text ?x}, or nameless dummies\n  ``@{variable _}'' (underscore). Note that in the @{command \"let\"}\n  form the patterns occur on the left-hand side, while the @{keyword\n  \"is\"} patterns are in postfix position.\n\n  Polymorphism of term bindings is handled in Hindley-Milner style,\n  similar to ML.  Type variables referring to local assumptions or\n  open goal statements are \\emph{fixed}, while those of finished\n  results or bound by @{command \"let\"} may occur in \\emph{arbitrary}\n  instances later.  Even though actual polymorphism should be rarely\n  used in practice, this mechanism is essential to achieve proper\n  incremental type-inference, as the user proceeds to build up the\n  Isar proof text from left to right.\n\n  \\medskip Term abbreviations are quite different from local\n  definitions as introduced via @{command \"def\"} (see\n  \\secref{sec:proof-context}).  The latter are visible within the\n  logic as actual equations, while abbreviations disappear during the\n  input process just after type checking.  Also note that @{command\n  \"def\"} does not support polymorphism.\n\n  @{rail \\<open>\n    @@{command let} ((@{syntax term} + @'and') '=' @{syntax term} + @'and')\n  \\<close>}\n\n  The syntax of @{keyword \"is\"} patterns follows @{syntax term_pat} or\n  @{syntax prop_pat} (see \\secref{sec:term-decls}).\n\n  \\begin{description}\n\n  \\item @{command \"let\"}~@{text \"p\\<^sub>1 = t\\<^sub>1 \\<AND> \\<dots> p\\<^sub>n = t\\<^sub>n\"} binds any\n  text variables in patterns @{text \"p\\<^sub>1, \\<dots>, p\\<^sub>n\"} by simultaneous\n  higher-order matching against terms @{text \"t\\<^sub>1, \\<dots>, t\\<^sub>n\"}.\n\n  \\item @{text \"(\\<IS> p\\<^sub>1 \\<dots> p\\<^sub>n)\"} resembles @{command \"let\"}, but\n  matches @{text \"p\\<^sub>1, \\<dots>, p\\<^sub>n\"} against the preceding statement.  Also\n  note that @{keyword \"is\"} is not a separate command, but part of\n  others (such as @{command \"assume\"}, @{command \"have\"} etc.).\n\n  \\end{description}\n\n  Some \\emph{implicit} term abbreviations\\index{term abbreviations}\n  for goals and facts are available as well.  For any open goal,\n  @{variable_ref thesis} refers to its object-level statement,\n  abstracted over any meta-level parameters (if present).  Likewise,\n  @{variable_ref this} is bound for fact statements resulting from\n  assumptions or finished goals.  In case @{variable this} refers to\n  an object-logic statement that is an application @{text \"f t\"}, then\n  @{text t} is bound to the special text variable ``@{variable \"\\<dots>\"}''\n  (three dots).  The canonical application of this convenience are\n  calculational proofs (see \\secref{sec:calculation}).\n\\<close>\n\n\nsubsection \\<open>Facts and forward chaining \\label{sec:proof-facts}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"note\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"then\"} & : & @{text \"proof(state) \\<rightarrow> proof(chain)\"} \\\\\n    @{command_def \"from\"} & : & @{text \"proof(state) \\<rightarrow> proof(chain)\"} \\\\\n    @{command_def \"with\"} & : & @{text \"proof(state) \\<rightarrow> proof(chain)\"} \\\\\n    @{command_def \"using\"} & : & @{text \"proof(prove) \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"unfolding\"} & : & @{text \"proof(prove) \\<rightarrow> proof(prove)\"} \\\\\n  \\end{matharray}\n\n  New facts are established either by assumption or proof of local\n  statements.  Any fact will usually be involved in further proofs,\n  either as explicit arguments of proof methods, or when forward\n  chaining towards the next goal via @{command \"then\"} (and variants);\n  @{command \"from\"} and @{command \"with\"} are composite forms\n  involving @{command \"note\"}.  The @{command \"using\"} elements\n  augments the collection of used facts \\emph{after} a goal has been\n  stated.  Note that the special theorem name @{fact_ref this} refers\n  to the most recently established facts, but only \\emph{before}\n  issuing a follow-up claim.\n\n  @{rail \\<open>\n    @@{command note} (@{syntax thmdef}? @{syntax thmrefs} + @'and')\n    ;\n    (@@{command from} | @@{command with} | @@{command using} | @@{command unfolding})\n      (@{syntax thmrefs} + @'and')\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command \"note\"}~@{text \"a = b\\<^sub>1 \\<dots> b\\<^sub>n\"} recalls existing facts\n  @{text \"b\\<^sub>1, \\<dots>, b\\<^sub>n\"}, binding the result as @{text a}.  Note that\n  attributes may be involved as well, both on the left and right hand\n  sides.\n\n  \\item @{command \"then\"} indicates forward chaining by the current\n  facts in order to establish the goal to be claimed next.  The\n  initial proof method invoked to refine that will be offered the\n  facts to do ``anything appropriate'' (see also\n  \\secref{sec:proof-steps}).  For example, method @{method (Pure) rule}\n  (see \\secref{sec:pure-meth-att}) would typically do an elimination\n  rather than an introduction.  Automatic methods usually insert the\n  facts into the goal state before operation.  This provides a simple\n  scheme to control relevance of facts in automated proof search.\n  \n  \\item @{command \"from\"}~@{text b} abbreviates ``@{command\n  \"note\"}~@{text b}~@{command \"then\"}''; thus @{command \"then\"} is\n  equivalent to ``@{command \"from\"}~@{text this}''.\n  \n  \\item @{command \"with\"}~@{text \"b\\<^sub>1 \\<dots> b\\<^sub>n\"} abbreviates ``@{command\n  \"from\"}~@{text \"b\\<^sub>1 \\<dots> b\\<^sub>n \\<AND> this\"}''; thus the forward chaining\n  is from earlier facts together with the current ones.\n  \n  \\item @{command \"using\"}~@{text \"b\\<^sub>1 \\<dots> b\\<^sub>n\"} augments the facts being\n  currently indicated for use by a subsequent refinement step (such as\n  @{command_ref \"apply\"} or @{command_ref \"proof\"}).\n  \n  \\item @{command \"unfolding\"}~@{text \"b\\<^sub>1 \\<dots> b\\<^sub>n\"} is structurally\n  similar to @{command \"using\"}, but unfolds definitional equations\n  @{text \"b\\<^sub>1, \\<dots> b\\<^sub>n\"} throughout the goal state and facts.\n\n  \\end{description}\n\n  Forward chaining with an empty list of theorems is the same as not\n  chaining at all.  Thus ``@{command \"from\"}~@{text nothing}'' has no\n  effect apart from entering @{text \"prove(chain)\"} mode, since\n  @{fact_ref nothing} is bound to the empty list of theorems.\n\n  Basic proof methods (such as @{method_ref (Pure) rule}) expect multiple\n  facts to be given in their proper order, corresponding to a prefix\n  of the premises of the rule involved.  Note that positions may be\n  easily skipped using something like @{command \"from\"}~@{text \"_\n  \\<AND> a \\<AND> b\"}, for example.  This involves the trivial rule\n  @{text \"PROP \\<psi> \\<Longrightarrow> PROP \\<psi>\"}, which is bound in Isabelle/Pure as\n  ``@{fact_ref \"_\"}'' (underscore).\n\n  Automated methods (such as @{method simp} or @{method auto}) just\n  insert any given facts before their usual operation.  Depending on\n  the kind of procedure involved, the order of facts is less\n  significant here.\n\\<close>\n\n\nsubsection \\<open>Goals \\label{sec:goals}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"lemma\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"theorem\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"corollary\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"schematic_lemma\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"schematic_theorem\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"schematic_corollary\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"have\"} & : & @{text \"proof(state) | proof(chain) \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"show\"} & : & @{text \"proof(state) | proof(chain) \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"hence\"} & : & @{text \"proof(state) \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"thus\"} & : & @{text \"proof(state) \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"print_statement\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n  \\end{matharray}\n\n  From a theory context, proof mode is entered by an initial goal\n  command such as @{command \"lemma\"}, @{command \"theorem\"}, or\n  @{command \"corollary\"}.  Within a proof, new claims may be\n  introduced locally as well; four variants are available here to\n  indicate whether forward chaining of facts should be performed\n  initially (via @{command_ref \"then\"}), and whether the final result\n  is meant to solve some pending goal.\n\n  Goals may consist of multiple statements, resulting in a list of\n  facts eventually.  A pending multi-goal is internally represented as\n  a meta-level conjunction (@{text \"&&&\"}), which is usually\n  split into the corresponding number of sub-goals prior to an initial\n  method application, via @{command_ref \"proof\"}\n  (\\secref{sec:proof-steps}) or @{command_ref \"apply\"}\n  (\\secref{sec:tactic-commands}).  The @{method_ref induct} method\n  covered in \\secref{sec:cases-induct} acts on multiple claims\n  simultaneously.\n\n  Claims at the theory level may be either in short or long form.  A\n  short goal merely consists of several simultaneous propositions\n  (often just one).  A long goal includes an explicit context\n  specification for the subsequent conclusion, involving local\n  parameters and assumptions.  Here the role of each part of the\n  statement is explicitly marked by separate keywords (see also\n  \\secref{sec:locale}); the local assumptions being introduced here\n  are available as @{fact_ref assms} in the proof.  Moreover, there\n  are two kinds of conclusions: @{element_def \"shows\"} states several\n  simultaneous propositions (essentially a big conjunction), while\n  @{element_def \"obtains\"} claims several simultaneous simultaneous\n  contexts of (essentially a big disjunction of eliminated parameters\n  and assumptions, cf.\\ \\secref{sec:obtain}).\n\n  @{rail \\<open>\n    (@@{command lemma} | @@{command theorem} | @@{command corollary} |\n     @@{command schematic_lemma} | @@{command schematic_theorem} |\n     @@{command schematic_corollary}) @{syntax target}? (goal | longgoal)\n    ;\n    (@@{command have} | @@{command show} | @@{command hence} | @@{command thus}) goal\n    ;\n    @@{command print_statement} @{syntax modes}? @{syntax thmrefs}\n    ;\n  \n    goal: (@{syntax props} + @'and')\n    ;\n    longgoal: @{syntax thmdecl}? (@{syntax_ref \"includes\"}?) (@{syntax context_elem} * ) conclusion\n    ;\n    conclusion: @'shows' goal | @'obtains' (@{syntax parname}? case + '|')\n    ;\n    case: (@{syntax vars} + @'and') @'where' (@{syntax props} + @'and')\n  \\<close>}\n\n  \\begin{description}\n  \n  \\item @{command \"lemma\"}~@{text \"a: \\<phi>\"} enters proof mode with\n  @{text \\<phi>} as main goal, eventually resulting in some fact @{text \"\\<turnstile>\n  \\<phi>\"} to be put back into the target context.  An additional @{syntax\n  context} specification may build up an initial proof context for the\n  subsequent claim; this includes local definitions and syntax as\n  well, see also @{syntax \"includes\"} in \\secref{sec:bundle} and\n  @{syntax context_elem} in \\secref{sec:locale}.\n  \n  \\item @{command \"theorem\"}~@{text \"a: \\<phi>\"} and @{command\n  \"corollary\"}~@{text \"a: \\<phi>\"} are essentially the same as @{command\n  \"lemma\"}~@{text \"a: \\<phi>\"}, but the facts are internally marked as\n  being of a different kind.  This discrimination acts like a formal\n  comment.\n\n  \\item @{command \"schematic_lemma\"}, @{command \"schematic_theorem\"},\n  @{command \"schematic_corollary\"} are similar to @{command \"lemma\"},\n  @{command \"theorem\"}, @{command \"corollary\"}, respectively but allow\n  the statement to contain unbound schematic variables.\n\n  Under normal circumstances, an Isar proof text needs to specify\n  claims explicitly.  Schematic goals are more like goals in Prolog,\n  where certain results are synthesized in the course of reasoning.\n  With schematic statements, the inherent compositionality of Isar\n  proofs is lost, which also impacts performance, because proof\n  checking is forced into sequential mode.\n  \n  \\item @{command \"have\"}~@{text \"a: \\<phi>\"} claims a local goal,\n  eventually resulting in a fact within the current logical context.\n  This operation is completely independent of any pending sub-goals of\n  an enclosing goal statements, so @{command \"have\"} may be freely\n  used for experimental exploration of potential results within a\n  proof body.\n  \n  \\item @{command \"show\"}~@{text \"a: \\<phi>\"} is like @{command\n  \"have\"}~@{text \"a: \\<phi>\"} plus a second stage to refine some pending\n  sub-goal for each one of the finished result, after having been\n  exported into the corresponding context (at the head of the\n  sub-proof of this @{command \"show\"} command).\n  \n  To accommodate interactive debugging, resulting rules are printed\n  before being applied internally.  Even more, interactive execution\n  of @{command \"show\"} predicts potential failure and displays the\n  resulting error as a warning beforehand.  Watch out for the\n  following message:\n\n  %FIXME proper antiquotation\n  \\begin{ttbox}\n  Problem! Local statement will fail to solve any pending goal\n  \\end{ttbox}\n  \n  \\item @{command \"hence\"} abbreviates ``@{command \"then\"}~@{command\n  \"have\"}'', i.e.\\ claims a local goal to be proven by forward\n  chaining the current facts.  Note that @{command \"hence\"} is also\n  equivalent to ``@{command \"from\"}~@{text this}~@{command \"have\"}''.\n  \n  \\item @{command \"thus\"} abbreviates ``@{command \"then\"}~@{command\n  \"show\"}''.  Note that @{command \"thus\"} is also equivalent to\n  ``@{command \"from\"}~@{text this}~@{command \"show\"}''.\n  \n  \\item @{command \"print_statement\"}~@{text a} prints facts from the\n  current theory or proof context in long statement form, according to\n  the syntax for @{command \"lemma\"} given above.\n\n  \\end{description}\n\n  Any goal statement causes some term abbreviations (such as\n  @{variable_ref \"?thesis\"}) to be bound automatically, see also\n  \\secref{sec:term-abbrev}.\n\n  The optional case names of @{element_ref \"obtains\"} have a twofold\n  meaning: (1) in the proof of this claim they refer to the local context\n  introductions, (2) in the resulting rule they become annotations for\n  symbolic case splits, e.g.\\ for the @{method_ref cases} method\n  (\\secref{sec:cases-induct}).\n\\<close>\n\n\nsection \\<open>Refinement steps\\<close>\n\nsubsection \\<open>Proof method expressions \\label{sec:proof-meth}\\<close>\n\ntext \\<open>Proof methods are either basic ones, or expressions composed\n  of methods via ``@{verbatim \",\"}'' (sequential composition),\n  ``@{verbatim \"|\"}'' (alternative choices), ``@{verbatim \"?\"}''\n  (try), ``@{verbatim \"+\"}'' (repeat at least once), ``@{verbatim\n  \"[\"}@{text n}@{verbatim \"]\"}'' (restriction to first @{text n}\n  sub-goals, with default @{text \"n = 1\"}).  In practice, proof\n  methods are usually just a comma separated list of @{syntax\n  nameref}~@{syntax args} specifications.  Note that parentheses may\n  be dropped for single method specifications (with no arguments).\n\n  @{rail \\<open>\n    @{syntax_def method}:\n      (@{syntax nameref} | '(' methods ')') (() | '?' | '+' | '[' @{syntax nat}? ']')\n    ;\n    methods: (@{syntax nameref} @{syntax args} | @{syntax method}) + (',' | '|')\n  \\<close>}\n\n  Proper Isar proof methods do \\emph{not} admit arbitrary goal\n  addressing, but refer either to the first sub-goal or all sub-goals\n  uniformly.  The goal restriction operator ``@{text \"[n]\"}''\n  evaluates a method expression within a sandbox consisting of the\n  first @{text n} sub-goals (which need to exist).  For example, the\n  method ``@{text \"simp_all[3]\"}'' simplifies the first three\n  sub-goals, while ``@{text \"(rule foo, simp_all)[]\"}'' simplifies all\n  new goals that emerge from applying rule @{text \"foo\"} to the\n  originally first one.\n\n  Improper methods, notably tactic emulations, offer a separate\n  low-level goal addressing scheme as explicit argument to the\n  individual tactic being involved.  Here ``@{text \"[!]\"}'' refers to\n  all goals, and ``@{text \"[n-]\"}'' to all goals starting from @{text\n  \"n\"}.\n\n  @{rail \\<open>\n    @{syntax_def goal_spec}:\n      '[' (@{syntax nat} '-' @{syntax nat} | @{syntax nat} '-' | @{syntax nat} | '!' ) ']'\n  \\<close>}\n\\<close>\n\n\nsubsection \\<open>Initial and terminal proof steps \\label{sec:proof-steps}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"proof\"} & : & @{text \"proof(prove) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"qed\"} & : & @{text \"proof(state) \\<rightarrow> proof(state) | local_theory | theory\"} \\\\\n    @{command_def \"by\"} & : & @{text \"proof(prove) \\<rightarrow> proof(state) | local_theory | theory\"} \\\\\n    @{command_def \"..\"} & : & @{text \"proof(prove) \\<rightarrow> proof(state) | local_theory | theory\"} \\\\\n    @{command_def \".\"} & : & @{text \"proof(prove) \\<rightarrow> proof(state) | local_theory | theory\"} \\\\\n    @{command_def \"sorry\"} & : & @{text \"proof(prove) \\<rightarrow> proof(state) | local_theory | theory\"} \\\\\n  \\end{matharray}\n\n  Arbitrary goal refinement via tactics is considered harmful.\n  Structured proof composition in Isar admits proof methods to be\n  invoked in two places only.\n\n  \\begin{enumerate}\n\n  \\item An \\emph{initial} refinement step @{command_ref\n  \"proof\"}~@{text \"m\\<^sub>1\"} reduces a newly stated goal to a number\n  of sub-goals that are to be solved later.  Facts are passed to\n  @{text \"m\\<^sub>1\"} for forward chaining, if so indicated by @{text\n  \"proof(chain)\"} mode.\n  \n  \\item A \\emph{terminal} conclusion step @{command_ref \"qed\"}~@{text\n  \"m\\<^sub>2\"} is intended to solve remaining goals.  No facts are\n  passed to @{text \"m\\<^sub>2\"}.\n\n  \\end{enumerate}\n\n  The only other (proper) way to affect pending goals in a proof body\n  is by @{command_ref \"show\"}, which involves an explicit statement of\n  what is to be solved eventually.  Thus we avoid the fundamental\n  problem of unstructured tactic scripts that consist of numerous\n  consecutive goal transformations, with invisible effects.\n\n  \\medskip As a general rule of thumb for good proof style, initial\n  proof methods should either solve the goal completely, or constitute\n  some well-understood reduction to new sub-goals.  Arbitrary\n  automatic proof tools that are prone leave a large number of badly\n  structured sub-goals are no help in continuing the proof document in\n  an intelligible manner.\n\n  Unless given explicitly by the user, the default initial method is\n  @{method_ref (Pure) rule} (or its classical variant @{method_ref\n  rule}), which applies a single standard elimination or introduction\n  rule according to the topmost symbol involved.  There is no separate\n  default terminal method.  Any remaining goals are always solved by\n  assumption in the very last step.\n\n  @{rail \\<open>\n    @@{command proof} method?\n    ;\n    @@{command qed} method?\n    ;\n    @@{command \"by\"} method method?\n    ;\n    (@@{command \".\"} | @@{command \"..\"} | @@{command sorry})\n  \\<close>}\n\n  \\begin{description}\n  \n  \\item @{command \"proof\"}~@{text \"m\\<^sub>1\"} refines the goal by proof\n  method @{text \"m\\<^sub>1\"}; facts for forward chaining are passed if so\n  indicated by @{text \"proof(chain)\"} mode.\n  \n  \\item @{command \"qed\"}~@{text \"m\\<^sub>2\"} refines any remaining goals by\n  proof method @{text \"m\\<^sub>2\"} and concludes the sub-proof by assumption.\n  If the goal had been @{text \"show\"} (or @{text \"thus\"}), some\n  pending sub-goal is solved as well by the rule resulting from the\n  result \\emph{exported} into the enclosing goal context.  Thus @{text\n  \"qed\"} may fail for two reasons: either @{text \"m\\<^sub>2\"} fails, or the\n  resulting rule does not fit to any pending goal\\footnote{This\n  includes any additional ``strong'' assumptions as introduced by\n  @{command \"assume\"}.} of the enclosing context.  Debugging such a\n  situation might involve temporarily changing @{command \"show\"} into\n  @{command \"have\"}, or weakening the local context by replacing\n  occurrences of @{command \"assume\"} by @{command \"presume\"}.\n  \n  \\item @{command \"by\"}~@{text \"m\\<^sub>1 m\\<^sub>2\"} is a \\emph{terminal\n  proof}\\index{proof!terminal}; it abbreviates @{command\n  \"proof\"}~@{text \"m\\<^sub>1\"}~@{command \"qed\"}~@{text \"m\\<^sub>2\"}, but with\n  backtracking across both methods.  Debugging an unsuccessful\n  @{command \"by\"}~@{text \"m\\<^sub>1 m\\<^sub>2\"} command can be done by expanding its\n  definition; in many cases @{command \"proof\"}~@{text \"m\\<^sub>1\"} (or even\n  @{text \"apply\"}~@{text \"m\\<^sub>1\"}) is already sufficient to see the\n  problem.\n\n  \\item ``@{command \"..\"}'' is a \\emph{default\n  proof}\\index{proof!default}; it abbreviates @{command \"by\"}~@{text\n  \"rule\"}.\n\n  \\item ``@{command \".\"}'' is a \\emph{trivial\n  proof}\\index{proof!trivial}; it abbreviates @{command \"by\"}~@{text\n  \"this\"}.\n  \n  \\item @{command \"sorry\"} is a \\emph{fake proof}\\index{proof!fake}\n  pretending to solve the pending claim without further ado.  This\n  only works in interactive development, or if the @{attribute\n  quick_and_dirty} is enabled.  Facts emerging from fake\n  proofs are not the real thing.  Internally, the derivation object is\n  tainted by an oracle invocation, which may be inspected via the\n  theorem status @{cite \"isabelle-implementation\"}.\n  \n  The most important application of @{command \"sorry\"} is to support\n  experimentation and top-down proof development.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Fundamental methods and attributes \\label{sec:pure-meth-att}\\<close>\n\ntext \\<open>\n  The following proof methods and attributes refer to basic logical\n  operations of Isar.  Further methods and attributes are provided by\n  several generic and object-logic specific tools and packages (see\n  \\chref{ch:gen-tools} and \\partref{part:hol}).\n\n  \\begin{matharray}{rcl}\n    @{command_def \"print_rules\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\[0.5ex]\n    @{method_def \"-\"} & : & @{text method} \\\\\n    @{method_def \"fact\"} & : & @{text method} \\\\\n    @{method_def \"assumption\"} & : & @{text method} \\\\\n    @{method_def \"this\"} & : & @{text method} \\\\\n    @{method_def (Pure) \"rule\"} & : & @{text method} \\\\\n    @{attribute_def (Pure) \"intro\"} & : & @{text attribute} \\\\\n    @{attribute_def (Pure) \"elim\"} & : & @{text attribute} \\\\\n    @{attribute_def (Pure) \"dest\"} & : & @{text attribute} \\\\\n    @{attribute_def (Pure) \"rule\"} & : & @{text attribute} \\\\[0.5ex]\n    @{attribute_def \"OF\"} & : & @{text attribute} \\\\\n    @{attribute_def \"of\"} & : & @{text attribute} \\\\\n    @{attribute_def \"where\"} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method fact} @{syntax thmrefs}?\n    ;\n    @@{method (Pure) rule} @{syntax thmrefs}?\n    ;\n    rulemod: ('intro' | 'elim' | 'dest')\n      ((('!' | () | '?') @{syntax nat}?) | 'del') ':' @{syntax thmrefs}\n    ;\n    (@@{attribute intro} | @@{attribute elim} | @@{attribute dest})\n      ('!' | () | '?') @{syntax nat}?\n    ;\n    @@{attribute (Pure) rule} 'del'\n    ;\n    @@{attribute OF} @{syntax thmrefs}\n    ;\n    @@{attribute of} @{syntax insts} ('concl' ':' @{syntax insts})? \\<newline>\n      (@'for' (@{syntax vars} + @'and'))?\n    ;\n    @@{attribute \"where\"}\n      ((@{syntax name} | @{syntax var} | @{syntax typefree} | @{syntax typevar}) '='\n      (@{syntax type} | @{syntax term}) * @'and') \\<newline>\n      (@'for' (@{syntax vars} + @'and'))?\n  \\<close>}\n\n  \\begin{description}\n  \n  \\item @{command \"print_rules\"} prints rules declared via attributes\n  @{attribute (Pure) intro}, @{attribute (Pure) elim}, @{attribute\n  (Pure) dest} of Isabelle/Pure.\n\n  See also the analogous @{command \"print_claset\"} command for similar\n  rule declarations of the classical reasoner\n  (\\secref{sec:classical}).\n\n  \\item ``@{method \"-\"}'' (minus) does nothing but insert the forward\n  chaining facts as premises into the goal.  Note that command\n  @{command_ref \"proof\"} without any method actually performs a single\n  reduction step using the @{method_ref (Pure) rule} method; thus a plain\n  \\emph{do-nothing} proof step would be ``@{command \"proof\"}~@{text\n  \"-\"}'' rather than @{command \"proof\"} alone.\n  \n  \\item @{method \"fact\"}~@{text \"a\\<^sub>1 \\<dots> a\\<^sub>n\"} composes some fact from\n  @{text \"a\\<^sub>1, \\<dots>, a\\<^sub>n\"} (or implicitly from the current proof context)\n  modulo unification of schematic type and term variables.  The rule\n  structure is not taken into account, i.e.\\ meta-level implication is\n  considered atomic.  This is the same principle underlying literal\n  facts (cf.\\ \\secref{sec:syn-att}): ``@{command \"have\"}~@{text\n  \"\\<phi>\"}~@{command \"by\"}~@{text fact}'' is equivalent to ``@{command\n  \"note\"}~@{verbatim \"`\"}@{text \\<phi>}@{verbatim \"`\"}'' provided that\n  @{text \"\\<turnstile> \\<phi>\"} is an instance of some known @{text \"\\<turnstile> \\<phi>\"} in the\n  proof context.\n  \n  \\item @{method assumption} solves some goal by a single assumption\n  step.  All given facts are guaranteed to participate in the\n  refinement; this means there may be only 0 or 1 in the first place.\n  Recall that @{command \"qed\"} (\\secref{sec:proof-steps}) already\n  concludes any remaining sub-goals by assumption, so structured\n  proofs usually need not quote the @{method assumption} method at\n  all.\n  \n  \\item @{method this} applies all of the current facts directly as\n  rules.  Recall that ``@{command \".\"}'' (dot) abbreviates ``@{command\n  \"by\"}~@{text this}''.\n  \n  \\item @{method (Pure) rule}~@{text \"a\\<^sub>1 \\<dots> a\\<^sub>n\"} applies some rule given as\n  argument in backward manner; facts are used to reduce the rule\n  before applying it to the goal.  Thus @{method (Pure) rule} without facts\n  is plain introduction, while with facts it becomes elimination.\n  \n  When no arguments are given, the @{method (Pure) rule} method tries to pick\n  appropriate rules automatically, as declared in the current context\n  using the @{attribute (Pure) intro}, @{attribute (Pure) elim},\n  @{attribute (Pure) dest} attributes (see below).  This is the\n  default behavior of @{command \"proof\"} and ``@{command \"..\"}'' \n  (double-dot) steps (see \\secref{sec:proof-steps}).\n  \n  \\item @{attribute (Pure) intro}, @{attribute (Pure) elim}, and\n  @{attribute (Pure) dest} declare introduction, elimination, and\n  destruct rules, to be used with method @{method (Pure) rule}, and similar\n  tools.  Note that the latter will ignore rules declared with\n  ``@{text \"?\"}'', while ``@{text \"!\"}''  are used most aggressively.\n  \n  The classical reasoner (see \\secref{sec:classical}) introduces its\n  own variants of these attributes; use qualified names to access the\n  present versions of Isabelle/Pure, i.e.\\ @{attribute (Pure)\n  \"Pure.intro\"}.\n  \n  \\item @{attribute (Pure) rule}~@{text del} undeclares introduction,\n  elimination, or destruct rules.\n\n  \\item @{attribute OF}~@{text \"a\\<^sub>1 \\<dots> a\\<^sub>n\"} applies some theorem to all\n  of the given rules @{text \"a\\<^sub>1, \\<dots>, a\\<^sub>n\"} in canonical right-to-left\n  order, which means that premises stemming from the @{text \"a\\<^sub>i\"}\n  emerge in parallel in the result, without interfering with each\n  other.  In many practical situations, the @{text \"a\\<^sub>i\"} do not have\n  premises themselves, so @{text \"rule [OF a\\<^sub>1 \\<dots> a\\<^sub>n]\"} can be actually\n  read as functional application (modulo unification).\n\n  Argument positions may be effectively skipped by using ``@{text _}''\n  (underscore), which refers to the propositional identity rule in the\n  Pure theory.\n  \n  \\item @{attribute of}~@{text \"t\\<^sub>1 \\<dots> t\\<^sub>n\"} performs positional\n  instantiation of term variables.  The terms @{text \"t\\<^sub>1, \\<dots>, t\\<^sub>n\"} are\n  substituted for any schematic variables occurring in a theorem from\n  left to right; ``@{text _}'' (underscore) indicates to skip a\n  position.  Arguments following a ``@{text \"concl:\"}'' specification\n  refer to positions of the conclusion of a rule.\n\n  An optional context of local variables @{text \"\\<FOR> x\\<^sub>1 \\<dots> x\\<^sub>m\"} may\n  be specified: the instantiated theorem is exported, and these\n  variables become schematic (usually with some shifting of indices).\n  \n  \\item @{attribute \"where\"}~@{text \"x\\<^sub>1 = t\\<^sub>1 \\<AND> \\<dots> x\\<^sub>n = t\\<^sub>n\"}\n  performs named instantiation of schematic type and term variables\n  occurring in a theorem.  Schematic variables have to be specified on\n  the left-hand side (e.g.\\ @{text \"?x1.3\"}).  The question mark may\n  be omitted if the variable name is a plain identifier without index.\n  As type instantiations are inferred from term instantiations,\n  explicit type instantiations are seldom necessary.\n\n  An optional context of local variables @{text \"\\<FOR> x\\<^sub>1 \\<dots> x\\<^sub>m\"} may\n  be specified as for @{attribute \"of\"} above.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Emulating tactic scripts \\label{sec:tactic-commands}\\<close>\n\ntext \\<open>\n  The Isar provides separate commands to accommodate tactic-style\n  proof scripts within the same system.  While being outside the\n  orthodox Isar proof language, these might come in handy for\n  interactive exploration and debugging, or even actual tactical proof\n  within new-style theories (to benefit from document preparation, for\n  example).  See also \\secref{sec:tactics} for actual tactics, that\n  have been encapsulated as proof methods.  Proper proof methods may\n  be used in scripts, too.\n\n  \\begin{matharray}{rcl}\n    @{command_def \"apply\"}@{text \"\\<^sup>*\"} & : & @{text \"proof(prove) \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"apply_end\"}@{text \"\\<^sup>*\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"done\"}@{text \"\\<^sup>*\"} & : & @{text \"proof(prove) \\<rightarrow> proof(state) | local_theory | theory\"} \\\\\n    @{command_def \"defer\"}@{text \"\\<^sup>*\"} & : & @{text \"proof \\<rightarrow> proof\"} \\\\\n    @{command_def \"prefer\"}@{text \"\\<^sup>*\"} & : & @{text \"proof \\<rightarrow> proof\"} \\\\\n    @{command_def \"back\"}@{text \"\\<^sup>*\"} & : & @{text \"proof \\<rightarrow> proof\"} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    ( @@{command apply} | @@{command apply_end} ) @{syntax method}\n    ;\n    @@{command defer} @{syntax nat}?\n    ;\n    @@{command prefer} @{syntax nat}\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command \"apply\"}~@{text m} applies proof method @{text m} in\n  initial position, but unlike @{command \"proof\"} it retains ``@{text\n  \"proof(prove)\"}'' mode.  Thus consecutive method applications may be\n  given just as in tactic scripts.\n  \n  Facts are passed to @{text m} as indicated by the goal's\n  forward-chain mode, and are \\emph{consumed} afterwards.  Thus any\n  further @{command \"apply\"} command would always work in a purely\n  backward manner.\n  \n  \\item @{command \"apply_end\"}~@{text \"m\"} applies proof method @{text\n  m} as if in terminal position.  Basically, this simulates a\n  multi-step tactic script for @{command \"qed\"}, but may be given\n  anywhere within the proof body.\n  \n  No facts are passed to @{text m} here.  Furthermore, the static\n  context is that of the enclosing goal (as for actual @{command\n  \"qed\"}).  Thus the proof method may not refer to any assumptions\n  introduced in the current body, for example.\n  \n  \\item @{command \"done\"} completes a proof script, provided that the\n  current goal state is solved completely.  Note that actual\n  structured proof commands (e.g.\\ ``@{command \".\"}'' or @{command\n  \"sorry\"}) may be used to conclude proof scripts as well.\n\n  \\item @{command \"defer\"}~@{text n} and @{command \"prefer\"}~@{text n}\n  shuffle the list of pending goals: @{command \"defer\"} puts off\n  sub-goal @{text n} to the end of the list (@{text \"n = 1\"} by\n  default), while @{command \"prefer\"} brings sub-goal @{text n} to the\n  front.\n  \n  \\item @{command \"back\"} does back-tracking over the result sequence\n  of the latest proof command.  Any proof command may return multiple\n  results, and this command explores the possibilities step-by-step.\n  It is mainly useful for experimentation and interactive exploration,\n  and should be avoided in finished proofs.\n  \n  \\end{description}\n\n  Any proper Isar proof method may be used with tactic script commands\n  such as @{command \"apply\"}.  A few additional emulations of actual\n  tactics are provided as well; these would be never used in actual\n  structured proofs, of course.\n\\<close>\n\n\nsubsection \\<open>Defining proof methods\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"method_setup\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command method_setup} @{syntax target}?\n      @{syntax name} '=' @{syntax text} @{syntax text}?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command \"method_setup\"}~@{text \"name = text description\"}\n  defines a proof method in the current context.  The given @{text\n  \"text\"} has to be an ML expression of type\n  @{ML_type \"(Proof.context -> Proof.method) context_parser\"}, cf.\\\n  basic parsers defined in structure @{ML_structure Args} and @{ML_structure\n  Attrib}.  There are also combinators like @{ML METHOD} and @{ML\n  SIMPLE_METHOD} to turn certain tactic forms into official proof\n  methods; the primed versions refer to tactics with explicit goal\n  addressing.\n\n  Here are some example method definitions:\n\n  \\end{description}\n\\<close>\n\n  method_setup my_method1 =\n    \\<open>Scan.succeed (K (SIMPLE_METHOD' (fn i: int => no_tac)))\\<close>\n    \"my first method (without any arguments)\"\n\n  method_setup my_method2 =\n    \\<open>Scan.succeed (fn ctxt: Proof.context =>\n      SIMPLE_METHOD' (fn i: int => no_tac))\\<close>\n    \"my second method (with context)\"\n\n  method_setup my_method3 =\n    \\<open>Attrib.thms >> (fn thms: thm list => fn ctxt: Proof.context =>\n      SIMPLE_METHOD' (fn i: int => no_tac))\\<close>\n    \"my third method (with theorem arguments and context)\"\n\n\nsection \\<open>Generalized elimination \\label{sec:obtain}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"obtain\"} & : & @{text \"proof(state) | proof(chain) \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def \"guess\"}@{text \"\\<^sup>*\"} & : & @{text \"proof(state) | proof(chain) \\<rightarrow> proof(prove)\"} \\\\\n  \\end{matharray}\n\n  Generalized elimination means that additional elements with certain\n  properties may be introduced in the current context, by virtue of a\n  locally proven ``soundness statement''.  Technically speaking, the\n  @{command \"obtain\"} language element is like a declaration of\n  @{command \"fix\"} and @{command \"assume\"} (see also see\n  \\secref{sec:proof-context}), together with a soundness proof of its\n  additional claim.  According to the nature of existential reasoning,\n  assumptions get eliminated from any result exported from the context\n  later, provided that the corresponding parameters do \\emph{not}\n  occur in the conclusion.\n\n  @{rail \\<open>\n    @@{command obtain} @{syntax parname}? (@{syntax vars} + @'and')\n      @'where' (@{syntax props} + @'and')\n    ;\n    @@{command guess} (@{syntax vars} + @'and')\n  \\<close>}\n\n  The derived Isar command @{command \"obtain\"} is defined as follows\n  (where @{text \"b\\<^sub>1, \\<dots>, b\\<^sub>k\"} shall refer to (optional)\n  facts indicated for forward chaining).\n  \\begin{matharray}{l}\n    @{text \"\\<langle>using b\\<^sub>1 \\<dots> b\\<^sub>k\\<rangle>\"}~~@{command \"obtain\"}~@{text \"x\\<^sub>1 \\<dots> x\\<^sub>m \\<WHERE> a: \\<phi>\\<^sub>1 \\<dots> \\<phi>\\<^sub>n  \\<langle>proof\\<rangle> \\<equiv>\"} \\\\[1ex]\n    \\quad @{command \"have\"}~@{text \"\\<And>thesis. (\\<And>x\\<^sub>1 \\<dots> x\\<^sub>m. \\<phi>\\<^sub>1 \\<Longrightarrow> \\<dots> \\<phi>\\<^sub>n \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\"} \\\\\n    \\quad @{command \"proof\"}~@{method succeed} \\\\\n    \\qquad @{command \"fix\"}~@{text thesis} \\\\\n    \\qquad @{command \"assume\"}~@{text \"that [Pure.intro?]: \\<And>x\\<^sub>1 \\<dots> x\\<^sub>m. \\<phi>\\<^sub>1 \\<Longrightarrow> \\<dots> \\<phi>\\<^sub>n \\<Longrightarrow> thesis\"} \\\\\n    \\qquad @{command \"then\"}~@{command \"show\"}~@{text thesis} \\\\\n    \\quad\\qquad @{command \"apply\"}~@{text -} \\\\\n    \\quad\\qquad @{command \"using\"}~@{text \"b\\<^sub>1 \\<dots> b\\<^sub>k  \\<langle>proof\\<rangle>\"} \\\\\n    \\quad @{command \"qed\"} \\\\\n    \\quad @{command \"fix\"}~@{text \"x\\<^sub>1 \\<dots> x\\<^sub>m\"}~@{command \"assume\"}@{text \"\\<^sup>* a: \\<phi>\\<^sub>1 \\<dots> \\<phi>\\<^sub>n\"} \\\\\n  \\end{matharray}\n\n  Typically, the soundness proof is relatively straight-forward, often\n  just by canonical automated tools such as ``@{command \"by\"}~@{text\n  simp}'' or ``@{command \"by\"}~@{text blast}''.  Accordingly, the\n  ``@{text that}'' reduction above is declared as simplification and\n  introduction rule.\n\n  In a sense, @{command \"obtain\"} represents at the level of Isar\n  proofs what would be meta-logical existential quantifiers and\n  conjunctions.  This concept has a broad range of useful\n  applications, ranging from plain elimination (or introduction) of\n  object-level existential and conjunctions, to elimination over\n  results of symbolic evaluation of recursive definitions, for\n  example.  Also note that @{command \"obtain\"} without parameters acts\n  much like @{command \"have\"}, where the result is treated as a\n  genuine assumption.\n\n  An alternative name to be used instead of ``@{text that}'' above may\n  be given in parentheses.\n\n  \\medskip The improper variant @{command \"guess\"} is similar to\n  @{command \"obtain\"}, but derives the obtained statement from the\n  course of reasoning!  The proof starts with a fixed goal @{text\n  thesis}.  The subsequent proof may refine this to anything of the\n  form like @{text \"\\<And>x\\<^sub>1 \\<dots> x\\<^sub>m. \\<phi>\\<^sub>1 \\<Longrightarrow> \\<dots>\n  \\<phi>\\<^sub>n \\<Longrightarrow> thesis\"}, but must not introduce new subgoals.  The\n  final goal state is then used as reduction rule for the obtain\n  scheme described above.  Obtained parameters @{text \"x\\<^sub>1, \\<dots>,\n  x\\<^sub>m\"} are marked as internal by default, which prevents the\n  proof context from being polluted by ad-hoc variables.  The variable\n  names and type constraints given as arguments for @{command \"guess\"}\n  specify a prefix of obtained parameters explicitly in the text.\n\n  It is important to note that the facts introduced by @{command\n  \"obtain\"} and @{command \"guess\"} may not be polymorphic: any\n  type-variables occurring here are fixed in the present context!\n\\<close>\n\n\nsection \\<open>Calculational reasoning \\label{sec:calculation}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"also\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"finally\"} & : & @{text \"proof(state) \\<rightarrow> proof(chain)\"} \\\\\n    @{command_def \"moreover\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"ultimately\"} & : & @{text \"proof(state) \\<rightarrow> proof(chain)\"} \\\\\n    @{command_def \"print_trans_rules\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{attribute trans} & : & @{text attribute} \\\\\n    @{attribute sym} & : & @{text attribute} \\\\\n    @{attribute symmetric} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  Calculational proof is forward reasoning with implicit application\n  of transitivity rules (such those of @{text \"=\"}, @{text \"\\<le>\"},\n  @{text \"<\"}).  Isabelle/Isar maintains an auxiliary fact register\n  @{fact_ref calculation} for accumulating results obtained by\n  transitivity composed with the current result.  Command @{command\n  \"also\"} updates @{fact calculation} involving @{fact this}, while\n  @{command \"finally\"} exhibits the final @{fact calculation} by\n  forward chaining towards the next goal statement.  Both commands\n  require valid current facts, i.e.\\ may occur only after commands\n  that produce theorems such as @{command \"assume\"}, @{command\n  \"note\"}, or some finished proof of @{command \"have\"}, @{command\n  \"show\"} etc.  The @{command \"moreover\"} and @{command \"ultimately\"}\n  commands are similar to @{command \"also\"} and @{command \"finally\"},\n  but only collect further results in @{fact calculation} without\n  applying any rules yet.\n\n  Also note that the implicit term abbreviation ``@{text \"\\<dots>\"}'' has\n  its canonical application with calculational proofs.  It refers to\n  the argument of the preceding statement. (The argument of a curried\n  infix expression happens to be its right-hand side.)\n\n  Isabelle/Isar calculations are implicitly subject to block structure\n  in the sense that new threads of calculational reasoning are\n  commenced for any new block (as opened by a local goal, for\n  example).  This means that, apart from being able to nest\n  calculations, there is no separate \\emph{begin-calculation} command\n  required.\n\n  \\medskip The Isar calculation proof commands may be defined as\n  follows:\\footnote{We suppress internal bookkeeping such as proper\n  handling of block-structure.}\n\n  \\begin{matharray}{rcl}\n    @{command \"also\"}@{text \"\\<^sub>0\"} & \\equiv & @{command \"note\"}~@{text \"calculation = this\"} \\\\\n    @{command \"also\"}@{text \"\\<^sub>n+1\"} & \\equiv & @{command \"note\"}~@{text \"calculation = trans [OF calculation this]\"} \\\\[0.5ex]\n    @{command \"finally\"} & \\equiv & @{command \"also\"}~@{command \"from\"}~@{text calculation} \\\\[0.5ex]\n    @{command \"moreover\"} & \\equiv & @{command \"note\"}~@{text \"calculation = calculation this\"} \\\\\n    @{command \"ultimately\"} & \\equiv & @{command \"moreover\"}~@{command \"from\"}~@{text calculation} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    (@@{command also} | @@{command finally}) ('(' @{syntax thmrefs} ')')?\n    ;\n    @@{attribute trans} (() | 'add' | 'del')\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command \"also\"}~@{text \"(a\\<^sub>1 \\<dots> a\\<^sub>n)\"} maintains the auxiliary\n  @{fact calculation} register as follows.  The first occurrence of\n  @{command \"also\"} in some calculational thread initializes @{fact\n  calculation} by @{fact this}. Any subsequent @{command \"also\"} on\n  the same level of block-structure updates @{fact calculation} by\n  some transitivity rule applied to @{fact calculation} and @{fact\n  this} (in that order).  Transitivity rules are picked from the\n  current context, unless alternative rules are given as explicit\n  arguments.\n\n  \\item @{command \"finally\"}~@{text \"(a\\<^sub>1 \\<dots> a\\<^sub>n)\"} maintaining @{fact\n  calculation} in the same way as @{command \"also\"}, and concludes the\n  current calculational thread.  The final result is exhibited as fact\n  for forward chaining towards the next goal. Basically, @{command\n  \"finally\"} just abbreviates @{command \"also\"}~@{command\n  \"from\"}~@{fact calculation}.  Typical idioms for concluding\n  calculational proofs are ``@{command \"finally\"}~@{command\n  \"show\"}~@{text ?thesis}~@{command \".\"}'' and ``@{command\n  \"finally\"}~@{command \"have\"}~@{text \\<phi>}~@{command \".\"}''.\n\n  \\item @{command \"moreover\"} and @{command \"ultimately\"} are\n  analogous to @{command \"also\"} and @{command \"finally\"}, but collect\n  results only, without applying rules.\n\n  \\item @{command \"print_trans_rules\"} prints the list of transitivity\n  rules (for calculational commands @{command \"also\"} and @{command\n  \"finally\"}) and symmetry rules (for the @{attribute symmetric}\n  operation and single step elimination patters) of the current\n  context.\n\n  \\item @{attribute trans} declares theorems as transitivity rules.\n\n  \\item @{attribute sym} declares symmetry rules, as well as\n  @{attribute \"Pure.elim\"}@{text \"?\"} rules.\n\n  \\item @{attribute symmetric} resolves a theorem with some rule\n  declared as @{attribute sym} in the current context.  For example,\n  ``@{command \"assume\"}~@{text \"[symmetric]: x = y\"}'' produces a\n  swapped fact derived from that assumption.\n\n  In structured proof texts it is often more appropriate to use an\n  explicit single-step elimination proof, such as ``@{command\n  \"assume\"}~@{text \"x = y\"}~@{command \"then\"}~@{command \"have\"}~@{text\n  \"y = x\"}~@{command \"..\"}''.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Proof by cases and induction \\label{sec:cases-induct}\\<close>\n\nsubsection \\<open>Rule contexts\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"case\"} & : & @{text \"proof(state) \\<rightarrow> proof(state)\"} \\\\\n    @{command_def \"print_cases\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{attribute_def case_names} & : & @{text attribute} \\\\\n    @{attribute_def case_conclusion} & : & @{text attribute} \\\\\n    @{attribute_def params} & : & @{text attribute} \\\\\n    @{attribute_def consumes} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  The puristic way to build up Isar proof contexts is by explicit\n  language elements like @{command \"fix\"}, @{command \"assume\"},\n  @{command \"let\"} (see \\secref{sec:proof-context}).  This is adequate\n  for plain natural deduction, but easily becomes unwieldy in concrete\n  verification tasks, which typically involve big induction rules with\n  several cases.\n\n  The @{command \"case\"} command provides a shorthand to refer to a\n  local context symbolically: certain proof methods provide an\n  environment of named ``cases'' of the form @{text \"c: x\\<^sub>1, \\<dots>,\n  x\\<^sub>m, \\<phi>\\<^sub>1, \\<dots>, \\<phi>\\<^sub>n\"}; the effect of ``@{command\n  \"case\"}~@{text c}'' is then equivalent to ``@{command \"fix\"}~@{text\n  \"x\\<^sub>1 \\<dots> x\\<^sub>m\"}~@{command \"assume\"}~@{text \"c: \\<phi>\\<^sub>1 \\<dots>\n  \\<phi>\\<^sub>n\"}''.  Term bindings may be covered as well, notably\n  @{variable ?case} for the main conclusion.\n\n  By default, the ``terminology'' @{text \"x\\<^sub>1, \\<dots>, x\\<^sub>m\"} of\n  a case value is marked as hidden, i.e.\\ there is no way to refer to\n  such parameters in the subsequent proof text.  After all, original\n  rule parameters stem from somewhere outside of the current proof\n  text.  By using the explicit form ``@{command \"case\"}~@{text \"(c\n  y\\<^sub>1 \\<dots> y\\<^sub>m)\"}'' instead, the proof author is able to\n  chose local names that fit nicely into the current context.\n\n  \\medskip It is important to note that proper use of @{command\n  \"case\"} does not provide means to peek at the current goal state,\n  which is not directly observable in Isar!  Nonetheless, goal\n  refinement commands do provide named cases @{text \"goal\\<^sub>i\"}\n  for each subgoal @{text \"i = 1, \\<dots>, n\"} of the resulting goal state.\n  Using this extra feature requires great care, because some bits of\n  the internal tactical machinery intrude the proof text.  In\n  particular, parameter names stemming from the left-over of automated\n  reasoning tools are usually quite unpredictable.\n\n  Under normal circumstances, the text of cases emerge from standard\n  elimination or induction rules, which in turn are derived from\n  previous theory specifications in a canonical way (say from\n  @{command \"inductive\"} definitions).\n\n  \\medskip Proper cases are only available if both the proof method\n  and the rules involved support this.  By using appropriate\n  attributes, case names, conclusions, and parameters may be also\n  declared by hand.  Thus variant versions of rules that have been\n  derived manually become ready to use in advanced case analysis\n  later.\n\n  @{rail \\<open>\n    @@{command case} (caseref | '(' caseref (('_' | @{syntax name}) *) ')')\n    ;\n    caseref: nameref attributes?\n    ;\n\n    @@{attribute case_names} ((@{syntax name} ( '[' (('_' | @{syntax name}) +) ']' ) ? ) +)\n    ;\n    @@{attribute case_conclusion} @{syntax name} (@{syntax name} * )\n    ;\n    @@{attribute params} ((@{syntax name} * ) + @'and')\n    ;\n    @@{attribute consumes} @{syntax int}?\n  \\<close>}\n\n  \\begin{description}\n  \n  \\item @{command \"case\"}~@{text \"(c x\\<^sub>1 \\<dots> x\\<^sub>m)\"} invokes a named local\n  context @{text \"c: x\\<^sub>1, \\<dots>, x\\<^sub>m, \\<phi>\\<^sub>1, \\<dots>, \\<phi>\\<^sub>m\"}, as provided by an\n  appropriate proof method (such as @{method_ref cases} and\n  @{method_ref induct}).  The command ``@{command \"case\"}~@{text \"(c\n  x\\<^sub>1 \\<dots> x\\<^sub>m)\"}'' abbreviates ``@{command \"fix\"}~@{text \"x\\<^sub>1 \\<dots>\n  x\\<^sub>m\"}~@{command \"assume\"}~@{text \"c: \\<phi>\\<^sub>1 \\<dots> \\<phi>\\<^sub>n\"}''.\n\n  \\item @{command \"print_cases\"} prints all local contexts of the\n  current state, using Isar proof language notation.\n  \n  \\item @{attribute case_names}~@{text \"c\\<^sub>1 \\<dots> c\\<^sub>k\"} declares names for\n  the local contexts of premises of a theorem; @{text \"c\\<^sub>1, \\<dots>, c\\<^sub>k\"}\n  refers to the \\emph{prefix} of the list of premises. Each of the\n  cases @{text \"c\\<^sub>i\"} can be of the form @{text \"c[h\\<^sub>1 \\<dots> h\\<^sub>n]\"} where\n  the @{text \"h\\<^sub>1 \\<dots> h\\<^sub>n\"} are the names of the hypotheses in case @{text \"c\\<^sub>i\"}\n  from left to right.\n  \n  \\item @{attribute case_conclusion}~@{text \"c d\\<^sub>1 \\<dots> d\\<^sub>k\"} declares\n  names for the conclusions of a named premise @{text c}; here @{text\n  \"d\\<^sub>1, \\<dots>, d\\<^sub>k\"} refers to the prefix of arguments of a logical formula\n  built by nesting a binary connective (e.g.\\ @{text \"\\<or>\"}).\n  \n  Note that proof methods such as @{method induct} and @{method\n  coinduct} already provide a default name for the conclusion as a\n  whole.  The need to name subformulas only arises with cases that\n  split into several sub-cases, as in common co-induction rules.\n\n  \\item @{attribute params}~@{text \"p\\<^sub>1 \\<dots> p\\<^sub>m \\<AND> \\<dots> q\\<^sub>1 \\<dots> q\\<^sub>n\"} renames\n  the innermost parameters of premises @{text \"1, \\<dots>, n\"} of some\n  theorem.  An empty list of names may be given to skip positions,\n  leaving the present parameters unchanged.\n  \n  Note that the default usage of case rules does \\emph{not} directly\n  expose parameters to the proof context.\n  \n  \\item @{attribute consumes}~@{text n} declares the number of ``major\n  premises'' of a rule, i.e.\\ the number of facts to be consumed when\n  it is applied by an appropriate proof method.  The default value of\n  @{attribute consumes} is @{text \"n = 1\"}, which is appropriate for\n  the usual kind of cases and induction rules for inductive sets (cf.\\\n  \\secref{sec:hol-inductive}).  Rules without any @{attribute\n  consumes} declaration given are treated as if @{attribute\n  consumes}~@{text 0} had been specified.\n\n  A negative @{text n} is interpreted relatively to the total number\n  of premises of the rule in the target context.  Thus its absolute\n  value specifies the remaining number of premises, after subtracting\n  the prefix of major premises as indicated above. This form of\n  declaration has the technical advantage of being stable under more\n  morphisms, notably those that export the result from a nested\n  @{command_ref context} with additional assumptions.\n\n  Note that explicit @{attribute consumes} declarations are only\n  rarely needed; this is already taken care of automatically by the\n  higher-level @{attribute cases}, @{attribute induct}, and\n  @{attribute coinduct} declarations.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Proof methods\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def cases} & : & @{text method} \\\\\n    @{method_def induct} & : & @{text method} \\\\\n    @{method_def induction} & : & @{text method} \\\\\n    @{method_def coinduct} & : & @{text method} \\\\\n  \\end{matharray}\n\n  The @{method cases}, @{method induct}, @{method induction},\n  and @{method coinduct}\n  methods provide a uniform interface to common proof techniques over\n  datatypes, inductive predicates (or sets), recursive functions etc.\n  The corresponding rules may be specified and instantiated in a\n  casual manner.  Furthermore, these methods provide named local\n  contexts that may be invoked via the @{command \"case\"} proof command\n  within the subsequent proof text.  This accommodates compact proof\n  texts even when reasoning about large specifications.\n\n  The @{method induct} method also provides some additional\n  infrastructure in order to be applicable to structure statements\n  (either using explicit meta-level connectives, or including facts\n  and parameters separately).  This avoids cumbersome encoding of\n  ``strengthened'' inductive statements within the object-logic.\n\n  Method @{method induction} differs from @{method induct} only in\n  the names of the facts in the local context invoked by the @{command \"case\"}\n  command.\n\n  @{rail \\<open>\n    @@{method cases} ('(' 'no_simp' ')')? \\<newline>\n      (@{syntax insts} * @'and') rule?\n    ;\n    (@@{method induct} | @@{method induction})\n      ('(' 'no_simp' ')')? (definsts * @'and') \\<newline> arbitrary? taking? rule?\n    ;\n    @@{method coinduct} @{syntax insts} taking rule?\n    ;\n\n    rule: ('type' | 'pred' | 'set') ':' (@{syntax nameref} +) | 'rule' ':' (@{syntax thmref} +)\n    ;\n    definst: @{syntax name} ('==' | '\\<equiv>') @{syntax term} | '(' @{syntax term} ')' | @{syntax inst}\n    ;\n    definsts: ( definst * )\n    ;\n    arbitrary: 'arbitrary' ':' ((@{syntax term} * ) @'and' +)\n    ;\n    taking: 'taking' ':' @{syntax insts}\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{method cases}~@{text \"insts R\"} applies method @{method\n  rule} with an appropriate case distinction theorem, instantiated to\n  the subjects @{text insts}.  Symbolic case names are bound according\n  to the rule's local contexts.\n\n  The rule is determined as follows, according to the facts and\n  arguments passed to the @{method cases} method:\n\n  \\medskip\n  \\begin{tabular}{llll}\n    facts           &                 & arguments   & rule \\\\\\hline\n                    & @{method cases} &             & classical case split \\\\\n                    & @{method cases} & @{text t}   & datatype exhaustion (type of @{text t}) \\\\\n    @{text \"\\<turnstile> A t\"} & @{method cases} & @{text \"\\<dots>\"} & inductive predicate/set elimination (of @{text A}) \\\\\n    @{text \"\\<dots>\"}     & @{method cases} & @{text \"\\<dots> rule: R\"} & explicit rule @{text R} \\\\\n  \\end{tabular}\n  \\medskip\n\n  Several instantiations may be given, referring to the \\emph{suffix}\n  of premises of the case rule; within each premise, the \\emph{prefix}\n  of variables is instantiated.  In most situations, only a single\n  term needs to be specified; this refers to the first variable of the\n  last premise (it is usually the same for all cases).  The @{text\n  \"(no_simp)\"} option can be used to disable pre-simplification of\n  cases (see the description of @{method induct} below for details).\n\n  \\item @{method induct}~@{text \"insts R\"} and\n  @{method induction}~@{text \"insts R\"} are analogous to the\n  @{method cases} method, but refer to induction rules, which are\n  determined as follows:\n\n  \\medskip\n  \\begin{tabular}{llll}\n    facts           &                  & arguments            & rule \\\\\\hline\n                    & @{method induct} & @{text \"P x\"}        & datatype induction (type of @{text x}) \\\\\n    @{text \"\\<turnstile> A x\"} & @{method induct} & @{text \"\\<dots>\"}          & predicate/set induction (of @{text A}) \\\\\n    @{text \"\\<dots>\"}     & @{method induct} & @{text \"\\<dots> rule: R\"} & explicit rule @{text R} \\\\\n  \\end{tabular}\n  \\medskip\n  \n  Several instantiations may be given, each referring to some part of\n  a mutual inductive definition or datatype --- only related partial\n  induction rules may be used together, though.  Any of the lists of\n  terms @{text \"P, x, \\<dots>\"} refers to the \\emph{suffix} of variables\n  present in the induction rule.  This enables the writer to specify\n  only induction variables, or both predicates and variables, for\n  example.\n\n  Instantiations may be definitional: equations @{text \"x \\<equiv> t\"}\n  introduce local definitions, which are inserted into the claim and\n  discharged after applying the induction rule.  Equalities reappear\n  in the inductive cases, but have been transformed according to the\n  induction principle being involved here.  In order to achieve\n  practically useful induction hypotheses, some variables occurring in\n  @{text t} need to be fixed (see below).  Instantiations of the form\n  @{text t}, where @{text t} is not a variable, are taken as a\n  shorthand for \\mbox{@{text \"x \\<equiv> t\"}}, where @{text x} is a fresh\n  variable. If this is not intended, @{text t} has to be enclosed in\n  parentheses.  By default, the equalities generated by definitional\n  instantiations are pre-simplified using a specific set of rules,\n  usually consisting of distinctness and injectivity theorems for\n  datatypes. This pre-simplification may cause some of the parameters\n  of an inductive case to disappear, or may even completely delete\n  some of the inductive cases, if one of the equalities occurring in\n  their premises can be simplified to @{text False}.  The @{text\n  \"(no_simp)\"} option can be used to disable pre-simplification.\n  Additional rules to be used in pre-simplification can be declared\n  using the @{attribute_def induct_simp} attribute.\n\n  The optional ``@{text \"arbitrary: x\\<^sub>1 \\<dots> x\\<^sub>m\"}''\n  specification generalizes variables @{text \"x\\<^sub>1, \\<dots>,\n  x\\<^sub>m\"} of the original goal before applying induction.  One can\n  separate variables by ``@{text \"and\"}'' to generalize them in other\n  goals then the first. Thus induction hypotheses may become\n  sufficiently general to get the proof through.  Together with\n  definitional instantiations, one may effectively perform induction\n  over expressions of a certain structure.\n  \n  The optional ``@{text \"taking: t\\<^sub>1 \\<dots> t\\<^sub>n\"}''\n  specification provides additional instantiations of a prefix of\n  pending variables in the rule.  Such schematic induction rules\n  rarely occur in practice, though.\n\n  \\item @{method coinduct}~@{text \"inst R\"} is analogous to the\n  @{method induct} method, but refers to coinduction rules, which are\n  determined as follows:\n\n  \\medskip\n  \\begin{tabular}{llll}\n    goal          &                    & arguments & rule \\\\\\hline\n                  & @{method coinduct} & @{text x} & type coinduction (type of @{text x}) \\\\\n    @{text \"A x\"} & @{method coinduct} & @{text \"\\<dots>\"} & predicate/set coinduction (of @{text A}) \\\\\n    @{text \"\\<dots>\"}   & @{method coinduct} & @{text \"\\<dots> rule: R\"} & explicit rule @{text R} \\\\\n  \\end{tabular}\n  \n  Coinduction is the dual of induction.  Induction essentially\n  eliminates @{text \"A x\"} towards a generic result @{text \"P x\"},\n  while coinduction introduces @{text \"A x\"} starting with @{text \"B\n  x\"}, for a suitable ``bisimulation'' @{text B}.  The cases of a\n  coinduct rule are typically named after the predicates or sets being\n  covered, while the conclusions consist of several alternatives being\n  named after the individual destructor patterns.\n  \n  The given instantiation refers to the \\emph{suffix} of variables\n  occurring in the rule's major premise, or conclusion if unavailable.\n  An additional ``@{text \"taking: t\\<^sub>1 \\<dots> t\\<^sub>n\"}''\n  specification may be required in order to specify the bisimulation\n  to be used in the coinduction step.\n\n  \\end{description}\n\n  Above methods produce named local contexts, as determined by the\n  instantiated rule as given in the text.  Beyond that, the @{method\n  induct} and @{method coinduct} methods guess further instantiations\n  from the goal specification itself.  Any persisting unresolved\n  schematic variables of the resulting rule will render the the\n  corresponding case invalid.  The term binding @{variable ?case} for\n  the conclusion will be provided with each case, provided that term\n  is fully specified.\n\n  The @{command \"print_cases\"} command prints all named cases present\n  in the current proof state.\n\n  \\medskip Despite the additional infrastructure, both @{method cases}\n  and @{method coinduct} merely apply a certain rule, after\n  instantiation, while conforming due to the usual way of monotonic\n  natural deduction: the context of a structured statement @{text\n  \"\\<And>x\\<^sub>1 \\<dots> x\\<^sub>m. \\<phi>\\<^sub>1 \\<Longrightarrow> \\<dots> \\<phi>\\<^sub>n \\<Longrightarrow> \\<dots>\"}\n  reappears unchanged after the case split.\n\n  The @{method induct} method is fundamentally different in this\n  respect: the meta-level structure is passed through the\n  ``recursive'' course involved in the induction.  Thus the original\n  statement is basically replaced by separate copies, corresponding to\n  the induction hypotheses and conclusion; the original goal context\n  is no longer available.  Thus local assumptions, fixed parameters\n  and definitions effectively participate in the inductive rephrasing\n  of the original statement.\n\n  In @{method induct} proofs, local assumptions introduced by cases are split\n  into two different kinds: @{text hyps} stemming from the rule and\n  @{text prems} from the goal statement.  This is reflected in the\n  extracted cases accordingly, so invoking ``@{command \"case\"}~@{text\n  c}'' will provide separate facts @{text c.hyps} and @{text c.prems},\n  as well as fact @{text c} to hold the all-inclusive list.\n\n  In @{method induction} proofs, local assumptions introduced by cases are\n  split into three different kinds: @{text IH}, the induction hypotheses,\n  @{text hyps}, the remaining hypotheses stemming from the rule, and\n  @{text prems}, the assumptions from the goal statement. The names are\n  @{text c.IH}, @{text c.hyps} and @{text c.prems}, as above.\n\n\n  \\medskip Facts presented to either method are consumed according to\n  the number of ``major premises'' of the rule involved, which is\n  usually 0 for plain cases and induction rules of datatypes etc.\\ and\n  1 for rules of inductive predicates or sets and the like.  The\n  remaining facts are inserted into the goal verbatim before the\n  actual @{text cases}, @{text induct}, or @{text coinduct} rule is\n  applied.\n\\<close>\n\n\nsubsection \\<open>Declaring rules\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def \"print_induct_rules\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{attribute_def cases} & : & @{text attribute} \\\\\n    @{attribute_def induct} & : & @{text attribute} \\\\\n    @{attribute_def coinduct} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{attribute cases} spec\n    ;\n    @@{attribute induct} spec\n    ;\n    @@{attribute coinduct} spec\n    ;\n\n    spec: (('type' | 'pred' | 'set') ':' @{syntax nameref}) | 'del'\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command \"print_induct_rules\"} prints cases and induct rules\n  for predicates (or sets) and types of the current context.\n\n  \\item @{attribute cases}, @{attribute induct}, and @{attribute\n  coinduct} (as attributes) declare rules for reasoning about\n  (co)inductive predicates (or sets) and types, using the\n  corresponding methods of the same name.  Certain definitional\n  packages of object-logics usually declare emerging cases and\n  induction rules as expected, so users rarely need to intervene.\n\n  Rules may be deleted via the @{text \"del\"} specification, which\n  covers all of the @{text \"type\"}/@{text \"pred\"}/@{text \"set\"}\n  sub-categories simultaneously.  For example, @{attribute\n  cases}~@{text del} removes any @{attribute cases} rules declared for\n  some type, predicate, or set.\n  \n  Manual rule declarations usually refer to the @{attribute\n  case_names} and @{attribute params} attributes to adjust names of\n  cases and parameters of a rule; the @{attribute consumes}\n  declaration is taken care of automatically: @{attribute\n  consumes}~@{text 0} is specified for ``type'' rules and @{attribute\n  consumes}~@{text 1} for ``predicate'' / ``set'' rules.\n\n  \\end{description}\n\\<close>\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/Doc/Isar_Ref/Proof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5736784074525098, "lm_q1q2_score": 0.3136518723240615}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Semantics\n  imports Weak_Late_Step_Semantics\nbegin\n\ndefinition weakTransition :: \"(pi \\<times> residual) set\"\n  where \"weakTransition \\<equiv> Weak_Late_Step_Semantics.transition \\<union> {x. \\<exists>P. x = (P, \\<tau> \\<prec> P)}\"\n\nabbreviation weakLateTransition_judge :: \"pi \\<Rightarrow> residual \\<Rightarrow> bool\" (\"_ \\<Longrightarrow>\\<^sub>l\\<^sup>^_\" [80, 80] 80)\n  where \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^Rs \\<equiv> (P, Rs) \\<in> weakTransition\"\n\nlemma transitionI:\n  fixes P  :: pi\n  and   Rs :: residual\n  and   P' :: pi\n\n  shows \"P \\<Longrightarrow>\\<^sub>l Rs \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>l\\<^sup>^Rs\"\n  and   \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> P\"\nproof -\n  assume \"P \\<Longrightarrow>\\<^sub>l Rs\"\n  thus \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^Rs\" by(simp add: weakTransition_def)\nnext\n  show \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> P\" by(simp add: weakTransition_def)\nqed\n\nlemma transitionCases[consumes 1, case_names Step Stay]:\n  fixes P  :: pi\n  and   Rs :: residual\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^ Rs\"\n  and     \"P \\<Longrightarrow>\\<^sub>l Rs \\<Longrightarrow> F Rs\"\n  and     \"Rs = \\<tau> \\<prec> P \\<Longrightarrow> F (\\<tau> \\<prec> P)\"\n\n  shows \"F Rs\"\nusing assms\nby(auto simp add: weakTransition_def)\n\nlemma singleActionChain:\n  fixes P  :: pi\n  and   \\<alpha>  :: freeRes\n  and   P' :: pi\n  \n  assumes \"P \\<longmapsto>\\<alpha> \\<prec> P'\"\n  \n  shows \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^(\\<alpha> \\<prec> P')\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.singleActionChain\n  simp add: weakTransition_def)\n\nlemma Tau:\n  fixes P :: pi\n\n  shows \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<tau> \\<prec>  P\"\nby(auto intro: Weak_Late_Step_Semantics.Tau\n   simp add: weakTransition_def)\n  \nlemma Output:\n  fixes a :: name\n  and   b :: name\n  and   P :: pi\n\n  shows \"a{b}.P \\<Longrightarrow>\\<^sub>l\\<^sup>^a[b] \\<prec> P\"\nby(auto intro: Weak_Late_Step_Semantics.Output\n   simp add: weakTransition_def)\n\nlemma Match:\n  fixes a  :: name\n  and   P  :: pi\n  and   b  :: name\n  and   x  :: name\n  and   P' :: pi\n  and   \\<alpha>  :: freeRes\n\n  shows \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^b<\\<nu>x> \\<prec> P' \\<Longrightarrow> [a\\<frown>a]P \\<Longrightarrow>\\<^sub>l\\<^sup>^b<\\<nu>x> \\<prec> P'\"\n  and   \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P' \\<Longrightarrow> P \\<noteq> P' \\<Longrightarrow> [a\\<frown>a]P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\"\nby(auto simp add: residual.inject weakTransition_def intro: Weak_Late_Step_Semantics.Match)\n\nlemma Mismatch:\n  fixes a  :: name\n  and   c  :: name\n  and   P  :: pi\n  and   b  :: name\n  and   x  :: name\n  and   P' :: pi\n  and   \\<alpha>  :: freeRes\n\n  shows \"\\<lbrakk>P \\<Longrightarrow>\\<^sub>l\\<^sup>^b<\\<nu>x> \\<prec> P'; a \\<noteq> c\\<rbrakk> \\<Longrightarrow> [a\\<noteq>c]P \\<Longrightarrow>\\<^sub>l\\<^sup>^b<\\<nu>x> \\<prec> P'\"\n  and   \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P' \\<Longrightarrow> P \\<noteq> P' \\<Longrightarrow> a \\<noteq> c \\<Longrightarrow> [a\\<noteq>c]P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\"\nby(auto simp add: residual.inject weakTransition_def intro: Weak_Late_Step_Semantics.Mismatch)\n\nlemma Open:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  assumes Trans:  \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a[b] \\<prec> P'\"\n  and     aInEqb: \"a \\<noteq> b\"\n\n  shows \"<\\<nu>b>P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>b> \\<prec> P'\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.Open\n  simp add: weakTransition_def residual.inject)\n\nlemma Par1B:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n\n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\"\n  and     xFreshQ: \"x \\<sharp> Q\"\n\n  shows \"P \\<parallel> Q \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> (P' \\<parallel> Q)\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.Par1B\n  simp add: weakTransition_def residual.inject)\n\nlemma Par1F:\n  fixes P  :: pi\n  and   \\<alpha>  :: freeRes\n  and   P' :: pi\n\n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\"\n\n  shows \"P \\<parallel> Q \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> (P' \\<parallel> Q)\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.Par1F\n  simp add: weakTransition_def residual.inject)\n\nlemma Par2B:\n  fixes Q  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   Q' :: pi\n\n  assumes QTrans: \"Q \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> Q'\"\n  and     xFreshP: \"x \\<sharp> P\"\n\n  shows \"P \\<parallel> Q \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> (P \\<parallel> Q')\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.Par2B\n  simp add: weakTransition_def residual.inject)\n\nlemma Par2F:\n  fixes Q :: pi\n  and   \\<alpha>  :: freeRes\n  and   Q' :: pi\n\n  assumes QTrans: \"Q \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> Q'\"\n\n  shows \"P \\<parallel> Q \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> (P \\<parallel> Q')\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.Par2F\n  simp add: weakTransition_def residual.inject)\n\nlemma Comm1:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P'' :: pi\n  and   P' :: pi\n  and   Q  :: pi\n  and   Q' :: pi\n  \n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>lb in P''\\<rightarrow>a<x> \\<prec> P'\"\n  and     QTrans: \"Q \\<Longrightarrow>\\<^sub>l\\<^sup>^a[b] \\<prec> Q'\"\n\n  shows \"P \\<parallel> Q \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> P' \\<parallel> Q'\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.Comm1\n  simp add: weakTransition_def residual.inject)\n\nlemma Comm2:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   Q'' :: pi\n  and   P' :: pi\n  and   Q  :: pi\n  and   Q' :: pi\n  \n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a[b] \\<prec> P'\"\n  and     QTrans: \"Q \\<Longrightarrow>\\<^sub>lb in Q''\\<rightarrow>a<x> \\<prec> Q'\"\n\n  shows \"P \\<parallel> Q \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> P' \\<parallel> Q'\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.Comm2\n  simp add: weakTransition_def residual.inject)\n\nlemma Close1:\n  fixes P  :: pi\n  and   y  :: name\n  and   P'' :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n  and   Q  :: pi\n  and   Q' :: pi\n  \n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>ly in P''\\<rightarrow>a<x> \\<prec> P'\"\n  and     QTrans: \"Q \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>y> \\<prec> Q'\"\n  and     xFreshP: \"y \\<sharp> P\"\n  and     xFreshQ: \"y \\<sharp> Q\"\n\n  shows \"P \\<parallel> Q \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> Q')\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.Close1\n  simp add: weakTransition_def residual.inject)\n\nlemma Close2:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n  and   Q  :: pi\n  and   y  :: name\n  and   Q'' :: pi\n  and   Q' :: pi\n  \n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>y> \\<prec> P'\"\n  and     QTrans: \"Q \\<Longrightarrow>\\<^sub>ly in Q''\\<rightarrow>a<x> \\<prec> Q'\"\n  and     xFreshP: \"y \\<sharp> P\"\n  and     xFreshQ: \"y \\<sharp> Q\"\n\n  shows \"P \\<parallel> Q \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> Q')\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.Close2\n  simp add: weakTransition_def residual.inject)\n\nlemma ResF:\n  fixes P  :: pi\n  and   \\<alpha>  :: freeRes\n  and   P' :: pi\n  and   x  :: name\n\n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\"\n  and     xFreshAlpha: \"x \\<sharp> \\<alpha>\"\n\n  shows \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> <\\<nu>x>P'\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.ResF\n  simp add: weakTransition_def residual.inject)\n\nlemma ResB:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n  and   y  :: name\n\n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\"\n  and     yineqa: \"y \\<noteq> a\"\n  and     yineqx: \"y \\<noteq> x\"\n  and     xFreshP: \"x \\<sharp> P\"\n\n  shows \"<\\<nu>y>P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> (<\\<nu>y>P')\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.ResB\n  simp add: weakTransition_def residual.inject)\n\nlemma Bang:\n  fixes P  :: pi\n  and   Rs :: residual\n\n  assumes \"P \\<parallel> !P \\<Longrightarrow>\\<^sub>l\\<^sup>^ Rs\"\n  and     \"Rs \\<noteq> \\<tau> \\<prec> P \\<parallel> !P\"\n  \n  shows \"!P \\<Longrightarrow>\\<^sub>l\\<^sup>^ Rs\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.Bang\n  simp add: weakTransition_def residual.inject)\n\nlemma tauTransitionChain:\n  fixes P  :: pi\n  and   P' :: pi\n\n  assumes \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> P'\"\n\n  shows \"P \\<Longrightarrow>\\<^sub>\\<tau> P'\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.tauTransitionChain\n  simp add: weakTransition_def residual.inject transition_def)\n  \nlemma chainTransitionAppend:\n  fixes P   :: pi\n  and   P'  :: pi\n  and   Rs  :: residual\n  and   a   :: name\n  and   x   :: name\n  and   P'' :: pi\n  and   \\<alpha>   :: freeRes\n\n  shows \"P \\<Longrightarrow>\\<^sub>\\<tau> P' \\<Longrightarrow> P' \\<Longrightarrow>\\<^sub>l\\<^sup>^ Rs \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>l\\<^sup>^ Rs\"\n  and   \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'' \\<Longrightarrow> P'' \\<Longrightarrow>\\<^sub>\\<tau> P' \\<Longrightarrow> x \\<sharp> P \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\"\n  and   \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'' \\<Longrightarrow> P'' \\<Longrightarrow>\\<^sub>\\<tau> P' \\<Longrightarrow> P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\"\nproof -\n  assume \"P \\<Longrightarrow>\\<^sub>\\<tau> P'\" and \"P' \\<Longrightarrow>\\<^sub>l\\<^sup>^ Rs\"\n  thus \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^ Rs\"\n    by(auto intro: Weak_Late_Step_Semantics.chainTransitionAppend\n                   Weak_Late_Step_Semantics.tauActionChain\n       simp add: weakTransition_def residual.inject)\nnext\n  assume \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P''\" and \"P'' \\<Longrightarrow>\\<^sub>\\<tau> P'\" and \"x \\<sharp> P\"\n  thus \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\"\n    by(auto intro: Weak_Late_Step_Semantics.chainTransitionAppend\n       simp add: weakTransition_def residual.inject)\nnext\n  assume \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P''\" and \"P'' \\<Longrightarrow>\\<^sub>\\<tau> P'\"\n  thus \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\"\n    apply(case_tac \"P''=P'\")\n    by(auto dest: Weak_Late_Step_Semantics.chainTransitionAppend\n                     Weak_Late_Step_Semantics.tauActionChain\n       simp add: weakTransition_def residual.inject)\nqed\n\nlemma weakEqWeakTransitionAppend:\n  fixes P   :: pi\n  and   P'  :: pi\n  and   \\<alpha>   :: freeRes\n  and   P'' :: pi\n  \n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P'\"\n  and     P'Trans: \"P' \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P''\"\n  \n  shows \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P''\"\nproof(cases \"\\<alpha>=\\<tau>\")\n  assume alphaEqTau: \"\\<alpha> = \\<tau>\"\n  with P'Trans have \"P' \\<Longrightarrow>\\<^sub>\\<tau> P''\" by(blast intro: tauTransitionChain)\n  with PTrans alphaEqTau show ?thesis\n    by(blast intro: Weak_Late_Step_Semantics.chainTransitionAppend)\nnext\n  assume alphaIneqTau: \"\\<alpha> \\<noteq> \\<tau>\"\n  from PTrans have \"P \\<Longrightarrow>\\<^sub>\\<tau> P'\" by(rule Weak_Late_Step_Semantics.tauTransitionChain)\n  moreover from P'Trans alphaIneqTau have \"P' \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P''\"\n    by(auto simp add: weakTransition_def residual.inject)\n  ultimately show ?thesis\n    by(rule Weak_Late_Step_Semantics.chainTransitionAppend)\nqed\n    \nlemma freshBoundOutputTransition:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n  and   c  :: name\n\n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\"\n  and     cFreshP: \"c \\<sharp> P\"\n  and     cineqx: \"c \\<noteq> x\"\n\n  shows \"c \\<sharp> P'\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.freshBoundOutputTransition\n  simp add: weakTransition_def residual.inject)\n\nlemma freshTauTransition:\n  fixes P :: pi\n  and   c :: name\n\n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> P'\"\n  and     cFreshP: \"c \\<sharp> P\"\n\n  shows \"c \\<sharp> P'\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.freshTauTransition\n  simp add: weakTransition_def residual.inject)\n\nlemma freshOutputTransition:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n  and   c  :: name\n\n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a[b] \\<prec> P'\"\n  and     cFreshP: \"c \\<sharp> P\"\n\n  shows \"c \\<sharp> P'\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.freshOutputTransition\n  simp add: weakTransition_def residual.inject)\n\nlemma eqvtI:\n  fixes P    :: pi\n  and   Rs   :: residual\n  and   perm :: \"name prm\"\n\n  assumes \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^ Rs\"\n\n  shows \"(perm \\<bullet> P) \\<Longrightarrow>\\<^sub>l\\<^sup>^ (perm \\<bullet> Rs)\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.eqvtI\n  simp add: weakTransition_def residual.inject)\n\nlemma freshInputTransition:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n  and   c  :: name\n\n  assumes PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<b> \\<prec> P'\"\n  and     cFreshP: \"c \\<sharp> P\"\n  and     cineqb: \"c \\<noteq> b\"\n\n  shows \"c \\<sharp> P'\"\nusing assms\nby(auto intro: Weak_Late_Step_Semantics.freshInputTransition\n  simp add: weakTransition_def residual.inject)\n\nlemmas freshTransition = freshBoundOutputTransition freshOutputTransition\n                         freshInputTransition freshTauTransition\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Late_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5736784074525098, "lm_q1q2_score": 0.3136518723240615}}
{"text": "section\\<open>The Axiom of Choice in $M[G]$\\<close>\n\ntheory Choice_Axiom\n  imports\n    Powerset_Axiom\n    Extensionality_Axiom\n    Foundation_Axiom\n    Replacement_Axiom\n    Infinity_Axiom\nbegin\n\ndefinition\n  upair_name :: \"i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i\" where\n  \"upair_name(\\<tau>,\\<rho>,on) \\<equiv> Upair(\\<langle>\\<tau>,on\\<rangle>,\\<langle>\\<rho>,on\\<rangle>)\"\n\ndefinition\n  opair_name :: \"i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> i\" where\n  \"opair_name(\\<tau>,\\<rho>,on) \\<equiv> upair_name(upair_name(\\<tau>,\\<tau>,on),upair_name(\\<tau>,\\<rho>,on),on)\"\n\ndefinition\n  induced_surj :: \"i\\<Rightarrow>i\\<Rightarrow>i\\<Rightarrow>i\" where\n  \"induced_surj(f,a,e) \\<equiv> f-``(range(f)-a)\\<times>{e} \\<union> restrict(f,f-``a)\"\n\nlemma domain_induced_surj: \"domain(induced_surj(f,a,e)) = domain(f)\"\n  unfolding induced_surj_def using domain_restrict domain_of_prod by auto\n\nlemma range_restrict_vimage:\n  assumes \"function(f)\"\n  shows \"range(restrict(f,f-``a)) \\<subseteq> a\"\nproof\n  from assms\n  have \"function(restrict(f,f-``a))\"\n    using function_restrictI by simp\n  fix y\n  assume \"y \\<in> range(restrict(f,f-``a))\"\n  then\n  obtain x where \"\\<langle>x,y\\<rangle> \\<in> restrict(f,f-``a)\"  \"x \\<in> f-``a\" \"x\\<in>domain(f)\"\n    using domain_restrict domainI[of _ _ \"restrict(f,f-``a)\"] by auto\n  moreover\n  note \\<open>function(restrict(f,f-``a))\\<close>\n  ultimately\n  have \"y = restrict(f,f-``a)`x\"\n    using function_apply_equality by blast\n  also from \\<open>x \\<in> f-``a\\<close>\n  have \"restrict(f,f-``a)`x = f`x\"\n    by simp\n  finally\n  have \"y = f`x\" .\n  moreover from assms \\<open>x\\<in>domain(f)\\<close>\n  have \"\\<langle>x,f`x\\<rangle> \\<in> f\"\n    using function_apply_Pair by auto\n  moreover\n  note assms \\<open>x \\<in> f-``a\\<close>\n  ultimately\n  show \"y\\<in>a\"\n    using function_image_vimage[of f a] by auto\nqed\n\nlemma induced_surj_type:\n  assumes \"function(f)\" (* \"relation(f)\" (* a function can contain non-pairs *) *)\n  shows\n    \"induced_surj(f,a,e): domain(f) \\<rightarrow> {e} \\<union> a\"\n    and\n    \"x \\<in> f-``a \\<Longrightarrow> induced_surj(f,a,e)`x = f`x\"\nproof -\n  let ?f1=\"f-``(range(f)-a) \\<times> {e}\" and ?f2=\"restrict(f, f-``a)\"\n  have \"domain(?f2) = domain(f) \\<inter> f-``a\"\n    using domain_restrict by simp\n  moreover from assms\n  have \"domain(?f1) = f-``(range(f))-f-``a\"\n    using domain_of_prod function_vimage_Diff by simp\n  ultimately\n  have \"domain(?f1) \\<inter> domain(?f2) = 0\"\n    by auto\n  moreover\n  have \"function(?f1)\" \"relation(?f1)\" \"range(?f1) \\<subseteq> {e}\"\n    unfolding function_def relation_def range_def by auto\n  moreover from this and assms\n  have \"?f1: domain(?f1) \\<rightarrow> range(?f1)\"\n    using function_imp_Pi by simp\n  moreover from assms\n  have \"?f2: domain(?f2) \\<rightarrow> range(?f2)\"\n    using function_imp_Pi[of \"restrict(f, f -`` a)\"] function_restrictI by simp\n  moreover from assms\n  have \"range(?f2) \\<subseteq> a\"\n    using range_restrict_vimage by simp\n  ultimately\n  have \"induced_surj(f,a,e): domain(?f1) \\<union> domain(?f2) \\<rightarrow> {e} \\<union> a\"\n    unfolding induced_surj_def using fun_is_function fun_disjoint_Un fun_weaken_type by simp\n  moreover\n  have \"domain(?f1) \\<union> domain(?f2) = domain(f)\"\n    using domain_restrict domain_of_prod by auto\n  ultimately\n  show \"induced_surj(f,a,e): domain(f) \\<rightarrow> {e} \\<union> a\"\n    by simp\n  assume \"x \\<in> f-``a\"\n  then\n  have \"?f2`x = f`x\"\n    using restrict by simp\n  moreover from \\<open>x \\<in> f-``a\\<close> \\<open>domain(?f1) = _\\<close>\n  have \"x \\<notin> domain(?f1)\"\n    by simp\n  ultimately\n  show \"induced_surj(f,a,e)`x = f`x\"\n    unfolding induced_surj_def using fun_disjoint_apply2[of x ?f1 ?f2] by simp\nqed\n\nlemma induced_surj_is_surj :\n  assumes\n    \"e\\<in>a\" \"function(f)\" \"domain(f) = \\<alpha>\" \"\\<And>y. y \\<in> a \\<Longrightarrow> \\<exists>x\\<in>\\<alpha>. f ` x = y\"\n  shows \"induced_surj(f,a,e) \\<in> surj(\\<alpha>,a)\"\n  unfolding surj_def\nproof (intro CollectI ballI)\n  from assms\n  show \"induced_surj(f,a,e): \\<alpha> \\<rightarrow> a\"\n    using induced_surj_type[of f a e] cons_eq cons_absorb by simp\n  fix y\n  assume \"y \\<in> a\"\n  with assms\n  have \"\\<exists>x\\<in>\\<alpha>. f ` x = y\"\n    by simp\n  then\n  obtain x where \"x\\<in>\\<alpha>\" \"f ` x = y\" by auto\n  with \\<open>y\\<in>a\\<close> assms\n  have \"x\\<in>f-``a\"\n    using vimage_iff function_apply_Pair[of f x] by auto\n  with \\<open>f ` x = y\\<close> assms\n  have \"induced_surj(f, a, e) ` x = y\"\n    using induced_surj_type by simp\n  with \\<open>x\\<in>\\<alpha>\\<close> show\n    \"\\<exists>x\\<in>\\<alpha>. induced_surj(f, a, e) ` x = y\" by auto\nqed\n\nlemma (in M_ZF1_trans) upair_name_closed :\n  \"\\<lbrakk> x\\<in>M; y\\<in>M ; o\\<in>M\\<rbrakk> \\<Longrightarrow> upair_name(x,y,o)\\<in>M\"\n  unfolding upair_name_def\n  using upair_in_M_iff pair_in_M_iff Upair_eq_cons\n  by simp\n\ncontext G_generic1\nbegin\n\nlemma val_upair_name : \"val(G,upair_name(\\<tau>,\\<rho>,\\<one>)) = {val(G,\\<tau>),val(G,\\<rho>)}\"\n  unfolding upair_name_def\n  using val_Upair Upair_eq_cons generic one_in_G\n  by simp\n\nlemma val_opair_name : \"val(G,opair_name(\\<tau>,\\<rho>,\\<one>)) = \\<langle>val(G,\\<tau>),val(G,\\<rho>)\\<rangle>\"\n  unfolding opair_name_def Pair_def\n  using val_upair_name by simp\n\nlemma val_RepFun_one: \"val(G,{\\<langle>f(x),\\<one>\\<rangle> . x\\<in>a}) = {val(G,f(x)) . x\\<in>a}\"\nproof -\n  let ?A = \"{f(x) . x \\<in> a}\"\n  let ?Q = \"\\<lambda>\\<langle>x,p\\<rangle> . p = \\<one>\"\n  have \"\\<one> \\<in> \\<bbbP>\\<inter>G\" using generic one_in_G one_in_P by simp\n  have \"{\\<langle>f(x),\\<one>\\<rangle> . x \\<in> a} = {t \\<in> ?A \\<times> \\<bbbP> . ?Q(t)}\"\n    using one_in_P by force\n  then\n  have \"val(G,{\\<langle>f(x),\\<one>\\<rangle>  . x \\<in> a}) = val(G,{t \\<in> ?A \\<times> \\<bbbP> . ?Q(t)})\"\n    by simp\n  also\n  have \"... = {z . t \\<in> ?A , (\\<exists>p\\<in>\\<bbbP>\\<inter>G . ?Q(\\<langle>t,p\\<rangle>)) \\<and> z= val(G,t)}\"\n    using val_of_name_alt by simp\n  also from \\<open>\\<one>\\<in>\\<bbbP>\\<inter>G\\<close>\n  have \"... = {val(G,t) . t \\<in> ?A }\"\n    by force\n  also\n  have \"... = {val(G,f(x)) . x \\<in> a}\"\n    by auto\n  finally\n  show ?thesis\n    by simp\nqed\n\nend\\<comment> \\<open>\\<^locale>\\<open>G_generic1\\<close>\\<close>\n\nsubsection\\<open>$M[G]$ is a transitive model of ZF\\<close>\n\nsublocale G_generic1 \\<subseteq> ext:M_Z_trans \"M[G]\"\n  using Transset_MG generic pairing_in_MG Union_MG\n    extensionality_in_MG power_in_MG foundation_in_MG\n    replacement_assm_MG separation_in_MG infinity_in_MG\n    replacement_ax1\n  by unfold_locales\n\nlemma (in M_replacement) upair_name_lam_replacement :\n  \"M(z) \\<Longrightarrow> lam_replacement(M,\\<lambda>x . upair_name(fst(x),snd(x),z))\"\n  using lam_replacement_Upair[THEN [5] lam_replacement_hcomp2]\n    lam_replacement_product\n    lam_replacement_fst lam_replacement_snd lam_replacement_constant\n  unfolding upair_name_def\n  by simp\n\nlemma (in forcing_data1) repl_opname_check :\n  assumes \"A\\<in>M\" \"f\\<in>M\"\n  shows \"{opair_name(check(x),f`x,\\<one>). x\\<in>A}\\<in>M\"\n    using assms lam_replacement_constant check_lam_replacement lam_replacement_identity\n      upair_name_lam_replacement[THEN [5] lam_replacement_hcomp2]\n      lam_replacement_apply2[THEN [5] lam_replacement_hcomp2]\n      lam_replacement_imp_strong_replacement_aux\n      transitivity RepFun_closed upair_name_closed apply_closed\n    unfolding opair_name_def\n    by simp\n\ntheorem (in G_generic1) choice_in_MG:\n  assumes \"choice_ax(##M)\"\n  shows \"choice_ax(##M[G])\"\nproof -\n  {\n    fix a\n    assume \"a\\<in>M[G]\"\n    then\n    obtain \\<tau> where \"\\<tau>\\<in>M\" \"val(G,\\<tau>) = a\"\n      using GenExt_def by auto\n    with \\<open>\\<tau>\\<in>M\\<close>\n    have \"domain(\\<tau>)\\<in>M\"\n      using domain_closed by simp\n    then\n    obtain s \\<alpha> where \"s\\<in>surj(\\<alpha>,domain(\\<tau>))\" \"Ord(\\<alpha>)\" \"s\\<in>M\" \"\\<alpha>\\<in>M\"\n      using assms choice_ax_abs\n      by auto\n    then\n    have \"\\<alpha>\\<in>M[G]\"\n      using M_subset_MG generic one_in_G subsetD\n      by blast\n    let ?A=\"domain(\\<tau>)\\<times>\\<bbbP>\"\n    let ?g = \"{opair_name(check(\\<beta>),s`\\<beta>,\\<one>). \\<beta>\\<in>\\<alpha>}\"\n    have \"?g \\<in> M\"\n      using \\<open>s\\<in>M\\<close> \\<open>\\<alpha>\\<in>M\\<close> repl_opname_check\n      by simp\n    let ?f_dot=\"{\\<langle>opair_name(check(\\<beta>),s`\\<beta>,\\<one>),\\<one>\\<rangle>. \\<beta>\\<in>\\<alpha>}\"\n    have \"?f_dot = ?g \\<times> {\\<one>}\" by blast\n    define f where\n      \"f \\<equiv> val(G,?f_dot)\"\n    from \\<open>?g\\<in>M\\<close> \\<open>?f_dot = ?g\\<times>{\\<one>}\\<close>\n    have \"?f_dot\\<in>M\"\n      using cartprod_closed singleton_closed\n      by simp\n    then\n    have \"f \\<in> M[G]\"\n      unfolding f_def\n      by (blast intro:GenExtI)\n    have \"f = {val(G,opair_name(check(\\<beta>),s`\\<beta>,\\<one>)) . \\<beta>\\<in>\\<alpha>}\"\n      unfolding f_def\n      using val_RepFun_one\n      by simp\n    also\n    have \"... = {\\<langle>\\<beta>,val(G,s`\\<beta>)\\<rangle> . \\<beta>\\<in>\\<alpha>}\"\n      using val_opair_name val_check generic one_in_G one_in_P\n      by simp\n    finally\n    have \"f = {\\<langle>\\<beta>,val(G,s`\\<beta>)\\<rangle> . \\<beta>\\<in>\\<alpha>}\" .\n    then\n    have 1: \"domain(f) = \\<alpha>\" \"function(f)\"\n      unfolding function_def by auto\n    have 2: \"y \\<in> a \\<Longrightarrow> \\<exists>x\\<in>\\<alpha>. f ` x = y\" for y\n    proof -\n      fix y\n      assume\n        \"y \\<in> a\"\n      with \\<open>val(G,\\<tau>) = a\\<close>\n      obtain \\<sigma> where  \"\\<sigma>\\<in>domain(\\<tau>)\" \"val(G,\\<sigma>) = y\"\n        using elem_of_val[of y _ \\<tau>]\n        by blast\n      with \\<open>s\\<in>surj(\\<alpha>,domain(\\<tau>))\\<close>\n      obtain \\<beta> where \"\\<beta>\\<in>\\<alpha>\" \"s`\\<beta> = \\<sigma>\"\n        unfolding surj_def\n        by auto\n      with \\<open>val(G,\\<sigma>) = y\\<close>\n      have \"val(G,s`\\<beta>) = y\"\n        by simp\n      with \\<open>f = {\\<langle>\\<beta>,val(G,s`\\<beta>)\\<rangle> . \\<beta>\\<in>\\<alpha>}\\<close> \\<open>\\<beta>\\<in>\\<alpha>\\<close>\n      have \"\\<langle>\\<beta>,y\\<rangle>\\<in>f\"\n        by auto\n      with \\<open>function(f)\\<close>\n      have \"f`\\<beta> = y\"\n        using function_apply_equality by simp\n      with \\<open>\\<beta>\\<in>\\<alpha>\\<close> show\n        \"\\<exists>\\<beta>\\<in>\\<alpha>. f ` \\<beta> = y\"\n        by auto\n    qed\n    then\n    have \"\\<exists>\\<alpha>\\<in>(M[G]). \\<exists>f'\\<in>(M[G]). Ord(\\<alpha>) \\<and> f' \\<in> surj(\\<alpha>,a)\"\n    proof (cases \"a=0\")\n      case True\n      then\n      show ?thesis\n        unfolding surj_def\n        using zero_in_MG\n        by auto\n    next\n      case False\n      with \\<open>a\\<in>M[G]\\<close>\n      obtain e where \"e\\<in>a\" \"e\\<in>M[G]\"\n        using transitivity_MG\n        by blast\n      with 1 and 2\n      have \"induced_surj(f,a,e) \\<in> surj(\\<alpha>,a)\"\n        using induced_surj_is_surj by simp\n      moreover from \\<open>f\\<in>M[G]\\<close> \\<open>a\\<in>M[G]\\<close> \\<open>e\\<in>M[G]\\<close>\n      have \"induced_surj(f,a,e) \\<in> M[G]\"\n        unfolding induced_surj_def\n        by (simp flip: setclass_iff)\n      moreover\n      note \\<open>\\<alpha>\\<in>M[G]\\<close> \\<open>Ord(\\<alpha>)\\<close>\n      ultimately\n      show ?thesis\n        by auto\n    qed\n  }\n  then\n  show ?thesis\n    using ext.choice_ax_abs\n    by simp\nqed\n\nsublocale G_generic1_AC \\<subseteq> ext:M_ZC_basic \"M[G]\"\n  using choice_ax choice_in_MG\n  by unfold_locales\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Independence_CH/Choice_Axiom.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784074525096, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.31365187232406144}}
{"text": "theory RecordCameras\nimports Graph\n  \"../IrisCore/Frac\"\n  \"../HeapLang/HeapLang\"\n  \"../HeapLang/PrimitiveLaws\"\n  \"../IrisCore/BaseLogicShallow\"\nbegin\n\n(* Children locations, in Coq it's a leibniz0 structure*)\ntype_synonym chl = \"loc option\\<times>loc option\"\n\n(* The graph camera, a unital camera. *)\ntype_synonym graphUR = \"((loc\\<rightharpoonup>(chl ex))\\<times>frac) option\"\n\n(* A camera for duplicatable markings *)\ntype_synonym markingUR = \"loc set\"\n\n\nrecord graphG =\n  graph :: \"graphUR auth\"\n  markings :: \"markingUR auth\"\n\ninstantiation graphG_ext :: (ofe) ofe begin\ndefinition n_equiv_graphG_ext :: \"nat \\<Rightarrow> 'a graphG_scheme \\<Rightarrow> 'a graphG_scheme \\<Rightarrow> bool\" where\n  \"n_equiv_graphG_ext n x y \\<equiv> n_equiv n (graph x) (graph y) \\<and> n_equiv n (markings x) (markings y)\n    \\<and> n_equiv n (graphG.more x) (graphG.more y)\"\ndefinition ofe_eq_graphG_ext :: \"'a graphG_scheme \\<Rightarrow> 'a graphG_scheme \\<Rightarrow> bool\" where\n  \"ofe_eq_graphG_ext x y \\<equiv> ofe_eq (graph x) (graph y) \\<and> ofe_eq (markings x) (markings y) \n    \\<and> ofe_eq (graphG.more x) (graphG.more y)\"\ninstance by standard \n(auto simp: n_equiv_graphG_ext_def ofe_eq_graphG_ext_def ofe_refl ofe_sym ofe_limit intro: ofe_trans ofe_mono)\nend\n\ninstance graphG_ext :: (discrete) discrete \n  by standard (auto simp: n_equiv_graphG_ext_def ofe_eq_graphG_ext_def ofe_refl d_equiv d_eq)\n\ninstantiation graphG_ext :: (camera) camera begin\nlift_definition valid_raw_graphG_ext :: \"'a graphG_scheme \\<Rightarrow> sprop\" is\n  \"\\<lambda>g n. n_valid (graph g) n \\<and> n_valid (markings g) n \\<and> n_valid (more g) n\" by simp\ndefinition pcore_graphG_ext :: \"'a graphG_scheme \\<Rightarrow> 'a graphG_scheme option\" where\n  \"pcore_graphG_ext x = (case pcore (graph x) of Some g \\<Rightarrow> \n    (case pcore (markings x) of Some m \\<Rightarrow> (case pcore (more x) of Some y \\<Rightarrow> \n      Some \\<lparr>graph=g,markings=m,\\<dots>=y\\<rparr> | None \\<Rightarrow> None) | None \\<Rightarrow> None) | None \\<Rightarrow> None)\"\ndefinition op_graphG_ext :: \"'a graphG_scheme \\<Rightarrow> 'a graphG_scheme \\<Rightarrow> 'a graphG_scheme\" where\n  \"op_graphG_ext x y = \\<lparr>graph=(graph x)\\<cdot>(graph y),markings=(markings x)\\<cdot>(markings y),\\<dots>=(more x)\\<cdot>(more y)\\<rparr>\"\ninstance proof\nshow \"non_expansive (valid_raw::'a graphG_scheme \\<Rightarrow> sprop)\"\n  apply (rule non_expansiveI)\n  apply (auto simp: valid_raw_graphG_ext.rep_eq n_equiv_graphG_ext_def n_equiv_sprop_def d_equiv)\n  using n_valid_ne ofe_mono ofe_sym  by blast+\nnext\nshow \"non_expansive (pcore::'a graphG_scheme \\<Rightarrow> 'a graphG_scheme option)\"\n  by (rule non_expansiveI; auto simp: n_equiv_graphG_ext_def pcore_graphG_ext_def ofe_refl \n    n_equiv_option_def d_equiv split: option.splits)\n  (metis n_equiv_option_def option.discI option.inject pcore_ne)+\nnext \nshow \"non_expansive2 (op::'a graphG_scheme \\<Rightarrow> 'a graphG_scheme \\<Rightarrow> 'a graphG_scheme)\"\n  by (rule non_expansive2I) (auto simp: n_equiv_graphG_ext_def op_graphG_ext_def)\nnext\nfix a b c :: \"'a graphG_ext\"\nshow \"a \\<cdot> b \\<cdot> c = a \\<cdot> (b \\<cdot> c)\" by (auto simp: op_graphG_ext_def camera_assoc)\nnext\nfix a b :: \"'a graphG_ext\"\nshow \"a \\<cdot> b = b \\<cdot> a\" by (auto simp: op_graphG_ext_def camera_comm)\nnext\nfix a a' :: \"'a graphG_ext\"\nshow \"pcore a = Some a' \\<Longrightarrow> a' \\<cdot> a = a\" \n  by (auto simp: op_graphG_ext_def pcore_graphG_ext_def camera_pcore_id split: option.splits)\nnext\nfix a a' :: \"'a graphG_ext\"\nshow \"pcore a = Some a' \\<Longrightarrow> pcore a' = pcore a\" \n  by (auto simp: pcore_graphG_ext_def camera_pcore_idem split: option.splits)\nnext\nfix a a' b :: \"'a graphG_ext\"\nshow \"pcore a = Some a' \\<Longrightarrow> \\<exists>c. b = a \\<cdot> c \\<Longrightarrow> \\<exists>b'. pcore b = Some b' \\<and> (\\<exists>c. b' = a' \\<cdot> c)\"\n  apply (auto simp: pcore_graphG_ext_def op_graphG_ext_def camera_pcore_mono total_pcore split: option.splits)\n  apply (metis option.distinct(1) total_pcore)\n  apply (metis camera_pcore_mono option.distinct(1))\n  by (metis (no_types, opaque_lifting) camera_pcore_mono option.inject select_convs(1) select_convs(2) select_convs(3))\nnext\nfix a b :: \"'a graphG_ext\" fix n\nshow \"Rep_sprop (valid_raw (a \\<cdot> b)) n \\<Longrightarrow> Rep_sprop (valid_raw a) n\"\n  by (auto simp: valid_raw_graphG_ext.rep_eq op_graphG_ext_def camera_valid_op)\nnext\nfix a b c :: \"'a graphG_ext\" fix n\nshow \"Rep_sprop (valid_raw a) n \\<Longrightarrow> n_equiv n a (b \\<cdot> c) \\<Longrightarrow> \n  \\<exists>c1 c2. a = c1 \\<cdot> c2 \\<and> n_equiv n c1 b \\<and> n_equiv n c2 c\"\n  by (auto simp: valid_raw_graphG_ext.rep_eq op_graphG_ext_def n_equiv_graphG_ext_def)\n  (metis select_convs(1) select_convs(2) select_convs(3) surjective  camera_extend)\nqed\nend\n\ninstance graphG_ext :: (dcamera) dcamera \n  apply (standard; auto simp: valid_def valid_raw_graphG_ext.rep_eq)\n  using dcamera_valid_iff by blast+\n\ninstantiation graphG_ext :: (ucamera) ucamera begin\ndefinition \\<epsilon>_graphG_ext :: \"'a graphG_scheme\" where [simp]: \"\\<epsilon>_graphG_ext \\<equiv> \\<lparr>graph=\\<epsilon>,markings=\\<epsilon>,\\<dots>=\\<epsilon>\\<rparr>\"\ninstance apply standard \n  apply (auto simp: valid_raw_graphG_ext.rep_eq valid_def \\<epsilon>_valid[unfolded valid_def])\n  apply (auto simp: op_graphG_ext_def \\<epsilon>_left_id)\n  by (auto simp: pcore_graphG_ext_def \\<epsilon>_pcore)\nend\n\ninstance graphG_ext :: (ducamera) ducamera ..\n\nrecord heapG = graphG +\n  heap :: heapGS  \nsetup_lifting type_definition_heapG_ext\n  \nlemma heapG_ext_abs: \"(\\<lparr>heap=h,\\<dots>=m\\<rparr>::'a heapG_ext) = Abs_heapG_ext (h,m)\"\n  unfolding heapG_ext_def Record.iso_tuple_cons_def heapG_ext_Tuple_Iso_def Record.abst_def\n  by simp\n\ninstantiation heapG_ext :: (ofe) ofe begin\ndefinition n_equiv_heapG_ext :: \"nat \\<Rightarrow> 'a heapG_ext \\<Rightarrow> 'a heapG_ext \\<Rightarrow> bool\" where \n  \"n_equiv_heapG_ext n hG1 hG2 \\<equiv> (case Rep_heapG_ext hG1 of (h1,m1) \\<Rightarrow> case Rep_heapG_ext hG2 of (h2,m2) \\<Rightarrow> \n     n_equiv n h1  h2 \\<and> n_equiv n m1 m2)\"\ndefinition ofe_eq_heapG_ext :: \"'a heapG_ext \\<Rightarrow> 'a heapG_ext \\<Rightarrow> bool\" where \n  \"ofe_eq_heapG_ext hG1 hG2 \\<equiv> (case Rep_heapG_ext hG1 of (h1,m1) \\<Rightarrow> case Rep_heapG_ext hG2 of (h2,m2) \\<Rightarrow> \n    ofe_eq h1  h2 \\<and> ofe_eq m1 m2)\"\ninstance by standard \n(auto simp: n_equiv_heapG_ext_def ofe_eq_heapG_ext_def ofe_refl ofe_sym ofe_limit intro: ofe_trans ofe_mono ofe_eq_eq) \nend\n  \ninstance heapG_ext :: (discrete) discrete \n  by (standard; auto simp: n_equiv_heapG_ext_def ofe_eq_heapG_ext_def ofe_refl d_equiv d_eq)\n  (metis Rep_heapG_ext_inject)+\n  \ninstantiation heapG_ext :: (camera) camera begin\nlift_definition valid_raw_heapG_ext :: \"'a heapG_ext \\<Rightarrow> sprop\" is\n  \"\\<lambda>(h,m) n. n_valid h n \\<and> n_valid m n\" by auto\ndefinition pcore_heapG_ext :: \"'a heapG_ext \\<Rightarrow> 'a heapG_ext option\" where\n  \"pcore_heapG_ext hG \\<equiv> case Rep_heapG_ext hG of (h,m) \\<Rightarrow> \n    (case pcore h of Some h' \\<Rightarrow> \n      (case pcore m of Some m' \\<Rightarrow> Some (heapG_ext h' m') \n      | _ \\<Rightarrow> None) \n    | _ \\<Rightarrow> None)\"\ndefinition op_heapG_ext :: \"'a heapG_ext \\<Rightarrow> 'a heapG_ext \\<Rightarrow> 'a heapG_ext\" where\n  \"op_heapG_ext hG1 hG2 \\<equiv> case Rep_heapG_ext hG1 of (h1,m1) \\<Rightarrow> case Rep_heapG_ext hG2 of (h2,m2) \\<Rightarrow>\n    heapG_ext (h1\\<cdot>h2) (m1\\<cdot>m2)\"\ninstance proof\nshow \"non_expansive (valid_raw::'a heapG_ext \\<Rightarrow> sprop)\"\n  apply (rule non_expansiveI)\n  apply (auto simp: n_equiv_heapG_ext_def valid_raw_heapG_ext_def n_equiv_sprop_def d_equiv Abs_sprop_inverse)\n  using n_valid_ne ofe_mono ofe_sym by blast+\nnext\nshow \"non_expansive (pcore::'a heapG_ext \\<Rightarrow> 'a heapG_ext option)\"\n  apply (rule non_expansiveI)\n  apply (auto simp: n_equiv_heapG_ext_def pcore_heapG_ext_def n_equiv_option_def d_equiv heapG_ext_abs Abs_heapG_ext_inverse split: option.splits)\n  by (metis camera_props(9) n_equiv_option_def option.distinct(1) option.sel pcore_ne)+\nnext\nshow \"non_expansive2 (op::'a heapG_ext \\<Rightarrow> 'a heapG_ext \\<Rightarrow> 'a heapG_ext)\" by (rule non_expansive2I) \n  (auto simp: n_equiv_heapG_ext_def op_heapG_ext_def heapG_ext_abs Abs_heapG_ext_inverse)\nnext\nfix a b c :: \"'a heapG_ext\"\nshow \"a \\<cdot> b \\<cdot> c = a \\<cdot> (b \\<cdot> c)\" \n  by (auto simp: op_heapG_ext_def heapG_ext_abs Abs_heapG_ext_inverse camera_assoc split: prod.splits)\nnext\nfix a b :: \"'a heapG_ext\"\nshow \"a \\<cdot> b = b \\<cdot> a\"\n  by (auto simp: op_heapG_ext_def heapG_ext_abs Abs_heapG_ext_inverse camera_comm split: prod.splits)\nnext\nfix a a' :: \"'a heapG_ext\"\nshow \"pcore a = Some a' \\<Longrightarrow> a' \\<cdot> a = a\"\n  by (auto simp: op_heapG_ext_def pcore_heapG_ext_def heapG_ext_abs Abs_heapG_ext_inverse \n    split: option.splits prod.splits) (metis Rep_heapG_ext_inverse camera_pcore_id)\nnext\nfix a a' :: \"'a heapG_ext\"\nshow \"pcore a = Some a' \\<Longrightarrow> pcore a' = pcore a\"\n  by (auto simp: pcore_heapG_ext_def heapG_ext_abs Abs_heapG_ext_inverse camera_pcore_idem \n    split: option.splits prod.splits)\nnext\nfix a a' b :: \"'a heapG_ext\"\nshow \"pcore a = Some a' \\<Longrightarrow> \\<exists>c. b = a \\<cdot> c \\<Longrightarrow> \\<exists>b'. pcore b = Some b' \\<and> (\\<exists>c. b' = a' \\<cdot> c)\"\n  by (auto simp: op_heapG_ext_def pcore_heapG_ext_def heapG_ext_abs Abs_heapG_ext_inverse\n    split: option.splits prod.splits)\n  (metis option.distinct(1) Rep_heapG_ext_inverse heapG.ext_inject heapG_ext_abs option.inject \n    camera_pcore_mono)+\nnext\nfix a b :: \"'a heapG_ext\" fix n\nshow \"Rep_sprop (valid_raw (a \\<cdot> b)) n \\<Longrightarrow> Rep_sprop (valid_raw a) n\"\n  by (auto simp: valid_raw_heapG_ext.rep_eq op_heapG_ext_def heapG_ext_abs Abs_heapG_ext_inverse \n    camera_valid_op split: prod.splits)\nnext\nfix a b c :: \"'a heapG_ext\" fix n\nshow \"Rep_sprop (valid_raw a) n \\<Longrightarrow> n_equiv n a (b \\<cdot> c) \\<Longrightarrow> \n  \\<exists>c1 c2. a = c1 \\<cdot> c2 \\<and> n_equiv n c1 b \\<and> n_equiv n c2 c\"\n  apply (auto simp: valid_raw_heapG_ext.rep_eq op_heapG_ext_def heapG_ext_abs Abs_heapG_ext_inverse\n    n_equiv_heapG_ext_def split: prod.splits)\n  by (metis Rep_heapG_ext_inverse camera_extend heapG.ext_inject heapG_ext_abs)\nqed\nend\n\ninstance heapG_ext :: (dcamera) dcamera \n  apply (standard; auto simp: valid_def valid_raw_heapG_ext.rep_eq)\n  using dcamera_valid_iff by blast+\n\ninstantiation heapG_ext :: (ucamera) ucamera begin\ndefinition \\<epsilon>_heapG_ext :: \"'a heapG_ext\" where [simp]: \"\\<epsilon>_heapG_ext \\<equiv> heapG_ext \\<epsilon> \\<epsilon>\"\ninstance proof standard\nshow \"camera_class.valid (\\<epsilon>::'a heapG_ext)\" \n  by (auto simp: valid_def heapG_ext_abs valid_raw_heapG_ext.rep_eq Abs_heapG_ext_inverse \\<epsilon>_n_valid)\nnext\nfix a :: \"'a heapG_ext\" show \"\\<epsilon> \\<cdot> a = a\" \n  by (auto simp: heapG_ext_abs op_heapG_ext_def Abs_heapG_ext_inverse Rep_heapG_ext_inverse \\<epsilon>_left_id \n    split: prod.splits)\nnext\nshow \"pcore \\<epsilon> = Some (\\<epsilon>::'a heapG_ext)\" \n  by (auto simp: heapG_ext_abs pcore_heapG_ext_def Abs_heapG_ext_inverse \\<epsilon>_pcore split: option.splits)\nqed\nend\n\ninstance heapG_ext :: (ducamera) ducamera ..\n\nabbreviation own_graph :: \"graphUR auth \\<Rightarrow> ('a::ucamera) graphG_scheme iprop\" (\"Own\\<^sub>g _\") where\n  \"own_graph \\<equiv> \\<lambda>g. Own\\<lparr>graph=g,markings=\\<epsilon>,\\<dots>=\\<epsilon>\\<rparr>\"\nabbreviation own_marking :: \"markingUR auth \\<Rightarrow> ('a::ucamera) graphG_scheme iprop\" (\"Own\\<^sub>m _\") where\n  \"own_marking \\<equiv> \\<lambda>m. Own\\<lparr>graph=\\<epsilon>,markings=m,\\<dots>=\\<epsilon>\\<rparr>\"\nabbreviation own_heap :: \"heapGS \\<Rightarrow> ('a::ucamera) heapG_scheme iprop\" (\"Own\\<^sub>h _\") where\n  \"own_heap \\<equiv> \\<lambda>h. Own\\<lparr>graph=\\<epsilon>,markings=\\<epsilon>,heap=h,\\<dots>=\\<epsilon>\\<rparr>\"\n\ndefinition points_to_graph :: \"loc \\<Rightarrow> dfrac \\<Rightarrow> val \\<Rightarrow> ('a::ucamera) heapG_scheme iprop\" where\n  \"points_to_graph l dq v = Own\\<^sub>h(Heap [l\\<mapsto>(dq, to_ag (Some v))])\"\nabbreviation points_to_disc :: \"loc \\<Rightarrow> val \\<Rightarrow> ('a::ucamera) heapG_scheme iprop\" where \n  \"points_to_disc \\<equiv> \\<lambda>l v. points_to_graph l DfracDiscarded v\"\nabbreviation points_to_own :: \"loc \\<Rightarrow> frac \\<Rightarrow> val \\<Rightarrow> ('a::ucamera) heapG_scheme iprop\" where\n  \"points_to_own \\<equiv> \\<lambda>l p v. points_to_graph l (DfracOwn p) v\"\nabbreviation points_to_full :: \"loc \\<Rightarrow> val \\<Rightarrow> ('a::ucamera) heapG_scheme iprop\" where\n  \"points_to_full \\<equiv> \\<lambda>l v. points_to_own l 1 v\"\n  \nend", "meta": {"author": "firefighterduck", "repo": "isariris", "sha": "d02268e1e11cf681cae70b366b52843cbd90cc49", "save_path": "github-repos/isabelle/firefighterduck-isariris", "path": "github-repos/isabelle/firefighterduck-isariris/isariris-d02268e1e11cf681cae70b366b52843cbd90cc49/SpanningTree/RecordCameras.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7490872131147276, "lm_q2_score": 0.41869690935568665, "lm_q1q2_score": 0.31364050096900103}}
{"text": "theory SPPF\n  imports \"LocalLexing2.LLEarleyParsing\" DerivationTrees1\nbegin\ntext \"Defines SFFP output of Earley Parser\" \n\n\ntype_synonym ('a, 'b) pointers = \"('a, 'b) item \\<Rightarrow> (('a, 'b) item \\<times> nat) option\"\n(*or just reuse this nat notion*)\n                    \ntype_synonym ('a, 'b) sppf_pointers = \"('a, 'b) pointers \\<times> ('a, 'b) pointers\" \n(*predecessor, reduction*)\n\n(*might be easier to add an measure that gets calculated on the fly*)\n\ntype_synonym ('a, 'b) sppf_items = \"('a, 'b) items  \\<times> ('a, 'b) sppf_pointers\" \n(*add an additional nat for measure*)\n\n\ndatatype ('a, 'b) sppf = Node\n  (node_head:\"('a, 'b) symbol\")\n  (node_production:\"('a, 'b) symbol list\")\n  (node_dot:nat)\n  (node_origin:nat)\n  (node_end:nat)\n\ndefinition sppf_nonterminal :: \"('a, 'b) sppf \\<Rightarrow> ('a, 'b) symbol\"\nwhere\n  \"sppf_nonterminal x = node_head x\"\n\ndefinition sppf_rhs :: \"('a, 'b) sppf \\<Rightarrow> ('a, 'b) sentence\"\nwhere\n  \"sppf_rhs x = node_production x\"\n\ndefinition sppf_\\<alpha> :: \"('a, 'b) sppf \\<Rightarrow> ('a, 'b) sentence\"\nwhere\n  \"sppf_\\<alpha> x = take (node_dot x) (sppf_rhs x)\"\n\ndefinition sppf_\\<beta> :: \"('a, 'b) sppf \\<Rightarrow> ('a, 'b) sentence\"\nwhere \n  \"sppf_\\<beta> x = drop (node_dot x) (sppf_rhs x)\"\n\n\nderive ccompare \"item\"\ncontext LocalLexing begin\n\nlemma csorted_set_distinct:\n  fixes X :: \"(('a, 'b) item \\<times> 'c list) set\"\n  assumes \"finite X\"\n  shows csorted_set: \"set (csorted_list_of_set X) = X\" and csorted_distinct: \"distinct (csorted_list_of_set X)\"\nproof -\n  have ID_ccompare_SomeI: \"ID ccompare \\<noteq> (None :: 'd :: ccompare comparator option) \\<Longrightarrow>\n    ID ccompare = Some (ccomp :: 'd comparator)\"\n    by simp\n  have c: \"ID ccompare = Some (ccomp :: (('a, 'b) item \\<times> 'c list) comparator)\"\n    apply (rule ID_ccompare_SomeI)\n    unfolding is_ccompare_item[unfolded is_ccompare_def] is_ccompare_prod[unfolded is_ccompare_def] is_ccompare_list[unfolded is_ccompare_def]\n    using ccomp\n    by auto\n  note cl = ID_ccompare[OF c]\n  show \"set (csorted_list_of_set X) = X\"\n    using assms\n    unfolding csorted_list_of_set_def\n    by (subst c) (auto simp: linorder.set_sorted_list_of_set[OF cl assms])\n  show \"distinct (csorted_list_of_set X)\"\n    using assms\n    unfolding csorted_list_of_set_def\n    by (subst c) (auto simp: linorder.distinct_sorted_list_of_set[OF cl])\nqed\n\n\nlemma csorted_set_distinct':\n  fixes X :: \"(('a, 'b) item \\<times> ('a, 'b) item) set\"\n  assumes \"finite X\"\n  shows csorted_set': \"set (csorted_list_of_set X) = X\" and csorted_distinct': \"distinct (csorted_list_of_set X)\"\nproof -\n  have ID_ccompare_SomeI: \"ID ccompare \\<noteq> (None :: 'd :: ccompare comparator option) \\<Longrightarrow>\n    ID ccompare = Some (ccomp :: 'd comparator)\"\n    by simp\n  have c: \"ID ccompare = Some (ccomp :: (('a, 'b) item \\<times> ('a, 'b) item) comparator)\"\n    apply (rule ID_ccompare_SomeI)\n    unfolding is_ccompare_item[unfolded is_ccompare_def] is_ccompare_prod[unfolded is_ccompare_def]\n    using ccomp\n    by auto\n  note cl = ID_ccompare[OF c]\n  show \"set (csorted_list_of_set X) = X\"\n    using assms\n    unfolding csorted_list_of_set_def\n    by (subst c) (auto simp: linorder.set_sorted_list_of_set[OF cl assms])\n  show \"distinct (csorted_list_of_set X)\"\n    using assms\n    unfolding csorted_list_of_set_def\n    by (subst c) (auto simp: linorder.distinct_sorted_list_of_set[OF cl])\nqed\n\nlemma csorted_set_distinct'':\n  fixes X :: \"(('a, 'b) item) set\"\n  assumes \"finite X\"\n  shows csorted_set'': \"set (csorted_list_of_set X) = X\" and csorted_distinct'': \"distinct (csorted_list_of_set X)\"\nproof -\n  have ID_ccompare_SomeI: \"ID ccompare \\<noteq> (None :: 'd :: ccompare comparator option) \\<Longrightarrow>\n    ID ccompare = Some (ccomp :: 'd comparator)\"\n    by simp\n  have c: \"ID ccompare = Some (ccomp :: (('a, 'b) item) comparator)\"\n    apply (rule ID_ccompare_SomeI)\n    unfolding is_ccompare_item[unfolded is_ccompare_def] \n    using ccomp\n    by auto\n  note cl = ID_ccompare[OF c]\n  show \"set (csorted_list_of_set X) = X\"\n    using assms\n    unfolding csorted_list_of_set_def\n    by (subst c) (auto simp: linorder.set_sorted_list_of_set[OF cl assms])\n  show \"distinct (csorted_list_of_set X)\"\n    using assms\n    unfolding csorted_list_of_set_def\n    by (subst c) (auto simp: linorder.distinct_sorted_list_of_set[OF cl])\nqed\n\n(*need a simpler measure to guarantee monotonicity on the pointers*)\nfun  measure_help::\"('a,'b) sppf_pointers \\<Rightarrow> ('a, 'b) item \\<Rightarrow> nat\" where\n\"measure_help (pred, red ) i = (if i \\<notin> (dom pred) then 0 else snd (the ( pred i)))\"\n\ndefinition reduction_pointers::\"('a, 'b) pointers\" where\n\"reduction_pointers = Map.empty\"\n\n\ndefinition predecessor_pointers::\"('a, 'b) pointers\" where\n\"predecessor_pointers = Map.empty\"\n\ndefinition is_lexed::\"('a, 'b) item \\<Rightarrow> ('a, 'b) item \\<Rightarrow> bool\" where\n\"is_lexed p x = ((item_end x - item_end p) \\<in> (Lex (item_rhs p! item_dot p) Doc (item_end p)))\"\n\nfun correct_red_pred_match::\"('a, 'b) sppf_pointers \\<Rightarrow> bool\" where\n\"correct_red_pred_match (pred, red) = (\\<forall> node \\<in> (dom red) . next_symbol (fst (the (pred node)))\n = Some (item_nonterminal (fst (the (red node)))))\"\n\nfun correct_lexing::\"('a, 'b) sppf_pointers \\<Rightarrow> bool\" where\n\"correct_lexing (pred, red) = (\\<forall> x \\<in> (dom pred) . x \\<notin> dom red \\<longrightarrow>\n    is_lexed (fst (the (pred x))) x)\"\n\nfun correct_bounds::\"('a, 'b) sppf_pointers \\<Rightarrow> bool\" where\n\"correct_bounds (pred, red) = (\\<forall> x \\<in> (dom pred) . item_origin x = item_origin (fst (the (pred x))) \n  \\<and> item_end x \\<ge> item_end (fst (the (pred x))) \\<and> (\\<forall> x \\<in> (dom red) . item_origin (fst (the (red x))) = item_end (fst (the (pred x))) \\<and> \n    item_end x = item_end (fst (the (red x)))))\"\nfun red_implies_pred_dom::\"('a, 'b) sppf_pointers \\<Rightarrow> bool\" where\n\"red_implies_pred_dom (pred, red) = ( dom red \\<subseteq> dom pred)\"\n(*other relations to predecessor*)\nfun  pred_increments::\"('a, 'b) sppf_pointers \\<Rightarrow> bool\" where\n\"pred_increments (pred, red) = (\\<forall> node \\<in>  (dom pred) . item_dot node = (Suc (item_dot (fst (the (pred node)))))\n  \\<and> item_rule node = item_rule (fst (the (pred node))))\"\n\nfun no_red_implies_terminal::\"('a, 'b) sppf_pointers \\<Rightarrow> bool\" where\n\"no_red_implies_terminal (pred, red) = (\\<forall> node \\<in>  (dom pred) . node \\<notin> (dom red) \n    \\<longrightarrow> (\\<exists> t . next_symbol (fst (the (pred node))) = Some t \\<and> is_terminal t))\"\nfun invariant_pointers'::\"('a, 'b) sppf_pointers \\<Rightarrow> bool\" where\n\"invariant_pointers' s = (pred_increments s \\<and> correct_bounds s \\<and> correct_lexing s \\<and> \n  correct_red_pred_match s \\<and> red_implies_pred_dom s \\<and> no_red_implies_terminal s)\"\n\nfun dom_sup_items::\"('a, 'b) sppf_pointers \\<Rightarrow> ('a, 'b) items \\<Rightarrow> bool\" where\n\"dom_sup_items (pred, red) I =  ({i . i\\<in> I \\<and> item_dot i >0} \\<subseteq> dom pred)\" (*this actually implies zero dot too*)\n\nfun dom_no_scan::\"('a, 'b) sppf_pointers \\<Rightarrow> ('a, 'b) items \\<Rightarrow> bool\" where\n\"dom_no_scan (pred, red) I = (\\<forall> node \\<in> I . node \\<notin> dom (pred) \\<longrightarrow> item_origin node = item_end node)\"\n\nfun Predict' :: \"nat \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow> ('a, 'b) sppf_items\"\nwhere\n  \"Predict' k (I, p) = (Predict k I, p)\" (*what can be said about added states here?*)\n\n(*theorem \"is_ccompare TYPE (('a, 'b) item)\"*)\n\nlemma Predict'_bounds:\"valid_bounds I \\<Longrightarrow> valid_bounds (fst (Predict' k (I, p))) \"\n  by (auto simp add: Predict_bounds)\nlemma Predict'_finite:\"finite I \\<Longrightarrow> Predict' k (I, p) = (I', p') \\<Longrightarrow> finite I'\"\n  by (auto simp add:Predict_Finite') \n\nlemma Predict'_rule:\"valid_rule I \\<Longrightarrow> valid_rule (fst (Predict' k (I, p)))\"\n  by (auto simp add: Predict_rule)\n\nlemma Predict_eq:\"fst (Predict' k  I)  = Predict k (fst I)\"\n  using Predict_def \n  by (metis (no_types, hide_lams) Predict'.elims fst_conv)\n\nlemma Predict'_dom_sup:\n  assumes \"dom_sup_items p I\" \"Predict' k (I, p) = (I', p') \"\n  shows  \"dom_sup_items p' I'\"\nproof -\n  from Predict_top assms(2) have 1:\"I' \\<subseteq> I \\<union> (\\<lambda>r. init_item r k) ` \\<RR>\" by auto\n  have \"{i . i\\<in> ((\\<lambda>r. init_item r k) ` \\<RR>) \\<and> item_dot i >0} = {}\" by auto\n  with 1 have \"{i . i\\<in> I' \\<and> item_dot i >0} \\<subseteq> {i . i\\<in> I \\<and> item_dot i >0}\" by blast\n  with assms(1) have \"{i . i\\<in> I' \\<and> item_dot i >0} \\<subseteq> dom (fst p)\" \n    by (metis (no_types, lifting)  dom_sup_items.elims(2) fst_conv subsetD subsetI)\n  then show ?thesis using assms(2) \n    by (metis (no_types, lifting)  Pair_inject Predict'.simps dom_sup_items.elims(3) fst_conv)\nqed\n\nlemma Predict'_dom_no_scan:\n  assumes \"dom_no_scan p I\" \"Predict' k (I, p) = (I', p')\"\n  shows \"dom_no_scan p' I'\"\nproof -\n  from assms(2) have eq:\"p = p'\" by simp\n  from Predict_top assms(2) have 1:\"I' \\<subseteq> I \\<union> (\\<lambda>r. init_item r k) ` \\<RR>\" by auto\n  from assms eq have 2:\"(\\<forall> node \\<in> I . node \\<notin> dom (fst p') \\<longrightarrow> item_origin node = item_end node)\" \n    apply(cases p') by auto\n  from 1 have \"\\<forall> i \\<in> (\\<lambda>r. init_item r k) ` \\<RR> . item_origin i = item_end i\" by simp\n  with 1 2 have \"(\\<forall> node \\<in> I' . node \\<notin> dom (fst p') \\<longrightarrow> item_origin node = item_end node)\" \n    apply(cases p') by auto\n  then show ?thesis apply(cases p') by simp\nqed\n(*prove of acyclicity \\<Longrightarrow> also, if pointed to, can't change*)\n\nfun Complete_pointers_step::\"('a, 'b) sppf_pointers \\<Rightarrow> (('a, 'b) item\\<times> ('a, 'b) item) \\<Rightarrow> ('a, 'b) sppf_pointers\" where\n\"Complete_pointers_step (pred, red) (p', r')= (if ((inc_item p' (item_end r')) \\<notin> (dom pred))\n   then (pred((inc_item p' (item_end r'))\\<mapsto> (p',  (measure_help (pred, red) p') + (measure_help (pred , red) r') + 1)), \n        red((inc_item p' (item_end r'))\\<mapsto> (r', 0)) ) \n    else (pred, red) )\"\n\nfun Complete_pointers::\"('a, 'b) sppf_pointers \\<Rightarrow> (('a, 'b) item \\<times> ('a, 'b) item) set \\<Rightarrow> ('a, 'b) sppf_pointers\" where\n\"Complete_pointers p I = foldl Complete_pointers_step \n       p (csorted_list_of_set I)\"\n\nfun Complete_extend::\"nat \\<Rightarrow> ('a, 'b) items \\<Rightarrow> (('a, 'b) item \\<times> ('a, 'b) item) set\" where\n\"Complete_extend k I= { (x, y) | x y. \n     x \\<in> bin I (item_origin y) \\<and> y \\<in> bin I k \\<and> is_complete y \\<and> \n     next_symbol x = Some (item_nonterminal y)}\"\n\nfun Complete' :: \"nat \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow> ('a, 'b) sppf_items\"\nwhere\n  \"Complete' k (I, p) = (Complete k I,  (Complete_pointers p (Complete_extend k I)))\"\n\nlemma Complete'_finite:\"finite I \\<Longrightarrow> Complete' k (I, p) = (I', p') \\<Longrightarrow> finite I'\"\n  by (auto simp add: Complete_Finite')\n\nlemma Complete'_bounds:\"valid_bounds I \\<Longrightarrow> Complete' k (I, p) = (I', p') \\<Longrightarrow> valid_bounds I'\"\n  by (auto simp add: Complete_bounds)\n\nlemma Complete'_rule:\"valid_rule I \\<Longrightarrow> Complete' k (I, p) = (I',p') \\<Longrightarrow> valid_rule I'\"\n  by (auto simp add: Complete_rule)\n\nfun in_set::\"('a, 'b) sppf_pointers \\<Rightarrow> ('a, 'b) items \\<Rightarrow> bool\" where\n\"in_set (pred, red) I = (\\<forall> (i', k) \\<in> (ran red \\<union> ran pred). (i' \\<in> I))\"\n\nfun red_complete::\"('a, 'b) sppf_pointers  \\<Rightarrow> bool\" where\n\"red_complete (pred, red) = (\\<forall> (i, k) \\<in> (ran red) . is_complete i)\"\n\n\nfun measure_help_monotone::\"('a, 'b) sppf_pointers \\<Rightarrow> bool\" where\n\"measure_help_monotone (pred, red) = ((\\<forall> i \\<in> (dom pred ) . (measure_help (pred, red) i) > (measure_help (pred, red) \n  (fst (the (pred i))))) \\<and> (\\<forall> i \\<in> (dom red ) . (measure_help (pred, red) i) > (measure_help (pred, red) \n  (fst (the (red i))))))\"\n\n(*\nlemma \"dom_sup_items p I \\<Longrightarrow> case  Complete' k (I, p) of (I', p') \\<Rightarrow> dom_sup_items p' I'\"\n  apply (cases p) apply auto \n*)\n\ndefinition Completable::\"('a, 'b) item \\<Rightarrow> ('a, 'b) item \\<Rightarrow> bool\" where\n\"Completable pred red = (next_symbol pred = Some (fst (item_rule red)) \\<and> (item_end pred = item_origin red))\"\n\nlemma Complete_pointers_step:\n  assumes \"Complete_pointers_step  p (pred_i, red_i) = p'\"\n        \"measure_help_monotone p \\<and> red_complete p\" \"is_complete red_i\" \n        \"in_set p I\" \"pred_i \\<in> I\" \"red_i \\<in> I\" \n        \"invariant_pointers' p\" \n        \"Completable pred_i red_i\" \"dom_sup_items p I\" \"valid_bounds I\"\n  shows \"measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I \\<and> invariant_pointers' p' \\<and> dom_sup_items p' I \\<and> valid_bounds I\"\nproof -\n  obtain new_i where new_def:\"new_i = (inc_item pred_i (item_end red_i))\" by blast\n  from assms have p_simp:\"p' = (if ((inc_item pred_i (item_end red_i)) \\<notin> (dom (fst p)))\n   then ((fst p)((inc_item pred_i (item_end red_i))\\<mapsto> (pred_i,  (measure_help p pred_i) + (measure_help p red_i) + 1)), \n        (snd p)((inc_item pred_i (item_end red_i))\\<mapsto> (red_i, 0))) else p)\" \n    by (metis Complete_pointers_step.simps prod.collapse)\n  (*new item values*)\n  have new_val:\"item_dot new_i = Suc (item_dot pred_i) \\<and> item_rule new_i = item_rule pred_i \\<and>\n        item_end new_i = item_end red_i \\<and> item_origin new_i = item_origin pred_i\" using new_def by simp \n  (*No item to be added*)\n  {assume  \"new_i \\<in> dom (fst p)\"\n    with p_simp new_def have \"p' = p\" by simp\n    with assms have \"measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I \\<and> invariant_pointers' p' \\<and> dom_sup_items p' I\" by simp\n  }\n  then have 1:\"new_i \\<in> dom (fst p) \\<Longrightarrow> measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I\n    \\<and> invariant_pointers' p' \\<and> dom_sup_items p' I \\<and> valid_bounds I\" using assms(10) by blast\n  (*Item added*)\n  {\n    assume  assms':\"new_i \\<notin> dom (fst p)\"\n    with p_simp new_def have p_simp':\"fst p' = (fst p)(new_i\n          \\<mapsto> (pred_i,  (measure_help p pred_i) + (measure_help p red_i) + 1))\" \n       and p_simp'':\"snd p' =  (snd p)(new_i\\<mapsto> (red_i, 0))\" apply simp using p_simp new_def assms' by simp\n    then have new_dom:\"dom (fst p') = dom (fst p) \\<union> {new_i}\" \n          and new_dom':\"dom (snd p') = dom (snd p) \\<union> {new_i} \"by auto \n   \n    (*measure pred*)\n    (*premise*)\n    from assms(2) have prem_mon:\"(\\<forall> i \\<in> (dom (fst p)) . (measure_help p i) > (measure_help p \n  (fst (the ((fst p) i)))))\"by (metis measure_help_monotone.simps prod.collapse)\n    from p_simp' have map_unchanged:\"\\<forall> i . new_i \\<noteq> i \\<longrightarrow> (fst p') i = (fst p) i\" by auto\n    from new_val have \"item_dot new_i > 0\" by simp\n    with assms(9) assms'  have new_not_in_I:\"new_i \\<notin> I\" apply(cases p) by auto  \n    with assms(4) have \"new_i \\<notin> fst ` (ran (fst p) \\<union> ran (snd p))\" apply(cases p)  by auto\n    (*prove measure not changing*)\n    from map_unchanged assms' have  fst_unchanged:\"\\<forall> i \\<in> dom (fst p) . (fst p') i = (fst p) i\" by auto\n    have measure_invar:\"\\<forall> i \\<in> dom (fst p) . measure_help p' i = measure_help p i\"\n      using map_unchanged  surjective_pairing assms' \n      by (metis UnI1 measure_help.simps new_dom) \n    (*prove mapped to not changing*)\n    have dom_ran:\"\\<forall> i \\<in> dom (fst p) . the ((fst p) i) \\<in> ran (fst p)\" by (auto simp add: ran_def)\n    from assms(4) have \"\\<forall> i \\<in> ran (fst p) .  fst i \\<in> I\" apply (cases p) by auto\n    then have \"\\<forall> i \\<in> dom (fst p) . fst (the ((fst p) i)) \\<in> I\" using dom_ran by auto\n    with new_not_in_I have \"\\<forall> i \\<in> dom (fst p) . fst (the ((fst p) i)) \\<noteq> new_i\" by blast\n    then have measure_invar':\"\\<forall> i \\<in> dom (fst p) . measure_help p' (fst (the ((fst p) i))) = measure_help p (fst (the ((fst p) i)))\"\n      using map_unchanged by (metis Un_empty_right Un_insert_right insertE measure_help.simps measure_invar new_dom prod.collapse)(*need a few others to*)\n    then have \"\\<forall> i \\<in> dom (fst p) . measure_help p' (fst (the ((fst p') i))) = measure_help p (fst (the ((fst p) i)))\"\n      using fst_unchanged by auto\n    with prem_mon measure_invar have fst_p'_mon:\"(\\<forall> i \\<in> (dom (fst p)) . (measure_help p' i) > (measure_help p' \n  (fst (the ((fst p') i)))))\" by simp\n    (*new_item added*)\n    have neq_pred:\"new_i \\<noteq> pred_i \\<and> new_i \\<noteq> red_i\" using new_def using assms(5) assms(6) new_not_in_I by blast\n    from new_dom have \"measure_help p' new_i = snd (the ((fst p') new_i))\"\n      by (metis Un_iff insertCI measure_help.simps prod.collapse) \n    with p_simp' have \"measure_help p' new_i = (measure_help p pred_i) + (measure_help p red_i) + 1\" by simp\n    with map_unchanged neq_pred have new_i_meas:\"measure_help p' new_i = (measure_help p' pred_i) + (measure_help p' red_i) + 1\" \n      by (metis (mono_tags, lifting) domD domI measure_help.simps prod.collapse) \n    then have \"measure_help p' new_i > measure_help p' (fst (the ((fst p') new_i)))\" using p_simp' by auto\n    with fst_p'_mon new_dom have measure_monotone:\"(\\<forall> i \\<in> (dom (fst p')) . (measure_help p' i) > (measure_help p' \n  (fst (the ((fst p') i)))))\" by simp\n\n    (*measure red*)\n    (*premise*) \n    (*\\<notin> snd p*)\n    from assms(7) have \"red_implies_pred_dom p\" by simp\n    then  have dom1:\"dom (snd p) \\<subseteq> dom (fst p)\"\n      by (metis red_implies_pred_dom.simps surjective_pairing)\n    have assms'':\"new_i \\<notin> (dom (snd p))\" using assms' using dom1 by blast\n\n    from assms(2) have prem_mon':\"(\\<forall> i \\<in> (dom (snd p)) . (measure_help p i) > (measure_help p \n  (fst (the ((snd p) i)))))\" by (metis measure_help_monotone.simps prod.collapse)\n    from p_simp'' have map_unchanged':\"\\<forall> i . new_i \\<noteq> i \\<longrightarrow> (snd p') i = (snd p) i\" by auto\n    from map_unchanged' assms'' have  snd_unchanged:\"\\<forall> i \\<in> dom (snd p) . (snd p') i = (snd p) i\" by auto\n    have measure_invar:\"\\<forall> i \\<in> dom (snd p) . measure_help p' i = measure_help p i\"\n      using map_unchanged'  surjective_pairing assms'' \n      by (metis gr_implies_not0 measure_help.simps measure_invar prem_mon') \n\n    from new_dom dom1 have red_in_pred:\"\\<forall> i \\<in> dom (snd p) . i \\<in> dom (fst p) \\<and> i \\<in> dom (fst p')\" by auto\n    have dom_ran':\"\\<forall> i \\<in> dom (snd p) . the ((snd p) i) \\<in> ran (snd p)\" by (auto simp add: ran_def)\n    from assms(4) have \"\\<forall> i \\<in> ran (snd p) .  fst i \\<in> I\" apply (cases p) by auto\n    then have \"\\<forall> i \\<in> dom (snd p) . fst (the ((snd p) i)) \\<in> I\" by (auto simp add: dom_ran') \n    with new_not_in_I have map_neq_new:\"\\<forall> i \\<in> dom (snd p) . fst (the ((snd p) i)) \\<noteq> new_i\" by blast\n    then have measure_invar':\"\\<forall> i \\<in> dom (snd p) . (fst p') (fst (the ((snd p) i))) \n          = (fst p) (fst (the ((snd p) i)))\" using map_unchanged by fast\n    from map_neq_new have map_dom':\n        \"\\<forall> i \\<in> dom (snd p) . fst (the ((snd p) i)) \\<in> dom (fst p) \\<longleftrightarrow> \n      fst (the ((snd p) i)) \\<in> dom (fst p')\" using p_simp' by simp\n    have \"\\<forall> i \\<in> dom (snd p) . measure_help p' (fst (the ((snd p) i)))\n          = measure_help p (fst (the ((snd p) i)))\" apply(cases p) apply(cases p') \n      using measure_invar' map_dom' by auto\n    then have \"\\<forall> i \\<in> dom (snd p) . measure_help p' (fst (the ((snd p') i))) = measure_help p (fst (the ((snd p) i)))\"\n      using snd_unchanged by auto\n    with prem_mon' measure_invar have snd_p'_mon:\"(\\<forall> i \\<in> (dom (snd p)) . (measure_help p' i) > (measure_help p' \n  (fst (the ((snd p') i)))))\" by simp\n    \n    (*new item*)\n    from new_i_meas have \"measure_help p' new_i > measure_help p' (fst (the ((snd p') new_i)))\" using p_simp'' by auto\n    with snd_p'_mon new_dom' have \"(\\<forall> i \\<in> (dom (snd p')) . (measure_help p' i) > (measure_help p' \n  (fst (the ((snd p') i)))))\" by blast \n    with measure_monotone have monotone:\"measure_help_monotone p'\" \n      using measure_help_monotone.elims(3) by fastforce\n\n    (*in_set p*)\n    from p_simp' have ran_fst:\"ran (fst p') \\<subseteq> ran (fst p) \\<union> {(pred_i,  measure_help p pred_i + measure_help p red_i + 1)}\" by (auto simp add: ran_def)\n    from assms have add:\"\\<forall> (i, k ) \\<in> {(pred_i, 0)} .  i \\<in> I\" by blast\n    from assms(4) have 2:\"\\<forall> (i, k ) \\<in> (ran (fst p)) . i \\<in> I\" \n      by (metis Un_iff  fst_conv in_set.elims(2))\n    from ran_fst add 2 have in_set:\"\\<forall> (i, k ) \\<in> (ran (fst p')) . i \\<in> I\" by auto\n\n    from p_simp assms' new_def have red_update:\"snd p' = (snd p)(new_i \\<mapsto> (red_i, 0))\" by simp \n    then have 1:\"ran (snd p') \\<subseteq> ran (snd p) \\<union> {(red_i, 0)}\" by (auto simp add: ran_def) (*self proved lemma needed*) \n\n    from assms have add:\"\\<forall> (i, k ) \\<in> {(red_i, 0)} . is_complete i \\<and> i \\<in> I\" by blast\n    from assms(4) have 2:\"\\<forall> (i, k ) \\<in> (ran (snd p)) . i \\<in> I\" \n      by (metis UnI1 assms(4)  in_set.elims(2) snd_conv)\n    from assms(2) have \"\\<forall> (i, k ) \\<in> (ran (snd p)) . is_complete i\"  \n      by (metis red_complete.simps snd_conv surj_pair)\n    then have complete:\"\\<forall> (i, k ) \\<in> (ran (snd p')) . is_complete i \\<and> i \\<in> I\" using add 1 2  by auto\n    (*invariant_pointers'*)\n    (*domain*)\n\n    from red_update have \"dom (snd p') = dom (snd p) \\<union> {new_i}\" by simp\n    with new_dom dom1 have \"dom (snd p') \\<subseteq> dom (fst p')\"  by auto\n    then have red_pred_dom:\"red_implies_pred_dom p'\"\n      by (metis red_implies_pred_dom.simps surjective_pairing)\n    (*pred_increment*)\n    from assms(7) have inc1:\"(\\<forall> node \\<in>  (dom (fst p)) . item_dot node = (Suc (item_dot (fst (the ((fst p) node)))))\n  \\<and> item_rule node = item_rule (fst (the ((fst p) node))))\" \n      by (metis invariant_pointers'.elims(2) pred_increments.simps prod.collapse)\n    then have inc2:\"(\\<forall> node \\<in>  (dom (fst p)) . item_dot node = (Suc (item_dot (fst (the ((fst p') node)))))\n  \\<and> item_rule node = item_rule (fst (the ((fst p') node))))\" by (simp add: fst_unchanged) (*pointer unchanged*)\n    from p_simp' new_val have \"item_dot new_i = (Suc (item_dot (fst (the ((fst p') new_i)))))\n  \\<and> item_rule new_i = item_rule (fst (the ((fst p') new_i)))\" by simp\n    then have \"(\\<forall> node \\<in>  {new_i} . item_dot node = (Suc (item_dot (fst (the ((fst p') node)))))\n  \\<and> item_rule node = item_rule (fst (the ((fst p') node))))\" by simp\n    with inc2 have pred_inc:\"(\\<forall> node \\<in>  (dom (fst p')) . item_dot node = (Suc (item_dot (fst (the ((fst p') node)))))\n  \\<and> item_rule node = item_rule (fst (the ((fst p') node))))\" using new_dom by blast\n    (*correct_bounds*)\n    from assms(7) have correct_bounds_prem:\"correct_bounds p\" by simp\n    then have bound_pred:\"(\\<forall> x \\<in> (dom (fst p)) . item_origin x = item_origin (fst (the ((fst p) x))) \n  \\<and> item_end x \\<ge> item_end (fst (the ((fst p) x))))\" and \n      bound_red:\"(\\<forall> x \\<in> (dom (snd p)) . item_origin (fst (the ((snd p) x))) = item_end (fst (the ((fst p) x))) \\<and> \n    item_end x = item_end (fst (the ((snd p) x))))\" \n      apply (metis correct_bounds.simps  prod.collapse) using correct_bounds_prem  apply(cases p) \n      by (metis (no_types, lifting) correct_bounds.simps dom1 fst_conv snd_conv subsetD)\n    then have bound_pred':\"(\\<forall> x \\<in> (dom (fst p)) . item_origin x = item_origin (fst (the ((fst p') x))) \n  \\<and> item_end x \\<ge> item_end (fst (the ((fst p') x))))\" and \n      bound_red':\"(\\<forall> x \\<in> (dom (snd p)) . item_origin (fst (the ((snd p') x))) = item_end (fst (the ((fst p') x))) \\<and> \n    item_end x = item_end (fst (the ((snd p') x))))\" using fst_unchanged apply simp using bound_red dom1 fst_unchanged snd_unchanged\n      by (metis assms'' map_unchanged) (*map stays for non updated*)\n    (*new_item*)\n    from assms(10) have \"valid_bounds I\" by simp\n    with  assms(6) have \"item_end red_i \\<ge> item_origin red_i\" using valid_bounds_def by simp\n    with assms(8)  have \"item_end red_i \\<ge> item_end pred_i\"  using Completable_def by simp (*hold by to be proven I_bounds_correct / invariant \\<Longrightarrow> items_based*)\n    with p_simp' new_val have \"item_origin new_i = item_origin (fst (the ((fst p') new_i))) \\<and> item_end new_i \\<ge> \n      item_end (fst (the ((fst p') new_i)))\" by simp   \n    with bound_pred' new_dom have bound_pred'':\"(\\<forall> x \\<in> (dom (fst p')) . item_origin x = item_origin (fst (the ((fst p') x))) \n  \\<and> item_end x \\<ge> item_end (fst (the ((fst p') x))))\" by auto\n    have \"item_end new_i = item_end red_i \\<and> item_origin red_i = item_end pred_i\" \n      using new_def assms(8) Completable_def by auto\n    then have \"item_end new_i = item_end (fst (the ((snd p') new_i))) \\<and> \n        item_origin (fst (the ((snd p') new_i))) = item_end (fst (the ((fst p') new_i)))\" using p_simp' p_simp''\n      by simp\n    with bound_red' new_dom' have bound_red'':\"(\\<forall> x \\<in> (dom (snd p')) . item_origin (fst \n      (the ((snd p') x))) = item_end (fst (the ((fst p') x))) \\<and> \n    item_end x = item_end (fst (the ((snd p') x))))\" by simp\n    (*correct bounds reduction pointer*)\n    \n    with bound_pred'' have correct_bounds:\"correct_bounds p'\" apply(cases p') by auto\n    (*correct match*)\n    have pointer_unchanged:\"\\<forall> node . node \\<noteq> new_i \\<longrightarrow> (fst p) node = (fst p') node \\<and> (snd p) node = (snd p') node\" \n      using p_simp' p_simp'' by simp\n\n\n    from assms(7) have \"correct_red_pred_match p\" by auto\n    then have \"(\\<forall> node \\<in> (dom (snd p)) . next_symbol (fst (the ((fst p) node)))\n = Some (item_nonterminal (fst (the ((snd p) node)))))\" \n      by (metis correct_red_pred_match.simps prod.collapse)\n    then have match:\"(\\<forall> node \\<in> (dom (snd p)) . next_symbol (fst (the ((fst p') node)))\n = Some (item_nonterminal (fst (the ((snd p') node)))))\" \n      using pointer_unchanged assms'' by metis\n    from red_update have dom_snd:\"dom (snd p') = dom (snd p) \\<union> {new_i}\" by simp\n    from assms(8) have \"next_symbol pred_i = Some (item_nonterminal red_i)\" \n      using Completable_def item_nonterminal_def by metis\n    then have \"next_symbol (fst (the ((fst p') new_i)))\n    = Some (item_nonterminal (fst (the ((snd p') new_i))))\" using p_simp' p_simp'' by auto\n    with match have \"(\\<forall> node \\<in> (dom (snd p')) . next_symbol (fst (the ((fst p') node)))\n = Some (item_nonterminal (fst (the ((snd p') node)))))\" using dom_snd by simp\n    then have match':\"correct_red_pred_match p'\" \n      using assms' new_def p_simp by auto\n    (*Correct lexing*) (*holds trivially*)\n    from assms' have pointer_unchanged':\n        \"\\<forall> node . node \\<noteq> new_i \\<longrightarrow> node \\<notin> dom (snd p) \\<longleftrightarrow>  node \\<notin> (dom (snd p'))\" \n          using p_simp' p_simp'' by auto\n    from assms(7) have \"(\\<forall> x \\<in> (dom (fst p)) . x \\<notin> dom (snd p) \\<longrightarrow>\n    is_lexed (fst (the ((fst p) x))) x)\" \n      by (metis correct_lexing.simps invariant_pointers'.simps surjective_pairing)\n    with pointer_unchanged have \"(\\<forall> x \\<in> (dom (fst p)) . x \\<notin> dom (snd p) \\<longrightarrow>\n    is_lexed (fst (the ((fst p') x))) x)\" using assms' pointer_unchanged' pointer_unchanged by metis\n    then have prev_lex:\"(\\<forall> x \\<in> (dom (fst p)) . x \\<notin> dom (snd p') \\<longrightarrow>\n    is_lexed (fst (the ((fst p') x))) x)\" using pointer_unchanged' assms' by metis\n    have \"new_i \\<in> dom (fst p') \\<and> new_i \\<in> dom (snd p')\" using p_simp' p_simp'' by simp\n     with prev_lex have \"(\\<forall> x \\<in> (dom (fst p')) . x \\<notin> dom (snd p') \\<longrightarrow>\n    is_lexed (fst (the ((fst p') x))) x)\" using new_dom by simp\n     then have lexing:\"correct_lexing p'\" using correct_lexing.elims(3) by fastforce\n    (*dom_sup_I*)\n      from assms(9) have \"{i . i\\<in> I \\<and> item_dot i >0} \\<subseteq> dom (fst p)\" \n       by (metis (no_types, lifting) Pair_inject dom_sup_items.elims(2) prod.collapse)\n     then have dom_sub_I:\"dom_sup_items p' I\" using new_dom \n       by (metis (no_types, lifting) Pair_inject UnCI dom_sup_items.elims(3) prod.collapse subsetD subsetI)\n    (*no red implies*)\n     from assms(7) have \"no_red_implies_terminal p\" by simp\n     then have \"(\\<forall> node \\<in>  (dom (fst p)) . node \\<notin> (dom (snd p)) \n    \\<longrightarrow> (\\<exists> t . next_symbol (fst (the ((fst p) node))) = Some t \\<and> is_terminal t))\" apply(cases p) by auto\n     then have no_red:\"(\\<forall> node \\<in>  (dom (fst p)) . node \\<notin> (dom (snd p')) \n    \\<longrightarrow> (\\<exists> t . next_symbol (fst (the ((fst p') node))) = Some t \\<and> is_terminal t))\" \n       using pointer_unchanged' pointer_unchanged assms' by metis\n     have \"new_i \\<notin> (dom (snd p')) \\<longrightarrow>(\\<exists> t . next_symbol (fst (the ((fst p') new_i))) = Some t \\<and> is_terminal t)\"\n       using new_dom' by simp\n     with no_red have no_red_implies_terminal:\"no_red_implies_terminal p'\" apply(cases p') using new_dom by simp\n\n    (*final summary*)\n     have \"invariant_pointers' p'\" using lexing match' correct_bounds pred_inc red_pred_dom no_red_implies_terminal \n       by (metis invariant_pointers'.elims(3) pred_increments.simps prod.collapse)\n     with complete monotone in_set dom_sub_I have \"measure_help_monotone p' \\<and> red_complete p' \n      \\<and> in_set  p' I \\<and> invariant_pointers' p' \\<and> dom_sup_items p' I \\<and> valid_bounds I\"\n      using red_complete.elims(3) assms(10)\n      by (metis (no_types, lifting) Un_iff fst_conv in_set.elims(3) prod.case_eq_if snd_conv)\n  }\n  then show ?thesis using 1 by blast\nqed\n\nlemma Complete_extend_help:\"\\<forall> (i, i') \\<in> (Complete_extend k I) . is_complete i' \\<and> i \\<in> I \\<and> i' \\<in> I\"\n  using is_complete_def bin_def by auto\n\nlemma Complete_extend_help':\"\\<forall> (i, i') \\<in> (Complete_extend k I) . next_symbol i = Some (item_nonterminal i') \\<and> item_end i = item_origin i'\"\n  using is_complete_def bin_def by auto\n\nlemma Complete_extend_help'':\"\\<forall> (i, i') \\<in> (Complete_extend k I) . \\<not> (is_complete i)\"\n  using Complete_extend_help' next_symbol_not_complete by blast\n\nlemma finite_Complete_extend:\"finite I \\<Longrightarrow> finite (Complete_extend k I)\"\n  using bin_def finite_subset [where ?A=\"Complete_extend k I\" and ?B=\"I \\<times> I\"] finite_cartesian_product by auto\nlemma Complete_pointers:\n  assumes \"Complete_pointers p (Complete_extend k I) = p'\" \n      \"measure_help_monotone p \\<and> red_complete p \\<and> in_set p I \\<and> invariant_pointers' p \\<and> dom_sup_items p I\" \"valid_bounds I\"\n      \"finite I\"\n  shows \"measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I \\<and> invariant_pointers' p'\"\nproof -\n  have fin_ext:\"finite (Complete_extend k I)\" using finite_Complete_extend assms(4) by blast (*added assumption to carry around*)\n  have 0:\"\\<forall> (i, i') \\<in> (Complete_extend k I) . is_complete i' \\<and> i \\<in> I \\<and> i' \\<in> I\" using Complete_extend_help by blast\n  obtain new where new_def:\"new = csorted_list_of_set (Complete_extend k I)\" by blast\n  then have eq:\"set new = Complete_extend k I\" using fin_ext csorted_set_distinct'(1) (*type issue*)by blast\n  then have 1:\"\\<forall> (i, i') \\<in> (set new) . is_complete i' \\<and> i \\<in> I \\<and> i' \\<in> I\" using 0  by simp    \n  from new_def have 2:\"\\<forall> (i, i') \\<in> (set new) . next_symbol i = Some (item_nonterminal i') \\<and>                 \n      item_end i = item_origin i'\" using Complete_extend_help' eq by auto \n\n  (**)\n  from assms new_def have \"p' = foldl Complete_pointers_step   p new\" by simp\n  with 1 assms(2) 2 show ?thesis \n  proof (induct new arbitrary: p)\n    case Nil\n    then have \"p = p'\" by simp\n  then show ?case using Nil by auto\n  next\n    case (Cons a new)\n    from Cons(2) have 0:\"fst a \\<in> I \" and 1:\"snd a \\<in> I \" and 2:\" is_complete (snd a)\" by auto\n    from Cons(3) have 3:\"measure_help_monotone p \\<and> red_complete p \" and 4:\" in_set p I\" \n        and 5:\"invariant_pointers' p\" and 7:\"dom_sup_items p I\"by auto\n    from Cons(4) have \"next_symbol (fst a) = Some (fst(item_rule (snd a))) \n      \\<and> item_end (fst a) = item_origin (snd a)\" using item_nonterminal_def by force\n    then have 6:\"Completable (fst a) (snd a)\" using Completable_def by blast\n    obtain p'' where p'':\"Complete_pointers_step  p (fst a, snd a) = p''\" by blast\n    then  have p''_invar:\"measure_help_monotone p'' \\<and> red_complete p'' \\<and> in_set p'' I \\<and> invariant_pointers' p''\n    \\<and> dom_sup_items p'' I\" \n        using Complete_pointers_step [OF p'' 3 2 4 0 1 5 6 7 assms(3)] by simp\n  \n    from p'' Cons have \"p' = foldl Complete_pointers_step   p'' new\" by auto\n    then  show ?case using Cons(1) p''_invar Cons by auto \n  qed\nqed\n\n(**)\n\nlemma Complete'_Complete:\"Complete' k (I, p) = (I', p') \\<Longrightarrow> I' = I \\<union> ((\\<lambda> (i, i') . inc_item i k) ` Complete_extend k I)\"\n  by (auto simp add: Complete_def)\n\nlemma Complete_extend_item_end_k:\"\\<forall> (i, i') \\<in> Complete_extend k i . item_end i' = k\" \n  by (auto simp add: bin_def)\n\nlemma Complete_pointers_step_extends_domain:\n  assumes \"Complete_pointers_step  p (i, i') = p'\"\n  shows \"dom (fst p') = dom (fst p) \\<union> {(inc_item i (item_end i'))}\"\nproof -\n  obtain i'' where i''_def:\"i'' = (inc_item i (item_end i'))\" by blast\n  show ?thesis \n  proof (cases \"i'' \\<in> dom (fst p)\")\n    case True\n    then have \"p = p'\" apply (cases p) using assms i''_def by simp\n    with True have 1:\"dom (fst p')  = dom (fst p)\" apply(cases p) by simp\n    from True have \"dom (fst p)  = dom (fst p) \\<union> {i''}\" by blast\n    then show ?thesis using 1 i''_def by simp \n  next\n    case False\n    then have \"fst p' = (fst p)(i''\\<mapsto> (i,  measure_help p i + measure_help p i' + 1))\" \n        apply(cases p) using assms i''_def by fastforce\n    then show ?thesis using i''_def by auto\n  qed\nqed\n\nlemma Complete_pointers_extends_domain:\n  assumes \"Complete_pointers p (Complete_extend k I ) = p'\" \"finite I\" \n  shows \"dom (fst p') = dom (fst p) \\<union> (\\<lambda> (i, i'). inc_item i (item_end i')) `(Complete_extend k I )\"\nproof -\n  have finite:\"finite (Complete_extend k I)\" using assms(2) using finite_Complete_extend by presburger\n  obtain new where new_def:\"new = csorted_list_of_set (Complete_extend k I )\" by blast\n  then have eq:\"set new = Complete_extend k I \" using finite using csorted_set' by presburger \n  from assms new_def have \"p' = foldl Complete_pointers_step   p new\" by simp\n  then have \"dom (fst p') = dom (fst p) \\<union> (\\<lambda>(i, i'). inc_item i (item_end i')) ` (set new)\"\n  proof (induction new arbitrary: p)\n    case Nil\n    then show ?case by simp\n  next\n    case (Cons a new)\n    obtain p'' where step:\"p'' = Complete_pointers_step p a\" by blast\n    then have 1:\"dom (fst p'') = dom (fst p) \\<union> {((\\<lambda>(i, i'). inc_item i (item_end i')) a)}\" \n      apply (cases p'') apply(cases a) using Complete_pointers_step_extends_domain by simp\n    from Cons have \"p' = foldl Complete_pointers_step p'' new\" using step by simp\n    then have \"dom (fst p') = dom (fst p'') \\<union> (\\<lambda>(i, i'). inc_item i (item_end i')) ` (set new)\" \n      using Cons by auto\n    then show ?case using 1 by simp\n  qed\n  then show ?thesis using eq by simp\nqed\n\nlemma Complete'_dom_sup:\n  assumes \"Complete' k (I, p) = (I', p')\" \"dom_sup_items p I\" \"finite I\"\n  shows \"dom_sup_items p' I'\"\nproof -\n  obtain I'' where I''_def:\"I'' = (\\<lambda> (i, i'). inc_item i (item_end i' )) `(Complete_extend k I)\" by simp\n  then have I''_def':\"I'' = (\\<lambda> (i, i'). inc_item i k) `(Complete_extend k I)\" using Complete_extend_item_end_k by fast \n  from assms(1) have I'_def:\"I' =  I \\<union> I''\" using Complete'_Complete  I''_def' by blast (*needs additional proof corresponding to item_end i' = k*)\n  from assms(1) have \"Complete_pointers p (Complete_extend k I ) = p'\" by simp\n  then have 2:\"dom (fst p') = dom (fst p) \\<union> I''\" apply (cases p) apply (cases p') \n    using I''_def Complete_pointers_extends_domain assms(3) by blast\n  from assms(2) have 3:\"{i . i\\<in> I \\<and> item_dot i >0} \\<subseteq> dom (fst p)\" apply(cases p) by simp\n  have \"{i . i\\<in> I' \\<and> item_dot i >0} \\<subseteq> {i . i\\<in> I \\<and> item_dot i >0} \\<union> I''\" using I'_def by auto\n  with 2 3 have \"{i . i\\<in> I' \\<and> item_dot i >0} \\<subseteq> dom (fst p')\" by auto \n  then show ?thesis apply(cases p') by simp\nqed\n\nlemma Complete'_dom_no_scan:\n  assumes \"Complete' k (I, p) = (I', p')\" \"dom_no_scan p I\" \"finite I\"\n  shows \"dom_no_scan p' I'\"\nproof - \n   obtain I'' where I''_def:\"I'' = (\\<lambda> (i, i'). inc_item i (item_end i' )) `(Complete_extend k I)\" by simp\n  then have I''_def':\"I'' = (\\<lambda> (i, i'). inc_item i k) `(Complete_extend k I)\" using Complete_extend_item_end_k by fast \n  from assms(1) have I'_def:\"I' =  I \\<union> I''\" using Complete'_Complete  I''_def' by blast (*needs additional proof corresponding to item_end i' = k*)\n  from assms(1) have \"Complete_pointers p (Complete_extend k I ) = p'\" by simp\n  then have 2:\"dom (fst p') = dom (fst p) \\<union> I''\" apply (cases p) apply (cases p') \n    using I''_def Complete_pointers_extends_domain assms(3) by blast\n  then have new:\"\\<forall> i \\<in> I'' . i \\<in> dom (fst p')\" by simp\n  from assms(2) have \"\\<forall> i \\<in> I . i \\<notin> dom (fst p) \\<longrightarrow> item_origin i = item_end i\" apply(cases p) by simp\n  with 2 have \"\\<forall> i \\<in> I . i \\<notin> dom (fst p') \\<longrightarrow> item_origin i = item_end i\" by simp\n  with new I'_def have \"\\<forall> i \\<in> I' . i \\<notin> dom (fst p') \\<longrightarrow> item_origin i = item_end i\" by blast\n  then show ?thesis apply(cases p') by simp\nqed\n\n\nlemma Complete'_pointers:\"Complete' k (I, p) = (I', p') \\<Longrightarrow> \n    measure_help_monotone p \\<and> red_complete p \\<and> in_set p I \\<and> invariant_pointers' p \\<and> dom_sup_items p I \\<and> dom_no_scan p I \\<and> valid_bounds I \\<and> finite I\\<Longrightarrow>\n    measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I \\<and> invariant_pointers' p' \\<and> dom_sup_items p' I' \\<and> dom_no_scan p' I' \\<and> valid_bounds I'\"\n  using Complete_pointers Complete'_dom_sup Complete'_dom_no_scan \n    Complete'_bounds\n  by (metis Complete'.simps Pair_inject)\n\n\n(*also for all predecessor pointers*)\n\nlemma Complete_eq:\"fst (Complete' k  I)  = Complete k (fst I)\"\n  using Complete_def \n  by (smt (verit, ccfv_SIG) Complete'.elims fst_conv)\n(*need list conversion*)\n\n\nsection \"Proof over scan pointers for reconstruction\n      - assumptions about the relation to the Doc String are added here specifically\"\n\nfun Scan_pointers_step::\" ('a, 'b) sppf_pointers \\<Rightarrow> ('a::ccompare, 'b::ccompare) item \\<times> 'c::ccompare list \n \\<Rightarrow> ('a, 'b) sppf_pointers\" where\n\"Scan_pointers_step (pred, red) (i, token) =  (if ((inc_item i (item_end i + length token)) \\<notin> (dom pred))\n   then (pred((inc_item i (item_end i + length token))\\<mapsto> (i,  measure_help (pred, red) i + 1)), red ) else (pred, red) )\"\n\nfun Scan_pointers::\"('a, 'b) sppf_pointers \\<Rightarrow> (('a::ccompare, 'b::ccompare) item \\<times> 'c::ccompare list) set \\<Rightarrow> ('a, 'b) sppf_pointers\" where\n\"Scan_pointers p I = foldl Scan_pointers_step p (csorted_list_of_set I)  \" (*add precedence pointers*)\n\n(*have to prove that measure does not change for all others*)\n\nfun Scan_extend::\"nat \\<Rightarrow> ('a, 'b) items \\<Rightarrow> ('a, 'b, 'c) token set \\<Rightarrow> (('a, 'b) item \\<times> ('c) list) set\" where\n\"Scan_extend k I T= {(x, c) | x  t c. x \\<in> bin I k \\<and> (t, c) \\<in> T \\<and>\n       next_symbol x = Some t}\"\n\n\nlemma Scan_pointers_step_invar:\n  assumes \"Scan_pointers_step  p (i, c) = p'\"\n        \"measure_help_monotone p \\<and> red_complete p\"  \n        \"in_set p I\" \"i \\<in> I\" \"invariant_pointers' p\" \"dom_sup_items p I\" \"length c \\<in> (Lex (item_rhs i! item_dot i) Doc (item_end i))\"\n        \"\\<exists> t . next_symbol i = Some t \\<and> is_terminal t\" \"length c > 0\"\n      shows \"measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I \\<and> invariant_pointers' p' \n            \\<and> dom_sup_items p' I\"\nproof -\n  obtain new where new_def:\"new = (inc_item i (item_end i + length c))\" by blast\n  have new_val:\"item_dot new = Suc (item_dot i) \\<and> item_rule new = item_rule i \\<and>\n        item_end new = (item_end i + length c) \\<and> item_origin new = item_origin i\" \n    using new_def by auto (*hold by increment*)\n \n  {\n    assume assms':\"new \\<notin> dom (fst p)\"\n    with assms new_def have step:\"p' = ((fst p)(new\\<mapsto> (i,   measure_help p i + 1)), snd p )\" \n      by (metis Scan_pointers_step.simps prod.collapse)\n    (*equality of red*)\n    then have eq:\"ran (snd p') = ran (snd p)\" by auto\n    from assms(2) have \"\\<forall> (i, k ) \\<in> (ran (snd p)) . is_complete i\"  \n      by (metis red_complete.simps snd_conv surj_pair)\n    then have 1:\"red_complete p'\" using eq\n      using local.step red_complete.simps by presburger\n  \n    have \"\\<forall> (i, k ) \\<in> (ran (snd p)) .  i \\<in> I\" \n      by (metis Un_iff assms(3) in_set.elims(2) snd_conv)\n    with eq have inSet:\"\\<forall> (i, k ) \\<in> (ran (snd p')) .  i \\<in> I\" by auto\n\n    have new_dom:\"dom (fst p') = dom (fst p) \\<union> {new}\" using step by simp\n    (*measure*)\n    (*original statement*)\n   from assms(2) have prem_mon:\"(\\<forall> i \\<in> (dom (fst p)) . (measure_help p i) > (measure_help p \n  (fst (the ((fst p) i)))))\"by (metis measure_help_monotone.simps prod.collapse)\n   from step have map_unchanged:\"\\<forall> i . new \\<noteq> i \\<longrightarrow> (fst p') i = (fst p) i\" by auto\n   from new_val have \"item_dot new > 0\" by simp\n   with assms(6) assms'  have new_not_in_I:\"new \\<notin> I\" apply(cases p) by auto  (*this will used to prove that the mapped to can't change*)\n   with assms(3) have \"new \\<notin> fst ` (ran (fst p) \\<union> ran (snd p))\" apply(cases p) by auto \n    (*prove measure not changing*)\n   from map_unchanged assms' have  fst_unchanged:\"\\<forall> i \\<in> dom (fst p) . (fst p') i = (fst p) i\" by auto\n    have measure_invar:\"\\<forall> i \\<in> dom (fst p) . measure_help p' i = measure_help p i\"\n      using map_unchanged  surjective_pairing assms' \n      by (metis UnI1 measure_help.simps new_dom) \n    (*prove mapped to not changing*)\n    have \"\\<forall> i \\<in> dom (fst p) . (the ((fst p) i)) \\<in> ran (fst p)\" by (auto simp add: ran_def)\n    with assms(3) have \"\\<forall> i \\<in> dom (fst p) . fst (the ((fst p) i)) \\<in> I\" apply(cases p) by force\n    with new_not_in_I have \"\\<forall> i \\<in> dom (fst p) . fst (the ((fst p) i)) \\<noteq> new\" by blast\n    then have measure_invar':\"\\<forall> i \\<in> dom (fst p) . measure_help p' (fst (the ((fst p) i))) = \n        measure_help p (fst (the ((fst p) i)))\"\n      using map_unchanged by (metis Un_empty_right Un_insert_right insertE measure_help.simps \n              measure_invar new_dom prod.collapse)(*need a few others to*)\n    then have \"\\<forall> i \\<in> dom (fst p) . measure_help p' (fst (the ((fst p') i))) = measure_help p (fst (the ((fst p) i)))\"\n      using fst_unchanged by auto\n    with prem_mon measure_invar have fst_p'_mon:\"(\\<forall> i \\<in> (dom (fst p)) . (measure_help p' i) > (measure_help p' \n  (fst (the ((fst p') i)))))\" by simp\n    (*new_item added*)\n    have neq_pred:\"new \\<noteq> i\" using new_def using assms(4)  new_not_in_I by blast\n    from new_dom have \"measure_help p' new = snd (the ((fst p') new))\"\n      by (metis Un_iff insertCI measure_help.simps prod.collapse) \n    with step have \"measure_help p' new = (measure_help p i) + 1\" by simp\n    with map_unchanged neq_pred have new_i_meas:\"measure_help p' new = (measure_help p' i) + 1\" \n      by (metis (mono_tags, lifting) domD domI measure_help.simps prod.collapse) \n    then have \"measure_help p' new > measure_help p' (fst (the ((fst p') new)))\" using step  by auto\n    with fst_p'_mon new_dom have measure_monotone:\"(\\<forall> i \\<in> (dom (fst p')) . (measure_help p' i) > (measure_help p' \n  (fst (the ((fst p') i)))))\" by simp\n    (*measure red*)\n    (*premise*) \n    (*\\<notin> snd p*)\n    from assms have \"red_implies_pred_dom p\" by simp\n    then  have dom1:\"dom (snd p) \\<subseteq> dom (fst p)\"\n      by (metis red_implies_pred_dom.simps surjective_pairing)\n    have assms'':\"new \\<notin> (dom (snd p))\" using assms' using dom1 by blast\n\n    from assms(2) have prem_mon':\"(\\<forall> i \\<in> (dom (snd p)) . (measure_help p i) > (measure_help p \n  (fst (the ((snd p) i)))))\" by (metis measure_help_monotone.simps prod.collapse)\n    from step have map_unchanged':\"\\<forall> i . new \\<noteq> i \\<longrightarrow> (snd p') i = (snd p) i\" by auto\n    from map_unchanged' assms'' have  snd_unchanged:\"\\<forall> i \\<in> dom (snd p) . (snd p') i = (snd p) i\" by auto\n    have measure_invar:\"\\<forall> i \\<in> dom (snd p) . measure_help p' i = measure_help p i\"\n      using map_unchanged'  surjective_pairing assms'' \n      by (metis gr_implies_not0 measure_help.simps measure_invar prem_mon') \n    from dom1 have dom1':\"\\<forall> i \\<in> dom (snd p) . i\\<in> dom (fst p)\" by blast\n    from assms(3) have inset:\"(\\<forall> (i', k) \\<in> (ran (fst p) \\<union> ran (snd p)). (i' \\<in> I))\" apply(cases p) by auto\n    then have \"\\<forall> i \\<in> dom (snd p) . the ((snd p) i) \\<in> ran (snd p)\" by (auto simp add: ran_def)\n    with inset  have \"\\<forall> i \\<in> dom (snd p) . fst (the ((snd p) i)) \\<in> I\" apply (cases \"(the ((snd p) i))\") by force\n    with new_not_in_I have map_neq_new:\"\\<forall> i \\<in> dom (snd p) . fst (the ((snd p) i)) \\<noteq> new\" by blast\n    then have map_same:\"\\<forall> i \\<in> dom (snd p) . (fst p') (fst (the ((snd p) i))) = (fst p) (fst (the ((snd p) i)))\" \n      using map_unchanged by metis\n    from map_neq_new have map_dom':\n        \"\\<forall> i \\<in> dom (snd p) . fst (the ((snd p) i)) \\<in> dom (fst p) \\<longleftrightarrow> \n      fst (the ((snd p) i)) \\<in> dom (fst p')\" using step by simp\n    then have measure_invar':\"\\<forall> i \\<in> dom (snd p) . measure_help p' (fst (the ((snd p) i))) \n          = measure_help p (fst (the ((snd p) i)))\" by (metis measure_help.simps prod.collapse map_same )\n    then have \"\\<forall> i \\<in> dom (snd p) . measure_help p' (fst (the ((snd p') i))) = measure_help p (fst (the ((snd p) i)))\"\n      using snd_unchanged by auto\n    with prem_mon' measure_invar step have snd_p'_mon:\"(\\<forall> i \\<in> (dom (snd p')) . (measure_help p' i) > (measure_help p' \n  (fst (the ((snd p') i)))))\" by simp  \n    with measure_monotone have monotone_p':\"measure_help_monotone p'\"\n      using local.step by auto\n    (*in set*)\n    from step have sub:\"ran (fst p') \\<subseteq> ran (fst p) \\<union> {(i,   measure_help p i + 1)}\" apply (cases p') \n        by (auto simp add: ran_def)\n    from assms(3) have 2:\"\\<forall> (i, k ) \\<in> (ran (fst p)) . i \\<in> I\" \n      by (metis UnCI fst_conv in_set.elims(2))\n    with sub have \"\\<forall> (i', k ) \\<in> (ran (fst p')) . i' \\<in>  fst ` ran (fst p) \\<or> i' = i\" by force\n    then have \"\\<forall> (i', k ) \\<in> (ran (fst p')) . i' \\<in> I\" using 2 assms by fastforce\n    with inSet have inset:\"in_set p' I\" \n      by (metis (no_types, lifting) Un_iff fst_conv in_set.elims(3) snd_eqD)\n    (*helpers*)\n    from step  assms' new_def have red_update:\"snd p' = (snd p)\" by simp\n    from step have pred_update:\"fst p' = (fst p)(new \\<mapsto> (i, measure_help p i + 1))\" by simp\n    then have new_dom:\"dom (fst p') = dom (fst p) \\<union> {new}\" by auto\n    (*invariant_pointers'*)\n    (*domain*)\n    from assms(5) have dom1:\"dom (snd p) \\<subseteq> dom (fst p)\" apply(cases p) by (auto simp add: dom_def) \n    from red_update have \"dom (snd p') = dom (snd p)\" by simp\n    with new_dom dom1 have \"dom (snd p') \\<subseteq> dom (fst p')\"  by auto\n    then have red_pred_dom:\"red_implies_pred_dom p'\" \n      by (metis prod.collapse red_implies_pred_dom.simps)\n    from step have pointers_unchanged:\"\\<forall> node . node \\<noteq> new \\<longrightarrow> (fst p) node = (fst p') node\" by simp\n    from dom1 assms' have assms'':\"new \\<notin> dom (snd p)\" by blast\n    (*pred_increment*)\n    from assms(5) have inc0:\"pred_increments p\" by auto\n    then have inc1:\"(\\<forall> node \\<in>  (dom (fst p)) . item_dot node = (Suc (item_dot (fst (the ((fst p) node)))))\n  \\<and> item_rule node = item_rule (fst (the ((fst p) node))))\" \n      by (metis pred_increments.simps prod.collapse)\n    then have inc2:\"(\\<forall> node \\<in>  (dom (fst p)) . item_dot node = (Suc (item_dot (fst (the ((fst p') node)))))\n  \\<and> item_rule node = item_rule (fst (the ((fst p') node))))\" using pointers_unchanged assms' by metis(*because no change*)\n    from pred_update new_val have \"item_dot new = (Suc (item_dot (fst (the ((fst p') new)))))\n  \\<and> item_rule new = item_rule (fst (the ((fst p') new)))\" by simp\n    then have \"(\\<forall> node \\<in>  {new} . item_dot node = (Suc (item_dot (fst (the ((fst p') node)))))\n  \\<and> item_rule node = item_rule (fst (the ((fst p') node))))\" by simp\n    with inc2 have pred_inc:\"(\\<forall> node \\<in>  (dom (fst p')) . item_dot node = (Suc (item_dot (fst (the ((fst p') node)))))\n  \\<and> item_rule node = item_rule (fst (the ((fst p') node))))\" using new_dom by blast\n    then have pred_increments:\"pred_increments p'\" \n      using pred_increments.elims(3) by fastforce\n    (*correct_bounds*)\n    from assms(5) have bound:\"correct_bounds p\" by simp\n    then  have bound_pred:\"(\\<forall> x \\<in> (dom (fst p)) . item_origin x = item_origin (fst (the ((fst p) x))) \n  \\<and> item_end x \\<ge> item_end (fst (the ((fst p) x))))\" and \n      bound_red:\"(\\<forall> x \\<in> (dom (snd p)) . item_origin (fst (the ((snd p) x))) = item_end (fst (the ((fst p) x))) \\<and> \n    item_end x = item_end (fst (the ((snd p) x))))\" \n      apply (metis correct_bounds.simps prod.collapse) using bound \n      by (metis (no_types, lifting) correct_bounds.simps dom1 in_mono surjective_pairing)\n    then have bound_pred':\"(\\<forall> x \\<in> (dom (fst p)) . item_origin x = item_origin (fst (the ((fst p') x))) \n  \\<and> item_end x \\<ge> item_end (fst (the ((fst p') x))))\" and \n      bound_red':\"(\\<forall> x \\<in> (dom (snd p)) . item_origin (fst (the ((snd p') x))) = item_end (fst (the ((fst p') x))) \\<and> \n    item_end x = item_end (fst (the ((snd p') x))))\" using pointers_unchanged assms' \n       apply metis using bound_red red_update assms''\n      using pointers_unchanged by auto (*map stays for non updated*)\n\n    (**)\n    from assms(9) have \"length c >0\" by blast \n    with new_val pred_update have \"item_origin new = item_origin (fst (the ((fst p') new))) \\<and> item_end new \\<ge>\n      item_end (fst (the ((fst p') new)))\" by simp (*do we need strict inequality*)   \n    with bound_pred' new_dom have bounds_pred':\"(\\<forall> x \\<in> (dom (fst p')) . item_origin x = item_origin (fst (the ((fst p') x))) \n  \\<and> item_end x \\<ge> item_end (fst (the ((fst p') x))))\" by auto\n    with bound_red' red_update have correct_bounds:\"correct_bounds p'\"  using correct_bounds.elims(3) \n      by fastforce\n    (*correct match*)\n    from assms(5) have \"correct_red_pred_match p\" by simp\n    then have \"(\\<forall> node \\<in> (dom (snd p)) . next_symbol (fst (the ((fst p) node)))\n = Some (item_nonterminal (fst (the ((snd p) node)))))\" by (metis correct_red_pred_match.simps prod.collapse)\n    with pointers_unchanged assms'' red_update have match:\"correct_red_pred_match p'\" \n      by (metis correct_red_pred_match.elims(3) fst_conv snd_conv)\n    (*correct lexing*)\n    from assms(5) have \"correct_lexing p\" by simp\n    then have \"(\\<forall> x \\<in> (dom (fst p)) . x \\<notin> dom (snd p) \\<longrightarrow>\n    is_lexed (fst (the ((fst p) x))) x)\" by (metis correct_lexing.simps surjective_pairing)\n    then have correct_lexing:\"(\\<forall> x \\<in> (dom (fst p)) . x \\<notin> dom (snd p') \\<longrightarrow>\n    is_lexed (fst (the ((fst p') x))) x)\" using pointers_unchanged assms' red_update by metis\n    have prem:\"new \\<notin> dom (snd p')\" using assms'' red_update by auto\n\n    from assms(7) have \"is_lexed i new\" using new_def by (simp add: is_lexed_def) \n    \n    then have \"new \\<notin> dom (snd p') \\<longrightarrow> is_lexed i new\" by simp\n    with correct_lexing new_dom have \"(\\<forall> x \\<in> (dom (fst p')) . x \\<notin> dom (snd p') \\<longrightarrow>\n    is_lexed (fst (the ((fst p') x))) x)\" using pred_update by simp\n    then have correct_lexing':\"correct_lexing p'\"\n      using correct_lexing.elims(3) by fastforce\n    (*dom_sup_items*)\n    from assms(6) have \"{i . i\\<in> I \\<and> item_dot i >0} \\<subseteq> dom (fst p)\" apply (cases p) by auto\n    with new_dom have \"{i . i\\<in> I \\<and> item_dot i >0} \\<subseteq> dom (fst p')\" by auto\n    then have dom_sup:\"dom_sup_items p' I\" apply(cases p') by auto\n    (*no red implies terminal*)\n    from assms(5) have \"(\\<forall> node \\<in>  (dom (fst p)) . node \\<notin> (dom (snd p)) \n    \\<longrightarrow> (\\<exists> t . next_symbol (fst (the ((fst p) node))) = Some t \\<and> is_terminal t))\" apply(cases p) by auto\n    with pointers_unchanged assms' red_update have no_red:\"(\\<forall> node \\<in>  (dom (fst p)) . node \\<notin> (dom (snd p')) \n    \\<longrightarrow> (\\<exists> t . next_symbol (fst (the ((fst p') node))) = Some t \\<and> is_terminal t))\" by metis\n    from step assms(8) have \"(\\<exists> t . next_symbol (fst (the ((fst p') new))) = Some t \\<and> is_terminal t)\" by simp\n    with prem have \"new \\<notin> dom (snd p') \\<longrightarrow> (\\<exists> t . next_symbol (fst (the ((fst p') new))) = Some t \\<and> is_terminal t)\"\n      by blast\n    with no_red new_dom have no_red_implies_terminal:\"no_red_implies_terminal p'\" apply(cases p') by auto\n    (*summary*)\n    have \"invariant_pointers' p'\" using match pred_increments correct_bounds correct_lexing' red_pred_dom \n       no_red_implies_terminal by simp\n    with  monotone_p' 1 inset dom_sup have \"measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I \n      \\<and> invariant_pointers' p' \\<and> dom_sup_items p' I\" by blast\n  }\n  then have case1:\"new \\<notin> dom (fst p) \\<Longrightarrow> measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I\n    \\<and> invariant_pointers' p' \\<and> dom_sup_items p' I\" by blast\n  {\n    assume \"new \\<in> dom (fst p)\"\n    with assms new_def have step:\"p' = p\" \n      by (metis Scan_pointers_step.simps prod.collapse)\n    then have \"measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I \\<and> invariant_pointers' p' \n    \\<and> dom_sup_items p' I\" using assms by blast\n  }\n  with case1 show ?thesis by blast\nqed\n(*add all the terminal statements there too*)\nfun Scan' :: \"('a, 'b,'c) token set \\<Rightarrow> nat \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow> ('a, 'b) sppf_items\"\nwhere\n  \"Scan' T k (I, p) = (Scan T k I, Scan_pointers p (Scan_extend k I T))\"\n\nlemma Scan'_finite:\"finite I \\<and> finite T \\<Longrightarrow> Scan' T k (I, p) = (I', p') \\<Longrightarrow> finite I'\"\n  by (auto simp add: Scan_Finite)\n\nlemma Scan'_bounds:\"valid_bounds I \\<Longrightarrow> Scan' T k (I, p) = (I', p') \\<Longrightarrow> valid_bounds I'\"\n  by (auto simp add: Scan_bounds)\n\nlemma Scan'_rule:\"valid_rule I \\<Longrightarrow>  Scan' T k (I, p) = (I', p') \\<Longrightarrow> valid_rule I'\"\n  by (auto simp add: Scan_rule)\n\ndefinition Tokens_lexed::\"nat \\<Rightarrow> ('a, 'b', 'c) token set \\<Rightarrow> bool\" where\n\"Tokens_lexed k T = (\\<forall> (t, c) \\<in> T . drop k (take (length c) Doc) = c)\"\n\nlemma Scan_extend_help: (*add statement about everything being lexed*)\n  assumes \"Tokens_lexed k T \" \n  shows \" \\<forall> (i, c) \\<in> (Scan_extend k I T) .   i \\<in> I \\<and> drop k (take (length c) Doc) = c\"\nproof -\n  have 1:\"\\<forall> (i, c) \\<in> (Scan_extend k I T) . i \\<in> I \\<and> (\\<exists> t . (t, c) \\<in> T)\" using bin_def by auto+\n  then show ?thesis \n    using Tokens_lexed_def assms by fastforce\nqed\n\nlemma Scan_extend_help':\"\\<forall> (i, c) \\<in> (Scan_extend k I T) .   i \\<in> I\"\n  using bin_def by auto\n\nlemma Scan_extend_top:\"Scan_extend k I T \\<subseteq> (\\<lambda> (i, (t,c)) . (i, c)) `( I \\<times>  T)\"\nproof - \n  have 1:\"Scan_extend k I T \\<subseteq> {(x, c)| x t c.  x \\<in> I  \\<and> (t, c) \\<in> T }\" using bin_def by fastforce\n  have 2:\"\\<forall> (i ,c) \\<in> {(x, c)| x t c.  x \\<in> I  \\<and> (t, c) \\<in> T } . (\\<exists> t . (i, (t, c)) \\<in> I \\<times> T)\" by blast\n  with 1 have \"Scan_extend k I T \\<subseteq> (\\<lambda> (i, (t, c)) . (i, c)) ` (I \\<times> T)\" by force\n  then show ?thesis by blast\nqed\n\nlemma Scan_extend_finite:\n  assumes \"finite T \" \"finite I \" \n  shows \"finite (Scan_extend k I T)\" \nproof -\n  have \"finite ((\\<lambda> (i, (t,c)) . (i, c)) `( I \\<times>  T))\" using assms finite_cartesian_product by blast\n  then show ?thesis using Scan_extend_top finite_subset by metis\nqed\n\nlemma Scan_extend_lexes:\n  assumes \"\\<forall> (t, c) \\<in> T . (length c) \\<in> (Lex t Doc k)\"\n  shows \"\\<forall> (i, c) \\<in> (Scan_extend k I T) . (length c) \\<in> (Lex (item_rhs i ! item_dot i) Doc (item_end i))\"\nproof -\n  have 1:\"\\<forall> (i, c) \\<in> (Scan_extend k I T) . item_end i = k\" by (auto simp add: bin_def)\n  have 2:\"\\<forall> (i, c) \\<in> (Scan_extend k I T) .  (\\<exists> t . (t, c) \\<in> T \\<and> Some t = next_symbol i)\" by auto\n  then have \"\\<forall> (i, c) \\<in> (Scan_extend k I T) . (\\<exists> t . (t, c) \\<in> T \\<and> Some t = next_symbol i \\<and>  \n      (length c) \\<in> (Lex t Doc k))\" using assms by blast\n  then have \"\\<forall> (i, c) \\<in> (Scan_extend k I T) . (\\<exists> t . (t, c) \\<in> T \\<and>   Some t = Some (item_rhs i ! item_dot i) \\<and>  \n      (length c) \\<in> (Lex t Doc k))\" using next_symbol_def \n    by (smt (z3) case_prodD case_prodI2 option.discI)\n  then have \"\\<forall> (i, c) \\<in> (Scan_extend k I T) . (\\<exists> t . (t, c) \\<in> T \\<and>\n      (length c) \\<in> (Lex (item_rhs i ! item_dot i) Doc k))\" by blast\n  then have \"\\<forall> (i, c) \\<in> (Scan_extend k I T) .   \n      (length c) \\<in> (Lex (item_rhs i ! item_dot i) Doc k)\" by fastforce\n  with 1 show ?thesis by fast\nqed\n\nlemma Scan_extend_next_terminal: \"\\<forall> (t, c) \\<in> T . is_terminal t \\<Longrightarrow> \\<forall> (i, c) \\<in> (Scan_extend k I T) .\n   (\\<exists> t. is_terminal t \\<and> next_symbol i = Some t )\"\n  by auto\n\nlemma Scan_extend_nonempty:\"\\<forall> (t, c) \\<in> T . length c > 0 \\<Longrightarrow> \\<forall> (i, c) \\<in> (Scan_extend k I T) \n  . length c > 0\" by auto\n\nlemma Scan_pointers:\n  assumes \"Scan_pointers p (Scan_extend k I T) = p'\" \n          \"measure_help_monotone p \\<and> red_complete p \\<and> in_set p I \\<and> invariant_pointers' p \\<and> dom_sup_items p I\"\n          \"finite T\" \"finite I\" \"\\<forall> (t, c) \\<in> T . (length c) \\<in> (Lex t Doc k)\" \"\\<forall> (t, c) \\<in> T . is_terminal t\" \n          \"\\<forall> (t, c) \\<in> T . length c > 0\"\n  shows \"measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I \\<and> invariant_pointers' p'\"\nproof -\n  obtain new where new_def:\"new = csorted_list_of_set (Scan_extend k I T)\" by blast\n  then have 1:\"\\<forall> (i, c) \\<in> (set new) .  i \\<in> I\"  by (metis Scan_extend_help' csorted_set Scan_extend_finite assms(3) assms(4))\n  from new_def have lexes:\"\\<forall> (i, c) \\<in> (set new) . (length c) \\<in> (Lex (item_rhs i ! item_dot i) Doc (item_end i))\" \n    using Scan_extend_finite Scan_extend_lexes assms(3) assms(4) assms(5) csorted_set by presburger\n  from new_def have is_terminal:\"\\<forall> (i, c) \\<in> (set new) . (\\<exists> t . is_terminal t \\<and> next_symbol i = Some t)\"\n    using Scan_extend_finite Scan_extend_next_terminal assms csorted_set by presburger\n  from new_def have non_empty_tokens:\"\\<forall> (i, c) \\<in> (set new) . length c > 0\"\n    using Scan_extend_finite Scan_extend_nonempty assms csorted_set by presburger\n  from assms new_def have \"p' = foldl Scan_pointers_step   p new\" by simp\n  with assms(2) 1 lexes is_terminal non_empty_tokens \n    show ?thesis \n  proof (induction new arbitrary: p)\n    case Nil\n    then have \"p' = p\" by simp\n    then show ?case using Nil by simp\n  next\n    case (Cons a new)\n    from Cons(2) have 1:\"measure_help_monotone p \\<and> red_complete p\" and 2:\"in_set p I\" by auto\n    from Cons(3) have 3:\"fst a \\<in> I\" by auto\n    from Cons(2) have 4:\"invariant_pointers' p\" by blast\n    from Cons(2) have 5:\"dom_sup_items p I\" by blast\n    from Cons(4) have 6:\"length (snd a) \\<in> Lex (item_rhs (fst a) ! item_dot (fst a)) Doc (item_end (fst a))\" by auto\n    from Cons(5) have 7:\"\\<exists> t .  next_symbol (fst a ) = Some t \\<and> is_terminal t\" by auto\n    from Cons(6) have 8:\"length (snd a)  > 0\" by force\n    obtain p'' where p'':\"Scan_pointers_step p (fst a, snd a) = p''\" by blast\n    then  have p''_invar:\"measure_help_monotone p'' \\<and> red_complete p'' \\<and> in_set p'' I \n        \\<and> invariant_pointers' p'' \\<and> dom_sup_items p'' I\" using \n         Scan_pointers_step_invar [OF p'' 1 2 3 4 5 6 7 8]  by simp\n    from p'' Cons have \"p' = foldl Scan_pointers_step  p'' new\" by auto\n    then show ?case using Cons p''_invar by simp \n  qed\nqed\n\nlemma in_set_trans:\n  assumes \"in_set p I \" \" I \\<subseteq> I' \"\n  shows \" in_set p I'\"\nproof -\n  from assms have \"(\\<forall> (i', k) \\<in> (ran (fst p) \\<union> ran (snd p)). (i' \\<in> I))\"\n    by (metis (no_types, lifting) case_prod_beta' in_set.simps inf_sup_aci(5) prod.collapse)\n  with assms(2) show ?thesis\n    by (metis (mono_tags, lifting) assms(1) case_prod_beta' in_set.elims(3) in_set.simps subset_iff)\nqed\n\nlemma Scan_sub:\"Scan k T I = I' \\<Longrightarrow> I \\<subseteq> I'\"\n  by (auto simp add: Scan_def)\nlemma Scan'_sub:\"Scan' k T (I,  p)  = (I', p') \\<Longrightarrow> I \\<subseteq> I'\" \n  using Scan_sub by auto\n\nlemma Scan_pointers_step_extends_domain:\n  assumes \"Scan_pointers_step  p (i, c) = p'\"\n  shows \"dom (fst p') = dom (fst p) \\<union> {(inc_item i (item_end i + length c))}\"\nproof -\n  obtain i' where i'_def:\"i' = (inc_item i (item_end i + length c))\" by blast\n  show ?thesis \n  proof (cases \"i' \\<in> dom (fst p)\")\n    case True\n    then have \"p = p'\" apply (cases p) using assms i'_def by simp\n    with True have 1:\"dom (fst p')  = dom (fst p)\" apply(cases p) by simp\n    from True have \"dom (fst p)  = dom (fst p) \\<union> {i'}\" by blast\n    then show ?thesis using 1 i'_def by simp \n  next\n    case False\n    then have \"fst p' = (fst p)(i'\\<mapsto> (i,  measure_help p i + 1))\" \n        apply(cases p) using assms i'_def by fastforce\n    then show ?thesis using i'_def by auto\n  qed\nqed\n\nlemma Scan_pointers_extends_domain:\n  assumes \"Scan_pointers p (Scan_extend k I T) = p'\" \"finite I\" \"finite T\"\n  shows \"dom (fst p') = dom (fst p) \\<union> (\\<lambda> (i,c ). inc_item i (item_end i + length c)) `(Scan_extend k I T)\"\nproof -\n  obtain new where new_def:\"new = csorted_list_of_set (Scan_extend k I T)\" by blast\n  then have eq:\"set new = Scan_extend k I T\" using csorted_set Scan_extend_finite assms by auto \n  from assms new_def have \"p' = foldl Scan_pointers_step   p new\" by simp\n  then have \"dom (fst p') = dom (fst p) \\<union> (\\<lambda>(i, c). inc_item i (item_end i + length c)) ` (set new)\"\n  proof (induction new arbitrary: p)\n    case Nil\n    then show ?case by simp\n  next\n    case (Cons a new)\n    obtain p'' where step:\"p'' = Scan_pointers_step p a\" by blast\n    then have 1:\"dom (fst p'') = dom (fst p) \\<union> {((\\<lambda>(i, c). inc_item i (item_end i + length c)) a)}\" \n      apply (cases p'') apply(cases a) using Scan_pointers_step_extends_domain by simp\n    from Cons have \"p' = foldl Scan_pointers_step p'' new\" using step by simp\n    then have \"dom (fst p') = dom (fst p'') \\<union> (\\<lambda>(i, c). inc_item i (item_end i + length c)) ` (set new)\" \n      using Cons by auto\n    then show ?case using 1 by simp\n  qed\n  then show ?thesis using eq by simp\nqed\n\nlemma Scan_extend_eq_Scan_add:\"(\\<lambda> (i,c ). inc_item i (item_end i + length c)) `(Scan_extend k I T) \n  = { inc_item x (k + length c) | x t c. x \\<in> bin I k \\<and> (t, c) \\<in> T \\<and>\n       next_symbol x = Some t }\"\nproof -\n  have 1:\"{inc_item x (k + length c) | x t c. x \\<in> bin I k \\<and> (t, c) \\<in> T \\<and>\n       next_symbol x = Some t } = (\\<lambda> (i,c ). inc_item i (k + length c)) `(Scan_extend k I T)\" by auto\n  have \"\\<forall> (i, c )\\<in> Scan_extend k I T . item_end i = k\" using bin_def by auto \n  then have \"(\\<lambda> (i,c ). inc_item i (item_end i + length c)) `(Scan_extend k I T) = \n    (\\<lambda> (i,c ). inc_item i (k + length c)) `(Scan_extend k I T)\" by fast\n  with 1 show ?thesis by simp\nqed\nlemma Scan_dom_sup:\n  assumes \"Scan'  T k (I,  p)  = (I', p')\" \"dom_sup_items p I\" \"finite I\" \"finite T\"\n  shows \"dom_sup_items p' I'\"\nproof -\n  obtain I'' where I''_def:\"I'' = (\\<lambda> (i,c ). inc_item i (item_end i + length c)) `(Scan_extend k I T)\" by simp\n  from assms(1) have 1:\"Scan T k I = I'\" by simp\n  then have I'_def:\"I' =  I \\<union> I''\" using Scan_def I''_def Scan_extend_eq_Scan_add by simp\n  from assms(1) have \"Scan_pointers p (Scan_extend k I T) = p'\" by simp\n  then have 2:\"dom (fst p') = dom (fst p) \\<union> I''\" apply (cases p) apply (cases p') \n    using I''_def Scan_pointers_extends_domain assms by meson\n  from assms(2) have 3:\"{i . i\\<in> I \\<and> item_dot i >0} \\<subseteq> dom (fst p)\" apply(cases p) by simp\n  have \"{i . i\\<in> I' \\<and> item_dot i >0} \\<subseteq> {i . i\\<in> I \\<and> item_dot i >0} \\<union> I''\" using I'_def by auto\n  with 2 3 have \"{i . i\\<in> I' \\<and> item_dot i >0} \\<subseteq> dom (fst p')\" by auto \n  then show ?thesis apply(cases p') by simp\nqed\n\n\nlemma Scan'_dom_no_scan:\n  assumes \"Scan' T k (I, p) = (I', p')\" \"dom_no_scan p I\" \"finite I\" \"finite T\" \n  shows \"dom_no_scan p' I'\"\nproof - \n  obtain I'' where I''_def:\"I'' = (\\<lambda> (i,c ). inc_item i (item_end i + length c)) `(Scan_extend k I T)\" by simp\n  from assms(1) have 1:\"Scan T k I = I'\" by simp\n  then have I'_def:\"I' =  I \\<union> I''\" using Scan_def I''_def \n    using Scan_extend_eq_Scan_add by auto\n  from assms(1) have \"Scan_pointers p (Scan_extend k I T) = p'\" by simp\n  then have 2:\"dom (fst p') = dom (fst p) \\<union> I''\" apply (cases p) apply (cases p') \n    using I''_def Scan_pointers_extends_domain assms by meson\n  then have new:\"\\<forall> i \\<in> I'' . i \\<in> dom (fst p')\" by simp\n  from assms(2) have \"\\<forall> i \\<in> I . i \\<notin> dom (fst p) \\<longrightarrow> item_origin i = item_end i\" apply(cases p) by simp\n  with 2 have \"\\<forall> i \\<in> I . i \\<notin> dom (fst p') \\<longrightarrow> item_origin i = item_end i\" by simp\n  with new I'_def have \"\\<forall> i \\<in> I' . i \\<notin> dom (fst p') \\<longrightarrow> item_origin i = item_end i\" by blast\n  then show ?thesis apply(cases p') by simp\nqed\n\n\nlemma Scan'_pointers:\"finite I \\<and> finite T \\<Longrightarrow> \\<forall>(t, c)\\<in>T. length c \\<in> Lex t Doc k \\<Longrightarrow> \n  \\<forall>(t, c)\\<in>T. is_terminal t \\<Longrightarrow>  \\<forall>(t, c)\\<in>T. length c > 0 \\<Longrightarrow>\n  Scan'  T k (I,  p)  = (I', p') \\<Longrightarrow> measure_help_monotone p \\<and> red_complete p \\<and> in_set p I \n    \\<and> invariant_pointers' p \\<and> dom_sup_items p I \\<and> dom_no_scan p I \\<Longrightarrow>\n  measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I \\<and> invariant_pointers' p' \\<and> \n  dom_sup_items p' I' \\<and> dom_no_scan p' I'\"\n  using Scan_pointers[where ?T = \"T\" and ?I = \"I\" and ?k=\"k\" and ?p=\"p\" and ?p'=\"p'\"]\n    Scan_dom_sup [where ?T = \"T\" and ?I = \"I\" and ?k=\"k\" and ?p=\"p\" and ?p'=\"p'\"] \n    Scan'_dom_no_scan [where ?T = \"T\" and ?I = \"I\" and ?k=\"k\" and ?p=\"p\" and ?p'=\"p'\"] by simp\n\nlemma Scan'_pointers':\n  assumes \"Scan'  T k (I,  p)  = (I', p') \" \"finite I \\<and> finite T\" \"\\<forall>(t, c)\\<in>T. length c \\<in> Lex t Doc k\"\n          \"\\<forall>(t, c)\\<in>T. is_terminal t\" \"\\<forall>(t, c)\\<in>T. length c > 0\"\n          \"measure_help_monotone p \\<and> red_complete p \\<and> in_set p I \\<and> invariant_pointers' p \\<and> dom_sup_items p I\n          \\<and> dom_no_scan p I\"\n  shows \"measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I' \\<and> \n        invariant_pointers' p' \\<and> dom_sup_items p' I' \\<and> dom_no_scan p' I'\"\nproof -\n  have \"I \\<subseteq> I'\" using assms Scan'_sub by blast\n  with Scan'_pointers [OF assms(2) assms(3) assms(4) assms(5) assms(1) assms(6) ] show ?thesis \n    using in_set_trans  assms by blast\nqed\n\nlemma Scan_eq:\"fst (Scan' T k  I)  = Scan T k (fst I)\"\n  using Scan_def \n  by (smt (verit) Complete'.elims Scan'.simps fst_conv)\n\nfun step'::\"nat \\<Rightarrow> ('a, 'b, 'c) token set \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow> ('a, 'b) sppf_items\" where\n\"step' k T   =(\\<lambda> I. Scan' T k (Complete' k (Predict' k I))) \"\n\n\nlemma step'_invar:\n  assumes \"step' k T (I, p) = (I', p')\" \n          \"measure_help_monotone p \\<and> red_complete p \\<and> in_set p I \\<and> invariant_pointers' p\"\n          \"finite I \\<and> finite T\" \"valid_bounds I\" \"valid_rule I\" \"dom_sup_items p I\" \"dom_no_scan p I\"\n          \"\\<forall>(t, c)\\<in>T. length c \\<in> Lex t Doc k\" \"\\<forall>(t, c)\\<in>T. is_terminal t\" \"\\<forall>(t, c)\\<in>T. length c > 0\"\n        shows \"measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I' \\<and> invariant_pointers' p' \n              \\<and> finite I' \\<and> valid_bounds I' \\<and> valid_rule I' \\<and> dom_sup_items p' I' \\<and> dom_no_scan p' I'\"\nproof -\n  obtain I'' p'' where step1:\"(I'', p'') = Predict' k (I, p)\" by simp\n  then have 0:\"p'' = p \\<and> (Predict k I) =  I''\" by auto \n  then have 1:\"p'' = p \\<and>  I \\<subseteq>  I''\" by (auto simp add: Predict_def) \n  then have inv:\"measure_help_monotone p'' \\<and> red_complete p'' \\<and> in_set p'' I'' \n    \\<and> invariant_pointers' p'' \" using assms in_set_trans  by blast\n  from step1 assms have fin1:\"finite I''\" by (auto simp add: Predict'_finite)\n  from step1 assms have bound1:\"valid_bounds I''\" using Predict_bounds 0 by blast\n  from step1 assms have rule1:\"valid_rule I''\" using Predict'_rule by simp\n  from step1 assms have dom_sup1:\"dom_sup_items p'' I''\" using Predict'_dom_sup 1 by metis\n  from step1 assms have dom_no_scan1:\"dom_no_scan p'' I''\" using Predict'_dom_no_scan by metis \n  obtain I''' p''' where step2:\"(I''', p''') = Complete' k (I'', p'')\" by simp\n  then have 2:\"measure_help_monotone p''' \\<and> red_complete p''' \\<and> in_set p''' I'' \\<and> \n    invariant_pointers' p''' \\<and> dom_sup_items p''' I''' \\<and> dom_no_scan p''' I'''\" using Complete'_pointers inv dom_sup1 \n    dom_no_scan1 bound1 fin1 by auto\n  from step2 have \"I'' \\<subseteq> I'''\" by (auto simp add: Complete_def)\n  with 2 have inv':\"measure_help_monotone p''' \\<and> red_complete p''' \\<and> in_set p''' I'''\n      \\<and> invariant_pointers' p''' \\<and> dom_sup_items p''' I''' \\<and> dom_no_scan p''' I'''\" \n    using in_set_trans by blast\n  from step2 fin1 have fin2:\"finite I'''\" by (auto simp add: Complete'_finite)\n  from step2 bound1 have bound2:\"valid_bounds I'''\" by (auto simp add: Complete'_bounds)\n  from step2 rule1 have rule2:\"valid_rule I'''\" by (auto simp add: Complete'_rule)\n  have step3:\"(I', p') = Scan' T k (I''', p''')\" using step1 step2  assms(1) by auto\n  then have inv'':\"measure_help_monotone p' \\<and> red_complete p' \\<and> in_set p' I' \\<and> invariant_pointers' p' \n  \\<and> dom_sup_items p' I' \\<and> dom_no_scan p' I'\"\n    using Scan'_pointers' assms inv' fin2  by simp\n  from step3 fin2 assms have fin3:\"finite I'\" using Scan'_finite by metis\n  from step3 bound2 have bound3:\"valid_bounds I'\" and rule3: \"valid_rule I'\" using Scan'_bounds apply metis\n    using step3 rule2 Scan'_rule by metis\n  with inv'' fin3 show ?thesis using assms by simp\nqed\n\nsection \"\\<pi> function\"\n\nfun \\<pi>' :: \"nat \\<Rightarrow> ('a, 'b, 'c) token set \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow> ('a, 'b) sppf_items\"\nwhere\n  \"\\<pi>' k T I = \n     while (\\<lambda> I. fst (step' k T I) \\<noteq> fst I) (step' k T) I\"\n\nlemma step_eq:\"fst (step' k T I)  = step k T (fst I)\" \n  using step_def Complete_eq Predict_eq Scan_eq by simp\n\ndefinition invariant''::\"nat \\<Rightarrow> ('a, 'b, 'c) token set \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow>('a, 'b) sppf_items \\<Rightarrow> bool\" where\n\"invariant'' k  T init I = (\\<exists> n . funpower (step k T) n  (fst init)   = fst I)\" (*there exists a *)\n\nlemma inv''_1:\n  assumes \"invariant'' k T I s \" \" fst (step' k T s) \\<noteq> fst s\" \n  shows \" invariant'' k T I (step' k T s)\"\nproof -\n  from assms obtain n where 1:\"funpower (step k T) n  (fst I)   = fst s\" using invariant''_def by blast\n  from assms have \"step k T (fst s) = fst (step' k T s)\" using step_eq by auto\n  with 1  have \"funpower (step k T) (Suc n) (fst I) = fst (step' k T s)\" by auto\n  then show ?thesis using invariant''_def by blast\nqed\n\nlemma step_inc':\n  \"funpower (step k T) n I = s \\<Longrightarrow>  s \\<subseteq> funpower (step k T) (n' + n) I\"\nproof (induction n')\n  case 0\n  then show ?case by simp\nnext\n  case (Suc n')\n  have \"funpower (step k T) (Suc (n' + n) ) I = step k T (funpower (step k T) (n' + n) I)\" by auto\n  then have \"(funpower (step k T) (n' + n) I) \\<subseteq> funpower (step k T) (Suc (n' + n)) I \" using step_def \n    using step_inc by auto\n  then show ?case using Suc by simp\nqed\n\nlemma inv''_2:\n  assumes \"invariant'' k T I s \" \" fst (step' k T s) = fst s\" \n  shows \"\\<pi> k T (fst I) = fst s\"\nproof -\n  obtain new where new_def:\"new = step' k T s\" by simp\n  with assms(2)  have \"fst new \\<subseteq> fst s\" by blast (*how does it hold?*)\n  from assms(1) have \"(\\<exists>n. funpower (step k T) n (fst I) = fst s)\" using invariant''_def by simp\n  then obtain n where base:\"funpower (step k T) n  (fst I)   = fst s\"  by blast\n  then have  1:\"funpower (step k T) (n' + n)  (fst I) = fst s\" for n'\n  proof (induction n')\n    case 0\n    then show ?case using base by simp\n  next\n    case (Suc n')\n    have \"funpower (step k T) (Suc n' + n) (fst I) =  step k T (funpower  (step k T) (n' + n)  (fst I))\"  by simp\n    then have \"funpower (step k T) (Suc n' + n) (fst I) =  step k T (fst s)\" using Suc by auto\n    then show ?case using assms step_eq by auto\n  qed  \n  from base have 2:\"natUnion' n (\\<lambda> n. funpower (\\<lambda> I. Scan T k (Complete k (Predict k I))) n (fst I)) = fst s\" \n      using step_natunion' \n      by (simp add: add.commute) \n  from 1 have \"\\<forall> n' \\<ge> 0 . funpower (step k T) (n' + n)  (fst I) = fst s\" by simp\n  from 1 have \"\\<Union> {((\\<lambda> n. funpower (\\<lambda> I. Scan T k (Complete k (Predict k I))) n (fst I)) n') | n' .n' \\<ge> n} = (fst s)\" \n    apply (auto simp add: step_def) \n    apply (metis add.commute less_eqE) \n    using nat_le_iff_add by auto\n  then have \"natUnion (\\<lambda> n. funpower (\\<lambda> I. Scan T k (Complete k (Predict k I))) n (fst I)) = (fst s)\" \n    apply (auto simp add: natUnion_def) using step_inc' 2 \n    by (smt (z3) Union_iff mem_Collect_eq natUnion'_def nat_le_linear)\n  then show ?thesis by (simp add: \\<pi>_def limit_def )\nqed\n\ndefinition invariant'''::\"nat \\<Rightarrow> ('a, 'b, 'c) token set \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow>('a, 'b) sppf_items \\<Rightarrow> bool\" where\n\"invariant''' k  T init I = (invariant'' k  T init I \\<and>  fst (step' k T I) \\<noteq> fst I)\" (*there exists a *)\n\n(*new measure*)\ndefinition meas_All_top'::\"('a, 'b) sppf_items  \\<Rightarrow> nat\" where\n\"meas_All_top' I  = card {s . s \\<in> All_top \\<and>   s \\<notin> (fst I)}\"\n(*modified all_top version*)\ndefinition invariant_All_top'::\"nat \\<Rightarrow> ('a, 'b, 'c) token set \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow> bool\" where\n\"invariant_All_top'  k  T init I = ((fst I) \\<subseteq> All_top \\<and> k \\<le> length Doc \\<and> (\\<forall> (t, c) \\<in> T . k + length c \\<le> length Doc) \n   \\<and> (\\<exists> n . fst (funpower (step' k T) n  init)   = fst I))\" (*there exists a *)\n\nlemma invariant_All_top'_step:\n  assumes \"invariant_All_top' k T I s\" \"fst (step' k T s) \\<noteq> fst s\" \n  shows \"invariant_All_top' k T I (step' k T s)\"\nproof -\n  from assms obtain n where \"fst (funpower (step' k T) n  I)   = fst s\" \n    using invariant_All_top'_def by meson\n  then have 1:\"fst (funpower (step' k T) (Suc n)  I) = step k T (fst s)\" using step_eq by simp\n  with assms invariant_All_top'_def have \"step k T (fst s) \\<subseteq> All_top\" using step_def Step_All_top by simp\n  with assms invariant_All_top'_def 1 step_eq show ?thesis by metis\nqed\n\nlemma step_eq':\"fst (funpower (step' k T) n  init)   =  funpower (step k T) n (fst init) \"\nproof (induct n arbitrary: I)\n  case 0\n  then show ?case by simp\nnext\n  case (Suc n)\n  then have \"fst (funpower (step' k T) (Suc n) init) = fst (step' k T (funpower (step' k T)  n init))\"\n    by simp\n  with step_eq have \"fst (funpower (step' k T) (Suc n) init) = step  k T (fst (funpower (step' k T)  n init))\"\n    by simp\n  with Suc show ?case by simp\nqed \n\nlemma invariant_All_top'_final:\n  assumes \"invariant_All_top' k T I s \" \"fst (step' k T s) = fst s \" \n  shows \"\\<pi> k T (fst I) = fst s \\<and> fst s \\<subseteq> All_top \\<and> step k T (fst s) = (fst s)\"\nproof -\n  obtain n where  \"fst s \\<subseteq> All_top \\<and> fst (funpower (step' k T) n  I)   = fst s\" \n    using assms(1)  by (auto simp add: invariant_All_top'_def)\n  then have \"invariant_All_top k T (fst I) (fst s)\" \n     using step_eq' invariant_All_top_def invariant_All_top'_def assms(1) by presburger\n   with step_eq assms(2) show ?thesis\n     using limit' by presburger\nqed\n\nlemma  meas_All_top'_decreasing:\n  assumes \"invariant_All_top'  k  T init  x \\<and> fst (step' k T x) \\<noteq> fst x\"\n  shows \"meas_All_top'  (step' k T x) < meas_All_top' x \"\nproof -\n  obtain x' x'' where x':\"x' = fst x \\<and> x'' = step k T x'\" by simp \n  then have x'':\"x'' = fst (step' k T x)\" using step_eq by simp\n  from x' assms have top:\"x' \\<subseteq> All_top\" using invariant_All_top'_def  by simp\n  then have top':\"x'' \\<subseteq> All_top\" using x' assms invariant_All_top'_def Step_All_top step_def by simp\n  from assms have \"x' \\<subset> x''\" using   step_inc  x' step_eq by fast \n  with top top' have \"{s . s \\<in> All_top \\<and>   s \\<notin>  step k T x'} \\<subset> {s . s \\<in> All_top \\<and>   s \\<notin>   x'}\" \n    by (smt (verit, best) Collect_mono_iff subset_iff subset_not_subset_eq x')\n  then have sub:\"{s . s \\<in> All_top \\<and>   s \\<notin>  fst (step' k T x)} \\<subset> {s . s \\<in> All_top \\<and>   s \\<notin>   (fst x)}\"\n    using x' x'' by simp\n  from All_top_fin have fin:\"finite  {s . s \\<in> All_top \\<and>   s \\<notin> (fst x)}\" by simp\n  show ?thesis apply(simp add: meas_All_top'_def) using sub fin   psubset_card_mono by auto\nqed\n\nlemma wf_All_top:\"wf {(t, s). invariant_All_top' k T init  s \\<and> fst (step' k T s) \\<noteq> fst s \\<and> t = step' k T s}\"\n  using wf_if_measure [where ?P=\"\\<lambda> x . invariant_All_top' k T init x \\<and> fst (step' k T x) \\<noteq> fst x\" \n      and ?g=\"(\\<lambda> I .  step' k T I)\"and ?f = \"meas_All_top'\"]\n  meas_All_top'_decreasing  by fastforce\n\nlemma All_top_equality:\n  assumes  \"k \\<le> length Doc\" \"\\<forall> (t, c) \\<in> T. k + length c \\<le> length Doc\" \"fst I \\<subseteq> All_top\"\n  shows \"fst (\\<pi>' k T I ) = \\<pi> k T (fst I)\"\nproof -\n  have \"funpower (step' k T) 0 I = I\" by simp\n  then have 0:\"invariant_All_top' k T I I\" using invariant_All_top'_def using assms by metis\n  from assms have 1:\"\\<pi> k T (fst I) = while (\\<lambda> I .  step k T I  \\<noteq> I) (step k T) (fst I)\" \n      using \\<pi>_termination_All_top by simp\n  have 2:\"\\<pi>' k T I = while (\\<lambda> I .  step k T (fst I)  \\<noteq> (fst I)) (step' k T)  I\" using step_eq by simp\n  have \"\\<pi> k T (fst I) = fst (while (\\<lambda> I .  fst (step' k T  I)  \\<noteq> (fst I)) (step' k T)  I) \"\n    apply (rule while_rule_lemma [where ?P = \"invariant_All_top' k T I\" and?b = \"(\\<lambda> I .  fst (step' k T  I)  \\<noteq> fst I)\" and ?c = \"step' k T\" and ?s =  \"I\" ])\n    using invariant_All_top'_step apply simp\n    using invariant_All_top'_final  apply simp (*should probably add other invariants*)\n    using wf_All_top assms apply blast\n    using 0 by simp\n  then show ?thesis by simp\nqed\n\n(*inherited wf*)\n\nsection \"Other invariants\"\n\nfun invariant_pointers::\"('a, 'b) sppf_items \\<Rightarrow> bool\" where\n\"invariant_pointers (I, s) = (measure_help_monotone s \\<and> red_complete s \\<and> in_set  s I \\<and> \ninvariant_pointers' s \\<and> finite I \\<and> valid_bounds I \\<and> valid_rule I \\<and> dom_sup_items s I \\<and> dom_no_scan s I)\"\n\nlemma invariant_pointers_step:\n  assumes \"finite T \" \"\\<forall>(t, c)\\<in>T. length c \\<in> Lex t Doc k\" \n   \"\\<forall>(t, c)\\<in>T . is_terminal t \" \"\\<forall>(t, c)\\<in>T. length c > 0\" \"invariant_pointers Ip\"  \n  shows \"invariant_pointers (step' k T Ip)\" \nproof -\n  obtain I p where 1:\"(I, p) = Ip\" by (metis invariant_pointers.cases)\n  with assms have 2:\"measure_help_monotone p \\<and> red_complete p \\<and> in_set p I \\<and> invariant_pointers' p\" by force\n  from 1 assms have 3:\" valid_bounds I\" and 4:\" valid_rule I \" and 5:\" dom_sup_items p I \" \n    and 6:\"dom_no_scan p I\" by auto\n  from 1 assms have 7:\"finite I \\<and> finite T\" by auto\n  obtain I' p'  where step:\"step' k T (I, p) = (I', p')\" using 1 by fastforce\n  then have \"invariant_pointers (I', p') \"  using step'_invar [OF step 2 7 3 4 5 6 assms(2) assms(3) assms(4)] by simp\n  with step 1 show ?thesis by simp\nqed\n\ndefinition invariant4::\"nat \\<Rightarrow> ('a, 'b, 'c) token set \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow>('a, 'b) sppf_items \\<Rightarrow> bool\" where\n\"invariant4 k  T init I = (invariant'' k  T init I \\<and>  invariant_pointers I \\<and> finite T \\<and> (\\<forall>(t, c)\\<in>T. length c \\<in> Lex t Doc k)\n    \\<and> (\\<forall>(t, c)\\<in>T. is_terminal t) \\<and> (\\<forall>(t, c)\\<in>T. length c > 0))\" (*there exists a *)\n\nthm while_rule_lemma [where ?P = \"invariant4 k T (I, p)\" and?b = \"(\\<lambda> I .  fst (step' k T  I)  \\<noteq> fst I)\" \nand ?c = \"step' k T\" and ?s =  \"(I, p)\"  and ?Q=\"invariant_pointers\"]\n\n\nlemma inv4_1:\"invariant4 k T I s \\<Longrightarrow> fst (step' k T s) \\<noteq> fst s \\<Longrightarrow> invariant4 k T I (step' k T s)\"\n  apply (simp add:invariant4_def) \n  using inv''_1 invariant_pointers_step by auto\n\nlemma inv4_2:\"invariant4 k T (I, p) s \\<Longrightarrow> \\<not> fst (step' k T s) \\<noteq> fst s \\<Longrightarrow> invariant_pointers s\"\n  using invariant4_def by auto\n\nlemma wf_sub: \"{(t, s). invariant4 k T (I, p) s \\<and> fst (step' k T s) \\<noteq> fst s \\<and> t = step' k T s} \\<subseteq> \n  {(t, s). invariant'' k T (I, p )s \\<and> fst (step' k T s) \\<noteq> (fst s) \\<and> t = step' k T s}\"\n  using invariant4_def by blast\n\n\n(*the one invariant of non-empty tokens might be better off removed*)\ndefinition invariant_pointers_All_top::\"nat \\<Rightarrow> ('a, 'b, 'c) token set \\<Rightarrow> ('a, 'b) sppf_items \\<Rightarrow>('a, 'b) sppf_items \\<Rightarrow> bool\" where\n\"invariant_pointers_All_top k  T init I = (invariant_All_top' k  T init I \\<and>  invariant_pointers I \\<and> finite T \\<and> (\\<forall>(t, c)\\<in>T. length c \\<in> Lex t Doc k)\n    \\<and> (\\<forall>(t, c)\\<in>T. is_terminal t) \\<and> (\\<forall>(t, c)\\<in>T. length c > 0))\" \n\nlemma invariant_pointers_All_top_step:\"invariant_pointers_All_top k T I s \\<Longrightarrow> \nfst (step' k T s) \\<noteq> fst s \\<Longrightarrow> invariant_pointers_All_top k T I (step' k T s)\"\n  apply (simp add:invariant_pointers_All_top_def) \n  using invariant_All_top'_step invariant_pointers_step by auto\n\nlemma invariant_pointers_All_top_final:\"invariant_pointers_All_top k T I s \\<Longrightarrow> \n  fst (step' k T s) = fst s \\<Longrightarrow> invariant_pointers s\"\n  by (simp add:invariant_pointers_All_top_def) \n\nlemma wf_invariant_pointers_All_top_help: \"{(t, s). invariant_pointers_All_top k T (I, p) s \\<and> fst (step' k T s) \\<noteq> fst s \\<and> t = step' k T s} \\<subseteq> \n  {(t, s). invariant_All_top' k T (I, p )s \\<and> fst (step' k T s) \\<noteq> (fst s) \\<and> t = step' k T s}\"\n  using invariant_pointers_All_top_def by blast \n\nlemma wf_invariant_pointers_All_top:\"wf {(t, s). invariant_pointers_All_top k T (I, p) s \\<and> fst (step' k T s) \\<noteq> fst s \\<and> t = step' k T s}\"\n  using  wf_subset [OF wf_All_top wf_invariant_pointers_All_top_help] by blast\n\n\nlemma \\<pi>'_pointer_invariants:\n  assumes \"invariant_pointers (I, p)\" \n      \"(\\<forall> (t, c) \\<in> T . length c > 0) \\<and> (\\<forall>(t, c)\\<in>T. length c \\<in> Lex t Doc k) \\<and> (\\<forall>(t, c)\\<in>T. is_terminal t)\n      \\<and> finite T\"\n      \"k \\<le> length Doc\" \"\\<forall> (t, c) \\<in> T. k + length c \\<le> length Doc\" \"I \\<subseteq> All_top\"\n  shows \"invariant_pointers (\\<pi>' k T (I, p ))\"\nproof -\n  have \"fst (funpower (step' k T) 0 (I, p)) = fst (I, p) \\<and> fst (I, p) \\<subseteq> All_top\" using assms by simp\n  then have 0:\"invariant_All_top' k T (I, p) (I, p)\" using invariant_All_top'_def assms by blast \n  then have init':\"invariant_pointers_All_top k T (I, p) (I, p)\" using invariant_pointers_All_top_def\n      assms(1) assms(2)  by (meson funpower.simps(1))\n   have \"invariant_pointers (while (\\<lambda>I. fst (step' k T I) \\<noteq> fst I) (step' k T) (I, p))\"\n    apply (rule while_rule_lemma [where ?P = \"invariant_pointers_All_top k T (I, p)\" and?b = \"(\\<lambda> I .  fst (step' k T  I)  \\<noteq> fst I)\" \nand ?c = \"step' k T\" and ?s =  \"(I, p)\"  and ?Q=\"invariant_pointers\"])\n     using invariant_pointers_All_top_step apply blast \n     using invariant_pointers_All_top_final apply blast\n     using wf_invariant_pointers_All_top apply blast\n     using init' by blast\n   then show ?thesis by simp\n qed\n\n\nfun update_tree::\"('a, 'b) derivtree \\<Rightarrow> ('a, 'b) derivtree \\<Rightarrow> ('a, 'b) derivtree\" where \n\"update_tree (DT r b) t = (DT r (b@[t]))\" |\n\"update_tree (Leaf s) t = (Leaf s)\"|\n\"update_tree (Inner s) t = (Inner s)\"\n\nfun step_I'::\"nat \\<Rightarrow> (('a, 'b, 'c) token set \\<times> ('a, 'b) sppf_items) \\<Rightarrow> \n  (('a, 'b, 'c) token set \\<times> ('a, 'b) sppf_items)\" where\n\" step_I' k (T, I) = (Tokens k T (fst I), \\<pi>' k (Tokens k T (fst I)) I)\"\n\n\nfun \\<J>' :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a, 'b) sppf_items\"\nand \\<I>' :: \"nat \\<Rightarrow> ('a, 'b) sppf_items\"\nand \\<T>' :: \"nat \\<Rightarrow> nat \\<Rightarrow> ('a, 'b, 'c) token set\"\nwhere\n  \"\\<J>' 0 0 = \\<pi>' 0 {} (Init, (Map.empty, Map.empty))\" (*Initial Element*)\n| \"\\<J>' k (Suc u) = \\<pi>' k (\\<T>' k (Suc u)) (\\<J>' k u)\" (*Early parsing*)\n| \"\\<J>' (Suc k) 0 = \\<pi>' (Suc k) {} (\\<I>' k)\" \n| \"\\<T>' k 0 = {}\"\n| \"\\<T>' k (Suc u) = Tokens k (\\<T>' k u) (fst (\\<J>' k u))\" (*selector step*)\n| \"\\<I>' k = (snd (while (\\<lambda> T.  fst (step_I'  k T) \\<noteq> (fst T)) (step_I' k) \n  ({}, \\<J>'  k 0)))\" (*upperbound at least Doc length \\<Longrightarrow> no proper upperground here*)\n\n(*proofs via induction actually*)\n(*\nlemma \\<J>'_eq:\n  shows  \"fst (\\<J>' k k') = \\<J> k k'\" \"\\<T>' k k' = \\<T> k k'\" \"fst (\\<I>' k) = \\<I> k\"\n*)\n\nfun iterate::\"nat \\<Rightarrow> (('a, 'b, 'c) token set \\<times> ('a, 'b) sppf_items) \\<Rightarrow> \n  (('a, 'b, 'c) token set \\<times> ('a, 'b) sppf_items)\" where\n\"iterate k s = (while (\\<lambda> s. fst (step_I' k s) \\<noteq> fst s) (step_I' k) s)\"\n\n\nlemma step_I'_eq:\"fst (step_I' k s) = fst (step_I k (fst s, fst (snd s)))\"\n  by (metis fst_conv prod.collapse step_I'.simps step_I.simps)\n\n(*unused*)\n(*\nlemma step_I'_eq':\"fst (snd (step_I' k s)) = snd (step_I k (fst s, fst (snd s)))\"\n  using All_top_equality  (*additional assumption to carry about*)\n*)\ndefinition invariant_T_top'::\"nat \\<Rightarrow> (('a, 'b, 'c) token set \\<times> ('a, 'b) sppf_items) \\<Rightarrow> bool\" where\n\"invariant_T_top' k T = ((fst (snd T) = fst (step' k (fst T) (snd T))) \\<and>  (\\<exists> k' . (\\<J> k k' = fst (snd T)) \\<and> (\\<T> k k' = fst T)) \n    \\<and> (fst T) \\<subseteq> TokensAt k (fst(snd T)) \\<and> fst T \\<subseteq> TokensAt_top k \\<and> fst (snd T) \\<subseteq> All_top)\"\n\nlemma \\<J>'_step:\n  assumes \"invariant_T_top' k s \" \"fst (step_I' k s) \\<noteq> fst s\" \"k \\<le> length Doc\"\n  shows \"invariant_T_top' k (step_I' k s)\"\nproof -\n  obtain T I p  where s_def:\"(T, I, p) = s\" apply(cases s ) by blast\n  then obtain k' where 1:\"(\\<J> k k' = I) \\<and> (\\<T> k k' = T)\" using assms(1) \n      invariant_T_top'_def by fastforce\n  from assms(1) invariant_T_top'_def have \"(I = fst (step' k (T) (I, p)))\" using s_def by fastforce\n  with step_eq  have 2:\"I = step k T I\" by force\n  from s_def  assms(1) invariant_T_top'_def have \n    3:\"T \\<subseteq> TokensAt k I \\<and> T \\<subseteq> TokensAt_top k \\<and> I \\<subseteq> All_top\" by fastforce\n  with 1 2 have invar:\"invariant_T_top k (T, I)\"  using invariant_T_top_def by auto\n  from assms(2) step_I'_eq s_def have \"fst (step_I k (T, I)) \\<noteq> T\" by force\n  with assms(3) invar have 6:\"invariant_T_top k (step_I k (T, I))\" using \\<J>_step by force\n  (*could in theory also just be reused anyways*)\n  (*step equality*)\n  obtain T' I' p' where 2:\"(T', I', p') = step_I' k s\" apply(cases \"step_I' k s\") by simp\n  with s_def have 4:\"T' = Tokens k T I \\<and> (I', p') = \\<pi>' k (Tokens k T  I) (I, p)\" by force\n  with 1 have T':\"T' = \\<T> k (Suc k')\" by force\n  from 3 4 have \"T' \\<subseteq> (TokensAt k I)\" using Tokens_def Sel_is_selector is_selector_def by blast\n  then have valid_tokens:\"\\<forall> (t, c) \\<in> T' . k + length c \\<le> length Doc \" using TokensAt_subset_\\<X> \\<X>_length_bound by fastforce\n  have 5:\"I' = \\<pi> k T' I\" using All_top_equality [OF assms(3) valid_tokens, where ?I=\"(I, p)\"] using 4 3 \n    by (metis fst_conv)\n  with 4 have \"I' = \\<J> k (Suc k')\" using 1 T' by simp \n  from 5 4 have \"(T', I') = (step_I k (T, I))\" by simp\n  then show ?thesis using 2 6 \n    by (metis (no_types, lifting) fst_conv invariant_T_top'_def invariant_T_top_def snd_conv step_eq)\nqed\n\nlemma step_I'_help:\n  assumes \"\\<T>' k (Suc k') = \\<T>' k k' \"\" \\<J>' k k' = step' k (\\<T>' k k') (\\<J>' k k')\" \n  shows     \"\\<T>' k (Suc (Suc k')) = \\<T>' k k' \\<and> \\<J>' k k' = \\<J>'  k (Suc k')\"\nproof -\n  from assms have \"\\<J>'  k (Suc k') = \\<pi>' k (\\<T>' k k') (\\<J>' k k')\" by simp\n  then have 1:\"\\<J>'  k (Suc k') = while (\\<lambda> I. fst (step' k (\\<T>' k k') I) \\<noteq> fst I) (step' k (\\<T>' k k')) (\\<J>' k k')\" by simp\n  with assms(2) have \"\\<not> (\\<lambda> I. fst (step' k (\\<T>' k k') I) \\<noteq> fst I) (\\<J>' k k')\" by simp\n  with 1 have 2:\"\\<J>'  k (Suc k') = (\\<J>' k k')\" using while_unfold by (smt (z3))\n  with assms(1) have \"\\<T>' k (Suc (Suc k')) = Sel (\\<T>' k  k') (TokensAt k (fst (\\<J>' k k')))\" using\n    Tokens_def by simp\n  then have \"\\<T>' k (Suc (Suc k')) = \\<T>' k (Suc k')\" using Tokens_def by simp \n  then show ?thesis using 2 assms(1) by simp\nqed\n\n(*unnecessary actually \\<longrightarrow> we just care about reusing the old part*)\n\n(*use nat union case *)\nlemma invariant_T_top_lift:\"invariant_T_top' k (T, I, p) \\<Longrightarrow> invariant_T_top k (T, I)\"\n using invariant_T_top_def invariant_T_top'_def step_eq by fastforce\nlemma \\<J>'_final: (*using natunion formulation, it seems easier to just add the invariant that (fst (snd) = J_k*)\n  (*only the needed information is carried around*)\n  assumes \"invariant_T_top' k s \" \"fst (step_I' k s) = fst s\" \"k \\<le> length Doc\"\n  shows \"natUnion (\\<J> k) = fst (snd s) \\<and> natUnion (\\<J> k)   \\<subseteq> All_top\" (*and pointer invariants*)\nproof -\n  obtain T I p where T_def:\"(T, I, p) = s\" apply (cases s) by blast\n  obtain k' where def:\"(\\<J> k k' = fst (snd s)) \\<and> (\\<T> k k' = fst s)\" using invariant_T_top'_def assms(1) by blast\n  (*should lifted from a theorem in Local Lexing*)\n  have \"fst (step_I' k s) = (Tokens k (fst s) (fst (snd s)))\" apply(cases s) by auto\n  with assms(2) def have \"Tokens k (\\<T> k k') (\\<J> k k') = \\<T> k k'\" by simp\n  then have \"\\<T> k (Suc k') = \\<T> k k'\" using  Tokens_def by simp\n\n  from T_def assms have 4:\"invariant_T_top k (T, I)\" \n    using invariant_T_top_lift by blast\n  from assms T_def have \"fst (step_I k (T, I)) = T\" by auto\n  then have \"\\<I> k = I \\<and> \\<I> k \\<subseteq> All_top\" using \\<J>_final [OF 4] assms(3) by auto\n  then have \"natUnion (\\<J> k) = (\\<J> k k')\" using def T_def by auto \n  (*to be proven in LocalLexing*)\n  then show ?thesis using invariant_T_top'_def assms def by blast  \nqed\n\nfun meas_T_I'::\"nat \\<Rightarrow> (('a, 'b, 'c) token set \\<times> ('a, 'b) sppf_items)  \\<Rightarrow> nat \" where\n\"meas_T_I' k (T, I)  = card {s . s \\<in> TokensAt_top k \\<and>   s \\<notin> T}\"\n\nlemma meas_T_I'_help:\"meas_T_I k (T, I) = meas_T_I' k (T, I, p)\"\n  by auto\n\nlemma meas_T_I'_help':\"meas_T_I' k (step_I' k (T, I, p)) = meas_T_I k (step_I k (T, I))\"\n  by simp\nlemma meas_T_I'_decreases:\n  assumes \"invariant_T_top' k s\" \"fst (step_I' k s) \\<noteq> fst s\" \n  shows \"meas_T_I' k (step_I' k s) < meas_T_I' k s\"\nproof -\n  obtain T I p  where s_def:\"(T, I, p) = s\" apply(cases s ) by blast\n  then obtain k' where 1:\"\\<J> k k' = I \\<and> \\<T> k k' = T\" using assms(1) \n      invariant_T_top'_def by fastforce\n  from assms(1) invariant_T_top'_def have \"(I = fst (step' k (T) (I, p)))\" using s_def by fastforce\n  with step_eq  have 2:\"I = step k T I\" by force\n  from s_def  assms(1) invariant_T_top'_def have \n    \"T \\<subseteq> TokensAt k I \\<and> T \\<subseteq> TokensAt_top k \\<and> I \\<subseteq> All_top\" by fastforce\n  with 1 2 have invar:\"invariant_T_top k (T, I)\"  using invariant_T_top_def by auto\n  from assms(2) step_I'_eq s_def have \"fst (step_I k (T, I)) \\<noteq> T\" by force\n  with meas_T_I_decreases invar have \"meas_T_I k (step_I k (T, I)) < meas_T_I k (T, I)\" by force\n  (*then upload measure*)\n  then show ?thesis using meas_T_I'_help meas_T_I'_help' s_def by force \nqed\n\nlemma init':\n  assumes \"Suc k \\<le> length Doc \" \"fst (\\<I>' k) = \\<I> k\"\n  shows \" invariant_T_top' (Suc k) ({}, \\<J>' (Suc k) 0)\"\nproof -\n  have 0:\"\\<I> k \\<subseteq> All_top\" using \\<I>_k_sub_All_top assms by simp\n  have 1:\"((\\<exists> k' . (\\<J> (Suc k) k' = \\<J> (Suc k) 0) \\<and> (\\<T> (Suc k) k' = {})) \n    \\<and> {} \\<subseteq> TokensAt (Suc k) (\\<J> (Suc k) 0) \\<and> {}  \\<subseteq> TokensAt_top (Suc k))\" by fastforce\n  have t:\"\\<forall>(t, c)\\<in> {}. Suc k + length c \\<le> length Doc\" by blast\n  have step:\"\\<J>' (Suc k) 0  = \\<pi>' (Suc k) {} (\\<I>' k)\" by simp\n  then have 2:\"fst (\\<J>' (Suc k) 0)  = \\<pi> (Suc k) {} (\\<I> k)\" using All_top_equality [OF assms(1) t] \n    using assms 0  by auto\n  then have \"fst (\\<J>' (Suc k) 0) = \\<J> (Suc k) 0\" by auto\n  \n  then show ?thesis using init \n    using assms(1) 0 invariant_T_top'_def invariant_T_top_def step_eq by auto\nqed\n\nlemma wf_T_I':\"wf {(t, s). invariant_T_top' k s \\<and> fst (step_I' k s) \\<noteq> fst s \\<and> t = step_I' k s}\"\n  using wf_if_measure [where ?P=\"\\<lambda> s . invariant_T_top' k s \\<and> fst (step_I' k s) \\<noteq> fst s\" and ?g=\"step_I' k\" \n        and ?f= \"meas_T_I' k\"] meas_T_I'_decreases by simp\n\nlemma \\<I>'_equality:\"fst (\\<I>' k) = \\<I> k \\<Longrightarrow> (Suc k) \\<le> length Doc \\<Longrightarrow> \\<I> (Suc k) = \n  fst (snd (while (\\<lambda> T.  fst (step_I'  (Suc k) T) \\<noteq> (fst T)) (step_I' (Suc k)) ({}, \\<J>' (Suc k) 0))) \\<and> \\<I> (Suc k) \\<subseteq> All_top\"\n    apply (rule while_rule_lemma [where   ?s =  \"({}, \\<J>' (Suc k) 0)\" and ?c=\"step_I' (Suc k)\" \n          and ?b=\"(\\<lambda> TI.  fst (step_I'  (Suc k) TI) \\<noteq> fst TI)\" and ?Q = \"\\<lambda> f . \\<I> (Suc k)  = fst (snd f) \n    \\<and> \\<I> (Suc k) \\<subseteq> All_top\" and ?P=\"invariant_T_top' (Suc k) \"])\n  using \\<J>'_step apply presburger\n  using \\<I>.simps \\<J>'_final apply blast\n  using wf_T_I' apply blast\n  using init' by blast\n\n\n\ndefinition \\<I>'_pointer_invariants::\"nat \\<Rightarrow> ( ('a, 'b) sppf_items) \\<Rightarrow> bool\" where\n\"\\<I>'_pointer_invariants k I = (invariant_pointers I \\<and> fst I = \\<I> k) \"\n\ndefinition \\<I>'_pointer_invariants'::\"nat \\<Rightarrow> (('a, 'b, 'c) token set \\<times>  ('a, 'b) sppf_items) \\<Rightarrow> bool\"\nwhere\n  \"\\<I>'_pointer_invariants' k TI = (invariant_T_top' k TI \\<and> invariant_pointers (snd TI))\"\n\nlemma TokensAt_invariants:\n  assumes \"k \\<le> length Doc\"\n  shows \"(\\<forall>(t, c)\\<in>TokensAt k I . length c \\<in> Lex t Doc k \\<and> is_terminal t \\<and>  k + length c \\<le> length Doc) \n  \\<and> finite (TokensAt k I)\"\nproof -\n  obtain T_top where top_def:\"T_top = { (t, s) | t s  l. is_terminal t \\<and> \n     l \\<in> Lex t Doc k \\<and> s = take l (drop k Doc) }\" by blast\n  then have 1:\"\\<forall>(t, c) \\<in> T_top. is_terminal t\" by blast\n  then have \"\\<forall>(t, c) \\<in> T_top . \\<exists> l.  t \\<in> \\<TT> \\<and> l \\<in> Lex t Doc k \\<and> c = take l (drop k Doc)\" \n    using top_def by (simp add: terminal_in_\\<TT>)\n  then have \"\\<forall>(t, c) \\<in> T_top . \\<exists> l.  is_lexer (Lex t) \\<and> l \\<in> Lex t Doc k \\<and> \n    c = take l (drop k Doc) \" using Lex_is_lexer by auto\n  then have \"\\<forall>(t, c) \\<in> T_top . \\<exists> l.   (\\<forall> l. (k \\<le> length Doc \\<and> l \\<in> Lex t Doc k \\<longrightarrow> k + l \\<le> length Doc) \n        \\<and> (length Doc < k \\<longrightarrow> Lex t Doc k = {})) \\<and> l \\<in> Lex t Doc k \\<and> \n    c = take l (drop k Doc) \" apply(simp add: is_lexer_def) by auto\n  with assms have \"\\<forall>(t, c) \\<in> T_top . \\<exists> l.   l \\<in> Lex t Doc k \\<and> \n    c = take l (drop k Doc) \\<and> l + k \\<le> length Doc\" using assms by fastforce\n  then have \"\\<forall>(t, c) \\<in> T_top . \\<exists> l.   l \\<in> Lex t Doc k \\<and> \n    c = take l (drop k Doc) \\<and> l + k \\<le> length Doc \\<and> length c = l\" by fastforce\n  then have \"\\<forall>(t, c) \\<in> T_top . \\<exists> l.   length c \\<in> Lex t Doc k \\<and> length c + k \\<le> length Doc\" by auto \n  then have 2:\"\\<forall>(t, c) \\<in> T_top . length c \\<in> Lex t Doc k \\<and> length c + k \\<le> length Doc\" by simp\n  have finite:\"finite (TokensAt k I)\" by (meson TokensAt_top finite_TokensAt_top finite_subset)\n  from top_def have \"TokensAt k I \\<subseteq> T_top\" using TokensAt_def by blast\n  then show ?thesis using 1 2 finite by fastforce\nqed\n\nlemma I_step:\n  assumes\"k \\<le> length Doc \"\n         \"\\<I>'_pointer_invariants'  k s\" \"fst (step_I' k s) \\<noteq> fst s \"\n  shows \" \\<I>'_pointer_invariants' k (step_I' k s)\"\nproof -\n  obtain T I p  where s_def:\"(T, I, p) = s\" apply(cases s ) by blast\n  from assms(2) have 1:\"invariant_T_top' k s \" using \\<I>'_pointer_invariants'_def by blast\n  then have  res1:\"invariant_T_top' k (step_I' k s)\" using \\<J>'_step assms by auto\n  (*invariants hold*)\n  from assms(2) have 2:\"invariant_pointers (I,p)\" using s_def \\<I>'_pointer_invariants'_def \n    by fastforce\n  from 1 have I_top:\"I \\<subseteq> All_top\" using invariant_T_top'_def s_def by auto\n  obtain T' where T':\"T' = (Tokens k T I)\" by simp\n  from 1 have 3:\"T \\<subseteq> TokensAt k I\" using invariant_T_top'_def s_def by auto\n  have selected:\"(Tokens k T I) = Sel T (TokensAt k I)\" using Tokens_def  by simp\n  then  have 4:\"(Tokens k T I) \\<subseteq> TokensAt k I\"  using 3 Sel_is_selector is_selector_def by blast \n      (*needs a few steps*)(*should immediately hold*)\n  with T' have T'_sub:\"T' \\<subseteq> TokensAt k I\" by blast\n  from selected have nonzero:\"(\\<forall> (t, c) \\<in> T' . length c > 0)\" using T' no_nonempty_tokens by blast\n  from TokensAt_invariants [OF assms(1), where ?I=\"I\"] T'_sub have \n    \"(\\<forall>(t, c)\\<in>T'. length c \\<in> Lex t Doc k \\<and> is_terminal t \\<and> \n    k + length c \\<le> length Doc) \\<and> finite (T')\" using finite_subset by blast\n  with nonzero have T'_invars:\"(\\<forall> (t, c) \\<in> T' . length c > 0) \\<and> (\\<forall>(t, c)\\<in>T'. length c \\<in> Lex t Doc k) \\<and> (\\<forall>(t, c)\\<in>T'. is_terminal t)\n      \\<and> finite T'\" and T'_valid:\"(\\<forall> (t, c) \\<in> T'. k + length c \\<le> length Doc)\" by auto\n  have \"snd (step_I' k s) =  \\<pi>' k T' (I, p)\" using s_def T' by auto\n  then have \"invariant_pointers (snd (step_I' k s))\" \n    using \\<pi>'_pointer_invariants [OF 2 T'_invars assms(1) T'_valid I_top] by simp\n  with res1 show ?thesis using \\<I>'_pointer_invariants'_def by blast\nqed\n\n\nlemma I_final:\n  assumes \"k \\<le> length Doc \" \"\\<I>'_pointer_invariants'  k s \" \n          \"\\<not> fst (step_I' k s) \\<noteq> fst s\"\n  shows  \"\\<I>'_pointer_invariants k (snd s)\"\nproof -\n  have 0:\"invariant_pointers (snd s)\" using assms(2)  \\<I>'_pointer_invariants'_def by blast\n  obtain T I p  where s_def:\"(T, I, p) = s\" apply(cases s ) by blast\n  with assms(3) have 1:\"\\<not> fst (step_I k (T, I)) \\<noteq> fst (T, I)\" by force\n  from assms(2) s_def have \"invariant_T_top k (T, I)\" \n    using \\<I>'_pointer_invariants'_def invariant_T_top'_def invariant_T_top_def step_eq by auto \n  with 1 assms(1) have \"\\<I> k = I\" using \\<J>_final by simp\n  then show ?thesis using 0 s_def \n    using \\<I>'_pointer_invariants'_def \\<I>'_pointer_invariants_def \\<I>.simps \\<J>'_final assms(1) assms(2) assms(3) by blast\nqed\n\n\n\nlemma wf_pointer_invariants:\n\"wf {(t, s). \\<I>'_pointer_invariants' k s \\<and> fst (step_I' k s) \\<noteq> fst s \\<and> t = step_I'  k s}\"\n  using wf_subset [OF  wf_T_I' subset] by blast\n\nlemma init'':\n  assumes \"\\<I>'_pointer_invariants k (\\<I>' k) \" \"Suc k \\<le> length Doc \"\n  shows \"\\<I>'_pointer_invariants' (Suc k) ({}, \\<J>' (Suc k) 0)\"\nproof -\n  obtain I p where Ip:\"(I, p) = (\\<I>' k)\" apply(cases \"(\\<I>' k)\") by simp\n  then  have 1:\"invariant_pointers (I, p)\" \n    using \\<I>'_pointer_invariants_def by (metis assms(1))\n  from assms Ip have I:\"I = \\<I> k\"  using \\<I>'_pointer_invariants_def by (metis  fst_conv) \n  then have I_alltop:\"I \\<subseteq> All_top\" using \\<I>_k_sub_All_top assms(2) by simp\n  have 2:\"(\\<forall>(t, c)\\<in>{}. 0 < length c) \\<and> (\\<forall>(t, c)\\<in>{}. length c \\<in> Lex t Doc (Suc k)) \\<and> (\\<forall>(t, c)\\<in>{}. is_terminal t) \\<and> finite {}\"\n    by blast\n  have \"\\<J>' (Suc k) 0 = \\<pi>' (Suc k) {} (\\<I>' k)\" by simp\n  then have  3:\"invariant_pointers (\\<J>' (Suc k) 0)\" using \\<pi>'_pointer_invariants [OF 1 2 assms(2)] \n      assms I_alltop Ip by simp\n  from init' [OF assms(2)] have \"invariant_T_top' (Suc k) ({}, \\<J>' (Suc k) 0)\" using  I Ip \n    using \\<I>'_pointer_invariants_def assms(1) by presburger\n  with 3 show ?thesis using \\<I>'_pointer_invariants'_def by auto\nqed\n(*Init \\<longrightarrow> iss*)\n\n(*have to include the All_top assumption*)\n\nlemma \\<I>'_pointer_invariants:\"\\<I>'_pointer_invariants k (\\<I>' k) \\<Longrightarrow> (Suc k) \\<le> length Doc \\<Longrightarrow> \n  \\<I>'_pointer_invariants (Suc k) (snd (while (\\<lambda> T.  fst (step_I'  (Suc k) T) \\<noteq> (fst T)) (step_I' (Suc k)) \n  ({}, \\<J>' (Suc k) 0)))\"\n    apply (rule while_rule_lemma [where   ?s =  \"({}, \\<J>' (Suc k) 0)\" and ?c=\"step_I' (Suc k)\" \n          and ?b=\"(\\<lambda> TI.  fst (step_I'  (Suc k) TI) \\<noteq> fst TI)\" and \n          ?Q = \"\\<lambda> f . \\<I>'_pointer_invariants (Suc k) (snd f) \" and ?P=\"\\<I>'_pointer_invariants' (Suc k)\"])\n  using I_step apply blast\n  using I_final apply blast\n  using wf_pointer_invariants apply blast\n  using init'' by blast\n\n\n\ndefinition I::\"('a, 'b) items\" where\n\"I = fst  (\\<I>' (length Doc))\"\n\ndefinition pred::\"('a, 'b) pointers\" where\n\"pred = fst (snd (\\<I>' (length Doc)))\"\n\n\ndefinition red::\"('a, 'b) pointers\" where\n\"red = snd (snd (\\<I>' (length Doc)))\"\n(*measure*)\n\nlemma empty_pred:\"measure_help_monotone (Map.empty, Map.empty) \\<and> red_complete (Map.empty, Map.empty) \\<and>  \n    in_set (Map.empty, Map.empty) Init \\<and> invariant_pointers' (Map.empty, Map.empty)\"\n  by auto\n\nlemma empty_tokens:\"\\<forall>(t, c)\\<in>{}. 0 < length c \"\n  by simp\n\nlemma Init_top:\"Init \\<subseteq> (\\<lambda> r .init_item r 0)`\\<RR> \"\n  using Init_def by blast\nlemma init_valid_rules:\"valid_rule Init\"\n  using Init_top init_item_def using valid_rule_def by auto\n\nlemma finite_init:\"finite Init\" by (meson finite_surj finite_grammar Init_top) \nlemma valid_bounds_init:\"valid_bounds Init\"\n  by (auto simp add: valid_bounds_def init_item_def Init_def)\n\nlemma init_dom_sup:\"dom_sup_items (Map.empty, Map.empty) Init\"\n  using Init_top init_item_def by auto\n\nlemma init_dom_no_scan:\"dom_no_scan (Map.empty, Map.empty) Init\"\n  using Init_top init_item_def by auto\n\nlemma invariant_pointers_init:\"invariant_pointers (Init , (Map.empty, Map.empty))\"\nusing finite_init \n    valid_bounds_init init_valid_rules init_dom_sup init_dom_no_scan  by simp\n\nlemma \\<J>_init:\"invariant_pointers (\\<J>' 0 0)\"\n  using \\<pi>'_pointer_invariants [OF invariant_pointers_init, where ?T=\"{}\" and ?k=\"0\"]\n  Init_sub_All_top'  by simp\n\n\nlemma \\<J>_equality:\"fst (\\<J>' 0 0) = \\<J> 0 0\"\n  using All_top_equality [where ?T=\"{}\" and ?k=\"0\" and ?I=\"(Init, (Map.empty, Map.empty))\"] \n  Init_sub_All_top' by simp\n(*Finiteness probagation*)\n\nlemma \\<J>_finite:\"finite (fst (\\<J>' 0 0))\"\n  by (metis \\<J>_init fst_conv invariant_pointers.elims(2))\n\n\nlemma \\<I>'_pointer_invariants':\"\\<I>'_pointer_invariants k (\\<I>' k) \\<Longrightarrow> (Suc k) \\<le> length Doc \\<Longrightarrow> \n  \\<I>'_pointer_invariants (Suc k) (\\<I>' (Suc k))\"\n   using \\<I>'_pointer_invariants by simp\n\nlemma \\<I>'_0_start:\"\\<I>'_pointer_invariants' 0 ({}, \\<J>' 0 0)\"\nproof -\n  have 0:\"(invariant_T_top 0 ({}, \\<J> 0 0))\"  using \\<I>_0_start by auto \n  have 1:\"\\<forall>(t, c)\\<in>{}. 0 < length c \" and 2:\" finite {} \\<and> finite (fst  (Init, (Map.empty, Map.empty)))\"\n    apply fastforce by (simp add: finite_init)\n  obtain I p  where s_def:\"(I, p) = \\<J>' 0 0\" apply(cases \"\\<J>' 0 0\") by simp\n  then have \"fst (\\<J>' 0 0) = \\<J> 0 0\" using \\<J>_equality by auto\n  with 0 have 2:\"(invariant_T_top' 0 ({}, \\<J>' 0 0))\" \n    using invariant_T_top'_def invariant_T_top_def step_eq by auto\n  with \\<J>_init show ?thesis using \\<I>'_pointer_invariants'_def by auto\nqed\n\nlemma \\<I>'_0_pointer_invariants:\"\\<I>'_pointer_invariants 0 \n  (snd (while (\\<lambda> T.  fst (step_I'  0 T) \\<noteq> (fst T)) (step_I' 0) \n  ({}, \\<J>' 0 0)))\"\n    apply (rule while_rule_lemma [where   ?s =  \"({}, \\<J>' 0 0)\" and ?c=\"step_I' 0\" \n          and ?b=\"(\\<lambda> TI.  fst (step_I'  0 TI) \\<noteq> fst TI)\" and \n          ?Q = \"\\<lambda> f . \\<I>'_pointer_invariants 0 (snd f) \" and ?P=\"\\<I>'_pointer_invariants' 0\"])\n  using I_step apply blast\n  using I_final apply blast\n  using wf_pointer_invariants apply blast\n  using \\<I>'_0_start by blast\n\ntheorem \\<I>'_invariants:\"k \\<le> length Doc \\<Longrightarrow> \\<I>'_pointer_invariants k (\\<I>' k)\"\n  apply(induct k) using \\<I>'_0_pointer_invariants apply simp \n  using Suc_leD \\<I>'_pointer_invariants' by presburger\n (*actually conditioned on only parsing until doc length*)\n\n(*where are the other invariants*)\n\nlemma TokensAt_top':\"{ (t, s) | t s x l. x \\<in> bin I' k \\<and> \n     next_symbol x = Some t \\<and> is_terminal t \\<and> \n     l \\<in> Lex t Doc k \\<and> s = take l (drop k Doc) } \\<subseteq> { (t, s) | t s  l. is_terminal t \\<and> \n     l \\<in> Lex t Doc k \\<and> s = take l (drop k Doc) }\"\n  by blast\n\n\nlemma TokensAt_top:\"TokensAt k I' \\<subseteq> {(t, s) | t s l. is_terminal t \\<and> \n     l \\<in> Lex t Doc k \\<and> s = take l (drop k Doc) }\"\n  by (auto simp add: TokensAt_top' TokensAt_def)\n\n(*Lexing condition \\<longrightarrow> holds because of lexer confition  *)\n\nlemma TokensAt_top_lex':\"\\<forall> (t,c) \\<in> {(t, s) | t s l. is_terminal t \\<and> \n     l \\<in> Lex t Doc k \\<and> s = take l (drop k Doc) \\<and> length s = l} . length c \\<in> Lex t Doc k \\<and> is_terminal t\"\n  by simp\n\n\nthm \"All_top_equality\"\n\nlemma \\<J>_step_equality':\n  assumes \"k \\<le> length Doc\" \"fst (\\<J>' k u) = (\\<J> k u)\"  \"fst (\\<J>' k u) \\<subseteq> All_top\" \"\\<T>' k  u = \\<T> k  u\" \n          \"\\<T>' k  u \\<subseteq> \\<T>' k  (Suc u)\" \"(\\<T>' k (Suc u)) \\<subseteq> TokensAt k (fst (\\<J>' k  u))\"\n        shows \"fst (\\<J>' k (Suc u)) = (\\<J> k (Suc u)) \\<and> \\<T>' k  (Suc u) = \\<T> k (Suc u) \n          \\<and>  \\<T>' k (Suc u) \\<subseteq> \\<T>' k  (Suc (Suc u)) \\<and> (\\<T>' k (Suc (Suc u))) \\<subseteq> TokensAt k (fst (\\<J>' k  (Suc u)))\"\nproof -\n  (*premises for step*)\n\n  have 0:\"\\<T>' k (Suc (Suc u)) = Tokens k (\\<T>' k (Suc u)) (fst (\\<J>' k (Suc u)))\" by force\n  have \"\\<T>' k (Suc u) = Tokens k (\\<T>' k u) (fst (\\<J>' k  u))\" by force\n  then have sub:\"\\<T>' k (Suc u) \\<subseteq> TokensAt k (fst (\\<J>' k u))\" using assms by blast\n  \n  from TokensAt_invariants [OF assms(1), where ?I = \"(fst (\\<J>' k u))\"] assms(6) have\n    \"(\\<forall>(t, c)\\<in> (\\<T>' k (Suc u)). length c \\<in> Lex t Doc k \\<and> is_terminal t \\<and> k + \n    length c \\<le> length Doc) \\<and> finite (\\<T>' k (Suc u))\" using finite_subset by blast\n  then have val_lexing:\"\\<forall>(t, c)\\<in> (\\<T>' k (Suc u)) .  length c + k  \\<le> length Doc\" by auto\n\n  from assms have 2:\"\\<T>' k (Suc u) = \\<T> k (Suc u)\" by force\n  then have sol1:\"fst (\\<J>' k (Suc u)) = (\\<J> k (Suc u))\" using\n       All_top_equality [OF  assms(1) , where ?T=\"\\<T>' k (Suc u)\" and ?I=\"(\\<J>' k u)\" ] assms(3) val_lexing\n       assms by fastforce\n  \n  then have \"fst (\\<J>' k (Suc u)) = \\<pi> k (\\<T> k (Suc u)) (fst (\\<J>' k u))\" using assms(2) by auto\n  then have \"(fst (\\<J>' k u)) \\<subseteq> fst (\\<J>' k (Suc u))\" using \\<pi>_monotone by presburger\n  then have 3:\"TokensAt k (fst (\\<J>' k u)) \\<subseteq> TokensAt k (fst (\\<J>' k (Suc u)))\" \n    by (meson mono_TokensAt mono_subset_elem subsetI)\n  with sub have 4:\"\\<T>' k (Suc u) \\<subseteq> TokensAt k (fst (\\<J>' k (Suc u)))\" by blast\n  with 0 have sol3:\"\\<T>' k (Suc (Suc u)) \\<subseteq> TokensAt k (fst (\\<J>' k (Suc u)))\" using Tokens_def Sel_is_selector\n    is_selector_def by blast\n  from 4 0 have sol5:\"\\<T>' k (Suc u) \\<subseteq> \\<T>' k (Suc (Suc u))\" using Tokens_def Sel_is_selector\n    is_selector_def by blast \n   have \"  \\<T>' k (Suc u) = Tokens k (\\<T>' k u) (fst (\\<J>' k u))\" by auto\n  with sol1 assms(4) have sol4:\"\\<T>' k (Suc u) = \\<T> k (Suc u)\" using 2 by force\n  (*Token proofs*)\n  show ?thesis using sol1 2 sol3  sol4 sol5 by blast\nqed\n\nthm \"All_top_equality\"\n\nlemma \\<J>_step_0:\n  shows   \"fst (\\<J>' 0 u) = (\\<J> 0 u) \\<and> \\<T>' 0 u = \\<T>  0  u \n          \\<and>  \\<T>' 0  u \\<subseteq> \\<T>' 0  (Suc u) \\<and> (\\<T>' 0 (Suc u)) \\<subseteq> TokensAt 0 (fst (\\<J>' 0   u))\"\nproof (induct u)\n  case 0\n  with  \\<I>'_invariants have 0:\"fst (Init, (Map.empty, Map.empty)) = Init\" by simp\n  then have 1:\"fst (Init, (Map.empty, Map.empty)) \\<subseteq> All_top\" by (simp add: Init_sub_All_top')\n  have \"\\<T>' 0 0 = \\<T> 0 0\" by simp\n  have 2:\"fst (\\<J>' 0 0) = \\<J> 0 0 \" using All_top_equality [OF _  _ 1 , where ?T=\"{}\"] 0 by simp\n  have \"\\<T>' 0 (Suc 0) = Sel {} (TokensAt 0 (fst (\\<J>' 0 0)))\" using Tokens_def by auto \n  then have \"\\<T>' 0 (Suc 0) \\<subseteq> (TokensAt 0 (fst (\\<J>' 0 0)))\" \n      using Sel_is_selector is_selector_def by blast\n  then show ?case using 2 by simp\nnext\n  case (Suc u)\n  then have \"fst (\\<J>' 0 u) \\<subseteq> All_top\" using \\<I>_k_sub_All_top  \\<J>_k_sub_\\<I>_k  by blast\n  with Suc  show ?case using \\<J>_step_equality' [where ?k=\"0\"] by blast\nqed\n\nlemma \\<J>_step_equality'':\n  assumes \"(Suc k) \\<le> length Doc\"\n  shows   \"fst (\\<J>' (Suc k) u) = (\\<J> (Suc k) u) \\<and> \\<T>' (Suc k) u = \\<T>  (Suc k)  u \n          \\<and>  \\<T>' (Suc k)  u \\<subseteq> \\<T>' (Suc k)  (Suc u) \\<and> (\\<T>' (Suc k) (Suc u)) \\<subseteq> TokensAt (Suc k) (fst (\\<J>' (Suc k)   u))\"\nproof (induct u)\n  case 0\n  with assms  \\<I>'_invariants have 0:\"fst (\\<I>' k) = (\\<I> k)\" using \\<I>'_pointer_invariants_def by simp\n  then have 1:\"fst (\\<I>' k) \\<subseteq> All_top\" using Suc_leD \\<I>_k_sub_All_top assms by blast\n  have \"\\<T>' (Suc k) 0 = \\<T> (Suc k) 0\" by simp\n  have 2:\"fst (\\<J>' (Suc k) 0) = \\<J> (Suc k) 0 \" \n    using All_top_equality [OF assms _ 1 , where ?T=\"{}\"] 0 by simp\n  have \"\\<T>' (Suc k) (Suc 0) = Sel {} (TokensAt (Suc k) (fst (\\<J>' (Suc k) 0)))\" using Tokens_def by auto \n  then have \"\\<T>' (Suc k) (Suc 0) \\<subseteq> (TokensAt (Suc k) (fst (\\<J>' (Suc k) 0)))\" \n      using Sel_is_selector is_selector_def by blast\n  then show ?case using 2 by simp\nnext\n  case (Suc u)\n  then have \"fst (\\<J>' (Suc k) u) \\<subseteq> All_top\" using \\<I>_k_sub_All_top  \\<J>_k_sub_\\<I>_k assms by blast\n  with Suc  show ?case using \\<J>_step_equality' [OF assms] by metis\nqed\n\n\nlemma \\<J>_step_eq:\"k \\<le> length Doc \\<Longrightarrow> fst (\\<J>' k u) = \\<J> k u\"\n  apply(cases \"k\")\n  using  \\<J>_step_0 apply simp using \\<J>_step_equality'' by blast\n\n\n\nlemma Tokens_monotone:\n  assumes \"k \\<le> length Doc \"\n  shows \"(\\<T>' k u)  \\<subseteq> \\<T>' k (Suc u) \\<and> (\\<T>' k (Suc u)) \\<subseteq> TokensAt k (fst (\\<J>' k  u))\"\nproof (induction u)\n  case 0\n  have 0:\"{} \\<subseteq> TokensAt k (fst (\\<J>' k 0))\" by blast\n  have \"\\<T>' k (Suc 0) = Tokens k (\\<T>' k 0) (fst (\\<J>' k 0))\" by simp\n  then have \"\\<T>' k (Suc 0) = Sel  {} (TokensAt k (fst (\\<J>' k 0)))\" using Tokens_def by simp\n  then have 1:\"(\\<T>' k (Suc 0)) \\<subseteq>  TokensAt k (fst (\\<J>' k   0))\" using \n      Sel_is_selector is_selector_def 0 by blast\n  with 1 show ?case by auto\nnext\n  case (Suc u)\n  then have 0:\"\\<T>' k (Suc (Suc u)) = Tokens k (\\<T>' k (Suc u)) (fst (\\<J>' k (Suc u)))\" by force\n  have \"\\<T>' k (Suc u) = Tokens k (\\<T>' k u) (fst (\\<J>' k  u))\" by force\n  then have 1:\"\\<T>' k (Suc u) \\<subseteq> TokensAt k (fst (\\<J>' k u))\" using Suc by blast\n  (*token mononicity*)\n  have 3:\"(fst (\\<J>' k u)) = \\<J> k u \\<and> (fst (\\<J>' k (Suc u))) = \\<J> k (Suc u)\" using \\<J>_step_eq assms by blast \n  have \"\\<J> k u \\<subseteq> \\<J> k (Suc u)\" using \\<J>_subset_Suc_u by auto\n  with 3 have  \"(fst (\\<J>' k u)) \\<subseteq> (fst (\\<J>' k (Suc u)))\" by blast (*from monotonicity of step*)\n  then have 2:\"TokensAt k (fst (\\<J>' k u)) \\<subseteq> TokensAt k (fst (\\<J>' k (Suc u)))\" \n    by (meson mono_TokensAt mono_subset_elem subsetI)\n  with 1 have \"\\<T>' k (Suc u) \\<subseteq> TokensAt k (fst (\\<J>' k (Suc u)))\" by blast\n  with  0 show ?case using Tokens_def [where ?k=\"k\" and ?T=\"\\<T>' k (Suc u)\" \n        and ?I=\"(fst (\\<J>' k (Suc u)))\"] Sel_is_selector is_selector_def by blast \nqed\n\nlemma TokensAt_finite:\"k \\<le> length Doc \\<Longrightarrow> finite (TokensAt k I')\"\n  using TokensAt_invariants by blast\nlemma Tokens_lex:\"k \\<le> length Doc \\<Longrightarrow> \\<forall>(t, c)\\<in> (\\<T>' k u). length c \\<in> Lex t Doc k\"\n  using TokensAt_invariants Tokens_monotone by blast\n\nlemma Tokens_lex_length:\"k \\<le> length Doc \\<Longrightarrow> \\<forall>(t, c)\\<in> (\\<T>' k u) . length c + k \\<le> length Doc\"\n  using TokensAt_invariants Tokens_monotone  by fastforce \n\nlemma Tokens_terminal:\"k \\<le> length Doc \\<Longrightarrow> \\<forall>(t, c)\\<in> (\\<T>' k u) . is_terminal t\" \n  using Tokens_monotone TokensAt_invariants by fast \n\nlemma Tokens0_finite:\"finite (\\<T>' k 0)\"\n  by auto\nlemma Tokens_finite:\"k \\<le> length Doc \\<Longrightarrow> finite (\\<T>' k u)\"\n  using TokensAt_finite Tokens_monotone finite_subset Tokens0_finite by metis\n\nlemma Tokens_finite_nonempty0:\"(\\<forall> (t, c) \\<in> (\\<T>' k 0) . 0 < length c)\"\n  by simp\nlemma Tokens_finite_nonempty':\"(\\<forall> (t, c) \\<in> (\\<T>' k (Suc u)) . 0 < length c)\"\n  using Tokens_def Sel_is_nonempty non_empty_selector_def Tokens_finite by fastforce \n\nlemma Tokens_finite_nonempty:\"k \\<le> length Doc \\<Longrightarrow> (\\<forall> (t, c) \\<in> (\\<T>' k u) . 0 < length c) \\<and> finite (\\<T>' k u)\"\n  by (metis not0_implies_Suc Tokens_finite_nonempty' Tokens_finite_nonempty0 Tokens_finite)\n\nlemma TokensAt_terminal:\"\\<forall>(t, c)\\<in> TokensAt k I . is_terminal t\"\n  by (auto simp add: TokensAt_def)\n\nlemma \\<J>_step_equality''':\n  assumes \"k \\<le> length Doc\" \"fst (\\<J>' k u) = (\\<J> k u)\"  \"fst (\\<J>' k u) \\<subseteq> All_top\" \"\\<T>' k  u = \\<T> k  u\" \" finite (fst (\\<J>' k u))\" \n          \"\\<T>' k  u \\<subseteq> \\<T>' k  (Suc u)\" \"(\\<T>' k (Suc u)) \\<subseteq> TokensAt k (fst (\\<J>' k  u))\"\n        shows \"fst (\\<J>' k (Suc u)) = (\\<J> k (Suc u)) \\<and> \\<T>' k  (Suc u) = \\<T> k (Suc u) \n          \\<and>  \\<T>' k (Suc u) \\<subseteq> \\<T>' k  (Suc (Suc u)) \\<and> (\\<T>' k (Suc (Suc u))) \\<subseteq> TokensAt k (fst (\\<J>' k  (Suc u)))\"\nproof -\n  have 0:\"\\<T>' k (Suc (Suc u)) = Tokens k (\\<T>' k (Suc u)) (fst (\\<J>' k (Suc u)))\" by force\n  have \"\\<T>' k (Suc u) = Tokens k (\\<T>' k u) (fst (\\<J>' k  u))\" by force\n  then have sub:\"\\<T>' k (Suc u) \\<subseteq> TokensAt k (fst (\\<J>' k u))\" using assms by blast\n  \n  from TokensAt_invariants [OF assms(1), where ?I = \"(fst (\\<J>' k u))\"] assms(7) have\n    \"(\\<forall>(t, c)\\<in> (\\<T>' k (Suc u)). length c \\<in> Lex t Doc k \\<and> is_terminal t \\<and> k + \n    length c \\<le> length Doc) \\<and> finite (\\<T>' k (Suc u))\" using finite_subset by blast\n  then have val_lexing:\"\\<forall>(t, c)\\<in> (\\<T>' k (Suc u)) .  length c + k  \\<le> length Doc\" by auto\n\n  have 1:\"finite (\\<T>' k (Suc u)) \\<and> (\\<forall>(t, c)\\<in>\\<T>' k (Suc u). 0 < length c)\" \n    using Tokens_finite_nonempty assms(1) by blast\n  with assms have 2:\"\\<T>' k (Suc u) = \\<T> k (Suc u)\" by force\n  then have sol1:\"fst (\\<J>' k (Suc u)) = (\\<J> k (Suc u))\" using\n       All_top_equality [OF  assms(1) , where ?T=\"\\<T>' k (Suc u)\" and ?I=\"(\\<J>' k u)\" ] assms(3) val_lexing\n       assms by fastforce\n  \n  then have \"fst (\\<J>' k (Suc u)) = \\<pi> k (\\<T> k (Suc u)) (fst (\\<J>' k u))\" using assms(2) by auto\n  then have \"(fst (\\<J>' k u)) \\<subseteq> fst (\\<J>' k (Suc u))\" using \\<pi>_monotone by presburger\n  then have 3:\"TokensAt k (fst (\\<J>' k u)) \\<subseteq> TokensAt k (fst (\\<J>' k (Suc u)))\" \n    by (meson mono_TokensAt mono_subset_elem subsetI)\n  with sub have 4:\"\\<T>' k (Suc u) \\<subseteq> TokensAt k (fst (\\<J>' k (Suc u)))\" by blast\n  with 0 have sol3:\"\\<T>' k (Suc (Suc u)) \\<subseteq> TokensAt k (fst (\\<J>' k (Suc u)))\" using Tokens_def Sel_is_selector\n    is_selector_def by blast\n  from 4 0 have sol5:\"\\<T>' k (Suc u) \\<subseteq> \\<T>' k (Suc (Suc u))\" using Tokens_def Sel_is_selector\n    is_selector_def by blast \n   have \"  \\<T>' k (Suc u) = Tokens k (\\<T>' k u) (fst (\\<J>' k u))\" by auto\n  with sol1 assms(4) have sol4:\"\\<T>' k (Suc u) = \\<T> k (Suc u)\" using 2 by force\n  (*Token proofs*)\n  show ?thesis using sol1 2 sol3  sol4 sol5 by blast\nqed\n\n\nlemma \\<J>_step:\n  assumes \"k \\<le> length Doc\" \"invariant_pointers (\\<J>' k u)\" \"fst (\\<J>' k u) = (\\<J> k u)\" \"\\<T>' k  u = \\<T> k  u\"\n  shows \"invariant_pointers (\\<J>' k (Suc u)) \\<and> fst (\\<J>' k (Suc u)) = (\\<J> k (Suc u)) \\<and> \\<T>' k  (Suc u) = \\<T> k (Suc u)\"\nproof - \n  (*from assms finite_\\<J>_k have 0:\"finite (fst (\\<J>' k (Suc u)))\" by simp*)\n  from assms have 1:\"measure_help_monotone (snd(\\<J>' k u))  \n    \\<and> red_complete (snd(\\<J>' k u)) \\<and> in_set (snd(\\<J>' k u)) (fst(\\<J>' k u)) \\<and> invariant_pointers' (snd(\\<J>' k u)) \" \n    by (metis invariant_pointers.simps prod.collapse)\n  have 2:\"(\\<forall> (t, c) \\<in> (\\<T>' k (Suc u)) . 0 < length c)\"   \n      using Tokens_finite_nonempty \n      apply simp  using Tokens_finite_nonempty assms by (metis \\<T>'.simps(2))   \n  from assms have \"finite (fst (\\<J>' k  u))\" by (metis invariant_pointers.simps prod.collapse)\n  then have 3:\"finite (\\<T>' k (Suc u)) \\<and> finite (fst (\\<J>' k  u))\" using Tokens_finite_nonempty assms(1) by blast\n  from assms have 4:\"valid_bounds (fst (\\<J>' k  u))\" by (metis invariant_pointers.simps prod.collapse)\n  from assms have 5:\"valid_rule (fst (\\<J>' k  u))\" by (metis invariant_pointers.simps prod.collapse)\n  from assms have 6:\"dom_sup_items (snd(\\<J>' k u)) (fst (\\<J>' k u))\" by (metis invariant_pointers.simps prod.collapse)\n\n  (*should be proven differently from the invariants*)\n  have 7:\"\\<forall>(t, c)\\<in> (\\<T>' k (Suc u)). length c \\<in> Lex t Doc k\" using Tokens_lex assms(1) by blast (*prove that it is smaller then this*)\n  have 8:\"\\<forall>(t, c)\\<in> (\\<T>' k (Suc u)) . is_terminal t\" using Tokens_terminal assms(1) by blast\n  have val_lexing:\"\\<forall>(t, c)\\<in> (\\<T>' k (Suc u)) .  length c + k  \\<le> length Doc\" using Tokens_lex_length assms(1) by blast\n\n  have val_lexing':\"(\\<forall>(t, c)\\<in>(\\<T>' k (Suc u)) . 0 < length c) \\<and> (\\<forall>(t, c)\\<in>(\\<T>' k (Suc u)) . length c \\<in> Lex t Doc k)\n       \\<and> (\\<forall>(t, c)\\<in>(\\<T>' k (Suc u)) . is_terminal t) \\<and> finite (\\<T>' k (Suc u))\" using 3  7 8 2 by blast \n  from assms(2) have 10:\"invariant_pointers (fst (\\<J>' k u), snd (\\<J>' k u))\" by simp\n  have All_top:\"fst (\\<J>' k u) \\<subseteq> All_top\" using assms \\<I>_k_sub_All_top \\<J>_k_sub_\\<I>_k by blast\n  from assms have 9:\"dom_no_scan (snd(\\<J>' k u)) (fst (\\<J>' k u))\" by (metis invariant_pointers.simps prod.collapse)\n  have invariants:\"invariant_pointers (\\<pi>' k (\\<T>' k (Suc u)) (fst (\\<J>' k u), snd (\\<J>' k u)))\" \n    using \\<pi>'_pointer_invariants [OF 10 val_lexing' assms(1)] All_top val_lexing\n    by fastforce\n  (*equality*)\n \n  have 1:\"finite (\\<T>' k (Suc u)) \\<and> (\\<forall>(t, c)\\<in>\\<T>' k (Suc u). 0 < length c)\" using Tokens_finite_nonempty assms(1) by blast\n  with assms have tokens_eq:\"\\<T>' k (Suc u) = \\<T> k (Suc u)\" by force\n  then have items_eq:\"fst (\\<J>' k (Suc u)) = (\\<J> k (Suc u))\" using \n      All_top_equality [OF  assms(1) , where ?T=\"\\<T>' k (Suc u)\" and ?I=\"(\\<J>' k u)\" ] All_top val_lexing\n       assms by fastforce\n  show ?thesis using \\<J>'.simps(2) invariants tokens_eq items_eq  by force\nqed\n\nlemma \\<J>_step_equality:\n  assumes \"k \\<le> length Doc\" \"fst (\\<J>' k u) = (\\<J> k u)  \" \"\\<T>' k  u = \\<T> k  u\" \" finite (fst (\\<J>' k u))\" \n  shows \"fst (\\<J>' k (Suc u)) = (\\<J> k (Suc u)) \\<and> \\<T>' k  (Suc u) = \\<T> k (Suc u)\"\nproof -\n  have All_top:\"fst (\\<J>' k u) \\<subseteq> All_top\" using assms \\<I>_k_sub_All_top \\<J>_k_sub_\\<I>_k by blast\n from assms have 2:\"\\<T>' k (Suc u) = \\<T> k (Suc u)\" by force\n  then have val_lexing:\"\\<forall>(t, c)\\<in> (\\<T>' k (Suc u)) .  length c + k  \\<le> length Doc\" \n    using Tokens_lex_length assms(1) by blast\n \n  have 1:\"finite (\\<T>' k (Suc u)) \\<and> (\\<forall>(t, c)\\<in>\\<T>' k (Suc u). 0 < length c)\" using Tokens_finite_nonempty assms(1) by blast\n   then have \"fst (\\<J>' k (Suc u)) = (\\<J> k (Suc u))\" using \n       All_top_equality [OF  assms(1) , where ?T=\"\\<T>' k (Suc u)\" and ?I=\"(\\<J>' k u)\" ] All_top val_lexing\n       assms by fastforce\n  then show ?thesis using 2 by blast\nqed\n\n\n\nlemma \\<I>_step:\n  assumes \"Suc k \\<le> length Doc\" \"invariant_pointers (\\<I>' k)\" \"fst (\\<I>' k) = \\<I> k\"  \n  shows \"invariant_pointers (\\<J>' (Suc k) 0) \\<and> fst (\\<J>' (Suc k) 0) = (\\<J> (Suc k) 0) \\<and> \\<T>' (Suc k)  0 = \\<T> (Suc k) 0\"\nproof - \n  from assms have 1:\"measure_help_monotone (snd(\\<I>' k ))  \n    \\<and> red_complete (snd(\\<I>' k )) \\<and> in_set (snd(\\<I>' k )) (fst(\\<I>' k )) \\<and> invariant_pointers' (snd(\\<I>' k )) \n  \" \n    by (metis invariant_pointers.simps prod.collapse)\n  have 2:\"(\\<forall> (t, c) \\<in> {} . 0 < length c)\"  by blast\n  have 3:\"finite {} \\<and> finite (fst (\\<I>' k ))\" apply (cases \"\\<I>' k\") using assms by auto\n  from assms have 4:\"valid_bounds (fst (\\<I>' k))\" by (metis invariant_pointers.simps prod.collapse)\n  from assms have 5:\"valid_rule (fst (\\<I>' k))\" by (metis invariant_pointers.simps prod.collapse)\n  from assms have 6:\"dom_sup_items (snd  (\\<I>' k)) (fst (\\<I>' k))\" by (metis invariant_pointers.simps prod.collapse)\n  from assms have 7:\"dom_no_scan (snd  (\\<I>' k)) (fst (\\<I>' k))\" by (metis invariant_pointers.simps prod.collapse)\n  have 8:\"\\<forall>(t, c)\\<in> {}. length c \\<in> Lex t Doc (Suc k)\"  by blast\n  have All_top:\"fst (\\<I>' k) \\<subseteq> All_top\" using assms \\<I>_k_sub_All_top by simp\n  have val_lexing:\"\\<forall>(t, c)\\<in> {} . (Suc k) + length c  \\<le> length Doc\" using Tokens_lex_length assms(1) by blast\n \n  have ip:\"invariant_pointers (fst (\\<I>' k ), snd (\\<I>' k ))\" using assms(2) by simp\n  from assms have \"invariant_pointers (\\<pi>' (Suc k) {} (fst (\\<I>' k ), snd (\\<I>' k )))\"\n    using \\<pi>'_pointer_invariants [OF ip , where ?T=\"{}\" and ?k=\"Suc k\"] All_top val_lexing by blast\n  then have invariants:\"invariant_pointers (\\<J>' (Suc k) 0)\" using \\<J>'.simps(3)[where ?k=\"k\"] by simp\n  (*equality*)\n  have 9:\"\\<T>' (Suc k)  0 = \\<T>' (Suc k) 0\" by blast\n \n  have \"\\<forall>(t, c)\\<in>{}. 0 < length c\" by blast\n  then have items_eq:\"fst (\\<J>' (Suc k) 0) = (\\<J> (Suc k) 0)\" using\n        All_top_equality [OF  assms(1) val_lexing All_top] assms by fastforce\n  show ?thesis using  invariants items_eq  by auto\nqed\n(*central theorem of high importance*)\n(*\n  unnecessary now\n*)\nlemma \\<I>_invar:\n  \"k \\<le> length Doc \\<Longrightarrow> invariant_pointers (\\<I>' k) \\<and> fst (\\<I>' k ) = \\<I> k\"\n  using \\<I>'_invariants \\<I>'_pointer_invariants_def by blast\n\ntheorem invariants:\"invariant_pointers (I, (pred, red))\"\n  using \\<I>_invar I_def pred_def red_def by fastforce\n\ntheorem item_equality:\"I = \\<I> (length Doc)\"\n  using \\<I>_invar I_def by blast \n\ntheorem I_finite: \"finite I\"\n  using invariants by simp\n\n\ntheorem wf:\"measure_help_monotone (pred, red)\"\n  using invariants by simp\n\ntheorem inset:\"in_set (pred, red) I\"\n  using invariants by simp\n\ntheorem reduction_complete:\"red_complete (pred, red)\"\n  using invariants by simp\n\ntheorem invariants':\"invariant_pointers' (pred, red)\"\n  using invariants by simp\ndefinition pointer_measure::\"('a, 'b) item \\<Rightarrow> nat\" where\n\"pointer_measure i= measure_help (pred, red) i\"\n\ndefinition pointer_measure'::\"('a, 'b) item \\<Rightarrow> nat\" where\n\"pointer_measure' i = (if i \\<notin> I then 0 else (if i \\<notin> (dom pred \\<union> dom red) then 1 else snd (the ( pred i))))\"\n\nsection \"Pointer Invariants\"\n\ntheorem pointer_wf:\"\\<forall> node \\<in>  (dom pred) . pointer_measure node > pointer_measure (fst (the (pred node)))\"\n  using wf pointer_measure_def by auto\ntheorem pointer_wf':\"\\<forall> node \\<in>  (dom red) . pointer_measure node > pointer_measure (fst (the (red node)))\"\n  using wf pointer_measure_def by auto\n\ntheorem pointer_wf'':\"\\<forall> node \\<in>  (dom red) . node \\<in> dom pred\"\n  using invariants by auto\n\nlemma pred_inc:\"\\<forall> node \\<in>  (dom pred) . item_dot node = (Suc (item_dot (fst (the (pred node)))))\"\n  using invariants by auto\n\nlemma pred_rule:\"\\<forall> node \\<in>  (dom pred) . item_rule node = item_rule (fst (the (pred node)))\"\n  using invariants by auto\nlemma pred_in_Items:\"\\<forall> node \\<in>  (dom pred) . (fst (the (pred node)))  \\<in> I\" \nproof -\n  have \"\\<forall> node \\<in>  (dom pred) . the (pred node) \\<in> ran pred\" apply(auto simp add: ran_def) done \n  then show ?thesis using inset by force\nqed\nlemma red_in_Items:\"\\<forall> node \\<in>  (dom red) . (fst (the (red node)))  \\<in> I\" \nproof -\n  have \"\\<forall> node \\<in> (dom red). the (red node) \\<in> ran red\" by (auto simp add: dom_def ran_def)\n  then show ?thesis using inset by force\nqed\n\nlemma red_complete:\"\\<forall> node \\<in>  (dom red) . is_complete(fst (the (red node)))\"\nproof -\n  have \"\\<forall> node \\<in> (dom red). the (red node) \\<in> ran red\" by (auto simp add: ran_def)\n  then show ?thesis using reduction_complete by force\nqed\n\n\nlemma red_is_pred_next:\"\\<forall> node \\<in> (dom red) . next_symbol (fst (the (pred node))) = Some (item_nonterminal (fst (the (red node))))\"\n  using invariants by auto\n\nlemma incomplete_implies_dot_le_rhs:\"\\<not> is_complete node \\<Longrightarrow> item_dot node < length (item_rhs node)\"\n  by (auto simp add: is_complete_def)\n\nlemma no_red_terminal_next:\"\\<forall> node \\<in>  (dom pred) . node \\<notin> (dom red) \n    \\<longrightarrow> (\\<exists> t . next_symbol (fst (the (pred node))) = Some t \\<and> is_terminal t)\"\n  using invariants by simp\nlemma pred_terminal:\"\\<forall> node \\<in>  (dom pred) . node \\<notin> (dom red) \n    \\<longrightarrow> (item_rhs (fst (the (pred node)))) ! (item_dot (fst (the (pred node)))) \\<in> \\<TT>\"\nproof -\n  from no_red_terminal_next have \"\\<forall> node \\<in>  (dom pred) . node \\<notin> (dom red) \n    \\<longrightarrow> (\\<exists> t . item_rhs (fst (the (pred node))) ! (item_dot (fst (the (pred node)))) =  t \\<and> is_terminal t)\" \n    by (metis next_symbol_not_complete option.sel next_symbol_def)\n  then have \"\\<forall> node \\<in>  (dom pred) . node \\<notin> (dom red) \n    \\<longrightarrow> is_terminal (item_rhs (fst (the (pred node))) ! (item_dot (fst (the (pred node)))))\" by simp\n  then show ?thesis by (meson is_terminal_')\nqed\n\nlemma pred_incomplete:\"\\<forall> node \\<in>  (dom pred) . \\<not> is_complete(fst (the (pred node)))\" \n  by (metis red_is_pred_next  no_red_terminal_next  next_symbol_not_complete)(*should be a lemma from the next symbols*)\n\n\nlemma pred_terminal':\"node \\<in>  (dom pred) \\<and>  node \\<notin> (dom red) \n    \\<Longrightarrow> (item_rhs (fst (the (pred node)))) ! (item_dot (fst (the (pred node)))) \\<in> \\<TT>\"\n  using  pred_terminal by blast \n\n(*actual invariant*)\nlemma dot0_if_no_pred:\"node \\<in> I \\<Longrightarrow> node \\<notin> (dom pred \\<union> dom red) \\<Longrightarrow> item_dot node = 0\" \n  using invariants by auto\n\n(*additional proof item_dot node = 0 \\<Longrightarrow> item_end node = item_origin node \\<longrightarrow> maybe just include*)\nlemma no_scan_if_no_pred:\"node \\<in> I \\<Longrightarrow> node \\<notin> (dom pred \\<union> dom red) \\<Longrightarrow> \n  item_end node = item_origin node\" \n  using invariants by auto(*proven from predict*)\n\nlemma node_valid:\"node \\<in> I \\<Longrightarrow> item_rule node \\<in> \\<RR>\" \n  using invariants valid_rule_def by simp (*has to be proven differently*)\n\nlemma next_lexes:\"\\<forall> x \\<in> (dom pred) . x \\<notin> dom red \\<longrightarrow>\n    is_lexed (fst (the (pred x))) x\"\n  using invariants by simp\n\n\nlemma Item_bounds:\"\\<forall> i \\<in> I. item_origin i \\<le> item_end i\" \n  using invariants valid_bounds_def by simp\n\nlemma pred_item_bounds:\"\\<forall> x \\<in> (dom pred) . item_origin x = item_origin (fst (the (pred x))) \\<and> item_end x \\<ge> item_end (fst (the (pred x)))\"\n  using invariants by simp\n\nlemma bound_help:\"(\\<forall> x \\<in> (dom pred) . item_origin x = item_origin (fst (the (pred x))) \n  \\<and> item_end x \\<ge> item_end (fst (the (pred x))) \\<and> (\\<forall> x \\<in> (dom red) . item_origin (fst (the (red x))) = item_end (fst (the (pred x))) \\<and> \n    item_end x = item_end (fst (the (red x)))))\"\n  using invariants by simp\nlemma red_item_bounds:\"\\<forall> x \\<in> (dom red) . item_origin (fst (the (red x))) = item_end (fst (the (pred x))) \\<and>\n    item_end x = item_end (fst (the (red x)))\"\n  using bound_help \n  by (meson pointer_wf'')\n\n\n\ndefinition ms'::\"(('a, 'b) item \\<times> ('a, 'b) item ) set\" where\n\"ms' = {(i, j) | i j . j \\<in> (dom pred) \\<and> i = fst (the (pred j))} \"\n\nlemma ms'_wf:\"wf ms'\"\nproof -\n  have 1:\"\\<forall> node . node \\<in> (dom pred) \\<longrightarrow> pointer_measure (fst (the (pred node))) < pointer_measure node\" using pointer_wf by blast\n  then show ?thesis using wf_if_measure [where ?P=\"(\\<lambda> x. x \\<in> (dom pred))\" and ?f=\"pointer_measure\" and ?g=\"\\<lambda> x . (fst (the (pred x)))\"] \n    by (smt (verit, ccfv_SIG) Collect_cong case_prodI2 ms'_def old.prod.case split_part)\nqed\n(*invariant \\<Longrightarrow> for each item constructed tree + subtrees \\<Longrightarrow>  valid until point*)\n(*complete items imply correct tree*)\nfunction build_tree::\"('a, 'b) item \\<Rightarrow> ('a, 'b) derivtree\" where\n\"build_tree node  = (if (node \\<notin> (dom pred \\<union> dom red)) then (DT (item_rule node) []) else \n  (if (node \\<in> dom red) then update_tree (build_tree (fst (the (pred node)))) (build_tree (fst (the (red node))))\n       else update_tree (build_tree (fst (the (pred node)))) (Leaf (item_rhs \n  (fst (the (pred node))) ! (item_dot (fst (the (pred node))))))))\"\n   apply auto[1]\n  by meson\ntermination proof (relation \"measure pointer_measure\", goal_cases)\ncase 1\n  then show ?case (*why no measure?*) by auto\n    (*by (auto simp add: pointer_measure_def pointer_wf)*)\nnext\n  case (2 node)\n  then show ?case\n    by (simp add: pointer_wf pointer_wf'')\nnext\n  case (3 node)\n  then show ?case \n    using pointer_wf' by auto\nnext\n  case (4 node)\n  then show ?case \n    using pointer_wf by auto\nqed\n\nfun valid_tree::\"('a, 'b) derivtree \\<Rightarrow> bool\" where\n\"valid_tree (Leaf a) = (a \\<in> \\<TT>)\"|\n\"valid_tree (DT r b) = ((r \\<in> \\<RR>) \\<and>  list_all valid_tree b \\<and> (map (\\<lambda> t. fst (DeriveFromTree t)) b)  = snd r) \"|\n\"valid_tree _ = False\"\nfun valid_tree_k::\"nat \\<Rightarrow> ('a, 'b) derivtree \\<Rightarrow> bool\" where\n\"valid_tree_k _ (Leaf a) = (a \\<in> \\<TT>)\"|\n\"valid_tree_k k (DT r b) = ((r \\<in> \\<RR>) \\<and> list_all valid_tree b \\<and> (map (\\<lambda> t. fst (DeriveFromTree t)) b)  = take k (snd r))\"|\n\"valid_tree_k _  _ = False\"\n\n\nlemma valid_tree_k_implies_valid_tree:\"valid_tree_k (length (snd r))  (DT r b) \\<Longrightarrow> valid_tree (DT r b)\"\n  by simp\n\nlemma valid_tree_k_implies_valid_tree':\"k \\<ge> length (snd r) \\<Longrightarrow> valid_tree_k k  (DT r b) \\<Longrightarrow> valid_tree (DT r b)\"\n  by simp\n\n\nlemma update_valid_tree_k_tree:\n  assumes \"valid_tree_k k (DT r b)\" \"length b = k\" \" valid_tree T\" \"fst (DeriveFromTree T) = (snd r) ! k\" \"k < length (snd r)\"\n  shows \"valid_tree_k (Suc k) (update_tree (DT r b) T)\"\n  \nproof -\n  from assms have 1:\"r \\<in> \\<RR>\" by simp\n  from assms have 2:\"(map (\\<lambda> t. fst (DeriveFromTree t)) b)  = take k (snd r)\" by simp\n  from assms have \"fst (DeriveFromTree T) = snd r ! k\" by simp\n  obtain bnew where 3:\"bnew = b@[T]\" by blast\n  then have 4:\"list_all valid_tree bnew\" using assms by simp\n  from 2 3 have \"(map (\\<lambda> t. fst (DeriveFromTree t)) bnew)  = (take k (snd r))@[fst (DeriveFromTree T)]\" by simp\n  with assms have 5:\"(map (\\<lambda> t. fst (DeriveFromTree t)) bnew)  = (take (Suc k) (snd r))\" \n    using take_Suc_conv_app_nth by metis\n  have \"(update_tree (DT r b) T) = DT r bnew\" using 3 by auto\n  then show ?thesis using 1 4 5 by simp\nqed\n\n(*another proof \\<Longrightarrow> complete trees can only be reduced too*)\ndefinition easy_prec::\"(('a, 'b) item  \\<times> ('a, 'b) item) set\" where\n \"easy_prec = measure pointer_measure\"\n\ntheorem easy_prec:\"wf easy_prec\"\n  using pointer_measure_def easy_prec_def by simp\n\ndefinition prec::\"(('a, 'b) item  \\<times> ('a, 'b) item) set\" where\n \"prec = {(i, j) | i j . pointer_measure i < pointer_measure j \\<and> ((j \\<in> (dom pred) \\<and> i = fst (the (pred j))) \\<or> \n  (j \\<in> (dom red) \\<and> i = fst (the (red j))))}\"\n\ntheorem wf_prec:\"wf prec\"\nproof -\n  have \"prec \\<subseteq> easy_prec\" by (auto simp add: prec_def easy_prec_def)\n  then show ?thesis using easy_prec \n    by (meson wf_subset)\nqed\nlemma build_tree_rule:\n  shows\"i \\<in> I \\<Longrightarrow>\\<exists> b .  build_tree i = (DT (item_rule i) b) \\<and> fst (DeriveFromTree (build_tree i)) \n  = item_nonterminal i \\<and> length b = item_dot i\"\nproof (induction \"i\"  rule: wf_induct [where ?r=\"prec\"])\n  case 1\n  then show ?case using wf_prec by simp\nnext\n  case (2 x)\n  then have x_in_I:\"x \\<in> I\" by blast\n  { assume a:\"x \\<notin> dom pred \\<union> dom red\"\n    then have 0:\"item_dot x = 0\" using dot0_if_no_pred x_in_I by blast \n    from a have 1:\"build_tree x = (DT (item_rule x) [])\" by auto\n    then have \"fst (DeriveFromTree (DT (item_rule x) [])) = (fst (item_rule x))\" by simp\n    with 1 have \"fst (DeriveFromTree (build_tree x)) = item_nonterminal x \\<and> build_tree x = (DT (item_rule x) [])\" \n      by (metis item_nonterminal_def)\n    then  have \"\\<exists> b . fst (DeriveFromTree (build_tree x)) = item_nonterminal x \\<and> build_tree x = (DT (item_rule x) b) \\<and> length b = item_dot x\" \n      by (auto simp add: 0)\n  }\n  then have  case1:\"x \\<notin> dom pred \\<union> dom red \\<Longrightarrow>\n    \\<exists> b . fst (DeriveFromTree (build_tree x)) = item_nonterminal x \n  \\<and> build_tree x = (DT (item_rule x) b) \\<and> length b = item_dot x\" by blast\n  {\n    assume 0:\"x \\<in> dom red\"\n    then have 1:\"x \\<in> dom pred\" using pointer_wf'' by auto\n    (*Predecessor Tree*)\n    then obtain prednode where prednode:\"prednode =  fst (the (pred x))\" by blast\n    with 1 have prednode':\"(prednode, x) \\<in> prec\" using  pointer_wf \n      by (simp add: prec_def)\n    from prednode 1 have prednode_in_I:\"prednode \\<in> I\" \n      by (simp add: pred_in_Items) \n    obtain rednode where rednode:\"rednode = fst (the (red x))\" by blast\n    with 0 have \"(rednode, x) \\<in> prec\" using pointer_measure_def using pointer_wf' by (simp add: prec_def)\n    from 0 1 prednode rednode have x:\"build_tree x = update_tree (build_tree prednode) (build_tree rednode)\" by auto\n    from 2 prednode' prednode_in_I obtain \n        b where predtree:\"build_tree prednode = (DT (item_rule prednode) b)\" by blast\n    then have x':\"build_tree x = (DT (item_rule prednode) (b@[(build_tree rednode)]))\" using x by simp\n    from prednode 1 have eq:\"item_rule x = item_rule prednode\" using pred_rule by blast\n    have \"item_dot x = (Suc (item_dot prednode))\" using pred_inc 1 prednode by blast\n    then have length:\"item_dot x = length (b@[(build_tree rednode)])\" using 2 prednode' predtree prednode_in_I by auto\n  \n    from  x' eq have \"build_tree x = (DT (item_rule x) (b@[(build_tree rednode)]))\" by auto\n    then have \"fst (DeriveFromTree (build_tree x)) =(fst (item_rule x))\" by simp\n    then have \"\\<exists> b . fst (DeriveFromTree (build_tree x)) = item_nonterminal x \\<and> \n      build_tree x = (DT (item_rule x) b) \\<and> length b = item_dot x\" using length x' item_nonterminal_def \n      by (metis eq)\n  }\n  then have case2:\"x \\<in> dom red \\<Longrightarrow> \\<exists>b. fst (DeriveFromTree (build_tree x)) \n  = item_nonterminal x \\<and> build_tree x = DT (item_rule x) b \\<and> length b = item_dot x\" by blast\n  {\n    assume 0:\"x \\<in> dom pred \\<and> x \\<notin> dom red\"\n   (*Predecessor Tree*)\n    then obtain prednode where prednode:\"prednode =  fst (the (pred x))\" by blast\n    with 0 have prednode':\"(prednode, x) \\<in> prec\" using pointer_measure_def pointer_wf by (simp add: prec_def)\n    from 0 have prednode_in_I:\"prednode \\<in> I\" \n      by (simp add: pred_in_Items prednode)\n    obtain T where T_def:\"T = Leaf ((item_rhs prednode) ! (item_dot prednode))\" by blast\n    \n    then have match:\"fst (DeriveFromTree T) = (item_rhs prednode) ! (item_dot prednode)\" by simp\n    with 0  prednode  have x:\"build_tree x = update_tree (build_tree prednode) T\" using T_def by auto \n    from 2 prednode' prednode_in_I obtain  b where predtree:\"build_tree prednode = (DT (item_rule prednode) b)\" by blast\n    then have x':\"build_tree x = (DT (item_rule prednode) (b@[T]))\" using x by simp\n    from prednode 0 have eq:\"item_rule x = item_rule prednode\" using pred_rule by blast\n    have \"item_dot x = (Suc (item_dot prednode))\" using pred_inc 0 prednode by blast\n    then have length:\"item_dot x = length (b@[T])\" using 2 prednode' predtree prednode_in_I by auto\n  \n    from  x' eq have \"build_tree x = (DT (item_rule x) (b@[T]))\" by auto\n    then have \"fst (DeriveFromTree (build_tree x)) =(fst (item_rule x))\" by simp\n    then have \"\\<exists> b . fst (DeriveFromTree (build_tree x)) = item_nonterminal x \\<and> \n      build_tree x = (DT (item_rule x) b) \\<and> length b = item_dot x\" using length x' item_nonterminal_def \n      by (metis eq)\n  }\n  then show ?case using case1 case2 by blast\nqed\n (*proved by induction on pred*)\n\nlemma build_tree_rule':\"i \\<in> I \\<Longrightarrow> fst (DeriveFromTree (build_tree i)) = item_nonterminal i\"\n  using build_tree_rule by blast\n\n\nlemma complete_item_implies_valid_tree:\n  assumes \"is_complete i \"\" i \\<in> I\" \"valid_tree_k (item_dot i) (build_tree i)\"\n  shows \" valid_tree (build_tree i)\"\nproof -\n  from build_tree_rule obtain b where 0:\"build_tree i = (DT (item_rule i) b)\" using assms by blast\n  from assms have \"item_dot i \\<ge> length (snd (item_rule i))\" using is_complete_def item_rhs_def by metis\n  with 0 valid_tree_k_implies_valid_tree assms show ?thesis by auto\nqed\n\n\ntheorem build_tree_valid:\n  shows \"node \\<in> I \\<Longrightarrow> valid_tree_k (item_dot node) (build_tree node)\" \nproof (induction \"node\" rule: wf_induct [where ?r=\"prec\"])\n  case 1\nthen show ?case using wf_prec by simp\nnext\n  case (2 x)\n  then have x_in_I:\"x \\<in> I\" by blast\n  { assume a:\"x \\<notin> dom pred \\<union> dom red\"\n    then have 0:\"item_dot x = 0\" using dot0_if_no_pred x_in_I by blast \n    from a have 1:\"build_tree x = (DT (item_rule x) [])\" by auto\n    have 2:\"item_rule x \\<in> \\<RR>\" \n      using x_in_I  node_valid by auto\n    have 3:\"list_all valid_tree []\" by simp\n    have \"(map (\\<lambda> t. fst (DeriveFromTree t)) []) = take 0 (snd (item_rule node))\" by simp\n    then have \"valid_tree_k (item_dot x) (build_tree x)\" using 0 1 2 3 by simp \n  }\n  then have case1:\" x \\<notin> dom pred \\<union> dom red \\<Longrightarrow> valid_tree_k (item_dot x) (build_tree x) \" by blast\n  {\n    assume 0:\"x \\<in> dom red\"\n    then have 1:\"x \\<in> dom pred\" using pointer_wf'' by auto\n    (*Predecessor Tree*)\n    then obtain prednode where prednode:\"prednode =  fst (the (pred x))\" by blast\n    then have prednode_in_I:\"prednode \\<in> I\" \n      by (simp add: 1 pred_in_Items)\n    with 1 have \"(prednode, x) \\<in> prec\" using pointer_wf \n      by (simp add: prec_def prednode)\n    with 2  prednode_in_I have validk_pred:\"valid_tree_k (item_dot prednode) (build_tree prednode)\" by blast\n    from 1 prednode have pred_assms:\"prednode \\<in> I \\<and> (item_dot prednode) < length (item_rhs prednode)\" \n      by (simp add: incomplete_implies_dot_le_rhs pred_in_Items pred_incomplete)(*one assumption to be proven, and incompleteness*)\n    then obtain b where b:\"build_tree prednode = (DT (item_rule prednode) b) \n      \\<and> (item_dot prednode) = length b\" using build_tree_rule by metis\n    (*Reduction Tree*)\n    obtain rednode where rednode:\"rednode = fst (the (red x))\" by blast\n    then have rednode_in_I:\"rednode \\<in> I\" by (simp add: 0 red_in_Items)\n    with 0 have \"(rednode, x) \\<in> prec\" using pointer_measure_def using pointer_wf' \n      using prec_def rednode by auto\n    with 2 rednode_in_I have redval:\"valid_tree_k (item_dot rednode) (build_tree rednode)\" by blast\n    \n    have red_assms:\"rednode \\<in> I \\<and> is_complete rednode \n    \\<and> next_symbol prednode = Some (item_nonterminal rednode)\" \n        by (simp add: 0 red_complete red_is_pred_next prednode rednode red_in_Items)   (*from reduction assumptions*)\n    obtain T where T_def:\"T = build_tree rednode\" by blast\n    with red_assms redval have T_valid:\"valid_tree T\" using complete_item_implies_valid_tree by blast\n    from red_assms have match:\"fst (DeriveFromTree T) = item_nonterminal rednode\" \n      using T_def build_tree_rule' by blast\n    from red_assms have match':\"item_nonterminal rednode = item_rhs prednode ! (item_dot prednode)\" \n      by (metis next_symbol_def next_symbol_not_complete option.inject)\n    (*Compose trees*)\n    have \"build_tree x = update_tree (build_tree (fst (the (pred x)))) (build_tree (fst (the (red x))))\" using 0 1 by simp\n    then have \"build_tree x = update_tree (build_tree prednode) T\" using prednode T_def rednode by auto\n    then have valid_x:\"valid_tree_k (Suc (item_dot prednode)) (build_tree x)\" using update_valid_tree_k_tree \n          b validk_pred  T_valid match\n      by (metis match' item_rhs_def pred_assms)\n    from 1 have \"item_dot x = Suc (item_dot prednode)\" using pred_inc prednode by blast\n    with valid_x have \"valid_tree_k (item_dot x) (build_tree x)\" by simp \n  }\n  then have case2:\"x \\<in> dom red \\<Longrightarrow> valid_tree_k (item_dot x) (build_tree x)\" by blast\n  {\n    assume 0:\"x \\<notin> dom red \\<and> x \\<in> dom pred\"\n       (*Predecessor Tree*)\n    then obtain prednode where prednode:\"prednode =  fst (the (pred x))\" by blast\n    with 0 have 1:\"(prednode, x) \\<in> prec\" using pointer_measure_def pointer_wf \n      using prec_def by auto\n    then have prednode_in_I:\"prednode \\<in> I\" \n      by (simp add: 0 pred_in_Items prednode)\n    with 2  1 have validk_pred:\"valid_tree_k (item_dot prednode) (build_tree prednode)\" by blast\n    from 0 prednode have pred_assms:\"prednode \\<in> I \\<and> (item_dot prednode) < length (item_rhs prednode)\"\n      using pred_in_Items pred_incomplete\n      by (simp add: incomplete_implies_dot_le_rhs)  (*one assumption to be proven, and incompleteness*)\n    then obtain b where b:\"build_tree prednode = (DT (item_rule prednode) b) \\<and> (item_dot prednode) = length b\" using build_tree_rule by metis\n\n    (*Leaf*)\n    obtain T where T_def:\"T = Leaf ((item_rhs prednode) ! (item_dot prednode))\" by blast\n    then have match:\"fst (DeriveFromTree T) = (item_rhs prednode) ! (item_dot prednode)\" by simp\n    from 0 have \"(item_rhs prednode) ! (item_dot prednode) \\<in> \\<TT>\" using pred_terminal' prednode by auto\n      \n        (*Scan assumption*) \n    with T_def have valid_T:\"valid_tree T\" by auto \n\n        (*Compose trees*)\n    from 0 have \"x \\<in> (dom red \\<union> dom pred) \\<and> x \\<notin> (dom red)\" by auto\n    then have \"build_tree x = update_tree (build_tree (fst (the (pred x)))) \n    (Leaf (item_rhs (fst (the (pred x))) ! (item_dot (fst (the (pred x))))))\" by (auto simp del: build_tree.simps simp add: build_tree.simps [of x])  \n    (*if else nesting gives issues*)\n    then have \"build_tree x = update_tree (build_tree prednode) T\" using prednode T_def by auto\n      \n    then have valid_x:\"valid_tree_k (Suc (item_dot prednode)) (build_tree x)\" using update_valid_tree_k_tree \n          b validk_pred  valid_T match\n      by (metis  item_rhs_def pred_assms)\n    from 0 have \"item_dot x = Suc (item_dot prednode)\" using prednode pred_inc by blast\n    with valid_x have \"valid_tree_k (item_dot x) (build_tree x)\" by simp \n  }\n  then have case3:\"x \\<notin> dom red \\<and> x \\<in> dom pred \\<Longrightarrow> valid_tree_k (item_dot x) (build_tree x)\" by blast\n  then show ?case using case1 case2 case3 by blast\nqed \n\ntheorem complete_implies_valid_tree:\n  \"node \\<in> I \\<Longrightarrow> is_complete node \\<Longrightarrow> valid_tree (build_tree node)\"\n  using build_tree_valid complete_item_implies_valid_tree by blast\n\n\n(*technically a lexer is only defined on the nats in the substring of doc*)\n\nfun lexes'::\"nat \\<Rightarrow> nat \\<Rightarrow> ('a, 'b) symbol  \\<Rightarrow> bool\" where\n\"lexes' k l b =  ((l-k ) \\<in> (Lex b Doc k))\"\n\nfun subdivision::\"nat \\<Rightarrow> nat \\<Rightarrow> (nat \\<times> nat) list \\<Rightarrow> bool\" where\n\"subdivision k l b = ((k = fst (hd b )) \\<and> (l = snd (last b )) \\<and> (\\<forall> (l, k) \\<in> set b . l \\<le> k )\n  \\<and> (tl (map fst b) = butlast (map snd b)))\"\n\nlemma subdivision_singleton:\"k \\<le> l \\<Longrightarrow> subdivision k l [(k, l)]\" by auto\nlemma subdivision_append:\n  assumes \"l\\<le> h\" \" subdivision k l sd\" \"sd \\<noteq> []\"\n  shows \"subdivision k h (sd@[(l, h)])\" \nproof -\n  have 1:\"k = fst( hd (sd@[(l, h)]))\" using assms by simp\n  have 2:\"h = snd (last (sd@[(l, h)]))\" by simp\n  have 3:\"(\\<forall> (l, k) \\<in> set (sd@[(l, h)]) . l \\<le> k )\" using assms by simp\n  have 4:\"(tl (map fst (sd@[(l, h)]))) = (tl (map fst (sd)))@[l]\" using assms by simp\n  have \"last (map snd sd) = snd (last sd)\" using assms \n    by (meson last_map) \n  then have l_last:\"last (map snd sd) = l\" using assms by auto\n  have 5:\"butlast (map snd (sd@[(l, h)])) = map snd sd\" by auto\n  with assms have 6:\"map snd sd = (butlast (map snd sd))@[l]\"  using l_last\n    by (metis Nil_is_map_conv append_butlast_last_id)\n  with 4 5 have \"(tl (map fst (sd@[(l, h)]))) = butlast (map snd (sd@[(l, h)]))\" using assms by auto\n  with 1 2 3 show ?thesis by auto\nqed\n\n\nfun tree_parses'::\"nat \\<times>  nat \\<Rightarrow> ('a, 'b) derivtree \\<Rightarrow> bool\" where\n\"tree_parses' (k, l) (Leaf a) = lexes' k l a\"|\n\"tree_parses' (k, l) (DT r []) =  (k = l)\"|\n\"tree_parses' (k, l) (DT r b) = (\\<exists> s . subdivision k l s \\<and> list_all2 tree_parses' s b)\"|\n\"tree_parses' _ _ = False\"\n\n(*Alternative proof based on subdivisions*)\ntheorem build_tree_valid_parse':\n  shows \"node \\<in> I \\<Longrightarrow> tree_parses' ((item_origin node), (item_end node)) (build_tree node) \" (*might have to add an minimum*)\nproof (induction \"node\" rule: wf_induct [where ?r=\"prec\"])\n  case 1\n  then show ?case \n    using wf_prec by blast\nnext\n  case (2 x)\n  then have x_in_I:\"x \\<in> I\" by simp\n  { assume a:\"x \\<notin> dom pred \\<union> dom red\"\n    then have 0:\"item_end x = item_origin x\" using no_scan_if_no_pred x_in_I by blast \n    from a have 1:\"build_tree x = (DT (item_rule x) [])\" by auto\n    with 0 1 have \"tree_parses' (item_origin x, item_end x) (build_tree x)\" by simp\n  }\n  then have case1:\"x \\<notin> dom pred \\<union> dom red \\<Longrightarrow> ?case\" by blast\n  { (*reduction case*)\n    assume 0:\"x \\<in> dom red\"\n    then have 1:\"x \\<in> dom pred\" using pointer_wf'' by auto\n    then obtain prednode where prednode:\"prednode =  fst (the (pred x))\" by blast\n    then have prednode_in_I:\"prednode \\<in> I\" \n      using 1 pred_in_Items by blast (*already proved*)\n    with 1 have \"(prednode, x) \\<in> prec\" using pointer_measure_def pointer_wf \n      using prec_def prednode by auto\n    with 2 prednode_in_I have pred_parses:\n        \"tree_parses' (item_origin prednode, item_end prednode) (build_tree prednode) \" by blast\n\n    (*Reduction Tree*)\n    obtain rednode where rednode:\"rednode = fst (the (red x))\" by blast\n    then have rednode_in_I:\"rednode \\<in> I\" using 0 red_in_Items by blast\n    with 0 have \"(rednode, x) \\<in> prec\" using pointer_measure_def  pointer_wf'\n      using prec_def rednode by auto\n    with 2 rednode_in_I have red_parses:\"tree_parses' ((item_origin rednode), (item_end rednode))\n      (build_tree rednode)\" by blast\n    \n    have red_assms:\"rednode \\<in> I \\<and> is_complete rednode \n    \\<and> next_symbol prednode = Some (item_nonterminal rednode)\" \n        by (simp add: 0 red_complete red_is_pred_next prednode rednode red_in_Items)   (*from reduction assumptions*)\n    obtain T where T_def:\"T = build_tree rednode\" by blast\n    (*obtain predecessor tree*)\n\n    from 1 prednode have pred_assms:\"prednode \\<in> I \\<and> (item_dot prednode) < length (item_rhs prednode)\"\n      by (simp add: incomplete_implies_dot_le_rhs pred_in_Items pred_incomplete)(*one assumption to be proven, and incompleteness*)\n    then obtain b where b:\"build_tree prednode = (DT (item_rule prednode) b) \n      \\<and> (item_dot prednode) = length b\" using build_tree_rule by metis\n\n    (*Compose trees*) \n    have \"build_tree x = update_tree (build_tree prednode) T\" using prednode T_def 0\n      using 1  rednode  by simp\n    then have tree_def:\"build_tree x = (DT (item_rule prednode) (b@[T]))\" using b by auto\n\n    (*case distinction on predecessor*)\n    have ?case \n    proof (cases \"b \\<noteq> []\")\n      case True\n        have \"tree_parses' (item_origin prednode, item_end prednode) (DT (item_rule prednode) b) \" \n          using pred_parses b by simp\n        then have \"(\\<exists> s . subdivision (item_origin prednode) (item_end prednode) \n          s \\<and> list_all2 tree_parses' s b)\" using True  tree_parses'.elims(2) by fastforce\n        then obtain sd where sd:\"subdivision (item_origin prednode) (item_end prednode) sd\n          \\<and> list_all2 tree_parses' sd b\" by blast\n        have nonempty:\"b@[T] \\<noteq> []\" by simp\n    (*most important assumption*)\n        from 0 1 prednode rednode have eq:\"item_origin rednode = item_end prednode \\<and> item_end rednode = item_end x\n              \\<and> item_origin x = item_origin prednode \\<and> item_end x \\<ge> item_end prednode\"\n          by (metis  pred_item_bounds red_item_bounds) \n        \n        \n        then have subdiv:\"subdivision (item_origin prednode) (item_end rednode)\n            (sd@[(item_origin rednode, item_end rednode)])\" using subdivision_append sd \n          by (metis True  list_all2_Nil)\n        have parses:\"list_all2  tree_parses' (sd@[(item_origin rednode, item_end rednode)]) (b@[T])\" \n          using red_parses T_def pred_parses \n            by (metis sd list.ctr_transfer(1) list_all2_Cons list_all2_appendI)\n        with subdiv eq have \"\\<exists> s . subdivision (item_origin x) (item_end x) s \\<and> list_all2 tree_parses' s (b@[T])\" by metis\n        with tree_def show ?thesis using nonempty\n            by (metis neq_Nil_conv tree_parses'.simps(3))\n    next\n      case False\n        have \"tree_parses' (item_origin prednode, item_end prednode) (DT (item_rule prednode) b) \" \n          using pred_parses b by simp\n        then have eq':\"item_origin prednode = item_end prednode\" using False tree_parses'.elims(2) by simp\n        (*most important assumption*)\n        from 0  1 prednode rednode have eq:\"item_origin rednode = item_end prednode \\<and> item_end rednode = item_end x\n          \\<and> item_origin x = item_origin prednode \\<and> item_end x \\<ge> item_end prednode\n          \" by (metis pred_item_bounds red_item_bounds )\n        then have eq'':\"item_origin x \\<le> item_end x\"  using Item_bounds prednode prednode_in_I by auto\n        obtain sd where sd:\"sd = [(item_origin x, item_end x)]\" by blast\n        then have sd':\"subdivision (item_origin x) (item_end x) sd\" using eq eq'' using subdivision_singleton by blast \n        from eq eq' have \"tree_parses' ((item_origin x) ,(item_end x)) T\" using T_def red_parses by simp\n        then have subtree_parses:\"list_all2 tree_parses' sd [T]\" using sd by simp        \n        from False have \"b@[T] = [T]\" by simp\n      then show ?thesis using tree_def sd' subtree_parses by auto\n    qed\n  }\n  then have case2:\"x \\<in> dom red \\<Longrightarrow> ?case\" by blast\n  {\n    assume 0:\"x \\<notin> dom red \\<and> x \\<in> dom pred\"\n       (*Predecessor Tree*)\n    then obtain prednode where prednode:\"prednode =  fst (the (pred x))\" by blast\n    then have prednode_in_I:\"prednode \\<in> I\" \n      by (simp add: 0 pred_in_Items)\n    with 0 have \"(prednode, x) \\<in> prec\" using pointer_wf prec_def prednode by auto\n    with 2 prednode_in_I have pred_parses:\n        \"tree_parses' (item_origin prednode, item_end prednode) (build_tree prednode) \" by blast\n    (*Leaf*)\n    obtain T where T_def:\"T = Leaf ((item_rhs prednode) ! (item_dot prednode))\" by blast\n    then have match:\"fst (DeriveFromTree T) = (item_rhs prednode) ! (item_dot prednode)\" by simp\n    from 0 have \"(item_rhs prednode) ! (item_dot prednode) \\<in> \\<TT>\" using pred_terminal' prednode by auto\n      \n    (*Scan assumption*)\n    from 0 next_lexes have \" x \\<notin> dom red \\<Longrightarrow> is_lexed (fst (the (pred x))) x\" by simp\n    with 0 next_lexes prednode have \"is_lexed prednode x\" by blast \n       (*assumption here*)\n    then have T_parses:\"lexes' (item_end prednode) \n        (item_end x) ((item_rhs prednode) ! (item_dot prednode))\" using is_lexed_def by auto\n    then have T_parses':\"tree_parses' (item_end prednode, item_end x) T\" using T_def by simp\n    \n\n(*obtain predecessor tree*)\n    from 0 prednode have pred_assms:\"prednode \\<in> I \\<and> (item_dot prednode) < length (item_rhs prednode)\"\n      by (simp add: incomplete_implies_dot_le_rhs pred_in_Items pred_incomplete)(*one assumption to be proven, and incompleteness*)\n    then obtain b where b:\"build_tree prednode = (DT (item_rule prednode) b) \n      \\<and> (item_dot prednode) = length b\" using build_tree_rule by metis\n    have pred_parses':\"tree_parses' (item_origin prednode, item_end prednode) (DT (item_rule prednode) b) \" \n      using pred_parses b by simp\n    from 0 have \"x \\<in> (dom red \\<union> dom pred) \\<and> x \\<notin> (dom red)\" by auto\n    then have \"build_tree x = update_tree (build_tree (fst (the (pred x)))) \n    (Leaf (item_rhs (fst (the (pred x))) ! (item_dot (fst (the (pred x))))))\" \n      by (auto simp del: build_tree.simps simp add: build_tree.simps [of x])\n    then have \"build_tree x = update_tree (build_tree prednode) T\" using prednode T_def by auto\n    then have tree_x:\"build_tree x = (DT (item_rule prednode) (b@[T]))\" using T_def b by auto\n    \n    have ?case\n    proof (cases \"b \\<noteq> []\")\n      case True\n      then have \"(\\<exists> s . subdivision (item_origin prednode) (item_end prednode) \n        s \\<and> list_all2 tree_parses' s b)\" using pred_parses' tree_parses'.elims(2) by fastforce\n      then  obtain sd where sd:\"subdivision (item_origin prednode) (item_end prednode) sd\n          \\<and> list_all2 tree_parses' sd b\" by blast\n      from 0 prednode have eq:\"item_origin x = item_origin prednode \\<and> item_end prednode \\<le> item_end x\" \n        using pred_item_bounds by blast\n      (*Compose trees*)\n      have subtrees_nonempty:\"b@[T] \\<noteq> []\" by blast\n      have subdiv:\"subdivision (item_origin x) (item_end x) (sd@[(item_end prednode, item_end x)])\"\n        using subdivision_append sd eq \n        by (metis True list_all2_Nil)\n      then have \"list_all2 tree_parses' (sd@[(item_end prednode, item_end x)]) (b@[T])\" using sd T_parses' \n          by (simp add: list_all2_appendI)\n      then show ?thesis  using subdiv tree_x subtrees_nonempty \n      by (metis list.exhaust tree_parses'.simps(3))\n    next\n      case False\n      have \"tree_parses' (item_origin prednode, item_end prednode) (DT (item_rule prednode) b) \" \n          using pred_parses b by simp\n        then have eq':\"item_origin prednode = item_end prednode\" using False tree_parses'.elims(2) by simp\n        (*most important assumption*)\n        from 0 prednode have eq:\"item_origin x = item_origin prednode \\<and> item_end x \\<ge> item_end prednode\n        \\<and> item_origin x \\<le> item_end x\" \n          using Item_bounds pred_item_bounds x_in_I by blast \n        obtain sd where sd:\"sd = [(item_origin x, item_end x)]\" by blast\n        then have sd':\"subdivision (item_origin x) (item_end x) sd\" using eq subdivision_singleton by blast\n        from eq eq' have \"tree_parses' ((item_origin x) ,(item_end x)) T\" using T_def T_parses' by simp\n        then have subtree_parses:\"list_all2 tree_parses' sd [T]\" using sd by simp        \n(**)\n        from False have \"b@[T] = [T]\" by simp\n        then show ?thesis using sd' subtree_parses tree_x by auto\n    qed\n  }\n  then show ?case using case1 case2 by blast\nqed\nterm \"is_finished\"\n\ndefinition select_item::\"('a, 'b) item set \\<Rightarrow> ('a, 'b) item option\" where\n\"select_item r = (case csorted_list_of_set (Set.filter is_finished r) of [] \\<Rightarrow> None | x#xs \\<Rightarrow> Some x)\"\n\nlemma select_item_is_finished:\n  assumes \"select_item r = Some i \" \"finite r\"\n  shows \"is_finished i \\<and> i \\<in> r\" \nproof -\n  from assms have 1:\"finite (Set.filter is_finished r)\" by simp\n  from assms select_item_def obtain xs \n     where 2:\"i#xs = csorted_list_of_set (Set.filter is_finished r)\" \n    by (metis (no_types, lifting) list.exhaust list.simps(4) list.simps(5) option.distinct(1) option.inject)\n  have \"i \\<in> (Set.filter is_finished r)\" using csorted_set'' [OF 1] arg_cong [where ?f=\"set\", OF 2]  by auto \n  then show ?thesis by simp\nqed\n\ndefinition T::\"('a, 'b) derivtree option\" where\n\"T = (case (\\<I>' (length Doc)) of (I', p) \\<Rightarrow> map_option build_tree (select_item I'))\"\n\nlemma \n  assumes \"T = None \"\n  shows \"\\<not>earley_recognised\" \nproof -\n  have 1:\"finite (\\<I> (length Doc))\" using item_equality I_finite by simp\n  then have 1:\"finite (Set.filter is_finished (\\<I> (length Doc)))\" by simp\n  { \n    assume \"earley_recognised\"\n    then have \"\\<exists> i \\<in> (\\<I> (length Doc)) . is_finished i\" using earley_recognised_def \\<II>_def by blast\n    then have \"(Set.filter is_finished (\\<I> (length Doc))) \\<noteq> {}\" by auto\n    then have \"\\<exists> x xs . x#xs=  csorted_list_of_set (Set.filter is_finished (\\<I> (length Doc)))\" using csorted_set'' [OF 1] \n      by (metis Collect_mem_eq empty_Collect_eq list.set_cases)\n    then have \"\\<exists> t . select_item (\\<I> (length Doc)) = Some t\" by (auto simp add: select_item_def split: list.splits) \n    with item_equality I_def have \"\\<exists> t . T = map_option build_tree (Some t)\"  \n      by (auto simp del: build_tree.simps simp add: T_def split: prod.splits) \n    then have \"T \\<noteq> None\" by auto\n  }\n  then show ?thesis using assms by blast\nqed\nlemma \n  assumes \"T = (Some t) \" \n  shows  \"earley_recognised \\<and> valid_tree t \\<and> tree_parses' (0, (length Doc)) t\"\nproof -\n  have 0:\"finite I\" by (simp add: I_finite)\n  from assms have \"T = map_option build_tree (select_item I)\" apply (cases \"(\\<I>' (length Doc))\") using T_def I_def by auto\n  with assms have \" (\\<exists>i. select_item I = Some i \\<and> build_tree i = t)\" using map_option_eq_Some by simp\n  then obtain i  where \"Some i = select_item I\" and t:\"build_tree i = t\" by fastforce\n  then have 1:\"is_finished i \\<and> i \\<in> I\" using select_item_is_finished 0 by simp\n  with t have valid:\"valid_tree t\" using complete_implies_valid_tree is_finished_def by blast \n  from build_tree_valid_parse' 1 have parse:\"tree_parses' (0, (length Doc)) t\" using is_finished_def t by metis\n  from 1 have \"earley_recognised\" using earley_recognised_def \\<II>_def item_equality by blast\n  with valid parse show ?thesis by blast\nqed\nend\n\nend", "meta": {"author": "LocalLexingParser", "repo": "LocalLexingParser", "sha": "243c0257ba20c9f9ec389a1883c640ace77d1bbc", "save_path": "github-repos/isabelle/LocalLexingParser-LocalLexingParser", "path": "github-repos/isabelle/LocalLexingParser-LocalLexingParser/LocalLexingParser-243c0257ba20c9f9ec389a1883c640ace77d1bbc/thys/SPPF.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6859494421679929, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.3135726759023278}}
{"text": "(*  Title:      JinjaThreads/J/DefAssPreservation.thy\n    Author:     Andreas Lochbihler, Tobias Nipkow\n*)\n\nsection \\<open>Preservation of definite assignment\\<close>\n\ntheory DefAssPreservation\nimports\n  DefAss\n  JWellForm\n  SmallStep\nbegin\n\ntext\\<open>Preservation of definite assignment more complex and requires a\nfew lemmas first.\\<close>\n\nlemma D_extRetJ [intro!]: \"\\<D> e A \\<Longrightarrow> \\<D> (extRet2J e va) A\"\nby(cases va) simp_all\n\nlemma blocks_defass [iff]: \"\\<And>A. \\<lbrakk> length Vs = length Ts; length vs = length Ts\\<rbrakk> \\<Longrightarrow>\n \\<D> (blocks Vs Ts vs e) A = \\<D> e (A \\<squnion> \\<lfloor>set Vs\\<rfloor>)\"\n(*<*)\napply(induct Vs Ts vs e rule:blocks.induct)\napply(simp_all add:hyperset_defs)\ndone\n(*>*)\n\ncontext J_heap_base begin\n\nlemma red_lA_incr: \"extTA,P,t \\<turnstile> \\<langle>e,s\\<rangle> -ta\\<rightarrow> \\<langle>e',s'\\<rangle> \\<Longrightarrow> \\<lfloor>dom (lcl s)\\<rfloor> \\<squnion> \\<A> e \\<sqsubseteq>  \\<lfloor>dom (lcl s')\\<rfloor> \\<squnion> \\<A> e'\"\n  and reds_lA_incr: \"extTA,P,t \\<turnstile> \\<langle>es,s\\<rangle> [-ta\\<rightarrow>] \\<langle>es',s'\\<rangle> \\<Longrightarrow> \\<lfloor>dom (lcl s)\\<rfloor> \\<squnion> \\<A>s es \\<sqsubseteq>  \\<lfloor>dom (lcl s')\\<rfloor> \\<squnion> \\<A>s es'\"\napply(induct rule:red_reds.inducts)\napply(simp_all del:fun_upd_apply add:hyperset_defs)\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply blast\napply(force split: if_split_asm)\napply blast\napply blast\napply blast\napply blast\napply blast\napply(blast dest: red_lcl_incr)\napply(blast dest: red_lcl_incr)\nby blast+\n\nend\n\ntext\\<open>Now preservation of definite assignment.\\<close>\n\ndeclare hyperUn_comm [simp del]\ndeclare hyperUn_leftComm [simp del]\n\ncontext J_heap_base begin\n\nlemma assumes wf: \"wf_J_prog P\"\n  shows red_preserves_defass: \"extTA,P,t \\<turnstile> \\<langle>e,s\\<rangle> -ta\\<rightarrow> \\<langle>e',s'\\<rangle> \\<Longrightarrow> \\<D> e \\<lfloor>dom (lcl s)\\<rfloor> \\<Longrightarrow> \\<D> e' \\<lfloor>dom (lcl s')\\<rfloor>\"\n  and reds_preserves_defass: \"extTA,P,t \\<turnstile> \\<langle>es,s\\<rangle> [-ta\\<rightarrow>] \\<langle>es',s'\\<rangle> \\<Longrightarrow> \\<D>s es \\<lfloor>dom (lcl s)\\<rfloor> \\<Longrightarrow> \\<D>s es' \\<lfloor>dom (lcl s')\\<rfloor>\"\nproof (induction rule:red_reds.inducts)\n  case BinOpRed1 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case AAccRed1 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case AAssRed1 thus ?case by(auto intro: red_lA_incr sqUn_lem D_mono)\nnext\n  case AAssRed2 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case FAssRed1 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case CASRed1 thus ?case by(auto intro: red_lA_incr sqUn_lem D_mono)\nnext\n  case CASRed2 thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case CallObj thus ?case by (auto elim!: Ds_mono[OF red_lA_incr])\nnext\n  case CallParams thus ?case by(auto elim!: Ds_mono[OF red_lA_incr])\nnext\n  case RedCall thus ?case by(auto dest!:sees_wf_mdecl[OF wf] simp:wf_mdecl_def elim!:D_mono')\nnext\n  case BlockRed thus ?case\n    by(auto simp:hyperset_defs elim!:D_mono' simp del:fun_upd_apply split: if_split_asm)\nnext\n  case SynchronizedRed1 thus ?case by(auto elim!: D_mono[OF red_lA_incr])\nnext\n  case SeqRed thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case CondRed thus ?case by (auto elim!: D_mono[OF red_lA_incr])\nnext\n  case TryRed thus ?case\n    by (fastforce dest:red_lcl_incr intro:D_mono' simp:hyperset_defs)\nnext\n  case RedWhile thus ?case by(auto simp:hyperset_defs elim!:D_mono')\nnext\n  case ListRed1 thus ?case by (auto elim!: Ds_mono[OF red_lA_incr])\nqed (auto simp:hyperset_defs)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/J/DefAssPreservation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802735722128, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.31356480258585095}}
{"text": "theory StandardModel\nimports\n  Protocol\n  ExecMessage\n  Subst\nbegin\n\n\nsection{* Operational Semantics *}\n\ntypes execstep = \"i \\<times> rolestep\"\n\ntypes trace = \"execstep list\"\n\nfun spies :: \"subst \\<Rightarrow> trace \\<Rightarrow> execmsg set\" \nwhere\n  \"spies s [] = IK0\"\n| \"spies s ((i, Send l pt) # es) = \n     insert (inst s i pt) (spies s es)\"\n| \"spies s ((i, Recv l pt) # es) = spies s es\"\n\ntypes threadpool = \"i \\<rightharpoonup> (rolestep list \\<times> rolestep list)\"\n\ntypes state = \"trace \\<times> threadpool \\<times> subst\"\n\n\ninductive_set \n  ossp :: \"proto \\<Rightarrow> state set\" \n  for P     :: \"proto\"\nwhere\n  init:  \"\\<lbrakk> \\<forall> i done todo. r i = Some (done,todo) \\<longrightarrow> \n                             done = [] \\<and> todo \\<in> P;\n            domS s = {EVar (AVar a) i | a i. True};\n            ranS s \\<subseteq> {Lit (EHonest a) | a. True} \\<union> {Lit (Eve a) | a. True}\n          \\<rbrakk>\n          \\<Longrightarrow> ([], r, s) \\<in> ossp P\"\n\n| send:  \"\\<lbrakk> (t, r, s) \\<in> ossp P;\n            r i = Some (done, Send l pt # todo)\n          \\<rbrakk>\n          \\<Longrightarrow> ( t @ [(i, Send l pt)], \n                r(i \\<mapsto> (done@[Send l pt], todo)), s) \\<in> ossp P\"\n            \n| recv:  \"\\<lbrakk> (t, r, s) \\<in> ossp P;\n            r i = Some (done, Recv l pt # todo);\n            domS \\<alpha> = { EVar v i | v. v \\<in> FV pt };\n            inst (extendS s \\<alpha>) i pt \\<in> infer (spies s t)\n          \\<rbrakk>\n          \\<Longrightarrow> (t @ [(i, Recv l pt)], \n               r(i \\<mapsto> (done@[Recv l pt], todo)), extendS s \\<alpha>) \\<in> ossp P\"\n\nlocale ossp_state = wf_proto+\n  fixes t :: trace\n  and r :: threadpool\n  and s :: subst\n  assumes ossp: \"(t,r,s) \\<in> ossp P\"\n\n\nsubsubsection{* Properties *}\n\nlemma spies_conv_set: \n  \"spies s t = IK0 \\<union> { inst s i pt\n                     | i l pt. (i, Send l pt) \\<in> set t }\"\n  by (induct t rule: spies.induct) auto\n\nlemma in_IK0_in_spies [simp,intro]: \"m \\<in> IK0 \\<Longrightarrow> m \\<in> spies s t\"\n  by (simp add: spies_conv_set)\n\nlemma spies_append [simp]: \n  \"spies s (t@t') = spies s t \\<union> spies s t'\"\n  by (auto simp: spies_conv_set)\n\nlemma spies_Un_IK0_conv_spies [simp]: \n  \"spies s t \\<union> IK0 = spies s t\"\n  \"IK0 \\<union> spies s t = spies s t\"\n  by(auto)\n\n\nsection{* Security Properties *}\n\ndefinition runs :: \"threadpool \\<Rightarrow> i \\<Rightarrow> role \\<Rightarrow> bool\"\nwhere \"runs r i R \\<equiv> case r i of \n                        Some (done, todo) \\<Rightarrow> R = done@todo\n                      | None \\<Rightarrow> False\"\n\n(* TODO: adapt names: knows \\<rightarrow> learnt, kntrace \\<rightarrow> ?, \\<dots>*)\ndefinition known :: \"subst \\<Rightarrow> trace \\<Rightarrow> execmsg set\"\nwhere \"known s t \\<equiv> infer (spies s t)\"\n\ntypes honesty_asms = \"id set\"\n\ndefinition secret :: \"proto \\<Rightarrow> role \\<Rightarrow> rolestep \\<Rightarrow> honesty_asms \\<Rightarrow> pattern  \\<Rightarrow> bool\"\nwhere \n  \"secret P R step H pt \\<equiv> \\<forall> (t,r,s) \\<in> ossp P. \\<forall> i.\n     ( runs r i R \\<and> (i,step) \\<in> set t \\<and> \n       (\\<forall> a \\<in> H. Rep_subst s (EVar (AVar a) i) \\<notin> Compromised)\n     ) \\<longrightarrow>\n     ( inst s i pt \\<notin> known s t )\"\n     \n\nsubsection{* Parts from other theories to be ported  *}\n\nsubsection{* Relation to Operational Semantics *}\n\n(* TODO: Port to substitution-less explicit model \n\nsubsubsection{* From Explicit Traces to Implicit Traces *}\n\nfun execsteps :: \"explicit_trace \\<Rightarrow> trace\"\nwhere\n  \"execsteps []               = []\"\n| \"execsteps (Step estep # t) =  estep # execsteps t\"\n| \"execsteps (_ # t)          =          execsteps t\"\n\nlemma execsteps_append [simp]: \n  \"execsteps (t@t') = execsteps t @ execsteps t'\"\n  by(induct t rule: execsteps.induct, auto)\n\nlemma set_execsteps_conv_set [simp]:\n  \"set (execsteps t) = \n   { (i,step) | i step. (i, step) \\<in> steps t}\"\n  by(induct t rule: execsteps.induct, auto)\n\n\ncontext reachable_state begin\n\nlemma spies_execsteps_extendS [simp]:\n  \"spies (extendS s \\<alpha>) (execsteps t) = \n   spies s (execsteps t)\"\n  apply(auto simp: spies_conv_set)\n  apply(force dest: steps_ground)+\n  done\n\n(* MOVE *)\nlemmas infer_monoD = rev_subsetD[OF _ infer_mono]\n\nlemma knows_spies_execsteps:\n  \"m \\<in> knows t \\<Longrightarrow> m \\<in> infer (spies s (execsteps t))\"\nproof(induct arbitrary: m rule: reachable_induct)\n  case init thus ?case by simp\nnext\n  case (send t r s i \"done\" l msg todo m' m) thus ?case\n    by(fastsimp elim!: infer_monoD pairParts_in_infer)\nnext\n  case (recv t r s i \"done\" l msg todo \\<alpha> m)\n  then interpret this_state: reachable_state P t r s by unfold_locales\n  show ?case using recv\n    by(simp add: this_state.spies_execsteps_extendS)\nnext\n  case hash thus ?case by(fastsimp intro: infer.Hash)\nnext\n  case encr thus ?case by(fastsimp intro: infer.Enc)\nnext\n  case decr thus ?case\n    by(simp, blast intro: pairParts_in_infer[OF _ infer.Dec])\nnext\n  case tuple thus ?case by fastsimp\nqed\n\nlemma in_ossp:\n  \"(execsteps t, r, s) \\<in> ossp P\"\nproof (induct rule: reachable_induct)\n  case init thus ?case by (simp add: ossp.init)\nnext\n  case (send t r s i \"done\" l msg todo m) thus ?case\n    by(fastsimp simp del: Fun.fun_upd_apply \n                  intro!: ossp.send)\nnext\n  case (recv t r s i \"done\" l msg todo \\<alpha>)\n  then interpret this_state: reachable_state P t r s by unfold_locales\n  show ?case using recv\n    by(fastsimp simp del: Fun.fun_upd_apply \n                  intro!: ossp.recv\n                          this_state.knows_spies_execsteps)\nqed auto\n\nend\n\n\nsubsubsection{* Implicit to Explicit Traces *}\n\n\ncontext reachable_state\nbegin\n\nlemma infer_known_subset_in_knows:\n  assumes m: \"m \\<in> infer M\" \n  and M: \"M \\<subseteq> knows t\"\n  shows \"\\<exists> t'. (t@t',r,s) \\<in> reachable P \\<and> execsteps t' = [] \\<and> \n            m \\<in> knows (t@t') \\<and> (\\<forall> x \\<in> M. x \\<notin> knows t')\"\n  (is \"\\<exists> t'. ?extension t t' m\")\nusing m M reachable\nproof(induct arbitrary: t rule: infer.induct)\n  case (Inj m t)\n  hence \"?extension t [] m\" by auto\n  thus ?case by fast\nnext\n  case (Fst x y t) then\n  obtain t' where ext: \"?extension t t' \\<lbrace>x, y\\<rbrace>\" by fastsimp\n  then interpret ext_state: reachable_state P \"t@t'\" r s \n    by unfold_locales auto\n  from ext have \"?extension t t' x\"\n    by (fastsimp simp del: knows_append \n                    intro: ext_state.knows_pairParts_closedD)\n  thus ?case by fast\nnext\n  case (Snd x y t) then\n  obtain t' where ext: \"?extension t t' \\<lbrace>x, y\\<rbrace>\" by fastsimp\n  then interpret ext_state: reachable_state P \"t@t'\" r s \n    by unfold_locales auto\n  from ext have \"?extension t t' y\"\n    by (fastsimp simp del: knows_append \n                    intro: ext_state.knows_pairParts_closedD)\n  thus ?case by fast\nnext\n  case (Hash m t) then\n  obtain t' where ext: \"?extension t t' m\" by fastsimp\n  then interpret ext_state: reachable_state P \"t@t'\" r s \n    by unfold_locales auto\n  show ?case\n  proof(cases \"Hash m \\<in> knows (t@t')\")\n    case True thus ?thesis using ext by auto\n  next\n    case False\n    hence \"((t@t')@[Learns {Hash m}], r, s) \\<in> reachable P\"\n      using ext\n      by(fastsimp intro!: reachable.hash simp del: append_assoc)\n    thus ?thesis using ext and `M \\<subseteq> knows t` and False\n      by(fastsimp)\n  qed\nnext\n  case (Tup x y t)\n  then obtain t' where ext1: \"?extension t t' x\" by fastsimp\n  hence \"\\<exists> t''. ?extension (t@t') t'' y\" using Tup\n    apply-\n    apply(rule prems)\n    apply(auto)\n    done\n  then obtain t'' where ext2: \"?extension t (t'@t'') y\" \n    using ext1 by auto\n  then interpret ext_state: reachable_state P \"t@t'@t''\" r s \n    by unfold_locales auto\n  show ?case\n  proof(cases \"Tup x y \\<in> knows (t@t'@t'')\")\n    case True thus ?thesis using ext2 by auto\n  next\n    case False\n    hence \"((t@t'@t'')@[Learns {Tup x y}], r, s) \\<in> reachable P\"\n      using ext1 and ext2\n      by(fastsimp intro!: reachable.tuple simp del: append_assoc)\n    thus ?thesis using ext1 ext2 `M \\<subseteq> knows t` and False\n      by(fastsimp)\n  qed\nnext\n  case (Enc m k t)\n  then obtain t' where ext1: \"?extension t t' m\" by fastsimp\n  hence \"\\<exists> t''. ?extension (t@t') t'' k\" using Enc\n    apply-\n    apply(rule prems)\n    apply(auto)\n    done\n  then obtain t'' where ext2: \"?extension t (t'@t'') k\" \n    using ext1 by auto\n  then interpret ext_state: reachable_state P \"t@t'@t''\" r s \n    by unfold_locales auto\n  show ?case\n  proof(cases \"Enc m k \\<in> knows (t@t'@t'')\")\n    case True thus ?thesis using ext2 by auto\n  next\n    case False\n    hence \"((t@t'@t'')@[Learns {Enc m k}], r, s) \\<in> reachable P\"\n      using ext1 and ext2\n      by(fastsimp intro!: reachable.encr simp del: append_assoc)\n    thus ?thesis using ext1 ext2 `M \\<subseteq> knows t` and False\n      by(fastsimp)\n  qed\nnext\n  case (Dec m k t)\n  then obtain t' where ext1: \"?extension t t' (Enc m k)\" by fastsimp\n  hence \"\\<exists> t''. ?extension (t@t') t'' (inv k)\" using Dec\n    apply-\n    apply(rule prems)\n    apply(auto)\n    done\n  then obtain t'' where ext2: \"?extension t (t'@t'') (inv k)\" \n    using ext1 by auto\n  then interpret ext_state: reachable_state P \"t@t'@t''\" r s \n    by unfold_locales auto\n  show ?case\n  proof(cases \"m \\<in> knows (t@t'@t'')\")\n    case True thus ?thesis using ext2 by auto\n  next\n    case False\n    hence \"((t@t'@t'')@[Learns (pairParts m - knows (t@t'@t''))], r, s) \n           \\<in> reachable P\"\n      using ext1 and ext2\n      by(fastsimp intro!: reachable.decr simp del: append_assoc)\n    thus ?thesis using ext1 ext2 `M \\<subseteq> knows t` and False\n      by(fastsimp)\n  qed\nqed\n\nlemma  in_spies_imp_in_knows:\n  \"m \\<in> spies s (execsteps t) \\<Longrightarrow> m \\<in> knows t\"\nproof(induct rule: reachable_induct)\n  case (recv t r s i \"done\" l msg todo \\<alpha>)\n  then interpret this_state: reachable_state P t r s by unfold_locales\n  show ?case using recv\n    by(simp add: this_state.spies_execsteps_extendS)\nqed auto\n\nlemma in_infer_spies_imp_in_ext_knows:\n  assumes \"m \\<in> infer (spies s (execsteps t))\"\n  shows \"\\<exists> t'. execsteps t' = [] \\<and> (t@t',r,s) \\<in> reachable P \\<and> \n               m \\<in> knows (t@t')\"\nproof -\n  from `m \\<in> infer (spies s (execsteps t))`\n  obtain M \n    where \"finite M\" \n    and \"m \\<in> infer M\" \n    and \"M \\<subseteq> spies s (execsteps t)\"\n    by (blast dest: infer_finite_support)\n  hence \"M \\<subseteq> knows t\" \n    by (fast intro!: in_spies_imp_in_knows)\n  with `m \\<in> infer M`\n  obtain t' where \"(t @ t', r, s) \\<in> reachable P\" \n    and \"execsteps t' = []\"\n    and \"m \\<in> knows (t @ t')\"\n    by (fast dest!: infer_known_subset_in_knows)\n  thus ?thesis by fast\nqed\n\nlemma refine_attack_raw:\n  assumes subset: \"M \\<subseteq> infer (spies s (execsteps t))\"\n  and finite: \"finite M\"\n  shows \"\\<exists> t'. execsteps t' = [] \\<and> (t@t',r,s) \\<in> reachable P \\<and> \n               M \\<subseteq> knows (t@t')\"\n  (is \"\\<exists> t'. ?extension M t'\")\nusing finite subset\nproof(induct rule: finite.induct)\n  case emptyI\n  have \"execsteps [] = []\" by simp\n  thus ?case by fastsimp\nnext\n  case (insertI M m)\n  then obtain t' where ext1: \"?extension M t'\" by auto\n  moreover\n  then interpret s1: reachable_state P \"t@t'\" r s\n    by unfold_locales auto\n  have infer_m: \"m \\<in> infer (spies s (execsteps (t@t')))\"\n    using insertI ext1 by fastsimp\n  then obtain t'' \n    where \"execsteps t'' = []\" \n      \"(t@(t'@t''),r,s) \\<in> reachable P\"\n      \"m \\<in> knows (t@t'@t'')\"\n    using ext1 s1.in_infer_spies_imp_in_ext_knows[OF infer_m]\n    by(auto)\n  ultimately show ?case \n    apply-\n    apply(rule_tac x=\"t'@t''\" in exI)\n    by(auto)\nqed\n\nend\n\n\ncontext ossp_state\nbegin \n\n(* TODO: move *)\nlemmas ossp_induct = \n  ossp.induct[OF ossp, consumes 0, case_names init send recv]\n\nlemma in_reachable:\n  \"\\<exists> t'. t = execsteps t' \\<and> (t',r,s) \\<in> reachable P\"\n  (is \"\\<exists> t'. ?witness t r s t'\")\nproof(induct rule: ossp_induct)\n  case (init r s)\n  hence \"?witness [] r s [Learns IK0]\"\n    by(fastsimp intro!: reachable.init)\n  thus ?case by fast\nnext\n  case (send t r s i \"done\" l pt todo) then\n  obtain t' where \"?witness t r s t'\" by fast\n  hence \"?witness (t @ [(i, Send l pt)]) \n                  (r(i \\<mapsto> (done @ [Send l pt], todo))) \n                  s \n    (t'@[Step (i, Send l pt), \n         Learns (pairParts (inst s i pt) - knows t')])\"\n    using send\n    by(fastsimp intro!: reachable.send)\n  thus ?case by fast\nnext\n  case (recv t r s i \"done\" l pt todo \\<alpha>)\n  then obtain t' where \"?witness t r s t'\" by fast\n  hence \"t = execsteps t'\" and \"(t', r, s) \\<in> reachable P\" by auto\n  then interpret s1: reachable_state P t' r s by unfold_locales auto\n  let ?m = \"inst (extendS s \\<alpha>) i pt\"\n  from `?m \\<in> infer (spies s t)` and `t = execsteps t'`\n  obtain t'' where \"(t' @ t'', r, s) \\<in> reachable P\" \n    and \"execsteps t'' = []\"\n    and \"?m \\<in> knows (t' @ t'')\"\n    by (fastsimp dest!: s1.in_infer_spies_imp_in_ext_knows)\n  hence \"?witness (t @ [(i, Recv l pt)]) \n                  (r(i \\<mapsto> (done @ [Recv l pt], todo))) \n                  (extendS s \\<alpha>)\n                  ((t'@t'')@[Step (i, Recv l pt)])\"\n    using `t = execsteps t'` and recv\n    by(fastsimp intro!: reachable.recv)\n  thus ?case by fast\nqed\n\nend\n\n\nlemma (in wf_proto) ossp_conv_reachable:\n  \"ossp P = {(execsteps t,r,s) | t r s. (t,r,s) \\<in> reachable P}\"\nproof -\n  { fix t r s\n    assume \"(t,r,s) \\<in> ossp P\"\n    then interpret s1: ossp_state P t r s by unfold_locales\n    note this = s1.in_reachable\n  }\n  moreover\n  { fix t r s\n    assume \"(t,r,s) \\<in> reachable P\"\n    then interpret s2: reachable_state P t r s by unfold_locales\n    note this = s2.in_ossp\n  }\n  ultimately\n  show ?thesis by fast\nqed\n\n*)\n\n\n\nsubsection{* Reduction Rules for Security Properties *}\n\n(* TODO: Port to substitition-less explicit model \n\nlemma runs_conv_roleMap [iff]:\n  \"runs r i R = (roleMap r i = Some R)\"\nby(auto simp: runs_def roleMap_def split: option.splits)\n\nlemma (in reachable_state) in_known_kntrace_imp_in_ext_knows:\n  assumes known: \"m \\<in> known s (execsteps t)\"\n  shows \"\\<exists> t'. execsteps t' = [] \\<and> (t@t',r,s) \\<in> reachable P \\<and> \n                m \\<in> knows (t@t')\"\nusing known unfolding known_def \nby (rule in_infer_spies_imp_in_ext_knows) \n\nlemma (in ossp_state) known_in_ext_knows: \n  assumes \"m \\<in> known s t\"\n  shows \"\\<exists> t'. t = execsteps t' \\<and> (t',r,s) \\<in> reachable P \\<and> \n                m \\<in> knows t'\"\nproof -\n  from in_reachable\n  obtain t' where \"t = execsteps t'\" and \"(t',r,s) \\<in> reachable P\"\n    by fast\n  moreover\n  then interpret s1: reachable_state P t' r s \n    by unfold_locales auto\n  from `m \\<in> known s t` and `t = execsteps t'`\n  obtain t'' \n    where \"execsteps t'' = []\" \n    and \"(t'@t'',r,s) \\<in> reachable P\"\n    and \"m \\<in> knows (t'@t'')\"\n    by (fast dest!: s1.in_known_kntrace_imp_in_ext_knows)\n  moreover\n  with `t = execsteps t'`\n  have \"t = execsteps (t'@t'')\" by simp\n  ultimately\n  show ?thesis by fast\nqed\n\nlemma (in wf_proto) secretI:\n  assumes reachable_secrecy:\n    \"\\<And> t r s i. \n     \\<lbrakk> (t, r, s) \\<in> reachable P; roleMap r i = Some R; \n       \\<forall> a \\<in> H. Rep_subst s (EVar (AVar a) i) \\<notin> Compromised;\n       (i, step) \\<in> steps t;\n       inst s i msg \\<in> knows t\n     \\<rbrakk> \\<Longrightarrow> False \"\n  shows \"secret P R step H msg\"\nproof -\n  { fix t r s i\n    assume asms: \n      \"(t, r, s) \\<in> ossp P\" \n      \"runs r i R\"\n      \"\\<forall> a \\<in> H. Rep_subst s (EVar (AVar a) i) \\<notin> Compromised\"\n      \"(i,step) \\<in> set t\"\n      \"inst s i msg \\<in> known s t\" (is \"?m \\<in> known s t\")\n    moreover\n    then interpret s1: ossp_state P t r s by unfold_locales\n    obtain t' \n      where \"(t', r, s) \\<in> reachable P\" \n      and \"t = execsteps t'\"\n      and \"?m \\<in> knows t'\"\n      using asms by (fast dest!: s1.known_in_ext_knows)\n    ultimately\n    have \"False\" \n      by (fastsimp dest!: reachable_secrecy)\n  }\n  thus ?thesis by (fastsimp simp: secret_def)\nqed\n\nlemma listOrd_kntrace_conv_predOrd [iff]:\n  \"listOrd (execsteps t) (i,step) (i',step') =\n   predOrd t (St (i, step)) (St (i', step'))\"\nby (induct t rule: execsteps.induct) auto\n\n*)\n\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/data/isabelle/src/experiments/protocol_semantics/StandardModel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.3135647963972502}}
{"text": "(*  Title:      HOL/UNITY/SubstAx.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1998  University of Cambridge\n\nWeak LeadsTo relation (restricted to the set of reachable states)\n*)\n\nsection\\<open>Weak Progress\\<close>\n\ntheory SubstAx imports WFair Constrains begin\n\ndefinition Ensures :: \"['a set, 'a set] => 'a program set\" (infixl \"Ensures\" 60) where\n    \"A Ensures B == {F. F \\<in> (reachable F \\<inter> A) ensures B}\"\n\ndefinition LeadsTo :: \"['a set, 'a set] => 'a program set\" (infixl \"LeadsTo\" 60) where\n    \"A LeadsTo B == {F. F \\<in> (reachable F \\<inter> A) leadsTo B}\"\n\nnotation LeadsTo  (infixl \"\\<longmapsto>w\" 60)\n\n\ntext\\<open>Resembles the previous definition of LeadsTo\\<close>\nlemma LeadsTo_eq_leadsTo: \n     \"A LeadsTo B = {F. F \\<in> (reachable F \\<inter> A) leadsTo (reachable F \\<inter> B)}\"\napply (unfold LeadsTo_def)\napply (blast dest: psp_stable2 intro: leadsTo_weaken)\ndone\n\n\nsubsection\\<open>Specialized laws for handling invariants\\<close>\n\n(** Conjoining an Always property **)\n\nlemma Always_LeadsTo_pre:\n     \"F \\<in> Always INV ==> (F \\<in> (INV \\<inter> A) LeadsTo A') = (F \\<in> A LeadsTo A')\"\nby (simp add: LeadsTo_def Always_eq_includes_reachable Int_absorb2 \n              Int_assoc [symmetric])\n\nlemma Always_LeadsTo_post:\n     \"F \\<in> Always INV ==> (F \\<in> A LeadsTo (INV \\<inter> A')) = (F \\<in> A LeadsTo A')\"\nby (simp add: LeadsTo_eq_leadsTo Always_eq_includes_reachable Int_absorb2 \n              Int_assoc [symmetric])\n\n(* [| F \\<in> Always C;  F \\<in> (C \\<inter> A) LeadsTo A' |] ==> F \\<in> A LeadsTo A' *)\nlemmas Always_LeadsToI = Always_LeadsTo_pre [THEN iffD1]\n\n(* [| F \\<in> Always INV;  F \\<in> A LeadsTo A' |] ==> F \\<in> A LeadsTo (INV \\<inter> A') *)\nlemmas Always_LeadsToD = Always_LeadsTo_post [THEN iffD2]\n\n\nsubsection\\<open>Introduction rules: Basis, Trans, Union\\<close>\n\nlemma leadsTo_imp_LeadsTo: \"F \\<in> A leadsTo B ==> F \\<in> A LeadsTo B\"\napply (simp add: LeadsTo_def)\napply (blast intro: leadsTo_weaken_L)\ndone\n\nlemma LeadsTo_Trans:\n     \"[| F \\<in> A LeadsTo B;  F \\<in> B LeadsTo C |] ==> F \\<in> A LeadsTo C\"\napply (simp add: LeadsTo_eq_leadsTo)\napply (blast intro: leadsTo_Trans)\ndone\n\nlemma LeadsTo_Union: \n     \"(!!A. A \\<in> S ==> F \\<in> A LeadsTo B) ==> F \\<in> (\\<Union>S) LeadsTo B\"\napply (simp add: LeadsTo_def)\napply (subst Int_Union)\napply (blast intro: leadsTo_UN)\ndone\n\n\nsubsection\\<open>Derived rules\\<close>\n\nlemma LeadsTo_UNIV [simp]: \"F \\<in> A LeadsTo UNIV\"\nby (simp add: LeadsTo_def)\n\ntext\\<open>Useful with cancellation, disjunction\\<close>\nlemma LeadsTo_Un_duplicate:\n     \"F \\<in> A LeadsTo (A' \\<union> A') ==> F \\<in> A LeadsTo A'\"\nby (simp add: Un_ac)\n\nlemma LeadsTo_Un_duplicate2:\n     \"F \\<in> A LeadsTo (A' \\<union> C \\<union> C) ==> F \\<in> A LeadsTo (A' \\<union> C)\"\nby (simp add: Un_ac)\n\nlemma LeadsTo_UN: \n     \"(!!i. i \\<in> I ==> F \\<in> (A i) LeadsTo B) ==> F \\<in> (\\<Union>i \\<in> I. A i) LeadsTo B\"\napply (blast intro: LeadsTo_Union)\ndone\n\ntext\\<open>Binary union introduction rule\\<close>\nlemma LeadsTo_Un:\n     \"[| F \\<in> A LeadsTo C; F \\<in> B LeadsTo C |] ==> F \\<in> (A \\<union> B) LeadsTo C\"\n  using LeadsTo_UN [of \"{A, B}\" F id C] by auto\n\ntext\\<open>Lets us look at the starting state\\<close>\nlemma single_LeadsTo_I:\n     \"(!!s. s \\<in> A ==> F \\<in> {s} LeadsTo B) ==> F \\<in> A LeadsTo B\"\nby (subst UN_singleton [symmetric], rule LeadsTo_UN, blast)\n\nlemma subset_imp_LeadsTo: \"A \\<subseteq> B ==> F \\<in> A LeadsTo B\"\napply (simp add: LeadsTo_def)\napply (blast intro: subset_imp_leadsTo)\ndone\n\nlemmas empty_LeadsTo = empty_subsetI [THEN subset_imp_LeadsTo, simp]\n\nlemma LeadsTo_weaken_R:\n     \"[| F \\<in> A LeadsTo A';  A' \\<subseteq> B' |] ==> F \\<in> A LeadsTo B'\"\napply (simp add: LeadsTo_def)\napply (blast intro: leadsTo_weaken_R)\ndone\n\nlemma LeadsTo_weaken_L:\n     \"[| F \\<in> A LeadsTo A';  B \\<subseteq> A |]   \n      ==> F \\<in> B LeadsTo A'\"\napply (simp add: LeadsTo_def)\napply (blast intro: leadsTo_weaken_L)\ndone\n\nlemma LeadsTo_weaken:\n     \"[| F \\<in> A LeadsTo A';    \n         B  \\<subseteq> A;   A' \\<subseteq> B' |]  \n      ==> F \\<in> B LeadsTo B'\"\nby (blast intro: LeadsTo_weaken_R LeadsTo_weaken_L LeadsTo_Trans)\n\nlemma Always_LeadsTo_weaken:\n     \"[| F \\<in> Always C;  F \\<in> A LeadsTo A';    \n         C \\<inter> B \\<subseteq> A;   C \\<inter> A' \\<subseteq> B' |]  \n      ==> F \\<in> B LeadsTo B'\"\nby (blast dest: Always_LeadsToI intro: LeadsTo_weaken intro: Always_LeadsToD)\n\n(** Two theorems for \"proof lattices\" **)\n\nlemma LeadsTo_Un_post: \"F \\<in> A LeadsTo B ==> F \\<in> (A \\<union> B) LeadsTo B\"\nby (blast intro: LeadsTo_Un subset_imp_LeadsTo)\n\nlemma LeadsTo_Trans_Un:\n     \"[| F \\<in> A LeadsTo B;  F \\<in> B LeadsTo C |]  \n      ==> F \\<in> (A \\<union> B) LeadsTo C\"\nby (blast intro: LeadsTo_Un subset_imp_LeadsTo LeadsTo_weaken_L LeadsTo_Trans)\n\n\n(** Distributive laws **)\n\nlemma LeadsTo_Un_distrib:\n     \"(F \\<in> (A \\<union> B) LeadsTo C)  = (F \\<in> A LeadsTo C & F \\<in> B LeadsTo C)\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken_L)\n\nlemma LeadsTo_UN_distrib:\n     \"(F \\<in> (\\<Union>i \\<in> I. A i) LeadsTo B)  =  (\\<forall>i \\<in> I. F \\<in> (A i) LeadsTo B)\"\nby (blast intro: LeadsTo_UN LeadsTo_weaken_L)\n\nlemma LeadsTo_Union_distrib:\n     \"(F \\<in> (\\<Union>S) LeadsTo B)  =  (\\<forall>A \\<in> S. F \\<in> A LeadsTo B)\"\nby (blast intro: LeadsTo_Union LeadsTo_weaken_L)\n\n\n(** More rules using the premise \"Always INV\" **)\n\nlemma LeadsTo_Basis: \"F \\<in> A Ensures B ==> F \\<in> A LeadsTo B\"\nby (simp add: Ensures_def LeadsTo_def leadsTo_Basis)\n\nlemma EnsuresI:\n     \"[| F \\<in> (A-B) Co (A \\<union> B);  F \\<in> transient (A-B) |]    \n      ==> F \\<in> A Ensures B\"\napply (simp add: Ensures_def Constrains_eq_constrains)\napply (blast intro: ensuresI constrains_weaken transient_strengthen)\ndone\n\nlemma Always_LeadsTo_Basis:\n     \"[| F \\<in> Always INV;       \n         F \\<in> (INV \\<inter> (A-A')) Co (A \\<union> A');  \n         F \\<in> transient (INV \\<inter> (A-A')) |]    \n  ==> F \\<in> A LeadsTo A'\"\napply (rule Always_LeadsToI, assumption)\napply (blast intro: EnsuresI LeadsTo_Basis Always_ConstrainsD [THEN Constrains_weaken] transient_strengthen)\ndone\n\ntext\\<open>Set difference: maybe combine with \\<open>leadsTo_weaken_L\\<close>??\n  This is the most useful form of the \"disjunction\" rule\\<close>\nlemma LeadsTo_Diff:\n     \"[| F \\<in> (A-B) LeadsTo C;  F \\<in> (A \\<inter> B) LeadsTo C |]  \n      ==> F \\<in> A LeadsTo C\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken)\n\n\nlemma LeadsTo_UN_UN: \n     \"(!! i. i \\<in> I ==> F \\<in> (A i) LeadsTo (A' i))  \n      ==> F \\<in> (\\<Union>i \\<in> I. A i) LeadsTo (\\<Union>i \\<in> I. A' i)\"\napply (blast intro: LeadsTo_Union LeadsTo_weaken_R)\ndone\n\n\ntext\\<open>Version with no index set\\<close>\nlemma LeadsTo_UN_UN_noindex: \n     \"(!!i. F \\<in> (A i) LeadsTo (A' i)) ==> F \\<in> (\\<Union>i. A i) LeadsTo (\\<Union>i. A' i)\"\nby (blast intro: LeadsTo_UN_UN)\n\ntext\\<open>Version with no index set\\<close>\nlemma all_LeadsTo_UN_UN:\n     \"\\<forall>i. F \\<in> (A i) LeadsTo (A' i)  \n      ==> F \\<in> (\\<Union>i. A i) LeadsTo (\\<Union>i. A' i)\"\nby (blast intro: LeadsTo_UN_UN)\n\ntext\\<open>Binary union version\\<close>\nlemma LeadsTo_Un_Un:\n     \"[| F \\<in> A LeadsTo A'; F \\<in> B LeadsTo B' |]  \n            ==> F \\<in> (A \\<union> B) LeadsTo (A' \\<union> B')\"\nby (blast intro: LeadsTo_Un LeadsTo_weaken_R)\n\n\n(** The cancellation law **)\n\nlemma LeadsTo_cancel2:\n     \"[| F \\<in> A LeadsTo (A' \\<union> B); F \\<in> B LeadsTo B' |]     \n      ==> F \\<in> A LeadsTo (A' \\<union> B')\"\nby (blast intro: LeadsTo_Un_Un subset_imp_LeadsTo LeadsTo_Trans)\n\nlemma LeadsTo_cancel_Diff2:\n     \"[| F \\<in> A LeadsTo (A' \\<union> B); F \\<in> (B-A') LeadsTo B' |]  \n      ==> F \\<in> A LeadsTo (A' \\<union> B')\"\napply (rule LeadsTo_cancel2)\nprefer 2 apply assumption\napply (simp_all (no_asm_simp))\ndone\n\nlemma LeadsTo_cancel1:\n     \"[| F \\<in> A LeadsTo (B \\<union> A'); F \\<in> B LeadsTo B' |]  \n      ==> F \\<in> A LeadsTo (B' \\<union> A')\"\napply (simp add: Un_commute)\napply (blast intro!: LeadsTo_cancel2)\ndone\n\nlemma LeadsTo_cancel_Diff1:\n     \"[| F \\<in> A LeadsTo (B \\<union> A'); F \\<in> (B-A') LeadsTo B' |]  \n      ==> F \\<in> A LeadsTo (B' \\<union> A')\"\napply (rule LeadsTo_cancel1)\nprefer 2 apply assumption\napply (simp_all (no_asm_simp))\ndone\n\n\ntext\\<open>The impossibility law\\<close>\n\ntext\\<open>The set \"A\" may be non-empty, but it contains no reachable states\\<close>\nlemma LeadsTo_empty: \"[|F \\<in> A LeadsTo {}; all_total F|] ==> F \\<in> Always (-A)\"\napply (simp add: LeadsTo_def Always_eq_includes_reachable)\napply (drule leadsTo_empty, auto)\ndone\n\n\nsubsection\\<open>PSP: Progress-Safety-Progress\\<close>\n\ntext\\<open>Special case of PSP: Misra's \"stable conjunction\"\\<close>\nlemma PSP_Stable:\n     \"[| F \\<in> A LeadsTo A';  F \\<in> Stable B |]  \n      ==> F \\<in> (A \\<inter> B) LeadsTo (A' \\<inter> B)\"\napply (simp add: LeadsTo_eq_leadsTo Stable_eq_stable)\napply (drule psp_stable, assumption)\napply (simp add: Int_ac)\ndone\n\nlemma PSP_Stable2:\n     \"[| F \\<in> A LeadsTo A'; F \\<in> Stable B |]  \n      ==> F \\<in> (B \\<inter> A) LeadsTo (B \\<inter> A')\"\nby (simp add: PSP_Stable Int_ac)\n\nlemma PSP:\n     \"[| F \\<in> A LeadsTo A'; F \\<in> B Co B' |]  \n      ==> F \\<in> (A \\<inter> B') LeadsTo ((A' \\<inter> B) \\<union> (B' - B))\"\napply (simp add: LeadsTo_def Constrains_eq_constrains)\napply (blast dest: psp intro: leadsTo_weaken)\ndone\n\nlemma PSP2:\n     \"[| F \\<in> A LeadsTo A'; F \\<in> B Co B' |]  \n      ==> F \\<in> (B' \\<inter> A) LeadsTo ((B \\<inter> A') \\<union> (B' - B))\"\nby (simp add: PSP Int_ac)\n\nlemma PSP_Unless: \n     \"[| F \\<in> A LeadsTo A'; F \\<in> B Unless B' |]  \n      ==> F \\<in> (A \\<inter> B) LeadsTo ((A' \\<inter> B) \\<union> B')\"\napply (unfold Unless_def)\napply (drule PSP, assumption)\napply (blast intro: LeadsTo_Diff LeadsTo_weaken subset_imp_LeadsTo)\ndone\n\n\nlemma Stable_transient_Always_LeadsTo:\n     \"[| F \\<in> Stable A;  F \\<in> transient C;   \n         F \\<in> Always (-A \\<union> B \\<union> C) |] ==> F \\<in> A LeadsTo B\"\napply (erule Always_LeadsTo_weaken)\napply (rule LeadsTo_Diff)\n   prefer 2\n   apply (erule\n          transient_imp_leadsTo [THEN leadsTo_imp_LeadsTo, THEN PSP_Stable2])\n   apply (blast intro: subset_imp_LeadsTo)+\ndone\n\n\nsubsection\\<open>Induction rules\\<close>\n\n(** Meta or object quantifier ????? **)\nlemma LeadsTo_wf_induct:\n     \"[| wf r;      \n         \\<forall>m. F \\<in> (A \\<inter> f-`{m}) LeadsTo                      \n                    ((A \\<inter> f-`(r\\<inverse> `` {m})) \\<union> B) |]  \n      ==> F \\<in> A LeadsTo B\"\napply (simp add: LeadsTo_eq_leadsTo)\napply (erule leadsTo_wf_induct)\napply (blast intro: leadsTo_weaken)\ndone\n\n\nlemma Bounded_induct:\n     \"[| wf r;      \n         \\<forall>m \\<in> I. F \\<in> (A \\<inter> f-`{m}) LeadsTo                    \n                      ((A \\<inter> f-`(r\\<inverse> `` {m})) \\<union> B) |]  \n      ==> F \\<in> A LeadsTo ((A - (f-`I)) \\<union> B)\"\napply (erule LeadsTo_wf_induct, safe)\napply (case_tac \"m \\<in> I\")\napply (blast intro: LeadsTo_weaken)\napply (blast intro: subset_imp_LeadsTo)\ndone\n\n\nlemma LessThan_induct:\n     \"(!!m::nat. F \\<in> (A \\<inter> f-`{m}) LeadsTo ((A \\<inter> f-`(lessThan m)) \\<union> B))\n      ==> F \\<in> A LeadsTo B\"\nby (rule wf_less_than [THEN LeadsTo_wf_induct], auto)\n\ntext\\<open>Integer version.  Could generalize from 0 to any lower bound\\<close>\nlemma integ_0_le_induct:\n     \"[| F \\<in> Always {s. (0::int) \\<le> f s};   \n         !! z. F \\<in> (A \\<inter> {s. f s = z}) LeadsTo                      \n                   ((A \\<inter> {s. f s < z}) \\<union> B) |]  \n      ==> F \\<in> A LeadsTo B\"\napply (rule_tac f = \"nat o f\" in LessThan_induct)\napply (simp add: vimage_def)\napply (rule Always_LeadsTo_weaken, assumption+)\napply (auto simp add: nat_eq_iff nat_less_iff)\ndone\n\nlemma LessThan_bounded_induct:\n     \"!!l::nat. \\<forall>m \\<in> greaterThan l. \n                   F \\<in> (A \\<inter> f-`{m}) LeadsTo ((A \\<inter> f-`(lessThan m)) \\<union> B)\n            ==> F \\<in> A LeadsTo ((A \\<inter> (f-`(atMost l))) \\<union> B)\"\napply (simp only: Diff_eq [symmetric] vimage_Compl \n                  Compl_greaterThan [symmetric])\napply (rule wf_less_than [THEN Bounded_induct], simp)\ndone\n\nlemma GreaterThan_bounded_induct:\n     \"!!l::nat. \\<forall>m \\<in> lessThan l. \n                 F \\<in> (A \\<inter> f-`{m}) LeadsTo ((A \\<inter> f-`(greaterThan m)) \\<union> B)\n      ==> F \\<in> A LeadsTo ((A \\<inter> (f-`(atLeast l))) \\<union> B)\"\napply (rule_tac f = f and f1 = \"%k. l - k\" \n       in wf_less_than [THEN wf_inv_image, THEN LeadsTo_wf_induct])\napply (simp add: Image_singleton, clarify)\napply (case_tac \"m<l\")\n apply (blast intro: LeadsTo_weaken_R diff_less_mono2)\napply (blast intro: not_le_imp_less subset_imp_LeadsTo)\ndone\n\n\nsubsection\\<open>Completion: Binary and General Finite versions\\<close>\n\nlemma Completion:\n     \"[| F \\<in> A LeadsTo (A' \\<union> C);  F \\<in> A' Co (A' \\<union> C);  \n         F \\<in> B LeadsTo (B' \\<union> C);  F \\<in> B' Co (B' \\<union> C) |]  \n      ==> F \\<in> (A \\<inter> B) LeadsTo ((A' \\<inter> B') \\<union> C)\"\napply (simp add: LeadsTo_eq_leadsTo Constrains_eq_constrains Int_Un_distrib)\napply (blast intro: completion leadsTo_weaken)\ndone\n\nlemma Finite_completion_lemma:\n     \"finite I  \n      ==> (\\<forall>i \\<in> I. F \\<in> (A i) LeadsTo (A' i \\<union> C)) -->   \n          (\\<forall>i \\<in> I. F \\<in> (A' i) Co (A' i \\<union> C)) -->  \n          F \\<in> (\\<Inter>i \\<in> I. A i) LeadsTo ((\\<Inter>i \\<in> I. A' i) \\<union> C)\"\napply (erule finite_induct, auto)\napply (rule Completion)\n   prefer 4\n   apply (simp only: INT_simps [symmetric])\n   apply (rule Constrains_INT, auto)\ndone\n\nlemma Finite_completion: \n     \"[| finite I;   \n         !!i. i \\<in> I ==> F \\<in> (A i) LeadsTo (A' i \\<union> C);  \n         !!i. i \\<in> I ==> F \\<in> (A' i) Co (A' i \\<union> C) |]    \n      ==> F \\<in> (\\<Inter>i \\<in> I. A i) LeadsTo ((\\<Inter>i \\<in> I. A' i) \\<union> C)\"\nby (blast intro: Finite_completion_lemma [THEN mp, THEN mp])\n\nlemma Stable_completion: \n     \"[| F \\<in> A LeadsTo A';  F \\<in> Stable A';    \n         F \\<in> B LeadsTo B';  F \\<in> Stable B' |]  \n      ==> F \\<in> (A \\<inter> B) LeadsTo (A' \\<inter> B')\"\napply (unfold Stable_def)\napply (rule_tac C1 = \"{}\" in Completion [THEN LeadsTo_weaken_R])\napply (force+)\ndone\n\nlemma Finite_stable_completion: \n     \"[| finite I;   \n         !!i. i \\<in> I ==> F \\<in> (A i) LeadsTo (A' i);  \n         !!i. i \\<in> I ==> F \\<in> Stable (A' i) |]    \n      ==> F \\<in> (\\<Inter>i \\<in> I. A i) LeadsTo (\\<Inter>i \\<in> I. A' i)\"\napply (unfold Stable_def)\napply (rule_tac C1 = \"{}\" in Finite_completion [THEN LeadsTo_weaken_R])\napply (simp_all, blast+)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/UNITY/SubstAx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.31350103785664585}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Cong_Pres\n  imports Weak_Late_Cong Weak_Late_Step_Sim_Pres Weak_Late_Bisim_Pres\nbegin\n\nlemma tauPres:\n  fixes P :: pi\n  and   Q :: pi\n  \n  assumes \"P \\<simeq> Q\"\n\n  shows \"\\<tau>.(P) \\<simeq> \\<tau>.(Q)\"\nusing assms\nby(blast intro: unfoldI Weak_Late_Step_Sim_Pres.tauPres dest: congruenceWeakBisim symetric)\n\nlemma outputPres:\n  fixes P :: pi\n  and   Q :: pi\n  \n  assumes \"P \\<simeq> Q\"\n\n  shows \"a{b}.P \\<simeq> a{b}.Q\"\nusing assms\nby(blast intro: unfoldI Weak_Late_Step_Sim_Pres.outputPres dest: congruenceWeakBisim symetric)\n\nlemma inputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   x :: name\n\n  assumes PSimQ: \"\\<forall>y. P[x::=y] \\<simeq> Q[x::=y]\"\n  \n  shows \"a<x>.P \\<simeq> a<x>.Q\"\nusing assms\napply(rule_tac unfoldI)\napply(rule_tac Weak_Late_Step_Sim_Pres.inputPres, auto intro: congruenceWeakBisim)\nby(rule_tac Weak_Late_Step_Sim_Pres.inputPres, auto intro: congruenceWeakBisim Weak_Late_Bisim.symmetric)\n\n\n\n  assumes \"P \\<simeq> Q\"\n\n  shows \"[a\\<frown>b]P \\<simeq> [a\\<frown>b]Q\"\nusing assms\nby(blast intro: unfoldI Weak_Late_Step_Sim_Pres.matchPres dest: unfoldE symetric)\n\nlemma mismatchPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<simeq> Q\"\n\n  shows \"[a\\<noteq>b]P \\<simeq> [a\\<noteq>b]Q\"\nusing assms\nby(blast intro: unfoldI Weak_Late_Step_Sim_Pres.mismatchPres dest: unfoldE symetric)\n\nlemma sumPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes \"P \\<simeq> Q\"\n\n  shows \"P \\<oplus> R \\<simeq> Q \\<oplus> R\"\nusing assms\nby(blast intro: Weak_Late_Bisim.reflexive unfoldI Weak_Late_Step_Sim_Pres.sumPres dest: unfoldE symetric)\n\nlemma parPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes \"P \\<simeq> Q\"\n\n  shows \"P \\<parallel> R \\<simeq> Q \\<parallel> R\"\nproof -\n  have \"\\<And>P Q R. \\<lbrakk>P \\<leadsto><weakBisim> Q; P \\<approx> Q\\<rbrakk> \\<Longrightarrow> P \\<parallel> R \\<leadsto><weakBisim> Q \\<parallel> R\"\n  proof -\n    fix P Q R\n    assume \"P \\<leadsto><weakBisim> Q\" and \"P \\<approx> Q\"\n    thus \"P \\<parallel> R \\<leadsto><weakBisim> Q \\<parallel> R\"\n      using Weak_Late_Bisim_Pres.parPres Weak_Late_Bisim_Pres.resPres Weak_Late_Bisim.reflexive Weak_Late_Bisim.eqvt\n      by(blast intro: Weak_Late_Step_Sim_Pres.parPres)\n  qed\n  with assms show ?thesis\n    by(blast intro: unfoldI dest: congruenceWeakBisim unfoldE symetric)\nqed\n\n\n\n  assumes PeqQ: \"P \\<simeq> Q\"\n  \n  shows \"<\\<nu>x>P \\<simeq> <\\<nu>x>Q\"\nproof -\n  have \"\\<And>P Q x. P \\<leadsto><weakBisim> Q \\<Longrightarrow> <\\<nu>x>P \\<leadsto><weakBisim> <\\<nu>x>Q\"\n  proof -\n    fix P Q x\n    assume \"P \\<leadsto><weakBisim> Q\"\n    with Weak_Late_Bisim.eqvt Weak_Late_Bisim_Pres.resPres show \"<\\<nu>x>P \\<leadsto><weakBisim> <\\<nu>x>Q\"\n      by(blast intro: Weak_Late_Step_Sim_Pres.resPres)\n  qed\n  with assms show ?thesis\n    by(blast intro: unfoldI dest: congruenceWeakBisim unfoldE symetric)\nqed\n\nlemma congruenceBang:\n  fixes P :: pi\n  and   Q :: pi\n  \n  assumes \"P \\<simeq> Q\"\n\n  shows \"!P \\<simeq> !Q\"\nproof -\n  have \"\\<And>P Q. \\<lbrakk>P \\<leadsto><weakBisim> Q; P \\<simeq> Q\\<rbrakk> \\<Longrightarrow> !P \\<leadsto><weakBisim> !Q\"\n  proof -\n    fix P Q\n    assume \"P \\<leadsto><weakBisim> Q\" and \"P \\<simeq> Q\"\n    hence \"!P \\<leadsto><bangRel weakBisim> !Q\" using unfoldE(1) congruenceWeakBisim Weak_Late_Bisim.eqvt \n      by(rule Weak_Late_Step_Sim_Pres.bangPres)\n    moreover have \"bangRel weakBisim \\<subseteq> weakBisim\"\n      proof auto\n        fix a b\n        assume \"(a, b) \\<in> bangRel weakBisim\"\n        thus   \"a \\<approx> b\"\n          apply(induct rule: bangRel.induct)\n          apply (metis Weak_Late_Bisim_Pres.bangPres)\n          apply (metis Weak_Late_Bisim.reflexive Weak_Late_Bisim.symmetric Weak_Late_Bisim.transitive Weak_Late_Bisim_Pres.parPres Weak_Late_Bisim_SC.parSym)\n          by (metis Weak_Late_Bisim_Pres.resPres)\n      qed\n    ultimately show\"!P \\<leadsto><weakBisim> !Q\" \n      by(rule Weak_Late_Step_Sim.monotonic)\n  qed\n\n  with assms show ?thesis\n    by(blast intro: unfoldI dest: unfoldE symetric congruenceWeakBisim)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Late_Cong_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.31350102996167467}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory spec_annotated_fn\nimports \"../CTranslation\"\nbegin\n\ndeclare sep_conj_ac [simp add]\n\ninstall_C_file \"spec_annotated_fn.c\"\n\n\nprint_locale spec_annotated_fn\nprint_locale Square_spec\n\nthm Square_spec_def\n\ncontext spec_annotated_fn\nbegin\n\nthm Square_body_def\nthm Square_impl\nthm Square_spec_def\nthm \\<Gamma>_def\nthm f_spec_def\nthm f_body_def\n\nend\n\nlemma (in Square_spec) foo:\n  shows \"\\<Gamma> \\<turnstile> \\<lbrace> T \\<rbrace> \\<acute>ret__unsigned :== CALL Square(4) \\<lbrace> \\<acute>ret__unsigned = 16 \\<rbrace> \"\napply vcg\napply simp\ndone\n\nlemma (in spec_annotated_fn)\nshows \"\\<forall>n. \\<Gamma> \\<turnstile> \\<lbrace> \\<acute>n = n \\<rbrace> \\<acute>ret__unsigned :== PROC Square(\\<acute>n)\n               \\<lbrace>\\<acute>ret__unsigned = n * n \\<rbrace>\"\napply vcg\ndone\n\nlemma (in spec_annotated_fn)\nshows \"\\<forall>n. \\<Gamma> \\<turnstile> \\<lbrace> \\<acute>n = n \\<rbrace> \\<acute>ret__unsigned :== PROC f(\\<acute>n) \\<lbrace> \\<acute>ret__unsigned = n * n \\<rbrace>\"\napply vcg\napply clarsimp\napply (simp add: mex_def meq_def)\ndone\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/c-parser/testfiles/spec_annotated_fn.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5774953651858117, "lm_q1q2_score": 0.3135010299616746}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   June 2005 (modified)    |\n            |                 August 2005 (modified)    |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_domain\nimports CSP_T_traces CSP_F_failures\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*********************************************************\n                        domF\n *********************************************************)\n\n(*--------------------------------*\n |             STOP               |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma STOP_T2 : \"HC_T2 (traces(STOP) (fstF o M), failures(STOP) M)\"\nby (simp add: HC_T2_def in_traces in_failures)\n\n(* F3 *)\n\nlemma STOP_F3 : \"HC_F3 (traces(STOP) (fstF o M), failures(STOP) M)\"\nby (simp add: HC_F3_def in_traces in_failures)\n\n(* T3_F4 *)\n\nlemma STOP_T3_F4 : \"HC_T3_F4 (traces(STOP) (fstF o M), failures(STOP) M)\"\nby (auto simp add: HC_T3_F4_def in_traces in_failures)\n\n(*** STOP_domF ***)\n\nlemma STOP_domF : \"(traces(STOP) (fstF o M), failures(STOP) M) : domF\"\napply (simp add: domF_iff)\napply (simp add: STOP_T2)\napply (simp add: STOP_F3)\napply (simp add: STOP_T3_F4)\ndone\n\n(*--------------------------------*\n |             SKIP               |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma SKIP_T2 : \"HC_T2 (traces(SKIP) (fstF o M), failures(SKIP) M)\"\nby (simp add: HC_T2_def in_traces in_failures)\n\n(* F3 *)\n\nlemma SKIP_F3 : \"HC_F3 (traces(SKIP) (fstF o M), failures(SKIP) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\nby (auto simp add: Evset_def)\n\n(* T3_F4 *)\n\nlemma SKIP_T3_F4 : \"HC_T3_F4 (traces(SKIP) (fstF o M), failures(SKIP) M)\"\nby (auto simp add: HC_T3_F4_def in_traces in_failures)\n\n(*** SKIP_domF ***)\n\nlemma SKIP_domF : \"(traces(SKIP) (fstF o M), failures(SKIP) M) : domF\"\napply (simp add: domF_iff)\napply (simp add: SKIP_T2)\napply (simp add: SKIP_F3)\napply (simp add: SKIP_T3_F4)\ndone\n\n(*--------------------------------*\n |              DIV               |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma DIV_T2 : \"HC_T2 (traces(DIV) (fstF o M), failures(DIV) M)\"\nby (simp add: HC_T2_def in_traces in_failures)\n\n(* F3 *)\n\nlemma DIV_F3 : \"HC_F3 (traces(DIV) (fstF o M), failures(DIV) M)\"\nby (simp add: HC_F3_def in_traces in_failures)\n\n(* T3_F4 *)\n\nlemma DIV_T3_F4 : \"HC_T3_F4 (traces(DIV) (fstF o M), failures(DIV) M)\"\nby (auto simp add: HC_T3_F4_def in_traces in_failures)\n\n(*** DIV_domF ***)\n\nlemma DIV_domF : \"(traces(DIV) (fstF o M), failures(DIV) M) : domF\"\napply (simp add: domF_iff)\napply (simp add: DIV_T2)\napply (simp add: DIV_F3)\napply (simp add: DIV_T3_F4)\ndone\n\n(*--------------------------------*\n |          Act_prefix            |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma Act_prefix_T2 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n    ==> HC_T2 (traces(a -> P) (fstF o M), failures(a -> P) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE, simp)\n\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\nby (force)\n\n(* F3 *)\n\nlemma Act_prefix_F3 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n    ==> HC_F3 (traces(a -> P) (fstF o M), failures(a -> P) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\n\napply (elim conjE disjE, simp)\napply (case_tac \"Ev a ~: Y\", simp)  (* show \"Ev a : Y --> contradict\" *)\napply (drule_tac x=\"Ev a\" in spec, simp)\napply (drule_tac x=\"<>\" in spec, simp)\n\napply (elim conjE exE, simp)\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"Y\" in spec)\napply (simp)\n\napply (drule mp)\n apply (intro allI impI)\n apply (drule_tac x=\"aa\" in spec, simp)\n apply (drule_tac x=\"sa ^^^ <aa>\" in spec)\napply (simp add: appt_assoc)\nby (simp)\n\n(* T3_F4 *)\n\nlemma Act_prefix_T3_F4 : \n  \"(traces(P) (fstF o M), failures(P) M) : domF\n    ==> HC_T3_F4 (traces(a -> P) (fstF o M), failures(a -> P) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (insert trace_nil_or_Tick_or_Ev)\napply (drule_tac x=\"s\" in spec)\n\napply (erule disjE, simp)   (* s ^^^ <Tick> = <> --> contradict *)\napply (erule disjE, simp)   (* s = <> --> contradict *)\napply (erule disjE, simp)   (* s = <Tick> --> contradict *)\n\napply (elim conjE exE)      (* s = [Ev a]t ^^^ sb *)\n\napply (simp add: domF_iff HC_T3_F4_def)\napply (elim conjE exE)\napply (drule_tac x=\"sb\" in spec)\napply (simp add: appt_assoc)\ndone\n\n(*** Act_prefix_domF ***)\n\nlemma Act_prefix_domF : \n  \"(traces(P) (fstF o M), failures(P) M) : domF\n    ==> (traces(a -> P) (fstF o M), failures(a -> P) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Act_prefix_T2)\napply (simp add: Act_prefix_F3)\napply (simp add: Act_prefix_T3_F4)\ndone\n\n(*--------------------------------*\n |        Ext_pre_choice          |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma Ext_pre_choice_T2 :\n  \"ALL a. (traces(Pf a) (fstF o M), failures(Pf a) M) : domF\n     ==> HC_T2 (traces(? :X -> Pf) (fstF o M), failures(? :X -> Pf) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE, simp)\n\napply (drule_tac x=\"a\" in spec)\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\nby (force)\n\n(* F3 *)\n\nlemma Ext_pre_choice_F3 :\n  \"ALL a. (traces(Pf a) (fstF o M), failures(Pf a) M) : domF\n     ==> HC_F3 (traces(? :X -> Pf) (fstF o M), failures(? :X -> Pf) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\n\napply (elim conjE disjE, simp)\n\n(* s = <> *)\napply (case_tac \"EX a. Ev a :Ev ` X Int (Xa Un Y)\")  (* show contradiction\" *)\n apply (elim conjE exE)\n apply (drule_tac x=\"Ev a\" in spec)\n apply (drule mp)\n  apply (simp)                      (* show \"Ev a : Y\" *)\n  apply (elim conjE disjE)\n  apply (fast)                      (* contradict *)\n  apply (simp)\n\n apply (drule_tac x=\"a\" in spec)\n apply (drule_tac x=\"a\" in spec)\n apply (simp)\n apply (drule_tac x=\"s\" in spec)\n apply (simp)\n apply (fast)                      (* contradict *)\napply (fast)                       (* Ev ` X Int (Xa Un Y) = {} *)\n\n(* s ~= <> *)\napply (elim conjE exE, simp)\napply (drule_tac x=\"a\" in spec)\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"Xa\" in spec)\napply (drule_tac x=\"Y\" in spec)\napply (simp)\n\napply (drule mp)\n apply (intro allI impI)\n apply (drule_tac x=\"aa\" in spec, simp)\n apply (drule_tac x=\"a\" in spec)\n apply (drule_tac x=\"sa ^^^ <aa>\" in spec)\n apply (simp add: appt_assoc)\nby (simp)\n\n(* T3_F4 *)\n\nlemma Ext_pre_choice_T3_F4 : \n  \"ALL a. (traces(Pf a) (fstF o M), failures(Pf a) M) : domF\n     ==> HC_T3_F4 (traces(? :X -> Pf) (fstF o M), failures(? :X -> Pf) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (insert trace_nil_or_Tick_or_Ev)\napply (drule_tac x=\"s\" in spec)\n\napply (erule disjE, simp)   (* contradict *)\napply (erule disjE, simp)   (* s = <> --> contradict *)\napply (erule disjE, simp)   (* s = <Tick> --> contradict *)\n\napply (elim conjE exE)      (* s = [Ev aa]t ^^^ sb *)\napply (drule_tac x=\"a\" in spec)\napply (simp add: domF_iff HC_T3_F4_def)\napply (elim conjE exE)\napply (drule_tac x=\"sb\" in spec)\napply (simp add: appt_assoc)\ndone\n\n(*** Ext_pre_choice_domF ***)\n\nlemma Ext_pre_choice_domF : \n  \"ALL a. (traces(Pf a) (fstF o M), failures(Pf a) M) : domF\n     ==> (traces(? :X -> Pf) (fstF o M), failures(? :X -> Pf) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Ext_pre_choice_T2)\napply (simp add: Ext_pre_choice_F3)\napply (simp add: Ext_pre_choice_T3_F4)\ndone\n\n(*--------------------------------*\n |          Ext_choice            |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma Ext_choice_T2 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T2 (traces(P [+] Q) (fstF o M), failures(P [+] Q) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\n\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"s\" in spec)\nby (fast)\n\n(* F3 *)\n\nlemma Ext_choice_F3 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_F3 (traces(P [+] Q) (fstF o M), failures(P [+] Q) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\n\napply (elim conjE disjE)\napply (simp_all add: domF_def HC_F3_def)\nby (auto simp add: Evset_def)\n\n(* T3_F4 *)\n\nlemma Ext_choice_T3_F4 : \n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T3_F4 (traces(P [+] Q) (fstF o M), failures(P [+] Q) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\n\napply (simp add: domF_iff HC_T3_F4_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"s\" in spec)\nby (auto)\n\n(*** Ext_choice_domF ***)\n\nlemma Ext_choice_domF : \n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> (traces(P [+] Q) (fstF o M), failures(P [+] Q) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Ext_choice_T2)\napply (simp add: Ext_choice_F3)\napply (simp add: Ext_choice_T3_F4)\ndone\n\n(*--------------------------------*\n |          Int_choice            |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma Int_choice_T2 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T2 (traces(P |~| Q) (fstF o M), failures(P |~| Q) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (simp add: domF_def HC_T2_def)\nby (auto)\n\n(* F3 *)\n\nlemma Int_choice_F3 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_F3 (traces(P |~| Q) (fstF o M), failures(P |~| Q) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (simp add: domF_def HC_F3_def)\nby (auto)\n\n(* T3_F4 *)\n\nlemma Int_choice_T3_F4 : \n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T3_F4 (traces(P |~| Q) (fstF o M), failures(P |~| Q) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (simp add: domF_iff HC_T3_F4_def)\nby (auto)\n\n(*** Int_choice_domF ***)\n\nlemma Int_choice_domF : \n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> (traces(P |~| Q) (fstF o M), failures(P |~| Q) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Int_choice_T2)\napply (simp add: Int_choice_F3)\napply (simp add: Int_choice_T3_F4)\ndone\n\n(*--------------------------------*\n |        Rep_int_choice          |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma Union_proc_T2:\n  \"ALL c. (Tf c, Ff c) : domF\n   ==> HC_T2 ({t. t = <> | (EX c:C. t :t Tf c)}t,\n                         {f. EX c:C. f :f Ff c}f)\"\napply (simp add: HC_T2_def)\napply (simp add: in_traces)\napply (simp add: in_failures)\napply (intro allI impI)\napply (elim conjE bexE exE)\napply (rule disjI2)\napply (drule_tac x=\"c\" in spec)\napply (rule_tac x=\"c\" in bexI)\napply (simp add: domF_def HC_T2_def)\nby (auto)\n\nlemma Rep_int_choice_T2 :\n  \"ALL c. (traces(Pf c) (fstF o M), failures(Pf c) M) : domF\n     ==> HC_T2 (traces(!! :C .. Pf) (fstF o M), failures(!! :C .. Pf) M)\"\napply (simp add: traces_iff failures_iff)\napply (simp add: Union_proc_T2)\ndone\n\n(* F3 *)\n\nlemma Union_proc_F3:\n  \"ALL c. (Tf c, Ff c) : domF\n   ==>\n   HC_F3 ({t. t = <> | (EX c:C. t :t Tf c)}t,\n          {f. EX c:C. f :f Ff c}f)\"\napply (simp add: HC_F3_def)\napply (simp add: in_traces)\napply (simp add: in_failures)\napply (intro allI)\napply (intro impI)\napply (elim conjE bexE)\napply (rule_tac x=\"c\" in bexI)\napply (drule_tac x=\"c\" in spec)\napply (rule domF_F3)\napply (auto)\ndone\n\nlemma Rep_int_choice_nat : \n  \"ALL c. (traces(Pf c) (fstF o M), failures(Pf c) M) : domF\n     ==> HC_F3 (traces(!! :C .. Pf) (fstF o M), failures(!! :C .. Pf) M)\"\napply (simp add: traces_iff failures_iff)\napply (simp add: Union_proc_F3)\ndone\n\n(* T3_F4 *)\n\nlemma Union_proc_T3_F4:\n  \"ALL c. (Tf c, Ff c) : domF\n   ==>\n   HC_T3_F4 ({t. t = <> | (EX c:C. t :t Tf c)}t,\n             {f. EX c:C. f :f Ff c}f)\"\napply (simp add: HC_T3_F4_def)\napply (simp add: in_traces)\napply (simp add: in_failures)\napply (auto)\napply (rule_tac x=\"c\" in bexI)\napply (rule domF_F4)\napply (simp_all)\napply (rule_tac x=\"c\" in bexI)\napply (rule domF_T3)\napply (simp_all)\ndone\n\nlemma Rep_int_choice_T3_F4 : \n  \"ALL c. (traces(Pf c) (fstF o M), failures(Pf c) M) : domF\n     ==> HC_T3_F4 (traces(!! :C .. Pf) (fstF o M),\n                   failures(!! :C .. Pf) M)\"\napply (simp add: traces_iff failures_iff)\napply (simp add: Union_proc_T3_F4)\ndone\n\n(*** F ***)\n\nlemma Union_proc_domF:\n  \"ALL c. (Tf c, Ff c) : domF\n   ==> ({t. t = <> | (EX c:C. t :t Tf c)}t,\n        {f. EX c:C. f :f Ff c}f) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Union_proc_T2)\napply (simp add: Union_proc_F3)\napply (simp add: Union_proc_T3_F4)\ndone\n\n(*** Rep_int_choice_domF ***)\n\nlemma Rep_int_choice_domF : \n  \"ALL c. (traces(Pf c) (fstF o M), failures(Pf c) M) : domF\n     ==> (traces(!! :C .. Pf) (fstF o M), failures(!! :C .. Pf) M) : domF\"\napply (simp add: traces_iff failures_iff)\napply (simp add: Union_proc_domF)\ndone\n\n(*--------------------------------*\n |               IF               |\n *--------------------------------*)\n\n(* T2 *)\n\nlemma IF_T2 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ;\n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T2 (traces(IF b THEN P ELSE Q) (fstF o M), \n                failures(IF b THEN P ELSE Q) M)\"\nby (simp add: HC_T2_def in_traces in_failures domF_def)\n\n(* F3 *)\n\nlemma IF_F3 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ;\n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_F3 (traces(IF b THEN P ELSE Q) (fstF o M), failures(IF b THEN P ELSE Q) M)\"\nby (simp add: HC_F3_def in_traces in_failures domF_def)\n\n(* T3_F4 *)\n\nlemma IF_T3_F4 : \n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ;\n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T3_F4 (traces(IF b THEN P ELSE Q) (fstF o M), \n                   failures(IF b THEN P ELSE Q) M)\"\nby (simp add: HC_T3_F4_def in_traces in_failures domF_iff)\n\n(*** IF_domF ***)\n\nlemma IF_domF :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ;\n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> (traces(IF b THEN P ELSE Q) (fstF o M), \n          failures(IF b THEN P ELSE Q) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: IF_T2)\napply (simp add: IF_F3)\napply (simp add: IF_T3_F4)\ndone\n\n(*--------------------------------*\n |           Parallel             |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Parallel_T2 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T2 (traces(P |[X]| Q) (fstF o M), failures(P |[X]| Q) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI)\napply (rule_tac x=\"t\" in exI)\napply (simp)\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"t\" in spec)\n\napply (drule mp, rule_tac x=\"Y\" in exI, simp)\napply (drule mp, rule_tac x=\"Z\" in exI, simp)\nby (simp)\n\n(*** F3 ***)\n\nlemma Parallel_F3_lm1: \"X1 Un (X2 Un X3) - X = (X1 - X) Un (X2 - X) Un (X3 - X)\"\nby (auto)\n\nlemma Parallel_F3_lm2: \"[| X1 = X2 ; Y1 = Y2 |] ==> X1 Un Y1 = X2 Un Y2\"\nby (auto)\n\nlemma Parallel_F3 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_F3 (traces(P |[X]| Q) (fstF o M), failures(P |[X]| Q) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rename_tac u X12 Y X1 X2 s t)\n\n(* (u, X12) :f [[P |[X]| Q]]F *)\n(* (s, X1)  :f [[P]]F         *)\n(* (t, X2)  :f [[Q]]F         *)\n(*  X12 = X1 Un X2               *)\n\napply (rule_tac x=\n        \"X1 Un\n         ({a. a : Y & (a = Tick | a : Ev ` X) & s ^^^ <a> ~:t traces(P) (fstF o M)} Un\n          {a. a : Y & a ~= Tick & a ~: Ev ` X})\" in exI)       (* Z1 *)\napply (rule_tac x=\n        \"X2 Un\n         ({a. a : Y & (a = Tick | a : Ev ` X) & t ^^^ <a> ~:t traces(Q) (fstF o M)} Un\n          {a. a : Y & a ~= Tick & a ~: Ev ` X})\" in exI)       (* Z2 *)\n\napply (subgoal_tac \"noTick s & noTick t\", simp)\napply (rule conjI)\n\n(* show X12 Un Y = X1 Un Z1 Un Z2 *)\napply (rule equalityI)\n\n (* <= *)\n apply (rule subsetI, simp)\n apply (erule disjE, simp)\n apply (erule disjE, simp)\n apply (simp)\n\n apply (drule_tac x=\"x\" in spec, simp)\n apply (drule_tac x=\"s ^^^ <x>\" in spec)\n apply (drule_tac x=\"t ^^^ <x>\" in spec)\n\n  (* no sync *)\n  apply (case_tac \"x ~= Tick & x ~: Ev ` X\", simp)\n  (* sync *)\n  apply (simp add: par_tr_last)\n  apply (erule disjE, simp)\n  apply (force)\n\n  apply (rotate_tac -2)\n  apply (erule disjE, simp)\n  apply (force)\n  apply (simp)\n  apply (force)\n\n (* => *)\n apply (force)\n\napply (rule conjI)\n\n (* show X1 Un ... = X2 Un ... *)\n apply (simp add: Parallel_F3_lm1)\n apply (rule Parallel_F3_lm2)\n apply (rule Parallel_F3_lm2)\n apply (simp)\n apply (force)\n apply (simp)\n\n (* condition 2 *)\n apply (rule_tac x=\"s\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n apply (simp add: domF_def HC_F3_def)\n apply (elim conjE)\n apply (drule_tac x=\"s\" in spec)\n apply (drule_tac x=\"t\" in spec)\n apply (drule_tac x=\"X1\" in spec)\n apply (drule_tac x=\"X2\" in spec)\n apply (drule_tac x=\n   \"{a. a : Y & (a = Tick | a : Ev ` X) & s ^^^ <a> ~:t traces(P) (fstF o M)} Un\n    {a. a : Y & a ~= Tick & a ~: Ev ` X}\" in spec)\n apply (drule_tac x=\n   \"{a. a : Y & (a = Tick | a : Ev ` X) & t ^^^ <a> ~:t traces(Q) (fstF o M)} Un\n    {a. a : Y & a ~= Tick & a ~: Ev ` X}\" in spec)\n apply (simp)\n\n (* left *)\n apply (drule mp)\n  apply (intro allI impI)\n  apply (drule_tac x=\"a\" in spec, simp)\n  apply (drule_tac x=\"s ^^^ <a>\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (erule disjE)\n  apply (simp add: par_tr_last)\n  apply (fast)\n\n  apply (erule disjE, simp)\n  apply (simp add: HC_T2_def)\n  apply (drule_tac x=\"s\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (force)\n\n (* right *)\n apply (drule mp)\n  apply (intro allI impI)\n  apply (drule_tac x=\"a\" in spec, simp)\n  apply (drule_tac x=\"s\" in spec)\n  apply (drule_tac x=\"t ^^^ <a>\" in spec)\n  apply (erule disjE)\n  apply (simp add: par_tr_last)\n  apply (fast)\n\n  apply (erule disjE)\n  apply (simp add: HC_T2_def)\n  apply (drule_tac x=\"s\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (force)\n  apply (simp)\n apply (simp)\n\n(* notick s & notick t *)\napply (simp add: par_tr_noTick_decompo)\ndone\n\n(* T3_F4 *)\n\nlemma Parallel_T3_F4 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T3_F4 (traces(P |[X]| Q) (fstF o M), failures(P |[X]| Q) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (simp add: par_tr_last)\napply (elim conjE exE)\napply (rule conjI)\n\n (* F4 *)\n apply (rule_tac x=\"Evset\" in exI)\n apply (rule_tac x=\"Evset\" in exI)\n apply (simp)\n apply (rule_tac x=\"s'\" in exI)\n apply (rule_tac x=\"t'\" in exI)\n apply (simp add: domF_def HC_F4_def)\n\n (* T3 *)\n apply (rule allI)\n apply (rule_tac x=\"Xa\" in exI)\n apply (rule_tac x=\"Xa\" in exI)\n apply (simp)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: domF_def HC_T3_def)\n apply (fast)\ndone\n\n(*** Parallel_domF ***)\n\nlemma Parallel_domF :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> (traces(P |[X]| Q) (fstF o M), failures(P |[X]| Q) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Parallel_T2)\napply (simp add: Parallel_F3)\napply (simp add: Parallel_T3_F4)\ndone\n\n(*--------------------------------*\n |            Hiding              |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Hiding_T2 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T2 (traces(P -- X) (fstF o M), failures(P -- X) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI)\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\nby (force)\n\n(*** F3 ***)\n\nlemma Hiding_F3 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_F3 (traces(P -- X) (fstF o M), failures(P -- X) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rename_tac t Y Z s)\napply (rule_tac x=\"s\" in exI, simp)\n\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"Ev ` X Un Y\" in spec)\napply (drule_tac x=\"Z - Ev ` X\" in spec)\napply (simp)\n\napply (drule mp)\n apply (intro allI impI)\n apply (drule_tac x=\"a\" in spec)\n apply (simp)\n\n apply (insert event_Tick_or_Ev)\n apply (drule_tac x=\"a\" in spec)\n apply (erule disjE)\n  (* Tick *)\n  apply (drule_tac x=\"s ^^^ <Tick>\" in spec)\n  apply (simp)\n  (* Ev *)\n  apply (elim conjE exE)\n  apply (drule_tac x=\"s ^^^ <Ev aa>\" in spec)\n  apply (simp)\n  apply (subgoal_tac \"aa ~: X\", simp_all)\n  apply (force)\n\napply (subgoal_tac \"Ev ` X Un Y Un (Z - Ev ` X) = Ev ` X Un (Y Un Z)\", simp)\nby (auto)\n\n(* T3_F4 *)\n\nlemma Hiding_T3_F4 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T3_F4 (traces(P -- X) (fstF o M), failures(P -- X) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (drule sym)\napply (simp add: hide_tr_decompo)\napply (elim conjE exE)\napply (rotate_tac -1)\napply (drule sym)\n\napply (subgoal_tac \"(EX t''. t' = t'' ^^^ <Tick> & sett t'' <= Ev ` X)\")\n apply (elim conjE exE)\n apply (simp)\n\n (* F4 *)\n apply (rule conjI)\n  apply (rule_tac x=\"s' ^^^ t''\" in exI)\n  apply (simp)\n  apply (subgoal_tac \"t'' --tr X = <>\", simp)\n   apply (simp add: domF_def HC_F4_def)\n   apply (elim conjE)\n   apply (drule_tac x=\"s' ^^^ t''\" in spec)\n   apply (subgoal_tac \"noTick t''\")\n    apply (simp add: appt_assoc)\n   apply (simp add: noTick_def)\n   apply (force)\n  apply (simp add: hide_tr_nilt_sett)\n\n (* T3 *)\n apply (rule allI)\n apply (rule_tac x=\"sa\" in exI, simp)\n apply (simp add: domF_def HC_T3_def)\n apply (elim conjE)\n apply (drule_tac x=\"s' ^^^ t''\" in spec, simp)\n apply (subgoal_tac \"noTick t''\")\n  apply (simp add: appt_assoc)\n apply (simp add: noTick_def)\n apply (force)\n\napply (auto simp add: hide_tr_Tick_sett)\ndone\n\n(*** Hiding_domF ***)\n\nlemma Hiding_domF :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> (traces(P -- X) (fstF o M), failures(P -- X) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Hiding_T2)\napply (simp add: Hiding_F3)\napply (simp add: Hiding_T3_F4)\ndone\n\n(*--------------------------------*\n |           Renaming             |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Renaming_T2 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T2 (traces(P [[r]]) (fstF o M), failures(P [[r]]) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI)\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\nby (force)\n\n(*** F3 ***)\n\nlemma Renaming_F3 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_F3 (traces(P [[r]]) (fstF o M), failures(P [[r]]) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (rule_tac x=\"sa\" in exI, simp)\n\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"[[r]]inv X\" in spec)\napply (drule_tac x=\"[[r]]inv Y\" in spec)\n\napply (drule mp)\n apply (simp add: ren_tr_noTick_right)\n apply (intro allI impI)\n apply (simp add: ren_inv_def)\n apply (erule bexE)\n apply (fold ren_inv_def)\n apply (drule_tac x=\"eb\" in spec, simp)\n\n  (* Tick *)\n  apply (erule disjE)\n  apply (drule_tac x=\" sa ^^^ <a>\" in spec)\n  apply (simp add: ren_tr_noTick_right)\n  (* Ev *)\n  apply (elim conjE exE)\n  apply (drule_tac x=\" sa ^^^ <Ev aa>\" in spec)\n  apply (simp add: ren_tr_noTick_right)\nby (simp)\n\n(* T3_F4 *)\n\nlemma Renaming_T3_F4 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T3_F4 (traces(P [[r]]) (fstF o M), failures(P [[r]]) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (simp add: ren_tr_appt_decompo)\napply (elim conjE exE)\napply (case_tac \"~ noTick s1\", simp)\napply (simp)\n\n (* F4 *)\n apply (rule conjI)\n apply (rule_tac x=\"s1\" in exI, simp)\n apply (simp add: domF_def HC_F4_def)\n apply (elim conjE)\n apply (drule_tac x=\"s1\" in spec, simp)\n apply (rule memF_F2, simp, simp)\n\n (* T3 *)\n apply (rule allI)\n apply (rule_tac x=\"s1 ^^^ <Tick>\" in exI)\n apply (simp add: domF_def HC_T3_def)\n apply (fast)\ndone\n\n(*** Renaming_domF ***)\n\nlemma Renaming_domF :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> (traces(P [[r]]) (fstF o M), failures(P [[r]]) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Renaming_T2)\napply (simp add: Renaming_F3)\napply (simp add: Renaming_T3_F4)\ndone\n\n(*--------------------------------*\n |           Seq_compo            |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Seq_compo_T2 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T2 (traces(P ;; Q) (fstF o M), failures(P ;; Q) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI)\napply (rule conjI)\n\n (* case 1 *)\n apply (intro impI)\n apply (rule disjI1)\n apply (rule_tac x=\"s\" in exI, simp)\n apply (simp add: domF_def HC_T2_def)\n apply (elim conjE)\n apply (drule_tac x=\"s\" in spec)\n apply (force)\n\n (* case 2 *)\n apply (intro impI)\n apply (elim conjE exE disjE)\n apply (rule disjI2)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp add: domF_def HC_T2_def)\n apply (elim conjE)\n apply (rotate_tac 4)\n apply (drule_tac x=\"t\" in spec)\n apply (force)\ndone\n\n(*** F3 ***)\n\nlemma Seq_compo_F3 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_F3 (traces(P ;; Q) (fstF o M), failures(P ;; Q) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE disjE)\n\n (* case 1 *)\n apply (simp add: domF_def HC_F3_def)\n apply (elim conjE)\n apply (drule_tac x=\"s\" in spec)\n apply (drule_tac x=\"insert Tick X\" in spec)\n apply (drule_tac x=\"Y-{Tick}\" in spec)\n apply (simp)\n apply (drule mp)\n  apply (intro allI impI)\n  apply (drule_tac x=\"a\" in spec, simp)\n  apply (simp add: not_Tick_to_Ev)\n  apply (elim conjE exE, simp)\n  apply (rotate_tac -3)\n  apply (drule_tac x=\"s ^^^ <Ev aa>\" in spec, simp)\n apply (subgoal_tac \n   \"insert Tick (X Un (Y - {Tick})) = insert Tick (X Un Y)\", simp)\n apply (force)\n\n (* case 2 *)\n apply (simp add: domF_def HC_F3_def)\n apply (elim conjE)\n apply (rotate_tac -2)\n apply (drule_tac x=\"t\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (drule_tac x=\"Y\" in spec)\n apply (simp)\n apply (drule mp)\n  apply (intro allI impI)\n  apply (drule_tac x=\"a\" in spec, simp)\n  apply (elim conjE)\n  apply (rotate_tac -1)\n  apply (drule_tac x=\"sa\" in spec)\n  apply (rotate_tac -1)\n  apply (drule_tac x=\"t ^^^ <a>\" in spec)\n  apply (simp add: appt_assoc)\n apply (rule disjI2)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\ndone\n\n(* T3_F4 *)\n\nlemma Seq_compo_T3_F4 :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> HC_T3_F4 (traces(P ;; Q) (fstF o M), failures(P ;; Q) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE disjE)\n\n (* case 1 *)\n apply (elim conjE exE)\n apply (subgoal_tac \"noTick (s ^^^ <Tick>) ~= noTick (rmTick sa)\", simp)\n apply (simp (no_asm_use))\n apply (drule sym)\n apply (simp)\n\n (* case 2 *)\n apply (elim conjE exE)\n apply (case_tac \"~ noTick sa\", simp)\n apply (insert trace_last_nil_or_unnil)\n apply (drule_tac x=\"t\" in spec)\n apply (simp)\n  (* <> *)\n  apply (erule disjE)\n  apply (rotate_tac -5)\n  apply (drule_tac sym, simp)   (* contradict *)\n\n  (* ... <Tick> *)\n  apply (elim conjE exE, simp)\n  apply (simp add: appt_assoc_sym)\n  apply (erule conjE)\n  apply (rule conjI)\n\n   (* F4 *)\n   apply (rule disjI2)\n   apply (rule_tac x=\"sa\" in exI)\n   apply (rule_tac x=\"sb\" in exI)\n   apply (simp add: domF_def HC_F4_def)\n\n   (* T3 *)\n   apply (rule allI)\n   apply (rule_tac x=\"sa\" in exI)\n   apply (rule_tac x=\"t\" in exI)\n   apply (simp add: appt_assoc_sym domF_def HC_T3_def)\ndone\n\n(*** Seq_compo_domF ***)\n\nlemma Seq_compo_domF :\n  \"[| (traces(P) (fstF o M), failures(P) M) : domF ; \n      (traces(Q) (fstF o M), failures(Q) M) : domF |]\n     ==> (traces(P ;; Q) (fstF o M), failures(P ;; Q) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Seq_compo_T2)\napply (simp add: Seq_compo_F3)\napply (simp add: Seq_compo_T3_F4)\ndone\n\n(*--------------------------------*\n |          Depth_rest            |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Depth_rest_T2 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T2 (traces(P |. n) (fstF o M), failures(P |. n) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (simp add: domF_def HC_T2_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\nby (force)\n\n(*** F3 ***)\n\nlemma Depth_rest_F3 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_F3 (traces(P |. n) (fstF o M), failures(P |. n) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\n\napply (simp add: domF_def HC_F3_def)\napply (elim conjE)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"Y\" in spec)\napply (simp)\napply (erule disjE)\napply (simp)\napply (simp)\napply (elim conjE exE)\napply (simp)\ndone\n\n(* T3_F4 *)\n\nlemma Depth_rest_T3_F4 :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> HC_T3_F4 (traces(P |. n) (fstF o M), failures(P |. n) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (elim conjE exE)\napply (simp)\n\n (* F4 *)\n apply (rule conjI)\n apply (simp add: domF_def HC_F4_def)\n\n (* T3 *)\n apply (simp add: domF_def HC_T3_def)\n apply (case_tac \"Suc (lengtht s) < n\")\n apply (simp)\n apply (simp)\n apply (fast)\ndone\n\n(*** Depth_rest_domF ***)\n\nlemma Depth_rest_domF :\n  \"(traces(P) (fstF o M), failures(P) M) : domF\n   ==> (traces(P |. n) (fstF o M), failures(P |. n) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Depth_rest_T2)\napply (simp add: Depth_rest_F3)\napply (simp add: Depth_rest_T3_F4)\ndone\n\n(*--------------------------------*\n |        Proc_name_dom           |\n *--------------------------------*)\n\n(*** T2 ***)\n\nlemma Proc_name_T2 :\n  \"HC_T2 (traces ($p) (fstF o M), failures ($p) M)\"\napply (simp add: HC_T2_def in_traces in_failures)\napply (intro allI impI)\napply (elim exE)\napply (simp add: pairF_domF_T2)\ndone\n\n(*** F3 ***)\n\nlemma Proc_name_F3 :\n  \"HC_F3 (traces ($p) (fstF o M), failures ($p) M)\"\napply (simp add: HC_F3_def in_traces in_failures)\napply (intro allI impI)\napply (simp add: pairF_domF_F3)\ndone\n\n(* T3_F4 *)\n\nlemma Proc_name_T3_F4 :\n  \"HC_T3_F4 (traces ($p) (fstF o M), failures ($p) M)\"\napply (simp add: HC_T3_F4_def in_traces in_failures)\napply (intro allI impI)\napply (simp add: pairF_domF_T3)\napply (simp add: pairF_domF_F4)\ndone\n\n(*** Proc_name_domF ***)\n\nlemma Proc_name_domF :\n  \"(traces ($p) (fstF o M), failures ($p) M) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: Proc_name_T2)\napply (simp add: Proc_name_F3)\napply (simp add: Proc_name_T3_F4)\ndone\n\n(*--------------------------------*\n |             proc               |\n *--------------------------------*)\n\ndeclare o_apply [simp del]\n\nlemma proc_domF[simp]: \"(traces(P) (fstF o M), failures(P) M) : domF\"\napply (induct_tac P)\napply (simp add: STOP_domF)\napply (simp add: SKIP_domF)\napply (simp add: DIV_domF)\napply (simp add: Act_prefix_domF)\napply (simp add: Ext_pre_choice_domF)\napply (simp add: Ext_choice_domF)\napply (simp add: Int_choice_domF)\napply (simp add: Rep_int_choice_domF)\napply (simp add: IF_domF)\napply (simp add: Parallel_domF)\napply (simp add: Hiding_domF)\napply (simp add: Renaming_domF)\napply (simp add: Seq_compo_domF)\napply (simp add: Depth_rest_domF)\napply (simp add: Proc_name_domF)\ndone\n\ndeclare o_apply [simp]\n\n(*--------------------------------*\n |          fstF sndF             |\n *--------------------------------*)\n\nlemma fstF_proc_domF[simp]:\n   \"fstF (traces(P) (fstF o M),, failures(P) M) = traces(P) (fstF o M)\"\nby (simp add: pairF)\n\nlemma sndF_proc_domF[simp]:\n   \"sndF (traces(P) (fstF o M),, failures(P) M) = failures(P) M\"\nby (simp add: pairF)\n\nlemma fstF_proc_domF2[simp]:\n   \"fstF (traces(P) (%x. fstF (M x)),, failures(P) M) = traces(P) (fstF o M)\"\napply (fold comp_def)\napply (simp)\ndone\n\nlemma sndF_proc_domF2[simp]:\n   \"sndF (traces(P) (%x. fstF (M x)),, failures(P) M) = failures(P) M\"\napply (fold comp_def)\napply (simp)\ndone\n\nlemma fstF_proc_domF_fun:\n   \"fstF o (%p. (traces(f p) (fstF o M),, failures(f p) M))\n     = (%p. traces(f p) (fstF o M))\"\napply (unfold comp_def)\napply (fold comp_def)\napply (simp add: fun_eq_iff)\ndone\n\nlemma sndF_proc_domF_fun:\n   \"sndF o (%p. (traces(f p) (fstF o M),, failures(f p) M))\n     = (%p.  failures(f p) M)\"\napply (unfold comp_def)\napply (fold comp_def)\napply (simp add: fun_eq_iff)\ndone\n\nlemma fstF_semFf[simp]: \"fstF ([[P]]Ff M) = traces(P) (fstF o M)\"\nby (simp add: semFf_def)\n\nlemma fstF_semF[simp]: \"fstF ([[P]]F) = traces(P) (fstF o MF)\"\nby (simp add: semF_def)\n\nlemma sndF_semFf[simp]: \"sndF ([[P]]Ff M) = failures(P) M\"\nby (simp add: semFf_def)\n\nlemma sndF_semF[simp]: \"sndF ([[P]]F) = failures(P) MF\"\nby (simp add: semF_def)\n\n(*** decomposition ***)\n\nlemma semFf_decompo:\n  \"([[P]]Ff M = SF) = ((traces P (fstF o M) = fstF SF) &\n                        failures P M = sndF SF)\"\napply (simp add: semFf_def)\napply (rule)\napply (drule sym)\napply (simp)\napply (simp)\ndone\n\nlemma semF_decompo:\n  \"([[P]]F = SF) = ((traces P (fstF o MF) = fstF SF) &\n                     failures P MF = sndF SF)\"\napply (simp add: semF_def)\napply (simp add: semFf_decompo)\ndone\n\nlemma semFf_decompo_fstF:\n  \"([[P]]Ff M = SF) ==> traces P (fstF o M) = fstF SF\"\nby (simp add: semFf_decompo)\n\nlemma semF_decompo_fstF:\n  \"([[P]]F = SF) ==> traces P (fstF o MF) = fstF SF\"\nby (simp add: semF_decompo)\n\nlemma semFf_decompo_sndF:\n  \"([[P]]Ff M = SF) ==>  failures P M = sndF SF\"\nby (simp add: semFf_decompo)\n\nlemma semF_decompo_sndF:\n  \"([[P]]F = SF) ==>  failures P MF = sndF SF\"\nby (simp add: semF_decompo)\n\n(*--------------------------------*\n |            [[$p]]Ff            |\n *--------------------------------*)\n\nlemma semFf_Proc_name: \"[[$p]]Ff = (%M. M p)\"\napply (simp add: semFf_def)\napply (simp add: traces_iff)\napply (simp add: failures_iff)\ndone\n\n(*--------------------------------*\n |          =F and <=F            |\n *--------------------------------*)\n\nlemma cspF_eqF_semantics:\n  \"(P =F[M1,M2] Q) = \n       ((traces P (fstF o M1) = traces Q (fstF o M2)) & \n        (failures P M1 = failures Q M2))\"\napply (simp add: eqF_def)\napply (simp add: semFf_def)\napply (simp add: eqF_decompo)\ndone\n\nlemma cspF_refF_semantics:\n  \"(P <=F[M1,M2] Q) = \n       ((traces Q (fstF o M2) <= traces P (fstF o M1)) & \n        (failures Q M2 <= failures P M1))\"\napply (simp add: refF_def)\napply (simp add: semFf_def)\napply (simp add: subdomF_decompo)\ndone\n\nlemmas cspF_semantics = cspF_eqF_semantics  cspF_refF_semantics\n\nlemma cspF_cspT_eqF_semantics:\n  \"(P =F[M1,M2] Q) = \n       ((P =T[fstF o M1,fstF o M2] Q) & \n        (failures P M1 = failures Q M2))\"\napply (simp add: cspF_eqF_semantics)\napply (simp add: eqT_def)\napply (simp add: semTf_def)\ndone\n\nlemma cspF_cspT_refF_semantics:\n  \"(P <=F[M1,M2] Q) = \n       ((P <=T[fstF o M1,fstF o M2] Q) & \n        (failures Q M2 <= failures P M1))\"\napply (simp add: cspF_refF_semantics)\napply (simp add: refT_def)\napply (simp add: semTf_def)\ndone\n\nlemmas cspF_cspT_semantics = cspF_cspT_eqF_semantics  cspF_cspT_refF_semantics\n\n(*--------------------------------*\n |            Timeout             |\n *--------------------------------*)\n\nlemma in_failures_Timeout1: \n  \"(f :f failures(P [> Q) M) =\n   (f :f failures(Q) M |\n   (EX s X. f = (s, X) & s ~= <> & (s, X) :f failures(P) M) |\n   (EX X. f = (<>, X) & X <= Evset & <Tick> :t traces(P) (fstF o M)))\"\napply (rule)\n\n(* <= *)\n apply (simp add: in_failures)\n apply (elim conjE exE disjE)\n apply (simp_all)\n apply (simp add: in_traces)\n apply (rule disjI1)\n apply (rule domF_F2_F4, simp_all)\n\n (* <= *)\n apply (simp add: in_failures in_traces)\n apply (elim conjE exE disjE, simp_all)\n apply (auto elim: memF_pairE)\ndone\n\nlemma in_failures_Timeout2:\n  \"(f :f failures(P [>def Q) M) =\n   (f :f failures(Q) M |\n   (EX s X. f = (s, X) & s ~= <> & (s, X) :f failures(P) M) |\n   (EX X. f = (<>, X) & X <= Evset & <Tick> :t traces(P) (fstF o M)))\"\napply (simp add: Timeout_def)\napply (simp add: in_failures_Timeout1)\ndone\n\nlemmas in_failures_Timeout = in_failures_Timeout1 in_failures_Timeout2\n\n(*--------------------------------*\n |           Depth rest           |\n *--------------------------------*)\n\nlemma semFf_Depth_rest: \"[[P |. n]]Ff M = [[P]]Ff M .|. n\"\napply (simp add: semFf_def)\napply (simp add: traces.simps)\napply (simp add: failures.simps)\napply (simp add: rest_domF_def)\napply (simp add: restTF_def)\napply (simp add: pairF_def)\napply (simp add: Abs_domF_inverse)\napply (simp add: pair_restriction_def)\ndone\n\nlemma semF_Depth_rest: \"[[P |. n]]F = [[P]]F .|. n\"\napply (simp add: semF_def)\napply (simp add: semFf_Depth_rest)\ndone\n\n(*---------------------------------------------------*\n |         Healthiness conditions for proc           |\n *---------------------------------------------------*)\n\nlemma proc_T2:\n    \"(s, X) :f failures(P) M ==> s :t traces(P) (fstF o M)\"\napply (insert pairF_domF_T2[of \"s\" \"X\" \"(traces(P) (fstF o M),, failures(P) M)\"])\nby (simp)\n\nlemma proc_T3:\n  \"[| s ^^^ <Tick> :t traces(P) (fstF o M); noTick s |]\n   ==> (s ^^^ <Tick>, X) :f failures(P) M\"\napply (insert pairF_domF_T3[of \"s\" \"(traces(P) (fstF o M),, failures(P) M)\" \"X\"])\nby (simp)\n\nlemma proc_T3_Tick:\n  \"<Tick> :t traces(P) (fstF o M) ==> (<Tick>, X) :f failures(P) M\"\napply (insert proc_T3[of \"<>\" P M X])\nby (simp)\n\nlemma proc_F4:\n  \"[| s ^^^ <Tick> :t traces(P) (fstF o M) ; noTick s |]\n   ==> (s, Evset) :f failures(P) M\"\napply (insert pairF_domF_F4[of \"s\" \"(traces(P) (fstF o M),, failures(P) M)\"])\nby (simp)\n\nlemma proc_F3:\n  \"[| (s, X) :f failures(P) M ; noTick s ;\n      (ALL a. a : Y --> s ^^^ <a> ~:t  traces(P) (fstF o M)) |]\n   ==> (s, X Un Y) :f  failures(P) M\"\napply (insert pairF_domF_F3[of \"s\" \"X\" \"(traces(P) (fstF o M),, failures(P) M)\" \"Y\"])\nby (simp)\n\nlemma proc_F3I:\n  \"[| (s, X) :f failures(P) M ; noTick s ;\n      (ALL a. a : Y --> s ^^^ <a> ~:t traces(P) (fstF o M)) ;\n      Z = X Un Y |]\n   ==> (s, Z) :f failures(P) M\"\nby (simp add: proc_F3)\n\n(*** F2_F4 ***)\n\nlemma proc_F2_F4:\n  \"[| s ^^^ <Tick> :t traces(P) (fstF o M) ; noTick s ; X <= Evset|]\n   ==> (s, X) :f failures(P) M\"\napply (insert pairF_domF_F2_F4[of \"s\" \"(traces(P) (fstF o M),, failures(P) M)\" \"X\"])\nby (simp)\n\n(*** T2_T3 ***)\n\nlemma proc_T2_T3:\n  \"[| (s ^^^ <Tick>, X) :f failures(P) M ; noTick s |] \n  ==> (s ^^^ <Tick>, Y) :f failures(P) M\"\napply (rule proc_T3)\napply (rule proc_T2)\nby (simp_all)\n\n(*------------------------------------------------------*\n |   Union in domF  (used for generic internal choice   |\n *------------------------------------------------------*)\n\nlemma non_empty_UnionT_UnionF_T2:\n \"Ps ~= {} ==>\n  HC_T2 (UnionT {(traces P (fstF o M)) |P. P : Ps} , \n         UnionF {(failures P M) |P. P : Ps})\"\napply (simp add: HC_T2_def)\napply (intro allI impI)\napply (subgoal_tac \"{(traces P (fstF o M)) |P. P : Ps} ~= {}\")\napply (simp)\napply (elim conjE bexE exE)\napply (simp)\napply (rule_tac x=\"traces Pa (fstF o M)\" in exI)\napply (rule conjI)\napply (rule_tac x=\"Pa\" in exI)\napply (simp)\napply (simp add: proc_T2)\nby (auto)\n\nlemma non_empty_UnionT_UnionF_F3:\n \"Ps ~= {} ==>\n  HC_F3 (UnionT {(traces P (fstF o M)) |P. P : Ps} , \n         UnionF {(failures P M) |P. P : Ps})\"\napply (simp add: HC_F3_def)\napply (intro allI impI)\napply (subgoal_tac \"{(traces P (fstF o M)) |P. P : Ps} ~= {}\")\napply (simp)\napply (elim conjE exE)\napply (simp)\napply (rule_tac x=\"failures Pa M\" in exI)\napply (rule conjI)\napply (rule_tac x=\"Pa\" in exI)\napply (simp)\napply (rule proc_F3)\napply (simp_all)\napply (intro allI impI)\napply (drule_tac x=\"a\" in spec)\napply (simp)\napply (drule_tac x=\"traces Pa  (fstF o M)\" in spec)\napply (erule disjE)\napply (drule_tac x=\"Pa\" in spec)\napply (simp)\napply (simp)\napply (auto)\ndone\n\nlemma non_empty_UnionT_UnionF_T3_F4:\n \"Ps ~= {} ==>\n  HC_T3_F4 (UnionT {(traces P (fstF o M)) |P. P : Ps} , \n            UnionF {(failures P M) |P. P : Ps})\"\napply (simp add: HC_T3_F4_def)\napply (intro allI impI)\napply (subgoal_tac \"{(traces P (fstF o M)) |P. P : Ps} ~= {}\")\napply (simp)\napply (elim conjE bexE exE)\napply (simp)\napply (rule conjI)\n apply (rule_tac x=\"failures Pa M\" in exI)\n apply (rule conjI)\n apply (fast)\n apply (rule proc_F4)\n apply (simp_all)\n\n apply (rule allI)\n apply (rule_tac x=\"failures Pa M\" in exI)\n apply (rule conjI)\n apply (fast)\n apply (rule proc_T3)\n apply (simp_all)\nby (auto)\n\nlemma non_empty_UnionT_UnionF_domF:\n \"Ps ~= {} ==>\n  (UnionT {(traces P (fstF o M)) |P. P : Ps} , \n   UnionF {(failures P M) |P. P : Ps}) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: non_empty_UnionT_UnionF_T2)\napply (simp add: non_empty_UnionT_UnionF_F3)\napply (simp add: non_empty_UnionT_UnionF_T3_F4)\ndone\n\n(*------------------------------------------------------*\n |   Union in domF  (used for generic internal choice   |\n *------------------------------------------------------*)\n\nlemma UnionT_UnionF_T2:\n \"HC_T2 ({t. t = <> | (EX P:Ps. t :t traces(P) (fstF o M)) }t ,\n         {f. EX P:Ps. f :f failures(P) M}f )\"\napply (simp add: HC_T2_def)\napply (intro allI impI)\napply (simp add: in_traces_Union_proc)\napply (simp add: in_failures_Union_proc)\napply (elim conjE bexE exE)\napply (rule disjI2)\napply (rule_tac x=\"P\" in bexI)\napply (simp add: proc_T2)\napply (simp)\ndone\n\nlemma UnionT_UnionF_F3:\n \"HC_F3 ({t. t = <> | (EX P:Ps. t :t traces(P) (fstF o M)) }t ,\n         {f. EX P:Ps. f :f failures(P) M}f )\"\napply (simp add: HC_F3_def)\napply (intro allI impI)\napply (simp add: in_traces_Union_proc)\napply (simp add: in_failures_Union_proc)\napply (elim conjE bexE exE)\napply (simp)\napply (rule_tac x=\"P\" in bexI)\napply (rule proc_F3)\napply (simp_all)\ndone\n\nlemma UnionT_UnionF_T3_F4:\n \"HC_T3_F4 ({t. t = <> | (EX P:Ps. t :t traces(P) (fstF o M)) }t ,\n            {f. EX P:Ps. f :f failures(P) M}f )\"\napply (simp add: HC_T3_F4_def)\napply (intro allI impI)\napply (simp add: in_traces_Union_proc)\napply (simp add: in_failures_Union_proc)\napply (elim conjE bexE exE)\napply (simp)\napply (elim bexE)\napply (rule conjI)\n apply (rule_tac x=\"P\" in bexI)\n apply (rule proc_F4)\n apply (simp_all)\n\n apply (rule allI)\n apply (rule_tac x=\"P\" in bexI)\n apply (rule proc_T3)\n apply (simp_all)\ndone\n\nlemma UnionT_UnionF_domF:\n \"({t. t = <> | (EX P:Ps. t :t traces(P) (fstF o M)) }t ,\n            {f. EX P:Ps. f :f failures(P) M}f) : domF\"\napply (simp (no_asm) add: domF_iff)\napply (simp add: UnionT_UnionF_T2)\napply (simp add: UnionT_UnionF_F3)\napply (simp add: UnionT_UnionF_T3_F4)\ndone\n\n(*-----------------------------------------*\n |              substitution               |\n *-----------------------------------------*)\n\nlemma semF_subst:\n  \"[[P<<f]]F = [[P]]Ff (%q. [[f q]]F)\"\napply (induct_tac P)\napply (simp add: semF_def semFf_def,\n       simp add: eqF_decompo,\n       simp add: traces_iff failures_iff)+\ndone\n\nlemma semF_subst_semFfun:\n  \"(%q. [[ (Pf q)<<f ]]F) = ([[Pf]]Ffun (%q. [[f q]]F))\"\napply (simp add: semFfun_def)\napply (simp add: fun_eq_iff)\napply (rule allI)\napply (simp add: semF_subst)\ndone\n\nlemma failrues_subst:\n  \"failures(P<<f) M = failures P (%q. [[f q]]Ff M)\"\napply (induct_tac P)\napply (simp_all add: semF_def semFf_def traces_iff failures_iff)+\napply (simp add: fstF_proc_domF_fun)\napply (simp add: traces_subst)\n\napply (simp add: fstF_proc_domF_fun)\napply (simp add: traces_subst)\ndone\n\n(*-----------------------------------------*\n |               semT -- semF              |\n *-----------------------------------------*)\n\nlemma semTfun_fstF_semFf:\n  \"[[Pf]]Tfun (fstF o M) p = fstF ([[Pf p]]Ff M)\"\napply (simp add: semTfun_def)\napply (simp add: semTf_def)\ndone\n\n(****************** to add them again ******************)\n\ndeclare disj_not1   [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_domain.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5774953651858117, "lm_q1q2_score": 0.3135010299616746}}
{"text": "theory ValueOntology     (*Benzmüller, Fuenmayor & Lomfeld, 2020*)  \n  imports PreferenceLogicBasics \nbegin (*** Lomfeld's value ontology is encoded ***)\n(*two legal parties (there can be more in principle)*)\ndatatype c = p | d (*parties/contenders: plaintiff, defendant*)\nfun other::\"c\\<Rightarrow>c\" (\"_\\<inverse>\") where \"p\\<inverse> = d\" | \"d\\<inverse>= p\" \n  \nconsts For::\"c\\<Rightarrow>\\<sigma>\"    (*decision: find/rule for party*)\naxiomatization where ForAx: \"\\<lfloor>For x \\<^bold>\\<leftrightarrow> (\\<^bold>\\<not>For x\\<inverse>)\\<rfloor>\"\n\n(* abbreviation relPref::\\<nu> (\"_\\<^bold>\\<prec>_\") where \"\\<phi> \\<^bold>\\<prec> \\<psi> \\<equiv> \\<phi> \\<^bold>\\<preceq>\\<^sub>A\\<^sub>E \\<psi> \" *)\nabbreviation relPref::\\<nu> (\"_\\<^bold>\\<prec>_\") where \"\\<phi> \\<^bold>\\<prec> \\<psi> \\<equiv> \\<psi> \\<^bold>\\<succ>\\<^sub>E\\<^sub>A \\<phi>\"\n\ndatatype (*ethico-legal values/principles*) \n   VAL = WILL | RELI | RESP | EQUI | FAIR | EFFI | STAB | GAIN \n\n(*predicate c\\<up>UV: (a decision for) party c promotes value V*)\nconsts V::\"c\\<Rightarrow>VAL\\<Rightarrow>\\<sigma>\" (\"_\\<upharpoonleft>_\") \n\n(*upper values and their compliance with ethico-legal values*)\nabbreviation \"SECURITY x \\<equiv> (x\\<upharpoonleft>RELI \\<^bold>\\<or> x\\<upharpoonleft>EQUI \\<^bold>\\<or> x\\<upharpoonleft>STAB \\<^bold>\\<or> x\\<upharpoonleft>EFFI)\"\nabbreviation \"EQUALITY x \\<equiv> (x\\<upharpoonleft>FAIR \\<^bold>\\<or> x\\<upharpoonleft>RESP \\<^bold>\\<or> x\\<upharpoonleft>EQUI \\<^bold>\\<or> x\\<upharpoonleft>RELI)\"\nabbreviation \"LIBERTY x \\<equiv> (x\\<upharpoonleft>WILL \\<^bold>\\<or> x\\<upharpoonleft>GAIN \\<^bold>\\<or> x\\<upharpoonleft>RESP \\<^bold>\\<or> x\\<upharpoonleft>FAIR)\"\nabbreviation \"UTILITY x \\<equiv> (x\\<upharpoonleft>EFFI \\<^bold>\\<or> x\\<upharpoonleft>STAB \\<^bold>\\<or> x\\<upharpoonleft>GAIN \\<^bold>\\<or> x\\<upharpoonleft>WILL)\"\nabbreviation (*inconsistency of upper values*)\n \"INCONS x \\<equiv> (SECURITY x \\<^bold>\\<and> EQUALITY x \\<^bold>\\<and> LIBERTY x \\<^bold>\\<and> UTILITY x)\"\nabbreviation (*Indifference*)\n \"INDIFF x \\<equiv> \\<^bold>\\<not>(SECURITY x \\<^bold>\\<or> EQUALITY x \\<^bold>\\<or> LIBERTY x \\<^bold>\\<or> UTILITY x)\"\n\n(*some useful settings for model finder: enforce information*)\nnitpick_params [eval=INCONS SECURITY EQUALITY LIBERTY UTILITY V] \n(*exploring the consistency and models of the ontology*)\nlemma \"True\" nitpick[satisfy,show_all,card i=1] oops\nlemma \"True\" nitpick[satisfy,show_all,card i=10] oops\nlemma \"\\<lfloor>(\\<^bold>\\<not>INDIFF d) \\<^bold>\\<and> (\\<^bold>\\<not>INDIFF p) \\<^bold>\\<and> (\\<^bold>\\<not>INCONS d) \\<^bold>\\<and> (\\<^bold>\\<not>INCONS p) \\<^bold>\\<and>\n  d\\<upharpoonleft>RELI \\<^bold>\\<and> p\\<upharpoonleft>WILL\\<rfloor>\"  nitpick[satisfy,max_genuine=10,show_all] oops\n\n(*useful shorthand notation for aggregated values*) \nabbreviation agg::\"\\<sigma>\\<Rightarrow>\\<sigma>\\<Rightarrow>\\<sigma>\" (\"_\\<^bold>\\<oplus>_\") where \"v\\<^sub>1\\<^bold>\\<oplus>v\\<^sub>2 \\<equiv> v\\<^sub>1 \\<^bold>\\<or> v\\<^sub>2\"\nabbreviation Agg2 (\"_\\<upharpoonleft>[_\\<oplus>_]\") where \"c\\<upharpoonleft>[V1\\<oplus>V2] \\<equiv> c\\<upharpoonleft>V1 \\<^bold>\\<oplus> c\\<upharpoonleft>V2\"\nabbreviation Agg3 (\"_\\<upharpoonleft>[_\\<oplus>_\\<oplus>_]\")\n  where \"c\\<upharpoonleft>[V1\\<oplus>V2\\<oplus>V3] \\<equiv> c\\<upharpoonleft>V1 \\<^bold>\\<oplus> (c\\<upharpoonleft>V2 \\<^bold>\\<oplus> c\\<upharpoonleft>V3)\"\nabbreviation Agg4 (\"_\\<upharpoonleft>[_\\<oplus>_\\<oplus>_\\<oplus>_]\") \n  where \"c\\<upharpoonleft>[V1\\<oplus>V2\\<oplus>V3\\<oplus>V4] \\<equiv> c\\<upharpoonleft>V1 \\<^bold>\\<oplus> (c\\<upharpoonleft>V2 \\<^bold>\\<oplus> (c\\<upharpoonleft>V3 \\<^bold>\\<oplus> c\\<upharpoonleft>V4))\"\n\n(*exploring implied knowledge*)\nlemma \"\\<lfloor>x\\<upharpoonleft>[WILL\\<oplus>STAB] \\<^bold>\\<rightarrow> INCONS x\\<rfloor>\" \n  nitpick oops (*two non-opposed quadrants \\<oplus> (noq): consistent*)\nlemma \"\\<lfloor>x\\<upharpoonleft>[WILL\\<oplus>GAIN\\<oplus>EFFI\\<oplus>STAB] \\<^bold>\\<rightarrow> INCONS x\\<rfloor>\" \n  nitpick oops (*two noq \\<oplus>: consistent*)\nlemma \"\\<lfloor>x\\<upharpoonleft>[WILL\\<oplus>EFFI\\<oplus>RELI] \\<^bold>\\<rightarrow> INCONS x\\<rfloor>\" nitpick (*TODO redefine INCONS appropriately to validate this*)\n  by simp (*three quadrants \\<oplus>: inconsistent*)\nlemma \"\\<lfloor>x\\<upharpoonleft>[RESP\\<oplus>STAB] \\<^bold>\\<rightarrow> INCONS x\\<rfloor>\"  nitpick (*TODO redefine INCONS appropriately to validate this*)\n  by simp (*two opposed quadrants \\<oplus> (oq): inconsistent*)\nlemma \"\\<lfloor>x\\<upharpoonleft>EQUI \\<^bold>\\<and> y\\<upharpoonleft>EFFI \\<^bold>\\<rightarrow> (INCONS x \\<^bold>\\<or> INCONS y)\\<rfloor>\" \n  nitpick oops (*two noq (different parties): consistent*)\nlemma \"\\<lfloor>x\\<upharpoonleft>RESP \\<^bold>\\<and> y\\<upharpoonleft>STAB \\<^bold>\\<rightarrow> (INCONS x \\<^bold>\\<or> INCONS y)\\<rfloor>\" \n  nitpick oops (*two oq (different parties): consistent*)\n\n(*Important: only AE/EA preference variants are suitable for the\nlogic of value aggregation (aggregating values by union/disjunction)*)\nlemma \"\\<lfloor>x\\<upharpoonleft>WILL \\<^bold>\\<prec> x\\<upharpoonleft>[WILL\\<oplus>STAB]\\<rfloor>\" \n  nitpick nitpick[satisfy] oops (*contingent --TODO: should also be countersatisfiable(?)*)\nlemma \"\\<lfloor>x\\<upharpoonleft>WILL \\<^bold>\\<prec> x\\<upharpoonleft>STAB\\<rfloor> \\<longrightarrow> \\<lfloor>x\\<upharpoonleft>WILL \\<^bold>\\<prec> x\\<upharpoonleft>[WILL\\<oplus>STAB]\\<rfloor>\" by blast\nlemma \"\\<lfloor>x\\<upharpoonleft>WILL \\<^bold>\\<prec> x\\<upharpoonleft>STAB\\<rfloor> \\<longrightarrow> \\<lfloor>x\\<upharpoonleft>WILL \\<^bold>\\<prec> x\\<upharpoonleft>[RELI\\<oplus>STAB]\\<rfloor>\" by blast\nlemma \"\\<lfloor>x\\<upharpoonleft>WILL \\<^bold>\\<prec> x\\<upharpoonleft>[WILL\\<oplus>STAB]\\<rfloor> \\<longrightarrow> \\<lfloor>x\\<upharpoonleft>WILL \\<^bold>\\<prec> x\\<upharpoonleft>STAB\\<rfloor>\" \n  nitpick nitpick[satisfy] oops (*contingent --TODO: should also be countersatisfiable(?)*)\nlemma \"\\<lfloor>x\\<upharpoonleft>WILL \\<^bold>\\<prec> x\\<upharpoonleft>[RELI\\<oplus>STAB]\\<rfloor> \\<longrightarrow> \\<lfloor>x\\<upharpoonleft>WILL \\<^bold>\\<prec> x\\<upharpoonleft>STAB\\<rfloor>\" \n  nitpick nitpick[satisfy] oops (*contingent*)\nlemma \"\\<lfloor>x\\<upharpoonleft>[WILL\\<oplus>STAB] \\<^bold>\\<prec> x\\<upharpoonleft>WILL\\<rfloor>\" \n  nitpick nitpick[satisfy] oops (*contingent --TODO: should also be satisfiable(?)*)\nlemma \"\\<lfloor>x\\<upharpoonleft>[WILL\\<oplus>STAB] \\<^bold>\\<prec> x\\<upharpoonleft>WILL\\<rfloor> \\<longrightarrow> \\<lfloor>x\\<upharpoonleft>STAB \\<^bold>\\<prec> x\\<upharpoonleft>WILL\\<rfloor>\" by blast\nlemma \"\\<lfloor>x\\<upharpoonleft>[RELI\\<oplus>STAB] \\<^bold>\\<prec> x\\<upharpoonleft>WILL\\<rfloor> \\<longrightarrow> \\<lfloor>x\\<upharpoonleft>STAB \\<^bold>\\<prec> x\\<upharpoonleft>WILL\\<rfloor>\" by blast\nlemma \"\\<lfloor>x\\<upharpoonleft>STAB \\<^bold>\\<prec> x\\<upharpoonleft>WILL\\<rfloor> \\<longrightarrow> \\<lfloor>x\\<upharpoonleft>[WILL\\<oplus>STAB] \\<^bold>\\<prec> x\\<upharpoonleft>WILL\\<rfloor>\" \n  nitpick nitpick[satisfy] oops (*contingent --TODO: should also be countersatisfiable(?)*)\nlemma \"\\<lfloor>x\\<upharpoonleft>STAB \\<^bold>\\<prec> x\\<upharpoonleft>WILL\\<rfloor> \\<longrightarrow> \\<lfloor>x\\<upharpoonleft>[RELI\\<oplus>STAB] \\<^bold>\\<prec> x\\<upharpoonleft>WILL\\<rfloor>\" \n  nitpick nitpick[satisfy] oops (*contingent*)\n\nend\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/Preference-Logics/vanBenthemEtAl2009/OLD/ValueOntology.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3133232324172162}}
{"text": "theory Indep_Vars\nimports Main Refine_Util Mpat_Antiquot\nbegin\n\ndefinition [simp]: \"INDEP v \\<equiv> True\"\nlemma INDEPI: \"INDEP v\" by simp\n\nML {*\n  signature INDEP_VARS = sig\n    val indep_tac: tactic'\n  end\n\n  structure Indep_Vars :INDEP_VARS = struct\n\n    local\n      fun vsubterms (Abs (_,_,t)) = vsubterms t\n        | vsubterms (t as (_$_)) = let\n            val (f,args) = strip_comb t\n            val args_vsts = map vsubterms args |> flat\n          in \n            case f of \n              (Var (name,vT)) => [(name,vT,fastype_of t,args)]@args_vsts\n            | _ => vsubterms f @ args_vsts\n          end\n        | vsubterms _ = []\n\n      fun indep_vars t st = let\n        val thy = theory_of_thm st\n        val cert = cterm_of thy\n\n        fun inst_of (name,vT,T,args) = let\n          val Ts = map fastype_of args |> rev\n          val t' = fold absdummy Ts (Var (name,T))\n          val inst = (cert (Var (name,vT)), cert t')\n        in inst end\n\n        val inst = vsubterms t\n          |> distinct (op = o pairself #1)\n          |> map inst_of\n\n        val st' = Drule.instantiate_normalize ([],inst) st\n          |> Conv.fconv_rule (Thm.beta_conversion true)\n      in \n        Seq.single st' \n      end\n      \n      fun indep_tac_aux i st = case Logic.concl_of_goal (prop_of st) i of\n        @{mpat \"Trueprop (INDEP ?v)\"} \n          => (indep_vars v THEN rtac @{thm INDEPI} i) st\n      | _ => Seq.empty\n\n    in\n      (* Remove explicit parameters from schematic variable. *)\n      val indep_tac = IF_EXGOAL \n        (CONVERSION Thm.eta_conversion THEN' indep_tac_aux)\n    end\n  end\n*}\n\n\n(*schematic_lemma \n  \"!!x y z. INDEP (?R x z)\"\n  \"!!x y z. ?R x z 1\"\n  apply (tactic {* Indep_Vars.indep_tac 1 *})\n  apply rule\n  done\n*)\n\n\n\nend\n\n(*\n\n      fun indep_vars t st = case strip_comb t of\n        (v as Var (name,_),args) => let\n          val thy = theory_of_thm st\n          val cert = cterm_of thy\n  \n          val T = fastype_of t\n          val Ts = map fastype_of args |> rev\n          val t' = fold absdummy Ts (Var (name,T))\n          val inst = ([],[(cert v, cert t')]) handle e =>\n            ( tracing (Syntax.pretty_term_global thy t |> Pretty.string_of);\n              reraise e\n            )\n\n          val st' = Drule.instantiate_normalize inst st\n            |> Conv.fconv_rule (Thm.beta_conversion true)\n\n          val _ = Config.get_global thy cfg_trace andalso (Pretty.block [\n            Pretty.str \"INDEP \", Syntax.pretty_term_global thy t, \n              Pretty.brk 1, Pretty.str \":\", Pretty.brk 1,\n              Syntax.pretty_term_global thy v,\n              Pretty.brk 1, Pretty.str \"->\", Pretty.brk 1,\n              Syntax.pretty_term_global thy t',\n              Pretty.fbrk,\n              Pretty.indent 2 (\n                Pretty.big_list \"Goals: \" \n                  (Goal_Display.pretty_goals_without_context st'))\n          ] |> Pretty.string_of |> tracing; true)\n\n        in Seq.single st' end\n      | _ => (\n        Pretty.block [ \n            Pretty.str \"INDEP on non-variable: \", \n            Syntax.pretty_term_global (theory_of_thm st) t\n          ] |> Pretty.string_of |> warning;\n        Seq.single st\n      )\n\n\n\n  Old version: Removes all functionality, not only explicit parameters\n  structure Indep_Vars :INDEP_VARS = struct\n    local\n      (* Remove explicit parameters from relation variable. *)\n      fun indep_var (name,typ) = let\n        val (Ts,T) = strip_type typ |>> rev\n        val r = fold absdummy Ts (Var (name,T))\n      in \n        r\n      end\n\n      fun indep_vars R st = let\n        val vs = Term.add_vars R []\n        val cert = cterm_of (theory_of_thm st)\n        val inst = map (fn v => (cert (Var v), cert (indep_var v))) vs\n        val st' = Drule.instantiate_normalize ([],inst) st\n          |> Conv.fconv_rule (Thm.beta_conversion true)\n      in \n        Seq.single st'\n      end\n\n      fun indep_tac_aux i st = case Logic.concl_of_goal (prop_of st) i of\n        @{mpat \"Trueprop (INDEP ?v)\"} \n          => (indep_vars v THEN rtac @{thm INDEPI} i) st\n      | _ => Seq.empty\n\n    in\n      val indep_tac = IF_EXGOAL indep_tac_aux\n\n    end\n  end\n\n\n\n*)\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Automatic_Refinement/Lib/Indep_Vars.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.31332323241721616}}
{"text": "theory Tactic\nimports Base\nbegin\n\nchapter \\<open>Tactical reasoning\\<close>\n\ntext \\<open>Tactical reasoning works by refining an initial claim in a\n  backwards fashion, until a solved form is reached.  A @{text \"goal\"}\n  consists of several subgoals that need to be solved in order to\n  achieve the main statement; zero subgoals means that the proof may\n  be finished.  A @{text \"tactic\"} is a refinement operation that maps\n  a goal to a lazy sequence of potential successors.  A @{text\n  \"tactical\"} is a combinator for composing tactics.\\<close>\n\n\nsection \\<open>Goals \\label{sec:tactical-goals}\\<close>\n\ntext \\<open>\n  Isabelle/Pure represents a goal as a theorem stating that the\n  subgoals imply the main goal: @{text \"A\\<^sub>1 \\<Longrightarrow> \\<dots> \\<Longrightarrow> A\\<^sub>n \\<Longrightarrow>\n  C\"}.  The outermost goal structure is that of a Horn Clause: i.e.\\\n  an iterated implication without any quantifiers\\footnote{Recall that\n  outermost @{text \"\\<And>x. \\<phi>[x]\"} is always represented via schematic\n  variables in the body: @{text \"\\<phi>[?x]\"}.  These variables may get\n  instantiated during the course of reasoning.}.  For @{text \"n = 0\"}\n  a goal is called ``solved''.\n\n  The structure of each subgoal @{text \"A\\<^sub>i\"} is that of a\n  general Hereditary Harrop Formula @{text \"\\<And>x\\<^sub>1 \\<dots>\n  \\<And>x\\<^sub>k. H\\<^sub>1 \\<Longrightarrow> \\<dots> \\<Longrightarrow> H\\<^sub>m \\<Longrightarrow> B\"}.  Here @{text\n  \"x\\<^sub>1, \\<dots>, x\\<^sub>k\"} are goal parameters, i.e.\\\n  arbitrary-but-fixed entities of certain types, and @{text\n  \"H\\<^sub>1, \\<dots>, H\\<^sub>m\"} are goal hypotheses, i.e.\\ facts that may\n  be assumed locally.  Together, this forms the goal context of the\n  conclusion @{text B} to be established.  The goal hypotheses may be\n  again arbitrary Hereditary Harrop Formulas, although the level of\n  nesting rarely exceeds 1--2 in practice.\n\n  The main conclusion @{text C} is internally marked as a protected\n  proposition, which is represented explicitly by the notation @{text\n  \"#C\"} here.  This ensures that the decomposition into subgoals and\n  main conclusion is well-defined for arbitrarily structured claims.\n\n  \\medskip Basic goal management is performed via the following\n  Isabelle/Pure rules:\n\n  \\[\n  \\infer[@{text \"(init)\"}]{@{text \"C \\<Longrightarrow> #C\"}}{} \\qquad\n  \\infer[@{text \"(finish)\"}]{@{text \"C\"}}{@{text \"#C\"}}\n  \\]\n\n  \\medskip The following low-level variants admit general reasoning\n  with protected propositions:\n\n  \\[\n  \\infer[@{text \"(protect n)\"}]{@{text \"A\\<^sub>1 \\<Longrightarrow> \\<dots> \\<Longrightarrow> A\\<^sub>n \\<Longrightarrow> #C\"}}{@{text \"A\\<^sub>1 \\<Longrightarrow> \\<dots> \\<Longrightarrow> A\\<^sub>n \\<Longrightarrow> C\"}}\n  \\]\n  \\[\n  \\infer[@{text \"(conclude)\"}]{@{text \"A \\<Longrightarrow> \\<dots> \\<Longrightarrow> C\"}}{@{text \"A \\<Longrightarrow> \\<dots> \\<Longrightarrow> #C\"}}\n  \\]\n\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML Goal.init: \"cterm -> thm\"} \\\\\n  @{index_ML Goal.finish: \"Proof.context -> thm -> thm\"} \\\\\n  @{index_ML Goal.protect: \"int -> thm -> thm\"} \\\\\n  @{index_ML Goal.conclude: \"thm -> thm\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML \"Goal.init\"}~@{text C} initializes a tactical goal from\n  the well-formed proposition @{text C}.\n\n  \\item @{ML \"Goal.finish\"}~@{text \"ctxt thm\"} checks whether theorem\n  @{text \"thm\"} is a solved goal (no subgoals), and concludes the\n  result by removing the goal protection.  The context is only\n  required for printing error messages.\n\n  \\item @{ML \"Goal.protect\"}~@{text \"n thm\"} protects the statement\n  of theorem @{text \"thm\"}.  The parameter @{text n} indicates the\n  number of premises to be retained.\n\n  \\item @{ML \"Goal.conclude\"}~@{text \"thm\"} removes the goal\n  protection, even if there are pending subgoals.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Tactics\\label{sec:tactics}\\<close>\n\ntext \\<open>A @{text \"tactic\"} is a function @{text \"goal \\<rightarrow> goal\\<^sup>*\\<^sup>*\"} that\n  maps a given goal state (represented as a theorem, cf.\\\n  \\secref{sec:tactical-goals}) to a lazy sequence of potential\n  successor states.  The underlying sequence implementation is lazy\n  both in head and tail, and is purely functional in \\emph{not}\n  supporting memoing.\\footnote{The lack of memoing and the strict\n  nature of ML requires some care when working with low-level\n  sequence operations, to avoid duplicate or premature evaluation of\n  results.  It also means that modified runtime behavior, such as\n  timeout, is very hard to achieve for general tactics.}\n\n  An \\emph{empty result sequence} means that the tactic has failed: in\n  a compound tactic expression other tactics might be tried instead,\n  or the whole refinement step might fail outright, producing a\n  toplevel error message in the end.  When implementing tactics from\n  scratch, one should take care to observe the basic protocol of\n  mapping regular error conditions to an empty result; only serious\n  faults should emerge as exceptions.\n\n  By enumerating \\emph{multiple results}, a tactic can easily express\n  the potential outcome of an internal search process.  There are also\n  combinators for building proof tools that involve search\n  systematically, see also \\secref{sec:tacticals}.\n\n  \\medskip As explained before, a goal state essentially consists of a\n  list of subgoals that imply the main goal (conclusion).  Tactics may\n  operate on all subgoals or on a particularly specified subgoal, but\n  must not change the main conclusion (apart from instantiating\n  schematic goal variables).\n\n  Tactics with explicit \\emph{subgoal addressing} are of the form\n  @{text \"int \\<rightarrow> tactic\"} and may be applied to a particular subgoal\n  (counting from 1).  If the subgoal number is out of range, the\n  tactic should fail with an empty result sequence, but must not raise\n  an exception!\n\n  Operating on a particular subgoal means to replace it by an interval\n  of zero or more subgoals in the same place; other subgoals must not\n  be affected, apart from instantiating schematic variables ranging\n  over the whole goal state.\n\n  A common pattern of composing tactics with subgoal addressing is to\n  try the first one, and then the second one only if the subgoal has\n  not been solved yet.  Special care is required here to avoid bumping\n  into unrelated subgoals that happen to come after the original\n  subgoal.  Assuming that there is only a single initial subgoal is a\n  very common error when implementing tactics!\n\n  Tactics with internal subgoal addressing should expose the subgoal\n  index as @{text \"int\"} argument in full generality; a hardwired\n  subgoal 1 is not acceptable.\n  \n  \\medskip The main well-formedness conditions for proper tactics are\n  summarized as follows.\n\n  \\begin{itemize}\n\n  \\item General tactic failure is indicated by an empty result, only\n  serious faults may produce an exception.\n\n  \\item The main conclusion must not be changed, apart from\n  instantiating schematic variables.\n\n  \\item A tactic operates either uniformly on all subgoals, or\n  specifically on a selected subgoal (without bumping into unrelated\n  subgoals).\n\n  \\item Range errors in subgoal addressing produce an empty result.\n\n  \\end{itemize}\n\n  Some of these conditions are checked by higher-level goal\n  infrastructure (\\secref{sec:struct-goals}); others are not checked\n  explicitly, and violating them merely results in ill-behaved tactics\n  experienced by the user (e.g.\\ tactics that insist in being\n  applicable only to singleton goals, or prevent composition via\n  standard tacticals such as @{ML REPEAT}).\n\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML_type tactic: \"thm -> thm Seq.seq\"} \\\\\n  @{index_ML no_tac: tactic} \\\\\n  @{index_ML all_tac: tactic} \\\\\n  @{index_ML print_tac: \"Proof.context -> string -> tactic\"} \\\\[1ex]\n  @{index_ML PRIMITIVE: \"(thm -> thm) -> tactic\"} \\\\[1ex]\n  @{index_ML SUBGOAL: \"(term * int -> tactic) -> int -> tactic\"} \\\\\n  @{index_ML CSUBGOAL: \"(cterm * int -> tactic) -> int -> tactic\"} \\\\\n  @{index_ML SELECT_GOAL: \"tactic -> int -> tactic\"} \\\\\n  @{index_ML PREFER_GOAL: \"tactic -> int -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item Type @{ML_type tactic} represents tactics.  The\n  well-formedness conditions described above need to be observed.  See\n  also @{file \"~~/src/Pure/General/seq.ML\"} for the underlying\n  implementation of lazy sequences.\n\n  \\item Type @{ML_type \"int -> tactic\"} represents tactics with\n  explicit subgoal addressing, with well-formedness conditions as\n  described above.\n\n  \\item @{ML no_tac} is a tactic that always fails, returning the\n  empty sequence.\n\n  \\item @{ML all_tac} is a tactic that always succeeds, returning a\n  singleton sequence with unchanged goal state.\n\n  \\item @{ML print_tac}~@{text \"ctxt message\"} is like @{ML all_tac}, but\n  prints a message together with the goal state on the tracing\n  channel.\n\n  \\item @{ML PRIMITIVE}~@{text rule} turns a primitive inference rule\n  into a tactic with unique result.  Exception @{ML THM} is considered\n  a regular tactic failure and produces an empty result; other\n  exceptions are passed through.\n\n  \\item @{ML SUBGOAL}~@{text \"(fn (subgoal, i) => tactic)\"} is the\n  most basic form to produce a tactic with subgoal addressing.  The\n  given abstraction over the subgoal term and subgoal number allows to\n  peek at the relevant information of the full goal state.  The\n  subgoal range is checked as required above.\n\n  \\item @{ML CSUBGOAL} is similar to @{ML SUBGOAL}, but passes the\n  subgoal as @{ML_type cterm} instead of raw @{ML_type term}.  This\n  avoids expensive re-certification in situations where the subgoal is\n  used directly for primitive inferences.\n\n  \\item @{ML SELECT_GOAL}~@{text \"tac i\"} confines a tactic to the\n  specified subgoal @{text \"i\"}.  This rearranges subgoals and the\n  main goal protection (\\secref{sec:tactical-goals}), while retaining\n  the syntactic context of the overall goal state (concerning\n  schematic variables etc.).\n\n  \\item @{ML PREFER_GOAL}~@{text \"tac i\"} rearranges subgoals to put\n  @{text \"i\"} in front.  This is similar to @{ML SELECT_GOAL}, but\n  without changing the main goal protection.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Resolution and assumption tactics \\label{sec:resolve-assume-tac}\\<close>\n\ntext \\<open>\\emph{Resolution} is the most basic mechanism for refining a\n  subgoal using a theorem as object-level rule.\n  \\emph{Elim-resolution} is particularly suited for elimination rules:\n  it resolves with a rule, proves its first premise by assumption, and\n  finally deletes that assumption from any new subgoals.\n  \\emph{Destruct-resolution} is like elim-resolution, but the given\n  destruction rules are first turned into canonical elimination\n  format.  \\emph{Forward-resolution} is like destruct-resolution, but\n  without deleting the selected assumption.  The @{text \"r/e/d/f\"}\n  naming convention is maintained for several different kinds of\n  resolution rules and tactics.\n\n  Assumption tactics close a subgoal by unifying some of its premises\n  against its conclusion.\n\n  \\medskip All the tactics in this section operate on a subgoal\n  designated by a positive integer.  Other subgoals might be affected\n  indirectly, due to instantiation of schematic variables.\n\n  There are various sources of non-determinism, the tactic result\n  sequence enumerates all possibilities of the following choices (if\n  applicable):\n\n  \\begin{enumerate}\n\n  \\item selecting one of the rules given as argument to the tactic;\n\n  \\item selecting a subgoal premise to eliminate, unifying it against\n  the first premise of the rule;\n\n  \\item unifying the conclusion of the subgoal to the conclusion of\n  the rule.\n\n  \\end{enumerate}\n\n  Recall that higher-order unification may produce multiple results\n  that are enumerated here.\n\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML resolve_tac: \"thm list -> int -> tactic\"} \\\\\n  @{index_ML eresolve_tac: \"thm list -> int -> tactic\"} \\\\\n  @{index_ML dresolve_tac: \"thm list -> int -> tactic\"} \\\\\n  @{index_ML forward_tac: \"thm list -> int -> tactic\"} \\\\\n  @{index_ML biresolve_tac: \"(bool * thm) list -> int -> tactic\"} \\\\[1ex]\n  @{index_ML assume_tac: \"Proof.context -> int -> tactic\"} \\\\\n  @{index_ML eq_assume_tac: \"int -> tactic\"} \\\\[1ex]\n  @{index_ML match_tac: \"Proof.context -> thm list -> int -> tactic\"} \\\\\n  @{index_ML ematch_tac: \"Proof.context -> thm list -> int -> tactic\"} \\\\\n  @{index_ML dmatch_tac: \"Proof.context -> thm list -> int -> tactic\"} \\\\\n  @{index_ML bimatch_tac: \"Proof.context -> (bool * thm) list -> int -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML resolve_tac}~@{text \"thms i\"} refines the goal state\n  using the given theorems, which should normally be introduction\n  rules.  The tactic resolves a rule's conclusion with subgoal @{text\n  i}, replacing it by the corresponding versions of the rule's\n  premises.\n\n  \\item @{ML eresolve_tac}~@{text \"thms i\"} performs elim-resolution\n  with the given theorems, which are normally be elimination rules.\n\n  Note that @{ML \"eresolve_tac [asm_rl]\"} is equivalent to @{ML\n  assume_tac}, which facilitates mixing of assumption steps with\n  genuine eliminations.\n\n  \\item @{ML dresolve_tac}~@{text \"thms i\"} performs\n  destruct-resolution with the given theorems, which should normally\n  be destruction rules.  This replaces an assumption by the result of\n  applying one of the rules.\n\n  \\item @{ML forward_tac} is like @{ML dresolve_tac} except that the\n  selected assumption is not deleted.  It applies a rule to an\n  assumption, adding the result as a new assumption.\n\n  \\item @{ML biresolve_tac}~@{text \"brls i\"} refines the proof state\n  by resolution or elim-resolution on each rule, as indicated by its\n  flag.  It affects subgoal @{text \"i\"} of the proof state.\n\n  For each pair @{text \"(flag, rule)\"}, it applies resolution if the\n  flag is @{text \"false\"} and elim-resolution if the flag is @{text\n  \"true\"}.  A single tactic call handles a mixture of introduction and\n  elimination rules, which is useful to organize the search process\n  systematically in proof tools.\n\n  \\item @{ML assume_tac}~@{text \"ctxt i\"} attempts to solve subgoal @{text i}\n  by assumption (modulo higher-order unification).\n\n  \\item @{ML eq_assume_tac} is similar to @{ML assume_tac}, but checks\n  only for immediate @{text \"\\<alpha>\"}-convertibility instead of using\n  unification.  It succeeds (with a unique next state) if one of the\n  assumptions is equal to the subgoal's conclusion.  Since it does not\n  instantiate variables, it cannot make other subgoals unprovable.\n\n  \\item @{ML match_tac}, @{ML ematch_tac}, @{ML dmatch_tac}, and @{ML\n  bimatch_tac} are similar to @{ML resolve_tac}, @{ML eresolve_tac},\n  @{ML dresolve_tac}, and @{ML biresolve_tac}, respectively, but do\n  not instantiate schematic variables in the goal state.%\n\\footnote{Strictly speaking, matching means to treat the unknowns in the goal\n  state as constants, but these tactics merely discard unifiers that would\n  update the goal state. In rare situations (where the conclusion and \n  goal state have flexible terms at the same position), the tactic\n  will fail even though an acceptable unifier exists.}\n  These tactics were written for a specific application within the classical reasoner.\n\n  Flexible subgoals are not updated at will, but are left alone.\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Explicit instantiation within a subgoal context\\<close>\n\ntext \\<open>The main resolution tactics (\\secref{sec:resolve-assume-tac})\n  use higher-order unification, which works well in many practical\n  situations despite its daunting theoretical properties.\n  Nonetheless, there are important problem classes where unguided\n  higher-order unification is not so useful.  This typically involves\n  rules like universal elimination, existential introduction, or\n  equational substitution.  Here the unification problem involves\n  fully flexible @{text \"?P ?x\"} schemes, which are hard to manage\n  without further hints.\n\n  By providing a (small) rigid term for @{text \"?x\"} explicitly, the\n  remaining unification problem is to assign a (large) term to @{text\n  \"?P\"}, according to the shape of the given subgoal.  This is\n  sufficiently well-behaved in most practical situations.\n\n  \\medskip Isabelle provides separate versions of the standard @{text\n  \"r/e/d/f\"} resolution tactics that allow to provide explicit\n  instantiations of unknowns of the given rule, wrt.\\ terms that refer\n  to the implicit context of the selected subgoal.\n\n  An instantiation consists of a list of pairs of the form @{text\n  \"(?x, t)\"}, where @{text ?x} is a schematic variable occurring in\n  the given rule, and @{text t} is a term from the current proof\n  context, augmented by the local goal parameters of the selected\n  subgoal; cf.\\ the @{text \"focus\"} operation described in\n  \\secref{sec:variables}.\n\n  Entering the syntactic context of a subgoal is a brittle operation,\n  because its exact form is somewhat accidental, and the choice of\n  bound variable names depends on the presence of other local and\n  global names.  Explicit renaming of subgoal parameters prior to\n  explicit instantiation might help to achieve a bit more robustness.\n\n  Type instantiations may be given as well, via pairs like @{text\n  \"(?'a, \\<tau>)\"}.  Type instantiations are distinguished from term\n  instantiations by the syntactic form of the schematic variable.\n  Types are instantiated before terms are.  Since term instantiation\n  already performs simple type-inference, so explicit type\n  instantiations are seldom necessary.\n\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML res_inst_tac: \"Proof.context -> (indexname * string) list -> thm -> int -> tactic\"} \\\\\n  @{index_ML eres_inst_tac: \"Proof.context -> (indexname * string) list -> thm -> int -> tactic\"} \\\\\n  @{index_ML dres_inst_tac: \"Proof.context -> (indexname * string) list -> thm -> int -> tactic\"} \\\\\n  @{index_ML forw_inst_tac: \"Proof.context -> (indexname * string) list -> thm -> int -> tactic\"} \\\\\n  @{index_ML subgoal_tac: \"Proof.context -> string -> int -> tactic\"} \\\\\n  @{index_ML thin_tac: \"Proof.context -> string -> int -> tactic\"} \\\\\n  @{index_ML rename_tac: \"string list -> int -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML res_inst_tac}~@{text \"ctxt insts thm i\"} instantiates the\n  rule @{text thm} with the instantiations @{text insts}, as described\n  above, and then performs resolution on subgoal @{text i}.\n  \n  \\item @{ML eres_inst_tac} is like @{ML res_inst_tac}, but performs\n  elim-resolution.\n\n  \\item @{ML dres_inst_tac} is like @{ML res_inst_tac}, but performs\n  destruct-resolution.\n\n  \\item @{ML forw_inst_tac} is like @{ML dres_inst_tac} except that\n  the selected assumption is not deleted.\n\n  \\item @{ML subgoal_tac}~@{text \"ctxt \\<phi> i\"} adds the proposition\n  @{text \"\\<phi>\"} as local premise to subgoal @{text \"i\"}, and poses the\n  same as a new subgoal @{text \"i + 1\"} (in the original context).\n\n  \\item @{ML thin_tac}~@{text \"ctxt \\<phi> i\"} deletes the specified\n  premise from subgoal @{text i}.  Note that @{text \\<phi>} may contain\n  schematic variables, to abbreviate the intended proposition; the\n  first matching subgoal premise will be deleted.  Removing useless\n  premises from a subgoal increases its readability and can make\n  search tactics run faster.\n\n  \\item @{ML rename_tac}~@{text \"names i\"} renames the innermost\n  parameters of subgoal @{text i} according to the provided @{text\n  names} (which need to be distinct identifiers).\n\n  \\end{description}\n\n  For historical reasons, the above instantiation tactics take\n  unparsed string arguments, which makes them hard to use in general\n  ML code.  The slightly more advanced @{ML Subgoal.FOCUS} combinator\n  of \\secref{sec:struct-goals} allows to refer to internal goal\n  structure with explicit context management.\n\\<close>\n\n\nsubsection \\<open>Rearranging goal states\\<close>\n\ntext \\<open>In rare situations there is a need to rearrange goal states:\n  either the overall collection of subgoals, or the local structure of\n  a subgoal.  Various administrative tactics allow to operate on the\n  concrete presentation these conceptual sets of formulae.\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML rotate_tac: \"int -> int -> tactic\"} \\\\\n  @{index_ML distinct_subgoals_tac: tactic} \\\\\n  @{index_ML flexflex_tac: \"Proof.context -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML rotate_tac}~@{text \"n i\"} rotates the premises of subgoal\n  @{text i} by @{text n} positions: from right to left if @{text n} is\n  positive, and from left to right if @{text n} is negative.\n\n  \\item @{ML distinct_subgoals_tac} removes duplicate subgoals from a\n  proof state.  This is potentially inefficient.\n\n  \\item @{ML flexflex_tac} removes all flex-flex pairs from the proof\n  state by applying the trivial unifier.  This drastic step loses\n  information.  It is already part of the Isar infrastructure for\n  facts resulting from goals, and rarely needs to be invoked manually.\n\n  Flex-flex constraints arise from difficult cases of higher-order\n  unification.  To prevent this, use @{ML res_inst_tac} to instantiate\n  some variables in a rule.  Normally flex-flex constraints can be\n  ignored; they often disappear as unknowns get instantiated.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Raw composition: resolution without lifting\\<close>\n\ntext \\<open>\n  Raw composition of two rules means resolving them without prior\n  lifting or renaming of unknowns.  This low-level operation, which\n  underlies the resolution tactics, may occasionally be useful for\n  special effects.  Schematic variables are not renamed by default, so\n  beware of clashes!\n\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML compose_tac: \"Proof.context -> (bool * thm * int) -> int -> tactic\"} \\\\\n  @{index_ML Drule.compose: \"thm * int * thm -> thm\"} \\\\\n  @{index_ML_op COMP: \"thm * thm -> thm\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML compose_tac}~@{text \"ctxt (flag, rule, m) i\"} refines subgoal\n  @{text \"i\"} using @{text \"rule\"}, without lifting.  The @{text\n  \"rule\"} is taken to have the form @{text \"\\<psi>\\<^sub>1 \\<Longrightarrow> \\<dots> \\<psi>\\<^sub>m \\<Longrightarrow> \\<psi>\"}, where\n  @{text \"\\<psi>\"} need not be atomic; thus @{text \"m\"} determines the\n  number of new subgoals.  If @{text \"flag\"} is @{text \"true\"} then it\n  performs elim-resolution --- it solves the first premise of @{text\n  \"rule\"} by assumption and deletes that assumption.\n\n  \\item @{ML Drule.compose}~@{text \"(thm\\<^sub>1, i, thm\\<^sub>2)\"} uses @{text \"thm\\<^sub>1\"},\n  regarded as an atomic formula, to solve premise @{text \"i\"} of\n  @{text \"thm\\<^sub>2\"}.  Let @{text \"thm\\<^sub>1\"} and @{text \"thm\\<^sub>2\"} be @{text\n  \"\\<psi>\"} and @{text \"\\<phi>\\<^sub>1 \\<Longrightarrow> \\<dots> \\<phi>\\<^sub>n \\<Longrightarrow> \\<phi>\"}.  The unique @{text \"s\"} that\n  unifies @{text \"\\<psi>\"} and @{text \"\\<phi>\\<^sub>i\"} yields the theorem @{text \"(\\<phi>\\<^sub>1 \\<Longrightarrow>\n  \\<dots> \\<phi>\\<^sub>i\\<^sub>-\\<^sub>1 \\<Longrightarrow> \\<phi>\\<^sub>i\\<^sub>+\\<^sub>1 \\<Longrightarrow> \\<dots> \\<phi>\\<^sub>n \\<Longrightarrow> \\<phi>)s\"}.  Multiple results are considered as\n  error (exception @{ML THM}).\n\n  \\item @{text \"thm\\<^sub>1 COMP thm\\<^sub>2\"} is the same as @{text \"Drule.compose\n  (thm\\<^sub>1, 1, thm\\<^sub>2)\"}.\n\n  \\end{description}\n\n  \\begin{warn}\n  These low-level operations are stepping outside the structure\n  imposed by regular rule resolution.  Used without understanding of\n  the consequences, they may produce results that cause problems with\n  standard rules and tactics later on.\n  \\end{warn}\n\\<close>\n\n\nsection \\<open>Tacticals \\label{sec:tacticals}\\<close>\n\ntext \\<open>A \\emph{tactical} is a functional combinator for building up\n  complex tactics from simpler ones.  Common tacticals perform\n  sequential composition, disjunctive choice, iteration, or goal\n  addressing.  Various search strategies may be expressed via\n  tacticals.\n\\<close>\n\n\nsubsection \\<open>Combining tactics\\<close>\n\ntext \\<open>Sequential composition and alternative choices are the most\n  basic ways to combine tactics, similarly to ``@{verbatim \",\"}'' and\n  ``@{verbatim \"|\"}'' in Isar method notation.  This corresponds to\n  @{ML_op \"THEN\"} and @{ML_op \"ORELSE\"} in ML, but there are further\n  possibilities for fine-tuning alternation of tactics such as @{ML_op\n  \"APPEND\"}.  Further details become visible in ML due to explicit\n  subgoal addressing.\n\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML_op \"THEN\": \"tactic * tactic -> tactic\"} \\\\\n  @{index_ML_op \"ORELSE\": \"tactic * tactic -> tactic\"} \\\\\n  @{index_ML_op \"APPEND\": \"tactic * tactic -> tactic\"} \\\\\n  @{index_ML \"EVERY\": \"tactic list -> tactic\"} \\\\\n  @{index_ML \"FIRST\": \"tactic list -> tactic\"} \\\\[0.5ex]\n\n  @{index_ML_op \"THEN'\": \"('a -> tactic) * ('a -> tactic) -> 'a -> tactic\"} \\\\\n  @{index_ML_op \"ORELSE'\": \"('a -> tactic) * ('a -> tactic) -> 'a -> tactic\"} \\\\\n  @{index_ML_op \"APPEND'\": \"('a -> tactic) * ('a -> tactic) -> 'a -> tactic\"} \\\\\n  @{index_ML \"EVERY'\": \"('a -> tactic) list -> 'a -> tactic\"} \\\\\n  @{index_ML \"FIRST'\": \"('a -> tactic) list -> 'a -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{text \"tac\\<^sub>1\"}~@{ML_op THEN}~@{text \"tac\\<^sub>2\"} is the sequential\n  composition of @{text \"tac\\<^sub>1\"} and @{text \"tac\\<^sub>2\"}.  Applied to a goal\n  state, it returns all states reachable in two steps by applying\n  @{text \"tac\\<^sub>1\"} followed by @{text \"tac\\<^sub>2\"}.  First, it applies @{text\n  \"tac\\<^sub>1\"} to the goal state, getting a sequence of possible next\n  states; then, it applies @{text \"tac\\<^sub>2\"} to each of these and\n  concatenates the results to produce again one flat sequence of\n  states.\n\n  \\item @{text \"tac\\<^sub>1\"}~@{ML_op ORELSE}~@{text \"tac\\<^sub>2\"} makes a choice\n  between @{text \"tac\\<^sub>1\"} and @{text \"tac\\<^sub>2\"}.  Applied to a state, it\n  tries @{text \"tac\\<^sub>1\"} and returns the result if non-empty; if @{text\n  \"tac\\<^sub>1\"} fails then it uses @{text \"tac\\<^sub>2\"}.  This is a deterministic\n  choice: if @{text \"tac\\<^sub>1\"} succeeds then @{text \"tac\\<^sub>2\"} is excluded\n  from the result.\n\n  \\item @{text \"tac\\<^sub>1\"}~@{ML_op APPEND}~@{text \"tac\\<^sub>2\"} concatenates the\n  possible results of @{text \"tac\\<^sub>1\"} and @{text \"tac\\<^sub>2\"}.  Unlike\n  @{ML_op \"ORELSE\"} there is \\emph{no commitment} to either tactic, so\n  @{ML_op \"APPEND\"} helps to avoid incompleteness during search, at\n  the cost of potential inefficiencies.\n\n  \\item @{ML EVERY}~@{text \"[tac\\<^sub>1, \\<dots>, tac\\<^sub>n]\"} abbreviates @{text\n  \"tac\\<^sub>1\"}~@{ML_op THEN}~@{text \"\\<dots>\"}~@{ML_op THEN}~@{text \"tac\\<^sub>n\"}.\n  Note that @{ML \"EVERY []\"} is the same as @{ML all_tac}: it always\n  succeeds.\n\n  \\item @{ML FIRST}~@{text \"[tac\\<^sub>1, \\<dots>, tac\\<^sub>n]\"} abbreviates @{text\n  \"tac\\<^sub>1\"}~@{ML_op ORELSE}~@{text \"\\<dots>\"}~@{ML_op \"ORELSE\"}~@{text\n  \"tac\\<^sub>n\"}.  Note that @{ML \"FIRST []\"} is the same as @{ML no_tac}: it\n  always fails.\n\n  \\item @{ML_op \"THEN'\"} is the lifted version of @{ML_op \"THEN\"}, for\n  tactics with explicit subgoal addressing.  So @{text\n  \"(tac\\<^sub>1\"}~@{ML_op THEN'}~@{text \"tac\\<^sub>2) i\"} is the same as @{text\n  \"(tac\\<^sub>1 i\"}~@{ML_op THEN}~@{text \"tac\\<^sub>2 i)\"}.\n\n  The other primed tacticals work analogously.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Repetition tacticals\\<close>\n\ntext \\<open>These tacticals provide further control over repetition of\n  tactics, beyond the stylized forms of ``@{verbatim \"?\"}''  and\n  ``@{verbatim \"+\"}'' in Isar method expressions.\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML \"TRY\": \"tactic -> tactic\"} \\\\\n  @{index_ML \"REPEAT\": \"tactic -> tactic\"} \\\\\n  @{index_ML \"REPEAT1\": \"tactic -> tactic\"} \\\\\n  @{index_ML \"REPEAT_DETERM\": \"tactic -> tactic\"} \\\\\n  @{index_ML \"REPEAT_DETERM_N\": \"int -> tactic -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML TRY}~@{text \"tac\"} applies @{text \"tac\"} to the goal\n  state and returns the resulting sequence, if non-empty; otherwise it\n  returns the original state.  Thus, it applies @{text \"tac\"} at most\n  once.\n\n  Note that for tactics with subgoal addressing, the combinator can be\n  applied via functional composition: @{ML \"TRY\"}~@{ML_op o}~@{text\n  \"tac\"}.  There is no need for @{verbatim TRY'}.\n\n  \\item @{ML REPEAT}~@{text \"tac\"} applies @{text \"tac\"} to the goal\n  state and, recursively, to each element of the resulting sequence.\n  The resulting sequence consists of those states that make @{text\n  \"tac\"} fail.  Thus, it applies @{text \"tac\"} as many times as\n  possible (including zero times), and allows backtracking over each\n  invocation of @{text \"tac\"}.  @{ML REPEAT} is more general than @{ML\n  REPEAT_DETERM}, but requires more space.\n\n  \\item @{ML REPEAT1}~@{text \"tac\"} is like @{ML REPEAT}~@{text \"tac\"}\n  but it always applies @{text \"tac\"} at least once, failing if this\n  is impossible.\n\n  \\item @{ML REPEAT_DETERM}~@{text \"tac\"} applies @{text \"tac\"} to the\n  goal state and, recursively, to the head of the resulting sequence.\n  It returns the first state to make @{text \"tac\"} fail.  It is\n  deterministic, discarding alternative outcomes.\n\n  \\item @{ML REPEAT_DETERM_N}~@{text \"n tac\"} is like @{ML\n  REPEAT_DETERM}~@{text \"tac\"} but the number of repetitions is bound\n  by @{text \"n\"} (where @{ML \"~1\"} means @{text \"\\<infinity>\"}).\n\n  \\end{description}\n\\<close>\n\ntext %mlex \\<open>The basic tactics and tacticals considered above follow\n  some algebraic laws:\n\n  \\begin{itemize}\n\n  \\item @{ML all_tac} is the identity element of the tactical @{ML_op\n  \"THEN\"}.\n\n  \\item @{ML no_tac} is the identity element of @{ML_op \"ORELSE\"} and\n  @{ML_op \"APPEND\"}.  Also, it is a zero element for @{ML_op \"THEN\"},\n  which means that @{text \"tac\"}~@{ML_op THEN}~@{ML no_tac} is\n  equivalent to @{ML no_tac}.\n\n  \\item @{ML TRY} and @{ML REPEAT} can be expressed as (recursive)\n  functions over more basic combinators (ignoring some internal\n  implementation tricks):\n\n  \\end{itemize}\n\\<close>\n\nML \\<open>\n  fun TRY tac = tac ORELSE all_tac;\n  fun REPEAT tac st = ((tac THEN REPEAT tac) ORELSE all_tac) st;\n\\<close>\n\ntext \\<open>If @{text \"tac\"} can return multiple outcomes then so can @{ML\n  REPEAT}~@{text \"tac\"}.  @{ML REPEAT} uses @{ML_op \"ORELSE\"} and not\n  @{ML_op \"APPEND\"}, it applies @{text \"tac\"} as many times as\n  possible in each outcome.\n\n  \\begin{warn}\n  Note the explicit abstraction over the goal state in the ML\n  definition of @{ML REPEAT}.  Recursive tacticals must be coded in\n  this awkward fashion to avoid infinite recursion of eager functional\n  evaluation in Standard ML.  The following attempt would make @{ML\n  REPEAT}~@{text \"tac\"} loop:\n  \\end{warn}\n\\<close>\n\nML \\<open>\n  (*BAD -- does not terminate!*)\n  fun REPEAT tac = (tac THEN REPEAT tac) ORELSE all_tac;\n\\<close>\n\n\nsubsection \\<open>Applying tactics to subgoal ranges\\<close>\n\ntext \\<open>Tactics with explicit subgoal addressing\n  @{ML_type \"int -> tactic\"} can be used together with tacticals that\n  act like ``subgoal quantifiers'': guided by success of the body\n  tactic a certain range of subgoals is covered.  Thus the body tactic\n  is applied to \\emph{all} subgoals, \\emph{some} subgoal etc.\n\n  Suppose that the goal state has @{text \"n \\<ge> 0\"} subgoals.  Many of\n  these tacticals address subgoal ranges counting downwards from\n  @{text \"n\"} towards @{text \"1\"}.  This has the fortunate effect that\n  newly emerging subgoals are concatenated in the result, without\n  interfering each other.  Nonetheless, there might be situations\n  where a different order is desired.\\<close>\n\ntext %mlref \\<open>\n  \\begin{mldecls}\n  @{index_ML ALLGOALS: \"(int -> tactic) -> tactic\"} \\\\\n  @{index_ML SOMEGOAL: \"(int -> tactic) -> tactic\"} \\\\\n  @{index_ML FIRSTGOAL: \"(int -> tactic) -> tactic\"} \\\\\n  @{index_ML HEADGOAL: \"(int -> tactic) -> tactic\"} \\\\\n  @{index_ML REPEAT_SOME: \"(int -> tactic) -> tactic\"} \\\\\n  @{index_ML REPEAT_FIRST: \"(int -> tactic) -> tactic\"} \\\\\n  @{index_ML RANGE: \"(int -> tactic) list -> int -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML ALLGOALS}~@{text \"tac\"} is equivalent to @{text \"tac\n  n\"}~@{ML_op THEN}~@{text \"\\<dots>\"}~@{ML_op THEN}~@{text \"tac 1\"}.  It\n  applies the @{text tac} to all the subgoals, counting downwards.\n\n  \\item @{ML SOMEGOAL}~@{text \"tac\"} is equivalent to @{text \"tac\n  n\"}~@{ML_op ORELSE}~@{text \"\\<dots>\"}~@{ML_op ORELSE}~@{text \"tac 1\"}.  It\n  applies @{text \"tac\"} to one subgoal, counting downwards.\n\n  \\item @{ML FIRSTGOAL}~@{text \"tac\"} is equivalent to @{text \"tac\n  1\"}~@{ML_op ORELSE}~@{text \"\\<dots>\"}~@{ML_op ORELSE}~@{text \"tac n\"}.  It\n  applies @{text \"tac\"} to one subgoal, counting upwards.\n\n  \\item @{ML HEADGOAL}~@{text \"tac\"} is equivalent to @{text \"tac 1\"}.\n  It applies @{text \"tac\"} unconditionally to the first subgoal.\n\n  \\item @{ML REPEAT_SOME}~@{text \"tac\"} applies @{text \"tac\"} once or\n  more to a subgoal, counting downwards.\n\n  \\item @{ML REPEAT_FIRST}~@{text \"tac\"} applies @{text \"tac\"} once or\n  more to a subgoal, counting upwards.\n\n  \\item @{ML RANGE}~@{text \"[tac\\<^sub>1, \\<dots>, tac\\<^sub>k] i\"} is equivalent to\n  @{text \"tac\\<^sub>k (i + k - 1)\"}~@{ML_op THEN}~@{text \"\\<dots>\"}~@{ML_op\n  THEN}~@{text \"tac\\<^sub>1 i\"}.  It applies the given list of tactics to the\n  corresponding range of subgoals, counting downwards.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Control and search tacticals\\<close>\n\ntext \\<open>A predicate on theorems @{ML_type \"thm -> bool\"} can test\n  whether a goal state enjoys some desirable property --- such as\n  having no subgoals.  Tactics that search for satisfactory goal\n  states are easy to express.  The main search procedures,\n  depth-first, breadth-first and best-first, are provided as\n  tacticals.  They generate the search tree by repeatedly applying a\n  given tactic.\\<close>\n\n\ntext %mlref \"\"\n\nsubsubsection \\<open>Filtering a tactic's results\\<close>\n\ntext \\<open>\n  \\begin{mldecls}\n  @{index_ML FILTER: \"(thm -> bool) -> tactic -> tactic\"} \\\\\n  @{index_ML CHANGED: \"tactic -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML FILTER}~@{text \"sat tac\"} applies @{text \"tac\"} to the\n  goal state and returns a sequence consisting of those result goal\n  states that are satisfactory in the sense of @{text \"sat\"}.\n\n  \\item @{ML CHANGED}~@{text \"tac\"} applies @{text \"tac\"} to the goal\n  state and returns precisely those states that differ from the\n  original state (according to @{ML Thm.eq_thm}).  Thus @{ML\n  CHANGED}~@{text \"tac\"} always has some effect on the state.\n\n  \\end{description}\n\\<close>\n\n\nsubsubsection \\<open>Depth-first search\\<close>\n\ntext \\<open>\n  \\begin{mldecls}\n  @{index_ML DEPTH_FIRST: \"(thm -> bool) -> tactic -> tactic\"} \\\\\n  @{index_ML DEPTH_SOLVE: \"tactic -> tactic\"} \\\\\n  @{index_ML DEPTH_SOLVE_1: \"tactic -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML DEPTH_FIRST}~@{text \"sat tac\"} returns the goal state if\n  @{text \"sat\"} returns true.  Otherwise it applies @{text \"tac\"},\n  then recursively searches from each element of the resulting\n  sequence.  The code uses a stack for efficiency, in effect applying\n  @{text \"tac\"}~@{ML_op THEN}~@{ML DEPTH_FIRST}~@{text \"sat tac\"} to\n  the state.\n\n  \\item @{ML DEPTH_SOLVE}@{text \"tac\"} uses @{ML DEPTH_FIRST} to\n  search for states having no subgoals.\n\n  \\item @{ML DEPTH_SOLVE_1}~@{text \"tac\"} uses @{ML DEPTH_FIRST} to\n  search for states having fewer subgoals than the given state.  Thus,\n  it insists upon solving at least one subgoal.\n\n  \\end{description}\n\\<close>\n\n\nsubsubsection \\<open>Other search strategies\\<close>\n\ntext \\<open>\n  \\begin{mldecls}\n  @{index_ML BREADTH_FIRST: \"(thm -> bool) -> tactic -> tactic\"} \\\\\n  @{index_ML BEST_FIRST: \"(thm -> bool) * (thm -> int) -> tactic -> tactic\"} \\\\\n  @{index_ML THEN_BEST_FIRST: \"tactic -> (thm -> bool) * (thm -> int) -> tactic -> tactic\"} \\\\\n  \\end{mldecls}\n\n  These search strategies will find a solution if one exists.\n  However, they do not enumerate all solutions; they terminate after\n  the first satisfactory result from @{text \"tac\"}.\n\n  \\begin{description}\n\n  \\item @{ML BREADTH_FIRST}~@{text \"sat tac\"} uses breadth-first\n  search to find states for which @{text \"sat\"} is true.  For most\n  applications, it is too slow.\n\n  \\item @{ML BEST_FIRST}~@{text \"(sat, dist) tac\"} does a heuristic\n  search, using @{text \"dist\"} to estimate the distance from a\n  satisfactory state (in the sense of @{text \"sat\"}).  It maintains a\n  list of states ordered by distance.  It applies @{text \"tac\"} to the\n  head of this list; if the result contains any satisfactory states,\n  then it returns them.  Otherwise, @{ML BEST_FIRST} adds the new\n  states to the list, and continues.\n\n  The distance function is typically @{ML size_of_thm}, which computes\n  the size of the state.  The smaller the state, the fewer and simpler\n  subgoals it has.\n\n  \\item @{ML THEN_BEST_FIRST}~@{text \"tac\\<^sub>0 (sat, dist) tac\"} is like\n  @{ML BEST_FIRST}, except that the priority queue initially contains\n  the result of applying @{text \"tac\\<^sub>0\"} to the goal state.  This\n  tactical permits separate tactics for starting the search and\n  continuing the search.\n\n  \\end{description}\n\\<close>\n\n\nsubsubsection \\<open>Auxiliary tacticals for searching\\<close>\n\ntext \\<open>\n  \\begin{mldecls}\n  @{index_ML COND: \"(thm -> bool) -> tactic -> tactic -> tactic\"} \\\\\n  @{index_ML IF_UNSOLVED: \"tactic -> tactic\"} \\\\\n  @{index_ML SOLVE: \"tactic -> tactic\"} \\\\\n  @{index_ML DETERM: \"tactic -> tactic\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML COND}~@{text \"sat tac\\<^sub>1 tac\\<^sub>2\"} applies @{text \"tac\\<^sub>1\"} to\n  the goal state if it satisfies predicate @{text \"sat\"}, and applies\n  @{text \"tac\\<^sub>2\"}.  It is a conditional tactical in that only one of\n  @{text \"tac\\<^sub>1\"} and @{text \"tac\\<^sub>2\"} is applied to a goal state.\n  However, both @{text \"tac\\<^sub>1\"} and @{text \"tac\\<^sub>2\"} are evaluated\n  because ML uses eager evaluation.\n\n  \\item @{ML IF_UNSOLVED}~@{text \"tac\"} applies @{text \"tac\"} to the\n  goal state if it has any subgoals, and simply returns the goal state\n  otherwise.  Many common tactics, such as @{ML resolve_tac}, fail if\n  applied to a goal state that has no subgoals.\n\n  \\item @{ML SOLVE}~@{text \"tac\"} applies @{text \"tac\"} to the goal\n  state and then fails iff there are subgoals left.\n\n  \\item @{ML DETERM}~@{text \"tac\"} applies @{text \"tac\"} to the goal\n  state and returns the head of the resulting sequence.  @{ML DETERM}\n  limits the search space by making its argument deterministic.\n\n  \\end{description}\n\\<close>\n\n\nsubsubsection \\<open>Predicates and functions useful for searching\\<close>\n\ntext \\<open>\n  \\begin{mldecls}\n  @{index_ML has_fewer_prems: \"int -> thm -> bool\"} \\\\\n  @{index_ML Thm.eq_thm: \"thm * thm -> bool\"} \\\\\n  @{index_ML Thm.eq_thm_prop: \"thm * thm -> bool\"} \\\\\n  @{index_ML size_of_thm: \"thm -> int\"} \\\\\n  \\end{mldecls}\n\n  \\begin{description}\n\n  \\item @{ML has_fewer_prems}~@{text \"n thm\"} reports whether @{text\n  \"thm\"} has fewer than @{text \"n\"} premises.\n\n  \\item @{ML Thm.eq_thm}~@{text \"(thm\\<^sub>1, thm\\<^sub>2)\"} reports whether @{text\n  \"thm\\<^sub>1\"} and @{text \"thm\\<^sub>2\"} are equal.  Both theorems must have the\n  same conclusions, the same set of hypotheses, and the same set of sort\n  hypotheses.  Names of bound variables are ignored as usual.\n\n  \\item @{ML Thm.eq_thm_prop}~@{text \"(thm\\<^sub>1, thm\\<^sub>2)\"} reports whether\n  the propositions of @{text \"thm\\<^sub>1\"} and @{text \"thm\\<^sub>2\"} are equal.\n  Names of bound variables are ignored.\n\n  \\item @{ML size_of_thm}~@{text \"thm\"} computes the size of @{text\n  \"thm\"}, namely the number of variables, constants and abstractions\n  in its conclusion.  It may serve as a distance function for\n  @{ML BEST_FIRST}.\n\n  \\end{description}\n\\<close>\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/Doc/Implementation/Tactic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5156199157230157, "lm_q2_score": 0.6076631698328916, "lm_q1q2_score": 0.31332323241721616}}
{"text": "theory OpSem_ProofRules\nimports Main OpSemSyntax_Def\nbegin\n\nlemmas defs [simp] =  Rd_def Let_def Wr_def Upd_def st_rd_def val_rd_def\n\n\nlemma read_pres_d_obs [simp]:\n  assumes \"wfs \\<sigma>\"\n    and \"[x =\\<^sub>t u] \\<sigma>\"\n  shows \"[x =\\<^sub>t u] (st_rd(Rd y t' b \\<sigma>))\"\n apply simp\n  using assms(1) assms(2) ext_d_obs_rd_pres3 by blast\n\n\nlemma read_pres_wfs [simp]:\n  assumes \"wfs \\<sigma>\"\n  shows \"wfs (st_rd(Rd x t b \\<sigma>))\"\n  by (simp add: assms read_pres_wfs)\n\nlemma write_pres_wfs [simp]:\n  assumes \"wfs \\<sigma>\"\n  shows \"wfs (Wr x v t b \\<sigma>)\"\n  by (simp add: assms write_pres_wfs)\n\n\nlemma update_pres_wfs [simp]:\n  assumes \"wfs \\<sigma>\"\n  shows \"wfs (st_rd(Upd x u t \\<sigma>))\"\n  by (simp add: assms update_pres_wfs)\n\n\nlemma ext_d_obs_d_obs [simp]:\n  assumes \"wfs \\<sigma>\"\n      and \"[x =\\<^sub>t v] \\<sigma>\"\n    shows\"[x =\\<^sub>t u] (Wr x u t b \\<sigma>)\"\n  using assms\n  apply simp\n  using assms(1) assms(2) ext_d_obs_d_obs by blast\n\n  \nlemma ext_upd_d_obs_d_obs [simp]:\n  assumes \"wfs \\<sigma>\"\n      and \"[x =\\<^sub>t v] \\<sigma>\"\n    shows\"[x =\\<^sub>t u] (st_rd(Upd x u t \\<sigma>))\"\n  apply simp \n  using assms ext_upd_d_obs_d_obs by blast\n\nlemma d_obs_read_value [simp]:\n  assumes \"wfs \\<sigma>\"\n    and \"[x =\\<^sub>t u] \\<sigma>\"\n  shows \"val_rd(Rd x t False \\<sigma>) = u\"\n  apply simp  \n  using assms(1) assms(2) d_obs_value by auto\n  \nlemma d_obs_diff_false [simp]:\n  assumes  \"[x =\\<^sub>t u] \\<sigma>\"\nand \"[x =\\<^sub>t' v] \\<sigma>\"\nand \"u \\<noteq> v\"\nshows \"False\"\n  using assms\n  by (simp add: d_obs_def d_obs_t_def)  \n\n\nlemma OG_14 [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \"[x =\\<^sub>t u] \\<sigma>\"\n  and \"[x =\\<^sub>t' v] \\<sigma>\"\n   and \"t \\<noteq> t'\"\n  and \"v \\<noteq> u\"\nshows \"[x =\\<^sub>t u] (Wr x u t' False \\<sigma>)\"\n  apply simp\n  using OpSemExtProof.d_obs_diff_false assms(1) assms(2) assms(3) assms(5) by blast\n \n\nlemma ext_write_other_pres_d_obs [simp]:\n  assumes \"wfs \\<sigma>\"\n      and \"[x =\\<^sub>t u] \\<sigma>\"\n      and \"y \\<noteq> x\"\n    shows\"[x =\\<^sub>t u] (Wr y v t' b \\<sigma>)\"\n  by (simp add: assms(1) assms(2) assms(3) ext_write_other_pres_d_obs)\n  \n\nlemma not_p_obs_other_pres_not_p_obs [simp]:\n  assumes \"wfs \\<sigma>\"\n      and \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\n      and \"y \\<noteq> x\"\n    shows \"\\<not>[x \\<approx>\\<^sub>t u] (Wr y v t' b \\<sigma>)\"\n  by (simp add: assms(1) assms(2) assms(3) not_p_obs_other_pres_not_p_obs)\n\n\nlemma not_p_obs_write_pres_c_obs_diff_var [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\n   and \"t \\<noteq> t'\"\n  and \"x \\<noteq> y\"\n  shows \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> (Wr y z t' b \\<sigma>)\"\n  by (simp add: assms(1) assms(2) assms(3) assms(4) not_p_obs_write_pres_c_obs_diff_var)\n\n\nlemma ext_c_obs_intro [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \"[y =\\<^sub>t v] \\<sigma>\"\n  and \"\\<not>[x \\<approx>\\<^sub>t' u] \\<sigma>\"\n  and \"x \\<noteq> y\"\n  and \"t \\<noteq> t'\"\n  shows \"[x = u]\\<lparr>y =\\<^sub>t' v\\<rparr> (Wr x u t True \\<sigma>)\"\n  by (simp add: assms(1) assms(2) assms(3) assms(4) assms(5) ext_c_obs_intro)\n\nlemma c_obs_read_pres [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> \\<sigma>\"\n  shows \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> (st_rd(Rd x t b \\<sigma>))\"\n  by (simp add: assms(1) assms(2) c_obs_read_pres)\n\n\nlemma c_obs_read_d_obs [simp]:\n  assumes \"wfs \\<sigma>\"\n      and \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> \\<sigma>\"\n      and \"val_rd(Rd x t True \\<sigma>) = u\"\n    shows \"[y =\\<^sub>t v] (st_rd(Rd x t True \\<sigma>))\"\n  using assms\n  apply simp\n  by (simp add: c_obs_read_d_obs)\n\n\nlemma p_obs_write_2 [simp]:\n  assumes \"wfs \\<sigma>\"\n  shows \"[x \\<approx>\\<^sub>t u] (Wr x u t b \\<sigma>)\"\n  using assms by simp \n\n\n\nlemma not_p_obs_read [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\nshows \"\\<not>[x \\<approx>\\<^sub>t u] (st_rd(Rd y t b \\<sigma>))\"\n  by (simp add: assms(1) assms(2)  not_p_obs_read)\n\nlemma d_obs_diff_c_obs [simp]:\n  assumes \"[x =\\<^sub>t z] \\<sigma>\"\n    and \"wfs \\<sigma>\"\n  and \"z \\<noteq> u\"\nshows \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> \\<sigma>\"\n  using assms\n  using d_obs_p_obs_agree not_p_obs_implies_c_obs by blast\n\nlemma d_obs_not_p_obs [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[x =\\<^sub>t z] \\<sigma>\"\n  and \"z \\<noteq> u\"\n  shows \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\n  using assms(1) assms(2) assms(3) d_obs_p_obs_agree by auto\n\n\nlemma init_rd_pres [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \" [init x u] \\<sigma>\"\n    shows \"[init x u]  (st_rd(Rd y t b \\<sigma>))\"\n  by (simp add: assms(1) assms(2)  init_rd_pres)\n\n\nlemma init_wr_pres [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \" [init x u] \\<sigma>\"\n    shows \"[init x u] (Wr y v t b \\<sigma>)\"\n    by (simp add: assms(1) assms(2)  init_wr_pres)\n\n\n\nlemma init_upd_pres [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \" [init x u] \\<sigma>\"\n    shows \"[init x u]  (st_rd(Upd y v t \\<sigma>))\"\n  by (simp add: assms(1) assms(2) init_upd_pres)\n\nlemma covered_wr_diif_var_pres [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \"cvd[x, u] \\<sigma>\"\n  and \"x \\<noteq> y\"\n  shows \"cvd[x, u] (Wr y v t b \\<sigma>)\"\n  by (simp add: assms(1) assms(2) assms(3)  covered_wr_diif_var_pres)\n\n\nlemma c_obs_pres_write_diff_var_ext [simp]:\n  assumes \"wfs \\<sigma>\"\n      and \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> \\<sigma>\"    \n      and \"x \\<noteq> z\"\n      and \"y \\<noteq> z\"   \n    shows \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> (Wr z v t b \\<sigma>)\"\n  by (simp add: assms(1) assms(2) assms(3) assms(4) c_obs_pres_write_diff_var_ext)\n\n\nlemma covered_update_pres_ext [simp]:\n  assumes \"cvd[x, u] \\<sigma>\"\n  and \"wfs \\<sigma>\"\nshows \"cvd[x, v] (st_rd(Upd x v t \\<sigma>))\"\n  apply simp \n  using assms(1) assms(2) ext_cvd_update_cvd by auto\n\nlemma update_diff_var_pres_dobs_ext [simp]:\n  assumes \"[x =\\<^sub>t u] \\<sigma>\"\n  and \"wfs \\<sigma>\"\n  and \"y \\<noteq> x\"\nshows \"[x =\\<^sub>t u] (st_rd(Upd y v t' \\<sigma>))\"\n  by (simp add: assms(1) assms(2) assms(3) update_diff_var_pres_dobs_ext)\n\n\nlemma ext_cvd_update_d_obs [simp]:\n  assumes \"wfs \\<sigma>\"\n      and \"[x = u]\\<lparr>y =\\<^sub>t v\\<rparr> \\<sigma>\"\n      and \"cvd[x, u] \\<sigma>\"\n      and \"x \\<noteq> y\"\n    shows \"[y =\\<^sub>t v] (st_rd(Upd x m t \\<sigma>))\"\n  apply simp \n  using assms(1) assms(2) assms(3) assms(4) ext_cvd_update_d_obs by blast  \n\nlemma ext_cvd_up_dobs [simp]: \n  assumes  \"cvd[x, u] \\<sigma>\"\n    and \"wfs \\<sigma>\"\n    shows \"[x =\\<^sub>t v] (st_rd(Upd x v t \\<sigma>))\"\n  apply simp \n  using assms(1) assms(2) ext_cvd_up_dobs by blast\n\nlemma ext_cvd_rd_pres [simp]:\n     assumes  \"cvd[x, u] \\<sigma>\"\n    and \"wfs \\<sigma>\"\n    shows \"cvd[x, u]  (st_rd(Rd y t b \\<sigma>))\"  \n  by (simp add: assms(1) assms(2)  ext_cvd_rd_pres)\n\n\n\nlemma ext_c_obs_Up_intro [simp]: \n  assumes  \"wfs \\<sigma>\"\n  and  \"[y =\\<^sub>t v] \\<sigma>\"\n  and  \" \\<not> [x \\<approx>\\<^sub>t' u] \\<sigma>\"\n  and  \"x \\<noteq> y\"  \n  and \"t' \\<noteq> t\"\nshows \"[x = u]\\<lparr>y =\\<^sub>t' v\\<rparr> (st_rd(Upd x u t \\<sigma>))\"\n  apply simp  \n  by (simp add: assms(1) assms(2) assms(3) assms(4) assms(5) ext_c_obs_Up_intro)\n\n\n\nlemma ext_c_obs_rdx_pres [simp]:\n  assumes  \"wfs \\<sigma>\"\n  and  \"[x = u]\\<lparr>y =\\<^sub>t' v\\<rparr> \\<sigma>\"\n  and  \"y \\<noteq> x\"  \n  and \"t \\<noteq> t'\"\nshows \"[x = u]\\<lparr>y =\\<^sub>t' v\\<rparr> (st_rd(Rd z t b \\<sigma>))\"\n  by (simp add: assms(1) assms(2) assms(3) assms(4)  ext_c_obs_rdx_pres)\n\n\nlemma ext_p_obs_contradiction [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\nand \"x \\<noteq> y\"\nand \"[x \\<approx>\\<^sub>t u] (st_rd(Rd y t' b \\<sigma>))\"\nshows \"False\"\n  using assms apply simp  \n  using ext_p_obs_contradiction by blast\n  \n\nlemma ext_d_obs_rd_pres [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[x =\\<^sub>t u] \\<sigma>\"\nshows \"[x =\\<^sub>t u] (st_rd(Rd y t' b \\<sigma>))\"\n  apply simp\n  using assms(1) assms(2) ext_d_obs_rd_pres3 by auto\n\n\n\nlemma ext_p_obs_rd_pres [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[x \\<approx>\\<^sub>t u] \\<sigma>\"\nand \" getVW \\<sigma> t' y = w\"\nand \"t \\<noteq> t'\"\nshows \"[x \\<approx>\\<^sub>t u] (st_rd(Rd y t' b \\<sigma>))\"\n  using assms\n  apply simp\n  apply(unfold p_obs_def read_trans_def)\n  apply(unfold rev_app_def Let_def update_thrView_def)\n  apply(simp add: value_def)\n  apply(case_tac \"syncing \\<sigma> w b\")\n   apply simp\n   apply(unfold visible_writes_def writes_on_def, simp)\n  by simp\n\n\nlemma p_obs_contradiction [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \"\\<not> [x \\<approx>\\<^sub>t v] \\<sigma>\"\n  and  \"[x \\<approx>\\<^sub>t v] (st_rd(Rd y t' b \\<sigma>))\"\n  shows \"False\"\n  using assms\n  apply simp\n  apply(unfold p_obs_def read_trans_def)\n  apply(unfold rev_app_def Let_def update_thrView_def)\n  apply(simp add: value_def)\n  using assms(2) assms(3) p_obs_contradiction by fastforce\n\nlemma amo_intro:\n  assumes \"wfs \\<sigma>\"\n    and \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\n    and \"getVWNC \\<sigma> t x = w\"\n    and \"getTS \\<sigma> w = ts'\"\n    and \"u \\<noteq> i\"\n  shows \"[\\<one>\\<^sub>x u] (write_trans t b w u \\<sigma> ts')\"\n  using assms\n  apply(simp add: no_val_def amo_def p_vorder_def value_def init_val_def)\n  apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  apply(intro allI impI)\n  apply(simp add: mo_def)\n  apply(intro conjI impI allI)\n    apply (subgoal_tac \"var w = x\")\n     apply simp\n     apply(elim conjE exE)\n     apply(unfold writes_on_def)\n apply simp \n     apply blast \n    apply simp\n  apply simp\n   apply auto[1]\n  apply simp\n  by blast\n\n\nlemma amo_intro_n [simp]:\n  assumes \"wfs \\<sigma>\"\n    and \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\n    and \"u \\<noteq> i\"\n  shows \"[\\<one>\\<^sub>x u] (Wr x u t b \\<sigma>)\"\n  apply simp   \n  using amo_intro assms(1) assms(2) assms(3) by auto\n\nlemma amo_wr_pres :\n  assumes \"wfs \\<sigma>\"\n    and \"[\\<one>\\<^sub>x u] \\<sigma>\"\n    and \"w = getVWNC \\<sigma> t x \"\n    and \"ts' = getTS \\<sigma> w\"\n    and \"u \\<noteq> v\"\n  shows \"[\\<one>\\<^sub>x u] (write_trans t b w v \\<sigma> ts')\"\n  using assms\n  apply(simp add: no_val_def amo_def p_vorder_def value_def init_val_def)\n  apply(intro allI impI)\n  apply(simp add: mo_def)\n  apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n     apply(unfold writes_on_def)\n  apply simp \n  by (smt write_record.select_convs(1))\n\nlemma amo_wr_pres_n [simp] :\n  assumes \"wfs \\<sigma>\"\n    and \"[\\<one>\\<^sub>x u] \\<sigma>\"\n    and \"u \\<noteq> v\"\n  shows \"[\\<one>\\<^sub>x u] (Wr x v t b \\<sigma>)\"\n  apply simp \n  by (simp add: amo_wr_pres assms(1) assms(2) assms(3))\n\n\nlemma no_val_contradition:\n  assumes \"wfs \\<sigma>\"\nand \"[init x i] \\<sigma>\"\nand \"\\<not>[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\nand \"u \\<noteq> i\"\nand \"getVWNC \\<sigma> t x = w\"\nand \"getTS \\<sigma> w = ts'\"\nand \"[\\<zero>\\<^sub>x u]\\<^sub>i (write_trans t b w v \\<sigma> ts')\"\nshows \"False\"\n  using assms\n  apply(simp add: no_val_def p_vorder_def value_def mo_def init_val_def)\n  apply(elim conjE exE impE)\n  apply(subgoal_tac \"var w = x\")\n  apply simp\n   apply(elim disjE conjE)\n    apply (metis  getVWNC_in_writes_on getTS_w_greater_tst_w order.asym w_in_writes_on_var w_not_in_writes_on)\n  apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n   apply(case_tac \"bb = ts'\")\n  apply simp  \n  apply (meson w_not_in_writes_on)  \n   apply simp \n   apply (smt w_not_in_writes_on)  \n  by (meson getVWNC_in_writes_on writes_on_var)\n\n\nlemma no_val_contradition_n [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[init x i] \\<sigma>\"\nand \"\\<not>[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\nand \"u \\<noteq> i\"\nand \"[\\<zero>\\<^sub>x u]\\<^sub>i (Wr x v t b \\<sigma>)\"\nshows \"False\"\n  using assms\n  apply simp\n  using no_val_contradition by blast\n\nlemma no_val_contradition_auto [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[init x i] \\<sigma>\"\nand \"\\<not>[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\nand \"u \\<noteq> i\"\nand \"w = getVWNC \\<sigma> t x \"\nand \"ts' = getTS \\<sigma> w \"\nand \"[\\<zero>\\<^sub>x u]\\<^sub>i (Wr x j t b \\<sigma>)\"\nshows \"[x  =\\<^sub>t' z] (Wr x j t b \\<sigma>)\"\n  using assms\n  apply simp\n  using no_val_contradition by blast\n\n\nlemma no_val_contradiction2:\nassumes \"wfs \\<sigma>\"\nand \"[\\<zero>\\<^sub>x  u]\\<^sub>i \\<sigma>\" \nand \"w = getVWNC \\<sigma> t x\"\nand \"ts'=  getTS \\<sigma> w\"\nand \"[\\<zero>\\<^sub>x u]\\<^sub>i (write_trans t b w u \\<sigma> ts')\"\nshows \"False\"\n  using assms \n  apply (simp add: no_val_def p_vorder_def mo_def value_def init_val_def)\n  apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  apply (unfold writes_on_def, simp)\n  apply(subgoal_tac \"var w = x\")\n   apply simp\n   apply(elim conjE exE)\n   apply(case_tac \"ba = ts'\")\n  apply simp  \n  apply (metis w_in_writes_on_var w_not_in_writes_on wfs_def)\n   apply simp \n   defer\n   apply (simp add: getVWNC_var)\nproof -\nfix ba :: rat and baa :: rat\nassume a1: \"ts' = getTS \\<sigma> (getVWNC \\<sigma> t x)\"\n  assume a2: \"w = getVWNC \\<sigma> t x\"\n  assume a3: \"\\<forall>ba. (ba = getTS \\<sigma> (getVWNC \\<sigma> t x) \\<longrightarrow> (\\<forall>ba. val (if ba = getTS \\<sigma> (getVWNC \\<sigma> t x) then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, ba)) = u \\<longrightarrow> u = i \\<longrightarrow> (x, ba) \\<in> surrey_state.writes \\<sigma> \\<longrightarrow> \\<not> getTS \\<sigma> (getVWNC \\<sigma> t x) < ba)) \\<and> ((x, ba) \\<in> surrey_state.writes \\<sigma> \\<longrightarrow> (\\<forall>bb. val (if bb = getTS \\<sigma> (getVWNC \\<sigma> t x) then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, bb)) = u \\<longrightarrow> val (if ba = getTS \\<sigma> (getVWNC \\<sigma> t x) then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, ba)) = i \\<longrightarrow> (bb = getTS \\<sigma> (getVWNC \\<sigma> t x) \\<longrightarrow> \\<not> ba < getTS \\<sigma> (getVWNC \\<sigma> t x)) \\<and> ((x, bb) \\<in> surrey_state.writes \\<sigma> \\<longrightarrow> \\<not> ba < bb)))\"\n  assume a4: \"val (if baa = getTS \\<sigma> (getVWNC \\<sigma> t x) then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, baa)) = i\"\n  assume a5: \"\\<forall>b. (b = getTS \\<sigma> (getVWNC \\<sigma> t x) \\<longrightarrow> baa \\<noteq> getTS \\<sigma> (getVWNC \\<sigma> t x) \\<longrightarrow> baa < getTS \\<sigma> (getVWNC \\<sigma> t x)) \\<and> ((x, b) \\<in> surrey_state.writes \\<sigma> \\<longrightarrow> baa \\<noteq> b \\<longrightarrow> baa < b)\"\n  assume a6: \"baa = getTS \\<sigma> (getVWNC \\<sigma> t x) \\<or> (x, baa) \\<in> surrey_state.writes \\<sigma>\"\n  assume a7: \"ba \\<noteq> getTS \\<sigma> (getVWNC \\<sigma> t x)\"\n  assume a8: \"(x, ba) \\<in> surrey_state.writes \\<sigma>\"\n  assume a9: \"val (mods \\<sigma> (x, ba)) = i\"\n  obtain bb :: bool where\n    f10: \"(\\<not> bb) = (\\<forall>X2. X2 \\<noteq> ts' \\<or> val (if X2 = ts' then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, X2)) \\<noteq> u)\"\n    by moura\nhave f11: \"getTS \\<sigma> w = ts'\"\n  using a2 a1 by meson\n  obtain bba :: bool where\n    f12: \"(\\<not> bba) = (\\<forall>X1. (\\<not> X1 < ts' \\<or> (x, X1) \\<notin> surrey_state.writes \\<sigma>) \\<or> val (if X1 = ts' then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, X1)) \\<noteq> i)\"\n    by moura\n  then have f13: \"\\<not> bba \\<or> \\<not> bb\"\n    using f11 f10 a3 a2 by blast\n  have f14: \"val (if baa = ts' then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, baa)) = i\"\n    using f11 a4 a2 by meson\n  have \"\\<not> bba\"\n    using f13 f10 by simp\n  then have f15: \"ts' = baa\"\n    using f14 f12 f11 a6 a5 a2 by (metis (no_types))\n  obtain bbb :: bool where\n    f16: \"(\\<not> bbb) = (\\<forall>X1. ((\\<not> ts' < X1 \\<or> (x, X1) \\<notin> surrey_state.writes \\<sigma>) \\<or> i \\<noteq> u) \\<or> val (if X1 = ts' then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, X1)) \\<noteq> u)\"\n    by moura\nthen have \"\\<not> bbb\"\nusing f11 a3 a2 by meson\n  then show ?thesis\n    using f16 f15 f14 f11 a9 a8 a7 a5 a2 by auto\nqed\n\n\n\nlemma no_val_contradition_auto2 [simp]:\nassumes \"wfs \\<sigma>\"\nand \"[\\<zero>\\<^sub>x  u]\\<^sub>i \\<sigma>\" \nand \"w = getVWNC \\<sigma> t x\"\nand \"ts'=  getTS \\<sigma> w\"\nand \"[\\<zero>\\<^sub>x u]\\<^sub>i (Wr x u t b \\<sigma>)\"\nshows \"[x  =\\<^sub>t' z]  (Wr x u t b \\<sigma>)\"\n  using assms\n  apply simp\n  using no_val_contradiction2 by blast\n\nlemma amo_wr_pres_diff_var:\n  assumes \"wfs \\<sigma>\"\n    and \"[\\<one>\\<^sub>x u] \\<sigma>\"\n    and \"w = getVWNC \\<sigma> t y \"\n    and \"ts' = getTS \\<sigma> w\"\n    and \"y \\<noteq> x\"\n  shows \"[\\<one>\\<^sub>x u] (write_trans t b w v \\<sigma> ts')\"\n  using assms\n  apply(simp add: amo_def p_vorder_def value_def mo_def)\n  apply(intro allI impI)\n  apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  apply(unfold writes_on_def, simp)\n  apply(subgoal_tac \"var w = y\", simp)\n   apply blast\n  using getVWNC_var by blast\n\nlemma amo_wr_pres_diff_var_n [simp]:\n  assumes \"wfs \\<sigma>\"\n    and \"[\\<one>\\<^sub>x u] \\<sigma>\"\n    and \"y \\<noteq> x\"\n  shows \"[\\<one>\\<^sub>x u] (Wr y v t b \\<sigma>)\"\n  apply simp \n  using amo_wr_pres_diff_var assms(1) assms(2) assms(3) by auto\n\nlemma amo_rd_pres [simp]:\n  assumes \"wfs \\<sigma>\"\n    and \"[\\<one>\\<^sub>x u] \\<sigma>\"\n  shows \"[\\<one>\\<^sub>x u] (st_rd(Rd y t b \\<sigma>))\"\n  using assms\n  by(simp add: amo_def p_vorder_def value_def)\n  \n\nlemma w_is: \"wfs \\<sigma> \\<Longrightarrow> tst w = ts \\<Longrightarrow> var w = x \\<Longrightarrow> w = (x, ts)\"  \n  using prod.exhaust_sel by blast\n\n\nlemma enc_intro:\n  assumes \"wfs \\<sigma>\"\nand \"w = getVW \\<sigma> t x\"\nand \"value \\<sigma> w = u\"\nshows \"[en x u]\\<^sub>t (read_trans t b w \\<sigma>)\"\n  using assms\n  apply (simp add: enc_t_def enc_def value_def)\n  apply(subgoal_tac \"var w  = x\")\n   defer\n  using getVW_var apply blast\n  apply(subgoal_tac \"tst w =  tst (getVW \\<sigma> t x)\")\n   defer\n   apply clarsimp\n    apply(subgoal_tac \"w = (x, tst (getVW \\<sigma> t x))\")\n   defer\n    using w_is apply blast\n  apply(rule_tac x = x in exI)\n  apply(rule_tac x = \"tst w\" in exI)\n    apply(intro conjI)\n   using getVW_in_writes_on apply auto[1]\n  apply(simp add: read_trans_def  rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)    \n     apply (simp add: ts_oride_def) \n    by simp\n\nlemma enc_intro_n [simp]:\n  assumes \"wfs \\<sigma>\"\nand \" (val_rd(Rd x t b \\<sigma>)) = u\"\nshows \"[en x u]\\<^sub>t (st_rd(Rd x t b \\<sigma>))\"\n  apply simp\n  using assms(1) assms(2) enc_intro by auto\n\nlemma enc_c_obs_intro:\n  assumes \"wfs \\<sigma>\"\nand \"w = getVW \\<sigma> t y\"\nand \"[y = u]\\<lparr>x =\\<^sub>t v\\<rparr> \\<sigma>\"\nand \"value \\<sigma> w = u\"\nand \"x \\<noteq> y\"\nshows \"[en x v]\\<^sub>t (read_trans t True w \\<sigma>)\"\n  using assms\n  apply(simp add: c_obs_def enc_def enc_t_def value_def)  \nproof -\n  assume a1: \"w = getVW \\<sigma> t y\"\nassume a2: \"wfs \\<sigma>\"\n  assume a3: \"\\<forall>w\\<in>visible_writes \\<sigma> t y. val (mods \\<sigma> w) = u \\<longrightarrow> d_obs \\<sigma> (modView \\<sigma> w) x v \\<and> releasing \\<sigma> w\"\n  assume a4: \"val (mods \\<sigma> (getVW \\<sigma> t y)) = u\"\n  then have \"\\<exists>n. [x =\\<^sub>t n] (read_trans t True w \\<sigma>)\"\n    using a2 a1 OpSemExtProof.c_obs_read_d_obs assms(3) value_def by blast\n  then show \"\\<exists>n r. (n, r) \\<in> writes_on \\<sigma> x \\<and> r \\<le> tst (thrView (read_trans t True (getVW \\<sigma> t y) \\<sigma>) t x) \\<and> val (mods \\<sigma> (n, r)) = v\"\n    using a4 a3 a2 a1 by (metis (no_types) d_obs_def d_obs_t_def getVW_in_vw lastWr_read_pres last_write_write_on old.prod.exhaust order_refl snd_conv value_def)\nqed\n \n\nlemma enc_c_obs_intro_n [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[y = u]\\<lparr>x =\\<^sub>t v\\<rparr> \\<sigma>\"\nand \" (val_rd(Rd y t True \\<sigma>)) = u\"\nand \"x \\<noteq> y\"\nshows \"[en x v]\\<^sub>t (st_rd(Rd y t True \\<sigma>))\"\n  apply simp\n  using assms(1) assms(2) assms(3) assms(4) enc_c_obs_intro by auto\n\nlemma no_val_read_pres :\n  assumes \"wfs \\<sigma>\"\n  and \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\n  and \"w = getVW \\<sigma> t y\"\nshows \"[\\<zero>\\<^sub>x u]\\<^sub>i (read_trans t b w \\<sigma>)\"\n  using assms\n  apply(simp add: no_val_def p_vorder_def init_val_def mo_def value_def)\n  done\n\nlemma no_val_read_pres_n [simp] :\n  assumes \"wfs \\<sigma>\"\n  and \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\n  shows \"[\\<zero>\\<^sub>x u]\\<^sub>i (st_rd(Rd y t b \\<sigma>))\"\n  apply simp \n  by (simp add: assms(1) assms(2) no_val_read_pres)\n\nlemma no_val_write_pres [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\n  and \"v \\<noteq> u\"\nand \"w = getVWNC \\<sigma> t y\"\nand \"ts' = getTS \\<sigma> w\"\n shows \"[\\<zero>\\<^sub>x u]\\<^sub>i (write_trans t b w v \\<sigma> ts')\"\n  using assms \n  apply(simp add: no_val_def p_vorder_def init_val_def mo_def value_def)\n  apply(elim conjE exE, intro conjI)\n   apply(rule_tac x = a in exI)\n   apply(rule_tac x = ba in exI)\n   apply(intro conjI)\n  apply(case_tac \"x = y\")\n      apply simp\n     apply(unfold writes_on_def)\n\n     apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n     apply blast\n     apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n    apply (metis dual_order.strict_trans getVWNC_in_visible_writes getTS_w_greater_tst_w subsetD visible_writes_in_writes w_is)\n     apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  \n   apply (metis getVWNC_var w_in_writes_on_var w_not_in_writes_on wfs_def)\n  apply(intro allI impI)\n     apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  by (smt write_record.select_convs(1))  \n\n\n\nlemma no_val_write_pres_n [simp]:\n  assumes \"wfs \\<sigma>\"\n      and \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\n      and \"v \\<noteq> u\"\n  shows \"[\\<zero>\\<^sub>x u]\\<^sub>i (Wr y v t b \\<sigma>)\"\n  apply simp  \n  by (simp add: assms(1) assms(2) assms(3))\n\n\n\nlemma dvorder_intro:\n  assumes \"wfs \\<sigma>\"\nand \"[init x i] \\<sigma>\"\n    and \"[\\<one>\\<^sub>x u] \\<sigma>\"\n    and \"[en x u]\\<^sub>t \\<sigma>\"\n    and \"[\\<zero>\\<^sub>x v]\\<^sub>i \\<sigma>\"\nand \"[x =\\<^sub>t u] \\<sigma>\"\nand \"w = getVWNC \\<sigma> t x\"\nand \"ts' = getTS \\<sigma> w\"\nand \"v \\<noteq> u\"\nand \"i \\<noteq> u\"\nand \"i \\<noteq> v\"\nshows \"[u \\<hookrightarrow>\\<^sub>x v] (write_trans t b w v \\<sigma> ts')\"\n  using assms\n    apply(subgoal_tac \"var w = x\")\n   defer\n   apply (simp add: getVWNC_var)\n  apply(simp add: no_val_def init_val_def enc_t_def enc_def amo_def d_vorder_def p_vorder_def mo_def d_obs_t_def)\n  apply(simp add: d_obs_def)\n  apply(intro conjI allI impI)\n    apply (metis w_in_writes_on_var)\n  apply(elim conjE disjE)  \n      apply simp\n  apply(simp add: value_def)\n    apply(simp add: value_def)\n     apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n    apply(subgoal_tac \"a = x\")\n     apply simp\n  apply(case_tac \"ba = getTS \\<sigma> (getVWNC \\<sigma> t x)\") \n      apply simp\n  apply simp  \n     apply (metis dual_order.trans getVWNC_lastWr getTS_w_greater_tst_w last_write_max2 less_eq_rat_def not_less_iff_gr_or_eq)\n  apply (meson w_in_writes_on_var)\n   apply(simp add: value_def)\n     apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  apply(case_tac \"a = x \\<and>\n               ba = getTS \\<sigma> (getVWNC \\<sigma> t x)\", simp)\n  apply(case_tac \"aa = x \\<and>\n               baa = getTS \\<sigma> (getVWNC \\<sigma> t x)\", simp) \n    apply (metis getVWNC_lastWr getts_greater_than last_write_max2)\n  apply simp \n   apply (metis w_in_writes_on_var w_is)\n  apply (simp add: value_def)\n  apply(rule_tac x = x in exI)\n  apply simp\n       apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  by (metis getVWNC_in_writes_on getVWNC_lastWr getts_greater_than w_is)\n\n\n\nlemma dvorder_intro_n [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[init x i] \\<sigma>\"\n    and \"[\\<one>\\<^sub>x u] \\<sigma>\"\n    and \"[en x u]\\<^sub>t \\<sigma>\"\n    and \"[\\<zero>\\<^sub>x v]\\<^sub>i \\<sigma>\"\nand \"[x =\\<^sub>t u] \\<sigma>\"\nand \"v \\<noteq> u\"\nand \"i \\<noteq> u\"\nand \"i \\<noteq> v\"\nshows \"[u \\<hookrightarrow>\\<^sub>x v] (Wr x v t b \\<sigma>)\"\n  apply simp  \n  using assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) assms(7) assms(8) assms(9) dvorder_intro by auto\n\nlemma pvorder_intro:\n  assumes \"wfs \\<sigma>\"\n    and \"[en x u]\\<^sub>t \\<sigma>\"\nand \"w = getVW \\<sigma> t x\"\nand \"value \\<sigma> w \\<noteq> u\"\nshows \"[u \\<leadsto>\\<^sub>x (value \\<sigma> w)] (read_trans t b w \\<sigma>)\"\n  using assms\n  apply(simp add: enc_t_def enc_def p_vorder_def  mo_def)\n  apply (subgoal_tac \"var w = x\")\n  defer\n  using getVW_var apply blast\n  apply(elim exE conjE)\n  apply (subgoal_tac \"a = x\")\n  defer\n  \n  using w_in_writes_on_var apply blast\n  apply simp\n  apply(rule_tac x = x in exI)\n  apply(rule_tac x = \"ba\" in exI)\n  apply(intro conjI)\n  \n  apply blast\n  apply(rule_tac x = \"tst w\" in exI)\n  apply(simp add: value_def)\n  apply(intro conjI)\n  \n  using getVW_in_writes_on w_is apply fastforce\n  \n  using w_is apply fastforce\n  apply(simp add: getVW_def obsW_def visible_writes_def)\n  by (smt assms(3) dual_order.antisym dual_order.trans getVW_in_vw mem_Collect_eq not_le_imp_less prod.collapse val_rd_def visible_writes_def writes_on_var)\n\n\nlemma pvorder_intro_n [simp]:\n  assumes \"wfs \\<sigma>\"\n    and \"[en x u]\\<^sub>t \\<sigma>\"\nand \"(val_rd(Rd x t b \\<sigma>)) \\<noteq> u\"\nshows \"[u \\<leadsto>\\<^sub>x (val_rd(Rd x t b \\<sigma>))](st_rd(Rd x t b \\<sigma>))\"\n  using assms \n  apply simp \n  using pvorder_intro by blast\n\n\nlemma no_val_contradiction:\n  assumes \"wfs \\<sigma>\"\nand \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\nand \"w = getVWNC \\<sigma> t x\"\nand \"ts' = getTS \\<sigma> w\"\nand \"[\\<zero>\\<^sub>x u]\\<^sub>i (write_trans t b w u \\<sigma> ts')\"\nshows \"False\"\n  using assms\n  apply(simp add: no_val_def p_vorder_def init_val_def value_def mo_def)\n  apply(elim conjE exE)\n  apply(unfold writes_on_def)\n apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  apply(subgoal_tac \"var w = x\", simp)\n   apply(case_tac \"ba = ts'\")\n    apply simp\n   apply(case_tac \"baa = ts'\")\n  apply simp\n     apply (metis w_in_writes_on_var w_not_in_writes_on wfs_def)\n    apply force\n   apply(case_tac \"baa = ts'\")\n  apply simp\n    apply force\n   apply simp\n  apply(elim conjE)\n   defer  \n  apply (simp add: getVWNC_var)\nproof -\nfix a :: nat and aa :: nat and ba :: rat and baa :: rat\n  assume a1: \"ts' = getTS \\<sigma> (getVWNC \\<sigma> t x)\"\n  assume \"w = getVWNC \\<sigma> t x\"\n  assume a2: \"\\<forall>ba. (ba = getTS \\<sigma> (getVWNC \\<sigma> t x) \\<longrightarrow> (\\<forall>ba. val (if ba = getTS \\<sigma> (getVWNC \\<sigma> t x) then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, ba)) = u \\<longrightarrow> u = i \\<longrightarrow> (x, ba) \\<in> surrey_state.writes \\<sigma> \\<longrightarrow> \\<not> getTS \\<sigma> (getVWNC \\<sigma> t x) < ba)) \\<and> ((x, ba) \\<in> surrey_state.writes \\<sigma> \\<longrightarrow> (\\<forall>bb. val (if bb = getTS \\<sigma> (getVWNC \\<sigma> t x) then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, bb)) = u \\<longrightarrow> val (if ba = getTS \\<sigma> (getVWNC \\<sigma> t x) then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, ba)) = i \\<longrightarrow> (bb = getTS \\<sigma> (getVWNC \\<sigma> t x) \\<longrightarrow> \\<not> ba < getTS \\<sigma> (getVWNC \\<sigma> t x)) \\<and> ((x, bb) \\<in> surrey_state.writes \\<sigma> \\<longrightarrow> \\<not> ba < bb)))\"\n  assume a3: \"\\<forall>b. (b = getTS \\<sigma> (getVWNC \\<sigma> t x) \\<longrightarrow> baa < getTS \\<sigma> (getVWNC \\<sigma> t x)) \\<and> ((x, b) \\<in> surrey_state.writes \\<sigma> \\<longrightarrow> baa \\<noteq> b \\<longrightarrow> baa < b)\"\n  assume a4: \"(aa, baa) \\<in> surrey_state.writes \\<sigma>\"\n  assume a5: \"aa = x\"\n  assume a6: \"val (mods \\<sigma> (x, baa)) = i\"\n  assume a7: \"baa \\<noteq> getTS \\<sigma> (getVWNC \\<sigma> t x)\"\n  obtain bb :: bool where\n    \"(\\<not> bb) = (\\<forall>X2. X2 \\<noteq> ts' \\<or> val (if X2 = ts' then \\<lparr>val = u, is_releasing = b\\<rparr> else mods \\<sigma> (x, X2)) \\<noteq> u)\"\n    by moura\n  then show ?thesis\nusing a7 a6 a5 a4 a3 a2 a1 by fastforce\nqed\n\nlemma no_val_contradiction_n [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\nand \"[\\<zero>\\<^sub>x u]\\<^sub>i (Wr x u t b \\<sigma>)\"\nshows \"False\"\n  using assms apply simp\n  using no_val_contradiction2 by blast\n\n\nlemma no_val_d_vorder_contradiction [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\n  and \"[u \\<hookrightarrow>\\<^sub>x  v] \\<sigma>\"\n  and \"u \\<noteq> v\"\n  and \"i\\<noteq>u\" \n  and \" i\\<noteq>v\"\n  shows \"False\"\n  using assms\n  apply(simp add: no_val_def d_vorder_def p_vorder_def init_val_def value_def)\n  apply(elim conjE)  \n  by metis\n\nlemma no_val_d_vorder_contradiction_auto [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \"[\\<zero>\\<^sub>x u]\\<^sub>i \\<sigma>\"\n  and \"[u \\<hookrightarrow>\\<^sub>x  v] \\<sigma>\"\n  and \"u \\<noteq> v\"\n  and \"i\\<noteq>u\" \n  and \" i\\<noteq>v\"\nshows \"[u \\<hookrightarrow>\\<^sub>x v] (Wr y z t b \\<sigma>)\"\n  apply simp\n  using assms(1) assms(2) assms(3) assms(4) assms(5) assms(6) no_val_d_vorder_contradiction by blast\n\n\n\nlemma d_vorder_wr_diff_var_pres:\n  assumes \"wfs \\<sigma>\"\nand \"w = getVWNC \\<sigma> t y\"\nand \"ts' = getTS \\<sigma> w\"\nand \"[u \\<hookrightarrow>\\<^sub>x  v] \\<sigma>\"\nand \"x \\<noteq> y\"\nshows \"[u \\<hookrightarrow>\\<^sub>x  v] (write_trans t b w z \\<sigma> ts')\"\n  using assms\n  apply(simp add: d_vorder_def p_vorder_def value_def)\n  apply(intro conjI allI impI, elim conjE)\n   apply(unfold mo_def)\n   apply(intro conjI)\n    apply (metis writes_on_var)\n   apply(subgoal_tac \"a = x\")\n   apply(subgoal_tac \"aa = x\")\n     apply(unfold writes_on_def)\n  apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  apply (simp add: getVWNC_var)\n  using w_in_writes_on_var writes_on_def apply blast\n  using w_in_writes_on_var writes_on_def apply blast\n  apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)  \n  by (simp add: getVWNC_var)\n\nlemma d_vorder_wr_diff_var_pres_n [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"w = getVWNC \\<sigma> t y\"\nand \"ts' = getTS \\<sigma> w\"\nand \"[u \\<hookrightarrow>\\<^sub>x  v] \\<sigma>\"\nand \"x \\<noteq> y\"\nshows \"[u \\<hookrightarrow>\\<^sub>x  v] (Wr y z t b \\<sigma>)\"\n  by (simp add: assms(1) assms(4) assms(5) d_vorder_wr_diff_var_pres)\n\nlemma enc_wr_prs:\n  assumes \"wfs \\<sigma>\"\n    and \"[en x u]\\<^sub>t \\<sigma>\"\n    and \"w = getVWNC \\<sigma> t' y\"\n    and \"ts = getTS \\<sigma> w\"\n  shows \"[en x u]\\<^sub>t (write_trans t' b w v \\<sigma> ts)\"\n  using assms\n  apply(simp add: enc_t_def enc_def value_def)\n  apply(elim exE conjE)\n   apply(rule_tac x = a in exI)\n  apply(rule_tac x = ba in exI)\n  apply(intro conjI)\n    apply simp\n  apply(case_tac \"t \\<noteq> t'\")\n   apply simp\n   apply simp\n  apply(simp add: getVWNC_def getTS_def vws_def vfs_def)\n   apply(intro impI)\n  apply (smt assms(3) assms(4) dual_order.trans getVWNC_in_visible_writes getVWNC_var getTS_w_greater_tst_w less_imp_le mem_Collect_eq visible_writes_def)\n  apply(simp add: getVWNC_def getTS_def vws_def vfs_def)\n  apply(case_tac \"t \\<noteq> t'\")\n   apply(case_tac \"x = y\")\n    apply simp\n  apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n    apply (metis assms(3) assms(4) w_in_writes_on_var w_not_in_writes_on)\n  apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n   apply (metis assms(3) getVWNC_var w_in_writes_on_var)\n  apply(simp add: write_trans_def rev_app_def update_mods_def update_wa_def update_modView_def update_thrView_def)\n  by (metis assms(1) assms(3) assms(4) getVWNC_in_writes_on w_in_writes_on_var w_not_in_writes_on  writes_on_var)\n  \n\nlemma enc_wr_prs_n [simp]:\n  assumes \"wfs \\<sigma>\"\n    and \"[en x u]\\<^sub>t \\<sigma>\"\n  shows \"[en x u]\\<^sub>t (Wr y v t' b \\<sigma>)\"\n  apply simp\n  by (simp add: assms(1) assms(2) enc_wr_prs)\n\nlemma enc_rd_prs:\n  assumes \"wfs \\<sigma>\"\n    and \"[en x u]\\<^sub>t \\<sigma>\"\n    and \"getVW \\<sigma> t' y = w\"\n  shows \"[en x u]\\<^sub>t (read_trans t' b w \\<sigma>)\"\n  using assms\n  apply(simp add: enc_t_def enc_def value_def)\n  apply(elim exE conjE)\n   apply(rule_tac x = a in exI)\n  apply(rule_tac x = ba in exI)\n  apply(intro conjI)\n    apply simp\n   defer\n   apply simp\n  apply(case_tac \"t \\<noteq> t'\")\n   apply simp\n  apply simp\n  apply (case_tac \"\\<not>syncing \\<sigma> w b\")\n   apply simp\n   apply(intro impI)\n   apply(simp add: getVW_def obsW_def)\n  apply (smt assms(3) dual_order.trans getVW_in_vw getVW_var mem_Collect_eq visible_writes_def)\n  apply simp\n  apply(simp add: getVW_def obsW_def ts_oride_def)\n  \n  by (smt assms(3) dual_order.trans getVW_in_vw getVW_var mem_Collect_eq visible_writes_def)\n\n\nlemma enc_rd_prs_n [simp]:\n  assumes \"wfs \\<sigma>\"\n    and \"[en x u]\\<^sub>t \\<sigma>\"\n  shows \"[en x u]\\<^sub>t (st_rd(Rd y t' b \\<sigma>))\"\n  apply simp\n  by (simp add: assms(1) assms(2) enc_rd_prs)\n\n\nlemma no_val_rd_contradiction [simp]: \n  \"wfs \\<sigma> \\<Longrightarrow>  \\<not>[\\<zero>\\<^sub>x  u]\\<^sub>i \\<sigma> \\<Longrightarrow> [\\<zero>\\<^sub>x  u]\\<^sub>i (st_rd(Rd y t b \\<sigma>)) \\<Longrightarrow> False\"\n  apply(simp add: no_val_def init_val_def p_vorder_def value_def)\n  by blast\n\nlemma p_vorder_wr_pres:\n  assumes \"wfs \\<sigma>\"\nand \"[u \\<leadsto>\\<^sub>x v] \\<sigma>\"\nand \"w = getVWNC \\<sigma> t y\"\nand \"ts' = getTS \\<sigma> w\"\nshows \"[u \\<leadsto>\\<^sub>x v] (write_trans t b w z \\<sigma> ts')\"\n  using assms\n  apply(simp add: p_vorder_def mo_def value_def)\n  apply(elim exE conjE)\n    apply(simp add: write_trans_def rev_app_def update_wa_def update_modView_def update_thrView_def update_mods_def)\n   apply(rule_tac x = a in exI)\n  apply(rule_tac x = ba in exI)\n  apply (intro conjI)\n\n  apply (metis getVWNC_var w_in_writes_on_var w_not_in_writes_on)\n  apply(unfold writes_on_def)\n  apply simp\n  by (metis getVWNC_var w_in_writes_on_var w_not_in_writes_on wfs_def)\n\n\nlemma p_vorder_wr_pres_n [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[u \\<leadsto>\\<^sub>x v] \\<sigma>\"\nshows \"[u \\<leadsto>\\<^sub>x v] (Wr y z t b \\<sigma>)\"\n  apply simp \n  by (simp add: assms(1) assms(2) p_vorder_wr_pres)\n\n\nlemma p_vorder_rd_pres [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[u \\<leadsto>\\<^sub>x v] \\<sigma>\"\nshows \"[u \\<leadsto>\\<^sub>x v] (st_rd(Rd y t b \\<sigma>))\"\n  using assms\n  by(simp add: p_vorder_def mo_def value_def)\n  \n\n\nlemma d_vorder_rd_prs [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[u \\<hookrightarrow>\\<^sub>x v] \\<sigma>\"\nshows \"[u \\<hookrightarrow>\\<^sub>x v]  (st_rd(Rd y t b \\<sigma>))\"\n  using assms \n  apply(simp add: d_vorder_def p_vorder_def value_def)\n  done\n\nlemma dorder_porder_contradiction [simp]:\n  assumes \"wfs \\<sigma>\"\n  and \"u \\<noteq> v\"\n  and \" [u \\<hookrightarrow>\\<^sub>x v] \\<sigma>\"\n  and \" [v \\<leadsto>\\<^sub>x u] \\<sigma> \"\n  shows \"False\"\n  using assms\n  apply (simp add: init_val_def amo_def p_vorder_def d_vorder_def)\n  apply(unfold  mo_def)\n  by (meson not_less_iff_gr_or_eq)\n\n\n\nlemma p_obs_contradiction_auto [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\nand \"w = getVW \\<sigma> t' x\"\nand \"[x \\<approx>\\<^sub>t u]  (st_rd(Rd x t' b \\<sigma>))\"\nshows \"False\"\n  using assms\n  apply simp\n  using OpSemExtProof.p_obs_contradiction by blast\n\nlemma wr_enc_intro [simp]:\n  assumes \"wfs \\<sigma>\"\nshows \"[en x u]\\<^sub>t (Wr x u t b \\<sigma>)\"\n  using assms\n  apply(simp add: enc_t_def enc_def)\n    apply(simp add: write_trans_def rev_app_def update_wa_def update_modView_def update_thrView_def update_mods_def value_def)\n  apply(intro conjI impI) \n   apply blast  \n  by (metis  getVWNC_var)\n\nlemma p_vorder_contradiction [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"[\\<one>\\<^sub>x u] \\<sigma>\"\nand \"[\\<one>\\<^sub>x v] \\<sigma>\"\nand \"[u \\<leadsto>\\<^sub>x v] \\<sigma>\"\nand \"[v \\<leadsto>\\<^sub>x  u] \\<sigma>\"\nshows \" False\"\n  using assms\n  apply(simp add: amo_def p_vorder_def value_def mo_def)\n  by (metis dual_order.asym less_linear w_in_writes_on_var)\n\n\nlemma not_pobs_contradiction [simp]:\n  assumes \"wfs \\<sigma>\"\nand \"\\<not>[x \\<approx>\\<^sub>t u] \\<sigma>\"\nand \"val_rd (Rd x t b \\<sigma>) = u\"\nshows \"False\"\n  using assms\n  by (simp add: not_p_obs_value)\n\n\n\n\n\nend", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/OpSem_ProofRules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443134, "lm_q2_score": 0.538983220687684, "lm_q1q2_score": 0.31331261199117677}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      XVcgEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \"Examples for Parallel Assignments\"\n\ntheory XVcgEx \nimports \"../XVcg\"\n\nbegin\n\nrecord \"globals\" =\n  \"G_'\"::\"nat\"\n  \"H_'\"::\"nat\"\n\nrecord 'g vars = \"'g state\" +\n  A_' :: nat\n  B_' :: nat\n  C_' :: nat\n  I_' :: nat\n  M_' :: nat\n  N_' :: nat\n  R_' :: nat\n  S_' :: nat\n  Arr_' :: \"nat list\"\n  Abr_':: string\n\nterm \"BASIC\n         \\<acute>A :== x,\n         \\<acute>B :== y        \n      END\"\n\nterm \"BASIC\n         \\<acute>G :== \\<acute>H,\n         \\<acute>H :== \\<acute>G        \n      END\"\n\nterm \"BASIC\n        LET (x,y) = (\\<acute>A,b);\n            z = \\<acute>B\n        IN \\<acute>A :== x,\n           \\<acute>G :== \\<acute>A + y + z\n      END\"\n\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>A = 0\\<rbrace> \n      \\<lbrace>\\<acute>A < 0\\<rbrace> \\<longmapsto> BASIC\n       LET (a,b,c) = foo \\<acute>A\n       IN \n            \\<acute>A :== a,\n            \\<acute>B :== b,\n            \\<acute>C :== c\n      END\n      \\<lbrace>\\<acute>A = x \\<and> \\<acute>B = y \\<and> \\<acute>C = c\\<rbrace>\"\napply vcg\noops\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>A = 0\\<rbrace> \n      \\<lbrace>\\<acute>A < 0\\<rbrace> \\<longmapsto> BASIC\n       LET (a,b,c) = foo \\<acute>A\n       IN \n            \\<acute>A :== a,\n            \\<acute>G :== b + \\<acute>B,\n            \\<acute>H :== c\n      END\n      \\<lbrace>\\<acute>A = x \\<and> \\<acute>G = y \\<and> \\<acute>H = c\\<rbrace>\"\napply vcg\noops\n\ndefinition foo:: \"nat \\<Rightarrow> (nat \\<times> nat \\<times> nat)\"\n  where \"foo n = (n,n+1,n+2)\"\n\nlemma \"\\<Gamma>\\<turnstile> \\<lbrace>\\<acute>A = 0\\<rbrace> \n      \\<lbrace>\\<acute>A < 0\\<rbrace> \\<longmapsto> BASIC\n       LET (a,b,c) = foo \\<acute>A\n       IN \n            \\<acute>A :== a,\n            \\<acute>G :== b + \\<acute>B,\n            \\<acute>H :== c\n      END\n      \\<lbrace>\\<acute>A = x \\<and> \\<acute>G = y \\<and> \\<acute>H = c\\<rbrace>\"\napply (vcg add: foo_def snd_conv fst_conv)\noops\n\nend\n", "meta": {"author": "LVPGroup", "repo": "TimSort", "sha": "16437b6b6e2df9f6d32b2a32be7d0d650d83f980", "save_path": "github-repos/isabelle/LVPGroup-TimSort", "path": "github-repos/isabelle/LVPGroup-TimSort/TimSort-16437b6b6e2df9f6d32b2a32be7d0d650d83f980/Simpl/ex/XVcgEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7154239957834733, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.31322943718418433}}
{"text": "theory \"ConstantStorage\" \n\nimports \n   \"InstructionAux\" \"../../ProgramInAvl\"\n\nbegin\n\ndeclare stack_1_1_op_def [simp del]\ndeclare jump_def [simp del]\n(*\ndeclare cut_memory.simps [simp del]\n*)\n\ntheorem lemma_stack_2_1_op :\n\"stack_2_1_op v c f = InstructionContinue nv \\<Longrightarrow>\n vctx_storage v = vctx_storage nv\"\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto split:option.split)\ndone\n\ntheorem lemma_stack_3_1_op :\n\"stack_3_1_op v c f = InstructionContinue nv \\<Longrightarrow>\n vctx_storage v = vctx_storage nv\"\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(simp)\napply(cases \"tl (tl (vctx_stack v))\")\napply(simp)\napply(auto)\ndone\n\ntheorem lemma_stack_1_1_op :\n\"stack_1_1_op v c f = InstructionContinue nv \\<Longrightarrow>\n vctx_storage v = vctx_storage nv\"\napply(auto simp:stack_1_1_op_def)\napply(cases \"vctx_stack v\")\napply(auto split:option.split)\ndone\n\ntheorem lemma_jump [simp] :\n\"jump v c = InstructionContinue nv \\<Longrightarrow>\n vctx_storage v = vctx_storage nv\"\napply(auto simp:jump_def)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"program_content (cctx_program c)\n                   (uint (hd (vctx_stack v)))\")\napply auto\napply(cases \"get_some (program_content (cctx_program c)\n                   (uint (hd (vctx_stack v))))\")\napply auto\napply(cases \"get_pc (program_content (cctx_program c)\n                   (uint (hd (vctx_stack v))))\")\napply auto\ndone\n\ntheorem lemma_jump_foo [simp] :\n\"jump (v\\<lparr>vctx_stack := a # lista\\<rparr>) c = InstructionContinue nv \\<Longrightarrow>\n vctx_storage v = vctx_storage nv\"\napply(auto simp:jump_def)\napply(cases \"program_content (cctx_program c)\n                   (uint a)\")\napply auto\napply(cases \"get_some (program_content (cctx_program c)\n                   (uint a))\")\napply auto\napply(cases \"get_pc (program_content (cctx_program c)\n                   (uint a))\")\napply auto\ndone\n\ntheorem no_modify_storage_aux :\n  \"inst \\<noteq> Storage SSTORE \\<Longrightarrow>\n   instruction_aux v c inst = InstructionContinue nv \\<Longrightarrow>\n   vctx_storage v = vctx_storage nv\"\napply(cases inst)\napply(auto simp:instruction_aux_def)\napply(cases \"get_bits (Some inst)\",\n   auto simp:lemma_stack_2_1_op lemma_stack_3_1_op lemma_stack_1_1_op)\napply(cases \"get_sarith (Some inst)\",\n   auto simp:lemma_stack_2_1_op lemma_stack_3_1_op lemma_stack_1_1_op)\napply(cases \"get_arith (Some inst)\",\n   auto simp:lemma_stack_2_1_op lemma_stack_3_1_op lemma_stack_1_1_op)\n\napply(auto simp:sha3_def)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto split:option.split)\napply(cases \"get_info (Some inst)\")\napply(auto simp:lemma_stack_2_1_op lemma_stack_3_1_op lemma_stack_1_1_op)\napply(cases \"index (vctx_stack v) (nat (uint (get_dup (Some inst))))\")\napply(auto split:option.split)\napply(cases \"get_memory (Some inst)\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto split:option.split)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto split:option.split)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto split:option.split)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"tl (tl (vctx_stack v))\")\napply(auto split:option.split)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"tl (tl (vctx_stack v))\")\napply(auto split:option.split)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"tl (tl (vctx_stack v))\")\napply(auto)\napply(cases \"tl (tl (tl (vctx_stack v)))\")\napply(auto split:option.split)\napply(cases \"get_storage (Some inst)\")\napply(auto simp:lemma_stack_2_1_op lemma_stack_3_1_op lemma_stack_1_1_op)\napply(cases \"get_pc (Some inst)\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto simp:strict_if_def split:option.split)\napply(cases \"hd (tl (vctx_stack v)) = 0\")\napply(auto simp:blockedInstructionContinue_def split:option.split)\n\napply(cases \"get_stack inst\")\napply(auto simp:lemma_stack_2_1_op lemma_stack_3_1_op lemma_stack_1_1_op)\napply(cases \"vctx_stack v\")\napply(auto split:option.split)\napply(cases \"index (vctx_stack v)\n              (nat (uint (get_swap (Some inst))))\")\napply(auto split:option.split)\napply(cases \"index (vctx_stack v) (Suc (nat (uint (get_swap (Some inst)))))\")\napply(auto split:option.split)\napply(cases \"index (vctx_stack v) 0\")\napply(auto split:option.split)\napply(cases \"get_log (Some inst)\")\napply(auto)\napply(cases \"get_misc (Some inst)\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"tl (tl (vctx_stack v))\")\napply(auto)\napply(cases \"vctx_balance v (cctx_this c) < hd (vctx_stack v)\")\napply(auto)\n\napply(cases \"vctx_stack v\")\napply(simp)\napply(cases \"tl (vctx_stack v)\")\napply(simp)\napply(cases \"tl (tl (vctx_stack v))\")\napply(simp)\napply(cases \"tl (tl (tl (vctx_stack v)))\")\napply(simp)\napply(cases \"tl (tl (tl (tl (vctx_stack v))))\")\napply(simp)\napply(cases \"tl (tl (tl (tl (tl (vctx_stack v)))))\")\napply(simp)\napply(cases \"tl (tl (tl (tl (tl (tl (vctx_stack v))))))\")\napply(auto)\napply(cases \"vctx_balance v (cctx_this c) <\n    hd (tl (tl (vctx_stack v)))\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"tl (tl (vctx_stack v))\")\napply(auto)\napply(cases \"tl (tl (tl (vctx_stack v)))\")\napply(auto)\napply(cases \"tl (tl (tl (tl (vctx_stack v))))\")\napply(auto)\napply(cases \"tl (tl (tl (tl (tl (vctx_stack v)))))\")\napply(auto)\napply(cases \"tl (tl (tl (tl (tl (tl (vctx_stack v))))))\")\napply(auto)\napply(cases \"vctx_balance v (cctx_this c) <\n    hd (tl (tl (vctx_stack v)))\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"tl (tl (vctx_stack v))\")\napply(auto)\napply(cases \"tl (tl (tl (vctx_stack v)))\")\napply(auto)\napply(cases \"tl (tl (tl (tl (vctx_stack v))))\")\napply(auto)\napply(cases \"tl (tl (tl (tl (tl (vctx_stack v)))))\")\napply(auto)\napply(cases \"vctx_balance v (cctx_this c) <\n    vctx_value_sent v\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\napply(cases \"tl (vctx_stack v)\")\napply(auto)\napply(cases \"vctx_stack v\")\napply(auto)\ndone\n\nlemma lemma_subtract : \n  \"subtract_gas x (InstructionContinue v) = InstructionContinue nv \\<Longrightarrow>\n   vctx_storage v = vctx_storage nv\"\napply auto\ndone\n\ntheorem no_modify_storage :\n  \"inst \\<noteq> Storage SSTORE \\<Longrightarrow>\n   instruction_sem v c inst = InstructionContinue nv \\<Longrightarrow>\n   vctx_storage v = vctx_storage nv\"\napply(subst (asm) inst_gas)\napply(cases \"instruction_aux v c inst\")\ndefer\napply(simp)\napply(simp)\n  by (metis lemma_subtract no_modify_storage_aux)\n\nend\n\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/example/termination/ConstantStorage.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7279754607093178, "lm_q2_score": 0.4301473485858429, "lm_q1q2_score": 0.31313671425967055}}
{"text": "(*  Title:      WhileGraphSSA.thy\n    Author:     Denis Lohner, Sebastian Ullrich\n*)\n\nsubsubsection {* Instantiation for a Simple While Language *}\n\ntheory WhileGraphSSA imports\nSingleInstruction_CFG\n\"$AFP/Slicing/While/AdditionalLemmas\"\n\"~~/src/HOL/Library/List_lexord\"\n\"~~/src/HOL/Library/Char_ord\"\nbegin\n\ninstantiation w_node :: ord\nbegin\n\nfun less_eq_w_node where\n  \"(_Entry_) \\<le> x = True\"\n| \"(_ n _) \\<le> x = (case x of\n     (_Entry_) \\<Rightarrow> False\n   | (_ m _) \\<Rightarrow> n \\<le> m\n   | (_Exit_) \\<Rightarrow> True)\"\n| \"(_Exit_) \\<le> x = (x = (_Exit_))\"\n\nfun less_w_node where\n  \"(_Entry_) < x = (x \\<noteq> (_Entry_))\"\n| \"(_ n _) < x = (case x of\n     (_Entry_) \\<Rightarrow> False\n   | (_ m _) \\<Rightarrow> n < m\n   | (_Exit_) \\<Rightarrow> True)\"\n| \"(_Exit_) < x = False\"\n\ninstance ..\nend\n\ninstance w_node :: linorder proof\n  fix x y z :: w_node\n\n  show \"x \\<le> x\" by (cases x) auto\n  show \"x \\<le> y \\<or> y \\<le> x\" by (cases x) (cases y, auto)+\n  show \"x < y \\<longleftrightarrow> x \\<le> y \\<and> \\<not> y \\<le> x\" by (cases x) (cases y, auto)+\n\n  assume \"x \\<le> y\" and \"y \\<le> z\"\n  thus \"x \\<le> z\" by (cases x, cases y, cases z) auto\n\n  assume \"x \\<le> y\" and \"y \\<le> x\"\n  thus \"x = y\" by (cases x) (cases y, auto)+\nqed\n\ndeclare Defs.simps [simp del]\ndeclare Uses.simps [simp del]\ndeclare Let_def [simp]\n\ndeclare finite_valid_nodes [simp, intro!]\n\nlemma finite_valid_edge [simp, intro!]: \"finite (Collect (valid_edge c))\"\n  unfolding valid_edge_def [abs_def]\napply (rule inj_on_finite [where f=\"\\<lambda>(f,d,t). (f,t)\" and B=\"Collect (valid_node c) \\<times> Collect (valid_node c)\"])\n  apply (rule inj_onI)\n  apply (auto intro: WCFG_edge_det)[1]\n apply (force simp: valid_node_def valid_edge_def)[1]\nby auto\n\nlemma uses_expr_finite: \"finite (rhs_aux e)\"\n  by (induction e) auto\n\nlemma uses_cmd_finite: \"finite (rhs c)\"\n  by (induction c) (auto intro: uses_expr_finite)\n\nlemma defs_cmd_finite: \"finite (lhs c)\"\n  by (induction c) auto\n\nlemma finite_labels': \"finite {(l,c). labels prog l c}\"\nproof -\n  have \"{l. \\<exists>c. labels prog l c} = fst ` {(l,c). labels prog l c}\"\n    by auto\n  with finite_labels [of prog] labels_det [of prog] show ?thesis\n    by (auto 4 4 intro: inj_onI dest: finite_imageD)\nqed\n\n\n\nlemma finite_Uses [simp, intro!]: \"finite (Uses c n)\"\n  unfolding Uses.simps\napply clarsimp\napply (rule_tac B=\"\\<Union>(rhs ` snd ` {(l,c'). labels c l c'})\" in finite_subset)\n apply fastforce\napply (rule finite_Union)\n apply (rule finite_imageI)+\n apply (rule finite_labels')\nby (clarsimp simp: uses_cmd_finite)\n\ndefinition \"while_cfg_\\<alpha>e c = Collect (valid_edge c)\"\ndefinition \"while_cfg_\\<alpha>n c = sorted_list_of_set (Collect (valid_node c))\"\ndefinition \"while_cfg_predecessors c t = (SOME ls. distinct ls \\<and> set ls = {sourcenode e| e. valid_edge c e \\<and> targetnode e = t})\"\ndefinition \"while_cfg_Entry c = (_Entry_)\"\ndefinition \"while_cfg_defs c = (Defs c)((_Entry_) := {v. \\<exists>n. v \\<in> Uses c n})\"\ndefinition \"while_cfg_uses c = Uses c\"\n\nabbreviation \"while_cfg_inEdges c t \\<equiv> map (\\<lambda>f. (f,(),t)) (while_cfg_predecessors c t)\"\n\nlemmas while_cfg_defs = while_cfg_\\<alpha>e_def while_cfg_\\<alpha>n_def\n  while_cfg_predecessors_def\n  while_cfg_Entry_def while_cfg_defs_def\n  while_cfg_uses_def\n\ninterpretation while: graph_path \"while_cfg_\\<alpha>n c\" \"while_cfg_predecessors c\"\n  for c :: cmd\napply unfold_locales\napply (simp_all add: while_cfg_defs graph_path_base.\\<alpha>e_def)[5]\n    apply (rule finite_subset [OF _ finite_imageI [OF finite_valid_edge [of \"c\"], where h=\"\\<lambda>(f,d,t). (f,(),t)\"]])\n    apply clarsimp\n    using sorted_list_of_set [of \"{n. \\<exists>a. valid_edge c (n, a, m)}\" for m]\n    apply (erule_tac x=m in meta_allE)\n    apply (erule meta_impE)\n     apply (rule finite_subset [OF _ finite_valid_nodes [of \"c\"]])\n     apply (fastforce simp: valid_node_def)\n    apply (case_tac \"n \\<in> {n. \\<exists>a. valid_edge c (n, a, m)}\")\n     prefer 2\n     apply clarsimp\n     apply (subgoal_tac \"n \\<notin> set (SOME ls. distinct ls \\<and> set ls = {n. \\<exists>a. valid_edge c (n, a, m)})\")\n      apply simp\n     apply (rule_tac a=\"sorted_list_of_set {n. \\<exists>a. valid_edge c (n, a, m)}\" in someI2)\n      using sorted_list_of_set [of \"{n. \\<exists>a. valid_edge c (n, a, m)}\" for m]\n      apply (erule_tac x=m in meta_allE)\n      apply (erule meta_impE)\n       apply (rule finite_subset [OF _ finite_valid_nodes [of \"c\"]])\n       apply (fastforce simp: valid_node_def)\n      apply simp\n     apply fastforce\n    apply (fastforce intro: rev_image_eqI)\n   apply clarsimp\n   apply (case_tac \"n \\<in> {n. \\<exists>a. valid_edge c (n, a, m)}\")\n    prefer 2\n    apply clarsimp\n    apply (subgoal_tac \"n \\<notin> set (SOME ls. distinct ls \\<and> set ls = {n. \\<exists>a. valid_edge c (n, a, m)})\")\n     apply simp\n    apply (rule_tac a=\"sorted_list_of_set {n. \\<exists>a. valid_edge c (n, a, m)}\" in someI2)\n     using sorted_list_of_set [of \"{n. \\<exists>a. valid_edge c (n, a, m)}\" for m]\n     apply (erule_tac x=m in meta_allE)\n     apply (erule meta_impE)\n      apply (rule finite_subset [OF _ finite_valid_nodes [of \"c\"]])\n      apply (fastforce simp: valid_node_def)\n     apply simp\n    apply fastforce\n   apply (fastforce simp: valid_node_def)\n  apply clarsimp\n  apply (case_tac \"n \\<in> {n. \\<exists>a. valid_edge c (n, a, m)}\")\n   prefer 2\n   apply clarsimp\n   apply (subgoal_tac \"n \\<notin> set (SOME ls. distinct ls \\<and> set ls = {n. \\<exists>a. valid_edge c (n, a, m)})\")\n    apply simp\n   apply (rule_tac a=\"sorted_list_of_set {n. \\<exists>a. valid_edge c (n, a, m)}\" in someI2)\n    using sorted_list_of_set [of \"{n. \\<exists>a. valid_edge c (n, a, m)}\" for m]\n    apply (erule_tac x=m in meta_allE)\n    apply (erule meta_impE)\n     apply (rule finite_subset [OF _ finite_valid_nodes [of \"c\"]])\n     apply (fastforce simp: valid_node_def)\n    apply simp\n   apply fastforce\n  apply (fastforce simp: valid_node_def)\n apply (rule set_iterator_I)\n   prefer 3 apply (simp add: foldri_def)\n  apply simp\n apply simp\napply (clarsimp simp: Graph_path.pred_def graph_path_base_base.inEdges_def)\napply (subgoal_tac \"{(v', w). (v', (), v) \\<in> graph_path_base.\\<alpha>e (while_cfg_predecessors c)}\n  = set (map (\\<lambda>m. (m, ())) (while_cfg_predecessors c v))\")\n apply (simp only:)\n apply (rule set_iterator_foldri_correct)\n apply (clarsimp simp: while_cfg_predecessors_def distinct_map)\n using sorted_list_of_set [of \"{n. \\<exists>a. valid_edge c (n, a, v)}\" for v]\n apply (erule_tac x=v in meta_allE)\n apply (erule meta_impE)\n  apply (rule finite_subset [OF _ finite_valid_nodes [of \"c\"]])\n  apply (fastforce simp: valid_node_def)\n apply (rule someI2 [where a=\"sorted_list_of_set {n. \\<exists>a. valid_edge c (n, a, v)}\" for v])\n  apply fastforce\n apply simp\nby (auto simp: graph_path_base.\\<alpha>e_def)\n\ndefinition \"gen_while_cfg c \\<equiv> \\<lparr>\n  gen_\\<alpha>n = while_cfg_\\<alpha>n c,\n  gen_predecessors = while_cfg_predecessors c,\n  gen_Entry = while_cfg_Entry c,\n  gen_defs = while_cfg_defs c,\n  gen_uses = while_cfg_uses c\n\\<rparr>\"\n\nlemma  while_path_graph_pathD: \"While_CFG.path c n es m \\<Longrightarrow> while.path2 c n (n#map targetnode es) m\"\n  unfolding while.path2_def\napply (induction n es m rule: While_CFG.path.induct)\n apply clarsimp\n apply (rule while.path.intros)\n apply (auto 4 4 simp: while_cfg_defs valid_node_def While_CFG.valid_node_def)[1]\napply clarsimp\napply (rule while.path.intros)\n apply assumption\napply clarsimp\napply (subst while_cfg_predecessors_def)\napply (rename_tac n ed m)\napply (rule_tac a=\"sorted_list_of_set {sourcenode e |e. valid_edge c e \\<and> targetnode e = m}\" in someI2)\n using sorted_list_of_set [of \"{sourcenode e |e. valid_edge c e \\<and> targetnode e = m}\" for m]\n apply (erule_tac x=m in meta_allE)\n apply (erule meta_impE)\n  apply (rule finite_subset [OF _ finite_valid_nodes [of \"c\"]])\n  apply (clarsimp simp: valid_node_def)\n  apply (rule_tac x=x in exI)\n  apply (rule_tac x=a in exI)\n  apply (rule_tac x=m in exI)\n  apply simp\n apply simp\napply clarsimp\nby (rule exI)\n\nlemma Uses_Entry [simp]: \"Uses c (_Entry_) = {}\"\n  unfolding Uses.simps by auto\n\nlemma in_Uses_valid_node: \"V \\<in> Uses c n \\<Longrightarrow> valid_node c n\"\n  by (auto dest!: label_less_num_inner_nodes less_num_nodes_edge\n    simp: Uses.simps valid_node_def valid_edge_def)\n\ninterpretation while_SI_CFG_wf:\n  SingleInstruction_CFG_wf \"while_cfg_\\<alpha>n cmd\" \"while_cfg_predecessors cmd\" \"while_cfg_Entry cmd\" \"while_cfg_defs cmd\" \"while_cfg_uses cmd\"\n  for cmd\napply unfold_locales\n       apply (clarsimp simp: while_cfg_defs)\n       using WCFG_intros(1) valid_edge_def valid_node_def apply auto[1]\n      apply (clarsimp simp: while_cfg_defs)\n      apply (subgoal_tac \"{n. \\<exists>a. valid_edge (cmd) (n, a, (_Entry_))} = {}\")\n       apply auto[1]\n      apply auto[1]\n     apply (subst(asm) while_cfg_\\<alpha>n_def)\n     apply simp\n     apply (drule valid_node_Entry_path)\n     apply clarsimp\n     apply (drule while_path_graph_pathD)\n     apply (auto simp: while_cfg_Entry_def)[1]\n    apply (clarsimp simp: while_cfg_defs)\n   apply (subgoal_tac \"{v. \\<exists>n. v \\<in> Uses (cmd) n} = (\\<Union>n \\<in> Collect (valid_node (cmd)). Uses (cmd) n)\")\n    apply simp\n   apply (auto dest: in_Uses_valid_node)[1]\n  apply (auto dest!: label_less_num_inner_nodes less_num_nodes_edge\n    simp: Uses.simps valid_node_def valid_edge_def while_cfg_defs)[1]\n apply (clarsimp simp: while_cfg_defs)\napply (clarsimp simp: SSA_CFG.CFG_wf_axioms_def CFG_base.defAss'_def)\napply (rule_tac x=\"(_Entry_)\" in bexI)\n apply (auto simp: while_cfg_defs)[1]\napply (cut_tac xs=ns in hd_in_butlast)\n apply (erule while.path2_cases)\n  apply (auto simp: while_cfg_Entry_def while_cfg_uses_def dest: while.path2_not_Nil3 \"while.path2_hd\")\ndone\n\nlift_definition si_while_cfg_wf :: \"cmd \\<Rightarrow> (w_node, vname) si_cfg_wf\"\n  is gen_while_cfg\n  unfolding gen_while_cfg_def\n  by simp unfold_locales\n\ndefinition \"build_ssa cmd = gen_ssa_wf_notriv_substAll (gen_ssa_cfg_wf (si_wf_disj_cfg_wf (si_while_cfg_wf cmd)))\"\n\nend\n", "meta": {"author": "lohner", "repo": "FormalSSA", "sha": "34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e", "save_path": "github-repos/isabelle/lohner-FormalSSA", "path": "github-repos/isabelle/lohner-FormalSSA/FormalSSA-34253ae0ea0db6ef78b644f41ab5e9d0bde6c32e/WhileGraphSSA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6791786861878392, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.3131127704838877}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Bisim\n  imports Weak_Late_Sim Strong_Late_Bisim\nbegin\n\nlemma monoAux: \"A \\<subseteq> B \\<Longrightarrow> P \\<leadsto>\\<^sup>^<A> Q \\<longrightarrow> P \\<leadsto>\\<^sup>^<B> Q\"\nby(auto intro: Weak_Late_Sim.monotonic)\n\ncoinductive_set weakBisim :: \"(pi \\<times> pi) set\"\nwhere\n  step: \"\\<lbrakk>P \\<leadsto>\\<^sup>^<weakBisim> Q; (Q, P) \\<in> weakBisim\\<rbrakk> \\<Longrightarrow> (P, Q) \\<in> weakBisim\"\nmonos monoAux\n\nabbreviation\n  \"weakBisimJudge\" (infixr \"\\<approx>\" 65)  where \"P \\<approx> Q \\<equiv> (P, Q) \\<in> weakBisim\"\n\nlemma weakBisimCoinductAux[case_names weakBisim, case_conclusion weakBisim step, consumes 1]:\n  assumes p: \"(P, Q) \\<in> X\"\n  and step:  \"\\<And>P Q. (P, Q) \\<in> X \\<Longrightarrow> P \\<leadsto>\\<^sup>^<(X \\<union> weakBisim)> Q \\<and> ((Q, P) \\<in> X \\<or> Q \\<approx> P)\"\n\n  shows \"P \\<approx> Q\"\nproof -\n  have aux: \"X \\<union> weakBisim = {(P, Q). (P, Q) \\<in> X \\<or> P \\<approx> Q}\" by blast\n\n  from p show ?thesis\n    by(coinduct, force dest: step simp add: aux)\nqed\n\nlemma weakBisimCoinduct[consumes 1, case_names cSim cSym]:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"(P, Q) \\<in> X\"\n  and     \"\\<And>P Q. (P, Q) \\<in> X \\<Longrightarrow> P \\<leadsto>\\<^sup>^<(X \\<union> weakBisim)> Q\"\n  and     \"\\<And>P Q. (P, Q) \\<in> X \\<Longrightarrow> (Q, P) \\<in> X\"\n\n  shows \"P \\<approx> Q\"\nusing assms\nby(coinduct rule: weakBisimCoinductAux) auto\n\nlemma weak_coinduct[case_names weakBisim, case_conclusion weakBisim step, consumes 1]:\n  assumes p: \"(P, Q) \\<in> X\"\n  and step:  \"\\<And>P Q. (P, Q) \\<in> X \\<Longrightarrow> P \\<leadsto>\\<^sup>^<X> Q \\<and> (Q, P) \\<in> X\"\n\n  shows \"P \\<approx> Q\"\nusing p\nproof(coinduct rule: weakBisimCoinductAux)\n  case (weakBisim P Q)\n  from step[OF this] show ?case using Weak_Late_Sim.monotonic by blast\nqed\n\nlemma weakBisimWeakCoinduct[consumes 1, case_names cSim cSym]:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"(P, Q) \\<in> X\"\n  and     \"\\<And>P Q. (P, Q) \\<in> X \\<Longrightarrow> P \\<leadsto>\\<^sup>^<X> Q\"\n  and     \"\\<And>P Q. (P, Q) \\<in> X \\<Longrightarrow> (Q, P) \\<in> X\"\n\n  shows \"P \\<approx> Q\"\nusing assms\nby(coinduct rule: weak_coinduct) auto\n\n\nlemma unfoldE:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<approx> Q\"\n  \n  shows \"P \\<leadsto>\\<^sup>^<weakBisim> Q\"\n  and   \"Q \\<approx> P\"\nusing assms\nby(auto intro: weakBisim.cases)\n\nlemma unfoldI:\n  fixes P :: pi\n  and   Q :: pi\n  \n  assumes \"P \\<leadsto>\\<^sup>^<weakBisim> Q\"\n  and     \"Q \\<approx> P\"\n\n  shows \"P \\<approx> Q\"\nusing assms\nby(auto intro: weakBisim.cases)\n\nlemma eqvt:\n  shows \"eqvt weakBisim\"\nproof(auto simp add: eqvt_def)\n  let ?X = \"{x. \\<exists>P Q (perm::name prm). P \\<approx> Q \\<and> x = (perm \\<bullet> P, perm \\<bullet> Q)}\"\n  fix P Q\n  fix perm::\"name prm\"\n  assume PBiSimQ: \"P \\<approx> Q\"\n\n  hence \"(perm \\<bullet> P, perm \\<bullet> Q) \\<in> ?X\" by blast\n  moreover have \"\\<And>P Q perm::name prm. \\<lbrakk>P \\<leadsto>\\<^sup>^<weakBisim> Q\\<rbrakk> \\<Longrightarrow> (perm \\<bullet> P) \\<leadsto>\\<^sup>^<?X> (perm \\<bullet> Q)\"\n  proof -\n    fix P Q\n    fix perm::\"name prm\"\n    assume \"P \\<leadsto>\\<^sup>^<weakBisim> Q\"\n\n    moreover have \"weakBisim \\<subseteq> ?X\"\n    proof(auto)\n      fix P Q\n      assume \"P \\<approx> Q\"\n      moreover have \"P = ([]::name prm) \\<bullet> P\" and \"Q = ([]::name prm) \\<bullet> Q\" by auto\n      ultimately show \"\\<exists>P' Q'. P' \\<approx> Q' \\<and> (\\<exists>(perm::name prm). P = perm \\<bullet> P' \\<and> Q = perm \\<bullet> Q')\"\n        by blast\n    qed\n\n    moreover have \"eqvt ?X\"\n    proof(auto simp add: eqvt_def)\n      fix P Q\n      fix perm1::\"name prm\"\n      fix perm2::\"name prm\"\n\n      assume \"P \\<approx> Q\"\n      moreover have \"perm1 \\<bullet> perm2 \\<bullet> P = (perm1 @ perm2) \\<bullet> P\" by(simp add: pt2[OF pt_name_inst])\n      moreover have \"perm1 \\<bullet> perm2 \\<bullet> Q = (perm1 @ perm2) \\<bullet> Q\" by(simp add: pt2[OF pt_name_inst])\n\n      ultimately show \"\\<exists>P' Q'. P' \\<approx> Q' \\<and> (\\<exists>(perm::name prm). perm1 \\<bullet> perm2 \\<bullet> P = perm \\<bullet> P' \\<and>\n                                                              perm1 \\<bullet> perm2 \\<bullet> Q = perm \\<bullet> Q')\"\n        by blast\n    qed\n\n    ultimately show \"(perm \\<bullet> P) \\<leadsto>\\<^sup>^<?X> (perm \\<bullet> Q)\"\n      by(rule Weak_Late_Sim.eqvtI)\n    qed\n\n    ultimately show \"(perm \\<bullet> P) \\<approx> (perm \\<bullet> Q)\" by(coinduct rule: weak_coinduct, blast dest: unfoldE)\nqed\n\nlemma eqvtI:\n  fixes P :: pi\n  and   Q :: pi\n  and   perm :: \"name prm\"\n\n  assumes \"P \\<approx> Q\"\n\n  shows \"(perm \\<bullet> P) \\<approx> (perm \\<bullet> Q)\"\nusing assms\nby(rule eqvtRelI[OF eqvt])\n\nlemma weakBisimEqvt[simp]:\n  shows \"eqvt weakBisim\"\nby(auto simp add: eqvt_def eqvtI)\n\nlemma strongBisimWeakBisim:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes PSimQ: \"P \\<sim> Q\"\n\n  shows \"P \\<approx> Q\"\nproof -\n  have \"\\<And>P Q. P \\<leadsto>[bisim] Q \\<Longrightarrow> P \\<leadsto>\\<^sup>^<(bisim \\<union> weakBisim)> Q\"\n  proof -\n    fix P Q\n    assume \"P \\<leadsto>[bisim] Q\"\n    hence \"P \\<leadsto>\\<^sup>^<bisim> Q\" by(rule strongSimWeakSim)\n    thus \"P \\<leadsto>\\<^sup>^<(bisim \\<union> weakBisim)> Q\"\n      by(blast intro: Weak_Late_Sim.monotonic)\n  qed\n\n  with PSimQ show ?thesis\n    by(coinduct rule: weakBisimCoinductAux, force dest: Strong_Late_Bisim.bisimE symmetric)\nqed\n\nlemma reflexive:\n  fixes P :: pi\n\n  shows \"P \\<approx> P\"\nproof -\n  have \"(P, P) \\<in> Id\" by simp\n  then show ?thesis\n\n  proof (coinduct rule: weak_coinduct)\n    case (weakBisim P Q)\n    have \"(P, Q) \\<in> Id\" by fact\n    thus ?case by(auto intro: Weak_Late_Sim.reflexive)\n  qed\nqed\n\n\n\n  shows \"Q \\<approx> P\"\nusing assms\nby(auto dest: unfoldE intro: unfoldI)\n\n\n\n  assumes PBiSimQ: \"P \\<approx> Q\"\n  and     QBiSimR: \"Q \\<approx> R\"\n\n  shows \"P \\<approx> R\"\nproof -\n  let ?X = \"weakBisim O weakBisim\"\n  from assms have \"(P, R) \\<in> ?X\" by blast\n  moreover have \"\\<And>P Q R. \\<lbrakk>Q \\<leadsto>\\<^sup>^<weakBisim> R; P \\<approx> Q\\<rbrakk> \\<Longrightarrow>\n                          P \\<leadsto>\\<^sup>^<(?X \\<union> weakBisim)> R\"\n  proof -\n    fix P Q R\n    assume PBiSimQ: \"P \\<approx> Q\"\n    assume \"Q \\<leadsto>\\<^sup>^<weakBisim> R\"\n    moreover have \"eqvt weakBisim\" by(rule eqvt)\n    moreover from eqvt have \"eqvt (?X \\<union> weakBisim)\" by(auto simp add: eqvtTrans)\n    moreover have \"weakBisim O weakBisim \\<subseteq> ?X \\<union> weakBisim\" by auto\n    moreover have \"\\<And>P Q. P \\<approx> Q \\<Longrightarrow> P \\<leadsto>\\<^sup>^<weakBisim> Q\" by(rule unfoldE)\n\n    ultimately show \"P \\<leadsto>\\<^sup>^<(?X \\<union> weakBisim)> R\" using PBiSimQ\n      by(rule Weak_Late_Sim.transitive)\n  qed\n\n  ultimately show ?thesis\n    apply(coinduct rule: weakBisimCoinduct, auto)\n    by(blast dest: unfoldE symmetric)+\nqed\n\n\nlemma transitive_coinduct_weak[case_names WeakBisimEarly, case_conclusion WeakBisimEarly step, consumes 2]:\n  assumes p: \"(P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and step: \"\\<And>P Q. (P, Q) \\<in> X \\<Longrightarrow> P \\<leadsto>\\<^sup>^<(bisim O X O bisim)> Q \\<and> (Q, P) \\<in> X\"\n\n  shows \"P \\<approx> Q\"\nproof -\n  let ?X = \"bisim O X O bisim\"\n\n  have Sim: \"\\<And>P P' Q' Q. \\<lbrakk>P \\<sim> P'; P'\\<leadsto>\\<^sup>^<?X> Q'; Q' \\<leadsto>[bisim] Q\\<rbrakk> \\<Longrightarrow>\n                          P \\<leadsto>\\<^sup>^<?X> Q\"\n  proof -\n    fix P P' Q' Q\n    assume PBisimP': \"P \\<sim> P'\"\n    assume P'SimQ': \"P' \\<leadsto>\\<^sup>^<?X> Q'\"\n    assume Q'SimQ: \"Q' \\<leadsto>[bisim] Q\"\n\n    show \"P \\<leadsto>\\<^sup>^<?X> Q\"\n    proof -\n      have \"P' \\<leadsto>\\<^sup>^<?X> Q\"\n      proof -\n        have \"?X O bisim \\<subseteq> ?X\" by(blast intro: Strong_Late_Bisim.transitive)\n        moreover from Strong_Late_Bisim.bisimEqvt Eqvt have \"eqvt ?X\" by blast\n        ultimately show ?thesis using P'SimQ' Q'SimQ by(blast intro: strongAppend)\n      qed\n      moreover have \"eqvt bisim\" by(rule Strong_Late_Bisim.bisimEqvt)\n      moreover from Strong_Late_Bisim.bisimEqvt Eqvt have \"eqvt ?X\" by blast\n      moreover have \"bisim O ?X \\<subseteq> ?X\" by(blast intro: Strong_Late_Bisim.transitive)\n      moreover have \"\\<And>P Q. P \\<sim> Q \\<Longrightarrow> P \\<leadsto>\\<^sup>^<bisim> Q\" by(blast dest: Strong_Late_Bisim.bisimE strongSimWeakSim)\n      ultimately show ?thesis using PBisimP' by(rule Weak_Late_Sim.transitive)\n    qed\n  qed\n\n  from p have \"(P, Q) \\<in> ?X\" by(blast intro: Strong_Late_Bisim.reflexive)\n  moreover from step Sim have \"\\<And>P Q. (P, Q) \\<in> ?X \\<Longrightarrow> P \\<leadsto>\\<^sup>^<?X> Q \\<and> (Q, P) \\<in> ?X\"\n    by(blast dest: Strong_Late_Bisim.bisimE Strong_Late_Bisim.symmetric)\n\n  ultimately show ?thesis by(rule weak_coinduct)\nqed\n\nlemma weakBisimTransitiveCoinduct[case_names cSim cSym, consumes 2]:\n  assumes p: \"(P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and rSim: \"\\<And>P Q. (P, Q) \\<in> X \\<Longrightarrow> P \\<leadsto>\\<^sup>^<(bisim O X O bisim)> Q\"\n  and rSym: \"\\<And>P Q. (P, Q) \\<in> X \\<Longrightarrow> (Q, P) \\<in> X\"\n\n  shows \"P \\<approx> Q\"\nusing assms\nby(coinduct rule: transitive_coinduct_weak) auto\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Late_Bisim.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984434543458, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.3130867168774901}}
{"text": "(*\n\nThis file deals with custom getters and setters in case of custom layouts.\nIt also register uvals read from the table file in the theory.\n\nThe two main functions are\n- generate_isa_getset_records_for_file: generates a direct and non monadic definition of custom\ngetters and setters by inspecting the C (monadic) definition\n\n- local_setup_getset_lemmas which generates the get/set lemmas and prove them (similarly\nto local_setup_take_put_member_case_esac_specialised_lemmas)\n\nTo show the get/set lemmas that ought to be proven, use the following snippset:\nML \\<open> val lems = mk_getset_lems \"variant_dargentisa.c\" @{context} \\<close>\nML \\<open>lems  |> map (string_of_getset_lem @{context})|> map tracing\\<close>\n\nThese get/set lemmas should be proven before the Take, Put, .. lemmas.\n\n\n*)\ntheory Complements\n  imports AutoCorres.AutoCorres\nbegin\n\nfind_theorems \"UCAST(_ \\<rightarrow> _) \"\n\nlemma unat_8 : \"unat (x :: 8 word) < 0x80000000\"\n  apply(unat_arith)\n  by (simp add: unat_ucast_up_simp)\n \nlemma unat_16 : \"unat (x :: 16 word) < 0x80000000\"\n  apply(unat_arith)\n  by (simp add: unat_ucast_up_simp)\n\n\n\n(* These lemmas seem necessary to prove some\nget/set lemmas (more exactly, to prove the correspondence between\nthe monadic and the direct definitions of custom getter/setters).\nIt is added to the set of simplification lemmas.\n\nStrangely enough, the statement \"unat (x :: 8 word) < 0x80000000\"\nis not enough for the proof of the get/set lemma.\n *)\nlemma unat_ucast_8  : \"unat (UCAST(('a :: len0) \\<rightarrow> 8)  x) < 0x80000000\"\n  by(rule unat_8)\nlemma unat_ucast_16 : \"unat (UCAST(('a :: len0) \\<rightarrow> 16) x) < 0x80000000\"\n  by(rule unat_16)\n\n\n(* Vincent's complements for his tactic *)\n\nlemma index_update_eq:\n  fixes f :: \"'a[('b :: finite)]\"\n  assumes \"k < CARD('b)\"\n  shows\n  \"(Arrays.update f n x.[k]) = (if n = k then x else f.[k])\"\n  using assms\n  by simp\n\nlemma ucast_and_distrib:\n  \"UCAST(('a::len) \\<rightarrow> ('b::len)) (a && b) = UCAST('a \\<rightarrow> 'b) a && UCAST('a \\<rightarrow> 'b) b\"\n  unfolding ucast_def Word.bitAND_word.abs_eq uint_and\n  by simp\n\nlemma neg_disj_pos_conj_iff:\n  \"\\<not> A \\<and> (A \\<or> B) \\<longleftrightarrow> \\<not> A \\<and> B\"\n  by blast\n\nlemma pos_disj_neg_conj_iff:\n  \"A \\<or> (\\<not>A \\<and> B) \\<longleftrightarrow> A \\<or> B\"\n  by blast\n\nlemma pos_disj_neg_conj_iff2:\n  \"A \\<or> (B \\<and> \\<not>A) \\<longleftrightarrow> A \\<or> B\"\n  by blast\n\nlemma posA_B_negA_iff:\n  \"A \\<or> B \\<or> \\<not> A \\<longleftrightarrow> True\"\n  by blast\n\n\nlemma xANDyANDx_eq: \"x && y && x = y && x\"\n  by (metis AND_twice word_bw_comms(1))\n\n\n\nlemma ucast_down_shiftr_distrib:\n  \"LENGTH('b) \\<le> LENGTH('a) \\<Longrightarrow> UCAST(('a::len) \\<rightarrow> ('b::len)) (a << n) = UCAST('a \\<rightarrow> 'b) a << n\"\n  apply (simp add: ucast_def uint_shiftl word_size shiftl_int_def)\n  apply (simp add: wi_bintr wi_hom_syms)\n  apply (simp add: shiftl_t2n word_of_int_2p)\n  done\n\nlemma ucast_up_shiftr_distrib:\n  \"LENGTH('b) \\<ge> LENGTH('a) \\<Longrightarrow> UCAST(('a::len) \\<rightarrow> ('b::len)) (a << n) = (UCAST('a \\<rightarrow> 'b) a << n) && mask LENGTH('a)\"\n  apply (simp add: ucast_def uint_shiftl word_size shiftl_int_def)\n  apply (simp add: and_mask_wi[symmetric])\n  apply (simp add: wi_hom_syms)\n  apply (simp add: shiftl_t2n word_of_int_2p)\n  apply (simp add: semiring_normalization_rules(7))\n  done\n\n\nlemma max_and_word_simps:\n  \"\\<And>a::8 word. 0xFF && a = a\"\n  \"\\<And>a::16 word. 0xFFFF && a = a\"\n  \"\\<And>a::32 word. 0xFFFFFFFF && a = a\"\n  \"\\<And>a::64 word. 0xFFFFFFFFFFFFFFFF && a = a\"\n  by (simp add: word_and_max_simps word_bw_comms)+\n\n(* \nVincent's tactic.\n\nOriginally, it is designed to prove the following get/set lemmas\nin the presence of variants:\n\n1. val_rel x v \\<Rightarrow> val_rel x (get_a (set_a p v))\n2. get_a \\<circ> set_b = get_a\n\nIt turns out that it may be working (for the second case) even when\nno variants are involved.\n\n*)\nML\\<open>\n(* This tactic was created using the \"throw things in and see if it works\" strategy.\n * Eventually, we should write something more principled. ~ v.j. / 2020-07-15\n *)\nfun solve_dargent_bitwise_tac ctxt tags_distinct i =\n  let\n  ; val reduce_variant1 (* only *) =  @{thms if_False if_True refl index_update_eq card_bit0 card_bit1}\n  ; val reduce_variant2 = tags_distinct @ @{thms disj_imp[symmetric] Inductive.imp_conj_iff\n                                 neg_disj_pos_conj_iff pos_disj_neg_conj_iff}\n  ; val word_distrib_simpset =\n    @{thms word_bool_alg.conj_disj_distrib word_bool_alg.conj_disj_distrib2\n           shiftr_over_or_dist shiftr_over_and_dist\n           shiftl_over_or_dist shiftl_over_and_dist\n           word_bool_alg.conj.assoc\n           word_bool_alg.disj.assoc\n           ucast_and_distrib ucast_or_distrib ucast_ucast_mask}\n  ; val word_simps2 =\n    @{thms xANDyANDx_eq and_mask2 word_size ucast_or_distrib mask_def ucast_id word_and_max_simps\n           max_and_word_simps}\n  ; val word_join_simps =\n    @{thms word_bool_alg.conj_disj_distrib[symmetric] word_and_max_simps max_and_word_simps}\n  ; val word_left_right_shift_simps =\n    @{thms and_mask2 and_not_mask[symmetric] mask_def\n           word_bool_alg.conj.assoc word_bool_alg.disj.assoc}\n  ; val cleanup_simps =\n    @{thms pos_disj_neg_conj_iff pos_disj_neg_conj_iff2 posA_B_negA_iff}\n   in ((simp_tac ((clear_simpset ctxt) addsimps reduce_variant1)\n        THEN' simp_tac ((clear_simpset ctxt) addsimps reduce_variant2)\n        THEN' (fn i => REPEAT_DETERM (DETERM (CHANGED (\n          (simp_tac ((clear_simpset ctxt) addsimps word_distrib_simpset)\n          THEN' simp_tac (ctxt addsimps word_simps2)\n          ) i\n        ))))\n        THEN' (fn i => (TRY (\n          (simp_tac (ctxt addsimps word_left_right_shift_simps)\n          THEN' simp_tac (ctxt addsimps word_join_simps)\n          THEN' (fn i => TRY (simp_tac (ctxt addsimps cleanup_simps) i))) i\n      )))) i)\n  end;\nfun getput_variant_tac ctxt tags_distinct =\n  let val tags_cleanup =\n    tags_distinct @ @{thms  if_False if_True refl disj_imp[symmetric] neg_disj_pos_conj_iff}\n   in TRYALL (fn i => CHANGED (\n        (simp_tac (ctxt addsimps tags_cleanup)\n        THEN' solve_dargent_bitwise_tac ctxt tags_distinct) i))\n  end;\n\\<close>\n\n\n\nend\n", "meta": {"author": "amblafont", "repo": "dargent-examples", "sha": "dbcfdd6573c088f65d4dade1b351b3bb2bc073e7", "save_path": "github-repos/isabelle/amblafont-dargent-examples", "path": "github-repos/isabelle/amblafont-dargent-examples/dargent-examples-dbcfdd6573c088f65d4dade1b351b3bb2bc073e7/Complements.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.3130867082017657}}
{"text": "theory CoCallImplTTreeSafe\nimports CoCallImplTTree CoCallAnalysisSpec TTreeAnalysisSpec\nbegin\n\nhide_const Multiset.single\n\nlemma valid_lists_many_calls:\n  assumes \"\\<not> one_call_in_path x p\"\n  assumes \"p \\<in> valid_lists S G\"\n  shows \"x--x \\<in> G\"\nusing assms(2,1)\nproof(induction rule:valid_lists.induct[case_names Nil Cons])\n  case Nil thus ?case by simp\nnext\n  case (Cons xs x')\n  show ?case\n  proof(cases \"one_call_in_path x xs\")\n    case False\n    from Cons.IH[OF this]\n    show ?thesis.\n  next\n    case True\n    with `\\<not> one_call_in_path x (x' # xs)`\n    have [simp]: \"x' = x\" by (auto split: if_splits)\n\n    have \"x \\<in> set xs\"\n    proof(rule ccontr)\n      assume \"x \\<notin> set xs\"\n      hence \"no_call_in_path x xs\" by (metis no_call_in_path_set_conv)\n      hence \"one_call_in_path x (x # xs)\" by simp\n      with Cons show False by simp\n    qed\n    with `set xs \\<subseteq> ccNeighbors x' G`\n    have \"x \\<in> ccNeighbors x G\" by auto\n    thus ?thesis by simp\n  qed\nqed\n\ncontext CoCallArityEdom\nbegin\n lemma carrier_Fexp': \"carrier (Texp e\\<cdot>a) \\<subseteq> fv e\"\n    unfolding Texp_simp carrier_ccTTree\n    by (rule Aexp_edom)\n\nend\n\n\ncontext CoCallAritySafe\nbegin\n\nlemma carrier_AnalBinds_below:\n  \"carrier ((Texp.AnalBinds  \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) x) \\<subseteq> edom ((ABinds \\<Delta>)\\<cdot>(Aheap \\<Delta> e\\<cdot>a))\"\nby (auto simp add: Texp.AnalBinds_lookup Texp_def split: option.splits \n         elim!: set_mp[OF edom_mono[OF monofun_cfun_fun[OF ABind_below_ABinds]]])\n\nsublocale TTreeAnalysisCarrier Texp\n  apply standard\n  unfolding Texp_simp carrier_ccTTree\n  apply standard\n  done\n\nsublocale TTreeAnalysisSafe Texp\nproof\n  fix x e a\n\n  from edom_mono[OF Aexp_App]\n  have \"{x} \\<union> edom (Aexp e\\<cdot>(inc\\<cdot>a)) \\<subseteq> edom (Aexp (App e x)\\<cdot>a)\" by auto\n  moreover\n  {\n  have \"ccApprox (many_calls x \\<otimes>\\<otimes> ccTTree (edom (Aexp e\\<cdot>(inc\\<cdot>a))) (ccExp e\\<cdot>(inc\\<cdot>a))) \n    = cc_restr (edom (Aexp e\\<cdot>(inc\\<cdot>a))) (ccExp e\\<cdot>(inc\\<cdot>a)) \\<squnion> ccProd {x} (insert x (edom (Aexp e\\<cdot>(inc\\<cdot>a))))\"\n    by (simp add: ccApprox_both ccProd_insert2[where S' = \"edom e\" for e])\n  also\n  have \"edom (Aexp e\\<cdot>(inc\\<cdot>a)) \\<subseteq> fv e\"\n    by (rule Aexp_edom)\n  also(below_trans[OF eq_imp_below join_mono[OF below_refl ccProd_mono2[OF insert_mono] ]])\n  have \"cc_restr (edom (Aexp e\\<cdot>(inc\\<cdot>a))) (ccExp e\\<cdot>(inc\\<cdot>a)) \\<sqsubseteq> ccExp e\\<cdot>(inc\\<cdot>a)\"\n    by (rule cc_restr_below_arg)\n  also\n  have \"ccExp e\\<cdot>(inc\\<cdot>a) \\<squnion> ccProd {x} (insert x (fv e)) \\<sqsubseteq> ccExp (App e x)\\<cdot>a\" \n    by (rule ccExp_App)\n  finally\n  have \"ccApprox (many_calls x \\<otimes>\\<otimes> ccTTree (edom (Aexp e\\<cdot>(inc\\<cdot>a))) (ccExp e\\<cdot>(inc\\<cdot>a))) \\<sqsubseteq> ccExp (App e x)\\<cdot>a\" by this simp_all\n  }\n  ultimately\n  show \"many_calls x \\<otimes>\\<otimes> Texp e\\<cdot>(inc\\<cdot>a) \\<sqsubseteq> Texp (App e x)\\<cdot>a\"\n    unfolding Texp_simp by (auto intro!: below_ccTTreeI)\nnext\n  fix y e n\n  show \"without y (Texp e\\<cdot>(pred\\<cdot>n)) \\<sqsubseteq> Texp (Lam [y]. e)\\<cdot>n\"\n    unfolding Texp_simp\n    by (auto dest: set_mp[OF Aexp_edom]\n             intro!: below_ccTTreeI  below_trans[OF _ ccExp_Lam] cc_restr_mono1 set_mp[OF edom_mono[OF Aexp_Lam]])\nnext\n  fix e y x a\n\n  from edom_mono[OF Aexp_subst]\n  have *: \"edom (Aexp e[y::=x]\\<cdot>a) \\<subseteq> insert x (edom (Aexp e\\<cdot>a) - {y})\" by simp\n\n  have \"Texp e[y::=x]\\<cdot>a = ccTTree (edom (Aexp e[y::=x]\\<cdot>a)) (ccExp e[y::=x]\\<cdot>a)\"\n    unfolding Texp_simp..\n  also have \"\\<dots> \\<sqsubseteq> ccTTree (insert x (edom (Aexp e\\<cdot>a) - {y})) (ccExp e[y::=x]\\<cdot>a)\"\n    by (rule ccTTree_mono1[OF *])\n  also have \"\\<dots> \\<sqsubseteq> many_calls x \\<otimes>\\<otimes> without x (\\<dots>)\"\n    by (rule paths_many_calls_subset)\n  also have \"without x (ccTTree (insert x (edom (Aexp e\\<cdot>a) - {y})) (ccExp e[y::=x]\\<cdot>a))\n    = ccTTree (edom (Aexp e\\<cdot>a) - {y} - {x}) (ccExp e[y::=x]\\<cdot>a)\"\n    by simp\n  also have \"\\<dots> \\<sqsubseteq> ccTTree (edom (Aexp e\\<cdot>a) - {y} - {x}) (ccExp e\\<cdot>a)\"\n    by (rule ccTTree_cong_below[OF ccExp_subst]) auto\n  also have \"\\<dots> = without y (ccTTree (edom (Aexp e\\<cdot>a) - {x}) (ccExp e\\<cdot>a))\"\n    by simp (metis Diff_insert Diff_insert2)\n  also have \"ccTTree (edom (Aexp e\\<cdot>a) - {x}) (ccExp e\\<cdot>a) \\<sqsubseteq> ccTTree (edom (Aexp e\\<cdot>a)) (ccExp e\\<cdot>a)\"\n    by (rule ccTTree_mono1) auto\n  also have \"\\<dots> = Texp e\\<cdot>a\"\n    unfolding Texp_simp..\n  finally\n  show \"Texp e[y::=x]\\<cdot>a \\<sqsubseteq> many_calls x \\<otimes>\\<otimes> without y (Texp e\\<cdot>a)\"\n    by this simp_all\nnext\n  fix v a\n  have \"up\\<cdot>a \\<sqsubseteq> (Aexp (Var v)\\<cdot>a) v\" by (rule Aexp_Var)\n  hence \"v \\<in> edom (Aexp (Var v)\\<cdot>a)\" by (auto simp add: edom_def)\n  thus \"single v \\<sqsubseteq> Texp (Var v)\\<cdot>a\"\n    unfolding Texp_simp\n    by (auto intro: below_ccTTreeI)\nnext\n  fix scrut e1 a e2\n  have \"ccTTree (edom (Aexp e1\\<cdot>a)) (ccExp e1\\<cdot>a) \\<oplus>\\<oplus> ccTTree (edom (Aexp e2\\<cdot>a)) (ccExp e2\\<cdot>a)\n    \\<sqsubseteq> ccTTree (edom (Aexp e1\\<cdot>a) \\<union> edom (Aexp e2\\<cdot>a)) (ccExp e1\\<cdot>a \\<squnion> ccExp e2\\<cdot>a)\"\n      by (rule either_ccTTree)\n  note both_mono2'[OF this]\n  also\n  have \"ccTTree (edom (Aexp scrut\\<cdot>0)) (ccExp scrut\\<cdot>0) \\<otimes>\\<otimes> ccTTree (edom (Aexp e1\\<cdot>a) \\<union> edom (Aexp e2\\<cdot>a)) (ccExp e1\\<cdot>a \\<squnion> ccExp e2\\<cdot>a)\n    \\<sqsubseteq> ccTTree (edom (Aexp scrut\\<cdot>0) \\<union> (edom (Aexp e1\\<cdot>a) \\<union> edom (Aexp e2\\<cdot>a))) (ccExp scrut\\<cdot>0 \\<squnion> (ccExp e1\\<cdot>a \\<squnion> ccExp e2\\<cdot>a) \\<squnion> ccProd (edom (Aexp scrut\\<cdot>0)) (edom (Aexp e1\\<cdot>a) \\<union> edom (Aexp e2\\<cdot>a)))\"\n    by (rule interleave_ccTTree)\n  also\n  have \"edom (Aexp scrut\\<cdot>0) \\<union> (edom (Aexp e1\\<cdot>a) \\<union> edom (Aexp e2\\<cdot>a)) = edom (Aexp scrut\\<cdot>0 \\<squnion> Aexp e1\\<cdot>a \\<squnion> Aexp e2\\<cdot>a)\" by auto\n  also\n  have \"Aexp scrut\\<cdot>0 \\<squnion> Aexp e1\\<cdot>a \\<squnion> Aexp e2\\<cdot>a \\<sqsubseteq> Aexp (scrut ? e1 : e2)\\<cdot>a\"\n    by (rule Aexp_IfThenElse)\n  also\n  have \"ccExp scrut\\<cdot>0 \\<squnion> (ccExp e1\\<cdot>a \\<squnion> ccExp e2\\<cdot>a) \\<squnion> ccProd (edom (Aexp scrut\\<cdot>0)) (edom (Aexp e1\\<cdot>a) \\<union> edom (Aexp e2\\<cdot>a)) \\<sqsubseteq>\n        ccExp (scrut ? e1 : e2)\\<cdot>a\"\n    by (rule ccExp_IfThenElse)\n  \n  show \"Texp scrut\\<cdot>0 \\<otimes>\\<otimes> (Texp e1\\<cdot>a \\<oplus>\\<oplus> Texp e2\\<cdot>a) \\<sqsubseteq> Texp (scrut ? e1 : e2)\\<cdot>a\"\n    unfolding Texp_simp\n    by (auto simp add: ccApprox_both join_below_iff  below_trans[OF _ join_above2]\n             intro!: below_ccTTreeI below_trans[OF cc_restr_below_arg]\n                     below_trans[OF _ ccExp_IfThenElse]  set_mp[OF edom_mono[OF Aexp_IfThenElse]])\nnext\n  fix e\n  assume \"isVal e\"\n  hence [simp]: \"ccExp e\\<cdot>0 = ccSquare (fv e)\" by (rule ccExp_pap)\n  thus \"repeatable (Texp e\\<cdot>0)\"\n    unfolding Texp_simp by (auto intro: repeatable_ccTTree_ccSquare[OF Aexp_edom])\nqed\n\ndefinition Theap :: \"heap \\<Rightarrow> exp \\<Rightarrow> Arity \\<rightarrow> var ttree\"\n  where \"Theap \\<Gamma> e = (\\<Lambda> a. if nonrec \\<Gamma> then ccTTree (edom (Aheap \\<Gamma> e\\<cdot>a)) (ccExp e\\<cdot>a) else ttree_restr (edom (Aheap \\<Gamma> e\\<cdot>a)) anything)\"\n\nlemma Theap_simp: \"Theap \\<Gamma> e\\<cdot>a = (if nonrec \\<Gamma> then ccTTree (edom (Aheap \\<Gamma> e\\<cdot>a)) (ccExp e\\<cdot>a) else ttree_restr (edom (Aheap \\<Gamma> e\\<cdot>a)) anything)\"\n  unfolding Theap_def by simp\n\nlemma carrier_Fheap':\"carrier (Theap \\<Gamma> e\\<cdot>a) = edom (Aheap \\<Gamma> e\\<cdot>a)\"\n    unfolding Theap_simp carrier_ccTTree by simp\n\nsublocale TTreeAnalysisCardinalityHeap Texp Aexp Aheap Theap\nproof\n  fix \\<Gamma> e a\n  show \"carrier (Theap \\<Gamma> e\\<cdot>a) = edom (Aheap \\<Gamma> e\\<cdot>a)\"\n    by (rule carrier_Fheap')\nnext\n  fix x \\<Gamma> p e a\n  assume \"x \\<in> thunks \\<Gamma>\"\n  \n  assume \"\\<not> one_call_in_path x p\"\n  hence \"x \\<in> set p\" by (rule more_than_one_setD)\n  \n  assume \"p \\<in> paths (Theap \\<Gamma> e\\<cdot>a)\" with `x \\<in> set p`\n  have \"x \\<in> carrier (Theap \\<Gamma> e\\<cdot>a)\" by (auto simp add: Union_paths_carrier[symmetric])\n  hence \"x \\<in> edom (Aheap \\<Gamma> e\\<cdot>a)\"\n    unfolding Theap_simp by (auto split: if_splits)\n  \n  show \"(Aheap \\<Gamma> e\\<cdot>a) x = up\\<cdot>0\"\n  proof(cases \"nonrec \\<Gamma>\")\n    case False\n    from False `x \\<in> thunks \\<Gamma>`  `x \\<in> edom (Aheap \\<Gamma> e\\<cdot>a)`\n    show ?thesis  by (rule aHeap_thunks_rec)\n  next\n    case True\n    with `p \\<in> paths (Theap \\<Gamma> e\\<cdot>a)`\n    have \"p \\<in> valid_lists (edom (Aheap \\<Gamma> e\\<cdot>a)) (ccExp e\\<cdot>a)\" by (simp add: Theap_simp)\n\n    with `\\<not> one_call_in_path x p`\n    have \"x--x\\<in> (ccExp e\\<cdot>a)\" by (rule valid_lists_many_calls)\n  \n    from True `x \\<in> thunks \\<Gamma>` this\n    show ?thesis by (rule aHeap_thunks_nonrec)\n  qed\nnext\n  fix \\<Delta> e a\n\n  have carrier: \"carrier (substitute (Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)) \\<subseteq> edom (Aheap \\<Delta> e\\<cdot>a) \\<union> edom (Aexp (Let \\<Delta> e)\\<cdot>a)\"\n  proof(rule carrier_substitute_below)\n    from edom_mono[OF Aexp_Let[of \\<Delta> e a]]\n    show \"carrier (Texp e\\<cdot>a) \\<subseteq> edom (Aheap \\<Delta> e\\<cdot>a) \\<union> edom (Aexp (Let \\<Delta> e)\\<cdot>a)\"  by (simp add: Texp_def)\n  next\n    fix x\n    assume \"x \\<in> edom (Aheap \\<Delta> e\\<cdot>a) \\<union> edom (Aexp (Let \\<Delta> e)\\<cdot>a)\"\n    hence \"x \\<in> edom (Aheap \\<Delta> e\\<cdot>a) \\<or> x : (edom (Aexp (Let \\<Delta> e)\\<cdot>a))\" by simp\n    thus \"carrier ((Texp.AnalBinds  \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) x) \\<subseteq> edom (Aheap \\<Delta> e\\<cdot>a) \\<union> edom (Aexp (Let \\<Delta> e)\\<cdot>a)\"\n    proof\n      assume \"x \\<in> edom (Aheap \\<Delta> e\\<cdot>a)\"\n      \n      have \"carrier ((Texp.AnalBinds  \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) x) \\<subseteq> edom (ABinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a))\"\n        by (rule carrier_AnalBinds_below)\n      also have \"\\<dots> \\<subseteq> edom (Aheap \\<Delta> e\\<cdot>a \\<squnion> Aexp (Terms.Let \\<Delta> e)\\<cdot>a)\"\n        using edom_mono[OF Aexp_Let[of \\<Delta> e a]] by simp\n      finally show ?thesis by simp\n    next\n      assume \"x \\<in> edom (Aexp (Terms.Let \\<Delta> e)\\<cdot>a)\"\n      hence \"x \\<notin> domA \\<Delta>\" by (auto  dest: set_mp[OF Aexp_edom])\n      hence \"(Texp.AnalBinds  \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) x = \\<bottom>\"\n        by (rule Texp.AnalBinds_not_there)\n      thus ?thesis by simp\n    qed\n  qed\n\n  show \"ttree_restr (- domA \\<Delta>) (substitute (Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)) \\<sqsubseteq> Texp (Let \\<Delta> e)\\<cdot>a\"\n  proof (rule below_trans[OF _ eq_imp_below[OF Texp_simp[symmetric]]], rule below_ccTTreeI)\n    have \"carrier (ttree_restr (- domA \\<Delta>) (substitute (Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)))\n       = carrier (substitute (Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)) - domA \\<Delta>\" by auto\n    also note carrier\n    also have \"edom (Aheap \\<Delta> e\\<cdot>a) \\<union> edom (Aexp (Terms.Let \\<Delta> e)\\<cdot>a) - domA \\<Delta> = edom (Aexp (Let \\<Delta> e)\\<cdot>a)\"\n      by (auto dest: set_mp[OF edom_Aheap] set_mp[OF Aexp_edom])\n    finally\n    show \"carrier (ttree_restr (- domA \\<Delta>) (substitute (Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>)(Texp e\\<cdot>a)))\n          \\<subseteq> edom (Aexp (Terms.Let \\<Delta> e)\\<cdot>a)\" by this auto\n  next\n    let ?x = \"ccApprox (ttree_restr (- domA \\<Delta>) (substitute (Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)))\"\n  \n    have \"?x = cc_restr (- domA \\<Delta>) ?x\"  by simp\n    also have \"\\<dots> \\<sqsubseteq> cc_restr (- domA \\<Delta>) (ccHeap \\<Delta> e\\<cdot>a)\"\n    proof(rule cc_restr_mono2[OF wild_recursion_thunked])\n      have \"ccExp e\\<cdot>a \\<sqsubseteq> ccHeap \\<Delta> e\\<cdot>a\" by (rule ccHeap_Exp)\n      thus \"ccApprox (Texp e\\<cdot>a) \\<sqsubseteq> ccHeap \\<Delta> e\\<cdot>a\"\n        by (auto simp add: Texp_simp intro: below_trans[OF cc_restr_below_arg])\n    next\n      fix x\n      assume \"x \\<notin> domA \\<Delta>\"\n      thus \"(Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) x = empty\"\n        by (metis Texp.AnalBinds_not_there empty_is_bottom)\n    next\n      fix x\n      assume \"x \\<in> domA \\<Delta>\"\n      then obtain e' where e': \"map_of \\<Delta> x = Some e'\" by (metis domA_map_of_Some_the)\n      \n      show \"ccApprox ((Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) x) \\<sqsubseteq> ccHeap \\<Delta> e\\<cdot>a\"\n      proof(cases \"(Aheap \\<Delta> e\\<cdot>a) x\")\n        case bottom thus ?thesis using e' by (simp add: Texp.AnalBinds_lookup)\n      next\n        case (up a')\n        with e'\n        have \"ccExp e'\\<cdot>a' \\<sqsubseteq> ccHeap \\<Delta> e\\<cdot>a\" by (rule ccHeap_Heap)\n        thus ?thesis using up e'\n          by (auto simp add: Texp.AnalBinds_lookup Texp_simp  intro: below_trans[OF cc_restr_below_arg])\n      qed\n\n      show \"ccProd (ccNeighbors x (ccHeap \\<Delta> e\\<cdot>a)- {x} \\<inter> thunks \\<Delta>) (carrier ((Texp.AnalBinds  \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) x)) \\<sqsubseteq> ccHeap \\<Delta> e\\<cdot>a\"\n      proof(cases \"(Aheap \\<Delta> e\\<cdot>a) x\")\n        case bottom thus ?thesis using e' by (simp add: Texp.AnalBinds_lookup)\n      next\n        case (up a')\n        have subset: \"(carrier (fup\\<cdot>(Texp e')\\<cdot>((Aheap \\<Delta> e\\<cdot>a) x))) \\<subseteq> fv e'\"\n          using up e' by (auto simp add: Texp.AnalBinds_lookup carrier_Fexp dest!: set_mp[OF Aexp_edom])\n        \n        from e' up\n        have \"ccProd (fv e') (ccNeighbors x (ccHeap \\<Delta> e\\<cdot>a) - {x} \\<inter> thunks \\<Delta>) \\<sqsubseteq> ccHeap \\<Delta> e\\<cdot>a\"\n          by (rule ccHeap_Extra_Edges)\n        then\n        show ?thesis using e'\n          by (simp add: Texp.AnalBinds_lookup  Texp_simp ccProd_comm  below_trans[OF ccProd_mono2[OF subset]])\n      qed\n    qed\n    also have \"\\<dots> \\<sqsubseteq> ccExp (Let \\<Delta> e)\\<cdot>a\"\n      by (rule ccExp_Let)\n    finally\n    show \"ccApprox (ttree_restr (- domA \\<Delta>) (substitute (Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)))\n        \\<sqsubseteq> ccExp (Terms.Let \\<Delta> e)\\<cdot>a\" by this simp_all\n  qed\n\n  note carrier\n  hence \"carrier (substitute (ExpAnalysis.AnalBinds Texp \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)) \\<subseteq> edom (Aheap \\<Delta> e\\<cdot>a) \\<union> - domA \\<Delta>\"\n    by (rule order_trans) (auto dest: set_mp[OF Aexp_edom])\n  hence \"ttree_restr (domA \\<Delta>)            (substitute (Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a))\n      = ttree_restr (edom (Aheap \\<Delta> e\\<cdot>a)) (ttree_restr (domA \\<Delta>) (substitute (Texp.AnalBinds  \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)))\"\n    by -(rule ttree_restr_noop[symmetric], auto)\n  also\n  have \"\\<dots> = ttree_restr (edom (Aheap \\<Delta> e\\<cdot>a)) (substitute (Texp.AnalBinds  \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a))\"\n    by (simp add: inf.absorb2[OF edom_Aheap ])\n  also\n  have \"\\<dots> \\<sqsubseteq> Theap \\<Delta> e \\<cdot>a\"\n  proof(cases \"nonrec \\<Delta>\")\n    case False\n    have \"ttree_restr (edom (Aheap \\<Delta> e\\<cdot>a)) (substitute (Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a))\n      \\<sqsubseteq> ttree_restr (edom (Aheap \\<Delta> e\\<cdot>a)) anything\"\n      by (rule ttree_restr_mono) simp\n    also have \"\\<dots> = Theap \\<Delta> e\\<cdot>a\"\n      by (simp add: Theap_simp False)\n    finally show ?thesis.\n  next\n    case [simp]: True\n\n    from True\n    have \"ttree_restr (edom (Aheap \\<Delta> e\\<cdot>a)) (substitute (Texp.AnalBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a))\n       = ttree_restr (edom (Aheap \\<Delta> e\\<cdot>a)) (Texp e\\<cdot>a)\"\n      by (rule nonrecE) (rule ttree_rest_substitute, auto simp add: carrier_Fexp fv_def fresh_def dest!: set_mp[OF edom_Aheap] set_mp[OF Aexp_edom])\n    also have \"\\<dots> = ccTTree (edom (Aexp e\\<cdot>a) \\<inter> edom (Aheap \\<Delta> e\\<cdot>a)) (ccExp e\\<cdot>a)\"\n      by (simp add: Texp_simp)\n    also have \"\\<dots> \\<sqsubseteq> ccTTree (edom (Aexp e\\<cdot>a) \\<inter> domA \\<Delta>) (ccExp e\\<cdot>a)\"\n      by (rule ccTTree_mono1[OF Int_mono[OF order_refl edom_Aheap]])\n    also have \"\\<dots> \\<sqsubseteq> ccTTree (edom (Aheap \\<Delta> e\\<cdot>a)) (ccExp e\\<cdot>a)\"\n      by (rule ccTTree_mono1[OF edom_mono[OF Aheap_nonrec[OF True], simplified]])\n    also have \"\\<dots> \\<sqsubseteq> Theap \\<Delta> e\\<cdot>a\"\n      by (simp add: Theap_simp)\n    finally\n    show ?thesis by this simp_all\n  qed\n  finally\n  show \"ttree_restr (domA \\<Delta>) (substitute (ExpAnalysis.AnalBinds Texp \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)) \\<sqsubseteq> Theap \\<Delta> e\\<cdot>a\".\n\nqed\nend\n\n(* TODO: Unused stuff from here, mostly about singles. Might be useful later. *)\n\n\nlemma paths_singles: \"xs \\<in> paths (singles S) \\<longleftrightarrow> (\\<forall>x \\<in> S. one_call_in_path x xs)\"\n  by transfer (auto simp add: one_call_in_path_filter_conv)\n\nlemma paths_singles': \"xs \\<in> paths (singles S) \\<longleftrightarrow> (\\<forall>x \\<in> (set xs \\<inter> S). one_call_in_path x xs)\"\n  apply transfer\n  apply (auto simp add: one_call_in_path_filter_conv)\n  apply (erule_tac x = x in ballE)\n  apply auto\n  by (metis (poly_guards_query) filter_empty_conv le0 length_0_conv)\n\nlemma both_below_singles1:\n  assumes \"t \\<sqsubseteq> singles S\"\n  assumes \"carrier t' \\<inter> S = {}\"\n  shows \"t \\<otimes>\\<otimes> t' \\<sqsubseteq> singles S\"\nproof (rule ttree_belowI)\n  fix xs\n  assume \"xs \\<in> paths (t \\<otimes>\\<otimes> t')\"\n  then obtain ys zs where \"ys \\<in> paths t\" and \"zs \\<in> paths t'\" and \"xs \\<in> ys \\<otimes> zs\" by (auto simp add: paths_both)\n  with assms \n  have \"ys \\<in> paths (singles S)\" and \"set zs \\<inter> S = {}\"\n    by (metis below_ttree.rep_eq contra_subsetD paths.rep_eq, auto simp add: Union_paths_carrier[symmetric])\n  with `xs \\<in> ys \\<otimes> zs`\n  show \"xs \\<in> paths (singles S)\"\n    by (induction) (auto simp add: paths_singles no_call_in_path_set_conv interleave_set dest: more_than_one_setD split: if_splits)\nqed\n\n\nlemma paths_ttree_restr_singles: \"xs \\<in> paths (ttree_restr S' (singles S)) \\<longleftrightarrow> set xs \\<subseteq> S' \\<and> (\\<forall>x \\<in> S. one_call_in_path x xs)\"\nproof\n  show \"xs \\<in> paths (ttree_restr S' (singles S)) \\<Longrightarrow>  set xs \\<subseteq> S' \\<and> (\\<forall>x \\<in> S. one_call_in_path x xs)\"\n    by (auto simp add: filter_paths_conv_free_restr[symmetric] paths_singles)\nnext\n  assume *: \"set xs \\<subseteq> S' \\<and> (\\<forall>x\\<in>S. one_call_in_path x xs)\"\n  hence \"set xs \\<subseteq> S'\" by auto\n  hence [simp]: \"filter (\\<lambda> x'. x' \\<in> S') xs = xs\" by (auto simp add: filter_id_conv)\n  \n  from *\n  have \"xs \\<in> paths (singles S)\"\n     by (auto simp add: paths_singles')\n  hence \"filter (\\<lambda> x'. x' \\<in> S') xs \\<in> filter (\\<lambda>x'. x' \\<in> S') ` paths (singles S)\"\n    by (rule imageI)\n  thus \"xs \\<in> paths (ttree_restr S' (singles S))\"\n    by (auto simp add: filter_paths_conv_free_restr[symmetric] )\nqed\n\n\n\n(* TODO: unused *)\nlemma substitute_not_carrier:\n  assumes \"x \\<notin> carrier t\"\n  assumes \"\\<And> x'. x \\<notin> carrier (f x')\"\n  shows \"x \\<notin>  carrier (substitute f T t)\"\nproof-\n  have \"ttree_restr ({x}) (substitute f T t) = ttree_restr ({x}) t\"\n  proof(rule ttree_rest_substitute)\n    fix x'\n    from `x \\<notin> carrier (f x')`\n    show \"carrier (f x') \\<inter> {x} = {}\" by auto\n  qed\n  hence \"x \\<notin> carrier (ttree_restr ({x}) (substitute f T t)) \\<longleftrightarrow> x \\<notin> carrier (ttree_restr ({x}) t)\" by metis\n  with assms(1)\n  show ?thesis by simp\nqed\n\n(* TODO: unused *)\nlemma substitute_below_singlesI:\n  assumes \"t \\<sqsubseteq> singles S\"\n  assumes \"\\<And> x. carrier (f x) \\<inter> S = {}\"\n  shows \"substitute f T t \\<sqsubseteq> singles S\"\nproof(rule ttree_belowI)\n  fix xs\n  assume \"xs \\<in> paths (substitute f T t)\"\n  thus \"xs \\<in> paths (singles S)\"\n  using assms\n  proof(induction f T t xs arbitrary: S rule: substitute_induct)\n    case Nil\n    thus ?case by simp\n  next\n    case (Cons f T t x xs)\n\n    from `x#xs \\<in> _`\n    have xs: \"xs \\<in> paths (substitute (f_nxt f T x) T (nxt t x \\<otimes>\\<otimes> f x))\" by auto\n    moreover\n\n    from `t \\<sqsubseteq> singles S`\n    have \"nxt t x \\<sqsubseteq> singles S\" \n      by (metis \"TTree-HOLCF.nxt_mono\" below_trans nxt_singles_below_singles)\n    from this `carrier (f x) \\<inter> S = {}`\n    have \"nxt t x \\<otimes>\\<otimes> f x \\<sqsubseteq> singles S\"\n      by (rule both_below_singles1)\n    moreover\n    { fix x'\n      from  `carrier (f x') \\<inter> S = {}`\n      have \"carrier (f_nxt f T x x') \\<inter> S = {}\"\n        by (auto simp add: f_nxt_def)\n    }\n    ultimately\n    have IH: \"xs \\<in> paths (singles S)\"\n      by (rule Cons.IH) \n  \n  show ?case\n    proof(cases \"x \\<in> S\")\n      case True\n      with `carrier (f x) \\<inter> S = {}`\n      have \"x \\<notin> carrier (f x)\" by auto\n      moreover\n      from `t \\<sqsubseteq> singles S`\n      have \"nxt t x \\<sqsubseteq> nxt (singles S) x\" by (rule nxt_mono)\n      hence \"carrier (nxt t x) \\<subseteq> carrier (nxt (singles S) x)\" by (rule carrier_mono)\n      from set_mp[OF this] True\n      have \"x \\<notin> carrier (nxt t x)\" by auto\n      ultimately\n      have \"x \\<notin> carrier (nxt t x \\<otimes>\\<otimes> f x)\" by simp\n      hence \"x \\<notin> carrier (substitute (f_nxt f T x) T (nxt t x \\<otimes>\\<otimes> f x))\"\n      proof(rule substitute_not_carrier)\n        fix x'  \n        from `carrier (f x') \\<inter> S = {}` `x \\<in> S`\n        show \"x \\<notin> carrier (f_nxt f T x x')\" by (auto simp add: f_nxt_def)\n      qed\n      with xs\n      have \"x \\<notin> set xs\" by (auto simp add: Union_paths_carrier[symmetric])\n      with IH\n      have \"xs \\<in> paths (without x (singles S))\" by (rule paths_withoutI)\n      thus ?thesis using True by (simp add: Cons_path)\n    next\n      case False\n      with IH\n      show ?thesis by (simp add: Cons_path)\n    qed\n  qed\nqed\n\nend\n\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/CoCallImplTTreeSafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011397337391, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.31308670045916326}}
{"text": "(*  File:       Profile_List_Monadic.thy\n    Copyright   2023  Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\<open>creator \"Valentin Springsklee, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\nsection \\<open>Refined Profile Evaluation\\<close>\n\ntheory Profile_List_Monadic\n  imports \"Verified_Voting_Rule_Construction.Profile\"\n    \"Verified_Voting_Rule_Construction.Profile_List\"\n    Ballot_Refinement\n  \nbegin\n\nsubsection \\<open>Profile Evaluation on List-based Profiles \\<close>\n\nfun win_count_l :: \"'a Profile_List \\<Rightarrow> 'a \\<Rightarrow> nat\" where\n  \"win_count_l p a = fold (\\<lambda>x ac. \n     if (0 < length x \\<and> x!0 = a) then (ac+1) else (ac)) p 0\"\n\nfun prefer_count_l :: \"'a Profile_List \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> nat\" where\n  \"prefer_count_l p a b = fold (\\<lambda> x ac. (if (b \\<lesssim>\\<^sub>x a) then (ac+1) else (ac))) p 0\"\n\nfun wins_l :: \"'a \\<Rightarrow> 'a Profile_List \\<Rightarrow> 'a \\<Rightarrow> bool\" where\n  \"wins_l x p y =\n    (prefer_count_l p x y > prefer_count_l p y x)\"\n\nfun condorcet_winner_l :: \"'a set \\<Rightarrow> 'a Profile_List \\<Rightarrow> 'a \\<Rightarrow> bool\" where\n  \"condorcet_winner_l A p w =\n      (finite A \\<and> profile_l A p \\<and>  w \\<in> A \\<and> (\\<forall> x \\<in> A - {w} . wins_l w p x))\"\n\nsubsection \\<open> Monadic definition of profile functions \\<close>\n\nlemma w_eq_param [sepref_import_param]: \"((=), (=)::'a\\<Rightarrow>_) \\<in> Id \\<rightarrow> Id \\<rightarrow> Id\" by simp\n\ndefinition \"index_mon_inv ballot a \\<equiv> (\\<lambda> (i, found).\n    (i \\<le> List_Index.index ballot a)\n  \\<and> (found \\<longrightarrow> (i = List_Index.index ballot a)))\"\n(*  \\<and> (\\<not>found \\<longrightarrow> (i \\<le> List_Index.index ballot a)))\"*)\n\n(* low level optimization for pref count *)\ndefinition index_mon :: \"'a::{default, heap, hashable} Preference_List \n  \\<Rightarrow> 'a::{default, heap, hashable}\n   \\<Rightarrow> nat nres\" where\n  \"index_mon ballot a \\<equiv> do {\n    (i, found) \\<leftarrow> WHILET  \n  (\\<lambda>(i, found). (i < (length ballot) \\<and> \\<not>found)) \n      (\\<lambda>(i,_). do {\n      ASSERT (i < (length ballot));\n      let (c::'a::{default, heap, hashable}) = (ballot ! i);\n      if (a = c) then\n        RETURN (i,True)\n      else\n        RETURN (i+1,False)\n    })(0::nat, False);\n    RETURN (i)\n  }\"          \n\nsepref_definition index_sep is \"uncurry index_mon\" :: \n  \"(arl_assn id_assn)\\<^sup>k *\\<^sub>a (id_assn)\\<^sup>k \\<rightarrow>\\<^sub>a nat_assn\"\n  unfolding index_mon_def \n  apply sepref_dbg_keep\n  done\n                      \nsepref_register index_mon\n\ndeclare index_sep.refine[sepref_fr_rules]\n\n\nlemma isl1_measure: \"wf (measure (\\<lambda>(i, found). length ballot - i - (if found then 1 else 0)))\"\n  by simp\n\nlemma index_sound:\n  fixes a:: 'a and l :: \"'a list\" and i::nat\n  assumes  \"i \\<le> List_Index.index l a\"\n  shows \"(a = l!i) \\<longrightarrow> (i = List_Index.index l a)\"\n  by (metis assms(1) index_first le_eq_less_or_eq)\n\nlemma index_mon_correct:\n  shows \"index_mon ballot a \\<le> SPEC (\\<lambda> r. r = index ballot a)\"\n  unfolding index_mon_def \n  apply (intro WHILET_rule[where I= \"index_mon_inv ballot a\" and R=\"measure (\\<lambda>(i, found). length ballot - i - (if found then 1 else 0))\"] refine_vcg)\nproof (unfold index_mon_inv_def, simp+, safe, auto)\n  fix aa::nat\n  assume bound: \"aa \\<le> List_Index.index ballot (ballot ! aa)\"\n  (*assume range : \"aa < length ballot\"*)\n  thus \"aa = List_Index.index ballot (ballot ! aa)\" by (simp add: index_sound)\nnext\n  fix i\n  assume notnow: \"a \\<noteq> ballot ! i\"\n  assume notyet: \"i \\<le> List_Index.index ballot a\"\n  assume ir: \"i < length ballot\"\n  from notnow have \"i \\<noteq> List_Index.index ballot a\"\n    by (metis index_eq_iff ir)\n  from notyet this show \"Suc i \\<le> List_Index.index ballot a\"\n    by fastforce\nnext\n  assume ir: \"List_Index.index ballot a < length ballot\"\n  assume na: \"a \\<noteq> ballot ! index ballot a\"\n  from ir have \"a = ballot ! List_Index.index ballot a\"\n    by (metis index_eq_iff)\n  from this na show \"False\" by simp\nnext\n  fix aa\n  assume \"aa \\<le> List_Index.index ballot a\"\n    and \"aa \\<noteq> List_Index.index ballot a\"\n  thus \"aa < length ballot\"\n    by (metis antisym index_le_size le_neq_implies_less order_trans)\nqed\n\n(* TODO: move to IICF Array List *)\n\nlemma index_mon_impl: \n  shows \"(index_mon, mop_list_index) \\<in> \\<langle>Id\\<rangle>list_rel \\<rightarrow> Id \\<rightarrow> \\<langle>nat_rel\\<rangle>nres_rel\"\n  apply (intro fun_relI nres_relI)\n  apply clarsimp\n  apply (refine_vcg index_mon_correct) by simp\n\n\nlemma arl_index_nc_correct: \"(uncurry index_sep, uncurry mop_list_index)\n    \\<in> (arl_assn id_assn)\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\<rightarrow>\\<^sub>a nat_assn\"\n  using index_sep.refine[FCOMP index_mon_impl]\nlist_rel_id hr_comp_Id2\n  by metis\n\n(*sepref_decl_impl (ismop) arl_index: arl_index_nc_correct .*)\n\ndefinition rank_mon :: \"'a::{default, heap, hashable} Preference_List \n  \\<Rightarrow> 'a::{default, heap, hashable} \\<Rightarrow> nat nres\" where\n  \"rank_mon ballot a \\<equiv> do {\n    i \\<leftarrow> (index_mon ballot a);\n    if (i = length ballot) then RETURN 0 else RETURN (i + 1)\n  }\"       \n\n\nlemma rank_mon_correct: \"rank_mon ballot a \\<le> SPEC (\\<lambda> r. r = rank_l ballot a)\"\n  unfolding rank_mon_def\nproof (refine_vcg, auto)\n  assume mem: \"a \\<in> set ballot\"\n  from this have \"List_Index.index ballot a \\<noteq> length ballot\"\n    by (simp add: in_set_member index_size_conv)\n  from this show \"index_mon ballot a \\<le> SPEC (\\<lambda>i. i = List_Index.index ballot a \\<and> i \\<noteq> length ballot)\"\n    using index_mon_correct\n    by (metis (mono_tags, lifting) SPEC_cons_rule)\nnext\n  assume nmem: \"\\<not>a \\<in> set ballot\"\n  from this have \"List_Index.index ballot a = length ballot\"\n    by (simp add: in_set_member)\n  from this show \"index_mon ballot a \\<le> RES {length ballot}\"\n    using index_mon_correct\n    by (metis singleton_conv)\nqed\n\n\nlemma rank_mon_refine:\n  shows \"(rank_mon, (\\<lambda> ballot a. RETURN (rank_l ballot a)))\\<in> Id \\<rightarrow> Id \\<rightarrow> \\<langle>nat_rel\\<rangle>nres_rel\"\n  by (refine_vcg rank_mon_correct, simp)\n\n\n\n\ndefinition is_less_preferred_than_ref ::\n  \"'a::{default, heap, hashable} \\<Rightarrow> 'a Preference_List \n  \\<Rightarrow> 'a\n   \\<Rightarrow> bool nres\" (\"_ p\\<lesssim>\\<^sub>_ _\" [50, 1000, 51] 50) where\n    \"x p\\<lesssim>\\<^sub>l y \\<equiv>  do { \n        idxx \\<leftarrow> index_mon l x;\n        idxy \\<leftarrow> index_mon l y;\n        RETURN (idxx \\<noteq> length l \\<and> idxy \\<noteq> length l \\<and>  idxx \\<ge> idxy)}\"\n\nlemma is_less_preferred_than_ref_refine:\n  shows \"(is_less_preferred_than_ref, \n      RETURN ooo  is_less_preferred_than_l) \\<in> Id \\<rightarrow> \\<langle>Id\\<rangle>list_rel \\<rightarrow> Id \\<rightarrow> \\<langle>bool_rel\\<rangle>nres_rel\" \n  unfolding is_less_preferred_than_ref_def is_less_preferred_than_l.simps\n  unfolding comp_apply\n  by (refine_vcg index_mon_correct, auto)\n\nsepref_definition is_less_preferred_than_sep\n  is \"uncurry2 is_less_preferred_than_ref\" :: \n    \"(id_assn\\<^sup>k *\\<^sub>a (ballot_impl_assn id_assn)\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn)\"\n  unfolding is_less_preferred_than_ref_def[abs_def] \n  apply sepref_dbg_keep\n  done\n\nsepref_register is_less_preferred_than_ref\n\ndeclare is_less_preferred_than_sep.refine [sepref_fr_rules]\n\n\nlemmas is_less_preferred_than_sep_correct = \n    is_less_preferred_than_sep.refine[FCOMP is_less_preferred_than_ref_refine]\n\n\ntext \\<open>\n  win-count, multiple refinement steps\n\\<close>\n\ndefinition \"wc_invar_fe p0 a \\<equiv> \\<lambda>(xs,ac).\n  xs = drop (length p0 - length xs) p0 \\<and>\n  ac = card {i. i < (length p0 - length xs) \\<and> above (p0!i) a = {a}}\"\n\ndefinition wc_foreach:: \"'a Profile \\<Rightarrow> 'a \\<Rightarrow> nat nres\" where \n\"wc_foreach p a \\<equiv> do {\n  (xs,ac) \\<leftarrow> WHILEIT (wc_invar_fe p a) (FOREACH_cond (\\<lambda>_.True)) \n    (FOREACH_body (\\<lambda>x (ac).\n     if (above x a = {a}) then RETURN (ac+1) else RETURN (ac)\n    )) (p,0);\n  RETURN ac\n}\"\n\nlemma wc_foreach_correct:\n  shows \"wc_foreach p a \\<le> SPEC (\\<lambda> wc. wc = win_count p a)\"\n  unfolding wc_foreach_def wc_invar_fe_def\n  FOREACH_cond_def FOREACH_body_def\n  apply (intro WHILEIT_rule[where R=\"measure (\\<lambda>(xs,_). length xs)\"]  refine_vcg)\n  apply (safe, simp_all)\n  apply (metis append_Nil diff_le_self drop_Suc drop_all drop_append length_drop tl_drop)\nproof (-)\n  fix xs:: \"'a Profile\"\n  assume headr: \"xs = drop (length p - length xs) p\"\n  assume pnemp: \"xs \\<noteq> []\"\n  from pnemp headr have hdidx: \"hd xs = (p!(length p - length xs))\"\n    by (metis drop_eq_Nil hd_drop_conv_nth linorder_not_le)\n  assume atop: \"above (hd xs) a = {a}\"\n  from hdidx this have aba: \"above (p!(length p - length xs)) a = {a}\" by simp\n  from this aba have comp: \"{i. i \\<le> (length p) - length xs \\<and> above (p ! i) a = {a}} \n        = ({i. i < length p - length xs \\<and> above (p ! i) a = {a}} \\<union> \n          {(length p - length xs)})\"\n    by fastforce\n  from headr have \"{i. i \\<le> (length p) - length xs \\<and> above (p ! i) a = {a}} \n        = {i. i < Suc (length p) - length xs \\<and> above (p ! i) a = {a}}\"\n    by (metis Suc_diff_le diff_le_self length_drop less_Suc_eq_le)\n  from this comp have \"{i. i < Suc (length p) - length xs \\<and> above (p ! i) a = {a}} \n        = ({i. i < length p - length xs \\<and> above (p ! i) a = {a}} \\<union> \n          {(length p - length xs)})\" by simp\n  from this show   \n         \"Suc (card {i. i < (length p) - length xs \\<and> above (p ! i) a = {a}}) =\n        card {i. i < Suc (length p) - length xs \\<and> above (p ! i) a = {a}}\"\n    by fastforce\nnext\n  fix xs:: \"'a Profile\"\n  fix alt:: \"'a\"\n  assume headr: \"xs = drop (length p - length xs) p\"\n  show \"tl xs = drop (Suc (length p) - length xs) p\"\n    by (metis Suc_diff_le diff_le_self drop_Suc headr length_drop tl_drop)\nnext\n  fix xs:: \"'a Profile\"\n  fix alt:: \"'a\"\n  assume headr: \"xs = drop (length p - length xs) p\"\n  assume pnemp: \"xs \\<noteq> []\"\n  from pnemp headr have hdidx: \"hd xs = (p!(length p - length xs))\"\n    by (metis drop_eq_Nil hd_drop_conv_nth linorder_not_le)\n  assume xtop: \"alt \\<in>  above (hd xs) a\"\n  assume xna: \"alt \\<noteq> a\"\n  from hdidx headr xna xtop show   \n         \"card {i. i < (length p) - length xs \\<and> above (p ! i) a = {a}} =\n        card {i. i < Suc (length p) - length xs \\<and> above (p ! i) a = {a}}\"\n  by (metis  Suc_diff_le diff_le_self insert_absorb insert_iff insert_not_empty length_drop less_Suc_eq )\nnext\n    fix xs:: \"'a Profile\"\n  fix alt:: \"'a\"\n  assume headr: \"xs = drop (length p - length xs) p\"\n  from headr show \"tl xs = drop (Suc (length p) - length xs) p\"\n    by (metis Suc_diff_le diff_le_self drop_Suc length_drop tl_drop)\nnext\n    fix xs:: \"'a Profile\"\n  fix alt:: \"'a\"\n  assume headr: \"xs = drop (length p - length xs) p\"\n  assume pnemp: \"xs \\<noteq> []\"\n  from pnemp headr have hdidx: \"hd xs = (p!(length p - length xs))\"\n    by (metis drop_eq_Nil hd_drop_conv_nth linorder_not_le)\n  assume xtop: \"a \\<notin>  above (hd xs) a\"\n  from hdidx this have aba: \"above (p!(length p - length xs)) a \\<noteq> {a}\"\n    by fastforce\n  from this show   \n         \"card {i. i < (length p) - length xs \\<and> above (p ! i) a = {a}} =\n        card {i. i < Suc (length p) - length xs \\<and> above (p ! i) a = {a}}\"\n    by (metis Suc_diff_le diff_le_self headr length_drop less_Suc_eq)\nqed\n\nschematic_goal wc_code_aux: \"RETURN ?wc_code \\<le> wc_foreach p a\"\n  unfolding wc_foreach_def FOREACH_body_def FOREACH_cond_def\n  by (refine_transfer)\n\nconcrete_definition win_count_code for p a uses wc_code_aux\n\nthm win_count_code_def\n\n\nlemma win_count_equiv: \n  shows \"win_count p a = win_count_code p a\"\nproof -\n  from order_trans[OF win_count_code.refine wc_foreach_correct] \n    have \"win_count_code p a = win_count p a\"\n      by fastforce\n  thus ?thesis by simp\nqed\n\n\n\nlemma carde: assumes prof: \"profile A p\"\n  shows \"\\<forall>ballot \\<in> set p. (rank ballot a = 1) = (above ballot a = {a})\" \n  using prof\n  by (metis above_rank profile_set)\n\nlemma cardei: assumes prof: \"profile A p\"\n  shows \"\\<forall>i < length p. let ballot=(p!i) in ((rank ballot a = 1) = (above ballot a = {a}))\" \n  using prof\n  by (metis carde nth_mem)\n\ndefinition \"f_inner_rel a \\<equiv> (\\<lambda>(x::'a Preference_Relation) (ac::nat).\n     (if (rank x a = 1) then RETURN (ac+1) else RETURN (ac)\n    ))\"\n\ndefinition wc_foreach_rank:: \"'a Profile \\<Rightarrow> 'a \\<Rightarrow> nat nres\" where \n\"wc_foreach_rank p a \\<equiv> do {\n  (xs,ac) \\<leftarrow> WHILET (FOREACH_cond (\\<lambda>_.True)) \n    (FOREACH_body (f_inner_rel a)) (p,0::nat);\n  RETURN ac\n}\"\n\nlemma wc_foreach_rank_refine:\n  assumes prof: \"profile A p\"\n  shows \"wc_foreach_rank p a \\<le> \\<Down> nat_rel (wc_foreach p a)\"\n  unfolding wc_foreach_rank_def wc_foreach_def wc_invar_fe_def FOREACH_body_def FOREACH_cond_def \n    f_inner_rel_def\n  apply (refine_vcg)\n    apply (refine_dref_type) \\<comment> \\<open>Type-based heuristics to instantiate data \n    refinement goals\\<close>\nproof (clarsimp_all simp del: rank.simps)\n  fix x1:: \"'a Profile\"\n  assume x1ne: \"x1 \\<noteq> []\"\n  assume rest: \"x1 = drop (length p - length x1) p\"\n  from x1ne rest show \"(rank (hd x1) a = Suc 0) = (above (hd x1) a = {a})\" using carde\n    by (metis One_nat_def in_set_dropD list.set_sel(1) prof rank.simps)\nqed\n\nlemma rank_refaux:\n  assumes prof: \"profile A p\"\n  shows \"wc_foreach_rank p a \\<le> (wc_foreach p a)\"\n  using prof wc_foreach_rank_refine\n  by (metis refine_IdD) \n\ntheorem wc_foreach_rank_correct:\n  assumes prof: \"profile A p\"\n  shows \"wc_foreach_rank p a \\<le> SPEC (\\<lambda> wc. wc = win_count p a)\"\n  using assms ref_two_step[OF wc_foreach_rank_refine wc_foreach_correct]\n  by fastforce\n\n\nsubsubsection \\<open> Data refinement \\<close>\n\ntext \\<open> these auxiliary lemmas illustrate the equivalence of checking the the first\n  candidate on a non empty ballot. \\<close>\nlemma top_above:\n  assumes ne: \"length pl > 0\"\n  shows \"pl!0 = a \\<longleftrightarrow> above_l pl a = [a]\"\n  unfolding above_l_def\nproof (simp add: rankdef, safe)\n  assume mem: \"pl ! 0 \\<in> set pl\"\n  assume \"a = pl ! 0\"\n  have \"List_Index.index pl (pl ! 0) = 0\"\n    by (simp add: index_eqI)\n  from mem this show \"take (Suc (List_Index.index pl (pl ! 0))) pl = [pl ! 0]\"\n    by (metis append_Nil index_less_size_conv take0 take_Suc_conv_app_nth)\nnext\n  (*assume mem: \"List.member pl a\"*)\n  assume \"take (Suc (List_Index.index pl a)) pl = [a]\"\n  from this show \"pl ! 0 = a\"\n    by (metis append_Cons append_Nil append_take_drop_id hd_conv_nth list.sel(1))\nnext\n  assume nm: \"\\<not> pl ! 0 \\<in> set pl\"\n  from this have pl_empty: \"pl = []\"\n    by (metis length_greater_0_conv nth_mem)\n  from ne this pl_empty show \"False\"\n    by simp\nqed\n\nlemma top_l_above_r:\n  assumes ballot: \"ballot_on A pl\"\n  and ne: \"length pl > 0\"\n  shows \"pl!0 = a \\<longleftrightarrow> above (pl_\\<alpha> pl) a = {a}\"\nproof -\n  from ne have listeq: \"pl!0 = a \\<longleftrightarrow> above_l pl a = [a]\"\n    by (simp add: top_above)\n  from assms have above_abstract: \"set (above_l pl a) = above (pl_\\<alpha> pl) a\" \n    by (auto simp add: aboveeq)\n  have list_set: \"above_l pl a = [a] \\<longleftrightarrow> set (above_l pl a) = {a}\"\n    by (metis above_l_def append_self_conv2 gr0I hd_take id_take_nth_drop insert_not_empty list.sel(1) list.set(1) list.set_sel(1) list.simps(15) listeq ne singleton_iff take_eq_Nil)\n  from above_abstract listeq this show ?thesis\n    by (simp)\nqed\n\n\ndefinition \"f_inner_list a \\<equiv> (\\<lambda>x ac::nat.\n     (if (rank_l x a = 1) then RETURN (ac+1) else RETURN (ac)))\"\n\n\ndefinition \"wc_list_invar p0 a \\<equiv> \\<lambda>(i,ac::nat).\n  0 \\<le> i \\<and> i \\<le> length p0\"\n\ndefinition \"wc_list_invar' p0 a \\<equiv> \\<lambda>(xs,ac).\n  xs = drop (length p0 - length xs) p0\"\n\n\nlemma innerf_eq:\n  fixes A:: \"'a set\"  and l :: \"'a Preference_List\" and a :: 'a\n  assumes \"(l,r) \\<in> ballot_rel\"\n  shows \"f_inner_list a l n \\<le> \\<Down> nat_rel (f_inner_rel a r n)\"\n  unfolding f_inner_list_def f_inner_rel_def\n  apply (refine_vcg)\n  using assms rankeq unfolding ballot_rel_def\n  by (metis in_br_conv)\n\nlemma foreachrel:\n  assumes \"(pl, pr) \\<in> profile_rel\" and \"pl \\<noteq> []\"\n  shows \"(hd pl, hd pr) \\<in> (ballot_rel) \\<and> \n  (tl pl, tl pr) \\<in> (profile_rel)\"\n  using assms\n  by (metis list.collapse list_rel_simp(2) list_rel_simp(4))\n\n\n     \ndefinition wc_foreach_list_rank :: \"'a Profile_List \\<Rightarrow> 'a \\<Rightarrow> nat nres\" where\n\"wc_foreach_list_rank pl a \\<equiv> do {\n  (xs,ac) \\<leftarrow> WHILET (FOREACH_cond (\\<lambda>_.True)) \n    (FOREACH_body (f_inner_list a)) (pl,0::nat);\n  RETURN ac\n}\"\n\nlemma initrel: \n  fixes A:: \"'a set\"\n  assumes \"(pl, pr) \\<in> profile_rel\"\n  shows \"((pl,0::nat), pr , 0::nat) \\<in> ((profile_rel \\<times>\\<^sub>r nat_rel))\"\n  using assms\n  by simp \n\n\nlemma wc_foreach_list_rank_refine: \n  fixes A:: \"'a set\"\n  shows \"(wc_foreach_list_rank, wc_foreach_rank) \\<in> \n  profile_rel \\<rightarrow> Id \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"\n  unfolding wc_foreach_list_rank_def wc_foreach_rank_def \n  FOREACH_cond_def FOREACH_body_def\n  apply (refine_vcg initrel)\n     apply (simp add: initrel)\n  apply refine_dref_type\n     apply (simp add: refine_rel_defs)\n     apply blast\n  apply clarsimp_all  \n  using innerf_eq unfolding ballot_rel_def \n  apply (metis param_hd refine_IdD)\n  using foreachrel unfolding ballot_rel_def   by (metis)\n\nlemma win_count_list_r_refine_os: \n  fixes A:: \"'a set\"\n  assumes \"(pl, pr) \\<in> (profile_rel)\"\n  shows \"wc_foreach_list_rank pl a \\<le> \\<Down> Id (wc_foreach_rank pr a)\"\n  unfolding wc_foreach_list_rank_def wc_foreach_rank_def \n  FOREACH_cond_def FOREACH_body_def\n  using assms apply (refine_vcg wc_foreach_list_rank_refine initrel)\n  apply (simp_all only: refine_rel_defs pl_to_pr_\\<alpha>_def)\n  apply refine_dref_type\n     apply (clarsimp_all, safe)\n  using innerf_eq unfolding ballot_rel_def \n   apply (metis (mono_tags, lifting) brI list.rel_sel refine_IdD)\n  using foreachrel\n  using list.rel_sel by blast\n  \n\nlemma wc_foreach_list_rank_correct:\n  assumes \"(pl, pr) \\<in> profile_rel\" and \"profile_l A pl\"\n  shows \"wc_foreach_list_rank pl a \\<le> SPEC (\\<lambda> wc. wc = win_count pr a)\"\nproof (-)\n  from assms have \"profile A pr\" using profile_ref\n    by (metis) \n  from assms(1) this \n  show \"wc_foreach_list_rank pl a \\<le> (SPEC (\\<lambda>wc. wc = win_count pr a))\"\n  using ref_two_step[OF win_count_list_r_refine_os wc_foreach_rank_correct] refine_IdD\n  by (metis)\nqed\n\nlemma top_rank1:\n  assumes ballot: \"ballot_on A ballot\" and \"length ballot > 0\"\n  shows \"ballot!0 = a \\<longleftrightarrow> rank_l ballot a = 1\"\n  using assms \n  apply clarsimp\n  apply safe\n    apply (simp add: index_eq_iff)\n   apply (metis nth_index)\n  by simp \n  \n\ndefinition wc_foreach_top:: \"'a Profile_List \\<Rightarrow> 'a \\<Rightarrow> nat nres\" where \n\"wc_foreach_top p  a \\<equiv> do {\n  (xs::'a Profile_List,ac) \\<leftarrow> WHILET (FOREACH_cond (\\<lambda>_.True)) \n    (FOREACH_body (\\<lambda>x (ac).\n     if ((length x > 0) \\<and> (x!0 = a)) then RETURN (ac+1) else RETURN (ac)\n    )) (p,0);\n  RETURN ac\n}\"\n\nlemma wc_foreach_top_refine_os: \n  fixes A:: \"'a set\"\n  shows \"wc_foreach_top pl a \\<le> \\<Down> Id (wc_foreach_list_rank pl a)\"\n  unfolding wc_foreach_list_rank_def f_inner_list_def wc_foreach_top_def \n  FOREACH_cond_def FOREACH_body_def\n  apply (refine_vcg wc_foreach_list_rank_refine initrel)\n  apply (simp_all only: refine_rel_defs pl_to_pr_\\<alpha>_def)\n  apply refine_dref_type\n  apply auto\n   apply (metis gr0I index_first)\n  by (metis index_eq_iff length_pos_if_in_set)\n\nlemma wc_foreach_top_correct:\n  assumes \"(pl, pr) \\<in> profile_rel\" and \"profile_l A pl\"\n  shows \"wc_foreach_top pl a \\<le> SPEC (\\<lambda> wc. wc = win_count pr a)\"\n  using assms ref_two_step[OF wc_foreach_top_refine_os wc_foreach_list_rank_correct] refine_IdD \n  by (metis) \n\ndefinition wc_fold:: \"'a Profile_List \\<Rightarrow> 'a \\<Rightarrow> nat nres\" \n  where \"wc_fold l a \\<equiv> \n   nfoldli l (\\<lambda>_. True) \n    (\\<lambda>x (ac). \n     RETURN (if ((length x > 0) \\<and> (x!0 = a))then (ac+1) else  (ac))\n    ) \n    (0)\"\n\nlemma wc_fold_refine:\n  shows \"wc_fold pl a \\<le> \\<Down> Id (wc_foreach_top pl a)\"\n  unfolding wc_fold_def wc_foreach_top_def\n  by (simp add: nfoldli_mono(1) while_eq_nfoldli)\n\ntheorem wc_fold_correct:\n  assumes \"(pl, pr) \\<in> profile_rel\" and \"profile_l A pl\"\n  shows \"wc_fold pl a \\<le> SPEC (\\<lambda> wc. wc = win_count pr a)\"\n  using assms ref_two_step[OF wc_fold_refine wc_foreach_top_correct] refine_IdD \n  by (metis) \n\n\n\nlemma nfwcc: \"nofail (wc_fold p a)\"\n  unfolding wc_fold_def \n  apply (induction p rule: rev_induct, simp)\n   apply simp\n  by (simp add: pw_bind_nofail)\n\nlemma win_count_l_correct:\n  shows \"(win_count_l, win_count)\n    \\<in> (profile_on_A_rel A) \\<rightarrow> Id \\<rightarrow> nat_rel\"\n  apply (auto simp del: win_count_l.simps win_count.simps)\n  apply (rename_tac pl pr)\nproof (standard, rename_tac a)\n  fix pl :: \"'a Profile_List\"\n  fix pr :: \"'a Profile\"\n  fix a:: 'a\n  assume prel: \"(pl, pr) \\<in> (profile_on_A_rel A)\"\n  from prel have profrel: \"(pl, pr) \\<in> profile_rel\" using profile_type_ref by fastforce\n  from prel have profprop: \"profile_l A pl\" using profile_prop_list by fastforce\n  have  \"RETURN (win_count_l pl a) = (wc_fold pl a)\"\n  unfolding  wc_fold_def win_count_l.simps\n  using fold_eq_nfoldli[where l = pl and f = \"(\\<lambda>x ac. if (0 < length x \\<and> x ! 0 = a)\n       then ac + 1 else ac)\" and s = 0]\n  by fastforce\n  from this profrel profprop have meq: \"RETURN (win_count_l pl a) = RETURN (win_count pr a)\"\n  using wc_fold_correct[where pl=pl and pr = pr and A = A and a = a]\n    by (metis mem_Collect_eq nres_order_simps(21))\n  from meq show \"win_count_l pl a = win_count pr a\"\n    by simp\nqed\n  \n\ntext \\<open>\n  pref count\n\\<close>\n\n\ndefinition pc_foldli:: \"'a Profile \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> nat nres\" where \n\"pc_foldli p a b \\<equiv>\n nfoldli p (\\<lambda>_.True)  \n     (\\<lambda>x (ac).\n     if (b \\<preceq>\\<^sub>x a) then RETURN (ac+1) else RETURN (ac)\n    ) (0::nat)\"\n\nlemma pc_foldli_correct:\n  shows \"pc_foldli p a b \\<le> SPEC (\\<lambda> wc. wc = prefer_count p a b)\"\n  unfolding pc_foldli_def\n  apply (intro nfoldli_rule[where I=\"\\<lambda> proc xs ac. \n    ac = card {i::nat. i < length proc \\<and> (let r = (p!i) in (b \\<preceq>\\<^sub>r a))}\"]  refine_vcg)\nproof (clarsimp_all)\n  fix l1:: \"'a Profile\"\n  fix l2:: \"'a Profile\"\n  fix x:: \"'a Preference_Relation\"\n  assume \"p = l1 @ x # l2\"\n  assume blpa: \"(b, a) \\<in> x\" \n  have pnemp: \"l1 @ x # l2 \\<noteq> []\" by simp\n  have xatl1: \"(l1 @ x # l2) ! (length l1) = x\"\n    by simp\n  from xatl1 blpa have stone: \"{i. i \\<le>(length l1) \\<and> (b, a) \\<in> (l1 @ x # l2) ! i} \n        = {i. i < length l1 \\<and> (b, a) \\<in> (l1 @ x # l2) ! i} \\<union> \n        {length l1}\"\n    by fastforce\n  from this have \"{i. i < Suc (length l1) \\<and> (b, a) \\<in> (l1 @ x # l2) ! i} =\n  ({i. i < length l1 \\<and> (b, a) \\<in> (l1 @ x # l2) ! i} \\<union> {length l1})\"\n    using less_Suc_eq_le\n    by blast \n  from this show \"Suc(card {i. i < length l1 \\<and> (b, a) \\<in> (l1 @ x # l2) ! i}) =\n      card {i. i < Suc (length l1) \\<and> (b, a) \\<in> (l1 @ x # l2) ! i}\"\n    by fastforce\nnext\n  fix l1:: \"'a Profile\"\n  fix l2:: \"'a Profile\"\n  fix x:: \"'a Preference_Relation\"\n  assume \"p = l1 @ x # l2\"\n  assume blpa: \"(b, a) \\<notin> x\" \n  have pnemp: \"l1 @ x # l2 \\<noteq> []\" by simp\n  have xatl1: \"(l1 @ x # l2) ! (length l1) = x\"\n    by simp\n  from xatl1 blpa have stone: \"{i. i < Suc (length l1) \\<and> (b, a) \\<in> (l1 @ x # l2) ! i} \n        = {i. i < length l1 \\<and> (b, a) \\<in> (l1 @ x # l2) ! i}\"\n    using less_Suc_eq_le order_le_less by blast\n  thus \"card {i. i < length l1 \\<and> (b, a) \\<in> (l1 @ x # l2) ! i} =\n       card {i. i < Suc (length l1) \\<and> (b, a) \\<in> (l1 @ x # l2) ! i}\"\n    by fastforce\nqed\n\n\n\ndefinition pc_foldli_list:: \"'a Profile_List \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> nat nres\" where \n\"pc_foldli_list p a b \\<equiv> \n  nfoldli p (\\<lambda>_.True)  \n      (\\<lambda> x ac. RETURN  (if (b \\<lesssim>\\<^sub>x a) then (ac+1) else (ac)))\n     (0::nat)\"\n\nlemma pc_fold_monad_eq: \n  shows \"RETURN (prefer_count_l p a b) = pc_foldli_list p a b\"\n  unfolding  pc_foldli_list_def\n  using fold_eq_nfoldli\n  by fastforce\n\n\nlemma pc_foldli_list_refine:\n  shows \"(pc_foldli_list, pc_foldli)\n    \\<in> profile_rel \\<rightarrow> Id \\<rightarrow> Id \\<rightarrow> \\<langle>nat_rel\\<rangle>nres_rel\"\n  unfolding   ballot_rel_def\n  apply (auto simp del : is_less_preferred_than.simps)\n  apply (rename_tac pl pr a b)\n  unfolding pc_foldli_list_def pc_foldli_def\n  apply (refine_vcg nfoldli_rule)\n  apply (auto simp del : is_less_preferred_than_l.simps is_less_preferred_than.simps)\n  apply (rename_tac l r)\n  apply (metis in_br_conv is_less_preferred_than_eq)+\n  done\n\nlemma pc_foldli_list_correct:\n  shows \"(pc_foldli_list, (\\<lambda> p a b. SPEC (\\<lambda> wc. wc = prefer_count p a b)))\n    \\<in> profile_rel \\<rightarrow> Id \\<rightarrow> Id \\<rightarrow> \\<langle>nat_rel\\<rangle>nres_rel\"\n  apply(refine_vcg) \n  apply (clarsimp_all simp del: prefer_count.simps)\n  apply (rename_tac pl pr a b) \nproof -\n  fix pl :: \"'a Profile_List\"\n  fix pr :: \"'a Profile\"\n  fix a :: 'a\n  fix b :: 'a\n  assume profr: \"(pl, pr) \\<in> profile_rel\"\n  note ref_two_step[OF pc_foldli_list_refine[THEN fun_relD, THEN fun_relD,\n          THEN fun_relD, THEN nres_relD]\n            pc_foldli_correct, where x5 = pl and p1=pr and x4 = a and a1 = a\n             and x3 = b and b1 = b] \nrefine_IdD \n  from profr this show \"pc_foldli_list pl a b \\<le> RES {prefer_count pr a b}\"\n    by fastforce\nqed\n\ndefinition prefer_count_monadic_imp:: \"'a::{default, heap, hashable} Profile_List \n  \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> nat nres\" where \n\"prefer_count_monadic_imp p a b \\<equiv> \n  nfoldli p (\\<lambda>_.True) (\\<lambda> x ac. \n  do {\n    b_less_a \\<leftarrow> is_less_preferred_than_ref b x a;\n    RETURN  (if b_less_a then (ac+1) else (ac)) \n  }) (0::nat)\"\n\nlemma prefer_count_monadic_imp_refine:\n  shows \"(prefer_count_monadic_imp, pc_foldli_list) \n\\<in> \\<langle>\\<langle>Id\\<rangle>list_rel\\<rangle>list_rel \\<rightarrow> Id \\<rightarrow> Id \\<rightarrow> \\<langle>nat_rel\\<rangle>nres_rel\"\n  unfolding prefer_count_monadic_imp_def pc_foldli_list_def\n  apply (refine_vcg is_less_preferred_than_ref_refine)\n  apply (refine_dref_type)\n    apply (auto simp del : is_less_preferred_than_l.simps)\nproof (rename_tac b a l)\n  fix a b :: 'a\n  fix l :: \"'a Preference_List\"\n  assume alpb: \"a \\<lesssim>\\<^sub>l b\"\n  note iq = is_less_preferred_than_ref_refine[THEN fun_relD,THEN fun_relD,THEN fun_relD,\n        THEN nres_relD] \n  from alpb iq[where x3= a and x'3 =a and x2 = l and x'2 =l and x1 =b and x'1 =b]\n    show \"(a p\\<lesssim>\\<^sub>l b) \\<le> SPEC (\\<lambda>b_less_a. b_less_a)\"\n      using conc_trans_additional(6) by fastforce\n  next\n    fix a b :: 'a\n  fix l :: \"'a Preference_List\"\n  assume alpb: \"\\<not> a \\<lesssim>\\<^sub>l b\"\n  note iq = is_less_preferred_than_ref_refine[THEN fun_relD,THEN fun_relD,THEN fun_relD,\n        THEN nres_relD] \n  from alpb iq[where x3= a and x'3 =a and x2 = l and x'2 =l and x1 =b and x'1 =b]\n  show \"(a p\\<lesssim>\\<^sub>l b) \\<le> SPEC (Not)\"\n    using conc_trans_additional(6) by fastforce\n  qed\n\ntheorem prefer_count_monadic_imp_correct:\n  assumes \"(pl, pr) \\<in> profile_rel\"\n  shows \"prefer_count_monadic_imp pl a b \\<le> SPEC (\\<lambda> pc. pc = prefer_count pr a b)\"\n  using assms(1) ref_two_step[OF prefer_count_monadic_imp_refine [THEN fun_relD,THEN fun_relD,THEN fun_relD,THEN nres_relD] \n      pc_foldli_list_correct[THEN fun_relD,THEN fun_relD,THEN fun_relD,THEN nres_relD,THEN refine_IdD],\n      where x10 = pl and x5 = pl and x'5 = pr] refine_IdD\n  by (metis list_rel_id IdI)\n\nlemma prefer_count_monadic_correct_rel:\n  shows \"(prefer_count_monadic_imp, RETURN ooo prefer_count)\n    \\<in> profile_rel \\<rightarrow> Id \\<rightarrow> Id \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"\nproof (refine_vcg, clarify, unfold comp_apply, (clarsimp simp del: prefer_count.simps),\n    rename_tac pl pr a b)\n  fix a b :: \"'a\"\n  fix pr :: \"'a Profile\"\n  fix pl :: \"'a Profile_List\"\n  assume prel: \"(pl, pr) \\<in> profile_rel\"\n  then show \"prefer_count_monadic_imp pl a b \\<le> RETURN (prefer_count pr a b) \"\n  using   ref_two_step[OF prefer_count_monadic_imp_refine [THEN fun_relD,THEN fun_relD,THEN fun_relD,THEN nres_relD] \n      pc_foldli_list_correct[THEN fun_relD,THEN fun_relD,THEN fun_relD,THEN nres_relD,THEN refine_IdD]] \n  IdI\n  unfolding SPEC_eq_is_RETURN(2)\n  by fastforce\nqed\n\nsepref_definition prefer_count_sep is\n  \"uncurry2 prefer_count_monadic_imp\" :: \"(profile_impl_assn id_assn)\\<^sup>k *\\<^sub>a id_assn\\<^sup>k  *\\<^sub>a id_assn\\<^sup>k\n    \\<rightarrow>\\<^sub>a nat_assn\"\n  unfolding prefer_count_monadic_imp_def \n  apply sepref_dbg_keep\n  done\n\nsepref_register prefer_count_monadic_imp\n\ndeclare prefer_count_sep.refine [sepref_fr_rules]\n\ndefinition wins_monadic :: \"'a::{default, heap, hashable}\n   \\<Rightarrow> 'a Profile_List \\<Rightarrow> 'a \\<Rightarrow> bool nres\" where\n  \"wins_monadic x p y \\<equiv> do {\n    pxy \\<leftarrow> prefer_count_monadic_imp p x y;\n    pyx \\<leftarrow> prefer_count_monadic_imp p y x;\n    RETURN (pxy > pyx)\n}\"\n\nlemma prefer_count_l_correct:\n  shows \"(prefer_count_l, prefer_count)\n    \\<in> profile_rel \\<rightarrow> Id \\<rightarrow> Id \\<rightarrow> nat_rel\"\n  apply (auto simp del: prefer_count_l.simps prefer_count.simps)\n  apply (rename_tac pl pr)\nproof (standard, standard, rename_tac a b)\n  fix pl :: \"'a Profile_List\"\n  fix pr :: \"'a Profile\"\n  fix a:: 'a and b:: 'a\n  assume \"(pl, pr) \\<in> profile_rel\"\n  from this have meq: \"RETURN (prefer_count_l pl a b) = RETURN (prefer_count pr a b)\"\n    using pc_fold_monad_eq[where p = pl and a=a and b=b]\n        pc_foldli_list_correct[THEN fun_relD,THEN fun_relD,THEN fun_relD,THEN nres_relD, \n        where x3 = pl and x'3=pr and x2 = a and x'2 = a\n             and x1 = b and x'1 = b]\n    by (metis (full_types) RETURN_ref_SPECD pair_in_Id_conv)\n  from meq show \"prefer_count_l pl a b = prefer_count pr a b\"\n    by simp\nqed\n\nlemma prefer_count_l_eq:\n  fixes pl :: \"'a Profile_List\"\n  fixes pr :: \"'a Profile\"\n  assumes prel: \"(pl, pr) \\<in> profile_rel\"\n  shows \"prefer_count_l pl a b = prefer_count pr a b\"\n  using prefer_count_l_correct[THEN fun_relD, THEN fun_relD, THEN fun_relD,\n      where x2 = pl and x'2 = pr and x1 = a and x'1 = a and x = b and x' = b]\n  assms by auto\n\n\nlemma prefer_count_monadic_imp_ref_l:\n  shows \"(prefer_count_monadic_imp, RETURN ooo prefer_count_l)\n    \\<in>  \\<langle>\\<langle>Id\\<rangle>list_rel\\<rangle>list_rel \\<rightarrow> Id \\<rightarrow> Id \\<rightarrow> \\<langle>nat_rel\\<rangle>nres_rel\"\nproof (clarsimp simp del: prefer_count_l.simps, rename_tac pl a b,\n    refine_vcg, unfold conc_fun_RETURN[symmetric], rule refine_IdI)\n  fix pl :: \"'a Profile_List\"\n  fix a:: 'a and b:: 'a\n  note pcr = prefer_count_monadic_imp_refine[THEN fun_relD,THEN fun_relD,THEN fun_relD,\n      THEN nres_relD, THEN refine_IdD]\n  pc_fold_monad_eq[symmetric]\n  from this show \"prefer_count_monadic_imp pl a b \\<le> RETURN (prefer_count_l pl a b)\"\n    using IdI list_rel_id by (metis)\nqed\n\nlemma imp_direct_ref: \n  fixes pl :: \"'a::{default, heap, hashable} Profile_List\"\n  fixes a b :: \"'a::{default,  heap, hashable}\"\n  shows\"prefer_count_monadic_imp pl a b \\<le> RETURN (prefer_count_l pl a b)\"\nproof -\n  have \"(pl, pl) \\<in> \\<langle>\\<langle>Id\\<rangle>list_rel\\<rangle>list_rel\" using list_rel_id IdI by simp\n  thus ?thesis\n  using prefer_count_monadic_imp_ref_l[THEN fun_relD, THEN fun_relD, THEN fun_relD\n      ,THEN nres_relD, THEN refine_IdD] IdI unfolding comp_def\n  by metis\nqed\n\n\nlemma wins_monadic_correct:\n  shows \"(wins_monadic, (\\<lambda> A p a. SPEC (\\<lambda> is_win. is_win = wins A p a))) \\<in> Id \\<rightarrow> profile_rel \\<rightarrow> Id \\<rightarrow> \\<langle>bool_rel\\<rangle>nres_rel\"\n  unfolding wins_monadic_def wins.simps\n  apply (clarsimp simp del: prefer_count.simps)\n  apply (refine_vcg prefer_count_monadic_imp_correct)\n  by (auto)  \n\nsepref_definition wins_imp is \"uncurry2 wins_monadic\" ::\n  \"(nat_assn\\<^sup>k *\\<^sub>a (profile_impl_assn id_assn)\\<^sup>k *\\<^sub>a nat_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn )\"\n  unfolding wins_monadic_def\n  apply sepref_dbg_keep\n  done\n\nlemma wins_l_correct:\n  shows \"(wins_l, wins)\n    \\<in> Id \\<rightarrow> profile_rel \\<rightarrow> Id \\<rightarrow> bool_rel\"\n  apply(refine_vcg)\nproof (clarsimp simp del: prefer_count_l.simps prefer_count.simps, rename_tac a pl pr b, safe)\n  fix pl :: \"'a Profile_List\"\n  fix pr :: \"'a Profile\"\n  fix a:: 'a and b:: 'a\n  assume a1: \"(pl, pr) \\<in> profile_rel\"\n  assume a2: \"prefer_count_l pl b a < prefer_count_l pl a b\"\n  note eq = prefer_count_l_correct[THEN fun_relD,THEN fun_relD,THEN fun_relD, \n        where x2= pl and x'2=pr]\n  from eq a1 have \"\\<forall> alt1 alt2. prefer_count_l pl alt1 alt2 = prefer_count pr alt1 alt2 \"\n    by blast   \n  from a2 this show  \"prefer_count pr b a < prefer_count pr a b\"\n    by fastforce\nnext \n  fix pl :: \"'a Profile_List\"\n  fix pr :: \"'a Profile\"\n  fix a:: 'a and b:: 'a\n  assume a1: \"(pl, pr) \\<in> profile_rel\"\n  assume a2: \"prefer_count pr b a < prefer_count pr a b\"\n  note eq = prefer_count_l_correct[THEN fun_relD,THEN fun_relD,THEN fun_relD, \n        where x2= pl and x'2=pr]\n  from eq a1 have \"\\<forall> alt1 alt2. prefer_count_l pl alt1 alt2 = prefer_count pr alt1 alt2 \"\n    by blast   \n  from a2 this show  \"prefer_count_l pl b a < prefer_count_l pl a b\"\n    by fastforce\nqed\n\nlemma wins_monadic_refine:\n  shows \"(wins_monadic, RETURN ooo wins_l) \\<in> Id \\<rightarrow> \\<langle>\\<langle>Id\\<rangle>list_rel\\<rangle>list_rel \\<rightarrow> Id \\<rightarrow> \\<langle>Id\\<rangle>nres_rel\"\n  unfolding wins_monadic_def wins_l.simps\nproof (clarsimp simp del: prefer_count_l.simps, rule nres_relI, rule refine_IdI,\n   refine_vcg , unfold SPEC_eq_is_RETURN(1), rename_tac a pl b )\n  fix pl :: \"'a Profile_List\"\n  fix a:: 'a and b:: 'a\n  note pcab = imp_direct_ref[where pl = pl and a = a and b = b]\n  note pcba = imp_direct_ref[where pl = pl and a = b and b = a]\n  have \"prefer_count_monadic_imp pl a b\n       \\<le> SPEC (\\<lambda>pab. pab = prefer_count_l pl a b)\"\n    using pcab SPEC_eq_is_RETURN(2)[symmetric, where y = \"prefer_count_l pl a b\"]\n    by metis\n  from this pcab pcba show \"prefer_count_monadic_imp pl a b\n       \\<le> SPEC (\\<lambda>pxy. prefer_count_monadic_imp pl b a \\<bind> (\\<lambda>pyx. RETURN (pyx < pxy))\n                      \\<le> RETURN (prefer_count_l pl b a < prefer_count_l pl a b))\"\n    using bind_rule SPEC_cons_rule SPEC_eq_is_RETURN(1)\n    by (smt (z3)  order_eq_refl specify_left)\nqed\n \n\nlemma condorcet_winner_l_correct:\n  shows \"(condorcet_winner_l, condorcet_winner)\n    \\<in> \\<langle>Id\\<rangle>set_rel \\<rightarrow> profile_rel \\<rightarrow> Id \\<rightarrow> bool_rel\"\n  apply (refine_vcg)\n  apply (clarsimp simp del : wins_l.simps wins.simps)\nproof (rename_tac A pl pr alt, safe)\n  fix pl :: \"'a Profile_List\"\n  fix pr :: \"'a Profile\"\n  fix A:: \"'a set\" and alt:: 'a\n  assume a1: \"(pl, pr) \\<in> profile_rel\"\n  assume a2: \"profile_l A pl\"\n  note winc = wins_l_correct[unfolded fref_def, THEN fun_relD, THEN fun_relD,THEN fun_relD,\n      where x2 = alt and x'2 = alt and x1 = pl and x'1 = pr]\n  note profr = profile_ref\n  from a1 a2 profr show \"(profile A pr)\"\n    by metis\nnext\n  fix pl :: \"'a Profile_List\"\n  fix pr :: \"'a Profile\"\n  fix A:: \"'a set\" and alt:: 'a\n  fix con:: 'a\n  assume a1: \"(pl, pr) \\<in> profile_rel\"\n  assume a2: \"con \\<in> A\"\n  assume a3: \"\\<not> wins alt pr con\"\n  assume altwins: \"\\<forall>x\\<in>A - {alt}. wins_l alt pl x\"\n  note winc = wins_l_correct[unfolded fref_def, THEN fun_relD, THEN fun_relD,THEN fun_relD,\n      where x2 = alt and x'2 = alt and x1 = pl and x'1 = pr]\n  from a1 a3 winc have \"\\<not> wins_l alt pl con\" by blast\n  from altwins a2 this show \"con = alt\" by blast\nnext\n  fix pl :: \"'a Profile_List\"\n  fix pr :: \"'a Profile\"\n  fix A:: \"'a set\" and alt:: 'a\n  assume a1: \"(pl, pr) \\<in> profile_rel\"\n  assume a2: \"profile A pr\"\n  note winc = wins_l_correct[unfolded fref_def, THEN fun_relD, THEN fun_relD,THEN fun_relD,\n      where x2 = alt and x'2 = alt and x1 = pl and x'1 = pr]\n  note profr = profile_ref\n  from a1 a2 profr show \"(profile_l A pl)\"\n    by blast\nnext\n  fix pl :: \"'a Profile_List\"\n  fix pr :: \"'a Profile\"\n  fix A:: \"'a set\" and alt:: 'a\n  fix con:: 'a\n  assume a1: \"(pl, pr) \\<in> profile_rel\"\n  assume a2: \"con \\<in> A\"\n  assume a3: \"\\<not> wins_l alt pl con\"\n  assume altwins: \"\\<forall>x\\<in>A - {alt}. wins alt pr x\"\n  note winc = wins_l_correct[THEN fun_relD, THEN fun_relD,THEN fun_relD,\n      where x2 = alt and x'2 = alt and x1 = pl and x'1 = pr]\n  from a1 a3 winc have \"\\<not> wins alt pr con\" by blast\n  from altwins a2 this show \"con = alt\" by blast\nqed\n\ndefinition condorcet_winner_monadic :: \"'a::{default, heap, hashable} set \n  \\<Rightarrow> 'a Profile_List \\<Rightarrow> 'a \\<Rightarrow> bool nres\" where\n  \"condorcet_winner_monadic A p w \\<equiv> \n    if (w \\<in> A) then\n    FOREACHc A (\\<lambda> sigma. sigma = True)\n     (\\<lambda> x b. do {\n     winswx \\<leftarrow> wins_monadic w p x;\n      RETURN (if (x = w) then True\n      else ((winswx)))\n    }) (True)\n    else RETURN False\"\n\n\nsepref_definition cond_imp is \"uncurry2 condorcet_winner_monadic\" \n  :: \"(alts_set_impl_assn id_assn)\\<^sup>k *\\<^sub>a (profile_impl_assn id_assn)\\<^sup>k *\\<^sub>a id_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n  unfolding condorcet_winner_monadic_def wins_monadic_def\n  apply sepref_dbg_keep\n  done\n\nsepref_register condorcet_winner_monadic\n\ndeclare cond_imp.refine [sepref_fr_rules]\n\nlemma condorcet_winner_monadic_correct:\n  fixes A :: \"'a::{default, heap, hashable} set\"\n  fixes pl :: \"'a::{default, heap, hashable} Profile_List\"\n    and pr :: \"'a::{default, heap, hashable} Profile\"\n   assumes prel: \"(pl, pr) \\<in> profile_rel\" and profp: \"profile A pr\" \n  assumes fina: \"finite A\" \n  shows \"condorcet_winner_monadic A pl a\n  \\<le> SPEC (\\<lambda> is_win. is_win = condorcet_winner A pr a)\"\nproof (unfold condorcet_winner_monadic_def RETURN_SPEC_conv FOREACH_def[symmetric]\n    , auto simp del: condorcet_winner.simps)\n  assume winner_in: \"a \\<in> A\"\n  note winsc = wins_monadic_correct[THEN fun_relD,THEN fun_relD,THEN fun_relD,THEN nres_relD, THEN refine_IdD]\n  from winner_in  have  \" FOREACH\\<^sub>C A (\\<lambda>sigma. sigma)\n     (\\<lambda>x b. wins_monadic a pl x \\<bind> (\\<lambda>winswx. RES {if x = a then True else winswx})) True\n    \\<le> SPEC (\\<lambda> is_win. is_win =  condorcet_winner A pr a)\"\n      apply (refine_vcg  FOREACHc_rule [where I =\" \\<lambda> it b. b =\n    (\\<forall>x\\<in>(A - it) - {a}. wins a pr x)\"] winsc prel fina profp)\n    by  (auto simp add: winner_in fina  profp simp del: wins.simps)\n  from this show \" a \\<in> A \\<Longrightarrow>\n    FOREACH\\<^sub>C A (\\<lambda>sigma. sigma)\n     (\\<lambda>x b. wins_monadic a pl x \\<bind> (\\<lambda>winswx. RES {if x = a then True else winswx})) True\n    \\<le> RES {condorcet_winner A pr a}\" by simp\nnext\n  assume aA: \"a \\<notin> A\"\n  assume condwa: \"condorcet_winner A pr a\"\n  from aA condwa show \"False\" by simp   \nqed\n\nlemma cond_winner_l_unique:\n  fixes A:: \"'a set\" \n  fixes pl :: \"'a Profile_List\"\n  fixes pr :: \"'a Profile\"\n  fixes c :: 'a and w :: 'a\n  assumes\n    prel:     \"(pl, pr) \\<in> profile_rel\"    and\n    winner_c: \"condorcet_winner_l A pl c\" and\n    winner_w: \"condorcet_winner_l A pl w\"\n  shows \"w = c\"\n  using condorcet_winner_l_correct[THEN fun_relD,THEN fun_relD, THEN fun_relD,\n      where x2 = A and x'2 = A and x1 = pl and x'1 = pr] set_rel_id_simp\n    cond_winner_unique[where A = A and p = pr and c = c and w = w]\n  assms by blast\n\nlemma cond_winner_l_unique2:\n  fixes A:: \"'a set\" \n  fixes pl :: \"'a Profile_List\"\n  fixes pr :: \"'a Profile\"\n  fixes x :: 'a and w :: 'a\n  assumes\n    prel:     \"(pl, pr) \\<in> profile_rel\"    and\n    winner: \"condorcet_winner_l A pl w\" and\n    not_w:  \"x \\<noteq> w\"\n  shows \"\\<not> condorcet_winner_l A pl x\"\n  using condorcet_winner_l_correct[THEN fun_relD,THEN fun_relD,THEN fun_relD,\n      where x2 = A and x'2 = A and x1 = pl and x'1 = pr]  set_rel_id_simp\n    cond_winner_unique2[where A = A and p = pr and x = x and w = w]\n  assms by blast\n\nlemma cond_winner_unique3_l:\n  fixes A:: \"'a set\" \n  fixes pl :: \"'a Profile_List\"\n  fixes pr :: \"'a Profile\"\n  fixes w :: 'a\n  assumes\n    prel:     \"(pl, pr) \\<in> profile_rel\"    and\n    wcond:    \"condorcet_winner_l A pl w\"\n  shows \"{a \\<in> A. condorcet_winner_l A pl a} = {w}\"\n  using condorcet_winner_l_correct[THEN fun_relD,THEN fun_relD,THEN fun_relD,\n      where x2 = A and x'2 = A and x1 = pl and x'1 = pr]  set_rel_id_simp\n    cond_winner_unique3[where A = A and p = pr and w = w]\n  assms by blast\n\nsubsubsection \\<open>Convert HOL types to heap data structures\\<close>\n\ndefinition convert_list :: \"'a::{default, heap} list \\<Rightarrow> 'a list nres\"  where\n  \"convert_list l \\<equiv>\n  nfoldli l (\\<lambda> x. True)\n (\\<lambda> x nl.\n    RETURN (nl @ [x])) []\"\n\nsepref_definition clist is \"convert_list\" :: \"(list_assn id_assn)\\<^sup>d\n \\<rightarrow>\\<^sub>a (arl_assn nat_assn)\"\n  unfolding convert_list_def \n  apply (rewrite in \"nfoldli _ _ _ rewrite_HOLE\" arl.fold_custom_empty)\n  by sepref\n\ndefinition convert_list_to_set :: \"'a::{default, heap} list \\<Rightarrow> 'a set nres\"  where\n  \"convert_list_to_set l \\<equiv> \n  nfoldli l (\\<lambda> x. True)\n (\\<lambda> x ns.\n    RETURN (insert x ns)) {}\"\n\n\nsepref_definition convert_list_to_hash_set is \"convert_list_to_set\" :: \"(list_assn id_assn)\\<^sup>d\n \\<rightarrow>\\<^sub>a (hs.assn nat_assn)\"\n  unfolding convert_list_to_set_def \n  apply (rewrite in \"nfoldli _ _ _ rewrite_HOLE\" hs.fold_custom_empty)\n  by sepref\n\nlemma convert_list_correct:\n  shows \"(convert_list, RETURN) \\<in> \\<langle>Id\\<rangle>list_rel \\<rightarrow> \\<langle>\\<langle>Id\\<rangle>list_rel\\<rangle>nres_rel\"\n  unfolding convert_list_def\n  apply (clarsimp, intro nres_relI refine_IdI)\n  apply (refine_vcg nfoldli_rule[where I = \"(\\<lambda> l1 l2 r.\n      (r = l1))\"])\n  by auto\n\n\nlemma convert_list_to_set_correct:\n  shows \"(convert_list_to_set, RETURN o set) \\<in> \\<langle>Id\\<rangle>list_rel \\<rightarrow> \\<langle>\\<langle>Id\\<rangle>set_rel\\<rangle>nres_rel\"\n  unfolding convert_list_to_set_def\n  apply (clarsimp, intro nres_relI refine_IdI)\n  apply (refine_vcg nfoldli_rule[where I = \"(\\<lambda> l1 l2 r.\n      (r = set l1))\"])\n  by auto\n\nsubsection \\<open>Monadic Implementation for Limiting Profiles\\<close>\n\ndefinition limit_profile_l :: \"'a::{default, hashable, heap} set \\<Rightarrow> \n    'a Profile_List \\<Rightarrow> 'a Profile_List nres\" where\n  \"limit_profile_l A p = \n    nfoldli p (\\<lambda>_. True)\n      (\\<lambda> x np. do {\n         newb \\<leftarrow> (limit_monadic A x);\n        RETURN (op_list_append np newb)}) []\"\n\nsepref_register limit_monadic\ndeclare limit_sep.refine [sepref_fr_rules]\n\nsepref_definition limit_profile_sep is \"uncurry (limit_profile_l)\" :: \n  \"(hs.assn id_assn)\\<^sup>k *\\<^sub>a (profile_impl_assn id_assn )\\<^sup>k \\<rightarrow>\\<^sub>a (profile_impl_assn id_assn )\"\n  unfolding limit_profile_l_def \n  apply (rewrite in \"nfoldli _ _ _ rewrite_HOLE\" HOL_list.fold_custom_empty)\n  apply sepref_dbg_keep\n  done\n\nsepref_register limit_profile_l\n\nlemma limitp_correct:\n  shows \"(uncurry limit_profile_l, uncurry (RETURN oo limit_profile)) \\<in> \n  [\\<lambda> (A, pl). finite A ]\\<^sub>f (\\<langle>Id\\<rangle>set_rel \\<times>\\<^sub>r  profile_rel) \\<rightarrow> \\<langle>profile_rel\\<rangle>nres_rel\"\nproof(intro frefI, unfold limit_profile_l_def comp_apply SPEC_eq_is_RETURN(2)[symmetric],\n    refine_vcg, auto, rename_tac A pl pr)\n  fix A :: \"'a set\"\n  fix pl:: \"'a Profile_List\" \n  fix pr :: \"'a Profile\"\n  assume fina : \"finite A\"\n  assume prel: \" (pl, pr) \\<in> profile_rel\"\n  show \" nfoldli pl (\\<lambda>_. True) (\\<lambda>x np. limit_monadic A x \\<bind> (\\<lambda>newb. RES {np @ [newb]})) []\n       \\<le> \\<Down> profile_rel (RES {map (limit A) pr})\"\n    apply (refine_vcg limit_monadic_refine  nfoldli_rule[where I = \"(\\<lambda> proc rem r. \n              r = map (limit_l A) proc)\"] )\n        apply (auto simp add: fina)  \n    unfolding  ballot_rel_def well_formed_pl_def  relAPP_def in_br_conv\n     in_br_conv  length_map limit_l_sound list_rel_eq_listrel listrel_iff_nth \n        nth_map prel  relAPP_def\n    apply safe using length_preserving\n    using prel list_rel_imp_same_length prel  apply blast\n    using limit_eq\n      apply (metis ballot_rel_def list_rel_imp_same_length map_in_list_rel_conv nth_map \n          nth_mem prel  profile_rel_imp_map_ballots)\n     using limit_eq\n      apply (metis ballot_rel_def list_rel_imp_same_length map_in_list_rel_conv nth_map \n          nth_mem prel  profile_rel_imp_map_ballots)\n     using prel limit_l_sound   \n     by (metis ballot_rel_def  map_in_list_rel_conv nth_map nth_mem \n         profile_rel_imp_map_ballots well_formed_pl_def)\n  \nqed\n\ndefinition \"ballot_assn R \\<equiv> (hr_comp (ballot_impl_assn R) ballot_rel)\"\n\nlemma limit_profile_sep_correct:\n  shows \"(uncurry limit_profile_sep, uncurry (RETURN \\<circ>\\<circ> limit_profile))\n    \\<in> [\\<lambda>(a, b).\n           finite\n            a]\\<^sub>a (alts_set_impl_assn id_assn)\\<^sup>k *\\<^sub>a\n                 (list_assn\n                   (ballot_assn id_assn))\\<^sup>k \\<rightarrow> list_assn\n                                        (ballot_assn id_assn)\"\n\n  using limit_profile_sep.refine[FCOMP limitp_correct]  set_rel_id hr_comp_Id2 \n  unfolding ballot_assn_def\n    by (simp)\n\ndeclare limit_profile_sep_correct [sepref_fr_rules]\n\n\nlemma limit_profile_sound_sep:\n  shows \"s \\<subseteq> A \\<and> finite_profile A p \\<Longrightarrow> <(alts_set_impl_assn nat_assn) s hs *\n            (list_assn (ballot_assn nat_assn)) p hp> limit_profile_sep hs hp \n  < \\<lambda>r. \\<exists>\\<^sub>Ares.  list_assn (ballot_assn nat_assn) p hp * \n                (list_assn (ballot_assn nat_assn)) res r * \\<up> (finite_profile s res) >\\<^sub>t\"\nproof (clarsimp)\n  assume sA: \"s \\<subseteq> A\"\n  assume fina: \"finite A\"\n  assume prof: \"profile A p\"\n  from sA fina have fins: \"finite s\"\n    using rev_finite_subset by blast\n  have postapp: \"\\<And>x. (\\<exists>\\<^sub>Axa. alts_set_impl_assn nat_assn s hs *\n                list_assn (ballot_assn nat_assn) p hp *\n                list_assn (ballot_assn nat_assn) xa x *\n                true *\n                \\<up> (xa = map (limit s) p)) \\<Longrightarrow>\\<^sub>A \n        ( \\<exists>\\<^sub>Ares.  list_assn (ballot_assn nat_assn) p hp *\n             list_assn (ballot_assn nat_assn) res x * true *\n             \\<up> (finite_profile s res))\" \n    using limit_profile_sound[where S = A and p = p and A = s] \n    apply sep_auto\n    using fins apply blast\n    by (simp add: fina prof sA)\n  from this fins show \"<alts_set_impl_assn nat_assn s hs *\n     list_assn (ballot_assn nat_assn) p hp>\n    limit_profile_sep hs hp\n    <\\<lambda>r. \\<exists>\\<^sub>Ares.  list_assn (ballot_assn nat_assn) p hp *\n             list_assn (ballot_assn nat_assn) res r * true *\n             \\<up> (finite_profile s res)>\" \n    using limit_profile_sep_correct[THEN hfrefD, THEN hn_refineD, of \"(s, p)\" \"(hs, hp)\", simplified]\n          cons_rule[where P = \"(alts_set_impl_assn nat_assn) s hs *\n            (list_assn (ballot_assn nat_assn)) p hp\"\n          and P' = \"(alts_set_impl_assn nat_assn) s hs *\n            (list_assn\n                   (hr_comp (ballot_impl_assn nat_assn)\n                     ballot_rel)) p hp\" and Q = \"(\\<lambda> r. \\<exists>\\<^sub>Ax. alts_set_impl_assn nat_assn s hs *\n                list_assn (ballot_assn nat_assn) p hp *\n                list_assn (ballot_assn nat_assn) x r *\n                true *\n                \\<up> (x = map (limit s) p))\"\n           and Q' = \"\\<lambda>r. \\<exists>\\<^sub>Ares.  list_assn (ballot_assn nat_assn) p hp *\n             list_assn (ballot_assn nat_assn) res r * true *\n             \\<up> (finite_profile s res)\"\n            and c = \"limit_profile_sep hs hp\"]\n      using ent_refl\n      by (simp add: ballot_assn_def) \n    \nqed\n\nend", "meta": {"author": "SpringVaS", "repo": "RefinementOfVotingRules", "sha": "a01e44b062fb43e172dff81cffbf941856c977d8", "save_path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules", "path": "github-repos/isabelle/SpringVaS-RefinementOfVotingRules/RefinementOfVotingRules-a01e44b062fb43e172dff81cffbf941856c977d8/theories/Compositional_Structures/Basic_Modules/Component_Types/Social_Choice_Types/Profile_List_Monadic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241632752915, "lm_q2_score": 0.5, "lm_q1q2_score": 0.31306208163764576}}
{"text": "section \\<open>Safety properties\\<close>\n\n(* Verification of safety properties *)\ntheory Safety_Properties\nimports Automation_Setup \"Bounded_Deducibility_Security.IO_Automaton\"\nbegin\n\n\n(* Note that the safety properties are only concerned with the\nstep actions (creation, update and u-update) and their action on the state;\nthey have nothing to do with the observation actions.  *)\n\n\ninterpretation IO_Automaton where\nistate = istate and step = step\ndone\n\n\nsubsection \\<open>Infrastructure for invariance reasoning\\<close>\n\ndefinition cIsInvar :: \"(state \\<Rightarrow> bool) \\<Rightarrow> bool\" where\n\"cIsInvar \\<phi> \\<equiv> \\<forall> s ca. reach s \\<and> \\<phi> s \\<longrightarrow> \\<phi> (snd (cStep s ca))\"\n\ndefinition uIsInvar :: \"(state \\<Rightarrow> bool) \\<Rightarrow> bool\" where\n\"uIsInvar \\<phi> \\<equiv> \\<forall> s ua. reach s \\<and> \\<phi> s \\<longrightarrow> \\<phi> (snd (uStep s ua))\"\n\ndefinition uuIsInvar :: \"(state \\<Rightarrow> bool) \\<Rightarrow> bool\" where\n\"uuIsInvar \\<phi> \\<equiv> \\<forall> s uua. reach s \\<and> \\<phi> s \\<longrightarrow> \\<phi> (snd (uuStep s uua))\"\n\n(* for properties on states, of course the observations do not count: *)\nlemma invar_cIsInvar_uIsInvar_uuIsInvar:\n\"invar \\<phi> \\<longleftrightarrow> cIsInvar \\<phi> \\<and> uIsInvar \\<phi> \\<and> uuIsInvar \\<phi>\" (is \"?L \\<longleftrightarrow> ?R\")\nunfolding invar_def cIsInvar_def uIsInvar_def uuIsInvar_def fun_eq_iff\n  apply standard\n  apply (metis snd_eqD step.simps)\n  apply safe\n  subgoal for _ a apply(cases a, auto) .\n  done\n\nlemma cIsInvar[case_names cUser cConf cPC cChair cPaper cAuthor cConflict cReview]:\nassumes\n\"\\<And>s uID p name info email.\n       \\<lbrakk>reach s; \\<phi> s; e_createUser s uID p name info email\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (createUser s uID p name info email)\"\nand\n\"\\<And>s confID uID p name info.\n       \\<lbrakk>reach s; \\<phi> s; e_createConf s confID uID p name info\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (createConf s confID uID p name info)\"\nand\n\"\\<And>s confID uID p uID'.\n       \\<lbrakk>reach s; \\<phi> s; e_createPC s confID uID p uID'\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (createPC s confID uID p uID')\"\nand\n\"\\<And>s confID uID p uID'.\n       \\<lbrakk>reach s; \\<phi> s; e_createChair s confID uID p uID'\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (createChair s confID uID p uID')\"\nand\n\"\\<And>s confID uID p papID name info.\n       \\<lbrakk>reach s; \\<phi> s; e_createPaper s confID uID p papID name info\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (createPaper s confID uID p papID name info)\"\nand\n\"\\<And>s confID uID p papID uID'.\n       \\<lbrakk>reach s; \\<phi> s; e_createAuthor s confID uID p papID uID'\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (createAuthor s confID uID p papID uID')\"\nand\n\"\\<And>s confID uID p papID uID'.\n       \\<lbrakk>reach s; \\<phi> s; e_createConflict s confID uID p papID uID'\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (createConflict s confID uID p papID uID')\"\nand\n\"\\<And>s confID uID p papID uID'.\n       \\<lbrakk>reach s; \\<phi> s; e_createReview s confID uID p papID uID'\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (createReview s confID uID p papID uID')\"\nshows \"cIsInvar \\<phi>\"\nunfolding cIsInvar_def apply safe subgoal for _ ca using assms by (cases ca, auto) .\n\nlemma uIsInvar[case_names uUser uConfA uNextPhase uPaperTA uPaperC uPref uReview]:\nassumes\n\"\\<And>s uID p p' name info email.\n       \\<lbrakk>reach s; \\<phi> s; e_updateUser s uID p p' name info email\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (updateUser s uID p p' name info email)\"\n and\n\"\\<And>s confID uID p.\n       \\<lbrakk>reach s; \\<phi> s; e_updateConfA s confID uID p\\<rbrakk> \\<Longrightarrow> \\<phi> (updateConfA s confID uID p)\"\nand\n\"\\<And>s confID uID p ph.\n       \\<lbrakk>reach s; \\<phi> s; e_updatePhase s confID uID p ph\\<rbrakk> \\<Longrightarrow> \\<phi> (updatePhase s confID uID p ph)\"\nand\n\"\\<And>s confID uID p paperID name info.\n       \\<lbrakk>reach s; \\<phi> s; e_updatePaperTA s confID uID p paperID name info\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (updatePaperTA s confID uID p paperID name info)\"\nand\n\"\\<And>s confID uID p paperID pc.\n       \\<lbrakk>reach s; \\<phi> s; e_updatePaperC s confID uID p paperID pc\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (updatePaperC s confID uID p paperID pc)\"\nand\n\"\\<And>s confID uID p paperID preference.\n       \\<lbrakk>reach s; \\<phi> s; e_updatePref s confID uID p paperID preference\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (updatePref s confID uID p paperID preference)\"\nand\n\"\\<And>s confID uID p paperID n rc.\n       \\<lbrakk>reach s; \\<phi> s; e_updateReview s confID uID p paperID n rc\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (updateReview s confID uID p paperID n rc)\"\nand\n\"\\<And>s confID uID p paperID fpc.\n       \\<lbrakk>reach s; \\<phi> s; e_updateFPaperC s confID uID p paperID fpc\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (updateFPaperC s confID uID p paperID fpc)\"\nshows \"uIsInvar \\<phi>\"\nunfolding uIsInvar_def apply safe using assms subgoal for _ ua by (cases ua, auto) .\n\nlemma uuIsInvar[case_names uuNews uuDis uuReview uuDec]:\nassumes\n\"\\<And>s confID uID p comm.\n       \\<lbrakk>reach s; \\<phi> s; e_uupdateNews s confID uID p comm\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (uupdateNews s confID uID p comm)\"\nand\n\"\\<And>s confID uID p paperID comm.\n       \\<lbrakk>reach s; \\<phi> s; e_uupdateDis s confID uID p paperID comm\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (uupdateDis s confID uID p paperID comm)\"\nand\n\"\\<And>s confID uID p paperID n rc.\n       \\<lbrakk>reach s; \\<phi> s; e_uupdateReview s confID uID p paperID n rc\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (uupdateReview s confID uID p paperID n rc)\"\nand\n\"\\<And>s confID uID p paperID decision.\n       \\<lbrakk>reach s; \\<phi> s; e_uupdateDec s confID uID p paperID decision\\<rbrakk>\n       \\<Longrightarrow> \\<phi> (uupdateDec s confID uID p paperID decision)\"\nshows \"uuIsInvar \\<phi>\"\nunfolding uuIsInvar_def apply safe subgoal for _ uua using assms by (cases uua, auto) .\n\n\nsubsection \\<open>Safety proofs\\<close>\n\n(* Simplification and splitting setup: *)\ndeclare option.splits[split] paper.splits[split] discussion.splits[split] role.splits[split]\n        Let_def[simp] list_all_iff[simp] list_ex_iff[simp] fun_upd2_def[simp] IDsOK_def[simp]\n        if_splits[split]\n\n\nfun papIDsOfRole where\n\"papIDsOfRole (Aut papID) = [papID]\"\n|\n\"papIDsOfRole (Rev papID n) = [papID]\"\n|\n\"papIDsOfRole _ = []\"\n\n(* The phase is always \\<le> closedPH: *)\ndefinition phase_leq_closedPH :: \"state \\<Rightarrow> bool\" where\n\"phase_leq_closedPH s \\<equiv>\n \\<forall> confID. phase s confID \\<le> closedPH\"\n\nlemma holdsIstate_phase_leq_closedPH: \"holdsIstate phase_leq_closedPH\"\nunfolding IO_Automaton.holdsIstate_def istate_def phase_leq_closedPH_def by auto\n\nlemma cIsInvar_phase_leq_closedPH: \"cIsInvar phase_leq_closedPH\"\napply (cases phase_leq_closedPH rule: cIsInvar)\nby (auto simp: c_defs phase_leq_closedPH_def)\n\nlemma uIsInvar_phase_leq_closedPH: \"uIsInvar phase_leq_closedPH\"\napply (cases phase_leq_closedPH rule: uIsInvar)\nby (auto simp: u_defs phase_leq_closedPH_def)\n\nlemma uuIsInvar_phase_leq_closedPH: \"uuIsInvar phase_leq_closedPH\"\napply (cases phase_leq_closedPH rule: uuIsInvar)\nby (auto simp: uu_defs phase_leq_closedPH_def)\n\nlemma invar_phase_leq_closedPH: \"invar phase_leq_closedPH\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_phase_leq_closedPH uIsInvar_phase_leq_closedPH uuIsInvar_phase_leq_closedPH by auto\n\nlemmas phase_leq_closedPH1 =\nholdsIstate_invar[OF holdsIstate_phase_leq_closedPH invar_phase_leq_closedPH]\n\ntheorem phase_leq_closedPH:\nassumes a: \"reach s\"\nshows \"phase s confID \\<le> closedPH\"\nusing phase_leq_closedPH1[OF a] unfolding phase_leq_closedPH_def by auto\n\n(* A conference ID exsists if its phase is > noPH: *)\ndefinition geq_noPH_confIDs :: \"state \\<Rightarrow> bool\" where\n\"geq_noPH_confIDs s \\<equiv>\n \\<forall> confID. phase s confID > noPH \\<longrightarrow> confID \\<in>\\<in> confIDs s\"\n\nlemma holdsIstate_geq_noPH_confIDs: \"holdsIstate geq_noPH_confIDs\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def geq_noPH_confIDs_def by auto\n\nlemma cIsInvar_geq_noPH_confIDs: \"cIsInvar geq_noPH_confIDs\"\napply (cases geq_noPH_confIDs rule: cIsInvar)\nby (auto simp: c_defs geq_noPH_confIDs_def)\n\nlemma uIsInvar_geq_noPH_confIDs: \"uIsInvar geq_noPH_confIDs\"\napply (cases geq_noPH_confIDs rule: uIsInvar)\nby (auto simp: u_defs geq_noPH_confIDs_def)\n\nlemma uuIsInvar_geq_noPH_confIDs: \"uuIsInvar geq_noPH_confIDs\"\napply (cases geq_noPH_confIDs rule: uuIsInvar)\nby (auto simp: uu_defs geq_noPH_confIDs_def)\n\nlemma invar_geq_noPH_confIDs: \"invar geq_noPH_confIDs\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_geq_noPH_confIDs uIsInvar_geq_noPH_confIDs uuIsInvar_geq_noPH_confIDs by auto\n\nlemmas geq_noPH_confIDs1 =\nholdsIstate_invar[OF holdsIstate_geq_noPH_confIDs invar_geq_noPH_confIDs]\n\ntheorem geq_noPH_confIDs:\nassumes a: \"reach s\"\nshows \"phase s confID > noPH \\<longrightarrow> confID \\<in>\\<in> confIDs s\"\nusing geq_noPH_confIDs1[OF a] unfolding geq_noPH_confIDs_def by auto\n\n(* All the IDs involved in the \"roles\" relation are valid IDs of the system: *)\ndefinition roles_IDsOK :: \"state \\<Rightarrow> bool\" where\n\"roles_IDsOK s \\<equiv>\n \\<forall> confID uID rl.\n   rl \\<in>\\<in> roles s confID uID \\<longrightarrow> IDsOK s [confID] [uID] (papIDsOfRole rl)\"\n\nlemma holdsIstate_roles_IDsOK: \"holdsIstate roles_IDsOK\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def roles_IDsOK_def by auto\n\nlemma cIsInvar_roles_IDsOK: \"cIsInvar roles_IDsOK\"\napply (cases roles_IDsOK rule: cIsInvar)\nby (auto simp: c_defs roles_IDsOK_def)\n\nlemma uIsInvar_roles_IDsOK: \"uIsInvar roles_IDsOK\"\napply (cases roles_IDsOK rule: uIsInvar)\nby (auto simp: u_defs roles_IDsOK_def)\n\nlemma uuIsInvar_roles_IDsOK: \"uuIsInvar roles_IDsOK\"\napply (cases roles_IDsOK rule: uuIsInvar)\nby (auto simp: uu_defs roles_IDsOK_def)\n\nlemma invar_roles_IDsOK: \"invar roles_IDsOK\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_roles_IDsOK uIsInvar_roles_IDsOK uuIsInvar_roles_IDsOK by auto\n\nlemmas roles_IDsOK1 =\nholdsIstate_invar[OF holdsIstate_roles_IDsOK invar_roles_IDsOK]\n\ntheorem roles_IDsOK:\nassumes a: \"reach s\" and rl: \"rl \\<in>\\<in> roles s confID uID\"\nshows \"IDsOK s [confID] [uID] (papIDsOfRole rl)\"\nusing roles_IDsOK1[OF a] rl unfolding roles_IDsOK_def by auto\n\ncorollary roles_confIDs:\nassumes a: \"reach s\" and A: \"rl \\<in>\\<in> roles s confID uID\"\nshows \"confID \\<in>\\<in> confIDs s\"\nusing roles_IDsOK[OF a] A unfolding IDsOK_def by auto\n\ncorollary roles_userIDs:\nassumes a: \"reach s\" and A: \"rl \\<in>\\<in> roles s confID uID\"\nshows \"uID \\<in>\\<in> userIDs s\"\nusing roles_IDsOK[OF a] A unfolding IDsOK_def by auto\n\ncorollary isAut_paperIDs:\nassumes a: \"reach s\" and A: \"isAut s confID uID papID\"\nshows \"papID \\<in>\\<in> paperIDs s confID\"\nusing roles_IDsOK[OF a] A unfolding IDsOK_def by auto\n\ncorollary isRevNth_paperIDs:\nassumes a: \"reach s\" and A: \"isRevNth s confID uID papID n\"\nshows \"papID \\<in>\\<in> paperIDs s confID\"\nusing roles_IDsOK[OF a] A unfolding IDsOK_def by auto\n\ncorollary isRev_paperIDs:\nassumes a: \"reach s\" and A: \"isRev s confID uID papID\"\nshows \"papID \\<in>\\<in> paperIDs s confID\"\nusing isRevNth_paperIDs[OF a] A unfolding isRev_def2 by auto\n\ncorollary isRev_userIDs:\nassumes a: \"reach s\" and A: \"isRev s confID uID papID\"\nshows \"uID \\<in>\\<in> userIDs s\"\nusing roles_userIDs[OF a] A unfolding isRev_def2 by auto\n\ncorollary isRev_confIDs:\nassumes a: \"reach s\" and A: \"isRev s confID uID papID\"\nshows \"confID \\<in>\\<in> confIDs s\"\nusing roles_confIDs[OF a] A unfolding isRev_def2 by auto\n\n(* The lists of (conference, user and paper) IDs are non-repetitive *)\ndefinition distinct_IDs :: \"state \\<Rightarrow> bool\" where\n\"distinct_IDs s \\<equiv>\n distinct (confIDs s) \\<and> distinct (userIDs s) \\<and> (\\<forall> confID. distinct (paperIDs s confID))\"\n\nlemma holdsIstate_distinct_IDs: \"holdsIstate distinct_IDs\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def distinct_IDs_def by auto\n\nlemma cIsInvar_distinct_IDs: \"cIsInvar distinct_IDs\"\napply (cases distinct_IDs rule: cIsInvar)\nby (auto simp: c_defs distinct_IDs_def getAllPaperIDs_def)\n\nlemma uIsInvar_distinct_IDs: \"uIsInvar distinct_IDs\"\napply (cases distinct_IDs rule: uIsInvar)\nby (auto simp: u_defs distinct_IDs_def)\n\nlemma uuIsInvar_distinct_IDs: \"uuIsInvar distinct_IDs\"\napply (cases distinct_IDs rule: uuIsInvar)\nby (auto simp: uu_defs distinct_IDs_def)\n\nlemma invar_distinct_IDs: \"invar distinct_IDs\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_distinct_IDs uIsInvar_distinct_IDs uuIsInvar_distinct_IDs by auto\n\nlemmas distinct_IDs1 = holdsIstate_invar[OF holdsIstate_distinct_IDs invar_distinct_IDs]\n\ntheorem distinct_IDs:\nassumes a: \"reach s\"\nshows \"distinct (confIDs s) \\<and> distinct (userIDs s) \\<and> (\\<forall> confID. distinct (paperIDs s confID))\"\nusing distinct_IDs1[OF a] unfolding distinct_IDs_def by auto\n\nlemmas distinct_confIDs = distinct_IDs[THEN conjunct1]\nlemmas distinct_userIDs = distinct_IDs[THEN conjunct2, THEN conjunct1]\nlemmas distinct_paperIDs = distinct_IDs[THEN conjunct2, THEN conjunct2, rule_format]\n\n(* The list of roles of a user at a conference is non-repetitive *)\ndefinition distinct_roles :: \"state \\<Rightarrow> bool\" where\n\"distinct_roles s \\<equiv>\n \\<forall> confID uID. distinct (roles s confID uID)\"\n\nlemma holdsIstate_distinct_roles: \"holdsIstate distinct_roles\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def distinct_roles_def by auto\n\nlemma cIsInvar_distinct_roles: \"cIsInvar distinct_roles\"\napply (cases distinct_roles rule: cIsInvar)\nby (auto simp: c_defs distinct_roles_def)\n\nlemma uIsInvar_distinct_roles: \"uIsInvar distinct_roles\"\napply (cases distinct_roles rule: uIsInvar)\nby (auto simp: u_defs distinct_roles_def)\n\nlemma uuIsInvar_distinct_roles: \"uuIsInvar distinct_roles\"\napply (cases distinct_roles rule: uuIsInvar)\nby (auto simp: uu_defs distinct_roles_def)\n\nlemma invar_distinct_roles: \"invar distinct_roles\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_distinct_roles uIsInvar_distinct_roles uuIsInvar_distinct_roles by auto\n\nlemmas distinct_roles1 = holdsIstate_invar[OF holdsIstate_distinct_roles invar_distinct_roles]\n\ntheorem distinct_roles:\nassumes a: \"reach s\"\nshows \"distinct (roles s confID uID)\"\nusing distinct_roles1[OF a] unfolding distinct_roles_def by auto\n\n(* Only committee members become reviewers: *)\ndefinition isRevNth_isPC :: \"state \\<Rightarrow> bool\" where\n\"isRevNth_isPC s \\<equiv>\n \\<forall> confID uID papID n. isRevNth s confID uID papID n \\<longrightarrow> isPC s confID uID\"\n\nlemma holdsIstate_isRevNth_isPC: \"holdsIstate isRevNth_isPC\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def isRevNth_isPC_def by auto\n\nlemma cIsInvar_isRevNth_isPC: \"cIsInvar isRevNth_isPC\"\napply (cases isRevNth_isPC rule: cIsInvar)\nby (auto simp: c_defs isRevNth_isPC_def)\n\nlemma uIsInvar_isRevNth_isPC: \"uIsInvar isRevNth_isPC\"\napply (cases isRevNth_isPC rule: uIsInvar)\nby (auto simp: u_defs isRevNth_isPC_def)\n\nlemma uuIsInvar_isRevNth_isPC: \"uuIsInvar isRevNth_isPC\"\napply (cases isRevNth_isPC rule: uuIsInvar)\nby (auto simp: uu_defs isRevNth_isPC_def)\n\nlemma invar_isRevNth_isPC: \"invar isRevNth_isPC\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_isRevNth_isPC uIsInvar_isRevNth_isPC uuIsInvar_isRevNth_isPC by auto\n\nlemmas isRevNth_isPC1 = holdsIstate_invar[OF holdsIstate_isRevNth_isPC invar_isRevNth_isPC]\n\ntheorem isRevNth_isPC:\nassumes a: \"reach s\" and R: \"isRevNth s confID uID papID n\"\nshows \"isPC s confID uID\"\nusing isRevNth_isPC1[OF a] R unfolding isRevNth_isPC_def by auto\n\ncorollary isRev_isPC:\nassumes a: \"reach s\" and R: \"isRev s confID uID papID\"\nshows \"isPC s confID uID\"\nusing isRevNth_isPC[OF a] R unfolding isRev_def2 by auto\n\n(* Every conference that has papers is registered: *)\ndefinition paperIDs_confIDs :: \"state \\<Rightarrow> bool\" where\n\"paperIDs_confIDs s \\<equiv>\n \\<forall> confID papID.\n    papID \\<in>\\<in> paperIDs s confID \\<longrightarrow> confID \\<in>\\<in> confIDs s\"\n\nlemma holdsIstate_paperIDs_confIDs: \"holdsIstate paperIDs_confIDs\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def paperIDs_confIDs_def by auto\n\nlemma cIsInvar_paperIDs_confIDs: \"cIsInvar paperIDs_confIDs\"\napply (cases paperIDs_confIDs rule: cIsInvar)\nby (auto simp: c_defs paperIDs_confIDs_def )\n\nlemma uIsInvar_paperIDs_confIDs: \"uIsInvar paperIDs_confIDs\"\napply (cases paperIDs_confIDs rule: uIsInvar)\nby (auto simp: u_defs paperIDs_confIDs_def)\n\nlemma uuIsInvar_paperIDs_confIDs: \"uuIsInvar paperIDs_confIDs\"\napply (cases paperIDs_confIDs rule: uuIsInvar)\nby (auto simp: uu_defs paperIDs_confIDs_def)\n\nlemma invar_paperIDs_confIDs: \"invar paperIDs_confIDs\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_paperIDs_confIDs uIsInvar_paperIDs_confIDs uuIsInvar_paperIDs_confIDs by auto\n\nlemmas paperIDs_confIDs1 = holdsIstate_invar[OF holdsIstate_paperIDs_confIDs invar_paperIDs_confIDs]\n\ntheorem paperIDs_confIDs:\nassumes a: \"reach s\" and p: \"papID \\<in>\\<in> paperIDs s confID\"\nshows \"confID \\<in>\\<in> confIDs s\"\nusing paperIDs_confIDs1[OF a] p  unfolding paperIDs_confIDs_def by auto\n\ncorollary paperIDs_getAllPaperIDs:\nassumes a: \"reach s\" and p: \"papID \\<in>\\<in> paperIDs s confID\"\nshows \"papID \\<in>\\<in> getAllPaperIDs s\"\nusing paperIDs_confIDs[OF assms] p unfolding getAllPaperIDs_def by auto\n\ncorollary isRevNth_getAllPaperIDs:\nassumes a: \"reach s\" and \"isRevNth s confID uID papID n\"\nshows \"papID \\<in>\\<in> getAllPaperIDs s\"\nusing paperIDs_getAllPaperIDs[OF a isRevNth_paperIDs[OF assms]] .\n\n(* No paper is registered at two conferences: *)\ndefinition paperIDs_equals :: \"state \\<Rightarrow> bool\" where\n\"paperIDs_equals s \\<equiv>\n \\<forall> confID1 confID2 papID.\n    papID \\<in>\\<in> paperIDs s confID1 \\<and> papID \\<in>\\<in> paperIDs s confID2\n    \\<longrightarrow> confID1 = confID2\"\n\nlemma holdsIstate_paperIDs_equals: \"holdsIstate paperIDs_equals\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def paperIDs_equals_def by auto\n\nlemma cIsInvar_paperIDs_equals: \"cIsInvar paperIDs_equals\"\napply (cases paperIDs_equals rule: cIsInvar)\nby (auto simp: c_defs paperIDs_equals_def paperIDs_getAllPaperIDs)\n\nlemma uIsInvar_paperIDs_equals: \"uIsInvar paperIDs_equals\"\napply (cases paperIDs_equals rule: uIsInvar)\nby (auto simp: u_defs paperIDs_equals_def)\n\nlemma uuIsInvar_paperIDs_equals: \"uuIsInvar paperIDs_equals\"\napply (cases paperIDs_equals rule: uuIsInvar)\nby (auto simp: uu_defs paperIDs_equals_def)\n\nlemma invar_paperIDs_equals: \"invar paperIDs_equals\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_paperIDs_equals uIsInvar_paperIDs_equals uuIsInvar_paperIDs_equals by auto\n\nlemmas paperIDs_equals1 = holdsIstate_invar[OF holdsIstate_paperIDs_equals invar_paperIDs_equals]\n\ntheorem paperIDs_equals:\nassumes a: \"reach s\" and p: \"papID \\<in>\\<in> paperIDs s confID1\" \"papID \\<in>\\<in> paperIDs s confID2\"\nshows \"confID1 = confID2\"\nusing paperIDs_equals1[OF a] p unfolding paperIDs_equals_def by auto\n\n(* Everybody has conflict with their own papers *)\ndefinition isAut_pref_Conflict :: \"state \\<Rightarrow> bool\" where\n\"isAut_pref_Conflict s \\<equiv>\n \\<forall> confID uID papID. isAut s confID uID papID \\<longrightarrow> pref s uID papID = Conflict\"\n\nlemma holdsIstate_isAut_pref_Conflict: \"holdsIstate isAut_pref_Conflict\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def isAut_pref_Conflict_def by auto\n\nlemma cIsInvar_isAut_pref_Conflict: \"cIsInvar isAut_pref_Conflict\"\napply (cases isAut_pref_Conflict rule: cIsInvar)\nby (auto simp: c_defs isAut_pref_Conflict_def)\n\nlemma uIsInvar_isAut_pref_Conflict: \"uIsInvar isAut_pref_Conflict\"\nproof(cases isAut_pref_Conflict rule: uIsInvar)\n  case (uPref s confID uID p paperID preference)\n  thus ?case apply (auto simp: u_defs isAut_pref_Conflict_def)\n  apply(frule isAut_paperIDs, simp)\n  apply(frule paperIDs_equals, simp, simp, fastforce)\n  done\nqed (auto simp: u_defs isAut_pref_Conflict_def)\n\nlemma uuIsInvar_isAut_pref_Conflict: \"uuIsInvar isAut_pref_Conflict\"\napply (cases isAut_pref_Conflict rule: uuIsInvar)\nby (auto simp: uu_defs isAut_pref_Conflict_def)\n\nlemma invar_isAut_pref_Conflict: \"invar isAut_pref_Conflict\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_isAut_pref_Conflict uIsInvar_isAut_pref_Conflict\nuuIsInvar_isAut_pref_Conflict by auto\n\nlemmas isAut_pref_Conflict1 =\nholdsIstate_invar[OF holdsIstate_isAut_pref_Conflict invar_isAut_pref_Conflict]\n\ntheorem isAut_pref_Conflict:\nassumes a: \"reach s\" and i: \"isAut s confID uID papID\"\nshows \"pref s uID papID = Conflict\"\nusing isAut_pref_Conflict1[OF a] i unfolding isAut_pref_Conflict_def by auto\n\n(* A conference in phase noPH has no assigned papers  *)\ndefinition phase_noPH_paperIDs :: \"state \\<Rightarrow> bool\" where\n\"phase_noPH_paperIDs s \\<equiv>\n \\<forall> confID. phase s confID = noPH \\<longrightarrow> paperIDs s confID = []\"\n\nlemma holdsIstate_phase_noPH_paperIDs: \"holdsIstate phase_noPH_paperIDs\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def phase_noPH_paperIDs_def by auto\n\nlemma cIsInvar_phase_noPH_paperIDs: \"cIsInvar phase_noPH_paperIDs\"\napply (cases phase_noPH_paperIDs rule: cIsInvar)\nby (auto simp: c_defs phase_noPH_paperIDs_def)\n\nlemma uIsInvar_phase_noPH_paperIDs: \"uIsInvar phase_noPH_paperIDs\"\napply(cases phase_noPH_paperIDs rule: uIsInvar)\nby (auto simp: u_defs phase_noPH_paperIDs_def)\n\nlemma uuIsInvar_phase_noPH_paperIDs: \"uuIsInvar phase_noPH_paperIDs\"\napply (cases phase_noPH_paperIDs rule: uuIsInvar)\nby (auto simp: uu_defs phase_noPH_paperIDs_def)\n\nlemma invar_phase_noPH_paperIDs: \"invar phase_noPH_paperIDs\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_phase_noPH_paperIDs uIsInvar_phase_noPH_paperIDs\nuuIsInvar_phase_noPH_paperIDs by auto\n\nlemmas phase_noPH_paperIDs1 =\nholdsIstate_invar[OF holdsIstate_phase_noPH_paperIDs invar_phase_noPH_paperIDs]\n\ntheorem phase_noPH_paperIDs:\nassumes a: \"reach s\" and p: \"phase s confID = noPH\"\nshows \"paperIDs s confID = []\"\nusing phase_noPH_paperIDs1[OF a] p unfolding phase_noPH_paperIDs_def by auto\n\n(* Papers only exist starting from the submission phase: *)\ndefinition paperIDs_geq_subPH :: \"state \\<Rightarrow> bool\" where\n\"paperIDs_geq_subPH s \\<equiv>\n \\<forall> confID papID. papID \\<in>\\<in> paperIDs s confID \\<longrightarrow> phase s confID \\<ge> subPH\"\n\nlemma holdsIstate_paperIDs_geq_subPH: \"holdsIstate paperIDs_geq_subPH\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def paperIDs_geq_subPH_def by auto\n\nlemma cIsInvar_paperIDs_geq_subPH: \"cIsInvar paperIDs_geq_subPH\"\napply (cases paperIDs_geq_subPH rule: cIsInvar)\nby (auto simp: c_defs paperIDs_geq_subPH_def)\n\nlemma uIsInvar_paperIDs_geq_subPH: \"uIsInvar paperIDs_geq_subPH\"\napply (cases paperIDs_geq_subPH rule: uIsInvar)\nby (fastforce simp: u_defs paperIDs_geq_subPH_def)+\n\nlemma uuIsInvar_paperIDs_geq_subPH: \"uuIsInvar paperIDs_geq_subPH\"\napply (cases paperIDs_geq_subPH rule: uuIsInvar)\nby (auto simp: uu_defs paperIDs_geq_subPH_def)\n\nlemma invar_paperIDs_geq_subPH: \"invar paperIDs_geq_subPH\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_paperIDs_geq_subPH uIsInvar_paperIDs_geq_subPH\nuuIsInvar_paperIDs_geq_subPH by auto\n\nlemmas paperIDs_geq_subPH1 =\nholdsIstate_invar[OF holdsIstate_paperIDs_geq_subPH invar_paperIDs_geq_subPH]\n\ntheorem paperIDs_geq_subPH:\nassumes a: \"reach s\" and i: \"papID \\<in>\\<in> paperIDs s confID\"\nshows \"phase s confID \\<ge> subPH\"\nusing paperIDs_geq_subPH1[OF a] i unfolding paperIDs_geq_subPH_def by auto\n\n(* Reviewers only exist starting from the reviewing phase: *)\ndefinition isRevNth_geq_revPH :: \"state \\<Rightarrow> bool\" where\n\"isRevNth_geq_revPH s \\<equiv>\n \\<forall> confID uID papID n. isRevNth s confID uID papID n \\<longrightarrow> phase s confID \\<ge> revPH\"\n\nlemma holdsIstate_isRevNth_geq_revPH: \"holdsIstate isRevNth_geq_revPH\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def isRevNth_geq_revPH_def by auto\n\nlemma cIsInvar_isRevNth_geq_revPH: \"cIsInvar isRevNth_geq_revPH\"\napply (cases isRevNth_geq_revPH rule: cIsInvar)\nby (auto simp: c_defs isRevNth_geq_revPH_def)\n\nlemma uIsInvar_isRevNth_geq_revPH: \"uIsInvar isRevNth_geq_revPH\"\nproof (cases isRevNth_geq_revPH rule: uIsInvar)\n  case (uConfA s confID uID p) thus ?case\n  by (fastforce simp: u_defs isRevNth_geq_revPH_def)\nqed(fastforce simp: u_defs isRevNth_geq_revPH_def)+\n\nlemma uuIsInvar_isRevNth_geq_revPH: \"uuIsInvar isRevNth_geq_revPH\"\napply (cases isRevNth_geq_revPH rule: uuIsInvar)\nby (auto simp: uu_defs isRevNth_geq_revPH_def)\n\nlemma invar_isRevNth_geq_revPH: \"invar isRevNth_geq_revPH\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_isRevNth_geq_revPH uIsInvar_isRevNth_geq_revPH\nuuIsInvar_isRevNth_geq_revPH by auto\n\nlemmas isRevNth_geq_revPH1 =\nholdsIstate_invar[OF holdsIstate_isRevNth_geq_revPH invar_isRevNth_geq_revPH]\n\ntheorem isRevNth_geq_revPH:\nassumes a: \"reach s\" and i: \"isRevNth s confID uID papID n\"\nshows \"phase s confID \\<ge> revPH\"\nusing isRevNth_geq_revPH1[OF a] i unfolding isRevNth_geq_revPH_def by auto\n\ncorollary isRev_geq_revPH:\nassumes a: \"reach s\" and i: \"isRev s confID uID papID\"\nshows \"phase s confID \\<ge> revPH\"\nusing isRevNth_geq_revPH[OF a] i unfolding isRev_def2 by auto\n\n(* Every paper has at least one author: *)\ndefinition paperID_ex_userID :: \"state \\<Rightarrow> bool\" where\n\"paperID_ex_userID s \\<equiv>\n \\<forall> confID papID. papID \\<in>\\<in> paperIDs s confID \\<longrightarrow> (\\<exists> uID. isAut s confID uID papID)\"\n\nlemma holdsIstate_paperID_ex_userID: \"holdsIstate paperID_ex_userID\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def paperID_ex_userID_def by auto\n\nlemma cIsInvar_paperID_ex_userID: \"cIsInvar paperID_ex_userID\"\napply (cases paperID_ex_userID rule: cIsInvar)\nby (fastforce simp: c_defs paperID_ex_userID_def paperIDs_confIDs)+\n\nlemma uIsInvar_paperID_ex_userID: \"uIsInvar paperID_ex_userID\"\napply (cases paperID_ex_userID rule: uIsInvar)\nby (fastforce simp: u_defs paperID_ex_userID_def)+\n\nlemma uuIsInvar_paperID_ex_userID: \"uuIsInvar paperID_ex_userID\"\napply (cases paperID_ex_userID rule: uuIsInvar)\nby (auto simp: uu_defs paperID_ex_userID_def)\n\nlemma invar_paperID_ex_userID: \"invar paperID_ex_userID\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_paperID_ex_userID uIsInvar_paperID_ex_userID\nuuIsInvar_paperID_ex_userID by auto\n\nlemmas paperID_ex_userID1 =\nholdsIstate_invar[OF holdsIstate_paperID_ex_userID invar_paperID_ex_userID]\n\ntheorem paperID_ex_userID:\nassumes a: \"reach s\" and i: \"papID \\<in>\\<in> paperIDs s confID\"\nshows \"\\<exists> uID. isAut s confID uID papID\"\nusing paperID_ex_userID1[OF a] i unfolding paperID_ex_userID_def by auto\n\n(* Nobody reviews a paper with which one has conflict: *)\ndefinition pref_Conflict_isRevNth :: \"state \\<Rightarrow> bool\" where\n\"pref_Conflict_isRevNth s \\<equiv>\n \\<forall> confID uID papID n. pref s uID papID = Conflict \\<longrightarrow> \\<not> isRevNth s confID uID papID n\"\n\nlemma holdsIstate_pref_Conflict_isRevNth: \"holdsIstate pref_Conflict_isRevNth\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def pref_Conflict_isRevNth_def by auto\n\nlemma cIsInvar_pref_Conflict_isRevNth: \"cIsInvar pref_Conflict_isRevNth\"\nproof (cases pref_Conflict_isRevNth rule: cIsInvar)\n  case (cAuthor s confID uID p papID uID') thus ?case\n  apply (auto simp: c_defs pref_Conflict_isRevNth_def)\n  apply(frule isRevNth_geq_revPH, simp, simp)\n  apply(frule isRevNth_paperIDs, simp)\n  apply(frule paperIDs_equals, simp, simp, force)\n  done\nnext\n  case (cConflict  s confID uID p papID uID') thus ?case\n  apply (auto simp: c_defs pref_Conflict_isRevNth_def)\n  apply(frule isRevNth_geq_revPH, simp)\n  apply(frule isRevNth_paperIDs, simp)\n  apply(frule paperIDs_equals, simp, simp, force)\n  done\nqed (auto simp: c_defs pref_Conflict_isRevNth_def isRevNth_getAllPaperIDs)\n\nlemma uIsInvar_pref_Conflict_isRevNth: \"uIsInvar pref_Conflict_isRevNth\"\nproof(cases pref_Conflict_isRevNth rule: uIsInvar)\n  case (uPref s confID uID p paperID pref) thus ?case\n  apply (auto simp: u_defs pref_Conflict_isRevNth_def)\n  apply(frule isRevNth_geq_revPH, simp)\n  apply(frule isRevNth_paperIDs, simp)\n  apply(frule paperIDs_equals, simp, simp, force)\n  done\nqed (auto simp: u_defs pref_Conflict_isRevNth_def)\n\nlemma uuIsInvar_pref_Conflict_isRevNth: \"uuIsInvar pref_Conflict_isRevNth\"\napply (cases pref_Conflict_isRevNth rule: uuIsInvar)\nby (auto simp: uu_defs pref_Conflict_isRevNth_def)\n\nlemma invar_pref_Conflict_isRevNth: \"invar pref_Conflict_isRevNth\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_pref_Conflict_isRevNth uIsInvar_pref_Conflict_isRevNth uuIsInvar_pref_Conflict_isRevNth by auto\n\nlemmas pref_Conflict_isRevNth1 =\nholdsIstate_invar[OF holdsIstate_pref_Conflict_isRevNth invar_pref_Conflict_isRevNth]\n\ntheorem pref_Conflict_isRevNth:\nassumes a: \"reach s\" and i: \"pref s uID papID = Conflict\"\nshows \"\\<not> isRevNth s confID uID papID n\"\nusing pref_Conflict_isRevNth1[OF a] i unfolding pref_Conflict_isRevNth_def by auto\n\ncorollary pref_Conflict_isRev:\nassumes a: \"reach s\" and i: \"pref s uID papID = Conflict\"\nshows \"\\<not> isRev s confID uID papID\"\nusing pref_Conflict_isRevNth[OF a] i unfolding isRev_def2 by auto\n\n(* Nobody reviews her own paper: *)\ncorollary pref_isAut_isRevNth:\nassumes a: \"reach s\" and i: \"isAut s confID uID papID\"\nshows \"\\<not> isRevNth s confID uID papID n\"\nusing pref_Conflict_isRevNth[OF a] isAut_pref_Conflict[OF a i] by auto\n\ncorollary pref_isAut_isRev:\nassumes a: \"reach s\" and i: \"isAut s confID uID papID\"\nshows \"\\<not> isRev s confID uID papID\"\nusing pref_isAut_isRevNth[OF a] i unfolding isRev_def2 by auto\n\n(* Every chair is also a committee member *)\ndefinition isChair_isPC :: \"state \\<Rightarrow> bool\" where\n\"isChair_isPC s \\<equiv>\n \\<forall> confID uID. isChair s confID uID \\<longrightarrow> isPC s confID uID\"\n\nlemma holdsIstate_isChair_isPC: \"holdsIstate isChair_isPC\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def isChair_isPC_def by auto\n\nlemma cIsInvar_isChair_isPC: \"cIsInvar isChair_isPC\"\napply (cases isChair_isPC rule: cIsInvar)\nby (auto simp: c_defs isChair_isPC_def)\n\nlemma uIsInvar_isChair_isPC: \"uIsInvar isChair_isPC\"\napply(cases isChair_isPC rule: uIsInvar)\nby (auto simp: u_defs isChair_isPC_def)\n\nlemma uuIsInvar_isChair_isPC: \"uuIsInvar isChair_isPC\"\napply (cases isChair_isPC rule: uuIsInvar)\nby (auto simp: uu_defs isChair_isPC_def)\n\nlemma invar_isChair_isPC: \"invar isChair_isPC\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_isChair_isPC uIsInvar_isChair_isPC\nuuIsInvar_isChair_isPC by auto\n\nlemmas isChair_isPC1 =\nholdsIstate_invar[OF holdsIstate_isChair_isPC invar_isChair_isPC]\n\ntheorem isChair_isPC:\nassumes a: \"reach s\" and p: \"isChair s confID uID\"\nshows \"isPC s confID uID\"\nusing isChair_isPC1[OF a] p unfolding isChair_isPC_def by auto\n\n(* A user does not get to write more than one review of any given paper: *)\ndefinition isRevNth_equals :: \"state \\<Rightarrow> bool\" where\n\"isRevNth_equals s \\<equiv>\n \\<forall> confID uID papID m n.\n    isRevNth s confID uID papID m \\<and> isRevNth s confID uID papID n\n    \\<longrightarrow> m = n\"\n\nlemma holdsIstate_isRevNth_equals: \"holdsIstate isRevNth_equals\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def isRevNth_equals_def by auto\n\nlemma cIsInvar_isRevNth_equals: \"cIsInvar isRevNth_equals\"\nproof (cases isRevNth_equals rule: cIsInvar)\n(* this case is merely singled out for documentation: *)\n  case (cReview s confID uID p papID uID')\n  thus ?case by(fastforce simp add: c_defs isRevNth_equals_def isRev_def2)\nqed (auto simp: c_defs isRevNth_equals_def)\n\nlemma uIsInvar_isRevNth_equals: \"uIsInvar isRevNth_equals\"\napply(cases isRevNth_equals rule: uIsInvar)\nby (auto simp: u_defs isRevNth_equals_def)\n\nlemma uuIsInvar_isRevNth_equals: \"uuIsInvar isRevNth_equals\"\napply (cases isRevNth_equals rule: uuIsInvar)\nby (auto simp: uu_defs isRevNth_equals_def)\n\nlemma invar_isRevNth_equals: \"invar isRevNth_equals\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_isRevNth_equals uIsInvar_isRevNth_equals\nuuIsInvar_isRevNth_equals by auto\n\nlemmas isRevNth_equals1 =\nholdsIstate_invar[OF holdsIstate_isRevNth_equals invar_isRevNth_equals]\n\ntheorem isRevNth_equals:\nassumes a: \"reach s\" and r: \"isRevNth s confID uID papID m\" \"isRevNth s confID uID papID n\"\nshows \"m = n\"\nusing isRevNth_equals1[OF a] r unfolding isRevNth_equals_def by blast\n\ncorollary isRevNth_getReviewIndex:\nassumes a: \"reach s\" and r: \"isRevNth s confID uID papID n\"\nshows \"n = getReviewIndex s confID uID papID\"\nusing isRevNth_equals[OF a r] r\nby (metis isRev_def2 isRev_def3)\n\n\n(* A reviewer is always assigned a valid review number: *)\ndefinition isRevNth_less_length :: \"state \\<Rightarrow> bool\" where\n\"isRevNth_less_length s \\<equiv>\n \\<forall> confID uID papID n.\n    isRevNth s confID uID papID n \\<longrightarrow> n < length (reviewsPaper (paper s papID))\"\n\nlemma holdsIstate_isRevNth_less_length: \"holdsIstate isRevNth_less_length\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def isRevNth_less_length_def by auto\n\nlemma cIsInvar_isRevNth_less_length: \"cIsInvar isRevNth_less_length\"\napply(cases isRevNth_less_length rule: cIsInvar)\nby(fastforce simp: c_defs isRevNth_less_length_def\nisRevNth_getAllPaperIDs isRev_def2 isRevNth_paperIDs paperIDs_equals less_SucI)+\n\nlemma uIsInvar_isRevNth_less_length: \"uIsInvar isRevNth_less_length\"\napply(cases isRevNth_less_length rule: uIsInvar)\nby(fastforce simp: u_defs isRevNth_less_length_def\nisRevNth_getAllPaperIDs isRev_def2 isRevNth_paperIDs paperIDs_equals less_SucI)+\n\nlemma uuIsInvar_isRevNth_less_length: \"uuIsInvar isRevNth_less_length\"\napply (cases isRevNth_less_length rule: uuIsInvar)\nby(fastforce simp: uu_defs isRevNth_less_length_def\nisRevNth_getAllPaperIDs isRev_def2 isRevNth_paperIDs paperIDs_equals less_SucI)+\n\nlemma invar_isRevNth_less_length: \"invar isRevNth_less_length\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_isRevNth_less_length uIsInvar_isRevNth_less_length\nuuIsInvar_isRevNth_less_length by auto\n\nlemmas isRevNth_less_length1 =\nholdsIstate_invar[OF holdsIstate_isRevNth_less_length invar_isRevNth_less_length]\n\ntheorem isRevNth_less_length:\nassumes \"reach s\" and \"isRevNth s cid uid pid n\"\nshows \"n < length (reviewsPaper (paper s pid))\"\nusing isRevNth_less_length1 assms unfolding isRevNth_less_length_def by blast\n\n\n(* No two reviewers get assigned the same review: *)\ndefinition isRevNth_equalsU :: \"state \\<Rightarrow> bool\" where\n\"isRevNth_equalsU s \\<equiv>\n \\<forall> confID uID uID1 papID n.\n    isRevNth s confID uID papID n \\<and> isRevNth s confID uID1 papID n\n    \\<longrightarrow> uID = uID1\"\n\nlemma holdsIstate_isRevNth_equalsU: \"holdsIstate isRevNth_equalsU\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def isRevNth_equalsU_def by auto\n\nlemma cIsInvar_isRevNth_equalsU: \"cIsInvar isRevNth_equalsU\"\napply (cases isRevNth_equalsU rule: cIsInvar)\napply(fastforce simp: c_defs isRevNth_equalsU_def)+\nproof-\n  fix s confID uID p papID uID'\n  assume s: \"reach s\"\n  and 0: \"isRevNth_equalsU s\" \"e_createReview s confID uID p papID uID'\"\n  let ?s' = \"createReview s confID uID p papID uID'\"\n  show \"isRevNth_equalsU ?s'\"\n  unfolding isRevNth_equalsU_def proof clarify\n    fix confIDa uIDa uID1 papIDa n\n    assume \"isRevNth ?s' confIDa uIDa papIDa n\" \"isRevNth ?s' confIDa uID1 papIDa n\"\n    thus \"uIDa = uID1\"\n    apply(cases \"confIDa = confID \\<and> papIDa = papID\")\n    apply(cases \"uIDa = uID\", cases \"uID1 = uID\")\n    using s 0 isRevNth_less_length[OF s, of papID n] unfolding isRevNth_less_length_def\n    by (fastforce simp: c_defs isRevNth_equalsU_def)+\n  qed\nqed\n\nlemma uIsInvar_isRevNth_equalsU: \"uIsInvar isRevNth_equalsU\"\napply(cases isRevNth_equalsU rule: uIsInvar)\nby (auto simp: u_defs isRevNth_equalsU_def)\n\nlemma uuIsInvar_isRevNth_equalsU: \"uuIsInvar isRevNth_equalsU\"\napply (cases isRevNth_equalsU rule: uuIsInvar)\nby (auto simp: uu_defs isRevNth_equalsU_def)\n\nlemma invar_isRevNth_equalsU: \"invar isRevNth_equalsU\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_isRevNth_equalsU uIsInvar_isRevNth_equalsU\nuuIsInvar_isRevNth_equalsU by auto\n\nlemmas isRevNth_equalsU1 =\nholdsIstate_invar[OF holdsIstate_isRevNth_equalsU invar_isRevNth_equalsU]\n\ntheorem isRevNth_equalsU:\nassumes a: \"reach s\" and r: \"isRevNth s confID uID papID n\" \"isRevNth s confID uID1 papID n\"\nshows \"uID = uID1\"\nusing isRevNth_equalsU1[OF a] r unfolding isRevNth_equalsU_def by blast\n\n(* The reviews form a compact interval (with no gaps): *)\ndefinition reviews_compact :: \"state \\<Rightarrow> bool\" where\n\"reviews_compact s \\<equiv>\n \\<forall> confID papID n.\n    papID \\<in>\\<in> paperIDs s confID \\<and> n < length (reviewsPaper (paper s papID)) \\<longrightarrow>\n   (\\<exists> uID. isRevNth s confID uID papID n)\"\n\nlemma holdsIstate_reviews_compact: \"holdsIstate reviews_compact\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def reviews_compact_def by auto\n\nlemma cIsInvar_reviews_compact: \"cIsInvar reviews_compact\"\napply(cases reviews_compact rule: cIsInvar)\napply(auto simp: c_defs reviews_compact_def\nisRevNth_getAllPaperIDs isRev_def2 isRevNth_paperIDs paperIDs_equals less_SucI)\nusing paperIDs_confIDs\n apply fastforce\napply metis\napply metis\napply metis\nusing less_Suc_eq apply auto[1]\napply metis\ndone\n\nlemma uIsInvar_reviews_compact: \"uIsInvar reviews_compact\"\napply(cases reviews_compact rule: uIsInvar)\nby(fastforce simp: u_defs reviews_compact_def\nisRevNth_getAllPaperIDs isRev_def2 isRevNth_paperIDs paperIDs_equals less_SucI)+\n\nlemma uuIsInvar_reviews_compact: \"uuIsInvar reviews_compact\"\napply (cases reviews_compact rule: uuIsInvar)\nby(fastforce simp: uu_defs reviews_compact_def\nisRevNth_getAllPaperIDs isRev_def2 isRevNth_paperIDs paperIDs_equals less_SucI)+\n\nlemma invar_reviews_compact: \"invar reviews_compact\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_reviews_compact uIsInvar_reviews_compact\nuuIsInvar_reviews_compact by auto\n\nlemmas reviews_compact1 =\nholdsIstate_invar[OF holdsIstate_reviews_compact invar_reviews_compact]\n\ntheorem reviews_compact:\nassumes \"reach s\" and \"n < length (reviewsPaper (paper s pid))\"\nand \"pid \\<in>\\<in> paperIDs s cid\"\nshows \"\\<exists> uid. isRevNth s cid uid pid n\"\nusing reviews_compact1 assms unfolding reviews_compact_def by blast\n\n\n(* The list of roles for each conference-user is nonrepetitive: *)\ndefinition roles_nonrep :: \"state \\<Rightarrow> bool\" where\n\"roles_nonrep s \\<equiv>\n \\<forall> confID uID.\n    distinct (roles s confID uID)\"\n\nlemma holdsIstate_roles_nonrep: \"holdsIstate roles_nonrep\"\nunfolding IO_Automaton.holdsIstate_def istate_def istate_def roles_nonrep_def by auto\n\nlemma cIsInvar_roles_nonrep: \"cIsInvar roles_nonrep\"\napply(cases roles_nonrep rule: cIsInvar)\nby (auto simp: c_defs roles_nonrep_def\nisRevNth_getAllPaperIDs isRev_def2 isRevNth_paperIDs paperIDs_equals less_SucI)\n\nlemma uIsInvar_roles_nonrep: \"uIsInvar roles_nonrep\"\napply(cases roles_nonrep rule: uIsInvar)\nby(fastforce simp: u_defs roles_nonrep_def\nisRevNth_getAllPaperIDs isRev_def2 isRevNth_paperIDs paperIDs_equals less_SucI)+\n\nlemma uuIsInvar_roles_nonrep: \"uuIsInvar roles_nonrep\"\napply (cases roles_nonrep rule: uuIsInvar)\nby(fastforce simp: uu_defs roles_nonrep_def\nisRevNth_getAllPaperIDs isRev_def2 isRevNth_paperIDs paperIDs_equals less_SucI)+\n\nlemma invar_roles_nonrep: \"invar roles_nonrep\"\nunfolding invar_cIsInvar_uIsInvar_uuIsInvar\nusing cIsInvar_roles_nonrep uIsInvar_roles_nonrep\nuuIsInvar_roles_nonrep by auto\n\nlemmas roles_nonrep1 =\nholdsIstate_invar[OF holdsIstate_roles_nonrep invar_roles_nonrep]\n\ntheorem roles_nonrep:\nassumes \"reach s\"\nshows \"distinct (roles s confID uID)\"\nusing roles_nonrep1 assms unfolding roles_nonrep_def by blast\n\n\nsubsection\\<open>Properties of the step function\\<close>\n\nlemma step_outErr_eq: \"step s a = (outErr, s') \\<Longrightarrow> s'= s\"\napply (cases a)\n  subgoal for x1 apply (cases x1, simp_all add: c_defs) .\n  subgoal for x2 apply (cases x2, simp_all add: u_defs) .\n  subgoal for x3 apply (cases x3, simp_all add: uu_defs) .\n  by auto\n\nlemma phase_increases:\nassumes \"step s a = (ou,s')\"\nshows \"phase s cid \\<le> phase s' cid\"\nusing assms\napply (cases a)\n  subgoal for x1 apply(cases x1) apply(auto simp: c_defs) .\n  subgoal for x2 apply(cases x2) apply(auto simp: u_defs) .\n  subgoal for x3 apply(cases x3) apply(auto simp: uu_defs) .\n  by auto\n\nlemma phase_increases2: \"phase s CID \\<le> phase (snd (step s a)) CID\"\nby (metis phase_increases snd_conv surj_pair)\n\nlemma confIDs_mono:\nassumes \"step s a = (ou,s')\" and \"cid \\<in>\\<in> confIDs s\"\nshows \"cid \\<in>\\<in> confIDs s'\"\nusing assms\napply (cases a)\n  subgoal for x1 apply(cases x1) apply(auto simp: c_defs) .\n  subgoal for x2 apply(cases x2) apply(auto simp: u_defs) .\n  subgoal for x3 apply(cases x3) apply(auto simp: uu_defs) .\n  by auto\n\nlemma userIDs_mono:\nassumes \"step s a = (ou,s')\" and \"uid \\<in>\\<in> userIDs s\"\nshows \"uid \\<in>\\<in> userIDs s'\"\nusing assms\napply (cases a)\n  subgoal for x1 apply(cases x1) apply(auto simp: c_defs) .\n  subgoal for x2 apply(cases x2) apply(auto simp: u_defs) .\n  subgoal for x3 apply(cases x3) apply(auto simp: uu_defs) .\n  by auto\n\nlemma paperIDs_mono:\nassumes \"step s a = (ou,s')\" and \"pid \\<in>\\<in> paperIDs s cid\"\nshows \"pid \\<in>\\<in> paperIDs s' cid\"\nusing assms\napply (cases a)\n  subgoal for x1 apply(cases x1) apply(auto simp: c_defs) .\n  subgoal for x2 apply(cases x2) apply(auto simp: u_defs) .\n  subgoal for x3 apply(cases x3) apply(auto simp: uu_defs) .\n  by auto\n\nlemma isPC_persistent:\nassumes \"isPC s cid uid\" and \"step s a = (ou, s')\"\nshows \"isPC s' cid uid\"\nusing assms apply (cases a)\n  subgoal for x1 apply(cases x1) apply(auto simp: c_defs) .\n  subgoal for x2 apply(cases x2) apply(auto simp: u_defs) .\n  subgoal for x3 apply(cases x3) apply(auto simp: uu_defs) .\n  by auto\n\nlemma isChair_persistent:\nassumes \"isChair s cid uid\" and \"step s a = (ou, s')\"\nshows \"isChair s' cid uid\"\nusing assms apply (cases a)\n  subgoal for x1 apply(cases x1) apply(auto simp: c_defs) .\n  subgoal for x2 apply(cases x2) apply(auto simp: u_defs) .\n  subgoal for x3 apply(cases x3) apply(auto simp: uu_defs) .\n  by auto\n\n\nsubsection \\<open>Action-safety properties\\<close>\n\nlemma pref_Conflict_disPH:\nassumes \"reach s\" and \"pid \\<in>\\<in> paperIDs s cid\" and \"pref s uid pid \\<noteq> Conflict\" and \"phase s cid = disPH\"\nand \"step s a = (ou, s')\"\nshows \"pref s' uid pid \\<noteq> Conflict\"\nproof-\n  have 1: \"cid \\<in>\\<in> confIDs s\" using assms by (metis geq_noPH_confIDs zero_less_Suc)\n  thus ?thesis using assms\n  apply(cases a)\n    subgoal for x1 apply(cases x1, auto simp: c_defs getAllPaperIDs_def)\n       apply (metis Suc_inject Zero_not_Suc paperIDs_equals)\n      apply (metis Suc_inject Zero_not_Suc paperIDs_equals) .\n    subgoal for x2 apply(cases x2, auto simp: u_defs)\n      apply (metis Suc_inject Zero_not_Suc paperIDs_equals) .\n    subgoal for x3 apply(cases x3, auto simp: uu_defs) .\n    by auto\nqed\n\nlemma isRevNth_persistent:\nassumes \"reach s\" and \"isRevNth s cid uid pid n\"\nand \"step s a = (ou, s')\"\nshows \"isRevNth s' cid uid pid n\"\nusing assms apply (cases a)\n  subgoal for x1 apply(cases x1) apply(auto simp: c_defs roles_confIDs) .\n  subgoal for x2 apply(cases x2) apply(auto simp: u_defs) .\n  subgoal for x3 apply(cases x3) apply(auto simp: uu_defs) .\n  by auto\n\nlemma nonempty_decsPaper_persist:\nassumes s: \"reach s\"\nand pid: \"pid \\<in>\\<in> paperIDs s cid\"\nand \"decsPaper (paper s pid) \\<noteq> []\" and \"step s a = (ou,s')\"\nshows \"decsPaper (paper s' pid) \\<noteq> []\"\nproof-\n  have \"cid \\<in>\\<in> confIDs s\" using s pid by (metis paperIDs_confIDs)\n  thus ?thesis using assms apply(cases a)\n    subgoal for x1 apply(cases x1, auto simp: c_defs getAllPaperIDs_def) .\n    subgoal for x2 apply(cases x2, auto simp: u_defs) .\n    subgoal for x3 apply(cases x3, auto simp: uu_defs) .\n    by auto\nqed\n\nlemma nonempty_reviews_persist:\nassumes s: \"reach s\"\nand r: \"isRevNth s cid uid pid n\"\nand \"(reviewsPaper (paper s pid))!n \\<noteq> []\" and \"step s a = (ou,s')\"\nshows \"(reviewsPaper (paper s' pid))!n \\<noteq> []\"\nproof-\n  have pid: \"pid \\<in>\\<in> paperIDs s cid\" using s r by (metis isRevNth_paperIDs)\n  have cid: \"cid \\<in>\\<in> confIDs s\" using s pid by (metis paperIDs_confIDs)\n  have n: \"n < length (reviewsPaper (paper s pid))\" using s r by (metis isRevNth_less_length)\n  show ?thesis using assms pid cid n apply(cases a)\n    subgoal for x1 apply(cases x1, auto simp: c_defs getAllPaperIDs_def) .\n    subgoal for x2 apply(cases x2, auto simp: u_defs)\n      apply (metis not_Cons_self2 nth_list_update_eq nth_list_update_neq) .\n    subgoal for x3 apply(cases x3, auto simp: uu_defs)\n      apply (metis list.distinct(1) nth_list_update_eq nth_list_update_neq) .\n    by auto\nqed\n\nlemma revPH_pref_persists:\nassumes \"reach s\"\n\"pid \\<in>\\<in> paperIDs s cid\" and \"phase s cid \\<ge> revPH\"\nand \"step s a = (ou,s')\"\nshows \"pref s' uid pid = pref s uid pid\"\nusing assms apply(cases a)\n  subgoal for x1 apply(cases x1) apply(auto simp: c_defs paperIDs_getAllPaperIDs)\n    using paperIDs_equals apply fastforce\n    using paperIDs_equals apply fastforce .\n  subgoal for x2 apply(cases x2) apply(auto simp: u_defs)\n    using paperIDs_equals apply fastforce .\n  subgoal for x3 apply(cases x3) apply(fastforce simp: uu_defs)+ .\n  by auto\n\n\nsubsection \\<open>Miscellaneous\\<close>\n\n(* Simps bringing the \"paper\" field all the way to the left---useful for situations\n   where the states are equal everywhere but on the paper field. *)\nlemma updates_commute_paper:\n \"\\<And> uu. s \\<lparr>confIDs := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, confIDs := uu\\<rparr>\"\n \"\\<And> uu. s \\<lparr>conf := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, conf := uu\\<rparr>\"\n\n \"\\<And> uu. s \\<lparr>userIDs := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, userIDs := uu\\<rparr>\"\n \"\\<And> uu. s \\<lparr>pass := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, pass := uu\\<rparr>\"\n \"\\<And> uu. s \\<lparr>user := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, user := uu\\<rparr>\"\n \"\\<And> uu. s \\<lparr>roles := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, roles := uu\\<rparr>\"\n\n \"\\<And> uu. s \\<lparr>paperIDs := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, paperIDs := uu\\<rparr>\"\n\n \"\\<And> uu. s \\<lparr>pref := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, pref := uu\\<rparr>\"\n \"\\<And> uu. s \\<lparr>voronkov := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, voronkov := uu\\<rparr>\"\n \"\\<And> uu. s \\<lparr>news := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, news := uu\\<rparr>\"\n \"\\<And> uu. s \\<lparr>phase := uu, paper := pp\\<rparr> = s \\<lparr>paper := pp, phase := uu\\<rparr>\"\nby (auto intro: state.equality)\n\n\n(* The implication between the implicit- and explicit conference ID selectors *)\n\nlemma isAUT_imp_isAut:\nassumes \"reach s\" and \"pid \\<in>\\<in> paperIDs s cid\" and \"isAUT s uid pid\"\nshows \"isAut s cid uid pid\"\nby (metis assms isAUT_def isAut_paperIDs paperIDs_equals)\n\nlemma isREVNth_imp_isRevNth:\nassumes \"reach s\" and \"pid \\<in>\\<in> paperIDs s cid\" and \"isREVNth s uid pid n\"\nshows \"isRevNth s cid uid pid n\"\nby (metis assms isREVNth_def isRevNth_paperIDs paperIDs_equals)\n\n\n(* BEGIN phase properties *)\n\nlemma phase_increases_validTrans:\nassumes \"validTrans (Trans s a ou s')\"\nshows \"phase s cid \\<le> phase s' cid\"\nusing assms apply(cases a)\n  subgoal for x1 apply(cases x1, auto simp: c_defs split: if_splits) .\n  subgoal for x2 apply(cases x2, auto simp: u_defs split: if_splits paper.splits) .\n  subgoal for x3 apply(cases x3, auto simp: uu_defs split: if_splits paper.splits) .\n  by auto\n\nlemma phase_increases_validTrans2:\nassumes \"validTrans tr\"\nshows \"phase (srcOf tr) cid \\<le> phase (tgtOf tr) cid\"\nusing assms phase_increases_validTrans by (cases tr) auto\n\nlemma phase_increases_trace:\nassumes vtr: \"valid tr\" and ij: \"i \\<le> j\" and j: \"j < length tr\"\nshows \"phase (srcOf (tr!i)) cid \\<le> phase (srcOf (tr!j)) cid\"\nproof(cases \"i < j\")\ncase False thus ?thesis using ij by auto\nnext\ncase True thus ?thesis\nusing j proof(induction j)\n  case (Suc jj)\n  show ?case\n  proof(cases \"jj = i\")\n    case True\n    obtain tr1 tr2 where tr: \"tr = tr1 @ (tr!i) # (tr!(Suc jj)) # tr2\"\n    unfolding True by (metis Cons_nth_drop_Suc Suc.prems(2) Suc_lessD True id_take_nth_drop)\n    hence \"validTrans (tr!i) \\<and> tgtOf (tr!i) = srcOf (tr!(Suc jj))\"\n    unfolding True by (metis Suc Suc_lessD True valid_validTrans_nth valid_validTrans_nth_srcOf_tgtOf vtr)\n    thus ?thesis using phase_increases_validTrans Suc by (cases \"tr!i\") auto\n  next\n    case False hence 1: \"i < jj \\<and> jj < length tr\" using Suc by auto\n    hence \"phase (srcOf (tr!i)) cid \\<le> phase (srcOf (tr!jj)) cid\" using Suc by auto\n    also have \"phase (srcOf (tr!jj)) cid \\<le> phase (tgtOf (tr!jj)) cid\"\n    using phase_increases_validTrans2 by (metis 1 valid_validTrans_nth vtr)\n    also have \"... = phase (srcOf (tr!(Suc jj))) cid\"\n    by (metis Suc valid_validTrans_nth_srcOf_tgtOf vtr)\n    finally show ?thesis .\n  qed\nqed auto\nqed\n\nlemma phase_increases_trace_srcOf_tgtOf:\nassumes vtr: \"valid tr\" and ij: \"i \\<le> j\" and j: \"j < length tr\"\nshows \"phase (srcOf (tr!i)) cid \\<le> phase (tgtOf (tr!j)) cid\"\n  using phase_increases_trace[OF assms]\n  using j le_trans phase_increases_validTrans2 valid_validTrans_nth vtr by blast\n\nlemma phase_increases_trace_srcOf_hd:\nassumes v: \"valid tr\" and l: \"length tr > 1\" and \"i < length tr\"\nshows \"phase (srcOf (hd tr)) cid \\<le> phase (srcOf (tr!i)) cid\"\nusing phase_increases_trace assms\nby (metis gr_implies_not0 hd_Cons_tl leI length_0_conv nth_Cons_0)\n\nlemma phase_increases_trace_srcOf_last:\nassumes v: \"valid tr\" and l: \"length tr > 1\" and i: \"i < length tr\"\nshows \"phase (srcOf (tr!i)) cid \\<le> phase (srcOf (last tr)) cid\"\nproof-\n  have 1: \"last tr = tr!(length tr - 1)\"\n  by (metis i last_conv_nth list.size(3) not_less0)\n  show ?thesis unfolding 1 using assms\n  by (metis Suc_diff_1 Suc_leI Suc_le_mono gr_implies_not0 length_0_conv\n          length_greater_0_conv lessI phase_increases_trace)\nqed\n\nlemma phase_increases_trace_srcOf_tgtOf_last:\nassumes v: \"valid tr\" and l: \"length tr > 1\" and i: \"i < length tr\"\nshows \"phase (srcOf (tr!i)) cid \\<le> phase (tgtOf (last tr)) cid\"\nproof-\n  have 1: \"last tr = tr!(length tr - 1)\"\n  by (metis i last_conv_nth list.size(3) not_less0)\n  have \"phase (srcOf (tr!i)) cid \\<le> phase (srcOf (last tr)) cid\" using\n  phase_increases_trace_srcOf_last[OF assms] .\n  also have \"... \\<le> phase (tgtOf (last tr)) cid\" unfolding 1\n  by (metis Suc_le_D diff_Suc_1 l lessI less_eq_Suc_le phase_increases_validTrans2 v valid_validTrans_nth)\n  finally show ?thesis by (simp add: le_funD)\nqed\n\nlemma valid_tgtPf_last_srcOf:\nassumes \"valid tr\" and \"s \\<in>\\<in> map tgtOf tr\"\nshows \"s = tgtOf (last tr) \\<or> s \\<in>\\<in> map srcOf tr\"\nusing assms by induction auto\n\nlemma phase_constant:\nassumes v: \"valid tr\" and l: \"length tr > 0\" and\nph: \"phase (srcOf (hd tr)) cid = phase (tgtOf (last tr)) cid\"\nshows \"set (map (\\<lambda> trn. phase (srcOf trn) cid) tr) \\<subseteq> {phase (srcOf (hd tr)) cid} \\<and>\n       set (map (\\<lambda> trn. phase (tgtOf trn) cid) tr) \\<subseteq> {phase (srcOf (hd tr)) cid}\"\nproof(cases \"length tr > 1\")\n  case False\n  then obtain trn where tr: \"tr = [trn]\" using l by (cases tr) auto\n  show ?thesis using assms unfolding tr by auto\nnext\n  case True note l = True\n  show ?thesis proof safe\n    {fix ph assume \"ph \\<in>\\<in> map (\\<lambda> trn. phase (srcOf trn) cid) tr\"\n     then obtain i where i: \"i < length tr\" and phe: \"ph = phase (srcOf(tr!i)) cid\"\n     by (smt comp_apply in_set_conv_nth length_map nth_map)\n     have \"phase (srcOf (hd tr)) cid \\<le> ph\"\n     unfolding phe using v l i phase_increases_trace_srcOf_hd by blast\n     moreover have \"ph \\<le> phase (tgtOf (last tr)) cid\"\n     unfolding phe using v l i phase_increases_trace_srcOf_tgtOf_last by auto\n     ultimately show \"ph = phase (srcOf (hd tr)) cid\" using ph by simp\n    } note 0 = this\n    fix ph assume \"ph \\<in>\\<in> map (\\<lambda> trn. phase (tgtOf trn) cid) tr\"\n    then obtain s where \"s \\<in>\\<in> map tgtOf tr\" and phs: \"ph = phase s cid\" by auto\n    hence \"s = tgtOf (last tr) \\<or> s \\<in>\\<in> map srcOf tr\" using valid_tgtPf_last_srcOf[OF v] by auto\n    thus \"ph = phase (srcOf (hd tr)) cid\" using 0[of ph] ph unfolding phs by auto\n  qed\nqed\n\nlemma phase_cases:\nassumes \"step s a = (ou, s')\"\nobtains (noPH) \"\\<not> cid \\<in>\\<in> confIDs s \\<or> phase s cid = noPH\"\n(* the conf. does not exist yet or the voronkov has not yet approved it *)\n      | (Id) \"phase s' cid = phase s cid\"\n      | (Upd) uid p ph where \"phase s' cid = ph\" \"a = Uact (uPhase cid uid p ph)\" \"e_updatePhase s cid uid p ph\"\nusing assms proof (cases a)\n  case (Cact ca)\n  then show thesis using assms\n    by (cases ca) (auto simp: c_defs split: if_splits intro: that)\nnext\n  case (Uact ua)\n  then show thesis using assms\n    apply (cases ua)\n    subgoal by (auto simp: u_defs split: if_splits paper.splits intro: that)\n    subgoal for x21 apply(cases \"x21 = cid\")\n      by (auto simp: u_defs split: if_splits paper.splits intro: that)\n    subgoal for x31 apply(cases \"cid = x31\")\n      by (auto simp: u_defs split: if_splits paper.splits intro: that)\n    by (auto simp: u_defs split: if_splits paper.splits intro: that)\nnext\n  case (UUact uua)\n  then show thesis using assms by (cases uua) (auto simp: uu_defs split: if_splits paper.splits intro: that)\nqed auto\n\nlemma phase_mono: \"reachFrom s s' \\<Longrightarrow> phase s cid \\<le> phase s' cid\"\nproof (induction rule: reachFrom_step_induct)\n  case (Step s' a ou s'')\n    then show ?case\n    proof (cases a)\n      case (Cact cAct) with Step show ?thesis by (cases cAct) (auto simp add: c_defs split: if_splits) next\n      case (Uact uAct) with Step show ?thesis by (cases uAct) (auto simp add: u_defs split: if_splits paper.split) next\n      case (UUact uAct) with Step show ?thesis by (cases uAct) (auto simp add: uu_defs split: if_splits paper.split)\n    qed (auto)\nqed (auto)\n\nlemma validTrans_rAct_lAct_srcOf_tgtOf:\nassumes \"validTrans trn\"\nand \"actOf trn = Ract rAct \\<or> actOf trn = Lact lAct\"\nshows \"tgtOf trn = srcOf trn\"\nusing assms by (cases trn) auto\n\nlemma valid_rAct_lAct_srcOf_tgtOf:\nassumes \"valid tr\"\nand \"\\<And> a. a \\<in>\\<in> map actOf tr \\<Longrightarrow> (\\<exists> rAct. a = Ract rAct) \\<or> (\\<exists> lAct. a = Lact lAct)\"\nshows \"srcOf ` (set tr) \\<subseteq> {srcOf (hd tr)}\"\nusing assms by (induction) (simp_all, metis validTrans_rAct_lAct_srcOf_tgtOf)\n\nlemma validFrom_rAct_lAct_srcOf_tgtOf:\nassumes \"validFrom s tr\"\nand \"\\<And> a. a \\<in>\\<in> map actOf tr \\<Longrightarrow> (\\<exists> rAct. a = Ract rAct) \\<or> (\\<exists> lAct. a = Lact lAct)\"\nshows \"srcOf ` (set tr) \\<subseteq> {s}\"\nusing assms valid_rAct_lAct_srcOf_tgtOf unfolding validFrom_def by auto\n\nlemma tgtOf_last_traceOf_Ract_Lact[simp]:\nassumes \"al \\<noteq> []\" \"set al \\<subseteq> range Ract \\<union> range Lact\"\nshows \"tgtOf (last (traceOf s al)) = s\"\nusing assms by (induction al arbitrary: s) auto\n\n(* END phase properties *)\n\nlemma paperIDs_cases:\nassumes \"step s a = (ou, s')\"\nobtains (Id) \"paperIDs s' cid = paperIDs s cid\"\n      | (Create) cid uid p pid tit ab  where\n           \"paperIDs s' cid = pid # paperIDs s cid\" \"a = Cact (cPaper cid uid p pid tit ab)\"\n           \"e_createPaper s cid uid p pid tit ab\"\nusing assms proof (cases a)\n  case (Cact ca)\n  then show thesis using assms\n    by (cases ca) (auto simp: c_defs split: if_splits intro: that)\nnext\n  case (Uact ua)\n  then show thesis using assms\n    by (cases ua) (auto simp: u_defs split: if_splits paper.splits intro: that)\nnext\n  case (UUact ua)\n  then show thesis using assms\n    by (cases ua) (auto simp: uu_defs split: if_splits paper.splits intro: that)\nqed auto\n\nlemma paperIDs_decPH_const:\nassumes s: \"step s a = (ou, s')\" and \"phase s cid > subPH\"\nshows \"paperIDs s' cid = paperIDs s cid\"\n  using assms\n  apply (elim paperIDs_cases[where cid = cid])\n  subgoal .\n  subgoal for cida\n    apply(cases \"cida = cid\", auto)\n    using s by (auto simp: c_defs) .\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoCon/Safety_Properties.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7025300698514778, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.3129978953722474}}
{"text": "theory Example_Forte14\nimports \"../TopoS_Impl\"\nbegin\n\n\nabbreviation \"V\\<equiv>TopoS_Vertices.V\"\n\n\ndefinition policy :: \"vString list_graph\" where\n    \"policy \\<equiv> \\<lparr> nodesL = [V ''CC'', V ''C1'', V ''C2'', V ''IFEsrv'', V ''IFE1'', V ''IFE2'', V ''SAT'', V ''Wifi'', V ''P1'', V ''P2'' ],\n                edgesL = [(V ''CC'', V ''C1''), (V ''CC'', V ''C2''), (V ''CC'', V ''IFEsrv''), (V ''C1'', V ''CC''), \n                          (V ''C1'', V ''C2''), (V ''C2'', V ''CC''), (V ''C2'', V ''C1''), \n                          (V ''IFEsrv'', V ''IFE1''), (V ''IFEsrv'', V ''IFE2''), (V ''IFEsrv'', V ''SAT''), (V ''IFEsrv'', V ''Wifi''),\n                          (V ''IFE1'', V ''IFEsrv''), (V ''IFE2'', V ''IFEsrv''), \n                          (V ''Wifi'', V ''IFEsrv''), (V ''Wifi'', V ''SAT''), (V ''Wifi'', V ''P1''),\n                          (V ''Wifi'', V ''P2''), (V ''P1'', V ''Wifi''), (V ''P1'', V ''P2''), (V ''P2'', V ''Wifi''), (V ''P2'', V ''P1'')\n                          ] \\<rparr>\"\n\nlemma \"valid_list_graph policy\" by eval\n\n(*21 rules*)\nlemma \"length (edgesL policy) = 21\" by eval\n\n\ndefinition DomainHierarchy_m::\"(vString SecurityInvariant)\" where\n      \"DomainHierarchy_m \\<equiv> new_configured_list_SecurityInvariant SINVAR_DomainHierarchyNG_impl.SINVAR_LIB_DomainHierarchyNG \\<lparr> \n          node_properties = [\n            V ''CC'' \\<mapsto> DN (''aircraft''--''crew''--Leaf, 1),\n            V ''C1'' \\<mapsto> DN (''aircraft''--''crew''--Leaf, 0),\n            V ''C2'' \\<mapsto> DN (''aircraft''--''crew''--Leaf, 0),\n            V ''IFEsrv'' \\<mapsto> DN (''aircraft''--''entertain''--Leaf, 0),\n            V ''IFE1'' \\<mapsto> DN (''aircraft''--''entertain''--Leaf, 0),\n            V ''IFE2'' \\<mapsto> DN (''aircraft''--''entertain''--Leaf, 0),\n            V ''SAT'' \\<mapsto> DN (''aircraft''--''entertain''--''INET''--Leaf, 0),\n            V ''Wifi'' \\<mapsto> DN (''aircraft''--''entertain''--''POD''--Leaf, 1),\n            V ''P1'' \\<mapsto> DN (''aircraft''--''entertain''--''POD''--Leaf, 0),\n            V ''P2'' \\<mapsto> DN (''aircraft''--''entertain''--''POD''--Leaf, 0)\n                            ], \n                          (*At the moment, there is no check whether the assigned node_properties comply with the tree in model_global_properties*)\n          model_global_properties = (\n            Department ''aircraft'' [\n              Department ''entertain'' [\n                Department ''POD'' [], Department ''INET'' []\n              ],\n              Department ''crew'' []\n            ]) \n          \\<rparr>\"\n\n\ndefinition SecurityGateway_m::\"(vString SecurityInvariant)\" where\n  \"SecurityGateway_m \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_SecurityGatewayExtended \\<lparr> \n          node_properties = [V ''IFEsrv'' \\<mapsto> SINVAR_SecGwExt.SecurityGatewayIN,\n                             V ''IFE1'' \\<mapsto> SINVAR_SecGwExt.DomainMember,\n                             V ''IFE2'' \\<mapsto> SINVAR_SecGwExt.DomainMember], \n          model_global_properties = () \n          \\<rparr>\"\n\n\n(*\n0 - unclassified\n1 - confidential\n2 - secret\n3 - topsecret\n*)\ndefinition BLP_m::\"(vString SecurityInvariant)\" where\n    \"BLP_m \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_BLPtrusted \\<lparr> \n          node_properties = [V ''CC'' \\<mapsto> \\<lparr> privacy_level = 2, trusted = False \\<rparr>,\n                             V ''C1'' \\<mapsto> \\<lparr> privacy_level = 2, trusted = False \\<rparr>,\n                             V ''C2'' \\<mapsto> \\<lparr> privacy_level = 2, trusted = False \\<rparr>,\n                             V ''IFE1'' \\<mapsto> \\<lparr> privacy_level = 1, trusted = False \\<rparr>,\n                             V ''IFE2'' \\<mapsto> \\<lparr> privacy_level = 1, trusted = False \\<rparr>,\n                             V ''IFEsrv'' \\<mapsto> \\<lparr> privacy_level = 0, trusted = True \\<rparr>], \n          model_global_properties = () \n          \\<rparr>\"\n\ndefinition \"security_invariants = [ DomainHierarchy_m, SecurityGateway_m, BLP_m]\"\n\nlemma \"all_security_requirements_fulfilled security_invariants policy\" by eval\n\nlemma \"implc_get_offending_flows security_invariants policy = []\" by eval\n\n\ntext{*\nVisualization with a violation\n*}\nML{*\nvizualize_graph @{context} @{term \"security_invariants\"} @{term \"policy\\<lparr>edgesL := (V ''P1'', V ''CC'')#edgesL policy\\<rparr>\"};\n*}\n\n\n\n\n\n\ndefinition \"max_policy = generate_valid_topology security_invariants \\<lparr>nodesL = nodesL policy, edgesL = List.product (nodesL policy) (nodesL policy) \\<rparr>\"\n\n\ntext{*calculating the maximum policy*}\nvalue \"max_policy\"\n\n\ntext{*\nThe diff to the maximum policy\n*}\nML_val{*\nvisualize_edges @{context} @{term \"edgesL policy\"} \n    [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"[e \\<leftarrow> edgesL max_policy. e \\<notin> set (edgesL policy)]\"})]; \n*}\n\n\ntext{*\nVisualizing the maximum policy\n*}\nML{*\nvizualize_graph @{context} @{term \"security_invariants\"} @{term \"policy\"};\n*}\n\nlemma \"all_security_requirements_fulfilled security_invariants policy\" by eval\nlemma \"all_security_requirements_fulfilled security_invariants max_policy\" by eval\n\n\nsubsection{*A stateful implementation*}\ndefinition \"stateful_policy = generate_valid_stateful_policy_IFSACS policy security_invariants\"\nvalue \"stateful_policy\"\n\nML_val{*\nvisualize_edges @{context} @{term \"flows_fixL stateful_policy\"} \n    [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL stateful_policy\"})]; \n*}\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Network_Security_Policy_Verification/Examples/Example_Forte14.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.31296212431481907}}
{"text": "theory UnitPropagate\nimports AssertLiteral\nbegin\n(*********************************************************************************)\n(*    A P P L Y    U N I T    P R O P A G A T E                                  *)\n(*********************************************************************************)\n\nlemma applyUnitPropagateEffect:\nassumes\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and \n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n\n  \"\\<not> (getConflictFlag state)\"\n  \"getQ state \\<noteq> []\"\nshows\n  \"let uLiteral = hd (getQ state) in\n   let state' = applyUnitPropagate state in\n      \\<exists> uClause. formulaEntailsClause (getF state) uClause \\<and> \n                 isUnitClause uClause uLiteral (elements (getM state)) \\<and> \n                 (getM state') = (getM state) @ [(uLiteral, False)]\"\nproof-\n  let ?uLiteral = \"hd (getQ state)\"\n  obtain uClause\n    where \"uClause el (getF state)\" \"isUnitClause uClause ?uLiteral (elements (getM state))\"\n    using assms\n    unfolding InvariantQCharacterization_def\n    by force\n  thus ?thesis\n    using assms\n    using assertLiteralEffect[of \"state\" \"?uLiteral\" \"False\"]\n    unfolding applyUnitPropagate_def\n    using formulaEntailsItsClauses[of \"uClause\" \"getF state\"]\n    by (auto simp add: Let_def )\nqed\n\nlemma InvariantConsistentAfterApplyUnitPropagate:\nassumes\n  \"InvariantConsistent (getM state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and \n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n  \"getQ state \\<noteq> []\"\n  \"\\<not> (getConflictFlag state)\"\nshows\n  \"let state' = applyUnitPropagate state in\n     InvariantConsistent (getM state')\n  \"\nproof-\n  let ?uLiteral = \"hd (getQ state)\"\n  let ?state' = \"applyUnitPropagate state\"\n  obtain uClause \n    where \"isUnitClause uClause ?uLiteral (elements (getM state))\" and\n    \"(getM ?state') = (getM state) @ [(?uLiteral, False)]\"\n    using assms\n    using applyUnitPropagateEffect[of \"state\"]\n    by (auto simp add: Let_def)\n  thus ?thesis\n    using assms\n    using InvariantConsistentAfterUnitPropagate[of \"getM state\" \"uClause\" \"?uLiteral\" \"getM ?state'\"]\n    by (auto simp add: Let_def)\nqed\n\nlemma InvariantUniqAfterApplyUnitPropagate:\nassumes\n  \"InvariantUniq (getM state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and \n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n  \"getQ state \\<noteq> []\"\n  \"\\<not> (getConflictFlag state)\"\nshows\n  \"let state' = applyUnitPropagate state in\n     InvariantUniq (getM state')\n  \"\nproof-\n  let ?uLiteral = \"hd (getQ state)\"\n  let ?state' = \"applyUnitPropagate state\"\n  obtain uClause \n    where \"isUnitClause uClause ?uLiteral (elements (getM state))\" and\n    \"(getM ?state') = (getM state) @ [(?uLiteral, False)]\"\n    using assms\n    using applyUnitPropagateEffect[of \"state\"]\n    by (auto simp add: Let_def)\n  thus ?thesis\n    using assms\n    using InvariantUniqAfterUnitPropagate[of \"getM state\" \"uClause\" \"?uLiteral\" \"getM ?state'\"]\n    by (auto simp add: Let_def)\nqed\n\nlemma InvariantWatchCharacterizationAfterApplyUnitPropagate:\nassumes\n  \"InvariantConsistent (getM state)\"\n  \"InvariantUniq (getM state)\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n  \"(getQ state) \\<noteq> []\"\n  \"\\<not> (getConflictFlag state)\"\nshows\n  \"let state' = applyUnitPropagate state in\n        InvariantWatchCharacterization (getF state') (getWatch1 state') (getWatch2 state') (getM state')\"\nproof-\n  let ?uLiteral = \"hd (getQ state)\"\n  let ?state' = \"assertLiteral ?uLiteral False state\"\n  let ?state'' = \"applyUnitPropagate state\"\n  have \"InvariantConsistent (getM ?state')\"\n    using assms\n    using InvariantConsistentAfterApplyUnitPropagate[of \"state\"]\n    unfolding applyUnitPropagate_def\n    by (auto simp add: Let_def)\n  moreover\n  have \"InvariantUniq (getM ?state')\"\n    using assms\n    using InvariantUniqAfterApplyUnitPropagate[of \"state\"]\n    unfolding applyUnitPropagate_def\n    by (auto simp add: Let_def)\n  ultimately\n  show ?thesis\n    using assms\n    using InvariantWatchCharacterizationAfterAssertLiteral[of \"state\" \"?uLiteral\" \"False\"]\n    using assertLiteralEffect\n    unfolding applyUnitPropagate_def\n    by (simp add: Let_def)\nqed\n\nlemma InvariantConflictFlagCharacterizationAfterApplyUnitPropagate:\nassumes\n  \"InvariantConsistent (getM state)\"\n  \"InvariantUniq (getM state)\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and \n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\" and \n  \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n  \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n  \"\\<not> getConflictFlag state\"\n  \"getQ state \\<noteq> []\"\nshows\n  \"let state' = (applyUnitPropagate state) in\n      InvariantConflictFlagCharacterization (getConflictFlag state') (getF state') (getM state')\"\nproof-\n  let ?uLiteral = \"hd (getQ state)\"\n  let ?state' = \"assertLiteral ?uLiteral False state\"\n  let ?state'' = \"applyUnitPropagate state\"\n  have \"InvariantConsistent (getM ?state')\"\n    using assms\n    using InvariantConsistentAfterApplyUnitPropagate[of \"state\"]\n    unfolding applyUnitPropagate_def\n    by (auto simp add: Let_def)\n  moreover\n  have \"InvariantUniq (getM ?state')\"\n    using assms\n    using InvariantUniqAfterApplyUnitPropagate[of \"state\"]\n    unfolding applyUnitPropagate_def\n    by (auto simp add: Let_def)\n  ultimately\n  show ?thesis\n    using assms\n    using InvariantConflictFlagCharacterizationAfterAssertLiteral[of \"state\" \"?uLiteral\" \"False\"]\n    using assertLiteralEffect\n    unfolding applyUnitPropagate_def\n    by (simp add: Let_def)\nqed\n\n\nlemma InvariantConflictClauseCharacterizationAfterApplyUnitPropagate:\nassumes\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and \n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\"\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\"\n  \"\\<not> getConflictFlag state\"\nshows\n   \"let state' = applyUnitPropagate state in\n    InvariantConflictClauseCharacterization (getConflictFlag state') (getConflictClause state') (getF state') (getM state')\"\nusing assms\nusing InvariantConflictClauseCharacterizationAfterAssertLiteral[of \"state\" \"hd (getQ state)\" \"False\"]\nunfolding applyUnitPropagate_def\nunfolding InvariantWatchesEl_def\nunfolding InvariantWatchListsContainOnlyClausesFromF_def\nunfolding InvariantWatchListsCharacterization_def\nunfolding InvariantWatchListsUniq_def\nunfolding InvariantConflictClauseCharacterization_def\nby (simp add: Let_def)\n  \nlemma InvariantQCharacterizationAfterApplyUnitPropagate:\nassumes\n  \"InvariantConsistent (getM state)\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n  \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n  \"InvariantUniqQ (getQ state)\"\n  \"(getQ state) \\<noteq> []\"\n  \"\\<not> (getConflictFlag state)\"\nshows\n  \"let state'' = applyUnitPropagate state in\n     InvariantQCharacterization (getConflictFlag state'') (getQ state'') (getF state'') (getM state'')\"\nproof-\n  let ?uLiteral = \"hd (getQ state)\"\n  let ?state' = \"assertLiteral ?uLiteral False state\"\n  let ?state'' = \"applyUnitPropagate state\"\n  have \"InvariantConsistent (getM ?state')\"\n    using assms\n    using InvariantConsistentAfterApplyUnitPropagate[of \"state\"]\n    unfolding applyUnitPropagate_def\n    by (auto simp add: Let_def)\n  hence \"InvariantQCharacterization (getConflictFlag ?state') (removeAll ?uLiteral (getQ ?state')) (getF ?state') (getM ?state')\"\n    using assms\n    using InvariantQCharacterizationAfterAssertLiteral[of \"state\" \"?uLiteral\" \"False\"]\n    using assertLiteralEffect[of \"state\" \"?uLiteral\" \"False\"]\n    by (simp add: Let_def)\n  moreover\n  have \"InvariantUniqQ (getQ ?state')\"\n    using assms\n    using InvariantUniqQAfterAssertLiteral[of \"state\" \"?uLiteral\" \"False\"]\n    by (simp add: Let_def)\n\n  have \"?uLiteral = (hd (getQ ?state'))\"\n  proof-\n    obtain s \n      where \"(getQ state) @ s = getQ ?state'\"\n      using assms\n      using assertLiteralEffect[of \"state\" \"?uLiteral\" \"False\"]\n      unfolding isPrefix_def\n      by auto\n    hence \"getQ ?state' = (getQ state) @ s\"\n      by (rule sym)\n    thus ?thesis\n      using \\<open>getQ state \\<noteq> []\\<close>\n      using hd_append[of \"getQ state\" \"s\"]\n      by auto\n  qed\n    \n  hence \"set (getQ ?state'') = set (removeAll ?uLiteral (getQ ?state'))\"\n    using assms\n    using \\<open>InvariantUniqQ (getQ ?state')\\<close>\n    unfolding InvariantUniqQ_def\n    using uniqHeadTailSet[of \"getQ ?state'\"]\n    unfolding applyUnitPropagate_def\n    by (simp add: Let_def)\n  ultimately\n  show ?thesis\n    unfolding InvariantQCharacterization_def\n    unfolding applyUnitPropagate_def\n    by (simp add: Let_def)\nqed\n\n\nlemma InvariantUniqQAfterApplyUnitPropagate:\nassumes\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\"\n  \"InvariantUniqQ (getQ state)\"\n  \"getQ state \\<noteq> []\"\nshows\n  \"let state'' = applyUnitPropagate state in\n      InvariantUniqQ (getQ state'')\"\nproof-\n  let ?uLiteral = \"hd (getQ state)\"\n  let ?state' = \"assertLiteral ?uLiteral False state\"\n  let ?state'' = \"applyUnitPropagate state\"\n  have \"InvariantUniqQ (getQ ?state')\"\n    using assms\n    using InvariantUniqQAfterAssertLiteral[of \"state\" \"?uLiteral\" \"False\"]\n    by (simp add: Let_def)\n  moreover\n  obtain s \n    where \"getQ state @ s = getQ ?state'\"\n    using assms\n    using assertLiteralEffect[of \"state\" \"?uLiteral\" \"False\"]\n    unfolding isPrefix_def\n    by auto\n  hence \"getQ ?state' = getQ state @ s\"\n    by (rule sym)\n  with \\<open>getQ state \\<noteq> []\\<close>\n  have \"getQ ?state' \\<noteq> []\"\n    by simp\n  ultimately\n  show ?thesis\n    using \\<open>getQ state \\<noteq> []\\<close>\n    unfolding InvariantUniqQ_def\n    unfolding applyUnitPropagate_def\n    using hd_Cons_tl[of \"getQ ?state'\"]\n    using uniqAppendIff[of \"[hd (getQ ?state')]\" \"tl (getQ ?state')\"]\n    by (simp add: Let_def)\nqed\n\nlemma InvariantNoDecisionsWhenConflictNorUnitAfterUnitPropagate:\nassumes \n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\"\n  \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n  \"InvariantNoDecisionsWhenConflict (getF state) (getM state) (currentLevel (getM state))\"\n  \"InvariantNoDecisionsWhenUnit (getF state) (getM state) (currentLevel (getM state))\"\nshows\n  \"let state' = applyUnitPropagate state in\n     InvariantNoDecisionsWhenConflict (getF state') (getM state') (currentLevel (getM state')) \\<and> \n     InvariantNoDecisionsWhenUnit (getF state') (getM state') (currentLevel (getM state'))\"\nusing assms\nunfolding applyUnitPropagate_def\nusing InvariantsNoDecisionsWhenConflictNorUnitAfterAssertLiteral[of \"state\" \"False\" \"hd (getQ state)\"]\nunfolding InvariantNoDecisionsWhenConflict_def\nby (simp add: Let_def)\n\n\nlemma InvariantGetReasonIsReasonAfterApplyUnitPropagate:\nassumes\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\" and\n  \"InvariantUniqQ (getQ state)\" and\n  \"InvariantGetReasonIsReason (getReason state) (getF state) (getM state) (set (getQ state))\" and\n  \"getQ state \\<noteq> []\" and\n  \"\\<not> getConflictFlag state\" \nshows\n  \"let state' = applyUnitPropagate state in \n     InvariantGetReasonIsReason (getReason state') (getF state') (getM state') (set (getQ state'))\"\nproof-\n  let ?state0 = \"state \\<lparr> getM := getM state @ [(hd (getQ state), False)]\\<rparr>\"\n  let ?state' = \"assertLiteral (hd (getQ state)) False state\"\n  let ?state'' = \"applyUnitPropagate state\"\n\n  have \"InvariantGetReasonIsReason (getReason ?state0) (getF ?state0) (getM ?state0) (set (removeAll (hd (getQ ?state0)) (getQ ?state0)))\"\n  proof-\n\n    {\n      fix l::Literal\n      assume *: \"l el (elements (getM ?state0)) \\<and> \\<not> l el (decisions (getM ?state0)) \\<and> elementLevel l (getM ?state0) > 0\"\n      hence \"\\<exists> reason. getReason ?state0 l = Some reason \\<and> 0 \\<le> reason \\<and> reason < length (getF ?state0) \\<and> \n               isReason (nth (getF ?state0) reason) l (elements (getM ?state0))\"\n      proof (cases \"l el (elements (getM state))\")\n        case True\n        from * \n        have \"\\<not> l el (decisions (getM state))\"\n          by (auto simp add: markedElementsAppend)\n        from *\n        have \"elementLevel l (getM state) > 0\"\n          using elementLevelAppend[of \"l\" \"getM state\" \"[(hd (getQ state), False)]\"]\n          using \\<open>l el (elements (getM state))\\<close>\n          by simp\n        show ?thesis\n          using \\<open>InvariantGetReasonIsReason (getReason state) (getF state) (getM state) (set (getQ state))\\<close>\n          using \\<open>l el (elements (getM state))\\<close>\n          using \\<open>\\<not> l el (decisions (getM state))\\<close>\n          using \\<open>elementLevel l (getM state) > 0\\<close>\n          unfolding InvariantGetReasonIsReason_def\n          by (auto simp add: isReasonAppend)\n      next\n        case False\n        with * \n        have \"l = hd (getQ state)\"\n          by simp\n\n        have \"currentLevel (getM ?state0) > 0\"\n          using *\n          using elementLevelLeqCurrentLevel[of \"l\" \"getM ?state0\"]\n          by auto\n        hence \"currentLevel (getM state) > 0\"\n          unfolding currentLevel_def\n          by (simp add: markedElementsAppend)\n        moreover\n        have \"hd (getQ ?state0) el (getQ state)\"\n          using \\<open>getQ state \\<noteq> []\\<close>\n          by simp\n        ultimately\n        obtain reason\n          where \"getReason state (hd (getQ state)) = Some reason\" \"0 \\<le> reason \\<and> reason < length (getF state)\"\n          \"isUnitClause (nth (getF state) reason) (hd (getQ state)) (elements (getM state)) \\<or> \n           clauseFalse (nth (getF state) reason) (elements (getM state))\" \n          using \\<open>InvariantGetReasonIsReason (getReason state) (getF state) (getM state) (set (getQ state))\\<close>\n          unfolding InvariantGetReasonIsReason_def\n          by auto\n        hence \"isUnitClause (nth (getF state) reason) (hd (getQ state)) (elements (getM state))\"\n          using \\<open>\\<not> getConflictFlag state\\<close>\n          using \\<open>InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\\<close>\n          unfolding InvariantConflictFlagCharacterization_def\n          using nth_mem[of \"reason\" \"getF state\"]\n          using formulaFalseIffContainsFalseClause[of \"getF state\" \"elements (getM state)\"]\n          by simp\n        thus ?thesis\n          using \\<open>getReason state (hd (getQ state)) = Some reason\\<close> \\<open>0 \\<le> reason \\<and> reason < length (getF state)\\<close>\n          using isUnitClauseIsReason[of \"nth (getF state) reason\" \"hd (getQ state)\" \"elements (getM state)\" \"[hd (getQ state)]\"]\n          using \\<open>l = hd (getQ state)\\<close>\n          by simp\n     qed\n    }\n    moreover\n    {\n      fix literal::Literal\n      assume \"currentLevel (getM ?state0) > 0\"\n      hence \"currentLevel (getM state) > 0\"\n        unfolding currentLevel_def\n        by (simp add: markedElementsAppend)\n\n      assume\"literal el removeAll (hd (getQ ?state0)) (getQ ?state0)\"\n      hence \"literal \\<noteq> hd (getQ state)\" \"literal el getQ state\"\n        by auto\n      \n      then obtain reason\n        where \"getReason state literal = Some reason\" \"0 \\<le> reason \\<and> reason < length (getF state)\" and\n        *: \"isUnitClause (nth (getF state) reason) literal (elements (getM state)) \\<or> \n            clauseFalse (nth (getF state) reason) (elements (getM state))\"\n        using \\<open>currentLevel (getM state) > 0\\<close>\n        using \\<open>InvariantGetReasonIsReason (getReason state) (getF state) (getM state) (set (getQ state))\\<close>\n        unfolding InvariantGetReasonIsReason_def\n        by auto\n      hence \"\\<exists> reason. getReason ?state0 literal = Some reason \\<and> 0 \\<le> reason \\<and> reason < length (getF ?state0) \\<and> \n              (isUnitClause (nth (getF ?state0) reason) literal (elements (getM ?state0)) \\<or> \n               clauseFalse (nth (getF ?state0) reason) (elements (getM ?state0)))\"\n      proof (cases \"isUnitClause (nth (getF state) reason) literal (elements (getM state))\")\n        case True\n        show ?thesis\n        proof (cases \"opposite literal = hd (getQ state)\")\n          case True\n          thus ?thesis\n            using \\<open>isUnitClause (nth (getF state) reason) literal (elements (getM state))\\<close>\n            using \\<open>getReason state literal = Some reason\\<close>\n            using \\<open>literal \\<noteq> hd (getQ state)\\<close>\n            using \\<open>0 \\<le> reason \\<and> reason < length (getF state)\\<close>\n            unfolding isUnitClause_def\n            by (auto simp add: clauseFalseIffAllLiteralsAreFalse)\n        next\n          case False\n          thus ?thesis\n            using \\<open>isUnitClause (nth (getF state) reason) literal (elements (getM state))\\<close>\n            using \\<open>getReason state literal = Some reason\\<close>\n            using \\<open>literal \\<noteq> hd (getQ state)\\<close>\n            using \\<open>0 \\<le> reason \\<and> reason < length (getF state)\\<close>\n            unfolding isUnitClause_def\n            by auto\n        qed\n      next\n        case False\n        with * \n        have \"clauseFalse (nth (getF state) reason) (elements (getM state))\"\n          by simp\n        thus ?thesis\n          using \\<open>getReason state literal = Some reason\\<close>\n          using \\<open>0 \\<le> reason \\<and> reason < length (getF state)\\<close>\n          using clauseFalseAppendValuation[of \"nth (getF state) reason\" \"elements (getM state)\" \"[hd (getQ state)]\"]\n          by auto\n      qed\n    }\n    ultimately\n    show ?thesis\n      unfolding InvariantGetReasonIsReason_def\n      by auto\n  qed\n\n  hence \"InvariantGetReasonIsReason (getReason ?state') (getF ?state') (getM ?state') (set (removeAll (hd (getQ state)) (getQ state)) \\<union> (set (getQ ?state') - set (getQ state)))\"\n    using assms\n    unfolding assertLiteral_def\n    unfolding notifyWatches_def\n    using InvariantGetReasonIsReasonAfterNotifyWatches[of  \n      \"?state0\" \"getWatchList ?state0 (opposite (hd (getQ state)))\"  \"opposite (hd (getQ state))\" \"getM state\" \"False\"\n      \"set (removeAll (hd (getQ ?state0)) (getQ ?state0))\" \"[]\"]\n    unfolding InvariantWatchListsContainOnlyClausesFromF_def\n    unfolding InvariantWatchListsCharacterization_def\n    unfolding InvariantWatchListsUniq_def\n    by (auto simp add: Let_def)\n\n  obtain s \n    where \"getQ state @ s = getQ ?state'\"\n    using assms\n    using assertLiteralEffect[of \"state\" \"hd (getQ state)\" \"False\"]\n    unfolding isPrefix_def\n    by auto\n  hence \"getQ ?state' = getQ state @ s\"\n    by simp\n  hence \"hd (getQ ?state') = hd (getQ state)\"\n    using hd_append2[of \"getQ state\" \"s\"]\n    using \\<open>getQ state \\<noteq> []\\<close>\n    by simp\n\n  have \" set (removeAll (hd (getQ state)) (getQ state)) \\<union> (set (getQ ?state') - set (getQ state)) = \n         set (removeAll (hd (getQ state)) (getQ ?state'))\"\n    using \\<open>getQ ?state' = getQ state @ s\\<close>\n    using \\<open>getQ state \\<noteq> []\\<close>\n    by auto\n\n  have \"uniq (getQ ?state')\"\n    using assms\n    using InvariantUniqQAfterAssertLiteral[of \"state\" \"hd (getQ state)\" \"False\"]\n    unfolding InvariantUniqQ_def\n    by (simp add: Let_def)\n  \n  have \"set (getQ ?state'') = set (removeAll (hd (getQ state)) (getQ ?state'))\"\n    using \\<open>uniq (getQ ?state')\\<close>\n    using \\<open>hd (getQ ?state') = hd (getQ state)\\<close>\n    using uniqHeadTailSet[of \"getQ ?state'\"]\n    unfolding applyUnitPropagate_def\n    by (simp add: Let_def)\n\n  thus ?thesis\n    using \\<open>InvariantGetReasonIsReason (getReason ?state') (getF ?state') (getM ?state') (set (removeAll (hd (getQ state)) (getQ state)) \\<union> (set (getQ ?state') - set (getQ state)))\\<close>\n    using \\<open>set (getQ ?state'') = set (removeAll (hd (getQ state)) (getQ ?state'))\\<close>\n    using \\<open>set (removeAll (hd (getQ state)) (getQ state)) \\<union> (set (getQ ?state') - set (getQ state)) = \n         set (removeAll (hd (getQ state)) (getQ ?state'))\\<close>\n    unfolding applyUnitPropagate_def\n    by (simp add: Let_def)\nqed\n\nlemma InvariantEquivalentZLAfterApplyUnitPropagate:\nassumes \n  \"InvariantEquivalentZL (getF state) (getM state) Phi\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and \n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n\n  \"\\<not> (getConflictFlag state)\"\n  \"getQ state \\<noteq> []\"\nshows\n  \"let state' = applyUnitPropagate state in\n      InvariantEquivalentZL (getF state') (getM state') Phi\n  \"\nproof-\n  let ?uLiteral = \"hd (getQ state)\"\n  let ?state' = \"applyUnitPropagate state\"\n  let ?FM = \"getF state @ val2form (elements (prefixToLevel 0 (getM state)))\"\n  let ?FM' = \"getF ?state' @ val2form (elements (prefixToLevel 0 (getM ?state')))\"\n\n\n  obtain uClause \n    where \"formulaEntailsClause (getF state) uClause\" and \n    \"isUnitClause uClause ?uLiteral (elements (getM state))\" and\n    \"(getM ?state') = (getM state) @ [(?uLiteral, False)]\"\n    \"(getF ?state') = (getF state)\"\n    using assms\n    using applyUnitPropagateEffect[of \"state\"]\n    unfolding applyUnitPropagate_def\n    using assertLiteralEffect\n    by (auto simp add: Let_def)\n  note * = this\n\n  show ?thesis\n  proof (cases \"currentLevel (getM state) = 0\")\n    case True\n    hence \"getM state = prefixToLevel 0 (getM state)\"\n      by (rule currentLevelZeroTrailEqualsItsPrefixToLevelZero)\n\n    \n    have \"?FM' = ?FM @ [[?uLiteral]]\"\n      using *\n      using \\<open>(getM ?state') = (getM state) @ [(?uLiteral, False)]\\<close>\n      using prefixToLevelAppend[of \"0\" \"getM state\" \"[(?uLiteral, False)]\"]\n      using \\<open>currentLevel (getM state) = 0\\<close>\n      using \\<open>getM state = prefixToLevel 0 (getM state)\\<close>\n      by (auto simp add: val2formAppend)\n\n    have \"formulaEntailsLiteral ?FM ?uLiteral\"\n      using *\n      using unitLiteralIsEntailed [of \"uClause\" \"?uLiteral\" \"elements (getM state)\" \"(getF state)\"]\n      using \\<open>InvariantEquivalentZL (getF state) (getM state) Phi\\<close>\n      using \\<open>getM state = prefixToLevel 0 (getM state)\\<close>\n      unfolding InvariantEquivalentZL_def\n      by simp\n    hence \"formulaEntailsClause ?FM [?uLiteral]\"\n      unfolding formulaEntailsLiteral_def\n      unfolding formulaEntailsClause_def\n      by (auto simp add: clauseTrueIffContainsTrueLiteral)\n\n    show ?thesis\n      using \\<open>InvariantEquivalentZL (getF state) (getM state) Phi\\<close>\n      using \\<open>?FM' = ?FM @ [[?uLiteral]]\\<close>\n      using \\<open>formulaEntailsClause ?FM [?uLiteral]\\<close>\n      unfolding InvariantEquivalentZL_def\n      using extendEquivalentFormulaWithEntailedClause[of \"Phi\" \"?FM\" \"[?uLiteral]\"]\n      by (simp add: equivalentFormulaeSymmetry)\n  next\n    case False\n    hence \"?FM = ?FM'\"\n      using *\n      using prefixToLevelAppend[of \"0\" \"getM state\" \"[(?uLiteral, False)]\"]\n      by (simp add: Let_def)\n    thus ?thesis\n      using \\<open>InvariantEquivalentZL (getF state) (getM state) Phi\\<close>\n      unfolding InvariantEquivalentZL_def\n      by (simp add: Let_def)\n  qed\nqed\n\n\nlemma InvariantVarsQTl:\nassumes\n  \"InvariantVarsQ Q F0 Vbl\"\n  \"Q \\<noteq> []\"\nshows\n  \"InvariantVarsQ (tl Q) F0 Vbl\"\nproof-\n  have \"InvariantVarsQ ((hd Q) # (tl Q)) F0 Vbl\"\n    using assms\n    by simp\n  hence \"{var (hd Q)} \\<union> vars (tl Q) \\<subseteq> vars F0 \\<union> Vbl\"\n    unfolding InvariantVarsQ_def\n    by simp\n  thus ?thesis\n    unfolding InvariantVarsQ_def\n    by simp\nqed\n\nlemma InvariantsVarsAfterApplyUnitPropagate:\nassumes\n  \"InvariantConsistent (getM state)\"\n  \"InvariantUniq (getM state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and \n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\" and\n  \"InvariantQCharacterization False (getQ state) (getF state) (getM state)\" and\n  \"getQ state \\<noteq> []\"\n  \"\\<not> getConflictFlag state\"\n  \"InvariantVarsM (getM state) F0 Vbl\" and\n  \"InvariantVarsQ (getQ state) F0 Vbl\" and\n  \"InvariantVarsF (getF state) F0 Vbl\"\nshows\n  \"let state' = applyUnitPropagate state in\n     InvariantVarsM (getM state') F0 Vbl \\<and> \n     InvariantVarsQ (getQ state') F0 Vbl\"\nproof-\n  let ?state' = \"assertLiteral (hd (getQ state)) False state\"\n  let ?state'' = \"applyUnitPropagate state\"\n  have \"InvariantVarsQ (getQ ?state') F0 Vbl\"\n    using assms\n    using InvariantConsistentAfterApplyUnitPropagate[of \"state\"]\n    using InvariantUniqAfterApplyUnitPropagate[of \"state\"]\n    using InvariantVarsQAfterAssertLiteral[of \"state\" \"hd (getQ state)\" \"False\" \"F0\" \"Vbl\"]\n    using assertLiteralEffect[of \"state\" \"hd (getQ state)\" \"False\"]\n    unfolding applyUnitPropagate_def\n    by (simp add: Let_def)\n  moreover\n  have \"(getQ ?state') \\<noteq> []\"\n    using assms\n    using assertLiteralEffect[of \"state\" \"hd (getQ state)\" \"False\"]\n    using \\<open>getQ state \\<noteq> []\\<close>\n    unfolding isPrefix_def\n    by auto\n  ultimately\n  have \"InvariantVarsQ (getQ ?state'') F0 Vbl\"\n    unfolding applyUnitPropagate_def\n    using InvariantVarsQTl[of \"getQ ?state'\" F0 Vbl]\n    by (simp add: Let_def)\n  moreover\n  have \"var (hd (getQ state)) \\<in> vars F0 \\<union> Vbl\"\n    using \\<open>getQ state \\<noteq> []\\<close>\n    using \\<open>InvariantVarsQ (getQ state) F0 Vbl\\<close>\n    using hd_in_set[of \"getQ state\"]\n    using clauseContainsItsLiteralsVariable[of \"hd (getQ state)\" \"getQ state\"]\n    unfolding InvariantVarsQ_def\n    by auto\n  hence \"InvariantVarsM (getM ?state'') F0 Vbl\"\n    using assms\n    using assertLiteralEffect[of \"state\" \"hd (getQ state)\" \"False\"]\n    using varsAppendValuation[of \"elements (getM state)\" \"[hd (getQ state)]\"]\n    unfolding applyUnitPropagate_def\n    unfolding InvariantVarsM_def\n    by (simp add: Let_def)\n  ultimately\n  show ?thesis\n    by (simp add: Let_def)\nqed\n\n\n(*********************************************************************************)\n(*   E X H A U S T I V E   U N I T   P R O P A G A T E                           *)\n(*********************************************************************************)\n\ndefinition \"lexLessState (Vbl::Variable set) == {(state1, state2). \n  (getM state1, getM state2) \\<in> lexLessRestricted Vbl}\"\n\nlemma exhaustiveUnitPropagateTermination:\nfixes\n  state::State and Vbl::\"Variable set\"\nassumes \n  \"InvariantUniq (getM state)\"\n  \"InvariantConsistent (getM state)\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n  \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n  \"InvariantUniqQ (getQ state)\"\n  \"InvariantVarsM (getM state) F0 Vbl\"\n  \"InvariantVarsQ (getQ state) F0 Vbl\"\n  \"InvariantVarsF (getF state) F0 Vbl\"\n  \"finite Vbl\"\nshows\n  \"exhaustiveUnitPropagate_dom state\"\nusing assms\nproof (induct rule: wf_induct[of \"lexLessState (vars F0 \\<union> Vbl)\"])\n  case 1\n  show ?case\n    unfolding wf_eq_minimal\n  proof-\n    show \"\\<forall>Q (state::State). state \\<in> Q \\<longrightarrow> (\\<exists>stateMin\\<in>Q. \\<forall>state'. (state', stateMin) \\<in> lexLessState (vars F0 \\<union> Vbl) \\<longrightarrow> state' \\<notin> Q)\"\n    proof-\n      {\n        fix Q :: \"State set\" and state :: State\n        assume \"state \\<in> Q\"\n        let ?Q1 = \"{M::LiteralTrail. \\<exists> state. state \\<in> Q \\<and> (getM state) = M}\"\n        from \\<open>state \\<in> Q\\<close>\n        have \"getM state \\<in> ?Q1\"\n          by auto\n        have \"wf (lexLessRestricted (vars F0 \\<union> Vbl))\"\n          using \\<open>finite Vbl\\<close>\n          using finiteVarsFormula[of \"F0\"]\n          using  wfLexLessRestricted[of \"vars F0 \\<union> Vbl\"]\n          by simp\n        with \\<open>getM state \\<in> ?Q1\\<close>\n        obtain Mmin where \"Mmin \\<in> ?Q1\" \"\\<forall>M'. (M', Mmin) \\<in> lexLessRestricted (vars F0 \\<union> Vbl) \\<longrightarrow> M' \\<notin> ?Q1\"\n          unfolding wf_eq_minimal\n          apply (erule_tac x=\"?Q1\" in allE)\n          apply (erule_tac x=\"getM state\" in allE)\n          by auto \n        from \\<open>Mmin \\<in> ?Q1\\<close> obtain stateMin\n          where \"stateMin \\<in> Q\" \"(getM stateMin) = Mmin\"\n          by auto\n        have \"\\<forall>state'. (state', stateMin) \\<in> lexLessState (vars F0 \\<union> Vbl) \\<longrightarrow> state' \\<notin> Q\"\n        proof\n          fix state'\n          show \"(state', stateMin) \\<in> lexLessState (vars F0 \\<union> Vbl) \\<longrightarrow> state' \\<notin> Q\"\n          proof\n            assume \"(state', stateMin) \\<in> lexLessState (vars F0 \\<union> Vbl)\"\n            hence \"(getM state', getM stateMin) \\<in> lexLessRestricted (vars F0 \\<union> Vbl)\"\n              unfolding lexLessState_def\n              by auto\n            from \\<open>\\<forall>M'. (M', Mmin) \\<in> lexLessRestricted (vars F0 \\<union> Vbl) \\<longrightarrow> M' \\<notin> ?Q1\\<close>\n              \\<open>(getM state', getM stateMin) \\<in> lexLessRestricted (vars F0 \\<union> Vbl)\\<close> \\<open>getM stateMin = Mmin\\<close>\n            have \"getM state' \\<notin> ?Q1\"\n              by simp\n            with \\<open>getM stateMin = Mmin\\<close>\n            show \"state' \\<notin> Q\"\n              by auto\n          qed\n        qed\n        with \\<open>stateMin \\<in> Q\\<close>\n        have \"\\<exists> stateMin \\<in> Q. (\\<forall>state'. (state', stateMin) \\<in> lexLessState (vars F0 \\<union> Vbl) \\<longrightarrow> state' \\<notin> Q)\"\n          by auto\n      }\n      thus ?thesis\n        by auto\n    qed\n  qed\nnext\n  case (2 state')\n  note ih = this\n  show ?case\n  proof (cases \"getQ state' = [] \\<or> getConflictFlag state'\")\n    case False\n    let ?state'' = \"applyUnitPropagate state'\"\n\n    have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state'') (getF ?state'')\" and\n      \"InvariantWatchListsUniq (getWatchList ?state'')\" and\n      \"InvariantWatchListsCharacterization (getWatchList ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      \"InvariantWatchesEl (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\" and\n      \"InvariantWatchesDiffer (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      using ih\n      using WatchInvariantsAfterAssertLiteral[of \"state'\" \"hd (getQ state')\" \"False\"]\n      unfolding applyUnitPropagate_def\n      by (auto simp add: Let_def)\n    moreover\n    have \"InvariantWatchCharacterization (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'') (getM ?state'')\"\n      using ih\n      using InvariantWatchCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      unfolding InvariantQCharacterization_def\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantQCharacterization (getConflictFlag ?state'') (getQ ?state'') (getF ?state'') (getM ?state'')\"\n      using ih\n      using InvariantQCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantConflictFlagCharacterization (getConflictFlag ?state'') (getF ?state'') (getM ?state'')\"\n      using ih\n      using InvariantConflictFlagCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantUniqQ (getQ ?state'')\"\n      using ih\n      using InvariantUniqQAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantConsistent (getM ?state'')\"\n      using ih\n      using InvariantConsistentAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantUniq (getM ?state'')\"\n      using ih\n      using InvariantUniqAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantVarsM (getM ?state'') F0 Vbl\" \"InvariantVarsQ (getQ ?state'') F0 Vbl\"\n      using ih\n      using \\<open>\\<not> (getQ state' = [] \\<or> getConflictFlag state')\\<close>\n      using InvariantsVarsAfterApplyUnitPropagate[of \"state'\" \"F0\" \"Vbl\"]\n      by (auto simp add: Let_def)\n    moreover\n    have \"InvariantVarsF (getF ?state'') F0 Vbl\"\n      unfolding applyUnitPropagate_def\n      using assertLiteralEffect[of \"state'\" \"hd (getQ state')\" \"False\"]\n      using ih\n      by (simp add: Let_def)\n    moreover\n    have \"(?state'', state') \\<in> lexLessState (vars F0 \\<union> Vbl)\"\n    proof-\n      have \"getM ?state'' = getM state' @ [(hd (getQ state'), False)]\"\n        unfolding applyUnitPropagate_def\n        using ih\n        using assertLiteralEffect[of \"state'\" \"hd (getQ state')\" \"False\"]\n        by (simp add: Let_def)\n      thus ?thesis\n        unfolding lexLessState_def\n        unfolding lexLessRestricted_def\n        using lexLessAppend[of \"[(hd (getQ state'), False)]\" \"getM state'\"]\n        using \\<open>InvariantConsistent (getM ?state'')\\<close>\n        unfolding InvariantConsistent_def\n        using \\<open>InvariantConsistent (getM state')\\<close>\n        unfolding InvariantConsistent_def\n        using \\<open>InvariantUniq (getM ?state'')\\<close>\n        unfolding InvariantUniq_def\n        using \\<open>InvariantUniq (getM state')\\<close>\n        unfolding InvariantUniq_def\n        using \\<open>InvariantVarsM (getM ?state'') F0 Vbl\\<close>\n        using \\<open>InvariantVarsM (getM state') F0 Vbl\\<close>\n        unfolding InvariantVarsM_def\n        by simp\n    qed\n    ultimately\n    have \"exhaustiveUnitPropagate_dom ?state''\"\n      using ih\n      by auto\n    thus ?thesis\n      using exhaustiveUnitPropagate_dom.intros[of \"state'\"]\n      using False\n      by simp\n  next\n    case True\n    show ?thesis\n      apply (rule exhaustiveUnitPropagate_dom.intros)\n      using True\n      by simp\n  qed  \nqed\n\nlemma exhaustiveUnitPropagatePreservedVariables:\nassumes\n  \"exhaustiveUnitPropagate_dom state\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\"\nshows\n  \"let state' = exhaustiveUnitPropagate state in \n       (getSATFlag state') = (getSATFlag state)\"\nusing assms\nproof (induct state rule: exhaustiveUnitPropagate_dom.induct)\n  case (step state')\n  note ih = this\n  show ?case\n  proof (cases \"(getConflictFlag state') \\<or> (getQ state') = []\")\n    case True\n    with exhaustiveUnitPropagate.simps[of \"state'\"]\n    have \"exhaustiveUnitPropagate state' = state'\"\n      by simp\n    thus ?thesis\n      by (simp only: Let_def)\n  next\n    case False\n    let ?state'' = \"applyUnitPropagate state'\"\n\n    have \"exhaustiveUnitPropagate state' = exhaustiveUnitPropagate ?state''\"\n      using exhaustiveUnitPropagate.simps[of \"state'\"]\n      using False\n      by simp\n    moreover\n    have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state'') (getF ?state'')\" and\n      \"InvariantWatchListsUniq (getWatchList ?state'')\" and\n      \"InvariantWatchListsCharacterization (getWatchList ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      \"InvariantWatchesEl (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\" and\n      \"InvariantWatchesDiffer (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      using ih\n      using WatchInvariantsAfterAssertLiteral[of \"state'\" \"hd (getQ state')\" \"False\"]\n      unfolding applyUnitPropagate_def\n      by (auto simp add: Let_def)\n    moreover\n    have \"getSATFlag ?state'' = getSATFlag state'\"\n      unfolding applyUnitPropagate_def\n      using assertLiteralEffect[of \"state'\" \"hd (getQ state')\" \"False\"]\n      using ih\n      by (simp add: Let_def)\n    ultimately\n    show ?thesis\n      using ih\n      using False\n      by (simp add: Let_def)\n  qed\nqed\n\nlemma exhaustiveUnitPropagatePreservesCurrentLevel:\nassumes\n  \"exhaustiveUnitPropagate_dom state\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\"\nshows\n  \"let state' = exhaustiveUnitPropagate state in \n       currentLevel (getM state') = currentLevel (getM state)\"\nusing assms\nproof (induct state rule: exhaustiveUnitPropagate_dom.induct)\n  case (step state')\n  note ih = this\n  show ?case\n  proof (cases \"(getConflictFlag state') \\<or> (getQ state') = []\")\n    case True\n    with exhaustiveUnitPropagate.simps[of \"state'\"]\n    have \"exhaustiveUnitPropagate state' = state'\"\n      by simp\n    thus ?thesis\n      by (simp only: Let_def)\n  next\n    case False\n    let ?state'' = \"applyUnitPropagate state'\"\n\n    have \"exhaustiveUnitPropagate state' = exhaustiveUnitPropagate ?state''\"\n      using exhaustiveUnitPropagate.simps[of \"state'\"]\n      using False\n      by simp\n    moreover\n    have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state'') (getF ?state'')\" and\n      \"InvariantWatchListsUniq (getWatchList ?state'')\" and\n      \"InvariantWatchListsCharacterization (getWatchList ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      \"InvariantWatchesEl (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\" and\n      \"InvariantWatchesDiffer (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      using ih\n      using WatchInvariantsAfterAssertLiteral[of \"state'\" \"hd (getQ state')\" \"False\"]\n      unfolding applyUnitPropagate_def\n      by (auto simp add: Let_def)\n    moreover\n    have \"currentLevel (getM state') = currentLevel (getM ?state'')\"\n      unfolding applyUnitPropagate_def\n      using assertLiteralEffect[of \"state'\" \"hd (getQ state')\" \"False\"]\n      using ih\n      unfolding currentLevel_def\n      by (simp add: Let_def markedElementsAppend)\n    ultimately\n    show ?thesis\n      using ih\n      using False\n      by (simp add: Let_def)\n  qed\nqed\n\n\nlemma InvariantsAfterExhaustiveUnitPropagate:\nassumes\n  \"exhaustiveUnitPropagate_dom state\"\n  \"InvariantConsistent (getM state)\"\n  \"InvariantUniq (getM state)\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n  \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n  \"InvariantUniqQ (getQ state)\"\n  \"InvariantVarsQ (getQ state) F0 Vbl\"\n  \"InvariantVarsM (getM state) F0 Vbl\"\n  \"InvariantVarsF (getF state) F0 Vbl\"\nshows\n  \"let state' = exhaustiveUnitPropagate state in \n       InvariantConsistent (getM state') \\<and> \n       InvariantUniq (getM state') \\<and> \n       InvariantWatchListsContainOnlyClausesFromF (getWatchList state') (getF state') \\<and> \n       InvariantWatchListsUniq (getWatchList state') \\<and> \n       InvariantWatchListsCharacterization (getWatchList state') (getWatch1 state') (getWatch2 state') \\<and> \n       InvariantWatchesEl (getF state') (getWatch1 state') (getWatch2 state') \\<and> \n       InvariantWatchesDiffer (getF state') (getWatch1 state') (getWatch2 state') \\<and> \n       InvariantWatchCharacterization (getF state') (getWatch1 state') (getWatch2 state') (getM state') \\<and> \n       InvariantConflictFlagCharacterization (getConflictFlag state') (getF state') (getM state') \\<and> \n       InvariantQCharacterization (getConflictFlag state') (getQ state') (getF state') (getM state') \\<and> \n       InvariantUniqQ (getQ state') \\<and> \n       InvariantVarsQ (getQ state') F0 Vbl \\<and> \n       InvariantVarsM (getM state') F0 Vbl \\<and> \n       InvariantVarsF (getF state') F0 Vbl\n\"\nusing assms\nproof (induct state rule: exhaustiveUnitPropagate_dom.induct)\n  case (step state')\n  note ih = this\n  show ?case\n  proof (cases \"(getConflictFlag state') \\<or> (getQ state') = []\")\n    case True\n    with exhaustiveUnitPropagate.simps[of \"state'\"]\n    have \"exhaustiveUnitPropagate state' = state'\"\n      by simp\n    thus ?thesis\n      using ih\n      by (auto simp only: Let_def)\n  next\n    case False\n    let ?state'' = \"applyUnitPropagate state'\"\n\n    have \"exhaustiveUnitPropagate state' = exhaustiveUnitPropagate ?state''\"\n      using exhaustiveUnitPropagate.simps[of \"state'\"]\n      using False\n      by simp\n    moreover\n    have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state'') (getF ?state'')\" and\n      \"InvariantWatchListsUniq (getWatchList ?state'')\" and\n      \"InvariantWatchListsCharacterization (getWatchList ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      \"InvariantWatchesEl (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\" and\n      \"InvariantWatchesDiffer (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      using ih\n      using WatchInvariantsAfterAssertLiteral[of \"state'\" \"hd (getQ state')\" \"False\"]\n      unfolding applyUnitPropagate_def\n      by (auto simp add: Let_def)\n    moreover\n    have \"InvariantWatchCharacterization (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'') (getM ?state'')\"\n      using ih\n      using InvariantWatchCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      unfolding InvariantQCharacterization_def\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantQCharacterization (getConflictFlag ?state'') (getQ ?state'') (getF ?state'') (getM ?state'')\"\n      using ih\n      using InvariantQCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantConflictFlagCharacterization (getConflictFlag ?state'') (getF ?state'') (getM ?state'')\"\n      using ih\n      using InvariantConflictFlagCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantUniqQ (getQ ?state'')\"\n      using ih\n      using InvariantUniqQAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantConsistent (getM ?state'')\"\n      using ih\n      using InvariantConsistentAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantUniq (getM ?state'')\"\n      using ih\n      using InvariantUniqAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantVarsM (getM ?state'') F0 Vbl\" \"InvariantVarsQ (getQ ?state'') F0 Vbl\"\n      using ih\n      using \\<open>\\<not> (getConflictFlag state' \\<or> getQ state' = [])\\<close>\n      using InvariantsVarsAfterApplyUnitPropagate[of \"state'\" \"F0\" \"Vbl\"]\n      by (auto simp add: Let_def)\n    moreover\n    have \"InvariantVarsF (getF ?state'') F0 Vbl\"\n      unfolding applyUnitPropagate_def\n      using assertLiteralEffect[of \"state'\" \"hd (getQ state')\" \"False\"]\n      using ih\n      by (simp add: Let_def)\n    ultimately\n    show ?thesis\n      using ih\n      using False\n      by (simp add: Let_def)\n  qed\nqed\n\nlemma InvariantConflictClauseCharacterizationAfterExhaustivePropagate:\nassumes\n  \"exhaustiveUnitPropagate_dom state\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantConflictClauseCharacterization (getConflictFlag state) (getConflictClause state) (getF state) (getM state)\"\nshows\n  \"let state' = exhaustiveUnitPropagate state in\n   InvariantConflictClauseCharacterization (getConflictFlag state') (getConflictClause state') (getF state') (getM state')\"\nusing assms\nproof (induct state rule: exhaustiveUnitPropagate_dom.induct)\n  case (step state')\n  note ih = this\n  show ?case\n  proof (cases \"(getConflictFlag state') \\<or> (getQ state') = []\")\n    case True\n    with exhaustiveUnitPropagate.simps[of \"state'\"]\n    have \"exhaustiveUnitPropagate state' = state'\"\n      by simp\n    thus ?thesis\n      using ih\n      by (auto simp only: Let_def)\n  next\n    case False\n    let ?state'' = \"applyUnitPropagate state'\"\n\n    have \"exhaustiveUnitPropagate state' = exhaustiveUnitPropagate ?state''\"\n      using exhaustiveUnitPropagate.simps[of \"state'\"]\n      using False\n      by simp\n    moreover\n    have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state'') (getF ?state'')\" and\n      \"InvariantWatchListsUniq (getWatchList ?state'')\" and\n      \"InvariantWatchListsCharacterization (getWatchList ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      \"InvariantWatchesEl (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\" and\n      \"InvariantWatchesDiffer (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      using ih(2) ih(3) ih(4) ih(5) ih(6) ih(7)\n      using WatchInvariantsAfterAssertLiteral[of \"state'\" \"hd (getQ state')\" \"False\"]\n      unfolding applyUnitPropagate_def\n      by (auto simp add: Let_def)\n    moreover\n    have \"InvariantConflictClauseCharacterization (getConflictFlag ?state'') (getConflictClause ?state'') (getF ?state'') (getM ?state'')\"\n      using ih(2) ih(3) ih(4) ih(5) ih(6)\n      using \\<open>\\<not> (getConflictFlag state' \\<or> getQ state' = [])\\<close>\n      using InvariantConflictClauseCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      by (auto simp add: Let_def)\n    ultimately\n    show ?thesis\n      using ih(1) ih(2)\n      using False\n      by (simp only: Let_def) (blast)\n  qed\nqed\n\n\n\n    have \"exhaustiveUnitPropagate state' = exhaustiveUnitPropagate ?state''\"\n      using exhaustiveUnitPropagate.simps[of \"state'\"]\n      using False\n      by simp\n    moreover\n    have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state'') (getF ?state'')\" and\n      \"InvariantWatchListsUniq (getWatchList ?state'')\" and\n      \"InvariantWatchListsCharacterization (getWatchList ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      \"InvariantWatchesEl (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\" and\n      \"InvariantWatchesDiffer (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      using ih(5) ih(6) ih(7) ih(8) ih(9)\n      using WatchInvariantsAfterAssertLiteral[of \"state'\" \"hd (getQ state')\" \"False\"]\n      unfolding applyUnitPropagate_def\n      by (auto simp add: Let_def)\n    moreover\n    have \"InvariantWatchCharacterization (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'') (getM ?state'')\"\n      using ih\n      using InvariantWatchCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      unfolding InvariantQCharacterization_def\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantQCharacterization (getConflictFlag ?state'') (getQ ?state'') (getF ?state'') (getM ?state'')\"\n      using ih\n      using InvariantQCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantConflictFlagCharacterization (getConflictFlag ?state'') (getF ?state'') (getM ?state'')\"\n      using ih\n      using InvariantConflictFlagCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantUniqQ (getQ ?state'')\"\n      using ih\n      using InvariantUniqQAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantConsistent (getM ?state'')\"\n      using ih\n      using InvariantConsistentAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantUniq (getM ?state'')\"\n      using ih\n      using InvariantUniqAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantNoDecisionsWhenUnit (getF ?state'') (getM ?state'') (currentLevel (getM ?state''))\"\n         \"InvariantNoDecisionsWhenConflict (getF ?state'') (getM ?state'') (currentLevel (getM ?state''))\"\n      using ih(5) ih(8) ih(11) ih(12) ih(14) ih(15)\n      using InvariantNoDecisionsWhenConflictNorUnitAfterUnitPropagate[of \"state'\"]\n      by (auto simp add: Let_def)\n    ultimately\n    show ?thesis\n      using ih(1) ih(2)\n      using False\n      by (simp add: Let_def)\n  qed\nqed\n\n\nlemma InvariantGetReasonIsReasonAfterExhaustiveUnitPropagate:\nassumes\n  \"exhaustiveUnitPropagate_dom state\"\n  \"InvariantConsistent (getM state)\"\n  \"InvariantUniq (getM state)\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n  \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n  \"InvariantUniqQ (getQ state)\" and\n  \"InvariantGetReasonIsReason (getReason state) (getF state) (getM state) (set (getQ state))\"\nshows\n  \"let state' = exhaustiveUnitPropagate state in \n       InvariantGetReasonIsReason (getReason state') (getF state') (getM state') (set (getQ state'))\"\nusing assms\nproof (induct state rule: exhaustiveUnitPropagate_dom.induct)\n  case (step state')\n  note ih = this\n  show ?case\n  proof (cases \"(getConflictFlag state') \\<or> (getQ state') = []\")\n    case True\n    with exhaustiveUnitPropagate.simps[of \"state'\"]\n    have \"exhaustiveUnitPropagate state' = state'\"\n      by simp\n    thus ?thesis\n      using ih\n      by (auto simp only: Let_def)\n  next\n    case False\n    let ?state'' = \"applyUnitPropagate state'\"\n\n    have \"exhaustiveUnitPropagate state' = exhaustiveUnitPropagate ?state''\"\n      using exhaustiveUnitPropagate.simps[of \"state'\"]\n      using False\n      by simp\n    moreover\n    have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state'') (getF ?state'')\" and\n      \"InvariantWatchListsUniq (getWatchList ?state'')\" and\n      \"InvariantWatchListsCharacterization (getWatchList ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      \"InvariantWatchesEl (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\" and\n      \"InvariantWatchesDiffer (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      using ih\n      using WatchInvariantsAfterAssertLiteral[of \"state'\" \"hd (getQ state')\" \"False\"]\n      unfolding applyUnitPropagate_def\n      by (auto simp add: Let_def)\n    moreover\n    have \"InvariantWatchCharacterization (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'') (getM ?state'')\"\n      using ih\n      using InvariantWatchCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      unfolding InvariantQCharacterization_def\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantQCharacterization (getConflictFlag ?state'') (getQ ?state'') (getF ?state'') (getM ?state'')\"\n      using ih\n      using InvariantQCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantConflictFlagCharacterization (getConflictFlag ?state'') (getF ?state'') (getM ?state'')\"\n      using ih\n      using InvariantConflictFlagCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantUniqQ (getQ ?state'')\"\n      using ih\n      using InvariantUniqQAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantConsistent (getM ?state'')\"\n      using ih\n      using InvariantConsistentAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantUniq (getM ?state'')\"\n      using ih\n      using InvariantUniqAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantGetReasonIsReason (getReason ?state'') (getF ?state'') (getM ?state'') (set (getQ ?state''))\"\n      using ih\n      using InvariantGetReasonIsReasonAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    ultimately\n    show ?thesis\n      using ih\n      using False\n      by (simp add: Let_def)\n  qed\nqed\n\n\nlemma InvariantEquivalentZLAfterExhaustiveUnitPropagate:\nassumes\n  \"exhaustiveUnitPropagate_dom state\"\n  \"InvariantConsistent (getM state)\"\n  \"InvariantUniq (getM state)\"\n  \"InvariantEquivalentZL (getF state) (getM state) Phi\"\n  \"InvariantWatchListsContainOnlyClausesFromF (getWatchList state) (getF state)\" and\n  \"InvariantWatchListsUniq (getWatchList state)\" and\n  \"InvariantWatchListsCharacterization (getWatchList state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchesEl (getF state) (getWatch1 state) (getWatch2 state)\" and\n  \"InvariantWatchesDiffer (getF state) (getWatch1 state) (getWatch2 state)\"\n  \"InvariantWatchCharacterization (getF state) (getWatch1 state) (getWatch2 state) (getM state)\"\n  \"InvariantConflictFlagCharacterization (getConflictFlag state) (getF state) (getM state)\"\n  \"InvariantQCharacterization (getConflictFlag state) (getQ state) (getF state) (getM state)\"\n  \"InvariantUniqQ (getQ state)\"\nshows\n  \"let state' = exhaustiveUnitPropagate state in \n      InvariantEquivalentZL (getF state') (getM state') Phi\n  \"\nusing assms\nproof (induct state rule: exhaustiveUnitPropagate_dom.induct)\n  case (step state')\n  note ih = this\n  show ?case\n  proof (cases \"(getConflictFlag state') \\<or> (getQ state') = []\")\n    case True\n    with exhaustiveUnitPropagate.simps[of \"state'\"]\n    have \"exhaustiveUnitPropagate state' = state'\"\n      by simp\n    thus ?thesis\n      using ih\n      by (simp only: Let_def)\n  next\n    case False\n    let ?state'' = \"applyUnitPropagate state'\"\n\n    have \"exhaustiveUnitPropagate state' = exhaustiveUnitPropagate ?state''\"\n      using exhaustiveUnitPropagate.simps[of \"state'\"]\n      using False\n      by simp\n    moreover\n    have \"InvariantWatchListsContainOnlyClausesFromF (getWatchList ?state'') (getF ?state'')\" and\n      \"InvariantWatchListsUniq (getWatchList ?state'')\" and\n      \"InvariantWatchListsCharacterization (getWatchList ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      \"InvariantWatchesEl (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\" and\n      \"InvariantWatchesDiffer (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'')\"\n      using ih\n      using WatchInvariantsAfterAssertLiteral[of \"state'\" \"hd (getQ state')\" \"False\"]\n      unfolding applyUnitPropagate_def\n      by (auto simp add: Let_def)\n    moreover\n    have \"InvariantWatchCharacterization (getF ?state'') (getWatch1 ?state'') (getWatch2 ?state'') (getM ?state'')\"\n      using ih\n      using InvariantWatchCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      unfolding InvariantQCharacterization_def\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantQCharacterization (getConflictFlag ?state'') (getQ ?state'') (getF ?state'') (getM ?state'')\"\n      using ih\n      using InvariantQCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantConflictFlagCharacterization (getConflictFlag ?state'') (getF ?state'') (getM ?state'')\"\n      using ih\n      using InvariantConflictFlagCharacterizationAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantUniqQ (getQ ?state'')\"\n      using ih\n      using InvariantUniqQAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantConsistent (getM ?state'')\"\n      using ih\n      using InvariantConsistentAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantUniq (getM ?state'')\"\n      using ih\n      using InvariantUniqAfterApplyUnitPropagate[of \"state'\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"InvariantEquivalentZL (getF ?state'') (getM ?state'') Phi\"\n      using ih\n      using InvariantEquivalentZLAfterApplyUnitPropagate[of \"state'\" \"Phi\"]\n      using False\n      by (simp add: Let_def)\n    moreover\n    have \"currentLevel (getM state') = currentLevel (getM ?state'')\"\n      unfolding applyUnitPropagate_def\n      using assertLiteralEffect[of \"state'\" \"hd (getQ state')\" \"False\"]\n      using ih\n      unfolding currentLevel_def\n      by (simp add: Let_def markedElementsAppend)\n    ultimately\n    show ?thesis\n      using ih\n      using False\n      by (auto simp only: Let_def)\n  qed\nqed\n\nlemma conflictFlagOrQEmptyAfterExhaustiveUnitPropagate:\nassumes\n\"exhaustiveUnitPropagate_dom state\"\nshows\n\"let state' = exhaustiveUnitPropagate state in\n    (getConflictFlag state') \\<or> (getQ state' = [])\"\nusing assms\nproof (induct state rule: exhaustiveUnitPropagate_dom.induct)\n  case (step state')\n  note ih = this\n  show ?case\n  proof (cases \"(getConflictFlag state') \\<or> (getQ state') = []\")\n    case True\n    with exhaustiveUnitPropagate.simps[of \"state'\"]\n    have \"exhaustiveUnitPropagate state' = state'\"\n      by simp\n    thus ?thesis\n      using True\n      by (simp only: Let_def)\n  next\n    case False\n    let ?state'' = \"applyUnitPropagate state'\"\n\n    have \"exhaustiveUnitPropagate state' = exhaustiveUnitPropagate ?state''\"\n      using exhaustiveUnitPropagate.simps[of \"state'\"]\n      using False\n      by simp\n    thus ?thesis\n      using ih\n      using False\n      by (simp add: Let_def)\n  qed\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/SATSolverVerification/UnitPropagate.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3128234261417961}}
{"text": "theory HC_To_UHC_Poly\n  imports \"../TSTSC_Poly\" HC_To_UHC\nbegin\n\nsubsection\\<open>The reduction from \\<open>HC\\<close> to \\<open>UHC\\<close> is polynomial\\<close>\nsubsubsection\\<open>Definitions\\<close>\n\ndefinition \"size_uhc = (\\<lambda>G. card (verts G) + card (arcs G))\"\ndefinition \"size_hc = (\\<lambda>G. card (verts G))\"\ndefinition \"hc_to_uhc_space n  = 3 * n+ 9 * n * n + 2\"\n\ndefinition \"mop_check_wf_digraph Gr = SPECT [wf_digraph Gr \\<mapsto> 1]\"\ndefinition \"mop_check_finite Gr = SPECT [finite (verts Gr) \\<mapsto> 1]\"\ndefinition \"mop_check_functions Gr = SPECT [((tail Gr = fst \\<and> head Gr = snd) \\<or> arcs Gr = {}) \\<mapsto> 3]\"\n\ndefinition \"mop_verts_G Gr = SPECT [ {(v, (0::nat))|v. v \\<in> verts Gr} \\<union> {(v, 1)|v. v \\<in> verts Gr}\n  \\<union> {(v, 2)|v. v \\<in> verts Gr} \\<mapsto> 3 * (card (verts Gr))]\"\n\ndefinition \"mop_arcs_G Gr = SPECT [\n            {((v, 0), (v, 1))|v. v \\<in> verts Gr} \\<union>{((v, 1), (v, 0))|v. v \\<in> verts Gr}\\<union>\n          {((v, 1), (v, 2))|v. v \\<in> verts Gr}\\<union>{((v, 2), (v, 1))|v. v \\<in> verts Gr}\\<union>\n          {((v, 2), (u, 0))|v u e. e \\<in> arcs Gr \\<and> v = tail Gr e \\<and> u = head Gr e \\<and> u \\<noteq> v}\\<union>\n          {((u, 0), (v, 2))|v u e. e \\<in> arcs Gr \\<and> v = tail Gr e \\<and> u = head Gr e \\<and> u \\<noteq> v}\n    \\<mapsto> 3 * card (verts Gr) * 3 * (card (verts Gr))]\"\n\ndefinition \"hc_to_uhc_alg = (\\<lambda>G.\n  do {\n    bg \\<leftarrow> mop_check_wf_digraph G;\n    bfu  \\<leftarrow> mop_check_functions G;\n    bfi \\<leftarrow> mop_check_finite G;\n    cVG \\<leftarrow> mop_set_card (verts G);\n    if bg \\<and> bfu then\n      do {\n        if bfi then\n        do {\n          if cVG > 1 then\n          do {\n            V \\<leftarrow> mop_verts_G G;\n            E  \\<leftarrow> mop_arcs_G G;\n            RETURNT \\<lparr>verts = V, arcs = E, tail = fst, head = snd\\<rparr>\n          }\n          else RETURNT \\<lparr>verts = {}, arcs = {}, tail = fst, head = snd\\<rparr>\n        }\n        else RETURNT \\<lparr>verts = {(v, 0)|v. v \\<in> verts G}, arcs = {}, tail = fst, head = snd\\<rparr>\n      }\n    else RETURNT (let x = (SOME x. x \\<in> arcs G) in\n      \\<lparr>verts = {}, arcs = {((head G x, 0), (head G x, 1))}, tail = fst, head = snd\\<rparr>)\n  } )\"\n\ndefinition \"hc_to_uhc_time n = 6 + 3*n + 3 * n * 3 * n\"\n\n\nsubsubsection\\<open>Auxiliary proofs\\<close>\n\nlemma wf_digraph_card_arcs:\n  assumes \"wf_digraph Gr\" \"(tail Gr = fst \\<and> head Gr = snd) \\<or> arcs Gr = {}\"\n    \"finite (verts Gr)\"\n  shows \"card (arcs Gr) \\<le> card (verts Gr) * card (verts Gr)\"\nproof -\n  have \"arcs Gr \\<subseteq> (verts Gr)\\<times> (verts Gr)\"\n    using assms wf_digraph.head_in_verts wf_digraph.tail_in_verts by fastforce\n  then show ?thesis\n    using assms by (metis card_cartesian_product card_mono finite_cartesian_product_iff)\nqed\n\nlemma card_verts:\n  assumes \"finite (verts Gr)\"\n  shows \"card (verts (hc_to_uhc Gr)) \\<le> 3 * card (verts Gr)\"\nproof -\n  let ?S1 = \"{(v, 0::nat)|v. v \\<in> verts Gr}\" and ?S2 = \"{(v, 1::nat)|v. v \\<in> verts Gr}\"\n      and ?S3 = \"{(v, 2::nat)|v. v \\<in> verts Gr}\"\n  from assms have\n    \"card ?S1 \\<le> card (verts Gr)\" \"card ?S2 \\<le> card (verts Gr)\" \"card ?S3 \\<le> card (verts Gr)\"\n    by (auto intro: card_image_le simp: setcompr_eq_image)\n  then have \"card ?S1 + card ?S2 + card ?S3 \\<le> 3 * card (verts Gr)\" (is \"?lhs \\<le> _\")\n    by auto\n  also have \"card (?S1 \\<union> ?S2 \\<union> ?S3) \\<le> ?lhs\"\n    by (rule order.trans, rule card_Un_le) (intro order.refl add_mono card_Un_le)\n  ultimately show ?thesis\n    using \\<open>finite (verts Gr)\\<close> unfolding hc_to_uhc_def by (auto simp: Let_def)\nqed\n\nlemma card_arcs:\n  assumes \"finite (verts Gr)\" \"wf_digraph Gr\" \"(tail Gr = fst \\<and> head Gr = snd) \\<or> arcs Gr = {}\"\n  shows \"card(arcs (hc_to_uhc Gr)) \\<le> 9 * (card (verts Gr)) * (card (verts Gr))\"\nproof -\n  have \"finite (verts (hc_to_uhc Gr))\"\n    \"tail (hc_to_uhc Gr) = fst \\<and> head (hc_to_uhc Gr) = snd\"\n    \"wf_digraph (hc_to_uhc Gr)\"\n    using assms by (auto simp: hc_to_uhc_def wf_digraph_def)\n  then have 2: \"card (arcs (hc_to_uhc Gr))\n      \\<le> card (verts (hc_to_uhc Gr)) * card (verts (hc_to_uhc Gr))\"\n    using wf_digraph_card_arcs by blast\n  have \"card (verts (hc_to_uhc Gr)) \\<le> 3 * card (verts Gr)\"\n    using assms card_verts assms(1) by auto\n  then have \"card (arcs (hc_to_uhc Gr)) \\<le> 3 * card (verts Gr)* 3 * card (verts Gr)\"\n    using 2 by (smt le_trans mult.assoc mult_le_mono)\n  then show ?thesis\n    using assms wf_digraph_card_arcs card_verts by linarith\nqed\n\nlemma aux1:\n  assumes \"finite (verts Gr)\" \"wf_digraph Gr\" \"(tail Gr = fst \\<and> head Gr = snd) \\<or> arcs Gr = {}\"\n  shows \"card (verts (hc_to_uhc Gr))+ card(arcs (hc_to_uhc Gr))\n        \\<le> 3 * card (verts Gr) + 9 * card (verts Gr) * card (verts Gr)\" (is \"?A + ?B \\<le> ?C\")\nproof -\n  have 1: \"?A \\<le> 3 * card (verts Gr)\"\n    using card_verts assms not_wf_digraph_not_arcs_empty by auto\n  have \"?B \\<le> 9 * card (verts Gr) * card (verts Gr)\"\n    using card_arcs assms not_wf_digraph_not_arcs_empty by auto\n  then show ?thesis\n    using 1 by simp\nqed\n\n\nsubsubsection \\<open>Main proofs\\<close>\n\nlemma vcs_to_vcl_size: \"size_uhc (hc_to_uhc Gr) \\<le> hc_to_uhc_space (size_hc Gr)\"\nproof -\n  consider (inf) \"infinite (verts Gr)\"\n    | (not_wf) \"\\<not> wf_digraph Gr\"\n    | (not_wf2) \"\\<not> ((tail Gr = fst \\<and> head Gr = snd) \\<or> arcs Gr = {})\"\n    | (wf) \"finite (verts Gr)\" \"wf_digraph Gr\" \"(tail Gr = fst \\<and> head Gr = snd) \\<or> arcs Gr = {}\"\n    by auto\n  then show ?thesis\n  proof cases\n    case inf\n    have \"infinite {(v, 0 :: nat) |v. v \\<in> verts Gr}\"\n    proof (rule ccontr, simp)\n      assume \"finite {(v, 0) |v. v \\<in> verts Gr}\"\n      moreover have \"verts Gr = fst ` {(v, 0) |v. v \\<in> verts Gr}\"\n        by auto\n      ultimately show False\n        by (smt inf finite_imageI)\n    qed\n    then show ?thesis\n      by (auto simp: Let_def hc_to_uhc_def size_uhc_def hc_to_uhc_space_def)\n  next\n    case wf\n    then show ?thesis\n      using card_arcs card_verts\n      by (simp add: size_uhc_def hc_to_uhc_space_def HC_To_UHC_Poly.aux1 le_SucI size_hc_def)\n  qed (auto simp: Let_def hc_to_uhc_def size_uhc_def hc_to_uhc_space_def)\nqed\n\nlemma vcs_to_vcl_refines:\n  \"hc_to_uhc_alg Gr \\<le> SPEC (\\<lambda>y. y = (hc_to_uhc Gr)) (\\<lambda>_. hc_to_uhc_time (size_hc Gr))\"\n  unfolding SPEC_def\n  unfolding hc_to_uhc_alg_def hc_to_uhc_def\n    mop_check_ugraph_def  mop_check_wf_digraph_def mop_check_functions_def mop_check_finite_def\n    mop_arcs_G_def mop_verts_G_def mop_set_card_def\n  by (rule T_specifies_I, vcg' \\<open>-\\<close> rules: T_SPEC )\n     (auto simp: hc_to_uhc_time_def one_enat_def size_hc_def numeral_eq_enat)\n\ntheorem cnf_sat_to_clique_ispolyred: \"ispolyred hc_to_uhc_alg hc uhc size_hc size_uhc\"\n  unfolding ispolyred_def\n  apply(rule exI[where x=hc_to_uhc])\n  apply(rule exI[where x=hc_to_uhc_time])\n  apply(rule exI[where x=hc_to_uhc_space])\n  apply(safe)\n  subgoal using vcs_to_vcl_refines by blast\n  subgoal using vcs_to_vcl_size by blast\n  subgoal unfolding poly_def hc_to_uhc_time_def apply(rule exI[where x=2]) by auto\n  subgoal unfolding poly_def hc_to_uhc_space_def apply(rule exI[where x=2]) by auto\n  subgoal using is_reduction_hc_uhc .\n  done\n\nend", "meta": {"author": "wimmers", "repo": "poly-reductions", "sha": "b2d7c584bcda9913dd5c3785817a5d63b14d1455", "save_path": "github-repos/isabelle/wimmers-poly-reductions", "path": "github-repos/isabelle/wimmers-poly-reductions/poly-reductions-b2d7c584bcda9913dd5c3785817a5d63b14d1455/Karp21/HC_To_UHC/HC_To_UHC_Poly.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5312093733737562, "lm_q1q2_score": 0.312823426141796}}
{"text": "theory javacap_typing\nimports\n  Main\n  javacap_syntax\n  javacap_auxiliary\nbegin   \n\n(* \\<T> is a tuple of the type and label. This is convenient as they are often used together. *)\ntype_synonym \\<T> = \"\\<tau> \\<times> label\"\n\n(* local environment *)\ntype_synonym lenv = \"(var \\<rightharpoonup> \\<T>)\"\n\n(* synonym to provide additional meaning to capability sets passed around *)\ntype_synonym require_caps = \"iname set\" (* method requires clause *)\ntype_synonym parent_caps = \"iname set\" (* label of parent object *)\n\n(* Method environment. Used as part of the context in which to type-check statements.\n   The first component is the class name in which the method is declared.\n   The second component is the labelled return type of the method.\n   The third component is the requires clause of the method.\n   *)\nrecord msenv =\n  mscname :: \"cname\"\n  msreturn :: \"\\<T>\"\n  msreq :: \"require_caps\"\n\n(* \"(cname \\<times> (\\<T> \\<times> require_caps))\"\n\nabbreviation msreq :: \"msenv \\<Rightarrow> require_caps\"\n  where \"msreq \\<equiv> snd\"\n\nabbreviation msreturn :: \"msenv \\<Rightarrow> \\<T>\"\n  where \"msreturn \\<equiv> fst\"*)\n\ndefinition intersect_label :: \"\\<T> \\<Rightarrow> parent_caps \\<Rightarrow> \\<T>\"\n  where \"intersect_label \\<equiv> (\\<lambda>(t,\\<gamma>) \\<gamma>'. (t,\\<gamma> \\<inter> \\<gamma>'))\"\n\nlemma intersect_label_type:\n  shows \"ttype (intersect_label T \\<gamma>) = ttype T\"\n  unfolding intersect_label_def by (simp add: case_prod_beta') \n\nlemma intersect_label_label:\n  shows \"tlabel (intersect_label T \\<gamma>) = (tlabel T) \\<inter> \\<gamma>\"\n  unfolding intersect_label_def by (simp add: case_prod_beta') \n\nlemma intersect_label_vary:\n  assumes \"T' = intersect_label T \\<gamma>0\"\n  assumes \"\\<gamma> = (\\<gamma>0 \\<inter> \\<gamma>1)\"\n  shows \"(intersect_label T \\<gamma>) = (intersect_label T' \\<gamma>1)\"\n  using assms unfolding intersect_label_def by (simp add: case_prod_beta' inf_assoc) \n\nabbreviation var_type :: \"lenv \\<Rightarrow> var \\<Rightarrow> \\<T> option\" (\"_\\<lbrakk>_\\<rbrakk>\\<^sub>v\" 50)\n  where \"var_type \\<equiv> id\"\n\n(* Subtyping relation *)\ninductive subtype :: \"prog \\<Rightarrow> \\<tau> \\<Rightarrow> \\<tau> \\<Rightarrow> bool\" (\"_ \\<turnstile> _ <: _\")  (* \\<Gamma> \\<turnstile> t1 <: t2, i.e. t1 implements t2 *)\n  for P :: \"prog\"\n  where subtype_self:   \"P \\<turnstile> t <: t\" |\n        subtype_cextend: \"\\<lbrakk>t1 \\<noteq> Object; (class P t1) = Some c1; (cextends c1 = t2)\\<rbrakk> \\<Longrightarrow> P \\<turnstile> (ClassT t1) <: (ClassT t2)\" |\n        subtype_cimpl:   \"\\<lbrakk>(class P t1) = Some c1; (t2 \\<in> set (cimpl c1))\\<rbrakk> \\<Longrightarrow> P \\<turnstile> (ClassT t1) <: (IfaceT t2)\" |\n        subtype_iextend:  \"\\<lbrakk>(interface P t1) = Some i1; (t2 \\<in> set (iextends i1))\\<rbrakk> \\<Longrightarrow> P \\<turnstile> (IfaceT t1) <: (IfaceT t2)\" |\n        subtype_trans: \"\\<lbrakk>P \\<turnstile> t1 <: t2 ; P \\<turnstile> t2 <: t3\\<rbrakk> \\<Longrightarrow> P \\<turnstile> t1 <: t3\"\n\n(* Lemmas for subtyping relation *)\nlemma subtype_derived_class: (* Classes can only derive classes. *)\n  assumes ct1_extends_t0: \"(P \\<turnstile> ct1 <: (ClassT t0))\"\n  shows \"\\<exists>t1. ct1 = (ClassT t1)\"\nproof -\n  have \"(P \\<turnstile> ct1 <: (ClassT t0))\" using ct1_extends_t0 by simp\n  then show ?thesis proof (induction \"ct1\" \"(ClassT t0)\" arbitrary: t0)\n    case (subtype_self)\n    then show ?case by simp\n  next\n    case (subtype_cextend t1 c1 t2)\n    then show ?case by simp\n  next\n    case (subtype_trans t1 t2)\n    then show ?case by blast\n  qed\nqed\n\nlemma subtype_int_parity:\n  shows \"P \\<turnstile> t1 <: t0 \\<Longrightarrow> (t1 = ValT t) = (t0 = ValT t)\"\nproof (induction \"t1\" \"t0\" rule:subtype.induct)\n  case subtype_self\n  then show ?case by simp\nnext\n  case (subtype_cextend t1 c1 t2)\n  then show ?case by simp\nnext\n  case (subtype_cimpl t1 c1 t2)\n  then show ?case by simp\nnext\n  case subtype_iextend\n  then show ?case by simp\nnext\n  case (subtype_trans t1 t2 t3)\n  then show ?case by simp\nqed\n\n\nlemma subtype_exists:\n  shows \"P \\<turnstile> t1 <: t0 \\<Longrightarrow> is_type P t0 \\<Longrightarrow> is_type P t1\"\nproof (induction \"t1\" \"t0\"  rule:subtype.induct)\n  case subtype_self\n  then show ?case by auto\nnext\n  case (subtype_cextend t1 c1 t2)\n  then show ?case using is_class_def by simp\nnext\n  case (subtype_cimpl t1 c1 t2)\n  then show ?case using is_class_def by simp\nnext\n  case subtype_iextend\n  then show ?case using is_interface_def by simp\nnext\n  case (subtype_trans t1 t2 t3)\n  then show ?case using subtype_derived_class by blast\nqed\n\nlemma subclass_subtype:\n  shows \"(c,s)\\<in>(subclass P) \\<Longrightarrow> P \\<turnstile> (ClassT c) <: (ClassT s)\"\nproof (induction rule:rtrancl_induct)\n  case base\n  then show ?case using subtype_self by simp\nnext\n  case (step y z)\n  moreover have \"P \\<turnstile> (ClassT y) <: (ClassT z)\" \n    using step subtype_cextend unfolding direct_subclass_def by blast\n  ultimately show ?case using subtype_trans by metis\nqed\n\nend", "meta": {"author": "patrickmeiring", "repo": "JavaCap", "sha": "43ded44673c45d596b6a399ef24292416591520b", "save_path": "github-repos/isabelle/patrickmeiring-JavaCap", "path": "github-repos/isabelle/patrickmeiring-JavaCap/JavaCap-43ded44673c45d596b6a399ef24292416591520b/javacap_typing.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3128118503494749}}
{"text": "header {* \\isaheader{HRB Slicing guarantees IFC Noninterference} *}\n\ntheory NonInterferenceInter \n  imports \"../HRB-Slicing/StaticInter/FundamentalProperty\"\nbegin\n\nsection {* Assumptions of this Approach *}\n\ntext {*\nClassical IFC noninterference, a special case of a noninterference\ndefinition using partial equivalence relations (per)\n\\cite{SabelfeldS:01}, partitions the variables (i.e.\\ locations) into\nsecurity levels. Usually, only levels for secret or high, written\n@{text H}, and public or low, written @{text L}, variables are\nused. Basically, a program that is noninterferent has to fulfil one\nbasic property: executing the program in two different initial states\nthat may differ in the values of their @{text H}-variables yields two\nfinal states that again only differ in the values of their \n@{text H}-variables; thus the values of the @{text H}-variables did not\ninfluence those of the @{text L}-variables.\n\nEvery per-based approach makes certain\nassumptions: (i) all \\mbox{@{text H}-variables} are defined at the\nbeginning of the program, (ii) all @{text L}-variables are observed (or\nused in our terms) at the end and (iii) every variable is either\n@{text H} or @{text L}. This security label is fixed for a variable\nand can not be altered during a program run. Thus, we have to extend \nthe prerequisites of the slicing framework in \\cite{Wasserrab:09} accordingly\nin a new locale:\n\n*}\n\nlocale NonInterferenceInterGraph =\n  SDG sourcenode targetnode kind valid_edge Entry \n    get_proc get_return_edges procs Main Exit Def Use ParamDefs ParamUses \n  for sourcenode :: \"'edge \\<Rightarrow> 'node\" and targetnode :: \"'edge \\<Rightarrow> 'node\"\n  and kind :: \"'edge \\<Rightarrow> ('var,'val,'ret,'pname) edge_kind\" \n  and valid_edge :: \"'edge \\<Rightarrow> bool\"\n  and Entry :: \"'node\" (\"'('_Entry'_')\")  and get_proc :: \"'node \\<Rightarrow> 'pname\"\n  and get_return_edges :: \"'edge \\<Rightarrow> 'edge set\"\n  and procs :: \"('pname \\<times> 'var list \\<times> 'var list) list\" and Main :: \"'pname\"\n  and Exit::\"'node\"  (\"'('_Exit'_')\") \n  and Def :: \"'node \\<Rightarrow> 'var set\" and Use :: \"'node \\<Rightarrow> 'var set\"\n  and ParamDefs :: \"'node \\<Rightarrow> 'var list\" and ParamUses :: \"'node \\<Rightarrow> 'var set list\" +\n  fixes H :: \"'var set\"\n  fixes L :: \"'var set\"\n  fixes High :: \"'node\"  (\"'('_High'_')\")\n  fixes Low :: \"'node\"   (\"'('_Low'_')\")\n  assumes Entry_edge_Exit_or_High:\n  \"\\<lbrakk>valid_edge a; sourcenode a = (_Entry_)\\<rbrakk> \n    \\<Longrightarrow> targetnode a = (_Exit_) \\<or> targetnode a = (_High_)\"\n  and High_target_Entry_edge:\n  \"\\<exists>a. valid_edge a \\<and> sourcenode a = (_Entry_) \\<and> targetnode a = (_High_) \\<and>\n       kind a = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n  and Entry_predecessor_of_High:\n  \"\\<lbrakk>valid_edge a; targetnode a = (_High_)\\<rbrakk> \\<Longrightarrow> sourcenode a = (_Entry_)\"\n  and Exit_edge_Entry_or_Low: \"\\<lbrakk>valid_edge a; targetnode a = (_Exit_)\\<rbrakk> \n    \\<Longrightarrow> sourcenode a = (_Entry_) \\<or> sourcenode a = (_Low_)\"\n  and Low_source_Exit_edge:\n  \"\\<exists>a. valid_edge a \\<and> sourcenode a = (_Low_) \\<and> targetnode a = (_Exit_) \\<and> \n       kind a = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n  and Exit_successor_of_Low:\n  \"\\<lbrakk>valid_edge a; sourcenode a = (_Low_)\\<rbrakk> \\<Longrightarrow> targetnode a = (_Exit_)\"\n  and DefHigh: \"Def (_High_) = H\" \n  and UseHigh: \"Use (_High_) = H\"\n  and UseLow: \"Use (_Low_) = L\"\n  and HighLowDistinct: \"H \\<inter> L = {}\"\n  and HighLowUNIV: \"H \\<union> L = UNIV\"\n\nbegin\n\nlemma Low_neq_Exit: assumes \"L \\<noteq> {}\" shows \"(_Low_) \\<noteq> (_Exit_)\"\nproof\n  assume \"(_Low_) = (_Exit_)\"\n  have \"Use (_Exit_) = {}\" by fastforce\n  with UseLow `L \\<noteq> {}` `(_Low_) = (_Exit_)` show False by simp\nqed\n\n\nlemma valid_node_High [simp]:\"valid_node (_High_)\"\n  using High_target_Entry_edge by fastforce\n\nlemma valid_node_Low [simp]:\"valid_node (_Low_)\"\n  using Low_source_Exit_edge by fastforce\n\n\nlemma get_proc_Low:\n  \"get_proc (_Low_) = Main\"\nproof -\n  from Low_source_Exit_edge obtain a where \"valid_edge a\"\n    and \"sourcenode a = (_Low_)\" and \"targetnode a = (_Exit_)\"\n    and \"intra_kind (kind a)\" by(fastforce simp:intra_kind_def)\n  from `valid_edge a` `intra_kind (kind a)`\n  have \"get_proc (sourcenode a) = get_proc (targetnode a)\" by(rule get_proc_intra)\n  with `sourcenode a = (_Low_)` `targetnode a = (_Exit_)` get_proc_Exit\n  show ?thesis by simp\nqed\n\nlemma get_proc_High:\n  \"get_proc (_High_) = Main\"\nproof -\n  from High_target_Entry_edge obtain a where \"valid_edge a\"\n    and \"sourcenode a = (_Entry_)\" and \"targetnode a = (_High_)\"\n    and \"intra_kind (kind a)\" by(fastforce simp:intra_kind_def)\n  from `valid_edge a` `intra_kind (kind a)`\n  have \"get_proc (sourcenode a) = get_proc (targetnode a)\" by(rule get_proc_intra)\n  with `sourcenode a = (_Entry_)` `targetnode a = (_High_)` get_proc_Entry\n  show ?thesis by simp\nqed\n\n\n\nlemma Entry_path_High_path:\n  assumes \"(_Entry_) -as\\<rightarrow>* n\" and \"inner_node n\"\n  obtains a' as' where \"as = a'#as'\" and \"(_High_) -as'\\<rightarrow>* n\" \n  and \"kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>\"\nproof(atomize_elim)\n  from `(_Entry_) -as\\<rightarrow>* n` `inner_node n`\n  show \"\\<exists>a' as'. as = a'#as' \\<and> (_High_) -as'\\<rightarrow>* n \\<and> kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n  proof(induct n'\\<equiv>\"(_Entry_)\" as n rule:path.induct)\n    case (Cons_path n'' as n' a)\n    from `n'' -as\\<rightarrow>* n'` `inner_node n'` have \"n'' \\<noteq> (_Exit_)\" \n      by(fastforce simp:inner_node_def)\n    with `valid_edge a` `sourcenode a = (_Entry_)` `targetnode a = n''`\n    have \"n'' = (_High_)\" by -(drule Entry_edge_Exit_or_High,auto)\n    from High_target_Entry_edge\n    obtain a' where \"valid_edge a'\" and \"sourcenode a' = (_Entry_)\"\n      and \"targetnode a' = (_High_)\" and \"kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n      by blast\n    with `valid_edge a` `sourcenode a = (_Entry_)` `targetnode a = n''`\n      `n'' = (_High_)`\n    have \"a = a'\" by(auto dest:edge_det)\n    with `n'' -as\\<rightarrow>* n'` `n'' = (_High_)` `kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>` show ?case by blast\n  qed fastforce\nqed\n\n\nlemma Exit_path_Low_path:\n  assumes \"n -as\\<rightarrow>* (_Exit_)\" and \"inner_node n\"\n  obtains a' as' where \"as = as'@[a']\" and \"n -as'\\<rightarrow>* (_Low_)\"\n  and \"kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>\"\nproof(atomize_elim)\n  from `n -as\\<rightarrow>* (_Exit_)`\n  show \"\\<exists>as' a'. as = as'@[a'] \\<and> n -as'\\<rightarrow>* (_Low_) \\<and> kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n  proof(induct as rule:rev_induct)\n    case Nil\n    with `inner_node n` show ?case by fastforce\n  next\n    case (snoc a' as')\n    from `n -as'@[a']\\<rightarrow>* (_Exit_)`\n    have \"n -as'\\<rightarrow>* sourcenode a'\" and \"valid_edge a'\" and \"targetnode a' = (_Exit_)\"\n      by(auto elim:path_split_snoc)\n    { assume \"sourcenode a' = (_Entry_)\"\n      with `n -as'\\<rightarrow>* sourcenode a'` have \"n = (_Entry_)\"\n        by(blast intro!:path_Entry_target)\n      with `inner_node n` have False by(simp add:inner_node_def) }\n    with `valid_edge a'` `targetnode a' = (_Exit_)` have \"sourcenode a' = (_Low_)\"\n      by(blast dest!:Exit_edge_Entry_or_Low)\n    from Low_source_Exit_edge\n    obtain ax where \"valid_edge ax\" and \"sourcenode ax = (_Low_)\"\n      and \"targetnode ax = (_Exit_)\" and \"kind ax = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n      by blast\n    with `valid_edge a'` `targetnode a' = (_Exit_)` `sourcenode a' = (_Low_)`\n    have \"a' = ax\" by(fastforce intro:edge_det)\n    with `n -as'\\<rightarrow>* sourcenode a'` `sourcenode a' = (_Low_)` `kind ax = (\\<lambda>s. True)\\<^sub>\\<surd>`\n    show ?case by blast\n  qed\nqed\n\n\nlemma not_Low_High: \"V \\<notin> L \\<Longrightarrow> V \\<in> H\"\n  using HighLowUNIV\n  by fastforce\n\nlemma not_High_Low: \"V \\<notin> H \\<Longrightarrow> V \\<in> L\"\n  using HighLowUNIV\n  by fastforce\n\n\nsection {* Low Equivalence *}\n\ntext {*\nIn classical noninterference, an external observer can only see public values,\nin our case the @{text L}-variables. If two states agree in the values of all \n@{text L}-variables, these states are indistinguishable for him. \n\\emph{Low equivalence} groups those states in an equivalence class using \nthe relation @{text \"\\<approx>\\<^sub>L\"}:\n*}\n\ndefinition lowEquivalence :: \"('var \\<rightharpoonup> 'val) list \\<Rightarrow> ('var \\<rightharpoonup> 'val) list \\<Rightarrow> bool\" \n(infixl \"\\<approx>\\<^sub>L\" 50)\n  where \"s \\<approx>\\<^sub>L s' \\<equiv> \\<forall>V \\<in> L. hd s V = hd s' V\"\n\ntext {* The following lemmas connect low equivalent states with\nrelevant variables as necessary in the correctness proof for slicing. *}\n\nlemma relevant_vars_Entry:\n  assumes \"V \\<in> rv S (CFG_node (_Entry_))\" and \"(_High_) \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\"\n  shows \"V \\<in> L\"\nproof -\n  from `V \\<in> rv S (CFG_node (_Entry_))` obtain as n' \n    where \"(_Entry_) -as\\<rightarrow>\\<^sub>\\<iota>* parent_node n'\" \n    and \"n' \\<in> HRB_slice S\" and \"V \\<in> Use\\<^bsub>SDG\\<^esub> n'\"\n    and \"\\<forall>n''. valid_SDG_node n'' \\<and> parent_node n'' \\<in> set (sourcenodes as) \n          \\<longrightarrow> V \\<notin> Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce elim:rvE)\n  from `(_Entry_) -as\\<rightarrow>\\<^sub>\\<iota>* parent_node n'` have \"valid_node (parent_node n')\"\n    by(fastforce intro:path_valid_node simp:intra_path_def)\n  thus ?thesis\n  proof(cases \"parent_node n'\" rule:valid_node_cases)\n    case Entry\n    with `V \\<in> Use\\<^bsub>SDG\\<^esub> n'` have False\n      by -(drule SDG_Use_parent_Use,simp add:Entry_empty)\n    thus ?thesis by simp\n  next\n    case Exit\n    with `V \\<in> Use\\<^bsub>SDG\\<^esub> n'` have False\n      by -(drule SDG_Use_parent_Use,simp add:Exit_empty)\n    thus ?thesis by simp\n  next\n    case inner\n    with `(_Entry_) -as\\<rightarrow>\\<^sub>\\<iota>* parent_node n'` obtain a' as' where \"as = a'#as'\"\n      and \"(_High_) -as'\\<rightarrow>\\<^sub>\\<iota>* parent_node n'\"\n      by(fastforce elim:Entry_path_High_path simp:intra_path_def)\n    from `(_Entry_) -as\\<rightarrow>\\<^sub>\\<iota>* parent_node n'` `as = a'#as'`\n    have \"sourcenode a' = (_Entry_)\" by(fastforce elim:path.cases simp:intra_path_def)\n    show ?thesis\n    proof(cases \"as' = []\")\n      case True\n      with `(_High_) -as'\\<rightarrow>\\<^sub>\\<iota>* parent_node n'` have \"parent_node n' = (_High_)\"\n        by(fastforce simp:intra_path_def)\n      with `n' \\<in> HRB_slice S` `(_High_) \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>`\n      have False \n        by(fastforce dest:valid_SDG_node_in_slice_parent_node_in_slice \n                    simp:SDG_to_CFG_set_def)\n      thus ?thesis by simp\n    next\n      case False\n      with `(_High_) -as'\\<rightarrow>\\<^sub>\\<iota>* parent_node n'` have \"hd (sourcenodes as') = (_High_)\"\n        by(fastforce intro:path_sourcenode simp:intra_path_def)\n      from False have \"hd (sourcenodes as') \\<in> set (sourcenodes as')\"\n        by(fastforce intro:hd_in_set simp:sourcenodes_def)\n      with `as = a'#as'` have \"hd (sourcenodes as') \\<in> set (sourcenodes as)\"\n        by(simp add:sourcenodes_def)\n      from `hd (sourcenodes as') = (_High_)`\n      have \"valid_node (hd (sourcenodes as'))\" by simp\n      have \"valid_SDG_node (CFG_node (_High_))\" by simp\n      with `hd (sourcenodes as') = (_High_)`\n        `hd (sourcenodes as') \\<in> set (sourcenodes as)`\n        `\\<forall>n''. valid_SDG_node n'' \\<and> parent_node n'' \\<in> set (sourcenodes as) \n        \\<longrightarrow> V \\<notin> Def\\<^bsub>SDG\\<^esub> n''`\n      have \"V \\<notin> Def (_High_)\"\n        by(fastforce dest:CFG_Def_SDG_Def[OF `valid_node (hd (sourcenodes as'))`])\n      hence \"V \\<notin> H\" by(simp add:DefHigh)\n      thus ?thesis by(rule not_High_Low)\n    qed\n  qed\nqed\n\n\n\nlemma lowEquivalence_relevant_nodes_Entry:\n  assumes \"s \\<approx>\\<^sub>L s'\" and \"(_High_) \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\"\n  shows \"\\<forall>V \\<in> rv S (CFG_node (_Entry_)). hd s V = hd s' V\"\nproof\n  fix V assume \"V \\<in> rv S (CFG_node (_Entry_))\"\n  with `(_High_) \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>` have \"V \\<in> L\" by -(rule relevant_vars_Entry)\n  with `s \\<approx>\\<^sub>L s'` show \"hd s V = hd s' V\" by(simp add:lowEquivalence_def)\nqed\n\n\nsection {* The Correctness Proofs *}\n\ntext {*\nIn the following, we present two correctness proofs that slicing\nguarantees IFC noninterference. In both theorems, @{text \"CFG_node\n(_High_) \\<notin> HRB_slice S\"}, where @{text \"CFG_node (_Low_) \\<in> S\"}, makes\nsure that no high variable (which are all defined in @{text \"(_High_)\"})\ncan influence a low variable (which are all used in @{text \"(_Low_)\"}).\n\n\nFirst, a theorem regarding @{text \"(_Entry_) -as\\<rightarrow>* (_Exit_)\"} paths in the \ncontrol flow graph (CFG), which agree to a complete program execution: *}\n\n\nlemma slpa_rv_Low_Use_Low:\n  assumes \"CFG_node (_Low_) \\<in> S\"\n  shows \"\\<lbrakk>same_level_path_aux cs as; upd_cs cs as = []; same_level_path_aux cs as';\n    \\<forall>c \\<in> set cs. valid_edge c; m -as\\<rightarrow>* (_Low_); m -as'\\<rightarrow>* (_Low_);\n   \\<forall>i < length cs. \\<forall>V \\<in> rv S (CFG_node (sourcenode (cs!i))). \n    fst (s!Suc i) V = fst (s'!Suc i) V; \\<forall>i < Suc (length cs). snd (s!i) = snd (s'!i);\n   \\<forall>V \\<in> rv S (CFG_node m). state_val s V = state_val s' V;\n   preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n   length s = Suc (length cs); length s' = Suc (length cs)\\<rbrakk>\n   \\<Longrightarrow> \\<forall>V \\<in> Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n                      state_val (transfers(slice_kinds S as') s') V\"\nproof(induct arbitrary:m as' s s' rule:slpa_induct)\n  case (slpa_empty cs)\n  from `m -[]\\<rightarrow>* (_Low_)` have \"m = (_Low_)\" by fastforce\n  from `m -[]\\<rightarrow>* (_Low_)` have \"valid_node m\"\n    by(rule path_valid_node)+\n  { fix V assume \"V \\<in> Use (_Low_)\"\n    moreover\n    from `valid_node m` `m = (_Low_)` have \"(_Low_) -[]\\<rightarrow>\\<^sub>\\<iota>* (_Low_)\"\n      by(fastforce intro:empty_path simp:intra_path_def)\n    moreover\n    from `valid_node m` `m = (_Low_)` `CFG_node (_Low_) \\<in> S`\n    have \"CFG_node (_Low_) \\<in> HRB_slice S\"\n      by(fastforce intro:HRB_slice_refl)\n    ultimately have \"V \\<in> rv S (CFG_node m)\" \n      using `m = (_Low_)`\n      by(auto intro!:rvI CFG_Use_SDG_Use simp:sourcenodes_def) }\n  hence \"\\<forall>V \\<in> Use (_Low_). V \\<in> rv S (CFG_node m)\" by simp\n  show ?case\n  proof(cases \"L = {}\")\n    case True with UseLow show ?thesis by simp\n  next\n    case False\n    from `m -as'\\<rightarrow>* (_Low_)` `m = (_Low_)` have \"as' = []\"\n    proof(induct m as' m'\\<equiv>\"(_Low_)\" rule:path.induct)\n      case (Cons_path m'' as a m)\n      from `valid_edge a` `sourcenode a = m` `m = (_Low_)`\n      have \"targetnode a = (_Exit_)\" by -(rule Exit_successor_of_Low,simp+)\n      with `targetnode a = m''` `m'' -as\\<rightarrow>* (_Low_)`\n      have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n      with False have False by -(drule Low_neq_Exit,simp)\n      thus ?case by simp\n    qed simp\n    with `\\<forall>V \\<in> Use (_Low_). V \\<in> rv S (CFG_node m)`\n      `\\<forall>V \\<in> rv S (CFG_node m). state_val s V = state_val s' V` Nil\n    show ?thesis by(auto simp:slice_kinds_def)\n  qed\nnext\n  case (slpa_intra cs a as)\n  note IH = `\\<And>m as' s s'. \\<lbrakk>upd_cs cs as = []; same_level_path_aux cs as'; \n    \\<forall>a\\<in>set cs. valid_edge a; m -as\\<rightarrow>* (_Low_); m -as'\\<rightarrow>* (_Low_);\n    \\<forall>i<length cs. \\<forall>V\\<in>rv S (CFG_node (sourcenode (cs ! i))).\n    fst (s ! Suc i) V = fst (s' ! Suc i) V; \n    \\<forall>i<Suc (length cs). snd (s ! i) = snd (s' ! i);\n    \\<forall>V\\<in>rv S (CFG_node m). state_val s V = state_val s' V;\n    preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n    length s = Suc (length cs); length s' = Suc (length cs)\\<rbrakk>\n    \\<Longrightarrow> \\<forall>V\\<in>Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n    state_val (transfers(slice_kinds S as') s') V`\n  note rvs = `\\<forall>i<length cs. \\<forall>V\\<in>rv S (CFG_node (sourcenode (cs ! i))).\n    fst (s ! Suc i) V = fst (s' ! Suc i) V`\n  from `m -a # as\\<rightarrow>* (_Low_)` have \"sourcenode a = m\" and \"valid_edge a\"\n    and \"targetnode a -as\\<rightarrow>* (_Low_)\" by(auto elim:path_split_Cons)\n  show ?case\n  proof(cases \"L = {}\")\n    case True with UseLow show ?thesis by simp\n  next\n    case False\n    show ?thesis\n    proof(cases as')\n      case Nil\n      with `m -as'\\<rightarrow>* (_Low_)` have \"m = (_Low_)\" by fastforce\n      with `valid_edge a` `sourcenode a = m` have \"targetnode a = (_Exit_)\"\n        by -(rule Exit_successor_of_Low,simp+)\n      from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n        and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n        and \"kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>\" by blast\n      from `valid_edge a` `sourcenode a = m` `m = (_Low_)` \n        `targetnode a = (_Exit_)` `valid_edge a'` `sourcenode a' = (_Low_)` \n        `targetnode a' = (_Exit_)`\n      have \"a = a'\" by(fastforce dest:edge_det)\n      with `kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>` have \"kind a = (\\<lambda>s. True)\\<^sub>\\<surd>\" by simp\n      with `targetnode a = (_Exit_)` `targetnode a -as\\<rightarrow>* (_Low_)`\n      have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n      with False have False by -(drule Low_neq_Exit,simp)\n      thus ?thesis by simp\n    next\n      case (Cons ax asx)\n      with `m -as'\\<rightarrow>* (_Low_)` have \"sourcenode ax = m\" and \"valid_edge ax\"\n        and \"targetnode ax -asx\\<rightarrow>* (_Low_)\" by(auto elim:path_split_Cons)\n      from `preds (slice_kinds S (a # as)) s`\n      obtain cf cfs where [simp]:\"s = cf#cfs\" by(cases s)(auto simp:slice_kinds_def)\n      from `preds (slice_kinds S as') s'` `as' = ax # asx` \n      obtain cf' cfs' where [simp]:\"s' = cf'#cfs'\"\n        by(cases s')(auto simp:slice_kinds_def)\n      have \"intra_kind (kind ax)\"\n      proof(cases \"kind ax\" rule:edge_kind_cases)\n        case (Call Q r p fs)\n        have False\n        proof(cases \"sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\")\n          case True\n          with `intra_kind (kind a)` have \"slice_kind S a = kind a\"\n            by -(rule slice_intra_kind_in_slice)\n          from `valid_edge ax` `kind ax = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs`\n          have unique:\"\\<exists>!a'. valid_edge a' \\<and> sourcenode a' = sourcenode ax \\<and> \n            intra_kind(kind a')\" by(rule call_only_one_intra_edge)\n          from `valid_edge ax` `kind ax = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs` obtain x \n            where \"x \\<in> get_return_edges ax\" by(fastforce dest:get_return_edge_call)\n          with `valid_edge ax` obtain a' where \"valid_edge a'\" \n            and \"sourcenode a' = sourcenode ax\" and \"kind a' = (\\<lambda>cf. False)\\<^sub>\\<surd>\"\n            by(fastforce dest:call_return_node_edge)\n          with `valid_edge a` `sourcenode a = m` `sourcenode ax = m`\n            `intra_kind (kind a)` unique\n          have \"a' = a\" by(fastforce simp:intra_kind_def)\n          with `kind a' = (\\<lambda>cf. False)\\<^sub>\\<surd>` `slice_kind S a = kind a`\n            `preds (slice_kinds S (a#as)) s`\n          have False by(cases s)(auto simp:slice_kinds_def)\n          thus ?thesis by simp\n        next\n          case False\n          with `kind ax = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs` `sourcenode a = m` `sourcenode ax = m`\n          have \"slice_kind S ax = (\\<lambda>cf. False):r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs\"\n            by(fastforce intro:slice_kind_Call)\n          with `as' = ax # asx` `preds (slice_kinds S as') s'`\n          have False by(cases s')(auto simp:slice_kinds_def)\n          thus ?thesis by simp\n        qed\n        thus ?thesis by simp\n      next\n        case (Return Q p f)\n        from `valid_edge ax` `kind ax = Q\\<hookleftarrow>\\<^bsub>p\\<^esub>f` `valid_edge a` `intra_kind (kind a)`\n          `sourcenode a = m` `sourcenode ax = m`\n        have False by -(drule return_edges_only,auto simp:intra_kind_def)\n        thus ?thesis by simp\n      qed simp\n      with `same_level_path_aux cs as'` `as' = ax#asx`\n      have \"same_level_path_aux cs asx\" by(fastforce simp:intra_kind_def)\n      show ?thesis\n      proof(cases \"targetnode a = targetnode ax\")\n        case True\n        with `valid_edge a` `valid_edge ax` `sourcenode a = m` `sourcenode ax = m`\n        have \"a = ax\" by(fastforce intro:edge_det)\n        with `valid_edge a` `intra_kind (kind a)` `sourcenode a = m`\n          `\\<forall>V\\<in>rv S (CFG_node m). state_val s V = state_val s' V`\n          `preds (slice_kinds S (a # as)) s`\n          `preds (slice_kinds S as') s'` `as' = ax # asx`\n        have rv:\"\\<forall>V\\<in>rv S (CFG_node (targetnode a)). \n          state_val (transfer (slice_kind S a) s) V =\n          state_val (transfer (slice_kind S a) s') V\"\n          by -(rule rv_edge_slice_kinds,auto)\n        from `upd_cs cs (a # as) = []` `intra_kind (kind a)`\n        have \"upd_cs cs as = []\" by(fastforce simp:intra_kind_def)\n        from `targetnode ax -asx\\<rightarrow>* (_Low_)` `a = ax`\n        have \"targetnode a -asx\\<rightarrow>* (_Low_)\" by simp\n        from `valid_edge a` `intra_kind (kind a)`\n        obtain cfx \n          where cfx:\"transfer (slice_kind S a) s = cfx#cfs \\<and> snd cfx = snd cf\"\n          apply(cases cf)\n          apply(cases \"sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\") apply auto\n          apply(fastforce dest:slice_intra_kind_in_slice simp:intra_kind_def)\n          apply(auto simp:intra_kind_def)\n          apply(drule slice_kind_Upd) apply auto \n          by(erule kind_Predicate_notin_slice_slice_kind_Predicate) auto\n        from `valid_edge a` `intra_kind (kind a)`\n        obtain cfx' \n          where cfx':\"transfer (slice_kind S a) s' = cfx'#cfs' \\<and> snd cfx' = snd cf'\"\n          apply(cases cf')\n          apply(cases \"sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\") apply auto\n          apply(fastforce dest:slice_intra_kind_in_slice simp:intra_kind_def)\n          apply(auto simp:intra_kind_def)\n          apply(drule slice_kind_Upd) apply auto \n          by(erule kind_Predicate_notin_slice_slice_kind_Predicate) auto\n        with cfx `\\<forall>i < Suc (length cs). snd (s!i) = snd (s'!i)`\n        have snds:\"\\<forall>i<Suc(length cs).\n          snd (transfer (slice_kind S a) s ! i) = \n          snd (transfer (slice_kind S a) s' ! i)\" \n          by auto(case_tac i,auto)\n        from rvs cfx cfx' have rvs':\"\\<forall>i<length cs.\n          \\<forall>V\\<in>rv S (CFG_node (sourcenode (cs ! i))).\n          fst (transfer (slice_kind S a) s ! Suc i) V =\n          fst (transfer (slice_kind S a) s' ! Suc i) V\"\n          by fastforce\n        from `preds (slice_kinds S (a # as)) s`\n        have \"preds (slice_kinds S as) \n          (transfer (slice_kind S a) s)\" by(simp add:slice_kinds_def)\n        moreover\n        from `preds (slice_kinds S as') s'` `as' = ax # asx` `a = ax`\n        have \"preds (slice_kinds S asx) (transfer (slice_kind S a) s')\" \n          by(simp add:slice_kinds_def)\n        moreover\n        from `valid_edge a` `intra_kind (kind a)`\n        have \"length (transfer (slice_kind S a) s) = length s\"\n          by(cases \"sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\")\n        (auto dest:slice_intra_kind_in_slice slice_kind_Upd\n          elim:kind_Predicate_notin_slice_slice_kind_Predicate simp:intra_kind_def)\n        with `length s = Suc (length cs)`\n        have \"length (transfer (slice_kind S a) s) = Suc (length cs)\"\n          by simp\n        moreover\n        from `a = ax` `valid_edge a` `intra_kind (kind a)`\n        have \"length (transfer (slice_kind S a) s') = length s'\"\n          by(cases \"sourcenode ax \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\")\n        (auto dest:slice_intra_kind_in_slice slice_kind_Upd\n          elim:kind_Predicate_notin_slice_slice_kind_Predicate simp:intra_kind_def)\n        with `length s' = Suc (length cs)`\n        have \"length (transfer (slice_kind S a) s') = Suc (length cs)\"\n          by simp\n        moreover\n        from IH[OF `upd_cs cs as = []` `same_level_path_aux cs asx` \n          `\\<forall>c\\<in>set cs. valid_edge c` `targetnode a -as\\<rightarrow>* (_Low_)` \n          `targetnode a -asx\\<rightarrow>* (_Low_)` rvs' snds rv calculation]\n          `as' = ax # asx` `a = ax`\n        show ?thesis by(simp add:slice_kinds_def)\n      next\n        case False\n        from `\\<forall>i < Suc(length cs). snd (s!i) = snd (s'!i)`\n        have \"snd (hd s) = snd (hd s')\" by(erule_tac x=\"0\" in allE) fastforce\n        with `valid_edge a` `valid_edge ax` `sourcenode a = m`\n          `sourcenode ax = m` `as' = ax # asx` False\n          `intra_kind (kind a)` `intra_kind (kind ax)`\n          `preds (slice_kinds S (a # as)) s`\n          `preds (slice_kinds S as') s'`\n          `\\<forall>V\\<in>rv S (CFG_node m). state_val s V = state_val s' V`\n          `length s = Suc (length cs)` `length s' = Suc (length cs)`\n        have False by(fastforce intro!:rv_branching_edges_slice_kinds_False[of a ax])\n        thus ?thesis by simp\n      qed\n    qed\n  qed\nnext\n  case (slpa_Call cs a as Q r p fs)\n  note IH = `\\<And>m as' s s'. \n    \\<lbrakk>upd_cs (a # cs) as = []; same_level_path_aux (a # cs) as';\n    \\<forall>c\\<in>set (a # cs). valid_edge c; m -as\\<rightarrow>* (_Low_); m -as'\\<rightarrow>* (_Low_);\n    \\<forall>i<length (a # cs). \\<forall>V\\<in>rv S (CFG_node (sourcenode ((a # cs) ! i))).\n    fst (s ! Suc i) V = fst (s' ! Suc i) V;\n    \\<forall>i<Suc (length (a # cs)). snd (s ! i) = snd (s' ! i);\n    \\<forall>V\\<in>rv S (CFG_node m). state_val s V = state_val s' V;\n    preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n    length s = Suc (length (a # cs)); length s' = Suc (length (a # cs))\\<rbrakk>\n    \\<Longrightarrow> \\<forall>V\\<in>Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n    state_val (transfers(slice_kinds S as') s') V`\n  note rvs = `\\<forall>i<length cs. \\<forall>V\\<in>rv S (CFG_node (sourcenode (cs ! i))).\n    fst (s ! Suc i) V = fst (s' ! Suc i) V`\n  from `m -a # as\\<rightarrow>* (_Low_)` have \"sourcenode a = m\" and \"valid_edge a\"\n    and \"targetnode a -as\\<rightarrow>* (_Low_)\" by(auto elim:path_split_Cons)\n  from `\\<forall>c\\<in>set cs. valid_edge c` `valid_edge a`\n  have \"\\<forall>c\\<in>set (a # cs). valid_edge c\" by simp\n  show ?case\n   proof(cases \"L = {}\")\n    case True with UseLow show ?thesis by simp\n  next\n    case False\n    show ?thesis\n    proof(cases as')\n      case Nil\n      with `m -as'\\<rightarrow>* (_Low_)` have \"m = (_Low_)\" by fastforce\n      with `valid_edge a` `sourcenode a = m` have \"targetnode a = (_Exit_)\"\n        by -(rule Exit_successor_of_Low,simp+)\n      from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n        and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n        and \"kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>\" by blast\n      from `valid_edge a` `sourcenode a = m` `m = (_Low_)` \n        `targetnode a = (_Exit_)` `valid_edge a'` `sourcenode a' = (_Low_)` \n        `targetnode a' = (_Exit_)`\n      have \"a = a'\" by(fastforce dest:edge_det)\n      with `kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>` have \"kind a = (\\<lambda>s. True)\\<^sub>\\<surd>\" by simp\n      with `targetnode a = (_Exit_)` `targetnode a -as\\<rightarrow>* (_Low_)`\n      have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n      with False have False by -(drule Low_neq_Exit,simp)\n      thus ?thesis by simp\n    next\n      case (Cons ax asx)\n      with `m -as'\\<rightarrow>* (_Low_)` have \"sourcenode ax = m\" and \"valid_edge ax\"\n        and \"targetnode ax -asx\\<rightarrow>* (_Low_)\" by(auto elim:path_split_Cons)\n      from `preds (slice_kinds S (a # as)) s`\n      obtain cf cfs where [simp]:\"s = cf#cfs\" by(cases s)(auto simp:slice_kinds_def)\n      from `preds (slice_kinds S as') s'` `as' = ax # asx` \n      obtain cf' cfs' where [simp]:\"s' = cf'#cfs'\"\n        by(cases s')(auto simp:slice_kinds_def)\n      have \"\\<exists>Q r p fs. kind ax = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs\"\n      proof(cases \"kind ax\" rule:edge_kind_cases)\n        case Intra\n        have False\n        proof(cases \"sourcenode ax \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\")\n          case True\n          with `intra_kind (kind ax)` \n          have \"slice_kind S ax = kind ax\"\n            by -(rule slice_intra_kind_in_slice)\n          from `valid_edge a` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs`\n          have unique:\"\\<exists>!a'. valid_edge a' \\<and> sourcenode a' = sourcenode a \\<and> \n            intra_kind(kind a')\" by(rule call_only_one_intra_edge)\n          from `valid_edge a` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs` obtain x \n            where \"x \\<in> get_return_edges a\" by(fastforce dest:get_return_edge_call)\n          with `valid_edge a` obtain a' where \"valid_edge a'\" \n            and \"sourcenode a' = sourcenode a\" and \"kind a' = (\\<lambda>cf. False)\\<^sub>\\<surd>\"\n            by(fastforce dest:call_return_node_edge)\n          with `valid_edge ax` `sourcenode ax = m` `sourcenode a = m`\n            `intra_kind (kind ax)` unique\n          have \"a' = ax\" by(fastforce simp:intra_kind_def)\n          with `kind a' = (\\<lambda>cf. False)\\<^sub>\\<surd>` \n            `slice_kind S ax = kind ax` `as' = ax # asx`\n            `preds (slice_kinds S as') s'`\n          have False by(simp add:slice_kinds_def)\n          thus ?thesis by simp\n        next\n          case False\n          with `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs` `sourcenode ax = m` `sourcenode a = m`\n          have \"slice_kind S a = (\\<lambda>cf. False):r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs\"\n            by(fastforce intro:slice_kind_Call)\n          with `preds (slice_kinds S (a # as)) s`\n          have False by(simp add:slice_kinds_def)\n          thus ?thesis by simp\n        qed\n        thus ?thesis by simp\n      next\n        case (Return Q' p' f')\n        from `valid_edge ax` `kind ax = Q'\\<hookleftarrow>\\<^bsub>p'\\<^esub>f'` `valid_edge a` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs`\n          `sourcenode a = m` `sourcenode ax = m`\n        have False by -(drule return_edges_only,auto)\n        thus ?thesis by simp\n      qed simp\n      have \"sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\"\n      proof(rule ccontr)\n        assume \"sourcenode a \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\"\n        from this `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs`\n        have \"slice_kind S a = (\\<lambda>cf. False):r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs\"\n          by(rule slice_kind_Call)\n        with `preds (slice_kinds S (a # as)) s`\n        show False by(simp add:slice_kinds_def)\n      qed\n      with `preds (slice_kinds S (a # as)) s` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs`\n      have \"pred (kind a) s\" \n        by(fastforce dest:slice_kind_Call_in_slice simp:slice_kinds_def)\n      from `sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>`\n        `sourcenode a = m` `sourcenode ax = m`\n      have \"sourcenode ax \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\" by simp\n      with `as' = ax # asx` `preds (slice_kinds S as') s'` \n        `\\<exists>Q r p fs. kind ax = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs`\n      have \"pred (kind ax) s'\"\n        by(fastforce dest:slice_kind_Call_in_slice simp:slice_kinds_def)\n      { fix V assume \"V \\<in> Use (sourcenode a)\"\n        from `valid_edge a` have \"sourcenode a -[]\\<rightarrow>\\<^sub>\\<iota>* sourcenode a\"\n          by(fastforce intro:empty_path simp:intra_path_def)\n        with `sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>`\n          `valid_edge a` `V \\<in> Use (sourcenode a)`\n        have \"V \\<in> rv S (CFG_node (sourcenode a))\"\n          by(auto intro!:rvI CFG_Use_SDG_Use simp:SDG_to_CFG_set_def sourcenodes_def) }\n      with `\\<forall>V\\<in>rv S (CFG_node m). state_val s V = state_val s' V`\n        `sourcenode a = m`\n      have Use:\"\\<forall>V \\<in> Use (sourcenode a). state_val s V = state_val s' V\" by simp\n      from `\\<forall>i<Suc (length cs). snd (s ! i) = snd (s' ! i)`\n      have \"snd (hd s) = snd (hd s')\"  by fastforce\n      with `valid_edge a` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs` `valid_edge ax`\n        `\\<exists>Q r p fs. kind ax = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs` `sourcenode a = m` `sourcenode ax = m`\n        `pred (kind a) s` `pred (kind ax) s'` Use `length s = Suc (length cs)`\n        `length s' = Suc (length cs)`\n      have [simp]:\"ax = a\" by(fastforce intro!:CFG_equal_Use_equal_call)\n      from `same_level_path_aux cs as'` `as' = ax#asx` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs`\n        `\\<exists>Q r p fs. kind ax = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs`\n      have \"same_level_path_aux (a # cs) asx\" by simp\n      from `targetnode ax -asx\\<rightarrow>* (_Low_)` have \"targetnode a -asx\\<rightarrow>* (_Low_)\" by simp\n      from `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs` `upd_cs cs (a # as) = []` \n      have \"upd_cs (a # cs) as = []\" by simp\n      from `sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs`\n      have slice_kind:\"slice_kind S a = \n        Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>(cspp (targetnode a) (HRB_slice S) fs)\"\n        by(rule slice_kind_Call_in_slice)\n      from `\\<forall>i<Suc (length cs). snd (s ! i) = snd (s' ! i)` slice_kind\n      have snds:\"\\<forall>i<Suc (length (a # cs)).\n        snd (transfer (slice_kind S a) s ! i) =\n        snd (transfer (slice_kind S a) s' ! i)\"\n        by auto(case_tac i,auto)\n      from `valid_edge a` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs` obtain ins outs \n        where \"(p,ins,outs) \\<in> set procs\" by(fastforce dest!:callee_in_procs)\n      with `valid_edge a` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs`\n      have \"length (ParamUses (sourcenode a)) = length ins\"\n        by(fastforce intro:ParamUses_call_source_length)\n      with `valid_edge a`\n      have \"\\<forall>i < length ins. \\<forall>V \\<in> (ParamUses (sourcenode a))!i. V \\<in> Use (sourcenode a)\"\n        by(fastforce intro:ParamUses_in_Use)\n      with `\\<forall>V \\<in> Use (sourcenode a). state_val s V = state_val s' V`\n      have \"\\<forall>i < length ins. \\<forall>V \\<in> (ParamUses (sourcenode a))!i. \n        state_val s V = state_val s' V\"\n        by fastforce\n      with `valid_edge a` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs` `(p,ins,outs) \\<in> set procs`\n        `pred (kind a) s` `pred (kind ax) s'`\n      have \"\\<forall>i < length ins. (params fs (fst (hd s)))!i = (params fs (fst (hd s')))!i\"\n        by(fastforce intro!:CFG_call_edge_params)\n      from `valid_edge a` `kind a = Q:r\\<hookrightarrow>\\<^bsub>p\\<^esub>fs` `(p,ins,outs) \\<in> set procs`\n      have \"length fs = length ins\" by(rule CFG_call_edge_length)\n      { fix i assume \"i < length fs\"\n        with `length fs = length ins` have \"i < length ins\" by simp\n        from `i < length fs` have \"(params fs (fst cf))!i = (fs!i) (fst cf)\"\n          by(rule params_nth)\n        moreover\n        from `i < length fs` have \"(params fs (fst cf'))!i = (fs!i) (fst cf')\"\n          by(rule params_nth)\n        ultimately have \"(fs!i) (fst (hd s)) = (fs!i) (fst (hd s'))\"\n          using `i < length ins`\n            `\\<forall>i < length ins. (params fs (fst (hd s)))!i = (params fs (fst (hd s')))!i`\n          by simp }\n      hence \"\\<forall>i < length fs. (fs ! i) (fst cf) = (fs ! i) (fst cf')\" by simp\n      { fix i assume \"i < length fs\"\n        with `\\<forall>i < length fs. (fs ! i) (fst cf) = (fs ! i) (fst cf')`\n        have \"(fs ! i) (fst cf) = (fs ! i) (fst cf')\" by simp\n        have \"((csppa (targetnode a) (HRB_slice S) 0 fs)!i)(fst cf) =\n          ((csppa (targetnode a) (HRB_slice S) 0 fs)!i)(fst cf')\"\n        proof(cases \"Formal_in(targetnode a,i + 0) \\<in>  HRB_slice S\")\n          case True\n          with `i < length fs` \n          have \"(csppa (targetnode a) (HRB_slice S) 0 fs)!i = fs!i\"\n            by(rule csppa_Formal_in_in_slice)\n          with `(fs ! i) (fst cf) = (fs ! i) (fst cf')` show ?thesis by simp\n        next\n          case False\n          with `i < length fs` \n          have \"(csppa (targetnode a) (HRB_slice S) 0 fs)!i = empty\"\n            by(rule csppa_Formal_in_notin_slice)\n          thus ?thesis by simp\n        qed }\n      hence eq:\"\\<forall>i < length fs.\n        ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf) =\n        ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf')\"\n        by(simp add:cspp_def)\n      { fix i assume \"i < length fs\"\n        hence \"(params (cspp (targetnode a) (HRB_slice S) fs)\n          (fst cf))!i =\n          ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf)\"\n          by(fastforce intro:params_nth)\n        moreover\n        from `i < length fs`\n        have \"(params (cspp (targetnode a) (HRB_slice S) fs)\n          (fst cf'))!i =\n          ((cspp (targetnode a) (HRB_slice S) fs)!i)(fst cf')\"\n          by(fastforce intro:params_nth)\n        ultimately \n        have \"(params (cspp (targetnode a) (HRB_slice S) fs)\n          (fst cf))!i =\n          (params (cspp (targetnode a) (HRB_slice S) fs)(fst cf'))!i\"\n          using eq `i < length fs` by simp }\n      hence \"params (cspp (targetnode a) (HRB_slice S) fs)(fst cf) =\n        params (cspp (targetnode a) (HRB_slice S) fs)(fst cf')\"\n        by(simp add:list_eq_iff_nth_eq)\n      with slice_kind `(p,ins,outs) \\<in> set procs`\n      obtain cfx where [simp]:\n        \"transfer (slice_kind S a) (cf#cfs) = cfx#cf#cfs\"\n        \"transfer (slice_kind S a) (cf'#cfs') = cfx#cf'#cfs'\"\n        by auto\n      hence rv:\"\\<forall>V\\<in>rv S (CFG_node (targetnode a)).\n        state_val (transfer (slice_kind S a) s) V = \n        state_val (transfer (slice_kind S a) s') V\" by simp\n      from rvs `\\<forall>V\\<in>rv S (CFG_node m). state_val s V = state_val s' V` \n        `sourcenode a = m`\n      have rvs':\"\\<forall>i<length (a # cs). \n        \\<forall>V\\<in>rv S (CFG_node (sourcenode ((a # cs) ! i))).\n        fst ((transfer (slice_kind S a) s) ! Suc i) V = \n        fst ((transfer (slice_kind S a) s') ! Suc i) V\"\n        by auto(case_tac i,auto)\n      from `preds (slice_kinds S (a # as)) s`\n      have \"preds (slice_kinds S as)\n        (transfer (slice_kind S a) s)\" by(simp add:slice_kinds_def)\n      moreover\n      from `preds (slice_kinds S as') s'` `as' = ax#asx`\n      have \"preds (slice_kinds S asx)\n        (transfer (slice_kind S a) s')\" by(simp add:slice_kinds_def)\n      moreover\n      from `length s = Suc (length cs)`\n      have \"length (transfer (slice_kind S a) s) = \n        Suc (length (a # cs))\" by simp\n      moreover\n      from `length s' = Suc (length cs)`\n      have \"length (transfer (slice_kind S a) s') = \n        Suc (length (a # cs))\" by simp\n      moreover\n      from IH[OF `upd_cs (a # cs) as = []` `same_level_path_aux (a # cs) asx`\n        `\\<forall>c\\<in>set (a # cs). valid_edge c` `targetnode a -as\\<rightarrow>* (_Low_)`\n        `targetnode a -asx\\<rightarrow>* (_Low_)` rvs' snds rv calculation] `as' = ax#asx`\n      show ?thesis by(simp add:slice_kinds_def)\n    qed\n  qed\nnext\n  case (slpa_Return cs a as Q p f c' cs')\n  note IH = `\\<And>m as' s s'. \\<lbrakk>upd_cs cs' as = []; same_level_path_aux cs' as'; \n    \\<forall>c\\<in>set cs'. valid_edge c; m -as\\<rightarrow>* (_Low_); m -as'\\<rightarrow>* (_Low_);\n    \\<forall>i<length cs'. \\<forall>V\\<in>rv S (CFG_node (sourcenode (cs' ! i))).\n    fst (s ! Suc i) V = fst (s' ! Suc i) V; \n    \\<forall>i<Suc (length cs'). snd (s ! i) = snd (s' ! i);\n    \\<forall>V\\<in>rv S (CFG_node m). state_val s V = state_val s' V;\n    preds (slice_kinds S as) s; preds (slice_kinds S as') s';\n    length s = Suc (length cs'); length s' = Suc (length cs')\\<rbrakk>\n    \\<Longrightarrow> \\<forall>V\\<in>Use (_Low_). state_val (transfers(slice_kinds S as) s) V =\n                       state_val (transfers(slice_kinds S as') s') V`\n  note rvs = ` \\<forall>i<length cs. \\<forall>V\\<in>rv S (CFG_node (sourcenode (cs ! i))).\n    fst (s ! Suc i) V = fst (s' ! Suc i) V`\n  from `m -a # as\\<rightarrow>* (_Low_)` have \"sourcenode a = m\" and \"valid_edge a\"\n    and \"targetnode a -as\\<rightarrow>* (_Low_)\" by(auto elim:path_split_Cons)\n  from `\\<forall>c\\<in>set cs. valid_edge c` `cs = c' # cs'`\n  have \"valid_edge c'\" and \"\\<forall>c\\<in>set cs'. valid_edge c\" by simp_all\n  show ?case\n  proof(cases \"L = {}\")\n    case True with UseLow show ?thesis by simp\n  next\n    case False\n    show ?thesis\n    proof(cases as')\n      case Nil\n      with `m -as'\\<rightarrow>* (_Low_)` have \"m = (_Low_)\" by fastforce\n      with `valid_edge a` `sourcenode a = m` have \"targetnode a = (_Exit_)\"\n        by -(rule Exit_successor_of_Low,simp+)\n      from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n        and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n        and \"kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>\" by blast\n      from `valid_edge a` `sourcenode a = m` `m = (_Low_)` \n        `targetnode a = (_Exit_)` `valid_edge a'` `sourcenode a' = (_Low_)` \n        `targetnode a' = (_Exit_)`\n      have \"a = a'\" by(fastforce dest:edge_det)\n      with `kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>` have \"kind a = (\\<lambda>s. True)\\<^sub>\\<surd>\" by simp\n      with `targetnode a = (_Exit_)` `targetnode a -as\\<rightarrow>* (_Low_)`\n      have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n      with False have False by -(drule Low_neq_Exit,simp)\n      thus ?thesis by simp\n    next\n      case (Cons ax asx)\n      with `m -as'\\<rightarrow>* (_Low_)` have \"sourcenode ax = m\" and \"valid_edge ax\"\n        and \"targetnode ax -asx\\<rightarrow>* (_Low_)\" by(auto elim:path_split_Cons)\n      from `valid_edge a` `valid_edge ax` `kind a = Q\\<hookleftarrow>\\<^bsub>p\\<^esub>f`\n        `sourcenode a = m` `sourcenode ax = m`\n      have \"\\<exists>Q f. kind ax = Q\\<hookleftarrow>\\<^bsub>p\\<^esub>f\" by(auto dest:return_edges_only)\n      with `same_level_path_aux cs as'` `as' = ax#asx` `cs = c' # cs'`\n      have \"ax \\<in> get_return_edges c'\" and \"same_level_path_aux cs' asx\" by auto\n      from `valid_edge c'` `ax \\<in> get_return_edges c'` `a \\<in> get_return_edges c'`\n      have [simp]:\"ax = a\" by(rule get_return_edges_unique)\n      from `targetnode ax -asx\\<rightarrow>* (_Low_)` have \"targetnode a -asx\\<rightarrow>* (_Low_)\" by simp\n      from `upd_cs cs (a # as) = []` `kind a = Q\\<hookleftarrow>\\<^bsub>p\\<^esub>f` `cs = c' # cs'`\n        `a \\<in> get_return_edges c'`\n      have \"upd_cs cs' as = []\" by simp\n      from `length s = Suc (length cs)` `cs = c' # cs'`\n      obtain cf cfx cfs where \"s = cf#cfx#cfs\"\n        by(cases s,auto,case_tac list,fastforce+)\n      from `length s' = Suc (length cs)` `cs = c' # cs'`\n      obtain cf' cfx' cfs' where \"s' = cf'#cfx'#cfs'\"\n        by(cases s',auto,case_tac list,fastforce+)\n      from rvs `cs = c' # cs'` `s = cf#cfx#cfs` `s' = cf'#cfx'#cfs'`\n      have rvs1:\"\\<forall>i<length cs'. \n        \\<forall>V\\<in>rv S (CFG_node (sourcenode (cs' ! i))).\n        fst ((cfx#cfs) ! Suc i) V = fst ((cfx'#cfs') ! Suc i) V\"\n        and \"\\<forall>V\\<in>rv S (CFG_node (sourcenode c')). \n        (fst cfx) V = (fst cfx') V\"\n        by auto\n      from `valid_edge c'` `a \\<in> get_return_edges c'`\n      obtain Qx rx px fsx where \"kind c' = Qx:rx\\<hookrightarrow>\\<^bsub>px\\<^esub>fsx\"\n        by(fastforce dest!:only_call_get_return_edges)\n      have \"\\<forall>V \\<in> rv S (CFG_node (targetnode a)).\n        V \\<in> rv S (CFG_node (sourcenode c'))\"\n      proof\n        fix V assume \"V \\<in> rv S (CFG_node (targetnode a))\"\n        from `valid_edge c'` `a \\<in> get_return_edges c'`\n        obtain a' where edge:\"valid_edge a'\" \"sourcenode a' = sourcenode c'\"\n          \"targetnode a' = targetnode a\" \"intra_kind (kind a')\"\n          by -(drule call_return_node_edge,auto simp:intra_kind_def)\n        from `V \\<in> rv S (CFG_node (targetnode a))`\n        obtain as n' where \"targetnode a -as\\<rightarrow>\\<^sub>\\<iota>* parent_node n'\"\n          and \"n' \\<in> HRB_slice S\" and \"V \\<in> Use\\<^bsub>SDG\\<^esub> n'\"\n          and all:\"\\<forall>n''. valid_SDG_node n'' \\<and> parent_node n'' \\<in> set (sourcenodes as) \n          \\<longrightarrow> V \\<notin> Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce elim:rvE)\n        from `targetnode a -as\\<rightarrow>\\<^sub>\\<iota>* parent_node n'` edge\n        have \"sourcenode c' -a'#as\\<rightarrow>\\<^sub>\\<iota>* parent_node n'\"\n          by(fastforce intro:Cons_path simp:intra_path_def)\n        from `valid_edge c'` `kind c' = Qx:rx\\<hookrightarrow>\\<^bsub>px\\<^esub>fsx` have \"Def (sourcenode c') = {}\"\n          by(rule call_source_Def_empty)\n        hence \"\\<forall>n''. valid_SDG_node n'' \\<and> parent_node n'' = sourcenode c'\n          \\<longrightarrow> V \\<notin> Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce dest:SDG_Def_parent_Def)\n        with all `sourcenode a' = sourcenode c'`\n        have \"\\<forall>n''. valid_SDG_node n'' \\<and> parent_node n'' \\<in> set (sourcenodes (a'#as)) \n          \\<longrightarrow> V \\<notin> Def\\<^bsub>SDG\\<^esub> n''\" by(fastforce simp:sourcenodes_def)\n        with `sourcenode c' -a'#as\\<rightarrow>\\<^sub>\\<iota>* parent_node n'` \n          `n' \\<in> HRB_slice S` `V \\<in> Use\\<^bsub>SDG\\<^esub> n'`\n        show \"V \\<in> rv S (CFG_node (sourcenode c'))\"\n          by(fastforce intro:rvI)\n      qed\n      show ?thesis\n      proof(cases \"sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\")\n        case True\n        from `valid_edge c'` `a \\<in> get_return_edges c'`\n        have \"get_proc (targetnode c') = get_proc (sourcenode a)\"\n          by -(drule intra_proc_additional_edge,\n            auto dest:get_proc_intra simp:intra_kind_def)\n        moreover\n        from `valid_edge c'` `kind c' = Qx:rx\\<hookrightarrow>\\<^bsub>px\\<^esub>fsx`\n        have \"get_proc (targetnode c') = px\" by(rule get_proc_call)\n        moreover\n        from `valid_edge a` `kind a = Q\\<hookleftarrow>\\<^bsub>p\\<^esub>f`\n        have \"get_proc (sourcenode a) = p\" by(rule get_proc_return)\n        ultimately have [simp]:\"px = p\" by simp\n        from `valid_edge c'` `kind c' = Qx:rx\\<hookrightarrow>\\<^bsub>px\\<^esub>fsx`\n        obtain ins outs where \"(p,ins,outs) \\<in> set procs\"\n          by(fastforce dest!:callee_in_procs)\n        with `sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>`\n          `valid_edge a` `kind a = Q\\<hookleftarrow>\\<^bsub>p\\<^esub>f`\n        have slice_kind:\"slice_kind S a = \n          Q\\<hookleftarrow>\\<^bsub>p\\<^esub>(\\<lambda>cf cf'. rspp (targetnode a) (HRB_slice S) outs cf' cf)\"\n          by(rule slice_kind_Return_in_slice)\n        with `s = cf#cfx#cfs` `s' = cf'#cfx'#cfs'`\n        have sx:\"transfer (slice_kind S a) s = \n          (rspp (targetnode a) (HRB_slice S) outs (fst cfx) (fst cf),\n          snd cfx)#cfs\"\n          and sx':\"transfer (slice_kind S a) s' = \n          (rspp (targetnode a) (HRB_slice S) outs (fst cfx') (fst cf'),\n          snd cfx')#cfs'\"\n          by simp_all\n        with rvs1 have rvs':\"\\<forall>i<length cs'. \n          \\<forall>V\\<in>rv S (CFG_node (sourcenode (cs' ! i))).\n          fst ((transfer (slice_kind S a) s) ! Suc i) V = \n          fst ((transfer (slice_kind S a) s') ! Suc i) V\"\n          by fastforce\n        from slice_kind `\\<forall>i<Suc (length cs). snd (s ! i) = snd (s' ! i)` `cs = c' # cs'`\n          `s = cf#cfx#cfs` `s' = cf'#cfx'#cfs'`\n        have snds:\"\\<forall>i<Suc (length cs').\n          snd (transfer (slice_kind S a) s ! i) =\n          snd (transfer (slice_kind S a) s' ! i)\"\n          apply auto apply(case_tac i) apply auto\n          by(erule_tac x=\"Suc (Suc nat)\" in allE) auto\n        have \"\\<forall>V\\<in>rv S (CFG_node (targetnode a)).\n          (rspp (targetnode a) (HRB_slice S) outs \n          (fst cfx) (fst cf)) V =\n          (rspp (targetnode a) (HRB_slice S) outs \n          (fst cfx') (fst cf')) V\"\n        proof\n          fix V assume \"V \\<in> rv S (CFG_node (targetnode a))\"\n          show \"(rspp (targetnode a) (HRB_slice S) outs \n            (fst cfx) (fst cf)) V =\n            (rspp (targetnode a) (HRB_slice S) outs \n            (fst cfx') (fst cf')) V\"\n          proof(cases \"V \\<in> set (ParamDefs (targetnode a))\")\n            case True\n            then obtain i where \"i < length (ParamDefs (targetnode a))\"\n              and \"(ParamDefs (targetnode a))!i = V\"\n              by(fastforce simp:in_set_conv_nth)\n            from `valid_edge a` `kind a = Q\\<hookleftarrow>\\<^bsub>p\\<^esub>f` `(p,ins,outs) \\<in> set procs`\n            have \"length(ParamDefs (targetnode a)) = length outs\"\n              by(fastforce intro:ParamDefs_return_target_length)\n            show ?thesis\n            proof(cases \"Actual_out(targetnode a,i) \\<in> HRB_slice S\")\n              case True\n              with `i < length (ParamDefs (targetnode a))` `valid_edge a`\n                `length(ParamDefs (targetnode a)) = length outs`\n                `(ParamDefs (targetnode a))!i = V`[THEN sym]\n              have rspp_eq:\"(rspp (targetnode a) \n                (HRB_slice S) outs (fst cfx) (fst cf)) V = \n                (fst cf)(outs!i)\"\n                \"(rspp (targetnode a) \n                (HRB_slice S) outs (fst cfx') (fst cf')) V = \n                (fst cf')(outs!i)\"\n                by(auto intro:rspp_Actual_out_in_slice)\n              from `valid_edge a` `kind a = Q\\<hookleftarrow>\\<^bsub>p\\<^esub>f` `(p,ins,outs) \\<in> set procs`\n              have \"\\<forall>V \\<in> set outs. V \\<in> Use (sourcenode a)\" by(fastforce dest:outs_in_Use)\n              have \"\\<forall>V \\<in> Use (sourcenode a). V \\<in> rv S (CFG_node m)\"\n              proof\n                fix V assume \"V \\<in> Use (sourcenode a)\"\n                from `valid_edge a` `sourcenode a = m`\n                have \"parent_node (CFG_node m) -[]\\<rightarrow>\\<^sub>\\<iota>* parent_node (CFG_node m)\"\n                  by(fastforce intro:empty_path simp:intra_path_def)\n                with `sourcenode a \\<in> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>` \n                  `V \\<in> Use (sourcenode a)` `sourcenode a = m` `valid_edge a`\n                show \"V \\<in> rv S (CFG_node m)\"\n                  by -(rule rvI,\n                    auto intro!:CFG_Use_SDG_Use simp:SDG_to_CFG_set_def sourcenodes_def)\n              qed\n              with `\\<forall>V \\<in> set outs. V \\<in> Use (sourcenode a)`\n              have \"\\<forall>V \\<in> set outs. V \\<in> rv S (CFG_node m)\" by simp\n              with `\\<forall>V\\<in>rv S (CFG_node m). state_val s V = state_val s' V`\n                `s = cf#cfx#cfs` `s' = cf'#cfx'#cfs'`\n              have \"\\<forall>V \\<in> set outs. (fst cf) V = (fst cf') V\" by simp\n              with `i < length (ParamDefs (targetnode a))`\n                `length(ParamDefs (targetnode a)) = length outs`\n              have \"(fst cf)(outs!i) = (fst cf')(outs!i)\" by fastforce\n              with rspp_eq show ?thesis by simp\n            next\n              case False\n              with `i < length (ParamDefs (targetnode a))` `valid_edge a`\n                `length(ParamDefs (targetnode a)) = length outs`\n                `(ParamDefs (targetnode a))!i = V`[THEN sym]\n              have rspp_eq:\"(rspp (targetnode a) \n                (HRB_slice S) outs (fst cfx) (fst cf)) V = \n                (fst cfx)((ParamDefs (targetnode a))!i)\"\n                \"(rspp (targetnode a) \n                (HRB_slice S) outs (fst cfx') (fst cf')) V = \n                (fst cfx')((ParamDefs (targetnode a))!i)\"\n                by(auto intro:rspp_Actual_out_notin_slice)\n              from `\\<forall>V\\<in>rv S (CFG_node (sourcenode c')). \n                (fst cfx) V = (fst cfx') V`\n                `V \\<in> rv S (CFG_node (targetnode a))`\n                `\\<forall>V \\<in> rv S (CFG_node (targetnode a)).\n                V \\<in> rv S (CFG_node (sourcenode c'))`\n                `(ParamDefs (targetnode a))!i = V`[THEN sym]\n              have \"(fst cfx) (ParamDefs (targetnode a) ! i) =\n                (fst cfx') (ParamDefs (targetnode a) ! i)\" by fastforce\n              with rspp_eq show ?thesis by fastforce\n            qed\n          next\n            case False\n            with `\\<forall>V\\<in>rv S (CFG_node (sourcenode c')). \n              (fst cfx) V = (fst cfx') V`\n              `V \\<in> rv S (CFG_node (targetnode a))`\n              `\\<forall>V \\<in> rv S (CFG_node (targetnode a)).\n              V \\<in> rv S (CFG_node (sourcenode c'))`\n            show ?thesis by(fastforce simp:rspp_def map_merge_def)\n          qed\n        qed\n        with sx sx'\n        have rv':\"\\<forall>V\\<in>rv S (CFG_node (targetnode a)).\n          state_val (transfer (slice_kind S a) s) V =\n          state_val (transfer (slice_kind S a) s') V\"\n          by fastforce\n        from `preds (slice_kinds S (a # as)) s`\n        have \"preds (slice_kinds S as) \n          (transfer (slice_kind S a) s)\"\n          by(simp add:slice_kinds_def)\n        moreover\n        from `preds (slice_kinds S as') s'` `as' = ax#asx`\n        have \"preds (slice_kinds S asx) \n          (transfer (slice_kind S a) s')\"\n          by(simp add:slice_kinds_def)\n        moreover\n        from `length s = Suc (length cs)` `cs = c' # cs'` sx\n        have \"length (transfer (slice_kind S a) s) = Suc (length cs')\"\n          by(simp,simp add:`s = cf#cfx#cfs`)\n        moreover\n        from `length s' = Suc (length cs)` `cs = c' # cs'` sx'\n        have \"length (transfer (slice_kind S a) s') = Suc (length cs')\"\n          by(simp,simp add:`s' = cf'#cfx'#cfs'`)\n        moreover\n        from IH[OF `upd_cs cs' as = []` `same_level_path_aux cs' asx` \n          `\\<forall>c\\<in>set cs'. valid_edge c` `targetnode a -as\\<rightarrow>* (_Low_)` \n          `targetnode a -asx\\<rightarrow>* (_Low_)` rvs' snds rv' calculation] `as' = ax#asx`\n        show ?thesis by(simp add:slice_kinds_def)\n      next\n        case False\n        from this `kind a = Q\\<hookleftarrow>\\<^bsub>p\\<^esub>f`\n        have slice_kind:\"slice_kind S a = (\\<lambda>cf. True)\\<hookleftarrow>\\<^bsub>p\\<^esub>(\\<lambda>cf cf'. cf')\"\n          by(rule slice_kind_Return)\n        with `s = cf#cfx#cfs` `s' = cf'#cfx'#cfs'`\n        have [simp]:\"transfer (slice_kind S a) s = cfx#cfs\"\n          \"transfer (slice_kind S a) s' = cfx'#cfs'\" by simp_all\n        from slice_kind `\\<forall>i<Suc (length cs). snd (s ! i) = snd (s' ! i)` \n          `cs = c' # cs'` `s = cf#cfx#cfs` `s' = cf'#cfx'#cfs'`\n        have snds:\"\\<forall>i<Suc (length cs').\n          snd (transfer (slice_kind S a) s ! i) =\n          snd (transfer (slice_kind S a) s' ! i)\" by fastforce\n        from rvs1 have rvs':\"\\<forall>i<length cs'. \n          \\<forall>V\\<in>rv S (CFG_node (sourcenode (cs' ! i))).\n          fst ((transfer (slice_kind S a) s) ! Suc i) V = \n          fst ((transfer (slice_kind S a) s') ! Suc i) V\"\n          by fastforce\n        from `\\<forall>V \\<in> rv S (CFG_node (targetnode a)).\n          V \\<in> rv S (CFG_node (sourcenode c'))`\n          `\\<forall>V\\<in>rv S (CFG_node (sourcenode c')). \n          (fst cfx) V = (fst cfx') V`\n        have rv':\"\\<forall>V\\<in>rv S (CFG_node (targetnode a)).\n          state_val (transfer (slice_kind S a) s) V =\n          state_val (transfer (slice_kind S a) s') V\" by simp\n        from `preds (slice_kinds S (a # as)) s`\n        have \"preds (slice_kinds S as) \n          (transfer (slice_kind S a) s)\"\n          by(simp add:slice_kinds_def)\n        moreover\n        from `preds (slice_kinds S as') s'` `as' = ax#asx`\n        have \"preds (slice_kinds S asx) \n          (transfer (slice_kind S a) s')\"\n          by(simp add:slice_kinds_def)\n        moreover\n        from `length s = Suc (length cs)` `cs = c' # cs'`\n        have \"length (transfer (slice_kind S a) s) = Suc (length cs')\"\n          by(simp,simp add:`s = cf#cfx#cfs`)\n        moreover\n        from `length s' = Suc (length cs)` `cs = c' # cs'`\n        have \"length (transfer (slice_kind S a) s') = Suc (length cs')\"\n          by(simp,simp add:`s' = cf'#cfx'#cfs'`)\n        moreover\n        from IH[OF `upd_cs cs' as = []` `same_level_path_aux cs' asx` \n          `\\<forall>c\\<in>set cs'. valid_edge c` `targetnode a -as\\<rightarrow>* (_Low_)` \n          `targetnode a -asx\\<rightarrow>* (_Low_)` rvs' snds rv' calculation] `as' = ax#asx`\n        show ?thesis by(simp add:slice_kinds_def)\n      qed\n    qed\n  qed\nqed\n\n\nlemma rv_Low_Use_Low:\n  assumes \"m -as\\<rightarrow>\\<^sub>\\<surd>* (_Low_)\" and \"m -as'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)\" and \"get_proc m = Main\"\n  and \"\\<forall>V \\<in> rv S (CFG_node m). cf V = cf' V\"\n  and \"preds (slice_kinds S as) [(cf,undefined)]\"\n  and \"preds (slice_kinds S as') [(cf',undefined)]\"\n  and \"CFG_node (_Low_) \\<in> S\"\n  shows \"\\<forall>V \\<in> Use (_Low_). \n    state_val (transfers(slice_kinds S as) [(cf,undefined)]) V =\n    state_val (transfers(slice_kinds S as') [(cf',undefined)]) V\"\nproof(cases as)\n  case Nil\n  with `m -as\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` have \"valid_node m\" and \"m = (_Low_)\" \n    by(auto intro:path_valid_node simp:vp_def)\n  { fix V assume \"V \\<in> Use (_Low_)\"\n    moreover\n    from `valid_node m` `m = (_Low_)` have \"(_Low_) -[]\\<rightarrow>\\<^sub>\\<iota>* (_Low_)\"\n      by(fastforce intro:empty_path simp:intra_path_def)\n    moreover\n    from `valid_node m` `m = (_Low_)` `CFG_node (_Low_) \\<in> S`\n    have \"CFG_node (_Low_) \\<in> HRB_slice S\"\n      by(fastforce intro:HRB_slice_refl)\n    ultimately have \"V \\<in> rv S (CFG_node m)\" using `m = (_Low_)`\n      by(auto intro!:rvI CFG_Use_SDG_Use simp:sourcenodes_def) }\n  hence \"\\<forall>V \\<in> Use (_Low_). V \\<in> rv S (CFG_node m)\" by simp\n  show ?thesis\n  proof(cases \"L = {}\")\n    case True with UseLow show ?thesis by simp\n  next\n    case False\n    from `m -as'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` have \"m -as'\\<rightarrow>* (_Low_)\" by(simp add:vp_def)\n    from `m -as'\\<rightarrow>* (_Low_)` `m = (_Low_)` have \"as' = []\"\n    proof(induct m as' m'\\<equiv>\"(_Low_)\" rule:path.induct)\n      case (Cons_path m'' as a m)\n      from `valid_edge a` `sourcenode a = m` `m = (_Low_)`\n      have \"targetnode a = (_Exit_)\" by -(rule Exit_successor_of_Low,simp+)\n      with `targetnode a = m''` `m'' -as\\<rightarrow>* (_Low_)`\n      have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n      with False have False by -(drule Low_neq_Exit,simp)\n      thus ?case by simp\n    qed simp\n    with Nil `\\<forall>V \\<in> rv S (CFG_node m). cf V = cf' V`\n      `\\<forall>V \\<in> Use (_Low_). V \\<in> rv S (CFG_node m)`\n    show ?thesis by(fastforce simp:slice_kinds_def)\n  qed\nnext\n  case (Cons ax asx)\n  with `m -as\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` have \"sourcenode ax = m\" and \"valid_edge ax\"\n    and \"targetnode ax -asx\\<rightarrow>* (_Low_)\"\n    by(auto elim:path_split_Cons simp:vp_def)\n  show ?thesis\n  proof(cases \"L = {}\")\n    case True with UseLow show ?thesis by simp\n  next\n    case False\n    show ?thesis\n    proof(cases as')\n      case Nil\n      with `m -as'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` have \"m = (_Low_)\" by(fastforce simp:vp_def)\n      with `valid_edge ax` `sourcenode ax = m` have \"targetnode ax = (_Exit_)\"\n        by -(rule Exit_successor_of_Low,simp+)\n      from Low_source_Exit_edge obtain a' where \"valid_edge a'\"\n        and \"sourcenode a' = (_Low_)\" and \"targetnode a' = (_Exit_)\"\n        and \"kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>\" by blast\n      from `valid_edge ax` `sourcenode ax = m` `m = (_Low_)` \n        `targetnode ax = (_Exit_)` `valid_edge a'` `sourcenode a' = (_Low_)` \n        `targetnode a' = (_Exit_)`\n      have \"ax = a'\" by(fastforce dest:edge_det)\n      with `kind a' = (\\<lambda>s. True)\\<^sub>\\<surd>` have \"kind ax = (\\<lambda>s. True)\\<^sub>\\<surd>\" by simp\n      with `targetnode ax = (_Exit_)` `targetnode ax -asx\\<rightarrow>* (_Low_)`\n      have \"(_Low_) = (_Exit_)\" by -(drule path_Exit_source,auto)\n      with False have False by -(drule Low_neq_Exit,simp)\n      thus ?thesis by simp\n    next\n      case (Cons ax' asx')\n      from `m -as\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` have \"valid_path_aux [] as\" and \"m -as\\<rightarrow>* (_Low_)\"\n        by(simp_all add:vp_def valid_path_def)\n      from this `as = ax#asx` `get_proc m = Main`\n      have \"same_level_path_aux [] as \\<and> upd_cs [] as = []\"\n        by -(rule vpa_Main_slpa[of _ _ m \"(_Low_)\"],\n        (fastforce intro!:get_proc_Low simp:valid_call_list_def)+)\n      hence \"same_level_path_aux [] as\" and \"upd_cs [] as = []\" by simp_all\n      from `m -as'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` have \"valid_path_aux [] as'\" and \"m -as'\\<rightarrow>* (_Low_)\"\n        by(simp_all add:vp_def valid_path_def)\n      from this `as' = ax'#asx'` `get_proc m = Main`\n      have \"same_level_path_aux [] as' \\<and> upd_cs [] as' = []\"\n        by -(rule vpa_Main_slpa[of _ _ m \"(_Low_)\"],\n        (fastforce intro!:get_proc_Low simp:valid_call_list_def)+)\n      hence \"same_level_path_aux [] as'\" by simp\n      from `same_level_path_aux [] as` `upd_cs [] as = []`\n        `same_level_path_aux [] as'` `m -as\\<rightarrow>* (_Low_)` `m -as'\\<rightarrow>* (_Low_)`\n        `\\<forall>V \\<in> rv S (CFG_node m). cf V = cf' V` `CFG_node (_Low_) \\<in> S`\n        `preds (slice_kinds S as) [(cf,undefined)]`\n        `preds (slice_kinds S as') [(cf',undefined)]`\n      show ?thesis by -(erule slpa_rv_Low_Use_Low,auto)\n    qed\n  qed\nqed\n\n\n\nlemma nonInterference_path_to_Low:\n  assumes \"[cf] \\<approx>\\<^sub>L [cf']\" and \"(_High_) \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\"\n  and \"CFG_node (_Low_) \\<in> S\"\n  and \"(_Entry_) -as\\<rightarrow>\\<^sub>\\<surd>* (_Low_)\" and \"preds (kinds as) [(cf,undefined)]\"\n  and \"(_Entry_) -as'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)\" and \"preds (kinds as') [(cf',undefined)]\"\n  shows \"map fst (transfers (kinds as) [(cf,undefined)]) \\<approx>\\<^sub>L \n         map fst (transfers (kinds as') [(cf',undefined)])\"\nproof -\n  from `(_Entry_) -as\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` `preds (kinds as) [(cf,undefined)]`\n    `CFG_node (_Low_) \\<in> S`\n  obtain asx where \"preds (slice_kinds S asx) [(cf,undefined)]\"\n    and \"\\<forall>V \\<in> Use (_Low_). \n    state_val (transfers (slice_kinds S asx) [(cf,undefined)]) V = \n    state_val (transfers (kinds as) [(cf,undefined)]) V\"\n    and \"slice_edges S [] as = slice_edges S [] asx\"\n    and \"transfers (kinds as) [(cf,undefined)] \\<noteq> []\"\n    and \"(_Entry_) -asx\\<rightarrow>\\<^sub>\\<surd>* (_Low_)\" \n    by(erule fundamental_property_of_static_slicing)\n  from `(_Entry_) -as'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` `preds (kinds as') [(cf',undefined)]`\n    `CFG_node (_Low_) \\<in> S`\n  obtain asx' where \"preds (slice_kinds S asx') [(cf',undefined)]\"\n    and \"\\<forall>V \\<in> Use (_Low_). \n    state_val (transfers(slice_kinds S asx') [(cf',undefined)]) V = \n    state_val (transfers(kinds as') [(cf',undefined)]) V\"\n    and \"slice_edges S [] as' = \n    slice_edges S [] asx'\"\n    and \"transfers (kinds as') [(cf',undefined)] \\<noteq> []\"\n    and \"(_Entry_) -asx'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)\"\n    by(erule fundamental_property_of_static_slicing)\n  from `[cf] \\<approx>\\<^sub>L [cf']` `(_High_) \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>`\n  have \"\\<forall>V \\<in> rv S (CFG_node (_Entry_)). cf V = cf' V\" \n    by(fastforce dest:lowEquivalence_relevant_nodes_Entry)\n  with `(_Entry_) -asx \\<rightarrow>\\<^sub>\\<surd>*(_Low_)` `(_Entry_) -asx'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)`\n    `CFG_node (_Low_) \\<in> S` `preds (slice_kinds S asx) [(cf,undefined)]`\n    `preds (slice_kinds S asx') [(cf',undefined)]`\n  have \"\\<forall>V \\<in> Use (_Low_). \n    state_val (transfers(slice_kinds S asx) [(cf,undefined)]) V =\n    state_val (transfers(slice_kinds S asx') [(cf',undefined)]) V\"\n    by -(rule rv_Low_Use_Low,auto intro:get_proc_Entry)\n  with `\\<forall>V \\<in> Use (_Low_). \n    state_val (transfers (slice_kinds S asx) [(cf,undefined)]) V = \n    state_val (transfers (kinds as) [(cf,undefined)]) V`\n    `\\<forall>V \\<in> Use (_Low_). \n    state_val (transfers(slice_kinds S asx') [(cf',undefined)]) V = \n    state_val (transfers(kinds as') [(cf',undefined)]) V`\n    `transfers (kinds as) [(cf,undefined)] \\<noteq> []` \n    `transfers (kinds as') [(cf',undefined)] \\<noteq> []`\n  show ?thesis by(fastforce simp:lowEquivalence_def UseLow neq_Nil_conv)\nqed\n\n\ntheorem nonInterference_path:\n  assumes \"[cf] \\<approx>\\<^sub>L [cf']\" and \"(_High_) \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\"\n  and \"CFG_node (_Low_) \\<in> S\"\n  and \"(_Entry_) -as\\<rightarrow>\\<^sub>\\<surd>* (_Exit_)\" and \"preds (kinds as) [(cf,undefined)]\"\n  and \"(_Entry_) -as'\\<rightarrow>\\<^sub>\\<surd>* (_Exit_)\" and \"preds (kinds as') [(cf',undefined)]\"\n  shows \"map fst (transfers (kinds as) [(cf,undefined)]) \\<approx>\\<^sub>L \n  map fst (transfers (kinds as') [(cf',undefined)])\"\nproof -\n  from `(_Entry_) -as\\<rightarrow>\\<^sub>\\<surd>* (_Exit_)` obtain x xs where \"as = x#xs\"\n    and \"(_Entry_) = sourcenode x\" and \"valid_edge x\" \n    and \"targetnode x -xs\\<rightarrow>* (_Exit_)\"\n    apply(cases \"as = []\")\n     apply(clarsimp simp:vp_def,drule empty_path_nodes,drule Entry_noteq_Exit,simp)\n    by(fastforce elim:path_split_Cons simp:vp_def)\n  from `(_Entry_) -as\\<rightarrow>\\<^sub>\\<surd>* (_Exit_)` have \"valid_path as\" by(simp add:vp_def)\n  from `valid_edge x` have \"valid_node (targetnode x)\" by simp\n  hence \"inner_node (targetnode x)\"\n  proof(cases rule:valid_node_cases)\n    case Entry\n    with `valid_edge x` have False by(rule Entry_target)\n    thus ?thesis by simp\n  next\n    case Exit\n    with `targetnode x -xs\\<rightarrow>* (_Exit_)` have \"xs = []\"\n      by -(drule path_Exit_source,auto)\n    from Entry_Exit_edge obtain z where \"valid_edge z\"\n      and \"sourcenode z = (_Entry_)\" and \"targetnode z = (_Exit_)\"\n      and \"kind z = (\\<lambda>s. False)\\<^sub>\\<surd>\" by blast\n    from `valid_edge x` `valid_edge z` `(_Entry_) = sourcenode x` \n      `sourcenode z = (_Entry_)` Exit `targetnode z = (_Exit_)`\n    have \"x = z\" by(fastforce intro:edge_det)\n    with `preds (kinds as) [(cf,undefined)]` `as = x#xs` `xs = []`\n      `kind z = (\\<lambda>s. False)\\<^sub>\\<surd>` \n    have False by(simp add:kinds_def)\n    thus ?thesis by simp\n  qed simp\n  with `targetnode x -xs\\<rightarrow>* (_Exit_)` obtain x' xs' where \"xs = xs'@[x']\"\n    and \"targetnode x -xs'\\<rightarrow>* (_Low_)\" and \"kind x' = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n    by(fastforce elim:Exit_path_Low_path)\n  with `(_Entry_) = sourcenode x` `valid_edge x`\n  have \"(_Entry_) -x#xs'\\<rightarrow>* (_Low_)\" by(fastforce intro:Cons_path)\n  from `valid_path as` `as = x#xs` `xs = xs'@[x']`\n  have \"valid_path (x#xs')\"\n    by(simp add:valid_path_def del:valid_path_aux.simps)\n      (rule valid_path_aux_split,simp)\n  with `(_Entry_) -x#xs'\\<rightarrow>* (_Low_)` have \"(_Entry_) -x#xs'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)\"\n    by(simp add:vp_def)\n  from `as = x#xs` `xs = xs'@[x']` have \"as = (x#xs')@[x']\" by simp\n  with `preds (kinds as) [(cf,undefined)]` \n  have \"preds (kinds (x#xs')) [(cf,undefined)]\"\n    by(simp add:kinds_def preds_split)\n  from `(_Entry_) -as'\\<rightarrow>\\<^sub>\\<surd>* (_Exit_)` obtain y ys where \"as' = y#ys\"\n    and \"(_Entry_) = sourcenode y\" and \"valid_edge y\" \n    and \"targetnode y -ys\\<rightarrow>* (_Exit_)\"\n    apply(cases \"as' = []\")\n     apply(clarsimp simp:vp_def,drule empty_path_nodes,drule Entry_noteq_Exit,simp)\n    by(fastforce elim:path_split_Cons simp:vp_def)\n  from `(_Entry_) -as'\\<rightarrow>\\<^sub>\\<surd>* (_Exit_)` have \"valid_path as'\" by(simp add:vp_def)\n  from `valid_edge y` have \"valid_node (targetnode y)\" by simp\n  hence \"inner_node (targetnode y)\"\n  proof(cases rule:valid_node_cases)\n    case Entry\n    with `valid_edge y` have False by(rule Entry_target)\n    thus ?thesis by simp\n  next\n    case Exit\n    with `targetnode y -ys\\<rightarrow>* (_Exit_)` have \"ys = []\"\n      by -(drule path_Exit_source,auto)\n    from Entry_Exit_edge obtain z where \"valid_edge z\"\n      and \"sourcenode z = (_Entry_)\" and \"targetnode z = (_Exit_)\"\n      and \"kind z = (\\<lambda>s. False)\\<^sub>\\<surd>\" by blast\n    from `valid_edge y` `valid_edge z` `(_Entry_) = sourcenode y` \n      `sourcenode z = (_Entry_)` Exit `targetnode z = (_Exit_)`\n    have \"y = z\" by(fastforce intro:edge_det)\n    with `preds (kinds as') [(cf',undefined)]` `as' = y#ys` `ys = []`\n      `kind z = (\\<lambda>s. False)\\<^sub>\\<surd>` \n    have False by(simp add:kinds_def)\n    thus ?thesis by simp\n  qed simp\n  with `targetnode y -ys\\<rightarrow>* (_Exit_)` obtain y' ys' where \"ys = ys'@[y']\"\n    and \"targetnode y -ys'\\<rightarrow>* (_Low_)\" and \"kind y' = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n    by(fastforce elim:Exit_path_Low_path)\n  with `(_Entry_) = sourcenode y` `valid_edge y`\n  have \"(_Entry_) -y#ys'\\<rightarrow>* (_Low_)\" by(fastforce intro:Cons_path)\n  from `valid_path as'` `as' = y#ys` `ys = ys'@[y']`\n  have \"valid_path (y#ys')\"\n    by(simp add:valid_path_def del:valid_path_aux.simps)\n      (rule valid_path_aux_split,simp)\n  with `(_Entry_) -y#ys'\\<rightarrow>* (_Low_)` have \"(_Entry_) -y#ys'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)\"\n    by(simp add:vp_def)\n  from `as' = y#ys` `ys = ys'@[y']` have \"as' = (y#ys')@[y']\" by simp\n  with `preds (kinds as') [(cf',undefined)]` \n  have \"preds (kinds (y#ys')) [(cf',undefined)]\"\n    by(simp add:kinds_def preds_split)\n  from `[cf] \\<approx>\\<^sub>L [cf']` `(_High_) \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>` `CFG_node (_Low_) \\<in> S`\n    `(_Entry_) -x#xs'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` `preds (kinds (x#xs')) [(cf,undefined)]`\n    `(_Entry_) -y#ys'\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` `preds (kinds (y#ys')) [(cf',undefined)]`\n  have \"map fst (transfers (kinds (x#xs')) [(cf,undefined)]) \\<approx>\\<^sub>L \n    map fst (transfers (kinds (y#ys')) [(cf',undefined)])\"\n    by(rule nonInterference_path_to_Low)\n  with `as = x#xs` `xs = xs'@[x']` `kind x' = (\\<lambda>s. True)\\<^sub>\\<surd>`\n    `as' = y#ys` `ys = ys'@[y']` `kind y' = (\\<lambda>s. True)\\<^sub>\\<surd>`\n  show ?thesis\n    apply(cases \"transfers (map kind xs') (transfer (kind x) [(cf,undefined)])\")\n    apply (auto simp add:kinds_def transfers_split)\n    by((cases \"transfers (map kind ys') (transfer (kind y) [(cf',undefined)])\"),\n       (auto simp add:kinds_def transfers_split))+\nqed\n\n\nend\n\ntext {* The second theorem assumes that we have a operational semantics,\nwhose evaluations are written @{text \"\\<langle>c,s\\<rangle> \\<Rightarrow> \\<langle>c',s'\\<rangle>\"} and which conforms \nto the CFG. The correctness theorem then states that if no high variable\ninfluenced a low variable and the initial states were low equivalent, the\nreulting states are again low equivalent: *}\n\n\nlocale NonInterferenceInter = \n  NonInterferenceInterGraph sourcenode targetnode kind valid_edge Entry \n    get_proc get_return_edges procs Main Exit Def Use ParamDefs ParamUses \n    H L High Low +\n  SemanticsProperty sourcenode targetnode kind valid_edge Entry get_proc\n    get_return_edges procs Main Exit Def Use ParamDefs ParamUses sem identifies\n  for sourcenode :: \"'edge \\<Rightarrow> 'node\" and targetnode :: \"'edge \\<Rightarrow> 'node\"\n  and kind :: \"'edge \\<Rightarrow> ('var,'val,'ret,'pname) edge_kind\" \n  and valid_edge :: \"'edge \\<Rightarrow> bool\"\n  and Entry :: \"'node\" (\"'('_Entry'_')\")  and get_proc :: \"'node \\<Rightarrow> 'pname\"\n  and get_return_edges :: \"'edge \\<Rightarrow> 'edge set\"\n  and procs :: \"('pname \\<times> 'var list \\<times> 'var list) list\" and Main :: \"'pname\"\n  and Exit::\"'node\"  (\"'('_Exit'_')\") \n  and Def :: \"'node \\<Rightarrow> 'var set\" and Use :: \"'node \\<Rightarrow> 'var set\"\n  and ParamDefs :: \"'node \\<Rightarrow> 'var list\" and ParamUses :: \"'node \\<Rightarrow> 'var set list\"\n  and sem :: \"'com \\<Rightarrow> ('var \\<rightharpoonup> 'val) list \\<Rightarrow> 'com \\<Rightarrow> ('var \\<rightharpoonup> 'val) list \\<Rightarrow> bool\" \n    (\"((1\\<langle>_,/_\\<rangle>) \\<Rightarrow>/ (1\\<langle>_,/_\\<rangle>))\" [0,0,0,0] 81)\n  and identifies :: \"'node \\<Rightarrow> 'com \\<Rightarrow> bool\" (\"_ \\<triangleq> _\" [51,0] 80)\n  and H :: \"'var set\" and L :: \"'var set\" \n  and High :: \"'node\"  (\"'('_High'_')\") and Low :: \"'node\" (\"'('_Low'_')\") +\n  fixes final :: \"'com \\<Rightarrow> bool\"\n  assumes final_edge_Low: \"\\<lbrakk>final c; n \\<triangleq> c\\<rbrakk> \n    \\<Longrightarrow> \\<exists>a. valid_edge a \\<and> sourcenode a = n \\<and> targetnode a = (_Low_) \\<and> kind a = \\<Up>id\"\nbegin\n\n\ntext{* The following theorem needs the explicit edge from @{text \"(_High_)\"}\n  to @{text n}. An approach using a @{text \"init\"} predicate for initial statements,\n  being reachable from @{text \"(_High_)\"} via a @{text \"(\\<lambda>s. True)\\<^sub>\\<surd>\"} edge,\n  does not work as the same statement could be identified by several nodes, some\n  initial, some not. E.g., in the program \\texttt{while (True) Skip;;Skip}\n  two nodes identify this inital statement: the initial node and the node\n  within the loop (because of loop unrolling).*}\n\ntheorem nonInterference:\n  assumes \"[cf\\<^sub>1] \\<approx>\\<^sub>L [cf\\<^sub>2]\" and \"(_High_) \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>\"\n  and \"CFG_node (_Low_) \\<in> S\"\n  and \"valid_edge a\" and \"sourcenode a = (_High_)\" and \"targetnode a = n\" \n  and \"kind a = (\\<lambda>s. True)\\<^sub>\\<surd>\" and \"n \\<triangleq> c\" and \"final c'\"\n  and \"\\<langle>c,[cf\\<^sub>1]\\<rangle> \\<Rightarrow> \\<langle>c',s\\<^sub>1\\<rangle>\" and \"\\<langle>c,[cf\\<^sub>2]\\<rangle> \\<Rightarrow> \\<langle>c',s\\<^sub>2\\<rangle>\"\n  shows \"s\\<^sub>1 \\<approx>\\<^sub>L s\\<^sub>2\"\nproof -\n  from High_target_Entry_edge obtain ax where \"valid_edge ax\"\n    and \"sourcenode ax = (_Entry_)\" and \"targetnode ax = (_High_)\"\n    and \"kind ax = (\\<lambda>s. True)\\<^sub>\\<surd>\" by blast\n  from `n \\<triangleq> c` `\\<langle>c,[cf\\<^sub>1]\\<rangle> \\<Rightarrow> \\<langle>c',s\\<^sub>1\\<rangle>`\n  obtain n\\<^sub>1 as\\<^sub>1 cfs\\<^sub>1 where \"n -as\\<^sub>1\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>1\" and \"n\\<^sub>1 \\<triangleq> c'\"\n    and \"preds (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)]\" \n    and \"transfers (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)] = cfs\\<^sub>1\" and \"map fst cfs\\<^sub>1 = s\\<^sub>1\"\n    by(fastforce dest:fundamental_property)\n  from `n -as\\<^sub>1\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>1` `valid_edge a` `sourcenode a = (_High_)` `targetnode a = n`\n    `kind a = (\\<lambda>s. True)\\<^sub>\\<surd>`\n  have \"(_High_) -a#as\\<^sub>1\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>1\" by(fastforce intro:Cons_path simp:vp_def valid_path_def)\n  from `final c'` `n\\<^sub>1 \\<triangleq> c'`\n  obtain a\\<^sub>1 where \"valid_edge a\\<^sub>1\" and \"sourcenode a\\<^sub>1 = n\\<^sub>1\" \n    and \"targetnode a\\<^sub>1 = (_Low_)\" and \"kind a\\<^sub>1 = \\<Up>id\" by(fastforce dest:final_edge_Low)\n  hence \"n\\<^sub>1 -[a\\<^sub>1]\\<rightarrow>* (_Low_)\" by(fastforce intro:path_edge)\n  with `(_High_) -a#as\\<^sub>1\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>1` have \"(_High_) -(a#as\\<^sub>1)@[a\\<^sub>1]\\<rightarrow>* (_Low_)\"\n    by(fastforce intro!:path_Append simp:vp_def)\n  with `valid_edge ax` `sourcenode ax = (_Entry_)` `targetnode ax = (_High_)`\n  have \"(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\<rightarrow>* (_Low_)\" by -(rule Cons_path)\n  moreover\n  from `(_High_) -a#as\\<^sub>1\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>1` have \"valid_path_aux [] (a#as\\<^sub>1)\"\n    by(simp add:vp_def valid_path_def)\n  with `kind a\\<^sub>1 = \\<Up>id` have \"valid_path_aux [] ((a#as\\<^sub>1)@[a\\<^sub>1])\"\n    by(fastforce intro:valid_path_aux_Append)\n  with `kind ax = (\\<lambda>s. True)\\<^sub>\\<surd>` have \"valid_path_aux [] (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))\"\n    by simp\n  ultimately have \"(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\<rightarrow>\\<^sub>\\<surd>* (_Low_)\"\n    by(simp add:vp_def valid_path_def)\n  from `valid_edge a` `kind a = (\\<lambda>s. True)\\<^sub>\\<surd>` `sourcenode a = (_High_)`\n    `targetnode a = n`\n  have \"get_proc n = get_proc (_High_)\"\n    by(fastforce dest:get_proc_intra simp:intra_kind_def)\n  with get_proc_High have \"get_proc n = Main\" by simp\n  from `valid_edge a\\<^sub>1` `sourcenode a\\<^sub>1 = n\\<^sub>1` `targetnode a\\<^sub>1 = (_Low_)` `kind a\\<^sub>1 = \\<Up>id`\n  have \"get_proc n\\<^sub>1 = get_proc (_Low_)\"\n    by(fastforce dest:get_proc_intra simp:intra_kind_def)\n  with get_proc_Low have \"get_proc n\\<^sub>1 = Main\" by simp\n  from `n -as\\<^sub>1\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>1` have \"n -as\\<^sub>1\\<rightarrow>\\<^bsub>sl\\<^esub>* n\\<^sub>1\"\n    by(cases as\\<^sub>1)\n      (auto dest!:vpa_Main_slpa intro:`get_proc n\\<^sub>1 = Main` `get_proc n = Main`\n             simp:vp_def valid_path_def valid_call_list_def slp_def \n                  same_level_path_def simp del:valid_path_aux.simps)\n  then obtain cfx r where cfx:\"transfers (map kind as\\<^sub>1) [(cf\\<^sub>1,undefined)] = [(cfx,r)]\"\n    by(fastforce elim:slp_callstack_length_equal simp:kinds_def)\n  from `kind ax = (\\<lambda>s. True)\\<^sub>\\<surd>` `kind a = (\\<lambda>s. True)\\<^sub>\\<surd>` \n    `preds (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)]` `kind a\\<^sub>1 = \\<Up>id` cfx \n  have \"preds (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) [(cf\\<^sub>1,undefined)]\"\n    by(auto simp:kinds_def preds_split)\n  from `n \\<triangleq> c` `\\<langle>c,[cf\\<^sub>2]\\<rangle> \\<Rightarrow> \\<langle>c',s\\<^sub>2\\<rangle>`\n  obtain n\\<^sub>2 as\\<^sub>2 cfs\\<^sub>2 where \"n -as\\<^sub>2\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>2\" and \"n\\<^sub>2 \\<triangleq> c'\"\n    and \"preds (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)]\" \n    and \"transfers (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)] = cfs\\<^sub>2\" and \"map fst cfs\\<^sub>2 = s\\<^sub>2\"\n    by(fastforce dest:fundamental_property)\n  from `n -as\\<^sub>2\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>2` `valid_edge a` `sourcenode a = (_High_)` `targetnode a = n`\n    `kind a = (\\<lambda>s. True)\\<^sub>\\<surd>`\n  have \"(_High_) -a#as\\<^sub>2\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>2\" by(fastforce intro:Cons_path simp:vp_def valid_path_def)\n  from `final c'` `n\\<^sub>2 \\<triangleq> c'`\n  obtain a\\<^sub>2 where \"valid_edge a\\<^sub>2\" and \"sourcenode a\\<^sub>2 = n\\<^sub>2\" \n    and \"targetnode a\\<^sub>2 = (_Low_)\" and \"kind a\\<^sub>2 = \\<Up>id\" by(fastforce dest:final_edge_Low)\n  hence \"n\\<^sub>2 -[a\\<^sub>2]\\<rightarrow>* (_Low_)\" by(fastforce intro:path_edge)\n  with `(_High_) -a#as\\<^sub>2\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>2` have \"(_High_) -(a#as\\<^sub>2)@[a\\<^sub>2]\\<rightarrow>* (_Low_)\"\n    by(fastforce intro!:path_Append simp:vp_def)\n  with `valid_edge ax` `sourcenode ax = (_Entry_)` `targetnode ax = (_High_)`\n  have \"(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\<rightarrow>* (_Low_)\" by -(rule Cons_path)\n  moreover\n  from `(_High_) -a#as\\<^sub>2\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>2` have \"valid_path_aux [] (a#as\\<^sub>2)\"\n    by(simp add:vp_def valid_path_def)\n  with `kind a\\<^sub>2 = \\<Up>id` have \"valid_path_aux [] ((a#as\\<^sub>2)@[a\\<^sub>2])\"\n    by(fastforce intro:valid_path_aux_Append)\n  with `kind ax = (\\<lambda>s. True)\\<^sub>\\<surd>` have \"valid_path_aux [] (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))\"\n    by simp\n  ultimately have \"(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\<rightarrow>\\<^sub>\\<surd>* (_Low_)\"\n    by(simp add:vp_def valid_path_def)\n  from `valid_edge a` `kind a = (\\<lambda>s. True)\\<^sub>\\<surd>` `sourcenode a = (_High_)`\n    `targetnode a = n`\n  have \"get_proc n = get_proc (_High_)\"\n    by(fastforce dest:get_proc_intra simp:intra_kind_def)\n  with get_proc_High have \"get_proc n = Main\" by simp\n  from `valid_edge a\\<^sub>2` `sourcenode a\\<^sub>2 = n\\<^sub>2` `targetnode a\\<^sub>2 = (_Low_)` `kind a\\<^sub>2 = \\<Up>id`\n  have \"get_proc n\\<^sub>2 = get_proc (_Low_)\"\n    by(fastforce dest:get_proc_intra simp:intra_kind_def)\n  with get_proc_Low have \"get_proc n\\<^sub>2 = Main\" by simp\n  from `n -as\\<^sub>2\\<rightarrow>\\<^sub>\\<surd>* n\\<^sub>2` have \"n -as\\<^sub>2\\<rightarrow>\\<^bsub>sl\\<^esub>* n\\<^sub>2\"\n    by(cases as\\<^sub>2)\n      (auto dest!:vpa_Main_slpa intro:`get_proc n\\<^sub>2 = Main` `get_proc n = Main`\n             simp:vp_def valid_path_def valid_call_list_def slp_def \n                  same_level_path_def simp del:valid_path_aux.simps)\n  then obtain cfx' r' \n    where cfx':\"transfers (map kind as\\<^sub>2) [(cf\\<^sub>2,undefined)] = [(cfx',r')]\"\n    by(fastforce elim:slp_callstack_length_equal simp:kinds_def)\n  from `kind ax = (\\<lambda>s. True)\\<^sub>\\<surd>` `kind a = (\\<lambda>s. True)\\<^sub>\\<surd>` \n    `preds (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)]` `kind a\\<^sub>2 = \\<Up>id` cfx' \n  have \"preds (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) [(cf\\<^sub>2,undefined)]\"\n    by(auto simp:kinds_def preds_split)\n  from `[cf\\<^sub>1] \\<approx>\\<^sub>L [cf\\<^sub>2]` `(_High_) \\<notin> \\<lfloor>HRB_slice S\\<rfloor>\\<^bsub>CFG\\<^esub>` `CFG_node (_Low_) \\<in> S`\n    `(_Entry_) -ax#((a#as\\<^sub>1)@[a\\<^sub>1])\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` \n    `preds (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) [(cf\\<^sub>1,undefined)]`\n    `(_Entry_) -ax#((a#as\\<^sub>2)@[a\\<^sub>2])\\<rightarrow>\\<^sub>\\<surd>* (_Low_)` \n    `preds (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) [(cf\\<^sub>2,undefined)]`\n  have \"map fst (transfers (kinds (ax#((a#as\\<^sub>1)@[a\\<^sub>1]))) [(cf\\<^sub>1,undefined)]) \\<approx>\\<^sub>L \n        map fst (transfers (kinds (ax#((a#as\\<^sub>2)@[a\\<^sub>2]))) [(cf\\<^sub>2,undefined)])\"\n    by(rule nonInterference_path_to_Low)\n  with `kind ax = (\\<lambda>s. True)\\<^sub>\\<surd>` `kind a = (\\<lambda>s. True)\\<^sub>\\<surd>` `kind a\\<^sub>1 = \\<Up>id` `kind a\\<^sub>2 = \\<Up>id`\n    `transfers (kinds as\\<^sub>1) [(cf\\<^sub>1,undefined)] = cfs\\<^sub>1` `map fst cfs\\<^sub>1 = s\\<^sub>1`\n    `transfers (kinds as\\<^sub>2) [(cf\\<^sub>2,undefined)] = cfs\\<^sub>2` `map fst cfs\\<^sub>2 = s\\<^sub>2`\n  show ?thesis by(cases s\\<^sub>1)(cases s\\<^sub>2,(fastforce simp:kinds_def transfers_split)+)+\nqed\n\n\nend\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/InformationFlowSlicing/NonInterferenceInter.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.3125680634325904}}
{"text": "(*  Title:      CCL/Term.thy\n    Author:     Martin Coen\n    Copyright   1993  University of Cambridge\n*)\n\nsection {* Definitions of usual program constructs in CCL *}\n\ntheory Term\nimports CCL\nbegin\n\nconsts\n\n  one        :: \"i\"\n\n  \"if\"       :: \"[i,i,i]\\<Rightarrow>i\"           (\"(3if _/ then _/ else _)\" [0,0,60] 60)\n\n  inl        :: \"i\\<Rightarrow>i\"\n  inr        :: \"i\\<Rightarrow>i\"\n  when       :: \"[i,i\\<Rightarrow>i,i\\<Rightarrow>i]\\<Rightarrow>i\"\n\n  split      :: \"[i,[i,i]\\<Rightarrow>i]\\<Rightarrow>i\"\n  fst        :: \"i\\<Rightarrow>i\"\n  snd        :: \"i\\<Rightarrow>i\"\n  thd        :: \"i\\<Rightarrow>i\"\n\n  zero       :: \"i\"\n  succ       :: \"i\\<Rightarrow>i\"\n  ncase      :: \"[i,i,i\\<Rightarrow>i]\\<Rightarrow>i\"\n  nrec       :: \"[i,i,[i,i]\\<Rightarrow>i]\\<Rightarrow>i\"\n\n  nil        :: \"i\"                        (\"([])\")\n  cons       :: \"[i,i]\\<Rightarrow>i\"                 (infixr \"$\" 80)\n  lcase      :: \"[i,i,[i,i]\\<Rightarrow>i]\\<Rightarrow>i\"\n  lrec       :: \"[i,i,[i,i,i]\\<Rightarrow>i]\\<Rightarrow>i\"\n\n  \"let\"      :: \"[i,i\\<Rightarrow>i]\\<Rightarrow>i\"\n  letrec     :: \"[[i,i\\<Rightarrow>i]\\<Rightarrow>i,(i\\<Rightarrow>i)\\<Rightarrow>i]\\<Rightarrow>i\"\n  letrec2    :: \"[[i,i,i\\<Rightarrow>i\\<Rightarrow>i]\\<Rightarrow>i,(i\\<Rightarrow>i\\<Rightarrow>i)\\<Rightarrow>i]\\<Rightarrow>i\"\n  letrec3    :: \"[[i,i,i,i\\<Rightarrow>i\\<Rightarrow>i\\<Rightarrow>i]\\<Rightarrow>i,(i\\<Rightarrow>i\\<Rightarrow>i\\<Rightarrow>i)\\<Rightarrow>i]\\<Rightarrow>i\"\n\nsyntax\n  \"_let\"     :: \"[id,i,i]\\<Rightarrow>i\"             (\"(3let _ be _/ in _)\"\n                        [0,0,60] 60)\n\n  \"_letrec\"  :: \"[id,id,i,i]\\<Rightarrow>i\"         (\"(3letrec _ _ be _/ in _)\"\n                        [0,0,0,60] 60)\n\n  \"_letrec2\" :: \"[id,id,id,i,i]\\<Rightarrow>i\"     (\"(3letrec _ _ _ be _/ in _)\"\n                        [0,0,0,0,60] 60)\n\n  \"_letrec3\" :: \"[id,id,id,id,i,i]\\<Rightarrow>i\" (\"(3letrec _ _ _ _ be _/ in _)\"\n                        [0,0,0,0,0,60] 60)\n\nML {*\n(** Quantifier translations: variable binding **)\n\n(* FIXME does not handle \"_idtdummy\" *)\n(* FIXME should use Syntax_Trans.mark_bound, Syntax_Trans.variant_abs' *)\n\nfun let_tr [Free x, a, b] = Const(@{const_syntax let},dummyT) $ a $ absfree x b;\nfun let_tr' [a,Abs(id,T,b)] =\n     let val (id',b') = Syntax_Trans.variant_abs(id,T,b)\n     in Const(@{syntax_const \"_let\"},dummyT) $ Free(id',T) $ a $ b' end;\n\nfun letrec_tr [Free f, Free x, a, b] =\n      Const(@{const_syntax letrec}, dummyT) $ absfree x (absfree f a) $ absfree f b;\nfun letrec2_tr [Free f, Free x, Free y, a, b] =\n      Const(@{const_syntax letrec2}, dummyT) $ absfree x (absfree y (absfree f a)) $ absfree f b;\nfun letrec3_tr [Free f, Free x, Free y, Free z, a, b] =\n      Const(@{const_syntax letrec3}, dummyT) $\n        absfree x (absfree y (absfree z (absfree f a))) $ absfree f b;\n\nfun letrec_tr' [Abs(x,T,Abs(f,S,a)),Abs(ff,SS,b)] =\n     let val (f',b') = Syntax_Trans.variant_abs(ff,SS,b)\n         val (_,a'') = Syntax_Trans.variant_abs(f,S,a)\n         val (x',a') = Syntax_Trans.variant_abs(x,T,a'')\n     in Const(@{syntax_const \"_letrec\"},dummyT) $ Free(f',SS) $ Free(x',T) $ a' $ b' end;\nfun letrec2_tr' [Abs(x,T,Abs(y,U,Abs(f,S,a))),Abs(ff,SS,b)] =\n     let val (f',b') = Syntax_Trans.variant_abs(ff,SS,b)\n         val ( _,a1) = Syntax_Trans.variant_abs(f,S,a)\n         val (y',a2) = Syntax_Trans.variant_abs(y,U,a1)\n         val (x',a') = Syntax_Trans.variant_abs(x,T,a2)\n     in Const(@{syntax_const \"_letrec2\"},dummyT) $ Free(f',SS) $ Free(x',T) $ Free(y',U) $ a' $ b'\n      end;\nfun letrec3_tr' [Abs(x,T,Abs(y,U,Abs(z,V,Abs(f,S,a)))),Abs(ff,SS,b)] =\n     let val (f',b') = Syntax_Trans.variant_abs(ff,SS,b)\n         val ( _,a1) = Syntax_Trans.variant_abs(f,S,a)\n         val (z',a2) = Syntax_Trans.variant_abs(z,V,a1)\n         val (y',a3) = Syntax_Trans.variant_abs(y,U,a2)\n         val (x',a') = Syntax_Trans.variant_abs(x,T,a3)\n     in Const(@{syntax_const \"_letrec3\"},dummyT) $ Free(f',SS) $ Free(x',T) $ Free(y',U) $ Free(z',V) $ a' $ b'\n      end;\n*}\n\nparse_translation {*\n [(@{syntax_const \"_let\"}, K let_tr),\n  (@{syntax_const \"_letrec\"}, K letrec_tr),\n  (@{syntax_const \"_letrec2\"}, K letrec2_tr),\n  (@{syntax_const \"_letrec3\"}, K letrec3_tr)]\n*}\n\nprint_translation {*\n [(@{const_syntax let}, K let_tr'),\n  (@{const_syntax letrec}, K letrec_tr'),\n  (@{const_syntax letrec2}, K letrec2_tr'),\n  (@{const_syntax letrec3}, K letrec3_tr')]\n*}\n\nconsts\n  napply     :: \"[i\\<Rightarrow>i,i,i]\\<Rightarrow>i\"            (\"(_ ^ _ ` _)\" [56,56,56] 56)\n\ndefs\n  one_def:                    \"one == true\"\n  if_def:     \"if b then t else u  == case(b, t, u, \\<lambda> x y. bot, \\<lambda>v. bot)\"\n  inl_def:                 \"inl(a) == <true,a>\"\n  inr_def:                 \"inr(b) == <false,b>\"\n  when_def:           \"when(t,f,g) == split(t, \\<lambda>b x. if b then f(x) else g(x))\"\n  split_def:           \"split(t,f) == case(t, bot, bot, f, \\<lambda>u. bot)\"\n  fst_def:                 \"fst(t) == split(t, \\<lambda>x y. x)\"\n  snd_def:                 \"snd(t) == split(t, \\<lambda>x y. y)\"\n  thd_def:                 \"thd(t) == split(t, \\<lambda>x p. split(p, \\<lambda>y z. z))\"\n  zero_def:                  \"zero == inl(one)\"\n  succ_def:               \"succ(n) == inr(n)\"\n  ncase_def:         \"ncase(n,b,c) == when(n, \\<lambda>x. b, \\<lambda>y. c(y))\"\n  nrec_def:          \" nrec(n,b,c) == letrec g x be ncase(x, b, \\<lambda>y. c(y,g(y))) in g(n)\"\n  nil_def:                     \"[] == inl(one)\"\n  cons_def:                   \"h$t == inr(<h,t>)\"\n  lcase_def:         \"lcase(l,b,c) == when(l, \\<lambda>x. b, \\<lambda>y. split(y,c))\"\n  lrec_def:           \"lrec(l,b,c) == letrec g x be lcase(x, b, \\<lambda>h t. c(h,t,g(t))) in g(l)\"\n\n  let_def:  \"let x be t in f(x) == case(t,f(true),f(false), \\<lambda>x y. f(<x,y>), \\<lambda>u. f(lam x. u(x)))\"\n  letrec_def:\n  \"letrec g x be h(x,g) in b(g) == b(\\<lambda>x. fix(\\<lambda>f. lam x. h(x,\\<lambda>y. f`y))`x)\"\n\n  letrec2_def:  \"letrec g x y be h(x,y,g) in f(g)==\n               letrec g' p be split(p,\\<lambda>x y. h(x,y,\\<lambda>u v. g'(<u,v>)))\n                          in f(\\<lambda>x y. g'(<x,y>))\"\n\n  letrec3_def:  \"letrec g x y z be h(x,y,z,g) in f(g) ==\n             letrec g' p be split(p,\\<lambda>x xs. split(xs,\\<lambda>y z. h(x,y,z,\\<lambda>u v w. g'(<u,<v,w>>))))\n                          in f(\\<lambda>x y z. g'(<x,<y,z>>))\"\n\n  napply_def: \"f ^n` a == nrec(n,a,\\<lambda>x g. f(g))\"\n\n\nlemmas simp_can_defs = one_def inl_def inr_def\n  and simp_ncan_defs = if_def when_def split_def fst_def snd_def thd_def\nlemmas simp_defs = simp_can_defs simp_ncan_defs\n\nlemmas ind_can_defs = zero_def succ_def nil_def cons_def\n  and ind_ncan_defs = ncase_def nrec_def lcase_def lrec_def\nlemmas ind_defs = ind_can_defs ind_ncan_defs\n\nlemmas data_defs = simp_defs ind_defs napply_def\n  and genrec_defs = letrec_def letrec2_def letrec3_def\n\n\nsubsection {* Beta Rules, including strictness *}\n\nlemma letB: \"\\<not> t=bot \\<Longrightarrow> let x be t in f(x) = f(t)\"\n  apply (unfold let_def)\n  apply (erule rev_mp)\n  apply (rule_tac t = \"t\" in term_case)\n      apply (simp_all add: caseBtrue caseBfalse caseBpair caseBlam)\n  done\n\nlemma letBabot: \"let x be bot in f(x) = bot\"\n  apply (unfold let_def)\n  apply (rule caseBbot)\n  done\n\nlemma letBbbot: \"let x be t in bot = bot\"\n  apply (unfold let_def)\n  apply (rule_tac t = t in term_case)\n      apply (rule caseBbot)\n     apply (simp_all add: caseBtrue caseBfalse caseBpair caseBlam)\n  done\n\nlemma applyB: \"(lam x. b(x)) ` a = b(a)\"\n  apply (unfold apply_def)\n  apply (simp add: caseBtrue caseBfalse caseBpair caseBlam)\n  done\n\nlemma applyBbot: \"bot ` a = bot\"\n  apply (unfold apply_def)\n  apply (rule caseBbot)\n  done\n\nlemma fixB: \"fix(f) = f(fix(f))\"\n  apply (unfold fix_def)\n  apply (rule applyB [THEN ssubst], rule refl)\n  done\n\nlemma letrecB:\n    \"letrec g x be h(x,g) in g(a) = h(a,\\<lambda>y. letrec g x be h(x,g) in g(y))\"\n  apply (unfold letrec_def)\n  apply (rule fixB [THEN ssubst], rule applyB [THEN ssubst], rule refl)\n  done\n\nlemmas rawBs = caseBs applyB applyBbot\n\nmethod_setup beta_rl = {*\n  Scan.succeed (fn ctxt =>\n    SIMPLE_METHOD' (CHANGED o\n      simp_tac (ctxt addsimps @{thms rawBs} setloop (fn _ => stac @{thm letrecB}))))\n*}\n\nlemma ifBtrue: \"if true then t else u = t\"\n  and ifBfalse: \"if false then t else u = u\"\n  and ifBbot: \"if bot then t else u = bot\"\n  unfolding data_defs by beta_rl+\n\nlemma whenBinl: \"when(inl(a),t,u) = t(a)\"\n  and whenBinr: \"when(inr(a),t,u) = u(a)\"\n  and whenBbot: \"when(bot,t,u) = bot\"\n  unfolding data_defs by beta_rl+\n\nlemma splitB: \"split(<a,b>,h) = h(a,b)\"\n  and splitBbot: \"split(bot,h) = bot\"\n  unfolding data_defs by beta_rl+\n\nlemma fstB: \"fst(<a,b>) = a\"\n  and fstBbot: \"fst(bot) = bot\"\n  unfolding data_defs by beta_rl+\n\nlemma sndB: \"snd(<a,b>) = b\"\n  and sndBbot: \"snd(bot) = bot\"\n  unfolding data_defs by beta_rl+\n\nlemma thdB: \"thd(<a,<b,c>>) = c\"\n  and thdBbot: \"thd(bot) = bot\"\n  unfolding data_defs by beta_rl+\n\nlemma ncaseBzero: \"ncase(zero,t,u) = t\"\n  and ncaseBsucc: \"ncase(succ(n),t,u) = u(n)\"\n  and ncaseBbot: \"ncase(bot,t,u) = bot\"\n  unfolding data_defs by beta_rl+\n\nlemma nrecBzero: \"nrec(zero,t,u) = t\"\n  and nrecBsucc: \"nrec(succ(n),t,u) = u(n,nrec(n,t,u))\"\n  and nrecBbot: \"nrec(bot,t,u) = bot\"\n  unfolding data_defs by beta_rl+\n\nlemma lcaseBnil: \"lcase([],t,u) = t\"\n  and lcaseBcons: \"lcase(x$xs,t,u) = u(x,xs)\"\n  and lcaseBbot: \"lcase(bot,t,u) = bot\"\n  unfolding data_defs by beta_rl+\n\nlemma lrecBnil: \"lrec([],t,u) = t\"\n  and lrecBcons: \"lrec(x$xs,t,u) = u(x,xs,lrec(xs,t,u))\"\n  and lrecBbot: \"lrec(bot,t,u) = bot\"\n  unfolding data_defs by beta_rl+\n\nlemma letrec2B:\n  \"letrec g x y be h(x,y,g) in g(p,q) = h(p,q,\\<lambda>u v. letrec g x y be h(x,y,g) in g(u,v))\"\n  unfolding data_defs letrec2_def by beta_rl+\n\nlemma letrec3B:\n  \"letrec g x y z be h(x,y,z,g) in g(p,q,r) =\n    h(p,q,r,\\<lambda>u v w. letrec g x y z be h(x,y,z,g) in g(u,v,w))\"\n  unfolding data_defs letrec3_def by beta_rl+\n\nlemma napplyBzero: \"f^zero`a = a\"\n  and napplyBsucc: \"f^succ(n)`a = f(f^n`a)\"\n  unfolding data_defs by beta_rl+\n\nlemmas termBs = letB applyB applyBbot splitB splitBbot fstB fstBbot\n  sndB sndBbot thdB thdBbot ifBtrue ifBfalse ifBbot whenBinl whenBinr\n  whenBbot ncaseBzero ncaseBsucc ncaseBbot nrecBzero nrecBsucc\n  nrecBbot lcaseBnil lcaseBcons lcaseBbot lrecBnil lrecBcons lrecBbot\n  napplyBzero napplyBsucc\n\n\nsubsection {* Constructors are injective *}\n\nlemma term_injs:\n  \"(inl(a) = inl(a')) \\<longleftrightarrow> (a=a')\"\n  \"(inr(a) = inr(a')) \\<longleftrightarrow> (a=a')\"\n  \"(succ(a) = succ(a')) \\<longleftrightarrow> (a=a')\"\n  \"(a$b = a'$b') \\<longleftrightarrow> (a=a' \\<and> b=b')\"\n  by (inj_rl applyB splitB whenBinl whenBinr ncaseBsucc lcaseBcons)\n\n\nsubsection {* Constructors are distinct *}\n\nML {*\nML_Thms.bind_thms (\"term_dstncts\",\n  mkall_dstnct_thms @{context} @{thms data_defs} (@{thms ccl_injs} @ @{thms term_injs})\n    [[\"bot\",\"inl\",\"inr\"], [\"bot\",\"zero\",\"succ\"], [\"bot\",\"nil\",\"cons\"]]);\n*}\n\n\nsubsection {* Rules for pre-order @{text \"[=\"} *}\n\nlemma term_porews:\n  \"inl(a) [= inl(a') \\<longleftrightarrow> a [= a'\"\n  \"inr(b) [= inr(b') \\<longleftrightarrow> b [= b'\"\n  \"succ(n) [= succ(n') \\<longleftrightarrow> n [= n'\"\n  \"x$xs [= x'$xs' \\<longleftrightarrow> x [= x' \\<and> xs [= xs'\"\n  by (simp_all add: data_defs ccl_porews)\n\n\nsubsection {* Rewriting and Proving *}\n\nML {*\n  ML_Thms.bind_thms (\"term_injDs\", XH_to_Ds @{thms term_injs});\n*}\n\nlemmas term_rews = termBs term_injs term_dstncts ccl_porews term_porews\n\nlemmas [simp] = term_rews\nlemmas [elim!] = term_dstncts [THEN notE]\nlemmas [dest!] = term_injDs\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/CCL/Term.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.3125228910109688}}
{"text": "(*  Title:      HOL/UNITY/Simple/NSP_Bad.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n\nOriginal file is ../Auth/NS_Public_Bad\n*)\n\nsection\\<open>Analyzing the Needham-Schroeder Public-Key Protocol in UNITY\\<close>\n\ntheory NSP_Bad imports \"HOL-Auth.Public\" \"../UNITY_Main\" begin\n\ntext\\<open>This is the flawed version, vulnerable to Lowe's attack.\nFrom page 260 of\n  Burrows, Abadi and Needham.  A Logic of Authentication.\n  Proc. Royal Soc. 426 (1989).\n\\<close>\n\ntype_synonym state = \"event list\"\n\n  (*The spy MAY say anything he CAN say.  We do not expect him to\n    invent new nonces here, but he can also use NS1.  Common to\n    all similar protocols.*)\ndefinition\n  Fake :: \"(state*state) set\"\n  where \"Fake = {(s,s').\n              \\<exists>B X. s' = Says Spy B X # s\n                    & X \\<in> synth (analz (spies s))}\"\n\n  (*The numeric suffixes on A identify the rule*)\n\n  (*Alice initiates a protocol run, sending a nonce to Bob*)\ndefinition\n  NS1 :: \"(state*state) set\"\n  where \"NS1 = {(s1,s').\n             \\<exists>A1 B NA.\n                 s' = Says A1 B (Crypt (pubK B) \\<lbrace>Nonce NA, Agent A1\\<rbrace>) # s1\n               & Nonce NA \\<notin> used s1}\"\n\n  (*Bob responds to Alice's message with a further nonce*)\ndefinition\n  NS2 :: \"(state*state) set\"\n  where \"NS2 = {(s2,s').\n             \\<exists>A' A2 B NA NB.\n                 s' = Says B A2 (Crypt (pubK A2) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) # s2\n               & Says A' B (Crypt (pubK B) \\<lbrace>Nonce NA, Agent A2\\<rbrace>) \\<in> set s2\n               & Nonce NB \\<notin> used s2}\"\n\n  (*Alice proves her existence by sending NB back to Bob.*)\ndefinition\n  NS3 :: \"(state*state) set\"\n  where \"NS3 = {(s3,s').\n             \\<exists>A3 B' B NA NB.\n                 s' = Says A3 B (Crypt (pubK B) (Nonce NB)) # s3\n               & Says A3  B (Crypt (pubK B) \\<lbrace>Nonce NA, Agent A3\\<rbrace>) \\<in> set s3\n               & Says B' A3 (Crypt (pubK A3) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) \\<in> set s3}\"\n\n\ndefinition Nprg :: \"state program\" where\n    (*Initial trace is empty*)\n    \"Nprg = mk_total_program({[]}, {Fake, NS1, NS2, NS3}, UNIV)\"\n\ndeclare spies_partsEs [elim]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\n\ntext\\<open>For other theories, e.g. Mutex and Lift, using [iff] slows proofs down.\n  Here, it facilitates re-use of the Auth proofs.\\<close>\n\ndeclare Fake_def [THEN def_act_simp, iff]\ndeclare NS1_def [THEN def_act_simp, iff]\ndeclare NS2_def [THEN def_act_simp, iff]\ndeclare NS3_def [THEN def_act_simp, iff]\n\ndeclare Nprg_def [THEN def_prg_Init, simp]\n\n\ntext\\<open>A \"possibility property\": there are traces that reach the end.\n  Replace by LEADSTO proof!\\<close>\nlemma \"A \\<noteq> B ==>\n       \\<exists>NB. \\<exists>s \\<in> reachable Nprg. Says A B (Crypt (pubK B) (Nonce NB)) \\<in> set s\"\napply (intro exI bexI)\napply (rule_tac [2] act = \"totalize_act NS3\" in reachable.Acts)\napply (rule_tac [3] act = \"totalize_act NS2\" in reachable.Acts)\napply (rule_tac [4] act = \"totalize_act NS1\" in reachable.Acts)\napply (rule_tac [5] reachable.Init)\napply (simp_all (no_asm_simp) add: Nprg_def totalize_act_def)\napply auto\ndone\n\n\nsubsection\\<open>Inductive Proofs about \\<^term>\\<open>ns_public\\<close>\\<close>\n\nlemma ns_constrainsI:\n     \"(!!act s s'. [| act \\<in> {Id, Fake, NS1, NS2, NS3};\n                      (s,s') \\<in> act;  s \\<in> A |] ==> s' \\<in> A')\n      ==> Nprg \\<in> A co A'\"\napply (simp add: Nprg_def mk_total_program_def)\napply (rule constrainsI, auto)\ndone\n\n\ntext\\<open>This ML code does the inductions directly.\\<close>\nML\\<open>\nfun ns_constrains_tac ctxt i =\n  SELECT_GOAL\n    (EVERY\n     [REPEAT (eresolve_tac ctxt @{thms Always_ConstrainsI} 1),\n      REPEAT (resolve_tac ctxt [@{thm StableI}, @{thm stableI}, @{thm constrains_imp_Constrains}] 1),\n      resolve_tac ctxt @{thms ns_constrainsI} 1,\n      full_simp_tac ctxt 1,\n      REPEAT (FIRSTGOAL (eresolve_tac ctxt [disjE])),\n      ALLGOALS (clarify_tac (ctxt delrules [impI, @{thm impCE}])),\n      REPEAT (FIRSTGOAL (analz_mono_contra_tac ctxt)),\n      ALLGOALS (asm_simp_tac ctxt)]) i;\n\n(*Tactic for proving secrecy theorems*)\nfun ns_induct_tac ctxt =\n  (SELECT_GOAL o EVERY)\n     [resolve_tac ctxt @{thms AlwaysI} 1,\n      force_tac ctxt 1,\n      (*\"reachable\" gets in here*)\n      resolve_tac ctxt [@{thm Always_reachable} RS @{thm Always_ConstrainsI} RS @{thm StableI}] 1,\n      ns_constrains_tac ctxt 1];\n\\<close>\n\nmethod_setup ns_induct = \\<open>\n    Scan.succeed (SIMPLE_METHOD' o ns_induct_tac)\\<close>\n    \"for inductive reasoning about the Needham-Schroeder protocol\"\n\ntext\\<open>Converts invariants into statements about reachable states\\<close>\nlemmas Always_Collect_reachableD =\n     Always_includes_reachable [THEN subsetD, THEN CollectD]\n\ntext\\<open>Spy never sees another agent's private key! (unless it's bad at start)\\<close>\nlemma Spy_see_priK:\n     \"Nprg \\<in> Always {s. (Key (priK A) \\<in> parts (spies s)) = (A \\<in> bad)}\"\napply ns_induct\napply blast\ndone\ndeclare Spy_see_priK [THEN Always_Collect_reachableD, simp]\n\nlemma Spy_analz_priK:\n     \"Nprg \\<in> Always {s. (Key (priK A) \\<in> analz (spies s)) = (A \\<in> bad)}\"\nby (rule Always_reachable [THEN Always_weaken], auto)\ndeclare Spy_analz_priK [THEN Always_Collect_reachableD, simp]\n\n\nsubsection\\<open>Authenticity properties obtained from NS2\\<close>\n\ntext\\<open>It is impossible to re-use a nonce in both NS1 and NS2 provided the\n     nonce is secret.  (Honest users generate fresh nonces.)\\<close>\nlemma no_nonce_NS1_NS2:\n \"Nprg\n  \\<in> Always {s. Crypt (pubK C) \\<lbrace>NA', Nonce NA\\<rbrace> \\<in> parts (spies s) -->\n                Crypt (pubK B) \\<lbrace>Nonce NA, Agent A\\<rbrace> \\<in> parts (spies s) -->\n                Nonce NA \\<in> analz (spies s)}\"\napply ns_induct\napply (blast intro: analz_insertI)+\ndone\n\ntext\\<open>Adding it to the claset slows down proofs...\\<close>\nlemmas no_nonce_NS1_NS2_reachable =\n       no_nonce_NS1_NS2 [THEN Always_Collect_reachableD, rule_format]\n\n\ntext\\<open>Unicity for NS1: nonce NA identifies agents A and B\\<close>\nlemma unique_NA_lemma:\n     \"Nprg\n  \\<in> Always {s. Nonce NA \\<notin> analz (spies s) -->\n                Crypt(pubK B) \\<lbrace>Nonce NA, Agent A\\<rbrace> \\<in> parts(spies s) -->\n                Crypt(pubK B') \\<lbrace>Nonce NA, Agent A'\\<rbrace> \\<in> parts(spies s) -->\n                A=A' & B=B'}\"\napply ns_induct\napply auto\ntxt\\<open>Fake, NS1 are non-trivial\\<close>\ndone\n\ntext\\<open>Unicity for NS1: nonce NA identifies agents A and B\\<close>\nlemma unique_NA:\n     \"[| Crypt(pubK B)  \\<lbrace>Nonce NA, Agent A\\<rbrace> \\<in> parts(spies s);\n         Crypt(pubK B') \\<lbrace>Nonce NA, Agent A'\\<rbrace> \\<in> parts(spies s);\n         Nonce NA \\<notin> analz (spies s);\n         s \\<in> reachable Nprg |]\n      ==> A=A' & B=B'\"\nby (blast dest: unique_NA_lemma [THEN Always_Collect_reachableD])\n\n\ntext\\<open>Secrecy: Spy does not see the nonce sent in msg NS1 if A and B are secure\\<close>\nlemma Spy_not_see_NA:\n     \"[| A \\<notin> bad;  B \\<notin> bad |]\n  ==> Nprg \\<in> Always\n              {s. Says A B (Crypt(pubK B) \\<lbrace>Nonce NA, Agent A\\<rbrace>) \\<in> set s\n                  --> Nonce NA \\<notin> analz (spies s)}\"\napply ns_induct\ntxt\\<open>NS3\\<close>\nprefer 4 apply (blast intro: no_nonce_NS1_NS2_reachable)\ntxt\\<open>NS2\\<close>\nprefer 3 apply (blast dest: unique_NA)\ntxt\\<open>NS1\\<close>\nprefer 2 apply blast\ntxt\\<open>Fake\\<close>\napply spy_analz\ndone\n\n\ntext\\<open>Authentication for A: if she receives message 2 and has used NA\n  to start a run, then B has sent message 2.\\<close>\nlemma A_trusts_NS2:\n \"[| A \\<notin> bad;  B \\<notin> bad |]\n  ==> Nprg \\<in> Always\n              {s. Says A B (Crypt(pubK B) \\<lbrace>Nonce NA, Agent A\\<rbrace>) \\<in> set s &\n                  Crypt(pubK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace> \\<in> parts (knows Spy s)\n         --> Says B A (Crypt(pubK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) \\<in> set s}\"\n  (*insert an invariant for use in some of the subgoals*)\napply (insert Spy_not_see_NA [of A B NA], simp, ns_induct)\napply (auto dest: unique_NA)\ndone\n\n\ntext\\<open>If the encrypted message appears then it originated with Alice in NS1\\<close>\nlemma B_trusts_NS1:\n     \"Nprg \\<in> Always\n              {s. Nonce NA \\<notin> analz (spies s) -->\n                  Crypt (pubK B) \\<lbrace>Nonce NA, Agent A\\<rbrace> \\<in> parts (spies s)\n         --> Says A B (Crypt (pubK B) \\<lbrace>Nonce NA, Agent A\\<rbrace>) \\<in> set s}\"\napply ns_induct\napply blast\ndone\n\n\nsubsection\\<open>Authenticity properties obtained from NS2\\<close>\n\ntext\\<open>Unicity for NS2: nonce NB identifies nonce NA and agent A.\n   Proof closely follows that of \\<open>unique_NA\\<close>.\\<close>\nlemma unique_NB_lemma:\n \"Nprg\n  \\<in> Always {s. Nonce NB \\<notin> analz (spies s)  -->\n                Crypt (pubK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace> \\<in> parts (spies s) -->\n                Crypt(pubK A') \\<lbrace>Nonce NA', Nonce NB\\<rbrace> \\<in> parts(spies s) -->\n                A=A' & NA=NA'}\"\napply ns_induct\napply auto\ntxt\\<open>Fake, NS2 are non-trivial\\<close>\ndone\n\nlemma unique_NB:\n     \"[| Crypt(pubK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace> \\<in> parts(spies s);\n         Crypt(pubK A') \\<lbrace>Nonce NA', Nonce NB\\<rbrace> \\<in> parts(spies s);\n         Nonce NB \\<notin> analz (spies s);\n         s \\<in> reachable Nprg |]\n      ==> A=A' & NA=NA'\"\napply (blast dest: unique_NB_lemma [THEN Always_Collect_reachableD])\ndone\n\n\ntext\\<open>NB remains secret PROVIDED Alice never responds with round 3\\<close>\nlemma Spy_not_see_NB:\n     \"[| A \\<notin> bad;  B \\<notin> bad |]\n  ==> Nprg \\<in> Always\n              {s. Says B A (Crypt (pubK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) \\<in> set s &\n                  (\\<forall>C. Says A C (Crypt (pubK C) (Nonce NB)) \\<notin> set s)\n                  --> Nonce NB \\<notin> analz (spies s)}\"\napply ns_induct\napply (simp_all (no_asm_simp) add: all_conj_distrib)\ntxt\\<open>NS3: because NB determines A\\<close>\nprefer 4 apply (blast dest: unique_NB)\ntxt\\<open>NS2: by freshness and unicity of NB\\<close>\nprefer 3 apply (blast intro: no_nonce_NS1_NS2_reachable)\ntxt\\<open>NS1: by freshness\\<close>\nprefer 2 apply blast\ntxt\\<open>Fake\\<close>\napply spy_analz\ndone\n\n\n\ntext\\<open>Authentication for B: if he receives message 3 and has used NB\n  in message 2, then A has sent message 3--to somebody....\\<close>\nlemma B_trusts_NS3:\n     \"[| A \\<notin> bad;  B \\<notin> bad |]\n  ==> Nprg \\<in> Always\n              {s. Crypt (pubK B) (Nonce NB) \\<in> parts (spies s) &\n                  Says B A  (Crypt (pubK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) \\<in> set s\n                  --> (\\<exists>C. Says A C (Crypt (pubK C) (Nonce NB)) \\<in> set s)}\"\n  (*insert an invariant for use in some of the subgoals*)\napply (insert Spy_not_see_NB [of A B NA NB], simp, ns_induct)\napply (simp_all (no_asm_simp) add: ex_disj_distrib)\napply auto\ntxt\\<open>NS3: because NB determines A. This use of \\<open>unique_NB\\<close> is robust.\\<close>\napply (blast intro: unique_NB [THEN conjunct1])\ndone\n\n\ntext\\<open>Can we strengthen the secrecy theorem?  NO\\<close>\nlemma \"[| A \\<notin> bad;  B \\<notin> bad |]\n  ==> Nprg \\<in> Always\n              {s. Says B A (Crypt (pubK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) \\<in> set s\n                  --> Nonce NB \\<notin> analz (spies s)}\"\napply ns_induct\napply auto\ntxt\\<open>Fake\\<close>\napply spy_analz\ntxt\\<open>NS2: by freshness and unicity of NB\\<close>\n apply (blast intro: no_nonce_NS1_NS2_reachable)\ntxt\\<open>NS3: unicity of NB identifies A and NA, but not B\\<close>\napply (frule_tac A'=A in Says_imp_spies [THEN parts.Inj, THEN unique_NB])\napply (erule Says_imp_spies [THEN parts.Inj], auto)\napply (rename_tac s B' C)\ntxt\\<open>This is the attack!\n@{subgoals[display,indent=0,margin=65]}\n\\<close>\noops\n\n\n(*\nTHIS IS THE ATTACK!\n[| A \\<notin> bad; B \\<notin> bad |]\n==> Nprg\n   \\<in> Always\n       {s. Says B A (Crypt (pubK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) \\<in> set s -->\n           Nonce NB \\<notin> analz (knows Spy s)}\n 1. !!s B' C.\n       [| A \\<notin> bad; B \\<notin> bad; s \\<in> reachable Nprg\n          Says A C (Crypt (pubK C) \\<lbrace>Nonce NA, Agent A\\<rbrace>) \\<in> set s;\n          Says B' A (Crypt (pubK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) \\<in> set s;\n          C \\<in> bad; Says B A (Crypt (pubK A) \\<lbrace>Nonce NA, Nonce NB\\<rbrace>) \\<in> set s;\n          Nonce NB \\<notin> analz (knows Spy s) |]\n       ==> False\n*)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/UNITY/Simple/NSP_Bad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665855647395, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3125228834232372}}
{"text": "section\\<open>Lambda-replacements required for cardinal inequalities\\<close>\n\ntheory Replacement_Lepoll\n  imports\n    ZF_Library_Relative\nbegin\n\ndefinition\n  lepoll_assumptions1 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions1(M,A,F,S,fa,K,x,f,r) \\<equiv> \\<forall>x\\<in>S. strong_replacement(M, \\<lambda>y z. y \\<in> F(A, x) \\<and> z = {\\<langle>x, y\\<rangle>})\"\n\ndefinition\n  lepoll_assumptions2 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions2(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement(M, \\<lambda>x z. z = Sigfun(x, F(A)))\"\n\ndefinition\n  lepoll_assumptions3 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions3(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement(M, \\<lambda>x y. y = F(A, x))\"\n\ndefinition\n  lepoll_assumptions4 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions4(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement(M, \\<lambda>x y. y = \\<langle>x, minimum(r, F(A, x))\\<rangle>)\"\n\ndefinition\n  lepoll_assumptions5 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions5(M,A,F,S,fa,K,x,f,r) \\<equiv>\nstrong_replacement(M, \\<lambda>x y. y = \\<langle>x, \\<mu> i. x \\<in> F(A, i), f ` (\\<mu> i. x \\<in> F(A, i)) ` x\\<rangle>)\"\n\ndefinition\n  lepoll_assumptions6 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions6(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement(M, \\<lambda>y z. y \\<in> inj\\<^bsup>M\\<^esup>(F(A, x),S) \\<and> z = {\\<langle>x, y\\<rangle>})\"\n\ndefinition\n  lepoll_assumptions7 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions7(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement(M, \\<lambda>x y. y = inj\\<^bsup>M\\<^esup>(F(A, x),S))\"\n\ndefinition\n  lepoll_assumptions8 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions8(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement(M, \\<lambda>x z. z = Sigfun(x, \\<lambda>i. inj\\<^bsup>M\\<^esup>(F(A, i),S)))\"\n\ndefinition\n  lepoll_assumptions9 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions9(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement(M, \\<lambda>x y. y = \\<langle>x, minimum(r, inj\\<^bsup>M\\<^esup>(F(A, x),S))\\<rangle>)\"\n\ndefinition\n  lepoll_assumptions10 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions10(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement\n           (M, \\<lambda>x z. z = Sigfun(x, \\<lambda>k. if k \\<in> range(f) then F(A, converse(f) ` k) else 0))\"\n\ndefinition\n  lepoll_assumptions11 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions11(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement(M, \\<lambda>x y. y = (if x \\<in> range(f) then F(A, converse(f) ` x) else 0))\"\n\ndefinition\n  lepoll_assumptions12 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions12(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement(M, \\<lambda>y z. y \\<in> F(A, converse(f) ` x) \\<and> z = {\\<langle>x, y\\<rangle>})\"\n\ndefinition\n  lepoll_assumptions13 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions13(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement\n         (M, \\<lambda>x y. y = \\<langle>x, minimum(r, if x \\<in> range(f) then F(A,converse(f) ` x) else 0)\\<rangle>)\"\n\ndefinition\n  lepoll_assumptions14 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions14(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement\n         (M, \\<lambda>x y. y = \\<langle>x, \\<mu> i. x \\<in> (if i \\<in> range(f) then F(A, converse(f) ` i) else 0),\n                        fa ` (\\<mu> i. x \\<in> (if i \\<in> range(f) then F(A, converse(f) ` i) else 0)) ` x\\<rangle>)\"\n\ndefinition\n  lepoll_assumptions15 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions15(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement\n         (M, \\<lambda>y z. y \\<in> inj\\<^bsup>M\\<^esup>(if x \\<in> range(f) then F(A, converse(f) ` x) else 0,K) \\<and> z = {\\<langle>x, y\\<rangle>})\"\n\ndefinition\n  lepoll_assumptions16 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions16(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement(M, \\<lambda>x y. y = inj\\<^bsup>M\\<^esup>(if x \\<in> range(f) then F(A, converse(f) ` x) else 0,K))\"\n\ndefinition\n  lepoll_assumptions17 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions17(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement\n             (M, \\<lambda>x z. z = Sigfun(x, \\<lambda>i. inj\\<^bsup>M\\<^esup>(if i \\<in> range(f) then F(A, converse(f) ` i) else 0,K)))\"\n\ndefinition\n  lepoll_assumptions18 :: \"[i\\<Rightarrow>o,i,[i,i]\\<Rightarrow>i,i,i,i,i,i,i] \\<Rightarrow> o\" where\n  \"lepoll_assumptions18(M,A,F,S,fa,K,x,f,r) \\<equiv> strong_replacement\n         (M, \\<lambda>x y. y = \\<langle>x, minimum(r, inj\\<^bsup>M\\<^esup>(if x \\<in> range(f) then F(A, converse(f) ` x) else 0,K))\\<rangle>)\"\n\nlemmas lepoll_assumptions_defs[simp] = lepoll_assumptions1_def\n  lepoll_assumptions2_def lepoll_assumptions3_def lepoll_assumptions4_def\n  lepoll_assumptions5_def lepoll_assumptions6_def lepoll_assumptions7_def\n  lepoll_assumptions8_def lepoll_assumptions9_def lepoll_assumptions10_def\n  lepoll_assumptions11_def lepoll_assumptions12_def lepoll_assumptions13_def\n  lepoll_assumptions14_def lepoll_assumptions15_def lepoll_assumptions16_def\n  lepoll_assumptions17_def lepoll_assumptions18_def\n\ndefinition if_range_F where\n  [simp]: \"if_range_F(H,f,i) \\<equiv> if i \\<in> range(f) then H(converse(f) ` i) else 0\"\n\ndefinition if_range_F_else_F where\n  \"if_range_F_else_F(H,b,f,i) \\<equiv> if b=0 then if_range_F(H,f,i) else H(i)\"\n\nlemma (in M_basic) lam_Least_assumption_general:\n  assumes\n    separations:\n    \"\\<forall>A'[M]. separation(M, \\<lambda>y. \\<exists>x\\<in>A'. y = \\<langle>x, \\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i)\\<rangle>)\"\n    and\n    mem_F_bound:\"\\<And>x c. x\\<in>F(A,c) \\<Longrightarrow> c \\<in> range(f) \\<union> U(A)\"\n    and\n    types:\"M(A)\" \"M(b)\" \"M(f)\" \"M(U(A))\"\n  shows \"lam_replacement(M,\\<lambda>x . \\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i))\"\nproof -\n  have \"\\<forall>x\\<in>X. (\\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i)) \\<in>\n    Pow\\<^bsup>M\\<^esup>(\\<Union>(X \\<union> range(f) \\<union> U(A)))\" if \"M(X)\" for X\n  proof\n    fix x\n    assume \"x\\<in>X\"\n    moreover\n    note \\<open>M(X)\\<close>\n    moreover from calculation\n    have \"M(x)\" by (auto dest:transM)\n    moreover\n    note assms\n    ultimately\n    show \"(\\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i)) \\<in>\n        Pow\\<^bsup>M\\<^esup>(\\<Union>(X \\<union> range(f) \\<union> U(A)))\"\n    proof (rule_tac Least_in_Pow_rel_Union, cases \"b=0\", simp_all)\n      case True\n      fix c\n      assume asm:\"x \\<in> if_range_F_else_F(F(A), 0, f, c)\"\n      with mem_F_bound\n      show \"c\\<in>X \\<or> c \\<in> range(f) \\<or> c \\<in> U(A)\"\n        unfolding if_range_F_else_F_def if_range_F_def by (cases \"c\\<in>range(f)\") auto\n    next\n      case False\n      fix c\n      assume \"x \\<in> if_range_F_else_F(F(A), b, f, c)\"\n      with False mem_F_bound[of x c]\n      show \"c\\<in>X \\<or> c \\<in> range(f) \\<or> c\\<in>U(A)\"\n        unfolding if_range_F_else_F_def if_range_F_def by auto\n    qed\n  qed\n  with assms\n  show ?thesis\n    using bounded_lam_replacement[of \"\\<lambda>x.(\\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i))\"\n        \"\\<lambda>X. Pow\\<^bsup>M\\<^esup>(\\<Union>(X \\<union> range(f) \\<union> U(A)))\"] by simp\nqed\n\nlemma (in M_basic) lam_Least_assumption_ifM_b0:\n  fixes F\n  defines \"F \\<equiv> \\<lambda>_ x. if M(x) then x else 0\"\n  assumes\n    separations:\n    \"\\<forall>A'[M]. separation(M, \\<lambda>y. \\<exists>x\\<in>A'. y = \\<langle>x, \\<mu> i. x \\<in> if_range_F_else_F(F(A),0,f,i)\\<rangle>)\"\n    and\n    types:\"M(A)\" \"M(f)\"\n  shows \"lam_replacement(M,\\<lambda>x . \\<mu> i. x \\<in> if_range_F_else_F(F(A),0,f,i))\"\n    (is \"lam_replacement(M,\\<lambda>x . Least(?P(x)))\")\nproof -\n  {\n    fix x X\n    assume \"M(X)\" \"x\\<in>X\" \"(\\<mu> i. ?P(x,i)) \\<noteq> 0\"\n    moreover from this\n    obtain m where \"Ord(m)\" \"?P(x,m)\"\n      using Least_0[of \"?P(_)\"] by auto\n    moreover\n    note assms\n    moreover\n    have \"?P(x,i) \\<longleftrightarrow> (M(converse(f) ` i) \\<and> i \\<in> range(f) \\<and> x \\<in> converse(f) ` i)\"  for i\n      unfolding F_def if_range_F_else_F_def if_range_F_def by auto\n    ultimately\n    have \"(\\<mu> i. ?P(x,i)) \\<in> range (f)\"\n      unfolding F_def if_range_F_else_F_def if_range_F_def\n      by (rule_tac LeastI2) auto\n  }\n  with assms\n  show ?thesis\n    by (rule_tac bounded_lam_replacement[of _ \"\\<lambda>X. range(f) \\<union> {0}\"]) auto\nqed\n\nlemma (in M_replacement) lam_Least_assumption_ifM_bnot0:\n  fixes F\n  defines \"F \\<equiv> \\<lambda>_ x. if M(x) then x else 0\"\n  assumes\n    lam_replacement_minimum:\"lam_replacement(M, \\<lambda>p. minimum(fst(p),snd(p)))\"\n    and\n    separations:\n    \"\\<forall>A'[M]. separation(M, \\<lambda>y. \\<exists>x\\<in>A'. y = \\<langle>x, \\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i)\\<rangle>)\"\n    \"separation(M,Ord)\"\n    and\n    types:\"M(A)\" \"M(f)\"\n    and\n    \"b\\<noteq>0\"\n  shows \"lam_replacement(M,\\<lambda>x . \\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i))\"\n    (is \"lam_replacement(M,\\<lambda>x . Least(?P(x)))\")\nproof -\n  have \"M(x) \\<Longrightarrow>(\\<mu> i. (M(i) \\<longrightarrow> x \\<in> i) \\<and> M(i)) = (if Ord(x) then succ(x) else 0)\" for x\n    using Ord_in_Ord\n    apply (auto intro:Least_0, rule_tac Least_equality, simp_all)\n    by (frule lt_Ord) (auto dest:le_imp_not_lt[of _ x] intro:ltI[of x])\n  moreover\n  have \"lam_replacement(M, \\<lambda>x. if Ord(x) then succ(x) else 0)\"\n    using lam_replacement_if[OF _ _ separations(2)] lam_replacement_identity\n      lam_replacement_constant lam_replacement_hcomp lam_replacement_succ\n    by simp\n  moreover\n  note types \\<open>b\\<noteq>0\\<close>\n  ultimately\n  show ?thesis\n    using lam_replacement_cong\n    unfolding F_def if_range_F_else_F_def if_range_F_def\n    by auto\nqed\n\nlemma (in M_replacement) lam_Least_assumption_drSR_Y:\n  fixes F r' D\n  defines \"F \\<equiv> drSR_Y(r',D)\"\n  assumes \"\\<forall>A'[M]. separation(M, \\<lambda>y. \\<exists>x\\<in>A'. y = \\<langle>x, \\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i)\\<rangle>)\"\n    \"M(A)\" \"M(b)\" \"M(f)\" \"M(r')\"\n    and\n    lam_replacement_minimum:\"lam_replacement(M, \\<lambda>p. minimum(fst(p),snd(p)))\"\n  shows \"lam_replacement(M,\\<lambda>x . \\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i))\"\nproof -\n  from assms(2-)\n  have [simp]: \"M(X) \\<Longrightarrow> M(X \\<union> range(f) \\<union> {domain(x) . x \\<in> A})\"\n    \"M(r') \\<Longrightarrow> M(X) \\<Longrightarrow> M({restrict(x,r') . x \\<in> A})\"\n    for X r'\n    using lam_replacement_domain[THEN lam_replacement_imp_strong_replacement,\n        THEN RepFun_closed, of A]\n      lam_replacement_restrict'[THEN lam_replacement_imp_strong_replacement,\n        THEN RepFun_closed, of r' A] by (auto dest:transM)\n  have \"\\<forall>x\\<in>X. (\\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i)) \\<in>\n    Pow\\<^bsup>M\\<^esup>(\\<Union>(X \\<union> range(f) \\<union> {domain(x). x\\<in>A} \\<union> {restrict(x,r'). x\\<in>A} \\<union> domain(A) \\<union> range(A) \\<union> \\<Union>A))\" if \"M(X)\" for X\n  proof\n    fix x\n    assume \"x\\<in>X\"\n    moreover\n    note \\<open>M(X)\\<close>\n    moreover from calculation\n    have \"M(x)\" by (auto dest:transM)\n    moreover\n    note assms(2-)\n    ultimately\n    show \"(\\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i)) \\<in>\n        Pow\\<^bsup>M\\<^esup>(\\<Union>(X \\<union> range(f) \\<union> {domain(x). x\\<in>A} \\<union> {restrict(x,r'). x\\<in>A} \\<union> domain(A) \\<union> range(A) \\<union> \\<Union>A))\"\n      unfolding if_range_F_else_F_def if_range_F_def\n    proof (rule_tac Least_in_Pow_rel_Union, simp_all,cases \"b=0\", simp_all)\n      case True\n      fix c\n      assume asm:\"x \\<in> (if c \\<in> range(f) then F(A, converse(f) ` c) else 0)\"\n      then\n      show \"c\\<in>X \\<or> c\\<in>range(f) \\<or> (\\<exists>x\\<in>A. c = domain(x)) \\<or> (\\<exists>x\\<in>A. c = restrict(x,r')) \\<or> c \\<in> domain(A) \\<or> c \\<in> range(A) \\<or> (\\<exists>x\\<in>A. c\\<in>x)\" by auto\n    next\n      case False\n      fix c\n      assume \"x \\<in> F(A, c)\"\n      then\n      show \"c\\<in>X \\<or> c\\<in>range(f) \\<or> (\\<exists>x\\<in>A. c = domain(x)) \\<or> (\\<exists>x\\<in>A. c = restrict(x,r')) \\<or> c \\<in> domain(A) \\<or> c \\<in> range(A) \\<or> (\\<exists>x\\<in>A. c\\<in>x)\"\n        using apply_0\n        by (cases \"M(c)\", auto simp:F_def drSR_Y_def dC_F_def)\n    qed\n  qed\n  with assms(2-)\n  show ?thesis\n    using bounded_lam_replacement[of \"\\<lambda>x.(\\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i))\"\n        \"\\<lambda>X. Pow\\<^bsup>M\\<^esup>(\\<Union>(X \\<union> range(f) \\<union> {domain(x). x\\<in>A} \\<union> {restrict(x,r'). x\\<in>A} \\<union> domain(A) \\<union> range(A) \\<union> \\<Union>A))\"] by simp\nqed\n\nlocale M_replacement_lepoll = M_replacement + M_inj +\n  fixes F\n  assumes\n    F_type[simp]: \"M(A) \\<Longrightarrow> \\<forall>x[M]. M(F(A,x))\"\n    and\n    lam_lepoll_assumption_F:\"M(A) \\<Longrightarrow> lam_replacement(M,F(A))\"\n    and\n    \\<comment> \\<open>Here b is a Boolean.\\<close>\n    lam_Least_assumption:\"M(A) \\<Longrightarrow> M(b) \\<Longrightarrow> M(f) \\<Longrightarrow>\n        lam_replacement(M,\\<lambda>x . \\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i))\"\n    and\n    F_args_closed: \"M(A) \\<Longrightarrow> M(x) \\<Longrightarrow> x \\<in> F(A,i) \\<Longrightarrow> M(i)\"\n    and\n    lam_replacement_inj_rel:\"lam_replacement(M, \\<lambda>p. inj\\<^bsup>M\\<^esup>(fst(p),snd(p)))\"\n    and\n    lam_replacement_minimum:\"lam_replacement(M, \\<lambda>p. minimum(fst(p),snd(p)))\"\nbegin\n\ndeclare if_range_F_else_F_def[simp]\n\nlemma lepoll_assumptions1:\n  assumes types[simp]:\"M(A)\" \"M(S)\"\n  shows \"lepoll_assumptions1(M,A,F,S,fa,K,x,f,r)\"\n  using strong_replacement_separation[OF lam_replacement_sing_const_id separation_in_constant]\n    transM[of _ S]\n  by simp\n\nlemma lepoll_assumptions2:\n  assumes types[simp]:\"M(A)\" \"M(S)\"\n  shows \"lepoll_assumptions2(M,A,F,S,fa,K,x,f,r)\"\n  using lam_replacement_Sigfun lam_replacement_imp_strong_replacement\n    assms lam_lepoll_assumption_F\n  by simp\n\nlemma lepoll_assumptions3:\n  assumes types[simp]:\"M(A)\"\n  shows \"lepoll_assumptions3(M,A,F,S,fa,K,x,f,r)\"\n  using lam_lepoll_assumption_F[THEN lam_replacement_imp_strong_replacement]\n  by simp\n\nlemma lepoll_assumptions4:\n  assumes types[simp]:\"M(A)\" \"M(r)\"\n  shows \"lepoll_assumptions4(M,A,F,S,fa,K,x,f,r)\"\n  using lam_replacement_minimum lam_replacement_constant lam_lepoll_assumption_F\n  unfolding lepoll_assumptions_defs\n    lam_replacement_def[symmetric]\n  by (rule_tac lam_replacement_hcomp2[of _ _ minimum])\n    (force intro: lam_replacement_identity)+\n\nlemma lam_Least_closed :\n  assumes \"M(A)\" \"M(b)\" \"M(f)\"\n  shows \"\\<forall>x[M]. M(\\<mu> i. x \\<in> if_range_F_else_F(F(A),b,f,i))\"\nproof -\n  have \"x \\<in> (if i \\<in> range(f) then F(A, converse(f) ` i) else 0) \\<Longrightarrow> M(i)\" for x i\n  proof (cases \"i\\<in>range(f)\")\n    case True\n    with \\<open>M(f)\\<close>\n    show ?thesis by (auto dest:transM)\n  next\n    case False\n    moreover\n    assume \"x \\<in> (if i \\<in> range(f) then F(A, converse(f) ` i) else 0)\"\n    ultimately\n    show ?thesis\n      by auto\n  qed\n  with assms\n  show ?thesis\n    using F_args_closed[of A] unfolding if_range_F_else_F_def if_range_F_def\n    by (clarify, rule_tac Least_closed', cases \"b=0\") simp_all\nqed\n\nlemma lepoll_assumptions5:\n  assumes\n    types[simp]:\"M(A)\" \"M(f)\"\n  shows \"lepoll_assumptions5(M,A,F,S,fa,K,x,f,r)\"\n  using\n    lam_replacement_apply2[THEN [5] lam_replacement_hcomp2]\n    lam_replacement_hcomp[OF _ lam_replacement_apply[of f]]\n    lam_replacement_identity\n    lam_replacement_product lam_Least_closed[where b=1]\n    assms lam_Least_assumption[where b=1,OF \\<open>M(A)\\<close> _ \\<open>M(f)\\<close>]\n  unfolding lepoll_assumptions_defs\n    lam_replacement_def[symmetric]\n  by simp\n\nlemma lepoll_assumptions6:\n  assumes types[simp]:\"M(A)\" \"M(S)\" \"M(x)\"\n  shows \"lepoll_assumptions6(M,A,F,S,fa,K,x,f,r)\"\n  using strong_replacement_separation[OF lam_replacement_sing_const_id separation_in_constant]\n    lam_replacement_inj_rel\n  by simp\n\nlemma lepoll_assumptions7:\n  assumes types[simp]:\"M(A)\" \"M(S)\" \"M(x)\"\n  shows \"lepoll_assumptions7(M,A,F,S,fa,K,x,f,r)\"\n  using lam_replacement_constant lam_lepoll_assumption_F lam_replacement_inj_rel\n  unfolding lepoll_assumptions_defs\n  by (rule_tac lam_replacement_imp_strong_replacement)\n    (rule_tac lam_replacement_hcomp2[of _ _ \"inj_rel(M)\"], simp_all)\n\nlemma lepoll_assumptions8:\n  assumes types[simp]:\"M(A)\" \"M(S)\"\n  shows \"lepoll_assumptions8(M,A,F,S,fa,K,x,f,r)\"\n  using lam_replacement_Sigfun lam_replacement_imp_strong_replacement\n    lam_replacement_inj_rel lam_replacement_constant\n    lam_replacement_hcomp2[of _ _ \"inj_rel(M)\",OF lam_lepoll_assumption_F[of A]]\n  by simp\n\nlemma lepoll_assumptions9:\n  assumes types[simp]:\"M(A)\" \"M(S)\" \"M(r)\"\n  shows \"lepoll_assumptions9(M,A,F,S,fa,K,x,f,r)\"\n  using lam_replacement_minimum lam_replacement_constant lam_lepoll_assumption_F\n    lam_replacement_hcomp2[of _ _ \"inj_rel(M)\"] lam_replacement_inj_rel lepoll_assumptions4\n  unfolding lepoll_assumptions_defs lam_replacement_def[symmetric]\n  by (rule_tac lam_replacement_hcomp2[of _ _ minimum])\n    (force intro: lam_replacement_identity)+\n\nlemma lepoll_assumptions10:\n  assumes types[simp]:\"M(A)\" \"M(f)\"\n  shows \"lepoll_assumptions10(M,A,F,S,fa,K,x,f,r)\"\n  using lam_replacement_Sigfun lam_replacement_imp_strong_replacement\n    lam_replacement_constant[OF nonempty]\n    lam_replacement_if[OF _ _ separation_in_constant]\n    lam_replacement_hcomp\n    lam_replacement_apply[OF converse_closed[OF \\<open>M(f)\\<close>]]\n    lam_lepoll_assumption_F[of A]\n  by simp\n\nlemma lepoll_assumptions11:\n  assumes types[simp]:\"M(A)\" \"M(f)\"\n  shows \"lepoll_assumptions11(M, A, F, S, fa, K, x, f, r)\"\n  using lam_replacement_imp_strong_replacement\n    lam_replacement_if[OF _ _ separation_in_constant[of \"range(f)\"]]\n    lam_replacement_constant\n    lam_replacement_hcomp lam_replacement_apply\n    lam_lepoll_assumption_F\n  by simp\n\nlemma lepoll_assumptions12:\n  assumes types[simp]:\"M(A)\" \"M(x)\" \"M(f)\"\n  shows \"lepoll_assumptions12(M,A,F,S,fa,K,x,f,r)\"\n  using strong_replacement_separation[OF lam_replacement_sing_const_id separation_in_constant]\n  by simp\n\nlemma lepoll_assumptions13:\n  assumes types[simp]:\"M(A)\" \"M(r)\" \"M(f)\"\n  shows \"lepoll_assumptions13(M,A,F,S,fa,K,x,f,r)\"\n  using  lam_replacement_constant[OF nonempty] lam_lepoll_assumption_F\n    lam_replacement_hcomp lam_replacement_apply\n    lam_replacement_hcomp2[OF lam_replacement_constant[OF \\<open>M(r)\\<close>]\n      lam_replacement_if[OF _ _ separation_in_constant[of \"range(f)\"]] _ _\n      lam_replacement_minimum] assms\n  unfolding lepoll_assumptions_defs\n    lam_replacement_def[symmetric]\n  by simp\n\nlemma lepoll_assumptions14:\n  assumes types[simp]:\"M(A)\" \"M(f)\" \"M(fa)\"\n  shows \"lepoll_assumptions14(M,A,F,S,fa,K,x,f,r)\"\n  using\n    lam_replacement_apply2[THEN [5] lam_replacement_hcomp2]\n    lam_replacement_hcomp[OF _ lam_replacement_apply[of fa]]\n    lam_replacement_identity\n    lam_replacement_product  lam_Least_closed[where b=0]\n    assms lam_Least_assumption[where b=0,OF \\<open>M(A)\\<close> _ \\<open>M(f)\\<close>]\n  unfolding lepoll_assumptions_defs\n    lam_replacement_def[symmetric]\n  by simp\n\nlemma lepoll_assumptions15:\n  assumes types[simp]:\"M(A)\" \"M(x)\" \"M(f)\" \"M(K)\"\n  shows \"lepoll_assumptions15(M,A,F,S,fa,K,x,f,r)\"\n  using strong_replacement_separation[OF lam_replacement_sing_const_id separation_in_constant]\n  by simp\n\nlemma lepoll_assumptions16:\n  assumes types[simp]:\"M(A)\" \"M(f)\" \"M(K)\"\n  shows \"lepoll_assumptions16(M,A,F,S,fa,K,x,f,r)\"\n  using lam_replacement_imp_strong_replacement\n    lam_replacement_inj_rel lam_replacement_constant\n    lam_replacement_hcomp2[of _ _ \"inj_rel(M)\"]\n    lam_replacement_constant[OF nonempty]\n    lam_replacement_if[OF _ _ separation_in_constant]\n    lam_replacement_hcomp\n    lam_replacement_apply[OF converse_closed[OF \\<open>M(f)\\<close>]]\n    lam_lepoll_assumption_F[of A]\n  by simp\n\nlemma lepoll_assumptions17:\n  assumes types[simp]:\"M(A)\" \"M(f)\" \"M(K)\"\n  shows \"lepoll_assumptions17(M,A,F,S,fa,K,x,f,r)\"\n  using lam_replacement_Sigfun lam_replacement_imp_strong_replacement\n    lam_replacement_inj_rel lam_replacement_constant\n    lam_replacement_hcomp2[of _ _ \"inj_rel(M)\"]\n    lam_replacement_constant[OF nonempty]\n    lam_replacement_if[OF _ _ separation_in_constant]\n    lam_replacement_hcomp\n    lam_replacement_apply[OF converse_closed[OF \\<open>M(f)\\<close>]]\n    lam_lepoll_assumption_F[of A]\n  by simp\n\nlemma lepoll_assumptions18:\n  assumes types[simp]:\"M(A)\" \"M(K)\" \"M(f)\" \"M(r)\"\n  shows \"lepoll_assumptions18(M,A,F,S,fa,K,x,f,r)\"\n  using lam_replacement_constant lam_replacement_inj_rel lam_lepoll_assumption_F\n    lam_replacement_minimum lam_replacement_identity lam_replacement_apply2 separation_in_constant\n  unfolding lepoll_assumptions18_def lam_replacement_def[symmetric]\n  by (rule_tac lam_replacement_hcomp2[of _ _ minimum], simp_all,\n      rule_tac lam_replacement_hcomp2[of _ _ \"inj_rel(M)\"], simp_all)\n    (rule_tac lam_replacement_if, rule_tac lam_replacement_hcomp[of _ \"F(A)\"],\n      rule_tac lam_replacement_hcomp2[of _ _ \"(`)\"], simp_all)\n\nlemmas lepoll_assumptions = lepoll_assumptions1 lepoll_assumptions2\n  lepoll_assumptions3 lepoll_assumptions4 lepoll_assumptions5\n  lepoll_assumptions6 lepoll_assumptions7 lepoll_assumptions8\n  lepoll_assumptions9 lepoll_assumptions10 lepoll_assumptions11\n  lepoll_assumptions12 lepoll_assumptions13 lepoll_assumptions14\n  lepoll_assumptions15 lepoll_assumptions16\n  lepoll_assumptions17 lepoll_assumptions18\n\nend \\<comment> \\<open>\\<^locale>\\<open>M_replacement_lepoll\\<close>\\<close>\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Transitive_Models/Replacement_Lepoll.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5926665855647394, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.31252288342323714}}
{"text": "(*\n   Copyright 2017 Sidney Amani\n   Copyright 2017 Maksym Bortin\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n*)\ntheory EvmFacts\n  imports \"lem/Evm\"\n      \"Hoare/Hoare\"\nbegin\n\nlemmas gas_simps = Gverylow_def Glow_def Gmid_def Gbase_def Gzero_def Glogtopic_def \n    Gsha3word_def Gsha3_def Gextcode_def Gcopy_def Gblockhash_def Gexpbyte_def Gexp_def\n    Gbalance_def Gsload_def Gsreset_def Gsset_def Gjumpdest_def Ghigh_def\n    Glogdata_def  Glog_def Gcreate_def Ccall_def \n    Cgascap_def Cextra_def Gnewaccount_def Cxfer_def Cnew_def\n    Gcall_def Gcallvalue_def Csstore_def Csuicide_def\n\nlemma log256floor_ge_0:\n  \"0 \\<le> log256floor s\"\n  apply (induct s rule: log256floor.induct)\n  subgoal for x\n    by (case_tac \"\\<not> x \\<le> 255\")\n       (clarsimp simp: log256floor.simps)+\n  done\ndeclare  log256floor.simps[simp del ]\n\nlemma Cextra_gt_0:\n  \"0 < Cextra  a b c\"\n  by (simp add:  gas_simps)\n\nlemma Cgascap_gt_0:\n  \" 0 \\<le> Cgascap a b c d e f\"\n  apply (simp add: Cgascap_def L_def )\n  apply clarsimp\n  apply (rule zdiv_le_dividend)\n  apply linarith\n  apply simp\ndone\n(*  by (case_tac \" b = 0\" ; auto simp:L_def gas_simps)+*)\n\nlemma Ccall_gt_0:\n  \"0 < Ccall s0 s1 s2 recipient_empty\n            remaining_gas net mmu_extra\"\n  unfolding Ccall_def\n  using Cextra_gt_0 Cgascap_gt_0\n  by (clarsimp simp add: ordered_comm_monoid_add_class.add_nonneg_pos)+\n\nlemma Csuicide_gt_0:\n  \"Gsuicide net \\<noteq> 0 \\<Longrightarrow> 0 < Csuicide recipient_empty net\"\n  unfolding Csuicide_def\n  by (auto split: if_splits\n           simp add: gas_simps Gsuicide_def)\n\nlemma thirdComponentOfC_gt_0:\n  \"i \\<noteq> Misc STOP \\<Longrightarrow> i \\<noteq> Misc RETURN \\<Longrightarrow> (\\<forall>v. i \\<noteq> Unknown v) \\<Longrightarrow>\n   i = Misc SUICIDE \\<longrightarrow> Gsuicide net \\<noteq> 0 \\<Longrightarrow>\n   i \\<notin>  (if before_homestead net then {Misc DELEGATECALL} else {}) \\<Longrightarrow>\n  0 < thirdComponentOfC  i s0 s1 s2 s3 recipient_empty orig_val new_val remaining_gas net mmu_extra\"\n  unfolding thirdComponentOfC_def\n  apply (case_tac i ; simp add: gas_simps del: Cextra_def )\n           apply (case_tac x2; simp add: gas_simps)\n          apply (case_tac x3; simp add: gas_simps )\n         apply (case_tac x4 ; simp add: gas_simps)\n         using log256floor_ge_0[where s=\"uint s1\"]\n                 apply (simp add: )\n              apply (clarsimp; simp add: word_less_def word_neq_0_conv)\n                apply (case_tac x5; simp add: gas_simps)\n              apply (case_tac x7; simp add: gas_simps)\n                apply (case_tac \"s2 = 0\" ; auto simp: word_less_def word_neq_0_conv)\n                apply (case_tac \"s2 = 0\" ; auto simp: word_less_def word_neq_0_conv)\n              apply (case_tac \"s3 = 0\" ; auto simp: word_less_def word_neq_0_conv)\n            apply (case_tac x8; simp add: gas_simps Csstore_def)\n            apply (case_tac x9; simp add: gas_simps Csstore_def)\n           apply (case_tac x10; simp add: gas_simps Csstore_def)\n          apply ( case_tac x12; case_tac \"s1 = 0\"; \n             simp add: gas_simps word_less_def word_neq_0_conv)\n         apply (clarsimp split: misc_inst.splits)\n         apply (rule conjI, clarsimp simp add: gas_simps L_def)\n         apply (clarsimp simp: Csuicide_gt_0 Ccall_gt_0  split:if_splits)\n         done\n\nlemma Cmem_lift:\n  \"max 0 x \\<le> y \\<Longrightarrow> Cmem (max 0 x) \\<le> Cmem y\"\n  apply (simp add: Cmem_def Gmemory_def)\n  apply (case_tac \"x = y\")\n   apply (clarsimp simp: max_def)\n  apply clarsimp\n  apply (drule (1) order_class.le_neq_trans)\n  apply simp\n  apply (rule add_mono, simp)\n  apply (rule zdiv_mono1[rotated], simp)\n  apply (rule mult_mono ; simp)\n  done\n\nlemma vctx_memory_usage_never_decreases:\n  \"max 0 (vctx_memory_usage v) \\<le> (new_memory_consumption i(max 0 (vctx_memory_usage   v)) (vctx_stack_default(( 0 :: int)) v) (vctx_stack_default(( 1 :: int)) v) (vctx_stack_default(( 2 :: int)) v) (vctx_stack_default(( 3 :: int)) v)\n      (vctx_stack_default(( 4 :: int)) v) (vctx_stack_default(( 5 :: int)) v) (vctx_stack_default(( 6 :: int)) v))\"\napply(case_tac i)\napply(rename_tac x, case_tac x; simp add: new_memory_consumption.simps vctx_stack_default_def M_def max_def)+\ndone\n\nlemma meter_gas_gt_0:\n  \" inst \\<noteq> Misc STOP \\<Longrightarrow>\n    inst \\<noteq> Misc RETURN \\<Longrightarrow>\n    inst \\<noteq> Misc SUICIDE \\<Longrightarrow>\n    inst \\<notin> range Unknown \\<Longrightarrow>\n    inst \\<notin>  (if before_homestead net then {Misc DELEGATECALL} else {}) \\<Longrightarrow>\nprogram_content (cctx_program const) (vctx_pc var) = Some inst \\<Longrightarrow>\n   0 < meter_gas inst var const net\"\n\n  using Cmem_lift[OF\n    vctx_memory_usage_never_decreases[where i=inst and v=var]]\n  apply (clarsimp simp add: C_def meter_gas_def Cmem_def Gmemory_def Let_def)\n  apply(case_tac inst)\napply( simp add: new_memory_consumption.simps vctx_next_instruction_default_def vctx_next_instruction_def;\n   fastforce  intro: ordered_comm_monoid_add_class.add_nonneg_pos \n          thirdComponentOfC_gt_0) +\ndone\n\nlemma subtract_gas_lower_gas:\n   \"subtract_gas m k (InstructionContinue var) = InstructionContinue v\n    \\<Longrightarrow> 0 < m \\<Longrightarrow> vctx_gas v < vctx_gas var \"\n  by (auto simp add: subtract_gas.simps)\n\nlemmas stack_op_simps = stack_0_0_op_def stack_0_1_op_def\n   stack_2_1_op_def stack_1_1_op_def stack_3_1_op_def\n\nlemmas op_simps = mstore8_def mload_def sha3_def\n  general_dup_def mstore_def swap_def ret_def create_def\n  call_def suicide_def calldatacopy_def codecopy_def\n  extcodecopy_def sstore_def jump_def jumpi_def\n  pc_def pop_def log_def callcode_def delegatecall_def\n  \nlemmas instruction_sem_simps =\n  stack_op_simps instruction_failure_result_def\n  subtract_gas.simps vctx_advance_pc_def\n  op_simps vctx_update_storage_def\n  blocked_jump_def blockedInstructionContinue_def\n  strict_if_def vctx_pop_stack_def\n  vctx_next_instruction_def \n\nlemma instruction_sem_not_continuing:\n  \"\\<lbrakk> inst \\<in> {Misc STOP, Misc RETURN, Misc SUICIDE} \\<union> range Unknown \\<rbrakk> \\<Longrightarrow>\n\\<forall>v. instruction_sem var const inst net \\<noteq> InstructionContinue v\"\n  apply (case_tac inst; clarsimp simp: instruction_sem_def instruction_failure_result_def subtract_gas.simps)\n  subgoal for opcode \n   apply (case_tac opcode; simp add: ret_def suicide_def image_def stop_def instruction_sem_def instruction_failure_result_def subtract_gas.simps split:list.splits)\n   done\n  done\n\nlemma instruction_sem_continuing:\n  \"\\<lbrakk> instruction_sem var const inst net = InstructionContinue v \\<rbrakk> \\<Longrightarrow>\ninst \\<notin> {Misc STOP, Misc RETURN, Misc SUICIDE} \\<union> range Unknown \\<union> (if  before_homestead net then {Misc DELEGATECALL} else {})\"\n  apply (case_tac inst; clarsimp simp: instruction_sem_def instruction_failure_result_def subtract_gas.simps)\n  subgoal for opcode\n   apply (case_tac opcode; simp add: ret_def suicide_def image_def stop_def instruction_sem_def instruction_failure_result_def subtract_gas.simps split:list.splits if_split_asm)\n   done\n  done\n\nlemma inst_sem_gas_consume:\n  \"instruction_sem var const inst net = InstructionContinue v \\<Longrightarrow>\n   inst \\<notin> {Misc STOP, Misc RETURN, Misc SUICIDE} \\<union> range Unknown \\<union> (if before_homestead net then {Misc DELEGATECALL} else {}) \\<Longrightarrow>\n  \\<not> vctx_gas var \\<le> 0 \\<Longrightarrow>\n  program_content (cctx_program const) (vctx_pc var) = Some inst \\<Longrightarrow>\n  vctx_gas v < vctx_gas var\"\n  apply (cut_tac meter_gas_gt_0[where inst=inst and var=var and const=const and net=net]; simp)\n  apply (simp only: instruction_sem_def)\n  apply (case_tac inst; clarsimp)\n             apply (case_tac x2 ; clarsimp simp: instruction_sem_simps split:list.splits)\n         apply (case_tac x3 ; clarsimp simp: instruction_sem_simps split:list.splits)\n         apply (case_tac x4 ; clarsimp simp: Let_def instruction_sem_simps split:list.splits if_splits)\n         apply (case_tac x5 ; clarsimp simp: instruction_sem_simps split:list.splits)\n         apply (case_tac x6 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n         apply (case_tac x7 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n         apply (case_tac x8 ; clarsimp simp: instruction_sem_simps split:list.splits option.splits)\n      apply (case_tac x9 ; clarsimp simp: instruction_sem_simps Let_def split:list.splits option.splits pc_inst.splits )\n      apply (case_tac x2; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits)\n       apply (case_tac \"x21a = 0\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n       apply (case_tac \"x2\"; clarsimp simp: instruction_sem_simps Let_def split: pc_inst.splits option.splits)\n     apply (case_tac \"x10\"; clarsimp simp: instruction_sem_simps  split: pc_inst.splits option.splits list.splits)\n     apply (clarsimp simp: instruction_sem_simps  split: pc_inst.splits option.splits)\n     apply (case_tac \"x12\"; clarsimp simp: instruction_sem_simps  split: pc_inst.splits option.splits)\n  apply (case_tac \"x13\"; clarsimp simp: instruction_sem_simps  split: pc_inst.splits option.splits list.splits if_splits)\n    done\n\ntermination program_sem_t\n  apply (relation \"measure (\\<lambda>(c,net,ir). nat (case ir of InstructionContinue v \\<Rightarrow>  vctx_gas v | _ \\<Rightarrow> 0))\")\n   apply (simp)\n  apply clarsimp\n  subgoal for const net var inst\n    apply (case_tac \"instruction_sem var const inst net\" ; simp)\n    apply (clarsimp simp add: check_resources_def prod.case_eq_if )\n     apply (frule instruction_sem_continuing)\n     apply (erule (2) inst_sem_gas_consume)\n  apply (simp add: vctx_next_instruction_def split:option.splits)\n    done\ndone\n    \nlemma program_sem_t_no_gas_not_continuing:\n  \"\\<lbrakk>vctx_gas var \\<le> 0 \\<rbrakk> \\<Longrightarrow>\n\\<forall>v. program_sem_t const net (InstructionContinue var) \\<noteq> InstructionContinue v\"\n  apply (clarsimp simp add: check_resources_def prod.case_eq_if  split:option.split)\n  apply (drule instruction_sem_continuing)\n  subgoal for i inst\n  using meter_gas_gt_0[where inst=i and var=var and const=const and net=net]\n  apply (simp add: vctx_next_instruction_def split:option.splits)\n  done\n done\n\ndeclare program_sem_t.simps[simp del]\ndeclare next_state_def[simp del]\n\nlemma program_sem_t_imp_program_sem:\n  notes if_split[split del]\n  shows\n \"\\<exists>k. program_sem_t const net ir = program_sem (\\<lambda>_. ()) const k net ir\"\n  apply (induct rule:program_sem_t.induct)\n  apply (case_tac p)\n    apply clarify\n    apply (rename_tac c net p inst)\n    apply (drule_tac x=inst in meta_spec)\n    apply (case_tac \"vctx_next_instruction inst c\", simp add: vctx_next_instruction_def split:option.splits)\n    apply (rename_tac nxt_inst)\n    apply (drule_tac x=\"nxt_inst\" in meta_spec)\n    apply (erule meta_impE , simp)\n    apply (erule meta_impE , simp)\n    apply (subst program_sem_t.simps)\n    apply (simp)\n    apply (split if_split)\n    apply (rule conjI)\n    apply clarify\n    apply (drule meta_mp, simp)\n    apply (split if_split)\n    apply (rule conjI)\n     apply clarsimp\n     apply (rule exI[where x=\"Suc 0\"])\n     apply (simp add: program_sem.simps next_state_def )\n    apply (rule impI)\n    apply (clarsimp split:if_split)\n    apply (rule_tac x=\"Suc k\" in exI)\n    apply (simp add: program_sem.simps next_state_def)\n   apply (clarsimp )\n   apply (rule exI[where x=\"Suc 0\"])\n   apply (clarsimp simp: program_sem.simps next_state_def)\n  apply (rule exI[where x=\"Suc 0\"])\n  apply (clarsimp simp: program_sem_t.simps program_sem.simps next_state_def)\n  done\n  \nlemma program_sem_ItoE :\n\"program_sem (\\<lambda>_. ()) const k net (InstructionToEnvironment a b c) = InstructionToEnvironment a b c\"\n  apply(induct_tac k, simp add: program_sem.simps next_state_def split: if_split)\n  apply(simp add: program_sem.simps next_state_def split: if_split)\n  done\n\n(* perhaps rename this to 'program_sem_no_gas_not_continuing' and \n   the above to 'program_sem_t_no_gas_not_continuing' *)    \nlemma program_sem_no_gas_not_continuing' :\n  \"\\<lbrakk>vctx_gas var \\<le> 0  \\<rbrakk> \\<Longrightarrow>\n\\<forall>k>0. \\<forall>v. program_sem (\\<lambda>_. ()) c k net (InstructionContinue var) \\<noteq> InstructionContinue v\"\n  apply clarify\n  apply(case_tac k, simp)\n  apply (simp add: program_sem.simps next_state_def split: if_split_asm)\n  apply (case_tac \"vctx_next_instruction var c\", simp  split:option.splits)\n   apply(simp add: program_sem_ItoE)\n    apply(simp split: if_split_asm)\n    apply (clarsimp simp add: check_resources_def prod.case_eq_if split:option.split)\n    apply(clarsimp simp: vctx_next_instruction_def split:option.splits)\n     apply(simp add: instruction_sem_def stop_def subtract_gas.simps)\n     apply(simp add: program_sem_ItoE)\n    apply(rename_tac inst)\n    apply(case_tac \"instruction_sem var c inst net\")\n      apply(drule instruction_sem_continuing, clarsimp)\n    apply(drule_tac const=c in meter_gas_gt_0[where net=net], assumption+)\n      apply fastforce\n     apply clarsimp\n    apply(simp add: program_sem_ItoE)\n   apply(simp add: program_sem_ItoE)\n  apply(simp add: program_sem_ItoE)\n  done\n\ntheorem program_sem_t_in_program_sem:\n  notes if_split[split del]\n  shows\n \"\\<exists>k. program_sem_t const net ir  = program_sem (\\<lambda>_. ()) const k net  ir \\<and>\n     (\\<forall>l\\<ge>k. \\<forall>z. program_sem (\\<lambda>_. ()) const l net ir \\<noteq> InstructionContinue z) \\<and>\n     (\\<forall>l<k. \\<exists>z. program_sem (\\<lambda>_. ()) const l net ir = InstructionContinue z)\"\n  apply(induct_tac const net ir rule: program_sem_t.induct) \n  apply(case_tac p)\n   apply clarify\n   apply(rename_tac c net p inst) \n   apply(drule_tac x=inst in meta_spec)\n   apply(case_tac \"vctx_next_instruction inst c\", simp add: vctx_next_instruction_def split:option.splits)\n   apply(rename_tac nxt_inst) \n   apply(drule_tac x=\"nxt_inst\" in meta_spec)\n   apply(erule meta_impE, simp)\n   apply(subst program_sem_t.simps)\n   apply(simp only: instruction_result.simps)\n   apply (drule meta_mp, simp)\n   apply simp\n   apply(split if_split)    \n   apply(rule conjI)    \n    apply clarify\n    apply (drule meta_mp, simp)\n    apply(split if_split)\n    apply(rule conjI)\n    apply clarify\n    apply(rule exI[where x=\"Suc 0\"])    \n    apply(simp add: program_sem.simps next_state_def split: if_split)\n    apply(drule_tac c=c and net=net in program_sem_no_gas_not_continuing')\n    apply fastforce\n    apply(rule impI, simp)\n    apply(erule exE)\n    apply(rule_tac x=\"k + 1\" in exI, clarify)\n    apply(simp add: program_sem.simps next_state_def)\n    apply(rule conjI)\n     apply(rule allI, rule impI)\n     apply(case_tac l, simp)\n     apply(rename_tac l')\n     apply(drule_tac x=l' in spec, drule mp, simp)\n     apply(simp add: program_sem.simps next_state_def)       \n    apply(rule allI, rule impI)\n    apply(case_tac l, simp add: program_sem.simps)\n    apply(rename_tac l', clarify)\n    apply(drule_tac x=l' in spec, drule mp, assumption)   \n    apply(clarsimp simp: program_sem.simps next_state_def)\n   apply(rule impI)\n   apply(rule exI[where x=\"Suc 0\"])  \n   apply(simp add: program_sem.simps next_state_def)\n   apply clarify\n   apply(case_tac l, simp)\n   apply clarify\n   apply(simp add: program_sem.simps next_state_def)    \n  apply(simp add: program_sem_ItoE)   \n  apply(simp add: program_sem.simps next_state_def)\n  apply(simp add: program_sem_ItoE program_sem_t.simps)\n  apply fastforce\n  done\n\ncorollary program_sem_t_fix :\n\"program_sem (\\<lambda>_. ()) const n net (program_sem_t const net ir) =\n program_sem_t const net ir\"\n  apply(insert program_sem_t_in_program_sem[of const net ir])\n  apply clarify\n  apply(erule ssubst)\n  apply(drule_tac x=\"k\" in spec, drule mp, simp)\n  apply(case_tac \"program_sem (\\<lambda>_. ()) const k net ir\")\n    apply fastforce\n   apply(erule ssubst)\n  apply(simp add: program_sem_ItoE)\n  done\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/EvmFacts.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6893056040203135, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.3124359319256093}}
{"text": "theory Automation_Setup\nimports \"System_Specification\"\nbegin\n\nlemma add_prop:\n  assumes \"PROP (T)\"\n  shows \"A ==> PROP (T)\"\n  using assms .\n\nlemmas exhaust_elim =\n   cAct.exhaust[of x, THEN add_prop[where A=\"a=Cact x\"], rotated -1]\n   uAct.exhaust[of x, THEN add_prop[where A=\"a=Uact x\"], rotated -1]\n   uuAct.exhaust[of x, THEN add_prop[where A=\"a=UUact x\"], rotated -1]\n   rAct.exhaust[of x, THEN add_prop[where A=\"a=Ract x\"], rotated -1]\n   lAct.exhaust[of x, THEN add_prop[where A=\"a=Lact x\"], rotated -1]\n  for x a\n\nlemma Paper_dest_conv:\n  \"(p =\n        Paper title abstract content reviews dis decs) \\<longleftrightarrow>\n  title = titlePaper p \\<and>\n  abstract = abstractPaper p \\<and>\n  content = contentPaper p \\<and>\n  reviews = reviewsPaper p \\<and>\n  dis = disPaper p \\<and>\n  decs = decsPaper p\n  \"\n  by (cases p) auto\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoCon/Automation_Setup.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3124273035851812}}
{"text": "(*******************************************************************************\n \n  Project: IsaNet\n\n  Author:  Tobias Klenze, ETH Zurich <tobias.klenze@inf.ethz.ch>\n  Version: JCSPaper.1.0\n  Isabelle Version: Isabelle2021-1\n\n  Copyright (c) 2022 Tobias Klenze\n  Licence: Mozilla Public License 2.0 (MPL) / BSD-3-Clause (dual license)\n\n*******************************************************************************)\n\nsection \\<open>EPIC Level 1 in the Basic Attacker Model\\<close>\ntheory EPIC_L1_BA\n  imports\n    \"../Parametrized_Dataplane_3_directed\"\n    \"../infrastructure/Keys\"\nbegin\n\nlocale epic_l1_defs = network_assums_direct _ _ _ auth_seg0 \n  for auth_seg0 :: \"(msgterm \\<times> ahi list) set\"\nbegin\n\n(******************************************************************************)\nsubsection \\<open>Hop validation check and extract functions\\<close>\n(******************************************************************************)\ntype_synonym EPIC_HF = \"(unit, msgterm) HF\"\ntype_synonym UINFO = \"nat\"\n\ntext\\<open>The predicate @{term \"hf_valid\"} is given to the concrete parametrized model as a parameter.\nIt ensures the authenticity of the hop authenticator in the hop field. The predicate takes an authenticated\ninfo field (in this model always a numeric value, hence the matching on Num ts), an unauthenticated\ninfo field uinfo, the hop field to be validated and in some cases the next hop field.\n\nWe distinguish if there is a next hop field (this yields the two cases below). If there is not, then\nthe hop authenticator @{text \"\\<sigma>\"} simply consists of a MAC over the authenticated info field and the local\nrouting information of the hop, using the key of the hop to which the hop field belongs. If on the\nother hand, there is a subsequent hop field, then the uhi field of that hop field is also included\nin the MAC computation.\n\nThe hop authenticator @{text \"\\<sigma>\"} is used to compute both the hop validation field and the uhi field.\nThe first is computed as a MAC over the path origin (pair of absolute timestamp ts and the relative\ntimestamp given in uinfo), using the hop authenticator as a key to the MAC. The hop authenticator\nis not secret, and any end host can use it to create a valid hvf. The uhi field, according to the \nprotocol description, is @{text \"\\<sigma>\"} shortened to a few bytes. We model this as applying the hash on @{text \"\\<sigma>\"}.\n\nThe predicate @{term \"hf_valid\"} checks if the hop authenticator, hvf and uhi field are computed\ncorrectly.\\<close>\nfun hf_valid :: \"msgterm \\<Rightarrow> UINFO\n    \\<Rightarrow> EPIC_HF\n    \\<Rightarrow> EPIC_HF option \\<Rightarrow> bool\" where \n  \"hf_valid (Num ts) tspkt \\<lparr>AHI = ahi, UHI = uhi, HVF = x\\<rparr> (Some \\<lparr>AHI = ahi2, UHI = uhi2, HVF = x2\\<rparr>) \\<longleftrightarrow> \n    (\\<exists>\\<sigma> upif downif. \\<sigma> = Mac[macKey (ASID ahi)] (L [Num ts, upif, downif, uhi2]) \\<and>\n          ASIF (DownIF ahi) downif \\<and> ASIF (UpIF ahi) upif \\<and> uhi = Hash \\<sigma> \\<and> x = Mac[\\<sigma>] \\<langle>Num ts, Num tspkt\\<rangle>)\"\n| \"hf_valid (Num ts) tspkt \\<lparr>AHI = ahi, UHI = uhi, HVF = x\\<rparr> None \\<longleftrightarrow> \n    (\\<exists>\\<sigma> upif downif. \\<sigma> = Mac[macKey (ASID ahi)] (L [Num ts, upif, downif]) \\<and>\n          ASIF (DownIF ahi) downif \\<and> ASIF (UpIF ahi) upif \\<and> uhi = Hash \\<sigma> \\<and> x = Mac[\\<sigma>] \\<langle>Num ts, Num tspkt\\<rangle>)\"\n| \"hf_valid _ _ _ _ = False\"\n\ndefinition upd_uinfo :: \"nat \\<Rightarrow> EPIC_HF \\<Rightarrow> nat\" where\n  \"upd_uinfo uinfo hf \\<equiv> uinfo\"\n\ntext\\<open>We can extract the entire path from the uhi field, since it includes the hop authenticator, \nwhich includes the local forwarding information as well as, recursively, all upstream hop \nauthenticators and their hop information.\nHowever, the parametrized model defines the extract function to operate on the hop validation field,\nnot the uhi field. We therefore define a separate function that extracts the path from a hvf. \nWe can do so, as both hvf and uhi contain the hop authenticator.\nInternally, that function uses @{term \"extrUhi\"}.\\<close>\nfun extrUhi :: \"msgterm \\<Rightarrow> ahi list\" where\n  \"extrUhi (Hash (Mac[macKey asid] (L [ts, upif, downif, uhi2])))\n = \\<lparr>UpIF = term2if upif, DownIF = term2if downif, ASID = asid\\<rparr> # extrUhi uhi2\"\n| \"extrUhi (Hash (Mac[macKey asid] (L [ts, upif, downif])))\n = [\\<lparr>UpIF = term2if upif, DownIF = term2if downif, ASID = asid\\<rparr>]\"\n| \"extrUhi _ = []\"\n\ntext\\<open>This function extracts from a hop validation field (HVF hf) the entire path.\\<close>\nfun extr :: \"msgterm \\<Rightarrow> ahi list\" where\n  \"extr (Mac[\\<sigma>] _) = extrUhi (Hash \\<sigma>)\" \n   | \"extr _ = []\"\n\ntext\\<open>Extract the authenticated info field from a hop validation field.\\<close>\nfun extr_ainfo :: \"msgterm \\<Rightarrow> msgterm\" where \n  \"extr_ainfo (Mac[Mac[macKey asid] (L (Num ts # xs))] _) = Num ts\"\n| \"extr_ainfo _ = \\<epsilon>\"\n\nabbreviation term_ainfo :: \"msgterm \\<Rightarrow> msgterm\" where\n  \"term_ainfo \\<equiv> id\"\n\ntext\\<open>When observing a hop field, an attacker learns the HVF and the UHI. The AHI only contains \npublic information that are not terms.\\<close>\nfun terms_hf :: \"EPIC_HF \\<Rightarrow> msgterm set\" where \n  \"terms_hf hf = {HVF hf, UHI hf}\"\n\nabbreviation terms_uinfo :: \"UINFO \\<Rightarrow> msgterm set\" where \n  \"terms_uinfo x \\<equiv> {}\"\n\ntext\\<open>An authenticated info field is always a number (corresponding to a timestamp). The \n     unauthenticated info field is as well a number, representing combination of timestamp offset\n     and SRC address.\\<close>\ndefinition auth_restrict where \n  \"auth_restrict ainfo uinfo l \\<equiv> (\\<exists>ts. ainfo = Num ts)\"\n\nabbreviation no_oracle where \"no_oracle \\<equiv> (\\<lambda> _ _. True)\"\n\ntext\\<open>We now define useful properties of the above definition.\\<close>\nlemma hf_valid_invert:\n  \"hf_valid tsn uinfo hf mo \\<longleftrightarrow>\n   ((\\<exists>ahi ahi2 \\<sigma> ts upif downif asid x upif2 downif2 asid2 uhi uhi2 x2.\n     hf = \\<lparr>AHI = ahi, UHI = uhi, HVF = x\\<rparr> \\<and>\n     ASID ahi = asid \\<and> ASIF (DownIF ahi) downif \\<and> ASIF (UpIF ahi) upif \\<and>\n     mo = Some \\<lparr>AHI = ahi2, UHI = uhi2, HVF = x2\\<rparr> \\<and>\n     ASID ahi2 = asid2 \\<and> ASIF (DownIF ahi2) downif2 \\<and> ASIF (UpIF ahi2) upif2 \\<and>\n     \\<sigma> = Mac[macKey asid] (L [tsn, upif, downif, uhi2]) \\<and>\n     tsn = Num ts \\<and>\n     uhi = Hash \\<sigma> \\<and>\n     x = Mac[\\<sigma>] \\<langle>tsn, Num uinfo\\<rangle>)\n \\<or> (\\<exists>ahi \\<sigma> ts upif downif asid uhi x.\n     hf = \\<lparr>AHI = ahi, UHI = uhi, HVF = x\\<rparr> \\<and>\n     ASID ahi = asid \\<and> ASIF (DownIF ahi) downif \\<and> ASIF (UpIF ahi) upif \\<and>\n     mo = None \\<and>\n     \\<sigma> = Mac[macKey asid] (L [tsn, upif, downif]) \\<and>\n     tsn = Num ts \\<and>\n     uhi = Hash \\<sigma> \\<and>\n     x = Mac[\\<sigma>] \\<langle>tsn, Num uinfo\\<rangle>)\n    )\"\n  apply(auto elim!: hf_valid.elims) using option.exhaust ASIF.simps by metis+\n\nlemma hf_valid_auth_restrict[dest]: \"hf_valid ainfo uinfo hf z \\<Longrightarrow> auth_restrict ainfo uinfo l\"\n  by(auto simp add: hf_valid_invert auth_restrict_def)\n\nlemma auth_restrict_ainfo[dest]: \"auth_restrict ainfo uinfo l \\<Longrightarrow> \\<exists>ts. ainfo = Num ts\"\n  by(auto simp add: auth_restrict_def)\n\nlemma info_hvf: \n  assumes \"hf_valid ainfo uinfo m z\" \"HVF m = Mac[\\<sigma>] \\<langle>ainfo', Num uinfo'\\<rangle> \\<or> hf_valid ainfo' uinfo' m z'\" \n  shows \"uinfo = uinfo'\" \"ainfo' = ainfo\"\n  using assms by(auto simp add: hf_valid_invert)\n\n\n(******************************************************************************)\nsubsection\\<open>Definitions and properties of the added intruder knowledge\\<close>\n(******************************************************************************)\ntext\\<open>Here we define a sets which are added to the intruder knowledge: @{text \"ik_add\"}, which contains hop\nauthenticators.\\<close>\n\nprint_locale dataplane_3_directed_defs \nsublocale dataplane_3_directed_defs _ _ _ auth_seg0 hf_valid auth_restrict extr extr_ainfo term_ainfo \n                 terms_hf terms_uinfo upd_uinfo no_oracle\n  by unfold_locales\n\ndeclare TWu.holds_set_list[dest]\ndeclare TWu.holds_takeW_is_identity[simp]\ndeclare parts_singleton[dest]\n\ntext\\<open>This additional Intruder Knowledge allows us to model the attacker's access not only to the \nhop validation fields and segment identifiers of authorized segments (which are already given in \n@{text \"ik_hfs\"}), but to the underlying hop authenticators that are used to create them.\\<close>\n\ndefinition ik_add :: \"msgterm set\" where\n  \"ik_add \\<equiv> { \\<sigma> | ainfo uinfo l hf \\<sigma>.  \n                 (ainfo, l) \\<in> auth_seg2 uinfo \\<and> hf \\<in> set l \\<and> HVF hf = Mac[\\<sigma>] \\<langle>ainfo, Num uinfo\\<rangle> }\"\n\nlemma ik_addI:\n  \"\\<lbrakk>(ainfo, l) \\<in> auth_seg2 uinfo; hf \\<in> set l; HVF hf = Mac[\\<sigma>] \\<langle>ainfo, Num uinfo\\<rangle>\\<rbrakk> \\<Longrightarrow> \\<sigma> \\<in> ik_add\"\n  by(auto simp add: ik_add_def)\n\nlemma ik_add_form: \"t \\<in> ik_add \\<Longrightarrow> \\<exists> asid l . t = Mac[macKey asid] l\"\n  by(auto simp add: ik_add_def auth_seg2_def hf_valid_invert dest!: TWu.holds_set_list)\n\nlemma parts_ik_add[simp]: \"parts ik_add = ik_add\"\n  by (auto intro!: parts_Hash dest: ik_add_form)\n\nabbreviation ik_oracle :: \"msgterm set\" where \"ik_oracle \\<equiv> {}\"\n\n(******************************************************************************)\nsubsection\\<open>Properties of the intruder knowledge, including @{text \"ik_add\"} and  @{text \"ik_oracle\"}\\<close>\n(******************************************************************************)\ntext\\<open>We now instantiate the parametrized model's definition of the intruder knowledge, using the\ndefinitions of @{text \"ik_add\"} and  @{text \"ik_oracle\"} from above. We then prove the properties \nthat we need to instantiate the @{text \"dataplane_3_directed\"} locale.\\<close>\nsublocale\n  dataplane_3_directed_ik_defs _ _ _ auth_seg0 terms_uinfo no_oracle hf_valid auth_restrict extr extr_ainfo term_ainfo \n                  terms_hf upd_uinfo ik_add ik_oracle \n  by unfold_locales\n\nlemma ik_hfs_form: \"t \\<in> parts ik_hfs \\<Longrightarrow> \\<exists> t' . t = Hash t'\"\n  by(auto 3 4 simp add: auth_seg2_def hf_valid_invert)\n\ndeclare ik_hfs_def[simp del]\n\nlemma parts_ik_hfs[simp]: \"parts ik_hfs = ik_hfs\"\n  by (auto intro!: parts_Hash ik_hfs_form)\n\ntext\\<open>This lemma allows us not only to expand the definition of @{term \"ik_hfs\"}, but also \nto obtain useful properties, such as a term being a Hash, and it being part of a valid hop field.\\<close>\nlemma ik_hfs_simp: \n  \"t \\<in> ik_hfs \\<longleftrightarrow> (\\<exists>t' . t = Hash t') \\<and> (\\<exists>hf . (t = HVF hf \\<or> t = UHI hf)\n                    \\<and> (\\<exists>hfs. hf \\<in> set hfs \\<and> (\\<exists>ainfo uinfo. (ainfo, hfs) \\<in> auth_seg2 uinfo\n                    \\<and> (\\<exists> nxt. hf_valid ainfo uinfo hf nxt))))\" (is \"?lhs \\<longleftrightarrow> ?rhs\")\nproof \n  assume asm: \"?lhs\" \n  then obtain ainfo uinfo hf hfs where \n    dfs: \"hf \\<in> set hfs\" \"(ainfo, hfs) \\<in> auth_seg2 uinfo\" \"t = HVF hf \\<or> t = UHI hf\"\n    by(auto simp add: ik_hfs_def)\n  then have \"hfs_valid_None ainfo uinfo hfs\"  \"(ainfo, AHIS hfs) \\<in> auth_seg0\"\n    by(auto simp add: auth_seg2_def)\n  then show \"?rhs\" using asm dfs\n    using upd_uinfo_def \n    by (auto 3 4 simp add: auth_seg2_def intro!: ik_hfs_form exI[of _ hf] exI[of _ hfs] \n                     dest: TWu.holds_set_list_no_update)\nqed(auto simp add: ik_hfs_def)\n\n(******************************************************************************)\nsubsubsection \\<open>Properties of Intruder Knowledge\\<close>\n(******************************************************************************)\nlemma auth_ainfo[dest]: \"\\<lbrakk>(ainfo, hfs) \\<in> auth_seg2 uinfo\\<rbrakk> \\<Longrightarrow> \\<exists> ts . ainfo = Num ts\"\n  by(auto simp add: auth_seg2_def)\n\nlemma Num_ik[intro]: \"Num ts \\<in> ik\"\n  by(auto simp add: ik_def auth_seg2_def auth_restrict_def TWu.holds.simps intro!: exI[of _ \"[]\"])\n\ntext \\<open>There are no ciphertexts (or signatures) in @{term \"parts ik\"}. Thus, @{term \"analz ik\"}\nand @{term \"parts ik\"} are identical.\\<close>\nlemma analz_parts_ik[simp]: \"analz ik = parts ik\"\n  apply(rule no_crypt_analz_is_parts)\n  by(auto simp add: ik_def auth_seg2_def)\n    (auto 3 4 simp add: ik_add_def auth_seg2_def hf_valid_invert ik_hfs_simp)\n\nlemma parts_ik[simp]: \"parts ik = ik\"\n  by(auto 3 4 simp add: ik_def auth_seg2_def auth_restrict_def dest!: parts_singleton_set)\n\nlemma key_ik_bad: \"Key (macK asid) \\<in> ik \\<Longrightarrow> asid \\<in> bad\"\n  by(auto simp add: ik_def)\n    (auto 3 4 simp add: auth_seg2_def ik_hfs_simp ik_add_def hf_valid_invert)\n\n(******************************************************************************)\nsubsubsection\\<open>Hop authenticators are agnostic to uinfo field\\<close>\n(******************************************************************************)\ntext\\<open>Those hop validation fields contained in @{term \"auth_seg2\"} or that can be generated from the hop\nauthenticators in @{text \"ik_add\"} have the property that they are agnostic about the uinfo field. If a\nhop validation field is contained in @{term \"auth_seg2\"} (resp. derivable from @{text \"ik_add\"}), \nthen a field with a different uinfo is also contained (resp. derivable).\nTo show this, we first define a function that changes uinfo in a hop validation field.\\<close>\nfun uinfo_change_hf :: \"UINFO \\<Rightarrow> EPIC_HF \\<Rightarrow> EPIC_HF\" where\n  \"uinfo_change_hf new_uinfo hf = \n    (case HVF hf of Mac[\\<sigma>] \\<langle>ainfo, uinfo\\<rangle> \\<Rightarrow> hf\\<lparr>HVF := Mac[\\<sigma>] \\<langle>ainfo, Num new_uinfo\\<rangle>\\<rparr> | _ \\<Rightarrow> hf)\"\n\nfun uinfo_change :: \"UINFO \\<Rightarrow> EPIC_HF list \\<Rightarrow> EPIC_HF list\" where \n  \"uinfo_change new_uinfo hfs = map (uinfo_change_hf new_uinfo) hfs\"\n\nlemma uinfo_change_valid: \n  \"hfs_valid ainfo uinfo l nxt \\<Longrightarrow> hfs_valid ainfo new_uinfo (uinfo_change new_uinfo l) nxt\"\n  apply(induction l nxt rule: TWu.holds.induct[where ?upd=upd_uinfo])\n  apply auto\n  subgoal for info x y ys nxt\n    by(cases \"map (uinfo_change_hf new_uinfo) ys\")\n      (cases info, auto 3 4 simp add: TWu.holds_split_tail hf_valid_invert upd_uinfo_def)+\n  by(auto 3 4 simp add: TWu.holds_split_tail hf_valid_invert TWu.holds.simps upd_uinfo_def)\n\nlemma uinfo_change_hf_AHI: \"AHI (uinfo_change_hf new_uinfo hf) = AHI hf\"\n  apply(cases \"HVF hf\") apply auto\n  subgoal for x apply(cases x) apply auto\n    subgoal for x1 x2 apply(cases x2) by auto\n    done\n  done\n\nlemma uinfo_change_hf_AHIS[simp]: \"AHIS (map (uinfo_change_hf new_uinfo) l) = AHIS l\"\n  apply(induction l) using uinfo_change_hf_AHI by auto\n\nlemma uinfo_change_auth_seg2:\n  assumes \"hf_valid ainfo uinfo m z\" \"\\<sigma> = Mac[Key (macK asid)] j\"\n          \"HVF m = Mac[\\<sigma>] \\<langle>ainfo, Num uinfo'\\<rangle>\" \"\\<sigma> \\<in> ik_add\"\n  shows \"\\<exists>hfs. m \\<in> set hfs \\<and> (\\<exists>uinfo''. (ainfo, hfs) \\<in> auth_seg2 uinfo'')\"\nproof-\n  from assms(4) obtain ainfo_add uinfo_add l_add hf_add where\n    \"(ainfo_add, l_add) \\<in> auth_seg2 uinfo_add\" \"hf_add \\<in> set l_add\" \"HVF hf_add = Mac[\\<sigma>] \\<langle>ainfo_add, Num uinfo_add\\<rangle>\"\n    by(auto simp add: ik_add_def)\n  then have add: \"m \\<in> set (uinfo_change uinfo l_add)\" \"(ainfo_add, (uinfo_change uinfo l_add)) \\<in> auth_seg2 uinfo\"\n    using assms(1-3) apply(auto simp add: auth_seg2_def simp del: AHIS_def)\n    apply(auto simp add: hf_valid_invert intro!: image_eqI dest!: TWu.holds_set_list)[1]\n    by(auto simp add: auth_restrict_def intro!: exI elim: ahi_eq dest: uinfo_change_valid simp del: AHIS_def)\n  then have \"ainfo_add = ainfo\" \n    using assms(1) by(auto simp add: auth_seg2_def dest!: TWu.holds_set_list dest: info_hvf)\n  then show ?thesis using add by fastforce\nqed\n\nlemma MAC_synth_helper:\n\"\\<lbrakk>hf_valid ainfo uinfo m z; \n  HVF m = Mac[\\<sigma>] \\<langle>ainfo, Num uinfo\\<rangle>; \\<sigma> = Mac[Key (macK asid)] j; \\<sigma> \\<in> ik \\<or> HVF m \\<in> ik\\<rbrakk>\n       \\<Longrightarrow> \\<exists>hfs. m \\<in> set hfs \\<and> (\\<exists>uinfo'. (ainfo, hfs) \\<in> auth_seg2 uinfo')\"\n  apply(auto simp add: ik_def ik_hfs_simp dest: ik_add_form)\n  prefer 3 subgoal by(auto elim!: uinfo_change_auth_seg2)\n  prefer 3 subgoal by(auto elim!: uinfo_change_auth_seg2 intro: ik_addI dest: info_hvf HOL.sym)\n  by(auto simp add: hf_valid_invert)\n\ntext\\<open>This definition helps with the limiting the number of cases generated. We don't require it, \nbut it is convenient. Given a hop validation field and an asid, return if the hvf has the expected\nformat.\\<close>\ndefinition mac_format :: \"msgterm \\<Rightarrow> as \\<Rightarrow> bool\" where \n  \"mac_format m asid \\<equiv> \\<exists> j ts uinfo . m = Mac[Mac[macKey asid] j] \\<langle>Num ts, uinfo\\<rangle>\"\n\ntext\\<open>If a valid hop field is derivable by the attacker, but does not belong to the attacker, then \nthe hop field is already contained in the set of authorized segments.\\<close>\nlemma MAC_synth:\n  assumes \"hf_valid ainfo uinfo m z\" \"HVF m \\<in> synth ik\" \"mac_format (HVF m) asid\"\n    \"asid \\<notin> bad\"\n  shows \"\\<exists>hfs . m \\<in> set hfs \\<and> (\\<exists>uinfo'. (ainfo, hfs) \\<in> auth_seg2 uinfo')\"\n  using assms\n  apply(auto simp add: mac_format_def elim!: MAC_synth_helper dest!: key_ik_bad)\n  apply(auto simp add: ik_def ik_hfs_simp dest: ik_add_form) (* takes a few seconds *)\n  using assms(1) by(auto dest: info_hvf simp add: hf_valid_invert)\n\n(******************************************************************************)\nsubsection\\<open>Direct proof goals for interpretation of @{text \"dataplane_3_directed\"}\\<close>\n(******************************************************************************)\n\nlemma COND_honest_hf_analz:\n  assumes \"ASID (AHI hf) \\<notin> bad\" \"hf_valid ainfo uinfo hf nxt\" \"terms_hf hf \\<subseteq> synth (analz ik)\"\n    \"no_oracle ainfo uinfo\"\n    shows \"terms_hf hf \\<subseteq> analz ik\"\nproof-\n  let ?asid = \"ASID (AHI hf)\"\n  from assms(3) have hf_synth_ik: \"HVF hf \\<in> synth ik\" \"UHI hf \\<in> synth ik\" by auto\n  from assms(2) have \"mac_format (HVF hf) ?asid\"\n    by(auto simp add: mac_format_def hf_valid_invert)\n  then obtain hfs uinfo where \"hf \\<in> set hfs\" \"(ainfo, hfs) \\<in> auth_seg2 uinfo\"\n    using assms(1,2,4) hf_synth_ik by(auto dest!: MAC_synth)\n  then have \"HVF hf \\<in> ik\" \"UHI hf \\<in> ik\" \n    using assms(2)\n    by(auto simp add: ik_hfs_def intro!: ik_ik_hfs intro!: exI) \n  then show ?thesis by auto\nqed\n\nlemma COND_terms_hf: \n  assumes \"hf_valid ainfo uinfo hf z\" and \"HVF hf \\<in> ik\" and \"no_oracle ainfo uinfo\"\n  shows \"\\<exists>hfs. hf \\<in> set hfs \\<and> (\\<exists>uinfo . (ainfo, hfs) \\<in> auth_seg2 uinfo)\"\nproof-\n  obtain hfs ainfo where hfs_def: \"hf \\<in> set hfs\" \"(ainfo, hfs) \\<in> auth_seg2 uinfo\"\n  using assms by(auto 3 4 simp add: hf_valid_invert ik_hfs_simp ik_def dest: ahi_eq\n                             dest!: ik_add_form)\n  then obtain hfs ainfo where hfs_def: \"hf \\<in> set hfs\" \"(ainfo, hfs) \\<in> auth_seg2 uinfo\" by auto\n  show ?thesis \n    using hfs_def apply (auto simp add: auth_seg2_def dest!: TWu.holds_set_list)\n    using hfs_def assms(1) by (auto simp add: auth_seg2_def dest: info_hvf)\nqed\n\nlemma COND_extr_prefix_path:\n  \"\\<lbrakk>hfs_valid ainfo uinfo l nxt; nxt = None\\<rbrakk> \\<Longrightarrow> prefix (extr_from_hd l) (AHIS l)\"\n  by(induction l nxt rule: TWu.holds.induct[where ?upd=upd_uinfo])\n    (auto simp add: upd_uinfo_def TWu.holds_split_tail TWu.holds.simps(1) hf_valid_invert,\n     auto split: list.split_asm simp add: hf_valid_invert intro!: ahi_eq elim: ASIF.elims)\n\nlemma COND_path_prefix_extr:\n  \"prefix (AHIS (hfs_valid_prefix ainfo uinfo l nxt))\n          (extr_from_hd l)\"\n  apply(induction l nxt rule: TWu.takeW.induct[where ?Pa=\"hf_valid ainfo\",where ?upd=upd_uinfo])\n  by(auto simp add: upd_uinfo_def TWu.takeW_split_tail TWu.takeW.simps(1))\n    (auto 3 4 simp add: hf_valid_invert intro!: ahi_eq elim: ASIF.elims)\n\nlemma COND_hf_valid_uinfo:\n  \"\\<lbrakk>hf_valid ainfo uinfo hf nxt; hf_valid ainfo' uinfo' hf nxt'\\<rbrakk> \\<Longrightarrow> uinfo' = uinfo\"\n  by(auto dest: info_hvf)\n\nlemma COND_upd_uinfo_ik: \n    \"\\<lbrakk>terms_uinfo uinfo \\<subseteq> synth (analz ik); terms_hf hf \\<subseteq> synth (analz ik)\\<rbrakk> \n    \\<Longrightarrow> terms_uinfo (upd_uinfo uinfo hf) \\<subseteq> synth (analz ik)\"\n  by (auto simp add: upd_uinfo_def)\n\nlemma COND_upd_uinfo_no_oracle: \n  \"no_oracle ainfo uinfo \\<Longrightarrow> no_oracle ainfo (upd_uinfo uinfo fld)\"\n  by (auto simp add: upd_uinfo_def)\n\nlemma COND_auth_restrict_upd:\n      \"auth_restrict ainfo uinfo (x#y#hfs) \n   \\<Longrightarrow> auth_restrict ainfo (upd_uinfo uinfo y) (y#hfs)\"\n  by (auto simp add: auth_restrict_def upd_uinfo_def)\n\n(******************************************************************************)\nsubsection\\<open>Instantiation of @{text \"dataplane_3_directed\"} locale\\<close>\n(******************************************************************************)\n(******************************************************************************)\nprint_locale dataplane_3_directed\nsublocale\n  dataplane_3_directed _ _ _ auth_seg0 terms_uinfo terms_hf hf_valid auth_restrict extr extr_ainfo term_ainfo \n            upd_uinfo ik_add \n            ik_oracle no_oracle\n  apply unfold_locales\n  using COND_terms_hf COND_honest_hf_analz COND_extr_prefix_path\n  COND_path_prefix_extr COND_hf_valid_uinfo COND_upd_uinfo_ik COND_upd_uinfo_no_oracle \n  COND_auth_restrict_upd by auto\n\nend\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/IsaNet/instances/EPIC_L1_BA.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3123489177711926}}
{"text": "theory WordArray_Shallow\n  imports Generated_AllRefine\n\nbegin\n\nsection \"Helper Functions and Lemmas\"\n\nfun myslice :: \"nat \\<Rightarrow> nat \\<Rightarrow> 'a list \\<Rightarrow> 'a list\"\n  where\n\"myslice frm to xs = List.take (to - frm) (List.drop frm xs)\"\n\nsection \"Shallow Word Array Function Definitions\"\n\noverloading\n  wordarray_put2' \\<equiv> wordarray_put2\nbegin\ndefinition wordarray_put2':\n \"wordarray_put2' (x :: ('a WordArray, 32 word, 'a) WordArrayPutP) \\<equiv> (WordArrayPutP.arr\\<^sub>f x)[unat (WordArrayPutP.idx\\<^sub>f x) := WordArrayPutP.val\\<^sub>f x]\" \nend\n\noverloading\n  wordarray_length' \\<equiv> wordarray_length\nbegin\ndefinition wordarray_length':\n \"wordarray_length' (x :: 'a WordArray) \\<equiv> (of_nat (length x) :: 32 word)\" \nend\n\noverloading\n  wordarray_get' \\<equiv> wordarray_get\nbegin\ndefinition wordarray_get':\n \"wordarray_get' (x :: (('a::len8) word WordArray, 32 word) T0) \\<equiv> (if unat (T0.p2\\<^sub>f x) < length (T0.p1\\<^sub>f x) then (T0.p1\\<^sub>f x) ! unat (T0.p2\\<^sub>f x) else 0)\" \nend\n\n\noverloading\n  wordarray_fold_no_break' \\<equiv> wordarray_fold_no_break\nbegin\ndefinition wordarray_fold_no_break':\n \"wordarray_fold_no_break' (x :: ('a WordArray, 32 word, 32 word, ('a, 'acc, 'obsv) ElemAO \\<Rightarrow> 'acc, 'acc, 'obsv) WordArrayMapNoBreakP) \\<equiv> \n    fold (\\<lambda>a b. (WordArrayMapNoBreakP.f\\<^sub>f x) (ElemAO.make a b (WordArrayMapNoBreakP.obsv\\<^sub>f x))) \n         (myslice (unat (WordArrayMapNoBreakP.frm\\<^sub>f x)) (unat (WordArrayMapNoBreakP.to\\<^sub>f x)) (WordArrayMapNoBreakP.arr\\<^sub>f x)) \n         (WordArrayMapNoBreakP.acc\\<^sub>f x)\" \nend\n\n\nfun mapAccum :: \"('a \\<Rightarrow> 'b  \\<Rightarrow> ('c \\<times> 'b)) \\<Rightarrow> 'a list \\<Rightarrow> 'b \\<Rightarrow> ('c list \\<times> 'b)\"\n  where\n\"mapAccum _ [] acc = ([], acc)\" |\n\"mapAccum f (x#xs) acc = \n  (let (a, b) = f x acc;\n       (as, b') = mapAccum f xs b\n   in (a#as, b'))\"\n\nfun listAccumStep :: \"('a \\<Rightarrow> 'b  \\<Rightarrow> ('c \\<times> 'b)) \\<Rightarrow> 'a \\<Rightarrow> ('c list \\<times> 'b) \\<Rightarrow> ('c list \\<times> 'b)\"\n  where\n\"listAccumStep f x (ys, acc) = (let (y, acc') = f x acc in (ys @ [y], acc'))\"\n\nlemma mapAccum_step:\n  \"mapAccum f (xs @ [x]) acc = listAccumStep f x (mapAccum f xs acc)\"\n  apply (induct arbitrary: x acc rule: list.induct)\n   apply clarsimp\n  apply (clarsimp split: prod.split)\n  done\n\n\nlemma mapAccum_length:\n  \"length (prod.fst (mapAccum f xs acc)) = length xs\"\n  apply (induct arbitrary: acc rule: rev_induct)\n   apply simp\n  apply (subst mapAccum_step)\n  apply clarsimp\n  apply (drule_tac x = acc in meta_spec)\n  by (metis (no_types, lifting) Product_Type.split_def fst_conv length_append_singleton listAccumStep.simps prod.collapse)\n\n\nlemma \n  \"map f xs = prod.fst (mapAccum (\\<lambda>a b. (f a, b)) xs ())\"\n  by (induct xs; clarsimp split: prod.split)\n\nlemma\n  \"fold f xs acc = prod.snd (mapAccum (\\<lambda>a b. (a, f a b)) xs acc)\"\n  apply (induct rule: rev_induct; clarsimp split: prod.split)\n  apply (subst mapAccum_step)\n  by (metis (no_types, lifting) case_prod_beta listAccumStep.simps prod.collapse snd_conv)\n\n\n\nfun cogent_isa_pair :: \"('a, 'b) T0 \\<Rightarrow> ('a \\<times> 'b)\"\n  where\n\"cogent_isa_pair x = (T0.p1\\<^sub>f x, T0.p2\\<^sub>f x)\"\n\nterm \"mapAccum \n          (\\<lambda>a b. cogent_isa_pair ((WordArrayMapNoBreakP.f\\<^sub>f x) (ElemAO.make a b (WordArrayMapNoBreakP.obsv\\<^sub>f x)))) \n          (myslice (unat (WordArrayMapNoBreakP.frm\\<^sub>f x)) (unat (WordArrayMapNoBreakP.to\\<^sub>f x)) (WordArrayMapNoBreakP.arr\\<^sub>f x)) \n          (WordArrayMapNoBreakP.acc\\<^sub>f x)\"\noverloading\n  wordarray_map_no_break' \\<equiv> wordarray_map_no_break\nbegin\ndefinition wordarray_map_no_break':\n \"wordarray_map_no_break' (x :: ('a WordArray, 32 word, 32 word, ('a, 'acc, 'obsv) ElemAO \\<Rightarrow> ('a, 'acc) T0, 'acc, 'obsv) WordArrayMapNoBreakP) \\<equiv> \n    (let xs = List.take (unat (WordArrayMapNoBreakP.frm\\<^sub>f x)) (WordArrayMapNoBreakP.arr\\<^sub>f x);\n         zs = List.drop (unat (WordArrayMapNoBreakP.to\\<^sub>f x)) (WordArrayMapNoBreakP.arr\\<^sub>f x);\n        (ys, acc) = mapAccum \n          (\\<lambda>a b. cogent_isa_pair ((WordArrayMapNoBreakP.f\\<^sub>f x) (ElemAO.make a b (WordArrayMapNoBreakP.obsv\\<^sub>f x)))) \n          (myslice (unat (WordArrayMapNoBreakP.frm\\<^sub>f x)) (unat (WordArrayMapNoBreakP.to\\<^sub>f x)) (WordArrayMapNoBreakP.arr\\<^sub>f x)) \n          (WordArrayMapNoBreakP.acc\\<^sub>f x)\n    in (if (WordArrayMapNoBreakP.frm\\<^sub>f x) \\<le> (WordArrayMapNoBreakP.to\\<^sub>f x) \n        then T0.make (xs @ ys @ zs) acc \n        else T0.make (WordArrayMapNoBreakP.arr\\<^sub>f x) acc))\" \nend\n\nend", "meta": {"author": "amblafont", "repo": "dargent-examples", "sha": "dbcfdd6573c088f65d4dade1b351b3bb2bc073e7", "save_path": "github-repos/isabelle/amblafont-dargent-examples", "path": "github-repos/isabelle/amblafont-dargent-examples/dargent-examples-dbcfdd6573c088f65d4dade1b351b3bb2bc073e7/sum-random/manual/SumRandom_Shallow.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.31234891060511166}}
{"text": "theory \"CoCallGraph-Nominal\"\nimports CoCallGraph \"Launchbury.Nominal-HOLCF\"\nbegin\n\ninstantiation CoCalls :: pt\nbegin\n  lift_definition permute_CoCalls :: \"perm \\<Rightarrow> CoCalls \\<Rightarrow> CoCalls\" is \"permute\"\n    by (auto intro!: symI elim: symE simp add: mem_permute_set)\ninstance\n  apply standard\n  apply (transfer, simp)+\n  done\nend\n\ninstance CoCalls :: cont_pt\n  apply standard\n  apply (rule contI2)\n  apply (rule monofunI)\n  apply transfer\n  apply (metis (full_types) True_eqvt subset_eqvt)\n  apply (thin_tac \"chain _\")+\n  apply transfer\n  apply simp\n  done\n\nlemmas lub_eqvt[OF exists_lub, simp, eqvt]\n\nlemma cc_restr_perm:\n  fixes G :: CoCalls\n  assumes \"supp p \\<sharp>* S\" and [simp]: \"finite S\"\n  shows \"cc_restr S (p \\<bullet> G) = cc_restr S G\"\n  using assms\n  apply -\n  apply transfer\n  apply (auto simp add: mem_permute_set)\n  apply (subst (asm) perm_supp_eq, simp add: supp_minus_perm, metis (full_types) fresh_def fresh_star_def supp_set_elem_finite)+\n  apply assumption\n  apply (subst perm_supp_eq, simp add: supp_minus_perm, metis (full_types) fresh_def fresh_star_def supp_set_elem_finite)+\n  apply assumption\n  done\n\n\n\nlemma inCC_eqvt[eqvt]: \"\\<pi> \\<bullet> (x--y\\<in>G) = (\\<pi>\\<bullet>x)--(\\<pi>\\<bullet>y)\\<in>(\\<pi>\\<bullet>G)\"\n  by transfer auto\nlemma cc_restr_eqvt[eqvt]: \"\\<pi> \\<bullet> cc_restr S G = cc_restr (\\<pi> \\<bullet> S) (\\<pi> \\<bullet> G)\"\n  by transfer (perm_simp, rule)\nlemma ccProd_eqvt[eqvt]: \"\\<pi> \\<bullet> ccProd S S' = ccProd (\\<pi> \\<bullet> S) (\\<pi> \\<bullet>  S')\" \n  by transfer (perm_simp, rule)\nlemma ccSquare_eqvt[eqvt]: \"\\<pi> \\<bullet> ccSquare S = ccSquare (\\<pi> \\<bullet> S)\"\n  unfolding ccSquare_def\n  by perm_simp rule\nlemma ccNeighbors_eqvt[eqvt]: \"\\<pi> \\<bullet> ccNeighbors S G = ccNeighbors (\\<pi> \\<bullet> S) (\\<pi> \\<bullet> G)\"\n  by transfer (perm_simp, rule)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/CoCallGraph-Nominal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.31218524553501986}}
{"text": "theory Combine\n  imports Balance_LR\nbegin\n\n\ncontext rbt_impl\nbegin\ninterpretation rbt_impl_deps .\n\n\nabbreviation \"is_black_b x \\<equiv> matches_rbt (RP_Branch CP_B RP_Var RP_Var) x\"\nabbreviation \"is_red_b x \\<equiv> matches_rbt (RP_Branch CP_R RP_Var RP_Var) x\"\n\nabbreviation \"ll_is_black_br x \\<equiv> ll_matches_rbt (RP_Branch CP_B RP_Var RP_Var) x\"\nabbreviation \"ll_is_red_br x \\<equiv> ll_matches_rbt (RP_Branch CP_R RP_Var RP_Var) x\"\n\n\npartial_function (M) combine ::\n  \"('ki, 'vi) rbti \\<Rightarrow> ('ki, 'vi) rbti \\<Rightarrow> ('ki, 'vi) rbti llM\" where\n  \"combine l_p r_p = do {\n    if l_p = null then return r_p\n    else if r_p = null then return l_p\n    else do {\n      l \\<leftarrow> ll_load l_p;\n      r \\<leftarrow> ll_load r_p;\n      if rbt_node.color l = rbt_node.color r\n      then do {\n        combined_p \\<leftarrow> combine (rbt_node.right l) (rbt_node.left r);\n        if! ll_is_red_br combined_p then!\n        do {\n            combined \\<leftarrow> ll_load combined_p;\n            case combined of (RBT_NODE cc cl ck cv cr) \\<Rightarrow>\n            do {\n              set_right_p cl l_p;\n              set_left_p cr r_p;\n              ll_store (RBT_NODE cc l_p ck cv r_p) combined_p;\n              return combined_p\n            }\n        }\n        else! do {\n          set_left_p combined_p r_p;\n          if rbt_node.color l = 0\n          then do {\n            set_right_p r_p l_p;\n            return l_p\n          }\n          else do {\n            case l of (RBT_NODE _ ll lk lv _) \\<Rightarrow>\n            do {\n              ll_free l_p;\n              balance_left ll lk lv r_p\n            }\n          }\n        }\n      }\n      else if (rbt_node.color r = 0)\n      then do {\n        combined_p \\<leftarrow> combine l_p (rbt_node.left r);\n        set_left_p combined_p r_p;\n        return r_p\n      }\n      else do { \n        combined_p \\<leftarrow> combine (rbt_node.right l) r_p;\n        set_right_p combined_p l_p;\n        return l_p\n      }\n    }\n  }\"\n\n\nlemma combine_correct [vcg_rules]:\n  \"\n  llvm_htriple\n  (rbt_assn l li ** rbt_assn r ri)\n  (combine li ri)\n  (\\<lambda>x. rbt_assn (rbt_combine l r) x)\n\"\nproof(induction l r arbitrary: li ri rule: RBT_Impl.combine.induct)\n  case (1 x)\n  then show ?case \n    apply (subst combine.simps)\n    apply vcg\n    done\nnext\n  case (2 v va vb vc vd)\n  then show ?case \n    apply (subst combine.simps)\n    apply vcg\n    done\nnext\n  case (3 a k x b c s y d)\n  note [vcg_rules] = 3\n  show ?case\n    apply (subst combine.simps)\n    apply vcg\n    apply (cases \"rbt_combine b c\")\n     apply (auto split: color.splits)\n     apply vcg\n    done\nnext\n  case (4 a k x b c s y d)\n  note [vcg_rules] = 4\n  show ?case\n    apply (subst combine.simps)\n    apply vcg\n    apply (cases \"rbt_combine b c\")\n     apply (auto split: color.splits)\n     apply vcg\n    done\nnext\n  case (5 va vb vc vd b k x c)\n  note [vcg_rules] = 5\n  show ?case\n    apply (subst combine.simps)\n    apply vcg\n    done\nnext\n  case (6 a k x b va vb vc vd)\n  note [vcg_rules] = 6\n  show ?case\n    apply (subst combine.simps)\n    apply vcg\n    done\nqed\n\n\nlemmas [llvm_code] = combine.simps\n\n\nend\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Delete/Combine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.3121095014503378}}
{"text": "section \\<open>Static backward slice\\<close>\n\ntheory Slice \n  imports Observable Distance DataDependence \"../Basic/SemanticsCFG\"  \nbegin\n\nlocale BackwardSlice = \n  CFG_wf sourcenode targetnode kind valid_edge Entry Def Use state_val\n  for sourcenode :: \"'edge \\<Rightarrow> 'node\" and targetnode :: \"'edge \\<Rightarrow> 'node\"\n  and kind :: \"'edge \\<Rightarrow> 'state edge_kind\" and valid_edge :: \"'edge \\<Rightarrow> bool\"\n  and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\<Rightarrow> 'var set\"\n  and Use :: \"'node \\<Rightarrow> 'var set\" and state_val :: \"'state \\<Rightarrow> 'var \\<Rightarrow> 'val\" +\n  fixes backward_slice :: \"'node set \\<Rightarrow> 'node set\"\n  assumes valid_nodes:\"n \\<in> backward_slice S \\<Longrightarrow> valid_node n\"\n  and refl:\"\\<lbrakk>valid_node n; n \\<in> S\\<rbrakk> \\<Longrightarrow> n \\<in> backward_slice S\"\n  and dd_closed:\"\\<lbrakk>n' \\<in> backward_slice S; n influences V in n'\\<rbrakk> \n  \\<Longrightarrow> n \\<in> backward_slice S\"\n  and obs_finite:\"finite (obs n (backward_slice S))\"\n  and obs_singleton:\"card (obs n (backward_slice S)) \\<le> 1\"\n\nbegin\n\nlemma slice_n_in_obs:\n  \"n \\<in> backward_slice S \\<Longrightarrow> obs n (backward_slice S) = {n}\"\nby(fastforce intro!:n_in_obs dest:valid_nodes)\n\nlemma obs_singleton_disj: \n  \"(\\<exists>m. obs n (backward_slice S) = {m}) \\<or> obs n (backward_slice S) = {}\"\nproof -\n  have \"finite(obs n (backward_slice S))\" by(rule obs_finite)\n  show ?thesis\n  proof(cases \"card(obs n (backward_slice S)) = 0\")\n    case True\n    with \\<open>finite(obs n (backward_slice S))\\<close> have \"obs n (backward_slice S) = {}\"\n      by simp\n    thus ?thesis by simp\n  next\n    case False\n    have \"card(obs n (backward_slice S)) \\<le> 1\" by(rule obs_singleton)\n    with False have \"card(obs n (backward_slice S)) = 1\"\n      by simp\n    hence \"\\<exists>m. obs n (backward_slice S) = {m}\" by(fastforce dest:card_eq_SucD)\n    thus ?thesis by simp\n  qed\nqed\n\n\nlemma obs_singleton_element:\n  assumes \"m \\<in> obs n (backward_slice S)\" shows \"obs n (backward_slice S) = {m}\"\nproof -\n  have \"(\\<exists>m. obs n (backward_slice S) = {m}) \\<or> obs n (backward_slice S) = {}\"\n    by(rule obs_singleton_disj)\n  with \\<open>m \\<in> obs n (backward_slice S)\\<close> show ?thesis by fastforce\nqed\n\n\nlemma obs_the_element: \n  \"m \\<in> obs n (backward_slice S) \\<Longrightarrow> (THE m. m \\<in> obs n (backward_slice S)) = m\"\nby(fastforce dest:obs_singleton_element)\n\n\nsubsection \\<open>Traversing the sliced graph\\<close>\n\ntext \\<open>\\<open>slice_kind S a\\<close> conforms to @{term \"kind a\"} in the\n  sliced graph\\<close>\n\ndefinition slice_kind :: \"'node set \\<Rightarrow> 'edge \\<Rightarrow> 'state edge_kind\"\n  where \"slice_kind S a = (let S' = backward_slice S; n = sourcenode a in \n  (if sourcenode a \\<in> S' then kind a\n   else (case kind a of \\<Up>f \\<Rightarrow> \\<Up>id | (Q)\\<^sub>\\<surd> \\<Rightarrow> \n    (if obs (sourcenode a) S' = {} then \n      (let nx = (SOME n'. \\<exists>a'. n = sourcenode a' \\<and> valid_edge a' \\<and> targetnode a' = n')\n      in (if (targetnode a = nx) then (\\<lambda>s. True)\\<^sub>\\<surd> else (\\<lambda>s. False)\\<^sub>\\<surd>))\n     else (let m = THE m. m \\<in> obs n S' in \n       (if (\\<exists>x. distance (targetnode a) m x \\<and> distance n m (x + 1) \\<and>\n            (targetnode a = (SOME nx'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                     distance (targetnode a') m x \\<and>\n                                     valid_edge a' \\<and> targetnode a' = nx'))) \n          then (\\<lambda>s. True)\\<^sub>\\<surd> else (\\<lambda>s. False)\\<^sub>\\<surd>\n       ))\n     ))\n  ))\"\n\n\ndefinition\n  slice_kinds :: \"'node set \\<Rightarrow> 'edge list \\<Rightarrow> 'state edge_kind list\"\n  where \"slice_kinds S as \\<equiv> map (slice_kind S) as\"\n\n\nlemma slice_kind_in_slice:\n  \"sourcenode a \\<in> backward_slice S \\<Longrightarrow> slice_kind S a = kind a\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Upd:\n  \"\\<lbrakk>sourcenode a \\<notin> backward_slice S; kind a = \\<Up>f\\<rbrakk> \\<Longrightarrow> slice_kind S a = \\<Up>id\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Pred_empty_obs_SOME:\n  \"\\<lbrakk>sourcenode a \\<notin> backward_slice S; kind a = (Q)\\<^sub>\\<surd>; \n    obs (sourcenode a) (backward_slice S) = {}; \n    targetnode a = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> valid_edge a' \\<and>\n                                  targetnode a' = n')\\<rbrakk>\n  \\<Longrightarrow> slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd>\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Pred_empty_obs_not_SOME:\n  \"\\<lbrakk>sourcenode a \\<notin> backward_slice S; kind a = (Q)\\<^sub>\\<surd>; \n    obs (sourcenode a) (backward_slice S) = {}; \n    targetnode a \\<noteq> (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> valid_edge a' \\<and>\n                                  targetnode a' = n')\\<rbrakk>\n  \\<Longrightarrow> slice_kind S a = (\\<lambda>s. False)\\<^sub>\\<surd>\"\nby(simp add:slice_kind_def)\n\n\nlemma slice_kind_Pred_obs_nearer_SOME:\n  assumes \"sourcenode a \\<notin> backward_slice S\" and \"kind a = (Q)\\<^sub>\\<surd>\" \n  and \"m \\<in> obs (sourcenode a) (backward_slice S)\"\n  and \"distance (targetnode a) m x\" \"distance (sourcenode a) m (x + 1)\"\n  and \"targetnode a = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and>\n                                          distance (targetnode a') m x \\<and>\n                                          valid_edge a' \\<and> targetnode a' = n')\"\n  shows \"slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd>\"\nproof -\n  from \\<open>m \\<in> obs (sourcenode a) (backward_slice S)\\<close>\n  have \"m = (THE m. m \\<in> obs (sourcenode a) (backward_slice S))\"\n    by(rule obs_the_element[THEN sym])\n  with assms show ?thesis\n    by(fastforce simp:slice_kind_def Let_def)\nqed\n\n\nlemma slice_kind_Pred_obs_nearer_not_SOME:\n  assumes \"sourcenode a \\<notin> backward_slice S\" and \"kind a = (Q)\\<^sub>\\<surd>\" \n  and \"m \\<in> obs (sourcenode a) (backward_slice S)\"\n  and \"distance (targetnode a) m x\" \"distance (sourcenode a) m (x + 1)\"\n  and \"targetnode a \\<noteq> (SOME nx'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                          distance (targetnode a') m x \\<and>\n                                          valid_edge a' \\<and> targetnode a' = nx')\"\n  shows \"slice_kind S a = (\\<lambda>s. False)\\<^sub>\\<surd>\"\nproof -\n  from \\<open>m \\<in> obs (sourcenode a) (backward_slice S)\\<close>\n  have \"m = (THE m. m \\<in> obs (sourcenode a) (backward_slice S))\"\n    by(rule obs_the_element[THEN sym])\n  with assms show ?thesis\n    by(fastforce dest:distance_det simp:slice_kind_def Let_def)\nqed\n\n\nlemma slice_kind_Pred_obs_not_nearer:\n  assumes \"sourcenode a \\<notin> backward_slice S\" and \"kind a = (Q)\\<^sub>\\<surd>\" \n  and in_obs:\"m \\<in> obs (sourcenode a) (backward_slice S)\"\n  and dist:\"distance (sourcenode a) m (x + 1)\" \n           \"\\<not> distance (targetnode a) m x\"\n  shows \"slice_kind S a = (\\<lambda>s. False)\\<^sub>\\<surd>\"\nproof -\n  from in_obs have the:\"m = (THE m. m \\<in> obs (sourcenode a) (backward_slice S))\"\n    by(rule obs_the_element[THEN sym])\n  from dist have \"\\<not> (\\<exists>x. distance (targetnode a) m x \\<and> \n                            distance (sourcenode a) m (x + 1))\"\n    by(fastforce dest:distance_det)\n  with \\<open>sourcenode a \\<notin> backward_slice S\\<close> \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close> in_obs the show ?thesis\n    by(fastforce simp:slice_kind_def Let_def)\nqed\n\n\nlemma kind_Predicate_notin_slice_slice_kind_Predicate:\n  assumes \"kind a = (Q)\\<^sub>\\<surd>\" and \"sourcenode a \\<notin> backward_slice S\"\n  obtains Q' where \"slice_kind S a = (Q')\\<^sub>\\<surd>\" and \"Q' = (\\<lambda>s. False) \\<or> Q' = (\\<lambda>s. True)\"\nproof(atomize_elim)\n  show \"\\<exists>Q'. slice_kind S a = (Q')\\<^sub>\\<surd> \\<and> (Q' = (\\<lambda>s. False) \\<or> Q' = (\\<lambda>s. True))\"\n  proof(cases \"obs (sourcenode a) (backward_slice S) = {}\")\n    case True\n    show ?thesis\n    proof(cases \"targetnode a = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                               valid_edge a' \\<and> targetnode a' = n')\")\n      case True\n      with \\<open>sourcenode a \\<notin> backward_slice S\\<close> \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close>\n        \\<open>obs (sourcenode a) (backward_slice S) = {}\\<close>\n      have \"slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd>\" by(rule slice_kind_Pred_empty_obs_SOME)\n      thus ?thesis by simp\n    next\n      case False\n      with \\<open>sourcenode a \\<notin> backward_slice S\\<close> \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close>\n        \\<open>obs (sourcenode a) (backward_slice S) = {}\\<close>\n      have \"slice_kind S a = (\\<lambda>s. False)\\<^sub>\\<surd>\"\n        by(rule slice_kind_Pred_empty_obs_not_SOME)\n      thus ?thesis by simp\n    qed\n  next\n    case False\n    then obtain m where \"m \\<in> obs (sourcenode a) (backward_slice S)\" by blast\n    show ?thesis\n    proof(cases \"\\<exists>x. distance (targetnode a) m x \\<and> \n        distance (sourcenode a) m (x + 1)\")\n      case True\n      then obtain x where \"distance (targetnode a) m x\" \n        and \"distance (sourcenode a) m (x + 1)\" by blast\n      show ?thesis\n      proof(cases \"targetnode a = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and>\n                                                 distance (targetnode a') m x \\<and>\n                                                 valid_edge a' \\<and> targetnode a' = n')\")\n        case True\n        with \\<open>sourcenode a \\<notin> backward_slice S\\<close> \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close>\n          \\<open>m \\<in> obs (sourcenode a) (backward_slice S)\\<close>\n          \\<open>distance (targetnode a) m x\\<close> \\<open>distance (sourcenode a) m (x + 1)\\<close>\n        have \"slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n          by(rule slice_kind_Pred_obs_nearer_SOME)\n        thus ?thesis by simp\n      next\n        case False\n        with \\<open>sourcenode a \\<notin> backward_slice S\\<close> \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close>\n          \\<open>m \\<in> obs (sourcenode a) (backward_slice S)\\<close>\n          \\<open>distance (targetnode a) m x\\<close> \\<open>distance (sourcenode a) m (x + 1)\\<close>\n        have \"slice_kind S a = (\\<lambda>s. False)\\<^sub>\\<surd>\"\n          by(rule slice_kind_Pred_obs_nearer_not_SOME)\n        thus ?thesis by simp\n      qed\n    next\n      case False\n      from \\<open>m \\<in> obs (sourcenode a) (backward_slice S)\\<close>\n      have \"m = (THE m. m \\<in> obs (sourcenode a) (backward_slice S))\"\n        by(rule obs_the_element[THEN sym])\n      with \\<open>sourcenode a \\<notin> backward_slice S\\<close> \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close> False\n        \\<open>m \\<in> obs (sourcenode a) (backward_slice S)\\<close>\n      have \"slice_kind S a = (\\<lambda>s. False)\\<^sub>\\<surd>\"\n        by(fastforce simp:slice_kind_def Let_def)\n      thus ?thesis by simp\n    qed\n  qed\nqed\n\n\nlemma only_one_SOME_edge:\n  assumes \"valid_edge a\"\n  shows \"\\<exists>!a'. sourcenode a = sourcenode a' \\<and> valid_edge a' \\<and>\n               targetnode a' = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                              valid_edge a' \\<and> targetnode a' = n')\"\nproof(rule ex_ex1I)\n  show \"\\<exists>a'. sourcenode a = sourcenode a' \\<and> valid_edge a' \\<and>\n             targetnode a' = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                            valid_edge a' \\<and> targetnode a' = n')\"\n  proof -\n    have \"(\\<exists>a'. sourcenode a = sourcenode a' \\<and> valid_edge a' \\<and>\n                targetnode a' = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                               valid_edge a' \\<and> targetnode a' = n')) =\n      (\\<exists>n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> valid_edge a' \\<and> targetnode a' = n')\"\n      apply(unfold some_eq_ex[of \"\\<lambda>n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                            valid_edge a' \\<and> targetnode a' = n'\"])\n      by simp\n    also have \"\\<dots>\" using \\<open>valid_edge a\\<close> by blast\n    finally show ?thesis .\n  qed\nnext\n  fix a' ax\n  assume \"sourcenode a = sourcenode a' \\<and> valid_edge a' \\<and>\n    targetnode a' = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                   valid_edge a' \\<and> targetnode a' = n')\"\n    and \"sourcenode a = sourcenode ax \\<and> valid_edge ax \\<and>\n    targetnode ax = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                              valid_edge a' \\<and> targetnode a' = n')\"\n  thus \"a' = ax\" by(fastforce intro!:edge_det)\nqed\n\n\nlemma slice_kind_only_one_True_edge:\n  assumes \"sourcenode a = sourcenode a'\" and \"targetnode a \\<noteq> targetnode a'\" \n  and \"valid_edge a\" and \"valid_edge a'\" and \"slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n  shows \"slice_kind S a' = (\\<lambda>s. False)\\<^sub>\\<surd>\"\nproof -\n  from assms obtain Q Q' where \"kind a = (Q)\\<^sub>\\<surd>\"\n    and \"kind a' = (Q')\\<^sub>\\<surd>\" and det:\"\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s)\"\n    by(auto dest:deterministic)\n  from \\<open>valid_edge a\\<close> have ex1:\"\\<exists>!a'. sourcenode a = sourcenode a' \\<and> valid_edge a' \\<and>\n               targetnode a' = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                              valid_edge a' \\<and> targetnode a' = n')\"\n    by(rule only_one_SOME_edge)\n  show ?thesis\n  proof(cases \"sourcenode a \\<in> backward_slice S\")\n    case True\n    with \\<open>slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd>\\<close> \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close> have \"Q = (\\<lambda>s. True)\"\n      by(simp add:slice_kind_def Let_def)\n    with det have \"Q' = (\\<lambda>s. False)\" by(simp add:fun_eq_iff)\n    with True \\<open>kind a' = (Q')\\<^sub>\\<surd>\\<close> \\<open>sourcenode a = sourcenode a'\\<close> show ?thesis\n      by(simp add:slice_kind_def Let_def)\n  next\n    case False\n    hence \"sourcenode a \\<notin> backward_slice S\" by simp\n    thus ?thesis\n    proof(cases \"obs (sourcenode a) (backward_slice S) = {}\")\n      case True\n      with \\<open>sourcenode a \\<notin> backward_slice S\\<close> \\<open>slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd>\\<close>\n        \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close>\n      have target:\"targetnode a = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                                 valid_edge a' \\<and> targetnode a' = n')\"\n        by(auto simp:slice_kind_def Let_def fun_eq_iff split:if_split_asm)\n      have \"targetnode a' \\<noteq> (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                            valid_edge a' \\<and> targetnode a' = n')\"\n      proof(rule ccontr)\n        assume \"\\<not> targetnode a' \\<noteq> (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                                 valid_edge a' \\<and> targetnode a' = n')\"\n        hence \"targetnode a' = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                              valid_edge a' \\<and> targetnode a' = n')\"\n          by simp\n        with ex1 target \\<open>sourcenode a = sourcenode a'\\<close> \\<open>valid_edge a\\<close>\n          \\<open>valid_edge a'\\<close> have \"a = a'\" by blast\n        with \\<open>targetnode a \\<noteq> targetnode a'\\<close> show False by simp\n      qed\n      with \\<open>sourcenode a \\<notin> backward_slice S\\<close> True \\<open>kind a' = (Q')\\<^sub>\\<surd>\\<close>\n        \\<open>sourcenode a = sourcenode a'\\<close> show ?thesis \n        by(auto simp:slice_kind_def Let_def fun_eq_iff split:if_split_asm)\n    next\n      case False\n      hence \"obs (sourcenode a) (backward_slice S) \\<noteq> {}\" .\n      then obtain m where \"m \\<in> obs (sourcenode a) (backward_slice S)\" by auto\n      hence \"m = (THE m. m \\<in> obs (sourcenode a) (backward_slice S))\"\n        by(auto dest:obs_the_element)\n      with \\<open>sourcenode a \\<notin> backward_slice S\\<close> \n        \\<open>obs (sourcenode a) (backward_slice S) \\<noteq> {}\\<close> \n        \\<open>slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd>\\<close> \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close>\n      obtain x x' where \"distance (targetnode a) m x\" \n        \"distance (sourcenode a) m (x + 1)\"\n        and target:\"targetnode a = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and>\n                                                 distance (targetnode a') m x \\<and>\n                                                 valid_edge a' \\<and> targetnode a' = n')\"\n        by(auto simp:slice_kind_def Let_def fun_eq_iff split:if_split_asm)\n      show ?thesis\n      proof(cases \"distance (targetnode a') m x\")\n        case False\n        with \\<open>sourcenode a \\<notin> backward_slice S\\<close> \\<open>kind a' = (Q')\\<^sub>\\<surd>\\<close>\n          \\<open>m \\<in> obs (sourcenode a) (backward_slice S)\\<close>\n          \\<open>distance (targetnode a) m x\\<close> \\<open>distance (sourcenode a) m (x + 1)\\<close>\n          \\<open>sourcenode a = sourcenode a'\\<close> show ?thesis\n          by(fastforce intro:slice_kind_Pred_obs_not_nearer)\n      next\n        case True\n        from \\<open>valid_edge a\\<close> \\<open>distance (targetnode a) m x\\<close>\n          \\<open>distance (sourcenode a) m (x + 1)\\<close>\n        have ex1:\"\\<exists>!a'. sourcenode a = sourcenode a' \\<and> \n               distance (targetnode a') m x \\<and> valid_edge a' \\<and>\n               targetnode a' = (SOME nx. \\<exists>a'. sourcenode a = sourcenode a' \\<and>\n                                              distance (targetnode a') m x \\<and>\n                                              valid_edge a' \\<and> targetnode a' = nx)\"\n          by(fastforce intro!:only_one_SOME_dist_edge)\n        have \"targetnode a' \\<noteq> (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                               distance (targetnode a') m x \\<and>\n                                               valid_edge a' \\<and> targetnode a' = n')\"\n        proof(rule ccontr)\n          assume \"\\<not> targetnode a' \\<noteq> (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                                 distance (targetnode a') m x \\<and>\n                                                 valid_edge a' \\<and> targetnode a' = n')\"\n          hence \"targetnode a' = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and>\n                                                distance (targetnode a') m x \\<and>\n                                                valid_edge a' \\<and> targetnode a' = n')\"\n            by simp\n          with ex1 target \\<open>sourcenode a = sourcenode a'\\<close> \n            \\<open>valid_edge a\\<close> \\<open>valid_edge a'\\<close> \n            \\<open>distance (targetnode a) m x\\<close> \\<open>distance (sourcenode a) m (x + 1)\\<close>\n          have \"a = a'\" by auto\n          with \\<open>targetnode a \\<noteq> targetnode a'\\<close> show False by simp\n        qed\n        with \\<open>sourcenode a \\<notin> backward_slice S\\<close> \n          \\<open>kind a' = (Q')\\<^sub>\\<surd>\\<close> \\<open>m \\<in> obs (sourcenode a) (backward_slice S)\\<close>\n          \\<open>distance (targetnode a) m x\\<close> \\<open>distance (sourcenode a) m (x + 1)\\<close>\n          True \\<open>sourcenode a = sourcenode a'\\<close> show ?thesis\n          by(fastforce intro:slice_kind_Pred_obs_nearer_not_SOME)\n      qed\n    qed\n  qed\nqed\n\n\nlemma slice_deterministic:\n  assumes \"valid_edge a\" and \"valid_edge a'\"\n  and \"sourcenode a = sourcenode a'\" and \"targetnode a \\<noteq> targetnode a'\"\n  obtains Q Q' where \"slice_kind S a = (Q)\\<^sub>\\<surd>\" and \"slice_kind S a' = (Q')\\<^sub>\\<surd>\"\n  and \"\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s)\"\nproof(atomize_elim)\n  from assms obtain Q Q' \n    where \"kind a = (Q)\\<^sub>\\<surd>\" and \"kind a' = (Q')\\<^sub>\\<surd>\" \n    and det:\"\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s)\"\n    by(auto dest:deterministic)\n  from \\<open>valid_edge a\\<close> have ex1:\"\\<exists>!a'. sourcenode a = sourcenode a' \\<and> valid_edge a' \\<and>\n               targetnode a' = (SOME n'. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                              valid_edge a' \\<and> targetnode a' = n')\"\n    by(rule only_one_SOME_edge)\n  show \"\\<exists>Q Q'. slice_kind S a = (Q)\\<^sub>\\<surd> \\<and> slice_kind S a' = (Q')\\<^sub>\\<surd> \\<and> \n                (\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s))\"\n  proof(cases \"sourcenode a \\<in> backward_slice S\")\n    case True\n    with \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close> have \"slice_kind S a = (Q)\\<^sub>\\<surd>\"\n      by(simp add:slice_kind_def Let_def)\n    from True \\<open>kind a' = (Q')\\<^sub>\\<surd>\\<close> \\<open>sourcenode a = sourcenode a'\\<close>\n    have \"slice_kind S a' = (Q')\\<^sub>\\<surd>\"\n      by(simp add:slice_kind_def Let_def)\n    with \\<open>slice_kind S a = (Q)\\<^sub>\\<surd>\\<close> det show ?thesis by blast\n  next\n    case False\n    with \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close> \n    have \"slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd> \\<or> slice_kind S a = (\\<lambda>s. False)\\<^sub>\\<surd>\"\n      by(simp add:slice_kind_def Let_def)\n    thus ?thesis\n    proof\n      assume true:\"slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n      with \\<open>sourcenode a = sourcenode a'\\<close> \\<open>targetnode a \\<noteq> targetnode a'\\<close>\n        \\<open>valid_edge a\\<close> \\<open>valid_edge a'\\<close>\n      have \"slice_kind S a' = (\\<lambda>s. False)\\<^sub>\\<surd>\"\n        by(rule slice_kind_only_one_True_edge)\n      with true show ?thesis by simp\n    next\n      assume false:\"slice_kind S a = (\\<lambda>s. False)\\<^sub>\\<surd>\"\n      from False \\<open>kind a' = (Q')\\<^sub>\\<surd>\\<close> \\<open>sourcenode a = sourcenode a'\\<close>\n      have \"slice_kind S a' = (\\<lambda>s. True)\\<^sub>\\<surd> \\<or> slice_kind S a' = (\\<lambda>s. False)\\<^sub>\\<surd>\"\n        by(simp add:slice_kind_def Let_def)\n      with false show ?thesis by auto\n    qed\n  qed\nqed\n\n\n\n\nsubsection \\<open>Observable and silent moves\\<close>\n\ninductive silent_move :: \n  \"'node set \\<Rightarrow> ('edge \\<Rightarrow> 'state edge_kind) \\<Rightarrow> 'node \\<Rightarrow> 'state \\<Rightarrow> 'edge \\<Rightarrow> \n  'node \\<Rightarrow> 'state \\<Rightarrow> bool\" (\"_,_ \\<turnstile> '(_,_') -_\\<rightarrow>\\<^sub>\\<tau> '(_,_')\" [51,50,0,0,50,0,0] 51) \n \n  where silent_moveI:\n  \"\\<lbrakk>pred (f a) s; transfer (f a) s = s'; sourcenode a \\<notin> backward_slice S; \n    valid_edge a\\<rbrakk>  \n  \\<Longrightarrow> S,f \\<turnstile> (sourcenode a,s) -a\\<rightarrow>\\<^sub>\\<tau> (targetnode a,s')\"\n\n\ninductive silent_moves :: \n  \"'node set \\<Rightarrow> ('edge \\<Rightarrow> 'state edge_kind) \\<Rightarrow> 'node \\<Rightarrow> 'state \\<Rightarrow> 'edge list \\<Rightarrow> \n  'node \\<Rightarrow> 'state \\<Rightarrow> bool\" (\"_,_ \\<turnstile> '(_,_') =_\\<Rightarrow>\\<^sub>\\<tau> '(_,_')\" [51,50,0,0,50,0,0] 51)\n\n  where silent_moves_Nil: \"S,f \\<turnstile> (n,s) =[]\\<Rightarrow>\\<^sub>\\<tau> (n,s)\"\n\n  | silent_moves_Cons:\n  \"\\<lbrakk>S,f \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (n',s'); S,f \\<turnstile> (n',s') =as\\<Rightarrow>\\<^sub>\\<tau> (n'',s'')\\<rbrakk> \n  \\<Longrightarrow> S,f \\<turnstile> (n,s) =a#as\\<Rightarrow>\\<^sub>\\<tau> (n'',s'')\"\n\n\nlemma silent_moves_obs_slice:\n  \"\\<lbrakk>S,f \\<turnstile> (n,s) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s'); nx \\<in> obs n' (backward_slice S)\\<rbrakk>\n  \\<Longrightarrow> nx \\<in> obs n (backward_slice S)\"\nproof(induct rule:silent_moves.induct)\n  case silent_moves_Nil thus ?case by simp\nnext\n  case (silent_moves_Cons S f n s a n' s' as n'' s'')\n  from \\<open>nx \\<in> obs n'' (backward_slice S)\\<close>\n    \\<open>nx \\<in> obs n'' (backward_slice S) \\<Longrightarrow> nx \\<in> obs n' (backward_slice S)\\<close>\n  have obs:\"nx \\<in> obs n' (backward_slice S)\" by simp\n  from \\<open>S,f \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (n',s')\\<close>\n  have \"n = sourcenode a\" and \"n' = targetnode a\" and \"valid_edge a\" \n    and \"n \\<notin> (backward_slice S)\"\n    by(auto elim:silent_move.cases)\n  hence \"obs n' (backward_slice S) \\<subseteq> obs n (backward_slice S)\"\n    by simp(rule edge_obs_subset,simp+)\n  with obs show ?case by blast\nqed\n\n\nlemma silent_moves_preds_transfers_path:\n  \"\\<lbrakk>S,f \\<turnstile> (n,s) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s'); valid_node n\\<rbrakk> \n  \\<Longrightarrow> preds (map f as) s \\<and> transfers (map f as) s = s' \\<and> n -as\\<rightarrow>* n'\"\nproof(induct rule:silent_moves.induct)\n  case silent_moves_Nil thus ?case by(simp add:path.empty_path)\nnext\n  case (silent_moves_Cons S f n s a n' s' as n'' s'')\n  note IH = \\<open>valid_node n' \\<Longrightarrow>\n    preds (map f as) s' \\<and> transfers (map f as) s' = s'' \\<and> n' -as\\<rightarrow>* n''\\<close>\n  from \\<open>S,f \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (n',s')\\<close> have \"pred (f a) s\" and \"transfer (f a) s = s'\"\n    and \"n = sourcenode a\" and \"n' = targetnode a\" and \"valid_edge a\"\n    by(auto elim:silent_move.cases)\n  from \\<open>n' = targetnode a\\<close> \\<open>valid_edge a\\<close> have \"valid_node n'\" by simp\n  from IH[OF this] have \"preds (map f as) s'\" and \"transfers (map f as) s' = s''\"\n    and \"n' -as\\<rightarrow>* n''\" by simp_all\n  from \\<open>n = sourcenode a\\<close> \\<open>n' = targetnode a\\<close> \\<open>valid_edge a\\<close> \\<open>n' -as\\<rightarrow>* n''\\<close>\n  have \"n -a#as\\<rightarrow>* n''\" by(fastforce intro:Cons_path)\n  with \\<open>pred (f a) s\\<close> \\<open>preds (map f as) s'\\<close> \\<open>transfer (f a) s = s'\\<close> \n    \\<open>transfers (map f as) s' = s''\\<close> show ?case by simp\nqed\n\n\nlemma obs_silent_moves:\n  assumes \"obs n (backward_slice S) = {n'}\"\n  obtains as where \"S,slice_kind S \\<turnstile> (n,s) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s)\"\nproof(atomize_elim)\n  from \\<open>obs n (backward_slice S) = {n'}\\<close> \n  have \"n' \\<in> obs n (backward_slice S)\" by simp\n  then obtain as where \"n -as\\<rightarrow>* n'\" \n    and \"\\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> (backward_slice S)\"\n    and \"n' \\<in> (backward_slice S)\" by(erule obsE)\n  from \\<open>n -as\\<rightarrow>* n'\\<close> obtain x where \"distance n n' x\" and \"x \\<le> length as\"\n    by(erule every_path_distance)\n  from \\<open>distance n n' x\\<close> \\<open>n' \\<in> obs n (backward_slice S)\\<close> \n  show \"\\<exists>as. S,slice_kind S \\<turnstile> (n,s) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s)\"\n  proof(induct x arbitrary:n s rule:nat.induct)\n    fix n s assume \"distance n n' 0\"\n    then obtain as' where \"n -as'\\<rightarrow>* n'\" and \"length as' = 0\"\n      by(auto elim:distance.cases)\n    hence \"n -[]\\<rightarrow>* n'\" by(cases as) auto\n    hence \"n = n'\" by(fastforce elim:path.cases)\n    hence \"S,slice_kind S \\<turnstile> (n,s) =[]\\<Rightarrow>\\<^sub>\\<tau> (n',s)\" by(fastforce intro:silent_moves_Nil)\n    thus \"\\<exists>as. S,slice_kind S \\<turnstile> (n,s) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s)\" by blast\n  next\n    fix x n s \n    assume \"distance n n' (Suc x)\" and \"n' \\<in> obs n (backward_slice S)\"\n      and IH:\"\\<And>n s. \\<lbrakk>distance n n' x; n' \\<in> obs n (backward_slice S)\\<rbrakk> \n              \\<Longrightarrow> \\<exists>as. S,slice_kind S \\<turnstile> (n,s) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s)\"\n    from \\<open>n' \\<in> obs n (backward_slice S)\\<close>\n    have \"valid_node n\" by(rule in_obs_valid)\n    with \\<open>distance n n' (Suc x)\\<close>\n    have \"n \\<noteq> n'\" by(fastforce elim:distance.cases dest:empty_path)\n    have \"n \\<notin> backward_slice S\"\n    proof\n      assume isin:\"n \\<in> backward_slice S\"\n      with \\<open>valid_node n\\<close> have \"obs n (backward_slice S) = {n}\"\n        by(fastforce intro!:n_in_obs)\n      with \\<open>n' \\<in> obs n (backward_slice S)\\<close> \\<open>n \\<noteq> n'\\<close> show False by simp\n    qed\n    from \\<open>distance n n' (Suc x)\\<close> obtain a where \"valid_edge a\" \n      and \"n = sourcenode a\" and \"distance (targetnode a) n' x\"\n      and target:\"targetnode a = (SOME nx. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n                                     distance (targetnode a') n' x \\<and>\n                                     valid_edge a' \\<and> targetnode a' = nx)\"\n      by -(erule distance_successor_distance,simp+)\n    from \\<open>n' \\<in> obs n (backward_slice S)\\<close>\n    have \"obs n (backward_slice S) = {n'}\"\n      by(rule obs_singleton_element)\n    with \\<open>valid_edge a\\<close> \\<open>n \\<notin> backward_slice S\\<close> \\<open>n = sourcenode a\\<close>\n    have disj:\"obs (targetnode a) (backward_slice S) = {} \\<or> \n               obs (targetnode a) (backward_slice S) = {n'}\"\n      by -(drule_tac S=\"backward_slice S\" in edge_obs_subset,auto)\n    from \\<open>distance (targetnode a) n' x\\<close> obtain asx where \"targetnode a -asx\\<rightarrow>* n'\" \n      and \"length asx = x\" and \"\\<forall>as'. targetnode a -as'\\<rightarrow>* n' \\<longrightarrow> x \\<le> length as'\" \n      by(auto elim:distance.cases)\n    from \\<open>targetnode a -asx\\<rightarrow>* n'\\<close> \\<open>n' \\<in> (backward_slice S)\\<close>\n    obtain m where \"\\<exists>m. m \\<in> obs (targetnode a) (backward_slice S)\"\n      by(fastforce elim:path_ex_obs)\n    with disj have \"n' \\<in> obs (targetnode a) (backward_slice S)\" by fastforce\n    from IH[OF \\<open>distance (targetnode a) n' x\\<close> this,of \"transfer (slice_kind S a) s\"]\n    obtain asx' where \n    moves:\"S,slice_kind S \\<turnstile> (targetnode a,transfer (slice_kind S a) s) =asx'\\<Rightarrow>\\<^sub>\\<tau> \n                               (n',transfer (slice_kind S a) s)\" by blast\n    have \"pred (slice_kind S a) s \\<and> transfer (slice_kind S a) s = s\"\n    proof(cases \"kind a\")\n      case (Update f)\n      with \\<open>n \\<notin> backward_slice S\\<close> \\<open>n = sourcenode a\\<close> have \"slice_kind S a = \\<Up>id\" \n        by(fastforce intro:slice_kind_Upd)\n      thus ?thesis by simp\n    next\n      case (Predicate Q)\n      with \\<open>n \\<notin> backward_slice S\\<close> \\<open>n = sourcenode a\\<close>\n        \\<open>n' \\<in> obs n (backward_slice S)\\<close> \\<open>distance (targetnode a) n' x\\<close>\n        \\<open>distance n n' (Suc x)\\<close> target\n      have \"slice_kind S a =  (\\<lambda>s. True)\\<^sub>\\<surd>\"\n        by(fastforce intro:slice_kind_Pred_obs_nearer_SOME)\n      thus ?thesis by simp\n    qed\n    hence \"pred (slice_kind S a) s\" and \"transfer (slice_kind S a) s = s\"\n      by simp_all\n    with \\<open>n \\<notin> backward_slice S\\<close> \\<open>n = sourcenode a\\<close> \\<open>valid_edge a\\<close>\n    have \"S,slice_kind S \\<turnstile> (sourcenode a,s) -a\\<rightarrow>\\<^sub>\\<tau> \n                             (targetnode a,transfer (slice_kind S a) s)\"\n      by(fastforce intro:silent_moveI)\n    with moves \\<open>transfer (slice_kind S a) s = s\\<close> \\<open>n = sourcenode a\\<close>\n    have \"S,slice_kind S \\<turnstile> (n,s) =a#asx'\\<Rightarrow>\\<^sub>\\<tau> (n',s)\"\n      by(fastforce intro:silent_moves_Cons)\n    thus \"\\<exists>as. S,slice_kind S \\<turnstile> (n,s) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s)\" by blast\n  qed\nqed\n\n\ninductive observable_move ::\n  \"'node set \\<Rightarrow> ('edge \\<Rightarrow> 'state edge_kind) \\<Rightarrow> 'node \\<Rightarrow> 'state \\<Rightarrow> 'edge \\<Rightarrow> \n  'node \\<Rightarrow> 'state \\<Rightarrow> bool\" (\"_,_ \\<turnstile> '(_,_') -_\\<rightarrow> '(_,_')\" [51,50,0,0,50,0,0] 51) \n \n  where observable_moveI:\n  \"\\<lbrakk>pred (f a) s; transfer (f a) s = s'; sourcenode a \\<in> backward_slice S; \n    valid_edge a\\<rbrakk>  \n  \\<Longrightarrow> S,f \\<turnstile> (sourcenode a,s) -a\\<rightarrow> (targetnode a,s')\"\n\n\ninductive observable_moves :: \n  \"'node set \\<Rightarrow> ('edge \\<Rightarrow> 'state edge_kind) \\<Rightarrow> 'node \\<Rightarrow> 'state \\<Rightarrow> 'edge list \\<Rightarrow> \n  'node \\<Rightarrow> 'state \\<Rightarrow> bool\" (\"_,_ \\<turnstile> '(_,_') =_\\<Rightarrow> '(_,_')\" [51,50,0,0,50,0,0] 51) \n\n  where observable_moves_snoc:\n  \"\\<lbrakk>S,f \\<turnstile> (n,s) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s'); S,f \\<turnstile> (n',s') -a\\<rightarrow> (n'',s'')\\<rbrakk> \n  \\<Longrightarrow> S,f \\<turnstile> (n,s) =as@[a]\\<Rightarrow> (n'',s'')\"\n\n\nlemma observable_move_notempty:\n  \"\\<lbrakk>S,f \\<turnstile> (n,s) =as\\<Rightarrow> (n',s'); as = []\\<rbrakk> \\<Longrightarrow> False\"\nby(induct rule:observable_moves.induct,simp)\n\n\nlemma silent_move_observable_moves:\n  \"\\<lbrakk>S,f \\<turnstile> (n'',s'') =as\\<Rightarrow> (n',s'); S,f \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (n'',s'')\\<rbrakk>\n  \\<Longrightarrow> S,f \\<turnstile> (n,s) =a#as\\<Rightarrow> (n',s')\"\nproof(induct rule:observable_moves.induct)\n  case (observable_moves_snoc S f nx sx as n' s' a' n'' s'')\n  from \\<open>S,f \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (nx,sx)\\<close> \\<open>S,f \\<turnstile> (nx,sx) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s')\\<close>\n  have \"S,f \\<turnstile> (n,s) =a#as\\<Rightarrow>\\<^sub>\\<tau> (n',s')\" by(rule silent_moves_Cons)\n  with \\<open>S,f \\<turnstile> (n',s') -a'\\<rightarrow> (n'',s'')\\<close>\n  have \"S,f \\<turnstile> (n,s) =(a#as)@[a']\\<Rightarrow> (n'',s'')\"\n    by -(rule observable_moves.observable_moves_snoc)\n  thus ?case by simp\nqed\n\n\n\n\n\n\n\nsubsection \\<open>Relevant variables\\<close>\n\ninductive_set relevant_vars :: \"'node set \\<Rightarrow> 'node \\<Rightarrow> 'var set\" (\"rv _\")\nfor S :: \"'node set\" and n :: \"'node\"\n\nwhere rvI:\n  \"\\<lbrakk>n -as\\<rightarrow>* n'; n' \\<in> backward_slice S; V \\<in> Use n';\n    \\<forall>nx \\<in> set(sourcenodes as). V \\<notin> Def nx\\<rbrakk>\n  \\<Longrightarrow> V \\<in> rv S n\"\n\n\nlemma rvE:\n  assumes rv:\"V \\<in> rv S n\"\n  obtains as n' where \"n -as\\<rightarrow>* n'\" and \"n' \\<in> backward_slice S\" and \"V \\<in> Use n'\"\n  and \"\\<forall>nx \\<in> set(sourcenodes as). V \\<notin> Def nx\"\nusing rv\nby(atomize_elim,auto elim!:relevant_vars.cases)\n\n\n\nlemma eq_obs_in_rv:\n  assumes obs_eq:\"obs n (backward_slice S) = obs n' (backward_slice S)\" \n  and \"x \\<in> rv S n\" shows \"x \\<in> rv S n'\"\nproof -\n  from \\<open>x \\<in> rv S n\\<close> obtain as m \n    where \"n -as\\<rightarrow>* m\" and \"m \\<in> backward_slice S\" and \"x \\<in> Use m\"\n    and \"\\<forall>nx\\<in>set (sourcenodes as). x \\<notin> Def nx\"\n    by(erule rvE)\n  from \\<open>n -as\\<rightarrow>* m\\<close> have \"valid_node m\" by(fastforce dest:path_valid_node)\n  from \\<open>n -as\\<rightarrow>* m\\<close> \\<open>m \\<in> backward_slice S\\<close> \n  have \"\\<exists>nx as' as''. nx \\<in> obs n (backward_slice S) \\<and> n -as'\\<rightarrow>* nx \\<and> \n                                     nx -as''\\<rightarrow>* m \\<and> as = as'@as''\"\n  proof(cases \"\\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> backward_slice S\")\n    case True\n    with \\<open>n -as\\<rightarrow>* m\\<close> \\<open>m \\<in> backward_slice S\\<close> have \"m \\<in> obs n (backward_slice S)\"\n      by -(rule obs_elem)\n    with \\<open>n -as\\<rightarrow>* m\\<close> \\<open>valid_node m\\<close> show ?thesis by(blast intro:empty_path)\n  next\n    case False\n    hence \"\\<exists>nx \\<in> set(sourcenodes as). nx \\<in> backward_slice S\" by simp\n    then obtain nx' ns ns' where \"sourcenodes as = ns@nx'#ns'\"\n      and \"nx' \\<in> backward_slice S\" \n      and \"\\<forall>x \\<in> set ns. x \\<notin> backward_slice S\"\n      by(fastforce elim!:split_list_first_propE)\n    from \\<open>sourcenodes as = ns@nx'#ns'\\<close>\n    obtain as' a' as'' where \"ns = sourcenodes as'\"\n      and \"as = as'@a'#as''\" and \"sourcenode a' = nx'\"\n      by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n    from \\<open>n -as\\<rightarrow>* m\\<close> \\<open>as = as'@a'#as''\\<close> \\<open>sourcenode a' = nx'\\<close>\n    have \"n -as'\\<rightarrow>* nx'\" and \"valid_edge a'\" and \"targetnode a' -as''\\<rightarrow>* m\"\n      by(fastforce dest:path_split)+\n    with \\<open>sourcenode a' = nx'\\<close> have \"nx' -a'#as''\\<rightarrow>* m\" by(fastforce intro:Cons_path)\n    from \\<open>n -as'\\<rightarrow>* nx'\\<close> \\<open>nx' \\<in> backward_slice S\\<close>\n      \\<open>\\<forall>x \\<in> set ns. x \\<notin> backward_slice S\\<close> \\<open>ns = sourcenodes as'\\<close> \n    have \"nx' \\<in> obs n (backward_slice S)\" \n      by(fastforce intro:obs_elem)\n    with \\<open>n -as'\\<rightarrow>* nx'\\<close> \\<open>nx' -a'#as''\\<rightarrow>* m\\<close> \\<open>as = as'@a'#as''\\<close> show ?thesis by blast\n  qed\n  then obtain nx as' as'' where \"nx \\<in> obs n (backward_slice S)\"\n    and \"n -as'\\<rightarrow>* nx\" and \"nx -as''\\<rightarrow>* m\" and \"as = as'@as''\"\n    by blast\n  from \\<open>nx \\<in> obs n (backward_slice S)\\<close> obs_eq \n  have \"nx \\<in> obs n' (backward_slice S)\" by auto\n  then obtain asx where \"n' -asx\\<rightarrow>* nx\" \n    and \"\\<forall>ni \\<in> set(sourcenodes asx). ni \\<notin> backward_slice S\" \n    and \"nx \\<in> backward_slice S\"\n    by(erule obsE)\n  from \\<open>as = as'@as''\\<close> \\<open>\\<forall>nx\\<in>set (sourcenodes as). x \\<notin> Def nx\\<close> \n  have \"\\<forall>ni\\<in>set (sourcenodes as''). x \\<notin> Def ni\"\n    by(auto simp:sourcenodes_def)\n  from \\<open>\\<forall>ni \\<in> set(sourcenodes asx). ni \\<notin> backward_slice S\\<close> \\<open>n' -asx\\<rightarrow>* nx\\<close>\n  have \"\\<forall>ni \\<in> set(sourcenodes asx). x \\<notin> Def ni\"\n  proof(induct asx arbitrary:n')\n    case Nil thus ?case by(simp add:sourcenodes_def)\n  next\n    case (Cons ax' asx')\n    note IH = \\<open>\\<And>n'. \\<lbrakk>\\<forall>ni\\<in>set (sourcenodes asx'). ni \\<notin> backward_slice S; \n      n' -asx'\\<rightarrow>* nx\\<rbrakk> \n        \\<Longrightarrow> \\<forall>ni\\<in>set (sourcenodes asx'). x \\<notin> Def ni\\<close>\n    from \\<open>n' -ax'#asx'\\<rightarrow>* nx\\<close> have \"n' -[]@ax'#asx'\\<rightarrow>* nx\" by simp\n    hence \"targetnode ax' -asx'\\<rightarrow>* nx\" and \"n' = sourcenode ax'\"\n      by(fastforce dest:path_split)+\n    from \\<open>\\<forall>ni\\<in>set (sourcenodes (ax'#asx')). ni \\<notin> backward_slice S\\<close>\n    have all:\"\\<forall>ni\\<in>set (sourcenodes asx'). ni \\<notin> backward_slice S\" \n      and \"sourcenode ax' \\<notin> backward_slice S\"\n      by(auto simp:sourcenodes_def)\n    from IH[OF all \\<open>targetnode ax' -asx'\\<rightarrow>* nx\\<close>]\n    have \"\\<forall>ni\\<in>set (sourcenodes asx'). x \\<notin> Def ni\" .\n    with \\<open>\\<forall>ni\\<in>set (sourcenodes as''). x \\<notin> Def ni\\<close>\n    have \"\\<forall>ni\\<in>set (sourcenodes (asx'@as'')). x \\<notin> Def ni\"\n      by(auto simp:sourcenodes_def)\n    from \\<open>n' -ax'#asx'\\<rightarrow>* nx\\<close> \\<open>nx -as''\\<rightarrow>* m\\<close> have \"n' -(ax'#asx')@as''\\<rightarrow>* m\" \n      by-(rule path_Append)\n    hence \"n' -ax'#asx'@as''\\<rightarrow>* m\" by simp\n    have \"x \\<notin> Def (sourcenode ax')\"\n    proof\n      assume \"x \\<in> Def (sourcenode ax')\"\n      with \\<open>x \\<in> Use m\\<close> \\<open>\\<forall>ni\\<in>set (sourcenodes (asx'@as'')). x \\<notin> Def ni\\<close>\n        \\<open>n' -ax'#asx'@as''\\<rightarrow>* m\\<close> \\<open>n' = sourcenode ax'\\<close> \n      have \"n' influences x in m\"\n        by(auto simp:data_dependence_def)\n      with \\<open>m \\<in> backward_slice S\\<close> dd_closed have \"n' \\<in> backward_slice S\" \n        by(auto simp:dd_closed)\n      with \\<open>n' = sourcenode ax'\\<close> \\<open>sourcenode ax' \\<notin> backward_slice S\\<close>\n      show False by simp\n    qed\n    with \\<open>\\<forall>ni\\<in>set (sourcenodes (asx'@as'')). x \\<notin> Def ni\\<close>\n    show ?case by(simp add:sourcenodes_def)\n  qed\n  with \\<open>\\<forall>ni\\<in>set (sourcenodes as''). x \\<notin> Def ni\\<close> \n  have \"\\<forall>ni\\<in>set (sourcenodes (asx@as'')). x \\<notin> Def ni\"\n    by(auto simp:sourcenodes_def)\n  from \\<open>n' -asx\\<rightarrow>* nx\\<close> \\<open>nx -as''\\<rightarrow>* m\\<close> have \"n' -asx@as''\\<rightarrow>* m\" by(rule path_Append)\n  with \\<open>m \\<in> backward_slice S\\<close> \\<open>x \\<in> Use m\\<close> \n    \\<open>\\<forall>ni\\<in>set (sourcenodes (asx@as'')). x \\<notin> Def ni\\<close> show \"x \\<in> rv S n'\" by -(rule rvI)\nqed\n\n\nlemma closed_eq_obs_eq_rvs:\n  fixes S :: \"'node set\"\n  assumes \"valid_node n\" and \"valid_node n'\"\n  and obs_eq:\"obs n (backward_slice S) = obs n' (backward_slice S)\"\n  shows \"rv S n = rv S n'\"\nproof\n  show \"rv S n \\<subseteq> rv S n'\"\n  proof\n    fix x assume \"x \\<in> rv S n\"\n    with \\<open>valid_node n\\<close> obs_eq show \"x \\<in> rv S n'\" by -(rule eq_obs_in_rv)\n  qed\nnext\n  show \"rv S n' \\<subseteq> rv S n\"\n  proof\n    fix x assume \"x \\<in> rv S n'\"\n    with \\<open>valid_node n'\\<close> obs_eq[THEN sym] show \"x \\<in> rv S n\" by -(rule eq_obs_in_rv)\n  qed\nqed\n\n\nlemma rv_edge_slice_kinds:\n  assumes \"valid_edge a\" and \"sourcenode a = n\" and \"targetnode a = n''\"\n  and \"\\<forall>V\\<in>rv S n. state_val s V = state_val s' V\"\n  and \"preds (slice_kinds S (a#as)) s\" and \"preds (slice_kinds S (a#asx)) s'\"\n  shows \"\\<forall>V\\<in>rv S n''. state_val (transfer (slice_kind S a) s) V =\n                       state_val (transfer (slice_kind S a) s') V\"\nproof\n  fix V assume \"V \\<in> rv S n''\"\n  show \"state_val (transfer (slice_kind S a) s) V =\n    state_val (transfer (slice_kind S a) s') V\"\n  proof(cases \"V \\<in> Def n\")\n    case True\n    show ?thesis\n    proof(cases \"sourcenode a \\<in> backward_slice S\")\n      case True\n      hence \"slice_kind S a = kind a\" by(rule slice_kind_in_slice)\n      with \\<open>preds (slice_kinds S (a#as)) s\\<close> have \"pred (kind a) s\"\n        by(simp add:slice_kinds_def)\n      from \\<open>slice_kind S a = kind a\\<close> \\<open>preds (slice_kinds S (a#asx)) s'\\<close>\n      have \"pred (kind a) s'\"\n        by(simp add:slice_kinds_def)\n      from \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> have \"n -[]\\<rightarrow>* n\"\n        by(fastforce intro:empty_path)\n      with True \\<open>sourcenode a = n\\<close> have \"\\<forall>V \\<in> Use n. V \\<in> rv S n\"\n        by(fastforce intro:rvI simp:sourcenodes_def)\n      with \\<open>\\<forall>V\\<in>rv S n. state_val s V = state_val s' V\\<close> \\<open>sourcenode a = n\\<close>\n      have \"\\<forall>V \\<in> Use (sourcenode a). state_val s V = state_val s' V\" by blast\n      from \\<open>valid_edge a\\<close> this \\<open>pred (kind a) s\\<close> \\<open>pred (kind a) s'\\<close>\n      have \"\\<forall>V \\<in> Def (sourcenode a). state_val (transfer (kind a) s) V =\n        state_val (transfer (kind a) s') V\"\n        by(rule CFG_edge_transfer_uses_only_Use)\n      with \\<open>V \\<in> Def n\\<close> \\<open>sourcenode a = n\\<close> \\<open>slice_kind S a = kind a\\<close>\n      show ?thesis by simp\n    next\n      case False\n      from \\<open>V \\<in> rv S n''\\<close> obtain xs nx where \"n'' -xs\\<rightarrow>* nx\"\n        and \"nx \\<in> backward_slice S\" and \"V \\<in> Use nx\"\n        and \"\\<forall>nx' \\<in> set(sourcenodes xs). V \\<notin> Def nx'\" by(erule rvE)\n      from \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> \\<open>targetnode a = n''\\<close> \n        \\<open>n'' -xs\\<rightarrow>* nx\\<close>\n      have \"n -a#xs\\<rightarrow>* nx\" by -(rule path.Cons_path)\n      with \\<open>V \\<in> Def n\\<close> \\<open>V \\<in> Use nx\\<close> \\<open>\\<forall>nx' \\<in> set(sourcenodes xs). V \\<notin> Def nx'\\<close>\n      have \"n influences V in nx\" by(fastforce simp:data_dependence_def)\n      with \\<open>nx \\<in> backward_slice S\\<close> have \"n \\<in> backward_slice S\"\n        by(rule dd_closed)\n      with \\<open>sourcenode a = n\\<close> False have False by simp\n      thus ?thesis by simp\n    qed\n  next\n    case False\n    from \\<open>V \\<in> rv S n''\\<close> obtain xs nx where \"n'' -xs\\<rightarrow>* nx\"\n      and \"nx \\<in> backward_slice S\" and \"V \\<in> Use nx\"\n      and \"\\<forall>nx' \\<in> set(sourcenodes xs). V \\<notin> Def nx'\" by(erule rvE)\n    from \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> \\<open>targetnode a = n''\\<close> \\<open>n'' -xs\\<rightarrow>* nx\\<close>\n    have \"n -a#xs\\<rightarrow>* nx\" by -(rule path.Cons_path)\n    from False \\<open>\\<forall>nx' \\<in> set(sourcenodes xs). V \\<notin> Def nx'\\<close> \\<open>sourcenode a = n\\<close>\n    have \"\\<forall>nx' \\<in> set(sourcenodes (a#xs)). V \\<notin> Def nx'\"\n      by(simp add:sourcenodes_def)\n    with \\<open>n -a#xs\\<rightarrow>* nx\\<close> \\<open>nx \\<in> backward_slice S\\<close> \\<open>V \\<in> Use nx\\<close>\n    have \"V \\<in> rv S n\" by(rule rvI)\n    show ?thesis\n    proof(cases \"kind a\")\n      case (Predicate Q)\n      show ?thesis\n      proof(cases \"sourcenode a \\<in> backward_slice S\")\n        case True\n        with Predicate have \"slice_kind S a = (Q)\\<^sub>\\<surd>\"\n          by(simp add:slice_kind_in_slice)\n        with \\<open>\\<forall>V\\<in>rv S n. state_val s V = state_val s' V\\<close> \\<open>V \\<in> rv S n\\<close>\n        show ?thesis by simp\n      next\n        case False\n        with Predicate obtain Q' where \"slice_kind S a = (Q')\\<^sub>\\<surd>\" \n          by -(erule kind_Predicate_notin_slice_slice_kind_Predicate)\n        with \\<open>\\<forall>V\\<in>rv S n. state_val s V = state_val s' V\\<close> \\<open>V \\<in> rv S n\\<close>\n        show ?thesis by simp\n      qed\n    next\n      case (Update f)\n      show ?thesis\n      proof(cases \"sourcenode a \\<in> backward_slice S\")\n        case True\n        hence \"slice_kind S a = kind a\" by(rule slice_kind_in_slice)\n        from Update have \"pred (kind a) s\" by simp\n        with \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> \\<open>V \\<notin> Def n\\<close>\n        have \"state_val (transfer (kind a) s) V = state_val s V\"\n          by(fastforce intro:CFG_edge_no_Def_equal)\n        from Update have \"pred (kind a) s'\" by simp\n        with \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> \\<open>V \\<notin> Def n\\<close>\n        have \"state_val (transfer (kind a) s') V = state_val s' V\"\n          by(fastforce intro:CFG_edge_no_Def_equal)\n        with \\<open>\\<forall>V\\<in>rv S n. state_val s V = state_val s' V\\<close> \\<open>V \\<in> rv S n\\<close>\n          \\<open>state_val (transfer (kind a) s) V = state_val s V\\<close>\n          \\<open>slice_kind S a = kind a\\<close>\n        show ?thesis by fastforce\n      next\n        case False\n        with Update have \"slice_kind S a = \\<Up>id\" by -(rule slice_kind_Upd)\n        with \\<open>\\<forall>V\\<in>rv S n. state_val s V = state_val s' V\\<close> \\<open>V \\<in> rv S n\\<close>\n        show ?thesis by fastforce\n      qed\n    qed\n  qed\nqed\n\n\n\nlemma rv_branching_edges_slice_kinds_False:\n  assumes \"valid_edge a\" and \"valid_edge ax\" \n  and \"sourcenode a = n\" and \"sourcenode ax = n\"\n  and \"targetnode a = n''\" and \"targetnode ax \\<noteq> n''\"\n  and \"preds (slice_kinds S (a#as)) s\" and \"preds (slice_kinds S (ax#asx)) s'\"\n  and \"\\<forall>V\\<in>rv S n. state_val s V = state_val s' V\"\n  shows False\nproof -\n  from \\<open>valid_edge a\\<close> \\<open>valid_edge ax\\<close> \\<open>sourcenode a = n\\<close> \\<open>sourcenode ax = n\\<close>\n    \\<open>targetnode a = n''\\<close> \\<open>targetnode ax \\<noteq> n''\\<close>\n  obtain Q Q' where \"kind a = (Q)\\<^sub>\\<surd>\" and \"kind ax = (Q')\\<^sub>\\<surd>\"\n    and \"\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s)\"\n    by(auto dest:deterministic)\n  from \\<open>valid_edge a\\<close> \\<open>valid_edge ax\\<close> \\<open>sourcenode a = n\\<close> \\<open>sourcenode ax = n\\<close>\n    \\<open>targetnode a = n''\\<close> \\<open>targetnode ax \\<noteq> n''\\<close>\n  obtain P P' where \"slice_kind S a = (P)\\<^sub>\\<surd>\" \n    and \"slice_kind S ax = (P')\\<^sub>\\<surd>\"\n    and \"\\<forall>s. (P s \\<longrightarrow> \\<not> P' s) \\<and> (P' s \\<longrightarrow> \\<not> P s)\"\n    by -(erule slice_deterministic,auto)\n  show ?thesis\n  proof(cases \"sourcenode a \\<in> backward_slice S\")\n    case True\n    hence \"slice_kind S a = kind a\" by(rule slice_kind_in_slice)\n    with \\<open>preds (slice_kinds S (a#as)) s\\<close> \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close> \n      \\<open>slice_kind S a = (P)\\<^sub>\\<surd>\\<close> have \"pred (kind a) s\"\n      by(simp add:slice_kinds_def)\n    from True \\<open>sourcenode a = n\\<close> \\<open>sourcenode ax = n\\<close>\n    have \"slice_kind S ax = kind ax\" by(fastforce simp:slice_kind_in_slice)\n    with \\<open>preds (slice_kinds S (ax#asx)) s'\\<close> \\<open>kind ax = (Q')\\<^sub>\\<surd>\\<close>\n      \\<open>slice_kind S ax = (P')\\<^sub>\\<surd>\\<close> have \"pred (kind ax) s'\" \n      by(simp add:slice_kinds_def)\n    with \\<open>kind ax = (Q')\\<^sub>\\<surd>\\<close> have \"Q' s'\" by simp\n    from \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> have \"n -[]\\<rightarrow>* n\"\n      by(fastforce intro:empty_path)\n    with True \\<open>sourcenode a = n\\<close> have \"\\<forall>V \\<in> Use n. V \\<in> rv S n\"\n      by(fastforce intro:rvI simp:sourcenodes_def)\n    with \\<open>\\<forall>V\\<in>rv S n. state_val s V = state_val s' V\\<close> \\<open>sourcenode a = n\\<close>\n    have \"\\<forall>V \\<in> Use (sourcenode a). state_val s V = state_val s' V\" by blast\n    with \\<open>valid_edge a\\<close> \\<open>pred (kind a) s\\<close> have \"pred (kind a) s'\"\n      by(rule CFG_edge_Uses_pred_equal)\n    with \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close> have \"Q s'\" by simp\n    with \\<open>Q' s'\\<close> \\<open>\\<forall>s. (Q s \\<longrightarrow> \\<not> Q' s) \\<and> (Q' s \\<longrightarrow> \\<not> Q s)\\<close> have False by simp\n    thus ?thesis by simp\n  next\n    case False\n    with \\<open>kind a = (Q)\\<^sub>\\<surd>\\<close> \\<open>slice_kind S a = (P)\\<^sub>\\<surd>\\<close>\n    have \"P = (\\<lambda>s. False) \\<or> P = (\\<lambda>s. True)\"\n      by(fastforce elim:kind_Predicate_notin_slice_slice_kind_Predicate)\n    with \\<open>slice_kind S a = (P)\\<^sub>\\<surd>\\<close> \\<open>preds (slice_kinds S (a#as)) s\\<close>\n    have \"P = (\\<lambda>s. True)\" by(fastforce simp:slice_kinds_def)\n    from \\<open>kind ax = (Q')\\<^sub>\\<surd>\\<close> \\<open>slice_kind S ax = (P')\\<^sub>\\<surd>\\<close> \n      \\<open>sourcenode a = n\\<close> \\<open>sourcenode ax = n\\<close> False\n    have \"P' = (\\<lambda>s. False) \\<or> P' = (\\<lambda>s. True)\"\n      by(fastforce elim:kind_Predicate_notin_slice_slice_kind_Predicate)\n    with \\<open>slice_kind S ax = (P')\\<^sub>\\<surd>\\<close> \\<open>preds (slice_kinds S (ax#asx)) s'\\<close>\n    have \"P' = (\\<lambda>s. True)\" by(fastforce simp:slice_kinds_def)\n    with \\<open>P = (\\<lambda>s. True)\\<close> \\<open>\\<forall>s. (P s \\<longrightarrow> \\<not> P' s) \\<and> (P' s \\<longrightarrow> \\<not> P s)\\<close>\n    have False by blast\n    thus ?thesis by simp\n  qed\nqed\n\n\n\nsubsection \\<open>The set \\<open>WS\\<close>\\<close>\n\ninductive_set WS :: \"'node set \\<Rightarrow> (('node \\<times> 'state) \\<times> ('node \\<times> 'state)) set\"\nfor S :: \"'node set\"\nwhere WSI:\"\\<lbrakk>obs n (backward_slice S) = obs n' (backward_slice S); \n            \\<forall>V \\<in> rv S n. state_val s V = state_val s' V;\n            valid_node n; valid_node n'\\<rbrakk>\n  \\<Longrightarrow> ((n,s),(n',s')) \\<in> WS S\"\n\n\nlemma WSD:\n  \"((n,s),(n',s')) \\<in> WS S \n  \\<Longrightarrow> obs n (backward_slice S) = obs n' (backward_slice S) \\<and> \n      (\\<forall>V \\<in> rv S n. state_val s V = state_val s' V) \\<and>\n      valid_node n \\<and> valid_node n'\"\nby(auto elim:WS.cases)\n\n\nlemma WS_silent_move:\n  assumes \"((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\" and \"S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) -a\\<rightarrow>\\<^sub>\\<tau> (n\\<^sub>1',s\\<^sub>1')\"\n  and \"obs n\\<^sub>1' (backward_slice S) \\<noteq> {}\" shows \"((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\"\nproof -\n  from \\<open>((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\\<close> have \"valid_node n\\<^sub>1\" and \"valid_node n\\<^sub>2\"\n    by(auto dest:WSD)\n  from \\<open>S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) -a\\<rightarrow>\\<^sub>\\<tau> (n\\<^sub>1',s\\<^sub>1')\\<close> have \"sourcenode a = n\\<^sub>1\"\n    and \"targetnode a = n\\<^sub>1'\" and \"transfer (kind a) s\\<^sub>1 = s\\<^sub>1'\"\n    and \"n\\<^sub>1 \\<notin> backward_slice S\" and \"valid_edge a\" and \"pred (kind a) s\\<^sub>1\"\n    by(auto elim:silent_move.cases)\n  from \\<open>targetnode a = n\\<^sub>1'\\<close> \\<open>valid_edge a\\<close> have \"valid_node n\\<^sub>1'\"\n    by(auto simp:valid_node_def)\n  have \"(\\<exists>m. obs n\\<^sub>1' (backward_slice S) = {m}) \\<or> obs n\\<^sub>1' (backward_slice S) = {}\"\n    by(rule obs_singleton_disj)\n  with \\<open>obs n\\<^sub>1' (backward_slice S) \\<noteq> {}\\<close> obtain n \n    where \"obs n\\<^sub>1' (backward_slice S) = {n}\" by fastforce\n  hence \"n \\<in> obs n\\<^sub>1' (backward_slice S)\" by auto\n  then obtain as where \"n\\<^sub>1' -as\\<rightarrow>* n\" \n    and \"\\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> (backward_slice S)\" \n    and \"n \\<in> (backward_slice S)\" by(erule obsE)\n  from \\<open>n\\<^sub>1' -as\\<rightarrow>* n\\<close> \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<^sub>1\\<close> \\<open>targetnode a = n\\<^sub>1'\\<close>\n  have \"n\\<^sub>1 -a#as\\<rightarrow>* n\" by(rule Cons_path)\n  moreover\n  from \\<open>\\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> (backward_slice S)\\<close> \\<open>sourcenode a = n\\<^sub>1\\<close>\n    \\<open>n\\<^sub>1 \\<notin> backward_slice S\\<close> \n  have \"\\<forall>nx \\<in> set(sourcenodes (a#as)). nx \\<notin> (backward_slice S)\"\n    by(simp add:sourcenodes_def)\n  ultimately have \"n \\<in> obs n\\<^sub>1 (backward_slice S)\" using \\<open>n \\<in> (backward_slice S)\\<close> \n    by(rule obs_elem)\n  hence \"obs n\\<^sub>1 (backward_slice S) = {n}\" by(rule obs_singleton_element)\n  with \\<open>obs n\\<^sub>1' (backward_slice S) = {n}\\<close> \n  have \"obs n\\<^sub>1 (backward_slice S) = obs n\\<^sub>1' (backward_slice S)\"\n    by simp\n  with \\<open>valid_node n\\<^sub>1\\<close> \\<open>valid_node n\\<^sub>1'\\<close> have \"rv S n\\<^sub>1 = rv S n\\<^sub>1'\"\n    by(rule closed_eq_obs_eq_rvs)\n  from \\<open>n \\<in> obs n\\<^sub>1 (backward_slice S)\\<close> \\<open>((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\\<close> \n  have \"obs n\\<^sub>1 (backward_slice S) = obs n\\<^sub>2 (backward_slice S)\"\n    and \"\\<forall>V \\<in> rv S n\\<^sub>1. state_val s\\<^sub>1 V = state_val s\\<^sub>2 V\"\n    by(fastforce dest:WSD)+\n  from \\<open>obs n\\<^sub>1 (backward_slice S) = obs n\\<^sub>2 (backward_slice S)\\<close>\n    \\<open>obs n\\<^sub>1 (backward_slice S) = {n}\\<close> \\<open>obs n\\<^sub>1' (backward_slice S) = {n}\\<close> \n  have \"obs n\\<^sub>1' (backward_slice S) = obs n\\<^sub>2 (backward_slice S)\" by simp\n  have \"\\<forall>V \\<in> rv S n\\<^sub>1'. state_val s\\<^sub>1' V = state_val s\\<^sub>2 V\"\n  proof\n    fix V assume \"V \\<in> rv S n\\<^sub>1'\"\n    with \\<open>rv S n\\<^sub>1 = rv S n\\<^sub>1'\\<close> have \"V \\<in> rv S n\\<^sub>1\" by simp\n    then obtain as n' where \"n\\<^sub>1 -as\\<rightarrow>* n'\" and \"n' \\<in> (backward_slice S)\"\n      and \"V \\<in> Use n'\" and \"\\<forall>nx \\<in> set(sourcenodes as). V \\<notin> Def nx\"\n      by(erule rvE)\n    with \\<open>n\\<^sub>1 \\<notin> backward_slice S\\<close> have \"V \\<notin> Def n\\<^sub>1\"\n      by(auto elim:path.cases simp:sourcenodes_def)\n    with \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<^sub>1\\<close> \\<open>pred (kind a) s\\<^sub>1\\<close>\n    have \"state_val (transfer (kind a) s\\<^sub>1) V = state_val s\\<^sub>1 V\"\n      by(fastforce intro:CFG_edge_no_Def_equal)\n    with \\<open>transfer (kind a) s\\<^sub>1 = s\\<^sub>1'\\<close> have \"state_val s\\<^sub>1' V = state_val s\\<^sub>1 V\" by simp\n    from \\<open>V \\<in> rv S n\\<^sub>1\\<close> \\<open>\\<forall>V \\<in> rv S n\\<^sub>1. state_val s\\<^sub>1 V = state_val s\\<^sub>2 V\\<close>\n    have \"state_val s\\<^sub>1 V = state_val s\\<^sub>2 V\" by simp\n    with \\<open>state_val s\\<^sub>1' V = state_val s\\<^sub>1 V\\<close> \n    show \"state_val s\\<^sub>1' V = state_val s\\<^sub>2 V\" by simp\n  qed\n  with \\<open>obs n\\<^sub>1' (backward_slice S) = obs n\\<^sub>2 (backward_slice S)\\<close>\n    \\<open>valid_node n\\<^sub>1'\\<close> \\<open>valid_node n\\<^sub>2\\<close> show ?thesis by(fastforce intro:WSI)\nqed\n\n\nlemma WS_silent_moves:\n  \"\\<lbrakk>S,f \\<turnstile> (n\\<^sub>1,s\\<^sub>1) =as\\<Rightarrow>\\<^sub>\\<tau> (n\\<^sub>1',s\\<^sub>1'); ((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S; f = kind;\n    obs n\\<^sub>1' (backward_slice S) \\<noteq> {}\\<rbrakk>\n  \\<Longrightarrow> ((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\"\nproof(induct rule:silent_moves.induct)\n  case silent_moves_Nil thus ?case by simp\nnext\n  case (silent_moves_Cons S f n s a n' s' as n'' s'')\n  note IH = \\<open>\\<lbrakk>((n',s'),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S; f = kind; obs n'' (backward_slice S) \\<noteq> {}\\<rbrakk>\n             \\<Longrightarrow> ((n'',s''),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\\<close>\n  from \\<open>S,f \\<turnstile> (n',s') =as\\<Rightarrow>\\<^sub>\\<tau> (n'',s'')\\<close> \\<open>obs n'' (backward_slice S) \\<noteq> {}\\<close>\n  have \"obs n' (backward_slice S) \\<noteq> {}\" by(fastforce dest:silent_moves_obs_slice)\n  with \\<open>((n,s),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\\<close> \\<open>S,f \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (n',s')\\<close> \\<open>f = kind\\<close>\n  have \"((n',s'),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\" by -(rule WS_silent_move,simp+)\n  from IH[OF this \\<open>f = kind\\<close> \\<open>obs n'' (backward_slice S) \\<noteq> {}\\<close>]\n  show ?case .\nqed\n\n\n\nlemma WS_observable_move:\n  assumes \"((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\" and \"S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) -a\\<rightarrow> (n\\<^sub>1',s\\<^sub>1')\"\n  obtains as where \"((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>1',transfer (slice_kind S a) s\\<^sub>2)) \\<in> WS S\"\n  and \"S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as@[a]\\<Rightarrow> (n\\<^sub>1',transfer (slice_kind S a) s\\<^sub>2)\"\nproof(atomize_elim)\n  from \\<open>((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\\<close> have \"valid_node n\\<^sub>1\" by(auto dest:WSD)\n  from \\<open>S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) -a\\<rightarrow> (n\\<^sub>1',s\\<^sub>1')\\<close> have [simp]:\"n\\<^sub>1 = sourcenode a\" \n    and [simp]:\"n\\<^sub>1' = targetnode a\" and \"pred (kind a) s\\<^sub>1\"\n    and \"transfer (kind a) s\\<^sub>1 = s\\<^sub>1'\" and \"n\\<^sub>1 \\<in> (backward_slice S)\" \n    and \"valid_edge a\" and \"pred (kind a) s\\<^sub>1\"\n    by(auto elim:observable_move.cases)\n  from  \\<open>valid_edge a\\<close> have \"valid_node n\\<^sub>1'\" by(auto simp:valid_node_def)\n  from \\<open>valid_node n\\<^sub>1\\<close> \\<open>n\\<^sub>1 \\<in> (backward_slice S)\\<close> \n  have \"obs n\\<^sub>1 (backward_slice S) = {n\\<^sub>1}\" by(rule n_in_obs)\n  with \\<open>((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\\<close> have \"obs n\\<^sub>2 (backward_slice S) = {n\\<^sub>1}\" \n    and \"\\<forall>V \\<in> rv S n\\<^sub>1. state_val s\\<^sub>1 V = state_val s\\<^sub>2 V\" by(auto dest:WSD)\n  from \\<open>valid_node n\\<^sub>1\\<close> have \"n\\<^sub>1 -[]\\<rightarrow>* n\\<^sub>1\" by(rule empty_path)\n  with \\<open>n\\<^sub>1 \\<in> (backward_slice S)\\<close> have \"\\<forall>V \\<in> Use n\\<^sub>1. V \\<in> rv S n\\<^sub>1\"\n    by(fastforce intro:rvI simp:sourcenodes_def)\n  with \\<open>\\<forall>V \\<in> rv S n\\<^sub>1. state_val s\\<^sub>1 V = state_val s\\<^sub>2 V\\<close>\n  have \"\\<forall>V \\<in> Use n\\<^sub>1. state_val s\\<^sub>1 V = state_val s\\<^sub>2 V\" by blast\n  with \\<open>valid_edge a\\<close>  \\<open>pred (kind a) s\\<^sub>1\\<close> have \"pred (kind a) s\\<^sub>2\"\n    by(fastforce intro:CFG_edge_Uses_pred_equal)\n  with \\<open>n\\<^sub>1 \\<in> (backward_slice S)\\<close> have \"pred (slice_kind S a) s\\<^sub>2\"\n    by(simp add:slice_kind_in_slice)\n  from \\<open>n\\<^sub>1 \\<in> (backward_slice S)\\<close> obtain s\\<^sub>2' \n    where \"transfer (slice_kind S a) s\\<^sub>2 = s\\<^sub>2'\"\n    by(simp add:slice_kind_in_slice)\n  with \\<open>pred (slice_kind S a) s\\<^sub>2\\<close> \\<open>n\\<^sub>1 \\<in> (backward_slice S)\\<close> \\<open>valid_edge a\\<close> \n  have \"S,slice_kind S \\<turnstile> (n\\<^sub>1,s\\<^sub>2) -a\\<rightarrow> (n\\<^sub>1',s\\<^sub>2')\"\n    by(fastforce intro:observable_moveI)\n  from \\<open>obs n\\<^sub>2 (backward_slice S) = {n\\<^sub>1}\\<close>\n  obtain as where \"S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as\\<Rightarrow>\\<^sub>\\<tau> (n\\<^sub>1,s\\<^sub>2)\"\n    by(erule obs_silent_moves)\n  with \\<open>S,slice_kind S \\<turnstile> (n\\<^sub>1,s\\<^sub>2) -a\\<rightarrow> (n\\<^sub>1',s\\<^sub>2')\\<close> \n  have \"S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as@[a]\\<Rightarrow> (n\\<^sub>1',s\\<^sub>2')\"\n    by -(rule observable_moves_snoc)\n  have \"\\<forall>V \\<in> rv S n\\<^sub>1'. state_val s\\<^sub>1' V = state_val s\\<^sub>2' V\"\n  proof\n    fix V assume rv:\"V \\<in> rv S n\\<^sub>1'\"\n    show \"state_val s\\<^sub>1' V = state_val s\\<^sub>2' V\"\n    proof(cases \"V \\<in> Def n\\<^sub>1\")\n      case True\n      thus ?thesis\n      proof(cases \"kind a\")\n        case (Update f)\n        with \\<open>transfer (kind a) s\\<^sub>1 = s\\<^sub>1'\\<close> have \"s\\<^sub>1' = f s\\<^sub>1\" by simp\n        from Update[THEN sym] \\<open>n\\<^sub>1 \\<in> (backward_slice S)\\<close> \n        have \"slice_kind S a = \\<Up>f\"\n          by(fastforce intro:slice_kind_in_slice)\n        with \\<open>transfer (slice_kind S a) s\\<^sub>2 = s\\<^sub>2'\\<close> have \"s\\<^sub>2' = f s\\<^sub>2\" by simp\n        from \\<open>valid_edge a\\<close> \\<open>\\<forall>V \\<in> Use n\\<^sub>1. state_val s\\<^sub>1 V = state_val s\\<^sub>2 V\\<close>\n          True Update \\<open>s\\<^sub>1' = f s\\<^sub>1\\<close> \\<open>s\\<^sub>2' = f s\\<^sub>2\\<close> show ?thesis\n          by(fastforce dest:CFG_edge_transfer_uses_only_Use)\n      next\n        case (Predicate Q)\n        with \\<open>transfer (kind a) s\\<^sub>1 = s\\<^sub>1'\\<close> have \"s\\<^sub>1' = s\\<^sub>1\" by simp\n        from Predicate[THEN sym] \\<open>n\\<^sub>1 \\<in> (backward_slice S)\\<close>\n        have \"slice_kind S a = (Q)\\<^sub>\\<surd>\"\n          by(fastforce intro:slice_kind_in_slice)\n        with \\<open>transfer (slice_kind S a) s\\<^sub>2 = s\\<^sub>2'\\<close> have \"s\\<^sub>2' = s\\<^sub>2\" by simp\n        with \\<open>valid_edge a\\<close> \\<open>\\<forall>V \\<in> Use n\\<^sub>1. state_val s\\<^sub>1 V = state_val s\\<^sub>2 V\\<close> \n          True Predicate \\<open>s\\<^sub>1' = s\\<^sub>1\\<close> \\<open>pred (kind a) s\\<^sub>1\\<close> \\<open>pred (kind a) s\\<^sub>2\\<close>\n        show ?thesis by(auto dest:CFG_edge_transfer_uses_only_Use)\n      qed\n    next\n      case False\n      with \\<open>valid_edge a\\<close> \\<open>transfer (kind a) s\\<^sub>1 = s\\<^sub>1'\\<close>[THEN sym] \n        \\<open>pred (kind a) s\\<^sub>1\\<close> \\<open>pred (kind a) s\\<^sub>2\\<close>\n      have \"state_val s\\<^sub>1' V = state_val s\\<^sub>1 V\"\n        by(fastforce intro:CFG_edge_no_Def_equal)\n      have \"state_val s\\<^sub>2' V = state_val s\\<^sub>2 V\"\n      proof(cases \"kind a\")\n        case (Update f)\n        with  \\<open>n\\<^sub>1 \\<in> (backward_slice S)\\<close> have \"slice_kind S a = kind a\"\n          by(fastforce intro:slice_kind_in_slice)\n        with \\<open>valid_edge a\\<close> \\<open>transfer (slice_kind S a) s\\<^sub>2 = s\\<^sub>2'\\<close>[THEN sym] \n          False \\<open>pred (kind a) s\\<^sub>2\\<close>\n        show ?thesis by(fastforce intro:CFG_edge_no_Def_equal)\n      next\n        case (Predicate Q)\n        with \\<open>transfer (slice_kind S a) s\\<^sub>2 = s\\<^sub>2'\\<close> have \"s\\<^sub>2 = s\\<^sub>2'\"\n          by(cases \"slice_kind S a\",\n            auto split:if_split_asm simp:slice_kind_def Let_def)\n        thus ?thesis by simp\n      qed\n      from rv obtain as' nx where \"n\\<^sub>1' -as'\\<rightarrow>* nx\" \n        and \"nx \\<in> (backward_slice S)\"\n        and \"V \\<in> Use nx\" and \"\\<forall>nx \\<in> set(sourcenodes as'). V \\<notin> Def nx\"\n        by(erule rvE)\n      from \\<open>\\<forall>nx \\<in> set(sourcenodes as'). V \\<notin> Def nx\\<close> False\n      have \"\\<forall>nx \\<in> set(sourcenodes (a#as')). V \\<notin> Def nx\"\n        by(auto simp:sourcenodes_def)\n      from  \\<open>valid_edge a\\<close> \\<open>n\\<^sub>1' -as'\\<rightarrow>* nx\\<close> have \"n\\<^sub>1 -a#as'\\<rightarrow>* nx\"\n        by(fastforce intro:Cons_path)\n      with \\<open>nx \\<in> (backward_slice S)\\<close> \\<open>V \\<in> Use nx\\<close> \n        \\<open>\\<forall>nx \\<in> set(sourcenodes (a#as')). V \\<notin> Def nx\\<close>\n      have \"V \\<in> rv S n\\<^sub>1\" by -(rule rvI)\n      with \\<open>\\<forall>V \\<in> rv S n\\<^sub>1. state_val s\\<^sub>1 V = state_val s\\<^sub>2 V\\<close> \n        \\<open>state_val s\\<^sub>1' V = state_val s\\<^sub>1 V\\<close> \\<open>state_val s\\<^sub>2' V = state_val s\\<^sub>2 V\\<close>\n      show ?thesis by fastforce\n    qed\n  qed\n  with \\<open>valid_node n\\<^sub>1'\\<close> have \"((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>1',s\\<^sub>2')) \\<in> WS S\" by(fastforce intro:WSI)\n  with \\<open>S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as@[a]\\<Rightarrow> (n\\<^sub>1',s\\<^sub>2')\\<close>\n    \\<open>transfer (slice_kind S a) s\\<^sub>2 = s\\<^sub>2'\\<close> \n  show \"\\<exists>as. ((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>1',transfer (slice_kind S a) s\\<^sub>2)) \\<in> WS S \\<and>\n    S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as@[a]\\<Rightarrow> (n\\<^sub>1',transfer (slice_kind S a) s\\<^sub>2)\"\n    by blast\nqed\n\n\n\ndefinition is_weak_sim :: \n  \"(('node \\<times> 'state) \\<times> ('node \\<times> 'state)) set \\<Rightarrow> 'node set \\<Rightarrow> bool\"\n  where \"is_weak_sim R S \\<equiv> \n  \\<forall>n\\<^sub>1 s\\<^sub>1 n\\<^sub>2 s\\<^sub>2 n\\<^sub>1' s\\<^sub>1' as. ((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> R \\<and> S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) =as\\<Rightarrow> (n\\<^sub>1',s\\<^sub>1')\n  \\<longrightarrow> (\\<exists>n\\<^sub>2' s\\<^sub>2' as'. ((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>2',s\\<^sub>2')) \\<in> R \\<and> \n                      S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as'\\<Rightarrow> (n\\<^sub>2',s\\<^sub>2'))\"\n\n\nlemma WS_weak_sim:\n  assumes \"((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\" \n  and \"S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) =as\\<Rightarrow> (n\\<^sub>1',s\\<^sub>1')\"\n  shows \"((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>1',transfer (slice_kind S (last as)) s\\<^sub>2)) \\<in> WS S \\<and>\n  (\\<exists>as'. S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as'@[last as]\\<Rightarrow> \n                             (n\\<^sub>1',transfer (slice_kind S (last as)) s\\<^sub>2))\"\nproof -\n  from \\<open>S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) =as\\<Rightarrow> (n\\<^sub>1',s\\<^sub>1')\\<close> obtain a' as' n' s'\n    where \"S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) =as'\\<Rightarrow>\\<^sub>\\<tau> (n',s')\" \n    and \"S,kind \\<turnstile> (n',s') -a'\\<rightarrow> (n\\<^sub>1',s\\<^sub>1')\" and \"as = as'@[a']\"\n    by(fastforce elim:observable_moves.cases)\n  from \\<open>S,kind \\<turnstile> (n',s') -a'\\<rightarrow> (n\\<^sub>1',s\\<^sub>1')\\<close> have \"obs n' (backward_slice S) = {n'}\"\n    by(fastforce elim:observable_move.cases intro!:n_in_obs)\n  hence \"obs n' (backward_slice S) \\<noteq> {}\" by fast\n  with \\<open>S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) =as'\\<Rightarrow>\\<^sub>\\<tau> (n',s')\\<close> \\<open>((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\\<close> \n  have \"((n',s'),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\"\n    by -(rule WS_silent_moves,simp+)\n  with \\<open>S,kind \\<turnstile> (n',s') -a'\\<rightarrow> (n\\<^sub>1',s\\<^sub>1')\\<close> obtain asx \n    where \"((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>1',transfer (slice_kind S a') s\\<^sub>2)) \\<in> WS S\"\n    and \"S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =asx@[a']\\<Rightarrow> \n    (n\\<^sub>1',transfer (slice_kind S a') s\\<^sub>2)\"\n    by(fastforce elim:WS_observable_move)\n  with \\<open>as = as'@[a']\\<close> show\n    \"((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>1',transfer (slice_kind S (last as)) s\\<^sub>2)) \\<in> WS S \\<and>\n    (\\<exists>as'. S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as'@[last as]\\<Rightarrow> \n           (n\\<^sub>1',transfer (slice_kind S (last as)) s\\<^sub>2))\" by simp blast\nqed\n\ntext \\<open>The following lemma states the correctness of static intraprocedural slicing:\\\\\n  the simulation \\<open>WS S\\<close> is a desired weak simulation\\<close>\n\ntheorem WS_is_weak_sim:\"is_weak_sim (WS S) S\"\nby(fastforce dest:WS_weak_sim simp:is_weak_sim_def)\n\n\nsubsection \\<open>@{term \"n -as\\<rightarrow>* n'\"} and transitive closure of \n  @{term \"S,f \\<turnstile> (n,s) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s')\"}\\<close>\n\ninductive trans_observable_moves :: \n  \"'node set \\<Rightarrow> ('edge \\<Rightarrow> 'state edge_kind) \\<Rightarrow> 'node \\<Rightarrow> 'state \\<Rightarrow> 'edge list \\<Rightarrow> \n  'node \\<Rightarrow> 'state \\<Rightarrow> bool\" (\"_,_ \\<turnstile> '(_,_') =_\\<Rightarrow>* '(_,_')\" [51,50,0,0,50,0,0] 51) \n\nwhere tom_Nil:\n  \"S,f \\<turnstile> (n,s) =[]\\<Rightarrow>* (n,s)\"\n\n| tom_Cons:\n  \"\\<lbrakk>S,f \\<turnstile> (n,s) =as\\<Rightarrow> (n',s'); S,f \\<turnstile> (n',s') =as'\\<Rightarrow>* (n'',s'')\\<rbrakk>\n  \\<Longrightarrow> S,f \\<turnstile> (n,s) =(last as)#as'\\<Rightarrow>* (n'',s'')\"\n\n\ndefinition slice_edges :: \"'node set \\<Rightarrow> 'edge list \\<Rightarrow> 'edge list\"\n  where \"slice_edges S as \\<equiv> [a \\<leftarrow> as. sourcenode a \\<in> backward_slice S]\"\n\n\nlemma silent_moves_no_slice_edges:\n  \"S,f \\<turnstile> (n,s) =as\\<Rightarrow>\\<^sub>\\<tau> (n',s') \\<Longrightarrow> slice_edges S as = []\"\nby(induct rule:silent_moves.induct,auto elim:silent_move.cases simp:slice_edges_def)\n\n\nlemma observable_moves_last_slice_edges:\n  \"S,f \\<turnstile> (n,s) =as\\<Rightarrow> (n',s') \\<Longrightarrow> slice_edges S as = [last as]\"\nby(induct rule:observable_moves.induct,\n   fastforce dest:silent_moves_no_slice_edges elim:observable_move.cases \n            simp:slice_edges_def)\n\n\nlemma slice_edges_no_nodes_in_slice:\n  \"slice_edges S as = [] \n  \\<Longrightarrow> \\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> (backward_slice S)\"\nproof(induct as)\n  case Nil thus ?case by(simp add:slice_edges_def sourcenodes_def)\nnext\n  case (Cons a' as')\n  note IH = \\<open>slice_edges S as' = [] \\<Longrightarrow>\n    \\<forall>nx\\<in>set (sourcenodes as'). nx \\<notin> backward_slice S\\<close>\n  from \\<open>slice_edges S (a'#as') = []\\<close> have \"slice_edges S as' = []\"\n    and \"sourcenode a' \\<notin> backward_slice S\"\n    by(auto simp:slice_edges_def split:if_split_asm)\n  from IH[OF \\<open>slice_edges S as' = []\\<close>] \\<open>sourcenode a' \\<notin> backward_slice S\\<close>\n  show ?case by(simp add:sourcenodes_def)\nqed\n\n\n\nlemma sliced_path_determ:\n  \"\\<lbrakk>n -as\\<rightarrow>* n'; n -as'\\<rightarrow>* n'; slice_edges S as = slice_edges S as';\n    preds (slice_kinds S as) s; preds (slice_kinds S as') s'; n' \\<in> S;\n    \\<forall>V \\<in> rv S n. state_val s V = state_val s' V\\<rbrakk> \\<Longrightarrow> as = as'\"\nproof(induct arbitrary:as' s s' rule:path.induct)\n  case (empty_path n)\n  from \\<open>slice_edges S [] = slice_edges S as'\\<close> \n  have \"\\<forall>nx \\<in> set(sourcenodes as'). nx \\<notin> (backward_slice S)\"\n    by(fastforce intro!:slice_edges_no_nodes_in_slice simp:slice_edges_def)\n  with \\<open>n -as'\\<rightarrow>* n\\<close> show ?case\n  proof(induct nx\\<equiv>\"n\" as' nx'\\<equiv>\"n\" rule:path.induct)\n    case (Cons_path n'' as a)\n    from \\<open>valid_node n\\<close> \\<open>n \\<in> S\\<close> have \"n \\<in> backward_slice S\" by(rule refl)\n    with \\<open>\\<forall>nx\\<in>set (sourcenodes (a # as)). nx \\<notin> backward_slice S\\<close> \n      \\<open>sourcenode a = n\\<close>\n    have False by(simp add:sourcenodes_def)\n    thus ?case by simp\n  qed simp\nnext\n  case (Cons_path n'' as n' a n)\n  note IH = \\<open>\\<And>as' s s'. \\<lbrakk>n'' -as'\\<rightarrow>* n'; slice_edges S as = slice_edges S as';\n    preds (slice_kinds S as) s; preds (slice_kinds S as') s'; n' \\<in> S;\n    \\<forall>V\\<in>rv S n''. state_val s V = state_val s' V\\<rbrakk> \\<Longrightarrow> as = as'\\<close>\n  show ?case\n  proof(cases as')\n    case Nil\n    with \\<open>n -as'\\<rightarrow>* n'\\<close> have \"n = n'\" by fastforce\n    from Nil \\<open>slice_edges S (a#as) = slice_edges S as'\\<close> \\<open>sourcenode a = n\\<close>\n    have \"n \\<notin> backward_slice S\" by(fastforce simp:slice_edges_def)\n    from \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> \\<open>n = n'\\<close> \\<open>n' \\<in> S\\<close>\n    have \"n \\<in> backward_slice S\" by(fastforce intro:refl)\n    with \\<open>n = n'\\<close> \\<open>n \\<notin> backward_slice S\\<close> have False by simp\n    thus ?thesis by simp\n  next\n    case (Cons ax asx)\n    with \\<open>n -as'\\<rightarrow>* n'\\<close> have \"n = sourcenode ax\" and \"valid_edge ax\" \n      and \"targetnode ax -asx\\<rightarrow>* n'\" by(auto elim:path_split_Cons)\n    show ?thesis\n    proof(cases \"targetnode ax = n''\")\n      case True\n      with \\<open>targetnode ax -asx\\<rightarrow>* n'\\<close> have \"n'' -asx\\<rightarrow>* n'\" by simp\n      from \\<open>valid_edge ax\\<close> \\<open>valid_edge a\\<close> \\<open>n = sourcenode ax\\<close> \\<open>sourcenode a = n\\<close>\n        True \\<open>targetnode a = n''\\<close> have \"ax = a\" by(fastforce intro:edge_det)\n      from \\<open>slice_edges S (a#as) = slice_edges S as'\\<close> Cons \n        \\<open>n = sourcenode ax\\<close> \\<open>sourcenode a = n\\<close>\n      have \"slice_edges S as = slice_edges S asx\"\n        by(cases \"n \\<in> backward_slice S\")(auto simp:slice_edges_def)\n      from \\<open>preds (slice_kinds S (a#as)) s\\<close> \n      have preds1:\"preds (slice_kinds S as) (transfer (slice_kind S a) s)\"\n        by(simp add:slice_kinds_def)\n      from \\<open>preds (slice_kinds S as') s'\\<close> Cons \\<open>ax = a\\<close>\n      have preds2:\"preds (slice_kinds S asx) (transfer (slice_kind S a) s')\"\n        by(simp add:slice_kinds_def)\n      from \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> \\<open>targetnode a = n''\\<close>\n        \\<open>preds (slice_kinds S (a#as)) s\\<close> \\<open>preds (slice_kinds S as') s'\\<close>\n        \\<open>ax = a\\<close> Cons \\<open>\\<forall>V\\<in>rv S n. state_val s V = state_val s' V\\<close>\n      have \"\\<forall>V\\<in>rv S n''. state_val (transfer (slice_kind S a) s) V =\n                          state_val (transfer (slice_kind S a) s') V\"\n        by -(rule rv_edge_slice_kinds,auto)\n      from IH[OF \\<open>n'' -asx\\<rightarrow>* n'\\<close> \\<open>slice_edges S as = slice_edges S asx\\<close>\n        preds1 preds2 \\<open>n' \\<in> S\\<close> this] Cons \\<open>ax = a\\<close> show ?thesis by simp\n    next\n      case False\n      with \\<open>valid_edge a\\<close> \\<open>valid_edge ax\\<close> \\<open>sourcenode a = n\\<close> \\<open>n = sourcenode ax\\<close>\n        \\<open>targetnode a = n''\\<close> \\<open>preds (slice_kinds S (a#as)) s\\<close>\n        \\<open>preds (slice_kinds S as') s'\\<close> Cons\n        \\<open>\\<forall>V\\<in>rv S n. state_val s V = state_val s' V\\<close>\n      have False by -(erule rv_branching_edges_slice_kinds_False,auto)\n      thus ?thesis by simp\n    qed\n  qed\nqed\n\n\n\nlemma path_trans_observable_moves:\n  assumes \"n -as\\<rightarrow>* n'\" and \"preds (kinds as) s\" and \"transfers (kinds as) s = s'\"\n  obtains n'' s'' as' as'' where \"S,kind \\<turnstile> (n,s) =slice_edges S as\\<Rightarrow>* (n'',s'')\"\n  and \"S,kind \\<turnstile> (n'',s'') =as'\\<Rightarrow>\\<^sub>\\<tau> (n',s')\" \n  and \"slice_edges S as = slice_edges S as''\" and \"n -as''@as'\\<rightarrow>* n'\"\nproof(atomize_elim)\n  from \\<open>n -as\\<rightarrow>* n'\\<close> \\<open>preds (kinds as) s\\<close> \\<open>transfers (kinds as) s = s'\\<close>\n  show \"\\<exists>n'' s'' as' as''. \n    S,kind \\<turnstile> (n,s) =slice_edges S as\\<Rightarrow>* (n'',s'') \\<and>\n    S,kind \\<turnstile> (n'',s'') =as'\\<Rightarrow>\\<^sub>\\<tau> (n',s') \\<and> slice_edges S as = slice_edges S as'' \\<and>\n    n -as''@as'\\<rightarrow>* n'\"\n  proof(induct arbitrary:s rule:path.induct)\n    case (empty_path n)\n    from \\<open>transfers (kinds []) s = s'\\<close> have \"s = s'\" by(simp add:kinds_def)\n    have \"S,kind \\<turnstile> (n,s) =[]\\<Rightarrow>* (n,s)\" by(rule tom_Nil)\n    have \"S,kind \\<turnstile> (n,s) =[]\\<Rightarrow>\\<^sub>\\<tau> (n,s)\" by(rule silent_moves_Nil)\n    with \\<open>S,kind \\<turnstile> (n,s) =[]\\<Rightarrow>* (n,s)\\<close> \\<open>s = s'\\<close> \\<open>valid_node n\\<close>\n    show ?case\n      apply(rule_tac x=\"n\" in exI)\n      apply(rule_tac x=\"s\" in exI)\n      apply(rule_tac x=\"[]\" in exI)\n      apply(rule_tac x=\"[]\" in exI)\n      by(fastforce intro:path.empty_path simp:slice_edges_def)\n  next\n    case (Cons_path n'' as n' a n)\n    note IH = \\<open>\\<And>s. \\<lbrakk>preds (kinds as) s; transfers (kinds as) s = s'\\<rbrakk>\n      \\<Longrightarrow> \\<exists>nx s'' as' as''. S,kind \\<turnstile> (n'',s) =slice_edges S as\\<Rightarrow>* (nx,s'') \\<and>\n            S,kind \\<turnstile> (nx,s'') =as'\\<Rightarrow>\\<^sub>\\<tau> (n',s') \\<and> \n            slice_edges S as = slice_edges S as'' \\<and> n'' -as''@as'\\<rightarrow>* n'\\<close>\n    from \\<open>preds (kinds (a#as)) s\\<close> \\<open>transfers (kinds (a#as)) s = s'\\<close>\n    have \"preds (kinds as) (transfer (kind a) s)\" \n      \"transfers (kinds as) (transfer (kind a) s) = s'\" by(simp_all add:kinds_def)\n    from IH[OF this] obtain nx sx asx asx'\n      where \"S,kind \\<turnstile> (n'',transfer (kind a) s) =slice_edges S as\\<Rightarrow>* (nx,sx)\"\n      and \"S,kind \\<turnstile> (nx,sx) =asx\\<Rightarrow>\\<^sub>\\<tau> (n',s')\"\n      and \"slice_edges S as = slice_edges S asx'\"\n      and \"n'' -asx'@asx\\<rightarrow>* n'\"\n      by clarsimp\n    from \\<open>preds (kinds (a#as)) s\\<close> have \"pred (kind a) s\" by(simp add:kinds_def)\n    show ?case\n    proof(cases \"n \\<in> backward_slice S\")\n      case True\n      with \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> \\<open>targetnode a = n''\\<close> \\<open>pred (kind a) s\\<close>\n      have \"S,kind \\<turnstile> (n,s) -a\\<rightarrow> (n'',transfer (kind a) s)\"\n        by(fastforce intro:observable_moveI)\n      hence \"S,kind \\<turnstile> (n,s) =[]@[a]\\<Rightarrow> (n'',transfer (kind a) s)\"\n        by(fastforce intro:observable_moves_snoc silent_moves_Nil)\n      with \\<open>S,kind \\<turnstile> (n'',transfer (kind a) s) =slice_edges S as\\<Rightarrow>* (nx,sx)\\<close>\n      have \"S,kind \\<turnstile> (n,s) =a#slice_edges S as\\<Rightarrow>* (nx,sx)\"\n        by(fastforce dest:tom_Cons)\n      with \\<open>S,kind \\<turnstile> (nx,sx) =asx\\<Rightarrow>\\<^sub>\\<tau> (n',s')\\<close>\n        \\<open>slice_edges S as = slice_edges S asx'\\<close> \\<open>n'' -asx'@asx\\<rightarrow>* n'\\<close>\n        \\<open>sourcenode a = n\\<close> \\<open>valid_edge a\\<close> \\<open>targetnode a = n''\\<close> True\n      show ?thesis\n        apply(rule_tac x=\"nx\" in exI)\n        apply(rule_tac x=\"sx\" in exI)\n        apply(rule_tac x=\"asx\" in exI)\n        apply(rule_tac x=\"a#asx'\" in exI)\n        by(auto intro:path.Cons_path simp:slice_edges_def)\n    next\n      case False\n      with \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> \\<open>targetnode a = n''\\<close> \\<open>pred (kind a) s\\<close>\n      have \"S,kind \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (n'',transfer (kind a) s)\"\n        by(fastforce intro:silent_moveI)\n      from \\<open>S,kind \\<turnstile> (n'',transfer (kind a) s) =slice_edges S as\\<Rightarrow>* (nx,sx)\\<close>\n      obtain f s'' asx'' where \"S,f \\<turnstile> (n'',s'') =asx''\\<Rightarrow>* (nx,sx)\"\n        and \"f = kind\" and \"s'' = transfer (kind a) s\" \n        and \"asx'' = slice_edges S as\" by simp\n      from \\<open>S,f \\<turnstile> (n'',s'') =asx''\\<Rightarrow>* (nx,sx)\\<close> \\<open>f = kind\\<close>\n        \\<open>asx'' = slice_edges S as\\<close> \\<open>s'' = transfer (kind a) s\\<close>\n        \\<open>S,kind \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (n'',transfer (kind a) s)\\<close> \n        \\<open>S,kind \\<turnstile> (nx,sx) =asx\\<Rightarrow>\\<^sub>\\<tau> (n',s')\\<close> \\<open>slice_edges S as = slice_edges S asx'\\<close>\n        \\<open>n'' -asx'@asx\\<rightarrow>* n'\\<close> False\n      show ?thesis\n      proof(induct rule:trans_observable_moves.induct)\n        case (tom_Nil S f ni si)\n        have \"S,kind \\<turnstile> (n,s) =[]\\<Rightarrow>* (n,s)\" by(rule trans_observable_moves.tom_Nil)\n        from \\<open>S,kind \\<turnstile> (ni,si) =asx\\<Rightarrow>\\<^sub>\\<tau> (n',s')\\<close>\n          \\<open>S,kind \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (ni,transfer (kind a) s)\\<close> \n          \\<open>si = transfer (kind a) s\\<close>\n        have \"S,kind \\<turnstile> (n,s) =a#asx\\<Rightarrow>\\<^sub>\\<tau> (n',s')\"\n          by(fastforce intro:silent_moves_Cons)\n        with \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close>\n        have \"n -a#asx\\<rightarrow>* n'\" by(fastforce dest:silent_moves_preds_transfers_path)\n        with \\<open>sourcenode a = n\\<close> \\<open>valid_edge a\\<close> \\<open>targetnode a = n''\\<close>\n          \\<open>[] = slice_edges S as\\<close> \\<open>n \\<notin> backward_slice S\\<close>\n          \\<open>S,kind \\<turnstile> (n,s) =a#asx\\<Rightarrow>\\<^sub>\\<tau> (n',s')\\<close>\n        show ?case\n          apply(rule_tac x=\"n\" in exI)\n          apply(rule_tac x=\"s\" in exI)\n          apply(rule_tac x=\"a#asx\" in exI)\n          apply(rule_tac x=\"[]\" in exI)\n          by(fastforce simp:slice_edges_def intro:trans_observable_moves.tom_Nil)\n      next\n        case (tom_Cons S f ni si asi ni' si' asi' n'' s'')\n        from \\<open>S,f \\<turnstile> (ni,si) =asi\\<Rightarrow> (ni',si')\\<close> have \"asi \\<noteq> []\"\n          by(fastforce dest:observable_move_notempty)\n        from \\<open>S,kind \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (ni,transfer (kind a) s)\\<close>\n        have \"valid_edge a\" and \"sourcenode a = n\" and \"targetnode a = ni\"\n          by(auto elim:silent_move.cases)\n        from \\<open>S,kind \\<turnstile> (n,s) -a\\<rightarrow>\\<^sub>\\<tau> (ni,transfer (kind a) s)\\<close> \\<open>f = kind\\<close>\n          \\<open>si = transfer (kind a) s\\<close> \\<open>S,f \\<turnstile> (ni,si) =asi\\<Rightarrow> (ni',si')\\<close>\n        have \"S,f \\<turnstile> (n,s) =a#asi\\<Rightarrow> (ni',si')\"\n          by(fastforce intro:silent_move_observable_moves)\n        with \\<open>S,f \\<turnstile> (ni',si') =asi'\\<Rightarrow>* (n'',s'')\\<close>\n        have \"S,f \\<turnstile> (n,s) =(last (a#asi))#asi'\\<Rightarrow>* (n'',s'')\"\n          by -(rule trans_observable_moves.tom_Cons)\n        with \\<open>f = kind\\<close> \\<open>last asi # asi' = slice_edges S as\\<close> \\<open>n \\<notin> backward_slice S\\<close>\n          \\<open>S,kind \\<turnstile> (n'',s'') =asx\\<Rightarrow>\\<^sub>\\<tau> (n',s')\\<close>  \\<open>sourcenode a = n\\<close> \\<open>asi \\<noteq> []\\<close>\n          \\<open>ni -asx'@asx\\<rightarrow>* n'\\<close> \\<open>slice_edges S as = slice_edges S asx'\\<close>\n          \\<open>valid_edge a\\<close> \\<open>sourcenode a = n\\<close> \\<open>targetnode a = ni\\<close>\n        show ?case\n          apply(rule_tac x=\"n''\" in exI)\n          apply(rule_tac x=\"s''\" in exI)\n          apply(rule_tac x=\"asx\" in exI)\n          apply(rule_tac x=\"a#asx'\" in exI)\n          by(auto intro:path.Cons_path simp:slice_edges_def)\n      qed\n    qed\n  qed\nqed\n\n\nlemma WS_weak_sim_trans:\n  assumes \"((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\"\n  and \"S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) =as\\<Rightarrow>* (n\\<^sub>1',s\\<^sub>1')\" and \"as \\<noteq> []\"\n  shows \"((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>1',transfers (slice_kinds S as) s\\<^sub>2)) \\<in> WS S \\<and> \n         S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as\\<Rightarrow>* (n\\<^sub>1',transfers (slice_kinds S as) s\\<^sub>2)\"\nproof -\n  obtain f where \"f = kind\" by simp\n  with \\<open>S,kind \\<turnstile> (n\\<^sub>1,s\\<^sub>1) =as\\<Rightarrow>* (n\\<^sub>1',s\\<^sub>1')\\<close> \n  have \"S,f \\<turnstile> (n\\<^sub>1,s\\<^sub>1) =as\\<Rightarrow>* (n\\<^sub>1',s\\<^sub>1')\" by simp\n  from \\<open>S,f \\<turnstile> (n\\<^sub>1,s\\<^sub>1) =as\\<Rightarrow>* (n\\<^sub>1',s\\<^sub>1')\\<close> \\<open>((n\\<^sub>1,s\\<^sub>1),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\\<close> \\<open>as \\<noteq> []\\<close> \\<open>f = kind\\<close>\n  show \"((n\\<^sub>1',s\\<^sub>1'),(n\\<^sub>1',transfers (slice_kinds S as) s\\<^sub>2)) \\<in> WS S \\<and>\n    S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as\\<Rightarrow>* (n\\<^sub>1',transfers (slice_kinds S as) s\\<^sub>2)\"\n  proof(induct arbitrary:n\\<^sub>2 s\\<^sub>2 rule:trans_observable_moves.induct)\n    case tom_Nil thus ?case by simp\n  next\n    case (tom_Cons S f n s as n' s' as' n'' s'')\n    note IH = \\<open>\\<And>n\\<^sub>2 s\\<^sub>2. \\<lbrakk>((n',s'),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S; as' \\<noteq> []; f = kind\\<rbrakk>\n      \\<Longrightarrow> ((n'',s''),(n'',transfers (slice_kinds S as') s\\<^sub>2)) \\<in> WS S \\<and>\n      S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =as'\\<Rightarrow>* (n'',transfers (slice_kinds S as') s\\<^sub>2)\\<close>\n    from \\<open>S,f \\<turnstile> (n,s) =as\\<Rightarrow> (n',s')\\<close>\n    obtain asx ax nx sx where \"S,f \\<turnstile> (n,s) =asx\\<Rightarrow>\\<^sub>\\<tau> (nx,sx)\"\n      and \"S,f \\<turnstile> (nx,sx) -ax\\<rightarrow> (n',s')\" and \"as = asx@[ax]\"\n      by(fastforce elim:observable_moves.cases)\n    from \\<open>S,f \\<turnstile> (nx,sx) -ax\\<rightarrow> (n',s')\\<close> have \"obs nx (backward_slice S) = {nx}\"\n      by(fastforce intro!:n_in_obs elim:observable_move.cases)\n    with \\<open>S,f \\<turnstile> (n,s) =asx\\<Rightarrow>\\<^sub>\\<tau> (nx,sx)\\<close> \\<open>((n,s),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\\<close> \\<open>f = kind\\<close>\n    have \"((nx,sx),(n\\<^sub>2,s\\<^sub>2)) \\<in> WS S\" by(fastforce intro:WS_silent_moves)\n    with \\<open>S,f \\<turnstile> (nx,sx) -ax\\<rightarrow> (n',s')\\<close> \\<open>f = kind\\<close>\n    obtain asx' where \"((n',s'),(n',transfer (slice_kind S ax) s\\<^sub>2)) \\<in> WS S\"\n      and \"S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =asx'@[ax]\\<Rightarrow> \n      (n',transfer (slice_kind S ax) s\\<^sub>2)\"\n      by(fastforce elim:WS_observable_move)\n    show ?case\n    proof(cases \"as' = []\")\n      case True\n      with \\<open>S,f \\<turnstile> (n',s') =as'\\<Rightarrow>* (n'',s'')\\<close> have \"n' = n'' \\<and> s' = s''\"\n        by(fastforce elim:trans_observable_moves.cases dest:observable_move_notempty)\n      from \\<open>S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =asx'@[ax]\\<Rightarrow> \n                               (n',transfer (slice_kind S ax) s\\<^sub>2)\\<close>\n      have \"S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =(last (asx'@[ax]))#[]\\<Rightarrow>* \n                               (n',transfer (slice_kind S ax) s\\<^sub>2)\"\n        by(fastforce intro:trans_observable_moves.intros)\n      with \\<open>((n',s'),(n',transfer (slice_kind S ax) s\\<^sub>2)) \\<in> WS S\\<close> \\<open>as = asx@[ax]\\<close>\n        \\<open>n' = n'' \\<and> s' = s''\\<close> True\n      show ?thesis by(fastforce simp:slice_kinds_def)\n    next\n      case False\n      from IH[OF \\<open>((n',s'),(n',transfer (slice_kind S ax) s\\<^sub>2)) \\<in> WS S\\<close> this \n        \\<open>f = kind\\<close>]\n      have \"((n'',s''),(n'',transfers (slice_kinds S as') \n        (transfer (slice_kind S ax) s\\<^sub>2))) \\<in> WS S\"\n        and \"S,slice_kind S \\<turnstile> (n',transfer (slice_kind S ax) s\\<^sub>2) \n        =as'\\<Rightarrow>* (n'',transfers (slice_kinds S as')\n                     (transfer (slice_kind S ax) s\\<^sub>2))\" by simp_all\n      with \\<open>S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =asx'@[ax]\\<Rightarrow> \n                               (n',transfer (slice_kind S ax) s\\<^sub>2)\\<close>\n      have \"S,slice_kind S \\<turnstile> (n\\<^sub>2,s\\<^sub>2) =(last (asx'@[ax]))#as'\\<Rightarrow>* \n        (n'',transfers (slice_kinds S as') (transfer (slice_kind S ax) s\\<^sub>2))\"\n        by(fastforce intro:trans_observable_moves.tom_Cons)\n      with \\<open>((n'',s''),(n'',transfers (slice_kinds S as') \n        (transfer (slice_kind S ax) s\\<^sub>2))) \\<in> WS S\\<close> False \\<open>as = asx@[ax]\\<close>\n      show ?thesis by(fastforce simp:slice_kinds_def)\n    qed\n  qed\nqed\n\n\nlemma transfers_slice_kinds_slice_edges:\n  \"transfers (slice_kinds S (slice_edges S as)) s = transfers (slice_kinds S as) s\"\nproof(induct as arbitrary:s)\n  case Nil thus ?case by(simp add:slice_kinds_def slice_edges_def)\nnext\n  case (Cons a' as')\n  note IH = \\<open>\\<And>s. transfers (slice_kinds S (slice_edges S as')) s =\n                  transfers (slice_kinds S as') s\\<close>\n  show ?case\n  proof(cases \"sourcenode a' \\<in> backward_slice S\")\n    case True\n    hence eq:\"transfers (slice_kinds S (slice_edges S (a'#as'))) s\n            = transfers (slice_kinds S (slice_edges S as')) \n                (transfer (slice_kind S a') s)\"\n      by(simp add:slice_edges_def slice_kinds_def)\n    have \"transfers (slice_kinds S (a'#as')) s\n        = transfers (slice_kinds S as') (transfer (slice_kind S a') s)\"\n      by(simp add:slice_kinds_def)\n    with eq IH[of \"transfer (slice_kind S a') s\"] show ?thesis by simp\n  next\n    case False\n    hence eq:\"transfers (slice_kinds S (slice_edges S (a'#as'))) s\n            = transfers (slice_kinds S (slice_edges S as')) s\"\n      by(simp add:slice_edges_def slice_kinds_def)\n    from False have \"transfer (slice_kind S a') s = s\"\n      by(cases \"kind a'\",auto simp:slice_kind_def Let_def)\n    hence \"transfers (slice_kinds S (a'#as')) s\n         = transfers (slice_kinds S as') s\"\n      by(simp add:slice_kinds_def)\n    with eq IH[of s] show ?thesis by simp\n  qed\nqed\n\n\nlemma trans_observable_moves_preds:\n  assumes \"S,f \\<turnstile> (n,s) =as\\<Rightarrow>* (n',s')\" and \"valid_node n\"\n  obtains as' where \"preds (map f as') s\" and \"slice_edges S as' = as\"\n  and \"n -as'\\<rightarrow>* n'\"\nproof(atomize_elim)\n  from \\<open>S,f \\<turnstile> (n,s) =as\\<Rightarrow>* (n',s')\\<close> \\<open>valid_node n\\<close>\n  show \"\\<exists>as'. preds (map f as') s \\<and> slice_edges S as' = as \\<and> n -as'\\<rightarrow>* n'\"\n  proof(induct rule:trans_observable_moves.induct)\n    case tom_Nil thus ?case \n      by(rule_tac x=\"[]\" in exI,fastforce intro:empty_path simp:slice_edges_def)\n  next\n    case (tom_Cons S f n s as n' s' as' n'' s'')\n    note IH = \\<open>valid_node n' \n      \\<Longrightarrow> \\<exists>asx. preds (map f asx) s' \\<and> slice_edges S asx = as' \\<and> n' -asx\\<rightarrow>* n''\\<close>\n    from \\<open>S,f \\<turnstile> (n,s) =as\\<Rightarrow> (n',s')\\<close>\n    have \"preds (map f as) s\" and \"transfers (map f as) s = s'\"\n      and \"n -as\\<rightarrow>* n'\"\n      by(fastforce dest:observable_moves_preds_transfers_path)+\n    from \\<open>n -as\\<rightarrow>* n'\\<close> have \"valid_node n'\" by(fastforce dest:path_valid_node)\n    from \\<open>S,f \\<turnstile> (n,s) =as\\<Rightarrow> (n',s')\\<close> have \"slice_edges S as = [last as]\"\n      by(rule observable_moves_last_slice_edges)\n    from IH[OF \\<open>valid_node n'\\<close>]\n    obtain asx where \"preds (map f asx) s'\" and \"slice_edges S asx = as'\"\n      and \"n' -asx\\<rightarrow>* n''\"\n      by blast\n    from \\<open>n -as\\<rightarrow>* n'\\<close> \\<open>n' -asx\\<rightarrow>* n''\\<close> have \"n -as@asx\\<rightarrow>* n''\" by(rule path_Append)\n    from \\<open>preds (map f asx) s'\\<close> \\<open>transfers (map f as) s = s'\\<close>[THEN sym]\n      \\<open>preds (map f as) s\\<close>\n    have \"preds (map f (as@asx)) s\" by(simp add:preds_split)\n    with \\<open>slice_edges S as = [last as]\\<close> \\<open>slice_edges S asx = as'\\<close> \n      \\<open>n -as@asx\\<rightarrow>* n''\\<close> show ?case\n      by(rule_tac x=\"as@asx\" in exI,auto simp:slice_edges_def)\n  qed\nqed\n\n\n\nlemma exists_sliced_path_preds:\n  assumes \"n -as\\<rightarrow>* n'\" and \"slice_edges S as = []\" and \"n' \\<in> backward_slice S\"\n  obtains as' where \"n -as'\\<rightarrow>* n'\" and \"preds (slice_kinds S as') s\"\n  and \"slice_edges S as' = []\"\nproof(atomize_elim)\n  from \\<open>slice_edges S as = []\\<close>\n  have \"\\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> (backward_slice S)\"\n    by(rule slice_edges_no_nodes_in_slice)\n  with \\<open>n -as\\<rightarrow>* n'\\<close> \\<open>n' \\<in> backward_slice S\\<close> have \"n' \\<in> obs n (backward_slice S)\"\n    by -(rule obs_elem)\n  hence \"obs n (backward_slice S) = {n'}\" by(rule obs_singleton_element)\n  from \\<open>n -as\\<rightarrow>* n'\\<close> have \"valid_node n\" and \"valid_node n'\"\n    by(fastforce dest:path_valid_node)+\n  from \\<open>n -as\\<rightarrow>* n'\\<close> obtain x where \"distance n n' x\" and \"x \\<le> length as\"\n    by(erule every_path_distance)\n  from \\<open>distance n n' x\\<close> \\<open>obs n (backward_slice S) = {n'}\\<close>\n  show \"\\<exists>as'. n -as'\\<rightarrow>* n' \\<and> preds (slice_kinds S as') s \\<and> \n              slice_edges S as' = []\"\n  proof(induct x arbitrary:n rule:nat.induct)\n    case zero\n    from \\<open>distance n n' 0\\<close> have \"n = n'\" by(fastforce elim:distance.cases)\n    with \\<open>valid_node n'\\<close> show ?case\n      by(rule_tac x=\"[]\" in exI,\n        auto intro:empty_path simp:slice_kinds_def slice_edges_def)\n  next\n    case (Suc x)\n    note IH = \\<open>\\<And>n. \\<lbrakk>distance n n' x; obs n (backward_slice S) = {n'}\\<rbrakk>\n      \\<Longrightarrow> \\<exists>as'. n -as'\\<rightarrow>* n' \\<and> preds (slice_kinds S as') s \\<and> \n               slice_edges S as' = []\\<close>\n    from \\<open>distance n n' (Suc x)\\<close> obtain a \n      where \"valid_edge a\" and \"n = sourcenode a\" \n      and \"distance (targetnode a) n' x\"\n      and target:\"targetnode a = (SOME nx. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n      distance (targetnode a') n' x \\<and>\n      valid_edge a' \\<and> targetnode a' = nx)\"\n      by(auto elim:distance_successor_distance)\n    have \"n \\<notin> backward_slice S\"\n    proof\n      assume \"n \\<in> backward_slice S\"\n      from \\<open>valid_edge a\\<close> \\<open>n = sourcenode a\\<close> have \"valid_node n\" by simp\n      with \\<open>n \\<in> backward_slice S\\<close> have \"obs n (backward_slice S) = {n}\"\n        by -(rule n_in_obs)\n      with \\<open>obs n (backward_slice S) = {n'}\\<close> have \"n = n'\" by simp\n      with \\<open>valid_node n\\<close> have \"n -[]\\<rightarrow>* n'\" by(fastforce intro:empty_path)\n      with \\<open>distance n n' (Suc x)\\<close> show False\n        by(fastforce elim:distance.cases)\n    qed\n    from \\<open>distance (targetnode a) n' x\\<close> \\<open>n' \\<in> backward_slice S\\<close>\n    obtain m where \"m \\<in> obs (targetnode a) (backward_slice S)\"\n      by(fastforce elim:distance.cases path_ex_obs)\n    from \\<open>valid_edge a\\<close> \\<open>n \\<notin> backward_slice S\\<close> \\<open>n = sourcenode a\\<close>\n    have \"obs (targetnode a) (backward_slice S) \\<subseteq> \n      obs (sourcenode a) (backward_slice S)\"\n      by -(rule edge_obs_subset,auto)\n    with \\<open>m \\<in> obs (targetnode a) (backward_slice S)\\<close> \\<open>n = sourcenode a\\<close>\n      \\<open>obs n (backward_slice S) = {n'}\\<close>\n    have \"n' \\<in> obs (targetnode a) (backward_slice S)\" by auto\n    hence \"obs (targetnode a) (backward_slice S) = {n'}\" \n      by(rule obs_singleton_element)\n    from IH[OF \\<open>distance (targetnode a) n' x\\<close> this]\n    obtain as where \"targetnode a -as\\<rightarrow>* n'\" and \"preds (slice_kinds S as) s\"\n      and \"slice_edges S as = []\" by blast\n    from \\<open>targetnode a -as\\<rightarrow>* n'\\<close> \\<open>valid_edge a\\<close> \\<open>n = sourcenode a\\<close>\n    have \"n -a#as\\<rightarrow>* n'\" by(fastforce intro:Cons_path)\n    from \\<open>slice_edges S as = []\\<close> \\<open>n \\<notin> backward_slice S\\<close> \\<open>n = sourcenode a\\<close>\n    have \"slice_edges S (a#as) = []\" by(simp add:slice_edges_def)\n    show ?case\n    proof(cases \"kind a\")\n      case (Update f)\n      with \\<open>n \\<notin> backward_slice S\\<close> \\<open>n = sourcenode a\\<close> have \"slice_kind S a = \\<Up>id\"\n        by(fastforce intro:slice_kind_Upd)\n      hence \"transfer (slice_kind S a) s = s\" and \"pred (slice_kind S a) s\"\n        by simp_all\n      with \\<open>preds (slice_kinds S as) s\\<close> have \"preds (slice_kinds S (a#as)) s\"\n        by(simp add:slice_kinds_def)\n      with \\<open>n -a#as\\<rightarrow>* n'\\<close> \\<open>slice_edges S (a#as) = []\\<close> show ?thesis\n        by blast\n    next\n      case (Predicate Q)\n      with \\<open>n \\<notin> backward_slice S\\<close> \\<open>n = sourcenode a\\<close> \\<open>distance n n' (Suc x)\\<close>  \n        \\<open>obs n (backward_slice S) = {n'}\\<close> \\<open>distance (targetnode a) n' x\\<close>\n        \\<open>targetnode a = (SOME nx. \\<exists>a'. sourcenode a = sourcenode a' \\<and> \n        distance (targetnode a') n' x \\<and>\n        valid_edge a' \\<and> targetnode a' = nx)\\<close>\n      have \"slice_kind S a = (\\<lambda>s. True)\\<^sub>\\<surd>\"\n        by(fastforce intro:slice_kind_Pred_obs_nearer_SOME)\n      hence \"transfer (slice_kind S a) s = s\" and \"pred (slice_kind S a) s\"\n        by simp_all\n      with \\<open>preds (slice_kinds S as) s\\<close> have \"preds (slice_kinds S (a#as)) s\"\n        by(simp add:slice_kinds_def)\n      with \\<open>n -a#as\\<rightarrow>* n'\\<close> \\<open>slice_edges S (a#as) = []\\<close> show ?thesis by blast\n    qed\n  qed\nqed\n\n\ntheorem fundamental_property_of_static_slicing:\n  assumes path:\"n -as\\<rightarrow>* n'\" and preds:\"preds (kinds as) s\" and \"n' \\<in> S\"\n  obtains as' where \"preds (slice_kinds S as') s\"\n  and \"(\\<forall>V \\<in> Use n'. state_val (transfers (slice_kinds S as') s) V = \n                     state_val (transfers (kinds as) s) V)\"\n  and \"slice_edges S as = slice_edges S as'\" and \"n -as'\\<rightarrow>* n'\"\nproof(atomize_elim)\n  from path preds obtain n'' s'' as' as''\n    where \"S,kind \\<turnstile> (n,s) =slice_edges S as\\<Rightarrow>* (n'',s'')\"\n    and \"S,kind \\<turnstile> (n'',s'') =as'\\<Rightarrow>\\<^sub>\\<tau> (n',transfers (kinds as) s)\"\n    and \"slice_edges S as = slice_edges S as''\"\n    and \"n -as''@as'\\<rightarrow>* n'\"\n    by -(erule_tac S=\"S\" in path_trans_observable_moves,auto)\n  from path have \"valid_node n\" and \"valid_node n'\" \n    by(fastforce dest:path_valid_node)+\n  from \\<open>valid_node n\\<close> have \"((n,s),(n,s)) \\<in> WS S\" by(fastforce intro:WSI)\n  from \\<open>valid_node n'\\<close> \\<open>n' \\<in> S\\<close> have \"obs n' (backward_slice S) = {n'}\"\n    by(fastforce intro!:n_in_obs refl)\n  from \\<open>valid_node n'\\<close> have \"n'-[]\\<rightarrow>* n'\" by(fastforce intro:empty_path)\n  with \\<open>valid_node n'\\<close> \\<open>n' \\<in> S\\<close> have \"\\<forall>V \\<in> Use n'. V \\<in> rv S n'\"\n    by(fastforce intro:rvI refl simp:sourcenodes_def)\n  show \"\\<exists>as'. preds (slice_kinds S as') s \\<and>\n    (\\<forall>V \\<in> Use n'. state_val (transfers (slice_kinds S as') s) V = \n                  state_val (transfers (kinds as) s) V) \\<and>\n    slice_edges S as = slice_edges S as' \\<and> n -as'\\<rightarrow>* n'\"\n  proof(cases \"slice_edges S as = []\")\n    case True\n    hence \"preds (slice_kinds S []) s\" and \"slice_edges S [] = slice_edges S as\"\n      by(simp_all add:slice_kinds_def slice_edges_def)\n    from \\<open>S,kind \\<turnstile> (n,s) =slice_edges S as\\<Rightarrow>* (n'',s'')\\<close> True\n    have \"n = n''\" and \"s = s''\"\n      by(fastforce elim:trans_observable_moves.cases)+\n    with \\<open>S,kind \\<turnstile> (n'',s'') =as'\\<Rightarrow>\\<^sub>\\<tau> (n',transfers (kinds as) s)\\<close>\n    have \"S,kind \\<turnstile> (n,s) =as'\\<Rightarrow>\\<^sub>\\<tau> (n',transfers (kinds as) s)\" by simp\n    with \\<open>valid_node n\\<close> have \"n -as'\\<rightarrow>* n'\"\n      by(fastforce dest:silent_moves_preds_transfers_path)\n    from \\<open>S,kind \\<turnstile> (n,s) =as'\\<Rightarrow>\\<^sub>\\<tau> (n',transfers (kinds as) s)\\<close>\n    have \"slice_edges S as' = []\" by(fastforce dest:silent_moves_no_slice_edges)\n    with \\<open>n -as'\\<rightarrow>* n'\\<close> \\<open>valid_node n'\\<close> \\<open>n' \\<in> S\\<close> obtain asx\n      where \"n -asx\\<rightarrow>* n'\" and \"preds (slice_kinds S asx) s\"\n      and \"slice_edges S asx = []\"\n      by -(erule exists_sliced_path_preds,auto intro:refl)\n    from \\<open>S,kind \\<turnstile> (n,s) =as'\\<Rightarrow>\\<^sub>\\<tau> (n',transfers (kinds as) s)\\<close>\n      \\<open>((n,s),(n,s)) \\<in> WS S\\<close> \\<open>obs n' (backward_slice S) = {n'}\\<close>\n    have \"((n',transfers (kinds as) s),(n,s)) \\<in> WS S\"\n      by(fastforce intro:WS_silent_moves)\n    with True have \"\\<forall>V \\<in> rv S n'. state_val (transfers (kinds as) s) V = \n      state_val (transfers (slice_kinds S (slice_edges S as)) s) V\"\n      by(fastforce dest:WSD simp:slice_edges_def slice_kinds_def)\n    with \\<open>\\<forall>V \\<in> Use n'. V \\<in> rv S n'\\<close>\n    have \"\\<forall>V \\<in> Use n'. state_val (transfers (kinds as) s) V = \n      state_val (transfers (slice_kinds S (slice_edges S as)) s) V\" by simp\n    with \\<open>slice_edges S asx = []\\<close> \\<open>slice_edges S [] = slice_edges S as\\<close>\n    have \"\\<forall>V \\<in> Use n'. state_val (transfers (kinds as) s) V = \n      state_val (transfers (slice_kinds S (slice_edges S asx)) s) V\"\n      by(simp add:slice_edges_def)\n    hence \"\\<forall>V \\<in> Use n'. state_val (transfers (kinds as) s) V = \n      state_val (transfers (slice_kinds S asx) s) V\"\n      by(simp add:transfers_slice_kinds_slice_edges)\n    with \\<open>n -asx\\<rightarrow>* n'\\<close> \\<open>preds (slice_kinds S asx) s\\<close>\n      \\<open>slice_edges S asx = []\\<close> \\<open>slice_edges S [] = slice_edges S as\\<close>\n    show ?thesis\n      by(rule_tac x=\"asx\" in exI,simp add:slice_edges_def)\n  next\n    case False\n    with \\<open>S,kind \\<turnstile> (n,s) =slice_edges S as\\<Rightarrow>* (n'',s'')\\<close> \\<open>((n,s),(n,s)) \\<in> WS S\\<close>\n    have \"((n'',s''),(n'',transfers (slice_kinds S (slice_edges S as)) s)) \\<in> WS S\"\n      \"S,slice_kind S \\<turnstile> (n,s) =slice_edges S as\\<Rightarrow>* \n      (n'',transfers (slice_kinds S (slice_edges S as)) s)\"\n      by(fastforce dest:WS_weak_sim_trans)+\n    from \\<open>S,slice_kind S \\<turnstile> (n,s) =slice_edges S as\\<Rightarrow>* \n                             (n'',transfers (slice_kinds S (slice_edges S as)) s)\\<close>\n      \\<open>valid_node n\\<close>\n    obtain asx where \"preds (slice_kinds S asx) s\" \n      and \"slice_edges S asx = slice_edges S as\"\n      and \"n -asx\\<rightarrow>* n''\"\n      by(fastforce elim:trans_observable_moves_preds simp:slice_kinds_def)\n    from \\<open>n -asx\\<rightarrow>* n''\\<close> have \"valid_node n''\" by(fastforce dest:path_valid_node)\n    with \\<open>S,kind \\<turnstile> (n'',s'') =as'\\<Rightarrow>\\<^sub>\\<tau> (n',transfers (kinds as) s)\\<close>\n    have \"n'' -as'\\<rightarrow>* n'\"\n      by(fastforce dest:silent_moves_preds_transfers_path)\n    from \\<open>S,kind \\<turnstile> (n'',s'') =as'\\<Rightarrow>\\<^sub>\\<tau> (n',transfers (kinds as) s)\\<close>\n    have \"slice_edges S as' = []\" by(fastforce dest:silent_moves_no_slice_edges)\n    with \\<open>n'' -as'\\<rightarrow>* n'\\<close> \\<open>valid_node n'\\<close> \\<open>n' \\<in> S\\<close> obtain asx'\n      where \"n'' -asx'\\<rightarrow>* n'\" and \"slice_edges S asx' = []\"\n      and \"preds (slice_kinds S asx') (transfers (slice_kinds S asx) s)\"\n      by -(erule exists_sliced_path_preds,auto intro:refl)\n    from \\<open>n -asx\\<rightarrow>* n''\\<close> \\<open>n'' -asx'\\<rightarrow>* n'\\<close> have \"n -asx@asx'\\<rightarrow>* n'\"\n      by(rule path_Append)\n    from \\<open>slice_edges S asx = slice_edges S as\\<close> \\<open>slice_edges S asx' = []\\<close>\n    have \"slice_edges S as = slice_edges S (asx@asx')\"\n      by(auto simp:slice_edges_def)\n    from \\<open>preds (slice_kinds S asx') (transfers (slice_kinds S asx) s)\\<close>\n      \\<open>preds (slice_kinds S asx) s\\<close>\n    have \"preds (slice_kinds S (asx@asx')) s\" \n      by(simp add:slice_kinds_def preds_split)\n    from \\<open>obs n' (backward_slice S) = {n'}\\<close>\n      \\<open>S,kind \\<turnstile> (n'',s'') =as'\\<Rightarrow>\\<^sub>\\<tau> (n',transfers (kinds as) s)\\<close>\n      \\<open>((n'',s''),(n'',transfers (slice_kinds S (slice_edges S as)) s)) \\<in> WS S\\<close>\n    have \"((n',transfers (kinds as) s),\n      (n'',transfers (slice_kinds S (slice_edges S as)) s)) \\<in> WS S\"\n      by(fastforce intro:WS_silent_moves)\n    hence \"\\<forall>V \\<in> rv S n'. state_val (transfers (kinds as) s) V = \n      state_val (transfers (slice_kinds S (slice_edges S as)) s) V\"\n      by(fastforce dest:WSD)\n    with \\<open>\\<forall>V \\<in> Use n'. V \\<in> rv S n'\\<close> \\<open>slice_edges S asx = slice_edges S as\\<close>\n    have \"\\<forall>V \\<in> Use n'. state_val (transfers (kinds as) s) V = \n      state_val (transfers (slice_kinds S (slice_edges S asx)) s) V\"\n      by fastforce\n    with \\<open>slice_edges S asx' = []\\<close>\n    have \"\\<forall>V \\<in> Use n'. state_val (transfers (kinds as) s) V = \n      state_val (transfers (slice_kinds S (slice_edges S (asx@asx'))) s) V\"\n      by(auto simp:slice_edges_def)\n    hence \"\\<forall>V \\<in> Use n'. state_val (transfers (kinds as) s) V = \n      state_val (transfers (slice_kinds S (asx@asx')) s) V\"\n      by(simp add:transfers_slice_kinds_slice_edges)\n    with \\<open>preds (slice_kinds S (asx@asx')) s\\<close> \\<open>n -asx@asx'\\<rightarrow>* n'\\<close>\n      \\<open>slice_edges S as = slice_edges S (asx@asx')\\<close>\n    show ?thesis by simp blast\n  qed\nqed\n\n\nend\n\n\nsubsection \\<open>The fundamental property of (static) slicing related to the semantics\\<close>\n\nlocale BackwardSlice_wf = \n  BackwardSlice sourcenode targetnode kind valid_edge Entry Def Use state_val \n  backward_slice +\n  CFG_semantics_wf sourcenode targetnode kind valid_edge Entry sem identifies\n  for sourcenode :: \"'edge \\<Rightarrow> 'node\" and targetnode :: \"'edge \\<Rightarrow> 'node\"\n  and kind :: \"'edge \\<Rightarrow> 'state edge_kind\" and valid_edge :: \"'edge \\<Rightarrow> bool\"\n  and Entry :: \"'node\" (\"'('_Entry'_')\") and Def :: \"'node \\<Rightarrow> 'var set\"\n  and Use :: \"'node \\<Rightarrow> 'var set\" and state_val :: \"'state \\<Rightarrow> 'var \\<Rightarrow> 'val\"\n  and backward_slice :: \"'node set \\<Rightarrow> 'node set\" \n  and sem :: \"'com \\<Rightarrow> 'state \\<Rightarrow> 'com \\<Rightarrow> 'state \\<Rightarrow> bool\" \n    (\"((1\\<langle>_,/_\\<rangle>) \\<Rightarrow>/ (1\\<langle>_,/_\\<rangle>))\" [0,0,0,0] 81)\n  and identifies :: \"'node \\<Rightarrow> 'com \\<Rightarrow> bool\" (\"_ \\<triangleq> _\" [51, 0] 80)\n\nbegin\n\n\ntheorem fundamental_property_of_path_slicing_semantically:\n  assumes \"n \\<triangleq> c\" and \"\\<langle>c,s\\<rangle> \\<Rightarrow> \\<langle>c',s'\\<rangle>\"\n  obtains n' as where \"n -as\\<rightarrow>* n'\" and \"preds (slice_kinds {n'} as) s\" and \"n' \\<triangleq> c'\"\n  and \"\\<forall>V \\<in> Use n'. state_val (transfers (slice_kinds {n'} as) s) V = state_val s' V\"\nproof(atomize_elim)\n  from \\<open>n \\<triangleq> c\\<close> \\<open>\\<langle>c,s\\<rangle> \\<Rightarrow> \\<langle>c',s'\\<rangle>\\<close> obtain n' as where \"n -as\\<rightarrow>* n'\"\n    and \"transfers (kinds as) s = s'\" and \"preds (kinds as) s\" and \"n' \\<triangleq> c'\"\n    by(fastforce dest:fundamental_property)\n  from \\<open>n -as\\<rightarrow>* n'\\<close> \\<open>preds (kinds as) s\\<close> obtain as'\n    where \"preds (slice_kinds {n'} as') s\"\n    and vals:\"\\<forall>V \\<in> Use n'. state_val (transfers (slice_kinds {n'} as') s) V = \n    state_val (transfers (kinds as) s) V\" and \"n -as'\\<rightarrow>* n'\"\n    by -(erule fundamental_property_of_static_slicing,auto)\n  from \\<open>transfers (kinds as) s = s'\\<close> vals have \"\\<forall>V \\<in> Use n'.\n    state_val (transfers (slice_kinds {n'} as') s) V = state_val s' V\"\n    by simp\n  with \\<open>preds (slice_kinds {n'} as') s\\<close> \\<open>n -as'\\<rightarrow>* n'\\<close> \\<open> n' \\<triangleq> c'\\<close>\n  show \"\\<exists>as n'. n -as\\<rightarrow>* n' \\<and> preds (slice_kinds {n'} as) s \\<and> n' \\<triangleq> c' \\<and>\n    (\\<forall>V\\<in>Use n'. state_val (transfers (slice_kinds {n'} as) s) V = state_val s' V)\"\n    by blast\nqed\n\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Slicing/StaticIntra/Slice.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251201477016, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.3120498179904941}}
{"text": "header {*\n\\isachapter{A Control Flow Graph for Jinja Byte Code}\n\\isaheader{Formalizing the CFG}\n*}\n\ntheory JVMCFG imports \"../StaticInter/BasicDefs\" \"../../Jinja/BV/BVExample\" begin\n\ndeclare lesub_list_impl_same_size [simp del]\ndeclare listE_length [simp del]\n\nsubsection {* Type definitions *}\n\nsubsubsection {* Wellformed Programs *}\n\ndefinition \"wf_jvmprog = {(P, Phi). wf_jvm_prog\\<^bsub>Phi\\<^esub> P}\"\n\ntypedef wf_jvmprog = \"wf_jvmprog\"\nproof\n  show \"(E, Phi) \\<in> wf_jvmprog\"\n    unfolding wf_jvmprog_def by (auto intro: wf_prog)\nqed\n\nhide_const Phi E\n\nabbreviation PROG :: \"wf_jvmprog \\<Rightarrow> jvm_prog\"\n  where \"PROG P \\<equiv> fst(Rep_wf_jvmprog(P))\"\n\nabbreviation TYPING :: \"wf_jvmprog \\<Rightarrow> ty\\<^sub>P\"\n  where \"TYPING P \\<equiv> snd(Rep_wf_jvmprog(P))\"\n\nlemma wf_jvmprog_is_wf_typ: \"wf_jvm_prog\\<^bsub>TYPING P\\<^esub> (PROG P)\"\nusing Rep_wf_jvmprog [of P]\n  by (auto simp: wf_jvmprog_def split_beta)\n\nlemma wf_jvmprog_is_wf: \"wf_jvm_prog (PROG P)\"\n  using wf_jvmprog_is_wf_typ unfolding wf_jvm_prog_def\n  by blast\n\nsubsubsection {* Interprocedural CFG *}\n\ntype_synonym jvm_method = \"wf_jvmprog \\<times> cname \\<times> mname\"\ndatatype var = Heap | Local \"nat\" | Stack \"nat\" | Exception\ndatatype val = Hp \"heap\" | Value \"Value.val\"\n\ntype_synonym state = \"var \\<rightharpoonup> val\"\n\ndefinition valid_state :: \"state \\<Rightarrow> bool\"\n  where \"valid_state s \\<equiv> (\\<forall>val. s Heap \\<noteq> Some (Value val))\n  \\<and> (s Exception = None \\<or> (\\<exists>addr. s Exception = Some (Value (Addr addr))))\n  \\<and> (\\<forall>var. var \\<noteq> Heap \\<and> var \\<noteq> Exception \\<longrightarrow> (\\<forall>h. s var \\<noteq> Some (Hp h)))\"\n\nfun the_Heap :: \"val \\<Rightarrow> heap\"\n  where \"the_Heap (Hp h) = h\"\n\nfun the_Value :: \"val \\<Rightarrow> Value.val\"\n  where \"the_Value (Value v) = v\"\n\nabbreviation heap_of :: \"state \\<Rightarrow> heap\"\n  where \"heap_of s \\<equiv> the_Heap (the (s Heap))\"\n\nabbreviation exc_flag :: \"state \\<Rightarrow> addr option\"\n  where \"exc_flag s \\<equiv> case (s Exception) of None \\<Rightarrow> None\n  | Some v \\<Rightarrow> Some (THE a. v = Value (Addr a))\"\n\nabbreviation stkAt :: \"state \\<Rightarrow> nat \\<Rightarrow> Value.val\"\n  where \"stkAt s n \\<equiv> the_Value (the (s (Stack n)))\"\n\nabbreviation locAt :: \"state \\<Rightarrow> nat \\<Rightarrow> Value.val\"\n  where \"locAt s n \\<equiv> the_Value (the (s (Local n)))\"\n\ndatatype nodeType = Enter | Normal | Return | Exceptional \"pc option\" \"nodeType\"\ntype_synonym cfg_node = \"cname \\<times> mname \\<times> pc option \\<times> nodeType\"\n\ntype_synonym\n  cfg_edge = \"cfg_node \\<times> (var, val, cname \\<times> mname \\<times> pc, cname \\<times> mname) edge_kind \\<times> cfg_node\"\n\ndefinition ClassMain :: \"wf_jvmprog \\<Rightarrow> cname\"\n  where \"ClassMain P \\<equiv> SOME Name. \\<not> is_class (PROG P) Name\"\n\ndefinition MethodMain :: \"wf_jvmprog \\<Rightarrow> mname\"\n  where \"MethodMain P \\<equiv> SOME Name.\n  \\<forall>C D fs ms. class (PROG P) C = \\<lfloor>(D, fs, ms)\\<rfloor> \\<longrightarrow> (\\<forall>m \\<in> set ms. Name \\<noteq> fst m)\"\n\ndefinition stkLength :: \"jvm_method \\<Rightarrow> pc \\<Rightarrow> nat\"\n  where\n  \"stkLength m pc \\<equiv> let (P, C, M) = m in (\n  if (C = ClassMain P) then 1 else (\n    length (fst(the(((TYPING P) C M) ! pc)))\n  ))\"\n\ndefinition locLength :: \"jvm_method \\<Rightarrow> pc \\<Rightarrow> nat\"\n  where\n  \"locLength m pc \\<equiv> let (P, C, M) = m in (\n  if (C = ClassMain P) then 1 else (\n    length (snd(the(((TYPING P) C M) ! pc)))\n  ))\"\n\nlemma ex_new_class_name: \"\\<exists>C. \\<not> is_class P C\"\nproof -\n  have \"\\<not> finite (UNIV :: cname set)\"\n    by (rule infinite_UNIV_listI)\n  hence \"\\<exists>C. C \\<notin> set (map fst P)\"\n    by -(rule ex_new_if_finite, auto)\n  then obtain C where \"C \\<notin> set (map fst P)\"\n    by blast\n  have \"\\<not> is_class P C\"\n  proof\n    assume \"is_class P C\"\n    then obtain D fs ms where \"class P C = \\<lfloor>(D, fs, ms)\\<rfloor>\"\n      by auto\n    with `C \\<notin> set (map fst P)` show False\n      by (auto dest: map_of_SomeD intro!: image_eqI simp: class_def)\n  qed\n  thus ?thesis\n    by blast\nqed\n\nlemma ClassMain_unique_in_P:\n  assumes \"is_class (PROG P) C\"\n  shows \"ClassMain P \\<noteq> C\"\nproof -\n  from ex_new_class_name [of \"PROG P\"] obtain D where \"\\<not> is_class (PROG P) D\"\n    by blast\n  with `is_class (PROG P) C` show ?thesis\n    unfolding ClassMain_def\n    by -(rule someI2, fastforce+)\nqed\n\nlemma map_of_fstD: \"\\<lbrakk> map_of xs a = \\<lfloor>b\\<rfloor>; \\<forall>x \\<in> set xs. fst x \\<noteq> a \\<rbrakk> \\<Longrightarrow> False\"\n  by (induct xs, auto)\n\nlemma map_of_fstE: \"\\<lbrakk> map_of xs a = \\<lfloor>b\\<rfloor>; \\<exists>x \\<in> set xs. fst x = a \\<Longrightarrow> thesis \\<rbrakk> \\<Longrightarrow> thesis\"\n  by (induct xs) (auto split: split_if_asm)\n\nlemma ex_unique_method_name:\n  \"\\<exists>Name. \\<forall>C D fs ms. class (PROG P) C = \\<lfloor>(D, fs, ms)\\<rfloor> \\<longrightarrow> (\\<forall>m\\<in>set ms. Name \\<noteq> fst m)\"\nproof -\n  from wf_jvmprog_is_wf [of P]\n  have \"distinct_fst (PROG P)\"\n    by (simp add: wf_jvm_prog_def wf_jvm_prog_phi_def wf_prog_def)\n  hence \"{C. \\<exists>D fs ms. class (PROG P) C = \\<lfloor>(D, fs, ms)\\<rfloor>} = fst ` set (PROG P)\"\n    by (fastforce elim: map_of_fstE simp: class_def intro: map_of_SomeI)\n  hence \"finite {C. \\<exists>D fs ms. class (PROG P) C = \\<lfloor>(D, fs, ms)\\<rfloor>}\"\n    by auto\n  moreover have \"{ms. \\<exists>C D fs. class (PROG P) C = \\<lfloor>(D, fs, ms)\\<rfloor>}\n    = snd ` snd ` the ` (\\<lambda>C. class (PROG P) C) ` {C. \\<exists>D fs ms. class (PROG P) C = \\<lfloor>(D, fs, ms)\\<rfloor>}\"\n    by (fastforce intro: rev_image_eqI map_of_SomeI simp: class_def)\n  ultimately have \"finite {ms. \\<exists>C D fs. class (PROG P) C = \\<lfloor>(D, fs, ms)\\<rfloor>}\"\n    by auto\n  moreover have \"\\<not> finite (UNIV :: mname set)\"\n    by (rule infinite_UNIV_listI)\n  ultimately\n  have \"\\<exists>Name. Name \\<notin> fst ` (\\<Union>ms \\<in> {ms. \\<exists>C D fs. class (PROG P) C = \\<lfloor>(D, fs, ms)\\<rfloor>}. set ms)\"\n    by -(rule ex_new_if_finite, auto)\n  thus ?thesis\n    by fastforce\nqed\n\nlemma MethodMain_unique_in_P:\n  assumes \"PROG P \\<turnstile> D sees M:Ts\\<rightarrow>T = mb in C\"\n  shows \"MethodMain P \\<noteq> M\"\nproof -\n  from ex_unique_method_name [of P] obtain M'\n    where \"\\<And>C D fs ms. class (PROG P) C = \\<lfloor>(D, fs, ms)\\<rfloor> \\<Longrightarrow> (\\<forall>m \\<in> set ms. M' \\<noteq> fst m)\"\n    by blast\n  with `PROG P \\<turnstile> D sees M:Ts\\<rightarrow>T = mb in C`\n  show ?thesis\n    unfolding MethodMain_def\n    by -(rule someI2_ex, fastforce, fastforce dest!: visible_method_exists elim: map_of_fstE)\nqed\n\nlemma ClassMain_is_no_class [dest!]: \"is_class (PROG P) (ClassMain P) \\<Longrightarrow> False\"\nproof (erule rev_notE)\n  from ex_new_class_name [of \"PROG P\"] obtain C where \"\\<not> is_class (PROG P) C\"\n    by blast\n  thus \"\\<not> is_class (PROG P) (ClassMain P)\" unfolding ClassMain_def\n    by (rule someI)\nqed\n\nlemma MethodMain_not_seen [dest!]: \"PROG P \\<turnstile> C sees (MethodMain P):Ts\\<rightarrow>T = mb in D \\<Longrightarrow> False\"\n  by (fastforce dest: MethodMain_unique_in_P)\n\nlemma no_Call_from_ClassMain [dest!]: \"PROG P \\<turnstile> ClassMain P sees M:Ts\\<rightarrow>T = mb in C \\<Longrightarrow> False\"\n  by (fastforce dest: sees_method_is_class)\n\nlemma no_Call_in_ClassMain [dest!]: \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = mb in ClassMain P \\<Longrightarrow> False\"\n  by (fastforce dest: sees_method_idemp)\n\ninductive JVMCFG :: \"jvm_method \\<Rightarrow> cfg_node \\<Rightarrow> (var, val, cname \\<times> mname \\<times> pc, cname \\<times> mname) edge_kind \\<Rightarrow> cfg_node \\<Rightarrow> bool\" (\" _ \\<turnstile> _ -_\\<rightarrow> _\")\n  and reachable :: \"jvm_method \\<Rightarrow> cfg_node \\<Rightarrow> bool\" (\" _ \\<turnstile> \\<Rightarrow>_\")\n  where\n    Entry_reachable: \"(P, C0, Main) \\<turnstile> \\<Rightarrow>(ClassMain P, MethodMain P, None, Enter)\"\n  | reachable_step: \"\\<lbrakk> P \\<turnstile> \\<Rightarrow>n; P \\<turnstile> n -(e)\\<rightarrow> n' \\<rbrakk> \\<Longrightarrow> P \\<turnstile> \\<Rightarrow>n'\"\n  | Main_to_Call: \"(P, C0, Main) \\<turnstile> \\<Rightarrow>(ClassMain P, MethodMain P, \\<lfloor>0\\<rfloor>, Enter)\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (ClassMain P, MethodMain P, \\<lfloor>0\\<rfloor>, Enter) -\\<Up>id\\<rightarrow> (ClassMain P, MethodMain P, \\<lfloor>0\\<rfloor>, Normal)\"\n  | Main_Call_LFalse: \"(P, C0, Main) \\<turnstile> \\<Rightarrow>(ClassMain P, MethodMain P, \\<lfloor>0\\<rfloor>, Normal)\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (ClassMain P, MethodMain P, \\<lfloor>0\\<rfloor>, Normal) -(\\<lambda>s. False)\\<^sub>\\<surd>\\<rightarrow> (ClassMain P, MethodMain P, \\<lfloor>0\\<rfloor>, Return)\"\n  | Main_Call: \"\\<lbrakk> (P, C0, Main) \\<turnstile> \\<Rightarrow>(ClassMain P, MethodMain P, \\<lfloor>0\\<rfloor>, Normal);\n     PROG P \\<turnstile> C0 sees Main:[]\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in D;\n     initParams = [(\\<lambda>s. s Heap),(\\<lambda>s. \\<lfloor>Value Null\\<rfloor>)];\n     ek = (\\<lambda>(s, ret). True):(ClassMain P, MethodMain P, 0)\\<hookrightarrow>\\<^bsub>(D, Main)\\<^esub>initParams \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (ClassMain P, MethodMain P, \\<lfloor>0\\<rfloor>, Normal) -(ek)\\<rightarrow> (D, Main, None, Enter)\"\n  | Main_Return_to_Exit: \"(P, C0, Main) \\<turnstile> \\<Rightarrow>(ClassMain P, MethodMain P, \\<lfloor>0\\<rfloor>, Return)\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (ClassMain P, MethodMain P, \\<lfloor>0\\<rfloor>, Return) -(\\<Up>id)\\<rightarrow> (ClassMain P, MethodMain P, None, Return)\"\n  | Method_LFalse: \"(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, None, Enter)\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, None, Enter) -(\\<lambda>s. False)\\<^sub>\\<surd>\\<rightarrow> (C, M, None, Return)\"\n  | Method_LTrue: \"(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, None, Enter)\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, None, Enter) -(\\<lambda>s. True)\\<^sub>\\<surd>\\<rightarrow> (C, M, \\<lfloor>0\\<rfloor>, Enter)\"\n  | CFG_Load: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter); instrs_of (PROG P) C M ! pc = Load n;\n    ek = \\<Up>(\\<lambda>s. s(Stack (stkLength (P, C, M) pc) := s (Local n))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_Store: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter); instrs_of (PROG P) C M ! pc = Store n;\n    ek = \\<Up>(\\<lambda>s. s(Local n := s (Stack (stkLength (P, C, M) pc - 1)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_Push: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter); instrs_of (PROG P) C M ! pc = Push v;\n    ek = \\<Up>(\\<lambda>s. s(Stack (stkLength (P, C, M) pc) \\<mapsto> Value v)) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_Pop: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter); instrs_of (PROG P) C M ! pc = Pop;\n    ek = \\<Up>id \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_IAdd: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter); instrs_of (PROG P) C M ! pc = IAdd;\n    ek = \\<Up>(\\<lambda>s. let i1 = the_Intg (stkAt s (stkLength (P, C, M) pc - 1));\n                   i2 = the_Intg (stkAt s (stkLength (P, C, M) pc - 2))\n                in s(Stack (stkLength (P, C, M) pc - 2) \\<mapsto> Value (Intg (i1 + i2)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_Goto: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter); instrs_of (PROG P) C M ! pc = Goto i \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -((\\<lambda>s. True)\\<^sub>\\<surd>)\\<rightarrow> (C, M, \\<lfloor>nat (int pc + i)\\<rfloor>, Enter)\"\n  | CFG_CmpEq: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter); instrs_of (PROG P) C M ! pc = CmpEq;\n    ek = \\<Up>(\\<lambda>s. let e1 = stkAt s (stkLength (P, C, M) pc - 1);\n                   e2 = stkAt s (stkLength (P, C, M) pc - 2)\n                in s(Stack (stkLength (P, C, M) pc - 2) \\<mapsto> Value (Bool (e1 = e2)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_IfFalse_False: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = IfFalse i;\n    i \\<noteq> 1;\n    ek = (\\<lambda>s. stkAt s (stkLength(P, C, M) pc - 1) = Bool False)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>nat (int pc + i)\\<rfloor>, Enter)\"\n  | CFG_IfFalse_True: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = IfFalse i;\n    ek = (\\<lambda>s. stkAt s (stkLength(P, C, M) pc - 1) \\<noteq> Bool False \\<or> i = 1)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_New_Check_Normal: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = New Cl;\n    ek = (\\<lambda>s. new_Addr (heap_of s) \\<noteq> None)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Normal)\"\n  | CFG_New_Check_Exceptional: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = New Cl;\n    pc' = (case (match_ex_table (PROG P) OutOfMemory pc (ex_table_of (PROG P) C M)) of\n             None \\<Rightarrow> None\n           | Some (pc'', d) \\<Rightarrow> \\<lfloor>pc''\\<rfloor>);\n    ek = (\\<lambda>s. new_Addr (heap_of s) = None)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional pc' Enter)\"\n  | CFG_New_Update: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Normal);\n    instrs_of (PROG P) C M ! pc = New Cl;\n    ek = \\<Up>(\\<lambda>s. let a = the (new_Addr (heap_of s))\n                in s(Heap \\<mapsto> Hp ((heap_of s)(a \\<mapsto> blank (PROG P) Cl)))\n                    (Stack (stkLength(P, C, M) pc) \\<mapsto> Value (Addr a))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Normal) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_New_Exceptional_prop: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter);\n    instrs_of (PROG P) C M ! pc = New Cl;\n    ek = \\<Up>(\\<lambda>s. s(Exception \\<mapsto> Value (Addr (addr_of_sys_xcpt OutOfMemory)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter) -(ek)\\<rightarrow> (C, M, None, Return)\"\n  | CFG_New_Exceptional_handle: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter);\n    instrs_of (PROG P) C M ! pc = New Cl;\n    ek = \\<Up>(\\<lambda>s. s(Exception := None)\n                (Stack (stkLength (P, C, M) pc' - 1) \\<mapsto> Value (Addr (addr_of_sys_xcpt OutOfMemory)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc'\\<rfloor>, Enter)\"\n  | CFG_Getfield_Check_Normal: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = Getfield F Cl;\n    ek = (\\<lambda>s. stkAt s (stkLength (P, C, M) pc - 1) \\<noteq> Null)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Normal)\"\n  | CFG_Getfield_Check_Exceptional: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = Getfield F Cl;\n    pc' = (case (match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M)) of\n             None \\<Rightarrow> None\n           | Some (pc'', d) \\<Rightarrow> \\<lfloor>pc''\\<rfloor>);\n    ek = (\\<lambda>s. stkAt s (stkLength (P, C, M) pc - 1) = Null)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional pc' Enter)\"\n  | CFG_Getfield_Update: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Normal);\n    instrs_of (PROG P) C M ! pc = Getfield F Cl;\n    ek = \\<Up>(\\<lambda>s. let (D, fs) = the (heap_of s (the_Addr (stkAt s (stkLength (P, C, M) pc - 1))))\n                 in s(Stack (stkLength(P, C, M) pc - 1) \\<mapsto> Value (the (fs (F, Cl))))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Normal) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_Getfield_Exceptional_prop: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter);\n    instrs_of (PROG P) C M ! pc = Getfield F Cl;\n    ek = \\<Up>(\\<lambda>s. s(Exception \\<mapsto> Value (Addr (addr_of_sys_xcpt NullPointer)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter) -(ek)\\<rightarrow> (C, M, None, Return)\"\n  | CFG_Getfield_Exceptional_handle: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter);\n    instrs_of (PROG P) C M ! pc = Getfield F Cl;\n    ek = \\<Up>(\\<lambda>s. s(Exception := None)\n                (Stack (stkLength (P, C, M) pc' - 1) \\<mapsto> Value (Addr (addr_of_sys_xcpt NullPointer)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc'\\<rfloor>, Enter)\"\n  | CFG_Putfield_Check_Normal: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = Putfield F Cl;\n    ek = (\\<lambda>s. stkAt s (stkLength (P, C, M) pc - 2) \\<noteq> Null)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Normal)\"\n  | CFG_Putfield_Check_Exceptional: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = Putfield F Cl;\n    pc' = (case (match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M)) of\n             None \\<Rightarrow> None\n           | Some (pc'', d) \\<Rightarrow> \\<lfloor>pc''\\<rfloor>);\n    ek = (\\<lambda>s. stkAt s (stkLength (P, C, M) pc - 2) = Null)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional pc' Enter)\"\n  | CFG_Putfield_Update: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Normal);\n    instrs_of (PROG P) C M ! pc = Putfield F Cl;\n    ek = \\<Up>(\\<lambda>s. let v = stkAt s (stkLength (P, C, M) pc - 1);\n                   r = stkAt s (stkLength (P, C, M) pc - 2);\n                   a = the_Addr r;\n                   (D, fs) = the (heap_of s a);\n                   h' = (heap_of s)(a \\<mapsto> (D, fs((F, Cl) \\<mapsto> v)))\n                 in s(Heap \\<mapsto> Hp h')) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Normal) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_Putfield_Exceptional_prop: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter);\n    instrs_of (PROG P) C M ! pc = Putfield F Cl;\n    ek = \\<Up>(\\<lambda>s. s(Exception \\<mapsto> Value (Addr (addr_of_sys_xcpt NullPointer)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter) -(ek)\\<rightarrow> (C, M, None, Return)\"\n  | CFG_Putfield_Exceptional_handle: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter);\n    instrs_of (PROG P) C M ! pc = Putfield F Cl;\n    ek = \\<Up>(\\<lambda>s. s(Exception := None)\n                (Stack (stkLength (P, C, M) pc' - 1) \\<mapsto> Value (Addr (addr_of_sys_xcpt NullPointer)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc'\\<rfloor>, Enter)\"\n  | CFG_Checkcast_Check_Normal: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = Checkcast Cl;\n    ek = (\\<lambda>s. cast_ok (PROG P) Cl (heap_of s) (stkAt s (stkLength (P, C, M) pc - 1)))\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_Checkcast_Check_Exceptional: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = Checkcast Cl;\n    pc' = (case (match_ex_table (PROG P) ClassCast pc (ex_table_of (PROG P) C M)) of\n             None \\<Rightarrow> None\n           | Some (pc'', d) \\<Rightarrow> \\<lfloor>pc''\\<rfloor>);\n    ek = (\\<lambda>s. \\<not> cast_ok (PROG P) Cl (heap_of s) (stkAt s (stkLength (P, C, M) pc - 1)))\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional pc' Enter)\"\n  | CFG_Checkcast_Exceptional_prop: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter);\n    instrs_of (PROG P) C M ! pc = Checkcast Cl;\n    ek = \\<Up>(\\<lambda>s. s(Exception \\<mapsto> Value (Addr (addr_of_sys_xcpt ClassCast)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter) -(ek)\\<rightarrow> (C, M, None, Return)\"\n  | CFG_Checkcast_Exceptional_handle: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter);\n    instrs_of (PROG P) C M ! pc = Checkcast Cl;\n    ek = \\<Up>(\\<lambda>s. s(Exception := None)\n                (Stack (stkLength (P, C, M) pc' - 1) \\<mapsto> Value (Addr (addr_of_sys_xcpt ClassCast)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc'\\<rfloor>, Enter)\"\n  | CFG_Throw_Check: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = Throw;\n    pc' = None \\<or> match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\<lfloor>(the pc', d)\\<rfloor>;\n    ek = (\\<lambda>s. let v = stkAt s (stkLength (P, C, M) pc - 1);\n                  Cl = if (v = Null) then NullPointer else (cname_of (heap_of s) (the_Addr v))\n               in case pc' of\n                  None \\<Rightarrow> match_ex_table (PROG P) Cl pc (ex_table_of (PROG P) C M) = None\n                | Some pc'' \\<Rightarrow> \\<exists>d. match_ex_table (PROG P) Cl pc (ex_table_of (PROG P) C M)\n                                  = \\<lfloor>(pc'', d)\\<rfloor>\n    )\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional pc' Enter)\"\n\n  | CFG_Throw_prop: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter);\n    instrs_of (PROG P) C M ! pc = Throw;\n    ek = \\<Up>(\\<lambda>s. s(Exception \\<mapsto> Value (stkAt s (stkLength (P, C, M) pc - 1)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter) -(ek)\\<rightarrow> (C, M, None, Return)\"\n  | CFG_Throw_handle: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter);\n    pc' \\<noteq> length (instrs_of (PROG P) C M);\n    instrs_of (PROG P) C M ! pc = Throw;\n    ek = \\<Up>(\\<lambda>s. s(Exception := None)\n                (Stack (stkLength (P, C, M) pc' - 1) \\<mapsto> Value (stkAt s (stkLength (P, C, M) pc - 1)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc'\\<rfloor>, Enter)\"\n  | CFG_Invoke_Check_NP_Normal: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = Invoke M' n;\n    ek = (\\<lambda>s. stkAt s (stkLength (P, C, M) pc - Suc n) \\<noteq> Null)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Normal)\"\n  | CFG_Invoke_Check_NP_Exceptional: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = Invoke M' n;\n    pc' = (case (match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M)) of\n             None \\<Rightarrow> None\n           | Some (pc'', d) \\<Rightarrow> \\<lfloor>pc''\\<rfloor>);\n    ek = (\\<lambda>s. stkAt s (stkLength (P, C, M) pc - Suc n) = Null)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional pc' Enter)\"\n  | CFG_Invoke_NP_prop: \"\\<lbrakk> C \\<noteq> ClassMain P;\n    (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter);\n    instrs_of (PROG P) C M ! pc = Invoke M' n;\n    ek = \\<Up>(\\<lambda>s. s(Exception \\<mapsto> Value (Addr (addr_of_sys_xcpt NullPointer)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional None Enter) -(ek)\\<rightarrow> (C, M, None, Return)\"\n  | CFG_Invoke_NP_handle: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter);\n    instrs_of (PROG P) C M ! pc = Invoke M' n;\n    ek = \\<Up>(\\<lambda>s. s(Exception := None)\n                (Stack (stkLength (P, C, M) pc' - 1) \\<mapsto> Value (Addr (addr_of_sys_xcpt NullPointer)))) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc'\\<rfloor>, Enter)\"\n  | CFG_Invoke_Call: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Normal);\n    instrs_of (PROG P) C M ! pc = Invoke M' n;\n    TYPING P C M ! pc = \\<lfloor>(ST, LT)\\<rfloor>;\n    ST ! n = Class D';\n    PROG P \\<turnstile> D' sees M':Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in D;\n    Q = (\\<lambda>(s, ret). let r = stkAt s (stkLength (P, C, M) pc - Suc n);\n                        C' = fst (the (heap_of s (the_Addr r)))\n                     in D = fst (method (PROG P) C' M'));\n    paramDefs = (\\<lambda>s. s Heap)\n                # (\\<lambda>s. s (Stack (stkLength (P, C, M) pc - Suc n)))\n                # (rev (map (\\<lambda>i. (\\<lambda>s. s (Stack (stkLength (P, C, M) pc - Suc i)))) [0..<n]));\n    ek = Q:(C, M, pc)\\<hookrightarrow>\\<^bsub>(D,M')\\<^esub>paramDefs\n  \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Normal) -(ek)\\<rightarrow> (D, M', None, Enter)\"\n  | CFG_Invoke_False: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Normal);\n    instrs_of (PROG P) C M ! pc = Invoke M' n;\n    ek = (\\<lambda>s. False)\\<^sub>\\<surd>\n  \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Normal) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Return)\"\n  | CFG_Invoke_Return_Check_Normal: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Return);\n    instrs_of (PROG P) C M ! pc = Invoke M' n;\n    (TYPING P) C M ! pc = \\<lfloor>(ST, LT)\\<rfloor>;\n    ST ! n \\<noteq> NT;\n    ek = (\\<lambda>s. s Exception = None)\\<^sub>\\<surd>\n  \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Return) -(ek)\\<rightarrow> (C, M, \\<lfloor>Suc pc\\<rfloor>, Enter)\"\n  | CFG_Invoke_Return_Check_Exceptional: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Return);\n    instrs_of (PROG P) C M ! pc = Invoke M' n;\n    match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\<lfloor>(pc', diff)\\<rfloor>;\n    pc' \\<noteq> length (instrs_of (PROG P) C M);\n    ek = (\\<lambda>s. \\<exists>v d. s Exception = \\<lfloor>v\\<rfloor> \\<and>\n                  match_ex_table (PROG P) (cname_of (heap_of s) (the_Addr (the_Value v))) pc (ex_table_of (PROG P) C M) = \\<lfloor>(pc', d)\\<rfloor>)\\<^sub>\\<surd>\n  \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Return) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Return)\"\n  | CFG_Invoke_Return_Exceptional_handle: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Return);\n    instrs_of (PROG P) C M ! pc = Invoke M' n;\n    ek = \\<Up>(\\<lambda>s. s(Exception := None,\n                 Stack (stkLength (P, C, M) pc' - 1) := s Exception)) \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Return) -(ek)\\<rightarrow> (C, M, \\<lfloor>pc'\\<rfloor>, Enter)\"\n  | CFG_Invoke_Return_Exceptional_prop: \"\\<lbrakk> C \\<noteq> ClassMain P;\n    (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Return);\n    instrs_of (PROG P) C M ! pc = Invoke M' n;\n    ek = (\\<lambda>s. \\<exists>v. s Exception = \\<lfloor>v\\<rfloor> \\<and>\n              match_ex_table (PROG P) (cname_of (heap_of s) (the_Addr (the_Value v))) pc (ex_table_of (PROG P) C M) = None)\\<^sub>\\<surd> \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Return) -(ek)\\<rightarrow> (C, M, None, Return)\"\n  | CFG_Return: \"\\<lbrakk> C \\<noteq> ClassMain P; (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter);\n    instrs_of (PROG P) C M ! pc = instr.Return;\n    ek = \\<Up>(\\<lambda>s. s(Stack 0 := s (Stack (stkLength (P, C, M) pc - 1))))\n  \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, \\<lfloor>pc\\<rfloor>, Enter) -(ek)\\<rightarrow> (C, M, None, Return)\"\n  | CFG_Return_from_Method: \"\\<lbrakk> (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, None, Return);\n    (P, C0, Main) \\<turnstile> (C', M', \\<lfloor>pc'\\<rfloor>, Normal) -(Q':(C', M', pc')\\<hookrightarrow>\\<^bsub>(C,M)\\<^esub>ps)\\<rightarrow> (C, M, None, Enter);\n    Q = (\\<lambda>(s, ret). ret = (C', M', pc'));\n    stateUpdate = (\\<lambda>s s'. s'(Heap := s Heap,\n                            Exception := s Exception,\n                            Stack (stkLength (P, C', M') (Suc pc') - 1) := s (Stack 0))\n                  );\n    ek = Q\\<hookleftarrow>\\<^bsub>(C, M)\\<^esub>stateUpdate\n  \\<rbrakk>\n  \\<Longrightarrow> (P, C0, Main) \\<turnstile> (C, M, None, Return) -(ek)\\<rightarrow> (C', M', \\<lfloor>pc'\\<rfloor>, Return)\"\n\n\n(* This takes veeeery long *)\nlemma JVMCFG_edge_det: \"\\<lbrakk> P \\<turnstile> n -(et)\\<rightarrow> n'; P \\<turnstile> n -(et')\\<rightarrow> n' \\<rbrakk> \\<Longrightarrow> et = et'\"\n  by (erule JVMCFG.cases) (erule JVMCFG.cases, (fastforce dest: sees_method_fun)+)+\n\nlemma sourcenode_reachable: \"P \\<turnstile> n -(ek)\\<rightarrow> n' \\<Longrightarrow> P \\<turnstile> \\<Rightarrow>n\"\n  by (erule JVMCFG.cases, auto)\n\nlemma targetnode_reachable:\n  assumes edge: \"P \\<turnstile> n -(ek)\\<rightarrow> n'\"\n  shows \"P \\<turnstile> \\<Rightarrow>n'\"\nproof -\n  from edge have \"P \\<turnstile> \\<Rightarrow>n\"\n    by -(drule sourcenode_reachable)\n  with edge show ?thesis\n    by -(rule JVMCFG_reachable.intros)\nqed\n\nlemmas JVMCFG_reachable_inducts = JVMCFG_reachable.inducts[split_format (complete)]\n\nlemma ClassMain_imp_MethodMain:\n  \"(P, C0, Main) \\<turnstile> (C', M', pc', nt') -ek\\<rightarrow> (ClassMain P, M, pc, nt) \\<Longrightarrow> M = MethodMain P\"\n  \"(P, C0, Main) \\<turnstile> \\<Rightarrow>(ClassMain P, M, pc, nt) \\<Longrightarrow> M = MethodMain P\"\nproof (induct P==\"P\" C0\\<equiv>\"C0\" Main\\<equiv>Main C' M' pc' nt' ek C''==\"ClassMain P\" M pc nt and\n              P==\"P\" C0\\<equiv>\"C0\" Main\\<equiv>Main C'==\"ClassMain P\" M pc nt\n       rule: JVMCFG_reachable_inducts)\n  case CFG_Return_from_Method\n  thus ?case\n    by (fastforce elim: JVMCFG.cases)\nqed auto\n\nlemma ClassMain_no_Call_target [dest!]:\n  \"(P, C0, Main) \\<turnstile> (C, M, pc, nt) -Q:(C', M', pc')\\<hookrightarrow>\\<^bsub>(D,M'')\\<^esub>paramDefs\\<rightarrow> (ClassMain P, M''', pc'', nt')\n  \\<Longrightarrow> False\"\n  and\n  \"(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, pc, nt) \\<Longrightarrow> True\"\n  by (induct  P C0 Main C M pc nt ek==\"Q:(C', M', pc')\\<hookrightarrow>\\<^bsub>(D,M'')\\<^esub>paramDefs\"\n                         C''==\"ClassMain P\" M''' pc'' nt' and\n               P C0 Main C M pc nt\n    rule: JVMCFG_reachable_inducts) auto\n\nlemma method_of_src_and_trg_exists:\n  \"\\<lbrakk> (P, C0, Main) \\<turnstile> (C', M', pc', nt') -ek\\<rightarrow> (C, M, pc, nt); C \\<noteq> ClassMain P; C' \\<noteq> ClassMain P \\<rbrakk>\n  \\<Longrightarrow> (\\<exists>Ts T mb. (PROG P) \\<turnstile> C sees M:Ts\\<rightarrow>T = mb in C) \\<and>\n     (\\<exists>Ts T mb. (PROG P) \\<turnstile> C' sees M':Ts\\<rightarrow>T = mb in C')\"\n  and method_of_reachable_node_exists:\n  \"\\<lbrakk> (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, pc, nt); C \\<noteq> ClassMain P \\<rbrakk>\n  \\<Longrightarrow> \\<exists>Ts T mb. (PROG P) \\<turnstile> C sees M:Ts\\<rightarrow>T = mb in C\"\nproof (induct rule: JVMCFG_reachable_inducts)\n  case CFG_Invoke_Call\n  thus ?case\n    by (blast dest: sees_method_idemp)\nnext\n  case (reachable_step P C0 Main C M pc nt ek C' M' pc' nt')\n  show ?case\n  proof (cases \"C = ClassMain P\")\n    case True\n    with `(P, C0, Main) \\<turnstile> (C, M, pc, nt) -ek\\<rightarrow> (C', M', pc', nt')` `C' \\<noteq> ClassMain P`\n    show ?thesis\n    proof cases\n      case Main_Call\n      thus ?thesis\n        by (blast dest: sees_method_idemp)\n    qed auto\n  next\n    case False\n    with reachable_step show ?thesis\n      by simp\n  qed\nqed simp_all\n\nlemma \"\\<lbrakk> (P, C0, Main) \\<turnstile> (C', M', pc', nt') -ek\\<rightarrow> (C, M, pc, nt); C \\<noteq> ClassMain P; C' \\<noteq> ClassMain P \\<rbrakk>\n  \\<Longrightarrow> (case pc of None \\<Rightarrow> True |\n    \\<lfloor>pc''\\<rfloor> \\<Rightarrow> (TYPING P) C M ! pc'' \\<noteq> None \\<and> pc'' < length (instrs_of (PROG P) C M)) \\<and>\n  (case pc' of None \\<Rightarrow> True |\n    \\<lfloor>pc''\\<rfloor> \\<Rightarrow> (TYPING P) C' M' ! pc'' \\<noteq> None \\<and> pc'' < length (instrs_of (PROG P) C' M'))\"\n  and instr_of_reachable_node_typable: \"\\<lbrakk> (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, pc, nt); C \\<noteq> ClassMain P \\<rbrakk>\n  \\<Longrightarrow> case pc of None \\<Rightarrow> True |\n  \\<lfloor>pc''\\<rfloor> \\<Rightarrow> (TYPING P) C M ! pc'' \\<noteq> None \\<and> pc'' < length (instrs_of (PROG P) C M)\"\nproof (induct rule: JVMCFG_reachable_inducts)\n  case (CFG_Load C P C0 Main M pc n ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_Load show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_Store C P C0 Main M pc n ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_Store show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_Push C P C0 Main M pc v ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_Push show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_Pop C P C0 Main M pc ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_Pop show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_IAdd C P C0 Main M pc ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_IAdd show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_Goto C P C0 Main M pc i)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_Goto show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_CmpEq C P C0 Main M pc ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_CmpEq show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_IfFalse_False C P C0 Main M pc i ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_IfFalse_False show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_IfFalse_True C P C0 Main M pc i ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_IfFalse_True show ?case\n    using [[simproc del: list_to_set_comprehension]] by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_New_Update C P C0 Main M pc Cl ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Normal)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_New_Update show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_New_Exceptional_handle C P C0 Main M pc pc' Cl ek)\n  hence \"TYPING P C M ! pc \\<noteq> None\" and \"pc < length (instrs_of (PROG P) C M)\"\n    by simp_all\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 where\n    \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n    by (fastforce dest: method_of_reachable_node_exists)\n  with `pc < length (instrs_of (PROG P) C M)` `instrs_of (PROG P) C M ! pc = New Cl`\n  have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n    \\<turnstile> New Cl,pc :: TYPING P C M\"\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n    `instrs_of (PROG P) C M ! pc = New Cl` obtain d'\n    where \"match_ex_table (PROG P) OutOfMemory pc (ex_table_of (PROG P) C M) = \\<lfloor>(pc', d')\\<rfloor>\"\n    by cases (fastforce elim: JVMCFG.cases)\n  hence \"\\<exists>(f, t, D, h, d)\\<in>set (ex_table_of (PROG P) C M).\n    matches_ex_entry (PROG P) OutOfMemory pc (f, t, D, h, d) \\<and> h = pc' \\<and> d = d'\"\n    by -(drule match_ex_table_SomeD)\n  ultimately show ?case using `instrs_of (PROG P) C M ! pc = New Cl`\n    by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n  case (CFG_Getfield_Update C P C0 Main M pc F Cl ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Normal)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_Getfield_Update show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_Getfield_Exceptional_handle C P C0 Main M pc pc' F Cl ek)\n  hence \"TYPING P C M ! pc \\<noteq> None\" and \"pc < length (instrs_of (PROG P) C M)\"\n    by simp_all\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 where\n    \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n    by (fastforce dest: method_of_reachable_node_exists)\n  with `pc < length (instrs_of (PROG P) C M)` `instrs_of (PROG P) C M ! pc = Getfield F Cl`\n  have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n    \\<turnstile> Getfield F Cl,pc :: TYPING P C M\"\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n    `instrs_of (PROG P) C M ! pc = Getfield F Cl` obtain d'\n    where \"match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M) = \\<lfloor>(pc', d')\\<rfloor>\"\n    by cases (fastforce elim: JVMCFG.cases)\n  hence \"\\<exists>(f, t, D, h, d)\\<in>set (ex_table_of (PROG P) C M).\n    matches_ex_entry (PROG P) NullPointer pc (f, t, D, h, d) \\<and> h = pc' \\<and> d = d'\"\n    by -(drule match_ex_table_SomeD)\n  ultimately show ?case using `instrs_of (PROG P) C M ! pc = Getfield F Cl`\n    by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n  case (CFG_Putfield_Update C P C0 Main M pc F Cl ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Normal)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_Putfield_Update show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_Putfield_Exceptional_handle C P C0 Main M pc pc' F Cl ek)\n  hence \"TYPING P C M ! pc \\<noteq> None\" and \"pc < length (instrs_of (PROG P) C M)\"\n    by simp_all\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 where\n    \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n    by (fastforce dest: method_of_reachable_node_exists)\n  with `pc < length (instrs_of (PROG P) C M)` `instrs_of (PROG P) C M ! pc = Putfield F Cl`\n  have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n    \\<turnstile> Putfield F Cl,pc :: TYPING P C M\"\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n    `instrs_of (PROG P) C M ! pc = Putfield F Cl` obtain d'\n    where \"match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M) = \\<lfloor>(pc', d')\\<rfloor>\"\n    by cases (fastforce elim: JVMCFG.cases)\n  hence \"\\<exists>(f, t, D, h, d)\\<in>set (ex_table_of (PROG P) C M).\n    matches_ex_entry (PROG P) NullPointer pc (f, t, D, h, d) \\<and> h = pc' \\<and> d = d'\"\n    by -(drule match_ex_table_SomeD)\n  ultimately show ?case using `instrs_of (PROG P) C M ! pc = Putfield F Cl`\n    by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n  case (CFG_Checkcast_Check_Normal C P C0 Main M pc Cl ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_Checkcast_Check_Normal show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext\n  case (CFG_Checkcast_Exceptional_handle C P C0 Main M pc pc' Cl ek)\n  hence \"TYPING P C M ! pc \\<noteq> None\" and \"pc < length (instrs_of (PROG P) C M)\"\n    by simp_all\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 where\n    \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n    by (fastforce dest: method_of_reachable_node_exists)\n  with `pc < length (instrs_of (PROG P) C M)` `instrs_of (PROG P) C M ! pc = Checkcast Cl`\n  have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n    \\<turnstile> Checkcast Cl,pc :: TYPING P C M\"\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n    `instrs_of (PROG P) C M ! pc = Checkcast Cl` obtain d'\n    where \"match_ex_table (PROG P) ClassCast pc (ex_table_of (PROG P) C M) = \\<lfloor>(pc', d')\\<rfloor>\"\n    by cases (fastforce elim: JVMCFG.cases)\n  hence \"\\<exists>(f, t, D, h, d)\\<in>set (ex_table_of (PROG P) C M).\n    matches_ex_entry (PROG P) ClassCast pc (f, t, D, h, d) \\<and> h = pc' \\<and> d = d'\"\n    by -(drule match_ex_table_SomeD)\n  ultimately show ?case using `instrs_of (PROG P) C M ! pc = Checkcast Cl`\n    by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n  case (CFG_Throw_handle C P C0 Main M pc pc' ek)\n  hence \"TYPING P C M ! pc \\<noteq> None\" and \"pc < length (instrs_of (PROG P) C M)\"\n    by simp_all\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 where\n    \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n    by (fastforce dest: method_of_reachable_node_exists)\n  with `pc < length (instrs_of (PROG P) C M)` `instrs_of (PROG P) C M ! pc = Throw`\n  have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n    \\<turnstile> Throw,pc :: TYPING P C M\"\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n    `instrs_of (PROG P) C M ! pc = Throw` obtain d' Exc\n    where \"match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\<lfloor>(pc', d')\\<rfloor>\"\n    by cases (fastforce elim: JVMCFG.cases)\n  hence \"\\<exists>(f, t, D, h, d)\\<in>set (ex_table_of (PROG P) C M).\n    matches_ex_entry (PROG P) Exc pc (f, t, D, h, d) \\<and> h = pc' \\<and> d = d'\"\n    by -(drule match_ex_table_SomeD)\n  ultimately show ?case using `instrs_of (PROG P) C M ! pc = Throw`\n    by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n  case (CFG_Invoke_NP_handle C P C0 Main M pc pc' M' n ek)\n  hence \"TYPING P C M ! pc \\<noteq> None\" and \"pc < length (instrs_of (PROG P) C M)\"\n    by simp_all\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 where\n    \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n    by (fastforce dest: method_of_reachable_node_exists)\n  with `pc < length (instrs_of (PROG P) C M)` `instrs_of (PROG P) C M ! pc = Invoke M' n`\n  have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n    \\<turnstile> Invoke M' n,pc :: TYPING P C M\"\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Enter)` `C \\<noteq> ClassMain P`\n    `instrs_of (PROG P) C M ! pc = Invoke M' n` obtain d'\n    where \"match_ex_table (PROG P) NullPointer pc (ex_table_of (PROG P) C M) = \\<lfloor>(pc', d')\\<rfloor>\"\n    by cases (fastforce elim: JVMCFG.cases)\n  hence \"\\<exists>(f, t, D, h, d)\\<in>set (ex_table_of (PROG P) C M).\n    matches_ex_entry (PROG P) NullPointer pc (f, t, D, h, d) \\<and> h = pc' \\<and> d = d'\"\n    by -(drule match_ex_table_SomeD)\n  ultimately show ?case using `instrs_of (PROG P) C M ! pc = Invoke M' n`\n    by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n  case (CFG_Invoke_Return_Exceptional_handle C P C0 Main M pc pc' M' n ek)\n  hence \"TYPING P C M ! pc \\<noteq> None\" and \"pc < length (instrs_of (PROG P) C M)\"\n    by simp_all\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Return)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 where\n    \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, instrs_of (PROG P) C M, ex_table_of (PROG P) C M) in C\"\n    by (fastforce dest: method_of_reachable_node_exists)\n  with `pc < length (instrs_of (PROG P) C M)` `instrs_of (PROG P) C M ! pc = Invoke M' n`\n  have \"PROG P,T,mxs,length (instrs_of (PROG P) C M),ex_table_of (PROG P) C M\n    \\<turnstile> Invoke M' n,pc :: TYPING P C M\"\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\n  moreover from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Exceptional \\<lfloor>pc'\\<rfloor> Return)` `C \\<noteq> ClassMain P`\n    `instrs_of (PROG P) C M ! pc = Invoke M' n` obtain d' Exc\n    where \"match_ex_table (PROG P) Exc pc (ex_table_of (PROG P) C M) = \\<lfloor>(pc', d')\\<rfloor>\"\n    by cases (fastforce elim: JVMCFG.cases)\n  hence \"\\<exists>(f, t, D, h, d)\\<in>set (ex_table_of (PROG P) C M).\n    matches_ex_entry (PROG P) Exc pc (f, t, D, h, d) \\<and> h = pc' \\<and> d = d'\"\n    by -(drule match_ex_table_SomeD)\n  ultimately show ?case using `instrs_of (PROG P) C M ! pc = Invoke M' n`\n    by (fastforce simp: relevant_entries_def is_relevant_entry_def matches_ex_entry_def)\nnext\n  case (CFG_Invoke_Return_Check_Normal C P C0 Main M pc M' n ST LT ek)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, Return)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with CFG_Invoke_Return_Check_Normal show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr [OF wf_jvmprog_is_wf_typ])\nnext \n  case (Method_LTrue P C0 Main C M)\n  from `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, None, Enter)` `C \\<noteq> ClassMain P`\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"instrs_of (PROG P) C M = is\"\n    by -(drule method_of_reachable_node_exists, auto)\n  with Method_LTrue show ?case\n    by (fastforce dest!: wt_jvm_prog_impl_wt_start [OF wf_jvmprog_is_wf_typ] simp: wt_start_def)\nnext\n  case (reachable_step P C0 Main C M opc nt ek C' M' opc' nt')\n  thus ?case\n    by (cases \"C = ClassMain P\") (fastforce elim: JVMCFG.cases, simp)\nqed simp_all\n\nlemma reachable_node_impl_wt_instr:\n  assumes \"(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, nt)\"\n  and \"C \\<noteq> ClassMain P\"\n  shows \"\\<exists>T mxs mpc xt. PROG P,T,mxs,mpc,xt \\<turnstile> (instrs_of (PROG P) C M ! pc),pc :: TYPING P C M\"\nproof -\n  from `C \\<noteq> ClassMain P` `(P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, \\<lfloor>pc\\<rfloor>, nt)`\n    method_of_reachable_node_exists [of P C0 Main C M \"\\<lfloor>pc\\<rfloor>\" nt]\n    instr_of_reachable_node_typable [of P C0 Main C M \"\\<lfloor>pc\\<rfloor>\" nt]\n  obtain Ts T mxs mxl\\<^sub>0 \"is\" xt\n    where \"PROG P \\<turnstile> C sees M:Ts\\<rightarrow>T = (mxs, mxl\\<^sub>0, is, xt) in C\"\n    and \"TYPING P C M ! pc \\<noteq> None\"\n    and \"pc < length (instrs_of (PROG P) C M)\"\n    by fastforce+\n  with wf_jvmprog_is_wf_typ [of P]\n  have \"PROG P,T,mxs,length is,xt \\<turnstile> instrs_of (PROG P) C M ! pc,pc :: TYPING P C M\"\n    by (fastforce dest!: wt_jvm_prog_impl_wt_instr)\n  thus ?thesis\n    by blast\nqed\n\nlemma\n  \"\\<lbrakk> (P, C0, Main) \\<turnstile> (C, M, pc, nt) -ek\\<rightarrow> (C', M', pc', nt'); C \\<noteq> ClassMain P \\<or> C' \\<noteq> ClassMain P \\<rbrakk>\n  \\<Longrightarrow> \\<exists>T mb D. PROG P \\<turnstile> C0 sees Main:[]\\<rightarrow>T = mb in D\"\n  and reachable_node_impl_Main_ex:\n  \"\\<lbrakk> (P, C0, Main) \\<turnstile> \\<Rightarrow>(C, M, pc, nt); C \\<noteq> ClassMain P\\<rbrakk>\n  \\<Longrightarrow> \\<exists>T mb D. PROG P \\<turnstile> C0 sees Main:[]\\<rightarrow>T = mb in D\"\n  by (induct rule: JVMCFG_reachable_inducts) fastforce+\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/HRB-Slicing/JinjaVM_Inter/JVMCFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.312049811373217}}
{"text": "theory NP4_Option_State_Values\n  imports\n  NP4_Option_State_Syntax\n  \"~~/src/HOL/Word/Word\"\n  \"~~/src/HOL/Word/Word_Bitwise\"\n(*  These files contain a minimalistic semantics of P4's action constructs. More complex concepts\n    like switch statements are left out. The purpose of this verification effort is to showcase\n    the viability of using Isabelle/HOL to verify P4 applications. These files focus on the\n    action constructs.\n\n    P4 actions are the code fragments that can read and write data being processed. The action\n    constructs are where sequential code resides in P4. To this end the action constructs are the\n    main way by which the control-plane can influence the behaviour of the data-plane.\n\n    To this end these files define a small-step semantics of the P4 actions. Then a typing\n    environment is built upon this, and the statements are extended with a termination-counter.\n    These are used to prove properties like termination, determinism, progression,\n    preservation, and more. The semantics can also be used to analyse reachability properties.\n    Well-defined and well-typed P4 programs will yield a derivation tree, where as ill-defined\n    or ill-typed P4 programs will yield no such tree. *)\nbegin\n\n(* ============================================================================================================== *)\n(*                                              VALUE MAPPINGS                                                    *)\n(* ============================================================================================================== *)\n\n(* Contains the value of a single bit, can be cast between bool *)\ndatatype sbit = ZERO | ONE\n\n(* Mapping to concrete value *)\ndatatype val = SBIT sbit\n  | UINT nat\n  | SINT int\n  | IINT int\n  | VINT nat\n  | BOOL bool\n  | STRING string\n  | ERROR \"identifier list\"\n  | MATCH \"identifier list\"\n\n(* State is a mapping from variable names to values *)\ntype_synonym state = \"vname \\<Rightarrow> val option\"\n\n(* ============================================================================================================== *)\n(*                                              HELPER FUNCTIONS                                                  *)\n(* ============================================================================================================== *)\n\n(* Convert a basetype to a concrete value used for converting the entries of derived types. *)\nfun baseToVal :: \"baseType \\<Rightarrow> val\" where\n    \"baseToVal (BBOOL b)       = (BOOL b)\"\n  | \"baseToVal (BSBIT 0)       = (SBIT ZERO)\"\n  | \"baseToVal (BSBIT (Suc n)) = (SBIT ONE)\"\n  | \"baseToVal (BIINT n)       = (IINT n)\"\n  | \"baseToVal (BUINT n)       = (UINT n)\"\n  | \"baseToVal (BSINT n)       = (SINT n)\"\n  | \"baseToVal (BVINT n)       = (VINT n)\"\n  | \"baseToVal (BERROR e)      = (ERROR e)\"\n  | \"baseToVal (BMATCH m)      = (MATCH m)\"\n  | \"baseToVal (BSTRING s)     = (STRING s)\"\n\n(* ============================================================================================================== *)\n(*                                   CONCRETE VALUE EVALUATION FUNCTIONS                                          *)\n(* ============================================================================================================== *)\n\ninductive eval :: \"expression \\<Rightarrow> state \\<Rightarrow> val \\<Rightarrow> bool\" where\n(* =============== Base types =============== *)\n    RBOOL:    \"eval (BASE (BBOOL b))       s (BOOL b)\"\n  | RBIT0:    \"eval (BASE (BSBIT 0))       s (SBIT ZERO)\"\n  | RBIT1:    \"eval (BASE (BSBIT (Suc n))) s (SBIT ONE)\"\n  | RIINT:    \"eval (BASE (BIINT n))       s (IINT n)\"\n  | RUINT:    \"eval (BASE (BUINT n))       s (UINT n)\"\n  | RSINT:    \"eval (BASE (BSINT n))       s (SINT n)\"\n  | RVINT:    \"eval (BASE (BVINT n))       s (VINT n)\"\n  | RERROR:   \"eval (BASE (BERROR e))      s (ERROR e)\"\n  | RMATCH:   \"eval (BASE (BMATCH m))      s (MATCH m)\"\n  | RSTRING:  \"eval (BASE (BSTRING str))   s (STRING str)\"\n(* =============== Miscellaneous expressions =============== *)\n  | TERNTRUE:  \"eval e1 s (BOOL b) \\<Longrightarrow> b = True \\<Longrightarrow> eval e2 s v \\<Longrightarrow> eval (TernExpr e1 e2 e3) s v\"\n  | TERNFALSE: \"eval e1 s (BOOL b) \\<Longrightarrow> b = False \\<Longrightarrow> eval e3 s v \\<Longrightarrow> eval (TernExpr e1 e2 e3) s v\"\n(* =============== Variable mapping  =============== *)\n  | NAMEDVAR: \"(s varName) = (Some v) \\<Longrightarrow> eval (NamedVar varName) s v\"\n(* =============== Operations that yield a single bit (SBIT)  =============== *)\n          (* Empty for now *)\n(* =============== Operations that yield a boolean (BOOL)  =============== *)\n  | ULNEB: \"eval e1 s (BOOL b) \\<Longrightarrow> eval (UNA_LNE e1) s (BOOL (\\<not>b))\"\n    (* Boolean operations *)\n  | BEQUB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (b1 = b2))\"\n(* Boolean equality check yields derivation error; code cannot be generated for inductive predicate eval *)\n(*  | BNEQB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (b1 \\<noteq> b2))\" *)\n  | BFANB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_FAN e1 e2) s (BOOL (b1 \\<and> b2))\"\n  | BFORB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_FOR e1 e2) s (BOOL (b1 \\<or> b2))\"\n    (* Signed integer opreations *)\n  | BEQUS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n  | BLEQS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_LEQ e1 e2) s (BOOL (n1 \\<le> n2))\"\n  | BGEQS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_GEQ e1 e2) s (BOOL (n1 \\<ge> n2))\"\n  | BLESS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_LES e1 e2) s (BOOL (n1 < n2))\"\n  | BGRES: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_GRE e1 e2) s (BOOL (n1 > n2))\"\n    (* Unsigned integer opreations *)\n  | BEQUU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n  | BLEQU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_LEQ e1 e2) s (BOOL (n1 \\<le> n2))\"\n  | BGEQU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_GEQ e1 e2) s (BOOL (n1 \\<ge> n2))\"\n  | BLESU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_LES e1 e2) s (BOOL (n1 < n2))\"\n  | BGREU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_GRE e1 e2) s (BOOL (n1 > n2))\"\n    (* Infinite precision integer opreations *)\n  | BEQUI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n  | BLEQI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_LEQ e1 e2) s (BOOL (n1 \\<le> n2))\"\n  | BGEQI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_GEQ e1 e2) s (BOOL (n1 \\<ge> n2))\"\n  | BLESI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_LES e1 e2) s (BOOL (n1 < n2))\"\n  | BGREI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_GRE e1 e2) s (BOOL (n1 > n2))\"\n    (* Variable size bitstring opreations *)\n  | BEQUV: \"eval e1 s (VINT n1) \\<Longrightarrow> eval e2 s (VINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQV: \"eval e1 s (VINT n1) \\<Longrightarrow> eval e2 s (VINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n(* =============== Operations that yield an unsigned integer (UINT)  =============== *)\n  | UNEGU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval (UNA_NEG e1) s (UINT n1)\" (* Incorrect but w/e for now *)\n  | UPOSU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval (UNA_POS e1) s (UINT n1)\"\n  | UCOMU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval (UNA_COM e1) s (UINT n1)\" (* (nat (NOT (int n1))))\" Incorrect but w/e *)\n  | BADDU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_ADD e1 e2) s (UINT (n1 + n2))\"\n  | BMINU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_MIN e1 e2) s (UINT (n1 - n2))\"\n  | BANDU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_AND e1 e2) s (UINT (nat ((int n1) AND (int n2))))\"\n  | BXORU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_XOR e1 e2) s (UINT (nat ((int n1) XOR (int n2))))\"\n  | BLORU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_LOR e1 e2) s (UINT (nat ((int n1) OR (int n2))))\"\n(* =============== Operations that yield a signed integer (SINT)  =============== *)\n  | UNEGS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval (UNA_NEG e1) s (SINT (-n1))\"\n  | UPOSS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval (UNA_POS e1) s (SINT n1)\"\n  | BADDS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_ADD e1 e2) s (SINT (n1 + n2))\"\n  | BMINS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_MIN e1 e2) s (SINT (n1 - n2))\"\n(* =============== Operations that yield an infinite-precision integer (IINT)  =============== *)\n  | UNEGI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval (UNA_NEG e1) s (IINT (-n1))\"\n  | UPOSI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval (UNA_POS e1) s (IINT n1)\"\n  | BADDI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_ADD e1 e2) s (IINT (n1 + n2))\"\n  | BMINI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_MIN e1 e2) s (IINT (n1 - n2))\"\n  | BMULI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_MUL e1 e2) s (IINT (n1 * n2))\"\n  | BDIVI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_DIV e1 e2) s (IINT (n1 div n2))\"\n  | BMODI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_MOD e1 e2) s (IINT (n1 mod n2))\"\n(* =============== Operations that yield a variable-width integer (VINT)  =============== *)\n      (* Empty for now *)\n\ninductive_cases [elim!]: \"eval (BASE b) s v\" \"eval (TernExpr e1 e2 e3) s v\" \"eval (NamedVar i) s v\"\n\"eval (UNA_LNE e) s v\" \"eval (UNA_COM e) s v\" \"eval (UNA_NEG e) s v\" \"eval (UNA_POS e) s v\" \"eval (BIN_MUL e1 e2) s v\"\n\"eval (BIN_DIV e1 e2) s v\" \"eval (BIN_MOD e1 e2) s v\" \"eval (BIN_ADD e1 e2) s v\" \"eval (BIN_MIN e1 e2) s v\" \"eval (BIN_AND e1 e2) s v\"\n\"eval (BIN_XOR e1 e2) s v\" \"eval (BIN_LOR e1 e2) s v\" \"eval (BIN_LEQ e1 e2) s v\" \"eval (BIN_GEQ e1 e2) s v\" \"eval (BIN_LES e1 e2) s v\"\n\"eval (BIN_GRE e1 e2) s v\" \"eval (BIN_NEQ e1 e2) s v\" \"eval (BIN_EQU e1 e2) s v\" \"eval (BIN_FAN e1 e2) s v\" \"eval (BIN_FOR e1 e2) s v\"\n\nlemma eval_deterministic: \"(eval e s v) \\<Longrightarrow> (eval e s v') \\<Longrightarrow> (v = v')\"\nproof (induction arbitrary: v' rule: eval.induct)\n  case (NAMEDVAR s varName v)\n  then show ?case sorry\nqed blast+\n\ncode_pred eval .\n\ndefinition null_state (\"<>\") where\n  \"null_state \\<equiv> \\<lambda>x. (UINT 0)\"\nsyntax\n  \"_State\" :: \"updbinds \\<Rightarrow> 'a\" (\"<_>\")\ntranslations\n  \"_State ms\" == \"_Update <> ms\"\n  \"_State (_updbinds b bs)\" <= \"_Update (_State b) bs\"\n\nend\n", "meta": {"author": "Johanmyst", "repo": "Nano-P4", "sha": "fc3720d7115d0bac5d719cfe6c73a024aae7f9c4", "save_path": "github-repos/isabelle/Johanmyst-Nano-P4", "path": "github-repos/isabelle/Johanmyst-Nano-P4/Nano-P4-fc3720d7115d0bac5d719cfe6c73a024aae7f9c4/Theory_Files/Option_State_Verification/NP4_Option_State_Values.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.31204981137321697}}
{"text": "theory TickTock_Max_Pri\n\nimports\n  \"TickTock.TickTock_Core\"\n  \"Utils.Event_Priority\"\nbegin\n\nsection \\<open> Prioritise for maximal TickTock \\<close>\n\ndefinition prirefMaxTT :: \"('e ttevent) partialorder \\<Rightarrow> ('e ttevent) set \\<Rightarrow> ('e ttevent) set\" where\n\"prirefMaxTT p Z = {z. z \\<notin> Z \\<longrightarrow> (\\<exists>b. b \\<notin> Z \\<and> z <\\<^sup>*p b)}\"\n\nfun priMaxTT :: \"('e ttevent) partialorder \\<Rightarrow> ('e ttobs) list \\<Rightarrow> ('e ttobs) list \\<Rightarrow> ('e ttobs) list \\<Rightarrow> ('e ttobs) list set \\<Rightarrow> bool\" where\n\"priMaxTT p [] [] s Q = True\" |\n\"priMaxTT p [[R]\\<^sub>R] [[S]\\<^sub>R] s Q = (prirefMaxTT p S = R)\" |\n\"priMaxTT p ([R]\\<^sub>R # [Tock]\\<^sub>E # aa) ([S]\\<^sub>R # [Tock]\\<^sub>E # zz) s Q = ((R = prirefMaxTT p S) \\<and> Tock \\<notin> R \\<and> priMaxTT p aa zz (s @ [[S]\\<^sub>R,[Tock]\\<^sub>E]) Q)\" |\n\"priMaxTT p ([e\\<^sub>1]\\<^sub>E # aa) ([e\\<^sub>2]\\<^sub>E # zz) s Q\n = \n (e\\<^sub>1 = e\\<^sub>2 \\<and> priMaxTT p aa zz (s @ [[e\\<^sub>1]\\<^sub>E]) Q \\<and>\n  (maximal(p,e\\<^sub>2) \n   \\<or> \n  (\\<exists>Z. s @ [[Z]\\<^sub>R] \\<in> Q \\<and> e\\<^sub>2 \\<notin> Z \\<and> \\<not>(\\<exists>b. b \\<notin> Z \\<and> e\\<^sub>2 <\\<^sup>*p b))))\" |\n\"priMaxTT p x y s Q = False\"\n\ndefinition PriMax :: \"('e ttevent) partialorder \\<Rightarrow> ('e ttobs) list set \\<Rightarrow> ('e ttobs) list set\" where\n\"PriMax p P = {t|s t. s \\<in> P \\<and> priMaxTT p t s [] P}\"\n\nsubsection \\<open> Properties of PriMax and priMaxTT \\<close>\n\nlemma priMaxTT_extend_both_refusal_ttWF:\n  assumes \"priMaxTT p xs ys s P\" \"ttWF (ys @ [[S]\\<^sub>R])\"  \"prirefMaxTT p S = R\"\n  shows \"priMaxTT p (xs @ [[R]\\<^sub>R]) (ys @ [[S]\\<^sub>R]) s P\"\n  using assms apply (induct p xs ys s P rule:priMaxTT.induct, auto)  \n  apply (metis ttWF.simps(10) ttWF.simps(4) ttWF.simps(6) ttevent.exhaust neq_Nil_conv snoc_eq_iff_butlast)\n  by (metis ttWF.simps(10) ttWF.simps(4) ttWF.simps(6) ttevent.exhaust neq_Nil_conv snoc_eq_iff_butlast)             \n\nlemma priMaxTT_extend_both_tock_refusal_ttWF:\n  assumes \"priMaxTT p xs ys s P\" \"ttWF (ys @ [[S]\\<^sub>R,[Tock]\\<^sub>E])\" \"prirefMaxTT p S = R\" \"Tock \\<notin> R\"\n  shows \"priMaxTT p (xs @ [[R]\\<^sub>R,[Tock]\\<^sub>E]) (ys @ [[S]\\<^sub>R,[Tock]\\<^sub>E]) s P\"\n  using assms apply (induct p xs ys s P rule:priMaxTT.induct, auto)\n  by (metis append_Cons append_Nil ttWF.simps(10) ttWF.simps(4) ttWF.simps(6) ttevent.exhaust neq_Nil_conv)+\n\nlemma maximal_Tock_then_not_prirefMaxTT [simp]:\n  assumes \"maximal(p,Tock)\" \"Tock \\<notin> S\"\n  shows \"Tock \\<notin> prirefMaxTT p S\"\n  using assms unfolding prirefMaxTT_def apply auto\n  by (simp add: some_higher_not_maximal)\n\nlemma priMaxTT_extend_both_events_eq_size_maximal_ttWF:\n  assumes \"priMaxTT p xs ys s P\" \"ttWF (ys @ [[e\\<^sub>1]\\<^sub>E])\" \"maximal(p,e\\<^sub>1)\" \"size xs = size ys\" \"ttWFx_trace (ys @ [[e\\<^sub>1]\\<^sub>E])\"\n  shows \"priMaxTT p (xs @ [[e\\<^sub>1]\\<^sub>E]) (ys @ [[e\\<^sub>1]\\<^sub>E]) s P\"\n  using assms apply (induct p xs ys s P rule:priMaxTT.induct, auto)\n    apply (cases e\\<^sub>1, auto)\n  using ttWFx_trace_cons_imp_cons\n  apply (metis append_Nil ttWF.simps(10) ttWF.simps(4) ttWF.simps(6) ttWF_prefix_is_ttWF ttevent.exhaust list.exhaust)\n  using ttWFx_trace_cons_imp_cons by (metis append_Nil ttWF.simps(10) ttWF.simps(4) ttWF.simps(6) ttWF_prefix_is_ttWF ttevent.exhaust list.exhaust)\n  \nlemma priMaxTT_extend_both_events_maximal_ttWF:\n  assumes \"priMaxTT p xs ys s P\" \"ttWF (xs @ [[e\\<^sub>1]\\<^sub>E])\" \"ttWF (ys @ [[e\\<^sub>1]\\<^sub>E])\" \"maximal(p,e\\<^sub>1)\" \"ttWFx_trace (ys @ [[e\\<^sub>1]\\<^sub>E])\"\n  shows \"priMaxTT p (xs @ [[e\\<^sub>1]\\<^sub>E]) (ys @ [[e\\<^sub>1]\\<^sub>E]) s P\"\n  using assms apply (induct p xs ys s P rule:priMaxTT.induct, auto)\n    apply (cases e\\<^sub>1, auto)\n  using ttWFx_trace_cons_imp_cons by (metis append_Nil ttWF.simps(10) ttWF.simps(4) ttWF.simps(6) ttWF_prefix_is_ttWF ttevent.exhaust list.exhaust)+\n\nlemma priMaxTT_same_length:\n  assumes \"priMaxTT p xs ys s P\"\n  shows \"size xs = size ys\"\n  using assms by (induct p xs ys s P rule:priMaxTT.induct, auto)\n\nlemma priMaxTT_imp_butlast_of_priMaxTTs:\n  assumes \"priMaxTT p ar xs [] P\"\n  shows \"priMaxTT p (List.butlast ar) (List.butlast xs) [] P\"\n  using assms apply (induct p ar xs _ P rule:priMaxTT.induct, auto)  \n  apply (metis neq_Nil_conv priMaxTT.simps(46))\n      apply (metis neq_Nil_conv priMaxTT.simps(28))\n     apply (metis neq_Nil_conv priMaxTT.simps(46))\n    apply (metis neq_Nil_conv priMaxTT.simps(28))\n   apply (metis neq_Nil_conv priMaxTT.simps(46))\n  by (metis neq_Nil_conv priMaxTT.simps(28))\n\nlemma priMaxTT_imp_one_butlast_of_priMaxTT:\n  assumes \"priMaxTT p ar (xs @ [x]) [] P\"\n  shows \"priMaxTT p (List.butlast ar) xs [] P\"\n  using assms priMaxTT_imp_butlast_of_priMaxTTs\n  by fastforce\n\nlemma prirefMaxTT_imp_not_exists_higher_pri:\n  assumes \"(R = prirefMaxTT p S)\" \"e\\<^sub>2 \\<notin> R\"\n  shows \"\\<not>(\\<exists>b. b \\<notin> S \\<and> e\\<^sub>2 <\\<^sup>*p b)\"\n  using assms unfolding prirefMaxTT_def by auto\n\nlemma priMaxTT_both_cons_extend_refusal_imp_prefix:\n  assumes \"priMaxTT p (x @ [[xs]\\<^sub>R]) (y @ [[ys]\\<^sub>R]) zs P\" \n  shows \"priMaxTT p x y zs P\"\n  using assms apply (induct p x y zs P arbitrary:xs ys rule:priMaxTT.induct, auto)\n  apply (metis list.exhaust priMaxTT.simps(57) snoc_eq_iff_butlast)\n  by (metis list.exhaust priMaxTT.simps(68) snoc_eq_iff_butlast)\n\nlemma priMaxTT_cannot_extend_refusal_rhs:\n  assumes \"priMaxTT p x y zs P\"\n  shows \"\\<not> priMaxTT p x (y @ [[ys]\\<^sub>R]) zs P\"\n  using assms by (induct p x y zs P rule:priMaxTT.induct, auto)\n\nlemma priMaxTT_cannot_extend_refusal_lhs:\n  assumes \"priMaxTT p x y zs P\"\n  shows \"\\<not> priMaxTT p (x @ [[xs]\\<^sub>R]) y zs P\"\n  using assms by (induct p x y zs P rule:priMaxTT.induct, auto)\n\nlemma not_priMaxTT_concat_refTock:\n  assumes \"v \\<noteq> []\"\n  shows \"\\<not> priMaxTT p (v @ [[x]\\<^sub>R, [Tock]\\<^sub>E]) [[y]\\<^sub>R, [Tock]\\<^sub>E] z P\"\n  using assms apply (induct p v \"[]:: 'a ttobs list\" z P rule:priMaxTT.induct, auto)\n  apply (case_tac va, auto, case_tac vb, auto, case_tac x1, auto)\n   apply (metis append_Cons append_Nil neq_Nil_conv priMaxTT.simps(28))\n  apply (case_tac va, auto, case_tac va, auto, case_tac a, auto, case_tac x1, auto)\n  by (metis append_Cons append_Nil neq_Nil_conv priMaxTT.simps(28))\n\nlemma not_priMaxTT_concat_refTock':\n  assumes \"v \\<noteq> []\"\n  shows \"\\<not> priMaxTT p [[y]\\<^sub>R, [Tock]\\<^sub>E] (v @ [[x]\\<^sub>R, [Tock]\\<^sub>E]) z P\"\n  using assms apply (induct p \"[]:: 'a ttobs list\" v z P rule:priMaxTT.induct, auto)\n   apply (case_tac va, auto, case_tac va, auto, case_tac a, auto, case_tac x1, auto)\n   apply (metis append_Cons neq_Nil_conv priMaxTT.simps(46) self_append_conv2)\n  apply (case_tac va, auto, case_tac vb, auto, case_tac x1, auto)\n  by (metis append_Cons neq_Nil_conv priMaxTT.simps(46) self_append_conv2)\n\nlemma priMaxTT_both_concat_refTock_imp_prefixes:\n  assumes \"priMaxTT p (xs @ [[s]\\<^sub>R, [Tock]\\<^sub>E]) (ys @ [[t]\\<^sub>R, [Tock]\\<^sub>E]) z P\" \n  shows \"priMaxTT p xs ys z P\"\n  using assms apply (induct p xs ys z P arbitrary:s t rule:priMaxTT.induct, auto)\n  using not_priMaxTT_concat_refTock \n     apply (metis append_Cons list.discI)     \n  using not_priMaxTT_concat_refTock \n    apply fastforce\n  using not_priMaxTT_concat_refTock'\n  by (metis append_Cons list.distinct(1))+\n\nlemma priMaxTT_length_eq:\n  assumes \"priMaxTT p xs ys z P\"\n  shows \"List.length xs = List.length ys\"\n  using assms by (induct p xs ys z P rule:priMaxTT.induct, auto)\n\nlemma ttWF_cons_simp:\n  assumes \"e\\<^sub>2 \\<noteq> Tock\" \"e\\<^sub>2 \\<noteq> Tick\" \"ttWF ([e\\<^sub>2]\\<^sub>E # zz)\"\n  shows \"ttWF(zz)\"\n  using assms\n  using ttWF.elims(2) by blast\n\nlemma priMaxTT_concat_dist1:\n  assumes \"ttWF (ys @ [[S]\\<^sub>R,[Tock]\\<^sub>E])\"\n  shows\n   \"priMaxTT p (xs @ [[R]\\<^sub>R,[Tock]\\<^sub>E]) (ys @ [[S]\\<^sub>R,[Tock]\\<^sub>E]) s P\n    =\n    (priMaxTT p xs ys s P \\<and> priMaxTT p [[R]\\<^sub>R,[Tock]\\<^sub>E] [[S]\\<^sub>R,[Tock]\\<^sub>E] (s @ ys) P)\"\n  using assms apply auto \n      apply (induct p xs ys s P rule:priMaxTT.induct, auto)\n  using priMaxTT_both_concat_refTock_imp_prefixes apply blast+\n         apply (metis append_Cons list.distinct(1) not_priMaxTT_concat_refTock)\n  using not_priMaxTT_concat_refTock apply fastforce\n       apply (metis append_Cons list.distinct(1) not_priMaxTT_concat_refTock')\n      apply (metis append_Cons list.distinct(1) not_priMaxTT_concat_refTock')\n     apply (induct p xs ys s P rule:priMaxTT.induct, auto)\n          apply (metis ttWF.simps(1) ttWF.simps(4) ttWF.simps(6) ttWF.simps(8) ttevent.exhaust neq_Nil_conv)\n         apply (metis append.left_neutral ttWF.simps(4) ttWF.simps(6) ttWF.simps(8) ttWF_prefix_is_ttWF ttevent.exhaust neq_Nil_conv)\n        apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock)\n  using not_priMaxTT_concat_refTock apply fastforce\n      apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock')\n     apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock')\n    apply (induct p xs ys s P rule:priMaxTT.induct, auto)\n         apply (metis ttWF.simps(1) ttWF.simps(4) ttWF.simps(6) ttWF.simps(8) ttevent.exhaust neq_Nil_conv)\n        apply (metis append.left_neutral ttWF.simps(4) ttWF.simps(6) ttWF.simps(8) ttWF_prefix_is_ttWF ttevent.exhaust neq_Nil_conv)\n       apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock)\n      apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock) \n     apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock')\n    apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock')\n   apply (induct p xs ys s P rule:priMaxTT.induct, auto)\n        apply (metis ttWF.simps(1) ttWF.simps(10) ttWF.simps(4) ttWF.simps(6) ttevent.exhaust neq_Nil_conv)\n       apply (metis ttWF.simps(1) ttWF.simps(10) ttWF.simps(4) ttWF.simps(6) ttevent.exhaust neq_Nil_conv)\n      apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock)\n     apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock)\n    apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock')\n   apply (metis Cons_eq_appendI neq_Nil_conv not_priMaxTT_concat_refTock')\napply (induct p xs ys s P rule:priMaxTT.induct, auto) \n  apply (metis Cons_eq_appendI priMaxTT.simps(4) priMaxTT_extend_both_tock_refusal_ttWF)\n  by (metis ttWF.simps(1) ttWF.simps(10) ttWF.simps(4) ttWF.simps(6) ttevent.exhaust neq_Nil_conv)\n\nlemma not_priMaxTT_simp1 [elim]:\n  assumes \"v \\<noteq> []\"\n  shows \"\\<not> priMaxTT p (v @ [a,b]) [c,d] s Q\"\n  using assms using priMaxTT_length_eq by fastforce\n\nlemma not_priMaxTT_simp2 [simp]:\n  shows \"\\<not> priMaxTT p (x # y @ [a,b]) [c,d] s Q\"\n  using priMaxTT_length_eq by fastforce\n\nlemma not_priMaxTT_simp2' [simp]:\n  shows \"\\<not> priMaxTT p [c,d] (x # y @ [a,b]) s Q\"\n  using priMaxTT_length_eq by fastforce\n\nlemma not_priMaxTT_simp3 [simp]:\n  shows \"\\<not> priMaxTT p (x # y # z @ [a,b]) [c,d] s Q\"\n  using priMaxTT_length_eq by fastforce\n\nlemma not_priMaxTT_simp3' [simp]:\n  shows \"\\<not> priMaxTT p [c,d] (x # y # z @ [a,b]) s Q\"\n  using priMaxTT_length_eq by fastforce\n\nlemma not_priMaxTT_simp4 [simp]:\n  shows \"\\<not> priMaxTT p [a, b, c] (x # y # z @ [w, u]) s Q\"\n  using priMaxTT_length_eq by fastforce\n\nlemma not_priMaxTT_simp4' [simp]:\n  shows \"\\<not> priMaxTT p (x # y # z @ [w, u]) [a, b, c]  s Q\"\n  using priMaxTT_length_eq by fastforce\n\nlemma priMaxTT_concat_dist2:\n  assumes \"ttWF (ys @ [[S]\\<^sub>R,[Tock]\\<^sub>E])\"\n  shows\n   \"priMaxTT p (xs @ [a,b]) (ys @ [[S]\\<^sub>R,[Tock]\\<^sub>E]) s P\n    =\n    (priMaxTT p xs ys s P \\<and> priMaxTT p [a,b] [[S]\\<^sub>R,[Tock]\\<^sub>E] (s @ ys) P)\"\n  using assms apply auto \n    apply (induct p xs ys s P rule:priMaxTT.induct, auto)\n  using ttWF.elims(2) apply blast\n  using ttWF.elims(2) apply blast\n   apply (induct p xs ys s P rule:priMaxTT.induct, auto)\n  using ttWF.elims(2) apply blast\n  using ttWF.elims(2) apply blast\n  apply (induct p xs ys s P rule:priMaxTT.induct, auto)\n  using ttWF.elims(2) apply blast\n  using ttWF.elims(2) by blast \n\nlemma priMaxTT_FIXME1:\n  assumes \"priMaxTT p (xs @ [a,b]) (ys @ [[S]\\<^sub>R, [Tock]\\<^sub>E]) s P\" \"ttWF (ys @ [[S]\\<^sub>R,[Tock]\\<^sub>E])\"\n  shows \"priMaxTT p [a,b] [[S]\\<^sub>R, [Tock]\\<^sub>E] (s@ys) P\"\n  using assms priMaxTT_concat_dist2 by (simp add:priMaxTT_concat_dist2)\n\nlemma priMaxTT_rhs_refTock_imp_no_gt_Tock_pri:\n  assumes \"priMaxTT p ar (ys @ [[r1]\\<^sub>R, [Tock]\\<^sub>E]) [] P\" \"ttWF (ys @ [[r1]\\<^sub>R, [Tock]\\<^sub>E])\"\n  shows \"\\<not>(\\<exists>b. b \\<notin> r1 \\<and> Tock <\\<^sup>*p b)\"\n  using assms \nproof -\n  from assms have ll:\"List.length ar = List.length (ys @ [[r1]\\<^sub>R, [Tock]\\<^sub>E])\"\n    using priMaxTT_length_eq by blast\n  then show ?thesis\n  using assms(1)\n  proof (induct ar rule:rev_induct)\n    case Nil\n    then show ?case by auto\n  next\n    case (snoc z zs)\n    then show ?case \n    proof (induct zs rule:rev_induct)\n      case Nil\n      then show ?case by auto\n    next\n      case (snoc x xs)\n      then show ?case \n        apply (case_tac z, auto)\n         apply (case_tac x1, auto)\n           apply (case_tac x, auto)\n            apply (meson assms(2) priMaxTT.simps(50) priMaxTT_FIXME1)\n           apply (meson assms(2) priMaxTT.simps(50) priMaxTT_FIXME1)\n          apply (case_tac x, auto)\n        using assms(2) priMaxTT.simps(47) priMaxTT_FIXME1 apply blast\n          apply (metis assms(2) priMaxTT.simps(3) priMaxTT_FIXME1 prirefMaxTT_imp_not_exists_higher_pri)\n         apply (case_tac x, auto)\n        using assms(2) priMaxTT.simps(52) priMaxTT_FIXME1 apply blast\n        using assms(2) priMaxTT.simps(52) priMaxTT_FIXME1 apply blast\n        using assms(2) priMaxTT.simps(17) priMaxTT_FIXME1 by blast\n    qed\n  qed\nqed\n\nlemma priMaxTT_nonmax_Tock_imp_exists_refusal:\n  assumes \"priMaxTT p ar (ys @ [[e1]\\<^sub>E]) s P\" \"e1 \\<noteq> Tock\"\n          \"ttWF (ys @ [[e1]\\<^sub>E])\" \"\\<not>maximal(p,e1)\"\n  shows \"(\\<exists>Z. s @ ys @ [[Z]\\<^sub>R] \\<in> P \\<and> e1 \\<notin> Z \\<and> \\<not>(\\<exists>b. b \\<notin> Z \\<and> e1 <\\<^sup>*p b))\"\n  using assms apply(induct p ar ys s P rule:priMaxTT.induct, auto)\n            apply (metis ttWF.simps(1) ttWF.simps(10) ttWF.simps(6) ttWF_cons_simp neq_Nil_conv)\n           apply (metis (full_types) append_Nil assms(2) ttWF.simps(10) ttWF.simps(5) ttWF.simps(6) ttWF_cons_simp ttWF_prefix_is_ttWF list.collapse rotate1.simps(2))\n          apply (metis ttobs.exhaust priMaxTT.simps(29) priMaxTT.simps(4))\n         apply (metis ttobs.exhaust priMaxTT.simps(29) priMaxTT.simps(4))\n        apply (metis ttobs.exhaust priMaxTT.simps(29) priMaxTT.simps(4))\n       apply (metis ttobs.exhaust priMaxTT.simps(29) priMaxTT.simps(4))\n      apply (case_tac va, auto, case_tac vb, auto, case_tac x1, auto, case_tac e1, auto)\n  using ttWF.elims(2) apply blast\n  using ttobs.exhaust  priMaxTT.simps(29) priMaxTT.simps(4) apply metis\n  apply (case_tac v, auto)\n  using ttWF.elims(2) by blast+\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/TickTock-FL/TickTock_Max_Pri.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.4687906266262438, "lm_q1q2_score": 0.31193823279863797}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory WP\nimports\n  \"WP_Pre\"\n  \"WPFix\"\n  \"../../Apply_Debug\"\n  \"../../ml-helpers/MLUtils\"\nbegin\n\ndefinition\n  triple_judgement :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'b \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> bool\"\nwhere\n \"triple_judgement pre body property = (\\<forall>s. pre s \\<longrightarrow> property s body)\"\n\ndefinition\n  postcondition :: \"('r \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> ('r \\<times> 's) set)\n            \\<Rightarrow> 'a \\<Rightarrow> 'b \\<Rightarrow> bool\"\nwhere\n \"postcondition P f = (\\<lambda>a b. \\<forall>(rv, s) \\<in> f a b. P rv s)\"\n\ndefinition\n  postconditions :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\"\nwhere\n \"postconditions P Q = (\\<lambda>a b. P a b \\<and> Q a b)\"\n\nlemma conj_TrueI: \"P \\<Longrightarrow> True \\<and> P\" by simp\nlemma conj_TrueI2: \"P \\<Longrightarrow> P \\<and> True\" by simp\n\nML_file \"WP-method.ML\"\n\ndeclare [[wp_trace = false, wp_trace_instantiation = false]]\n\nsetup WeakestPre.setup\n\nmethod_setup wp = \\<open>WeakestPre.apply_wp_args\\<close>\n  \"applies weakest precondition rules\"\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/lib/Monad_WP/wp/WP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883592602051, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.31181064982311946}}
{"text": "section \\<open> Instantaneous Reactive Designs \\<close>\n\ntheory utp_rdes_instant\n  imports utp_rdes_prog\nbegin\n\ndefinition ISRD1 :: \"('s,'t::trace,'\\<alpha>) hrel_rsp \\<Rightarrow> ('s,'t,'\\<alpha>) hrel_rsp\" where\n[upred_defs]: \"ISRD1(P) = P \\<parallel>\\<^sub>R \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> false \\<diamondop> ($tr =\\<^sub>u $tr\\<acute>))\"\n\ndefinition ISRD :: \"('s,'t::trace,'\\<alpha>) hrel_rsp \\<Rightarrow> ('s,'t,'\\<alpha>) hrel_rsp\" where\n[upred_defs]: \"ISRD = ISRD1 \\<circ> NSRD\"\n\nlemma ISRD1_idem: \"ISRD1(ISRD1(P)) = ISRD1(P)\"\n  by (rel_auto)\n    \nlemma ISRD1_monotonic: \"P \\<sqsubseteq> Q \\<Longrightarrow> ISRD1(P) \\<sqsubseteq> ISRD1(Q)\"\n  by (rel_auto)\n\nthm R5_def\n\nlemma ISRD1_RHS_design_form:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\" \"$ok\\<acute> \\<sharp> R\"\n  shows \"ISRD1(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = \\<^bold>R\\<^sub>s(P \\<turnstile> false \\<diamondop> R5(R))\"\n  using assms by (simp add: ISRD1_def choose_srd_def RHS_tri_design_par unrest, rel_auto)\n\nlemma ISRD1_form:\n  \"ISRD1(SRD(P)) = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> false \\<diamondop> (R5(post\\<^sub>R(P))))\"\n  by (simp add: ISRD1_RHS_design_form SRD_as_reactive_tri_design unrest)\n\nlemma ISRD1_rdes_def [rdes_def]: \n  \"\\<lbrakk> P is RR; R is RR \\<rbrakk> \\<Longrightarrow> ISRD1(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = \\<^bold>R\\<^sub>s(P \\<turnstile> false \\<diamondop> R5(R))\"\n  by (simp add: ISRD1_def R5_def rdes_def closure rpred)\n\nlemma ISRD_intro: \n  assumes \"P is NSRD\" \"peri\\<^sub>R(P) = (\\<not>\\<^sub>r pre\\<^sub>R(P))\" \"($tr\\<acute> =\\<^sub>u $tr) \\<sqsubseteq> post\\<^sub>R(P)\"\n  shows \"P is ISRD\"\nproof -\n  have \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) is ISRD1\"\n    apply (simp add: Healthy_def rdes_def closure assms(1-2))\n    using assms(3) least_zero apply (rel_blast)\n    done\n  hence \"P is ISRD1\"\n    by (simp add: SRD_reactive_tri_design closure assms(1))\n  thus ?thesis\n    by (simp add: ISRD_def Healthy_comp assms(1))\nqed\n\nlemma ISRD1_rdes_intro:\n  assumes \"P is RR\" \"Q is RR\" \"($tr =\\<^sub>u $tr\\<acute>) \\<sqsubseteq> Q\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> false \\<diamondop> Q) is ISRD1\"\n  unfolding Healthy_def\n  by (simp add: ISRD1_rdes_def R5_def assms closure unrest utp_pred_laws.inf.absorb1)\n\nlemma ISRD_rdes_intro [closure]:\n  assumes \"P is RC\" \"Q is RR\" \"($tr =\\<^sub>u $tr\\<acute>) \\<sqsubseteq> Q\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> false \\<diamondop> Q) is ISRD\"\n  unfolding Healthy_def\n  by (simp add: ISRD_def R5_def closure Healthy_if ISRD1_rdes_def assms unrest utp_pred_laws.inf.absorb1)\n\nlemma ISRD_implies_ISRD1:\n  assumes \"P is ISRD\"\n  shows \"P is ISRD1\"\nproof -\n  have \"ISRD(P) is ISRD1\"\n    by (simp add: ISRD_def Healthy_def ISRD1_idem)\n  thus ?thesis\n    by (simp add: assms Healthy_if)\nqed\n  \nlemma ISRD_implies_SRD: \n  assumes \"P is ISRD\"\n  shows \"P is SRD\"\nproof -\n  have 1:\"ISRD(P) = \\<^bold>R\\<^sub>s((\\<not>\\<^sub>r (\\<not>\\<^sub>r pre\\<^sub>R P) ;; R1 true \\<and> R1 true) \\<turnstile> false \\<diamondop> (post\\<^sub>R P \\<and> $tr =\\<^sub>u $tr\\<acute>))\"\n    by (simp add: NSRD_form ISRD1_def R5_def ISRD_def RHS_tri_design_par rdes_def unrest closure)\n  moreover have \"... is SRD\"\n    by (simp add: closure unrest)\n  ultimately have \"ISRD(P) is SRD\"\n    by (simp)\n  with assms show ?thesis\n    by (simp add: Healthy_def)\nqed\n\nlemma ISRD_implies_NSRD [closure]: \n  assumes \"P is ISRD\"\n  shows \"P is NSRD\"\nproof -\n  have 1:\"ISRD(P) = ISRD1(RD3(SRD(P)))\"\n    by (simp add: ISRD_def NSRD_def SRD_def, metis RD1_RD3_commute RD3_left_subsumes_RD2)\n  also have \"... = ISRD1(RD3(P))\"\n    by (simp add: assms ISRD_implies_SRD Healthy_if)\n  also have \"... = ISRD1 (\\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false\\<^sub>h \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> post\\<^sub>R P))\"\n    by (simp add: RD3_def, subst SRD_right_unit_tri_lemma, simp_all add: assms ISRD_implies_SRD)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false\\<^sub>h \\<turnstile> false \\<diamondop> (post\\<^sub>R P \\<and> $tr =\\<^sub>u $tr\\<acute>))\"\n    by (simp add: RHS_tri_design_par ISRD1_def unrest choose_srd_def rpred closure ISRD_implies_SRD assms)\n  also have \"... = (... ;; II\\<^sub>R)\"\n    by (rdes_simp, simp add: RHS_tri_normal_design_composition' closure assms unrest ISRD_implies_SRD R5_def wp rpred wp_rea_false_RC)\n  also have \"... is RD3\"\n    by (simp add: Healthy_def RD3_def seqr_assoc)\n  finally show ?thesis\n    by (simp add: SRD_RD3_implies_NSRD Healthy_if assms ISRD_implies_SRD)\nqed\n  \nlemma ISRD_form:\n  assumes \"P is ISRD\"\n  shows \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> false \\<diamondop> R5(post\\<^sub>R(P))) = P\"\nproof -\n  have \"P = ISRD1(P)\"\n    by (simp add: ISRD_implies_ISRD1 assms Healthy_if)\n  also have \"... = ISRD1(\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)))\"\n    by (simp add: SRD_reactive_tri_design ISRD_implies_SRD assms)\n  also have \"... = \\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> false \\<diamondop> R5(post\\<^sub>R(P)))\"\n    by (simp add: ISRD1_rdes_def R5_def closure assms)\n  finally show ?thesis ..\nqed\n    \nlemma ISRD_elim [RD_elim]: \n  \"\\<lbrakk> P is ISRD; Q(\\<^bold>R\\<^sub>s (pre\\<^sub>R(P) \\<turnstile> false \\<diamondop> R5(post\\<^sub>R(P)))) \\<rbrakk> \\<Longrightarrow> Q(P)\"\n  by (simp add: ISRD_form)\n  \nlemma skip_srd_ISRD [closure]: \"II\\<^sub>R is ISRD\"\n  by (rule ISRD_intro, simp_all add: rdes closure)\n    \nlemma assigns_srd_ISRD [closure]: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>R is ISRD\"\n  by (rule ISRD_intro, simp_all add: rdes closure, rel_auto)\n\nlemma seq_ISRD_closed:\n  assumes \"P is ISRD\" \"Q is ISRD\"\n  shows \"P ;; Q is ISRD\"\n  apply (insert assms)\n  apply (erule ISRD_elim)+\n  apply (simp add: rdes_def closure assms unrest)\n  apply (rule ISRD_rdes_intro)\n    apply (simp_all add: rdes_def closure assms unrest)\n  apply (rel_auto)\n  done\n\nlemma ISRD_Miracle_right_zero:\n  assumes \"P is ISRD\" \"pre\\<^sub>R(P) = true\\<^sub>r\"\n  shows \"P ;; Miracle = Miracle\"\n  by (rdes_simp cls: assms)\n\ntext \\<open> A recursion whose body does not extend the trace results in divergence \\<close>\n\nlemma ISRD_recurse_Chaos:\n  assumes \"P is ISRD\" \"post\\<^sub>R P ;; true\\<^sub>r = true\\<^sub>r\"\n  shows \"(\\<mu>\\<^sub>R X \\<bullet> P ;; X) = Chaos\"\nproof -\n  have 1: \"(\\<mu>\\<^sub>R X \\<bullet> P ;; X) = (\\<mu> X \\<bullet> P ;; SRD(X))\"\n    by (auto simp add: srdes_theory.utp_lfp_def closure assms)\n  have \"(\\<mu> X \\<bullet> P ;; SRD(X)) \\<sqsubseteq> Chaos\"\n  proof (rule gfp_upperbound)\n    have \"P ;; Chaos \\<sqsubseteq> Chaos\"\n      apply (rdes_refine_split cls: assms)\n      using assms(2) apply (rel_auto, metis (no_types, lifting) dual_order.antisym order_refl)\n       apply (rel_auto)+\n      done\n    thus \"P ;; SRD Chaos \\<sqsubseteq> Chaos\"\n      by (simp add: Healthy_if srdes_theory.bottom_closed)\n  qed\n  thus ?thesis\n    by (metis \"1\" dual_order.antisym srdes_theory.LFP_closed srdes_theory.bottom_lower)\nqed\n\nlemma recursive_assign_Chaos:\n  \"(\\<mu>\\<^sub>R X \\<bullet> \\<langle>\\<sigma>\\<rangle>\\<^sub>R ;; X) = Chaos\"\n  by (rule ISRD_recurse_Chaos, simp_all add: closure rdes, rel_auto)  \n\nlemma unproductive_form:\n  assumes \"P\\<^sub>2 is RR\" \"P\\<^sub>3 is RR\" \"P\\<^sub>3 is R5\" \"P\\<^sub>3 \\<noteq> false\"\n  shows \"\\<not> (\\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) is Productive)\"\nproof -\n  have \"Productive(\\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3)) = \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> P\\<^sub>2 \\<diamondop> R4(P\\<^sub>3))\"\n    by (simp add: Productive_RHS_R4_design_form closure assms)\n  also have \"... = \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> P\\<^sub>2 \\<diamondop> false)\"\n    by (metis Healthy_if R4_R5 assms(3))\n  also have \"... \\<noteq> \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3)\"\n    by (simp add: R5_implies_R1 assms rea_true_conj(1) rrel_theory.bottom_closed rrel_theory.top_closed srdes_tri_eq_iff)\n  finally show ?thesis\n    using Healthy_if by blast\nqed\n\nlemma unproductive_assigns: \"\\<not> (\\<langle>\\<sigma>\\<rangle>\\<^sub>R is Productive)\"\n  unfolding rdes_def by (rule unproductive_form, simp_all add: closure, rel_auto+)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/rea_designs/utp_rdes_instant.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3118106498231194}}
{"text": "(*  Title:      HOL/Auth/n_mutualExOnI.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExOnI Protocol Case Study*} \n\ntheory n_mutualExOnI imports n_mutualExOnI_lemma_invs_on_rules n_mutualExOnI_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "lyj238Gmail", "repo": "newParaVerifier", "sha": "5c2d49bf8e6c46c60efa53c98b0ba5c577d59618", "save_path": "github-repos/isabelle/lyj238Gmail-newParaVerifier", "path": "github-repos/isabelle/lyj238Gmail-newParaVerifier/newParaVerifier-5c2d49bf8e6c46c60efa53c98b0ba5c577d59618/examples/n_mutualExOnI/n_mutualExOnI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3118106498231194}}
{"text": "theory Deque\n  imports Nat_Language\nbegin\n\nsection \\<open>Define the variables\\<close>\ndatatype addr = h | t | task | level | head | tail | r | l\\<^sub>0 | l\\<^sub>1 | l\\<^sub>2 | t\\<^sub>0 | t\\<^sub>1 | t\\<^sub>2 | public | z | x\ndefinition all_vars\n  where \"all_vars = [h, t, task, level, head, tail, r, l\\<^sub>0, l\\<^sub>1, l\\<^sub>2, t\\<^sub>0, t\\<^sub>1, t\\<^sub>2, public, z, x]\"\ndefinition locals\n  where \"locals = [h, t, task, level, r]\"\n\nsection \\<open>Establish the language & logic\\<close>\nglobal_interpretation natlang: nat_language all_vars locals\n  defines \\<Gamma>\\<^sub>a = natlang.\\<Gamma>\\<^sub>a\n      and \\<Gamma>\\<^sub>b = natlang.\\<Gamma>\\<^sub>b\n      and wp = natlang.wp\n      and stabilize = natlang.stabilize\n      and wp\\<^sub>Q = natlang.wp\\<^sub>Q\n      and guar = natlang.guar\n      and PO = natlang.PO\n      and secureUpd = natlang.secureUpd\n      and ctrled = natlang.ctrled\n      and if_secure = natlang.if_secure\n      and wellformed = natlang.wellformed\n      and negate = natlang.negate\n      and var_policy = natlang.var_policy\n      and \\<Gamma>\\<^sub>e = natlang.\\<Gamma>\\<^sub>e\n      and invar = natlang.invar\n      and low\\<^sub>v = natlang.low\\<^sub>v\n      and wf\\<^sub>\\<L> = natlang.wf\\<^sub>\\<L>\n      and step = natlang.step\n      and str_env = natlang.str_env\n      and onlyGlobals = natlang.onlyGlobals\n  apply unfold_locales unfolding all_vars_def by allvars_tac\n\nsyntax\n  \"_Assign\" :: \"'addr \\<Rightarrow> ('addr) aexp \\<Rightarrow> ('addr, nat, 'addr aexp, 'addr bexp) WPLang\"\n    (\"(_ :=/ _)\" [70, 65] 61)\n  \"_Store\" :: \"'addr \\<Rightarrow> ('addr) aexp \\<Rightarrow> ('addr) aexp \\<Rightarrow> ('addr, nat, 'addr aexp, 'addr bexp) WPLang\"\n    (\"(_ IN _ :=/ _)\" [70, 70, 65] 61)\n  \"_Load\" :: \"'addr \\<Rightarrow> ('addr) list \\<Rightarrow> ('addr) aexp \\<Rightarrow> ('addr, nat, 'addr aexp, 'addr bexp) WPLang\"\n    (\"(_ :=/ _ IN/ _)\" [70, 70, 70] 61)\n  \"_Secure\" :: \"('addr,nat) rpred \\<Rightarrow> ('addr,nat) rpred \\<Rightarrow> ('addr \\<Rightarrow> 'addr bexp) \\<Rightarrow> ('addr,nat) pred \\<Rightarrow> ('addr, nat, 'addr aexp, 'addr bexp) WPLang \\<Rightarrow> bool\"\n    (\"(0_,_ \\<turnstile> R: _ /G: _ /{_})\" [0, 0, 0, 0, 0] 61)\n\ntranslations\n  \"x := a\" \\<rightharpoonup> \"CONST Act (CONST Assign x a)\"\n  \"x IN i := a\" \\<rightharpoonup> \"CONST Act (CONST Store x i a)\"\n  \"r := a IN i\" \\<rightharpoonup> \"CONST Act (CONST Action.Load r a i)\"\n  \"L,P \\<turnstile> R: RP G: GP {c}\" \\<rightharpoonup> \"CONST if_secure RP GP L P c\"\n\nsection \\<open>Example\\<close>\n\nsubsection \\<open>Specification\\<close>\n\nfun \\<L> :: \"addr \\<Rightarrow> addr bexp\" where\n  \"\\<L> tail = true\" |\n  \"\\<L> head = true\" |\n  \"\\<L> l\\<^sub>0 = true\" |\n  \"\\<L> l\\<^sub>1 = true\" |\n  \"\\<L> l\\<^sub>2 = true\" |\n  \"\\<L> t\\<^sub>0 = UCmp (\\<lambda>x. x = 0) (Load l\\<^sub>0)\" |\n  \"\\<L> t\\<^sub>1 = UCmp (\\<lambda>x. x = 0) (Load l\\<^sub>1)\" |\n  \"\\<L> t\\<^sub>2 = UCmp (\\<lambda>x. x = 0) (Load l\\<^sub>2)\" |\n  \"\\<L> public = true\" |\n  \"\\<L> z = true\" |\n  \"\\<L> _ = false\"\n\ndefinition P\\<^sub>0 :: \"(addr,nat) pred\"\n  where \"P\\<^sub>0 \\<equiv> PCmp (\\<lambda>x y. even x) (Var z) (Const 0)\"\n\ndefinition \"R \\<equiv>  (const z) \\<and>\\<^sub>p (const t\\<^sub>0) \\<and>\\<^sub>p (const l\\<^sub>0) \\<and>\\<^sub>p (const t\\<^sub>1) \\<and>\\<^sub>p (const l\\<^sub>1) \\<and>\\<^sub>p (const t\\<^sub>2) \\<and>\\<^sub>p (const l\\<^sub>2)\"\n\ndefinition \"G \\<equiv> inc z \n            \\<and>\\<^sub>p ((PCmp (\\<lambda>x y. even x) (Var z\\<^sup>o) (Const 0) \\<and>\\<^sub>p PCmp (=) (Var (Orig z)) (Var (Prime z))) \\<longrightarrow>\\<^sub>p (PCmp (=) (Var (Orig l\\<^sub>0)) (Var (Prime l\\<^sub>0)))) \n            \\<and>\\<^sub>p ((PCmp (\\<lambda>x y. even x) (Var z\\<^sup>o) (Const 0) \\<and>\\<^sub>p PCmp (=) (Var (Orig z)) (Var (Prime z))) \\<longrightarrow>\\<^sub>p (PCmp (=) (Var (Orig l\\<^sub>1)) (Var (Prime l\\<^sub>1)))) \n            \\<and>\\<^sub>p ((PCmp (\\<lambda>x y. even x) (Var z\\<^sup>o) (Const 0) \\<and>\\<^sub>p PCmp (=) (Var (Orig z)) (Var (Prime z))) \\<longrightarrow>\\<^sub>p (PCmp (=) (Var (Orig l\\<^sub>2)) (Var (Prime l\\<^sub>2))))\"\n\nlemma [natlang.RGSpec]:\n  \"transitive G\"\n  by natlang.wf_spec (intro conjI impI; auto)\n\nlemma [natlang.RGSpec]:\n  \"str_env (step G)\"\n  by natlang.wf_spec (auto simp: G_def)\n\ndeclare G_def [natlang.RGSimp]\ndeclare R_def [natlang.RGSimp]\n\nsubsection \\<open>Constants\\<close>\n\ndefinition \"levels = [l\\<^sub>0, l\\<^sub>1, l\\<^sub>2]\"\ndefinition \"tasks = [t\\<^sub>0, t\\<^sub>1, t\\<^sub>2]\"\ndefinition \"L = Nat 3\"\ndefinition \"fail = Nat 0\"\ndefinition \"none = Nat 0\"\n\nsubsection \\<open>Functions\\<close>\n\nlemma put:\n  \"\\<L>,P\\<^sub>0 \\<and>\\<^sub>p Low level \\<and>\\<^sub>p (PCmp (=) (Var level) (Const 0) \\<longrightarrow>\\<^sub>p (Low task)) \\<turnstile>\n   R: R\n   G: G\n   {\n    t := Load tail;\n    z := BExp (Load z) (+) (Nat 1);\n    tasks IN (BExp (Load t) (mod) L) := Nat 0;\n    levels IN (BExp (Load t) (mod) L) := Load level;\n    tasks IN (BExp (Load t) (mod) L) := Load task;\n    z := BExp (Load z) (+) (Nat 1);\n    tail := BExp (Load t) (+) (Nat 1)}\"\n  by natlang.vcgsolve (metis mod_Suc n_not_Suc_n numeral_2_eq_2)+\n\nlemma take:\n  \"\\<L>,P\\<^sub>0 \\<turnstile>\n   R: Pb True\n   G: G\n   {\n    t := BExp (Load tail) (-) (Nat 1);\n    tail := Load t;\n    h := Load head;\n    IF \\<lbrace>BCmp (Load h) (\\<le>) (Load t)\\<rbrace>\n    THEN\n      task := tasks IN BExp (Load t) (mod) L;\n      IF \\<lbrace>BCmp (Load h) (=) (Load t)\\<rbrace>\n      THEN\n        IF NCAS head (Load h) (BExp (Load h) (+) (Nat 1))\n        THEN task := Nat 0\n        ELSE Skip\n        FI ;\n        tail := BExp (Load h) (+) (Nat 1)\n      ELSE Skip\n      FI \n    ELSE\n      task := Nat 0;\n      tail := Load h\n    FI\n   }\"\n  by natlang.vcgsolve \n\nlemma steal:\n  \"\\<L>,P\\<^sub>0 \\<turnstile>\n   R: G\n   G: R\n   {\n    h := Load head;\n    t := Load tail;\n    IF \\<lbrace>BCmp (Load h) (<) (Load t)\\<rbrace>\n    THEN\n      DO\n        DO\n          r := Load z\n        INV {Low r \\<and>\\<^sub>p Low h \\<and>\\<^sub>p PCmp (\\<le>) (Var r) (Var z)} \n        WHILE \\<lbrace>Not (UCmp even (Load r))\\<rbrace>;\n        level := levels IN BExp (Load h) (mod) L;\n        IF \\<lbrace>BCmp (Load level) (=) (Nat 0)\\<rbrace>\n        THEN task := tasks IN BExp (Load h) (mod) L\n        ELSE task := fail\n        FI \n      INV {Low r \\<and>\\<^sub>p Low h \\<and>\\<^sub>p (PCmp (=) (Var r) (Var z) \\<longrightarrow>\\<^sub>p Low task)}     \n      WHILE \\<lbrace>BCmp (Load z) (\\<noteq>) (Load r)\\<rbrace>;\n      IF NCAS head (Load h) (BExp (Load h) (+) (Nat 1))\n      THEN task := fail\n      ELSE Skip\n      FI\n    ELSE\n      task := none\n    FI ;\n    public := Load task \n   }\"\n  by natlang.vcgsolve (metis (no_types, lifting) le_antisym le_trans)+\n\nend", "meta": {"author": "UQ-PAC", "repo": "wpif_CSF21", "sha": "e2fd527115dcd01c5a8e0664480bb982eb696d7e", "save_path": "github-repos/isabelle/UQ-PAC-wpif_CSF21", "path": "github-repos/isabelle/UQ-PAC-wpif_CSF21/wpif_CSF21-e2fd527115dcd01c5a8e0664480bb982eb696d7e/Examples/Deque.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3118106498231194}}
{"text": "(******************************************************************************\n * Orca: A Functional Correctness Verifier for Imperative Programs\n *       Based on Isabelle/UTP\n *\n * Copyright (c) 2016-2018 Virginia Tech, USA\n *               2016-2018 Technische Universität München, Germany\n *               2016-2018 University of York, UK\n *               2016-2018 Université Paris-Saclay, Univ. Paris-Sud, France\n *\n * This software may be distributed and modified according to the terms of\n * the GNU Lesser General Public License version 3.0 or any later version.\n * Note that NO WARRANTY is provided.\n *\n * See CONTRIBUTORS, LICENSE and CITATION files for details.\n ******************************************************************************)\n\nsection \\<open>Algebraic laws of programming\\<close>\n\ntext \\<open>In this section we introduce the semantic rules related to the different\n      statements of IMP. In the literature this also known as the algebraic laws of programming.\n      In our framework we will use these rules in order to optimize a given program written in our\n      language, and this before any deductive proof verification activity or formal testing.\\<close>\n\ntheory Algebraic_Laws\n  imports \"../../Isabelle-UTP/utp/utp_urel_laws\"\nbegin\n\nnamed_theorems symbolic_exec and symbolic_exec_assign_uop and symbolic_exec_assign_bop and\n               symbolic_exec_assign_trop and symbolic_exec_assign_qtop and symbolic_exec_ex\n(* Usage of symbolic_exec_ex for the simp lemmas avoids annoying warnings about duplicate theorems\nwhen using `simp add: symbolic_exec` *)\n\nsubsection \\<open>SKIP Laws\\<close>\ntext \\<open>In this section we introduce the algebraic laws of programming related to the SKIP\n      statement.\\<close>\n\nlemma pre_skip_post: \"(\\<lceil>b\\<rceil>\\<^sub>< \\<and> II) = (II \\<and> \\<lceil>b\\<rceil>\\<^sub>>)\"\n  by rel_auto\n\nlemma skip_var:\n  fixes x :: \"(bool \\<Longrightarrow> '\\<alpha>)\"\n  shows \"($x \\<and> II) = (II \\<and> $x\\<acute>)\"\n  by rel_auto\n\nlemma assign_r_alt_def [symbolic_exec]:\n  fixes x :: \"('a \\<Longrightarrow>'\\<alpha>)\"\n  shows \"x :== v = II\\<lbrakk>\\<lceil>v\\<rceil>\\<^sub></$x\\<rbrakk>\"\n  by rel_auto\n\nlemma skip_r_alpha_eq:\n  \"II = ($\\<Sigma>\\<acute> =\\<^sub>u $\\<Sigma>)\"\n  by rel_auto\n\nlemma skip_r_refine_orig:\n  \"(p \\<Rightarrow> p) \\<sqsubseteq> II\"\n  by pred_blast\n\nlemma skip_r_eq[simp]: \"\\<lbrakk>II\\<rbrakk>\\<^sub>e (a, b) \\<longleftrightarrow> a = b\"\n  by rel_auto\n\nlemma skip_refine_join:\n  \"(p \\<Rightarrow> q) \\<sqsubseteq> II \\<longleftrightarrow> `((p \\<squnion> II) \\<Rightarrow> q)`\"\n  by pred_auto\n \nlemma skip_refine_rel:\n  \"`(II \\<Rightarrow> (p \\<Rightarrow> q))` \\<Longrightarrow> (p \\<Rightarrow> q) \\<sqsubseteq> II\"\n  by pred_auto\n  \nlemma skip_r_refine_pred:\n  \"`(p \\<Rightarrow> q)` \\<Longrightarrow> (\\<lceil>p\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>q\\<rceil>\\<^sub>>) \\<sqsubseteq> II\"\n  by rel_auto\n    \nsubsection \\<open>Assignment Laws\\<close>\ntext \\<open>In this section we introduce the algebraic laws of programming related to the assignment\n      statement.\\<close>\n\nlemma \"&v\\<lbrakk>expr/v\\<rbrakk> = [v \\<mapsto>\\<^sub>s expr] \\<dagger> &v\" ..\n\nlemma usubst_cancel[usubst,symbolic_exec]:\n  assumes 1:\"weak_lens v\"\n  shows \"(&v)\\<lbrakk>expr/v\\<rbrakk> = expr\"\n  using 1\n  by transfer' rel_auto\n\nlemma usubst_cancel_r[usubst,symbolic_exec]:\n  assumes 1:\"weak_lens v\"\n  shows \"($v)\\<lbrakk>\\<lceil>expr\\<rceil>\\<^sub></$v\\<rbrakk>= \\<lceil>expr\\<rceil>\\<^sub><\"\n  using 1\n  by  rel_auto\n\nlemma assign_test[symbolic_exec]:\n  assumes 1:\"mwb_lens x\"\n  shows     \"(x :== \\<guillemotleft>u\\<guillemotright> ;; x :== \\<guillemotleft>v\\<guillemotright>) = (x :== \\<guillemotleft>v\\<guillemotright>)\"\n  using 1\n  by (simp add: assigns_comp subst_upd_comp subst_lit usubst_upd_idem)\n\nlemma assign_r_comp[symbolic_exec]:\n  \"(x :== u ;; P) = P\\<lbrakk>\\<lceil>u\\<rceil>\\<^sub></$x\\<rbrakk>\"\n  by (simp add: assigns_r_comp usubst)\n\nlemma assign_twice[symbolic_exec]:\n  assumes \"mwb_lens x\" and  \"x \\<sharp> f\"\n  shows \"(x :== e ;; x :== f) = (x :== f)\"\n  using assms\n  by (simp add: assigns_comp usubst)\n\nlemma assign_commute:\n  assumes \"x \\<bowtie> y\" \"x \\<sharp> f\" \"y \\<sharp> e\"\n  shows \"(x :== e ;; y :== f) = (y :== f ;; x :== e)\"\n  using assms\n  by (rel_auto, simp_all add: lens_indep_comm)\n\nlemma assign_cond:\n  fixes x :: \"('a \\<Longrightarrow> '\\<alpha>)\"\n  assumes \"out\\<alpha> \\<sharp> b\"\n  shows \"(x :== e ;; (P \\<triangleleft> b \\<triangleright> Q)) =\n         ((x :== e ;; P) \\<triangleleft>b\\<lbrakk>\\<lceil>e\\<rceil>\\<^sub></$x\\<rbrakk>\\<triangleright> (x :== e ;; Q))\"\n  by rel_auto\n\nlemma assign_rcond[symbolic_exec]:\n  fixes x :: \"('a \\<Longrightarrow> '\\<alpha>)\"\n  shows \"(x :== e ;; (P \\<triangleleft> b \\<triangleright>\\<^sub>r Q)) = ((x :== e ;; P) \\<triangleleft> (b\\<lbrakk>e/x\\<rbrakk>) \\<triangleright>\\<^sub>r (x :== e ;; Q))\"\n  by rel_auto\n\nlemma assign_uop1[symbolic_exec_assign_uop]:\n  assumes 1: \"mwb_lens v\"\n  shows \"(v :== e1 ;; v :== (uop F (&v))) = (v :== (uop F e1))\"\n  using 1\n  by rel_auto\n\nlemma assign_bop1[symbolic_exec_assign_bop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> e2\"\n  shows \"(v :== e1 ;; v :== (bop bp (&v) e2)) = (v :== (bop bp e1 e2))\"\n  using 1 2\n  by rel_auto\n\nlemma assign_bop2[symbolic_exec_assign_bop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> e2\"\n  shows \"(v :== e1 ;; v :== (bop bp e2 (&v))) = (v :== (bop bp e2 e1))\"\n  using 1 2\n  by rel_auto\n\nlemma assign_trop1[symbolic_exec_assign_trop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> e2\" and 3:\"v \\<sharp> e3\"\n  shows \"(v :== e1 ;; v :== (trop tp (&v) e2 e3)) =\n         (v :== (trop tp e1 e2 e3))\"\n  using 1 2 3\n  by rel_auto\n\nlemma assign_trop2[symbolic_exec_assign_trop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> e2\" and 3:\"v \\<sharp> e3\"\n  shows \"(v :== e1 ;; v :== (trop tp e2 (&v) e3)) =\n         (v :== (trop tp e2 e1 e3))\"\n  using 1 2 3\n  by rel_auto\n\nlemma assign_trop3[symbolic_exec_assign_trop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> e2\" and 3:\"v \\<sharp> e3\"\n  shows \"(v :== e1 ;; v :== (trop tp e2 e3 (&v))) =\n         (v :== (trop tp e2 e3 e1))\"\n  using 1 2 3\n  by rel_auto\n\nlemma assign_qtop1[symbolic_exec_assign_qtop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> e2\" and 3:\"v \\<sharp> e3\" and 4:\"v \\<sharp> e4\"\n  shows \"(v :== e1 ;; v :== (qtop tp (&v) e2 e3 e4)) =\n         (v :== (qtop tp e1 e2 e3 e4))\"\n  using 1 2 3 4\n  by rel_auto\n\nlemma assign_qtop2[symbolic_exec_assign_qtop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> e2\" and 3:\"v \\<sharp> e3\" and 4:\"v \\<sharp> e4\"\n  shows \"(v :== e1 ;; v :== (qtop tp e2 (&v) e3 e4)) =\n         (v :== (qtop tp e2 e1 e3 e4))\"\n  using 1 2 3 4\n  by rel_auto\n\nlemma assign_qtop3[symbolic_exec_assign_qtop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> e2\" and 3:\"v \\<sharp> e3\" and 4:\"v \\<sharp> e4\"\n  shows \"(v :== e1 ;; v :== (qtop tp e2 e3 (&v) e4)) =\n         (v :== (qtop tp e2 e3 e1 e4))\"\n  using 1 2 3 4\n  by rel_auto\n\nlemma assign_qtop4[symbolic_exec_assign_qtop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> e2\" and 3:\"v \\<sharp> e3\" and 4:\"v \\<sharp> e4\"\n  shows \"(v :== e1 ;; v :== (qtop tp e2 e3 e4 (&v))) =\n         (v :== (qtop tp e2 e3 e4 e1))\"\n  using 1 2 3 4\n  by rel_auto\n\nlemma assign_cond_seqr_dist:\n  \"(v :== e ;; (P \\<triangleleft> b \\<triangleright> Q)) = ((v :== e ;; P) \\<triangleleft> b\\<lbrakk>\\<lceil>e\\<rceil>\\<^sub></$v\\<rbrakk> \\<triangleright> (v :== e ;; Q))\"\n  by rel_auto \n\ntext \\<open>In the sequel we find assignment laws proposed by Hoare\\<close>\n\nlemma assign_vwb_skip:\n  assumes 1: \"vwb_lens v\"\n  shows \"(v :== &v) = II\"\n  by (simp add: assms skip_r_def usubst_upd_var_id)\n  \nlemma assign_simultaneous:\n  assumes  1: \"vwb_lens v2\"\n  and      2: \"v1 \\<bowtie> v2\"\n  shows \"(v1,v2 :== e, (&v2)) =  (v1 :== e)\"\n  by (simp add: 1 2 usubst_upd_comm usubst_upd_var_id)\n\nlemma assign_seq:\n  assumes  1: \"vwb_lens var2\"\n  shows\"(var1:== expr);; (var2 :== &var2) = (var1:== expr)\"\n  using 1 by rel_auto\n\nlemma assign_cond_uop[symbolic_exec_assign_uop]:\n  assumes 1: \"weak_lens v\"\n  shows \"v :== expr ;; (C1 \\<triangleleft>uop F (&v)\\<triangleright>\\<^sub>r  C2)  =\n         (v :== expr ;; C1) \\<triangleleft>uop F expr\\<triangleright>\\<^sub>r (v :== expr ;; C2)\"\n  using 1\n  by rel_auto\n\nlemma assign_cond_bop1[symbolic_exec_assign_bop]:\n  assumes 1: \"weak_lens v\" and 2: \"v \\<sharp> exp2\"\n  shows \"(v :== expr ;; (C1 \\<triangleleft>(bop bp (&v) exp2)\\<triangleright>\\<^sub>r C2)) =\n         ((v :== expr ;; C1) \\<triangleleft>(bop bp expr exp2)\\<triangleright>\\<^sub>r  (v :== expr ;; C2))\"\n  using 1 2\n  by rel_auto\n\nlemma assign_cond_bop2[symbolic_exec_assign_bop]:\n  assumes 1: \"weak_lens v\" and 2: \"v \\<sharp> exp2\"\n  shows \"(v :== exp1 ;; (C1 \\<triangleleft>(bop bp exp2 (&v))\\<triangleright>\\<^sub>r C2)) =\n         ((v :== exp1 ;; C1) \\<triangleleft>(bop bp exp2 exp1)\\<triangleright>\\<^sub>r (v :== exp1 ;; C2))\"\n  using 1 2\n  by rel_auto\n\nlemma assign_cond_trop1[symbolic_exec_assign_trop]:\n  assumes 1: \"weak_lens v\" and 2: \"v \\<sharp> exp2\" and 3: \"v \\<sharp> exp3\"\n  shows \"(v :== expr ;; (C1 \\<triangleleft>(trop tp (&v) exp2 exp3)\\<triangleright>\\<^sub>r C2)) =\n         ((v :== expr ;; C1) \\<triangleleft>(trop tp expr exp2 exp3)\\<triangleright>\\<^sub>r (v :== expr ;; C2))\"\n  using 1 2 3\n  by rel_auto\n\nlemma assign_cond_trop2[symbolic_exec_assign_trop]:\n  assumes 1: \"weak_lens v\" and 2: \"v \\<sharp> exp2\" and 3: \"v \\<sharp> exp3\"\n  shows \"(v :== exp1 ;; (C1 \\<triangleleft>(trop tp exp2 (&v) exp3)\\<triangleright>\\<^sub>r C2)) =\n         ((v :== exp1 ;; C1) \\<triangleleft>(trop tp exp2 exp1 exp3)\\<triangleright>\\<^sub>r (v :== exp1 ;; C2))\"\n  using 1 2 3\n  by rel_auto\n\nlemma assign_cond_trop3[symbolic_exec_assign_trop]:\n  assumes 1: \"weak_lens v\" and 2: \"v \\<sharp> exp2\" and 3: \"v \\<sharp> exp3\"\n  shows \"(v :== exp1 ;; (C1 \\<triangleleft>(trop bp exp2 exp3 (&v))\\<triangleright>\\<^sub>r C2)) =\n         ((v :== exp1 ;; C1) \\<triangleleft>(trop bp exp2 exp3 exp1)\\<triangleright>\\<^sub>r (v :== exp1 ;; C2))\"\n  using 1 2 3\n  by rel_auto\n\nlemma assign_cond_qtop1[symbolic_exec_assign_qtop]:\n  assumes 1: \"weak_lens v\" and 2: \"v \\<sharp> exp2\" and 3: \"v \\<sharp> exp3\" and 4: \"v \\<sharp> exp4\"\n  shows \"(v :== exp1 ;; (C1 \\<triangleleft>(qtop tp (&v) exp2 exp3 exp4)\\<triangleright>\\<^sub>r C2)) =\n         ((v :== exp1 ;; C1) \\<triangleleft>(qtop tp exp1 exp2 exp3  exp4)\\<triangleright>\\<^sub>r (v :== exp1 ;; C2))\"\n  using 1 2 3 4\n  by rel_auto\n\nlemma assign_cond_qtop2[symbolic_exec_assign_qtop]:\n  assumes 1: \"weak_lens v\" and 2: \"v \\<sharp> exp2\" and 3: \"v \\<sharp> exp3\" and 4:\"v \\<sharp> exp4\"\n  shows \"(v :== exp1 ;; (C1 \\<triangleleft>(qtop tp exp2 (&v) exp3 exp4)\\<triangleright>\\<^sub>r C2)) =\n         ((v :== exp1 ;; C1) \\<triangleleft>(qtop tp exp2 exp1 exp3 exp4)\\<triangleright>\\<^sub>r  (v :== exp1 ;; C2))\"\n  using 1 2 3 4\n  by rel_auto\n\nlemma assign_cond_qtop3[symbolic_exec_assign_qtop]:\n  assumes 1: \"weak_lens v\" and 2: \"v \\<sharp> exp2\" and 3: \"v \\<sharp> exp3\" and 4: \"v \\<sharp> exp4\"\n  shows \"(v :== exp1 ;; (C1 \\<triangleleft>(qtop bp exp2 exp3 (&v) exp4)\\<triangleright>\\<^sub>r C2)) =\n         ((v :== exp1 ;; C1) \\<triangleleft>(qtop bp exp2 exp3 exp1  exp4)\\<triangleright>\\<^sub>r (v :== exp1 ;; C2))\"\n  using 1 2 3 4\n  by rel_auto\n\nlemma assign_cond_qtop4[symbolic_exec_assign_qtop]:\n  assumes 1: \"weak_lens v\" and 2: \"v \\<sharp> exp2\" and 3: \"v \\<sharp> exp3\" and 4: \"v \\<sharp> exp4\"\n  shows \"(v :== exp1 ;; (C1 \\<triangleleft>(qtop bp exp2 exp3 exp4 (&v))\\<triangleright>\\<^sub>r C2)) =\n         ((v :== exp1 ;; C1) \\<triangleleft>(qtop bp exp2 exp3  exp4 exp1)\\<triangleright>\\<^sub>r (v :== exp1 ;; C2))\"\n  using 1 2 3 4\n  by rel_auto\n\nlemma assign_cond_If [symbolic_exec]:\n  \"((v :== exp1) \\<triangleleft> bexp\\<triangleright>\\<^sub>r (v :== exp2)) =\n   (v :== (trop If bexp exp1 exp2))\"\n  by rel_auto\n\nlemma assign_cond_If_uop[symbolic_exec_assign_uop]:\n  assumes 1: \"mwb_lens v\"\n  shows \"(v :== E;;\n         ((v :== uop F (&v)) \\<triangleleft>uop F (&v)\\<triangleright>\\<^sub>r (v :== uop G (&v)))) =\n         (v :== trop If (uop F E) (uop F E) (uop G E))\"\n  using 1\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_bop[symbolic_exec_assign_bop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> expr\"\n  shows \"((v :== E);;\n          ((v :== (bop F expr (&v))) \\<triangleleft>bop F expr (&v)\\<triangleright>\\<^sub>r (v :== (bop G expr (&v))))) =\n         (v :== (trop If (bop F expr E) (bop F expr E) (bop G expr E)))\"\n  using 1 2\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_bop1[symbolic_exec_assign_bop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> expr\"\n  shows \"((v :== E);;\n          ((v :== (bop F (&v) expr)) \\<triangleleft>bop F (&v) expr\\<triangleright>\\<^sub>r (v :== (bop G (&v) expr)))) =\n         (v :== (trop If (bop F E expr) (bop F E expr) (bop G E expr)))\"\n  using 1 2\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_bop2[symbolic_exec_assign_bop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> exp1\" and 3:\"v \\<sharp> exp2\"\n  shows \"((v :== E);;\n          ((v :== (bop F (&v) exp1)) \\<triangleleft>bop F (&v) exp1\\<triangleright>\\<^sub>r (v :== (bop G (&v) exp2)))) =\n         (v :== (trop If (bop F E exp1) (bop F E exp1) (bop G E exp2)))\"\n  using 1 2 3\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_bop4[symbolic_exec_assign_bop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> exp1\" and 3:\"v \\<sharp> exp2\"\n  shows \"((v :== E);;\n          ((v :== (bop F (&v) exp1)) \\<triangleleft>bop F (&v) exp1\\<triangleright>\\<^sub>r (v :== (bop G exp2 (&v))))) =\n         (v :== (trop If (bop F E exp1) (bop F E exp1) (bop G exp2 E)))\"\n  using 1 2 3\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_bop5[symbolic_exec_assign_bop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> exp1\" and 3:\"v \\<sharp> exp2\"\n  shows \"((v :== E);;\n          ((v :== (bop F exp1 (&v))) \\<triangleleft>bop F exp1 (&v)\\<triangleright>\\<^sub>r (v :== (bop G (&v) exp2)))) =\n         (v :== (trop If (bop F exp1 E) (bop F exp1 E) (bop G E exp2)))\"\n  using 1 2 3\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_bop6[symbolic_exec_assign_bop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> exp1\" and 3:\"v \\<sharp> exp2\"\n  shows \"((v :== E);;\n          ((v :== (bop F exp1 (&v))) \\<triangleleft>bop F exp1 (&v)\\<triangleright>\\<^sub>r (v :== (bop G exp2 (&v))))) =\n         (v :== (trop If (bop F exp1 E) (bop F exp1 E) (bop G exp2 E)))\"\n  using 1 2 3\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_trop[symbolic_exec_assign_trop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> exp1\" and 3:\"v \\<sharp> exp2\"\n  shows \"((v :== E);;\n         ((v :== (trop F exp1 exp2 (&v))) \\<triangleleft>trop F exp1 exp2 (&v)\\<triangleright>\\<^sub>r (v :== (trop G exp1 exp2 (&v))))) =\n         (v :== (trop If (trop F exp1 exp2 E) (trop F exp1 exp2 E) (trop G exp1 exp2 E)))\"\n  using 1 2 3\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_trop1[symbolic_exec_assign_trop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> exp1\" and 3:\"v \\<sharp> exp2\"\n  shows \"((v :== E);;\n          ((v :== (trop F exp1 (&v) exp2)) \\<triangleleft>trop F exp1 (&v) exp2\\<triangleright>\\<^sub>r (v :== (trop G exp1 (&v) exp2)))) =\n         (v :== (trop If (trop F exp1 E exp2) (trop F exp1 E exp2) (trop G exp1 E exp2)))\"\n  using 1 2 3\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_trop2[symbolic_exec_assign_trop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> exp1\" and 3:\"v \\<sharp> exp2\"\n  shows \"((v :== E);;\n          ((v :== (trop F (&v) exp1 exp2)) \\<triangleleft>trop F (&v) exp1 exp2\\<triangleright>\\<^sub>r (v :== (trop G (&v) exp1 exp2)))) =\n         (v :== (trop If (trop F E exp1 exp2) (trop F E exp1 exp2) (trop G E exp1 exp2)))\"\n  using 1 2 3\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_trop3[symbolic_exec_assign_trop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> exp1\" and 3:\"v \\<sharp> exp2\" and 4:\"v \\<sharp> exp3\" and 5:\"v \\<sharp> exp4\"\n  shows \"((v :== E);;\n          ((v :== (trop F exp1 exp2 (&v))) \\<triangleleft>trop F exp1 exp2 (&v)\\<triangleright>\\<^sub>r (v :== (trop G exp3 exp4 (&v))))) =\n         (v :== (trop If (trop F exp1 exp2 E) (trop F exp1 exp2 E) (trop G exp3 exp4 E)))\"\n  using 1 2 3 4 5\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_trop4[symbolic_exec_assign_trop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> exp1\" and 3:\"v \\<sharp> exp2\" and 4:\"v \\<sharp> exp3\" and 5:\"v \\<sharp> exp4\"\n  shows \"((v :== E);;\n         ((v :== (trop F exp1 (&v) exp2)) \\<triangleleft>trop F exp1 (&v) exp2\\<triangleright>\\<^sub>r (v :== (trop G exp3 (&v) exp4)))) =\n         (v :== (trop If (trop F exp1 E exp2) (trop F exp1 E exp2) (trop G exp3 E exp4)))\"\n  using 1 2 3 4 5\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nlemma assign_cond_If_trop5[symbolic_exec_assign_trop]:\n  assumes 1: \"mwb_lens v\" and 2:\"v \\<sharp> exp1\" and 3:\"v \\<sharp> exp2\" and 4:\"v \\<sharp> exp3\" and 5:\"v \\<sharp> exp4\"\n  shows \"((v :== E);;\n          ((v :== (trop F (&v) exp1 exp2)) \\<triangleleft>trop F (&v) exp1 exp2\\<triangleright>\\<^sub>r (v :== (trop G (&v) exp3 exp4)))) =\n         (v :== (trop If (trop F E exp1 exp2) (trop F E exp1 exp2) (trop G E exp3 exp4)))\"\n  using 1 2 3 4 5\nproof (rel_simp, transfer)\n  fix a :: 'a and b :: 'a and va :: \"bool \\<Longrightarrow> 'a\" and Fa :: \"bool \\<Rightarrow> bool\" and Ea :: \"'a \\<Rightarrow> bool\" and Ga :: \"bool \\<Rightarrow> bool\"\n  have \"Fa (Ea a) \\<longrightarrow> (Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)) \\<and> (\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)))\"\n    by presburger\n  then have \"\\<not> ((\\<not> Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a))) \\<and> (Fa (Ea a) \\<or> \\<not> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a)))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by fastforce\n  then show \"(Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Fa (Ea a)) \\<or> \\<not> Fa (Ea a) \\<and> b = put\\<^bsub>va\\<^esub> a (Ga (Ea a))) = (b = put\\<^bsub>va\\<^esub> a (Fa (Ea a) \\<or> \\<not> Fa (Ea a) \\<and> Ga (Ea a)))\"\n    by meson\nqed\n\nsubsection \\<open>Conditional Laws\\<close>\ntext \\<open>In this section we introduce the algebraic laws of programming related to the conditional\n      statement.\\<close>\nnamed_theorems urel_cond\nlemma cond_idem[urel_cond]:\n  \"(P \\<triangleleft> b \\<triangleright> P) = P\"\n  by rel_auto\n\nlemma cond_symm:\n  \"(P \\<triangleleft> b \\<triangleright> Q) = (Q \\<triangleleft>\\<not> b\\<triangleright> P)\"\n  by rel_auto\n\nlemma cond_assoc:\n  \"(P \\<triangleleft> b \\<triangleright> (Q \\<triangleleft> b \\<triangleright> R)) = ((P \\<triangleleft> b \\<triangleright> Q) \\<triangleleft> b \\<triangleright>  R)\"\n  by rel_auto\n\nlemma cond_distr[urel_cond]:\n  \"((P \\<triangleleft> b'\\<triangleright> R) \\<triangleleft> b \\<triangleright> (Q \\<triangleleft> b'\\<triangleright> R))= ((P \\<triangleleft> b \\<triangleright> Q) \\<triangleleft> b'\\<triangleright> R)\"\n  by rel_auto\n\nlemma cond_unit_T:\n  \"(P \\<triangleleft>true\\<triangleright> Q) = P\"\n  by auto\n\nlemma cond_unit_F:\n  \"(P \\<triangleleft>false\\<triangleright> Q) = Q\"\n  by auto\n\nlemma cond_and_T_integrate[urel_cond]:\n  \"((P \\<and> b) \\<or> (Q \\<triangleleft> b \\<triangleright> R)) = ((P \\<or> Q) \\<triangleleft> b \\<triangleright> R)\"\n  by rel_auto\n\nlemma cond_L6[urel_cond]:\n  \"(P \\<triangleleft> b \\<triangleright> (Q \\<triangleleft> b \\<triangleright> R)) = (P \\<triangleleft> b \\<triangleright> R)\"\n  by rel_auto\n\n\nlemma cond_L7[urel_cond]:\n  \"(P \\<triangleleft> b \\<triangleright> (P \\<triangleleft> c \\<triangleright> Q)) = (P \\<triangleleft> b \\<or> c \\<triangleright> Q)\"\n  by rel_auto\n\nlemma cond_and_distr[urel_cond]:\n  \"((P \\<and> Q) \\<triangleleft> b \\<triangleright> (R \\<and> S)) = ((P \\<triangleleft> b \\<triangleright> R) \\<and> (Q \\<triangleleft> b \\<triangleright> S))\"\n  by rel_auto\n\nlemma cond_or_distr[urel_cond]:\n  \"((P \\<or> Q) \\<triangleleft> b \\<triangleright> (R \\<or> S)) = ((P \\<triangleleft> b \\<triangleright> R) \\<or> (Q \\<triangleleft> b \\<triangleright> S))\"\n  by rel_auto\n\nlemma cond_imp_distr[urel_cond]:\n  \"((P \\<Rightarrow> Q) \\<triangleleft> b \\<triangleright> (R \\<Rightarrow> S)) =\n   ((P \\<triangleleft> b \\<triangleright> R) \\<Rightarrow> (Q \\<triangleleft> b \\<triangleright> S))\"\n  by rel_auto\n\nlemma cond_eq_distr[urel_cond]:\n  \"((P \\<Leftrightarrow> Q) \\<triangleleft> b \\<triangleright> (R \\<Leftrightarrow> S)) =\n   ((P \\<triangleleft> b \\<triangleright> R) \\<Leftrightarrow> (Q \\<triangleleft> b \\<triangleright> S))\"\n  by rel_auto\n\nlemma cond_ueq_distr[urel_cond]:\n  \"((P =\\<^sub>u Q) \\<triangleleft> b \\<triangleright> (R =\\<^sub>u S)) =\n   ((P \\<triangleleft> b \\<triangleright> R) =\\<^sub>u (Q \\<triangleleft> b \\<triangleright> S))\"\n  by rel_auto\n\nlemma cond_conj_distr[urel_cond]:\n  \"((P \\<and> Q) \\<triangleleft> b \\<triangleright> (P \\<and> S)) = (P \\<and> (Q \\<triangleleft> b \\<triangleright> S))\"\n  by rel_auto\n\nlemma cond_disj_distr [urel_cond]:\n  \"((P \\<or> Q) \\<triangleleft> b \\<triangleright> (P \\<or> S)) = (P \\<or> (Q \\<triangleleft> b \\<triangleright> S))\"\n  by rel_auto\n\nlemma cond_neg[urel_cond]:\n  \"\\<not> (P \\<triangleleft> b \\<triangleright> Q) = ((\\<not> P) \\<triangleleft> b \\<triangleright> (\\<not> Q))\"\n  by rel_auto\n\nlemma cond_conj[urel_cond]:\n  \"(P \\<triangleleft>b \\<and> c\\<triangleright> Q) = (P \\<triangleleft> c \\<triangleright> Q) \\<triangleleft> b \\<triangleright> Q\"\n  by rel_auto\n\n(*IF Theorem by Hoare: It optimize nested IF*)\ntheorem COND12[urel_cond]:\n  \"((C1 \\<triangleleft>bexp2\\<triangleright> C3) \\<triangleleft>bexp1\\<triangleright> (C2 \\<triangleleft>bexp3\\<triangleright> C3)) =\n   ((C1 \\<triangleleft>bexp1\\<triangleright> C2) \\<triangleleft>(bexp2 \\<triangleleft>bexp1\\<triangleright>bexp3)\\<triangleright> C3)\"\n  by rel_auto\n\nlemma comp_cond_left_distr:\n  \"((P \\<triangleleft> b \\<triangleright>\\<^sub>r Q) ;; R) = ((P ;; R) \\<triangleleft> b \\<triangleright>\\<^sub>r (Q ;; R))\"\n  by rel_auto\n\nlemma cond_var_subst_left[urel_cond]:\n  assumes \"vwb_lens x\"\n  shows \"(P\\<lbrakk>true/x\\<rbrakk> \\<triangleleft>&x \\<triangleright> Q) = (P \\<triangleleft>&x \\<triangleright> Q)\"\n  using assms\n  apply rel_auto apply transfer\n  using vwb_lens.put_eq by fastforce\n\nlemma cond_var_subst_right[urel_cond]:\n  assumes \"vwb_lens x\"\n  shows \"(P \\<triangleleft>&x \\<triangleright> Q\\<lbrakk>false/x\\<rbrakk>) = (P \\<triangleleft>&x \\<triangleright> Q)\"\n  using assms\n  apply pred_auto apply transfer\n  by (metis (full_types) vwb_lens.put_eq)\n\nlemma cond_var_split[urel_cond]:\n  \"vwb_lens x \\<Longrightarrow> (P\\<lbrakk>true/x\\<rbrakk> \\<triangleleft>&x \\<triangleright> P\\<lbrakk>false/x\\<rbrakk>) = P\"\n  by (rel_auto, (metis (full_types) vwb_lens.put_eq)+)\n\nlemma cond_seq_left_distr[urel_comp]:\n  \"out\\<alpha> \\<sharp> b \\<Longrightarrow> ((P \\<triangleleft> b \\<triangleright> Q) ;; R) = ((P ;; R) \\<triangleleft> b \\<triangleright> (Q ;; R))\"\n  by rel_auto\n\nlemma cond_seq_right_distr[urel_comp]:\n  \"in\\<alpha> \\<sharp> b \\<Longrightarrow> (P ;; (Q \\<triangleleft> b \\<triangleright> R)) = ((P ;; Q) \\<triangleleft> b \\<triangleright> (P ;; R))\"\n  by rel_auto\n\nsubsection \\<open>Sequential Laws\\<close>\ntext \\<open>In this section we introduce the algebraic laws of programming related to the sequential\n      composition of statements.\\<close>\n\n\nlemma seqr_exists_left[symbolic_exec]:\n  \"((\\<exists> $x \\<bullet> P) ;; Q) = (\\<exists> $x \\<bullet> (P ;; Q))\"\n  by rel_auto\n\nlemma seqr_exists_right[symbolic_exec]:\n  \"(P ;; (\\<exists> $x\\<acute> \\<bullet> Q)) = (\\<exists> $x\\<acute> \\<bullet> (P ;; Q))\"\n  by rel_auto\n\nlemma seqr_left_zero [simp, symbolic_exec_ex]:\n  \"false ;; P = false\"\n  by pred_auto\n\nlemma seqr_right_zero [simp, symbolic_exec_ex]:\n  \"P ;; false = false\"\n  by pred_auto\n\nlemma seqr_or_distr[urel_comp]:\n  \"(P ;; (Q \\<or> R)) = ((P ;; Q) \\<or> (P ;; R))\"\n  by rel_auto\n\nlemma seqr_unfold:\n  \"(P ;; Q) = (\\<^bold>\\<exists> v \\<bullet> P\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/$\\<Sigma>\\<acute>\\<rbrakk> \\<and> Q\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/$\\<Sigma>\\<rbrakk>)\"\n  by rel_auto\n\nlemma seqr_middle:\n  assumes \"vwb_lens x\"\n  shows \"(P ;; Q) = (\\<^bold>\\<exists> v \\<bullet> P\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/$x\\<acute>\\<rbrakk> ;; Q\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/$x\\<rbrakk>)\"\n  using assms\n  apply (rel_auto robust)\n  apply (rename_tac xa P Q a b y)\n  apply (rule_tac x=\"get\\<^bsub>xa\\<^esub> y\" in exI)\n  apply (rule_tac x=\"y\" in exI)\n  apply (simp)\ndone\n\nlemma seqr_left_one_point[urel_comp]:\n  assumes \"vwb_lens x\"\n  shows \"((P \\<and> $x\\<acute> =\\<^sub>u \\<guillemotleft>v\\<guillemotright>) ;; Q) = (P\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/$x\\<acute>\\<rbrakk> ;; Q\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/$x\\<rbrakk>)\"\n  using assms\n  by (rel_auto, metis vwb_lens_wb wb_lens.get_put)\n\nlemma seqr_right_one_point[urel_comp]:\n  assumes \"vwb_lens x\"\n  shows \"(P ;; ($x =\\<^sub>u \\<guillemotleft>v\\<guillemotright> \\<and> Q)) = (P\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/$x\\<acute>\\<rbrakk> ;; Q\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/$x\\<rbrakk>)\"\n  using assms\n  by (rel_auto, metis vwb_lens_wb wb_lens.get_put)\n\nlemma seqr_insert_ident_left[urel_comp]:\n  assumes \"vwb_lens x\" \"$x\\<acute> \\<sharp> P\" \"$x \\<sharp> Q\"\n  shows \"(($x\\<acute> =\\<^sub>u $x \\<and> P) ;; Q) = (P ;; Q)\"\n  using assms\n  by (rel_auto, meson vwb_lens_wb wb_lens_weak weak_lens.put_get)\n\nlemma seqr_insert_ident_right[urel_comp]:\n  assumes \"vwb_lens x\" \"$x\\<acute> \\<sharp> P\" \"$x \\<sharp> Q\"\n  shows \"(P ;; ($x\\<acute> =\\<^sub>u $x \\<and> Q)) = (P ;; Q)\"\n  using assms\n  by (rel_auto, metis (no_types, hide_lams) vwb_lens_def wb_lens_def weak_lens.put_get)\n\nlemma seq_var_ident_lift[urel_comp]:\n  assumes \"vwb_lens x\" \"$x\\<acute> \\<sharp> P\" \"$x \\<sharp> Q\"\n  shows \"(($x\\<acute> =\\<^sub>u $x \\<and> P) ;; ($x\\<acute> =\\<^sub>u $x \\<and> Q)) = ($x\\<acute> =\\<^sub>u $x \\<and> (P ;; Q))\"\n  using assms\n  by (rel_auto, metis (no_types, lifting) vwb_lens_wb wb_lens_weak weak_lens.put_get)\n\nlemma seqr_skip: \"II ;; C = C ;; II\"\n  by (metis seqr_left_unit seqr_right_unit)\n\n(*The rules SEQ6 SEQ7 related to SEQ and non-deterministic choice are missing for now*)\n\nsubsection \\<open>While laws for normal designs\\<close>\n\ntext \\<open>In this section we introduce the algebraic laws of programming related to the while\n      statement.\\<close>\n  \nlemma while_gfp_rel_def_alt:\n  \"(while\\<^sup>\\<top> b do body od) = (\\<nu> X \\<bullet> bif b then (body ;; X) else SKIP\\<^sub>r eif)\"\n  unfolding from_until_gfp_rel_def while_gfp_rel_def \n  by simp \n    \nlemma while_lfp_rel_def_alt:\n  \"(while\\<^sub>\\<bottom> b do body od) = (\\<mu> X \\<bullet> bif b then (body ;; X) else SKIP\\<^sub>r eif)\"\n  unfolding from_until_lfp_rel_def while_lfp_rel_def \n  by simp\n    \ntheorem while_gfp_rel_unfold:\n  \"while\\<^sup>\\<top> b do body od = (bif b then (body ;; while\\<^sup>\\<top> b do body od) else SKIP\\<^sub>r eif)\"\nproof -\n  have m:\"mono (\\<lambda>X. bif b then (body ;; X) else SKIP\\<^sub>r eif)\"\n    by (auto intro: monoI seqr_mono cond_mono)\n  have \"(while\\<^sup>\\<top> b do body od) = (\\<nu> X \\<bullet> bif b then (body;; X) else SKIP\\<^sub>r eif)\"\n    by (simp add: while_gfp_rel_def_alt)\n  also have \"... = (bif b then (body ;; (\\<nu> X \\<bullet> bif b then (body ;; X) else SKIP\\<^sub>r eif)) else SKIP\\<^sub>r eif)\"\n    by (rule lfp_fixpoint[THEN sym, OF m])\n  also have \"... = (bif b then (body ;; while\\<^sup>\\<top> b do body od) else SKIP\\<^sub>r eif)\"\n    by (simp add: while_gfp_rel_def_alt)\n  finally show ?thesis .\nqed\n  \ntheorem while_lfp_rel_unfold:\n  \"while\\<^sub>\\<bottom> b do body od = (bif b then (body;; while\\<^sub>\\<bottom> b do body od) else SKIP\\<^sub>r eif)\"\nproof -\n  have m:\"mono (\\<lambda>X. bif b then (body ;; X) else SKIP\\<^sub>r eif)\"\n    by (auto intro: monoI seqr_mono cond_mono)       \n  have \"(while\\<^sub>\\<bottom> b do body od) = (\\<mu> X \\<bullet> bif b then (body ;; X) else SKIP\\<^sub>r eif)\"\n    by (simp add: while_lfp_rel_def_alt)\n  also have \"... = (bif b then (body ;; (\\<mu> X \\<bullet> bif b then (body ;; X) else SKIP\\<^sub>r eif)) else SKIP\\<^sub>r eif)\"\n     by (rule gfp_fixpoint[THEN sym, OF m]) \n  also have \"... = (bif b then (body ;; while\\<^sub>\\<bottom> b do body od) else SKIP\\<^sub>r eif)\"\n    by (simp add: while_lfp_rel_def_alt)\n  finally show ?thesis .\nqed\n    \ntheorem while_lfp_rel_true: \n  \"while\\<^sub>\\<bottom> true do body od = (\\<mu> X \\<bullet> (body;; X))\"\n  by (simp add: while_lfp_rel_def_alt alpha)\n \nlemma while_lfp_rel_false:\n  \"(while\\<^sub>\\<bottom> false do body od) = SKIP\\<^sub>r\"\n  by (simp add: while_lfp_rel_def_alt alpha gfp_const)\n\ntheorem while_gfp_rel_false: \n \"while\\<^sup>\\<top> false do body od = SKIP\\<^sub>r\"\n by (simp add: while_gfp_rel_def_alt alpha lfp_const)\n\ntheorem while_gfp_rel_non_termination: (*because of this lemma and the lemma utp_designs.design_top we do not use gfp for capturing termination *)\n  \"while\\<^sup>\\<top> true do SKIP\\<^sub>r od = false\"\n  unfolding while_gfp_rel_def_alt  \nproof (rule lfp_eqI[of \"(\\<lambda>X. bif true then SKIP\\<^sub>r ;; X else SKIP\\<^sub>r eif)\"] , goal_cases)\n  case 1\n  then show ?case by (auto intro: monoI seqr_mono cond_mono) \nnext\n  case 2\n  then show ?case by rel_simp  \nnext\n  case 3\n  then show ?case by simp                      \nqed\n\ntheorem while_lfp_rel_non_termination: \n  \"while\\<^sub>\\<bottom> true do SKIP\\<^sub>r od = true\"\n  unfolding while_lfp_rel_def_alt\nproof (rule gfp_eqI[of \"(\\<lambda>X. bif true then SKIP\\<^sub>r ;; X else SKIP\\<^sub>r eif)\"] , goal_cases)\n  case 1\n  then show ?case by (auto intro: monoI seqr_mono cond_mono) \nnext\n  case 2\n  then show ?case  by rel_simp  \nnext\n  case 3\n  then show ?case by simp                       \nqed    \n\ntext \\<open>An infinite loop with a feasible body corresponds to a program error (non-termination).\\<close>\n\ntheorem while_infinite: \n  assumes is_in_abort_situation: \"P ;; true\\<^sub>h = true\" \n  shows \"while\\<^sub>\\<bottom> true do P od = true\"    \n  apply (simp add: while_lfp_rel_true)\n  apply (rule antisym)\n  apply (simp)\n  apply (rule gfp_upperbound)\n  apply (simp add: assms)\n  done\n    \nsubsection \\<open>Other Iteration laws for relations\\<close>\n  \ntheorem from_until_gfp_rel_alt_def:\n  \"from\\<^sup>\\<top> init until exit do body od = init ;; while\\<^sup>\\<top> \\<not> exit do body od\"\n  unfolding while_gfp_rel_def_alt from_until_gfp_rel_def \n  by simp  \n\nlemma from_until_while_gfp_rel:\n  \"from\\<^sup>\\<top> SKIP\\<^sub>r until exit do body od = while\\<^sup>\\<top> \\<not> exit do body od\"\n  unfolding from_until_gfp_rel_alt_def\n  by simp\n    \ntheorem from_until_gfp_rel_unfold:\n  \"from\\<^sup>\\<top> init until exit do body od = \n   init ;; (bif \\<not> exit then (body;; while\\<^sup>\\<top> \\<not> exit do body od) else SKIP\\<^sub>r eif)\"\n  unfolding from_until_gfp_rel_alt_def using while_gfp_rel_unfold[of \"\\<not>exit\"]\n  by simp\n    \ntheorem from_until_lfp_rel_alt_def:\n  \"from\\<^sub>\\<bottom> init until exit do body od = init ;; while\\<^sub>\\<bottom> \\<not> exit do body od\"\n  unfolding while_lfp_rel_def_alt from_until_lfp_rel_def \n  by simp  \n\nlemma from_until_while_lfp_rel:\n  \"from\\<^sub>\\<bottom> SKIP\\<^sub>r until exit do body od = while\\<^sub>\\<bottom> \\<not> exit do body od\"\n  unfolding from_until_lfp_rel_alt_def\n  by simp\n    \ntheorem from_until_lfp_rel_unfold:\n  \"from\\<^sub>\\<bottom> init until exit do body od = \n   init ;; (bif \\<not> exit then (body;; while\\<^sub>\\<bottom> \\<not> exit do body od) else SKIP\\<^sub>r eif)\"\n  unfolding from_until_lfp_rel_alt_def using while_lfp_rel_unfold[of \"\\<not>exit\"]\n  by simp\n\ntheorem do_while_gfp_rel_alt_def:\n  \"do body while\\<^sup>\\<top> exit od = body ;; while\\<^sup>\\<top> exit do body od\"\n  unfolding  do_while_gfp_rel_def from_until_gfp_rel_alt_def\n  by simp  \n    \ntheorem do_while_gfp_rel_unfold:\n  \"do body while\\<^sup>\\<top> exit od = \n   body ;; (bif exit then (body;; while\\<^sup>\\<top> exit do body od) else SKIP\\<^sub>r eif)\"\n  unfolding do_while_gfp_rel_alt_def using while_gfp_rel_unfold[of exit]\n  by simp\n\ntheorem do_while_lfp_rel_alt_def:\n  \"do body while\\<^sub>\\<bottom> exit od = body ;; while\\<^sub>\\<bottom> exit do body od\"\n  unfolding  do_while_lfp_rel_def from_until_lfp_rel_alt_def\n  by simp  \n    \ntheorem do_while_lfp_rel_unfold:\n  \"do body while\\<^sub>\\<bottom> exit od = \n   body ;; (bif exit then (body;; while\\<^sub>\\<bottom> exit do body od) else SKIP\\<^sub>r eif)\"\n  unfolding do_while_lfp_rel_alt_def using while_lfp_rel_unfold[of exit]\n  by simp    \n\ntheorem for_gfp_rel_alt_def:\n  \"for\\<^sup>\\<top> (init, exit, incr) do body od = init ;; while\\<^sup>\\<top> exit do body;;incr od\"\n  unfolding  for_gfp_rel_def from_until_gfp_rel_alt_def\n  by simp  \n    \ntheorem for_gfp_rel_unfold: \n  shows \"for\\<^sup>\\<top> (init, exit, incr) do body od = \n         init ;; (bif exit then (body;;incr;;while\\<^sup>\\<top> exit do body ;; incr od) else SKIP\\<^sub>r eif)\"\n  unfolding for_gfp_rel_alt_def using while_gfp_rel_unfold \n  by (metis seqr_assoc)\n\ntheorem for_lfp_rel_alt_def:\n \"for\\<^sub>\\<bottom> (init, exit, incr) do body od = init ;; while\\<^sub>\\<bottom> exit do body;;incr od\"\n  unfolding  for_lfp_rel_def from_until_lfp_rel_alt_def\n  by simp  \n    \ntheorem for_lfp_rel_unfold:\n  \"for\\<^sub>\\<bottom> (init, exit, incr) do body od = \n   init ;; (bif exit then (body;;incr;;while\\<^sub>\\<bottom> exit do body ;; incr od) else SKIP\\<^sub>r eif)\"\n  unfolding for_lfp_rel_alt_def using while_lfp_rel_unfold \n  by (metis seqr_assoc)  \n\nsubsection \\<open>assume and assert laws\\<close>\n\nlemma assume_twice[urel_comp]: \"(b\\<^sup>\\<top> ;; c\\<^sup>\\<top>) = (b \\<and> c)\\<^sup>\\<top>\"\n  by rel_auto\n\nlemma assert_twice[urel_comp]: \"(b\\<^sub>\\<bottom> ;; c\\<^sub>\\<bottom>) = (b \\<and> c)\\<^sub>\\<bottom>\"\n  by rel_auto\n\nsubsection \\<open>Relation algebra laws\\<close>\n\ntheorem RA1: \"(P ;; (Q ;; R)) = ((P ;; Q) ;; R)\"\n  using seqr_assoc by auto\n\ntheorem RA2: \"(P ;; II) = P\" \"(II ;; P) = P\"\n  by simp_all\n\ntheorem RA3: \"P\\<^sup>-\\<^sup>- = P\"\n  by simp\n\ntheorem RA4: \"(P ;; Q)\\<^sup>- = (Q\\<^sup>- ;; P\\<^sup>-)\"\n  by simp\n\ntheorem RA5: \"(P \\<or> Q)\\<^sup>- = (P\\<^sup>- \\<or> Q\\<^sup>-)\"\n  by (rel_auto)\n\ntheorem RA6[urel_comp]: \"((P \\<or> Q) ;; R) = ((P;;R) \\<or> (Q;;R))\"\n  using seqr_or_distl by blast\n\n\n\nsubsection \\<open>Refinement rules\\<close>\n\nlemma reverse_impl_refine:\n  \"`Q2 \\<Rightarrow> Q1`  = (Q1 \\<sqsubseteq> Q2)\"\n  by pred_auto    \n  \nlemma pre_weak_rel:\n  assumes \"`Pre \\<Rightarrow> I`\"\n  and     \"(I \\<Rightarrow> Post) \\<sqsubseteq> P\"\n  shows \"(Pre \\<Rightarrow> Post) \\<sqsubseteq> P\"\n using assms\n  by(rel_auto)\n    \nlemma post_str_rel: \n  \"(p\\<Rightarrow>q) \\<sqsubseteq> P \\<Longrightarrow> `q\\<Rightarrow>r` \\<Longrightarrow> (p\\<Rightarrow>r) \\<sqsubseteq> P\"\n  by pred_blast\n        \nlemma cond_refine_rel: \n  assumes \"(b \\<and> p \\<Rightarrow> q) \\<sqsubseteq> C\\<^sub>1\" and \"(\\<not>b \\<and> p \\<Rightarrow> q)\\<sqsubseteq> C\\<^sub>2\" \n  shows \"(p \\<Rightarrow> q) \\<sqsubseteq> (C\\<^sub>1 \\<triangleleft> b \\<triangleright> C\\<^sub>2)\"\n  using assms by rel_auto\n    \nlemma cond_refine_pred: \n  assumes \"(\\<lceil>b \\<and> p\\<rceil>\\<^sub><\\<Rightarrow> \\<lceil>q\\<rceil>\\<^sub>>) \\<sqsubseteq> C\\<^sub>1\" and \"(\\<lceil>\\<not>b \\<and> p\\<rceil>\\<^sub><\\<Rightarrow> \\<lceil>q\\<rceil>\\<^sub>>)\\<sqsubseteq> C\\<^sub>2\" \n  shows \"(\\<lceil>p\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>q\\<rceil>\\<^sub>>) \\<sqsubseteq> (C\\<^sub>1 \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>< \\<triangleright> C\\<^sub>2)\"\n  using assms by rel_auto\n\nlemma seq_refine_pred:\n  assumes \"(\\<lceil>p\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>s\\<rceil>\\<^sub>>) \\<sqsubseteq> f\" and \"(\\<lceil>s\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>q\\<rceil>\\<^sub>>) \\<sqsubseteq> fa\"\n  shows \"(\\<lceil>p\\<rceil>\\<^sub>< \\<Rightarrow> \\<lceil>q\\<rceil>\\<^sub>>) \\<sqsubseteq> (f ;; fa)\"\n  using assms by rel_auto\n   \nlemma seq_refine_unrest:\n  assumes \"out\\<alpha> \\<sharp> p\" \"in\\<alpha> \\<sharp> q\"\n  assumes \"(p \\<Rightarrow> \\<lceil>s\\<rceil>\\<^sub>>) \\<sqsubseteq> f\" and \"(\\<lceil>s\\<rceil>\\<^sub>< \\<Rightarrow> q) \\<sqsubseteq> fa\"\n  shows \"(p \\<Rightarrow> q) \\<sqsubseteq> (f ;; fa)\"\n  using assms by rel_blast    \n    \nlemmas skip_refine' = post_str_rel[OF skip_r_refine_orig]\n\nend\n\n\n", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP-Extended/AlgebraicLaws/Algebraic_Laws.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.31181064239247486}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoareTotalDef.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Hoare Logic for Total Correctness *}\n\ntheory HoareTotalDef imports HoarePartialDef Termination begin \n\nsubsection {* Validity of Hoare Tuples: @{text  \"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\ndefinition\n  validt :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] \\<Rightarrow> bool\"\n                (\"_\\<Turnstile>\\<^sub>t\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<and> (\\<forall>s \\<in> Normal ` P. \\<Gamma>\\<turnstile>c\\<down>s)\"\n\ndefinition\n  cvalidt::\n  \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n    's assn,('s,'p,'f) com,'s assn,'s assn] \\<Rightarrow> bool\"\n                (\"_,_\\<Turnstile>\\<^sub>t\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60, 60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> (\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\<longrightarrow> \\<Gamma> \\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n\nnotation (ascii)\n  validt  (\"_|=t'/_/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60) and\n  cvalidt  (\"_,_|=t'/_ / _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60)\n\nsubsection {* Properties of Validity *}\n\nlemma validtI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P;t \\<notin> Fault ` F\\<rbrakk> \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A;\n   \\<And>s. s \\<in> P \\<Longrightarrow> \\<Gamma>\\<turnstile> c\\<down>(Normal s) \\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: validt_def valid_def)\n\nlemma cvalidtI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P; \n          t \\<notin> Fault ` F\\<rbrakk> \n          \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A;\n   \\<And>s. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A; s\\<in>P\\<rbrakk> \\<Longrightarrow>  \\<Gamma>\\<turnstile>c\\<down>(Normal s)\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: cvalidt_def validt_def valid_def)\n\nlemma cvalidt_postD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t;\n   s \\<in> P;t \\<notin> Fault ` F\\<rbrakk> \n  \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  by (simp add: cvalidt_def validt_def valid_def)\n\nlemma cvalidt_termD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;s \\<in> P\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>\\<turnstile>c\\<down>(Normal s)\"\n  by (simp add: cvalidt_def validt_def valid_def)\n\n\nlemma validt_augment_Faults:\n  assumes valid:\"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F \\<subseteq> F'\"\n  shows \"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F'\\<^esub> P c Q,A\"\n  using valid F'\n  by (auto intro: valid_augment_Faults simp add: validt_def)\n\nsubsection {* The Hoare Rules: @{text \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" } *}\n\ninductive \"hoaret\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n                        's assn,('s,'p,'f) com,'s assn,'s assn] \n                       => bool\"\n    (\"(3_,_/\\<turnstile>\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _,_))\" [61,60,60,1000,20,1000,1000]60)  \n   for \\<Gamma>::\"('s,'p,'f) body\"\nwhere\n  Skip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> {s. f s \\<in> Q} (Basic f) Q,A\"\n\n| Spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> {s. (\\<forall>t. (s,t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s,t) \\<in> r)} (Spec r) Q,A\"\n\n| Seq: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c\\<^sub>1 c\\<^sub>2 Q,A\"\n  \n| Cond: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P \\<inter> b) c\\<^sub>1 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P \\<inter> - b) c\\<^sub>2 Q,A\\<rbrakk>\n         \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\<lbrakk>wf r; \\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<sigma>} \\<inter> P \\<inter> b) c ({t. (t,\\<sigma>)\\<in>r} \\<inter> P),A\\<rbrakk>\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (While b c) (P \\<inter> - b),A\"\n\n| Guard: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (g \\<inter> P) Guard f g c Q,A\"\n\n| Guarantee: \"\\<lbrakk>f \\<in> F; \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec: \n  \"\\<lbrakk>(P,p,Q,A) \\<in> Specs;\n    wf r; \n    Specs_wf = (\\<lambda>p \\<sigma>. (\\<lambda>(P,q,Q,A). (P \\<inter> {s. ((s,q),(\\<sigma>,p)) \\<in> r},q,Q,A)) ` Specs);\n    \\<forall>(P,p,Q,A)\\<in> Specs. \n      p \\<in> dom \\<Gamma> \\<and> (\\<forall>\\<sigma>. \\<Gamma>,\\<Theta> \\<union> Specs_wf p \\<sigma>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<sigma>} \\<inter> P) (the (\\<Gamma> p)) Q,A)\n    \\<rbrakk>\n    \\<Longrightarrow>\n    \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| DynCom:  \"\\<forall>s \\<in> P. \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (c s) Q,A \n            \\<Longrightarrow> \n            \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n\n| Throw: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk> \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\<forall>s \\<in> P. \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A \n           \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"(P,p,Q,A) \\<in> \\<Theta> \n        \\<Longrightarrow> \n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| ExFalso: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\<not> \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  -- {* This is a hack rule that enables us to derive completeness for\n        an arbitrary context @{text \"\\<Theta>\"}, from completeness for an empty context.*}\n\n  \ntext {* Does not work, because of rule ExFalso, the context @{text \\<Theta>} is to blame.\n A weaker version with empty context can be derived from soundness \n later on. *}\nlemma hoaret_to_hoarep:\n  assumes hoaret: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nusing hoaret\nproof (induct)\n  case Skip thus ?case by (rule hoarep.intros)\nnext\n  case Basic thus ?case by (rule hoarep.intros)\nnext\n  case Seq thus ?case by - (rule hoarep.intros)\nnext\n  case Cond thus ?case by - (rule hoarep.intros)\nnext\n  case (While r \\<Theta> F P b c A)\n  hence \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({\\<sigma>} \\<inter> P \\<inter> b) c ({t. (t, \\<sigma>) \\<in> r} \\<inter> P),A\"\n    by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A\"\n    by (rule HoarePartialDef.conseq) blast\n  then show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P While b c (P \\<inter> - b),A\"\n    by (rule hoarep.While)\nnext\n  case Guard thus ?case by - (rule hoarep.intros)\n(*next\n  case (CallRec A F P Procs Q Z \\<Theta>  p r)\n  hence hyp: \"\\<forall>p\\<in>Procs. \\<forall>\\<tau> Z. \n           \\<Gamma>,\\<Theta> \\<union> (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r},\n                      Call q, Q q Z,A q Z)})\\<turnstile>\\<^bsub>/F\\<^esub>\n              ({\\<tau>} \\<inter> P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n    by blast\n  have \"\\<forall>p\\<in>Procs. \\<forall>Z. \n           \\<Gamma>,\\<Theta> \\<union> (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z,\n                      Call q, Q q Z,A q Z)})\\<turnstile>\\<^bsub>/F\\<^esub>\n              (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\" \n  proof (intro ballI allI)\n    fix p Z\n    assume \"p \\<in> Procs\"\n    with hyp\n    have hyp': \"\\<And> \\<tau>. \n           \\<Gamma>,\\<Theta> \\<union> (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r},\n                      Call q, Q q Z, A q Z)})\\<turnstile>\\<^bsub>/F\\<^esub>\n              ({\\<tau>} \\<inter> P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n      by blast\n    have \"\\<forall>\\<tau>. \n           \\<Gamma>,\\<Theta> \\<union> (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z,\n                      Call q, Q q Z,A q Z)})\\<turnstile>\\<^bsub>/F\\<^esub>\n              ({\\<tau>} \\<inter> P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n      (is \"\\<forall>\\<tau>. \\<Gamma>,?\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> ({\\<tau>} \\<inter> P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\")\n    proof (rule allI, rule WeakenContext [OF hyp'],clarify)\n      fix \\<tau> P' c Q' A'\n      assume \"(P', c, Q', A') \\<in> \\<Theta> \\<union>\n         (\\<Union>q\\<in>Procs.\n             \\<Union>Z. {(P q Z \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r},\n                  Call q, Q q Z,\n                  A q Z)})\" (is \"(P', c, Q', A') \\<in> \\<Theta> \\<union> ?Spec\")\n      then show \"\\<Gamma>,?\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A'\"\n      proof (cases rule: UnE [consumes 1])\n        assume \"(P',c,Q',A') \\<in> \\<Theta>\" \n        then show ?thesis\n          by (blast intro: HoarePartialDef.Asm)\n      next\n        assume \"(P',c,Q',A') \\<in> ?Spec\" \n        then show ?thesis\n        proof (clarify)\n          fix q Z\n          assume q: \"q \\<in> Procs\"\n          show \"\\<Gamma>,?\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> (P q Z \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r}) \n                         Call  q \n                        (Q q Z),(A q Z)\"\n          proof -\n            from q\n            have \"\\<Gamma>,?\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> (P q Z) Call q (Q q Z),(A q Z)\"\n              by - (rule HoarePartialDef.Asm,blast)\n            thus ?thesis\n              by (rule HoarePartialDef.conseqPre) blast\n          qed\n        qed\n      qed\n    qed\n    then show \"\\<Gamma>,\\<Theta> \\<union> (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z, Call q, Q q Z,A q Z)})\n                \\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n      by (rule HoarePartialDef.conseq) blast\n  qed\n  thus ?case\n    by - (rule hoarep.CallRec)*)\nnext\n  case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n  case Throw thus ?case by - (rule hoarep.Throw)\nnext\n  case Catch thus ?case by - (rule hoarep.Catch)\nnext\n  case Conseq thus ?case by - (rule hoarep.Conseq,blast)\nnext\n  case Asm thus ?case by (rule HoarePartialDef.Asm)\nnext\n  case (ExFalso \\<Theta> F P c Q A)\n  assume \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  hence \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n    oops\n\n\nlemma hoaret_augment_context: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"\\<And>\\<Theta>'. \\<Theta> \\<subseteq> \\<Theta>' \\<Longrightarrow> \\<Gamma>,\\<Theta>'\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n  case (CallRec P p Q A Specs r Specs_wf \\<Theta> F \\<Theta>')\n  have aug: \"\\<Theta> \\<subseteq> \\<Theta>'\" by fact\n  then\n  have h: \"\\<And>\\<tau> p. \\<Theta> \\<union> Specs_wf p \\<tau>\n       \\<subseteq> \\<Theta>' \\<union> Specs_wf p \\<tau>\"\n    by blast\n  have \"\\<forall>(P,p,Q,A)\\<in>Specs. p \\<in> dom \\<Gamma> \\<and>\n     (\\<forall>\\<tau>. \\<Gamma>,\\<Theta> \\<union> Specs_wf p \\<tau>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<tau>} \\<inter> P) (the (\\<Gamma> p)) Q,A \\<and>\n           (\\<forall>x. \\<Theta> \\<union> Specs_wf p \\<tau>\n                 \\<subseteq> x \\<longrightarrow>\n                 \\<Gamma>,x\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<tau>} \\<inter> P) (the (\\<Gamma> p)) Q,A))\" by fact\n  hence \"\\<forall>(P,p,Q,A)\\<in>Specs. p \\<in> dom \\<Gamma> \\<and> \n         (\\<forall>\\<tau>. \\<Gamma>,\\<Theta>'\\<union> Specs_wf p \\<tau> \\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<tau>} \\<inter> P) (the (\\<Gamma> p)) Q,A)\"\n    apply (clarify)\n    apply (rename_tac P p Q A)\n    apply (drule (1) bspec)\n    apply (clarsimp)\n    apply (erule_tac x=\\<tau> in allE)\n    apply clarify\n    apply (erule_tac x=\"\\<Theta>' \\<union> Specs_wf p \\<tau>\" in allE)\n    apply (insert aug)\n    apply auto\n    done\n  with CallRec show ?case by - (rule hoaret.CallRec)\nnext\n  case DynCom thus ?case by (blast intro: hoaret.DynCom)\nnext\n  case (Conseq P \\<Theta> F c Q A \\<Theta>')\n  from Conseq\n  have \"\\<forall>s \\<in> P. (\\<exists>P' Q' A'. (\\<Gamma>,\\<Theta>' \\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A') \\<and> s \\<in> P'\\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A)\"\n    by blast\n  with Conseq show ?case by - (rule hoaret.Conseq)\nnext\n  case (ExFalso \\<Theta> F P  c Q A \\<Theta>')\n  have \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \"\\<not> \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \"\\<Theta> \\<subseteq> \\<Theta>'\"  by fact+\n  then show ?case\n    by (fastforce intro: hoaret.ExFalso simp add: cvalidt_def)\nqed (blast intro: hoaret.intros)+\n\nsubsection {* Some Derived Rules *}\n\n\nlemma  Conseq': \"\\<forall>s. s \\<in> P \\<longrightarrow> \n            (\\<exists>P' Q' A'. \n              (\\<forall> Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\<and>\n                    (\\<exists>Z. s \\<in> P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A)))\n           \\<Longrightarrow>\n           \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\<lbrakk>\\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n              \\<forall>s. s \\<in> P \\<longrightarrow> (\\<exists> Z. s\\<in>P' Z \\<and> (Q' Z \\<subseteq> Q)\\<and> (A' Z \\<subseteq> A))\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule Conseq) blast\n\ntheorem conseqPrePost: \n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A' \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow>  Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq [where ?P'=\"\\<lambda>Z. P'\" and ?Q'=\"\\<lambda>Z. Q'\"]) auto\n\nlemma conseqPre: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q,A \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A'\\<Longrightarrow> Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \\<Longrightarrow>   \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq) auto\n\n\nlemma Spec_wf_conv: \n  \"(\\<lambda>(P, q, Q, A). (P \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r}, q, Q, A)) `\n                (\\<Union>p\\<in>Procs. \\<Union>Z. {(P p Z, p, Q p Z, A p Z)}) = \n        (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r}, q, Q q Z, A q Z)})\"\napply (rule)\napply  fastforce\napply (fastforce simp add: image_def)\ndone\n\nlemma CallRec': \n  \"\\<lbrakk>p\\<in>Procs; Procs \\<subseteq> dom \\<Gamma>;\n    wf r; \n   \\<forall>p\\<in>Procs. \\<forall>\\<tau> Z. \n   \\<Gamma>,\\<Theta>\\<union>(\\<Union>q\\<in>Procs. \\<Union>Z. \n    {((P q Z) \\<inter> {s. ((s,q),(\\<tau>,p)) \\<in> r},q,Q q Z,(A q Z))})\n     \\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<tau>} \\<inter> (P p Z)) (the (\\<Gamma> p)) (Q p Z),(A p Z)\\<rbrakk>\n   \\<Longrightarrow>\n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\<Union>p\\<in>Procs. \\<Union>Z. {((P p Z),p,Q p Z,A p Z)}\" and\n         r=r])\napply    blast\napply   assumption\napply  (rule refl)\napply (clarsimp)\napply (rename_tac p')\napply (rule conjI)\napply  blast\napply (intro allI)\napply (rename_tac Z \\<tau>)\napply (drule_tac x=p' in bspec, assumption)\napply (erule_tac x=\\<tau> in allE)\napply (erule_tac x=Z in allE)\napply (fastforce simp add: Spec_wf_conv)\ndone\n\nend\n\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/HoareTotalDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804478040616, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.31180728585121426}}
{"text": "theory TA_Impl_Misc2\n  imports\n    TA_Impl.TA_Impl_Misc\n    \"HOL-Library.Sublist\"\n    \"List-Index.List_Index\"\n    Automatic_Refinement.Misc\nbegin\n\nlemma mem_nth:\n  \"x \\<in> set xs \\<Longrightarrow> \\<exists> i < length xs. xs ! i = x\"\n  by (metis index_less_size_conv nth_index)\n\nlemma union_subsetI:\n  \"A \\<union> B \\<subseteq> C \\<union> D\" if \"A \\<subseteq> C\" \"B \\<subseteq> D\"\n  using that by blast\n\nlemma map_eq_imageD:\n  \"f ` set xs = set ys\" if \"map f xs = ys\"\n  using that by auto\n\nlemma if_contract:\n  \"(if a then x else if b then x else y) = (if a \\<or> b then x else y)\" for a x b y\n  by (rule SMT.z3_rule)\n\nparagraph \\<open>More intros\\<close>\n\nnamed_theorems more_intros\nnamed_theorems more_elims\nlemmas [more_intros] =\n  image_eqI[rotated] CollectI subsetI\n\nlemmas [more_elims] =\n  CollectE\n\nparagraph \\<open>Finiteness\\<close>\n\nlemma finite_prodI:\n  \"finite {(a,b). P a \\<and> Q b}\" if \"finite {a. P a}\" \"finite {a. Q a}\"\n  using that by simp\n\nlemma finite_prodI3:\n  \"finite {(a,b,c). P a \\<and> Q b \\<and> Q1 c}\"\n  if \"finite {a. P a}\" \"finite {a. Q a}\" \"finite {a. Q1 a}\"\n  using that by simp\n\nlemma finite_prodI4:\n  \"finite {(a,b,c,d). P a \\<and> Q b \\<and> Q1 c \\<and> Q2 d}\"\n  if \"finite {a. P a}\" \"finite {a. Q a}\" \"finite {a. Q1 a}\" \"finite {a. Q2 a}\"\n  using that by simp\n\nnamed_theorems finite_intros\nnamed_theorems more_finite_intros\n\nlemmas [finite_intros] =\n  finite_UnI finite_Union finite_imageI\n  finite_lists_length_eq finite_lists_length_le\n  distinct_finite_subset distinct_finite_set\n\nlemmas [more_finite_intros] =\n  finite_prodI finite_prodI3 finite_prodI4\n\nparagraph \\<open>Lists\\<close>\n\n(* XXX Merge with the variants from TA_Impl_Misc *)\nlemma fold_evD2:\n  assumes\n    \"P y (fold f xs acc)\" \"\\<not> P y acc\"\n    \"\\<And> acc x. \\<not> P y acc \\<Longrightarrow> Q acc \\<Longrightarrow> P y (f x acc) \\<Longrightarrow> x \\<in> set xs \\<Longrightarrow> x = y\"\n    \"Q acc\" \"\\<And> acc x. Q acc \\<Longrightarrow> Q (f x acc)\"\n    \"\\<And> acc x. \\<not> P y acc \\<Longrightarrow> Q acc \\<Longrightarrow> P y (f x acc) \\<Longrightarrow> R y\"\n  shows \"\\<exists> ys zs. xs = ys @ y # zs \\<and> \\<not> P y (fold f ys acc) \\<and> P y (f y (fold f ys acc)) \\<and> R y\"\nproof -\n  from fold_evD'[OF assms(2,1)] obtain x ys zs where *:\n    \"xs = ys @ x # zs\" \"\\<not> P y (fold f ys acc)\" \"P y (f x (fold f ys acc))\"\n    by auto\n  moreover from assms(4-) have \"Q (fold f ys acc)\" by (auto intro: fold_acc_preserv)\n  moreover from \\<open>xs = _\\<close> have \"x \\<in> set xs\"\n    by auto\n  ultimately show ?thesis using assms(3,6) by auto\nqed\n\nlemmas fold_evD2' = fold_evD2[where R = \"\\<lambda> _. True\", simplified]\n\nlemma filter_map_map_filter:\n  \"filter P (map f xs) = List.map_filter (\\<lambda> x. let y = f x in if P y then Some y else None) xs\"\n  by (induction xs; simp add: Let_def List.map_filter_simps)\n\nlemma distinct_map_filterI:\n  \"distinct (List.map_filter f xs)\"\n  if \"\\<forall>x \\<in> set xs. \\<forall>y \\<in> set xs. \\<forall>a. f x = Some a \\<and> f y = Some a \\<longrightarrow> x = y\" \"distinct xs\"\n  using that by (induction xs) (auto simp: map_filter_simps set_map_filter split: option.split)\n\nlemma filter_eqI:\n  assumes\n    \"subseq ys xs\" \"\\<forall>x \\<in> set ys. P x\"\n    \"\\<forall>zs. subseq zs xs \\<and> length zs > length ys \\<longrightarrow> (\\<exists> x \\<in> set zs. \\<not> P x)\"\n  shows \"filter P xs = ys\"\n  using assms\nproof (induction xs arbitrary: ys rule: list.induct)\n  case Nil\n  then show ?case\n    by - (cases ys; simp)\nnext\n  case (Cons x xs)\n  show ?case\n  proof (cases \"P x\")\n    case True\n    show ?thesis\n    proof (cases ys)\n      case Nil\n      have \"subseq [x] (x # xs)\"\n        by auto\n      with Cons.prems Nil \\<open>P x\\<close> show ?thesis\n        by fastforce\n    next\n      case (Cons y ys')\n      have \"x = y\"\n      proof (rule ccontr)\n        assume \"x \\<noteq> y\"\n        with \\<open>subseq ys (x # xs)\\<close> \\<open>ys = _\\<close> have \"subseq (x # ys) (x # xs)\"\n          by simp\n        with Cons.prems(2-) \\<open>P x\\<close> show False\n          by fastforce\n      qed\n      have \"\\<exists>x\\<in>set zs. \\<not> P x\" if \"subseq zs xs\" and \"length ys' < length zs\" for zs\n      proof -\n        from \\<open>subseq zs xs\\<close> have \"subseq (x # zs) (x # xs)\"\n          by simp\n        with \\<open>length ys' < length zs\\<close> Cons.prems(3) \\<open>ys = _\\<close> have \"\\<exists>x\\<in>set (x # zs). \\<not> P x\"\n          by (intro Cons.prems(3)[rule_format]; simp)\n        with \\<open>P x\\<close> show ?thesis\n          by auto\n      qed\n      with Cons.prems \\<open>P x\\<close> \\<open>ys = _\\<close> \\<open>x = y\\<close> show ?thesis\n        by (auto intro!: Cons.IH)\n    qed\n  next\n    case False\n    with Cons.prems show ?thesis\n      by (cases ys) (auto split: if_split_asm intro!: Cons.IH)\n  qed\nqed\n\nlemma filter_greatest_subseqD:\n  \"\\<exists> x \\<in> set zs. \\<not> P x\" if \"subseq zs xs\" \"length zs > length (filter P xs)\"\n  using that by (metis filter_id_conv not_subseq_length subseq_filter)\n\nlemma filter_eq_iff_greatest_subseq:\n  \"filter P xs = ys \\<longleftrightarrow>\n  subseq ys xs \\<and> (\\<forall>x \\<in> set ys. P x) \\<and>\n  (\\<forall>zs. subseq zs xs \\<and> length zs > length ys \\<longrightarrow> (\\<exists> x \\<in> set zs. \\<not> P x))\"\n  using filter_greatest_subseqD filter_eqI by auto\n\nlemma subseq_subsetD:\n  \"set xs \\<subseteq> set ys\" if \"subseq xs ys\"\n  using that\n  by (intro subsetI) (unfold subseq_singleton_left[symmetric], erule subseq_order.order.trans)\n\nlemma subseq_distinct:\n  \"distinct xs\" if \"distinct ys\" \"subseq xs ys\"\n  using subseqs_distinctD that by simp\n\n(* XXX Move *)\nlemma filter_distinct_eqI:\n  assumes\n    \"subseq ys xs\" \"\\<forall>x \\<in> set ys. P x\" \"\\<forall>x \\<in> set xs. x \\<notin> set ys \\<longrightarrow> \\<not> P x\" \"distinct xs\"\n  shows \"filter P xs = ys\"\nproof (intro filter_eqI, safe)\n  fix zs assume prems: \"subseq zs xs\" \"length ys < length zs\"\n  obtain x where \"x \\<in> set zs\" \"x \\<notin> set ys\"\n  proof (atomize_elim, rule ccontr)\n    assume \"\\<nexists>x. x \\<in> set zs \\<and> x \\<notin> set ys\"\n    then have \"set zs \\<subseteq> set ys\"\n      by auto\n    moreover from prems assms have \"distinct zs\" \"distinct ys\"\n      by (blast intro: subseq_distinct)+\n    ultimately show False\n      using \\<open>length ys < length zs\\<close>\n      by (auto dest: card_mono[rotated] simp: distinct_card[symmetric])\n  qed\n  with prems assms show \"\\<exists>x\\<in>set zs. \\<not> P x\"\n    by (auto 4 3 dest: subseq_subsetD)\nqed (use assms in blast)+\n\nlemma subseq_sorted_wrt:\n  \"sorted_wrt R xs\" if \"sorted_wrt R ys\" \"subseq xs ys\"\n  using that\n  by (induction xs arbitrary: ys)\n     (auto 0 4 dest: subseq_subsetD list_emb_ConsD subseq_Cons' simp: sorted_wrt_append)\n\nlemma subseq_sorted:\n  \"sorted xs\" if \"sorted ys\" \"subseq xs ys\"\n  using that unfolding sorted_sorted_wrt by (rule subseq_sorted_wrt)\n\nlemma sorted_distinct_subset_subseqI:\n  assumes \"sorted xs\" \"distinct xs\" \"sorted ys\" \"set xs \\<subseteq> set ys\"\n  shows \"subseq xs ys\"\n  using assms\nproof (induction ys arbitrary: xs)\n  case Nil\n  then show ?case\n    by simp\nnext\n  case (Cons y ys xs)\n  from Cons.prems show ?case\n    by (cases xs; simp) (safe; rule Cons.IH; auto 4 4)\nqed\n\nlemma sorted_distinct_subseq_iff:\n  assumes \"sorted ys\" \"distinct ys\"\n  shows \"subseq xs ys \\<longleftrightarrow> (sorted xs \\<and> distinct xs \\<and> set xs \\<subseteq> set ys)\"\n  using assms\n  by safe\n     (erule\n       subseq_subsetD[THEN subsetD] sorted_distinct_subset_subseqI subseq_distinct subseq_sorted;\n       assumption\n     )+\n\nlemma list_all2_map_fst_aux:\n  assumes \"list_all2 (\\<lambda>x y. x \\<in> Pair y ` (zs y)) xs ys\"\n  shows \"list_all2 (=) (map fst xs) ys\"\n  using assms by (smt fstI imageE list.rel_mono_strong list_all2_map1)\n\nend", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Simple_Networks/TA_Impl_Misc2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290806, "lm_q2_score": 0.6187804337438501, "lm_q1q2_score": 0.31180727876618697}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory ExtraSpecs\n\nimports\n  \"CParser.TypHeapLib\"\n\nbegin\n\ndefinition\n  \"simple_simpl_refines \\<Gamma> com com'\n    = (\\<forall>s. (\\<exists>ft. \\<Gamma> \\<turnstile> \\<langle>com', Normal s\\<rangle> \\<Rightarrow> Fault ft)\n        \\<or> ((\\<forall>xs. \\<Gamma> \\<turnstile> \\<langle>com, Normal s\\<rangle> \\<Rightarrow> xs \\<longrightarrow> \\<Gamma> \\<turnstile> \\<langle>com', Normal s\\<rangle> \\<Rightarrow> xs)\n            \\<and> (\\<not> terminates \\<Gamma> com (Normal s) \\<longrightarrow> \\<not> terminates \\<Gamma> com' (Normal s))))\"\n\nlemma simple_simpl_refines_no_fault_execD:\n  \"\\<Gamma> \\<turnstile> \\<langle>com,Normal s\\<rangle> \\<Rightarrow> xs\n    \\<Longrightarrow> simple_simpl_refines \\<Gamma> com com'\n    \\<Longrightarrow> (\\<forall>ft. \\<not> \\<Gamma> \\<turnstile> \\<langle>com',Normal s\\<rangle> \\<Rightarrow> Fault ft)\n    \\<Longrightarrow> \\<Gamma> \\<turnstile> \\<langle>com', Normal s\\<rangle> \\<Rightarrow> xs\"\n  by (auto simp add: simple_simpl_refines_def)\n\nlemma simple_simpl_refines_no_fault_terminatesD:\n  \"simple_simpl_refines \\<Gamma> com com'\n    \\<Longrightarrow> (\\<forall>ft. \\<not> \\<Gamma> \\<turnstile> \\<langle>com',Normal s\\<rangle> \\<Rightarrow> Fault ft)\n    \\<Longrightarrow> \\<not> terminates \\<Gamma> com (Normal s) \\<longrightarrow> \\<not> terminates \\<Gamma> com' (Normal s)\"\n  by (auto simp add: simple_simpl_refines_def)\n\nlemma simple_simpl_refines_refl:\n  \"simple_simpl_refines \\<Gamma> com com\"\n  by (auto simp add: simple_simpl_refines_def)\n\nlemma simple_simpl_refines_from_def_eq:\n  \"body \\<equiv> body' \\<Longrightarrow> simple_simpl_refines \\<Gamma> body' body\"\n  (* these are flipped, because the \"implementation\" is on the rhs of\n     definitional equalities, but the lhs of refinement thms. *)\n  by (simp add: simple_simpl_refines_def)\n\nlemma simple_simpl_refines_trans:\n  \"simple_simpl_refines \\<Gamma> com com' \\<Longrightarrow> simple_simpl_refines \\<Gamma> com' com''\n    \\<Longrightarrow> simple_simpl_refines \\<Gamma> com com''\"\n  by (simp add: simple_simpl_refines_def, metis)\n\nlemma simple_simpl_refines_drop_Guard:\n  \"simple_simpl_refines \\<Gamma> com (Guard F G com)\"\n  apply (clarsimp simp add: simple_simpl_refines_def)\n  apply (case_tac \"s \\<in> G\")\n  apply (auto intro: exec.Guard exec.GuardFault\n              elim!: terminates_Normal_elim_cases)\n  done\n\nlemma simple_simpl_refines_guarded_Basic_guarded_spec_body:\n  \"(\\<forall>s s'. (s, s') \\<in> R \\<longrightarrow> (s \\<in> G \\<and> (s, f s) \\<in> R))\n    \\<Longrightarrow> simple_simpl_refines \\<Gamma> (Guard F' G (Basic f)) (guarded_spec_body F R)\"\n  apply (simp add: guarded_spec_body_def simple_simpl_refines_def)\n  apply (intro allI, drule_tac x=s in spec)\n  apply (erule impCE)\n   apply (rule disjI1)\n   apply (fastforce intro: exec.GuardFault)\n  apply (rule disjI2)\n  apply (auto intro!: exec.Guard terminates.Guard\n               intro: exec.GuardFault exec.Spec terminates.Basic image_eqI[rotated]\n              elim!: exec_Normal_elim_cases terminates_Normal_elim_cases)\n  done\n\nlemmas simple_simpl_refines_Basic_guarded_spec_body\n    = simple_simpl_refines_trans[OF\n        simple_simpl_refines_drop_Guard[where G=UNIV]\n        simple_simpl_refines_guarded_Basic_guarded_spec_body\n        ]\n\nML \\<open>\nstructure Get_Body_Refines = struct\n\nfun get ctxt name = let\n    fun pget sfx = try (Proof_Context.get_thm ctxt o suffix sfx) name\n    val eqv = pget \"_body_refines\"\n    val def = pget \"_body_def\"\n  in case (eqv, def) of\n      (SOME eqvt, _) => eqvt\n    | (_, SOME deft) => (deft RS @{thm simple_simpl_refines_from_def_eq})\n    | _ => raise THM (\"Get_Body_Refines.get: \"\n          ^ \"no body_def or body_refines: \" ^ name, 1, [])\n  end\n\nend\n\\<close>\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/asmrefine/ExtraSpecs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3118072787661869}}
{"text": "(* Title:     Check_Monad\n   Author:    Christian Sternagel\n   Author:    René Thiemann\n*)\n\nsection \\<open>A Special Error Monad for Certification with Informative Error Messages\\<close>\n\ntheory Check_Monad\nimports Error_Monad\nbegin\n\ntext \\<open>A check is either successful or fails with some error.\\<close>\ntype_synonym\n  'e check = \"'e + unit\"\n\nabbreviation succeed :: \"'e check\"\nwhere\n  \"succeed \\<equiv> return ()\"\n\ndefinition check :: \"bool \\<Rightarrow> 'e \\<Rightarrow> 'e check\"\nwhere\n  \"check b e = (if b then succeed else error e)\"\n\nlemma isOK_check [simp]:\n  \"isOK (check b e) = b\" by (simp add: check_def)\n\nlemma isOK_check_catch [simp]:\n  \"isOK (try check b e catch f) \\<longleftrightarrow> b \\<or> isOK (f e)\"\n  by (auto simp add: catch_def check_def)\n\ndefinition check_return :: \"'a check \\<Rightarrow> 'b \\<Rightarrow> 'a + 'b\"\nwhere\n  \"check_return chk res = (chk \\<then> return res)\"\n\nlemma check_return [simp]:\n  \"check_return chk res = return res' \\<longleftrightarrow> isOK chk \\<and> res' = res\"\n  unfolding check_return_def by (cases chk) auto\n\nlemma [code_unfold]:\n  \"check_return chk res = (case chk of Inr _ \\<Rightarrow> Inr res | Inl e \\<Rightarrow> Inl e)\"\n  unfolding check_return_def bind_def ..\n\nabbreviation check_allm :: \"('a \\<Rightarrow> 'e check) \\<Rightarrow> 'a list \\<Rightarrow> 'e check\"\nwhere\n  \"check_allm f xs \\<equiv> forallM f xs <+? snd\"\n\nabbreviation check_exm :: \"('a \\<Rightarrow> 'e check) \\<Rightarrow> 'a list \\<Rightarrow> ('e list \\<Rightarrow> 'e) \\<Rightarrow> 'e check\"\nwhere\n  \"check_exm f xs fld \\<equiv> existsM f xs <+? fld\"\n\nlemma isOK_check_allm:\n  \"isOK (check_allm f xs) \\<longleftrightarrow> (\\<forall>x \\<in> set xs. isOK (f x))\"\n  by simp\n\nabbreviation check_allm_index :: \"('a \\<Rightarrow> nat \\<Rightarrow> 'e check) \\<Rightarrow> 'a list \\<Rightarrow> 'e check\"\nwhere\n  \"check_allm_index f xs \\<equiv> forallM_index f xs <+? snd\"\n\nabbreviation check_all :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> 'a check\"\nwhere\n  \"check_all f xs \\<equiv> check_allm (\\<lambda>x. if f x then succeed else error x) xs\"\n\nabbreviation check_all_index :: \"('a \\<Rightarrow> nat \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> ('a \\<times> nat) check\"\nwhere\n  \"check_all_index f xs \\<equiv> check_allm_index (\\<lambda>x i. if f x i then succeed else error (x, i)) xs\"\n\nlemma isOK_check_all_index [simp]:\n  \"isOK (check_all_index f xs) \\<longleftrightarrow> (\\<forall>i < length xs. f (xs ! i) i)\"\n  by auto\n\ntext \\<open>The following version allows to modify the index during the check.\\<close>\ndefinition\n  check_allm_gen_index ::\n    \"('a \\<Rightarrow> nat \\<Rightarrow> nat) \\<Rightarrow> ('a \\<Rightarrow> nat \\<Rightarrow> 'e check) \\<Rightarrow> nat \\<Rightarrow> 'a list \\<Rightarrow> 'e check\"\nwhere\n  \"check_allm_gen_index g f n xs = snd (foldl (\\<lambda>(i, m) x. (g x i, m \\<then> f x i)) (n, succeed) xs)\"\n\nlemma foldl_error:\n  \"snd (foldl (\\<lambda>(i, m) x . (g x i, m \\<then> f x i)) (n, error e) xs) = error e\"\n  by (induct xs arbitrary: n) auto\n\nlemma isOK_check_allm_gen_index [simp]:\n  assumes \"isOK (check_allm_gen_index g f n xs)\"\n  shows \"\\<forall>x\\<in>set xs. \\<exists>i. isOK (f x i)\"\nusing assms\nproof (induct xs arbitrary: n)\n  case (Cons x xs)\n  show ?case\n  proof (cases \"isOK (f x n)\")\n    case True\n    then have \"\\<exists>i. isOK (f x i)\" by auto\n    with True Cons show ?thesis\n      unfolding check_allm_gen_index_def by (force simp: isOK_iff)\n  next\n    case False\n    then obtain e where \"f x n = error e\" by (cases \"f x n\") auto\n    with foldl_error [of g f _ e] and Cons show ?thesis\n      unfolding check_allm_gen_index_def by auto\n  qed\nqed simp\n\nlemma check_allm_gen_index [fundef_cong]:\n  fixes f :: \"'a \\<Rightarrow> nat \\<Rightarrow> 'e check\"\n  assumes \"\\<And>x n. x \\<in> set xs \\<Longrightarrow> g x n = g' x n\"\n    and \"\\<And>x n. x \\<in> set xs \\<Longrightarrow> f x n = f' x n\"\n  shows \"check_allm_gen_index g f n xs = check_allm_gen_index g' f' n xs\"\nproof -\n  { fix n m\n    have \"foldl (\\<lambda>(i, m) x. (g x i, m \\<then> f x i)) (n, m) xs =\n      foldl (\\<lambda>(i, m) x. (g' x i, m \\<then> f' x i)) (n, m) xs\"\n      using assms by (induct xs arbitrary: n m) auto }\n  then show ?thesis unfolding check_allm_gen_index_def by simp\nqed\n\ndefinition check_subseteq :: \"'a list \\<Rightarrow> 'a list \\<Rightarrow> 'a check\"\nwhere\n  \"check_subseteq xs ys = check_all (\\<lambda>x. x \\<in> set ys) xs\"\n\nlemma isOK_check_subseteq [simp]:\n  \"isOK (check_subseteq xs ys) \\<longleftrightarrow> set xs \\<subseteq> set ys\"\n  by (auto simp: check_subseteq_def)\n\ndefinition check_same_set :: \"'a list \\<Rightarrow> 'a list \\<Rightarrow> 'a check\"\nwhere\n  \"check_same_set xs ys = (check_subseteq xs ys \\<then> check_subseteq ys xs)\"\n\nlemma isOK_check_same_set [simp]:\n  \"isOK (check_same_set xs ys) \\<longleftrightarrow> set xs = set ys\"\n  unfolding check_same_set_def by auto\n\ndefinition check_disjoint :: \"'a list \\<Rightarrow> 'a list \\<Rightarrow> 'a check\"\nwhere\n  \"check_disjoint xs ys = check_all (\\<lambda>x. x \\<notin> set ys) xs\"\n\nlemma isOK_check_disjoint [simp]:\n  \"isOK (check_disjoint xs ys) \\<longleftrightarrow> set xs \\<inter> set ys = {}\"\n  unfolding check_disjoint_def by (auto)\n\ndefinition check_all_combinations :: \"('a \\<Rightarrow> 'a \\<Rightarrow> 'b check) \\<Rightarrow> 'a list \\<Rightarrow> 'b check\"\nwhere\n  \"check_all_combinations c xs = check_allm (\\<lambda>x. check_allm (c x) xs) xs\"\n\nlemma isOK_check_all_combinations [simp]:\n  \"isOK (check_all_combinations c xs) \\<longleftrightarrow> (\\<forall>x \\<in> set xs. \\<forall>y \\<in> set xs. isOK (c x y))\"\n  unfolding check_all_combinations_def by simp\n\nfun check_pairwise :: \"('a \\<Rightarrow> 'a \\<Rightarrow> 'b check) \\<Rightarrow> 'a list \\<Rightarrow> 'b check\"\nwhere\n  \"check_pairwise c [] = succeed\" |\n  \"check_pairwise c (x # xs) = (check_allm (c x) xs \\<then> check_pairwise c xs)\"\n\nlemma pairwise_aux:\n  \"(\\<forall>j<length (x # xs). \\<forall>i<j. P ((x # xs) ! i) ((x # xs) ! j))\n     = ((\\<forall>j<length xs. P x (xs ! j)) \\<and> (\\<forall>j<length xs. \\<forall>i<j. P (xs ! i) (xs ! j)))\"\n  (is \"?C = (?A \\<and> ?B)\")\nproof (intro iffI conjI)\n  assume *: \"?A \\<and> ?B\"\n  show \"?C\"\n  proof (intro allI impI)\n    fix i j\n    assume \"j < length (x # xs)\" and \"i < j\"\n    then show \"P ((x # xs) ! i) ((x # xs) ! j)\"\n    proof (induct j)\n      case (Suc j)\n      then show ?case\n        using * by (induct i) simp_all\n    qed simp\n  qed\nqed force+\n\nlemma isOK_check_pairwise [simp]:\n  \"isOK (check_pairwise c xs) \\<longleftrightarrow> (\\<forall>j<length xs. \\<forall>i<j. isOK (c (xs ! i) (xs ! j)))\"\nproof (induct xs)\n  case (Cons x xs)\n  have \"isOK (check_allm (c x) xs) = (\\<forall>j<length xs. isOK (c x (xs ! j)))\"\n    using all_set_conv_all_nth [of xs \"\\<lambda>y. isOK (c x y)\"] by simp\n  then have \"isOK (check_pairwise c (x # xs)) =\n    ((\\<forall>j<length xs. isOK (c x (xs ! j))) \\<and> (\\<forall>j<length xs. \\<forall>i<j. isOK (c (xs ! i) (xs ! j))))\"\n    by (simp add: Cons)\n  then show ?case using pairwise_aux [of x xs \"\\<lambda>x y. isOK (c x y)\"] by simp\nqed auto\n\nabbreviation check_exists :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> ('a list) check\"\nwhere\n  \"check_exists f xs \\<equiv> check_exm (\\<lambda>x. if f x then succeed else error [x]) xs concat\"\n\nlemma isOK_choice [simp]:\n  \"isOK (choice []) \\<longleftrightarrow> False\"\n  \"isOK (choice (x # xs)) \\<longleftrightarrow> isOK x \\<or> isOK (choice xs)\"\n  by (auto simp: choice.simps isOK_def split: sum.splits)\n\nfun or_ok :: \"'a check \\<Rightarrow> 'a check \\<Rightarrow> 'a check\" where\n  \"or_ok (Inl a) b = b\" |\n  \"or_ok (Inr a) b = Inr a\" \n\n\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Certification_Monads/Check_Monad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.6187804337438501, "lm_q1q2_score": 0.3118072787661869}}
{"text": "\\<^marker>\\<open>creator \"Kevin Kappelmann\"\\<close>\nsubsubsection \\<open>Galois Property\\<close>\ntheory Transport_Functions_Galois_Property\n  imports\n    Transport_Functions_Monotone\nbegin\n\nparagraph \\<open>Dependent Function Relator\\<close>\n\ncontext transport_Dep_Fun_Rel\nbegin\n\ncontext\nbegin\n\ninterpretation flip : transport_Dep_Fun_Rel R1 L1 r1 l1 R2 L2 r2 l2 .\n\nlemma left_right_rel_if_left_rel_rightI:\n  assumes mono_r1: \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and half_galois_prop_left1: \"((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and refl_R1: \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and half_galois_prop_left2: \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow>\n    ((\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)) (l2\\<^bsub> x' (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and R2_le1: \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x' x'\\<^esub>)\"\n  and R2_le2: \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and ge_L2_r2_le2: \"\\<And>x' y'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> in_codom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y' \\<Longrightarrow>\n    (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y') \\<le> (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y')\"\n  and trans_R2: \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"g \\<le>\\<^bsub>R\\<^esub> g\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> r g\"\n  shows \"l f \\<le>\\<^bsub>R\\<^esub> g\"\nproof (rule flip.left_relI)\n  fix x1' x2'\n  assume [iff]: \"x1' \\<le>\\<^bsub>R1\\<^esub> x2'\"\n  with refl_R1 have [iff]: \"x1' \\<le>\\<^bsub>R1\\<^esub> x1'\" by auto\n  with mono_r1 half_galois_prop_left1 have [iff]: \"\\<epsilon>\\<^sub>1 x1' \\<le>\\<^bsub>R1\\<^esub> x1'\"\n    by (intro t1.counit_rel_if_right_rel_if_half_galois_prop_left_if_mono_wrt_rel)\n  with refl_R1 have \"\\<epsilon>\\<^sub>1 x1' \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 x1'\" by blast\n  with \\<open>g \\<le>\\<^bsub>R\\<^esub> g\\<close> have \"g (\\<epsilon>\\<^sub>1 x1') \\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') (\\<epsilon>\\<^sub>1 x1')\\<^esub> g (\\<epsilon>\\<^sub>1 x1')\" by blast\n  with R2_le2 have \"g (\\<epsilon>\\<^sub>1 x1') \\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x1'\\<^esub> g (\\<epsilon>\\<^sub>1 x1')\" by blast\n\n  let ?x1 = \"r1 x1'\"\n  from \\<open>f \\<le>\\<^bsub>L\\<^esub> r g\\<close> \\<open>x1' \\<le>\\<^bsub>R1\\<^esub> x1'\\<close> have \"f ?x1 \\<le>\\<^bsub>L2 ?x1 ?x1\\<^esub> r g ?x1\" using mono_r1 by blast\n  then have \"f ?x1 \\<le>\\<^bsub>L2 ?x1 ?x1\\<^esub> r2\\<^bsub>?x1 (\\<epsilon>\\<^sub>1 x1')\\<^esub> (g (\\<epsilon>\\<^sub>1 x1'))\" by simp\n  with ge_L2_r2_le2 have \"f ?x1 \\<le>\\<^bsub>L2 ?x1 ?x1\\<^esub> r2\\<^bsub>?x1 x1'\\<^esub> (g (\\<epsilon>\\<^sub>1 x1'))\"\n    using \\<open>_ \\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x1'\\<^esub> g (\\<epsilon>\\<^sub>1 x1')\\<close> by blast\n  with half_galois_prop_left2 have \"l2\\<^bsub> x1' ?x1\\<^esub> (f ?x1) \\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x1'\\<^esub> g (\\<epsilon>\\<^sub>1 x1')\"\n    using \\<open>_ \\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x1'\\<^esub> g (\\<epsilon>\\<^sub>1 x1')\\<close> by auto\n  moreover from \\<open>g \\<le>\\<^bsub>R\\<^esub> g\\<close> \\<open>\\<epsilon>\\<^sub>1 x1' \\<le>\\<^bsub>R1\\<^esub> x1'\\<close> have \"... \\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x1'\\<^esub> g x1'\" by blast\n  ultimately have \"l2\\<^bsub> x1' ?x1\\<^esub> (f ?x1) \\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x1'\\<^esub> g x1'\" using trans_R2 by blast\n  with R2_le1 R2_le2 have \"l2\\<^bsub> x1' ?x1\\<^esub> (f ?x1) \\<le>\\<^bsub>R2 x1' x2'\\<^esub> g x1'\" by blast\n  moreover from \\<open>g \\<le>\\<^bsub>R\\<^esub> g\\<close> \\<open>x1' \\<le>\\<^bsub>R1\\<^esub> x2'\\<close> have \"... \\<le>\\<^bsub>R2 x1' x2'\\<^esub> g x2'\" by blast\n  ultimately have \"l2\\<^bsub> x1' ?x1\\<^esub> (f ?x1) \\<le>\\<^bsub>R2 x1' x2'\\<^esub> g x2'\" using trans_R2 by blast\n  then show \"l f x1' \\<le>\\<^bsub>R2 x1' x2'\\<^esub> g x2'\" by simp\nqed\n\nlemma left_right_rel_if_left_rel_right_ge_left2_assmI:\n  assumes mono_r1: \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"([in_codom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>))\n    (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"x' \\<le>\\<^bsub>R1\\<^esub> x'\"\n  and \"in_codom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y'\"\n  shows \"(\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y') \\<le> (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y')\"\n  using dep_mono_wrt_relD[OF mono_r1 \\<open>x' \\<le>\\<^bsub>R1\\<^esub> x'\\<close>] assms(2-4,6)\n  by (blast dest!: t1.half_galois_prop_leftD)\n\ninterpretation flip_inv :\n  transport_Dep_Fun_Rel \"(\\<ge>\\<^bsub>R1\\<^esub>)\" \"(\\<ge>\\<^bsub>L1\\<^esub>)\" r1 l1 \"flip2 R2\" \"flip2 L2\" r2 l2\n  rewrites \"flip_inv.L \\<equiv> (\\<ge>\\<^bsub>R\\<^esub>)\" and \"flip_inv.R \\<equiv> (\\<ge>\\<^bsub>L\\<^esub>)\"\n  and \"flip_inv.t1.counit \\<equiv> \\<eta>\\<^sub>1\"\n  and \"\\<And>R x y. (flip2 R x y)\\<inverse> \\<equiv> R y x\"\n  and \"\\<And>R. in_dom R\\<inverse> \\<equiv> in_codom R\"\n  and \"\\<And>R x1 x2. in_codom (flip2 R x1 x2) \\<equiv> in_dom (R x2 x1)\"\n  and \"\\<And>R S. (R\\<inverse> \\<Rrightarrow>\\<^sub>m S\\<inverse>) \\<equiv> (R \\<Rrightarrow>\\<^sub>m S)\"\n  and \"\\<And>R S x1 x2 x1' x2'. (flip2 R x1 x2 \\<^sub>h\\<unlhd> flip2 S x1' x2') \\<equiv> (S x2' x1' \\<unlhd>\\<^sub>h R x2 x1)\\<inverse>\"\n  and \"\\<And>R S. (R\\<inverse> \\<^sub>h\\<unlhd> S\\<inverse>) \\<equiv> (S \\<unlhd>\\<^sub>h R)\\<inverse>\"\n  and \"\\<And>x1 x2 x3 x4. flip2 L2 x1 x2 \\<le> flip2 L2 x3 x4 \\<equiv> (\\<le>\\<^bsub>L2 x2 x1\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x4 x3\\<^esub>)\"\n  and \"\\<And>(R :: 'z \\<Rightarrow> _) (P :: 'z \\<Rightarrow> bool). reflexive_on P R\\<inverse> \\<equiv> reflexive_on P R\"\n  and \"\\<And>R x1 x2. transitive (flip2 R x1 x2) \\<equiv> transitive (R x2 x1)\"\n  and \"\\<And>x x. ([in_dom (\\<le>\\<^bsub>L2 x' \\<eta>\\<^sub>1 x'\\<^esub>)] \\<Rrightarrow> flip2 R2 (l1 x') (l1 x'))\n    \\<equiv> ([in_dom (\\<le>\\<^bsub>L2 x' \\<eta>\\<^sub>1 x'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x') (l1 x')\\<^esub>))\\<inverse>\"\n  by (simp_all add: flip_inv_left_eq_ge_right flip_inv_right_eq_ge_left\n    t1.flip_counit_eq_unit\n    galois_prop.rel_inv_half_galois_prop_right_eq_half_galois_prop_left_rel_inv)\n\nlemma left_rel_right_if_left_right_relI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x x\\<^esub>)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_dom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y \\<Longrightarrow>\n    (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y) \\<le> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> f\"\n  and \"l f \\<le>\\<^bsub>R\\<^esub> g\"\n  shows \"f \\<le>\\<^bsub>L\\<^esub> r g\"\n  using assms\n  by (intro flip_inv.left_right_rel_if_left_rel_rightI[simplified rel_inv_iff_rel])\n\nlemma left_rel_right_if_left_right_rel_le_right2_assmI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R1\\<^esub>))\\<inverse> r1 l1\"\n  and \"([in_dom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"x \\<le>\\<^bsub>L1\\<^esub> x\"\n  and \"in_dom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y\"\n  shows \"(\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y) \\<le> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y)\"\n  using assms by (intro flip_inv.left_right_rel_if_left_rel_right_ge_left2_assmI\n    [simplified rel_inv_iff_rel])\n  auto\n\nend\n\nlemma left_rel_right_iff_left_right_relI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow>\n    ((\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)) (l2\\<^bsub> x' (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x x\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x' x'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_dom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y \\<Longrightarrow>\n    (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y) \\<le> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y)\"\n  and \"\\<And>x' y'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> in_codom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y' \\<Longrightarrow>\n    (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y') \\<le> (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y')\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> f\"\n  and \"g \\<le>\\<^bsub>R\\<^esub> g\"\n  shows \"f \\<le>\\<^bsub>L\\<^esub> r g \\<longleftrightarrow> l f \\<le>\\<^bsub>R\\<^esub> g\"\n  using assms by (intro iffI left_right_rel_if_left_rel_rightI)\n  (auto intro!: left_rel_right_if_left_right_relI)\n\nlemma half_galois_prop_left2_if_half_galois_prop_left2_if_GaloisI:\n  assumes \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n  and \"x' \\<le>\\<^bsub>R1\\<^esub> x'\"\n  shows \"((\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)) (l2\\<^bsub> x' (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  using assms by (auto intro: t1.right_Galois_if_right_relI)\n\nlemma half_galois_prop_right2_if_half_galois_prop_right2_if_GaloisI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n  and \"x \\<le>\\<^bsub>L1\\<^esub> x\"\n  shows \"((\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  by (auto intro!: assms t1.Galois_left_if_left_relI)\n\nlemma left_rel_right_iff_left_right_relI':\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and galois_prop2: \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow>\n    ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<unlhd> (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x x\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x' x'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow>\n    ([in_dom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow>\n    ([in_codom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>)) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> f\"\n  and \"g \\<le>\\<^bsub>R\\<^esub> g\"\n  shows \"f \\<le>\\<^bsub>L\\<^esub> r g \\<longleftrightarrow> l f \\<le>\\<^bsub>R\\<^esub> g\"\nproof -\n  from galois_prop2 have\n    \"((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n    \"((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n    if \"x \\<^bsub>L1\\<^esub>\\<lessapprox> x'\" for x x'\n    using \\<open>x \\<^bsub>L1\\<^esub>\\<lessapprox> x'\\<close> by blast+\n  with assms show ?thesis\n    by (intro left_rel_right_iff_left_right_relI\n      left_right_rel_if_left_rel_right_ge_left2_assmI\n      left_rel_right_if_left_right_rel_le_right2_assmI\n      half_galois_prop_left2_if_half_galois_prop_left2_if_GaloisI\n      half_galois_prop_right2_if_half_galois_prop_right2_if_GaloisI)\n    auto\nqed\n\nlemma left_rel_right_iff_left_right_rel_if_galois_prop_le_assms_leftI:\n  assumes galois_conn1: \"((\\<le>\\<^bsub>L1\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and refl_L1: \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and antimono_L2:\n    \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3 x4 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | (x2 \\<le>\\<^bsub>L1\\<^esub> x3 \\<and> x4 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x3)] \\<Rrightarrow> (\\<ge>)) L2\"\n  shows \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\nproof -\n  fix x1 x2 assume \"x1 \\<le>\\<^bsub>L1\\<^esub> x2\"\n  with galois_conn1 refl_L1 have \"x1 \\<le>\\<^bsub>L1\\<^esub> x1\" \"x2 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x2\"\n    by (blast intro:\n      t1.rel_unit_if_left_rel_if_half_galois_prop_right_if_mono_wrt_rel)+\n  moreover with refl_L1 have \"x2 \\<le>\\<^bsub>L1\\<^esub> x2\" \"\\<eta>\\<^sub>1 x2 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x2\" by auto\n  moreover note dep_mono_wrt_relD[OF antimono_L2 \\<open>x1 \\<le>\\<^bsub>L1\\<^esub> x2\\<close>]\n    and dep_mono_wrt_relD[OF antimono_L2 \\<open>x1 \\<le>\\<^bsub>L1\\<^esub> x1\\<close>]\n  ultimately show \"(\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\" \"(\\<le>\\<^bsub>L2 x1 (\\<eta>\\<^sub>1 x2)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n    using \\<open>x1 \\<le>\\<^bsub>L1\\<^esub> x2\\<close> by auto\nqed\n\nlemma left_rel_right_iff_left_right_rel_if_galois_prop_le_assms_rightI:\n  assumes galois_conn1: \"((\\<le>\\<^bsub>L1\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and refl_R1: \"reflexive_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and mono_R2:\n    \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | \\<epsilon>\\<^sub>1 x2' \\<le>\\<^bsub>R1\\<^esub> x1'] \\<Rrightarrow>\\<^sub>m [x3' x4' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | x2' \\<le>\\<^bsub>R1\\<^esub> x3'] \\<Rrightarrow> (\\<le>)) R2\"\n  shows \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\nproof -\n  fix x1' x2' assume \"x1' \\<le>\\<^bsub>R1\\<^esub> x2'\"\n  with galois_conn1 refl_R1 have \"x2' \\<le>\\<^bsub>R1\\<^esub> x2'\" \"\\<epsilon>\\<^sub>1 x1' \\<le>\\<^bsub>R1\\<^esub> x1'\"\n    by (blast intro:\n      t1.counit_rel_if_right_rel_if_half_galois_prop_left_if_mono_wrt_rel)+\n  moreover with refl_R1 have \"x1' \\<le>\\<^bsub>R1\\<^esub> x1'\" \"\\<epsilon>\\<^sub>1 x1' \\<le>\\<^bsub>R1\\<^esub> \\<epsilon>\\<^sub>1 x1'\" by auto\n  moreover note dep_mono_wrt_relD[OF mono_R2 \\<open>\\<epsilon>\\<^sub>1 x1' \\<le>\\<^bsub>R1\\<^esub> x1'\\<close>]\n    and dep_mono_wrt_relD[OF mono_R2 \\<open>x1' \\<le>\\<^bsub>R1\\<^esub> x1'\\<close>]\n  ultimately show \"(\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x1') x2'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\" \"(\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n    using \\<open>x1' \\<le>\\<^bsub>R1\\<^esub> x2'\\<close> by auto\nqed\n\ncorollary left_rel_right_iff_left_right_rel_if_monoI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<unlhd> (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n  and \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3 x4 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | (x2 \\<le>\\<^bsub>L1\\<^esub> x3 \\<and> x4 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x3)] \\<Rrightarrow> (\\<ge>)) L2\"\n  and \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | \\<epsilon>\\<^sub>1 x2' \\<le>\\<^bsub>R1\\<^esub> x1'] \\<Rrightarrow>\\<^sub>m [x3' x4' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | x2' \\<le>\\<^bsub>R1\\<^esub> x3'] \\<Rrightarrow> (\\<le>)) R2\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow>\n    ([in_dom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow>\n    ([in_codom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>)) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> f\"\n  and \"g \\<le>\\<^bsub>R\\<^esub> g\"\n  shows \"f \\<le>\\<^bsub>L\\<^esub> r g \\<longleftrightarrow> l f \\<le>\\<^bsub>R\\<^esub> g\"\n  using assms by (intro left_rel_right_iff_left_right_relI'\n    left_rel_right_iff_left_right_rel_if_galois_prop_le_assms_leftI\n    left_rel_right_iff_left_right_rel_if_galois_prop_le_assms_rightI)\n  (auto intro: reflexive_on_if_le_pred_if_reflexive_on\n    in_field_if_in_dom in_field_if_in_codom)\n\nend\n\n\nparagraph \\<open>Function Relator\\<close>\n\ncontext transport_Fun_Rel\nbegin\n\ncorollary left_right_rel_if_left_rel_rightI:\n  assumes \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"transitive (\\<le>\\<^bsub>R2\\<^esub>)\"\n  and \"g \\<le>\\<^bsub>R\\<^esub> g\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> r g\"\n  shows \"l f \\<le>\\<^bsub>R\\<^esub> g\"\n  using assms by (intro tdfr.left_right_rel_if_left_rel_rightI) simp_all\n\ncorollary left_rel_right_if_left_right_relI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"transitive (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> f\"\n  and \"l f \\<le>\\<^bsub>R\\<^esub> g\"\n  shows \"f \\<le>\\<^bsub>L\\<^esub> r g\"\n  using assms by (intro tdfr.left_rel_right_if_left_right_relI) simp_all\n\ncorollary left_rel_right_iff_left_right_relI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<unlhd> (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"transitive (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"transitive (\\<le>\\<^bsub>R2\\<^esub>)\"\n  and \"f \\<le>\\<^bsub>L\\<^esub> f\"\n  and \"g \\<le>\\<^bsub>R\\<^esub> g\"\n  shows \"f \\<le>\\<^bsub>L\\<^esub> r g \\<longleftrightarrow> l f \\<le>\\<^bsub>R\\<^esub> g\"\n  using assms by (intro tdfr.left_rel_right_iff_left_right_relI) auto\n\nend\n\n\nparagraph \\<open>Monotone Dependent Function Relator\\<close>\n\ncontext transport_Mono_Dep_Fun_Rel\nbegin\n\nlemma half_galois_prop_left_left_rightI:\n  assumes \"(tdfr.L \\<Rrightarrow>\\<^sub>m tdfr.R) l\"\n  and \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow>\n    ((\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)) (l2\\<^bsub> x' (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x' x'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x' y'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> in_codom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y' \\<Longrightarrow>\n    (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y') \\<le> (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y')\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  unfolding left_rel_eq_tdfr_left_Refl_Rel right_rel_eq_tdfr_right_Refl_Rel using assms\n  by (intro\n    half_galois_prop_leftI[unfolded left_rel_eq_tdfr_left_Refl_Rel right_rel_eq_tdfr_right_Refl_Rel]\n    Refl_Rel_app_leftI[where ?f=l]\n    tdfr.left_right_rel_if_left_rel_rightI)\n  auto\n\nlemma half_galois_prop_right_left_rightI:\n  assumes \"(tdfr.R \\<Rrightarrow>\\<^sub>m tdfr.L) r\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x x\\<^esub>)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_dom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y \\<Longrightarrow>\n    (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y) \\<le> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  unfolding left_rel_eq_tdfr_left_Refl_Rel right_rel_eq_tdfr_right_Refl_Rel using assms\n  by (intro\n    half_galois_prop_rightI[unfolded left_rel_eq_tdfr_left_Refl_Rel right_rel_eq_tdfr_right_Refl_Rel]\n    Refl_Rel_app_rightI[where ?f=r]\n    tdfr.left_rel_right_if_left_right_relI)\n  auto\n\ncorollary galois_prop_left_rightI:\n  assumes \"(tdfr.L \\<Rrightarrow>\\<^sub>m tdfr.R) l\" and \"(tdfr.R \\<Rrightarrow>\\<^sub>m tdfr.L) r\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow>\n    ((\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)) (l2\\<^bsub> x' (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (r2\\<^bsub>x (l1 x)\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x x\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x' x'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x y. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> in_dom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) y \\<Longrightarrow>\n    (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub> y) \\<le> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>) (l2\\<^bsub>(l1 x) x\\<^esub> y)\"\n  and \"\\<And>x' y'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> in_codom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) y' \\<Longrightarrow>\n    (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub> y') \\<le> (\\<ge>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub> y')\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<unlhd> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro galois_propI half_galois_prop_left_left_rightI\n    half_galois_prop_right_left_rightI)\n  auto\n\ncorollary galois_prop_left_rightI':\n  assumes \"(tdfr.L \\<Rrightarrow>\\<^sub>m tdfr.R) l\" and \"(tdfr.R \\<Rrightarrow>\\<^sub>m tdfr.L) r\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and galois_prop2: \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow>\n    ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<unlhd> (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> (\\<le>\\<^bsub>L2 x2 x2\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow> (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>) \\<le> (\\<le>\\<^bsub>L2 x x\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow> (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x' x'\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> (\\<le>\\<^bsub>R2 x1' x1'\\<^esub>) \\<le> (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow>\n    ([in_dom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow>\n    ([in_codom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>)) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<unlhd> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\nproof -\n  from galois_prop2 have\n    \"((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n    \"((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n    if \"x \\<^bsub>L1\\<^esub>\\<lessapprox> x'\" for x x'\n    using \\<open>x \\<^bsub>L1\\<^esub>\\<lessapprox> x'\\<close> by blast+\n  with assms show ?thesis by (intro galois_prop_left_rightI\n    tdfr.left_right_rel_if_left_rel_right_ge_left2_assmI\n    tdfr.left_rel_right_if_left_right_rel_le_right2_assmI\n    tdfr.half_galois_prop_left2_if_half_galois_prop_left2_if_GaloisI\n    tdfr.half_galois_prop_right2_if_half_galois_prop_right2_if_GaloisI)\n    auto\nqed\n\ncorollary galois_prop_left_right_if_mono_if_galois_propI:\n  assumes \"(tdfr.L \\<Rrightarrow>\\<^sub>m tdfr.R) l\" and \"(tdfr.R \\<Rrightarrow>\\<^sub>m tdfr.L) r\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_field (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"\\<And>x x'. x \\<^bsub>L1\\<^esub>\\<lessapprox> x' \\<Longrightarrow> ((\\<le>\\<^bsub>L2 x (r1 x')\\<^esub>) \\<unlhd> (\\<le>\\<^bsub>R2 (l1 x) x'\\<^esub>)) (l2\\<^bsub>x' x\\<^esub>) (r2\\<^bsub>x x'\\<^esub>)\"\n  and \"([x1 x2 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>)] \\<Rrightarrow>\\<^sub>m [x3 x4 \\<Colon> (\\<le>\\<^bsub>L1\\<^esub>) | (x2 \\<le>\\<^bsub>L1\\<^esub> x3 \\<and> x4 \\<le>\\<^bsub>L1\\<^esub> \\<eta>\\<^sub>1 x3)] \\<Rrightarrow> (\\<ge>)) L2\"\n  and \"([x1' x2' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | \\<epsilon>\\<^sub>1 x2' \\<le>\\<^bsub>R1\\<^esub> x1'] \\<Rrightarrow>\\<^sub>m [x3' x4' \\<Colon> (\\<le>\\<^bsub>R1\\<^esub>) | x2' \\<le>\\<^bsub>R1\\<^esub> x3'] \\<Rrightarrow> (\\<le>)) R2\"\n  and \"\\<And>x. x \\<le>\\<^bsub>L1\\<^esub> x \\<Longrightarrow>\n    ([in_dom (\\<le>\\<^bsub>L2 x (\\<eta>\\<^sub>1 x)\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>R2 (l1 x) (l1 x)\\<^esub>)) (l2\\<^bsub>(l1 x) x\\<^esub>) (l2\\<^bsub>(l1 x) (\\<eta>\\<^sub>1 x)\\<^esub>)\"\n  and \"\\<And>x'. x' \\<le>\\<^bsub>R1\\<^esub> x' \\<Longrightarrow>\n    ([in_codom (\\<le>\\<^bsub>R2 (\\<epsilon>\\<^sub>1 x') x'\\<^esub>)] \\<Rrightarrow> (\\<le>\\<^bsub>L2 (r1 x') (r1 x')\\<^esub>)) (r2\\<^bsub>(r1 x') (\\<epsilon>\\<^sub>1 x')\\<^esub>) (r2\\<^bsub>(r1 x') x'\\<^esub>)\"\n  and \"\\<And>x1 x2. x1 \\<le>\\<^bsub>L1\\<^esub> x2 \\<Longrightarrow> transitive (\\<le>\\<^bsub>L2 x1 x2\\<^esub>)\"\n  and \"\\<And>x1' x2'. x1' \\<le>\\<^bsub>R1\\<^esub> x2' \\<Longrightarrow> transitive (\\<le>\\<^bsub>R2 x1' x2'\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<unlhd> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro galois_prop_left_rightI'\n    tdfr.left_rel_right_iff_left_right_rel_if_galois_prop_le_assms_leftI\n    tdfr.left_rel_right_iff_left_right_rel_if_galois_prop_le_assms_rightI)\n  (auto intro: reflexive_on_if_le_pred_if_reflexive_on\n    in_field_if_in_dom in_field_if_in_codom)\n\ntext \\<open>Note that we could further rewrite\n@{thm \"galois_prop_left_right_if_mono_if_galois_propI\"},\nas we will do later for Galois connections, by applying\n@{thm \"tdfr.mono_wrt_rel_leftI\"} and @{thm \"tdfr.mono_wrt_rel_rightI\"} to the\nfirst premises. However, this is not really helpful here.\nMoreover, the resulting theorem will not result in a\nuseful lemma for the flipped instance of @{locale transport_Dep_Fun_Rel}\nsince @{thm \"tdfr.mono_wrt_rel_leftI\"} and @{thm \"tdfr.mono_wrt_rel_rightI\"} are\nnot flipped dual but only flipped-inversed dual.\\<close>\n\nend\n\n\nparagraph \\<open>Monotone Function Relator\\<close>\n\ncontext transport_Mono_Fun_Rel\nbegin\n\nlemma half_galois_prop_left_left_rightI:\n  assumes \"((\\<le>\\<^bsub>R1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L1\\<^esub>)) r1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R2\\<^esub>)) l2\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"transitive (\\<le>\\<^bsub>R2\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<^sub>h\\<unlhd> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms\n  by (intro tpdfr.half_galois_prop_left_left_rightI tfr.mono_wrt_rel_leftI)\n  simp_all\n\ninterpretation flip : transport_Mono_Fun_Rel R1 L1 r1 l1 R2 L2 r2 l2 .\n\nlemma half_galois_prop_right_left_rightI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>R1\\<^esub>)) l1\"\n  and \"((\\<le>\\<^bsub>L1\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>R2\\<^esub>) \\<Rrightarrow>\\<^sub>m (\\<le>\\<^bsub>L2\\<^esub>)) r2\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"transitive (\\<le>\\<^bsub>L2\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<unlhd>\\<^sub>h (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms\n  by (intro tpdfr.half_galois_prop_right_left_rightI flip.tfr.mono_wrt_rel_leftI)\n  simp_all\n\ncorollary galois_prop_left_rightI:\n  assumes \"((\\<le>\\<^bsub>L1\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R1\\<^esub>)) l1 r1\"\n  and \"reflexive_on (in_codom (\\<le>\\<^bsub>L1\\<^esub>)) (\\<le>\\<^bsub>L1\\<^esub>)\"\n  and \"reflexive_on (in_dom (\\<le>\\<^bsub>R1\\<^esub>)) (\\<le>\\<^bsub>R1\\<^esub>)\"\n  and \"((\\<le>\\<^bsub>L2\\<^esub>) \\<stileturn> (\\<le>\\<^bsub>R2\\<^esub>)) l2 r2\"\n  and \"transitive (\\<le>\\<^bsub>L2\\<^esub>)\"\n  and \"transitive (\\<le>\\<^bsub>R2\\<^esub>)\"\n  shows \"((\\<le>\\<^bsub>L\\<^esub>) \\<unlhd> (\\<le>\\<^bsub>R\\<^esub>)) l r\"\n  using assms by (intro tpdfr.galois_propI\n    half_galois_prop_left_left_rightI half_galois_prop_right_left_rightI)\n  auto\n\nend\n\n\nend", "meta": {"author": "kappelmann", "repo": "transport-isabelle", "sha": "b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff", "save_path": "github-repos/isabelle/kappelmann-transport-isabelle", "path": "github-repos/isabelle/kappelmann-transport-isabelle/transport-isabelle-b6d2cb56ea4abf6e496d1c258d5b3d2a816d75ff/Transport/Functions/Transport_Functions_Galois_Property.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102775181399, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.311757023638045}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n(*<*)\ntheory EgTop\nimports GenFilterSystem\nbegin\n(*>*)\n\nsubsection \\<open>\\label{ssec:archprop}Architectural Properties\\<close>\n\ntext \\<open>\n  Using the most generalised (untrusted) version of the system, we cannot show\n  anything except architectural properties. These are true by construction of\n  the generated system. To demonstrate this, we show a proof that the\n  @{term client} and @{term store} instances cannot directly communicate.\n\n  First we introduce some definitions to aid the statement of the property. A\n  predicate specifying that a component sends on a given channel is defined as\n  @{term sends_on}.\n\\<close>\n\nfun\n  sends_on :: \"channel \\<Rightarrow> component \\<Rightarrow> bool\"\nwhere\n   \"sends_on c (Request f _) = (\\<exists>s. \\<exists>q \\<in> f s. q_channel q = c)\"\n | \"sends_on c (a ;; b) = (sends_on c a \\<or> sends_on c b)\"\n | \"sends_on c (IF cond THEN a ELSE b) =\n     (\\<forall>s. cond s \\<and> sends_on c a \\<or> \\<not> cond s \\<and> sends_on c b)\"\n | \"sends_on c (WHILE cond DO a) = (\\<forall>s. cond s \\<and> sends_on c a \\<or> \\<not> cond s)\"\n | \"sends_on c (a \\<squnion> b) = (sends_on c a \\<or> sends_on c b)\"\n | \"sends_on _ _ = False\"\n\ntext \\<open>\n  The corresponding predicate for receiving on a channel is defined as\n  @{term receives_on}.\n\\<close>\n\nfun\n  receives_on :: \"channel \\<Rightarrow> component \\<Rightarrow> bool\"\nwhere\n   \"receives_on c (Response f) = (\\<exists>q s. \\<exists>a \\<in> f q s. a_channel (snd a) = c)\"\n | \"receives_on c (a ;; b) = (receives_on c a \\<or> receives_on c b)\"\n | \"receives_on c (IF cond THEN a ELSE b) =\n     (\\<forall>s. cond s \\<and> receives_on c a \\<or> \\<not> cond s \\<and> receives_on c b)\"\n | \"receives_on c (WHILE cond DO a) =\n     (\\<forall>s. cond s \\<and> receives_on c a \\<or> \\<not> cond s)\"\n | \"receives_on c (a \\<squnion> b) = (receives_on c a \\<or> receives_on c b)\"\n | \"receives_on _ _ = False\"\n\ntext \\<open>\n  Now whether a component communicates on a channel can be defined as the\n  disjunction of these two.\n\\<close>\n\ndefinition\n  communicates_on :: \"channel \\<Rightarrow> component \\<Rightarrow> bool\"\nwhere\n  \"communicates_on ch c \\<equiv> sends_on ch c \\<or> receives_on ch c\"\n\ntext \\<open>\n  We can now state, and prove, the property that @{term client} and\n  @{term store} never directly communicate.\n\\<close>\n\nlemma \"\\<forall>c.\n  \\<not>(communicates_on c client_untrusted \\<and> communicates_on c store_untrusted)\"\n  unfolding communicates_on_def client_untrusted_def Client_untrusted_def\n            store_untrusted_def Store_untrusted_def\n  apply clarsimp\n  unfolding UserStep_def ArbitraryRequest_def ArbitraryResponse_def\n  apply clarsimp\n  apply (case_tac c, clarsimp+)\n  done\n\ntext \\<open>\n  Were we to try reasoning about a property of the system that depended upon\n  the behaviour of any component in the system, we would not be able to do it\n  using the existing definitions. To show a property of this form we need to\n  provide a more precise definition of the critical components. An example of\n  this is shown in the next section.\n\\<close>\n\n(*<*)\n(* Whether a component ever sends a question in a given set. *)\nfun\n  sends :: \"component \\<Rightarrow> channel question set \\<Rightarrow> bool\"\nwhere\n   \"sends (Request f _) qs = (\\<exists>s. \\<exists>q \\<in> f s. q \\<in> qs)\"\n | \"sends (a ;; b) qs = (sends a qs \\<or> sends b qs)\"\n | \"sends (IF cond THEN a ELSE b) qs = (\\<forall>s. cond s \\<and> sends a qs \\<or> \\<not> cond s \\<and> sends b qs)\"\n | \"sends (WHILE cond DO a) qs = (\\<forall>s. cond s \\<and> sends a qs \\<or> \\<not> cond s)\"\n | \"sends (a \\<squnion> b) qs = (sends a qs \\<or> sends b qs)\"\n | \"sends _ _ = False\"\n\ntext \\<open>\n  Reasoning about a property of the system execution itself is not possible\n  because we have not described what the components themselves actually do. For\n  example, proving that the client never reads the secret is not possible.\n\\<close>\n\nlemma \"\\<forall>p. \\<exists>e s. gs\\<^sub>0 p = Some (e, s) \\<and>\n           (e = client_untrusted \\<or>\n            \\<not>(\\<exists>c. sends e {x. q_channel x = c \\<and> q_data x = Return [String ''baz'']} \\<and>\n              receives_on c client_untrusted))\"\n  oops\n\nend\n(*>*)\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/camkes/glue-spec/example-untrusted/EgTop.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102636778401, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3117570168260137}}
{"text": "theory Worklist_Subsumption_Impl1\n  imports Refine_Imperative_HOL.IICF Worklist_Subsumption1\nbegin\n\n  subsection \\<open>Implementation on Lists\\<close>\n\n  (* XXX Duplication, see DBM_Operations_Impl *)\n  lemma list_ex_foldli:\n    \"list_ex P xs = foldli xs Not (\\<lambda> x y. P x \\<or> y) False\"\n   apply (induction xs)\n   apply (simp; fail)\n   subgoal for x xs\n    apply simp\n    apply (induction xs)\n   by auto\n  done\n\n  lemma list_filter_foldli:\n    \"[x \\<leftarrow> xs. P x] = rev (foldli xs (\\<lambda> x. True) (\\<lambda> x xs. if P x then x # xs else xs) [])\"\n    (is \"_ = rev (foldli xs ?c ?f [])\")\n  proof -\n    have *:\n      \"rev (foldli xs ?c ?f (ys @ zs)) = rev zs @ rev (foldli xs ?c ?f ys)\" for xs ys zs\n    proof (induction xs arbitrary: ys)\n      case Nil\n      then show ?case by simp\n    next\n      case (Cons x xs)\n      from Cons[of \"x # ys\"] Cons[of ys] show ?case by simp\n    qed\n    show ?thesis\n      apply (induction xs)\n       apply (simp; fail)\n      apply simp\n      apply (subst (2) *[of _ \"[]\", simplified])\n      by simp\n  qed\n\n  (* XXX Move *)\n  context notes [split!] = list.split begin\n  sepref_decl_op list_hdtl: \"\\<lambda> (x # xs) \\<Rightarrow> (x, xs)\" :: \"[\\<lambda>l. l\\<noteq>[]]\\<^sub>f \\<langle>A\\<rangle>list_rel \\<rightarrow> A \\<times>\\<^sub>r \\<langle>A\\<rangle>list_rel\"\n    by auto\n  end\n\n  context Worklist4_Impl\n  begin\n    sepref_register \"PR_CONST a\\<^sub>0\" \"PR_CONST F'\" \"PR_CONST (\\<unlhd>)\" \"PR_CONST succs\" \"PR_CONST empty\"\n\n    \n\n    (* XXX Now obsolete *)\n    lemma take_from_mset_as_mop_mset_pick: \"take_from_mset = mop_mset_pick\"\n      apply (intro ext)\n      unfolding take_from_mset_def[abs_def]\n      by (auto simp: pw_eq_iff refine_pw_simps)\n\n    lemma take_from_list_alt_def:\n      \"take_from_list xs = do {_ \\<leftarrow> ASSERT (xs \\<noteq> []); RETURN (hd_tl xs)}\"\n      unfolding take_from_list_def by (auto simp: pw_eq_iff refine_pw_simps)\n\n    lemma [safe_constraint_rules]: \"CN_FALSE is_pure A \\<Longrightarrow> is_pure A\" by simp\n\n\n    sepref_thm filter_insert_wait_impl is\n      \"uncurry (RETURN oo PR_CONST filter_insert_wait)\" :: \"(list_assn A)\\<^sup>d *\\<^sub>a A\\<^sup>d \\<rightarrow>\\<^sub>a list_assn A\"\n      unfolding filter_insert_wait_alt_def list_ex_foldli list_filter_foldli\n      unfolding HOL_list.fold_custom_empty\n      unfolding PR_CONST_def\n      by sepref\n\n    concrete_definition (in -) filter_insert_wait_impl\n      uses Worklist4_Impl.filter_insert_wait_impl.refine_raw is \"(uncurry ?f, _) \\<in> _\"\n\n    lemmas [sepref_fr_rules] = filter_insert_wait_impl.refine[OF Worklist4_Impl_axioms]\n\n    sepref_register filter_insert_wait\n\n\n    lemmas [sepref_fr_rules] = hd_tl_hnr\n\n    sepref_thm worklist_algo2_impl is \"uncurry0 worklist_algo2\" :: \"unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n      unfolding worklist_algo2_def worklist_algo2'_def add_succ2_alt_def PR_CONST_def\n      supply [[goals_limit = 1]]\n      supply conv_to_is_Nil[simp]\n      apply (rewrite in \"Let \\<hole> _\" lso_fold_custom_empty)\n      unfolding fold_lso_bex\n      unfolding take_from_list_alt_def\n      apply (rewrite in \"[a\\<^sub>0]\" HOL_list.fold_custom_empty)\n      by sepref\n\n    concrete_definition (in -) worklist_algo2_impl\n    for Lei a\\<^sub>0i Fi succsi emptyi\n    uses Worklist4_Impl.worklist_algo2_impl.refine_raw is \"(uncurry0 ?f,_)\\<in>_\"\n\n    end \\<comment> \\<open>Worklist4 Impl\\<close>\n\n  context Worklist4_Impl_finite_strict\n    begin\n\n    lemma worklist_algo2_impl_hnr_F_reachable:\n      \"(uncurry0 (worklist_algo2_impl Lei a\\<^sub>0i Fi succsi emptyi), uncurry0 (RETURN F_reachable))\n      \\<in> unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n      using worklist_algo2_impl.refine[OF Worklist4_Impl_axioms,\n        FCOMP worklist_algo2_ref[THEN nres_relI],\n        FCOMP worklist_algo''_correct[THEN Id_SPEC_refine, THEN nres_relI]]\n      by (simp add: RETURN_def)\n\n    sepref_decl_op F_reachable :: \"bool_rel\" .\n    lemma [def_pat_rules]: \"F_reachable \\<equiv> op_F_reachable\" by simp\n\n\n    lemma hnr_op_F_reachable:\n      assumes \"GEN_ALGO a\\<^sub>0i (\\<lambda>a\\<^sub>0i. (uncurry0 a\\<^sub>0i, uncurry0 (RETURN a\\<^sub>0)) \\<in> unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a A)\"\n      assumes \"GEN_ALGO Fi (\\<lambda>Fi. (Fi,RETURN o F') \\<in> A\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn)\"\n      assumes \"GEN_ALGO Lei (\\<lambda>Lei. (uncurry Lei,uncurry (RETURN oo (\\<unlhd>))) \\<in> A\\<^sup>k *\\<^sub>a A\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn)\"\n      assumes \"GEN_ALGO succsi (\\<lambda>succsi. (succsi,RETURN o succs) \\<in> A\\<^sup>k \\<rightarrow>\\<^sub>a list_assn A)\"\n      assumes \"GEN_ALGO emptyi (\\<lambda>Fi. (Fi,RETURN o empty) \\<in> A\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn)\"\n      shows\n        \"(uncurry0 (worklist_algo2_impl Lei a\\<^sub>0i Fi succsi emptyi), uncurry0 (RETURN (PR_CONST op_F_reachable)))\n        \\<in> unit_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool_assn\"\n    proof -\n      from assms interpret Worklist4_Impl E a\\<^sub>0 F \"(\\<preceq>)\" succs empty \"(\\<unlhd>)\" F' A succsi a\\<^sub>0i Fi Lei emptyi\n        by (unfold_locales; simp add: GEN_ALGO_def)\n\n      from worklist_algo2_impl_hnr_F_reachable show ?thesis by simp\n    qed\n\n    sepref_decl_impl hnr_op_F_reachable .\n\n  end \\<comment> \\<open>Worklist4 (strictly finite)\\<close>\n\nend \\<comment> \\<open>End of Theory\\<close>\n", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Worklist_Algorithms/Worklist_Subsumption_Impl1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.3117290326035732}}
{"text": "theory op_tee_init\nimports \"Op_Tee_Def\" \"Op_Tee_Spec\" \"../State_Machine\"\n\nbegin\n\nsection\"The sys instantiation of state machine\"\n\nconsts sys_conf :: \"Sys_Conf\"\n\ndefinition sys_config_witness :: \"Sys_Conf\"\n  where \"sys_config_witness \\<equiv> \n  \\<lparr> kerneler_conf = undefined,\n    cpus_conf={},\n    procs_conf =Map.empty,\n    objs_conf = Map.empty \\<rparr>\"\n\nspecification(sys_conf)\n  proc_not_kernel: \"(procs_conf sys_conf) x \\<noteq> None \n                    \\<Longrightarrow> x \\<noteq> kerneler_conf sys_conf\"\n  kernel_not_proc: \"kerneler_conf sys_conf = x \n                    \\<Longrightarrow> (procs_conf sys_conf) x = None\"\n  domainid_eq_pid: \"\\<forall> p. (procs_conf sys_conf) p \\<noteq> None \n                    \\<longrightarrow> subjid_name(subjattr_procid(proc_subattr_conf(the((procs_conf sys_conf) p))))  = p\"\nproof-\n  have p1: \"\\<exists> f n na .f (n::nat) = (None::Proc_Conf option) \\<and> f na = None \\<and> na \\<noteq> n\"\n    by fastforce\n  have p2: \"\\<exists> sys_conf .(\\<forall> p. (procs_conf sys_conf) p \\<noteq> None \n                    \\<longrightarrow> subjid_name(subjattr_procid(proc_subattr_conf(the((procs_conf sys_conf) p))))  = p)\"\n    using sys_config_witness_def\n    by (metis Sys_Conf.select_convs(3))\n  show ?thesis\n    using sys_config_witness_def p1 p2\n  proof -\n    show ?thesis\n      by (metis Sys_Conf.select_convs(1) Sys_Conf.select_convs(3) sys_config_witness_def)\n  qed   \nqed\n\ndefinition sys_init :: \"Sys_Conf \\<Rightarrow> Sys_State\"\n  where\"sys_init sc \\<equiv> \\<lparr> \n                        currents = Map.empty,                      \n                        objs = Map.empty,\n                        procs = Map.empty,\n                        memories = {},\n                        mode = (TEE Privilege)\n                       \\<rparr>\"\n\nconsts fn_s0 :: Sys_State\n\ndefinition \"fn_s0_witness \\<equiv> sys_init sys_conf\"\n\nspecification(fn_s0)\n  fn_s0_init: \"fn_s0 = fn_s0_witness\"\n  by simp\n\ndefinition fn_step :: \"Event \\<Rightarrow> (Sys_State\\<times> Sys_State) set\"\n  where\"fn_step event = {(s,s'). s' \\<in> \n  (case \n    event \n   of \n    sys_call (TEE_OBJ_CREATE sc poa) pa \\<Rightarrow>\n                            {fst(utee_obj_create s sc pa poa)} |\n    sys_call (TEE_OBJ_COPY poa r) pa \\<Rightarrow>\n                            {fst(utee_obj_copy s pa poa r)} |\n    sys_call (TEE_OBJ_CLOSE poa) pa \\<Rightarrow>\n                            {fst(utee_obj_close s pa poa)} |\n    sys_call (TEE_OBJ_DEL poa) pa \\<Rightarrow>\n                            {fst(utee_obj_del s pa poa)} |\n    sys_call (TEE_OBJ_TRANS dst_pa channel_poa trans_poa) src_pa \\<Rightarrow>\n                            {fst(utee_channel_transmit s src_pa dst_pa channel_poa trans_poa)}|\n    kernel_event (TEE_OBJ_DEBUG poa) pa \\<Rightarrow>\n                            {fst(mbedtls_debug_print_buf s pa poa)})}\"\n\n(*get the domain*)\ndefinition fn_dom :: \"Sys_State \\<Rightarrow> Event \\<Rightarrow> Pid option\"\n  where \"fn_dom s e \\<equiv>\n  case \n    e\n  of\n    sys_call _ poa \\<Rightarrow> Some(subjid_name(subjattr_procid(poa)))\"\n\ndefinition equiv_object :: \"Sys_State \\<Rightarrow> Kid \\<Rightarrow> Sys_State \\<Rightarrow> bool\"\n  where \"equiv_object s kid t \\<equiv>\n  kernel_objs s kid = kernel_objs t kid\"\n\ndefinition equiv_handle:: \"Sys_State \\<Rightarrow> Pid \\<Rightarrow> Sys_State \\<Rightarrow> bool\"\n  where \"equiv_handle s pid t \\<equiv>\n  \\<forall> hid . proc_handles(the(procs s pid)) hid = proc_handles(the(procs t pid)) hid \\<and>\n          equiv_object s (kernel_obj_id(the(proc_handles(the(procs s pid)) hid))) t\"\n\ndefinition equiv_proc :: \"Sys_State \\<Rightarrow> Pid \\<Rightarrow> Sys_State \\<Rightarrow> bool\"\n  where \"equiv_proc s pid t \\<equiv>\n  procs s pid = procs t pid \\<and> equiv_handle s pid t\"\n\ndefinition fn_equiv :: \"Sys_State \\<Rightarrow> Pid \\<Rightarrow> Sys_State \\<Rightarrow> bool\" (\"(_~_~_)\")\n  where \"fn_equiv s pid t \\<equiv>\n  if\n    is_proc sys_conf pid\n  then\n    equiv_proc s pid t\n  else if \n    is_kernel sys_conf pid\n  then\n    True\n  else\n    False\"\n\n\ndefinition fn_interfence :: \"Pid \\<Rightarrow> Pid \\<Rightarrow> bool\" (\"(_ \\<leadsto> _)\")\n  where \"fn_interfence d1 d2 \\<equiv>\n  if\n    d1 = d2\n  then\n    True\n  else if\n    is_kernel sys_conf d1\n  then\n    True\n  else\n    False\"\n\ndefinition fn_non_interference :: \"Pid \\<Rightarrow> Pid \\<Rightarrow> bool\" (\"(_ \\<setminus>\\<leadsto> _)\")\n  where \"(u \\<setminus>\\<leadsto>  v) \\<equiv> \\<not> (u \\<leadsto> v)\"\n\ndeclare equiv_object_def[cong] and equiv_handle_def[cong] and equiv_proc_def[cong] and\n        fn_equiv_def[cong] fn_interfence_def[cong] fn_non_interference_def[cong] and fn_dom_def[cong]\n\nlemma equiv_proc_transitive :\n  \"\\<forall> s t r d. equiv_proc s d t \\<and> equiv_proc t d r \n              \\<longrightarrow> equiv_proc s d r\"\n   by auto\n\nlemma equiv_proc_symmetic :\n  \"\\<forall> s t d. equiv_proc s d t \n            \\<longrightarrow> equiv_proc t d s\"\n  by auto\n\nlemma equiv_proc_reflexive : \n  \"\\<forall> s d. equiv_proc s d s\"\n  by auto\n\nlemma fn_equiv_relfexive:\n  \"\\<forall> s d . fn_equiv s d s\"\n  using equiv_proc_reflexive try0 \nlemma fn_kernel_intf_all :\n  \"\\<forall> d. fn_interfence (kerneler_conf sys_conf) d\"\n  by (simp add: is_kernel_def)\n\nlemma fn_not_intf_kernel :\n  \"\\<forall> d. fn_interfence d (kerneler_conf sys_conf) \\<longrightarrow>\n        d = (kerneler_conf sys_conf)\"\n  by (simp add: is_kernel_def)\n\nlemma fn_intf_reflexive: \"fn_interfence d d\"\n  by auto\n\nlemma fn_reachable: \n  \"\\<forall> s a. (SM.reachable0 fn_s0 fn_step) s \\<longrightarrow>\n          (\\<exists> s'. (s,s') \\<in> fn_step a)\"\nproof -\n  {\n    fix s a\n    assume p0: \"(SM.reachable0 fn_s0 fn_step) s\"\n    have \"\\<exists> s' .(s,s') \\<in> fn_step a\"\n    proof(induct a)\n      case (sys_call x1 x2)\n      then show ?case\n        apply(induct x1)\n        by (simp add:fn_step_def)+\n    next\n      case (kernel_event x1 x2)\n      then show ?case \n        apply (induct x1)\n      by (simp add:fn_step_def)+\n    qed\n  }\n  then show ?thesis by simp\nqed\n\ninterpretation SM_enabled\n        fn_s0 fn_step fn_dom  \"kerneler_conf sys_conf\" fn_equiv fn_interfence\n  using fn_reachable fn_kernel_intf_all fn_not_intf_kernel equiv_proc_reflexive\n        equiv_proc_transitive equiv_proc_symmetic fn_intf_reflexive\nend", "meta": {"author": "ZZJ22160008", "repo": "test", "sha": "5c7bca50d6ea000274dff6318058eecd2a9337c6", "save_path": "github-repos/isabelle/ZZJ22160008-test", "path": "github-repos/isabelle/ZZJ22160008-test/test-5c7bca50d6ea000274dff6318058eecd2a9337c6/op_tee_init.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850278370112, "lm_q2_score": 0.4416730056646256, "lm_q1q2_score": 0.3117261945978642}}
{"text": "theory Defs\n  imports \"HOL-IMP.AExp\" \"HOL-IMP.BExp\"\nbegin\n\nfun deduplicate :: \"'a list \\<Rightarrow> 'a list\" where\n  \"deduplicate [] = []\"\n| \"deduplicate [x] = [x]\"\n| \"deduplicate (x # y # xs) = (if x = y then deduplicate (y # xs) else x # deduplicate (y # xs))\"\n\nlemma \"length (deduplicate xs) \\<le> length xs\"\n  by (induction xs rule: deduplicate.induct) auto\n\nfun subst :: \"vname \\<Rightarrow> aexp \\<Rightarrow> aexp \\<Rightarrow> aexp\" where\n  \"subst x a' (N n) = N n\"\n| \"subst x a' (V y) = (if x=y then a' else V y)\"\n| \"subst x a' (Plus a1 a2) = Plus (subst x a' a1) (subst x a' a2)\"\n\nlemma subst_lemma: \"aval (subst x a' a) s = aval a (s(x:=aval a' s))\"\n  by (induct a) auto\n\nlemma comp: \"aval a1 s = aval a2 s \\<Longrightarrow> aval (subst x a1 a) s = aval (subst x a2 a) s\"\n  by (simp add: subst_lemma)\n\ndatatype aexp' = N' int | V' vname | PI' vname | Plus' aexp' aexp'\n\nfun aval' where\n  \"aval' (N' n) s = (n,s)\" |\n  \"aval' (V' x) s = (s x, s)\" |\n  \"aval' (PI' x) s = (s x, s(x := 1 + s x))\" |\n  \"aval' (Plus' a1 a2) s = (\n    let (v1, s') = aval' a1 s; (v2, s'') = aval' a2 s'\n    in (v1 + v2, s''))\"\n\nlemma \"aval' (Plus' (PI' x) (V' x)) <> \\<noteq> aval' (Plus' (V' x) (PI' x)) <>\"\n  by auto\n\nlemma aval'_inc': \"aval' a s = (v,s') \\<Longrightarrow> s x \\<le> s' x\"\n  apply (induct a arbitrary: s s' v)\n     apply (auto split: prod.splits)\n  apply fastforce\n  done\n\nlemma aval'_inc:\n  \"aval' a <> = (v, s') \\<Longrightarrow> 0 \\<le> s' x\"\n  using aval'_inc' by (fastforce simp: null_state_def)\n\nend", "meta": {"author": "VTrelat", "repo": "P4F", "sha": "389c6e9087c354320335d1da28b76962b45754b6", "save_path": "github-repos/isabelle/VTrelat-P4F", "path": "github-repos/isabelle/VTrelat-P4F/P4F-389c6e9087c354320335d1da28b76962b45754b6/AExp/Defs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3117102658359745}}
{"text": "theory ValueOntologyTest     (*Benzmüller, Fuenmayor & Lomfeld, 2020*)  \n  imports ValueOntologyNew \nbegin\n\n(*exploring the consistency and models of the ontology*)\nlemma \"True\" nitpick[satisfy,show_all,card i=1] oops\nlemma \"True\" nitpick[satisfy,show_all,card i=10] oops\n\nlemma \"\\<lfloor>INCONS\\<^sup>p\\<rfloor>\" nitpick[satisfy,card i=4] nitpick oops (*contingent*)\nlemma \"\\<lfloor>INDIFF\\<^sup>p\\<rfloor>\" nitpick[satisfy,card i=4] nitpick oops (*contingent*)\n\n(****the pair of Ext/Int operators satisfies the main properties of Galois connections ****)\nlemma G:  \"B \\<^bold>\\<sqsubseteq> A\\<up> \\<longleftrightarrow> A \\<^bold>\\<sqsubseteq> B\\<down>\" by blast\n\nlemma G1:      \"A \\<^bold>\\<sqsubseteq> A\\<up>\\<down>\" by simp\nlemma G2:      \"B \\<^bold>\\<sqsubseteq> B\\<down>\\<up>\" by simp\nlemma G3:     \"A\\<^sub>1 \\<^bold>\\<sqsubseteq> A\\<^sub>2 \\<longrightarrow> A\\<^sub>2\\<up> \\<^bold>\\<sqsubseteq> A\\<^sub>1\\<up>\" by simp\nlemma G4:     \"B\\<^sub>1 \\<^bold>\\<sqsubseteq> B\\<^sub>2 \\<longrightarrow> B\\<^sub>2\\<down> \\<^bold>\\<sqsubseteq> B\\<^sub>1\\<down>\" by simp\n\nlemma cl1:    \"A\\<up> = A\\<up>\\<down>\\<up>\" by blast\nlemma cl2:    \"B\\<down> = B\\<down>\\<up>\\<down>\" by blast\nlemma dual1a: \"(A\\<^sub>1 \\<^bold>\\<squnion> A\\<^sub>2)\\<up> = (A\\<^sub>1\\<up> \\<^bold>\\<sqinter> A\\<^sub>2\\<up>)\" by blast\nlemma dual1b: \"(B\\<^sub>1 \\<^bold>\\<squnion> B\\<^sub>2)\\<down> = (B\\<^sub>1\\<down> \\<^bold>\\<sqinter> B\\<^sub>2\\<down>)\" by blast\n\nlemma          \"(A\\<^sub>1 \\<^bold>\\<sqinter> A\\<^sub>2)\\<up> \\<^bold>\\<sqsubseteq> (A\\<^sub>1\\<up> \\<^bold>\\<squnion> A\\<^sub>2\\<up>)\" nitpick oops\nlemma          \"(B\\<^sub>1 \\<^bold>\\<sqinter> B\\<^sub>2)\\<down> \\<^bold>\\<sqsubseteq> (B\\<^sub>1\\<down> \\<^bold>\\<squnion> B\\<^sub>2\\<down>)\" nitpick oops\nlemma dual2a: \"(A\\<^sub>1\\<up> \\<^bold>\\<squnion> A\\<^sub>2\\<up>) \\<^bold>\\<sqsubseteq>  (A\\<^sub>1 \\<^bold>\\<sqinter> A\\<^sub>2)\\<up>\" by blast\nlemma dual2b: \"(B\\<^sub>1\\<down> \\<^bold>\\<squnion> B\\<^sub>2\\<down>) \\<^bold>\\<sqsubseteq>  (B\\<^sub>1 \\<^bold>\\<sqinter> B\\<^sub>2)\\<down>\" by blast\n\n(***** test notation **)\nlemma \"(let y = x\\<inverse> in WILL\\<^sup>y) = WILL\\<^sup>x\\<inverse>\" by meson\n(*both notations do the same. TODO: do we want to do away with rhs?*)\nlemma \"\\<lfloor>[WILL\\<^sup>x\\<oplus>STAB\\<^sup>x] \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor> \\<equiv> \\<lfloor>(WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x)\\<down> \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" by simp\n\n(********* value ontology tests *****************)\nlemma \"SECU\\<^sup>x \\<^bold>\\<sqsubseteq> RELI\\<^sup>x\" by simp\nlemma \"RELI\\<^sup>x\\<down> \\<^bold>\\<sqsubseteq> SECU\\<^sup>x\\<down>\" by simp\nlemma \"\\<lfloor>RELI\\<^sup>x\\<down> \\<^bold>\\<rightarrow> SECU\\<^sup>x\\<down>\\<rfloor>\" by simp\nlemma \"EQUA\\<^sup>x \\<^bold>\\<sqsubseteq> RELI\\<^sup>x\" by simp\nlemma \"RELI\\<^sup>x\\<down> \\<^bold>\\<sqsubseteq> EQUA\\<^sup>x\\<down>\" by simp\nlemma \"\\<lfloor>RELI\\<^sup>x\\<down> \\<^bold>\\<rightarrow> EQUA\\<^sup>x\\<down>\\<rfloor>\" by simp\nlemma \"\\<lfloor>RELI\\<^sup>x\\<down> \\<^bold>\\<rightarrow> (SECU\\<^sup>x\\<down> \\<^bold>\\<and> EQUA\\<^sup>x\\<down>)\\<rfloor>\" by simp\n\nlemma \"\\<lfloor>RELI\\<^sup>p\\<down> \\<^bold>\\<and> WILL\\<^sup>p\\<down> \\<^bold>\\<rightarrow> INCONS\\<^sup>p\\<rfloor>\" by simp \nlemma \"\\<lfloor>INCONS\\<^sup>p \\<^bold>\\<rightarrow> RELI\\<^sup>p\\<down> \\<^bold>\\<and> WILL\\<^sup>p\\<down>\\<rfloor>\" by simp \n\nlemma \"\\<lfloor>RELI\\<^sup>p\\<down> \\<^bold>\\<and> WILL\\<^sup>p\\<down>\\<rfloor>\" nitpick[satisfy] nitpick oops (*contingent*)\nlemma \"\\<lfloor>FAIR\\<^sup>d\\<down> \\<^bold>\\<and> EFFI\\<^sup>d\\<down>\\<rfloor>\" nitpick[satisfy] nitpick oops (*contingent*)\nlemma \"\\<lfloor>(\\<^bold>\\<not>INCONS\\<^sup>p) \\<^bold>\\<and> [FAIR\\<^sup>d] \\<^bold>\\<and> [EFFI\\<^sup>d]\\<rfloor>\"\n   nitpick[satisfy,show_all] nitpick oops (*contingent: p & d are independent*)\nlemma \"\\<lfloor>(\\<^bold>\\<not>INCONS\\<^sup>d) \\<^bold>\\<and> (\\<^bold>\\<not>INCONS\\<^sup>p) \\<^bold>\\<and> [RELI\\<^sup>d] \\<^bold>\\<and> [WILL\\<^sup>p]\\<rfloor>\" \n  nitpick[satisfy,show_all] nitpick oops (*contingent: p & d are independent*)\n\n(*more tests*)\nlemma \"\\<lfloor>[WILL\\<^sup>x\\<oplus>STAB\\<^sup>x] \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" nitpick oops (*two non-opposed quadrants \\<oplus> (noq): consistent*)\nlemma \"\\<lfloor>WILL\\<^sup>x\\<down> \\<^bold>\\<and> STAB\\<^sup>x\\<down> \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" nitpick oops (*two non-opposed quadrants \\<and> (noq): consistent*)\n\nlemma \"\\<lfloor>[WILL\\<^sup>x\\<oplus>GAIN\\<^sup>X\\<oplus>EFFI\\<^sup>x\\<oplus>STAB\\<^sup>x] \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" nitpick oops (*two noq \\<oplus>: consistent*)\nlemma \"\\<lfloor>WILL\\<^sup>x\\<down> \\<^bold>\\<and> GAIN\\<^sup>X\\<down> \\<^bold>\\<and> EFFI\\<^sup>x\\<down> \\<^bold>\\<and> STAB\\<^sup>x\\<down> \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" nitpick oops (*two noq \\<and>: consistent*)\n\nlemma \"\\<lfloor>[WILL\\<^sup>x\\<oplus>EFFI\\<^sup>x\\<oplus>RELI\\<^sup>x] \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" nitpick oops (*three quadrants \\<oplus>: consistent*)\nlemma \"\\<lfloor>WILL\\<^sup>x\\<down> \\<^bold>\\<and> EFFI\\<^sup>x\\<down> \\<^bold>\\<and> RELI\\<^sup>x\\<down> \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" by simp (*three quadrants \\<and>: inconsistent*)\n\nlemma \"\\<lfloor>[RESP\\<^sup>x\\<oplus>STAB\\<^sup>x] \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" nitpick oops (*two opposed quadrants \\<oplus> (oq): consistent*)\nlemma \"\\<lfloor>RESP\\<^sup>x\\<down> \\<^bold>\\<and> STAB\\<^sup>x\\<down> \\<^bold>\\<rightarrow> INCONS\\<^sup>x\\<rfloor>\" by simp (*two opposed quadrants \\<and> (oq): inconsistent*)\n\nlemma \"\\<lfloor>[EQUI\\<^sup>x\\<oplus>EFFI\\<^sup>y] \\<^bold>\\<rightarrow> (INCONS\\<^sup>x \\<^bold>\\<or> INCONS\\<^sup>y)\\<rfloor>\" nitpick oops (*two noq (different parties) \\<oplus>: consistent*)\nlemma \"\\<lfloor>EQUI\\<^sup>x\\<down> \\<^bold>\\<and> EFFI\\<^sup>y\\<down> \\<^bold>\\<rightarrow> (INCONS\\<^sup>x \\<^bold>\\<or> INCONS\\<^sup>y)\\<rfloor>\" nitpick oops (*two noq (different parties) \\<and>: consistent*)\n\nlemma \"\\<lfloor>[RESP\\<^sup>x\\<oplus>STAB\\<^sup>y] \\<^bold>\\<rightarrow> (INCONS\\<^sup>x \\<^bold>\\<or> INCONS\\<^sup>y)\\<rfloor>\" nitpick oops (*two oq (different parties) \\<oplus>: consistent*)\nlemma \"\\<lfloor>RESP\\<^sup>x\\<down> \\<^bold>\\<and> STAB\\<^sup>y\\<down> \\<^bold>\\<rightarrow> (INCONS\\<^sup>x \\<^bold>\\<or> INCONS\\<^sup>y)\\<rfloor>\" nitpick oops (*two oq (different parties) \\<and>: consistent*)\n\n(* value preferences tests*)\nlemma \"\\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x\\<rfloor>\"\n  nitpick nitpick[satisfy] oops (*contingent*)\nlemma \"\\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v STAB\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x\\<rfloor>\" by blast\nlemma \"\\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v STAB\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v RELI\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x\\<rfloor>\" by blast\nlemma \"\\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v STAB\\<^sup>x\\<rfloor>\"\n  nitpick nitpick[satisfy] oops (*contingent*)\nlemma \"\\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v RELI\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>WILL\\<^sup>x \\<^bold>\\<prec>\\<^sub>v STAB\\<^sup>x\\<rfloor>\"\n  nitpick nitpick[satisfy] oops (*contingent*)\nlemma \"\\<not>\\<lfloor>WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor>\" using rBR by auto\nlemma \"\\<lfloor>WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor>\" by auto\nlemma \"\\<lfloor>RELI\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor>\" by auto\nlemma \"\\<lfloor>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>WILL\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor>\" \n  nitpick nitpick[satisfy] oops (*contingent*)\nlemma \"\\<lfloor>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor> \\<longrightarrow> \\<lfloor>RELI\\<^sup>x\\<^bold>\\<oplus>STAB\\<^sup>x \\<^bold>\\<prec>\\<^sub>v WILL\\<^sup>x\\<rfloor>\" \n  nitpick nitpick[satisfy] oops (*contingent*)\n\nend\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/Preference-Logics/vanBenthemEtAl2009/OLD/ValueOntologyTest.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3117102658359745}}
{"text": "theory utp_hoare\nimports utp_rel_laws\nbegin\n\ntext \\<open>Hoare triples\\<close>\n\ndefinition hoare_r :: \"('s \\<Rightarrow> bool) \\<Rightarrow> 's hrel \\<Rightarrow> ('s \\<Rightarrow> bool) \\<Rightarrow> bool\" where\n[pred]: \"hoare_r p Q r = ((p\\<^sup>< \\<longrightarrow> r\\<^sup>>)\\<^sub>e \\<sqsubseteq> Q)\"\n\nsyntax \n  \"_hoare_r\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"\\<^bold>{_\\<^bold>}/ _/ \\<^bold>{_\\<^bold>}\")\n  \"_hoare_r\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"H{_}/ _/ {_}\")\n\ntranslations \"_hoare_r P S Q\" == \"CONST hoare_r (P)\\<^sub>e S (Q)\\<^sub>e\"\n\n\nnamed_theorems hoare and hoare_safe\n\nlemma hoare_meaning: \"H{p}Q{r} = (\\<forall> s s'. p s \\<and> Q (s, s') \\<longrightarrow> r s')\"\n  by (pred_auto)\n\nlemma hoare_alt_def: \"\\<^bold>{b\\<^bold>}P\\<^bold>{c\\<^bold>} = (P ;; \\<questiondown>c? \\<sqsubseteq> \\<questiondown>b? ;; P)\"\n  by (pred_auto)\n\nlemma hoare_assume: \"\\<^bold>{P\\<^bold>}S\\<^bold>{Q\\<^bold>} \\<Longrightarrow> \\<questiondown>P? ;; S = \\<questiondown>P? ;; S ;; \\<questiondown>Q?\"\n  by (pred_auto)\n\nlemma hoare_pre_assume_1: \"\\<^bold>{b \\<and> c\\<^bold>}P\\<^bold>{d\\<^bold>} = \\<^bold>{c\\<^bold>}\\<questiondown>b? ;; P\\<^bold>{d\\<^bold>}\"\n  by (pred_auto)\n\nlemma hoare_pre_assume_2: \"\\<^bold>{b \\<and> c\\<^bold>}P\\<^bold>{d\\<^bold>} = \\<^bold>{b\\<^bold>}\\<questiondown>c? ;; P\\<^bold>{d\\<^bold>}\"\n  by pred_auto\n                               \nlemma hoare_test [hoare_safe]: \"`p \\<and> b \\<longrightarrow> q` \\<Longrightarrow> \\<^bold>{p\\<^bold>}\\<questiondown>b?\\<^bold>{q\\<^bold>}\"\n  by pred_auto\n\nlemma hoare_gcmd [hoare_safe]: \"\\<^bold>{p \\<and> b\\<^bold>}P\\<^bold>{q\\<^bold>} \\<Longrightarrow> \\<^bold>{p\\<^bold>}\\<questiondown>b? ;; P\\<^bold>{q\\<^bold>}\"\n  by pred_auto\n\nlemma hoare_r_conj [hoare_safe]: \"\\<lbrakk> \\<^bold>{p\\<^bold>}Q\\<^bold>{r\\<^bold>}; \\<^bold>{p\\<^bold>}Q\\<^bold>{s\\<^bold>} \\<rbrakk> \\<Longrightarrow> \\<^bold>{p\\<^bold>}Q\\<^bold>{r \\<and> s\\<^bold>}\"\n  by pred_auto\n\nlemma hoare_r_weaken_pre [hoare]:\n  \"\\<^bold>{p\\<^bold>}Q\\<^bold>{r\\<^bold>} \\<Longrightarrow> \\<^bold>{p \\<and> q\\<^bold>}Q\\<^bold>{r\\<^bold>}\"\n  \"\\<^bold>{q\\<^bold>}Q\\<^bold>{r\\<^bold>} \\<Longrightarrow> \\<^bold>{p \\<and> q\\<^bold>}Q\\<^bold>{r\\<^bold>}\"\n  by pred_auto+\n\n\n\nlemma hoare_r_conseq: \"\\<lbrakk> \\<^bold>{p\\<^sub>2\\<^bold>}S\\<^bold>{q\\<^sub>2\\<^bold>}; `p\\<^sub>1 \\<longrightarrow> p\\<^sub>2`; `q\\<^sub>2 \\<longrightarrow> q\\<^sub>1` \\<rbrakk> \\<Longrightarrow> \\<^bold>{p\\<^sub>1\\<^bold>}S\\<^bold>{q\\<^sub>1\\<^bold>}\"\n  by pred_auto\n\nlemma hoare_r_cut:\n  assumes \"\\<^bold>{b\\<^bold>}P\\<^bold>{b\\<^bold>}\" \"\\<^bold>{b \\<and> c\\<^bold>}P\\<^bold>{c\\<^bold>}\"\n  shows \"\\<^bold>{b \\<and> c\\<^bold>}P\\<^bold>{b \\<and> c\\<^bold>}\"\n  using assms by pred_auto\n\nlemma hoare_r_cut_simple: \n  assumes \"\\<^bold>{b\\<^bold>}P\\<^bold>{b\\<^bold>}\" \"\\<^bold>{c\\<^bold>}P\\<^bold>{c\\<^bold>}\"\n  shows \"\\<^bold>{b \\<and> c\\<^bold>}P\\<^bold>{b \\<and> c\\<^bold>}\"\n  using assms by pred_auto\n\nlemma hoare_oracle: \"\\<^bold>{p\\<^bold>}false\\<^bold>{q\\<^bold>}\"\n  by (simp add: hoare_r_def)\n\nsubsection \\<open> Sequence Laws \\<close>\n\nlemma seq_hoare_r: \"\\<lbrakk> \\<^bold>{p\\<^bold>}Q\\<^sub>1\\<^bold>{s\\<^bold>} ; \\<^bold>{s\\<^bold>}Q\\<^sub>2\\<^bold>{r\\<^bold>} \\<rbrakk> \\<Longrightarrow> \\<^bold>{p\\<^bold>}Q\\<^sub>1 ;; Q\\<^sub>2\\<^bold>{r\\<^bold>}\"\n  by (pred_auto)\n \nlemma seq_hoare_invariant [hoare_safe]: \"\\<lbrakk> \\<^bold>{p\\<^bold>}Q\\<^sub>1\\<^bold>{p\\<^bold>} ; \\<^bold>{p\\<^bold>}Q\\<^sub>2\\<^bold>{p\\<^bold>} \\<rbrakk> \\<Longrightarrow> \\<^bold>{p\\<^bold>}Q\\<^sub>1 ;; Q\\<^sub>2\\<^bold>{p\\<^bold>}\"\n  by (pred_auto)\n\nlemma seq_hoare_stronger_pre_1 [hoare_safe]: \n  \"\\<lbrakk> \\<^bold>{p \\<and> q\\<^bold>}Q\\<^sub>1\\<^bold>{p \\<and> q\\<^bold>} ; \\<^bold>{p \\<and> q\\<^bold>}Q\\<^sub>2\\<^bold>{q\\<^bold>} \\<rbrakk> \\<Longrightarrow> \\<^bold>{p \\<and> q\\<^bold>}Q\\<^sub>1 ;; Q\\<^sub>2\\<^bold>{q\\<^bold>}\"\n  using seq_hoare_r by blast\n\nlemma seq_hoare_stronger_pre_2 [hoare_safe]: \n  \"\\<lbrakk> \\<^bold>{p \\<and> q\\<^bold>}Q\\<^sub>1\\<^bold>{p \\<and> q\\<^bold>} ; \\<^bold>{p \\<and> q\\<^bold>}Q\\<^sub>2\\<^bold>{p\\<^bold>} \\<rbrakk> \\<Longrightarrow> \\<^bold>{p \\<and> q\\<^bold>}Q\\<^sub>1 ;; Q\\<^sub>2\\<^bold>{p\\<^bold>}\"\n  using seq_hoare_r by blast\n    \nlemma seq_hoare_inv_r_2 [hoare]: \"\\<lbrakk> \\<^bold>{p\\<^bold>}Q\\<^sub>1\\<^bold>{q\\<^bold>} ; \\<^bold>{q\\<^bold>}Q\\<^sub>2\\<^bold>{q\\<^bold>} \\<rbrakk> \\<Longrightarrow> \\<^bold>{p\\<^bold>}Q\\<^sub>1 ;; Q\\<^sub>2\\<^bold>{q\\<^bold>}\"\n  using seq_hoare_r by blast\n\nlemma seq_hoare_inv_r_3 [hoare]: \"\\<lbrakk> \\<^bold>{p\\<^bold>}Q\\<^sub>1\\<^bold>{p\\<^bold>} ; \\<^bold>{p\\<^bold>}Q\\<^sub>2\\<^bold>{q\\<^bold>} \\<rbrakk> \\<Longrightarrow> \\<^bold>{p\\<^bold>}Q\\<^sub>1 ;; Q\\<^sub>2\\<^bold>{q\\<^bold>}\"\n  using seq_hoare_r by blast\n\nsubsection \\<open> Assignment Laws \\<close>\n\nlemma assigns_hoare_r [hoare_safe]: \"`p \\<longrightarrow> \\<sigma> \\<dagger> q` \\<Longrightarrow> \\<^bold>{p\\<^bold>}\\<langle>\\<sigma>\\<rangle>\\<^sub>a\\<^bold>{q\\<^bold>}\"\n  by pred_auto\n  \nlemma assigns_backward_hoare_r: \n  \"\\<^bold>{\\<sigma> \\<dagger> p\\<^bold>}\\<langle>\\<sigma>\\<rangle>\\<^sub>a\\<^bold>{p\\<^bold>}\"\n  by pred_auto\n\n\n\nlemma assigns_init_hoare [hoare_safe]:\n  \"\\<lbrakk> vwb_lens x; $x \\<sharp> p; $x \\<sharp> v; \\<^bold>{$x = v \\<and> p\\<^bold>}S\\<^bold>{q\\<^bold>} \\<rbrakk> \\<Longrightarrow> \\<^bold>{p\\<^bold>}(x := v) ;; S\\<^bold>{q\\<^bold>}\"\n  by pred_auto\n\nlemma assigns_init_hoare_general:\n  \"\\<lbrakk> vwb_lens x; \\<And> x\\<^sub>0. \\<^bold>{$x = v\\<lbrakk>\\<guillemotleft>x\\<^sub>0\\<guillemotright>/x\\<rbrakk> \\<and> p\\<lbrakk>\\<guillemotleft>x\\<^sub>0\\<guillemotright>/x\\<rbrakk>\\<^bold>}S\\<^bold>{q\\<^bold>} \\<rbrakk> \\<Longrightarrow> \\<^bold>{p\\<^bold>}x := v ;; S\\<^bold>{q\\<^bold>}\"\n  by (rule seq_hoare_r, rule assign_floyd_hoare_r, simp, pred_auto)\n\nlemma assigns_final_hoare [hoare_safe]:\n  \"\\<^bold>{p\\<^bold>}S\\<^bold>{\\<sigma> \\<dagger> q\\<^bold>} \\<Longrightarrow> \\<^bold>{p\\<^bold>}S ;; \\<langle>\\<sigma>\\<rangle>\\<^sub>a\\<^bold>{q\\<^bold>}\"\n  by (pred_auto)\n\nlemma skip_hoare_r [hoare_safe]: \"\\<^bold>{p\\<^bold>}II\\<^bold>{p\\<^bold>}\"\n  by pred_auto\n\nlemma skip_hoare_impl_r [hoare_safe]: \"`p \\<longrightarrow> q` \\<Longrightarrow> \\<^bold>{p\\<^bold>}II\\<^bold>{q\\<^bold>}\"\n  by pred_auto  \n\nsubsection \\<open> Conditional Laws \\<close>\n\nlemma cond_hoare_r [hoare_safe]: \"\\<lbrakk> \\<^bold>{b \\<and> p\\<^bold>}S\\<^bold>{q\\<^bold>} ; \\<^bold>{\\<not>b \\<and> p\\<^bold>}T\\<^bold>{q\\<^bold>} \\<rbrakk> \\<Longrightarrow> \\<^bold>{p\\<^bold>}S \\<lhd> b \\<rhd> T\\<^bold>{q\\<^bold>}\"\n  by pred_auto\n\nlemma cond_hoare_r_wp: \n  assumes \"\\<^bold>{p'\\<^bold>}S\\<^bold>{q\\<^bold>}\" and \"\\<^bold>{p''\\<^bold>}T\\<^bold>{q\\<^bold>}\"\n  shows \"\\<^bold>{(b \\<and> p') \\<sqinter> (\\<not>b \\<and> p'')\\<^bold>} S \\<lhd> b \\<rhd> T \\<^bold>{q\\<^bold>}\"\n  using assms by pred_auto\n\nlemma cond_hoare_r_sp:\n  assumes \"\\<^bold>{(b \\<and> p)\\<^bold>}S\\<^bold>{q\\<^bold>}\" and \"\\<^bold>{\\<not>b \\<and> p\\<^bold>}T\\<^bold>{s\\<^bold>}\"\n  shows \"\\<^bold>{p\\<^bold>}S \\<lhd> b \\<rhd> T\\<^bold>{q \\<or> s\\<^bold>}\"\n  using assms by pred_auto\n\nlemma hoare_ndet [hoare_safe]: \n  assumes \"\\<^bold>{p\\<^bold>}P\\<^bold>{q\\<^bold>}\" \"\\<^bold>{p\\<^bold>}Q\\<^bold>{q\\<^bold>}\"\n  shows \"\\<^bold>{p\\<^bold>}(P \\<sqinter> Q)\\<^bold>{q\\<^bold>}\"\n  using assms by (pred_auto)\n\nlemma hoare_disj [hoare_safe]: \n  assumes \"\\<^bold>{p\\<^bold>}P\\<^bold>{q\\<^bold>}\" \"\\<^bold>{p\\<^bold>}Q\\<^bold>{q\\<^bold>}\"\n  shows \"\\<^bold>{p\\<^bold>}(P \\<sqinter> Q)\\<^bold>{q\\<^bold>}\"\n  using assms by (pred_auto)\n\nlemma hoare_UINF [hoare_safe]:\n  assumes \"\\<And>i. i \\<in> A \\<Longrightarrow> \\<^bold>{p\\<^bold>}P(i)\\<^bold>{q\\<^bold>}\"\n  shows \"\\<^bold>{p\\<^bold>}(\\<Sqinter> {P(i)|i. i\\<in>A})\\<^bold>{q\\<^bold>}\"\n  by (pred_auto assms: assms)\n\nsubsection \\<open> Recursion Laws \\<close>\n\nlemma nu_hoare_r_partial: \n  assumes induct_step: \"\\<And>P st. \\<^bold>{p\\<^bold>}P\\<^bold>{q\\<^bold>} \\<Longrightarrow> \\<^bold>{p\\<^bold>}F P\\<^bold>{q\\<^bold>}\"   \n  shows \"\\<^bold>{p\\<^bold>}\\<nu> F\\<^bold>{q\\<^bold>}\"\n  using assms\n  unfolding hoare_r_def pred_ref_iff_le\n  by (rule lfp_lowerbound, pred_auto)\n\n(*\nlemma mu_hoare_r:\n  assumes WF: \"wf R\"\n  assumes M:\"mono F\"  \n  assumes induct_step:\n    \"\\<Sqinter> st P. \\<^bold>{p \\<and> (e,\\<guillemotleft>st\\<guillemotright>) \\<in> \\<guillemotleft>R\\<guillemotright>\\<^bold>}P\\<^bold>{q\\<^bold>} \\<Longrightarrow> \\<^bold>{p \\<and> e = \\<guillemotleft>st\\<guillemotright>\\<^bold>}F P\\<^bold>{q\\<^bold>}\"   \n  shows \"\\<^bold>{p\\<^bold>}\\<mu> F \\<^bold>{q\\<^bold>}\"\n  unfolding hoare_r_def\nproof (rule mu_rec_total_utp_rule[OF WF M , of _ e ], goal_cases)\n  case (1 st)\n  then show ?case \n    using induct_step[unfolded hoare_r_def, of st \"(p\\<^sup>< \\<and> (e\\<^sup><, \\<guillemotleft>st\\<guillemotright>) \\<in> \\<guillemotleft>R\\<guillemotright> \\<longrightarrow> q\\<^sup>>)\\<^sub>u\"]\n      by (simp add: usubst)\nqed\n    \\<Sqinter>\nlemma mu_hoare_r':\n  assumes WF: \"wf R\"\n  assumes M:\"mono F\"  \n  assumes induct_step:\n    \"\\<Sqinter> st P. \\<^bold>{p \\<and> (e,\\<guillemotleft>st\\<guillemotright>) \\<in> \\<guillemotleft>R\\<guillemotright>\\<^bold>} P \\<^bold>{q\\<^bold>} \\<Longrightarrow> \\<^bold>{p \\<and> e = \\<guillemotleft>st\\<guillemotright>\\<^bold>} F P \\<^bold>{q\\<^bold>}\" \n  assumes I0: \"`p' \\<longrightarrow> p`\"  \n  shows \"\\<^bold>{p'\\<^bold>} \\<mu> F \\<^bold>{q\\<^bold>}\"\n  using I0 M WF assms(3) mu_hoare_r pre_str_hoare_r by blast\n*)\nsubsection \\<open> Iteration Rules \\<close>\n\n(*\nlemma iter_hoare_r [hoare_safe]: \"\\<^bold>{P\\<^bold>}S\\<^bold>{P\\<^bold>} \\<Longrightarrow> \\<^bold>{P\\<^bold>}S\\<^sup>\\<star>\\<^bold>{P\\<^bold>}\"\n   using rtrancl_induct by (pred_auto, fastforce)\n*)\n\nlemma while_hoare_r [hoare_safe]:\n  assumes \"\\<^bold>{p \\<and> b\\<^bold>}S\\<^bold>{p\\<^bold>}\"\n  shows \"\\<^bold>{p\\<^bold>}while b do S od\\<^bold>{\\<not>b \\<and> p\\<^bold>}\"\nproof (simp add: while_top_def hoare_r_def assms)\n  have \"(p\\<^sup>< \\<longrightarrow> (\\<not> b \\<and> p)\\<^sup>>)\\<^sub>e \\<sqsubseteq> S ;; (p\\<^sup>< \\<longrightarrow> (\\<not> b \\<and> p)\\<^sup>>)\\<^sub>e \\<lhd> b \\<rhd> II\"\n    using assms by pred_auto\n  then show \"(p\\<^sup>< \\<longrightarrow> (\\<not> b \\<and> p)\\<^sup>>)\\<^sub>e \\<sqsubseteq> (\\<nu> X \\<bullet> S ;; X \\<lhd> b \\<rhd> II)\"\n    by (simp add: pred_ref_iff_le lfp_lowerbound)\nqed\n\nlemma while_invr_hoare_r [hoare_safe]:\n  assumes \"\\<^bold>{p \\<and> b\\<^bold>}S\\<^bold>{p\\<^bold>}\" \"`pre' \\<longrightarrow> p`\" \"`(\\<not>b \\<and> p) \\<longrightarrow> post'`\"\n  shows \"\\<^bold>{pre'\\<^bold>}while b invr p do S od\\<^bold>{post'\\<^bold>}\"\n  unfolding while_inv_def using assms while_hoare_r hoare_r_conseq by blast\n\nlemma while_r_minimal_partial:\n  assumes seq_step: \"`p \\<longrightarrow> invar`\"\n  assumes induct_step: \"\\<^bold>{invar \\<and> b\\<^bold>} C \\<^bold>{invar\\<^bold>}\"  \n  shows \"\\<^bold>{p\\<^bold>}while b do C od\\<^bold>{\\<not>b \\<and> invar\\<^bold>}\"\n  using induct_step pre_str_hoare_r seq_step while_hoare_r by blast\n\n(*lemma approx_chain: \n  \"(\\<Sqinter>n::nat. \\<lceil>p \\<and> v <\\<^sub>u \\<guillemotleft>n\\<guillemotright>\\<rceil>\\<^sub><) = \\<lceil>p\\<rceil>\\<^sub><\"\n  by (pred_auto)*)\n\ntext \\<open> Total correctness law for Hoare logic, based on constructive chains. This is limited to\n  variants that have naturals numbers as their range. \\<close>\n    \nlemma while_term_hoare_r:\n  assumes \"\\<And> z::nat. \\<^bold>{p \\<and> b \\<and> v = \\<guillemotleft>z\\<guillemotright>\\<^bold>}S\\<^bold>{p \\<and> v < \\<guillemotleft>z\\<guillemotright>\\<^bold>}\"\n  shows \"\\<^bold>{p\\<^bold>}while\\<^sub>\\<bottom> b do S od\\<^bold>{\\<not>b \\<and> p\\<^bold>}\"\nproof -\n  have \"((p\\<^sup><)\\<^sub>e \\<longrightarrow> ((\\<not> b \\<and> p)\\<^sup>>)\\<^sub>e) \\<sqsubseteq> (\\<mu> X \\<bullet> S ;; X \\<lhd> b \\<rhd> II)\"\n  proof (rule mu_refine_intro)\n    from assms show \"((p\\<^sup><)\\<^sub>e \\<longrightarrow> ((\\<not> b \\<and> p)\\<^sup>>)\\<^sub>e) \\<sqsubseteq> S ;; ((p\\<^sup><)\\<^sub>e \\<longrightarrow> ((\\<not> b \\<and> p)\\<^sup>>)\\<^sub>e) \\<lhd> b \\<rhd> II\"\n      by (pred_auto; smt (z3) hoare_meaning)+\n    let ?E = \"\\<lambda> n. ((p \\<and> v < \\<guillemotleft>n\\<guillemotright>)\\<^sup><)\\<^sub>e\"\n    show \"((p\\<^sup><)\\<^sub>e \\<and> (\\<mu> X \\<bullet> S ;; X \\<lhd> b \\<rhd> II)) = ((p\\<^sup><)\\<^sub>e \\<and> (\\<nu> X \\<bullet> S ;; X \\<lhd> b \\<rhd> II))\"\n    proof (rule constr_fp_uniq[where E=\"?E\"])\n      show \"mono (\\<lambda>X. S ;; X \\<lhd> b \\<rhd> II)\"\n        by (rule cond_seqr_mono)\n      show \"constr (\\<lambda>X. S ;; X \\<lhd> b \\<rhd> II) ?E\"\n        apply (rule constrI, rule chainI)\n          apply (pred_auto, pred_auto, pred_auto)\n        by (smt (verit, del_insts) assms hoare_meaning less_Suc_eq order_less_trans)+\n    qed pred_auto (* Couldn't pattern match last goal *)\n  qed\n  thus ?thesis\n    by (simp add: SEXP_def while_bot_def hoare_r_def impl_pred_def)\nqed\n\nlemma while_vrt_hoare_r [hoare_safe]:\n  assumes \"\\<And> z::nat. \\<^bold>{p \\<and> b \\<and> v = \\<guillemotleft>z\\<guillemotright>\\<^bold>}S\\<^bold>{p \\<and> v < \\<guillemotleft>z\\<guillemotright>\\<^bold>}\" \"`p' \\<longrightarrow> p`\" \"`(\\<not>b \\<and> p) \\<longrightarrow> q'`\"\n  shows \"\\<^bold>{p'\\<^bold>}while b invr p vrt v do S od\\<^bold>{q'\\<^bold>}\"\n  apply (rule hoare_r_conseq[OF _ assms(2) assms(3)])\n  apply (simp add: while_vrt_def)\n  apply (rule while_term_hoare_r[where v=\"v\", OF assms(1)]) \n  done\n  \ntext \\<open> General total correctness law based on well-founded induction \\<close>\n\n(*\nlemma while_wf_hoare_r:\n  assumes WF: \"wf R\"\n  assumes I0: \"`p' \\<longrightarrow> p`\"\n  assumes induct_step:\"\\<And> st. \\<^bold>{b \\<and> p \\<and> e = \\<guillemotleft>st\\<guillemotright>\\<^bold>}Q\\<^bold>{p \\<and> (e, \\<guillemotleft>st\\<guillemotright>) \\<in> \\<guillemotleft>R\\<guillemotright>\\<^bold>}\"\n  assumes PHI:\"`(\\<not>b \\<and> p) \\<longrightarrow> q'`\"  \n  shows \"\\<^bold>{p'\\<^bold>}while\\<^sub>\\<bottom> b invr p do Q od\\<^bold>{q'\\<^bold>}\"\n  unfolding hoare_r_def while_inv_bot_def while_bot_def\nproof (rule pre_weak_rel[of _ \"p\\<^sup><\" ], goal_cases)\n  case 1\n  from I0 show ?case by expr_auto\nnext\n  case 2\n  have \"(p\\<^sup>< \\<longrightarrow> q'\\<^sup>>)\\<^sub>u \\<sqsubseteq> (\\<mu> X \\<bullet> Q ;; X \\<lhd> b \\<rhd> II)\"\n  proof (rule mu_rec_total_utp_rule[where e=e, OF WF])\n    show \"mono (\\<lambda>X. Q ;; X \\<lhd> b \\<rhd> II)\"\n      by (simp add: cond_seqr_mono)\n    have induct_step': \"\\<Sqinter> st. ((b \\<and> p \\<and> e = \\<guillemotleft>st\\<guillemotright>)\\<^sup>< \\<longrightarrow> (p \\<and> (e,\\<guillemotleft>st\\<guillemotright>) \\<in> \\<guillemotleft>R\\<guillemotright>)\\<^sup>>)\\<^sub>u \\<sqsubseteq> Q\"\n      using induct_step by pred_auto  \n    with PHI\n    show \"\\<Sqinter>st. (p\\<^sup>< \\<and> e\\<^sup>< = \\<guillemotleft>st\\<guillemotright> \\<longrightarrow> q'\\<^sup>>)\\<^sub>u \\<sqsubseteq> Q ;; (p\\<^sup>< \\<and> (e\\<^sup><, \\<guillemotleft>st\\<guillemotright>) \\<in> \\<guillemotleft>R\\<guillemotright> \\<longrightarrow> q'\\<^sup>>)\\<^sub>u \\<lhd> b \\<rhd> II\"\n      apply pred_auto\n      by (smt (z3) hoare_meaning induct_step)+\n  qed\n  then show ?case by simp\nqed\n*)\n\nsubsection \\<open> Frame Rules \\<close>\n\ntext \\<open> Frame rule: If starting $S$ in a state satisfying $p establishes q$ in the final state, then\n  we can insert an invariant predicate $r$ when $S$ is framed by $a$, provided that $r$ does not\n  refer to variables in the frame, and $q$ does not refer to variables outside the frame. \\<close>\n\n(* TODO - Fix all these metis proofs *)\n\n(*\nlemma frame_hoare_r:\n  assumes \"idem_scene a\" \"a \\<sharp> r\" \"-a \\<sharp> q\" \"\\<^bold>{p\\<^bold>}P\\<^bold>{q\\<^bold>}\"\n  shows \"\\<^bold>{p \\<and> r\\<^bold>}a:[P]\\<^bold>{q \\<and> r\\<^bold>}\"\n  using assms\n  apply (pred_auto)\n   apply (metis (mono_tags, lifting) Product_Type.Collect_case_prodD frame_def fst_conv hoare_meaning snd_conv)\n  by (metis (mono_tags, lifting) Product_Type.Collect_case_prodD frame_def fst_eqD scene_equiv_def scene_override_commute snd_eqD)\n\nlemma frame_strong_hoare_r [hoare_safe]: \n  assumes \"idem_scene a\" \"a \\<sharp> r\" \"-a \\<sharp> q\" \"\\<^bold>{p \\<and> r\\<^bold>}S\\<^bold>{q\\<^bold>}\"\n  shows \"\\<^bold>{p \\<and> r\\<^bold>}a:[S]\\<^bold>{q \\<and> r\\<^bold>}\"\n  using assms apply (pred_auto)\n   apply (metis (mono_tags, lifting) SEXP_def hoare_meaning rel_frame set_pred_def)\n  by (metis SEXP_def rel_frame scene_equiv_def scene_override_commute set_pred_def)\n\nlemma frame_hoare_r' [hoare_safe]: \n  assumes \"idem_scene a\" \"a \\<sharp> r\" \"-a \\<sharp> q\" \"\\<^bold>{r \\<and> p\\<^bold>}S\\<^bold>{q\\<^bold>}\"\n  shows \"\\<^bold>{r \\<and> p\\<^bold>}a:[S]\\<^bold>{r \\<and> q\\<^bold>}\"\n  using assms apply (pred_auto)\n   apply (metis SEXP_def rel_frame scene_equiv_def scene_override_commute set_pred_def)\n  by (metis (mono_tags, lifting) Product_Type.Collect_case_prodD frame_def fst_conv hoare_meaning snd_conv)\n\nlemma antiframe_hoare_r:\n  assumes \"idem_scene a\" \"-a \\<sharp> r\" \"a \\<sharp> q\" \"\\<^bold>{p\\<^bold>}P\\<^bold>{q\\<^bold>}\"  \n  shows \"\\<^bold>{p \\<and> r\\<^bold>} (-a):[P] \\<^bold>{q \\<and> r\\<^bold>}\"\n  using assms apply (pred_auto)\n   apply (metis (mono_tags, lifting) Product_Type.Collect_case_prodD frame_def fst_conv hoare_meaning snd_conv)\n  by (metis (full_types) SEXP_def rel_frame scene_equiv_def scene_override_commute set_pred_def)\n    \nlemma antiframe_strong_hoare_r:\n  assumes \"idem_scene a\" \"-a \\<sharp> r\" \"a \\<sharp> q\" \"\\<^bold>{p \\<and> r\\<^bold>}P\\<^bold>{q\\<^bold>}\"  \n  shows \"\\<^bold>{p \\<and> r\\<^bold>} (-a):[P] \\<^bold>{q \\<and> r\\<^bold>}\"\n  using assms  apply (pred_auto)\n   apply (metis (mono_tags, lifting) Product_Type.Collect_case_prodD frame_def fst_conv hoare_meaning snd_conv)\n  by (metis (full_types) SEXP_def rel_frame scene_equiv_def scene_override_commute set_pred_def)\n\n\nlemma nmods_invariant:\n  assumes \"S nmods a\" \"-a \\<sharp> p\"\n  shows \"\\<^bold>{p\\<^bold>}S\\<^bold>{p\\<^bold>}\"\n  using assms apply pred_auto\n  by (metis Healthy_def SEXP_def rel_frame scene_equiv_def scene_override_commute set_pred_def)\n*)\n\n(*\nlemma hoare_r_ghost:\n  assumes \"vwb_lens x\" \"x \\<sharp> p\" \"x \\<sharp> q\" \"S nuses x\" \"\\<^bold>{p\\<^bold>}x := e;; S\\<^bold>{q\\<^bold>}\"\n  shows \"\\<^bold>{p\\<^bold>}S\\<^bold>{q\\<^bold>}\" \nproof -\n  have \"\\<^bold>{p\\<^bold>}x := e;; rrestr x S\\<^bold>{q\\<^bold>}\"\n    by (simp add: Healthy_if assms(4) assms(5))\n  with assms(1-3) have \"\\<^bold>{p\\<^bold>}rrestr x S\\<^bold>{q\\<^bold>}\"\n    by (rel_simp,metis mwb_lens.put_put vwb_lens_mwb)\n  thus ?thesis\n    by (simp add: Healthy_if assms(4))\nqed *)\n\nend", "meta": {"author": "isabelle-utp", "repo": "UTP", "sha": "fc446b72cc3620e1d013ccd4d37aa693fb64ba59", "save_path": "github-repos/isabelle/isabelle-utp-UTP", "path": "github-repos/isabelle/isabelle-utp-UTP/UTP-fc446b72cc3620e1d013ccd4d37aa693fb64ba59/utp_hoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3117102658359745}}
{"text": "(*  Author:      Andreas Lochbihler\n    Maintainer:  Andreas Lochbihler\n*)\nsection {* Manual construction of a resumption codatatype *}\n\ntheory Resumption imports \n  \"HOL-Library.Old_Datatype\"\nbegin\n\ntext {*\n  This theory defines the following codatatype:\n\n\\begin{verbatim}\ncodatatype ('a,'b,'c,'d) resumption =\n    Terminal 'a\n  | Linear 'b \"('a,'b,'c,'d) resumption\"\n  | Branch 'c \"'d => ('a,'b,'c,'d) resumption\"\n\\end{verbatim}\n\n*}\n\nsubsection {* Auxiliary definitions and lemmata similar to @{theory Old_Datatype} *}\n\nlemma Lim_mono: \"(\\<And>d. rs d \\<subseteq> rs' d) \\<Longrightarrow> Old_Datatype.Lim rs \\<subseteq> Old_Datatype.Lim rs'\"\nby(simp add: Lim_def) blast\n\nlemma Lim_UN1:  \"Old_Datatype.Lim (\\<lambda>x. \\<Union>y. f x y) = (\\<Union>y. Old_Datatype.Lim (\\<lambda>x. f x y))\"\nby(simp add: Old_Datatype.Lim_def) blast\n\ntext {*\n  Inverse for @{term \"Old_Datatype.Lim\"} like @{term \"Old_Datatype.Split\"} and @{term \"Old_Datatype.Case\"}\n  for @{term \"Old_Datatype.Scons\"} and @{term \"In0\"}/@{term \"In1\"}\n*}\n\ndefinition DTBranch :: \"(('b \\<Rightarrow> ('a, 'b) Old_Datatype.dtree) \\<Rightarrow> 'c) \\<Rightarrow> ('a, 'b) Old_Datatype.dtree \\<Rightarrow> 'c\"\nwhere \"DTBranch f M = (THE u. \\<exists>x. M = Old_Datatype.Lim x \\<and> u = f x)\"\n\nlemma DTBranch_Lim [simp]: \"DTBranch f (Old_Datatype.Lim M) = f M\"\nby(auto simp add: DTBranch_def dest: Lim_inject)\n\ntext {* Lemmas for @{term Old_Datatype.ntrunc} and @{term \"Old_Datatype.Lim\"} *}\n\nlemma ndepth_Push_Node_Inl_aux:\n     \"case_nat (Inl n) f k = Inr 0 \\<Longrightarrow> Suc (LEAST x. f x = Inr 0) <= k\"\napply (induct \"k\", auto)\napply (erule Least_le)\ndone\n\nlemma ndepth_Push_Node_Inl:\n  \"ndepth (Push_Node (Inl a) n) = Suc (ndepth n)\"\nusing Rep_Node[of n, unfolded Node_def]\napply(simp add: ndepth_def Push_Node_def Abs_Node_inverse[OF Node_Push_I[OF Rep_Node]])\napply(simp add: Push_def split_beta)\napply(rule Least_equality)\napply(auto elim: LeastI intro: ndepth_Push_Node_Inl_aux)\ndone\n\nlemma ntrunc_Lim [simp]: \"ntrunc (Suc k) (Old_Datatype.Lim rs) = Old_Datatype.Lim (\\<lambda>x. ntrunc k (rs x))\"\nunfolding Lim_def ntrunc_def\napply(rule equalityI)\napply clarify\napply(auto simp add: ndepth_Push_Node_Inl)\ndone\n\nsubsection {* Definition for the codatatype universe *}\n\ntext {* Constructors *}\n\ndefinition TERMINAL :: \"'a \\<Rightarrow> ('c + 'b + 'a, 'd) Old_Datatype.dtree\"\nwhere \"TERMINAL a = In0 (Old_Datatype.Leaf (Inr (Inr a)))\"\n\ndefinition LINEAR :: \"'b \\<Rightarrow> ('c + 'b + 'a, 'd) Old_Datatype.dtree \\<Rightarrow> ('c + 'b + 'a, 'd) Old_Datatype.dtree\"\n  where \"LINEAR b r = In1 (In0 (Scons (Old_Datatype.Leaf (Inr (Inl b))) r))\"\n\ndefinition BRANCH :: \"'c \\<Rightarrow> ('d \\<Rightarrow> ('c + 'b + 'a, 'd) Old_Datatype.dtree) \\<Rightarrow> ('c + 'b + 'a, 'd) Old_Datatype.dtree\"\n where \"BRANCH c rs = In1 (In1 (Scons (Old_Datatype.Leaf (Inl c)) (Old_Datatype.Lim rs)))\"\n\ntext {* case operator *}\n\ndefinition case_RESUMPTION :: \"('a \\<Rightarrow> 'e) \\<Rightarrow> ('b \\<Rightarrow> (('c + 'b + 'a, 'd) Old_Datatype.dtree) \\<Rightarrow> 'e) \\<Rightarrow> ('c \\<Rightarrow> ('d \\<Rightarrow> ('c + 'b + 'a, 'd) Old_Datatype.dtree) \\<Rightarrow> 'e) \\<Rightarrow> ('c + 'b + 'a, 'd) Old_Datatype.dtree \\<Rightarrow> 'e\"\nwhere \n  \"case_RESUMPTION t l br =\n   Old_Datatype.Case (t o inv (Old_Datatype.Leaf o Inr o Inr))\n                 (Old_Datatype.Case (Old_Datatype.Split (\\<lambda>x. l (inv (Old_Datatype.Leaf o Inr o Inl) x)))\n                                (Old_Datatype.Split (\\<lambda>x. DTBranch (br (inv (Old_Datatype.Leaf o Inl) x)))))\"\n\n\n\nlemma case_RESUMPTION_simps [simp]:\n  shows case_RESUMPTION_TERMINAL: \"case_RESUMPTION t l br (TERMINAL a) = t a\"\n  and case_RESUMPTION_LINEAR: \"case_RESUMPTION t l br (LINEAR b r) = l b r\"\n  and case_RESUMPTION_BRANCH: \"case_RESUMPTION t l br (BRANCH c rs) = br c rs\"\napply(simp_all add: case_RESUMPTION_def TERMINAL_def LINEAR_def BRANCH_def o_def)\napply(rule arg_cong) back\napply(blast intro: injI inv_f_f)\napply(rule arg_cong) back\napply(blast intro: injI inv_f_f)\napply(rule arg_cong) back\napply(blast intro: injI inv_f_f)\ndone\n\nlemma LINEAR_mono: \"r \\<subseteq> r' \\<Longrightarrow> LINEAR b r \\<subseteq> LINEAR b r'\"\nby(simp add: LINEAR_def In1_mono In0_mono Scons_mono)\n\nlemma BRANCH_mono: \"(\\<And>d. rs d \\<subseteq> rs' d) \\<Longrightarrow> BRANCH c rs \\<subseteq> BRANCH c rs'\"\nby(simp add: BRANCH_def In1_mono Scons_mono Lim_mono)\n\nlemma LINEAR_UN: \"LINEAR b (\\<Union>x. f x) = (\\<Union>x. LINEAR b (f x))\"\nby (simp add: LINEAR_def In1_UN1 In0_UN1 Scons_UN1_y)\n\nlemma BRANCH_UN: \"BRANCH b (\\<lambda>d. \\<Union>x. f d x) = (\\<Union>x. BRANCH b (\\<lambda>d. f d x))\"\nby (simp add: BRANCH_def Lim_UN1 In1_UN1 In0_UN1 Scons_UN1_y)\n\ntext {* The codatatype universe *}\n\ncoinductive_set resumption :: \"('c + 'b + 'a, 'd) Old_Datatype.dtree set\"\nwhere\nresumption_TERMINAL:\n  \"TERMINAL a \\<in> resumption\"\n| resumption_LINEAR:\n  \"r \\<in> resumption \\<Longrightarrow> LINEAR b r \\<in> resumption\"\n| resumption_BRANCH:\n  \"(\\<And>d. rs d \\<in> resumption) \\<Longrightarrow> BRANCH c rs \\<in> resumption\"\n\nsubsection {* Definition of the codatatype as a type *}\n\ntypedef ('a,'b,'c,'d) resumption = \"resumption :: ('c + 'b + 'a, 'd) Old_Datatype.dtree set\"\nproof\n  show \"TERMINAL undefined \\<in> ?resumption\" by(blast intro: resumption.intros)\nqed\n\ntext {* Constructors *}\n\ndefinition Terminal :: \"'a \\<Rightarrow> ('a,'b,'c,'d) resumption\"\nwhere \"Terminal a = Abs_resumption (TERMINAL a)\"\n\ndefinition Linear :: \"'b \\<Rightarrow> ('a,'b,'c,'d) resumption \\<Rightarrow> ('a,'b,'c,'d) resumption\"\nwhere \"Linear b r = Abs_resumption (LINEAR b (Rep_resumption r))\"\n\ndefinition Branch :: \"'c \\<Rightarrow> ('d \\<Rightarrow> ('a,'b,'c,'d) resumption) \\<Rightarrow> ('a,'b,'c,'d) resumption\"\nwhere \"Branch c rs = Abs_resumption (BRANCH c (\\<lambda>d. Rep_resumption (rs d)))\"\n\nlemma [iff]:\n  shows Terminal_not_Linear: \"Terminal a \\<noteq> Linear b r\"\n  and Linear_not_Terminal: \"Linear b R \\<noteq> Terminal a\"\n  and Termina_not_Branch: \"Terminal a \\<noteq> Branch c rs\"\n  and Branch_not_Terminal: \"Branch c rs \\<noteq> Terminal a\"\n  and Linear_not_Branch: \"Linear b r \\<noteq> Branch c rs\"\n  and Branch_not_Linear: \"Branch c rs \\<noteq> Linear b r\"\n  and Terminal_inject: \"Terminal a = Terminal a' \\<longleftrightarrow> a = a'\"\n  and Linear_inject: \"Linear b r = Linear b' r' \\<longleftrightarrow> b = b' \\<and> r = r'\"\n  and Branch_inject: \"Branch c rs = Branch c' rs' \\<longleftrightarrow> c = c' \\<and> rs = rs'\"\napply(auto simp add: Terminal_def Linear_def Branch_def simp add: Rep_resumption resumption.intros Abs_resumption_inject Rep_resumption_inject)\napply(subst (asm) fun_eq_iff, auto simp add: Rep_resumption_inject)\ndone\n\nlemma Rep_resumption_constructors:\n  shows Rep_resumption_Terminal: \"Rep_resumption (Terminal a) = TERMINAL a\"\n  and Rep_resumption_Linear: \"Rep_resumption (Linear b r) = LINEAR b (Rep_resumption r)\"\n  and Rep_resumption_Branch: \"Rep_resumption (Branch c rs) = BRANCH c (\\<lambda>d. Rep_resumption (rs d))\"\nby(simp_all add: Terminal_def Linear_def Branch_def Abs_resumption_inverse resumption.intros Rep_resumption)\n\ntext {* Case operator *}\n\ndefinition case_resumption :: \"('a \\<Rightarrow> 'e) \\<Rightarrow> ('b \\<Rightarrow> ('a,'b,'c,'d) resumption \\<Rightarrow> 'e) \\<Rightarrow>\n                            ('c \\<Rightarrow> ('d \\<Rightarrow> ('a,'b,'c,'d) resumption) \\<Rightarrow> 'e) \\<Rightarrow> ('a,'b,'c,'d) resumption \\<Rightarrow> 'e\"\nwhere [code del]:\n  \"case_resumption t l br r =\n   case_RESUMPTION t (\\<lambda>b r. l b (Abs_resumption r)) (\\<lambda>c rs. br c (\\<lambda>d. Abs_resumption (rs d))) (Rep_resumption r)\"\n\nlemma case_resumption_simps [simp, code]:\n  shows case_resumption_Terminal: \"case_resumption t l br (Terminal a) = t a\"\n  and case_resumption_Linear: \"case_resumption t l br (Linear b r) = l b r\"\n  and case_resumption_Branch: \"case_resumption t l br (Branch c rs) = br c rs\"\nby(simp_all add: Terminal_def Linear_def Branch_def case_resumption_def Abs_resumption_inverse resumption.intros Rep_resumption Rep_resumption_inverse)\n\ndeclare [[case_translation case_resumption Terminal Linear Branch]]\n\nlemma case_resumption_cert:\n  assumes \"CASE \\<equiv> case_resumption t l br\"\n  shows \"(CASE (Terminal a) \\<equiv> t a) &&& (CASE (Linear b r) \\<equiv> l b r) &&& (CASE (Branch c rs) \\<equiv> br c rs)\"\nusing assms by simp_all\n\ncode_datatype Terminal Linear Branch\n\nsetup \\<open>Code.declare_case_global @{thm case_resumption_cert}\\<close>\n\nsetup {*\n  Nitpick.register_codatatype @{typ \"('a,'b,'c,'d) resumption\"} @{const_name case_resumption}\n                              (map dest_Const [@{term Terminal}, @{term Linear}, @{term Branch}])\n*}\n\nlemma resumption_exhaust [cases type: resumption]:\n  obtains (Terminal) a where \"x = Terminal a\"\n  | (Linear) b r where \"x = Linear b r\"\n  | (Branch) c rs where \"x = Branch c rs\"\nproof(cases x)\n  case (Abs_resumption y)\n  note [simp] = `x = Abs_resumption y`\n  from `y \\<in> resumption` show thesis\n  proof(cases rule: resumption.cases)\n    case resumption_TERMINAL thus ?thesis\n      by -(rule Terminal, simp add: Terminal_def)\n  next\n    case (resumption_LINEAR r b) \n    from `r \\<in> resumption` have \"Rep_resumption (Abs_resumption r) = r\"\n      by(simp add: Abs_resumption_inverse)\n    hence \"y = LINEAR b (Rep_resumption (Abs_resumption r))\"\n      using `y = LINEAR b r` by simp\n    thus ?thesis by -(rule Linear, simp add: Linear_def)\n  next\n    case (resumption_BRANCH rs c)\n    from `\\<And>d. rs d \\<in> resumption`\n    have eq: \"rs = (\\<lambda>d. Rep_resumption (Abs_resumption (rs d)))\"\n      by(subst Abs_resumption_inverse) blast+\n    show ?thesis using `y = BRANCH c rs` \n      by -(rule Branch, simp add: Branch_def, subst eq, simp)\n  qed\nqed\n\nlemma resumption_split:\n  \"P (case_resumption t l br r) \\<longleftrightarrow> \n  (\\<forall>a. r = Terminal a \\<longrightarrow> P (t a)) \\<and>\n  (\\<forall>b r'. r = Linear b r' \\<longrightarrow> P (l b r')) \\<and>\n  (\\<forall>c rs. r = Branch c rs \\<longrightarrow> P (br c rs))\"\nby(cases r) simp_all\n\nlemma resumption_split_asm:\n  \"P (case_resumption t l br r) \\<longleftrightarrow>\n  \\<not> ((\\<exists>a. r = Terminal a \\<and> \\<not> P (t a)) \\<or>\n     (\\<exists>b r'. r = Linear b r' \\<and> \\<not> P (l b r')) \\<or>\n     (\\<exists>c rs. r = Branch c rs \\<and> \\<not> P (br c rs)))\"\nby(cases r) simp_all\n\nlemmas resumption_splits = resumption_split resumption_split_asm\n\n\ntext {* corecursion operator *}\n\ndatatype (dead 'a, dead 'b, dead 'c, dead 'd, dead 'e) resumption_corec =\n    Terminal_corec 'a\n  | Linear_corec 'b 'e\n  | Branch_corec 'c \"'d \\<Rightarrow> 'e\"\n  | Resumption_corec \"('a, 'b, 'c, 'd) resumption\"\n\nprimrec RESUMPTION_corec_aux :: \"nat \\<Rightarrow> ('e \\<Rightarrow> ('a,'b,'c,'d,'e) resumption_corec) \\<Rightarrow> 'e \\<Rightarrow> ('c + 'b + 'a,'d) Old_Datatype.dtree\"\nwhere\n  \"RESUMPTION_corec_aux 0 f e = {}\"\n| \"RESUMPTION_corec_aux (Suc n) f e =\n  (case f e of Terminal_corec a \\<Rightarrow> TERMINAL a\n            | Linear_corec b e' \\<Rightarrow> LINEAR b (RESUMPTION_corec_aux n f e')\n            | Branch_corec c es \\<Rightarrow> BRANCH c (\\<lambda>d. RESUMPTION_corec_aux n f (es d))\n            | Resumption_corec r \\<Rightarrow> Rep_resumption r)\"\n\ndefinition RESUMPTION_corec :: \"('e \\<Rightarrow> ('a,'b,'c,'d,'e) resumption_corec) \\<Rightarrow> 'e \\<Rightarrow> ('c + 'b + 'a,'d) Old_Datatype.dtree\"\nwhere\n  \"RESUMPTION_corec f e = (\\<Union>n. RESUMPTION_corec_aux n f e)\"\n\nlemma RESUMPTION_corec [nitpick_simp]:\n  \"RESUMPTION_corec f e =\n  (case f e of Terminal_corec a \\<Rightarrow> TERMINAL a\n            | Linear_corec b e' \\<Rightarrow> LINEAR b (RESUMPTION_corec f e')\n            | Branch_corec c es \\<Rightarrow> BRANCH c (\\<lambda>d. RESUMPTION_corec f (es d))\n            | Resumption_corec r \\<Rightarrow> Rep_resumption r)\"\n  (is \"?lhs = ?rhs\")\nproof\n  show \"?lhs \\<subseteq> ?rhs\" unfolding RESUMPTION_corec_def\n  proof(rule UN_least)\n    fix n\n    show \"RESUMPTION_corec_aux n f e\n        \\<subseteq> (case f e of Terminal_corec a \\<Rightarrow> TERMINAL a\n           | Linear_corec b e' \\<Rightarrow> LINEAR b (\\<Union>n. RESUMPTION_corec_aux n f e')\n           | Branch_corec c es \\<Rightarrow> BRANCH c (\\<lambda>d. \\<Union>n. RESUMPTION_corec_aux n f (es d))\n           | Resumption_corec r \\<Rightarrow> Rep_resumption r)\"\n      apply(cases n, simp_all split: resumption_corec.split)\n      by(rule conjI strip LINEAR_mono[OF UN_upper] BRANCH_mono[OF UN_upper] UNIV_I)+\n  qed\nnext\n  show \"?rhs \\<subseteq> ?lhs\" unfolding RESUMPTION_corec_def\n    apply(simp split: resumption_corec.split add: LINEAR_UN BRANCH_UN)\n    by safe(rule_tac a=\"Suc n\" for n in UN_I, rule UNIV_I, simp)+\nqed\n\nlemma RESUMPTION_corec_type: \"RESUMPTION_corec f e \\<in> resumption\"\nproof -\n  have \"\\<exists>x. RESUMPTION_corec f e = RESUMPTION_corec f x\" by blast\n  thus ?thesis\n  proof coinduct\n    case (resumption x)\n    then obtain e where x: \"x = RESUMPTION_corec f e\" by blast\n    thus ?case \n    proof(cases \"f e\")\n      case (Resumption_corec r)\n      thus ?thesis using x\n        by(cases r)(simp_all add: RESUMPTION_corec Rep_resumption_constructors Rep_resumption)\n    qed(auto simp add: RESUMPTION_corec)\n  qed\nqed\n\ntext {* corecursion operator for the resumption type *}\n\ndefinition resumption_corec :: \"('e \\<Rightarrow> ('a,'b,'c,'d,'e) resumption_corec) \\<Rightarrow> 'e \\<Rightarrow> ('a,'b,'c,'d) resumption\"\nwhere\n  \"resumption_corec f e = Abs_resumption (RESUMPTION_corec f e)\"\n\nlemma resumption_corec:\n  \"resumption_corec f e =\n  (case f e of Terminal_corec a \\<Rightarrow> Terminal a\n            | Linear_corec b e' \\<Rightarrow> Linear b (resumption_corec f e')\n            | Branch_corec c es \\<Rightarrow> Branch c (\\<lambda>d. resumption_corec f (es d))\n            | Resumption_corec r \\<Rightarrow> r)\"\nunfolding resumption_corec_def\napply(subst RESUMPTION_corec)\napply(auto split: resumption_corec.splits simp add: Terminal_def Linear_def Branch_def RESUMPTION_corec_type Abs_resumption_inverse Rep_resumption_inverse)\ndone\n\ntext {* Equality as greatest fixpoint *}\n\ncoinductive Eq_RESUMPTION :: \"('c+'b+'a, 'd) Old_Datatype.dtree \\<Rightarrow> ('c+'b+'a, 'd) Old_Datatype.dtree \\<Rightarrow> bool\"\nwhere\n  EqTERMINAL: \"Eq_RESUMPTION (TERMINAL a) (TERMINAL a)\"\n| EqLINEAR: \"Eq_RESUMPTION r r' \\<Longrightarrow> Eq_RESUMPTION (LINEAR b r) (LINEAR b r')\"\n| EqBRANCH: \"(\\<And>d. Eq_RESUMPTION (rs d) (rs' d)) \\<Longrightarrow> Eq_RESUMPTION (BRANCH c rs) (BRANCH c rs')\"\n\n\n\nlemma Eq_RESUMPTION_refl:\n  assumes \"r \\<in> resumption\"\n  shows \"Eq_RESUMPTION r r\"\nproof -\n  def r' == r\n  with assms have \"r = r' \\<and> r \\<in> resumption\" by auto\n  thus \"Eq_RESUMPTION r r'\"\n  proof(coinduct)\n    case (Eq_RESUMPTION r r')\n    hence [simp]: \"r = r'\" and \"r \\<in> resumption\" by auto\n    from `r \\<in> resumption` show ?case\n      by(cases rule: resumption.cases) auto\n  qed\nqed\n\nlemma Eq_RESUMPTION_into_resumption:\n  assumes \"Eq_RESUMPTION r r\"\n  shows \"r \\<in> resumption\"\nusing assms\nproof(coinduct)\n  case resumption thus ?case by cases auto\nqed\n\nlemma Eq_RESUMPTION_eq:\n  \"Eq_RESUMPTION r r' \\<longleftrightarrow> r = r' \\<and> r \\<in> resumption\"\nproof(rule iffI)\n  assume \"Eq_RESUMPTION r r'\"\n  hence \"\\<And>k. ntrunc k r = ntrunc k r'\" by(rule Eq_RESUMPTION_implies_ntrunc_equality)\n  hence \"r = r'\" by(rule ntrunc_equality)\n  moreover with `Eq_RESUMPTION r r'` have \"r \\<in> resumption\"\n    by(auto intro: Eq_RESUMPTION_into_resumption)\n  ultimately show \"r = r' \\<and> r \\<in> resumption\" ..\nnext\n  assume \"r = r' \\<and> r \\<in> resumption\"\n  thus \"Eq_RESUMPTION r r'\" by(blast intro: Eq_RESUMPTION_refl)\nqed\n\nlemma Eq_RESUMPTION_I [consumes 1, case_names Eq_RESUMPTION, case_conclusion Eq_RESUMPTION EqTerminal EqLinear EqBranch]:\n  assumes \"X r r'\"\n  and step: \"\\<And>r r'. X r r' \\<Longrightarrow>\n             (\\<exists>a. r = TERMINAL a \\<and> r' = TERMINAL a) \\<or>\n             (\\<exists>R R' b. r = LINEAR b R \\<and> r' = LINEAR b R' \\<and> (X R R' \\<or> Eq_RESUMPTION R R')) \\<or>\n             (\\<exists>rs rs' c. r = BRANCH c rs \\<and> r' = BRANCH c rs' \\<and> (\\<forall>d. X (rs d) (rs' d) \\<or> Eq_RESUMPTION (rs d) (rs' d)))\"\n  shows \"r = r'\"\nproof -\n  from `X r r'` have \"Eq_RESUMPTION r r'\"\n    by(coinduct)(rule step)\n  thus ?thesis by(simp add: Eq_RESUMPTION_eq)\nqed\n\nlemma resumption_equalityI [consumes 1, case_names Eq_resumption, case_conclusion Eq_resumption EqTerminal EqLinear EqBranch]:\n  assumes \"X r r'\"\n  and step: \"\\<And>r r'. X r r' \\<Longrightarrow>\n             (\\<exists>a. r = Terminal a \\<and> r' = Terminal a) \\<or>\n             (\\<exists>R R' b. r = Linear b R \\<and> r' = Linear b R' \\<and> (X R R' \\<or> R = R')) \\<or>\n             (\\<exists>rs rs' c. r = Branch c rs \\<and> r' = Branch c rs' \\<and> (\\<forall>d. X (rs d) (rs' d) \\<or> rs d = rs' d))\"\n  shows \"r = r'\"\nproof -\n  def M == \"Rep_resumption r\" and N == \"Rep_resumption r'\"\n  with `X r r'` have \"\\<exists>r r'. M = Rep_resumption r \\<and> N = Rep_resumption r' \\<and> X r r'\" by blast\n  hence \"M = N\"\n  proof(coinduct rule: Eq_RESUMPTION_I)\n    case (Eq_RESUMPTION M N)\n    then obtain r r' where [simp]: \"M = Rep_resumption r\" \"N = Rep_resumption r'\"\n      and \"X r r'\" by blast\n    { assume \"\\<exists>a. r = Terminal a \\<and> r' = Terminal a\"\n      hence ?EqTerminal by(auto simp add: Rep_resumption_constructors)\n      hence ?case .. }\n    moreover\n    { assume \"\\<exists>R R' b. r = Linear b R \\<and> r' = Linear b R' \\<and> (X R R' \\<or> R = R')\"\n      hence ?EqLinear\n        by(clarsimp simp add: Rep_resumption_constructors Eq_RESUMPTION_eq Rep_resumption_inject Rep_resumption)\n      hence ?case by blast }\n    moreover\n    { assume \"\\<exists>rs rs' c. r = Branch c rs \\<and> r' = Branch c rs' \\<and> (\\<forall>d. X (rs d) (rs' d) \\<or> rs d = rs' d)\"\n      hence ?EqBranch\n        by(clarsimp simp add: Rep_resumption_constructors Eq_RESUMPTION_eq Rep_resumption_inject Rep_resumption)\n      hence ?case by blast }\n    ultimately show ?case using step[OF `X r r'`] by blast\n  qed\n  thus ?thesis unfolding M_def N_def by(simp add: Rep_resumption_inject)\nqed\n\ntext {*\n  Finality of @{text \"resumption\"}: Uniqueness of functions defined by corecursion.\n*}\n\nlemma equals_RESUMPTION_corec:\n  assumes h: \"\\<And>x. h x = (case f x of Terminal_corec a \\<Rightarrow> TERMINAL a\n                                   | Linear_corec b x' \\<Rightarrow> LINEAR b (h x')\n                                   | Branch_corec c xs \\<Rightarrow> BRANCH c (\\<lambda>d. h (xs d))\n                                   | Resumption_corec r \\<Rightarrow> Rep_resumption r)\"\n  shows \"h = RESUMPTION_corec f\"\nproof\n  fix x\n  def h' == \"RESUMPTION_corec f\"\n  have h': \"\\<And>x. h' x = (case f x of Terminal_corec a \\<Rightarrow> TERMINAL a\n                                   | Linear_corec b x' \\<Rightarrow> LINEAR b (h' x')\n                                   | Branch_corec c xs \\<Rightarrow> BRANCH c (\\<lambda>d. h' (xs d))\n                                   | Resumption_corec r \\<Rightarrow> Rep_resumption r)\"\n    unfolding h'_def by(simp add: RESUMPTION_corec)\n  def M == \"h x\" and N == \"h' x\"\n  hence \"\\<exists>x. M = h x \\<and> N = h' x\" by blast\n  thus \"M = N\"\n  proof(coinduct rule: Eq_RESUMPTION_I)\n    case (Eq_RESUMPTION M N)\n    then obtain x where [simp]: \"M = h x\" \"N = h' x\" by blast\n    show ?case\n    proof(cases \"f x\")\n      case (Terminal_corec a)\n      with h h' have ?EqTerminal by simp\n      thus ?thesis ..\n    next\n      case (Linear_corec b x')\n      with h h' have ?EqLinear by auto\n      thus ?thesis by blast\n    next\n      case (Branch_corec c xs)\n      with h h' have ?EqBranch by auto\n      thus ?thesis by blast\n    next\n      case (Resumption_corec r)\n      thus ?thesis\n        by(cases r)(simp_all add: h h' Rep_resumption_constructors Eq_RESUMPTION_refl Rep_resumption)\n    qed\n  qed\nqed\n\nlemma equals_resumption_corec:\n  assumes h: \"\\<And>x. h x = (case f x of Terminal_corec a \\<Rightarrow> Terminal a\n                                   | Linear_corec b x' \\<Rightarrow> Linear b (h x')\n                                   | Branch_corec c xs \\<Rightarrow> Branch c (\\<lambda>d. h (xs d))\n                                   | Resumption_corec r \\<Rightarrow> r)\"\n  shows \"h = resumption_corec f\"\nproof(rule ext)\n  fix x\n  { fix x\n    from h[of x]\n    have \"Rep_resumption (h x) =\n      (case f x of Terminal_corec a \\<Rightarrow> TERMINAL a\n                | Linear_corec b x' \\<Rightarrow> LINEAR b (Rep_resumption (h x'))\n                | Branch_corec c xs \\<Rightarrow> BRANCH c (\\<lambda>d. Rep_resumption (h (xs d)))\n                | Resumption_corec r \\<Rightarrow> Rep_resumption r)\"\n      by(auto split: resumption_corec.split simp add: Rep_resumption_constructors) }\n  hence eq: \"(\\<lambda>x. Rep_resumption (h x)) = RESUMPTION_corec f\" by(rule equals_RESUMPTION_corec)\n  hence \"Abs_resumption (Rep_resumption (h x)) = Abs_resumption (RESUMPTION_corec f x)\"\n    by(subst (asm) fun_eq_iff)(auto)\n  from this[symmetric] show \"h x = resumption_corec f x\"\n    unfolding resumption_corec_def by(simp add: Rep_resumption_inverse)\nqed\n\nend\n", "meta": {"author": "PLSysSec", "repo": "ct-wasm-proofs", "sha": "3fa5c38ecda3d05c351096ba5e6d7ba1df793c21", "save_path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs", "path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs/ct-wasm-proofs-3fa5c38ecda3d05c351096ba5e6d7ba1df793c21/CT-WASM_model/AFP/Coinductive/Examples/Resumption.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3117102658359745}}
{"text": "(*\n * @TAG(OTHER_LGPL)\n *)\n\n(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoarePartialProps.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Properties of Partial Correctness Hoare Logic *}\n\ntheory HoarePartialProps imports HoarePartialDef begin\n\nsubsection {* Soundness *}\n\nlemma hoare_cnvalid: \n assumes hoare: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n shows \"\\<And>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nusing hoare\nproof (induct)\n  case (Skip \\<Theta> F P A)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Skip P,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> P\"\n    thus \"t \\<in> Normal ` P \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext\n  case (Basic \\<Theta> F f P A)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> {s. f s \\<in> P} (Basic f) P,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> {s. f s \\<in> P}\"\n    thus \"t \\<in> Normal ` P \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext \n  case (Spec \\<Theta> F r Q A)\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {s. (\\<forall>t. (s, t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s, t) \\<in> r)} Spec r Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> {s. (\\<forall>t. (s, t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s, t) \\<in> r)}\"\n    from exec P\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by cases auto\n  qed\nnext\n  case (Seq \\<Theta> F P c1 R A c2 Q)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c1 R,A\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> R c2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Seq c1 c2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    assume P: \"s \\<in> P\"\n    from exec P obtain r where\n      exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> r\" and exec_c2:  \"\\<Gamma>\\<turnstile>\\<langle>c2,r\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    with t_notin_F have \"r \\<notin> Fault ` F\"\n      by (auto dest: execn_Fault_end)\n    with valid_c1 ctxt exec_c1 P\n    have r: \"r\\<in>Normal ` R \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n    show \"t\\<in>Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases r)\n      case (Normal r')\n      with exec_c2 r\n      show \"t\\<in>Normal ` Q \\<union> Abrupt ` A\"\n        apply -\n        apply (rule cnvalidD [OF valid_c2 ctxt _ _ t_notin_F])\n        apply auto\n        done\n    next\n      case (Abrupt r')\n      with exec_c2 have \"t=Abrupt r'\"\n        by (auto elim: execn_elim_cases)\n      with Abrupt r show ?thesis\n        by auto\n    next\n      case Fault with r show ?thesis by blast\n    next\n      case Stuck with r show ?thesis by blast\n    qed\n  qed\nnext\n  case (Cond \\<Theta> F P b c1 Q A c2)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> b) c1 Q,A\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> - b) c2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Cond b c1 c2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases \"s\\<in>b\")\n      case True\n      with exec have \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by cases auto\n      with P True \n      show ?thesis\n        by - (rule cnvalidD [OF valid_c1 ctxt _ _ t_notin_F],auto)\n    next\n      case False\n      with exec P have \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> =n\\<Rightarrow> t\"\n        by cases auto\n      with P False \n      show ?thesis\n        by - (rule cnvalidD [OF valid_c2 ctxt _ _ t_notin_F],auto)\n    qed\n  qed\nnext\n  case (While \\<Theta> F P b c A n)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P While b c (P \\<inter> - b),A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\" \n    show \"t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt ` A\"\n    proof (cases \"s \\<in> b\")\n      case True\n      {\n        fix d::\"('b,'a,'c) com\" fix s t \n        assume exec: \"\\<Gamma>\\<turnstile>\\<langle>d,s\\<rangle> =n\\<Rightarrow> t\"\n        assume d: \"d=While b c\"\n        assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n        from exec d ctxt\n        have \"\\<lbrakk>s \\<in> Normal ` P; t \\<notin> Fault ` F\\<rbrakk>\n               \\<Longrightarrow> t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt`A\"\n        proof (induct)\n          case (WhileTrue s b' c' n r t)\n          have t_notin_F: \"t \\<notin> Fault ` F\" by fact\n          have eqs: \"While b' c' = While b c\" by fact\n          note valid_c\n          moreover have ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n          moreover from WhileTrue\n          obtain \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> r\" and\n            \"\\<Gamma>\\<turnstile>\\<langle>While b c,r\\<rangle> =n\\<Rightarrow> t\" and\n            \"Normal s \\<in> Normal `(P \\<inter> b)\" by auto\n          moreover with t_notin_F have \"r \\<notin> Fault ` F\"\n            by (auto dest: execn_Fault_end)\n          ultimately\n          have r: \"r \\<in> Normal ` P \\<union> Abrupt ` A\"\n            by - (rule cnvalidD,auto)\n          from this _ ctxt\n          show \"t \\<in> Normal ` (P \\<inter> - b) \\<union> Abrupt ` A \"\n          proof (cases r)\n            case (Normal r')\n            with r ctxt eqs t_notin_F\n            show ?thesis\n              by - (rule WhileTrue.hyps,auto)\n          next\n            case (Abrupt r')\n            have \"\\<Gamma>\\<turnstile>\\<langle>While b' c',r\\<rangle> =n\\<Rightarrow> t\" by fact\n            with Abrupt have \"t=r\"\n              by (auto dest: execn_Abrupt_end) \n            with r Abrupt show ?thesis\n              by blast\n          next\n            case Fault with r show ?thesis by blast\n          next\n            case Stuck with r show ?thesis by blast\n          qed   \n        qed auto\n      }\n      with exec ctxt P t_notin_F\n      show ?thesis\n        by auto\n    next\n      case False\n      with exec P have \"t=Normal s\"\n        by cases auto\n      with P False\n      show ?thesis\n        by auto\n    qed\n  qed\nnext\n  case (Guard \\<Theta> F g P c Q A f)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) Guard f g c  Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    assume P:\"s \\<in> (g \\<inter> P)\"\n    from exec P have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    from valid_c ctxt this P t_notin_F\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n  qed\nnext\n  case (Guarantee f F \\<Theta> g P c Q A)\n  have valid_c: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\" by fact\n  have f_F: \"f \\<in> F\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Guard f g c  Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    assume P:\"s \\<in> P\"\n    from exec f_F t_notin_F have g: \"s \\<in> g\"\n      by cases auto\n    with P have P': \"s \\<in> g \\<inter> P\"\n      by blast\n    from exec P g have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by cases auto\n    from valid_c ctxt this P' t_notin_F\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (rule cnvalidD)\n  qed\nnext\n  case (CallRec P p Q A Specs \\<Theta> F)\n  have p: \"(P,p,Q,A) \\<in> Specs\" by fact\n  have valid_body:\n    \"\\<forall>(P,p,Q,A) \\<in> Specs. p \\<in> dom \\<Gamma> \\<and> (\\<forall>n. \\<Gamma>,\\<Theta> \\<union> Specs \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A)\"\n    using CallRec.hyps by blast\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P Call p Q,A\"\n  proof -\n    {\n      fix n\n      have \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\n        \\<Longrightarrow> \\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n      proof (induct n)\n        case 0\n        show \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>0:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (fastforce elim!: execn_elim_cases simp add: nvalid_def)\n      next\n        case (Suc m)\n        have hyp: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\n              \\<Longrightarrow> \\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n        have \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" by fact\n        hence ctxt_m: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (fastforce simp add: nvalid_def intro: execn_Suc)\n        hence valid_Proc:\n          \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma>\\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by (rule hyp)\n        let ?\\<Theta>'= \"\\<Theta> \\<union> Specs\"\n        from valid_Proc ctxt_m\n        have \"\\<forall>(P, p, Q, A)\\<in>?\\<Theta>'. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          by fastforce\n        with valid_body\n        have valid_body_m: \n          \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<forall>n. \\<Gamma> \\<Turnstile>m:\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A\"\n          by (fastforce simp add: cnvalid_def)\n        show \"\\<forall>(P,p,Q,A) \\<in>Specs. \\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n        proof (clarify)\n          fix P p Q A assume p: \"(P,p,Q,A) \\<in> Specs\"\n          show \"\\<Gamma> \\<Turnstile>Suc m:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n          proof (rule nvalidI)\n            fix s t\n            assume exec_call: \n              \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> =Suc m\\<Rightarrow> t\"\n            assume Pre: \"s \\<in> P\"\n            assume t_notin_F: \"t \\<notin> Fault ` F\"\n            from exec_call\n            show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n            proof (cases)\n              fix bdy m' \n              assume m: \"Suc m = Suc m'\"\n              assume bdy: \"\\<Gamma> p = Some bdy\"\n              assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal s\\<rangle> =m'\\<Rightarrow> t\"\n              from Pre valid_body_m exec_body bdy m p t_notin_F\n              show ?thesis\n                by (fastforce simp add: nvalid_def)\n            next\n              assume \"\\<Gamma> p = None\"\n              with valid_body p have False by auto\n              thus ?thesis ..\n            qed\n          qed\n        qed\n      qed\n    }\n    with p show ?thesis\n      by (fastforce simp add: cnvalid_def)\n  qed\nnext\n  case (DynCom P \\<Theta> F c Q A)\n  hence valid_c: \"\\<forall>s\\<in>P. (\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (c s) Q,A)\" by auto\n  show \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P DynCom c Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    assume P: \"s \\<in> P\"\n    assume t_notin_Fault: \"t \\<notin> Fault ` F\"\n    from exec show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases)\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c s,Normal s\\<rangle> =n\\<Rightarrow> t\"      \n      from cnvalidD [OF valid_c [rule_format, OF P] ctxt this P t_notin_Fault]\n      show ?thesis .\n    qed\n  qed\nnext\n  case (Throw \\<Theta> F A Q)\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> A Throw Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume \"\\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> =n\\<Rightarrow> t\" \"s \\<in> A\"\n    then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by cases simp\n  qed\nnext\n  case (Catch \\<Theta> F P c\\<^sub>1 Q R c\\<^sub>2 A)\n  have valid_c1: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\" by fact\n  have valid_c2: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    assume P: \"s \\<in> P\"\n    assume t_notin_Fault: \"t \\<notin> Fault ` F\"\n    from exec show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof (cases)\n      fix s'\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Abrupt s'\" \n      assume exec_c2: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s'\\<rangle> =n\\<Rightarrow> t\"\n      from cnvalidD [OF valid_c1 ctxt exec_c1 P ] \n      have \"Abrupt s' \\<in> Abrupt ` R\"\n        by auto\n      with cnvalidD [OF valid_c2 ctxt _ _ t_notin_Fault] exec_c2\n      show ?thesis\n        by fastforce\n    next\n      assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      assume notAbr: \"\\<not> isAbr t\"\n      from cnvalidD [OF valid_c1 ctxt exec_c1 P t_notin_Fault] \n      have \"t \\<in> Normal ` Q \\<union> Abrupt ` R\" .\n      with notAbr\n      show ?thesis\n        by auto\n    qed\n  qed\nnext\n  case (Conseq P \\<Theta> F c Q A)\n  hence adapt: \"\\<forall>s \\<in> P. (\\<exists>P' Q' A'. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'  \\<and>\n                          s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A)\"\n    by blast\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    assume P: \"s \\<in> P\"\n    assume t_notin_F: \"t \\<notin> Fault ` F\"\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    proof -\n      from P adapt obtain P' Q' A' Z  where\n        spec: \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'\" and\n        P': \"s \\<in> P'\"  and  strengthen: \"Q' \\<subseteq> Q \\<and> A' \\<subseteq> A\"\n        by auto\n      from spec [rule_format] ctxt exec P' t_notin_F  \n      have \"t \\<in> Normal ` Q' \\<union> Abrupt ` A'\"\n        by (rule cnvalidD)\n      with strengthen show ?thesis\n        by blast\n    qed\n  qed\nnext\n  case (Asm P p Q A \\<Theta> F)\n  have asm: \"(P, p, Q, A) \\<in> \\<Theta>\" by fact\n  show \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  proof (rule cnvalidI)\n    fix s t\n    assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    assume exec: \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    from asm ctxt have \"\\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P Call p Q,A\" by auto\n    moreover\n    assume \"s \\<in> P\" \"t \\<notin> Fault ` F\"\n    ultimately\n    show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      using exec\n      by (auto simp add: nvalid_def)\n  qed\nnext\n  case ExFalso thus ?case by iprover\nqed\n\n\n\nsubsection {* Completeness *}\n\nlemma MGT_valid:\n\"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n   {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t}, {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof (rule validI) \n  fix s t\n  assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t\" \n         \"s \\<in> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))}\"\n         \"t \\<notin> Fault ` F\"\n  thus \"t \\<in> Normal ` {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t} \\<union> \n            Abrupt ` {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (cases t) (auto simp add: final_notin_def)\nqed\n\ntext {* The consequence rule where the existential @{term Z} is instantiated\nto @{term s}. Usefull in proof of @{text \"MGT_lemma\"}.*}\nlemma ConseqMGT: \n  assumes modif: \"\\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\n  assumes impl: \"\\<And>s. s \\<in> P \\<Longrightarrow> s \\<in> P' s \\<and> (\\<forall>t. t \\<in> Q' s \\<longrightarrow> t \\<in> Q) \\<and> \n                                            (\\<forall>t. t \\<in> A' s \\<longrightarrow> t \\<in> A)\"\n  shows \"\\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nusing impl \nby -  (rule conseq [OF modif],blast)\n\n\nlemma Seq_NoFaultStuckD1: \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nproof (rule final_notinI)\n  fix t\n  assume exec_c1: \"\\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t\"\n  show \"t \\<notin> {Stuck} \\<union> Fault `  F\"\n  proof \n    assume \"t \\<in> {Stuck} \\<union> Fault `  F\"\n    moreover\n    {\n      assume \"t = Stuck\"\n      with exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Stuck\"\n        by (auto intro: exec_Seq')\n      with noabort have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    moreover \n    {\n      assume \"t \\<in> Fault ` F\"\n      then obtain f where \n      t: \"t=Fault f\" and f: \"f \\<in> F\"\n        by auto\n      from t exec_c1\n      have \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow> Fault f\"\n        by (auto intro: exec_Seq')\n      with noabort f have False\n        by (auto simp add: final_notin_def)\n      hence False ..\n    }\n    ultimately show False by auto\n  qed\nqed\n\nlemma Seq_NoFaultStuckD2: \n  assumes noabort: \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\n  shows \"\\<forall>t. \\<Gamma>\\<turnstile>\\<langle>c1,s\\<rangle> \\<Rightarrow> t \\<longrightarrow> t\\<notin> ({Stuck} \\<union> Fault `  F) \\<longrightarrow> \n             \\<Gamma>\\<turnstile>\\<langle>c2,t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault `  F)\"\nusing noabort\nby (auto simp add: final_notin_def intro: exec_Seq')\n\n\nlemma MGT_implies_complete:\n  assumes MGT: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  assumes valid: \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  using MGT\n  apply (rule ConseqMGT) \n  apply (insert valid)\n  apply (auto simp add: valid_def intro!: final_notinI)\n  done\n\ntext {* Equipped only with the classic consequence rule @{thm \"conseqPrePost\"}\n        we can only derive this syntactically more involved version\n        of completeness. But semantically it is equivalent to the \"real\" one\n        (see below) *}\nlemma MGT_implies_complete':\n  assumes MGT: \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> \n                       {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union>  Fault ` (-F))} c \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  assumes valid: \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  using MGT [rule_format, of Z]\n  apply (rule conseqPrePost)\n  apply (insert valid)\n  apply   (fastforce simp add: valid_def final_notin_def)\n  apply  (fastforce simp add: valid_def)\n  apply (fastforce simp add: valid_def)\n  done\n\ntext {* Semantic equivalence of both kind of formulations *}\nlemma valid_involved_to_valid:\n  assumes valid: \n    \"\\<forall>Z. \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  shows \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  using valid\n  apply (simp add: valid_def)\n  apply clarsimp\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"Normal x\" in allE)\n  apply (erule_tac x=t in allE)\n  apply fastforce\n  done\n\ntext {* The sophisticated consequence rule allow us to do this \n        semantical transformation on the hoare-level, too. \n        The magic is, that it allow us to\n        choose the instance of @{term Z} under the assumption of an state @{term \"s \\<in> P\"} *}\nlemma\n  assumes deriv: \n    \"\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  shows \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule ConseqMGT [OF deriv])\n  apply auto\n  done\n\nlemma valid_to_valid_involved:\n  \"\\<Gamma> \\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow>\n   \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\nby (simp add: valid_def Collect_conv_if)\n\nlemma\n  assumes deriv: \"\\<Gamma>,{} \\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> s \\<in> P} c {t. Z \\<in> P \\<longrightarrow> t \\<in> Q},{t. Z \\<in> P \\<longrightarrow> t \\<in> A}\"\n  apply (rule conseqPrePost [OF deriv])\n  apply auto\n  done\n\nlemma conseq_extract_state_indep_prop: \n  assumes state_indep_prop:\"\\<forall>s \\<in> P. R\" \n  assumes to_show: \"R \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule Conseq)\n  apply (clarify)\n  apply (rule_tac x=\"P\" in exI)\n  apply (rule_tac x=\"Q\" in exI)\n  apply (rule_tac x=\"A\" in exI)\n  using state_indep_prop to_show\n  by blast\n\n\nlemma MGT_lemma:\n  assumes MGT_Calls: \n    \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> \n       {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n        (Call p)\n       {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n       {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  shows \"\\<And>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c \n             {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof (induct c)\n  case Skip\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Skip,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Skip\n           {t. \\<Gamma>\\<turnstile>\\<langle>Skip,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>Skip,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Skip [THEN conseqPre])\n       (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\nnext\n  case (Basic f)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Basic f\n           {t. \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal Z\\<rangle> \\<Rightarrow> Normal t}, \n           {t. \\<Gamma>\\<turnstile>\\<langle>Basic f,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Basic [THEN conseqPre])\n       (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\nnext\n  case (Spec r)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Spec r\n           {t. \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal Z\\<rangle> \\<Rightarrow> Normal t}, \n           {t. \\<Gamma>\\<turnstile>\\<langle>Spec r,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    apply (rule hoarep.Spec [THEN conseqPre])\n    apply (clarsimp simp add: final_notin_def)\n    apply (case_tac \"\\<exists>t. (Z,t) \\<in> r\")\n    apply (auto elim: exec_elim_cases simp add: final_notin_def intro: exec.intros)\n    done\nnext\n  case (Seq c1 c2) \n  have hyp_c1: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n                           {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                           {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Seq.hyps by iprover\n  have hyp_c2: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c2 \n                          {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                          {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Seq.hyps by iprover\n  from hyp_c1 \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n              {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t \\<and> \n                  \\<Gamma>\\<turnstile>\\<langle>c2,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT)\n       (auto dest: Seq_NoFaultStuckD1 [simplified] Seq_NoFaultStuckD2 [simplified]\n             intro: exec.Seq)\n  thus \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   Seq c1 c2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule hoarep.Seq )\n    show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t \\<and> \n                      \\<Gamma>\\<turnstile>\\<langle>c2,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   c2\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    proof (rule ConseqMGT [OF hyp_c2],safe)\n      fix r t\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal r\" \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal r\\<rangle> \\<Rightarrow> Normal t\"\n      then show \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        by (iprover intro: exec.intros)\n    next\n      fix r t\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal r\" \"\\<Gamma>\\<turnstile>\\<langle>c2,Normal r\\<rangle> \\<Rightarrow> Abrupt t\"\n      then show \"\\<Gamma>\\<turnstile>\\<langle>Seq c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n        by (iprover intro: exec.intros)\n    qed\n  qed\nnext\n  case (Cond b c1 c2) \n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c1 \n                 {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>c1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Cond.hyps by iprover  \n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\\<inter>b)\n                   c1 \n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    by (rule ConseqMGT)\n       (fastforce intro: exec.CondTrue simp add: final_notin_def)\n  moreover\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c2 \n                    {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    using Cond.hyps by iprover  \n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>({s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\\<inter>-b)\n                  c2 \n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" \n    by (rule ConseqMGT)\n       (fastforce intro: exec.CondFalse simp add: final_notin_def)\n  ultimately\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                 Cond b c1 c2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Cond b c1 c2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Cond)       \nnext\n  case (While b c)\n  let ?unroll = \"({(s,t). s\\<in>b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t})\\<^sup>*\"\n  let ?P' = \"\\<lambda>Z. {t. (Z,t)\\<in>?unroll \\<and> \n                    (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                         \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                             (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}\"\n  let ?A' = \"\\<lambda>Z. {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                While b c\n              {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule ConseqMGT [where ?P'=\"?P'\" \n                         and ?Q'=\"\\<lambda>Z. ?P' Z \\<inter> - b\" and ?A'=\"?A'\"])\n    show \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?P' Z) (While b c) (?P' Z \\<inter> - b),(?A' Z)\"\n    proof (rule allI, rule hoarep.While)\n      fix Z\n      from While \n      have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\n                        {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                        {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\" by iprover\n      then show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?P' Z  \\<inter> b) c (?P' Z),(?A' Z)\"\n      proof (rule ConseqMGT)\n        fix s\n        assume  \"s\\<in> {t. (Z, t) \\<in> ?unroll \\<and> \n                      (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                           \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                               (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                    \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}\n                   \\<inter> b\"\n        then obtain \n          Z_s_unroll: \"(Z,s) \\<in> ?unroll\" and\n          noabort:\"\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                        \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                            (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u)\" and\n          s_in_b: \"s\\<in>b\" \n          by blast\n        show \"s \\<in> {t. t = s \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal t\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \\<and>\n        (\\<forall>t. t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t} \\<longrightarrow>\n             t \\<in> {t. (Z, t) \\<in> ?unroll \\<and> \n                  (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow>  e\\<in>b \n                       \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                           (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))}) \\<and> \n         (\\<forall>t. t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Abrupt t} \\<longrightarrow>\n             t \\<in> {t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t})\"\n          (is \"?C1 \\<and> ?C2 \\<and> ?C3\")\n        proof (intro conjI)\n          from Z_s_unroll noabort s_in_b show ?C1 by blast\n        next\n          {\n            fix t \n            assume s_t: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t\"\n            moreover\n            from Z_s_unroll s_t s_in_b \n            have \"(Z, t) \\<in> ?unroll\"\n              by (blast intro: rtrancl_into_rtrancl)\n            moreover note noabort\n            ultimately \n            have \"(Z, t) \\<in> ?unroll \\<and> \n                  (\\<forall>e. (Z,e)\\<in>?unroll \\<longrightarrow> e\\<in>b\n                        \\<longrightarrow> \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n                            (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                                  \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u))\"\n              by iprover\n          }\n          then show ?C2 by blast\n        next\n          {\n            fix t\n            assume s_t:  \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Abrupt t\" \n            from Z_s_unroll noabort s_t s_in_b \n            have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n              by blast\n          } thus ?C3 by simp\n        qed\n      qed\n    qed\n  next\n    fix s\n    assume P: \"s \\<in> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>While b c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n    hence WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n      by auto\n    show \"s \\<in> ?P' s \\<and> \n    (\\<forall>t. t\\<in>(?P' s \\<inter> - b)\\<longrightarrow>\n         t\\<in>{t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t})\\<and>\n    (\\<forall>t. t\\<in>?A' s \\<longrightarrow> t\\<in>?A' Z)\"\n    proof (intro conjI)\n      {\n        fix e\n        assume \"(Z,e) \\<in> ?unroll\" \"e \\<in> b\"\n        from this WhileNoFault\n        have \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F)) \\<and> \n               (\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>Abrupt u \\<longrightarrow> \n                    \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u)\" (is \"?Prop Z e\")\n        proof (induct rule: converse_rtrancl_induct [consumes 1])\n          assume e_in_b: \"e \\<in> b\"\n          assume WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n          with e_in_b WhileNoFault\n          have cNoFault: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n            by (auto simp add: final_notin_def intro: exec.intros)\n          moreover\n          {\n            fix u assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n            with e_in_b have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n              by (blast intro: exec.intros)\n          }\n          ultimately\n          show \"?Prop e e\"\n            by iprover\n        next\n          fix Z r\n          assume e_in_b: \"e\\<in>b\" \n          assume WhileNoFault: \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n          assume hyp: \"\\<lbrakk>e\\<in>b;\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\\<rbrakk>\n                       \\<Longrightarrow> ?Prop r e\"\n          assume Z_r:\n            \"(Z, r) \\<in> {(Z, r). Z \\<in> b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r}\"\n          with WhileNoFault\n          have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n            by (auto simp add: final_notin_def intro: exec.intros)\n          from hyp [OF e_in_b this] obtain\n            cNoFault: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\" and\n            Abrupt_r: \"\\<forall>u. \\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u \\<longrightarrow> \n                            \\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Abrupt u\"\n            by simp\n          \n           {\n            fix u assume \"\\<Gamma>\\<turnstile>\\<langle>c,Normal e\\<rangle> \\<Rightarrow> Abrupt u\"\n            with Abrupt_r have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Abrupt u\" by simp\n            moreover from  Z_r obtain\n              \"Z \\<in> b\"  \"\\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r\"\n              by simp\n            ultimately have \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Abrupt u\"\n              by (blast intro: exec.intros)\n          }\n          with cNoFault show \"?Prop Z e\"\n            by iprover\n        qed\n      }\n      with P show \"s \\<in> ?P' s\"\n        by blast\n    next\n      {\n        fix t\n        assume \"termination\": \"t \\<notin> b\"\n        assume \"(Z, t) \\<in> ?unroll\"\n        hence \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        proof (induct rule: converse_rtrancl_induct [consumes 1])\n          from \"termination\" \n          show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal t\\<rangle> \\<Rightarrow> Normal t\"\n            by (blast intro: exec.WhileFalse)\n        next\n          fix Z r\n          assume first_body: \n                 \"(Z, r) \\<in> {(s, t). s \\<in> b \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> Normal t}\"\n          assume \"(r, t) \\<in> ?unroll\"\n          assume rest_loop: \"\\<Gamma>\\<turnstile>\\<langle>While b c, Normal r\\<rangle> \\<Rightarrow> Normal t\"\n          show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n          proof -\n            from first_body obtain\n              \"Z \\<in> b\" \"\\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal r\"\n              by fast\n            moreover\n            from rest_loop have\n              \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal r\\<rangle> \\<Rightarrow> Normal t\"\n              by fast\n            ultimately show \"\\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n              by (rule exec.WhileTrue)\n          qed\n        qed\n      }\n      with P\n      show \"(\\<forall>t. t\\<in>(?P' s \\<inter> - b)\n            \\<longrightarrow>t\\<in>{t. \\<Gamma>\\<turnstile>\\<langle>While b c,Normal Z\\<rangle> \\<Rightarrow> Normal t})\"\n        by blast\n    next\n      from P show \"\\<forall>t. t\\<in>?A' s \\<longrightarrow> t\\<in>?A' Z\" by simp\n    qed\n  qed\nnext\n  case (Call p)\n  let ?P = \"{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n  from noStuck_Call have \"\\<forall>s \\<in> ?P. p \\<in> dom \\<Gamma>\"\n    by (fastforce simp add: final_notin_def )\n  then show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ?P (Call p)\n               {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n  proof (rule conseq_extract_state_indep_prop)\n    assume p_definied: \"p \\<in> dom \\<Gamma>\"\n    with MGT_Calls show\n      \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \n                 \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n                  (Call p)\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                 {t. \\<Gamma>\\<turnstile>\\<langle>Call  p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      by (auto)\n  qed\nnext\n  case (DynCom c)\n  have hyp: \n    \"\\<And>s'. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c s',Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c s'\n      {t. \\<Gamma>\\<turnstile>\\<langle>c s',Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>c s',Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using DynCom by simp\n  have hyp':\n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c Z\n        {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Normal t},{t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT [OF hyp])\n       (fastforce simp add: final_notin_def intro: exec.intros)\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n               DynCom c\n             {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n             {t. \\<Gamma>\\<turnstile>\\<langle>DynCom c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    apply (rule hoarep.DynCom)\n    apply (clarsimp)\n    apply (rule hyp' [simplified])\n    done\nnext  \n  case (Guard f g c)\n  have hyp_c: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                    {t. \\<Gamma>\\<turnstile>\\<langle>c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Guard by iprover\n  show ?case\n  proof (cases \"f \\<in> F\")\n    case True \n    from hyp_c\n    have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>(g \\<inter> {s. s = Z \\<and> \n                    \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (- F))}) \n             c\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      apply (rule ConseqMGT)\n      apply (insert True)\n      apply (auto simp add: final_notin_def intro: exec.intros)\n      done\n    from True this\n    show ?thesis      \n      by (rule conseqPre [OF Guarantee]) auto\n  next\n    case False\n    from hyp_c\n    have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> \n           (g \\<inter> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}) \n           c\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n           {t. \\<Gamma>\\<turnstile>\\<langle>Guard f g c,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      apply (rule ConseqMGT)\n      apply clarify\n      apply (frule Guard_noFaultStuckD [OF _ False])\n      apply (auto simp add: final_notin_def intro: exec.intros)\n      done\n    then show ?thesis\n      apply (rule conseqPre [OF hoarep.Guard])\n      apply clarify\n      apply (frule Guard_noFaultStuckD [OF _ False])\n      apply auto\n      done\n  qed\nnext\n  case Throw\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Throw,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} Throw\n              {t. \\<Gamma>\\<turnstile>\\<langle>Throw,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Throw,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule conseqPre [OF hoarep.Throw]) (blast intro: exec.intros)\nnext\n  case (Catch c\\<^sub>1 c\\<^sub>2)\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>1\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Catch.hyps by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>1\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow> Abrupt t \\<and> \n                   \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"\n    by (rule ConseqMGT)\n       (fastforce intro: exec.intros simp add: final_notin_def)\n  moreover\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} c\\<^sub>2\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                  {t. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    using Catch.hyps by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal Z\\<rangle> \\<Rightarrow>Abrupt s \\<and> \n                   \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n               c\\<^sub>2\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n               {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule ConseqMGT)\n       (fastforce intro: exec.intros  simp add: final_notin_def)\n  ultimately\n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n                   Catch c\\<^sub>1 c\\<^sub>2\n              {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n              {t. \\<Gamma>\\<turnstile>\\<langle>Catch c\\<^sub>1 c\\<^sub>2,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n    by (rule hoarep.Catch)\nqed\n\nlemma MGT_Calls: \n \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \n     \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n            (Call p)\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\nproof - \n  {\n    fix p Z \n    assume defined: \"p \\<in> dom \\<Gamma>\"\n    have \n      \"\\<Gamma>,(\\<Union>p\\<in>dom \\<Gamma>. \\<Union>Z. \n          {({s. s=Z \\<and> \n             \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))},\n             p,\n             {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n             {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t})})\n       \\<turnstile>\\<^bsub>/F\\<^esub>{s. s = Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))} \n          (the (\\<Gamma> p))\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n          {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n      (is \"\\<Gamma>,?\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> (?Pre p Z) (the (\\<Gamma> p)) (?Post p Z),(?Abr p Z)\")\n    proof -\n      have MGT_Calls:\n       \"\\<forall>p\\<in>dom \\<Gamma>. \\<forall>Z. \\<Gamma>,?\\<Theta> \\<turnstile>\\<^bsub>/F\\<^esub> \n        {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\n         (Call p)\n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t},\n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n        by (intro ballI allI, rule HoarePartialDef.Asm,auto)\n      have \"\\<forall>Z. \\<Gamma>,?\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. s=Z \\<and> \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p) ,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault`(-F))} \n                        (the (\\<Gamma> p))\n                        {t. \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Normal t},\n                        {t. \\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"\n        by (iprover intro: MGT_lemma [OF MGT_Calls])\n      thus \"\\<Gamma>,?\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (?Pre p Z) (the (\\<Gamma> p)) (?Post p Z),(?Abr p Z)\"\n        apply (rule ConseqMGT)\n        apply (clarify,safe)\n      proof -\n        assume \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\"\n        with defined show \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))\" \n          by (fastforce simp add: final_notin_def \n                intro: exec.intros)\n      next\n        fix t\n        assume \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Normal t\"\n        with defined \n        show \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>Normal t\"\n          by  (auto intro: exec.Call)\n      next\n        fix t\n        assume \"\\<Gamma>\\<turnstile>\\<langle>the (\\<Gamma> p),Normal Z\\<rangle> \\<Rightarrow> Abrupt t\"\n        with defined \n        show \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow>Abrupt t\"\n          by  (auto intro: exec.Call)\n      qed\n    qed\n  }\n  then show ?thesis\n    apply -\n    apply (intro ballI allI)\n    apply (rule CallRec' [where Procs=\"dom \\<Gamma>\"  and \n      P=\"\\<lambda>p Z. {s. s=Z \\<and> \n                  \\<Gamma>\\<turnstile>\\<langle>Call p,Normal s\\<rangle> \\<Rightarrow>\\<notin>({Stuck} \\<union> Fault ` (-F))}\"and\n      Q=\"\\<lambda>p Z. \n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Normal t}\" and\n      A=\"\\<lambda>p Z. \n        {t. \\<Gamma>\\<turnstile>\\<langle>Call p,Normal Z\\<rangle> \\<Rightarrow> Abrupt t}\"] )\n    apply simp+\n    done\nqed\n\ntheorem hoare_complete: \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow> \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (iprover intro: MGT_implies_complete MGT_lemma [OF MGT_Calls])\n\nlemma hoare_complete': \n  assumes cvalid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (cases \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\")\n  case True\n  hence \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n    by (rule hoare_complete)\n  thus \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P c Q,A\"\n    by (rule hoare_augment_context) simp\nnext\n  case False\n  with cvalid\n  show ?thesis\n    by (rule ExFalso)\nqed\n  \n\nlemma hoare_strip_\\<Gamma>: \n  assumes deriv: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n  assumes F': \"F' \\<subseteq> -F\"\n  shows \"strip F' \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nproof (rule hoare_complete)\n  from hoare_sound [OF deriv] have \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n    by (simp add: cvalid_def)\n  from this F'\n  show \"strip F' \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\n    by (rule valid_to_valid_strip)\nqed\n\n\nsubsection {* And Now: Some Useful Rules *}\n \nsubsubsection {* Consequence *}\n\n\nlemma LiberalConseq_sound:\nfixes F::\"'f set\" \nassumes cons: \"\\<forall>s \\<in> P. \\<forall>(t::('s,'f) xstate). \\<exists>P' Q' A'. (\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A') \\<and>\n                ((s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from P cons obtain P' Q' A' where\n      spec: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P' c Q',A'\" and\n      adapt: \"(s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      apply -\n      apply (drule (1) bspec)\n      apply (erule_tac x=t in allE)\n      apply (elim exE conjE)\n      apply iprover\n      done\n    from exec spec ctxt t_notin_F\n    have \"s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A'\"\n      by (simp add: cnvalid_def nvalid_def)\n    with adapt show ?thesis\n      by simp\n  qed\nqed\n\nlemma LiberalConseq:\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<forall>(t::('s,'f) xstate). \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                ((s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule hoare_complete')\napply (rule allI)\napply (rule LiberalConseq_sound)\nusing cons\napply (clarify)\napply (drule (1) bspec)\napply (erule_tac x=t in allE)\napply clarify\napply (rule_tac x=P' in exI)\napply (rule_tac x=Q' in exI)\napply (rule_tac x=A' in exI)\napply (rule conjI)\napply (blast intro: hoare_cnvalid)\napply assumption\ndone\n\nlemma \"\\<forall>s \\<in> P. \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A \n           \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule LiberalConseq)\n  apply (rule ballI)\n  apply (drule (1) bspec)\n  apply clarify\n  apply (rule_tac x=P' in exI)\n  apply (rule_tac x=Q' in exI)\n  apply (rule_tac x=A' in exI)\n  apply auto\n  done\n\nlemma\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                (\\<forall>(t::('s,'f) xstate). (s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\n  apply (rule Conseq)\n  apply (rule ballI)\n  apply (insert cons)\n  apply (drule (1) bspec)\n  apply clarify\n  apply (rule_tac x=P' in exI)\n  apply (rule_tac x=Q' in exI)\n  apply (rule_tac x=A' in exI)\n  apply (rule conjI)\n  apply  assumption\n  (* no way to get s \\<in> P' *)\n  oops\n\nlemma LiberalConseq':\nfixes F:: \"'f set\"\nassumes cons: \"\\<forall>s \\<in> P.  \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A' \\<and>\n                (\\<forall>(t::('s,'f) xstate). (s \\<in> P' \\<longrightarrow> t \\<in> Normal ` Q' \\<union> Abrupt ` A')\n                              \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule LiberalConseq)\napply (rule ballI)\napply (rule allI)\napply (insert cons)\napply (drule (1) bspec)\napply clarify\napply (rule_tac x=P' in exI)\napply (rule_tac x=Q' in exI)\napply (rule_tac x=A' in exI)\napply iprover\ndone\n\nlemma LiberalConseq'':\nfixes F:: \"'f set\"\nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s (t::('s,'f) xstate). \n                 (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in> Normal ` Q' Z \\<union> Abrupt ` A' Z)\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule LiberalConseq)\napply (rule ballI)\napply (rule allI)\napply (insert cons)\napply (erule_tac x=s in allE)\napply (erule_tac x=t in allE)\napply (case_tac \"t \\<in> Normal ` Q \\<union> Abrupt ` A\")\napply (insert spec)\napply  iprover\napply auto\ndone\n\nprimrec procs:: \"('s,'p,'f) com \\<Rightarrow> 'p set\"\nwhere\n\"procs Skip = {}\" |\n\"procs (Basic f) = {}\" |\n\"procs (Seq c\\<^sub>1 c\\<^sub>2)  = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\" |\n\"procs (Cond b c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\" |\n\"procs (While b c) = procs c\" |\n\"procs (Call p) = {p}\" |\n\"procs (DynCom c) = (\\<Union>s. procs (c s))\" |\n\"procs (Guard f g c) = procs c\" |\n\"procs Throw = {}\" |\n\"procs (Catch c\\<^sub>1 c\\<^sub>2) = (procs c\\<^sub>1 \\<union> procs c\\<^sub>2)\"\n\nprimrec noSpec:: \"('s,'p,'f) com \\<Rightarrow> bool\"\nwhere\n\"noSpec Skip = True\" |\n\"noSpec (Basic f) = True\" |\n\"noSpec (Spec r) = False\" |\n\"noSpec (Seq c\\<^sub>1 c\\<^sub>2)  = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\" |\n\"noSpec (Cond b c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\" |\n\"noSpec (While b c) = noSpec c\" |\n\"noSpec (Call p) = True\" |\n\"noSpec (DynCom c) = (\\<forall>s. noSpec (c s))\" |\n\"noSpec (Guard f g c) = noSpec c\" |\n\"noSpec Throw = True\" |\n\"noSpec (Catch c\\<^sub>1 c\\<^sub>2) = (noSpec c\\<^sub>1 \\<and> noSpec c\\<^sub>2)\"\n\nlemma exec_noSpec_no_Stuck:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> \\<Rightarrow> t\"\n assumes noSpec_c: \"noSpec c\"\n assumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\n assumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\n assumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\n assumes s_no_Stuck: \"s\\<noteq>Stuck\"\n shows \"t\\<noteq>Stuck\"\n  using exec noSpec_c procs_subset s_no_Stuck\n  proof (induct) \n    case (Call p bdy s t) with noSpec_\\<Gamma> procs_subset_\\<Gamma> show ?case \n      apply -\n      apply (drule bspec [where x=p])\n      apply  fastforce\n      apply (drule bspec [where x=p])\n      apply (auto)\n      done\n  qed fastforce+\n\nlemma execn_noSpec_no_Stuck:\n assumes exec: \"\\<Gamma>\\<turnstile>\\<langle>c,s\\<rangle> =n\\<Rightarrow> t\"\n assumes noSpec_c: \"noSpec c\"\n assumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\n assumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\n assumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\n assumes s_no_Stuck: \"s\\<noteq>Stuck\"\n shows \"t\\<noteq>Stuck\"\n  using exec noSpec_c procs_subset s_no_Stuck\n  proof (induct)\n     case (Call p bdy n s t) with noSpec_\\<Gamma> procs_subset_\\<Gamma> show ?case \n      apply -\n      apply (drule bspec [where x=p])\n      apply  fastforce\n      apply (drule bspec [where x=p])\n      apply (auto)\n      done\n  qed fastforce+\n\n\n\nlemma LiberalConseq_noguards_nothrows_sound:\nassumes spec: \"\\<forall>Z. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s t. (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in>  Q' Z )\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Q )\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A \"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt:\"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from execn_noguards_no_Fault [OF exec noguards_c noguards_\\<Gamma>]\n     execn_nothrows_no_Abrupt [OF exec nothrows_c nothrows_\\<Gamma> ]\n     execn_noSpec_no_Stuck [OF exec  \n              noSpec_c  noSpec_\\<Gamma> procs_subset \n      procs_subset_\\<Gamma>]                            \n    obtain t' where t: \"t=Normal t'\"\n      by (cases t) auto\n    with exec spec ctxt\n    have \"(\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t' \\<in>  Q' Z)\"\n      by (unfold  cnvalid_def nvalid_def) blast\n    with cons P t show ?thesis\n      by simp\n  qed\nqed\n\n\nlemma LiberalConseq_noguards_nothrows:\nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nassumes cons: \"\\<forall>s t. (\\<forall>Z. s \\<in> P' Z \\<longrightarrow> t \\<in>  Q' Z )\n                  \\<longrightarrow> (s \\<in> P \\<longrightarrow> t \\<in> Q )\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \"\napply (rule hoare_complete')\napply (rule allI)\napply (rule LiberalConseq_noguards_nothrows_sound \n             [OF _ cons noguards_c noguards_\\<Gamma> nothrows_c nothrows_\\<Gamma> \n                 noSpec_c noSpec_\\<Gamma> \n                 procs_subset procs_subset_\\<Gamma>])\napply (insert spec)\napply (intro allI)\napply (erule_tac x=Z in allE)\nby (rule hoare_cnvalid)\n\nlemma \nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=fst Z \\<and> P s (snd Z)} c {t. Q (fst Z) (snd Z) t},{}\"\nassumes noguards_c: \"noguards c\"\nassumes noguards_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noguards (the (\\<Gamma> p))\"\nassumes nothrows_c: \"nothrows c\"\nassumes nothrows_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. nothrows (the (\\<Gamma> p))\"\nassumes noSpec_c: \"noSpec c\"\nassumes noSpec_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. noSpec (the (\\<Gamma> p))\"\nassumes procs_subset: \"procs c \\<subseteq> dom \\<Gamma>\"\nassumes procs_subset_\\<Gamma>: \"\\<forall>p \\<in> dom \\<Gamma>. procs (the (\\<Gamma> p)) \\<subseteq> dom \\<Gamma>\"\nshows \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>{s. s=\\<sigma>} c {t. \\<forall>l. P \\<sigma> l \\<longrightarrow> Q \\<sigma> l t},{}\"\napply (rule allI)\napply (rule LiberalConseq_noguards_nothrows\n              [OF spec _ noguards_c noguards_\\<Gamma> nothrows_c nothrows_\\<Gamma>\n                  noSpec_c noSpec_\\<Gamma> \n                  procs_subset procs_subset_\\<Gamma>])\napply auto\ndone\n\nsubsubsection {* Modify Return *}\n\nlemma ProcModifyReturn_sound:\n  assumes valid_call: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n  assumes valid_modif: \n    \"\\<forall>\\<sigma>. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \n  assumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\n  assumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\n  shows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  then have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from exec\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.Call)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = \n      Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\"  .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\" \n      \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> p = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    then have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\n\nlemma ProcModifyReturn:\n  assumes spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n  assumes result_conform:\n      \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes return_conform:\n      \"\\<forall>s t. t \\<in> ModifAbr (init s) \n             \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes modifies_spec:  \n  \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule ProcModifyReturn_sound \n          [where Modif=Modif and ModifAbr=ModifAbr, \n            OF _ _ result_conform return_conform] )\nusing spec\napply (blast intro: hoare_cnvalid)\nusing modifies_spec\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma ProcModifyReturnSameFaults_sound:\n  assumes valid_call: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P call init p return' c Q,A\"\n  assumes valid_modif: \n    \"\\<forall>\\<sigma>. \\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \n  assumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\n  assumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\n  shows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>call init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from exec\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy \n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = \n      Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also \n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call p,Normal (init s)\\<rangle> =n \\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\"  and\n      t: \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    from cnvalidD [OF valid_call [rule_format] ctxt this P] t t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> p = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> p = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    then have \"\\<Gamma>\\<turnstile>\\<langle>call init p return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    from valid_call [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\n\nlemma ProcModifyReturnSameFaults:\n  assumes spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n  assumes result_conform:\n      \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes return_conform:\n  \"\\<forall>s t. t \\<in> ModifAbr (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes modifies_spec:  \n  \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule ProcModifyReturnSameFaults_sound \n          [where Modif=Modif and ModifAbr=ModifAbr, \n         OF _ _ result_conform return_conform])\nusing spec\napply (blast intro: hoare_cnvalid)\nusing modifies_spec\napply (blast intro: hoare_cnvalid)\ndone\n\nsubsubsection {* DynCall *}\n  \nlemma dynProcModifyReturn_sound:\nassumes valid_call: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  then have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> P (Call p) Q,A\"\n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  assume P: \"s \\<in> P\"\n  with valid_modif \n  have valid_modif': \"\\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n    by blast\n  from exec\n  have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by (cases rule: execn_dynCall_Normal_elim)\n  then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n\\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n\\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt' this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\" \n      \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> (p s) = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    hence \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma dynProcModifyReturn:\nassumes dyn_call: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nassumes modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>.  \n       \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule dynProcModifyReturn_sound [where Modif=Modif and ModifAbr=ModifAbr,\n          OF hoare_cnvalid [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_cnvalid [OF modif [rule_format]])\napply assumption\ndone\n\nlemma dynProcModifyReturnSameFaults_sound:\nassumes valid_call: \"\\<And>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes valid_modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<forall>n. \n       \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \\<longrightarrow> return' s t = return s t\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  assume P: \"s \\<in> P\"\n  with valid_modif \n  have valid_modif': \"\\<forall>\\<sigma>. \\<forall>n. \n    \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n    by blast\n  from exec\n  have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n    by (cases rule: execn_dynCall_Normal_elim)\n  then show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases rule: execn_call_Normal_elim)\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Normal t'\" \n    assume exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c s t',Normal (return s t')\\<rangle> =Suc m\\<Rightarrow> t\" \n    assume n: \"n = Suc m\"\n    from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n \\<Rightarrow> Normal t'\"\n      by (auto simp add: intro: execn.Call)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> Modif (init s)\"\n      by auto\n    with ret_modif have \"Normal (return' s t') = Normal (return s t')\"\n      by simp\n    with exec_body exec_c bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_call)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m t'\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume exec_body: \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Abrupt t'\" \n    assume n: \"n = Suc m\"\n    assume t: \"t = Abrupt (return s t')\"\n    also from exec_body n bdy\n    have \"\\<Gamma>\\<turnstile>\\<langle>Call (p s) ,Normal (init s)\\<rangle> =n \\<Rightarrow> Abrupt t'\"\n      by (auto simp add: intro: execn.intros)\n    from cnvalidD [OF valid_modif' [rule_format, of n \"init s\"] ctxt this] P\n    have \"t' \\<in> ModifAbr (init s)\"\n      by auto\n    with ret_modifAbr have \"Abrupt (return s t') = Abrupt (return' s t')\"\n      by simp\n    finally have \"t = Abrupt (return' s t')\" .\n    with exec_body bdy n\n    have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (auto intro: execn_callAbrupt)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this] P t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m f\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Fault f\" \"n = Suc m\"  and\n      t: \"t = Fault f\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callFault)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from cnvalidD [OF valid_call ctxt this P] t t_notin_F\n    show ?thesis\n      by simp\n  next\n    fix bdy m\n    assume bdy: \"\\<Gamma> (p s) = Some bdy\"\n    assume \"\\<Gamma>\\<turnstile>\\<langle>bdy,Normal (init s)\\<rangle> =m\\<Rightarrow> Stuck\" \"n = Suc m\" \n      \"t = Stuck\"\n    with bdy have \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callStuck)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    fix m\n    assume \"\\<Gamma> (p s) = None\"\n    and  \"n = Suc m\" \"t = Stuck\"\n    hence \"\\<Gamma>\\<turnstile>\\<langle>call init (p s) return' c ,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by (auto intro: execn_callUndefined)\n    hence \"\\<Gamma>\\<turnstile>\\<langle>dynCall init p return' c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n      by (rule execn_dynCall)\n    from valid_call ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma dynProcModifyReturnSameFaults:\nassumes dyn_call: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P dynCall init p return' c Q,A\"\nassumes ret_modif:\n    \"\\<forall>s t. t \\<in> Modif (init s) \n           \\<longrightarrow> return' s t = return s t\"\nassumes ret_modifAbr: \"\\<forall>s t. t \\<in> ModifAbr (init s) \n                             \\<longrightarrow> return' s t = return s t\"\nassumes modif: \n    \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} Call (p s) (Modif \\<sigma>),(ModifAbr \\<sigma>)\" \nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule dynProcModifyReturnSameFaults_sound \n        [where Modif=Modif and ModifAbr=ModifAbr,\n           OF hoare_cnvalid [OF dyn_call] _ ret_modif ret_modifAbr])\napply (intro ballI allI)\napply (rule hoare_cnvalid [OF modif [rule_format]])\napply assumption\ndone\n\n\nsubsubsection {* Conjunction of Postcondition *}\n\nlemma PostConjI_sound:\nassumes valid_Q: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\" \nassumes valid_R: \"\\<forall>n. \\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c R,B\"\nshows \"\\<Gamma>,\\<Theta> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from valid_Q [rule_format] ctxt exec P t_notin_F have \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (rule cnvalidD)\n  moreover\n  from valid_R [rule_format] ctxt exec P t_notin_F have \"t \\<in> Normal ` R \\<union> Abrupt ` B\"\n    by (rule cnvalidD)\n  ultimately show \"t \\<in> Normal ` (Q \\<inter> R) \\<union> Abrupt ` (A \\<inter> B)\"\n    by blast\nqed\n\nlemma PostConjI: \n  assumes deriv_Q: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  assumes deriv_R: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c R,B\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule PostConjI_sound)\nusing deriv_Q\napply (blast intro: hoare_cnvalid)\nusing deriv_R\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma Merge_PostConj_sound: \n  assumes validF: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validG: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/G\\<^esub> P' c R,X\"\n  assumes F_G: \"F \\<subseteq> G\"\n  assumes P_P': \"P \\<subseteq> P'\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> X)\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  with F_G have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/G\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  with P_P' have P': \"s \\<in> P'\"\n    by auto\n  assume t_noFault: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` (Q \\<inter> R) \\<union> Abrupt ` (A \\<inter> X)\"\n  proof -\n    from cnvalidD [OF validF [rule_format] ctxt exec P t_noFault]\n    have \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\n    moreover from this have \"t \\<notin> Fault ` G\"\n      by auto\n    from cnvalidD [OF validG [rule_format] ctxt' exec P' this]\n    have \"t \\<in> Normal ` R \\<union> Abrupt ` X\" .\n    ultimately show ?thesis by auto\n  qed\nqed\n\nlemma Merge_PostConj: \n  assumes validF: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validG: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/G\\<^esub> P' c R,X\"\n  assumes F_G: \"F \\<subseteq> G\"\n  assumes P_P': \"P \\<subseteq> P'\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> X)\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule Merge_PostConj_sound [OF _ _ F_G P_P'])\nusing validF apply (blast intro:hoare_cnvalid)\nusing validG apply (blast intro:hoare_cnvalid)\ndone\n\nsubsubsection {* Weaken Context *}\n\n\nlemma WeakenContext_sound:\n  assumes valid_c: \"\\<forall>n. \\<Gamma>,\\<Theta>'\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes valid_ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>'. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  with valid_ctxt\n  have ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>'. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n    by (simp add: cnvalid_def)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from valid_c [rule_format] ctxt' exec P t_notin_F\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by (rule cnvalidD)\nqed\n\nlemma WeakenContext: \n  assumes deriv_c: \"\\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" \n  assumes deriv_ctxt: \"\\<forall>(P,p,Q,A)\\<in>\\<Theta>'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule WeakenContext_sound)\nusing deriv_c\napply (blast intro: hoare_cnvalid)\nusing deriv_ctxt\napply (blast intro: hoare_cnvalid)\ndone\n\nsubsubsection {* Guards and Guarantees *}\n\nlemma SplitGuards_sound:\nassumes valid_c1: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\"\nassumes valid_c2: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\nassumes c: \"(c\\<^sub>1 \\<inter>\\<^sub>g c\\<^sub>2) = Some c\"\nshows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t \n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma> \\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case Normal\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    case Abrupt\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  next\n    case (Fault f)\n    with exec inter_guards_execn_Fault [OF c]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Fault f \\<or> \\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      by auto\n    then show ?thesis\n    proof (cases rule: disjE [consumes 1])\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      from Fault cnvalidD [OF valid_c1 [rule_format] ctxt this P] t_notin_F\n      show ?thesis\n        by blast\n    next\n      assume \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>2,Normal s\\<rangle> =n\\<Rightarrow> Fault f\"\n      from Fault cnvalidD [OF valid_c2 [rule_format] ctxt this P] t_notin_F\n      show ?thesis\n        by blast\n    qed\n  next\n    case Stuck\n    with inter_guards_execn_noFault [OF c exec]\n    have \"\\<Gamma>\\<turnstile>\\<langle>c\\<^sub>1,Normal s\\<rangle> =n\\<Rightarrow> t\" by simp\n    from valid_c1 [rule_format] ctxt this P t_notin_F\n    show ?thesis\n      by (rule cnvalidD)\n  qed\nqed\n\nlemma SplitGuards: \n  assumes c: \"(c\\<^sub>1 \\<inter>\\<^sub>g c\\<^sub>2) = Some c\" \n  assumes deriv_c1: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,A\" \n  assumes deriv_c2: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>2 UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule SplitGuards_sound [OF _ _ c])\nusing deriv_c1\napply (blast intro: hoare_cnvalid)\nusing deriv_c2\napply (blast intro: hoare_cnvalid)\ndone\n\nlemma CombineStrip_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes valid_strip: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  hence ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case (Normal t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Normal \n    show ?thesis\n      by auto\n  next\n    case (Abrupt t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Abrupt \n    show ?thesis\n      by auto\n  next\n    case (Fault f)\n    show ?thesis\n    proof (cases \"f \\<in> F\")\n      case True\n      hence \"f \\<notin> -F\" by simp\n      with exec Fault\n      have \"\\<Gamma>\\<turnstile>\\<langle>strip_guards (-F) c,Normal s\\<rangle> =n\\<Rightarrow> Fault f\" \n        by (auto intro: execn_to_execn_strip_guards_Fault)\n      from cnvalidD [OF valid_strip [rule_format] ctxt this P] Fault\n      have False\n        by auto\n      thus ?thesis ..\n    next\n      case False\n      with cnvalidD [OF valid [rule_format] ctxt' exec P] Fault\n      show ?thesis\n        by auto\n    qed\n  next\n    case Stuck\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Stuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma CombineStrip: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes deriv_strip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P (strip_guards (-F) c) UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule CombineStrip_sound)\napply  (iprover intro: hoare_cnvalid [OF deriv])\napply (iprover intro: hoare_cnvalid [OF deriv_strip])\ndone\n\nlemma GuardsFlip_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes validFlip: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  hence ctxt': \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  from ctxt have ctxtFlip: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/-F\\<^esub> P (Call p) Q,A\" \n    by (auto intro: nvalid_augment_Faults)\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases t)\n    case (Normal t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Normal \n    show ?thesis\n      by auto\n  next\n    case (Abrupt t')\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Abrupt \n    show ?thesis\n      by auto\n  next\n    case (Fault f)\n    show ?thesis\n    proof (cases \"f \\<in> F\")\n      case True\n      hence \"f \\<notin> -F\" by simp\n      with cnvalidD [OF validFlip [rule_format] ctxtFlip exec P] Fault\n      have False\n        by auto\n      thus ?thesis ..\n    next\n      case False\n      with cnvalidD [OF valid [rule_format] ctxt' exec P] Fault\n      show ?thesis\n        by auto\n    qed\n  next\n    case Stuck\n    from cnvalidD [OF valid [rule_format] ctxt' exec P] Stuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma GuardsFlip: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes derivFlip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/-F\\<^esub> P c UNIV,UNIV\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule GuardsFlip_sound)\napply  (iprover intro: hoare_cnvalid [OF deriv])\napply (iprover intro: hoare_cnvalid [OF derivFlip])\ndone\n\nlemma MarkGuardsI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_mark_guards_to_execn [OF exec] obtain t' where\n    exec_c: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n    t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n    by blast\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from cnvalidD [OF valid [rule_format] ctxt exec_c P]\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by blast\n    with t'_noFault\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma MarkGuardsI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\"  \napply (rule hoare_complete')\napply (rule allI)\napply (rule MarkGuardsI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MarkGuardsD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof (cases \"isFault t\")\n    case True\n    with execn_to_execn_mark_guards_Fault [OF exec ]\n    obtain f' where \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> Fault f'\"\n      by (fastforce elim: isFaultE)\n    from cnvalidD [OF valid [rule_format] ctxt this P]\n    have False\n      by auto\n    thus ?thesis ..\n  next\n    case False\n    from execn_to_execn_mark_guards [OF exec False]\n    obtain f' where \"\\<Gamma>\\<turnstile>\\<langle>mark_guards f c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n      by auto\n    from cnvalidD [OF valid [rule_format] ctxt this P]\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma MarkGuardsD: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P mark_guards f c Q,A\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MarkGuardsD_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MergeGuardsI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\"\n  from execn_merge_guards_to_execn [OF exec_merge] \n  have exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" .\n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec P t_notin_F]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma MergeGuardsI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule MergeGuardsI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma MergeGuardsD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P merge_guards c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_to_execn_merge_guards [OF exec] \n  have exec_merge: \"\\<Gamma>\\<turnstile>\\<langle>merge_guards c,Normal s\\<rangle> =n\\<Rightarrow> t\".\n  assume P: \"s \\<in> P\" \n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_merge P t_notin_F]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\n\n\n\nlemma SubsetGuards_sound: \n  assumes c_c': \"c \\<subseteq>\\<^sub>g c'\"\n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c' Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/{}\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  from execn_to_execn_subseteq_guards [OF c_c' exec] obtain t' where\n    exec_c': \"\\<Gamma>\\<turnstile>\\<langle>c',Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n    t'_noFault: \"\\<not> isFault t' \\<longrightarrow> t' = t\"\n    by blast\n  assume P: \"s \\<in> P\" \n  assume t_noFault: \"t \\<notin> Fault ` {}\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_c' P] t'_noFault t_noFault\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n    by auto\nqed\n\nlemma SubsetGuards: \n  assumes c_c': \"c \\<subseteq>\\<^sub>g c'\"\n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c' Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule SubsetGuards_sound [OF c_c'])\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma NormalizeD_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  hence exec_norm: \"\\<Gamma>\\<turnstile>\\<langle>normalize c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    by (rule execn_to_execn_normalize)\n  assume P: \"s \\<in> P\" \n  assume noFault: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec_norm P noFault]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma NormalizeD: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule NormalizeD_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\nlemma NormalizeI_sound: \n  assumes valid: \"\\<forall>n. \\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\nproof (rule cnvalidI)\n  fix s t\n  assume ctxt: \"\\<forall>(P, p, Q, A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P (Call p) Q,A\" \n  assume \"\\<Gamma>\\<turnstile>\\<langle>normalize c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  hence exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n    by (rule execn_normalize_to_execn)\n  assume P: \"s \\<in> P\" \n  assume noFault: \"t \\<notin> Fault ` F\"\n  from cnvalidD [OF valid [rule_format] ctxt exec P noFault]\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\".\nqed\n\nlemma NormalizeI: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (normalize c) Q,A\"\napply (rule hoare_complete')\napply (rule allI)\napply (rule NormalizeI_sound)\napply (iprover intro: hoare_cnvalid [OF deriv])\ndone\n\n\nsubsubsection {* Restricting the Procedure Environment *}\n\nlemma nvalid_restrict_to_nvalid:\nassumes valid_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>\\<Turnstile>n:\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule nvalidI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from execn_to_execn_restrict [OF exec]\n    obtain t' where\n      exec_res: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<turnstile>\\<langle>c,Normal s\\<rangle> =n\\<Rightarrow> t'\" and\n      t_Fault: \"\\<forall>f. t = Fault f \\<longrightarrow> t' \\<in> {Fault f, Stuck}\" and\n      t'_notStuck: \"t'\\<noteq>Stuck \\<longrightarrow> t'=t\"\n      by blast\n    from t_Fault t_notin_F t'_notStuck have \"t' \\<notin> Fault ` F\"\n      by (cases t') auto\n    with valid_c exec_res P \n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: nvalid_def)\n    with t'_notStuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma valid_restrict_to_valid:\nassumes valid_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nproof (rule validI)\n  fix s t\n  assume exec: \"\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t\" \n  assume P: \"s \\<in> P\"\n  assume t_notin_F: \"t \\<notin> Fault ` F\"\n  show \"t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  proof -\n    from exec_to_exec_restrict [OF exec]\n    obtain t' where\n      exec_res: \"\\<Gamma>|\\<^bsub>M\\<^esub>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t'\" and\n      t_Fault: \"\\<forall>f. t = Fault f \\<longrightarrow> t' \\<in> {Fault f, Stuck}\" and\n      t'_notStuck: \"t'\\<noteq>Stuck \\<longrightarrow> t'=t\"\n      by blast\n    from t_Fault t_notin_F t'_notStuck have \"t' \\<notin> Fault ` F\"\n      by (cases t') auto\n    with valid_c exec_res P\n    have \"t' \\<in> Normal ` Q \\<union> Abrupt ` A\"\n      by (auto simp add: valid_def)\n    with t'_notStuck\n    show ?thesis\n      by auto\n  qed\nqed\n\nlemma augment_procs:\nassumes deriv_c: \"\\<Gamma>|\\<^bsub>M\\<^esub>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nshows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule hoare_complete)\n  apply (rule valid_restrict_to_valid)\n  apply (insert hoare_sound [OF deriv_c])\n  by (simp add: cvalid_def)\n\nlemma augment_Faults:\nassumes deriv_c: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\nassumes F: \"F \\<subseteq> F'\"\nshows \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/F'\\<^esub> P c Q,A\"\n  apply (rule hoare_complete)\n  apply (rule valid_augment_Faults [OF _ F])\n  apply (insert hoare_sound [OF deriv_c])\n  by (simp add: cvalid_def)\n\nend\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/hoare-package/HoarePartialProps.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3116539745084412}}
{"text": "(* \n   Title: Psi-calculi   \n   Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Close_Subst\n  imports Agent Subst_Term\nbegin\n\ncontext subst_psi\nbegin\n\ndefinition close_subst :: \"('b::fs_name \\<times> ('a::fs_name, 'b, 'c::fs_name) psi \\<times> ('a, 'b, 'c) psi) set \\<Rightarrow> ('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\nwhere \"close_subst Rel \\<equiv> {(\\<Psi>, P, Q) | \\<Psi> P Q. (\\<forall>\\<sigma>. well_formed_subst \\<sigma> \\<longrightarrow> (\\<Psi>, P[<\\<sigma>>], Q[<\\<sigma>>]) \\<in> Rel)}\"\n\nlemma close_substI:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<And>\\<sigma>. well_formed_subst \\<sigma> \\<Longrightarrow> (\\<Psi>, P[<\\<sigma>>], Q[<\\<sigma>>]) \\<in> Rel\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> close_subst Rel\"\nusing assms\nby(unfold close_subst_def) auto\n\nlemma close_substE:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   \\<sigma> :: \"(name list \\<times> 'a list) list\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> close_subst Rel\"\n  and     \"well_formed_subst \\<sigma>\"\n\n  shows \"(\\<Psi>, P[<\\<sigma>>], Q[<\\<sigma>>]) \\<in> Rel\"\nusing assms\nby(unfold close_subst_def) auto\n\nlemma close_subst_closed:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   p :: \"name prm\"\n\n  assumes \"eqvt Rel\"\n  and     \"(\\<Psi>, P, Q) \\<in> close_subst Rel\"\n\n  shows \"(p \\<bullet> \\<Psi>, p \\<bullet> P, p \\<bullet> Q) \\<in> close_subst Rel\"\nproof(rule close_substI)\n  fix \\<sigma>\n  assume \"well_formed_subst(\\<sigma>::(name list \\<times> 'a list) list)\"\n  with `(\\<Psi>, P, Q) \\<in> close_subst Rel` `well_formed_subst \\<sigma>`\n  have \"(\\<Psi>, P[<(rev p \\<bullet> \\<sigma>)>], Q[<(rev p \\<bullet> \\<sigma>)>]) \\<in> Rel\"\n    by(rule_tac close_substE) auto\n  hence \"(p \\<bullet> \\<Psi>, p \\<bullet> (P[<(rev p \\<bullet> \\<sigma>)>]), p \\<bullet> (Q[<(rev p \\<bullet> \\<sigma>)>])) \\<in> Rel\"\n    by(drule_tac p=p in eqvtI[OF `eqvt Rel`]) (simp add: eqvts)\n  thus \"(p \\<bullet> \\<Psi>, (p \\<bullet> P)[<\\<sigma>>], (p \\<bullet> Q)[<\\<sigma>>]) \\<in> Rel\"\n    by(simp del: seq_subs_def add: eqvts)\nqed\n\nlemma close_subst_eqvt:\n  assumes \"eqvt Rel\"\n\n  shows \"eqvt(close_subst Rel)\"\nproof(auto simp add: eqvt_def)\n  fix \\<Psi> P Q p\n  assume \"(\\<Psi>, P, Q) \\<in> close_subst Rel\"\n  thus \"((p::name prm) \\<bullet> \\<Psi>, p \\<bullet> P, p \\<bullet> Q) \\<in> close_subst Rel\"\n    by(drule_tac p=p in close_subst_closed[OF `eqvt Rel`]) (simp add: eqvts)\nqed\n\nlemma close_subst_unfold:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   \\<sigma> :: \"(name list \\<times> 'a list) list\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> close_subst Rel\"\n  and     \"well_formed_subst \\<sigma>\"\n\n  shows \"(\\<Psi>, P[<\\<sigma>>], Q[<\\<sigma>>]) \\<in> close_subst Rel\"\nproof(rule close_substI)\n  fix \\<sigma>'::\"(name list \\<times> 'a list) list\"\n  assume \"well_formed_subst \\<sigma>'\"\n  with `well_formed_subst \\<sigma>` have \"well_formed_subst(\\<sigma>@\\<sigma>')\" by simp\n  with `(\\<Psi>, P, Q) \\<in> close_subst Rel` have \"(\\<Psi>, P[<(\\<sigma>@\\<sigma>')>], Q[<(\\<sigma>@\\<sigma>')>]) \\<in> Rel\"\n    by(rule close_substE)\n  thus \"(\\<Psi>, P[<\\<sigma>>][<\\<sigma>'>], Q[<\\<sigma>>][<\\<sigma>'>]) \\<in> Rel\"\n    by simp\nqed\n\nend\n\nend\n  \n\n  \n\n\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Close_Subst.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3116539745084412}}
{"text": "(*<*)\n(*  Author : Peter Chapman *)\n(* License: LGPL *)\nheader \"Single Succedent\"\n\ntheory SingleSuccedent\nimports \"~~/src/HOL/Library/Multiset\"\nbegin\n\n(* Has the empty formula O, which will mean we can have empty right-hand sides *)\n(*>*)\n\ntext{* \n\\section{Single Succedent Calculi \\label{isasingle}}\nWe must be careful when restricting sequents to single succedents.  If we have sequents as a pair of multisets, where the second is restricted to having size at most 1, then how does one extend the active part of $\\implies{L}{}$ from \\textbf{G3ip}?  The left premiss will be $\\implies{A}{B} \\Rightarrow A$, and the extension will be $\\Gamma \\Rightarrow C$.  The \\texttt{extend} function must be able to correctly choose to discard the $C$.  \n\nRather than taking this route, we instead restrict to single formulae in the succedents of sequents.  This raises its own problems, since now how does one represent the empty succedent?  We introduce a dummy formula \\texttt{Em}, which will stand for the empty formula:\n*}\n\ndatatype 'a form = At \"nat\"\n                        | Compound \"'a\" \"'a form list\"\n                        | ff\n                        | Em\n(*<*)\nabbreviation multiset_abbrev (\"\\<LM> _  \\<RM>\" [75]75) where\n   \"\\<LM> A \\<RM> \\<equiv> {# A #}\"\n\nabbreviation multiset_empty (\"\\<Empt>\" 75) where\n  \"\\<Empt> \\<equiv> {#}\"\n\ndatatype 'a sequent = Sequent \"('a form) multiset\" \"('a form)\" (\" (_) \\<Rightarrow>* (_)\" [6,6] 5)\n\n(* We have that any step in a rule, be it a primitive rule or an instance of a rule in a derivation\n   can be represented as a list of premisses and a conclusion.  We need a list since a list is finite\n   by definition *)\ntype_synonym 'a rule = \"'a sequent list * 'a sequent\"\n\ntype_synonym 'a deriv = \"'a sequent * nat\"\n\nabbreviation\nmultiset_plus (infixl \"\\<oplus>\" 80) where\n   \"(\\<Gamma> :: 'a multiset) \\<oplus> (A :: 'a) \\<equiv> \\<Gamma> + \\<LM>A\\<RM>\"\nabbreviation\nmultiset_minus (infixl \"\\<ominus>\" 80) where\n   \"(\\<Gamma> :: 'a multiset) \\<ominus>  (A :: 'a) \\<equiv> \\<Gamma> - \\<LM>A\\<RM>\" \n\nconsts\n  (* extend a sequent by adding another one.  A form of weakening.  Is this overkill by adding a sequent? *)\n  extend :: \"'a sequent \\<Rightarrow> 'a sequent \\<Rightarrow> 'a sequent\"\n  extendRule :: \"'a sequent \\<Rightarrow> 'a rule \\<Rightarrow> 'a rule\"\n\n  (* Unique conclusion Property *)\n  uniqueConclusion :: \"'a rule set \\<Rightarrow> bool\"\n\n  (* Invertible definitions *)\n  invertible :: \"'a rule \\<Rightarrow> 'a rule set \\<Rightarrow> bool\"\n  invertible_set :: \"'a rule set \\<Rightarrow> bool\"\n\n  (* functions to get at components of sequents *)\nprimrec antec :: \"'a sequent \\<Rightarrow> 'a form multiset\" where \"antec (Sequent ant suc) = ant\"\nprimrec succ :: \"'a sequent \\<Rightarrow> 'a form\" where \"succ (Sequent ant suc) = suc\"\nprimrec mset :: \"'a sequent \\<Rightarrow> 'a form multiset\" where \"mset (Sequent ant suc) = ant \\<oplus> suc\"\nprimrec seq_size :: \"'a sequent \\<Rightarrow> nat\" where \"seq_size (Sequent ant suc) = size ant + size suc\"\n\n(* Extend a sequent, and then a rule by adding seq to all premisses and the conclusion *)\n\n(*>*)\ntext{*\n\\noindent When we come to extend a sequent, say $\\Gamma \\Rightarrow C$, with another sequent, say $\\Gamma' \\Rightarrow C'$, we only ``overwrite'' the succedent if $C$ is the empty formula:\n*}\ndefs extend_def : \"extend forms seq \\<equiv> if (succ seq = Em) \n                  then (antec forms + antec seq) \\<Rightarrow>* (succ forms) \n                  else (antec forms + antec seq \\<Rightarrow>* succ seq)\"\n\n(*<*)\ndefs extendRule_def : \"extendRule forms R \\<equiv> (map (extend forms) (fst R), extend forms (snd R))\"\n\n(* The formulation of various rule sets *)\n\n(* Ax is the set containing all identity RULES and LBot *)\ninductive_set \"Ax\" where\n   id[intro]: \"([], \\<LM> At i \\<RM> \\<Rightarrow>* At i) \\<in> Ax\"\n|  Lbot[intro]: \"([], \\<LM> ff \\<RM> \\<Rightarrow>* Em) \\<in> Ax\"\n\n(* upRules is the set of all rules which have a single conclusion.  This is akin to each rule having a \n   single principal formula.  We don't want rules to have no premisses, hence the restriction\n   that ps \\<noteq> [] *)\ninductive_set \"upRules\" where\n   L[intro]: \"\\<lbrakk> c \\<equiv> (\\<LM> Compound R Fs \\<RM> \\<Rightarrow>* Em) ; ps \\<noteq> [] \\<rbrakk> \\<Longrightarrow> (ps,c) \\<in> upRules\"\n|  R[intro]: \"\\<lbrakk> c \\<equiv> (\\<Empt> \\<Rightarrow>* Compound F Fs) ; ps \\<noteq> [] \\<rbrakk> \\<Longrightarrow> (ps,c) \\<in> upRules\" \n\ninductive_set extRules :: \"'a rule set \\<Rightarrow> 'a rule set\"  (\"_*\")\n  for R :: \"'a rule set\" \n  where\n   I[intro]: \"r \\<in> R \\<Longrightarrow> extendRule seq r \\<in> R*\"\n\n(* A formulation of what it means to be a principal formula for a rule.  Note that we have to build up from\n   single conclusion rules.   *)\n\ninductive leftPrincipal :: \"'a rule \\<Rightarrow> 'a form \\<Rightarrow> bool\"\n  where\n  up[intro]: \"C = (\\<LM>Compound F Fs\\<RM> \\<Rightarrow>* Em)  \\<Longrightarrow> \n                   leftPrincipal (Ps,C) (Compound F Fs)\"\n\n\ninductive rightPrincipal :: \"'a rule \\<Rightarrow> 'a form \\<Rightarrow> bool\"\n  where\n  up[intro]: \"C = (\\<Empt> \\<Rightarrow>* Compound F Fs) \\<Longrightarrow> rightPrincipal (Ps,C) (Compound F Fs)\"\n\n\n(* What it means to be a derivable sequent.  Can have this as a predicate or as a set.\n   The two formation rules say that the supplied premisses are derivable, and the second says\n   that if all the premisses of some rule are derivable, then so is the conclusion.  *)\n\ninductive_set derivable :: \"'a rule set \\<Rightarrow> 'a deriv set\"\n  for R :: \"'a rule set\"\n  where\n   base[intro]: \"\\<lbrakk>([],C) \\<in> R\\<rbrakk> \\<Longrightarrow> (C,0) \\<in> derivable R\"\n|  step[intro]: \"\\<lbrakk> r \\<in> R ; (fst r)\\<noteq>[] ; \\<forall> p \\<in> set (fst r). \\<exists> n \\<le> m. (p,n) \\<in> derivable R \\<rbrakk> \n                       \\<Longrightarrow> (snd r,m + 1) \\<in> derivable R\"\n\n\n(* When we don't care about height! *)\ninductive_set derivable' :: \"'a rule set \\<Rightarrow> 'a sequent set\"\n   for R :: \"'a rule set\"\n   where\n    base[intro]: \"\\<lbrakk> ([],C) \\<in> R \\<rbrakk> \\<Longrightarrow> C \\<in> derivable' R\"\n|   step[intro]: \"\\<lbrakk> r \\<in> R ; (fst r) \\<noteq> [] ; \\<forall> p \\<in> set (fst r). p \\<in> derivable' R \\<rbrakk>\n                       \\<Longrightarrow> (snd r) \\<in> derivable' R\"\n\nlemma deriv_to_deriv[simp]:\nassumes \"(C,n) \\<in> derivable R\"\nshows \"C \\<in> derivable' R\"\nusing assms by (induct) auto\n\nlemma deriv_to_deriv2:\nassumes \"C \\<in> derivable' R\"\nshows \"\\<exists> n. (C,n) \\<in> derivable R\"\nusing assms\nproof (induct)\n  case (base C)\n  then have \"(C,0) \\<in> derivable R\" by auto\n  then show ?case by blast\nnext\n  case (step r)\n  then obtain ps c where \"r = (ps,c)\" and \"ps \\<noteq> []\" by (cases r) auto\n  then have aa: \"\\<forall> p \\<in> set ps. \\<exists> n. (p,n) \\<in> derivable R\" using step(3) by auto\n  then have \"\\<exists> m. \\<forall> p \\<in> set ps. \\<exists> n\\<le>m. (p,n) \\<in> derivable R\"\n  proof (induct ps)\n    case Nil\n    then show ?case  by auto\n  next\n    case (Cons a as)\n    then have \"\\<exists> m. \\<forall> p \\<in> set as. \\<exists> n\\<le>m. (p,n) \\<in> derivable R\" by auto\n    then obtain m where \"\\<forall> p \\<in> set as. \\<exists> n\\<le>m. (p,n) \\<in> derivable R\" by auto\n    moreover from `\\<forall> p \\<in> set (a # as). \\<exists> n. (p,n) \\<in> derivable R` have\n      \"\\<exists> n. (a,n) \\<in> derivable R\" by auto\n    then obtain m' where \"(a,m') \\<in> derivable R\" by blast\n    ultimately have \"\\<forall> p \\<in> set (a # as). \\<exists> n\\<le>(max m m'). (p,n) \\<in> derivable R\" apply (auto simp add:Ball_def)\n      apply (rule_tac x=m' in exI) apply simp\n      apply (drule_tac x=x in spec) apply auto by (rule_tac x=n in exI) auto\n    then show ?case by blast\n  qed\n  then obtain m where \"\\<forall> p \\<in> set ps. \\<exists> n\\<le>m. (p,n) \\<in> derivable R\" by blast\n  with `r = (ps,c)` and `r \\<in> R` have \"(c,m+1) \\<in> derivable R\" using `ps \\<noteq> []` and\n    derivable.step[where r=\"(ps,c)\" and R=R and m=m] by auto\n  then show ?case using `r = (ps,c)` by auto\nqed\n\n(* definition of invertible rule and invertible set of rules.  It's a bit nasty, but all it really says is\n   If a rule is in the given set, and if any extension of that rule is derivable at n, then the\n   premisses of the extended rule are derivable at height at most n.  *)\ndefs invertible_def : \"invertible r R \\<equiv> \\<forall> n S. (r \\<in> R \\<and> (snd (extendRule S r),n) \\<in> derivable R*) \\<longrightarrow>\n                                          (\\<forall> p \\<in> set (fst (extendRule S r)). \\<exists> m \\<le> n. (p,m) \\<in> derivable R*)\"\n\ndefs invertible_set_def : \"invertible_set R \\<equiv> \\<forall> (ps,c) \\<in> R. invertible (ps,c) R\"\n\n\n(* Characterisation of a sequent *)\nlemma characteriseSeq:\nshows \"\\<exists> A B. (C :: 'a sequent) = (A \\<Rightarrow>* B)\"\napply (rule_tac x=\"antec C\" in exI, rule_tac x=\"succ C\" in exI) by (cases C) (auto)\n\n\n(* Helper function for later *)\nlemma nonEmptySet:\nshows \"A \\<noteq> [] \\<longrightarrow> (\\<exists> a. a \\<in> set A)\"\nby (auto simp add:neq_Nil_conv)\n\n(* Lemma which comes in helpful ALL THE TIME *)\nlemma midMultiset:\n  assumes \"\\<Gamma> \\<oplus> A = \\<Gamma>' \\<oplus> B\" and \"A \\<noteq> B\"\n  shows \"\\<exists> \\<Gamma>''. \\<Gamma> = \\<Gamma>'' \\<oplus> B \\<and> \\<Gamma>' = \\<Gamma>'' \\<oplus> A\"\nproof-\n  from assms have \"A :# \\<Gamma>'\"\n      proof-\n      from assms have \"set_of (\\<Gamma> \\<oplus> A) = set_of (\\<Gamma>' \\<oplus> B)\" by auto\n      then have \"set_of \\<Gamma> \\<union> {A} = set_of \\<Gamma>' \\<union> {B}\" by auto\n      then have \"set_of \\<Gamma> \\<union> {A} \\<subseteq> set_of \\<Gamma>' \\<union> {B}\" by simp\n      then have \"A \\<in> set_of \\<Gamma>'\" using assms by auto\n      thus \"A :# \\<Gamma>'\" by simp\n      qed\n  then have \"\\<Gamma>' \\<ominus> A \\<oplus> A = \\<Gamma>'\" by (auto simp add:multiset_eq_iff)\n  then have \"\\<exists> \\<Gamma>''. \\<Gamma>' = \\<Gamma>'' \\<oplus> A\" apply (rule_tac x=\"\\<Gamma>' \\<ominus> A\" in exI) by auto\n  then obtain \\<Gamma>'' where eq1:\"\\<Gamma>' = \\<Gamma>'' \\<oplus> A\" by blast\n  from `\\<Gamma> \\<oplus> A = \\<Gamma>' \\<oplus> B` eq1 have \"\\<Gamma> \\<oplus> A = \\<Gamma>'' \\<oplus> A \\<oplus> B\" by auto\n  then have \"\\<Gamma> = \\<Gamma>'' \\<oplus> B\" by (auto simp add:multiset_eq_iff)\n  thus ?thesis using eq1 by blast\nqed\n\n(* Lemma which says that if we have extended an identity rule, then the propositional variable is\n   contained in the extended multisets *)\nlemma extendID:\nassumes \"extend S (\\<LM> At i \\<RM> \\<Rightarrow>* At i) = (\\<Gamma> \\<Rightarrow>* \\<Delta>)\"\nshows \"At i :# \\<Gamma>\"\nusing assms\nproof-\n  from assms have \"\\<exists> \\<Gamma>'. \\<Gamma> = \\<Gamma>' \\<oplus> At i\" \n     using extend_def[where forms=S and seq=\"\\<LM> At i \\<RM> \\<Rightarrow>* At i\"]\n     by (rule_tac x=\"antec S\" in exI) auto\n  then show ?thesis by auto\nqed\n\nlemma extendFalsum:\nassumes \"extend S (\\<LM> ff \\<RM> \\<Rightarrow>* Em) = (\\<Gamma> \\<Rightarrow>* \\<Delta>)\"\nshows \"ff :# \\<Gamma>\"\nproof-\n  from assms have \"\\<exists> \\<Gamma>'. \\<Gamma> = \\<Gamma>' \\<oplus> ff\" \n     using extend_def[where forms=S and seq=\"\\<LM>ff \\<RM> \\<Rightarrow>* Em\"]\n     by (rule_tac x=\"antec S\" in exI) auto\n  then show ?thesis by auto\nqed\n\n\n(* Lemma that says if a propositional variable is in both the antecedent and succedent of a sequent,\n   then it is derivable from idupRules *)\nlemma containID:\nassumes a:\"At i :# \\<Gamma>\"\n    and b:\"Ax \\<subseteq> R\"\nshows \"(\\<Gamma> \\<Rightarrow>* At i,0) \\<in> derivable R*\"\nproof-\nfrom a have \"\\<Gamma> = \\<Gamma> \\<ominus> At i \\<oplus> At i\" by auto\nthen have \"extend ((\\<Gamma> \\<ominus> At i) \\<Rightarrow>* Em) (\\<LM> At i \\<RM> \\<Rightarrow>* At i) = (\\<Gamma> \\<Rightarrow>* At i)\" \n     using extend_def[where forms=\"\\<Gamma> \\<ominus> At i \\<Rightarrow>* Em\" and seq=\"\\<LM>At i\\<RM> \\<Rightarrow>* At i\"] by auto\nmoreover\nhave \"([],\\<LM> At i \\<RM> \\<Rightarrow>* At i) \\<in> R\" using b by auto\nultimately\nhave \"([],\\<Gamma> \\<Rightarrow>* At i) \\<in> R*\" \n     using extRules.I[where R=R and r=\"([],  \\<LM>At i\\<RM> \\<Rightarrow>* At i)\" and seq=\"\\<Gamma> \\<ominus> At i \\<Rightarrow>* Em\"] \n       and extendRule_def[where forms=\"\\<Gamma> \\<ominus> At i \\<Rightarrow>* Em\" and R=\"([],  \\<LM>At i\\<RM> \\<Rightarrow>* At i)\"] by auto\nthen show ?thesis using derivable.base[where R=\"R*\" and C=\"\\<Gamma> \\<Rightarrow>* At i\"] by auto\nqed\n\nlemma containFalsum:\nassumes a: \"ff :# \\<Gamma>\"\n   and  b: \"Ax \\<subseteq> R\"\nshows \"(\\<Gamma> \\<Rightarrow>* C,0) \\<in> derivable R*\"\nproof-\nfrom a have \"\\<Gamma> = \\<Gamma> \\<ominus> ff \\<oplus> ff\" by auto\nthen have \"extend (\\<Gamma> \\<ominus> ff \\<Rightarrow>* C) (\\<LM>ff\\<RM> \\<Rightarrow>* Em) = (\\<Gamma> \\<Rightarrow>* C)\"\n     using extend_def[where forms=\"\\<Gamma> \\<ominus> ff \\<Rightarrow>* C\" and seq=\"\\<LM>ff\\<RM> \\<Rightarrow>* Em\"] by auto \nmoreover\nhave \"([],\\<LM>ff\\<RM> \\<Rightarrow>* Em) \\<in> R\" using b by auto\nultimately have \"([],\\<Gamma> \\<Rightarrow>* C) \\<in> R*\"\n     using extRules.I[where R=R and r=\"([],  \\<LM>ff\\<RM> \\<Rightarrow>* Em)\" and seq=\"\\<Gamma> \\<ominus> ff \\<Rightarrow>* C\"] \n       and extendRule_def[where forms=\"\\<Gamma> \\<ominus> ff \\<Rightarrow>* C\" and R=\"([],  \\<LM>ff\\<RM> \\<Rightarrow>* Em)\"] by auto\nthen show ?thesis using derivable.base[where R=\"R*\" and C=\"\\<Gamma> \\<Rightarrow>* C\"] by auto\nqed \n\n(* Lemma which says that if r is an identity rule, then r is of the form\n   ([], P \\<Rightarrow>* P) *)\nlemma characteriseAx:\nshows \"r \\<in> Ax \\<Longrightarrow> r = ([],\\<LM> ff \\<RM> \\<Rightarrow>* Em) \\<or> (\\<exists> i. r = ([], \\<LM> At i \\<RM> \\<Rightarrow>* At i))\"\napply (cases r) by (rule Ax.cases) auto\n\n(* A lemma about the last rule used in a derivation, i.e. that one exists *)\nlemma characteriseLast:\nassumes \"(C,m+1) \\<in> derivable R\"\nshows \"\\<exists> Ps. Ps \\<noteq> [] \\<and>\n             (Ps,C) \\<in> R \\<and> \n             (\\<forall> p \\<in> set Ps. \\<exists> n\\<le>m. (p,n) \\<in> derivable R)\"\nusing assms\nby (cases) auto\n\n\n\n\nlemma upRuleCharacterise:\nassumes \"(Ps,C) \\<in> upRules\"\nshows \"\\<exists> F Fs. C = (\\<Empt> \\<Rightarrow>* Compound F Fs) \\<or> C = (\\<LM>Compound F Fs\\<RM> \\<Rightarrow>* Em)\"\nusing assms by (cases) auto\n\n\nlemma extendEmpty:\nshows \"extend (\\<Empt> \\<Rightarrow>* Em) C = C\"\napply (auto simp add:extend_def) apply (cases C) apply auto by (cases C) auto\n\nlemma extendContain:\nassumes \"r = (ps,c)\"\n    and \"(Ps,C) = extendRule S r\"\n    and \"p \\<in> set ps\"\nshows \"extend S p \\<in> set Ps\"\nproof-\nfrom `p \\<in> set ps` have \"extend S p \\<in> set (map (extend S) ps)\" by auto\nmoreover from `(Ps,C) = extendRule S r` and `r = (ps,c)` have \"map (extend S) ps = Ps\" by (simp add:extendRule_def) \nultimately show ?thesis by auto\nqed\n\nlemma nonPrincipalID:\nfixes A :: \"'a form\"\nassumes \"r \\<in> Ax\"\nshows \"\\<not> rightPrincipal r A \\<and> \\<not> leftPrincipal r A\"\nproof-\nfrom assms obtain i where r1:\"r = ([], \\<LM> ff \\<RM> \\<Rightarrow>* Em) \\<or> r = ([], \\<LM> At i \\<RM> \\<Rightarrow>* At i)\" \n     using characteriseAx[where r=r] by auto\n{ assume \"rightPrincipal r A\" then obtain Ps where r2:\"r = (Ps, \\<Empt> \\<Rightarrow>* A)\" by (cases r) auto\n  with r1 have \"False\" by simp\n}\nthen have \"\\<not> rightPrincipal r A\" by auto\nmoreover\n{ assume \"leftPrincipal r A\" then obtain Ps' F Fs where r3:\"r = (Ps', \\<LM>Compound F Fs\\<RM> \\<Rightarrow>* Em)\" by (cases r) auto\n  with r1 have \"False\" by auto\n}\nthen have \"\\<not> leftPrincipal r A\" by auto\nultimately show ?thesis by simp\nqed\n\nlemma extended_Ax_prems_empty:\nassumes \"r \\<in> Ax\"\nshows \"fst (extendRule S r) = []\"\nusing assms apply (cases r) by (rule Ax.cases) (auto simp add:extendRule_def)\n\n\n\n(* ---------------------------------------------------\n   ---------------------------------------------------\n   ---------------------------------------------------\n   ---------------------------------------------------\n                THIS IS NOW\n                SingleWeakening.thy\n   ---------------------------------------------------\n   ---------------------------------------------------\n   ---------------------------------------------------\n   --------------------------------------------------- *)\n\n\n(* Constructing the rule set we will use.  It contains all axioms, but only a subset\n   of the possible logical rules. *)\nlemma ruleSet:\nassumes \"R' \\<subseteq> upRules\"\n    and \"R = Ax \\<union> R'\"\n    and \"(Ps,C) \\<in> R*\"\nshows \"\\<exists> S r. extendRule S r = (Ps,C) \\<and> (r \\<in> R' \\<or> r \\<in> Ax)\"\nproof-\nfrom `(Ps,C) \\<in> R*` have \"\\<exists> S r. extendRule S r = (Ps,C) \\<and> r \\<in> R\" by (cases) auto\nthen obtain S r where \"(Ps,C) = extendRule S r\" and \"r \\<in> R\" apply auto \n                by (drule_tac x=S in meta_spec,drule_tac x=a in meta_spec, drule_tac x=b in meta_spec) auto\nmoreover from `r \\<in> R` and `R = Ax \\<union> R'` have \"r \\<in> Ax \\<or> r \\<in> R'\" by blast\nultimately show ?thesis by (rule_tac x=S in exI,rule_tac x=r in exI) (auto)\nqed\n\nlemma dpWeak:\nassumes a:\"(\\<Gamma> \\<Rightarrow>* E,n) \\<in> derivable R*\"\n   and  b: \"R' \\<subseteq> upRules\"\n   and  c: \"R = Ax \\<union> R'\" \nshows \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,n) \\<in> derivable R*\"\nusing a\nproof (induct n arbitrary: \\<Gamma> E rule:nat_less_induct)\ncase (1 n \\<Gamma> E)\nthen have IH: \"\\<forall>m<n. \\<forall> \\<Gamma> E. ( \\<Gamma> \\<Rightarrow>* E, m) \\<in> derivable R* \\<longrightarrow> ( \\<Gamma> + \\<Gamma>' \\<Rightarrow>* E, m) \\<in> derivable R*\" \n      and a': \"( \\<Gamma> \\<Rightarrow>* E, n) \\<in> derivable R*\" by auto\nshow ?case\nproof (cases n)\ncase 0\n then have \"(\\<Gamma> \\<Rightarrow>* E,0) \\<in> derivable R*\" using a' by simp\n then have \"([], \\<Gamma> \\<Rightarrow>* E) \\<in> R*\" by (cases) auto\n then obtain  r S where \"r \\<in> R\" and split:\"extendRule S r = ([],\\<Gamma> \\<Rightarrow>* E)\" \n      by (rule extRules.cases) auto\n then obtain c where \"r = ([],c)\" by (cases r) (auto simp add:extendRule_def)\n with `r \\<in> R` have \"r \\<in> Ax \\<or> r \\<in> upRules\" using b c by auto\n with `r = ([],c)` have \"r \\<in> Ax\" by (auto) (rule upRules.cases,auto)                                 \n with `r = ([],c)` obtain i where \"c = (\\<LM>At i\\<RM> \\<Rightarrow>* At i) \\<or> c = (\\<LM>ff\\<RM> \\<Rightarrow>* Em)\"\n      using characteriseAx[where r=r] by auto\n moreover\n    {assume \"c = (\\<LM>At i\\<RM> \\<Rightarrow>* At i)\"\n     then have \"extend S (\\<LM>At i\\<RM> \\<Rightarrow>* At i) = (\\<Gamma> \\<Rightarrow>* At i)\" and \"At i = E\" using split and `r = ([],c)`\n          by (auto simp add:extendRule_def extend_def)\n     then have \"At i :# \\<Gamma>\" using extendID by auto\n     then have \"At i :# \\<Gamma> + \\<Gamma>'\" by auto\n     then have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,0) \\<in> derivable R*\" \n          using c and containID[where \\<Gamma>=\"\\<Gamma>+\\<Gamma>'\" and R=R and i=i] and `At i = E` by auto\n    }\n moreover\n    {assume \"c = (\\<LM>ff\\<RM> \\<Rightarrow>* Em)\"\n     then have \"extend S (\\<LM>ff\\<RM> \\<Rightarrow>* Em) = (\\<Gamma> \\<Rightarrow>* E)\" using split and `r = ([],c)`\n          by (auto simp add:extendRule_def extend_def)\n     then have \"ff :# \\<Gamma>\" using extendFalsum by auto\n     then have \"ff :# \\<Gamma> + \\<Gamma>'\" by auto\n     then have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,0) \\<in> derivable R*\" \n          using c and containFalsum[where \\<Gamma>=\"\\<Gamma>+\\<Gamma>'\" and R=R] by auto\n    }\n ultimately show \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,n) \\<in> derivable R*\" using `n=0` by auto\nnext\ncase (Suc n')\n then have \"(\\<Gamma> \\<Rightarrow>* E, n'+1) \\<in> derivable R*\" using a' by simp\n then obtain Ps where f:\"Ps \\<noteq> []\"\n                  and g:\"(Ps, \\<Gamma> \\<Rightarrow>* E) \\<in> R*\" \n                  and h:\"\\<forall> p \\<in> set Ps. \\<exists> m\\<le>n'. (p,m) \\<in> derivable R*\" \n      using characteriseLast[where C=\"\\<Gamma> \\<Rightarrow>* E\" and m=n' and R=\"R*\"] by auto\n from g c obtain S r where \"r \\<in> R\" and \"(r \\<in> Ax \\<or> r \\<in> R') \\<and> extendRule S r = (Ps, \\<Gamma> \\<Rightarrow>* E)\" by (cases) auto\n with b have as: \"(r \\<in> Ax \\<or> r \\<in> upRules) \\<and> extendRule S r = (Ps, \\<Gamma> \\<Rightarrow>* E)\" by auto\n from as f have \"fst r \\<noteq> []\" by (auto simp add:extendRule_def map_is_Nil_conv)\n with as have \"r \\<in> upRules\" apply (cases r,auto) by (rule Ax.cases) auto\n moreover obtain ps c where \"r = (ps,c)\" by (cases r) auto\n ultimately have \"(ps,c) \\<in> upRules\" by simp\n obtain \\<Gamma>1 \\<delta> where \"S = (\\<Gamma>1 \\<Rightarrow>* \\<delta>)\" by (cases S) auto\n with h as `r = (ps,c)` have pms: \"\\<forall> p \\<in> set ps. \\<exists> m\\<le>n'. (extend (\\<Gamma>1 \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\"\n      by(auto simp add:extendRule_def)\n have \"\\<forall> p \\<in> set ps. \\<exists> m\\<le>n'. (extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\"\n      proof-\n      {fix p\n       assume \"p \\<in> set ps\"\n       with pms obtain m where \"m\\<le>n'\" and aa: \"(extend (\\<Gamma>1 \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\" by auto\n       moreover obtain \\<Gamma>2 \\<delta>' where eq:\"p = (\\<Gamma>2 \\<Rightarrow>* \\<delta>')\" by (cases p) auto\n       have \"\\<delta>' = Em \\<or> \\<delta>' \\<noteq> Em\" by blast\n       moreover\n          {assume \"\\<delta>' = Em\"\n           then have \"extend (\\<Gamma>1 \\<Rightarrow>* \\<delta>) p = (\\<Gamma>1 + \\<Gamma>2 \\<Rightarrow>* \\<delta>)\" using eq by (auto simp add:extend_def)\n           then have \"(\\<Gamma>1 + \\<Gamma>2 \\<Rightarrow>* \\<delta>,m) \\<in> derivable R*\" using aa by auto\n           then have \"(\\<Gamma>1 + \\<Gamma>2 + \\<Gamma>' \\<Rightarrow>* \\<delta>, m) \\<in> derivable R*\" using IH and `n = Suc n'` and `m\\<le>n'`\n                apply- apply (drule_tac x=m in spec) by auto\n           then have \"(extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\" using eq and `\\<delta>' = Em`\n                by (auto simp add:extend_def union_ac)\n          }\n       moreover\n          {assume \"\\<delta>' \\<noteq> Em\"\n           then have \"extend (\\<Gamma>1 \\<Rightarrow>* \\<delta>) p = (\\<Gamma>1 + \\<Gamma>2 \\<Rightarrow>* \\<delta>')\" using eq by (auto simp add:extend_def)\n           then have \"(\\<Gamma>1 + \\<Gamma>2 \\<Rightarrow>* \\<delta>',m) \\<in> derivable R*\" using aa by auto\n           then have \"(\\<Gamma>1 + \\<Gamma>2 + \\<Gamma>' \\<Rightarrow>* \\<delta>', m) \\<in> derivable R*\" using IH and `n = Suc n'` and `m\\<le>n'`\n                apply- apply (drule_tac x=m in spec) by auto\n           then have \"(extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\" using eq and `\\<delta>' \\<noteq> Em`\n                by (auto simp add:extend_def union_ac)\n          }\n       ultimately have \"(extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\" by blast\n       then have \"\\<exists> m\\<le>n'. (extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\" using `m\\<le>n'` by auto\n       }\n       then show ?thesis by auto\n       qed\n then have \"\\<forall> p \\<in> set (fst (extendRule (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) r)).\n            \\<exists> m\\<le>n'. (p,m) \\<in> derivable R*\" using `r = (ps,c)` by (auto simp add:extendRule_def)\n moreover have \"extendRule (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) r \\<in> R*\" \n          using `r \\<in> upRules` and `r \\<in> R` by auto\n moreover from `S = (\\<Gamma>1 \\<Rightarrow>* \\<delta>)` and as have \"extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) (snd r) = (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E)\"\n          by (auto simp add:extendRule_def extend_def union_ac)\n ultimately have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,n'+1) \\<in> derivable R*\"\n          using derivable.step[where r=\"extendRule (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) r\" and R=\"R*\" and m=\"n'\"]\n          and `fst r \\<noteq> []` by (cases r) (auto simp add:map_is_Nil_conv extendRule_def)\n then show \"( \\<Gamma> + \\<Gamma>' \\<Rightarrow>* E, n) \\<in> derivable R*\" using `n = Suc n'` by auto\n qed\nqed\n\n(*>*)\ntext{*  \n\\noindent Given this, it is possible to have right weakening, where we overwrite the empty formula if it appears as the succedent of the root of a derivation:\n*}\nlemma dpWeakR:\nassumes (*<*)a:(*>*)\"(\\<Gamma> \\<Rightarrow>* Em,n) \\<in> derivable R*\"\nand  (*<*)b:(*>*) \"R' \\<subseteq> upRules\"\nand  (*<*)c:(*>*) \"R = Ax \\<union> R'\" \nshows \"(\\<Gamma> \\<Rightarrow>* C,n) \\<in> derivable R*\"   -- \"Proof omitted\"\n(*<*)\nusing a\nproof (induct n arbitrary: \\<Gamma> rule:nat_less_induct)\ncase (1 n \\<Gamma>)\nthen have IH: \"\\<forall>m<n. \\<forall> \\<Gamma>. ( \\<Gamma> \\<Rightarrow>* Em, m) \\<in> derivable R* \\<longrightarrow> ( \\<Gamma> \\<Rightarrow>* C, m) \\<in> derivable R*\" \n      and a': \"( \\<Gamma> \\<Rightarrow>* Em, n) \\<in> derivable R*\" by auto\nshow ?case\nproof (cases n)\ncase 0\n then have \"(\\<Gamma> \\<Rightarrow>* Em,0) \\<in> derivable R*\" using a' by simp\n then have \"([], \\<Gamma> \\<Rightarrow>* Em) \\<in> R*\" by (cases) auto\n then obtain  r S where \"r \\<in> R\" and split:\"extendRule S r = ([],\\<Gamma> \\<Rightarrow>* Em)\" \n      by (rule extRules.cases) auto\n then obtain c where \"r = ([],c)\" by (cases r) (auto simp add:extendRule_def)\n with `r \\<in> R` have \"r \\<in> Ax \\<or> r \\<in> upRules\" using b c by auto\n with `r = ([],c)` have \"r \\<in> Ax\" by (auto) (rule upRules.cases,auto)                                 \n with `r = ([],c)` obtain i where \"c = (\\<LM>At i\\<RM> \\<Rightarrow>* At i) \\<or> c = (\\<LM>ff\\<RM> \\<Rightarrow>* Em)\"\n      using characteriseAx[where r=r] by auto\n moreover\n    {assume \"c = (\\<LM>At i\\<RM> \\<Rightarrow>* At i)\"\n     with split and `r = ([],c)` have \"(\\<Gamma> \\<Rightarrow>* C,0) \\<in> derivable R*\" by (auto simp add:extendRule_def extend_def)\n    }\n moreover\n    {assume \"c = (\\<LM>ff\\<RM> \\<Rightarrow>* Em)\"\n     then have \"extend S (\\<LM>ff\\<RM> \\<Rightarrow>* Em) = (\\<Gamma> \\<Rightarrow>* Em)\" using split and `r = ([],c)`\n          by (auto simp add:extendRule_def extend_def)\n     then have \"ff :# \\<Gamma>\" using extendFalsum by auto\n     then have \"(\\<Gamma> \\<Rightarrow>* C,0) \\<in> derivable R*\" \n          using c and containFalsum[where \\<Gamma>=\\<Gamma> and R=R] by auto\n    }\n ultimately show \"(\\<Gamma> \\<Rightarrow>* C,n) \\<in> derivable R*\" using `n=0` by auto\nnext\ncase (Suc n')\n then have \"(\\<Gamma> \\<Rightarrow>* Em, n'+1) \\<in> derivable R*\" using a' by simp\n then obtain Ps where f:\"Ps \\<noteq> []\"\n                  and g:\"(Ps, \\<Gamma> \\<Rightarrow>* Em) \\<in> R*\" \n                  and h:\"\\<forall> p \\<in> set Ps. \\<exists> m\\<le>n'. (p,m) \\<in> derivable R*\" \n      using characteriseLast[where C=\"\\<Gamma> \\<Rightarrow>* Em\" and m=n' and R=\"R*\"] by auto\n from g c obtain S r where \"r \\<in> R\" and split: \"(r \\<in> Ax \\<or> r \\<in> R') \\<and> extendRule S r = (Ps, \\<Gamma> \\<Rightarrow>* Em)\" by (cases) auto\n with b have as: \"(r \\<in> Ax \\<or> r \\<in> upRules) \\<and> extendRule S r = (Ps, \\<Gamma> \\<Rightarrow>* Em)\" by auto\n from as f have \"fst r \\<noteq> []\" by (auto simp add:extendRule_def map_is_Nil_conv)\n with as have \"r \\<in> upRules\" apply (cases r,auto) by (rule Ax.cases) auto\n moreover obtain ps c where \"r = (ps,c)\" by (cases r) auto\n ultimately have \"(ps,c) \\<in> upRules\" by simp\n then obtain F Fs where \"c = (\\<LM>Compound F Fs\\<RM> \\<Rightarrow>* Em) \\<or> c = (\\<Empt> \\<Rightarrow>* Compound F Fs)\" by (rule upRules.cases) auto\n moreover\n    {assume \"c = (\\<Empt> \\<Rightarrow>* Compound F Fs)\"\n     with `r = (ps,c)` and split have \"(\\<Gamma> \\<Rightarrow>* C,n'+1) \\<in> derivable R*\" by (auto simp add:extendRule_def extend_def)\n    }\n moreover\n    {assume \"c = (\\<LM> Compound F Fs \\<RM> \\<Rightarrow>* Em)\"\n     moreover obtain \\<Gamma>1 \\<delta> where \"S = (\\<Gamma>1 \\<Rightarrow>* \\<delta>)\" by (cases S) auto\n     ultimately have \"\\<delta> = Em\" using split and `r= (ps,c)` by (auto simp add:extendRule_def extend_def)\n     then have \"S = (\\<Gamma>1 \\<Rightarrow>* Em)\" using `S = (\\<Gamma>1 \\<Rightarrow>* \\<delta>)` by simp\n     with h as `r = (ps,c)` have pms: \"\\<forall> p \\<in> set ps. \\<exists> m\\<le>n'. (extend (\\<Gamma>1 \\<Rightarrow>* Em) p,m) \\<in> derivable R*\"\n          by(auto simp add:extendRule_def)\n     have \"\\<forall> p \\<in> set ps. \\<exists> m\\<le>n'. (extend (\\<Gamma>1  \\<Rightarrow>* C) p,m) \\<in> derivable R*\"\n          proof-\n          {fix p\n           assume \"p \\<in> set ps\"\n           with pms obtain m where \"m\\<le>n'\" and aa: \"(extend (\\<Gamma>1 \\<Rightarrow>* Em) p,m) \\<in> derivable R*\" by auto\n           moreover obtain \\<Gamma>2 \\<delta>' where eq:\"p = (\\<Gamma>2 \\<Rightarrow>* \\<delta>')\" by (cases p) auto\n           have \"\\<delta>' = Em \\<or> \\<delta>' \\<noteq> Em\" by blast\n           moreover\n              {assume \"\\<delta>' = Em\"\n               then have \"extend (\\<Gamma>1 \\<Rightarrow>* Em) p = (\\<Gamma>1 + \\<Gamma>2 \\<Rightarrow>* Em)\" using eq by (auto simp add:extend_def)\n               then have \"(\\<Gamma>1 + \\<Gamma>2 \\<Rightarrow>* Em,m) \\<in> derivable R*\" using aa by auto\n               then have \"(\\<Gamma>1 + \\<Gamma>2 \\<Rightarrow>* C, m) \\<in> derivable R*\" using IH and `n = Suc n'` and `m\\<le>n'`\n                    apply- apply (drule_tac x=m in spec) by auto\n               then have \"(extend (\\<Gamma>1  \\<Rightarrow>* C) p,m) \\<in> derivable R*\" using eq and `\\<delta>' = Em`\n                    by (auto simp add:extend_def union_ac)\n              }\n           moreover\n              {assume \"\\<delta>' \\<noteq> Em\"\n               then have \"extend (\\<Gamma>1 \\<Rightarrow>* Em) p = (\\<Gamma>1 + \\<Gamma>2 \\<Rightarrow>* \\<delta>')\" using eq by (auto simp add:extend_def)\n               then have \"(\\<Gamma>1 + \\<Gamma>2 \\<Rightarrow>* \\<delta>',m) \\<in> derivable R*\" using aa by auto\n               moreover have \"extend (\\<Gamma>1 \\<Rightarrow>* C) p = (\\<Gamma>1 + \\<Gamma>2 \\<Rightarrow>* \\<delta>')\" using eq and `\\<delta>' \\<noteq> Em` by (auto simp add:extend_def)\n               ultimately have \"(extend (\\<Gamma>1 \\<Rightarrow>* C) p,m) \\<in> derivable R*\" by simp\n              }\n           ultimately have \"(extend (\\<Gamma>1  \\<Rightarrow>* C) p,m) \\<in> derivable R*\" by blast\n           then have \"\\<exists> m\\<le>n'. (extend (\\<Gamma>1  \\<Rightarrow>* C) p,m) \\<in> derivable R*\" using `m\\<le>n'` by auto\n           }\n           then show ?thesis by auto\n           qed\n     then have \"\\<forall> p \\<in> set (fst (extendRule (\\<Gamma>1  \\<Rightarrow>* C) r)).\n                \\<exists> m\\<le>n'. (p,m) \\<in> derivable R*\" using `r = (ps,c)` by (auto simp add:extendRule_def)\n     moreover have \"extendRule (\\<Gamma>1  \\<Rightarrow>* C) r \\<in> R*\" \n              using `r \\<in> upRules` and `r \\<in> R` by auto\n     moreover from `S = (\\<Gamma>1 \\<Rightarrow>* Em)` and as have \"extend (\\<Gamma>1  \\<Rightarrow>* C) (snd r) = (\\<Gamma> \\<Rightarrow>* C)\"\n              by (auto simp add:extendRule_def extend_def union_ac)\n     ultimately have \"(\\<Gamma> \\<Rightarrow>* C,n'+1) \\<in> derivable R*\"\n              using derivable.step[where r=\"extendRule (\\<Gamma>1 \\<Rightarrow>* C) r\" and R=\"R*\" and m=\"n'\"]\n              and `fst r \\<noteq> []` by (cases r) (auto simp add:map_is_Nil_conv extendRule_def)\n    }\n ultimately show \"( \\<Gamma> \\<Rightarrow>* C, n) \\<in> derivable R*\" using `n = Suc n'` by auto\n qed\nqed\n\n\n\n(* ---------------------------------------------------\n   ---------------------------------------------------\n   ---------------------------------------------------\n   ---------------------------------------------------\n                THIS IS NOW\n                SingleInvertible.thy\n   ---------------------------------------------------\n   ---------------------------------------------------\n   ---------------------------------------------------\n   --------------------------------------------------- *)\n(*>*)\ntext{* \n\\noindent Of course, if $C = Em$, then the above lemma is trivial.  The burden is on the user not to ``use'' the empty formula as a normal formula.  An invertibility lemma can then be formalised:\n*}\n\nlemma rightInvertible:\n(*<*)fixes \\<Gamma> :: \"'a form multiset\"(*>*)\n\nassumes (*<*)rules:(*>*) \"R' \\<subseteq> upRules \\<and> R = Ax \\<union> R'\"\nand   (*<*)a:(*>*) \"(\\<Gamma> \\<Rightarrow>* Compound F Fs,n) \\<in> derivable R*\"\nand   (*<*)b:(*>*) \"\\<forall> r' \\<in> R. rightPrincipal r' (Compound F Fs) \\<longrightarrow> (\\<Gamma>' \\<Rightarrow>* E) \\<in> set (fst r')\"\nand (*<*)nonEm:(*>*) \"E \\<noteq> Em\"\nshows \"\\<exists> m\\<le>n. (\\<Gamma> +\\<Gamma>' \\<Rightarrow>* E,m) \\<in> derivable R*\"\n\n(*<*)\nusing assms\nproof (induct n arbitrary:\\<Gamma> rule:nat_less_induct)\n case (1 n \\<Gamma>)\n then have IH:\"\\<forall>m<n. \\<forall>\\<Gamma>. ( \\<Gamma> \\<Rightarrow>* Compound F Fs, m) \\<in> derivable R* \\<longrightarrow>\n              (\\<forall>r' \\<in> R. rightPrincipal r' (Compound F Fs) \\<longrightarrow> ( \\<Gamma>' \\<Rightarrow>* E) \\<in> set (fst r')) \\<longrightarrow>\n              (\\<exists>m'\\<le>m. ( \\<Gamma> + \\<Gamma>' \\<Rightarrow>* E, m') \\<in> derivable R*)\" \n     and a': \"(\\<Gamma> \\<Rightarrow>* Compound F Fs,n) \\<in> derivable R*\" \n     and b': \"\\<forall> r' \\<in> R. rightPrincipal r' (Compound F Fs) \\<longrightarrow> (\\<Gamma>' \\<Rightarrow>* E) \\<in> set (fst r')\"\n       by auto\n show ?case\n proof (cases n)\n     case 0\n     then have \"(\\<Gamma> \\<Rightarrow>* Compound F Fs,0) \\<in> derivable R*\" using a' by simp\n     then have \"([],\\<Gamma> \\<Rightarrow>* Compound F Fs) \\<in> R*\" by (cases) (auto)\n     then have \"\\<exists> r S. extendRule S r = ([],\\<Gamma> \\<Rightarrow>* Compound F Fs) \\<and> (r \\<in> Ax \\<or> r \\<in> R')\"\n          using rules and ruleSet[where R'=R' and R=R and Ps=\"[]\" and C=\"\\<Gamma> \\<Rightarrow>* Compound F Fs\"] by auto\n     then obtain r S where \"extendRule S r = ([],\\<Gamma> \\<Rightarrow>* Compound F Fs)\" and \"r \\<in> Ax \\<or> r \\<in> R'\" by auto\n      moreover\n      {assume \"r \\<in> Ax\"\n       then have \"r = ([], \\<LM> ff \\<RM> \\<Rightarrow>* Em)\" \n            using characteriseAx[where r=r] and `extendRule S r = ([],\\<Gamma> \\<Rightarrow>* Compound F Fs)` \n            by (auto simp add:extendRule_def extend_def)\n       with `extendRule S r = ([],\\<Gamma> \\<Rightarrow>* Compound F Fs)`\n            have \"extend S (\\<LM> ff \\<RM> \\<Rightarrow>* Em) = (\\<Gamma> \\<Rightarrow>* Compound F Fs)\"\n            using extendRule_def[where R=\"([],\\<LM>ff\\<RM>\\<Rightarrow>* Em)\" and forms=S] by auto\n       then have \"ff :# \\<Gamma>\" using extendFalsum[where S=S and \\<Gamma>=\\<Gamma> and \\<Delta>=\"Compound F Fs\"] by auto\n       then have \"ff :# \\<Gamma> + \\<Gamma>'\" by auto\n       then have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,0) \\<in> derivable R*\" using rules\n            and containFalsum[where \\<Gamma>=\"\\<Gamma> + \\<Gamma>'\" and R=R] by auto\n       then have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,0) \\<in> derivable R*\" by blast\n      }\n      moreover\n      {assume \"r \\<in> R'\"\n       then have \"r \\<in> upRules\" using rules by auto\n       then have \"\\<exists> Ps C. Ps \\<noteq> [] \\<and> r = (Ps,C)\"\n            proof-\n            obtain x y where \"r = (x,y)\" by (cases r)\n            with `r \\<in> upRules` have \"(x,y) \\<in> upRules\" by simp\n            then obtain Ps where \"(Ps :: 'a sequent list) \\<noteq> []\" and \"x=Ps\" by (cases) (auto)\n            with `r = (x,y)` have \"r = (Ps, y)\" by simp\n            then show \"\\<exists> Ps C. Ps \\<noteq> [] \\<and> r = (Ps,C)\" using `Ps \\<noteq> []` by blast\n            qed\n       then obtain Ps C where \"Ps \\<noteq> []\" and \"r = (Ps,C)\" by auto\n       moreover from `extendRule S r = ([], \\<Gamma> \\<Rightarrow>* Compound F Fs)` have \"\\<exists> S. r = ([],S)\"\n            using extendRule_def[where forms=S and R=r] by (cases r) (auto)\n       then obtain S where \"r = ([],S)\" by blast\n       ultimately have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,0) \\<in> derivable R*\" using rules by simp\n       }\n       ultimately show \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,m) \\<in> derivable R*\" using `n=0` by blast\n next\n     case (Suc n')\n     then have \"(\\<Gamma> \\<Rightarrow>* Compound F Fs,n'+1) \\<in> derivable R*\" using a' by simp\n     then obtain Ps where \"(Ps, \\<Gamma> \\<Rightarrow>* Compound F Fs) \\<in> R*\" and \n                          \"Ps \\<noteq> []\" and \n                          derv: \"\\<forall> p \\<in> set Ps. \\<exists> n\\<le>n'. (p,n) \\<in> derivable R*\"\n          using characteriseLast[where C=\"\\<Gamma> \\<Rightarrow>* Compound F Fs\" and m=n' and R=\"R*\"] by auto\n     then have \"\\<exists> r S. (r \\<in> Ax \\<or> r \\<in> R') \\<and> extendRule S r = (Ps, \\<Gamma> \\<Rightarrow>* Compound F Fs)\"\n          using rules and ruleSet[where R'=R' and R=R and Ps=Ps and C=\"\\<Gamma> \\<Rightarrow>* Compound F Fs\"] by auto\n     then obtain r S where \"r \\<in> Ax \\<or> r \\<in> R'\" and ext: \"extendRule S r = (Ps, \\<Gamma> \\<Rightarrow>* Compound F Fs)\" by auto\n     moreover\n        {assume \"r \\<in> Ax\"\n         then have \"fst r = []\" apply (cases r) by (rule Ax.cases) auto\n         moreover obtain x y where \"r = (x,y)\" by (cases r)\n         then have \"x \\<noteq> []\" using `Ps \\<noteq> []` and ext\n                            and extendRule_def[where forms=S and R=r]\n                            and extend_def[where forms=S and seq=\"snd r\"] by auto\n         ultimately have \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,m) \\<in> derivable R*\"\n              using `r=(x,y)` by auto\n        }\n     moreover\n        {assume \"r \\<in> R'\"\n         obtain ps c where \"r = (ps,c)\" by (cases r) auto\n         then have \"r \\<in> upRules\" using rules and `r \\<in> R'` by auto\n         then have \"\\<exists> T Ts. c = (\\<LM>Compound T Ts\\<RM> \\<Rightarrow>* Em) \\<or> c = (\\<Empt> \\<Rightarrow>* Compound T Ts)\" using `r=(ps,c)`\n              and upRuleCharacterise[where Ps=ps and C=c] by auto\n         then obtain T Ts where \"c = (\\<LM>Compound T Ts\\<RM> \\<Rightarrow>* Em) \\<or> c = (\\<Empt> \\<Rightarrow>* Compound T Ts)\" by blast\n         moreover\n            {assume \"c = (\\<Empt> \\<Rightarrow>* Compound T Ts)\"\n             with ext have \"Compound T Ts = Compound F Fs\"\n                  using `r = (ps,c)` by (auto simp add:extendRule_def extend_def)\n             then have \"rightPrincipal r (Compound F Fs)\" using `c = (\\<Empt> \\<Rightarrow>* Compound T Ts)` and `r = (ps,c)`\n                  by auto\n             then have \"(\\<Gamma>' \\<Rightarrow>* E) \\<in> set ps\" using b' and `r = (ps,c)` and `r \\<in> R'` and rules\n                  by auto\n             then have \"extend S (\\<Gamma>' \\<Rightarrow>* E) \\<in> set Ps\" using `extendRule S r = (Ps,\\<Gamma> \\<Rightarrow>* Compound F Fs)`\n                  and `r = (ps,c)` by (simp add:extendContain)\n             moreover from `rightPrincipal r (Compound F Fs)` have \"c = (\\<Empt> \\<Rightarrow>* Compound F Fs)\" \n                  using `r = (ps,c)` by (cases) auto\n             with ext have \"antec S = \\<Gamma>\"\n                  using `r = (ps,c)` by (auto simp add:extendRule_def extend_def)\n             ultimately have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E) \\<in> set Ps\" using nonEm by (simp add:extend_def)\n             then have \"\\<exists> m\\<le>n'. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,m) \\<in> derivable R*\"\n                  using `\\<forall> p \\<in> set Ps. \\<exists> n\\<le>n'. (p,n) \\<in> derivable R*` by auto\n             then have \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,m) \\<in> derivable R*\" using `n = Suc n'`\n                  by (auto,rule_tac x=m in exI) (simp)\n            }\n         moreover\n            {assume \"c = (\\<LM>Compound T Ts\\<RM> \\<Rightarrow>* Em)\"\n             with ext and `r = (ps,c)`\n                  have \"Compound T Ts :# \\<Gamma>\" by (auto simp add:extendRule_def extend_def)\n             then have \"\\<exists> \\<Gamma>1. \\<Gamma> = \\<Gamma>1 \\<oplus> Compound T Ts\"\n                  by (rule_tac x=\"\\<Gamma> \\<ominus> Compound T Ts\" in exI) (auto simp add:multiset_eq_iff)\n             then obtain \\<Gamma>1 where \"\\<Gamma> = \\<Gamma>1 \\<oplus> Compound T Ts\" by auto\n             moreover from `c = (\\<LM>Compound T Ts\\<RM> \\<Rightarrow>* Em)` and `r = (ps,c)` and ext\n                  have \"succ S = Compound F Fs\"\n                  by (auto simp add:extendRule_def extend_def)\n             ultimately have \"S = (\\<Gamma>1 \\<Rightarrow>* Compound F Fs)\" using ext\n                  and `r = (ps,c)` and `c = (\\<LM>Compound T Ts\\<RM> \\<Rightarrow>* Em)` apply (auto simp add:extendRule_def extend_def)\n                  by (cases S) auto\n             with derv have pms: \"\\<forall> p \\<in> set ps. \\<exists> m\\<le>n'. (extend (\\<Gamma>1 \\<Rightarrow>* Compound F Fs) p,m) \\<in> derivable R*\" using ext\n                  and `r= (ps,c)` by (auto simp add:extendRule_def)\n             have \"\\<forall> p \\<in> set ps. \\<exists> m\\<le>n'. (extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* E) p,m) \\<in> derivable R*\"\n                 proof-\n                 {fix p\n                  assume \"p \\<in> set ps\"\n                  obtain \\<Gamma>i \\<delta>i where p: \"p = (\\<Gamma>i \\<Rightarrow>* \\<delta>i)\" by (cases p) auto\n                  have \"\\<delta>i = Em \\<or> \\<delta>i \\<noteq> Em\" by blast\n                  moreover\n                     {assume \"\\<delta>i = Em\"\n                      then have \"extend (\\<Gamma>1 \\<Rightarrow>* Compound F Fs) p = (\\<Gamma>1 + \\<Gamma>i \\<Rightarrow>* Compound F Fs)\" using p\n                           by (auto simp add:extend_def)\n                      with pms obtain m where \"m \\<le>n'\" and \"(\\<Gamma>1 + \\<Gamma>i \\<Rightarrow>* Compound F Fs,m) \\<in> derivable R*\"\n                           using `p \\<in> set ps` by auto\n                      with IH and `n = Suc n'` and b' have \"\\<exists> m'\\<le>m. (\\<Gamma>1 + \\<Gamma>i + \\<Gamma>' \\<Rightarrow>* E,m') \\<in> derivable R*\"\n                           by auto\n                      then have \"\\<exists> m\\<le>n'. (extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* E) p,m) \\<in> derivable R*\" using `m\\<le>n'`\n                           and p and `\\<delta>i = Em` apply (auto simp add:extend_def union_ac) \n                           by (rule_tac x=\"m'\" in exI) auto\n                     }\n                  moreover\n                     {assume \"\\<delta>i \\<noteq> Em\"\n                      then have \"extend (\\<Gamma>1 \\<Rightarrow>* Compound F Fs) p = (\\<Gamma>1 + \\<Gamma>i \\<Rightarrow>* \\<delta>i)\" using p\n                           by (auto simp add:extend_def)\n                      with pms obtain m where \"m\\<le>n'\" and \"(\\<Gamma>1 + \\<Gamma>i \\<Rightarrow>* \\<delta>i,m) \\<in> derivable R*\"\n                           using `p \\<in> set ps` by auto\n                      then have \"(\\<Gamma>1 + \\<Gamma>i + \\<Gamma>' \\<Rightarrow>* \\<delta>i,m) \\<in> derivable R*\" using rules \n                           and dpWeak[where \\<Gamma>=\"\\<Gamma>1 + \\<Gamma>i\" and E=\"\\<delta>i\" and n=m and R=R and R'=R'] by auto\n                      then have \"\\<exists> m\\<le>n'. (extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* E) p,m) \\<in> derivable R*\" using `m\\<le>n'`\n                           and p and `\\<delta>i \\<noteq> Em` by (auto simp add:extend_def union_ac)\n                     } \n                  ultimately have \"\\<exists> m\\<le>n'. (extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* E) p, m) \\<in> derivable R*\" by blast\n                 }\n                 thus ?thesis by auto\n                 qed\n             then have \"\\<forall> p \\<in> set (fst (extendRule (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* E) r)).\n                          \\<exists> m\\<le>n'. (p,m) \\<in> derivable R*\" using `r = (ps,c)` by (auto simp add:extendRule_def)\n             moreover have \"extendRule (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* E) r \\<in> R*\" using `r \\<in> R'` and rules by auto\n             moreover from `S = (\\<Gamma>1 \\<Rightarrow>* Compound F Fs)` and ext and `c = (\\<LM>Compound T Ts\\<RM> \\<Rightarrow>* Em)`\n                 and `\\<Gamma> = \\<Gamma>1 \\<oplus> Compound T Ts` and `r = (ps,c)`\n                 have \"extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* E) (snd r) = (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E)\" by (auto simp add:extend_def union_ac)\n             moreover from ext and `r = (ps,c)` and `Ps \\<noteq> []` have \"fst r \\<noteq> []\" by (auto simp add:extendRule_def)\n             ultimately have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,n'+1) \\<in> derivable R*\" using\n                 derivable.step[where r=\"extendRule (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* E) r\" and m=\"n'\" and R=\"R*\"] \n                 by (cases r) (auto simp add:map_is_Nil_conv extendRule_def)\n             then have \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,m) \\<in> derivable R*\" using `n = Suc n'` by auto\n            }\n         ultimately have \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,m) \\<in> derivable R*\" by blast         \n        }\n      ultimately show \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* E,m) \\<in> derivable R*\" by blast\n   qed\nqed\n(*>*)\n\nlemma leftInvertible:\n(*<*)fixes \\<Gamma> :: \"'a form multiset\"(*>*)\n\nassumes (*<*)rules:(*>*) \"R' \\<subseteq> upRules \\<and> R = Ax \\<union> R'\"\nand   (*<*)a:(*>*) \"(\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>,n) \\<in> derivable R*\"\nand   (*<*)b:(*>*) \"\\<forall> r' \\<in> R. leftPrincipal r' (Compound F Fs) \\<longrightarrow> (\\<Gamma>' \\<Rightarrow>* Em) \\<in> set (fst r')\"\nshows \"\\<exists> m\\<le>n. (\\<Gamma> +\\<Gamma>' \\<Rightarrow>* \\<delta>,m) \\<in> derivable R*\"\n (*<*)\nusing assms\nproof (induct n arbitrary:\\<Gamma> \\<delta> rule:nat_less_induct)\n case (1 n \\<Gamma> \\<delta>)\n then have IH:\"\\<forall>m<n. \\<forall>\\<Gamma> \\<delta>. ( \\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>, m) \\<in> derivable R* \\<longrightarrow>\n              (\\<forall>r' \\<in> R. leftPrincipal r' (Compound F Fs) \\<longrightarrow> ( \\<Gamma>' \\<Rightarrow>* Em) \\<in> set (fst r')) \\<longrightarrow>\n              (\\<exists>m'\\<le>m. ( \\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>, m') \\<in> derivable R*)\" \n     and a': \"(\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>,n) \\<in> derivable R*\" \n     and b': \"\\<forall> r' \\<in> R. leftPrincipal r' (Compound F Fs) \\<longrightarrow> (\\<Gamma>' \\<Rightarrow>* Em) \\<in> set (fst r')\"\n       by auto\n show ?case\n proof (cases n)\n     case 0\n     then have \"(\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>, 0) \\<in> derivable R*\" using a' by simp\n     then have \"([],\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>) \\<in> R*\" by (cases) (auto)\n     then have \"\\<exists> r S. extendRule S r = ([],\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>) \\<and> (r \\<in> Ax \\<or> r \\<in> R')\"\n          using rules and ruleSet[where R'=R' and R=R and Ps=\"[]\" and C=\"\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>\"] by auto\n     then obtain r S where \"extendRule S r = ([],\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)\" and \"r \\<in> Ax \\<or> r \\<in> R'\" by auto\n     moreover\n      {assume \"r \\<in> Ax\"\n       then obtain i where \"r = ([], \\<LM> ff \\<RM> \\<Rightarrow>* Em) \\<or> r = ([], \\<LM>At i\\<RM> \\<Rightarrow>* At i)\" \n            using characteriseAx[where r=r] and `extendRule S r = ([],\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)` \n            by (auto simp add:extendRule_def extend_def)\n       moreover\n          {assume \"r = ([], \\<LM>ff\\<RM> \\<Rightarrow>* Em)\"\n           with `extendRule S r = ([],\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)`\n                have \"extend S (\\<LM> ff \\<RM> \\<Rightarrow>* Em) = (\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)\"\n                using extendRule_def[where R=\"([],\\<LM>ff\\<RM>\\<Rightarrow>* Em)\" and forms=S] by auto\n           then have \"ff :# \\<Gamma> \\<oplus> Compound F Fs\" \n                using extendFalsum[where S=S and \\<Gamma>=\"\\<Gamma>\\<oplus> Compound F Fs\" and \\<Delta>=\\<delta>] by auto\n           then have \"ff :# \\<Gamma>\" by auto\n           then have \"ff :# \\<Gamma> + \\<Gamma>'\" by auto\n           then have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>,0) \\<in> derivable R*\" using rules\n                and containFalsum[where \\<Gamma>=\"\\<Gamma> + \\<Gamma>'\" and R=R] by auto\n          }\n       moreover\n          {assume \"r = ([], \\<LM>At i\\<RM> \\<Rightarrow>* At i)\"\n           with `extendRule S r = ([], \\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)`\n                have \"extend S (\\<LM> At i\\<RM> \\<Rightarrow>* At i) = (\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)\"\n                using extendRule_def[where R=\"([], \\<LM>At i \\<RM> \\<Rightarrow>* At i)\" and forms=S] by auto\n           then have \"At i :# \\<Gamma> \\<oplus> Compound F Fs\" and eq: \"\\<delta> = At i\"\n                using extendID[where S=S and \\<Gamma>=\"\\<Gamma> \\<oplus> Compound F Fs\" and \\<Delta>=\\<delta> and i=i] by (auto simp add:extend_def)\n           then have \"At i :# \\<Gamma>\" by auto\n           then have \"At i :# \\<Gamma> + \\<Gamma>'\" by auto\n           with eq have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>,0) \\<in> derivable R*\" using rules\n                and containID[where i=i and \\<Gamma>=\"\\<Gamma> + \\<Gamma>'\" and R=R] by auto\n          }\n       ultimately have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>, 0) \\<in> derivable R*\" by blast\n      }\n   moreover\n      {assume \"r \\<in> R'\"\n       then have \"r \\<in> upRules\" using rules by auto\n       then have \"\\<exists> Ps C. Ps \\<noteq> [] \\<and> r = (Ps,C)\"\n            proof-\n            obtain x y where \"r = (x,y)\" by (cases r)\n            with `r \\<in> upRules` have \"(x,y) \\<in> upRules\" by simp\n            then obtain Ps where \"(Ps :: 'a sequent list) \\<noteq> []\" and \"x=Ps\" by (cases) (auto)\n            with `r = (x,y)` have \"r = (Ps, y)\" by simp\n            then show \"\\<exists> Ps C. Ps \\<noteq> [] \\<and> r = (Ps,C)\" using `Ps \\<noteq> []` by blast\n            qed\n       then obtain Ps C where \"Ps \\<noteq> []\" and \"r = (Ps,C)\" by auto\n       moreover from `extendRule S r = ([], \\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)` have \"\\<exists> S. r = ([],S)\"\n            using extendRule_def[where forms=S and R=r] by (cases r) (auto)\n       then obtain S where \"r = ([],S)\" by blast\n       ultimately have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>,0) \\<in> derivable R*\" using rules by simp\n       }\n    ultimately show \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>,m) \\<in> derivable R*\" using `n=0` by blast\n next\n     case (Suc n')\n     then have \"(\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>,n'+1) \\<in> derivable R*\" using a' by simp\n     then obtain Ps where \"(Ps, \\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>) \\<in> R*\" and \n                          \"Ps \\<noteq> []\" and \n                          derv: \"\\<forall> p \\<in> set Ps. \\<exists> n\\<le>n'. (p,n) \\<in> derivable R*\"\n          using characteriseLast[where C=\"\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>\" and m=n' and R=\"R*\"] by auto\n     then have \"\\<exists> r S. (r \\<in> Ax \\<or> r \\<in> R') \\<and> extendRule S r = (Ps, \\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)\"\n          using rules and ruleSet[where R'=R' and R=R and Ps=Ps and C=\"\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>\"] by auto\n     then obtain r S where \"r \\<in> Ax \\<or> r \\<in> R'\" and ext: \"extendRule S r = (Ps, \\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)\" by auto\n     moreover\n        {assume \"r \\<in> Ax\"\n         then have \"fst r = []\" apply (cases r) by (rule Ax.cases) auto\n         moreover obtain x y where \"r = (x,y)\" by (cases r)\n         then have \"x \\<noteq> []\" using `Ps \\<noteq> []` and ext\n                            and extendRule_def[where forms=S and R=r]\n                            and extend_def[where forms=S and seq=\"snd r\"] by auto\n         ultimately have \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>,m) \\<in> derivable R*\"\n              using `r=(x,y)` by auto\n        }\n     moreover\n        {assume \"r \\<in> R'\"\n         obtain ps c where \"r = (ps,c)\" by (cases r) auto\n         then have \"r \\<in> upRules\" using rules and `r \\<in> R'` by auto\n         then have \"\\<exists> T Ts. c = (\\<LM>Compound T Ts\\<RM> \\<Rightarrow>* Em) \\<or> c = (\\<Empt> \\<Rightarrow>* Compound T Ts)\" using `r=(ps,c)`\n              and upRuleCharacterise[where Ps=ps and C=c] by auto\n         then obtain T Ts where \"c = (\\<LM>Compound T Ts\\<RM> \\<Rightarrow>* Em) \\<or> c = (\\<Empt> \\<Rightarrow>* Compound T Ts)\" by blast\n         moreover\n            {assume \"c = (\\<Empt> \\<Rightarrow>* Compound T Ts)\"\n             with ext have \"antec S = \\<Gamma> \\<oplus> Compound F Fs\" and del: \"Compound T Ts = \\<delta>\"\n                  using `r = (ps,c)` by (auto simp add:extendRule_def extend_def)\n             then obtain \\<delta>' where \"S = (\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>')\" by (cases S) auto\n             with derv have pms: \"\\<forall> p \\<in> set ps. \\<exists> m\\<le>n'. (extend (\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>') p,m) \\<in> derivable R*\"\n                  using ext and `r = (ps,c)` by (auto simp add:extendRule_def)\n             have \"\\<forall> p \\<in> set ps. \\<exists> m\\<le>n'. (extend (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>') p,m) \\<in> derivable R*\"\n                 proof-\n                 {fix p\n                  assume \"p \\<in> set ps\"\n                  obtain \\<Gamma>i \\<delta>i where p: \"p = (\\<Gamma>i \\<Rightarrow>* \\<delta>i)\" by (cases p) auto\n                  have \"\\<delta>i = Em \\<or> \\<delta>i \\<noteq> Em\" by blast\n                  moreover\n                     {assume \"\\<delta>i = Em\"\n                      then have \"extend (\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>') p = (\\<Gamma> + \\<Gamma>i \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>')\" using p\n                           by (auto simp add:extend_def union_ac)\n                      with pms obtain m where \"m \\<le>n'\" and \"(\\<Gamma> + \\<Gamma>i \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>',m) \\<in> derivable R*\"\n                           using `p \\<in> set ps` by auto\n                      with IH and `n = Suc n'` and b' have \"\\<exists> m'\\<le>m. (\\<Gamma> + \\<Gamma>i + \\<Gamma>' \\<Rightarrow>* \\<delta>',m') \\<in> derivable R*\"\n                           apply auto apply (drule_tac x=m in spec) apply auto\n                           apply (drule_tac x=\"\\<Gamma>+\\<Gamma>i\" in spec) apply (drule_tac x=\"\\<delta>'\" in spec)\n                           by (auto simp add:union_ac)\n                      then have \"\\<exists> m\\<le>n'. (extend (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>') p,m) \\<in> derivable R*\" using `m\\<le>n'`\n                           and p and `\\<delta>i = Em` apply (auto simp add:extend_def union_ac) \n                           by (rule_tac x=\"m'\" in exI) auto\n                     }\n                  moreover\n                     {assume \"\\<delta>i \\<noteq> Em\"\n                      then have \"extend (\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>') p = (\\<Gamma> + \\<Gamma>i \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>i)\" using p\n                           by (auto simp add:extend_def union_ac)\n                      with pms obtain m where \"m\\<le>n'\" and \"(\\<Gamma> + \\<Gamma>i \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>i,m) \\<in> derivable R*\"\n                           using `p \\<in> set ps` by auto\n                      then have \"\\<exists> m\\<le>n'. (\\<Gamma> + \\<Gamma>i + \\<Gamma>' \\<Rightarrow>* \\<delta>i,m) \\<in> derivable R*\" using `n = Suc n'` and b'\n                           and IH\n                           apply auto apply (drule_tac x=m in spec) apply auto\n                           apply (drule_tac x=\"\\<Gamma> + \\<Gamma>i\" in spec) apply (drule_tac x=\\<delta>i in spec) \n                           apply (auto simp add:union_ac) apply (rule_tac x=\"m'\" in exI) by auto\n                      then have \"\\<exists> m\\<le>n'. (extend (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>') p,m) \\<in> derivable R*\" using `m\\<le>n'`\n                           and p and `\\<delta>i \\<noteq> Em` by (auto simp add:extend_def union_ac)\n                     } \n                  ultimately have \"\\<exists> m\\<le>n'. (extend (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>') p, m) \\<in> derivable R*\" by blast\n                 }\n                 thus ?thesis by auto\n                 qed\n             then have \"\\<forall> p \\<in> set (fst (extendRule (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>') r)).\n                          \\<exists> m\\<le>n'. (p,m) \\<in> derivable R*\" using `r = (ps,c)` by (auto simp add:extendRule_def)\n             moreover have \"extendRule (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>') r \\<in> R*\" using `r \\<in> R'` and rules by auto\n             moreover from `S = (\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>')` and ext and `c = (\\<Empt> \\<Rightarrow>* Compound T Ts)`\n                 and `r = (ps,c)`\n                 have \"extend (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>') (snd r) = (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* Compound T Ts)\" by (auto simp add:extend_def union_ac)\n             moreover from ext and `r = (ps,c)` and `Ps \\<noteq> []` have \"fst r \\<noteq> []\" by (auto simp add:extendRule_def)\n             ultimately have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* Compound T Ts ,n'+1) \\<in> derivable R*\" using\n                 derivable.step[where r=\"extendRule (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>') r\" and m=\"n'\" and R=\"R*\"] \n                 by (cases r) (auto simp add:map_is_Nil_conv extendRule_def)\n             then have \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>,m) \\<in> derivable R*\" using `n = Suc n'` and del by auto\n            }\n         moreover\n            {assume r: \"c = (\\<LM>Compound T Ts\\<RM> \\<Rightarrow>* Em)\"\n             have \"Compound F Fs = Compound T Ts \\<or> Compound F Fs \\<noteq> Compound T Ts\" by blast\n             moreover\n                {assume \"Compound F Fs = Compound T Ts\"\n                 then have \"leftPrincipal r (Compound F Fs)\" using r and `r = (ps,c)` by auto\n                 then have \"(\\<Gamma>' \\<Rightarrow>* Em) \\<in> set ps\" using b' and `r = (ps,c)` and `r \\<in> R'` and rules\n                      by auto\n                 then have \"extend S (\\<Gamma>' \\<Rightarrow>* Em) \\<in> set Ps\" using `extendRule S r = (Ps,\\<Gamma> \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)`\n                      and `r = (ps,c)` by (simp add:extendContain)\n                 moreover from r and `Compound F Fs = Compound T Ts` have \"c = (\\<LM>Compound F Fs\\<RM> \\<Rightarrow>* Em)\" by auto\n                 with ext have \"S = (\\<Gamma> \\<Rightarrow>* \\<delta>)\"\n                      using `r = (ps,c)` apply (auto simp add:extendRule_def extend_def) by (cases S) auto\n                 ultimately have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>) \\<in> set Ps\" by (simp add:extend_def)\n                 then have \"\\<exists> m\\<le>n'. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>,m) \\<in> derivable R*\"\n                      using `\\<forall> p \\<in> set Ps. \\<exists> n\\<le>n'. (p,n) \\<in> derivable R*` by auto\n                 then have \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta> ,m) \\<in> derivable R*\" using `n = Suc n'`\n                      by (auto,rule_tac x=m in exI) (simp)\n                }\n             moreover\n                {assume \"Compound F Fs \\<noteq> Compound T Ts\"\n                 obtain \\<Gamma>'' \\<delta>' where \"S = (\\<Gamma>'' \\<Rightarrow>* \\<delta>')\" by (cases S) auto\n                 with ext and r and `r = (ps,c)` have \"\\<delta> = \\<delta>'\" by (auto simp add:extendRule_def extend_def)\n                 then have \"S = (\\<Gamma>'' \\<Rightarrow>* \\<delta>)\" using `S = (\\<Gamma>'' \\<Rightarrow>* \\<delta>')` by simp\n                 with r and `r = (ps,c)` and ext have \"\\<Gamma> \\<oplus> Compound F Fs = \\<Gamma>'' \\<oplus> Compound T Ts\"\n                      by (auto simp add:extendRule_def extend_def)\n                 with `Compound F Fs \\<noteq> Compound T Ts` obtain \\<Gamma>1 where\n                      gam1: \"\\<Gamma> = \\<Gamma>1 \\<oplus> Compound T Ts\" and\n                      gam2: \"\\<Gamma>'' = \\<Gamma>1 \\<oplus> Compound F Fs\"\n                      using midMultiset[where \\<Gamma>=\\<Gamma> and \\<Gamma>'=\\<Gamma>'' and A=\"Compound F Fs\" and B=\"Compound T Ts\"] by auto\n                 with `S = (\\<Gamma>'' \\<Rightarrow>* \\<delta>)` have \"S = (\\<Gamma>1 \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)\" by simp\n                 with derv have pms: \"\\<forall> p \\<in> set ps. \\<exists> m\\<le>n'. (extend (\\<Gamma>1 \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\" \n                      using ext and `r= (ps,c)` by (auto simp add:extendRule_def)\n                 have \"\\<forall> p \\<in> set ps. \\<exists> m\\<le>n'. (extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\"\n                     proof-\n                     {fix p\n                      assume \"p \\<in> set ps\"\n                      obtain \\<Gamma>i \\<delta>i where p: \"p = (\\<Gamma>i \\<Rightarrow>* \\<delta>i)\" by (cases p) auto\n                      have \"\\<delta>i = Em \\<or> \\<delta>i \\<noteq> Em\" by blast\n                      moreover\n                         {assume \"\\<delta>i = Em\"\n                          then have \"extend (\\<Gamma>1 \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>) p = (\\<Gamma>1 + \\<Gamma>i \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)\" using p\n                               by (auto simp add:extend_def union_ac)\n                          with pms obtain m where \"m \\<le>n'\" and \"(\\<Gamma>1 + \\<Gamma>i \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>,m) \\<in> derivable R*\"\n                               using `p \\<in> set ps` by auto\n                          with IH and `n = Suc n'` and b' have \"\\<exists> m'\\<le>m. (\\<Gamma>1 + \\<Gamma>i + \\<Gamma>' \\<Rightarrow>* \\<delta>,m') \\<in> derivable R*\"\n                               apply auto apply (drule_tac x=m in spec) apply auto\n                               apply (drule_tac x=\"\\<Gamma>1 + \\<Gamma>i\" in spec) apply (drule_tac x=\\<delta> in spec) \n                               by (auto simp add:union_ac)\n                          then have \"\\<exists> m\\<le>n'. (extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\" using `m\\<le>n'`\n                               and p and `\\<delta>i = Em` apply (auto simp add:extend_def union_ac) \n                               by (rule_tac x=\"m'\" in exI) auto\n                         }\n                      moreover\n                         {assume \"\\<delta>i \\<noteq> Em\"\n                          then have \"extend (\\<Gamma>1 \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>) p = (\\<Gamma>1 + \\<Gamma>i \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>i)\" using p\n                               by (auto simp add:extend_def union_ac)\n                          with pms obtain m where \"m\\<le>n'\" and \"(\\<Gamma>1 + \\<Gamma>i \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>i,m) \\<in> derivable R*\"\n                               using `p \\<in> set ps` by auto\n                          with IH and `n = Suc n'` and b' have \"\\<exists> m'\\<le>m. (\\<Gamma>1 + \\<Gamma>i + \\<Gamma>' \\<Rightarrow>* \\<delta>i,m') \\<in> derivable R*\"\n                               apply auto apply (drule_tac x=m in spec) apply auto\n                               apply (drule_tac x=\"\\<Gamma>1 + \\<Gamma>i\" in spec) apply (drule_tac x=\\<delta>i in spec) \n                               by (auto simp add:union_ac)\n                          then have \"\\<exists> m\\<le>n'. (extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) p,m) \\<in> derivable R*\" using `m\\<le>n'`\n                               and p and `\\<delta>i \\<noteq> Em` and `n = Suc n'` apply (auto simp add:extend_def union_ac)\n                               apply (rule_tac x=m' in exI) by auto\n                         } \n                      ultimately have \"\\<exists> m\\<le>n'. (extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) p, m) \\<in> derivable R*\" by blast\n                     }\n                     thus ?thesis by auto\n                     qed\n                 then have \"\\<forall> p \\<in> set (fst (extendRule (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) r)).\n                              \\<exists> m\\<le>n'. (p,m) \\<in> derivable R*\" using `r = (ps,c)` by (auto simp add:extendRule_def)\n                 moreover have \"extendRule (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) r \\<in> R*\" using `r \\<in> R'` and rules by auto\n                 moreover from `S = (\\<Gamma>1 \\<oplus> Compound F Fs \\<Rightarrow>* \\<delta>)` and ext and `c = (\\<LM>Compound T Ts\\<RM> \\<Rightarrow>* Em)`\n                     and gam1 and `r = (ps,c)`\n                     have \"extend (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) (snd r) = (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>)\" by (auto simp add:extend_def union_ac)\n                 moreover from ext and `r = (ps,c)` and `Ps \\<noteq> []` have \"fst r \\<noteq> []\" by (auto simp add:extendRule_def)\n                 ultimately have \"(\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>,n'+1) \\<in> derivable R*\" using\n                     derivable.step[where r=\"extendRule (\\<Gamma>1 + \\<Gamma>' \\<Rightarrow>* \\<delta>) r\" and m=\"n'\" and R=\"R*\"] \n                     by (cases r) (auto simp add:map_is_Nil_conv extendRule_def)\n                 then have \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>,m) \\<in> derivable R*\" using `n = Suc n'` by auto\n                }\n            ultimately have \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>, m) \\<in> derivable R*\" by blast\n           }\n       ultimately have \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>, m) \\<in> derivable R*\" by blast\n      }\n   ultimately show \"\\<exists> m\\<le>n. (\\<Gamma> + \\<Gamma>' \\<Rightarrow>* \\<delta>, m) \\<in> derivable R*\" by blast\n   qed\nqed\n    \n\n\n(* ---------------------------------------------------\n   ---------------------------------------------------\n   ---------------------------------------------------\n   ---------------------------------------------------\n                THIS IS NOW\n                G3ip.thy\n   ---------------------------------------------------\n   ---------------------------------------------------\n   ---------------------------------------------------\n   --------------------------------------------------- *)\n\n\n\ndatatype cdi = con | dis | imp\n\ntype_synonym cdi_form = \"cdi form\"\n\nabbreviation con_form (infixl \"\\<and>*\" 80) where\n   \"p \\<and>* q \\<equiv> Compound con [p,q]\"\n\nabbreviation dis_form (infixl \"\\<or>*\" 80) where\n   \"p \\<or>* q \\<equiv> Compound dis [p,q]\"\n\nabbreviation imp_form (infixl \"\\<supset>\" 80) where\n   \"p \\<supset> q  \\<equiv> Compound imp [p,q]\"\n(*>*)\ntext{*  \n\\noindent \\textbf{G3ip} can be expressed in this formalism: \n*}\ninductive_set \"g3ip\"\nwhere\n   conL(*<*)[intro](*>*):  \"([\\<LM> A \\<RM> + \\<LM> B \\<RM> \\<Rightarrow>* Em], \\<LM> A \\<and>* B \\<RM> \\<Rightarrow>* Em) \\<in> g3ip\"\n|  conR(*<*)[intro](*>*):  \"([\\<Empt> \\<Rightarrow>* A, \\<Empt> \\<Rightarrow>* B], \\<Empt> \\<Rightarrow>* (A \\<and>* B)) \\<in> g3ip\"\n|  disL(*<*)[intro](*>*):  \"([\\<LM> A \\<RM> \\<Rightarrow>* Em, \\<LM> B \\<RM> \\<Rightarrow>* Em], \\<LM> A \\<or>* B\\<RM> \\<Rightarrow>* Em) \\<in> g3ip\"\n|  disR1(*<*)[intro](*>*): \"([\\<Empt> \\<Rightarrow>* A], \\<Empt> \\<Rightarrow>* (A \\<or>* B)) \\<in> g3ip\"\n|  disR2(*<*)[intro](*>*): \"([\\<Empt> \\<Rightarrow>* B], \\<Empt> \\<Rightarrow>* (A \\<or>* B)) \\<in> g3ip\"\n|  impL(*<*)[intro](*>*):  \"([\\<LM> A \\<supset> B \\<RM> \\<Rightarrow>* A, \\<LM> B \\<RM> \\<Rightarrow>* Em], \\<LM> (A \\<supset> B) \\<RM> \\<Rightarrow>* Em) \\<in> g3ip\"\n|  impR(*<*)[intro](*>*):  \"([\\<LM> A \\<RM> \\<Rightarrow>* B], \\<Empt> \\<Rightarrow>* (A \\<supset> B)) \\<in> g3ip\"\n\n(*<*)\nlemma g3ip_upRules:\nshows \"g3ip \\<subseteq> upRules\"\nproof-\n  {fix r\n   assume \"r \\<in> g3ip\"\n   then have \"r \\<in> upRules\" apply (cases r) by (rule g3ip.cases) auto\n  }\n  then show \"g3ip \\<subseteq> upRules\" by auto\nqed\n(*>*)\n\ntext{* \\noindent As expected, $\\implies{R}{}$ can be shown invertible: *}\n\nlemma impRInvert:\nassumes \"(\\<Gamma> \\<Rightarrow>* (A \\<supset> B), n) \\<in> derivable (Ax \\<union> g3ip)*\" and \"B \\<noteq> Em\"\nshows \"\\<exists> m\\<le>n. (\\<Gamma> \\<oplus> A \\<Rightarrow>* B, m) \\<in> derivable (Ax \\<union> g3ip)*\"\nproof-\n  have \"\\<forall> r \\<in> (Ax \\<union> g3ip). rightPrincipal r (A \\<supset> B) \\<longrightarrow> \n                           (\\<LM>A\\<RM> \\<Rightarrow>* B) \\<in> set (fst r)\"\n  proof-  -- {*Showing that $A \\Rightarrow B$ is a premiss of every rule with $\\implies{A}{B}$ principal*} \n   {fix r\n    assume \"r \\<in> (Ax \\<union> g3ip)\"\n    moreover assume \"rightPrincipal r (A \\<supset> B)\"\n    ultimately have \"r \\<in> g3ip\" (*<*)apply auto apply (rule rightPrincipal.cases) apply auto (*>*)by(*<*) (rule Ax.cases) (*>*) auto  -- {* If $\\implies{A}{B}$ was principal, then $r \\notin Ax$ *}\n    from `rightPrincipal r (A \\<supset> B)` have \"snd r = (\\<Empt> \\<Rightarrow>* (A \\<supset> B))\" by(*<*) (rule rightPrincipal.cases)(*>*) auto\n    with `r \\<in> g3ip` and `rightPrincipal r (A \\<supset> B)` \n        have \"r = ([\\<LM>A\\<RM> \\<Rightarrow>* B], \\<Empt> \\<Rightarrow>* (A\\<supset>B))\" (*<*) apply (cases r)(*>*) by (rule g3ip.cases) auto\n    then have \"(\\<LM>A\\<RM> \\<Rightarrow>* B) \\<in> set (fst r)\" by auto\n   }\n   thus ?thesis by auto\n   qed\n  with assms (*<*)and g3ip_upRules(*>*) show ?thesis using rightInvertible(*<*)[where R'=\"g3ip\" and R=\"Ax \\<union> g3ip\" and \\<Gamma>=\\<Gamma> and n=n\n                            and \\<Gamma>'=\"\\<LM>A\\<RM>\" and E=B and F=\"imp\" and Fs=\"[A,B]\"](*>*) by auto\nqed\n\n(*<*)\nend\n(*>*)", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/SequentInvertibility/SingleSuccedent.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381667555713, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.31156019395497786}}
{"text": "theory Extended_Assertion\n  imports Setup\nbegin\n\nsubsection \\<open>Assertion Tree\\<close>\n\ndatatype ('k, 'v, 'ki, 'vi) assn_tree =\n  ATEmpty |\n  ATBranch\n  (color: color)\n  (key: 'k)\n  (val: 'v) \n  (ll_color: \"8 word\")\n  (ll_left: \"('ki, 'vi) rbti\")\n  (ll_key: 'ki) \n  (ll_val: 'vi) \n  (ll_right: \"('ki, 'vi) rbti\")\n  (left: \"('k, 'v, 'ki, 'vi) assn_tree\")\n  (right: \"('k, 'v, 'ki, 'vi) assn_tree\")\n\n\nsubsubsection \\<open>rbt of\\<close>\n\nfun rbt_of :: \"('k, 'v, 'ki, 'vi) assn_tree \\<Rightarrow> ('k, 'v) rbt\"  where\n  \"rbt_of ATEmpty = rbt.Empty\" |\n  \"rbt_of (ATBranch c k v _ _ _ _ _ l r) =\n    (rbt.Branch c (rbt_of l) k v (rbt_of r))\"\n\ndeclare rbt_of.elims[where y=rbt.Empty, simplified, elim!]\nlemma rbt_of_branchE [elim!]:\n  assumes\n    \"rbt_of t = rbt.Branch c l k v r\"\n  shows\n    \"\\<lbrakk>\\<And>al ar. rbt_of al = l \\<Longrightarrow> rbt_of ar = r  \\<Longrightarrow> (\\<And>ci li ki vi ri. t = ATBranch c k v ci li ki vi ri al ar \\<Longrightarrow> P)\\<rbrakk> \\<Longrightarrow> P\"\n  using assms\n  by (blast elim: rbt_of.elims)\n\n\nlemma rbt_of_branchI [intro!]:\n  assumes \n    \"rbt_of l = l'\"\n    \"rbt_of r = r'\"\n  shows\n    \"rbt_of (ATBranch c k v ci li ki vi ri l r) = rbt.Branch c l' k v r'\"\n  using assms by simp\n\n\nlemma rbt_of_emptyI [intro!]:\n  \"rbt_of ATEmpty = rbt.Empty\"\n  by simp\n\nlemma rbt_of_reorient_branch [simp]: \n  \"(Branch c l k v r = rbt_of t) = (rbt_of t = Branch c l k v r)\" by auto\n\nlemma rbt_of_reorient_empty [simp]:\n  \"(rbt.Empty = rbt_of t) = (rbt_of t = rbt.Empty)\" by auto\n\nsubsection \\<open>Assertion\\<close>\n\nfun assn_unless (infixl \"unless\" 40) where \n  \"assn_unless assn b = (if b then \\<box> else assn)\"\ndeclare assn_unless.simps[simp del]\n\n\nlemma assn_unless_True [simp]:\n  \"(assn unless False) = assn\"\n  by (simp add: assn_unless.simps)\n\n\nlemma assn_unless_False [simp]:\n  \"(assn unless True) = \\<box>\"\n  by (simp add: assn_unless.simps)\n\n\ncontext rbt_impl\nbegin\ninterpretation rbt_impl_deps .\n\nfun rbt_assn_ext :: \"('k, 'v, 'ki, 'vi) assn_tree \\<Rightarrow> 'k set \\<Rightarrow> ('ki, 'vi) rbti \\<Rightarrow> ll_assn\" where\n  \"rbt_assn_ext ATEmpty ex p = \\<up>(p = null)\"\n| \"rbt_assn_ext (ATBranch c k v ci li ki vi ri l r) ex p =\n    (\n      \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) p **\n      color_assn c ci **\n      rbt_assn_ext l ex li **\n      \\<upharpoonleft>key_assn k ki **\n      \\<upharpoonleft>value_assn v vi unless k \\<in> ex **\n      rbt_assn_ext r ex ri\n    )\"\ndeclare rbt_assn_ext.simps(2)[simp del]\nlemmas rbt_assn_ext_unfold = rbt_assn_ext.simps(2)\n\n\nlemma rbt_assn_ext_null [simp]: \n  \"rbt_assn_ext t ex null = \\<up>(t =  ATEmpty)\"\n  apply (cases t)\n  using rbt_assn_ext_unfold apply auto\n  done\n\nlemma rbt_assn_ext_empty_set_null [simp]:\n  \"rbt_assn_ext t {} null = \\<up>(t  = ATEmpty)\" by simp\n\n\nsubsection \\<open>Load Rules\\<close>\n\n\nlemma load_rbt [vcg_rules]:\n  \"\n    llvm_htriple\n    (rbt_assn_ext (ATBranch c k v ci li ki vi ri l r) ex ti)\n    (ll_load ti)\n    (\\<lambda>res.\n      rbt_assn_ext (ATBranch c k v ci li ki vi ri l r) ex ti **\n      \\<up>(res = RBT_NODE ci li ki vi ri)\n    )\n  \"\n  unfolding rbt_assn_ext_unfold\n  apply vcg\n  done\n\n\nlemma load_rbt_ext_non_null [vcg_rules]:\n  \"\n    llvm_htriple\n    (rbt_assn_ext t {} ti ** \\<up>(ti \\<noteq> null))\n    (ll_load ti)\n    (\\<lambda>res.\n      EXS ci li ki vi ri c l k v r.\n      rbt_assn_ext t {} ti **\n      \\<up>(t = (ATBranch c k v ci li ki vi ri l r)) **\n      \\<up>(res = RBT_NODE ci li ki vi ri)\n    )\n  \"\n  apply vcg\n  apply (cases t)\n  subgoal by simp (*contradiction*)\n  subgoal by vcg\n  done\n\nsubsection \\<open>Reduction Rules\\<close>\n\nlemma unfold_rbt_assn_ext_red_rule_1 [fri_red_rules]:\n  \"\n    is_sep_red\n    (\\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) ti)\n    (\n        \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) ti **\n        color_assn c ci **\n        rbt_assn_ext l ex li **\n        \\<upharpoonleft>key_assn k ki **\n        \\<upharpoonleft>value_assn v vi unless k \\<in> ex **\n        rbt_assn_ext r ex ri\n    )\n    (\\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) ti)\n    (rbt_assn_ext (ATBranch c k v ci li ki vi ri l r) ex ti)\n  \"\n  apply (rule is_sep_redI)\n  unfolding rbt_assn_ext_unfold\n  apply simp\n  done\nthm is_sep_red_def\nlemma rbt_assn_ext_key_assn_unfold [fri_red_rules]: \n  \"\n    is_sep_red\n    (\n      \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) ti \\<and>*\n      color_assn c ci \\<and>*\n      rbt_assn_ext l ex li \\<and>*\n      \\<upharpoonleft>value_assn v vi unless k\\<in>ex\\<and>*\n      rbt_assn_ext r ex ri)\n    \\<box>\n    (rbt_assn_ext (ATBranch c k v ci li ki vi ri l r) ex ti)\n    (\\<upharpoonleft>key_assn k ki)\n  \"\n  apply (rule is_sep_redI)\n  unfolding rbt_assn_ext_unfold\n  apply simp\n  subgoal premises prems\n    apply (sep isep_dest: prems)\n    done\n  done\n\n\nlemma rbt_assn_ext_color_assn_unfold [fri_red_rules]: \n  \"\n    is_sep_red\n    (\n      \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) ti \\<and>*\n      rbt_assn_ext l {} li \\<and>*\n      \\<upharpoonleft>key_assn k ki **\n      \\<upharpoonleft>value_assn v vi \\<and>*\n      rbt_assn_ext r {} ri)\n    \\<box>\n    (rbt_assn_ext (ATBranch c k v ci li ki vi ri l r) {} ti)\n    (color_assn c ci)\n  \"\n  apply (rule is_sep_redI)\n  unfolding rbt_assn_ext_unfold\n  apply simp\n  subgoal premises prems\n    apply (sep isep_dest: prems)\n    done\n  done\n\n\nlemma rbt_assn_ext_pto_assn_unfold [fri_red_rules]:\n  \"\n    is_sep_red\n    (\n      color_assn c ci **\n      rbt_assn_ext l {} li \\<and>*\n      \\<upharpoonleft>key_assn k ki **\n      \\<upharpoonleft>value_assn v vi \\<and>*\n      rbt_assn_ext r {} ri)\n    \\<box>\n    (rbt_assn_ext (ATBranch c k v ci li ki vi ri l r) {} ti)\n    (\\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) ti)\n  \"\n  apply (rule is_sep_redI)\n  unfolding rbt_assn_ext_unfold\n  apply simp\n  subgoal premises prems\n    apply (sep isep_dest: prems)\n    done\n  done\n\n\nlemma rbt_assn_ext_left_assn_unfold [fri_red_rules]:\n  \"\n    is_sep_red\n    (\n      \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) ti **\n      color_assn c ci **\n      \\<upharpoonleft>key_assn k ki **\n      \\<upharpoonleft>value_assn v vi unless k \\<in> ex \\<and>*\n      rbt_assn_ext r ex ri)\n    \\<box>\n    (rbt_assn_ext (ATBranch c k v ci li ki vi ri l r) ex ti)\n    (rbt_assn_ext l ex li)\n  \"\n  apply (rule is_sep_redI)\n  unfolding rbt_assn_ext_unfold\n  apply simp\n  subgoal premises prems\n    apply (sep isep_dest: prems)\n    done\n  done\n\nlemma rbt_assn_ext_right_assn_unfold [fri_red_rules]:\n  \"\n    is_sep_red\n    (\n      \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) ti **\n      color_assn c ci **\n      rbt_assn_ext l ex li **\n      \\<upharpoonleft>key_assn k ki **\n      \\<upharpoonleft>value_assn v vi unless k \\<in> ex\n    )\n    \\<box>\n    (rbt_assn_ext (ATBranch c k v ci li ki vi ri l r) ex ti)\n    (rbt_assn_ext r ex ri)\n  \"\n  apply (rule is_sep_redI)\n  unfolding rbt_assn_ext_unfold\n  apply simp\n  subgoal premises prems\n    apply (sep isep_dest: prems)\n    done\n  done\n\nsubsection \\<open>Empty Constructor\\<close>\n\nlemma empty_correct_ext [vcg_rules]: \n  \"llvm_htriple\n   \\<box>\n   empty\n   (\\<lambda>ti_res. rbt_assn_ext ATEmpty {} ti_res)\"\n  unfolding empty_def\n  by vcg\n\nend\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Extended_Assertion.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3115601855377086}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory HaskellLemmaBucket\nimports\n  HaskellLib_H\n  NonDetMonadLemmaBucket\nbegin\n\nlemma map_bits_to_bl:\n  \"map (op !! x) [0..<size x] = reverse (to_bl x)\"\n  by (simp add: map_bits_rev_to_bl)\n\nlemma not_orList_is_replicate:\n  \"\\<not> orList ls \\<Longrightarrow> ls = replicate (length ls) False\"\nproof (induct ls rule: rev_induct)\n  case Nil thus ?case unfolding orList_def by simp\nnext\n  case (snoc l ls)\n\n  from snoc.prems have ol: \"\\<not> orList ls\" and nl: \"\\<not> l\" unfolding orList_def by auto\n  have \"ls = replicate (length ls) False\" by (rule snoc.hyps [OF ol])\n  thus ?case\n    by (rule ssubst) (simp add: nl replicate_app_Cons_same [where xs = \"[]\", simplified])\nqed\n\nlemma andList_Cons:\n  assumes al: \"andList $ map P (y # ys)\"\n  shows   \"P y\"\n  using al unfolding andList_def\n  by simp (induct rule: rev_induct, simp+)\n\nlemma andList_mapE:\n  assumes al: \"andList $ map P xs\"\n  and     xv: \"x \\<in> set xs\"\n  shows   \"P x\"\n  using al xv\nproof (induct xs arbitrary: x rule: rev_induct)\n  case Nil thus ?case by simp\nnext\n  case (snoc y ys)\n\n  show ?case\n  proof (cases \"x = y\")\n    case True\n    with snoc.prems show ?thesis by (simp add: andList_def)\n  next\n    case False\n    with snoc.prems show ?thesis\n      by (auto simp: andList_def intro!: snoc.hyps)\n  qed\nqed\n\nlemma andList_to_aligned:\n  assumes al: \"andList $ map (\\<lambda>x. x && mask pageBits = 0) xs\"\n  and     xv: \"x \\<in> set xs\"\n  shows   \"is_aligned x pageBits\"\nproof (subst is_aligned_mask)\n  from al show \"x && mask pageBits = 0\" by (rule andList_mapE) fact\nqed\n\n(* minimum/maximum *)\n\nlemma maximum_ge: \"x \\<in> set b \\<Longrightarrow> x \\<le> maximum b\"\n  unfolding maximum_def by (auto intro: Max_ge)\n\nlemma less_minimum_not_in:\n  \"\\<lbrakk> ls \\<noteq> []; x < minimum ls \\<rbrakk> \\<Longrightarrow> x \\<notin> set ls\"\n  unfolding minimum_def by auto\n\nlemma minimum_le_member:\n  \"\\<lbrakk> x \\<in> set ls; ls \\<noteq> []\\<rbrakk> \\<Longrightarrow> minimum ls \\<le> x\"\n  unfolding minimum_def\n  apply (rule Min_le)\n    apply simp\n   apply simp\n  done\n\nlemma minimum_map_distrib:\n  fixes f :: \"('a :: linorder) \\<Rightarrow> 'a\" and ls :: \"'a list\"\n  assumes minf: \"\\<And>x y. \\<lbrakk>x \\<in> set ls; y \\<in> set ls\\<rbrakk> \\<Longrightarrow> min (f x) (f y) = f (min x y)\"\n  and      lsn: \"ls \\<noteq> []\"\n  shows \"minimum (map f ls) = f (minimum ls)\"\n  unfolding minimum_def\n  apply simp\n  apply (rule Min_image_distrib)\n    apply (erule (1) minf)\n   apply simp\n  apply (simp add: lsn)\n  done\n\nlemma minimum_enum_upto:\n  fixes x :: \"'a::len word\"\n  assumes le: \"x \\<le> y\"\n  shows   \"minimum [x .e. y] = x\"\n  unfolding minimum_def using le by (auto intro!: MinI)\n\nlemma break_subsetsD:\n  \"break f xs = (ys, zs) \\<Longrightarrow> set ys \\<subseteq> set xs \\<and> set zs \\<subseteq> set xs\"\n  apply (induct xs arbitrary: ys zs)\n   apply simp\n  apply (case_tac \"break f xs\")\n  apply (elim meta_allE, drule(1) meta_mp)\n  apply (fastforce simp: split_def split: if_split_asm)\n  done\n\nlemma distinct_prop_breakD:\n  \"\\<lbrakk> distinct_prop P xs; break f xs = (ys, zs) \\<rbrakk>\n    \\<Longrightarrow> \\<forall>y \\<in> set ys. \\<forall>z \\<in> set zs. P y z\"\n  apply (induct xs arbitrary: ys zs)\n   apply simp\n  apply (simp add: split_def split: if_split_asm)\n  apply (case_tac \"break f xs\")\n  apply (elim meta_allE, drule(1) meta_mp)\n  apply (frule break_subsetsD)\n  apply fastforce\n  done\n\nlemma stateAssert_wp:\n  \"\\<lbrace>\\<lambda>s. P s \\<longrightarrow> Q () s\\<rbrace> stateAssert P e \\<lbrace>Q\\<rbrace>\"\n  by (clarsimp simp: stateAssert_def) wp\n\nlemma haskell_assert_wp:\n  \"\\<lbrace>\\<lambda>s. Q \\<longrightarrow> P s\\<rbrace> haskell_assert Q xs \\<lbrace>\\<lambda>_. P\\<rbrace>\"\n  by simp wp\n\nlemma init_append_last:\n  \"xs \\<noteq> [] \\<Longrightarrow> init xs @ [last xs] = xs\"\n  apply (induct xs rule: rev_induct)\n   apply simp\n  apply (simp add: init_def)\n  done\n\nlemma no_fail_stateAssert:\n  \"no_fail P (stateAssert P xs)\"\n  apply (simp add: stateAssert_def)\n  apply (rule no_fail_pre, wp no_fail_bind)\n  apply simp\n  done\n\nlemma empty_fail_stateAssert:\n  \"empty_fail (stateAssert P s)\"\n  by (simp add: stateAssert_def assert_def empty_fail_get)\n\nlemma haskell_fail_wp:\n  \"\\<lbrace>\\<top>\\<rbrace> haskell_fail x \\<lbrace>P\\<rbrace>\"\n  by simp\n\nlemma no_fail_haskell_fail [simp, wp]:\n  \"no_fail \\<bottom> (haskell_fail xs)\"\n  by simp\n\nlemma in_assocs_is_fun:\n  \"(x \\<in> set (assocs f)) = (f (fst x) = snd x)\"\n  by (cases x) (auto simp add: assocs_def)\n\nlemma fun_is_in_assocs:\n  \"(f x = y) = ((x,y) \\<in> set (assocs f))\"\n  by (simp add: in_assocs_is_fun)\n\nlemma empty_set_is_null:\n  \"(set xs = {}) = null xs\"\n  by (clarsimp simp: null_def)\n  \nlemma assert_into_when:\n  \"(assert P) = (when (\\<not> P) (haskell_fail []))\"\n  by (simp add: assert_def when_def)\n\nlemma const_apply:\n  \"const x y = x\"\n  by (simp add: const_def)\n\nlemma const_None_empty:\n  \"const None = empty\"\n  by (rule ext, simp add: const_apply)\n\nlemma headM_tailM_Cons:\n  \"headM (x # xs) = return x\"\n  \"tailM (x # xs) = return xs\"\n  by (simp add: headM_def tailM_def)+\n\nlemma replicateM_mapM:\n  \"replicateM n f = mapM (\\<lambda>x. f) (replicate n ())\"\n  by (simp add: replicateM_def mapM_def)\n  \nlemma orList_False:\n  \"(\\<not> orList bs) = (set bs \\<subseteq> {False})\"\n  apply (induct bs)\n  apply (simp_all add: orList_def foldl_True)\n  apply (case_tac a)   \n  apply (simp_all add: orList_def foldl_True)\n  done\n\nlemma Cons_eq_tails:\n  \"((xs # xxs) = tails ys) = (ys = xs \\<and> xxs = tl (tails ys))\"\n  by (case_tac ys, auto)\n\nlemma findM_on_outcome':\n  assumes x: \"\\<And>x xs. \\<lbrace>\\<lambda>s. Q None s \\<and> x \\<in> fn s \\<and> set xs \\<subseteq> fn s\\<rbrace> f x\n                     \\<lbrace>\\<lambda>rv s. (rv \\<longrightarrow> Q (Some x) s) \\<and> (\\<not> rv \\<longrightarrow> Q None s \\<and> set xs \\<subseteq> fn s)\\<rbrace>\"\n  shows      \"\\<lbrace>\\<lambda>s. Q None s \\<and> set xs \\<subseteq> fn s\\<rbrace> findM f xs \\<lbrace>Q\\<rbrace>\"\n  apply (induct xs)\n   apply (simp, wp)\n  apply (simp, wp)\n   apply (rule x)\n  apply simp\n  done\n\n\nlemma findM_on_outcome:\n  assumes x: \"\\<And>x ys. x \\<in> set xs \\<Longrightarrow> \\<lbrace>Q None and I\\<rbrace> f x \\<lbrace>\\<lambda>rv s. (rv \\<longrightarrow> Q (Some x) s) \\<and> (\\<not> rv \\<longrightarrow> Q None s \\<and> I s)\\<rbrace>\"\n  shows      \"\\<lbrace>Q None and I\\<rbrace> findM f xs \\<lbrace>Q\\<rbrace>\"\n  apply (rule hoare_vcg_precond_imp)\n   apply (rule findM_on_outcome' [where fn=\"\\<lambda>s. if I s then set xs else {}\"])\n   apply (case_tac \"x \\<notin> set xs\")\n    apply simp\n   apply (simp cong: rev_conj_cong)\n   apply (case_tac \"\\<not> set xsa \\<subseteq> set xs\")\n    apply simp\n   apply simp\n   apply (rule hoare_vcg_precond_imp)\n    apply (rule hoare_post_imp [OF _ x])\n     apply clarsimp\n    apply assumption\n   apply simp\n  apply simp\n  done\n\nlemma in_set_tailsD: \"xs \\<in> set (tails ys) \\<Longrightarrow> set xs \\<subseteq> set ys\"\n  apply (induct ys)\n   apply simp\n  apply simp\n  apply (erule disjE)\n   apply simp\n  apply simp\n  apply blast\n  done\n\nlemma notin_set_tails_set:\n  \"x \\<notin> set xs \\<Longrightarrow> \\<forall>xs' \\<in> set (tails xs). \\<forall>x' \\<in> set xs'. x \\<noteq> x'\"\n  by (fastforce dest!: in_set_tailsD)\n\nlemma set_tails_set: \"(set (tails v) \\<subseteq> {x. set x \\<subseteq> S}) = (set v \\<subseteq> S)\"\n  apply (induct v, simp_all)\n  done\n\nlemma filter_assocs_Cons:\n  fixes v :: \"('a :: len) word\" shows\n  \"\\<lbrakk> f (v, g v); \\<forall>x < v. \\<not> f (x, g x) \\<rbrakk> \\<Longrightarrow>\n     filter f (assocs g) = (v, g v) # tl (filter f (assocs g))\"\n  apply (simp add: assocs_def)\n  apply (cut_tac v=v in enum_word_div)\n  apply clarsimp\n  apply (subst map_cong [OF _ refl], assumption)+\n  apply (simp(no_asm))\n  apply simp\n  done\n\nlemma snd_stateAssert_after:\n  \"\\<not> snd ((do _ \\<leftarrow> f; stateAssert R vs od) s) \\<Longrightarrow>\n  \\<not>snd (f s) \\<and> (\\<forall>(rv, s') \\<in> fst (f s). R s')\"\n  apply (clarsimp simp: bind_def stateAssert_def get_def assert_def \n      return_def fail_def split_def split: if_split_asm)\n  done\n    \nlemma oblivious_stateAssert [simp]:\n  \"oblivious f (stateAssert g xs) = (\\<forall>s. g (f s) = g s)\"\n  apply (simp add: oblivious_def stateAssert_def exec_get\n                   assert_def return_def fail_def split: if_split)\n  apply auto\n  done\n\nlemma stateAssert_def2:\n  \"stateAssert f xs = do v \\<leftarrow> gets f; if v then return () else fail od\"\n  by (simp add: stateAssert_def gets_def assert_def)\n\nlemma findM_is_mapME:\n  \"(findM f xs >>= g)\n   = liftM (\\<lambda>_. ())\n      (doE ys \\<leftarrow> mapME_x (\\<lambda>x. do v \\<leftarrow> f x;\n                             if v then do g (Some x); throwError () od\n                             else returnOk () od) xs;\n              liftE (g None) odE)\"\n  apply (induct xs)\n   apply (simp add: mapME_x_def sequenceE_x_def liftM_def returnOk_bind)\n   apply (simp add: liftE_def)\n  apply (simp add: mapME_x_Cons bindE_assoc liftE_bindE[symmetric]\n                   liftM_def cong: if_cong)\n  apply (simp add: liftE_bindE bind_assoc)\n  apply (rule bind_cong[OF refl])\n  apply (simp add: bindE_assoc split: if_split)\n  apply (simp add: liftE_bindE bind_assoc throwError_bind)\n  done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/lib/HaskellLemmaBucket.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3115601855377086}}
{"text": "theory StoreByteList\n\nimports Main \"hoare/Hoare\"\n\nbegin\n\nlemma word_of_nat [simp] : \"word_of_int (int (unat x)) = x\"\n  by (metis uint_nat word_of_int_uint)\n\nfun store_byte_list_memory_old  :: \"w256 \\<Rightarrow> byte list \\<Rightarrow> memory \\<Rightarrow> memory\"  where\n \" store_byte_list_memory_old pos [] orig = orig\"\n|\" store_byte_list_memory_old pos (h # t) orig = (\n     store_byte_list_memory_old (pos +((word_of_int 1) ::  256 word)) t\n       (\\<lambda> p .  if pos = p then h else orig p))\"\n\nlemma find_mod :\n  \"uint (word_of_int x::w256) = (x::int) mod 2^256\"\napply (auto simp:uint_word_of_int)\ndone\n\nlemma unat_mod [simp]:\n  \"unat (word_of_int (int x)::w256) = x mod 2^256\"\napply (simp add: find_mod unat_def)\n  by (metis (mono_tags, hide_lams) Divides.transfer_int_nat_functions(2) nat_int.Rep_inverse' of_nat_numeral)\n\n\n\nlemma simp_take :\n \"n > 0 \\<Longrightarrow>\n  take n (a # lst) = a#take (n-1) lst\"\nusing List.take_Suc_Cons [of \"n-1\" a lst]\napply auto\ndone\n\nlemma take_index [simp] :\n  \"i < n \\<Longrightarrow>\n   i < length lst \\<Longrightarrow>\n  index (take n lst) i = Some (lst!i)\"\napply(simp)\ndone\n\nlemma minus_one_large :\n   \"(-1::int) mod 2^256 = 2^256-1\"\napply auto\ndone\n\nlemma minus_one_word :\n   \"uint (-1::w256) = 2^256-1\"\nproof -\n  have \"uint ((word_of_int (-1))::w256) = (-1) mod 2^256\"\n   using find_mod\n   by blast\n  then have \"uint ((-1)::w256) = (-1) mod 2^256\" by auto\n  then show ?thesis using minus_one_large by auto\nqed\n\nlemma minus_one_word_nat :\n   \"unat (-1::w256) = 2^256-1\"\nusing minus_one_word\n  by (simp add: unat_def)\n\nlemma split_new :\n \"n < 2^256 \\<Longrightarrow>\n  store_byte_list_memory w\n     (a # take n lst) mem x =\n  store_byte_list_memory (w+1) (take n lst)\n    (\\<lambda>p. if w = p then a else mem p) x\"\napply (auto simp add:store_byte_list_memory_def)\napply (cases \"unat (-1) < n\")\napply (auto simp: minus_one_word_nat)\napply (cases \"unat (x - w) \\<le> n\")\napply (cases \"unat (x - w) \\<le> length lst\")\napply auto\napply (cases \"unat (x - (w+1)) < n\")\napply (cases \"unat (x - (w+1)) < length lst\")\napply auto\nsubgoal\nproof -\n  assume a1: \"w \\<noteq> x\"\n  assume a2: \"unat (x - (w + 1)) < n\"\n  have \"x - w \\<noteq> 0\"\n    using a1 by auto\n  then have \"lst ! unat (x - (1 + w)) = take n lst ! (unat (x - w) - 1) \\<and> 0 \\<noteq> unat (x - w)\"\n    using a2 by (simp add: add.commute diff_add_eq_diff_diff_swap unat_eq_zero unat_minus_one)\n  then show \"(a # take n lst) ! unat (x - w) = lst ! unat (x - (w + 1))\"\n    by (simp add: add.commute)\nqed\nsubgoal proof -\n  assume a1: \"w \\<noteq> x\"\n  assume a2: \"unat (x - w) \\<le> length lst\"\n  assume a3: \"\\<not> unat (x - (w + 1)) < length lst\"\n  have f4: \"\\<forall>n. (0::nat) + (n - 0) = n\"\n    using linordered_semidom_class.add_diff_inverse by blast\n  have f5: \"(0::nat) + 0 = 0\"\n    by blast\n  have f6: \"\\<forall>w wa. (w::256 word) + (wa - w) = wa\"\n    by auto\n  have f7: \"\\<forall>w wa. (w::256 word) + wa - w = wa\"\n  by simp\n  have f8: \"\\<forall>w. unat ((w::256 word) - 1) < unat w \\<or> 0 = w\"\n    using f5 f4 by (metis (no_types) One_nat_def diff_is_0_eq' diff_less lessI not_le unat_eq_zero unat_minus_one)\n  have f9: \"\\<forall>n. (0::nat) + n = n\"\n    by linarith\n  have \"\\<forall>n. unat (x - w) - (n + length lst) = 0\"\n  using a2 by force\n  then have \"length lst = unat (x - (1 + w)) \\<or> x - w = 0\"\n    using f9 a3 by (metis (no_types) add.commute diff_diff_add linordered_semidom_class.add_diff_inverse unat_minus_one)\n  then show \"(a # lst) ! unat (x - w) = mem x\"\n    using f8 f7 f6 a2 a1 by (metis (no_types) diff_add_eq_diff_diff_swap not_le right_minus_eq)\nqed\n  apply (metis (mono_tags, hide_lams) add.left_neutral cancel_ab_semigroup_add_class.diff_right_commute diff_add_cancel diff_add_eq_diff_diff_swap less_le_trans measure_unat)\n\napply (cases \"unat (x - (w+1)) < n\")\napply (cases \"unat (x - (w+1)) < length lst\")\napply auto\nsubgoal proof -\n  assume a1: \"\\<not> unat (x - w) \\<le> length lst\"\n  assume \"unat (x - (w + 1)) < length lst\"\n  then have f2: \"Suc (unat (x - (w + 1))) \\<le> length lst\"\n    by (metis Suc_leI)\n  have \"\\<forall>n. \\<not> n \\<le> length lst \\<or> unat (of_nat n::256 word) = n\"\n    using a1 by (metis (no_types) le_unat_uoi less_imp_le not_less)\n  then show \"mem x = lst ! unat (x - (w + 1))\"\n    using f2 a1 by fastforce\nqed\napply (cases \"unat (x - (w+1)) < n\")\napply (cases \"unat (x - (w+1)) < length lst\")\napply auto\nproof -\n  assume a1: \"w \\<noteq> x\"\n  assume a2: \"\\<not> unat (x - w) \\<le> n\"\n  assume a3: \"unat (x - (w + 1)) < n\"\n  have \"\\<forall>n. n + 1 = Suc n\"\n    by presburger\n  then have f4: \"\\<forall>n. n \\<le> 0 \\<or> Suc (n - 1) = n\"\n    by (metis (no_types) One_nat_def not_less_eq_eq ordered_cancel_comm_monoid_diff_class.diff_add)\n  have f5: \"Suc (unat (x - (w + 1))) \\<le> n\"\n    using a3 by auto\n  have \"\\<not> unat (x - w) \\<le> 0\"\n    using a2 by linarith\n  then have \"x - w = 0\"\n    using f5 f4 a2 by (metis (no_types) diff_diff_add unat_minus_one)\n  then show \"mem x = lst ! unat (x - (w + 1))\"\n    using a1 by (metis right_minus_eq)\n  qed\n\nlemma funext : \"(\\<forall>x. f x = g x) \\<Longrightarrow> f = g\"\napply auto\ndone\n\n\nlemma store_byte_list_eq :\n  \"n \\<le> 2^256 \\<Longrightarrow>\n   store_byte_list_memory_old w (take n lst) mem =\n   store_byte_list_memory w (take n lst) mem\"\napply (induction lst arbitrary: w n mem)\napply (auto)\napply (rule funext)\napply (simp add:store_byte_list_memory_def)\napply (rule funext)\napply (auto)\nsubgoal for a lst w n mem x\napply (cases \"n > 0\")\ndefer\napply auto\napply (simp add:store_byte_list_memory_def)\napply (simp add:simp_take)\nusing split_new\napply force\ndone\ndone\n\nend\n\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/StoreByteList.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.31153881993507343}}
{"text": "theory ListReversal\n  imports LinkedList Syntax\nbegin\n\nrecord rev_list =\n  i :: nat\n  j :: nat\n  k :: nat\n \nno_notation pmult_one_class.pmult_one (\"1\")\n\nlemma \"\\<lbrakk>llist xs i, llist (rev xs) j\\<rbrakk> \\<le>\n      `j := 0;\n      while `i \\<noteq> 0 do \n        `k := @(`i + 1);\n        @(`i + 1) := `j;\n        `j := `i;\n        `i := `k\n      od\"\nproof -\n  have \"\\<lbrakk>llist xs i, llist (rev xs) j\\<rbrakk> \\<le>\n      `j := 0; \n      \\<lbrakk>EXS A B. llist A i * llist B j * \\<langle>rev xs = (rev A) @ B\\<rangle>, llist (rev xs) j\\<rbrakk>\"\n      by morgan (sep_auto, auto)\n  also have \"... \\<le> \n      `j := 0; \n      while `i \\<noteq> 0 do \n        \\<lbrakk>EXS A B. llist A i * llist B j * \\<langle>rev xs = (rev A) @ B\\<rangle> * \\<langle>`i \\<noteq> 0\\<rangle>,\n         EXS A B. llist A i * llist B j * \\<langle>rev xs = (rev A) @ B\\<rangle>\\<rbrakk>\n      od\"\n      by morgan sep_auto+\n  also have \"... \\<le> \n      `j := 0; \n      while `i \\<noteq> 0 do \n        \\<lbrakk>EXS A B a k. (i \\<mapsto> $a, $k) * llist A $k * llist B j * \\<langle>rev xs = (rev (a#A)) @ B\\<rangle> * \\<langle>`i \\<noteq> 0\\<rangle>,\n         EXS A B. llist A i * llist B j * \\<langle>rev xs = (rev A) @ B\\<rangle>\\<rbrakk>\n      od\"\n      by morgan (sep_safe, sep_auto)\n  also have \"... \\<le> \n      `j := 0; \n      while `i \\<noteq> 0 do \n        `k := @(`i + 1);\n        \\<lbrakk>EXS A B a. (i \\<mapsto> $a, k) * llist A k * llist B j * \\<langle>rev xs = (rev (a#A)) @ B\\<rangle> * \\<langle>`i \\<noteq> 0\\<rangle>,\n         EXS A B. llist A i * llist B j * \\<langle>rev xs = (rev A) @ B\\<rangle>\\<rbrakk>\n      od\"\n      by morgan sep_auto+\n  also have \"... \\<le> \n      `j := 0; \n      while `i \\<noteq> 0 do \n        `k := @(`i + 1);\n        @(`i + 1) := `j;\n        \\<lbrakk>EXS A B a. (i \\<mapsto> $a, j) * llist A k * llist B j * \\<langle>rev xs = (rev (a#A)) @ B\\<rangle> * \\<langle>`i \\<noteq> 0\\<rangle>,\n         EXS A B. llist A i * llist B j * \\<langle>rev xs = (rev A) @ B\\<rangle>\\<rbrakk>\n      od\"\n    by morgan\n    also have \"... \\<le> \n      `j := 0; \n      while `i \\<noteq> 0 do \n        `k := @(`i + 1);\n        @(`i + 1) := `j;\n        \\<lbrakk>EXS A B. llist A k * llist B i * \\<langle>rev xs = (rev A) @ B\\<rangle> * \\<langle>`i \\<noteq> 0\\<rangle>,\n         EXS A B. llist A i * llist B j * \\<langle>rev xs = (rev A) @ B\\<rangle>\\<rbrakk>\n      od\"\n      by morgan sep_auto+\n    also have \"... \\<le> \n      `j := 0; \n      while `i \\<noteq> 0 do \n        `k := @(`i + 1);\n        @(`i + 1) := `j;\n        `j := `i;\n        \\<lbrakk>EXS A B. llist A k * llist B j * \\<langle>rev xs = (rev A) @ B\\<rangle> * \\<langle>`j \\<noteq> 0\\<rangle>,\n         EXS A B. llist A i * llist B j * \\<langle>rev xs = (rev A) @ B\\<rangle>\\<rbrakk>\n      od\"\n      by morgan sep_auto\n    also have \"... \\<le> \n      `j := 0; \n      while `i \\<noteq> 0 do \n        `k := @(`i + 1);\n        @(`i + 1) := `j;\n        `j := `i;\n        `i := `k\n      od\"\n      by morgan sep_auto\n    finally show ?thesis .\nqed\n\n\nlemma \"\\<turnstile> \\<lbrace> list_seg (x#xs) i k \\<rbrace>\n      `j := @(`i + 1);\n      dispose `i;\n      dispose (`i + 1);\n      `i := `j\n    \\<lbrace> list_seg xs i k \\<rbrace>\"\n by hoare sep_auto+\n\nlemma exsI: \"(x, y) \\<in> (EXS xa xb xc x. P x \\<inter> Q xa xb xc x) \\<Longrightarrow> (x, y) \\<in> (EXS x. P x \\<inter> (EXS xa xb xc. Q xa xb xc x))\"\n  by auto\n\nlemma deallocI [intro]: \"(x, y) \\<in> {(s, h). i s \\<noteq> 0} \\<Longrightarrow>\n              (x, y) \\<in> llist xa i \\<Longrightarrow>\n              (x, y) \\<in> (EXS x. ((\\<lambda>s. i (s\\<lparr>j := i s\\<rparr>) + 1) \\<mapsto> (\\<lambda>s. x)) * true \\<inter> (EXS xa xb xc. ((\\<lambda>s. j (s\\<lparr>j := i s, i := x\\<rparr>)) \\<mapsto> (\\<lambda>s. xa)) * (((\\<lambda>s. j (s\\<lparr>j := i s, i := x\\<rparr>) + 1) \\<mapsto> (\\<lambda>s. xb)) * llist xc (\\<lambda>s. i (s\\<lparr>j := i s, i := x\\<rparr>)))))\"\n  apply (rule exsI)\n  apply safe\n  apply (drule llist_cons) back\n  apply assumption\n  apply auto\n  apply (rule_tac x=\"hd xa\" in exI)\n  apply (rule_tac x=j in exI)\n  apply (rule_tac x=\"tl xa\" in exI)\n  apply (rule_tac x=j in exI)\n  apply auto\nby (metis (no_types, lifting) bbi.Sup.qisol bbi.mult.left_commute contra_subsetD top_greatest)\n\nlemma \"\\<turnstile> \\<lbrace> llist xs i \\<rbrace>\n      while `i \\<noteq> 0 \n      inv EXS ys. llist ys i \n      do\n        `j := `i;\n        `i := @(`i + 1);\n        dispose `j;\n        dispose (`j + 1)\n      od\n    \\<lbrace> emp \\<rbrace>\"\nby hoare (sep_safe, (rule deallocI, auto | sep_auto))+\n\ndeclare sl_frame [sl]\n\nlemma \"\\<turnstile> \\<lbrace> llist xs i \\<rbrace>\n      `j := 0;\n      while `i \\<noteq> 0 \n      inv EXS as bs. (llist as i * llist bs j) * \\<langle>rev xs = rev as @ bs\\<rangle>\n      do\n        \\<lbrace> EXS A B a k. (i \\<mapsto> $a, $k) * llist A $k * llist B j * \\<langle>rev xs = (rev (a#A)) @ B\\<rangle> * \\<langle>`i \\<noteq> 0\\<rangle> \\<rbrace>\n        `k := @(`i + 1); \n        @(`i + 1) := `j\n        \\<lbrace> EXS A B a. (i \\<mapsto> $a, j) * llist A k * llist B j * \\<langle>rev xs = (rev (a#A)) @ B\\<rangle> * \\<langle>`i \\<noteq> 0\\<rangle> \\<rbrace>;\n        `j := `i;\n        `i := `k\n      od\n      \\<lbrace> llist (rev xs) j \\<rbrace>\"\nby (hoare; sep_safe) sep_auto+\n\nend", "meta": {"author": "victorgomes", "repo": "veritas", "sha": "d0b50770f9146f18713a690b87dc8fafa6a87580", "save_path": "github-repos/isabelle/victorgomes-veritas", "path": "github-repos/isabelle/victorgomes-veritas/veritas-d0b50770f9146f18713a690b87dc8fafa6a87580/SL/ListReversal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544335934766, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.3115385026732614}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |                    May 2005               |\n            |                   June 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2016         |\n            |                    May 2016  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2017         |\n            |                  April 2018  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_T_op_rep_par\nimports CSP_T_op_alpha_par\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n\n(* no simp rules in Isabelle 2017 \ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n*)\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite (notick | t = <>)                  *)\n(*                                                                     *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*============================================================*\n |                                                            |\n |            replicated alphabetized parallel                |\n |                                                            |\n *============================================================*)\n\n(*** traces Inductive_parallel ***)\n\nlemma in_traces_Inductive_parallel_lm1: \n  \"(P, X) : set PXs ==> X <= Union (snd ` (set PXs))\"\nby (auto)\n\n(* main *)\n\nlemma in_traces_Inductive_parallel_lm:\n  \"PXs ~= [] --> (ALL u.\n    (u :t traces ([||] PXs) M) =\n     (sett(u) <= insert Tick (Ev ` (Union (snd ` (set PXs)))) & \n      (ALL P X. (P,X):(set PXs) --> (u rest-tr X) :t traces P M)))\"\napply (induct_tac PXs)\n\n(* case 0 *)\n apply (simp)\n\n(* case 1 *)\n apply (case_tac \"list = []\")\n apply (simp)\n apply (intro allI)\n apply (simp add: in_traces_Alpha_parallel in_traces)\n apply (simp add: pair_eq_decompo)\n apply (simp add: rest_tr_empty)\n apply (rule iffI)\n (* => *)\n  apply (simp)\n (* <= *)\n  apply (simp)\n\n(* step case *)\napply (simp add: in_traces_Alpha_parallel)\napply (intro allI impI)\napply (rule iffI)\n\n(* => *)\n apply (simp)\n apply (intro allI)\n apply (rule conjI)\n\n  apply (intro impI)\n  apply (simp add: pair_eq_decompo)\n\n  apply (intro impI)\n  apply (elim conjE)\n  apply (drule_tac x=\"P\" in spec)\n  apply (drule_tac x=\"X\" in spec)\n  apply (subgoal_tac \"X <= Union (snd ` set list)\")\n  apply (simp add: rest_tr_of_rest_tr_subset)\n  apply (simp add: in_traces_Inductive_parallel_lm1)\n\n(* <= *)\n apply (simp add: rest_tr_sett_subseteq_sett)\n apply (intro allI impI)\n apply (elim conjE)\n apply (drule_tac x=\"P\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (subgoal_tac \"X <= Union (snd ` set list)\")\n apply (simp add: rest_tr_of_rest_tr_subset)\n apply (simp add: in_traces_Inductive_parallel_lm1)\ndone\n\n(*** remove ALL ***)\n\nlemma in_traces_Inductive_parallel:\n  \"PXs ~= [] \n   ==> (u :t traces ([||] PXs) M) =\n       (sett(u) <= insert Tick (Ev ` (Union (snd ` (set PXs)))) & \n        (ALL P X. (P,X):(set PXs) --> (u rest-tr X) :t traces P M))\"\nby (simp add: in_traces_Inductive_parallel_lm)\n\n(*** Semantics for replicated alphabetized parallel on T ***)\n\nlemma traces_Inductive_parallel:\n  \"PXs ~= []\n   ==> traces ([||] PXs) M =\n       {u. sett(u) <= insert Tick (Ev ` (Union (snd ` (set PXs)))) & \n        (ALL P X. (P,X):(set PXs) --> (u rest-tr X) :t traces P M)}t\"\napply (simp add: in_traces_Inductive_parallel[THEN sym])\ndone\n\n(************************************\n |              traces              |\n ************************************)\n\nlemma sett_in_traces_Inductive_parallel:\n  \"[| PXs ~= [] ; t :t traces ([||] PXs) M |] \n   ==> sett t <= insert Tick (Ev ` Union (snd ` set PXs))\"\nby (simp add: in_traces_Inductive_parallel)\n\n(*---------------------------------------------------------*\n |        another expression of Inductive_parallel_eval          |\n *---------------------------------------------------------*)\n\nlemma in_traces_Inductive_parallel_nth:\n  \"PXs ~= [] \n   ==> (u :t traces ([||] PXs) M) =\n       (sett(u) <= insert Tick (Ev ` (Union (snd ` (set PXs)))) & \n        (ALL i. i < length PXs --> (u rest-tr (snd (PXs!i))) :t traces (fst (PXs!i)) M))\"\napply (simp add: in_traces_Inductive_parallel)\napply (simp add: set_nth)\napply (simp add: pair_eq_decompo)\nby (auto)\n\n(*============================================================*\n |                                                            |\n |              indexed alphabetized parallel                 |\n |                                                            |\n *============================================================*)\n\n(*** index_style ***)\n\nlemma to_index_style_T:\n   \"(ALL P X. (P,X):(PXf ` I) --> (u rest-tr X) :t traces P M)\n  = (ALL i:I. u rest-tr (snd (PXf i)) :t traces (fst (PXf i)) M)\"\napply (auto)\napply (simp add: pair_eq_decompo)\ndone\n\n(*** in_traces_Rep_parallel (pre) ***)\n\nlemma in_traces_Rep_parallel_pre:\n  \"[| I ~= {} ; finite I |]\n   ==> (u :t traces ([||]:I PXf) M) =\n       (sett(u) <= insert Tick (Ev ` (Union (snd ` PXf ` I))) & \n        (ALL P X. (P,X):PXf ` I --> (u rest-tr X) :t traces P M))\"\napply (simp add: Rep_parallel_def)\napply (subgoal_tac \"EX Is. Is isListOf I\")\napply (elim conjE exE)\napply (subgoal_tac \"(map PXf (SOME Is. Is isListOf I)) ~= []\")\napply (simp add: in_traces in_traces_Inductive_parallel)\napply (rule someI2)\n apply (simp)\n apply (simp add: isListOf_set_eq)\n\napply (rule someI2)\n apply (simp)\n apply (simp add: isListOf_nonemptyset)\n\napply (simp add: isListOf_EX)\ndone\n\n(*** in_traces_Rep_parallel ***)\n\nlemma in_traces_Rep_parallel:\n  \"[| I ~= {} ; finite I |]\n   ==> (u :t traces ([||]:I PXf) M) =\n       (sett(u) <= insert Tick (Ev ` (Union (snd ` PXf ` I))) & \n        (ALL i:I. (u rest-tr (snd (PXf i))) :t traces (fst (PXf i)) M))\"\napply (simp add: in_traces_Rep_parallel_pre)\napply (simp add: to_index_style_T)\ndone\n\nlemmas in_traces_par = in_traces_Alpha_parallel\n                       in_traces_Inductive_parallel\n                       in_traces_Rep_parallel\n\n(*** Semantics for indexed alphabetized parallel on T ***)\n\n(* declare[[simp_trace=false, simp_trace_depth_limit=100]] *)\n\nlemma traces_Rep_parallel:\n  \"[| I ~= {} ; finite I |]\n   ==> traces ([||]:I PXf) M =\n             {u. (sett(u) <= insert Tick (Ev ` (Union (snd ` PXf ` I))) & \n              (ALL i:I. (u rest-tr (snd (PXf i))) :t traces (fst (PXf i)) M))}t\"\n  (* using [[simp_trace=true]]*)\n  (* Modified for Isabelle 2017 *)\n    apply (simp del: UN_simps SUP_image \n                add: in_traces_Rep_parallel[THEN sym])\ndone\n\n(************************************\n |              traces              |\n ************************************)\n\nlemma sett_in_traces_Rep_parallel:\n  \"[| I ~= {} ; finite I ; t :t traces ([||]:I PXf) M |] \n   ==> sett t <= insert Tick (Ev ` Union (snd ` PXf ` I))\"\nby (simp add: in_traces_Rep_parallel)\n\n(****************** to add it again ******************)\n\ndeclare disj_not1   [simp]\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n(* 2017\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n*)\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_T/CSP_T_op_rep_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5736784074525098, "lm_q1q2_score": 0.31142894375484365}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"Signed Words\"\n\ntheory Signed_Words\nimports \"HOL-Word.Word\"\nbegin\n\ntext \\<open>Signed words as separate (isomorphic) word length class. Useful for tagging words in C.\\<close>\n\ntypedef ('a::len0) signed = \"UNIV :: 'a set\" ..\n\nlemma card_signed [simp]: \"CARD (('a::len0) signed) = CARD('a)\"\n  unfolding type_definition.card [OF type_definition_signed]\n  by simp\n\ninstantiation signed :: (len0) len0\nbegin\n\ndefinition\n  len_signed [simp]: \"len_of (x::'a::len0 signed itself) = len_of TYPE('a)\"\n\ninstance ..\n\nend\n\ninstance signed :: (len) len\n  by (intro_classes, simp)\n\ntype_synonym 'a sword = \"'a signed word\"\ntype_synonym  sword8 =  \"8 sword\"\ntype_synonym sword16 = \"16 sword\"\ntype_synonym sword32 = \"32 sword\"\ntype_synonym sword64 = \"64 sword\"\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/Word_Lib/Signed_Words.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3114289437548436}}
{"text": "theory AList_Extra\n  imports \"HOL-Library.AList\" List_util\nbegin\n\nlemma list_all2_rel_prod_updateI:\n  assumes \"list_all2 (rel_prod (=) R) xs ys\" and \"R xval yval\"\n  shows \"list_all2 (rel_prod (=) R) (AList.update k xval xs) (AList.update k yval ys)\"\n  using assms(1,1,2)\n  by (induction xs ys rule: list.rel_induct) auto\n\nlemma length_map_entry[simp]: \"length (AList.map_entry k f al) = length al\"\n  by (induction al) simp_all\n\nlemma map_entry_id0[simp]: \"AList.map_entry k id = id\"\nproof (rule ext)\n  fix xs\n  show \"AList.map_entry k id xs = id xs\"\n    by (induction xs) auto\nqed\n\nlemma map_entry_id: \"AList.map_entry k id xs = xs\"\n  by simp\n\nlemma map_entry_map_of_Some_conv:\n  \"map_of xs k = Some v \\<Longrightarrow> AList.map_entry k f xs = AList.update k (f v) xs\"\n  by (induction xs) auto\n\nlemma map_entry_map_of_None_conv:\n  \"map_of xs k = None \\<Longrightarrow> AList.map_entry k f xs = xs\"\n  by (induction xs) auto\n\nlemma list_all2_rel_prod_map_entry:\n  assumes\n    \"list_all2 (rel_prod (=) R) xs ys\" and\n    \"\\<And>xval yval. map_of xs k = Some xval \\<Longrightarrow> map_of ys k = Some yval \\<Longrightarrow> R (f xval) (g yval)\"\n  shows \"list_all2 (rel_prod (=) R) (AList.map_entry k f xs) (AList.map_entry k g ys)\"\n  using assms(1)[THEN rel_option_map_of, of k]\nproof (cases rule: option.rel_cases)\n  case None\n  thus ?thesis\n    using assms(1) by (simp add: map_entry_map_of_None_conv)\nnext\n  case (Some xval yval)\n  then show ?thesis\n    using assms(1,2)\n    by (auto simp add: map_entry_map_of_Some_conv intro!: list_all2_rel_prod_updateI)\nqed\n\nlemmas list_all2_rel_prod_map_entry1 = list_all2_rel_prod_map_entry[where g = id, simplified]\nlemmas list_all2_rel_prod_map_entry2 = list_all2_rel_prod_map_entry[where f = id, simplified]\n\nlemma list_all_updateI:\n  assumes \"list_all P xs\" and \"P (k, v)\"\n  shows \"list_all P (AList.update k v xs)\"\n  using assms\n  by (induction xs) auto\n\nlemma set_update: \"set (AList.update k v xs) \\<subseteq> {(k, v)} \\<union> set xs\"\n  by (induction xs) auto\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Interpreter_Optimizations/AList_Extra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3114289437548436}}
{"text": "theory Validity\nimports\n  Transition_System\n  Formula\nbegin\n\nsection \\<open>Validity\\<close>\n\ntext \\<open>The following is needed to prove termination of~@{term validTree}.\\<close>\n\ndefinition alpha_Tree_rel where\n  \"alpha_Tree_rel \\<equiv> {(x,y). x =\\<^sub>\\<alpha> y}\"\n\nlemma alpha_Tree_relI [simp]:\n  assumes \"x =\\<^sub>\\<alpha> y\" shows \"(x,y) \\<in> alpha_Tree_rel\"\nusing assms unfolding alpha_Tree_rel_def by simp\n\nlemma alpha_Tree_relE:\n  assumes \"(x,y) \\<in> alpha_Tree_rel\" and \"x =\\<^sub>\\<alpha> y \\<Longrightarrow> P\"\n  shows P\nusing assms unfolding alpha_Tree_rel_def by simp\n\nlemma wf_alpha_Tree_rel_hull_rel_Tree_wf:\n  \"wf (alpha_Tree_rel O hull_rel O Tree_wf)\"\nproof (rule wf_relcomp_compatible)\n  show \"wf (hull_rel O Tree_wf)\"\n    by (metis Tree_wf_eqvt' wf_Tree_wf wf_hull_rel_relcomp)\nnext\n  show \"(hull_rel O Tree_wf) O alpha_Tree_rel \\<subseteq> alpha_Tree_rel O (hull_rel O Tree_wf)\"\n  proof\n    fix x :: \"('d, 'e, 'f) Tree \\<times> ('d, 'e, 'f) Tree\"\n    assume \"x \\<in> (hull_rel O Tree_wf) O alpha_Tree_rel\"\n    then obtain x1 x2 x3 x4 where x: \"x = (x1,x4)\" and 1: \"(x1,x2) \\<in> hull_rel\" and 2: \"(x2,x3) \\<in> Tree_wf\" and 3: \"(x3,x4) \\<in> alpha_Tree_rel\"\n      by auto\n    from 2 have \"(x1,x4) \\<in> alpha_Tree_rel O hull_rel O Tree_wf\"\n      using 1 and 3 proof (induct rule: Tree_wf.induct)\n        \\<comment> \\<open>@{const tConj}\\<close>\n        fix t and tset :: \"('d,'e,'f) Tree set['d]\"\n        assume *: \"t \\<in> set_bset tset\" and **: \"(x1,t) \\<in> hull_rel\" and ***: \"(tConj tset, x4) \\<in> alpha_Tree_rel\"\n        from \"**\" obtain p where x1: \"x1 = p \\<bullet> t\"\n          using hull_rel.cases by blast\n        from \"***\" have \"tConj tset =\\<^sub>\\<alpha> x4\"\n          by (rule alpha_Tree_relE)\n        then obtain tset' where x4: \"x4 = tConj tset'\" and \"rel_bset (=\\<^sub>\\<alpha>) tset tset'\"\n          by (cases \"x4\") simp_all\n        with \"*\" obtain t' where t': \"t' \\<in> set_bset tset'\" and \"t =\\<^sub>\\<alpha> t'\"\n          by (metis rel_bset.rep_eq rel_set_def)\n        with x1 have \"(x1, p \\<bullet> t') \\<in> alpha_Tree_rel\"\n          by (metis Tree\\<^sub>\\<alpha>.abs_eq_iff alpha_Tree_relI permute_Tree\\<^sub>\\<alpha>.abs_eq)\n        moreover have \"(p \\<bullet> t', t') \\<in> hull_rel\"\n          by (rule hull_rel.intros)\n        moreover from x4 and t' have \"(t', x4) \\<in> Tree_wf\"\n          by (simp add: Tree_wf.intros(1))\n        ultimately show \"(x1,x4) \\<in> alpha_Tree_rel O hull_rel O Tree_wf\"\n          by auto\n      next\n        \\<comment> \\<open>@{const tNot}\\<close>\n        fix t\n        assume *: \"(x1,t) \\<in> hull_rel\" and **: \"(tNot t, x4) \\<in> alpha_Tree_rel\"\n        from \"*\" obtain p where x1: \"x1 = p \\<bullet> t\"\n          using hull_rel.cases by blast\n        from \"**\" have \"tNot t =\\<^sub>\\<alpha> x4\"\n          by (rule alpha_Tree_relE)\n        then obtain t' where x4: \"x4 = tNot t'\" and \"t =\\<^sub>\\<alpha> t'\"\n          by (cases \"x4\") simp_all\n        with x1 have \"(x1, p \\<bullet> t') \\<in> alpha_Tree_rel\"\n          by (metis Tree\\<^sub>\\<alpha>.abs_eq_iff alpha_Tree_relI permute_Tree\\<^sub>\\<alpha>.abs_eq x1)\n        moreover have \"(p \\<bullet> t', t') \\<in> hull_rel\"\n          by (rule hull_rel.intros)\n        moreover from x4 have \"(t', x4) \\<in> Tree_wf\"\n          using Tree_wf.intros(2) by blast\n        ultimately show \"(x1,x4) \\<in> alpha_Tree_rel O hull_rel O Tree_wf\"\n          by auto\n      next\n        \\<comment> \\<open>@{const tAct}\\<close>\n        fix \\<alpha> t\n        assume *: \"(x1,t) \\<in> hull_rel\" and **: \"(tAct \\<alpha> t, x4) \\<in> alpha_Tree_rel\"\n        from \"*\" obtain p where x1: \"x1 = p \\<bullet> t\"\n          using hull_rel.cases by blast\n        from \"**\" have \"tAct \\<alpha> t =\\<^sub>\\<alpha> x4\"\n          by (rule alpha_Tree_relE)\n        then obtain q t' where x4: \"x4 = tAct (q \\<bullet> \\<alpha>) t'\" and \"q \\<bullet> t =\\<^sub>\\<alpha> t'\"\n          by (cases \"x4\") (auto simp add: alpha_set)\n        with x1 have \"(x1, p \\<bullet> -q \\<bullet> t') \\<in> alpha_Tree_rel\"\n          by (metis Tree\\<^sub>\\<alpha>.abs_eq_iff alpha_Tree_relI permute_Tree\\<^sub>\\<alpha>.abs_eq permute_minus_cancel(1))\n        moreover have \"(p \\<bullet> -q \\<bullet> t', t') \\<in> hull_rel\"\n          by (metis hull_rel.simps permute_plus)\n        moreover from x4 have \"(t', x4) \\<in> Tree_wf\"\n          by (simp add: Tree_wf.intros(3))\n        ultimately show \"(x1,x4) \\<in> alpha_Tree_rel O hull_rel O Tree_wf\"\n          by auto\n      qed\n    with x show \"x \\<in> alpha_Tree_rel O hull_rel O Tree_wf\"\n      by simp\n  qed\nqed\n\nlemma alpha_Tree_rel_relcomp_trivialI [simp]:\n  assumes \"(x, y) \\<in> R\"\n  shows \"(x, y) \\<in> alpha_Tree_rel O R\"\nusing assms unfolding alpha_Tree_rel_def\nby (metis Tree\\<^sub>\\<alpha>.abs_eq_iff case_prodI mem_Collect_eq relcomp.relcompI)\n\nlemma alpha_Tree_rel_relcompI [simp]:\n  assumes \"x =\\<^sub>\\<alpha> x'\" and \"(x', y) \\<in> R\"\n  shows \"(x, y) \\<in> alpha_Tree_rel O R\"\nusing assms unfolding alpha_Tree_rel_def\nby (metis case_prodI mem_Collect_eq relcomp.relcompI)\n\n\nsubsection \\<open>Validity for infinitely branching trees\\<close>\n\ncontext nominal_ts\nbegin\n\n  text \\<open>Since we defined formulas via a manual quotient construction, we also need to define\n  validity via lifting from the underlying type of infinitely branching trees. We cannot use\n  {\\bf nominal\\_function} because that generates proof obligations where, for formulas of the\n  form~@{term \"Conj xset\"}, the assumption that~@{term xset} has finite support is missing.\\<close>\n\n  declare conj_cong [fundef_cong]\n\n  function valid_Tree :: \"'state \\<Rightarrow> ('idx,'pred,'act) Tree \\<Rightarrow> bool\" where\n    \"valid_Tree P (tConj tset) \\<longleftrightarrow> (\\<forall>t\\<in>set_bset tset. valid_Tree P t)\"\n  | \"valid_Tree P (tNot t) \\<longleftrightarrow> \\<not> valid_Tree P t\"\n  | \"valid_Tree P (tPred \\<phi>) \\<longleftrightarrow> P \\<turnstile> \\<phi>\"\n  | \"valid_Tree P (tAct \\<alpha> t) \\<longleftrightarrow> (\\<exists>\\<alpha>' t' P'. tAct \\<alpha> t =\\<^sub>\\<alpha> tAct \\<alpha>' t' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> valid_Tree P' t')\"\n  by pat_completeness auto\n  termination proof\n    let ?R = \"inv_image (alpha_Tree_rel O hull_rel O Tree_wf) snd\"\n    {\n      show \"wf ?R\"\n        by (metis wf_alpha_Tree_rel_hull_rel_Tree_wf wf_inv_image)\n    next\n      fix P :: 'state and tset :: \"('idx,'pred,'act) Tree set['idx]\" and t\n      assume \"t \\<in> set_bset tset\" then show \"((P, t), (P, tConj tset)) \\<in> ?R\"\n        by (simp add: Tree_wf.intros(1))\n    next\n      fix P :: 'state and t :: \"('idx,'pred,'act) Tree\"\n      show \"((P, t), (P, tNot t)) \\<in> ?R\"\n        by (simp add: Tree_wf.intros(2))\n    next\n      fix P1 P2 :: 'state and \\<alpha>1 \\<alpha>2 :: 'act and t1 t2 :: \"('idx,'pred,'act) Tree\"\n      assume \"tAct \\<alpha>1 t1 =\\<^sub>\\<alpha> tAct \\<alpha>2 t2\"\n      then obtain p where \"t2 =\\<^sub>\\<alpha> p \\<bullet> t1\"\n        by (auto simp add: alphas) (metis alpha_Tree_symp sympE)\n      then show \"((P2, t2), (P1, tAct \\<alpha>1 t1)) \\<in> ?R\"\n        by (simp add: Tree_wf.intros(3))\n    }\n  qed\n\n  text \\<open>@{const valid_Tree} is equivariant.\\<close>\n\n  lemma valid_Tree_eqvt': \"valid_Tree P t \\<longleftrightarrow> valid_Tree (p \\<bullet> P) (p \\<bullet> t)\"\n  proof (induction P t rule: valid_Tree.induct)\n    case (1 P tset) show ?case\n      proof\n        assume *: \"valid_Tree P (tConj tset)\"\n        {\n          fix t\n          assume \"t \\<in> p \\<bullet> set_bset tset\"\n          with \"1.IH\" and \"*\" have \"valid_Tree (p \\<bullet> P) t\"\n            by (metis (no_types, lifting) imageE permute_set_eq_image valid_Tree.simps(1))\n        }\n        then show \"valid_Tree (p \\<bullet> P) (p \\<bullet> tConj tset)\"\n          by simp\n      next\n        assume *: \"valid_Tree (p \\<bullet> P) (p \\<bullet> tConj tset)\"\n        {\n          fix t\n          assume \"t \\<in> set_bset tset\"\n          with \"1.IH\" and \"*\" have \"valid_Tree P t\"\n            by (metis mem_permute_iff permute_Tree_tConj set_bset_eqvt valid_Tree.simps(1))\n        }\n        then show \"valid_Tree P (tConj tset)\"\n          by simp\n      qed\n  next\n    case 2 then show ?case by simp\n  next\n    case 3 show ?case by simp (metis permute_minus_cancel(2) satisfies_eqvt)\n  next\n    case (4 P \\<alpha> t) show ?case\n      proof\n        assume \"valid_Tree P (tAct \\<alpha> t)\"\n        then obtain \\<alpha>' t' P' where *: \"tAct \\<alpha> t =\\<^sub>\\<alpha> tAct \\<alpha>' t' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> valid_Tree P' t'\"\n          by auto\n        with \"4.IH\" have \"valid_Tree (p \\<bullet> P') (p \\<bullet> t')\"\n          by blast\n        moreover from \"*\" have \"p \\<bullet> P \\<rightarrow> \\<langle>p \\<bullet> \\<alpha>', p \\<bullet> P'\\<rangle>\"\n          by (metis transition_eqvt')\n        moreover from \"*\" have \"p \\<bullet> tAct \\<alpha> t =\\<^sub>\\<alpha> tAct (p \\<bullet> \\<alpha>') (p \\<bullet> t')\"\n          by (metis alpha_Tree_eqvt permute_Tree.simps(4))\n        ultimately show \"valid_Tree (p \\<bullet> P) (p \\<bullet> tAct \\<alpha> t)\"\n          by auto\n      next\n        assume \"valid_Tree (p \\<bullet> P) (p \\<bullet> tAct \\<alpha> t)\"\n        then obtain \\<alpha>' t' P' where *: \"p \\<bullet> tAct \\<alpha> t =\\<^sub>\\<alpha> tAct \\<alpha>' t' \\<and> (p \\<bullet> P) \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> valid_Tree P' t'\"\n          by auto\n        then have eq: \"tAct \\<alpha> t =\\<^sub>\\<alpha> tAct (-p \\<bullet> \\<alpha>') (-p \\<bullet> t')\"\n          by (metis alpha_Tree_eqvt permute_Tree.simps(4) permute_minus_cancel(2))\n        moreover from \"*\" have \"P \\<rightarrow> \\<langle>-p \\<bullet> \\<alpha>', -p \\<bullet> P'\\<rangle>\"\n          by (metis permute_minus_cancel(2) transition_eqvt')\n        moreover with \"4.IH\" have \"valid_Tree (-p \\<bullet> P') (-p \\<bullet> t')\"\n          using eq and \"*\" by simp\n        ultimately show \"valid_Tree P (tAct \\<alpha> t)\"\n          by auto\n      qed\n  qed\n\n  lemma valid_Tree_eqvt (*[eqvt]*):\n    assumes \"valid_Tree P t\" shows \"valid_Tree (p \\<bullet> P) (p \\<bullet> t)\"\n  using assms by (metis valid_Tree_eqvt')\n\n  text \\<open>$\\alpha$-equivalent trees validate the same states.\\<close>\n\n  lemma alpha_Tree_valid_Tree:\n    assumes \"t1 =\\<^sub>\\<alpha> t2\"\n    shows \"valid_Tree P t1 \\<longleftrightarrow> valid_Tree P t2\"\n  using assms proof (induction t1 t2 arbitrary: P rule: alpha_Tree_induct)\n    case tConj then show ?case\n      by auto (metis (mono_tags) rel_bset.rep_eq rel_set_def)+\n  next\n    case (tAct \\<alpha>1 t1 \\<alpha>2 t2) show ?case\n    proof\n      assume \"valid_Tree P (tAct \\<alpha>1 t1)\"\n      then obtain \\<alpha>' t' P' where \"tAct \\<alpha>1 t1 =\\<^sub>\\<alpha> tAct \\<alpha>' t' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> valid_Tree P' t'\"\n        by auto\n      moreover from tAct.hyps have \"tAct \\<alpha>1 t1 =\\<^sub>\\<alpha> tAct \\<alpha>2 t2\"\n        using alpha_tAct by blast\n      ultimately show \"valid_Tree P (tAct \\<alpha>2 t2)\"\n        by (metis Tree\\<^sub>\\<alpha>.abs_eq_iff valid_Tree.simps(4))\n    next\n      assume \"valid_Tree P (tAct \\<alpha>2 t2)\"\n      then obtain \\<alpha>' t' P' where \"tAct \\<alpha>2 t2 =\\<^sub>\\<alpha> tAct \\<alpha>' t' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> valid_Tree P' t'\"\n        by auto\n      moreover from tAct.hyps have \"tAct \\<alpha>1 t1 =\\<^sub>\\<alpha> tAct \\<alpha>2 t2\"\n        using alpha_tAct by blast\n      ultimately show \"valid_Tree P (tAct \\<alpha>1 t1)\"\n        by (metis Tree\\<^sub>\\<alpha>.abs_eq_iff valid_Tree.simps(4))\n    qed\n  qed simp_all\n\n\n  subsection \\<open>Validity for trees modulo \\texorpdfstring{$\\alpha$}{alpha}-equivalence\\<close>\n\n  lift_definition valid_Tree\\<^sub>\\<alpha> :: \"'state \\<Rightarrow> ('idx,'pred,'act) Tree\\<^sub>\\<alpha> \\<Rightarrow> bool\" is\n    valid_Tree\n  by (fact alpha_Tree_valid_Tree)\n\n  lemma valid_Tree\\<^sub>\\<alpha>_eqvt (*[eqvt]*):\n    assumes \"valid_Tree\\<^sub>\\<alpha> P t\" shows \"valid_Tree\\<^sub>\\<alpha> (p \\<bullet> P) (p \\<bullet> t)\"\n  using assms by transfer (fact valid_Tree_eqvt)\n\n  lemma valid_Tree\\<^sub>\\<alpha>_Conj\\<^sub>\\<alpha> [simp]: \"valid_Tree\\<^sub>\\<alpha> P (Conj\\<^sub>\\<alpha> tset\\<^sub>\\<alpha>) \\<longleftrightarrow> (\\<forall>t\\<^sub>\\<alpha>\\<in>set_bset tset\\<^sub>\\<alpha>. valid_Tree\\<^sub>\\<alpha> P t\\<^sub>\\<alpha>)\"\n  proof -\n    have \"valid_Tree P (rep_Tree\\<^sub>\\<alpha> (abs_Tree\\<^sub>\\<alpha> (tConj (map_bset rep_Tree\\<^sub>\\<alpha> tset\\<^sub>\\<alpha>)))) \\<longleftrightarrow> valid_Tree P (tConj (map_bset rep_Tree\\<^sub>\\<alpha> tset\\<^sub>\\<alpha>))\"\n      by (metis Tree\\<^sub>\\<alpha>_rep_abs alpha_Tree_valid_Tree)\n    then show ?thesis\n      by (simp add: valid_Tree\\<^sub>\\<alpha>_def Conj\\<^sub>\\<alpha>_def map_bset.rep_eq)\n  qed\n\n  lemma valid_Tree\\<^sub>\\<alpha>_Not\\<^sub>\\<alpha> [simp]: \"valid_Tree\\<^sub>\\<alpha> P (Not\\<^sub>\\<alpha> t\\<^sub>\\<alpha>) \\<longleftrightarrow> \\<not> valid_Tree\\<^sub>\\<alpha> P t\\<^sub>\\<alpha>\"\n  by transfer simp\n\n  lemma valid_Tree\\<^sub>\\<alpha>_Pred\\<^sub>\\<alpha> [simp]: \"valid_Tree\\<^sub>\\<alpha> P (Pred\\<^sub>\\<alpha> \\<phi>) \\<longleftrightarrow> P \\<turnstile> \\<phi>\"\n  by transfer simp\n\n  lemma valid_Tree\\<^sub>\\<alpha>_Act\\<^sub>\\<alpha> [simp]: \"valid_Tree\\<^sub>\\<alpha> P (Act\\<^sub>\\<alpha> \\<alpha> t\\<^sub>\\<alpha>) \\<longleftrightarrow> (\\<exists>\\<alpha>' t\\<^sub>\\<alpha>' P'. Act\\<^sub>\\<alpha> \\<alpha> t\\<^sub>\\<alpha> = Act\\<^sub>\\<alpha> \\<alpha>' t\\<^sub>\\<alpha>' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> valid_Tree\\<^sub>\\<alpha> P' t\\<^sub>\\<alpha>')\"\n  proof\n    assume \"valid_Tree\\<^sub>\\<alpha> P (Act\\<^sub>\\<alpha> \\<alpha> t\\<^sub>\\<alpha>)\"\n    moreover have \"Act\\<^sub>\\<alpha> \\<alpha> t\\<^sub>\\<alpha> = abs_Tree\\<^sub>\\<alpha> (tAct \\<alpha> (rep_Tree\\<^sub>\\<alpha> t\\<^sub>\\<alpha>))\"\n      by (metis Act\\<^sub>\\<alpha>.abs_eq Tree\\<^sub>\\<alpha>_abs_rep)\n    ultimately show \"\\<exists>\\<alpha>' t\\<^sub>\\<alpha>' P'. Act\\<^sub>\\<alpha> \\<alpha> t\\<^sub>\\<alpha> = Act\\<^sub>\\<alpha> \\<alpha>' t\\<^sub>\\<alpha>' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> valid_Tree\\<^sub>\\<alpha> P' t\\<^sub>\\<alpha>'\"\n      by (metis Act\\<^sub>\\<alpha>.abs_eq Tree\\<^sub>\\<alpha>.abs_eq_iff valid_Tree.simps(4) valid_Tree\\<^sub>\\<alpha>.abs_eq)\n  next\n    assume \"\\<exists>\\<alpha>' t\\<^sub>\\<alpha>' P'. Act\\<^sub>\\<alpha> \\<alpha> t\\<^sub>\\<alpha> = Act\\<^sub>\\<alpha> \\<alpha>' t\\<^sub>\\<alpha>' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> valid_Tree\\<^sub>\\<alpha> P' t\\<^sub>\\<alpha>'\"\n    moreover have \"\\<And>\\<alpha>' t\\<^sub>\\<alpha>'. Act\\<^sub>\\<alpha> \\<alpha>' t\\<^sub>\\<alpha>' = abs_Tree\\<^sub>\\<alpha> (tAct \\<alpha>' (rep_Tree\\<^sub>\\<alpha> t\\<^sub>\\<alpha>'))\"\n      by (metis Act\\<^sub>\\<alpha>.abs_eq Tree\\<^sub>\\<alpha>_abs_rep)\n    ultimately show \"valid_Tree\\<^sub>\\<alpha> P (Act\\<^sub>\\<alpha> \\<alpha> t\\<^sub>\\<alpha>)\"\n      by (metis Tree\\<^sub>\\<alpha>.abs_eq_iff valid_Tree.simps(4) valid_Tree\\<^sub>\\<alpha>.abs_eq valid_Tree\\<^sub>\\<alpha>.rep_eq)\n  qed\n\n\n  subsection \\<open>Validity for infinitary formulas\\<close>\n\n  lift_definition valid :: \"'state \\<Rightarrow> ('idx,'pred,'act) formula \\<Rightarrow> bool\" (infix \"\\<Turnstile>\" 70) is\n    valid_Tree\\<^sub>\\<alpha>\n  .\n\n  lemma valid_eqvt (*[eqvt]*):\n    assumes \"P \\<Turnstile> x\" shows \"(p \\<bullet> P) \\<Turnstile> (p \\<bullet> x)\"\n  using assms by transfer (metis valid_Tree\\<^sub>\\<alpha>_eqvt)\n\n  lemma valid_Conj [simp]:\n    assumes \"finite (supp xset)\"\n    shows \"P \\<Turnstile> Conj xset \\<longleftrightarrow> (\\<forall>x\\<in>set_bset xset. P \\<Turnstile> x)\"\n  using assms by (simp add: valid_def Conj_def map_bset.rep_eq)\n\n  lemma valid_Not [simp]: \"P \\<Turnstile> Not x \\<longleftrightarrow> \\<not> P \\<Turnstile> x\"\n  by transfer simp\n\n  lemma valid_Pred [simp]: \"P \\<Turnstile> Pred \\<phi> \\<longleftrightarrow> P \\<turnstile> \\<phi>\"\n  by transfer simp\n\n  lemma valid_Act: \"P \\<Turnstile> Act \\<alpha> x \\<longleftrightarrow> (\\<exists>\\<alpha>' x' P'. Act \\<alpha> x = Act \\<alpha>' x' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> P' \\<Turnstile> x')\"\n  proof\n    assume \"P \\<Turnstile> Act \\<alpha> x\"\n    moreover have \"Rep_formula (Abs_formula (Act\\<^sub>\\<alpha> \\<alpha> (Rep_formula x))) = Act\\<^sub>\\<alpha> \\<alpha> (Rep_formula x)\"\n      by (metis Act.rep_eq Rep_formula_inverse)\n    ultimately show \"\\<exists>\\<alpha>' x' P'. Act \\<alpha> x = Act \\<alpha>' x' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> P' \\<Turnstile> x'\"\n      by (auto simp add: valid_def Act_def) (metis Abs_formula_inverse Rep_formula' hereditarily_fs_alpha_renaming)\n  next\n    assume \"\\<exists>\\<alpha>' x' P'. Act \\<alpha> x = Act \\<alpha>' x' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> P' \\<Turnstile> x'\"\n    then show \"P \\<Turnstile> Act \\<alpha> x\"\n      by (metis Act.rep_eq valid.rep_eq valid_Tree\\<^sub>\\<alpha>_Act\\<^sub>\\<alpha>)\n  qed\n\n  text \\<open>The binding names in the alpha-variant that witnesses validity may be chosen fresh for any\n  finitely supported context.\\<close>\n\n  lemma valid_Act_strong:\n    assumes \"finite (supp X)\"\n    shows \"P \\<Turnstile> Act \\<alpha> x \\<longleftrightarrow> (\\<exists>\\<alpha>' x' P'. Act \\<alpha> x = Act \\<alpha>' x' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> P' \\<Turnstile> x' \\<and> bn \\<alpha>' \\<sharp>* X)\"\n  proof\n    assume \"P \\<Turnstile> Act \\<alpha> x\"\n    then obtain \\<alpha>' x' P' where eq: \"Act \\<alpha> x = Act \\<alpha>' x'\" and trans: \"P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle>\" and valid: \"P' \\<Turnstile> x'\"\n      by (metis valid_Act)\n    have \"finite (bn \\<alpha>')\"\n      by (fact bn_finite)\n    moreover note \\<open>finite (supp X)\\<close>\n    moreover have \"finite (supp (Act \\<alpha>' x', \\<langle>\\<alpha>',P'\\<rangle>))\"\n      by (metis finite_Diff finite_UnI finite_supp supp_Pair supp_abs_residual_pair)\n    moreover have \"bn \\<alpha>' \\<sharp>* (Act \\<alpha>' x', \\<langle>\\<alpha>',P'\\<rangle>)\"\n      by (auto simp add: fresh_star_def fresh_def supp_Pair supp_abs_residual_pair)\n    ultimately obtain p where fresh_X: \"(p \\<bullet> bn \\<alpha>') \\<sharp>* X\" and \"supp (Act \\<alpha>' x', \\<langle>\\<alpha>',P'\\<rangle>) \\<sharp>* p\"\n      by (metis at_set_avoiding2)\n    then have \"supp (Act \\<alpha>' x') \\<sharp>* p\" and \"supp \\<langle>\\<alpha>',P'\\<rangle> \\<sharp>* p\"\n      by (metis fresh_star_Un supp_Pair)+\n    then have \"Act (p \\<bullet> \\<alpha>') (p \\<bullet> x') = Act \\<alpha>' x'\" and \"\\<langle>p \\<bullet> \\<alpha>', p \\<bullet> P'\\<rangle> = \\<langle>\\<alpha>',P'\\<rangle>\"\n      by (metis Act_eqvt supp_perm_eq, metis abs_residual_pair_eqvt supp_perm_eq)\n    then show \"\\<exists>\\<alpha>' x' P'. Act \\<alpha> x = Act \\<alpha>' x' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> P' \\<Turnstile> x' \\<and> bn \\<alpha>' \\<sharp>* X\"\n      using eq and trans and valid and fresh_X by (metis bn_eqvt valid_eqvt)\n  next\n    assume \"\\<exists>\\<alpha>' x' P'. Act \\<alpha> x = Act \\<alpha>' x' \\<and> P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle> \\<and> P' \\<Turnstile> x' \\<and> bn \\<alpha>' \\<sharp>* X\"\n    then show \"P \\<Turnstile> Act \\<alpha> x\"\n      by (metis valid_Act)\n  qed\n\n  lemma valid_Act_fresh:\n    assumes \"bn \\<alpha> \\<sharp>* P\"\n    shows \"P \\<Turnstile> Act \\<alpha> x \\<longleftrightarrow> (\\<exists>P'. P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle> \\<and> P' \\<Turnstile> x)\"\n  proof\n    assume \"P \\<Turnstile> Act \\<alpha> x\"\n\n    moreover have \"finite (supp P)\"\n      by (fact finite_supp)\n    ultimately obtain \\<alpha>' x' P' where\n      eq: \"Act \\<alpha> x = Act \\<alpha>' x'\" and trans: \"P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle>\" and valid: \"P' \\<Turnstile> x'\" and fresh: \"bn \\<alpha>' \\<sharp>* P\"\n      by (metis valid_Act_strong)\n\n    from eq obtain p where p_\\<alpha>: \"\\<alpha>' = p \\<bullet> \\<alpha>\" and p_x: \"x' = p \\<bullet> x\" and supp_p: \"supp p \\<subseteq> bn \\<alpha> \\<union> p \\<bullet> bn \\<alpha>\"\n      by (metis Act_eq_iff_perm_renaming)\n\n    from assms and fresh have \"(bn \\<alpha> \\<union> p \\<bullet> bn \\<alpha>) \\<sharp>* P\"\n      using p_\\<alpha> by (metis bn_eqvt fresh_star_Un)\n    then have \"supp p \\<sharp>* P\"\n      using supp_p by (metis fresh_star_def subset_eq)\n    then have p_P: \"-p \\<bullet> P = P\"\n      by (metis perm_supp_eq supp_minus_perm)\n\n    from trans have \"P \\<rightarrow> \\<langle>\\<alpha>,-p \\<bullet> P'\\<rangle>\"\n      using p_P p_\\<alpha> by (metis permute_minus_cancel(1) transition_eqvt')\n    moreover from valid have \"-p \\<bullet> P' \\<Turnstile> x\"\n      using p_x by (metis permute_minus_cancel(1) valid_eqvt)\n    ultimately show \"\\<exists>P'. P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle> \\<and> P' \\<Turnstile> x\"\n      by meson\n  next\n    assume \"\\<exists>P'. P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle> \\<and> P' \\<Turnstile> x\" then show \"P \\<Turnstile> Act \\<alpha> x\"\n      by (metis valid_Act)\n  qed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Modal_Logics_for_NTS/Validity.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3114289437548436}}
{"text": "section \\<open>Compasitionality of the during-execution security notions\\<close> \n\ntheory Compositionality imports During_Execution begin\n\n\n(*******************************************)\ncontext PL_Indis \nbegin \n\n(* The end-product compositionality results are listed as theorems \n(as opposed to lemmas). *)\n\nsubsection \\<open>Discreetness versus language constructs:\\<close>\n\ntheorem discr_Atm[simp]:\n\"discr (Atm atm) = presAtm atm\"  \nproof-    \n  {fix c\n   have \n   \"(\\<exists> atm. c = Atm atm \\<and> presAtm atm) \n    \\<Longrightarrow> discr c\"\n   apply(erule discr_coind) \n   apply (metis Atm_transC_invert)\n   by (metis PL.Atm_transT_invert presAtm_def)\n  }\n  moreover have \"discr (Atm atm) \\<Longrightarrow> presAtm atm\"\n    by (metis Atm presAtm_def discr_transT)\n  ultimately show ?thesis by blast\nqed\n\ntheorem discr_If[simp]:\nassumes \"discr c1\" and \"discr c2\"\nshows \"discr (If tst c1 c2)\"\nproof-    \n  {fix c\n   have \n   \"(\\<exists> tst c1 c2. c = If tst c1 c2 \\<and> discr c1 \\<and> discr c2) \\<Longrightarrow> discr c\"\n   apply(erule discr_coind) \n   apply (metis PL.If_transC_invert indis_refl)\n   by (metis If_transT_invert)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr_Seq[simp]:\nassumes *: \"discr c1\" and **: \"discr c2\"\nshows \"discr (c1 ;; c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = c1 ;; c2 \\<and> discr c1 \\<and> discr c2) \n    \\<Longrightarrow> discr c\"\n   apply(erule discr_coind) \n   proof(tactic\\<open>clarify_all_tac @{context}\\<close>)\n     fix c s c' s' c1 c2\n     assume c1: \"discr c1\" and c2: \"discr c2\" \n     assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n     thus \"s \\<approx> s' \\<and> ((\\<exists>c1 c2. c' = c1 ;; c2 \\<and> discr c1 \\<and> discr c2) \\<or> discr c')\"\n     apply - apply(erule Seq_transC_invert)\n     apply (metis c1 c2 discr_transC discr_transC_indis)\n     by (metis c1 c2 discr.cases)\n   qed (insert Seq_transT_invert, blast)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr_While[simp]:\nassumes \"discr c\"\nshows \"discr (While tst c)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> tst d. c = While tst d \\<and> discr d) \\<or> \n    (\\<exists> tst d1 d. c = d1 ;; (While tst d) \\<and> discr d1 \\<and> discr d)\n    \\<Longrightarrow> discr c\"\n   apply(erule discr_coind)\n   apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n   apply (metis While_transC_invert indis_refl)\n   apply (metis Seq_transC_invert discr.cases)\n   apply (metis While_transC_invert)\n   apply (metis Seq_transC_invert discr.cases)\n   apply (metis PL.While_transT_invert indis_refl)\n   by (metis Seq_transT_invert)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr_Par[simp]:\nassumes *: \"discr c1\" and **: \"discr c2\"\nshows \"discr (Par c1 c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = Par c1 c2 \\<and> discr c1 \\<and> discr c2) \n    \\<Longrightarrow> discr c\"\n   apply(erule discr_coind) \n   proof(tactic\\<open>clarify_all_tac @{context}\\<close>)\n     fix c s c' s' c1 c2\n     assume c1: \"discr c1\" and c2: \"discr c2\" \n     assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n     thus \"s \\<approx> s' \\<and> ((\\<exists>c1 c2. c' = Par c1 c2 \\<and> discr c1 \\<and> discr c2) \\<or> discr c')\"\n     apply - apply(erule Par_transC_invert)\n     by(metis c1 c2 discr.cases)+\n   qed\n  }\n  thus ?thesis using assms by blast\nqed\n\n\nsubsection \\<open>Discreetness versus language constructs:\\<close>\n\ntheorem discr0_Atm[simp]:\n\"discr0 (Atm atm) = presAtm atm\"  \nproof-    \n  {fix c\n   have \n   \"(\\<exists> atm. c = Atm atm \\<and> presAtm atm) \n    \\<Longrightarrow> discr0 c\"\n   apply(erule discr0_coind) \n   apply (metis Atm_transC_invert)\n   by (metis discr_Atm discr_transT)\n  }\n  moreover have \"discr0 (Atm atm) \\<Longrightarrow> presAtm atm\"\n  by (metis Atm discr0_MtransT presAtm_def mustT_Atm transT_MtransT)\n  ultimately show ?thesis by blast\nqed\n\ntheorem discr0_If[simp]:\nassumes \"discr0 c1\" and \"discr0 c2\"\nshows \"discr0 (If tst c1 c2)\"\nproof-    \n  {fix c\n   have \n   \"(\\<exists> tst c1 c2. c = If tst c1 c2 \\<and> discr0 c1 \\<and> discr0 c2) \\<Longrightarrow> discr0 c\"\n   apply(erule discr0_coind) \n   apply (metis If_transC_invert indis_refl)\n   by (metis If_transT_invert)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr0_Seq[simp]:\nassumes *: \"discr0 c1\" and **: \"discr0 c2\"\nshows \"discr0 (c1 ;; c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = c1 ;; c2 \\<and> discr0 c1 \\<and> discr0 c2) \n    \\<Longrightarrow> discr0 c\"\n   apply(erule discr0_coind) \n   proof(tactic\\<open>clarify_all_tac @{context}\\<close>)\n     fix c s c' s' c1 c2\n     assume mt: \"mustT (c1 ;; c2) s\" \n     and c1: \"discr0 c1\" and c2: \"discr0 c2\" \n     assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n     thus \"s \\<approx> s' \\<and> ((\\<exists>c1 c2. c' = c1 ;; c2 \\<and> discr0 c1 \\<and> discr0 c2) \\<or> discr0 c')\"\n     apply - apply(erule Seq_transC_invert)\n     apply (metis mustT_Seq_L c1 c2 discr0_MtransC discr0_MtransC_indis mt \n                  transC_MtransC)\n     by (metis c1 c2 discr0_transT mt mustT_Seq_L)\n   qed (insert Seq_transT_invert, blast)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr0_While[simp]:\nassumes \"discr0 c\"\nshows \"discr0 (While tst c)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> tst d. c = While tst d \\<and> discr0 d) \\<or> \n    (\\<exists> tst d1 d. c = d1 ;; (While tst d) \\<and> discr0 d1 \\<and> discr0 d)\n    \\<Longrightarrow> discr0 c\"\n   proof (induct rule: discr0_coind)\n     case (Term c s s')\n     thus \"s \\<approx> s'\" \n     apply (elim exE disjE conjE)\n     apply (metis While_transT_invert indis_refl)\n     by (metis Seq_transT_invert)\n   next\n     case (Cont c s c' s')\n     thus ?case\n     apply(intro conjI)\n     apply (elim exE disjE conjE)\n     apply (metis While_transC_invert indis_refl)\n     apply (metis Seq_transC_invert discr0_MtransC_indis discr0_transT \n                  mustT_Seq_L transC_MtransC)\n     (*  *)\n     apply (elim exE disjE conjE)\n     apply (metis While_transC_invert)\n     by (metis Cont(3) Seq_transC_invert discr0_transC mustT_Seq_L)\n   qed   \n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr0_Par[simp]:\nassumes *: \"discr0 c1\" and **: \"discr0 c2\"\nshows \"discr0 (Par c1 c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = Par c1 c2 \\<and> discr0 c1 \\<and> discr0 c2) \n    \\<Longrightarrow> discr0 c\"\n   apply(induct rule: discr0_coind) \n   proof(tactic\\<open>clarify_all_tac @{context}\\<close>)\n     fix c s c' s' c1 c2\n     assume mt: \"mustT (Par c1 c2) s\" and c1: \"discr0 c1\" and c2: \"discr0 c2\" \n     assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n     thus \"s \\<approx> s' \\<and> ((\\<exists>c1 c2. c' = Par c1 c2 \\<and> discr0 c1 \\<and> discr0 c2) \\<or> discr0 c')\"\n     apply(elim Par_transC_invert)\n     apply (metis c1 c2 discr0.simps mt mustT_Par_L)\n     apply (metis c1 c2 discr0_transT mt mustT_Par_L)\n     apply (metis c1 c2 discr0.simps indis_sym mt mustT_Par_R)\n     by (metis PL.mustT_Par_R c1 c2 discr0_transT mt)\n   qed\n  }\n  thus ?thesis using assms by blast\nqed\n\n\nsubsection \\<open>Self-Isomorphism versus language constructs:\\<close>\n\ntheorem siso_Atm[simp]:\n\"siso (Atm atm) = compatAtm atm\"  \nproof-    \n  {fix c\n   have \n   \"(\\<exists> atm. c = Atm atm \\<and> compatAtm atm) \n    \\<Longrightarrow> siso c\"\n   apply(erule siso_coind) \n   apply (metis Atm_transC_invert)\n   apply (metis PL.Atm_transC_invert)\n   by (metis Atm_transT_invert PL.Atm compatAtm_def)\n  }\n  moreover have \"siso (Atm atm) \\<Longrightarrow> compatAtm atm\" unfolding compatAtm_def\n  by (metis Atm Atm_transT_invert siso_transT)\n  ultimately show ?thesis by blast\nqed \n\ntheorem siso_If[simp]:\nassumes  \"compatTst tst\" and \"siso c1\" and \"siso c2\"\nshows \"siso (If tst c1 c2)\"\nproof-    \n  {fix c\n   have \n   \"(\\<exists> tst c1 c2. c = If tst c1 c2 \\<and> compatTst tst \\<and> siso c1 \\<and> siso c2) \\<Longrightarrow> siso c\"\n   apply(erule siso_coind) \n   apply (metis PL.If_transC_invert indis_refl)\n   apply (metis IfTrue PL.IfFalse PL.If_transC_invert compatTst_def)\n   by (metis If_transT_invert)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso_Seq[simp]:\nassumes *: \"siso c1\" and **: \"siso c2\"\nshows \"siso (c1 ;; c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = c1 ;; c2 \\<and> siso c1 \\<and> siso c2) \n    \\<Longrightarrow> siso c\"\n   apply(erule siso_coind) \n   proof(tactic\\<open>clarify_all_tac @{context}\\<close>)\n     fix c s t c' s' c1 c2\n     assume \"s \\<approx> t\" and \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\" and \"siso c1\" and \"siso c2\"\n     thus \"\\<exists>t'. s' \\<approx> t' \\<and> (c1 ;; c2, t) \\<rightarrow>c (c', t')\"\n     apply - apply(erule Seq_transC_invert)\n     apply (metis SeqC siso_transC_indis)\n     by (metis PL.SeqT siso_transT)\n   qed (insert Seq_transT_invert siso_transC, blast+)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso_While[simp]:\nassumes \"compatTst tst\" and \"siso c\"\nshows \"siso (While tst c)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> tst d. compatTst tst \\<and> c = While tst d \\<and> siso d) \\<or> \n    (\\<exists> tst d1 d. compatTst tst \\<and> c = d1 ;; (While tst d) \\<and> siso d1 \\<and> siso d)\n    \\<Longrightarrow> siso c\"\n   apply(erule siso_coind)\n   apply auto\n   apply (metis PL.Seq_transC_invert siso_transC)\n   apply (metis WhileTrue While_transC_invert compatTst_def)\n   apply (metis PL.SeqC siso_transC_indis)\n   apply (metis PL.SeqT siso_transT)\n   by (metis WhileFalse compatTst_def) \n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso_Par[simp]:\nassumes *: \"siso c1\" and **: \"siso c2\"\nshows \"siso (Par c1 c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = Par c1 c2 \\<and> siso c1 \\<and> siso c2) \n    \\<Longrightarrow> siso c\"\n   apply(erule siso_coind)\n   proof(tactic\\<open>clarify_all_tac @{context}\\<close>)\n     fix c s t c' s' c1 c2\n     assume \"s \\<approx> t\" and \"(Par c1 c2, s) \\<rightarrow>c (c', s')\" and c1: \"siso c1\" and c2: \"siso c2\"\n     thus \"\\<exists>t'. s' \\<approx> t' \\<and> (Par c1 c2, t) \\<rightarrow>c (c', t')\"\n     apply - apply(erule Par_transC_invert)\n     by(metis ParCL ParTL ParCR ParTR c1 c2 siso_transT siso_transC_indis)+   \n   qed (insert Par_transC_invert siso_transC Par_transT_invert, blast+)\n  }\n  thus ?thesis using assms by blast\nqed\n\n\nsubsection \\<open>Self-Isomorphism versus language constructs:\\<close>\n\ntheorem siso0_Atm[simp]:\n\"siso0 (Atm atm) = compatAtm atm\"  \nproof-    \n  {fix c\n   have \n   \"(\\<exists> atm. c = Atm atm \\<and> compatAtm atm) \n    \\<Longrightarrow> siso0 c\"\n   apply(erule siso0_coind) \n   apply (metis Atm_transC_invert)\n   apply (metis PL.Atm_transC_invert)\n   by (metis Atm_transT_invert PL.Atm compatAtm_def)\n  }\n  moreover have \"siso0 (Atm atm) \\<Longrightarrow> compatAtm atm\" unfolding compatAtm_def\n  by (metis Atm Atm_transT_invert siso0_transT mustT_Atm)\n  ultimately show ?thesis by blast\nqed \n\ntheorem siso0_If[simp]:\nassumes  \"compatTst tst\" and \"siso0 c1\" and \"siso0 c2\"\nshows \"siso0 (If tst c1 c2)\"\nproof-    \n  {fix c\n   have \n   \"(\\<exists> tst c1 c2. c = If tst c1 c2 \\<and> compatTst tst \\<and> siso0 c1 \\<and> siso0 c2) \\<Longrightarrow> siso0 c\"\n   apply(erule siso0_coind) \n   apply (metis PL.If_transC_invert indis_refl)\n   apply (metis IfTrue PL.IfFalse PL.If_transC_invert compatTst_def)\n   by (metis If_transT_invert)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso0_Seq[simp]:\nassumes *: \"siso0 c1\" and **: \"siso0 c2\"\nshows \"siso0 (c1 ;; c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = c1 ;; c2 \\<and> siso0 c1 \\<and> siso0 c2) \n    \\<Longrightarrow> siso0 c\"\n   proof (induct rule: siso0_coind)\n     case (Indef c s c' s')\n     thus ?case\n     by (metis Seq_transC_invert mustT_Seq_L siso0_transC) \n   next\n     case (Cont c s t c' s')\n     then obtain c1 c2\n     where c: \"c = c1 ;; c2\" and mt: \"mustT (c1 ;; c2) s\" \"mustT (c1 ;; c2) t\" \n     and st: \"s \\<approx> t\" and siso1: \"siso0 c1\" and siso2: \"siso0 c2\" by auto\n     hence mt1: \"mustT c1 s\" \"mustT c1 t\"\n     by (metis mustT_Seq_L)+\n     have \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\" using c Cont by auto\n     thus ?case\n     proof (elim Seq_transC_invert)\n       fix c1' assume c1: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n       obtain t' where \"(c1, t) \\<rightarrow>c (c1', t')\" and \"s' \\<approx> t'\"\n       using siso1 c1 st mt1 by (metis siso0_transC_indis) \n       thus ?thesis by (metis SeqC c c') \n     next\n       assume \"(c1, s) \\<rightarrow>t s'\" and \"c' = c2\"\n       thus ?thesis by (metis c SeqT mt1 siso0_transT siso1 st)\n     qed\n   qed auto\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso0_While[simp]:\nassumes \"compatTst tst\" and \"siso0 c\"\nshows \"siso0 (While tst c)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> tst d. compatTst tst \\<and> c = While tst d \\<and> siso0 d) \\<or> \n    (\\<exists> tst d1 d. compatTst tst \\<and> c = d1 ;; (While tst d) \\<and> siso0 d1 \\<and> siso0 d)\n    \\<Longrightarrow> siso0 c\"\n   apply(erule siso0_coind)\n   apply auto\n   apply (metis mustT_Seq_L siso0_transC)\n   apply (metis WhileTrue While_transC_invert compatTst_def)\n   apply (metis SeqC mustT_Seq_L siso0_transC_indis)\n   apply (metis SeqT mustT_Seq_L siso0_transT)\n   by (metis WhileFalse compatTst_def)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso0_Par[simp]:\nassumes *: \"siso0 c1\" and **: \"siso0 c2\"\nshows \"siso0 (Par c1 c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = Par c1 c2 \\<and> siso0 c1 \\<and> siso0 c2) \n    \\<Longrightarrow> siso0 c\"\n   proof (induct rule: siso0_coind)\n     case (Indef c s c' s')\n     then obtain c1 c2 where c: \"c = Par c1 c2\" \n     and c1: \"siso0 c1\" and c2: \"siso0 c2\" by auto\n     hence \"(Par c1 c2, s) \\<rightarrow>c (c', s')\" using c Indef by auto\n     thus ?case\n     apply(elim Par_transC_invert)\n     by (metis Indef c c1 c2 mustT_Par_L mustT_Par_R siso0_transC)+ \n   next\n     case (Cont c s t c' s')\n     then obtain c1 c2 where c: \"c = Par c1 c2\" \n     and c1: \"siso0 c1\" and c2: \"siso0 c2\" by auto\n     hence mt: \"mustT c1 s\" \"mustT c1 t\" \"mustT c2 s\" \"mustT c2 t\"\n     by (metis Cont mustT_Par_L mustT_Par_R)+\n     have \"(Par c1 c2, s) \\<rightarrow>c (c', s')\" using c Cont by auto\n     thus ?case\n     apply(elim Par_transC_invert)\n     apply (metis Cont ParCL c c1 mt siso0_transC_indis)\n     apply (metis Cont ParTL c c1 mt siso0_transT)\n     apply (metis Cont ParCR c c2 mt siso0_transC_indis)\n     by (metis Cont ParTR c c2 mt siso0_transT)\n   qed auto \n  }\n  thus ?thesis using assms by blast\nqed\n\n\nsubsection\\<open>Strong bisimilarity versus language constructs\\<close>\n\ntext \\<open>Atomic commands:\\<close>\n\ndefinition thetaAtm where \n\"thetaAtm atm \\<equiv> {(Atm atm, Atm atm)}\"\n\nlemma thetaAtm_sym:\n\"sym (thetaAtm atm)\"\nunfolding thetaAtm_def sym_def by blast\n\nlemma thetaAtm_Sretr:\nassumes \"compatAtm atm\"\nshows \"thetaAtm atm \\<subseteq> Sretr (thetaAtm atm)\"\nusing assms \nunfolding compatAtm_def Sretr_def matchC_C_def matchT_T_def thetaAtm_def\napply simp by (metis Atm_transT_invert Atm) \n\nlemma thetaAtm_Sbis:\nassumes \"compatAtm atm\"\nshows \"thetaAtm atm \\<subseteq> Sbis\"\napply(rule Sbis_raw_coind)\nusing assms thetaAtm_sym thetaAtm_Sretr by auto\n\ntheorem Atm_Sbis[simp]:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>s Atm atm\"\nusing assms thetaAtm_Sbis unfolding thetaAtm_def by auto\n\ntext\\<open>Sequential composition:\\<close> \n\ndefinition thetaSeq where \n\"thetaSeq \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>s d1 \\<and> c2 \\<approx>s d2}\"\n\nlemma thetaSeq_sym:\n\"sym thetaSeq\"\nunfolding thetaSeq_def sym_def using Sbis_Sym by blast\n\nlemma thetaSeq_Sretr:\n\"thetaSeq \\<subseteq> Sretr (thetaSeq Un Sbis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>s d1\" and c2d2: \"c2 \\<approx>s d2\"\n   hence matchC_C1: \"matchC_C Sbis c1 d1\" and matchC_C2: \"matchC_C Sbis c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using Sbis_matchC_C Sbis_matchT_T by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> Sretr (thetaSeq Un Sbis)\"\n   unfolding Sretr_def proof (clarify, intro conjI)\n     show \"matchC_C (thetaSeq Un Sbis) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_C_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeq Un Sbis\"\n       apply - proof(erule Seq_transC_invert) \n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence \"\\<exists>d1' t'. (d1, t) \\<rightarrow>c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>s d1'\"\n         using st matchC_C1 unfolding matchC_C_def by blast\n         thus ?thesis unfolding c' thetaSeq_def\n         apply simp by (metis SeqC c2d2 ) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaSeq_def\n         apply simp by (metis PL.SeqT c2d2) \n       qed\n     qed \n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaSeq_def by auto\nqed\n\nlemma thetaSeq_Sbis:\n\"thetaSeq \\<subseteq> Sbis\"\napply(rule Sbis_coind)\nusing thetaSeq_sym thetaSeq_Sretr by auto\n\ntheorem Seq_Sbis[simp]:\nassumes \"c1 \\<approx>s d1\" and \"c2 \\<approx>s d2\"\nshows \"c1 ;; c2 \\<approx>s d1 ;; d2\"\nusing assms thetaSeq_Sbis unfolding thetaSeq_def by blast \n\ntext\\<open>Conditional:\\<close>\n\ndefinition thetaIf where \n\"thetaIf \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>s d1 \\<and> c2 \\<approx>s d2}\"\n\nlemma thetaIf_sym:\n\"sym thetaIf\"\nunfolding thetaIf_def sym_def using Sbis_Sym by blast\n\nlemma thetaIf_Sretr:\n\"thetaIf \\<subseteq> Sretr (thetaIf Un Sbis)\"\nproof-\n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>s d1\" and c2d2: \"c2 \\<approx>s d2\"\n   hence matchC_C1: \"matchC_C Sbis c1 d1\" and matchC_C2: \"matchC_C Sbis c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using Sbis_matchC_C Sbis_matchT_T by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> Sretr (thetaIf Un Sbis)\"\n   unfolding Sretr_def proof (clarify, intro conjI)\n     show \"matchC_C (thetaIf Un Sbis) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_C_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaIf Un Sbis\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIf_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st tst)\n       apply simp by (metis IfFalse c2d2 compatTst_def st tst)\n     qed\n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaIf_def by auto\nqed\n\nlemma thetaIf_Sbis:\n\"thetaIf \\<subseteq> Sbis\"\napply(rule Sbis_coind)\nusing thetaIf_sym thetaIf_Sretr by auto\n\ntheorem If_Sbis[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>s d1\" and \"c2 \\<approx>s d2\"\nshows \"If tst c1 c2 \\<approx>s If tst d1 d2\"\nusing assms thetaIf_Sbis unfolding thetaIf_def by blast\n\ntext\\<open>While loop:\\<close>\n\ndefinition thetaWhile where \n\"thetaWhile \\<equiv> \n {(While tst c, While tst d) | tst c d. compatTst tst \\<and> c \\<approx>s d} Un \n {(c1 ;; (While tst c), d1 ;; (While tst d)) | tst c1 d1 c d. compatTst tst \\<and> c1 \\<approx>s d1 \\<and> c \\<approx>s d}\"\n\nlemma thetaWhile_sym:\n\"sym thetaWhile\"\nunfolding thetaWhile_def sym_def using Sbis_Sym by blast\n\nlemma thetaWhile_Sretr:\n\"thetaWhile \\<subseteq> Sretr (thetaWhile Un Sbis)\"\nproof-\n  {fix tst c d \n   assume tst: \"compatTst tst\" and c_d: \"c \\<approx>s d\"\n   hence matchC_C: \"matchC_C Sbis c d\" \n     and matchT_T: \"matchT_T c d\" \n   using Sbis_matchC_C Sbis_matchT_T by auto\n   have \"(While tst c, While tst d) \\<in> Sretr (thetaWhile Un Sbis)\"\n   unfolding Sretr_def proof (clarify, intro conjI)\n     show \"matchC_C (thetaWhile \\<union> Sbis) (While tst c) (While tst d)\"\n     unfolding matchC_C_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (While tst d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhile \\<union> Sbis\"\n       apply - apply(erule While_transC_invert)\n       unfolding thetaWhile_def apply simp\n       by (metis WhileTrue c_d compatTst_def st tst)\n     qed\n   next\n     show \"matchT_T (While tst c) (While tst d)\"\n     unfolding matchT_T_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t s' assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>t s'\"\n       thus \"\\<exists>t'. (While tst d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \"\n       apply - apply(erule While_transT_invert)\n       unfolding thetaWhile_def apply simp\n       by (metis PL.WhileFalse compatTst_def st tst)    \n     qed\n   qed\n  }\n  moreover \n  {fix tst c1 d1  c d\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>s d1\" and c_d: \"c \\<approx>s d\"\n   hence matchC_C1: \"matchC_C Sbis c1 d1\" and matchC_C: \"matchC_C Sbis c d\" \n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T: \"matchT_T c d\"\n   using Sbis_matchC_C Sbis_matchT_T by auto\n   have \"(c1 ;; (While tst c), d1 ;; (While tst d)) \\<in> Sretr (thetaWhile Un Sbis)\"\n   unfolding Sretr_def proof (clarify, intro conjI)\n     show \"matchC_C (thetaWhile \\<union> Sbis) (c1 ;; (While tst c)) (d1 ;; (While tst d))\"\n     unfolding matchC_C_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; (While tst c), s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (d1 ;; (While tst d), t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhile \\<union> Sbis\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; (While tst c)\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>s d'\" \n         using st matchC_C1 unfolding matchC_C_def by blast\n         thus ?thesis\n         unfolding c' thetaWhile_def\n         apply simp by (metis SeqC c_d tst) \n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = While tst c\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis\n         unfolding c' thetaWhile_def \n         apply simp by (metis PL.SeqT c_d tst) \n       qed\n     qed\n   qed (unfold matchT_T_def, auto)\n  }\n  ultimately show ?thesis unfolding thetaWhile_def by auto\nqed\n\nlemma thetaWhile_Sbis:\n\"thetaWhile \\<subseteq> Sbis\"\napply(rule Sbis_coind)\nusing thetaWhile_sym thetaWhile_Sretr by auto\n\n\n\ntext\\<open>Parallel composition:\\<close>\n\ndefinition thetaPar where \n\"thetaPar \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>s d1 \\<and> c2 \\<approx>s d2}\"\n\nlemma thetaPar_sym:\n\"sym thetaPar\"\nunfolding thetaPar_def sym_def using Sbis_Sym by blast\n\nlemma thetaPar_Sretr:\n\"thetaPar \\<subseteq> Sretr (thetaPar Un Sbis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>s d1\" and c2d2: \"c2 \\<approx>s d2\"\n   hence matchC_C1: \"matchC_C Sbis c1 d1\" and matchC_C2: \"matchC_C Sbis c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using Sbis_matchC_C Sbis_matchT_T by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> Sretr (thetaPar Un Sbis)\"\n   unfolding Sretr_def proof (clarify, intro conjI)\n     show \"matchC_C (thetaPar \\<union> Sbis) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_C_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaPar \\<union> Sbis\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>s d'\"\n         using st matchC_C1 unfolding matchC_C_def by blast\n         thus ?thesis unfolding c' thetaPar_def\n         apply simp by(metis ParCL c2d2)\n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaPar_def\n         apply simp by (metis PL.ParTL c2d2) \n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \"\\<exists>d' t'. (d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>s d'\"\n         using st matchC_C2 unfolding matchC_C_def by blast\n         thus ?thesis \n         unfolding c' thetaPar_def\n         apply simp by (metis ParCR c1d1)\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"\\<exists>t'. (d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T2 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaPar_def\n         apply simp by (metis PL.ParTR c1d1) \n       qed\n     qed \n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaPar_def by auto\nqed\n\nlemma thetaPar_Sbis:\n\"thetaPar \\<subseteq> Sbis\"\napply(rule Sbis_coind)\nusing thetaPar_sym thetaPar_Sretr by auto\n\ntheorem Par_Sbis[simp]:\nassumes \"c1 \\<approx>s d1\" and \"c2 \\<approx>s d2\"\nshows \"Par c1 c2 \\<approx>s Par d1 d2\"\nusing assms thetaPar_Sbis unfolding thetaPar_def by blast\n\n\nsubsubsection\\<open>01T-bisimilarity versus language constructs\\<close>\n\ntext \\<open>Atomic commands:\\<close>\n\ntheorem Atm_ZObisT:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>01T Atm atm\"\nby (metis Atm_Sbis assms bis_imp)\n\ntext\\<open>Sequential composition:\\<close> \n\ndefinition thetaSeqZOT where \n\"thetaSeqZOT \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>01T d1 \\<and> c2 \\<approx>01T d2}\"\n\nlemma thetaSeqZOT_sym:\n\"sym thetaSeqZOT\"\nunfolding thetaSeqZOT_def sym_def using ZObisT_Sym by blast\n\nlemma thetaSeqZOT_ZOretrT:\n\"thetaSeqZOT \\<subseteq> ZOretrT (thetaSeqZOT Un ZObisT)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>01T d1\" and c2d2: \"c2 \\<approx>01T d2\"\n   hence matchC_ZOC1: \"matchC_ZOC ZObisT c1 d1\" and matchC_ZOC2: \"matchC_ZOC ZObisT c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using ZObisT_matchC_ZOC ZObisT_matchT_T by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> ZOretrT (thetaSeqZOT Un ZObisT)\"\n   unfolding ZOretrT_def proof (clarify, intro conjI)\n     show \"matchC_ZOC (thetaSeqZOT Un ZObisT) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_ZOC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', d1 ;; d2) \\<in> thetaSeqZOT Un ZObisT) \\<or>\n        (\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqZOT Un ZObisT)\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence\n         \"(s' \\<approx> t \\<and> c1' \\<approx>01T d1) \\<or> \n          (\\<exists>d1' t'. (d1, t) \\<rightarrow>c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01T d1')\"\n         using st matchC_ZOC1 unfolding matchC_ZOC_def by auto\n         thus ?thesis unfolding c' thetaSeqZOT_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis c2d2)\n         apply simp by (metis SeqC c2d2 ) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaSeqZOT_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp by (metis PL.SeqT c2d2) \n       qed\n     qed \n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqZOT_def by auto\nqed\n\nlemma thetaSeqZOT_ZObisT:\n\"thetaSeqZOT \\<subseteq> ZObisT\"\napply(rule ZObisT_coind)\nusing thetaSeqZOT_sym thetaSeqZOT_ZOretrT by auto\n\ntheorem Seq_ZObisT[simp]:\nassumes \"c1 \\<approx>01T d1\" and \"c2 \\<approx>01T d2\"\nshows \"c1 ;; c2 \\<approx>01T d1 ;; d2\"\nusing assms thetaSeqZOT_ZObisT unfolding thetaSeqZOT_def by blast \n\ntext\\<open>Conditional:\\<close>\n\ndefinition thetaIfZOT where \n\"thetaIfZOT \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>01T d1 \\<and> c2 \\<approx>01T d2}\"\n\nlemma thetaIfZOT_sym:\n\"sym thetaIfZOT\"\nunfolding thetaIfZOT_def sym_def using ZObisT_Sym by blast\n\nlemma thetaIfZOT_ZOretrT:\n\"thetaIfZOT \\<subseteq> ZOretrT (thetaIfZOT Un ZObisT)\"\nproof-\n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>01T d1\" and c2d2: \"c2 \\<approx>01T d2\"\n   hence matchC_ZOC1: \"matchC_ZOC ZObisT c1 d1\" and matchC_ZOC2: \"matchC_ZOC ZObisT c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using ZObisT_matchC_ZOC ZObisT_matchT_T by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> ZOretrT (thetaIfZOT Un ZObisT)\"\n   unfolding ZOretrT_def proof (clarify, intro conjI)\n     show \"matchC_ZOC (thetaIfZOT Un ZObisT) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_ZOC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', If tst d1 d2) \\<in> thetaIfZOT Un ZObisT) \\<or>\n        (\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaIfZOT Un ZObisT)\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIfZOT_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st tst)\n       apply simp by (metis IfFalse c2d2 compatTst_def st tst)\n     qed\n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaIfZOT_def by auto\nqed\n\nlemma thetaIfZOT_ZObisT:\n\"thetaIfZOT \\<subseteq> ZObisT\"\napply(rule ZObisT_coind)\nusing thetaIfZOT_sym thetaIfZOT_ZOretrT by auto\n\ntheorem If_ZObisT[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>01T d1\" and \"c2 \\<approx>01T d2\"\nshows \"If tst c1 c2 \\<approx>01T If tst d1 d2\"\nusing assms thetaIfZOT_ZObisT unfolding thetaIfZOT_def by blast\n\ntext\\<open>While loop:\\<close>\n\ndefinition thetaWhileZOT where \n\"thetaWhileZOT \\<equiv> \n {(While tst c, While tst d) | tst c d. compatTst tst \\<and> c \\<approx>01T d} Un \n {(c1 ;; (While tst c), d1 ;; (While tst d)) | tst c1 d1 c d. compatTst tst \\<and> c1 \\<approx>01T d1 \\<and> c \\<approx>01T d}\"\n\nlemma thetaWhileZOT_sym:\n\"sym thetaWhileZOT\"\nunfolding thetaWhileZOT_def sym_def using ZObisT_Sym by blast\n\nlemma thetaWhileZOT_ZOretrT:\n\"thetaWhileZOT \\<subseteq> ZOretrT (thetaWhileZOT Un ZObisT)\"\nproof-\n  {fix tst c d \n   assume tst: \"compatTst tst\" and c_d: \"c \\<approx>01T d\"\n   hence matchC_ZOC: \"matchC_ZOC ZObisT c d\" \n     and matchT_T: \"matchT_T c d\" \n   using ZObisT_matchC_ZOC ZObisT_matchT_T by auto\n   have \"(While tst c, While tst d) \\<in> ZOretrT (thetaWhileZOT Un ZObisT)\"\n   unfolding ZOretrT_def proof (clarify, intro conjI)\n     show \"matchC_ZOC (thetaWhileZOT \\<union> ZObisT) (While tst c) (While tst d)\"\n     unfolding matchC_ZOC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', While tst d) \\<in> thetaWhileZOT \\<union> ZObisT) \\<or> \n        (\\<exists>d' t'. (While tst d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhileZOT \\<union> ZObisT)\"\n       apply - apply(erule While_transC_invert)\n       unfolding thetaWhileZOT_def apply simp\n       by (metis WhileTrue c_d compatTst_def st tst)\n     qed\n   next\n     show \"matchT_T (While tst c) (While tst d)\"\n     unfolding matchT_T_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t s' assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>t s'\"\n       thus \"\\<exists>t'. (While tst d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \"\n       apply - apply(erule While_transT_invert)\n       unfolding thetaWhileZOT_def apply simp\n       by (metis PL.WhileFalse compatTst_def st tst)    \n     qed\n   qed\n  }\n  moreover \n  {fix tst c1 d1  c d\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>01T d1\" and c_d: \"c \\<approx>01T d\"\n   hence matchC_ZOC1: \"matchC_ZOC ZObisT c1 d1\" and matchC_ZOC: \"matchC_ZOC ZObisT c d\" \n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T: \"matchT_T c d\"\n   using ZObisT_matchC_ZOC ZObisT_matchT_T by auto\n   have \"(c1 ;; (While tst c), d1 ;; (While tst d)) \\<in> ZOretrT (thetaWhileZOT Un ZObisT)\"\n   unfolding ZOretrT_def proof (clarify, intro conjI)\n     show \"matchC_ZOC (thetaWhileZOT \\<union> ZObisT) (c1 ;; (While tst c)) (d1 ;; (While tst d))\"\n     unfolding matchC_ZOC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; (While tst c), s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', d1 ;; (While tst d)) \\<in> thetaWhileZOT \\<union> ZObisT) \\<or> \n        (\\<exists>d' t'. (d1 ;; (While tst d), t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhileZOT \\<union> ZObisT)\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; (While tst c)\"\n         hence \n         \"(s' \\<approx> t \\<and> c1' \\<approx>01T d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01T d')\" \n         using st matchC_ZOC1 unfolding matchC_ZOC_def by auto\n         thus ?thesis\n         unfolding c' thetaWhileZOT_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis c_d tst)\n         apply simp by (metis SeqC c_d tst) \n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = While tst c\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis\n         unfolding c' thetaWhileZOT_def \n         apply simp by (metis PL.SeqT c_d tst) \n       qed\n     qed\n   qed (unfold matchT_T_def, auto)\n  }\n  ultimately show ?thesis unfolding thetaWhileZOT_def by auto\nqed\n\nlemma thetaWhileZOT_ZObisT:\n\"thetaWhileZOT \\<subseteq> ZObisT\"\napply(rule ZObisT_coind)\nusing thetaWhileZOT_sym thetaWhileZOT_ZOretrT by auto\n\ntheorem While_ZObisT[simp]:\nassumes \"compatTst tst\" and \"c \\<approx>01T d\"\nshows \"While tst c \\<approx>01T While tst d\"\nusing assms thetaWhileZOT_ZObisT unfolding thetaWhileZOT_def by auto\n\ntext\\<open>Parallel composition:\\<close>\n\ndefinition thetaParZOT where \n\"thetaParZOT \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>01T d1 \\<and> c2 \\<approx>01T d2}\"\n\nlemma thetaParZOT_sym:\n\"sym thetaParZOT\"\nunfolding thetaParZOT_def sym_def using ZObisT_Sym by blast\n\nlemma thetaParZOT_ZOretrT:\n\"thetaParZOT \\<subseteq> ZOretrT (thetaParZOT Un ZObisT)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>01T d1\" and c2d2: \"c2 \\<approx>01T d2\"\n   hence matchC_ZOC1: \"matchC_ZOC ZObisT c1 d1\" and matchC_ZOC2: \"matchC_ZOC ZObisT c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using ZObisT_matchC_ZOC ZObisT_matchT_T by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> ZOretrT (thetaParZOT Un ZObisT)\"\n   unfolding ZOretrT_def proof (clarify, intro conjI)\n     show \"matchC_ZOC (thetaParZOT \\<union> ZObisT) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_ZOC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', Par d1 d2) \\<in> thetaParZOT \\<union> ZObisT) \\<or>\n        (\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZOT \\<union> ZObisT)\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence\n         \"(s' \\<approx> t \\<and> c1' \\<approx>01T d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01T d')\"\n         using st matchC_ZOC1 unfolding matchC_ZOC_def by auto\n         thus ?thesis unfolding c' thetaParZOT_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis c2d2)\n         apply simp by(metis ParCL c2d2)\n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaParZOT_def\n         apply simp by (metis PL.ParTL c2d2) \n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \n         \"(s' \\<approx> t \\<and> c2' \\<approx>01T d2) \\<or> \n          (\\<exists>d' t'. (d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>01T d')\"\n         using st matchC_ZOC2 unfolding matchC_ZOC_def by auto\n         thus ?thesis \n         unfolding c' thetaParZOT_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis c1d1)\n         apply simp by (metis ParCR c1d1)\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"\\<exists>t'. (d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T2 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaParZOT_def\n         apply simp by (metis PL.ParTR c1d1) \n       qed\n     qed \n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaParZOT_def by auto\nqed\n\nlemma thetaParZOT_ZObisT:\n\"thetaParZOT \\<subseteq> ZObisT\"\napply(rule ZObisT_coind)\nusing thetaParZOT_sym thetaParZOT_ZOretrT by auto\n\ntheorem Par_ZObisT[simp]:\nassumes \"c1 \\<approx>01T d1\" and \"c2 \\<approx>01T d2\"\nshows \"Par c1 c2 \\<approx>01T Par d1 d2\"\nusing assms thetaParZOT_ZObisT unfolding thetaParZOT_def by blast\n\n\nsubsubsection\\<open>01-bisimilarity versus language constructs\\<close>\n\ntext\\<open>Discreetness:\\<close>\n\ntheorem discr_ZObis[simp]:\nassumes *: \"discr c\" and **: \"discr d\"\nshows \"c \\<approx>01 d\"\nproof-\n  let ?theta = \"{(c,d) | c d. discr c \\<and> discr d}\"\n  have \"?theta \\<subseteq> ZObis\"\n  proof(rule ZObis_raw_coind)\n    show \"sym ?theta\" unfolding sym_def by blast\n  next\n    show \"?theta \\<subseteq> ZOretr ?theta\"\n    proof clarify\n      fix c d assume c: \"discr c\" and d: \"discr d\"\n      show \"(c, d) \\<in> ZOretr ?theta\"\n      unfolding ZOretr_def proof (clarify, intro conjI)\n        show \"matchC_ZO ?theta c d\"\n        unfolding matchC_ZO_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n          fix s t c' s'\n          assume st: \"s \\<approx> t\" and cs: \"(c, s) \\<rightarrow>c (c', s')\"\n          show \n          \"(s' \\<approx> t \\<and> (c', d) \\<in> ?theta) \\<or>\n           (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> ?theta) \\<or>\n           (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n          proof-\n            have \"s \\<approx> s'\" using c cs discr_transC_indis by blast\n            hence s't: \"s' \\<approx> t\" using st indis_trans indis_sym by blast\n            have \"discr c'\" using c cs discr_transC by blast\n            hence \"(c',d) \\<in> ?theta\" using d by blast\n            thus ?thesis using s't by blast\n          qed\n        qed\n      next\n        show \"matchT_ZO c d\"\n        unfolding matchT_ZO_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n          fix s t s'\n          assume st: \"s \\<approx> t\" and cs: \"(c, s) \\<rightarrow>t s'\"\n          show \n          \"(s' \\<approx> t \\<and> discr d) \\<or>\n           (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or>\n           (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n          proof-\n            have \"s \\<approx> s'\" using c cs discr_transT by blast\n            hence s't: \"s' \\<approx> t\" using st indis_trans indis_sym by blast\n            thus ?thesis using d by blast\n          qed\n        qed\n      qed\n    qed\n  qed\n  thus ?thesis using assms by blast\nqed\n\ntext \\<open>Atomic commands:\\<close>\n\ntheorem Atm_ZObis[simp]:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>01 Atm atm\"\nby (metis Atm_Sbis assms bis_imp) \n\ntext\\<open>Sequential composition:\\<close>\n\ndefinition thetaSeqZO where \n\"thetaSeqZO \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>01T d1 \\<and> c2 \\<approx>01 d2}\"\n\nlemma thetaSeqZO_sym:\n\"sym thetaSeqZO\"\nunfolding thetaSeqZO_def sym_def using ZObisT_Sym ZObis_Sym by blast\n\nlemma thetaSeqZO_ZOretr:\n\"thetaSeqZO \\<subseteq> ZOretr (thetaSeqZO Un ZObis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>01T d1\" and c2d2: \"c2 \\<approx>01 d2\"\n   hence matchC_ZOC1: \"matchC_ZOC ZObisT c1 d1\" and matchC_ZO2: \"matchC_ZO ZObis c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_ZO2: \"matchT_ZO c2 d2\"\n   using ZObisT_matchC_ZOC ZObisT_matchT_T ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> ZOretr (thetaSeqZO Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaSeqZO Un ZObis) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_ZO_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', d1 ;; d2) \\<in> thetaSeqZO Un ZObis) \\<or>\n        (\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqZO Un ZObis) \\<or> \n        (\\<exists>t'. (d1 ;; d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence\n         \"(s' \\<approx> t \\<and> c1' \\<approx>01T d1) \\<or> \n          (\\<exists>d1' t'. (d1, t) \\<rightarrow>c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01T d1')\"\n         using st matchC_ZOC1 unfolding matchC_ZOC_def by auto\n         thus ?thesis unfolding c' thetaSeqZO_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis c2d2)\n         apply simp by (metis SeqC c2d2 ) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaSeqZO_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp by (metis PL.SeqT c2d2) \n       qed\n     qed \n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqZO_def by auto\nqed\n\nlemma thetaSeqZO_ZObis:\n\"thetaSeqZO \\<subseteq> ZObis\"\napply(rule ZObis_coind)\nusing thetaSeqZO_sym thetaSeqZO_ZOretr by auto\n\ntheorem Seq_ZObisT_ZObis[simp]:\nassumes \"c1 \\<approx>01T d1\" and \"c2 \\<approx>01 d2\"\nshows \"c1 ;; c2 \\<approx>01 d1 ;; d2\"\nusing assms thetaSeqZO_ZObis unfolding thetaSeqZO_def by blast\n\ntheorem Seq_siso_ZObis[simp]:\nassumes \"siso e\" and \"c2 \\<approx>01 d2\"\nshows \"e ;; c2 \\<approx>01 e ;; d2\"\nusing assms by auto\n\n(*  *)\n\ndefinition thetaSeqZOD where \n\"thetaSeqZOD \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>01 d1 \\<and> discr c2 \\<and> discr d2}\"\n\nlemma thetaSeqZOD_sym:\n\"sym thetaSeqZOD\"\nunfolding thetaSeqZOD_def sym_def using ZObis_Sym by blast\n\nlemma thetaSeqZOD_ZOretr:\n\"thetaSeqZOD \\<subseteq> ZOretr (thetaSeqZOD Un ZObis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>01 d1\" and c2: \"discr c2\" and d2: \"discr d2\"\n   hence matchC_ZO: \"matchC_ZO ZObis c1 d1\" \n     and matchT_ZO: \"matchT_ZO c1 d1\"\n   using ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> ZOretr (thetaSeqZOD Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaSeqZOD Un ZObis) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_ZO_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', d1 ;; d2) \\<in> thetaSeqZOD Un ZObis) \\<or>\n        (\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqZOD Un ZObis) \\<or> \n        (\\<exists>t'. (d1 ;; d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence\n         \"(s' \\<approx> t \\<and> c1' \\<approx>01 d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01 d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_ZO unfolding matchC_ZO_def by auto\n         thus ?thesis unfolding c' thetaSeqZOD_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis c2 d2)\n         apply simp apply (metis SeqC c2 d2)\n         apply simp by (metis SeqT c2 d2 discr_Seq discr_ZObis) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(s' \\<approx> t \\<and> discr d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n         using st matchT_ZO unfolding matchT_ZO_def by auto\n         thus ?thesis \n         unfolding c' thetaSeqZOD_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis c2 d2 discr_Seq discr_ZObis)\n         apply simp apply (metis SeqC c2 d2 discr_Seq discr_ZObis)\n         apply simp by (metis SeqT c2 d2 discr_ZObis) \n       qed\n     qed \n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqZOD_def by auto\nqed\n\nlemma thetaSeqZOD_ZObis:\n\"thetaSeqZOD \\<subseteq> ZObis\"\napply(rule ZObis_coind)\nusing thetaSeqZOD_sym thetaSeqZOD_ZOretr by auto\n\ntheorem Seq_ZObis_discr[simp]:\nassumes \"c1 \\<approx>01 d1\" and \"discr c2\" and \"discr d2\"\nshows \"c1 ;; c2 \\<approx>01 d1 ;; d2\"\nusing assms thetaSeqZOD_ZObis unfolding thetaSeqZOD_def by blast\n\ntext\\<open>Conditional:\\<close>\n\ndefinition thetaIfZO where \n\"thetaIfZO \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>01 d1 \\<and> c2 \\<approx>01 d2}\"\n\nlemma thetaIfZO_sym:\n\"sym thetaIfZO\"\nunfolding thetaIfZO_def sym_def using ZObis_Sym by blast\n\nlemma thetaIfZO_ZOretr:\n\"thetaIfZO \\<subseteq> ZOretr (thetaIfZO Un ZObis)\"\nproof-\n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>01 d1\" and c2d2: \"c2 \\<approx>01 d2\"\n   hence matchC_ZO1: \"matchC_ZO ZObis c1 d1\" and matchC_ZO2: \"matchC_ZO ZObis c2 d2\"\n     and matchT_ZO1: \"matchT_ZO c1 d1\" and matchT_ZO2: \"matchT_ZO c2 d2\"\n   using ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> ZOretr (thetaIfZO Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaIfZO Un ZObis) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_ZO_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', If tst d1 d2) \\<in> thetaIfZO Un ZObis) \\<or>\n        (\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaIfZO Un ZObis) \\<or> \n        (\\<exists>t'. (If tst d1 d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIfZO_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st tst)\n       apply simp by (metis IfFalse c2d2 compatTst_def st tst)\n     qed\n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaIfZO_def by auto\nqed\n\nlemma thetaIfZO_ZObis:\n\"thetaIfZO \\<subseteq> ZObis\"\napply(rule ZObis_coind)\nusing thetaIfZO_sym thetaIfZO_ZOretr by auto\n\ntheorem If_ZObis[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>01 d1\" and \"c2 \\<approx>01 d2\"\nshows \"If tst c1 c2 \\<approx>01 If tst d1 d2\"\nusing assms thetaIfZO_ZObis unfolding thetaIfZO_def by blast\n\ntext\\<open>While loop:\\<close>\n\ntext\\<open>01-bisimilarity does not interact with / preserve the While construct in \nany interesting way.\\<close>\n\n(* Indeed, assume c \\<approx>01 d and try to prove while tst c \\<approx>01 while tst d.  \nIf tst is True in some state, we obtain the task of proving c ;; (while tst c) \\<approx>01 d ;; (while tst d).  \nNow, assume c takes a step to c' and d terminates, possibility allowed by ~01-bisimilarity, \nprovided c' is discr.  So now we need to have, for discr c', the following: \nc' ;; (while tst c) \\<approx>01 while tst d.  This is not true in general. *)\n\ntext\\<open>Parallel composition:\\<close>\n\ndefinition thetaParZOL1 where \n\"thetaParZOL1 \\<equiv> \n {(Par c1 c2, d) | c1 c2 d. c1 \\<approx>01 d \\<and> discr c2}\"\n\nlemma thetaParZOL1_ZOretr:\n\"thetaParZOL1 \\<subseteq> ZOretr (thetaParZOL1 Un ZObis)\"\nproof-\n  {fix c1 c2 d\n   assume c1d: \"c1 \\<approx>01 d\" and c2: \"discr c2\"\n   hence matchC_ZO: \"matchC_ZO ZObis c1 d\" \n     and matchT_ZO: \"matchT_ZO c1 d\" \n   using ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(Par c1 c2, d) \\<in> ZOretr (thetaParZOL1 Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaParZOL1 \\<union> ZObis) (Par c1 c2) d\"\n     unfolding matchC_ZO_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus\n       \"(s' \\<approx> t \\<and> (c', d) \\<in> thetaParZOL1 \\<union> ZObis) \\<or>\n        (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZOL1 \\<union> ZObis) \\<or>\n        (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \n         \"(s' \\<approx> t \\<and> c1' \\<approx>01 d) \\<or> \n          (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01 d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_ZO unfolding matchC_ZO_def by blast\n         thus ?thesis unfolding thetaParZOL1_def\n         apply - apply(elim disjE exE conjE) \n         apply simp apply (metis c2 c')\n         apply simp apply (metis c2 c')\n         apply simp by (metis c' c2 discr_Par) \n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(s' \\<approx> t \\<and> discr d) \\<or> \n          (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n         using st matchT_ZO unfolding matchT_ZO_def by blast\n         thus ?thesis unfolding thetaParZOL1_def\n         apply - apply(elim disjE exE conjE)\n         apply simp apply (metis c' c2 discr_ZObis)\n         apply simp apply (metis c' c2 discr_ZObis)\n         apply simp by (metis c' c2)  \n       next\n         fix c2' assume c2s: \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \"s \\<approx> s'\" using c2 discr_transC_indis by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         have \"discr c2'\" using c2 c2s discr_transC by blast\n         thus ?thesis using s't c1d unfolding thetaParZOL1_def c' by simp\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"s \\<approx> s'\" using c2 discr_transT by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         thus ?thesis using c1d unfolding thetaParZOL1_def c' by simp\n       qed\n     qed\n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaParZOL1_def by blast\nqed\n\nlemma thetaParZOL1_converse_ZOretr:\n\"thetaParZOL1 ^-1 \\<subseteq> ZOretr (thetaParZOL1 ^-1 Un ZObis)\"\nproof-\n  {fix c1 c2 d\n   assume c1d: \"c1 \\<approx>01 d\" and c2: \"discr c2\"\n   hence matchC_ZO: \"matchC_ZO ZObis d c1\" \n     and matchT_ZO: \"matchT_ZO d c1\" \n   using ZObis_matchC_ZO_rev ZObis_matchT_ZO_rev by auto\n   have \"(d, Par c1 c2) \\<in> ZOretr (thetaParZOL1\\<inverse> \\<union> ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaParZOL1\\<inverse> \\<union> ZObis) d (Par c1 c2)\"\n     unfolding matchC_ZO_def2 ZObis_converse proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>) \n       fix s t d' t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>c (d', t')\"\n       hence \n       \"(s \\<approx> t' \\<and> d' \\<approx>01 c1) \\<or> \n        (\\<exists>c' s'. (c1, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> d' \\<approx>01 c') \\<or> \n        (\\<exists>s'. (c1, s) \\<rightarrow>t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       using matchC_ZO unfolding matchC_ZO_def2 by auto\n       thus\n       \"(s \\<approx> t' \\<and> (Par c1 c2, d') \\<in> thetaParZOL1 \\<union> ZObis) \\<or>\n        (\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZOL1 \\<union> ZObis) \\<or>\n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       unfolding thetaParZOL1_def \n       apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       apply simp apply (metis ZObis_Sym c2)\n       apply simp apply (metis ParCL ZObis_sym c2 sym_def)\n       apply simp by (metis ParTL c2 discr_ZObis) \n     qed\n   next\n     show \"matchT_ZO d (Par c1 c2)\"\n     unfolding matchT_ZO_def2 ZObis_converse proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>) \n       fix s t t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>t t'\"\n       hence \n       \"(s \\<approx> t' \\<and> discr c1) \\<or> \n        (\\<exists>c' s'. (c1, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (c1, s) \\<rightarrow>t s' \\<and> s' \\<approx> t')\"\n       using matchT_ZO unfolding matchT_ZO_def2 by auto\n       thus\n       \"(s \\<approx> t' \\<and> discr (Par c1 c2)) \\<or> \n        (\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t')\"\n       apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       apply simp apply (metis c2 discr_Par)\n       apply simp apply (metis ParCL c2 discr_Par)\n       apply simp by (metis ParTL c2)\n     qed\n   qed\n  }\n  thus ?thesis unfolding thetaParZOL1_def by blast\nqed\n\nlemma thetaParZOL1_ZObis:\n\"thetaParZOL1 \\<subseteq> ZObis\"\napply(rule ZObis_coind2)\nusing thetaParZOL1_ZOretr thetaParZOL1_converse_ZOretr by auto\n\ntheorem Par_ZObis_discrL1[simp]:\nassumes \"c1 \\<approx>01 d\" and \"discr c2\"\nshows \"Par c1 c2 \\<approx>01 d\"\nusing assms thetaParZOL1_ZObis unfolding thetaParZOL1_def by blast\n\ntheorem Par_ZObis_discrR1[simp]:\nassumes \"c \\<approx>01 d1\" and \"discr d2\"\nshows \"c \\<approx>01 Par d1 d2\"\nusing assms Par_ZObis_discrL1 ZObis_Sym by blast\n\n(*  *)\n\ndefinition thetaParZOL2 where \n\"thetaParZOL2 \\<equiv> \n {(Par c1 c2, d) | c1 c2 d. discr c1 \\<and> c2 \\<approx>01 d}\"\n\nlemma thetaParZOL2_ZOretr:\n\"thetaParZOL2 \\<subseteq> ZOretr (thetaParZOL2 Un ZObis)\"\nproof-\n  {fix c1 c2 d\n   assume c2d: \"c2 \\<approx>01 d\" and c1: \"discr c1\" \n   hence matchC_ZO: \"matchC_ZO ZObis c2 d\" \n     and matchT_ZO: \"matchT_ZO c2 d\" \n   using ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(Par c1 c2, d) \\<in> ZOretr (thetaParZOL2 Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaParZOL2 \\<union> ZObis) (Par c1 c2) d\"\n     unfolding matchC_ZO_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus\n       \"(s' \\<approx> t \\<and> (c', d) \\<in> thetaParZOL2 \\<union> ZObis) \\<or>\n        (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZOL2 \\<union> ZObis) \\<or>\n        (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \"s \\<approx> s'\" using c1 discr_transC_indis by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         have \"discr c1'\" using c1 c1s discr_transC by blast\n         thus ?thesis using s't c2d unfolding thetaParZOL2_def c' by simp\n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"s \\<approx> s'\" using c1 discr_transT by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         thus ?thesis using c2d unfolding thetaParZOL2_def c' by simp\n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \n         \"(s' \\<approx> t \\<and> c2' \\<approx>01 d) \\<or> \n          (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>01 d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c2')\"\n         using st matchC_ZO unfolding matchC_ZO_def by blast\n         thus ?thesis unfolding thetaParZOL2_def\n         apply - apply(elim disjE exE conjE) \n         apply simp apply (metis c1 c')\n         apply simp apply (metis c1 c')\n         apply simp by (metis c' c1 discr_Par) \n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \n         \"(s' \\<approx> t \\<and> discr d) \\<or> \n          (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n         using st matchT_ZO unfolding matchT_ZO_def by blast\n         thus ?thesis unfolding thetaParZOL2_def\n         apply - apply(elim disjE exE conjE)\n         apply simp apply (metis c' c1 discr_ZObis)\n         apply simp apply (metis c' c1 discr_ZObis)\n         apply simp by (metis c' c1)          \n       qed\n     qed\n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaParZOL2_def by blast\nqed\n\nlemma thetaParZOL2_converse_ZOretr:\n\"thetaParZOL2 ^-1 \\<subseteq> ZOretr (thetaParZOL2 ^-1 Un ZObis)\"\nproof-\n  {fix c1 c2 d\n   assume c2d: \"c2 \\<approx>01 d\" and c1: \"discr c1\"\n   hence matchC_ZO: \"matchC_ZO ZObis d c2\" \n     and matchT_ZO: \"matchT_ZO d c2\" \n   using ZObis_matchC_ZO_rev ZObis_matchT_ZO_rev by auto\n   have \"(d, Par c1 c2) \\<in> ZOretr (thetaParZOL2\\<inverse> \\<union> ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaParZOL2\\<inverse> \\<union> ZObis) d (Par c1 c2)\"\n     unfolding matchC_ZO_def2 ZObis_converse proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>) \n       fix s t d' t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>c (d', t')\"\n       hence \n       \"(s \\<approx> t' \\<and> d' \\<approx>01 c2) \\<or> \n        (\\<exists>c' s'. (c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> d' \\<approx>01 c') \\<or> \n        (\\<exists>s'. (c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       using matchC_ZO unfolding matchC_ZO_def2 by auto\n       thus\n       \"(s \\<approx> t' \\<and> (Par c1 c2, d') \\<in> thetaParZOL2 \\<union> ZObis) \\<or>\n        (\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZOL2 \\<union> ZObis) \\<or>\n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       unfolding thetaParZOL2_def \n       apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       apply simp apply (metis ZObis_Sym c1)\n       apply simp apply (metis ParCR ZObis_sym c1 sym_def)\n       apply simp by (metis ParTR c1 discr_ZObis) \n     qed\n   next\n     show \"matchT_ZO d (Par c1 c2)\"\n     unfolding matchT_ZO_def2 ZObis_converse proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>) \n       fix s t t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>t t'\"\n       hence \n       \"(s \\<approx> t' \\<and> discr c2) \\<or> \n        (\\<exists>c' s'. (c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t')\"\n       using matchT_ZO unfolding matchT_ZO_def2 by auto\n       thus\n       \"(s \\<approx> t' \\<and> discr (Par c1 c2)) \\<or> \n        (\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t')\"\n       apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       apply simp apply (metis c1 discr_Par)\n       apply simp apply (metis ParCR c1 discr_Par)\n       apply simp by (metis ParTR c1)\n     qed\n   qed\n  }\n  thus ?thesis unfolding thetaParZOL2_def by blast\nqed\n\nlemma thetaParZOL2_ZObis:\n\"thetaParZOL2 \\<subseteq> ZObis\"\napply(rule ZObis_coind2)\nusing thetaParZOL2_ZOretr thetaParZOL2_converse_ZOretr by auto\n\ntheorem Par_ZObis_discrL2[simp]:\nassumes \"c2 \\<approx>01 d\" and \"discr c1\"\nshows \"Par c1 c2 \\<approx>01 d\"\nusing assms thetaParZOL2_ZObis unfolding thetaParZOL2_def by blast\n\ntheorem Par_ZObis_discrR2[simp]:\nassumes \"c \\<approx>01 d2\" and \"discr d1\"\nshows \"c \\<approx>01 Par d1 d2\"\nusing assms Par_ZObis_discrL2 ZObis_Sym by blast\n\n(*  *)\n\ndefinition thetaParZO where \n\"thetaParZO \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>01 d1 \\<and> c2 \\<approx>01 d2}\"\n\nlemma thetaParZO_sym:\n\"sym thetaParZO\"\nunfolding thetaParZO_def sym_def using ZObis_Sym by blast\n\nlemma thetaParZO_ZOretr:\n\"thetaParZO \\<subseteq> ZOretr (thetaParZO Un ZObis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>01 d1\" and c2d2: \"c2 \\<approx>01 d2\"\n   hence matchC_ZO1: \"matchC_ZO ZObis c1 d1\" and matchC_ZO2: \"matchC_ZO ZObis c2 d2\"\n     and matchT_ZO1: \"matchT_ZO c1 d1\" and matchT_ZO2: \"matchT_ZO c2 d2\"\n   using ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> ZOretr (thetaParZO Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaParZO \\<union> ZObis) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_ZO_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', Par d1 d2) \\<in> thetaParZO \\<union> ZObis) \\<or>\n        (\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZO \\<union> ZObis) \\<or> \n        (\\<exists>t'. (Par d1 d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence\n         \"(s' \\<approx> t \\<and> c1' \\<approx>01 d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01 d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_ZO1 unfolding matchC_ZO_def by auto\n         thus ?thesis unfolding c' thetaParZO_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis c2d2)\n         apply simp apply (metis ParCL c2d2)\n         apply simp by (metis ParTL Par_ZObis_discrL2 c2d2)   \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(s' \\<approx> t \\<and> discr d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n         using st matchT_ZO1 unfolding matchT_ZO_def by auto\n         thus ?thesis \n         unfolding c' thetaParZO_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis Par_ZObis_discrR2 c2d2)\n         apply simp apply (metis PL.ParCL Par_ZObis_discrR2 c2d2)\n         apply simp by (metis PL.ParTL c2d2) \n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \n         \"(s' \\<approx> t \\<and> c2' \\<approx>01 d2) \\<or> \n          (\\<exists>d' t'. (d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>01 d') \\<or> \n          (\\<exists>t'. (d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c2')\"\n         using st matchC_ZO2 unfolding matchC_ZO_def by auto\n         thus ?thesis \n         unfolding c' thetaParZO_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis c1d1)\n         apply simp apply (metis PL.ParCR c1d1)\n         apply simp by (metis PL.ParTR Par_ZObis_discrL1 c1d1)\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \n         \"(s' \\<approx> t \\<and> discr d2) \\<or> \n          (\\<exists>d' t'. (d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n         using st matchT_ZO2 unfolding matchT_ZO_def by auto\n         thus ?thesis \n         unfolding c' thetaParZO_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis Par_ZObis_discrR1 c1d1)\n         apply simp apply (metis PL.ParCR Par_ZObis_discrR1 c1d1)\n         apply simp by (metis PL.ParTR c1d1) \n       qed\n     qed \n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaParZO_def by auto\nqed\n\nlemma thetaParZO_ZObis:\n\"thetaParZO \\<subseteq> ZObis\"\napply(rule ZObis_coind)\nusing thetaParZO_sym thetaParZO_ZOretr by auto\n\ntheorem Par_ZObis[simp]:\nassumes \"c1 \\<approx>01 d1\" and \"c2 \\<approx>01 d2\"\nshows \"Par c1 c2 \\<approx>01 Par d1 d2\"\nusing assms thetaParZO_ZObis unfolding thetaParZO_def by blast\n\n\nsubsubsection\\<open>WT-bisimilarity versus language constructs\\<close>\n\ntext\\<open>Discreetness:\\<close>\n\ntheorem noWhile_discr_WbisT[simp]:\n  assumes \"noWhile c1\" and \"noWhile c2\" \n  and \"discr c1\" and \"discr c2\"\n  shows \"c1 \\<approx>wT c2\"\nproof -\n  from assms have \"noWhile c1 \\<and> noWhile c2 \\<and> discr c1 \\<and> discr c2\" by auto\n  then show ?thesis\n  proof (induct rule: WbisT_coinduct)\n    case cont then show ?case\n      by (metis MtransC_Refl noWhile_transC discr_transC discr_transC_indis indis_sym indis_trans) \n  next\n    case termi then show ?case\n      by (metis discr_MtransT indis_sym indis_trans noWhile_MtransT transT_MtransT)\n  qed simp\nqed\n\ntext \\<open>Atomic commands:\\<close>\n\ntheorem Atm_WbisT:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>wT Atm atm\"\nby (metis Atm_Sbis assms bis_imp)\n\ntext\\<open>Sequential composition:\\<close> \n\ndefinition thetaSeqWT where \n\"thetaSeqWT \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>wT d1 \\<and> c2 \\<approx>wT d2}\"\n\nlemma thetaSeqWT_sym:\n\"sym thetaSeqWT\"\nunfolding thetaSeqWT_def sym_def using WbisT_Sym by blast\n\nlemma thetaSeqWT_WretrT:\n\"thetaSeqWT \\<subseteq> WretrT (thetaSeqWT Un WbisT)\"\nproof- \n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>wT d1\" and c2d2: \"c2 \\<approx>wT d2\"\n   hence matchC_MC1: \"matchC_MC WbisT c1 d1\" and matchC_MC2: \"matchC_MC WbisT c2 d2\"\n     and matchT_MT1: \"matchT_MT c1 d1\" and matchT_T2: \"matchT_MT c2 d2\"\n   using WbisT_matchC_MC WbisT_matchT_MT by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> WretrT (thetaSeqWT Un WbisT)\"\n   unfolding WretrT_def proof (clarify, intro conjI)\n     show \"matchC_MC (thetaSeqWT Un WbisT) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_MC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \"(\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqWT Un WbisT)\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence \"\\<exists>d1' t'. (d1, t) \\<rightarrow>*c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>wT d1'\"\n         using st matchC_MC1 unfolding matchC_MC_def by blast\n         thus ?thesis unfolding c' thetaSeqWT_def\n         apply simp by (metis PL.Seq_MtransC c2d2) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using st matchT_MT1 unfolding matchT_MT_def by auto\n         thus ?thesis \n         unfolding c' thetaSeqWT_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp by (metis Seq_MtransT_MtransC c2d2) \n       qed\n     qed \n   qed (unfold matchT_MT_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqWT_def by auto\nqed\n\nlemma thetaSeqWT_WbisT:\n\"thetaSeqWT \\<subseteq> WbisT\"\napply(rule WbisT_coind)\nusing thetaSeqWT_sym thetaSeqWT_WretrT by auto\n\ntheorem Seq_WbisT[simp]:\nassumes \"c1 \\<approx>wT d1\" and \"c2 \\<approx>wT d2\"\nshows \"c1 ;; c2 \\<approx>wT d1 ;; d2\"\nusing assms thetaSeqWT_WbisT unfolding thetaSeqWT_def by blast \n\ntext\\<open>Conditional:\\<close>\n\ndefinition thetaIfWT where \n\"thetaIfWT \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>wT d1 \\<and> c2 \\<approx>wT d2}\"\n\nlemma thetaIfWT_sym:\n\"sym thetaIfWT\"\nunfolding thetaIfWT_def sym_def using WbisT_Sym by blast\n\nlemma thetaIfWT_WretrT:\n\"thetaIfWT \\<subseteq> WretrT (thetaIfWT Un WbisT)\"\nproof- \n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>wT d1\" and c2d2: \"c2 \\<approx>wT d2\"\n   hence matchC_MC1: \"matchC_MC WbisT c1 d1\" and matchC_MC2: \"matchC_MC WbisT c2 d2\"\n     and matchT_MT1: \"matchT_MT c1 d1\" and matchT_MT2: \"matchT_MT c2 d2\"\n   using WbisT_matchC_MC WbisT_matchT_MT by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> WretrT (thetaIfWT Un WbisT)\"\n   unfolding WretrT_def proof (clarify, intro conjI)\n     show \"matchC_MC (thetaIfWT Un WbisT) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_MC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaIfWT Un WbisT\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIfWT_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st transC_MtransC tst) \n       apply simp by (metis IfFalse c2d2 compatTst_def st transC_MtransC tst) \n     qed\n   qed (unfold matchT_MT_def, auto)\n  }\n  thus ?thesis unfolding thetaIfWT_def by auto\nqed\n\nlemma thetaIfWT_WbisT:\n\"thetaIfWT \\<subseteq> WbisT\"\napply(rule WbisT_coind)\nusing thetaIfWT_sym thetaIfWT_WretrT by auto\n\ntheorem If_WbisT[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>wT d1\" and \"c2 \\<approx>wT d2\"\nshows \"If tst c1 c2 \\<approx>wT If tst d1 d2\"\nusing assms thetaIfWT_WbisT unfolding thetaIfWT_def by blast\n\ntext\\<open>While loop:\\<close>\n\ndefinition thetaWhileW where \n\"thetaWhileW \\<equiv> \n {(While tst c, While tst d) | tst c d. compatTst tst \\<and> c \\<approx>wT d} Un \n {(c1 ;; (While tst c), d1 ;; (While tst d)) | tst c1 d1 c d. \n               compatTst tst \\<and> c1 \\<approx>wT d1 \\<and> c \\<approx>wT d}\"\n\nlemma thetaWhileW_sym:\n\"sym thetaWhileW\"\nunfolding thetaWhileW_def sym_def using WbisT_Sym by blast\n\nlemma thetaWhileW_WretrT:\n\"thetaWhileW \\<subseteq> WretrT (thetaWhileW Un WbisT)\"\nproof-\n  {fix tst c d \n   assume tst: \"compatTst tst\" and c_d: \"c \\<approx>wT d\"\n   hence matchC_MC: \"matchC_MC WbisT c d\" \n     and matchT_MT: \"matchT_MT c d\" \n   using WbisT_matchC_MC WbisT_matchT_MT by auto\n   have \"(While tst c, While tst d) \\<in> WretrT (thetaWhileW Un WbisT)\"\n   unfolding WretrT_def proof (clarify, intro conjI)\n     show \"matchC_MC (thetaWhileW \\<union> WbisT) (While tst c) (While tst d)\"\n     unfolding matchC_MC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (While tst d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                     (c', d') \\<in> thetaWhileW \\<union> WbisT\"\n       apply - apply(erule While_transC_invert)\n       unfolding thetaWhileW_def apply simp\n       by (metis PL.WhileTrue PL.transC_MtransC c_d compatTst_def st tst)\n     qed\n   next\n     show \"matchT_MT (While tst c) (While tst d)\"\n     unfolding matchT_MT_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t s' assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>t s'\"\n       thus \"\\<exists>t'. (While tst d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \"\n       apply - apply(erule While_transT_invert)\n       unfolding thetaWhileW_def apply simp\n       by (metis WhileFalse compatTst_def st transT_MtransT tst)       \n     qed\n   qed\n  }\n  moreover \n  {fix tst c1 d1  c d\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>wT d1\" and c_d: \"c \\<approx>wT d\"\n   hence matchC_MC1: \"matchC_MC WbisT c1 d1\" and matchC_MC: \"matchC_MC WbisT c d\" \n     and matchT_MT1: \"matchT_MT c1 d1\" and matchT_MT: \"matchT_MT c d\"\n   using WbisT_matchC_MC WbisT_matchT_MT by auto\n   have \"(c1 ;; (While tst c), d1 ;; (While tst d)) \\<in> WretrT (thetaWhileW Un WbisT)\"\n   unfolding WretrT_def proof (clarify, intro conjI)\n     show \"matchC_MC (thetaWhileW \\<union> WbisT) (c1 ;; (While tst c)) (d1 ;; (While tst d))\"\n     unfolding matchC_MC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; (While tst c), s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (d1 ;; (While tst d), t) \\<rightarrow>*c (d', t') \\<and> \n                     s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhileW \\<union> WbisT\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; (While tst c)\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>wT d'\" \n         using st matchC_MC1 unfolding matchC_MC_def by blast\n         thus ?thesis\n         unfolding c' thetaWhileW_def\n         apply simp by (metis PL.Seq_MtransC c_d tst)\n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = While tst c\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using st matchT_MT1 unfolding matchT_MT_def by auto\n         thus ?thesis\n         unfolding c' thetaWhileW_def \n         apply simp by (metis PL.Seq_MtransT_MtransC c_d tst)\n       qed\n     qed\n   qed (unfold matchT_MT_def, auto)\n  }\n  ultimately show ?thesis unfolding thetaWhileW_def by auto\nqed\n\nlemma thetaWhileW_WbisT:\n\"thetaWhileW \\<subseteq> WbisT\"\napply(rule WbisT_coind)\nusing thetaWhileW_sym thetaWhileW_WretrT by auto\n\ntheorem While_WbisT[simp]:\nassumes \"compatTst tst\" and \"c \\<approx>wT d\"\nshows \"While tst c \\<approx>wT While tst d\"\nusing assms thetaWhileW_WbisT unfolding thetaWhileW_def by auto\n\ntext\\<open>Parallel composition:\\<close>\n\ndefinition thetaParWT where \n\"thetaParWT \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>wT d1 \\<and> c2 \\<approx>wT d2}\"\n\nlemma thetaParWT_sym:\n\"sym thetaParWT\"\nunfolding thetaParWT_def sym_def using WbisT_Sym by blast\n\nlemma thetaParWT_WretrT:\n\"thetaParWT \\<subseteq> WretrT (thetaParWT Un WbisT)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>wT d1\" and c2d2: \"c2 \\<approx>wT d2\"\n   hence matchC_MC1: \"matchC_MC WbisT c1 d1\" and matchC_MC2: \"matchC_MC WbisT c2 d2\"\n     and matchT_MT1: \"matchT_MT c1 d1\" and matchT_MT2: \"matchT_MT c2 d2\"\n   using WbisT_matchC_MC WbisT_matchT_MT by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> WretrT (thetaParWT Un WbisT)\"\n   unfolding WretrT_def proof (clarify, intro conjI)\n     show \"matchC_MC (thetaParWT \\<union> WbisT) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_MC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                     (c', d') \\<in> thetaParWT \\<union> WbisT\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>wT d'\"\n         using st matchC_MC1 unfolding matchC_MC_def by blast\n         thus ?thesis unfolding c' thetaParWT_def\n         apply simp by (metis PL.ParCL_MtransC c2d2) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using st matchT_MT1 unfolding matchT_MT_def by blast\n         thus ?thesis \n         unfolding c' thetaParWT_def\n         apply simp by (metis PL.ParTL_MtransC c2d2)\n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \"\\<exists>d' t'. (d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>wT d'\"\n         using st matchC_MC2 unfolding matchC_MC_def by blast\n         thus ?thesis \n         unfolding c' thetaParWT_def\n         apply simp by (metis PL.ParCR_MtransC c1d1)\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"\\<exists>t'. (d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using st matchT_MT2 unfolding matchT_MT_def by blast\n         thus ?thesis \n         unfolding c' thetaParWT_def\n         apply simp by (metis PL.ParTR_MtransC c1d1)\n       qed\n     qed \n   qed (unfold matchT_MT_def, auto)\n  }\n  thus ?thesis unfolding thetaParWT_def by auto\nqed\n\nlemma thetaParWT_WbisT:\n\"thetaParWT \\<subseteq> WbisT\"\napply(rule WbisT_coind)\nusing thetaParWT_sym thetaParWT_WretrT by auto\n\ntheorem Par_WbisT[simp]:\nassumes \"c1 \\<approx>wT d1\" and \"c2 \\<approx>wT d2\"\nshows \"Par c1 c2 \\<approx>wT Par d1 d2\"\nusing assms thetaParWT_WbisT unfolding thetaParWT_def by blast\n\n\nsubsubsection\\<open>T-bisimilarity versus language constructs\\<close>\n\ntext\\<open>T-Discreetness:\\<close>\n\ndefinition thetaFDW0 where \n\"thetaFDW0 \\<equiv> \n {(c1,c2). discr0 c1 \\<and> discr0 c2}\"\n\nlemma thetaFDW0_sym:\n\"sym thetaFDW0\"\nunfolding thetaFDW0_def sym_def using Sbis_Sym by blast\n\nlemma thetaFDW0_RetrT:\n\"thetaFDW0 \\<subseteq> RetrT thetaFDW0\"\nproof-\n  {fix c d \n   assume c: \"discr0 c\" and d: \"discr0 d\"\n   have \"(c,d) \\<in> RetrT thetaFDW0\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC thetaFDW0 c d\"\n     unfolding matchC_TMC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s' assume \"mustT c s\" \"mustT d t\" \n       \"s \\<approx> t\" and \"(c, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaFDW0\"\n       unfolding thetaFDW0_def apply simp\n       by (metis MtransC_Refl noWhile_transC c d discr0_transC discr0_transC_indis \n                 indis_sym indis_trans) \n     qed\n   next\n     show \"matchT_TMT c d\"\n     unfolding matchT_TMT_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t s' assume mt: \"mustT c s\" \"mustT d t\"  \n       and st: \"s \\<approx> t\" and cs: \"(c, s) \\<rightarrow>t s'\"\n       obtain t' where dt: \"(d, t) \\<rightarrow>*t t'\" by (metis mt mustT_MtransT)\n       hence \"t \\<approx> t'\" and \"s \\<approx> s'\" using mt cs c d discr0_transT discr0_MtransT by blast+\n       hence \"s' \\<approx> t'\" using st indis_trans indis_sym by blast\n       thus \"\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\" using dt by blast     \n     qed\n   qed\n  }\n  thus ?thesis unfolding thetaFDW0_def by blast\nqed\n\nlemma thetaFDW0_BisT:\n\"thetaFDW0 \\<subseteq> BisT\"\napply(rule BisT_raw_coind)\nusing thetaFDW0_sym thetaFDW0_RetrT by auto\n\ntheorem discr0_BisT[simp]:\nassumes \"discr0 c1\" and \"discr0 c2\"\nshows \"c1 \\<approx>T c2\"\nusing assms thetaFDW0_BisT unfolding thetaFDW0_def by blast   \n\ntext \\<open>Atomic commands:\\<close>\n\ntheorem Atm_BisT:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>T Atm atm\"\nby (metis assms siso0_Atm siso0_Sbis)\n\ntext\\<open>Sequential composition:\\<close> \n\ndefinition thetaSeqTT where \n\"thetaSeqTT \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>T d1 \\<and> c2 \\<approx>T d2}\"\n\nlemma thetaSeqTT_sym:\n\"sym thetaSeqTT\"\nunfolding thetaSeqTT_def sym_def using BisT_Sym by blast\n\nlemma thetaSeqTT_RetrT:\n\"thetaSeqTT \\<subseteq> RetrT (thetaSeqTT \\<union> BisT)\"\nproof- \n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>T d1\" and c2d2: \"c2 \\<approx>T d2\"\n   hence matchC_TMC1: \"matchC_TMC BisT c1 d1\" and matchC_TMC2: \"matchC_TMC BisT c2 d2\"\n     and matchT_TMT1: \"matchT_TMT c1 d1\" and matchT_T2: \"matchT_TMT c2 d2\"\n   using BisT_matchC_TMC BisT_matchT_TMT by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> RetrT (thetaSeqTT \\<union> BisT)\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC (thetaSeqTT \\<union> BisT) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_TMC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume mt: \"mustT (c1 ;; c2) s\" \"mustT (d1 ;; d2) t\"\n       and st: \"s \\<approx> t\" \n       hence mt1: \"mustT c1 s\" \"mustT d1 t\"\n       by (metis mustT_Seq_L mustT_Seq_R)+\n       assume 0: \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \"(\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                      (c', d') \\<in> thetaSeqTT \\<union> BisT)\"\n       proof(elim Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence \"\\<exists>d1' t'. (d1, t) \\<rightarrow>*c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>T d1'\"\n         using mt1 st matchC_TMC1 unfolding matchC_TMC_def by blast\n         thus ?thesis unfolding c' thetaSeqTT_def\n         apply simp by (metis Seq_MtransC c2d2) \n       next      \n         assume c1: \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         then obtain t' where d1: \"(d1, t) \\<rightarrow>*t t'\" and s't': \"s' \\<approx> t'\"\n         using mt1 st matchT_TMT1 unfolding matchT_TMT_def by blast\n         hence mt1: \"mustT c2 s'\" \"mustT d2 t'\"\n         apply (metis 0 c' mt mustT_transC)\n         by (metis mustT_Seq_R d1 mt(2))\n         thus ?thesis \n         unfolding c' thetaSeqTT_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp by (metis Seq_MtransT_MtransC c2d2 d1 s't') \n       qed\n     qed \n   qed (unfold matchT_TMT_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqTT_def by auto\nqed\n\nlemma thetaSeqTT_BisT:\n\"thetaSeqTT \\<subseteq> BisT\"\napply(rule BisT_coind)\nusing thetaSeqTT_sym thetaSeqTT_RetrT by auto\n\ntheorem Seq_BisT[simp]:\nassumes \"c1 \\<approx>T d1\" and \"c2 \\<approx>T d2\"\nshows \"c1 ;; c2 \\<approx>T d1 ;; d2\"\nusing assms thetaSeqTT_BisT unfolding thetaSeqTT_def by blast \n\ntext\\<open>Conditional:\\<close>\n\ndefinition thetaIfTT where \n\"thetaIfTT \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>T d1 \\<and> c2 \\<approx>T d2}\"\n\nlemma thetaIfTT_sym:\n\"sym thetaIfTT\"\nunfolding thetaIfTT_def sym_def using BisT_Sym by blast\n\nlemma thetaIfTT_RetrT:\n\"thetaIfTT \\<subseteq> RetrT (thetaIfTT \\<union> BisT)\"\nproof- \n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>T d1\" and c2d2: \"c2 \\<approx>T d2\"\n   hence matchC_TMC1: \"matchC_TMC BisT c1 d1\" and matchC_TMC2: \"matchC_TMC BisT c2 d2\"\n     and matchT_TMT1: \"matchT_TMT c1 d1\" and matchT_TMT2: \"matchT_TMT c2 d2\"\n   using BisT_matchC_TMC BisT_matchT_TMT by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> RetrT (thetaIfTT \\<union> BisT)\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC (thetaIfTT \\<union> BisT) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_TMC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                     (c', d') \\<in> thetaIfTT \\<union> BisT\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIfTT_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st transC_MtransC tst) \n       apply simp by (metis IfFalse c2d2 compatTst_def st transC_MtransC tst) \n     qed\n   qed (unfold matchT_TMT_def, auto)\n  }\n  thus ?thesis unfolding thetaIfTT_def by auto\nqed\n\nlemma thetaIfTT_BisT:\n\"thetaIfTT \\<subseteq> BisT\"\napply(rule BisT_coind)\nusing thetaIfTT_sym thetaIfTT_RetrT by auto\n\ntheorem If_BisT[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>T d1\" and \"c2 \\<approx>T d2\"\nshows \"If tst c1 c2 \\<approx>T If tst d1 d2\"\nusing assms thetaIfTT_BisT unfolding thetaIfTT_def by blast\n\ntext\\<open>While loop:\\<close>\n\ndefinition thetaWhileW0 where \n\"thetaWhileW0 \\<equiv> \n {(While tst c, While tst d) | tst c d. compatTst tst \\<and> c \\<approx>T d} \\<union> \n {(c1 ;; (While tst c), d1 ;; (While tst d)) | tst c1 d1 c d. \n               compatTst tst \\<and> c1 \\<approx>T d1 \\<and> c \\<approx>T d}\"\n\nlemma thetaWhileW0_sym:\n\"sym thetaWhileW0\"\nunfolding thetaWhileW0_def sym_def using BisT_Sym by blast\n\nlemma thetaWhileW0_RetrT:\n\"thetaWhileW0 \\<subseteq> RetrT (thetaWhileW0 \\<union> BisT)\"\nproof-\n  {fix tst c d \n   assume tst: \"compatTst tst\" and c_d: \"c \\<approx>T d\"\n   hence matchC_TMC: \"matchC_TMC BisT c d\" \n     and matchT_TMT: \"matchT_TMT c d\" \n   using BisT_matchC_TMC BisT_matchT_TMT by auto\n   have \"(While tst c, While tst d) \\<in> RetrT (thetaWhileW0 \\<union> BisT)\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC (thetaWhileW0 \\<union> BisT) (While tst c) (While tst d)\"\n     unfolding matchC_TMC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (While tst d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                     (c', d') \\<in> thetaWhileW0 \\<union> BisT\"\n       apply - apply(erule While_transC_invert)\n       unfolding thetaWhileW0_def apply simp\n       by (metis WhileTrue transC_MtransC c_d compatTst_def st tst)\n     qed\n   next\n     show \"matchT_TMT (While tst c) (While tst d)\"\n     unfolding matchT_TMT_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t s' assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>t s'\"\n       thus \"\\<exists>t'. (While tst d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \"\n       apply - apply(erule While_transT_invert)\n       unfolding thetaWhileW0_def apply simp\n       by (metis WhileFalse compatTst_def st transT_MtransT tst)       \n     qed\n   qed\n  }\n  moreover \n  {fix tst c1 d1  c d\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>T d1\" and c_d: \"c \\<approx>T d\"\n   hence matchC_TMC1: \"matchC_TMC BisT c1 d1\" and matchC_TMC: \"matchC_TMC BisT c d\" \n     and matchT_TMT1: \"matchT_TMT c1 d1\" and matchT_TMT: \"matchT_TMT c d\"\n   using BisT_matchC_TMC BisT_matchT_TMT by auto\n   have \"(c1 ;; (While tst c), d1 ;; (While tst d)) \\<in> RetrT (thetaWhileW0 \\<union> BisT)\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC (thetaWhileW0 \\<union> BisT) (c1 ;; (While tst c)) (d1 ;; (While tst d))\"\n     unfolding matchC_TMC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume mt: \"mustT (c1 ;; While tst c) s\" \"mustT (d1 ;; While tst d) t\"\n       and st: \"s \\<approx> t\" \n       hence mt1: \"mustT c1 s\" \"mustT d1 t\"\n       by (metis mustT_Seq_L mustT_Seq_R)+     \n       assume 0: \"(c1 ;; (While tst c), s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (d1 ;; (While tst d), t) \\<rightarrow>*c (d', t') \\<and> \n                     s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhileW0 \\<union> BisT\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; (While tst c)\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>T d'\" \n         using mt1 st matchC_TMC1 unfolding matchC_TMC_def by blast\n         thus ?thesis\n         unfolding c' thetaWhileW0_def\n         apply simp by (metis Seq_MtransC c_d tst)\n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = While tst c\"\n         then obtain t' where \"(d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using mt1 st matchT_TMT1 unfolding matchT_TMT_def by metis\n         thus ?thesis\n         unfolding c' thetaWhileW0_def \n         apply simp by (metis Seq_MtransT_MtransC c_d tst)\n       qed\n     qed\n   qed (unfold matchT_TMT_def, auto)\n  }\n  ultimately show ?thesis unfolding thetaWhileW0_def by auto\nqed\n\nlemma thetaWhileW0_BisT:\n\"thetaWhileW0 \\<subseteq> BisT\"\napply(rule BisT_coind)\nusing thetaWhileW0_sym thetaWhileW0_RetrT by auto\n\ntheorem While_BisT[simp]:\nassumes \"compatTst tst\" and \"c \\<approx>T d\"\nshows \"While tst c \\<approx>T While tst d\"\nusing assms thetaWhileW0_BisT unfolding thetaWhileW0_def by auto\n\ntext\\<open>Parallel composition:\\<close>\n\ndefinition thetaParTT where \n\"thetaParTT \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>T d1 \\<and> c2 \\<approx>T d2}\"\n\nlemma thetaParTT_sym:\n\"sym thetaParTT\"\nunfolding thetaParTT_def sym_def using BisT_Sym by blast\n\nlemma thetaParTT_RetrT:\n\"thetaParTT \\<subseteq> RetrT (thetaParTT \\<union> BisT)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>T d1\" and c2d2: \"c2 \\<approx>T d2\"\n   hence matchC_TMC1: \"matchC_TMC BisT c1 d1\" and matchC_TMC2: \"matchC_TMC BisT c2 d2\"\n     and matchT_TMT1: \"matchT_TMT c1 d1\" and matchT_TMT2: \"matchT_TMT c2 d2\"\n   using BisT_matchC_TMC BisT_matchT_TMT by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> RetrT (thetaParTT \\<union> BisT)\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC (thetaParTT \\<union> BisT) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_TMC_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume \"mustT (Par c1 c2) s\" and \"mustT (Par d1 d2) t\"\n       and st: \"s \\<approx> t\" \n       hence mt: \"mustT c1 s\" \"mustT c2 s\"\n                 \"mustT d1 t\" \"mustT d2 t\"\n       by (metis mustT_Par_L mustT_Par_R)+        \n       assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                     (c', d') \\<in> thetaParTT \\<union> BisT\"\n       proof(elim Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>T d'\"\n         using mt st matchC_TMC1 unfolding matchC_TMC_def by blast\n         thus ?thesis unfolding c' thetaParTT_def\n         apply simp by (metis ParCL_MtransC c2d2) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using mt st matchT_TMT1 unfolding matchT_TMT_def by blast\n         thus ?thesis \n         unfolding c' thetaParTT_def\n         apply simp by (metis PL.ParTL_MtransC c2d2)\n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \"\\<exists>d' t'. (d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>T d'\"\n         using mt st matchC_TMC2 unfolding matchC_TMC_def by blast\n         thus ?thesis \n         unfolding c' thetaParTT_def\n         apply simp by (metis PL.ParCR_MtransC c1d1)\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"\\<exists>t'. (d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using mt st matchT_TMT2 unfolding matchT_TMT_def by blast\n         thus ?thesis \n         unfolding c' thetaParTT_def\n         apply simp by (metis PL.ParTR_MtransC c1d1)\n       qed\n     qed \n   qed (unfold matchT_TMT_def, auto)\n  }\n  thus ?thesis unfolding thetaParTT_def by auto\nqed\n\nlemma thetaParTT_BisT:\n\"thetaParTT \\<subseteq> BisT\"\napply(rule BisT_coind)\nusing thetaParTT_sym thetaParTT_RetrT by auto\n\ntheorem Par_BisT[simp]:\nassumes \"c1 \\<approx>T d1\" and \"c2 \\<approx>T d2\"\nshows \"Par c1 c2 \\<approx>T Par d1 d2\"\nusing assms thetaParTT_BisT unfolding thetaParTT_def by blast\n\n\nsubsubsection\\<open>W-bisimilarity versus language constructs\\<close>\n\ntext \\<open>Atomic commands:\\<close>\n\ntheorem Atm_Wbis[simp]:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>w Atm atm\"\nby (metis Atm_Sbis assms bis_imp)\n\ntext\\<open>Discreetness:\\<close>\n\ntheorem discr_Wbis[simp]:\nassumes *: \"discr c\" and **: \"discr d\"\nshows \"c \\<approx>w d\"\nby (metis * ** bis_imp(4) discr_ZObis)\n\ntext\\<open>Sequential composition:\\<close>\n\ndefinition thetaSeqW where \n\"thetaSeqW \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>wT d1 \\<and> c2 \\<approx>w d2}\"\n\nlemma thetaSeqW_sym:\n\"sym thetaSeqW\"\nunfolding thetaSeqW_def sym_def using WbisT_Sym Wbis_Sym by blast\n\nlemma thetaSeqW_Wretr:\n\"thetaSeqW \\<subseteq> Wretr (thetaSeqW \\<union> Wbis)\"\nproof- \n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>wT d1\" and c2d2: \"c2 \\<approx>w d2\"\n   hence matchC_MC1: \"matchC_MC WbisT c1 d1\" and matchC_W2: \"matchC_M Wbis c2 d2\"\n     and matchT_MT1: \"matchT_MT c1 d1\" and matchT_M2: \"matchT_M c2 d2\" \n   using WbisT_matchC_MC WbisT_matchT_MT Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> Wretr (thetaSeqW \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaSeqW \\<union> Wbis) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_M_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqW \\<union> Wbis) \\<or> \n        (\\<exists>t'. (d1 ;; d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence \"\\<exists>d1' t'. (d1, t) \\<rightarrow>*c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>wT d1'\"\n         using st matchC_MC1 unfolding matchC_MC_def by blast\n         thus ?thesis unfolding c' thetaSeqW_def\n         apply simp by (metis PL.Seq_MtransC c2d2)\n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using st matchT_MT1 unfolding matchT_MT_def by auto\n         thus ?thesis \n         unfolding c' thetaSeqW_def\n         apply simp by (metis PL.Seq_MtransT_MtransC c2d2) \n       qed\n     qed \n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqW_def by auto\nqed\n\nlemma thetaSeqW_Wbis:\n\"thetaSeqW \\<subseteq> Wbis\"\napply(rule Wbis_coind)\nusing thetaSeqW_sym thetaSeqW_Wretr by auto\n\ntheorem Seq_WbisT_Wbis[simp]:\nassumes \"c1 \\<approx>wT d1\" and \"c2 \\<approx>w d2\"\nshows \"c1 ;; c2 \\<approx>w d1 ;; d2\"\nusing assms thetaSeqW_Wbis unfolding thetaSeqW_def by blast\n\ntheorem Seq_siso_Wbis[simp]:\nassumes \"siso e\" and \"c2 \\<approx>w d2\"\nshows \"e ;; c2 \\<approx>w e ;; d2\"\nusing assms by auto\n\n(*  *)\n\ndefinition thetaSeqWD where \n\"thetaSeqWD \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>w d1 \\<and> discr c2 \\<and> discr d2}\"\n\nlemma thetaSeqWD_sym:\n\"sym thetaSeqWD\"\nunfolding thetaSeqWD_def sym_def using Wbis_Sym by blast\n\nlemma thetaSeqWD_Wretr:\n\"thetaSeqWD \\<subseteq> Wretr (thetaSeqWD \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>w d1\" and c2: \"discr c2\" and d2: \"discr d2\"\n   hence matchC_M: \"matchC_M Wbis c1 d1\" \n     and matchT_M: \"matchT_M c1 d1\"\n   using Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> Wretr (thetaSeqWD \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaSeqWD \\<union> Wbis) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_M_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqWD \\<union> Wbis) \\<or> \n        (\\<exists>t'. (d1 ;; d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence\n         \"(\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>w d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_M unfolding matchC_M_def by blast\n         thus ?thesis unfolding c' thetaSeqWD_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis PL.Seq_MtransC c2 d2)\n         apply simp by (metis PL.Seq_MtransT_MtransC c2 d2 discr_Seq discr_Wbis)\n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n         using st matchT_M unfolding matchT_M_def by blast\n         thus ?thesis \n         unfolding c' thetaSeqWD_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis PL.Seq_MtransC c2 d2 discr_Seq discr_Wbis)\n         apply simp by (metis PL.Seq_MtransT_MtransC c2 d2 discr_Wbis)\n       qed\n     qed \n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqWD_def by auto\nqed\n\nlemma thetaSeqWD_Wbis:\n\"thetaSeqWD \\<subseteq> Wbis\"\napply(rule Wbis_coind)\nusing thetaSeqWD_sym thetaSeqWD_Wretr by auto\n\ntheorem Seq_Wbis_discr[simp]:\nassumes \"c1 \\<approx>w d1\" and \"discr c2\" and \"discr d2\"\nshows \"c1 ;; c2 \\<approx>w d1 ;; d2\"\nusing assms thetaSeqWD_Wbis unfolding thetaSeqWD_def by blast\n\ntext\\<open>Conditional:\\<close>\n\ndefinition thetaIfW where \n\"thetaIfW \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>w d1 \\<and> c2 \\<approx>w d2}\"\n\nlemma thetaIfW_sym:\n\"sym thetaIfW\"\nunfolding thetaIfW_def sym_def using Wbis_Sym by blast\n\nlemma thetaIfW_Wretr:\n\"thetaIfW \\<subseteq> Wretr (thetaIfW \\<union> Wbis)\"\nproof-\n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>w d1\" and c2d2: \"c2 \\<approx>w d2\"\n   hence matchC_M1: \"matchC_M Wbis c1 d1\" and matchC_M2: \"matchC_M Wbis c2 d2\"\n     and matchT_M1: \"matchT_M c1 d1\" and matchT_M2: \"matchT_M c2 d2\"\n   using Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> Wretr (thetaIfW \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaIfW \\<union> Wbis) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_M_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaIfW \\<union> Wbis) \\<or> \n        (\\<exists>t'. (If tst d1 d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIfW_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st transC_MtransC tst)\n       apply simp by (metis IfFalse c2d2 compatTst_def st transC_MtransC tst)\n     qed\n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaIfW_def by auto\nqed\n\nlemma thetaIfW_Wbis:\n\"thetaIfW \\<subseteq> Wbis\"\napply(rule Wbis_coind)\nusing thetaIfW_sym thetaIfW_Wretr by auto\n\ntheorem If_Wbis[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>w d1\" and \"c2 \\<approx>w d2\"\nshows \"If tst c1 c2 \\<approx>w If tst d1 d2\"\nusing assms thetaIfW_Wbis unfolding thetaIfW_def by blast\n\ntext\\<open>While loop:\\<close>\n\ntext\\<open>Again, w-bisimilarity does not interact with / preserve the While construct in \nany interesting way.\\<close>\n\ntext\\<open>Parallel composition:\\<close>\n\ndefinition thetaParWL1 where \n\"thetaParWL1 \\<equiv> \n {(Par c1 c2, d) | c1 c2 d. c1 \\<approx>w d \\<and> discr c2}\"\n\nlemma thetaParWL1_Wretr:\n\"thetaParWL1 \\<subseteq> Wretr (thetaParWL1 \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d\n   assume c1d: \"c1 \\<approx>w d\" and c2: \"discr c2\"\n   hence matchC_M: \"matchC_M Wbis c1 d\" \n     and matchT_M: \"matchT_M c1 d\" \n   using Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(Par c1 c2, d) \\<in> Wretr (thetaParWL1 \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaParWL1 \\<union> Wbis) (Par c1 c2) d\"\n     unfolding matchC_M_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus\n       \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParWL1 \\<union> Wbis) \\<or>\n        (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \n         \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>w d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_M unfolding matchC_M_def by blast\n         thus ?thesis unfolding thetaParWL1_def\n         apply - apply(elim disjE exE conjE) \n         apply simp apply (metis c2 c')\n         apply simp by (metis c' c2 discr_Par) \n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n         using st matchT_M unfolding matchT_M_def by blast\n         thus ?thesis unfolding thetaParWL1_def\n         apply - apply(elim disjE exE conjE)\n         apply simp apply (metis c' c2 discr_Wbis)\n         apply simp by (metis c' c2)  \n       next\n         fix c2' assume c2s: \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \"s \\<approx> s'\" using c2 discr_transC_indis by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         have \"discr c2'\" using c2 c2s discr_transC by blast\n         thus ?thesis using s't c1d unfolding thetaParWL1_def c' by auto\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"s \\<approx> s'\" using c2 discr_transT by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         thus ?thesis using c1d unfolding thetaParWL1_def c' by auto\n       qed\n     qed\n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaParWL1_def by blast\nqed\n\nlemma thetaParWL1_converse_Wretr:\n\"thetaParWL1 ^-1 \\<subseteq> Wretr (thetaParWL1 ^-1 \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d\n   assume c1d: \"c1 \\<approx>w d\" and c2: \"discr c2\"\n   hence matchC_M: \"matchC_M Wbis d c1\" \n     and matchT_M: \"matchT_M d c1\" \n   using Wbis_matchC_M_rev Wbis_matchT_M_rev by auto\n   have \"(d, Par c1 c2) \\<in> Wretr (thetaParWL1\\<inverse> \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaParWL1\\<inverse> \\<union> Wbis) d (Par c1 c2)\"\n     unfolding matchC_M_def2 Wbis_converse proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>) \n       fix s t d' t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>c (d', t')\"\n       hence \n       \"(\\<exists>c' s'. (c1, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> d' \\<approx>w c') \\<or> \n        (\\<exists>s'. (c1, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       using matchC_M unfolding matchC_M_def2 by blast\n       thus\n       \"(\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParWL1 \\<union> Wbis) \\<or>\n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       unfolding thetaParWL1_def \n       apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       apply simp apply (metis PL.ParCL_MtransC Wbis_Sym c2)\n       apply simp by (metis PL.ParTL_MtransC c2 discr_Wbis)\n     qed\n   next\n     show \"matchT_M d (Par c1 c2)\"\n     unfolding matchT_M_def2 Wbis_converse proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>) \n       fix s t t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>t t'\"\n       hence \n       \"(\\<exists>c' s'. (c1, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (c1, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t')\"\n       using matchT_M unfolding matchT_M_def2 by blast\n       thus\n       \"(\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t')\"\n       apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       apply (metis PL.ParCL_MtransC c2 discr_Par)\n       by (metis PL.ParTL_MtransC c2)  \n     qed\n   qed\n  }\n  thus ?thesis unfolding thetaParWL1_def by blast\nqed\n\nlemma thetaParWL1_Wbis:\n\"thetaParWL1 \\<subseteq> Wbis\"\napply(rule Wbis_coind2)\nusing thetaParWL1_Wretr thetaParWL1_converse_Wretr by auto\n\ntheorem Par_Wbis_discrL1[simp]:\nassumes \"c1 \\<approx>w d\" and \"discr c2\"\nshows \"Par c1 c2 \\<approx>w d\"\nusing assms thetaParWL1_Wbis unfolding thetaParWL1_def by blast\n\ntheorem Par_Wbis_discrR1[simp]:\nassumes \"c \\<approx>w d1\" and \"discr d2\"\nshows \"c \\<approx>w Par d1 d2\"\nusing assms Par_Wbis_discrL1 Wbis_Sym by blast\n\n(*  *)\n\ndefinition thetaParWL2 where \n\"thetaParWL2 \\<equiv> \n {(Par c1 c2, d) | c1 c2 d. discr c1 \\<and> c2 \\<approx>w d}\"\n\nlemma thetaParWL2_Wretr:\n\"thetaParWL2 \\<subseteq> Wretr (thetaParWL2 \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d\n   assume c2d: \"c2 \\<approx>w d\" and c1: \"discr c1\" \n   hence matchC_M: \"matchC_M Wbis c2 d\" \n     and matchT_M: \"matchT_M c2 d\" \n   using Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(Par c1 c2, d) \\<in> Wretr (thetaParWL2 \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaParWL2 \\<union> Wbis) (Par c1 c2) d\"\n     unfolding matchC_M_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus\n       \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParWL2 \\<union> Wbis) \\<or>\n        (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \"s \\<approx> s'\" using c1 discr_transC_indis by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         have \"discr c1'\" using c1 c1s discr_transC by blast\n         thus ?thesis using s't c2d unfolding thetaParWL2_def c' by auto\n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"s \\<approx> s'\" using c1 discr_transT by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         thus ?thesis using c2d unfolding thetaParWL2_def c' by auto\n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \n         \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>w d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c2')\"\n         using st matchC_M unfolding matchC_M_def by blast\n         thus ?thesis unfolding thetaParWL2_def\n         apply - apply(elim disjE exE conjE) \n         apply simp apply (metis c1 c')\n         apply simp by (metis c' c1 discr_Par) \n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \n         \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n         using st matchT_M unfolding matchT_M_def by blast\n         thus ?thesis unfolding thetaParWL2_def\n         apply - apply(elim disjE exE conjE)\n         apply simp apply (metis c' c1 discr_Wbis)\n         apply simp by (metis c' c1)          \n       qed\n     qed\n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaParWL2_def by blast\nqed\n\nlemma thetaParWL2_converse_Wretr:\n\"thetaParWL2 ^-1 \\<subseteq> Wretr (thetaParWL2 ^-1 \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d\n   assume c2d: \"c2 \\<approx>w d\" and c1: \"discr c1\"\n   hence matchC_M: \"matchC_M Wbis d c2\" \n     and matchT_M: \"matchT_M d c2\" \n   using Wbis_matchC_M_rev Wbis_matchT_M_rev by auto\n   have \"(d, Par c1 c2) \\<in> Wretr (thetaParWL2\\<inverse> \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaParWL2\\<inverse> \\<union> Wbis) d (Par c1 c2)\"\n     unfolding matchC_M_def2 Wbis_converse proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>) \n       fix s t d' t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>c (d', t')\"\n       hence \n       \"(\\<exists>c' s'. (c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> d' \\<approx>w c') \\<or> \n        (\\<exists>s'. (c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       using matchC_M unfolding matchC_M_def2 by blast\n       thus\n       \"(\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParWL2 \\<union> Wbis) \\<or>\n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       unfolding thetaParWL2_def \n       apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       apply simp apply (metis PL.ParCR_MtransC Wbis_Sym c1)\n       apply simp by (metis PL.ParTR_MtransC c1 discr_Wbis) \n     qed\n   next\n     show \"matchT_M d (Par c1 c2)\"\n     unfolding matchT_M_def2 Wbis_converse proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>) \n       fix s t t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>t t'\"\n       hence \n       \"(\\<exists>c' s'. (c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t')\"\n       using matchT_M unfolding matchT_M_def2 by blast\n       thus\n       \"(\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t')\"\n       apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       apply (metis PL.ParCR_MtransC c1 discr_Par)\n       by (metis PL.ParTR_MtransC c1)\n     qed\n   qed\n  }\n  thus ?thesis unfolding thetaParWL2_def by blast\nqed\n\nlemma thetaParWL2_Wbis:\n\"thetaParWL2 \\<subseteq> Wbis\"\napply(rule Wbis_coind2)\nusing thetaParWL2_Wretr thetaParWL2_converse_Wretr by auto\n\ntheorem Par_Wbis_discrL2[simp]:\nassumes \"c2 \\<approx>w d\" and \"discr c1\"\nshows \"Par c1 c2 \\<approx>w d\"\nusing assms thetaParWL2_Wbis unfolding thetaParWL2_def by blast\n\ntheorem Par_Wbis_discrR2[simp]:\nassumes \"c \\<approx>w d2\" and \"discr d1\"\nshows \"c \\<approx>w Par d1 d2\"\nusing assms Par_Wbis_discrL2 Wbis_Sym by blast\n\n(*  *)\n\ndefinition thetaParW where \n\"thetaParW \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>w d1 \\<and> c2 \\<approx>w d2}\"\n\nlemma thetaParW_sym:\n\"sym thetaParW\"\nunfolding thetaParW_def sym_def using Wbis_Sym by blast\n\nlemma thetaParW_Wretr:\n\"thetaParW \\<subseteq> Wretr (thetaParW \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>w d1\" and c2d2: \"c2 \\<approx>w d2\"\n   hence matchC_M1: \"matchC_M Wbis c1 d1\" and matchC_M2: \"matchC_M Wbis c2 d2\"\n     and matchT_M1: \"matchT_M c1 d1\" and matchT_M2: \"matchT_M c2 d2\"\n   using Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> Wretr (thetaParW \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaParW \\<union> Wbis) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_M_def proof (tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParW \\<union> Wbis) \\<or> \n        (\\<exists>t'. (Par d1 d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence\n         \"(\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>w d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_M1 unfolding matchC_M_def by blast\n         thus ?thesis unfolding c' thetaParW_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis PL.ParCL_MtransC c2d2) \n         apply simp by (metis PL.ParTL_MtransC Par_Wbis_discrL2 c2d2)\n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n         using st matchT_M1 unfolding matchT_M_def by blast\n         thus ?thesis \n         unfolding c' thetaParW_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis PL.ParCL_MtransC Par_Wbis_discrR2 c2d2)\n         apply simp by (metis PL.ParTL_MtransC c2d2) \n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \n         \"(\\<exists>d' t'. (d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>w d') \\<or> \n          (\\<exists>t'. (d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c2')\"\n         using st matchC_M2 unfolding matchC_M_def by blast\n         thus ?thesis \n         unfolding c' thetaParW_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis PL.ParCR_MtransC c1d1)\n         apply simp by (metis PL.ParTR_MtransC Par_Wbis_discrL1 c1d1) \n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \n         \"(\\<exists>d' t'. (d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n         using st matchT_M2 unfolding matchT_M_def by blast\n         thus ?thesis \n         unfolding c' thetaParW_def\n         apply - apply(tactic \\<open>mauto_no_simp_tac @{context}\\<close>)\n         apply simp apply (metis PL.ParCR_MtransC Par_Wbis_discrR1 c1d1) \n         apply simp by (metis PL.ParTR_MtransC c1d1)\n       qed\n     qed \n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaParW_def by auto\nqed\n\nlemma thetaParW_Wbis:\n\"thetaParW \\<subseteq> Wbis\"\napply(rule Wbis_coind)\nusing thetaParW_sym thetaParW_Wretr by auto\n\ntheorem Par_Wbis[simp]:\nassumes \"c1 \\<approx>w d1\" and \"c2 \\<approx>w d2\"\nshows \"Par c1 c2 \\<approx>w Par d1 d2\"\nusing assms thetaParW_Wbis unfolding thetaParW_def by blast\n\nend (* context PL_Indis *)\n(*******************************************)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Possibilistic_Noninterference/Compositionality.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632683808533, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.31142893526919224}}
{"text": "(*\n * Copyright 2018, Data61\n * Commonwealth Scientific and Industrial Research Organisation (CSIRO)\n * ABN 41 687 119 230.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(DATA61_BSD)\n *)\n\ntheory Cogent\n  imports Util\nbegin\n\ntype_synonym name = string\n\ntype_synonym index = nat\n\ntype_synonym field = nat\n\nsection {* Prim Ops  *}\n\ndatatype num_type = U8 | U16 | U32 | U64\n\ndatatype prim_type = Num num_type | Bool | String\n\ndatatype prim_op\n  = Plus num_type\n  | Minus num_type\n  | Times num_type\n  | Divide num_type\n  | Mod num_type\n  | Not | And | Or\n  | Gt num_type\n  | Lt num_type\n  | Le num_type\n  | Ge num_type\n  | Eq prim_type\n  | NEq prim_type\n  | BitAnd num_type\n  | BitOr num_type\n  | BitXor num_type\n  | LShift num_type\n  | RShift num_type\n  | Complement num_type\n\n\nsection {* Types *}\n\ndatatype ptr_layout = PtrBits int int\n                    | PtrVariant int int \"(name \\<times> int \\<times> ptr_layout) list\"\n                    | PtrRecord \"(name \\<times> ptr_layout) list\"\n\ndatatype access_perm = ReadOnly | Writable\n\n(* Sigils represent where the memory that makes up the datatype is, and its access permissions.\n *\n * Data is either boxed (on the heap), or unboxed (on the stack). If data is on the heap, we keep\n * track of how it is represented, and what access permissions it requires.\n *)\ndatatype sigil = Boxed access_perm ptr_layout\n               | Unboxed\n\nlemma sigil_cases:\n  obtains (SBoxRo) r where \"x = Boxed ReadOnly r\"\n  | (SBoxWr) r where \"x = Boxed Writable r\"\n  | (SUnbox) \"x = Unboxed\"\nproof (cases x)\n  case (Boxed p r)\n  moreover assume \"(\\<And>r. x = Boxed ReadOnly r \\<Longrightarrow> thesis)\"\n    and \"(\\<And>r. x = Boxed Writable r \\<Longrightarrow> thesis)\"\n  ultimately show ?thesis\n    by (cases p, simp+)\nqed simp\n\nprimrec sigil_perm :: \"sigil \\<Rightarrow> access_perm option\" where\n  \"sigil_perm (Boxed p _) = Some p\"\n| \"sigil_perm Unboxed     = None\"\n\n\nsubsection {* Types *}\n\n(* the states of elements in variants/records *)\ndatatype variant_state = Checked | Unchecked\ndatatype record_state = Taken | Present\n\n(* variant and record states are boolean algebras.\n   This should match up with the subtyping lattice ops. *)\n\ninstantiation variant_state :: \"{boolean_algebra, linorder}\"\nbegin\n\nfun uminus_variant_state :: \"variant_state \\<Rightarrow> variant_state\" where\n  \"uminus_variant_state Checked   = Unchecked\"\n| \"uminus_variant_state Unchecked = Checked\"\n\ndefinition top_variant_state :: variant_state where\n  \"top_variant_state \\<equiv> Unchecked\"\ndeclare top_variant_state_def[simp]\n\ndefinition bot_variant_state :: variant_state where\n  \"bot_variant_state \\<equiv> Checked\"\ndeclare bot_variant_state_def[simp]\n\nfun inf_variant_state :: \"variant_state \\<Rightarrow> variant_state \\<Rightarrow> variant_state\" where\n  \"inf_variant_state Checked   _         = Checked\"\n| \"inf_variant_state Unchecked Checked   = Checked\"\n| \"inf_variant_state Unchecked Unchecked = Unchecked\"\n\nfun sup_variant_state :: \"variant_state \\<Rightarrow> variant_state \\<Rightarrow> variant_state\" where\n  \"sup_variant_state Unchecked _         = Unchecked\"\n| \"sup_variant_state Checked   Unchecked = Unchecked\"\n| \"sup_variant_state Checked   Checked   = Checked\"\n\nfun less_eq_variant_state :: \"variant_state \\<Rightarrow> variant_state \\<Rightarrow> bool\" where\n  \"less_eq_variant_state _         Unchecked = True\"\n| \"less_eq_variant_state Checked   Checked   = True\"\n| \"less_eq_variant_state Unchecked Checked   = False\"\n\nfun less_variant_state :: \"variant_state \\<Rightarrow> variant_state \\<Rightarrow> bool\" where\n  \"less_variant_state _         Checked   = False\"\n| \"less_variant_state Unchecked Unchecked = False\"\n| \"less_variant_state Checked   Unchecked = True\"\n\ndefinition minus_variant_state :: \"variant_state \\<Rightarrow> variant_state \\<Rightarrow> variant_state\" where\n  \"minus_variant_state x y \\<equiv> inf x (- y)\"\ndeclare minus_variant_state_def[simp]\n\ninstance proof\n  fix x y z :: variant_state\n\n  show \"(x < y) = (x \\<le> y \\<and> \\<not> y \\<le> x)\"\n    by (cases x; cases y; clarsimp)\n  show \"x \\<le> x\"\n    by (cases x; clarsimp)\n  show \"x \\<le> y \\<Longrightarrow> y \\<le> z \\<Longrightarrow> x \\<le> z\"\n    by (cases x; cases y; cases z; clarsimp)\n  show \"x \\<le> y \\<Longrightarrow> y \\<le> x \\<Longrightarrow> x = y\"\n    by (cases x; cases y; clarsimp)\n  show \"inf x y \\<le> x\" \"inf x y \\<le> y\"\n    by (cases x; cases y; clarsimp)+\n  show \"x \\<le> y \\<Longrightarrow> x \\<le> z \\<Longrightarrow> x \\<le> inf y z\"\n    by (cases x; cases y; cases z; clarsimp)\n  show \"x \\<le> sup x y\"\n    by (cases x; cases y; clarsimp)\n  show \"y \\<le> sup x y\"\n    by (cases x; cases y; clarsimp)\n  show \"y \\<le> x \\<Longrightarrow> z \\<le> x \\<Longrightarrow> sup y z \\<le> x\"\n    by (cases x; cases y; cases z; clarsimp)\n  show \"bot \\<le> x\" \"x \\<le> top\"\n    by (cases x; simp)+\n  show \"sup x (inf y z) = inf (sup x y) (sup x z)\"\n    by (cases x; cases y; cases z; simp)\n  show\n    \"inf x (- x) = bot\"\n    \"sup x (- x) = top\"\n    by (cases x; simp)+\n  show \"x - y = inf x (- y)\"\n    by simp\n  show \"x \\<le> y \\<or> y \\<le> x\"\n    by (cases x; cases y; simp)\nqed\nend\n\ninstantiation record_state :: \"{boolean_algebra, linorder}\"\nbegin\n\nfun uminus_record_state :: \"record_state \\<Rightarrow> record_state\" where\n  \"uminus_record_state Taken   = Present\"\n| \"uminus_record_state Present = Taken\"\n\ndefinition top_record_state :: record_state where\n  \"top_record_state \\<equiv> Taken\"\ndeclare top_record_state_def[simp]\n\ndefinition bot_record_state :: record_state where\n  \"bot_record_state \\<equiv> Present\"\ndeclare bot_record_state_def[simp]\n\nfun inf_record_state :: \"record_state \\<Rightarrow> record_state \\<Rightarrow> record_state\" where\n  \"inf_record_state Present _       = Present\"\n| \"inf_record_state Taken   Present = Present\"\n| \"inf_record_state Taken   Taken   = Taken\"\n\nfun sup_record_state :: \"record_state \\<Rightarrow> record_state \\<Rightarrow> record_state\" where\n  \"sup_record_state Taken   _       = Taken\"\n| \"sup_record_state Present Taken   = Taken\"\n| \"sup_record_state Present Present = Present\"\n\nfun less_eq_record_state :: \"record_state \\<Rightarrow> record_state \\<Rightarrow> bool\" where\n  \"less_eq_record_state _       Taken   = True\"\n| \"less_eq_record_state Present Present = True\"\n| \"less_eq_record_state Taken   Present = False\"\n\nfun less_record_state :: \"record_state \\<Rightarrow> record_state \\<Rightarrow> bool\" where\n  \"less_record_state _       Present = False\"\n| \"less_record_state Taken   Taken   = False\"\n| \"less_record_state Present Taken   = True\"\n\ndefinition minus_record_state :: \"record_state \\<Rightarrow> record_state \\<Rightarrow> record_state\" where\n  \"minus_record_state x y \\<equiv> inf x (- y)\"\ndeclare minus_record_state_def[simp]\n\ninstance proof\n  fix x y z :: record_state\n\n  show \"(x < y) = (x \\<le> y \\<and> \\<not> y \\<le> x)\"\n    by (cases x; cases y; clarsimp)\n  show \"x \\<le> x\"\n    by (cases x; clarsimp)\n  show \"x \\<le> y \\<Longrightarrow> y \\<le> z \\<Longrightarrow> x \\<le> z\"\n    by (cases x; cases y; cases z; clarsimp)\n  show \"x \\<le> y \\<Longrightarrow> y \\<le> x \\<Longrightarrow> x = y\"\n    by (cases x; cases y; clarsimp)\n  show \"inf x y \\<le> x\" \"inf x y \\<le> y\"\n    by (cases x; cases y; clarsimp)+\n  show \"x \\<le> y \\<Longrightarrow> x \\<le> z \\<Longrightarrow> x \\<le> inf y z\"\n    by (cases x; cases y; cases z; clarsimp)\n  show \"x \\<le> sup x y\"\n    by (cases x; cases y; clarsimp)\n  show \"y \\<le> sup x y\"\n    by (cases x; cases y; clarsimp)\n  show \"y \\<le> x \\<Longrightarrow> z \\<le> x \\<Longrightarrow> sup y z \\<le> x\"\n    by (cases x; cases y; cases z; clarsimp)\n  show \"bot \\<le> x\" \"x \\<le> top\"\n    by (cases x; simp)+\n  show \"sup x (inf y z) = inf (sup x y) (sup x z)\"\n    by (cases x; cases y; cases z; simp)\n  show\n    \"inf x (- x) = bot\"\n    \"sup x (- x) = top\"\n    by (cases x; simp)+\n  show \"x - y = inf x (- y)\"\n    by simp\n  show \"x \\<le> y \\<or> y \\<le> x\"\n    by (cases x; cases y; simp)\nqed\nend\n\n\nsubsection {* variants *}\n\nfun variant_un_step :: \"(['t, 't] \\<Rightarrow> 't) \\<Rightarrow> ([bool, bool] \\<Rightarrow> bool) \\<Rightarrow> ('a \\<times> 't \\<times> bool) \\<Rightarrow> ('a \\<times> 't \\<times> bool) list \\<Rightarrow> ('a \\<times> 't \\<times> bool) option\" where\n  \"variant_un_step f g (tag, t, b) ys = (case find (\\<lambda>p. fst p = tag) ys of\n                                          Some (tag', t', b') \\<Rightarrow> Some (tag, f t t', g b b')\n                                        | None \\<Rightarrow> None)\"\n\n(* precondition: \\<open>fst ` set xs = fst ` set ys\\<close> *)\ndefinition variant_un :: \"(['t, 't] \\<Rightarrow> 't) \\<Rightarrow> ([bool, bool] \\<Rightarrow> bool) \\<Rightarrow> ('a \\<times> 't \\<times> bool) list \\<Rightarrow> ('a \\<times> 't \\<times> bool) list \\<Rightarrow> ('a \\<times> 't \\<times> bool) list\" where\n  \"variant_un f g xs ys = fold (\\<lambda>x acc. case variant_un_step f g x ys of\n                                          Some xy \\<Rightarrow> xy # acc\n                                        | None \\<Rightarrow> acc) xs []\"\n\n\nfun variant_un_tailrec :: \"(['t, 't] \\<Rightarrow> 't) \\<Rightarrow> ([bool, bool] \\<Rightarrow> bool) \\<Rightarrow> ('a \\<times> 't \\<times> bool) list \\<Rightarrow> ('a \\<times> 't \\<times> bool) list \\<Rightarrow> ('a \\<times> 't \\<times> bool) list \\<Rightarrow> ('a \\<times> 't \\<times> bool) list\" where\n  \"variant_un_tailrec f g [] ys acc = acc\"\n| \"variant_un_tailrec f g (x # xs) ys acc = (case find (\\<lambda>p. fst p = fst x) ys of\n                                          Some p \\<Rightarrow> (fst x, f (fst (snd x)) (fst (snd p)), g (snd (snd x)) (snd (snd p))) # acc\n                                        | None \\<Rightarrow> acc)\"\n\nlemma variant_un_bound_generalised:\n  shows \"length (fold (\\<lambda>x acc. case variant_un_step f g x ys of\n                                 Some xy \\<Rightarrow> xy # acc\n                               | None \\<Rightarrow> acc) xs init) \\<le> length init + length xs + length ys\"\nproof (induct xs arbitrary: init)\n  case (Cons x xs)\n  then show ?case\n  proof (cases \"variant_un_step f g x ys\")\n    case (Some a)\n    then show ?thesis\n      using Cons\n      by (simp, metis (no_types, lifting) add_Suc length_Cons)\n  qed (simp add: le_Suc_eq)\nqed simp\n\nlemma variant_un_bound: \"length (variant_un f g xs ys) \\<le> length xs + length ys\"\n  using variant_un_bound_generalised[where init=\"[]\"]\n  by (simp add: variant_un_def)\n\n\nsubsection {* types *}\n\ndatatype type = TVar index\n              | TVarBang index\n              | TCon name \"type list\" sigil\n              | TFun type type\n              | TPrim prim_type\n              | TSum \"(name \\<times> type \\<times> variant_state) list\"\n              | TProduct type type\n              | TRecord \"(name \\<times> type \\<times> record_state) list\" sigil\n              | TUnit\n\ndatatype lit = LBool bool\n             | LU8 \"8 word\"\n             | LU16 \"16 word\"\n             | LU32 \"32 word\"\n             | LU64 \"64 word\"\n             (* etc *)\n\nfun cast_to :: \"num_type \\<Rightarrow> lit \\<Rightarrow> lit option\" where\n  \"cast_to U8  (LU8  x) = Some (LU8 x)\"\n| \"cast_to U16 (LU8  x) = Some (LU16 (ucast x))\"\n| \"cast_to U16 (LU16 x) = Some (LU16 x)\"\n| \"cast_to U32 (LU8  x) = Some (LU32 (ucast x))\"\n| \"cast_to U32 (LU16 x) = Some (LU32 (ucast x))\"\n| \"cast_to U32 (LU32 x) = Some (LU32 x)\"\n| \"cast_to U64 (LU8  x) = Some (LU64 (ucast x))\"\n| \"cast_to U64 (LU16 x) = Some (LU64 (ucast x))\"\n| \"cast_to U64 (LU32 x) = Some (LU64 (ucast x))\"\n| \"cast_to U64 (LU64 x) = Some (LU64 x)\"\n\nsection {* Expressions *}\n\ndatatype 'f expr = Var index\n                 | AFun 'f  \"type list\"\n                 | Fun \"'f expr\" \"type list\"\n                 | Prim prim_op \"'f expr list\"\n                 | App \"'f expr\" \"'f expr\"\n                 | Con \"(name \\<times> type \\<times> variant_state) list\" name \"'f expr\"\n                 | Struct \"type list\" \"'f expr list\"\n                 | Member \"'f expr\" field\n                 | Unit\n                 | Lit lit\n                 | SLit string\n                 | Cast num_type \"'f expr\"\n                 | Tuple \"'f expr\" \"'f expr\"\n                 | Put \"'f expr\" field \"'f expr\"\n                 | Let \"'f expr\" \"'f expr\"\n                 | LetBang \"index set\" \"'f expr\" \"'f expr\"\n                 | Case \"'f expr\" name \"'f expr\" \"'f expr\"\n                 | Esac \"'f expr\" name\n                 | If \"'f expr\" \"'f expr\" \"'f expr\"\n                 | Take \"'f expr\" field \"'f expr\"\n                 | Split \"'f expr\" \"'f expr\"\n                 | Promote type \"'f expr\"\n\nsection {* Kinds *}\n\ndatatype kind_comp\n  = D (* Drop *)\n  | S (* Share *)\n  | E (* Escape *)\n\ntype_synonym kind = \"kind_comp set\"\n\ntype_synonym poly_type = \"kind list \\<times> type \\<times> type\"\n\ntype_synonym 'v env  = \"'v list\"\n\ntype_synonym 'a substitution = \"'a list\"\n\nfun sigil_kind :: \"sigil \\<Rightarrow> kind\" where\n  \"sigil_kind (Boxed ReadOnly _) = {D,S}\"\n| \"sigil_kind (Boxed Writable _) = {E}\"\n| \"sigil_kind Unboxed            = {D,S,E}\"\n\n\nfun type_wellformed :: \"nat \\<Rightarrow> type \\<Rightarrow> bool\" where\n  \"type_wellformed n (TVar i) = (i < n)\"\n| \"type_wellformed n (TVarBang i) = (i < n)\"\n| \"type_wellformed n (TCon _ ts _) = list_all (\\<lambda>x. type_wellformed n x) ts\"\n| \"type_wellformed n (TFun t1 t2) = (type_wellformed n t1 \\<and> type_wellformed n t2)\"\n| \"type_wellformed n (TPrim _) = True\"\n| \"type_wellformed n (TSum ts) = (distinct (map fst ts) \\<and> (list_all (\\<lambda>x. type_wellformed n (fst (snd x))) ts))\"\n| \"type_wellformed n (TProduct t1 t2) = (type_wellformed n t1 \\<and> type_wellformed n t2)\"\n| \"type_wellformed n (TRecord ts _) = (distinct (map fst ts) \\<and> (list_all (\\<lambda>x. type_wellformed n (fst (snd x))) ts))\"\n| \"type_wellformed n TUnit = True\"\n\ndefinition type_wellformed_pretty :: \"kind env \\<Rightarrow> type \\<Rightarrow> bool\" (\"_ \\<turnstile> _ wellformed\" [30,20] 60) where\n  \"K \\<turnstile> t wellformed \\<equiv> type_wellformed (length K) t\"\ndeclare type_wellformed_pretty_def[simp]\n\nlemma type_wellformed_intros:\n  \"\\<And>n i. i < n \\<Longrightarrow> type_wellformed n (TVar i)\"\n  \"\\<And>n i. i < n \\<Longrightarrow> type_wellformed n (TVarBang i)\"\n  \"\\<And>n name ts s. list_all (\\<lambda>x. type_wellformed n x) ts \\<Longrightarrow> type_wellformed n (TCon name ts s)\"\n  \"\\<And>n t1 t2. \\<lbrakk> type_wellformed n t1 ; type_wellformed n t2 \\<rbrakk> \\<Longrightarrow> type_wellformed n (TFun t1 t2)\"\n  \"\\<And>n p. type_wellformed n (TPrim p)\"\n  \"\\<And>n ts. \\<lbrakk> distinct (map fst ts) ; list_all (\\<lambda>x. type_wellformed n (fst (snd x))) ts \\<rbrakk> \\<Longrightarrow> type_wellformed n (TSum ts)\"\n  \"\\<And>n t1 t2. \\<lbrakk> type_wellformed n t1 ; type_wellformed n t2 \\<rbrakk> \\<Longrightarrow> type_wellformed n (TProduct t1 t2)\"\n  \"\\<And>n ts s. \\<lbrakk> distinct (map fst ts) ; list_all (\\<lambda>x. type_wellformed n (fst (snd x))) ts \\<rbrakk> \\<Longrightarrow> type_wellformed n (TRecord ts s)\"\n  \"\\<And>n. type_wellformed n TUnit\"\n  by (simp add: list_all_iff)+\n\nlemma type_wellformed_pretty_intros:\n  \"\\<And>K i. i < length K \\<Longrightarrow> type_wellformed_pretty K (TVar i)\"\n  \"\\<And>K i. i < length K \\<Longrightarrow> type_wellformed_pretty K (TVarBang i)\"\n  \"\\<And>K name ts s. list_all (\\<lambda>x. type_wellformed_pretty K x) ts \\<Longrightarrow> type_wellformed_pretty K (TCon name ts s)\"\n  \"\\<And>K t1 t2. \\<lbrakk> type_wellformed_pretty K t1 ; type_wellformed_pretty K t2 \\<rbrakk> \\<Longrightarrow> type_wellformed_pretty K (TFun t1 t2)\"\n  \"\\<And>K p. type_wellformed_pretty K (TPrim p)\"\n  \"\\<And>K ts. \\<lbrakk> distinct (map fst ts) ; list_all (\\<lambda>x. type_wellformed_pretty K (fst (snd x))) ts \\<rbrakk> \\<Longrightarrow> type_wellformed_pretty K (TSum ts)\"\n  \"\\<And>K t1 t2. \\<lbrakk> type_wellformed_pretty K t1 ; type_wellformed_pretty K t2 \\<rbrakk> \\<Longrightarrow> type_wellformed_pretty K (TProduct t1 t2)\"\n  \"\\<And>K ts s. \\<lbrakk> distinct (map fst ts) ; list_all (\\<lambda>x. type_wellformed_pretty K (fst (snd x))) ts \\<rbrakk> \\<Longrightarrow> type_wellformed_pretty K (TRecord ts s)\"\n  \"\\<And>K. type_wellformed_pretty K TUnit\"\n  by (simp add: list_all_iff)+\n\ndefinition type_wellformed_all_pretty :: \"kind env \\<Rightarrow> type list \\<Rightarrow> bool\" (\"_ \\<turnstile>* _ wellformed\" [30,20] 60) where\n  \"K \\<turnstile>* ts wellformed \\<equiv> (\\<forall>t\\<in>set ts. type_wellformed (length K) t)\"\ndeclare type_wellformed_all_pretty_def[simp]\n\ndefinition proc_ctx_wellformed :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow> bool\" where\n  \"proc_ctx_wellformed \\<Xi> = (\\<forall> f. let (K, \\<tau>i, \\<tau>o) = \\<Xi> f in K \\<turnstile> TFun \\<tau>i \\<tau>o wellformed)\"\n\n\nfun kinding_fn :: \"kind env \\<Rightarrow> type \\<Rightarrow> kind\" where\n  \"kinding_fn K (TVar i)         = (if i < length K then K ! i else undefined)\"\n| \"kinding_fn K (TVarBang i)     = {D,S}\"\n| \"kinding_fn K (TCon n ts s)    = Inter (set (map (kinding_fn K) ts)) \\<inter> (sigil_kind s)\"\n| \"kinding_fn K (TFun ta tb)     = UNIV\"\n| \"kinding_fn K (TPrim p)        = UNIV\"\n| \"kinding_fn K (TSum ts)        = Inter (set (map (\\<lambda>(_,t,b). case b of Unchecked \\<Rightarrow> kinding_fn K t | Checked \\<Rightarrow> UNIV) ts))\"\n| \"kinding_fn K (TProduct ta tb) = kinding_fn K ta \\<inter> kinding_fn K tb\"\n| \"kinding_fn K (TRecord ts s)   = Inter (set (map (\\<lambda>(_,t,b). case b of Present \\<Rightarrow> kinding_fn K t | Taken \\<Rightarrow> UNIV) ts)) \\<inter> (sigil_kind s)\"\n| \"kinding_fn K TUnit            = UNIV\"\n\nlemmas kinding_fn_induct = kinding_fn.induct[case_names kind_tvar kind_tvarb kind_tcon kind_tfun kind_tprim kind_tsum kind_tprod kind_trec kind_tunit]\n\n\ndefinition kinding :: \"kind env \\<Rightarrow> type \\<Rightarrow> kind \\<Rightarrow> bool\" (\"_ \\<turnstile> _ :\\<kappa> _\" [30,0,30] 60) where\n  \"K \\<turnstile> t :\\<kappa> k \\<equiv> K \\<turnstile> t wellformed \\<and> k \\<subseteq> kinding_fn K t\"\n\nlemma kindingI:\n  \"K \\<turnstile> t wellformed \\<Longrightarrow> k \\<subseteq> kinding_fn K t \\<Longrightarrow> K \\<turnstile> t :\\<kappa> k\"\n  by (simp add: kinding_def)\n\ndefinition kinding_all :: \"kind env \\<Rightarrow> type list \\<Rightarrow> kind \\<Rightarrow> bool\" (\"_ \\<turnstile>* _ :\\<kappa> _\" [30,0,30] 60) where\n  \"K \\<turnstile>* ts :\\<kappa> k \\<equiv> (\\<forall>t\\<in>set ts. K \\<turnstile> t wellformed) \\<and> k \\<subseteq> (\\<Inter>t\\<in>set ts. kinding_fn K t)\"\n\ndefinition kinding_variant :: \"kind env \\<Rightarrow> (name \\<times> type \\<times> variant_state) list \\<Rightarrow> kind \\<Rightarrow> bool\" (\"_ \\<turnstile>* _ :\\<kappa>v _\" [30,0,60] 60) where\n  \"K \\<turnstile>* ts :\\<kappa>v k \\<equiv> (\\<forall>(_,t,_)\\<in>set ts. K \\<turnstile> t wellformed) \\<and> k \\<subseteq> (\\<Inter>(_,t,b)\\<in>set ts. (case b of Checked \\<Rightarrow> UNIV | Unchecked \\<Rightarrow> kinding_fn K t))\"\n\ndefinition kinding_record  :: \"kind env \\<Rightarrow> (name \\<times> type \\<times> record_state) list \\<Rightarrow> kind \\<Rightarrow> bool\" (\"_ \\<turnstile>* _ :\\<kappa>r _\" [30,0,30] 60) where\n  \"K \\<turnstile>* ts :\\<kappa>r k \\<equiv> (\\<forall>(_,t,_)\\<in>set ts. K \\<turnstile> t wellformed) \\<and> k \\<subseteq> (\\<Inter>(_,t,b)\\<in>set ts. (case b of Taken \\<Rightarrow> UNIV | Present \\<Rightarrow> kinding_fn K t))\"\n\nlemmas kinding_defs = kinding_def kinding_all_def kinding_variant_def kinding_record_def\n\n\nsection {* Observation and type instantiation *}\n\nfun bang_sigil :: \"sigil \\<Rightarrow> sigil\" where\n  \"bang_sigil (Boxed ReadOnly r) = Boxed ReadOnly r\"\n| \"bang_sigil (Boxed Writable r) = Boxed ReadOnly r\"\n| \"bang_sigil Unboxed            = Unboxed\"\n\nfun bang :: \"type \\<Rightarrow> type\" where\n  \"bang (TVar i)       = TVarBang i\"\n| \"bang (TVarBang i)   = TVarBang i\"\n| \"bang (TCon n ts s)  = TCon n (map bang ts) (bang_sigil s)\"\n| \"bang (TFun a b)     = TFun a b\"\n| \"bang (TPrim p)      = TPrim p\"\n| \"bang (TSum ps)      = TSum (map (\\<lambda> (c, (t, b)). (c, (bang t, b))) ps)\"\n| \"bang (TProduct t u) = TProduct (bang t) (bang u)\"\n| \"bang (TRecord ts s) = TRecord (map (\\<lambda>(n, t, b). (n, bang t, b)) ts) (bang_sigil s)\"\n| \"bang (TUnit)        = TUnit\"\n\nfun instantiate :: \"type substitution \\<Rightarrow> type \\<Rightarrow> type\" where\n  \"instantiate \\<delta> (TVar i)       = (if i < length \\<delta> then \\<delta> ! i else TVar i)\"\n| \"instantiate \\<delta> (TVarBang i)   = (if i < length \\<delta> then bang (\\<delta> ! i) else TVarBang i)\"\n| \"instantiate \\<delta> (TCon n ts s)  = TCon n (map (instantiate \\<delta>) ts) s\"\n| \"instantiate \\<delta> (TFun a b)     = TFun (instantiate \\<delta> a) (instantiate \\<delta> b)\"\n| \"instantiate \\<delta> (TPrim p)      = TPrim p\"\n| \"instantiate \\<delta> (TSum ps)      = TSum (map (\\<lambda> (c, t, b). (c, instantiate \\<delta> t, b)) ps)\"\n| \"instantiate \\<delta> (TProduct t u) = TProduct (instantiate \\<delta> t) (instantiate \\<delta> u)\"\n| \"instantiate \\<delta> (TRecord ts s) = TRecord (map (\\<lambda> (n, t, b). (n, instantiate \\<delta> t, b)) ts) s\"\n| \"instantiate \\<delta> (TUnit)        = TUnit\"\n\nfun specialise :: \"type substitution \\<Rightarrow> 'f expr \\<Rightarrow> 'f expr\" where\n  \"specialise \\<delta> (Var i)           = Var i\"\n| \"specialise \\<delta> (Fun f ts)        = Fun f (map (instantiate \\<delta>) ts)\"\n| \"specialise \\<delta> (AFun f ts)       = AFun f (map (instantiate \\<delta>) ts)\"\n| \"specialise \\<delta> (Prim p es)       = Prim p (map (specialise \\<delta>) es)\"\n| \"specialise \\<delta> (App a b)         = App (specialise \\<delta> a) (specialise \\<delta> b)\"\n| \"specialise \\<delta> (Con as t e)      = Con (map (\\<lambda> (c,t,b). (c, instantiate \\<delta> t, b)) as) t (specialise \\<delta> e)\"\n| \"specialise \\<delta> (Struct ts vs)    = Struct (map (instantiate \\<delta>) ts) (map (specialise \\<delta>) vs)\"\n| \"specialise \\<delta> (Member v f)      = Member (specialise \\<delta> v) f\"\n| \"specialise \\<delta> (Unit)            = Unit\"\n| \"specialise \\<delta> (Cast t e)        = Cast t (specialise \\<delta> e)\"\n| \"specialise \\<delta> (Lit v)           = Lit v\"\n| \"specialise \\<delta> (SLit s)          = SLit s\"\n| \"specialise \\<delta> (Tuple a b)       = Tuple (specialise \\<delta> a) (specialise \\<delta> b)\"\n| \"specialise \\<delta> (Put e f e')      = Put (specialise \\<delta> e) f (specialise \\<delta> e')\"\n| \"specialise \\<delta> (Let e e')        = Let (specialise \\<delta> e) (specialise \\<delta> e')\"\n| \"specialise \\<delta> (LetBang vs e e') = LetBang vs (specialise \\<delta> e) (specialise \\<delta> e')\"\n| \"specialise \\<delta> (Case e t a b)    = Case (specialise \\<delta> e) t (specialise \\<delta> a) (specialise \\<delta> b)\"\n| \"specialise \\<delta> (Esac e t)        = Esac (specialise \\<delta> e) t\"\n| \"specialise \\<delta> (If c t e)        = If (specialise \\<delta> c) (specialise \\<delta> t) (specialise \\<delta> e)\"\n| \"specialise \\<delta> (Take e f e')     = Take (specialise \\<delta> e) f (specialise \\<delta> e')\"\n| \"specialise \\<delta> (Split v va)      = Split (specialise \\<delta> v) (specialise \\<delta> va)\"\n| \"specialise \\<delta> (Promote t x)     = Promote (instantiate \\<delta> t) (specialise \\<delta> x)\"\n\nsection {* Subtyping *}\n\nabbreviation record_kind_subty :: \"kind_comp set list \\<Rightarrow> name \\<times> Cogent.type \\<times> record_state \\<Rightarrow> name \\<times> Cogent.type \\<times> record_state \\<Rightarrow> bool\" where\n  \"record_kind_subty K p1 p2 \\<equiv> snd (snd p1) = snd (snd p2) \\<or> ((K \\<turnstile> (fst (snd p1)) :\\<kappa> {D}) \\<and> snd (snd p1) < snd (snd p2))\"\n\nabbreviation variant_kind_subty :: \"name \\<times> Cogent.type \\<times> variant_state \\<Rightarrow> name \\<times> Cogent.type \\<times> variant_state \\<Rightarrow> bool\" where\n  \"variant_kind_subty p1 p2 \\<equiv> snd (snd p1) \\<le> snd (snd p2)\"\n\ninductive subtyping :: \"kind env \\<Rightarrow> type \\<Rightarrow> type \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<sqsubseteq> _\" [40,0,40] 60) where\n  subty_tvar   : \"n1 = n2 \\<Longrightarrow> K \\<turnstile> TVar n1 \\<sqsubseteq> TVar n2\"\n| subty_tvarb  : \"n1 = n2 \\<Longrightarrow> K \\<turnstile> TVarBang n1 \\<sqsubseteq> TVarBang n2\"\n| subty_tcon   : \"\\<lbrakk> n1 = n2 ; s1 = s2 ; ts1 = ts2\n                  \\<rbrakk> \\<Longrightarrow> K \\<turnstile> TCon n1 ts1 s1 \\<sqsubseteq> TCon n2 ts2 s2\"\n| subty_tfun   : \"\\<lbrakk> K \\<turnstile> t2 \\<sqsubseteq> t1\n                  ; K \\<turnstile> u1 \\<sqsubseteq> u2\n                  \\<rbrakk> \\<Longrightarrow> K \\<turnstile> TFun t1 u1 \\<sqsubseteq> TFun t2 u2\"\n| subty_tprim  : \"\\<lbrakk> p1 = p2\n                  \\<rbrakk> \\<Longrightarrow> K \\<turnstile> TPrim p1 \\<sqsubseteq> TPrim p2\"\n| subty_trecord: \"\\<lbrakk> list_all2 (\\<lambda>p1 p2. subtyping K (fst (snd p1)) (fst (snd p2))) ts1 ts2\n                  ; map fst ts1 = map fst ts2\n                  ; list_all2 (record_kind_subty K) ts1 ts2\n                  ; s1 = s2\n                  \\<rbrakk> \\<Longrightarrow> K \\<turnstile> TRecord ts1 s1 \\<sqsubseteq> TRecord ts2 s2\"\n| subty_tprod  : \"\\<lbrakk> K \\<turnstile> t1 \\<sqsubseteq> t2\n                  ; K \\<turnstile> u1 \\<sqsubseteq> u2\n                  \\<rbrakk> \\<Longrightarrow> K \\<turnstile> TProduct t1 u1 \\<sqsubseteq> TProduct t2 u2\"\n| subty_tsum   : \"\\<lbrakk> list_all2 (\\<lambda>p1 p2. subtyping K (fst (snd p1)) (fst (snd p2))) ts1 ts2\n                  ; map fst ts1 = map fst ts2\n                  ; list_all2 variant_kind_subty ts1 ts2\n                  \\<rbrakk> \\<Longrightarrow> K \\<turnstile> TSum ts1 \\<sqsubseteq> TSum ts2\"\n| subty_tunit  : \"K \\<turnstile> TUnit \\<sqsubseteq> TUnit\"\n\n\nsection {* Contexts *}\n\ntype_synonym ctx = \"type option env\"\n\ndefinition empty :: \"nat \\<Rightarrow> ctx\" where\n  \"empty \\<equiv> (\\<lambda> x. replicate x None)\"\n\ndefinition singleton :: \"nat \\<Rightarrow> index \\<Rightarrow> type \\<Rightarrow> ctx\" where\n  \"singleton n i t \\<equiv> (empty n)[i := Some t]\"\n\ndeclare singleton_def [simp]\n\ndefinition instantiate_ctx :: \"type substitution \\<Rightarrow> ctx \\<Rightarrow> ctx\" where\n  \"instantiate_ctx \\<delta> \\<Gamma> \\<equiv> map (map_option (instantiate \\<delta>)) \\<Gamma>\"\n\ninductive split_comp :: \"kind env \\<Rightarrow> type option \\<Rightarrow> type option \\<Rightarrow> type option \\<Rightarrow> bool\"\n          (\"_ \\<turnstile> _ \\<leadsto> _ \\<parallel> _\" [30,0,0,20] 60) where\n  none  : \"K \\<turnstile> None \\<leadsto> None \\<parallel> None\"\n| left  : \"\\<lbrakk> K \\<turnstile> t wellformed \\<rbrakk> \\<Longrightarrow> K \\<turnstile> Some t \\<leadsto> Some t \\<parallel> None\"\n| right : \"\\<lbrakk> K \\<turnstile> t wellformed \\<rbrakk> \\<Longrightarrow> K \\<turnstile> Some t \\<leadsto> None   \\<parallel> Some t\"\n| share : \"\\<lbrakk> K \\<turnstile> t :\\<kappa> k; S \\<in> k \\<rbrakk> \\<Longrightarrow> K \\<turnstile> Some t \\<leadsto> Some t \\<parallel> Some t\"\n\ndefinition split :: \"kind env \\<Rightarrow> ctx \\<Rightarrow> ctx \\<Rightarrow> ctx \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<leadsto> _ | _\" [30,0,0,20] 60) where\n  \"split K \\<equiv> list_all3 (split_comp K)\"\n\nlemmas split_induct[consumes 1, case_names split_empty split_cons, induct set: list_all3]\n = list_all3_induct[where P=\"split_comp K\" for K, simplified split_def[symmetric]]\n\nlemmas split_empty = all3Nil[where P=\"split_comp K\" for K, simplified split_def[symmetric]]\nlemmas split_cons = all3Cons[where P=\"split_comp K\" for K, simplified split_def[symmetric]]\n\nlemmas split_Cons = list_all3_Cons[where P=\"split_comp K\" for K, simplified split_def[symmetric]]\nlemmas split_Cons1 = list_all3_Cons1[where P=\"split_comp K\" for K, simplified split_def[symmetric]]\nlemmas split_Cons2 = list_all3_Cons2[where P=\"split_comp K\" for K, simplified split_def[symmetric]]\nlemmas split_Cons3 = list_all3_Cons3[where P=\"split_comp K\" for K, simplified split_def[symmetric]]\n\nlemmas split_conv_all_nth = list_all3_conv_all_nth[where P=\"split_comp K\" for K, simplified split_def[symmetric]]\n\ndefinition pred :: \"nat \\<Rightarrow> nat\" where\n  \"pred n \\<equiv> (case n of Suc n' \\<Rightarrow> n')\"\n\ninductive split_bang_comp :: \"kind env \\<Rightarrow> bool \\<Rightarrow> type option \\<Rightarrow> type option \\<Rightarrow> type option \\<Rightarrow> bool\" (\"_ , _ \\<turnstile> _ \\<leadsto>b _ \\<parallel> _\" [55,0,0,0,55] 60) where\n  none   : \"K \\<turnstile> x \\<leadsto> a \\<parallel> b \\<Longrightarrow> K , False \\<turnstile> x \\<leadsto>b a \\<parallel> b\"\n| dobang : \"K \\<turnstile> x wellformed \\<Longrightarrow> K , True \\<turnstile> Some x \\<leadsto>b Some (bang x) \\<parallel> Some x\"\n\ninductive split_bang :: \"kind env \\<Rightarrow> index set \\<Rightarrow> ctx \\<Rightarrow> ctx \\<Rightarrow> ctx \\<Rightarrow> bool\"  (\"_ , _ \\<turnstile> _ \\<leadsto>b _ | _\" [55,0,0,0,55] 60) where\n  split_bang_empty : \"K , is \\<turnstile> [] \\<leadsto>b [] | []\"\n| split_bang_cons  : \"\\<lbrakk> K , (pred ` Set.remove (0 :: index) is) \\<turnstile> xs \\<leadsto>b as | bs\n                      ; K, (0 \\<in> is) \\<turnstile> x \\<leadsto>b a \\<parallel> b\n                      \\<rbrakk> \\<Longrightarrow> K , is \\<turnstile> x # xs \\<leadsto>b a # as | b # bs\"\n\nlemma split_bang_Cons:\n  \"K , is \\<turnstile> x # xs \\<leadsto>b a # as | b # bs \\<longleftrightarrow> (K, (0 \\<in> is) \\<turnstile> x \\<leadsto>b a \\<parallel> b \\<and> K , (pred ` Set.remove (0 :: index) is) \\<turnstile> xs \\<leadsto>b as | bs)\"\n  by (auto elim: split_bang.cases intro: split_bang.intros)\n\ninductive weakening_comp :: \"kind env \\<Rightarrow> type option \\<Rightarrow> type option \\<Rightarrow> bool\" where\n  none : \"weakening_comp K None None\"\n| keep : \"\\<lbrakk> K \\<turnstile> t wellformed \\<rbrakk> \\<Longrightarrow> weakening_comp K (Some t) (Some t)\"\n| drop : \"\\<lbrakk> K \\<turnstile> t :\\<kappa> k; D \\<in> k \\<rbrakk> \\<Longrightarrow> weakening_comp K (Some t) None\"\n\ndefinition weakening :: \"kind env \\<Rightarrow> ctx \\<Rightarrow> ctx \\<Rightarrow> bool\" (\"_ \\<turnstile> _ \\<leadsto>w _\" [30,0,20] 60) where\n  \"weakening K \\<equiv> list_all2 (weakening_comp K)\"\n\nlemmas weakening_induct[consumes 1, case_names weakening_empty weakening_cons, induct set: list_all2]\n = list_all2_induct[where P=\"weakening_comp K\" for K, simplified weakening_def[symmetric]]\n\nlemmas weakening_nil = List.list.rel_intros(1)[where R=\"weakening_comp K\" for K, simplified weakening_def[symmetric]]\nlemmas weakening_cons =  List.list.rel_intros(2)[where R=\"weakening_comp K\" for K, simplified weakening_def[symmetric]]\n\nlemmas weakening_Cons = list_all2_Cons[where P=\"weakening_comp K\" for K, simplified weakening_def[symmetric]]\n\nlemmas weakening_conv_all_nth = list_all2_conv_all_nth[where P=\"weakening_comp K\" for K, simplified weakening_def[symmetric]]\n\n\ndefinition is_consumed :: \"kind env \\<Rightarrow> ctx \\<Rightarrow> bool\" (\"_ \\<turnstile> _ consumed\" [30,20] 60 ) where\n  \"K \\<turnstile> \\<Gamma> consumed \\<equiv> K \\<turnstile> \\<Gamma> \\<leadsto>w empty (length \\<Gamma>)\"\n\ndeclare is_consumed_def [simp]\n\nsection {* Built-in types *}\n\nprimrec prim_op_type :: \"prim_op \\<Rightarrow> prim_type list \\<times> prim_type\" where\n  \"prim_op_type (Plus t)   = ([Num t, Num t], Num t)\"\n| \"prim_op_type (Times t)  = ([Num t, Num t], Num t)\"\n| \"prim_op_type (Minus t)  = ([Num t, Num t], Num t)\"\n| \"prim_op_type (Divide t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (Mod t)    = ([Num t, Num t], Num t)\"\n| \"prim_op_type (BitAnd t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (BitOr t)  = ([Num t, Num t], Num t)\"\n| \"prim_op_type (BitXor t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (LShift t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (RShift t) = ([Num t, Num t], Num t)\"\n| \"prim_op_type (Complement t) = ([Num t], Num t)\"\n| \"prim_op_type (Gt t)     = ([Num t, Num t], Bool )\"\n| \"prim_op_type (Lt t)     = ([Num t, Num t], Bool )\"\n| \"prim_op_type (Le t)     = ([Num t, Num t], Bool )\"\n| \"prim_op_type (Ge t)     = ([Num t, Num t], Bool )\"\n| \"prim_op_type (Eq t)     = ([t    , t    ], Bool )\"\n| \"prim_op_type (NEq t)    = ([t    , t    ], Bool )\"\n| \"prim_op_type (And)      = ([Bool , Bool ], Bool )\"\n| \"prim_op_type (Or)       = ([Bool , Bool ], Bool )\"\n| \"prim_op_type (Not)      = ([Bool],         Bool )\"\n\nprimrec lit_type :: \"lit \\<Rightarrow> prim_type\" where\n  \"lit_type (LBool _) = Bool\"\n| \"lit_type (LU8  _)  = Num U8\"\n| \"lit_type (LU16 _)  = Num U16\"\n| \"lit_type (LU32 _)  = Num U32\"\n| \"lit_type (LU64 _)  = Num U64\"\n\nfun upcast_valid :: \"num_type \\<Rightarrow> num_type \\<Rightarrow> bool\" where\n  \"upcast_valid U8  U8  = True\"\n| \"upcast_valid U8  U16 = True\"\n| \"upcast_valid U8  U32 = True\"\n| \"upcast_valid U8  U64 = True\"\n| \"upcast_valid U16 U16 = True\"\n| \"upcast_valid U16 U32 = True\"\n| \"upcast_valid U16 U64 = True\"\n| \"upcast_valid U32 U32 = True\"\n| \"upcast_valid U32 U64 = True\"\n| \"upcast_valid U64 U64 = True\"\n| \"upcast_valid _   _   = False\"\n\nprimrec prim_lbool where\n  \"prim_lbool (LBool b) = b\"\n| \"prim_lbool (LU8 w) = False\"\n| \"prim_lbool (LU16 w) = False\"\n| \"prim_lbool (LU32 w) = False\"\n| \"prim_lbool (LU64 w) = False\"\n\ndefinition prim_word_op\n  where prim_word_op_def[simp]:\n  \"prim_word_op f8 f16 f32 f64 xs = (case (take 2 xs) of\n      [LU8 x, LU8 y] \\<Rightarrow> LU8 (f8 x y)\n    | [LU16 x, LU16 y] \\<Rightarrow> LU16 (f16 x y)\n    | [LU32 x, LU32 y] \\<Rightarrow> LU32 (f32 x y)\n    | [LU64 x, LU64 y] \\<Rightarrow> LU64 (f64 x y)\n    | _ \\<Rightarrow> LBool False)\"\n\ndefinition prim_word_comp\n  where prim_word_comp_def[simp]:\n  \"prim_word_comp f8 f16 f32 f64 xs = (case (take 2 xs) of\n      [LU8 x, LU8 y] \\<Rightarrow> LBool (f8 x y)\n    | [LU16 x, LU16 y] \\<Rightarrow> LBool (f16 x y)\n    | [LU32 x, LU32 y] \\<Rightarrow> LBool (f32 x y)\n    | [LU64 x, LU64 y] \\<Rightarrow> LBool (f64 x y)\n    | _ \\<Rightarrow> LBool False)\"\n\nprimrec eval_prim_op :: \"prim_op \\<Rightarrow> lit list \\<Rightarrow> lit\"\nwhere\n    \"eval_prim_op Not xs = LBool (\\<not> prim_lbool (hd xs))\"\n  | \"eval_prim_op And xs = LBool (prim_lbool (hd xs) \\<and> prim_lbool (xs ! 1))\"\n  | \"eval_prim_op Or xs = LBool (prim_lbool (hd xs) \\<or> prim_lbool (xs ! 1))\"\n  | \"eval_prim_op (Eq _) xs = LBool (hd xs = xs ! 1)\"\n  | \"eval_prim_op (NEq _) xs = LBool (hd xs \\<noteq> xs ! 1)\"\n  | \"eval_prim_op (Plus _) xs = prim_word_op (+) (+) (+) (+) xs\"\n  | \"eval_prim_op (Minus _) xs = prim_word_op (-) (-) (-) (-) xs\"\n  | \"eval_prim_op (Times _) xs = prim_word_op (*) (*) (*) (*) xs\"\n  | \"eval_prim_op (Divide _) xs = prim_word_op checked_div checked_div checked_div checked_div  xs\"\n  | \"eval_prim_op (Mod _) xs = prim_word_op checked_mod checked_mod checked_mod checked_mod xs\"\n  | \"eval_prim_op (Gt _) xs = prim_word_comp greater greater greater greater xs\"\n  | \"eval_prim_op (Lt _) xs = prim_word_comp less less less less xs\"\n  | \"eval_prim_op (Le _) xs = prim_word_comp less_eq less_eq less_eq less_eq xs\"\n  | \"eval_prim_op (Ge _) xs = prim_word_comp greater_eq greater_eq greater_eq greater_eq xs\"\n  | \"eval_prim_op (BitAnd _) xs = prim_word_op bitAND bitAND bitAND bitAND xs\"\n  | \"eval_prim_op (BitOr _) xs = prim_word_op bitOR bitOR bitOR bitOR xs\"\n  | \"eval_prim_op (BitXor _) xs = prim_word_op bitXOR bitXOR bitXOR bitXOR xs\"\n  | \"eval_prim_op (LShift _) xs = prim_word_op (checked_shift shiftl) (checked_shift shiftl)\n        (checked_shift shiftl) (checked_shift shiftl) xs\"\n  | \"eval_prim_op (RShift _) xs = prim_word_op (checked_shift shiftr) (checked_shift shiftr)\n        (checked_shift shiftr) (checked_shift shiftr) xs\"\n  | \"eval_prim_op (Complement _) xs = prim_word_op (\\<lambda>x y. bitNOT x) (\\<lambda>x y. bitNOT x)\n        (\\<lambda>x y. bitNOT x) (\\<lambda>x y. bitNOT x) [hd xs, hd xs]\"\n\nlemma eval_prim_op_lit_type:\n  \"prim_op_type pop = (\\<tau>s, \\<tau>) \\<Longrightarrow> map lit_type xs = \\<tau>s\n    \\<Longrightarrow> lit_type (eval_prim_op pop xs) = \\<tau>\"\n  by (cases pop, auto split: lit.split)\n\nsection {* Typing rules *}\n\ninductive typing :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow> kind env \\<Rightarrow> ctx \\<Rightarrow> 'f expr \\<Rightarrow> type \\<Rightarrow> bool\"\n          (\"_, _, _ \\<turnstile> _ : _\" [30,0,0,0,20] 60)\n      and typing_all :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow> kind env \\<Rightarrow> ctx \\<Rightarrow> 'f expr list \\<Rightarrow> type list \\<Rightarrow> bool\"\n          (\"_, _, _ \\<turnstile>* _ : _\" [30,0,0,0,20] 60) where\n\ntyping_var    : \"\\<lbrakk> K \\<turnstile> \\<Gamma> \\<leadsto>w singleton (length \\<Gamma>) i t\n                   ; i < length \\<Gamma>\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Var i : t\"\n\n| typing_afun   : \"\\<lbrakk> \\<Xi> f = (K', t, u)\n                   ; t' = instantiate ts t\n                   ; u' = instantiate ts u\n                   ; list_all2 (kinding K) ts K'\n                   ; K' \\<turnstile> TFun t u wellformed\n                   ; K \\<turnstile> \\<Gamma> consumed\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> AFun f ts : TFun t' u'\"\n\n| typing_fun    : \"\\<lbrakk> \\<Xi>, K', [Some t] \\<turnstile> f : u\n                   ; t' = instantiate ts t\n                   ; u' = instantiate ts u\n                   ; K \\<turnstile> \\<Gamma> consumed\n                   ; K' \\<turnstile> t wellformed\n                   ; list_all2 (kinding K) ts K'\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Fun f ts : TFun t' u'\"\n\n| typing_app    : \"\\<lbrakk> K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\n                   ; \\<Xi>, K, \\<Gamma>1 \\<turnstile> a : TFun x y\n                   ; \\<Xi>, K, \\<Gamma>2 \\<turnstile> b : x\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> App a b : y\"\n\n| typing_cast   : \"\\<lbrakk> \\<Xi>, K, \\<Gamma> \\<turnstile> e : TPrim (Num \\<tau>)\n                   ; upcast_valid \\<tau> \\<tau>'\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Cast \\<tau>' e : TPrim (Num \\<tau>')\"\n\n| typing_tuple  : \"\\<lbrakk> K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\n                   ; \\<Xi>, K, \\<Gamma>1 \\<turnstile> t : T\n                   ; \\<Xi>, K, \\<Gamma>2 \\<turnstile> u : U\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Tuple t u : TProduct T U\"\n\n| typing_split  : \"\\<lbrakk> K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\n                   ; \\<Xi>, K, \\<Gamma>1 \\<turnstile> x : TProduct t u\n                   ; \\<Xi>, K, (Some t)#(Some u)#\\<Gamma>2 \\<turnstile> y : t'\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Split x y : t'\"\n\n| typing_let    : \"\\<lbrakk> K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\n                   ; \\<Xi>, K, \\<Gamma>1 \\<turnstile> x : t\n                   ; \\<Xi>, K, (Some t # \\<Gamma>2) \\<turnstile> y : u\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Let x y : u\"\n\n| typing_letb   : \"\\<lbrakk> K, is \\<turnstile> \\<Gamma> \\<leadsto>b \\<Gamma>1 | \\<Gamma>2\n                   ; \\<Xi>, K, \\<Gamma>1 \\<turnstile> x : t\n                   ; \\<Xi>, K, (Some t # \\<Gamma>2) \\<turnstile> y : u\n                   ; K \\<turnstile> t :\\<kappa> k\n                   ; E \\<in> k\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> LetBang is x y : u\"\n\n| typing_con    : \"\\<lbrakk> \\<Xi>, K, \\<Gamma> \\<turnstile> x : t\n                   ; (tag, t, Unchecked) \\<in> set ts\n                   ; K \\<turnstile> TSum ts wellformed\n                   ; ts = ts'\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Con ts tag x : TSum ts'\"\n\n| typing_case   : \"\\<lbrakk> K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\n                   ; \\<Xi>, K, \\<Gamma>1 \\<turnstile> x : TSum ts\n                   ; (tag, t, Unchecked) \\<in> set ts\n                   ; \\<Xi>, K, (Some t # \\<Gamma>2) \\<turnstile> a : u\n                   ; \\<Xi>, K, (Some (TSum (tagged_list_update tag (t, Checked) ts)) # \\<Gamma>2) \\<turnstile> b : u\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Case x tag a b : u\"\n\n| typing_esac   : \"\\<lbrakk> \\<Xi>, K, \\<Gamma> \\<turnstile> x : TSum ts\n                   ; [(n, t, Unchecked)] = filter ((=) Unchecked \\<circ> snd \\<circ> snd) ts\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Esac x n : t\"\n\n| typing_if     : \"\\<lbrakk> K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\n                   ; \\<Xi>, K, \\<Gamma>1 \\<turnstile> x : TPrim Bool\n                   ; \\<Xi>, K, \\<Gamma>2 \\<turnstile> a : t\n                   ; \\<Xi>, K, \\<Gamma>2 \\<turnstile> b : t\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> If x a b : t\"\n\n| typing_prim   : \"\\<lbrakk> \\<Xi>, K, \\<Gamma> \\<turnstile>* args : map TPrim ts\n                   ; prim_op_type oper = (ts,t)\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Prim oper args : TPrim t\"\n\n| typing_lit    : \"\\<lbrakk> K \\<turnstile> \\<Gamma> consumed\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Lit l : TPrim (lit_type l)\"\n\n| typing_slit   : \"\\<lbrakk> K \\<turnstile> \\<Gamma> consumed\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> SLit s : TPrim String\"\n\n| typing_unit   : \"\\<lbrakk> K \\<turnstile> \\<Gamma> consumed\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Unit : TUnit\"\n\n| typing_struct : \"\\<lbrakk> \\<Xi>, K, \\<Gamma> \\<turnstile>* es : ts\n                   ; distinct ns\n                   ; length ns = length ts\n                   ; ts' = zip ns (zip ts (replicate (length ts) Present))\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Struct ts es : TRecord ts' Unboxed\"\n\n| typing_member : \"\\<lbrakk> \\<Xi>, K, \\<Gamma> \\<turnstile> e : TRecord ts s\n                   ; K \\<turnstile> TRecord ts s :\\<kappa> k\n                   ; S \\<in> k\n                   ; f < length ts\n                   ; ts ! f = (n, t, Present)\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Member e f : t\"\n\n| typing_take   : \"\\<lbrakk> K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\n                   ; \\<Xi>, K, \\<Gamma>1 \\<turnstile> e : TRecord ts s\n                   ; sigil_perm s \\<noteq> Some ReadOnly\n                   ; f < length ts\n                   ; ts ! f = (n, t, Present)\n                   ; K \\<turnstile> t :\\<kappa> k\n                   ; S \\<in> k \\<or> taken = Taken\n                   ; \\<Xi>, K, (Some t # Some (TRecord (ts [f := (n,t,taken)]) s) # \\<Gamma>2) \\<turnstile> e' : u\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Take e f e' : u\"\n\n| typing_put    : \"\\<lbrakk> K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\n                   ; \\<Xi>, K, \\<Gamma>1 \\<turnstile> e : TRecord ts s\n                   ; sigil_perm s \\<noteq> Some ReadOnly\n                   ; f < length ts\n                   ; ts ! f = (n, t, taken)\n                   ; K \\<turnstile> t :\\<kappa> k\n                   ; D \\<in> k \\<or> taken = Taken\n                   ; \\<Xi>, K, \\<Gamma>2 \\<turnstile> e' : t\n                   \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Put e f e' : TRecord (ts [f := (n,t,Present)]) s\"\n\n| typing_promote: \"\\<lbrakk> \\<Xi>, K, \\<Gamma> \\<turnstile> x : t' ; K \\<turnstile> t' \\<sqsubseteq> t \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile> Promote t x : t\"\n\n| typing_all_empty : \"\\<Gamma> = empty n \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile>* [] : []\"\n\n| typing_all_cons  : \"\\<lbrakk> K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\n                      ; \\<Xi>, K, \\<Gamma>1 \\<turnstile>  e  : t\n                      ; \\<Xi>, K, \\<Gamma>2 \\<turnstile>* es : ts\n                      \\<rbrakk> \\<Longrightarrow> \\<Xi>, K, \\<Gamma> \\<turnstile>* (e # es) : (t # ts)\"\n\n\ninductive_cases typing_num     [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> e : TPrim (Num \\<tau>)\"\ninductive_cases typing_bool    [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> e : TPrim Bool\"\ninductive_cases typing_varE    [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Var i : \\<tau>\"\ninductive_cases typing_appE    [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> App x y : \\<tau>\"\ninductive_cases typing_litE    [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Lit l : \\<tau>\"\ninductive_cases typing_slitE   [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> SLit l : \\<tau>\"\ninductive_cases typing_funE    [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Fun f ts : \\<tau>\"\ninductive_cases typing_afunE   [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> AFun f ts : \\<tau>\"\ninductive_cases typing_ifE     [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> If c t e : \\<tau>\"\ninductive_cases typing_conE    [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Con ts t e : \\<tau>\"\ninductive_cases typing_unitE   [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Unit : \\<tau>\"\ninductive_cases typing_primE   [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Prim p es : \\<tau>\"\ninductive_cases typing_memberE [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Member e f : \\<tau>\"\ninductive_cases typing_tupleE  [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Tuple a b : \\<tau>\"\ninductive_cases typing_caseE   [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Case x t m n : \\<tau>\"\ninductive_cases typing_esacE   [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Esac e t : \\<tau>\"\ninductive_cases typing_castE   [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Cast t e : \\<tau>\"\ninductive_cases typing_letE    [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Let a b : \\<tau>\"\ninductive_cases typing_structE [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Struct ts es : \\<tau>\"\ninductive_cases typing_letbE   [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> LetBang vs a b : \\<tau>\"\ninductive_cases typing_takeE   [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Take x f e : \\<tau>\"\ninductive_cases typing_putE    [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Put x f e : \\<tau>\"\ninductive_cases typing_splitE  [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Split x e : \\<tau>\"\ninductive_cases typing_promoteE[elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile> Promote \\<tau>' x : \\<tau>\"\ninductive_cases typing_all_emptyE [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile>* []       : \\<tau>s\"\ninductive_cases typing_all_consE  [elim]: \"\\<Xi>, K, \\<Gamma> \\<turnstile>* (x # xs) : \\<tau>s\"\n\nsection {* Syntax structural judgements *}\n\nsubsection {* A-normal form *}\n\ninductive atom ::\"'f expr \\<Rightarrow> bool\" where\n  \"atom (Var x)\"\n| \"atom (Fun f ts)\"\n| \"atom (AFun f ts)\"\n| \"atom (Prim p (map Var is))\"\n| \"atom (Con ts n (Var x))\"\n| \"atom (Struct ts (map Var is))\"\n| \"atom (Cast t (Var x))\"\n| \"atom (Member (Var x) f)\"\n| \"atom Unit\"\n| \"atom (Lit l)\"\n| \"atom (SLit l)\"\n| \"atom (Tuple (Var x) (Var y))\"\n| \"atom (Esac (Var x) t)\"\n| \"atom (App (Var a) (Var b))\"\n| \"atom (App (Fun f ts) (Var b))\"\n| \"atom (App (AFun f ts) (Var b))\"\n| \"atom (Put (Var x) f (Var y))\"\n\ninductive a_normal :: \"'f expr \\<Rightarrow> bool\" where\n  \"\\<lbrakk> atom x \\<rbrakk> \\<Longrightarrow> a_normal x\"\n| \"\\<lbrakk> atom x ; a_normal y \\<rbrakk> \\<Longrightarrow> a_normal (Let x y)\"\n| \"\\<lbrakk> a_normal x ; a_normal y \\<rbrakk> \\<Longrightarrow> a_normal (LetBang is x y)\"\n| \"\\<lbrakk> a_normal m ; a_normal n \\<rbrakk> \\<Longrightarrow> a_normal (Case (Var x) t m n)\"\n| \"\\<lbrakk> a_normal t ; a_normal e \\<rbrakk> \\<Longrightarrow> a_normal (If (Var x) t e)\"\n| \"\\<lbrakk> a_normal y \\<rbrakk> \\<Longrightarrow> a_normal (Split (Var x) y)\"\n| \"\\<lbrakk> a_normal y \\<rbrakk> \\<Longrightarrow> a_normal (Take (Var x) f y)\"\n\ninductive_cases a_normal_E:  \"a_normal x\"\ninductive_cases a_normal_LetE:  \"a_normal (Let x y)\"\ninductive_cases a_normal_LetBangE: \"a_normal (LetBang is x y)\"\ninductive_cases a_normal_CaseE: \"a_normal (Case x t m n)\"\ninductive_cases a_normal_IfE: \"a_normal (If x t e)\"\ninductive_cases a_normal_Split: \"a_normal (Split x y)\"\ninductive_cases a_normal_TakeE:  \"a_normal (Take x f e)\"\n\nsection {* Representation Types (for use in C-refinement) *}\n\n\ndatatype repr = RPtr repr\n              | RCon name \"repr list\"\n              | RFun\n              | RPrim prim_type\n              | RSum \"(name \\<times> repr) list\"\n              | RProduct \"repr\" \"repr\"\n              | RRecord \"repr list\"\n              | RUnit\n\nfun type_repr :: \"type \\<Rightarrow> repr\" where\n  \"type_repr (TFun t t')          = RFun\"\n| \"type_repr (TPrim t)            = RPrim t\"\n| \"type_repr (TSum ts)            = RSum (map (\\<lambda>(a,b,_).(a, type_repr b)) ts)\"\n| \"type_repr (TProduct a b)       = RProduct (type_repr a) (type_repr b)\"\n| \"type_repr (TCon n ts Unboxed)  = RCon n (map type_repr ts)\"\n| \"type_repr (TCon n ts _)        = RPtr (RCon n (map type_repr ts))\"\n| \"type_repr (TRecord ts Unboxed) = RRecord (map (\\<lambda>(_,b,_). type_repr b) ts)\"\n| \"type_repr (TRecord ts _)       = RPtr (RRecord (map (\\<lambda>(_,b,_). type_repr b) ts))\"\n| \"type_repr (TUnit)              = RUnit\"\n\n\nsection {* Wellformed lemmas *}\n\nlemma wellformed_record_wellformed_elem:\n  assumes \"K \\<turnstile> TRecord ts s wellformed\"\n    and \"(name, t, taken) \\<in> set ts\"\n  shows \"K \\<turnstile> t wellformed\"\n  by (metis assms fst_conv in_set_conv_nth list_all_length snd_conv type_wellformed.simps(8) type_wellformed_pretty_def)\n\nlemma wellformed_sum_wellformed_elem:\n  assumes \"K \\<turnstile> TSum ts wellformed\"\n    and \"(name, t, taken) \\<in> set ts\"\n  shows \"K \\<turnstile> t wellformed\"\n  by (metis assms fst_conv in_set_conv_nth list_all_length snd_conv type_wellformed.simps(6) type_wellformed_pretty_def)\n\nsection {* Kinding lemmas *}\n\n(* kinding in terms of the higher level kinding judgements *)\nlemma kinding_simps:\n  \"\\<And>K i k.      K \\<turnstile> (TVar i) :\\<kappa> k         \\<longleftrightarrow> i < length K \\<and> k \\<subseteq> K ! i\"\n  \"\\<And>K i k.      K \\<turnstile> (TVarBang i) :\\<kappa> k     \\<longleftrightarrow> i < length K \\<and> k \\<subseteq> {D,S}\"\n  \"\\<And>K n ts s k. K \\<turnstile> (TCon n ts s) :\\<kappa> k    \\<longleftrightarrow> (K \\<turnstile>* ts :\\<kappa> k) \\<and> k \\<subseteq> sigil_kind s\"\n  \"\\<And>K ta tb k.  K \\<turnstile> (TFun ta tb) :\\<kappa> k     \\<longleftrightarrow> k \\<subseteq> UNIV \\<and> (K \\<turnstile> ta wellformed) \\<and> (K \\<turnstile> tb wellformed)\"\n  \"\\<And>K p k.      K \\<turnstile> (TPrim p) :\\<kappa> k        \\<longleftrightarrow> k \\<subseteq> UNIV\"\n  \"\\<And>K ts k.     K \\<turnstile> (TSum ts) :\\<kappa> k        \\<longleftrightarrow> (K \\<turnstile>* ts :\\<kappa>v k) \\<and> distinct (map fst ts)\"\n  \"\\<And>K ta tb k.  K \\<turnstile> (TProduct ta tb) :\\<kappa> k \\<longleftrightarrow> (K \\<turnstile> ta :\\<kappa> k) \\<and> (K \\<turnstile> tb :\\<kappa> k)\"\n  \"\\<And>K ts s k.   K \\<turnstile> (TRecord ts s) :\\<kappa> k   \\<longleftrightarrow> (K \\<turnstile>* ts :\\<kappa>r k) \\<and> k \\<subseteq> sigil_kind s \\<and> distinct (map fst ts)\"\n  \"\\<And>K k.        K \\<turnstile> TUnit :\\<kappa> k            \\<longleftrightarrow> k \\<subseteq> UNIV\"\n  by (auto simp add: kinding_defs list_all_iff)\n\nlemma kinding_all_simps:\n  \"\\<And>K k.        K \\<turnstile>* [] :\\<kappa> k       \\<longleftrightarrow> True\"\n  \"\\<And>K t ts k.   K \\<turnstile>* (t # ts) :\\<kappa> k \\<longleftrightarrow> (K \\<turnstile> t :\\<kappa> k) \\<and> (K \\<turnstile>* ts :\\<kappa> k)\"\n  by (auto simp add: kinding_defs list_all_iff)\n\nlemma kinding_variant_simps:\n  \"\\<And>K k.        K \\<turnstile>* [] :\\<kappa>v k                     \\<longleftrightarrow> True\"\n  \"\\<And>K n t ts k. K \\<turnstile>* ((n,t,Unchecked) # ts) :\\<kappa>v k \\<longleftrightarrow> (K \\<turnstile> t :\\<kappa> k) \\<and> (K \\<turnstile>* ts :\\<kappa>v k)\"\n  \"\\<And>K n t ts k. K \\<turnstile>* ((n,t,Checked) # ts) :\\<kappa>v k   \\<longleftrightarrow> (K \\<turnstile> t wellformed) \\<and> (K \\<turnstile>* ts :\\<kappa>v k)\"\n  by (auto simp add: kinding_defs list_all_iff)\n\nlemma kinding_record_simps:\n  \"\\<And>K k.        K \\<turnstile>* [] :\\<kappa>r k                   \\<longleftrightarrow> True\"\n  \"\\<And>K n t ts k. K \\<turnstile>* ((n,t,Present) # ts) :\\<kappa>r k \\<longleftrightarrow> (K \\<turnstile> t :\\<kappa> k) \\<and> (K \\<turnstile>* ts :\\<kappa>r k)\"\n  \"\\<And>K n t ts k. K \\<turnstile>* ((n,t,Taken) # ts) :\\<kappa>r k   \\<longleftrightarrow> (K \\<turnstile> t wellformed) \\<and> (K \\<turnstile>* ts :\\<kappa>r k)\"\n  by (auto simp add: kinding_defs list_all_iff)\n\nlemma kinding_imp_wellformed:\n  \"K \\<turnstile> t :\\<kappa> k \\<Longrightarrow> K \\<turnstile> t wellformed\"\n  by (simp add: kinding_def)\n\nlemma kinding_iff_wellformed:\n  shows\n    \"(\\<exists>k. K \\<turnstile> t :\\<kappa> k) \\<longleftrightarrow> K \\<turnstile> t wellformed\"\n    \"(\\<exists>k. K \\<turnstile>* ts :\\<kappa> k) \\<longleftrightarrow> K \\<turnstile>* ts wellformed\"\n    \"(\\<exists>k. K \\<turnstile>* tvs :\\<kappa>v k) \\<longleftrightarrow> K \\<turnstile>* map (fst \\<circ> snd) tvs wellformed\"\n    \"(\\<exists>k. K \\<turnstile>* trs :\\<kappa>r k) \\<longleftrightarrow> K \\<turnstile>* map (fst \\<circ> snd) trs wellformed\"\n  by (auto simp add: kinding_defs)\n\nlemma kinding_to_wellformedD:\n  shows\n    \"K \\<turnstile> t :\\<kappa> k \\<Longrightarrow> K \\<turnstile> t wellformed\"\n    \"K \\<turnstile>* ts :\\<kappa> k \\<Longrightarrow> K \\<turnstile>* ts wellformed\"\n    \"K \\<turnstile>* tvs :\\<kappa>v k \\<Longrightarrow> K \\<turnstile>* map (fst \\<circ> snd) tvs wellformed\"\n    \"K \\<turnstile>* trs :\\<kappa>r k \\<Longrightarrow> K \\<turnstile>* map (fst \\<circ> snd) trs wellformed\"\n  by (auto simp add: kinding_defs)\n\nlemma list_all2_kinding_wellformedD:\n  \"list_all2 (kinding K) ts K' \\<Longrightarrow> list_all (type_wellformed (length K)) ts \\<and> length ts = length K'\"\n  by (simp add: kinding_def list_all2_conv_all_nth list_all_length)\n\nlemma supersumption:\nfixes k' :: kind\nassumes k_is_superset : \"k' \\<subseteq> k\"\nshows \"K \\<turnstile>  t  :\\<kappa> k  \\<Longrightarrow> K \\<turnstile>  t  :\\<kappa> k'\"\nand   \"K \\<turnstile>* ts :\\<kappa> k  \\<Longrightarrow> K \\<turnstile>* ts :\\<kappa> k'\"\nand   \"K \\<turnstile>* xs :\\<kappa>v k \\<Longrightarrow> K \\<turnstile>* xs :\\<kappa>v k'\"\nand   \"K \\<turnstile>* fs :\\<kappa>r k \\<Longrightarrow> K \\<turnstile>* fs :\\<kappa>r k'\"\n  using k_is_superset\n  by (fastforce simp add: kinding_defs)+\n\nlemma kind_top:\nshows \"k \\<subseteq> {D, S, E}\"\nby (force intro: kind_comp.exhaust)\n\nlemma kinding_all_nth:\nfixes n :: nat\nassumes \"K \\<turnstile>* ts :\\<kappa> k\"\nand     \"n < length ts\"\nshows   \"K \\<turnstile> (ts ! n) :\\<kappa> k\"\nusing assms proof (induct ts arbitrary: n)\n     case Nil  then show ?case by auto\nnext case Cons then show ?case by (case_tac n, auto simp add: kinding_defs)\nqed\n\nlemma kinding_all_set:\n  shows \"(K \\<turnstile>* ts :\\<kappa> k) = (\\<forall>t\\<in>set ts. K \\<turnstile> t :\\<kappa> k)\"\n  by (auto simp add: kinding_defs)\n\nlemma kinding_all_subset:\nassumes \"K \\<turnstile>* ts :\\<kappa> k\"\nand     \"set us \\<subseteq> set ts\"\nshows   \"K \\<turnstile>* us :\\<kappa> k\"\nusing assms by (auto simp add: kinding_all_set)\n\nlemma kinding_all_list_all:\n  shows \"(K \\<turnstile>* ts :\\<kappa> k) = list_all (\\<lambda>t. K \\<turnstile> t :\\<kappa> k) ts\"\n  by (induct ts; fastforce simp add: kinding_defs)\n\nlemma kinding_typelist_wellformed_elem:\n  assumes \"K \\<turnstile>* ts :\\<kappa> k\"\n    and \"t \\<in> set ts\"\n  shows \"K \\<turnstile> t wellformed\"\n  using assms kinding_all_set kinding_def by auto\n\nlemma kinding_in_kind_helper:\n  assumes\n    \"x \\<in> k\"\n    \"K \\<turnstile> t :\\<kappa> k\"\n  shows \"K \\<turnstile> t :\\<kappa> {x}\"\n  using assms\n  unfolding kinding_def\n  by blast\n\nlemma kinding_variant_cons:\n  shows \"(K \\<turnstile>* t # ts :\\<kappa>v k) \\<longleftrightarrow> (case snd (snd t) of Checked \\<Rightarrow> K \\<turnstile> fst (snd t) wellformed | Unchecked \\<Rightarrow> K \\<turnstile> fst (snd t) :\\<kappa> k) \\<and> (K \\<turnstile>* ts :\\<kappa>v k)\"\n  by (cases t, case_tac c; force simp add: kinding_defs)\n\nlemma kinding_variant_conv_all_nth:\n  shows \"(K \\<turnstile>* ts :\\<kappa>v k) \\<longleftrightarrow> (\\<forall>i < length ts. case snd (snd (ts ! i)) of\n                                                Checked \\<Rightarrow> K \\<turnstile> fst (snd (ts ! i)) wellformed\n                                              | Unchecked \\<Rightarrow> K \\<turnstile> fst (snd (ts ! i)) :\\<kappa> k)\"\nproof (induct ts)\n  case (Cons a ts)\n  then show ?case\n    by (cases \"snd (snd a)\";\n        clarsimp simp add: kinding_variant_cons All_less_Suc2,\n        metis nth_Cons_Suc)\nqed (simp add: kinding_defs)\n\nlemma kinding_variant_set:\n  shows \"(K \\<turnstile>* ts :\\<kappa>v k) = (\\<forall>(n,t,b)\\<in>set ts. case b of Checked \\<Rightarrow> K \\<turnstile> t wellformed | Unchecked \\<Rightarrow> K \\<turnstile> t :\\<kappa> k)\"\nproof (induct ts)\n  case (Cons a ts)\n  then show ?case\n    by (cases a; case_tac c; clarsimp simp add: kinding_variant_cons)\nqed (simp add: kinding_defs)\n\nlemma kinding_variant_wellformed_elem:\n  assumes \"K \\<turnstile>* ts :\\<kappa>v k\"\n    and \"(n,t,b) \\<in> set ts\"\n  shows \"K \\<turnstile> t wellformed\"\n  using assms\n  by (induct ts; force simp add: kinding_defs)\n\nlemma kinding_variant_all_wellformed:\n  assumes\n    \"K \\<turnstile>* ts :\\<kappa>v k\"\n    \"(n,t,b) \\<in> set ts\"\n  shows   \"K \\<turnstile> t wellformed\"\n  using assms\n  by (case_tac b; force simp add: kinding_variant_set kinding_defs)\n\nlemma kinding_all_variant':\n  assumes \"K \\<turnstile>* map (fst \\<circ> snd) ts :\\<kappa> k\"\n  shows   \"K \\<turnstile>* ts :\\<kappa>v k\"\n  using assms\nproof (induct ts)\n  case (Cons a ts)\n  then show ?case\n    by (case_tac a; case_tac c; simp add: kinding_defs)\nqed (force simp add: kinding_defs)\n\nlemma variant_tagged_list_update_wellformedI:\n  assumes\n    \"n \\<in> fst ` set ts\"\n    \"distinct (map fst ts)\"\n    \"K \\<turnstile> t wellformed\"\n    \"K \\<turnstile>* map (fst \\<circ> snd) ts wellformed\"\n  shows \"K \\<turnstile> TSum (tagged_list_update n (t, b) ts) wellformed\"\n  using assms\n  by (induct ts arbitrary: n t b; fastforce simp add: list_all_iff)\n\nlemma variant_tagged_list_update_kinding:\n  assumes \"n \\<in> fst ` set ts\"\n  shows\n    \"K \\<turnstile>* (tagged_list_update n (\\<tau>, Checked) ts) :\\<kappa>v k \\<Longrightarrow> K \\<turnstile> \\<tau> wellformed\"\n    \"K \\<turnstile>* (tagged_list_update n (\\<tau>, Unchecked) ts) :\\<kappa>v k \\<Longrightarrow> K \\<turnstile> \\<tau> :\\<kappa> k\"\n  using assms tagged_list_update_success_contains_updated_elem\n  by (fastforce dest: bspec[where x=\"(n,\\<tau>,Checked)\"] simp add: kinding_variant_set)+\n\nlemma kinding_variant_downcast:\n  assumes\n    \"K \\<turnstile>* ts :\\<kappa>v k\"\n    \"distinct (map fst ts)\"\n    \"(tag, t, Unchecked) \\<in> set ts\"\n  shows\n    \"K \\<turnstile>* tagged_list_update tag (t, Checked) ts :\\<kappa>v k\"\nproof -\n  obtain i\n    where tag_elem_at:\n      \"ts ! i = (tag, t, Unchecked)\"\n      \"i < length ts\"\n    using assms by (meson in_set_conv_nth)\n  then have\n    \"K \\<turnstile> t :\\<kappa> k\"\n    \"\\<forall>(n, t, b) \\<in> set ts. case b of Checked \\<Rightarrow> K \\<turnstile> t wellformed | Unchecked \\<Rightarrow> K \\<turnstile> t :\\<kappa> k\"\n    using assms kinding_variant_conv_all_nth kinding_variant_set by auto\n  then have \"\\<forall>(n, t, b) \\<in> insert (tag, t, Checked) (set ts). case b of Checked \\<Rightarrow> K \\<turnstile> t wellformed | Unchecked \\<Rightarrow> K \\<turnstile> t :\\<kappa> k\"\n    by (clarsimp simp add: Ball_def kinding_def split: variant_state.splits)\n  then have \"\\<forall>(n, t, b) \\<in> set (ts[i := (tag, t, Checked)]). case b of Checked \\<Rightarrow> K \\<turnstile> t wellformed | Unchecked \\<Rightarrow> K \\<turnstile> t :\\<kappa> k\"\n    by (metis (no_types, lifting) set_update_subset_insert subsetCE)\n  then show ?thesis\n    using tag_elem_at assms\n    by (simp add: kinding_variant_set tagged_list_update_distinct)\nqed\n\n\nlemma kinding_record_cons:\n  shows \"(K \\<turnstile>* t # ts :\\<kappa>r k) \\<longleftrightarrow> (case snd (snd t) of Taken \\<Rightarrow> K \\<turnstile> fst (snd t) wellformed | Present \\<Rightarrow> K \\<turnstile> fst (snd t) :\\<kappa> k) \\<and> (K \\<turnstile>* ts :\\<kappa>r k)\"\n  by (cases t; case_tac c; force simp add: kinding_defs)\n\nlemma kinding_record_conv_all_nth:\n  shows \"(K \\<turnstile>* ts :\\<kappa>r k) \\<longleftrightarrow> (\\<forall>i < length ts. case snd (snd (ts ! i)) of\n                                                Taken \\<Rightarrow> K \\<turnstile> fst (snd (ts ! i)) wellformed\n                                              | Present \\<Rightarrow> K \\<turnstile> fst (snd (ts ! i)) :\\<kappa> k)\"\nproof (induct ts)\n  case (Cons a ts)\n  then show ?case\n    apply (clarsimp simp add: kinding_record_cons All_less_Suc2)\n    apply (metis nth_Cons_0 nth_Cons_Suc)\n    done\nqed (simp add: kinding_defs)\n\nlemma kinding_record_set:\n  shows \"(K \\<turnstile>* ts :\\<kappa>r k) = (\\<forall>(n,t,b)\\<in>set ts. case b of Taken \\<Rightarrow> K \\<turnstile> t wellformed | Present \\<Rightarrow> K \\<turnstile> t :\\<kappa> k)\"\nproof (induct ts)\n  case (Cons a ts)\n  then show ?case\n    by (cases a; case_tac c; clarsimp simp add: kinding_record_cons)\nqed (simp add: kinding_defs)\n\nlemma kinding_record_wellformed_elem:\n  assumes \"K \\<turnstile>* ts :\\<kappa>r k\"\n    and \"(name,t,taken) \\<in> set ts\"\n  shows \"K \\<turnstile> t wellformed\"\n  using assms\n  by (induct ts; force simp add: kinding_defs)\n\nlemma kinding_record_wellformed_nth:\nassumes \"K \\<turnstile>* ts :\\<kappa>r k\"\nand     \"ts ! n = (name,t,taken)\"\nand     \"n < length ts\"\nshows   \"K \\<turnstile> t wellformed\"\nusing assms(1)\n  and assms(2) [THEN sym]\n  and assms(3) by (force intro: kinding_record_wellformed_elem[simplified]\n                         simp:  set_conv_nth)\n\nlemma kinding_all_record:\n  assumes\n    \"K \\<turnstile>* ts :\\<kappa> k\"\n    \"length ns = length ts\"\n  shows\n    \"K \\<turnstile>* zip ns (zip ts (replicate (length ts) Present)) :\\<kappa>r k\"\n  using assms\nproof (induct ts arbitrary: ns)\n  case (Cons a ts)\n  moreover then obtain n ns' where \"ns = n # ns'\"\n    by (metis Suc_length_conv length_Cons)\n  ultimately show ?case\n    by (fastforce simp add: length_Cons kinding_defs)\nqed (force simp add: kinding_defs)\n\nlemma kinding_all_record':\n  assumes \"K \\<turnstile>* map (fst \\<circ> snd) ts :\\<kappa> k\"\n  shows   \"K \\<turnstile>* ts :\\<kappa>r k\"\n  using assms\nproof (induct ts)\n  case (Cons a ts)\n  then show ?case\n    by (case_tac a; case_tac c; auto simp add: kinding_defs)\nqed (force simp add: kinding_defs)\n\nlemma kinding_record_update:\n  assumes \"K \\<turnstile>* ts :\\<kappa>r k\"\n    and \"ts ! n = (name, a, b)\"\n    and \"K \\<turnstile> a :\\<kappa> k'\"\n  shows \"K \\<turnstile>* (ts[ n := (name, a, Present)]) :\\<kappa>r (k \\<inter> k')\"\n  using assms\nproof (induct ts arbitrary: n)\n  case (Cons a ts)\n  then show ?case\n    by (force intro!: Cons.hyps simp add: nth_Cons kinding_defs split: nat.splits)\nqed (force simp add: kinding_defs)\n\nlemma sigil_kind_writable:\n  assumes \"sigil_perm s = Some Writable\"\n    and \"\\<And>r. k \\<subseteq> sigil_kind (Boxed Writable r)\"\n  shows \"k \\<subseteq> sigil_kind s\"\n  using assms\n  by (case_tac s rule: sigil_cases, auto)\n\n\nsection {* Bang lemmas *}\n\nlemma bang_sigil_idempotent:\nshows \"bang_sigil (bang_sigil s) = bang_sigil s\"\n  by (cases s rule: bang_sigil.cases, simp+)\n\nlemma bang_idempotent:\nshows \"bang (bang \\<tau>) = bang \\<tau>\"\nby (force intro: bang.induct [where P = \"\\<lambda> \\<tau> . bang (bang \\<tau>) = bang \\<tau>\"]\n          simp:  bang_sigil_idempotent)\n\nlemma bang_sigil_kind:\nshows \"{D , S} \\<subseteq> sigil_kind (bang_sigil s)\"\n  by (case_tac s rule: bang_sigil.cases, auto)\n\nlemma bang_wellformed:\n  shows \"type_wellformed n t \\<Longrightarrow> type_wellformed n (bang t)\"\n  by (induct t rule: type_wellformed.induct; fastforce simp add: list_all_iff)\n\nlemma bang_kinding_fn:\n  shows \"{D,S} \\<subseteq> kinding_fn K (bang t)\"\nproof (induct K t rule: kinding_fn_induct)\n  case (kind_tcon K n ts s)\n  then show ?case\n    using bang_sigil_kind by (simp add: list_all_iff)\nnext\n  case (kind_tsum K ts)\n  then show ?case\n    by (fastforce simp add: list_all_iff simp del: insert_subset split: variant_state.split)\nnext\n  case (kind_trec K ts s)\n  then show ?case\n    using bang_sigil_kind\n    by (fastforce simp add: list_all_iff simp del: insert_subset split: record_state.split)\nqed auto\n\nlemma bang_kind:\nshows \"K \\<turnstile>  t  wellformed \\<Longrightarrow> k \\<subseteq> {D, S} \\<Longrightarrow> K \\<turnstile> bang t :\\<kappa> k\"\nand   \"K \\<turnstile>* ts wellformed \\<Longrightarrow> k \\<subseteq> {D, S} \\<Longrightarrow> K \\<turnstile>* map bang ts :\\<kappa> k\"\nand   \"K \\<turnstile>* map (fst \\<circ> snd) xs wellformed \\<Longrightarrow> k \\<subseteq> {D, S} \\<Longrightarrow> K \\<turnstile>* map (\\<lambda>(n,t,b). (n, bang t, b)) xs :\\<kappa>v k\"\nand   \"K \\<turnstile>* map (fst \\<circ> snd) fs wellformed \\<Longrightarrow> k \\<subseteq> {D, S} \\<Longrightarrow> K \\<turnstile>* map (\\<lambda>(n,t,b). (n, bang t, b)) fs :\\<kappa>r k\"\n  using bang_wellformed bang_kinding_fn\n  by (fastforce simp add: kinding_defs INT_subset_iff simp del: insert_subset\n      split: variant_state.split record_state.split)+\n\nsection {* Subtyping lemmas *}\n\nlemma subtyping_simps:\n  shows\n  \"\\<And>n1 n2. K \\<turnstile> TVar n1 \\<sqsubseteq> TVar n2 \\<longleftrightarrow> n1 = n2\"\n  \"\\<And>n1 n2. K \\<turnstile> TVarBang n1 \\<sqsubseteq> TVarBang n2 \\<longleftrightarrow> n1 = n2\"\n  \"\\<And>n1 ts1 s1 n2 ts2 s2. K \\<turnstile> TCon n1 ts1 s1 \\<sqsubseteq> TCon n2 ts2 s2 \\<longleftrightarrow> n1 = n2 \\<and> s1 = s2 \\<and> ts1 = ts2\"\n  \"\\<And>t1 u1 t2 u2. K \\<turnstile> TFun t1 u1 \\<sqsubseteq> TFun t2 u2 \\<longleftrightarrow> K \\<turnstile> t2 \\<sqsubseteq> t1 \\<and> K \\<turnstile> u1 \\<sqsubseteq> u2\"\n  \"\\<And>p1 p2. K \\<turnstile> TPrim p1 \\<sqsubseteq> TPrim p2 \\<longleftrightarrow> p1 = p2\"\n  \"\\<And>ts1 s1 ts2 s2. K \\<turnstile> TRecord ts1 s1 \\<sqsubseteq> TRecord ts2 s2\n                    \\<longleftrightarrow> list_all2 (\\<lambda>p1 p2. subtyping K (fst (snd p1)) (fst (snd p2))) ts1 ts2\n                    \\<and> list_all2 (record_kind_subty K) ts1 ts2\n                    \\<and> map fst ts1 = map fst ts2\n                    \\<and> s1 = s2\"\n  \"\\<And>t1 u1 t2 u2. K \\<turnstile> TProduct t1 u1 \\<sqsubseteq> TProduct t2 u2 \\<longleftrightarrow> K \\<turnstile> t1 \\<sqsubseteq> t2 \\<and> K \\<turnstile> u1 \\<sqsubseteq> u2\"\n  \"\\<And>ts1 ts2. K \\<turnstile> TSum ts1 \\<sqsubseteq> TSum ts2\n                    \\<longleftrightarrow> list_all2 (\\<lambda>p1 p2. subtyping K (fst (snd p1)) (fst (snd p2))) ts1 ts2\n                    \\<and> list_all2 (variant_kind_subty) ts1 ts2\n                    \\<and> map fst ts1 = map fst ts2\"\n  \"K \\<turnstile> TUnit \\<sqsubseteq> TUnit\"\n  by (auto simp: subtyping.intros intro!: subtyping.intros elim!: subtyping.cases)\n\nlemma subtyping_refl: \"K \\<turnstile> t \\<sqsubseteq> t\"\nproof (induct t)\n  case (TSum ts)\n  moreover then have \"\\<And>i. i < length ts \\<Longrightarrow> K \\<turnstile> fst (snd (ts ! i)) \\<sqsubseteq> fst (snd (ts ! i))\"\n    using fsts.intros snds.intros nth_mem by blast\n  ultimately show ?case\n    by (fastforce intro!: subtyping.intros simp add: list_all2_conv_all_nth list_all_length)\nnext\n  case (TRecord ts s)\n  moreover then have \"\\<And>i. i < length ts \\<Longrightarrow> K \\<turnstile> fst (snd (ts ! i)) \\<sqsubseteq> fst (snd (ts ! i))\"\n    using fsts.intros snds.intros nth_mem by blast\n  ultimately show ?case\n    by (fastforce intro!: subtyping.intros simp add: list_all2_conv_all_nth list_all_length)\nqed (auto intro!: subtyping.intros simp add: list.rel_refl_strong list_all_iff)\n\nlemma subtyping_wellformed_preservation:\n  assumes\n    \"K \\<turnstile> t1 \\<sqsubseteq> t2\"\n  shows\n    \"K \\<turnstile> t1 wellformed \\<Longrightarrow> K \\<turnstile> t2 wellformed\"\n    \"K \\<turnstile> t2 wellformed \\<Longrightarrow> K \\<turnstile> t1 wellformed\"\n  using assms\nproof (induct rule: subtyping.inducts)\n  fix K\n  case (subty_tcon n1 n2 s1 s2 ts1 ts2)\n  then show\n    \"K \\<turnstile> TCon n1 ts1 s1 wellformed \\<Longrightarrow> K \\<turnstile> TCon n2 ts2 s2 wellformed\"\n    \"K \\<turnstile> TCon n2 ts2 s2 wellformed \\<Longrightarrow> K \\<turnstile> TCon n1 ts1 s1 wellformed\"\n    by (fastforce simp add: list_all2_conv_all_nth Ball_def in_set_conv_nth list_all_iff)+\nnext\n  case (subty_trecord K ts1 ts2 s1 s2)\n  moreover then have\n    \"list_all (\\<lambda>p1. K \\<turnstile> fst (snd p1) wellformed) ts1 \\<longleftrightarrow> list_all (\\<lambda>p2. K \\<turnstile> fst (snd p2) wellformed) ts2\"\n    by (clarsimp simp add: list_all2_mono iff_conv_conj_imp list_all2_conv_all_nth list_all_length)\n  ultimately show\n    \"K \\<turnstile> TRecord ts1 s1 wellformed \\<Longrightarrow> K \\<turnstile> TRecord ts2 s2 wellformed\"\n    \"K \\<turnstile> TRecord ts2 s2 wellformed \\<Longrightarrow> K \\<turnstile> TRecord ts1 s1 wellformed\"\n    by simp+\nnext\n  case (subty_tsum K ts1 ts2)\n  moreover then have\n    \"list_all (\\<lambda>p1. K \\<turnstile> fst (snd p1) wellformed) ts1 \\<longleftrightarrow> list_all (\\<lambda>p2. K \\<turnstile> fst (snd p2) wellformed) ts2\"\n    by (clarsimp simp add: list_all2_mono iff_conv_conj_imp list_all2_conv_all_nth list_all_length)\n  ultimately show\n    \"K \\<turnstile> TSum ts1 wellformed \\<Longrightarrow> K \\<turnstile> TSum ts2 wellformed\"\n    \"K \\<turnstile> TSum ts2 wellformed \\<Longrightarrow> K \\<turnstile> TSum ts1 wellformed\"\n    by simp+\nqed simp+\n\nlemma subtyping_bang_preservation:\n  assumes\n    \"K \\<turnstile> t1 \\<sqsubseteq> t2\"\n    \"K \\<turnstile> t1 wellformed\"\n  shows \"K \\<turnstile> bang t1 \\<sqsubseteq> bang t2\"\n  using assms\nproof (induct rule: subtyping.induct)\n  case subty_tcon then show ?case\n    by (force simp add: list_all2_conv_all_nth intro: subtyping.intros)\nnext\n  case (subty_trecord K ts1 ts2 s1 s2)\n  moreover then have \"\\<And>i k. i < length ts2 \\<Longrightarrow> K \\<turnstile> bang (fst (snd (ts1 ! i))) :\\<kappa> {D}\"\n    by (auto simp add: list_all_length intro!: bang_kind, metis length_map)\n  moreover have \"\\<And>i. i < length ts2 \\<Longrightarrow> snd (snd (ts1 ! i)) \\<le> snd (snd (ts2 ! i))\"\n    using subty_trecord.hyps\n    by (force simp add: list_all2_conv_all_nth if_bool_eq_conj le_less)\n  ultimately show ?case\n    by (slowsimp simp add: subtyping_simps list_all2_conv_all_nth list_all_length le_less split: prod.splits)\nnext\n  case subty_tsum then show ?case\n    by (slowsimp intro!: subtyping.intros simp add: list_all2_conv_all_nth list_all_length split: prod.splits)\nqed (simp add: subtyping_simps)+\n\n\nlemma subtyping_kinding_fn_drop_super_impl_drop_sub:\n  assumes \"K \\<turnstile> p \\<sqsubseteq> q\"\n  and \"D \\<in> kinding_fn K q\"\n  shows \"D \\<in> kinding_fn K p\"\n  using assms\nproof (induct rule: subtyping.inducts)\n  case (subty_trecord K pts qts ps qs)\n  moreover have kind_pts:\n    \"\\<And>n pt pb. (n, pt, pb) \\<in> set pts \\<Longrightarrow> D \\<in> (case pb of Taken \\<Rightarrow> UNIV | Present \\<Rightarrow> kinding_fn K pt)\"\n  proof -\n    fix n tp bp\n    assume elem_pts: \"(n, tp, bp) \\<in> set pts\"\n    then obtain i tq bq\n      where elems_at_i:\n        \"i < length qts\"\n        \"pts ! i = (n, tp, bp)\"\n        \"qts ! i = (n, tq, bq)\"\n      using \\<open>map fst pts = map fst qts\\<close>\n      by (simp add: in_set_conv_nth map_eq_iff_nth_eq, metis fst_conv surj_pair)\n    moreover have ih_elim:\n      \"D \\<in> kinding_fn K tq \\<longrightarrow> D \\<in> kinding_fn K tp\"\n      \"bp = bq \\<or> ((K \\<turnstile> tp :\\<kappa> {D}) \\<and> bp < bq)\"\n      using subty_trecord.hyps elems_at_i\n      by (auto simp add: list_all2_conv_all_nth map_eq_iff_nth_eq le_less)\n    ultimately show \"D \\<in> (case bp of Taken \\<Rightarrow> UNIV | Present \\<Rightarrow> kinding_fn K tp)\"\n      using subty_trecord.prems\n      by (force simp add: kinding_def all_set_conv_all_nth split: record_state.splits)\n  qed\n  ultimately show ?case\n    by clarsimp\nnext\n  case (subty_tsum K pts qts)\n  moreover have kind_pts: \"\\<And>n pt pb. (n, pt, pb) \\<in> set pts \\<Longrightarrow> D \\<in> (case pb of Checked \\<Rightarrow> UNIV | Unchecked \\<Rightarrow> kinding_fn K pt)\"\n  proof -\n    fix n tp bp\n    assume elem_pts: \"(n, tp, bp) \\<in> set pts\"\n    then obtain i tq bq\n      where elems_at_i:\n        \"i < length qts\"\n        \"pts ! i = (n, tp, bp)\"\n        \"qts ! i = (n, tq, bq)\"\n      using \\<open>map fst pts = map fst qts\\<close>\n      by (simp add: in_set_conv_nth map_eq_iff_nth_eq, metis fst_conv surj_pair)\n\n    have\n      \"D \\<in> kinding_fn K tq \\<longrightarrow> D \\<in> kinding_fn K tp\"\n      \"bp \\<le> bq\"\n      using subty_tsum.hyps elems_at_i\n      by (auto simp add: list_all2_conv_all_nth map_eq_iff_nth_eq)\n    moreover have \"bq = Unchecked \\<longrightarrow> D \\<in> kinding_fn K tq\"\n      using subty_tsum.prems elems_at_i\n      by (fastforce simp add: all_set_conv_all_nth split: prod.splits)\n    ultimately show \"D \\<in> (case bp of Checked \\<Rightarrow> UNIV | Unchecked \\<Rightarrow> kinding_fn K tp)\"\n      using less_eq_variant_state.elims\n      by (auto split: variant_state.splits)\n  qed\n  ultimately show ?case by auto\nqed auto\n\n\nlemma subtyping_drop_super_impl_drop_sub:\n  assumes \"K \\<turnstile> p \\<sqsubseteq> q\"\n  and \"K \\<turnstile> q :\\<kappa> {D}\"\n  shows \"K \\<turnstile> p :\\<kappa> {D}\"\n  using assms kinding_def subtyping_kinding_fn_drop_super_impl_drop_sub subtyping_wellformed_preservation(2) by auto\n\nlemma subtyping_trans:\n  assumes \"K \\<turnstile> p \\<sqsubseteq> q\"\n  and     \"K \\<turnstile> q \\<sqsubseteq> r\"\n  shows   \"K \\<turnstile> p \\<sqsubseteq> r\"\n  using assms\nproof (induct q arbitrary: p r rule: type.induct)\nnext\n  case (TFun qt ut)\n  show ?case\n    using TFun.prems\n    apply -\n    apply (erule subtyping.cases; clarsimp)\n    apply (erule subtyping.cases; clarsimp)\n    apply (fast dest: TFun.hyps intro: subtyping.intros)\n    done\nnext\n  case (TSum qts)\n  thm subtyping.cases[OF TSum.prems(1), simplified]\n  moreover obtain pts where p_elims:\n    \"p = TSum pts\"\n    \"map fst pts = map fst qts\"\n    \"list_all2 (\\<lambda>p1 p2. subtyping K (fst (snd p1)) (fst (snd p2))) pts qts\"\n    \"list_all2 variant_kind_subty pts qts\"\n    using TSum.prems by (auto elim: subtyping.cases)\n  moreover obtain rts where r_elims:\n    \"r = TSum rts\"\n    \"map fst qts = map fst rts\"\n    \"list_all2 (\\<lambda>p1 p2. subtyping K (fst (snd p1)) (fst (snd p2))) qts rts\"\n    \"list_all2 (\\<lambda>p1 p2. snd (snd p1) \\<le> snd (snd p2)) qts rts\"\n    using TSum.prems by (auto elim: subtyping.cases)\n  moreover have IH:\n    \"(\\<And>i tp tq tr. i < length qts \\<Longrightarrow>\n      K \\<turnstile> fst (snd (pts ! i)) \\<sqsubseteq> fst (snd (qts ! i)) \\<Longrightarrow>\n      K \\<turnstile> fst (snd (qts ! i)) \\<sqsubseteq> fst (snd (rts ! i)) \\<Longrightarrow>\n      K \\<turnstile> fst (snd (pts ! i)) \\<sqsubseteq> fst (snd (rts ! i)))\"\n    using TSum.hyps fsts.intros nth_mem snds.intros by blast\n  moreover have \"list_all2 (\\<lambda>p1 p2. subtyping K (fst (snd p1)) (fst (snd p2))) pts rts\"\n    using p_elims(3) r_elims(3) IH\n    by (clarsimp simp add: list_all2_conv_all_nth)\n  moreover have \"list_all2 (\\<lambda>p1 p2. snd (snd p1) \\<le> snd (snd p2)) pts rts\"\n    using list_all2_trans[OF _ p_elims(4) r_elims(4)]\n    by simp\n  ultimately show ?case\n    using subty_tsum\n    by presburger\nnext\n  case (TProduct x1a x2a)\n  show ?case\n    using TProduct.prems\n    apply -\n    apply (erule subtyping.cases; clarsimp)\n    apply (erule subtyping.cases; clarsimp)\n    apply (fast dest: TProduct.hyps intro: subtyping.intros)\n    done\nnext\n  case (TRecord qts s)\n\n  obtain pts where p_elims:\n    \"p = TRecord pts s\"\n    \"map fst pts = map fst qts\"\n    \"list_all2 (\\<lambda>p1 p2. subtyping K (fst (snd p1)) (fst (snd p2))) pts qts\"\n    \"list_all2 (record_kind_subty K) pts qts\"\n    using TRecord.prems by (auto elim: subtyping.cases)\n  moreover obtain rts where r_elims:\n    \"r = TRecord rts s\"\n    \"map fst qts = map fst rts\"\n    \"list_all2 (\\<lambda>p1 p2. subtyping K (fst (snd p1)) (fst (snd p2))) qts rts\"\n    \"list_all2 (record_kind_subty K) qts rts\"\n    using TRecord.prems by (auto elim: subtyping.cases)\n  moreover have IH:\n    \"(\\<And>i tp tq tr. i < length qts \\<Longrightarrow>\n      K \\<turnstile> fst (snd (pts ! i)) \\<sqsubseteq> fst (snd (qts ! i)) \\<Longrightarrow>\n      K \\<turnstile> fst (snd (qts ! i)) \\<sqsubseteq> fst (snd (rts ! i)) \\<Longrightarrow>\n      K \\<turnstile> fst (snd (pts ! i)) \\<sqsubseteq> fst (snd (rts ! i)))\"\n    using TRecord.hyps fsts.intros nth_mem snds.intros by blast\n  moreover have \"list_all2 (\\<lambda>p1 p2. subtyping K (fst (snd p1)) (fst (snd p2))) pts rts\"\n    using p_elims(3) r_elims(3) IH\n    by (clarsimp simp add: list_all2_conv_all_nth)\n  moreover have sat_p_r: \"\\<And>i. i < length pts \\<Longrightarrow> record_kind_subty K (pts ! i) (rts ! i)\"\n  proof -\n    fix i\n    assume i_len: \"i < length pts\"\n    moreover have \"K \\<turnstile> (fst \\<circ> snd) (pts ! i) \\<sqsubseteq> (fst \\<circ> snd) (qts ! i)\"\n      using i_len list_all2_lengthD list_all2_nthD2 p_elims by fastforce\n    moreover have\n      \"record_kind_subty K (pts ! i) (qts ! i)\"\n      \"record_kind_subty K (qts ! i) (rts ! i)\"\n      using p_elims r_elims i_len\n      by (simp add: list_all2_conv_all_nth)+\n    ultimately show \"record_kind_subty K (pts ! i) (rts ! i)\"\n      by (auto\n          simp add: if_bool_eq_conj kinding_defs not_less_iff_gr_or_eq\n          dest: subtyping_wellformed_preservation subtyping_kinding_fn_drop_super_impl_drop_sub)\n  qed\n  ultimately show ?case\n    using p_elims r_elims\n    by (simp add: sat_p_r list_all2_conv_all_nth subty_trecord)\nqed (fast elim: subtyping.cases)+\n\n\nlemma subtyping_preserves_type_repr:\n  \"K \\<turnstile> t \\<sqsubseteq> t' \\<Longrightarrow> type_repr t = type_repr t'\"\nproof (induct rule: subtyping.induct)\n  case (subty_trecord K ts1 ts2 s1 s2)\n  then show ?case\n    by (cases s1; induct rule: list_all2_induct; auto)\nnext\n  case (subty_tsum K ts1 ts2)\n  then show ?case\n    by (induct rule: list_all2_induct; auto)\nqed auto\n\nlemma subtyping_preserves_type_repr_map:\n  \"list_all2 (\\<lambda>p1 p2. [] \\<turnstile> fst (snd p1) \\<sqsubseteq> fst (snd p2)) as bs\n  \\<Longrightarrow> map (type_repr \\<circ> fst \\<circ> snd) as = map (type_repr \\<circ> fst \\<circ> snd) bs\"\n  by (induct rule: list_all2_induct, auto simp add: subtyping_preserves_type_repr)\n\n\nsection {* Typing lemmas *}\n\nlemma typing_all_Cons1I:\n  assumes\n    \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n    \"\\<exists>ta tsa. ts = ta # tsa \\<and> \\<Xi>, K, \\<Gamma>1 \\<turnstile>  e : ta \\<and> \\<Xi>, K, \\<Gamma>2 \\<turnstile>* es : tsa\"\n  shows \"\\<Xi>, K, \\<Gamma> \\<turnstile>* (e # es) : ts\"\n  using assms\n  by (force intro: typing_all_cons)\n\nlemma variant_elem_preservation:\n  assumes tag_in_ts: \"(tag, t, b) \\<in> set ts\"\n    and tags_same: \"map fst ts = map fst ts'\"\n    and types_same: \"map (fst \\<circ> snd) ts = map (fst \\<circ> snd) ts'\"\n    and taken_subcond: \"list_all2 (\\<lambda>x y. snd (snd x) \\<le> snd (snd y)) ts ts'\"\n  shows \"\\<exists>b'. (tag, t, b') \\<in> set ts' \\<and> (b \\<le> b')\"\nproof -\n  obtain i\n    where ts_at_i:\n      \"i < length ts\"\n      \"ts ! i = (tag, t, b)\"\n    by (meson tag_in_ts in_set_conv_nth)\n  moreover then obtain b' where ts'_at_i: \"ts' ! i = (tag, t, b')\"\n    by (metis comp_eq_dest_lhs eq_fst_iff length_map nth_map snd_conv tags_same types_same)\n  ultimately show ?thesis\n    using taken_subcond ts_at_i ts'_at_i nth_mem\n    by (fastforce simp add: list_all2_conv_all_nth)\nqed\n\nlemma variant_elem_preservation_reverse:\n  assumes tag_in_ts': \"(tag', t', b') \\<in> set ts'\"\n    and tags_same: \"map fst ts = map fst ts'\"\n    and types_same: \"map (fst \\<circ> snd) ts = map (fst \\<circ> snd) ts'\"\n    and taken_subcond: \"list_all2 (\\<lambda>x y. snd (snd x) \\<le> snd (snd y)) ts ts'\"\n  shows \"\\<exists>b. (tag', t', b) \\<in> set ts \\<and> (b \\<le> b')\"\nproof -\n  obtain i\n    where ts'_at_i:\n      \"i < length ts'\"\n      \"ts' ! i = (tag', t', b')\"\n    by (meson tag_in_ts' in_set_conv_nth)\n  then obtain b where ts_at_i: \"ts ! i = (tag', t', b)\"\n    by (metis comp_eq_dest_lhs eq_fst_iff length_map nth_map snd_conv tags_same types_same)\n  moreover have \"b \\<le> b'\"\n    using taken_subcond ts_at_i ts'_at_i\n    by (fastforce simp add: list_all2_conv_all_nth)\n  ultimately show ?thesis\n    using taken_subcond ts_at_i ts'_at_i nth_mem\n    by (metis length_map tags_same)\nqed\n\nsection {* Instantiation *}\n\nlemma instantiate_bang [simp]:\nshows \"instantiate \\<delta> (bang \\<tau>) = bang (instantiate \\<delta> \\<tau>)\"\nby (force intro: bang.induct [where P = \"\\<lambda> \\<tau>. instantiate \\<delta> (bang \\<tau>) = bang (instantiate \\<delta> \\<tau>)\"]\n          simp:  bang_idempotent)\n\nlemma instantiate_instantiate [simp]:\nassumes \"list_all2 (kinding K') \\<delta>' K\"\nand     \"length K' = length \\<delta>\"\nshows   \"K \\<turnstile> x wellformed \\<Longrightarrow> instantiate \\<delta> (instantiate \\<delta>' x) = instantiate (map (instantiate \\<delta>) \\<delta>') x\"\n  using assms\nproof (induct x arbitrary: \\<delta>' rule: instantiate.induct)\nnext case 3 then show ?case by (force dest: kinding_typelist_wellformed_elem simp add: list_all_iff kinding_simps)\nnext case 8 then show ?case by (fastforce dest: kinding_record_wellformed_elem simp add: list_all_iff kinding_simps)\nnext case 6 then show ?case by (fastforce dest: kinding_variant_wellformed_elem simp add: list_all_iff kinding_simps)\nqed (auto simp add: kinding_def kinding_simps dest: list_all2_lengthD)\n\nlemma instantiate_tprim [simp]:\nshows \"instantiate \\<delta> \\<circ> TPrim = TPrim\"\nby (rule ext, simp)\n\nlemma instantiate_nothing:\nshows \"instantiate [] e = e\"\nby (induct e) (auto simp: prod_set_defs intro: map_idI)\n\nlemma instantiate_nothing_id[simp]:\nshows \"instantiate [] = id\"\nby (rule ext, simp add: instantiate_nothing)\n\nlemma instantiate_ctx_nothing:\nshows \"instantiate_ctx [] e = e\"\nunfolding instantiate_ctx_def\nby (induct e, auto simp: map_option.id [simplified id_def])\n\nlemma instantiate_ctx_nothing_id[simp]:\nshows \"instantiate_ctx [] = id\"\nby (rule ext, simp add: instantiate_ctx_nothing)\n\nlemma specialise_nothing:\nshows \"specialise [] e = e\"\nby (induct e) (auto simp: prod_set_defs intro: map_idI)\n\nlemma specialise_nothing_id[simp]:\nshows \"specialise [] = id\"\nby (rule ext, simp add: specialise_nothing)\n\nlemmas typing_struct_instantiate = typing_struct[where ts = \"map (instantiate \\<delta>) ts\" for \\<delta> ts, simplified]\n\nlemma wellkinded_imp_kinded: \"list_all2 (kinding K') \\<delta> K \\<Longrightarrow> list_all2 (\\<lambda>t k. k \\<subseteq> kinding_fn K' t) \\<delta> K\"\n  by (clarsimp simp add: list_all2_conv_all_nth kinding_def)\n\nlemma wellkinded_imp_wellformed: \"list_all2 (kinding K') \\<delta> K \\<Longrightarrow> list_all (type_wellformed (length K')) \\<delta>\"\n  by (clarsimp simp add: list_all2_conv_all_nth list_all_length kinding_def)\n\nlemma instantiate_over_variants_subvariants:\n  assumes tags_same: \"map fst ts = map fst ts'\"\n    and types_same: \"map (fst \\<circ> snd) ts = map (fst \\<circ> snd) ts'\"\n  shows \"map (\\<lambda>(n, t, _). (n, type_repr t)) (map (\\<lambda>(c, t, b). (c, instantiate \\<tau>s t, b)) ts) =\n         map (\\<lambda>(c, t, _). (c, type_repr t)) (map (\\<lambda>(c, t, b). (c, instantiate \\<tau>s t, b)) ts')\"\nproof -\n  have f1: \"((\\<lambda>(n, t, _). (n, type_repr t)) \\<circ> (\\<lambda>(c, t, b). (c, instantiate \\<tau>s t, b))) = (\\<lambda>(n, t, _). (n, type_repr (instantiate \\<tau>s t)))\"\n    by fastforce\n  have f2: \"(\\<lambda>(n, t, _). (n, type_repr (instantiate \\<tau>s t))) = (\\<lambda>p. (fst p, (type_repr \\<circ> (instantiate \\<tau>s) \\<circ> (fst \\<circ> snd)) p))\"\n    by fastforce\n\n  have \"(map (type_repr \\<circ> (instantiate \\<tau>s) \\<circ> (fst \\<circ> snd)) ts) = (map (type_repr \\<circ> (instantiate \\<tau>s) \\<circ> (fst \\<circ> snd)) ts')\"\n    using types_same map_map by metis\n  then have \"map (\\<lambda>(n, t, _). (n, type_repr (instantiate \\<tau>s t))) ts =\n          map (\\<lambda>(n, t, _). (n, type_repr (instantiate \\<tau>s t))) ts'\"\n    by (fastforce intro: pair_list_eqI simp add: f2 comp_def tags_same)\n  then show ?thesis\n    by (simp add: f1)\nqed\n\nsubsection {* substitutivity *}\n\nlemma instantiate_wellformed:\n  assumes\n    \"list_all (type_wellformed n') \\<delta>\"\n    \"length \\<delta> = n\"\n  shows \"type_wellformed n t \\<Longrightarrow> type_wellformed n' (instantiate \\<delta> t)\"\n  using assms\nproof (induct t)\n  case (TVar i)\n  then show ?case\n    by (simp add: list_all_length)\nnext\n  case (TVarBang x)\n  then show ?case\n    using bang_wellformed\n    by (clarsimp simp add: list_all_length)\nqed (auto simp add: list_all_iff)\n\nlemma substitutivity_kinding_fn:\n  assumes\n    \"list_all (type_wellformed (length K')) \\<delta>\"\n    \"list_all2 (\\<lambda>t k. k \\<subseteq> kinding_fn K' t) \\<delta> K\"\n    \"type_wellformed (length K) t\"\n    \"k \\<subseteq> kinding_fn K t\"\n  shows \"k \\<subseteq> kinding_fn K' (instantiate \\<delta> t)\"\n  using assms\nproof (induct t arbitrary: k)\n  case (TVarBang i)\n  then show ?case\n    using bang_kinding_fn\n    by (auto simp add: list_all2_conv_all_nth list_all_length)\nnext\n  case (TSum ts)\n  then show ?case\n    by (fastforce split: variant_state.split simp add: list_all_iff)\nnext\n  case (TRecord ts s)\n  then show ?case\n    by (fastforce split: record_state.split simp add: list_all_iff)\nqed (fastforce simp add: list_all2_conv_all_nth list_all_iff)+\n\nlemma substitutivity_single:\n  assumes\n    \"list_all2 (kinding K') \\<delta> K\"\n    \"K \\<turnstile> t :\\<kappa> k\"\n  shows \"K' \\<turnstile> instantiate \\<delta> t :\\<kappa> k\"\nproof -\n  have \"type_wellformed (length K') (instantiate \\<delta> t)\"\n    using assms\n    by (auto intro!: instantiate_wellformed simp add: kinding_def list_all2_conv_all_nth list_all_length)\n  moreover then have \"k \\<subseteq> kinding_fn K' (instantiate \\<delta> t)\"\n    using assms\n    by (intro substitutivity_kinding_fn; auto simp add: kinding_def list_all2_conv_all_nth list_all_length)\n  ultimately show \"K' \\<turnstile> instantiate \\<delta> t :\\<kappa> k\"\n    by (simp add: kinding_def)\nqed\n\nlemma substitutivity_rest:\nfixes \\<delta>    :: \"type substitution\"\nand   K K' :: \"kind env\"\nassumes well_kinded: \"list_all2 (kinding K') \\<delta> K\"\nshows \"K \\<turnstile>* ts :\\<kappa> k  \\<Longrightarrow> K' \\<turnstile>* map (instantiate \\<delta>) ts                :\\<kappa> k\"\nand   \"K \\<turnstile>* xs :\\<kappa>v k \\<Longrightarrow> K' \\<turnstile>* map (\\<lambda>(n,a,b). (n,instantiate \\<delta> a, b)) xs :\\<kappa>v k\"\nand   \"K \\<turnstile>* fs :\\<kappa>r k \\<Longrightarrow> K' \\<turnstile>* map (\\<lambda>(n,a,b). (n,instantiate \\<delta> a, b)) fs :\\<kappa>r k\"\n  using substitutivity_single well_kinded instantiate_wellformed\n    list_all2_kinding_wellformedD list_all2_lengthD\n     apply -\n     apply (simp add: kinding_all_set kinding_iff_wellformed)+\n   apply (fastforce simp add: kinding_variant_set kinding_iff_wellformed split: variant_state.split)\n  apply (fastforce simp add: kinding_record_set kinding_iff_wellformed split: record_state.split)\n  done\n\nlemmas substitutivity = substitutivity_single substitutivity_rest\n\nlemma list_all2_substitutivity:\nfixes \\<delta>    :: \"type substitution\"\nand   K K' :: \"kind env\"\nassumes well_kinded: \"list_all2 (kinding K') \\<delta> K\"\nshows \"list_all2 (kinding K) ts ks \\<Longrightarrow> list_all2 (kinding K') (map (instantiate \\<delta>) ts) ks\"\nby ( induct rule: list_all2_induct\n   , auto dest: substitutivity [OF well_kinded])\n\nsubsection {* Instantiation of contexts *}\n\nlemma instantiate_ctx_weaken:\nassumes \"K \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'\"\nand     \"list_all2 (kinding K') \\<delta> K\"\nshows   \"K' \\<turnstile> instantiate_ctx \\<delta> \\<Gamma> \\<leadsto>w instantiate_ctx \\<delta> \\<Gamma>'\"\nusing assms(1) [simplified weakening_def] and assms(2) proof (induct rule: list_all2_induct)\n     case Nil  then show ?case by (simp add: instantiate_ctx_def weakening_def)\nnext case Cons then show ?case\n    using instantiate_wellformed list_all2_kinding_wellformedD\n    by (auto simp add: weakening_comp.simps instantiate_ctx_def weakening_Cons\n        dest: substitutivity)\nqed\n\n\nlemma instantiate_ctx_empty [simplified, simp]:\nshows \"instantiate_ctx \\<delta> (empty l) = empty l\"\nby (induct l, simp_all add: empty_def\n                            instantiate_ctx_def)\n\n\n\nlemma instantiate_ctx_singleton [simplified, simp]:\nshows \"instantiate_ctx \\<delta> (singleton l i \\<tau>) = singleton l i (instantiate \\<delta> \\<tau>)\"\nby (induct l arbitrary: i, simp_all add:   instantiate_ctx_def\n                                           empty_def\n                                    split: nat.split)\n\nlemma instantiate_ctx_length [simp]:\nshows \"length (instantiate_ctx \\<delta> \\<Gamma>) = length \\<Gamma>\"\nby (simp add: instantiate_ctx_def)\n\nlemma instantiate_ctx_consumed [simplified]:\nassumes \"K \\<turnstile> \\<Gamma> consumed\"\nand     \"list_all2 (kinding K') \\<delta> K\"\nshows   \"K' \\<turnstile> instantiate_ctx \\<delta> \\<Gamma> consumed\"\nusing assms by (auto intro: instantiate_ctx_weaken [where \\<Gamma>' = \"empty (length \\<Gamma>)\", simplified])\n\nlemma map_option_instantiate_split_comp:\nassumes \"K \\<turnstile> c \\<leadsto> c1 \\<parallel> c2\"\nand     \"list_all2 (kinding K') \\<delta> K\"\nshows   \"K' \\<turnstile> map_option (instantiate \\<delta>) c \\<leadsto> map_option (instantiate \\<delta>) c1 \\<parallel> map_option (instantiate \\<delta>) c2\"\n  using assms\n  by (auto elim!: split_comp.cases simp add: instantiate_wellformed split_comp.intros\n      dest: substitutivity_single list_all2_kinding_wellformedD)\n\nlemma instantiate_ctx_split:\nassumes \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\nand     \"list_all2 (kinding K') \\<delta> K\"\nshows   \"K' \\<turnstile> instantiate_ctx \\<delta> \\<Gamma> \\<leadsto> instantiate_ctx \\<delta> \\<Gamma>1 | instantiate_ctx \\<delta> \\<Gamma>2\"\n  using assms\n  by (auto intro: list_all3_map_over simp: map_option_instantiate_split_comp instantiate_ctx_def split_def)\n\n\nlemma instantiate_ctx_split_bang:\nassumes \"split_bang K is \\<Gamma> \\<Gamma>1 \\<Gamma>2\"\nand     \"list_all2 (kinding K') \\<delta> K\"\nshows   \"split_bang K' is (instantiate_ctx \\<delta> \\<Gamma>) (instantiate_ctx \\<delta> \\<Gamma>1) (instantiate_ctx \\<delta> \\<Gamma>2)\"\n  using assms\nproof (induct rule: split_bang.induct)\n  case split_bang_empty\n  then show ?case\n    by (auto simp: instantiate_ctx_def intro: split_bang.intros)\nnext\n  case split_bang_cons\n  then show ?case\n    by (auto\n        intro!: split_bang.intros substitutivity_single instantiate_wellformed\n        elim!: split_bang_comp.cases split_comp.cases\n        dest: list_all2_kinding_wellformedD\n        simp add: instantiate_ctx_def split_bang_comp.simps split_comp.simps)\nqed\n\n\nlemma instantiate_ctx_cons [simp]:\nshows   \"instantiate_ctx \\<delta> (Some x # \\<Gamma>) = Some (instantiate \\<delta> x) # instantiate_ctx \\<delta> \\<Gamma>\"\nby (simp add: instantiate_ctx_def)\n\n\nlemma specialisation_subtyping:\n  assumes\n    \"K \\<turnstile> t \\<sqsubseteq> t'\"\n    \"K \\<turnstile> t wellformed\"\n    \"K \\<turnstile> t' wellformed\"\n    \"list_all2 (kinding K') \\<delta> K\"\n  shows \"K' \\<turnstile> instantiate \\<delta> t \\<sqsubseteq> instantiate \\<delta>  t'\"\n  using assms\nproof (induct rule: subtyping.inducts)\n  case (subty_tvar i' i K)\n  then show ?case\n    by (auto intro!: subtyping.intros subtyping_refl simp add: kinding_def list_all2_conv_all_nth)\nnext\n  case (subty_tvarb i' i K)\n  moreover then have \"type_wellformed (length K') (bang (\\<delta> ! i))\"\n    by (auto dest: bang_wellformed simp add: kinding_def list_all2_conv_all_nth)\n  ultimately show ?case\n    by (auto intro!: subtyping.intros subtyping_refl simp add: kinding_def list_all2_conv_all_nth)\nnext\n  case (subty_tcon n1 n2 s1 s2 ts1 ts2 K)\n  then show ?case\n    by (simp add: subtyping_simps(3))\nnext\n  case (subty_trecord K ts1 ts2 s1 s2)\n  then show ?case\n  proof (clarsimp, intro subtyping.intros)\n    show \"list_all2 (\\<lambda>p1 p2. K' \\<turnstile> fst (snd p1) \\<sqsubseteq> fst (snd p2)) (map (\\<lambda>(n, t, b). (n, instantiate \\<delta> t, b)) ts1) (map (\\<lambda>(n, t, b). (n, instantiate \\<delta> t, b)) ts2)\"\n      using subty_trecord.prems subty_trecord.hyps(1)\n      by (fastforce simp add: list_all2_conv_all_nth list_all_length split: prod.splits)\n  next\n    have \"length ts1 = length ts2\"\n      using list_all2_conv_all_nth subty_trecord.hyps by blast\n    then show \"list_all2 (record_kind_subty K') (map (\\<lambda>(n, t, b). (n, instantiate \\<delta> t, b)) ts1) (map (\\<lambda>(n, t, b). (n, instantiate \\<delta> t, b)) ts2)\"\n    proof (clarsimp simp add: list_all2_conv_all_nth split: prod.splits)\n      fix i n1 t1 b1 n2 t2 b2\n      presume localassms:\n        \"ts1 ! i = (n1, t1, b1)\"\n        \"ts2 ! i = (n2, t2, b2)\"\n        \"i < length ts2\"\n        \"i < length ts1\"\n        \"K' \\<turnstile> instantiate \\<delta> t1 :\\<kappa> {D} \\<longrightarrow> \\<not> b1 < b2\"\n      moreover then have \"b1 = b2 \\<or> ((K \\<turnstile> t1 :\\<kappa> {D}) \\<and> b1 < b2)\"\n        using subty_trecord.hyps(3)\n        by (force simp add: list_all2_conv_all_nth split: prod.splits)\n      moreover then have \"K \\<turnstile> t1 :\\<kappa> {D} \\<Longrightarrow> K' \\<turnstile> (instantiate \\<delta> t1) :\\<kappa> {D}\"\n        using subty_trecord.prems substitutivity_single\n        by blast\n      ultimately show \"b1 = b2\"\n        by clarsimp\n    qed force+\n  qed force+\nnext\n  case (subty_tsum K ts1 ts2)\n  moreover then have \"\\<And>i. i < length ts1 \\<Longrightarrow>\n    K' \\<turnstile> instantiate \\<delta> (fst (snd (ts1 ! i))) \\<sqsubseteq> instantiate \\<delta> (fst (snd (ts2 ! i)))\"\n    by (auto simp add: list_all2_conv_all_nth list_all_length)\n  ultimately show ?case\n    by (fastforce intro!: subtyping.intros simp add: list_all2_conv_all_nth split: prod.splits)\nqed (auto intro!: subtyping.intros)\n\n\n\nsection {* Lemmas about contexts, splitting and weakening *}\n\nlemma empty_length:\nshows \"length (empty n) = n\"\nby (induct n, simp_all add: empty_def)\n\nsubsection {* split *}\n\nlemma split_length:\n  assumes \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n  shows \"length \\<Gamma> = length \\<Gamma>1\"\n    and \"length \\<Gamma> = length \\<Gamma>2\"\n  using assms\n  by (induct rule: split_induct, force+)\n\nlemma split_preservation_some_left:\n  assumes splits: \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n    and idx: \"\\<Gamma>1 ! i = Some t\"\n  shows \"\\<Gamma> ! i  = Some t\"\n  using assms\n  by (induct arbitrary: i rule: split_induct; fastforce simp add: nth_Cons' elim: split_comp.cases)\n\nlemma split_preservation_some_right:\n  assumes splits: \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n    and idx: \"\\<Gamma>2 ! i = Some t\"\n  shows \"\\<Gamma> ! i  = Some t\"\n  using assms\n  by (induct arbitrary: i rule: split_induct; fastforce simp add: nth_Cons' elim: split_comp.cases)\n\nlemma split_preserves_none:\n  assumes splits: \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n    and idx: \"\\<Gamma> ! i  = None\"\n  shows \"\\<Gamma>1 ! i = None\"\n    and \"\\<Gamma>2 ! i = None\"\n  using assms\n  by (induct arbitrary: i rule: split_induct, (fastforce simp add: nth_Cons' elim: split_comp.cases)+)\n\nsubsection {* split bang *}\n\nlemma split_bang_length:\n  assumes \"K , isa \\<turnstile> \\<Gamma> \\<leadsto>b \\<Gamma>1 | \\<Gamma>2\"\n  shows \"length \\<Gamma> = length \\<Gamma>1\"\n    and \"length \\<Gamma> = length \\<Gamma>2\"\n    and \"length \\<Gamma>1 = length \\<Gamma>2\"\n  using assms\n  by (induct rule: split_bang.induct, force+)\n\nlemma split_bang_Cons1:\n  shows \"(K , isa \\<turnstile> x # \\<Gamma>' \\<leadsto>b \\<Gamma>1 | \\<Gamma>2) \\<longleftrightarrow>\n          (\\<exists>a \\<Gamma>1' b \\<Gamma>2'.\n            (K, (0 \\<in> isa) \\<turnstile> x \\<leadsto>b a \\<parallel> b) \\<and>\n            (K , (pred ` Set.remove (0 :: index) isa) \\<turnstile> \\<Gamma>' \\<leadsto>b \\<Gamma>1' | \\<Gamma>2') \\<and>\n            \\<Gamma>1 = a # \\<Gamma>1' \\<and>\n            \\<Gamma>2 = b # \\<Gamma>2' \\<and>\n            length \\<Gamma>1' = length \\<Gamma>' \\<and>\n            length \\<Gamma>2' = length \\<Gamma>')\"\n  by (fastforce dest: split_bang_length elim: split_bang.cases intro!: split_bang.intros)\n\nlemma split_bang_Cons2:\n  shows \"(K , isa \\<turnstile> \\<Gamma> \\<leadsto>b a # \\<Gamma>1' | \\<Gamma>2) \\<longleftrightarrow>\n          (\\<exists>x \\<Gamma>' b \\<Gamma>2'.\n            (K, (0 \\<in> isa) \\<turnstile> x \\<leadsto>b a \\<parallel> b) \\<and>\n            (K , (pred ` Set.remove (0 :: index) isa) \\<turnstile> \\<Gamma>' \\<leadsto>b \\<Gamma>1' | \\<Gamma>2') \\<and>\n            \\<Gamma> = x # \\<Gamma>' \\<and>\n            \\<Gamma>2 = b # \\<Gamma>2' \\<and>\n            length \\<Gamma>' = length \\<Gamma>1' \\<and>\n            length \\<Gamma>2' = length \\<Gamma>1')\"\n  by (fastforce dest: split_bang_length elim: split_bang.cases intro!: split_bang.intros)\n\nlemma split_bang_Cons3:\n  shows \"(K , isa \\<turnstile> \\<Gamma> \\<leadsto>b \\<Gamma>1 | b # \\<Gamma>2') \\<longleftrightarrow>\n          (\\<exists>x \\<Gamma>' a \\<Gamma>1'.\n            (K, (0 \\<in> isa) \\<turnstile> x \\<leadsto>b a \\<parallel> b) \\<and>\n            (K , (pred ` Set.remove (0 :: index) isa) \\<turnstile> \\<Gamma>' \\<leadsto>b \\<Gamma>1' | \\<Gamma>2') \\<and>\n            \\<Gamma> = x # \\<Gamma>' \\<and>\n            \\<Gamma>1 = a # \\<Gamma>1' \\<and>\n            length \\<Gamma>' = length \\<Gamma>2' \\<and>\n            length \\<Gamma>1' = length \\<Gamma>2')\"\n  by (fastforce dest: split_bang_length elim: split_bang.cases intro!: split_bang.intros)\n\nlemma Suc_mem_image_pred:\n  \"0 \\<notin> js \\<Longrightarrow> (Suc n \\<in> js) = (n \\<in> pred ` js)\"\n  apply (simp add: image_def pred_def)\n  apply (auto elim: rev_bexI split: nat.split_asm)\n  done\n\nlemma Suc_mem_image_pred_remove:\n  \"(n \\<in> pred ` Set.remove 0 js) = (Suc n \\<in> js)\"\n  by (simp add: Suc_mem_image_pred[symmetric])\n\nlemma split_bang_nth:\n  \"split_bang K is \\<Gamma> \\<Gamma>1 \\<Gamma>2 = (length \\<Gamma>1 = length \\<Gamma> \\<and> length \\<Gamma>2 = length \\<Gamma>\n        \\<and> (\\<forall>i < length \\<Gamma>. K , i \\<in> is \\<turnstile> \\<Gamma> ! i \\<leadsto>b \\<Gamma>1 ! i \\<parallel> \\<Gamma>2 ! i))\"\nproof (induct \\<Gamma> arbitrary: \"is\" \\<Gamma>1 \\<Gamma>2)\n  case (Cons a \\<Gamma>)\n  then show ?case\n    apply -\n    apply (intro iffI)\n\n     apply (clarsimp simp add: split_bang_Cons1)\n     apply (case_tac i)\n      apply force\n     apply (fastforce simp add: Suc_mem_image_pred_remove)\n\n    apply (clarsimp simp add: split_bang_Cons1 Suc_mem_image_pred_remove length_Suc_conv)\n    apply (rename_tac a1 \\<Gamma>1 a2 \\<Gamma>2)\n    apply (intro conjI)\n     apply (drule_tac x=0 in spec, cases \"0 \\<in> is\"; force simp add: split_bang_comp.simps)\n    apply auto\n\n    done\nqed (fastforce elim: split_bang.cases intro: split_bang_empty)\n\n\nlemma weakening_length:\nshows \"K \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>' \\<Longrightarrow> length \\<Gamma> = length \\<Gamma>'\"\nby (auto simp: weakening_def dest:list_all2_lengthD)\n\nlemma weakening_preservation_some:\nassumes weak: \"K \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'\"\nand     idx:  \"\\<Gamma>' ! x = Some t\"\nshows   \"\\<Gamma>  ! x = Some t\"\nusing weak[simplified weakening_def]\n  and weakening_length[OF weak]\n  and idx\n  proof (induct arbitrary: x rule: list_all2_induct)\n     case Nil                then show ?case by auto\nnext case (Cons x xs y ys a) then show ?case by (case_tac a, auto elim: weakening_comp.cases)\nqed\n\nlemma weakening_preserves_none:\nassumes weak: \"K \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'\"\nand     idx:  \"\\<Gamma>  ! x = None\"\nshows   \"\\<Gamma>' ! x = None\"\nusing weak[simplified weakening_def]\n  and weakening_length[OF weak]\n  and idx\n  proof (induct arbitrary: x rule: list_all2_induct)\n     case Nil                then show ?case by auto\nnext case (Cons x xs y ys a) then show ?case by (case_tac a, auto elim: weakening_comp.cases)\nqed\n\nlemma same_type_as_weakened:\n  assumes\n    \"K \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'[i := Some t]\"\n    \"i < length \\<Gamma>\"\n  shows \"\\<Gamma> ! i = Some t\"\n  using assms weakening_length weakening_preservation_some\n  by fastforce\n\nlemma same_type_as_split_weakened_left:\n  assumes\n    \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n    \"K \\<turnstile> \\<Gamma>1 \\<leadsto>w \\<Gamma>1'[x := Some t]\"\n    \"x < length \\<Gamma>1\"\n  shows \"\\<Gamma> ! x = Some t\"\n  using assms same_type_as_weakened split_preservation_some_left by blast\n\nlemma same_type_as_split_weakened_right:\n  assumes\n    \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n    \"K \\<turnstile> \\<Gamma>2 \\<leadsto>w \\<Gamma>2'[x := Some t]\"\n    \"x < length \\<Gamma>2\"\n  shows \"\\<Gamma> ! x = Some t\"\n  using assms same_type_as_weakened split_preservation_some_right by blast\n\n\nlemma weakening_nth:\nassumes weak: \"K \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'\"\nand           \"i < length \\<Gamma>\"\nshows         \"weakening_comp K (\\<Gamma>!i) (\\<Gamma>'!i)\"\nusing assms by (auto simp add: weakening_def dest: list_all2_nthD)\n\n\nlemma typing_to_wellformed:\nshows \"\\<Xi>, K, \\<Gamma> \\<turnstile>  e  : t  \\<Longrightarrow> K \\<turnstile>  t  wellformed\"\nand   \"\\<Xi>, K, \\<Gamma> \\<turnstile>* es : ts \\<Longrightarrow> K \\<turnstile>* ts wellformed\"\nproof (induct rule: typing_typing_all.inducts)\n  case typing_var then show ?case\n    by (fastforce dest: weakening_nth elim: weakening_comp.cases simp add: kinding_defs empty_def)\nnext case typing_afun then show ?case\n    by (clarsimp simp add: kinding_defs instantiate_wellformed list_all2_kinding_wellformedD list_all2_lengthD)\nnext case typing_fun then show ?case\n    by (clarsimp simp add: kinding_defs instantiate_wellformed list_all2_kinding_wellformedD list_all2_lengthD)\nnext case typing_esac then show ?case\n    by (fastforce dest: filter_member2  simp add: kinding_simps kinding_variant_set list_all_iff)\nnext case typing_struct then show ?case by (clarsimp simp add: in_set_zip list_all_iff)\nnext case typing_member then show ?case\n    by (fastforce simp add: kinding_defs INT_subset_iff list_all_iff dest: nth_mem split: prod.splits record_state.splits)\nnext case typing_put then show ?case\n    by (clarsimp, auto intro: distinct_list_update simp add: list_all_iff map_update in_set_conv_nth Ball_def nth_list_update)\nnext case typing_promote then show ?case\n    using subtyping_wellformed_preservation by blast\nqed (auto intro: supersumption simp add: kinding_defs)\n\nlemma upcast_valid_cast_to :\nassumes \"upcast_valid \\<tau> \\<tau>'\"\n    and \"lit_type l = Num \\<tau>\"\nobtains x where \"cast_to \\<tau>' l = Some x\"\n            and \"lit_type x = Num \\<tau>'\"\nusing assms by (cases l, auto elim: upcast_valid.elims)\n\nlemma wellformed_imp_bang_type_repr:\n  assumes \"[] \\<turnstile> t wellformed\"\n  shows \"type_repr (bang t) = type_repr t\"\n  using assms\nproof (induct t)\n  case (TCon n ts s)\n  then show ?case\n    by (cases s, rename_tac p l, case_tac p; auto simp add: list_all_iff)\nnext\n  case (TRecord ts s)\n  then show ?case\n    by (cases s, rename_tac p l, case_tac p; auto simp add: list_all_iff)\nqed (auto simp add: list_all_iff)\n\nlemma wellformed_bang_type_repr[simp]:\n  shows \"[] \\<turnstile> t wellformed \\<Longrightarrow> type_repr (bang t) = type_repr t\"\n    and \"[] \\<turnstile>* ts wellformed \\<Longrightarrow> (map (type_repr \\<circ> bang) ts) = map (type_repr) ts \"\n    and \"[] \\<turnstile>* map (fst \\<circ> snd) xs wellformed \\<Longrightarrow> (map (type_repr \\<circ>  bang \\<circ> fst \\<circ> snd) xs) = map (type_repr \\<circ> fst \\<circ> snd) xs\"\n    and \"[] \\<turnstile>* map (fst \\<circ> snd) fs wellformed \\<Longrightarrow> (map (type_repr \\<circ>  bang \\<circ> fst \\<circ> snd) fs) = map (type_repr \\<circ> fst \\<circ> snd) fs\"\n  by (force intro: wellformed_imp_bang_type_repr simp add: kinding_all_set kinding_def)+\n\nlemma bang_type_repr[simp]:\n  shows \"[] \\<turnstile> t :\\<kappa> k \\<Longrightarrow> (type_repr (bang t) = type_repr t)\"\n    and \"[] \\<turnstile>* ts :\\<kappa> k \\<Longrightarrow> (map (type_repr \\<circ> bang) ts) = map (type_repr) ts \"\n    and \"[] \\<turnstile>* xs :\\<kappa>v k \\<Longrightarrow> (map (type_repr \\<circ>  bang \\<circ> fst \\<circ> snd) xs) = map (type_repr \\<circ> fst \\<circ> snd) xs\"\n    and \"[] \\<turnstile>* fs :\\<kappa>r k \\<Longrightarrow> (map (type_repr \\<circ>  bang \\<circ> fst \\<circ> snd) fs) = map (type_repr \\<circ> fst \\<circ> snd) fs\"\n  using wellformed_bang_type_repr\n  by (force dest: kinding_to_wellformedD)+\n\nsubsection {* Specialisation *}\n\nlemma specialisation:\nassumes well_kinded: \"list_all2 (kinding K') \\<delta> K\"\nshows \"\\<Xi> , K , \\<Gamma> \\<turnstile>  e  : \\<tau>  \\<Longrightarrow> \\<Xi> , K' , instantiate_ctx \\<delta> \\<Gamma> \\<turnstile> specialise \\<delta> e : instantiate \\<delta> \\<tau> \"\nand   \"\\<Xi> , K , \\<Gamma> \\<turnstile>* es : \\<tau>s \\<Longrightarrow> \\<Xi> , K' , instantiate_ctx \\<delta> \\<Gamma> \\<turnstile>* map (specialise \\<delta>) es : map (instantiate \\<delta>) \\<tau>s\"\n  using assms\nproof (induct rule: typing_typing_all.inducts)\n  have f1: \"(\\<lambda>(c, p). (c, case p of (t, b) \\<Rightarrow> (instantiate \\<delta> t, b))) = (\\<lambda>(c, t, b). (c, instantiate \\<delta> t, b))\"\n    by force\n  case (typing_case K \\<Gamma> \\<Gamma>1 \\<Gamma>2 \\<Xi> x ts tag t a u b)\n  then have \"\\<Xi>, K', instantiate_ctx \\<delta> \\<Gamma> \\<turnstile> Case (specialise \\<delta> x) tag (specialise \\<delta> a) (specialise \\<delta> b) : instantiate \\<delta> u\"\n  proof (intro typing_typing_all.typing_case)\n    have \"\\<Xi>, K', instantiate_ctx \\<delta> (Some (TSum (tagged_list_update tag (t, Checked) ts)) # \\<Gamma>2) \\<turnstile> specialise \\<delta> b : instantiate \\<delta> u\"\n      using typing_case.hyps(8) typing_case.prems by blast\n    moreover have \"(map (\\<lambda>(c, t, b). (c, instantiate \\<delta> t, b)) (tagged_list_update tag (t, Checked) ts)) = (tagged_list_update tag (instantiate \\<delta> t, Checked) (map (\\<lambda>(c, t, b). (c, instantiate \\<delta> t, b)) ts))\"\n      using case_prod_conv f1 tagged_list_update_map_over1[where f = id and g = \"\\<lambda>_ (t,b). (instantiate \\<delta> t, b)\", simplified]\n      by metis\n    ultimately show \"\\<Xi>, K', Some (TSum (tagged_list_update tag (instantiate \\<delta> t, Checked) (map (\\<lambda>(c, t, b). (c, instantiate \\<delta> t, b)) ts))) # instantiate_ctx \\<delta> \\<Gamma>2 \\<turnstile> specialise \\<delta> b : instantiate \\<delta> u\"\n      by clarsimp\n  qed (force intro: instantiate_ctx_split)+\n  then show ?case by simp\nnext case (typing_afun \\<Xi> f ks t u K ts ks)\n  then also have \"instantiate \\<delta> (instantiate ts t) = instantiate (map (instantiate \\<delta>) ts) t\"\n    and \"instantiate \\<delta> (instantiate ts u) = instantiate (map (instantiate \\<delta>) ts) u\"\n    by (auto dest: list_all2_lengthD intro!: instantiate_instantiate kinding_simps)\n  ultimately show ?case by (auto intro!: list_all2_substitutivity\n        typing_typing_all.typing_afun [simplified]\n        instantiate_ctx_consumed)\nnext case (typing_fun \\<Xi> K t f u t' ts u' ks \\<Gamma>)\n  then also have \"instantiate \\<delta> (instantiate ts t) = instantiate (map (instantiate \\<delta>) ts) t\"\n    and  \"instantiate \\<delta> (instantiate ts u) = instantiate (map (instantiate \\<delta>) ts) u\"\n    by (force dest: list_all2_lengthD intro: instantiate_instantiate dest!: typing_to_wellformed)+\n  ultimately show ?case by (auto intro!: list_all2_substitutivity\n        typing_typing_all.typing_fun [simplified]\n        instantiate_ctx_consumed)\nnext\n  case (typing_con \\<Xi> K \\<Gamma> x t tag ts ts')\n  then show ?case\n  proof (clarsimp, intro typing_typing_all.intros)\n  next show \"K' \\<turnstile> TSum (map (\\<lambda>(c, t, b). (c, instantiate \\<delta> t, b)) ts') wellformed\"\n      using typing_con\n      by (fastforce simp add: list_all_iff intro: substitutivity instantiate_wellformed dest: list_all2_kinding_wellformedD list_all2_lengthD)\n  qed (force intro: specialisation_subtyping substitutivity)+\nnext case typing_esac then show ?case\n    by (force intro!: typing_typing_all.typing_esac\n              simp: filter_map_map_filter_thd3_app2\n                    typing_esac.hyps(3)[symmetric])+\nnext case typing_promote then show ?case\n    by (simp, metis specialisation_subtyping typing_to_wellformed(1) typing_typing_all.typing_promote)\nnext\n  case (typing_all_empty \\<Gamma> \\<Xi> K)\n  then show ?case\n    by (force intro!: typing_typing_all.intros simp add: instantiate_ctx_def empty_def)\nqed (force intro!: typing_struct_instantiate\n                   typing_typing_all.intros\n           dest:   substitutivity\n                   instantiate_ctx_split\n                   instantiate_ctx_split_bang\n                   instantiate_ctx_weaken\n                   instantiate_ctx_consumed\n           simp:   instantiate_ctx_def [where \\<Gamma> = \"[]\", simplified]\n                   map_update\n           split:  prod.splits)+\n\n\n\nfun expr_size :: \"'f expr \\<Rightarrow> nat\" where\n  \"expr_size (Let a b) = Suc ((expr_size a) + (expr_size b))\"\n| \"expr_size (LetBang vs a b) = Suc ((expr_size a) + (expr_size b))\"\n| \"expr_size (Fun f ts) = Suc (expr_size f)\"\n| \"expr_size (Unit) = 0\"\n| \"expr_size (Member x f) = Suc (expr_size x)\"\n| \"expr_size (Cast t x) = Suc (expr_size x)\"\n| \"expr_size (Con c x ts) = Suc (expr_size ts)\"\n| \"expr_size (App a b) = Suc ((expr_size a) + (expr_size b))\"\n| \"expr_size (Prim p as) = Suc (sum_list (map expr_size as))\"\n| \"expr_size (Var v) = 0\"\n| \"expr_size (AFun v va) = 0\"\n| \"expr_size (Struct v va) = Suc (sum_list (map expr_size va))\"\n| \"expr_size (Lit v) = 0\"\n| \"expr_size (SLit s) = 0\"\n| \"expr_size (Tuple v va) = Suc ((expr_size v) + (expr_size va))\"\n| \"expr_size (Put v va vb) = Suc ((expr_size v) + (expr_size vb))\"\n| \"expr_size (Esac x t) = Suc (expr_size x)\"\n| \"expr_size (If x a b) = Suc ((expr_size x) + (expr_size a) + (expr_size b))\"\n| \"expr_size (Split x y) = Suc ((expr_size x) + (expr_size y))\"\n| \"expr_size (Case x v a b) = Suc ((expr_size x) + (expr_size a) + (expr_size b))\"\n| \"expr_size (Take x f y) = Suc ((expr_size x) + (expr_size y))\"\n| \"expr_size (Promote t x) = Suc (expr_size x)\"\n\nlemma specialise_size [simp]:\n  shows \"expr_size (specialise \\<tau>s x) = expr_size x\"\nproof -\nhave \"\\<forall> as . (\\<forall> x. x \\<in> set as \\<longrightarrow> expr_size (specialise \\<tau>s x) = expr_size x) \\<longrightarrow>\n  sum_list (map (expr_size \\<circ> specialise \\<tau>s) as) = sum_list (map expr_size as)\"\nby (rule allI, induct_tac as, simp+)\nthen show ?thesis by (induct x rule: expr_size.induct, auto)\nqed\n\nend\n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/cogent/isa/Cogent.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.31139928120822497}}
{"text": "(*  Title:       Isabelle Collections Library\n    Author:      Andreas Lochbihler <andreas dot lochbihler at kit.edu>\n    Maintainer:  Andreas Lochbihler <andreas dot lochbihler at kit.edu>\n*)\nsection \\<open>\\isaheader{Set implementation via tries}\\<close>\ntheory TrieSetImpl imports\n  TrieMapImpl\n  \"../gen_algo/SetByMap\"\n  \"../gen_algo/SetGA\"\nbegin\n\n(*@impl Set\n  @type ('a) ts\n  @abbrv ts,t\n  Sets of elements of type @{typ \"'a list\"} implemented by tries.\n*)\n\nsubsection \"Definitions\"\n\ntype_synonym\n  'a ts = \"('a, unit) trie\"\n\nsetup Locale_Code.open_block\ninterpretation ts_sbm: SetByMap tm_basic_ops by unfold_locales\nsetup Locale_Code.close_block\n\ndefinition ts_ops :: \"('a list,'a ts) set_ops\"\n  where [icf_rec_def]:\n  \"ts_ops \\<equiv> ts_sbm.basic.dflt_ops\"\n\nsetup Locale_Code.open_block\ninterpretation ts: StdSet ts_ops\n  unfolding ts_ops_def by (rule ts_sbm.basic.dflt_ops_impl)\ninterpretation ts: StdSet_no_invar ts_ops\n  by unfold_locales (simp add: icf_rec_unf SetByMapDefs.invar_def)\nsetup Locale_Code.close_block\n\nsetup \\<open>ICF_Tools.revert_abbrevs \"ts\"\\<close>\n\nlemmas ts_it_to_it_map_code_unfold[code_unfold] = \n  it_to_it_map_fold'[OF pi_trie]\n\nlemma pi_ts[proper_it]: \"proper_it' ts.iteratei ts.iteratei\"\n  unfolding ts.iteratei_def[abs_def]\n  by (rule proper_it'I icf_proper_iteratorI)+\n\ninterpretation pi_ts: proper_it_loc ts.iteratei ts.iteratei\n  by unfold_locales (rule pi_ts)\n\ndefinition test_codegen where \"test_codegen \\<equiv> (\n  ts.empty,\n  ts.memb,\n  ts.ins,\n  ts.delete,\n  ts.list_it,\n  ts.sng,\n  ts.isEmpty,\n  ts.isSng,\n  ts.ball,\n  ts.bex,\n  ts.size,\n  ts.size_abort,\n  ts.union,\n  ts.union_dj,\n  ts.diff,\n  ts.filter,\n  ts.inter,\n  ts.subset,\n  ts.equal,\n  ts.disjoint,\n  ts.disjoint_witness,\n  ts.sel,\n  ts.to_list,\n  ts.from_list\n)\"\n\nexport_code test_codegen checking SML\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/ICF/impl/TrieSetImpl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.31126031186005915}}
{"text": "subsection\\<open>Main Theorems\\<close>\n\ntheory Stuttering\nimports StutteringLemmas\n\nbegin\n\ntext \\<open>\n  Using the lemmas of the previous section about the invariance by stuttering\n  of various properties of TESL specifications, we can now prove that the atomic \n  formulae that compose TESL specifications are invariant by stuttering.\n\\<close>\n\ntext \\<open>Sporadic specifications are preserved in a dilated run.\\<close>\nlemma sporadic_sub:\n  assumes \\<open>sub \\<lless> r\\<close>\n      and \\<open>sub \\<in> \\<lbrakk>c sporadic \\<tau> on c'\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n    shows \\<open>r \\<in> \\<lbrakk>c sporadic \\<tau> on c'\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\nproof -\n  from assms(1) is_subrun_def obtain f\n    where \\<open>dilating f sub r\\<close> by blast\n  hence \\<open>\\<forall>n c. time ((Rep_run sub) n c) = time ((Rep_run r) (f n) c)\n           \\<and> hamlet ((Rep_run sub) n c) = hamlet ((Rep_run r) (f n) c)\\<close> by (simp add: dilating_def)\n  moreover from assms(2) have\n    \\<open>sub \\<in> {r. \\<exists> n. hamlet ((Rep_run r) n c) \\<and> time ((Rep_run r) n c') = \\<tau>}\\<close> by simp\n  from this obtain k where \\<open>time ((Rep_run sub) k c') = \\<tau> \\<and> hamlet ((Rep_run sub) k c)\\<close> by auto\n  ultimately have \\<open>time ((Rep_run r) (f k) c') = \\<tau> \\<and> hamlet ((Rep_run r) (f k) c)\\<close> by simp\n  thus ?thesis by auto\nqed\n\ntext \\<open>Implications are preserved in a dilated run.\\<close>\ntheorem implies_sub:\n  assumes \\<open>sub \\<lless> r\\<close>\n      and \\<open>sub \\<in> \\<lbrakk>c\\<^sub>1 implies c\\<^sub>2\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n    shows \\<open>r \\<in> \\<lbrakk>c\\<^sub>1 implies c\\<^sub>2\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\nproof -\n  from assms(1) is_subrun_def obtain f where \\<open>dilating f sub r\\<close> by blast\n  moreover from assms(2) have\n    \\<open>sub \\<in> {r. \\<forall>n. hamlet ((Rep_run r) n c\\<^sub>1) \\<longrightarrow> hamlet ((Rep_run r) n c\\<^sub>2)}\\<close> by simp\n  hence \\<open>\\<forall>n. hamlet ((Rep_run sub) n c\\<^sub>1) \\<longrightarrow> hamlet ((Rep_run sub) n c\\<^sub>2)\\<close> by simp\n  ultimately have \\<open>\\<forall>n. hamlet ((Rep_run r) n c\\<^sub>1) \\<longrightarrow> hamlet ((Rep_run r) n c\\<^sub>2)\\<close>\n    using ticks_imp_ticks_subk ticks_sub by blast\n  thus ?thesis by simp\nqed\n\ntheorem implies_not_sub:\n  assumes \\<open>sub \\<lless> r\\<close>\n      and \\<open>sub \\<in> \\<lbrakk>c\\<^sub>1 implies not c\\<^sub>2\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n    shows \\<open>r \\<in> \\<lbrakk>c\\<^sub>1 implies not c\\<^sub>2\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\nproof -\n  from assms(1) is_subrun_def obtain f where \\<open>dilating f sub r\\<close> by blast\n  moreover from assms(2) have\n    \\<open>sub \\<in> {r. \\<forall>n. hamlet ((Rep_run r) n c\\<^sub>1) \\<longrightarrow> \\<not> hamlet ((Rep_run r) n c\\<^sub>2)}\\<close> by simp\n  hence \\<open>\\<forall>n. hamlet ((Rep_run sub) n c\\<^sub>1) \\<longrightarrow> \\<not> hamlet ((Rep_run sub) n c\\<^sub>2)\\<close> by simp\n  ultimately have \\<open>\\<forall>n. hamlet ((Rep_run r) n c\\<^sub>1) \\<longrightarrow> \\<not> hamlet ((Rep_run r) n c\\<^sub>2)\\<close>\n    using ticks_imp_ticks_subk ticks_sub by blast\n  thus ?thesis by simp\nqed\n\ntext \\<open>Precedence relations are preserved in a dilated run.\\<close>\ntheorem weakly_precedes_sub:\n  assumes \\<open>sub \\<lless> r\\<close>\n      and \\<open>sub \\<in> \\<lbrakk>c\\<^sub>1 weakly precedes c\\<^sub>2\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n    shows \\<open>r \\<in> \\<lbrakk>c\\<^sub>1 weakly precedes c\\<^sub>2\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\nproof -\n  from assms(1) is_subrun_def obtain f where *:\\<open>dilating f sub r\\<close> by blast\n  from assms(2) have\n    \\<open>sub \\<in> {r. \\<forall>n. (run_tick_count r c\\<^sub>2 n) \\<le> (run_tick_count r c\\<^sub>1 n)}\\<close> by simp\n  hence \\<open>\\<forall>n. (run_tick_count sub c\\<^sub>2 n) \\<le> (run_tick_count sub c\\<^sub>1 n)\\<close> by simp\n  from dil_tick_count[OF assms(1) this]\n    have \\<open>\\<forall>n. (run_tick_count r c\\<^sub>2 n) \\<le> (run_tick_count r c\\<^sub>1 n)\\<close> by simp\n  thus ?thesis by simp\nqed\n\ntheorem strictly_precedes_sub:\n  assumes \\<open>sub \\<lless> r\\<close>\n      and \\<open>sub \\<in> \\<lbrakk>c\\<^sub>1 strictly precedes c\\<^sub>2\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n    shows \\<open>r \\<in> \\<lbrakk>c\\<^sub>1 strictly precedes c\\<^sub>2\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\nproof -\n  from assms(1) is_subrun_def obtain f where *:\\<open>dilating f sub r\\<close> by blast\n  from assms(2) have\n    \\<open>sub \\<in> { \\<rho>. \\<forall>n::nat. (run_tick_count \\<rho> c\\<^sub>2 n) \\<le> (run_tick_count_strictly \\<rho> c\\<^sub>1 n) }\\<close>\n  by simp\n  with strictly_precedes_alt_def2[of \\<open>c\\<^sub>2\\<close> \\<open>c\\<^sub>1\\<close>]  have\n    \\<open>sub \\<in> { \\<rho>. (\\<not>hamlet ((Rep_run \\<rho>) 0 c\\<^sub>2))\n  \\<and> (\\<forall>n::nat. (run_tick_count \\<rho> c\\<^sub>2 (Suc n)) \\<le> (run_tick_count \\<rho> c\\<^sub>1 n)) }\\<close>\n  by blast\n  hence \\<open>(\\<not>hamlet ((Rep_run sub) 0 c\\<^sub>2))\n       \\<and> (\\<forall>n::nat. (run_tick_count sub c\\<^sub>2 (Suc n)) \\<le> (run_tick_count sub c\\<^sub>1 n))\\<close>\n    by simp\n  hence\n    1:\\<open>(\\<not>hamlet ((Rep_run sub) 0 c\\<^sub>2))\n     \\<and> (\\<forall>n::nat. (tick_count sub c\\<^sub>2 (Suc n)) \\<le> (tick_count sub c\\<^sub>1 n))\\<close>\n  by (simp add: tick_count_is_fun)\n  have \\<open>\\<forall>n::nat. (tick_count r c\\<^sub>2 (Suc n)) \\<le> (tick_count r c\\<^sub>1 n)\\<close>\n  proof -\n    { fix n::nat\n      have \\<open>tick_count r c\\<^sub>2 (Suc n) \\<le> tick_count r c\\<^sub>1 n\\<close>\n      proof (cases \\<open>\\<exists>n\\<^sub>0. f n\\<^sub>0 = n\\<close>)\n        case True \\<comment> \\<open>n is in the image of f\\<close>\n          from this obtain n\\<^sub>0 where fn:\\<open>f n\\<^sub>0 = n\\<close> by blast\n          show ?thesis\n          proof (cases \\<open>\\<exists>sn\\<^sub>0. f sn\\<^sub>0 = Suc n\\<close>)\n            case True \\<comment> \\<open>Suc n is in the image of f\\<close>\n              from this obtain sn\\<^sub>0 where fsn:\\<open>f sn\\<^sub>0 = Suc n\\<close> by blast\n              with fn strict_mono_suc * have \\<open>sn\\<^sub>0 = Suc n\\<^sub>0\\<close>\n                using  dilating_def dilating_fun_def by blast\n              with 1 have \\<open>tick_count sub c\\<^sub>2 sn\\<^sub>0 \\<le> tick_count sub c\\<^sub>1 n\\<^sub>0\\<close> by simp\n              thus ?thesis using fn fsn tick_count_sub[OF *] by simp\n          next\n            case False \\<comment> \\<open>Suc n is not in the image of f\\<close>\n              hence \\<open>\\<not>hamlet ((Rep_run r) (Suc n) c\\<^sub>2)\\<close>\n                using * by (simp add: dilating_def dilating_fun_def)\n              hence \\<open>tick_count r c\\<^sub>2 (Suc n) = tick_count r c\\<^sub>2 n\\<close>\n                by (simp add: tick_count_suc)\n              also have \\<open>... = tick_count sub c\\<^sub>2 n\\<^sub>0\\<close>\n                using fn tick_count_sub[OF *] by simp\n              finally have \\<open>tick_count r c\\<^sub>2 (Suc n) = tick_count sub c\\<^sub>2 n\\<^sub>0\\<close> .\n              moreover have \\<open>tick_count sub c\\<^sub>2 n\\<^sub>0 \\<le> tick_count sub c\\<^sub>2 (Suc n\\<^sub>0)\\<close>\n                by (simp add: tick_count_suc)\n              ultimately have\n                \\<open>tick_count r c\\<^sub>2 (Suc n) \\<le> tick_count sub c\\<^sub>2 (Suc n\\<^sub>0)\\<close> by simp\n              moreover have\n                \\<open>tick_count sub c\\<^sub>2 (Suc n\\<^sub>0) \\<le> tick_count sub c\\<^sub>1 n\\<^sub>0\\<close> using 1 by simp\n              ultimately have \\<open>tick_count r c\\<^sub>2 (Suc n) \\<le> tick_count sub c\\<^sub>1 n\\<^sub>0\\<close> by simp\n              thus ?thesis using tick_count_sub[OF *] fn by simp\n          qed\n      next\n        case False \\<comment> \\<open>n is not in the image of f\\<close>\n          from greatest_prev_image[OF * this] obtain n\\<^sub>p  where\n            np_prop:\\<open>f n\\<^sub>p < n \\<and> (\\<forall>k. f n\\<^sub>p < k \\<and> k \\<le> n \\<longrightarrow> (\\<nexists>k\\<^sub>0. f k\\<^sub>0 = k))\\<close> by blast\n          from tick_count_latest[OF * this] have\n            \\<open>tick_count r c\\<^sub>1 n = tick_count r c\\<^sub>1 (f n\\<^sub>p)\\<close> . \n          hence a:\\<open>tick_count r c\\<^sub>1 n = tick_count sub c\\<^sub>1 n\\<^sub>p\\<close>\n            using tick_count_sub[OF *] by simp\n          have b: \\<open>tick_count sub c\\<^sub>2 (Suc n\\<^sub>p) \\<le> tick_count sub c\\<^sub>1 n\\<^sub>p\\<close> using 1 by simp\n          show ?thesis\n          proof (cases \\<open>\\<exists>sn\\<^sub>0. f sn\\<^sub>0 = Suc n\\<close>)\n            case True \\<comment> \\<open>Suc n is in the image of f\\<close>\n              from this obtain sn\\<^sub>0 where fsn:\\<open>f sn\\<^sub>0 = Suc n\\<close> by blast\n              from next_non_stuttering[OF * np_prop this]  have sn_prop:\\<open>sn\\<^sub>0 = Suc n\\<^sub>p\\<close> .\n              with b have \\<open>tick_count sub c\\<^sub>2 sn\\<^sub>0 \\<le> tick_count sub c\\<^sub>1 n\\<^sub>p\\<close> by simp\n              thus ?thesis using tick_count_sub[OF *] fsn a by auto\n          next\n            case False \\<comment> \\<open>Suc n is not in the image of f\\<close>\n              hence \\<open>\\<not>hamlet ((Rep_run r) (Suc n) c\\<^sub>2)\\<close>\n                using * by (simp add: dilating_def dilating_fun_def)\n              hence \\<open>tick_count r c\\<^sub>2 (Suc n) = tick_count r c\\<^sub>2 n\\<close>\n                by (simp add: tick_count_suc)\n              also have \\<open>... = tick_count sub c\\<^sub>2 n\\<^sub>p\\<close> using np_prop tick_count_sub[OF *]\n                by (simp add: tick_count_latest[OF * np_prop])\n              finally have \\<open>tick_count r c\\<^sub>2 (Suc n) = tick_count sub c\\<^sub>2 n\\<^sub>p\\<close> .\n              moreover have \\<open>tick_count sub c\\<^sub>2 n\\<^sub>p \\<le> tick_count sub c\\<^sub>2 (Suc n\\<^sub>p)\\<close>\n                by (simp add: tick_count_suc)\n              ultimately have\n                \\<open>tick_count r c\\<^sub>2 (Suc n) \\<le> tick_count sub c\\<^sub>2 (Suc n\\<^sub>p)\\<close> by simp\n              moreover have\n                \\<open>tick_count sub c\\<^sub>2 (Suc n\\<^sub>p) \\<le> tick_count sub c\\<^sub>1 n\\<^sub>p\\<close> using 1 by simp\n              ultimately have \\<open>tick_count r c\\<^sub>2 (Suc n) \\<le> tick_count sub c\\<^sub>1 n\\<^sub>p\\<close> by simp\n              thus ?thesis using np_prop mono_tick_count  using a by linarith\n          qed\n      qed\n    } thus ?thesis ..\n  qed\n  moreover from 1 have \\<open>\\<not>hamlet ((Rep_run r) 0 c\\<^sub>2)\\<close>\n    using * empty_dilated_prefix ticks_sub by fastforce\n  ultimately show ?thesis by (simp add: tick_count_is_fun strictly_precedes_alt_def2) \nqed\n\ntext \\<open>\n  Time delayed relations are preserved in a dilated run.\n\\<close>\ntheorem time_delayed_sub:\n  assumes \\<open>sub \\<lless> r\\<close>\n      and \\<open>sub \\<in> \\<lbrakk> a time-delayed by \\<delta>\\<tau> on ms implies b \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n    shows \\<open>r \\<in> \\<lbrakk> a time-delayed by \\<delta>\\<tau> on ms implies b \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\nproof -\n  from assms(1) is_subrun_def obtain f where *:\\<open>dilating f sub r\\<close> by blast\n  from assms(2) have \\<open>\\<forall>n. hamlet ((Rep_run sub) n a)\n                          \\<longrightarrow> (\\<forall>m \\<ge> n. first_time sub ms m (time ((Rep_run sub) n ms) + \\<delta>\\<tau>)\n                                       \\<longrightarrow> hamlet ((Rep_run sub) m b))\\<close>\n    using TESL_interpretation_atomic.simps(5)[of \\<open>a\\<close> \\<open>\\<delta>\\<tau>\\<close> \\<open>ms\\<close> \\<open>b\\<close>] by simp\n  hence **:\\<open>\\<forall>n\\<^sub>0. hamlet ((Rep_run r) (f n\\<^sub>0) a)\n                  \\<longrightarrow> (\\<forall>m\\<^sub>0 \\<ge> n\\<^sub>0. first_time r ms (f m\\<^sub>0) (time ((Rep_run r) (f n\\<^sub>0) ms) + \\<delta>\\<tau>)\n                                  \\<longrightarrow> hamlet ((Rep_run r) (f m\\<^sub>0) b))  \\<close>\n    using first_time_image[OF *] dilating_def * by fastforce\n  hence \\<open>\\<forall>n. hamlet ((Rep_run r) n a)\n                  \\<longrightarrow> (\\<forall>m \\<ge> n. first_time r ms m (time ((Rep_run r) n ms) + \\<delta>\\<tau>)\n                                \\<longrightarrow> hamlet ((Rep_run r) m b))\\<close>\n  proof -\n    { fix n assume assm:\\<open>hamlet ((Rep_run r) n a)\\<close>\n      from ticks_image_sub[OF * assm] obtain n\\<^sub>0 where nfn0:\\<open>n = f n\\<^sub>0\\<close> by blast\n      with ** assm have ft0:\n        \\<open>(\\<forall>m\\<^sub>0 \\<ge> n\\<^sub>0. first_time r ms (f m\\<^sub>0) (time ((Rep_run r) (f n\\<^sub>0) ms) + \\<delta>\\<tau>)\n                    \\<longrightarrow> hamlet ((Rep_run r) (f m\\<^sub>0) b))\\<close> by blast\n      have \\<open>(\\<forall>m \\<ge> n. first_time r ms m (time ((Rep_run r) n ms) + \\<delta>\\<tau>) \n                       \\<longrightarrow> hamlet ((Rep_run r) m b)) \\<close>\n      proof -\n      { fix m assume hyp:\\<open>m \\<ge> n\\<close>\n        have \\<open>first_time r ms m (time (Rep_run r n ms) + \\<delta>\\<tau>) \\<longrightarrow> hamlet (Rep_run r m b)\\<close>\n        proof (cases \\<open>\\<exists>m\\<^sub>0. f m\\<^sub>0 = m\\<close>)\n          case True\n          from this obtain m\\<^sub>0 where \\<open>m = f m\\<^sub>0\\<close> by blast\n          moreover have \\<open>strict_mono f\\<close> using * by (simp add: dilating_def dilating_fun_def)\n          ultimately show ?thesis using ft0 hyp nfn0 by (simp add: strict_mono_less_eq)\n        next\n          case False thus ?thesis\n          proof (cases \\<open>m = 0\\<close>)\n            case True\n              hence \\<open>m = f 0\\<close> using * by (simp add: dilating_def dilating_fun_def)\n              then show ?thesis using False by blast\n          next\n            case False\n            hence \\<open>\\<exists>pm. m = Suc pm\\<close> by (simp add: not0_implies_Suc)\n            from this obtain pm where mpm:\\<open>m = Suc pm\\<close> by blast\n            hence \\<open>\\<nexists>pm\\<^sub>0. f pm\\<^sub>0 = Suc pm\\<close> using \\<open>\\<nexists>m\\<^sub>0. f m\\<^sub>0 = m\\<close> by simp \n            with *  have \\<open>time (Rep_run r (Suc pm) ms) = time (Rep_run r pm ms)\\<close>\n              using dilating_def dilating_fun_def by blast\n            hence \\<open>time (Rep_run r pm ms) = time (Rep_run r m ms)\\<close> using mpm by simp\n            moreover from mpm have \\<open>pm < m\\<close> by simp\n            ultimately have \\<open>\\<exists>m' < m. time (Rep_run r m' ms) = time (Rep_run r m ms)\\<close> by blast\n            hence \\<open>\\<not>(first_time r ms m (time (Rep_run r n ms) + \\<delta>\\<tau>))\\<close>\n              by (auto simp add: first_time_def)\n            thus ?thesis by simp\n          qed\n        qed\n      } thus ?thesis by simp\n      qed\n    } thus ?thesis by simp\n  qed\n  thus ?thesis by simp\nqed\n\ntext \\<open>Time relations are preserved through dilation of a run.\\<close>\nlemma tagrel_sub':\n  assumes \\<open>sub \\<lless> r\\<close>\n      and \\<open>sub \\<in> \\<lbrakk> time-relation \\<lfloor>c\\<^sub>1,c\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n    shows \\<open>R (time ((Rep_run r) n c\\<^sub>1), time ((Rep_run r) n c\\<^sub>2))\\<close>\nproof -\n  from assms(1) is_subrun_def obtain f where *:\\<open>dilating f sub r\\<close> by blast\n  moreover from assms(2) TESL_interpretation_atomic.simps(2) have\n    \\<open>sub \\<in> {r. \\<forall>n. R (time ((Rep_run r) n c\\<^sub>1), time ((Rep_run r) n c\\<^sub>2))}\\<close> by blast\n  hence 1:\\<open>\\<forall>n. R (time ((Rep_run sub) n c\\<^sub>1), time ((Rep_run sub) n c\\<^sub>2))\\<close> by simp\n  show ?thesis\n  proof (induction n)\n    case 0\n      from 1 have \\<open>R (time ((Rep_run sub) 0 c\\<^sub>1), time ((Rep_run sub) 0 c\\<^sub>2))\\<close> by simp\n      moreover from * have \\<open>f 0 = 0\\<close> by (simp add: dilating_def dilating_fun_def)\n      moreover from * have \\<open>\\<forall>c. time ((Rep_run sub) 0 c) = time ((Rep_run r) (f 0) c)\\<close>\n        by (simp add: dilating_def)\n      ultimately show ?case by simp\n  next\n    case (Suc n)\n    then show ?case\n    proof (cases \\<open>\\<nexists>n\\<^sub>0. f n\\<^sub>0 = Suc n\\<close>)\n      case True\n      with * have \\<open>\\<forall>c. time (Rep_run r (Suc n) c) = time (Rep_run r n c)\\<close>\n        by (simp add: dilating_def dilating_fun_def) \n      thus ?thesis using Suc.IH by simp\n    next\n      case False\n      from this obtain n\\<^sub>0 where n\\<^sub>0prop:\\<open>f n\\<^sub>0 = Suc n\\<close> by blast\n      from 1 have \\<open>R (time ((Rep_run sub) n\\<^sub>0 c\\<^sub>1), time ((Rep_run sub) n\\<^sub>0 c\\<^sub>2))\\<close> by simp\n      moreover from n\\<^sub>0prop * have \\<open>time ((Rep_run sub) n\\<^sub>0 c\\<^sub>1) = time ((Rep_run r) (Suc n) c\\<^sub>1)\\<close>\n        by (simp add: dilating_def)\n      moreover from n\\<^sub>0prop * have \\<open>time ((Rep_run sub) n\\<^sub>0 c\\<^sub>2) = time ((Rep_run r) (Suc n) c\\<^sub>2)\\<close>\n        by (simp add: dilating_def)\n      ultimately show ?thesis by simp\n    qed\n  qed\nqed\n\ncorollary tagrel_sub:\n  assumes \\<open>sub \\<lless> r\\<close>\n      and \\<open>sub \\<in> \\<lbrakk> time-relation \\<lfloor>c\\<^sub>1,c\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n    shows \\<open>r \\<in> \\<lbrakk> time-relation \\<lfloor>c\\<^sub>1,c\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\nusing tagrel_sub'[OF assms] unfolding TESL_interpretation_atomic.simps(3) by simp\n\ntext \\<open>Time relations are also preserved by contraction\\<close>\nlemma tagrel_sub_inv:\n  assumes \\<open>sub \\<lless> r\\<close>\n      and \\<open>r \\<in> \\<lbrakk> time-relation \\<lfloor>c\\<^sub>1, c\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n    shows \\<open>sub \\<in> \\<lbrakk> time-relation \\<lfloor>c\\<^sub>1, c\\<^sub>2\\<rfloor> \\<in> R \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\nproof -\n  from assms(1) is_subrun_def obtain f where df:\\<open>dilating f sub r\\<close> by blast\n  moreover from assms(2) TESL_interpretation_atomic.simps(2) have\n    \\<open>r \\<in> {\\<rho>. \\<forall>n. R (time ((Rep_run \\<rho>) n c\\<^sub>1), time ((Rep_run \\<rho>) n c\\<^sub>2))}\\<close> by blast\n  hence \\<open>\\<forall>n. R (time ((Rep_run r) n c\\<^sub>1), time ((Rep_run r) n c\\<^sub>2))\\<close> by simp\n  hence \\<open>\\<forall>n. (\\<exists>n\\<^sub>0. f n\\<^sub>0 = n) \\<longrightarrow> R (time ((Rep_run r) n c\\<^sub>1), time ((Rep_run r) n c\\<^sub>2))\\<close> by simp\n  hence \\<open>\\<forall>n\\<^sub>0. R (time ((Rep_run r) (f n\\<^sub>0) c\\<^sub>1), time ((Rep_run r) (f n\\<^sub>0) c\\<^sub>2))\\<close> by blast\n  moreover from dilating_def df have\n    \\<open>\\<forall>n c. time ((Rep_run sub) n c) = time ((Rep_run r) (f n) c)\\<close> by blast\n  ultimately have \\<open>\\<forall>n\\<^sub>0. R (time ((Rep_run sub) n\\<^sub>0 c\\<^sub>1), time ((Rep_run sub) n\\<^sub>0 c\\<^sub>2))\\<close> by auto\n  thus ?thesis by simp\nqed\n\ntext \\<open>\n  Kill relations are preserved in a dilated run.\n\\<close>\ntheorem kill_sub:\n  assumes \\<open>sub \\<lless> r\\<close>\n      and \\<open>sub \\<in> \\<lbrakk> c\\<^sub>1 kills c\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n    shows \\<open>r \\<in> \\<lbrakk> c\\<^sub>1 kills c\\<^sub>2 \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\nproof -\n  from assms(1) is_subrun_def obtain f where *:\\<open>dilating f sub r\\<close> by blast\n  from assms(2) TESL_interpretation_atomic.simps(8) have\n    \\<open>\\<forall>n. hamlet (Rep_run sub n c\\<^sub>1) \\<longrightarrow> (\\<forall>m\\<ge>n. \\<not> hamlet (Rep_run sub m c\\<^sub>2))\\<close> by simp\n  hence 1:\\<open>\\<forall>n. hamlet (Rep_run r (f n) c\\<^sub>1) \\<longrightarrow> (\\<forall>m\\<ge>n. \\<not> hamlet (Rep_run r (f m) c\\<^sub>2))\\<close>\n    using ticks_sub[OF *] by simp\n  hence \\<open>\\<forall>n. hamlet (Rep_run r (f n) c\\<^sub>1) \\<longrightarrow> (\\<forall>m\\<ge> (f n). \\<not> hamlet (Rep_run r m c\\<^sub>2))\\<close>\n  proof -\n    { fix n assume \\<open>hamlet (Rep_run r (f n) c\\<^sub>1)\\<close>\n      with 1 have 2:\\<open>\\<forall> m \\<ge> n. \\<not> hamlet (Rep_run r (f m) c\\<^sub>2)\\<close> by simp\n      have \\<open>\\<forall> m\\<ge> (f n). \\<not> hamlet (Rep_run r m c\\<^sub>2)\\<close>\n      proof -\n        { fix m assume h:\\<open>m \\<ge> f n\\<close>\n          have \\<open>\\<not> hamlet (Rep_run r m c\\<^sub>2)\\<close>\n          proof (cases \\<open>\\<exists>m\\<^sub>0. f m\\<^sub>0 = m\\<close>)\n            case True\n              from this obtain m\\<^sub>0 where fm0:\\<open>f m\\<^sub>0 = m\\<close> by blast\n              hence \\<open>m\\<^sub>0 \\<ge> n\\<close>\n                using * dilating_def dilating_fun_def h strict_mono_less_eq by fastforce\n              with 2 show ?thesis using fm0 by blast\n          next\n            case False\n              thus ?thesis  using ticks_image_sub'[OF *] by blast\n          qed\n        } thus ?thesis by simp\n      qed\n    } thus ?thesis by simp\n  qed\n  hence \\<open>\\<forall>n. hamlet (Rep_run r n c\\<^sub>1) \\<longrightarrow> (\\<forall>m \\<ge> n. \\<not> hamlet (Rep_run r m c\\<^sub>2))\\<close>\n    using ticks_imp_ticks_subk[OF *] by blast\n  thus ?thesis using TESL_interpretation_atomic.simps(8) by blast\nqed\n\nlemmas atomic_sub_lemmas = sporadic_sub tagrel_sub implies_sub implies_not_sub\n                           time_delayed_sub weakly_precedes_sub\n                           strictly_precedes_sub kill_sub\n\ntext \\<open>\n  We can now prove that all atomic specification formulae are preserved\n  by the dilation of runs.\n\\<close>\n\n\ntext \\<open>\n  Finally, any TESL specification is invariant by stuttering.\n\\<close>\ntheorem TESL_stuttering_invariant:\n  assumes \\<open>sub \\<lless> r\\<close>\n    shows \\<open>sub \\<in> \\<lbrakk>\\<lbrakk> S \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L \\<Longrightarrow> r \\<in> \\<lbrakk>\\<lbrakk> S \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\nproof (induction S)\n  case Nil\n    thus ?case by simp\nnext\n  case (Cons a s)\n    from Cons.prems have sa:\\<open>sub \\<in> \\<lbrakk> a \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close> and sb:\\<open>sub \\<in> \\<lbrakk>\\<lbrakk> s \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close>\n      using TESL_interpretation_image by simp+\n    from Cons.IH[OF sb] have \\<open>r \\<in> \\<lbrakk>\\<lbrakk> s \\<rbrakk>\\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close> .\n    moreover from atomic_sub[OF assms(1) sa] have \\<open>r \\<in> \\<lbrakk> a \\<rbrakk>\\<^sub>T\\<^sub>E\\<^sub>S\\<^sub>L\\<close> .\n    ultimately show ?case using  TESL_interpretation_image by simp\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/TESL_Language/Stuttering.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3112603118600591}}
{"text": "(*  Title:      HOL/Auth/Guard/P1.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2002  University of Cambridge\n\nFrom G. Karjoth, N. Asokan and C. Gulcu\n\"Protecting the computation results of free-roaming agents\"\nMobiles Agents 1998, LNCS 1477.\n*)\n\nsection{*Protocol P1*}\n\ntheory P1 imports \"../Public\" Guard_Public List_Msg begin\n\nsubsection{*Protocol Definition*}\n\n(******************************************************************************\n\nthe contents of the messages are not completely specified in the paper\nwe assume that the user sends his request and his itinerary in the clear\n\nwe will adopt the following format for messages: {|A,r,I,L|}\nA: originator (agent)\nr: request (number)\nI: next shops (agent list)\nL: collected offers (offer list)\n\nin the paper, the authors use nonces r_i to add redundancy in the offer\nin order to make it safer against dictionary attacks\nit is not necessary in our modelization since crypto is assumed to be strong\n(Crypt in injective)\n******************************************************************************)\n\nsubsubsection{*offer chaining:\nB chains his offer for A with the head offer of L for sending it to C*}\n\ndefinition chain :: \"agent => nat => agent => msg => agent => msg\" where\n\"chain B ofr A L C ==\nlet m1= Crypt (pubK A) (Nonce ofr) in\nlet m2= Hash {|head L, Agent C|} in\nsign B {|m1,m2|}\"\n\ndeclare Let_def [simp]\n\nlemma chain_inj [iff]: \"(chain B ofr A L C = chain B' ofr' A' L' C')\n= (B=B' & ofr=ofr' & A=A' & head L = head L' & C=C')\"\nby (auto simp: chain_def Let_def)\n\nlemma Nonce_in_chain [iff]: \"Nonce ofr:parts {chain B ofr A L C}\"\nby (auto simp: chain_def sign_def)\n\nsubsubsection{*agent whose key is used to sign an offer*}\n\nfun shop :: \"msg => msg\" where\n\"shop {|B,X,Crypt K H|} = Agent (agt K)\"\n\nlemma shop_chain [simp]: \"shop (chain B ofr A L C) = Agent B\"\nby (simp add: chain_def sign_def)\n\nsubsubsection{*nonce used in an offer*}\n\nfun nonce :: \"msg => msg\" where\n\"nonce {|B,{|Crypt K ofr,m2|},CryptH|} = ofr\"\n\nlemma nonce_chain [simp]: \"nonce (chain B ofr A L C) = Nonce ofr\"\nby (simp add: chain_def sign_def)\n\nsubsubsection{*next shop*}\n\nfun next_shop :: \"msg => agent\" where\n\"next_shop {|B,{|m1,Hash{|headL,Agent C|}|},CryptH|} = C\"\n\nlemma next_shop_chain [iff]: \"next_shop (chain B ofr A L C) = C\"\nby (simp add: chain_def sign_def)\n\nsubsubsection{*anchor of the offer list*}\n\ndefinition anchor :: \"agent => nat => agent => msg\" where\n\"anchor A n B == chain A n A (cons nil nil) B\"\n\nlemma anchor_inj [iff]: \"(anchor A n B = anchor A' n' B')\n= (A=A' & n=n' & B=B')\"\nby (auto simp: anchor_def)\n\nlemma Nonce_in_anchor [iff]: \"Nonce n:parts {anchor A n B}\"\nby (auto simp: anchor_def)\n\nlemma shop_anchor [simp]: \"shop (anchor A n B) = Agent A\"\nby (simp add: anchor_def)\n\nlemma nonce_anchor [simp]: \"nonce (anchor A n B) = Nonce n\"\nby (simp add: anchor_def)\n\nlemma next_shop_anchor [iff]: \"next_shop (anchor A n B) = B\"\nby (simp add: anchor_def)\n\nsubsubsection{*request event*}\n\ndefinition reqm :: \"agent => nat => nat => msg => agent => msg\" where\n\"reqm A r n I B == {|Agent A, Number r, cons (Agent A) (cons (Agent B) I),\ncons (anchor A n B) nil|}\"\n\nlemma reqm_inj [iff]: \"(reqm A r n I B = reqm A' r' n' I' B')\n= (A=A' & r=r' & n=n' & I=I' & B=B')\"\nby (auto simp: reqm_def)\n\nlemma Nonce_in_reqm [iff]: \"Nonce n:parts {reqm A r n I B}\"\nby (auto simp: reqm_def)\n\ndefinition req :: \"agent => nat => nat => msg => agent => event\" where\n\"req A r n I B == Says A B (reqm A r n I B)\"\n\nlemma req_inj [iff]: \"(req A r n I B = req A' r' n' I' B')\n= (A=A' & r=r' & n=n' & I=I' & B=B')\"\nby (auto simp: req_def)\n\nsubsubsection{*propose event*}\n\ndefinition prom :: \"agent => nat => agent => nat => msg => msg =>\nmsg => agent => msg\" where\n\"prom B ofr A r I L J C == {|Agent A, Number r,\napp (J, del (Agent B, I)), cons (chain B ofr A L C) L|}\"\n\nlemma prom_inj [dest]: \"prom B ofr A r I L J C\n= prom B' ofr' A' r' I' L' J' C'\n==> B=B' & ofr=ofr' & A=A' & r=r' & L=L' & C=C'\"\nby (auto simp: prom_def)\n\nlemma Nonce_in_prom [iff]: \"Nonce ofr:parts {prom B ofr A r I L J C}\"\nby (auto simp: prom_def)\n\ndefinition pro :: \"agent => nat => agent => nat => msg => msg =>\nmsg => agent => event\" where\n\"pro B ofr A r I L J C == Says B C (prom B ofr A r I L J C)\"\n\nlemma pro_inj [dest]: \"pro B ofr A r I L J C = pro B' ofr' A' r' I' L' J' C'\n==> B=B' & ofr=ofr' & A=A' & r=r' & L=L' & C=C'\"\nby (auto simp: pro_def dest: prom_inj)\n\nsubsubsection{*protocol*}\n\ninductive_set p1 :: \"event list set\"\nwhere\n\n  Nil: \"[]:p1\"\n\n| Fake: \"[| evsf:p1; X:synth (analz (spies evsf)) |] ==> Says Spy B X # evsf : p1\"\n\n| Request: \"[| evsr:p1; Nonce n ~:used evsr; I:agl |] ==> req A r n I B # evsr : p1\"\n\n| Propose: \"[| evsp:p1; Says A' B {|Agent A,Number r,I,cons M L|}:set evsp;\n  I:agl; J:agl; isin (Agent C, app (J, del (Agent B, I)));\n  Nonce ofr ~:used evsp |] ==> pro B ofr A r I (cons M L) J C # evsp : p1\"\n\nsubsubsection{*Composition of Traces*}\n\nlemma \"evs':p1 ==> \n       evs:p1 & (ALL n. Nonce n:used evs' --> Nonce n ~:used evs) --> \n       evs'@evs : p1\"\napply (erule p1.induct, safe) \napply (simp_all add: used_ConsI) \napply (erule p1.Fake, erule synth_sub, rule analz_mono, rule knows_sub_app)\napply (erule p1.Request, safe, simp_all add: req_def, force) \napply (erule_tac A'=A' in p1.Propose, simp_all) \napply (drule_tac x=ofr in spec, simp add: pro_def, blast) \napply (erule_tac A'=A' in p1.Propose, auto simp: pro_def)\ndone\n\nsubsubsection{*Valid Offer Lists*}\n\ninductive_set\n  valid :: \"agent => nat => agent => msg set\"\n  for A :: agent and n :: nat and B :: agent\nwhere\n  Request [intro]: \"cons (anchor A n B) nil:valid A n B\"\n\n| Propose [intro]: \"L:valid A n B\n==> cons (chain (next_shop (head L)) ofr A L C) L:valid A n B\"\n\nsubsubsection{*basic properties of valid*}\n\nlemma valid_not_empty: \"L:valid A n B ==> EX M L'. L = cons M L'\"\nby (erule valid.cases, auto)\n\nlemma valid_pos_len: \"L:valid A n B ==> 0 < len L\"\nby (erule valid.induct, auto)\n\nsubsubsection{*offers of an offer list*}\n\ndefinition offer_nonces :: \"msg => msg set\" where\n\"offer_nonces L == {X. X:parts {L} & (EX n. X = Nonce n)}\"\n\nsubsubsection{*the originator can get the offers*}\n\nlemma \"L:valid A n B ==> offer_nonces L <= analz (insert L (initState A))\"\nby (erule valid.induct, auto simp: anchor_def chain_def sign_def\noffer_nonces_def initState.simps)\n\nsubsubsection{*list of offers*}\n\nfun offers :: \"msg => msg\" where\n\"offers (cons M L) = cons {|shop M, nonce M|} (offers L)\" |\n\"offers other = nil\"\n\nsubsubsection{*list of agents whose keys are used to sign a list of offers*}\n\nfun shops :: \"msg => msg\" where\n\"shops (cons M L) = cons (shop M) (shops L)\" |\n\"shops other = other\"\n\nlemma shops_in_agl: \"L:valid A n B ==> shops L:agl\"\nby (erule valid.induct, auto simp: anchor_def chain_def sign_def)\n\nsubsubsection{*builds a trace from an itinerary*}\n\nfun offer_list :: \"agent * nat * agent * msg * nat => msg\" where\n\"offer_list (A,n,B,nil,ofr) = cons (anchor A n B) nil\" |\n\"offer_list (A,n,B,cons (Agent C) I,ofr) = (\nlet L = offer_list (A,n,B,I,Suc ofr) in\ncons (chain (next_shop (head L)) ofr A L C) L)\"\n\nlemma \"I:agl ==> ALL ofr. offer_list (A,n,B,I,ofr):valid A n B\"\nby (erule agl.induct, auto)\n\nfun trace :: \"agent * nat * agent * nat * msg * msg * msg\n=> event list\" where\n\"trace (B,ofr,A,r,I,L,nil) = []\" |\n\"trace (B,ofr,A,r,I,L,cons (Agent D) K) = (\nlet C = (if K=nil then B else agt_nb (head K)) in\nlet I' = (if K=nil then cons (Agent A) (cons (Agent B) I)\n          else cons (Agent A) (app (I, cons (head K) nil))) in\nlet I'' = app (I, cons (head K) nil) in\npro C (Suc ofr) A r I' L nil D\n# trace (B,Suc ofr,A,r,I'',tail L,K))\"\n\ndefinition trace' :: \"agent => nat => nat => msg => agent => nat => event list\" where\n\"trace' A r n I B ofr == (\nlet AI = cons (Agent A) I in\nlet L = offer_list (A,n,B,AI,ofr) in\ntrace (B,ofr,A,r,nil,L,AI))\"\n\ndeclare trace'_def [simp]\n\nsubsubsection{*there is a trace in which the originator receives a valid answer*}\n\nlemma p1_not_empty: \"evs:p1 ==> req A r n I B:set evs -->\n(EX evs'. evs'@evs:p1 & pro B' ofr A r I' L J A:set evs' & L:valid A n B)\"\noops\n\n\nsubsection{*properties of protocol P1*}\n\ntext{*publicly verifiable forward integrity:\nanyone can verify the validity of an offer list*}\n\nsubsubsection{*strong forward integrity:\nexcept the last one, no offer can be modified*}\n\nlemma strong_forward_integrity: \"ALL L. Suc i < len L\n--> L:valid A n B & repl (L,Suc i,M):valid A n B --> M = ith (L,Suc i)\"\napply (induct i)\n(* i = 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"{|x,xa,l'a|}:valid A n B\" for x xa l'a)\napply (ind_cases \"{|x,M,l'a|}:valid A n B\" for x l'a)\napply (simp add: chain_def)\n(* i > 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"{|x,repl(l',Suc na,M)|}:valid A n B\" for x l' na)\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"{|x,l'|}:valid A n B\" for x l')\nby (drule_tac x=l' in spec, simp, blast)\n\nsubsubsection{*insertion resilience:\nexcept at the beginning, no offer can be inserted*}\n\nlemma chain_isnt_head [simp]: \"L:valid A n B ==>\nhead L ~= chain (next_shop (head L)) ofr A L C\"\nby (erule valid.induct, auto simp: chain_def sign_def anchor_def)\n\nlemma insertion_resilience: \"ALL L. L:valid A n B --> Suc i < len L\n--> ins (L,Suc i,M) ~:valid A n B\"\napply (induct i)\n(* i = 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"{|x,l'|}:valid A n B\" for x l', simp)\napply (ind_cases \"{|x,M,l'|}:valid A n B\" for x l', clarsimp)\napply (ind_cases \"{|head l',l'|}:valid A n B\" for l', simp, simp)\n(* i > 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"{|x,l'|}:valid A n B\" for x l')\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"{|x,ins(l',Suc na,M)|}:valid A n B\" for x l' na)\napply (frule len_not_empty, clarsimp)\nby (drule_tac x=l' in spec, clarsimp)\n\nsubsubsection{*truncation resilience:\nonly shop i can truncate at offer i*}\n\nlemma truncation_resilience: \"ALL L. L:valid A n B --> Suc i < len L\n--> cons M (trunc (L,Suc i)):valid A n B --> shop M = shop (ith (L,i))\"\napply (induct i)\n(* i = 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"{|x,l'|}:valid A n B\" for x l')\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"{|M,l'|}:valid A n B\" for l')\napply (frule len_not_empty, clarsimp, simp)\n(* i > 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"{|x,l'|}:valid A n B\" for x l')\napply (frule len_not_empty, clarsimp)\nby (drule_tac x=l' in spec, clarsimp)\n\nsubsubsection{*declarations for tactics*}\n\ndeclare knows_Spy_partsEs [elim]\ndeclare Fake_parts_insert [THEN subsetD, dest]\ndeclare initState.simps [simp del]\n\nsubsubsection{*get components of a message*}\n\nlemma get_ML [dest]: \"Says A' B {|A,r,I,M,L|}:set evs ==>\nM:parts (spies evs) & L:parts (spies evs)\"\nby blast\n\nsubsubsection{*general properties of p1*}\n\nlemma reqm_neq_prom [iff]:\n\"reqm A r n I B ~= prom B' ofr A' r' I' (cons M L) J C\"\nby (auto simp: reqm_def prom_def)\n\nlemma prom_neq_reqm [iff]:\n\"prom B' ofr A' r' I' (cons M L) J C ~= reqm A r n I B\"\nby (auto simp: reqm_def prom_def)\n\nlemma req_neq_pro [iff]: \"req A r n I B ~= pro B' ofr A' r' I' (cons M L) J C\"\nby (auto simp: req_def pro_def)\n\nlemma pro_neq_req [iff]: \"pro B' ofr A' r' I' (cons M L) J C ~= req A r n I B\"\nby (auto simp: req_def pro_def)\n\nlemma p1_has_no_Gets: \"evs:p1 ==> ALL A X. Gets A X ~:set evs\"\nby (erule p1.induct, auto simp: req_def pro_def)\n\nlemma p1_is_Gets_correct [iff]: \"Gets_correct p1\"\nby (auto simp: Gets_correct_def dest: p1_has_no_Gets)\n\nlemma p1_is_one_step [iff]: \"one_step p1\"\nby (unfold one_step_def, clarify, ind_cases \"ev#evs:p1\" for ev evs, auto)\n\nlemma p1_has_only_Says' [rule_format]: \"evs:p1 ==>\nev:set evs --> (EX A B X. ev=Says A B X)\"\nby (erule p1.induct, auto simp: req_def pro_def)\n\nlemma p1_has_only_Says [iff]: \"has_only_Says p1\"\nby (auto simp: has_only_Says_def dest: p1_has_only_Says')\n\nlemma p1_is_regular [iff]: \"regular p1\"\napply (simp only: regular_def, clarify)\napply (erule_tac p1.induct)\napply (simp_all add: initState.simps knows.simps pro_def prom_def\n                     req_def reqm_def anchor_def chain_def sign_def)\nby (auto dest: no_Key_in_agl no_Key_in_appdel parts_trans)\n\nsubsubsection{*private keys are safe*}\n\nlemma priK_parts_Friend_imp_bad [rule_format,dest]:\n     \"[| evs:p1; Friend B ~= A |]\n      ==> (Key (priK A):parts (knows (Friend B) evs)) --> (A:bad)\"\napply (erule p1.induct)\napply (simp_all add: initState.simps knows.simps pro_def prom_def\n                req_def reqm_def anchor_def chain_def sign_def)\napply (blast dest: no_Key_in_agl)\napply (auto del: parts_invKey disjE  dest: parts_trans\n            simp add: no_Key_in_appdel)\ndone\n\nlemma priK_analz_Friend_imp_bad [rule_format,dest]:\n     \"[| evs:p1; Friend B ~= A |]\n==> (Key (priK A):analz (knows (Friend B) evs)) --> (A:bad)\"\nby auto\n\nlemma priK_notin_knows_max_Friend: \"[| evs:p1; A ~:bad; A ~= Friend C |]\n==> Key (priK A) ~:analz (knows_max (Friend C) evs)\"\napply (rule not_parts_not_analz, simp add: knows_max_def, safe)\napply (drule_tac H=\"spies' evs\" in parts_sub)\napply (rule_tac p=p1 in knows_max'_sub_spies', simp+)\napply (drule_tac H=\"spies evs\" in parts_sub)\nby (auto dest: knows'_sub_knows [THEN subsetD] priK_notin_initState_Friend)\n\nsubsubsection{*general guardedness properties*}\n\nlemma agl_guard [intro]: \"I:agl ==> I:guard n Ks\"\nby (erule agl.induct, auto)\n\nlemma Says_to_knows_max'_guard: \"[| Says A' C {|A'',r,I,L|}:set evs;\nGuard n Ks (knows_max' C evs) |] ==> L:guard n Ks\"\nby (auto dest: Says_to_knows_max')\n\nlemma Says_from_knows_max'_guard: \"[| Says C A' {|A'',r,I,L|}:set evs;\nGuard n Ks (knows_max' C evs) |] ==> L:guard n Ks\"\nby (auto dest: Says_from_knows_max')\n\nlemma Says_Nonce_not_used_guard: \"[| Says A' B {|A'',r,I,L|}:set evs;\nNonce n ~:used evs |] ==> L:guard n Ks\"\nby (drule not_used_not_parts, auto)\n\nsubsubsection{*guardedness of messages*}\n\nlemma chain_guard [iff]: \"chain B ofr A L C:guard n {priK A}\"\nby (case_tac \"ofr=n\", auto simp: chain_def sign_def)\n\nlemma chain_guard_Nonce_neq [intro]: \"n ~= ofr\n==> chain B ofr A' L C:guard n {priK A}\"\nby (auto simp: chain_def sign_def)\n\nlemma anchor_guard [iff]: \"anchor A n' B:guard n {priK A}\"\nby (case_tac \"n'=n\", auto simp: anchor_def)\n\nlemma anchor_guard_Nonce_neq [intro]: \"n ~= n'\n==> anchor A' n' B:guard n {priK A}\"\nby (auto simp: anchor_def)\n\nlemma reqm_guard [intro]: \"I:agl ==> reqm A r n' I B:guard n {priK A}\"\nby (case_tac \"n'=n\", auto simp: reqm_def)\n\nlemma reqm_guard_Nonce_neq [intro]: \"[| n ~= n'; I:agl |]\n==> reqm A' r n' I B:guard n {priK A}\"\nby (auto simp: reqm_def)\n\nlemma prom_guard [intro]: \"[| I:agl; J:agl; L:guard n {priK A} |]\n==> prom B ofr A r I L J C:guard n {priK A}\"\nby (auto simp: prom_def)\n\nlemma prom_guard_Nonce_neq [intro]: \"[| n ~= ofr; I:agl; J:agl;\nL:guard n {priK A} |] ==> prom B ofr A' r I L J C:guard n {priK A}\"\nby (auto simp: prom_def)\n\nsubsubsection{*Nonce uniqueness*}\n\nlemma uniq_Nonce_in_chain [dest]: \"Nonce k:parts {chain B ofr A L C} ==> k=ofr\"\nby (auto simp: chain_def sign_def)\n\nlemma uniq_Nonce_in_anchor [dest]: \"Nonce k:parts {anchor A n B} ==> k=n\"\nby (auto simp: anchor_def chain_def sign_def)\n\nlemma uniq_Nonce_in_reqm [dest]: \"[| Nonce k:parts {reqm A r n I B};\nI:agl |] ==> k=n\"\nby (auto simp: reqm_def dest: no_Nonce_in_agl)\n\nlemma uniq_Nonce_in_prom [dest]: \"[| Nonce k:parts {prom B ofr A r I L J C};\nI:agl; J:agl; Nonce k ~:parts {L} |] ==> k=ofr\"\nby (auto simp: prom_def dest: no_Nonce_in_agl no_Nonce_in_appdel)\n\nsubsubsection{*requests are guarded*}\n\nlemma req_imp_Guard [rule_format]: \"[| evs:p1; A ~:bad |] ==>\nreq A r n I B:set evs --> Guard n {priK A} (spies evs)\"\napply (erule p1.induct, simp)\napply (simp add: req_def knows.simps, safe)\napply (erule in_synth_Guard, erule Guard_analz, simp)\nby (auto simp: req_def pro_def dest: Says_imp_knows_Spy)\n\nlemma req_imp_Guard_Friend: \"[| evs:p1; A ~:bad; req A r n I B:set evs |]\n==> Guard n {priK A} (knows_max (Friend C) evs)\"\napply (rule Guard_knows_max')\napply (rule_tac H=\"spies evs\" in Guard_mono)\napply (rule req_imp_Guard, simp+)\napply (rule_tac B=\"spies' evs\" in subset_trans)\napply (rule_tac p=p1 in knows_max'_sub_spies', simp+)\nby (rule knows'_sub_knows)\n\nsubsubsection{*propositions are guarded*}\n\nlemma pro_imp_Guard [rule_format]: \"[| evs:p1; B ~:bad; A ~:bad |] ==>\npro B ofr A r I (cons M L) J C:set evs --> Guard ofr {priK A} (spies evs)\"\napply (erule p1.induct) (* +3 subgoals *)\n(* Nil *)\napply simp\n(* Fake *)\napply (simp add: pro_def, safe) (* +4 subgoals *)\n(* 1 *)\napply (erule in_synth_Guard, drule Guard_analz, simp, simp)\n(* 2 *)\napply simp\n(* 3 *)\napply (simp, simp add: req_def pro_def, blast)\n(* 4 *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard Nonce_not_used_Guard)\n(* 5 *)\napply simp\napply safe (* +1 subgoal *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard)\n(* 6 *)\napply (simp add: pro_def)\napply (blast dest: Says_imp_knows_Spy)\n(* Request *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard Nonce_not_used_Guard)\n(* Propose *)\napply simp\napply safe (* +1 subgoal *)\n(* 1 *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard)\n(* 2 *)\napply (simp add: pro_def)\nby (blast dest: Says_imp_knows_Spy)\n\nlemma pro_imp_Guard_Friend: \"[| evs:p1; B ~:bad; A ~:bad;\npro B ofr A r I (cons M L) J C:set evs |]\n==> Guard ofr {priK A} (knows_max (Friend D) evs)\"\napply (rule Guard_knows_max')\napply (rule_tac H=\"spies evs\" in Guard_mono)\napply (rule pro_imp_Guard, simp+)\napply (rule_tac B=\"spies' evs\" in subset_trans)\napply (rule_tac p=p1 in knows_max'_sub_spies', simp+)\nby (rule knows'_sub_knows)\n\nsubsubsection{*data confidentiality:\nno one other than the originator can decrypt the offers*}\n\nlemma Nonce_req_notin_spies: \"[| evs:p1; req A r n I B:set evs; A ~:bad |]\n==> Nonce n ~:analz (spies evs)\"\nby (frule req_imp_Guard, simp+, erule Guard_Nonce_analz, simp+)\n\nlemma Nonce_req_notin_knows_max_Friend: \"[| evs:p1; req A r n I B:set evs;\nA ~:bad; A ~= Friend C |] ==> Nonce n ~:analz (knows_max (Friend C) evs)\"\napply (clarify, frule_tac C=C in req_imp_Guard_Friend, simp+)\napply (simp add: knows_max_def, drule Guard_invKey_keyset, simp+)\nby (drule priK_notin_knows_max_Friend, auto simp: knows_max_def)\n\nlemma Nonce_pro_notin_spies: \"[| evs:p1; B ~:bad; A ~:bad;\npro B ofr A r I (cons M L) J C:set evs |] ==> Nonce ofr ~:analz (spies evs)\"\nby (frule pro_imp_Guard, simp+, erule Guard_Nonce_analz, simp+)\n\nlemma Nonce_pro_notin_knows_max_Friend: \"[| evs:p1; B ~:bad; A ~:bad;\nA ~= Friend D; pro B ofr A r I (cons M L) J C:set evs |]\n==> Nonce ofr ~:analz (knows_max (Friend D) evs)\"\napply (clarify, frule_tac A=A in pro_imp_Guard_Friend, simp+)\napply (simp add: knows_max_def, drule Guard_invKey_keyset, simp+)\nby (drule priK_notin_knows_max_Friend, auto simp: knows_max_def)\n\nsubsubsection{*non repudiability:\nan offer signed by B has been sent by B*}\n\nlemma Crypt_reqm: \"[| Crypt (priK A) X:parts {reqm A' r n I B}; I:agl |] ==> A=A'\"\nby (auto simp: reqm_def anchor_def chain_def sign_def dest: no_Crypt_in_agl)\n\nlemma Crypt_prom: \"[| Crypt (priK A) X:parts {prom B ofr A' r I L J C};\nI:agl; J:agl |] ==> A=B | Crypt (priK A) X:parts {L}\"\napply (simp add: prom_def anchor_def chain_def sign_def)\nby (blast dest: no_Crypt_in_agl no_Crypt_in_appdel)\n\nlemma Crypt_safeness: \"[| evs:p1; A ~:bad |] ==> Crypt (priK A) X:parts (spies evs)\n--> (EX B Y. Says A B Y:set evs & Crypt (priK A) X:parts {Y})\"\napply (erule p1.induct)\n(* Nil *)\napply simp\n(* Fake *)\napply clarsimp\napply (drule_tac P=\"%G. Crypt (priK A) X:G\" in parts_insert_substD, simp)\napply (erule disjE)\napply (drule_tac K=\"priK A\" in Crypt_synth, simp+, blast, blast)\n(* Request *)\napply (simp add: req_def, clarify)\napply (drule_tac P=\"%G. Crypt (priK A) X:G\" in parts_insert_substD, simp)\napply (erule disjE)\napply (frule Crypt_reqm, simp, clarify)\napply (rule_tac x=B in exI, rule_tac x=\"reqm A r n I B\" in exI, simp, blast)\n(* Propose *)\napply (simp add: pro_def, clarify)\napply (drule_tac P=\"%G. Crypt (priK A) X:G\" in parts_insert_substD, simp)\napply (rotate_tac -1, erule disjE)\napply (frule Crypt_prom, simp, simp)\napply (rotate_tac -1, erule disjE)\napply (rule_tac x=C in exI)\napply (rule_tac x=\"prom B ofr Aa r I (cons M L) J C\" in exI, blast)\napply (subgoal_tac \"cons M L:parts (spies evsp)\")\napply (drule_tac G=\"{cons M L}\" and H=\"spies evsp\" in parts_trans, blast, blast)\napply (drule Says_imp_spies, rotate_tac -1, drule parts.Inj)\napply (drule parts.Snd, drule parts.Snd, drule parts.Snd)\nby auto\n\nlemma Crypt_Hash_imp_sign: \"[| evs:p1; A ~:bad |] ==>\nCrypt (priK A) (Hash X):parts (spies evs)\n--> (EX B Y. Says A B Y:set evs & sign A X:parts {Y})\"\napply (erule p1.induct)\n(* Nil *)\napply simp\n(* Fake *)\napply clarsimp\napply (drule_tac P=\"%G. Crypt (priK A) (Hash X):G\" in parts_insert_substD)\napply simp\napply (erule disjE)\napply (drule_tac K=\"priK A\" in Crypt_synth, simp+, blast, blast)\n(* Request *)\napply (simp add: req_def, clarify)\napply (drule_tac P=\"%G. Crypt (priK A) (Hash X):G\" in parts_insert_substD)\napply simp\napply (erule disjE)\napply (frule Crypt_reqm, simp+)\napply (rule_tac x=B in exI, rule_tac x=\"reqm Aa r n I B\" in exI)\napply (simp add: reqm_def sign_def anchor_def no_Crypt_in_agl)\napply (simp add: chain_def sign_def, blast)\n(* Propose *)\napply (simp add: pro_def, clarify)\napply (drule_tac P=\"%G. Crypt (priK A) (Hash X):G\" in parts_insert_substD)\napply simp\napply (rotate_tac -1, erule disjE)\napply (simp add: prom_def sign_def no_Crypt_in_agl no_Crypt_in_appdel)\napply (simp add: chain_def sign_def)\napply (rotate_tac -1, erule disjE)\napply (rule_tac x=C in exI)\napply (rule_tac x=\"prom B ofr Aa r I (cons M L) J C\" in exI)\napply (simp add: prom_def chain_def sign_def)\napply (erule impE) \napply (blast dest: get_ML parts_sub) \napply (blast del: MPair_parts)+\ndone\n\nlemma sign_safeness: \"[| evs:p1; A ~:bad |] ==> sign A X:parts (spies evs)\n--> (EX B Y. Says A B Y:set evs & sign A X:parts {Y})\"\napply (clarify, simp add: sign_def, frule parts.Snd)\napply (blast dest: Crypt_Hash_imp_sign [unfolded sign_def])\ndone\n\nend", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Auth/Guard/P1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.4804786780479071, "lm_q1q2_score": 0.31125323140342}}
{"text": "theory Extra_no_setVarAny\n  imports HandDryer_no_setVarAny Requirements_no_setVarAny VCTheoryLemmas_no_setVarAny\nbegin\n\ntheorem extra2: \"VC2 extraInv s0 hands_value\"\n  apply(simp only: VC2_def extraInv_def dryer_def\nwaiting_def drying_def)\n  by auto\n\ntheorem extra3: \"VC3 extraInv s0 hands_value\"\n  apply(simp only: VC3_def extraInv_def dryer_def\nwaiting_def drying_def)\n  by auto\n\ntheorem extra5: \"VC5 extraInv s0 hands_value\"\n  apply(simp only: VC5_def extraInv_def dryer_def\nwaiting_def drying_def)\n  apply(auto)\nproof -\n  assume 1: \" toEnvP s0\"\n   \" \\<forall>s1. toEnvP s1 \\<and> substate s1 s0 \\<longrightarrow>\n         getPstate s1 Ctrl =\n         Suc (Suc (Suc (Suc 0))) \\<or>\n         getPstate s1 Ctrl =\n         Suc (Suc (Suc (Suc (Suc 0))))\"\n    \"env (setVarBool s0 hands ON) ON \"\n   \" getPstate s0 Ctrl =\n    Suc (Suc (Suc (Suc (Suc 0)))) \"\n   \" hands_value \"\n   \" 0 < ltimeEnv s0 Ctrl \"\n   \" ltimeEnv s0 Ctrl \\<le> 10 \"\n  \"\\<forall>s1. toEnvP s1 \\<and>\n         substate s1 s0 \\<and>\n         Suc (toEnvNum s1 s0) = ltimeEnv s0 Ctrl \\<longrightarrow>\n         getVarBool s1 (Suc 0) \\<and>\n         getVarBool s1 (Suc (Suc 0)) \"\n   \" \\<forall>s1. toEnvP s1 \\<and>\n         substate s1 s0 \\<and>\n         Suc (toEnvNum s1 s0) < ltimeEnv s0 Ctrl \\<longrightarrow>\n         \\<not> getVarBool s1 (Suc 0) \\<and>\n         getVarBool s1 (Suc (Suc 0))\"\n  with toEnvNum_id  have \"Suc (toEnvNum s0 s0) = ltimeEnv s0 Ctrl \\<or>\nSuc (toEnvNum s0 s0) <ltimeEnv s0 Ctrl\" by auto\n  with 1 substate_refl\n  show \"getVarBool s0 (Suc (Suc 0))\" by auto\nqed\n\ntheorem extra6: \"VC6 extraInv s0 hands_value\"\n  apply(simp only: VC6_def extraInv_def dryer_def\nwaiting_def drying_def)\n  by auto\n\ntheorem extra7: \"VC7 extraInv s0 hands_value\"\n  apply(simp only: VC7_def extraInv_def dryer_def\nwaiting_def drying_def)\n  apply(auto)\nproof -\n  assume 1: \"toEnvP s0 \"\n    \"\\<forall>s1. toEnvP s1 \\<and> substate s1 s0 \\<longrightarrow>\n         getPstate s1 Ctrl =\n         Suc (Suc (Suc (Suc 0))) \\<or>\n         getPstate s1 Ctrl =\n         Suc (Suc (Suc (Suc (Suc 0)))) \"\n   \" env (setVarBool s0 hands OFF) OFF \"\n    \"getPstate s0 Ctrl =\n    Suc (Suc (Suc (Suc (Suc 0)))) \"\n    \"\\<not> hands_value \"\n   \" ltimeEnv s0 Ctrl \\<noteq> 10 \"\n    \"0 < ltimeEnv s0 Ctrl \"\n   \" ltimeEnv s0 Ctrl \\<le> 10 \"\n   \" \\<forall>s1. toEnvP s1 \\<and>\n         substate s1 s0 \\<and>\n         Suc (toEnvNum s1 s0) = ltimeEnv s0 Ctrl \\<longrightarrow>\n         getVarBool s1 (Suc 0) \\<and>\n         getVarBool s1 (Suc (Suc 0)) \"\n    \"\\<forall>s1. toEnvP s1 \\<and>\n         substate s1 s0 \\<and>\n         Suc (toEnvNum s1 s0) < ltimeEnv s0 Ctrl \\<longrightarrow>\n         \\<not> getVarBool s1 (Suc 0) \\<and>\n         getVarBool s1 (Suc (Suc 0))\"\nwith toEnvNum_id  have \"Suc (toEnvNum s0 s0) = ltimeEnv s0 Ctrl \\<or>\nSuc (toEnvNum s0 s0) <ltimeEnv s0 Ctrl\" by auto\n  with 1 substate_refl\n  show \"getVarBool s0 (Suc (Suc 0))\" by auto\nqed\n\nend", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/HandDryer/Extra_no_setVarAny.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.3112532314034199}}
{"text": "theory L_Transform\nimports\n  Validity\n  Bisimilarity_Implies_Equivalence\n  FL_Equivalence_Implies_Bisimilarity\nbegin\n\nsection \\<open>\\texorpdfstring{$L$}{L}-Transform\\<close>\n\nsubsection \\<open>States\\<close>\n\ntext \\<open>The intuition is that states of kind~\\<open>AC\\<close> can perform ordinary actions, and states of\nkind~\\<open>EF\\<close> can commit effects.\\<close>\n\ndatatype ('state,'effect) L_state =\n    AC \"'effect \\<times> 'effect fs_set \\<times> 'state\"\n  | EF \"'effect fs_set \\<times> 'state\"\n\ninstantiation L_state :: (pt,pt) pt\nbegin\n\n  fun permute_L_state :: \"perm \\<Rightarrow> ('a,'b) L_state \\<Rightarrow> ('a,'b) L_state\" where\n    \"p \\<bullet> (AC x) = AC (p \\<bullet> x)\"\n  | \"p \\<bullet> (EF x) = EF (p \\<bullet> x)\"\n\n  instance\n  proof\n    fix x :: \"('a,'b) L_state\"\n    show \"0 \\<bullet> x = x\" by (cases x, simp_all)\n  next\n    fix p q and x :: \"('a,'b) L_state\"\n    show \"(p + q) \\<bullet> x = p \\<bullet> q \\<bullet> x\" by (cases x, simp_all)\n  qed\n\nend\n\ndeclare permute_L_state.simps [eqvt]\n\nlemma supp_AC [simp]: \"supp (AC x) = supp x\"\nunfolding supp_def by simp\n\nlemma supp_EF [simp]: \"supp (EF x) = supp x\"\nunfolding supp_def by simp\n\ninstantiation L_state :: (fs,fs) fs\nbegin\n\n  instance\n  proof\n    fix x :: \"('a,'b) L_state\"\n    show \"finite (supp x)\"\n      by (cases x) (simp add: finite_supp)+\n  qed\n\nend\n\n\nsubsection \\<open>Actions and binding names\\<close>\n\ndatatype ('act,'effect) L_action =\n    Act 'act\n  | Eff 'effect\n\ninstantiation L_action :: (pt,pt) pt\nbegin\n\n  fun permute_L_action :: \"perm \\<Rightarrow> ('a,'b) L_action \\<Rightarrow> ('a,'b) L_action\" where\n    \"p \\<bullet> (Act \\<alpha>) = Act (p \\<bullet> \\<alpha>)\"\n  | \"p \\<bullet> (Eff f) = Eff (p \\<bullet> f)\"\n\n  instance\n  proof\n    fix x :: \"('a,'b) L_action\"\n    show \"0 \\<bullet> x = x\" by (cases x, simp_all)\n  next\n    fix p q and x :: \"('a,'b) L_action\"\n    show \"(p + q) \\<bullet> x = p \\<bullet> q \\<bullet> x\" by (cases x, simp_all)\n  qed\n\nend\n\ndeclare permute_L_action.simps [eqvt]\n\nlemma supp_Act [simp]: \"supp (Act \\<alpha>) = supp \\<alpha>\"\nunfolding supp_def by simp\n\nlemma supp_Eff [simp]: \"supp (Eff f) = supp f\"\nunfolding supp_def by simp\n\ninstantiation L_action :: (fs,fs) fs\nbegin\n\n  instance\n  proof\n    fix x :: \"('a,'b) L_action\"\n    show \"finite (supp x)\"\n      by (cases x) (simp add: finite_supp)+\n  qed\n\nend\n\ninstantiation L_action :: (bn,fs) bn\nbegin\n\n  fun bn_L_action :: \"('a,'b) L_action \\<Rightarrow> atom set\" where\n    \"bn_L_action (Act \\<alpha>) = bn \\<alpha>\"\n  | \"bn_L_action (Eff _) = {}\"\n\n  instance\n  proof\n    fix p and \\<alpha> :: \"('a,'b) L_action\"\n    show \"p \\<bullet> bn \\<alpha> = bn (p \\<bullet> \\<alpha>)\"\n      by (cases \\<alpha>) (simp add: bn_eqvt, simp)\n  next\n    fix \\<alpha> :: \"('a,'b) L_action\"\n    show \"finite (bn \\<alpha>)\"\n      by (cases \\<alpha>) (simp add: bn_finite, simp)\n  qed\n\nend\n\n\nsubsection \\<open>Satisfaction\\<close>\n\ncontext effect_nominal_ts\nbegin\n\n  fun L_satisfies :: \"('state,'effect) L_state \\<Rightarrow> 'pred \\<Rightarrow> bool\" (infix \"\\<turnstile>\\<^sub>L\" 70) where\n    \"AC (_,_,P) \\<turnstile>\\<^sub>L \\<phi> \\<longleftrightarrow> P \\<turnstile> \\<phi>\"\n  | \"EF _       \\<turnstile>\\<^sub>L \\<phi> \\<longleftrightarrow> False\"\n\n  lemma L_satisfies_eqvt: assumes \"P\\<^sub>L \\<turnstile>\\<^sub>L \\<phi>\" shows \"(p \\<bullet> P\\<^sub>L) \\<turnstile>\\<^sub>L (p \\<bullet> \\<phi>)\"\n  proof (cases P\\<^sub>L)\n    case (AC fFP)\n    with assms have \"snd (snd fFP) \\<turnstile> \\<phi>\"\n      by (metis L_satisfies.simps(1) prod.collapse)\n    then have \"snd (snd (p \\<bullet> fFP)) \\<turnstile> p \\<bullet> \\<phi>\"\n      by (metis satisfies_eqvt snd_eqvt)\n    then show ?thesis\n      using AC by (metis L_satisfies.simps(1) permute_L_state.simps(1) prod.collapse)\n  next\n    case EF\n    with assms have \"False\"\n      by simp\n    then show ?thesis ..\n  qed\n\nend\n\n\nsubsection \\<open>Transitions\\<close>\n\ncontext effect_nominal_ts\nbegin\n\n  fun L_transition :: \"('state,'effect) L_state \\<Rightarrow> (('act,'effect) L_action, ('state,'effect) L_state) residual \\<Rightarrow> bool\" (infix \"\\<rightarrow>\\<^sub>L\" 70) where\n    \"AC (f,F,P) \\<rightarrow>\\<^sub>L \\<alpha>P' \\<longleftrightarrow> (\\<exists>\\<alpha> P'. P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle> \\<and> \\<alpha>P' = \\<langle>Act \\<alpha>, EF (L (\\<alpha>,F,f), P')\\<rangle> \\<and> bn \\<alpha> \\<sharp>* (F,f))\" \\<comment> \\<open>note the freshness condition\\<close>\n  | \"EF (F,P) \\<rightarrow>\\<^sub>L \\<alpha>P' \\<longleftrightarrow> (\\<exists>f. f \\<in>\\<^sub>f\\<^sub>s F \\<and> \\<alpha>P' = \\<langle>Eff f, AC (f, F, \\<langle>f\\<rangle>P)\\<rangle>)\"\n\n  lemma L_transition_eqvt: assumes \"P\\<^sub>L \\<rightarrow>\\<^sub>L \\<alpha>\\<^sub>LP\\<^sub>L'\" shows \"(p \\<bullet> P\\<^sub>L) \\<rightarrow>\\<^sub>L (p \\<bullet> \\<alpha>\\<^sub>LP\\<^sub>L')\"\n  proof (cases P\\<^sub>L)\n    case AC\n    {\n      fix f F P\n      assume *: \"P\\<^sub>L = AC (f,F,P)\"\n      with assms obtain \\<alpha> P' where trans: \"P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle>\" and \\<alpha>P': \"\\<alpha>\\<^sub>LP\\<^sub>L' = \\<langle>Act \\<alpha>, EF (L (\\<alpha>,F,f), P')\\<rangle>\" and fresh: \"bn \\<alpha> \\<sharp>* (F,f)\"\n        by auto\n      from trans have \"p \\<bullet> P \\<rightarrow> \\<langle>p \\<bullet> \\<alpha>, p \\<bullet> P'\\<rangle>\"\n        by (simp add: transition_eqvt')\n      moreover from \\<alpha>P' have \"p \\<bullet> \\<alpha>\\<^sub>LP\\<^sub>L' = \\<langle>Act (p \\<bullet> \\<alpha>), EF (L (p \\<bullet> \\<alpha>, p \\<bullet> F, p \\<bullet> f), p \\<bullet> P')\\<rangle>\"\n        by (simp add: L_eqvt')\n      moreover from fresh have \"bn (p \\<bullet> \\<alpha>) \\<sharp>* (p \\<bullet> F, p \\<bullet> f)\"\n        by (metis bn_eqvt fresh_star_Pair fresh_star_permute_iff)\n      ultimately have \"p \\<bullet> P\\<^sub>L \\<rightarrow>\\<^sub>L p \\<bullet> \\<alpha>\\<^sub>LP\\<^sub>L'\"\n        using \"*\" by auto\n    }\n    with AC show ?thesis\n      by (metis prod.collapse)\n  next\n    case EF\n    {\n      fix F P\n      assume *: \"P\\<^sub>L = EF (F,P)\"\n      with assms obtain f where \"f \\<in>\\<^sub>f\\<^sub>s F\" and \"\\<alpha>\\<^sub>LP\\<^sub>L' = \\<langle>Eff f, AC (f, F, \\<langle>f\\<rangle>P)\\<rangle>\"\n        by auto\n      then have \"(p \\<bullet> f) \\<in>\\<^sub>f\\<^sub>s (p \\<bullet> F)\" and \"p \\<bullet> \\<alpha>\\<^sub>LP\\<^sub>L' = \\<langle>Eff (p \\<bullet> f), AC (p \\<bullet> f, p \\<bullet> F, \\<langle>p \\<bullet> f\\<rangle>(p \\<bullet> P))\\<rangle>\"\n        by simp+\n      then have \"p \\<bullet> P\\<^sub>L \\<rightarrow>\\<^sub>L p \\<bullet> \\<alpha>\\<^sub>LP\\<^sub>L'\"\n        using \"*\" L_transition.simps(2) Pair_eqvt permute_L_state.simps(2) by force\n    }\n    with EF show ?thesis\n      by (metis prod.collapse)\n  qed\n\n  text \\<open>The binding names in the alpha-variant that witnesses the $L$-transition may be chosen fresh\n  for any finitely supported context.\\<close>\n\n  lemma L_transition_AC_strong:\n    assumes \"finite (supp X)\" and \"AC (f,F,P) \\<rightarrow>\\<^sub>L \\<langle>\\<alpha>\\<^sub>L,P\\<^sub>L'\\<rangle>\"\n    shows \"\\<exists>\\<alpha> P'. P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle> \\<and> \\<langle>\\<alpha>\\<^sub>L,P\\<^sub>L'\\<rangle> = \\<langle>Act \\<alpha>, EF (L (\\<alpha>,F,f), P')\\<rangle> \\<and> bn \\<alpha> \\<sharp>* X\"\n  using assms proof -\n    from \\<open>AC (f,F,P) \\<rightarrow>\\<^sub>L \\<langle>\\<alpha>\\<^sub>L,P\\<^sub>L'\\<rangle>\\<close> obtain \\<alpha> P' where transition: \"P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle>\" and alpha: \"\\<langle>\\<alpha>\\<^sub>L,P\\<^sub>L'\\<rangle> = \\<langle>Act \\<alpha>, EF (L (\\<alpha>,F,f), P')\\<rangle>\" and fresh: \"bn \\<alpha> \\<sharp>* (F,f)\"\n      by (metis L_transition.simps(1))\n    let ?Act = \"Act \\<alpha> :: ('act,'effect) L_action\" \\<comment> \\<open>the type annotation prevents a type that is too polymorphic and doesn't fix~@{typ 'effect}\\<close>\n    have \"finite (bn \\<alpha>)\"\n      by (fact bn_finite)\n    moreover note \\<open>finite (supp X)\\<close>\n    moreover have \"finite (supp (\\<langle>?Act, EF (L (\\<alpha>,F,f), P')\\<rangle>, \\<langle>\\<alpha>,P'\\<rangle>, F, f))\"\n      by (metis finite_Diff finite_UnI finite_supp supp_Pair supp_abs_residual_pair)\n    moreover from fresh have \"bn \\<alpha> \\<sharp>* (\\<langle>?Act, EF (L (\\<alpha>,F,f), P')\\<rangle>, \\<langle>\\<alpha>,P'\\<rangle>, F, f)\"\n      by (auto simp add: fresh_star_def fresh_def supp_Pair supp_abs_residual_pair)\n    ultimately obtain p where fresh_X: \"(p \\<bullet> bn \\<alpha>) \\<sharp>* X\" and \"supp (\\<langle>?Act, EF (L (\\<alpha>,F,f), P')\\<rangle>, \\<langle>\\<alpha>,P'\\<rangle>, F, f) \\<sharp>* p\"\n      by (metis at_set_avoiding2)\n    then have \"supp \\<langle>?Act, EF (L (\\<alpha>,F,f), P')\\<rangle> \\<sharp>* p\" and \"supp \\<langle>\\<alpha>,P'\\<rangle> \\<sharp>* p\" and \"supp (F,f) \\<sharp>* p\"\n      by (metis fresh_star_Un supp_Pair)+\n    then have \"p \\<bullet> \\<langle>?Act, EF (L (\\<alpha>,F,f), P')\\<rangle> = \\<langle>?Act, EF (L (\\<alpha>,F,f), P')\\<rangle>\" and \"p \\<bullet> \\<langle>\\<alpha>,P'\\<rangle> = \\<langle>\\<alpha>,P'\\<rangle>\" and \"p \\<bullet> (F,f) = (F,f)\"\n      by (metis supp_perm_eq)+\n    then have \"\\<langle>Act (p \\<bullet> \\<alpha>), EF (L (p \\<bullet> \\<alpha>, F, f), p \\<bullet> P')\\<rangle> = \\<langle>?Act, EF (L (\\<alpha>,F,f), P')\\<rangle>\" and \"\\<langle>p \\<bullet> \\<alpha>, p \\<bullet> P'\\<rangle> = \\<langle>\\<alpha>,P'\\<rangle>\"\n      using permute_L_action.simps(1) permute_L_state.simps(2) abs_residual_pair_eqvt L_eqvt' Pair_eqvt by auto\n    then show \"\\<exists>\\<alpha> P'. P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle> \\<and> \\<langle>\\<alpha>\\<^sub>L,P\\<^sub>L'\\<rangle> = \\<langle>Act \\<alpha>, EF (L (\\<alpha>,F,f), P')\\<rangle> \\<and> bn \\<alpha> \\<sharp>* X\"\n      using transition and alpha and fresh_X by (metis bn_eqvt)\n  qed\n\n  (* bn \\<alpha> \\<sharp>* (F,f) is required for the \\<longleftarrow> implication as well as for the \\<longrightarrow> implication;\n     additionally bn \\<alpha> \\<sharp>* P is required for the \\<longrightarrow> implication. *)\n\n  lemma L_transition_AC_fresh:\n    assumes \"bn \\<alpha> \\<sharp>* (F,f,P)\"\n    shows \"AC (f,F,P) \\<rightarrow>\\<^sub>L \\<langle>Act \\<alpha>, P\\<^sub>L'\\<rangle> \\<longleftrightarrow> (\\<exists>P'. P\\<^sub>L' = EF (L (\\<alpha>,F,f), P') \\<and> P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle>)\"\n  proof\n    assume \"AC (f,F,P) \\<rightarrow>\\<^sub>L \\<langle>Act \\<alpha>, P\\<^sub>L'\\<rangle>\"\n    moreover have \"finite (supp (F,f,P))\"\n      by (fact finite_supp)\n    ultimately obtain \\<alpha>' P' where trans: \"P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle>\" and eq: \"\\<langle>Act \\<alpha> :: ('act,'effect) L_action, P\\<^sub>L'\\<rangle> = \\<langle>Act \\<alpha>', EF (L (\\<alpha>',F,f), P')\\<rangle>\" and fresh: \"bn \\<alpha>' \\<sharp>* (F,f,P)\"\n      using L_transition_AC_strong by blast\n    from eq obtain p where p: \"p \\<bullet> (Act \\<alpha> :: ('act,'effect) L_action, P\\<^sub>L') = (Act \\<alpha>', EF (L (\\<alpha>',F,f), P'))\" and supp_p: \"supp p \\<subseteq> bn (Act \\<alpha> :: ('act,'effect) L_action) \\<union> p \\<bullet> bn (Act \\<alpha> :: ('act,'effect) L_action)\"\n      using residual_eq_iff_perm_renaming by metis\n\n    from p have p_\\<alpha>: \"p \\<bullet> \\<alpha> = \\<alpha>'\" and p_P\\<^sub>L': \"p \\<bullet> P\\<^sub>L' = EF (L (\\<alpha>',F,f), P')\"\n      by simp_all\n\n    from supp_p and p_\\<alpha> and assms and fresh have \"supp p \\<sharp>* (F, f, P)\"\n      by (simp add: bn_eqvt fresh_star_def) blast\n    then have p_F: \"p \\<bullet> F = F\" and p_f: \"p \\<bullet> f = f\" and p_P: \"p \\<bullet> P = P\"\n      by (simp_all add: fresh_star_Pair perm_supp_eq)\n\n    from p_P\\<^sub>L' have \"P\\<^sub>L' = -p \\<bullet> EF (L (\\<alpha>',F,f), P')\"\n      by (metis permute_minus_cancel(2))\n    then have \"P\\<^sub>L' = EF (L (\\<alpha>,F,f), -p \\<bullet> P')\"\n      using p_\\<alpha> p_F p_f by simp (metis (full_types) permute_minus_cancel(2))\n\n    moreover from trans have \"P \\<rightarrow> \\<langle>\\<alpha>, -p \\<bullet> P'\\<rangle>\"\n      using p_P and p_\\<alpha> by (metis permute_minus_cancel(2) transition_eqvt')\n\n    ultimately show \"\\<exists>P'. P\\<^sub>L' = EF (L (\\<alpha>,F,f), P') \\<and> P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle>\"\n      by blast\n  next\n    assume \"\\<exists>P'. P\\<^sub>L' = EF (L (\\<alpha>,F,f), P') \\<and> P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle>\"\n    moreover from assms have \"bn \\<alpha> \\<sharp>* (F,f)\"\n      by (simp add: fresh_star_Pair)\n    ultimately show \"AC (f, F, P) \\<rightarrow>\\<^sub>L \\<langle>Act \\<alpha>, P\\<^sub>L'\\<rangle>\"\n      using L_transition.simps(1) by blast\n  qed\n\nend\n\n\nsubsection \\<open>Translation of \\texorpdfstring{$F/L$}{F/L}-formulas into formulas without effects\\<close>\n\ntext \\<open>Since we defined formulas via a manual quotient construction, we also need to define the\n$L$-transform via lifting from the underlying type of infinitely branching trees. As before, we\ncannot use {\\bf nominal\\_function} because that generates proof obligations where, for formulas\nof the form~@{term \"Conj xset\"}, the assumption that~@{term xset} has finite support is missing.\\<close>\n\ntext \\<open>The following auxiliary function returns trees (modulo $\\alpha$-equivalence) rather than\nformulas. This allows us to prove equivariance for \\emph{all} argument trees, without an assumption\nthat they are (hereditarily) finitely supported. Further below--after this auxiliary function has\nbeen lifted to $F/L$-formulas as arguments--we derive a version that returns formulas.\\<close>\n\nprimrec L_transform_Tree :: \"('idx,'pred::fs,'act::bn,'eff::fs) Tree \\<Rightarrow> ('idx, 'pred, ('act,'eff) L_action) Formula.Tree\\<^sub>\\<alpha>\" where\n  \"L_transform_Tree (tConj tset) = Formula.Conj\\<^sub>\\<alpha> (map_bset L_transform_Tree tset)\"\n| \"L_transform_Tree (tNot t) = Formula.Not\\<^sub>\\<alpha> (L_transform_Tree t)\"\n| \"L_transform_Tree (tPred f \\<phi>) = Formula.Act\\<^sub>\\<alpha> (Eff f) (Formula.Pred\\<^sub>\\<alpha> \\<phi>)\"\n| \"L_transform_Tree (tAct f \\<alpha> t) = Formula.Act\\<^sub>\\<alpha> (Eff f) (Formula.Act\\<^sub>\\<alpha> (Act \\<alpha>) (L_transform_Tree t))\"\n\nlemma L_transform_Tree_eqvt [eqvt]: \"p \\<bullet> L_transform_Tree t = L_transform_Tree (p \\<bullet> t)\"\nproof (induct t)\n  case (tConj tset)\n  then show ?case\n    by simp (metis (no_types, hide_lams) bset.map_cong0 map_bset_eqvt permute_fun_def permute_minus_cancel(1))\nqed simp_all\n\ntext \\<open>@{const L_transform_Tree} respects $\\alpha$-equivalence.\\<close>\n\nlemma alpha_Tree_L_transform_Tree:\n  assumes \"alpha_Tree t1 t2\"\n  shows \"L_transform_Tree t1 = L_transform_Tree t2\"\nusing assms proof (induction t1 t2 rule: alpha_Tree_induct')\n  case (alpha_tConj tset1 tset2)\n  then have \"rel_bset (=) (map_bset L_transform_Tree tset1) (map_bset L_transform_Tree tset2)\"\n    by (simp add: bset.rel_map(1) bset.rel_map(2) bset.rel_mono_strong)\n  then show ?case\n    by (simp add: bset.rel_eq)\nnext\n  case (alpha_tAct f1 \\<alpha>1 t1 f2 \\<alpha>2 t2)\n  from \\<open>alpha_Tree (FL_Formula.Tree.tAct f1 \\<alpha>1 t1) (FL_Formula.Tree.tAct f2 \\<alpha>2 t2)\\<close>\n    obtain p where *: \"(bn \\<alpha>1, t1) \\<approx>set alpha_Tree (supp_rel alpha_Tree) p (bn \\<alpha>2, t2)\"\n      and **: \"(bn \\<alpha>1, \\<alpha>1) \\<approx>set (=) supp p (bn \\<alpha>2, \\<alpha>2)\" and \"f1 = f2\"\n    by auto\n  from * have fresh: \"(supp_rel alpha_Tree t1 - bn \\<alpha>1) \\<sharp>* p\" and alpha: \"alpha_Tree (p \\<bullet> t1) t2\" and eq: \"p \\<bullet> bn \\<alpha>1 = bn \\<alpha>2\"\n    by (auto simp add: alpha_set)\n  from alpha_tAct.IH(2) have \"supp_rel Formula.alpha_Tree (Formula.rep_Tree\\<^sub>\\<alpha> (L_transform_Tree t1)) \\<subseteq> supp_rel alpha_Tree t1\"\n    by (metis (no_types, lifting) infinite_mono Formula.alpha_Tree_permute_rep_commute L_transform_Tree_eqvt mem_Collect_eq subsetI supp_rel_def)\n  with fresh have fresh': \"(supp_rel Formula.alpha_Tree (Formula.rep_Tree\\<^sub>\\<alpha> (L_transform_Tree t1)) - bn \\<alpha>1) \\<sharp>* p\"\n    by (meson DiffD1 DiffD2 DiffI fresh_star_def subsetCE)\n  moreover from alpha have alpha': \"Formula.alpha_Tree (p \\<bullet> Formula.rep_Tree\\<^sub>\\<alpha> (L_transform_Tree t1)) (Formula.rep_Tree\\<^sub>\\<alpha> (L_transform_Tree t2))\"\n    using alpha_tAct.IH(1) by (metis Formula.alpha_Tree_permute_rep_commute L_transform_Tree_eqvt)\n  moreover from fresh' alpha' eq have \"supp_rel Formula.alpha_Tree (Formula.rep_Tree\\<^sub>\\<alpha> (L_transform_Tree t1)) - bn \\<alpha>1 = supp_rel Formula.alpha_Tree (Formula.rep_Tree\\<^sub>\\<alpha> (L_transform_Tree t2)) - bn \\<alpha>2\"\n    by (metis (mono_tags) Diff_eqvt Formula.alpha_Tree_eqvt' Formula.alpha_Tree_eqvt_aux Formula.alpha_Tree_supp_rel atom_set_perm_eq)\n  ultimately have \"(bn \\<alpha>1, Formula.rep_Tree\\<^sub>\\<alpha> (L_transform_Tree t1)) \\<approx>set Formula.alpha_Tree (supp_rel Formula.alpha_Tree) p (bn \\<alpha>2, Formula.rep_Tree\\<^sub>\\<alpha> (L_transform_Tree t2))\"\n    using eq by (simp add: alpha_set)\n  moreover from ** have \"(bn \\<alpha>1, Act \\<alpha>1) \\<approx>set (=) supp p (bn \\<alpha>2, Act \\<alpha>2)\"\n    by (metis (mono_tags, lifting) L_Transform.supp_Act alpha_set permute_L_action.simps(1))\n  ultimately have \"Formula.Act\\<^sub>\\<alpha> (Act \\<alpha>1) (L_transform_Tree t1) = Formula.Act\\<^sub>\\<alpha> (Act \\<alpha>2) (L_transform_Tree t2)\"\n    by (auto simp add: Formula.Act\\<^sub>\\<alpha>_eq_iff)\n  with \\<open>f1 = f2\\<close> show ?case\n    by simp\nqed simp_all\n\ntext \\<open>$L$-transform for trees modulo $\\alpha$-equivalence.\\<close>\n\nlift_definition L_transform_Tree\\<^sub>\\<alpha> :: \"('idx,'pred::fs,'act::bn,'eff::fs) Tree\\<^sub>\\<alpha> \\<Rightarrow> ('idx, 'pred, ('act,'eff) L_action) Formula.Tree\\<^sub>\\<alpha>\" is\n    L_transform_Tree\n  by (fact alpha_Tree_L_transform_Tree)\n\nlemma L_transform_Tree\\<^sub>\\<alpha>_eqvt [eqvt]: \"p \\<bullet> L_transform_Tree\\<^sub>\\<alpha> t\\<^sub>\\<alpha> = L_transform_Tree\\<^sub>\\<alpha> (p \\<bullet> t\\<^sub>\\<alpha>)\"\n  by transfer (simp)\n\nlemma L_transform_Tree\\<^sub>\\<alpha>_Conj\\<^sub>\\<alpha> [simp]: \"L_transform_Tree\\<^sub>\\<alpha> (Conj\\<^sub>\\<alpha> tset\\<^sub>\\<alpha>) = Formula.Conj\\<^sub>\\<alpha> (map_bset L_transform_Tree\\<^sub>\\<alpha> tset\\<^sub>\\<alpha>)\"\n  by (simp add: Conj\\<^sub>\\<alpha>_def' L_transform_Tree\\<^sub>\\<alpha>.abs_eq) (metis (no_types, lifting) L_transform_Tree\\<^sub>\\<alpha>.rep_eq bset.map_comp bset.map_cong0 comp_apply)\n\nlemma L_transform_Tree\\<^sub>\\<alpha>_Not\\<^sub>\\<alpha> [simp]: \"L_transform_Tree\\<^sub>\\<alpha> (Not\\<^sub>\\<alpha> t\\<^sub>\\<alpha>) = Formula.Not\\<^sub>\\<alpha> (L_transform_Tree\\<^sub>\\<alpha> t\\<^sub>\\<alpha>)\"\n  by transfer simp\n\nlemma L_transform_Tree\\<^sub>\\<alpha>_Pred\\<^sub>\\<alpha> [simp]: \"L_transform_Tree\\<^sub>\\<alpha> (Pred\\<^sub>\\<alpha> f \\<phi>) = Formula.Act\\<^sub>\\<alpha> (Eff f) (Formula.Pred\\<^sub>\\<alpha> \\<phi>)\"\n  by transfer simp\n\nlemma L_transform_Tree\\<^sub>\\<alpha>_Act\\<^sub>\\<alpha> [simp]: \"L_transform_Tree\\<^sub>\\<alpha> (Act\\<^sub>\\<alpha> f \\<alpha> t\\<^sub>\\<alpha>) = Formula.Act\\<^sub>\\<alpha> (Eff f) (Formula.Act\\<^sub>\\<alpha> (Act \\<alpha>) (L_transform_Tree\\<^sub>\\<alpha> t\\<^sub>\\<alpha>))\"\n  by transfer simp\n\nlemma finite_supp_map_bset_L_transform_Tree\\<^sub>\\<alpha> [simp]:\n  assumes \"finite (supp tset\\<^sub>\\<alpha>)\"\n  shows \"finite (supp (map_bset L_transform_Tree\\<^sub>\\<alpha> tset\\<^sub>\\<alpha>))\"\nproof -\n  have \"eqvt map_bset\" and \"eqvt L_transform_Tree\\<^sub>\\<alpha>\"\n    by (simp add: eqvtI)+\n  then have \"supp (map_bset L_transform_Tree\\<^sub>\\<alpha>) = {}\"\n    using supp_fun_eqvt supp_fun_app_eqvt by blast\n  then have \"supp (map_bset L_transform_Tree\\<^sub>\\<alpha> tset\\<^sub>\\<alpha>) \\<subseteq> supp tset\\<^sub>\\<alpha>\"\n    using supp_fun_app by blast\n  with assms show \"finite (supp (map_bset L_transform_Tree\\<^sub>\\<alpha> tset\\<^sub>\\<alpha>))\"\n    by (metis finite_subset)\nqed\n\nlemma L_transform_Tree\\<^sub>\\<alpha>_preserves_hereditarily_fs:\n  assumes \"hereditarily_fs t\\<^sub>\\<alpha>\"\n  shows \"Formula.hereditarily_fs (L_transform_Tree\\<^sub>\\<alpha> t\\<^sub>\\<alpha>)\"\nusing assms proof (induct rule: hereditarily_fs.induct)\n  case (Conj\\<^sub>\\<alpha> tset\\<^sub>\\<alpha>)\n  then show ?case\n    by (auto intro!: Formula.hereditarily_fs.Conj\\<^sub>\\<alpha>) (metis imageE map_bset.rep_eq)\nnext\n  case (Not\\<^sub>\\<alpha> t\\<^sub>\\<alpha>)\n  then show ?case\n    by (simp add: Formula.hereditarily_fs.Not\\<^sub>\\<alpha>)\nnext\n  case (Pred\\<^sub>\\<alpha> f \\<phi>)\n  then show ?case\n    by (simp add: Formula.hereditarily_fs.Act\\<^sub>\\<alpha> Formula.hereditarily_fs.Pred\\<^sub>\\<alpha>)\nnext\n  case (Act\\<^sub>\\<alpha> t\\<^sub>\\<alpha> f \\<alpha>)\n  then show ?case\n    by (simp add: Formula.hereditarily_fs.Act\\<^sub>\\<alpha>)\nqed\n\ntext \\<open>$L$-transform for $F/L$-formulas.\\<close>\n\nlift_definition L_transform_formula :: \"('idx,'pred::fs,'act::bn,'eff::fs) formula \\<Rightarrow> ('idx, 'pred, ('act,'eff) L_action) Formula.Tree\\<^sub>\\<alpha>\" is\n    L_transform_Tree\\<^sub>\\<alpha>\n  .\n\nlemma L_transform_formula_eqvt [eqvt]: \"p \\<bullet> L_transform_formula x = L_transform_formula (p \\<bullet> x)\"\n  by transfer (simp)\n\nlemma L_transform_formula_Conj [simp]:\n  assumes \"finite (supp xset)\"\n  shows \"L_transform_formula (Conj xset) = Formula.Conj\\<^sub>\\<alpha> (map_bset L_transform_formula xset)\"\n  using assms by (simp add: Conj_def L_transform_formula_def bset.map_comp map_fun_def)\n\nlemma L_transform_formula_Not [simp]: \"L_transform_formula (Not x) = Formula.Not\\<^sub>\\<alpha> (L_transform_formula x)\"\n  by transfer simp\n\nlemma L_transform_formula_Pred [simp]: \"L_transform_formula (Pred f \\<phi>) = Formula.Act\\<^sub>\\<alpha> (Eff f) (Formula.Pred\\<^sub>\\<alpha> \\<phi>)\"\n  by transfer simp\n\nlemma L_transform_formula_Act [simp]: \"L_transform_formula (FL_Formula.Act f \\<alpha> x) = Formula.Act\\<^sub>\\<alpha> (Eff f) (Formula.Act\\<^sub>\\<alpha> (Act \\<alpha>) (L_transform_formula x))\"\n  by transfer simp\n\nlemma L_transform_formula_hereditarily_fs [simp]: \"Formula.hereditarily_fs (L_transform_formula x)\"\n  by transfer (fact L_transform_Tree\\<^sub>\\<alpha>_preserves_hereditarily_fs)\n\ntext \\<open>Finally, we define the proper $L$-transform, which returns formulas instead of trees.\\<close>\n\ndefinition L_transform :: \"('idx,'pred::fs,'act::bn,'eff::fs) formula \\<Rightarrow> ('idx, 'pred, ('act,'eff) L_action) Formula.formula\" where\n  \"L_transform x = Formula.Abs_formula (L_transform_formula x)\"\n\nlemma L_transform_eqvt [eqvt]: \"p \\<bullet> L_transform x = L_transform (p \\<bullet> x)\"\n  unfolding L_transform_def by simp\n\nlemma finite_supp_map_bset_L_transform [simp]:\n  assumes \"finite (supp xset)\"\n  shows \"finite (supp (map_bset L_transform xset))\"\nproof -\n  have \"eqvt map_bset\" and \"eqvt L_transform\"\n    by (simp add: eqvtI)+\n  then have \"supp (map_bset L_transform) = {}\"\n    using supp_fun_eqvt supp_fun_app_eqvt by blast\n  then have \"supp (map_bset L_transform xset) \\<subseteq> supp xset\"\n    using supp_fun_app by blast\n  with assms show \"finite (supp (map_bset L_transform xset))\"\n    by (metis finite_subset)\nqed\n\nlemma L_transform_Conj [simp]:\n  assumes \"finite (supp xset)\"\n  shows \"L_transform (Conj xset) = Formula.Conj (map_bset L_transform xset)\"\n  using assms unfolding L_transform_def by (simp add: Formula.Conj_def bset.map_comp o_def)\n\nlemma L_transform_Not [simp]: \"L_transform (Not x) = Formula.Not (L_transform x)\"\n  unfolding L_transform_def by (simp add: Formula.Not_def)\n\nlemma L_transform_Pred [simp]: \"L_transform (Pred f \\<phi>) = Formula.Act (Eff f) (Formula.Pred \\<phi>)\"\n  unfolding L_transform_def by (simp add: Formula.Act_def Formula.Pred_def Formula.hereditarily_fs.Pred\\<^sub>\\<alpha>)\n\nlemma L_transform_Act [simp]: \"L_transform (FL_Formula.Act f \\<alpha> x) = Formula.Act (Eff f) (Formula.Act (Act \\<alpha>) (L_transform x))\"\n  unfolding L_transform_def by (simp add: Formula.Act_def Formula.hereditarily_fs.Act\\<^sub>\\<alpha>)\n\ncontext effect_nominal_ts\nbegin\n\n  interpretation L_transform: nominal_ts \"(\\<turnstile>\\<^sub>L)\" \"(\\<rightarrow>\\<^sub>L)\"\n  by unfold_locales (fact L_satisfies_eqvt, fact L_transition_eqvt)\n\n  text \\<open>The $L$-transform preserves satisfaction of formulas in the following sense:\\<close>\n\n  theorem FL_valid_iff_valid_L_transform:\n    assumes \"(x::('idx,'pred,'act,'effect) formula) \\<in> \\<A>[F]\"\n    shows \"FL_valid P x \\<longleftrightarrow> L_transform.valid (EF (F, P)) (L_transform x)\"\n  using assms proof (induct x arbitrary: P)\n    case (Conj xset F)\n    then show ?case\n      by auto (metis imageE map_bset.rep_eq, simp add: map_bset.rep_eq)\n  next\n    case (Not F x)\n    then show ?case by simp\n  next\n    case (Pred f F \\<phi>)\n    let ?\\<phi> = \"Formula.Pred \\<phi> :: ('idx, 'pred, ('act,'effect) L_action) Formula.formula\"\n    show ?case\n    proof\n      assume \"FL_valid P (Pred f \\<phi>)\"\n      then have \"L_transform.valid (AC (f, F, \\<langle>f\\<rangle>P)) ?\\<phi>\"\n        by (simp add: L_transform.valid_Act)\n      moreover from \\<open>f \\<in>\\<^sub>f\\<^sub>s F\\<close> have \"EF (F, P) \\<rightarrow>\\<^sub>L \\<langle>Eff f, AC (f, F, \\<langle>f\\<rangle>P)\\<rangle>\"\n        by (metis L_transition.simps(2))\n      ultimately show \"L_transform.valid (EF (F, P)) (L_transform (Pred f \\<phi>))\"\n        using L_transform.valid_Act by fastforce\n    next\n      assume \"L_transform.valid (EF (F, P)) (L_transform (Pred f \\<phi>))\"\n      then obtain P' where trans: \"EF (F, P) \\<rightarrow>\\<^sub>L \\<langle>Eff f, P'\\<rangle>\" and valid: \"L_transform.valid P' ?\\<phi>\"\n        by simp (metis bn_L_action.simps(2) empty_iff fresh_star_def L_transform.valid_Act_fresh L_transform.valid_Pred L_transition.simps(2))\n      from trans have \"P' = AC (f, F, \\<langle>f\\<rangle>P)\"\n        by (simp add: residual_empty_bn_eq_iff)\n      with valid show \"FL_valid P (Pred f \\<phi>)\"\n        by simp\n    qed\n  next\n    case (Act f F \\<alpha> x)\n    show ?case\n    proof\n      assume \"FL_valid P (FL_Formula.Act f \\<alpha> x)\"\n      then obtain \\<alpha>' x' P' where eq: \"FL_Formula.Act f \\<alpha> x = FL_Formula.Act f \\<alpha>' x'\" and trans: \"\\<langle>f\\<rangle>P \\<rightarrow> \\<langle>\\<alpha>',P'\\<rangle>\" and valid: \"FL_valid P' x'\" and fresh: \"bn \\<alpha>' \\<sharp>* (F, f)\"\n        by (metis FL_valid_Act_strong finite_supp)\n      from eq obtain p where p_x: \"p \\<bullet> x = x'\" and p_\\<alpha>: \"p \\<bullet> \\<alpha> = \\<alpha>'\" and supp_p: \"supp p \\<subseteq> bn \\<alpha> \\<union> bn \\<alpha>'\"\n        by (metis bn_eqvt FL_Formula.Act_eq_iff_perm_renaming)\n      from \\<open>bn \\<alpha> \\<sharp>* (F, f)\\<close> and fresh have \"supp (F, f) \\<sharp>* p\"\n        using supp_p by (auto simp add: fresh_star_Pair fresh_star_def supp_Pair fresh_def)\n      then have \"p \\<bullet> F = F\" and \"p \\<bullet> f = f\"\n        using supp_perm_eq by fastforce+\n\n      from valid have \"FL_valid (-p \\<bullet> P') x\"\n        using p_x by (metis FL_valid_eqvt permute_minus_cancel(2))\n      then have \"L_transform.valid (EF (L (\\<alpha>, F, f), -p \\<bullet> P')) (L_transform x)\"\n        using Act.hyps(4) by metis\n      then have \"L_transform.valid (p \\<bullet> EF (L (\\<alpha>, F, f), -p \\<bullet> P')) (p \\<bullet> L_transform x)\"\n        by (fact L_transform.valid_eqvt)\n      then have \"L_transform.valid (EF (L (\\<alpha>', F, f), P')) (L_transform x')\"\n        using p_x and p_\\<alpha> and \\<open>p \\<bullet> F = F\\<close> and \\<open>p \\<bullet> f = f\\<close> by simp\n\n      then have \"L_transform.valid (AC (f, F, \\<langle>f\\<rangle>P)) (Formula.Act (Act \\<alpha>') (L_transform x'))\"\n        using trans fresh L_transform.valid_Act by fastforce\n      with \\<open>f \\<in>\\<^sub>f\\<^sub>s F\\<close> and eq show \"L_transform.valid (EF (F, P)) (L_transform (FL_Formula.Act f \\<alpha> x))\"\n        using L_transform.valid_Act by fastforce\n    next\n      assume *: \"L_transform.valid (EF (F, P)) (L_transform (FL_Formula.Act f \\<alpha> x))\"\n\n      \\<comment> \\<open>rename~@{term \"bn \\<alpha>\"} to avoid~@{term \"(F, f, P)\"}, without touching~@{term F} or~@{term \"FL_Formula.Act f \\<alpha> x\"}\\<close>\n      obtain p where 1: \"(p \\<bullet> bn \\<alpha>) \\<sharp>* (F, f, P)\" and 2: \"supp (F, FL_Formula.Act f \\<alpha> x) \\<sharp>* p\"\n      proof (rule at_set_avoiding2[of \"bn \\<alpha>\" \"(F, f, P)\" \"(F, FL_Formula.Act f \\<alpha> x)\", THEN exE])\n        show \"finite (bn \\<alpha>)\" by (fact bn_finite)\n      next\n        show \"finite (supp (F, f, P))\" by (fact finite_supp)\n      next\n        show \"finite (supp (F, FL_Formula.Act f \\<alpha> x))\" by (simp add: finite_supp)\n      next\n        from \\<open>bn \\<alpha> \\<sharp>* (F, f)\\<close> show \"bn \\<alpha> \\<sharp>* (F, FL_Formula.Act f \\<alpha> x)\"\n          by (simp add: fresh_star_Pair fresh_star_def fresh_def supp_Pair)\n      qed metis\n      from 2 have \"supp F \\<sharp>* p\" and Act_fresh: \"supp (FL_Formula.Act f \\<alpha> x) \\<sharp>* p\"\n        by (simp add: fresh_star_Pair fresh_star_def supp_Pair)+\n      from \\<open>supp F \\<sharp>* p\\<close> have \"p \\<bullet> F = F\"\n        by (metis supp_perm_eq)\n      from Act_fresh have \"p \\<bullet> f = f\"\n        using fresh_star_Un supp_perm_eq by fastforce\n      from Act_fresh have eq: \"FL_Formula.Act f \\<alpha> x = FL_Formula.Act f (p \\<bullet> \\<alpha>) (p \\<bullet> x)\"\n        by (metis FL_Formula.Act_eq_iff_perm FL_Formula.Act_eqvt supp_perm_eq)\n\n      with * obtain P' where trans: \"EF (F, P) \\<rightarrow>\\<^sub>L \\<langle>Eff f,P'\\<rangle>\" and valid: \"L_transform.valid P' (Formula.Act (Act (p \\<bullet> \\<alpha>)) (L_transform (p \\<bullet> x)))\"\n        using L_transform_Act by (metis L_transform.valid_Act_fresh bn_L_action.simps(2) empty_iff fresh_star_def)\n      from trans have P': \"P' = AC (f, F, \\<langle>f\\<rangle>P)\"\n        by (simp add: residual_empty_bn_eq_iff)\n\n      have supp_f_P: \"supp (\\<langle>f\\<rangle>P) \\<subseteq> supp f \\<union> supp P\"\n        using effect_apply_eqvt supp_fun_app supp_fun_app_eqvt by fastforce\n      with 1 have \"bn (Act (p \\<bullet> \\<alpha>)) \\<sharp>* AC (f, F, \\<langle>f\\<rangle>P)\"\n        by (auto simp add: bn_eqvt fresh_star_def fresh_def supp_Pair)\n      with valid obtain P'' where trans': \"AC (f, F, \\<langle>f\\<rangle>P) \\<rightarrow>\\<^sub>L \\<langle>Act (p \\<bullet> \\<alpha>),P''\\<rangle>\" and valid': \"L_transform.valid P'' (L_transform (p \\<bullet> x))\"\n        using P' by (metis L_transform.valid_Act_fresh)\n\n      from supp_f_P and 1 have \"bn (p \\<bullet> \\<alpha>) \\<sharp>* (F, f, \\<langle>f\\<rangle>P)\"\n        by (auto simp add: bn_eqvt fresh_star_def fresh_def supp_Pair)\n      with trans' obtain P' where P'': \"P'' = EF (L (p \\<bullet> \\<alpha>, F, f), P')\" and trans'': \"\\<langle>f\\<rangle>P \\<rightarrow> \\<langle>p \\<bullet> \\<alpha>,P'\\<rangle>\"\n        by (metis L_transition_AC_fresh)\n\n      from valid' have \"L_transform.valid (-p \\<bullet> P'') (L_transform x)\"\n        by (metis (mono_tags) L_transform.valid_eqvt L_transform_eqvt permute_minus_cancel(2))\n      with P'' \\<open>p \\<bullet> F = F\\<close> \\<open>p \\<bullet> f = f\\<close> have \"L_transform.valid (EF (L (\\<alpha>, F, f), - p \\<bullet> P')) (L_transform x)\"\n        by simp (metis pemute_minus_self permute_minus_cancel(1))\n      then have \"FL_valid P' (p \\<bullet> x)\"\n        using Act.hyps(4) by (metis FL_valid_eqvt permute_minus_cancel(1))\n\n      with trans'' and eq show \"FL_valid P (FL_Formula.Act f \\<alpha> x)\"\n        by (metis FL_valid_Act)\n    qed\n  qed\n\nend\n\n\nsubsection \\<open>Bisimilarity in the \\texorpdfstring{$L$}{L}-transform\\<close>\n\ncontext effect_nominal_ts\nbegin\n\n  (* Not quite sure why this is needed again? *)\n  interpretation L_transform: nominal_ts \"(\\<turnstile>\\<^sub>L)\" \"(\\<rightarrow>\\<^sub>L)\"\n  by unfold_locales (fact L_satisfies_eqvt, fact L_transition_eqvt)\n\n  notation L_transform.bisimilar (infix \"\\<sim>\\<cdot>\\<^sub>L\" 100)\n\n  text \\<open>$F/L$-bisimilarity is equivalent to bisimilarity in the $L$-transform.\\<close>\n\n  inductive L_bisimilar :: \"('state,'effect) L_state \\<Rightarrow> ('state,'effect) L_state \\<Rightarrow> bool\" where\n    \"P \\<sim>\\<cdot>[F] Q \\<Longrightarrow> L_bisimilar (EF (F,P)) (EF (F,Q))\"\n  | \"P \\<sim>\\<cdot>[F] Q \\<Longrightarrow> f \\<in>\\<^sub>f\\<^sub>s F \\<Longrightarrow> L_bisimilar (AC (f, F, \\<langle>f\\<rangle>P)) (AC (f, F, \\<langle>f\\<rangle>Q))\"\n\n  lemma L_bisimilar_is_L_transform_bisimulation: \"L_transform.is_bisimulation L_bisimilar\"\n  unfolding L_transform.is_bisimulation_def\n  proof\n    show \"symp L_bisimilar\"\n      by (metis FL_bisimilar_symp L_bisimilar.cases L_bisimilar.intros symp_def)\n  next\n    have \"\\<forall>P\\<^sub>L Q\\<^sub>L. L_bisimilar P\\<^sub>L Q\\<^sub>L \\<longrightarrow> (\\<forall>\\<phi>. P\\<^sub>L \\<turnstile>\\<^sub>L \\<phi> \\<longrightarrow> Q\\<^sub>L \\<turnstile>\\<^sub>L \\<phi>)\" (is ?S)\n      using FL_bisimilar_is_L_bisimulation L_bisimilar.simps is_L_bisimulation_def by auto\n    moreover have \"\\<forall>P\\<^sub>L Q\\<^sub>L. L_bisimilar P\\<^sub>L Q\\<^sub>L \\<longrightarrow> (\\<forall>\\<alpha>\\<^sub>L P\\<^sub>L'. bn \\<alpha>\\<^sub>L \\<sharp>* Q\\<^sub>L \\<longrightarrow> P\\<^sub>L \\<rightarrow>\\<^sub>L \\<langle>\\<alpha>\\<^sub>L,P\\<^sub>L'\\<rangle> \\<longrightarrow> (\\<exists>Q\\<^sub>L'. Q\\<^sub>L \\<rightarrow>\\<^sub>L \\<langle>\\<alpha>\\<^sub>L,Q\\<^sub>L'\\<rangle> \\<and> L_bisimilar P\\<^sub>L' Q\\<^sub>L'))\" (is ?T)\n      proof (clarify)\n        fix P\\<^sub>L Q\\<^sub>L \\<alpha>\\<^sub>L P\\<^sub>L'\n        assume L_bisim: \"L_bisimilar P\\<^sub>L Q\\<^sub>L\" and fresh\\<^sub>L: \"bn \\<alpha>\\<^sub>L \\<sharp>* Q\\<^sub>L\" and trans\\<^sub>L: \"P\\<^sub>L \\<rightarrow>\\<^sub>L \\<langle>\\<alpha>\\<^sub>L,P\\<^sub>L'\\<rangle>\"\n        obtain Q\\<^sub>L' where \"Q\\<^sub>L \\<rightarrow>\\<^sub>L \\<langle>\\<alpha>\\<^sub>L,Q\\<^sub>L'\\<rangle>\" and \"L_bisimilar P\\<^sub>L' Q\\<^sub>L'\"\n          using L_bisim proof (rule L_bisimilar.cases)\n            fix P F Q\n            assume P\\<^sub>L: \"P\\<^sub>L = EF (F, P)\" and Q\\<^sub>L: \"Q\\<^sub>L = EF (F, Q)\" and bisim: \"P \\<sim>\\<cdot>[F] Q\"\n            from P\\<^sub>L and trans\\<^sub>L obtain f where effect: \"f \\<in>\\<^sub>f\\<^sub>s F\" and \\<alpha>\\<^sub>LP\\<^sub>L': \"\\<langle>\\<alpha>\\<^sub>L,P\\<^sub>L'\\<rangle> = \\<langle>Eff f, AC (f, F, \\<langle>f\\<rangle>P)\\<rangle>\"\n              using L_transition.simps(2) by blast\n            from Q\\<^sub>L and effect have \"Q\\<^sub>L \\<rightarrow>\\<^sub>L \\<langle>Eff f, AC (f, F, \\<langle>f\\<rangle>Q)\\<rangle>\"\n              using L_transition.simps(2) by blast\n            moreover from bisim and effect have \"L_bisimilar (AC (f, F, \\<langle>f\\<rangle>P)) (AC (f, F, \\<langle>f\\<rangle>Q))\"\n              using L_bisimilar.intros(2) by blast\n            moreover from \\<alpha>\\<^sub>LP\\<^sub>L' have \"\\<alpha>\\<^sub>L = Eff f\" and \"P\\<^sub>L' = AC (f, F, \\<langle>f\\<rangle>P)\"\n              by (metis bn_L_action.simps(2) residual_empty_bn_eq_iff)+\n            ultimately show \"thesis\"\n              using \\<open>\\<And>Q\\<^sub>L'. Q\\<^sub>L \\<rightarrow>\\<^sub>L \\<langle>\\<alpha>\\<^sub>L,Q\\<^sub>L'\\<rangle> \\<Longrightarrow> L_bisimilar P\\<^sub>L' Q\\<^sub>L' \\<Longrightarrow> thesis\\<close> by blast\n          next\n            fix P F Q f\n            assume P\\<^sub>L: \"P\\<^sub>L = AC (f, F, \\<langle>f\\<rangle>P)\" and Q\\<^sub>L: \"Q\\<^sub>L = AC (f, F, \\<langle>f\\<rangle>Q)\" and bisim: \"P \\<sim>\\<cdot>[F] Q\" and effect: \"f \\<in>\\<^sub>f\\<^sub>s F\"\n            have \"finite (supp (\\<langle>f\\<rangle>Q, F, f))\"\n              by (fact finite_supp)\n            with P\\<^sub>L and trans\\<^sub>L obtain \\<alpha> P' where trans_P: \"\\<langle>f\\<rangle>P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle>\" and \\<alpha>\\<^sub>LP\\<^sub>L': \"\\<langle>\\<alpha>\\<^sub>L,P\\<^sub>L'\\<rangle> = \\<langle>Act \\<alpha>, EF (L (\\<alpha>,F,f), P')\\<rangle>\" and fresh: \"bn \\<alpha> \\<sharp>* (\\<langle>f\\<rangle>Q, F, f)\"\n              by (metis L_transition_AC_strong)\n            from bisim and effect and fresh and trans_P obtain Q' where trans_Q: \"\\<langle>f\\<rangle>Q \\<rightarrow> \\<langle>\\<alpha>,Q'\\<rangle>\" and bisim': \"P' \\<sim>\\<cdot>[L (\\<alpha>,F,f)] Q'\"\n              by (metis FL_bisimilar_simulation_step)\n            from fresh have \"bn \\<alpha> \\<sharp>* (F, f)\"\n              by (meson fresh_PairD(2) fresh_star_def)\n            with Q\\<^sub>L and trans_Q have trans_Q\\<^sub>L: \"Q\\<^sub>L \\<rightarrow>\\<^sub>L \\<langle>Act \\<alpha>, EF (L (\\<alpha>,F,f), Q')\\<rangle>\"\n              by (metis L_transition.simps(1))\n\n            from \\<alpha>\\<^sub>LP\\<^sub>L' obtain p where p: \"(\\<alpha>\\<^sub>L,P\\<^sub>L') = p \\<bullet> (Act \\<alpha>, EF (L (\\<alpha>,F,f), P'))\" and supp_p: \"supp p \\<subseteq> bn \\<alpha> \\<union> bn \\<alpha>\\<^sub>L\"\n              by (metis (no_types, lifting) bn_L_action.simps(1) residual_eq_iff_perm_renaming)\n            from supp_p and fresh and fresh\\<^sub>L and Q\\<^sub>L have \"supp p \\<sharp>* (\\<langle>f\\<rangle>Q, F, f)\"\n              unfolding fresh_star_def by (metis (no_types, hide_lams) Un_iff fresh_Pair fresh_def subsetCE supp_AC)\n            then have p_fQ: \"p \\<bullet> \\<langle>f\\<rangle>Q = \\<langle>f\\<rangle>Q\" and p_Ff: \"p \\<bullet> (F,f) = (F,f)\"\n              by (simp add: fresh_star_def perm_supp_eq)+\n            from p and p_Ff have \"\\<alpha>\\<^sub>L = Act (p \\<bullet> \\<alpha>)\" and \"P\\<^sub>L' = EF (L (p \\<bullet> \\<alpha>, F, f), p \\<bullet> P')\"\n              by auto\n\n            moreover from Q\\<^sub>L and p_fQ and p_Ff have \"p \\<bullet> Q\\<^sub>L = Q\\<^sub>L\"\n              by simp\n            with trans_Q\\<^sub>L have \"Q\\<^sub>L \\<rightarrow>\\<^sub>L p \\<bullet> \\<langle>Act \\<alpha>, EF (L (\\<alpha>,F,f), Q')\\<rangle>\"\n              by (metis L_transform.transition_eqvt)\n            then have \"Q\\<^sub>L \\<rightarrow>\\<^sub>L \\<langle>Act (p \\<bullet> \\<alpha>), EF (L (p \\<bullet> \\<alpha>, F, f), p \\<bullet> Q')\\<rangle>\"\n              using p_Ff by simp\n\n            moreover from p_Ff have \"p \\<bullet> F = F\" and \"p \\<bullet> f = f\"\n              by simp+\n            with bisim' have \"(p \\<bullet> P') \\<sim>\\<cdot>[L (p \\<bullet> \\<alpha>, F, f)] (p \\<bullet> Q')\"\n              by (metis FL_bisimilar_eqvt L_eqvt')\n            then have \"L_bisimilar (EF (L (p \\<bullet> \\<alpha>, F, f), p \\<bullet> P')) (EF (L (p \\<bullet> \\<alpha>, F, f), p \\<bullet> Q'))\"\n              by (metis L_bisimilar.intros(1))\n\n            ultimately show thesis\n                using \\<open>\\<And>Q\\<^sub>L'. Q\\<^sub>L \\<rightarrow>\\<^sub>L \\<langle>\\<alpha>\\<^sub>L,Q\\<^sub>L'\\<rangle> \\<Longrightarrow> L_bisimilar P\\<^sub>L' Q\\<^sub>L' \\<Longrightarrow> thesis\\<close> by blast\n          qed\n        then show \"\\<exists>Q\\<^sub>L'. Q\\<^sub>L \\<rightarrow>\\<^sub>L \\<langle>\\<alpha>\\<^sub>L,Q\\<^sub>L'\\<rangle> \\<and> L_bisimilar P\\<^sub>L' Q\\<^sub>L'\"\n          by auto\n      qed\n    ultimately show \"?S \\<and> ?T\"\n      by metis\n  qed\n\n  definition invL_FL_bisimilar :: \"'effect first \\<Rightarrow> 'state \\<Rightarrow> 'state \\<Rightarrow> bool\" where\n    \"invL_FL_bisimilar F P Q \\<equiv> EF (F,P) \\<sim>\\<cdot>\\<^sub>L EF(F,Q)\"\n\n  lemma invL_FL_bisimilar_is_L_bisimulation: \"is_L_bisimulation invL_FL_bisimilar\"\n  unfolding is_L_bisimulation_def\n  proof\n    fix F\n    have \"symp (invL_FL_bisimilar F)\" (is ?R)\n      by (metis L_transform.bisimilar_symp invL_FL_bisimilar_def symp_def)\n    moreover have \"\\<forall>P Q. invL_FL_bisimilar F P Q \\<longrightarrow> (\\<forall>f. f \\<in>\\<^sub>f\\<^sub>s F \\<longrightarrow> (\\<forall>\\<phi>. \\<langle>f\\<rangle>P \\<turnstile> \\<phi> \\<longrightarrow> \\<langle>f\\<rangle>Q \\<turnstile> \\<phi>))\" (is ?S)\n      proof (clarify)\n        fix P Q f \\<phi>\n        assume bisim: \"invL_FL_bisimilar F P Q\" and effect: \"f \\<in>\\<^sub>f\\<^sub>s F\" and satisfies: \"\\<langle>f\\<rangle>P \\<turnstile> \\<phi>\"\n        from bisim have \"EF (F,P) \\<sim>\\<cdot>\\<^sub>L EF (F,Q)\"\n          by (metis invL_FL_bisimilar_def)\n        moreover have \"bn (Eff f) \\<sharp>* EF (F,Q)\"\n          by (simp add: fresh_star_def)\n        moreover from effect have \"EF (F,P) \\<rightarrow>\\<^sub>L \\<langle>Eff f, AC (f, F, \\<langle>f\\<rangle>P)\\<rangle>\"\n          by (metis L_transition.simps(2))\n        ultimately obtain Q\\<^sub>L' where trans: \"EF (F,Q) \\<rightarrow>\\<^sub>L \\<langle>Eff f, Q\\<^sub>L'\\<rangle>\" and L_bisim: \"AC (f, F, \\<langle>f\\<rangle>P) \\<sim>\\<cdot>\\<^sub>L Q\\<^sub>L'\"\n          by (metis L_transform.bisimilar_simulation_step)\n        from trans obtain f' where \"\\<langle>Eff f :: ('act,'effect) L_action, Q\\<^sub>L'\\<rangle> = \\<langle>Eff f', AC (f', F, \\<langle>f'\\<rangle>Q)\\<rangle>\"\n          by (metis L_transition.simps(2))\n        then have Q\\<^sub>L': \"Q\\<^sub>L' = AC (f, F, \\<langle>f\\<rangle>Q)\"\n          by (metis L_action.inject(2) bn_L_action.simps(2) residual_empty_bn_eq_iff)\n\n        from satisfies have \"AC (f, F, \\<langle>f\\<rangle>P) \\<turnstile>\\<^sub>L \\<phi>\"\n          by (metis L_satisfies.simps(1))\n        with L_bisim and Q\\<^sub>L' have \"AC (f, F, \\<langle>f\\<rangle>Q) \\<turnstile>\\<^sub>L \\<phi>\"\n          by (metis L_transform.bisimilar_is_bisimulation L_transform.is_bisimulation_def)\n        then show \"\\<langle>f\\<rangle>Q \\<turnstile> \\<phi>\"\n          by (metis L_satisfies.simps(1))\n      qed\n    moreover have \"\\<forall>P Q. invL_FL_bisimilar F P Q \\<longrightarrow> (\\<forall>f. f \\<in>\\<^sub>f\\<^sub>s F \\<longrightarrow> (\\<forall>\\<alpha> P'. bn \\<alpha> \\<sharp>* (\\<langle>f\\<rangle>Q, F, f) \\<longrightarrow>\n        \\<langle>f\\<rangle>P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle> \\<longrightarrow> (\\<exists>Q'. \\<langle>f\\<rangle>Q \\<rightarrow> \\<langle>\\<alpha>,Q'\\<rangle> \\<and> invL_FL_bisimilar (L (\\<alpha>, F, f)) P' Q')))\" (is ?T)\n      proof (clarify)\n        fix P Q f \\<alpha> P'\n        assume bisim: \"invL_FL_bisimilar F P Q\" and effect: \"f \\<in>\\<^sub>f\\<^sub>s F\" and fresh: \"bn \\<alpha> \\<sharp>* (\\<langle>f\\<rangle>Q, F, f)\" and trans: \"\\<langle>f\\<rangle>P \\<rightarrow> \\<langle>\\<alpha>,P'\\<rangle>\"\n        from bisim have \"EF (F,P) \\<sim>\\<cdot>\\<^sub>L EF (F,Q)\"\n          by (metis invL_FL_bisimilar_def)\n        moreover have \"bn (Eff f) \\<sharp>* EF (F,Q)\"\n          by (simp add: fresh_star_def)\n        moreover from effect have \"EF (F,P) \\<rightarrow>\\<^sub>L \\<langle>Eff f, AC (f, F, \\<langle>f\\<rangle>P)\\<rangle>\"\n          by (metis L_transition.simps(2))\n        ultimately obtain Q\\<^sub>L' where trans\\<^sub>L: \"EF (F,Q) \\<rightarrow>\\<^sub>L \\<langle>Eff f, Q\\<^sub>L'\\<rangle>\" and L_bisim: \"AC (f, F, \\<langle>f\\<rangle>P) \\<sim>\\<cdot>\\<^sub>L Q\\<^sub>L'\"\n          by (metis L_transform.bisimilar_simulation_step)\n        from trans\\<^sub>L obtain f' where \"\\<langle>Eff f :: ('act,'effect) L_action, Q\\<^sub>L'\\<rangle> = \\<langle>Eff f', AC (f', F, \\<langle>f'\\<rangle>Q)\\<rangle>\"\n          by (metis L_transition.simps(2))\n        then have Q\\<^sub>L': \"Q\\<^sub>L' = AC (f, F, \\<langle>f\\<rangle>Q)\"\n          by (metis L_action.inject(2) bn_L_action.simps(2) residual_empty_bn_eq_iff)\n\n        from L_bisim and Q\\<^sub>L' have \"AC (f, F, \\<langle>f\\<rangle>P) \\<sim>\\<cdot>\\<^sub>L AC (f, F, \\<langle>f\\<rangle>Q)\"\n          by metis\n        moreover from fresh have \"bn (Act \\<alpha>) \\<sharp>* AC (f, F, \\<langle>f\\<rangle>Q)\"\n          by (simp add: fresh_def fresh_star_def supp_Pair)\n        moreover from fresh have \"bn \\<alpha> \\<sharp>* (F, f)\"\n          by (simp add: fresh_star_Pair)\n        with trans have \"AC (f, F, \\<langle>f\\<rangle>P) \\<rightarrow>\\<^sub>L \\<langle>Act \\<alpha>, EF (L (\\<alpha>,F,f), P')\\<rangle>\"\n          by (metis L_transition.simps(1))\n        ultimately obtain Q\\<^sub>L'' where trans\\<^sub>L': \"AC (f, F, \\<langle>f\\<rangle>Q) \\<rightarrow>\\<^sub>L \\<langle>Act \\<alpha>, Q\\<^sub>L''\\<rangle>\" and L_bisim': \"EF (L (\\<alpha>,F,f), P') \\<sim>\\<cdot>\\<^sub>L Q\\<^sub>L''\"\n          by (metis L_transform.bisimilar_simulation_step)\n\n        have \"finite (supp (\\<langle>f\\<rangle>Q, F, f))\"\n          by (fact finite_supp)\n        with trans\\<^sub>L' obtain \\<alpha>' Q' where trans': \"\\<langle>f\\<rangle>Q \\<rightarrow> \\<langle>\\<alpha>',Q'\\<rangle>\" and alpha: \"\\<langle>Act \\<alpha> :: ('act,'effect) L_action, Q\\<^sub>L''\\<rangle> = \\<langle>Act \\<alpha>', EF (L (\\<alpha>',F,f), Q')\\<rangle>\" and fresh': \"bn \\<alpha>' \\<sharp>* (\\<langle>f\\<rangle>Q, F,f)\"\n          by (metis L_transition_AC_strong)\n\n        from alpha obtain p where p: \"(Act \\<alpha> :: ('act,'effect) L_action, Q\\<^sub>L'') = p \\<bullet> (Act \\<alpha>', EF (L (\\<alpha>',F,f), Q'))\" and supp_p: \"supp p \\<subseteq> bn \\<alpha> \\<union> bn \\<alpha>'\"\n          by (metis Un_commute bn_L_action.simps(1) residual_eq_iff_perm_renaming)\n        from supp_p and fresh and fresh' have \"supp p \\<sharp>* (\\<langle>f\\<rangle>Q, F,f)\"\n          unfolding fresh_star_def by (metis (no_types, hide_lams) Un_iff subsetCE)\n        then have p_fQ: \"p \\<bullet> \\<langle>f\\<rangle>Q = \\<langle>f\\<rangle>Q\" and p_F: \"p \\<bullet> F = F\" and p_f: \"p \\<bullet> f = f\"\n          by (simp add: fresh_star_def perm_supp_eq)+\n        from p and p_F and p_f have p_\\<alpha>': \"p \\<bullet> \\<alpha>' = \\<alpha>\" and Q\\<^sub>L'': \"Q\\<^sub>L'' = EF (L (p \\<bullet> \\<alpha>', F, f), p \\<bullet> Q')\"\n          by auto\n\n        from trans' and p_fQ and p_\\<alpha>' have \"\\<langle>f\\<rangle>Q \\<rightarrow> \\<langle>\\<alpha>, p \\<bullet> Q'\\<rangle>\"\n          by (metis transition_eqvt')\n        moreover from L_bisim' and Q\\<^sub>L'' and p_\\<alpha>' have \"invL_FL_bisimilar (L (\\<alpha>,F,f)) P' (p \\<bullet> Q')\"\n          by (metis invL_FL_bisimilar_def)\n        ultimately show \"\\<exists>Q'. \\<langle>f\\<rangle>Q \\<rightarrow> \\<langle>\\<alpha>,Q'\\<rangle> \\<and> invL_FL_bisimilar (L (\\<alpha>,F,f)) P' Q'\"\n          by metis\n      qed\n    ultimately show \"?R \\<and> ?S \\<and> ?T\"\n      by metis\n  qed\n\n  theorem \"P \\<sim>\\<cdot>[F] Q \\<longleftrightarrow> EF (F,P) \\<sim>\\<cdot>\\<^sub>L EF(F,Q)\"\n  proof\n    assume \"P \\<sim>\\<cdot>[F] Q\"\n    then have \"L_bisimilar (EF (F,P)) (EF (F,Q))\"\n        by (metis L_bisimilar.intros(1))\n    then show \"EF (F,P) \\<sim>\\<cdot>\\<^sub>L EF(F,Q)\"\n      by (metis L_bisimilar_is_L_transform_bisimulation L_transform.bisimilar_def)\n  next\n    assume \"EF (F, P) \\<sim>\\<cdot>\\<^sub>L EF (F, Q)\"\n    then have \"invL_FL_bisimilar F P Q\"\n      by (metis invL_FL_bisimilar_def)\n    then show \"P \\<sim>\\<cdot>[F] Q\"\n      by (metis invL_FL_bisimilar_is_L_bisimulation FL_bisimilar_def)\n  qed\n\nend\n\ntext \\<open>The following (alternative) proof of the ``$\\leftarrow$'' direction of this equivalence,\nnamely that bisimilarity in the $L$-transform implies $F/L$-bisimilarity, uses the fact that the\n$L$-transform preserves satisfaction of formulas, together with the fact that bisimilarity (in the\n$L$-transform) implies logical equivalence. However, since we proved the latter in the context of\nindexed nominal transition systems, this proof requires an indexed nominal transition system with\neffects where, additionally, the cardinality of the state set of the $L$-transform is bounded. We\ncould re-organize our formalization to remove this assumption: the proof of\n@{thm indexed_nominal_ts.bisimilarity_implies_equivalence} does not actually make use of the\ncardinality assumptions provided by indexed nominal transition systems.\\<close>\n\nlocale L_transform_indexed_effect_nominal_ts = indexed_effect_nominal_ts L satisfies transition effect_apply\n  for L :: \"('act::bn) \\<times> ('effect::fs) fs_set \\<times> 'effect \\<Rightarrow> 'effect fs_set\" \n  and satisfies :: \"'state::fs \\<Rightarrow> 'pred::fs \\<Rightarrow> bool\" (infix \"\\<turnstile>\" 70)\n  and transition :: \"'state \\<Rightarrow> ('act,'state) residual \\<Rightarrow> bool\" (infix \"\\<rightarrow>\" 70)\n  and effect_apply :: \"'effect \\<Rightarrow> 'state \\<Rightarrow> 'state\" (\"\\<langle>_\\<rangle>_\" [0,101] 100) +\n  assumes card_idx_L_transform_state: \"|UNIV::('state, 'effect) L_state set| <o |UNIV::'idx set|\"\nbegin\n\n  interpretation L_transform: indexed_nominal_ts \"(\\<turnstile>\\<^sub>L)\" \"(\\<rightarrow>\\<^sub>L)\"\n    by unfold_locales (fact L_satisfies_eqvt, fact L_transition_eqvt, fact card_idx_perm, fact card_idx_L_transform_state)\n\n  notation L_transform.bisimilar (infix \"\\<sim>\\<cdot>\\<^sub>L\" 100)\n\n  theorem \"EF (F,P) \\<sim>\\<cdot>\\<^sub>L EF(F,Q) \\<longrightarrow> P \\<sim>\\<cdot>[F] Q\"\n  proof\n    assume \"EF (F, P) \\<sim>\\<cdot>\\<^sub>L EF (F, Q)\"\n    then have \"L_transform.logically_equivalent (EF (F, P)) (EF (F, Q))\"\n      by (fact L_transform.bisimilarity_implies_equivalence)\n    with FL_valid_iff_valid_L_transform have \"FL_logically_equivalent F P Q\"\n      using FL_logically_equivalent_def L_transform.logically_equivalent_def by blast\n    then show \"P \\<sim>\\<cdot>[F] Q\"\n      by (fact FL_equivalence_implies_bisimilarity)\n  qed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Modal_Logics_for_NTS/L_Transform.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3112532314034199}}
{"text": "theory RRLoopThree\n(* Third instance of the RRLoop: here we add the type label_fun\n   to the model to avoid the attack that Eve can change labels using eval *)\n  imports hcKripkeTwo\nbegin\n(*\ndatatype action = get | move | eval |put\ntypedecl actor \ntype_synonym identity = string\nconsts Actor :: \"string => actor\"\ntype_synonym policy = \"((actor => bool) * action set)\"\n\ndefinition ID :: \"[actor, string] \\<Rightarrow> bool\"\nwhere \"ID a s \\<equiv> (a = Actor s)\"\n\ndatatype location = Location nat\n*)\n\ntype_synonym data = string\n  (* Inspired by Myers DLM mode: first is the owner of a data item, second is the\n     set of all actors that may access the data item *)\ntype_synonym dlm = \"actor * actor set\"\n  (* the following type constructors are from Hoare_logic:\n     bexp and assn are just synonyms for set, and\n     com is a simple datatype repesenting while command language\n     over some basic 'a \\<Rightarrow> 'a functions, while 'a sem is\n     just the type of relations 'a \\<Rightarrow> 'a \\<Rightarrow> bool representing relational\n     semantics *)\ntype_synonym acond = \"(dlm * data) set\"\n(* \ntype_synonym aassn = \"(dlm * data) assn\"\ntype_synonym acom = \"(dlm * data) com\"\ntype_synonym asem = \"(dlm * data) sem\"\n*)\ndatatype igraph = Lgraph \"(location * location)set\" \"location \\<Rightarrow> identity set\"\n                         \"actor \\<Rightarrow> (string set * string set)\"  \"location \\<Rightarrow> acond\"\ndatatype infrastructure = \n         Infrastructure \"igraph\" \n                        \"[igraph ,location] \\<Rightarrow> policy set\" \nprimrec loc :: \"location \\<Rightarrow> nat\"\nwhere  \"loc(Location n) = n\"\nprimrec gra :: \"igraph \\<Rightarrow> (location * location)set\"\nwhere  \"gra(Lgraph g a c l) = g\"\nprimrec agra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> identity set)\"\nwhere  \"agra(Lgraph g a c l) = a\"\nprimrec cgra :: \"igraph \\<Rightarrow> (actor \\<Rightarrow> string set * string set)\"\nwhere  \"cgra(Lgraph g a c l) = c\"\nprimrec lgra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> acond)\"\nwhere  \"lgra(Lgraph g a c l) = l\"\n\ndefinition nodes :: \"igraph \\<Rightarrow> location set\" \nwhere \"nodes g == { x. (? y. ((x,y): gra g) | ((y,x): gra g))}\"\n\ndefinition actors_graph :: \"igraph \\<Rightarrow> identity set\"  \nwhere  \"actors_graph g == {x. ? y. y : nodes g \\<and> x \\<in> (agra g y)}\"\n\nprimrec graphI :: \"infrastructure \\<Rightarrow> igraph\"\nwhere \"graphI (Infrastructure g d) = g\"\nprimrec delta :: \"[infrastructure, igraph, location] \\<Rightarrow> policy set\"\nwhere \"delta (Infrastructure g d) = d\"\nprimrec tspace :: \"[infrastructure, actor ] \\<Rightarrow> string set * string set\"\n  where \"tspace (Infrastructure g d) = cgra g\"\nprimrec lspace :: \"[infrastructure, location ] \\<Rightarrow> acond\"\nwhere \"lspace (Infrastructure g d) = lgra g\"\ndefinition credentials :: \"string set * string set \\<Rightarrow> string set\"\n  where  \"credentials lxl \\<equiv> (fst lxl)\"\ndefinition has :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"has G ac \\<equiv> snd ac \\<in> credentials(cgra G (fst ac))\"\ndefinition roles :: \"string set * string set \\<Rightarrow> string set\"\n  where  \"roles lxl \\<equiv> (snd lxl)\"\ndefinition role :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"role G ac \\<equiv> snd ac \\<in> roles(cgra G (fst ac))\"\n\ndefinition owner :: \"dlm * data \\<Rightarrow> actor\" where \"owner d \\<equiv> fst(fst d)\"\n    \ndefinition owns :: \"[igraph, location, actor, dlm * data] \\<Rightarrow> bool\"    \n  where \"owns G l a d \\<equiv> owner d = a\"\n    \ndefinition readers :: \"dlm * data \\<Rightarrow> actor set\"\n  where \"readers d \\<equiv> snd (fst d)\"\n\ndefinition has_access :: \"[igraph, location, actor, dlm * data] \\<Rightarrow> bool\"    \nwhere \"has_access G l a d \\<equiv> owns G l a d \\<or> a \\<in> readers d\"\n  \ndefinition actor_can_delete ::   \"[infrastructure, actor, location] \\<Rightarrow> bool\"\nwhere actor_can_delete_def: \"actor_can_delete I h l \\<equiv>  \n                   (\\<forall> as n. ((h, as), n) \\<notin> (lgra (graphI I) l))\"\n        \n\ndefinition atI :: \"[identity, igraph, location] \\<Rightarrow> bool\" (\"_ @\\<^bsub>(_)\\<^esub> _\" 50)\nwhere \"a @\\<^bsub>G\\<^esub> l \\<equiv> a \\<in> (agra G l)\"\n\ndefinition enables :: \"[infrastructure, location, actor, action] \\<Rightarrow> bool\"\nwhere\n\"enables I l a a' \\<equiv>  (\\<exists> (p,e) \\<in> delta I (graphI I) l. a' \\<in> e \\<and> p a)\"\n\ndefinition move_graph_a :: \"[identity, location, location, igraph] \\<Rightarrow> igraph\"\nwhere \"move_graph_a n l l' g \\<equiv> Lgraph (gra g) \n                    (if n \\<in> ((agra g) l) &  n \\<notin> ((agra g) l') then \n                     ((agra g)(l := (agra g l) - {n}))(l' := (insert n (agra g l')))\n                     else (agra g))(cgra g)(lgra g)\"\n\n\n(* type of functions that preserves the security labeling *)    \ntypedef label_fun = \"{f :: dlm * data \\<Rightarrow> dlm * data. \n                        \\<forall> x:: dlm * data. fst x = fst (f x)}\"  \nproof (auto)\n  show \"\\<exists>x::(actor \\<times> actor set) \\<times> string \\<Rightarrow> (actor \\<times> actor set) \\<times> string.\n       \\<forall>(a::actor) (b::actor set) ba::string. (a, b) = fst (x ((a, b), ba))\"\n  by (rule_tac x = id in exI, simp)\nqed\n\ndefinition secure_process :: \"label_fun \\<Rightarrow> dlm * data \\<Rightarrow> dlm * data\" (\"_ \\<Updown> _\" 50)\n  where \"f  \\<Updown> d \\<equiv> (Rep_label_fun f) d\" \n\n(* from the earlier use of Hoare triples - now obsolete \ndefinition valid_proc :: \"acond \\<Rightarrow> label_fun \\<Rightarrow> acond \\<Rightarrow> bool\"    \n  where \"valid_proc a f b \\<equiv> Valid a (Basic (Rep_label_fun f)) b\"\n*)\n\nlemma move_graph_eq: \"move_graph_a a l l g = g\"  \nproof (simp add: move_graph_a_def, case_tac g, force)\nqed\n\ninductive state_transition_in :: \"[infrastructure, infrastructure] \\<Rightarrow> bool\" (\"(_ \\<rightarrow>\\<^sub>n _)\" 50)\nwhere\n  move: \"\\<lbrakk> G = graphI I; h @\\<^bsub>G\\<^esub> l; l \\<in> nodes G; l' \\<in> nodes G;\n          h \\<in> actors_graph(graphI I); enables I l' (Actor h) move;\n         I' = Infrastructure (move_graph_a h l l' (graphI I))(delta I) \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\" \n| get_data : \"G = graphI I \\<Longrightarrow> h @\\<^bsub>G\\<^esub> l \\<Longrightarrow> l \\<in> nodes G \\<Longrightarrow> l' \\<in> nodes G \\<Longrightarrow> \n        enables I l (Actor h) get \\<Longrightarrow> \n       ((Actor h', hs), n) \\<in> lgra G l' \\<Longrightarrow> Actor h \\<in> hs \\<Longrightarrow> \n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := (lgra G l)  \\<union> {((Actor h', hs), n)})))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| process : \"G = graphI I \\<Longrightarrow> h @\\<^bsub>G\\<^esub> l \\<Longrightarrow> l \\<in> nodes G \\<Longrightarrow> \n        enables I l (Actor h) eval \\<Longrightarrow> \n       ((Actor h', hs), n) \\<in> lgra G l \\<Longrightarrow> Actor h \\<in> hs \\<or> h = h' \\<Longrightarrow>\n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := ((lgra G l)  - {(y, x). x = n}\n                    \\<union> {(f :: label_fun) \\<Updown> ((Actor h', hs), n)}))))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"  \n| del_data : \"G = graphI I \\<Longrightarrow> h \\<in> actors_graph G \\<Longrightarrow> l \\<in> nodes G \\<Longrightarrow>\n       ((Actor h, hs), n) \\<in> lgra G l \\<Longrightarrow> \n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := (lgra G l) - {(y, x). x = n })))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| put : \"G = graphI I \\<Longrightarrow> h @\\<^bsub>G\\<^esub> l \\<Longrightarrow> l \\<in> nodes G \\<Longrightarrow> \n        enables I l (Actor h) put \\<Longrightarrow>\n        I' = Infrastructure \n                  (Lgraph (gra G)(agra G)(cgra G)\n                          ((lgra G)(l := (lgra G l) \\<union> {((Actor h, hs), n)})))\n                   (delta I)\n          \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n\ninstantiation \"infrastructure\" :: state\nbegin\n\ndefinition \n   state_transition_infra_def: \"(i \\<rightarrow>\\<^sub>i i') =  (i \\<rightarrow>\\<^sub>n (i' :: infrastructure))\"\n\ninstance\n  by (rule MC.class.MC.state.of_class.intro)\n\ndefinition state_transition_in_refl (\"(_ \\<rightarrow>\\<^sub>n* _)\" 50)\nwhere \"s \\<rightarrow>\\<^sub>n* s' \\<equiv> ((s,s') \\<in> {(x,y). state_transition_in x y}\\<^sup>*)\"\n\nend\n\n\ndefinition ref_map :: \"[RRLoopThree.infrastructure, \n                        [RRLoopTwo.igraph, location] \\<Rightarrow> policy set]\n                        \\<Rightarrow> RRLoopTwo.infrastructure\"\n  where \"ref_map I lp = RRLoopTwo.Infrastructure \n                                 (RRLoopTwo.Lgraph\n                                        (RRLoopThree.gra (RRLoopThree.graphI I))(RRLoopThree.agra (graphI I))\n                                        (RRLoopThree.cgra (graphI I))\n                                        (RRLoopThree.lgra (graphI I)))\n                                 lp\"\n                   \nlemma delta_invariant: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  delta(z) = delta(z')\"    \n  apply clarify\n  apply (erule state_transition_in.cases)\n by simp+\n\nend", "meta": {"author": "flokam", "repo": "IsabelleAT", "sha": "b8d80c31ac13fdf8c7710f7ae032233b3fa474da", "save_path": "github-repos/isabelle/flokam-IsabelleAT", "path": "github-repos/isabelle/flokam-IsabelleAT/IsabelleAT-b8d80c31ac13fdf8c7710f7ae032233b3fa474da/RRLoopThree.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3112532314034199}}
{"text": "theory StoreBuffer\n  imports \"../SimAsm_Syntax\"\nbegin\n\ndatatype globals = X | Y\nrecord aux = S :: bool\n\ntext \\<open>Auxiliary variable S encodes when the first thread will write 1 to r0\\<close>\n\ntext \\<open>Verification of the first thread\\<close>\nlemma sb0:\n  \"FNBEGIN\n    R: (\\<^sup>1\\<lbrakk>X\\<rbrakk> = 1 \\<longrightarrow> \\<^sup>2\\<^sup>aS \\<longrightarrow> \\<^sup>1\\<^sup>aS) \\<and> \\<^sup>1\\<lbrakk>X\\<rbrakk> = \\<^sup>2\\<lbrakk>X\\<rbrakk>\n    G: (\\<^sup>2\\<lbrakk>Y\\<rbrakk> = 1 \\<longrightarrow> \\<^sup>1\\<^sup>aS \\<longrightarrow> \\<^sup>2\\<^sup>aS) \\<and> \\<^sup>1\\<lbrakk>Y\\<rbrakk> = \\<^sup>2\\<lbrakk>Y\\<rbrakk>\n    P: True\n    {\n      \\<lbrakk>X\\<rbrakk> := #1;\n      fence;\n      \\<^bold>r(0 :: nat) := \\<lbrakk>Y\\<rbrakk> :\\<^sub>a \\<^sup>aS := (\\<^sup>0\\<lbrakk>Y\\<rbrakk> = 1)\n    }\n    Q: (\\<^sup>0\\<lbrakk>X\\<rbrakk> = 1 \\<and> (\\<^sup>aS \\<longrightarrow> \\<^sup>0\\<^bold>r0 = 1))\n  FNEND\" \n  apply (unfold fn_valid.simps, intro conjI)\n\n  (* Stability of Q *)\n  apply (auto simp: glb_def step\\<^sub>t_def stable_def)[1]\n\n  (* Wellformedness of R & G *)\n  apply (auto simp: transitive_def reflexive_def)[3]\n\n  (* Guarantees of each atomic action *)\n  apply (auto simp: wp\\<^sub>r_def st_upd_def step_def glb_def aux_upd_def)[1]\n\n  (* WP reasoning *)\n  apply simp\n  apply (clarsimp simp: stabilize_def st_upd_def glb_def aux_upd_def rg_def)\n\n  (* RIF *)\n  by rif_eval (simp add: expand_points_def checks_def)\n\ntext \\<open>Verification of the second thread\\<close>\nlemma sb1:\n  \"FNBEGIN\n    R: (\\<^sup>2\\<lbrakk>Y\\<rbrakk> = 1 \\<longrightarrow> \\<^sup>1\\<^sup>aS \\<longrightarrow> \\<^sup>2\\<^sup>aS) \\<and> \\<^sup>1\\<lbrakk>Y\\<rbrakk> = \\<^sup>2\\<lbrakk>Y\\<rbrakk>\n    G: (\\<^sup>1\\<lbrakk>X\\<rbrakk> = 1 \\<longrightarrow> \\<^sup>2\\<^sup>aS \\<longrightarrow> \\<^sup>1\\<^sup>aS) \\<and> \\<^sup>1\\<lbrakk>X\\<rbrakk> = \\<^sup>2\\<lbrakk>X\\<rbrakk>\n    P: True\n    {\n      \\<lbrakk>Y\\<rbrakk> := #1;\n      fence;\n      \\<^bold>r1 := \\<lbrakk>X\\<rbrakk> :\\<^sub>a \\<^sup>aS := (\\<^sup>0\\<lbrakk>X\\<rbrakk> \\<noteq> 1)\n    }\n    Q: (\\<^sup>0\\<lbrakk>Y\\<rbrakk> = 1 \\<and> (\\<not>\\<^sup>aS \\<longrightarrow> \\<^sup>0\\<^bold>r1 = 1))\n  FNEND\" \n  apply (unfold fn_valid.simps, intro conjI)\n\n  (* Stability of Q *)\n  apply (auto simp: glb_def step\\<^sub>t_def stable_def)[1]\n\n  (* Wellformedness of R & G *)\n  apply (auto simp: transitive_def reflexive_def)[3]\n\n  (* Guarantees of each atomic action *)\n  apply (auto simp: wp\\<^sub>r_def st_upd_def step_def glb_def aux_upd_def)[1]\n\n  (* WP reasoning *)\n  apply (simp; clarsimp simp: stabilize_def st_upd_def glb_def aux_upd_def rg_def)\n\n  (* RIF *)\n  by rif_eval (simp add: expand_points_def checks_def)\n\ntext \\<open>Show the conjunction of their post-conditions achieves the desired outcome\\<close>\nlemma Q_rewrite:\n  \"\\<llangle>(\\<^sup>0\\<lbrakk>X\\<rbrakk> = 1 \\<and> (\\<^sup>aS \\<longrightarrow> \\<^sup>0\\<^bold>r0 = 1)) \\<and> (\\<^sup>0\\<lbrakk>Y\\<rbrakk> = 1 \\<and> (\\<not>\\<^sup>aS \\<longrightarrow> \\<^sup>0\\<^bold>r1 = 1))\\<rrangle> \\<subseteq> \\<llangle>\\<^sup>0\\<^bold>r0 = 1 \\<or> \\<^sup>0\\<^bold>r1 = 1\\<rrangle>\"\n  by auto\n\nend\n", "meta": {"author": "UQ-PAC", "repo": "wmm-rg", "sha": "7eef2f42693cb0723a9a7a75cd7cd6f73f9bdfb2", "save_path": "github-repos/isabelle/UQ-PAC-wmm-rg", "path": "github-repos/isabelle/UQ-PAC-wmm-rg/wmm-rg-7eef2f42693cb0723a9a7a75cd7cd6f73f9bdfb2/SimAsm/Examples/StoreBuffer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3112532314034199}}
{"text": "theory Scratch2\nimports Main Hoare_Tactics Procs_Typed RHL_Typed\nbegin\n\nlemma rhoare_untypedE: \n  assumes \"rhoare_untyped P p1 p2 Q\"\n  assumes \"P m1 m2\"\n  shows \"\\<exists>\\<mu>. apply_to_distr fst \\<mu> = denotation_untyped p1 m1 \\<and>\n                  apply_to_distr snd \\<mu> = denotation_untyped p2 m2 \\<and> (\\<forall>m1' m2'. (m1',m2') \\<in> support_distr \\<mu> \\<longrightarrow> Q m1' m2')\"\nusing assms unfolding rhoare_untyped_rhoare_denotation rhoare_denotation_def by simp\n\nlemma rhoareE: \n  assumes \"rhoare P p1 p2 Q\"\n  assumes \"P m1 m2\"\n  shows \"\\<exists>\\<mu>. apply_to_distr fst \\<mu> = denotation p1 m1 \\<and>\n                  apply_to_distr snd \\<mu> = denotation p2 m2 \\<and> (\\<forall>m1' m2'. (m1',m2') \\<in> support_distr \\<mu> \\<longrightarrow> Q m1' m2')\"\nusing assms unfolding rhoare_def by simp\n\n\n\nlemma memory_update_pattern_swap: \"memory_update_pattern (memory_update_pattern m a x) b y\n     = memory_update_pattern (memory_update_pattern m b y) (kill_vars_pattern a (set (p_vars b))) x\"\n     sorry\n\nlemma memory_pattern_related_pair_pattern [simp]: \n  \"memory_pattern_related (pair_pattern a1 a2) (pair_pattern b1 b2) m1 m2\n     = (memory_pattern_related a2 b2 m1 m2 \n     \\<and> memory_pattern_related (kill_vars_pattern a1 (set (p_vars a2))) (kill_vars_pattern b1 (set (p_vars b2))) m1 m2)\" (is \"?lhs=?rhs\")\nproof (rule iffI)\n  assume \"memory_pattern_related (pair_pattern a1 a2) (pair_pattern b1 b2) m1 m2\"\n  then obtain a b where m1: \"m1 = memory_update_pattern (memory_update_pattern m1 a1 a) a2 b\" and\n        m2: \"m2 = memory_update_pattern (memory_update_pattern m2 b1 a) b2 b\"\n  unfolding memory_pattern_related_def split_paired_Ex memory_update_pair_pattern by auto\n  have \"memory_pattern_related a2 b2 m1 m2\"\n    apply (rule memory_pattern_relatedI)\n     close (subst m1, rule refl)\n    by (subst m2, rule refl)\n\n  moreover have \"memory_pattern_related (kill_vars_pattern a1 (set (p_vars a2))) (kill_vars_pattern b1 (set (p_vars b2))) m1 m2\"\n    apply (rule memory_pattern_relatedI)\n     apply (subst memory_update_pattern_swap[symmetric])\n     close (subst m1, rule refl)\n    apply (subst memory_update_pattern_swap[symmetric])\n    by (subst m2, rule refl)\n\n  ultimately show \"?rhs\" by simp\nnext\n  assume \"?rhs\"\n  hence 2: \"memory_pattern_related a2 b2 m1 m2\" and 1: \"memory_pattern_related (kill_vars_pattern a1 (set (p_vars a2))) (kill_vars_pattern b1 (set (p_vars b2))) m1 m2\"\n    by simp_all\n  from 2 obtain v where m1a2: \"m1 = memory_update_pattern m1 a2 v\" and m2b2: \"m2 = memory_update_pattern m2 b2 v\"\n    unfolding memory_pattern_related_def by auto\n  from 1 obtain w where m1a1: \"m1 = memory_update_pattern m1 (kill_vars_pattern a1 (set (p_vars a2))) w\" and\n          m2b1: \"m2 = memory_update_pattern m2 (kill_vars_pattern b1 (set (p_vars b2))) w\"\n    unfolding memory_pattern_related_def by auto\n  have \"m1 = memory_update_pattern m1 (pair_pattern a1 a2) (w,v)\"\n    unfolding memory_update_pair_pattern \n    apply (subst memory_update_pattern_twice_kill[of _ a1 _ a2])\n    apply (subst m1a2) apply (subst m1a1) by simp\n  moreover have \"m2 = memory_update_pattern m2 (pair_pattern b1 b2) (w,v)\"\n    unfolding memory_update_pair_pattern \n    apply (subst memory_update_pattern_twice_kill[of _ b1 _ b2])\n    apply (subst m2b2) apply (subst m2b1) by simp\n  ultimately show \"memory_pattern_related (pair_pattern a1 a2) (pair_pattern b1 b2) m1 m2\"\n    by (rule memory_pattern_relatedI)\nqed\n\nlemma memory_pattern_related_ignore_pattern1 [simp]: \n  \"memory_pattern_related ignore_pattern p m1 m2\"\n  sorry\n\nlemma memory_pattern_related_ignore_pattern2 [simp]: \n  \"memory_pattern_related p ignore_pattern m1 m2\"\n  sorry\n\nlemma kill_vars_pattern_pair_pattern [simp]: \"kill_vars_pattern (pair_pattern p q) V = pair_pattern (kill_vars_pattern p V) (kill_vars_pattern q V)\"\n  sorry\n(* lemma kill_vars_pattern_unit_pattern [simp]: \"kill_vars_pattern (unit_pattern) V = unit_pattern\"\n  sorry *)\nlemma kill_vars_pattern_ignore_pattern [simp]: \"kill_vars_pattern (ignore_pattern) V = ignore_pattern\"\n  sorry\nlemma kill_vars_pattern_variable_pattern1 [simp]: \n  \"mk_variable_untyped x \\<in> V \\<Longrightarrow> kill_vars_pattern (variable_pattern x) V = ignore_pattern\"\n  sorry\nlemma kill_vars_pattern_variable_pattern2 [simp]: \n  \"mk_variable_untyped x \\<notin> V \\<Longrightarrow> kill_vars_pattern (variable_pattern x) V = variable_pattern x\"\n  sorry\n\nlemma\n  assumes \"mk_variable_untyped x \\<noteq> mk_variable_untyped y\"\n  assumes \"mk_variable_untyped y \\<noteq> mk_variable_untyped x\"\n  assumes \"mk_variable_untyped x \\<noteq> mk_variable_untyped z\"\n  assumes \"mk_variable_untyped z \\<noteq> mk_variable_untyped x\"\n  assumes \"mk_variable_untyped z \\<noteq> mk_variable_untyped y\"\n  assumes \"mk_variable_untyped y \\<noteq> mk_variable_untyped z\"\n  assumes \"mk_variable_untyped z \\<noteq> mk_variable_untyped a\"\n  shows \"memory_pattern_related (pair_pattern (variable_pattern x) (pair_pattern (variable_pattern y) (variable_pattern z))) (pair_pattern (variable_pattern z) (pair_pattern (variable_pattern a) ignore_pattern)) m1 m2\"\n  apply (auto simp: assms)\noops\n\n\n\n(* lemma callproc_split_args_result: \n  (* assumes fX: \"set (vars_proc_global f) \\<subseteq> X\" *)\n  (* assumes eX: \"set (e_vars e) \\<subseteq> X\" *)\n  (* assumes Y: \"Y \\<subseteq> X \\<union> set (p_vars p)\" *)\n  (* assumes xX: \"mk_variable_untyped x \\<notin> X\" *)\n  shows \"obs_eq X Y (callproc p f e) (seq (seq (assign (variable_pattern x) e) (callproc (variable_pattern y) f (var_expression x))) (assign p (var_expression y)))\"\nproof -\n  have \"obs_eq X Y (callproc p f e) \n    (seq (callproc (variable_pattern y) f e) (assign p (var_expression y)))\"\n    apply (rule callproc_split_result)\n    sorry\n  have \"obs_eq X Y (callproc (variable_pattern y) f e) \n      (seq (assign (variable_pattern x) e) (callproc (variable_pattern y) f (var_expression x)))\"\n    apply (rule callproc_split_args)\nqed    \n *)\n\n(*\nlemma call_rule_abstract_complex: \n  fixes res and globals_f and x1::\"'x::prog_type pattern\" and x2::\"'x::prog_type pattern\" \n    and y1::\"'y::prog_type expression\" and y2::\"'y::prog_type expression\" \n    and A B \n  assumes globals_f: \"set(write_vars_proc_global f) \\<subseteq> set globals_f\"\n  assumes globals_f': \"set(vars_proc_global f) \\<supseteq> set globals_f\"\n  assumes res_nin_f: \"mk_variable_untyped res \\<notin> set (vars_proc_global f)\"\n  assumes args_nin_f: \"mk_variable_untyped args \\<notin> set (vars_proc_global f)\"\n  assumes args_not_res: \"mk_variable_untyped args \\<noteq> mk_variable_untyped res\"\n  defines \"P == \\<lambda>m1 m2. \\<forall>x\\<in>set (vars_proc_global f) \\<union> {mk_variable_untyped res, mk_variable_untyped args}.\n                    memory_lookup_untyped m1 x = memory_lookup_untyped m2 x\"\n  defines \"P' == \\<lambda>m1 m2. \\<forall>x\\<in>set (vars_proc_global f) \\<union> {mk_variable_untyped res, mk_variable_untyped args}.\n                    memory_lookup_untyped m1 x = memory_lookup_untyped m2 x\"\n  defines \"Q == \\<lambda>m1 m2. \\<forall>x\\<in>set (vars_proc_global f) \\<union> {mk_variable_untyped res}. memory_lookup_untyped m1 x = memory_lookup_untyped m2 x\"\n  defines \"QB == (\\<lambda>m1 m2. (\\<forall>gL gR xL xR x'L x'R. \n                     Q (memory_update (memory_update_untyped_pattern (memory_update_untyped_pattern m1 (list_pattern_untyped globals_f) gL) (list_pattern_untyped (p_vars x1)) x'L) res xL)\n                       (memory_update (memory_update_untyped_pattern (memory_update_untyped_pattern m2 (list_pattern_untyped globals_f) gR) (list_pattern_untyped (p_vars x2)) x'R) res xR)\n                \\<longrightarrow> B (memory_update_pattern (memory_update_untyped_pattern m1 (list_pattern_untyped globals_f) gL) x1 xL)\n                      (memory_update_pattern (memory_update_untyped_pattern m2 (list_pattern_untyped globals_f) gR) x2 xR)))\"\n  defines \"C == (\\<lambda>m1 m2. P (memory_update m1 args (e_fun y1 m1)) (memory_update m2 args (e_fun y2 m2)) \\<and> QB m1 m2)\"\n  defines \"QB' == (\\<lambda>m1 m2. (\\<forall>gL gR xL xR x'L x'R. \n                     (Q (memory_update (memory_update_untyped_pattern (memory_update_untyped_pattern m1 (list_pattern_untyped globals_f) gL) (list_pattern_untyped (p_vars x1)) x'L) res xL)\n                       (memory_update (memory_update_untyped_pattern (memory_update_untyped_pattern m2 (list_pattern_untyped globals_f) gR) (list_pattern_untyped (p_vars x2)) x'R) res xR)\n                      \\<and> xL=xR) \n                \\<longrightarrow> B (memory_update_pattern (memory_update_untyped_pattern m1 (list_pattern_untyped globals_f) gL) x1 xL)\n                      (memory_update_pattern (memory_update_untyped_pattern m2 (list_pattern_untyped globals_f) gR) x2 xR)))\"\n  defines \"C' == (\\<lambda>m1 m2. P' (memory_update m1 args (e_fun y1 m1)) (memory_update m2 args (e_fun y2 m2)) \\<and> QB' m1 m2)\"\n  assumes p1p2': \"rhoare A p1 p2 C'\"\n  shows \"rhoare A (seq p1 (callproc x1 f y1)) (seq p2 (callproc x2 f y2)) B\"\nproof -\n  (* fix res :: \"'x variable\" and args :: \"'y variable\" (* TODO *) *)\n\n(*   def P == \"\\<lambda>m1 m2. \\<forall>x\\<in>set (vars_proc_global f) \\<union> {mk_variable_untyped res, mk_variable_untyped args}.\n                    memory_lookup_untyped m1 x = memory_lookup_untyped m2 x\"\n  def Q == \"\\<lambda>m1 m2. \\<forall>x\\<in>set (vars_proc_global f) \\<union> {mk_variable_untyped res}. memory_lookup_untyped m1 x = memory_lookup_untyped m2 x\" *)\n\n  have aux: \"(\\<forall>x\\<in>X. f x) = (\\<forall>x\\<in>X. g x)\" if \"\\<And>x. x\\<in>X \\<Longrightarrow> f x = g x\" for X::\"variable_untyped set\" and f g\n    using that by blast\n\n(* \n  defines \"Q == \\<lambda>m1 m2. \\<forall>x\\<in>set (vars_proc_global f) \\<union> {mk_variable_untyped res}. memory_lookup_untyped m1 x = memory_lookup_untyped m2 x\"\n*)\n    \n  (* {fix m1 m2 gL gR x'L x'R xL xR *)\n  have \"Q (memory_update (memory_update_untyped_pattern (memory_update_untyped_pattern m1 (list_pattern_untyped globals_f) gL) (list_pattern_untyped (p_vars x1)) x'L) res xL)\n          (memory_update (memory_update_untyped_pattern (memory_update_untyped_pattern m2 (list_pattern_untyped globals_f) gR) (list_pattern_untyped (p_vars x2)) x'R) res xR)\n    \\<Longrightarrow> x'L = x'R \\<and> gL = gR \\<and> xL = xR\" \n    (* TODO: gL=gR only holds on vars outside x1/x2 *)\n    for m1 m2 gL gR x'L x'R xL xR \n(*     unfolding Q_def by auto\n  also have \"?rhs \\<Longrightarrow> Q (memory_update_untyped_pattern (memory_update_untyped_pattern m1 (list_pattern_untyped globals_f) gL) (list_pattern_untyped (p_vars x1)) x'L)\n          (memory_update_untyped_pattern (memory_update_untyped_pattern m2 (list_pattern_untyped globals_f) gR) (list_pattern_untyped (p_vars x2)) x'R)\n        \\<and> xL = xR\"\n    apply simp\n    unfolding Q_def apply auto\n        by auto *)\n          \n  hence QB'QB: \"QB' m1 m2 \\<Longrightarrow> QB m1 m2\" for m1 m2\n    unfolding QB'_def QB_def by metis\n\n  have P'P: \"P' m1 m2 \\<Longrightarrow> P m1 m2\" for m1 m2\n    unfolding P'_def P_def by simp\n\n  from QB'QB P'P have \"C' m1 m2 \\<Longrightarrow> C m1 m2\" for m1 m2 unfolding C'_def C_def by simp\n  hence p1p2: \"rhoare A p1 p2 C\"\n    apply (rule_tac rconseq_rule[OF _ _ p1p2'])\n    by auto\n\n  have \"obs_eq (set(vars_proc_global f) \\<union> {mk_variable_untyped res, mk_variable_untyped args})  \n      (set(vars_proc_global f) \\<union> {mk_variable_untyped res}) \n      (callproc (variable_pattern res) f (var_expression args)) (callproc (variable_pattern res) f (var_expression args))\"\n    by (rule self_obseq_vars, auto)\n  hence PfQ: \"rhoare P (callproc (variable_pattern res) f (var_expression args))\n                 (callproc (variable_pattern res) f (var_expression args)) Q\"\n    unfolding obs_eq_def P_def Q_def by simp\n\n  have footQ1: \"assertion_footprint_left (- {mk_variable_untyped args}) Q\"\n    unfolding Q_def\n    apply (rule assertion_footprint_leftI)\n    apply simp by (metis args_nin_f args_not_res memory_lookup_def)\n\n  have footQ2: \"assertion_footprint_right (- {mk_variable_untyped args}) Q\"\n    apply (subst assertion_footprint_right_left)\n    apply (rewrite at \"assertion_footprint_left _ \\<hole>\" eq_reflection[of _ Q])\n     close (unfold Q_def, metis)\n    by (rule footQ1)\n\n  show ?thesis\n    apply (rule call_rule[where P=P and Q=Q])\n    close 2 (rule globals_f)+\n    close 2 (rule args_nin_f)+\n    close (rule footQ1) close (rule footQ2)\n    close (rule PfQ)\n    by (rule p1p2[unfolded C_def QB_def])\nqed\n*)\n\nend", "meta": {"author": "dominique-unruh", "repo": "IsaCrypt", "sha": "1abc2041871af7b758adcc914b83f0d9135ec129", "save_path": "github-repos/isabelle/dominique-unruh-IsaCrypt", "path": "github-repos/isabelle/dominique-unruh-IsaCrypt/IsaCrypt-1abc2041871af7b758adcc914b83f0d9135ec129/Scratch2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3112532248693237}}
{"text": "theory Prelude_NumericClasses\nimports \"$HETS_LIB/Isabelle/MainHCPairs\"\nuses \"$HETS_LIB/Isabelle/prelude\"\nbegin\n\nML \"Header.initialize\n    [\\\"NotFalse\\\", \\\"NotTrue\\\", \\\"AndFalse\\\", \\\"AndTrue\\\", \\\"AndSym\\\",\n     \\\"OrDef\\\", \\\"OtherwiseDef\\\", \\\"NotFalse1\\\", \\\"NotTrue1\\\",\n     \\\"notNot1\\\", \\\"notNot2\\\", \\\"EqualTDef\\\", \\\"EqualSymDef\\\",\n     \\\"EqualReflex\\\", \\\"EqualTransT\\\", \\\"DiffDef\\\", \\\"DiffSymDef\\\",\n     \\\"DiffTDef\\\", \\\"DiffFDef\\\", \\\"TE1\\\", \\\"TE2\\\", \\\"TE3\\\", \\\"TE4\\\",\n     \\\"IUE1\\\", \\\"IUE2\\\", \\\"IBE1\\\", \\\"IBE2\\\", \\\"IBE3\\\", \\\"IBE4\\\",\n     \\\"IBE5\\\", \\\"IBE6\\\", \\\"IBE7\\\", \\\"IBE8\\\", \\\"IOE01\\\", \\\"IOE02\\\",\n     \\\"IOE03\\\", \\\"IOE04\\\", \\\"IOE05\\\", \\\"IOE06\\\", \\\"IOE07\\\", \\\"IOE08\\\",\n     \\\"IOE09\\\", \\\"LeIrreflexivity\\\", \\\"LeTAsymmetry\\\",\n     \\\"LeTTransitive\\\", \\\"LeTTotal\\\", \\\"GeDef\\\", \\\"GeIrreflexivity\\\",\n     \\\"GeTAsymmetry\\\", \\\"GeTTransitive\\\", \\\"GeTTotal\\\", \\\"LeqDef\\\",\n     \\\"LeqReflexivity\\\", \\\"LeqTTransitive\\\", \\\"LeqTTotal\\\", \\\"GeqDef\\\",\n     \\\"GeqReflexivity\\\", \\\"GeqTTransitive\\\", \\\"GeqTTotal\\\",\n     \\\"EqTSOrdRel\\\", \\\"EqFSOrdRel\\\", \\\"EqTOrdRel\\\", \\\"EqFOrdRel\\\",\n     \\\"EqTOrdTSubstE\\\", \\\"EqTOrdFSubstE\\\", \\\"EqTOrdTSubstD\\\",\n     \\\"EqTOrdFSubstD\\\", \\\"LeTGeFEqFRel\\\", \\\"LeFGeTEqTRel\\\",\n     \\\"LeTGeTRel\\\", \\\"LeFGeFRel\\\", \\\"LeqTGetTRel\\\", \\\"LeqFGetFRel\\\",\n     \\\"GeTLeTRel\\\", \\\"GeFLeFRel\\\", \\\"GeqTLeqTRel\\\", \\\"GeqFLeqFRel\\\",\n     \\\"LeqTGeFRel\\\", \\\"LeqFGeTRel\\\", \\\"GeTLeFEqFRel\\\", \\\"GeFLeTEqTRel\\\",\n     \\\"GeqTLeFRel\\\", \\\"GeqFLeTRel\\\", \\\"LeqTLeTEqTRel\\\",\n     \\\"LeqFLeFEqFRel\\\", \\\"GeqTGeTEqTRel\\\", \\\"GeqFGeFEqFRel\\\",\n     \\\"LeTGeqFRel\\\", \\\"GeTLeqFRel\\\", \\\"LeLeqDiff\\\", \\\"CmpLTDef\\\",\n     \\\"CmpEQDef\\\", \\\"CmpGTDef\\\", \\\"MaxYDef\\\", \\\"MaxXDef\\\", \\\"MinXDef\\\",\n     \\\"MinYDef\\\", \\\"MaxSym\\\", \\\"MinSym\\\", \\\"TO1\\\", \\\"TO2\\\", \\\"TO3\\\",\n     \\\"TO4\\\", \\\"TO5\\\", \\\"TO6\\\", \\\"TO7\\\", \\\"IUO01\\\", \\\"IUO02\\\",\n     \\\"IUO03\\\", \\\"IUO04\\\", \\\"IUO05\\\", \\\"IUO06\\\", \\\"IUO07\\\", \\\"IOO13\\\",\n     \\\"IOO14\\\", \\\"IOO15\\\", \\\"IOO16\\\", \\\"IOO17\\\", \\\"IOO18\\\", \\\"IOO19\\\",\n     \\\"IOO20\\\", \\\"IOO21\\\", \\\"IOO22\\\", \\\"IOO23\\\", \\\"IOO24\\\", \\\"IOO25\\\",\n     \\\"IOO26\\\", \\\"IOO27\\\", \\\"IOO28\\\", \\\"IOO29\\\", \\\"IOO30\\\", \\\"IOO31\\\",\n     \\\"IOO32\\\", \\\"IOO33\\\", \\\"IBO5\\\", \\\"IBO6\\\", \\\"IBO7\\\", \\\"IBO8\\\",\n     \\\"IBO9\\\", \\\"IBO10\\\", \\\"IBO11\\\", \\\"IBO12\\\", \\\"ga_selector_pre\\\",\n     \\\"ga_injective_suc\\\", \\\"ga_disjoint_0_suc\\\",\n     \\\"ga_selector_undef_pre_0\\\", \\\"X1_def_Nat\\\", \\\"X2_def_Nat\\\",\n     \\\"X3_def_Nat\\\", \\\"X4_def_Nat\\\", \\\"X5_def_Nat\\\", \\\"X6_def_Nat\\\",\n     \\\"X7_def_Nat\\\", \\\"X8_def_Nat\\\", \\\"X9_def_Nat\\\", \\\"decimal_def\\\",\n     \\\"ga_comm___XPlus__\\\", \\\"ga_assoc___XPlus__\\\",\n     \\\"ga_right_unit___XPlus__\\\", \\\"ga_left_unit___XPlus__\\\",\n     \\\"ga_left_comm___XPlus__\\\", \\\"ga_comm___Xx__\\\",\n     \\\"ga_assoc___Xx__\\\", \\\"ga_right_unit___Xx__\\\",\n     \\\"ga_left_unit___Xx__\\\", \\\"ga_left_comm___Xx__\\\", \\\"ga_comm_min\\\",\n     \\\"ga_assoc_min\\\", \\\"ga_left_comm_min\\\", \\\"ga_comm_max\\\",\n     \\\"ga_assoc_max\\\", \\\"ga_right_unit_max\\\", \\\"ga_left_unit_max\\\",\n     \\\"ga_left_comm_max\\\", \\\"leq_def1_Nat\\\", \\\"dvd_def_Nat\\\",\n     \\\"leq_def2_Nat\\\", \\\"leq_def3_Nat\\\", \\\"geq_def_Nat\\\",\n     \\\"less_def_Nat\\\", \\\"greater_def_Nat\\\", \\\"even_0_Nat\\\",\n     \\\"even_suc_Nat\\\", \\\"odd_def_Nat\\\", \\\"factorial_0\\\",\n     \\\"factorial_suc\\\", \\\"add_0_Nat\\\", \\\"add_suc_Nat\\\", \\\"mult_0_Nat\\\",\n     \\\"mult_suc_Nat\\\", \\\"power_0_Nat\\\", \\\"power_suc_Nat\\\",\n     \\\"min_def_Nat\\\", \\\"max_def_Nat\\\", \\\"subTotal_def1_Nat\\\",\n     \\\"subTotal_def2_Nat\\\", \\\"sub_dom_Nat\\\", \\\"sub_def_Nat\\\",\n     \\\"divide_dom_Nat\\\", \\\"divide_0_Nat\\\", \\\"divide_Pos_Nat\\\",\n     \\\"div_dom_Nat\\\", \\\"div_Nat\\\", \\\"mod_dom_Nat\\\", \\\"mod_Nat\\\",\n     \\\"distr1_Nat\\\", \\\"distr2_Nat\\\", \\\"Pos_def\\\", \\\"X1_as_Pos_def\\\",\n     \\\"min_0\\\", \\\"div_mod_Nat\\\", \\\"power_Nat\\\", \\\"ga_generated_Int\\\",\n     \\\"equality_Int\\\", \\\"Nat2Int_embedding\\\", \\\"ga_comm___XPlus___1\\\",\n     \\\"ga_assoc___XPlus___1\\\", \\\"ga_right_unit___XPlus___1\\\",\n     \\\"ga_left_unit___XPlus___1\\\", \\\"ga_left_comm___XPlus___1\\\",\n     \\\"ga_comm___Xx___1\\\", \\\"ga_assoc___Xx___1\\\",\n     \\\"ga_right_unit___Xx___1\\\", \\\"ga_left_unit___Xx___1\\\",\n     \\\"ga_left_comm___Xx___1\\\", \\\"ga_comm_min_1\\\", \\\"ga_comm_max_1\\\",\n     \\\"ga_assoc_min_1\\\", \\\"ga_assoc_max_1\\\", \\\"ga_left_comm_min_1\\\",\n     \\\"ga_left_comm_max_1\\\", \\\"leq_def_Int\\\", \\\"geq_def_Int\\\",\n     \\\"less_def_Int\\\", \\\"greater_def_Int\\\", \\\"even_def_Int\\\",\n     \\\"odd_def_Int\\\", \\\"odd_alt_Int\\\", \\\"neg_def_Int\\\",\n     \\\"sign_def_Int\\\", \\\"abs_def_Int\\\", \\\"add_def_Int\\\",\n     \\\"mult_def_Int\\\", \\\"sub_def_Int\\\", \\\"min_def_Int\\\",\n     \\\"max_def_Int\\\", \\\"power_neg1_Int\\\", \\\"power_others_Int\\\",\n     \\\"divide_dom2_Int\\\", \\\"divide_alt_Int\\\", \\\"divide_Int\\\",\n     \\\"div_dom_Int\\\", \\\"div_Int\\\", \\\"quot_dom_Int\\\", \\\"quot_neg_Int\\\",\n     \\\"quot_nonneg_Int\\\", \\\"rem_dom_Int\\\", \\\"quot_rem_Int\\\",\n     \\\"rem_nonneg_Int\\\", \\\"mod_dom_Int\\\", \\\"mod_Int\\\", \\\"distr1_Int\\\",\n     \\\"distr2_Int\\\", \\\"Int_Nat_sub_compat\\\", \\\"abs_decomp_Int\\\",\n     \\\"mod_abs_Int\\\", \\\"div_mod_Int\\\", \\\"quot_abs_Int\\\",\n     \\\"rem_abs_Int\\\", \\\"quot_rem_Int_1\\\", \\\"power_Int\\\",\n     \\\"ga_generated_Rat\\\", \\\"equality_Rat\\\", \\\"Int2Rat_embedding\\\",\n     \\\"ga_comm___XPlus___2_1\\\", \\\"ga_assoc___XPlus___2_1\\\",\n     \\\"ga_right_unit___XPlus___2_1\\\", \\\"ga_left_unit___XPlus___2_1\\\",\n     \\\"ga_left_comm___XPlus___2_1\\\", \\\"ga_comm___Xx___2_1\\\",\n     \\\"ga_assoc___Xx___2_1\\\", \\\"ga_right_unit___Xx___2_1\\\",\n     \\\"ga_left_unit___Xx___2_1\\\", \\\"ga_left_comm___Xx___2_1\\\",\n     \\\"ga_comm_min_2_1\\\", \\\"ga_comm_max_2_1\\\", \\\"ga_assoc_min_2_1\\\",\n     \\\"ga_assoc_max_2_1\\\", \\\"ga_left_comm_min_2_1\\\",\n     \\\"ga_left_comm_max_2_1\\\", \\\"leq_def_Rat\\\", \\\"geq_def_Rat\\\",\n     \\\"less_def_Rat\\\", \\\"greater_def_Rat\\\", \\\"minus_def_Rat\\\",\n     \\\"abs_def_Rat\\\", \\\"add_def_Rat\\\", \\\"sub_def_Rat\\\",\n     \\\"mult_def_Rat\\\", \\\"min_def_Rat\\\", \\\"max_def_Rat\\\",\n     \\\"divide_def1_Rat\\\", \\\"divide_def2_Rat\\\", \\\"power_0_Rat\\\",\n     \\\"power_suc_Rat\\\", \\\"power_neg_Rat\\\", \\\"distr1_Rat\\\",\n     \\\"distr2_Rat\\\", \\\"sub_rule_Rat\\\", \\\"divide_dom_Rat\\\",\n     \\\"divide_rule_Rat\\\", \\\"power_Rat\\\", \\\"IPN01\\\", \\\"IPN02\\\",\n     \\\"IPN03\\\", \\\"IPN04\\\", \\\"IPN05\\\", \\\"IPN06\\\", \\\"IPN07\\\", \\\"INN01\\\",\n     \\\"INN02\\\", \\\"INN03\\\", \\\"INN04\\\", \\\"INN05\\\", \\\"INN06\\\", \\\"INN07\\\",\n     \\\"IIN01\\\", \\\"IIN02\\\", \\\"IIN03\\\", \\\"IIN04\\\", \\\"IIN05\\\", \\\"IIN06\\\",\n     \\\"IIN07\\\", \\\"IIN07_1\\\", \\\"IIN08\\\", \\\"IIN09\\\", \\\"IRN01\\\", \\\"IRN02\\\",\n     \\\"IRN03\\\", \\\"IRN04\\\", \\\"IRN05\\\", \\\"IRN06\\\", \\\"IRN07\\\", \\\"IRN07_1\\\",\n     \\\"IRN08\\\", \\\"IRN09\\\", \\\"IRI01\\\", \\\"IRI02\\\", \\\"IRI03\\\", \\\"IRI04\\\",\n     \\\"IRI05\\\", \\\"IRI06\\\", \\\"IRI01_1\\\", \\\"IRI02_1\\\", \\\"IRF01\\\",\n     \\\"IRF02\\\", \\\"AbsSignumLaw\\\"]\"\n\ntypedecl Bool\ntypedecl Pos\ntypedecl Rat\ntypedecl Unit\ntypedecl X_Int\n\ndatatype Ordering = EQ | GT | LT\ndatatype X_Nat = X0X2 (\"0''''\") | sucX1 \"X_Nat\" (\"suc''/'(_')\" [3] 999)\n\nconsts\nNot__X :: \"bool => bool\" (\"(Not''/ _)\" [56] 56)\nX0X1 :: \"X_Int\" (\"0''\")\nX0X3 :: \"Rat\" (\"0'_3\")\nX1X1 :: \"X_Int\" (\"1''\")\nX1X2 :: \"X_Nat\" (\"1''''\")\nX1X3 :: \"Pos\" (\"1'_3\")\nX1X4 :: \"Rat\" (\"1'_4\")\nX2X1 :: \"X_Int\" (\"2''\")\nX2X2 :: \"X_Nat\" (\"2''''\")\nX2X3 :: \"Rat\" (\"2'_3\")\nX3X1 :: \"X_Int\" (\"3''\")\nX3X2 :: \"X_Nat\" (\"3''''\")\nX3X3 :: \"Rat\" (\"3'_3\")\nX4X1 :: \"X_Int\" (\"4''\")\nX4X2 :: \"X_Nat\" (\"4''''\")\nX4X3 :: \"Rat\" (\"4'_3\")\nX5X1 :: \"X_Int\" (\"5''\")\nX5X2 :: \"X_Nat\" (\"5''''\")\nX5X3 :: \"Rat\" (\"5'_3\")\nX6X1 :: \"X_Int\" (\"6''\")\nX6X2 :: \"X_Nat\" (\"6''''\")\nX6X3 :: \"Rat\" (\"6'_3\")\nX7X1 :: \"X_Int\" (\"7''\")\nX7X2 :: \"X_Nat\" (\"7''''\")\nX7X3 :: \"Rat\" (\"7'_3\")\nX8X1 :: \"X_Int\" (\"8''\")\nX8X2 :: \"X_Nat\" (\"8''''\")\nX8X3 :: \"Rat\" (\"8'_3\")\nX9X1 :: \"X_Int\" (\"9''\")\nX9X2 :: \"X_Nat\" (\"9''''\")\nX9X3 :: \"Rat\" (\"9'_3\")\nXMinus__XX1 :: \"X_Int => X_Int\" (\"(-''/ _)\" [56] 56)\nXMinus__XX2 :: \"Rat => Rat\" (\"(-''''/ _)\" [56] 56)\nX__XAmpXAmp__X :: \"bool => bool => bool\" (\"(_/ &&/ _)\" [54,54] 52)\nX__XAtXAt__X :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ @@/ _)\" [54,54] 52)\nX__XCaret__XX1 :: \"X_Int => X_Nat => X_Int\" (\"(_/ ^''/ _)\" [54,54] 52)\nX__XCaret__XX2 :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ ^''''/ _)\" [54,54] 52)\nX__XCaret__XX3 :: \"Rat => X_Int => Rat partial\" (\"(_/ ^'_3/ _)\" [54,54] 52)\nX__XEqXEq__X :: \"'a partial => 'a partial => bool\" (\"(_/ ==''/ _)\" [54,54] 52)\nX__XExclam :: \"X_Nat => X_Nat\" (\"(_/ !'')\" [58] 58)\nX__XGtXEq__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ >=''/ _)\" [44,44] 42)\nX__XGtXEq__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ >=''''/ _)\" [44,44] 42)\nX__XGtXEq__XX3 :: \"Rat => Rat => bool\" (\"(_/ >='_3/ _)\" [44,44] 42)\nX__XGtXEq__XX4 :: \"'a partial => 'a partial => bool\" (\"(_/ >='_4/ _)\" [54,54] 52)\nX__XGt__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ >''/ _)\" [44,44] 42)\nX__XGt__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ >''''/ _)\" [44,44] 42)\nX__XGt__XX3 :: \"Rat => Rat => bool\" (\"(_/ >'_3/ _)\" [44,44] 42)\nX__XGt__XX4 :: \"'a partial => 'a partial => bool\" (\"(_/ >'_4/ _)\" [54,54] 52)\nX__XLtXEq__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ <=''/ _)\" [44,44] 42)\nX__XLtXEq__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ <=''''/ _)\" [44,44] 42)\nX__XLtXEq__XX3 :: \"Rat => Rat => bool\" (\"(_/ <='_3/ _)\" [44,44] 42)\nX__XLtXEq__XX4 :: \"'a partial => 'a partial => bool\" (\"(_/ <='_4/ _)\" [54,54] 52)\nX__XLt__XX1 :: \"X_Int => X_Int => bool\" (\"(_/ <''/ _)\" [44,44] 42)\nX__XLt__XX2 :: \"X_Nat => X_Nat => bool\" (\"(_/ <''''/ _)\" [44,44] 42)\nX__XLt__XX3 :: \"Rat => Rat => bool\" (\"(_/ <'_3/ _)\" [44,44] 42)\nX__XLt__XX4 :: \"'a partial => 'a partial => bool\" (\"(_/ <'_4/ _)\" [54,54] 52)\nX__XMinusXExclam__X :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ -!/ _)\" [54,54] 52)\nX__XMinusXQuest__X :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ -?/ _)\" [54,54] 52)\nX__XMinus__XX1 :: \"X_Int => X_Int => X_Int\" (\"(_/ -''/ _)\" [54,54] 52)\nX__XMinus__XX2 :: \"X_Nat => X_Nat => X_Int\" (\"(_/ -''''/ _)\" [54,54] 52)\nX__XMinus__XX3 :: \"Rat => Rat => Rat\" (\"(_/ -'_3/ _)\" [54,54] 52)\nX__XMinus__XX4 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ -'_4/ _)\" [54,54] 52)\nX__XPlus__XX1 :: \"X_Int => X_Int => X_Int\" (\"(_/ +''/ _)\" [54,54] 52)\nX__XPlus__XX2 :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ +''''/ _)\" [54,54] 52)\nX__XPlus__XX3 :: \"X_Nat => Pos => Pos\" (\"(_/ +'_3/ _)\" [54,54] 52)\nX__XPlus__XX4 :: \"Pos => X_Nat => Pos\" (\"(_/ +'_4/ _)\" [54,54] 52)\nX__XPlus__XX5 :: \"Rat => Rat => Rat\" (\"(_/ +'_5/ _)\" [54,54] 52)\nX__XPlus__XX6 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ +'_6/ _)\" [54,54] 52)\nX__XSlashXEq__X :: \"'a partial => 'a partial => bool\" (\"(_/ '/=/ _)\" [54,54] 52)\nX__XSlashXQuest__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ '/?''/ _)\" [54,54] 52)\nX__XSlashXQuest__XX2 :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ '/?''''/ _)\" [54,54] 52)\nX__XSlash__XX1 :: \"X_Int => Pos => Rat\" (\"(_/ '/''/ _)\" [54,54] 52)\nX__XSlash__XX2 :: \"Rat => Rat => Rat partial\" (\"(_/ '/''''/ _)\" [54,54] 52)\nX__XSlash__XX3 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ '/'_3/ _)\" [54,54] 52)\nX__XVBarXVBar__X :: \"bool => bool => bool\" (\"(_/ ||/ _)\" [54,54] 52)\nX__Xx__XX1 :: \"X_Int => X_Int => X_Int\" (\"(_/ *''/ _)\" [54,54] 52)\nX__Xx__XX2 :: \"X_Nat => X_Nat => X_Nat\" (\"(_/ *''''/ _)\" [54,54] 52)\nX__Xx__XX3 :: \"Pos => Pos => Pos\" (\"(_/ *'_3/ _)\" [54,54] 52)\nX__Xx__XX4 :: \"Rat => Rat => Rat\" (\"(_/ *'_4/ _)\" [54,54] 52)\nX__Xx__XX5 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ *'_5/ _)\" [54,54] 52)\nX__div__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ div''/ _)\" [54,54] 52)\nX__div__XX2 :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ div''''/ _)\" [54,54] 52)\nX__div__XX3 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ div'_3/ _)\" [54,54] 52)\nX__dvd__X :: \"X_Nat => X_Nat => bool\" (\"(_/ dvd''/ _)\" [44,44] 42)\nX__mod__XX1 :: \"X_Int => X_Int => X_Nat partial\" (\"(_/ mod''/ _)\" [54,54] 52)\nX__mod__XX2 :: \"X_Nat => X_Nat => X_Nat partial\" (\"(_/ mod''''/ _)\" [54,54] 52)\nX__mod__XX3 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ mod'_3/ _)\" [54,54] 52)\nX__quot__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ quot''/ _)\" [54,54] 52)\nX__quot__XX2 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ quot''''/ _)\" [54,54] 52)\nX__rem__XX1 :: \"X_Int => X_Int => X_Int partial\" (\"(_/ rem''/ _)\" [54,54] 52)\nX__rem__XX2 :: \"'a partial => 'a partial => 'a partial\" (\"(_/ rem''''/ _)\" [54,54] 52)\nX_absX1 :: \"X_Int => X_Nat\" (\"abs''/'(_')\" [3] 999)\nX_absX2 :: \"Rat => Rat\" (\"abs''''/'(_')\" [3] 999)\nX_absX3 :: \"'a partial => 'a partial\" (\"abs'_3/'(_')\" [3] 999)\nX_evenX1 :: \"X_Int => bool\" (\"even''/'(_')\" [3] 999)\nX_evenX2 :: \"X_Nat => bool\" (\"even''''/'(_')\" [3] 999)\nX_fromInteger :: \"X_Int => 'a partial\" (\"fromInteger/'(_')\" [3] 999)\nX_gn_inj :: \"'a => 'b\" (\"gn'_inj/'(_')\" [3] 999)\nX_gn_proj :: \"'a => 'b partial\" (\"gn'_proj/'(_')\" [3] 999)\nX_maxX1 :: \"X_Int => X_Int => X_Int\" (\"max''/'(_,/ _')\" [3,3] 999)\nX_maxX2 :: \"X_Nat => X_Nat => X_Nat\" (\"max''''/'(_,/ _')\" [3,3] 999)\nX_maxX3 :: \"Rat => Rat => Rat\" (\"max'_3/'(_,/ _')\" [3,3] 999)\nX_maxX4 :: \"'a partial => 'a partial => 'a partial\"\nX_minX1 :: \"X_Int => X_Int => X_Int\" (\"min''/'(_,/ _')\" [3,3] 999)\nX_minX2 :: \"X_Nat => X_Nat => X_Nat\" (\"min''''/'(_,/ _')\" [3,3] 999)\nX_minX3 :: \"Rat => Rat => Rat\" (\"min'_3/'(_,/ _')\" [3,3] 999)\nX_minX4 :: \"'a partial => 'a partial => 'a partial\"\nX_negate :: \"'a partial => 'a partial\" (\"negate/'(_')\" [3] 999)\nX_oddX1 :: \"X_Int => bool\" (\"odd''/'(_')\" [3] 999)\nX_oddX2 :: \"X_Nat => bool\" (\"odd''''/'(_')\" [3] 999)\nX_pre :: \"X_Nat => X_Nat partial\" (\"pre/'(_')\" [3] 999)\nX_recip :: \"'a partial => 'a partial\" (\"recip/'(_')\" [3] 999)\nX_sign :: \"X_Int => X_Int\" (\"sign/'(_')\" [3] 999)\nX_signum :: \"'a partial => 'a partial\" (\"signum/'(_')\" [3] 999)\nX_toInteger :: \"'a partial => X_Int\" (\"toInteger/'(_')\" [3] 999)\ncompare :: \"'a partial => 'a partial => Ordering partial\"\ndivMod :: \"'a partial => 'a partial => 'a partial * 'a partial\"\notherwiseH :: \"bool\"\nquotRem :: \"'a partial => 'a partial => 'a partial * 'a partial\"\nsucX2 :: \"X_Nat => Pos\" (\"suc''''/'(_')\" [3] 999)\n\naxioms\nNotFalse [rule_format] : \"Not' False\"\n\nNotTrue [rule_format] : \"~ Not' True\"\n\nAndFalse [rule_format] : \"ALL x. ~ False && x\"\n\nAndTrue [rule_format] : \"ALL x. True && x = x\"\n\nAndSym [rule_format] : \"ALL x. ALL y. x && y = y && x\"\n\nOrDef [rule_format] :\n\"ALL x. ALL y. x || y = Not' (Not' x && Not' y)\"\n\nOtherwiseDef [rule_format] : \"otherwiseH\"\n\nNotFalse1 [rule_format] : \"ALL x. Not' x = (~ x)\"\n\nNotTrue1 [rule_format] : \"ALL x. ~ Not' x = x\"\n\nnotNot1 [rule_format] : \"ALL x. (~ x) = Not' x\"\n\nnotNot2 [rule_format] : \"ALL x. (~ ~ x) = (~ Not' x)\"\n\nEqualTDef [rule_format] : \"ALL x. ALL y. x = y --> x ==' y\"\n\nEqualSymDef [rule_format] : \"ALL x. ALL y. x ==' y = y ==' x\"\n\nEqualReflex [rule_format] : \"ALL x. x ==' x\"\n\nEqualTransT [rule_format] :\n\"ALL x. ALL y. ALL z. x ==' y & y ==' z --> x ==' z\"\n\nDiffDef [rule_format] : \"ALL x. ALL y. x /= y = Not' (x ==' y)\"\n\nDiffSymDef [rule_format] : \"ALL x. ALL y. x /= y = y /= x\"\n\nDiffTDef [rule_format] : \"ALL x. ALL y. x /= y = Not' (x ==' y)\"\n\nDiffFDef [rule_format] : \"ALL x. ALL y. (~ x /= y) = x ==' y\"\n\nTE1 [rule_format] : \"ALL x. ALL y. ~ x ==' y --> ~ x = y\"\n\nTE2 [rule_format] : \"ALL x. ALL y. Not' (x ==' y) = (~ x ==' y)\"\n\nTE3 [rule_format] : \"ALL x. ALL y. (~ Not' (x ==' y)) = x ==' y\"\n\nTE4 [rule_format] : \"ALL x. ALL y. (~ x ==' y) = (~ x ==' y)\"\n\nIUE1 [rule_format] : \"makePartial () ==' makePartial ()\"\n\nIUE2 [rule_format] : \"~ makePartial () /= makePartial ()\"\n\nIBE1 [rule_format] : \"makePartial () ==' makePartial ()\"\n\nIBE2 [rule_format] : \"undefinedOp ==' undefinedOp\"\n\nIBE3 [rule_format] : \"~ undefinedOp ==' makePartial ()\"\n\nIBE4 [rule_format] : \"~ makePartial () ==' undefinedOp\"\n\nIBE5 [rule_format] : \"makePartial () /= undefinedOp\"\n\nIBE6 [rule_format] : \"undefinedOp /= makePartial ()\"\n\nIBE7 [rule_format] : \"Not' (makePartial () ==' undefinedOp)\"\n\nIBE8 [rule_format] : \"~ Not' Not' (makePartial () ==' undefinedOp)\"\n\nIOE01 [rule_format] : \"makePartial LT ==' makePartial LT\"\n\nIOE02 [rule_format] : \"makePartial EQ ==' makePartial EQ\"\n\nIOE03 [rule_format] : \"makePartial GT ==' makePartial GT\"\n\nIOE04 [rule_format] : \"~ makePartial LT ==' makePartial EQ\"\n\nIOE05 [rule_format] : \"~ makePartial LT ==' makePartial GT\"\n\nIOE06 [rule_format] : \"~ makePartial EQ ==' makePartial GT\"\n\nIOE07 [rule_format] : \"makePartial LT /= makePartial EQ\"\n\nIOE08 [rule_format] : \"makePartial LT /= makePartial GT\"\n\nIOE09 [rule_format] : \"makePartial EQ /= makePartial GT\"\n\nLeIrreflexivity [rule_format] :\n\"ALL x. ALL y. x ==' y --> ~ x <_4 y\"\n\nLeTAsymmetry [rule_format] : \"ALL x. ALL y. x <_4 y --> ~ y <_4 x\"\n\nLeTTransitive [rule_format] :\n\"ALL x. ALL y. ALL z. x <_4 y & y <_4 z --> x <_4 z\"\n\nLeTTotal [rule_format] :\n\"ALL x. ALL y. (x <_4 y | y <_4 x) | x ==' y\"\n\nGeDef [rule_format] : \"ALL x. ALL y. x >_4 y = y <_4 x\"\n\nGeIrreflexivity [rule_format] :\n\"ALL x. ALL y. x ==' y --> ~ x >_4 y\"\n\nGeTAsymmetry [rule_format] : \"ALL x. ALL y. x >_4 y --> ~ y >_4 x\"\n\nGeTTransitive [rule_format] :\n\"ALL x. ALL y. ALL z. (x >_4 y) && (y >_4 z) --> x >_4 z\"\n\nGeTTotal [rule_format] :\n\"ALL x. ALL y. ((x >_4 y) || (y >_4 x)) || (x ==' y)\"\n\nLeqDef [rule_format] :\n\"ALL x. ALL y. x <=_4 y = (x <_4 y) || (x ==' y)\"\n\nLeqReflexivity [rule_format] : \"ALL x. x <=_4 x\"\n\nLeqTTransitive [rule_format] :\n\"ALL x. ALL y. ALL z. (x <=_4 y) && (y <=_4 z) --> x <=_4 z\"\n\nLeqTTotal [rule_format] :\n\"ALL x. ALL y. (x <=_4 y) && (y <=_4 x) = x ==' y\"\n\nGeqDef [rule_format] :\n\"ALL x. ALL y. x >=_4 y = (x >_4 y) || (x ==' y)\"\n\nGeqReflexivity [rule_format] : \"ALL x. x >=_4 x\"\n\nGeqTTransitive [rule_format] :\n\"ALL x. ALL y. ALL z. (x >=_4 y) && (y >=_4 z) --> x >=_4 z\"\n\nGeqTTotal [rule_format] :\n\"ALL x. ALL y. (x >=_4 y) && (y >=_4 x) = x ==' y\"\n\nEqTSOrdRel [rule_format] :\n\"ALL x. ALL y. x ==' y = (~ x <_4 y & ~ x >_4 y)\"\n\nEqFSOrdRel [rule_format] :\n\"ALL x. ALL y. (~ x ==' y) = (x <_4 y | x >_4 y)\"\n\nEqTOrdRel [rule_format] :\n\"ALL x. ALL y. x ==' y = (x <=_4 y & x >=_4 y)\"\n\nEqFOrdRel [rule_format] :\n\"ALL x. ALL y. (~ x ==' y) = (x <=_4 y | x >=_4 y)\"\n\nEqTOrdTSubstE [rule_format] :\n\"ALL x. ALL y. ALL z. x ==' y & y <_4 z --> x <_4 z\"\n\nEqTOrdFSubstE [rule_format] :\n\"ALL x. ALL y. ALL z. x ==' y & ~ y <_4 z --> ~ x <_4 z\"\n\nEqTOrdTSubstD [rule_format] :\n\"ALL x. ALL y. ALL z. x ==' y & z <_4 y --> z <_4 x\"\n\nEqTOrdFSubstD [rule_format] :\n\"ALL x. ALL y. ALL z. x ==' y & ~ z <_4 y --> ~ z <_4 x\"\n\nLeTGeFEqFRel [rule_format] :\n\"ALL x. ALL y. x <_4 y = (~ x >_4 y & ~ x ==' y)\"\n\nLeFGeTEqTRel [rule_format] :\n\"ALL x. ALL y. (~ x <_4 y) = (x >_4 y | x ==' y)\"\n\nLeTGeTRel [rule_format] : \"ALL x. ALL y. x <_4 y = y >_4 x\"\n\nLeFGeFRel [rule_format] : \"ALL x. ALL y. (~ x <_4 y) = (~ y >_4 x)\"\n\nLeqTGetTRel [rule_format] : \"ALL x. ALL y. x <=_4 y = y >=_4 x\"\n\nLeqFGetFRel [rule_format] :\n\"ALL x. ALL y. (~ x <=_4 y) = (~ y >=_4 x)\"\n\nGeTLeTRel [rule_format] : \"ALL x. ALL y. x >_4 y = y <_4 x\"\n\nGeFLeFRel [rule_format] : \"ALL x. ALL y. (~ x >_4 y) = (~ y <_4 x)\"\n\nGeqTLeqTRel [rule_format] : \"ALL x. ALL y. x >=_4 y = y <=_4 x\"\n\nGeqFLeqFRel [rule_format] :\n\"ALL x. ALL y. (~ x >=_4 y) = (~ y <=_4 x)\"\n\nLeqTGeFRel [rule_format] : \"ALL x. ALL y. x <=_4 y = (~ x >_4 y)\"\n\nLeqFGeTRel [rule_format] : \"ALL x. ALL y. (~ x <=_4 y) = x >_4 y\"\n\nGeTLeFEqFRel [rule_format] :\n\"ALL x. ALL y. x >_4 y = (~ x <_4 y & ~ x ==' y)\"\n\nGeFLeTEqTRel [rule_format] :\n\"ALL x. ALL y. (~ x >_4 y) = (x <_4 y | x ==' y)\"\n\nGeqTLeFRel [rule_format] : \"ALL x. ALL y. x >=_4 y = (~ x <_4 y)\"\n\nGeqFLeTRel [rule_format] : \"ALL x. ALL y. (~ x >=_4 y) = x <_4 y\"\n\nLeqTLeTEqTRel [rule_format] :\n\"ALL x. ALL y. x <=_4 y = (x <_4 y | x ==' y)\"\n\nLeqFLeFEqFRel [rule_format] :\n\"ALL x. ALL y. (~ x <=_4 y) = (~ x <_4 y & ~ x ==' y)\"\n\nGeqTGeTEqTRel [rule_format] :\n\"ALL x. ALL y. x >=_4 y = (x >_4 y | x ==' y)\"\n\nGeqFGeFEqFRel [rule_format] :\n\"ALL x. ALL y. (~ x >=_4 y) = (~ x >_4 y & ~ x ==' y)\"\n\nLeTGeqFRel [rule_format] : \"ALL x. ALL y. x <_4 y = (~ x >=_4 y)\"\n\nGeTLeqFRel [rule_format] : \"ALL x. ALL y. x >_4 y = (~ x <=_4 y)\"\n\nLeLeqDiff [rule_format] :\n\"ALL x. ALL y. x <_4 y = (x <=_4 y) && (x /= y)\"\n\nCmpLTDef [rule_format] :\n\"ALL x. ALL y. compare x y ==' makePartial LT = x <_4 y\"\n\nCmpEQDef [rule_format] :\n\"ALL x. ALL y. compare x y ==' makePartial EQ = x ==' y\"\n\nCmpGTDef [rule_format] :\n\"ALL x. ALL y. compare x y ==' makePartial GT = x >_4 y\"\n\nMaxYDef [rule_format] :\n\"ALL x. ALL y. X_maxX4 x y ==' y = x <=_4 y\"\n\nMaxXDef [rule_format] :\n\"ALL x. ALL y. X_maxX4 x y ==' x = y <=_4 x\"\n\nMinXDef [rule_format] :\n\"ALL x. ALL y. X_minX4 x y ==' x = x <=_4 y\"\n\nMinYDef [rule_format] :\n\"ALL x. ALL y. X_minX4 x y ==' y = y <=_4 x\"\n\nMaxSym [rule_format] :\n\"ALL x. ALL y. X_maxX4 x y ==' y = X_maxX4 y x ==' y\"\n\nMinSym [rule_format] :\n\"ALL x. ALL y. X_minX4 x y ==' y = X_minX4 y x ==' y\"\n\nTO1 [rule_format] : \"ALL x. ALL y. (x ==' y | x <_4 y) = x <=_4 y\"\n\nTO2 [rule_format] : \"ALL x. ALL y. x ==' y --> ~ x <_4 y\"\n\nTO3 [rule_format] :\n\"ALL x. ALL y. Not' Not' (x <_4 y) | Not' (x <_4 y)\"\n\nTO4 [rule_format] : \"ALL x. ALL y. x <_4 y --> Not' (x ==' y)\"\n\nTO5 [rule_format] :\n\"ALL w.\n ALL x. ALL y. ALL z. (x <_4 y & y <_4 z) & z <_4 w --> x <_4 w\"\n\nTO6 [rule_format] : \"ALL x. ALL z. z <_4 x --> Not' (x <_4 z)\"\n\nTO7 [rule_format] : \"ALL x. ALL y. x <_4 y = y >_4 x\"\n\nIUO01 [rule_format] : \"makePartial () <=_4 makePartial ()\"\n\nIUO02 [rule_format] : \"~ makePartial () <_4 makePartial ()\"\n\nIUO03 [rule_format] : \"makePartial () >=_4 makePartial ()\"\n\nIUO04 [rule_format] : \"~ makePartial () >_4 makePartial ()\"\n\nIUO05 [rule_format] :\n\"X_maxX4 (makePartial ()) (makePartial ()) ==' makePartial ()\"\n\nIUO06 [rule_format] :\n\"X_minX4 (makePartial ()) (makePartial ()) ==' makePartial ()\"\n\nIUO07 [rule_format] :\n\"compare (makePartial ()) (makePartial ()) ==' makePartial EQ\"\n\nIOO13 [rule_format] : \"makePartial LT <_4 makePartial EQ\"\n\nIOO14 [rule_format] : \"makePartial EQ <_4 makePartial GT\"\n\nIOO15 [rule_format] : \"makePartial LT <_4 makePartial GT\"\n\nIOO16 [rule_format] : \"makePartial LT <=_4 makePartial EQ\"\n\nIOO17 [rule_format] : \"makePartial EQ <=_4 makePartial GT\"\n\nIOO18 [rule_format] : \"makePartial LT <=_4 makePartial GT\"\n\nIOO19 [rule_format] : \"makePartial EQ >=_4 makePartial LT\"\n\nIOO20 [rule_format] : \"makePartial GT >=_4 makePartial EQ\"\n\nIOO21 [rule_format] : \"makePartial GT >=_4 makePartial LT\"\n\nIOO22 [rule_format] : \"makePartial EQ >_4 makePartial LT\"\n\nIOO23 [rule_format] : \"makePartial GT >_4 makePartial EQ\"\n\nIOO24 [rule_format] : \"makePartial GT >_4 makePartial LT\"\n\nIOO25 [rule_format] :\n\"X_maxX4 (makePartial LT) (makePartial EQ) ==' makePartial EQ\"\n\nIOO26 [rule_format] :\n\"X_maxX4 (makePartial EQ) (makePartial GT) ==' makePartial GT\"\n\nIOO27 [rule_format] :\n\"X_maxX4 (makePartial LT) (makePartial GT) ==' makePartial GT\"\n\nIOO28 [rule_format] :\n\"X_minX4 (makePartial LT) (makePartial EQ) ==' makePartial LT\"\n\nIOO29 [rule_format] :\n\"X_minX4 (makePartial EQ) (makePartial GT) ==' makePartial EQ\"\n\nIOO30 [rule_format] :\n\"X_minX4 (makePartial LT) (makePartial GT) ==' makePartial LT\"\n\nIOO31 [rule_format] :\n\"compare (makePartial LT) (makePartial LT) ==' makePartial EQ\"\n\nIOO32 [rule_format] :\n\"compare (makePartial EQ) (makePartial EQ) ==' makePartial EQ\"\n\nIOO33 [rule_format] :\n\"compare (makePartial GT) (makePartial GT) ==' makePartial EQ\"\n\nIBO5 [rule_format] : \"undefinedOp <_4 makePartial ()\"\n\nIBO6 [rule_format] : \"~ undefinedOp >=_4 makePartial ()\"\n\nIBO7 [rule_format] : \"makePartial () >=_4 undefinedOp\"\n\nIBO8 [rule_format] : \"~ makePartial () <_4 undefinedOp\"\n\nIBO9 [rule_format] :\n\"X_maxX4 undefinedOp (makePartial ()) ==' makePartial ()\"\n\nIBO10 [rule_format] :\n\"X_minX4 undefinedOp (makePartial ()) ==' undefinedOp\"\n\nIBO11 [rule_format] :\n\"compare (makePartial ()) (makePartial ()) ==' makePartial EQ\"\n\nIBO12 [rule_format] :\n\"compare undefinedOp undefinedOp ==' makePartial EQ\"\n\nga_selector_pre [rule_format] :\n\"ALL XX1. pre(suc'(XX1)) = makePartial XX1\"\n\nga_injective_suc [rule_format] :\n\"ALL XX1. ALL Y1. suc'(XX1) = suc'(Y1) = (XX1 = Y1)\"\n\nga_disjoint_0_suc [rule_format] : \"ALL Y1. ~ 0'' = suc'(Y1)\"\n\nga_selector_undef_pre_0 [rule_format] : \"~ defOp (pre(0''))\"\n\nX1_def_Nat [rule_format] : \"1'' = suc'(0'')\"\n\nX2_def_Nat [rule_format] : \"2'' = suc'(1'')\"\n\nX3_def_Nat [rule_format] : \"3'' = suc'(2'')\"\n\nX4_def_Nat [rule_format] : \"4'' = suc'(3'')\"\n\nX5_def_Nat [rule_format] : \"5'' = suc'(4'')\"\n\nX6_def_Nat [rule_format] : \"6'' = suc'(5'')\"\n\nX7_def_Nat [rule_format] : \"7'' = suc'(6'')\"\n\nX8_def_Nat [rule_format] : \"8'' = suc'(7'')\"\n\nX9_def_Nat [rule_format] : \"9'' = suc'(8'')\"\n\ndecimal_def [rule_format] :\n\"ALL m. ALL X_n. m @@ X_n = (m *'' suc'(9'')) +'' X_n\"\n\nga_comm___XPlus__ [rule_format] : \"ALL x. ALL y. x +'' y = y +'' x\"\n\nga_assoc___XPlus__ [rule_format] :\n\"ALL x. ALL y. ALL z. (x +'' y) +'' z = x +'' (y +'' z)\"\n\nga_right_unit___XPlus__ [rule_format] : \"ALL x. x +'' 0'' = x\"\n\nga_left_unit___XPlus__ [rule_format] : \"ALL x. 0'' +'' x = x\"\n\nga_left_comm___XPlus__ [rule_format] :\n\"ALL x. ALL y. ALL z. x +'' (y +'' z) = y +'' (x +'' z)\"\n\nga_comm___Xx__ [rule_format] : \"ALL x. ALL y. x *'' y = y *'' x\"\n\nga_assoc___Xx__ [rule_format] :\n\"ALL x. ALL y. ALL z. (x *'' y) *'' z = x *'' (y *'' z)\"\n\nga_right_unit___Xx__ [rule_format] : \"ALL x. x *'' 1'' = x\"\n\nga_left_unit___Xx__ [rule_format] : \"ALL x. 1'' *'' x = x\"\n\nga_left_comm___Xx__ [rule_format] :\n\"ALL x. ALL y. ALL z. x *'' (y *'' z) = y *'' (x *'' z)\"\n\nga_comm_min [rule_format] :\n\"ALL x. ALL y. min''(x, y) = min''(y, x)\"\n\nga_assoc_min [rule_format] :\n\"ALL x.\n ALL y. ALL z. min''(min''(x, y), z) = min''(x, min''(y, z))\"\n\nga_left_comm_min [rule_format] :\n\"ALL x.\n ALL y. ALL z. min''(x, min''(y, z)) = min''(y, min''(x, z))\"\n\nga_comm_max [rule_format] :\n\"ALL x. ALL y. max''(x, y) = max''(y, x)\"\n\nga_assoc_max [rule_format] :\n\"ALL x.\n ALL y. ALL z. max''(max''(x, y), z) = max''(x, max''(y, z))\"\n\nga_right_unit_max [rule_format] : \"ALL x. max''(x, 0'') = x\"\n\nga_left_unit_max [rule_format] : \"ALL x. max''(0'', x) = x\"\n\nga_left_comm_max [rule_format] :\n\"ALL x.\n ALL y. ALL z. max''(x, max''(y, z)) = max''(y, max''(x, z))\"\n\nleq_def1_Nat [rule_format] : \"ALL X_n. 0'' <='' X_n\"\n\ndvd_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m dvd' X_n) = (EX k. X_n = m *'' k)\"\n\nleq_def2_Nat [rule_format] : \"ALL X_n. ~ suc'(X_n) <='' 0''\"\n\nleq_def3_Nat [rule_format] :\n\"ALL m. ALL X_n. (suc'(m) <='' suc'(X_n)) = (m <='' X_n)\"\n\ngeq_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m >='' X_n) = (X_n <='' m)\"\n\nless_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m <'' X_n) = (m <='' X_n & ~ m = X_n)\"\n\ngreater_def_Nat [rule_format] :\n\"ALL m. ALL X_n. (m >'' X_n) = (X_n <'' m)\"\n\neven_0_Nat [rule_format] : \"even''(0'')\"\n\neven_suc_Nat [rule_format] : \"ALL m. even''(suc'(m)) = odd''(m)\"\n\nodd_def_Nat [rule_format] : \"ALL m. odd''(m) = (~ even''(m))\"\n\nfactorial_0 [rule_format] : \"0'' !' = 1''\"\n\nfactorial_suc [rule_format] :\n\"ALL X_n. suc'(X_n) !' = suc'(X_n) *'' X_n !'\"\n\nadd_0_Nat [rule_format] : \"ALL m. 0'' +'' m = m\"\n\nadd_suc_Nat [rule_format] :\n\"ALL m. ALL X_n. suc'(X_n) +'' m = suc'(X_n +'' m)\"\n\nmult_0_Nat [rule_format] : \"ALL m. 0'' *'' m = 0''\"\n\nmult_suc_Nat [rule_format] :\n\"ALL m. ALL X_n. suc'(X_n) *'' m = (X_n *'' m) +'' m\"\n\npower_0_Nat [rule_format] : \"ALL m. m ^'' 0'' = 1''\"\n\npower_suc_Nat [rule_format] :\n\"ALL m. ALL X_n. m ^'' suc'(X_n) = m *'' (m ^'' X_n)\"\n\nmin_def_Nat [rule_format] :\n\"ALL m. ALL X_n. min''(m, X_n) = (if m <='' X_n then m else X_n)\"\n\nmax_def_Nat [rule_format] :\n\"ALL m. ALL X_n. max''(m, X_n) = (if m <='' X_n then X_n else m)\"\n\nsubTotal_def1_Nat [rule_format] :\n\"ALL m. ALL X_n. m >'' X_n --> X_n -! m = 0''\"\n\nsubTotal_def2_Nat [rule_format] :\n\"ALL m. ALL X_n. m <='' X_n --> makePartial (X_n -! m) = X_n -? m\"\n\nsub_dom_Nat [rule_format] :\n\"ALL m. ALL X_n. defOp (m -? X_n) = (m >='' X_n)\"\n\nsub_def_Nat [rule_format] :\n\"ALL m. ALL X_n. ALL r. m -? X_n = makePartial r = (m = r +'' X_n)\"\n\ndivide_dom_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n defOp (m /?'' X_n) = (~ X_n = 0'' & m mod'' X_n = makePartial 0'')\"\n\ndivide_0_Nat [rule_format] : \"ALL m. ~ defOp (m /?'' 0'')\"\n\ndivide_Pos_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n X_n >'' 0'' --> m /?'' X_n = makePartial r = (m = r *'' X_n)\"\n\ndiv_dom_Nat [rule_format] :\n\"ALL m. ALL X_n. defOp (m div'' X_n) = (~ X_n = 0'')\"\n\ndiv_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m div'' X_n = makePartial r =\n (EX s. m = (X_n *'' r) +'' s & s <'' X_n)\"\n\nmod_dom_Nat [rule_format] :\n\"ALL m. ALL X_n. defOp (m mod'' X_n) = (~ X_n = 0'')\"\n\nmod_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL s.\n m mod'' X_n = makePartial s =\n (EX r. m = (X_n *'' r) +'' s & s <'' X_n)\"\n\ndistr1_Nat [rule_format] :\n\"ALL r. ALL s. ALL t. (r +'' s) *'' t = (r *'' t) +'' (s *'' t)\"\n\ndistr2_Nat [rule_format] :\n\"ALL r. ALL s. ALL t. t *'' (r +'' s) = (t *'' r) +'' (t *'' s)\"\n\nPos_def [rule_format] : \"ALL p. defOp (gn_proj(p)) = (p >'' 0'')\"\n\nX1_as_Pos_def [rule_format] : \"1_3 = suc''(0'')\"\n\nmin_0 [rule_format] : \"ALL m. min''(m, 0'') = 0''\"\n\ndiv_mod_Nat [rule_format] :\n\"ALL m.\n ALL X_n.\n ~ X_n = 0'' -->\n makePartial m =\n restrictOp\n (makePartial\n  ((makeTotal (m div'' X_n) *'' X_n) +'' makeTotal (m mod'' X_n)))\n (defOp (m div'' X_n) & defOp (m mod'' X_n))\"\n\npower_Nat [rule_format] :\n\"ALL m. ALL r. ALL s. m ^'' (r +'' s) = (m ^'' r) *'' (m ^'' s)\"\n\nga_generated_Int [rule_format] :\n\"ALL p_Int.\n (ALL x_1. ALL x_2. p_Int (x_1 -'' x_2)) --> (ALL x. p_Int x)\"\n\nequality_Int [rule_format] :\n\"ALL a.\n ALL b. ALL c. ALL d. a -'' b = c -'' d = (a +'' d = c +'' b)\"\n\nNat2Int_embedding [rule_format] : \"ALL a. gn_inj(a) = a -'' 0''\"\n\nga_comm___XPlus___1 [rule_format] : \"ALL x. ALL y. x +' y = y +' x\"\n\nga_assoc___XPlus___1 [rule_format] :\n\"ALL x. ALL y. ALL z. (x +' y) +' z = x +' (y +' z)\"\n\nga_right_unit___XPlus___1 [rule_format] :\n\"ALL x. x +' gn_inj(0'') = x\"\n\nga_left_unit___XPlus___1 [rule_format] :\n\"ALL x. gn_inj(0'') +' x = x\"\n\nga_left_comm___XPlus___1 [rule_format] :\n\"ALL x. ALL y. ALL z. x +' (y +' z) = y +' (x +' z)\"\n\nga_comm___Xx___1 [rule_format] : \"ALL x. ALL y. x *' y = y *' x\"\n\nga_assoc___Xx___1 [rule_format] :\n\"ALL x. ALL y. ALL z. (x *' y) *' z = x *' (y *' z)\"\n\nga_right_unit___Xx___1 [rule_format] :\n\"ALL x. x *' gn_inj(1_3) = x\"\n\nga_left_unit___Xx___1 [rule_format] : \"ALL x. gn_inj(1_3) *' x = x\"\n\nga_left_comm___Xx___1 [rule_format] :\n\"ALL x. ALL y. ALL z. x *' (y *' z) = y *' (x *' z)\"\n\nga_comm_min_1 [rule_format] :\n\"ALL x. ALL y. min'(x, y) = min'(y, x)\"\n\nga_comm_max_1 [rule_format] :\n\"ALL x. ALL y. max'(x, y) = max'(y, x)\"\n\nga_assoc_min_1 [rule_format] :\n\"ALL x. ALL y. ALL z. min'(min'(x, y), z) = min'(x, min'(y, z))\"\n\nga_assoc_max_1 [rule_format] :\n\"ALL x. ALL y. ALL z. max'(max'(x, y), z) = max'(x, max'(y, z))\"\n\nga_left_comm_min_1 [rule_format] :\n\"ALL x. ALL y. ALL z. min'(x, min'(y, z)) = min'(y, min'(x, z))\"\n\nga_left_comm_max_1 [rule_format] :\n\"ALL x. ALL y. ALL z. max'(x, max'(y, z)) = max'(y, max'(x, z))\"\n\nleq_def_Int [rule_format] :\n\"ALL m. ALL X_n. (m <=' X_n) = defOp (gn_proj(X_n -' m))\"\n\ngeq_def_Int [rule_format] :\n\"ALL m. ALL X_n. (m >=' X_n) = (X_n <=' m)\"\n\nless_def_Int [rule_format] :\n\"ALL m. ALL X_n. (m <' X_n) = (m <=' X_n & ~ m = X_n)\"\n\ngreater_def_Int [rule_format] :\n\"ALL m. ALL X_n. (m >' X_n) = (X_n <' m)\"\n\neven_def_Int [rule_format] : \"ALL m. even'(m) = even''(abs'(m))\"\n\nodd_def_Int [rule_format] : \"ALL m. odd'(m) = (~ even'(m))\"\n\nodd_alt_Int [rule_format] : \"ALL m. odd'(m) = odd''(abs'(m))\"\n\nneg_def_Int [rule_format] : \"ALL a. ALL b. -' (a -'' b) = b -'' a\"\n\nsign_def_Int [rule_format] :\n\"ALL m.\n sign(m) =\n (if m = gn_inj(0'') then gn_inj(0'')\n     else if m >' gn_inj(0'') then gn_inj(1_3) else -' gn_inj(1_3))\"\n\nabs_def_Int [rule_format] :\n\"ALL m. gn_inj(abs'(m)) = (if m <' gn_inj(0'') then -' m else m)\"\n\nadd_def_Int [rule_format] :\n\"ALL a.\n ALL b.\n ALL c. ALL d. (a -'' b) +' (c -'' d) = (a +'' c) -'' (b +'' d)\"\n\nmult_def_Int [rule_format] :\n\"ALL a.\n ALL b.\n ALL c.\n ALL d.\n (a -'' b) *' (c -'' d) =\n ((a *'' c) +'' (b *'' d)) -'' ((b *'' c) +'' (a *'' d))\"\n\nsub_def_Int [rule_format] :\n\"ALL m. ALL X_n. m -' X_n = m +' -' X_n\"\n\nmin_def_Int [rule_format] :\n\"ALL m. ALL X_n. min'(m, X_n) = (if m <=' X_n then m else X_n)\"\n\nmax_def_Int [rule_format] :\n\"ALL m. ALL X_n. max'(m, X_n) = (if m <=' X_n then X_n else m)\"\n\npower_neg1_Int [rule_format] :\n\"ALL a.\n -' gn_inj(1_3) ^' a =\n (if even''(a) then gn_inj(1_3) else -' gn_inj(1_3))\"\n\npower_others_Int [rule_format] :\n\"ALL m.\n ALL a.\n ~ m = -' gn_inj(1_3) -->\n m ^' a = (sign(m) ^' a) *' gn_inj(abs'(m) ^'' a)\"\n\ndivide_dom2_Int [rule_format] :\n\"ALL m.\n ALL X_n. defOp (m /?' X_n) = (m mod' X_n = makePartial 0'')\"\n\ndivide_alt_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m /?' X_n = makePartial r = (~ X_n = gn_inj(0'') & X_n *' r = m)\"\n\ndivide_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n m /?' X_n =\n restrictOp\n (makePartial\n  ((sign(m) *' sign(X_n)) *'\n   gn_inj(makeTotal (abs'(m) /?'' abs'(X_n)))))\n (defOp (abs'(m) /?'' abs'(X_n)))\"\n\ndiv_dom_Int [rule_format] :\n\"ALL m. ALL X_n. defOp (m div' X_n) = (~ X_n = gn_inj(0''))\"\n\ndiv_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m div' X_n = makePartial r =\n (EX a. m = (X_n *' r) +' gn_inj(a) & a <'' abs'(X_n))\"\n\nquot_dom_Int [rule_format] :\n\"ALL m. ALL X_n. defOp (m quot' X_n) = (~ X_n = gn_inj(0''))\"\n\nquot_neg_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m <' gn_inj(0'') -->\n m quot' X_n = makePartial r =\n (EX s.\n  m = (X_n *' r) +' s &\n  gn_inj(0'') >=' s & s >' -' gn_inj(abs'(X_n)))\"\n\nquot_nonneg_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL r.\n m >=' gn_inj(0'') -->\n m quot' X_n = makePartial r =\n (EX s.\n  m = (X_n *' r) +' s & gn_inj(0'') <=' s & s <' gn_inj(abs'(X_n)))\"\n\nrem_dom_Int [rule_format] :\n\"ALL m. ALL X_n. defOp (m rem' X_n) = (~ X_n = gn_inj(0''))\"\n\nquot_rem_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL s.\n m <' gn_inj(0'') -->\n m rem' X_n = makePartial s =\n (EX r.\n  m = (X_n *' r) +' s &\n  gn_inj(0'') >=' s & s >' -' gn_inj(abs'(X_n)))\"\n\nrem_nonneg_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL s.\n m >=' gn_inj(0'') -->\n m rem' X_n = makePartial s =\n (EX r.\n  m = (X_n *' r) +' s & gn_inj(0'') <=' s & s <' gn_inj(abs'(X_n)))\"\n\nmod_dom_Int [rule_format] :\n\"ALL m. ALL X_n. defOp (m mod' X_n) = (~ X_n = gn_inj(0''))\"\n\nmod_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ALL a.\n m mod' X_n = makePartial a =\n (EX r. m = (X_n *' r) +' gn_inj(a) & a <'' abs'(X_n))\"\n\ndistr1_Int [rule_format] :\n\"ALL r. ALL s. ALL t. (r +' s) *' t = (r *' t) +' (s *' t)\"\n\ndistr2_Int [rule_format] :\n\"ALL r. ALL s. ALL t. t *' (r +' s) = (t *' r) +' (t *' s)\"\n\nInt_Nat_sub_compat [rule_format] :\n\"ALL a.\n ALL b.\n defOp (a -? b) -->\n restrictOp (makePartial (gn_inj(makeTotal (a -? b))))\n (defOp (a -? b)) =\n makePartial (a -'' b)\"\n\nabs_decomp_Int [rule_format] :\n\"ALL m. m = sign(m) *' gn_inj(abs'(m))\"\n\nmod_abs_Int [rule_format] :\n\"ALL m. ALL X_n. m mod' X_n = m mod' gn_inj(abs'(X_n))\"\n\ndiv_mod_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n ~ X_n = gn_inj(0'') -->\n makePartial m =\n restrictOp\n (makePartial\n  ((makeTotal (m div' X_n) *' X_n) +'\n   gn_inj(makeTotal (m mod' X_n))))\n (defOp (m div' X_n) & defOp (m mod' X_n))\"\n\nquot_abs_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n restrictOp (makePartial (gn_inj(abs'(makeTotal (m quot' X_n)))))\n (defOp (m quot' X_n)) =\n gn_inj(abs'(m)) quot' gn_inj(abs'(X_n))\"\n\nrem_abs_Int [rule_format] :\n\"ALL m.\n ALL X_n.\n restrictOp (makePartial (gn_inj(abs'(makeTotal (m rem' X_n)))))\n (defOp (m rem' X_n)) =\n gn_inj(abs'(m)) rem' gn_inj(abs'(X_n))\"\n\nquot_rem_Int_1 [rule_format] :\n\"ALL m.\n ALL X_n.\n ~ X_n = gn_inj(0'') -->\n makePartial m =\n restrictOp\n (makePartial\n  ((makeTotal (m quot' X_n) *' X_n) +' makeTotal (m rem' X_n)))\n (defOp (m quot' X_n) & defOp (m rem' X_n))\"\n\npower_Int [rule_format] :\n\"ALL m. ALL a. ALL b. m ^' (a +'' b) = (m ^' a) *' (m ^' b)\"\n\nga_generated_Rat [rule_format] :\n\"ALL p_Rat.\n (ALL x_1. ALL x_2. p_Rat (x_1 /' x_2)) --> (ALL x. p_Rat x)\"\n\nequality_Rat [rule_format] :\n\"ALL i.\n ALL j.\n ALL p. ALL q. i /' p = j /' q = (i *' gn_inj(q) = j *' gn_inj(p))\"\n\nInt2Rat_embedding [rule_format] : \"ALL i. gn_inj(i) = i /' 1_3\"\n\nga_comm___XPlus___2_1 [rule_format] :\n\"ALL x. ALL y. x +_5 y = y +_5 x\"\n\nga_assoc___XPlus___2_1 [rule_format] :\n\"ALL x. ALL y. ALL z. (x +_5 y) +_5 z = x +_5 (y +_5 z)\"\n\nga_right_unit___XPlus___2_1 [rule_format] :\n\"ALL x. x +_5 gn_inj(0'') = x\"\n\nga_left_unit___XPlus___2_1 [rule_format] :\n\"ALL x. gn_inj(0'') +_5 x = x\"\n\nga_left_comm___XPlus___2_1 [rule_format] :\n\"ALL x. ALL y. ALL z. x +_5 (y +_5 z) = y +_5 (x +_5 z)\"\n\nga_comm___Xx___2_1 [rule_format] :\n\"ALL x. ALL y. x *_4 y = y *_4 x\"\n\nga_assoc___Xx___2_1 [rule_format] :\n\"ALL x. ALL y. ALL z. (x *_4 y) *_4 z = x *_4 (y *_4 z)\"\n\nga_right_unit___Xx___2_1 [rule_format] :\n\"ALL x. x *_4 gn_inj(1_3) = x\"\n\nga_left_unit___Xx___2_1 [rule_format] :\n\"ALL x. gn_inj(1_3) *_4 x = x\"\n\nga_left_comm___Xx___2_1 [rule_format] :\n\"ALL x. ALL y. ALL z. x *_4 (y *_4 z) = y *_4 (x *_4 z)\"\n\nga_comm_min_2_1 [rule_format] :\n\"ALL x. ALL y. min_3(x, y) = min_3(y, x)\"\n\nga_comm_max_2_1 [rule_format] :\n\"ALL x. ALL y. max_3(x, y) = max_3(y, x)\"\n\nga_assoc_min_2_1 [rule_format] :\n\"ALL x.\n ALL y. ALL z. min_3(min_3(x, y), z) = min_3(x, min_3(y, z))\"\n\nga_assoc_max_2_1 [rule_format] :\n\"ALL x.\n ALL y. ALL z. max_3(max_3(x, y), z) = max_3(x, max_3(y, z))\"\n\nga_left_comm_min_2_1 [rule_format] :\n\"ALL x.\n ALL y. ALL z. min_3(x, min_3(y, z)) = min_3(y, min_3(x, z))\"\n\nga_left_comm_max_2_1 [rule_format] :\n\"ALL x.\n ALL y. ALL z. max_3(x, max_3(y, z)) = max_3(y, max_3(x, z))\"\n\nleq_def_Rat [rule_format] :\n\"ALL p.\n ALL q.\n ALL i.\n ALL j. (i /' p <=_3 j /' q) = (i *' gn_inj(q) <=' j *' gn_inj(p))\"\n\ngeq_def_Rat [rule_format] : \"ALL x. ALL y. (x >=_3 y) = (y <=_3 x)\"\n\nless_def_Rat [rule_format] :\n\"ALL x. ALL y. (x <_3 y) = (x <=_3 y & ~ x = y)\"\n\ngreater_def_Rat [rule_format] :\n\"ALL x. ALL y. (x >_3 y) = (y <_3 x)\"\n\nminus_def_Rat [rule_format] :\n\"ALL p. ALL i. -'' (i /' p) = -' i /' p\"\n\nabs_def_Rat [rule_format] :\n\"ALL p. ALL i. abs''(i /' p) = gn_inj(abs'(i)) /' p\"\n\nadd_def_Rat [rule_format] :\n\"ALL p.\n ALL q.\n ALL i.\n ALL j.\n (i /' p) +_5 (j /' q) =\n ((i *' gn_inj(q)) +' (j *' gn_inj(p))) /' (p *_3 q)\"\n\nsub_def_Rat [rule_format] : \"ALL x. ALL y. x -_3 y = x +_5 -'' y\"\n\nmult_def_Rat [rule_format] :\n\"ALL p.\n ALL q. ALL i. ALL j. (i /' p) *_4 (j /' q) = (i *' j) /' (p *_3 q)\"\n\nmin_def_Rat [rule_format] :\n\"ALL x. ALL y. min_3(x, y) = (if x <=_3 y then x else y)\"\n\nmax_def_Rat [rule_format] :\n\"ALL x. ALL y. max_3(x, y) = (if x <=_3 y then y else x)\"\n\ndivide_def1_Rat [rule_format] :\n\"ALL x. ~ defOp (x /'' gn_inj(0''))\"\n\ndivide_def2_Rat [rule_format] :\n\"ALL x.\n ALL y.\n ALL z.\n ~ y = gn_inj(0'') --> x /'' y = makePartial z = (x = z *_4 y)\"\n\npower_0_Rat [rule_format] :\n\"ALL x. x ^_3 gn_inj(0'') = makePartial (gn_inj(1_3))\"\n\npower_suc_Rat [rule_format] :\n\"ALL X_n.\n ALL x.\n x ^_3 gn_inj(suc''(X_n)) =\n restrictOp (makePartial (x *_4 makeTotal (x ^_3 gn_inj(X_n))))\n (defOp (x ^_3 gn_inj(X_n)))\"\n\npower_neg_Rat [rule_format] :\n\"ALL p.\n ALL x.\n x ^_3 -' gn_inj(p) =\n restrictOp (gn_inj(1_3) /'' makeTotal (x ^_3 gn_inj(p)))\n (defOp (x ^_3 gn_inj(p)))\"\n\ndistr1_Rat [rule_format] :\n\"ALL x. ALL y. ALL z. (x +_5 y) *_4 z = (x *_4 z) +_5 (y *_4 z)\"\n\ndistr2_Rat [rule_format] :\n\"ALL x. ALL y. ALL z. z *_4 (x +_5 y) = (z *_4 x) +_5 (z *_4 y)\"\n\nsub_rule_Rat [rule_format] :\n\"ALL i.\n ALL j.\n ALL p.\n ALL q.\n (i /' p) -_3 (j /' q) =\n ((i *' gn_inj(q)) -' (j *' gn_inj(p))) /' (p *_3 q)\"\n\ndivide_dom_Rat [rule_format] :\n\"ALL x. ALL y. defOp (x /'' y) = (~ y = gn_inj(0''))\"\n\ndivide_rule_Rat [rule_format] :\n\"ALL i.\n ALL j.\n ALL p.\n ALL q.\n ~ j = gn_inj(0'') -->\n (i /' p) /'' (j /' q) =\n gn_inj(i *' gn_inj(q)) /'' gn_inj(gn_inj(p) *' j)\"\n\npower_Rat [rule_format] :\n\"ALL i.\n ALL j.\n ALL x.\n x ^_3 (i +' j) =\n restrictOp\n (makePartial (makeTotal (x ^_3 i) *_4 makeTotal (x ^_3 j)))\n (defOp (x ^_3 i) & defOp (x ^_3 j))\"\n\nIPN01 [rule_format] :\n\"ALL x.\n ALL y.\n makePartial (gn_inj(x) +' gn_inj(y)) =\n gn_inj(gn_inj(x) +'' gn_inj(y))\"\n\nIPN02 [rule_format] :\n\"ALL x.\n ALL y.\n makePartial (gn_inj(x) *' gn_inj(y)) =\n gn_inj(gn_inj(x) *'' gn_inj(y))\"\n\nIPN03 [rule_format] :\n\"ALL x.\n ALL y.\n makePartial (gn_inj(x) -' gn_inj(y)) =\n gn_inj(gn_inj(x) -! gn_inj(y))\"\n\nIPN04 [rule_format] :\n\"ALL x.\n gn_inj(negate(makePartial x)) = makePartial (0'' -! gn_inj(x))\"\n\nIPN05 [rule_format] : \"ALL x. abs_3(makePartial x) = makePartial x\"\n\nIPN06 [rule_format] :\n\"ALL x. signum(makePartial x) = makePartial 1_3\"\n\nIPN07 [rule_format] : \"ALL z. fromInteger(z) = gn_proj(z)\"\n\nINN01 [rule_format] :\n\"ALL x.\n ALL y. makePartial (gn_inj(x) +' gn_inj(y)) = gn_inj(x +'' y)\"\n\nINN02 [rule_format] :\n\"ALL x.\n ALL y. makePartial (gn_inj(x) *' gn_inj(y)) = gn_inj(x *'' y)\"\n\nINN03 [rule_format] :\n\"ALL x.\n ALL y. makePartial (gn_inj(x) -' gn_inj(y)) = gn_inj(x -! y)\"\n\nINN04 [rule_format] :\n\"ALL x. negate(makePartial x) = makePartial (0'' -! x)\"\n\nINN05 [rule_format] : \"ALL x. abs_3(makePartial x) = makePartial x\"\n\nINN06 [rule_format] : \"ALL x. signum(makePartial x) = gn_inj(1_3)\"\n\nINN07 [rule_format] : \"ALL z. fromInteger(z) = gn_proj(z)\"\n\nIIN01 [rule_format] : \"ALL x. ALL y. x +' y = x +' y\"\n\nIIN02 [rule_format] : \"ALL x. ALL y. x *' y = x *' y\"\n\nIIN03 [rule_format] : \"ALL x. ALL y. x -' y = x -' y\"\n\nIIN04 [rule_format] :\n\"ALL x. negate(makePartial x) = makePartial (gn_inj(0'') -' x)\"\n\nIIN05 [rule_format] :\n\"ALL x.\n gn_inj(x) >=_3 gn_inj(0'') -->\n abs_3(makePartial x) = makePartial x\"\n\nIIN06 [rule_format] :\n\"ALL x.\n gn_inj(x) <_3 gn_inj(0'') -->\n abs_3(makePartial x) = negate(makePartial x)\"\n\nIIN07 [rule_format] :\n\"ALL x.\n gn_inj(x) >_3 gn_inj(0'') --> signum(makePartial x) = gn_inj(1_3)\"\n\nIIN07_1 [rule_format] :\n\"ALL x.\n makePartial x ==' gn_inj(0'') -->\n signum(makePartial x) = gn_inj(0'')\"\n\nIIN08 [rule_format] :\n\"ALL x.\n gn_inj(x) <_3 gn_inj(0'') -->\n signum(makePartial x) = makePartial (-' gn_inj(1_3))\"\n\nIIN09 [rule_format] : \"ALL x. fromInteger(x) = makePartial x\"\n\nIRN01 [rule_format] : \"ALL x. ALL y. x +_5 y = x +_5 y\"\n\nIRN02 [rule_format] : \"ALL x. ALL y. x *_4 y = x *_4 y\"\n\nIRN03 [rule_format] : \"ALL x. ALL y. x -_3 y = x -_3 y\"\n\nIRN04 [rule_format] :\n\"ALL x. negate(makePartial x) = makePartial (gn_inj(0'') -_3 x)\"\n\nIRN05 [rule_format] :\n\"ALL x.\n x >=_3 gn_inj(0'') --> abs_3(makePartial x) = makePartial x\"\n\nIRN06 [rule_format] :\n\"ALL x.\n x <_3 gn_inj(0'') --> abs_3(makePartial x) = negate(makePartial x)\"\n\nIRN07 [rule_format] :\n\"ALL x. x >_3 gn_inj(0'') --> signum(makePartial x) = gn_inj(1_3)\"\n\nIRN07_1 [rule_format] :\n\"ALL x.\n makePartial x ==' gn_inj(0'') -->\n signum(makePartial x) = gn_inj(0'')\"\n\nIRN08 [rule_format] :\n\"ALL x.\n x <_3 gn_inj(0'') -->\n signum(makePartial x) = gn_inj(-' gn_inj(1_3))\"\n\nIRN09 [rule_format] :\n\"ALL z. fromInteger(z) = makePartial (z /' 1_3)\"\n\nIRI01 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (quotRem x y))) -->\n x quot'' y = z\"\n\nIRI02 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (quotRem x y))) -->\n x rem'' y = w\"\n\nIRI03 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (divMod x y))) -->\n x div_3 y = z\"\n\nIRI04 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (divMod x y))) -->\n x mod_3 y = w\"\n\nIRI05 [rule_format] :\n\"ALL s.\n ALL w.\n ALL x.\n ALL y.\n ALL z.\n signum(w) = negate(signum(y)) &\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (quotRem x y))) -->\n makePartial (mapSnd makeTotal (mapFst makeTotal (divMod x y))) =\n restrictOp\n (makePartial\n  (makeTotal\n   (z -_4 fromInteger(toInteger(makePartial (gn_inj(1_3))))),\n   makeTotal (w +_6 s)))\n (defOp (z -_4 fromInteger(toInteger(makePartial (gn_inj(1_3))))) &\n  defOp (w +_6 s))\"\n\nIRI06 [rule_format] :\n\"ALL w.\n ALL x.\n ALL y.\n ALL z.\n ~ signum(w) = negate(signum(y)) &\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w) =\n makePartial (mapSnd makeTotal (mapFst makeTotal (quotRem x y))) -->\n makePartial (mapSnd makeTotal (mapFst makeTotal (divMod x y))) =\n restrictOp (makePartial (makeTotal z, makeTotal w))\n (defOp z & defOp w)\"\n\nIRI01_1 [rule_format] :\n\"ALL x. gn_inj(recip(makePartial x)) = gn_inj(1_3) /'' gn_inj(x)\"\n\nIRI02_1 [rule_format] :\n\"ALL x.\n ALL y.\n gn_inj(x) /'' gn_inj(y) =\n restrictOp (gn_inj(x *' makeTotal (recip(makePartial y))))\n (defOp (recip(makePartial y)))\"\n\nIRF01 [rule_format] :\n\"ALL x. recip(makePartial x) = gn_inj(1_3) /'' x\"\n\nIRF02 [rule_format] :\n\"ALL x.\n ALL y.\n x /'' y =\n restrictOp (makePartial (x *_4 makeTotal (recip(makePartial y))))\n (defOp (recip(makePartial y)))\"\n\ndeclare NotFalse [simp]\ndeclare NotTrue [simp]\ndeclare AndFalse [simp]\ndeclare AndTrue [simp]\ndeclare OtherwiseDef [simp]\ndeclare NotTrue1 [simp]\ndeclare EqualReflex [simp]\ndeclare IUE1 [simp]\ndeclare IUE2 [simp]\ndeclare IBE1 [simp]\ndeclare IBE2 [simp]\ndeclare IBE3 [simp]\ndeclare IBE4 [simp]\ndeclare IBE5 [simp]\ndeclare IBE6 [simp]\ndeclare IBE7 [simp]\ndeclare IBE8 [simp]\ndeclare IOE01 [simp]\ndeclare IOE02 [simp]\ndeclare IOE03 [simp]\ndeclare IOE04 [simp]\ndeclare IOE05 [simp]\ndeclare IOE06 [simp]\ndeclare IOE07 [simp]\ndeclare IOE08 [simp]\ndeclare IOE09 [simp]\ndeclare LeIrreflexivity [simp]\ndeclare LeTAsymmetry [simp]\ndeclare GeIrreflexivity [simp]\ndeclare GeTAsymmetry [simp]\ndeclare GeTTransitive [simp]\ndeclare GeTTotal [simp]\ndeclare LeqReflexivity [simp]\ndeclare LeqTTransitive [simp]\ndeclare LeqTTotal [simp]\ndeclare GeqReflexivity [simp]\ndeclare GeqTTransitive [simp]\ndeclare GeqTTotal [simp]\ndeclare CmpLTDef [simp]\ndeclare CmpEQDef [simp]\ndeclare CmpGTDef [simp]\ndeclare MaxYDef [simp]\ndeclare MaxXDef [simp]\ndeclare MinXDef [simp]\ndeclare MinYDef [simp]\ndeclare TO2 [simp]\ndeclare TO4 [simp]\ndeclare TO6 [simp]\ndeclare IUO01 [simp]\ndeclare IUO02 [simp]\ndeclare IUO03 [simp]\ndeclare IUO04 [simp]\ndeclare IUO05 [simp]\ndeclare IUO06 [simp]\ndeclare IUO07 [simp]\ndeclare IOO13 [simp]\ndeclare IOO14 [simp]\ndeclare IOO15 [simp]\ndeclare IOO16 [simp]\ndeclare IOO17 [simp]\ndeclare IOO18 [simp]\ndeclare IOO19 [simp]\ndeclare IOO20 [simp]\ndeclare IOO21 [simp]\ndeclare IOO22 [simp]\ndeclare IOO23 [simp]\ndeclare IOO24 [simp]\ndeclare IOO25 [simp]\ndeclare IOO26 [simp]\ndeclare IOO27 [simp]\ndeclare IOO28 [simp]\ndeclare IOO29 [simp]\ndeclare IOO30 [simp]\ndeclare IOO31 [simp]\ndeclare IOO32 [simp]\ndeclare IOO33 [simp]\ndeclare IBO5 [simp]\ndeclare IBO6 [simp]\ndeclare IBO7 [simp]\ndeclare IBO8 [simp]\ndeclare IBO9 [simp]\ndeclare IBO10 [simp]\ndeclare IBO11 [simp]\ndeclare IBO12 [simp]\ndeclare ga_selector_pre [simp]\ndeclare ga_selector_undef_pre_0 [simp]\ndeclare ga_comm___XPlus__ [simp]\ndeclare ga_assoc___XPlus__ [simp]\ndeclare ga_right_unit___XPlus__ [simp]\ndeclare ga_left_unit___XPlus__ [simp]\ndeclare ga_left_comm___XPlus__ [simp]\ndeclare ga_comm___Xx__ [simp]\ndeclare ga_assoc___Xx__ [simp]\ndeclare ga_right_unit___Xx__ [simp]\ndeclare ga_left_unit___Xx__ [simp]\ndeclare ga_left_comm___Xx__ [simp]\ndeclare ga_comm_min [simp]\ndeclare ga_assoc_min [simp]\ndeclare ga_left_comm_min [simp]\ndeclare ga_comm_max [simp]\ndeclare ga_assoc_max [simp]\ndeclare ga_right_unit_max [simp]\ndeclare ga_left_unit_max [simp]\ndeclare ga_left_comm_max [simp]\ndeclare leq_def1_Nat [simp]\ndeclare dvd_def_Nat [simp]\ndeclare leq_def2_Nat [simp]\ndeclare leq_def3_Nat [simp]\ndeclare geq_def_Nat [simp]\ndeclare less_def_Nat [simp]\ndeclare greater_def_Nat [simp]\ndeclare even_0_Nat [simp]\ndeclare even_suc_Nat [simp]\ndeclare odd_def_Nat [simp]\ndeclare factorial_0 [simp]\ndeclare factorial_suc [simp]\ndeclare add_0_Nat [simp]\ndeclare add_suc_Nat [simp]\ndeclare mult_0_Nat [simp]\ndeclare mult_suc_Nat [simp]\ndeclare power_0_Nat [simp]\ndeclare power_suc_Nat [simp]\ndeclare subTotal_def1_Nat [simp]\ndeclare subTotal_def2_Nat [simp]\ndeclare sub_dom_Nat [simp]\ndeclare divide_0_Nat [simp]\ndeclare min_0 [simp]\ndeclare ga_comm___XPlus___1 [simp]\ndeclare ga_assoc___XPlus___1 [simp]\ndeclare ga_right_unit___XPlus___1 [simp]\ndeclare ga_left_unit___XPlus___1 [simp]\ndeclare ga_left_comm___XPlus___1 [simp]\ndeclare ga_comm___Xx___1 [simp]\ndeclare ga_assoc___Xx___1 [simp]\ndeclare ga_right_unit___Xx___1 [simp]\ndeclare ga_left_unit___Xx___1 [simp]\ndeclare ga_left_comm___Xx___1 [simp]\ndeclare ga_comm_min_1 [simp]\ndeclare ga_comm_max_1 [simp]\ndeclare ga_assoc_min_1 [simp]\ndeclare ga_assoc_max_1 [simp]\ndeclare ga_left_comm_min_1 [simp]\ndeclare ga_left_comm_max_1 [simp]\ndeclare leq_def_Int [simp]\ndeclare even_def_Int [simp]\ndeclare odd_alt_Int [simp]\ndeclare neg_def_Int [simp]\ndeclare sign_def_Int [simp]\ndeclare abs_def_Int [simp]\ndeclare add_def_Int [simp]\ndeclare mult_def_Int [simp]\ndeclare sub_def_Int [simp]\ndeclare min_def_Int [simp]\ndeclare max_def_Int [simp]\ndeclare power_neg1_Int [simp]\ndeclare power_others_Int [simp]\ndeclare divide_Int [simp]\ndeclare div_Int [simp]\ndeclare quot_neg_Int [simp]\ndeclare quot_nonneg_Int [simp]\ndeclare quot_rem_Int [simp]\ndeclare rem_nonneg_Int [simp]\ndeclare mod_Int [simp]\ndeclare Int_Nat_sub_compat [simp]\ndeclare quot_abs_Int [simp]\ndeclare rem_abs_Int [simp]\ndeclare ga_comm___XPlus___2_1 [simp]\ndeclare ga_assoc___XPlus___2_1 [simp]\ndeclare ga_right_unit___XPlus___2_1 [simp]\ndeclare ga_left_unit___XPlus___2_1 [simp]\ndeclare ga_left_comm___XPlus___2_1 [simp]\ndeclare ga_comm___Xx___2_1 [simp]\ndeclare ga_assoc___Xx___2_1 [simp]\ndeclare ga_right_unit___Xx___2_1 [simp]\ndeclare ga_left_unit___Xx___2_1 [simp]\ndeclare ga_left_comm___Xx___2_1 [simp]\ndeclare ga_comm_min_2_1 [simp]\ndeclare ga_comm_max_2_1 [simp]\ndeclare ga_assoc_min_2_1 [simp]\ndeclare ga_assoc_max_2_1 [simp]\ndeclare ga_left_comm_min_2_1 [simp]\ndeclare ga_left_comm_max_2_1 [simp]\ndeclare divide_def1_Rat [simp]\ndeclare power_0_Rat [simp]\ndeclare IPN05 [simp]\ndeclare IPN06 [simp]\ndeclare INN01 [simp]\ndeclare INN02 [simp]\ndeclare INN03 [simp]\ndeclare INN05 [simp]\ndeclare INN06 [simp]\ndeclare IIN05 [simp]\ndeclare IIN07 [simp]\ndeclare IIN07_1 [simp]\ndeclare IRN05 [simp]\ndeclare IRN07 [simp]\ndeclare IRN07_1 [simp]\n\ntheorem AbsSignumLaw : \"ALL x. abs_3(x) *_5 signum(x) = x\"\nusing X1_def_Nat X2_def_Nat X3_def_Nat X4_def_Nat X5_def_Nat\n      X6_def_Nat X7_def_Nat X8_def_Nat X9_def_Nat decimal_def Pos_def\n      X1_as_Pos_def\nby (auto)\n\nML \"Header.record \\\"AbsSignumLaw\\\"\"\n\nend\n", "meta": {"author": "glaubersp", "repo": "HasCASL-Library_Source", "sha": "be605b06acfc124d8e88829cc931a1148ea30460", "save_path": "github-repos/isabelle/glaubersp-HasCASL-Library_Source", "path": "github-repos/isabelle/glaubersp-HasCASL-Library_Source/HasCASL-Library_Source-be605b06acfc124d8e88829cc931a1148ea30460/Prelude.newBool_Cpo.deprecated/Prelude_NumericClasses.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6224593452091672, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3112296726045836}}
{"text": "(*******************************************************************************\n\n  Project: Refining Authenticated Key Agreement with Strong Adversaries\n\n  Module:  Channels.thy (Isabelle/HOL 2016-1)\n  ID:      $Id: Channels.thy 132885 2016-12-23 18:41:32Z csprenge $\n  Author:  Joseph Lallemand, INRIA Nancy <joseph.lallemand@loria.fr>\n           Christoph Sprenger, ETH Zurich <sprenger@inf.ethz.ch>\n  \n  Channel messages and related message derivations (extract and fake).\n\n  Copyright (c) 2015-2016 Joseph Lallemand and Christoph Sprenger\n  Licence: LGPL\n\n*******************************************************************************)\n\nsection \\<open>Channel Messages\\<close>\n\ntheory Channels\nimports Message_derivation\nbegin\n\n(**************************************************************************************************)\nsubsection \\<open>Channel messages\\<close>\n(**************************************************************************************************)\n\ndatatype chan = \n  Chan \"tag\" \"agent\" \"agent\" \"msg\"\n\n\nabbreviation \n  Insec :: \"[agent, agent, msg] \\<Rightarrow> chan\" where\n  \"Insec \\<equiv> Chan insec\"\n\nabbreviation \n  Confid :: \"[agent, agent, msg] \\<Rightarrow> chan\" where\n  \"Confid \\<equiv> Chan confid\"\n\nabbreviation \n  Auth :: \"[agent, agent, msg] \\<Rightarrow> chan\" where\n  \"Auth \\<equiv> Chan auth\"\n\nabbreviation \n  Secure :: \"[agent, agent, msg] \\<Rightarrow> chan\" where\n  \"Secure \\<equiv> Chan secure\"\n\n\n(**************************************************************************************************)\nsubsection \\<open>Extract\\<close>\n(**************************************************************************************************)\n\ntext \\<open>The set of payload messages that can be extracted from a set of (crypto) messages \nand a set of channel messages, given a set of bad agents. The second rule states that \nthe payload can be extracted from insecure and authentic channels as well as from channels\nwith a compromised endpoint.\\<close>\n\ninductive_set \n  extr :: \"agent set \\<Rightarrow> msg set \\<Rightarrow> chan set \\<Rightarrow> msg set\"  \n  for bad :: \"agent set\"\n  and IK :: \"msg set\"\n  and H :: \"chan set\"\nwhere \n  extr_Inj: \"M \\<in> IK \\<Longrightarrow> M \\<in> extr bad IK H\"\n| extr_Chan: \n    \"\\<lbrakk> Chan c A B M \\<in> H; c = insec \\<or> c = auth \\<or> A \\<in> bad \\<or> B \\<in> bad \\<rbrakk> \\<Longrightarrow> M \\<in> extr bad IK H\"\n\ndeclare extr.intros [intro]\ndeclare extr.cases [elim]\n\n\nlemma extr_empty_chan [simp]: \"extr bad IK {} = IK\"\nby (auto)\n\nlemma IK_subset_extr: \"IK \\<subseteq> extr bad IK chan\"\nby (auto)\n\nlemma extr_mono_chan [dest]: \"G \\<subseteq> H \\<Longrightarrow> extr bad IK G \\<subseteq> extr bad IK H\"\nby (safe, erule extr.induct, auto)\n\nlemma extr_mono_IK [dest]: \"IK1 \\<subseteq> IK2 \\<Longrightarrow> extr bad IK1 H \\<subseteq> extr bad IK2 H\"\nby (safe) (erule extr.induct, auto)\n\nlemma extr_mono_bad [dest]: \"bad \\<subseteq> bad' \\<Longrightarrow> extr bad IK H \\<subseteq> extr bad' IK H\"\nby (safe, erule extr.induct, auto)\n\nlemmas extr_monotone_chan [elim] = extr_mono_chan [THEN [2] rev_subsetD]\nlemmas extr_monotone_IK [elim] = extr_mono_IK [THEN [2] rev_subsetD]\nlemmas extr_monotone_bad [elim] = extr_mono_bad [THEN [2] rev_subsetD]\n\nlemma extr_mono [intro]: \"\\<lbrakk> b \\<subseteq> b'; I \\<subseteq> I'; C \\<subseteq> C' \\<rbrakk> \\<Longrightarrow> extr b I C \\<subseteq> extr b' I' C'\"\nby (force)\n\nlemmas extr_monotone [elim] = extr_mono [THEN [2] rev_subsetD]\n\nlemma extr_insert [intro]: \"M \\<in> extr bad IK H \\<Longrightarrow> M \\<in> extr bad IK (insert C H)\"\nby (auto)\n\nlemma extr_insert_Chan [simp]: \n  \"extr bad IK (insert (Chan c A B M) H) \n   = (if c = insec \\<or> c = auth \\<or> A \\<in> bad \\<or> B \\<in> bad \n      then insert M (extr bad IK H) else extr bad IK H)\"\nby auto\n\n(* do not declare [simp]! *)\nlemma extr_insert_chan_eq: \"extr bad IK (insert X CH) = extr bad IK {X} \\<union> extr bad IK CH\"\nby (auto)\n\nlemma extr_insert_IK_eq [simp]: \"extr bad (insert X IK) CH = insert X (extr bad IK CH)\"\nby (auto)\n\nlemma extr_insert_bad:\n  \"extr (insert A bad) IK CH \\<subseteq>\n   extr bad IK CH \\<union> {M. \\<exists> B. Confid A B M \\<in> CH \\<or> Confid B A M \\<in> CH \\<or>\n                             Secure A B M \\<in> CH \\<or> Secure B A M \\<in> CH}\"\nby (rule, erule extr.induct, auto intro: tag.exhaust)\n\nlemma extr_insert_Confid [simp]:\n  \"A \\<notin> bad \\<Longrightarrow>\n   B \\<notin> bad \\<Longrightarrow> \n   extr bad IK (insert (Confid A B X) CH) = extr bad IK CH\"\nby auto\n\n\n(**************************************************************************************************)\nsubsection \\<open>Fake\\<close>\n(**************************************************************************************************)\n\ntext \\<open>The set of channel messages that an attacker can fake given a set of compromised\nagents, a set of crypto messages and a set of channel messages. The second rule states\nthat an attacker can fake an insecure or confidential messages or a channel message\nwith a compromised endpoint using a payload that he knows.\\<close>\n\ninductive_set \n  fake :: \"agent set \\<Rightarrow> msg set \\<Rightarrow> chan set \\<Rightarrow> chan set\"\n  for bad :: \"agent set\"\n  and IK :: \"msg set\"\n  and chan :: \"chan set\"\nwhere \n  fake_Inj: \"M \\<in> chan \\<Longrightarrow> M \\<in> fake bad IK chan\"\n| fake_New: \n    \"\\<lbrakk> M \\<in> IK; c = insec \\<or> c = confid \\<or> A \\<in> bad \\<or> B \\<in> bad  \\<rbrakk> \n   \\<Longrightarrow> Chan c A B M \\<in> fake bad IK chan\"\n\ndeclare fake.cases [elim]\ndeclare fake.intros [intro]\n\nlemmas fake_intros = fake_Inj fake_New\n\nlemma fake_mono_bad [intro]: \n  \"bad \\<subseteq> bad' \\<Longrightarrow> fake bad IK chan \\<subseteq> fake bad' IK chan\" \nby (auto)\n\nlemma fake_mono_ik [intro]: \n  \"IK \\<subseteq> IK' \\<Longrightarrow> fake bad IK chan \\<subseteq> fake bad IK' chan\" \nby (auto)\n\nlemma fake_mono_chan [intro]: \n  \"chan \\<subseteq> chan' \\<Longrightarrow> fake bad IK chan \\<subseteq> fake bad IK chan'\" \nby (auto)\n\nlemma fake_mono [intro]: \n  \"\\<lbrakk> bad \\<subseteq> bad'; IK \\<subseteq> IK'; chan \\<subseteq> chan'\\<rbrakk> \\<Longrightarrow> fake bad IK chan \\<subseteq> fake bad' IK' chan'\" \nby (auto, erule fake.cases, auto)\n\nlemmas fake_monotone_bad [elim] = fake_mono_bad [THEN [2] rev_subsetD]\nlemmas fake_monotone_ik [elim] = fake_mono_ik [THEN [2] rev_subsetD]\nlemmas fake_monotone_chan [elim] = fake_mono_chan [THEN [2] rev_subsetD]\nlemmas fake_monotone [elim] = fake_mono [THEN [2] rev_subsetD]\n\n\nlemma chan_subset_fake: \"chan \\<subseteq> fake bad IK chan\"\nby auto\n\nlemma extr_fake:\n  \"X \\<in> fake bad IK chan \\<Longrightarrow> extr bad IK' {X} \\<subseteq> IK \\<union> extr bad IK' chan\"\nby auto\n\nlemmas extr_fake_2 [elim] = extr_fake [THEN [2] rev_subsetD]\n\nlemma fake_parts_extr_singleton:  \n  \"X \\<in> fake bad IK chan \\<Longrightarrow> parts (extr bad IK' {X}) \\<subseteq> parts IK \\<union> parts (extr bad IK' chan)\"\nby (rule extr_fake [THEN parts_mono, simplified])\n\nlemmas fake_parts_extr_singleton_2 [elim] = fake_parts_extr_singleton [THEN [2] rev_subsetD]\n\n\nlemma fake_parts_extr_insert: \nassumes \"X \\<in> fake bad IK CH\"\nshows \"parts (extr bad IK' (insert X CH)) \\<subseteq> parts (extr bad IK' CH) \\<union> parts IK\"\nproof -\n  have \"parts (extr bad IK' (insert X CH)) \\<subseteq> parts (extr bad IK' {X}) \\<union> parts (extr bad IK' CH)\" \n    by (auto simp: extr_insert_chan_eq [where CH=CH])\n  also have \"... \\<subseteq> parts (extr bad IK' CH) \\<union> parts IK\" using assms\n    by (auto dest!: fake_parts_extr_singleton)\n  finally show ?thesis .\nqed\n\n\nlemma fake_synth_analz_extr: \nassumes  \"X \\<in> fake bad (synth (analz (extr bad IK CH))) CH\"\nshows \"synth (analz (extr bad IK (insert X CH))) = synth (analz (extr bad IK CH))\"\nusing assms\nproof (intro equalityI) \n  have \"synth (analz (extr bad IK (insert X CH))) \n     \\<subseteq> synth (analz (extr bad IK {X} \\<union> extr bad IK CH))\"\n    by - (rule synth_analz_mono, auto)\n  also have \"... \\<subseteq> synth (analz (synth (analz (extr bad IK CH)) \\<union> extr bad IK CH))\" using assms\n    by - (rule synth_analz_mono, auto)\n  also have \"... \\<subseteq> synth (analz (synth (analz (extr bad IK CH))))\"\n    by - (rule synth_analz_mono, auto)\n  also have \"... \\<subseteq> synth (analz (extr bad IK CH))\" by simp\n  finally show \"synth (analz (extr bad IK (insert X CH))) \\<subseteq> synth (analz (extr bad IK CH))\" .\nnext\n  have \"extr bad IK CH \\<subseteq> extr bad IK (insert X CH)\"\n    by auto\n  then show \"synth (analz (extr bad IK CH)) \\<subseteq> synth (analz (extr bad IK (insert X CH)))\"\n    by - (rule synth_analz_mono, auto)\nqed\n\n\n(**************************************************************************************************)\nsubsection \\<open>Closure of Dolev-Yao, extract and fake\\<close>\n(**************************************************************************************************)\n\nsubsubsection \\<open>\\<open>dy_fake_msg\\<close>: returns messages, closure of DY and extr is sufficient\\<close>\n(**************************************************************************************************)\n\ntext \\<open>Close @{term extr} under Dolev-Yao closure using @{term synth} and @{term analz}. \nThis will be used in Level 2 attacker events to fake crypto messages.\\<close>\n\ndefinition \n  dy_fake_msg :: \"agent set \\<Rightarrow> msg set \\<Rightarrow> chan set \\<Rightarrow> msg set\"\nwhere\n  \"dy_fake_msg b i c = synth (analz (extr b i c))\"\n\n\nlemma dy_fake_msg_empty [simp]: \"dy_fake_msg bad {} {} = synth {}\"\nby (auto simp add: dy_fake_msg_def)\n\nlemma dy_fake_msg_mono_bad [dest]: \"bad \\<subseteq> bad' \\<Longrightarrow> dy_fake_msg bad I C \\<subseteq> dy_fake_msg bad' I C\"\nby (auto simp add: dy_fake_msg_def intro!: synth_analz_mono)\n\nlemma dy_fake_msg_mono_ik [dest]: \"G \\<subseteq> H \\<Longrightarrow> dy_fake_msg bad G C \\<subseteq> dy_fake_msg bad H C\"\nby (auto simp add: dy_fake_msg_def intro!: synth_analz_mono)\n\nlemma dy_fake_msg_mono_chan [dest]: \"G \\<subseteq> H \\<Longrightarrow> dy_fake_msg bad I G \\<subseteq> dy_fake_msg bad I H\"\nby (auto simp add: dy_fake_msg_def intro!: synth_analz_mono)\n \nlemmas dy_fake_msg_monotone_bad [elim] = dy_fake_msg_mono_bad [THEN [2] rev_subsetD]\nlemmas dy_fake_msg_monotone_ik [elim] = dy_fake_msg_mono_ik [THEN [2] rev_subsetD]\nlemmas dy_fake_msg_monotone_chan [elim] = dy_fake_msg_mono_chan [THEN [2] rev_subsetD]\n\nlemma dy_fake_msg_insert [intro]: \n  \"M \\<in> dy_fake_msg bad I C \\<Longrightarrow> M \\<in> dy_fake_msg bad I (insert X C)\"\nby (auto)\n\nlemma dy_fake_msg_mono [intro]: \n  \"\\<lbrakk> b \\<subseteq> b'; I \\<subseteq> I'; C \\<subseteq> C' \\<rbrakk> \\<Longrightarrow> dy_fake_msg b I C \\<subseteq> dy_fake_msg b' I' C'\"\nby (force simp add: dy_fake_msg_def intro!: synth_analz_mono)\n\nlemmas dy_fake_msg_monotone [elim] = dy_fake_msg_mono [THEN [2] rev_subsetD]\n\nlemma dy_fake_msg_insert_chan:\n  \"x = insec \\<or> x = auth \\<Longrightarrow>\n   M \\<in> dy_fake_msg bad IK (insert (Chan x A B M) CH)\"\nby (auto simp add: dy_fake_msg_def)\n\n\nsubsubsection \\<open>\\<open>dy_fake_chan\\<close>: returns channel messages\\<close>\n(**************************************************************************************************)\n\ntext \\<open>The set of all channel messages that an attacker can fake is obtained using\n@{term fake} with the sets of possible payload messages derived with @{term dy_fake_msg}\ndefined above. This will be used in Level 2 attacker events to fake channel messages.\\<close>\n\ndefinition\n  dy_fake_chan :: \"agent set \\<Rightarrow> msg set \\<Rightarrow> chan set \\<Rightarrow> chan set\"\nwhere\n  \"dy_fake_chan b i c = fake b (dy_fake_msg b i c) c\"\n\n\nlemma dy_fake_chan_mono_bad [intro]: \n  \"bad \\<subseteq> bad' \\<Longrightarrow> dy_fake_chan bad I C \\<subseteq> dy_fake_chan bad' I C\" \nby (auto simp add: dy_fake_chan_def)\n\nlemma dy_fake_chan_mono_ik [intro]: \n  \"T \\<subseteq> T' \\<Longrightarrow> dy_fake_chan bad T C \\<subseteq> dy_fake_chan bad T' C\" \nby (auto simp add: dy_fake_chan_def)\n\nlemma dy_fake_chan_mono_chan [intro]: \n  \"C \\<subseteq> C' \\<Longrightarrow> dy_fake_chan bad T C \\<subseteq> dy_fake_chan bad T C'\" \nby (auto simp add: dy_fake_chan_def)\n\nlemmas dy_fake_chan_monotone_bad [elim] = dy_fake_chan_mono_bad [THEN [2] rev_subsetD]\nlemmas dy_fake_chan_monotone_ik [elim] = dy_fake_chan_mono_ik [THEN [2] rev_subsetD]\nlemmas dy_fake_chan_monotone_chan [elim] = dy_fake_chan_mono_chan [THEN [2] rev_subsetD]\n\n\nlemma dy_fake_chan_mono [intro]: \n  assumes \"b \\<subseteq> b'\" and \"I \\<subseteq> I'\" and \"C \\<subseteq> C'\"\n  shows \"dy_fake_chan b I C \\<subseteq> dy_fake_chan b' I' C'\"\nproof -\n  have \"dy_fake_chan b I C \\<subseteq> dy_fake_chan b' I C\" using \\<open>b \\<subseteq> b'\\<close> by auto\n  also have \"... \\<subseteq> dy_fake_chan b' I' C\" using \\<open>I \\<subseteq> I'\\<close> by auto\n  also have \"... \\<subseteq> dy_fake_chan b' I' C'\" using \\<open>C \\<subseteq> C'\\<close> by auto\n  finally show ?thesis .\nqed\n\nlemmas dy_fake_chan_monotone [elim] = dy_fake_chan_mono [THEN [2] rev_subsetD]\n\nlemma dy_fake_msg_subset_synth_analz: \n  \"\\<lbrakk>extr bad IK chan \\<subseteq> T \\<rbrakk> \\<Longrightarrow> dy_fake_msg bad IK chan \\<subseteq> synth (analz T)\"\nby (auto simp add: dy_fake_msg_def synth_analz_mono)\n\nlemma dy_fake_chan_mono2:\n  \"\\<lbrakk> extr bad IK chan \\<subseteq> synth (analz y); chan \\<subseteq> fake bad (synth (analz y)) z \\<rbrakk>\n \\<Longrightarrow> dy_fake_chan bad IK chan \\<subseteq> fake bad (synth (analz y)) z\"\napply (auto simp add: dy_fake_chan_def, erule fake.cases, auto)\napply (auto intro!: fake_New dest!: dy_fake_msg_subset_synth_analz)\ndone\n\nlemma extr_subset_dy_fake_msg: \"extr bad IK chan \\<subseteq> dy_fake_msg bad IK chan\"\nby (auto simp add: dy_fake_msg_def)\n\n\nlemma dy_fake_chan_extr_insert: \n  \"M \\<in> dy_fake_chan bad IK CH \\<Longrightarrow> extr bad IK (insert M CH) \\<subseteq> dy_fake_msg bad IK CH\"\nby (auto simp add: dy_fake_chan_def dy_fake_msg_def dest: fake_synth_analz_extr)\n\nlemma dy_fake_chan_extr_insert_parts:\n  \"M \\<in> dy_fake_chan bad IK CH \\<Longrightarrow>\n   parts (extr bad IK (insert M CH)) \\<subseteq> parts (extr bad IK CH) \\<union> dy_fake_msg bad IK CH\"\nby (drule dy_fake_chan_extr_insert [THEN parts_mono], auto simp add: dy_fake_msg_def)\n\nlemma dy_fake_msg_extr: \n  \"extr bad ik chan \\<subseteq> synth (analz X) \\<Longrightarrow> dy_fake_msg bad ik chan \\<subseteq> synth (analz X)\"\nby (drule synth_analz_mono) (auto simp add: dy_fake_msg_def)\n\nlemma extr_insert_dy_fake_msg:\n  \"M \\<in> dy_fake_msg bad IK CH \\<Longrightarrow> extr bad (insert M IK) CH \\<subseteq> dy_fake_msg bad IK CH\"\nby (auto simp add: dy_fake_msg_def)\n\nlemma dy_fake_msg_insert_dy_fake_msg:\n  \"M \\<in> dy_fake_msg bad IK CH \\<Longrightarrow> dy_fake_msg bad (insert M IK) CH \\<subseteq> dy_fake_msg bad IK CH\"\nby (drule synth_analz_mono [OF extr_insert_dy_fake_msg], auto simp add: dy_fake_msg_def)\n\nlemma synth_analz_insert_dy_fake_msg:\n  \"M \\<in> dy_fake_msg bad IK CH \\<Longrightarrow> synth (analz (insert M IK)) \\<subseteq> dy_fake_msg bad IK CH\"\nby (auto dest!: dy_fake_msg_insert_dy_fake_msg, erule subsetD, \n    auto simp add: dy_fake_msg_def elim: synth_analz_monotone)\n\nlemma Fake_insert_dy_fake_msg:\n  \"M \\<in> dy_fake_msg bad IK CH \\<Longrightarrow>\n   extr bad IK CH \\<subseteq> synth (analz X) \\<Longrightarrow>\n   synth (analz (insert M IK)) \\<subseteq> synth (analz X)\"\nby (auto dest!: synth_analz_insert_dy_fake_msg dy_fake_msg_extr)\n\nlemma dy_fake_chan_insert_chan:\n  \"x = insec \\<or> x = auth \\<Longrightarrow>\n   Chan x A B M \\<in> dy_fake_chan bad IK (insert (Chan x A B M) CH)\"\nby (auto simp add: dy_fake_chan_def)\n\nlemma dy_fake_chan_subset:\n  \"CH \\<subseteq> fake bad (dy_fake_msg bad IK CH) CH' \\<Longrightarrow>\n   dy_fake_chan bad IK CH \\<subseteq> fake bad (dy_fake_msg bad IK CH) CH'\"\nby (auto simp add: dy_fake_chan_def)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Key_Agreement_Strong_Adversaries/Channels.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417487156366, "lm_q2_score": 0.4726834766204329, "lm_q1q2_score": 0.3112230668967603}}
{"text": "section \\<open>Implementation of Heaps with Arrays\\<close>\ntheory IICF_Impl_Heap\nimports \n  IICF_Abs_Heap \n  \"../IICF_Array\" \n  \"../IICF_Array_List\" \nbegin\n\n  (* TODO: Move *)\n  \n  term al_assn\n\n  (* TODO: Move *)      \n  lemma size_mset_param[param]: \"(size,size)\\<in>\\<langle>A\\<rangle>mset_rel \\<rightarrow> nat_rel\"  \n    by (auto simp: mset_rel_def p2rel_def rel_mset_size)\n    \n\n  (* TODO: Move *)\n  lemma rdomp_ref_mk_assn_iff[simp]: \"rdomp \\<upharpoonleft>(mk_assn A) = rdomp A\"\n    by (auto simp: rdomp_def)\n  \n  thm vcg_prep_ext_rules  \n    \n  find_theorems pure_part  \n    \n  lemma rdomp_arl_assn_len:\n    assumes \"rdomp \\<upharpoonleft>(arl_assn:: ('a::llvm_rep list, 'l::len2 word \\<times> 'l word \\<times> 'a ptr) dr_assn) xs\"\n    shows \"length xs < max_snat LENGTH('l)\"\n    using assms\n    by (auto \n      simp: rdomp_def arl_assn_def arl_assn'_def sep_algebra_simps pred_lift_extract_simps\n      simp: snat.assn_def\n      )\n\n  find_theorems vassn_tag hn_refine\n\n    (* TODO: Move*)\n    lemma snat_imp_bound[simp,arith]: \"(c::'l::len2 word,a)\\<in>snat_rel \\<Longrightarrow> l=LENGTH('l) \\<Longrightarrow> a<max_snat l\"\n      unfolding snat_rel_def snat.rel_def in_br_conv\n      unfolding snat_def max_snat_def\n      apply auto\n      using sint_range' by blast\n\n      \n  (* TODO: Very specialized workaround lemma, to work around invalid-recombination\n    problem for case that B is pure \n  *)    \n  lemma workaround_invalid_recombine_pure2: \"is_pure B \\<Longrightarrow> hn_ctxt (invalid_assn A \\<times>\\<^sub>a B) ax px \\<turnstile> hn_invalid (A \\<times>\\<^sub>a B) ax px\"\n    unfolding hn_ctxt_def invalid_assn_def prod_assn_def entails_def\n    by (auto split: prod.split elim!: is_pureE \n      simp: sep_algebra_simps pure_part_pure_conj_eq)\n    argo\n    \n  (* TODO: Move\n    TODO: Should be generic algorithm!\n  *)  \n  lemma mop_list_swap_unfold: \"mop_list_swap xs i j = do {\n    xi \\<leftarrow> mop_list_get xs i;\n    xj \\<leftarrow> mop_list_get xs j;\n    xs \\<leftarrow> mop_list_set xs i xj;\n    mop_list_set xs j xi\n  }\"\n  by (auto simp: pw_eq_iff refine_pw_simps swap_def)\n  \n    \n\n\n  text \\<open>We implement the heap data structure by an array.\n    The implementation is automatically synthesized by the Sepref-tool.\n    \\<close>\n  subsection \\<open>Setup of the Sepref-Tool\\<close>\n\n  (* TODO: Move *)\n  lemma mset_rel_id: \"\\<langle>Id\\<rangle>mset_rel = Id\"\n    unfolding mset_rel_def apply (simp add: rel2p multiset.rel_eq)\n    by (simp only: p2rel)\n  \n  \n  locale heap_impl = heapstruct prio for prio :: \"'e \\<Rightarrow> 'p::linorder\" +\n    fixes prio_assn :: \"'p \\<Rightarrow> 'pi::llvm_rep \\<Rightarrow> assn\"\n      and elem_assn :: \"'e \\<Rightarrow> 'ei::llvm_rep \\<Rightarrow> assn\"\n      and prio_impl le_prio_impl lt_prio_impl\n      and ltype :: \"'l::len2 itself\"\n    assumes prio_is_pure[safe_constraint_rules]: \"is_pure prio_assn\"\n    assumes elem_is_pure[safe_constraint_rules]: \"is_pure elem_assn\"  \n    assumes prio_impl_refine[sepref_fr_rules]: \"(prio_impl, RETURN o prio)\\<in>elem_assn\\<^sup>k \\<rightarrow>\\<^sub>a prio_assn\"\n    assumes le_prio_impl_refine[sepref_fr_rules]: \n      \"(uncurry le_prio_impl, uncurry (RETURN oo (\\<le>))) \\<in> prio_assn\\<^sup>k *\\<^sub>a prio_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n    assumes lt_prio_impl_refine[sepref_fr_rules]: \n      \"(uncurry lt_prio_impl, uncurry (RETURN oo (<))) \\<in> prio_assn\\<^sup>k *\\<^sub>a prio_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n      \n    fixes N defines \"N\\<equiv>LENGTH('l)\"\n    (*assumes l_len[simp,arith]: \"4 < LENGTH('l)\"*)\n  begin\n      \n    abbreviation \"assn \\<equiv> al_assn' TYPE('l) elem_assn\"\n    abbreviation \"idx_assn \\<equiv> snat_assn' TYPE('l)\"\n    definition \"heap_assn \\<equiv> hr_comp (al_assn elem_assn) heap_rel1\"\n\n    lemma mk_free_heap_assn[sepref_frame_free_rules]: \"MK_FREE heap_assn arl_free\"\n      unfolding heap_assn_def\n      by (rule sepref_frame_free_rules)+\n  \n    (*context\n      assumes l_len_pre: \"(4 < LENGTH('l))\"\n    begin  \n      private lemma l_len: \"4 < LENGTH('l)\" using l_len_pre unfolding vcg_tag_defs by auto\n    *)  \n  \n      sepref_register prio\n  \n      sepref_register \"(\\<le>) :: 'p \\<Rightarrow> 'p \\<Rightarrow> bool\"\n      sepref_register \"(<) :: 'p \\<Rightarrow> 'p \\<Rightarrow> bool\"\n      \n      lemma l_len_bound[simp,arith]: \"4 < LENGTH('l) \\<Longrightarrow> 16 \\<le> max_snat LENGTH('l)\"\n        unfolding max_snat_def\n      proof -\n        assume \"4<LENGTH('l)\"\n        hence \"4\\<le>LENGTH('l)-1\" by simp\n        hence \"(2::nat)^4 \\<le> 2^(LENGTH('l)-1)\" \n          by (rule power_increasing) auto\n        thus \"(16::nat) \\<le> 2^(LENGTH('l)-1)\" by auto\n      qed\n      \n      lemmas [sepref_frame_free_rules] = \n        mk_free_is_pure[OF prio_is_pure]\n        mk_free_is_pure[OF elem_is_pure]\n          \n      sepref_register update_op\n      sepref_definition update_impl is \"uncurry2 update_op\" \n        :: \"assn\\<^sup>d *\\<^sub>a idx_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>k \\<rightarrow>\\<^sub>a assn\"\n        unfolding update_op_def[abs_def]\n        apply (annot_snat_const \"TYPE('l)\")\n        by sepref\n      lemmas [sepref_fr_rules] = update_impl.refine\n          \n      sepref_register val_of_op\n      sepref_definition val_of_impl is \"uncurry val_of_op\" :: \"assn\\<^sup>k *\\<^sub>a idx_assn\\<^sup>k \\<rightarrow>\\<^sub>a elem_assn\"\n        unfolding val_of_op_def[abs_def]\n        apply (annot_snat_const \"TYPE('l)\")\n        by sepref\n      lemmas [sepref_fr_rules] = val_of_impl.refine\n    \n      sepref_register exch_op\n      sepref_definition exch_impl is \"uncurry2 exch_op\" :: \"assn\\<^sup>d *\\<^sub>a idx_assn\\<^sup>k *\\<^sub>a idx_assn\\<^sup>k \\<rightarrow>\\<^sub>a assn\"\n        unfolding exch_op_def[abs_def] mop_list_swap_unfold\n        apply (annot_snat_const \"TYPE('l)\")\n        by sepref\n        \n      lemmas [sepref_fr_rules] = exch_impl.refine\n    \n      sepref_register valid\n      sepref_definition valid_impl is \"uncurry (RETURN oo valid)\" :: \"assn\\<^sup>k *\\<^sub>a idx_assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n        unfolding valid_def[abs_def]\n        apply (annot_snat_const \"TYPE('l)\")\n        by sepref\n      lemmas [sepref_fr_rules] = valid_impl.refine\n          \n      sepref_register prio_of_op  \n      sepref_definition prio_of_impl is \"uncurry (PR_CONST prio_of_op)\" :: \"assn\\<^sup>k *\\<^sub>a idx_assn\\<^sup>k \\<rightarrow>\\<^sub>a prio_assn\"\n        unfolding prio_of_op_def[abs_def] PR_CONST_def\n        by sepref\n      lemmas [sepref_fr_rules] = prio_of_impl.refine\n      \n      sepref_definition append_impl is \"uncurry mop_list_append\" \n        :: \"[\\<lambda>(xs,_). length xs + 1 < max_snat LENGTH('l)]\\<^sub>a assn\\<^sup>d *\\<^sub>a elem_assn\\<^sup>k \\<rightarrow> assn\"\n        by sepref\n      lemmas [sepref_fr_rules] = append_impl.refine \n      \n      sepref_register swim_op\n      sepref_definition swim_impl is \n        \"uncurry (PR_CONST swim_op)\" :: \"[\\<lambda>_. 4<LENGTH('l)]\\<^sub>a assn\\<^sup>d *\\<^sub>a idx_assn\\<^sup>k \\<rightarrow> assn\"\n        unfolding swim_op_def[abs_def] parent_def PR_CONST_def\n        apply (annot_snat_const \"TYPE('l)\")\n        (* TODO: Workaround/Hack *)\n        supply [sepref_frame_match_rules] = workaround_invalid_recombine_pure2[where B=snat_assn, simplified]\n        by sepref_dbg_keep\n  \n      lemmas [sepref_fr_rules] = swim_impl.refine\n  \n      \n      lemma overflow_safe_hbound_check: \"2*k\\<le>n \\<longleftrightarrow> k\\<le>n div 2\" for k n :: nat by auto\n      \n      (* TODO: Move *)\n      lemma al_assn_len_bound: \"rdomp (al_assn' TYPE('l) A) xs \\<Longrightarrow> length xs < max_snat LENGTH('l)\"\n        unfolding al_assn_def \n        by (auto simp: rdomp_hrcomp_conv dest!: rdomp_arl_assn_len list_rel_imp_same_length)\n      \n      lemma bound_aux1: \"rdomp assn xs \\<Longrightarrow> j\\<le>length xs div 2 \\<Longrightarrow> 2*j < max_snat LENGTH('l)\"  \n        apply (drule al_assn_len_bound)\n        by simp\n        \n      lemma bound_aux2: \"\\<lbrakk>rdomp assn a1'; 2 * a2' < length a1'\\<rbrakk> \n        \\<Longrightarrow> Suc (2 * a2') < max_snat LENGTH('l)\"  \n        apply (drule al_assn_len_bound)\n        by auto\n        \n      sepref_register sink_op\n      sepref_definition sink_impl is \"uncurry (PR_CONST sink_op)\" :: \"[\\<lambda>_. 4<LENGTH('l)]\\<^sub>a assn\\<^sup>d *\\<^sub>a idx_assn\\<^sup>k \\<rightarrow> assn\"\n        unfolding sink_op_opt_def[abs_def] sink_op_opt_eq[symmetric,abs_def]  PR_CONST_def\n        unfolding overflow_safe_hbound_check Suc_eq_plus1\n        (* TODO: Workaround/Hack *)\n        supply [sepref_frame_match_rules] = workaround_invalid_recombine_pure2[where B=snat_assn, simplified]\n        supply [simp] = bound_aux1 bound_aux2\n        apply (annot_snat_const \"TYPE('l)\")\n        by sepref\n        \n      lemmas [sepref_fr_rules] = sink_impl.refine\n  \n      \n      lemma prenorm_heaprel1_len: \"(h,m)\\<in>heap_rel1 \\<Longrightarrow> length h = size m\"\n        unfolding heap_rel1_def in_br_conv\n        by auto\n      lemma max_snat_param: \"(max_snat,max_snat)\\<in>nat_rel \\<rightarrow> nat_rel\" by simp\n\n      context\n        notes [fcomp_norm_unfold] = heap_assn_def[symmetric] list_rel_id_simp mset_rel_id\n        notes [fcomp_prenorm_simps] = prenorm_heaprel1_len\n        notes [param] = IdI[of N] max_snat_param\n      begin    \n      \n        sepref_definition empty_impl is \"uncurry0 empty_op\" :: \"[\\<lambda>_. 4<N]\\<^sub>a unit_assn\\<^sup>k \\<rightarrow> assn\"\n          unfolding empty_op_def N_def\n          apply (rewrite al_fold_custom_empty[where 'l='l])\n          by sepref\n        sepref_decl_impl (no_register) heap_empty: empty_impl.refine[FCOMP empty_op_refine] \n          uses op_mset_empty.fref[of Id] .\n    \n        sepref_definition is_empty_impl is \"is_empty_op\" :: \"assn\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n          unfolding is_empty_op_def[abs_def]\n          apply (annot_snat_const \"TYPE('l)\")\n          by sepref\n        sepref_decl_impl heap_is_empty: is_empty_impl.refine[FCOMP is_empty_op_refine] \n          uses op_mset_is_empty.fref[of Id] .  \n    \n        sepref_definition insert_impl\n          is \"uncurry insert_op\" :: \"[\\<lambda>(_,xs). 4<N \\<and> length xs+1 < max_snat N]\\<^sub>a elem_assn\\<^sup>k *\\<^sub>a assn\\<^sup>d \\<rightarrow> assn\"\n          unfolding insert_op_def[abs_def] append_op_def N_def\n          by sepref\n        sepref_decl_impl heap_insert: insert_impl.refine[FCOMP insert_op_refine] \n          uses op_mset_insert.fref[of Id] .\n          \n        sepref_definition pop_min_impl is \"pop_min_op\" :: \"[\\<lambda>_. 4<N]\\<^sub>a assn\\<^sup>d \\<rightarrow> elem_assn \\<times>\\<^sub>a assn\"\n          unfolding pop_min_op_def[abs_def] butlast_op_def N_def\n          apply (annot_snat_const \"TYPE('l)\")\n          by sepref\n        sepref_decl_impl (no_mop) heap_pop_min: pop_min_impl.refine[FCOMP pop_min_op_refine] \n          uses op_prio_pop_min.fref[of Id] .\n        \n        \n    \n        sepref_definition peek_min_impl is \"peek_min_op\" :: \"assn\\<^sup>k \\<rightarrow>\\<^sub>a elem_assn\"\n          unfolding peek_min_op_def[abs_def]\n          apply (annot_snat_const \"TYPE('l)\")\n          by sepref\n        sepref_decl_impl (no_mop) heap_peek_min: peek_min_impl.refine[FCOMP peek_min_op_refine] \n          uses op_prio_peek_min.fref[of Id] .\n                  \n      end\n    (*end        *)\n\n  end  \n    \n  \n  find_theorems snat_rel ll_icmp_ult\n  \n  sepref_definition foo is \"uncurry (\\<lambda>a b. RETURN (a<b))\" :: \"(snat_assn' TYPE('l::len2))\\<^sup>k *\\<^sub>a (snat_assn' TYPE('l::len2))\\<^sup>k \\<rightarrow>\\<^sub>a bool1_assn\"\n    by sepref\n\n  global_interpretation heap_impl id snat_assn snat_assn return ll_icmp_sle ll_icmp_slt \"TYPE('l::len2)\" \"LENGTH('l)\"\n    defines h_update_impl = update_impl\n        and h_val_of_impl = val_of_impl\n        and h_exch_impl = exch_impl\n        and h_valid_impl = valid_impl\n        and h_prio_of_impl = prio_of_impl\n        and h_append_impl = append_impl\n        and h_swim_impl = swim_impl\n        and h_sink_impl = sink_impl\n        and h_empty_impl = empty_impl\n        and h_is_empty_impl = is_empty_impl\n        and h_insert_impl = insert_impl\n        and h_pop_min_impl = pop_min_impl\n        and h_peek_min_impl = peek_min_impl\n  \n    apply unfold_locales\n    apply (rule pure_pure)\n    apply sepref\n    apply sepref\n    apply sepref\n    apply simp\n    done\n\n   \n  lemmas heap_impl_inlines = \n    heap_impl.valid_impl_def[OF heap_impl_axioms]  \n    heap_impl.prio_of_impl_def[OF heap_impl_axioms]\n    heap_impl.val_of_impl_def[OF heap_impl_axioms]\n    heap_impl.append_impl_def[OF heap_impl_axioms]\n    heap_impl.exch_impl_def[OF heap_impl_axioms]\n    heap_impl.empty_impl_def[OF heap_impl_axioms]\n    heap_impl.is_empty_impl_def[OF heap_impl_axioms]\n    heap_impl.insert_impl_def[OF heap_impl_axioms]\n    heap_impl.pop_min_impl_def[OF heap_impl_axioms]\n    heap_impl.peek_min_impl_def[OF heap_impl_axioms]\n    \n    h_swim_impl_def[symmetric]\n    h_sink_impl_def[symmetric]\n    \n  lemmas [llvm_inline] = update_impl_def \n  lemmas [llvm_inline] = val_of_impl_def \n  lemmas [llvm_inline] = exch_impl_def    \n  lemmas [llvm_inline] = h_valid_impl_def[unfolded heap_impl_inlines]\n  lemmas [llvm_inline] = h_prio_of_impl_def[unfolded heap_impl_inlines]\n  lemmas [llvm_inline] = h_append_impl_def[unfolded heap_impl_inlines]\n  lemmas [llvm_code] = h_swim_impl_def[unfolded heap_impl.swim_impl_def[OF heap_impl_axioms], unfolded heap_impl_inlines]\n  lemmas [llvm_code] = h_sink_impl_def[unfolded heap_impl.sink_impl_def[OF heap_impl_axioms], unfolded heap_impl_inlines]\n  lemmas [llvm_inline] = h_empty_impl_def[unfolded heap_impl_inlines]\n  lemmas [llvm_inline] = h_is_empty_impl_def[unfolded heap_impl_inlines]\n  lemmas [llvm_inline] = h_insert_impl_def[unfolded heap_impl_inlines]\n  lemmas [llvm_inline] = h_pop_min_impl_def[unfolded heap_impl_inlines]\n  lemmas [llvm_inline] = h_peek_min_impl_def[unfolded heap_impl_inlines]\n  \n  definition [simp]: \"op_heap_custom_empty (_::'a::len2 itself) (_::'l::len2 itself) \\<equiv> op_mset_empty\"\n  context fixes Q T :: \"_::len2 itself\" begin sepref_register \"op_heap_custom_empty Q T\" end\n  \n  lemma op_heap_custom_empty_hnr[sepref_fr_rules]:\n    shows \"(\n      uncurry0 (empty_impl::('a::len2 word,'l)array_list llM ), \n      uncurry0 (RETURN (PR_CONST (op_heap_custom_empty TYPE('a) TYPE('l))))) \\<in> [\\<lambda>_. 4<LENGTH('l::len2)]\\<^sub>a unit_assn\\<^sup>k \\<rightarrow> heap_assn\"\n    unfolding op_heap_custom_empty_def PR_CONST_def\n    by (rule heap_empty_hnr[unfolded PRECOND_def])\n    \n  lemma heap_fold_custom_empty: \n    \"{#} = op_heap_custom_empty TYPE('a::len2) TYPE('l::len2)\"\n    \"op_mset_empty = op_heap_custom_empty TYPE('a::len2) TYPE('l::len2)\"\n    \"mop_mset_empty = RETURN (op_heap_custom_empty TYPE('a::len2) TYPE('l::len2))\"\n    by auto\n  \n    \n      \n  \n    \ndefinition \"sort_by_prio l\\<^sub>0 \\<equiv> do {\n  q \\<leftarrow> nfoldli l\\<^sub>0 (\\<lambda>_. True) (\\<lambda>x q. do { ASSERT (size q < length l\\<^sub>0); mop_mset_insert x q }) {#};\n  ASSERT (q = mset l\\<^sub>0);\n  (l,q) \\<leftarrow> WHILEIT (\\<lambda>(l,q). sorted l \\<and> (\\<forall>x\\<in>set l. \\<forall>y\\<in>#q. x\\<le>y) \\<and> mset l + q = mset l\\<^sub>0) \n    (\\<lambda>(l,q). \\<not>op_mset_is_empty q) (\\<lambda>(l,q). \n  do {\n    (x,q) \\<leftarrow> mop_prio_pop_min id q;\n    ASSERT (size l < length l\\<^sub>0);\n    RETURN (l@[x],q)\n  }) (op_list_empty,q);\n  RETURN l\n}\"\n\nlemma sort_by_prio_correct: \"sort_by_prio l \\<le> SPEC (\\<lambda>l'. sorted l' \\<and> mset l' = mset l)\"\n  unfolding sort_by_prio_def mop_prio_pop_min_def\n  \n  apply (refine_vcg \n    nfoldli_rule[where I=\"\\<lambda>ll _ q. q = mset ll\"]\n    WHILEIT_rule[where R=\"measure (\\<lambda>(l,q). size q)\"]\n    )\n  apply (auto 0 3 dest: in_diffD simp: size_Diff1_less sorted_append_bigger)\n  subgoal by (metis add_cancel_right_right le_add1 nat_less_le size_eq_0_iff_empty size_mset size_union) \n  subgoal by (metis insert_DiffM union_iff) \n  done\n  \n\n\n(* TODO: Move  *)\nfunction list_intv_induction where\n  \"list_intv_induction l u = (if l<u then list_intv_induction (Suc l) u else ())\"\n  by pat_completeness auto\n\ntermination\n  apply (relation \"measure (\\<lambda>(l,u). u-l)\")\n  by auto\n  \nlemma nfoldli_range_to_while: \"nfoldli [l..<u] c f \\<sigma> = do {\n    (_,\\<sigma>) \\<leftarrow> WHILET \n      (\\<lambda>(i,\\<sigma>). i<u \\<and> c \\<sigma>) \n      (\\<lambda>(i,\\<sigma>). do { \\<sigma> \\<leftarrow> f i \\<sigma>; ASSERT (i<u); RETURN (i+1,\\<sigma>) })\n      (l,\\<sigma>);\n    RETURN \\<sigma>\n  }\"\nproof (induction l u arbitrary: \\<sigma> rule: list_intv_induction.induct)\n  case (1 l u)\n  show ?case proof (cases \"l<u\")\n    case False thus ?thesis\n      by (rewrite WHILET_unfold) simp\n      \n  next\n    case True \n    thm \"1.IH\"[OF True, abs_def]\n    thus ?thesis \n      by (rewrite WHILET_unfold) (simp add: upt_conv_Cons \"1.IH\"[OF True, abs_def])\n  qed\nqed\n  \n\n\n\nsepref_definition sort_impl [llvm_code] is \n  \"sort_by_prio\" :: \"[\\<lambda>l. length l < max_snat LENGTH(64)]\\<^sub>a (al_assn' TYPE(64) (snat_assn' TYPE(64)))\\<^sup>k \\<rightarrow> al_assn' TYPE(64) (snat_assn' TYPE(64))\"\n  unfolding sort_by_prio_def[abs_def] \n  apply (rewrite nfoldli_by_idx)\n  apply (rewrite nfoldli_range_to_while)\n  apply (rewrite heap_fold_custom_empty[where 'l=64 and 'a=\"64\"])\n  apply (rewrite at op_list_empty al_fold_custom_empty[where 'l=64])\n  apply (annot_snat_const \"TYPE(64)\")\n  by sepref\n\n  \n  \nexport_llvm \n  sort_impl is \"sort\" \n  \"arl_new_raw :: (64 word,64) array_list llM\" is \"arl_new\"\n  \"arl_push_back :: _ \\<Rightarrow> _ \\<Rightarrow> (64 word,64) array_list llM\" is \"arl_push_back\"\n  (*file \"sort.ll\" *)\n  (* CAREFUL: The calling conventions generated by this LLVM code are hard/impossible to \n    interface from C !? *)\n  \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2018/sepref/IICF/Impl/Heaps/IICF_Impl_Heap.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.31105437035956474}}
{"text": "theory Trace\n  imports Semantics\nbegin        \n\nsection \\<open>Trace\\<close>\n\ntext \\<open>\nGiven the small-step semantics for a language,\ndefine the possible traces that a program may generate.\n\\<close>\n\ninductive rep\\<^sub>i\n  where \n    n[intro]: \"rep\\<^sub>i s []\" | \n    s[intro]: \"rep\\<^sub>i s t\\<^sub>1 \\<Longrightarrow> t\\<^sub>2 \\<in> s \\<Longrightarrow> rep\\<^sub>i s (t\\<^sub>2 @ t\\<^sub>1)\"\n\ninductive inter\\<^sub>i\n  where \n    e[intro]: \"inter\\<^sub>i [] [] []\" | \n    l[intro]: \"inter\\<^sub>i l\\<^sub>1 l\\<^sub>2 t \\<Longrightarrow> inter\\<^sub>i (x#l\\<^sub>1) l\\<^sub>2 (x#t)\" |\n    r[intro]: \"inter\\<^sub>i l\\<^sub>1 l\\<^sub>2 t \\<Longrightarrow> inter\\<^sub>i l\\<^sub>1 (x#l\\<^sub>2) (x#t)\"\n\ntype_synonym 'b Trace = \"'b list\"\n\ninductive_set trace :: \"('a Stmt \\<times> 'a Trace \\<times> 'a Stmt) set\"\n  and trace_abv :: \"'a Stmt \\<Rightarrow> 'a Trace \\<Rightarrow> 'a Stmt \\<Rightarrow> bool\" (\"_ \\<mapsto>_\\<^sup>* _\" [50,40,40] 70)\n  where\n  \"trace_abv P t P' \\<equiv> (P, t, P') \\<in> trace\"\n  | lift[intro]:    \"c \\<mapsto>[]\\<^sup>* c\"\n  | rewrite[intro]: \"c\\<^sub>1 \\<leadsto> c\\<^sub>2 \\<Longrightarrow> c\\<^sub>2 \\<mapsto>t\\<^sup>* c\\<^sub>3 \\<Longrightarrow> c\\<^sub>1 \\<mapsto>t\\<^sup>* c\\<^sub>3\"\n  | prepend[intro]: \"c\\<^sub>1 \\<mapsto>\\<^sub>\\<alpha> c\\<^sub>2 \\<Longrightarrow> c\\<^sub>2 \\<mapsto>t\\<^sup>* c\\<^sub>3 \\<Longrightarrow> c\\<^sub>1 \\<mapsto>\\<alpha>#t\\<^sup>* c\\<^sub>3\"\n\nsection \\<open>Properties\\<close>\n\nlemma inter\\<^sub>i_I1 [intro]:\n  shows \"inter\\<^sub>i [] l l\"\n  by (induct l) auto\n\nlemma inter\\<^sub>i_I2 [intro]:\n  shows \"inter\\<^sub>i l [] l\"\n  by (induct l) auto\n\nlemma interE [elim]:\n  assumes \"inter\\<^sub>i t\\<^sub>1 t\\<^sub>2 []\"\n  obtains \"t\\<^sub>1 = []\" \"t\\<^sub>2 = []\"\n  using assms \n  by (induct t\\<^sub>1 t\\<^sub>2 \"[] :: 'a list\" rule: inter\\<^sub>i.induct) auto\n\nlemma inter\\<^sub>i_E2 [elim]:\n  assumes \"inter\\<^sub>i [] t t'\"\n  obtains \"t = t'\"\n  using assms\n  by (induct \"[] :: 'a list\" t t' rule: inter\\<^sub>i.induct) auto\n\nsubsection \\<open>Trace Properties\\<close>\n\nlemma trace_concat [intro]:\n  assumes \"P\\<^sub>1 \\<mapsto>t\\<^sub>1\\<^sup>* P\\<^sub>2\"\n  assumes \"P\\<^sub>2 \\<mapsto>t\\<^sub>2\\<^sup>* P\\<^sub>3\"\n  shows \"P\\<^sub>1 \\<mapsto>t\\<^sub>1@t\\<^sub>2\\<^sup>* P\\<^sub>3\"\n  using assms by induct auto\n\nlemma trace_pre [intro]:\n  assumes \"P\\<^sub>1 \\<mapsto>[x]\\<^sup>* P\\<^sub>2\"\n  assumes \"P\\<^sub>2 \\<mapsto>t\\<^sup>* P\\<^sub>3\"\n  shows \"P\\<^sub>1 \\<mapsto>x#t\\<^sup>* P\\<^sub>3\"\n  using trace_concat[OF assms] by auto\n\nlemma trace_concatE [elim]:\n  assumes \"P\\<^sub>1 \\<mapsto>t\\<^sub>1@t\\<^sub>2\\<^sup>* P\\<^sub>3\"\n  obtains P\\<^sub>2 where \"P\\<^sub>1 \\<mapsto>t\\<^sub>1\\<^sup>* P\\<^sub>2\" \"P\\<^sub>2 \\<mapsto>t\\<^sub>2\\<^sup>* P\\<^sub>3\"\n  using assms\nproof (induct P\\<^sub>1 \"t\\<^sub>1 @t\\<^sub>2\" P\\<^sub>3 arbitrary: t\\<^sub>1 t\\<^sub>2)\n  case (prepend c\\<^sub>1 \\<alpha> c\\<^sub>2 t c\\<^sub>3)\n  then show ?case by (cases t\\<^sub>1) auto\nqed blast+\n\nlemma trace_preE [elim]:\n  assumes \"P\\<^sub>1 \\<mapsto>x#t\\<^sub>2\\<^sup>* P\\<^sub>3\"\n  obtains P\\<^sub>2 where \"P\\<^sub>1 \\<mapsto>[x]\\<^sup>* P\\<^sub>2\" \"P\\<^sub>2 \\<mapsto>t\\<^sub>2\\<^sup>* P\\<^sub>3\"\n  using assms by (metis append_Cons append_Nil trace_concatE)\n\nlemma trace_par [intro]:\n  assumes \"c\\<^sub>1 \\<mapsto>t\\<^sup>* c\\<^sub>1'\"\n  shows \"c\\<^sub>1 || c\\<^sub>2 \\<mapsto>t\\<^sup>* c\\<^sub>1' || c\\<^sub>2\" \"c\\<^sub>2 || c\\<^sub>1 \\<mapsto>t\\<^sup>* c\\<^sub>2 || c\\<^sub>1'\"\n  using assms by induct auto\n\nlemma trace_seq [intro]:\n  assumes \"P\\<^sub>1 \\<mapsto>t\\<^sub>1\\<^sup>* P\\<^sub>2\"\n  shows \"P\\<^sub>1 ;; P\\<^sub>3 \\<mapsto>t\\<^sub>1\\<^sup>* P\\<^sub>2 ;; P\\<^sub>3\"\n  using assms by induct blast+\n\nsubsection \\<open>Trace Elimination\\<close>\n\nsubsubsection \\<open>Skip Properties\\<close>\n\nlemma trace_skipE [elim]:\n  assumes \"Skip \\<mapsto>t\\<^sup>* P\"\n  obtains \"P = Skip\" \"t = []\"\n  using assms by (induct \"Skip :: 'a Stmt\" t P rule: trace.induct) blast+\n\nsubsubsection \\<open>Act Properties\\<close>\n\nlemma trace_actE [elim]:\n  assumes \"Basic \\<alpha> \\<mapsto>t\\<^sup>* P\"\n  obtains \"t = [\\<alpha>]\" \"P = Skip\" | \"t = []\" \"P = Basic \\<alpha>\"\n  using assms by (induct \"Basic \\<alpha>\" t P) blast+\n\nsubsubsection \\<open>Seq Properties\\<close>\n\nlemma trace_seqE [elim]:\n  assumes \"P\\<^sub>1 ;; P\\<^sub>2 \\<mapsto>t\\<^sup>* P\\<^sub>3\"\n  obtains t\\<^sub>1 t\\<^sub>2 P\\<^sub>1' P\\<^sub>2' where \"P\\<^sub>1 \\<mapsto>t\\<^sub>1\\<^sup>* P\\<^sub>1'\" \"P\\<^sub>2 \\<mapsto>t\\<^sub>2\\<^sup>* P\\<^sub>2'\" \"t = t\\<^sub>1@t\\<^sub>2\" \"P\\<^sub>1' ;; P\\<^sub>2' \\<mapsto>[]\\<^sup>* P\\<^sub>3\"\n  using assms \nproof (induct \"P\\<^sub>1 ;; P\\<^sub>2\" t P\\<^sub>3 arbitrary: P\\<^sub>1 P\\<^sub>2)\n  case lift\n  then show ?case by blast\nnext\n  case (rewrite c\\<^sub>2 t c\\<^sub>3)\n  then show ?case \n  proof (cases )\n    case (seq c\\<^sub>1')\n    then show ?thesis using rewrite by blast\n  next\n    case seqE\n    then show ?thesis using rewrite by force\n  qed\nnext\n  case (prepend \\<alpha> c\\<^sub>2 t c\\<^sub>3)\n  then show ?case\n  proof (cases)\n    case (seq c\\<^sub>1')\n    then show ?thesis \n      using prepend(2,4) prepend(3)[OF seq(1)] \n      by (metis Cons_eq_appendI trace.prepend)\n  qed\nqed\n\nlemma traces_seq_skipI [intro]:\n  shows \"Skip ;; Skip \\<mapsto>[]\\<^sup>* Skip\"\n  by auto\n\nlemma traces_seq_skipE [elim]:\n  assumes \"c\\<^sub>1 ;; c\\<^sub>2 \\<mapsto>[]\\<^sup>* Skip\"\n  obtains \"c\\<^sub>1 \\<mapsto>[]\\<^sup>* Skip\" \"c\\<^sub>2 \\<mapsto>[]\\<^sup>* Skip\"\n  using assms\n  by (induct \"c\\<^sub>1 ;; c\\<^sub>2\" \"[] :: 'a Trace\" \"Skip :: 'a Stmt\" arbitrary: c\\<^sub>1 c\\<^sub>2 rule: trace.induct)\n      blast+\n\nlemma trace_seq_fullE [elim]:\n  assumes \"P\\<^sub>1 ;; P\\<^sub>2 \\<mapsto>t\\<^sup>* Skip\"\n  obtains t\\<^sub>1 t\\<^sub>2 where \"P\\<^sub>1 \\<mapsto>t\\<^sub>1\\<^sup>* Skip\" \"P\\<^sub>2 \\<mapsto>t\\<^sub>2\\<^sup>* Skip\" \"t = t\\<^sub>1@t\\<^sub>2\"\n  using assms \nproof (cases rule: trace_seqE)\n  case (1 t\\<^sub>1 t\\<^sub>2 P\\<^sub>1' P\\<^sub>2')\n  then show ?thesis using traces_seq_skipE[OF 1(4)] that trace_concat by fastforce\nqed\n\nlemma traces_seq_fullI [intro]:\n  assumes \"P\\<^sub>1 \\<mapsto>t\\<^sub>1\\<^sup>* Skip\" \"P\\<^sub>2 \\<mapsto>t\\<^sub>2\\<^sup>* Skip\"\n  shows \"P\\<^sub>1 ;; P\\<^sub>2 \\<mapsto>t\\<^sub>1@t\\<^sub>2\\<^sup>* Skip\"\n  using assms by blast\n\nsubsubsection \\<open>Choice Properties\\<close>\n\nlemma trace_choiceE [elim]:\n  assumes \"P\\<^sub>1 \\<sqinter> P\\<^sub>2 \\<mapsto>t\\<^sup>* P\\<^sub>3\"\n  obtains \"P\\<^sub>1 \\<mapsto>t\\<^sup>* P\\<^sub>3\" | \"P\\<^sub>2 \\<mapsto>t\\<^sup>* P\\<^sub>3\" | \"P\\<^sub>3 = P\\<^sub>1 \\<sqinter> P\\<^sub>2\" \"t = []\"\n  using assms by (induct \"P\\<^sub>1 \\<sqinter> P\\<^sub>2\" t P\\<^sub>3) blast+\n\nsubsubsection \\<open>Loop Properties\\<close>\n\nlemma trace_loopE [elim]:\n  assumes \"P\\<^sub>1* \\<mapsto>t\\<^sup>* P\\<^sub>3\"\n  obtains n where \"unroll n P\\<^sub>1 \\<mapsto>t\\<^sup>* P\\<^sub>3\" | \"P\\<^sub>3 = (P\\<^sub>1*)\" \"t = []\"\n  using assms by (induct \"P\\<^sub>1*\" t P\\<^sub>3) blast+\n\nlemma trace_loop_zeroI [intro]:\n  \"c* \\<mapsto>[]\\<^sup>* Skip\"\nproof \n  show \"c* \\<leadsto> unroll 0 c\" by blast\nnext\n  show \"unroll 0 c \\<mapsto>[]\\<^sup>* Skip\" by auto\nqed\n\nlemma trace_loop_sucI [intro]:\n  \"c* \\<mapsto>t\\<^sub>1\\<^sup>* Skip \\<Longrightarrow> c \\<mapsto>t\\<^sub>2\\<^sup>* Skip \\<Longrightarrow> c* \\<mapsto>t\\<^sub>2@t\\<^sub>1\\<^sup>* Skip\"\nproof -\n  assume a: \"c* \\<mapsto>t\\<^sub>1\\<^sup>* Skip\" \"c \\<mapsto>t\\<^sub>2\\<^sup>* Skip\"\n  then obtain n where \"unroll n c \\<mapsto>t\\<^sub>1\\<^sup>* Skip\" by blast\n  then have \"unroll (Suc n) c \\<mapsto>t\\<^sub>2@t\\<^sub>1\\<^sup>* Skip\" using a(2) by auto\n  thus ?thesis by blast\nqed\n\nlemma trace_loop_fullE [elim]:\n  assumes \"P\\<^sub>1* \\<mapsto>t\\<^sup>* Skip\"\n  obtains n where \"unroll n P\\<^sub>1 \\<mapsto>t\\<^sup>* Skip\"\n  using assms by auto\n\nsubsubsection \\<open>Parallel Properties\\<close>\n\nlemma trace_parE [elim]:\n  assumes \"P\\<^sub>1 || P\\<^sub>2 \\<mapsto>t\\<^sup>* P\\<^sub>3\"\n  obtains t\\<^sub>1 t\\<^sub>2 P\\<^sub>1' P\\<^sub>2' where \"P\\<^sub>1 \\<mapsto>t\\<^sub>1\\<^sup>* P\\<^sub>1'\" \"P\\<^sub>2 \\<mapsto>t\\<^sub>2\\<^sup>* P\\<^sub>2'\" \"inter\\<^sub>i t\\<^sub>1 t\\<^sub>2 t\" \"P\\<^sub>1' || P\\<^sub>2' \\<mapsto>[]\\<^sup>* P\\<^sub>3\"\n  using assms \nproof (induct \"P\\<^sub>1 || P\\<^sub>2\" t P\\<^sub>3 arbitrary: P\\<^sub>1 P\\<^sub>2)\n  case (rewrite c\\<^sub>2 t c\\<^sub>3)\n  then show ?case\n  proof (cases rule: rw_parE)\n    case par1E\n    then show ?thesis using rewrite(1,2) rewrite(4)[of \"[]\"] by blast\n  next\n    case par2E\n    then show ?thesis using rewrite(1,2) rewrite(4)[of t] by blast\n  qed blast+\nqed blast+\n\nlemma trace_parI [intro]:\n  assumes \"inter\\<^sub>i t\\<^sub>1 t\\<^sub>2 t\" \"c\\<^sub>1 \\<mapsto>t\\<^sub>1\\<^sup>* c\\<^sub>1'\" \"c\\<^sub>2 \\<mapsto>t\\<^sub>2\\<^sup>* c\\<^sub>2'\" \n  shows \"c\\<^sub>1 || c\\<^sub>2 \\<mapsto>t\\<^sup>* c\\<^sub>1' || c\\<^sub>2'\"\n  using assms\nproof (induct arbitrary: c\\<^sub>1 c\\<^sub>2)\n  case e\n  then show ?case by (metis (no_types, lifting) Nil_is_append_conv trace_par trace_concat)\nnext\n  case (l l\\<^sub>1 l\\<^sub>2 t x)\n  then obtain c where \"c\\<^sub>1 \\<mapsto>[x]\\<^sup>* c\" \"c \\<mapsto>l\\<^sub>1\\<^sup>* c\\<^sub>1'\" by blast\n  thus ?case using l by auto\nnext\n  case (r l\\<^sub>1 l\\<^sub>2 t x)\n  then obtain c where \"c\\<^sub>2 \\<mapsto>[x]\\<^sup>* c\" \"c \\<mapsto>l\\<^sub>2\\<^sup>* c\\<^sub>2'\" by blast\n  thus ?case using r by auto\nqed\n\nlemma traces_par_skipI [intro]:\n  shows \"Skip || Skip \\<mapsto>[]\\<^sup>* Skip\"\n  by auto\n\nlemma traces_par_skipE [elim]:\n  assumes \"c\\<^sub>1 || c\\<^sub>2 \\<mapsto>[]\\<^sup>* Skip\"\n  obtains \"c\\<^sub>1 \\<mapsto>[]\\<^sup>* Skip\" \"c\\<^sub>2 \\<mapsto>[]\\<^sup>* Skip\"\n  using assms\n  by (induct \"c\\<^sub>1 || c\\<^sub>2\" \"[] :: 'a Trace\" \"Skip :: 'a Stmt\" arbitrary: c\\<^sub>1 c\\<^sub>2 rule: trace.induct)\n      blast+\n\nlemma trace_par_fullE [elim]:\n  assumes \"P\\<^sub>1 || P\\<^sub>2 \\<mapsto>t\\<^sup>* Skip\"\n  obtains t\\<^sub>1 t\\<^sub>2 where \"P\\<^sub>1 \\<mapsto>t\\<^sub>1\\<^sup>* Skip\" \"P\\<^sub>2 \\<mapsto>t\\<^sub>2\\<^sup>* Skip\" \"inter\\<^sub>i t\\<^sub>1 t\\<^sub>2 t\"\n  using assms\nproof (cases rule: trace_parE)\n  case (1 t\\<^sub>1 t\\<^sub>2 P\\<^sub>1' P\\<^sub>2')\n  thus ?thesis using trace_concat that by (elim traces_par_skipE) force\nqed\n\nlemma traces_par_fullI [intro]:\n  assumes \"P\\<^sub>1 \\<mapsto>t\\<^sub>1\\<^sup>* Skip\" \"P\\<^sub>2 \\<mapsto>t\\<^sub>2\\<^sup>* Skip\" \"inter\\<^sub>i t\\<^sub>1 t\\<^sub>2 t\"\n  shows \"P\\<^sub>1 || P\\<^sub>2 \\<mapsto>t\\<^sup>* Skip\"\nproof -\n  have \"P\\<^sub>1 || P\\<^sub>2 \\<mapsto>t\\<^sup>* Skip || Skip\" using assms by auto\n  thus ?thesis using traces_par_skipI trace_concat append_Nil2 by force\nqed\n\nsubsection \\<open>Properties over sets of traces\\<close>\n\ndefinition traces\n  where \"traces c\\<^sub>1 = {t. c\\<^sub>1 \\<mapsto>t\\<^sup>* Skip}\"\n\ndefinition cat\n  where \"cat s\\<^sub>1 s\\<^sub>2 \\<equiv> {t\\<^sub>1 @ t\\<^sub>2 |t\\<^sub>1 t\\<^sub>2. t\\<^sub>1 \\<in> s\\<^sub>1 \\<and> t\\<^sub>2 \\<in> s\\<^sub>2}\"\n\ndefinition rep\n  where \"rep s \\<equiv> Collect (rep\\<^sub>i s)\"\n\ndefinition inter\n  where \"inter s\\<^sub>1 s\\<^sub>2 = {t. \\<exists>t\\<^sub>1 t\\<^sub>2. t\\<^sub>1 \\<in> s\\<^sub>1 \\<and> t\\<^sub>2 \\<in> s\\<^sub>2 \\<and> inter\\<^sub>i t\\<^sub>1 t\\<^sub>2 t}\"\n\nsubsection \\<open>Trace Lemmas\\<close>\n\nlemma traces_skip [simp]:\n  \"traces Skip = {[]}\"\n  by (auto simp: traces_def)\n\nlemma traces_act [simp]:\n  \"traces (Basic \\<alpha>) = {[\\<alpha>]}\"\n  by (auto simp: traces_def)\n\nlemma traces_seq [simp]:\n  \"traces (c\\<^sub>1 ;; c\\<^sub>2) = cat (traces c\\<^sub>1) (traces c\\<^sub>2)\"\n  unfolding cat_def traces_def by blast\n\nlemma traces_choice [simp]:\n  \"traces (c\\<^sub>1 \\<sqinter> c\\<^sub>2) = traces c\\<^sub>1 \\<union> traces c\\<^sub>2\"\n  by (auto simp: traces_def)\n\nlemma traces_par [simp]:\n  \"traces (c\\<^sub>1 || c\\<^sub>2) = inter (traces c\\<^sub>1) (traces c\\<^sub>2)\"\n  unfolding traces_def inter_def by blast\n\nlemma traces_loop [simp]:\n  \"traces (c*) = rep (traces c)\"\n  unfolding traces_def rep_def\nproof (auto)\n  fix x assume \"c* \\<mapsto>x\\<^sup>* Skip\"\n  then obtain n where \"unroll n c \\<mapsto>x\\<^sup>* Skip\" by auto\n  thus \"rep\\<^sub>i {t. c \\<mapsto>t\\<^sup>* Skip} x\" by (induct n arbitrary: x) auto\nnext\n  fix x\n  show \"rep\\<^sub>i {t. c \\<mapsto>t\\<^sup>* Skip} x \\<Longrightarrow> c* \\<mapsto>x\\<^sup>* Skip\"\n    by (induct \"{t. c \\<mapsto>t\\<^sup>* Skip}\" x rule: rep\\<^sub>i.induct) auto\nqed\n\nlemma trace_det:\n  assumes \"c \\<mapsto>t\\<^sup>* c'\" \"c \\<mapsto>t\\<^sup>* c''\"\n  shows \"c'' = c'\"\n  using assms\nproof (induct arbitrary: c'')\n  case (lift c)\n  then show ?case sorry\nnext\n  case (rewrite c\\<^sub>1 c\\<^sub>2 t c\\<^sub>3)\n  then show ?case sorry\nnext\n  case (prepend c\\<^sub>1 \\<alpha> c\\<^sub>2 t c\\<^sub>3)\n  then show ?case sorry\nqed\n\nend", "meta": {"author": "UQ-PAC", "repo": "wpif_CSF21", "sha": "e2fd527115dcd01c5a8e0664480bb982eb696d7e", "save_path": "github-repos/isabelle/UQ-PAC-wpif_CSF21", "path": "github-repos/isabelle/UQ-PAC-wpif_CSF21/wpif_CSF21-e2fd527115dcd01c5a8e0664480bb982eb696d7e/Isabelle/Trace.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030761371503, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.3110543625968047}}
{"text": "(*  Title:      HOL/Auth/n_mutualEx_on_inis.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualEx Protocol Case Study*} \n\ntheory n_mutualEx_on_inis imports n_mutualEx_on_ini\nbegin\nlemma on_inis:\n  assumes b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  shows \"formEval f s\"\n  proof -\n  have c1: \"(\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__1  p__Inv3 p__Inv4)\\<or>\n    (\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__2  p__Inv4)\\<or>\n    (\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__3  p__Inv3 p__Inv4)\\<or>\n    (\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__4  p__Inv4)\\<or>\n    (\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__5  p__Inv3 p__Inv4)\"\n  apply (cut_tac b1, simp) done\n    moreover {\n      assume d1: \"(\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__1  p__Inv3 p__Inv4)\"\n      have \"formEval f s\"\n      apply (rule iniImply_inv__1)\n      apply (cut_tac d1, assumption)\n      apply (cut_tac b2 b3, blast) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__2  p__Inv4)\"\n      have \"formEval f s\"\n      apply (rule iniImply_inv__2)\n      apply (cut_tac d1, assumption)\n      apply (cut_tac b2 b3, blast) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__3  p__Inv3 p__Inv4)\"\n      have \"formEval f s\"\n      apply (rule iniImply_inv__3)\n      apply (cut_tac d1, assumption)\n      apply (cut_tac b2 b3, blast) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__4  p__Inv4)\"\n      have \"formEval f s\"\n      apply (rule iniImply_inv__4)\n      apply (cut_tac d1, assumption)\n      apply (cut_tac b2 b3, blast) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__5  p__Inv3 p__Inv4)\"\n      have \"formEval f s\"\n      apply (rule iniImply_inv__5)\n      apply (cut_tac d1, assumption)\n      apply (cut_tac b2 b3, blast) done\n    }\n\n  ultimately show \"formEval f s\"\n  by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mutualEx/n_mutualEx_on_inis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370308082623217, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.31105156596637634}}
{"text": "(*  File:       Sequential_Composition.thy\n    Copyright   2021  Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\<open>creator \"Karsten Diekhoff, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\\<^marker>\\<open>contributor \"Jonas Kraemer, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\\<^marker>\\<open>contributor \"Michael Kirsten, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\nsection \\<open>Sequential Composition\\<close>\n\ntheory Sequential_Composition\n  imports \"Basic_Modules/Component_Types/Electoral_Module\"\nbegin\n\ntext\n\\<open>The sequential composition creates a new electoral module from\ntwo electoral modules. In a sequential composition, the second\nelectoral module makes decisions over alternatives deferred by\nthe first electoral module.\\<close>\n\nsubsection \\<open>Definition\\<close>\n\nfun sequential_composition :: \"'a Electoral_Module \\<Rightarrow> 'a Electoral_Module \\<Rightarrow>\n        'a Electoral_Module\" where\n  \"sequential_composition m n A p vs =\n    (let new_A = defer m A p vs;\n        new_p = limit_profile new_A p;\n        new_vs =  limit_pair_vectors new_A vs in (\n                  (elect m A p vs) \\<union> (elect n new_A new_p new_vs),\n                  (reject m A p vs) \\<union> (reject n new_A new_p new_vs),\n                  defer n new_A new_p new_vs))\"\n\nabbreviation sequence ::\n  \"'a Electoral_Module \\<Rightarrow> 'a Electoral_Module \\<Rightarrow> 'a Electoral_Module\"\n     (infix \"\\<triangleright>\" 50) where\n  \"m \\<triangleright> n == sequential_composition m n\"\n\nlemma seq_comp_presv_disj:\n  assumes module_m: \"electoral_module m\" and\n          module_n: \"electoral_module n\" and\n          f_prof:  \"finite_profile A p\" and\n          f_vec: \"finite_pair_vectors A vs\"\n  shows \"disjoint3 ((m \\<triangleright> n) A p vs)\"\nproof -\n  let ?new_A = \"defer m A p vs\"\n  let ?new_p = \"limit_profile ?new_A p\"\n  let ?new_vs = \"limit_pair_vectors ?new_A vs\"\n  have fin_def: \"finite (defer m A p vs)\"\n    using def_presv_fin_prof f_prof module_m f_vec\n    by metis\n  have prof_def_lim:\n    \"profile (defer m A p vs) (limit_profile (defer m A p vs) p)\"\n    using def_presv_fin_prof f_prof module_m f_vec\n    by metis\n  have vec_def_lim:\n    \"vector_pair (defer m A p vs) (limit_pair_vectors (defer m A p vs) vs)\"\n    using f_prof module_m f_vec def_presv_fin_vector_pair\n    by metis\n  have defer_in_A:\n    \"\\<forall>prof f a A vs.\n      (profile A prof \\<and> finite A \\<and> vector_pair A vs \\<and> electoral_module f \\<and>\n        (a::'a) \\<in> defer f A prof vs) \\<longrightarrow>\n          a \\<in> A\"\n    using UnCI result_presv_alts\n    by (metis (mono_tags))\n  from module_m f_prof f_vec\n  have disjoint_m: \"disjoint3 (m A p vs)\"\n    using electoral_module_def well_formed.simps\n    by blast\n  from module_m module_n def_presv_fin_prof f_prof\n  have disjoint_n:\n    \"(disjoint3 (n ?new_A ?new_p ?new_vs))\"\n    using electoral_module_def well_formed.simps\n    by (metis def_presv_fin_vector_pair f_vec)\n  have disj_n:\n    \"elect m A p vs \\<inter> reject m A p vs = {} \\<and>\n      elect m A p vs \\<inter> defer m A p vs = {} \\<and>\n      reject m A p vs \\<inter> defer m A p vs = {}\"\n    using f_prof module_m f_vec\n    by (simp add: result_disj)\n  from f_prof module_m module_n f_vec\n  have rej_n_in_def_m:\n    \"reject n (defer m A p vs)\n      (limit_profile (defer m A p vs) p) (limit_pair_vectors (defer m A p vs) vs)  \\<subseteq> defer m A p vs\"\n    using def_presv_fin_prof reject_in_alts  def_presv_fin_vector_pair\n    by metis\n  with disjoint_m module_m module_n f_prof f_vec\n  have 0:\n    \"(elect m A p vs \\<inter> reject n ?new_A ?new_p ?new_vs) = {}\"\n    using disj_n\n    by (simp add: disjoint_iff_not_equal subset_eq)\n  from f_prof module_m module_n f_vec\n  have elec_n_in_def_m:\n    \"elect n (defer m A p vs)\n      (limit_profile (defer m A p vs) p) (limit_pair_vectors (defer m A p vs) vs) \\<subseteq> defer m A p vs\"\n    using def_presv_fin_prof elect_in_alts def_presv_fin_vector_pair\n    by metis\n  from disjoint_m disjoint_n def_presv_fin_prof f_prof f_vec\n       module_m module_n def_presv_fin_vector_pair\n  have 1:\n    \"(elect m A p vs \\<inter> defer n ?new_A ?new_p ?new_vs) = {}\"\n  proof -\n    obtain sf :: \"'a set \\<Rightarrow> 'a set \\<Rightarrow> 'a\" where\n      \"\\<forall>a b.\n        (\\<exists>c. c \\<in> b \\<and> (\\<exists>d. d \\<in> a \\<and> c = d)) =\n          (sf a b \\<in> b \\<and>\n            (\\<exists>e. e \\<in> a \\<and> sf a b = e))\"\n      by moura\n    then obtain sf2 :: \"'a set \\<Rightarrow> 'a set \\<Rightarrow> 'a\" where\n      \"\\<forall>A B.\n        (A \\<inter> B \\<noteq> {} \\<or> (\\<forall>a. a \\<notin> A \\<or> (\\<forall>b. b \\<notin> B \\<or> a \\<noteq> b))) \\<and>\n          (A \\<inter> B = {} \\<or> sf B A \\<in> A \\<and> sf2 B A \\<in> B \\<and>\n            sf B A = sf2 B A)\"\n      by auto\n    thus ?thesis\n      using defer_in_A disj_n fin_def module_n prof_def_lim vec_def_lim\n      by (metis (no_types))\n  qed\n  from disjoint_m disjoint_n def_presv_fin_prof f_prof f_vec\n       module_m module_n\n  have 2:\n    \"(reject m A p vs \\<inter> reject n ?new_A ?new_p ?new_vs) = {}\"\n    using disjoint_iff_not_equal reject_in_alts\n          set_rev_mp result_disj Int_Un_distrib2\n          Un_Diff_Int boolean_algebra_cancel.inf2\n          inf.order_iff inf_sup_aci(1) subsetD\n          rej_n_in_def_m disj_n\n    by auto\n  have \"\\<forall>A Aa. \\<not> (A::'a set) \\<subseteq> Aa \\<or> A = A \\<inter> Aa\"\n    by blast\n  with disjoint_m disjoint_n def_presv_fin_prof f_prof\n       module_m module_n elec_n_in_def_m\n  have 3:\n    \"(reject m A p vs \\<inter> elect n ?new_A ?new_p ?new_vs) = {}\"\n    using disj_n\n    by blast\n  have\n    \"(elect m A p vs \\<union> elect n ?new_A ?new_p ?new_vs) \\<inter>\n          (reject m A p vs \\<union> reject n ?new_A ?new_p ?new_vs) = {}\"\n  proof (safe)\n    fix x :: \"'a\"\n    assume\n      elec_x: \"x \\<in> elect m A p vs\" and\n      rej_x: \"x \\<in> reject m A p vs\"\n    from elec_x rej_x\n    have \"x \\<in> elect m A p vs \\<inter> reject m A p vs\"\n      by simp\n    thus \"x \\<in> {}\"\n      using disj_n\n      by simp\n  next\n    fix x :: \"'a\"\n    assume\n      elec_x: \"x \\<in> elect m A p vs\" and\n      rej_lim_x:\n      \"x \\<in> reject n (defer m A p vs)\n        (limit_profile (defer m A p vs) p) (limit_pair_vectors (defer m A p vs) vs)\"\n    from elec_x rej_lim_x\n    show \"x \\<in> {}\"\n      using \"0\"\n      by blast\n  next\n    fix x :: \"'a\"\n    assume\n      elec_lim_x:\n      \"x \\<in> elect n (defer m A p vs) (limit_profile (defer m A p vs) p) \n          (limit_pair_vectors (defer m A p vs) vs)\" and\n      rej_x: \"x \\<in> reject m A p vs\"\n    from elec_lim_x rej_x\n    show \"x \\<in> {}\"\n      using \"3\"\n      by blast\n  next\n    fix x :: \"'a\"\n    assume\n      elec_lim_x:\n      \"x \\<in> elect n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs)\" and\n      rej_lim_x:\n      \"x \\<in> reject n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs)\"\n    from elec_lim_x rej_lim_x\n    show \"x \\<in> {}\"\n      using disjoint_iff_not_equal elec_lim_x fin_def vec_def_lim\n            module_n prof_def_lim rej_lim_x result_disj\n      by metis\n  qed\n  moreover from 0 1 2 3 disjoint_n module_m module_n f_prof f_vec\n  have\n    \"(elect m A p vs \\<union> elect n ?new_A ?new_p ?new_vs) \\<inter>\n          (defer n ?new_A ?new_p ?new_vs) = {}\"\n    using Int_Un_distrib2 Un_empty def_presv_fin_prof result_disj vec_def_lim\n    by metis\n  moreover from 0 1 2 3 f_prof disjoint_m disjoint_n module_m module_n\n  have\n    \"(reject m A p vs \\<union> reject n ?new_A ?new_p ?new_vs) \\<inter>\n          (defer n ?new_A ?new_p ?new_vs) = {}\"\n(*    using Int_Un_distrib2 defer_in_alts distrib_imp2\n          def_presv_fin_prof result_disj subset_Un_eq\n          sup_inf_distrib1 *)\n  proof (safe)\n    fix x :: \"'a\"\n    assume\n      elec_rej_disj:\n      \"elect m A p vs \\<inter>\n        reject n (defer m A p vs) (limit_profile (defer m A p vs) p)\n        (limit_pair_vectors (defer m A p vs) vs) = {}\" and\n      elec_def_disj:\n      \"elect m A p vs \\<inter>\n        defer n (defer m A p vs) (limit_profile (defer m A p vs) p)\n        (limit_pair_vectors (defer m A p vs) vs) = {}\" and\n      rej_rej_disj:\n      \"reject m A p vs \\<inter>\n        reject n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) = {}\" and\n      rej_elec_disj:\n      \"reject m A p vs \\<inter>\n        elect n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) = {}\" and\n      disj_p: \"disjoint3 (m A p vs)\" and\n      disj_limit:\n      \"disjoint3 (n (defer m A p vs) (limit_profile (defer m A p vs) p)\n      (limit_pair_vectors (defer m A p vs) vs))\" and\n      mod_m: \"electoral_module m\" and\n      mod_n: \"electoral_module n\" and\n      fin_A: \"finite A\" and\n      prof_A: \"profile A p\" and\n      x_in_def:\n      \"x \\<in> defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n      (limit_pair_vectors (defer m A p vs) vs)\" and\n      x_in_rej: \"x \\<in> reject m A p vs\"\n    from x_in_def\n    have \"x \\<in> defer m A p vs\"\n      using defer_in_A fin_def module_n prof_def_lim vec_def_lim\n      by blast\n    with x_in_rej\n    have \"x \\<in> reject m A p vs \\<inter> defer m A p vs\"\n      by fastforce\n    thus \"x \\<in> {}\"\n      using disj_n\n      by blast\n  next\n    fix x :: \"'a\"\n    assume\n      elec_rej_disj:\n      \"elect m A p vs \\<inter>\n        reject n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) = {}\" and\n      elec_def_disj:\n      \"elect m A p vs \\<inter>\n        defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) = {}\" and\n      rej_rej_disj:\n      \"reject m A p vs \\<inter>\n        reject n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) = {}\" and\n      rej_elec_disj:\n      \"reject m A p vs \\<inter>\n        elect n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) = {}\" and\n      disj_p: \"disjoint3 (m A p vs)\" and\n      disj_limit:\n      \"disjoint3 (n (defer m A p vs) (limit_profile (defer m A p vs) p) \n      (limit_pair_vectors (defer m A p vs) vs))\" and\n      mod_m: \"electoral_module m\" and\n      mod_n: \"electoral_module n\" and\n      fin_A: \"finite A\" and\n      prof_A: \"profile A p\" and\n      x_in_def:\n      \"x \\<in> defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n      (limit_pair_vectors (defer m A p vs) vs)\" and\n      x_in_rej:\n      \"x \\<in> reject n (defer m A p vs) (limit_profile (defer m A p vs) p) \n      (limit_pair_vectors (defer m A p vs) vs)\"\n    from x_in_def x_in_rej\n    show \"x \\<in> {}\"\n      using fin_def module_n prof_def_lim reject_not_elec_or_def vec_def_lim \n       Diff_iff by fastforce\n  qed\n  ultimately have\n    \"disjoint3 (elect m A p vs \\<union> elect n ?new_A ?new_p ?new_vs,\n                reject m A p vs \\<union> reject n ?new_A ?new_p ?new_vs,\n                defer n ?new_A ?new_p ?new_vs)\"\n    by simp\n  thus ?thesis\n    using sequential_composition.simps\n    by metis\nqed\n\nlemma seq_comp_presv_alts:\n  assumes module_m: \"electoral_module m\" and\n          module_n: \"electoral_module n\" and\n          f_prof:  \"finite_profile A p\" and\n          f_vec: \"finite_pair_vectors A vs\"\n  shows \"set_equals_partition A ((m \\<triangleright> n) A p vs)\"\nproof -\n  let ?new_A = \"defer m A p vs\"\n  let ?new_p = \"limit_profile ?new_A p\"\n  let ?new_vs = \"(limit_pair_vectors ?new_A vs)\"\n  from module_m f_prof f_vec have \"set_equals_partition A (m A p vs)\"\n    by (simp add: electoral_module_def)\n  with module_m f_prof f_vec have 0:\n    \"elect m A p vs \\<union> reject m A p vs \\<union> ?new_A = A\"\n    by (simp add: result_presv_alts)\n  from module_n def_presv_fin_prof f_prof f_vec module_m have\n    \"set_equals_partition ?new_A (n ?new_A ?new_p ?new_vs)\"\n    using electoral_module_def well_formed.simps def_presv_fin_vector_pair    \n    by metis\n  with module_m module_n f_prof f_vec have 1:\n    \"elect n ?new_A ?new_p ?new_vs \\<union>\n        reject n ?new_A ?new_p ?new_vs \\<union>\n        defer n ?new_A ?new_p ?new_vs = ?new_A\"\n    using def_presv_fin_prof result_presv_alts def_presv_fin_vector_pair\n    by metis\n  from 0 1 have\n    \"(elect m A p vs \\<union> elect n ?new_A ?new_p ?new_vs) \\<union>\n        (reject m A p vs \\<union> reject n ?new_A ?new_p ?new_vs) \\<union>\n         defer n ?new_A ?new_p ?new_vs = A\"\n    by blast\n  hence\n    \"set_equals_partition A\n      (elect m A p vs \\<union> elect n ?new_A ?new_p ?new_vs,\n      reject m A p vs \\<union> reject n ?new_A ?new_p ?new_vs,\n      defer n ?new_A ?new_p ?new_vs)\"\n    by simp\n  thus ?thesis\n    using sequential_composition.simps\n    by metis\nqed\n\nsubsection \\<open>Soundness\\<close>\n\ntheorem seq_comp_sound[simp]:\n  assumes module_m: \"electoral_module m\" and\n          module_n: \"electoral_module n\"\n        shows \"electoral_module (m \\<triangleright> n)\"\n  unfolding electoral_module_def\nproof (safe)\n  fix\n    A :: \"'a set\" and\n    p :: \"'a Profile\" and\n    vs :: \"'a Pair_Vectors\"\n  assume\n    fin_A: \"finite A\" and\n    prof_A: \"profile A p\" and\n    vec_A: \"vector_pair A vs\"\n  have \"\\<forall>r. well_formed (A::'a set) r =\n          (disjoint3 r \\<and> set_equals_partition A r)\"\n    by simp\n  thus \"well_formed A ((m \\<triangleright> n) A p vs)\"\n    using module_m module_n seq_comp_presv_disj\n          seq_comp_presv_alts fin_A prof_A vec_A\n    by metis\nqed\n\nsubsection \\<open>Lemmata\\<close>\n\nlemma seq_comp_dec_only_def:\n  assumes\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    f_prof: \"finite_profile A p\" and\n    f_vec: \"finite_pair_vectors A vs\" and\n    empty_defer: \"defer m A p vs = {}\"\n  shows \"(m \\<triangleright> n) A p vs =  m A p vs\"\nproof\n  have\n    \"\\<forall>f A prof vs.\n      (electoral_module f \\<and> finite_profile A prof \\<and> finite_pair_vectors A vs) \\<longrightarrow>\n        finite_pair_vectors (defer f A prof vs) (limit_pair_vectors (defer f A prof vs) vs)\"\n    using def_presv_fin_prof def_presv_fin_vector_pair\n    by metis\n  hence vec_no_alt: \"vector_pair {} (limit_pair_vectors (defer m A p vs) vs)\"\n    using empty_defer f_prof f_vec module_m by fastforce \n  have\n    \"\\<forall>f A prof vs.\n      (electoral_module f \\<and> finite_profile A prof \\<and> finite_pair_vectors A vs) \\<longrightarrow>\n        finite_profile (defer f A prof vs)\n          (limit_profile (defer f A prof vs) prof)\"\n    using def_presv_fin_prof \n    by metis\n  hence prof_no_alt:\n    \"profile {} (limit_profile (defer m A p vs) p)\"\n    using empty_defer f_prof module_m f_vec\n    by metis\n  hence\n    \"(elect m A p vs) \\<union>\n      (elect n (defer m A p vs)\n        (limit_profile (defer m A p vs) p) (limit_pair_vectors (defer m A p vs) vs))\n    = elect m A p vs\"\n    using elect_in_alts empty_defer module_n vec_no_alt\n    by fastforce \n  thus \"elect (m \\<triangleright> n) A p vs = elect m A p vs\"\n    using fst_conv sequential_composition.simps\n    by metis\nnext\n  have rej_empty:\n    \"\\<forall>f prof vs.\n      (electoral_module f \\<and> profile ({}::'a set) prof) \\<and> vector_pair ({}::'a set) vs\\<longrightarrow>\n        reject f {} prof vs = {}\"\n    using bot.extremum_uniqueI infinite_imp_nonempty reject_in_alts\n    by metis\n  have prof_no_alt:\n    \"profile {} (limit_profile (defer m A p vs) p)\"\n    using empty_defer f_prof module_m limit_profile_sound\n    by auto\n  have vec_no_alt:\n    \"vector_pair {} (limit_pair_vectors (defer m A p vs) vs)\" \n    using empty_defer f_prof f_vec module_m limit_profile_sound limit_pair_vectors_sound prof_no_alt\n     by (simp add: vector_pair_def empty_defer)\n  hence\n    \"(reject m A p vs, defer n {} (limit_profile {} p) (limit_pair_vectors {} vs)) =\n        snd (m A p vs)\"\n    using bot.extremum_uniqueI defer_in_alts empty_defer\n          infinite_imp_nonempty module_n prod.collapse vec_no_alt prof_no_alt\n    by (metis (no_types))\n  thus \"snd ((m \\<triangleright> n) A p vs) = snd (m A p vs)\"\n    using rej_empty empty_defer module_n prof_no_alt vec_no_alt\n    by auto\nqed\n\nlemma seq_comp_def_then_elect:\n  assumes\n    n_electing_m: \"non_electing m\" and\n    def_one_m: \"defers 1 m\" and\n    electing_n: \"electing n\" and\n    f_prof: \"finite_profile A p\" and\n    f_vec: \"finite_pair_vectors A vs\"\n  shows \"elect (m \\<triangleright> n) A p vs = defer m A p vs\"\nproof cases\n  assume \"A = {}\"\n  with electing_n n_electing_m f_prof\n  show ?thesis\n    using bot.extremum_uniqueI defer_in_alts elect_in_alts\n          electing_def non_electing_def seq_comp_sound f_vec\n    by metis\nnext\n  assume assm: \"A \\<noteq> {}\"\n  from n_electing_m f_prof f_vec\n  have ele: \"elect m A p vs = {}\"\n    using non_electing_def\n    by blast\n  from assm def_one_m f_prof finite f_vec\n  have def_card:\n    \"card (defer m A p vs) = 1\"\n    by (simp add: Suc_leI card_gt_0_iff defers_def)\n  with n_electing_m f_prof\n  have def:\n    \"\\<exists>a \\<in> A. defer m A p vs = {a}\"\n    using card_1_singletonE defer_in_alts\n          non_electing_def singletonI subsetCE f_vec \n    by metis\n  from ele def n_electing_m\n  have rej:\n    \"\\<exists>a \\<in> A. reject m A p vs = A-{a}\"\n    using Diff_empty def_one_m defers_def\n          f_prof reject_not_elec_or_def f_vec\n    by metis\n  from ele rej def n_electing_m f_prof\n  have res_m:\n    \"\\<exists>a \\<in> A. m A p vs = ({}, A-{a}, {a})\"\n    using Diff_empty combine_ele_rej_def non_electing_def\n          reject_not_elec_or_def f_vec\n    by metis\n  hence\n    \"\\<exists>a \\<in> A. elect (m \\<triangleright> n) A p vs  =\n        elect n {a} (limit_profile {a} p) (limit_pair_vectors (defer m A p vs) vs)\"\n    using prod.sel(1) prod.sel(2) sequential_composition.simps\n          sup_bot.left_neutral\n    by metis\n  with def_card def electing_n n_electing_m f_prof\n  have\n    \"\\<exists>a \\<in> A. elect (m \\<triangleright> n) A p vs = {a}\"\n    using electing_for_only_alt non_electing_def prod.sel\n          sequential_composition.simps def_presv_fin_prof\n          sup_bot.left_neutral def_presv_fin_vector_pair f_vec\n    by metis\n  with def def_card electing_n n_electing_m f_prof res_m f_vec\n  show ?thesis\n    using def_presv_fin_prof electing_for_only_alt fst_conv\n          non_electing_def sequential_composition.simps\n          sup_bot.left_neutral def_presv_fin_vector_pair\n    by metis\nqed\n\nlemma seq_comp_def_card_bounded:\n  assumes\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    f_prof: \"finite_profile A p\" and\n    f_vec: \"finite_pair_vectors A vs\"\n  shows \"card (defer (m \\<triangleright> n) A p vs) \\<le> card (defer m A p vs)\"\n  using card_mono defer_in_alts module_m module_n f_prof f_vec\n        sequential_composition.simps def_presv_fin_prof snd_conv\n        def_presv_fin_vector_pair\n  by metis\n\nlemma seq_comp_def_set_bounded:\n  assumes\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    f_prof: \"finite_profile A p\" and\n    f_vec: \"finite_pair_vectors A vs\"\n  shows \"defer (m \\<triangleright> n) A p vs \\<subseteq> defer m A p vs\"\n  using defer_in_alts module_m module_n prod.sel(2) f_prof def_presv_fin_vector_pair\n        sequential_composition.simps def_presv_fin_prof f_vec\n  by metis\n\nlemma seq_comp_defers_def_set:\n  assumes\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    f_prof: \"finite_profile A p\" and\n    f_vec: \"finite_pair_vectors A vs\"\n  shows\n    \"defer (m \\<triangleright> n) A p vs =\n      defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n    (limit_pair_vectors (defer m A p vs) vs)\"\n  using sequential_composition.simps snd_conv\n  by metis\n\nlemma seq_comp_def_then_elect_elec_set:\n  assumes\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    f_prof: \"finite_profile A p\" and\n    f_vec: \"finite_pair_vectors A vs\"\n  shows\n    \"elect (m \\<triangleright> n) A p vs =\n      elect n (defer m A p vs) (limit_profile (defer m A p vs) p) \n      (limit_pair_vectors (defer m A p vs) vs) \\<union> (elect m A p vs)\"\n  using Un_commute fst_conv sequential_composition.simps\n  by metis\n\nlemma seq_comp_elim_one_red_def_set:\n  assumes\n    module_m: \"electoral_module m\" and\n    module_n: \"eliminates 1 n\" and\n    f_prof: \"finite_profile A p\" and\n    enough_leftover: \"card (defer m A p vs) > 1\" and\n    f_vec: \"finite_pair_vectors A vs\"\n  shows \"defer (m \\<triangleright> n) A p vs \\<subset> defer m A p vs\"\n  using enough_leftover module_m module_n f_prof\n        sequential_composition.simps def_presv_fin_prof\n        single_elim_imp_red_def_set snd_conv f_vec def_presv_fin_vector_pair\n  by metis\n\nlemma seq_comp_def_set_sound:\n  assumes\n    \"electoral_module m\" and\n    \"electoral_module n\" and\n    \"finite_profile A p\" and\n    \"finite_pair_vectors A vs\"\n  shows \"defer (m \\<triangleright> n) A p vs \\<subseteq> defer m A p vs\"\nproof -\n  have \"\\<forall>A p vs. finite_profile A p \\<and> finite_pair_vectors A vs\n        \\<longrightarrow> well_formed A (n A p vs)\"\n    using assms(2) electoral_module_def\n    by auto\n  hence\n    \"finite_profile (defer m A p vs) (limit_profile (defer m A p vs) p) \\<and>\n     finite_pair_vectors (defer m A p vs) (limit_pair_vectors (defer m A p vs) vs) \\<longrightarrow>\n        well_formed (defer m A p vs)\n          (n (defer m A p vs) (limit_profile (defer m A p vs) p) \n      (limit_pair_vectors (defer m A p vs) vs))\"\n    by simp\n  hence\n    \"well_formed (defer m A p vs) (n (defer m A p vs)\n      (limit_profile (defer m A p vs) p) (limit_pair_vectors (defer m A p vs) vs))\"\n    using assms(1) assms(3) assms(4) def_presv_fin_prof def_presv_fin_vector_pair\n    by metis\n  thus ?thesis\n    using assms seq_comp_def_set_bounded\n    by blast\nqed\n\nlemma seq_comp_def_set_trans:\n  assumes\n    \"a \\<in> (defer (m \\<triangleright> n) A p vs)\" and\n    \"electoral_module m \\<and> electoral_module n\" and\n    \"finite_profile A p\" and \n    \"finite_pair_vectors A vs\"\n  shows\n    \"a \\<in> defer n (defer m A p vs)\n      (limit_profile (defer m A p vs) p) (limit_pair_vectors (defer m A p vs) vs) \\<and>\n      a \\<in> defer m A p vs\"\n  using seq_comp_def_set_bounded assms(1) assms(2)\n        assms(3) assms(4) in_mono seq_comp_defers_def_set\n  by (smt (verit, ccfv_threshold))\n\nsubsection \\<open>Composition Rules\\<close>\n\n(*The sequential composition preserves the non-blocking property.*)\ntheorem seq_comp_presv_non_blocking[simp]:\n  assumes\n    non_blocking_m: \"non_blocking m\" and\n    non_blocking_n: \"non_blocking n\"\n  shows \"non_blocking (m \\<triangleright> n)\"\nproof -\n  fix\n    A :: \"'a set\" and\n    p :: \"'a Profile\" and\n    vs :: \"'a Pair_Vectors\"\n  let ?input_sound = \"((A::'a set) \\<noteq> {} \\<and> finite_profile A p \\<and> \n      finite_pair_vectors A vs)\"\n  from non_blocking_m have\n    \"?input_sound \\<longrightarrow> reject m A p vs \\<noteq> A\"\n    by (simp add: non_blocking_def)\n  with non_blocking_m have 0:\n    \"?input_sound \\<longrightarrow> A - reject m A p vs \\<noteq> {}\"\n    using Diff_eq_empty_iff non_blocking_def\n          reject_in_alts subset_antisym\n    by metis\n  from non_blocking_m have\n    \"?input_sound \\<longrightarrow> well_formed A (m A p vs)\"\n    by (simp add: electoral_module_def non_blocking_def)\n  hence\n    \"?input_sound \\<longrightarrow>\n        elect m A p vs \\<union> defer m A p vs = A - reject m A p vs\"\n    using non_blocking_def non_blocking_m elec_and_def_not_rej\n    by metis\n  with 0 have\n    \"?input_sound \\<longrightarrow> elect m A p vs \\<union> defer m A p vs \\<noteq> {}\"\n    by auto\n  hence \"?input_sound \\<longrightarrow> (elect m A p vs \\<noteq> {} \\<or> defer m A p vs \\<noteq> {})\"\n    by simp\n  with non_blocking_m non_blocking_n\n  show ?thesis\n  proof (unfold non_blocking_def)\n    assume\n      emod_reject_m:\n      \"electoral_module m \\<and>\n        (\\<forall>A p vs. A \\<noteq> {} \\<and> finite_profile A p \\<and> finite_pair_vectors A vs \\<longrightarrow>\n          reject m A p vs \\<noteq> A)\" and\n      emod_reject_n:\n      \"electoral_module n \\<and>\n        (\\<forall>A p vs. A \\<noteq> {} \\<and> finite_profile A p \\<and> finite_pair_vectors A vs \\<longrightarrow>\n          reject n A p vs \\<noteq> A)\"\n    show\n      \"electoral_module (m \\<triangleright> n) \\<and>\n        (\\<forall>A p vs.\n          A \\<noteq> {} \\<and> finite_profile A p \\<and> finite_pair_vectors A vs \\<longrightarrow>\n            reject (m \\<triangleright> n) A p vs \\<noteq> A)\"\n    proof (safe)\n      show \"electoral_module (m \\<triangleright> n)\"\n        using emod_reject_m emod_reject_n\n        by simp\n    next\n      fix\n        A :: \"'a set\" and\n        p :: \"'a Profile\" and\n        vs :: \"'a Pair_Vectors\" and\n        x :: \"'a\"\n      assume\n        fin_A: \"finite A\" and\n        prof_A: \"profile A p\" and\n        vec_A: \"vector_pair A vs\" and\n        rej_mn: \"reject (m \\<triangleright> n) A p vs = A\" and\n        x_in_A: \"x \\<in> A\"\n      from emod_reject_m fin_A prof_A vec_A\n      have fin_defer:\n        \"finite_profile (defer m A p vs) (limit_profile (defer m A p vs) p)\"\n        using def_presv_fin_prof\n        by (metis (no_types))\n      from emod_reject_m fin_A prof_A vec_A\n      have fin_defer2:\n        \"finite_pair_vectors (defer m A p vs) (limit_pair_vectors (defer m A p vs) vs)\"\n        using def_presv_fin_prof def_presv_fin_vector_pair\n        by (metis (no_types))\n      from emod_reject_m emod_reject_n fin_A prof_A vec_A\n      have seq_elect:\n        \"elect (m \\<triangleright> n) A p vs =\n          elect n (defer m A p vs) (limit_profile (defer m A p vs) p) \n          (limit_pair_vectors (defer m A p vs) vs) \\<union>\n            elect m A p vs\"\n        using seq_comp_def_then_elect_elec_set\n        by metis\n      from emod_reject_n emod_reject_m fin_A prof_A vec_A\n      have def_limit:\n        \"defer (m \\<triangleright> n) A p vs =\n          defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n          (limit_pair_vectors (defer m A p vs) vs)\"\n        using seq_comp_defers_def_set\n        by metis\n      from emod_reject_n emod_reject_m fin_A prof_A vec_A\n      have\n        \"elect (m \\<triangleright> n) A p vs \\<union> defer (m \\<triangleright> n) A p vs = A - reject (m \\<triangleright> n) A p vs\"\n        using elec_and_def_not_rej seq_comp_sound\n        by metis\n      hence elect_def_disj:\n        \"elect n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) \\<union>\n        elect m A p vs \\<union>\n        defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) = {}\"\n        using def_limit seq_elect Diff_cancel rej_mn\n        by auto\n      have rej_def_eq_set:\n        \"defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) -\n        defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) = {} \\<longrightarrow>\n        reject n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) =\n              defer m A p vs\"\n        using elect_def_disj emod_reject_n fin_defer fin_defer2\n        by (simp add: reject_not_elec_or_def)\n      have\n        \"defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) -\n          defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n        (limit_pair_vectors (defer m A p vs) vs) = {} \\<longrightarrow>\n            elect m A p vs = elect m A p vs \\<inter> defer m A p vs\"\n        using elect_def_disj\n        by blast\n      thus \"x \\<in> {}\"\n        using rej_def_eq_set result_disj fin_defer\n        using Diff_cancel Diff_empty emod_reject_m emod_reject_n\n              fin_A prof_A vec_A reject_not_elec_or_def x_in_A fin_defer2\n        by metis\n    qed\n  qed\nqed\n\n(*Sequential composition preserves the non-electing property.*)\ntheorem seq_comp_presv_non_electing[simp]:\n  assumes\n    m_elect: \"non_electing m\" and\n    n_elect: \"non_electing n\"\n  shows \"non_electing (m \\<triangleright> n)\"\n  unfolding non_electing_def\nproof (safe)\n  from m_elect n_elect\n  have \"electoral_module m \\<and> electoral_module n\"\n    unfolding non_electing_def\n    by blast\n  thus \"electoral_module (m \\<triangleright> n)\"\n    by simp\nnext\n  fix\n    A :: \"'a set\" and\n    p :: \"'a Profile\" and\n    x :: \"'a\" and\n    vs :: \"'a Pair_Vectors\"\n  assume\n    \"finite A\" and\n    \"profile A p\" and\n    \"vector_pair A vs\" and\n    \"x \\<in> elect (m \\<triangleright> n) A p vs\"\n  with m_elect n_elect\n  show \"x \\<in> {}\"\n    unfolding non_electing_def\n    using seq_comp_def_then_elect_elec_set def_presv_fin_prof\n          Diff_empty Diff_partition empty_subsetI def_presv_fin_vector_pair\n    by metis\nqed\n\n(*\n   Composing an electoral module that defers exactly 1 alternative\n   in sequence after an electoral module that is electing\n   results (still) in an electing electoral module.\n*)\ntheorem seq_comp_electing[simp]:\n  assumes def_one_m1:  \"defers 1 m1\" and\n          electing_m2: \"electing m2\"\n  shows \"electing (m1 \\<triangleright> m2)\"\nproof -\n  have\n    \"\\<forall>A p vs. (card A \\<ge> 1 \\<and> finite_profile A p \\<and> finite_pair_vectors A vs) \\<longrightarrow>\n        card (defer m1 A p vs) = 1\"\n    using def_one_m1 defers_def\n    by blast\n  hence def_m1_not_empty:\n    \"\\<forall>A p vs. (A \\<noteq> {} \\<and> finite_profile A p \\<and> finite_pair_vectors A vs) \\<longrightarrow>\n        defer m1 A p vs \\<noteq> {}\"\n    using One_nat_def Suc_leI card_eq_0_iff\n          card_gt_0_iff zero_neq_one\n    by metis\n  thus ?thesis\n    using Un_empty def_one_m1 defers_def electing_def\n          electing_m2 seq_comp_def_then_elect_elec_set\n          seq_comp_sound def_presv_fin_prof \n  proof -\n    have def_card_one:\n      \"electoral_module m1 \\<and>\n        (\\<forall>A prof vs.\n          (1 \\<le> card A \\<and> finite A \\<and> profile A prof \\<and> vector_pair A vs) \\<longrightarrow>\n            card (defer m1 A prof vs) = 1)\"\n      using def_one_m1 defers_def\n      by blast\n   (* hence \"electoral_module (m1 \\<triangleright> m2)\"\n      using  seq_comp_sound\n      by metis*)\n    with  def_card_one\n    show ?thesis\n      using seq_comp_def_then_elect_elec_set def_presv_fin_prof\n            def_m1_not_empty bot_eq_sup_iff def_presv_fin_vector_pair\n      by (smt (z3) electing_def electing_m2 seq_comp_sound)\n  qed\nqed\n\nlemma def_lift_inv_seq_comp_help:\n  assumes\n    monotone_m: \"defer_lift_invariance m\" and\n    monotone_n: \"defer_lift_invariance n\" and\n    f_vec: \"finite_pair_vectors A vs\" and\n    def_and_lifted: \"a \\<in> (defer (m \\<triangleright> n) A p vs) \\<and> lifted A p q a\"\n  shows \"(m \\<triangleright> n) A p vs = (m \\<triangleright> n) A q vs\"\nproof -\n  let ?new_Ap = \"defer m A p vs\"\n  let ?new_Aq = \"defer m A q vs\"\n  let ?new_p = \"limit_profile ?new_Ap p\"\n  let ?new_q = \"limit_profile ?new_Aq q\"\n  let ?new_vsp = \"limit_pair_vectors ?new_Ap vs\"\n  let ?new_vsq = \"limit_pair_vectors ?new_Aq vs\"\n  from monotone_m monotone_n have modules:\n    \"electoral_module m \\<and> electoral_module n\"\n    unfolding defer_lift_invariance_def\n    by simp\n  hence \"finite_profile A p \\<and> finite_pair_vectors A vs \n    \\<longrightarrow> defer (m \\<triangleright> n) A p vs \\<subseteq> defer m A p vs\"\n    using seq_comp_def_set_bounded\n    by metis\n  moreover have profile_p: \"lifted A p q a \\<longrightarrow> finite_profile A p\"\n    unfolding lifted_def\n    by simp\n ultimately have defer_subset: \"defer (m \\<triangleright> n) A p vs \\<subseteq> defer m A p vs\"\n    using def_and_lifted f_vec\n    by blast\n  hence mono_m: \"m A p vs = m A q vs\"\n    using monotone_m defer_lift_invariance_def def_and_lifted\n          modules profile_p seq_comp_def_set_trans f_vec\n    by metis\n  hence new_A_eq: \"?new_Ap = ?new_Aq\"\n    by presburger\n  have defer_eq:\n    \"defer (m \\<triangleright> n) A p vs = defer n ?new_Ap ?new_p ?new_vsp\"\n    using sequential_composition.simps snd_conv\n    by metis\n  hence mono_n:\n    \"n ?new_Ap ?new_p ?new_vsp = n ?new_Aq ?new_q ?new_vsq\"\n  proof cases\n    have m0: \"finite (defer m A p vs)\"\n      by (metis def_and_lifted defer_in_alts f_vec modules profile_p rev_finite_subset)\n    have m1: \"vector_pair ?new_Ap ?new_vsp\" \n      using f_vec vector_pair_def profile_p def_and_lifted defer_in_alts\n      by (smt (verit, ccfv_SIG) limit_pair_vectors_sound modules)\n      \n    have m2: \"finite_pair_vectors ?new_Ap ?new_vsp\" using m0 m1 by simp\n\n    assume \"lifted ?new_Ap ?new_p ?new_q a\"  \n    thus ?thesis\n      using defer_eq mono_m monotone_n\n            defer_lift_invariance_def def_and_lifted m2 (*f_vec lifted_finite_vectors*)\n      by (metis (no_types, lifting))\n  next\n    assume a2: \"\\<not>lifted ?new_Ap ?new_p ?new_q a\"\n    from def_and_lifted\n    have \"finite_profile A q\"\n      by (simp add: lifted_def)\n    with modules new_A_eq\n    have 1:\n      \"finite_profile ?new_Ap ?new_q\"\n      using def_presv_fin_prof f_vec\n      by (metis)\n    moreover from modules profile_p def_and_lifted\n    have 0:\n      \"finite_profile ?new_Ap ?new_p\"\n      using def_presv_fin_prof\n      by (metis def_and_lifted f_vec profile_p)\n    moreover from defer_subset def_and_lifted\n    have 2: \"a \\<in> ?new_Ap\"\n      by blast\n    moreover from def_and_lifted\n    have eql_lengths:\n      \"length ?new_p = length ?new_q\"\n      by (simp add: lifted_def)\n    ultimately have 0:\n      \"(\\<forall>i::nat. i < length ?new_p \\<longrightarrow>\n          \\<not>Preference_Relation.lifted ?new_Ap (?new_p!i) (?new_q!i) a) \\<or>\n       (\\<exists>i::nat. i < length ?new_p \\<and>\n          \\<not>Preference_Relation.lifted ?new_Ap (?new_p!i) (?new_q!i) a \\<and>\n              (?new_p!i) \\<noteq> (?new_q!i))\"\n      using a2 lifted_def\n      by (metis (no_types, lifting))\n    from def_and_lifted modules have\n      \"\\<forall>i. (0 \\<le> i \\<and> i < length ?new_p) \\<longrightarrow>\n          (Preference_Relation.lifted A (p!i) (q!i) a \\<or> (p!i) = (q!i))\"\n      using defer_in_alts Profile.lifted_def limit_prof_presv_size f_vec\n      by metis\n    with def_and_lifted modules mono_m have\n      \"\\<forall>i. (0 \\<le> i \\<and> i < length ?new_p) \\<longrightarrow>\n          (Preference_Relation.lifted ?new_Ap (?new_p!i) (?new_q!i) a \\<or>\n           (?new_p!i) = (?new_q!i))\"\n      using limit_lifted_imp_eq_or_lifted defer_in_alts\n            Profile.lifted_def limit_prof_presv_size\n            limit_profile.simps nth_map f_vec\n      by (metis (no_types, lifting))\n    with 0 eql_lengths mono_m\n    show ?thesis\n      using leI not_less_zero nth_equalityI\n      by metis\n  qed\n  from mono_m mono_n\n  show ?thesis\n    using sequential_composition.simps\n    by (metis (full_types))\nqed\n\n(*Sequential composition preserves the property defer-lift-invariance.*)\ntheorem seq_comp_presv_def_lift_inv[simp]:\n  assumes\n    monotone_m: \"defer_lift_invariance m\" and\n    monotone_n: \"defer_lift_invariance n\"\n  shows \"defer_lift_invariance (m \\<triangleright> n)\"\n  using monotone_m monotone_n def_lift_inv_seq_comp_help\n        seq_comp_sound defer_lift_invariance_def\n  by (smt (z3)) \n \n(*\n   Composing a non-blocking, non-electing electoral module\n   in sequence with an electoral module that defers exactly\n   one alternative results in an electoral module that defers\n   exactly one alternative.\n*)\ntheorem seq_comp_def_one[simp]:\n  assumes\n    non_blocking_m: \"non_blocking m\" and\n    non_electing_m: \"non_electing m\" and\n    def_1_n: \"defers 1 n\"\n  shows \"defers 1 (m \\<triangleright> n)\"\n  unfolding defers_def\nproof (safe)\n  have electoral_mod_m: \"electoral_module m\"\n    using non_electing_m\n    by (simp add: non_electing_def)\n  have electoral_mod_n: \"electoral_module n\"\n    using def_1_n\n    by (simp add: defers_def)\n  show \"electoral_module (m \\<triangleright> n)\"\n    using electoral_mod_m electoral_mod_n\n    by simp\nnext\n  fix\n    A :: \"'a set\" and\n    p :: \"'a Profile\" and\n    vs :: \"'a Pair_Vectors\"\n  assume\n    pos_card: \"1 \\<le> card A\" and\n    fin_A: \"finite A\" and\n    prof_A: \"profile A p\" and\n    vec_A: \"vector_pair A vs\"\n  from pos_card have\n    \"A \\<noteq> {}\"\n    by auto\n  with fin_A prof_A vec_A have m_non_blocking:\n    \"reject m A p vs \\<noteq> A\"\n    using non_blocking_m non_blocking_def\n    by metis\n  hence\n    \"\\<exists>a. a \\<in> A \\<and> a \\<notin> reject m A p vs\"\n    using pos_card non_electing_def non_electing_m\n          reject_in_alts subset_antisym subset_iff\n          fin_A prof_A vec_A subsetI\n    by metis\n  hence \"defer m A p vs \\<noteq> {}\"\n    using electoral_mod_defer_elem empty_iff pos_card\n          non_electing_def non_electing_m fin_A prof_A vec_A\n    by (metis (no_types))\n  hence defer_non_empty:\n    \"card (defer m A p vs) \\<ge> 1\"\n    using One_nat_def Suc_leI card_gt_0_iff pos_card fin_A prof_A vec_A\n          non_blocking_def non_blocking_m def_presv_fin_prof \n    by metis\n  have defer_fun:\n    \"defer (m \\<triangleright> n) A p vs =\n      defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n      (limit_pair_vectors (defer m A p vs) vs)\"\n    using def_1_n defers_def fin_A non_blocking_def non_blocking_m\n          prof_A vec_A seq_comp_defers_def_set\n    by (metis (no_types, hide_lams))\n  have\n    \"\\<forall>n f. defers n f =\n      (electoral_module f \\<and>\n        (\\<forall>A prof vs.\n          (\\<not> n \\<le> card (A::'a set) \\<or> infinite A \\<or>\n            \\<not> profile A prof \\<or> \\<not> vector_pair A vs) \\<or>\n          card (defer f A prof vs) = n))\"\n    using defers_def \n    by blast\n  hence\n    \"card (defer n (defer m A p vs)\n      (limit_profile (defer m A p vs) p) \n      (limit_pair_vectors (defer m A p vs) vs)) = 1\"\n    using defer_non_empty def_1_n\n          fin_A prof_A vec_A non_blocking_def\n          non_blocking_m def_presv_fin_prof def_presv_fin_vector_pair\n    by metis\n  thus \"card (defer (m \\<triangleright> n) A p vs) = 1\"\n    using defer_fun\n    by auto\nqed\n\n(*\n   Sequentially composing electoral modules after compatible\n   electoral modules does not break their compatibility.\n*)\ntheorem disj_compat_seq[simp]:\n  assumes\n    compatible: \"disjoint_compatibility m n\" and\n    module_m2: \"electoral_module m2\"\n  shows \"disjoint_compatibility (m \\<triangleright> m2) n\"\n  unfolding disjoint_compatibility_def \nproof (safe)\n  show \"electoral_module (m \\<triangleright> m2)\"\n    using compatible disjoint_compatibility_def\n          module_m2 seq_comp_sound\n  proof -\n    have \"electoral_module m\"\n      using compatible disjoint_compatibility_def by blast\n    then show ?thesis\n      by (meson module_m2 seq_comp_sound)\n  qed\nnext\n  show \"electoral_module n\"\n    using compatible disjoint_compatibility_def by blast\nnext\n  fix\n    S :: \"'a set\" (*and\n    vs :: \"'a Pair_Vectors\"*)\n  assume\n    fin_S: \"finite S\" (*and\n    vec_A: \"vector_pair S vs\"*)\n  have modules:\n    \"electoral_module (m \\<triangleright> m2) \\<and> electoral_module n\"\n    using compatible disjoint_compatibility_def\n          module_m2 seq_comp_sound\n    by auto\n\n obtain A where A:\n    \"A \\<subseteq> S \\<and>\n      (\\<forall>a \\<in> A. indep_of_alt m S a \\<and>\n        (\\<forall>p vs. finite_profile S p \\<and> vector_pair S vs \\<longrightarrow> a \\<in> reject m S p vs)) \\<and>\n      (\\<forall>a \\<in> S-A. indep_of_alt n S a \\<and>\n        (\\<forall>p vs. finite_profile S p \\<and> vector_pair S vs \\<longrightarrow> a \\<in> reject n S p vs))\"\n    using compatible disjoint_compatibility_def fin_S (*vec_A*)\n    by (metis (no_types, lifting))\n  show \"\\<exists>A\\<subseteq>S. \n          (\\<forall>a\\<in>A. indep_of_alt (m \\<triangleright> m2) S a \\<and> \n            (\\<forall>p vs. finite_profile S p \\<and> vector_pair S vs \\<longrightarrow> a \\<in> reject (m \\<triangleright> m2) S p vs)) \\<and>\n              (\\<forall>a\\<in>S - A. indep_of_alt n S a \\<and> (\\<forall>p vs. finite_profile S p \\<and> vector_pair S vs\n                \\<longrightarrow> a \\<in> reject n S p vs)) \"\n    (*\"\\<exists>A \\<subseteq> S.\n      (\\<forall>a \\<in> A. indep_of_alt (m \\<triangleright> m2) S a \\<and>\n        (\\<forall>p vs. finite_profile S p \\<and> finite_pair_vectors S vs \n        \\<longrightarrow> a \\<in> reject (m \\<triangleright> m2) S p vs)) \\<and>\n      (\\<forall>a \\<in> S-A. indep_of_alt n S a \\<and>\n        (\\<forall>p vs. finite_profile S p \\<and> finite_pair_vectors S vs\n        \\<longrightarrow> a \\<in> reject n S p vs))\"*)\n  proof\n    (*have\n      \"\\<forall>a p q.\n        a \\<in> A \\<and> equiv_prof_except_a S p q a \\<and> \n      finite_pair_vectors S p vs \\<and> finite_pair_vectors S q vs \\<longrightarrow>\n          (m \\<triangleright> m2) S p vs = (m \\<triangleright> m2) S q vs\"*)\n     have t0:\n      \"\\<forall>a \\<in> A. \\<forall>p vs. finite_profile S p \\<and> vector_pair S vs \\<longrightarrow> a \\<in> reject (m \\<triangleright> m2) S p vs\"\n      using A UnI1 prod.sel sequential_composition.simps \n      by metis\n    have \n      \"\\<forall>a p q vs.\n        a \\<in> A \\<and> equiv_prof_except_a S p q a \\<and> finite_pair_vectors S vs\\<longrightarrow>\n          (m \\<triangleright> m2) S p vs = (m \\<triangleright> m2) S q vs\"\n    proof (safe)\n      fix\n        a :: \"'a\" and\n        p :: \"'a Profile\" and\n        q :: \"'a Profile\" and\n        vs :: \"'a Pair_Vectors\"\n      assume\n        a: \"a \\<in> A\" and\n        b: \"equiv_prof_except_a S p q a\" and\n        c1: \"finite S\" and\n        c2: \"vector_pair S vs\"\n      have c: \"finite_pair_vectors S vs\" using c1 c2 by simp \n      have eq_def:\n        \"defer m S p vs = defer m S q vs\"\n        using A a b c indep_of_alt_def\n        by metis\n      from a b have profiles:\n        \"finite_profile S p \\<and> finite_profile S q\"\n        using equiv_prof_except_a_def\n        by fastforce\n      hence \"(defer m S p vs) \\<subseteq> S\"\n        using compatible defer_in_alts disjoint_compatibility_def c by blast\n      hence\n        \"limit_profile (defer m S p vs) p =\n          limit_profile (defer m S q vs) q\"\n        using A DiffD2 a b compatible defer_not_elec_or_rej\n              disjoint_compatibility_def eq_def profiles\n              negl_diff_imp_eq_limit_prof c \n        by (metis (no_types, lifting))\n      with eq_def have 0:\n        \"m2 (defer m S p vs) (limit_profile (defer m S p vs) p) \n          (limit_pair_vectors (defer m S p vs) vs) =\n          m2 (defer m S q vs) (limit_profile (defer m S q vs) q) \n      (limit_pair_vectors (defer m S q vs) vs)\"\n        by simp\n      moreover have \"m S p vs = m S q vs\"\n        using A a b indep_of_alt_def c\n        by metis\n      ultimately have \"(m \\<triangleright> m2) S p vs = (m \\<triangleright> m2) S q vs\"\n        using sequential_composition.simps c \n        by (metis (full_types))\n      then show\n        \"(m \\<triangleright> m2) S p vs = (m \\<triangleright> m2) S q vs\"\n        using c\n        by (metis (full_types))\n    qed\n    then have \"(\\<forall>a \\<in> A. indep_of_alt (m \\<triangleright> m2) S a)\" \n      using modules indep_of_alt_def unfolding indep_of_alt_def\n      by blast \n     (*have \"A \\<subseteq> S \\<and> (\\<forall>a \\<in> A. electoral_module (m \\<triangleright> m2) \\<and> (\\<forall>p q vs. equiv_prof_except_a A p q a \n      \\<longrightarrow> (m \\<triangleright> m2) A p vs = (m \\<triangleright> m2) A q vs))\" sorry*)\n    then show\n      \"A \\<subseteq> S \\<and>\n        (\\<forall>a \\<in> A. indep_of_alt (m \\<triangleright> m2) S a \\<and>\n          (\\<forall>p vs. finite_profile S p \\<and> vector_pair S vs \\<longrightarrow> a \\<in> reject (m \\<triangleright> m2) S p vs)) \\<and>\n        (\\<forall>a \\<in> S-A. indep_of_alt n S a \\<and>\n          (\\<forall>p vs. finite_profile S p \\<and> vector_pair S vs \\<longrightarrow> a \\<in> reject n S p vs))\"\n      using A indep_of_alt_def modules compatible fin_S  disjoint_compatibility_def t0 by auto \n      (*by (metis (mono_tags, lifting))*)\n  qed\nqed\n\n(*\n   Composing a defer-lift invariant and a non-electing\n   electoral module that defers exactly one alternative\n   in sequence with an electing electoral module\n   results in a monotone electoral module.\n*)\ntheorem seq_comp_mono[simp]:\n  assumes\n    def_monotone_m: \"defer_lift_invariance m\" and\n    non_ele_m: \"non_electing m\" and\n    def_one_m: \"defers 1 m\" and\n    electing_n: \"electing n\"\n  shows \"monotonicity (m \\<triangleright> n)\"\n  unfolding monotonicity_def\nproof (safe)\n  have electoral_mod_m: \"electoral_module m\"\n    using non_ele_m\n    by (simp add: non_electing_def)\n  have electoral_mod_n: \"electoral_module n\"\n    using electing_n\n    by (simp add: electing_def)\n  show \"electoral_module (m \\<triangleright> n)\"\n    using electoral_mod_m electoral_mod_n\n    by simp\nnext\n  fix\n    A :: \"'a set\" and\n    p :: \"'a Profile\" and\n    q :: \"'a Profile\" and\n    vs :: \"'a Pair_Vectors\" and\n    w :: \"'a\"\n  assume\n    fin_A: \"finite A\" and\n    elect_w_in_p: \"w \\<in> elect (m \\<triangleright> n) A p vs\" and\n    lifted_w: \"Profile.lifted A p q w\" and\n    vec_f: \"vector_pair A vs\"\n\n  have\n    \"finite_profile A p \\<and> finite_profile A q\"\n    using lifted_w lifted_def\n    by metis\n  thus \"w \\<in> elect (m \\<triangleright> n) A q vs\"\n    using seq_comp_def_then_elect defer_lift_invariance_def\n          elect_w_in_p lifted_w def_monotone_m non_ele_m\n          def_one_m electing_n vec_f\n    by (smt (verit, del_insts))\n    (*by metis *)\nqed\n\n(*\n   Composing a defer-invariant-monotone electoral module in sequence before\n   a non-electing, defer-monotone electoral module that defers exactly\n   1 alternative results in a defer-lift-invariant electoral module.\n*)\ntheorem def_inv_mono_imp_def_lift_inv[simp]:\n  assumes\n    strong_def_mon_m: \"defer_invariant_monotonicity m\" and\n    non_electing_n: \"non_electing n\" and\n    defers_1: \"defers 1 n\" and\n    defer_monotone_n: \"defer_monotonicity n\"\n  shows \"defer_lift_invariance (m \\<triangleright> n)\"\n  unfolding defer_lift_invariance_def\nproof (safe)\n  have electoral_mod_m: \"electoral_module m\"\n    using defer_invariant_monotonicity_def\n          strong_def_mon_m\n    by auto\n  have electoral_mod_n: \"electoral_module n\"\n    using defers_1 defers_def\n    by auto\n  show \"electoral_module (m \\<triangleright> n)\"\n    using electoral_mod_m electoral_mod_n\n    by simp\nnext\n  fix\n    A :: \"'a set\" and\n    p :: \"'a Profile\" and\n    q :: \"'a Profile\" and\n    vs :: \"'a Pair_Vectors\" and\n    a :: \"'a\"\n  assume\n  defer_a_p: \"a \\<in> defer (m \\<triangleright> n) A p vs\" and\n  lifted_a: \"Profile.lifted A p q a\" and\n  vec_A: \"vector_pair A vs\"\n  from strong_def_mon_m\n  have non_electing_m: \"non_electing m\"\n    by (simp add: defer_invariant_monotonicity_def)\n  have electoral_mod_m: \"electoral_module m\"\n    using strong_def_mon_m defer_invariant_monotonicity_def\n    by auto\n  have electoral_mod_n: \"electoral_module n\"\n    using defers_1 defers_def\n    by auto\n  have finite_profile_q: \"finite_profile A q\"\n    using lifted_a\n    by (simp add: Profile.lifted_def)\n  have finite_profile_p: \"profile A p\"\n    using lifted_a\n    by (simp add: Profile.lifted_def)\n  show \"(m \\<triangleright> n) A p vs = (m \\<triangleright> n) A q vs\"\n  proof cases\n    assume not_unchanged: \"defer m A q vs \\<noteq> defer m A p vs\"\n    from not_unchanged\n    have a_single_defer: \"{a} = defer m A q vs\"\n      using strong_def_mon_m electoral_mod_n defer_a_p\n            defer_invariant_monotonicity_def lifted_a\n            seq_comp_def_set_trans finite_profile_p\n            finite_profile_q vec_A\n      by metis\n    moreover have\n      \"{a} = defer m A q vs \\<longrightarrow> defer (m \\<triangleright> n) A q vs \\<subseteq> {a}\"\n      using finite_profile_q electoral_mod_m electoral_mod_n\n            seq_comp_def_set_sound vec_A\n      by (metis) \n    ultimately have\n      \"(a \\<in> defer m A p vs) \\<longrightarrow> defer (m \\<triangleright> n) A q vs \\<subseteq> {a}\"\n      by blast (* lifted defer-subset of a *)\n    moreover have def_card_one:\n      \"(a \\<in> defer m A p vs) \\<longrightarrow> card (defer (m \\<triangleright> n) A q vs) = 1\"\n      using One_nat_def a_single_defer card_eq_0_iff\n            card_insert_disjoint defers_1 defers_def\n            electoral_mod_m empty_iff finite.emptyI\n            seq_comp_defers_def_set order_refl\n            def_presv_fin_prof finite_profile_q vec_A\n            def_presv_fin_vector_pair \n      by (smt (verit))\n    moreover have defer_a_in_m_p:\n      \"a \\<in> defer m A p vs\"\n      using electoral_mod_m electoral_mod_n defer_a_p\n            seq_comp_def_set_bounded finite_profile_p\n            finite_profile_q\n      by (metis (no_types, lifting) insert_Diff insert_subset vec_A)\n    ultimately have\n      \"defer (m \\<triangleright> n) A q vs = {a}\" (* lifted defer set = a *)\n      using Collect_mem_eq card_1_singletonE empty_Collect_eq\n            insertCI subset_singletonD\n      by metis\n    moreover have\n      \"defer (m \\<triangleright> n) A p vs = {a}\" (* regular defer set = a *)\n    proof (safe)\n      fix x :: \"'a\"\n      assume\n      defer_x: \"x \\<in> defer (m \\<triangleright> n) A p vs\" and\n      x_exists: \"x \\<notin> {}\"\n      show \"x = a\"\n      proof - \n        have fin_defer:\n          \"\\<forall>f (A::'a set) prof vs.\n            (electoral_module f \\<and> finite A \\<and> profile A prof \\<and> vector_pair A vs) \\<longrightarrow>\n              finite_profile (defer f A prof vs)\n                (limit_profile (defer f A prof vs) prof)\"\n          using def_presv_fin_prof \n          by (metis (no_types))\n        have \"finite_profile (defer m A p vs) (limit_profile (defer m A p vs) p)\"\n          using electoral_mod_m finite_profile_p finite_profile_q fin_defer vec_A\n          by blast\n        hence \"Suc (card (defer m A p vs - {a})) = card (defer m A p vs)\"\n          using card_Suc_Diff1 defer_a_in_m_p\n          by metis\n        hence min_card:\n          \"Suc 0 \\<le> card (defer m A p vs)\"\n          by linarith\n        have emod_n_then_mn:\n          \"electoral_module n \\<longrightarrow> electoral_module (m \\<triangleright> n)\"\n          using electoral_mod_m\n          by simp\n        have \"defers (Suc 0) n\"\n          using defers_1\n          by auto\n        hence defer_card_one:\n          \"electoral_module n \\<and>\n            (\\<forall>A prof vs.\n              (Suc 0 \\<le> card A \\<and> finite A \\<and> profile A prof \\<and> finite_pair_vectors A vs) \\<longrightarrow>\n                card (defer n A prof vs) = Suc 0)\"\n          by (simp add: defers_def)\n        hence emod_mn: \"electoral_module (m \\<triangleright> n)\"\n          using emod_n_then_mn\n          by blast\n        have nat_diff:\n          \"\\<forall> (i::nat) j. i \\<le> j \\<longrightarrow> i - j = 0\"\n          by auto\n        have nat_comp:\n          \"\\<forall> (i::nat) j k.\n            i \\<le> j \\<and> j \\<le> k \\<or>\n              j \\<le> i \\<and> i \\<le> k \\<or>\n              i \\<le> k \\<and> k \\<le> j \\<or>\n              k \\<le> j \\<and> j \\<le> i \\<or>\n              j \\<le> k \\<and> k \\<le> i \\<or>\n              k \\<le> i \\<and> i \\<le> j\"\n          using le_cases3\n          by linarith\n        have fin_diff_card:\n          \"\\<forall>A a.\n            (finite A \\<and> (a::'a) \\<in> A) \\<longrightarrow>\n              card (A - {a}) = card A - 1\"\n          using card_Diff_singleton\n          by metis\n        have m1:\"vector_pair A vs \\<Longrightarrow> Profile.lifted A p q a \\<Longrightarrow> finite_pair_vectors A vs\"\n          by (simp add: finite_profile_q) \n        have fin_vec_defer:\n          \"\\<forall>f (A::'a set) prof vs.\n            (electoral_module f \\<and> finite A \\<and> profile A prof \\<and> vector_pair A vs) \\<longrightarrow>\n              finite_pair_vectors (defer f A prof vs) (limit_pair_vectors (defer f A prof vs) vs)\"\n          using def_presv_fin_vector_pair\n          by (metis (no_types))\n        with fin_defer defer_card_one min_card\n         have \"card (defer (m \\<triangleright> n) A p vs) = Suc 0\"\n          using electoral_mod_m seq_comp_defers_def_set electoral_mod_n\n                finite_profile_p finite_profile_q m1 fin_vec_defer vec_A\n          by metis\n        with fin_diff_card nat_comp nat_diff emod_mn fin_defer\n        have \"{a} = {x}\"\n          using One_nat_def card_1_singletonE singletonD\n                defer_a_p defer_x\n          by metis\n        thus ?thesis\n          by force\n      qed\n    next\n      show \"a \\<in> defer (m \\<triangleright> n) A p vs\"\n        using defer_a_p\n        by linarith\n    qed\n    ultimately have (* defer sets equal *)\n      mm3: \"defer (m \\<triangleright> n) A p vs = defer (m \\<triangleright> n) A q vs\"\n      by blast \n    moreover have (* elect sets sets equal *)\n      \"elect (m \\<triangleright> n) A p vs = elect (m \\<triangleright> n) A q vs\"\n      using finite_profile_p finite_profile_q\n            non_electing_m non_electing_n\n            seq_comp_presv_non_electing\n            non_electing_def vec_A lifted_a \n            finite_profile_q \n      by metis (* elect sets equal *)\n    thus ?thesis (*(m \\<triangleright> n) A p vs = (m \\<triangleright> n) A q vs*)\n        proof -\n      have f1: \"electoral_module (m \\<triangleright> n)\"\n        by (meson electoral_mod_m electoral_mod_n seq_comp_sound)\n      have \"vector_pair A vs\"\n        by (meson finite_profile_q lifted_a vec_A)\n      then show ?thesis\n        using f1 \\<open>elect (m \\<triangleright> n) A p vs = elect (m \\<triangleright> n) A q vs\\<close> \n          eq_def_and_elect_imp_eq finite_profile_p finite_profile_q mm3 vec_A by blast\n    qed\n  next\n    assume not_different_alternatives:\n      \"\\<not>(defer m A q vs \\<noteq> defer m A p vs)\"\n    have \"elect m A p vs = {}\"\n      using non_electing_m finite_profile_p finite_profile_q vec_A\n      by (simp add: non_electing_def)\n    moreover have \"elect m A q vs = {}\"\n      using non_electing_m finite_profile_q finite_profile_p lifted_a vec_A non_electing_def\n       finite_profile_q by metis\n    ultimately have elect_m_equal:\n      \"elect m A p vs = elect m A q vs\"\n      by simp (* m elects the same stuff *)\n    from not_different_alternatives\n    have same_alternatives: \"defer m A q vs = defer m A p vs\"\n      by simp\n    hence\n      \"(limit_profile (defer m A p vs) p) =\n        (limit_profile (defer m A p vs) q) \\<or>\n          lifted (defer m A q vs)\n            (limit_profile (defer m A p vs) p)\n              (limit_profile (defer m A p vs) q) a\"\n      using defer_in_alts electoral_mod_m\n            lifted_a finite_profile_q\n            limit_prof_eq_or_lifted vec_A\n      by metis\n    thus ?thesis\n    proof\n      assume\n        \"limit_profile (defer m A p vs) p =\n          limit_profile (defer m A p vs) q\"\n      hence same_profile:\n        \"limit_profile (defer m A p vs) p =\n          limit_profile (defer m A q vs) q\"\n        using same_alternatives\n        by simp\n      hence results_equal_n:\n        \"n (defer m A q vs) (limit_profile (defer m A q vs) q) =\n          n (defer m A p vs) (limit_profile (defer m A p vs) p)\"\n        by (simp add: same_alternatives)\n      moreover have results_equal_m: \"m A p vs = m A q vs\"\n        using elect_m_equal same_alternatives\n              finite_profile_p finite_profile_q vec_A lifted_a\n        by (simp add: electoral_mod_m eq_def_and_elect_imp_eq)\n      hence \"(m \\<triangleright> n) A p vs = (m \\<triangleright> n) A q vs\"\n        using same_profile\n        by auto\n      thus ?thesis\n        by blast\n    next\n      assume still_lifted:\n        \"lifted (defer m A q vs) (limit_profile (defer m A p vs) p)\n          (limit_profile (defer m A p vs) q) a\"\n      hence a_in_def_p:\n        \"a \\<in> defer n (defer m A p vs)\n          (limit_profile (defer m A p vs) p) (limit_pair_vectors (defer m A p vs) vs)\"\n        using electoral_mod_m electoral_mod_n\n              finite_profile_p defer_a_p\n              seq_comp_def_set_trans\n              finite_profile_q vec_A  \n        by metis\n      hence a_still_deferred_p:\n        \"{a} \\<subseteq> defer n (defer m A p vs)\n          (limit_profile (defer m A p vs) p) (limit_pair_vectors (defer m A p vs) vs)\"\n        by simp\n      have card_le_1_p: \"card (defer m A p vs) \\<ge> 1\"\n        using One_nat_def Suc_leI card_gt_0_iff\n              electoral_mod_m electoral_mod_n\n              equals0D finite_profile_p defer_a_p\n              seq_comp_def_set_trans def_presv_fin_prof\n              finite_profile_q vec_A\n        by metis\n      hence\n        \"card (defer n (defer m A p vs)\n          (limit_profile (defer m A p vs) p) (limit_pair_vectors (defer m A p vs) vs)) = 1\"\n        using defers_1 defers_def electoral_mod_m\n              finite_profile_p def_presv_fin_prof\n              finite_profile_q vec_A lifted_a def_presv_fin_vector_pair \n        by metis\n      hence def_set_is_a_p:\n        \"{a} = defer n (defer m A p vs) (limit_profile (defer m A p vs) p) \n          (limit_pair_vectors (defer m A p vs) vs)\"\n        using a_still_deferred_p card_1_singletonE\n              insert_subset singletonD\n        by metis\n      have a_still_deferred_q:\n        \"a \\<in> defer n (defer m A q vs)\n          (limit_profile (defer m A p vs) q) (limit_pair_vectors (defer m A p vs) vs)\"\n        using still_lifted a_in_def_p\n              defer_monotonicity_def\n              defer_monotone_n electoral_mod_m\n              same_alternatives\n              def_presv_fin_prof finite_profile_q finite_profile_p\n              def_presv_fin_vector_pair vec_A\n        by metis\n      have \"card (defer m A q vs) \\<ge> 1\"\n        using card_le_1_p same_alternatives\n        by auto\n      hence\n        \"card (defer n (defer m A q vs)\n          (limit_profile (defer m A q vs) q) (limit_pair_vectors (defer m A q vs) vs)) = 1\"\n        using defers_1 defers_def electoral_mod_m\n              finite_profile_q def_presv_fin_prof vec_A lifted_a def_presv_fin_vector_pair \n        by metis\n      hence def_set_is_a_q:\n        \"{a} =\n          defer n (defer m A q vs)\n            (limit_profile (defer m A q vs) q) (limit_pair_vectors (defer m A q vs) vs)\"\n        using a_still_deferred_q card_1_singletonE\n              same_alternatives singletonD\n        by metis\n      have\n        \"defer n (defer m A p vs)\n          (limit_profile (defer m A p vs) p) (limit_pair_vectors (defer m A p vs) vs)=\n            defer n (defer m A q vs)\n              (limit_profile (defer m A q vs) q) (limit_pair_vectors (defer m A q vs) vs)\"\n        using def_set_is_a_q def_set_is_a_p\n        by auto\n      thus ?thesis\n        using seq_comp_presv_non_electing\n              eq_def_and_elect_imp_eq non_electing_def\n              finite_profile_p finite_profile_q\n              non_electing_m non_electing_n\n              seq_comp_defers_def_set vec_A lifted_a\n        by metis\n    qed\n  qed\nqed\n\nend\n", "meta": {"author": "ChrisMackKit", "repo": "ba-scoring-rule-reinforcement-homogeneity", "sha": "d87febd04743389ac578b332349ae446b9c55e89", "save_path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity", "path": "github-repos/isabelle/ChrisMackKit-ba-scoring-rule-reinforcement-homogeneity/ba-scoring-rule-reinforcement-homogeneity-d87febd04743389ac578b332349ae446b9c55e89/verifiedVotingRuleConstruction-master/theories/Compositional_Structures/Sequential_Composition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.607663184043154, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.31095134134228514}}
{"text": "theory addMul\n\nimports Main\n        \"../Naturals\"\n\nbegin\n\n(*hipster add mul*)\n\nlemma l01 [thy_expl] : \"mul x Z = Z\"\nby hipster_induct_simp_metis\n\nlemma l02 [thy_expl] : \"add x Z = x\"\nby hipster_induct_simp_metis\n\nlemma l03 [thy_expl] : \"add (add x y) z = add x (add y z)\"\nby hipster_induct_simp_metis\n(* by (tactic {* Simp_Tacs.routine_tac @{context} *}) *)\n\nlemma l04 [thy_expl] : \"add x (S y) = S (add x y)\"\nby hipster_induct_simp_metis\n\nlemma l05 [thy_expl] : \"add x (add y x) = add y (add x x)\"\nby hipster_induct_simp_metis\n\nlemma l06 [thy_expl] : \"add x (add y y) = add y (add y x)\"\nby hipster_induct_simp_metis\n\nlemma l07 [thy_expl] : \"add x (S y) = S (add y x)\"\nby hipster_induct_simp_metis\n\n\nlemma l08' [thy_expl] : \"add (mul x y) x = mul x (S y)\"\nby (hipster_induct_simp_metis l03 l04)\n\n(*lemma l08 [thy_expl] : \"add (mul x y) x = mul x (S y)\"\n(*apply (hipster_induct_schemes add.simps mul.simps l07 l03 l04)*)\n(*apply (tactic {* Hipster_Explore.explore_goal @{context} [\"Naturals.add\", \"Naturals.mul\"] *})*)\nsorry (*by (hipster_induct_schemes add.simps mul.simps l07 l03 l04)*)*)\n\nlemma t01 : \"add (add x y) x = add x (add x y)\"\nby hipster_induct_simp_metis\n\nlemma t02 : \"add (add x y) y = add x (add y y)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma l09 [thy_expl] : \"mul (add x x) y = mul x (add y y)\"\nby hipster_induct_simp_metis\n\nlemma l10 [thy_expl] : \"mul (add x x) y = mul y (add x x)\"\nby hipster_induct_simp_metis\n\nlemma l11 [thy_expl] : \"add (mul x x) y = add y (mul x x)\"\nby hipster_induct_simp_metis\n\nlemma t03 : \"add (add x x) y = add x (add x y)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t04 : \"add (add x x) y = add y (add x x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma l12 [thy_expl] : \"add (S x) y = S (add y x)\"\nby hipster_induct_simp_metis\n\nlemma t05  : \"add x (mul x x) = mul x (S x)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)  (* follows from the incomplete one *)\n\nlemma t06 : \"add x (S x) = S (add x x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t07 : \"mul (mul x x) x = mul x (mul x x)\"\nby hipster_induct_simp_metis\n\nlemma t07b : \"mul (add x x) x = mul x (add x x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t08 : \"mul (S x) x = mul x (S x)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t09 : \"add (mul x x) x = mul x (S x)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t10 : \"add (add x x) x = add x (add x x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma l13 [thy_expl] : \"add (mul x y) (mul x z) = mul x (add y z)\"\nby hipster_induct_simp_metis\n\nlemma l14 [thy_expl] : \"add (mul x y) (mul y z) = mul y (add x z)\"\nby hipster_induct_simp_metis\n\nlemma l15 [thy_expl] : \"add (mul x y) (mul x z) = mul x (add z y)\"\nby hipster_induct_simp_metis\n\nlemma t11 : \"add (mul x y) (mul z y) = mul y (add x z)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t12 : \"add (mul x y) (mul z x) = mul x (add z y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t13 : \"add (mul x y) (mul z y) = mul y (add z x)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t14 : \"add (add x y) (mul x z) = add (mul x z) (add x y)\"\nby hipster_induct_simp_metis\n\nlemma t15 : \"add (add x y) (mul y z) = add (mul y z) (add x y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t16 : \"add (add x y) (mul z y) = add (mul z y) (add x y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t17 : \"add (add x y) (add x z) = add (add x z) (add x y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t18 : \"add (add x y) (add z y) = add (add x z) (add y y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t19 : \"add (add x y) (add z z) = add (add x z) (add z y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t20 : \"add (add x y) (S z) = add (add x z) (S y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t21 : \"add (add x y) (mul z x) = add (mul z x) (add x y)\"\nby hipster_induct_simp_metis\n\nlemma t22 : \"add (add x y) (add z x) = add (add z x) (add x y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t23 : \"add (add x y) (add z y) = add (add z x) (add y y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t24 : \"add (add x y) (add z z) = add (add z x) (add z y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t25 : \"add (add x y) (S z) = add (add z x) (S y)\"\nby hipster_induct_simp_metis\n\nlemma t26 : \"mul (mul x x) (add y z) = mul (add y z) (mul x x)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t27 : \"mul (mul x x) (mul y z) = mul (mul y z) (mul x x)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma l16 : \"mul (add x x) (add y z) = mul (add y z) (add x x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t28 : \"mul (add x x) (mul y z) = mul (mul y z) (add x x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t29 : \"mul (S x) (mul y z) = mul (mul y z) (S x)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t30 : \"mul (S x) (add y z) = mul (add y z) (S x)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t31 : \"add (mul x x) (mul y z) = add (mul y z) (mul x x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t32 : \"add (mul x x) (add y z) = add (add y z) (mul x x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t33 : \"add (add x x) (mul y z) = add (mul y z) (add x x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t34 : \"add (add x x) (add y z) = add (add x y) (add x z)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t35 : \"add (add x x) (add y z) = add (add y x) (add x z)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t36 : \"add (add x x) (add y z) = add (add y z) (add x x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t37 : \"add (S x) (mul y z) = add (mul y z) (S x)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t38 : \"add (S x) (add y z) = add (add x y) (S z)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t39 : \"add (S x) (add y z) = add (add y x) (S z)\"\nby hipster_induct_simp_metis\n\nlemma l17 [thy_expl] : \"add (S x) (add y z) = add (add y z) (S x)\"\nby hipster_induct_simp_metis\n\nlemma t40 : \"mul (mul x y) Z = Z\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t41 : \"mul (add x y) Z = Z\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma l18 [thy_expl]  : \"mul (add x y) (mul x y) = mul (mul x y) (add x y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t42 : \"add (mul x y) Z = mul x y\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t43 : \"add (mul x y) (mul x y) = mul x (add y y)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t44 : \"add (mul x y) (mul x x) = mul x (add x y)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t45 : \"add (mul x y) (mul y y) = mul y (add x y)\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t46 : \"add (add x y) Z = add x y\"\nby (tactic \\<open>Simp_Tacs.routine_tac @{context}\\<close>)\n\nlemma t47 : \"add (add x y) (mul x y) = add (mul x y) (add x y)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma t48 : \"mul (mul x x) (mul x y) = mul (mul x y) (mul x x)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\nlemma l19 [thy_expl] : \"mul (mul x x) (add x y) = mul (add x y) (mul x x)\"\nby (tactic \\<open>Ind_Schemes_Tacs.routine_tac @{context}\\<close>)\n\n\nend\n", "meta": {"author": "moajohansson", "repo": "IsaHipster", "sha": "91f6ea3f1166a9de547722ece6445fe843ad89b4", "save_path": "github-repos/isabelle/moajohansson-IsaHipster", "path": "github-repos/isabelle/moajohansson-IsaHipster/IsaHipster-91f6ea3f1166a9de547722ece6445fe843ad89b4/TestTheories/expl-cases/addMul.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.607663184043154, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.31095134134228514}}
{"text": "theory Independent_DYNAMIC_Post_Network\n  imports\n    \"Independent_DYNAMIC_Post_ISSUER\"\n    \"Independent_Post_RECEIVER\"\n    \"../../API_Network\"\n    \"BD_Security_Compositional.Composing_Security_Network\"\nbegin\n\nsubsubsection \\<open>Confidentiality for the N-ary composition\\<close>\n\ntype_synonym ttrans = \"(state, act, out) trans\"\ntype_synonym obs = Post_Observation_Setup_ISSUER.obs\ntype_synonym \"value\" = \"Post.value + Post_RECEIVER.value\"\n\nlemma value_cases:\nfixes v :: \"value\"\nobtains (PVal) pst where \"v = Inl (Post.PVal pst)\"\n      | (PValS) aid pst where \"v = Inl (Post.PValS aid pst)\"\n      | (OVal) ov where \"v = Inl (Post.OVal ov)\"\n      | (PValR) pst where \"v = Inr (Post_RECEIVER.PValR pst)\"\nproof (cases v)\n  case (Inl vl) then show thesis using PVal PValS OVal by (cases vl rule: Post.value.exhaust) auto next\n  case (Inr vr) then show thesis using PValR by (cases vr rule: Post_RECEIVER.value.exhaust) auto\nqed\n\nlocale Post_Network = Network\n+ fixes UIDs :: \"apiID \\<Rightarrow> userID set\"\n  and AID :: \"apiID\" and PID :: \"postID\"\n  assumes AID_in_AIDs: \"AID \\<in> AIDs\"\nbegin\n\nsublocale Iss: Post \"UIDs AID\" PID .\n\nabbreviation \\<phi> :: \"apiID \\<Rightarrow> (state, act, out) trans \\<Rightarrow> bool\"\nwhere \"\\<phi> aid trn \\<equiv> (if aid = AID then Iss.\\<phi> trn else Post_RECEIVER.\\<phi> PID AID trn)\"\n\nabbreviation f :: \"apiID \\<Rightarrow> (state, act, out) trans \\<Rightarrow> value\"\nwhere \"f aid trn \\<equiv> (if aid = AID then Inl (Iss.f trn) else Inr (Post_RECEIVER.f PID AID trn))\"\n\nabbreviation \\<gamma> :: \"apiID \\<Rightarrow> (state, act, out) trans \\<Rightarrow> bool\"\nwhere \"\\<gamma> aid trn \\<equiv> (if aid = AID then Iss.\\<gamma> trn else Strong_ObservationSetup_RECEIVER.\\<gamma> (UIDs aid) trn)\"\n\nabbreviation g :: \"apiID \\<Rightarrow> (state, act, out) trans \\<Rightarrow> obs\"\nwhere \"g aid trn \\<equiv> (if aid = AID then Iss.g trn else Strong_ObservationSetup_RECEIVER.g PID AID trn)\"\n\nabbreviation T :: \"apiID \\<Rightarrow> (state, act, out) trans \\<Rightarrow> bool\"\nwhere \"T aid trn \\<equiv> (if aid = AID then Iss.T trn else Post_RECEIVER.T (UIDs aid) PID AID trn)\"\n\nabbreviation B :: \"apiID \\<Rightarrow> value list \\<Rightarrow> value list \\<Rightarrow> bool\"\nwhere \"B aid vl vl1 \\<equiv>\n  (if aid = AID then list_all isl vl \\<and> list_all isl vl1 \\<and> Iss.B (map projl vl) (map projl vl1)\n   else list_all (Not o isl) vl \\<and> list_all (Not o isl) vl1 \\<and> Post_RECEIVER.B (map projr vl) (map projr vl1))\"\n\nfun comOfV :: \"apiID \\<Rightarrow> value \\<Rightarrow> com\" where\n  \"comOfV aid (Inl (Post.PValS aid' pst)) = (if aid' \\<noteq> aid then Send else Internal)\"\n| \"comOfV aid (Inl (Post.PVal pst)) = Internal\"\n| \"comOfV aid (Inl (Post.OVal ov)) = Internal\"\n| \"comOfV aid (Inr v) = Recv\"\n\nfun tgtNodeOfV :: \"apiID \\<Rightarrow> value \\<Rightarrow> apiID\" where\n  \"tgtNodeOfV aid (Inl (Post.PValS aid' pst)) = aid'\"\n| \"tgtNodeOfV aid (Inl (Post.PVal pst)) = undefined\"\n| \"tgtNodeOfV aid (Inl (Post.OVal ov)) = undefined\"\n| \"tgtNodeOfV aid (Inr v) = AID\"\n\ndefinition syncV :: \"apiID \\<Rightarrow> value \\<Rightarrow> apiID \\<Rightarrow> value \\<Rightarrow> bool\" where\n  \"syncV aid1 v1 aid2 v2 =\n    (\\<exists>pst. aid1 = AID \\<and> v1 = Inl (Post.PValS aid2 pst) \\<and> v2 = Inr (Post_RECEIVER.PValR pst))\"\n\nlemma syncVI: \"syncV AID (Inl (Post.PValS aid' pst)) aid' (Inr (Post_RECEIVER.PValR pst))\"\nunfolding syncV_def by auto\n\nlemma syncVE:\nassumes \"syncV aid1 v1 aid2 v2\"\nobtains pst where \"aid1 = AID\" \"v1 = Inl (Post.PValS aid2 pst)\" \"v2 = Inr (Post_RECEIVER.PValR pst)\"\nusing assms unfolding syncV_def by auto\n\nfun getTgtV where\n  \"getTgtV (Inl (Post.PValS aid pst)) = Inr (Post_RECEIVER.PValR pst)\"\n| \"getTgtV v = v\"\n\nlemma comOfV_AID:\n  \"comOfV AID v = Send \\<longleftrightarrow> isl v \\<and> Iss.isPValS (projl v) \\<and> Iss.tgtAPI (projl v) \\<noteq> AID\"\n  \"comOfV AID v = Recv \\<longleftrightarrow> Not (isl v)\"\nby (cases v rule: value_cases; auto)+\n\nlemmas \\<phi>_defs = Post_RECEIVER.\\<phi>_def2 Iss.\\<phi>_def3\n\nsublocale Net: BD_Security_TS_Network_getTgtV\nwhere istate = \"\\<lambda>_. istate\" and validTrans = validTrans and srcOf = \"\\<lambda>_. srcOf\" and tgtOf = \"\\<lambda>_. tgtOf\"\n  and nodes = AIDs and comOf = comOf and tgtNodeOf = tgtNodeOf\n  and sync = sync and \\<phi> = \\<phi> and f = f and \\<gamma> = \\<gamma> and g = g and T = T and B = B\n  and comOfV = comOfV and tgtNodeOfV = tgtNodeOfV and syncV = syncV\n  and comOfO = comOfO and tgtNodeOfO = tgtNodeOfO and syncO = syncO (*and cmpO = cmpO*)\n  and source = AID and getTgtV = getTgtV\nusing AID_in_AIDs proof (unfold_locales, goal_cases)\n  case (1 nid trn) then show ?case using Iss.validTrans_isCOMact_open[of trn] by (cases trn rule: Iss.\\<phi>.cases) (auto simp: \\<phi>_defs split: prod.splits) next\n  case (2 nid trn) then show ?case using Iss.validTrans_isCOMact_open[of trn] by (cases trn rule: Iss.\\<phi>.cases) (auto simp: \\<phi>_defs split: prod.splits) next\n  case (3 nid trn)\n    interpret Sink: Post_RECEIVER \"UIDs nid\" PID AID .\n    show ?case using 3 by (cases \"(nid,trn)\" rule: tgtNodeOf.cases) (auto split: prod.splits)\nnext\n  case (4 nid trn)\n    interpret Sink: Post_RECEIVER \"UIDs nid\" PID AID .\n    show ?case using 4 by (cases \"(nid,trn)\" rule: tgtNodeOf.cases) (auto split: prod.splits)\nnext\n  case (5 nid1 trn1 nid2 trn2)\n    interpret Sink1: Post_RECEIVER \"UIDs nid1\" PID AID .\n    interpret Sink2: Post_RECEIVER \"UIDs nid2\" PID AID .\n    show ?case using 5 by (elim sync_cases) (auto intro: syncVI)\nnext\n  case (6 nid1 trn1 nid2 trn2)\n    interpret Sink1: Post_RECEIVER \"UIDs nid1\" PID AID .\n    interpret Sink2: Post_RECEIVER \"UIDs nid2\" PID AID .\n    show ?case using 6 by (elim sync_cases) auto\nnext\n  case (7 nid1 trn1 nid2 trn2)\n    interpret Sink1: Post_RECEIVER \"UIDs nid1\" PID AID .\n    interpret Sink2: Post_RECEIVER \"UIDs nid2\" PID AID .\n    show ?case using 7(2,4,6-10)\n      using Iss.validTrans_isCOMact_open[OF 7(2)] Iss.validTrans_isCOMact_open[OF 7(4)]\n      by (elim sync_cases) (auto split: prod.splits, auto simp: sendPost_def)\nnext\n  case (8 nid1 trn1 nid2 trn2)\n    interpret Sink1: Post_RECEIVER \"UIDs nid1\" PID AID .\n    interpret Sink2: Post_RECEIVER \"UIDs nid2\" PID AID .\n    show ?case using 8(2,4,6-10,11,12,13)\n      apply (elim syncO_cases; cases trn1; cases trn2)\n          apply (auto simp: Iss.g_simps Strong_ObservationSetup_RECEIVER.g_simps split: prod.splits)\n      apply (auto simp: sendPost_def split: prod.splits elim: syncVE)[]\n      done\nnext\n  case (9 nid trn)\n    then show ?case\n      by (cases \"(nid,trn)\" rule: tgtNodeOf.cases)\n         (auto simp: Strong_ObservationSetup_RECEIVER.\\<gamma>.simps)\nnext\n  case (10 nid trn) then show ?case by (cases trn) (auto simp: \\<phi>_defs)\nnext\n  case (11 vSrc nid vn) then show ?case by (cases vSrc rule: value_cases) (auto simp: syncV_def)\nnext\n  case (12 vSrc nid vn) then show ?case by (cases vSrc rule: value_cases) (auto simp: syncV_def)\nqed\n\nlemma list_all_Not_isl_projectSrcV: \"list_all (Not o isl) (Net.projectSrcV aid vlSrc)\"\nproof (induction vlSrc)\n  case (Cons vSrc vlSrc') then show ?case by (cases vSrc rule: value_cases) auto\nqed auto\n\ncontext\nfixes AID' :: apiID\nassumes AID': \"AID' \\<in> AIDs - {AID}\"\nbegin\n\ninterpretation Recv: Post_RECEIVER \"UIDs AID'\" PID AID by unfold_locales\n\nlemma Iss_BC_BO_tgtAPI:\nshows \"(Iss.BC vl vl1 \\<longrightarrow> map Iss.tgtAPI (filter Iss.isPValS vl) =\n                          map Iss.tgtAPI (filter Iss.isPValS vl1)) \\<and>\n       (Iss.BO vl vl1 \\<longrightarrow> map Iss.tgtAPI (filter Iss.isPValS vl) =\n                          map Iss.tgtAPI (filter Iss.isPValS vl1))\"\nby (induction rule: Iss.BC_BO.induct) auto\n\nlemma Iss_B_Recv_B_aux:\nassumes \"list_all isl vl\"\nand \"list_all isl vl1\"\nand \"map Iss.tgtAPI (filter Iss.isPValS (map projl vl)) =\n     map Iss.tgtAPI (filter Iss.isPValS (map projl vl1))\"\nshows \"length (map projr (Net.projectSrcV AID' vl)) = length (map projr (Net.projectSrcV AID' vl1))\"\nusing assms proof (induction vl vl1 rule: list22_induct)\n  case (ConsCons v vl v1 vl1)\n    consider (SendSend) aid pst pst1 where \"v = Inl (Iss.PValS aid pst)\" \"v1 = Inl (Iss.PValS aid pst1)\"\n           | (Internal) \"comOfV AID v = Internal\" \"\\<not>Iss.isPValS (projl v)\"\n           | (Internal1) \"comOfV AID v1 = Internal\" \"\\<not>Iss.isPValS (projl v1)\"\n      using ConsCons(4-6) by (cases v rule: value_cases; cases v1 rule: value_cases) auto\n    then show ?case proof cases\n      case (SendSend) then show ?thesis using ConsCons.IH(1) ConsCons.prems by auto\n    next\n      case (Internal) then show ?thesis using ConsCons.IH(2)[of \"v1 # vl1\"] ConsCons.prems by auto\n    next\n      case (Internal1) then show ?thesis using ConsCons.IH(3)[of \"v # vl\"] ConsCons.prems by auto\n    qed\nqed (auto simp: comOfV_AID)\n\nlemma Iss_B_Recv_B:\nassumes \"B AID vl vl1\"\nshows \"Recv.B (map projr (Net.projectSrcV AID' vl)) (map projr (Net.projectSrcV AID' vl1))\"\nusing assms Iss_B_Recv_B_aux Iss_BC_BO_tgtAPI by (auto simp: Iss.B_def Recv.B_def)\n\nend\n\nlemma map_projl_Inl: \"map (projl o Inl) vl = vl\"\nby (induction vl) auto\n\nlemma these_map_Inl_projl: \"list_all isl vl \\<Longrightarrow> these (map (Some o Inl o projl) vl) = vl\"\nby (induction vl) auto\n\nlemma map_projr_Inr: \"map (projr o Inr) vl = vl\"\nby (induction vl) auto\n\nlemma these_map_Inr_projr: \"list_all (Not o isl) vl \\<Longrightarrow> these (map (Some o Inr o projr) vl) = vl\"\nby (induction vl) auto\n\nsublocale BD_Security_TS_Network_Preserve_Source_Security_getTgtV\nwhere istate = \"\\<lambda>_. istate\" and validTrans = validTrans and srcOf = \"\\<lambda>_. srcOf\" and tgtOf = \"\\<lambda>_. tgtOf\"\n  and nodes = AIDs and comOf = comOf and tgtNodeOf = tgtNodeOf\n  and sync = sync and \\<phi> = \\<phi> and f = f and \\<gamma> = \\<gamma> and g = g and T = T and B = B\n  and comOfV = comOfV and tgtNodeOfV = tgtNodeOfV and syncV = syncV\n  and comOfO = comOfO and tgtNodeOfO = tgtNodeOfO and syncO = syncO (*and cmpO = cmpO*)\n  and source = AID and getTgtV = getTgtV\nproof (unfold_locales, goal_cases)\n  case 1 show ?case using AID_in_AIDs .\nnext\n  case 2\n    interpret Iss': BD_Security_TS_Trans\n      istate System_Specification.validTrans srcOf tgtOf Iss.\\<phi> Iss.f Iss.\\<gamma> Iss.g Iss.T Iss.B\n      istate System_Specification.validTrans srcOf tgtOf Iss.\\<phi> \"\\<lambda>trn. Inl (Iss.f trn)\" Iss.\\<gamma> Iss.g Iss.T \"B AID\"\n      id id Some \"Some o Inl\"\n    proof (unfold_locales, goal_cases)\n      case (11 vl' vl1' tr) then show ?case\n        by (intro exI[of _ \"map projl vl1'\"]) (auto simp: map_projl_Inl these_map_Inl_projl)\n    qed auto\n    show ?case using Iss.secure Iss'.translate_secure by auto\nnext\n  case (3 aid tr vl' vl1)\n    then show ?case\n      using Iss_B_Recv_B[of aid \"(Net.lV AID tr)\" vl1] list_all_Not_isl_projectSrcV\n      by auto\nqed\n\ntheorem secure: \"secure\"\nproof (intro preserve_source_secure ballI)\n  fix aid\n  assume aid: \"aid \\<in> AIDs - {AID}\"\n  interpret Node: Post_RECEIVER \"UIDs aid\" PID AID .\n  interpret Node': BD_Security_TS_Trans\n    istate System_Specification.validTrans srcOf tgtOf Node.\\<phi> Node.f Node.\\<gamma> Node.g Node.T Node.B\n    istate System_Specification.validTrans srcOf tgtOf Node.\\<phi> \"\\<lambda>trn. Inr (Node.f trn)\" Node.\\<gamma> Node.g Node.T \"B aid\"\n    id id Some \"Some o Inr\"\n  proof (unfold_locales, goal_cases)\n    case (11 vl' vl1' tr) then show ?case using aid\n      by (intro exI[of _ \"map projr vl1'\"]) (auto simp: map_projr_Inr these_map_Inr_projr)\n  qed auto\n  show \"Net.lsecure aid\"\n    using aid Node.Post_secure Node'.translate_secure by auto\nqed\n\nend  (* context Post_Network *)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMeDis/Post_Confidentiality/Independent_Posts/Independent_DYNAMIC_Post_Network.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3109513267990306}}
{"text": "section \\<open>Modular Formalization of Program Semantics\\<close>\n\ntext \\<open>Using the Virtual Datatype, Resource Space, Fiction Space, now in this section it is\n  feasible to formalize the semantics of programs modularly and extensibly.\n\nThe section first presents an empty formalization (framework) of computation states\nconsisting of empty types, empty values, empty resources, and empty fictions.\nIt serves for future formalization of any specific program semantics.\n\nThen on this empty formalization of computation states.\nThe framework formalizes computations using state-error-exception monad,\nsupporting most of control flows and therefore most of (imperative) languages.\n\\<close>\n\ntheory Phi_Semantics_Framework\n  imports Resource_Space Virtual_Datatype.Virtual_Datatype Debt_Axiom.Debt_Axiom\n  keywords \"resource_space\" :: thy_goal\n       and \"fiction_space\"  :: thy_goal\n  abbrevs \"<throws>\" = \"\\<t>\\<h>\\<r>\\<o>\\<w>\\<s>\"\n    and \"<proc>\" = \"\\<p>\\<r>\\<o>\\<c>\"\nbegin\n\n\ntext \\<open>The section provides the initial empty semantics of computation states\n  serving as the base for any further substantial formalization.\\<close>\n\nsubsection \\<open>Type\\<close>\n\n(* virtual_datatype \\<phi>empty_ty \\<comment> \\<open>base of type formalization\\<close> *)\n\nunspecified_type TY\nunspecified_type TY_N\ntype_synonym 'T type_entry = \\<open>(TY_N, TY, 'T) Virtual_Datatype.Field\\<close>\n\nconsts TY_CONS_OF :: \\<open>TY \\<Rightarrow> TY_N\\<close>\n\ninterpretation \"virtual_datatype\" TY_CONS_OF .\n\n(* interpretation \\<phi>empty_ty TY_CONS_OF by standard simp *)\n\n\nsubsection \\<open>Value\\<close>\n\n(* virtual_datatype \\<phi>empty_val :: sep_magma \\<comment> \\<open>base of value formalization\\<close> *)\n\nunspecified_type VAL\nunspecified_type VAL_N\ntype_synonym 'T value_entry = \\<open>(VAL_N, VAL, 'T) Virtual_Datatype.Field\\<close>\ntype_synonym vassn = \\<open>VAL set\\<close>\n\nconsts VAL_CONS_OF :: \\<open>VAL \\<Rightarrow> VAL_N\\<close>\n\ninstance VAL :: sep_magma ..\n\ninterpretation \"virtual_datatype\" VAL_CONS_OF .\n\ntext \\<open>The semantic value is a separation magma. It is nothing related to the semantic\n  or the specification framework themselves but just to be helpful in some situation for\n  formalization of some semantics such as that in aggregate the separation can represent\n  concatenation of fields.\\<close>\n\n(* interpretation \\<phi>empty_val VAL_CONS_OF by standard simp *)\n\n\nsubsubsection \\<open>Deep Representation of Aggregated Values\\<close>\n\nclass VAL =\n  fixes to_val   :: \\<open>'a \\<Rightarrow> VAL\\<close>\n    and from_val :: \\<open>VAL \\<Rightarrow> 'a\\<close>\n  assumes from_to_val[simp]: \\<open>from_val (to_val x) = x\\<close>\n\nclass VALs =\n  fixes to_vals    :: \\<open>'a \\<Rightarrow> VAL list\\<close>\n    and from_vals  :: \\<open>VAL list \\<Rightarrow> 'a\\<close>\n  assumes from_to_vals[simp]: \\<open>from_vals (to_vals x) = x\\<close>\n\nclass FIX_ARITY_VALs = VALs +\n  fixes vals_arity :: \\<open>'a itself \\<Rightarrow> nat\\<close>\n  assumes length_to_vals[simp]: \\<open>length (to_vals x) = vals_arity TYPE('a)\\<close>\n\ninstantiation VAL :: VAL begin\ndefinition to_val_VAL :: \\<open>VAL \\<Rightarrow> VAL\\<close> where \\<open>to_val_VAL = id\\<close>\ndefinition from_val_VAL :: \\<open>VAL \\<Rightarrow> VAL\\<close> where \\<open>from_val_VAL = id\\<close>\ninstance by standard (simp add: to_val_VAL_def from_val_VAL_def)\nend\n\ninstantiation unit :: FIX_ARITY_VALs begin\ndefinition to_vals_unit    :: \\<open>unit \\<Rightarrow> VAL list\\<close>   where \\<open>to_vals_unit v  = []\\<close>\ndefinition from_vals_unit  :: \\<open>VAL list \\<Rightarrow> unit\\<close>   where \\<open>from_vals_unit _ = ()\\<close>\ndefinition vals_arity_unit :: \\<open>unit itself \\<Rightarrow> nat\\<close> where \\<open>vals_arity_unit _ = 0\\<close>\ninstance by standard (simp_all add: vals_arity_unit_def to_vals_unit_def)\nend\n\ninstantiation VAL :: FIX_ARITY_VALs begin\ndefinition to_vals_VAL    :: \\<open>VAL \\<Rightarrow> VAL list\\<close>   where \\<open>to_vals_VAL v  = [v]\\<close>\ndefinition from_vals_VAL  :: \\<open>VAL list \\<Rightarrow> VAL\\<close>   where \\<open>from_vals_VAL  = hd\\<close>\ndefinition vals_arity_VAL :: \\<open>VAL itself \\<Rightarrow> nat\\<close> where \\<open>vals_arity_VAL _ = 1\\<close>\ninstance by standard (simp_all add: to_vals_VAL_def from_vals_VAL_def vals_arity_VAL_def)\nend\n\ninstantiation prod :: (FIX_ARITY_VALs, FIX_ARITY_VALs) FIX_ARITY_VALs begin\n\ndefinition to_vals_prod    :: \\<open>'a \\<times> 'b \\<Rightarrow> VAL list\\<close>\n  where \\<open>to_vals_prod v = (case v of (v1,v2) \\<Rightarrow> to_vals v1 @ to_vals v2)\\<close>\ndefinition from_vals_prod  :: \\<open>VAL list \\<Rightarrow> 'a \\<times> 'b\\<close>\n  where \\<open>from_vals_prod vs = (@v. to_vals v = vs)\\<close>\ndefinition vals_arity_prod :: \\<open>('a \\<times> 'b) itself \\<Rightarrow> nat\\<close>\n  where \\<open>vals_arity_prod _ = vals_arity TYPE('a) + vals_arity TYPE('b)\\<close>\n\ninstance apply standard\n  apply (clarsimp simp add: to_vals_prod_def from_vals_prod_def)\n  apply (smt (verit) Eps_case_prod_eq Eps_cong append_eq_append_conv from_to_vals length_to_vals split_def)\n  by (clarsimp simp add: to_vals_prod_def vals_arity_prod_def)\n\nend\n\ninstantiation list :: (VAL) VALs begin\ndefinition to_vals_list :: \\<open>'a list \\<Rightarrow> VAL list\\<close> where \\<open>to_vals_list = map to_val\\<close>\ndefinition from_vals_list :: \\<open>VAL list \\<Rightarrow> 'a list\\<close> where \\<open>from_vals_list = map from_val\\<close>\ninstance by standard (induct_tac x; simp add: to_vals_list_def from_vals_list_def)\nend\n\n\n\nsubsection \\<open>Resource\\<close>\n\nunspecified_type RES\nunspecified_type RES_N\ntype_synonym resource = \\<open>RES_N \\<Rightarrow> RES\\<close>\ntype_synonym rassn = \\<open>resource set\\<close>\ntype_synonym 'T resource_entry = \"(RES_N, RES, 'T, 'T sep_closed_set) Resource_Space.kind\"\n\nsetup \\<open>Sign.mandatory_path \"RES\"\\<close>\n\nconsts DOMAIN :: \\<open>RES_N \\<Rightarrow> RES sep_closed_set\\<close>\n\ndebt_axiomatization sort: \\<open>OFCLASS(RES, sep_algebra_class)\\<close>\n\ninstance RES :: sep_algebra using RES.sort .\n\ninterpretation \"resource_space\" RES.DOMAIN .\n\nsetup \\<open>Sign.parent_path\\<close>\n\nML_file \\<open>resource_space_more.ML\\<close>\n \nML \\<open>Resource_Space.define_command \\<^command_keyword>\\<open>resource_space\\<close> \"extend resource semantics\"\\<close>\n\n(*\ndefinition \"Valid_Resource = {R. (\\<forall>N. R N \\<in>\\<^sub>S Resource_Validator N)}\"\n\nlemma Valid_Resource_1[iff]:\n  \\<open>1 \\<in> Valid_Resource\\<close>\n  unfolding Valid_Resource_def by simp\n\nlemma Valid_Resource_mult_homo:\n  \\<open>A ## B \\<Longrightarrow> A * B \\<in> Valid_Resource \\<longleftrightarrow> A \\<in> Valid_Resource \\<and> B \\<in> Valid_Resource\\<close>\n  unfolding Valid_Resource_def\n  by (simp add: times_fun sep_disj_fun_def; blast)*)\n\n\nsubsection \\<open>Abnormality\\<close>\n\nvirtual_datatype \\<phi>empty_abnormal\n\nunspecified_type ABNM\nunspecified_type ABNM_N\ntype_synonym 'T abnormal_entry = \\<open>(ABNM_N, ABNM, 'T) Virtual_Datatype.Field\\<close>\n\nconsts ABNM_CONS_OF :: \\<open>ABNM \\<Rightarrow> ABNM_N\\<close>\n\ninterpretation \\<phi>empty_abnormal ABNM_CONS_OF by standard simp\n\n\nsubsection \\<open>All-in-One Semantics\\<close>\n\ndebt_axiomatization Well_Type :: \\<open>TY \\<Rightarrow> VAL set\\<close>\n(*  where Well_Type_disjoint: \\<open>ta \\<noteq> tb \\<Longrightarrow> Well_Type ta \\<inter> Well_Type tb = {}\\<close> *)\n\ndebt_axiomatization Can_EqCompare :: \\<open>resource \\<Rightarrow> VAL \\<Rightarrow> VAL \\<Rightarrow> bool\\<close>\n  where can_eqcmp_sym: \"Can_EqCompare res A B \\<longleftrightarrow> Can_EqCompare res B A\"\n\nconsts EqCompare :: \\<open>VAL \\<Rightarrow> VAL \\<Rightarrow> bool\\<close>\n(*  and   eqcmp_refl:  \"EqCompare A A\"\n    and   eqcmp_sym:   \"EqCompare A B \\<longleftrightarrow> EqCompare B A\"\n    and   eqcmp_trans: \"EqCompare A B \\<Longrightarrow> EqCompare B C \\<Longrightarrow> EqCompare A C\" *)\n\ndebt_axiomatization Zero :: \\<open>TY \\<Rightarrow> VAL option\\<close>\n  where zero_well_typ: \"pred_option (\\<lambda>v. v \\<in> Well_Type T) (Zero T)\"\n\n(* lemma Well_Type_unique:\n  \\<open>v \\<in> Well_Type ta \\<Longrightarrow> v \\<in> Well_Type tb \\<Longrightarrow> ta = tb\\<close>\n  using Well_Type_disjoint by blast\n\nabbreviation \\<open>Valid_Type T \\<equiv> Inhabited (Well_Type T)\\<close>*)\n\n\nsubsection \\<open>Fiction\\<close>\n\nunspecified_type FIC\nunspecified_type FIC_N\n\ntype_synonym fiction = \\<open>FIC_N \\<Rightarrow> FIC\\<close>\ntype_synonym assn = \\<open>fiction set\\<close>\ntype_synonym 'T fiction_entry = \"(FIC_N, FIC, 'T, unit) Resource_Space.kind\"\n\nsetup \\<open>Sign.mandatory_path \"FIC\"\\<close>\n\nconsts DOMAIN :: \\<open>FIC_N \\<Rightarrow> FIC sep_homo_set\\<close>\n\ndebt_axiomatization sort: \\<open>OFCLASS(FIC, sep_algebra_class)\\<close>\n\nsetup \\<open>Sign.parent_path\\<close>\n\ninstance FIC :: sep_algebra using FIC.sort .\n\nconsts INTERPRET :: \\<open>FIC_N \\<Rightarrow> (FIC, resource) interp\\<close>\n\ninterpretation FIC: fictional_space FIC.DOMAIN INTERPRET .\n\n\ndefinition \"INTERP_RES fic \\<equiv> RES.SPACE \\<inter> {_. fic \\<in> FIC.SPACE } \\<inter> \\<I> FIC.INTERP fic\"\n  \\<comment> \\<open>Interpret a fiction\\<close>\n\nlemma In_INTERP_RES:\n  \\<open>r \\<in> INTERP_RES fic \\<longleftrightarrow> r \\<in> RES.SPACE \\<and> fic \\<in> FIC.SPACE \\<and> r \\<in> \\<I> FIC.INTERP fic\\<close>\n  unfolding INTERP_RES_def by simp\n\ndefinition INTERP_SPEC :: \\<open>assn \\<Rightarrow> rassn\\<close>\n  \\<comment> \\<open>Interpret a fictional specification\\<close>\n  where \"INTERP_SPEC T = { res. \\<exists>fic. fic \\<in> T \\<and> res \\<in> INTERP_RES fic }\"\n\nlemma INTERP_SPEC:\n  \\<open>res \\<in> INTERP_SPEC T \\<longleftrightarrow> (\\<exists>fic. fic \\<in> T \\<and> res \\<in> INTERP_RES fic)\\<close>\n  unfolding INTERP_SPEC_def by simp\n\nlemma INTERP_SPEC_subset[intro, simp]: \\<open>A \\<subseteq> B \\<Longrightarrow> INTERP_SPEC A \\<subseteq> INTERP_SPEC B\\<close>\n  unfolding INTERP_SPEC_def subset_iff by simp blast\n\nlemma INTERP_SPEC_plus[iff]:\n  \\<open>INTERP_SPEC (A + B) = INTERP_SPEC A + INTERP_SPEC B\\<close>\n  unfolding INTERP_SPEC_def plus_set_def by simp blast\n\nlemma INTERP_SPEC_empty[intro, simp]:\n  \\<open>S = {} \\<Longrightarrow> INTERP_SPEC S = {}\\<close>\n  unfolding INTERP_SPEC_def set_eq_iff by simp\n\nlemma INTERP_SPEC_0[simp]:\n  \\<open>INTERP_SPEC 0  = 0\\<close>\n  \\<open>INTERP_SPEC {} = {}\\<close>\n  unfolding INTERP_SPEC_def zero_set_def by simp+\n\nML_file \\<open>fiction_space_more.ML\\<close>\n\nML \\<open>Fiction_Space.define_command \\<^command_keyword>\\<open>fiction_space\\<close> \"extend fictions\"\\<close>\n\n(*\nlemma INTERP_mult:\n  \\<open> Fic_Space f1\n\\<Longrightarrow> Fic_Space f2\n\\<Longrightarrow> dom1 r1 \\<inter> dom1 r2 = {}\n\\<Longrightarrow> dom1 f1 \\<inter> dom1 f2 = {}\n\\<Longrightarrow> r1 \\<in> \\<I> INTERP f1\n\\<Longrightarrow> r2 \\<in> \\<I> INTERP f2\n\\<Longrightarrow> f1 ## f2\n\\<Longrightarrow> r1 * r2 \\<in> \\<I> INTERP (f1 * f2) \\<and> r1 ## r2\\<close>\n  unfolding INTERP_def Fic_Space_def\n  by (simp add: dom1_sep_mult_disjoint times_fun prod.union_disjoint\n                disjoint_dom1_eq_1[of f1 f2],\n      meson dom1_disjoint_sep_disj times_set_I) *)\n\n\nsubsection \\<open>Formalization of Computation\\<close>\n\nsubsubsection \\<open>Explicit Annotation of Semantic Arguments and Returns\\<close>\n\ntext \\<open>Arguments and Returns are wrapped by \\<phi>arg type.\n  It helps the programming framework and syntax parser to recognize which one is an argument\n  or a return, among values that may be used for other purposes of specification.\\<close>\n\ndatatype ('a::VALs) \\<phi>arg = \\<phi>arg (dest: 'a)\nhide_const (open) dest\n\nlemma \\<phi>arg_forall: \\<open>All P \\<longleftrightarrow> (\\<forall>x. P (\\<phi>arg x))\\<close> by (metis \\<phi>arg.exhaust)\nlemma \\<phi>arg_exists: \\<open>Ex P  \\<longleftrightarrow> (\\<exists>x. P (\\<phi>arg x))\\<close> by (metis \\<phi>arg.exhaust)\nlemma \\<phi>arg_All: \\<open>(\\<And>x. PROP P x) \\<equiv> (\\<And>x. PROP P (\\<phi>arg x))\\<close>\nproof\n  fix x :: 'a assume A: \\<open>(\\<And>x. PROP P x)\\<close> then show \\<open>PROP P (\\<phi>arg x)\\<close> .\nnext\n  fix x :: \\<open>'a \\<phi>arg\\<close> assume A: \\<open>\\<And>x. PROP P (\\<phi>arg x)\\<close>\n  from \\<open>PROP P (\\<phi>arg (\\<phi>arg.dest x))\\<close> show \"PROP P x\" by simp\nqed\n\n\ndefinition \\<open>\\<phi>V_none = \\<phi>arg ()\\<close>\ndefinition \\<phi>V_pair (infixr \"\\<^bold>,\" 10) where \\<open>\\<phi>V_pair x y = \\<phi>arg (\\<phi>arg.dest x, \\<phi>arg.dest y)\\<close>\ndefinition \\<open>\\<phi>V_case_prod f x \\<equiv> case x of \\<phi>arg (a,b) \\<Rightarrow> f (\\<phi>arg a) (\\<phi>arg b)\\<close>\ndefinition \\<open>\\<phi>V_fst x = map_\\<phi>arg fst x\\<close>\ndefinition \\<open>\\<phi>V_snd x = map_\\<phi>arg snd x\\<close>\nabbreviation \\<open>\\<phi>V_nil \\<equiv> \\<phi>arg []\\<close>\ndefinition \\<open>\\<phi>V_cons h l = \\<phi>arg (\\<phi>arg.dest h # \\<phi>arg.dest l)\\<close>\ndefinition \\<open>\\<phi>V_hd l = \\<phi>arg (hd (\\<phi>arg.dest l))\\<close>\ndefinition \\<open>\\<phi>V_tl l = \\<phi>arg (tl (\\<phi>arg.dest l))\\<close>\n\nlemma \\<phi>V_simps[simp]:\n  \\<open>\\<phi>V_pair (\\<phi>V_fst v) (\\<phi>V_snd v) = v\\<close>\n  \\<open>\\<phi>V_fst (\\<phi>V_pair u y) = u\\<close>\n  \\<open>\\<phi>V_snd (\\<phi>V_pair x u) = u\\<close>\n  \\<open>\\<phi>V_fst (\\<phi>arg (xa,xb)) = \\<phi>arg xa\\<close>\n  \\<open>\\<phi>V_snd (\\<phi>arg (xa,xb)) = \\<phi>arg xb\\<close>\n  \\<open>\\<phi>V_cons (\\<phi>arg h) (\\<phi>arg l) = \\<phi>arg (h#l)\\<close>\n  \\<open>\\<phi>V_hd (\\<phi>V_cons hv lv) = hv\\<close>\n  \\<open>\\<phi>V_tl (\\<phi>V_cons hv lv) = lv\\<close>\n  \\<open>\\<phi>V_case_prod f (\\<phi>V_pair a b) = f a b\\<close>\n  \\<open>\\<phi>V_case_prod (\\<lambda>a b. f2 (\\<phi>V_pair a b)) = f2\\<close>\n  \\<open>\\<phi>V_case_prod (\\<lambda>a. \\<phi>V_case_prod (\\<lambda>b c. f3 (\\<phi>V_pair a (\\<phi>V_pair b c)))) = f3\\<close>\n  \\<open>\\<phi>V_case_prod (\\<lambda>a. \\<phi>V_case_prod (\\<lambda>b. \\<phi>V_case_prod (\\<lambda>c d. f4 (\\<phi>V_pair a (\\<phi>V_pair b (\\<phi>V_pair c d)))))) = f4\\<close>\n  unfolding \\<phi>V_pair_def \\<phi>V_fst_def \\<phi>V_snd_def \\<phi>V_cons_def \\<phi>V_hd_def \\<phi>V_tl_def \\<phi>V_case_prod_def\n    apply (cases v, simp)\n    apply (cases v, simp)\n    apply (cases v, simp)\n    apply simp apply simp apply simp\n    apply simp apply simp apply simp\n    apply (simp add: fun_eq_iff \\<phi>arg_forall)\n    apply (simp add: fun_eq_iff \\<phi>arg_forall)\n    apply (simp add: fun_eq_iff \\<phi>arg_forall) .\n\ndefinition unreachable :: \\<open>'a::VALs\\<close> where \\<open>unreachable = undefined\\<close>\n\nparagraph \\<open>More auxiliary properties\\<close>\n\nlemma split_paired_All_\\<phi>arg:\n  \"(\\<forall>x. P x) \\<longleftrightarrow> (\\<forall>a b. P (\\<phi>V_pair a b))\"\n  by (metis \\<phi>V_simps(1))\n\nlemma split_paired_Ex_\\<phi>arg:\n  \"(\\<exists>x. P x) \\<longleftrightarrow> (\\<exists>a b. P (\\<phi>V_pair a b))\"\n  by (metis \\<phi>V_simps(1))\n\nlemma split_paired_all_\\<phi>arg:\n  \"(\\<And>x. PROP P x) \\<equiv> (\\<And>a b. PROP P (\\<phi>V_pair a b))\"\n  unfolding \\<phi>arg_All \\<phi>V_pair_def split_paired_all by simp\n\nlemma split_paired_All_\\<phi>arg_unit:\n  \"(\\<forall>x. P x) \\<longleftrightarrow> P \\<phi>V_none\"\n  by (simp add: \\<phi>arg_forall \\<phi>V_none_def)\n\nlemma split_paired_Ex_\\<phi>arg_unit:\n  \"(\\<exists>x. P x) \\<longleftrightarrow> P \\<phi>V_none\"\n  by (simp add: \\<phi>arg_exists \\<phi>V_none_def)\n\nlemma split_paired_all_\\<phi>arg_unit:\n  \"(\\<And>x. PROP P x) \\<equiv> PROP P \\<phi>V_none\"\n  unfolding \\<phi>arg_All \\<phi>V_pair_def split_paired_all \\<phi>V_none_def by simp\n\n\n\n\n(* datatype unreachable = unreachable\n\ninstantiation unreachable :: VALs begin\ndefinition to_vals_unreachable :: \\<open>unreachable \\<Rightarrow> VAL list\\<close> where \\<open>to_vals_unreachable _ = undefined\\<close>\ndefinition from_vals_unreachable :: \\<open>VAL list \\<Rightarrow> unreachable\\<close> where \\<open>from_vals_unreachable _ = unreachable\\<close>\ndefinition vals_arity_unreachable :: \\<open>unreachable itself \\<Rightarrow> nat\\<close>\n  where \\<open>vals_arity_unreachable _ = length (undefined::VAL list)\\<close>\n\ninstance apply standard\n  apply (simp_all add: to_vals_unreachable_def from_vals_unreachable_def vals_arity_unreachable_def)\n  by (metis unreachable.exhaust)\nend\n*)\n\nsubsubsection \\<open>Monadic Formalization\\<close>\n\ntext \\<open>\\<open>('ret,'ex,'RES_N,'RES) state\\<close> represents any potential returning state of a program.\n\n\\<^item> \\<open>Success v r\\<close> represents a successful returning state with return value \\<open>v\\<close> and resulted resource\n  state \\<open>r\\<close>.\n\n\\<^item> \\<open>Abnormality v r\\<close> represents the computation throws an exception of value \\<open>v\\<close>, at the\n  moment when the state of the resources is \\<open>r\\<close>.\n\n\\<^item> \\<open>NonTerm\\<close> represents the execution does not terminate.\n\n\\<^item> \\<open>Invalid\\<close> represents the computation is invalid.\n  It defines the domain of valid programs, which are the ones that never never generates\n  an execution path that results in \\<open>Invalid\\<close>.\n\n\\<^item> \\<open>Assumption_Violated\\<close> represents the computation that results in an execution path that is not\n  considered or modelled by the trust base.\n  For example, the formalization of the allocation instruction may assume the size of the object\n  to be allocated is always less than the size of the address space (e.g., \\<open>2\\<^sup>3\\<^sup>2\\<close> bytes).\n  In another case users may assume the size of their objects is representable by \\<open>size_t\\<close>.\n  \\<open>Assumption_Violated\\<close> enables an easy way for semantic assumptions, e.g., to assume \\<open>P\\<close>,\n  \\[ \\<open>if P then do-something else return Assumption_Violated\\<close> \\]\n  \\<open>Assumption_Violated\\<close> is admitted by any post-condition, i.e.,\n  \\[ {\\<top>} return Assumption_Violated {\\<bottom>} \\]\n  Computations returning \\<open>Assumption_Violated\\<close> are trusted by the trust base.\n  This additional increment in the trust base is controllable, because whether and where to\n  use the \\<open>Assumption_Violated\\<close>, this is determined by the formalization of instruction semantics,\n  which belongs to the trust base already.\n\\<close>\n\ndeclare [ [typedef_overloaded] ]\n\ndatatype 'ret comp =\n      Success \\<open>'ret::VALs \\<phi>arg\\<close> (resource: resource)\n    | Abnormality \\<open>ABNM\\<close> (resource: resource)\n    | Invalid\n    | AssumptionBroken\n    | NonTerm\n\ndeclare [ [typedef_overloaded = false] ]\n\n\nlemma split_comp_All:\n  \\<open>All P \\<longleftrightarrow> (\\<forall>v r. P (Success v r)) \\<and> (\\<forall>v r. P (Abnormality v r)) \\<and> P Invalid\n                \\<and> P AssumptionBroken \\<and> P NonTerm\\<close>\n  by (metis comp.exhaust)\n\nlemma split_comp_Ex:\n  \\<open>Ex P \\<longleftrightarrow> (\\<exists>v r. P (Success v r)) \\<or> (\\<exists>v r. P (Abnormality v r)) \\<or> P Invalid\n                \\<or> P AssumptionBroken \\<or> P NonTerm\\<close>\n  by (metis comp.exhaust)\n\nhide_const(open) resource\n\ndeclare comp.split[split]\n\ntext \\<open>Procedure is the basic building block of a program on the semantics formalization.\nIt represents a segment of a program, which is defined inductively,\n\n\\<^item> Any instruction instantiated by any arguments is a procedure\n\\<^item> Any lambda abstraction of a procedure is a procedure\n\\<^item> Sequential composition \\<open>f \\<bind> g\\<close> is a procedure iff \\<open>f, g\\<close> are procedures.\n\\<^item> A control flow combinator combines several procedures into a procedure\n\nControl flow combinator does not include the sequential composition combinator \\<open>\\<bind>\\<close>.\n\nAny function, routine, or sub-routine in high level languages is a procedure but a procedure\ndoes not necessarily corresponds to them nor any basic block in assemble representations.\n\nA procedure is not required to be a valid program necessarily.\nProcedure is only a syntax structure and the semantics of invalid operations or programs\nis expressed by returning \\<open>Invalid\\<close>.\n\n%% Not Required:\n% \\<^bold>\\<open>Normal Form of Procedures\\<close> (NFP) is defined by the following BNF,\n% \\begin{align}\n% \\<open>NFP p\\<close> \\Coloneqq & \\<open>return v\\<close>\n%                 | & \\<open>i \\<bind> p\\<close>   & &\\text{for \\<open>i \\<in> Instructions\\<close>} \\\\\n%                 | & \\<open>\\<lambda>x. p\\<close>\n%                 | & \\<open>c p p \\<cdots> p\\<close> & &\\text{\\<open>c\\<close> is a control flow combinator.}\n% \\end{align}\n% It essentially says any lambda abstraction occurring in the left hand side of a sequential\n% composition \\<open>(\\<lambda>x. f) \\<bind> g\\<close> can be expanded to the whole term, i.e., \\<open>\\<lambda>x. (f \\<bind> g)\\<close>.\n% And any body of the control flows is also in NFP.\n% It is obvious the NFP can express equivalently any procedure.\n% NFP is used later in CoP to construct any procedure.\n\n% TODO: value annotation and slightly-shallow representation.\n \\<close>\n\ntype_synonym 'ret proc = \"resource \\<Rightarrow> 'ret comp set\"\ntype_synonym ('arg,'ret) proc' = \"'arg \\<phi>arg \\<Rightarrow> 'ret proc\"\n\n\ndefinition bind :: \"'a::VALs proc \\<Rightarrow> ('a,'b) proc' \\<Rightarrow> 'b::VALs proc\"  (\"_ \\<bind>/ _\" [75,76] 75)\n  where \"bind f g = (\\<lambda>res. \\<Union>((\\<lambda>y. case y of Success v x \\<Rightarrow> g v x\n                                           | Abnormality v x \\<Rightarrow> {Abnormality v x}\n                                           | Invalid \\<Rightarrow> {Invalid}\n                                           | NonTerm \\<Rightarrow> {NonTerm}\n                                           | AssumptionBroken \\<Rightarrow> {AssumptionBroken}\n                              ) ` f res))\"\n\nabbreviation bind' (\"_ \\<ggreater>/ _\" [75,76] 75)\n  where \\<open>bind' f g \\<equiv> (f \\<bind> (\\<lambda>_. g))\\<close>\n\ndefinition \\<open>det_lift f x = {f x}\\<close>\n\ndefinition \\<open>Return = det_lift o Success\\<close>\n\ndefinition Nondet :: \\<open>'ret proc \\<Rightarrow> 'ret proc \\<Rightarrow> 'ret proc\\<close>\n  where \\<open>Nondet f g = (\\<lambda>res. f res \\<union> g res)\\<close>\n\nlemma proc_bind_SKIP'[simp]:\n  \"f \\<bind> Return \\<equiv> f\"\n  \"Return any \\<bind> ff \\<equiv> ff any\"\n  \"(g \\<ggreater> Return any) \\<ggreater> f \\<equiv> g \\<ggreater> f\"\n  \"(\\<lambda>v. Return v \\<bind> h) \\<equiv> h\"\n  unfolding bind_def atomize_eq fun_eq_iff det_lift_def set_eq_iff Return_def\n  by (clarsimp; metis comp.exhaust)+\n\nlemma proc_bind_return_none[simp]:\n  \"f_nil \\<ggreater> Return \\<phi>V_none \\<equiv> f_nil\"\n  for f_nil :: \\<open>unit proc\\<close>\n  unfolding bind_def atomize_eq fun_eq_iff det_lift_def set_eq_iff Return_def \\<phi>V_none_def\n  apply (clarsimp)\n  subgoal for x y\n  apply rule\n    apply clarsimp\n    subgoal for z\n      apply (cases z; simp add: \\<phi>arg_All) .\n  apply (rule bexI[where x=y]; clarsimp simp add: \\<phi>arg_All) . .\n\nlemmas proc_bind_SKIP[simp] =\n  proc_bind_SKIP'[unfolded Return_def, simplified]\n  proc_bind_return_none[unfolded Return_def, simplified]\n\nlemma proc_bind_assoc[simp]:\n  \"((A \\<bind> B) \\<bind> C) = (A \\<bind> (\\<lambda>x. B x \\<bind> C))\"\n  unfolding bind_def fun_eq_iff det_lift_def set_eq_iff\n  by clarsimp\n\nend\n", "meta": {"author": "xqyww123", "repo": "phi-system", "sha": "c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab", "save_path": "github-repos/isabelle/xqyww123-phi-system", "path": "github-repos/isabelle/xqyww123-phi-system/phi-system-c8dca186bcc8ac2c9b38d813fc0f0dfec486ebab/Phi_Semantics_Framework/Phi_Semantics_Framework.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032313, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.31081121748456003}}
{"text": "(*  Title:      HOL/Auth/Event.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n\nDatatype of events; function \"spies\"; freshness\n\n\"bad\" agents have been broken by the Spy; their private keys and internal\n    stores are visible to him\n*)\n\nsection\\<open>Theory of Events for Security Protocols against Dolev-Yao\\<close>\n\ntheory Event imports Message begin\n\nconsts  (*Initial states of agents -- parameter of the construction*)\n  initState :: \"agent => msg set\"\n\ndatatype\n  event = Says  agent agent msg\n        | Gets  agent       msg\n        | Notes agent       msg\n       \nconsts \n  bad    :: \"agent set\"                         \\<comment> \\<open>compromised agents\\<close>\n\ntext\\<open>Spy has access to his own key for spoof messages, but Server is secure\\<close>\nspecification (bad)\n  Spy_in_bad     [iff]: \"Spy \\<in> bad\"\n  Server_not_bad [iff]: \"Server \\<notin> bad\"\n    by (rule exI [of _ \"{Spy}\"], simp)\n\nprimrec knows :: \"agent => event list => msg set\"\nwhere\n  knows_Nil:   \"knows A [] = initState A\"\n| knows_Cons:\n    \"knows A (ev # evs) =\n       (if A = Spy then \n        (case ev of\n           Says A' B X => insert X (knows Spy evs)\n         | Gets A' X => knows Spy evs\n         | Notes A' X  => \n             if A' \\<in> bad then insert X (knows Spy evs) else knows Spy evs)\n        else\n        (case ev of\n           Says A' B X => \n             if A'=A then insert X (knows A evs) else knows A evs\n         | Gets A' X    => \n             if A'=A then insert X (knows A evs) else knows A evs\n         | Notes A' X    => \n             if A'=A then insert X (knows A evs) else knows A evs))\"\n\n(*\n  Case A=Spy on the Gets event\n  enforces the fact that if a message is received then it must have been sent,\n  therefore the oops case must use Notes\n*)\n\ntext\\<open>The constant \"spies\" is retained for compatibility's sake\\<close>\n\nabbreviation (input)\n  spies  :: \"event list => msg set\" where\n  \"spies == knows Spy\"\n\n\n(*Set of items that might be visible to somebody:\n    complement of the set of fresh items*)\n\nprimrec used :: \"event list => msg set\"\nwhere\n  used_Nil:   \"used []         = (UN B. parts (initState B))\"\n| used_Cons:  \"used (ev # evs) =\n                     (case ev of\n                        Says A B X => parts {X} \\<union> used evs\n                      | Gets A X   => used evs\n                      | Notes A X  => parts {X} \\<union> used evs)\"\n    \\<comment> \\<open>The case for @{term Gets} seems anomalous, but @{term Gets} always\n        follows @{term Says} in real protocols.  Seems difficult to change.\n        See @{text Gets_correct} in theory @{text \"Guard/Extensions.thy\"}.\\<close>\n\nlemma Notes_imp_used [rule_format]: \"Notes A X \\<in> set evs --> X \\<in> used evs\"\napply (induct_tac evs)\napply (auto split: event.split) \ndone\n\nlemma Says_imp_used [rule_format]: \"Says A B X \\<in> set evs --> X \\<in> used evs\"\napply (induct_tac evs)\napply (auto split: event.split) \ndone\n\n\nsubsection\\<open>Function @{term knows}\\<close>\n\n(*Simplifying   \n parts(insert X (knows Spy evs)) = parts{X} \\<union> parts(knows Spy evs).\n  This version won't loop with the simplifier.*)\nlemmas parts_insert_knows_A = parts_insert [of _ \"knows A evs\"] for A evs\n\n\n\ntext\\<open>Letting the Spy see \"bad\" agents' notes avoids redundant case-splits\n      on whether @{term \"A=Spy\"} and whether @{term \"A\\<in>bad\"}\\<close>\nlemma knows_Spy_Notes [simp]:\n     \"knows Spy (Notes A X # evs) =  \n          (if A:bad then insert X (knows Spy evs) else knows Spy evs)\"\nby simp\n\nlemma knows_Spy_Gets [simp]: \"knows Spy (Gets A X # evs) = knows Spy evs\"\nby simp\n\nlemma knows_Spy_subset_knows_Spy_Says:\n     \"knows Spy evs \\<subseteq> knows Spy (Says A B X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_Spy_subset_knows_Spy_Notes:\n     \"knows Spy evs \\<subseteq> knows Spy (Notes A X # evs)\"\nby force\n\nlemma knows_Spy_subset_knows_Spy_Gets:\n     \"knows Spy evs \\<subseteq> knows Spy (Gets A X # evs)\"\nby (simp add: subset_insertI)\n\ntext\\<open>Spy sees what is sent on the traffic\\<close>\nlemma Says_imp_knows_Spy [rule_format]:\n     \"Says A B X \\<in> set evs --> X \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\nlemma Notes_imp_knows_Spy [rule_format]:\n     \"Notes A X \\<in> set evs --> A: bad --> X \\<in> knows Spy evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\n\ntext\\<open>Elimination rules: derive contradictions from old Says events containing\n  items known to be fresh\\<close>\nlemmas Says_imp_parts_knows_Spy = \n       Says_imp_knows_Spy [THEN parts.Inj, THEN revcut_rl] \n\nlemmas knows_Spy_partsEs =\n     Says_imp_parts_knows_Spy parts.Body [THEN revcut_rl]\n\nlemmas Says_imp_analz_Spy = Says_imp_knows_Spy [THEN analz.Inj]\n\ntext\\<open>Compatibility for the old \"spies\" function\\<close>\nlemmas spies_partsEs = knows_Spy_partsEs\nlemmas Says_imp_spies = Says_imp_knows_Spy\nlemmas parts_insert_spies = parts_insert_knows_A [of _ Spy]\n\n\nsubsection\\<open>Knowledge of Agents\\<close>\n\nlemma knows_Says: \"knows A (Says A B X # evs) = insert X (knows A evs)\"\nby simp\n\nlemma knows_Notes: \"knows A (Notes A X # evs) = insert X (knows A evs)\"\nby simp\n\nlemma knows_Gets:\n     \"A \\<noteq> Spy --> knows A (Gets A X # evs) = insert X (knows A evs)\"\nby simp\n\n\nlemma knows_subset_knows_Says: \"knows A evs \\<subseteq> knows A (Says A' B X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_subset_knows_Notes: \"knows A evs \\<subseteq> knows A (Notes A' X # evs)\"\nby (simp add: subset_insertI)\n\nlemma knows_subset_knows_Gets: \"knows A evs \\<subseteq> knows A (Gets A' X # evs)\"\nby (simp add: subset_insertI)\n\ntext\\<open>Agents know what they say\\<close>\nlemma Says_imp_knows [rule_format]: \"Says A B X \\<in> set evs --> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext\\<open>Agents know what they note\\<close>\nlemma Notes_imp_knows [rule_format]: \"Notes A X \\<in> set evs --> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext\\<open>Agents know what they receive\\<close>\nlemma Gets_imp_knows_agents [rule_format]:\n     \"A \\<noteq> Spy --> Gets A X \\<in> set evs --> X \\<in> knows A evs\"\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\ndone\n\n\ntext\\<open>What agents DIFFERENT FROM Spy know \n  was either said, or noted, or got, or known initially\\<close>\nlemma knows_imp_Says_Gets_Notes_initState [rule_format]:\n     \"[| X \\<in> knows A evs; A \\<noteq> Spy |] ==> \\<exists>B.  \n  Says A B X \\<in> set evs | Gets A X \\<in> set evs | Notes A X \\<in> set evs | X \\<in> initState A\"\napply (erule rev_mp)\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\ntext\\<open>What the Spy knows -- for the time being --\n  was either said or noted, or known initially\\<close>\nlemma knows_Spy_imp_Says_Notes_initState [rule_format]:\n     \"[| X \\<in> knows Spy evs |] ==> \\<exists>A B.  \n  Says A B X \\<in> set evs | Notes A X \\<in> set evs | X \\<in> initState Spy\"\napply (erule rev_mp)\napply (induct_tac \"evs\")\napply (simp_all (no_asm_simp) split: event.split)\napply blast\ndone\n\nlemma parts_knows_Spy_subset_used: \"parts (knows Spy evs) \\<subseteq> used evs\"\napply (induct_tac \"evs\", force)  \napply (simp add: parts_insert_knows_A knows_Cons add: event.split, blast) \ndone\n\nlemmas usedI = parts_knows_Spy_subset_used [THEN subsetD, intro]\n\nlemma initState_into_used: \"X \\<in> parts (initState B) ==> X \\<in> used evs\"\napply (induct_tac \"evs\")\napply (simp_all add: parts_insert_knows_A split: event.split, blast)\ndone\n\nlemma used_Says [simp]: \"used (Says A B X # evs) = parts{X} \\<union> used evs\"\nby simp\n\nlemma used_Notes [simp]: \"used (Notes A X # evs) = parts{X} \\<union> used evs\"\nby simp\n\nlemma used_Gets [simp]: \"used (Gets A X # evs) = used evs\"\nby simp\n\nlemma used_nil_subset: \"used [] \\<subseteq> used evs\"\napply simp\napply (blast intro: initState_into_used)\ndone\n\ntext\\<open>NOTE REMOVAL--laws above are cleaner, as they don't involve \"case\"\\<close>\ndeclare knows_Cons [simp del]\n        used_Nil [simp del] used_Cons [simp del]\n\n\ntext\\<open>For proving theorems of the form @{term \"X \\<notin> analz (knows Spy evs) --> P\"}\n  New events added by induction to \"evs\" are discarded.  Provided \n  this information isn't needed, the proof will be much shorter, since\n  it will omit complicated reasoning about @{term analz}.\\<close>\n\nlemmas analz_mono_contra =\n       knows_Spy_subset_knows_Spy_Says [THEN analz_mono, THEN contra_subsetD]\n       knows_Spy_subset_knows_Spy_Notes [THEN analz_mono, THEN contra_subsetD]\n       knows_Spy_subset_knows_Spy_Gets [THEN analz_mono, THEN contra_subsetD]\n\n\nlemma knows_subset_knows_Cons: \"knows A evs \\<subseteq> knows A (e # evs)\"\nby (induct e, auto simp: knows_Cons)\n\nlemma initState_subset_knows: \"initState A \\<subseteq> knows A evs\"\napply (induct_tac evs, simp) \napply (blast intro: knows_subset_knows_Cons [THEN subsetD])\ndone\n\n\ntext\\<open>For proving \\<open>new_keys_not_used\\<close>\\<close>\nlemma keysFor_parts_insert:\n     \"[| K \\<in> keysFor (parts (insert X G));  X \\<in> synth (analz H) |] \n      ==> K \\<in> keysFor (parts (G \\<union> H)) | Key (invKey K) \\<in> parts H\"\nby (force \n    dest!: parts_insert_subset_Un [THEN keysFor_mono, THEN [2] rev_subsetD]\n           analz_subset_parts [THEN keysFor_mono, THEN [2] rev_subsetD]\n    intro: analz_subset_parts [THEN subsetD] parts_mono [THEN [2] rev_subsetD])\n\n\nlemmas analz_impI = impI [where P = \"Y \\<notin> analz (knows Spy evs)\"] for Y evs\n\nML\n\\<open>\nfun analz_mono_contra_tac ctxt =\n  resolve_tac ctxt @{thms analz_impI} THEN' \n  REPEAT1 o (dresolve_tac ctxt @{thms analz_mono_contra})\n  THEN' mp_tac ctxt\n\\<close>\n\nmethod_setup analz_mono_contra = \\<open>\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (analz_mono_contra_tac ctxt)))\\<close>\n    \"for proving theorems of the form X \\<notin> analz (knows Spy evs) --> P\"\n\ntext\\<open>Useful for case analysis on whether a hash is a spoof or not\\<close>\n\nlemmas syan_impI = impI [where P = \"Y \\<notin> synth (analz (knows Spy evs))\"] for Y evs\n\nML\n\\<open>\nfun synth_analz_mono_contra_tac ctxt =\n  resolve_tac ctxt @{thms syan_impI} THEN'\n  REPEAT1 o \n    (dresolve_tac ctxt \n     [@{thm knows_Spy_subset_knows_Spy_Says} RS @{thm synth_analz_mono} RS @{thm contra_subsetD},\n      @{thm knows_Spy_subset_knows_Spy_Notes} RS @{thm synth_analz_mono} RS @{thm contra_subsetD},\n      @{thm knows_Spy_subset_knows_Spy_Gets} RS @{thm synth_analz_mono} RS @{thm contra_subsetD}])\n  THEN'\n  mp_tac ctxt\n\\<close>\n\nmethod_setup synth_analz_mono_contra = \\<open>\n    Scan.succeed (fn ctxt => SIMPLE_METHOD (REPEAT_FIRST (synth_analz_mono_contra_tac ctxt)))\\<close>\n    \"for proving theorems of the form X \\<notin> synth (analz (knows Spy evs)) --> P\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Inductive_Confidentiality/DolevYao/Event.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.31081121748456}}
{"text": "(*\n * Copyright 2018, Data61\n * Commonwealth Scientific and Industrial Research Organisation (CSIRO)\n * ABN 41 687 119 230.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(DATA61_BSD)\n *)\n\ntheory ValueSemantics\nimports Cogent\nbegin\n\n\ndatatype ('f, 'a) vval = VPrim lit\n                       | VProduct \"('f, 'a) vval\" \"('f, 'a) vval\"\n                       | VSum name \"('f, 'a) vval\"\n                       | VRecord \"('f, 'a) vval list\"\n                       | VAbstract \"'a\"\n                       | VFunction \"'f expr\" \"type list\"\n                       | VAFunction \"'f\" \"type list\"\n                       | VUnit\n\n(* All polymorphic instantiations must have the _same_ value semantics. This means even if the C\nimplementations differ they must all refine the same specification *)\ntype_synonym ('f, 'a) vabsfuns = \"'f \\<Rightarrow> ('f, 'a) vval \\<Rightarrow> ('f,'a) vval \\<Rightarrow> bool\"\n\n\ndefinition eval_prim :: \"prim_op \\<Rightarrow> ('f, 'a) vval list \\<Rightarrow> ('f, 'a) vval\"\nwhere\n  \"eval_prim pop xs = VPrim (eval_prim_op pop (map (\\<lambda>vv. case vv of VPrim v \\<Rightarrow> v | _ \\<Rightarrow> LBool False) xs))\"\n\nlemma eval_prim_type_change:\nassumes \"(eval_prim :: prim_op \\<Rightarrow> ('f1, 'a1) vval list \\<Rightarrow> ('f1, 'a1) vval) p (map VPrim lits) = VPrim l\"\nshows \"(eval_prim :: prim_op \\<Rightarrow> ('f2, 'a2) vval list \\<Rightarrow> ('f2, 'a2) vval) p (map VPrim  lits) = VPrim l\"\nproof -\nhave helper: \"(\\<lambda>vv. case vv of VPrim v \\<Rightarrow> v | _ \\<Rightarrow> LBool False) \\<circ> VPrim = id\" by (rule ext, simp)\nthen show ?thesis using assms by (simp add: eval_prim_def helper)\nqed\nsection {* Semantics *}\n\n(* NOTE: Termination is currently not provable with this approach. It's possible to show\n   it for v_sem assuming all called functions are terminating, but proving\n   this assumption would in turn require termination of v_sem.\n\n   Fixing this problem is nontrivial, and will likely necessitate changes to the design.\n*)\n\n\ninductive v_sem :: \"('f,'a) vabsfuns \\<Rightarrow> ('f, 'a) vval env \\<Rightarrow> 'f expr \\<Rightarrow> ('f, 'a) vval \\<Rightarrow> bool\"\n          (\"_ , _ \\<turnstile> _ \\<Down> _\" [30,0,0,20] 60)\nand       v_sem_all  :: \"('f,'a) vabsfuns \\<Rightarrow> ('f, 'a) vval list \\<Rightarrow> 'f expr list \\<Rightarrow> ('f, 'a) vval list \\<Rightarrow> bool\"\n          (\"_ , _ \\<turnstile>* _ \\<Down> _\" [30,0,0,20] 60)\nwhere\n  v_sem_var     : \"\\<xi> , \\<gamma> \\<turnstile> (Var i) \\<Down> (\\<gamma> ! i)\"\n\n| v_sem_lit     : \"\\<xi> , \\<gamma> \\<turnstile> (Lit l) \\<Down> VPrim l\"\n\n| v_sem_prim    : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile>* as \\<Down> as'\n                   \\<rbrakk> \\<Longrightarrow>  \\<xi> , \\<gamma> \\<turnstile> (Prim p as) \\<Down> eval_prim p as'\"\n\n| v_sem_fun     : \"\\<xi> , \\<gamma> \\<turnstile> Fun f ts \\<Down> VFunction f ts\"\n\n| v_sem_afun     : \"\\<xi> , \\<gamma> \\<turnstile> AFun f ts \\<Down> VAFunction f ts\"\n\n| v_sem_abs_app : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VAFunction f ts\n                   ; \\<xi> , \\<gamma> \\<turnstile> y \\<Down> a\n                   ; \\<xi> f a r\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> (App x y) \\<Down> r\"\n\n| v_sem_cast    : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> e \\<Down> VPrim l\n                   ; cast_to \\<tau> l = Some l'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Cast \\<tau> e \\<Down> VPrim l'\"\n\n| v_sem_app     : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VFunction e ts\n                   ; \\<xi> , \\<gamma> \\<turnstile> y \\<Down> a\n                   ; \\<xi> , [ a ] \\<turnstile> specialise ts e \\<Down> r\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> (App x y) \\<Down> r\"\n\n| v_sem_con     : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> x'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> (Con _ t x) \\<Down> VSum t x'\"\n\n| v_sem_member  : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> e \\<Down> VRecord fs\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Member e f \\<Down> fs ! f\"\n\n| v_sem_unit    : \"\\<xi> , \\<gamma> \\<turnstile> Unit \\<Down> VUnit\"\n\n| v_sem_tuple   : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> x'\n                   ; \\<xi> , \\<gamma> \\<turnstile> y \\<Down> y'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> (Tuple x y) \\<Down> VProduct x' y'\"\n\n| v_sem_esac    : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> t \\<Down> VSum ts v\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Esac t ts \\<Down> v\"\n\n| v_sem_let     : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> a \\<Down> a'\n                   ; \\<xi> , (a' # \\<gamma>) \\<turnstile> b \\<Down> b'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Let a b \\<Down> b'\"\n\n| v_sem_letbang : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> a \\<Down> a'\n                   ; \\<xi> , (a' # \\<gamma>) \\<turnstile> b \\<Down> b'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> LetBang vs a b \\<Down> b'\"\n\n| v_sem_case_m  : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VSum t v\n                   ; \\<xi> , (v # \\<gamma>) \\<turnstile> m \\<Down> m'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Case x t m n \\<Down> m'\"\n\n| v_sem_case_nm : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VSum t' v\n                   ; t \\<noteq> t'\n                   ; \\<xi> , (VSum t' v # \\<gamma>) \\<turnstile> n \\<Down> n'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Case x t m n \\<Down> n'\"\n\n| v_sem_if      : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VPrim (LBool b)\n                   ; \\<xi> , \\<gamma> \\<turnstile> if b then t else e \\<Down> r\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> If x t e \\<Down> r\"\n\n| v_sem_struct  : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile>* xs \\<Down> vs\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Struct ts xs \\<Down> VRecord vs\"\n\n| v_sem_take    : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VRecord fs\n                   ; \\<xi> , (fs ! f # VRecord fs # \\<gamma>) \\<turnstile> e \\<Down> e'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Take x f e \\<Down> e'\"\n\n| v_sem_put     : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VRecord fs\n                   ; \\<xi> , \\<gamma> \\<turnstile> e \\<Down> e'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Put x f e \\<Down> VRecord (fs [ f := e' ])\"\n\n| v_sem_split   : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> VProduct a b\n                   ; \\<xi> , (a # b # \\<gamma>) \\<turnstile> e \\<Down> e'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Split x e \\<Down> e'\"\n\n| v_sem_promote : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> e \\<Down> e'\n                   \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Promote t' e \\<Down> e'\"\n\n\n| v_sem_all_empty : \"\\<xi> , \\<gamma> \\<turnstile>* [] \\<Down> []\"\n\n| v_sem_all_cons  : \"\\<lbrakk> \\<xi> , \\<gamma> \\<turnstile> x \\<Down> v\n                     ; \\<xi> , \\<gamma> \\<turnstile>* xs \\<Down> vs\n                     \\<rbrakk> \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile>* (x # xs) \\<Down> (v # vs)\"\n\ninductive_cases v_sem_varE  [elim] : \"\\<xi> , \\<gamma> \\<turnstile> Var i \\<Down> v\"\ninductive_cases v_sem_funE  [elim] : \"\\<xi> , \\<gamma> \\<turnstile> Fun f ts \\<Down> v\"\ninductive_cases v_sem_afunE [elim] : \"\\<xi> , \\<gamma> \\<turnstile> AFun f ts \\<Down> v\"\ninductive_cases v_sem_appE  [elim] : \"\\<xi> , \\<gamma> \\<turnstile> App a b \\<Down> v\"\n\n\nlocale value_sem =\n  fixes abs_typing :: \"'a \\<Rightarrow> name \\<Rightarrow> type list \\<Rightarrow> bool\"\n  assumes abs_typing_bang : \"abs_typing av n \\<tau>s \\<Longrightarrow> abs_typing av n (map bang \\<tau>s)\"\n\ncontext value_sem begin\n\ninductive vval_typing  :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow> ('f, 'a) vval \\<Rightarrow> type \\<Rightarrow> bool\"\n          (\"_ \\<turnstile> _ :v _\" [30,0,20] 80)\nand vval_typing_record :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow> ('f, 'a) vval list \\<Rightarrow> (name \\<times> type \\<times> record_state) list \\<Rightarrow> bool\"\n          (\"_ \\<turnstile>* _ :vr _\" [30,0,20] 80) where\n\n  v_t_prim     : \"\\<Xi> \\<turnstile> VPrim l :v TPrim (lit_type l)\"\n\n| v_t_product  : \"\\<lbrakk> \\<Xi> \\<turnstile> a :v t\n                  ; \\<Xi> \\<turnstile> b :v u\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VProduct a b :v TProduct t u\"\n\n| v_t_sum      : \"\\<lbrakk> \\<Xi> \\<turnstile> a :v t\n                  ; (g, t, Unchecked) \\<in> set ts\n                  ; distinct (map fst ts)\n                  ; [] \\<turnstile> TSum ts wellformed\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VSum g a :v TSum ts\"\n\n| v_t_record   : \"\\<lbrakk> \\<Xi> \\<turnstile>* fs :vr ts\n                  ; distinct (map fst ts)\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VRecord fs :v TRecord ts s\"\n\n| v_t_abstract : \"\\<lbrakk> abs_typing a n ts\n                  ; [] \\<turnstile>* ts wellformed\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VAbstract a :v TCon n ts s\"\n\n(*\n  The term language type system uses an explicit subtyping rule (Promote), but we want a subtyping-implies-subset relation for values\n  so that we can upcast values without having to change their representation. This means we want implicit subsumption for values.\n  However, if we introduce a separate subsumption rule for values such as\n  | v_t_subsumption: \" \\<lbrakk> \\<Xi> \\<turnstile> v :v t ; [] \\<turnstile> t \\<sqsubseteq> t' \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> v :v t' \"\n  the canonical forms of values are less obvious.\n  Because our definition of subtyping is quite simple, we only really need subsumption for function values.\n  So for these two rules, we condense the v_t_subsumption and v_t_afun/v_t_function rules into one.\n  These rules still associate values with a concrete type constructor (TFun), which makes reasoning about canonical forms trivial.\n*)\n| v_t_afun     : \"\\<lbrakk> \\<Xi> f = (ks, a, b)\n                  ; list_all2 (kinding []) ts ks\n                  ; ks \\<turnstile> TFun a b wellformed\n                  ; [] \\<turnstile> TFun (instantiate ts a) (instantiate ts b) \\<sqsubseteq> TFun t' u'\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VAFunction f ts :v TFun t' u'\"\n\n| v_t_function : \"\\<lbrakk> \\<Xi> , K , [ Some t ] \\<turnstile> f : u\n                  ; K \\<turnstile> t wellformed\n                  ; list_all2 (kinding []) ts K\n                  ; [] \\<turnstile> TFun (instantiate ts t) (instantiate ts u) \\<sqsubseteq> TFun t' u'\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile> VFunction f ts :v TFun t' u'\"\n\n| v_t_unit     : \"\\<Xi> \\<turnstile> VUnit :v TUnit\"\n\n| v_t_r_empty  : \"\\<Xi> \\<turnstile>* [] :vr []\"\n| v_t_r_cons1  : \"\\<lbrakk> \\<Xi> \\<turnstile> x :v t\n                  ; \\<Xi> \\<turnstile>* xs :vr ts\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile>* (x # xs) :vr ((n, t, Present) # ts)\"\n| v_t_r_cons2  : \"\\<lbrakk> [] \\<turnstile> t wellformed\n                  ; \\<Xi> \\<turnstile>* xs :vr ts\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile>* (x # xs) :vr ((n, t, Taken) # ts)\"\n\n\nlemma v_t_prim' [intro]:\nassumes \"lit_type l = \\<tau>\"\nshows   \"\\<Xi> \\<turnstile> VPrim l :v TPrim \\<tau>\"\nusing assms by (auto intro: v_t_prim)\n\ninductive_cases v_t_funE      [elim]: \"\\<Xi> \\<turnstile> VFunction f ts :v t\"\ninductive_cases v_t_afunE     [elim]: \"\\<Xi> \\<turnstile> VAFunction f ts :v t\"\ninductive_cases v_t_recordE   [elim]: \"\\<Xi> \\<turnstile> VRecord fs :v \\<tau>\"\ninductive_cases v_t_productE  [elim]: \"\\<Xi> \\<turnstile> VProduct a b :v \\<tau>\"\ninductive_cases v_t_sumE'     [elim]: \"\\<Xi> \\<turnstile> e :v TSum ts\"\ninductive_cases v_t_primE     [elim]: \"\\<Xi> \\<turnstile> VPrim l :v TPrim (Num \\<tau>)\"\n\ninductive_cases v_t_r_emptyE  [elim]: \"\\<Xi> \\<turnstile>* [] :vr \\<tau>s\"\ninductive_cases v_t_r_consE   [elim]: \"\\<Xi> \\<turnstile>* (x # xs) :vr \\<tau>s\"\n\n\ndefinition vval_typing_all :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow> ('f, 'a) vval list \\<Rightarrow> type list \\<Rightarrow> bool\"\n           (\"_  \\<turnstile>* _ :v _\" [30,0,20] 80) where\n   \"(\\<Xi> \\<turnstile>* vs :v ts) \\<equiv> list_all2 (vval_typing \\<Xi>) vs ts\"\n\ndefinition matches :: \"('f \\<Rightarrow> poly_type) \\<Rightarrow>  ('f, 'a) vval env \\<Rightarrow> ctx \\<Rightarrow> bool\"\n           (\"_ \\<turnstile> _ matches _\" [30,0,20] 60) where\n   \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma> \\<equiv> list_all2 (\\<lambda> x m. \\<forall> \\<tau>. m = Some \\<tau> \\<longrightarrow> \\<Xi> \\<turnstile> x :v \\<tau>) \\<gamma> \\<Gamma>\"\n\nlemmas matches_Cons = list_all2_Cons[where P=\"(\\<lambda>x m. \\<forall>\\<tau>. m = Some \\<tau> \\<longrightarrow> \\<Xi> \\<turnstile> x :v \\<tau>)\" for \\<Xi>, simplified matches_def[symmetric]]\n\ndefinition proc_env_matches :: \"('f \\<Rightarrow> ('f, 'a) vval \\<Rightarrow> ('f, 'a) vval \\<Rightarrow> bool) \\<Rightarrow> ('f \\<Rightarrow> poly_type) \\<Rightarrow> bool\"\n           (\"_ matches _\" [30,20] 60) where\n  \"\\<xi> matches \\<Xi> \\<equiv> (\\<forall> f. let (K, \\<tau>i, \\<tau>o) = \\<Xi> f\n                        in (\\<forall> \\<tau>s v v'. list_all2 (kinding []) \\<tau>s K\n                                  \\<longrightarrow> (\\<Xi> \\<turnstile> v  :v instantiate \\<tau>s \\<tau>i)\n                                  \\<longrightarrow> \\<xi> f v v'\n                                  \\<longrightarrow> (\\<Xi> \\<turnstile> v' :v instantiate \\<tau>s \\<tau>o)))\"\n\n\nsection {* vval_typing lemmas *}\n\nlemma vval_typing_to_wellformed:\n  shows \"\\<Xi> \\<turnstile> v :v \\<tau>     \\<Longrightarrow> [] \\<turnstile> \\<tau> wellformed\"\n    and \"\\<Xi> \\<turnstile>* vs :vr fs \\<Longrightarrow> [] \\<turnstile>* map (fst \\<circ> snd) fs wellformed\"\nproof (induct rule: vval_typing_vval_typing_record.inducts)\n  case v_t_function then show ?case\n    by (metis instantiate_wellformed list_all2_kinding_wellformedD subtyping_wellformed_preservation(1) type_wellformed.simps(4) type_wellformed_pretty_def typing_to_wellformed(1))\nnext case v_t_afun  then show ?case\n    by (metis instantiate_wellformed list_all2_kinding_wellformedD subtyping_wellformed_preservation(1) type_wellformed.simps(4) type_wellformed_pretty_def)\nqed (auto intro: supersumption simp add: list_all_iff kinding_simps dest: kinding_all_record'[simplified o_def])\n\nlemma vval_typing_bang:\n  shows \"\\<Xi> \\<turnstile> x :v \\<tau> \\<Longrightarrow> \\<Xi> \\<turnstile> x :v bang \\<tau>\"\n    and \"\\<Xi> \\<turnstile>* fs :vr \\<tau>rs \\<Longrightarrow> \\<Xi> \\<turnstile>* fs :vr map (\\<lambda>(n, x, y). (n, bang x, y)) \\<tau>rs\"\nproof (induct rule: vval_typing_vval_typing_record.inducts)\n  case v_t_sum      then show ?case\n    by (force simp add: list_all_iff intro: vval_typing_vval_typing_record.intros\n                                                        bang_wellformed rev_image_eqI)\nnext case v_t_abstract then show ?case by (force intro: vval_typing_vval_typing_record.intros\n                                                        abs_typing_bang bang_wellformed)\nnext case v_t_r_cons2  then show ?case by (force intro: vval_typing_vval_typing_record.intros\n                                                        bang_wellformed)\nnext case v_t_afun\n  show ?case\n    using subtyping_bang_preservation v_t_afun vval_typing_vval_typing_record.v_t_afun by fastforce\nnext case v_t_function\n  show ?case\n    using subtyping_bang_preservation v_t_function.hyps vval_typing_vval_typing_record.v_t_function by fastforce\nqed (force intro: vval_typing_vval_typing_record.intros)+\n\nsubsection {* vval_typing_record *}\n\nlemma vval_typing_record_length:\nassumes \"\\<Xi> \\<turnstile>* fs :vr \\<tau>s\"\nshows   \"length fs = length \\<tau>s\"\nusing assms proof (induct fs arbitrary: \\<tau>s)\nqed (auto)\n\nlemma vval_typing_record_nth:\nassumes \"\\<Xi> \\<turnstile>* fs :vr \\<tau>s\"\nand     \"\\<tau>s ! f = (n, \\<tau>, Present)\"\nand     \"f < length \\<tau>s\"\nshows   \"\\<Xi> \\<turnstile> fs ! f :v \\<tau>\"\nusing assms proof (induct fs arbitrary: f \\<tau>s)\n     case Nil  then show ?case by (auto)\nnext case Cons then show ?case by (case_tac f, auto)\nqed\n\n\nlemma vval_typing_all_record:\n  assumes \"\\<Xi> \\<turnstile>* vs :v ts\"\n  and \"length ns = length ts\"\nshows \"\\<Xi> \\<turnstile>* vs :vr zip ns (zip ts (replicate (length ts) Present))\"\n  using assms[simplified vval_typing_all_def]\n  by (induct arbitrary: ns rule: list_all2_induct)\n    (auto simp add: length_Suc_conv intro!: vval_typing_vval_typing_record.intros)\n\nlemma vval_typing_record_take:\n  assumes \"\\<Xi> \\<turnstile>* ts :vr \\<tau>s\"\n    and \"\\<tau>s ! f = (n, t, Present)\"\n    and \"[] \\<turnstile> t :\\<kappa> k\"\n    and \"S \\<in> k \\<or> taken = Taken\"\n  shows \"\\<Xi> \\<turnstile>* ts :vr \\<tau>s[ f := (n, t, taken) ]\"\n  using assms\nproof (induct ts arbitrary: \\<tau>s n f)\n  case (Cons a ts)\n  moreover obtain \\<tau> \\<tau>s' where \"\\<tau>s = \\<tau> # \\<tau>s'\"\n    using Cons.prems by blast\n  ultimately show ?case\n    by (cases taken, auto dest: kinding_to_wellformedD split: nat.splits\n        intro!: vval_typing_vval_typing_record.intros)\nqed (force intro: vval_typing_vval_typing_record.intros)\n\nlemma vval_typing_record_put:\nassumes \"\\<Xi> \\<turnstile>* ts :vr \\<tau>s\"\nand     \"\\<tau>s ! f = (n, t, taken)\"\nand     \"[] \\<turnstile> t :\\<kappa> k\"\nand     \"D \\<in> k \\<or> taken = Taken\"\nand     \"\\<Xi> \\<turnstile> v :v t\"\nshows   \"\\<Xi> \\<turnstile>* ts[ f := v ] :vr \\<tau>s[ f := (n, t, Present) ]\"\nusing assms proof (induct ts arbitrary: \\<tau>s f)\n     case Nil  then show ?case by ( force intro: vval_typing_vval_typing_record.intros)\nnext case Cons then show ?case by ( cases taken\n                                  , (force split: nat.split\n                                           intro!: vval_typing_vval_typing_record.intros)+ )\nqed\n\n\nsubsection {* Sums and subtyping *}\n\n(*\n  (* With the changes to the typing system now, I don't think this holds anymore? ~ v.jackson / 2019.01.10 *)\nlemma width_subtyping:\nassumes \"set ts \\<subseteq> set us\"\nand     \"\\<Xi> \\<turnstile> v :v TSum ts\"\nand     \"[] \\<turnstile> TSum us wellformed\"\nshows   \"\\<Xi> \\<turnstile> v :v TSum us\"\nusing assms\nby (force simp add: kinding_simps intro: vval_typing_vval_typing_variant_vval_typing_record.intros)\n*)\nlemma sum_downcast:\n  assumes vval_tsum_ts: \"\\<Xi> \\<turnstile> VSum tag v :v TSum ts\"\n    and   tag_neq_tag': \"tag \\<noteq> tag'\"\n    and   tag'_in_ts  : \"(tag', \\<tau>, Unchecked) \\<in> set ts\"\n  shows \"\\<Xi> \\<turnstile> VSum tag v :v TSum (tagged_list_update tag' (\\<tau>, Checked) ts)\"\nproof -\n  from vval_tsum_ts\n  obtain \\<tau>1\n    where vval_elim_lemmas:\n      \"\\<Xi> \\<turnstile> v :v \\<tau>1\"\n      \"(tag, \\<tau>1, Unchecked) \\<in> set ts\"\n      \"distinct (map fst ts)\"\n      \"[] \\<turnstile> TSum ts wellformed\"\n    by force\n  then show ?thesis\n    using assms\n  proof (intro v_t_sum)\n    show \"(tag, \\<tau>1, Unchecked) \\<in> set (tagged_list_update tag' (\\<tau>, Checked) ts)\"\n      using vval_elim_lemmas tag_neq_tag' tagged_list_update_different_tag_preserves_values2\n      by metis\n  next\n    show \"[] \\<turnstile> TSum (tagged_list_update tag' (\\<tau>, Checked) ts) wellformed\"\n      using vval_elim_lemmas tag'_in_ts prod_in_set(1)\n      by (fastforce intro!: variant_tagged_list_update_wellformedI simp add: list_all_iff)\n  qed simp+\nqed\n\n\nlemma value_subtyping_to_wellformed:\n  \"K \\<turnstile> t \\<sqsubseteq> t'\n  \\<Longrightarrow> \\<Xi> \\<turnstile> v :v t\n  \\<Longrightarrow> K \\<turnstile> t' wellformed\"\n  by (metis instantiate_nothing kinding_iff_wellformed(1) list_all2_Nil substitutivity_single subtyping_wellformed_preservation(1) vval_typing_to_wellformed(1))\n\nlemma subtyping_record_cons_split:\n  \"K \\<turnstile> TRecord ((n,t1,b1) # ts1) s \\<sqsubseteq> TRecord ts2 s \\<Longrightarrow> \\<exists>t2 b2 ts2'. ts2 = (n,t2,b2) # ts2' \\<and>  (K \\<turnstile> t1 \\<sqsubseteq> t2) \\<and> (if K \\<turnstile> t1 :\\<kappa> {D} then b1 \\<le> b2 else b1 = b2)\"\nproof -\n  assume subty_rec: \"K \\<turnstile> TRecord ((n,t1,b1) # ts1) s \\<sqsubseteq> TRecord ts2 s\"\n  obtain xts1 where xts1_def: \"xts1 = ((n,t1,b1) # ts1)\" by auto\n  have elims:\n    \"map fst xts1 = map fst ts2\"\n    \"list_all2 (\\<lambda>p1 p2. K \\<turnstile> fst (snd p1) \\<sqsubseteq> fst (snd p2))  xts1 ts2\"\n    \"list_all2 (record_kind_subty K) xts1 ts2\"\n    using subty_rec subtyping.cases xts1_def\n    by fast+\n\n  obtain t2 b2 ts2' where ts2_def: \"ts2 = (n,t2,b2) # ts2'\"\n    using elims xts1_def\n    by (cases ts2, auto)\n\n  then show ?thesis\n    using elims xts1_def by force\nqed\n\nlemma subtyping_record_uncons: \"K \\<turnstile> TRecord (t1 # ts1) s \\<sqsubseteq> TRecord (t2 # ts2) s \\<Longrightarrow> K \\<turnstile> TRecord ts1 s \\<sqsubseteq> TRecord ts2 s\"\nproof -\n  assume subty_rec: \"K \\<turnstile> TRecord (t1 # ts1) s \\<sqsubseteq> TRecord (t2 # ts2) s\"\n  obtain xts1 where xts1_def: \"xts1 = (t1 # ts1)\" by auto\n  obtain xts2 where xts2_def: \"xts2 = (t2 # ts2)\" by auto\n  have elims:\n    \"map fst xts1 = map fst xts2\"\n    \"list_all2 (\\<lambda>p1 p2. K \\<turnstile> fst (snd p1) \\<sqsubseteq> fst (snd p2)) xts1 xts2\"\n    \"list_all2 (record_kind_subty K) xts1 xts2\"\n    using subty_rec subtyping.cases xts1_def xts2_def\n    by fast+\n  show \"K \\<turnstile> TRecord ts1 s \\<sqsubseteq> TRecord ts2 s\"\n    using xts1_def xts2_def subty_trecord elims by force\nqed\n\nlemma value_subtyping:\n  shows \"\\<Xi> \\<turnstile> v :v t \\<Longrightarrow>[] \\<turnstile> t \\<sqsubseteq> t' \\<Longrightarrow> \\<Xi> \\<turnstile> v :v t'\"\n    and \"\\<Xi> \\<turnstile>* vs :vr ts \\<Longrightarrow> [] \\<turnstile> TRecord ts s \\<sqsubseteq> TRecord ts' s \\<Longrightarrow>  \\<Xi> \\<turnstile>* vs :vr ts'\"\nproof (induct arbitrary: t' and ts' rule: vval_typing_vval_typing_record.inducts)\n  case (v_t_product \\<Xi> va ta vb tb)\n  obtain ta' tb' where elims:\n    \"t' = TProduct ta' tb'\"\n    \"[] \\<turnstile> ta \\<sqsubseteq> ta'\"\n    \"[] \\<turnstile> tb \\<sqsubseteq> tb'\"\n    using v_t_product by (auto elim: subtyping.cases intro: vval_typing_vval_typing_record.intros)\n  show ?case\n    using v_t_product elims by (simp add: vval_typing_vval_typing_record.intros)\nnext\n  case (v_t_sum \\<Xi> a ta n ts1)\n  obtain ts2 where elims:\n    \"t' = TSum ts2\"\n    \"list_all2 (\\<lambda>p1 p2. [] \\<turnstile> fst (snd p1) \\<sqsubseteq> fst (snd p2)) ts1 ts2\"\n    \"map fst ts1 = map fst ts2\"\n    \"list_all2 variant_kind_subty ts1 ts2\"\n    using v_t_sum(6)\n    by (auto elim: subtyping.cases intro: vval_typing_vval_typing_record.intros)\n\n  obtain i where n_in_ts_ix:\n    \"(n, ta, Unchecked) = ts1 ! i\"\n    \"i < length ts1\"\n    using v_t_sum\n    by (metis in_set_conv_nth)\n\n  obtain n' ta' ba' where n'_in_ts2: \"(n', ta', ba') = ts2 ! i\"\n    by (metis prod_cases3)\n\n  have sat_ts1_ts2: \"variant_kind_subty (ts1 ! i) (ts2 ! i)\"\n    using elims n_in_ts_ix n'_in_ts2 list_all2_nthD\n    by blast\n\n  have\n    \"n = n'\"\n    using n_in_ts_ix n'_in_ts2\n    by (metis elims(3) fst_conv length_map nth_map)\n\n  moreover have\n    \"[] \\<turnstile> ta \\<sqsubseteq> ta'\"\n    using n_in_ts_ix n'_in_ts2 elims\n    by (metis fst_conv list_all2_conv_all_nth snd_conv)\n\n  moreover have\n    \"ba' = Unchecked\"\n    using n_in_ts_ix n'_in_ts2 sat_ts1_ts2\n    by (metis less_eq_variant_state.elims(2) snd_conv)\n\n  ultimately show ?case\n    using v_t_sum elims n'_in_ts2 n_in_ts_ix subtyping_wellformed_preservation value_sem.v_t_sum value_sem_axioms\n    by (metis (no_types, lifting) in_set_conv_nth list_all2_lengthD)\nnext\n  case (v_t_record \\<Xi> fs ts s)\n  obtain ts' where elims:\n    \"t' = TRecord ts' s\"\n    \"distinct (map fst ts')\"\n    using v_t_record by (auto elim: subtyping.cases intro: vval_typing_vval_typing_record.intros)\n\n  have \"\\<Xi> \\<turnstile>* fs :vr ts'\"\n    using elims subty_trecord subtyping_simps(6) v_t_record by presburger\n\n  then show ?case\n    using v_t_record elims  vval_typing_vval_typing_record.intros\n    by blast\nnext\n  case (v_t_abstract a n ts \\<Xi> s)\n  have \"t' = TCon n ts s\"\n    using subtyping.cases v_t_abstract by fastforce\n  then show ?case\n    using v_t_abstract vval_typing_vval_typing_record.v_t_abstract by blast\nnext\n  case (v_t_afun \\<Xi> f ks ta tb ts tfun')\n  then obtain tx ux where \"t' = TFun tx ux\"\n    by (auto elim: subtyping.cases)\n  then show ?case\n    using v_t_afun by (meson subtyping_trans vval_typing_vval_typing_record.intros)\nnext\n  case (v_t_function \\<Xi> K t f u ts t')\n  then obtain tx ux where \"t' = TFun tx ux\"\n    by (auto elim: subtyping.cases)\n  then show ?case\n    using v_t_function by (meson subtyping_trans vval_typing_vval_typing_record.intros)\nnext\n  case (v_t_r_empty \\<Xi>)\n  have \"ts' = []\"\n    using v_t_r_empty by (auto elim: subtyping.cases)\n  then show ?case\n    by (auto elim: subtyping.cases intro: vval_typing_vval_typing_record.intros)\nnext\n  case (v_t_r_cons1 \\<Xi> x t1 xs ts n)\n\n  obtain t2 b2 ts2' where field_is: \"ts' = (n,t2,b2) # ts2'\"\n    \"([] \\<turnstile> t1 \\<sqsubseteq> t2)\"\n    \"(if [] \\<turnstile> t1 :\\<kappa> {D} then Present \\<le> b2 else Present = b2)\"\n    using subtyping_record_cons_split v_t_r_cons1 by blast\n\n  have field_rest: \"\\<Xi> \\<turnstile>* xs :vr ts2'\"\n    using v_t_r_cons1 field_is subtyping_record_uncons\n    by meson\n\n  then show ?case\n  proof (cases b2)\n    case Taken\n    then show ?thesis\n      using field_rest field_is v_t_r_cons1 vval_typing_vval_typing_record.v_t_r_cons2 value_subtyping_to_wellformed by metis\n  next case Present\n    then show ?thesis\n    using field_rest field_is v_t_r_cons1 vval_typing_vval_typing_record.v_t_r_cons1 by metis\n  qed\nnext\n  case (v_t_r_cons2 t1 \\<Xi> xs ts x n)\n\n  obtain t2 b2 ts2' where field_is: \"ts' = (n,t2,b2) # ts2'\"\n    \"([] \\<turnstile> t1 \\<sqsubseteq> t2)\"\n    \"(if [] \\<turnstile> t1 :\\<kappa> {D} then Taken \\<le> b2 else Taken = b2)\"\n    using subtyping_record_cons_split v_t_r_cons2 by blast\n\n  have field_rest: \"\\<Xi> \\<turnstile>* xs :vr ts2'\"\n    using v_t_r_cons2 field_is subtyping_record_uncons\n    by meson\n\n  have b2_is: \"b2 = Taken\"\n    using field_is less_eq_record_state.elims\n    by metis\n\n  then show ?case\n    using field_rest field_is b2_is v_t_r_cons2 vval_typing_vval_typing_record.v_t_r_cons2\n    by (metis subtyping_wellformed_preservation(1))\nqed (auto elim: subtyping.cases intro: vval_typing_vval_typing_record.intros)\n\n\nsubsection {* Introductions under instantiations *}\n\ntext {* An alternative introduction rule used for showing a value is a function under some type instantiation *}\n\nlemma v_t_afun_instantiate:\nassumes \"list_all2 (kinding K') ts K\"\nand     \"list_all2 (kinding []) \\<delta> K'\"\nand     \"K \\<turnstile> t wellformed\"\nand     \"K \\<turnstile> u wellformed\"\nand     \"\\<Xi> f = (K, t, u)\"\nshows   \"\\<Xi> \\<turnstile> VAFunction f (map (instantiate \\<delta>) ts) :v TFun (instantiate \\<delta> (instantiate ts t))\n                                                           (instantiate \\<delta> (instantiate ts u))\"\nproof -\n  from assms\n  have tfun_eq:\n      \"TFun (instantiate \\<delta> (instantiate ts t))\n             (instantiate \\<delta> (instantiate ts u))\n      = TFun (instantiate (map (instantiate \\<delta>) ts) t)\n             (instantiate (map (instantiate \\<delta>) ts) u)\"\n    by (force intro: instantiate_instantiate dest: list_all2_lengthD)\n\n  have tfun_sub:\n    \"[] \\<turnstile> TFun (instantiate (map (instantiate \\<delta>) ts) t) (instantiate (map (instantiate \\<delta>) ts) u)\n        \\<sqsubseteq> TFun (instantiate       \\<delta> (instantiate ts t)) (instantiate       \\<delta> (instantiate ts u))\"\n    using assms tfun_eq\n    by (metis (mono_tags, lifting) list_all2_substitutivity specialisation_subtyping subty_tfun subtyping_refl)\n\n  show ?thesis\n    using assms tfun_sub\n    by (meson list_all2_substitutivity type_wellformed.simps(4) type_wellformed_pretty_def v_t_afun)\nqed\n\nlemma v_t_function_instantiate:\n  assumes \"\\<Xi>, K, [Some t] \\<turnstile> f : u\"\n  and     \"K \\<turnstile> t wellformed\"\n  and     \"list_all2 (kinding []) \\<delta> K'\"\n  assumes \"list_all2 (kinding K') ts K\"\n  shows   \"\\<Xi> \\<turnstile> VFunction f (map (instantiate \\<delta>) ts) :v TFun (instantiate \\<delta> (instantiate ts t))\n                                                            (instantiate \\<delta> (instantiate ts u))\"\nproof -\nfrom assms have \"TFun (instantiate \\<delta> (instantiate ts t))\n                      (instantiate \\<delta> (instantiate ts u))\n               = TFun (instantiate (map (instantiate \\<delta>) ts) t)\n                      (instantiate (map (instantiate \\<delta>) ts) u)\"\n  by (force intro: instantiate_instantiate dest: list_all2_lengthD dest!: typing_to_wellformed)\n\n\n  then have tfun_sub:\n    \"[] \\<turnstile> TFun (instantiate (map (instantiate \\<delta>) ts) t) (instantiate (map (instantiate \\<delta>) ts) u)\n        \\<sqsubseteq> TFun (instantiate       \\<delta> (instantiate ts t)) (instantiate       \\<delta> (instantiate ts u))\"\n    using assms\n    by (metis (mono_tags, lifting) list_all2_substitutivity specialisation_subtyping subty_tfun subtyping_refl typing_to_wellformed(1))\n\n  then show ?thesis\n    using assms\n    by (meson list_all2_substitutivity type_wellformed.simps(4) type_wellformed_pretty_def v_t_function)\nqed\n\nsection {* matches lemmas *}\n\nsubsection {* matches + context manipulation *}\nlemma matches_split':\nassumes \"[] \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>1\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>2\"\nproof -\n  have \"\\<And>a x y z. [] \\<turnstile> x \\<leadsto> y \\<parallel> z \\<Longrightarrow> \\<forall>\\<tau>. x = Some \\<tau> \\<longrightarrow> \\<Xi> \\<turnstile> a :v \\<tau> \\<Longrightarrow> (\\<forall>\\<tau>. y = Some \\<tau> \\<longrightarrow> \\<Xi> \\<turnstile> a :v \\<tau>) \\<and> (\\<forall>\\<tau>. z = Some \\<tau> \\<longrightarrow> \\<Xi> \\<turnstile> a :v \\<tau>)\"\n    by (force simp add: split_comp.simps)\n  then show \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>1\" \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>2\"\n    using list_all3_product_over_list_all2\n      [where A=\"\\<lambda>x m. \\<forall>\\<tau>. m = Some \\<tau> \\<longrightarrow> \\<Xi> \\<turnstile> x :v \\<tau>\" and P=\"split_comp []\",\n              simplified matches_def[symmetric] split_def[symmetric]]\n    using assms by blast+\nqed\n\n\nlemma matches_split:\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>1)\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>2)\"\nusing assms by (auto intro: matches_split' instantiate_ctx_split)\n\n\nlemma matches_split2:\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\nshows   \"(\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>1)) \\<and> (\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>2))\"\nusing assms by (auto dest: matches_split)\n\n\nlemma matches_splitE:\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\nand     \"\\<lbrakk> \\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>1) ; \\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>2) \\<rbrakk> \\<Longrightarrow> P\"\nshows   \"P\"\nusing assms by (auto dest: matches_split2)\n\n\nlemma matches_split_bang':\nassumes \"split_bang [] vs \\<Gamma> \\<Gamma>1 \\<Gamma>2\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>1\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>2\"\n  using assms\nproof (induct arbitrary: \\<gamma> rule: split_bang.induct)\n  case split_bang_empty\n  case 1 then show ?case by simp\n  case 2 then show ?case by simp\nnext case split_bang_cons\n  note prems = this\n  case 1 with prems show ?case\n    by (auto\n        elim!: split_comp.cases split_bang_comp.cases\n        intro: vval_typing_bang\n        simp: matches_def list_all2_Cons2)\n  case 2 with prems show ?case\n    by (auto\n        elim!: split_comp.cases split_bang_comp.cases\n        simp: matches_def list_all2_Cons2)\nqed\n\n\nlemma matches_split_bang:\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"split_bang K vs \\<Gamma> \\<Gamma>1 \\<Gamma>2\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>1)\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>2)\"\nusing assms by (auto intro: matches_split_bang' instantiate_ctx_split_bang)\n\nlemma matches_weakening':\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nand     \"[] \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>'\"\nusing assms(2) [simplified weakening_def]\n  and assms(1) proof(induct  arbitrary: \\<gamma> rule: list_all2_induct)\n     case Nil  then show ?case by simp\nnext case Cons then show ?case by (force simp:  matches_def\n                                         iff:   list_all2_Cons2\n                                         elim!: weakening_comp.cases)\nqed\n\nlemma matches_weakening:\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"K \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'\"\nshows   \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>')\"\nusing assms by (auto dest: instantiate_ctx_weaken intro: matches_weakening')\n\nlemma matches_cons':\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nand     \"\\<Xi> \\<turnstile> x :v \\<tau>\"\nshows   \"\\<Xi> \\<turnstile> (x # \\<gamma>) matches (Some \\<tau> # \\<Gamma>)\"\nusing assms by (simp add: matches_def)\n\nlemma matches_cons:\nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"\\<Xi> \\<turnstile> x :v instantiate \\<tau>s \\<tau>\"\nshows   \"\\<Xi> \\<turnstile> (x # \\<gamma>) matches (instantiate_ctx \\<tau>s (Some \\<tau> # \\<Gamma>))\"\nusing assms by (auto intro: matches_cons')\n\nlemma matches_empty':\nshows \"\\<Xi> \\<turnstile> [] matches []\"\nby (simp add: matches_def)\n\nlemma matches_empty:\nshows \"\\<Xi> \\<turnstile> [] matches instantiate_ctx \\<tau>s []\"\nby (simp add: matches_empty' instantiate_ctx_def)\n\nsubsection {* other matches properties *}\n\nlemma matches_length:\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nshows   \"length \\<gamma> = length \\<Gamma>\"\nusing assms by (simp add: matches_def list_all2_lengthD)\n\nlemma matches_proj':\nassumes \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nand     \"i < length \\<Gamma>\"\nand     \"\\<Gamma> ! i = Some \\<tau>\"\nshows   \"\\<Xi> \\<turnstile> (\\<gamma> ! i) :v \\<tau>\"\nusing assms by (auto dest: list_all2_nthD2\n                     simp: matches_def\n                     intro: vval_typing_vval_typing_record.intros)\n\nlemma matches_proj:\nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"i < length \\<Gamma>\"\nand     \"\\<Gamma> ! i = Some \\<tau>\"\nshows   \"\\<Xi> \\<turnstile> (\\<gamma> ! i) :v instantiate \\<tau>s \\<tau>\"\nusing assms by (auto intro: matches_proj' simp: instantiate_ctx_def)\n\n\nsection {* procedure environment matches *}\nlemma proc_env_matches_abstract:\nassumes \"\\<xi> matches \\<Xi>\"\nand     \"\\<Xi> f = (K, \\<tau>i, \\<tau>o)\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi> \\<turnstile> v    :v instantiate \\<tau>s \\<tau>i\"\nand     \"\\<xi> f v v'\"\nshows   \"\\<Xi> \\<turnstile> v' :v instantiate \\<tau>s \\<tau>o\"\nusing assms by ( clarsimp simp: proc_env_matches_def\n               , drule_tac x = f in spec\n               , auto)\n\n\nsection {* Type Safety *}\n\ntheorem progress:\nassumes \"\\<Xi>, K, \\<Gamma> \\<turnstile> e : \\<tau>\"\nand     \"\\<xi> matches \\<Xi>\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nshows   \"\\<exists>! v. \\<xi>, \\<gamma> \\<turnstile> specialise \\<tau>s e \\<Down> v\"\noops\n\nlemma v_t_map_TPrimD:\n  \"\\<Xi> \\<turnstile>* vs :v map TPrim \\<tau>s\n    \\<Longrightarrow> \\<exists>lits. vs = map VPrim lits \\<and> map lit_type lits = \\<tau>s\"\n  unfolding vval_typing_all_def list_all2_map2\nproof (induct rule: list_all2_induct)\n  case (Cons x xs y ys)\n  obtain l where l_def: \"x = VPrim l\"\n    using Cons by (auto elim: vval_typing.cases subtyping.cases)\n\n  obtain lits where lits_def: \"xs = map VPrim lits \\<and> map lit_type lits = ys\"\n    using Cons by presburger\n\n  have \"x # xs = map VPrim (l # lits) \\<and> map lit_type (l # lits) = y # ys\"\n    using Cons l_def lits_def by (auto elim: vval_typing.cases)\n\n  then show ?case by meson\nqed auto\n\nlemma eval_prim_preservation:\nassumes \"prim_op_type p = (\\<tau>s, \\<tau>)\"\nand     \"\\<Xi> \\<turnstile>* vs :v map TPrim \\<tau>s\"\nshows   \"\\<Xi> \\<turnstile>  eval_prim p vs :v TPrim \\<tau>\"\nusing assms v_t_prim[where \\<Xi>=\\<Xi> and l=\"case eval_prim p vs of VPrim v \\<Rightarrow> v\"]\nby (clarsimp simp add: eval_prim_def o_def eval_prim_op_lit_type dest!: v_t_map_TPrimD)\n\ntheorem preservation:\nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"proc_ctx_wellformed \\<Xi>\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches (instantiate_ctx \\<tau>s \\<Gamma>)\"\nand     \"\\<xi> matches \\<Xi>\"\nshows   \"\\<lbrakk> \\<xi>, \\<gamma> \\<turnstile>  specialise \\<tau>s e \\<Down> v  ; \\<Xi>, K, \\<Gamma> \\<turnstile>  e  : \\<tau> \\<rbrakk> \\<Longrightarrow>  \\<Xi> \\<turnstile>  v  :v instantiate \\<tau>s \\<tau>\"\nand     \"\\<lbrakk> \\<xi>, \\<gamma> \\<turnstile>* map (specialise \\<tau>s) es \\<Down> vs ; \\<Xi>, K, \\<Gamma> \\<turnstile>* es : \\<tau>s' \\<rbrakk> \\<Longrightarrow> \\<Xi> \\<turnstile>* vs :v map (instantiate \\<tau>s) \\<tau>s'\"\nusing assms proof (induct \"specialise \\<tau>s e\"        v\n                      and \"map (specialise \\<tau>s) es\" vs\n                      arbitrary: e  \\<tau>s K \\<tau>   \\<Gamma>\n                             and es \\<tau>s K \\<tau>s' \\<Gamma>\n                      rule: v_sem_v_sem_all.inducts)\n     case v_sem_var     then show ?case by ( case_tac e, simp_all\n                                           , fastforce dest:  matches_weakening\n                                                       intro: matches_proj\n                                                       simp:  empty_length empty_def)\nnext case v_sem_lit     then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: vval_typing_vval_typing_record.intros)\nnext case v_sem_prim    then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: eval_prim_preservation)\nnext case v_sem_cast    then show ?case by ( case_tac e, simp_all\n                                           , fastforce elim!: upcast_valid_cast_to)\nnext case v_sem_afun    then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: v_t_afun_instantiate simp add: kinding_simps)\nnext case v_sem_fun     then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: v_t_function_instantiate)\nnext case (v_sem_con \\<xi> \\<gamma> x_spec x' ts_inst tag)\n  then show ?case\n  proof (cases e)\n    case (Con ts tag' x)\n\n    have typing_simps:\n      \"tag' = tag\"\n      \"ts_inst = map (\\<lambda>(c, t, b). (c, instantiate \\<tau>s t, b)) ts\"\n      \"x_spec = specialise \\<tau>s x\"\n      using v_sem_con.hyps Con\n      by clarsimp+\n\n    moreover then obtain t\n      where con_elims:\n        \"\\<tau> = TSum ts\"\n        \"\\<Xi>, K, \\<Gamma> \\<turnstile> x : t\"\n        \"distinct (map fst ts)\"\n        \"K \\<turnstile> TSum ts wellformed\"\n        \"(tag, t, Unchecked) \\<in> set ts\"\n      using Con v_sem_con.prems\n      by auto\n    ultimately have \"\\<Xi> \\<turnstile> VSum tag x' :v TSum (map (\\<lambda>(c, t, b). (c, instantiate \\<tau>s t, b)) ts)\"\n      using v_sem_con.hyps(2) v_sem_con.prems con_elims typing_simps\n    proof (intro v_t_sum)\n      show \"(tag, instantiate \\<tau>s t, Unchecked) \\<in> set (map (\\<lambda>(c, t, b). (c, instantiate \\<tau>s t, b)) ts)\"\n        using con_elims image_iff by fastforce\n    next\n      show \"[] \\<turnstile> TSum (map (\\<lambda>(c, t, b). (c, instantiate \\<tau>s t, b)) ts) wellformed\"\n        using con_elims v_sem_con.prems\n        by (metis instantiate.simps(6) kinding_iff_wellformed(1) substitutivity_single)\n    qed auto\n    then show ?thesis\n      using con_elims by auto\n  qed simp+\nnext case v_sem_member  then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: vval_typing_record_nth)\nnext case v_sem_unit    then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: vval_typing_vval_typing_record.intros)\nnext case v_sem_tuple   then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: matches_split\n                                                              vval_typing_vval_typing_record.intros)\nnext case v_sem_case_m  then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: matches_split\n                                                              matches_cons [simplified]\n                                                       dest:  distinct_fst)\nnext case (v_sem_case_nm \\<xi> \\<gamma> x tag' v tag n n' m)\n  from v_sem_case_nm.hyps(6)\n  show ?case\n  proof (case_tac e; clarsimp)\n    fix x1 x3 x4\n    assume e_is: \"e = Case x1 tag x3 x4\"\n      and x_is: \"x = specialise \\<tau>s x1\"\n      and m_is: \"m = specialise \\<tau>s x3\"\n      and n_is: \"n = specialise \\<tau>s x4\"\n\n    then obtain \\<Gamma>1 \\<Gamma>2 ts ta\n      where split\\<Gamma>: \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n      and typing_x1: \"\\<Xi>, K, \\<Gamma>1 \\<turnstile> x1 : TSum ts\"\n      and ta_in_ts: \"(tag, ta, Unchecked) \\<in> set ts\"\n      and typing_x3: \"\\<Xi>, K, Some ta # \\<Gamma>2 \\<turnstile> x3 : \\<tau>\"\n      and typing_x4: \"\\<Xi>, K, Some (TSum (tagged_list_update tag (ta, Checked) ts)) # \\<Gamma>2 \\<turnstile> x4 : \\<tau>\"\n      using v_sem_case_nm.prems\n      by fastforce\n\n    from split\\<Gamma>\n    have \\<gamma>_matches_\\<Gamma>1: \"\\<Xi> \\<turnstile> \\<gamma> matches instantiate_ctx \\<tau>s \\<Gamma>1\"\n      and \\<gamma>_matches_\\<Gamma>2: \"\\<Xi> \\<turnstile> \\<gamma> matches instantiate_ctx \\<tau>s \\<Gamma>2\"\n      using matches_split2 v_sem_case_nm.prems\n      by fastforce+\n\n    have \"\\<Xi> \\<turnstile> VSum tag' v :v instantiate \\<tau>s (TSum ts)\"\n      using x_is typing_x1 \\<gamma>_matches_\\<Gamma>1 v_sem_case_nm.hyps(2) v_sem_case_nm.prems\n      by fastforce\n    then have \"\\<Xi> \\<turnstile> VSum tag' v :v TSum (tagged_list_update tag (instantiate \\<tau>s ta, Checked) (map (\\<lambda>(c, t, b). (c, instantiate \\<tau>s t, b)) ts))\"\n      using v_sem_case_nm.hyps(3) image_iff ta_in_ts\n      by (fastforce intro!: sum_downcast)\n    then have \"\\<Xi> \\<turnstile> VSum tag' v :v instantiate \\<tau>s (TSum (tagged_list_update tag (ta, Checked) ts))\"\n      by (simp add: tagged_list_update_map_over2[where f=\"\\<lambda>(c, t, b). (c, instantiate \\<tau>s t, b)\" and g=\"\\<lambda>(t,b). (instantiate \\<tau>s t, b)\"] case_prod_beta)\n    then show \"\\<Xi> \\<turnstile> n' :v instantiate \\<tau>s \\<tau>\"\n      using v_sem_case_nm.prems v_sem_case_nm.hyps(5) \\<gamma>_matches_\\<Gamma>2 matches_cons\n        n_is typing_x4\n      by blast\n  qed\nnext\n  case (v_sem_esac \\<xi> \\<gamma> spec_a tag v)\n  then show ?case\n  proof (cases e)\n    case (Esac a)\n\n    have esac_simps: \"spec_a = specialise \\<tau>s a\"\n      using v_sem_esac.hyps Esac\n      by simp\n\n    then obtain ts' tag'\n      where esac_elims:\n        \"\\<Xi>, K, \\<Gamma> \\<turnstile> a : TSum ts'\"\n        \"[(tag', \\<tau>, Unchecked)] = filter ((=) Unchecked \\<circ> snd \\<circ> snd) ts'\"\n      using v_sem_esac.prems Esac\n      by blast\n\n    have \"\\<Xi> \\<turnstile> VSum tag v :v instantiate \\<tau>s (TSum ts')\"\n      using v_sem_esac.hyps(2) v_sem_esac.prems esac_simps esac_elims\n      by blast\n    then obtain \\<tau>'\n      where ih_elims:\n        \"\\<Xi> \\<turnstile> v :v instantiate \\<tau>s \\<tau>'\"\n        \"(tag, instantiate \\<tau>s \\<tau>', Unchecked) \\<in> set (map (\\<lambda>(c, t, b). (c, instantiate \\<tau>s t, b)) ts')\"\n        \"distinct (map fst ts')\"\n        \"[] \\<turnstile> instantiate \\<tau>s (TSum ts') wellformed\"\n      by (force simp add: kinding_simps)\n    then have \"(tag, instantiate \\<tau>s \\<tau>', Unchecked) = (tag', instantiate \\<tau>s \\<tau>, Unchecked)\"\n      using esac_elims ih_elims by (fastforce simp add: filter_eq_singleton_iff2)\n    then show \"\\<Xi> \\<turnstile> v :v instantiate \\<tau>s \\<tau>\"\n      using ih_elims by simp\n  qed clarsimp+\nnext case v_sem_let     then show ?case by ( case_tac e, simp_all\n                                           , fastforce dest:   matches_split\n                                                       intro!: matches_cons [simplified])\nnext case v_sem_letbang then show ?case by ( case_tac e, simp_all\n                                           , fastforce dest:   matches_split_bang\n                                                       intro!: matches_cons [simplified])\nnext case v_sem_if      then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro:  matches_split\n                                                       split:  if_splits)\nnext case v_sem_struct  then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro: vval_typing_vval_typing_record.intros\n                                                              vval_typing_all_record [ where ts = \"map f ts\" for f ts\n                                                                                     , simplified])\nnext\n  case (v_sem_take \\<xi> \\<gamma> spec_x fs f' spec_y e')\n  then show ?case\n  proof (cases e)\n    case (Take x f y)\n    then have spec_simps:\n      \"spec_x = specialise \\<tau>s x\"\n      \"f' = f\"\n      \"spec_y = specialise \\<tau>s y\"\n      using v_sem_take(5) Take by simp+\n    \n    obtain \\<Gamma>1 \\<Gamma>2 ts s n t k taken\n      where typing_elims:\n        \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n        \"\\<Xi>, K, \\<Gamma>1 \\<turnstile> x : TRecord ts s\"\n        \"sigil_perm s \\<noteq> Some ReadOnly\"\n        \"f < length ts\"\n        \"ts ! f = (n, t, Present)\"\n        \"K \\<turnstile> t :\\<kappa> k\"\n        \"S \\<in> k \\<or> taken = Taken\"\n        \"\\<Xi>, K, Some t # Some (TRecord (ts[f := (n, t, taken)]) s) # \\<Gamma>2 \\<turnstile> y : \\<tau>\"\n      using v_sem_take.prems(1) spec_simps Take\n      by blast\n    then have matchsplit_lemmas:\n      \"\\<Xi> \\<turnstile> \\<gamma> matches instantiate_ctx \\<tau>s \\<Gamma>1\"\n      \"\\<Xi> \\<turnstile> \\<gamma> matches instantiate_ctx \\<tau>s \\<Gamma>2\"\n      using matches_split2 v_sem_take.prems\n      by blast+\n    \n    have \"\\<Xi> \\<turnstile> VRecord fs :v instantiate \\<tau>s (TRecord ts s)\"\n      using v_sem_take.prems spec_simps typing_elims matchsplit_lemmas\n      by (fastforce intro!: v_sem_take.hyps(2))\n    moreover then have all_inst_ts:\n      \"\\<Xi> \\<turnstile>* fs :vr map (\\<lambda>(n, t, b). (n, instantiate \\<tau>s t, b)) ts\"\n      \"distinct (map fst ts)\"\n      by (fastforce)+\n    moreover then have \"\\<And>t' b'. distinct (map fst (ts[f := (n, t', b')]))\"\n      by (simp add: map_fst_update typing_elims)\n    ultimately have \"\\<Xi> \\<turnstile> VRecord fs :v TRecord (map (\\<lambda>(n, t, b). (n, instantiate \\<tau>s t, b)) (ts[f := (n, t, taken)])) s\"\n      using typing_elims v_sem_take.prems\n      by (fastforce simp add: map_update intro: substitutivity vval_typing_vval_typing_record.intros vval_typing_record_take)\n    then show ?thesis\n      using v_sem_take.prems matchsplit_lemmas typing_elims spec_simps all_inst_ts\n      by (fastforce intro!: v_sem_take.hyps(4) simp add: matches_Cons vval_typing_record_nth)\n  qed simp+\nnext\n  case (v_sem_put \\<xi> \\<gamma> x_spec fs ea_spec ea' f)\n  \n  then show ?case\n  proof (case_tac e; clarsimp)\n    fix x ea\n    assume assms1:\n      \"e = Put x f ea\"\n      \"x_spec = specialise \\<tau>s x\"\n      \"ea_spec = specialise \\<tau>s ea\"\n    then obtain \\<Gamma>1 \\<Gamma>2 ts s n t taken k\n      where typingelims:\n        \"\\<tau> = TRecord (ts[f := (n, t, Present)]) s\"\n        \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n        \"\\<Xi>, K, \\<Gamma>1 \\<turnstile> x : TRecord ts s\"\n        \"sigil_perm s \\<noteq> Some ReadOnly\"\n        \"f < length ts\"\n        \"ts ! f = (n, t, taken)\"\n        \"K \\<turnstile> t :\\<kappa> k\"\n        \"D \\<in> k \\<or> taken = Taken\"\n        \"\\<Xi>, K, \\<Gamma>2 \\<turnstile> ea : t\"\n      using v_sem_put by blast\n    \n    have IHresults:\n      \"\\<Xi> \\<turnstile> VRecord fs :v instantiate \\<tau>s (TRecord ts s)\"\n      \"\\<Xi> \\<turnstile> ea' :v instantiate \\<tau>s t\"\n      using v_sem_put.prems assms1 typingelims matches_split\n      by (fast intro: v_sem_put.hyps(2,4))+\n    then obtain ts' s'\n      where instvrecordelims:\n        \"instantiate \\<tau>s (TRecord ts s) = TRecord ts' s'\"\n        \"\\<Xi> \\<turnstile>* fs :vr ts'\"\n        \"distinct (map fst ts')\"\n      by blast\n\n    show \"\\<Xi> \\<turnstile> VRecord (fs[f := ea']) :v instantiate \\<tau>s \\<tau>\"\n      using v_sem_put assms1 typingelims IHresults instvrecordelims\n    proof (simp add: map_update, intro vval_typing_vval_typing_record.intros vval_typing_record_put)\n      show \"[] \\<turnstile> instantiate \\<tau>s t :\\<kappa> k\"\n        using v_sem_put.prems typingelims\n        by (blast intro: substitutivity)\n    next\n      show \"ts' ! f = (n, instantiate \\<tau>s t, taken)\"\n        using instvrecordelims typingelims by fastforce\n      then show \"distinct (map fst (ts'[f := (n, instantiate \\<tau>s t, Present)]))\"\n        using instvrecordelims typingelims\n        by (fastforce simp add: map_fst_update)\n    qed simp+\n  qed\nnext case v_sem_split   then show ?case by ( case_tac e, simp_all\n                                           , fastforce intro!: matches_cons\n                                                       intro:  matches_split)\nnext case (v_sem_app \\<xi> \\<gamma> x ea ts y a r e \\<tau>s K \\<tau> \\<Gamma>)\n  obtain efun earg where e_def: \"e = App efun earg\"\n      \"x = specialise \\<tau>s efun\"\n      \"y = specialise \\<tau>s earg\"\n    using v_sem_app by (cases e, auto)\n\n  obtain \\<Gamma>1 \\<Gamma>2 targ where app_elims:\n    \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n    \"\\<Xi>, K, \\<Gamma>1 \\<turnstile> efun : TFun targ \\<tau>\"\n    \"\\<Xi>, K, \\<Gamma>2 \\<turnstile> earg : targ\"\n    using v_sem_app e_def by blast\n\n  have vfun_ty: \"\\<Xi> \\<turnstile> VFunction ea ts :v instantiate \\<tau>s (TFun targ \\<tau>)\"\n    using app_elims e_def v_sem_app matches_split\n    by fast\n\n  have varg_ty: \"\\<Xi> \\<turnstile> a :v instantiate \\<tau>s targ\"\n    using app_elims e_def v_sem_app matches_split\n    by fast\n\n  obtain Kfun t u where vfun_ty_elims: \"\\<Xi>, Kfun, [Some t] \\<turnstile> ea : u\"\n       \"type_wellformed (length Kfun) t\"\n       \"list_all2 (kinding []) ts Kfun\"\n       \"[] \\<turnstile> TFun (instantiate ts t) (instantiate ts u) \\<sqsubseteq> TFun (instantiate \\<tau>s targ) (instantiate \\<tau>s \\<tau>)\"\n    using vfun_ty by (auto elim: vval_typing.cases)\n\n  have vres_ty_sub: \"\\<Xi> \\<turnstile> r :v instantiate ts u\"\n    using vfun_ty_elims v_sem_app(6)\n    using matches_cons' matches_empty subtyping_simps(4) v_sem_app.prems(3) v_sem_app.prems(5) value_subtyping(1) varg_ty by fastforce\n\n  show ?case\n    using app_elims e_def v_sem_app vfun_ty_elims vres_ty_sub\n    by (metis subtyping_simps(4) value_subtyping(1))\n\nnext case (v_sem_abs_app \\<xi> \\<gamma> x f ts y a r)\n  obtain efun earg where e_def: \"e = App efun earg\"\n      \"x = specialise \\<tau>s efun\"\n      \"y = specialise \\<tau>s earg\"\n    using v_sem_abs_app by (cases e, auto)\n\n  obtain \\<Gamma>1 \\<Gamma>2 targ where app_elims:\n    \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n    \"\\<Xi>, K, \\<Gamma>1 \\<turnstile> efun : TFun targ \\<tau>\"\n    \"\\<Xi>, K, \\<Gamma>2 \\<turnstile> earg : targ\"\n    using v_sem_abs_app e_def by blast\n\n  have vafun_ty: \"\\<Xi> \\<turnstile> VAFunction f ts :v instantiate \\<tau>s (TFun targ \\<tau>)\"\n    using app_elims e_def v_sem_abs_app matches_split\n    by fast\n\n  have varg_ty: \"\\<Xi> \\<turnstile> a :v instantiate \\<tau>s targ\"\n    using app_elims e_def v_sem_abs_app matches_split\n    by fast\n\n  obtain ks t u t' u' where vafun_ty_elims:\n      \"instantiate \\<tau>s (TFun targ \\<tau>) = TFun t' u'\"\n      \"\\<Xi> f = (ks, t, u)\"\n      \"list_all2 (kinding []) ts ks\"\n      \"ks \\<turnstile> TFun t u wellformed\"\n      \"[] \\<turnstile> TFun (instantiate ts t) (instantiate ts u) \\<sqsubseteq> TFun t' u'\"\n    using vafun_ty by (auto elim: vval_typing.cases)\n\n  have vres_ty_sub: \"\\<Xi> \\<turnstile> r :v instantiate ts u\"\n    using vafun_ty_elims varg_ty v_sem_abs_app\n    using subtyping_simps(4) value_subtyping(1)  instantiate.simps(4) proc_env_matches_abstract\n    by metis\n\n  show ?case\n    using app_elims e_def v_sem_abs_app vafun_ty_elims vres_ty_sub\n    by (metis instantiate.simps(4) subtyping_simps(4) value_subtyping(1))\n\nnext case v_sem_all_empty then show ?case by ( case_tac es, simp_all\n                                             , fastforce simp: vval_typing_all_def)\nnext case v_sem_all_cons  then show ?case by ( case_tac es, simp_all\n                                             , fastforce simp: vval_typing_all_def\n                                                         dest: matches_split)\nnext\n  case (v_sem_promote \\<Xi> \\<xi> \\<gamma> ea ea' t)\n  then show ?case\n    using value_subtyping(1) specialisation(1) typing_promoteE instantiate_ctx_nothing instantiate_nothing list.ctr_transfer(1) specialise_nothing\n    by (metis)\nqed\n\n(* TODO:\n    - A-normal.\n*)\n\nlemma order_sum_list: \"x \\<in> set es \\<Longrightarrow> x < Suc (sum_list es)\"\n  by (simp add: le_imp_less_Suc member_le_sum_list)\n\nfunction monoexpr :: \"'f expr \\<Rightarrow> ('f \\<times> type list) expr\" where\n  \"monoexpr (AFun f ts)       = AFun (f, ts) []\"\n| \"monoexpr (Fun f ts)        = Fun (monoexpr (specialise ts f)) []\"\n| \"monoexpr (Var i)           = Var i\"\n| \"monoexpr (Prim p es)       = Prim p (map (monoexpr) es)\"\n| \"monoexpr (App a b)         = App (monoexpr a) (monoexpr b)\"\n| \"monoexpr (Con as t e)      = Con as t (monoexpr e)\"\n| \"monoexpr (Struct ts vs)    = Struct ts (map (monoexpr) vs)\"\n| \"monoexpr (Member v f)      = Member (monoexpr v) f\"\n| \"monoexpr (Unit)            = Unit\"\n| \"monoexpr (Cast t e)        = Cast t (monoexpr e)\"\n| \"monoexpr (Lit v)           = Lit v\"\n| \"monoexpr (SLit v)          = SLit v\"\n| \"monoexpr (Tuple a b)       = Tuple (monoexpr a) (monoexpr b)\"\n| \"monoexpr (Put e f e')      = Put (monoexpr e) f (monoexpr e')\"\n| \"monoexpr (Let e e')        = Let (monoexpr e) (monoexpr e')\"\n| \"monoexpr (LetBang vs e e') = LetBang vs (monoexpr e) (monoexpr e')\"\n| \"monoexpr (Case e t a b)    = Case (monoexpr e) t (monoexpr a) (monoexpr b)\"\n| \"monoexpr (Esac e t)        = Esac (monoexpr e) t\"\n| \"monoexpr (If c t e)        = If (monoexpr c) (monoexpr t) (monoexpr e)\"\n| \"monoexpr (Take e f e')     = Take (monoexpr e) f (monoexpr e')\"\n| \"monoexpr (Split v va)      = Split (monoexpr v) (monoexpr va)\"\n| \"monoexpr (Promote t x)     = Promote t (monoexpr x)\"\n\n             by (case_tac x, auto)\ntermination by (relation \"measure expr_size\", (simp add: order_sum_list)+)\n\nfun monoval :: \"('f, 'a) vval \\<Rightarrow> ('f \\<times> type list, 'a) vval\"\nwhere \"monoval (VPrim lit) = VPrim lit\"\n    | \"monoval (VProduct t u) = VProduct (monoval t) (monoval u)\"\n    | \"monoval (VSum name v) = VSum name (monoval v)\"\n    | \"monoval (VRecord vs) = VRecord (map monoval vs)\"\n    | \"monoval (VAbstract t) = VAbstract t\"\n    | \"monoval (VAFunction f ts) = VAFunction (f, ts) []\"\n    | \"monoval (VFunction f ts) = VFunction (monoexpr (specialise ts f)) []\"\n    | \"monoval VUnit = VUnit\"\n\n\ndefinition monoprog :: \"('f, 'a) vabsfuns \\<Rightarrow> (('f \\<times> type list), 'a) vabsfuns \\<Rightarrow> bool\"\nwhere \"monoprog \\<xi> \\<xi>' \\<equiv> \\<forall>f \\<tau>s. (\\<forall>v v'. \\<xi> f v v' \\<longleftrightarrow> \\<xi>' (f, \\<tau>s) (monoval v) (monoval v'))\"\n\nlemma member_nth_map: \"f < length fs \\<Longrightarrow> \\<xi>', map monoval \\<gamma> \\<turnstile> Member (monoexpr e) f \\<Down> monoval (fs ! f) =  \\<xi>' , map monoval \\<gamma> \\<turnstile> Member (monoexpr e) f \\<Down> (map monoval fs) ! f\"\nby (subst nth_map, simp_all)\nthm v_sem_prim\n\nlemma v_sem_prim': \"\\<xi> , \\<gamma> \\<turnstile>* as \\<Down> as' \\<Longrightarrow> eval_prim p as' = r \\<Longrightarrow> \\<xi> , \\<gamma> \\<turnstile> Prim p as \\<Down> r\"\nby (force dest: sym intro: v_sem_prim)\n\nlemma monoval_vprim [simp]: \"monoval \\<circ> VPrim = VPrim\" by (rule ext, simp)\n\nlemma mono_correct:\nassumes \"\\<xi> matches \\<Xi>\"\nand     \"proc_ctx_wellformed \\<Xi>\"\nand     \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>\"\nand     \"monoprog \\<xi> \\<xi>'\"\nshows   \"\\<xi>, \\<gamma> \\<turnstile> e \\<Down> e' \\<Longrightarrow>  \\<Xi>, [], \\<Gamma> \\<turnstile> e : \\<tau>    \\<Longrightarrow> \\<xi>', map monoval \\<gamma> \\<turnstile> monoexpr e \\<Down> monoval e'\"\n and     \"\\<xi>, \\<gamma> \\<turnstile>* es \\<Down> es' \\<Longrightarrow> \\<Xi>, [], \\<Gamma> \\<turnstile>* es : \\<tau>s \\<Longrightarrow> \\<xi>', map monoval \\<gamma> \\<turnstile>* map monoexpr es \\<Down> map monoval es'\"\nusing assms proof (induct \\<xi> \\<gamma> e e'\n                      and \\<xi> \\<gamma> es es'\n               arbitrary: \\<tau> \\<Gamma>\n                      and \\<tau>s \\<Gamma>\n                    rule: v_sem_v_sem_all.inducts)\n  case (v_sem_app \\<xi> \\<gamma> x e ts y a r)\nnote IH1 = this(2)\nand  IH2 = this(4)\nand  IH3 = this(6)\nand  rest = this(1,3,5,7-)\n  then show ?case\n  apply (clarsimp)\n  apply (erule typing_appE)\n  apply (rule, erule(5) IH1 [OF _ _ _ matches_split'(1), simplified], erule(5) IH2 [OF _ _ _ matches_split'(2), simplified])\n  apply (simp)\n  apply (frule(5) preservation(1) [where \\<tau>s = \"[]\" and K = \"[]\", OF _ _ matches_split'(1), simplified])\n    apply (frule(5) preservation(1) [where \\<tau>s = \"[]\" and K = \"[]\", OF _ _ matches_split'(2), simplified])\n\n\n    apply (erule v_t_funE)\n    apply (rule_tac V=\"\\<Xi> \\<turnstile> a :v instantiate ts t\" in revcut_rl)\n      apply (rule value_subtyping)\n       apply assumption\n      apply (auto elim: subtyping.cases)\n    apply (rule IH3[simplified])\n    apply (auto intro: specialisation\n              simp:  matches_def instantiate_ctx_def)\ndone\nnext case v_sem_abs_app\nnote IH1  = this(2)\nand  IH2  = this(4)\nand  rest = this(1,3,5-)\nthen show ?case\n  apply (clarsimp)\n  apply (erule typing_appE)\n  apply (rule v_sem_v_sem_all.v_sem_abs_app, erule(5) IH1 [OF _ _ _ matches_split'(1), simplified], erule(5) IH2 [OF _ _ _ matches_split'(2), simplified])\n  apply (simp add: monoprog_def)\ndone\nnext case v_sem_var then show ?case by (simp, metis matches_length nth_map typing_varE v_sem_v_sem_all.v_sem_var)\nnext case v_sem_lit then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_lit)\nnext case v_sem_fun then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_fun)\nnext case v_sem_afun then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_afun)\nnext case v_sem_cast then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_cast)\nnext case v_sem_con then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_con)\nnext case v_sem_unit then show ?case by (simp add: v_sem_v_sem_all.v_sem_unit)\nnext case v_sem_tuple then show ?case by (clarsimp elim!: typing_tupleE simp: matches_split' v_sem_v_sem_all.v_sem_tuple)\nnext case v_sem_esac then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_esac)\nnext case (v_sem_take \\<xi> \\<gamma> x fs f e e')\n  obtain \\<Gamma>1 \\<Gamma>2 ts s n t k taken\n    where takeelims:\n      \"[] \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\"\n      \"\\<Xi>, [], \\<Gamma>1 \\<turnstile> x : TRecord ts s\"\n      \"sigil_perm s \\<noteq> Some ReadOnly\"\n      \"f < length ts\"\n      \"ts ! f = (n, t, Present)\"\n      \"[] \\<turnstile> t :\\<kappa> k\"\n      \"S \\<in> k \\<or> taken = Taken\"\n      \"\\<Xi>, [], Some t # Some (TRecord (ts[f := (n, t, taken)]) s) # \\<Gamma>2 \\<turnstile> e : \\<tau>\"\n    using v_sem_take.prems typing_takeE\n    by blast\n\n  have submatches:\n    \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>1\"\n    \"\\<Xi> \\<turnstile> \\<gamma> matches \\<Gamma>2\"\n    using matches_split' takeelims v_sem_take.prems\n    by blast+\n\n  have ts_v_sem_lemmas:\n    \"\\<Xi> \\<turnstile>* fs :vr ts\"\n    \"distinct (map fst ts)\"\n    using preservation[where \\<tau>s=\"[]\" and K=\"[]\", simplified] submatches takeelims v_sem_take\n    by blast+\n\n  have \"\\<Xi> \\<turnstile> VRecord fs :v TRecord (ts[f := (n, t, taken)]) s\"\n    using takeelims ts_v_sem_lemmas\n    by (fastforce intro: vval_typing_vval_typing_record.intros vval_typing_record_take simp add: map_fst_update)\n  moreover have \"\\<Xi> \\<turnstile> fs ! f :v t\"\n    using takeelims ts_v_sem_lemmas vval_typing_record_nth by blast\n  ultimately have \"\\<xi>' , map monoval fs ! f # VRecord (map monoval fs) # map monoval \\<gamma> \\<turnstile> monoexpr e \\<Down> monoval e'\"\n    using v_sem_take.prems takeelims submatches ts_v_sem_lemmas vval_typing_record_take\n    by (force dest!: v_sem_take.hyps(4) intro!: matches_cons' simp add: vval_typing_record_length)\n  then show ?case\n    using v_sem_take takeelims submatches\n    by (auto intro!: v_sem_v_sem_all.intros)\nnext case v_sem_all_empty then show ?case by (simp add: v_sem_v_sem_all.v_sem_all_empty)\nnext case v_sem_all_cons then show ?case by (auto elim!: typing_all_consE dest: matches_split' intro!: v_sem_v_sem_all.intros)\nnext case v_sem_split\nnote IH1 = this(2)\nand  IH2 = this(4)\nand rest = this(1,3,5-)\nfrom rest show ?case\n  apply (clarsimp elim!: typing_splitE)\n  apply (frule(1) matches_split'(1))\n  apply (frule(1) matches_split'(2))\n  apply (rule v_sem_v_sem_all.v_sem_split)\n   apply (frule(5) IH1[simplified])\n   apply (force dest: preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified, rotated -3]\n                      IH2\n                simp: matches_def\n                elim: v_t_productE)\ndone\nnext case v_sem_member then show ?case\n  apply (clarsimp elim!: typing_memberE)\n  apply (subst member_nth_map\n        , (force dest:preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified] elim!: v_t_recordE dest: vval_typing_record_length intro: v_sem_v_sem_all.intros)+\n        )\ndone\nnext case v_sem_prim\nnote IH = this(2)\nand rest = this(1,3-)\nfrom rest show ?case\n  apply (clarsimp elim!: typing_primE)\n  apply (frule(4) preservation(2) [where \\<tau>s = \"[]\" and K = \"[]\", simplified])\n  apply (frule v_t_map_TPrimD)\n  apply (clarsimp)\n  apply (frule eval_prim_preservation)\n  apply (simp)\n  apply (erule vval_typing.cases, simp_all)\n  apply (rule v_sem_prim')\n  apply (clarsimp)\n  apply (erule(4) IH)\n    apply (force intro: eval_prim_type_change)\ndone\nnext case v_sem_struct then show ?case by (fastforce intro!: v_sem_v_sem_all.v_sem_struct)\nnext case v_sem_case_m then show ?case\n    apply (clarsimp elim!: typing_caseE)\n    apply (frule(1) matches_split'(1))\n    apply (frule(1) matches_split'(2))\n    apply (rule v_sem_v_sem_all.intros, fastforce)\n    apply (frule(4) preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified, rotated -3])\n    apply (erule v_t_sumE', simp)\n    apply (metis Pair_inject distinct_fst matches_cons')\n    done\nnext case v_sem_case_nm\nnote IH1 = this(2)\nand  IH2 = this(5)\nand rest = this(1,3-4,6-)\nfrom rest show ?case\n  apply (clarsimp elim!: typing_caseE)\n  apply (frule(1) matches_split'(1))\n  apply (frule(1) matches_split'(2))\n  apply (rule v_sem_v_sem_all.intros, frule(6) IH1[simplified])\n  apply (frule(3) IH2[OF _ _ _ matches_cons', simplified])\n  apply simp_all\n  apply (force intro: sum_downcast dest: preservation[where \\<tau>s = \"[]\" and K = \"[]\", simplified])\n  done\nnext case v_sem_let\nnote IH1 = this(2)\nand  IH2 = this(4)\nand rest = this(1,3,5-)\nfrom rest show ?case\n  apply (clarsimp elim!: typing_letE)\n  apply (frule(1) matches_split'(1))\n  apply (frule(1) matches_split'(2))\n  apply (frule(4) preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified])\n  apply (erule(4) v_sem_v_sem_all.v_sem_let [OF IH1])\n  apply (frule(5) IH2 [OF _ _ _ matches_cons', simplified])\n  apply simp\ndone\nnext case v_sem_letbang\nnote IH1 = this(2)\nand  IH2 = this(4)\nand rest = this(1,3,5-)\nfrom rest show ?case\n  apply (clarsimp elim!: typing_letbE)\n  apply (frule(1) matches_split_bang'(1))\n  apply (frule(1) matches_split_bang'(2))\n  apply (frule(4) preservation [where \\<tau>s = \"[]\" and K = \"[]\", simplified])\n  apply (erule(4) v_sem_v_sem_all.v_sem_letbang [OF IH1])\n  apply (frule(5) IH2 [OF _ _ _ matches_cons', simplified])\n  apply simp\ndone\nnext case v_sem_if then show ?case by (fastforce elim!: typing_ifE dest: matches_split' intro!: v_sem_v_sem_all.v_sem_if)\nnext case v_sem_put then show ?case\n  apply (clarsimp elim!: typing_putE)\n  apply (frule(1) matches_split'(1))\n  apply (frule(1) matches_split'(2))\n  apply (fastforce simp: map_update intro: v_sem_v_sem_all.v_sem_put)\n    done\nnext case (v_sem_promote \\<xi> \\<gamma> e e' t e'' t')\n  have eval_orig: \"\\<xi>' , map monoval \\<gamma> \\<turnstile> monoexpr e \\<Down> monoval e'\"\n    using v_sem_promote.hyps(2) v_sem_promote.prems(1) v_sem_promote.prems(2) v_sem_promote.prems(3) v_sem_promote.prems(4) v_sem_promote.prems(5) by auto\n  then show ?case\n    apply (clarsimp)\n    apply (rule v_sem_v_sem_all.v_sem_promote[where e' = \"monoval _\"])\n    using eval_orig by assumption\nqed\n\nend\n\nend\n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/cogent/isa/ValueSemantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3106163408055177}}
{"text": "theory NP4_Simple_Action_Values\n  imports\n  NP4_Simple_Action_Syntax\n  \"~~/src/HOL/Word/Word\"\n  \"~~/src/HOL/Word/Word_Bitwise\"\n(*  These files contain a minimalistic semantics of P4's action constructs. More complex concepts\n    like switch statements are left out. The purpose of this verification effort is to showcase\n    the viability of using Isabelle/HOL to verify P4 applications. These files focus on the\n    action constructs.\n\n    P4 actions are the code fragments that can read and write data being processed. The action\n    constructs are where sequential code resides in P4. To this end the action constructs are the\n    main way by which the control-plane can influence the behaviour of the data-plane.\n\n    To this end these files define a small-step semantics of the P4 actions. Then a typing\n    environment is built upon this, and the statements are extended with a termination-counter.\n    These are used to prove properties like termination, determinism, progression,\n    preservation, and more. The semantics can also be used to analyse reachability properties.\n    Well-defined and well-typed P4 programs will yield a derivation tree, where as ill-defined\n    or ill-typed P4 programs will yield no such tree. *)\nbegin\n\n(* ============================================================================================================== *)\n(*                                              VALUE MAPPINGS                                                    *)\n(* ============================================================================================================== *)\n\n(* Contains the value of a single bit, can be cast between bool *)\ndatatype sbit = ZERO | ONE\n\n(* Mapping to concrete value *)\ndatatype val = SBIT sbit\n  | UINT nat\n  | SINT int\n  | IINT int\n  | VINT nat\n  | BOOL bool\n  | STRING string\n  | ERROR \"identifier list\"\n  | MATCH \"identifier list\"\n\n(* State is a mapping from variable names to values *)\ntype_synonym state = \"vname \\<Rightarrow> val\"\n\n(* ============================================================================================================== *)\n(*                                              HELPER FUNCTIONS                                                  *)\n(* ============================================================================================================== *)\n\n(* Convert a basetype to a concrete value used for converting the entries of derived types. *)\nfun baseToVal :: \"baseType \\<Rightarrow> val\" where\n    \"baseToVal (BBOOL b)       = (BOOL b)\"\n  | \"baseToVal (BSBIT 0)       = (SBIT ZERO)\"\n  | \"baseToVal (BSBIT (Suc n)) = (SBIT ONE)\"\n  | \"baseToVal (BIINT n)       = (IINT n)\"\n  | \"baseToVal (BUINT n)       = (UINT n)\"\n  | \"baseToVal (BSINT n)       = (SINT n)\"\n  | \"baseToVal (BVINT n)       = (VINT n)\"\n  | \"baseToVal (BERROR e)      = (ERROR e)\"\n  | \"baseToVal (BMATCH m)      = (MATCH m)\"\n  | \"baseToVal (BSTRING s)     = (STRING s)\"\n\n(* ============================================================================================================== *)\n(*                                   CONCRETE VALUE EVALUATION FUNCTIONS                                          *)\n(* ============================================================================================================== *)\n\ninductive eval :: \"expression \\<Rightarrow> state \\<Rightarrow> val \\<Rightarrow> bool\" where\n(* =============== Base types =============== *)\n    RBOOL:    \"eval (BASE (BBOOL b))      s (BOOL b)\"\n  | RBIT0:    \"eval (BASE (BSBIT 0))       s (SBIT ZERO)\"\n  | RBIT1:    \"eval (BASE (BSBIT (Suc n))) s (SBIT ONE)\"\n  | RIINT:    \"eval (BASE (BIINT n))      s (IINT n)\"\n  | RUINT:    \"eval (BASE (BUINT n))      s (UINT n)\"\n  | RSINT:    \"eval (BASE (BSINT n))      s (SINT n)\"\n  | RVINT:    \"eval (BASE (BVINT n))      s (VINT n)\"\n  | RERROR:   \"eval (BASE (BERROR e))     s (ERROR e)\"\n  | RMATCH:   \"eval (BASE (BMATCH m))     s (MATCH m)\"\n  | RSTRING:  \"eval (BASE (BSTRING str))  s (STRING str)\"\n(* =============== Miscellaneous expressions =============== *)\n  | TERNTRUE:  \"eval e1 s (BOOL b) \\<Longrightarrow> b = True \\<Longrightarrow> eval e2 s v \\<Longrightarrow> eval (TernExpr e1 e2 e3) s v\"\n  | TERNFALSE: \"eval e1 s (BOOL b) \\<Longrightarrow> b = False \\<Longrightarrow> eval e3 s v \\<Longrightarrow> eval (TernExpr e1 e2 e3) s v\"\n(* =============== Variable mapping  =============== *)\n  | NAMEDVAR: \"eval (NamedVar varName) s (s varName)\"\n(* =============== Operations that yield a single bit (SBIT)  =============== *)\n          (* Empty for now *)\n(* =============== Operations that yield a boolean (BOOL)  =============== *)\n  | ULNEB: \"eval e1 s (BOOL b) \\<Longrightarrow> eval (UNA_LNE e1) s (BOOL (\\<not>b))\"\n    (* Boolean operations *)\n  | BEQUB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (b1 = b2))\"\n(* Boolean equality check yields derivation error; code cannot be generated for inductive predicate eval *)\n(*  | BNEQB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (b1 \\<noteq> b2))\" *)\n  | BFANB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_FAN e1 e2) s (BOOL (b1 \\<and> b2))\"\n  | BFORB: \"eval e1 s (BOOL b1) \\<Longrightarrow> eval e2 s (BOOL b2) \\<Longrightarrow> eval (BIN_FOR e1 e2) s (BOOL (b1 \\<or> b2))\"\n    (* Signed integer opreations *)\n  | BEQUS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n  | BLEQS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_LEQ e1 e2) s (BOOL (n1 \\<le> n2))\"\n  | BGEQS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_GEQ e1 e2) s (BOOL (n1 \\<ge> n2))\"\n  | BLESS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_LES e1 e2) s (BOOL (n1 < n2))\"\n  | BGRES: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_GRE e1 e2) s (BOOL (n1 > n2))\"\n    (* Unsigned integer opreations *)\n  | BEQUU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n  | BLEQU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_LEQ e1 e2) s (BOOL (n1 \\<le> n2))\"\n  | BGEQU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_GEQ e1 e2) s (BOOL (n1 \\<ge> n2))\"\n  | BLESU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_LES e1 e2) s (BOOL (n1 < n2))\"\n  | BGREU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_GRE e1 e2) s (BOOL (n1 > n2))\"\n    (* Infinite precision integer opreations *)\n  | BEQUI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n  | BLEQI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_LEQ e1 e2) s (BOOL (n1 \\<le> n2))\"\n  | BGEQI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_GEQ e1 e2) s (BOOL (n1 \\<ge> n2))\"\n  | BLESI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_LES e1 e2) s (BOOL (n1 < n2))\"\n  | BGREI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_GRE e1 e2) s (BOOL (n1 > n2))\"\n    (* Variable size bitstring opreations *)\n  | BEQUV: \"eval e1 s (VINT n1) \\<Longrightarrow> eval e2 s (VINT n2) \\<Longrightarrow> eval (BIN_EQU e1 e2) s (BOOL (n1 = n2))\"\n  | BNEQV: \"eval e1 s (VINT n1) \\<Longrightarrow> eval e2 s (VINT n2) \\<Longrightarrow> eval (BIN_NEQ e1 e2) s (BOOL (n1 \\<noteq> n2))\"\n(* =============== Operations that yield an unsigned integer (UINT)  =============== *)\n  | UNEGU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval (UNA_NEG e1) s (UINT n1)\" (* Incorrect but w/e for now *)\n  | UPOSU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval (UNA_POS e1) s (UINT n1)\"\n  | UCOMU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval (UNA_COM e1) s (UINT n1)\" (* (nat (NOT (int n1))))\" Incorrect but w/e *)\n  | BADDU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_ADD e1 e2) s (UINT (n1 + n2))\"\n  | BMINU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_MIN e1 e2) s (UINT (n1 - n2))\"\n  | BANDU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_AND e1 e2) s (UINT (nat ((int n1) AND (int n2))))\"\n  | BXORU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_XOR e1 e2) s (UINT (nat ((int n1) XOR (int n2))))\"\n  | BLORU: \"eval e1 s (UINT n1) \\<Longrightarrow> eval e2 s (UINT n2) \\<Longrightarrow> eval (BIN_LOR e1 e2) s (UINT (nat ((int n1) OR (int n2))))\"\n(* =============== Operations that yield a signed integer (SINT)  =============== *)\n  | UNEGS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval (UNA_NEG e1) s (SINT (-n1))\"\n  | UPOSS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval (UNA_POS e1) s (SINT n1)\"\n  | BADDS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_ADD e1 e2) s (SINT (n1 + n2))\"\n  | BMINS: \"eval e1 s (SINT n1) \\<Longrightarrow> eval e2 s (SINT n2) \\<Longrightarrow> eval (BIN_MIN e1 e2) s (SINT (n1 - n2))\"\n(* =============== Operations that yield an infinite-precision integer (IINT)  =============== *)\n  | UNEGI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval (UNA_NEG e1) s (IINT (-n1))\"\n  | UPOSI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval (UNA_POS e1) s (IINT n1)\"\n  | BADDI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_ADD e1 e2) s (IINT (n1 + n2))\"\n  | BMINI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_MIN e1 e2) s (IINT (n1 - n2))\"\n  | BMULI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_MUL e1 e2) s (IINT (n1 * n2))\"\n  | BDIVI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_DIV e1 e2) s (IINT (n1 div n2))\"\n  | BMODI: \"eval e1 s (IINT n1) \\<Longrightarrow> eval e2 s (IINT n2) \\<Longrightarrow> eval (BIN_MOD e1 e2) s (IINT (n1 mod n2))\"\n(* =============== Operations that yield a variable-width integer (VINT)  =============== *)\n      (* Empty for now *)\n\ninductive_cases [elim!]: \"eval (BASE b) s v\" \"eval (TernExpr e1 e2 e3) s v\" \"eval (NamedVar i) s v\"\n\"eval (UNA_LNE e) s v\" \"eval (UNA_COM e) s v\" \"eval (UNA_NEG e) s v\" \"eval (UNA_POS e) s v\" \"eval (BIN_MUL e1 e2) s v\"\n\"eval (BIN_DIV e1 e2) s v\" \"eval (BIN_MOD e1 e2) s v\" \"eval (BIN_ADD e1 e2) s v\" \"eval (BIN_MIN e1 e2) s v\" \"eval (BIN_AND e1 e2) s v\"\n\"eval (BIN_XOR e1 e2) s v\" \"eval (BIN_LOR e1 e2) s v\" \"eval (BIN_LEQ e1 e2) s v\" \"eval (BIN_GEQ e1 e2) s v\" \"eval (BIN_LES e1 e2) s v\"\n\"eval (BIN_GRE e1 e2) s v\" \"eval (BIN_NEQ e1 e2) s v\" \"eval (BIN_EQU e1 e2) s v\" \"eval (BIN_FAN e1 e2) s v\" \"eval (BIN_FOR e1 e2) s v\"\n\nlemma eval_deterministic: \"(eval e s v) \\<Longrightarrow> (eval e s v') \\<Longrightarrow> (v = v')\"\n  apply (induction arbitrary: v' rule: eval.induct)\n                      apply (blast+)\n  done\n\ncode_pred eval .\n\ndefinition null_state (\"<>\") where\n  \"null_state \\<equiv> \\<lambda>x. (UINT 0)\"\nsyntax\n  \"_State\" :: \"updbinds \\<Rightarrow> 'a\" (\"<_>\")\ntranslations\n  \"_State ms\" == \"_Update <> ms\"\n  \"_State (_updbinds b bs)\" <= \"_Update (_State b) bs\"\n\nend\n", "meta": {"author": "Johanmyst", "repo": "Nano-P4", "sha": "fc3720d7115d0bac5d719cfe6c73a024aae7f9c4", "save_path": "github-repos/isabelle/Johanmyst-Nano-P4", "path": "github-repos/isabelle/Johanmyst-Nano-P4/Nano-P4-fc3720d7115d0bac5d719cfe6c73a024aae7f9c4/Theory_Files/Simple_Action_Verification/NP4_Simple_Action_Values.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3106163408055177}}
{"text": "theory Abstract_Reachability_Analysis_C1\n  imports\n    Abstract_Reachability_Analysis\n  \"../Refinement/Weak_Set\"\n  \"../Refinement/Refine_Parallel\"\n  \"../Refinement/Refine_Default\"\n  \"../Refinement/Refine_Phantom\"\n  \"../Refinement/Refine_ScaleR2\"\nbegin\n\ndefinition blinfun_of_list :: \"real list \\<Rightarrow> 'a \\<Rightarrow>\\<^sub>L 'a::executable_euclidean_space\"\n  where \"blinfun_of_list xs = blinfun_of_matrix (\\<lambda>i j. xs ! ((index Basis_list i) * DIM('a) + (index Basis_list j)))\"\n\ndefinition vec1_of_list :: \"real list \\<Rightarrow> 'n::{finite, one, plus} vec1\"\n  where \"vec1_of_list xs =\n    (vector (take CARD('n) xs), vector (map (\\<lambda>i. vector (nths xs {CARD('n)*i..CARD('n)*Suc i})) [1..<Suc (CARD('n))]))\"\n\ndefinition flow1_of_vec1 :: \"'n vec1 \\<Rightarrow> ('n rvec * ('n rvec \\<Rightarrow>\\<^sub>L 'n::finite rvec))\"\n  where \"flow1_of_vec1 xs = (fst xs, blinfun_of_vmatrix (snd xs))\"\n\ndefinition vec1_of_flow1 :: \"('n::finite eucl1) \\<Rightarrow> 'n vec1\"\n  where \"vec1_of_flow1 xs = (fst xs, matrix (snd xs))\"\n\nlemma vec1_of_flow1_flow1_of_vec1[simp]:\n  \"vec1_of_flow1 (flow1_of_vec1 X) = X\"\n  unfolding vec1_of_flow1_def flow1_of_vec1_def\n  by (transfer) (auto simp: matrix_of_matrix_vector_mul)\n\ndefinition \"flow1_of_list xs =\n  (eucl_of_list (take DIM('a::executable_euclidean_space) xs)::'a,\n    blinfun_of_list (take (DIM('a)*DIM('a)) (drop DIM('a) xs @\n    replicate (DIM('a)*DIM('a) - (length xs - DIM('a))) 0))::'a\\<Rightarrow>\\<^sub>L'a)\"\n\n\nlemma blinfun_of_list_eq_blinfun_of_vmatrix:\n  assumes \"length xs = CARD('n)*CARD('n::enum)\"\n  shows \"blinfun_of_list xs = blinfun_of_vmatrix (eucl_of_list xs::((real, 'n) vec, 'n) vec)\"\n  using assms\n  apply (auto simp: blinfun_of_list_def)\n  apply (auto intro!: simp: blinfun_ext blinfun_of_vmatrix.rep_eq blinfun_of_matrix.rep_eq)\n  subgoal for i\n    apply (subst (2) eucl_of_list_list_of_eucl[symmetric, of i])\n    apply (subst eucl_of_list_matrix_vector_mult_eq_sum_nth_Basis_list)\n    by (auto simp: sum_Basis_sum_nth_Basis_list scaleR_sum_left intro!: sum.cong)\n  done\n\n\ndefinition \"ghost_rel = Pair () ` UNIV\"\nconsts i_ghost::interface\nlemmas [autoref_rel_intf] = REL_INTFI[of ghost_rel i_ghost]\nlemma ghost_relI: \"((), x) \\<in> ghost_rel\" by (auto simp: ghost_rel_def)\n\ndefinition [refine_vcg_def]: \"GSPEC x = SPEC x\"\nlemma [autoref_op_pat_def]: \"GSPEC x \\<equiv> Autoref_Tagging.OP (GSPEC x)\" by auto\n\nlemma GSPEC_impl[autoref_rules]:\n  assumes \"SIDE_PRECOND (Ex P)\"\n  shows \"(RETURN (), GSPEC P) \\<in> \\<langle>ghost_rel\\<rangle>nres_rel\"\n  using assms by (auto simp: nres_rel_def ghost_rel_def GSPEC_def intro!: RETURN_SPEC_refine)\n\ncontext approximate_sets_ode' begin\n\ndefinition \"c1_info_of_appr XD =\n  (case snd XD of None \\<Rightarrow> eucl_of_list ` set_of_appr (fst XD) \\<times> UNIV\n   | Some DD \\<Rightarrow> flow1_of_list ` set_of_appr (fst XD @ DD))\"\ndefinition \"c1_info_of_apprs x = \\<Union>(set (map c1_info_of_appr x))\"\ndefinition \"c1_info_of_appr' x = Affine_Code.the_default UNIV (map_option c1_info_of_apprs x)\"\ndefinition \"c1_info_of_appre X = scaleR2 (fst (fst X)) (snd (fst X)) (c1_info_of_appr (snd X))\"\ndefinition \"c1_info_of_apprse x = \\<Union>(set (map c1_info_of_appre x))\"\n\n\ndefinition [simp]: \"op_image_flow1_of_vec1 = (`) flow1_of_vec1\"\n\ndefinition [simp]: \"op_image_flow1_of_vec1_coll = (`) flow1_of_vec1\"\n\ndefinition [simp]: \"op_image_fst = (`) fst\"\n\ndefinition [refine_vcg_def]:\n  \"vec1rep CX = SPEC (\\<lambda>R. case R of None \\<Rightarrow> True | Some X \\<Rightarrow> X = vec1_of_flow1 ` CX)\"\n\ndefinition [simp]: \"op_times_UNIV X = X \\<times> UNIV\"\n\ndefinition appr1_rel::\"(('b list \\<times> 'b list option) \\<times>\n  ('a::executable_euclidean_space c1_info set)) set\"\n  where appr1_rel_internal: \"appr1_rel = {((xs, None), X \\<times> UNIV) |xs X. (xs, X) \\<in> appr_rel} \\<union>\n{((xs, Some ys), X::('a c1_info) set) |xs ys X. X = flow1_of_list ` set_of_appr (xs @ ys) \\<and>\n  length xs = DIM('a::executable_euclidean_space) \\<and>\n  length ys = DIM('a) * DIM('a)}\"\n\nabbreviation \"appr1e_rel \\<equiv> \\<langle>appr1_rel\\<rangle>scaleR2_rel\"\n\ntext \\<open>TODO: remove \\<open>...:::relation\\<close> from this file\\<close>\ndefinition \"solve_poincare_plane (n::'n::enum rvec) (CX::'n eucl1 set) = do {\n    X \\<leftarrow> mk_safe (((`) fst CX::'n rvec set));\n    F \\<leftarrow> ode_set (X);\n    nonzero_component (ST ''solve_poincare_map: not nonzero!'') F n;\n    let i = index Basis_list n;\n    ASSERT (i < length solve_poincare_slp);\n    vCX \\<leftarrow> vec1rep CX;\n    case vCX of None \\<Rightarrow>\n      do {\n        RETURN (op_times_UNIV (X))\n      }\n    | Some vCX \\<Rightarrow>\n      do {\n        (R::'n vec1 set) \\<leftarrow> approx_slp_appr (map fold_const_fa (solve_poincare_fas i)) (solve_poincare_slp ! i) (list_of_eucl ` vCX);\n        let R = (op_image_flow1_of_vec1 (R:::appr_rel):::appr1_rel);\n        X \\<leftarrow> mk_safe (op_image_fst R);\n        F \\<leftarrow> ode_set (X);\n        nonzero_component (ST ''solve_poincare_map: not nonzero!'') (F) n;\n        RETURN (R::'n eucl1 set)\n      }\n  }\"\n\ndefinition embed1::\"'n::enum rvec \\<Rightarrow> ('n rvec * (real^'n::enum^'n::enum))\" where [simp]: \"embed1 x = (x, 0)\"\n\ndefinition \"choose_step1 (X::'n::enum eucl1 set) h = do {\n    lX \\<leftarrow> vec1rep X;\n    case lX of None \\<Rightarrow>\n      do {\n        sX \\<leftarrow> mk_safe (fst ` X);\n        (h, err, CX', X') \\<leftarrow> choose_step sX h;\n        \\<^cancel>\\<open>err \\<leftarrow> width_spec (err:::appr_rel);\\<close>\n        RETURN (h, err \\<times> UNIV, (CX') \\<times> UNIV, (X') \\<times> UNIV)\n      }\n    | Some vX \\<Rightarrow>\n      do {\n        sX \\<leftarrow> var.mk_safe vX;\n        (h, err, CX', X') \\<leftarrow> var.choose_step sX h;\n        let CX' = flow1_of_vec1 ` ((CX':::appr_rel):::appr_rel);\n        let X' = flow1_of_vec1 ` ((X':::appr_rel):::appr_rel);\n        let err' = flow1_of_vec1 ` (err:::appr_rel);\n        \\<^cancel>\\<open>err \\<leftarrow> width_spec (fst ` (flow1_of_vec1 ` (err:::appr_rel)):::appr_rel);\\<close>\n        RETURN (h, err', CX', X'::'n eucl1 set)\n      }\n  }\"\n\ndefinition \"plane1_of x = plane_of x \\<times> UNIV\"\ndefinition \"below1_halfspaces x = below_halfspaces x \\<times> UNIV\"\ndefinition \"sbelow1_halfspaces x = sbelow_halfspaces x \\<times> UNIV\"\nabbreviation \"plane1_invar_rel \\<equiv> \\<lambda>A. \\<langle>(\\<langle>lv_rel\\<rangle>sctn_rel), A\\<rangle>invar_rel plane1_of \"\n\ndefinition \"c1_info_invar N XD \\<longleftrightarrow> length (fst XD) = N \\<and> (case snd XD of Some DD \\<Rightarrow> length DD = (length (fst XD))\\<^sup>2 | None \\<Rightarrow> True)\"\n\ndefinition op_image_zerofst :: \"('a \\<times> 'c) set \\<Rightarrow> ('a::zero \\<times> 'c) set\"\n  where [simp]: \"op_image_zerofst \\<equiv> \\<lambda>X. (\\<lambda>x. (0, snd x)) ` X\"\n\ndefinition op_image_zerofst_vec :: \"('n::enum vec1) set \\<Rightarrow> ('n::enum vec1) set\"\n  where [simp]: \"op_image_zerofst_vec \\<equiv> \\<lambda>X. (\\<lambda>x. (0, snd x)) ` X\"\n\ndefinition [simp]: \"op_image_embed1 X = embed1 ` X\"\n\ndefinition \"inter_sctn1_spec (X::'n::enum eucl1 set) (sctn::'n rvec sctn) = do {\n    R \\<leftarrow> inter_sctn_spec (fst ` X) sctn;\n    vX \\<leftarrow> vec1rep X;\n    case vX of None \\<Rightarrow>\n      do {\n        let R1 = R \\<times> UNIV;\n        RETURN (R1, R1)\n      }\n    | Some X \\<Rightarrow>\n      do {\n        let sctn = ((Sctn (embed1 (normal sctn)) (pstn sctn)::'n vec1 sctn));\n        R1 \\<leftarrow> inter_sctn_spec X sctn;\n        let R2 = op_image_zerofst_vec X + op_image_embed1 R;\n        RETURN ((flow1_of_vec1 ` R1), (flow1_of_vec1 ` R2))\n      }\n  }\"\n\ndefinition \"op_image_fst_coll_nres XS = do {\n    XSs \\<leftarrow> sets_of_coll XS;\n    FORWEAK XSs (RETURN op_empty_coll) (\\<lambda>X.\n      RETURN (mk_coll (op_image_fst X:::appr_rel))) (\\<lambda>A B. RETURN (B \\<union> A))\n  }\"\n\nlemma op_image_fst_coll_nres_spec[le, refine_vcg]: \"op_image_fst_coll_nres X \\<le> SPEC (\\<lambda>R. R = fst ` X)\"\n  unfolding op_image_fst_coll_nres_def\n  by (refine_vcg FORWEAK_mono_rule[where I=\"\\<lambda>it s. fst ` \\<Union>it \\<subseteq> s \\<and> s \\<subseteq> fst ` X\"])\n    (auto, force+)\n\ndefinition [simp]: \"op_image_fst_coll = (`) fst\"\n\ndefinition \"fst_safe_coll XS = do {\n    C \\<leftarrow> op_image_fst_coll_nres XS;\n    mk_safe_coll (C:::clw_rel appr_rel)\n  }\"\n\ndefinition [refine_vcg_def]:\n  \"vec1reps X = do {\n    XS \\<leftarrow> sets_of_coll X;\n    FORWEAK XS (RETURN (Some op_empty_coll))\n      (\\<lambda>x. do {\n        x \\<leftarrow> vec1rep x;\n        RETURN (map_option mk_coll x:::\\<langle>clw_rel appr_rel\\<rangle>option_rel)\n      })\n      (\\<lambda>a b.\n        case (a, b) of (Some a, Some b) \\<Rightarrow> RETURN (Some (b \\<union> a))\n        | _ \\<Rightarrow> RETURN None)\n  }\"\n\ndefinition \"do_intersection_spec S guards ivl sctn X0 = (\\<lambda>(PS, CXS).\n    poincare_mapsto {x \\<in> ivl. x \\<in> plane_of sctn} X0 S CXS PS \\<and>\n      CXS \\<inter> guards = {} \\<and>\n      CXS \\<inter> ivl \\<inter> plane_of sctn = {} \\<and>\n      fst ` PS \\<inter> guards = {} \\<and>\n      fst ` PS \\<subseteq> {x \\<in> ivl. x \\<in> plane_of sctn} \\<and>\n      fst ` PS \\<union> CXS \\<subseteq> Csafe \\<and>\n      0 \\<notin> (\\<lambda>x. ode x \\<bullet> normal sctn) ` fst ` PS \\<and>\n      (\\<forall>x\\<in>PS. (\\<forall>\\<^sub>F x in at (fst x) within plane_of sctn. x \\<in> ivl)))\"\n\nabbreviation \"inter_sbelows X sctns \\<equiv> mk_inter X (sbelow_halfspaces sctns)\"\n\ndefinition \"list_of_appr1 X = fst X @ the_default [] (snd X)\"\n\ndefinition print_set1::\"bool \\<Rightarrow> 'a set \\<Rightarrow> unit\" where \"print_set1 _ _ = ()\"\n\ndefinition \"nonzero_component_within ivl sctn PDP = do {\n  fPDP \\<leftarrow> mk_safe (fst ` PDP);\n  F \\<leftarrow> ode_set (fPDP);\n  nonzero_component (ST ''solve_poincare_map: not nonzero!'') F (normal sctn);\n  op_eventually_within_sctn (op_image_fst PDP:::appr_rel) sctn ivl\n}\"\n\ndefinition \"do_intersection_invar guards GUARDS ivl sctn X \\<equiv> \\<lambda>(X', T, PS, PS2, CXS, intersects, inside).\n  (inside \\<longrightarrow>\n          (fst ` X \\<inter> GUARDS = {} \\<and>\n          fst ` X \\<subseteq> sbelow_halfspace sctn \\<and>\n          ivl \\<subseteq> plane_of sctn \\<and>\n          fst ` X \\<subseteq> CXS \\<and>\n          fst ` PS \\<union> fst ` PS2 \\<union> CXS \\<union> fst ` X' \\<subseteq> Csafe \\<and>\n          T \\<subseteq> nonneg_reals \\<and>\n          (\\<not>intersects \\<longrightarrow> (fst ` X' \\<inter> plane_of sctn = {} \\<and> T = pos_reals)) \\<and>\n          CXS \\<subseteq> (sbelow_halfspace sctn - guards) \\<and>\n          X' \\<subseteq> (- guards) \\<times> UNIV \\<and>\n          fst ` (PS \\<union> PS2) \\<inter> guards = {} \\<and>\n          (0 \\<notin> (\\<lambda>x. ode x \\<bullet> normal sctn) ` fst ` (PS \\<union> PS2)) \\<and>\n          ((\\<forall>x\\<in>PS \\<union> PS2. (\\<forall>\\<^sub>F x in at (fst x) within plane_of sctn. x \\<in> ivl))) \\<and>\n          (\\<exists>A B. X = A \\<union> B \\<and>\n            flowsto A T (CXS \\<times> UNIV) (X' \\<inter> (sbelow_halfspace sctn) \\<times> UNIV) \\<and>\n            poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} B UNIV CXS PS \\<and>\n            poincare_mapsto {x \\<in> ivl. x \\<bullet> normal sctn = pstn sctn} B UNIV CXS PS2)))\"\n\ndefinition \"list_of_appr1e X = fst (snd X) @ the_default [] (snd (snd X)) @\n  (let (l, u) = fst X;\n    roer = (\\<lambda>x. if x = - \\<infinity> then FloatR 1 (-88) else if x = \\<infinity> then FloatR 1 88 else real_of_ereal x)\n  in\n    appr_of_ivl ops [roer l] [roer u]\n    )\"\n\ndefinition print_set1e::\"bool \\<Rightarrow> 'a set \\<Rightarrow> unit\" where \"print_set1e _ _ = ()\"\n\ndefinition trace_set1e::\"string\\<Rightarrow>'a set option\\<Rightarrow>unit\" where \"trace_set1e _ _ = ()\"\ndefinition trace_set1::\"string\\<Rightarrow>'a set option\\<Rightarrow>unit\" where \"trace_set1 _ _ = ()\"\n\ndefinition \"split_spec_param1 X = do {\n    (vX) \\<leftarrow> vec1rep X;\n    let D = CARD('n);\n    case vX of None \\<Rightarrow> do {\n      (a, b) \\<leftarrow> split_spec_param D (fst ` X::'n::finite rvec set);\n      RETURN (a \\<times> UNIV, b \\<times> UNIV)\n    }\n    | Some X \\<Rightarrow> do {\n      (a, b) \\<leftarrow> split_spec_param D X;\n      RETURN (op_image_flow1_of_vec1 a, op_image_flow1_of_vec1 b)\n    }\n  }\"\n\nabbreviation iinfo_rel :: \"('c \\<times> 'a set) set \\<Rightarrow> ((real \\<times> 'c) \\<times> 'a::real_normed_vector set) set\"\nwhere \"iinfo_rel \\<equiv> \\<lambda>s. \\<langle>rnv_rel, s\\<rangle>info_rel\"\n\ndefinition \"split_spec_param1e X = do {\n    ((l, u), Y) \\<leftarrow> scaleR2_rep X;\n    (a, b) \\<leftarrow> split_spec_param1 Y;\n    a \\<leftarrow> scaleRe_ivl_spec l u a;\n    b \\<leftarrow> scaleRe_ivl_spec l u b;\n    RETURN (a, b)\n  }\"\n\ndefinition \"reduce_spec1 C X = do {\n  vX \\<leftarrow> vec1rep X;\n  case vX of None \\<Rightarrow> do {\n    X \\<leftarrow> reduce_spec C (fst ` X);\n    RETURN (X \\<times> UNIV)\n  }\n  | Some vX \\<Rightarrow> do {\n    vX \\<leftarrow> reduce_spec C vX;\n    RETURN (flow1_of_vec1 ` vX)\n  }\n}\"\ndefinition \"reduce_spec1e C X = do {\n  ((l, u), X) \\<leftarrow> scaleR2_rep X;\n  X \\<leftarrow> reduce_spec1 C X;\n  scaleRe_ivl_spec l u X\n}\"\n\ndefinition [refine_vcg_def]: \"pre_split_reduce_spec (ro::unit) = SPEC (\\<lambda>x::unit. True)\"\n\ndefinition split_under_threshold::\"_ \\<Rightarrow> real \\<Rightarrow> 'n::enum eucl1 set \\<Rightarrow> 'n eucl1 set nres\" where\n  \"split_under_threshold ro th X = do {\n    (_, Ys) \\<leftarrow> WHILE\\<^bsup>\\<lambda>(Xs, Ys). X \\<subseteq> Xs \\<union> Ys\\<^esup> (\\<lambda>(Xs, Ys). \\<not> op_coll_is_empty Xs) (\\<lambda>(Xs, Ys). do {\n      (X, Xs') \\<leftarrow> (split_spec_coll (Xs:::clw_rel (\\<langle>appr1_rel\\<rangle>scaleR2_rel)):::\\<langle>\\<langle>appr1_rel\\<rangle>scaleR2_rel \\<times>\\<^sub>r clw_rel (\\<langle>appr1_rel\\<rangle>scaleR2_rel)\\<rangle>nres_rel);\n      w \\<leftarrow> width_spec (op_image_fste X:::appr_rel);\n      if w \\<le> th then RETURN (Xs', mk_coll X \\<union> Ys)\n      else do {\n        ra \\<leftarrow> pre_split_reduce_spec ro;\n        X \\<leftarrow> reduce_spec1e ra X;\n        (a, b) \\<leftarrow> split_spec_param1e (X:::\\<langle>appr1_rel\\<rangle>scaleR2_rel);\n        RETURN (mk_coll (a:::\\<langle>appr1_rel\\<rangle>scaleR2_rel) \\<union> mk_coll (b:::\\<langle>appr1_rel\\<rangle>scaleR2_rel) \\<union> Xs', Ys)\n      }\n    }) (X:::clw_rel (\\<langle>appr1_rel\\<rangle>scaleR2_rel), op_empty_coll:::clw_rel (\\<langle>appr1_rel\\<rangle>scaleR2_rel));\n    RETURN Ys\n  }\"\n\ndefinition \"choose_step1e X h = do {\n    ((l, u), X) \\<leftarrow> scaleR2_rep X;\n    (h', error, CY, Y) \\<leftarrow> choose_step1 X h;\n    Y \\<leftarrow> scaleRe_ivl_spec l u Y;\n    RETURN (h', error, fst ` CY, Y)\n  }\"\n\ndefinition \"step_split ro (X::'n::enum eucl1 set) =\n  do {\n    ra \\<leftarrow> pre_split_reduce_spec ro;\n    X \\<leftarrow> reduce_spec1e ra X;\n    (a, b) \\<leftarrow> split_spec_param1e (X:::appr1e_rel);\n    _ \\<leftarrow> mk_safe (op_image_fste a);\n    _ \\<leftarrow> mk_safe (op_image_fste b);\n    width_X \\<leftarrow> width_spec (op_image_fste X:::appr_rel);\n    wa \\<leftarrow> width_spec (op_image_fste a:::appr_rel);\n    wb \\<leftarrow> width_spec (op_image_fste b:::appr_rel);\n    let _ = trace_set (ST ''splitting: '' @ show (lfloat10 width_X) @ ST ''-->'' @ show (lfloat10 wa) @\n      ST '', ''  @ show (lfloat10 wb)) (None::'n::enum eucl1 set option);\n    RETURN (mk_coll a \\<union> mk_coll b)\n  }\"\n\ndefinition \"width_spec_appr1 X = do {\n    vX \\<leftarrow> vec1rep X;\n    case vX of None \\<Rightarrow> width_spec (fst ` X:::appr_rel)\n    | Some vX \\<Rightarrow> width_spec (vX:::appr_rel)\n  }\"\n\ndefinition \"tolerate_error1 Y E = tolerate_error (fst ` Y) (fst ` E)\"\n\ndefinition \"step_adapt_time (X::'n::enum eucl1 set) h =\n  do {\n    let X0 = fst ` X;\n    _ \\<leftarrow> mk_safe (X0:::appr_rel);\n    (h', error, CY, Y) \\<leftarrow> choose_step1e X h;\n    (te, e) \\<leftarrow> tolerate_error1 Y error;\n    let _ = trace_set1 (ST ''discrete time step: stepsize = '' @ show (lfloat10 h)) (None::'n eucl1 set option);\n    let _ = trace_set1 (ST ''discrete time step: stepsize' = '' @ show (lfloat10 h')) (None::'n eucl1 set option);\n    let _ = trace_set1 (ST ''error estimation: '' @ show (lfloat10 e)) (None::'n eucl1 set option);\n    if \\<not> te\n    then do {\n      let _ = trace_set (ST ''revoking step'') (None::'n eucl1 set option);\n      RETURN (0, fst ` X, X, 3 * h' / 2 / 2)\n    } else do {\n      let _ = trace_set1 (ST ''error OK, step_adapt_time stepped '') (None::'n eucl1 set option);\n      let _ = trace_set (ST ''interpolated step:'') (Some (CY));\n      let _ = print_set True CY;\n      let _ = trace_set1e (ST ''discrete step:'') (Some (Y));\n      let _ = print_set1e False Y;\n      rtol \\<leftarrow> adaptive_rtol_spec;\n      method_id \\<leftarrow> method_spec;\n      prec \\<leftarrow> precision_spec;\n      case approx prec (adapt_stepsize_fa rtol method_id e h') []\n      of Some ivl_h'' \\<Rightarrow>\n        let h'' = lower ivl_h'';\n            _ = trace_set1 (ST ''increase step: stepsize = '' @ show (lfloat10 h'')) (None::'n eucl1 set option)\n        in RETURN (h', CY, Y, 15/2/2/2/2 * h'')\n      | None \\<Rightarrow>\n        let _ = trace_set1 (ST ''increase time step (failure): stepsize = '' @ show (lfloat10 h')) (None::'n eucl1 set option)\n        in RETURN (h', CY, Y, h' * 5 / 2 / 2)\n    }\n  }\"\n\ndefinition [simp]: \"eq_spec x y = SPEC (\\<lambda>r. r \\<longrightarrow> x = y)\"\nlemma [autoref_itype]: \"eq_spec ::\\<^sub>i A \\<rightarrow>\\<^sub>i A \\<rightarrow>\\<^sub>i \\<langle>i_bool\\<rangle>\\<^sub>ii_nres\" by simp\n\ndefinition \"select_with_inter ci a = do {\n    CIs \\<leftarrow> (sets_of_coll ci);\n    As \\<leftarrow> sets_of_coll a;\n    FORWEAK CIs (RETURN op_empty_coll)\n      (\\<lambda>ci. do {\n        (c, I) \\<leftarrow> (get_inter ci);\n        FORWEAK As (RETURN op_empty_coll)\n        (\\<lambda>a. do {\n          b \\<leftarrow> eq_spec a c;\n          if b then RETURN (mk_coll ci)\n          else RETURN (op_empty_coll)\n        })\n        (\\<lambda>CIS CIS'. RETURN (CIS' \\<union> CIS))\n      })\n      (\\<lambda>CIS CIS'. RETURN (CIS' \\<union> CIS))\n  }\"\n\nabbreviation \"fst_safe_colle XS \\<equiv> (mk_safe_coll (op_image_fst_colle XS:::clw_rel appr_rel):::\\<langle>clw_rel appr_rel\\<rangle>nres_rel)\"\n\ndefinition \"do_intersection_body GUARDS ivl sctn h \\<equiv> \\<lambda>(X, T, PDPS, PDPS2, CXS, _, _).\n  do {\n    (_, _, CX', X') \\<leftarrow> choose_step1 (X:::appr1_rel) (h:::rnv_rel);\n    let _ = trace_set1 (ST ''interpolated step during intersection:'') (Some (CX'));\n    let _ = print_set1 True (CX');\n    let _ = trace_set1 (ST ''step during intersection:'') (Some (X'));\n    let _ = print_set1 False (X');\n    CHECKs (ST ''unnormal intersection'') (abs (normal sctn) \\<in> set Basis_list);\n    CPDP \\<leftarrow> solve_poincare_plane (abs (normal sctn)) CX';\n    let _ = trace_set1 (ST ''CPDP: '') (Some CPDP);\n    let _ = print_set1 False (CPDP);\n    (PDP, PDP2) \\<leftarrow> inter_sctn1_spec CPDP sctn;\n    b1 \\<leftarrow> disjoints_spec (mk_coll (op_image_fst X')) (GUARDS);\n    b2 \\<leftarrow> disjoints_spec (mk_coll (op_image_fst CX')) (GUARDS);\n    b3 \\<leftarrow> disjoints_spec (mk_coll (op_image_fst PDP)) (GUARDS);\n    b4 \\<leftarrow> disjoints_spec (mk_coll (op_image_fst PDP2)) (GUARDS);\n    CHECKs (ST ''do_intersection: hitting several planes :('') (b1 \\<and> b2 \\<and> b3 \\<and> b4);\n    intersects \\<leftarrow> op_intersects (op_image_fst X') sctn;\n    CX's \\<leftarrow> mk_safe (op_image_fst CX');\n    c1 \\<leftarrow> nonzero_component_within ivl sctn PDP;\n    c2 \\<leftarrow> nonzero_component_within ivl sctn PDP2;\n    RETURN (X', pos_reals:::\\<langle>Id\\<rangle>phantom_rel, mk_coll PDP \\<union> PDPS,\n      mk_coll PDP2 \\<union> PDPS2,\n      mk_coll (inter_sbelows (CX's:::appr_rel) {sctn}) \\<union> CXS, intersects, c1 \\<and> c2)\n  }\"\n\ndefinition \"do_intersection guards ivl sctn (X::'n::enum eucl1 set) (h::real) =\n  do {\n    ASSUME (closed ivl);\n    sp \\<leftarrow> subset_spec_plane ivl sctn;\n    sX \\<leftarrow> mk_safe (op_image_fst (X:::appr1_rel));\n    GUARDS \\<leftarrow> unintersect_coll guards;\n    a \\<leftarrow> sbelow_sctn (op_image_fst X) sctn;\n    b \\<leftarrow> disjoints_spec (mk_coll (op_image_fst X)) GUARDS;\n    let inside = sp \\<and> a \\<and> b; \\<comment> \\<open>this is a bit of a hack: if the \\<open>ivl\\<close> is not subset of the plane,\\<close>\n      \\<comment> \\<open>then do not do intersections\\<close>\n    (X, T, PDPS, PDPS2, CXS, intersects, inside) \\<leftarrow>\n      WHILE\\<^bsup>do_intersection_invar guards GUARDS ivl sctn X\\<^esup>\n      (\\<lambda>(X, T, PDPS, PDPS2, CXS, intersects, inside). intersects \\<and> inside)\n      (do_intersection_body GUARDS ivl sctn h)\n      (X, nonneg_reals:::\\<langle>Id\\<rangle>phantom_rel, op_empty_coll:::clw_rel appr1_rel::'n eucl1 set,\n        op_empty_coll:::clw_rel appr1_rel::'n eucl1 set,\n        mk_coll (inter_sbelows (sX:::appr_rel) {sctn}), True, inside);\n    a \\<leftarrow> above_sctn (op_image_fst X) sctn;\n    b \\<leftarrow> subset_spec_coll (op_image_fst_coll PDPS) ivl;\n    b2 \\<leftarrow> subset_spec_coll (op_image_fst_coll PDPS2) ivl;\n    RETURN (inside \\<and> b \\<and> b2 \\<and> a, PDPS, PDPS2, CXS)\n  }\"\n\ndefinition \"resolve_step roptns X h = do {\n    width_X \\<leftarrow> width_spec (op_image_fste X:::appr_rel);\n    mtdt \\<leftarrow> max_tdev_thres_spec roptns;\n    if \\<not> width_X \\<le> mtdt\n    then do {\n      Y \\<leftarrow> step_split roptns X;\n      RETURN (h, fst ` Y, Y, h)\n    }\n    else do {\n      (h0, CY, Y, h') \\<leftarrow> step_adapt_time (X::'n::enum eucl1 set) h;\n      RETURN (h0, mk_coll (fst ` Y) \\<union> mk_coll CY, mk_coll Y, h')\n    }\n  }\"\n\ndefinition \"pre_intersection_step ro X h = do {\n    mis \\<leftarrow> max_intersection_step_spec ro;\n    if h > mis\n    then RETURN (with_infos (h/2) (mk_coll X), mk_coll (fst ` X), op_empty_coll:::clw_rel (iinfo_rel appr1e_rel))\n    else do {\n      width_X \\<leftarrow> width_spec (op_image_fste X:::appr_rel);\n      pig \\<leftarrow> pre_inter_granularity_spec ro;\n      if width_X \\<le> pig then\n        RETURN (with_infos h (op_empty_coll:::clw_rel appr1e_rel), mk_coll (fst ` X),\n                with_infos (5 * h / 2 / 2) (mk_coll X))\n      else do {\n        X' \\<leftarrow> step_split ro X;\n        RETURN (with_infos h X', fst ` X', op_empty_coll:::clw_rel (iinfo_rel appr1e_rel))\n      }\n    }\n  }\"\n\ndefinition \"reach_cont ro (guardsi::'n::enum rvec set) XS0 =\n  do {\n    startstep \\<leftarrow> start_stepsize_spec;\n    (_, XS0') \\<leftarrow> scaleR2_rep_coll XS0;\n    sXS0 \\<leftarrow> fst_safe_coll XS0';\n    let fX0 = op_image_fst_colle XS0;\n    guards \\<leftarrow> (unintersect_coll (guardsi:::clw_rel (iplane_rel lvivl_rel)):::\\<langle>clw_rel lvivl_rel\\<rangle>nres_rel);\n    d \\<leftarrow> disjoints_spec fX0 (guards);\n    CHECKs (ST ''reach_cont: starting from guarded set'') d;\n    (_, CXS, GS) \\<leftarrow>\n      WHILE\\<^bsup>(\\<lambda>(XS, CXS, GS).\n        flowsto XS0 {0..} (CXS \\<times> UNIV) (XS \\<union> GS) \\<and>\n        (XS \\<union> GS \\<union> CXS \\<times> UNIV) \\<subseteq> (Csafe - guards) \\<times> UNIV \\<and>\n        XS0 \\<union> GS \\<subseteq> CXS \\<times> UNIV)\\<^esup>\n          (\\<lambda>(XS, CXS, GS). \\<not> op_coll_is_empty XS) (\\<lambda>(XS, CXS, GS).\n      do {\n        (hX, XS') \\<leftarrow> (split_spec_exact XS:::\\<langle>iinfo_rel (appr1e_rel) \\<times>\\<^sub>r clw_rel (iinfo_rel (appr1e_rel))\\<rangle>nres_rel);\n        (h::real, X) \\<leftarrow> get_info hX;\n        let _ = trace_set1e (ST ''next step in resolve_sctns using'') (Some X);\n        cXS::nat \\<leftarrow> card_info XS;\n        cGS::nat \\<leftarrow> card_info GS;\n        let _ = trace_set1 (ST ''XS: '' @ show cXS) (None::'n eucl1 set option);\n        let _ = trace_set1 (ST ''GS: '' @ show cGS) (None::'n eucl1 set option);\n        (h0, fCX', X', h') \\<leftarrow> resolve_step ro X h;\n        sfCX' \\<leftarrow> (mk_safe_coll (fCX':::clw_rel appr_rel):::\\<langle>clw_rel appr_rel\\<rangle>nres_rel);\n        let fX' = (fst ` X');\n        fXS \\<leftarrow> ivls_of_sets (fCX' \\<union> fX');\n        IS \\<leftarrow> inter_overappr guards fXS;\n        let d = op_coll_is_empty IS;\n        if d then RETURN (with_infos h' X' \\<union> XS':::clw_rel (iinfo_rel appr1e_rel), sfCX' \\<union> CXS, GS)\n        else do {\n          (hX', fCX', hG') \\<leftarrow> pre_intersection_step ro X h0;\n          sfCX' \\<leftarrow> (mk_safe_coll (fCX':::clw_rel appr_rel):::\\<langle>clw_rel appr_rel\\<rangle>nres_rel);\n          _ \\<leftarrow> fst_safe_colle (uninfo hX');\n          _ \\<leftarrow> fst_safe_colle (uninfo hG');\n          fGs \\<leftarrow> ivls_of_sets (op_image_fst_colle (uninfo hG') \\<union> fCX' \\<union> op_image_fst_colle (uninfo hX'));\n          d \\<leftarrow> disjoints_spec (sets_of_ivls guards) fGs;\n          CHECKs (ST ''reach_cont: pre_intersection_step should not change disjointness condition!'') d;\n          iguards \\<leftarrow> select_with_inter guardsi IS;\n          iG' \\<leftarrow> with_coll_infos iguards hG';\n          RETURN (hX' \\<union> XS', sfCX' \\<union> CXS, iG' \\<union> GS)\n        }\n      })\n      (with_infos startstep (XS0:::clw_rel appr1e_rel):::clw_rel (iinfo_rel appr1e_rel),\n        sXS0:::clw_rel appr_rel, op_empty_coll:::clw_rel (\\<langle>iplane_rel (lvivl_rel::(_\\<times>'n rvec set)set), iinfo_rel appr1e_rel\\<rangle>info_rel));\n    RETURN (CXS, GS)\n  }\"\n\ndefinition \"reach_cont_par roptns guards XS = do {\n  XS \\<leftarrow> sets_of_coll XS;\n  PARS \\<leftarrow> PAR_IMAGE (\\<lambda>X (CX, G).\n      G \\<union> (CX \\<times> UNIV) \\<subseteq> (Csafe - guards) \\<times> UNIV \\<and>\n      X \\<union> G \\<subseteq> CX \\<times> UNIV \\<and> flowsto X {0..} (CX \\<times> UNIV) G)\n    (\\<lambda>X. reach_cont roptns guards (mk_coll X)) XS;\n  RETURN (\\<Union>(fst ` snd ` PARS), \\<Union>(snd ` snd ` PARS))\n}\"\n\n\ndefinition \"subset_iplane_coll x ics = do {\n    X \\<leftarrow> unintersect x;\n    ics \\<leftarrow> sets_of_coll ics;\n    FORWEAK ics (RETURN False) (\\<lambda>ic. do {\n      (i, c) \\<leftarrow> get_inter ic;\n      sctn \\<leftarrow> get_plane c;\n      b1 \\<leftarrow> subset_spec_plane X sctn;\n      RETURN (b1 \\<and> op_subset_ivl X i)\n    }) (\\<lambda>b c. RETURN (b \\<or> c))\n  }\"\n\ndefinition \"subsets_iplane_coll xs ics = FORWEAK xs (RETURN True) (\\<lambda>x. subset_iplane_coll x ics) (\\<lambda>a b. RETURN (a \\<and> b))\"\n\n\ndefinition \"stable_set p = {x. {0..} \\<subseteq> existence_ivl0 x \\<and> (flow0 x \\<longlongrightarrow> p) at_top}\"\n\ndefinition symstart_coll::\"('n::enum eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set)nres) \\<Rightarrow>\n  'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set)nres\"\n  where\n\"symstart_coll symstart X0 = do {\n    _ \\<leftarrow> (fst_safe_colle (X0:::clw_rel appr1e_rel):::\\<langle>clw_rel appr_rel\\<rangle>nres_rel);\n    X0s \\<leftarrow> sets_of_coll X0;\n    (CX1, X1) \\<leftarrow> FORWEAK X0s (RETURN (op_empty_coll, op_empty_coll)) (symstart)\n      (\\<lambda>(CX, X) (CX', X'). RETURN (CX' \\<union> CX, X' \\<union> X));\n    RETURN (CX1, X1)\n  }\"\n\ndefinition reach_cont_symstart ::\n  \"_ \\<Rightarrow> _ \\<Rightarrow> 'n::enum rvec set\n      \\<Rightarrow> 'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> 'n eucl1 set) nres\"\n  where \"reach_cont_symstart ro symstart (guards::'n rvec set) X0 = do {\n    let fX0 = op_image_fst_colle X0;\n    GUARDS \\<leftarrow> unintersect_coll guards;\n    d \\<leftarrow> disjoints_spec fX0 GUARDS;\n    CHECKs (ST ''reach_cont_symstart: starting from guarded set'') d;\n    (CY, Y0) \\<leftarrow> symstart_coll symstart X0;\n    sCY \\<leftarrow> (mk_safe_coll (op_image_fst_colle X0 \\<union> CY:::clw_rel appr_rel):::\\<langle>clw_rel appr_rel\\<rangle>nres_rel);\n    b \\<leftarrow> disjoints_spec (op_image_fst_colle Y0 \\<union> CY) GUARDS;\n    CHECKs ''reach_cont_symstart with a stupid guard'' b;\n    (CX, GS) \\<leftarrow> (reach_cont_par ro guards Y0:::\\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel (\\<langle>iplane_rel lvivl_rel::(_ \\<times> 'n rvec set) set, iinfo_rel appr1e_rel\\<rangle>info_rel)\\<rangle>nres_rel);\n    let CZ = sCY \\<union> CX;\n    RETURN (CZ, GS)\n  }\"\n\ncontext includes autoref_syntax begin\\<comment> \\<open>TODO: should not be annotating relations here\\<close>\ndefinition reach_conts ::\n  \"_ \\<Rightarrow> _ \\<Rightarrow> _ \\<Rightarrow> 'n::enum rvec set\n      \\<Rightarrow> 'n eucl1 set \\<Rightarrow> ('n rvec set \\<times> ('n rvec set \\<times> 'n eucl1 set) set \\<times> ('n eucl1 set \\<Rightarrow> 'n eucl1 set)) nres\"\n  where \"reach_conts ro symstart trap (guardsi::'n rvec set) X0 = do {\n    (CX, GS) \\<leftarrow> (reach_cont_symstart ro (symstart:::appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel) guardsi X0:::\n      \\<langle>clw_rel appr_rel \\<times>\\<^sub>r\n       clw_rel (\\<langle>iplane_rel lvivl_rel::(_\\<times>'n rvec set) set, iinfo_rel appr1e_rel\\<rangle>info_rel)\\<rangle>nres_rel);\n    (IGSs:: ('n rvec set \\<times> 'n eucl1 set) set) \\<leftarrow> explicit_info_set GS;\n    let GSs = snd ` IGSs;\n    ASSUME (finite GSs);\n    CHECKs '''' (GSs \\<noteq> {});\n    ASSERT       (\\<exists>f. X0 = \\<Union>(f ` GSs) \\<and> (\\<forall>G \\<in> GSs. flowsto (f G - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) (G)));\n    X0f \\<leftarrow> GSPEC (\\<lambda>f. X0 = \\<Union>(f ` GSs) \\<and> (\\<forall>G \\<in> GSs. flowsto (f G - trap \\<times> UNIV) {0..} (CX \\<times> UNIV) (G)));\n    let K = (fst ` IGSs);\n    b \\<leftarrow> subsets_iplane_coll K guardsi;\n    CHECKs (ST ''reach_conts: subsets_iplane_coll'') b;\n    RETURN (CX, IGSs:::\\<langle>iplane_rel lvivl_rel \\<times>\\<^sub>r clw_rel (iinfo_rel appr1e_rel)\\<rangle>list_wset_rel, X0f)\n  }\"\nend\n\ndefinition [refine_vcg_def]: \"get_sctns X = SPEC (\\<lambda>R. X = below_halfspaces R)\"\n\ndefinition \"leaves_halfspace S X = do {\n    sctns \\<leftarrow> get_sctns S;\n    sctnss \\<leftarrow> op_set_to_list sctns;\n    (case sctnss of\n      [] \\<Rightarrow> RETURN None\n    | [sctn] \\<Rightarrow>\n      do {\n        (Xi, Xs) \\<leftarrow> ivl_rep_of_set_coll X;\n        ASSERT (Xi \\<le> Xs);\n        b \\<leftarrow> subset_spec_plane ({Xi .. Xs}:::lvivl_rel) sctn;\n        CHECKs (ST ''leaves_halfspace: not subset of plane'') b;\n        F \\<leftarrow> ode_set ({Xi .. Xs}:::appr_rel);\n        sF \\<leftarrow> Sup_inner F (normal sctn);\n        CHECKs (ST ''leaves_halfspace: not down from plane'') (sF < 0);\n        RETURN (Some sctn)\n      }\n    | _ \\<Rightarrow> do {CHECKs (ST ''leaves_halfspace: not a good halfspace'') False; SUCCEED})\n  }\"\n\ndefinition \"poincare_start_on guards sctn X0S =\n  do {\n    X0SS \\<leftarrow> sets_of_coll X0S;\n    (FORWEAK X0SS (RETURN (op_empty_coll:::clw_rel appr1e_rel, op_empty_coll:::clw_rel appr_rel)) (\\<lambda>X0. do {\n      mk_safe (fst ` X0);\n      startstep \\<leftarrow> start_stepsize_spec;\n      (h, err, CX1, X1) \\<leftarrow> choose_step1e X0 (startstep);\n      let _ = trace_set (ST ''interpolated start step:'') (Some CX1);\n      let _ = print_set True CX1;\n      let _ = trace_set1e (ST ''discrete start step:'') (Some X1);\n      let _ = print_set1e False X1;\n      let fX1 = op_image_fste X1;\n      c0 \\<leftarrow> below_sctn (op_image_fste X0) (sctn);\n      c1 \\<leftarrow> sbelow_sctn (fX1) (sctn);\n      c2 \\<leftarrow> disjoints_spec (mk_coll (fX1)) guards;\n      c3 \\<leftarrow> disjoints_spec (mk_coll (CX1)) guards;\n      mk_safe (fX1);\n      mk_safe (CX1);\n      D \\<leftarrow> (ode_set (CX1):::\\<langle>appr_rel\\<rangle>nres_rel);\n      d \\<leftarrow> Sup_inner D (normal sctn);\n      let _ = trace_set (ST ''poincare_start_on: D '') (Some D);\n      CHECKs (ST ''poincare_start_on: is away and really moves away'') (c0 \\<and> c1 \\<and> c2 \\<and> c3 \\<and> d < 0);\n      RETURN (mk_coll X1:::clw_rel appr1e_rel, (mk_coll CX1):::clw_rel appr_rel)\n    })\n    (\\<lambda>(X1, CX1) (X1S, CX1S). RETURN (op_union_coll X1 X1S:::clw_rel appr1e_rel, op_union_coll CX1 CX1S:::clw_rel appr_rel)))\n  }\"\n\ndefinition [simp]: \"isets_of_iivls x = x\"\n\nabbreviation \"inter_plane A B \\<equiv> mk_inter A (plane_of B)\"\n\ndefinition \"do_intersection_core guards ivl sctn hX =\n  do {\n    (h, eX) \\<leftarrow> get_info hX;\n    ((l, u), X) \\<leftarrow> scaleR2_rep eX;\n    (b, PS1, PS2, CXS) \\<leftarrow> do_intersection (guards:::clw_rel (iplane_rel lvivl_rel)) ivl sctn X h;\n    if b then do {\n      PS1e \\<leftarrow> scaleRe_ivl_coll_spec l u PS1;\n      PS2e \\<leftarrow> scaleRe_ivl_coll_spec l u PS2;\n      RETURN (PS1e, PS2e, CXS, op_empty_coll)\n    }\n    else RETURN (op_empty_coll, op_empty_coll, op_empty_coll, mk_coll eX)\n  }\"\n\ndefinition \"do_intersection_coll guards ivl sctn X =\n  do {\n    Xs \\<leftarrow> sets_of_coll X;\n    CHECKs ''nonempty inter nonfinite: '' (Xs \\<noteq> {});\n    RS \\<leftarrow> PAR_IMAGE (\\<lambda>X. \\<lambda>(P1, P2, CX, X0s).\n      do_intersection_spec UNIV guards ivl sctn (X - X0s) (P1, CX) \\<and>\n      do_intersection_spec UNIV guards ivl sctn (X - X0s) (P2, CX)\n      \\<and> fst ` (X - X0s) \\<subseteq> CX\n      \\<and> X0s \\<subseteq> X) (do_intersection_core guards ivl sctn) Xs;\n    ASSUME (finite RS);\n    RETURN ((\\<Union>(X, (P1, P2, CX, X0s))\\<in>RS. P1),\n            (\\<Union>(X, (P1, P2, CX, X0s))\\<in>RS. P2),\n            (\\<Union>(X, (P1, P2, CX, X0s))\\<in>RS. CX),\n            (\\<Union>(X, (P1, P2, CX, X0s))\\<in>RS. X0s))\n  }\"\n\ndefinition \"op_enlarge_ivl_sctn ivl sctn d = do {\n    (l, u) \\<leftarrow> ivl_rep ivl;\n    CHECKs ''op_enlarge_ivl_sctn: trying to shrink'' (d \\<ge> 0);\n    CHECKs ''op_enlarge_ivl_sctn: empty ivl'' (l \\<le> u);\n    CHECKs ''op_enlarge_ivl_sctn: not in Basis'' (abs (normal sctn) \\<in> set Basis_list);\n    let dOne = sum_list (map (\\<lambda>i. d *\\<^sub>R i) Basis_list) - d *\\<^sub>R abs (normal sctn);\n    ASSERT (l - dOne \\<le> u + dOne);\n    RETURN (op_atLeastAtMost_ivl (l - dOne) (u + dOne))\n  }\"\n\ndefinition \"guardset guards = Union (case_prod (\\<inter>) ` (\\<lambda>(x, y). (x, plane_of y)) ` guards)\"\n\ndefinition \"resolve_ivlplanes (guards::'n::enum rvec set)\n                          (ivlplanes::'n::enum rvec set)\n                          XS\n                           =\n  FORWEAK XS (RETURN ({}))\n     (\\<lambda>(ivlplane, X).\n      do {\n        (ivl, plane) \\<leftarrow> (get_inter (ivlplane));\n        ASSUME (closed ivl);\n        sctn \\<leftarrow> (get_plane plane);\n        b \\<leftarrow> subset_iplane_coll ivlplane ivlplanes;\n        CHECKs ''reach_conts: subsets_iplane_coll'' b;\n        (PS1, PS2, CXS, RS) \\<leftarrow> (do_intersection_coll guards ivl sctn X);\n        RETURN {(uninfo X, PS1, PS2, RS, ivl, sctn, CXS)}\n      })\n      (\\<lambda>(PS) (PS'). RETURN (PS' \\<union> PS))\"\n\ncontext includes autoref_syntax begin\ndefinition \"poincare_onto ro \\<comment> \\<open>options\\<close>\n                          symstart trap \\<comment> \\<open>symbolic start and trap\\<close>\n                          (guards::'n::enum rvec set) \\<comment> \\<open>avoiding guards\\<close>\n                          (ivlplanes::'n::enum rvec set) \\<comment> \\<open>target sections\\<close>\n                          (XS0::'n eucl1 set)\n                          (CXS0::'n rvec set)\n     =\n  do {\n    (CXS, XS, X0s) \\<leftarrow> (reach_conts ro (symstart:::appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel) trap (ivlplanes \\<union> guards) XS0:::\n      \\<langle>clw_rel appr_rel \\<times>\\<^sub>r \\<langle>iplane_rel lvivl_rel \\<times>\\<^sub>r clw_rel (iinfo_rel appr1e_rel)\\<rangle>list_wset_rel \\<times>\\<^sub>r\n     ghost_rel\\<rangle>nres_rel);\n    PS \\<leftarrow> resolve_ivlplanes guards ivlplanes XS;\n    _ \\<leftarrow> mk_safe_coll CXS0;\n    RETURN ((\\<lambda>(X, P1, P2, R, ivl, sctn, CX). (X, P1, P2, R, ivl, sctn, CX, CXS \\<union> CXS0)) ` PS)\n  }\"\n\ndefinition \"empty_remainders PS =\n  FORWEAK PS (RETURN True) (\\<lambda>(X, P1, P2, R, ivl, sctn, CX, CXS). do { e \\<leftarrow> isEmpty_spec R; RETURN e})\n    (\\<lambda>a b. RETURN (a \\<and> b))\"\n\ndefinition [simp]: \"empty_trap = {}\"\n\ndefinition empty_symstart::\"((real, 'a) vec \\<times> (real, 'a) vec \\<Rightarrow>\\<^sub>L (real, 'a) vec) set\n   \\<Rightarrow> ((real, 'a) vec set \\<times> ((real, 'a) vec \\<times> (real, 'a) vec \\<Rightarrow>\\<^sub>L (real, 'a) vec) set) nres\"\n  where [simp]: \"empty_symstart \\<equiv> \\<lambda>X. RETURN (op_empty_coll, mk_coll X)\"\n\ndefinition \"poincare_onto_empty ro \\<comment> \\<open>options\\<close>\n                          (guards::'n::enum rvec set) \\<comment> \\<open>avoiding guards\\<close>\n                          (ivlplanes::'n::enum rvec set) \\<comment> \\<open>target sections\\<close>\n                          (XS0::'n eucl1 set) =\n  poincare_onto ro (OP empty_symstart:::appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel)\n    empty_trap guards ivlplanes XS0\"\n\n\ndefinition \"poincare_onto2 ro \\<comment> \\<open>options\\<close>\n                          symstart trap \\<comment> \\<open>symbolic start and trap\\<close>\n                          (guards::'n::enum rvec set) \\<comment> \\<open>avoiding guards\\<close>\n                          (ivlplanes::'n::enum rvec set) \\<comment> \\<open>target sections\\<close>\n                          (XS0::'n eucl1 set) =\n  do {\n    (PS) \\<leftarrow> (poincare_onto ro (symstart:::appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel)\n      trap guards ivlplanes XS0 op_empty_coll:::\n      \\<langle>\\<langle>clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel \\<times>\\<^sub>r\n        clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel);\n    (PS2) \\<leftarrow> FORWEAK PS (RETURN ({})) (\\<lambda>(X, P1, P2, R, ivl, sctn, CX, CXS).\n      if op_coll_is_empty R then RETURN ({})\n      else do {\n        ivlplaness \\<leftarrow> (sets_of_coll ivlplanes:::\\<langle>\\<langle>iplane_rel lvivl_rel\\<rangle>list_wset_rel\\<rangle>nres_rel);\n        ivlplaness' \\<leftarrow> op_set_ndelete (mk_inter ivl (plane_of sctn)) ivlplaness;\n        let ivlplanes' = (\\<Union>(mk_coll ` ivlplaness':::\\<langle>clw_rel (iplane_rel lvivl_rel)\\<rangle>list_wset_rel));\n        PS' \\<leftarrow> (poincare_onto_empty ro (guards) ivlplanes' R CXS:::\n            \\<langle>\\<langle>clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel\n            \\<times>\\<^sub>r clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel);\n        b \\<leftarrow> empty_remainders PS';\n        CHECKs (ST ''poincare_onto2: empty remainders!'') b;\n        ASSUME (finite PS');\n        RETURN PS'\n        }) (\\<lambda>PS PS'. RETURN (PS' \\<union> PS));\n      RETURN (Pair True ` PS2 \\<union> Pair False ` PS)\n    }\"\n\ndefinition \"width_spec_ivl M x = do {\n    (i, s) \\<leftarrow> ivl_rep x;\n    RETURN (\\<Sum>(i, s)\\<leftarrow>zip (take M (list_of_eucl i)) (take M (list_of_eucl s)). abs (s - i))\n  }\"\n\ndefinition partition_ivl::\"_ \\<Rightarrow> 'a::executable_euclidean_space set \\<Rightarrow> 'a::executable_euclidean_space set nres\"\n  where\n \"partition_ivl roptns xs = (if op_coll_is_empty xs then RETURN (op_empty_coll:::clw_rel lvivl_rel) else do {\n    (i, s) \\<leftarrow> ivl_rep_of_set_coll (sets_of_ivls (xs:::clw_rel lvivl_rel):::clw_rel appr_rel);\n    ASSERT (i \\<le> s);\n    let r = (op_atLeastAtMost_ivl i s);\n    (rs, ps) \\<leftarrow>\n      WHILE\\<^bsup>(\\<lambda>(rs, ps). (xs) \\<subseteq> rs \\<union> ps)\\<^esup> (\\<lambda>(rs, ps). \\<not> op_coll_is_empty (rs:::clw_rel lvivl_rel))\n      (\\<lambda>(rs, ps).\n      do {\n        (r, rs') \\<leftarrow> (split_spec_exact rs:::\\<langle>lvivl_rel \\<times>\\<^sub>r clw_rel lvivl_rel\\<rangle>nres_rel);\n        (ri, rs) \\<leftarrow> ivl_rep r;\n        CHECKs (ST ''partition_ivl with strange ivl'') (ri \\<le> rs);\n        width \\<leftarrow> width_spec ({ri .. rs}:::appr_rel);\n        pig \\<leftarrow> post_inter_granularity_spec roptns;\n        if width \\<le> pig then\n          RETURN (rs', mk_coll r \\<union> ps)\n        else do {\n          (a, b) \\<leftarrow> split_spec_ivl (DIM('a)) r;\n          let isa = (op_inter_ivl_coll (xs:::clw_rel lvivl_rel) (a:::lvivl_rel));\n          let isb = (op_inter_ivl_coll(xs:::clw_rel lvivl_rel) (b:::lvivl_rel));\n          ra' \\<leftarrow> (if op_coll_is_empty isa then RETURN op_empty_coll else do {\n            (i', s') \\<leftarrow> ivl_rep_of_set_coll (sets_of_ivls isa);\n            RETURN (mk_coll (({i' .. s'}:::lvivl_rel) \\<inter> a))\n          });\n          rb' \\<leftarrow> (if op_coll_is_empty isb then RETURN op_empty_coll else do {\n            (i', s') \\<leftarrow> ivl_rep_of_set_coll (sets_of_ivls isb);\n            RETURN (mk_coll (({i' .. s'}:::lvivl_rel) \\<inter> b))\n          });\n          RETURN (ra' \\<union> rb' \\<union> rs', ps)\n        }\n      }) (mk_coll r:::clw_rel lvivl_rel, op_empty_coll :::clw_rel lvivl_rel);\n    RETURN ps\n  })\"\n\ndefinition\n  \"vec1repse X = do {\n    XS \\<leftarrow> sets_of_coll X;\n    FORWEAK XS (RETURN (Some op_empty_coll))\n      (\\<lambda>x. do {\n        ((l, u), x) \\<leftarrow> scaleR2_rep x;\n        xo \\<leftarrow> vec1rep x;\n        case xo of None \\<Rightarrow> RETURN None\n        | Some x \\<Rightarrow> do {\n            xe \\<leftarrow> scaleRe_ivl_spec l u x;\n            RETURN (Some (mk_coll xe))\n          }\n      })\n      (\\<lambda>a b.\n        case (a, b) of (Some a, Some b) \\<Rightarrow> RETURN (Some (b \\<union> a))\n        | _ \\<Rightarrow> RETURN None)\n  }\"\n\nabbreviation \"appre_rel \\<equiv> \\<langle>appr_rel\\<rangle>scaleR2_rel\"\n\ndefinition \"scaleR2_rep1 (Y::('a::executable_euclidean_space\\<times>_) set) = do {\n    let D = DIM('a);\n    ((l, u), X) \\<leftarrow> scaleR2_rep Y;\n    (i, s) \\<leftarrow> op_ivl_rep_of_set X;\n    let mig = inf (abs i) (abs s);\n    CHECKs (ST ''scaleR2_rep1: strange'') (i \\<le> s);\n    (N::real set) \\<leftarrow> approx_slp_appr [floatarith.Inverse (norm2\\<^sub>e D)] (norm2_slp D) (list_of_eucl ` ({mig .. mig}:::appr_rel));\n    (sl, su) \\<leftarrow> op_ivl_rep_of_set (N:::appr_rel);\n    let scale = (rnv_of_lv sl + rnv_of_lv su)/2;\n    CHECKs (ST ''scaleR2_rep1: scale 0'') (scale > 0);\n    CHECKs (ST ''scaleR2_rep1: l 0'') (l > 0);\n    CHECKs (ST ''scaleR2_rep1: u 0'') (u > 0);\n    precision \\<leftarrow> precision_spec;\n    let scalel = real_divl (precision) 1 scale;\n    let scaleu = real_divr (precision) 1 scale;\n    CHECKs (ST ''scaleR2_rep1: scalel 0'') (scalel > 0);\n    CHECKs (ST ''scaleR2_rep1: scaleu 0'') (scaleu > 0);\n    (i, s) \\<leftarrow> op_ivl_rep_of_set X;\n    let (i0, i1) = split_lv_rel i;\n    let (s0, s1) = split_lv_rel s;\n    scaleRe_ivl_spec (scalel * l) (scaleu * u)\n      (op_atLeastAtMost_ivl (Pair_lv_rel i0 (scale *\\<^sub>R i1)) (Pair_lv_rel s0 (scale *\\<^sub>R s1)))\n  }\"\n\ndefinition \"ivlse_of_setse X = do {\n  Xs \\<leftarrow> sets_of_coll X;\n  FORWEAK Xs (RETURN op_empty_coll) (\\<lambda>X. do {\n    I \\<leftarrow> scaleR2_rep1 X;\n    I \\<leftarrow> reduces_ivle I;\n    RETURN (mk_coll I)\n  }) (\\<lambda>X' X. RETURN (X' \\<union> X))\n  }\"\n\ndefinition [simp]: \"op_image_flow1_of_vec1_colle \\<equiv> op_image_flow1_of_vec1_coll\"\n\ndefinition \"okay_granularity ro r = do {\n    (ri, rs) \\<leftarrow> ivl_rep r;\n    CHECKs (ST ''partition_ivle with strange ivl'') (ri \\<le> rs);\n    width \\<leftarrow> width_spec ({ri .. rs}:::appr_rel);\n    pig \\<leftarrow> post_inter_granularity_spec ro;\n    RETURN (width\\<le>pig)\n  }\"\n\ndefinition partition_set::\"unit \\<Rightarrow> 'n::enum eucl1 set \\<Rightarrow> 'n eucl1 set nres\"\n  where\n    \"partition_set ro xs =\n    (if op_coll_is_empty xs then RETURN (op_empty_coll:::clw_rel appr1e_rel) else do {\n    ASSERT (xs \\<noteq> {});\n    pcg \\<leftarrow> pre_collect_granularity_spec ro;\n    xs \\<leftarrow> split_under_threshold ro pcg\n            (xs:::clw_rel appr1e_rel);\n    vxs \\<leftarrow> vec1repse xs;\n    case vxs of None \\<Rightarrow> do {\n      xs \\<leftarrow> ivls_of_sets (op_image_fst_colle xs);\n      ps \\<leftarrow> partition_ivl ro xs;\n      scaleRe_ivl_coll_spec 1 1 (sets_of_ivls ps \\<times> UNIV:::clw_rel appr1_rel)\n    }\n    | Some xs \\<Rightarrow> do {\n      xs \\<leftarrow> ivlse_of_setse xs;\n      ps \\<leftarrow> (OP partition_ivle) $ ro $ xs;\n      ps \\<leftarrow> setse_of_ivlse ps;\n      RETURN (op_image_flow1_of_vec1_colle ps)\n    }\n  })\"\n\ndefinition partition_sets::\"unit \\<Rightarrow>\n  (bool \\<times> 'a::enum eucl1 set \\<times> 'a::enum eucl1 set \\<times> 'a::enum eucl1 set \\<times> 'a::enum eucl1 set \\<times> 'a rvec set \\<times> 'a rvec sctn \\<times> 'a rvec set \\<times> 'a rvec set) set \\<Rightarrow>\n  'a eucl1 set nres\"\n  where\n \"partition_sets ro xs =\n    FORWEAK xs (RETURN op_empty_coll) (\\<lambda>(b, X, PS1, PS2, R, ivl', sctn', CX, CXS). do {\n      PS \\<leftarrow> partition_set ro PS1;\n      RETURN PS\n    })\n    (\\<lambda>a b. RETURN (b \\<union> a))\"\n\ndefinition \"ivlsctn_to_set xs = (\\<Union>(ivl, sctn)\\<in>set xs. ivl \\<inter> plane_of sctn)\"\n\ndefinition [refine_vcg_def]: \"singleton_spec X = SPEC (\\<lambda>x. X = {x})\"\n\nprimrec poincare_onto_series where\n  \"poincare_onto_series interrupt trap [] XS0 ivl sctn ro = do {\n    let guard0 = mk_coll (mk_inter ivl (plane_of sctn));\n    ASSUME (closed guard0);\n    XS1 \\<leftarrow> (poincare_onto2 (ro:::Id)\n       (interrupt:::appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel) trap\n        (op_empty_coll:::clw_rel (iplane_rel lvivl_rel)) guard0 XS0:::\n      \\<langle>\\<langle>bool_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel \\<times>\\<^sub>r\n      clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel);\n    (b, X, PS1, PS2, R, ivl', sctn', CX, CXS) \\<leftarrow> singleton_spec XS1;\n    CHECKs (ST ''poincare_onto_series: last return!'') (ivl' = ivl \\<and> sctn' = sctn);\n    RETURN PS2\n  }\"\n| \"poincare_onto_series interrupt trap ((guardro)#guards) XS0 ivl sctn ro0 = (case guardro of (guard, ro) \\<Rightarrow>\n    do {\n      ASSUME (closed ivl);\n      let guard0 = mk_coll (mk_inter ivl (plane_of sctn));\n      ASSUME (closed guard0);\n      ASSUME (\\<forall>(guard, ro) \\<in> set (guardro#guards). closed guard);\n      let guardset = (\\<Union>(guard, ro)\\<in>set ((guard0, ro0)#guards). guard);\n      XS1 \\<leftarrow> (poincare_onto2 ro (interrupt:::appr1e_rel \\<rightarrow> \\<langle>clw_rel appr_rel \\<times>\\<^sub>r clw_rel appr1e_rel\\<rangle>nres_rel) trap (guardset:::clw_rel (iplane_rel lvivl_rel)) guard XS0 :::\n        \\<langle>\\<langle>bool_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r clw_rel appr1e_rel \\<times>\\<^sub>r lvivl_rel \\<times>\\<^sub>r \\<langle>lv_rel\\<rangle>sctn_rel \\<times>\\<^sub>r\n      clw_rel (isbelows_rel appr_rel) \\<times>\\<^sub>r clw_rel appr_rel\\<rangle>list_wset_rel\\<rangle>nres_rel);\n      ASSUME (\\<forall>(b, X, PS1, PS1, R, ivl, sctn, CX, CXS) \\<in> XS1. closed ivl);\n      XS2 \\<leftarrow> partition_sets ro XS1;\n      _ \\<leftarrow> fst_safe_colle XS2;\n      XS3 \\<leftarrow> poincare_onto_series interrupt trap guards XS2 ivl sctn (ro0:::Id);\n      RETURN XS3\n    })\"\n\ndefinition \"poincare_onto_from interrupt trap\n                               S                      \\<comment> \\<open>leaving this (half)space in the beginning\\<close>\n                          (guards)                    \\<comment> \\<open>avoiding guards\\<close>\n                          (ivl::'n rvec set)          \\<comment> \\<open>onto \\<open>ivl\\<close>\\<close>\n                          sctn                        \\<comment> \\<open>which is part of \\<open>sctn\\<close>\\<close>\n                          ro\n                          (XS0::'n::enum eucl1 set) =\n  do {\n    ASSUME (closed ivl);\n    let guardset = (\\<Union>(ivlsctn, ro)\\<in>set (guards). ivlsctn:::clw_rel (iplane_rel lvivl_rel));\n    lsctn \\<leftarrow> leaves_halfspace S (op_image_fst_colle XS0);\n    XS0 \\<leftarrow> (case lsctn of\n        None \\<Rightarrow> RETURN XS0\n      | Some lsctn =>\n        do {\n            CHECKs (ST ''poincare_onto_from: section only makes sense if start section = end section'')\n              (lsctn = sctn \\<or> normal lsctn = - normal sctn \\<and> pstn lsctn = - pstn sctn);\n            guards \\<leftarrow> unintersect_coll guardset;\n            b \\<leftarrow> subset_spec_coll (op_image_fst_colle XS0) ivl;\n            CHECKs (ST ''poincare_onto_from: section only makes sense if we start from there'') b;\n            (XS0, _) \\<leftarrow> poincare_start_on guards lsctn (XS0);\n            RETURN XS0\n        }\n      );\n    PS \\<leftarrow> poincare_onto_series interrupt trap guards XS0 ivl sctn ro;\n    RETURN PS\n  }\"\n\ndefinition \"subset_spec1 R P dP = do {\n    R1 \\<leftarrow> vec1rep R;\n    dP \\<leftarrow> default_rep UNIV dP;\n    case (R1, dP) of (_, None) \\<Rightarrow>\n      op_subset (fst ` R) P\n    | (Some RdR, Some dP) \\<Rightarrow>\n      op_subset RdR (P \\<times> dP)\n    | (None, Some _) \\<Rightarrow> RETURN False\n  }\"\n\ndefinition \"subset_spec1_coll R P dP = do {\n    XS \\<leftarrow> sets_of_coll R;\n    WEAK_ALL (\\<lambda>x. x \\<subseteq> flow1_of_vec1 ` (P \\<times> dP)) XS (\\<lambda>X. subset_spec1 X P dP)\n  }\"\n\ndefinition \"one_step_until_time X0 (ph::bool) (t1::real) =\n  do {\n    CHECKs ''one_step_until_time optns'' (0 \\<le> t1);\n    startstep \\<leftarrow> start_stepsize_spec;\n    rk2param \\<leftarrow> rk2_param_spec;\n    let fX0 = fst ` X0;\n    mk_safe (fX0);\n    (t, _, X, CX) \\<leftarrow> WHILE (\\<lambda>(t, _, _, _). t < t1) (\\<lambda>(t, h, X, CXs). do {\n        let _ = trace_set1e (ST ''choose step from:'') (Some X);\n        (h0, CX, X, h') \\<leftarrow> step_adapt_time X (min h (t1 - t));\n        CHECKs (ST ''one_step negative step'') (h0 \\<ge> 0 \\<and> h' > 0 \\<and> h0 \\<le> min h (t1 - t));\n        let _ = trace_set (ST ''interpolated step:'') (Some CX);\n        let _ = print_set True CX;\n        let _ = trace_set1e (ST ''step:'') (Some X);\n        let _ = print_set1e False X;\n        let fCX = CX;\n        mk_safe fCX;\n        let fX = fst ` X;\n        mk_safe fX;\n        RETURN (t + h0, h', X, mk_phantom (mk_coll CX) \\<union> CXs)\n    }) (0::real, startstep, X0, op_union_phantom (mk_phantom (mk_coll fX0)) (op_empty_phantom ph));\n    RETURN (X, CX)\n  }\"\n\ndefinition \"ivl_of_eucl_coll CY =\n  do {\n    (i, s) \\<leftarrow> ivl_rep_of_set_coll CY;\n    ASSERT (i \\<le> s);\n    RETURN (({i .. s}\\<times>UNIV):::appr1_rel)\n  }\"\n\ndefinition \"one_step_until_time_ivl X0 (ph::bool) (t1::real) (t2::real) =\n  do {\n    (X, CX) \\<leftarrow>  one_step_until_time X0 ph t1;\n    CHECKs (ST ''one_step_until_time_ivl empty time interval'') (0 \\<le> t1 \\<and> t1 \\<le> t2);\n    (if t2 = t1 then RETURN (X, CX)\n    else do {\n      (Y, CYp) \\<leftarrow> one_step_until_time X False (t2 - t1);\n      CY \\<leftarrow> get_phantom CYp;\n      R \\<leftarrow> ivl_of_eucl_coll CY;\n      mk_safe (fst ` R);\n      R \\<leftarrow> scaleRe_ivl_spec 1 1 R;\n      RETURN (R, CYp \\<union> CX)\n    })\n  }\"\n\ndefinition \"c1_info_invare n X = (let l = (fst (fst X)); u = (snd (fst X))\n  in (c1_info_invar n (snd X)) \\<and> (l < u \\<or> -\\<infinity> < l \\<and> l \\<le> u \\<and> u < \\<infinity>))\"\n\ndefinition \"c0_info_of_appr X = eucl_of_list ` set_of_appr X\"\ndefinition \"c0_info_of_apprs X = (\\<Union>x\\<in>set X. c0_info_of_appr x)\"\n\ndefinition \"c0_info_of_appr' X = the_default UNIV (map_option c0_info_of_apprs X)\"\n\nlemma the_default_eq: \"the_default a x = (case x of None \\<Rightarrow> a | Some b \\<Rightarrow> b)\"\n  by (auto split: option.splits)\n\ndefinition \"poincare_onto_from_in_ivl interrupt trap\n                               S                      \\<comment> \\<open>leaving this (half)space in the beginning\\<close>\n                          (guards)                    \\<comment> \\<open>avoiding guards\\<close>\n                          (ivl::'n rvec set)          \\<comment> \\<open>onto \\<open>ivl\\<close>\\<close>\n                          sctn                        \\<comment> \\<open>which is part of \\<open>sctn\\<close>\\<close>\n                          ro\n                          (XS0::'n::enum eucl1 set)\n                          P dP =\n  do {\n    RS \\<leftarrow> poincare_onto_from interrupt trap S guards ivl sctn ro XS0;\n    ((l, u), R) \\<leftarrow> scaleR2_rep_coll RS;\n    CHECKs (ST ''poincare_onto_from_in: there should not be scaleR2'') (l = 1 \\<and> u = 1);\n    (l, u) \\<leftarrow> ivl_rep P;\n    CHECKs (ST ''poincare_onto_from_in: strange interval'') (l \\<le> u);\n    _ \\<leftarrow> mk_safe {l .. u};\n    subset_spec1_coll R P dP\n  }\"\n\ndefinition \"set_of_lvivl' x = (case x of None \\<Rightarrow> UNIV | Some x \\<Rightarrow> set_of_lvivl x)\"\n\ndefinition \"lvivl'_invar n x =\n  (case x of None \\<Rightarrow> True | Some (l, u) \\<Rightarrow> length l = length u \\<and> length u = n)\"\n\ndefinition \"one_step_until_time_ivl_in_ivl X0 (t1::real) (t2::real) R dR =\n  do {\n    (X, CX) \\<leftarrow> one_step_until_time_ivl X0 True t1 t2;\n    ((l, u), X) \\<leftarrow> scaleR2_rep X;\n    CHECKs (ST ''one_step_until_time_ivl_in_ivl: there should not be scaleR2'') (l = 1 \\<and> u = 1);\n    (l, u) \\<leftarrow> ivl_rep R;\n    CHECKs (ST ''one_step_until_time_ivl_in_ivl: strange interval'') (l \\<le> u);\n    _ \\<leftarrow> mk_safe {l .. u};\n    let _ = trace_set1 (ST ''final step to:'') (Some X);\n    let _ = trace_set (ST ''contained in?'') (Some {l .. u});\n    let _ = print_set1 False X;\n    let _ = print_set False {l .. u};\n    subset_spec1 X R dR\n}\"\n\ndefinition \"poincare_onto_in_ivl\n                          (guards)                    \\<comment> \\<open>avoiding guards\\<close>\n                          (ivl::'n rvec set)          \\<comment> \\<open>onto \\<open>ivl\\<close>\\<close>\n                          sctn                        \\<comment> \\<open>which is part of \\<open>sctn\\<close>\\<close>\n                          ro\n                          (XS0::'n::enum eucl1 set)\n                          P dP =\n  do {\n    RS \\<leftarrow> poincare_onto_series empty_symstart empty_trap guards XS0 ivl sctn ro;\n    ((l, u), R) \\<leftarrow> scaleR2_rep_coll RS;\n    CHECKs (ST ''poincare_onto_in_ivl: there should not be scaleR2'') (l = 1 \\<and> u = 1);\n    (l, u) \\<leftarrow> ivl_rep P;\n    CHECKs (ST ''poincare_onto_in_ivl: strange interval'') (l \\<le> u);\n    (lR, uR) \\<leftarrow> ivl_rep_of_set_coll (op_image_fst_coll R);\n    CHECKs (ST ''poincare_onto_in_ivl: strange interval2'') (lR \\<le> uR);\n    let _ = trace_set (ST ''final step to:'') (Some {lR .. uR});\n    let _ = trace_set (ST ''contained in?'') (Some {l .. u});\n    _ \\<leftarrow> mk_safe {l .. u};\n    subset_spec1_coll R P dP\n  }\"\n\ndefinition \"poincare_maps_onto \\<Sigma> X0 X1 \\<longleftrightarrow> poincare_mapsto \\<Sigma> X0 UNIV (Csafe - \\<Sigma>) X1\"\n\nend\n\nend\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Ordinary_Differential_Equations/Numerics/Abstract_Reachability_Analysis_C1.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241632752914, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.31061633388351456}}
{"text": "theory Finite_Linear_Ops\n\nimports\n  Finite_Linear_Model\nbegin\n\nsubsection \\<open> Operators \\<close>\n\ndefinition Div :: \"'e fltraces\" where\n\"Div = {\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>}\"\n\nlemma FL2_Div [simp]:\n  \"FL2 Div\"\n  unfolding FL2_def Div_def apply auto\n  by (metis Finite_Linear_Model.last.simps(1) amember.simps(1) concat_FL_last_not_bullet_absorb last_bullet_then_last_cons)\n\ndefinition Stop :: \"'e fltraces\" where\n\"Stop = {\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>} \\<union> {\\<langle>[{}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>}\"\n\nlemma Stop_is_FL2 [simp]: \"FL2 Stop\"\n  unfolding FL2_def Stop_def apply auto\n  apply (metis Finite_Linear_Model.last.simps(1) acceptance.inject amember.elims(2) concat_FL_last_not_bullet_absorb empty_iff last_bullet_then_last_cons)\n  by (metis Finite_Linear_Model.last.simps(1) amember.simps(1) concat_FL_last_not_bullet_absorb last_bullet_then_last_cons)\n\ndefinition prefixH :: \"'e \\<Rightarrow> 'e fltrace \\<Rightarrow> 'e fltrace \\<Rightarrow> bool\" where\n\"prefixH a aa X = (X = \\<langle>[{a}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<or> X = \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<or> X = ([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> aa \\<or> X = (\\<bullet>,a)\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> aa)\"\n\ndefinition Prefix :: \"'e \\<Rightarrow> 'e fltraces \\<Rightarrow> 'e fltraces\" (infixl \"\\<rightarrow>\\<^sub>\\<F>\\<^sub>\\<L>\" 65) where\n\"a \\<rightarrow>\\<^sub>\\<F>\\<^sub>\\<L> P = {\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>} \\<union> {\\<langle>[{a}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>} \\<union> {([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L>#\\<^sub>\\<F>\\<^sub>\\<L>\\<rho>| \\<rho>. \\<rho> \\<in> P} \\<union> {(\\<bullet>,a)\\<^sub>\\<F>\\<^sub>\\<L>#\\<^sub>\\<F>\\<^sub>\\<L>\\<rho>| \\<rho>. \\<rho> \\<in> P}\"\n\ndefinition PrefixAlt :: \"'e \\<Rightarrow> 'e fltraces \\<Rightarrow> 'e fltraces\" where\n\"PrefixAlt a P = {x|s x. prefixH a s x \\<and> s\\<in>P}\"\n\n(*\nlemma eq_acceptances [simp]:\n  \"([{aa}]\\<^sub>\\<F>\\<^sub>\\<L>,aa)\\<^sub>\\<F>\\<^sub>\\<L> = ([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L> \\<longleftrightarrow> a = aa\"\n  apply auto\n  by (simp add: acceptance_pair_eq)\n\nlemma unequal_acceptances [simp]:\n  \"([{aa}]\\<^sub>\\<F>\\<^sub>\\<L>,aa)\\<^sub>\\<F>\\<^sub>\\<L> \\<noteq> (\\<bullet>,a)\\<^sub>\\<F>\\<^sub>\\<L>\"\n  apply auto\n  by (metis acceptance.distinct(1) acceptance_set amember.simps(2) singletonI)\n\nlemma unequal_acceptances_2 [simp]:\n  \"(\\<bullet>,a)\\<^sub>\\<F>\\<^sub>\\<L> \\<noteq> ([{aa}]\\<^sub>\\<F>\\<^sub>\\<L>,aa)\\<^sub>\\<F>\\<^sub>\\<L>\"\n  apply auto\n  by (metis acceptance.distinct(1) acceptance_set amember.simps(2) singletonI)\n\nlemma eq_acceptances_bullet [simp]:\n  \"(\\<bullet>,aa)\\<^sub>\\<F>\\<^sub>\\<L> = (\\<bullet>,a)\\<^sub>\\<F>\\<^sub>\\<L> \\<longleftrightarrow> aa = a\"\n  apply auto\n  by (metis acceptance_event)*)\n\nlemma Prefix_PrefixAlt_eq:\n  assumes \"FL0 P\" \"FL1 P\"\n  shows \"Prefix a P = PrefixAlt a P\"\n  using assms unfolding Prefix_def PrefixAlt_def prefixH_def apply auto\n  using FL0_def apply fastforce\n  using FL0_def by fastforce\n\ndefinition IntChoice :: \"'e fltraces \\<Rightarrow> 'e fltraces \\<Rightarrow> 'e fltraces\" (infixl \"\\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L>\" 65) where\n\"P \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> Q \\<equiv> P \\<union> Q\"\n\nfun ExtChoiceH :: \"'e fltrace \\<Rightarrow> 'e fltrace \\<Rightarrow> 'e fltrace \\<Rightarrow> bool\" where\n\"ExtChoiceH \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<langle>B\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> X = (X = \\<langle>A \\<union>\\<^sub>\\<F>\\<^sub>\\<L> B\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>)\" |\n\"ExtChoiceH (A #\\<^sub>\\<F>\\<^sub>\\<L> aa) (B #\\<^sub>\\<F>\\<^sub>\\<L> bb) X = \n  (X = ((acceptance(A) \\<union>\\<^sub>\\<F>\\<^sub>\\<L> acceptance(B),event(A))\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> aa)\n   \\<or> \n   X = ((acceptance(A) \\<union>\\<^sub>\\<F>\\<^sub>\\<L> acceptance(B),event(B))\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> bb))\" |\n\"ExtChoiceH \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> (B #\\<^sub>\\<F>\\<^sub>\\<L> bb) X = \n  (X = \\<langle>A \\<union>\\<^sub>\\<F>\\<^sub>\\<L> acceptance(B)\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<or> X = ((A \\<union>\\<^sub>\\<F>\\<^sub>\\<L> acceptance(B),event(B))\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> bb))\" |\n\"ExtChoiceH (A #\\<^sub>\\<F>\\<^sub>\\<L> aa) \\<langle>B\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> X = \n  (X = \\<langle>acceptance(A) \\<union>\\<^sub>\\<F>\\<^sub>\\<L> B\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> \\<or> X = ((acceptance(A) \\<union>\\<^sub>\\<F>\\<^sub>\\<L> B,event(A))\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> aa))\"\n\ndefinition ExtChoice :: \"'e fltraces \\<Rightarrow> 'e fltraces \\<Rightarrow> 'e fltraces\" (infixl \"\\<box>\\<^sub>\\<F>\\<^sub>\\<L>\" 65) where\n\"P \\<box>\\<^sub>\\<F>\\<^sub>\\<L> Q = {X| X A B. ExtChoiceH A B X \\<and> A \\<in> P \\<and> B \\<in> Q}\"\n\nfun HideAcceptance :: \"'e acceptance \\<Rightarrow> 'e set \\<Rightarrow> 'e acceptance\" where\n\"HideAcceptance \\<bullet> X = \\<bullet>\" |\n\"HideAcceptance [A]\\<^sub>\\<F>\\<^sub>\\<L> X = (if A \\<inter> X = {} then [A]\\<^sub>\\<F>\\<^sub>\\<L> else \\<bullet>)\"\n\nfun HideFL :: \"'e fltrace \\<Rightarrow> 'e set \\<Rightarrow> 'e fltrace\" where\n\"HideFL \\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> X = \\<langle>HideAcceptance A X\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\" |\n\"HideFL (A #\\<^sub>\\<F>\\<^sub>\\<L> aa) X = (if event(A) \\<in> X then (HideFL aa X) \n                          else (HideAcceptance (acceptance(A)) X,event(A))\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> (HideFL aa X))\"\n\ndefinition Hiding :: \"'e fltraces \\<Rightarrow> 'e set \\<Rightarrow> 'e fltraces\" (infixl \"\\\\\\<^sub>\\<F>\\<^sub>\\<L>\" 65) where\n\"P \\\\\\<^sub>\\<F>\\<^sub>\\<L> X = {HideFL s X|s. s \\<in> P}\"\n\nlemma ExtChoiceH_bullet:\n  assumes \"ExtChoiceH \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> B x\" \"B \\<in> P\" \"FL1 P\"\n  shows \"x \\<in> P\"\n  using assms apply (cases B, auto) \n  apply (metis FL0_FL1_bullet_in_so aunion.simps(1) unionA_sym)\n  using acceptance_bullet_event_FL1 by blast\n\nlemma ExtChoiceH_emptyset:\n  assumes \"ExtChoiceH \\<langle>[{}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> B x\" \"B \\<in> P\" \"FL1 P\"\n  shows \"x \\<in> P\"\n  using assms apply (cases B, auto, case_tac x21, auto)\n    apply (case_tac a, auto)\n    apply (simp add: aevent_less_eq_FL1)\n  by (case_tac x21, auto)\n\n(*\nlemma ExtChoice_Div_zero:\n  assumes \"FL0 P\" \"FL1 P\"\n  shows \"Div \\<box>\\<^sub>\\<F>\\<^sub>\\<L> P = Div\"\n  using assms unfolding Div_def ExtChoice_def apply auto\n   apply (simp add: ExtChoiceH_bullet_then)\n  using FL0_FL1_bullet_in by force\n*)\n\nlemma ExtChoiceH_exists:\n  assumes \"x \\<in> P\"\n  shows \"\\<exists>B. (ExtChoiceH \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> B x \\<or> ExtChoiceH \\<langle>[{}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> B x) \\<and> B \\<in> P\"\n  using assms\nproof (cases x)\n  case (Acceptance x1)\n  then show ?thesis\n  proof (cases x1)\n    case acnil\n    then show ?thesis using Acceptance assms apply auto\n      by (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n  next\n    case (acset x2)\n    then show ?thesis using Acceptance assms apply auto\n      by (rule exI[where x=\"\\<langle>[x2]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n  qed\nnext\n  case (AEvent x21 x22)\n  then show ?thesis \n  proof (cases \"acceptance(x21) = \\<bullet>\")\n    case True\n    then show ?thesis using AEvent assms apply auto\n      apply (case_tac x21, auto)\n      by (rule exI[where x=\"((\\<bullet>,event(x21))\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> x22)\"], auto)\n  next\n    case acceptance_not_bullet:False\n    then obtain A b where Ab:\"x21 = ([A]\\<^sub>\\<F>\\<^sub>\\<L>,b)\\<^sub>\\<F>\\<^sub>\\<L> \\<and> b \\<in>\\<^sub>\\<F>\\<^sub>\\<L> [A]\\<^sub>\\<F>\\<^sub>\\<L>\"\n      by (metis Rep_aevent_inverse acceptance.rep_eq amember.elims(2) event.rep_eq event_in_acceptance prod.collapse)\n    then show ?thesis \n    proof (cases \"A = {}\")\n      case True\n      then show ?thesis using acceptance_not_bullet AEvent Ab by auto\n    next\n      case False\n      then show ?thesis using acceptance_not_bullet AEvent Ab assms\n        by (intro exI[where x=\"(([A]\\<^sub>\\<F>\\<^sub>\\<L>,b)\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> x22)\"], auto)\n    qed\n  qed\nqed\n\n\nlemma\n  assumes \"FL1 P\" \"x \\<in> P\" \n  shows \"(\\<exists>B. ExtChoiceH \\<langle>[{}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> B x \\<and> B \\<in> P) \\<or> (\\<exists>B. ExtChoiceH \\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L> B x \\<and> B \\<in> P)\"\n  using assms apply auto\n  apply (intro exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n  oops\n\nlemma ExtChoiceH_triple_refl: \"ExtChoiceH x x x\"\n  apply (induct x rule:fltrace.induct, auto)\n  by (case_tac x, auto, case_tac x1a, auto, case_tac a, auto)\n\nlemma ExtChoiceH_sym: \"ExtChoiceH A B x = ExtChoiceH B A x\"\n  by (induct A B x rule:ExtChoiceH.induct, auto)\n\nlemma ExtChoice_refines_double:\n  \"P \\<box>\\<^sub>\\<F>\\<^sub>\\<L> P \\<sqsubseteq>\\<^sub>\\<F>\\<^sub>\\<L> P\"\n  unfolding ExtChoice_def apply auto\n  using ExtChoiceH_triple_refl by blast\n\n(*\nlemma\n  assumes \"s \\<le> t\" \"FL1 P\" \"FL1 Q\"\n          \"ExtChoiceH A B t\" \"A \\<in> P\" \"B \\<in> Q\"\n    shows \"\\<exists>A B. ExtChoiceH A B s \\<and> A \\<in> P \\<and> B \\<in> Q\"\n  using assms \nproof (induct A B t arbitrary:s rule:ExtChoiceH.induct)\n  case (1 A B X)\n  then show ?case \n    apply auto\n    apply (cases s, auto, case_tac x1, auto)\n     apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"])\n     apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n    apply (cases A, auto, cases B, auto, cases B, auto)\n    by (metis \"1.prems\"(4))\nnext\n  case ExtChoiceH2:(2 A aa B bb X)\n  then show ?case\n  proof (induct s X rule:less_eq_fltrace.induct)\n    case (1 x y)\n    then show ?case using ExtChoiceH2 by auto\n  next\n    case (2 x y ys)\n    then have \"x \\<le> acceptance(y)\"\n      using less_eq_fltrace.simps(2) by blast\n    then show ?case using 2\n       apply (cases x, auto)\n        apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"],rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n        apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"],rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n       apply (rule exI[where x=\"\\<langle>acceptance(A)\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"])\n       apply (rule exI[where x=\"\\<langle>acceptance(B)\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"])\n       apply auto\n      using less_eq_acceptance.elims(2) apply force\n      using FL_cons_acceptance apply blast\n      using FL_cons_acceptance apply blast\n       apply (rule exI[where x=\"\\<langle>acceptance(A)\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"])\n       apply (rule exI[where x=\"\\<langle>acceptance(B)\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"])\n       apply auto\n      using less_eq_acceptance.elims(2) apply force\n      using FL_cons_acceptance apply blast\n      using FL_cons_acceptance by blast\n  next\n    case (3 x xs y ys)\n    have \"event A \\<in>\\<^sub>\\<F>\\<^sub>\\<L> (acceptance A \\<union>\\<^sub>\\<F>\\<^sub>\\<L> acceptance B) \\<or> acceptance A \\<union>\\<^sub>\\<F>\\<^sub>\\<L> acceptance B = \\<bullet>\"\n      by (cases A, auto, cases B, auto, case_tac a, auto, case_tac aa, auto, case_tac a, auto)\n    then have \"x = (acceptance A \\<union>\\<^sub>\\<F>\\<^sub>\\<L> acceptance B,event A)\\<^sub>\\<F>\\<^sub>\\<L> \\<or> x = (\\<bullet>,event A)\\<^sub>\\<F>\\<^sub>\\<L>\"\n      using 3 apply auto\n       apply (cases x, auto)      \n      apply (metis acceptance_set amember.simps(1) dual_order.antisym less_eq_acceptance.elims(2) less_eq_aevent_def)\n      apply (metis Un_iff acceptance.distinct(1) acceptance_event amember.simps(2) aunion.elims event_in_acceptance less_eq_aevent_def)\n       apply (cases x, auto)      \n      sledgehammer[debug=true]\n\n      then obtain pA pB xA where pAB:\n            \"xA \\<le> xs \\<and> pA \\<le> (acceptance A,event A)\\<^sub>\\<F>\\<^sub>\\<L> \\<and> pB \\<le> (acceptance B,event A)\\<^sub>\\<F>\\<^sub>\\<L>\"\n      by auto\n(*    then have \"x = (acceptance pA \\<union>\\<^sub>\\<F>\\<^sub>\\<L> acceptance pB,event pA)\\<^sub>\\<F>\\<^sub>\\<L>\"\n      using 3 \n      apply auto\n      apply (cases x, auto, case_tac a, auto, cases A, cases B, auto) *)\n    then show ?case using 3\n      apply auto\n       apply (rule exI[where x=\"pA #\\<^sub>\\<F>\\<^sub>\\<L> xA\"])\n       apply (rule exI[where x=\"pB #\\<^sub>\\<F>\\<^sub>\\<L> xA\"], auto)\n      next\n    case (4 x xs y)\n    then show ?case sorry\n  qed\nnext\n  case (3 A B bb X)\n  then obtain sA where sA: \"sA \\<le> A\" by auto\n  then show ?case using 3\n    apply (cases X, auto)\n     apply (rule exI[where x=\"\\<langle>sA\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], cases A, auto, cases sA, auto)\n      apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], cases s, auto, case_tac x1, auto)\n    apply (cases B, auto)\n    apply (cases sA, auto, cases s, auto)\n\n  proof (induct s X rule:less_eq_fltrace.induct)\n    case (1 x y)\n    then show ?case\n      apply auto\n      apply (cases x, auto)\n       apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"])\n       apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n      apply (cases A, auto, cases B, auto, case_tac a, auto)\n      by (metis \"1.prems\"(4))\n  next\n    case (2 x y ys)\n    then show ?case \n      apply auto\n      apply (cases x, auto)\n      apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"])\n       apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n      apply (cases A, auto, cases B, auto, case_tac a, auto)\n      by (metis ExtChoiceH.simps(3) acceptance_set amember.simps(2) aunion.simps(3))\n  next\n    case (3 x xs y ys)\n    then show ?case\n      apply auto\n      apply (cases \"bb = \\<langle>A \\<union>\\<^sub>\\<F>\\<^sub>\\<L> acceptance B\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\", auto)\n       apply (rule exI[where x=\"\\<langle>A\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n       apply (rule exI[where x=\"\\<langle>B,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n      apply (cases xs, auto, case_tac x1, auto)\n      apply (cases x, auto)\n       apply (cases A, auto, case_tac a, auto)\n        apply (simp add: less_eq_aevent_def)+\n      apply (cases B, auto)\n  next\n    case (4 x xs y)\n    then show ?case sorry\n  qed\n    case (Acceptance x)\n    then show ?case\n      apply auto\n      apply (cases x, auto)\n      apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n     apply (cases A, cases B, auto, cases B, auto, case_tac a, auto)\n     apply (metis \"3.prems\"(4))\n    apply (cases x, auto)\n      apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n    apply (cases A, cases B, auto, cases B, auto, case_tac a, auto)\n    by (metis ExtChoiceH.simps(3) acceptance_set amember.simps(2) aunion.simps(3))\n  next\n    case (AEvent x1a s)\n    then show ?case \n    proof (cases s)\n      case (Acceptance x1)\n      then show ?thesis using AEvent\n        apply auto\n        apply (cases x1a, auto)\n        apply (rule exI[where x=\"\\<langle>A \\<union>\\<^sub>\\<F>\\<^sub>\\<L> acceptance B\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"])\n        apply (rule exI[where x=\"\\<langle>B,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n            apply (cases B, auto, cases A, auto, case_tac a, auto)\n        apply (case_tac aa, auto)\n        apply (simp add: less_eq_aevent_def)\n             apply (case_tac aa, auto, case_tac a, auto)\n        sledgehammer[debug=true]\n             apply (metis Un_iff acceptance_event acceptance_set amember.elims(2) amember.simps(2) less_eq_acceptance.simps(3) less_eq_aevent_def less_eq_fltrace.simps(1) sup.idem sup_left_commute)\n        apply (cases A, auto, case_tac a, auto)\n             apply (metis Un_commute Un_left_absorb acceptance.distinct(1) acceptance_event acceptance_set amember.elims(2) aunion.simps(3) eq_iff first.simps(2) less_eq_acceptance.elims(2) less_eq_acceptance.simps(2) less_eq_aevent_def unionA_sym)\n        apply (case_tac a, auto)\n            apply (metis Un_commute Un_left_absorb acceptance.distinct(1) acceptance_event acceptance_set amember.elims(2) aunion.simps(3) eq_iff first.simps(2) less_eq_acceptance.elims(2) less_eq_acceptance.simps(2) less_eq_aevent_def unionA_sym)\n\n    next\n      case (AEvent x21 x22)\n      then show ?thesis sorry\n    qed\n      apply auto\n      apply (cases x1a, auto, case_tac a, auto, cases A, auto)\n        apply (simp_all add: less_eq_aevent_def)\n       apply (cases B, auto, case_tac a, auto)\n       apply (cases s, auto)\n      apply (case_tac x1, auto)\n    qed\nnext\ncase (4 A aa B X)\n  then show ?case sorry\nqed\n        apply (cases s, auto)\n\nlemma \n  assumes \"FL1 P\" \"FL1 Q\"\n  shows \"FL1 (P \\<box>\\<^sub>\\<F>\\<^sub>\\<L> Q)\"\n  using assms unfolding FL1_def ExtChoice_def apply auto\n*)\n\ntext \\<open>Idempotency does not hold for external choice in FL.\\<close>\n\nlemma\n  \"P \\<sqsubseteq>\\<^sub>\\<F>\\<^sub>\\<L> (P \\<box>\\<^sub>\\<F>\\<^sub>\\<L> P)\"\n  unfolding ExtChoice_def apply auto\n  nitpick[expect=genuine]\n  oops\n\nlemma ExtChoice_sym:\n  \"P \\<box>\\<^sub>\\<F>\\<^sub>\\<L> Q = Q \\<box>\\<^sub>\\<F>\\<^sub>\\<L> P\"\n  unfolding ExtChoice_def apply auto\n  using ExtChoiceH_sym by blast+\n\nlemma ExtChoice_unit:\n  assumes \"FL1 P\"\n  shows \"Stop \\<box>\\<^sub>\\<F>\\<^sub>\\<L> P = P\"\n  using assms unfolding ExtChoice_def Stop_def apply auto\n    apply (simp add: ExtChoiceH_emptyset)\n   apply (simp add: ExtChoiceH_bullet)\n  using ExtChoiceH_exists\n  by blast\n\nlemma ExtChoice_dist:\n  shows \"P \\<box>\\<^sub>\\<F>\\<^sub>\\<L> (Q \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> R) = (P \\<box>\\<^sub>\\<F>\\<^sub>\\<L> Q) \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> (P \\<box>\\<^sub>\\<F>\\<^sub>\\<L> R)\"\n  unfolding ExtChoice_def IntChoice_def by auto\n\ntext \\<open>Following laws do not hold in FL.\\<close>\n\nlemma\n  assumes \"FL0 P\" \"FL0 Q\" \"FL0 R\"\n  shows \"((P \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> R) \\<box>\\<^sub>\\<F>\\<^sub>\\<L> (Q \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> R)) = ((P \\<box>\\<^sub>\\<F>\\<^sub>\\<L> Q) \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> R)\"\n  nitpick[expect=genuine]\n  oops\n\nlemma\n  assumes \"FL0 P\" \"FL0 Q\" \"FL0 R\"\n  shows \"P \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> (Q \\<box>\\<^sub>\\<F>\\<^sub>\\<L> R) = (P \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> Q) \\<box>\\<^sub>\\<F>\\<^sub>\\<L> (P \\<sqinter>\\<^sub>\\<F>\\<^sub>\\<L> R)\"\n  nitpick[expect=genuine]\n  oops\n\nlemma a_then_Stop:\n  \"a \\<rightarrow>\\<^sub>\\<F>\\<^sub>\\<L> Stop = {\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>,\n                  \\<langle>[{a}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>,\n                  \\<langle>(\\<bullet>,a)\\<^sub>\\<F>\\<^sub>\\<L>,[{}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>,\n                  \\<langle>(\\<bullet>,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>,\n                  \\<langle>([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L>,[{}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>,\n                  \\<langle>([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\n                  }\"\n  unfolding Prefix_def Stop_def by auto\n\nlemma Hiding_Stop:\n  \"Stop \\\\\\<^sub>\\<F>\\<^sub>\\<L> X = Stop\"\n  unfolding Stop_def Hiding_def apply auto\n   apply (rule exI[where x=\"\\<langle>[{}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n  by (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n\nlemma Hiding_a_then_Stop:\n  assumes \"a \\<notin> X\"\n  shows \"(PrefixAlt a Stop) \\\\\\<^sub>\\<F>\\<^sub>\\<L> X = (PrefixAlt a Stop)\"\n  using assms \n  unfolding PrefixAlt_def Stop_def Hiding_def prefixH_def apply auto\n         apply (rule exI[where x=\"\\<langle>[{a}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n        apply (rule exI[where x=\"\\<langle>[{a}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n       apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n      apply (rule exI[where x=\"\\<langle>([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L>,[{}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n     apply (rule exI[where x=\"\\<langle>(\\<bullet>,a)\\<^sub>\\<F>\\<^sub>\\<L>,[{}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n    apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n   apply (rule exI[where x=\"\\<langle>([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n  by (rule exI[where x=\"\\<langle>(\\<bullet>,a)\\<^sub>\\<F>\\<^sub>\\<L>,\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n\nlemma Hiding_a_then_Stop2:\n  \"(PrefixAlt a Stop) \\\\\\<^sub>\\<F>\\<^sub>\\<L> {a} = Stop\"\n  unfolding PrefixAlt_def Hiding_def Stop_def prefixH_def apply auto\n   apply (rule exI[where x=\"([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L>\\<langle>[{}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n  by (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n\nlemma Hiding_a_then_P:\n  assumes \"FL1 P\"\n  shows \"(PrefixAlt a P) \\\\\\<^sub>\\<F>\\<^sub>\\<L> {a} = P \\\\\\<^sub>\\<F>\\<^sub>\\<L> {a}\"\n  using assms unfolding PrefixAlt_def Hiding_def Stop_def prefixH_def apply auto\n   apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n  by (rule_tac x=\"([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> s\" in exI, auto)\n\nlemma Hiding_a_then_P_event_in_set:\n  assumes \"FL1 P\" \"a \\<in> X\"\n  shows \"(PrefixAlt a P) \\\\\\<^sub>\\<F>\\<^sub>\\<L> X = P \\\\\\<^sub>\\<F>\\<^sub>\\<L> X\"\n  using assms unfolding PrefixAlt_def Hiding_def Stop_def prefixH_def apply auto\n   apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n  by (rule_tac x=\"([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> s\" in exI, auto)\n\nlemma Hiding_a_then_P_event_not_in_set:\n  assumes \"FL1 P\" \"a \\<notin> X\"\n  shows \"(PrefixAlt a P) \\\\\\<^sub>\\<F>\\<^sub>\\<L> X = (PrefixAlt a (P \\\\\\<^sub>\\<F>\\<^sub>\\<L> X))\"\n  using assms unfolding PrefixAlt_def Hiding_def Stop_def prefixH_def apply auto\n  apply (rule exI[where x=\"\\<langle>[{a}]\\<^sub>\\<F>\\<^sub>\\<L>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n    apply (rule exI[where x=\"\\<langle>\\<bullet>\\<rangle>\\<^sub>\\<F>\\<^sub>\\<L>\"], auto)\n   apply (rule_tac x=\"([{a}]\\<^sub>\\<F>\\<^sub>\\<L>,a)\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> sa\" in exI, auto)\n  by (rule_tac x=\"(\\<bullet>,a)\\<^sub>\\<F>\\<^sub>\\<L> #\\<^sub>\\<F>\\<^sub>\\<L> sa\" in exI, auto)\n\nlemma\n  assumes \"\\<forall> P Q. f (P \\<union> Q) = f P \\<union> f Q\"\n  shows \"\\<forall> P Q. Q \\<subseteq> P \\<longrightarrow> f Q \\<subseteq> f P\"\n  using assms apply auto\n  by (metis UnCI Un_absorb2)\n\nlemma\n  assumes \"\\<forall> P Q. Q \\<subseteq> P \\<longrightarrow> f Q \\<subseteq> f P\"\n  shows \"\\<forall> P Q. f (P \\<union> Q) = f P \\<union> f Q\"\n  using assms nitpick[expect=genuine]\n  oops\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/FL/Finite_Linear_Ops.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.31053096148322107}}
{"text": "theory Incredible_Correctness\nimports\n  Abstract_Rules_To_Incredible\n  Natural_Deduction\nbegin\n\ntext \\<open>\nIn this theory, we prove that if we have a graph that proves a given abstract task (which is\nrepresented as the context @{term Tasked_Proof_Graph}), then we can prove @{term solved}.\n\\<close>\n\nlemma ffUnion_fempty[simp]: \"ffUnion fempty = fempty\"\n  by (auto simp add: fmember.rep_eq ffUnion.rep_eq)\n\nlemma ffUnion_finsert[simp]: \"ffUnion (finsert x S) = x |\\<union>| ffUnion S\"\n  by (auto simp add: fmember.rep_eq ffUnion.rep_eq)\n\n\ncontext Tasked_Proof_Graph\nbegin\n\ndefinition adjacentTo :: \"'vertex \\<Rightarrow> ('form, 'var) in_port \\<Rightarrow> ('vertex \\<times> ('form, 'var) out_port)\" where\n \"adjacentTo v p = (SOME ps. (ps, (v,p)) \\<in> edges)\" \n\nfun isReg where\n  \"isReg v p = (case p of Hyp h c \\<Rightarrow> False | Reg  c \\<Rightarrow>\n      (case nodeOf v of\n        Conclusion a \\<Rightarrow> False\n      | Assumption a \\<Rightarrow> False\n      | Rule r \\<Rightarrow> True\n      | Helper \\<Rightarrow> True\n      ))\"\n\nfun toNatRule  where\n  \"toNatRule v p = (case p of Hyp h c \\<Rightarrow> Axiom | Reg  c \\<Rightarrow>\n      (case nodeOf v of\n        Conclusion a \\<Rightarrow> Axiom (* a lie *)\n      | Assumption a \\<Rightarrow> Axiom\n      | Rule r \\<Rightarrow> NatRule (r,c)\n      | Helper \\<Rightarrow> Cut\n      ))\"\n\n\ninductive_set global_assms' :: \"'var itself \\<Rightarrow> 'form set\" for i  where\n  \"v |\\<in>| vertices \\<Longrightarrow> nodeOf v = Assumption p \\<Longrightarrow> labelAtOut v (Reg p) \\<in> global_assms' i\"\n\nlemma finite_global_assms': \"finite (global_assms' i)\"\nproof-\n  have \"finite (fset vertices)\" by (rule finite_fset)\n  moreover\n  have \"global_assms' i \\<subseteq> (\\<lambda> v. case nodeOf v of Assumption p \\<Rightarrow>  labelAtOut v (Reg p)) ` fset vertices\"\n    by (force simp add: global_assms'.simps fmember.rep_eq image_iff )\n  ultimately\n  show ?thesis by (rule finite_surj)\nqed\n\ncontext includes fset.lifting\nbegin\n  lift_definition global_assms :: \"'var itself \\<Rightarrow> 'form fset\" is global_assms' by (rule finite_global_assms')\n  lemmas global_assmsI = global_assms'.intros[Transfer.transferred]\n  lemmas global_assms_simps = global_assms'.simps[Transfer.transferred]\nend\n\nfun extra_assms :: \"('vertex \\<times> ('form, 'var) in_port) \\<Rightarrow> 'form fset\" where\n  \"extra_assms (v, p) = (\\<lambda> p. labelAtOut v p) |`| hyps_for (nodeOf v) p\"\n\nfun hyps_along :: \"('vertex, 'form, 'var) edge' list \\<Rightarrow> 'form fset\" where\n  \"hyps_along pth = ffUnion (extra_assms |`| snd |`| fset_from_list pth) |\\<union>| global_assms TYPE('var)\"\n\nlemma hyps_alongE[consumes 1, case_names Hyp Assumption]:\n  assumes \"f |\\<in>| hyps_along pth\"\n  obtains v p h where \"(v,p) \\<in> snd ` set pth\" and \"f = labelAtOut v h \" and \"h |\\<in>| hyps_for (nodeOf v) p\"\n  | v pf  where \"v |\\<in>| vertices\" and \"nodeOf v = Assumption pf\" \"f = labelAtOut v (Reg pf)\" \n  using assms\n  apply (auto simp add: fmember.rep_eq ffUnion.rep_eq  global_assms_simps[unfolded fmember.rep_eq])\n  apply (metis image_iff snd_conv)\n  done\n\ntext \\<open>Here we build the natural deduction tree, by walking the graph.\\<close>    \n\nprimcorec tree :: \"'vertex \\<Rightarrow> ('form, 'var) in_port \\<Rightarrow> ('vertex, 'form, 'var) edge' list \\<Rightarrow>  (('form entailment), ('rule \\<times> 'form) NatRule) dtree\" where\n \"root (tree v p pth) =\n    ((hyps_along ((adjacentTo v p,(v,p))#pth) \\<turnstile> labelAtIn v p),\n    (case adjacentTo v p of (v', p') \\<Rightarrow> toNatRule v' p'\n    ))\"\n | \"cont (tree v p pth) =\n    (case adjacentTo v p of (v', p') \\<Rightarrow>\n    (if isReg v' p' then ((\\<lambda> p''. tree v' p'' ((adjacentTo v p,(v,p))#pth)) |`| inPorts (nodeOf v')) else {||}\n    ))\"\n\n\nlemma fst_root_tree[simp]: \"fst (root (tree v p pth)) = (hyps_along ((adjacentTo v p,(v,p))#pth) \\<turnstile> labelAtIn v p)\" by simp\n\nlemma out_port_cases[consumes 1, case_names Assumption Hyp Rule Helper]:\n  assumes \"p |\\<in>| outPorts n\"\n  obtains\n    a where \"n = Assumption a\" and \"p = Reg a\"\n    | r h c where \"n = Rule r\" and \"p = Hyp h c\"\n    | r f where \"n = Rule r\" and \"p = Reg f\"\n    | \"n = Helper\" and \"p = Reg anyP\"\n  using assms by (atomize_elim, cases p; cases n) auto\n\nlemma hyps_for_fimage: \"hyps_for (Rule r) x = (if x |\\<in>| f_antecedent r then (\\<lambda> f. Hyp f x) |`| (a_hyps x) else {||})\"\n  apply (rule fset_eqI)\n  apply (rename_tac p')\n  apply (case_tac p')\n  apply (auto simp add:  split: if_splits out_port.splits)\n  done\n\ntext \\<open>Now we prove that the thus produced tree is well-formed.\\<close>\n\ntheorem wf_tree:\n  assumes \"valid_in_port (v,p)\"\n  assumes \"terminal_path v t pth\"\n  shows \"wf (tree v p pth)\"\nusing assms\nproof (coinduction arbitrary: v p pth)\ncase (wf v p pth)\n  let ?t = \"tree v p pth\"\n  from saturated[OF wf(1)]\n  obtain v' p'\n  where e:\"((v',p'),(v,p)) \\<in> edges\" and [simp]: \"adjacentTo v p = (v',p')\"\n    by (auto simp add: adjacentTo_def, metis (no_types, lifting) eq_fst_iff tfl_some)\n\n  let ?e = \"((v',p'),(v,p))\"\n  let ?pth' = \"?e#pth\"\n  let ?\\<Gamma> = \"hyps_along ?pth'\"\n  let ?l = \"labelAtIn v p\"\n  \n  from e valid_edges have \"v' |\\<in>| vertices\" and \"p' |\\<in>| outPorts (nodeOf v')\" by auto\n  hence \"nodeOf v' \\<in> sset nodes\" using valid_nodes by (meson image_eqI notin_fset set_mp)\n\n  from `?e \\<in> edges`\n  have s: \"labelAtOut v' p' = labelAtIn v p\"  by (rule solved)\n\n  from `p' |\\<in>| outPorts (nodeOf v')`\n  show ?case\n  proof (cases rule: out_port_cases)\n    case (Hyp r h c)\n\n    from Hyp `p' |\\<in>| outPorts (nodeOf v')`\n    have \"h |\\<in>| a_hyps c\" and \"c |\\<in>| f_antecedent r\" by auto\n    hence \"hyps (nodeOf v') (Hyp h c) = Some c\" using Hyp by simp\n\n    from well_scoped[OF ` _ \\<in> edges`[unfolded Hyp] this]\n    have \"(v, p) = (v', c) \\<or> v \\<in> scope (v', c)\".\n    hence \"(v', c) \\<in> insert (v, p) (snd ` set pth)\"\n    proof\n      assume \"(v, p) = (v', c)\"\n      thus ?thesis by simp\n    next\n      assume \"v \\<in> scope (v', c)\"\n      from this terminal_path_end_is_terminal[OF wf(2)] terminal_path_is_path[OF wf(2)]\n      have \"(v', c) \\<in> snd ` set pth\" by (rule scope_find)\n      thus ?thesis by simp\n    qed\n    moreover\n\n    \n    from `hyps (nodeOf v') (Hyp h c) = Some c`\n    have \"Hyp h c |\\<in>| hyps_for (nodeOf v') c\" by simp\n    hence \"labelAtOut v' (Hyp h c) |\\<in>| extra_assms (v',c)\" by auto\n    ultimately\n\n    have \"labelAtOut v' (Hyp h c) |\\<in>| ?\\<Gamma>\" \n      by (fastforce simp add: fmember.rep_eq ffUnion.rep_eq)\n      \n    hence \"labelAtIn v p |\\<in>| ?\\<Gamma>\" by (simp add: s[symmetric] Hyp fmember.rep_eq)\n    thus ?thesis\n      using Hyp\n      apply (auto intro: exI[where x = ?t] simp add: eff.simps simp del: hyps_along.simps)\n      done\n  next\n    case (Assumption f)\n\n    from `v' |\\<in>| vertices` `nodeOf v' = Assumption f`\n    have \"labelAtOut v' (Reg f) |\\<in>| global_assms TYPE('var)\"\n      by (rule global_assmsI)\n    hence \"labelAtOut v' (Reg f) |\\<in>| ?\\<Gamma>\" by auto\n    hence \"labelAtIn v p |\\<in>| ?\\<Gamma>\" by (simp add: s[symmetric] Assumption fmember.rep_eq)\n    thus ?thesis using Assumption\n      by (auto intro: exI[where x = ?t] simp add: eff.simps)\n  next\n    case (Rule r f)\n    with `nodeOf v' \\<in> sset nodes`\n    have \"r \\<in> sset rules\"\n      by (auto simp add: nodes_def stream.set_map)\n\n    from Rule\n    have \"hyps (nodeOf v') p' = None\" by simp\n    with e `terminal_path v t pth`\n    have \"terminal_path v' t ?pth'\"..\n\n    from Rule  `p' |\\<in>| outPorts (nodeOf v')`\n    have \"f |\\<in>| f_consequent r\" by simp\n    hence \"f \\<in> set (consequent r)\" by (simp add: f_consequent_def)\n    with `r \\<in> sset rules`\n    have \"NatRule (r, f) \\<in> sset (smap NatRule n_rules)\"\n      by (auto simp add: stream.set_map n_rules_def no_empty_conclusions)\n    moreover\n\n    {\n    from `f |\\<in>| f_consequent r`\n    have \"f \\<in> set (consequent r)\" by (simp add: f_consequent_def)\n    hence \"natEff_Inst (r, f) f (f_antecedent r)\" \n      by (rule natEff_Inst.intros)\n    hence \"eff (NatRule (r, f)) (?\\<Gamma> \\<turnstile> subst (inst v') (freshen (vidx v') f))\n           ((\\<lambda>ant. ((\\<lambda>p. subst (inst v') (freshen (vidx v') p)) |`| a_hyps ant |\\<union>| ?\\<Gamma> \\<turnstile> subst (inst v') (freshen (vidx v') (a_conc ant)))) |`| f_antecedent r)\" \n           (is \"eff _ _ ?ants\")\n    proof (rule eff.intros)\n      fix ant f\n      assume \"ant |\\<in>| f_antecedent r\"\n      from  `v' |\\<in>| vertices` `ant |\\<in>| f_antecedent r`\n      have \"valid_in_port (v',ant)\" by (simp add: Rule)\n\n      assume \"f |\\<in>| ?\\<Gamma>\"\n      thus \"freshenLC (vidx v') ` a_fresh ant \\<inter> lconsts f = {}\" \n      proof(induct rule: hyps_alongE)\n        case (Hyp v'' p'' h'')\n\n        from Hyp(1) snd_set_path_verties[OF terminal_path_is_path[OF `terminal_path v' t ?pth'`]]\n        have \"v'' |\\<in>| vertices\" by (force simp add: fmember.rep_eq)\n\n        from `terminal_path v' t ?pth'` Hyp(1)\n        have \"v'' \\<notin> scope (v', ant)\" by (rule hyps_free_path_not_in_scope)\n        with `valid_in_port (v',ant)` `v'' |\\<in>| vertices`\n        have \"freshenLC (vidx v') ` local_vars (nodeOf v') ant \\<inter> subst_lconsts (inst v'') = {}\"\n         by (rule out_of_scope)\n        moreover\n        from hyps_free_vertices_distinct'[OF `terminal_path v' t ?pth'`] Hyp.hyps(1)\n        have \"v'' \\<noteq> v'\" by (metis distinct.simps(2) fst_conv image_eqI list.set_map)\n        hence \"vidx v'' \\<noteq> vidx v'\" using `v' |\\<in>| vertices` `v'' |\\<in>| vertices` by (meson vidx_inj inj_onD notin_fset)\n        hence \"freshenLC (vidx v') ` a_fresh ant \\<inter> freshenLC (vidx v'') ` lconsts (labelsOut (nodeOf v'') h'') = {}\"by auto\n        moreover\n        have \"lconsts f \\<subseteq> lconsts (freshen (vidx v'') (labelsOut (nodeOf v'') h'')) \\<union> subst_lconsts (inst v'') \" using `f = _`\n          by (simp add: labelAtOut_def fv_subst)\n        ultimately\n        show ?thesis \n          by (fastforce simp add:  lconsts_freshen)\n      next\n        case (Assumption v pf)\n        hence \"f = subst (inst v) (freshen (vidx v) pf)\" by (simp add: labelAtOut_def)\n        moreover\n        from Assumption have \"Assumption pf \\<in> sset nodes\" using valid_nodes by (auto simp add: fmember.rep_eq)\n        hence \"pf \\<in> set assumptions\" unfolding nodes_def by (auto simp add: stream.set_map)\n        hence \"closed pf\" by (rule assumptions_closed)\n        ultimately\n        have \"lconsts f = {}\" by (simp add: closed_no_lconsts lconsts_freshen subst_closed freshen_closed)\n        thus ?thesis by simp\n      qed      \n    next\n      fix ant\n      assume \"ant |\\<in>| f_antecedent r\"\n      from  `v' |\\<in>| vertices` `ant |\\<in>| f_antecedent r`\n      have \"valid_in_port (v',ant)\" by (simp add: Rule)\n      moreover\n      note `v' |\\<in>| vertices`\n      moreover\n      hence \"v' \\<notin> scope (v', ant)\" by (rule scopes_not_refl)\n      ultimately\n      have \"freshenLC (vidx v') ` local_vars (nodeOf v') ant \\<inter> subst_lconsts (inst v') = {}\"\n        by (rule out_of_scope)\n      thus \"freshenLC (vidx v') ` a_fresh ant \\<inter> subst_lconsts (inst v') = {}\" by simp\n    qed\n    also\n    have \"subst (inst v') (freshen (vidx v') f) = labelAtOut v' p'\" using Rule by (simp add: labelAtOut_def)\n    also\n    note `labelAtOut v' p' = labelAtIn v p`\n    also\n    have \"?ants = ((\\<lambda>x. (extra_assms (v',x) |\\<union>| hyps_along ?pth' \\<turnstile> labelAtIn  v' x)) |`| f_antecedent r)\"\n      by (rule fimage_cong[OF refl])\n        (auto simp add: labelAtIn_def labelAtOut_def Rule hyps_for_fimage fmember.rep_eq ffUnion.rep_eq)\n    finally\n    have \"eff (NatRule (r, f))\n        (?\\<Gamma>, labelAtIn v p)\n        ((\\<lambda>x. extra_assms (v',x) |\\<union>| ?\\<Gamma> \\<turnstile> labelAtIn v' x) |`| f_antecedent r)\".\n    }\n    moreover\n\n    { fix x\n      assume \"x |\\<in>| cont ?t\"\n      then obtain a where \"x = tree v' a ?pth'\" and \"a |\\<in>| f_antecedent r\"\n        by (auto simp add: Rule)\n      note this(1)\n      moreover\n\n      from  `v' |\\<in>| vertices` `a |\\<in>| f_antecedent r`\n      have \"valid_in_port (v',a)\" by (simp add: Rule)\n      moreover\n\n      note `terminal_path v' t ?pth'`\n      ultimately\n\n      have \"\\<exists>v p pth. x = tree v p pth \\<and> valid_in_port (v,p) \\<and>  terminal_path v t pth\"\n        by blast\n    }\n    ultimately\n\n    show ?thesis using Rule\n      by (auto intro!: exI[where x = ?t]  simp add: comp_def funion_assoc)\n  next\n    case Helper\n    from Helper\n    have \"hyps (nodeOf v') p' = None\" by simp\n    with e `terminal_path v t pth`\n    have \"terminal_path v' t ?pth'\"..\n\n    have \"labelAtIn v' (plain_ant anyP) = labelAtIn v p\"\n      unfolding s[symmetric]\n      using Helper by (simp add: labelAtIn_def labelAtOut_def)\n    moreover\n    { fix x\n      assume \"x |\\<in>| cont ?t\"\n      \n      hence \"x = tree v' (plain_ant anyP) ?pth'\"\n        by (auto simp add: Helper)\n      note this(1)\n      moreover\n\n      from  `v' |\\<in>| vertices`\n      have \"valid_in_port (v',plain_ant anyP)\" by (simp add: Helper)\n      moreover\n\n      note `terminal_path v' t ?pth'`\n      ultimately\n\n      have \"\\<exists>v p pth. x = tree v p pth \\<and> valid_in_port (v,p) \\<and>  terminal_path v t pth\"\n        by blast\n    }\n    ultimately\n\n    show ?thesis using Helper\n      by (auto intro!: exI[where x = ?t]  simp add: comp_def funion_assoc )\n  qed\nqed\n\nlemma global_in_ass: \"global_assms TYPE('var) |\\<subseteq>| ass_forms\"\nproof\n  fix x\n  assume \"x |\\<in>| global_assms TYPE('var)\"\n  then obtain v pf where \"v |\\<in>| vertices\" and \"nodeOf v = Assumption pf\" and \"x = labelAtOut v (Reg pf)\"\n    by (auto simp add: global_assms_simps)\n  from this (1,2) valid_nodes\n  have \"Assumption pf \\<in> sset nodes\" by (auto simp add: fmember.rep_eq)\n  hence \"pf \\<in> set assumptions\" by (auto simp add: nodes_def stream.set_map)\n  hence \"closed pf\" by (rule  assumptions_closed)\n  with `x = labelAtOut v (Reg pf)`\n  have \"x = pf\" by (auto simp add: labelAtOut_def lconsts_freshen closed_no_lconsts freshen_closed subst_closed)\n  thus \"x |\\<in>| ass_forms\" using `pf \\<in> set assumptions` by (auto simp add: ass_forms_def)\nqed\n\nprimcorec edge_tree :: \"'vertex \\<Rightarrow> ('form, 'var) in_port \\<Rightarrow> ('vertex, 'form, 'var) edge' tree\" where\n \"root (edge_tree v p) = (adjacentTo v p, (v,p))\"\n | \"cont (edge_tree v p) =\n    (case adjacentTo v p of (v', p') \\<Rightarrow>\n    (if isReg v' p' then ((\\<lambda> p. edge_tree  v' p) |`| inPorts (nodeOf v')) else {||}\n    ))\"\n\nlemma tfinite_map_tree: \"tfinite (map_tree f t) \\<longleftrightarrow> tfinite t\"\nproof\n  assume \"tfinite (map_tree f t)\"\n  thus \"tfinite t\"\n    by (induction \"map_tree f t\" arbitrary: t rule: tfinite.induct)\n       (fastforce intro:  tfinite.intros simp add:  tree.map_sel)\nnext\n  assume \"tfinite t\"\n  thus \"tfinite (map_tree f t)\"\n    by (induction t rule: tfinite.induct)\n       (fastforce intro:  tfinite.intros simp add:  tree.map_sel)\nqed\n\n\nlemma finite_tree_edge_tree:\n  \"tfinite (tree v p pth) \\<longleftrightarrow> tfinite (edge_tree v p)\"\nproof-\n  have \"map_tree (\\<lambda> _. ())  (tree v p pth) = map_tree (\\<lambda> _. ()) (edge_tree v p)\"\n   by(coinduction arbitrary: v p pth)\n     (fastforce simp add: tree.map_sel rel_fset_def rel_set_def split: prod.split out_port.split graph_node.split option.split)\n  thus ?thesis by (metis tfinite_map_tree)\nqed\n\ncoinductive forbidden_path :: \"'vertex \\<Rightarrow> ('vertex, 'form, 'var) edge' stream \\<Rightarrow> bool\"   where\n    forbidden_path: \"((v\\<^sub>1,p\\<^sub>1),(v\\<^sub>2,p\\<^sub>2)) \\<in> edges \\<Longrightarrow> hyps (nodeOf v\\<^sub>1) p\\<^sub>1 = None \\<Longrightarrow> forbidden_path v\\<^sub>1 pth \\<Longrightarrow> forbidden_path v\\<^sub>2 (((v\\<^sub>1,p\\<^sub>1),(v\\<^sub>2,p\\<^sub>2))##pth)\"\n\nlemma path_is_forbidden:\n  assumes \"valid_in_port (v,p)\"\n  assumes \"ipath (edge_tree v p) es\"\n  shows \"forbidden_path v es\"\nusing assms\nproof(coinduction arbitrary: v p es)\n  case forbidden_path\n\n  let ?es' = \"stl es\"\n\n  from forbidden_path(2)\n  obtain t' where \"root (edge_tree v p) = shd es\" and \"t' |\\<in>| cont (edge_tree v p)\" and \"ipath t' ?es'\"\n    by rule blast \n\n  from `root (edge_tree v p) = shd es`\n  have [simp]: \"shd es = (adjacentTo v p, (v,p))\" by simp\n    \n  from saturated[OF `valid_in_port (v,p)`]\n  obtain v' p'\n  where e:\"((v',p'),(v,p)) \\<in> edges\" and [simp]: \"adjacentTo v p = (v',p')\"\n    by (auto simp add: adjacentTo_def, metis (no_types, lifting) eq_fst_iff tfl_some)\n  let ?e = \"((v',p'),(v,p))\"\n\n  from e have \"p' |\\<in>| outPorts (nodeOf v')\" using valid_edges by auto\n  thus ?case\n  proof(cases rule: out_port_cases)\n    case Hyp \n    with  `t' |\\<in>| cont (edge_tree v p)`\n    have False by auto\n    thus ?thesis..\n  next\n    case Assumption \n    with  `t' |\\<in>| cont (edge_tree v p)`\n    have False by auto\n    thus ?thesis..\n  next\n    case (Rule r f)\n    from `t' |\\<in>| cont (edge_tree v p)` Rule\n    obtain a where [simp]: \"t' = edge_tree v' a\" and \"a |\\<in>| f_antecedent r\"  by auto\n\n    have \"es = ?e ## ?es'\" by (cases es rule: stream.exhaust_sel) simp\n    moreover\n  \n    have \"?e \\<in> edges\" using e by simp\n    moreover\n  \n    from `p' = Reg f` `nodeOf v' = Rule r`\n    have \"hyps (nodeOf v') p' = None\" by simp\n    moreover\n   \n    from e valid_edges have \"v' |\\<in>| vertices\"  by auto\n    with `nodeOf v' = Rule r` `a |\\<in>| f_antecedent r`\n    have \"valid_in_port (v', a)\" by simp\n    moreover\n  \n    have \"ipath (edge_tree v' a) ?es'\" using `ipath t' _` by simp\n    ultimately\n  \n    show ?thesis by metis\n  next\n    case Helper\n    from `t' |\\<in>| cont (edge_tree v p)` Helper\n    have [simp]: \"t' = edge_tree v' (plain_ant anyP)\" by simp\n\n    have \"es = ?e ## ?es'\" by (cases es rule: stream.exhaust_sel) simp\n    moreover\n  \n    have \"?e \\<in> edges\" using e by simp\n    moreover\n  \n    from `p' = Reg anyP` `nodeOf v' = Helper`\n    have \"hyps (nodeOf v') p' = None\" by simp\n    moreover\n   \n    from e valid_edges have \"v' |\\<in>| vertices\"  by auto\n    with `nodeOf v' = Helper`\n    have \"valid_in_port (v', plain_ant anyP)\" by simp\n    moreover\n  \n    have \"ipath (edge_tree v' (plain_ant anyP)) ?es'\" using `ipath t' _` by simp\n    ultimately\n  \n    show ?thesis by metis\n  qed\nqed\n\nlemma forbidden_path_prefix_is_path:\n  assumes \"forbidden_path v es\"\n  obtains v' where  \"path v' v (rev (stake n es))\"\n  using assms\n  apply (atomize_elim)\n  apply (induction n arbitrary: v es)\n  apply simp\n  apply (simp add: path_snoc)\n  apply (subst (asm) forbidden_path.simps) back\n  apply auto\n  done\n\nlemma forbidden_path_prefix_is_hyp_free:\n  assumes \"forbidden_path v es\"\n  shows \"hyps_free (rev (stake n es))\"\n  using assms\n  apply (induction n arbitrary: v es)\n  apply (simp add: hyps_free_def)\n  apply (subst (asm) forbidden_path.simps) back\n  apply (force simp add: hyps_free_def)\n  done\n\n\ntext \\<open>And now we prove that the tree is finite, which requires the above notion of a\n@{term forbidden_path}, i.e.\\@ an infinite path.\\<close>\n\ntheorem finite_tree:\n  assumes \"valid_in_port (v,p)\"\n  assumes \"terminal_vertex v\"\n  shows \"tfinite (tree v p pth)\"\nproof(rule ccontr)\n  let ?n = \"Suc (fcard vertices)\"\n  assume \"\\<not> tfinite (tree v p pth)\"\n  hence \"\\<not> tfinite (edge_tree v p)\" unfolding finite_tree_edge_tree.\n  then obtain es  :: \"('vertex, 'form, 'var) edge' stream\"\n    where \"ipath (edge_tree v p) es\" using Konig by blast\n  with `valid_in_port (v,p)`\n  have \"forbidden_path v es\" by (rule path_is_forbidden)\n  from forbidden_path_prefix_is_path[OF this] forbidden_path_prefix_is_hyp_free[OF this]\n  obtain v' where \"path v' v (rev (stake ?n es))\" and \"hyps_free (rev (stake ?n es))\"\n    by blast\n  from this `terminal_vertex v`\n  have \"terminal_path  v' v (rev (stake ?n es))\" by (rule terminal_pathI)\n  hence \"length (rev (stake ?n es)) \\<le> fcard vertices\"\n    by (rule hyps_free_limited)\n  thus False by simp\nqed\n\ntext \\<open>The main result of this theory.\\<close>\n\ntheorem solved\nunfolding solved_def\nproof(intro ballI allI conjI impI)\n  fix c\n  assume \"c |\\<in>| conc_forms\"\n  hence \"c \\<in> set conclusions\"  by (auto simp add: conc_forms_def)\n  from this(1) conclusions_present\n  obtain v where \"v |\\<in>| vertices\" and \"nodeOf v = Conclusion c\"\n    by (auto, metis (no_types, lifting) image_iff image_subset_iff notin_fset)\n\n  have \"valid_in_port (v, (plain_ant c))\"\n    using `v |\\<in>| vertices` `nodeOf _ = _ `  by simp\n\n  have \"terminal_vertex v\" using `v |\\<in>| vertices` `nodeOf v = Conclusion c` by auto\n\n  let ?t = \"tree v (plain_ant c) []\"\n\n  have \"fst (root ?t) = (global_assms TYPE('var), c)\"\n    using `c \\<in> set conclusions` `nodeOf _ = _`\n    by (auto simp add: labelAtIn_def conclusions_closed closed_no_lconsts  freshen_def rename_closed subst_closed)\n  moreover\n\n  have \"global_assms TYPE('var) |\\<subseteq>| ass_forms\" by (rule global_in_ass)\n  moreover\n\n  from  `terminal_vertex v`\n  have \"terminal_path v v []\" by (rule terminal_path_empty)\n  with `valid_in_port (v, (plain_ant c))`\n  have \"wf ?t\" by (rule wf_tree)\n  moreover\n\n  from `valid_in_port (v, plain_ant c)` `terminal_vertex v`\n  have \"tfinite ?t\" by (rule finite_tree)\n  ultimately\n  \n  show \"\\<exists>\\<Gamma> t. fst (root t) = (\\<Gamma> \\<turnstile> c) \\<and> \\<Gamma> |\\<subseteq>| ass_forms \\<and> wf t \\<and> tfinite t\" by blast\nqed\n\nend\n\nend", "meta": {"author": "nomeata", "repo": "isa-incredible", "sha": "10eb1d938879778196cc69bf86b1ed0d979512cc", "save_path": "github-repos/isabelle/nomeata-isa-incredible", "path": "github-repos/isabelle/nomeata-isa-incredible/isa-incredible-10eb1d938879778196cc69bf86b1ed0d979512cc/Incredible_Correctness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3104670196452017}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nheader {* More properties of maps plus map disjuction. *}\n\ntheory MapExtra\nimports \"~~/src/HOL/Main\"\nbegin\n\ntext {*\n  BEWARE: we are not interested in using the @{term \"dom x \\<inter> dom y = {}\"}\n  rules from Map for our separation logic proofs. As such, we overwrite the\n  Map rules where that form of disjointness is in the assumption conflicts\n  with a name we want to use with @{text \"\\<bottom>\"}. *}\n\ntext {*\n  A note on naming:\n  Anything not involving heap disjuction can potentially be incorporated\n  directly into Map.thy, thus uses @{text \"m\"}.\n  Anything involving heap disjunction is not really mergeable with Map, is\n  destined for use in separation logic, and hence uses @{text \"h\"}\n*}\n\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\ntext {* Things that should go into Option Type *}\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\n\ntext {* Misc option lemmas *}\n\nlemma None_not_eq: \"(None \\<noteq> x) = (\\<exists>y. x = Some y)\" by (cases x) auto\n\nlemma None_com: \"(None = x) = (x = None)\" by fast\n\nlemma Some_com: \"(Some y = x) = (x = Some y)\" by fast\n\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\ntext {* Things that should go into Map.thy *}\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\n\ntext {* Map intersection: set of all keys for which the maps agree. *}\n\ndefinition\n  map_inter :: \"('a \\<rightharpoonup> 'b) \\<Rightarrow> ('a \\<rightharpoonup> 'b) \\<Rightarrow> 'a set\" (infixl \"\\<inter>\\<^sub>m\" 70) where\n  \"m\\<^sub>1 \\<inter>\\<^sub>m m\\<^sub>2 \\<equiv> {x \\<in> dom m\\<^sub>1. m\\<^sub>1 x = m\\<^sub>2 x}\"\n\ntext {* Map restriction via domain subtraction *}\n\ndefinition\n  sub_restrict_map :: \"('a \\<rightharpoonup> 'b) => 'a set => ('a \\<rightharpoonup> 'b)\" (infixl \"`-\"  110)\n  where\n  \"m `- S \\<equiv> (\\<lambda>x. if x \\<in> S then None else m x)\"\n\nsubsection {* Properties of maps not related to restriction *}\n\nlemma empty_forall_equiv: \"(m = empty) = (\\<forall>x. m x = None)\"\n  by (fastforce intro!: ext)\n\nlemma map_le_empty2 [simp]:\n  \"(m \\<subseteq>\\<^sub>m empty) = (m = empty)\"\n  by (auto simp: map_le_def intro: ext)\n\nlemma dom_iff:\n  \"(\\<exists>y. m x = Some y) = (x \\<in> dom m)\"\n  by auto\n\nlemma non_dom_eval:\n  \"x \\<notin> dom m \\<Longrightarrow> m x = None\"\n  by auto\n\nlemma non_dom_eval_eq:\n  \"x \\<notin> dom m = (m x = None)\"\n  by auto\n\nlemma map_add_same_left_eq:\n  \"m\\<^sub>1 = m\\<^sub>1' \\<Longrightarrow> (m\\<^sub>0 ++ m\\<^sub>1 = m\\<^sub>0 ++ m\\<^sub>1')\"\n  by simp\n\nlemma map_add_left_cancelI [intro!]:\n  \"m\\<^sub>1 = m\\<^sub>1' \\<Longrightarrow> m\\<^sub>0 ++ m\\<^sub>1 = m\\<^sub>0 ++ m\\<^sub>1'\"\n  by simp\n\nlemma dom_empty_is_empty:\n  \"(dom m = {}) = (m = empty)\"\nproof (rule iffI)\n  assume a: \"dom m = {}\"\n  { assume \"m \\<noteq> empty\"\n    hence \"dom m \\<noteq> {}\"\n      by - (subst (asm) empty_forall_equiv, simp add: dom_def)\n    hence False using a by blast\n  }\n  thus \"m = empty\" by blast\nnext\n  assume a: \"m = empty\"\n  thus \"dom m = {}\" by simp\nqed\n\nlemma map_add_dom_eq:\n  \"dom m = dom m' \\<Longrightarrow> m ++ m' = m'\"\n  by (rule ext) (auto simp: map_add_def split: option.splits)\n\nlemma map_add_right_dom_eq:\n  \"\\<lbrakk> m\\<^sub>0 ++ m\\<^sub>1 = m\\<^sub>0' ++ m\\<^sub>1'; dom m\\<^sub>1 = dom m\\<^sub>1' \\<rbrakk> \\<Longrightarrow> m\\<^sub>1 = m\\<^sub>1'\"\n  unfolding map_add_def\n  by (rule ext, rule ccontr,\n      drule_tac x=x in fun_cong, clarsimp split: option.splits,\n      drule sym, drule sym, force+)\n\nlemma map_le_same_dom_eq:\n  \"\\<lbrakk> m\\<^sub>0 \\<subseteq>\\<^sub>m m\\<^sub>1 ; dom m\\<^sub>0 = dom m\\<^sub>1 \\<rbrakk> \\<Longrightarrow> m\\<^sub>0 = m\\<^sub>1\"\n  by (auto intro!: ext simp: map_le_def elim!: ballE)\n\nsubsection {* Properties of map restriction *}\n\nlemma restrict_map_cancel:\n  \"(m |` S = m |` T) = (dom m \\<inter> S = dom m \\<inter> T)\"\n  by (fastforce intro: set_eqI ext dest: fun_cong\n               simp: restrict_map_def None_not_eq\n               split: split_if_asm)\n\nlemma map_add_restricted_self [simp]:\n  \"m ++ m |` S = m\"\n  by (auto intro: ext simp: restrict_map_def map_add_def split: option.splits)\n\nlemma map_add_restrict_dom_right [simp]:\n  \"(m ++ m') |` dom m' = m'\"\n  by (rule ext, auto simp: restrict_map_def map_add_def split: option.splits)\n\nlemma restrict_map_UNIV [simp]:\n  \"m |` UNIV = m\"\n  by (simp add: restrict_map_def)\n\nlemma restrict_map_dom:\n  \"S = dom m \\<Longrightarrow> m |` S = m\"\n  by (auto intro!: ext simp: restrict_map_def None_not_eq)\n\nlemma restrict_map_subdom:\n  \"dom m \\<subseteq> S \\<Longrightarrow> m |` S = m\"\n  by (fastforce simp: restrict_map_def None_com intro: ext)\n\nlemma map_add_restrict:\n  \"(m\\<^sub>0 ++ m\\<^sub>1) |` S = ((m\\<^sub>0 |` S) ++ (m\\<^sub>1 |` S))\"\n  by (force simp: map_add_def restrict_map_def intro: ext)\n\nlemma map_le_restrict:\n  \"m \\<subseteq>\\<^sub>m m' \\<Longrightarrow> m = m' |` dom m\"\n  by (force simp: map_le_def restrict_map_def None_com intro: ext)\n\nlemma restrict_map_le:\n  \"m |` S \\<subseteq>\\<^sub>m m\"\n  by (auto simp: map_le_def)\n\nlemma restrict_map_remerge:\n  \"\\<lbrakk> S \\<inter> T = {} \\<rbrakk> \\<Longrightarrow> m |` S ++ m |` T = m |` (S \\<union> T)\"\n  by (rule ext, clarsimp simp: restrict_map_def map_add_def\n                         split: option.splits)\n\nlemma restrict_map_empty:\n  \"dom m \\<inter> S = {} \\<Longrightarrow> m |` S = empty\"\n  by (fastforce simp: restrict_map_def intro: ext)\n\nlemma map_add_restrict_comp_right [simp]:\n  \"(m |` S ++ m |` (UNIV - S)) = m\"\n  by (force simp: map_add_def restrict_map_def split: option.splits intro: ext)\n\nlemma map_add_restrict_comp_right_dom [simp]:\n  \"(m |` S ++ m |` (dom m - S)) = m\"\n  by (auto simp: map_add_def restrict_map_def split: option.splits intro!: ext)\n\nlemma map_add_restrict_comp_left [simp]:\n  \"(m |` (UNIV - S) ++ m |` S) = m\"\n  by (subst map_add_comm, auto)\n\nlemma restrict_self_UNIV:\n  \"m |` (dom m - S) = m |` (UNIV - S)\"\n  by (auto intro!: ext simp: restrict_map_def)\n\nlemma map_add_restrict_nonmember_right:\n  \"x \\<notin> dom m' \\<Longrightarrow> (m ++ m') |` {x} = m |` {x}\"\n  by (rule ext, auto simp: restrict_map_def map_add_def split: option.splits)\n\nlemma map_add_restrict_nonmember_left:\n  \"x \\<notin> dom m \\<Longrightarrow> (m ++ m') |` {x} = m' |` {x}\"\n  by (rule ext, auto simp: restrict_map_def map_add_def split: option.splits)\n\nlemma map_add_restrict_right:\n  \"x \\<subseteq> dom m' \\<Longrightarrow> (m ++ m') |` x = m' |` x\"\n  by (rule ext, auto simp: restrict_map_def map_add_def split: option.splits)\n\nlemma restrict_map_compose:\n  \"\\<lbrakk> S \\<union> T = dom m ; S \\<inter> T = {} \\<rbrakk> \\<Longrightarrow> m |` S ++ m |` T = m\"\n  by (fastforce intro: ext simp: map_add_def restrict_map_def)\n\nlemma map_le_dom_subset_restrict:\n  \"\\<lbrakk> m' \\<subseteq>\\<^sub>m m; dom m' \\<subseteq> S \\<rbrakk> \\<Longrightarrow> m' \\<subseteq>\\<^sub>m (m |` S)\"\n  by (force simp: restrict_map_def map_le_def)\n\nlemma map_le_dom_restrict_sub_add:\n  \"m' \\<subseteq>\\<^sub>m m \\<Longrightarrow> m |` (dom m - dom m') ++ m' = m\"\n  by (auto simp: None_com map_add_def restrict_map_def map_le_def\n           split: option.splits\n           intro!: ext)\n     (force simp: Some_com)+\n\nlemma subset_map_restrict_sub_add:\n  \"T \\<subseteq> S \\<Longrightarrow> m |` (S - T) ++ m |` T = m |` S\"\n  by (auto simp: restrict_map_def map_add_def intro!: ext split: option.splits)\n\nlemma restrict_map_sub_union:\n  \"m |` (dom m - (S \\<union> T)) = (m |` (dom m - T)) |` (dom m - S)\"\n  by (auto intro!: ext simp: restrict_map_def)\n\nlemma prod_restrict_map_add:\n  \"\\<lbrakk> S \\<union> T = U; S \\<inter> T = {} \\<rbrakk> \\<Longrightarrow> m |` (X \\<times> S) ++ m |` (X \\<times> T) = m |` (X \\<times> U)\"\n  by (auto simp: map_add_def restrict_map_def intro!: ext split: option.splits)\n\n\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\ntext {* Things that should NOT go into Map.thy *}\ntext {* \\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash>\\<emdash> *}\n\nsection {* Definitions *}\n\ntext {* Map disjuction *}\n\ndefinition\n  map_disj :: \"('a \\<rightharpoonup> 'b) \\<Rightarrow> ('a \\<rightharpoonup> 'b) \\<Rightarrow> bool\" (infix \"\\<bottom>\" 51) where\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<equiv> dom h\\<^sub>0 \\<inter> dom h\\<^sub>1 = {}\"\n\ndeclare None_not_eq [simp]\n\ntext {* Heap monotonicity and the frame property *}\n\ndefinition\n  heap_mono :: \"(('a \\<rightharpoonup> 'b) \\<Rightarrow> 'c option) \\<Rightarrow> bool\" where\n  \"heap_mono f \\<equiv> \\<forall>h h' v. h \\<bottom> h' \\<and> f h = Some v \\<longrightarrow> f (h ++ h') = Some v\"\n\nlemma heap_monoE:\n  \"\\<lbrakk> heap_mono f ; f h = Some v ; h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> f (h ++ h') = Some v\"\n  unfolding heap_mono_def by blast\n\nlemma heap_mono_simp:\n  \"\\<lbrakk> heap_mono f ; f h = Some v ; h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> f (h ++ h') = f h\"\n  by (frule (2) heap_monoE, simp)\n\ndefinition\n  heap_frame :: \"(('a \\<rightharpoonup> 'b) \\<Rightarrow> 'c option) \\<Rightarrow> bool\" where\n  \"heap_frame f \\<equiv> \\<forall>h h' v. h \\<bottom> h' \\<and> f (h ++ h') = Some v\n                           \\<longrightarrow> (f h = Some v \\<or> f h = None)\"\n\nlemma heap_frameE:\n  \"\\<lbrakk> heap_frame f ; f (h ++ h') = Some v ; h \\<bottom> h' \\<rbrakk>\n   \\<Longrightarrow> f h = Some v \\<or> f h = None\"\n  unfolding heap_frame_def by fastforce\n\n\nsection {* Properties of @{term \"sub_restrict_map\"} *}\n\n\n\nlemma restrict_map_sub_add: \"h |` S ++ h `- S = h\"\n  by (fastforce simp: sub_restrict_map_def restrict_map_def map_add_def\n               split: option.splits split_if\n               intro: ext)\n\n\nsection {* Properties of map disjunction *}\n\nlemma map_disj_empty_right [simp]:\n  \"h \\<bottom> empty\"\n  by (simp add: map_disj_def)\n\nlemma map_disj_empty_left [simp]:\n  \"empty \\<bottom> h\"\n  by (simp add: map_disj_def)\n\nlemma map_disj_com:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 = h\\<^sub>1 \\<bottom> h\\<^sub>0\"\n  by (simp add: map_disj_def, fast)\n\nlemma map_disjD:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> dom h\\<^sub>0 \\<inter> dom h\\<^sub>1 = {}\"\n  by (simp add: map_disj_def)\n\nlemma map_disjI:\n  \"dom h\\<^sub>0 \\<inter> dom h\\<^sub>1 = {} \\<Longrightarrow> h\\<^sub>0 \\<bottom> h\\<^sub>1\"\n  by (simp add: map_disj_def)\n\n\nsubsection {* Map associativity-commutativity based on map disjuction *}\n\nlemma map_add_com:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>1 ++ h\\<^sub>0\"\n  by (drule map_disjD, rule map_add_comm, force)\n\nlemma map_add_left_commute:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 ++ (h\\<^sub>1 ++ h\\<^sub>2) = h\\<^sub>1 ++ (h\\<^sub>0 ++ h\\<^sub>2)\"\n  by (simp add: map_add_com map_disj_com map_add_assoc)\n\nlemma map_add_disj:\n  \"h\\<^sub>0 \\<bottom> (h\\<^sub>1 ++ h\\<^sub>2) = (h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<and> h\\<^sub>0 \\<bottom> h\\<^sub>2)\"\n  by (simp add: map_disj_def, fast)\n\nlemma map_add_disj':\n  \"(h\\<^sub>1 ++ h\\<^sub>2) \\<bottom> h\\<^sub>0 = (h\\<^sub>1 \\<bottom> h\\<^sub>0 \\<and> h\\<^sub>2 \\<bottom> h\\<^sub>0)\"\n  by (simp add: map_disj_def, fast)\n\ntext {*\n  We redefine @{term \"map_add\"} associativity to bind to the right, which\n  seems to be the more common case.\n  Note that when a theory includes Map again, @{text \"map_add_assoc\"} will\n  return to the simpset and will cause infinite loops if its symmetric\n  counterpart is added (e.g. via @{text \"map_ac_simps\"})\n  *}\n\ndeclare map_add_assoc [simp del]\n\ntext {*\n  Since the associativity-commutativity of @{term \"map_add\"} relies on\n  map disjunction, we include some basic rules into the ac set.\n  *}\n\nlemmas map_ac_simps =\n  map_add_assoc[symmetric] map_add_com map_disj_com\n  map_add_left_commute map_add_disj map_add_disj'\n\n\nsubsection {* Basic properties *}\n\nlemma map_disj_None_right:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; x \\<in> dom h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> h\\<^sub>1 x = None\"\n  by (auto simp: map_disj_def dom_def)\n\nlemma map_disj_None_left:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; x \\<in> dom h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 x = None\"\n  by (auto simp: map_disj_def dom_def)\n\nlemma map_disj_None_left':\n  \"\\<lbrakk> h\\<^sub>0 x = Some y ; h\\<^sub>1 \\<bottom> h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> h\\<^sub>1 x = None \"\n  by (auto simp: map_disj_def)\n\nlemma map_disj_None_right':\n  \"\\<lbrakk> h\\<^sub>1 x = Some y ; h\\<^sub>1 \\<bottom> h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 x = None \"\n  by (auto simp: map_disj_def)\n\nlemma map_disj_common:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; h\\<^sub>0 p = Some v ; h\\<^sub>1 p = Some v' \\<rbrakk> \\<Longrightarrow> False\"\n  by (frule (1) map_disj_None_left', simp)\n\n\nsubsection {* Map disjunction and addition *}\n\nlemma map_add_eval_left:\n  \"\\<lbrakk> x \\<in> dom h ; h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> (h ++ h') x = h x\"\n  by (auto dest!: map_disj_None_right simp: map_add_def cong: option.case_cong)\n\nlemma map_add_eval_right:\n  \"\\<lbrakk> x \\<in> dom h' ; h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> (h ++ h') x = h' x\"\n  by (auto elim!: map_disjD simp: map_add_comm map_add_eval_left map_disj_com)\n\n\n\nlemma map_add_eval_right':\n  \"\\<lbrakk> x \\<notin> dom h ; h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> (h ++ h') x = h' x\"\n  by (clarsimp simp: map_disj_def map_add_def split: option.splits)\n\nlemma map_add_left_dom_eq:\n  assumes eq: \"h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>0' ++ h\\<^sub>1'\"\n  assumes etc: \"h\\<^sub>0 \\<bottom> h\\<^sub>1\" \"h\\<^sub>0' \\<bottom> h\\<^sub>1'\" \"dom h\\<^sub>0 = dom h\\<^sub>0'\"\n  shows \"h\\<^sub>0 = h\\<^sub>0'\"\nproof -\n  from eq have \"h\\<^sub>1 ++ h\\<^sub>0 = h\\<^sub>1' ++ h\\<^sub>0'\" using etc by (simp add: map_ac_simps)\n  thus ?thesis using etc\n    by (fastforce elim!: map_add_right_dom_eq simp: map_ac_simps)\nqed\n\nlemma map_add_left_eq:\n  assumes eq: \"h\\<^sub>0 ++ h = h\\<^sub>1 ++ h\"\n  assumes disj: \"h\\<^sub>0 \\<bottom> h\" \"h\\<^sub>1 \\<bottom> h\"\n  shows \"h\\<^sub>0 = h\\<^sub>1\"\nproof (rule ext)\n  fix x\n  from eq have eq': \"(h\\<^sub>0 ++ h) x = (h\\<^sub>1 ++ h) x\" by (auto intro!: ext)\n  { assume \"x \\<in> dom h\"\n    hence \"h\\<^sub>0 x = h\\<^sub>1 x\" using disj by (simp add: map_disj_None_left)\n  } moreover {\n    assume \"x \\<notin> dom h\"\n    hence \"h\\<^sub>0 x = h\\<^sub>1 x\" using disj eq' by (simp add: map_add_eval_left')\n  }\n  ultimately show \"h\\<^sub>0 x = h\\<^sub>1 x\" by cases\nqed\n\n\nlemma map_add_right_eq:\n  \"\\<lbrakk>h ++ h\\<^sub>0 = h ++ h\\<^sub>1; h\\<^sub>0 \\<bottom> h; h\\<^sub>1 \\<bottom> h\\<rbrakk> \\<Longrightarrow> h\\<^sub>0 = h\\<^sub>1\"\n  by (rule_tac h=h in map_add_left_eq, auto simp: map_ac_simps)\n\nlemma map_disj_add_eq_dom_right_eq:\n  assumes merge: \"h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>0' ++ h\\<^sub>1'\" and d: \"dom h\\<^sub>0 = dom h\\<^sub>0'\" and\n      ab_disj: \"h\\<^sub>0 \\<bottom> h\\<^sub>1\" and cd_disj: \"h\\<^sub>0' \\<bottom> h\\<^sub>1'\"\n  shows \"h\\<^sub>1 = h\\<^sub>1'\"\nproof (rule ext)\n  fix x\n  from merge have merge_x: \"(h\\<^sub>0 ++ h\\<^sub>1) x = (h\\<^sub>0' ++ h\\<^sub>1') x\" by simp\n  with d ab_disj cd_disj show  \"h\\<^sub>1 x = h\\<^sub>1' x\"\n    by - (case_tac \"h\\<^sub>1 x\", case_tac \"h\\<^sub>1' x\", simp, fastforce simp: map_disj_def,\n          case_tac \"h\\<^sub>1' x\", clarsimp, simp add: Some_com,\n          force simp: map_disj_def, simp)\nqed\n\nlemma map_disj_add_eq_dom_left_eq:\n  assumes add: \"h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>0' ++ h\\<^sub>1'\" and\n          dom: \"dom h\\<^sub>1 = dom h\\<^sub>1'\" and\n          disj: \"h\\<^sub>0 \\<bottom> h\\<^sub>1\" \"h\\<^sub>0' \\<bottom> h\\<^sub>1'\"\n  shows \"h\\<^sub>0 = h\\<^sub>0'\"\nproof -\n  have \"h\\<^sub>1 ++ h\\<^sub>0 = h\\<^sub>1' ++ h\\<^sub>0'\" using add disj by (simp add: map_ac_simps)\n  thus ?thesis using dom disj\n    by - (rule map_disj_add_eq_dom_right_eq, auto simp: map_disj_com)\nqed\n\nlemma map_add_left_cancel:\n  assumes disj: \"h\\<^sub>0 \\<bottom> h\\<^sub>1\" \"h\\<^sub>0 \\<bottom> h\\<^sub>1'\"\n  shows \"(h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>0 ++ h\\<^sub>1') = (h\\<^sub>1 = h\\<^sub>1')\"\nproof (rule iffI, rule ext)\n  fix x\n  assume \"(h\\<^sub>0 ++ h\\<^sub>1) = (h\\<^sub>0 ++ h\\<^sub>1')\"\n  hence \"(h\\<^sub>0 ++ h\\<^sub>1) x = (h\\<^sub>0 ++ h\\<^sub>1') x\" by (auto intro!: ext)\n  hence \"h\\<^sub>1 x = h\\<^sub>1' x\" using disj\n    by - (cases \"x \\<in> dom h\\<^sub>0\",\n          simp_all add: map_disj_None_right map_add_eval_right')\n  thus \"h\\<^sub>1 x = h\\<^sub>1' x\" by (auto intro!: ext)\nqed auto\n\nlemma map_add_lr_disj:\n  \"\\<lbrakk> h\\<^sub>0 ++ h\\<^sub>1 = h\\<^sub>0' ++ h\\<^sub>1'; h\\<^sub>1 \\<bottom> h\\<^sub>1'  \\<rbrakk> \\<Longrightarrow> dom h\\<^sub>1 \\<subseteq> dom h\\<^sub>0'\"\n  by (clarsimp simp: map_disj_def map_add_def, drule_tac x=x in fun_cong)\n     (auto split: option.splits)\n\n\nsubsection {* Map disjunction and updates *}\n\nlemma map_disj_update_left [simp]:\n  \"p \\<in> dom h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 \\<bottom> h\\<^sub>1(p \\<mapsto> v) = h\\<^sub>0 \\<bottom> h\\<^sub>1\"\n  by (clarsimp simp add: map_disj_def, blast)\n\nlemma map_disj_update_right [simp]:\n  \"p \\<in> dom h\\<^sub>1 \\<Longrightarrow> h\\<^sub>1(p \\<mapsto> v) \\<bottom> h\\<^sub>0 = h\\<^sub>1 \\<bottom> h\\<^sub>0\"\n  by (simp add: map_disj_com)\n\nlemma map_add_update_left:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; p \\<in> dom h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> (h\\<^sub>0 ++ h\\<^sub>1)(p \\<mapsto> v) = (h\\<^sub>0(p \\<mapsto> v) ++ h\\<^sub>1)\"\n  by (drule (1) map_disj_None_right)\n     (auto intro: ext simp: map_add_def cong: option.case_cong)\n\nlemma map_add_update_right:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; p \\<in> dom h\\<^sub>1  \\<rbrakk> \\<Longrightarrow> (h\\<^sub>0 ++ h\\<^sub>1)(p \\<mapsto> v) = (h\\<^sub>0 ++ h\\<^sub>1 (p \\<mapsto> v))\"\n  by (drule (1) map_disj_None_left)\n     (auto intro: ext simp: map_add_def cong: option.case_cong)\n\n\n\n\nsubsection {* Map disjunction and @{term \"map_le\"} *}\n\nlemma map_le_override [simp]:\n  \"\\<lbrakk> h \\<bottom> h' \\<rbrakk> \\<Longrightarrow> h \\<subseteq>\\<^sub>m h ++ h'\"\n  by (auto simp: map_le_def map_add_def map_disj_def split: option.splits)\n\nlemma map_leI_left:\n  \"\\<lbrakk> h = h\\<^sub>0 ++ h\\<^sub>1 ; h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 \\<subseteq>\\<^sub>m h\" by auto\n\nlemma map_leI_right:\n  \"\\<lbrakk> h = h\\<^sub>0 ++ h\\<^sub>1 ; h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>1 \\<subseteq>\\<^sub>m h\" by auto\n\nlemma map_disj_map_le:\n  \"\\<lbrakk> h\\<^sub>0' \\<subseteq>\\<^sub>m h\\<^sub>0; h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0' \\<bottom> h\\<^sub>1\"\n  by (force simp: map_disj_def map_le_def)\n\nlemma map_le_on_disj_left:\n  \"\\<lbrakk> h' \\<subseteq>\\<^sub>m h ; h\\<^sub>0 \\<bottom> h\\<^sub>1 ; h' = h\\<^sub>0 ++ h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 \\<subseteq>\\<^sub>m h\"\n  unfolding map_le_def\n  by (rule ballI, erule_tac x=a in ballE, auto simp: map_add_eval_left)+\n\nlemma map_le_on_disj_right:\n  \"\\<lbrakk> h' \\<subseteq>\\<^sub>m h ; h\\<^sub>0 \\<bottom> h\\<^sub>1 ; h' = h\\<^sub>1 ++ h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 \\<subseteq>\\<^sub>m h\"\n  by (auto simp: map_le_on_disj_left map_ac_simps)\n\nlemma map_le_add_cancel:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1 ; h\\<^sub>0' \\<subseteq>\\<^sub>m h\\<^sub>0 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0' ++ h\\<^sub>1 \\<subseteq>\\<^sub>m h\\<^sub>0 ++ h\\<^sub>1\"\n  by (auto simp: map_le_def map_add_def map_disj_def split: option.splits)\n\nlemma map_le_override_bothD:\n  assumes subm: \"h\\<^sub>0' ++ h\\<^sub>1 \\<subseteq>\\<^sub>m h\\<^sub>0 ++ h\\<^sub>1\"\n  assumes disj': \"h\\<^sub>0' \\<bottom> h\\<^sub>1\"\n  assumes disj: \"h\\<^sub>0 \\<bottom> h\\<^sub>1\"\n  shows \"h\\<^sub>0' \\<subseteq>\\<^sub>m h\\<^sub>0\"\nunfolding map_le_def\nproof (rule ballI)\n  fix a\n  assume a: \"a \\<in> dom h\\<^sub>0'\"\n  hence sumeq: \"(h\\<^sub>0' ++ h\\<^sub>1) a = (h\\<^sub>0 ++ h\\<^sub>1) a\"\n    using subm unfolding map_le_def by auto\n  from a have \"a \\<notin> dom h\\<^sub>1\" using disj' by (auto dest!: map_disj_None_right)\n  thus \"h\\<^sub>0' a = h\\<^sub>0 a\" using a sumeq disj disj'\n    by (simp add: map_add_eval_left map_add_eval_left')\nqed\n\nlemma map_le_conv:\n  \"(h\\<^sub>0' \\<subseteq>\\<^sub>m h\\<^sub>0 \\<and> h\\<^sub>0' \\<noteq> h\\<^sub>0) = (\\<exists>h\\<^sub>1. h\\<^sub>0 = h\\<^sub>0' ++ h\\<^sub>1 \\<and> h\\<^sub>0' \\<bottom> h\\<^sub>1 \\<and> h\\<^sub>0' \\<noteq> h\\<^sub>0)\"\n  unfolding map_le_def map_disj_def map_add_def\n  by (rule iffI,\n      clarsimp intro!: exI[where x=\"\\<lambda>x. if x \\<notin> dom h\\<^sub>0' then h\\<^sub>0 x else None\"])\n     (fastforce intro: ext intro: set_eqI split: option.splits split_if_asm)+\n\nlemma map_le_conv2:\n  \"h\\<^sub>0' \\<subseteq>\\<^sub>m h\\<^sub>0 = (\\<exists>h\\<^sub>1. h\\<^sub>0 = h\\<^sub>0' ++ h\\<^sub>1 \\<and> h\\<^sub>0' \\<bottom> h\\<^sub>1)\"\n  by (case_tac \"h\\<^sub>0'=h\\<^sub>0\", insert map_le_conv, auto intro: exI[where x=empty])\n\n\nsubsection {* Map disjunction and restriction *}\n\nlemma map_disj_comp [simp]:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 |` (UNIV - dom h\\<^sub>0)\"\n  by (force simp: map_disj_def)\n\nlemma restrict_map_disj:\n  \"S \\<inter> T = {} \\<Longrightarrow> h |` S \\<bottom> h |` T\"\n  by (auto simp: map_disj_def restrict_map_def dom_def)\n\nlemma map_disj_restrict_dom [simp]:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 |` (dom h\\<^sub>1 - dom h\\<^sub>0)\"\n  by (force simp: map_disj_def)\n\nlemma restrict_map_disj_dom_empty:\n  \"h \\<bottom> h' \\<Longrightarrow> h |` dom h' = empty\"\n  by (fastforce simp: map_disj_def restrict_map_def intro: ext)\n\nlemma restrict_map_univ_disj_eq:\n  \"h \\<bottom> h' \\<Longrightarrow> h |` (UNIV - dom h') = h\"\n  by (rule ext, auto simp: map_disj_def restrict_map_def)\n\nlemma restrict_map_disj_dom:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> h |` dom h\\<^sub>0 \\<bottom> h |` dom h\\<^sub>1\"\n  by (auto simp: map_disj_def restrict_map_def dom_def)\n\nlemma map_add_restrict_dom_left:\n  \"h \\<bottom> h' \\<Longrightarrow> (h ++ h') |` dom h = h\"\n  by (rule ext, auto simp: restrict_map_def map_add_def dom_def map_disj_def\n                     split: option.splits)\n\n\n\nlemma restrict_map_disj_right:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 \\<bottom> h\\<^sub>1 |` S\"\n  by (auto simp: map_disj_def)\n\nlemmas restrict_map_disj_both = restrict_map_disj_right restrict_map_disj_left\n\nlemma map_dom_disj_restrict_right:\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> (h\\<^sub>0 ++ h\\<^sub>0') |` dom h\\<^sub>1 = h\\<^sub>0' |` dom h\\<^sub>1\"\n  by (simp add: map_add_restrict restrict_map_empty map_disj_def)\n\nlemma restrict_map_on_disj:\n  \"h\\<^sub>0' \\<bottom> h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 |` dom h\\<^sub>0' \\<bottom> h\\<^sub>1\"\n  unfolding map_disj_def by auto\n\nlemma restrict_map_on_disj':\n  \"h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<Longrightarrow> h\\<^sub>0 \\<bottom> h\\<^sub>1 |` S\"\n  by (auto simp: map_disj_def map_add_def)\n\nlemma map_le_sub_dom:\n  \"\\<lbrakk> h\\<^sub>0 ++ h\\<^sub>1 \\<subseteq>\\<^sub>m h ; h\\<^sub>0 \\<bottom> h\\<^sub>1 \\<rbrakk> \\<Longrightarrow> h\\<^sub>0 \\<subseteq>\\<^sub>m h |` (dom h - dom h\\<^sub>1)\"\n  by (rule map_le_override_bothD, subst map_le_dom_restrict_sub_add)\n     (auto elim: map_add_le_mapE simp: map_ac_simps)\n\nlemma map_submap_break:\n  \"\\<lbrakk> h \\<subseteq>\\<^sub>m h' \\<rbrakk> \\<Longrightarrow> h' = (h' |` (UNIV - dom h)) ++ h\"\n  by (fastforce intro!: ext split: option.splits\n               simp: map_le_restrict restrict_map_def map_le_def map_add_def\n                     dom_def)\n\nlemma map_add_disj_restrict_both:\n  \"\\<lbrakk> h\\<^sub>0 \\<bottom> h\\<^sub>1; S \\<inter> S' = {}; T \\<inter> T' = {} \\<rbrakk>\n   \\<Longrightarrow> (h\\<^sub>0 |` S) ++ (h\\<^sub>1 |` T) \\<bottom> (h\\<^sub>0 |` S') ++ (h\\<^sub>1 |` T')\"\n  by (auto simp: map_ac_simps intro!: restrict_map_disj_both restrict_map_disj)\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/c-parser/umm_heap/MapExtra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.611381973294151, "lm_q1q2_score": 0.3104670196452016}}
{"text": "(*  Title:      HOL/Auth/ZhouGollmann.thy\n    Author:     Giampaolo Bella and L C Paulson, Cambridge Univ Computer Lab\n    Copyright   2003  University of Cambridge\n\nThe protocol of\n  Jianying Zhou and Dieter Gollmann,\n  A Fair Non-Repudiation Protocol,\n  Security and Privacy 1996 (Oakland)\n  55-61\n*)\n\ntheory ZhouGollmann imports Public begin\n\nabbreviation\n  TTP :: agent where \"TTP == Server\"\n\nabbreviation f_sub :: nat where \"f_sub == 5\"\nabbreviation f_nro :: nat where \"f_nro == 2\"\nabbreviation f_nrr :: nat where \"f_nrr == 3\"\nabbreviation f_con :: nat where \"f_con == 4\"\n\n\ndefinition broken :: \"agent set\" where    \n    \\<comment> \\<open>the compromised honest agents; TTP is included as it's not allowed to\n        use the protocol\\<close>\n   \"broken == bad - {Spy}\"\n\ndeclare broken_def [simp]\n\ninductive_set zg :: \"event list set\"\n  where\n\n  Nil:  \"[] \\<in> zg\"\n\n| Fake: \"\\<lbrakk>evsf \\<in> zg;  X \\<in> synth (analz (spies evsf))\\<rbrakk>\n         \\<Longrightarrow> Says Spy B X  # evsf \\<in> zg\"\n\n| Reception:  \"\\<lbrakk>evsr \\<in> zg; Says A B X \\<in> set evsr\\<rbrakk> \\<Longrightarrow> Gets B X # evsr \\<in> zg\"\n\n  (*L is fresh for honest agents.\n    We don't require K to be fresh because we don't bother to prove secrecy!\n    We just assume that the protocol's objective is to deliver K fairly,\n    rather than to keep M secret.*)\n| ZG1: \"\\<lbrakk>evs1 \\<in> zg;  Nonce L \\<notin> used evs1; C = Crypt K (Number m);\n           K \\<in> symKeys;\n           NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, C\\<rbrace>\\<rbrakk>\n       \\<Longrightarrow> Says A B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> # evs1 \\<in> zg\"\n\n  (*B must check that NRO is A's signature to learn the sender's name*)\n| ZG2: \"\\<lbrakk>evs2 \\<in> zg;\n           Gets B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs2;\n           NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, C\\<rbrace>;\n           NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, C\\<rbrace>\\<rbrakk>\n       \\<Longrightarrow> Says B A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> # evs2  \\<in>  zg\"\n\n  (*A must check that NRR is B's signature to learn the sender's name;\n    without spy, the matching label would be enough*)\n| ZG3: \"\\<lbrakk>evs3 \\<in> zg; C = Crypt K M; K \\<in> symKeys;\n           Says A B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs3;\n           Gets A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs3;\n           NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, C\\<rbrace>;\n           sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>\\<rbrakk>\n       \\<Longrightarrow> Says A TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace>\n             # evs3 \\<in> zg\"\n\n (*TTP checks that sub_K is A's signature to learn who issued K, then\n   gives credentials to A and B.  The Notes event models the availability of\n   the credentials, but the act of fetching them is not modelled.  We also\n   give con_K to the Spy. This makes the threat model more dangerous, while \n   also allowing lemma @{text Crypt_used_imp_spies} to omit the condition\n   @{term \"K \\<noteq> priK TTP\"}. *)\n| ZG4: \"\\<lbrakk>evs4 \\<in> zg; K \\<in> symKeys;\n           Gets TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace>\n             \\<in> set evs4;\n           sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n           con_K = Crypt (priK TTP) \\<lbrace>Number f_con, Agent A, Agent B,\n                                      Nonce L, Key K\\<rbrace>\\<rbrakk>\n       \\<Longrightarrow> Says TTP Spy con_K\n           #\n           Notes TTP \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K, con_K\\<rbrace>\n           # evs4 \\<in> zg\"\n\n\ndeclare Says_imp_knows_Spy [THEN analz.Inj, dest]\ndeclare Fake_parts_insert_in_Un  [dest]\ndeclare analz_into_parts [dest]\n\ndeclare symKey_neq_priEK [simp]\ndeclare symKey_neq_priEK [THEN not_sym, simp]\n\n\ntext\\<open>A \"possibility property\": there are traces that reach the end\\<close>\nlemma \"\\<lbrakk>A \\<noteq> B; TTP \\<noteq> A; TTP \\<noteq> B; K \\<in> symKeys\\<rbrakk> \\<Longrightarrow>\n     \\<exists>L. \\<exists>evs \\<in> zg.\n           Notes TTP \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K,\n               Crypt (priK TTP) \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K\\<rbrace>\\<rbrace>\n               \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] zg.Nil\n                    [THEN zg.ZG1, THEN zg.Reception [of _ A B],\n                     THEN zg.ZG2, THEN zg.Reception [of _ B A],\n                     THEN zg.ZG3, THEN zg.Reception [of _ A TTP], \n                     THEN zg.ZG4])\napply (basic_possibility, auto)\ndone\n\nsubsection \\<open>Basic Lemmas\\<close>\n\nlemma Gets_imp_Says:\n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> zg\\<rbrakk> \\<Longrightarrow> \\<exists>A. Says A B X \\<in> set evs\"\napply (erule rev_mp)\napply (erule zg.induct, auto)\ndone\n\nlemma Gets_imp_knows_Spy:\n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> zg\\<rbrakk>  \\<Longrightarrow> X \\<in> spies evs\"\nby (blast dest!: Gets_imp_Says Says_imp_knows_Spy)\n\n\ntext\\<open>Lets us replace proofs about \\<^term>\\<open>used evs\\<close> by simpler proofs \nabout \\<^term>\\<open>parts (spies evs)\\<close>.\\<close>\nlemma Crypt_used_imp_spies:\n     \"\\<lbrakk>Crypt K X \\<in> used evs; evs \\<in> zg\\<rbrakk>\n      \\<Longrightarrow> Crypt K X \\<in> parts (spies evs)\"\napply (erule rev_mp)\napply (erule zg.induct)\napply (simp_all add: parts_insert_knows_A) \ndone\n\nlemma Notes_TTP_imp_Gets:\n     \"\\<lbrakk>Notes TTP \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K, con_K\\<rbrace>\n           \\<in> set evs;\n        sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n        evs \\<in> zg\\<rbrakk>\n    \\<Longrightarrow> Gets TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs\"\napply (erule rev_mp)\napply (erule zg.induct, auto)\ndone\n\ntext\\<open>For reasoning about C, which is encrypted in message ZG2\\<close>\nlemma ZG2_msg_in_parts_spies:\n     \"\\<lbrakk>Gets B \\<lbrace>F, B', L, C, X\\<rbrace> \\<in> set evs; evs \\<in> zg\\<rbrakk>\n      \\<Longrightarrow> C \\<in> parts (spies evs)\"\nby (blast dest: Gets_imp_Says)\n\n(*classical regularity lemma on priK*)\nlemma Spy_see_priK [simp]:\n     \"evs \\<in> zg \\<Longrightarrow> (Key (priK A) \\<in> parts (spies evs)) = (A \\<in> bad)\"\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, auto)\ndone\n\ntext\\<open>So that blast can use it too\\<close>\ndeclare  Spy_see_priK [THEN [2] rev_iffD1, dest!]\n\nlemma Spy_analz_priK [simp]:\n     \"evs \\<in> zg \\<Longrightarrow> (Key (priK A) \\<in> analz (spies evs)) = (A \\<in> bad)\"\nby auto \n\n\nsubsection\\<open>About NRO: Validity for \\<^term>\\<open>B\\<close>\\<close>\n\ntext\\<open>Below we prove that if \\<^term>\\<open>NRO\\<close> exists then \\<^term>\\<open>A\\<close> definitely\nsent it, provided \\<^term>\\<open>A\\<close> is not broken.\\<close>\n\ntext\\<open>Strong conclusion for a good agent\\<close>\nlemma NRO_validity_good:\n     \"\\<lbrakk>NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, C\\<rbrace>;\n        NRO \\<in> parts (spies evs);\n        A \\<notin> bad;  evs \\<in> zg\\<rbrakk>\n     \\<Longrightarrow> Says A B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, auto)  \ndone\n\nlemma NRO_sender:\n     \"\\<lbrakk>Says A' B \\<lbrace>n, b, l, C, Crypt (priK A) X\\<rbrace> \\<in> set evs; evs \\<in> zg\\<rbrakk>\n    \\<Longrightarrow> A' \\<in> {A,Spy}\"\napply (erule rev_mp)  \napply (erule zg.induct, simp_all)\ndone\n\ntext\\<open>Holds also for \\<^term>\\<open>A = Spy\\<close>!\\<close>\ntheorem NRO_validity:\n     \"\\<lbrakk>Gets B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs;\n        NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, C\\<rbrace>;\n        A \\<notin> broken;  evs \\<in> zg\\<rbrakk>\n     \\<Longrightarrow> Says A B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs\"\napply (drule Gets_imp_Says, assumption) \napply clarify \napply (frule NRO_sender, auto)\ntxt\\<open>We are left with the case where the sender is \\<^term>\\<open>Spy\\<close> and not\n  equal to \\<^term>\\<open>A\\<close>, because \\<^term>\\<open>A \\<notin> bad\\<close>. \n  Thus theorem \\<open>NRO_validity_good\\<close> applies.\\<close>\napply (blast dest: NRO_validity_good [OF refl])\ndone\n\n\nsubsection\\<open>About NRR: Validity for \\<^term>\\<open>A\\<close>\\<close>\n\ntext\\<open>Below we prove that if \\<^term>\\<open>NRR\\<close> exists then \\<^term>\\<open>B\\<close> definitely\nsent it, provided \\<^term>\\<open>B\\<close> is not broken.\\<close>\n\ntext\\<open>Strong conclusion for a good agent\\<close>\nlemma NRR_validity_good:\n     \"\\<lbrakk>NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, C\\<rbrace>;\n        NRR \\<in> parts (spies evs);\n        B \\<notin> bad;  evs \\<in> zg\\<rbrakk>\n     \\<Longrightarrow> Says B A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct) \napply (frule_tac [5] ZG2_msg_in_parts_spies, auto)  \ndone\n\nlemma NRR_sender:\n     \"\\<lbrakk>Says B' A \\<lbrace>n, a, l, Crypt (priK B) X\\<rbrace> \\<in> set evs; evs \\<in> zg\\<rbrakk>\n    \\<Longrightarrow> B' \\<in> {B,Spy}\"\napply (erule rev_mp)  \napply (erule zg.induct, simp_all)\ndone\n\ntext\\<open>Holds also for \\<^term>\\<open>B = Spy\\<close>!\\<close>\ntheorem NRR_validity:\n     \"\\<lbrakk>Says B' A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs;\n        NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, C\\<rbrace>;\n        B \\<notin> broken; evs \\<in> zg\\<rbrakk>\n    \\<Longrightarrow> Says B A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs\"\napply clarify \napply (frule NRR_sender, auto)\ntxt\\<open>We are left with the case where \\<^term>\\<open>B' = Spy\\<close> and  \\<^term>\\<open>B' \\<noteq> B\\<close>,\n  i.e. \\<^term>\\<open>B \\<notin> bad\\<close>, when we can apply \\<open>NRR_validity_good\\<close>.\\<close>\n apply (blast dest: NRR_validity_good [OF refl])\ndone\n\n\nsubsection\\<open>Proofs About \\<^term>\\<open>sub_K\\<close>\\<close>\n\ntext\\<open>Below we prove that if \\<^term>\\<open>sub_K\\<close> exists then \\<^term>\\<open>A\\<close> definitely\nsent it, provided \\<^term>\\<open>A\\<close> is not broken.\\<close>\n\ntext\\<open>Strong conclusion for a good agent\\<close>\nlemma sub_K_validity_good:\n     \"\\<lbrakk>sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n        sub_K \\<in> parts (spies evs);\n        A \\<notin> bad;  evs \\<in> zg\\<rbrakk>\n     \\<Longrightarrow> Says A TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close> \napply (blast dest!: Fake_parts_sing_imp_Un)\ndone\n\nlemma sub_K_sender:\n     \"\\<lbrakk>Says A' TTP \\<lbrace>n, b, l, k, Crypt (priK A) X\\<rbrace> \\<in> set evs;  evs \\<in> zg\\<rbrakk>\n    \\<Longrightarrow> A' \\<in> {A,Spy}\"\napply (erule rev_mp)  \napply (erule zg.induct, simp_all)\ndone\n\ntext\\<open>Holds also for \\<^term>\\<open>A = Spy\\<close>!\\<close>\ntheorem sub_K_validity:\n     \"\\<lbrakk>Gets TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs;\n        sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n        A \\<notin> broken;  evs \\<in> zg\\<rbrakk>\n     \\<Longrightarrow> Says A TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs\"\napply (drule Gets_imp_Says, assumption) \napply clarify \napply (frule sub_K_sender, auto)\ntxt\\<open>We are left with the case where the sender is \\<^term>\\<open>Spy\\<close> and not\n  equal to \\<^term>\\<open>A\\<close>, because \\<^term>\\<open>A \\<notin> bad\\<close>. \n  Thus theorem \\<open>sub_K_validity_good\\<close> applies.\\<close>\napply (blast dest: sub_K_validity_good [OF refl])\ndone\n\n\n\nsubsection\\<open>Proofs About \\<^term>\\<open>con_K\\<close>\\<close>\n\ntext\\<open>Below we prove that if \\<^term>\\<open>con_K\\<close> exists, then \\<^term>\\<open>TTP\\<close> has it,\nand therefore \\<^term>\\<open>A\\<close> and \\<^term>\\<open>B\\<close>) can get it too.  Moreover, we know\nthat \\<^term>\\<open>A\\<close> sent \\<^term>\\<open>sub_K\\<close>\\<close>\n\nlemma con_K_validity:\n     \"\\<lbrakk>con_K \\<in> used evs;\n        con_K = Crypt (priK TTP)\n                  \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K\\<rbrace>;\n        evs \\<in> zg\\<rbrakk>\n    \\<Longrightarrow> Notes TTP \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K, con_K\\<rbrace>\n          \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply (blast dest!: Fake_parts_sing_imp_Un)\ntxt\\<open>ZG2\\<close> \napply (blast dest: parts_cut)\ndone\n\ntext\\<open>If \\<^term>\\<open>TTP\\<close> holds \\<^term>\\<open>con_K\\<close> then \\<^term>\\<open>A\\<close> sent\n \\<^term>\\<open>sub_K\\<close>.  We assume that \\<^term>\\<open>A\\<close> is not broken.  Importantly, nothing\n  needs to be assumed about the form of \\<^term>\\<open>con_K\\<close>!\\<close>\nlemma Notes_TTP_imp_Says_A:\n     \"\\<lbrakk>Notes TTP \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K, con_K\\<rbrace>\n           \\<in> set evs;\n        sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n        A \\<notin> broken; evs \\<in> zg\\<rbrakk>\n     \\<Longrightarrow> Says A TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt\\<open>ZG4\\<close>\napply clarify \napply (rule sub_K_validity, auto) \ndone\n\ntext\\<open>If \\<^term>\\<open>con_K\\<close> exists, then \\<^term>\\<open>A\\<close> sent \\<^term>\\<open>sub_K\\<close>.  We again\n   assume that \\<^term>\\<open>A\\<close> is not broken.\\<close>\ntheorem B_sub_K_validity:\n     \"\\<lbrakk>con_K \\<in> used evs;\n        con_K = Crypt (priK TTP) \\<lbrace>Number f_con, Agent A, Agent B,\n                                   Nonce L, Key K\\<rbrace>;\n        sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n        A \\<notin> broken; evs \\<in> zg\\<rbrakk>\n     \\<Longrightarrow> Says A TTP \\<lbrace>Number f_sub, Agent B, Nonce L, Key K, sub_K\\<rbrace> \\<in> set evs\"\nby (blast dest: con_K_validity Notes_TTP_imp_Says_A)\n\n\nsubsection\\<open>Proving fairness\\<close>\n\ntext\\<open>Cannot prove that, if \\<^term>\\<open>B\\<close> has NRO, then  \\<^term>\\<open>A\\<close> has her NRR.\nIt would appear that \\<^term>\\<open>B\\<close> has a small advantage, though it is\nuseless to win disputes: \\<^term>\\<open>B\\<close> needs to present \\<^term>\\<open>con_K\\<close> as well.\\<close>\n\ntext\\<open>Strange: unicity of the label protects \\<^term>\\<open>A\\<close>?\\<close>\nlemma A_unicity: \n     \"\\<lbrakk>NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, Crypt K M\\<rbrace>;\n        NRO \\<in> parts (spies evs);\n        Says A B \\<lbrace>Number f_nro, Agent B, Nonce L, Crypt K M', NRO'\\<rbrace>\n          \\<in> set evs;\n        A \\<notin> bad; evs \\<in> zg\\<rbrakk>\n     \\<Longrightarrow> M'=M\"\napply clarify\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, auto) \ntxt\\<open>ZG1: freshness\\<close>\napply (blast dest: parts.Body) \ndone\n\n\ntext\\<open>Fairness lemma: if \\<^term>\\<open>sub_K\\<close> exists, then \\<^term>\\<open>A\\<close> holds \nNRR.  Relies on unicity of labels.\\<close>\nlemma sub_K_implies_NRR:\n     \"\\<lbrakk>NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, Crypt K M\\<rbrace>;\n         NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, Crypt K M\\<rbrace>;\n         sub_K \\<in> parts (spies evs);\n         NRO \\<in> parts (spies evs);\n         sub_K = Crypt (priK A) \\<lbrace>Number f_sub, Agent B, Nonce L, Key K\\<rbrace>;\n         A \\<notin> bad;  evs \\<in> zg\\<rbrakk>\n     \\<Longrightarrow> Gets A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs\"\napply clarify\napply hypsubst_thin\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply blast \ntxt\\<open>ZG1: freshness\\<close>\napply (blast dest: parts.Body) \ntxt\\<open>ZG3\\<close> \napply (blast dest: A_unicity [OF refl]) \ndone\n\n\nlemma Crypt_used_imp_L_used:\n     \"\\<lbrakk>Crypt (priK TTP) \\<lbrace>F, A, B, L, K\\<rbrace> \\<in> used evs; evs \\<in> zg\\<rbrakk>\n      \\<Longrightarrow> L \\<in> used evs\"\napply (erule rev_mp)\napply (erule zg.induct, auto)\ntxt\\<open>Fake\\<close>\napply (blast dest!: Fake_parts_sing_imp_Un)\ntxt\\<open>ZG2: freshness\\<close>\napply (blast dest: parts.Body) \ndone\n\n\ntext\\<open>Fairness for \\<^term>\\<open>A\\<close>: if \\<^term>\\<open>con_K\\<close> and \\<^term>\\<open>NRO\\<close> exist, \nthen \\<^term>\\<open>A\\<close> holds NRR.  \\<^term>\\<open>A\\<close> must be uncompromised, but there is no\nassumption about \\<^term>\\<open>B\\<close>.\\<close>\ntheorem A_fairness_NRO:\n     \"\\<lbrakk>con_K \\<in> used evs;\n        NRO \\<in> parts (spies evs);\n        con_K = Crypt (priK TTP)\n                      \\<lbrace>Number f_con, Agent A, Agent B, Nonce L, Key K\\<rbrace>;\n        NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, Crypt K M\\<rbrace>;\n        NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, Crypt K M\\<rbrace>;\n        A \\<notin> bad;  evs \\<in> zg\\<rbrakk>\n    \\<Longrightarrow> Gets A \\<lbrace>Number f_nrr, Agent A, Nonce L, NRR\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\n   txt\\<open>Fake\\<close>\n   apply (simp add: parts_insert_knows_A) \n   apply (blast dest: Fake_parts_sing_imp_Un) \n  txt\\<open>ZG1\\<close>\n  apply (blast dest: Crypt_used_imp_L_used) \n txt\\<open>ZG2\\<close>\n apply (blast dest: parts_cut)\ntxt\\<open>ZG4\\<close> \napply (blast intro: sub_K_implies_NRR [OF refl] \n             dest: Gets_imp_knows_Spy [THEN parts.Inj])\ndone\n\ntext\\<open>Fairness for \\<^term>\\<open>B\\<close>: NRR exists at all, then \\<^term>\\<open>B\\<close> holds NRO.\n\\<^term>\\<open>B\\<close> must be uncompromised, but there is no assumption about \\<^term>\\<open>A\\<close>.\\<close>\ntheorem B_fairness_NRR:\n     \"\\<lbrakk>NRR \\<in> used evs;\n        NRR = Crypt (priK B) \\<lbrace>Number f_nrr, Agent A, Nonce L, C\\<rbrace>;\n        NRO = Crypt (priK A) \\<lbrace>Number f_nro, Agent B, Nonce L, C\\<rbrace>;\n        B \\<notin> bad; evs \\<in> zg\\<rbrakk>\n    \\<Longrightarrow> Gets B \\<lbrace>Number f_nro, Agent B, Nonce L, C, NRO\\<rbrace> \\<in> set evs\"\napply clarify\napply (erule rev_mp)\napply (erule zg.induct)\napply (frule_tac [5] ZG2_msg_in_parts_spies, simp_all)\ntxt\\<open>Fake\\<close>\napply (blast dest!: Fake_parts_sing_imp_Un)\ntxt\\<open>ZG2\\<close>\napply (blast dest: parts_cut)\ndone\n\n\ntext\\<open>If \\<^term>\\<open>con_K\\<close> exists at all, then \\<^term>\\<open>B\\<close> can get it, by \\<open>con_K_validity\\<close>.  Cannot conclude that also NRO is available to \\<^term>\\<open>B\\<close>,\nbecause if \\<^term>\\<open>A\\<close> were unfair, \\<^term>\\<open>A\\<close> could build message 3 without\nbuilding message 1, which contains NRO.\\<close>\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/ZhouGollmann.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.3104224741211761}}
{"text": "theory flash88Bra  imports flash88Rev\n \n  begin\nlemma onInv88:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv88  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv88  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv88 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash88Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548646660542, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.31042247412117596}}
{"text": "(* $Id$ *)\n(*<*)\ntheory GC0 \nimports RGToolkit \nbegin\n(*>*)\n   \n(* TODO: add it as finite? *)  \ntypedecl Addr\n  \ntypedef Addrs = \"{ (a::Addr set) . finite a }\" \n  morphisms Rep_Addrs Abs_Addrs by auto\n  \nprint_theorems\nsetup_lifting type_definition_Addrs\n  \nlift_definition\n  Addr_as_Set :: \"Addrs \\<Rightarrow> Addr set\" (\"(_`)\" [103] 102) is \"\\<lambda> S . S\" . \n\ndefinition \n  ALL_ADDR0 :: \"Addrs\" \nwhere\n  \"ALL_ADDR0 \\<equiv> (Abs_Addrs UNIV)\"\n\nconsts\n  an_addr  :: Addr\n  ALL_ADDR :: \"Addr set\" \n  \nspecification (all_addr: ALL_ADDR adr: an_addr)\n   l_ALL_ADDR_finite[simp]: \"finite (ALL_ADDR)\"\n   l_ALL_ADDR_not_empty[simp]: \"an_addr \\<in> ALL_ADDR\"\n   by blast\n\nlemma \"ALL_ADDR0` = ALL_ADDR\"\n  unfolding ALL_ADDR0_def Addr_as_Set_def\n  apply (simp_all)\n  oops   \n(*\ndefinition\n   ALL_ADDR :: \"Addr set\"\nwhere\n   \"ALL_ADDR \\<equiv> (SOME x . finite x \\<and> x \\<noteq> {})\" = BAD! \n*)     \n     \nlemma l_Addrs_finite[simp]: \"finite (ALL_ADDR0`)\" \n  using Addr_as_Set.rep_eq Rep_Addrs by auto\n      \n(*\ninstance Addrs :: finite\n  apply (intro_classes)\n  find_theorems name:Addrs name:Abs\n  apply (rule Abs_Addrs_induct)\n  apply simp oops *) \n(*    \ndefinition\n  hat0 :: \"Addrs \\<Rightarrow> Addrs VDMSet\"\nwhere\n  \"hat0 s \\<equiv> { (x``) | x . x \\<subseteq> s` }\"\n  *)\n(* TODO: propagage Addrs everywhere Addr VDMSet is used *)\n  \ndefinition\n  hat :: \"Addr VDMSet \\<Rightarrow> Addr VDMSet VDMSet\"\nwhere\n  \"hat s \\<equiv> { ALL_ADDR }\"\n\nrecord Sigma0 =\n  busy0 :: \"Addr VDMSet\"\n  free0 :: \"Addr VDMSet\"\n\ndefinition\n  garbage0 :: \"Addr VDMSet \\<Rightarrow> Addr VDMSet \\<Rightarrow> Addr VDMSet\"\nwhere\n  \"garbage0 busy free \\<equiv> ALL_ADDR - (busy \\<union> free)\"\n\ndefinition\n  inv_Sigma0 :: \"Addr VDMSet \\<Rightarrow> Addr VDMSet \\<Rightarrow> \\<bool>\"\nwhere\n  \"inv_Sigma0 busy free \\<equiv> \n       free \\<inter> busy = {} \\<and> \n       free \\<union> busy \\<union> (garbage0 busy free) = ALL_ADDR\"\n  \\<comment> \\<open>TODO: here if we had used Addrs for the type these considerations wouldn't be needed\\<close>\n\nlemma f_garbage0_disjoint: \"inv_Sigma0 busy free \\<Longrightarrow> \n    garbage0 busy free \\<inter> busy ={} \\<and>\n    garbage0 busy free \\<inter> free = {}\"\n  unfolding inv_Sigma0_def garbage0_def\n    by blast\n  \ndefinition\n  inv_Sigma0_R :: \"Sigma0 \\<Rightarrow> \\<bool>\"\nwhere\n  \"inv_Sigma0_R s \\<equiv> inv_Sigma0 (busy0 s) (free0 s)\"\n\nlemmas inv_Sigma0_defs = inv_Sigma0_R_def inv_Sigma0_def garbage0_def\n  \n(* { expr | var . filter }, { var \\<in> type . filter }, { var . filter } *)\ntypedef Sigma0Type = \"{ s . inv_Sigma0_R s }\"\n  morphisms s0t_t (* st: Sigma0Type \\<Rightarrow> Sigma0 *) \n            s0t_r (* rc: Sigma0 \\<Rightarrow> Sigma0Type *)\n  unfolding inv_Sigma0_defs inv_SetElems_def \n  apply simp\n  apply (rule exI[of _ \"\\<lparr>busy0 = {}, free0 = ALL_ADDR\\<rparr>\"])\n  by (simp add: inv_VDMNat_def)\n\ndefinition\n  inv_Sigma0_T :: \"Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n  \"inv_Sigma0_T s \\<equiv> inv_Sigma0_R (s0t_t s)\" \n\n(*================================================================*)\n  \ninstantiation Sigma0Type :: VDM\nbegin\n\ndefinition \n  \"st_inv_Sigma0Type s \\<longleftrightarrow> inv_Sigma0_T s\"\n\nlemma l_Sigma0_valid: \"inv_Sigma0_T s\"\nusing inv_Sigma0_T_def s0t_t by auto\n  \ninstance \n  using inv_Sigma0_T_def st_inv_Sigma0Type_def s0t_t \n  by (intro_classes, auto)\n    \nend\n\n(*\nCollector\next   wr free\n      rd busy\npre   True\nrely  (busy' - busy) \\<subseteq> free \\<and> \n      free' \\<subseteq> free\nguar  free \\<subseteq> free'\npost  (ALL_ADDR - busy) \\<subseteq> \\<Union> (hat free)\n*)  \n  \ndefinition\n  collector0_frame :: \"Sigma0Type \\<Rightarrow> Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n \"collector0_frame s s' \\<equiv> \n    (let busy0'=(busy0 (s0t_t s')); busy0 =(busy0 (s0t_t s)) in\n      busy0' = busy0)\"   \n  \ndefinition \n  collector0_pre :: \"Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n  \"collector0_pre s \\<equiv> True\"\n  \ndefinition \n  collector0_post :: \"Sigma0Type \\<Rightarrow> Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n  \"collector0_post s s' \\<equiv> \n    (let busy0'=(busy0 (s0t_t s')); busy0 =(busy0 (s0t_t s));  \n         free0 =(free0 (s0t_t s)) in\n          ALL_ADDR - busy0 \\<subseteq> \\<Union> (hat free0))\"\n\ndefinition \n  collector0_rely :: \"Sigma0Type \\<Rightarrow> Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n  \"collector0_rely s s' \\<equiv>\n    (let busy0'=(busy0 (s0t_t s')); free0'=(free0 (s0t_t s'));\n         busy0 =(busy0 (s0t_t s));  free0 =(free0 (s0t_t s))          \n      in busy0' - busy0 \\<subseteq> free0 \\<and> free0' \\<subseteq> free0)\"\n\ndefinition \n  collector0_guar :: \"Sigma0Type \\<Rightarrow> Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n  \"collector0_guar s s' \\<equiv> \n    (let free0'=(free0 (s0t_t s')); free0 =(free0 (s0t_t s)) in \n        collector0_frame s s' \\<and>\n        free0 \\<subseteq> free0')\"\n\nlemmas collector0_guar_defs = \n                         collector0_frame_def\n                         collector0_guar_def\nlemmas collector0_defs = Let_def hat_def \n                         collector0_pre_def \n                         collector0_post_def \n                         collector0_rely_def \n                         collector0_guar_defs \n\n(*\nMutator\next   wr bury, free\npre   True\nrely  busy' = busy \\<and> \n      free \\<subseteq> free'\nguar  (busy' - busy) \\<subseteq> free \\<and> \n      free' \\<subseteq> free\npost  True\n*)  \n                         \ndefinition \n  mutator0_frame :: \"Sigma0Type \\<Rightarrow> Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n  \"mutator0_frame s s' \\<equiv> True\"\n\ndefinition \n  mutator0_pre :: \"Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n  \"mutator0_pre s \\<equiv> True\"\n  \ndefinition \n  mutator0_post :: \"Sigma0Type \\<Rightarrow> Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n  \"mutator0_post s s' \\<equiv> True\"\n\ndefinition \n  mutator0_rely :: \"Sigma0Type \\<Rightarrow> Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n  \"mutator0_rely s s' \\<equiv>\n    (let busy0'=(busy0 (s0t_t s')); free0'=(free0 (s0t_t s'));\n         busy0 =(busy0 (s0t_t s));  free0 =(free0 (s0t_t s))          \n      in busy0' = busy0 \\<and> free0 \\<subseteq> free0')\"\n\ndefinition \n  mutator0_guar :: \"Sigma0Type \\<Rightarrow> Sigma0Type \\<Rightarrow> \\<bool>\"\nwhere\n  \"mutator0_guar s s' \\<equiv> \n    (let busy0'=(busy0 (s0t_t s')); free0'=(free0 (s0t_t s'));\n         busy0 =(busy0 (s0t_t s));  free0 =(free0 (s0t_t s))          \n      in \n         mutator0_frame s s' \\<and>\n         busy0' - busy0 \\<subseteq> free0 \\<and> free0' \\<subseteq> free0)\"\n\nlemmas mutator0_defs = Let_def mutator0_pre_def mutator0_frame_def\n                       mutator0_post_def mutator0_rely_def mutator0_guar_def\n\n(*context RG_VCG\nbegin*)\n\nlemma l1_s0t_inv: \"inv_Sigma0_T s\"\n  by (simp add: l_Sigma0_valid)\n\nlemma l2_collector0_fsb: \"collector0_pre s \\<Longrightarrow> \\<exists>s'. collector0_post s s'\" \n  unfolding collector0_defs \n    by blast\n    \nlemma l3_collector0_rely_refl: \"collector0_rely s s\"\n  unfolding collector0_defs\n  by simp\n    \nlemma l4_collector0_guar_refl: \"collector0_guar s s\"\n  unfolding collector0_defs\n  by simp\n    \nlemma l5_collector0_rely_trans: \"collector0_rely s t \\<Longrightarrow> collector0_rely t u \\<Longrightarrow> collector0_rely s u\"\n  unfolding collector0_defs\n  apply safe\n  apply blast\n  by blast  \n\nlemma l6_collector0_guar_trans: \"collector0_guar s t \\<Longrightarrow> collector0_guar t u \\<Longrightarrow> collector0_guar s u\"\n  unfolding collector0_defs\n  apply safe\n  apply blast\n  apply blast\n  by blast\n\nlemma l7_collector0_post_guar: \"collector0_pre s \\<Longrightarrow> (\\<exists>s'. collector0_post s s' \\<and> collector0_guar s s')\"\n  unfolding collector0_defs by blast\n    \nlemma l8_collector0_pre_rely: \"collector0_pre s \\<Longrightarrow> collector0_rely s s' \\<Longrightarrow> collector0_pre s'\"\n  unfolding collector0_defs by blast\n    \nlemma l9_collector0_rely_comp_post: \n  \"collector0_pre s \\<Longrightarrow> (collector0_rely ;; collector0_post) s s' \\<Longrightarrow> collector0_post s s'\"\n  apply (erule spec_compE)\n  unfolding collector0_defs\n  apply (elim conjE ssubst)\n  by blast\n  \nlemma l10_collector0_post_comp_rely: \n  \"(collector0_post ;; collector0_rely) s s' \\<Longrightarrow> collector0_post s s'\"\n  apply (elim spec_compE)\n  unfolding collector0_defs\n  apply (elim conjE ssubst)\n  by simp\n    \nlemma l2_mutator0_fsb: \"mutator0_pre s \\<Longrightarrow> \\<exists>s'. mutator0_post s s'\" \n  unfolding mutator0_defs by simp\n    \nlemma l3_mutator0_rely_refl: \"mutator0_rely s s\"\n  unfolding mutator0_defs\n  by simp\n    \nlemma l4_mutator0_guar_refl: \"mutator0_guar s s\"\n  unfolding mutator0_defs\n  by simp\n    \nlemma l5_mutator0_rely_trans: \"mutator0_rely s t \\<Longrightarrow> mutator0_rely t u \\<Longrightarrow> mutator0_rely s u\"\n  unfolding mutator0_defs\n  apply safe\n  by blast+\n    \nlemma l6_mutator0_guar_trans: \"mutator0_guar s t \\<Longrightarrow> mutator0_guar t u \\<Longrightarrow> mutator0_guar s u\"\n  unfolding mutator0_defs\n  apply safe\n  apply (meson DiffI collector0_rely_def contra_subsetD l5_collector0_rely_trans)\n  by blast\n\nlemma l7_mutator0_post_guar: \"mutator0_pre s \\<Longrightarrow> (\\<exists>s'. mutator0_post s s' \\<and> mutator0_guar s s')\"\n  unfolding mutator0_defs by blast\n    \nlemma l8_mutator0_pre_rely: \"mutator0_pre s \\<Longrightarrow> mutator0_rely s s' \\<Longrightarrow> mutator0_pre s'\"\n  unfolding mutator0_defs by blast\n    \nlemma l9_mutator0_rely_comp_post: \n  \"mutator0_pre s \\<Longrightarrow> (mutator0_rely ;; mutator0_post) s s' \\<Longrightarrow> mutator0_post s s'\"\n  apply (erule spec_compE)\n  unfolding mutator0_defs by blast\n    \nlemma l10_mutator0_post_comp_rely: \n  \"(mutator0_post ;; mutator0_rely) s s' \\<Longrightarrow> mutator0_post s s'\"\n  apply (erule spec_compE)\n  unfolding mutator0_defs by blast\n\ninterpretation Sigma0Type : VDM inv_Sigma0_T\n  apply (unfold_locales)\n  apply (simp add: l1_s0t_inv)\n  done\n    \ninterpretation collector0: RG_VCG  \n  inv_Sigma0_T collector0_pre collector0_post collector0_rely collector0_guar\n  apply (unfold_locales)\n  apply (simp add: l2_collector0_fsb)\n  apply (simp add: l3_collector0_rely_refl)\n  apply (simp add: l4_collector0_guar_refl)\n  using l5_collector0_rely_trans apply blast\n  using l6_collector0_guar_trans apply blast\n  apply (simp add: l7_collector0_post_guar) \n  using l8_collector0_pre_rely apply blast\n  using l9_collector0_rely_comp_post apply blast\n  apply (simp add: l10_collector0_post_comp_rely)\n    done\n  (*\n  using l8_collector0_pre_rely apply blast\n  apply (simp add: l9_collector0_rely_comp_post)\n  apply (simp add: l10_collector0_post_comp_rely)\n  apply (simp add: l7_collector0_post_guar)\n  done*)\n\ninterpretation mutator0: RG_VCG\n  inv_Sigma0_T mutator0_pre mutator0_post mutator0_rely mutator0_guar\n  apply (unfold_locales)\n  apply (simp add: l2_mutator0_fsb)\n  apply (simp add: l3_mutator0_rely_refl)\n  apply (simp add: l4_mutator0_guar_refl)\n  using l5_mutator0_rely_trans apply blast\n  using l6_mutator0_guar_trans apply blast\n  apply (simp add: l7_mutator0_post_guar)\n  using l8_mutator0_pre_rely apply blast\n  apply (simp add: l9_mutator0_rely_comp_post)\n  apply (simp add: l10_mutator0_post_comp_rely)\n  done\n    \n(* We also need coherence between guarantee/relies of each operation *)\n    \n(*\n\nlemma l7_mutator0_guar_rely: \"mutator0_guar s s' \\<Longrightarrow> mutator0_rely s s'\"\n  unfolding mutator0_defs\n  apply (elim conjE ssubst)\n  apply simp\n  oops\n    \nlemma l7_collector0_guar_rely: \"collector0_guar s s' \\<Longrightarrow> collector0_rely s s'\"\n  unfolding collector0_defs\n  apply (elim conjE ssubst)\n  apply safe\n  oops (* this is meant to be between operations not the same *)\nlocale RG_Coherence = st: RG_VCG + op2: RG_VCG for op1 and op2 \n*)\n\ntext \\<open> Cliff's Theorem 1 \\<close>\nlemma l_mutator0_coherence: \"collector0_guar s s' \\<longleftrightarrow> mutator0_rely s s'\"\n  unfolding Let_def mutator0_rely_def collector0_guar_defs by safe\nlemma l_collector0_coherence: \"mutator0_guar s s' \\<longleftrightarrow>  collector0_rely s s'\"\n  unfolding Let_def mutator0_guar_def collector0_rely_def \n  by (simp add: mutator0_frame_def)\n    \nend\n", "meta": {"author": "leouk", "repo": "VDM_Toolkit", "sha": "791013909961d45949fcd96d937ae18f0174c7ec", "save_path": "github-repos/isabelle/leouk-VDM_Toolkit", "path": "github-repos/isabelle/leouk-VDM_Toolkit/VDM_Toolkit-791013909961d45949fcd96d937ae18f0174c7ec/experiments/vdm/GarbageCollector/isa/GC0.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.31031124935820775}}
{"text": "(*File: Language.thy\n  Author: L Beringer & M Hofmann, LMU Munich\n  Date: 05/12/2008\n  Purpose: Syntax and operational semantics of subset of JVML \n*)\n(*<*)\ntheory Language imports AssocLists begin\n(*>*)\n\nsection{*Language \\label{sec:language}*}\nsubsection{*Syntax*}\n\ntext{*We have syntactic classes of (local) variables, class names,\nfield names, and method names. Naming restrictions, namespaces, long\nJava names etc.~are not modelled.*}\n\ntypedecl Var\ntypedecl Class\ntypedecl Field\ntypedecl Method\n\ntext{*Since arithmetic operations are modelled as unimplemented\nfunctions, we introduce the type of values in this section. The domain\nof heap locations is arbitrary.  *}\n\ntypedecl Addr \n\ntext{*A reference is either null or an address.*}\n\ndatatype Ref = Nullref | Loc Addr\n\ntext{* Values are either integer numbers or references.*}\n\ndatatype Val = RVal Ref | IVal int\n\ntext{*The type of (instruction) labels is fixed, since the operational\nsemantics increments the program counter after each instruction.*}\n\ntype_synonym Label = int\n\ntext{*Regarding the instructions, we support basic operand-stack\nmanipulations, object creation, field modifications, casts, static\nmethod invocations, conditional and unconditional jumps, and a return\ninstruction.\n\nFor every (Isabelle) function @{text \"f : Val\\<Rightarrow>Val\\<Rightarrow>Val\"} we have an\ninstruction @{text \"binop f\"} whose semantics is to invoke @{text \"f\"}\non the two topmost values on the operand stack and replace them with\nthe result.  Similarly for @{text \"unop f\"}. *}\n\ndatatype Instr =\n  const Val\n| dup\n| pop\n| swap\n| load Var\n| store Var\n| binop \"Val \\<Rightarrow> Val \\<Rightarrow> Val\"\n| unop \"Val \\<Rightarrow> Val\" \n| new Class\n| getfield Class Field\n| putfield Class Field\n| checkcast Class\n| invokeS Class Method\n| goto Label\n| iftrue Label\n| vreturn \n\ntext{*Method body declarations contain a list of formal parameters, a\nmapping from instruction labels to instructions, and a start\nlabel. The operational semantics assumes that instructions are\nlabelled consecutively\\footnote{In the paper, we slightly abstract\nfrom this by including a successor functions on labels}.*}\n\ntype_synonym Mbody = \"Var list \\<times> (Label, Instr) AssList \\<times> Label\" \n\ntext{*A class definition associates method bodies to method names.*}\ntype_synonym Classdef = \"(Method, Mbody) AssList\"\n\ntext{*Finally, a program consists of classes.*}\ntype_synonym Prog = \"(Class, Classdef) AssList\"\n\ntext{*Taken together, the three types @{text Prog}, @{text Classdef},\nand @{text Mbody} represent an abstract model of the virtual machine\nenvironment. In our opinion, it would be desirable to avoid modelling\nthis environment at a finer level, at least for the purpose of the\nprogram logic. For example, we prefer not to consider in detail the\nrepresentation of the constant pool.*}\n\nsubsection{*Dynamic semantics*}\nsubsubsection{*Semantic components*}\n\ntext{*An object consists of the identifier of its dynamic class and a\nmap from field names to values. Currently, we do not model\ntype-correctness, nor do we require that all (or indeed any) of the\nfields stem from the static definition of the class, or a super-class.\nNote, however, that type correctness can be expressed in the logic.*}\n\ntype_synonym Object = \"Class \\<times> (Field, Val) AssList\"\n\ntext{*The heap is represented as a map from addresses to values.  The\nJVM specification does not prescribe any particular object layout. The\nproposed type reflects this indeterminacy, but allows one to calculate\nthe byte-correct size of a heap only after a layout scheme has been\nsupplied. Alternative heap models would be the store-less semantics in\nthe sense of Jonkers~\\cite{Jonkers1981} and\nDeutsch~\\cite{Deutsch1992}, (where the heap is modelled as a partial\nequivalence relation on access paths), or object-based semantics in\nthe sense of Reddy~\\cite{Reddy1996}, where the heap is represented as\na history of update operations.  H\\\"ahnle et al.~use a variant of the\nlatter in their dynamic logic for a {\\sc\nJavaCard}~~\\cite{HaehnleM:Cassis2005}.*}\n\ntype_synonym Heap = \"(Addr, Object) AssList\"\n\ntext{*Later, one might extend heaps by a component for static fields.*}\n\ntext{*The types of the (register) store and the operand stack are as\nexpected.*}\n\ntype_synonym Store = \"(Var, Val) AssList\"\ntype_synonym OpStack = \"Val list\"\n\ntext{*States contain an operand stack, a store, and a heap.*}\ntype_synonym State = \"OpStack \\<times> Store \\<times> Heap\"\n\ndefinition heap::\"State \\<Rightarrow> Heap\"\nwhere \"heap s = snd(snd s)\"\n\ntext{*The operational semantics and the program logic are defined\nrelative to a fixed program @{text P}.  Alternatively, the type of the\noperational semantics (and proof judgements) could be extended by a\nprogram component.  We also define the constant value @{text TRUE},\nthe representation of which does not matter for the current\nformalisation.*}\n\naxiomatization P::Prog and TRUE::Val\n\ntext{*In order to obtain more readable rules, we define operations\nfor extracting method bodies and instructions from the program.*}\n\ndefinition mbody_is::\"Class \\<Rightarrow> Method \\<Rightarrow> Mbody \\<Rightarrow> bool\"\nwhere \"mbody_is C m M = (\\<exists> CD . P\\<down>C = Some CD \\<and> CD\\<down>m = Some M)\"\n\ndefinition get_ins::\"Mbody \\<Rightarrow> Label \\<Rightarrow> Instr option\"\nwhere \"get_ins M l = (fst(snd M))\\<down>l\"\n\ndefinition ins_is::\"Class \\<Rightarrow> Method \\<Rightarrow> Label \\<Rightarrow> Instr \\<Rightarrow> bool\"\nwhere \"ins_is C m l ins = (\\<exists> M . mbody_is C m M \\<and> get_ins M l = Some ins)\"\n\ntext{*The transfer of method arguments from the caller's operand stack\nto the formal parameters of an invoked method is modelled by the\npredicate *}\n\ninductive_set Frame::\"(OpStack \\<times> (Var list) \\<times> Store \\<times> OpStack) set\"\nwhere\nFrameNil: \"\\<lbrakk>oo=ops\\<rbrakk> \\<Longrightarrow> (ops,[],emp,oo) : Frame\"\n|\nFrame_cons: \"\\<lbrakk>(oo,par,S,ops) : Frame; R =S[x\\<mapsto>v]\\<rbrakk>\n            \\<Longrightarrow> (v # oo, x # par,R,ops):Frame\"\n\n(*<*)\nlemma Frame_deterministic[rule_format]:\n\"(ops, par, S, os) \\<in> Frame \\<Longrightarrow> \n(\\<forall> R opsa . (ops, par, R, opsa) \\<in> Frame \\<longrightarrow> R=S \\<and> opsa = os)\"\napply (erule Frame.induct, clarsimp)\napply (erule Frame.cases, clarsimp, clarsimp)\napply (erule thin_rl, clarsimp)\napply (erule Frame.cases, clarsimp, clarsimp)\ndone\n(*>*)\n\ntext{*In order to obtain a deterministic semantics, we assume the\nexistence of a function, with the obvious freshness axiom for this\nconstruction.*}\n\naxiomatization nextLoc::\"Heap \\<Rightarrow> Addr\"\nwhere nextLoc_fresh: \"h\\<down>(nextLoc h) = None\"\n\nsubsubsection{*Operational judgements*} \n\ntext{*Similar to Bannwart-M\\\"uller~\\cite{BannwartMueller05}, we define\ntwo operational judgements: a one-step relation and a relation that\nrepresents the transitive closure of the former until the end of the\ncurrent method invocation. These relations are mutually recursive,\nsince the method invocation rule contracts the execution of the\ninvoked method to a single step. The one-step relation associates a\nstate to its immediate successor state, where the program counter is\ninterpreted with respect to the current method body. The transitive\nclosure ignores the bottom part of the operand stack and the store of\nthe final configuration. It simply returns the heap and the result of\nthe method invocation, where the latter is given by the topmost value\non the operand stack. In contrast to~\\cite{BannwartMueller05}, we do\nnot use an explicit @{text return} variable. Both relations take an\nadditional index of type @{text nat} that monitors the derivation\nheight. This is useful in the proof of soundness of the program\nlogic.*}\n\ntext{*Intuitively, @{text \"(M,l,s,n,l',s'):Step\"} means that method\n(body) @{text M} evolves in one step from state @{text s} to state\n@{text s'}, while statement @{text \"(M,s,n,h,v):Exec\"} indicates that\nexecuting from @{text s} in method @{text M} leads eventually to a\nstate whose final value is @{text h}, where precisely the last step in\nthis sequence is a @{text vreturn} instruction and the return value is\n@{text v}.*}\n\ntext{*Like Bannwart and M\\\"uller, we define a \"frame-less\"\nsemantics. i.e.~the execution of a method body is modelled by a\ntransitive closure of the basic step-relation, which results in a\none-step reduction at the invocation site. Arguably, an operational\nsemantics with an explicit frame stack is closer to the real JVM. It\nshould not be difficult to verify the operational soundness of the\npresent system w.r.t.~such a finer model, or to modify the\nsemantics. *}\n\ninductive_set\n  Step::\"(Mbody \\<times> Label \\<times> State \\<times> nat \\<times> Label \\<times> State) set\"\nand\n  Exec::\"(Mbody \\<times> Label \\<times> State \\<times> nat \\<times> Heap \\<times> Val) set\"\nwhere\nConst:\"\\<lbrakk>get_ins M l = Some (const v); NEXT = (v # os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(os,s,h), 1, ll, NEXT) : Step\"\n|\nDup:  \"\\<lbrakk>get_ins M l = Some dup; NEXT = (v # v # os,s,h); ll =l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # os,s,h), 1, ll, NEXT) : Step\"\n|\nPop:  \"\\<lbrakk>get_ins M l = Some pop; NEXT = (os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # os,s,h), 1, ll, NEXT) : Step\"\n|\nSwap: \"\\<lbrakk>get_ins M l = Some swap; NEXT = (w # (v # os),s,h); ll= l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # (w # os),s,h), 1, ll, NEXT) : Step\"\n|\nLoad: \"\\<lbrakk>get_ins M l = Some (load x); s\\<down>x = Some v;\n         NEXT = (v # os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(os,s,h), 1, ll,NEXT) : Step\"\n|\nStore:\"\\<lbrakk>get_ins M l = Some (store x); NEXT = (os,s[x\\<mapsto>v],h); ll= l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # os,s,h), 1, ll, NEXT) : Step\"\n|\nBinop:\"\\<lbrakk>get_ins M l = Some (binop f); NEXT = ((f v w) # os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # (w # os),s,h), 1, ll,NEXT) : Step\"\n|\nUnop: \"\\<lbrakk>get_ins M l = Some (unop f); NEXT = ((f v) # os,s,h);ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # os,s,h), 1, ll, NEXT) : Step\"\n|\nNew:  \"\\<lbrakk>get_ins M l = Some (new d); newobj = (d, emp); a=nextLoc h; \n         NEXT = ((RVal (Loc a)) # os,s,h[a\\<mapsto>newobj]); ll = l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(os,s,h), 1, ll,NEXT) : Step\"\n|\nGet:  \"\\<lbrakk>get_ins M l = Some (getfield d F); h\\<down>a = Some (d, Flds);\n         Flds\\<down>F = Some v; NEXT = (v # os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,((RVal (Loc a)) # os,s,h), 1, ll,NEXT) : Step\"\n|\nPut:  \"\\<lbrakk>get_ins M l = Some (putfield d F); h\\<down>a = Some (d, Flds);\n         newobj = (d, Flds[F\\<mapsto>v]); NEXT = (os,s,h[a\\<mapsto>newobj]); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # ((RVal (Loc a)) # os),s,h), 1, ll, NEXT) : Step\"\n|\nCast: \"\\<lbrakk>get_ins M l = Some (checkcast d); h\\<down>a = Some (d, Flds);\n         NEXT = ((RVal (Loc a)) # os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,((RVal (Loc a)) # os,s,h), 1, ll,NEXT) : Step\"\n|\nGoto: \"\\<lbrakk>get_ins M l = Some (goto pc)\\<rbrakk> \\<Longrightarrow> (M,l,S, 1, pc,S) : Step\"\n|\nIfT:  \"\\<lbrakk>get_ins M l = Some (iftrue pc); NEXT = (os,s,h)\\<rbrakk>\n       \\<Longrightarrow> (M,l,(TRUE # os,s,h), 1, pc, NEXT) : Step\"\n|\nIfF:  \"\\<lbrakk>get_ins M l = Some (iftrue pc); v \\<noteq> TRUE; NEXT = (os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # os,s,h), 1, ll, NEXT) : Step\"\n|\nInvS: \"\\<lbrakk>get_ins M l = Some (invokeS C m); mbody_is C m (par,code,l0);\n         ((par,code,l0),l0,([], S,h), n, hh, v): Exec; \n         (ops,par,S,os) : Frame; NEXT = (v # os,s,hh); ll = l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(ops,s,h), Suc n, ll, NEXT) : Step\"\n|\nVret: \"\\<lbrakk>get_ins M l = Some vreturn\\<rbrakk> \\<Longrightarrow> (M,l,(v # os,s,h), 1, h, v) : Exec\"\n|\nRun:  \"\\<lbrakk>(M,l,s,n,ll,t):Step; (M,ll,t,m,h,v):Exec; k = (max n m) +1 \\<rbrakk>\n       \\<Longrightarrow> (M,l,s,k,h,v) : Exec\"\n\ntext{*A big-step operational judgement that abstracts from the\nderivation height is easily defined.*}\n\ndefinition Opsem::\"Mbody \\<Rightarrow> Label \\<Rightarrow> State \\<Rightarrow> Heap \\<Rightarrow> Val \\<Rightarrow> bool\"\nwhere \"Opsem M l s h v = (\\<exists> n . (M,l,s,n,h,v):Exec)\"\n\nsubsection {* Basic properties *}\n\ntext {*We provide elimination lemmas for the inductively defined\nrelations*}\n\ninductive_cases eval_cases: \n \"(M,l,s,n,ll,t) : Step\"\n \"(M,l,s,n,h,v) : Exec\"\n(*<*)\nlemma no_zero_height_derivsAux[rule_format]: \n\"\\<forall>n . ((M,l,s,n,ll,t) : Step \\<longrightarrow> (n=0 \\<longrightarrow> False)) \\<and> ((MM,lll,ss,m,h,v):Exec \\<longrightarrow> (m=0 \\<longrightarrow> False))\"\nby (rule allI, rule Step_Exec.induct, simp_all)\n\nlemma no_zero_height_derivsAux2: \"((M,l,s,0,ll,t):Step \\<longrightarrow> False) \\<and> ((MM,lll,ss,0,h,v):Exec \\<longrightarrow> False)\"\nby (insert no_zero_height_derivsAux, fast)\n(*>*)\ntext {*and observe that no derivations of height 0 exist.*}\nlemma no_zero_height_Step_derivs: \"(M,l,s,0,ll,t):Step \\<Longrightarrow> False\"\n(*<*)by (insert no_zero_height_derivsAux2, fast)(*>*)\n(*<*)\nlemma no_zero_height_Step_derivs1: \"(M,l,(os,S,H),0,ll,t):Step \\<Longrightarrow> False\"\nby (insert no_zero_height_derivsAux2, fast)\n(*>*)\n\nlemma no_zero_height_Exec_derivs: \"(M,l,s,0,h,v):Exec \\<Longrightarrow> False\"\n(*<*)by (insert no_zero_height_derivsAux2, fast)(*>*)\n(*<*)\nlemma no_zero_height_Exec_derivs1: \"(M,l,(os,S,H),0,h,v):Exec \\<Longrightarrow> False\"\nby (insert no_zero_height_derivsAux2, fast)\n(*>*)\n\n(*<*)\n(*Elimination rules*)\nlemma ConstElim1:\"\\<lbrakk>(M, l, (os, S, h), n, ll,t) \\<in> Step; get_ins M l = Some (const v)\\<rbrakk> \n               \\<Longrightarrow> n = Suc 0 \\<and> t = (v # os, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma DupElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l =  Some dup\\<rbrakk> \n               \\<Longrightarrow> \\<exists> v ops . os = v # ops \\<and> n = Suc 0 \\<and> t = (v # os, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma PopElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l =  Some pop\\<rbrakk> \n               \\<Longrightarrow> \\<exists> v ops . os = v # ops \\<and> n = Suc 0 \\<and> t = (ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma SwapElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some swap\\<rbrakk>\n              \\<Longrightarrow> \\<exists> v w ops . os = v # w # ops \\<and> n = Suc 0 \\<and> t = (w # v # ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma LoadElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (load x)\\<rbrakk>\n                 \\<Longrightarrow> \\<exists> v . S\\<down>x = Some v \\<and> n = Suc 0 \\<and> t = (v # os, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma StoreElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (store x)\\<rbrakk>\n                  \\<Longrightarrow> \\<exists> v ops . os = v # ops \\<and> n = Suc 0 \\<and> t = (ops, S[x\\<mapsto>v], h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma BinopElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (binop f)\\<rbrakk>\n                  \\<Longrightarrow> \\<exists> v w ops . os = v # w # ops \\<and> n = Suc 0 \\<and> t = (f v w # ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all) \n\nlemma UnopElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (unop f)\\<rbrakk>\n                 \\<Longrightarrow> \\<exists> v ops . os = v # ops \\<and> n = Suc 0 \\<and> t = (f v # ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma NewElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (new d)\\<rbrakk>\n               \\<Longrightarrow> \\<exists> a . a = nextLoc h \\<and> n = Suc 0 \\<and> t = (RVal (Loc a) # os, S, h[a\\<mapsto>(d, emp)]) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma GetElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (getfield d F)\\<rbrakk>\n               \\<Longrightarrow> \\<exists> a Flds v ops. h\\<down>a = Some (d, Flds) \\<and> Flds\\<down>F = Some v \\<and> \n                                   os = RVal (Loc a) # ops \\<and> n = Suc 0 \\<and> t = (v # ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma PutElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (putfield d F)\\<rbrakk>\n                \\<Longrightarrow> \\<exists> a Flds v ops. h\\<down>a = Some (d, Flds) \\<and> os = v # RVal (Loc a) # ops \\<and>\n                                   n = Suc 0 \\<and> t = (ops, S, h[a\\<mapsto>(d, Flds[F\\<mapsto>v])]) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma CastElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (checkcast d)\\<rbrakk>\n                \\<Longrightarrow> \\<exists> a Flds ops . h\\<down>a = Some (d, Flds) \\<and> os = RVal (Loc a) # ops \\<and> n = Suc 0 \\<and> \n                                   t = (RVal (Loc a) # ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma GotoElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (goto pc)\\<rbrakk>\n                \\<Longrightarrow> n = Suc 0 \\<and> t = (os, S, h) \\<and> ll = pc\"\nby (erule eval_cases, simp_all)\n\nlemma IfElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (iftrue pc)\\<rbrakk>\n              \\<Longrightarrow> (\\<exists> ops . os = TRUE # ops \\<and> n = Suc 0 \\<and> t = (ops, S, h) \\<and> ll = pc) \\<or> \n                  (\\<exists> v ops . v \\<noteq> TRUE \\<and> os = v # ops \\<and> n = Suc 0 \\<and> t = (ops, S, h) \\<and> ll = l+1)\"\nby (erule eval_cases, simp_all)\n\nlemma InvokeElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (invokeS C m)\\<rbrakk>\n                   \\<Longrightarrow> \\<exists> code l0 v ops hh u k R par. \n                           mbody_is C m (par,code, l0) \\<and> (os,par,R,ops):Frame \\<and> \n                           ((par,code,l0), l0, ([], R, h), k, hh, v) \\<in> Exec \\<and> \n                           n = Suc k \\<and> t = (v # ops, S, hh) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all, fastforce)\nlemma InvokeElim: \"\\<lbrakk>(M, l, s, n, ll, t) \\<in> Step; get_ins M l = Some (invokeS C m)\\<rbrakk>\n                   \\<Longrightarrow> \\<exists> code l0 v ops hh u k R par. \n                           mbody_is C m (par,code, l0) \\<and> (fst s,par,R,ops):Frame \\<and> \n                           ((par,code,l0), l0, ([], R, snd(snd s)), k, hh, v) \\<in> Exec \\<and> \n                           n = Suc k \\<and> t = (v # ops, fst (snd s), hh) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all, fastforce)\n\nlemma RetElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (vreturn)\\<rbrakk> \\<Longrightarrow> False\"\nby (erule eval_cases, simp_all)\n\nlemma ExecElim1: \"\\<lbrakk>(M,l,(os,S,H),k,h,v):Exec\\<rbrakk>\n      \\<Longrightarrow> (get_ins M l = Some vreturn \\<and> (\\<exists> ops . os = v # ops \\<and> k = Suc 0 \\<and> h=H)) \\<or>\n          (\\<exists> n m t ll. (M, l,(os,S,H), n, ll,t) \\<in> Step \\<and> (M, ll, t, m, h, v) \\<in> Exec \\<and> k = Suc (max n m))\"\napply (erule eval_cases, simp_all)\napply (rule disjI2)\n  apply clarsimp\n  apply (rule, rule, rule, rule) apply (rule, rule, rule) apply assumption\n  apply (rule, assumption) apply simp\ndone\n\nlemma InstrElimNext:\n \"\\<lbrakk>(M, l, s, n, ll, t) \\<in> Step;\n   get_ins M l = Some I;\n   I = const c \\<or> I = dup \\<or> I = pop \\<or> I = swap \\<or> I = load x \\<or>\n   I = store x \\<or> I = binop f \\<or> I = unop g \\<or> I = new d \\<or>\n   I = getfield d F \\<or> I = putfield d F \\<or> I = checkcast d\\<rbrakk>\n  \\<Longrightarrow> ll = l+1\"\napply (drule eval_cases, simp_all)\napply clarsimp \napply clarsimp\ndone\n(*>*)\n\ntext{*By induction on the derivation system one can show\ndeterminism.*}\n\n(*<*)\nlemma StepExec_determ_Aux[rule_format]:\n\"(\\<forall> n1 l M s l1 t . n1 \\<le> n \\<longrightarrow> (M, l, s, n1, l1, t) \\<in> Step \\<longrightarrow>\n       (\\<forall> n2 l2 r. (M,l,s,n2,l2,r):Step \\<longrightarrow> (n1=n2 \\<and> t=r \\<and> l1=l2))) \\<and>\n (\\<forall> n1 l M s h v . n1 \\<le> n \\<longrightarrow> (M, l, s, n1, h, v) \\<in> Exec \\<longrightarrow>\n      (\\<forall> n2 k w . (M,l,s,n2,k,w):Exec \\<longrightarrow> (n1=n2 \\<and> h=k \\<and> v=w)))\"\napply (induct n)\napply clarsimp apply rule apply clarsimp apply (drule no_zero_height_Step_derivs1, simp)\n   apply clarsimp apply (drule no_zero_height_Exec_derivs1, simp)\napply clarsimp\napply rule\n  apply clarsimp \napply (erule Step.cases)\n  apply clarsimp apply (drule ConstElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule DupElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule PopElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule SwapElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule LoadElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule StoreElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule BinopElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule UnopElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule NewElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule GetElim1) apply fastforce apply clarsimp\n  apply clarsimp apply (drule PutElim1) apply fastforce apply clarsimp\n  apply clarsimp apply (drule CastElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule GotoElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule IfElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule IfElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule InvokeElim1) apply simp apply clarsimp\n    apply (erule thin_rl)\n    apply (simp add: mbody_is_def, clarsimp)\n    apply (drule Frame_deterministic, assumption, clarsimp)\napply clarsimp\n  apply (erule Exec.cases)\n  apply clarsimp apply (erule Exec.cases)\n    apply clarsimp\n    apply clarsimp apply (drule RetElim1, simp, simp)\n  apply clarsimp apply (drule ExecElim1)\n    apply clarsimp\n    apply (erule disjE, clarsimp) apply (drule RetElim1, simp, simp)\n    apply clarsimp\n      apply (erule_tac x=na in allE, rotate_tac -1, clarsimp)\n      apply (erule_tac x=la in allE, rotate_tac -1)\n      apply (erule_tac x=ad in allE, rotate_tac -1)\n      apply (erule_tac x=ae in allE, rotate_tac -1)\n      apply (erule_tac x=bb in allE, rotate_tac -1)\n      apply (erule_tac x=af in allE, rotate_tac -1)\n      apply (erule_tac x=ag in allE, rotate_tac -1)\n      apply (erule_tac x=bc in allE, rotate_tac -1)\n      apply (erule_tac x=ll in allE, rotate_tac -1)\n      apply (erule_tac x=ah in allE, rotate_tac -1)\n      apply (erule_tac x=ai in allE, rotate_tac -1)\n      apply (erule_tac x=bd in allE, clarsimp)\n      apply (rotate_tac -1)\n      apply (erule_tac x=nb in allE, rotate_tac -1) \n      apply (erule_tac x=lla in allE, rotate_tac -1)\n      apply (erule_tac x=a in allE, rotate_tac -1)\n      apply (erule_tac x=aa in allE, rotate_tac -1)\n      apply (erule_tac x=b in allE, clarsimp)\n      apply (erule_tac x=m in allE, rotate_tac -1, clarsimp)\n      apply (erule_tac x=lla in allE, rotate_tac -1)\n      apply (erule_tac x=ad in allE, rotate_tac -1)\n      apply (erule_tac x=ae in allE, rotate_tac -1)\n      apply (erule_tac x=bb in allE, rotate_tac -1)\n      apply (erule_tac x=a in allE, rotate_tac -1)\n      apply (erule_tac x=aa in allE, rotate_tac -1)\n      apply (erule_tac x=b in allE, rotate_tac -1)\n      apply (erule_tac x=ha in allE, rotate_tac -1)\n      apply (erule_tac x=va in allE, rotate_tac -1, clarsimp)\ndone\n(*>*)\n\nlemma Step_determ:\n \"\\<lbrakk>(M,l,s,n,l1,t) \\<in> Step; (M,l,s,m,l2,r):Step\\<rbrakk> \\<Longrightarrow> n=m \\<and> t=r \\<and> l1=l2\"\n(*<*)\napply (insert StepExec_determ_Aux[of n])\napply (erule conjE)\napply (rotate_tac -1, erule thin_rl)\napply fast\ndone\n(*>*)\n\nlemma Exec_determ:\n \"\\<lbrakk>(M,l,s,n,h,v) \\<in> Exec; (M,l,s,m,k,w):Exec\\<rbrakk> \\<Longrightarrow> n=m \\<and> h=k \\<and> v=w\"\n(*<*)\napply (insert StepExec_determ_Aux[of n])\napply (erule conjE)\napply (rotate_tac -2, erule thin_rl)\napply fast\ndone\n(*>*)\n\n(*<*)\nend\n(*>*)", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/BytecodeLogicJmlTypes/Language.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.4843800842769843, "lm_q1q2_score": 0.3103112493582077}}
{"text": "section {*FUNCTION\\_\\_LR\\_MACHINE*}\ntheory\n  FUNCTION__LR_MACHINE\n\nimports\n  PRJ_12_06_04__ENTRY\n\nbegin\n\nrecord ('nonterminal, 'event) F_LR_MACHINE__fp_one_ARG =\n  funlrml_arg_grammar :: \"('nonterminal, 'event) cfg\"\n  funlrml_arg_la_length :: \"nat\"\n  funlrml_arg_found_edges :: \"(('nonterminal, 'event) DT_cfg_item set, ('nonterminal, 'event) DT_two_elements, nat) epda_step_label set\"\n  funlrml_arg_found_states :: \"('nonterminal, 'event) DT_cfg_item set set\"\n  funlrml_arg_todo_states :: \"('nonterminal, 'event) DT_cfg_item set set\"\n\ndefinition F_LR_MACHINE__fp_one_TERM_ARGS_TEST :: \"\n  ('nonterminal, 'event) cfg\n    \\<times> (('nonterminal, 'event) DT_first_function)\n    \\<times> nat\n    \\<times> (('nonterminal, 'event) DT_cfg_item set, ('nonterminal, 'event) DT_two_elements, nat) epda_step_label set\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n  \\<Rightarrow> bool\"\n  where\n    \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST A \\<equiv>\n  (\\<lambda>(G, F, k, E, V, S).\n      valid_cfg G\n      \\<and> cfgSTD_first_compatible F k\n      \\<and> finite E\n      \\<and> finite V\n      \\<and> finite S\n      \\<and> (\\<forall>e \\<in> E.\n            edge_src e \\<in> V\n            \\<and> edge_push e = [0]\n            \\<and> edge_pop e = [0]\n            \\<and> V \\<inter> S = {}\n            \\<and> edge_trg e \\<in> V \\<union> S\n            \\<and> (\\<exists>v \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G).\n                  edge_event e = Some v))\n      \\<and> (\\<forall>q \\<in> V. \\<forall>I \\<in> q. valid_item G k I)\n      \\<and> (\\<forall>q \\<in> S. \\<forall>I \\<in> q. valid_item G k I)\n      \\<and> (\\<forall>q \\<in> V \\<union> S.\n            \\<exists>w.\n              set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\n              \\<and> q = valid_item_set G k w))\n  A\"\n\ndefinition F_LR_MACHINE_TRANSFER_01 :: \"\n  ('nonterminal, 'event) cfg\n    \\<times> (('nonterminal, 'event) DT_first_function)\n    \\<times> nat\n    \\<times> (('nonterminal, 'event) DT_cfg_item set, ('nonterminal, 'event) DT_two_elements, nat) epda_step_label set\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n  \\<Rightarrow> bool\"\n  where\n    \"F_LR_MACHINE_TRANSFER_01 A \\<equiv>\n  (\\<lambda>(G, F, k, E, V, S).\n      finite S\n      \\<and> valid_cfg G\n      \\<longrightarrow> finite (F_LR_MACHINE__one G F k S))\n  A\"\n\ndefinition F_LR_MACHINE_TRANSFER_02 :: \"\n  ('nonterminal, 'event) cfg\n    \\<times> (('nonterminal, 'event) DT_first_function)\n    \\<times> nat\n    \\<times> (('nonterminal, 'event) DT_cfg_item set, ('nonterminal, 'event) DT_two_elements, nat) epda_step_label set\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n  \\<Rightarrow> bool\"\n  where\n    \"F_LR_MACHINE_TRANSFER_02 A \\<equiv>\n  (\\<lambda>(G, F, k, E, V, S).\n    \\<forall>q \\<in> S.\n      \\<forall>X \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G).\n        \\<lparr>edge_src = q,\n          edge_event = Some X,\n          edge_pop = [0],\n          edge_push = [0],\n          edge_trg = F_VALID_ITEM_SET_GOTO G F k X q\\<rparr> \\<in> (F_LR_MACHINE__one G F k S))\n  A\"\n\ndefinition F_LR_MACHINE_TRANSFER_03 :: \"\n  ('nonterminal, 'event) cfg\n    \\<times> (('nonterminal, 'event) DT_first_function)\n    \\<times> nat\n    \\<times> (('nonterminal, 'event) DT_cfg_item set, ('nonterminal, 'event) DT_two_elements, nat) epda_step_label set\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n  \\<Rightarrow> bool\"\n  where\n    \"F_LR_MACHINE_TRANSFER_03 A \\<equiv>\n  (\\<lambda>(G, F, k, E, V, S).\n    \\<forall>q \\<in> V \\<union> S.\n      \\<exists>w.\n        set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\n        \\<and> q = valid_item_set G k w)\n  A\"\n\ndefinition F_LR_MACHINE_TRANSFER :: \"\n  ('nonterminal, 'event) cfg\n    \\<times> (('nonterminal, 'event) DT_first_function)\n    \\<times> nat\n    \\<times> (('nonterminal, 'event) DT_cfg_item set, ('nonterminal, 'event) DT_two_elements, nat) epda_step_label set\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n  \\<Rightarrow> bool\"\n  where\n    \"F_LR_MACHINE_TRANSFER A \\<equiv>\n  F_LR_MACHINE_TRANSFER_01 A\n  \\<and> F_LR_MACHINE_TRANSFER_02 A\n  \\<and> F_LR_MACHINE_TRANSFER_03 A\"\n\ndefinition F_LR_MACHINE_mod_args :: \"\n  (('nonterminal, 'event) cfg\n    \\<times> (('nonterminal, 'event) DT_first_function)\n    \\<times> nat\n    \\<times> (('nonterminal, 'event) DT_cfg_item set, ('nonterminal, 'event) DT_two_elements, nat) epda_step_label set\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set))\n  \\<Rightarrow>   (('nonterminal, 'event) cfg\n    \\<times> (('nonterminal, 'event) DT_first_function)\n    \\<times> nat\n    \\<times> (('nonterminal, 'event) DT_cfg_item set, ('nonterminal, 'event) DT_two_elements, nat) epda_step_label set\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set)\n    \\<times> (('nonterminal, 'event) DT_cfg_item set set))\"\n  where\n    \"F_LR_MACHINE_mod_args A \\<equiv>\n  (\\<lambda>(G, F, k, E, V, S).\n    (G, F, k, E \\<union> F_LR_MACHINE__one G F k S, V \\<union> S, (edge_trg ` (F_LR_MACHINE__one G F k S))-(V \\<union> S)))\n  A\"\n\nlemma F_LR_MACHINE__one_finite: \"\n  valid_cfg G\n  \\<Longrightarrow> finite S\n  \\<Longrightarrow> finite (F_LR_MACHINE__one G F k S)\"\n  apply(simp add: F_LR_MACHINE__one_def)\n  apply(rule finite_imageI)\n  apply(rule finite_cartesian_product)\n   apply(force)\n  apply(rule finite_two_elements_construct_domain)\n   apply(simp add: valid_cfg_def)\n  apply(simp add: valid_cfg_def)\n  done\n\nlemma F_LR_MACHINE_TRANSFER_AT_kleene_starT: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, {}, {}, S)\n  \\<Longrightarrow> F_LR_MACHINE_TRANSFER (G, F, k, {}, {}, S)\"\n  apply(simp add: F_LR_MACHINE_TRANSFER_def)\n  apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def F_LR_MACHINE_TRANSFER_01_def F_LR_MACHINE_TRANSFER_02_def F_LR_MACHINE_TRANSFER_03_def)\n  apply(rule conjI)\n   apply(rule F_LR_MACHINE__one_finite)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac q X)(*strict*)\n  apply(simp add: F_LR_MACHINE__one_def)\n  apply(rule inMap)\n  apply(clarsimp)\n  done\n\nlemma F_LR_MACHINE__one_preserves_F_LR_MACHINE__fp_one_TERM_ARGS_TEST: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST A\n  \\<Longrightarrow> F_LR_MACHINE__fp_one_TERM_ARGS_TEST (F_LR_MACHINE_mod_args A)\"\n  apply(case_tac A)\n  apply(rename_tac a b c d e f)(*strict*)\n  apply(rename_tac G F k E V S)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n   apply(rename_tac G F k E V S)(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def F_LR_MACHINE_mod_args_def)\n   apply(clarsimp)\n   apply(rename_tac G F k E V S q x)(*strict*)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def F_LR_MACHINE_mod_args_def)\n  apply(clarsimp)\n  apply(rule context_conjI)\n   apply(rename_tac G F k E V S)(*strict*)\n   apply(simp add: F_LR_MACHINE__one_def)\n   apply(rule finite_imageI)\n   apply(rule finite_cartesian_product)\n    apply(rename_tac G k E V S)(*strict*)\n    apply(force)\n   apply(rename_tac G k E V S)(*strict*)\n   apply(rule finite_two_elements_construct_domain)\n    apply(rename_tac G k E V S)(*strict*)\n    apply(simp add: valid_cfg_def)\n   apply(rename_tac G k E V S)(*strict*)\n   apply(simp add: valid_cfg_def)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac G F k E V S)(*strict*)\n   apply(rule finite_imageI)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G k E V S)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G k E V S e)(*strict*)\n   apply(simp add: F_LR_MACHINE__one_def)\n   apply(clarsimp)\n   apply(erule disjE)\n    apply(rename_tac G k E V S e)(*strict*)\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"e\"\n      in ballE)\n     apply(rename_tac G k E V S e)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac G k E V S e)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G k E V S e)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G k E V S)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G k E V S)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G k E V S q x)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac G k E V S q x)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G k E V S q x)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(simp add: F_LR_MACHINE__one_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"a\"\n      and A=\"S\"\n      and P=\"\\<lambda>a. \\<forall>x \\<in> a. valid_item G k x\"\n      in ballE)\n    prefer 2\n    apply(clarsimp)\n   apply(rule_tac\n      S=\"a\"\n      in F_VALID_ITEM_SET_GOTO_preserves_item_set)\n      apply(force)\n     apply(rename_tac G k E V S xa a b)(*strict*)\n     apply(force)\n    apply(rename_tac G k E V S xa a b)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(simp add: F_LR_MACHINE__one_def)\n  apply(clarsimp)\n  apply(rename_tac G F k E V S q)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac G F k E V S q)(*strict*)\n   apply(erule_tac\n      x=\"q\"\n      and A=\"V \\<union> S\"\n      in ballE)\n    apply(rename_tac G k E V S q)(*strict*)\n    apply(force)\n   apply(rename_tac G k E V S q)(*strict*)\n   apply(force)\n  apply(rename_tac G F k E V S q)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac G F k E V S q)(*strict*)\n   apply(erule_tac\n      x=\"q\"\n      and A=\"V \\<union> S\"\n      in ballE)\n    apply(rename_tac G F k E V S q)(*strict*)\n    apply(force)\n   apply(rename_tac G F k E V S q)(*strict*)\n   apply(force)\n  apply(rename_tac G F k E V S q)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G F k E V S a b)(*strict*)\n  apply(erule_tac\n      x=\"a\"\n      and A=\"V \\<union> S\"\n      in ballE)\n   apply(rename_tac G F k E V S a b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G F k E V S b w)(*strict*)\n   apply(rule_tac\n      x=\"w@[b]\"\n      in exI)\n   apply(rule context_conjI)\n    apply(rename_tac G F k E V S b w)(*strict*)\n    prefer 2\n    apply(rule sym)\n    apply(rule Lemma6__26)\n       apply(rename_tac G F k E V S b w)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac G F k E V S b w)(*strict*)\n     apply(rule two_elements_construct_domain_setA)\n     apply(force)\n    apply(rename_tac G F k E V S b w)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(force)\n   apply(rename_tac G F k E V S b w)(*strict*)\n   apply(rule two_elements_construct_domain_append)\n    apply(rename_tac G F k E V S b w)(*strict*)\n    apply(force)\n   apply(rename_tac G F k E V S b w)(*strict*)\n   apply(force)\n  apply(rename_tac G F k E V S a b)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_termLem2: \"\n  F_LR_MACHINE__one G F k S \\<noteq> {}\n  \\<Longrightarrow> F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> F_LR_MACHINE_mod_args (G, F, k, E, V, S) = (G, F', k, E', V', S')\n  \\<Longrightarrow> card ({x. edge_src x \\<subseteq> Collect (valid_item G k) \\<and> (\\<exists>a \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G). edge_event x = Some a) \\<and> edge_push x = [0] \\<and> edge_pop x = [0] \\<and> edge_trg x \\<subseteq> Collect (valid_item G k)} - E') < card ({x. edge_src x \\<subseteq> Collect (valid_item G k) \\<and> (\\<exists>a \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G). edge_event x = Some a) \\<and> edge_push x = [0] \\<and> edge_pop x = [0] \\<and> edge_trg x \\<subseteq> Collect (valid_item G k)} - E)\"\n  apply(rule psubset_card_mono)\n   prefer 2\n   apply(rule rev_subset)\n    prefer 3\n    apply(rule_tac\n      B = \"{x. edge_src x \\<subseteq> Collect (valid_item G k) \\<and> (\\<exists>a \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G). edge_event x = Some a) \\<and> edge_push x = [0] \\<and> edge_pop x = [0] \\<and> edge_trg x \\<subseteq> Collect (valid_item G k)}\"\n      in finite_subset)\n     apply(force)\n    apply(rule_tac\n      B = \"(\\<lambda>(s, r, po, pu, t). \\<lparr>edge_src=s, edge_event=r, edge_pop=po, edge_push=pu, edge_trg=t\\<rparr>) ` (Pow(Collect (valid_item G k)) \\<times> (WrapInSome (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G))) \\<times> {[0]} \\<times> {[0]} \\<times> Pow(Collect (valid_item G k)))\"\n      in finite_subset)\n     apply(clarsimp)\n     apply(rename_tac x a)(*strict*)\n     apply(rule inMap)\n     apply(clarsimp)\n     apply(case_tac x)\n     apply(rename_tac x a edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac a edge_src edge_trg)(*strict*)\n     apply(simp add: WrapInSome_def)\n    apply(rule finite_imageI)\n    apply(subgoal_tac \"finite (Pow (Collect (valid_item G k)))\")\n     prefer 2\n     apply(rule card_ge_0_finite)\n     apply(rule_tac\n      t=\"card (Pow (Collect (valid_item G k)))\"\n      and s=\"Suc (Suc 0) ^ card A\" for A\n      in ssubst)\n      apply(rule card_Pow_SucSuc)\n      apply(rule finite_ItemSet)\n      apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n     apply(force)\n    apply(rule finite_cartesian_product)\n     apply(force)\n    apply(rule finite_cartesian_product)\n     apply(subgoal_tac \"finite (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G))\")\n      apply(simp add: WrapInSome_def)\n     apply(rule finite_two_elements_construct_domain)\n      apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def valid_cfg_def)\n     apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def valid_cfg_def)\n    apply(rule finite_cartesian_product)\n     apply(force)\n    apply(rule finite_cartesian_product)\n     apply(force)\n    apply(force)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>I \\<in> (F_LR_MACHINE__one G F' k S). I\\<notin> E\")\n    apply(force)\n   apply(simp add: F_LR_MACHINE__one_def)\n   apply(clarsimp)\n   apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>x. x \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G))\")\n    prefer 2\n    apply(force)\n   apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(subgoal_tac \"\\<exists>x \\<in> S. True\")\n    apply(rename_tac x)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xa)(*strict*)\n   apply(erule_tac\n      x=\"xa\"\n      and A=\"V \\<union> S\"\n      in ballE)\n    apply(rename_tac x xa)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x xa)(*strict*)\n   apply(rule_tac\n      x=\"xa\"\n      in bexI)\n    apply(rename_tac x xa)(*strict*)\n    apply(rule_tac\n      x=\"x\"\n      in bexI)\n     apply(rename_tac x xa)(*strict*)\n     apply(case_tac \"\\<lparr>edge_src = xa, edge_event = Some x, edge_pop = [0], edge_push = [0], edge_trg = F_VALID_ITEM_SET_GOTO G F' k x xa\\<rparr> \\<in> E\")\n      apply(rename_tac x xa)(*strict*)\n      apply(subgoal_tac \"False\")\n       apply(rename_tac x xa)(*strict*)\n       apply(force)\n      apply(rename_tac x xa)(*strict*)\n      apply(erule_tac\n      x=\"\\<lparr>edge_src = xa, edge_event = Some x, edge_pop = [0], edge_push = [0], edge_trg = F_VALID_ITEM_SET_GOTO G F' k x xa\\<rparr>\"\n      in ballE)\n       apply(rename_tac x xa)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac x w)(*strict*)\n       apply(force)\n      apply(rename_tac x xa)(*strict*)\n      apply(force)\n     apply(rename_tac x xa)(*strict*)\n     apply(force)\n    apply(rename_tac x xa)(*strict*)\n    apply(force)\n   apply(rename_tac x xa)(*strict*)\n   apply(force)\n  apply(subgoal_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (F_LR_MACHINE_mod_args (G, F, k, E, V, S))\")\n   prefer 2\n   apply(rule F_LR_MACHINE__one_preserves_F_LR_MACHINE__fp_one_TERM_ARGS_TEST)\n   apply(force)\n  apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def F_LR_MACHINE_mod_args_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      and P=\"\\<lambda>x. (edge_src x \\<in> V \\<or> edge_src x \\<in> S) \\<and> edge_push x = [0] \\<and> edge_pop x = [0] \\<and> (edge_trg x \\<in> V \\<or> edge_trg x \\<in> S \\<or> edge_trg x \\<in> edge_trg ` F_LR_MACHINE__one G F' k S \\<and> edge_trg x \\<notin> V \\<and> edge_trg x \\<notin> S) \\<and> (\\<exists>v \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G). edge_event x = Some v)\"\n      in ballE)\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x v)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac x v)(*strict*)\n   apply(erule_tac\n      P=\"edge_src x \\<in> V\"\n      in disjE)\n    apply(rename_tac x v)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x v)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x v)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x v xa)(*strict*)\n  apply(erule_tac\n      P=\"x \\<in> E\"\n      in disjE)\n   apply(rename_tac x v xa)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"x\"\n      in ballE)\n    apply(rename_tac x v xa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x v xa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x v xa)(*strict*)\n  apply(erule_tac\n      P=\"edge_src x \\<in> V\"\n      in disjE)\n   apply(rename_tac x v xa)(*strict*)\n   apply(clarsimp)\n   apply(erule disjE)\n    apply(rename_tac x v xa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x v xa)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac x v xa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x v xa)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"edge_trg x\"\n      and P=\"\\<lambda>x. \\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> x = valid_item_set G k w\"\n      in ballE)\n    apply(rename_tac x v xa)(*strict*)\n    prefer 2\n    apply(clarsimp)\n   apply(rename_tac x v xa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x v xa w)(*strict*)\n   apply(rule Fact6_12__2)\n    apply(rename_tac x v xa w)(*strict*)\n    apply(force)\n   apply(rename_tac x v xa w)(*strict*)\n   apply(force)\n  apply(rename_tac x v xa)(*strict*)\n  apply(clarsimp)\n  apply(erule disjE)\n   apply(rename_tac x v xa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x v xa)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac x v xa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x v xa)(*strict*)\n  apply(clarsimp)\n  apply(simp add: F_LR_MACHINE__one_def)\n  apply(clarsimp)\n  apply(rename_tac v xa a)(*strict*)\n  apply(erule_tac\n      x=\"a\"\n      and A=\"V \\<union> S\"\n      and P=\"\\<lambda>a. \\<forall>x \\<in> a. valid_item G k x\"\n      in ballE)\n   apply(rename_tac v xa a)(*strict*)\n   apply(rule_tac\n      S=\"a\"\n      in F_VALID_ITEM_SET_GOTO_preserves_item_set)\n      apply(rename_tac v xa a)(*strict*)\n      apply(force)\n     apply(force)\n    apply(rename_tac v xa a)(*strict*)\n    apply(force)\n   apply(rename_tac v xa a)(*strict*)\n   apply(force)\n  apply(rename_tac v xa a)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_LR_MACHINE__fp_one_Meta_Lift: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, {}, {}, S)\n  \\<Longrightarrow> (\\<And>G F k E V S G' F' k' E' V' S'. F_LR_MACHINE_TRANSFER (G', F', k', {}, {}, S') \\<longrightarrow> P G' F' k' S' (F_LR_MACHINE__fp_one G' F' k' {} {} S') \\<Longrightarrow> F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S) \\<Longrightarrow>  F_LR_MACHINE_mod_args (G, F, k, E, V, S) = (G', F', k', E', V', S') \\<Longrightarrow> F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G', F', k', E', V', S') \\<Longrightarrow> F_LR_MACHINE_TRANSFER (G, F, k, {}, {}, S) \\<Longrightarrow> P G F k S (F_LR_MACHINE__fp_one G F k {} {} S))\n  \\<Longrightarrow> (\\<And>G F k E V S. F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S) \\<Longrightarrow> F_LR_MACHINE_TRANSFER (G, F, k, {}, {}, S) \\<Longrightarrow> \\<not> P G F k S (F_LR_MACHINE__fp_one G F k {} {} S) \\<Longrightarrow> F_LR_MACHINE__one G F k S = {} \\<Longrightarrow> False)\n  \\<Longrightarrow> P G F k S (F_LR_MACHINE__fp_one G F k {} {} S)\"\n  apply(subgoal_tac \"(\\<lambda>G F k E V S. F_LR_MACHINE_TRANSFER (G, F, k, E, V, S) \\<longrightarrow> (P G F k S (F_LR_MACHINE__fp_one G F k {} {} S))) G F k {} {} S\")\n   apply(erule impE)\n    prefer 2\n    apply(blast)\n   apply(rule F_LR_MACHINE_TRANSFER_AT_kleene_starT)\n   apply(blast)\n  apply(subgoal_tac \"(\\<lambda>(G, F, k, E, V, S). F_LR_MACHINE_TRANSFER (G, F, k, {}, {}, S) \\<longrightarrow> (P G F k S (F_LR_MACHINE__fp_one G F k {} {} S))) (G, F, k, {}, {}, S)\")\n   apply(blast)\n  apply(rule_tac\n      TERM_ARGS_TEST = \"\\<lambda>(G, F, k, E, V, S). F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\"\n      and RECURSIVE_COND = \"\\<lambda>(G, F, k, E, V, S). F_LR_MACHINE__one G F k S \\<noteq> {}\"\n      and MODIFY_ARGS_FOR_REC_CALL = \"\\<lambda>(G, F, k, E, V, S). (G, F, k, E \\<union> (F_LR_MACHINE__one G F k S), V \\<union> S, (edge_trg ` (F_LR_MACHINE__one G F k S))-(V \\<union> S))\"\n      and MEASURE = \"\\<lambda>(G, F, k, E, V, S). card (((Collect (\\<lambda>x. edge_src x \\<subseteq> (Collect (\\<lambda>x. valid_item G k x)) \\<and> (\\<exists>a \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)). edge_event x = Some a) \\<and> edge_push x = [0] \\<and> edge_pop x = [0] \\<and> edge_trg x \\<subseteq> (Collect (\\<lambda>x. valid_item G k x))))) -E)\"\n      and TERM_FUN = \"(\\<lambda>(G, F, k, E, V, S). F_LR_MACHINE_TRANSFER (G, F, k, {}, {}, S) \\<longrightarrow> (P G F k S (F_LR_MACHINE__fp_one G F k {} {} S)))\"\n      and y = \"(G, F, k, {}, {}, S)\"\n      in partial_termination_wf)\n      apply(fold F_LR_MACHINE_mod_args_def)\n      apply(rule allI)\n      apply(rename_tac x)(*strict*)\n      apply(clarify)\n      apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, {}, {}, S)\")\n      apply(rename_tac G F k E V S G' F' k' E' V' S')\n      apply(rule_tac\n      t=\"(G', F', k', E', V', S')\"\n      and s=\"F_LR_MACHINE_mod_args (G, F, k, E, V, S)\"\n      in ssubst)\n       apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n       apply(force)\n      apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n      apply(rule F_LR_MACHINE__one_preserves_F_LR_MACHINE__fp_one_TERM_ARGS_TEST)\n      apply(force)\n     apply(clarify)\n     apply(rename_tac a aa ab ac b)(*strict*)\n     apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, {}, {}, S)\")\n     apply(rename_tac G F k E V S)\n     apply(rename_tac G F k E V S)(*strict*)\n     apply(case_tac \"F_LR_MACHINE_mod_args (G, F, k, E, V, S)\")\n     apply(rename_tac G F k E V S a b c d e)(*strict*)\n     apply(rename_tac G F k E V S G' F' k' E' V' S')\n     apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"G'=G \\<and> k'=k\")\n      apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n      prefer 2\n      apply(simp add: F_LR_MACHINE_mod_args_def)\n     apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n     apply(clarsimp)\n     apply(rename_tac G F k E V S E' V' S' F')(*strict*)\n     apply(rule_tac\n      S=\"S\"\n      and F=\"F\"\n      in F_LR_MACHINE_termLem2)\n       apply(rename_tac G F k E V S E' V' S')(*strict*)\n       apply(force)\n      apply(rename_tac G F k E V S E' V' S')(*strict*)\n      apply(force)\n     apply(rename_tac G F k E V S E' V' S')(*strict*)\n     apply(force)\n    prefer 3\n    apply(force)\n   apply(clarify)\n   apply(rename_tac a aa ab ac b)(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, {}, {}, S)\")\n   apply(rename_tac G F k E V S)\n   apply(rename_tac G F k E V S)(*strict*)\n   prefer 2\n   apply(clarify)\n   apply(rename_tac a aa ab ac b x ad ae af ba xa ag ah ai bb)(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, {}, {}, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"(\\<And>G F k E V S.\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST\n            (G, F, k, E, V, S) \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER (G, F, k, {}, {}, S) \\<Longrightarrow>\n           \\<not> P G F k S (F_LR_MACHINE__fp_one G F k {} {} S) \\<Longrightarrow>\n           F_LR_MACHINE__one G F k S = {} \\<Longrightarrow> False)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(erule_tac\n      x=\"G\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"F\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"k\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"E\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"V\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"S\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"G'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"F'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"k'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"E'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"V'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"S'\"\n      in meta_allE)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(erule_tac\n      x=\"G\"\n      and P=\"\\<lambda>G. (\\<And>F k E V S.\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST\n            (G, F, k, E, V, S) \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER (G, F, k, {}, {}, S) \\<Longrightarrow>\n           \\<not> P G F k S (F_LR_MACHINE__fp_one G F k {} {} S) \\<Longrightarrow>\n           F_LR_MACHINE__one G F k S = {} \\<Longrightarrow> False)\"\n      in meta_allE)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(erule_tac\n      x=\"F\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"k\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"E\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"V\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"S\"\n      in meta_allE)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_TRANSFER_transfers: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> F_LR_MACHINE_TRANSFER (G, F, k, E, V, S)\"\n  apply(simp add: F_LR_MACHINE_TRANSFER_def)\n  apply(simp add: F_LR_MACHINE_TRANSFER_01_def F_LR_MACHINE_TRANSFER_02_def)\n  apply(simp add: F_LR_MACHINE__one_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rule finite_imageI)\n   apply(rule finite_cartesian_product)\n    apply(force)\n   apply(rule finite_two_elements_construct_domain)\n    apply(simp add: valid_cfg_def)\n   apply(simp add: valid_cfg_def)\n  apply(rule conjI)\n   apply(rule ballI)\n   apply(rename_tac q)(*strict*)\n   apply(rule ballI)\n   apply(rename_tac q X)(*strict*)\n   apply(case_tac \"\\<lparr>edge_src = q, edge_event = Some X, edge_pop = [0], edge_push = [0], edge_trg = F_VALID_ITEM_SET_GOTO G F k X q\\<rparr> \\<in> E\")\n    apply(rename_tac q X)(*strict*)\n    apply(force)\n   apply(rename_tac q X)(*strict*)\n   apply(rule inMap)\n   apply(clarsimp)\n  apply(simp add: F_LR_MACHINE_TRANSFER_03_def)\n  apply(clarsimp)\n  apply(rename_tac q)(*strict*)\n  apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n  done\n\nlemma F_LR_MACHINE__fp_one_Meta_Lift2: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> (\\<And>G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S''. F_LR_MACHINE_mod_args (G, F, k, E, V, S) = (G', F', k', E', V', S') \\<Longrightarrow> F_LR_MACHINE_TRANSFER (G', F', k', E', V', S') \\<longrightarrow> P G' F' k' E' V' S' (F_LR_MACHINE__fp_one G' F' k' E' V' S') \\<Longrightarrow> F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S) \\<Longrightarrow> F_LR_MACHINE_mod_args (G, F, k, E, V, S) = (G'', F'', k'', E'', V'', S'') \\<Longrightarrow> F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G'', F'', k'', E'', V'', S'') \\<Longrightarrow> F_LR_MACHINE_TRANSFER (G, F, k, E, V, S) \\<Longrightarrow> P G F k E V S (F_LR_MACHINE__fp_one G F k E V S))\n  \\<Longrightarrow> (\\<And>G F k E V S. F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S) \\<Longrightarrow> F_LR_MACHINE_TRANSFER (G, F, k, E, V, S) \\<Longrightarrow> F_LR_MACHINE__one G F k S = {} \\<Longrightarrow> P G F k E V S (F_LR_MACHINE__fp_one G F k E V S))\n  \\<Longrightarrow> P G F k E V S (F_LR_MACHINE__fp_one G F k E V S)\"\n  apply(subgoal_tac \"(\\<lambda>G F k E V S. F_LR_MACHINE_TRANSFER (G, F, k, E, V, S) \\<longrightarrow> (P G F k E V S (F_LR_MACHINE__fp_one G F k E V S))) G F k E V S\")\n   apply(erule impE)\n    prefer 2\n    apply(blast)\n   apply(rule F_LR_MACHINE_TRANSFER_transfers)\n   apply(force)\n  apply(subgoal_tac \"(\\<lambda>(G, F, k, E, V, S). F_LR_MACHINE_TRANSFER (G, F, k, E, V, S) \\<longrightarrow> (P G F k E V S (F_LR_MACHINE__fp_one G F k E V S))) (G, F, k, E, V, S)\")\n   apply(blast)\n  apply(rule_tac\n      TERM_ARGS_TEST = \"\\<lambda>(G, F, k, E, V, S). F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\"\n      and RECURSIVE_COND = \"\\<lambda>(G, F, k, E, V, S). F_LR_MACHINE__one G F k S \\<noteq> {}\"\n      and MODIFY_ARGS_FOR_REC_CALL = \"\\<lambda>(G, F, k, E, V, S). (G, F, k, E \\<union> (F_LR_MACHINE__one G F k S), V \\<union> S, (edge_trg ` (F_LR_MACHINE__one G F k S))-(V \\<union> S))\"\n      and MEASURE = \"\\<lambda>(G, F, k, E, V, S). card (((Collect (\\<lambda>x. edge_src x \\<subseteq> (Collect (\\<lambda>x. valid_item G k x)) \\<and> (\\<exists>a \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)). edge_event x = Some a) \\<and> edge_push x = [0] \\<and> edge_pop x = [0] \\<and> edge_trg x \\<subseteq> (Collect (\\<lambda>x. valid_item G k x))))) -E)\"\n      and TERM_FUN = \"(\\<lambda>(G, F, k, E, V, S). F_LR_MACHINE_TRANSFER (G, F, k, E, V, S) \\<longrightarrow> (P G F k E V S (F_LR_MACHINE__fp_one G F k E V S)))\"\n      and y = \"(G, F, k, E, V, S)\"\n      in partial_termination_wf)\n      apply(fold F_LR_MACHINE_mod_args_def)\n      apply(rule allI)\n      apply(rename_tac x)(*strict*)\n      apply(clarify)\n      apply(rename_tac a aa ab ac b ad ae af ag ba)(*strict*)\n      apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n      apply(rename_tac G F k E V S G' F' k' E' V' S')\n      apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n      apply(rule_tac\n      t=\"(G', F', k', E', V', S')\"\n      and s=\"F_LR_MACHINE_mod_args (G, F, k, E, V, S)\"\n      in ssubst)\n       apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n       apply(rule sym)\n       apply(force)\n      apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n      apply(rule F_LR_MACHINE__one_preserves_F_LR_MACHINE__fp_one_TERM_ARGS_TEST)\n      apply(force)\n     apply(clarify)\n     apply(rename_tac a aa ab ac b)(*strict*)\n     apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n     apply(rename_tac G F k E V S)\n     apply(rename_tac G F k E V S)(*strict*)\n     apply(case_tac \"F_LR_MACHINE_mod_args (G, F, k, E, V, S)\")\n     apply(rename_tac G F k E V S a b c d e)(*strict*)\n     apply(rename_tac G F k E V S G' F' k' E' V' S')\n     apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n     apply(subgoal_tac \"G'=G \\<and> k'=k\")\n      apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n      prefer 2\n      apply(simp only: F_LR_MACHINE_mod_args_def)\n      apply(clarify)\n      apply(blast)\n     apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n     apply(thin_tac \" (\\<And>G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S''.\n           F_LR_MACHINE_mod_args (G, F, k, E, V, S) = (G', F', k', E', V', S') \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER (G', F', k', E', V', S') \\<longrightarrow>\n           P G' F' k' E' V' S' (F_LR_MACHINE__fp_one G' F' k' E' V' S') \\<Longrightarrow>\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S) \\<Longrightarrow>\n           F_LR_MACHINE_mod_args (G, F, k, E, V, S) = (G'', F'', k'', E'', V'', S'') \\<Longrightarrow>\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G'', F'', k'', E'', V'', S'') \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER (G, F, k, E, V, S) \\<Longrightarrow> P G F k E V S (F_LR_MACHINE__fp_one G F k E V S)) \")\n     apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n     apply(clarsimp)\n     apply(rename_tac G F k E V S F' E' V' S')(*strict*)\n     apply(rule_tac\n      S=\"S\"\n      and F=\"F\"\n      in F_LR_MACHINE_termLem2)\n       apply(rename_tac G F k E V S E' V' S')(*strict*)\n       apply(force)\n      apply(rename_tac G F k E V S E' V' S')(*strict*)\n      apply(force)\n     apply(rename_tac G F k E V S E' V' S')(*strict*)\n     apply(force)\n    prefer 3\n    apply(force)\n   apply(clarify)\n   apply(rename_tac a aa ab ac b)(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S)\n   apply(rename_tac G F k E V S)(*strict*)\n   prefer 2\n   apply(clarify)\n   apply(rename_tac a aa ab ac b x ad ae af ba xa ag ah ai bb)(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')\n   apply(erule_tac\n      x=\"G\"\n      and P=\"\\<lambda>G. (\\<And>F k E V S G' F' k' E' V' S' G''\n           F'' k'' E'' V'' S''.\n           F_LR_MACHINE_mod_args\n            (G, F, k, E, V, S) =\n           (G', F', k', E', V', S') \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER\n            (G', F', k', E', V', S') \\<longrightarrow>\n           P G' F' k' E' V' S'\n            (F_LR_MACHINE__fp_one G' F' k' E' V'\n              S') \\<Longrightarrow>\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST\n            (G, F, k, E, V, S) \\<Longrightarrow>\n           F_LR_MACHINE_mod_args\n            (G, F, k, E, V, S) =\n           (G'', F'', k'', E'', V'', S'') \\<Longrightarrow>\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST\n            (G'', F'', k'', E'', V'', S'') \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER\n            (G, F, k, E, V, S) \\<Longrightarrow>\n           P G F k E V S\n            (F_LR_MACHINE__fp_one G F k E V S))\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"F\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"k\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"E\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"V\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"S\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"G'\"\n      and P=\"\\<lambda>G'. (\\<And>F' k' E' V' S' G'' F'' k'' E''\n           V'' S''.\n           F_LR_MACHINE_mod_args\n            (G, F, k, E, V, S) =\n           (G', F', k', E', V', S') \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER\n            (G', F', k', E', V', S') \\<longrightarrow>\n           P G' F' k' E' V' S'\n            (F_LR_MACHINE__fp_one G' F' k' E' V'\n              S') \\<Longrightarrow>\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST\n            (G, F, k, E, V, S) \\<Longrightarrow>\n           F_LR_MACHINE_mod_args\n            (G, F, k, E, V, S) =\n           (G'', F'', k'', E'', V'', S'') \\<Longrightarrow>\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST\n            (G'', F'', k'', E'', V'', S''\n       ) \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER\n            (G, F, k, E, V, S) \\<Longrightarrow>\n           P G F k E V S\n            (F_LR_MACHINE__fp_one G F k E V S))\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"F'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"k'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"E'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"V'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"S'\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"G''\"\n      and P=\"\\<lambda>G''. (\\<And>F'' k'' E'' V'' S''.\n           F_LR_MACHINE_mod_args\n            (G, F, k, E, V, S) =\n           (G', F', k', E', V', S') \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER\n            (G', F', k', E', V', S') \\<longrightarrow>\n           P G' F' k' E' V' S'\n            (F_LR_MACHINE__fp_one G' F' k' E' V'\n              S') \\<Longrightarrow>\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST\n            (G, F, k, E, V, S) \\<Longrightarrow>\n           F_LR_MACHINE_mod_args\n            (G, F, k, E, V, S) =\n           (G'', F'', k'', E'', V'', S'') \\<Longrightarrow>\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST\n            (G'', F'', k'', E'', V'', S'') \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER\n            (G, F, k, E, V, S) \\<Longrightarrow>\n           P G F k E V S\n            (F_LR_MACHINE__fp_one G F k E V S))\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"F''\" in meta_allE)\n   apply(erule_tac\n      x=\"k''\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"E''\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"V''\"\n      in meta_allE)\n   apply(erule_tac\n      x=\"S''\"\n      in meta_allE)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(erule_tac\n      x=\"G\"\n      and P=\"\\<lambda>G. (\\<And>F k E V S.\n           F_LR_MACHINE__fp_one_TERM_ARGS_TEST\n            (G, F, k, E, V, S) \\<Longrightarrow>\n           F_LR_MACHINE_TRANSFER (G, F, k, E, V, S) \\<Longrightarrow>\n           F_LR_MACHINE__one G F k S = {} \\<Longrightarrow>\n           P G F k E V S (F_LR_MACHINE__fp_one G F k E V S))\"\n      in meta_allE)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(erule_tac\n      x=\"F\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"k\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"E\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"V\"\n      in meta_allE)\n  apply(erule_tac\n      x=\"S\"\n      in meta_allE)\n  apply(blast)\n  done\n\nlemma F_LR_MACHINE__fp_one_dom_empty: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> F_LR_MACHINE__one G F k S = {}\n  \\<Longrightarrow> F_LR_MACHINE__fp_one_dom (G, F, k, E, V, S)\"\n  apply(rule F_LR_MACHINE__fp_one.domintros)\n  apply(clarsimp)\n  apply(simp add: F_LR_MACHINE__one_def)\n  apply(erule disjE)\n   apply(force)\n  apply(simp add: two_elements_construct_domain_def F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def valid_cfg_def)\n  done\n\nlemma F_LR_MACHINE__fp_one_termination: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> F_LR_MACHINE__fp_one_dom (G, F, k, E, V, S)\"\n  apply(rule_tac\n      TERM_ARGS_TEST = \"\\<lambda>(G, F, k, E, V, S). F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\"\n      and RECURSIVE_COND = \"\\<lambda>(G, F, k, E, V, S). F_LR_MACHINE__one G F k S \\<noteq> {}\"\n      and MODIFY_ARGS_FOR_REC_CALL = \"\\<lambda>(G, F, k, E, V, S). (G, F, k, E \\<union> (F_LR_MACHINE__one G F k S), V \\<union> S, (edge_trg ` (F_LR_MACHINE__one G F k S))-(V \\<union> S))\"\n      and MEASURE = \"\\<lambda>(G, F, k, E, V, S). card (((Collect (\\<lambda>x. edge_src x \\<subseteq> (Collect (\\<lambda>x. valid_item G k x)) \\<and> (\\<exists>a \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)). edge_event x = Some a) \\<and> edge_push x = [0] \\<and> edge_pop x = [0] \\<and> edge_trg x \\<subseteq> (Collect (\\<lambda>x. valid_item G k x))))) -E)\"\n      and y = \"(G, F, k, E, V, S)\"\n      in partial_termination_wf)\n      apply(fold F_LR_MACHINE_mod_args_def)\n      apply(rule allI)\n      apply(rename_tac x)(*strict*)\n      apply(clarify)\n      apply(rename_tac a aa ab ac b ad ae af ag ba)(*strict*)\n      apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n      apply(rename_tac G F k E V S G' F' k' E' V' S')\n      apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n      apply(rule_tac\n      t=\"(G', F', k', E', V', S')\"\n      and s=\"F_LR_MACHINE_mod_args (G, F, k, E, V, S)\"\n      in ssubst)\n       apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n       apply(force)\n      apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n      apply(rule F_LR_MACHINE__one_preserves_F_LR_MACHINE__fp_one_TERM_ARGS_TEST)\n      apply(force)\n     apply(clarify)\n     apply(rename_tac a aa ab ac b)(*strict*)\n     apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n     apply(rename_tac G F k E V S)\n     apply(rename_tac G F k E V S)(*strict*)\n     apply(case_tac \"F_LR_MACHINE_mod_args (G, F, k, E, V, S)\")\n     apply(rename_tac G F k E V S a b c d e)(*strict*)\n     apply(rename_tac G F k E V S G' F' k' E' V' S')\n     apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"G'=G \\<and> k'=k\")\n      apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n      prefer 2\n      apply(simp add: F_LR_MACHINE_mod_args_def)\n     apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n     apply(clarsimp)\n     apply(rename_tac G F k E V S E' V' S' F')(*strict*)\n     apply(rule_tac\n      S=\"S\"\n      and V=\"V\"\n      and F=\"F\"\n      in F_LR_MACHINE_termLem2)\n       apply(rename_tac G k E V S E' V' S')(*strict*)\n       apply(force)\n      apply(rename_tac G k E V S E' V' S')(*strict*)\n      apply(force)\n     apply(rename_tac G k E V S E' V' S')(*strict*)\n     apply(force)\n    prefer 3\n    apply(force)\n   apply(clarify)\n   apply(rename_tac a aa ab ac b)(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S)\n   apply(rename_tac G F  k E V S)(*strict*)\n   prefer 2\n   apply(clarify)\n   apply(rename_tac a aa ab ac b x ad ae af ba)(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(clarsimp)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(clarsimp)\n   apply(rename_tac ab ac b x ad)(*strict*)\n   apply(rule F_LR_MACHINE__fp_one.domintros, blast)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(subgoal_tac \"F_LR_MACHINE__fp_one_dom (G, F, k, E, V, S)\")\n   apply(rename_tac G F  k E V S)(*strict*)\n   apply(force)\n  apply(rule F_LR_MACHINE__fp_one_dom_empty)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE__fp_one_psimps_ALT: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> F_LR_MACHINE__fp_one G F k E V S = (if F_LR_MACHINE__one G F k S = {} then (V, E) else F_LR_MACHINE__fp_one G F k (E \\<union> F_LR_MACHINE__one G F k S) (V \\<union> S) (edge_trg ` F_LR_MACHINE__one G F k S - (V \\<union> S)))\"\n  apply(rule_tac\n      P=\"%X. X =\n    (if F_LR_MACHINE__one G F k S = {} then (V, E)\n     else F_LR_MACHINE__fp_one G F k\n           (E \\<union> F_LR_MACHINE__one G F k S) (V \\<union> S)\n           (edge_trg ` F_LR_MACHINE__one G F k S - (V \\<union> S)))\"\n      and s=\" (if S = {} then (V, E) else F_LR_MACHINE__fp_one G F k (E \\<union> F_LR_MACHINE__one G F k S) (V \\<union> S) (edge_trg ` F_LR_MACHINE__one G F k S - (V \\<union> S)))\"\n      in ssubst)\n   prefer 2\n   apply(rule_tac t=\"F_LR_MACHINE__one G F k S = {}\" and s=\"S={}\" in ssubst)\n    prefer 2\n    apply(force)\n   apply(simp add: F_LR_MACHINE__one_def)\n   apply(rule antisym)\n    apply(clarsimp)\n    apply(simp add: two_elements_construct_domain_def F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def valid_cfg_def)\n   apply(clarsimp)\n  apply(rule F_LR_MACHINE__fp_one.psimps)\n  apply(rule F_LR_MACHINE__fp_one_termination)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_finite_snd2: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> finite S\n  \\<Longrightarrow> finite E\n  \\<Longrightarrow> finite V\n  \\<Longrightarrow> finite (snd (F_LR_MACHINE__fp_one G F k E V S))\"\n  apply(subgoal_tac \"finite S \\<and> finite E \\<and> finite V \\<longrightarrow> finite (snd (F_LR_MACHINE__fp_one G F k E V S))\")\n   apply(blast)\n  apply(thin_tac \"finite S\")\n  apply(thin_tac \"finite E\")\n  apply(thin_tac \"finite V\")\n  apply(rule_tac\n      G=\"G\"\n      and k=\"k\"\n      and S=\"S\"\n      and E=\"E\"\n      and V=\"V\"\n      in F_LR_MACHINE__fp_one_Meta_Lift2)\n    apply(blast)\n   apply(rename_tac Ga Fa ka Ea Va Sa G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n    apply(simp add: F_LR_MACHINE_mod_args_def)\n    apply(clarsimp)\n    apply(rename_tac E V S G' F' k')(*strict*)\n    apply(rule propSym)\n    apply(rule context_conjI)\n     apply(rename_tac E V S G' F' k')(*strict*)\n     apply(rule F_LR_MACHINE__one_finite)\n      apply(rename_tac E V S G' F' k')(*strict*)\n      apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n     apply(rename_tac E V S G' F' k')(*strict*)\n     apply(force)\n    apply(rename_tac E V S G' F' k')(*strict*)\n    apply(rule finite_imageI)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n   apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n    apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n   apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n    apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(clarsimp)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n   apply(rename_tac G F k E V S)(*strict*)\n   apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n   apply(rename_tac G F k E V S)(*strict*)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, {}, {}, {F_VALID_ITEM_SET_INITIAL G F k})\"\n  apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n  apply(rule conjI)\n   apply(subgoal_tac \"F_VALID_ITEM_SET_INITIAL G F k \\<subseteq> (Collect (valid_item G k))\")\n    apply(force)\n   apply(rule F_VALID_ITEM_SET_INITIAL_consists_of_items)\n    apply(force)\n   apply(force)\n  apply(rule_tac\n      x=\"[]\"\n      in exI)\n  apply(clarsimp)\n  apply(rule sym)\n  apply(rule Lemma6__23_1)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_finite_snd: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> finite (snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}))\"\n  apply(rule F_LR_MACHINE_all_finite_snd2)\n     apply(auto)\n  apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_finite_fst2: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> finite S\n  \\<Longrightarrow> finite E\n  \\<Longrightarrow> finite V\n  \\<Longrightarrow> finite (fst (F_LR_MACHINE__fp_one G F k E V S))\"\n  apply(subgoal_tac \"finite S \\<and> finite E \\<and> finite V \\<longrightarrow> finite (fst (F_LR_MACHINE__fp_one G F k E V S))\")\n   apply(blast)\n  apply(thin_tac \"finite S\")\n  apply(thin_tac \"finite E\")\n  apply(thin_tac \"finite V\")\n  apply(rule_tac\n      G=\"G\"\n      and k=\"k\"\n      and S=\"S\"\n      and E=\"E\"\n      and V=\"V\"\n      in F_LR_MACHINE__fp_one_Meta_Lift2)\n    apply(blast)\n   apply(rename_tac Ga Fa ka Ea Va Sa G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n    apply(simp add: F_LR_MACHINE_mod_args_def)\n    apply(clarsimp)\n    apply(rename_tac E V S G' F' k')(*strict*)\n    apply(rule propSym)\n    apply(rule context_conjI)\n     apply(rename_tac E V S G' F' k')(*strict*)\n     apply(rule F_LR_MACHINE__one_finite)\n      apply(rename_tac E V S G' F' k')(*strict*)\n      apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n     apply(rename_tac E V S G' F' k')(*strict*)\n     apply(force)\n    apply(rename_tac E V S G' F' k')(*strict*)\n    apply(rule finite_imageI)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n   apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n    apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n   apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n    apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S')(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(clarsimp)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n   apply(rename_tac G F k E V S)(*strict*)\n   apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n   apply(rename_tac G F k E V S)(*strict*)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_LR_MACHINE_all_finite_fst: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> finite (fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}))\"\n  apply(rule F_LR_MACHINE_all_finite_fst2)\n     apply(auto)\n  apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE__fp_one_snd_monotone: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> E \\<subseteq> snd (F_LR_MACHINE__fp_one G F k E V S)\"\n  apply(rule_tac\n      G=\"G\"\n      and k=\"k\"\n      and S=\"S\"\n      and E=\"E\"\n      and V=\"V\"\n      in F_LR_MACHINE__fp_one_Meta_Lift2)\n    apply(blast)\n   apply(rename_tac Ga Fa ka Ea Va Sa G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(clarsimp)\n   apply(rename_tac E V S G'' F'' k'' x)(*strict*)\n   apply(rename_tac E V S G F k x)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = (V, E)\")\n     apply(rename_tac E V S G F k x)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n     apply(rename_tac E V S G F k x)(*strict*)\n     apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n     apply(force)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(force)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = F_LR_MACHINE__fp_one G F k (E \\<union> F_LR_MACHINE__one G F k S) (V \\<union> S) (edge_trg ` F_LR_MACHINE__one G F k S - (V \\<union> S))\")\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(clarsimp)\n    apply(force)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G F k E V S\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(force)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n   apply(rename_tac G F k E V S)(*strict*)\n   apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE__fp_one_fst_monotone: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> V \\<subseteq> fst (F_LR_MACHINE__fp_one G F k E V S)\"\n  apply(rule_tac\n      G=\"G\"\n      and k=\"k\"\n      and S=\"S\"\n      and E=\"E\"\n      and V=\"V\"\n      in F_LR_MACHINE__fp_one_Meta_Lift2)\n    apply(blast)\n   apply(rename_tac Ga Fa ka Ea Va Sa G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(clarsimp)\n   apply(rename_tac E V S G'' F'' k'' x)(*strict*)\n   apply(rename_tac E V S G F k x)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = (V, E)\")\n     apply(rename_tac E V S G F k x)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n     apply(rename_tac E V S G F k x)(*strict*)\n     apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n     apply(force)\n    apply(rename_tac E V S G  F k x)(*strict*)\n    apply(force)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = F_LR_MACHINE__fp_one G F k (E \\<union> F_LR_MACHINE__one G F k S) (V \\<union> S) (edge_trg ` F_LR_MACHINE__one G F k S - (V \\<union> S))\")\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(clarsimp)\n    apply(force)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G F k E V S\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(force)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n   apply(rename_tac G F k E V S)(*strict*)\n   apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE__fp_one_fst_monotone2: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> S \\<subseteq> fst (F_LR_MACHINE__fp_one G F k E V S)\"\n  apply(rule_tac\n      G=\"G\"\n      and k=\"k\"\n      and S=\"S\"\n      and E=\"E\"\n      and V=\"V\"\n      in F_LR_MACHINE__fp_one_Meta_Lift2)\n    apply(blast)\n   apply(rename_tac Ga Fa ka Ea Va Sa G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(clarsimp)\n   apply(rename_tac E V S G'' k'' x)(*strict*)\n   apply(rename_tac E V S G F k x)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(subgoal_tac \"S={}\")\n     apply(rename_tac E V S G F k x)(*strict*)\n     prefer 2\n     apply(simp add: F_LR_MACHINE__one_def)\n     apply(clarsimp)\n     apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n     apply(simp add: valid_cfg_def two_elements_construct_domain_def)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      A=\"V \\<union> S\"\n      in set_mp)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(rule F_LR_MACHINE__fp_one_fst_monotone)\n    apply(clarsimp)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n   apply(rename_tac G F k E V S)(*strict*)\n   apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n   apply(force)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(subgoal_tac \"S={}\")\n   apply(rename_tac G F k E V S)(*strict*)\n   prefer 2\n   apply(simp add: F_LR_MACHINE__one_def)\n   apply(clarsimp)\n   apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n   apply(simp add: valid_cfg_def two_elements_construct_domain_def)\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_edgesOK2: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> \\<forall>x \\<in> E. edge_src x \\<in> V \\<and> (\\<exists>y. (edge_event x) = Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> (V \\<union> S)\n  \\<Longrightarrow> \\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k E V S). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k E V S) \\<and> (\\<exists>y. (edge_event x) = Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k E V S)\"\n  apply(subgoal_tac \"(\\<forall>x \\<in> E. edge_src x \\<in> V \\<and> (\\<exists>y. edge_event x = Some y \\<and> y \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> edge_pop x = [0] \\<and> edge_push x = [0] \\<and> edge_trg x \\<in> (V \\<union> S)) \\<longrightarrow> (\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k E V S). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k E V S) \\<and> (\\<exists>y. edge_event x = Some y \\<and> y \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> edge_pop x = [0] \\<and> edge_push x = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k E V S)) \")\n   apply(force)\n  apply(thin_tac \"\\<forall>x \\<in> E. edge_src x \\<in> V \\<and> (\\<exists>y. edge_event x = Some y \\<and> y \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> edge_pop x = [0] \\<and> edge_push x = [0] \\<and> edge_trg x \\<in> (V \\<union> S)\")\n  apply(rule_tac\n      G=\"G\"\n      and k=\"k\"\n      and S=\"S\"\n      and E=\"E\"\n      and V=\"V\"\n      in F_LR_MACHINE__fp_one_Meta_Lift2)\n    apply(blast)\n   apply(rename_tac Ga Fa ka Ea Va Sa G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(rule impI)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x)(*strict*)\n    apply(simp add: F_LR_MACHINE_mod_args_def)\n    apply(clarsimp)\n    apply(rename_tac E V S G' F' k' x)(*strict*)\n    apply(erule disjE)\n     apply(rename_tac E V S G' F' k' x)(*strict*)\n     apply(clarsimp)\n     apply(simp add: F_LR_MACHINE__one_def)\n     apply(erule_tac\n      x=\"x\"\n      in ballE)\n      apply(rename_tac E V S G' F' k' x)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac E V S G' F' k' x)(*strict*)\n     apply(force)\n    apply(rename_tac E V S G' F' k' x)(*strict*)\n    apply(clarsimp)\n    apply(simp add: F_LR_MACHINE__one_def)\n    apply(clarsimp)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x)(*strict*)\n   apply(erule_tac\n      x=\"x\"\n      and P=\"\\<lambda>x. edge_src x \\<in> V \\<and> (\\<exists>y. edge_event x = Some y \\<and> y \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x)) \\<and> edge_pop x = [0] \\<and> edge_push x = [0] \\<and> (edge_trg x \\<in> V \\<or> edge_trg x \\<in> S)\"\n      in ballE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x)(*strict*)\n    apply(simp add: F_LR_MACHINE_mod_args_def)\n    apply(clarsimp)\n    apply(rename_tac E V S G' F' k' x y)(*strict*)\n    apply(rename_tac E V S G F k x y)\n    apply(rename_tac E V S G F k x y)(*strict*)\n    apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n     apply(rename_tac E V S G F k x y)(*strict*)\n     apply(clarsimp)\n     apply(subgoal_tac \"S={}\")\n      apply(rename_tac E V S G F k x y)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac E V G k x y)(*strict*)\n      apply(erule_tac\n      x=\"x\"\n      in ballE)\n       apply(rename_tac E V G k x y)(*strict*)\n       apply(clarsimp)\n      apply(rename_tac E V G k x y)(*strict*)\n      apply(force)\n     apply(rename_tac E V S G F k x y)(*strict*)\n     apply(simp add: F_LR_MACHINE__one_def)\n     apply(clarsimp)\n    apply(rename_tac E V S G F k x y)(*strict*)\n    apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = F_LR_MACHINE__fp_one G F k (E \\<union> F_LR_MACHINE__one G F k S) (V \\<union> S) (edge_trg ` F_LR_MACHINE__one G F k S - (V \\<union> S))\")\n     apply(rename_tac E V S G F k x y)(*strict*)\n     apply(clarsimp)\n     apply(erule_tac\n      x=\"x\"\n      in ballE)\n      apply(rename_tac E V S G F k x y)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac E V S G F k x y)(*strict*)\n     apply(force)\n    apply(rename_tac E V S G F k x y)(*strict*)\n    apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G F k E V S\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n     apply(rename_tac E V S G F k x y)(*strict*)\n     apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n     apply(force)\n    apply(rename_tac E V S G F k x y)(*strict*)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x)(*strict*)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(clarsimp)\n   apply(rename_tac E V S G' F' k' x)(*strict*)\n   apply(rename_tac E V S G F k x)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"S={}\")\n     apply(rename_tac E V S G F k x)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(simp add: F_LR_MACHINE__one_def)\n    apply(clarsimp)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = F_LR_MACHINE__fp_one G F k (E \\<union> F_LR_MACHINE__one G F k S) (V \\<union> S) (edge_trg ` F_LR_MACHINE__one G F k S - (V \\<union> S))\")\n     apply(rename_tac E V S G F k x)(*strict*)\n     apply(clarsimp)\n     apply(simp add: F_LR_MACHINE__one_def)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G F k E V S\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n     apply(rename_tac E V S G F k x)(*strict*)\n     apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n     apply(force)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(rule cfg_has_nonempty_two_elements_construct_domain)\n     apply(rename_tac E V S G F k x)(*strict*)\n     apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n     apply(force)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(force)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = F_LR_MACHINE__fp_one G F k (E \\<union> F_LR_MACHINE__one G F k S) (V \\<union> S) (edge_trg ` F_LR_MACHINE__one G F k S - (V \\<union> S))\")\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G F k E V S\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n    apply(rename_tac E V S G F k x)(*strict*)\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac E V S G F k x)(*strict*)\n   apply(force)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac Ga Fa ka Ea Va Sa x)(*strict*)\n  apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n  apply(rename_tac G F k E V S x)(*strict*)\n  apply(subgoal_tac \"S={}\")\n   apply(rename_tac G F k E V S x)(*strict*)\n   apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V {}= (if F_LR_MACHINE__one G F k {} = {} then (V, E) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSE SSG SSF SSk SSV SSS)\n    apply(rename_tac G F k E V S x)(*strict*)\n    prefer 2\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac G F k E V S x)(*strict*)\n   prefer 2\n   apply(simp add: F_LR_MACHINE__one_def)\n   apply(erule disjE)\n    apply(rename_tac G F k E V S x)(*strict*)\n    apply(force)\n   apply(rename_tac G F k E V S x)(*strict*)\n   apply(rule cfg_has_nonempty_two_elements_construct_domain)\n    apply(rename_tac G F k E V S x)(*strict*)\n    apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n    apply(force)\n   apply(rename_tac G F k E V S x)(*strict*)\n   apply(force)\n  apply(rename_tac G F k E V S x)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_LR_MACHINE_all_edgesOK: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> \\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x) = Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\"\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   apply(force)\n  apply(rule F_LR_MACHINE_all_edgesOK2)\n   apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_edgesOK_prime: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> \\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x) = Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\"\n  apply(rule F_LR_MACHINE_all_edgesOK2)\n   apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_edges_src_OK: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> \\<forall>x \\<in> E. edge_src x \\<subseteq> Collect (valid_item G k)\n  \\<Longrightarrow> \\<forall>x \\<in> S. x \\<subseteq> Collect (valid_item G k)\n  \\<Longrightarrow> \\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k E V S). edge_src x \\<subseteq> (Collect (valid_item G k))\"\n  apply(subgoal_tac \"(\\<forall>x \\<in> E. edge_src x \\<subseteq> Collect (valid_item G k)) \\<and> (\\<forall>x \\<in> S. x \\<subseteq> Collect (valid_item G k)) \\<longrightarrow> (\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k E V S). edge_src x \\<subseteq> (Collect (valid_item G k)))\")\n   apply(force)\n  apply(thin_tac \"\\<forall>x \\<in> E. edge_src x \\<subseteq> Collect (valid_item G k)\")\n  apply(thin_tac \"\\<forall>x \\<in> S. x \\<subseteq> Collect (valid_item G k)\")\n  apply(rule_tac\n      G=\"G\"\n      and k=\"k\"\n      and S=\"S\"\n      and E=\"E\"\n      and V=\"V\"\n      in F_LR_MACHINE__fp_one_Meta_Lift2)\n    apply(blast)\n   apply(rename_tac Ga Fa ka Ea Va Sa G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(simp add: F_LR_MACHINE_mod_args_def)\n    apply(clarsimp)\n    apply(rename_tac E V S G' F' k' x xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac E V S G' F' k' x xa)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac E V S G' F' k' x xa xb xc)(*strict*)\n     apply(erule disjE)\n      apply(rename_tac E V S G' F' k' x xa xb xc)(*strict*)\n      apply(erule_tac\n      x=\"xb\"\n      in ballE)\n       apply(rename_tac E V S G' F' k' x xa xb xc)(*strict*)\n       apply(force)\n      apply(rename_tac E V S G' F' k' x xa xb xc)(*strict*)\n      apply(force)\n     apply(rename_tac E V S G' F' k' x xa xb xc)(*strict*)\n     apply(simp add: F_LR_MACHINE__one_def)\n     apply(clarsimp)\n     apply(rename_tac E V S G' F' k' x xa xc a b)(*strict*)\n     apply(erule_tac\n      x=\"a\"\n      in ballE)\n      apply(rename_tac E V S G' F' k' x xa xc a b)(*strict*)\n      apply(force)\n     apply(rename_tac E V S G' F' k' x xa xc a b)(*strict*)\n     apply(force)\n    apply(rename_tac E V S G' F' k' x xa)(*strict*)\n    apply(simp add: F_LR_MACHINE__one_def)\n    apply(clarsimp)\n    apply(rename_tac E V S G' F' k' x xa a b xd)(*strict*)\n    apply(erule_tac\n      x=\"a\"\n      in ballE)\n     apply(rename_tac E V S G' F' k' x xa a b xd)(*strict*)\n     apply(rule_tac\n      S=\"a\"\n      and F=\"F'\"\n      in F_VALID_ITEM_SET_GOTO_preserves_item_set)\n        apply(rename_tac E V S G' F' k' x xa a b xd)(*strict*)\n        apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G', F', k', E \\<union> (\\<lambda>(q, X). \\<lparr>edge_src = q, edge_event = Some X, edge_pop = [0], edge_push = [0], edge_trg = F_VALID_ITEM_SET_GOTO G' F' k' X q\\<rparr>) ` (S \\<times> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')), V \\<union> S, edge_trg ` (\\<lambda>(q, X). \\<lparr>edge_src = q, edge_event = Some X, edge_pop = [0], edge_push = [0], edge_trg = F_VALID_ITEM_SET_GOTO G' F' k' X q\\<rparr>) ` (S \\<times> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')) - (V \\<union> S))\")\n        apply(rename_tac E V S G' F' k' x xa a b xd)(*strict*)\n        apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n       apply(rename_tac E V S G' F' k' x xa a b xd)(*strict*)\n       apply(simp only: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n       apply(force)\n      apply(force)\n     apply(rename_tac E V S G' F' k' x xa a b xd)(*strict*)\n     apply(force)\n    apply(rename_tac E V S G' F' k' x xa a b xd)(*strict*)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = (V, E)\")\n     apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n     apply(clarsimp)\n     apply(simp add: F_LR_MACHINE_mod_args_def)\n     apply(subgoal_tac \"F_LR_MACHINE__fp_one G' F' k' E' V' {} = (V', E')\")\n      apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac V S G' k' E' x xa)(*strict*)\n      apply(erule_tac\n      x=\"x\"\n      in ballE)\n       apply(rename_tac V S G' k' E' x xa)(*strict*)\n       apply(force)\n      apply(rename_tac V S G' k' E' x xa)(*strict*)\n      apply(force)\n     apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n     apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G' F' k' E' V' {}\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n      apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n      apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n      apply(force)\n     apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n     apply(simp add: F_LR_MACHINE__one_def)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G F k E V S\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n     apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n     apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n     apply(force)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(simp add: F_LR_MACHINE__one_def)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S= (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    prefer 2\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"x\"\n      and P=\"\\<lambda>x. edge_src x \\<subseteq> Collect (valid_item G k)\"\n      in ballE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(simp add: F_LR_MACHINE_mod_args_def)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(force)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac Ga Fa ka Ea Va Sa x xa)(*strict*)\n  apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n  apply(rename_tac G F k E V S x xa)(*strict*)\n  apply(subgoal_tac \"S={}\")\n   apply(rename_tac G F k E V S x xa)(*strict*)\n   apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V {}= (if F_LR_MACHINE__one G F k {} = {} then (V, E) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE)\n    apply(rename_tac G F k E V S x xa)(*strict*)\n    prefer 2\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac G F k E V S x xa)(*strict*)\n   prefer 2\n   apply(simp add: F_LR_MACHINE__one_def)\n   apply(erule disjE)\n    apply(rename_tac G F k E V S x xa)(*strict*)\n    apply(force)\n   apply(rename_tac G F k E V S x xa)(*strict*)\n   apply(rule cfg_has_nonempty_two_elements_construct_domain)\n    apply(rename_tac G F k E V S x xa)(*strict*)\n    apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n    apply(force)\n   apply(rename_tac G F k E V S x xa)(*strict*)\n   apply(force)\n  apply(rename_tac G F k E V S x xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G k E V x xa)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in ballE)\n   apply(rename_tac G k E V x xa)(*strict*)\n   apply(force)\n  apply(rename_tac G k E V x xa)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_edges_src_OK2: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> \\<forall>x \\<in> V \\<union> S. x \\<subseteq> Collect (valid_item G k)\n  \\<Longrightarrow> \\<forall>x \\<in> fst (F_LR_MACHINE__fp_one G F k E V S). x \\<subseteq> (Collect (valid_item G k))\"\n  apply(subgoal_tac \"(\\<forall>x \\<in> V \\<union> S. x \\<subseteq> Collect (valid_item G k)) \\<longrightarrow> (\\<forall>x \\<in> fst (F_LR_MACHINE__fp_one G F k E V S). x \\<subseteq> (Collect (valid_item G k)))\")\n   apply(force)\n  apply(thin_tac \"\\<forall>x \\<in> V \\<union> S. x \\<subseteq> Collect (valid_item G k)\")\n  apply(rule_tac\n      G=\"G\"\n      and k=\"k\"\n      and S=\"S\"\n      and E=\"E\"\n      and V=\"V\"\n      in F_LR_MACHINE__fp_one_Meta_Lift2)\n    apply(blast)\n   apply(rename_tac Ga Fa ka Ea Va Sa G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(simp add: F_LR_MACHINE_mod_args_def)\n    apply(clarsimp)\n    apply(rename_tac E V S G' F' k' x xa xb xc)(*strict*)\n    apply(erule disjE)\n     apply(rename_tac E V S G' F' k' x xa xb xc)(*strict*)\n     apply(force)\n    apply(rename_tac E V S G' F' k' x xa xb xc)(*strict*)\n    apply(erule disjE)\n     apply(rename_tac E V S G' F' k' x xa xb xc)(*strict*)\n     apply(force)\n    apply(rename_tac E V S G' F' k' x xa xb xc)(*strict*)\n    apply(simp add: F_LR_MACHINE__one_def)\n    apply(clarsimp)\n    apply(rename_tac E V S G' F' k' x xa xc a b)(*strict*)\n    apply(erule_tac\n      x=\"a\"\n      in ballE)\n     apply(rename_tac E V S G' F' k' x xa xc a b)(*strict*)\n     apply(rule_tac\n      S=\"a\"\n      and F=\"F'\"\n      in F_VALID_ITEM_SET_GOTO_preserves_item_set)\n        apply(rename_tac E V S G' F' k' x xa xc a b)(*strict*)\n        apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST\n        (G', F', k',\n         E \\<union>\n         (\\<lambda>(q, X).\n             \\<lparr>edge_src = q, edge_event = Some X, edge_pop = [0],\n                edge_push = [0], edge_trg = F_VALID_ITEM_SET_GOTO G' F' k' X q\\<rparr>) `\n         (S \\<times> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')),\n         V \\<union> S,\n         edge_trg `\n         (\\<lambda>(q, X).\n             \\<lparr>edge_src = q, edge_event = Some X, edge_pop = [0],\n                edge_push = [0], edge_trg = F_VALID_ITEM_SET_GOTO G' F' k' X q\\<rparr>) `\n         (S \\<times> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')) -\n         (V \\<union> S))\")\n        apply(rename_tac E V S G' F' k' x xa xc a b)(*strict*)\n        apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n       apply(simp only: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n       apply(rename_tac E V S G' F' k' x xa xc a b)(*strict*)\n       apply(force)\n      apply(rename_tac E V S G' F' k' x xa xc a b)(*strict*)\n      apply(force)\n     apply(rename_tac E V S G' F' k' x xa xc a b)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = (V, E)\")\n     apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n     apply(clarsimp)\n     apply(simp add: F_LR_MACHINE_mod_args_def)\n     apply(subgoal_tac \"F_LR_MACHINE__fp_one G' F' k' E' V' {} = (V', E')\")\n      apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac V S G' k' E' x xa)(*strict*)\n      apply(erule_tac\n      x=\"x\"\n      in ballE)\n       apply(rename_tac V S G' k' E' x xa)(*strict*)\n       apply(force)\n      apply(rename_tac V S G' k' E' x xa)(*strict*)\n      apply(force)\n     apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n     apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G' F' k' E' V' {}\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n      apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n      apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n      apply(force)\n     apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n     apply(simp add: F_LR_MACHINE__one_def)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G F k E V S\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n     apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n     apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n     apply(force)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(simp add: F_LR_MACHINE__one_def)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S= (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    prefer 2\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"x\"\n      and P=\"\\<lambda>x. x \\<subseteq> Collect (valid_item G k)\"\n      in ballE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n    apply(simp add: F_LR_MACHINE_mod_args_def)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x xa)(*strict*)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(force)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac Ga Fa ka Ea Va Sa x xa)(*strict*)\n  apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n  apply(rename_tac G F k E V S x xa)(*strict*)\n  apply(subgoal_tac \"S={}\")\n   apply(rename_tac G F k E V S x xa)(*strict*)\n   apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V {}= (if F_LR_MACHINE__one G F k {} = {} then (V, E) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE)\n    apply(rename_tac G F k E V S x xa)(*strict*)\n    prefer 2\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac G F k E V S x xa)(*strict*)\n   prefer 2\n   apply(simp add: F_LR_MACHINE__one_def)\n   apply(erule disjE)\n    apply(rename_tac G F k E V S x xa)(*strict*)\n    apply(force)\n   apply(rename_tac G F k E V S x xa)(*strict*)\n   apply(rule cfg_has_nonempty_two_elements_construct_domain)\n    apply(rename_tac G F k E V S x xa)(*strict*)\n    apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n    apply(force)\n   apply(rename_tac G F k E V S x xa)(*strict*)\n   apply(force)\n  apply(rename_tac G F k E V S x xa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G k E V x xa)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in ballE)\n   apply(rename_tac G k E V x xa)(*strict*)\n   apply(force)\n  apply(rename_tac G k E V x xa)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_edgesDiffer: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> \\<forall>x1 x2. x1 \\<in> (snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})) \\<and> x2 \\<in> (snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})) \\<and> (x1\\<lparr>edge_trg := edge_trg x2\\<rparr>) = x2\\<longrightarrow> x1 = x2\"\n  apply(clarsimp)\n  apply(rename_tac x1 x2)(*strict*)\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   apply(rename_tac x1 x2)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesOK_prime)\n    apply(force)\n   apply(force)\n  apply(rename_tac x1 x2)(*strict*)\n  apply(erule_tac\n      x=\"x1\"\n      in ballE)\n   apply(rename_tac x1 x2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x1 x2 y)(*strict*)\n   apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n    apply(rename_tac x1 x2 y)(*strict*)\n    prefer 2\n    apply(rule F_LR_MACHINE_all_edgesOK_prime)\n     apply(force)\n    apply(force)\n   apply(rename_tac x1 x2 y)(*strict*)\n   apply(erule_tac\n      x=\"x2\"\n      in ballE)\n    apply(rename_tac x1 x2 y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x1 x2 y ya)(*strict*)\n    apply(case_tac x1)\n    apply(rename_tac x1 x2 y ya edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n    apply(case_tac x2)\n    apply(rename_tac x1 x2 y ya edge_srca edge_eventa edge_popa edge_pusha edge_trga edge_srcaa edge_eventaa edge_popaa edge_pushaa edge_trgaa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x1 x2 y)(*strict*)\n   apply(force)\n  apply(rename_tac x1 x2)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE__fp_one_step_eq: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> F_LR_MACHINE_mod_args (G, F, k, E, V, S) = (G', F', k', E', V', S')\n  \\<Longrightarrow> F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G', F', k', E', V', S')\n  \\<Longrightarrow> F_LR_MACHINE_TRANSFER (G, F, k, E, V, S)\n  \\<Longrightarrow> F_LR_MACHINE__fp_one G F k E V S = F_LR_MACHINE__fp_one G' F' k' E' V' S'\"\n  apply(simp add: F_LR_MACHINE_mod_args_def)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G' F' k' E V S\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n   apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"S={}\")\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(clarsimp)\n  apply(simp add: F_LR_MACHINE__one_def)\n  apply(clarsimp)\n  apply(simp add: F_LR_MACHINE__fp_one_TERM_ARGS_TEST_def)\n  apply(simp add: valid_cfg_def two_elements_construct_domain_def)\n  done\n\nlemma F_LR_MACHINE__fp_one_colapses: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> F_LR_MACHINE__one G F k S = {}\n  \\<Longrightarrow> F_LR_MACHINE__fp_one G F k E V S = (V, E)\"\n  apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n   apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n   apply(force)\n  apply(clarsimp)\n  done\n\nlemma F_LR_MACHINE__fp_one_unfold_03: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> \\<forall>q \\<in> V \\<union> S. \\<exists>w. set w \\<subseteq> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)) \\<and> q = valid_item_set G k w\n  \\<Longrightarrow> q \\<in> fst (F_LR_MACHINE__fp_one G F k E V S)\n  \\<Longrightarrow> \\<exists>w. set w \\<subseteq> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)) \\<and> q = valid_item_set G k w\"\n  apply(subgoal_tac \"(\\<forall>q \\<in> V \\<union> S. \\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> q = valid_item_set G k w) \\<longrightarrow> (\\<forall>q \\<in> fst (F_LR_MACHINE__fp_one G F k E V S). \\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> q = valid_item_set G k w)\")\n   apply(force)\n  apply(thin_tac \"q \\<in> fst (F_LR_MACHINE__fp_one G F k E V S)\")\n  apply(thin_tac \"\\<forall>q \\<in> V \\<union> S. \\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> q = valid_item_set G k w\")\n  apply(rule_tac\n      G=\"G\"\n      and k=\"k\"\n      and S=\"S\"\n      and E=\"E\"\n      and V=\"V\"\n      in F_LR_MACHINE__fp_one_Meta_Lift2)\n    apply(force)\n   apply(rename_tac Ga Fa ka Ea Va Sa G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n   apply(subgoal_tac \"F_LR_MACHINE_TRANSFER (G', F', k', E', V', S')\")\n    apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n    prefer 2\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n   apply(simp add: F_LR_MACHINE_TRANSFER_def F_LR_MACHINE_TRANSFER_03_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = F_LR_MACHINE__fp_one G' F' k' E' V' S'\")\n    apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n    prefer 2\n    apply(rule F_LR_MACHINE__fp_one_step_eq)\n       apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n       apply(force)\n      apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n      apply(force)\n     apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n     apply(force)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"q\"\n      and A=\"fst (F_LR_MACHINE__fp_one G' F' k' E' V' S')\"\n      and P=\"\\<lambda>q. \\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G') \\<and> q = valid_item_set G' k' w\"\n      in ballE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n    apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' q)(*strict*)\n   apply(force)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G F k E V S q)(*strict*)\n  apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = (V, E)\")\n   apply(rename_tac G F k E V S q)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G F k E V S q)(*strict*)\n  apply(rule F_LR_MACHINE__fp_one_colapses)\n   apply(rename_tac G F k E V S q)(*strict*)\n   apply(force)\n  apply(rename_tac G F k E V S q)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_uniqueEntry: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> \\<forall>e1 e2. e1 \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> e2 \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> edge_trg e2 = edge_trg e1 \\<and> edge_trg e1 \\<noteq> {} \\<longrightarrow> edge_event e1 = edge_event e2\"\n  apply(clarsimp)\n  apply(rename_tac e1 e2)(*strict*)\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   apply(rename_tac e1 e2)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesOK_prime)\n    apply(force)\n   apply(force)\n  apply(rename_tac e1 e2)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in ballE)\n   apply(rename_tac e1 e2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e1 e2 y)(*strict*)\n   apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n    apply(rename_tac e1 e2 y)(*strict*)\n    prefer 2\n    apply(rule F_LR_MACHINE_all_edgesOK_prime)\n     apply(force)\n    apply(force)\n   apply(rename_tac e1 e2 y)(*strict*)\n   apply(erule_tac\n      x=\"e2\"\n      in ballE)\n    apply(rename_tac e1 e2 y)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac e1 e2 y ya)(*strict*)\n    defer\n    apply(rename_tac e1 e2 y)(*strict*)\n    apply(force)\n   apply(rename_tac e1 e2)(*strict*)\n   apply(force)\n  apply(rename_tac e1 e2 y ya)(*strict*)\n  apply(case_tac e1)\n  apply(rename_tac e1 e2 y ya edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n  apply(case_tac e2)\n  apply(rename_tac e1 e2 y ya edge_srca edge_eventa edge_popa edge_pusha edge_trga edge_srcaa edge_eventaa edge_popaa edge_pushaa edge_trgaa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y ya edge_src edge_srca)(*strict*)\n  apply(rule F_VALID_ITEM_SET_GOTO_unique_entry_for_nonempty_sets)\n       apply(rename_tac y ya edge_src edge_srca)(*strict*)\n       apply(force)\n      apply(rename_tac y ya edge_src edge_srca)(*strict*)\n      apply(force)\n     apply(rename_tac y ya edge_src edge_srca)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac y ya edge_src edge_srca)(*strict*)\n   apply(subgoal_tac \"\\<forall>x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). x \\<subseteq> Collect (valid_item G k)\")\n    apply(rename_tac y ya edge_src edge_srca)(*strict*)\n    prefer 2\n    apply(rule F_LR_MACHINE_all_edges_src_OK2)\n     apply(rename_tac y ya edge_src edge_srca)(*strict*)\n     apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n      apply(force)\n     apply(force)\n    apply(rename_tac y ya edge_src edge_srca)(*strict*)\n    apply(subgoal_tac \"F_VALID_ITEM_SET_INITIAL G F k \\<subseteq> (Collect (valid_item G k))\")\n     apply(rename_tac y ya edge_src edge_srca)(*strict*)\n     apply(force)\n    apply(rename_tac y ya edge_src edge_srca)(*strict*)\n    apply(rule F_VALID_ITEM_SET_INITIAL_consists_of_items)\n     apply(force)\n    apply(rename_tac y ya edge_src edge_srca)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac y ya edge_src edge_srca)(*strict*)\n  apply(subgoal_tac \"\\<forall>x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). x \\<subseteq> Collect (valid_item G k)\")\n   apply(rename_tac y ya edge_src edge_srca)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edges_src_OK2)\n    apply(rename_tac y ya edge_src edge_srca)(*strict*)\n    apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n     apply(force)\n    apply(force)\n   apply(rename_tac y ya edge_src edge_srca)(*strict*)\n   apply(subgoal_tac \"F_VALID_ITEM_SET_INITIAL G F k \\<subseteq> (Collect (valid_item G k))\")\n    apply(rename_tac y ya edge_src edge_srca)(*strict*)\n    apply(force)\n   apply(rename_tac y ya edge_src edge_srca)(*strict*)\n   apply(rule F_VALID_ITEM_SET_INITIAL_consists_of_items)\n    apply(force)\n   apply(force)\n  apply(rename_tac y ya edge_src edge_srca)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_complete_prime: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> (\\<forall>x' p. x' \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<longrightarrow> p \\<in> V \\<longrightarrow> \\<lparr>edge_src = p, edge_event = Some x', edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = F_VALID_ITEM_SET_GOTO G F k x' p\\<rparr> \\<in> E) \\<longrightarrow> (\\<forall>x' p. x' \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<longrightarrow> p \\<in> fst (F_LR_MACHINE__fp_one G F k E V S) \\<longrightarrow> \\<lparr>edge_src = p, edge_event = Some x', edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = F_VALID_ITEM_SET_GOTO G F k x' p\\<rparr> \\<in> snd (F_LR_MACHINE__fp_one G F k E V S))\"\n  apply(rule_tac\n      G=\"G\"\n      and k=\"k\"\n      and S=\"S\"\n      and E=\"E\"\n      and V=\"V\"\n      in F_LR_MACHINE__fp_one_Meta_Lift2)\n    apply(blast)\n   apply(rename_tac Ga Fa ka Ea Va Sa G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n   apply(rename_tac G F k E V S G' F' k' E' V' S' G'' F'' k'' E'' V'' S'')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x' p)(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x' p)(*strict*)\n    apply(rule F_LR_MACHINE_TRANSFER_transfers)\n    apply(force)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x' p)(*strict*)\n   apply(erule impE)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x' p)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G F k E V S G' F' k' E' V' S' x' p x'nonterminal pa)(*strict*)\n    apply(simp add: F_LR_MACHINE_mod_args_def)\n    apply(clarsimp)\n    apply(rename_tac E V S G' F' k' x' p x'nonterminal pa)(*strict*)\n    apply(erule_tac\n      x=\"x'nonterminal\"\n      in allE)\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"pa\"\n      in allE)\n    apply(erule disjE)\n     apply(rename_tac E V S G' F' k' x' p x'nonterminal pa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac E V S G' F' k' x' p x'nonterminal pa)(*strict*)\n    apply(subgoal_tac \"pa \\<notin> S\")\n     apply(rename_tac E V S G' F' k' x' p x'nonterminal pa)(*strict*)\n     apply(force)\n    apply(rename_tac E V S G' F' k' x' p x'nonterminal pa)(*strict*)\n    apply(simp add: F_LR_MACHINE__one_def)\n    apply(subgoal_tac \"\\<lparr>edge_src = pa, edge_event = Some x'nonterminal, edge_pop = [epda_box (F_LR_MACHINE G' F' k')], edge_push = [epda_box (F_LR_MACHINE G' F' k')], edge_trg = F_VALID_ITEM_SET_GOTO G' F' k' x'nonterminal pa\\<rparr> \\<in> (\\<lambda>(q, X). \\<lparr>edge_src = q, edge_event = Some X, edge_pop = [0], edge_push = [0], edge_trg = F_VALID_ITEM_SET_GOTO G' F' k' X q\\<rparr>) ` (S \\<times> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G'))\")\n     apply(rename_tac E V S G' F' k' x' p x'nonterminal pa)(*strict*)\n     apply(force)\n    apply(rename_tac E V S G' F' k' x' p x'nonterminal pa)(*strict*)\n    apply(rule inMap)\n    apply(rule_tac\n      x=\"(pa, x'nonterminal)\"\n      in bexI)\n     apply(rename_tac E V S G' F' k' x' p x'nonterminal pa)(*strict*)\n     apply(clarsimp)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rename_tac E V S G' F' k' x' p x'nonterminal pa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac G F k E V S G' F' k' E' V' S' x' p)(*strict*)\n   apply(simp add: F_LR_MACHINE_mod_args_def)\n   apply(clarsimp)\n   apply(rename_tac E V S G' F' k' x' p)(*strict*)\n   apply(erule_tac\n      x=\"x'\"\n      and P=\"\\<lambda>x'. x' \\<in> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G') \\<longrightarrow> (\\<forall>p. p \\<in> fst (F_LR_MACHINE__fp_one G' F' k' (E \\<union> F_LR_MACHINE__one G' F' k' S) (V \\<union> S) (edge_trg ` F_LR_MACHINE__one G' F' k' S - (V \\<union> S))) \\<longrightarrow> \\<lparr>edge_src = p, edge_event = Some x', edge_pop = [epda_box (F_LR_MACHINE G' F' k')], edge_push = [epda_box (F_LR_MACHINE G' F' k')], edge_trg = F_VALID_ITEM_SET_GOTO G' F' k' x' p\\<rparr> \\<in> snd (F_LR_MACHINE__fp_one G' F' k' (E \\<union> F_LR_MACHINE__one G' F' k' S) (V \\<union> S) (edge_trg ` F_LR_MACHINE__one G' F' k' S - (V \\<union> S))))\"\n      in allE)\n   apply(rename_tac E V S G' F' k' x' p)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"p\"\n      in allE)\n   apply(rename_tac E V S G F k x' p)\n   apply(rename_tac E V S G F k x' p)(*strict*)\n   apply(case_tac \"F_LR_MACHINE__one G F k S = {}\")\n    apply(rename_tac E V S G F k x' p)(*strict*)\n    apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = (V, E)\")\n     apply(rename_tac E V S G F k x' p)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac E V S G F k x' p)(*strict*)\n    prefer 2\n    apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n     apply(rename_tac E V S G F k x' p)(*strict*)\n     apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n     apply(force)\n    apply(rename_tac E V S G F k x' p)(*strict*)\n    apply(clarsimp)\n    apply(subgoal_tac \"p \\<in> fst (F_LR_MACHINE__fp_one G F k (E \\<union> F_LR_MACHINE__one G F k S) (V \\<union> S) (edge_trg ` F_LR_MACHINE__one G F k S - (V \\<union> S)))\")\n     apply(rename_tac E V S G F k x' p)(*strict*)\n     apply(force)\n    apply(rename_tac E V S G F k x' p)(*strict*)\n    apply(rule_tac\n      A=\"fst (F_LR_MACHINE__fp_one G F k E V S)\"\n      in set_mp)\n     apply(rename_tac E V S G F k x' p)(*strict*)\n     apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one G F k E V S\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n      apply(rename_tac E V S G F k x' p)(*strict*)\n      apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n      apply(force)\n     apply(rename_tac E V S G F k x' p)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac E V S G F k x' p)(*strict*)\n    apply(force)\n   apply(rename_tac E V S G F k x' p)(*strict*)\n   apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n    apply(rename_tac E V S G F k x' p)(*strict*)\n    apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n    apply(force)\n   apply(rename_tac E V S G F k x' p)(*strict*)\n   apply(subgoal_tac \"F_LR_MACHINE__one G F k {} = {}\")\n    apply(rename_tac E V S G F k x' p)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac E V S G F k x' p)(*strict*)\n   apply(simp add: F_LR_MACHINE__one_def)\n  apply(rename_tac Ga Fa ka Ea Va Sa)(*strict*)\n  apply(thin_tac \"F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\")\n  apply(rename_tac G F k E V S)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G F k E V S x' p)(*strict*)\n  apply(subgoal_tac \"F_LR_MACHINE__fp_one G F k E V S = (V, E)\")\n   apply(rename_tac G F k E V S x' p)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G F k E V S x' p)(*strict*)\n  apply(rule_tac\n      t=\"F_LR_MACHINE__fp_one SSG SSF SSk SSE SSV SSS\"\n      and s=\" (if F_LR_MACHINE__one SSG SSF SSk SSS = {} then (SSV, SSE) else F_LR_MACHINE__fp_one SSG SSF SSk (SSE \\<union> F_LR_MACHINE__one SSG SSF SSk SSS) (SSV \\<union> SSS) (edge_trg ` F_LR_MACHINE__one SSG SSF SSk SSS - (SSV \\<union> SSS)))\" for SSG SSF SSk SSS SSV SSE\n      in ssubst)\n   apply(rename_tac G F k E V S x' p)(*strict*)\n   apply(rule F_LR_MACHINE__fp_one_psimps_ALT)\n   apply(force)\n  apply(rename_tac G F k E V S x' p)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_complete: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> x' \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\n  \\<Longrightarrow> p \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\n  \\<Longrightarrow> \\<lparr>edge_src = p, edge_event = Some x', edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = F_VALID_ITEM_SET_GOTO G F k x' p\\<rparr> \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\"\n  apply(subgoal_tac \"(\\<forall>x' p. x' \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<longrightarrow> p \\<in> {} \\<longrightarrow> \\<lparr>edge_src = p, edge_event = Some x', edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = F_VALID_ITEM_SET_GOTO G F k x' p\\<rparr> \\<in> {}) \\<longrightarrow> (\\<forall>x' p. x' \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<longrightarrow> p \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<longrightarrow> \\<lparr>edge_src = p, edge_event = Some x', edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = F_VALID_ITEM_SET_GOTO G F k x' p\\<rparr> \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}))\")\n   apply(force)\n  apply(rule F_LR_MACHINE_complete_prime)\n  apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n   apply(force)\n  apply(force)\n  done\n\ntheorem LRM_contains_theEqClasses: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> epda_states M = {valid_item_set G k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)}\"\n  apply(rule order_antisym)\n   apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(subgoal_tac \"\\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> x = valid_item_set G k w\")\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(rule F_LR_MACHINE__fp_one_unfold_03)\n     apply(rename_tac x)(*strict*)\n     apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n      apply(force)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"[]\"\n      in exI)\n    apply(clarsimp)\n    apply(rule sym)\n    apply(rule Lemma6__23_1)\n     apply(force)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(clarsimp)\n  apply(rename_tac w)(*strict*)\n  apply(subgoal_tac \"set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<longrightarrow> valid_item_set G k w \\<in> epda_states (F_LR_MACHINE G F k)\")\n   apply(rename_tac w)(*strict*)\n   apply(force)\n  apply(rename_tac w)(*strict*)\n  apply(thin_tac \"set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n  apply(induct_tac w rule: rev_induct)\n   apply(rename_tac w)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"valid_item_set G k []\"\n      and s=\"F_VALID_ITEM_SET_INITIAL G F k\"\n      in ssubst)\n    apply(rule Lemma6__23_1)\n     apply(force)\n    apply(force)\n   apply(simp add: F_LR_MACHINE_def)\n   apply(rule_tac\n      A=\"{F_VALID_ITEM_SET_INITIAL G F k}\"\n      in set_mp)\n    apply(rule F_LR_MACHINE__fp_one_fst_monotone2)\n    apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rename_tac w x xs)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x xs)(*strict*)\n  apply(subgoal_tac \"\\<lparr>edge_src = valid_item_set G k xs, edge_event = Some x, edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = F_VALID_ITEM_SET_GOTO G F k x (valid_item_set G k xs)\\<rparr> \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   apply(rename_tac x xs)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_complete)\n      apply(rename_tac x xs)(*strict*)\n      apply(force)\n     apply(rename_tac x xs)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac x xs)(*strict*)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac x xs)(*strict*)\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   apply(rename_tac x xs)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesOK)\n    apply(force)\n   apply(force)\n  apply(rename_tac x xs)(*strict*)\n  apply(erule_tac\n      x=\"\\<lparr>edge_src = valid_item_set G k xs, edge_event = Some x, edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = F_VALID_ITEM_SET_GOTO G F k x (valid_item_set G k xs)\\<rparr>\"\n      in ballE)\n   apply(rename_tac x xs)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x xs)(*strict*)\n  apply(clarsimp)\n  apply(rule_tac\n      t=\"valid_item_set G k (xs @ [x])\"\n      and s=\"F_VALID_ITEM_SET_GOTO G F k x (valid_item_set G k xs)\"\n      in ssubst)\n   apply(rename_tac x xs)(*strict*)\n   prefer 2\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac x xs)(*strict*)\n  apply(rule Lemma6__26)\n     apply(rename_tac x xs)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac x xs)(*strict*)\n   apply(subgoal_tac \"set (xs@[x]) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n    apply(rename_tac x xs)(*strict*)\n    apply(rule two_elements_construct_domain_setA)\n    apply(force)\n   apply(rename_tac x xs)(*strict*)\n   apply(rule two_elements_construct_domain_append)\n    apply(rename_tac x xs)(*strict*)\n    apply(force)\n   apply(rename_tac x xs)(*strict*)\n   apply(force)\n  apply(rename_tac x xs)(*strict*)\n  apply(subgoal_tac \"set (xs@[x]) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n   apply(rename_tac x xs)(*strict*)\n   apply(rule two_elements_construct_domain_setB)\n   apply(force)\n  apply(rename_tac x xs)(*strict*)\n  apply(rule two_elements_construct_domain_append)\n   apply(rename_tac x xs)(*strict*)\n   apply(force)\n  apply(rename_tac x xs)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_insert_edge_valid_item_set: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> setA (w @ [a]) \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB (w @ [a]) \\<subseteq> cfg_events G\n  \\<Longrightarrow> \\<lparr>edge_src = valid_item_set G k w, edge_event = Some a, edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = valid_item_set G k (w @ [a]) \\<rparr> \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\"\n  apply(subgoal_tac \"valid_item_set G k w \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   apply(rule_tac\n      t=\"valid_item_set G k (w @ [a])\"\n      and s=\"F_VALID_ITEM_SET_GOTO G F k a (valid_item_set G k w)\"\n      in ssubst)\n    apply(rule Lemma6__26)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(rule F_LR_MACHINE_complete)\n      apply(force)\n     apply(force)\n    apply(simp only: setAConcat concat_asso setBConcat two_elements_construct_domain_def)\n    apply(clarsimp)\n    apply(case_tac a)\n     apply(rename_tac aa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac b)(*strict*)\n    apply(clarsimp)\n   apply(force)\n  apply(rule_tac\n      t=\"fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\"\n      and s=\"epda_states M\"\n      in ssubst)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rule_tac\n      t=\"epda_states M \"\n      and s=\"{valid_item_set G k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)}\"\n      in ssubst)\n   apply(rule LRM_contains_theEqClasses)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(rule_tac\n      x=\"w\"\n      in exI)\n  apply(rule conjI)\n   apply(clarsimp)\n  apply(rule_tac\n      B=\"set (w@[a])\"\n      in subset_trans)\n   apply(force)\n  apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n   apply(force)\n  apply(force)\n  done\n\ntheorem F_LR_MACHINE_Complete: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> some_step_from_every_configuration M\"\n  apply(simp only: some_step_from_every_configuration_def F_LR_MACHINE_def)\n  apply(clarsimp)\n  apply(rename_tac q A)(*strict*)\n  apply(rule_tac\n      x=\"\\<lparr>edge_src = q, edge_event = Some A, edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = F_VALID_ITEM_SET_GOTO G F k A q\\<rparr>\"\n      in bexI)\n   apply(rename_tac q A)(*strict*)\n   apply(force)\n  apply(rename_tac q A)(*strict*)\n  apply(rule F_LR_MACHINE_complete)\n     apply(force)\n    apply(rename_tac q A)(*strict*)\n    apply(force)\n   apply(rename_tac q A)(*strict*)\n   apply(force)\n  apply(rename_tac q A)(*strict*)\n  apply(force)\n  done\n\ntheorem Theorem6__27_b: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> p \\<noteq> {}\n  \\<Longrightarrow> e1 \\<in> epda_delta M\n  \\<Longrightarrow> e2 \\<in> epda_delta M\n  \\<Longrightarrow> edge_trg e1 = p\n  \\<Longrightarrow> edge_trg e2 = p\n  \\<Longrightarrow> edge_event e1 = edge_event e2\"\n  apply(simp add: F_LR_MACHINE_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<forall>e1 e2. e1 \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> e2 \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> edge_trg e2 = edge_trg e1 \\<and> edge_trg e1\\<noteq>{} \\<longrightarrow> edge_event e1 = edge_event e2\")\n   apply(blast)\n  apply(rule F_LR_MACHINE_all_uniqueEntry)\n   apply(blast)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE__fp_one_mono_fst: \"\n  F_LR_MACHINE__fp_one_TERM_ARGS_TEST (G, F, k, E, V, S)\n  \\<Longrightarrow> S \\<union> V \\<subseteq> fst (F_LR_MACHINE__fp_one G F k E V S)\"\n  apply(rule Un_least)\n   apply(rule F_LR_MACHINE__fp_one_fst_monotone2)\n   apply(force)\n  apply(rule F_LR_MACHINE__fp_one_fst_monotone)\n  apply(force)\n  done\n\nlemma Theorem6__27_a1: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_epda M\"\n  apply(simp add: valid_epda_def)\n  apply(simp add: F_LR_MACHINE_def)\n  apply(auto)\n      apply(rule F_LR_MACHINE_all_finite_fst)\n       apply(force)\n      apply(force)\n     apply(simp add: two_elements_construct_domain_def)\n     apply(auto)\n      apply(rule finite_imageI)\n      apply(simp add: valid_cfg_def)\n     apply(rule finite_imageI)\n     apply(simp add: valid_cfg_def)\n    apply(rule F_LR_MACHINE_all_finite_snd)\n     apply(blast)\n    apply(force)\n   apply(rule_tac\n      A=\"{F_VALID_ITEM_SET_INITIAL G F k} \\<union> {}\"\n      in set_mp)\n    apply(rule F_LR_MACHINE__fp_one_mono_fst)\n    apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(simp add: valid_epda_step_label_def)\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n   apply(simp add: may_terminated_by_def append_language_def kleene_star_def)\n   apply(simp add: option_to_set_def)\n   apply(erule_tac\n      x=\"x\"\n      in ballE)\n    apply(rename_tac x)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(rule F_LR_MACHINE_all_edgesOK)\n   apply(blast)+\n  done\n\nlemma Theorem6__27_a2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_pda M\"\n  apply(simp add: valid_pda_def)\n  apply(rule conjI)\n   apply(rule Theorem6__27_a1)\n     apply(blast)\n    apply(blast)\n   apply(force)\n  apply(simp add: F_LR_MACHINE_def)\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   apply(force)\n  apply(rule F_LR_MACHINE_all_edgesOK)\n   apply(blast)\n  apply(blast)\n  done\n\nlemma Theorem6__27_a3: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dpda M\"\n  apply(simp add: valid_dpda_def)\n  apply(rule conjI)\n   apply(rule Theorem6__27_a2)\n     apply(blast)\n    apply(blast)\n   apply(blast)\n  apply(simp add: epdaS.is_forward_edge_deterministic_accessible_def)\n  apply(rule ballI)\n  apply(rename_tac c)(*strict*)\n  apply(rule allI)+\n  apply(rename_tac c c1 c2 e1 e2)(*strict*)\n  apply(rule impI)\n  apply(clarsimp)\n  apply(simp add: epdaS_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac c c1 c2 e1 e2 w wa)(*strict*)\n  apply(case_tac c)\n  apply(rename_tac c c1 c2 e1 e2 w wa epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stacka)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac c c1 c2 e1 e2 w wa epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stacka epdaS_conf_stateaa epdaS_conf_scheduleraa epdaS_conf_stackaa)(*strict*)\n  apply(case_tac c2)\n  apply(rename_tac c c1 c2 e1 e2 w wa epdaS_conf_statea epdaS_conf_schedulera epdaS_conf_stacka epdaS_conf_stateaa epdaS_conf_scheduleraa epdaS_conf_stackaa epdaS_conf_stateb epdaS_conf_schedulerb epdaS_conf_stackb)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac e1 e2 w wa epdaS_conf_schedulera epdaS_conf_schedulerb)(*strict*)\n  apply(simp add: option_to_list_def)\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   apply(rename_tac e1 e2 w wa epdaS_conf_schedulera epdaS_conf_schedulerb)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesOK)\n    apply(blast)\n   apply(blast)\n  apply(rename_tac e1 e2 w wa epdaS_conf_schedulera epdaS_conf_schedulerb)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in ballE)\n   apply(rename_tac e1 e2 w wa epdaS_conf_schedulera epdaS_conf_schedulerb)(*strict*)\n   prefer 2\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac e1 e2 w wa epdaS_conf_schedulera epdaS_conf_schedulerb)(*strict*)\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   apply(rename_tac e1 e2 w wa epdaS_conf_schedulera epdaS_conf_schedulerb)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesOK)\n    apply(blast)\n   apply(blast)\n  apply(rename_tac e1 e2 w wa epdaS_conf_schedulera epdaS_conf_schedulerb)(*strict*)\n  apply(erule_tac\n      x=\"e2\"\n      in ballE)\n   apply(rename_tac e1 e2 w wa epdaS_conf_schedulera epdaS_conf_schedulerb)(*strict*)\n   prefer 2\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac e1 e2 w wa epdaS_conf_schedulera epdaS_conf_schedulerb)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac e1 e2 w epdaS_conf_schedulerb ya)(*strict*)\n  apply(subgoal_tac \"\\<forall>x1 x2. x1 \\<in> (snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})) \\<and> x2 \\<in> (snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})) \\<and> (x1\\<lparr>edge_trg:=edge_trg x2\\<rparr>)=x2 \\<longrightarrow> x1=x2\")\n   apply(rename_tac e1 e2 w epdaS_conf_schedulerb ya)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesDiffer)\n    apply(blast)\n   apply(blast)\n  apply(rename_tac e1 e2 w epdaS_conf_schedulerb ya)(*strict*)\n  apply(erule_tac\n      x=\"e1\"\n      in allE)\n  apply(erule_tac\n      x=\"e2\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac e1 e2 w epdaS_conf_schedulerb ya)(*strict*)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac e1 e2 w epdaS_conf_schedulerb ya)(*strict*)\n  apply(clarsimp)\n  done\n\ntheorem Theorem6__27_a: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dfa M\"\n  apply(simp add: valid_dfa_def)\n  apply(rule conjI)\n   apply(rule Theorem6__27_a3)\n     apply(blast)\n    apply(blast)\n   apply(blast)\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G) (cfg_events G))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesOK)\n    apply(blast)\n   apply(blast)\n  apply(clarsimp)\n  apply(rename_tac e)(*strict*)\n  apply(erule_tac\n      x=\"e\"\n      in ballE)\n   apply(rename_tac e)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e y)(*strict*)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac e)(*strict*)\n  apply(simp add: F_LR_MACHINE_def)\n  done\n\nlemma Theorem6__27_c: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> set \\<gamma> \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\n  \\<Longrightarrow> (\\<exists>d e qf. epdaS.derivation M d \\<and> maximum_of_domain d (length \\<gamma>) \\<and> d 0 = Some (pair None \\<lparr>epdaS_conf_state = epda_initial M, epdaS_conf_scheduler = \\<gamma>, epdaS_conf_stack = [epda_box M]\\<rparr>) \\<and> d (length \\<gamma>) = Some (pair e \\<lparr>epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = [epda_box M]\\<rparr>)) \\<longleftrightarrow> (q = valid_item_set G k \\<gamma>)\"\n  apply(clarsimp)\n  apply(rule aequI)\n   apply(clarsimp)\n   apply(rename_tac d e)(*strict*)\n   defer\n   apply(clarsimp)\n   apply(induct \\<gamma> rule: rev_induct)\n    apply(rule_tac\n      t=\"valid_item_set G k []\"\n      and s=\"F_VALID_ITEM_SET_GOTO__descent__fp G F k (F_VALID_ITEM_SET_INITIAL G F k)\"\n      in ssubst)\n     apply(simp add: Lemma6__23)\n    apply(simp add: F_VALID_ITEM_SET_INITIAL_def)\n    apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO__descent__fp G F k (F_VALID_ITEM_SET_GOTO__descent__fp G F k (F_VALID_ITEM_SET_INITIAL__fp_start G))\"\n      and s=\"F_VALID_ITEM_SET_GOTO__descent__fp G F k (F_VALID_ITEM_SET_INITIAL__fp_start G)\"\n      in ssubst)\n     apply(rule F_VALID_ITEM_SET_GOTO__descent__fp_idemp)\n     apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_valid_input_def)\n     apply(rule F_VALID_ITEM_SET_INITIAL__fp_start_contains_valid_item)\n    apply(rule_tac\n      x = \"der1 \\<lparr>epdaS_conf_state = F_VALID_ITEM_SET_GOTO__descent__fp G F k (F_VALID_ITEM_SET_INITIAL__fp_start G), epdaS_conf_scheduler = [], epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>\"\n      in exI)\n    apply(rule conjI)\n     apply(rule epdaS.der1_is_derivation)\n    apply(rule conjI)\n     apply(rule der1_maximum_of_domain)\n    apply(simp add: der1_def)\n    apply(simp add: F_LR_MACHINE_def)\n    apply(simp add: F_VALID_ITEM_SET_INITIAL_def)\n   apply(rename_tac x xs)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x xs d e)(*strict*)\n   apply(rename_tac a w d e)\n   apply(rename_tac a w d e)(*strict*)\n   apply(rule_tac\n      x = \"derivation_append (derivation_map d (\\<lambda>v. v\\<lparr>epdaS_conf_scheduler:= (epdaS_conf_scheduler v) @ [a]\\<rparr>)) (der2 \\<lparr>epdaS_conf_state = valid_item_set G k w, epdaS_conf_scheduler = [a], epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr> \\<lparr>edge_src=valid_item_set G k w, edge_event=Some a, edge_pop=[epda_box (F_LR_MACHINE G F k)], edge_push=[epda_box (F_LR_MACHINE G F k)], edge_trg=valid_item_set G k (w@[a])\\<rparr> \\<lparr>epdaS_conf_state = valid_item_set G k (w@[a]), epdaS_conf_scheduler = [], epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>) (length w)\"\n      in exI)\n   apply(rename_tac a w d e)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac a w d e)(*strict*)\n    apply(rule epdaS.derivation_concat2)\n       apply(rename_tac a w d e)(*strict*)\n       apply(rule epdaS.derivation_map_preserves_derivation2)\n        apply(rename_tac a w d e)(*strict*)\n        apply(blast)\n       apply(rename_tac a w d e)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac a w d e aa ea b)(*strict*)\n       apply(simp add: epdaS_step_relation_def)\n      apply(rename_tac a w d e)(*strict*)\n      apply(rule derivation_map_preserves_maximum_of_domain)\n      apply(blast)\n     apply(rename_tac a w d e)(*strict*)\n     apply(rule epdaS.der2_is_derivation)\n     apply(simp add: epdaS_step_relation_def)\n     apply(simp add: option_to_list_def)\n     apply(simp (no_asm) add: F_LR_MACHINE_def)\n     apply(rule_tac\n      t=\"0\"\n      and s=\"epda_box (F_LR_MACHINE G F k)\"\n      in ssubst)\n      apply(rename_tac a w d e)(*strict*)\n      apply(simp add: F_LR_MACHINE_def)\n     apply(rename_tac a w d e)(*strict*)\n     apply(rule F_LR_MACHINE_all_insert_edge_valid_item_set)\n         apply(rename_tac a w d e)(*strict*)\n         apply(force)\n        apply(force)\n       apply(rename_tac a w d e)(*strict*)\n       apply(force)\n      apply(rename_tac a w d e)(*strict*)\n      apply(subgoal_tac \"set (w@[a]) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n       apply(rename_tac a w d e)(*strict*)\n       apply(rule two_elements_construct_domain_setA)\n       apply(force)\n      apply(rename_tac a w d e)(*strict*)\n      apply(rule two_elements_construct_domain_append)\n       apply(rename_tac a w d e)(*strict*)\n       apply(force)\n      apply(rename_tac a w d e)(*strict*)\n      apply(force)\n     apply(rename_tac a w d e)(*strict*)\n     apply(subgoal_tac \"set (w@[a]) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n      apply(rename_tac a w d e)(*strict*)\n      apply(rule two_elements_construct_domain_setB)\n      apply(force)\n     apply(rename_tac a w d e)(*strict*)\n     apply(rule two_elements_construct_domain_append)\n      apply(rename_tac a w d e)(*strict*)\n      apply(force)\n     apply(rename_tac a w d e)(*strict*)\n     apply(force)\n    apply(rename_tac a w d e)(*strict*)\n    apply(simp add: derivation_map_def der2_def)\n   apply(rename_tac a w d e)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac a w d e)(*strict*)\n    apply(rule_tac\n      t=\"Suc (length w)\"\n      and s=\"length w+Suc 0\"\n      in ssubst)\n     apply(rename_tac a w d e)(*strict*)\n     apply(force)\n    apply(rename_tac a w d e)(*strict*)\n    apply(rule concat_has_max_dom)\n     apply(rename_tac a w d e)(*strict*)\n     apply(rule derivation_map_preserves_maximum_of_domain)\n     apply(blast)\n    apply(rename_tac a w d e)(*strict*)\n    apply(rule der2_maximum_of_domain)\n   apply(rename_tac a w d e)(*strict*)\n   apply(simp add: derivation_append_def)\n   apply(simp add: derivation_map_def der2_def)\n  apply(rename_tac d e)(*strict*)\n  apply(subgoal_tac \"\\<forall>n d e q \\<gamma>1 \\<gamma>2. epdaS.derivation (F_LR_MACHINE G F k) d \\<and> set \\<gamma>1 \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> n=length \\<gamma>1 \\<and> maximum_of_domain d n \\<and> d 0 = Some (pair None \\<lparr>epdaS_conf_state = epda_initial (F_LR_MACHINE G F k), epdaS_conf_scheduler = \\<gamma>1@\\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>) \\<and> d n = Some (pair e \\<lparr>epdaS_conf_state = q, epdaS_conf_scheduler = \\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>) \\<longrightarrow> q = valid_item_set G k \\<gamma>1\")\n   apply(rename_tac d e)(*strict*)\n   apply(erule_tac\n      x=\"length \\<gamma>\"\n      in allE)\n   apply(erule_tac\n      x=\"d\"\n      in allE)\n   apply(erule_tac\n      x=\"e\"\n      in allE)\n   apply(erule_tac\n      x=\"q\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<gamma>\"\n      in allE)\n   apply(erule_tac\n      x=\"[]\"\n      in allE)\n   apply(force)\n  apply(rename_tac d e)(*strict*)\n  apply(thin_tac \"epdaS.derivation (F_LR_MACHINE G F k) d\")\n  apply(thin_tac \"maximum_of_domain d (length \\<gamma>)\")\n  apply(thin_tac \"d 0 = Some (pair None \\<lparr>epdaS_conf_state = epda_initial (F_LR_MACHINE G F k), epdaS_conf_scheduler = \\<gamma>, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>)\")\n  apply(thin_tac \"d (length \\<gamma>) = Some (pair e \\<lparr>epdaS_conf_state = q, epdaS_conf_scheduler = [], epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>)\")\n  apply(thin_tac \"set \\<gamma> \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n  apply(rule allI)\n  apply(rename_tac d e n)(*strict*)\n  apply(induct_tac n)\n   apply(rename_tac d e n)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d \\<gamma>2)(*strict*)\n   apply(simp (no_asm) add: F_LR_MACHINE_def)\n   apply(rule_tac\n      t=\"valid_item_set G k []\"\n      and s=\"F_VALID_ITEM_SET_GOTO__descent__fp G F k (F_VALID_ITEM_SET_INITIAL G F k)\"\n      in ssubst)\n    apply(rename_tac d \\<gamma>2)(*strict*)\n    apply(simp add: Lemma6__23)\n   apply(rename_tac d \\<gamma>2)(*strict*)\n   apply(simp add: F_VALID_ITEM_SET_INITIAL_def)\n   apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO__descent__fp G F k (F_VALID_ITEM_SET_GOTO__descent__fp G F k (F_VALID_ITEM_SET_INITIAL__fp_start G))\"\n      and s=\"F_VALID_ITEM_SET_GOTO__descent__fp G F k (F_VALID_ITEM_SET_INITIAL__fp_start G)\"\n      in ssubst)\n    apply(rename_tac d \\<gamma>2)(*strict*)\n    apply(rule F_VALID_ITEM_SET_GOTO__descent__fp_idemp)\n    apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_valid_input_def)\n    apply(rule F_VALID_ITEM_SET_INITIAL__fp_start_contains_valid_item)\n   apply(rename_tac d \\<gamma>2)(*strict*)\n   apply(blast)\n  apply(rename_tac d e n na)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d e q \\<gamma>1 \\<gamma>2)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d na = Some (pair e c)\")\n   apply(rename_tac na d e q \\<gamma>1 \\<gamma>2)(*strict*)\n   prefer 2\n   apply(rule epdaS.some_position_has_details_before_max_dom)\n     apply(rename_tac na d e q \\<gamma>1 \\<gamma>2)(*strict*)\n     apply(blast)\n    apply(rename_tac na d e q \\<gamma>1 \\<gamma>2)(*strict*)\n    apply(blast)\n   apply(rename_tac na d e q \\<gamma>1 \\<gamma>2)(*strict*)\n   apply(arith)\n  apply(rename_tac na d e q \\<gamma>1 \\<gamma>2)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n  apply(subgoal_tac \"(epdaS_conf_scheduler c=drop na (epdaS_conf_scheduler \\<lparr>epdaS_conf_state = epda_initial (F_LR_MACHINE G F k), epdaS_conf_scheduler = \\<gamma>1@\\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>)) \\<and> (length (epdaS_conf_scheduler \\<lparr>epdaS_conf_state = epda_initial (F_LR_MACHINE G F k), epdaS_conf_scheduler = \\<gamma>1@\\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>) = na + (length (epdaS_conf_scheduler c)))\")\n   apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"F_LR_MACHINE G F k\"\n      in DFA_derivation_drops_stepwise)\n        apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n        apply(rule Theorem6__27_a)\n          apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n          apply(blast)\n         apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n         apply(blast)\n        apply(force)\n       apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n       apply(blast)\n      apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n      apply(blast)\n     apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n     apply(arith)\n    apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n    apply(blast)\n   apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n   apply(blast)\n  apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"length \\<gamma>1 = Suc na\")\n   apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n   prefer 2\n   apply(arith)\n  apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n  apply(subgoal_tac \" (epdaS_conf_scheduler \\<lparr>epdaS_conf_state = q, epdaS_conf_scheduler = \\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>=drop (Suc na) (epdaS_conf_scheduler \\<lparr>epdaS_conf_state = epda_initial (F_LR_MACHINE G F k), epdaS_conf_scheduler = \\<gamma>1@\\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>)) \\<and> (length (epdaS_conf_scheduler \\<lparr>epdaS_conf_state = epda_initial (F_LR_MACHINE G F k), epdaS_conf_scheduler = \\<gamma>1@\\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>) = (Suc na) + (length (epdaS_conf_scheduler \\<lparr>epdaS_conf_state = q, epdaS_conf_scheduler = \\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>)))\")\n   apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"F_LR_MACHINE G F k\"\n      in DFA_derivation_drops_stepwise)\n        apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n        apply(rule Theorem6__27_a)\n          apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n          apply(blast)\n         apply(force)\n        apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n        apply(blast)\n       apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n       apply(blast)\n      apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n      apply(blast)\n     apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n     apply(arith)\n    apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n    apply(force)\n   apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n   apply(force)\n  apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n  apply(subgoal_tac \"\\<exists>e c. d (Suc na) = Some (pair (Some e) c)\")\n   apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n   prefer 2\n   apply(rule epdaS.some_position_has_details_before_max_dom_after_0)\n     apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n     apply(blast)\n    apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n    apply(blast)\n   apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n   apply(arith)\n  apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac na d e q \\<gamma>1 \\<gamma>2 ea c eb ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n  apply(subgoal_tac \"epdaS_step_relation (F_LR_MACHINE G F k) c eb \\<lparr>epdaS_conf_state = q, epdaS_conf_scheduler = \\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>\")\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   prefer 2\n   apply(rule_tac\n      n=\"na\"\n      in epdaS.position_change_due_to_step_relation)\n     apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n     apply(blast)\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n    apply(blast)\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   apply(blast)\n  apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n  apply(subgoal_tac \"valid_dfa (F_LR_MACHINE G F k)\")\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   prefer 2\n   apply(rule Theorem6__27_a)\n     apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n     apply(blast)\n    apply(force)\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   apply(blast)\n  apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n  apply(subgoal_tac \"epdaS_conf_stack c=[epda_box (F_LR_MACHINE G F k)]\")\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   prefer 2\n   apply(simp add: valid_dfa_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"eb\"\n      in ballE)\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb y)(*strict*)\n    apply(simp add: epdaS_step_relation_def)\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   apply(simp add: epdaS_step_relation_def)\n  apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n  apply(erule_tac\n      x=\"derivation_take d na\"\n      in allE)\n  apply(erule_tac\n      x=\"ea\"\n      in allE)\n  apply(erule_tac\n      x=\"epdaS_conf_state c\"\n      in allE)\n  apply(erule_tac\n      x=\"take na \\<gamma>1\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n    apply(rule_tac epdaS.derivation_take_preserves_derivation)\n    apply(blast)\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   apply(subgoal_tac \"length \\<gamma>1 \\<ge> na\")\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n    prefer 2\n    apply(clarsimp)\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n    apply(rule_tac\n      B=\"set \\<gamma>1\"\n      in subset_trans)\n     apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n     apply(rule set_take_subset)\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n    apply(force)\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n    apply(force)\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n    apply(rule_tac\n      m=\"Suc 0\"\n      in epdaS.derivation_take_preserves_generates_maximum_of_domain)\n     apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n     apply(blast)\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   apply(rule_tac\n      x=\"drop na \\<gamma>1@\\<gamma>2\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n    apply(simp add: derivation_take_def)\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   apply(simp add: derivation_take_def)\n  apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n  apply(thin_tac \"epdaS.derivation (F_LR_MACHINE G F k) d\")\n  apply(thin_tac \"d 0 = Some (pair None \\<lparr>epdaS_conf_state = epda_initial (F_LR_MACHINE G F k), epdaS_conf_scheduler = \\<gamma>1 @ \\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>)\")\n  apply(thin_tac \"d (Suc na) = Some (pair (Some eb) \\<lparr>epdaS_conf_state = q, epdaS_conf_scheduler = \\<gamma>2, epdaS_conf_stack = [epda_box (F_LR_MACHINE G F k)]\\<rparr>)\")\n  apply(thin_tac \"d na = Some (pair ea c)\")\n  apply(thin_tac \"maximum_of_domain d (Suc na)\")\n  apply(subgoal_tac \"eb=\\<lparr>edge_src=valid_item_set G k (take na \\<gamma>1), edge_event=Some (last (drop na \\<gamma>1)), edge_pop=[epda_box (F_LR_MACHINE G F k)], edge_push=[epda_box (F_LR_MACHINE G F k)], edge_trg=q\\<rparr>\")\n   apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n   prefer 2\n   apply(simp add: valid_dfa_def)\n   apply(rename_tac na q \\<gamma>1 \\<gamma>2 c eb)(*strict*)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"eb\"\n      in ballE)\n    apply(rename_tac na q \\<gamma>1 \\<gamma>2 c eb)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac na q \\<gamma>1 \\<gamma>2 c eb y)(*strict*)\n    apply(simp add: epdaS_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac na \\<gamma>1 \\<gamma>2 c eb y)(*strict*)\n    apply(case_tac eb)\n    apply(rename_tac na \\<gamma>1 \\<gamma>2 c eb y edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac na \\<gamma>1 \\<gamma>2 c y edge_trg)(*strict*)\n    apply(simp add: option_to_list_def)\n    apply (metis take_last2)\n   apply(rename_tac na q \\<gamma>1 \\<gamma>2 c eb)(*strict*)\n   apply(simp add: epdaS_step_relation_def)\n  apply(rename_tac na d q \\<gamma>1 \\<gamma>2 ea c eb)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n  apply(simp add: epdaS_step_relation_def)\n  apply(clarsimp)\n  apply(simp add: option_to_list_def)\n  apply(subgoal_tac \"\\<forall>x1 x2. x1 \\<in> (snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})) \\<and> x2 \\<in> (snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})) \\<and> (x1\\<lparr>edge_trg:=edge_trg x2\\<rparr>)=x2 \\<longrightarrow> x1=x2\")\n   apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesDiffer)\n    apply(blast)\n   apply(force)\n  apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n  apply(erule_tac\n      x=\"\\<lparr>edge_src = valid_item_set G k (take na \\<gamma>1), edge_event = Some (last \\<gamma>1), edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = q\\<rparr>\"\n      in allE)\n  apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n  apply(erule_tac\n      x=\"\\<lparr>edge_src = valid_item_set G k (take na \\<gamma>1), edge_event = Some (last \\<gamma>1), edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = valid_item_set G k ((take na \\<gamma>1) @ [last \\<gamma>1])\\<rparr>\"\n      in allE)\n  apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n  apply(erule impE)\n   apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n    apply(simp add: F_LR_MACHINE_def)\n   apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n    apply(rule F_LR_MACHINE_all_insert_edge_valid_item_set)\n        apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n        apply(force)\n       apply(force)\n      apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n      apply(force)\n     apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n     apply(rule_tac\n      t=\"take na \\<gamma>1 @ [last \\<gamma>1]\"\n      and s=\"\\<gamma>1\"\n      in ssubst)\n      apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n      apply(rule_tac\n      t=\"[last \\<gamma>1]\"\n      and s=\"drop na \\<gamma>1\"\n      in ssubst)\n       apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n       apply(force)\n      apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n      apply(rule append_take_drop_id)\n     apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n     apply(rule two_elements_construct_domain_setA)\n     apply(force)\n    apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n    apply(rule_tac\n      t=\"take na \\<gamma>1 @ [last \\<gamma>1]\"\n      and s=\"\\<gamma>1\"\n      in ssubst)\n     apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n     apply(rule_tac\n      t=\"[last \\<gamma>1]\"\n      and s=\"drop na \\<gamma>1\"\n      in ssubst)\n      apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n      apply(force)\n     apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n     apply(rule append_take_drop_id)\n    apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(force)\n   apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n   apply(force)\n  apply(rename_tac na q \\<gamma>1 \\<gamma>2 c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na \\<gamma>1 \\<gamma>2 c)(*strict*)\n  apply(subgoal_tac \"take na \\<gamma>1 @ [last \\<gamma>1]=\\<gamma>1\")\n   apply(rename_tac na \\<gamma>1 \\<gamma>2 c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac na \\<gamma>1 \\<gamma>2 c)(*strict*)\n  apply(rule take_last)\n  apply(blast)\n  done\n\ntheorem F_LR_MACHINE_all_epdaS_accessible_states: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> q \\<in> epdaS_accessible_states M\"\n  apply(simp add: epdaS_accessible_states_def)\n  apply(subgoal_tac \"\\<exists>w. q=valid_item_set G k w \\<and> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n   prefer 2\n   apply(subgoal_tac \"epda_states M = {valid_item_set G k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)}\")\n    prefer 2\n    apply(rule LRM_contains_theEqClasses)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(erule exE)+\n  apply(rename_tac w)(*strict*)\n  apply(erule conjE)+\n  apply(subgoal_tac \"(\\<exists>d e qf. epdaS.derivation M d \\<and> maximum_of_domain d (length w) \\<and> d 0 = Some (pair None \\<lparr>epdaS_conf_state=epda_initial M, epdaS_conf_scheduler=w, epdaS_conf_stack=[epda_box M]\\<rparr>) \\<and> d (length w) = Some (pair e \\<lparr>epdaS_conf_state=q, epdaS_conf_scheduler=[], epdaS_conf_stack=[epda_box M]\\<rparr>)) \\<longleftrightarrow> (q=valid_item_set G k w)\")\n   apply(rename_tac w)(*strict*)\n   prefer 2\n   apply(rule Theorem6__27_c)\n      apply(rename_tac w)(*strict*)\n      apply(force)\n     apply(rename_tac w)(*strict*)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rename_tac w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac w d e)(*strict*)\n  apply(rule_tac\n      x=\"d\"\n      in exI)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac w d e)(*strict*)\n   apply(rule_tac\n      x=\"length w\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac w d e)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(simp add: epdaS_initial_configurations_def)\n  apply(simp add: epdaS_configurations_def)\n  apply(rule conjI)\n   apply(rename_tac w d e)(*strict*)\n   apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n  apply(rename_tac w d e)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac w d e)(*strict*)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac w d e)(*strict*)\n  apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n  done\n\ntheorem F_LR_MACHINE_all_epdaS_accessible_states2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> all_states_accessible M\"\n  apply(simp add: all_states_accessible_def)\n  apply(clarsimp)\n  apply(rule F_LR_MACHINE_all_epdaS_accessible_states)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(rule Theorem6__27_a)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma Theorem6__27_e: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> S = {q. \\<exists>\\<gamma>. q = valid_item_set G k \\<gamma> \\<and> q \\<noteq> {}}\\<inter> (epda_states M)\n  \\<Longrightarrow> (epdaS.marked_language (M\\<lparr>epda_marking := S\\<rparr>)) = Collect (\\<lambda>x. viable_prefix G x)\"\n  oops\n\nlemma Theorem6__27_f: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> (epdaS.marked_language (M\\<lparr>epda_marking := epda_states M\\<rparr>)) = {w. setA w \\<subseteq> cfg_nonterminals G \\<and> setB w \\<subseteq> cfg_events G}\"\n  oops\n\nlemma F_LR_MACHINE_all_Connected: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> every_state_in_some_accessible_configuration M\"\n  apply(rule DFA_Connected_from_ConnectedEx)\n   apply(force)\n  apply(simp add: every_state_in_some_accessible_configurationEx_def)\n  apply(rule ballI)\n  apply(rename_tac q)(*strict*)\n  apply(subgoal_tac \"q \\<in> epdaS_accessible_states M\")\n   apply(rename_tac q)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_all_epdaS_accessible_states)\n       apply(rename_tac q)(*strict*)\n       apply(force)\n      apply(rename_tac q)(*strict*)\n      apply(force)\n     apply(rename_tac q)(*strict*)\n     apply(force)\n    apply(rename_tac q)(*strict*)\n    apply(force)\n   apply(rename_tac q)(*strict*)\n   apply(clarsimp)\n  apply(simp add: epdaS.get_accessible_configurations_def epdaS_accessible_states_def)\n  apply(clarsimp)\n  apply(rename_tac q d n)(*strict*)\n  apply(case_tac \"d n\")\n   apply(rename_tac q d n)(*strict*)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac q d n a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"d 0\")\n   apply(rename_tac q d n a)(*strict*)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac q d n a aa)(*strict*)\n  apply(clarsimp)\n  apply(simp add: get_configuration_def)\n  apply(case_tac a)\n  apply(rename_tac q d n a aa option b)(*strict*)\n  apply(case_tac aa)\n  apply(rename_tac q d n a aa option b optiona ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d n option b optiona ba)(*strict*)\n  apply(rule_tac\n      x=\"epdaS_conf_scheduler b\"\n      in exI)\n  apply(subgoal_tac \"b \\<in> epdaS_configurations (F_LR_MACHINE G F k)\")\n   apply(rename_tac d n option b optiona ba)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d n option b optiona ba)(*strict*)\n    apply(simp add: epdaS_configurations_def)\n    apply(force)\n   apply(rename_tac d n option b optiona ba)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d n option b optiona ba)(*strict*)\n    apply(simp add: epdaS.derivation_initial_def)\n    apply(simp add: epdaS.derivation_def)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n    apply(case_tac \"optiona\")\n     apply(rename_tac d n option b optiona ba)(*strict*)\n     apply(force)\n    apply(rename_tac d n option b optiona ba a)(*strict*)\n    apply(force)\n   apply(rename_tac d n option b optiona ba)(*strict*)\n   apply(rule_tac\n      x=\"n\"\n      in exI)\n   apply(clarsimp)\n   apply(subgoal_tac \"epdaS_conf_stack b = [epda_box (F_LR_MACHINE G F k)]\")\n    apply(rename_tac d n option b optiona ba)(*strict*)\n    apply(force)\n   apply(rename_tac d n option b optiona ba)(*strict*)\n   apply(rule_tac\n      d=\"d\"\n      in DFA_always_box_stack)\n     apply(rename_tac d n option b optiona ba)(*strict*)\n     apply(force)\n    apply(rename_tac d n option b optiona ba)(*strict*)\n    apply(simp add: epdaS.derivation_initial_def)\n    apply(simp add: epdaS.derivation_def)\n    apply(erule_tac\n      x=\"0\"\n      in allE)\n    apply(clarsimp)\n    apply(case_tac \"optiona\")\n     apply(rename_tac d n option b optiona ba)(*strict*)\n     apply(force)\n    apply(rename_tac d n option b optiona ba a)(*strict*)\n    apply(force)\n   apply(rename_tac d n option b optiona ba)(*strict*)\n   apply(force)\n  apply(rename_tac d n option b optiona ba)(*strict*)\n  apply(rule_tac\n      d=\"d\"\n      in epdaS.belongs_configurations)\n   apply(rename_tac d n option b optiona ba)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac d n option b optiona ba)(*strict*)\n  apply(rule epdaS.derivation_initial_belongs)\n   apply(rename_tac d n option b optiona ba)(*strict*)\n   apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n  apply(rename_tac d n option b optiona ba)(*strict*)\n  apply(rule epdaS.derivation_initialI)\n   apply(rename_tac d n option b optiona ba)(*strict*)\n   apply(force)\n  apply(rename_tac d n option b optiona ba)(*strict*)\n  apply(simp add: get_configuration_def)\n  done\n\ntheorem F_VALID_ITEM_SET_GOTO_vs_F_DFA_GOTO_in_F_LR_MACHINE: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> valid_dfa (F_LR_MACHINE G F k)\n  \\<Longrightarrow> some_step_from_every_configuration (F_LR_MACHINE G F k)\n  \\<Longrightarrow> x' \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\n  \\<Longrightarrow> p \\<in> epda_states (F_LR_MACHINE G F k)\n  \\<Longrightarrow> F_VALID_ITEM_SET_GOTO G F k x' p = F_DFA_GOTO (F_LR_MACHINE G F k) p x'\"\n  apply(rule equalsFUNF_DFA_GOTO)\n       apply(force)\n      apply(force)\n     apply(rule F_LR_MACHINE_all_Connected)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(subgoal_tac \"\\<lparr>edge_src = p, edge_event = Some x', edge_pop = [epda_box (F_LR_MACHINE G F k)], edge_push = [epda_box (F_LR_MACHINE G F k)], edge_trg = F_VALID_ITEM_SET_GOTO G F k x' p\\<rparr> \\<in> snd (F_LR_MACHINE__fp_one G F k {} {} {F_VALID_ITEM_SET_INITIAL G F k})\")\n   prefer 2\n   apply(rule F_LR_MACHINE_complete)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(simp add: F_LR_MACHINE_def)\n  done\n\nlemma F_LR_MACHINE_goes_to_F_VALID_ITEM_SET_GOTO: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> X \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> e = \\<lparr>edge_src = q, edge_event = Some X, edge_pop = [0], edge_push = [0], edge_trg = q'\\<rparr>\n  \\<Longrightarrow> e \\<in> epda_delta M\n  \\<Longrightarrow> q' = F_VALID_ITEM_SET_GOTO G F k X q\"\n  apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO G F k X q\"\n      and s=\"F_DFA_GOTO (F_LR_MACHINE G F k) q X\"\n      in ssubst)\n   apply(rule F_VALID_ITEM_SET_GOTO_vs_F_DFA_GOTO_in_F_LR_MACHINE)\n        apply(force)+\n  apply(rule equalsFUNF_DFA_GOTO)\n       apply(blast)+\n     apply(rule F_LR_MACHINE_all_Connected)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(simp add: F_LR_MACHINE_def)\n  done\n\ntheorem F_LR_MACHINE_all_SOUND: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> setA w \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> valid_item_set G k w = (if w = [] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))\"\n  apply(rule_tac\n      t=\"valid_item_set G k w\"\n      and s=\"valid_item_set__recursive G F k w\"\n      in ssubst)\n   apply(rule valid_item_set_to_valid_item_set__recursive)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"setA w \\<subseteq> cfg_nonterminals G \\<and> setB w \\<subseteq> cfg_events G \\<longrightarrow> valid_item_set__recursive G F k w = (if w = [] then epda_initial M else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))\")\n   apply(force)\n  apply(thin_tac \"setA w \\<subseteq> cfg_nonterminals G\")\n  apply(thin_tac \"setB w \\<subseteq> cfg_events G\")\n  apply(induct w rule: length_induct)\n  apply(rename_tac xs)(*strict*)\n  apply(case_tac \"length xs\")\n   apply(rename_tac xs)(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac xs nat)(*strict*)\n  apply(rule impI)\n  apply(rename_tac w n)\n  apply(rename_tac w n)(*strict*)\n  apply(rule_tac\n      t=\"valid_item_set__recursive G F k w\"\n      and s=\"(case w of [] \\<Rightarrow> F_VALID_ITEM_SET_INITIAL G F k | y#w' \\<Rightarrow> F_VALID_ITEM_SET_GOTO G F k (last w) (valid_item_set__recursive G F k (butlast w)))\"\n      in ssubst)\n   apply(rename_tac w n)(*strict*)\n   apply(rule valid_item_set__recursive.simps)\n  apply(rename_tac w n)(*strict*)\n  apply(case_tac w)\n   apply(rename_tac w n)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac w n a list)(*strict*)\n  defer\n  apply(rule_tac\n      t=\"(case w of [] \\<Rightarrow> F_VALID_ITEM_SET_INITIAL G F k | y # w' \\<Rightarrow> F_VALID_ITEM_SET_GOTO G F k (last w) (valid_item_set__recursive G F k (butlast w)))\"\n      and s=\"F_VALID_ITEM_SET_GOTO G F k (last w) (valid_item_set__recursive G F k (butlast w))\"\n      in ssubst)\n   apply(rename_tac w n a list)(*strict*)\n   apply(force)\n  apply(rename_tac w n a list)(*strict*)\n  apply(rule_tac\n      t=\"(if w = [] then epda_initial M else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      in ssubst)\n   apply(rename_tac w n a list)(*strict*)\n   apply(force)\n  apply(rename_tac w n a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. w = w' @ [x']\")\n   apply(rename_tac w n a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac w n a list)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(erule_tac\n      x=\"w'\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(erule impE)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(erule impE)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(erule impE)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(erule impE)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(force)\n  apply(erule impE)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(erule impE)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(thin_tac \"w=a#list\")\n   apply(rule conjI)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(simp only: setAConcat concat_asso)\n    apply(blast)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(simp only: setBConcat concat_asso)\n   apply(blast)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(rule_tac\n      t=\"butlast w\"\n      and s=\"w'\"\n      in ssubst)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(rule_tac\n      t=\"last w\"\n      and s=\"x'\"\n      in ssubst)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(subgoal_tac \"epda_initial (F_LR_MACHINE G F k) \\<in> epda_states (F_LR_MACHINE G F k)\")\n   apply(rename_tac w n a list w' x')(*strict*)\n   prefer 2\n   apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(subgoal_tac \"set w' \\<subseteq> epda_events (F_LR_MACHINE G F k)\")\n   apply(rename_tac w n a list w' x')(*strict*)\n   prefer 2\n   apply(rule_tac\n      B=\"set w\"\n      in subset_trans)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(force)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(rule_tac\n      t=\"epda_events (F_LR_MACHINE G F k)\"\n      and s=\"two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\"\n      in ssubst)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(simp add: F_LR_MACHINE_def)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(force)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      and s=\" if w'=[] then F_DFA_GOTO M (epda_initial M) x' else F_DFA_GOTO M (last(F_DFA_GOTO_SEQUENCE M (epda_initial M) w')) x' \"\n      in ssubst)\n   apply(rename_tac w n a list w' x')(*strict*)\n   defer\n   apply(rule_tac\n      t=\"(valid_item_set__recursive G F k w')\"\n      and s=\"(if w' = [] then epda_initial M else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w'))\"\n      in ssubst)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(force)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(thin_tac \"w=a#list\")\n   apply(case_tac \"w'\")\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(clarsimp)\n    apply(rename_tac x')(*strict*)\n    apply(rule F_VALID_ITEM_SET_GOTO_vs_F_DFA_GOTO_in_F_LR_MACHINE)\n         apply(rename_tac x')(*strict*)\n         apply(force)\n        apply(force)\n       apply(rename_tac x')(*strict*)\n       apply(force)\n      apply(rename_tac x')(*strict*)\n      apply(force)\n     apply(rename_tac x')(*strict*)\n     apply(simp add: two_elements_construct_domain_def)\n     apply(case_tac x')\n      apply(rename_tac x' a)(*strict*)\n      apply(force)\n     apply(rename_tac x' b)(*strict*)\n     apply(force)\n    apply(rename_tac x')(*strict*)\n    apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n   apply(rename_tac w n a list w' x' aa lista)(*strict*)\n   apply(subgoal_tac \"F_VALID_ITEM_SET_GOTO G F k x' (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w')) = F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w')) x'\")\n    apply(rename_tac w n a list w' x' aa lista)(*strict*)\n    apply(force)\n   apply(rename_tac w n a list w' x' aa lista)(*strict*)\n   apply(subgoal_tac \"\\<exists>w'' x'. w' = w'' @ [x']\")\n    apply(rename_tac w n a list w' x' aa lista)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac w n a list w' x' aa lista)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n   apply(thin_tac \"w'=aa#lista\")\n   apply(rule_tac\n      t=\"M\"\n      and s=\"F_LR_MACHINE G F k\"\n      in ssubst)\n    apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n    apply(force)\n   apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n   apply(rule F_VALID_ITEM_SET_GOTO_vs_F_DFA_GOTO_in_F_LR_MACHINE)\n        apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n       apply(force)\n      apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n      apply(force)\n     apply(force)\n    apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n    apply(case_tac x')\n     apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal ab)(*strict*)\n     apply(simp add: two_elements_construct_domain_def)\n     apply(rename_tac w n w' x' w'' x'nonterminal ab)(*strict*)\n     apply(rule disjI1)\n     apply(clarsimp)\n     apply(rename_tac w'' x'nonterminal ab)(*strict*)\n     apply(simp only: setAConcat concat_asso)\n     apply(clarsimp)\n    apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal b)(*strict*)\n    apply(simp add: two_elements_construct_domain_def)\n    apply(rename_tac w n w' x' w'' x'nonterminal b)(*strict*)\n    apply(rule disjI2)\n    apply(clarsimp)\n    apply(rename_tac w'' x'nonterminal b)(*strict*)\n    apply(simp only: setBConcat concat_asso)\n    apply(clarsimp)\n   apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n   apply(rule_tac\n      A=\"set ((F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G F k) (epda_initial (F_LR_MACHINE G F k)) w'))\"\n      in set_mp)\n    apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n    apply(rule_tac\n      w=\"w'\"\n      and q=\"(epda_initial (F_LR_MACHINE G F k))\"\n      in F_DFA_GOTO_SEQUENCESound_main3)\n         apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n         apply(force)\n        apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n       apply(rule F_LR_MACHINE_all_Connected)\n          apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n          apply(force)\n         apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n         apply(force)\n        apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n       apply(force)\n      apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n      apply(force)\n     apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n   apply(rule last_in_set)\n   apply(subgoal_tac \"length w'=length (F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G F k) (epda_initial (F_LR_MACHINE G F k)) w')\")\n    apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n    apply(force)\n   apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n   apply(rule_tac\n      w=\"w'\"\n      and q=\"(epda_initial (F_LR_MACHINE G F k))\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n       apply(force)\n      apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n         apply(force)\n        apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n       apply(force)\n      apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n      apply(force)\n     apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n     apply(force)\n    apply(rename_tac w n a list w' x' aa lista w'' x'nonterminal)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(subgoal_tac \"x' \\<in> epda_events M\")\n   apply(rename_tac w n a list w' x')(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"epda_events M\"\n      and s=\"two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\"\n      in ssubst)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(simp add: F_LR_MACHINE_def)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(rule_tac\n      A=\"set [x']\"\n      in set_mp)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(thin_tac \"w=a#list\")\n    apply(case_tac x')\n     apply(rename_tac w n a list w' x' aa)(*strict*)\n     apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n      apply(rename_tac w n a list w' x' aa)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac w n a list w' x' aa)(*strict*)\n     apply(simp add: setAConcat concat_asso)\n    apply(rename_tac w n a list w' x' b)(*strict*)\n    apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n     apply(rename_tac w n a list w' x' b)(*strict*)\n     apply(simp only: setBConcat concat_asso)\n     apply(clarsimp)\n    apply(rename_tac w n a list w' x' b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x')(*strict*)\n  apply(case_tac \"w'\")\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) w\"\n      and s=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [x']\"\n      in ssubst)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(force)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [x']\"\n      and s=\"[F_DFA_GOTO M (epda_initial M) x']\"\n      in ssubst)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(rule DFA_F_DFA_GOTO_SEQUENCE_to_F_DFA_GOTO)\n        apply(rename_tac w n a list w' x')(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x')(*strict*)\n       apply(force)\n      apply(rename_tac w n a list w' x')(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac w n a list w' x')(*strict*)\n         apply(force)\n        apply(rename_tac w n a list w' x')(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x')(*strict*)\n       apply(force)\n      apply(rename_tac w n a list w' x')(*strict*)\n      apply(force)\n     apply(force)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(rule_tac\n      t=\"epda_events M\"\n      and s=\"two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\"\n      in ssubst)\n     apply(rename_tac w n a list w' x')(*strict*)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(rule_tac\n      A=\"set [a]\"\n      in set_mp)\n     apply(rename_tac w n a list w' x')(*strict*)\n     apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n      apply(rename_tac w n a list w' x')(*strict*)\n      apply(force)\n     apply(rename_tac w n a list w' x')(*strict*)\n     apply(force)\n    apply(rename_tac w n a list w' x')(*strict*)\n    apply(force)\n   apply(rename_tac w n a list w' x')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac w n a list w' x' aa lista)(*strict*)\n  apply(rule_tac\n      t=\"(if w' = [] then F_DFA_GOTO M (epda_initial M) x' else F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w')) x')\"\n      and s=\"F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w')) x'\"\n      in ssubst)\n   apply(rename_tac w n a list w' x' aa lista)(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x' aa lista)(*strict*)\n  apply(rule sym)\n  apply(rule_tac\n      t=\"F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w')) x'\"\n      and s=\"last [F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w')) x']\"\n      in ssubst)\n   apply(rename_tac w n a list w' x' aa lista)(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x' aa lista)(*strict*)\n  apply(rule_tac\n      t=\"[F_DFA_GOTO M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w')) x']\"\n      and s=\"F_DFA_GOTO_SEQUENCE M (last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w')) [x']\"\n      in ssubst)\n   apply(rename_tac w n a list w' x' aa lista)(*strict*)\n   apply(rule sym)\n   apply(rule DFA_F_DFA_GOTO_SEQUENCE_to_F_DFA_GOTO)\n       apply(rename_tac w n a list w' x' aa lista)(*strict*)\n       apply(force)\n      apply(rename_tac w n a list w' x' aa lista)(*strict*)\n      apply(force)\n     apply(rename_tac w n a list w' x' aa lista)(*strict*)\n     apply(rule F_LR_MACHINE_all_Connected)\n        apply(rename_tac w n a list w' x' aa lista)(*strict*)\n        apply(force)\n       apply(force)\n      apply(rename_tac w n a list w' x' aa lista)(*strict*)\n      apply(force)\n     apply(rename_tac w n a list w' x' aa lista)(*strict*)\n     apply(force)\n    apply(rename_tac w n a list w' x' aa lista)(*strict*)\n    apply(rule_tac\n      A=\"set ((F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G F k) (epda_initial (F_LR_MACHINE G F k)) w'))\"\n      in set_mp)\n     apply(rename_tac w n a list w' x' aa lista)(*strict*)\n     apply(rule_tac\n      w=\"w'\"\n      and q=\"(epda_initial (F_LR_MACHINE G F k))\"\n      in F_DFA_GOTO_SEQUENCESound_main3)\n          apply(rename_tac w n a list w' x' aa lista)(*strict*)\n          apply(force)\n         apply(rename_tac w n a list w' x' aa lista)(*strict*)\n         apply(force)\n        apply(rename_tac w n a list w' x' aa lista)(*strict*)\n        apply(rule F_LR_MACHINE_all_Connected)\n           apply(rename_tac w n a list w' x' aa lista)(*strict*)\n           apply(force)\n          apply(force)\n         apply(rename_tac w n a list w' x' aa lista)(*strict*)\n         apply(force)\n        apply(rename_tac w n a list w' x' aa lista)(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x' aa lista)(*strict*)\n       apply(force)\n      apply(rename_tac w n a list w' x' aa lista)(*strict*)\n      apply(force)\n     apply(rename_tac w n a list w' x' aa lista)(*strict*)\n     apply(force)\n    apply(rename_tac w n a list w' x' aa lista)(*strict*)\n    apply(rule_tac\n      t=\"M\"\n      and s=\"F_LR_MACHINE G F k\"\n      in ssubst)\n     apply(rename_tac w n a list w' x' aa lista)(*strict*)\n     apply(force)\n    apply(rename_tac w n a list w' x' aa lista)(*strict*)\n    apply(rule last_in_set)\n    apply(subgoal_tac \"length w'=length (F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G F k) (epda_initial (F_LR_MACHINE G F k)) w')\")\n     apply(rename_tac w n a list w' x' aa lista)(*strict*)\n     apply(force)\n    apply(rename_tac w n a list w' x' aa lista)(*strict*)\n    apply(rule_tac\n      w=\"w'\"\n      and q=\"(epda_initial (F_LR_MACHINE G F k))\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n         apply(rename_tac w n a list w' x' aa lista)(*strict*)\n         apply(force)\n        apply(rename_tac w n a list w' x' aa lista)(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x' aa lista)(*strict*)\n       apply(rule F_LR_MACHINE_all_Connected)\n          apply(rename_tac w n a list w' x' aa lista)(*strict*)\n          apply(force)\n         apply(force)\n        apply(rename_tac w n a list w' x' aa lista)(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x' aa lista)(*strict*)\n       apply(force)\n      apply(rename_tac w n a list w' x' aa lista)(*strict*)\n      apply(force)\n     apply(rename_tac w n a list w' x' aa lista)(*strict*)\n     apply(force)\n    apply(rename_tac w n a list w' x' aa lista)(*strict*)\n    apply(force)\n   apply(rename_tac w n a list w' x' aa lista)(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x' aa lista)(*strict*)\n  apply(rule_tac\n      t=\"w\"\n      and s=\"w'@[x']\"\n      in ssubst)\n   apply(rename_tac w n a list w' x' aa lista)(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x' aa lista)(*strict*)\n  apply(rule F_DFA_GOTO_SEQUENCE_concat)\n         apply(rename_tac w n a list w' x' aa lista)(*strict*)\n         apply(force)\n        apply(rename_tac w n a list w' x' aa lista)(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x' aa lista)(*strict*)\n       apply(rule F_LR_MACHINE_all_Connected)\n          apply(rename_tac w n a list w' x' aa lista)(*strict*)\n          apply(force)\n         apply(force)\n        apply(rename_tac w n a list w' x' aa lista)(*strict*)\n        apply(force)\n       apply(rename_tac w n a list w' x' aa lista)(*strict*)\n       apply(force)\n      apply(rename_tac w n a list w' x' aa lista)(*strict*)\n      apply(force)\n     apply(rename_tac w n a list w' x' aa lista)(*strict*)\n     apply(force)\n    apply(rename_tac w n a list w' x' aa lista)(*strict*)\n    apply(force)\n   apply(rename_tac w n a list w' x' aa lista)(*strict*)\n   apply(force)\n  apply(rename_tac w n a list w' x' aa lista)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_SOUND_Nil: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> setA w \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> w = []\n  \\<Longrightarrow> valid_item_set G k w = epda_initial M\"\n  apply(rule_tac\n      t=\"valid_item_set G k w\"\n      and s=\"(if w=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))\"\n      in ssubst)\n   apply(rule F_LR_MACHINE_all_SOUND)\n         apply(blast)+\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_SOUND_NotNil: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> setA w \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> w \\<noteq> []\n  \\<Longrightarrow> valid_item_set G k w = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n  apply(rule_tac\n      t=\"valid_item_set G k w\"\n      and s=\"(if w=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))\"\n      in ssubst)\n   apply(rule F_LR_MACHINE_all_SOUND)\n         apply(blast)+\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_SOUND_NotNil2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> setA w \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> w \\<noteq> []\n  \\<Longrightarrow> valid_item_set G k w = last (q # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n  apply(rule_tac\n      t=\"valid_item_set G k w\"\n      and s=\"(if w=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))\"\n      in ssubst)\n   apply(rule F_LR_MACHINE_all_SOUND)\n         apply(blast)+\n  apply(clarsimp)\n  apply(subgoal_tac \"length w=length (F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G F k) (epda_initial (F_LR_MACHINE G F k)) w)\")\n   prefer 2\n   apply(rule_tac\n      w=\"w\"\n      and q=\"(epda_initial (F_LR_MACHINE G F k))\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(force)\n       apply(force)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(simp add: F_LR_MACHINE_def)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(simp add: F_LR_MACHINE_def)\n    apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_insertion_implies_F_VALID_ITEM_SET_GOTO_to_target: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> e \\<in> epda_delta M\n  \\<Longrightarrow> \\<exists>q X. q \\<in> epda_states M \\<and> edge_trg e = F_VALID_ITEM_SET_GOTO G' F k X q\"\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G' F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k})\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesOK_prime)\n    apply(force)\n   apply(force)\n  apply(erule_tac\n      x=\"e\"\n      in ballE)\n   apply(rule_tac\n      x=\"edge_src e\"\n      in exI)\n   apply(erule conjE)+\n   apply(erule exE)+\n   apply(rename_tac y)(*strict*)\n   apply(erule conjE)+\n   apply(rule_tac\n      x=\"y\"\n      in exI)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(simp add: F_LR_MACHINE_def)\n  done\n\nlemma F_LR_MACHINE_target_not_initial: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> e \\<in> epda_delta M\n  \\<Longrightarrow> edge_trg e \\<noteq> epda_initial M\"\n  apply(subgoal_tac \"\\<exists>q X. q \\<in> epda_states M \\<and> edge_trg e = F_VALID_ITEM_SET_GOTO G' F k X q\")\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_insertion_implies_F_VALID_ITEM_SET_GOTO_to_target)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(erule exE)+\n  apply(rename_tac q X)(*strict*)\n  apply(rule_tac\n      t=\"edge_trg e\"\n      and s=\"F_VALID_ITEM_SET_GOTO G' F k X q\"\n      in ssubst)\n   apply(rename_tac q X)(*strict*)\n   apply(force)\n  apply(rename_tac q X)(*strict*)\n  apply(rule not_sym)\n  apply(rule_tac\n      t=\"epda_initial M\"\n      and s=\"F_VALID_ITEM_SET_INITIAL G' F k\"\n      in ssubst)\n   apply(rename_tac q X)(*strict*)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac q X)(*strict*)\n  apply(rule F_VALID_ITEM_SET_GOTO_does_not_reach_F_LR_MACHINE_initial)\n        apply(rename_tac q X)(*strict*)\n        apply(force)\n       apply(rename_tac q X)(*strict*)\n       apply(force)\n      apply(rename_tac q X)(*strict*)\n      apply(force)\n     apply(rename_tac q X)(*strict*)\n     apply(force)\n    apply(rename_tac q X)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac q X)(*strict*)\n  apply(subgoal_tac \"q \\<in> {valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\")\n   apply(rename_tac q X)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"{valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\"\n      and s=\"epda_states M\"\n      in ssubst)\n    apply(rename_tac q X)(*strict*)\n    apply(rule sym)\n    apply(rule LRM_contains_theEqClasses)\n      apply(rename_tac q X)(*strict*)\n      apply(force)\n     apply(rename_tac q X)(*strict*)\n     apply(force)\n    apply(rename_tac q X)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac q X)(*strict*)\n  apply(rule ballI)\n  apply(rename_tac q X I)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac X I w)(*strict*)\n  apply(rule_tac\n      \\<gamma>=\"w\"\n      in Fact6_12__2)\n   apply(rename_tac X I w)(*strict*)\n   apply(force)\n  apply(rename_tac X I w)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma State_With_Item_from_G_is_reached_via_Dollar_w: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> I \\<in> q\n  \\<Longrightarrow> cfg_item_lhs I \\<in> cfg_nonterminals G\n  \\<Longrightarrow> \\<exists>w. q = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # w)) \\<and> (set w \\<subseteq> epda_events M)\"\n  apply(subgoal_tac \"\\<exists>w. q=valid_item_set G' k w \\<and> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n   prefer 2\n   apply(subgoal_tac \"epda_states M = {valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\")\n    apply(force)\n   apply(rule LRM_contains_theEqClasses)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(erule exE)+\n  apply(rename_tac w)(*strict*)\n  apply(rule_tac\n      x=\"drop (Suc 0) w\"\n      in exI)\n  apply(erule conjE)+\n  apply(rule conjI)\n   apply(rename_tac w)(*strict*)\n   prefer 2\n   apply(rule_tac\n      B=\"set w\"\n      in subset_trans)\n    apply(rename_tac w)(*strict*)\n    apply(thin_tac \"q = valid_item_set G' k w\")\n    apply(thin_tac \"set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n    apply(induct_tac w)\n     apply(rename_tac w)(*strict*)\n     apply(force)\n    apply(rename_tac w a list)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac w)(*strict*)\n  apply(case_tac \"\\<exists>w'. w=[teB Do]@w'\")\n   apply(rename_tac w)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac w w')(*strict*)\n   apply(rule_tac\n      t=\"q\"\n      and s=\"valid_item_set G' k w\"\n      in ssubst)\n    apply(rename_tac w w')(*strict*)\n    apply(force)\n   apply(rename_tac w w')(*strict*)\n   apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # drop (Suc 0) w))\"\n      and s=\"(if w=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # drop (Suc 0) w)))\"\n      in ssubst)\n    apply(rename_tac w w')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac w w')(*strict*)\n   apply(rule_tac\n      t=\"teB Do # drop (Suc 0) w\"\n      and s=\"w\"\n      in ssubst)\n    apply(rename_tac w w')(*strict*)\n    apply(force)\n   apply(rename_tac w w')(*strict*)\n   apply(rule F_LR_MACHINE_all_SOUND)\n         apply(rename_tac w w')(*strict*)\n         apply(force)\n        apply(force)\n       apply(rename_tac w w')(*strict*)\n       apply(force)\n      apply(rename_tac w w')(*strict*)\n      apply(force)\n     apply(rename_tac w w')(*strict*)\n     apply(force)\n    apply(rename_tac w w')(*strict*)\n    apply(rule two_elements_construct_domain_setA)\n    apply(force)\n   apply(rename_tac w w')(*strict*)\n   apply(rule two_elements_construct_domain_setB)\n   apply(force)\n  apply(rename_tac w)(*strict*)\n  apply(case_tac w)\n   apply(rename_tac w)(*strict*)\n   apply(subgoal_tac \"False\")\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(subgoal_tac \"I\\<notin>valid_item_set G' k []\")\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(rule_tac\n      t=\"valid_item_set G' k []\"\n      and s=\"(if []=[] then F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_INITIAL G' F k) else F_VALID_ITEM_SET_GOTO__descent__fp G' F k (essential_items (valid_item_set G' k [])))\"\n      in ssubst)\n    apply(rename_tac w)(*strict*)\n    apply(rule Lemma6__23)\n       apply(rename_tac w)(*strict*)\n       apply(force)\n      apply(rename_tac w)(*strict*)\n      apply(force)\n     apply(rename_tac w)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(rule_tac\n      t=\"(if [] = [] then F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_INITIAL G' F k) else F_VALID_ITEM_SET_GOTO__descent__fp G' F k (essential_items (valid_item_set G' k [])))\"\n      and s=\"F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_INITIAL G' F k)\"\n      in ssubst)\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_INITIAL G' F k)\"\n      and s=\"(F_VALID_ITEM_SET_INITIAL G' F k)\"\n      in ssubst)\n    apply(rename_tac w)(*strict*)\n    apply(rule F_CFG_AUGMENT__F_VALID_ITEM_SET_INITIAL_F_VALID_ITEM_SET_GOTO__descent__fp)\n         apply(rename_tac w)(*strict*)\n         apply(force)\n        apply(rename_tac w)(*strict*)\n        apply(force)\n       apply(rename_tac w)(*strict*)\n       apply(force)\n      apply(rename_tac w)(*strict*)\n      apply(force)\n     apply(rename_tac w)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(rule_tac\n      t=\"F_VALID_ITEM_SET_INITIAL G' F k\"\n      and s=\"{\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[], cfg_item_rhs2=[teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\"\n      in ssubst)\n    apply(rename_tac w)(*strict*)\n    apply(rule F_CFG_AUGMENT__F_VALID_ITEM_SET_INITIAL)\n         apply(rename_tac w)(*strict*)\n         apply(force)\n        apply(rename_tac w)(*strict*)\n        apply(force)\n       apply(rename_tac w)(*strict*)\n       apply(force)\n      apply(rename_tac w)(*strict*)\n      apply(force)\n     apply(rename_tac w)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(subgoal_tac \"cfg_item_lhs I\\<noteq>S'\")\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(subgoal_tac \"S' \\<notin> cfg_nonterminals G\")\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(rule_tac\n      t=\"S'\"\n      and s=\"F_FRESH (cfg_nonterminals G)\"\n      in ssubst)\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: valid_cfg_def)\n  apply(rename_tac w a list)(*strict*)\n  apply(subgoal_tac \"I\\<notin>valid_item_set G' k (a#list)\")\n   apply(rename_tac w a list)(*strict*)\n   apply(force)\n  apply(rename_tac w a list)(*strict*)\n  apply(subgoal_tac \"a\\<noteq>teB Do\")\n   apply(rename_tac w a list)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac w a list)(*strict*)\n  apply(thin_tac \"\\<not> (\\<exists>w'. w = [teB Do] @ w')\")\n  apply(case_tac \"I \\<notin> valid_item_set G' k (a # list)\")\n   apply(rename_tac w a list)(*strict*)\n   apply(force)\n  apply(rename_tac w a list)(*strict*)\n  apply(subgoal_tac \"False\")\n   apply(rename_tac w a list)(*strict*)\n   apply(force)\n  apply(rename_tac w a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>n. I \\<in> valid_item_set_n G' k n w\")\n   apply(rename_tac w a list)(*strict*)\n   prefer 2\n   apply(simp only: valid_item_set_def)\n   apply(clarsimp)\n  apply(rename_tac w a list)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac w a list n)(*strict*)\n  apply(subgoal_tac \"\\<exists>A \\<alpha> \\<beta> y. I = \\<lparr>cfg_item_lhs = A, cfg_item_rhs1 = \\<alpha>, cfg_item_rhs2 = \\<beta>, cfg_item_look_ahead = y\\<rparr> \\<and> (\\<exists>d \\<delta> e1 e2 z. cfgRM.derivation G' d \\<and> d 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G')]\\<rparr>) \\<and> d n = Some (pair e1 \\<lparr>cfg_conf=\\<delta>@[teA A]@z\\<rparr>) \\<and> d (Suc n) = Some (pair e2 \\<lparr>cfg_conf=\\<delta>@\\<alpha>@\\<beta>@z\\<rparr>) \\<and> take k z=liftB y \\<and> w=\\<delta>@\\<alpha> \\<and> maximum_of_domain d (Suc n) \\<and> setA z = {})\")\n   apply(rename_tac w a list n)(*strict*)\n   prefer 2\n   apply(simp add: valid_item_set_n_def)\n  apply(rename_tac w a list n)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac w a list n A \\<alpha> \\<beta> y)(*strict*)\n  apply(erule conjE)+\n  apply(erule exE)+\n  apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n  apply(erule conjE)+\n  apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>)\")\n   apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   prefer 2\n   apply(rule F_CFG_AUGMENT__FirstStep)\n          apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n          apply(force)\n         apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n         apply(force)\n        apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n        apply(force)\n       apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n       apply(force)\n      apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n      apply(force)\n     apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(force)\n    apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(force)\n   apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   apply(blast)\n  apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n  apply(subgoal_tac \"\\<exists>e w. d (Suc n) = Some (pair e \\<lparr>cfg_conf = teB Do # w\\<rparr>)\")\n   apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      and m=\"Suc 0\"\n      and n=\"n\"\n      in terminal_at_beginning_are_never_modified)\n       apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n       apply(rule cfgRM_derivations_are_cfg_derivations)\n       apply(force)\n      apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n      apply(force)\n     apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(force)\n    apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(force)\n   apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   apply(force)\n  apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n  apply(subgoal_tac \"teB Do # wa\\<noteq>\\<delta> @ \\<alpha> @ \\<beta> @ z\")\n   apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n   apply(force)\n  apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n  apply(rule_tac\n      t=\"\\<delta> @ \\<alpha> @ \\<beta> @ z\"\n      and s=\"w @ \\<beta> @ z\"\n      in ssubst)\n   apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n   apply(force)\n  apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n  apply(rule_tac\n      t=\"w\"\n      and s=\"a#list\"\n      in ssubst)\n   apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n   apply(force)\n  apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n  apply(rule_tac\n      a=\"teB Do\"\n      and w=\"wa\"\n      and b=\"a\"\n      and v=\"list@\\<beta>@z\"\n      in unequal_by_first_char)\n    apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n    apply(blast)\n   apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n   apply(force)\n  apply(rename_tac w a list n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_States_contain_Items: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> I \\<in> q\n  \\<Longrightarrow> valid_item G k I\"\n  apply(subgoal_tac \"\\<exists>w. q=valid_item_set G k w \\<and> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n   prefer 2\n   apply(subgoal_tac \"epda_states M = {valid_item_set G k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)}\")\n    prefer 2\n    apply(rule LRM_contains_theEqClasses)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(erule exE)+\n  apply(rename_tac w)(*strict*)\n  apply(rule Fact6_12__2)\n   apply(rename_tac w)(*strict*)\n   apply(force)\n  apply(rename_tac w)(*strict*)\n  apply(force)\n  done\n\nlemma DollarTailStays: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> q \\<in> (epda_states M)\n  \\<Longrightarrow> \\<forall>I \\<in> q. (cfg_item_lhs I = S' \\<longrightarrow> cfg_item_look_ahead I = []) \\<and> (cfg_item_lhs I \\<noteq> S' \\<longrightarrow> ((cfg_item_look_ahead I) \\<in> ((kPrefix k) ` ({w @ [Do]|w. set w \\<subseteq> (cfg_events G)}))))\"\n  apply(rule_tac\n      M=\"M\"\n      and P=\"\\<lambda>q. \\<forall>I \\<in> q. (cfg_item_lhs I=S' \\<longrightarrow> cfg_item_look_ahead I = []) \\<and> (cfg_item_lhs I\\<noteq>S' \\<longrightarrow> ((cfg_item_look_ahead I) \\<in> ((kPrefix k) ` ({w@[Do]|w. set w \\<subseteq> (cfg_events G)})))) \"\n      in InductOverReachables)\n     apply(rule_tac\n      G=\"G'\"\n      and M=\"M\"\n      and k=\"k\"\n      in Theorem6__27_a1)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(rule_tac\n      t=\"epda_initial M\"\n      and s=\"F_VALID_ITEM_SET_INITIAL G' F k\"\n      in ssubst)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rule_tac\n      t=\"F_VALID_ITEM_SET_INITIAL G' F k\"\n      and s=\"{\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[], cfg_item_rhs2=[teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\"\n      in ssubst)\n     apply(rule F_CFG_AUGMENT__F_VALID_ITEM_SET_INITIAL)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(clarsimp)\n   apply(rule allI)+\n   apply(rename_tac p e qa cp cq)(*strict*)\n   apply(rule impI)+\n   apply(subgoal_tac \"p \\<in> epda_states M\")\n    apply(rename_tac p e qa cp cq)(*strict*)\n    prefer 2\n    apply(simp add: epdaS_accessible_states_def)\n   apply(rename_tac p e qa cp cq)(*strict*)\n   apply(subgoal_tac \"\\<exists>w. p=valid_item_set G' k w \\<and> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n    apply(rename_tac p e qa cp cq)(*strict*)\n    prefer 2\n    apply(subgoal_tac \"epda_states M = {valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\")\n     apply(rename_tac p e qa cp cq)(*strict*)\n     apply(force)\n    apply(rename_tac p e qa cp cq)(*strict*)\n    apply(rule LRM_contains_theEqClasses)\n      apply(rename_tac p e qa cp cq)(*strict*)\n      apply(force)\n     apply(force)\n    apply(rename_tac p e qa cp cq)(*strict*)\n    apply(force)\n   apply(rename_tac p e qa cp cq)(*strict*)\n   apply(erule exE)\n   apply(rename_tac p e qa cp cq w)(*strict*)\n   apply(erule conjE)+\n   apply(subgoal_tac \"valid_dfa M\")\n    apply(rename_tac p e qa cp cq w)(*strict*)\n    prefer 2\n    apply(rule_tac\n      G=\"G'\"\n      in Theorem6__27_a)\n      apply(rename_tac p e qa cp cq w)(*strict*)\n      apply(force)\n     apply(force)\n    apply(rename_tac p e qa cp cq w)(*strict*)\n    apply(force)\n   apply(rename_tac p e qa cp cq w)(*strict*)\n   apply(subgoal_tac \"\\<exists>a. e=\\<lparr>edge_src=p, edge_event=Some a, edge_pop=[0], edge_push=[0], edge_trg=qa\\<rparr>\")\n    apply(rename_tac p e qa cp cq w)(*strict*)\n    prefer 2\n    apply(case_tac e)\n    apply(rename_tac p e qa cp cq w edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac cp cq w edge_src edge_event edge_pop edge_push edge_trg)(*strict*)\n    apply(simp add: epdaS_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac cp cq w edge_event edge_pop edge_push wa)(*strict*)\n    apply(simp add: valid_dfa_def)\n    apply(rename_tac cp cq w edge_eventa edge_popa edge_pusha wa)(*strict*)\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"\\<lparr>edge_src = epdaS_conf_state cp, edge_event = edge_eventa, edge_pop = edge_popa, edge_push = edge_pusha, edge_trg = epdaS_conf_state cq\\<rparr>\"\n      in ballE)\n     apply(rename_tac cp cq w edge_eventa edge_popa edge_pusha wa)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac cp cq w wa y)(*strict*)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rename_tac cp cq w edge_event edge_pop edge_push wa)(*strict*)\n    apply(force)\n   apply(rename_tac p e qa cp cq w)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac p e qa cp cq w a)(*strict*)\n   apply(subgoal_tac \"qa=valid_item_set G' k (w@[a])\")\n    apply(rename_tac p e qa cp cq w a)(*strict*)\n    prefer 2\n    apply(subgoal_tac \"\\<forall>x1 x2. x1 \\<in> (snd(F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k})) \\<and> x2 \\<in> (snd(F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k})) \\<and> (x1\\<lparr>edge_trg:=edge_trg x2\\<rparr>)=x2 \\<longrightarrow> x1=x2\")\n     apply(rename_tac p e qa cp cq w a)(*strict*)\n     prefer 2\n     apply(rule F_LR_MACHINE_all_edgesDiffer)\n      apply(force)\n     apply(force)\n    apply(rename_tac p e qa cp cq w a)(*strict*)\n    apply(erule_tac\n      x=\"e\"\n      in allE)\n    apply(erule_tac\n      x=\"e\\<lparr>edge_trg:=valid_item_set G' k (w@[a])\\<rparr>\"\n      in allE)\n    apply(erule impE)\n     apply(rename_tac p e qa cp cq w a)(*strict*)\n     apply(rule conjI)\n      apply(rename_tac p e qa cp cq w a)(*strict*)\n      apply(simp add: F_LR_MACHINE_def epda_step_labels_def)\n     apply(rename_tac p e qa cp cq w a)(*strict*)\n     apply(rule conjI)\n      apply(rename_tac p e qa cp cq w a)(*strict*)\n      apply(subgoal_tac \"\\<lparr>edge_src = valid_item_set G' k w, edge_event = Some a, edge_pop = [epda_box (F_LR_MACHINE G' F k)], edge_push = [epda_box (F_LR_MACHINE G' F k)], edge_trg = valid_item_set G' k (w @ [a])\\<rparr> \\<in> snd(F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k})\")\n       apply(rename_tac p e qa cp cq w a)(*strict*)\n       prefer 2\n       apply(rule F_LR_MACHINE_all_insert_edge_valid_item_set)\n           apply(rename_tac p e qa cp cq w a)(*strict*)\n           apply(force)\n          apply(force)\n         apply(rename_tac p e qa cp cq w a)(*strict*)\n         apply(force)\n        apply(rename_tac p e qa cp cq w a)(*strict*)\n        apply(subgoal_tac \"set (w@[a]) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n         apply(rename_tac p e qa cp cq w a)(*strict*)\n         apply(rule two_elements_construct_domain_setA)\n         apply(force)\n        apply(rename_tac p e qa cp cq w a)(*strict*)\n        apply(rule two_elements_construct_domain_append)\n         apply(rename_tac p e qa cp cq w a)(*strict*)\n         apply(force)\n        apply(rename_tac p e qa cp cq w a)(*strict*)\n        apply(rule_tac\n      t=\"two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\"\n      and s=\"epda_events M\"\n      in ssubst)\n         apply(rename_tac p e qa cp cq w a)(*strict*)\n         apply(simp add: F_LR_MACHINE_def)\n        apply(rename_tac p e qa cp cq w a)(*strict*)\n        apply(rule epda_read_in_epda_events)\n          apply(rename_tac p e qa cp cq w a)(*strict*)\n          apply(rule_tac\n      G=\"G'\"\n      in Theorem6__27_a1)\n            apply(rename_tac p e qa cp cq w a)(*strict*)\n            apply(force)\n           apply(force)\n          apply(rename_tac p e qa cp cq w a)(*strict*)\n          apply(force)\n         apply(rename_tac p e qa cp cq w a)(*strict*)\n         apply(simp add: epda_step_labels_def)\n        apply(rename_tac p e qa cp cq w a)(*strict*)\n        apply(force)\n       apply(rename_tac p e qa cp cq w a)(*strict*)\n       apply(subgoal_tac \"set (w@[a]) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n        apply(rename_tac p e qa cp cq w a)(*strict*)\n        apply(rule two_elements_construct_domain_setB)\n        apply(force)\n       apply(rename_tac p e qa cp cq w a)(*strict*)\n       apply(rule two_elements_construct_domain_append)\n        apply(rename_tac p e qa cp cq w a)(*strict*)\n        apply(force)\n       apply(rename_tac p e qa cp cq w a)(*strict*)\n       apply(rule_tac\n      t=\"two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\"\n      and s=\"epda_events M\"\n      in ssubst)\n        apply(rename_tac p e qa cp cq w a)(*strict*)\n        apply(simp add: F_LR_MACHINE_def)\n       apply(rename_tac p e qa cp cq w a)(*strict*)\n       apply(rule epda_read_in_epda_events)\n         apply(rename_tac p e qa cp cq w a)(*strict*)\n         apply(rule_tac\n      G=\"G'\"\n      in Theorem6__27_a1)\n           apply(rename_tac p e qa cp cq w a)(*strict*)\n           apply(force)\n          apply(force)\n         apply(rename_tac p e qa cp cq w a)(*strict*)\n         apply(force)\n        apply(rename_tac p e qa cp cq w a)(*strict*)\n        apply(simp add: epda_step_labels_def)\n       apply(rename_tac p e qa cp cq w a)(*strict*)\n       apply(force)\n      apply(rename_tac p e qa cp cq w a)(*strict*)\n      apply(rule_tac\n      t=\"e\\<lparr>edge_trg := valid_item_set G' k (w @ [a])\\<rparr>\"\n      and s=\"\\<lparr>edge_src = valid_item_set G' k w, edge_event = Some a, edge_pop = [epda_box (F_LR_MACHINE G' F k)], edge_push = [epda_box (F_LR_MACHINE G' F k)], edge_trg = valid_item_set G' k (w @ [a])\\<rparr>\"\n      in ssubst)\n       apply(rename_tac p e qa cp cq w a)(*strict*)\n       apply(clarsimp)\n       apply(rename_tac cp cq w a)(*strict*)\n       apply(simp add: F_LR_MACHINE_def)\n      apply(rename_tac p e qa cp cq w a)(*strict*)\n      apply(force)\n     apply(rename_tac p e qa cp cq w a)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac p e qa cp cq w a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac p e qa cp cq w a)(*strict*)\n   apply(rule_tac\n      t=\"qa\"\n      and s=\"F_VALID_ITEM_SET_GOTO G' F k a (valid_item_set G' k w)\"\n      in ssubst)\n    apply(rename_tac p e qa cp cq w a)(*strict*)\n    apply(rule_tac\n      t=\"qa\"\n      and s=\"valid_item_set G' k (w @ [a])\"\n      in ssubst)\n     apply(rename_tac p e qa cp cq w a)(*strict*)\n     apply(force)\n    apply(rename_tac p e qa cp cq w a)(*strict*)\n    apply(subgoal_tac \"a \\<in> epda_events M\")\n     apply(rename_tac p e qa cp cq w a)(*strict*)\n     prefer 2\n     apply(simp only: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n     apply(erule conjE)+\n     apply(erule_tac\n      x=\"\\<lparr>edge_src = p, edge_event = Some a, edge_pop = [0], edge_push = [0], edge_trg = qa\\<rparr>\"\n      and P=\"\\<lambda>x. valid_epda_step_label (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k) x\"\n      in ballE)\n      apply(rename_tac p e qa cp cq w a)(*strict*)\n      apply(simp add: valid_epda_step_label_def option_to_set_def)\n     apply(rename_tac p e qa cp cq w a)(*strict*)\n     apply(simp add: epda_step_labels_def)\n    apply(rename_tac p e qa cp cq w a)(*strict*)\n    apply(rule Lemma6__26)\n       apply(rename_tac p e qa cp cq w a)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac p e qa cp cq w a)(*strict*)\n     apply(simp add: F_LR_MACHINE_def)\n     apply(rule two_elements_construct_domain_setA)\n     apply(force)\n    apply(rename_tac p e qa cp cq w a)(*strict*)\n    apply(simp add: F_LR_MACHINE_def)\n    apply(rule two_elements_construct_domain_setB)\n    apply(force)\n   apply(rename_tac p e qa cp cq w a)(*strict*)\n   apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO G' F k a (valid_item_set G' k w)\"\n      and s=\"F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_GOTO__basis a (valid_item_set G' k w))\"\n      in ssubst)\n    apply(rename_tac p e qa cp cq w a)(*strict*)\n    apply(simp add: F_VALID_ITEM_SET_GOTO_def)\n   apply(rename_tac p e qa cp cq w a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      in F_LR_MACHINE_all_epdaS_accessible_states)\n       apply(blast)+\n    apply(rule_tac\n      G=\"G'\"\n      in Theorem6__27_a)\n      apply(blast)\n     apply(force)\n    apply(blast)\n   apply(blast)\n  apply(rename_tac p e qa cp cq w a)(*strict*)\n  apply(subgoal_tac \"\\<forall>I \\<in> F_VALID_ITEM_SET_GOTO__basis a (valid_item_set G' k w). (cfg_item_lhs I = S' \\<longrightarrow> cfg_item_look_ahead I = []) \\<and> (cfg_item_lhs I \\<noteq> S' \\<longrightarrow> cfg_item_look_ahead I \\<in> kPrefix k ` {w @ [Do] |w. set w \\<subseteq> cfg_events G})\")\n   apply(rename_tac p e qa cp cq w a)(*strict*)\n   apply(rule ballI)\n   apply(rename_tac p e qa cp cq w a I)(*strict*)\n   apply(rule_tac\n      S=\"F_VALID_ITEM_SET_GOTO__basis a (valid_item_set G' k w)\"\n      in F_VALID_ITEM_SET_GOTO__descent__fp_new_is_from_old_G)\n            apply(rename_tac p e qa cp cq w a I)(*strict*)\n            apply(force)\n           apply(force)\n          apply(rename_tac p e qa cp cq w a I)(*strict*)\n          apply(force)\n         apply(rename_tac p e qa cp cq w a I)(*strict*)\n         apply(force)\n        apply(rename_tac p e qa cp cq w a I)(*strict*)\n        apply(force)\n       apply(rename_tac p e qa cp cq w a I)(*strict*)\n       apply(force)\n      apply(rename_tac p e qa cp cq w a I)(*strict*)\n      apply(force)\n     apply(rename_tac p e qa cp cq w a I)(*strict*)\n     apply(force)\n    apply(rename_tac p e qa cp cq w a I)(*strict*)\n    apply(force)\n   apply(rename_tac p e qa cp cq w a I)(*strict*)\n   apply(rule ballI)\n   apply(rename_tac p e qa cp cq w a I Ia)(*strict*)\n   apply(subgoal_tac \"F_VALID_ITEM_SET_GOTO__basis a p \\<subseteq> Collect(valid_item G' k)\")\n    apply(rename_tac p e qa cp cq w a I Ia)(*strict*)\n    apply(force)\n   apply(rename_tac p e qa cp cq w a I Ia)(*strict*)\n   apply(rule F_VALID_ITEM_SET_GOTO__basis_preserves_item_set)\n   apply(clarsimp)\n   apply(rename_tac cp cq w a I Ia x)(*strict*)\n   apply(rule Fact6_12__2)\n    apply(rename_tac cp cq w a I Ia x)(*strict*)\n    apply(force)\n   apply(rename_tac cp cq w a I Ia x)(*strict*)\n   apply(force)\n  apply(rename_tac p e qa cp cq w a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac cp cq w a I)(*strict*)\n  apply(simp add: F_VALID_ITEM_SET_GOTO__basis_def)\n  apply(clarsimp)\n  apply(rename_tac cp cq w a I I1)(*strict*)\n  apply(simp add: F_VALID_ITEM_SET_GOTO__passes_def)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"I1\"\n      in ballE)\n   apply(rename_tac cp cq w a I I1)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac cp cq w a I I1)(*strict*)\n  apply(force)\n  done\n\nlemma LRM_contains_theEqClasses_prime: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> \\<exists>w. q = valid_item_set G k w\"\n  apply(subgoal_tac \"epda_states M = {valid_item_set G k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)}\")\n   prefer 2\n   apply(rule LRM_contains_theEqClasses)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_item_in_state_rhs2_in_cfg_events: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> I \\<in> q\n  \\<Longrightarrow> set (cfg_item_rhs2 I) \\<subseteq> epda_events M\"\n  apply(subgoal_tac \"\\<exists>w. q=valid_item_set G k w\")\n   prefer 2\n   apply(rule LRM_contains_theEqClasses_prime)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(erule exE)+\n  apply(rename_tac w)(*strict*)\n  apply(subgoal_tac \"valid_item G k I\")\n   apply(rename_tac w)(*strict*)\n   prefer 2\n   apply(rule Fact6_12__2)\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(force)\n  apply(rename_tac w)(*strict*)\n  apply(simp add: valid_item_def)\n  apply(erule conjE)+\n  apply(erule bexE)+\n  apply(rename_tac w p)(*strict*)\n  apply(erule conjE)+\n  apply(simp add: valid_cfg_def)\n  apply(erule conjE)+\n  apply(erule_tac\n      x=\"p\"\n      in ballE)\n   apply(rename_tac w p)(*strict*)\n   apply(simp add: F_LR_MACHINE_def)\n   apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n    apply(rename_tac w p)(*strict*)\n    apply(simp add: setBConcat concat_asso)\n   apply(rename_tac w p)(*strict*)\n   apply(simp add: setAConcat concat_asso)\n  apply(rename_tac w p)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_item_in_state_lhs_in_cfg_events: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> \\<lparr>prod_lhs = cfg_item_lhs I, prod_rhs = cfg_item_rhs1 I @ cfg_item_rhs2 I\\<rparr> \\<in> cfg_productions G\n  \\<Longrightarrow> teA (cfg_item_lhs I) \\<in> epda_events M\"\n  apply(subgoal_tac \"set [teA (cfg_item_lhs I)] \\<subseteq> epda_events M\")\n   prefer 2\n   apply(rule_tac\n      B=\"two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\"\n      in subset_trans)\n    apply(simp only: valid_cfg_def)\n    apply(erule conjE)+\n    apply(erule_tac\n      x=\"\\<lparr>prod_lhs = cfg_item_lhs I, prod_rhs = cfg_item_rhs1 I @ cfg_item_rhs2 I\\<rparr>\"\n      in ballE)\n     apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n      apply(clarsimp)\n     apply(clarsimp)\n    apply(force)\n   apply(rule_tac\n      B=\"two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\"\n      in subset_trans)\n    apply(simp add: two_elements_construct_domain_def F_CFG_AUGMENT_def)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(force)\n  done\n\ntheorem F_LR_MACHINE_has_finite_states: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> finite q\"\n  apply(rule_tac\n      B = \"Collect (valid_item G k)\"\n      in finite_subset)\n   prefer 2\n   apply(rule finite_ItemSet)\n   apply(force)\n  apply(subgoal_tac \"\\<exists>w. q=valid_item_set G k w \\<and> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n   prefer 2\n   apply(subgoal_tac \"epda_states M = {valid_item_set G k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)}\")\n    apply(force)\n   apply(rule LRM_contains_theEqClasses)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(erule exE)\n  apply(rename_tac w)(*strict*)\n  apply(erule conjE)+\n  apply(rule subsetI)\n  apply(rename_tac w x)(*strict*)\n  apply(subgoal_tac \"valid_item G k x\")\n   apply(rename_tac w x)(*strict*)\n   apply(force)\n  apply(rename_tac w x)(*strict*)\n  apply(rule Fact6_12__2)\n   apply(rename_tac w x)(*strict*)\n   apply(force)\n  apply(rename_tac w x)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_prefix_closureise_additionalItems_0: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> v = [teB Do, teA (cfg_initial G), teB Do]\n  \\<Longrightarrow> w = []\n  \\<Longrightarrow> (last ((epda_initial M) # (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))) = {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = w, cfg_item_rhs2 = v, cfg_item_look_ahead = []\\<rparr>}\"\n  apply(subgoal_tac \"epda_initial (F_LR_MACHINE G' F k) \\<in> epda_states (F_LR_MACHINE G' F k)\")\n   prefer 2\n   apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n  apply(rule_tac\n      t=\"v\"\n      and s=\"[teB Do, teA (cfg_initial G), teB Do]\"\n      in ssubst)\n   apply(force)\n  apply(rule_tac\n      t=\"w\"\n      and s=\"[]\"\n      in ssubst)\n   apply(force)\n  apply(thin_tac \"v = [teB Do, teA (cfg_initial G), teB Do]\")\n  apply(thin_tac \"w = []\")\n  apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [])\"\n      and s=\"F_VALID_ITEM_SET_INITIAL G' F k\"\n      in ssubst)\n   prefer 2\n   apply(rule F_CFG_AUGMENT__F_VALID_ITEM_SET_INITIAL)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) []\"\n      and s=\"[]\"\n      in ssubst)\n   apply(subgoal_tac \"length [] = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [])\")\n    prefer 2\n    apply(rule_tac\n      w=\"[]\"\n      and q=\"(epda_initial (F_LR_MACHINE G' F k))\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n         apply(force)\n        apply(force)\n       apply(rule F_LR_MACHINE_all_Connected)\n          prefer 3\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule_tac\n      t=\"last [epda_initial M]\"\n      and s=\"epda_initial M\"\n      in ssubst)\n   apply(force)\n  apply(simp add: F_LR_MACHINE_def)\n  done\n\nlemma F_LR_MACHINE_prefix_closureise_additionalItems_1: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> v = [teA (cfg_initial G), teB Do]\n  \\<Longrightarrow> w = [teB Do]\n  \\<Longrightarrow> (last ((epda_initial M) # (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))) -{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} = {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = w, cfg_item_rhs2 = v, cfg_item_look_ahead = []\\<rparr>}\"\n  apply(rule_tac\n      t=\"w\"\n      and s=\"[teB Do]\"\n      in ssubst)\n   apply(force)\n  apply(rule_tac\n      t=\"v\"\n      and s=\"[teA (cfg_initial G), teB Do]\"\n      in ssubst)\n   apply(force)\n  apply(thin_tac \"w = [teB Do]\")\n  apply(thin_tac \"v = [teA (cfg_initial G), teB Do]\")\n  apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      and s=\"valid_item_set G' k [teB Do]\"\n      in ssubst)\n   apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      in ssubst)\n    apply(subgoal_tac \"length [teB Do]=length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\")\n     prefer 2\n     apply(rule_tac\n      w=\"[teB Do]\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n          apply(force)\n         apply(force)\n        apply(rule F_LR_MACHINE_all_Connected)\n           prefer 3\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n      apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def valid_cfg_def)\n     apply(force)\n    apply(force)\n   apply(rule sym)\n   apply(rule F_LR_MACHINE_all_SOUND_NotNil)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(simp add: F_CFG_AUGMENT_def)\n   apply(force)\n  apply(rule order_antisym)\n   apply(rule subsetI)\n   apply(rename_tac x)(*strict*)\n   apply(rename_tac I)\n   apply(rename_tac I)(*strict*)\n   apply(subgoal_tac \"valid_item G' k I\")\n    apply(rename_tac I)(*strict*)\n    apply(subgoal_tac \"\\<exists>n. I \\<in> valid_item_set_n G' k n [teB Do]\")\n     apply(rename_tac I)(*strict*)\n     prefer 2\n     apply(simp only: valid_item_set_def)\n     apply(clarsimp)\n    apply(rename_tac I)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac I n)(*strict*)\n    apply(subgoal_tac \"\\<exists>A \\<alpha> \\<beta> y. I = \\<lparr>cfg_item_lhs = A, cfg_item_rhs1 = \\<alpha>, cfg_item_rhs2 = \\<beta>, cfg_item_look_ahead = y\\<rparr> \\<and> (\\<exists>d \\<delta> e1 e2 z. cfgRM.derivation G' d \\<and> d 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G')]\\<rparr>) \\<and> d n = Some (pair e1 \\<lparr>cfg_conf=\\<delta>@[teA A]@z\\<rparr>) \\<and> d (Suc n) = Some (pair e2 \\<lparr>cfg_conf=\\<delta>@\\<alpha>@\\<beta>@z\\<rparr>) \\<and> take k z=liftB y \\<and> [teB Do]=\\<delta>@\\<alpha> \\<and> maximum_of_domain d (Suc n) \\<and> setA z = {})\")\n     apply(rename_tac I n)(*strict*)\n     prefer 2\n     apply(simp add: valid_item_set_n_def)\n    apply(rename_tac I n)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac I n A \\<alpha> \\<beta> y)(*strict*)\n    apply(erule conjE)+\n    apply(erule exE)+\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(erule conjE)+\n    apply(subgoal_tac \"I=\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do], cfg_item_rhs2 = [teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>)\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     prefer 2\n     apply(rule F_CFG_AUGMENT__FirstStep)\n            apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n            apply(force)\n           apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n           apply(force)\n          apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n          apply(force)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n        apply(force)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n       apply(rule cfgRM_derivations_are_cfg_derivations)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(blast)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(case_tac n)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> z)(*strict*)\n     apply(case_tac \\<delta>)\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> z)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac y d)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac y d)(*strict*)\n       apply(simp add: F_CFG_AUGMENT_def)\n      apply(rename_tac y d)(*strict*)\n      apply(rule liftB_reflects_Nil)\n      apply(force)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> z a list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n    apply(subgoal_tac \"\\<exists>e w. d (Suc nat) = Some (pair e \\<lparr>cfg_conf = teB Do # w\\<rparr>)\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n     prefer 2\n     apply(rule_tac\n      G=\"G'\"\n      and m=\"Suc 0\"\n      and n=\"Suc nat\"\n      in terminal_at_beginning_are_never_modified)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n         apply(rule cfgRM_derivations_are_cfg_derivations)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n        apply(force)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"setA (\\<delta> @ [teA A] @ z) \\<subseteq> cfg_nonterminals G\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(rule F_CFG_AUGMENT__later_at_old_grammar)\n            apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n            apply(force)\n           apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n           apply(force)\n          apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n          apply(force)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n        apply(force)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"False\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"A \\<in> cfg_nonterminals G\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(rule_tac\n      ?w1.0=\"\\<delta>\"\n      and ?w2.0=\"z\"\n      in suffixes_setA_2)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(rule suffixes_intro2)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"\\<lparr>prod_lhs=A, prod_rhs=\\<alpha>@\\<beta>\\<rparr> \\<in> cfg_productions G'\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(simp add: valid_item_def)\n     apply(clarsimp)\n     apply(rename_tac \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w p)(*strict*)\n     apply(case_tac p)\n     apply(rename_tac \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w p prod_lhsa prod_rhsa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(case_tac \"\\<lparr>prod_lhs=A, prod_rhs=\\<alpha>@\\<beta>\\<rparr> \\<in> cfg_productions G\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(subgoal_tac \"\\<lparr>prod_lhs = A, prod_rhs = \\<alpha> @ \\<beta>\\<rparr> = \\<lparr>prod_lhs=S', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>\")\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      prefer 2\n      apply(simp add: F_CFG_AUGMENT_def)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      prefer 2\n      apply(rule F_FRESH_is_fresh)\n      apply(simp add: valid_cfg_def)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"item_core I=\\<lparr>prod_lhs = A, prod_rhs = \\<alpha> @ \\<beta>\\<rparr>\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(simp add: item_core_def)\n   apply(rename_tac I)(*strict*)\n   apply(rule Fact6_12__2)\n    apply(rename_tac I)(*strict*)\n    apply(force)\n   apply(rename_tac I)(*strict*)\n   apply(force)\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do], cfg_item_rhs2 = [teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr> \\<in> valid_item_set G' k [teB Do]\")\n   prefer 2\n   apply(simp add: valid_item_set_def valid_item_set_n_def)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule_tac\n      x = \"der2 \\<lparr>cfg_conf = [teA (cfg_initial (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))))]\\<rparr> \\<lparr>prod_lhs=cfg_initial (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))), prod_rhs=[teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr> \\<lparr>cfg_conf = [teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr> \"\n      in exI)\n   apply(rule conjI)\n    apply(rule cfgRM.der2_is_derivation)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(rule conjI)\n     apply(simp add: F_CFG_AUGMENT_def)\n    apply(rule_tac\n      x=\"[]\"\n      in exI)\n    apply(rule_tac\n      x=\"[]\"\n      in exI)\n    apply(clarsimp)\n   apply(rule conjI)\n    apply(simp add: der2_def)\n   apply(simp add: der2_def)\n   apply(fold der2_def)\n   apply(rule conjI)\n    apply(simp add: F_CFG_AUGMENT_def)\n   apply(rule der2_maximum_of_domain)\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do], cfg_item_rhs2 = [teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>\\<notin>{I. valid_item G' k I \\<and> item_core I \\<in> cfg_productions G}\")\n   prefer 2\n   apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n    prefer 2\n    apply(rule F_FRESH_is_fresh)\n    apply(simp add: valid_cfg_def)\n   apply(simp add: item_core_def valid_cfg_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = [teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr>\"\n      and P=\"\\<lambda>x. prod_lhs x \\<in> cfg_nonterminals G \\<and> setA (prod_rhs x) \\<subseteq> cfg_nonterminals G \\<and> setB (prod_rhs x) \\<subseteq> cfg_events G\"\n      in ballE)\n    apply(clarsimp)\n   apply(clarsimp)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_prefix_closureise_additionalItems_2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> v = [teB Do]\n  \\<Longrightarrow> w = [teB Do, teA (cfg_initial G)]\n  \\<Longrightarrow> (last ((epda_initial M) # (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))) -{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} = {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = w, cfg_item_rhs2 = v, cfg_item_look_ahead = []\\<rparr>}\"\n  apply(rule_tac\n      t=\"w\"\n      and s=\"[teB Do, teA (cfg_initial G)]\"\n      in ssubst)\n   apply(force)\n  apply(rule_tac\n      t=\"v\"\n      and s=\"[teB Do]\"\n      in ssubst)\n   apply(force)\n  apply(thin_tac \"v = [teB Do]\")\n  apply(thin_tac \"w = [teB Do, teA (cfg_initial G)]\")\n  apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      and s=\"valid_item_set G' k [teB Do, teA (cfg_initial G)]\"\n      in ssubst)\n   apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      in ssubst)\n    apply(subgoal_tac \"length [teB Do, teA (cfg_initial G)]=length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\")\n     prefer 2\n     apply(rule_tac\n      w=\"[teB Do, teA (cfg_initial G)]\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n          apply(force)\n         apply(force)\n        apply(rule F_LR_MACHINE_all_Connected)\n           prefer 3\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n      apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def valid_cfg_def)\n     apply(force)\n    apply(force)\n   apply(rule sym)\n   apply(rule F_LR_MACHINE_all_SOUND_NotNil)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(simp add: F_CFG_AUGMENT_def valid_cfg_def)\n    apply(simp add: F_CFG_AUGMENT_def valid_cfg_def)\n   apply(force)\n  apply(rule order_antisym)\n   apply(rule subsetI)\n   apply(rename_tac x)(*strict*)\n   apply(rename_tac I)\n   apply(rename_tac I)(*strict*)\n   apply(subgoal_tac \"valid_item G' k I\")\n    apply(rename_tac I)(*strict*)\n    apply(subgoal_tac \"\\<exists>n. I \\<in> valid_item_set_n G' k n [teB Do, teA (cfg_initial G)]\")\n     apply(rename_tac I)(*strict*)\n     prefer 2\n     apply(simp only: valid_item_set_def)\n     apply(clarsimp)\n    apply(rename_tac I)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac I n)(*strict*)\n    apply(subgoal_tac \"\\<exists>A \\<alpha> \\<beta> y. I = \\<lparr>cfg_item_lhs = A, cfg_item_rhs1 = \\<alpha>, cfg_item_rhs2 = \\<beta>, cfg_item_look_ahead = y\\<rparr> \\<and> (\\<exists>d \\<delta> e1 e2 z. cfgRM.derivation G' d \\<and> d 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G')]\\<rparr>) \\<and> d n = Some (pair e1 \\<lparr>cfg_conf=\\<delta>@[teA A]@z\\<rparr>) \\<and> d (Suc n) = Some (pair e2 \\<lparr>cfg_conf=\\<delta>@\\<alpha>@\\<beta>@z\\<rparr>) \\<and> take k z=liftB y \\<and> [teB Do, teA (cfg_initial G)]=\\<delta>@\\<alpha> \\<and> maximum_of_domain d (Suc n) \\<and> setA z = {})\")\n     apply(rename_tac I n)(*strict*)\n     prefer 2\n     apply(simp add: valid_item_set_n_def)\n    apply(rename_tac I n)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac I n A \\<alpha> \\<beta> y)(*strict*)\n    apply(erule conjE)+\n    apply(erule exE)+\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(erule conjE)+\n    apply(subgoal_tac \"I=\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G)], cfg_item_rhs2 = [teB Do], cfg_item_look_ahead = []\\<rparr>\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>)\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     prefer 2\n     apply(rule F_CFG_AUGMENT__FirstStep)\n            apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n            apply(force)\n           apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n           apply(force)\n          apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n          apply(force)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n        apply(force)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n       apply(rule cfgRM_derivations_are_cfg_derivations)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(blast)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(case_tac n)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> z)(*strict*)\n     apply(case_tac \\<delta>)\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> z)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac y d)(*strict*)\n      apply(rule conjI)\n       apply(rename_tac y d)(*strict*)\n       apply(simp add: F_CFG_AUGMENT_def)\n      apply(rename_tac y d)(*strict*)\n      apply(rule liftB_reflects_Nil)\n      apply(force)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> z a list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n    apply(subgoal_tac \"\\<exists>e w. d (Suc nat) = Some (pair e \\<lparr>cfg_conf = teB Do # w\\<rparr>)\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n     prefer 2\n     apply(rule_tac\n      G=\"G'\"\n      and m=\"Suc 0\"\n      and n=\"Suc nat\"\n      in terminal_at_beginning_are_never_modified)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n         apply(rule cfgRM_derivations_are_cfg_derivations)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n        apply(force)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"setA (\\<delta> @ [teA A] @ z) \\<subseteq> cfg_nonterminals G\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(rule F_CFG_AUGMENT__later_at_old_grammar)\n            apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n            apply(force)\n           apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n           apply(force)\n          apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n          apply(force)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n        apply(force)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"False\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"A \\<in> cfg_nonterminals G\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(rule_tac\n      ?w1.0=\"\\<delta>\"\n      and ?w2.0=\"z\"\n      in suffixes_setA_2)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(rule suffixes_intro2)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"\\<lparr>prod_lhs=A, prod_rhs=\\<alpha>@\\<beta>\\<rparr> \\<in> cfg_productions G'\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(simp add: valid_item_def)\n     apply(clarsimp)\n     apply(rename_tac \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w p)(*strict*)\n     apply(case_tac p)\n     apply(rename_tac \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w p prod_lhsa prod_rhsa)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(case_tac \"\\<lparr>prod_lhs=A, prod_rhs=\\<alpha>@\\<beta>\\<rparr> \\<in> cfg_productions G\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(subgoal_tac \"\\<lparr>prod_lhs = A, prod_rhs = \\<alpha> @ \\<beta>\\<rparr> = \\<lparr>prod_lhs=S', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>\")\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      prefer 2\n      apply(simp add: F_CFG_AUGMENT_def)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      prefer 2\n      apply(rule F_FRESH_is_fresh)\n      apply(simp add: valid_cfg_def)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"item_core I=\\<lparr>prod_lhs = A, prod_rhs = \\<alpha> @ \\<beta>\\<rparr>\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(simp add: item_core_def)\n   apply(rename_tac I)(*strict*)\n   apply(rule Fact6_12__2)\n    apply(rename_tac I)(*strict*)\n    apply(force)\n   apply(rename_tac I)(*strict*)\n   apply(force)\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G)], cfg_item_rhs2 = [teB Do], cfg_item_look_ahead = []\\<rparr> \\<in> valid_item_set G' k [teB Do, teA (cfg_initial G)]\")\n   prefer 2\n   apply(simp add: valid_item_set_def valid_item_set_n_def)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule_tac\n      x = \"der2 \\<lparr>cfg_conf = [teA (cfg_initial (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))))]\\<rparr> \\<lparr>prod_lhs=cfg_initial (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))), prod_rhs=[teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr> \\<lparr>cfg_conf = [teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr> \"\n      in exI)\n   apply(rule conjI)\n    apply(rule cfgRM.der2_is_derivation)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(rule conjI)\n     apply(simp add: F_CFG_AUGMENT_def)\n    apply(rule_tac\n      x=\"[]\"\n      in exI)\n    apply(rule_tac\n      x=\"[]\"\n      in exI)\n    apply(clarsimp)\n   apply(simp add: der2_def)\n   apply(fold der2_def)\n   apply(rule conjI)\n    apply(simp add: F_CFG_AUGMENT_def)\n   apply(rule der2_maximum_of_domain)\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G)], cfg_item_rhs2 = [teB Do], cfg_item_look_ahead = []\\<rparr>\\<notin>{I. valid_item G' k I \\<and> item_core I \\<in> cfg_productions G}\")\n   prefer 2\n   apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n    prefer 2\n    apply(rule F_FRESH_is_fresh)\n    apply(simp add: valid_cfg_def)\n   apply(simp add: item_core_def valid_cfg_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = [teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr>\"\n      and P=\"\\<lambda>e. prod_lhs e \\<in> cfg_nonterminals G \\<and> setA (prod_rhs e) \\<subseteq> cfg_nonterminals G \\<and> setB (prod_rhs e) \\<subseteq> cfg_events G\"\n      in ballE)\n    apply(clarsimp)\n   apply(clarsimp)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_prefix_closureise_additionalItems_3: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> v = []\n  \\<Longrightarrow> w = [teB Do, teA (cfg_initial G), teB Do]\n  \\<Longrightarrow> (last ((epda_initial M) # (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))) = {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = w, cfg_item_rhs2 = v, cfg_item_look_ahead = []\\<rparr>}\"\n  apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n   prefer 2\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: valid_cfg_def)\n  apply(subgoal_tac \"F_FRESH (cfg_events G) \\<notin> cfg_events G\")\n   prefer 2\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: valid_cfg_def)\n  apply(rule_tac\n      t=\"w\"\n      and s=\"[teB Do, teA(cfg_initial G), teB Do]\"\n      in ssubst)\n   apply(force)\n  apply(rule_tac\n      t=\"v\"\n      and s=\"[]\"\n      in ssubst)\n   apply(force)\n  apply(thin_tac \"w = [teB Do, teA(cfg_initial G), teB Do]\")\n  apply(thin_tac \"v = []\")\n  apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA(cfg_initial G), teB Do])\"\n      and s=\"valid_item_set G' k [teB Do, teA(cfg_initial G), teB Do]\"\n      in ssubst)\n   apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA(cfg_initial G), teB Do])\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA(cfg_initial G), teB Do])\"\n      in ssubst)\n    apply(subgoal_tac \"length [teB Do, teA(cfg_initial G), teB Do]=length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA(cfg_initial G), teB Do])\")\n     prefer 2\n     apply(rule_tac\n      w=\"[teB Do, teA(cfg_initial G), teB Do]\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n          apply(force)\n         apply(force)\n        apply(rule F_LR_MACHINE_all_Connected)\n           prefer 3\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n      apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def valid_cfg_def)\n     apply(force)\n    apply(force)\n   apply(rule sym)\n   apply(rule F_LR_MACHINE_all_SOUND_NotNil)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(simp add: F_CFG_AUGMENT_def valid_cfg_def)\n    apply(simp add: F_CFG_AUGMENT_def valid_cfg_def)\n   apply(force)\n  apply(rule order_antisym)\n   apply(rule subsetI)\n   apply(rename_tac x)(*strict*)\n   apply(rename_tac I)\n   apply(rename_tac I)(*strict*)\n   apply(subgoal_tac \"valid_item G' k I\")\n    apply(rename_tac I)(*strict*)\n    apply(subgoal_tac \"\\<exists>n. I \\<in> valid_item_set_n G' k n [teB Do, teA(cfg_initial G), teB Do]\")\n     apply(rename_tac I)(*strict*)\n     prefer 2\n     apply(simp only: valid_item_set_def)\n     apply(clarsimp)\n    apply(rename_tac I)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac I n)(*strict*)\n    apply(subgoal_tac \"\\<exists>A \\<alpha> \\<beta> y. I = \\<lparr>cfg_item_lhs = A, cfg_item_rhs1 = \\<alpha>, cfg_item_rhs2 = \\<beta>, cfg_item_look_ahead = y\\<rparr> \\<and> (\\<exists>d \\<delta> e1 e2 z. cfgRM.derivation G' d \\<and> d 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G')]\\<rparr>) \\<and> d n = Some (pair e1 \\<lparr>cfg_conf=\\<delta>@[teA A]@z\\<rparr>) \\<and> d (Suc n) = Some (pair e2 \\<lparr>cfg_conf=\\<delta>@\\<alpha>@\\<beta>@z\\<rparr>) \\<and> take k z=liftB y \\<and> [teB Do, teA(cfg_initial G), teB Do]=\\<delta>@\\<alpha> \\<and> maximum_of_domain d (Suc n) \\<and> setA z = {})\")\n     apply(rename_tac I n)(*strict*)\n     prefer 2\n     apply(simp add: valid_item_set_n_def)\n    apply(rename_tac I n)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac I n A \\<alpha> \\<beta> y)(*strict*)\n    apply(erule conjE)+\n    apply(erule exE)+\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(erule conjE)+\n    apply(subgoal_tac \"I=\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA(cfg_initial G), teB Do], cfg_item_rhs2 = [], cfg_item_look_ahead = []\\<rparr>\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>)\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     prefer 2\n     apply(rule F_CFG_AUGMENT__FirstStep)\n            apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n            apply(force)\n           apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n           apply(force)\n          apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n          apply(force)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n        apply(force)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n       apply(rule cfgRM_derivations_are_cfg_derivations)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(blast)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(case_tac n)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac y d)(*strict*)\n     apply(rule conjI)\n      apply(rename_tac y d)(*strict*)\n      apply(simp add: F_CFG_AUGMENT_def)\n     apply(rename_tac y d)(*strict*)\n     apply(rule liftB_reflects_Nil)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n    apply(subgoal_tac \"\\<exists>e w. d (Suc nat) = Some (pair e \\<lparr>cfg_conf = teB Do # w\\<rparr>)\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n     prefer 2\n     apply(rule_tac\n      w=\"[teA (cfg_initial G), teB Do]\"\n      and G=\"G'\"\n      and m=\"Suc 0\"\n      and n=\"Suc nat\"\n      in terminal_at_beginning_are_never_modified)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n         apply(rule cfgRM_derivations_are_cfg_derivations)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n        apply(force)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"setA (\\<delta> @ [teA A] @ z) \\<subseteq> cfg_nonterminals G\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(rule F_CFG_AUGMENT__later_at_old_grammar)\n            apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n            apply(force)\n           apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n           apply(force)\n          apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n          apply(force)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n        apply(force)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"\\<exists>e w. d (Suc nat) = Some (pair e \\<lparr>cfg_conf = w @ [teB Do]\\<rparr>)\")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(rule_tac\n      w=\"[teB Do, teA (cfg_initial G)]\"\n      and G=\"G'\"\n      and m=\"Suc 0\"\n      and n=\"Suc nat\"\n      in terminal_at_ending_is_never_modified)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n         apply(rule cfgRM_derivations_are_cfg_derivations)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n        apply(force)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(force)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(subgoal_tac \"\\<exists>e w. d (Suc n) = Some (pair e \\<lparr>cfg_conf = teB Do # w @ [teB Do]\\<rparr>) \\<and> (set w) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \")\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     prefer 2\n     apply(rule_tac\n      m=\"Suc 0\"\n      and n=\"n\"\n      in cfgRM.property_preseved_under_steps_is_invariant2)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n         apply(force)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n        apply(rule_tac\n      x=\"Some\\<lparr>prod_lhs = cfg_initial G', prod_rhs = [teB Do, teA (cfg_initial G), teB Do]\\<rparr>\"\n      in exI)\n        apply(rule_tac\n      x=\"[teA (cfg_initial G)]\"\n      in exI)\n        apply(rule conjI)\n         apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n         apply(clarsimp)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n        apply(simp add: two_elements_construct_domain_def valid_cfg_def)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n       apply(force)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n      apply(force)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n     apply(rule allI)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i)(*strict*)\n     apply(rule impI)\n     apply(erule conjE)+\n     apply(erule exE)+\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb)(*strict*)\n     apply(erule conjE)+\n     apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb)(*strict*)\n      prefer 2\n      apply(rule cfgRM.some_position_has_details_before_max_dom_after_0)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb)(*strict*)\n        apply(blast)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb)(*strict*)\n       apply(blast)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb)(*strict*)\n      apply(arith)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb)(*strict*)\n     apply(erule exE)+\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb ec c)(*strict*)\n     apply(subgoal_tac \"cfgRM_step_relation G' \\<lparr>cfg_conf = teB Do # wb @ [teB Do]\\<rparr> ec c\")\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb ec c)(*strict*)\n      prefer 2\n      apply(rule_tac\n      n=\"i\"\n      in cfgRM.position_change_due_to_step_relation)\n        apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb ec c)(*strict*)\n        apply(blast)\n       apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb ec c)(*strict*)\n       apply(blast)\n      apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb ec c)(*strict*)\n      apply(blast)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb ec c)(*strict*)\n     apply(case_tac c)\n     apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w i ea eb wa wb ec c cfg_conf)(*strict*)\n     apply(simp add: cfgRM_step_relation_def)\n     apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa wb ec l r)(*strict*)\n     apply(case_tac l)\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa wb ec l r)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa wb ec l r a list)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa wb ec r list)(*strict*)\n     apply(case_tac \"r=[]\")\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa wb ec r list)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa wb ec r list)(*strict*)\n     apply(subgoal_tac \"\\<exists>r' a. r=r'@[a]\")\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa wb ec r list)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa ec list r' x)(*strict*)\n      apply(subgoal_tac \"ec \\<in> cfg_productions G\")\n       apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa ec list r' x)(*strict*)\n       apply(simp add: valid_cfg_def)\n       apply(clarsimp)\n       apply(erule_tac\n      x=\"ec\"\n      and P=\"\\<lambda>ec. prod_lhs ec \\<in> cfg_nonterminals G \\<and> setA (prod_rhs ec) \\<subseteq> cfg_nonterminals G \\<and> setB (prod_rhs ec) \\<subseteq> cfg_events G\"\n      in ballE)\n        apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa ec list r' x)(*strict*)\n        apply(clarsimp)\n        apply(rule_tac\n      A=\"set(prod_rhs ec)\"\n      in set_mp)\n         apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa ec list r' x)(*strict*)\n         apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n          apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa ec list r' x)(*strict*)\n          apply(force)\n         apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa ec list r' x)(*strict*)\n         apply(force)\n        apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa ec list r' x)(*strict*)\n        apply(clarsimp)\n       apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa ec list r' x)(*strict*)\n       apply(force)\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa ec list r' x)(*strict*)\n      apply(simp add: F_CFG_AUGMENT_def)\n      apply(clarsimp)\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa list r' x)(*strict*)\n      apply(subgoal_tac \"teA (F_FRESH (cfg_nonterminals G)) \\<notin> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n       apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa list r' x)(*strict*)\n       apply(force)\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa list r' x)(*strict*)\n      apply(thin_tac \"teA (F_FRESH (cfg_nonterminals G)) \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n      apply(simp add: two_elements_construct_domain_def)\n      apply(rule conjI)\n       apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa list r' x)(*strict*)\n       prefer 2\n       apply(clarsimp)\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa list r' x)(*strict*)\n      apply(rule teA_notInMap)\n      apply(rule F_FRESH_is_fresh)\n      apply(simp add: valid_cfg_def)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa wb ec r list)(*strict*)\n     apply(rule_tac\n      n=\"length r - 1\"\n      in NonEmptyListHasTailElem)\n     apply(case_tac r)\n      apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa wb ec r list)(*strict*)\n      apply(force)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w i eb wa wb ec r list a lista)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac I n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat e w)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w wa wb)(*strict*)\n    apply(case_tac \\<delta>)\n     apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w wa wb)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac A \\<beta> y d e1 e2 z nat w wa wb)(*strict*)\n     apply(subgoal_tac \"\\<exists>z'. z=z'@[teB (F_FRESH (cfg_events G))]\")\n      apply(rename_tac A \\<beta> y d e1 e2 z nat w wa wb)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac A \\<beta> y d e1 e2 z nat w wa wb)(*strict*)\n     apply(case_tac wa)\n      apply(rename_tac A \\<beta> y d e1 e2 z nat w wa wb)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac A \\<beta> y d e1 e2 z nat w wa wb a list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat w wa wb a list)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 z nat w wa wb list)(*strict*)\n    apply(subgoal_tac \"\\<exists>z'. z=z'@[teB (F_FRESH (cfg_events G))]\")\n     apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 z nat w wa wb list)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 nat list z')(*strict*)\n     apply(case_tac list)\n      apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 nat list z')(*strict*)\n      apply(clarsimp)\n      apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n      apply(simp add: two_elements_construct_domain_def)\n      apply(erule_tac\n      P=\"teA (cfg_initial G) \\<in> teA ` cfg_nonterminals G\"\n      in disjE)\n       apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n       apply(clarsimp)\n       apply(erule disjE)\n        apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n        apply(clarsimp)\n       apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n       apply(clarsimp)\n      apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n      apply(erule disjE)\n       apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n       apply(clarsimp)\n      apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n      apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 nat list z' a lista)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 nat z' lista)(*strict*)\n     apply(case_tac lista)\n      apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 nat z' lista)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n      apply(simp add: two_elements_construct_domain_def)\n      apply(erule disjE)\n       apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n       apply(clarsimp)\n      apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n      apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 nat z' lista a list)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n     apply(simp add: two_elements_construct_domain_def)\n     apply(erule disjE)\n      apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n      apply(clarsimp)\n     apply(rename_tac A \\<beta> y d e1 e2 nat z')(*strict*)\n     apply(clarsimp)\n    apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 z nat w wa wb list)(*strict*)\n    apply(case_tac wa)\n     apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 z nat w wa wb list)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 z nat w wa wb list a lista)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 z nat wb list lista)(*strict*)\n    apply(rule_tac\n      u=\"[]\"\n      in terminalTailEquals2)\n      apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 z nat wb list lista)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 z nat wb list lista)(*strict*)\n     apply(force)\n    apply(rename_tac A \\<alpha> \\<beta> y d e1 e2 z nat wb list lista)(*strict*)\n    apply(force)\n   apply(rename_tac I)(*strict*)\n   apply(rule Fact6_12__2)\n    apply(rename_tac I)(*strict*)\n    apply(force)\n   apply(rename_tac I)(*strict*)\n   apply(force)\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_rhs2 = [], cfg_item_look_ahead = []\\<rparr> \\<in> valid_item_set G' k [teB Do, teA (cfg_initial G), teB Do]\")\n   prefer 2\n   apply(simp add: valid_item_set_def valid_item_set_n_def)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule_tac\n      x = \"der2 \\<lparr>cfg_conf = [teA (cfg_initial (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))))]\\<rparr> \\<lparr>prod_lhs=cfg_initial (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))), prod_rhs=[teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr> \\<lparr>cfg_conf = [teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr>\"\n      in exI)\n   apply(rule conjI)\n    apply(rule cfgRM.der2_is_derivation)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(rule conjI)\n     apply(simp add: F_CFG_AUGMENT_def)\n    apply(rule_tac\n      x=\"[]\"\n      in exI)\n    apply(rule_tac\n      x=\"[]\"\n      in exI)\n    apply(clarsimp)\n   apply(simp add: der2_def)\n   apply(fold der2_def)\n   apply(rule conjI)\n    apply(simp add: F_CFG_AUGMENT_def)\n   apply(rule der2_maximum_of_domain)\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G)], cfg_item_rhs2 = [teB Do], cfg_item_look_ahead = []\\<rparr>\\<notin>{I. valid_item G' k I \\<and> item_core I \\<in> cfg_productions G}\")\n   prefer 2\n   apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n    prefer 2\n    apply(rule F_FRESH_is_fresh)\n    apply(simp add: valid_cfg_def)\n   apply(simp add: item_core_def valid_cfg_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = [teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr>\"\n      and P=\"\\<lambda>p. prod_lhs p \\<in> cfg_nonterminals G \\<and> setA (prod_rhs p) \\<subseteq> cfg_nonterminals G \\<and> setB (prod_rhs p) \\<subseteq> cfg_events G\"\n      in ballE)\n    apply(clarsimp)\n   apply(clarsimp)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_DFAGTOTO_differs: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) \\<noteq> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) []) \\<and> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) \\<noteq> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) []) \\<and> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) \\<noteq> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) []) \\<and> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) \\<noteq> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) \\<and> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) \\<noteq> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) \\<and> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) \\<noteq> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) \\<and> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) \\<noteq> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n  apply(subgoal_tac \"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) []) -{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} = {\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[], cfg_item_rhs2=[teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\")\n   prefer 2\n   apply(subgoal_tac \"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) []) = {\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[], cfg_item_rhs2=[teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\")\n    prefer 2\n    apply(rule F_LR_MACHINE_prefix_closureise_additionalItems_0)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr> \\<notin> {I. valid_item G' k I \\<and> item_core I \\<in> cfg_productions G}\")\n    apply(force)\n   apply(simp add: item_core_def valid_cfg_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = [teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr>\"\n      and P=\"\\<lambda>p. prod_lhs p \\<in> cfg_nonterminals G \\<and> setA (prod_rhs p) \\<subseteq> cfg_nonterminals G \\<and> setB (prod_rhs p) \\<subseteq> cfg_events G\"\n      in ballE)\n    apply(clarsimp)\n    apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n     apply(force)\n    apply(rule F_FRESH_is_fresh)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) -{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} = {\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do], cfg_item_rhs2=[teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\")\n   prefer 2\n   apply(rule F_LR_MACHINE_prefix_closureise_additionalItems_1)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) -{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} = {\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do, teA (cfg_initial G)], cfg_item_rhs2=[teB Do], cfg_item_look_ahead=[]\\<rparr>}\")\n   prefer 2\n   apply(rule F_LR_MACHINE_prefix_closureise_additionalItems_2)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) -{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} = {\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do, teA (cfg_initial G), teB Do], cfg_item_rhs2=[], cfg_item_look_ahead=[]\\<rparr>}\")\n   prefer 2\n   apply(subgoal_tac \"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) = {\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do, teA (cfg_initial G), teB Do], cfg_item_rhs2=[], cfg_item_look_ahead=[]\\<rparr>}\")\n    prefer 2\n    apply(rule F_LR_MACHINE_prefix_closureise_additionalItems_3)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_rhs2 = [], cfg_item_look_ahead = []\\<rparr> \\<notin> {I. valid_item G' k I \\<and> item_core I \\<in> cfg_productions G}\")\n    prefer 2\n    apply(simp add: item_core_def valid_cfg_def)\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = [teB (F_FRESH (cfg_events G)), teA (cfg_initial G), teB (F_FRESH (cfg_events G))]\\<rparr>\"\n      and P=\"\\<lambda>p. prod_lhs p \\<in> cfg_nonterminals G \\<and> setA (prod_rhs p) \\<subseteq> cfg_nonterminals G \\<and> setB (prod_rhs p) \\<subseteq> cfg_events G\"\n      in ballE)\n     apply(clarsimp)\n     apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n      apply(force)\n     apply(rule F_FRESH_is_fresh)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule conjI, force)+\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_DFAGTOTO_differs2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> x \\<noteq> y\n  \\<Longrightarrow> \\<exists>v. x @ v = [teB Do, teA (cfg_initial G), teB Do]\n  \\<Longrightarrow> \\<exists>v. y @ v = [teB Do, teA (cfg_initial G), teB Do]\n  \\<Longrightarrow> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) y) \\<noteq> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) x)\"\n  apply(subgoal_tac \"last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) \\<noteq> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) []) \\<and> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) \\<noteq> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) []) \\<and> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) \\<noteq> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) []) \\<and> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) \\<noteq> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) \\<and> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) \\<noteq> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) \\<and> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) \\<noteq> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) \\<and> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) \\<noteq> last((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\")\n   prefer 2\n   apply(rule F_LR_MACHINE_DFAGTOTO_differs)\n           apply(blast)+\n  apply(erule exE)+\n  apply(rename_tac v va)(*strict*)\n  apply(subgoal_tac \"x=[] \\<or> x=[teB Do] \\<or> x=[teB Do, teA (cfg_initial G)] \\<or> x=[teB Do, teA (cfg_initial G), teB Do]\")\n   apply(rename_tac v va)(*strict*)\n   prefer 2\n   apply(case_tac x)\n    apply(rename_tac v va)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac v va a list)(*strict*)\n   apply(case_tac list)\n    apply(rename_tac v va a list)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac v va a list aa lista)(*strict*)\n   apply(case_tac lista)\n    apply(rename_tac v va a list aa lista)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac v va a list aa lista ab listb)(*strict*)\n   apply(case_tac listb)\n    apply(rename_tac v va a list aa lista ab listb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac v va a list aa lista ab listb ac listc)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac v va)(*strict*)\n  apply(subgoal_tac \"y=[] \\<or> y=[teB Do] \\<or> y=[teB Do, teA (cfg_initial G)] \\<or> y=[teB Do, teA (cfg_initial G), teB Do]\")\n   apply(rename_tac v va)(*strict*)\n   prefer 2\n   apply(case_tac y)\n    apply(rename_tac v va)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac v va a list)(*strict*)\n   apply(case_tac list)\n    apply(rename_tac v va a list)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac v va a list aa lista)(*strict*)\n   apply(case_tac lista)\n    apply(rename_tac v va a list aa lista)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac v va a list aa lista ab listb)(*strict*)\n   apply(case_tac listb)\n    apply(rename_tac v va a list aa lista ab listb)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac v va a list aa lista ab listb ac listc)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac v va)(*strict*)\n  apply(erule disjE)+\n    apply(rename_tac v va)(*strict*)\n    apply(force)\n   apply(rename_tac v va)(*strict*)\n   apply(erule disjE)+\n    apply(rename_tac v va)(*strict*)\n    apply(force)\n   apply(rename_tac v va)(*strict*)\n   apply(erule disjE)+\n    apply(rename_tac v va)(*strict*)\n    apply(force)\n   apply(rename_tac v va)(*strict*)\n   apply(force)\n  apply(rename_tac v va)(*strict*)\n  apply(erule disjE)+\n    apply(rename_tac v va)(*strict*)\n    apply(force)\n   apply(rename_tac v va)(*strict*)\n   apply(erule disjE)+\n    apply(rename_tac v va)(*strict*)\n    apply(force)\n   apply(rename_tac v va)(*strict*)\n   apply(force)\n  apply(rename_tac v va)(*strict*)\n  apply(erule disjE)+\n    apply(rename_tac v va)(*strict*)\n    apply(force)\n   apply(rename_tac v va)(*strict*)\n   apply(erule disjE)+\n    apply(rename_tac v va)(*strict*)\n    apply(force)\n   apply(rename_tac v va)(*strict*)\n   apply(force)\n  apply(rename_tac v va)(*strict*)\n  apply(erule disjE)+\n    apply(rename_tac v va)(*strict*)\n    apply(force)\n   apply(rename_tac v va)(*strict*)\n   apply(force)\n  apply(rename_tac v va)(*strict*)\n  apply(erule disjE)+\n    apply(rename_tac v va)(*strict*)\n    apply(force)\n   apply(rename_tac v va)(*strict*)\n   apply(force)\n  apply(rename_tac v va)(*strict*)\n  apply(erule disjE)+\n   apply(rename_tac v va)(*strict*)\n   apply(force)\n  apply(rename_tac v va)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_DFAGTOTO_differs_hlp1: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) = F_DFA_GOTO M (epda_initial M) (teB Do)\"\n  apply(rule_tac\n      t=\"(last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])))\"\n      and s=\"(last ((F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])))\"\n      in ssubst)\n   apply(subgoal_tac \"length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) = length [teB Do]\")\n    apply(force)\n   apply(rule sym)\n   apply(rule_tac\n      q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(force)\n       apply(force)\n      apply(rule F_LR_MACHINE_all_Connected)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n   apply(force)\n  apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]\"\n      and s=\"[F_DFA_GOTO M (epda_initial M) (teB Do)]\"\n      in ssubst)\n   apply(rule DFA_F_DFA_GOTO_SEQUENCE_to_F_DFA_GOTO)\n       apply(force)\n      apply(force)\n     apply(rule F_LR_MACHINE_all_Connected)\n        prefer 3\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n   apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_DFAGTOTO_differs_hlp2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) []) = epda_initial M\"\n  apply(subgoal_tac \"length [] = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [])\")\n   apply(force)\n  apply(rule_tac\n      q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n       apply(force)\n      apply(force)\n     apply(rule F_LR_MACHINE_all_Connected)\n        prefer 3\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n   apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n  apply(force)\n  done\n\nlemma F_VALID_ITEM_SET_GOTO_to_1: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> F_VALID_ITEM_SET_GOTO G' F k X q = valid_item_set G' k []\n  \\<Longrightarrow> Q\"\n  apply(subgoal_tac \"F_VALID_ITEM_SET_GOTO G' F k X q \\<noteq> valid_item_set G' k []\")\n   apply(force)\n  apply(rule not_sym)\n  apply(rule_tac\n      t=\"valid_item_set G' k []\"\n      and s=\"(if []=[] then F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_INITIAL G' F k) else F_VALID_ITEM_SET_GOTO__descent__fp G' F k (essential_items (valid_item_set G' k [])))\"\n      in ssubst)\n   apply(rule Lemma6__23)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule_tac\n      t=\"(if [] = [] then F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_INITIAL G' F k) else F_VALID_ITEM_SET_GOTO__descent__fp G' F k (essential_items (valid_item_set G' k [])))\"\n      and s=\"F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_INITIAL G' F k)\"\n      in ssubst)\n   apply(clarsimp)\n  apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_INITIAL G' F k)\"\n      and s=\"F_VALID_ITEM_SET_INITIAL G' F k\"\n      in ssubst)\n   apply(simp add: F_VALID_ITEM_SET_INITIAL_def)\n   apply(rule F_VALID_ITEM_SET_GOTO__descent__fp_idemp)\n   apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_valid_input_def)\n   apply(rule F_VALID_ITEM_SET_INITIAL__fp_start_contains_valid_item)\n  apply(rule F_VALID_ITEM_SET_GOTO_does_not_reach_F_LR_MACHINE_initial)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"q \\<in> {valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\")\n   prefer 2\n   apply(rule_tac\n      t=\"{valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\"\n      and s=\"epda_states M\"\n      in ssubst)\n    apply(rule sym)\n    apply(rule LRM_contains_theEqClasses)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule ballI)\n  apply(rename_tac I)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac I w)(*strict*)\n  apply(rule_tac\n      \\<gamma>=\"w\"\n      in Fact6_12__2)\n   apply(rename_tac I w)(*strict*)\n   apply(force)\n  apply(rename_tac I w)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_VALID_ITEM_SET_GOTO_to_2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> set v \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\n  \\<Longrightarrow> F_VALID_ITEM_SET_GOTO G' F k X (valid_item_set G' k v) = valid_item_set G' k [teB Do]\n  \\<Longrightarrow> valid_item_set G' k v = valid_item_set G' k [] \\<and> X = teB Do\"\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do], cfg_item_rhs2=[teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr> \\<in> valid_item_set G' k [teB Do]\")\n   prefer 2\n   apply(rule_tac\n      A=\"(last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])))- {I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)}\"\n      in set_mp)\n    apply(rule_tac\n      t=\"valid_item_set G' k [teB Do]\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      in ssubst)\n     apply(rule F_LR_MACHINE_all_SOUND_NotNil2)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(simp add: F_CFG_AUGMENT_def)\n     apply(force)\n    apply(force)\n   apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) - {I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)}\"\n      and s=\"{\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do], cfg_item_rhs2=[teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\"\n      in ssubst)\n    apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_prefix_closureise_additionalItems_1)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"X=teB Do\")\n   prefer 2\n   apply(rule_tac\n      S=\"(valid_item_set G' k v)\"\n      and I=\"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do], cfg_item_rhs2 = [teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>\"\n      and w=\"[]\"\n      and G=\"G\"\n      in F_VALID_ITEM_SET_GOTO_uses_every_last_cfg_item_rhs1_symbol)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(clarsimp)\n    apply(rename_tac x)(*strict*)\n    apply(rule Fact6_12__2)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rule conjI)\n   prefer 2\n   apply(force)\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr> \\<in> valid_item_set G' k v\")\n   prefer 2\n   apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do], cfg_item_rhs2 = [teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>\\<lparr>cfg_item_rhs1:=[], cfg_item_rhs2:=teB Do#(cfg_item_rhs2 \\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do], cfg_item_rhs2 = [teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>)\\<rparr> \\<in> valid_item_set G' k v\")\n    apply(force)\n   apply(rule F_LR_MACHINE_shift_back_in_pre_state)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(subgoal_tac \"valid_item_set G' k v \\<in> epda_states M\")\n    prefer 2\n    apply(rule_tac\n      t=\"epda_states M\"\n      and s=\"{valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\"\n      in ssubst)\n     apply(rule_tac\n      G=\"G'\"\n      in LRM_contains_theEqClasses)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"v=[]\")\n   apply(force)\n  apply(rule F_CFG_AUGMENT__Initial_only_in_F_VALID_ITEM_SET_INITIAL)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma DollarReadItem_OnlyIn_Specific_Valid2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> set w \\<subseteq> epda_events M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> \\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do], cfg_item_rhs2 = [teA (cfg_initial G), teB Do], cfg_item_look_ahead = x\\<rparr> \\<in> (last ((epda_initial M) # (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)))\n  \\<Longrightarrow> w = [teB Do] \\<and> x = []\"\n  apply(rule DollarReadItem_OnlyIn_Specific_Valid)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rule_tac\n      t=\"valid_item_set (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) k w\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\" for k\n      in ssubst)\n   defer\n   apply(force)\n  apply(case_tac w)\n   apply(subgoal_tac \"(last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) []))) ={\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[], cfg_item_rhs2=[teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\")\n    prefer 2\n    apply(rule F_LR_MACHINE_prefix_closureise_additionalItems_0)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rename_tac a list)(*strict*)\n  apply(subgoal_tac \"length w = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\")\n   apply(rename_tac a list)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"M\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac a list)(*strict*)\n        apply(force)\n       apply(rename_tac a list)(*strict*)\n       apply(force)\n      apply(rename_tac a list)(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac a list)(*strict*)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(rename_tac a list)(*strict*)\n       apply(force)\n      apply(rename_tac a list)(*strict*)\n      apply(force)\n     apply(rename_tac a list)(*strict*)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(rename_tac a list)(*strict*)\n    apply(simp add: F_LR_MACHINE_def)\n   apply(rename_tac a list)(*strict*)\n   apply(force)\n  apply(rename_tac a list)(*strict*)\n  apply(subgoal_tac \" last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w) = valid_item_set G' k w\")\n   apply(rename_tac a list)(*strict*)\n   prefer 2\n   apply(rule sym)\n   apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      in ssubst)\n    apply(rename_tac a list)(*strict*)\n    apply(force)\n   apply(rename_tac a list)(*strict*)\n   apply(rule F_LR_MACHINE_all_SOUND_NotNil)\n          apply(rename_tac a list)(*strict*)\n          apply(force)\n         apply(rename_tac a list)(*strict*)\n         apply(force)\n        apply(rename_tac a list)(*strict*)\n        apply(force)\n       apply(rename_tac a list)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac a list)(*strict*)\n     apply(rule two_elements_construct_domain_setA)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rename_tac a list)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(simp add: F_LR_MACHINE_def)\n   apply(rename_tac a list)(*strict*)\n   apply(force)\n  apply(rename_tac a list)(*strict*)\n  apply(force)\n  done\n\nlemma F_VALID_ITEM_SET_GOTO_to_3: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> set v \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\n  \\<Longrightarrow> F_VALID_ITEM_SET_GOTO G' F k X (valid_item_set G' k v) = valid_item_set G' k [teB Do, teA (cfg_initial G)]\n  \\<Longrightarrow> valid_item_set G' k v = valid_item_set G' k [teB Do] \\<and> X = teA (cfg_initial G)\"\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do, teA (cfg_initial G)], cfg_item_rhs2=[teB Do], cfg_item_look_ahead=[]\\<rparr> \\<in> valid_item_set G' k [teB Do, teA (cfg_initial G)]\")\n   prefer 2\n   apply(rule_tac\n      A=\"(last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA(cfg_initial G)])))-{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)}\"\n      in set_mp)\n    apply(rule_tac\n      t=\"valid_item_set G' k [teB Do, teA (cfg_initial G)]\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      in ssubst)\n     apply(rule F_LR_MACHINE_all_SOUND_NotNil2)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(simp add: F_CFG_AUGMENT_def valid_cfg_def)\n      apply(simp add: F_CFG_AUGMENT_def)\n     apply(force)\n    apply(force)\n   apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) - {I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)}\"\n      and s=\"{\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do, teA (cfg_initial G)], cfg_item_rhs2=[teB Do], cfg_item_look_ahead=[]\\<rparr>}\"\n      in ssubst)\n    apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_prefix_closureise_additionalItems_2)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"X=teA (cfg_initial G)\")\n   prefer 2\n   apply(rule_tac\n      S=\"(valid_item_set G' k v)\"\n      and I=\"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G)], cfg_item_rhs2 = [teB Do], cfg_item_look_ahead = []\\<rparr>\"\n      and w=\"[teB Do]\"\n      and G=\"G\"\n      in F_VALID_ITEM_SET_GOTO_uses_every_last_cfg_item_rhs1_symbol)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(clarsimp)\n    apply(rename_tac x)(*strict*)\n    apply(rule Fact6_12__2)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rule conjI)\n   prefer 2\n   apply(force)\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do], cfg_item_rhs2 = [teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr> \\<in> valid_item_set G' k v\")\n   prefer 2\n   apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G)], cfg_item_rhs2 = [teB Do], cfg_item_look_ahead = []\\<rparr>\\<lparr>cfg_item_rhs1:=[teB Do], cfg_item_rhs2:=teA (cfg_initial G)#(cfg_item_rhs2 \\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G)], cfg_item_rhs2 = [teB Do], cfg_item_look_ahead = []\\<rparr>)\\<rparr> \\<in> valid_item_set G' k v\")\n    apply(force)\n   apply(rule F_LR_MACHINE_shift_back_in_pre_state)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"valid_item_set G' k v \\<in> epda_states M\")\n   prefer 2\n   apply(rule_tac\n      t=\"epda_states M\"\n      and s=\"{valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\"\n      in ssubst)\n    apply(rule_tac\n      G=\"G'\"\n      in LRM_contains_theEqClasses)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"v=[teB Do] \\<and> []=[]\")\n   apply(force)\n  apply(rule DollarReadItem_OnlyIn_Specific_Valid)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_VALID_ITEM_SET_GOTO_to_4: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> set v \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\n  \\<Longrightarrow> F_VALID_ITEM_SET_GOTO G' F k X (valid_item_set G' k v) = valid_item_set G' k [teB Do, teA (cfg_initial G), teB Do]\n  \\<Longrightarrow> valid_item_set G' k v = valid_item_set G' k [teB Do, teA (cfg_initial G)] \\<and> X = teB Do\"\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do, teA (cfg_initial G), teB Do], cfg_item_rhs2=[], cfg_item_look_ahead=[]\\<rparr> \\<in> valid_item_set G' k [teB Do, teA (cfg_initial G), teB Do]\")\n   prefer 2\n   apply(rule_tac\n      A=\"(last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA(cfg_initial G), teB Do])))\"\n      in set_mp)\n    apply(rule_tac\n      t=\"valid_item_set G' k [teB Do, teA (cfg_initial G), teB Do]\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do])\"\n      in ssubst)\n     apply(rule F_LR_MACHINE_all_SOUND_NotNil2)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(simp add: F_CFG_AUGMENT_def valid_cfg_def)\n      apply(simp add: F_CFG_AUGMENT_def)\n     apply(force)\n    apply(force)\n   apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do])\"\n      and s=\"{\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do, teA (cfg_initial G), teB Do], cfg_item_rhs2=[], cfg_item_look_ahead=[]\\<rparr>}\"\n      in ssubst)\n    apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_prefix_closureise_additionalItems_3)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"X=teB Do\")\n   prefer 2\n   apply(rule_tac\n      S=\"valid_item_set G' k v\"\n      and I=\"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_rhs2 = [], cfg_item_look_ahead = []\\<rparr>\"\n      and w=\"[teB Do, teA (cfg_initial G)]\"\n      and G=\"G\"\n      in F_VALID_ITEM_SET_GOTO_uses_every_last_cfg_item_rhs1_symbol)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(clarsimp)\n    apply(rename_tac x)(*strict*)\n    apply(rule Fact6_12__2)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rule conjI)\n   prefer 2\n   apply(force)\n  apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G)], cfg_item_rhs2 = [teB Do], cfg_item_look_ahead = []\\<rparr> \\<in> valid_item_set G' k v\")\n   prefer 2\n   apply(subgoal_tac \"\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_rhs2 = [], cfg_item_look_ahead = []\\<rparr>\\<lparr>cfg_item_rhs1:=[teB Do, teA (cfg_initial G)], cfg_item_rhs2:=teB Do#(cfg_item_rhs2 \\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_rhs2 = [], cfg_item_look_ahead = []\\<rparr>)\\<rparr> \\<in> valid_item_set G' k v\")\n    apply(force)\n   apply(rule F_LR_MACHINE_shift_back_in_pre_state)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"valid_item_set G' k v \\<in> epda_states M\")\n   prefer 2\n   apply(rule_tac\n      t=\"epda_states M\"\n      and s=\"{valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\"\n      in ssubst)\n    apply(rule_tac\n      G=\"G'\"\n      in LRM_contains_theEqClasses)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"v=[teB Do, teA (cfg_initial G)]\")\n   apply(force)\n  apply(rule DollarInitialReadItem_OnlyIn_Specific_Valid)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma nonEmptyStatesViaDoS_primeDo: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> q' \\<in> set (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do])\n  \\<Longrightarrow> q' \\<noteq> {}\"\n  apply(subgoal_tac \" q'=last(epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) []) \\<or> q'=last(epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) \\<or> q'=last(epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) \\<or> q'=last(epda_initial M #F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) \")\n   apply(erule disjE)\n    apply(subgoal_tac \"(last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) []))) ={\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[], cfg_item_rhs2=[teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\")\n     apply(force)\n    apply(rule F_LR_MACHINE_prefix_closureise_additionalItems_0)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(erule disjE)\n    apply(subgoal_tac \"(last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])))-{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} ={\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do], cfg_item_rhs2=[teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\")\n     apply(force)\n    apply(rule F_LR_MACHINE_prefix_closureise_additionalItems_1)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(erule disjE)\n    apply(subgoal_tac \"(last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])))-{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} ={\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do, teA (cfg_initial G)], cfg_item_rhs2=[teB Do], cfg_item_look_ahead=[]\\<rparr>}\")\n     apply(force)\n    apply(rule F_LR_MACHINE_prefix_closureise_additionalItems_2)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(subgoal_tac \"(last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]))) ={\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do, teA (cfg_initial G), teB Do], cfg_item_rhs2=[], cfg_item_look_ahead=[]\\<rparr>}\")\n    apply(force)\n   apply(rule F_LR_MACHINE_prefix_closureise_additionalItems_3)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"\\<exists>i<length SSw. SSw ! i = q'\" for SSw)\n   prefer 2\n   apply(rule set_elem_nth)\n   apply(blast)\n  apply(erule exE)\n  apply(rename_tac i)(*strict*)\n  apply(erule conjE)\n  apply(case_tac i)\n   apply(rename_tac i)(*strict*)\n   apply(rule_tac disjI1)\n   apply(subgoal_tac \"F_DFA_GOTO_SEQUENCE M (epda_initial M) []=[]\")\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(subgoal_tac \"length [] = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [])\")\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(rule_tac\n      q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac i)(*strict*)\n        apply(force)\n       apply(rename_tac i)(*strict*)\n       apply(force)\n      apply(rename_tac i)(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac i)(*strict*)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(rename_tac i)(*strict*)\n       apply(force)\n      apply(rename_tac i)(*strict*)\n      apply(force)\n     apply(rename_tac i)(*strict*)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(force)\n  apply(rename_tac i nat)(*strict*)\n  apply(case_tac nat)\n   apply(rename_tac i nat)(*strict*)\n   apply(rule_tac disjI2)\n   apply(rule_tac disjI1)\n   apply(rule_tac\n      t=\"q'\"\n      and s=\"(epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) ! i\"\n      in ssubst)\n    apply(rename_tac i nat)(*strict*)\n    apply(force)\n   apply(rename_tac i nat)(*strict*)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]\"\n      and s=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) (take i ([teB Do, teA (cfg_initial G), teB Do]))\"\n      in ssubst)\n    apply(rename_tac i nat)(*strict*)\n    apply(force)\n   apply(rename_tac i nat)(*strict*)\n   apply(rule nth_last_commutes_over_F_DFA_GOTO_SEQUENCE_prime)\n        apply(rename_tac i nat)(*strict*)\n        apply(force)\n       apply(rename_tac i nat)(*strict*)\n       apply(force)\n      apply(rename_tac i nat)(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac i nat)(*strict*)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(rename_tac i nat)(*strict*)\n       apply(force)\n      apply(rename_tac i nat)(*strict*)\n      apply(force)\n     apply(rename_tac i nat)(*strict*)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(rename_tac i nat)(*strict*)\n    apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n   apply(rename_tac i nat)(*strict*)\n   apply(force)\n  apply(rename_tac i nat nata)(*strict*)\n  apply(case_tac nata)\n   apply(rename_tac i nat nata)(*strict*)\n   apply(rule_tac disjI2)\n   apply(rule disjI2)\n   apply(rule_tac disjI1)\n   apply(rule_tac\n      t=\"q'\"\n      and s=\"(epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) ! i\"\n      in ssubst)\n    apply(rename_tac i nat nata)(*strict*)\n    apply(force)\n   apply(rename_tac i nat nata)(*strict*)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]\"\n      and s=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) (take i ([teB Do, teA (cfg_initial G), teB Do]))\"\n      in ssubst)\n    apply(rename_tac i nat nata)(*strict*)\n    apply(force)\n   apply(rename_tac i nat nata)(*strict*)\n   apply(rule nth_last_commutes_over_F_DFA_GOTO_SEQUENCE_prime)\n        apply(rename_tac i nat nata)(*strict*)\n        apply(force)\n       apply(rename_tac i nat nata)(*strict*)\n       apply(force)\n      apply(rename_tac i nat nata)(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac i nat nata)(*strict*)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(rename_tac i nat nata)(*strict*)\n       apply(force)\n      apply(rename_tac i nat nata)(*strict*)\n      apply(force)\n     apply(rename_tac i nat nata)(*strict*)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(rename_tac i nat nata)(*strict*)\n    apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n   apply(rename_tac i nat nata)(*strict*)\n   apply(force)\n  apply(rename_tac i nat nata natb)(*strict*)\n  apply(case_tac natb)\n   apply(rename_tac i nat nata natb)(*strict*)\n   apply(rule_tac disjI2)\n   apply(rule disjI2)\n   apply(rule disjI2)\n   apply(rule_tac\n      t=\"[teB Do, teA (cfg_initial G), teB Do]\"\n      and s=\"(take i ([teB Do, teA (cfg_initial G), teB Do]))\"\n      in ssubst)\n    apply(rename_tac i nat nata natb)(*strict*)\n    apply(force)\n   apply(rename_tac i nat nata natb)(*strict*)\n   apply(rule_tac\n      t=\"q'\"\n      and s=\"(epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]) ! i\"\n      in ssubst)\n    apply(rename_tac i nat nata natb)(*strict*)\n    apply(force)\n   apply(rename_tac i nat nata natb)(*strict*)\n   apply(rule nth_last_commutes_over_F_DFA_GOTO_SEQUENCE_prime)\n        apply(rename_tac i nat nata natb)(*strict*)\n        apply(force)\n       apply(rename_tac i nat nata natb)(*strict*)\n       apply(force)\n      apply(rename_tac i nat nata natb)(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac i nat nata natb)(*strict*)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(rename_tac i nat nata natb)(*strict*)\n       apply(force)\n      apply(rename_tac i nat nata natb)(*strict*)\n      apply(force)\n     apply(rename_tac i nat nata natb)(*strict*)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(rename_tac i nat nata natb)(*strict*)\n    apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n   apply(rename_tac i nat nata natb)(*strict*)\n   apply(force)\n  apply(rename_tac i nat nata natb natc)(*strict*)\n  apply(subgoal_tac \"length [teB Do, teA (cfg_initial G), teB Do] = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do])\")\n   apply(rename_tac i nat nata natb natc)(*strict*)\n   apply(force)\n  apply(rename_tac i nat nata natb natc)(*strict*)\n  apply(rule_tac\n      q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n       apply(rename_tac i nat nata natb natc)(*strict*)\n       apply(force)\n      apply(rename_tac i nat nata natb natc)(*strict*)\n      apply(force)\n     apply(rename_tac i nat nata natb natc)(*strict*)\n     apply(rule F_LR_MACHINE_all_Connected)\n        apply(rename_tac i nat nata natb natc)(*strict*)\n        prefer 3\n        apply(force)\n       apply(force)\n      apply(rename_tac i nat nata natb natc)(*strict*)\n      apply(force)\n     apply(rename_tac i nat nata natb natc)(*strict*)\n     apply(force)\n    apply(rename_tac i nat nata natb natc)(*strict*)\n    apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n   apply(rename_tac i nat nata natb natc)(*strict*)\n   apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n  apply(rename_tac i nat nata natb natc)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_edges_have_valid_item_set: \"\n  M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> e \\<in> epda_delta M\n  \\<Longrightarrow> \\<exists>w a. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G') \\<and> e = \\<lparr>edge_src = valid_item_set G' k w, edge_event = Some a, edge_pop = [epda_box (F_LR_MACHINE G' F k)], edge_push = [epda_box (F_LR_MACHINE G' F k)], edge_trg = valid_item_set G' k (w @ [a]) \\<rparr>\"\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G' F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k})\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesOK_prime)\n    apply(force)\n   apply(force)\n  apply(erule_tac\n      x=\"e\"\n      in ballE)\n   apply(subgoal_tac \"\\<exists>w. set w \\<subseteq> (two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')) \\<and> (edge_src e)=valid_item_set G' k w\")\n    prefer 2\n    apply(rule F_LR_MACHINE__fp_one_unfold_03)\n      apply(rule F_LR_MACHINE__fp_one_TERM_ARGS_TEST_initial)\n       apply(force)\n      apply(force)\n     apply(clarsimp)\n     apply(rename_tac y)(*strict*)\n     apply(rule_tac\n      x=\"[]\"\n      in exI)\n     apply(clarsimp)\n     apply(rule sym)\n     apply(rule Lemma6__23_1)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(erule exE)+\n   apply(rename_tac w)(*strict*)\n   apply(erule conjE)+\n   apply(erule exE)+\n   apply(rename_tac w y)(*strict*)\n   apply(erule conjE)+\n   apply(rule_tac\n      x=\"w\"\n      in exI)\n   apply(rule_tac\n      x=\"y\"\n      in exI)\n   apply(rule context_conjI)\n    apply(rename_tac w y)(*strict*)\n    apply(force)\n   apply(rename_tac w y)(*strict*)\n   apply(subgoal_tac \"valid_item_set G' k (w @ [y]) = F_VALID_ITEM_SET_GOTO G' F k y (valid_item_set G' k w)\")\n    apply(rename_tac w y)(*strict*)\n    apply(clarsimp)\n    apply(simp add: F_LR_MACHINE_def)\n   apply(rename_tac w y)(*strict*)\n   prefer 2\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rename_tac w y)(*strict*)\n  apply(rule Lemma6__26)\n     apply(rename_tac w y)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac w y)(*strict*)\n   apply(subgoal_tac \"set (w@[y]) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n    apply(rename_tac w y)(*strict*)\n    apply(rule two_elements_construct_domain_setA)\n    apply(force)\n   apply(rename_tac w y)(*strict*)\n   apply(rule two_elements_construct_domain_append)\n    apply(rename_tac w y)(*strict*)\n    apply(force)\n   apply(rename_tac w y)(*strict*)\n   apply(force)\n  apply(rename_tac w y)(*strict*)\n  apply(subgoal_tac \"set (w@[y]) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n   apply(rename_tac w y)(*strict*)\n   apply(rule two_elements_construct_domain_setB)\n   apply(force)\n  apply(rename_tac w y)(*strict*)\n  apply(rule two_elements_construct_domain_append)\n   apply(rename_tac w y)(*strict*)\n   apply(force)\n  apply(rename_tac w y)(*strict*)\n  apply(force)\n  done\n\nlemma uniqueEntryEdgeForReadingDollarInitialDollar: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> q' \\<in> set (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do])\n  \\<Longrightarrow> e1 \\<in> epda_delta M\n  \\<Longrightarrow> e2 \\<in> epda_delta M\n  \\<Longrightarrow> edge_trg e2 = edge_trg e1\n  \\<Longrightarrow> edge_trg e1 = q'\n  \\<Longrightarrow> e1 = e2\"\n  apply(subgoal_tac \"q'\\<noteq>{}\")\n   prefer 2\n   apply(rule nonEmptyStatesViaDoS_primeDo)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"edge_event e1=edge_event e2\")\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      and p=\"q'\"\n      in Theorem6__27_b)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G' F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k})\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesOK_prime)\n    apply(force)\n   apply(force)\n  apply(erule_tac\n      x=\"e1\"\n      in ballE)\n   prefer 2\n   apply(simp add: F_LR_MACHINE_def)\n  apply(subgoal_tac \"\\<forall>x \\<in> snd (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k}). edge_src x \\<in> fst (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k}) \\<and> (\\<exists>y. (edge_event x)=Some y \\<and> y \\<in> (two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')) \\<and> (edge_trg x = F_VALID_ITEM_SET_GOTO G' F k y (edge_src x))) \\<and> (edge_pop x) = [0] \\<and> (edge_push x) = [0] \\<and> edge_trg x \\<in> fst (F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k})\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_edgesOK_prime)\n    apply(force)\n   apply(force)\n  apply(erule_tac\n      x=\"e2\"\n      in ballE)\n   prefer 2\n   apply(simp add: F_LR_MACHINE_def)\n  apply(subgoal_tac \"edge_src e1 = edge_src e2\")\n   apply(case_tac e1)\n   apply(rename_tac edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n   apply(case_tac e2)\n   apply(rename_tac edge_srca edge_eventa edge_popa edge_pusha edge_trga edge_srcaa edge_eventaa edge_popaa edge_pushaa edge_trgaa)(*strict*)\n   apply(clarsimp)\n  apply(erule conjE)+\n  apply(erule exE)+\n  apply(rename_tac y ya)(*strict*)\n  apply(erule conjE)+\n  apply(subgoal_tac \"\\<exists>w a. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G') \\<and> e1=\\<lparr>edge_src = valid_item_set G' k w, edge_event = Some a, edge_pop = [epda_box (F_LR_MACHINE G' F k)], edge_push = [epda_box (F_LR_MACHINE G' F k)], edge_trg = valid_item_set G' k (w @ [a])\\<rparr>\")\n   apply(rename_tac y ya)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_edges_have_valid_item_set)\n      apply(rename_tac y ya)(*strict*)\n      apply(force)\n     apply(rename_tac y ya)(*strict*)\n     apply(force)\n    apply(rename_tac y ya)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac y ya)(*strict*)\n  apply(subgoal_tac \"\\<exists>w a. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G') \\<and> e2=\\<lparr>edge_src = valid_item_set G' k w, edge_event = Some a, edge_pop = [epda_box (F_LR_MACHINE G' F k)], edge_push = [epda_box (F_LR_MACHINE G' F k)], edge_trg = valid_item_set G' k (w @ [a])\\<rparr>\")\n   apply(rename_tac y ya)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_edges_have_valid_item_set)\n      apply(rename_tac y ya)(*strict*)\n      apply(force)\n     apply(rename_tac y ya)(*strict*)\n     apply(force)\n    apply(rename_tac y ya)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac y ya)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac y ya w wa a aa)(*strict*)\n  apply(erule conjE)+\n  apply(subgoal_tac \"y=ya\")\n   apply(rename_tac y ya w wa a aa)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac y ya w wa a aa)(*strict*)\n  apply(subgoal_tac \"valid_item_set G' k w = valid_item_set G' k wa\")\n   apply(rename_tac y ya w wa a aa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y ya w wa a aa)(*strict*)\n  apply(subgoal_tac \"\\<exists>qa. qa= edge_src e2\")\n   apply(rename_tac y ya w wa a aa)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac y ya w wa a aa)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac y ya w wa a aa qa)(*strict*)\n  apply(rename_tac X Xa w wa a aa qa)\n  apply(rename_tac X Xa w wa a aa qa)(*strict*)\n  apply(subgoal_tac \" F_VALID_ITEM_SET_GOTO G' F k Xa qa = valid_item_set G' k [] \\<or> F_VALID_ITEM_SET_GOTO G' F k Xa qa = valid_item_set G' k [teB Do] \\<or> F_VALID_ITEM_SET_GOTO G' F k Xa qa = valid_item_set G' k [teB Do, teA (cfg_initial G)] \\<or> F_VALID_ITEM_SET_GOTO G' F k Xa qa = valid_item_set G' k [teB Do, teA (cfg_initial G), teB Do]\")\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   prefer 2\n   apply(case_tac \"F_VALID_ITEM_SET_GOTO G' F k Xa qa = epda_initial M\")\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    apply(rule disjI1)\n    apply(rule_tac\n      t=\"valid_item_set G' k []\"\n      and s=\"(if []=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) []))\"\n      in ssubst)\n     apply(rename_tac X Xa w wa a aa qa)(*strict*)\n     apply(rule F_LR_MACHINE_all_SOUND)\n           apply(rename_tac X Xa w wa a aa qa)(*strict*)\n           apply(force)\n          apply(rename_tac X Xa w wa a aa qa)(*strict*)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa)(*strict*)\n      apply(force)\n     apply(rename_tac X Xa w wa a aa qa)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(subgoal_tac \"\\<exists>i. i<(length((F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]))) \\<and> F_VALID_ITEM_SET_GOTO G' F k Xa qa = (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do])!i\")\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    prefer 2\n    apply(rule_tac\n      b=\"epda_initial M\"\n      in hasPositionInSet)\n     apply(rename_tac X Xa w wa a aa qa)(*strict*)\n     apply(force)\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(erule exE)\n   apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n   apply(erule conjE)\n   apply(subgoal_tac \"i<3\")\n    apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n    prefer 2\n    apply(rule_tac\n      t=\"3\"\n      and s=\"length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do])\"\n      in ssubst)\n     apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n     apply(rule_tac\n      t=\"length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do])\"\n      and s=\"length ([teB Do, teA (cfg_initial G), teB Do])\"\n      in ssubst)\n      apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n      apply(rule sym)\n      apply(rule_tac\n      q=\"(epda_initial M)\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n           apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n           apply(force)\n          apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n         apply(rule F_LR_MACHINE_all_Connected)\n            apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n            prefer 3\n            apply(force)\n           apply(force)\n          apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n        apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n       apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n       apply(rule set_take_head2)\n        apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n        apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def)\n       apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n       apply(rule set_take_head2)\n        apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n        apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def valid_cfg_def)\n       apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n       apply(rule set_take_head2)\n        apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n        apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def)\n       apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n      apply(force)\n     apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n     apply(force)\n    apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n   apply(thin_tac \"i < length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do])\")\n   apply(subgoal_tac \"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do] ! i = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (take (Suc i) [teB Do, teA (cfg_initial G), teB Do]))\")\n    apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n    prefer 2\n    apply(rule nth_last_commutes_over_F_DFA_GOTO_SEQUENCE)\n         apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n       apply(rule F_LR_MACHINE_all_Connected)\n          apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n          prefer 3\n          apply(force)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n      apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n     apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n     apply(force)\n    apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n    apply(rule set_take_head2)\n     apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n     apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def)\n    apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n    apply(rule set_take_head2)\n     apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n     apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def valid_cfg_def)\n    apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n    apply(rule set_take_head2)\n     apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n     apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def)\n    apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n   apply(subgoal_tac \"F_VALID_ITEM_SET_GOTO G' F k Xa qa = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (take (Suc i) [teB Do, teA (cfg_initial G), teB Do]))\")\n    apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n   apply(thin_tac \"F_VALID_ITEM_SET_GOTO G' F k Xa qa = F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do] ! i\")\n   apply(case_tac i)\n    apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n    apply(rule disjI2, rule disjI1)\n    apply(rule_tac\n      t=\"valid_item_set G' k [teB Do]\"\n      and s=\"(if [teB Do]=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]))\"\n      in ssubst)\n     apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n     apply(rule F_LR_MACHINE_all_SOUND)\n           apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n           apply(force)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n      apply(force)\n     apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n     apply(simp add: F_CFG_AUGMENT_def)\n    apply(rename_tac X Xa w wa a aa qa i)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa i nat)(*strict*)\n   apply(case_tac nat)\n    apply(rename_tac X Xa w wa a aa qa i nat)(*strict*)\n    apply(rule disjI2, rule disjI2, rule disjI1)\n    apply(rule_tac\n      t=\"valid_item_set G' k [teB Do, teA (cfg_initial G)]\"\n      and s=\"(if [teB Do, teA (cfg_initial G)]=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]))\"\n      in ssubst)\n     apply(rename_tac X Xa w wa a aa qa i nat)(*strict*)\n     apply(rule F_LR_MACHINE_all_SOUND)\n           apply(rename_tac X Xa w wa a aa qa i nat)(*strict*)\n           apply(force)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa i nat)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa i nat)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa i nat)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa i nat)(*strict*)\n      apply(simp add: F_CFG_AUGMENT_def valid_cfg_def)\n     apply(rename_tac X Xa w wa a aa qa i nat)(*strict*)\n     apply(simp add: F_CFG_AUGMENT_def valid_cfg_def)\n    apply(rename_tac X Xa w wa a aa qa i nat)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa i nat nata)(*strict*)\n   apply(rule disjI2, rule disjI2, rule disjI2)\n   apply(rule_tac\n      t=\"valid_item_set G' k [teB Do, teA (cfg_initial G), teB Do]\"\n      and s=\"(if [teB Do, teA (cfg_initial G), teB Do]=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]))\"\n      in ssubst)\n    apply(rename_tac X Xa w wa a aa qa i nat nata)(*strict*)\n    apply(rule F_LR_MACHINE_all_SOUND)\n          apply(rename_tac X Xa w wa a aa qa i nat nata)(*strict*)\n          apply(force)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa i nat nata)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa i nat nata)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa i nat nata)(*strict*)\n      apply(force)\n     apply(rename_tac X Xa w wa a aa qa i nat nata)(*strict*)\n     apply(simp add: F_CFG_AUGMENT_def valid_cfg_def)\n    apply(rename_tac X Xa w wa a aa qa i nat nata)(*strict*)\n    apply(simp add: F_CFG_AUGMENT_def valid_cfg_def)\n   apply(rename_tac X Xa w wa a aa qa i nat nata)(*strict*)\n   apply(force)\n  apply(rename_tac X Xa w wa a aa qa)(*strict*)\n  apply(thin_tac \"q' \\<in> set (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do])\")\n  apply(rename_tac X Xa w wa a aa qa)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(rule_tac\n      q=\"qa\"\n      in F_VALID_ITEM_SET_GOTO_to_1)\n             apply(rename_tac X Xa w wa a aa qa)(*strict*)\n             apply(force)\n            apply(rename_tac X Xa w wa a aa qa)(*strict*)\n            apply(force)\n           apply(rename_tac X Xa w wa a aa qa)(*strict*)\n           apply(force)\n          apply(rename_tac X Xa w wa a aa qa)(*strict*)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa)(*strict*)\n      apply(force)\n     apply(force)\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    apply(rule_tac\n      t=\"epda_states (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k)\"\n      and s=\"{valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\"\n      in ssubst)\n     apply(rename_tac X Xa w wa a aa qa)(*strict*)\n     apply(simp only: LRM_contains_theEqClasses)\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(force)\n  apply(rename_tac X Xa w wa a aa qa)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(subgoal_tac \"valid_item_set G' k wa=valid_item_set G' k [] \\<and> X=teB Do\")\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    prefer 2\n    apply(rule F_VALID_ITEM_SET_GOTO_to_2)\n              apply(rename_tac X Xa w wa a aa qa)(*strict*)\n              apply(force)\n             apply(force)\n            apply(rename_tac X Xa w wa a aa qa)(*strict*)\n            apply(force)\n           apply(rename_tac X Xa w wa a aa qa)(*strict*)\n           apply(force)\n          apply(rename_tac X Xa w wa a aa qa)(*strict*)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa)(*strict*)\n      apply(force)\n     apply(rename_tac X Xa w wa a aa qa)(*strict*)\n     apply(force)\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(subgoal_tac \"valid_item_set G' k w=valid_item_set G' k [] \\<and> X=teB Do\")\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    prefer 2\n    apply(rule F_VALID_ITEM_SET_GOTO_to_2)\n              apply(rename_tac X Xa w wa a aa qa)(*strict*)\n              apply(force)\n             apply(force)\n            apply(rename_tac X Xa w wa a aa qa)(*strict*)\n            apply(force)\n           apply(rename_tac X Xa w wa a aa qa)(*strict*)\n           apply(force)\n          apply(rename_tac X Xa w wa a aa qa)(*strict*)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa)(*strict*)\n      apply(force)\n     apply(rename_tac X Xa w wa a aa qa)(*strict*)\n     apply(force)\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(force)\n  apply(rename_tac X Xa w wa a aa qa)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(subgoal_tac \"valid_item_set G' k wa=valid_item_set G' k [teB Do] \\<and> X=teA (cfg_initial G)\")\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    prefer 2\n    apply(rule F_VALID_ITEM_SET_GOTO_to_3)\n              apply(rename_tac X Xa w wa a aa qa)(*strict*)\n              apply(force)\n             apply(force)\n            apply(rename_tac X Xa w wa a aa qa)(*strict*)\n            apply(force)\n           apply(rename_tac X Xa w wa a aa qa)(*strict*)\n           apply(force)\n          apply(rename_tac X Xa w wa a aa qa)(*strict*)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa)(*strict*)\n      apply(force)\n     apply(rename_tac X Xa w wa a aa qa)(*strict*)\n     apply(force)\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(subgoal_tac \"valid_item_set G' k w=valid_item_set G' k [teB Do] \\<and> X=teA (cfg_initial G)\")\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    prefer 2\n    apply(rule F_VALID_ITEM_SET_GOTO_to_3)\n              apply(rename_tac X Xa w wa a aa qa)(*strict*)\n              apply(force)\n             apply(force)\n            apply(rename_tac X Xa w wa a aa qa)(*strict*)\n            apply(force)\n           apply(rename_tac X Xa w wa a aa qa)(*strict*)\n           apply(force)\n          apply(rename_tac X Xa w wa a aa qa)(*strict*)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa)(*strict*)\n      apply(force)\n     apply(rename_tac X Xa w wa a aa qa)(*strict*)\n     apply(force)\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(force)\n  apply(rename_tac X Xa w wa a aa qa)(*strict*)\n  apply(subgoal_tac \"valid_item_set G' k wa=valid_item_set G' k [teB Do, teA(cfg_initial G)] \\<and> X=teB Do\")\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   prefer 2\n   apply(rule F_VALID_ITEM_SET_GOTO_to_4)\n             apply(rename_tac X Xa w wa a aa qa)(*strict*)\n             apply(force)\n            apply(force)\n           apply(rename_tac X Xa w wa a aa qa)(*strict*)\n           apply(force)\n          apply(rename_tac X Xa w wa a aa qa)(*strict*)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa)(*strict*)\n      apply(force)\n     apply(rename_tac X Xa w wa a aa qa)(*strict*)\n     apply(force)\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(force)\n  apply(rename_tac X Xa w wa a aa qa)(*strict*)\n  apply(subgoal_tac \"valid_item_set G' k w=valid_item_set G' k [teB Do, teA(cfg_initial G)] \\<and> X=teB Do\")\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   prefer 2\n   apply(rule F_VALID_ITEM_SET_GOTO_to_4)\n             apply(rename_tac X Xa w wa a aa qa)(*strict*)\n             apply(force)\n            apply(force)\n           apply(rename_tac X Xa w wa a aa qa)(*strict*)\n           apply(force)\n          apply(rename_tac X Xa w wa a aa qa)(*strict*)\n          apply(force)\n         apply(rename_tac X Xa w wa a aa qa)(*strict*)\n         apply(force)\n        apply(rename_tac X Xa w wa a aa qa)(*strict*)\n        apply(force)\n       apply(rename_tac X Xa w wa a aa qa)(*strict*)\n       apply(force)\n      apply(rename_tac X Xa w wa a aa qa)(*strict*)\n      apply(force)\n     apply(rename_tac X Xa w wa a aa qa)(*strict*)\n     apply(force)\n    apply(rename_tac X Xa w wa a aa qa)(*strict*)\n    apply(force)\n   apply(rename_tac X Xa w wa a aa qa)(*strict*)\n   apply(force)\n  apply(rename_tac X Xa w wa a aa qa)(*strict*)\n  apply(force)\n  done\n\nlemma ReadInitialIsEmpty: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> q = F_DFA_GOTO M (epda_initial M) (teA (cfg_initial G))\n  \\<Longrightarrow> q = {}\"\n  apply(rule_tac\n      t=\"q\"\n      and s=\"F_DFA_GOTO M (epda_initial M) (teA (cfg_initial G))\"\n      in ssubst)\n   apply(force)\n  apply(rule_tac\n      t=\"F_DFA_GOTO M (epda_initial M) (teA (cfg_initial G))\"\n      and s=\"last [F_DFA_GOTO M (epda_initial M) (teA (cfg_initial G))]\"\n      in ssubst)\n   apply(force)\n  apply(rule_tac\n      t=\"[F_DFA_GOTO M (epda_initial M) (teA (cfg_initial G))]\"\n      and s=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teA (cfg_initial G)]\"\n      in ssubst)\n   apply(rule sym)\n   apply(rule DFA_F_DFA_GOTO_SEQUENCE_to_F_DFA_GOTO)\n       apply(force)\n      apply(force)\n     apply(rule F_LR_MACHINE_all_Connected)\n        prefer 3\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n   apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def valid_cfg_def)\n  apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teA (cfg_initial G)])\"\n      and s=\"valid_item_set G' k [teA (cfg_initial G)]\"\n      in subst)\n   apply(rule_tac\n      G=\"G'\"\n      in F_LR_MACHINE_all_SOUND_NotNil)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(rule two_elements_construct_domain_setA)\n     apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def valid_cfg_def)\n    apply(rule_tac\n      A=\"cfg_nonterminals G'\"\n      in two_elements_construct_domain_setB)\n    apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def valid_cfg_def)\n   apply(force)\n  apply(case_tac \"\\<exists>I. I \\<in> valid_item_set G' k [teA (cfg_initial G)]\")\n   prefer 2\n   apply(force)\n  apply(erule exE)+\n  apply(rename_tac I)(*strict*)\n  apply(subgoal_tac \"\\<exists>n. I \\<in> valid_item_set_n G' k n [teA (cfg_initial G)]\")\n   apply(rename_tac I)(*strict*)\n   prefer 2\n   apply(simp add: valid_item_set_def)\n  apply(rename_tac I)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac I n)(*strict*)\n  apply(subgoal_tac \"\\<forall>A \\<alpha> \\<beta> y. I = \\<lparr>cfg_item_lhs = A, cfg_item_rhs1 = \\<alpha>, cfg_item_rhs2 = \\<beta>, cfg_item_look_ahead = y\\<rparr> \\<longrightarrow> (\\<exists>d \\<delta> e1 e2 z. cfgRM.derivation G' d \\<and> d 0 = Some (pair None \\<lparr>cfg_conf=[teA (cfg_initial G')]\\<rparr>) \\<and> d n = Some (pair e1 \\<lparr>cfg_conf=\\<delta>@[teA A]@z\\<rparr>) \\<and> d (Suc n) = Some (pair e2 \\<lparr>cfg_conf=\\<delta>@\\<alpha>@\\<beta>@z\\<rparr>) \\<and> take k z=liftB y \\<and> [teA (cfg_initial G)]=\\<delta>@\\<alpha> \\<and> maximum_of_domain d (Suc n) \\<and> setA z = {})\")\n   apply(rename_tac I n)(*strict*)\n   prefer 2\n   apply(simp add: valid_item_set_n_def)\n   apply(clarsimp)\n   apply(rename_tac n Aa \\<alpha>' \\<beta>' ya d \\<delta> e1 e2 z)(*strict*)\n   apply(rule_tac\n      x=\"d\"\n      in exI)\n   apply(clarsimp)\n  apply(rename_tac I n)(*strict*)\n  apply(thin_tac \"I \\<in> valid_item_set G' k [teA (cfg_initial G)]\")\n  apply(thin_tac \"I \\<in> valid_item_set_n G' k n [teA (cfg_initial G)]\")\n  apply(subgoal_tac \"False\")\n   apply(rename_tac I n)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac I n)(*strict*)\n  apply(erule_tac\n      x=\"cfg_item_lhs I\"\n      in allE)\n  apply(erule_tac\n      x=\"cfg_item_rhs1 I\"\n      in allE)\n  apply(erule_tac\n      x=\"cfg_item_rhs2 I\"\n      in allE)\n  apply(erule_tac\n      x=\"cfg_item_look_ahead I\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac I n)(*strict*)\n   apply(force)\n  apply(rename_tac I n)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n  apply(erule conjE)+\n  apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>)\")\n   apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n   prefer 2\n   apply(rule F_CFG_AUGMENT__FirstStep)\n          apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n          apply(force)\n         apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n         apply(force)\n        apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n        apply(force)\n       apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n       apply(force)\n      apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n      apply(force)\n     apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(force)\n    apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n    apply(force)\n   apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n   apply(blast)\n  apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n  apply(subgoal_tac \"\\<exists>e w. d (Suc n) = Some (pair e \\<lparr>cfg_conf = teB Do # w\\<rparr>)\")\n   apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      and m=\"Suc 0\"\n      and n=\"n\"\n      in terminal_at_beginning_are_never_modified)\n       apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n       apply(rule cfgRM_derivations_are_cfg_derivations)\n       apply(force)\n      apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n      apply(force)\n     apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n     apply(force)\n    apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n    apply(force)\n   apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n   apply(force)\n  apply(rename_tac I n d \\<delta> e1 e2 z)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac I n d \\<delta> e1 e2 z e w)(*strict*)\n  apply(subgoal_tac \"\\<exists>e w. d (Suc n) = Some (pair e \\<lparr>cfg_conf = teB Do # w @ [teB Do]\\<rparr>) \\<and> (set w) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \")\n   apply(rename_tac I n d \\<delta> e1 e2 z e w)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc 0\"\n      and n=\"n\"\n      in cfgRM.property_preseved_under_steps_is_invariant2)\n       apply(rename_tac I n d \\<delta> e1 e2 z e w)(*strict*)\n       apply(force)\n      apply(rename_tac I n d \\<delta> e1 e2 z e w)(*strict*)\n      apply(rule_tac\n      x=\"Some\\<lparr>prod_lhs = cfg_initial G', prod_rhs = [teB Do, teA (cfg_initial G), teB Do]\\<rparr>\"\n      in exI)\n      apply(rule_tac\n      x=\"[teA (cfg_initial G)]\"\n      in exI)\n      apply(rule conjI)\n       apply(rename_tac I n d \\<delta> e1 e2 z e w)(*strict*)\n       apply(clarsimp)\n      apply(rename_tac I n d \\<delta> e1 e2 z e w)(*strict*)\n      apply(thin_tac \"[teA (cfg_initial G)] = \\<delta> @ cfg_item_rhs1 I\")\n      apply(simp add: two_elements_construct_domain_def valid_cfg_def)\n     apply(rename_tac I n d \\<delta> e1 e2 z e w)(*strict*)\n     apply(force)\n    apply(rename_tac I n d \\<delta> e1 e2 z e w)(*strict*)\n    apply(force)\n   apply(rename_tac I n d \\<delta> e1 e2 z e w)(*strict*)\n   apply(rule allI)\n   apply(rename_tac I n d \\<delta> e1 e2 z e w i)(*strict*)\n   apply(rule impI)\n   apply(erule conjE)+\n   apply(erule exE)+\n   apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa)(*strict*)\n   apply(erule conjE)+\n   apply(subgoal_tac \"\\<exists>e c. d (Suc i) = Some (pair (Some e) c)\")\n    apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa)(*strict*)\n    prefer 2\n    apply(rule cfgRM.some_position_has_details_before_max_dom_after_0)\n      apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa)(*strict*)\n      apply(blast)\n     apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa)(*strict*)\n     apply(blast)\n    apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa)(*strict*)\n    apply(arith)\n   apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa eb c)(*strict*)\n   apply(subgoal_tac \"cfgRM_step_relation G' \\<lparr>cfg_conf = teB Do # wa @ [teB Do]\\<rparr> eb c\")\n    apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa eb c)(*strict*)\n    prefer 2\n    apply(rule cfgRM.position_change_due_to_step_relation)\n      apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa eb c)(*strict*)\n      apply(blast)\n     apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa eb c)(*strict*)\n     apply(blast)\n    apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa eb c)(*strict*)\n    apply(blast)\n   apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa eb c)(*strict*)\n   apply(case_tac c)\n   apply(rename_tac I n d \\<delta> e1 e2 z e w i ea wa eb c cfg_conf)(*strict*)\n   apply(simp add: cfgRM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac I n d \\<delta> e1 e2 z w i ea wa eb l r)(*strict*)\n   apply(case_tac l)\n    apply(rename_tac I n d \\<delta> e1 e2 z w i ea wa eb l r)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac I n d \\<delta> e1 e2 z w i ea wa eb l r a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac I n d \\<delta> e1 e2 z w i ea wa eb r list)(*strict*)\n   apply(case_tac \"r=[]\")\n    apply(rename_tac I n d \\<delta> e1 e2 z w i ea wa eb r list)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac I n d \\<delta> e1 e2 z w i ea wa eb r list)(*strict*)\n   apply(subgoal_tac \"\\<exists>r' a. r=r'@[a]\")\n    apply(rename_tac I n d \\<delta> e1 e2 z w i ea wa eb r list)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac I n d \\<delta> e1 e2 z w i ea eb list r' x)(*strict*)\n    apply(subgoal_tac \"eb \\<in> cfg_productions G\")\n     apply(rename_tac I n d \\<delta> e1 e2 z w i ea eb list r' x)(*strict*)\n     apply(simp add: valid_cfg_def)\n     apply(clarsimp)\n     apply(erule_tac\n      x=\"eb\"\n      and P=\"\\<lambda>eb. prod_lhs eb \\<in> cfg_nonterminals G \\<and> setA (prod_rhs eb) \\<subseteq> cfg_nonterminals G \\<and> setB (prod_rhs eb) \\<subseteq> cfg_events G\"\n      in ballE)\n      apply(rename_tac I n d \\<delta> e1 e2 z w i ea eb list r' x)(*strict*)\n      apply(clarsimp)\n      apply(rule_tac\n      A=\"set(prod_rhs eb)\"\n      in set_mp)\n       apply(rename_tac I n d \\<delta> e1 e2 z w i ea eb list r' x)(*strict*)\n       apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n        apply(rename_tac I n d \\<delta> e1 e2 z w i ea eb list r' x)(*strict*)\n        apply(force)\n       apply(rename_tac I n d \\<delta> e1 e2 z w i ea eb list r' x)(*strict*)\n       apply(force)\n      apply(rename_tac I n d \\<delta> e1 e2 z w i ea eb list r' x)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac I n d \\<delta> e1 e2 z w i ea eb list r' x)(*strict*)\n     apply(force)\n    apply(rename_tac I n d \\<delta> e1 e2 z w i ea eb list r' x)(*strict*)\n    apply(simp add: F_CFG_AUGMENT_def)\n    apply(clarsimp)\n    apply(rename_tac I n d \\<delta> e1 e2 z w i ea list r' x)(*strict*)\n    apply(subgoal_tac \"teA (F_FRESH (cfg_nonterminals G)) \\<notin> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n     apply(rename_tac I n d \\<delta> e1 e2 z w i ea list r' x)(*strict*)\n     apply(force)\n    apply(rename_tac I n d \\<delta> e1 e2 z w i ea list r' x)(*strict*)\n    apply(thin_tac \"teA (F_FRESH (cfg_nonterminals G)) \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n    apply(simp add: two_elements_construct_domain_def)\n    apply(rule conjI)\n     apply(rename_tac I n d \\<delta> e1 e2 z w i ea list r' x)(*strict*)\n     prefer 2\n     apply(clarsimp)\n    apply(rename_tac I n d \\<delta> e1 e2 z w i ea list r' x)(*strict*)\n    apply(rule teA_notInMap)\n    apply(rule F_FRESH_is_fresh)\n    apply(simp add: valid_cfg_def)\n   apply(rename_tac I n d \\<delta> e1 e2 z w i ea wa eb r list)(*strict*)\n   apply(rule_tac\n      n=\"length r - 1\"\n      in NonEmptyListHasTailElem)\n   apply(case_tac r)\n    apply(rename_tac I n d \\<delta> e1 e2 z w i ea wa eb r list)(*strict*)\n    apply(force)\n   apply(rename_tac I n d \\<delta> e1 e2 z w i ea wa eb r list a lista)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac I n d \\<delta> e1 e2 z e w)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac I n d \\<delta> e1 e2 z wa)(*strict*)\n  apply(subgoal_tac \"[teA (cfg_initial G)] @ cfg_item_rhs2 I @ z = teB (F_FRESH (cfg_events G)) # wa @ [teB (F_FRESH (cfg_events G))]\")\n   apply(rename_tac I n d \\<delta> e1 e2 z wa)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"[teA (cfg_initial G)]\"\n      and s=\"\\<delta> @ cfg_item_rhs1 I\"\n      in ssubst)\n    apply(rename_tac I n d \\<delta> e1 e2 z wa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac I n d \\<delta> e1 e2 z wa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac I n d \\<delta> e1 e2 z wa)(*strict*)\n  apply(thin_tac \"[teA (cfg_initial G)] = \\<delta> @ cfg_item_rhs1 I\")\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_states_are_sets_of_items: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> q \\<subseteq> (Collect (valid_item G' k))\"\n  apply(subgoal_tac \"\\<exists>w. q=valid_item_set G' k w \\<and> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n   prefer 2\n   apply(subgoal_tac \"epda_states M = {valid_item_set G' k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\")\n    apply(force)\n   apply(rule LRM_contains_theEqClasses)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(erule exE)\n  apply(rename_tac w)(*strict*)\n  apply(rule_tac\n      t=\"q\"\n      and s=\"valid_item_set G' k w\"\n      in ssubst)\n   apply(rename_tac w)(*strict*)\n   apply(force)\n  apply(rename_tac w)(*strict*)\n  apply(rule subsetI)\n  apply(rename_tac w x)(*strict*)\n  apply(clarsimp)\n  apply(rule Fact6_12__2)\n   apply(rename_tac w x)(*strict*)\n   apply(force)\n  apply(rename_tac w x)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_shifted_item_in_next_state: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> valid_item G' k I\n  \\<Longrightarrow> I \\<in> q\n  \\<Longrightarrow> cfg_item_rhs2 I = a # w\n  \\<Longrightarrow> J = I\\<lparr>cfg_item_rhs1 := cfg_item_rhs1 I @ [a], cfg_item_rhs2 := w\\<rparr>\n  \\<Longrightarrow> q' = F_DFA_GOTO M q a\n  \\<Longrightarrow> J \\<in> q'\"\n  apply(subgoal_tac \"q \\<subseteq> (Collect (valid_item G' k))\")\n   prefer 2\n   apply(rule F_LR_MACHINE_states_are_sets_of_items)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule_tac\n      t=\"q'\"\n      and s=\"F_VALID_ITEM_SET_GOTO G' F k a q\"\n      in subst)\n   apply(rule_tac\n      t=\"q'\"\n      and s=\"F_DFA_GOTO (F_LR_MACHINE G' F k) q a\"\n      in subst)\n    apply(force)\n   apply(rule F_VALID_ITEM_SET_GOTO_vs_F_DFA_GOTO_in_F_LR_MACHINE)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(rule_tac\n      A=\"set (a#w)\"\n      in set_mp)\n     apply(rule Item_rhs2_in_CFG)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO G' F k a q\"\n      and s=\"F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_GOTO__basis a q)\"\n      in ssubst)\n   apply(simp add: F_VALID_ITEM_SET_GOTO_def)\n  apply(rule_tac\n      A=\"F_VALID_ITEM_SET_GOTO__basis a q\"\n      in set_mp)\n   apply(rule F_VALID_ITEM_SET_GOTO__descent__fp_mono)\n     apply(force)\n    apply(rule F_VALID_ITEM_SET_GOTO__basis_preserves_item_set)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"\\<exists>I1 \\<in> q. F_VALID_ITEM_SET_GOTO__passes a I1 J\")\n   apply(simp add: F_VALID_ITEM_SET_GOTO__basis_def)\n  apply(rule_tac\n      x=\"I\"\n      in bexI)\n   apply(simp add: F_VALID_ITEM_SET_GOTO__passes_def)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_connected: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> \\<exists>w. last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) w) = q \\<and> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\"\n  apply(subgoal_tac \"\\<exists>w. q=valid_item_set G k w \\<and> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n   prefer 2\n   apply(subgoal_tac \"epda_states M = {valid_item_set G k w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)}\")\n    apply(force)\n   apply(rule LRM_contains_theEqClasses)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(erule exE)+\n  apply(rename_tac w)(*strict*)\n  apply(rule_tac\n      x=\"w\"\n      in exI)\n  apply(subgoal_tac \"length w = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\")\n   apply(rename_tac w)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"M\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac w)(*strict*)\n        apply(force)\n       apply(rename_tac w)(*strict*)\n       apply(force)\n      apply(rename_tac w)(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac w)(*strict*)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(rename_tac w)(*strict*)\n       apply(force)\n      apply(rename_tac w)(*strict*)\n      apply(force)\n     apply(rename_tac w)(*strict*)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(rename_tac w)(*strict*)\n    apply(simp add: F_LR_MACHINE_def)\n   apply(rename_tac w)(*strict*)\n   apply(force)\n  apply(rename_tac w)(*strict*)\n  apply(case_tac w)\n   apply(rename_tac w)(*strict*)\n   apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      and s=\"epda_initial M\"\n      in ssubst)\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(rule_tac\n      t=\"epda_initial M\"\n      and s=\"valid_item_set G k w\"\n      in subst)\n    apply(rename_tac w)(*strict*)\n    apply(rule F_LR_MACHINE_all_SOUND_Nil)\n           apply(rename_tac w)(*strict*)\n           apply(force)\n          apply(rename_tac w)(*strict*)\n          apply(force)\n         apply(rename_tac w)(*strict*)\n         apply(force)\n        apply(rename_tac w)(*strict*)\n        apply(force)\n       apply(rename_tac w)(*strict*)\n       apply(force)\n      apply(rename_tac w)(*strict*)\n      apply(force)\n     apply(rename_tac w)(*strict*)\n     apply(force)\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac w a list)(*strict*)\n  apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      in ssubst)\n   apply(rename_tac w a list)(*strict*)\n   apply(force)\n  apply(rename_tac w a list)(*strict*)\n  apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      and s=\"valid_item_set G k w\"\n      in subst)\n   apply(rename_tac w a list)(*strict*)\n   apply(rule F_LR_MACHINE_all_SOUND_NotNil)\n          apply(rename_tac w a list)(*strict*)\n          apply(force)+\n     apply(rename_tac w a list)(*strict*)\n     apply(rule two_elements_construct_domain_setA)\n     apply(force)\n    apply(rename_tac w a list)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(force)\n   apply(rename_tac w a list)(*strict*)\n   apply(force)\n  apply(rename_tac w a list)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_shifted_item_in_next_states: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> I \\<in> q\n  \\<Longrightarrow> n \\<le> length (cfg_item_rhs2 I)\n  \\<Longrightarrow> J = I\\<lparr>cfg_item_rhs1 := cfg_item_rhs1 I @ (take n (cfg_item_rhs2 I)), cfg_item_rhs2 := drop n (cfg_item_rhs2 I) \\<rparr>\n  \\<Longrightarrow> q' = last (q # F_DFA_GOTO_SEQUENCE M q (take n (cfg_item_rhs2 I)))\n  \\<Longrightarrow> J \\<in> q'\"\n  apply(case_tac n)\n   apply(rule_tac\n      t=\"J\"\n      and s=\"I\"\n      in ssubst)\n    apply(force)\n   apply(rule_tac\n      t=\"q'\"\n      and s=\"q\"\n      in ssubst)\n    apply(rule_tac\n      t=\"q'\"\n      and s=\"last (q # F_DFA_GOTO_SEQUENCE M q (take 0 (cfg_item_rhs2 I)))\"\n      in ssubst)\n     apply(force)\n    apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M q (take 0 (cfg_item_rhs2 I))\"\n      and s=\"[]\"\n      in ssubst)\n     apply(subgoal_tac \"length [] = length (F_DFA_GOTO_SEQUENCE M q [])\")\n      prefer 2\n      apply(rule_tac\n      w=\"[]\"\n      and q=\"q\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n           apply(force)\n          apply(force)\n         apply(rule F_LR_MACHINE_all_Connected)\n            prefer 3\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(subgoal_tac \"q \\<subseteq> (Collect (valid_item G' k))\")\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(rule F_LR_MACHINE_states_are_sets_of_items)\n          apply(rename_tac nat)(*strict*)\n          apply(force)\n         apply(rename_tac nat)(*strict*)\n         apply(force)\n        apply(rename_tac nat)(*strict*)\n        apply(force)\n       apply(rename_tac nat)(*strict*)\n       apply(force)\n      apply(rename_tac nat)(*strict*)\n      apply(force)\n     apply(rename_tac nat)(*strict*)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(subgoal_tac \"valid_item G' k I\")\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(subgoal_tac \"length (take n (cfg_item_rhs2 I)) = length (F_DFA_GOTO_SEQUENCE M q (take n (cfg_item_rhs2 I)))\")\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      w=\"(take n (cfg_item_rhs2 I))\"\n      and q=\"q\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac nat)(*strict*)\n        apply(force)\n       apply(rename_tac nat)(*strict*)\n       apply(force)\n      apply(rename_tac nat)(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac nat)(*strict*)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(rename_tac nat)(*strict*)\n       apply(force)\n      apply(rename_tac nat)(*strict*)\n      apply(force)\n     apply(rename_tac nat)(*strict*)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(rule_tac\n      B=\"set (cfg_item_rhs2 I)\"\n      in subset_trans)\n     apply(rename_tac nat)(*strict*)\n     apply(rule set_take_subset)\n    apply(rename_tac nat)(*strict*)\n    apply(rule_tac\n      t=\"epda_events (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k)\"\n      and s=\"two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\"\n      in ssubst)\n     apply(rename_tac nat)(*strict*)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rename_tac nat)(*strict*)\n    apply(rule Item_rhs2_in_CFG)\n      apply(rename_tac nat)(*strict*)\n      apply(force)\n     apply(rename_tac nat)(*strict*)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(force)\n   apply(rename_tac nat)(*strict*)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(subgoal_tac \"\\<exists>w. last ((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) w)=q \\<and> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n   apply(rename_tac nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      in F_LR_MACHINE_all_connected)\n        apply(rename_tac nat)(*strict*)\n        apply(force)\n       apply(rename_tac nat)(*strict*)\n       apply(force)\n      apply(rename_tac nat)(*strict*)\n      apply(force)\n     apply(rename_tac nat)(*strict*)\n     apply(force)\n    apply(rename_tac nat)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rename_tac nat)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac nat w)(*strict*)\n  apply(subgoal_tac \"length w = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\")\n   apply(rename_tac nat w)(*strict*)\n   prefer 2\n   apply(rule_tac\n      w=\"w\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac nat w)(*strict*)\n        apply(force)\n       apply(rename_tac nat w)(*strict*)\n       apply(force)\n      apply(rename_tac nat w)(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac nat w)(*strict*)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(rename_tac nat w)(*strict*)\n       apply(force)\n      apply(rename_tac nat w)(*strict*)\n      apply(force)\n     apply(rename_tac nat w)(*strict*)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(rename_tac nat w)(*strict*)\n    apply(simp add: F_LR_MACHINE_def)\n   apply(rename_tac nat w)(*strict*)\n   apply(force)\n  apply(rename_tac nat w)(*strict*)\n  apply(subgoal_tac \"valid_item_set G' k (w@take n (cfg_item_rhs2 I))=q'\")\n   apply(rename_tac nat w)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"q'\"\n      and s=\"last (q # F_DFA_GOTO_SEQUENCE M q (take n (cfg_item_rhs2 I)))\"\n      in subst)\n    apply(rename_tac nat w)(*strict*)\n    apply(force)\n   apply(rename_tac nat w)(*strict*)\n   apply(rule_tac\n      t=\"last (q # F_DFA_GOTO_SEQUENCE M q (take n (cfg_item_rhs2 I)))\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M q (take n (cfg_item_rhs2 I)))\"\n      in ssubst)\n    apply(rename_tac nat w)(*strict*)\n    apply(force)\n   apply(rename_tac nat w)(*strict*)\n   apply(rule_tac\n      t=\"q\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      in ssubst)\n    apply(rename_tac nat w)(*strict*)\n    apply(force)\n   apply(rename_tac nat w)(*strict*)\n   apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)) (take n (cfg_item_rhs2 I)))\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (w@(take n (cfg_item_rhs2 I))))\"\n      in ssubst)\n    apply(rename_tac nat w)(*strict*)\n    apply(case_tac w)\n     apply(rename_tac nat w)(*strict*)\n     apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      and s=\"epda_initial M\"\n      in ssubst)\n      apply(rename_tac nat w)(*strict*)\n      apply(force)\n     apply(rename_tac nat w)(*strict*)\n     apply(force)\n    apply(rename_tac nat w a list)(*strict*)\n    apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      in ssubst)\n     apply(rename_tac nat w a list)(*strict*)\n     apply(force)\n    apply(rename_tac nat w a list)(*strict*)\n    apply(rule F_DFA_GOTO_SEQUENCE_concat)\n           apply(rename_tac nat w a list)(*strict*)\n           apply(force)\n          apply(rename_tac nat w a list)(*strict*)\n          apply(force)\n         apply(rename_tac nat w a list)(*strict*)\n         apply(rule F_LR_MACHINE_all_Connected)\n            apply(rename_tac nat w a list)(*strict*)\n            prefer 3\n            apply(force)\n           apply(force)\n          apply(rename_tac nat w a list)(*strict*)\n          apply(force)\n         apply(rename_tac nat w a list)(*strict*)\n         apply(force)\n        apply(rename_tac nat w a list)(*strict*)\n        apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n       apply(rename_tac nat w a list)(*strict*)\n       apply(simp add: F_LR_MACHINE_def)\n      apply(rename_tac nat w a list)(*strict*)\n      apply(rule_tac\n      B=\"set (cfg_item_rhs2 I)\"\n      in subset_trans)\n       apply(rename_tac nat w a list)(*strict*)\n       apply(rule set_take_subset)\n      apply(rename_tac nat w a list)(*strict*)\n      apply(rule_tac\n      t=\"epda_events M\"\n      and s=\"two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\"\n      in ssubst)\n       apply(rename_tac nat w a list)(*strict*)\n       apply(simp add: F_LR_MACHINE_def)\n      apply(rename_tac nat w a list)(*strict*)\n      apply(rule Item_rhs2_in_CFG)\n        apply(rename_tac nat w a list)(*strict*)\n        apply(force)\n       apply(rename_tac nat w a list)(*strict*)\n       apply(force)\n      apply(rename_tac nat w a list)(*strict*)\n      apply(force)\n     apply(rename_tac nat w a list)(*strict*)\n     apply(force)\n    apply(rename_tac nat w a list)(*strict*)\n    apply(force)\n   apply(rename_tac nat w)(*strict*)\n   apply(rule F_LR_MACHINE_all_SOUND_NotNil)\n          apply(rename_tac nat w)(*strict*)\n          apply(force)\n         apply(rename_tac nat w)(*strict*)\n         apply(force)\n        apply(rename_tac nat w)(*strict*)\n        apply(force)\n       apply(rename_tac nat w)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac nat w)(*strict*)\n     apply(rule two_elements_construct_domain_setA)\n     apply(rule set_concat_subset)\n      apply(rename_tac nat w)(*strict*)\n      apply(force)\n     apply(rename_tac nat w)(*strict*)\n     apply(rule_tac\n      B=\"set (cfg_item_rhs2 I)\"\n      in subset_trans)\n      apply(rename_tac nat w)(*strict*)\n      apply(rule set_take_subset)\n     apply(rename_tac nat w)(*strict*)\n     apply(rule_tac\n      t=\"two_elements_construct_domain (cfg_nonterminals G') (cfg_events (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))))\"\n      and s=\"two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\"\n      in ssubst)\n      apply(rename_tac nat w)(*strict*)\n      apply(force)\n     apply(rename_tac nat w)(*strict*)\n     apply(rule Item_rhs2_in_CFG)\n       apply(rename_tac nat w)(*strict*)\n       apply(force)\n      apply(rename_tac nat w)(*strict*)\n      apply(force)\n     apply(rename_tac nat w)(*strict*)\n     apply(force)\n    apply(rename_tac nat w)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(rule set_concat_subset)\n     apply(rename_tac nat w)(*strict*)\n     apply(force)\n    apply(rename_tac nat w)(*strict*)\n    apply(rule_tac\n      B=\"set (cfg_item_rhs2 I)\"\n      in subset_trans)\n     apply(rename_tac nat w)(*strict*)\n     apply(rule set_take_subset)\n    apply(rename_tac nat w)(*strict*)\n    apply(rule_tac\n      t=\"two_elements_construct_domain (cfg_nonterminals (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G)))) (cfg_events G')\"\n      and s=\"two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\"\n      in ssubst)\n     apply(rename_tac nat w)(*strict*)\n     apply(force)\n    apply(rename_tac nat w)(*strict*)\n    apply(rule Item_rhs2_in_CFG)\n      apply(rename_tac nat w)(*strict*)\n      apply(force)\n     apply(rename_tac nat w)(*strict*)\n     apply(force)\n    apply(rename_tac nat w)(*strict*)\n    apply(force)\n   apply(rename_tac nat w)(*strict*)\n   apply(force)\n  apply(rename_tac nat w)(*strict*)\n  apply(subgoal_tac \"valid_item_set G' k w=q\")\n   apply(rename_tac nat w)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"q\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      in ssubst)\n    apply(rename_tac nat w)(*strict*)\n    apply(force)\n   apply(rename_tac nat w)(*strict*)\n   apply(case_tac w)\n    apply(rename_tac nat w)(*strict*)\n    apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      and s=\"epda_initial M\"\n      in ssubst)\n     apply(rename_tac nat w)(*strict*)\n     apply(force)\n    apply(rename_tac nat w)(*strict*)\n    apply(rule F_LR_MACHINE_all_SOUND_Nil)\n           apply(rename_tac nat w)(*strict*)\n           apply(force)\n          apply(rename_tac nat w)(*strict*)\n          apply(force)\n         apply(rename_tac nat w)(*strict*)\n         apply(force)\n        apply(rename_tac nat w)(*strict*)\n        apply(force)\n       apply(rename_tac nat w)(*strict*)\n       apply(force)\n      apply(rename_tac nat w)(*strict*)\n      apply(force)\n     apply(rename_tac nat w)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac nat w a list)(*strict*)\n   apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      in ssubst)\n    apply(rename_tac nat w a list)(*strict*)\n    apply(force)\n   apply(rename_tac nat w a list)(*strict*)\n   apply(rule F_LR_MACHINE_all_SOUND_NotNil)\n          apply(rename_tac nat w a list)(*strict*)\n          apply(force)\n         apply(rename_tac nat w a list)(*strict*)\n         apply(force)\n        apply(rename_tac nat w a list)(*strict*)\n        apply(force)\n       apply(force)\n      apply(rename_tac nat w a list)(*strict*)\n      apply(force)\n     apply(rename_tac nat w a list)(*strict*)\n     apply(rule two_elements_construct_domain_setA)\n     apply(force)\n    apply(rename_tac nat w a list)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(force)\n   apply(rename_tac nat w a list)(*strict*)\n   apply(force)\n  apply(rename_tac nat w)(*strict*)\n  apply(subgoal_tac \"\\<exists>n. I \\<in> valid_item_set_n G' k n w\")\n   apply(rename_tac nat w)(*strict*)\n   prefer 2\n   apply(simp only: valid_item_set_def)\n   apply(clarsimp)\n  apply(rename_tac nat w)(*strict*)\n  apply(subgoal_tac \"\\<exists>n'. J \\<in> valid_item_set_n G' k n' (w @ take n (cfg_item_rhs2 I))\")\n   apply(rename_tac nat w)(*strict*)\n   apply(rule_tac\n      t=\"q'\"\n      and s=\"valid_item_set G' k (w @ take n (cfg_item_rhs2 I))\"\n      in ssubst)\n    apply(rename_tac nat w)(*strict*)\n    apply(force)\n   apply(rename_tac nat w)(*strict*)\n   apply(erule exE)+\n   apply(rename_tac nat w na n')(*strict*)\n   apply(rule valid_item_set_n_subset_valid_item_set)\n   apply(blast)\n  apply(rename_tac nat w)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac nat w na)(*strict*)\n  apply(rule_tac\n      x=\"na\"\n      in exI)\n  apply(rule_tac\n      t=\"J\"\n      and s=\"\\<lparr>cfg_item_lhs=cfg_item_lhs I, cfg_item_rhs1 = cfg_item_rhs1 I @ take n (cfg_item_rhs2 I), cfg_item_rhs2 = drop n (cfg_item_rhs2 I), cfg_item_look_ahead=cfg_item_look_ahead I\\<rparr>\"\n      in ssubst)\n   apply(rename_tac nat w na)(*strict*)\n   apply(force)\n  apply(rename_tac nat w na)(*strict*)\n  apply(rule Lemma6__24_2)\n  apply(rule_tac\n      t=\"\\<lparr>cfg_item_lhs = cfg_item_lhs I, cfg_item_rhs1 = cfg_item_rhs1 I, cfg_item_rhs2 = take n (cfg_item_rhs2 I) @ drop n (cfg_item_rhs2 I), cfg_item_look_ahead = cfg_item_look_ahead I\\<rparr>\"\n      and s=\"I\"\n      in ssubst)\n   apply(rename_tac nat w na)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat w na)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_LR_MACHINE_Do_in_cfg_events: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> teB Do \\<in> epda_events M\"\n  apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def)\n  done\n\nlemma F_LR_MACHINE_DoS_in_cfg_events: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> set [teB Do, teA (cfg_initial G)] \\<subseteq> epda_events M\"\n  apply(simp add: F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def valid_cfg_def)\n  done\n\nlemma F_LR_MACHINE_has_elem_shifts_back: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> valid_dfa (F_LR_MACHINE G F k)\n  \\<Longrightarrow> some_step_from_every_configuration (F_LR_MACHINE G F k)\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> p \\<in> epda_states M\n  \\<Longrightarrow> a \\<in> epda_events M\n  \\<Longrightarrow> F_DFA_GOTO M p a \\<noteq> {}\n  \\<Longrightarrow> p \\<noteq> {}\"\n  apply(subgoal_tac \"F_VALID_ITEM_SET_GOTO G F k a p \\<noteq> {}\")\n   prefer 2\n   apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO G F k a p\"\n      and s=\"F_DFA_GOTO (F_LR_MACHINE G F k) p a\"\n      in ssubst)\n    apply(rule F_VALID_ITEM_SET_GOTO_vs_F_DFA_GOTO_in_F_LR_MACHINE)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(force)\n   apply(force)\n  apply(case_tac \"p={}\")\n   prefer 2\n   apply(force)\n  apply(subgoal_tac \"F_VALID_ITEM_SET_GOTO G F k a p = {}\")\n   apply(force)\n  apply(simp add: F_VALID_ITEM_SET_GOTO_def)\n  apply(subgoal_tac \"F_VALID_ITEM_SET_GOTO__basis a {}={}\")\n   apply(clarsimp)\n   prefer 2\n   apply(simp add: F_VALID_ITEM_SET_GOTO__basis_def)\n  apply(subgoal_tac \"F_VALID_ITEM_SET_GOTO__descent__fp G F k {} = {}\")\n   apply(force)\n  apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO__descent__fp G F k {}\"\n      and s=\"(if F_VALID_ITEM_SET_GOTO__descent__fp_one_1s G F k SSS = SSS then SSS else F_VALID_ITEM_SET_GOTO__descent__fp G F k (F_VALID_ITEM_SET_GOTO__descent__fp_one_1s G F k SSS))\" for SSS\n      in ssubst)\n   apply(rule F_VALID_ITEM_SET_GOTO__descent__fp.psimps)\n   apply(rule F_VALID_ITEM_SET_GOTO__descent__fp_termination)\n   apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_valid_input_def)\n  apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_one_1s_def)\n  done\n\nlemma F_LR_MACHINE_no_empty_states_when_reading_items: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> q_seq = F_DFA_GOTO_SEQUENCE M q (cfg_item_rhs2 I)\n  \\<Longrightarrow> I \\<in> q\n  \\<Longrightarrow> \\<forall>i < length q_seq. q_seq ! i \\<noteq> {}\"\n  apply(rule_tac\n      t=\"length q_seq\"\n      and s=\"length (cfg_item_rhs2 I)\"\n      in ssubst)\n   prefer 2\n   apply(rule_tac\n      t=\"q_seq\"\n      and s=\"F_DFA_GOTO_SEQUENCE M q (cfg_item_rhs2 I)\"\n      in ssubst)\n    apply(blast)\n   apply(rule allI)\n   apply(rename_tac i)(*strict*)\n   apply(rule impI)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M q (cfg_item_rhs2 I) ! i\"\n      and s=\"(q#F_DFA_GOTO_SEQUENCE M q (cfg_item_rhs2 I)) ! (Suc i)\"\n      in ssubst)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(rule_tac\n      t=\"(q#F_DFA_GOTO_SEQUENCE M q (cfg_item_rhs2 I)) ! (Suc i)\"\n      and s=\"last (q#F_DFA_GOTO_SEQUENCE SSM SSq (take (Suc SSi) SSw))\" for SSM SSq SSi SSw\n      in ssubst)\n    apply(rename_tac i)(*strict*)\n    apply(rule nth_last_commutes_over_F_DFA_GOTO_SEQUENCE_prime)\n         apply(rename_tac i)(*strict*)\n         apply(force)\n        apply(rename_tac i)(*strict*)\n        apply(force)\n       apply(rename_tac i)(*strict*)\n       apply(rule F_LR_MACHINE_all_Connected)\n          apply(rename_tac i)(*strict*)\n          prefer 3\n          apply(force)\n         apply(force)\n        apply(rename_tac i)(*strict*)\n        apply(force)\n       apply(rename_tac i)(*strict*)\n       apply(force)\n      apply(rename_tac i)(*strict*)\n      apply(force)\n     apply(rename_tac i)(*strict*)\n     apply(rule_tac\n      G=\"G'\"\n      in F_LR_MACHINE_item_in_state_rhs2_in_cfg_events)\n         apply(rename_tac i)(*strict*)\n         apply(force)\n        apply(rename_tac i)(*strict*)\n        apply(force)\n       apply(rename_tac i)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(subgoal_tac \"I\\<lparr>cfg_item_rhs1:=cfg_item_rhs1 I @ (take (Suc i) (cfg_item_rhs2 I)), cfg_item_rhs2:=drop (Suc i) (cfg_item_rhs2 I)\\<rparr> \\<in> last (q # F_DFA_GOTO_SEQUENCE M q (take (Suc i) (cfg_item_rhs2 I)))\")\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(rename_tac i)(*strict*)\n   apply(rule_tac\n      n=\"Suc i\"\n      in F_LR_MACHINE_shifted_item_in_next_states)\n                apply(rename_tac i)(*strict*)\n                apply(force)\n               apply(rename_tac i)(*strict*)\n               apply(force)\n              apply(rename_tac i)(*strict*)\n              apply(force)\n             apply(rename_tac i)(*strict*)\n             apply(force)\n            apply(rename_tac i)(*strict*)\n            apply(force)\n           apply(rename_tac i)(*strict*)\n           apply(force)\n          apply(rename_tac i)(*strict*)\n          apply(force)\n         apply(rename_tac i)(*strict*)\n         apply(force)\n        apply(rename_tac i)(*strict*)\n        apply(force)\n       apply(rename_tac i)(*strict*)\n       apply(force)\n      apply(rename_tac i)(*strict*)\n      apply(force)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(force)\n   apply(force)\n  apply(rule sym)\n  apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n       apply(force)\n      apply(force)\n     apply(rule F_LR_MACHINE_all_Connected)\n        prefer 3\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(rule_tac\n      G=\"G'\"\n      in F_LR_MACHINE_item_in_state_rhs2_in_cfg_events)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_nonempty_shifts_back_mult_prime: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> set w \\<subseteq> epda_events M\n  \\<Longrightarrow> (F_DFA_GOTO_SEQUENCE M q w) ! i = {}\n  \\<Longrightarrow> i \\<le> j\n  \\<Longrightarrow> j < length w\n  \\<Longrightarrow> (F_DFA_GOTO_SEQUENCE M q w) ! j = {}\"\n  apply(induct j arbitrary: i)\n   apply(rename_tac i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac j i)(*strict*)\n  apply(case_tac \"i=Suc j\")\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule_tac\n      x=\"i\"\n      in meta_allE)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(subgoal_tac \"F_DFA_GOTO M ((q # (F_DFA_GOTO_SEQUENCE M q w)) ! (Suc j)) (w!(Suc j)) = (F_DFA_GOTO_SEQUENCE M q w) ! (Suc j)\")\n   apply(rename_tac j i)(*strict*)\n   prefer 2\n   apply(subgoal_tac \"\\<forall>i<length SSw. F_DFA_GOTO SSM ((SSq # SSqseq) ! i) (SSw ! i) = SSqseq ! i\" for SSw SSM SSq SSqseq)\n    apply(rename_tac j i)(*strict*)\n    prefer 2\n    apply(rule F_DFA_GOTO_SEQUENCESound_main2)\n         apply(rename_tac j i)(*strict*)\n         apply(force)\n        apply(rename_tac j i)(*strict*)\n        apply(force)\n       apply(rename_tac j i)(*strict*)\n       apply(rule F_LR_MACHINE_all_Connected)\n          apply(rename_tac j i)(*strict*)\n          prefer 3\n          apply(force)\n         apply(force)\n        apply(rename_tac j i)(*strict*)\n        apply(force)\n       apply(rename_tac j i)(*strict*)\n       apply(force)\n      apply(rename_tac j i)(*strict*)\n      apply(force)\n     apply(rename_tac j i)(*strict*)\n     apply(force)\n    apply(rename_tac j i)(*strict*)\n    apply(force)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M q w ! Suc j\"\n      and s=\"F_DFA_GOTO M ((q # F_DFA_GOTO_SEQUENCE M q w) ! Suc j) (w ! Suc j)\"\n      in ssubst)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(rule_tac\n      t=\"F_DFA_GOTO M ((q # F_DFA_GOTO_SEQUENCE M q w) ! Suc j) (w ! Suc j)\"\n      and s=\"F_VALID_ITEM_SET_GOTO G' F k (w!(Suc j)) ((q # F_DFA_GOTO_SEQUENCE M q w) ! Suc j)\"\n      in subst)\n   apply(rename_tac j i)(*strict*)\n   apply(rule_tac\n      t=\"M\"\n      and s=\"F_LR_MACHINE G' F k\"\n      in ssubst)\n    apply(rename_tac j i)(*strict*)\n    apply(force)\n   apply(rename_tac j i)(*strict*)\n   apply(rule F_VALID_ITEM_SET_GOTO_vs_F_DFA_GOTO_in_F_LR_MACHINE)\n        apply(rename_tac j i)(*strict*)\n        apply(force)\n       apply(force)\n      apply(rename_tac j i)(*strict*)\n      apply(force)\n     apply(rename_tac j i)(*strict*)\n     apply(force)\n    apply(rename_tac j i)(*strict*)\n    apply(simp add: F_LR_MACHINE_def)\n    apply(force)\n   apply(rename_tac j i)(*strict*)\n   apply(subgoal_tac \"set (F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G' F k) q w) \\<subseteq> epda_states SSM\" for SSM)\n    apply(rename_tac j i)(*strict*)\n    prefer 2\n    apply(rule F_DFA_GOTO_SEQUENCESound_main3)\n         apply(rename_tac j i)(*strict*)\n         apply(force)\n        apply(rename_tac j i)(*strict*)\n        apply(force)\n       apply(rename_tac j i)(*strict*)\n       apply(rule F_LR_MACHINE_all_Connected)\n          apply(rename_tac j i)(*strict*)\n          prefer 3\n          apply(force)\n         apply(force)\n        apply(rename_tac j i)(*strict*)\n        apply(force)\n       apply(rename_tac j i)(*strict*)\n       apply(force)\n      apply(rename_tac j i)(*strict*)\n      apply(force)\n     apply(rename_tac j i)(*strict*)\n     apply(force)\n    apply(rename_tac j i)(*strict*)\n    apply(force)\n   apply(rename_tac j i)(*strict*)\n   apply(rule_tac\n      t=\"(q # F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G' F k) q w) ! Suc j\"\n      and s=\"(F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G' F k) q w) ! j\"\n      in ssubst)\n    apply(rename_tac j i)(*strict*)\n    apply(force)\n   apply(rename_tac j i)(*strict*)\n   apply(rule_tac\n      A=\"set (F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G' F k) q w)\"\n      in set_mp)\n    apply(rename_tac j i)(*strict*)\n    apply(force)\n   apply(rename_tac j i)(*strict*)\n   apply(rule nth_mem)\n   apply(subgoal_tac \"length w= length (F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G' F k) q w)\")\n    apply(rename_tac j i)(*strict*)\n    apply(force)\n   apply(rename_tac j i)(*strict*)\n   apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac j i)(*strict*)\n        apply(force)\n       apply(rename_tac j i)(*strict*)\n       apply(force)\n      apply(rename_tac j i)(*strict*)\n      apply(rule F_LR_MACHINE_all_Connected)\n         apply(rename_tac j i)(*strict*)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(rename_tac j i)(*strict*)\n       apply(force)\n      apply(rename_tac j i)(*strict*)\n      apply(force)\n     apply(rename_tac j i)(*strict*)\n     apply(force)\n    apply(rename_tac j i)(*strict*)\n    apply(force)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(rule_tac\n      t=\"((q # F_DFA_GOTO_SEQUENCE M q w) ! Suc j)\"\n      and s=\"{}\"\n      in ssubst)\n   apply(rename_tac j i)(*strict*)\n   apply(force)\n  apply(rename_tac j i)(*strict*)\n  apply(simp (no_asm_use) only: F_VALID_ITEM_SET_GOTO_def)\n  apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO__basis (w ! Suc j) {}\"\n      and s=\"{}\"\n      in ssubst)\n   apply(rename_tac j i)(*strict*)\n   apply(simp add: F_VALID_ITEM_SET_GOTO__basis_def)\n  apply(rename_tac j i)(*strict*)\n  apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO__descent__fp G' F k {}\"\n      and s=\"(if F_VALID_ITEM_SET_GOTO__descent__fp_one_1s SSG SSF SSk SSS = SSS then SSS else F_VALID_ITEM_SET_GOTO__descent__fp SSG SSF SSk (F_VALID_ITEM_SET_GOTO__descent__fp_one_1s SSG SSF SSk SSS))\" for SSG SSF SSk SSS\n      in ssubst)\n   apply(rename_tac j i)(*strict*)\n   apply(rule F_VALID_ITEM_SET_GOTO__descent__fp.psimps)\n   apply(rule F_VALID_ITEM_SET_GOTO__descent__fp_termination)\n   apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_valid_input_def)\n  apply(rename_tac j i)(*strict*)\n  apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_one_1s_def)\n  done\n\nlemma rhs1_empty_items_due_to_specific_item: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> q \\<in> (epda_states M)\n  \\<Longrightarrow> \\<forall>I \\<in> q. (cfg_item_lhs I \\<noteq> S' \\<longrightarrow> (cfg_item_rhs1 I = [] \\<longrightarrow> (\\<exists>J. setA (cfg_item_rhs2 J) \\<subseteq> cfg_nonterminals G' \\<and> (\\<exists>w. cfg_item_rhs2 J = teA (cfg_item_lhs I) # w) \\<and> J \\<in> q)))\"\n  apply(rule_tac\n      M=\"M\"\n      and P=\"\\<lambda>q. \\<forall>I \\<in> q. (cfg_item_lhs I\\<noteq>S' \\<longrightarrow> (cfg_item_rhs1 I = [] \\<longrightarrow> (\\<exists>J. setA (cfg_item_rhs2 J) \\<subseteq> cfg_nonterminals G' \\<and> (\\<exists>w. cfg_item_rhs2 J = teA (cfg_item_lhs I) # w) \\<and> J \\<in> q)))\"\n      in InductOverReachables)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def)\n    apply(rule ballI)\n    apply(rename_tac I)(*strict*)\n    apply(rule impI)+\n    apply(subgoal_tac \"False\")\n     apply(rename_tac I)(*strict*)\n     apply(force)\n    apply(rename_tac I)(*strict*)\n    prefer 2\n    apply(rule allI)+\n    apply(rename_tac p e qa cp cq)(*strict*)\n    apply(rule impI)+\n    apply(rule ballI)+\n    apply(rename_tac p e qa cp cq I)(*strict*)\n    apply(rule impI)+\n    apply(subgoal_tac \"e \\<in> epda_delta M\")\n     apply(rename_tac p e qa cp cq I)(*strict*)\n     prefer 2\n     apply(simp add: epda_step_labels_def)\n    apply(rename_tac p e qa cp cq I)(*strict*)\n    apply(subgoal_tac \"edge_src e = p \\<and> edge_trg e = qa\")\n     apply(rename_tac p e qa cp cq I)(*strict*)\n     prefer 2\n     apply(case_tac cp)\n     apply(rename_tac p e qa cp cq I epdaS_conf_statea epdaS_conf_scheduler epdaS_conf_stack)(*strict*)\n     apply(case_tac cq)\n     apply(rename_tac p e qa cp cq I epdaS_conf_statea epdaS_conf_scheduler epdaS_conf_stack epdaS_conf_stateaa epdaS_conf_schedulera epdaS_conf_stacka)(*strict*)\n     apply(simp add: epdaS_step_relation_def)\n    apply(rename_tac p e qa cp cq I)(*strict*)\n    apply(erule conjE)\n    apply(subgoal_tac \"\\<exists>w a. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G') \\<and> e=\\<lparr>edge_src = valid_item_set G' k w, edge_event = Some a, edge_pop = [epda_box (F_LR_MACHINE G' F k)], edge_push = [epda_box (F_LR_MACHINE G' F k)], edge_trg = valid_item_set G' k (w @ [a])\\<rparr>\")\n     apply(rename_tac p e qa cp cq I)(*strict*)\n     prefer 2\n     apply(rule F_LR_MACHINE_edges_have_valid_item_set)\n        apply(rename_tac p e qa cp cq I)(*strict*)\n        apply(force)\n       apply(rename_tac p e qa cp cq I)(*strict*)\n       apply(force)\n      apply(rename_tac p e qa cp cq I)(*strict*)\n      apply(force)\n     apply(force)\n    apply(rename_tac p e qa cp cq I)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac p e qa cp cq I w a)(*strict*)\n    apply(subgoal_tac \"qa=F_VALID_ITEM_SET_GOTO G' F k a (valid_item_set G' k w)\")\n     apply(rename_tac p e qa cp cq I w a)(*strict*)\n     prefer 2\n     apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO G' F k a (valid_item_set G' k w)\"\n      and s=\"valid_item_set G' k (w@[a])\"\n      in subst)\n      apply(rename_tac p e qa cp cq I w a)(*strict*)\n      apply(rule Lemma6__26)\n         apply(rename_tac p e qa cp cq I w a)(*strict*)\n         apply(force)\n        apply(force)\n       apply(rename_tac p e qa cp cq I w a)(*strict*)\n       defer\n       defer\n       apply(force)\n      apply(rename_tac p e qa cp cq I w a)(*strict*)\n      apply(erule conjE)\n      apply(thin_tac \"valid_cfg G\")\n      apply(thin_tac \"Do = F_FRESH (cfg_events G)\")\n      apply(thin_tac \"S' = F_FRESH (cfg_nonterminals G)\")\n      apply(thin_tac \"G' = F_CFG_AUGMENT G S' Do\")\n      apply(thin_tac \"M = F_LR_MACHINE G' F k\")\n      apply(thin_tac \"valid_dfa M\")\n      apply(thin_tac \"q \\<in> epda_states M\")\n      apply(rename_tac p e q cp cq I w a)(*strict*)\n      apply(thin_tac \"cp \\<in> epdaS_configurations M\")\n      apply(thin_tac \"cq \\<in> epdaS_configurations M\")\n      apply(thin_tac \"p \\<in> epdaS_accessible_states M\")\n      apply(thin_tac \"\\<forall>I \\<in> p. cfg_item_lhs I \\<noteq> S' \\<longrightarrow> cfg_item_rhs1 I = [] \\<longrightarrow> (\\<exists>J. setA (cfg_item_rhs2 J) \\<subseteq> cfg_nonterminals G' \\<and> (\\<exists>w. cfg_item_rhs2 J = teA (cfg_item_lhs I) # w) \\<and> J \\<in> p)\")\n      apply(thin_tac \"epdaS_conf_state cp = p\")\n      apply(thin_tac \"epdaS_conf_state cq = q\")\n      apply(thin_tac \"epdaS_step_relation M cp e cq\")\n      apply(thin_tac \"e \\<in> epda_step_labels M\")\n      apply(thin_tac \"e \\<in> epda_delta M\")\n      apply(thin_tac \"edge_src e = p\")\n      apply(thin_tac \"edge_trg e = q\")\n      apply(thin_tac \"e = \\<lparr>edge_src = valid_item_set G' k w, edge_event = Some a, edge_pop = [epda_box (F_LR_MACHINE G' F k)], edge_push = [epda_box (F_LR_MACHINE G' F k)], edge_trg = valid_item_set G' k (w @ [a])\\<rparr>\")\n      apply(thin_tac \"cfg_item_lhs I \\<noteq> S'\")\n      apply(clarsimp)\n      apply(rename_tac I w a)(*strict*)\n      apply(simp only: F_VALID_ITEM_SET_GOTO_def)\n      apply(case_tac \"(F_VALID_ITEM_SET_GOTO__basis a (valid_item_set G' k w)) = F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_GOTO__basis a (valid_item_set G' k w))\")\n       apply(rename_tac I w a)(*strict*)\n       apply(subgoal_tac \"False\")\n        apply(rename_tac I w a)(*strict*)\n        apply(force)\n       apply(rename_tac I w a)(*strict*)\n       apply(rule F_VALID_ITEM_SET_GOTO__basis_makes_nonempty_rhs1)\n        apply(rename_tac I w a)(*strict*)\n        apply(force)\n       apply(rename_tac I w a)(*strict*)\n       apply(force)\n      apply(rename_tac I w a)(*strict*)\n      apply(subgoal_tac \"F_VALID_ITEM_SET_GOTO__basis a (valid_item_set G' k w) \\<subseteq> Collect (valid_item G' k)\")\n       apply(rename_tac I w a)(*strict*)\n       prefer 2\n       apply(rule F_VALID_ITEM_SET_GOTO__basis_preserves_item_set)\n       apply(clarsimp)\n       apply(rename_tac I w a x)(*strict*)\n       apply(rule Fact6_12__2)\n        apply(rename_tac I w a x)(*strict*)\n        apply(force)\n       apply(rename_tac I w a x)(*strict*)\n       apply(force)\n      apply(rename_tac I w a)(*strict*)\n      apply(subgoal_tac \"I \\<notin> F_VALID_ITEM_SET_GOTO__basis a (valid_item_set G' k w)\")\n       apply(rename_tac I w a)(*strict*)\n       prefer 2\n       apply(case_tac \"I \\<notin> F_VALID_ITEM_SET_GOTO__basis a (valid_item_set G' k w)\")\n        apply(rename_tac I w a)(*strict*)\n        apply(force)\n       apply(rename_tac I w a)(*strict*)\n       apply(clarsimp)\n       apply(rule F_VALID_ITEM_SET_GOTO__basis_makes_nonempty_rhs1)\n        apply(rename_tac I w a)(*strict*)\n        apply(force)\n       apply(rename_tac I w a)(*strict*)\n       apply(force)\n      apply(rename_tac I w a)(*strict*)\n      apply(subgoal_tac \"\\<exists>J \\<in> F_VALID_ITEM_SET_GOTO__descent__fp SSG SSF SSk SSS. \\<exists>w. cfg_item_rhs2 J = teA (cfg_item_lhs SSI) # w\" for SSG SSF SSk SSS SSI)\n       apply(rename_tac I w a)(*strict*)\n       prefer 2\n       apply(rule_tac\n      S=\"F_VALID_ITEM_SET_GOTO__basis a (valid_item_set G' k w)\"\n      in F_VALID_ITEM_SET_GOTO__descent__fp_has_reason_prime)\n          apply(rename_tac I w a)(*strict*)\n          apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_valid_input_def)\n          apply(rule conjI)\n           apply(rename_tac I w a)(*strict*)\n           apply(force)\n          apply(rename_tac I w a)(*strict*)\n          apply(force)\n         apply(rename_tac I w a)(*strict*)\n         apply(force)\n        apply(rename_tac I w a)(*strict*)\n        apply(force)\n       apply(rename_tac I w a)(*strict*)\n       apply(force)\n      apply(rename_tac I w a)(*strict*)\n      apply(clarsimp)\n      apply(rename_tac I w a J wa)(*strict*)\n      apply(rule_tac\n      x=\"J\"\n      in exI)\n      apply(rule context_conjI)\n       apply(rename_tac I w a J wa)(*strict*)\n       apply(subgoal_tac \"valid_item G' k J\")\n        apply(rename_tac I w a J wa)(*strict*)\n        apply(simp only: valid_item_def)\n        apply(erule conjE)+\n        apply(erule bexE)+\n        apply(rename_tac I w a J wa p)(*strict*)\n        apply(erule conjE)+\n        apply(simp only: valid_cfg_def)\n        apply(erule conjE)+\n        apply(erule_tac\n      x=\"p\"\n      in ballE)\n         apply(rename_tac I w a J wa p)(*strict*)\n         apply(rule_tac\n      B=\"setA (prod_rhs p)\"\n      in subset_trans)\n          apply(rename_tac I w a J wa p)(*strict*)\n          apply(simp only: setAConcat concat_asso)\n          apply(force)\n         apply(rename_tac I w a J wa p)(*strict*)\n         apply(force)\n        apply(rename_tac I w a J wa p)(*strict*)\n        apply(force)\n       apply(rename_tac I w a J wa)(*strict*)\n       apply(subgoal_tac \"Ball (F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_GOTO__basis a (valid_item_set G' k w))) (valid_item G' k)\")\n        apply(rename_tac I w a J wa)(*strict*)\n        prefer 2\n        apply(rule F_VALID_ITEM_SET_GOTO__descent__fp_F_VALID_ITEM_SET_GOTO__descent__fp_EXTRA_02_unfold)\n        apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_valid_input_def)\n        apply(force)\n       apply(rename_tac I w a J wa)(*strict*)\n       apply(force)\n      apply(rename_tac I w a J wa)(*strict*)\n      apply(clarsimp)\n     apply(rename_tac I)(*strict*)\n     apply(subgoal_tac \"I \\<in> F_VALID_ITEM_SET_INITIAL G' F k\")\n      apply(rename_tac I)(*strict*)\n      apply(subgoal_tac \"I \\<in> {\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[], cfg_item_rhs2=[teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\")\n       apply(rename_tac I)(*strict*)\n       apply(force)\n      apply(rename_tac I)(*strict*)\n      apply(rule_tac\n      t=\"{\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>}\"\n      and s=\"F_VALID_ITEM_SET_INITIAL G' F k\"\n      in subst)\n       apply(rename_tac I)(*strict*)\n       apply(rule F_CFG_AUGMENT__F_VALID_ITEM_SET_INITIAL)\n            apply(rename_tac I)(*strict*)\n            apply(force)\n           apply(rename_tac I)(*strict*)\n           apply(force)\n          apply(rename_tac I)(*strict*)\n          apply(force)\n         apply(rename_tac I)(*strict*)\n         apply(force)\n        apply(rename_tac I)(*strict*)\n        apply(force)\n       apply(rename_tac I)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac I)(*strict*)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rule_tac\n      G=\"G'\"\n      in F_LR_MACHINE_all_epdaS_accessible_states)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(rename_tac p e qa cp cq I w a)(*strict*)\n   apply(simp (no_asm_use) only: setAConcat concat_asso)\n   apply(rule Un_least)\n    apply(rename_tac p e qa cp cq I w a)(*strict*)\n    apply(rule two_elements_construct_domain_setA)\n    apply(force)\n   apply(rename_tac p e qa cp cq I w a)(*strict*)\n   prefer 2\n   apply(simp (no_asm_use) only: setBConcat concat_asso)\n   apply(rule Un_least)\n    apply(rename_tac p e qa cp cq I w a)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(force)\n   apply(rename_tac p e qa cp cq I w a)(*strict*)\n   apply(subgoal_tac \"a \\<in> epda_events M\")\n    apply(rename_tac p e qa cp cq I w a)(*strict*)\n    prefer 2\n    apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(clarsimp)\n    apply(rename_tac cp cq I w a)(*strict*)\n    apply(erule_tac\n      x=\"\\<lparr>edge_src = epdaS_conf_state cp, edge_event = Some a, edge_pop = [epda_box (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k)], edge_push = [epda_box (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k)], edge_trg = epdaS_conf_state cq\\<rparr>\"\n      and P=\"\\<lambda>e. valid_epda_step_label (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k) e\"\n      in ballE)\n     apply(rename_tac cp cq I w a)(*strict*)\n     apply(simp add: valid_epda_step_label_def option_to_set_def)\n    apply(rename_tac cp cq I w a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac p e qa cp cq I w a)(*strict*)\n   apply(case_tac a)\n    apply(rename_tac p e qa cp cq I w a aa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac p e qa cp cq I w a b)(*strict*)\n   apply(simp add: F_LR_MACHINE_def)\n   apply(clarsimp)\n   apply(rename_tac cp cq I w b)(*strict*)\n   apply(simp add: two_elements_construct_domain_def)\n   apply(erule disjE)\n    apply(rename_tac cp cq I w b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac cp cq I w b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac p e qa cp cq I w a)(*strict*)\n  apply(subgoal_tac \"a \\<in> epda_events M\")\n   apply(rename_tac p e qa cp cq I w a)(*strict*)\n   prefer 2\n   apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n   apply(clarsimp)\n   apply(rename_tac cp cq I w a)(*strict*)\n   apply(erule_tac\n      x=\"\\<lparr>edge_src = epdaS_conf_state cp, edge_event = Some a, edge_pop = [epda_box (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k)], edge_push = [epda_box (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k)], edge_trg = epdaS_conf_state cq\\<rparr>\"\n      and P=\"\\<lambda>e. valid_epda_step_label (F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k) e\"\n      in ballE)\n    apply(rename_tac cp cq I w a)(*strict*)\n    apply(simp add: valid_epda_step_label_def option_to_set_def)\n   apply(rename_tac cp cq I w a)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac p e qa cp cq I w a)(*strict*)\n  apply(case_tac a)\n   apply(rename_tac p e qa cp cq I w a aa)(*strict*)\n   prefer 2\n   apply(rename_tac p e qa cp cq I w a b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac p e qa cp cq I w a aa)(*strict*)\n  apply(simp add: F_LR_MACHINE_def)\n  apply(clarsimp)\n  apply(rename_tac cp cq I w aa)(*strict*)\n  apply(simp add: two_elements_construct_domain_def)\n  apply(erule disjE)\n   apply(rename_tac cp cq I w aa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac cp cq I w aa)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma DollarTailStays_notS_prime: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> q \\<in> (epda_states M)\n  \\<Longrightarrow> I \\<in> q\n  \\<Longrightarrow> cfg_item_lhs I \\<noteq> S'\n  \\<Longrightarrow> (cfg_item_look_ahead I) \\<in> ((kPrefix k) ` {w @ [Do]|w. set w \\<subseteq> (cfg_events G)})\"\n  apply(subgoal_tac \"\\<forall>I \\<in> q. (cfg_item_lhs I=S' \\<longrightarrow> cfg_item_look_ahead I = []) \\<and> (cfg_item_lhs I\\<noteq>S' \\<longrightarrow> ((cfg_item_look_ahead I) \\<in> ((kPrefix k) ` ({w@[Do]|w. set w \\<subseteq> (cfg_events G)}))))\")\n   prefer 2\n   apply(rule DollarTailStays)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(erule_tac\n      x=\"I\"\n      in ballE)\n   prefer 2\n   apply(force)\n  apply(clarsimp)\n  done\n\nlemma F_LR_MACHINE_elem_in_GOTO_Do: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> \\<lparr>cfg_item_lhs = F_FRESH (cfg_nonterminals G), cfg_item_rhs1 = [teB Do], cfg_item_rhs2 = [teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr> \\<in> F_DFA_GOTO M (epda_initial M) (teB Do)\"\n  apply(subgoal_tac \"(last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])))-{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} ={\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do], cfg_item_rhs2=[teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\")\n   prefer 2\n   apply(rule F_LR_MACHINE_prefix_closureise_additionalItems_1)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule_tac\n      A=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) - {I. valid_item G' k I \\<and> item_core I \\<in> cfg_productions G}\"\n      in set_mp)\n   apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      and s=\"F_DFA_GOTO M (epda_initial M) (teB Do)\"\n      in ssubst)\n    apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]\"\n      and s=\"[F_DFA_GOTO M (epda_initial M) (teB Do)]\"\n      in ssubst)\n     apply(rule DFA_F_DFA_GOTO_SEQUENCE_to_F_DFA_GOTO)\n         apply(force)\n        apply(force)\n       apply(rule F_LR_MACHINE_all_Connected)\n          prefer 3\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def F_LR_MACHINE_def)\n     apply(rule F_LR_MACHINE_Do_in_cfg_events)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma LRM_contains_theEqClasses2: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\n  \\<Longrightarrow> valid_item_set G k w \\<in> epda_states M\"\n  apply(rule_tac\n      t=\"epda_states M\"\n      and s=\"{valid_item_set SSG SSk w |w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals SSG) (cfg_events SSG)}\" for SSG SSk\n      in ssubst)\n   apply(rule LRM_contains_theEqClasses)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_all_SOUND_prime: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> M = F_LR_MACHINE G F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> setA w \\<subseteq> cfg_nonterminals G\n  \\<Longrightarrow> setB w \\<subseteq> cfg_events G\n  \\<Longrightarrow> valid_item_set G k w = last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n  apply(rule_tac\n      t=\"valid_item_set G k w\"\n      and s=\"(if w=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w))\"\n      in ssubst)\n   apply(rule F_LR_MACHINE_all_SOUND)\n         apply(blast)+\n  apply(clarsimp)\n  apply(subgoal_tac \"length w=length (F_DFA_GOTO_SEQUENCE (F_LR_MACHINE G F k) (epda_initial (F_LR_MACHINE G F k)) w)\")\n   prefer 2\n   apply(rule_tac\n      w=\"w\"\n      and q=\"(epda_initial (F_LR_MACHINE G F k))\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(force)\n       apply(force)\n      apply(rule F_LR_MACHINE_all_Connected)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(simp add: F_LR_MACHINE_def)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(simp add: F_LR_MACHINE_def)\n    apply(rule SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_last_not_empty_starts_with_dollar: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> w \\<noteq> []\n  \\<Longrightarrow> set w \\<subseteq> epda_events M\n  \\<Longrightarrow> last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w) \\<noteq> {}\n  \\<Longrightarrow> \\<exists>w'. w = teB Do # w'\"\n  apply(subgoal_tac \"valid_item_set G' k w \\<noteq> {}\")\n   prefer 2\n   apply(rule_tac\n      t=\"valid_item_set G' k w\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\"\n      in ssubst)\n    apply(rule F_LR_MACHINE_all_SOUND_NotNil)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(rule two_elements_construct_domain_setA)\n      apply(simp add: F_LR_MACHINE_def)\n     apply(rule two_elements_construct_domain_setB)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(force)\n   apply(force)\n  apply(thin_tac \"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) w) \\<noteq> {}\")\n  apply(simp add: valid_item_set_def valid_item_set_n_def)\n  apply(erule exE)+\n  apply(rename_tac n A \\<alpha> \\<beta> y d)(*strict*)\n  apply(erule conjE)+\n  apply(erule exE)+\n  apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta>)(*strict*)\n  apply(erule conjE)+\n  apply(erule exE)+\n  apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n  apply(erule conjE)+\n  apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>)\")\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   prefer 2\n   apply(rule F_CFG_AUGMENT__FirstStep)\n          apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n          apply(force)\n         apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n         apply(force)\n        apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n        apply(force)\n       apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n       apply(force)\n      apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n      apply(force)\n     apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(force)\n    apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(force)\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   apply(blast)\n  apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n  apply(subgoal_tac \"\\<exists>e w. d (Suc n) = Some (pair e \\<lparr>cfg_conf = teB Do # w\\<rparr>)\")\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G'\"\n      and m=\"Suc 0\"\n      and n=\"n\"\n      in terminal_at_beginning_are_never_modified)\n       apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n       apply(rule cfgRM_derivations_are_cfg_derivations)\n       apply(force)\n      apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n      apply(force)\n     apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(force)\n    apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(force)\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   apply(force)\n  apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n  apply(case_tac \\<delta>)\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n   apply(case_tac \\<alpha>)\n    apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa a list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z e wa a list)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_LR_MACHINE_F_DFA_GOTO_SEQUENCE_inj: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> set w \\<subseteq> epda_events M\n  \\<Longrightarrow> set v \\<subseteq> epda_events M\n  \\<Longrightarrow> F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # w) = F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v)\n  \\<Longrightarrow> last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # v)) \\<noteq> {}\n  \\<Longrightarrow> w = v\"\n  apply(subgoal_tac \"teB Do # w=teB Do#v\")\n   apply(force)\n  apply(rule_tac\n      q=\"epda_initial M\"\n      and r=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # w)\"\n      and P=\"\\<lambda>x. x\\<noteq>{}\"\n      in F_DFA_GOTO_SEQUENCE_injective_prime)\n           apply(blast)\n          apply(blast)\n         apply(rule F_LR_MACHINE_all_Connected)\n            prefer 3\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(rule valid_epda_initial_in_states)\n        apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n       apply(simp add: set_Cons)\n       apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_Do_in_cfg_events)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(simp add: set_Cons)\n      apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_Do_in_cfg_events)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(subgoal_tac \"length (teB Do # w) = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # w))\")\n    apply(rule allI)\n    apply(rename_tac i)(*strict*)\n    apply(rule impI)\n    apply(case_tac \"F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # w) ! i = {}\")\n     apply(rename_tac i)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(subgoal_tac \"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # w)) = {}\")\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # w))\"\n      and s=\" (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # w))! ((length (F_DFA_GOTO_SEQUENCE M (epda_initial M) (teB Do # w))) - 1)\"\n      in ssubst)\n     apply(rename_tac i)(*strict*)\n     apply(rule last_nth3)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(rename_tac i)(*strict*)\n    apply(rule_tac\n      G=\"G\"\n      and q=\"epda_initial M\"\n      in F_LR_MACHINE_nonempty_shifts_back_mult_prime)\n                 apply(rename_tac i)(*strict*)\n                 apply(force)\n                apply(rename_tac i)(*strict*)\n                apply(force)\n               apply(rename_tac i)(*strict*)\n               apply(force)\n              apply(rename_tac i)(*strict*)\n              apply(force)\n             apply(rename_tac i)(*strict*)\n             apply(force)\n            apply(rename_tac i)(*strict*)\n            apply(force)\n           apply(force)\n          apply(rename_tac i)(*strict*)\n          apply(force)\n         apply(rename_tac i)(*strict*)\n         apply(force)\n        apply(rename_tac i)(*strict*)\n        apply(rule valid_epda_initial_in_states)\n        apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n       apply(rename_tac i)(*strict*)\n       apply(simp add: set_Cons)\n       apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_Do_in_cfg_events)\n            apply(rename_tac i)(*strict*)\n            apply(force)\n           apply(rename_tac i)(*strict*)\n           apply(force)\n          apply(rename_tac i)(*strict*)\n          apply(force)\n         apply(rename_tac i)(*strict*)\n         apply(force)\n        apply(rename_tac i)(*strict*)\n        apply(force)\n       apply(rename_tac i)(*strict*)\n       apply(force)\n      apply(rename_tac i)(*strict*)\n      apply(force)\n     apply(rename_tac i)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rule_tac\n      q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(force)\n       apply(force)\n      apply(rule F_LR_MACHINE_all_Connected)\n         prefer 3\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(clarsimp)\n     apply(rule valid_epda_initial_in_states)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(simp add: set_Cons)\n    apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_Do_in_cfg_events)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(rule_tac\n      t=\"epda_delta M\"\n      and s=\"snd(F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k})\"\n      in ssubst)\n   apply(simp add: F_LR_MACHINE_def)\n  apply(rule F_LR_MACHINE_all_uniqueEntry)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_la_not_empty: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> M = F_LR_MACHINE G' F (Suc k)\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> I \\<in> valid_item_set G' (Suc k) (teB Do # w)\n  \\<Longrightarrow> w \\<noteq> [teA (cfg_initial G), teB Do]\n  \\<Longrightarrow> setA (teB Do # w) \\<subseteq> cfg_nonterminals G'\n  \\<Longrightarrow> setB (teB Do # w) \\<subseteq> cfg_events G'\n  \\<Longrightarrow> cfg_item_rhs2 I @ liftB (cfg_item_look_ahead I) \\<noteq> []\"\n  apply(simp (no_asm_use) add: valid_item_set_def valid_item_set_n_def)\n  apply(erule exE)+\n  apply(rename_tac n A \\<alpha> \\<beta> y)(*strict*)\n  apply(erule conjE)+\n  apply(erule exE)+\n  apply(rename_tac n A \\<alpha> \\<beta> y d)(*strict*)\n  apply(erule conjE)+\n  apply(erule exE)+\n  apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n  apply(erule conjE)+\n  apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>)\")\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   prefer 2\n   apply(rule F_CFG_AUGMENT__FirstStep)\n          apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n          apply(force)\n         apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n         apply(force)\n        apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n        apply(force)\n       apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n       apply(force)\n      apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n      apply(force)\n     apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(force)\n    apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n    apply(force)\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   apply(force)\n  apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n  apply(case_tac n)\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n  apply(subgoal_tac \"\\<exists>e w. teB Do \\<notin> set w \\<and> (teA S') \\<notin> set w \\<and> d (Suc nat) = Some (pair e \\<lparr>cfg_conf=teB Do#w@[teB Do]\\<rparr>)\")\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      in F_CFG_AUGMENT__on_old_grammar_basically)\n           apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n           apply(force)\n          apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n          apply(force)\n         apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n         apply(force)\n        apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n        apply(force)\n       apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n       apply(force)\n      apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n      apply(rule cfgRM_derivations_are_cfg_derivations)\n      apply(force)\n     apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n     apply(force)\n    apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n    apply(force)\n   apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n   apply(force)\n  apply(rename_tac n A \\<alpha> \\<beta> y d \\<delta> e1 e2 z nat)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma F_LR_MACHINE_items_with_core_from_old_grammar_have_nonempty_lookahead: \"\n  F_CFG_AUGMENT__input G Do S' G'\n  \\<Longrightarrow> cfgSTD_first_compatible F (Suc k)\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> M = F_LR_MACHINE G' F (Suc k)\n  \\<Longrightarrow> q \\<in> epda_states M\n  \\<Longrightarrow> I \\<in> q\n  \\<Longrightarrow> item_core I \\<in> cfg_productions G\n  \\<Longrightarrow> cfg_item_look_ahead I \\<noteq> []\"\n  apply(subgoal_tac \"\\<exists>w. q=valid_item_set G' (Suc k) w\")\n   apply(thin_tac \"q \\<in> epda_states M\")\n   apply(thin_tac \"M = F_LR_MACHINE G' F (Suc k)\")\n   apply(clarsimp)\n   apply(rename_tac w)(*strict*)\n   apply(simp add: valid_item_set_def valid_item_set_n_def)\n   apply(clarsimp)\n   apply(rename_tac n A \\<alpha> \\<beta> d \\<delta> e1 e2)(*strict*)\n   apply(case_tac n)\n    apply(rename_tac n A \\<alpha> \\<beta> d \\<delta> e1 e2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac \\<alpha> \\<beta> d e2)(*strict*)\n    apply(simp add: item_core_def)\n    apply(simp (no_asm_use) add: F_CFG_AUGMENT__input_def valid_cfg_def)\n    apply(erule conjE)+\n    apply(erule_tac\n      x=\"\\<lparr>prod_lhs = cfg_initial G', prod_rhs = \\<alpha> @ \\<beta>\\<rparr>\"\n      and A=\"cfg_productions G\"\n      in ballE)\n     apply(rename_tac \\<alpha> \\<beta> d e2)(*strict*)\n     apply(erule conjE)+\n     apply(simp (no_asm_use))\n     apply(subgoal_tac \"cfg_initial G' \\<notin> cfg_nonterminals G\")\n      apply(rename_tac \\<alpha> \\<beta> d e2)(*strict*)\n      apply(force)\n     apply(rename_tac \\<alpha> \\<beta> d e2)(*strict*)\n     apply(simp (no_asm_use) add: F_CFG_AUGMENT_def)\n     apply(simp (no_asm_simp))\n     apply(rule F_FRESH_is_fresh)\n     apply(force)\n    apply(rename_tac \\<alpha> \\<beta> d e2)(*strict*)\n    apply(force)\n   apply(rename_tac n A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n   apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>)\")\n    apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n    prefer 2\n    apply(rule F_CFG_AUGMENT__FirstStep)\n           apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n           apply(simp add: F_CFG_AUGMENT__input_def)\n          apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n          apply(simp add: F_CFG_AUGMENT__input_def)\n         apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n         apply(force)\n        apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n        apply(simp add: F_CFG_AUGMENT__input_def)\n       apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n       apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n      apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rule cfgRM_derivations_are_cfg_derivations)\n      apply(force)\n     apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n     apply(force)\n    apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n    apply(force)\n   apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n   apply(subgoal_tac \"\\<exists>e w. d (Suc nat) = Some (pair e \\<lparr>cfg_conf = w @ [teB Do]\\<rparr>)\")\n    apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n    prefer 2\n    apply(rule_tac\n      G=\"G'\"\n      and m=\"Suc 0\"\n      in terminals_at_ending_are_never_modified_list)\n         apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n         apply(rule cfgRM_derivations_are_cfg_derivations)\n         apply(force)\n        apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n        apply(force)\n       apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n       apply(force)\n      apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n      apply(force)\n     apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n     apply(force)\n    apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n    apply(force)\n   apply(rename_tac A \\<alpha> \\<beta> d \\<delta> e1 e2 nat)(*strict*)\n   apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>w. q=valid_item_set G' (Suc k) w \\<and> set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\")\n   prefer 2\n   apply(subgoal_tac \"epda_states M = {valid_item_set G' (Suc k) w|w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')}\")\n    prefer 2\n    apply(rule LRM_contains_theEqClasses)\n      apply(simp add: F_CFG_AUGMENT__input_def)\n     apply(force)\n    apply(simp add: F_CFG_AUGMENT__input_def)\n   apply(force)\n  apply(force)\n  done\n\nlemma partial_F_DFA_GOTO_SEQUENCE_eq_implies_existence_of_sub_F_DFA_GOTO_SEQUENCEs: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> q1 = epda_initial M\n  \\<Longrightarrow> set w1 \\<subseteq> epda_events M\n  \\<Longrightarrow> set w2 \\<subseteq> epda_events M\n  \\<Longrightarrow> F_DFA_GOTO_SEQUENCE M q1 w1 = v @ q2 # F_DFA_GOTO_SEQUENCE M q2 w2\n  \\<Longrightarrow> q2 \\<noteq> {}\n  \\<Longrightarrow> last (q2 # F_DFA_GOTO_SEQUENCE M q2 w2) \\<noteq> {}\n  \\<Longrightarrow> \\<exists>w x. w @ x # w2 = w1 \\<and> v = F_DFA_GOTO_SEQUENCE M q1 w \\<and> q2 = F_DFA_GOTO M (last (q1 # v)) x\"\n  apply(subgoal_tac \"every_state_in_some_accessible_configuration M\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_Connected)\n      prefer 3\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"q2 \\<in> epda_states M\")\n   prefer 2\n   apply(rule_tac\n      A=\"set (F_DFA_GOTO_SEQUENCE M q1 w1)\"\n      in set_mp)\n    apply(rule F_DFA_GOTO_SEQUENCESound_main3)\n         apply(force)\n        apply(force)\n       prefer 4\n       apply(force)\n      prefer 2\n      apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def valid_epda_def)\n     prefer 2\n     apply(force)\n    prefer 2\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"length w1=length v+Suc 0+length w2\")\n   prefer 2\n   apply(subgoal_tac \"length w1=length (F_DFA_GOTO_SEQUENCE M q1 w1)\")\n    apply(subgoal_tac \"length w2=length (F_DFA_GOTO_SEQUENCE M q2 w2)\")\n     apply(force)\n    apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n        apply(force)\n       apply(force)\n      apply(force)\n     prefer 3\n     apply(force)\n    apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def valid_epda_def)\n   apply(force)\n  apply(subgoal_tac \"\\<exists>w x wX. w @ x # wX = w1 \\<and> length wX=length w2\")\n   prefer 2\n   apply(rule_tac\n      x=\"take (length v) w1\"\n      in exI)\n   apply(rule_tac\n      x=\"hd (drop (length v) w1)\"\n      in exI)\n   apply(rule_tac\n      x=\"drop (Suc(length v)) w1\"\n      in exI)\n   apply(rule word_decompose)\n   apply(blast)\n  apply(erule exE)+\n  apply(rename_tac w x wX)(*strict*)\n  apply(rule_tac\n      x=\"w\"\n      in exI)\n  apply(rule_tac\n      x=\"x\"\n      in exI)\n  apply(subgoal_tac \"length w2=length (F_DFA_GOTO_SEQUENCE M q2 w2)\")\n   apply(rename_tac w x wX)(*strict*)\n   prefer 2\n   apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac w x wX)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(subgoal_tac \"length w=length (F_DFA_GOTO_SEQUENCE M q1 w)\")\n   apply(rename_tac w x wX)(*strict*)\n   prefer 2\n   apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac w x wX)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     prefer 3\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def valid_epda_def)\n   apply(rename_tac w x wX)(*strict*)\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(subgoal_tac \"length (w@[x])=length (F_DFA_GOTO_SEQUENCE M q1 (w@[x]))\")\n   apply(rename_tac w x wX)(*strict*)\n   prefer 2\n   apply(rule F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac w x wX)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     prefer 3\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def valid_epda_def)\n   apply(rename_tac w x wX)(*strict*)\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(subgoal_tac \"length w=length v\")\n   apply(rename_tac w x wX)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(subgoal_tac \"F_DFA_GOTO_SEQUENCE M q1 w1 = (F_DFA_GOTO_SEQUENCE M q1 w) @ (F_DFA_GOTO M (last (q1 # (F_DFA_GOTO_SEQUENCE M q1 w))) x) # F_DFA_GOTO_SEQUENCE M (F_DFA_GOTO M (last (q1 # (F_DFA_GOTO_SEQUENCE M q1 w))) x) wX\")\n   apply(rename_tac w x wX)(*strict*)\n   apply(subgoal_tac \"v = F_DFA_GOTO_SEQUENCE M q1 w\")\n    apply(rename_tac w x wX)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(subgoal_tac \"q2 = F_DFA_GOTO M (last (q1 # v)) x\")\n    apply(rename_tac w x wX)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(subgoal_tac \"w2=wX\")\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(subgoal_tac \"F_DFA_GOTO_SEQUENCE M (F_DFA_GOTO M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)) x) wX = F_DFA_GOTO_SEQUENCE M q2 w2\")\n    apply(rename_tac w x wX)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(subgoal_tac \"w@x#wX=w@x#w2\")\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule_tac\n      q=\"epda_initial M\"\n      and r=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) (w@x#wX)\"\n      and P=\"\\<lambda>x. x\\<noteq>{}\"\n      in F_DFA_GOTO_SEQUENCE_injective_prime)\n            apply(rename_tac w x wX)(*strict*)\n            apply(force)\n           apply(rename_tac w x wX)(*strict*)\n           apply(force)\n          apply(rename_tac w x wX)(*strict*)\n          apply(force)\n         apply(rename_tac w x wX)(*strict*)\n         apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def valid_epda_def)\n        apply(rename_tac w x wX)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(rule_tac\n      t=\"w@x#wX\"\n      and s=\"w1\"\n      in ssubst)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(rule_tac\n      t=\"F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k\"\n      and s=\"M\"\n      in ssubst)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) (w @ x # w2)\"\n      and s=\"F_DFA_GOTO_SEQUENCE M q1 w @ F_DFA_GOTO M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)) x # F_DFA_GOTO_SEQUENCE M (F_DFA_GOTO M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)) x) w2\"\n      in ssubst)\n      apply(rename_tac w x wX)(*strict*)\n      defer\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(rule allI)\n     apply(rename_tac w x wX i)(*strict*)\n     apply(rule impI)\n     apply(case_tac \"F_DFA_GOTO_SEQUENCE M (epda_initial M) (w@x#wX) ! i = {}\")\n      apply(rename_tac w x wX i)(*strict*)\n      prefer 2\n      apply(force)\n     apply(rename_tac w x wX i)(*strict*)\n     apply(subgoal_tac \"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (w@x#wX)) = {}\")\n      apply(rename_tac w x wX i)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX i)(*strict*)\n     apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (w@x#wX))\"\n      and s=\" (F_DFA_GOTO_SEQUENCE M (epda_initial M) (w@x#wX))! ((length (F_DFA_GOTO_SEQUENCE M (epda_initial M) (w@x#wX))) - 1)\"\n      in ssubst)\n      apply(rename_tac w x wX i)(*strict*)\n      apply(rule last_nth3)\n      apply(rename_tac w x wX i)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX i)(*strict*)\n     apply(rule_tac\n      G=\"G\"\n      and q=\"epda_initial M\"\n      in F_LR_MACHINE_nonempty_shifts_back_mult_prime)\n                  apply(rename_tac w x wX i)(*strict*)\n                  apply(force)\n                 apply(force)\n                apply(rename_tac w x wX i)(*strict*)\n                apply(force)\n               apply(rename_tac w x wX i)(*strict*)\n               apply(force)\n              apply(rename_tac w x wX i)(*strict*)\n              apply(force)\n             apply(rename_tac w x wX i)(*strict*)\n             apply(force)\n            apply(rename_tac w x wX i)(*strict*)\n            apply(force)\n           apply(rename_tac w x wX i)(*strict*)\n           apply(force)\n          apply(rename_tac w x wX i)(*strict*)\n          apply(force)\n         apply(rename_tac w x wX i)(*strict*)\n         apply(rule valid_epda_initial_in_states)\n         apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n        apply(rename_tac w x wX i)(*strict*)\n        apply(simp add: set_Cons)\n       apply(rename_tac w x wX i)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX i)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX i)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(rule_tac\n      t=\"F_LR_MACHINE (F_CFG_AUGMENT G (F_FRESH (cfg_nonterminals G)) (F_FRESH (cfg_events G))) F k\"\n      and s=\"M\"\n      in ssubst)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(rule_tac\n      t=\"epda_delta M\"\n      and s=\"snd(F_LR_MACHINE__fp_one G' F k {} {} {F_VALID_ITEM_SET_INITIAL G' F k})\"\n      in ssubst)\n     apply(rename_tac w x wX)(*strict*)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rename_tac w x wX)(*strict*)\n    apply(rule F_LR_MACHINE_all_uniqueEntry)\n     apply(force)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule_tac\n      t=\"w1\"\n      and s=\"(w@[x])@wX\"\n      in ssubst)\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M q1 ((w @ [x]) @ wX)\"\n      and s=\"F_DFA_GOTO_SEQUENCE M q1 (w @ [x]) @ (F_DFA_GOTO_SEQUENCE M (last (q1#(F_DFA_GOTO_SEQUENCE M q1 (w@[x])))) wX)\"\n      in ssubst)\n    apply(rename_tac w x wX)(*strict*)\n    apply(rule F_DFA_GOTO_SEQUENCE_append_split)\n         apply(rename_tac w x wX)(*strict*)\n         apply(force)\n        apply(rename_tac w x wX)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 (w @ [x]))) wX\"\n      and s=\"F_DFA_GOTO_SEQUENCE M (F_DFA_GOTO M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)) x) wX\"\n      in ssubst)\n    apply(rename_tac w x wX)(*strict*)\n    apply(rule_tac\n      t=\"(last (q1 # F_DFA_GOTO_SEQUENCE M q1 (w @ [x])))\"\n      and s=\"(F_DFA_GOTO M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)) x)\"\n      in ssubst)\n     apply(rename_tac w x wX)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(rule_tac\n      t=\"last (q1 # F_DFA_GOTO_SEQUENCE M q1 (w @ [x]))\"\n      and s=\"last(F_DFA_GOTO_SEQUENCE M q1 (w @ [x]))\"\n      in ssubst)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(rule F_DFA_GOTO_SEQUENCE_dropTerminal_last)\n        apply(rename_tac w x wX)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M q1 (w @ [x])\"\n      and s=\"F_DFA_GOTO_SEQUENCE M q1 w @ [F_DFA_GOTO M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)) x]\"\n      in ssubst)\n    apply(rename_tac w x wX)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M q1 (w @ [x])\"\n      and s=\"F_DFA_GOTO_SEQUENCE M q1 w @ (F_DFA_GOTO_SEQUENCE M (last (q1#(F_DFA_GOTO_SEQUENCE M q1 w))) [x])\"\n      in ssubst)\n    apply(rename_tac w x wX)(*strict*)\n    apply(rule F_DFA_GOTO_SEQUENCE_append_split)\n         apply(rename_tac w x wX)(*strict*)\n         apply(force)\n        apply(rename_tac w x wX)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)) [x]\"\n      and s=\"[F_DFA_GOTO M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)) x]\"\n      in ssubst)\n    apply(rename_tac w x wX)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule DFA_F_DFA_GOTO_SEQUENCE_to_F_DFA_GOTO)\n       apply(rename_tac w x wX)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(case_tac w)\n    apply(rename_tac w x wX)(*strict*)\n    apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M q1 w\"\n      and s=\"[]\"\n      in ssubst)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(rule_tac\n      t=\"last [q1]\"\n      and s=\"q1\"\n      in ssubst)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def valid_epda_def)\n   apply(rename_tac w x wX a list)(*strict*)\n   apply(rule_tac\n      t=\"last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M q1 w)\"\n      in ssubst)\n    apply(rename_tac w x wX a list)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX a list)(*strict*)\n   apply(rule_tac\n      A=\"set (F_DFA_GOTO_SEQUENCE M q1 w)\"\n      in set_mp)\n    apply(rename_tac w x wX a list)(*strict*)\n    apply(rule F_DFA_GOTO_SEQUENCESound_main3)\n         apply(rename_tac w x wX a list)(*strict*)\n         apply(force)\n        apply(rename_tac w x wX a list)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX a list)(*strict*)\n       prefer 4\n       apply(force)\n      apply(rename_tac w x wX a list)(*strict*)\n      prefer 2\n      apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def valid_epda_def)\n     apply(rename_tac w x wX a list)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac w x wX a list)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX a list)(*strict*)\n   apply(rule last_in_set)\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(rule_tac\n      t=\"w@x#w2\"\n      and s=\"(w@[x])@w2\"\n      in ssubst)\n   apply(rename_tac w x wX)(*strict*)\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) ((w @ [x]) @ w2)\"\n      and s=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) (w@[x]) @ (F_DFA_GOTO_SEQUENCE M (last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) (w@[x])))) w2)\"\n      in ssubst)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule F_DFA_GOTO_SEQUENCE_append_split)\n        apply(rename_tac w x wX)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) (w @ [x])\"\n      and s=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) w @ (F_DFA_GOTO_SEQUENCE M (last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) w))) [x])\"\n      in ssubst)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule F_DFA_GOTO_SEQUENCE_append_split)\n        apply(rename_tac w x wX)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(rule_tac\n      t=\"epda_initial M\"\n      and s=\"q1\"\n      in ssubst)\n   apply(rename_tac w x wX)(*strict*)\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)) [x]\"\n      and s=\"[F_DFA_GOTO M (last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)) x]\"\n      in ssubst)\n   apply(rename_tac w x wX)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(rule DFA_F_DFA_GOTO_SEQUENCE_to_F_DFA_GOTO)\n      apply(rename_tac w x wX)(*strict*)\n      apply(force)\n     apply(rename_tac w x wX)(*strict*)\n     apply(force)\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac w x wX)(*strict*)\n  apply(case_tac w)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M q1 w\"\n      and s=\"[]\"\n      in ssubst)\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(rule_tac\n      t=\"last [q1]\"\n      and s=\"q1\"\n      in ssubst)\n    apply(rename_tac w x wX)(*strict*)\n    apply(force)\n   apply(rename_tac w x wX)(*strict*)\n   apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def valid_epda_def)\n  apply(rename_tac w x wX a list)(*strict*)\n  apply(rule_tac\n      t=\"last (q1 # F_DFA_GOTO_SEQUENCE M q1 w)\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M q1 w)\"\n      in ssubst)\n   apply(rename_tac w x wX a list)(*strict*)\n   apply(force)\n  apply(rename_tac w x wX a list)(*strict*)\n  apply(rule_tac\n      A=\"set (F_DFA_GOTO_SEQUENCE M q1 w)\"\n      in set_mp)\n   apply(rename_tac w x wX a list)(*strict*)\n   apply(rule F_DFA_GOTO_SEQUENCESound_main3)\n        apply(rename_tac w x wX a list)(*strict*)\n        apply(force)\n       apply(rename_tac w x wX a list)(*strict*)\n       apply(force)\n      apply(rename_tac w x wX a list)(*strict*)\n      prefer 4\n      apply(force)\n     apply(rename_tac w x wX a list)(*strict*)\n     prefer 2\n     apply(simp add: valid_dfa_def valid_pda_def valid_dpda_def valid_epda_def)\n    apply(rename_tac w x wX a list)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac w x wX a list)(*strict*)\n   apply(force)\n  apply(rename_tac w x wX a list)(*strict*)\n  apply(rule last_in_set)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_Single_Initial_Item: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> I \\<in> epda_initial M\n  \\<Longrightarrow> I = \\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>\"\n  apply(subgoal_tac \"I \\<in> F_VALID_ITEM_SET_INITIAL G' F k\")\n   prefer 2\n   apply(rule_tac\n      t=\"F_VALID_ITEM_SET_INITIAL G' F k\"\n      and s=\"valid_item_set G' k []\"\n      in subst)\n    apply(rule Lemma6__23_1)\n     apply(force)\n    apply(force)\n   apply(rule_tac\n      t=\"valid_item_set G' k []\"\n      and s=\"epda_initial M\"\n      in ssubst)\n    apply(rule F_LR_MACHINE_all_SOUND_Nil)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(simp (no_asm_use) only: F_VALID_ITEM_SET_INITIAL_def F_VALID_ITEM_SET_INITIAL__fp_start_def)\n  apply(subgoal_tac \"{\\<lparr>cfg_item_lhs = cfg_initial G', cfg_item_rhs1 = [],\n              cfg_item_rhs2 = prod_rhs p, cfg_item_look_ahead = []\\<rparr> |\n           p. p \\<in> cfg_productions G' \\<and>\n              prod_lhs p = cfg_initial G'} = {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>}\")\n   prefer 2\n   apply(rule order_antisym)\n    prefer 2\n    apply(rule subsetI)\n    apply(rename_tac x)(*strict*)\n    apply(simp (no_asm))\n    apply(simp add: F_CFG_AUGMENT_def)\n    apply(rule_tac\n      x=\"\\<lparr>prod_lhs=S', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>\"\n      in exI)\n    apply(rename_tac x)(*strict*)\n    apply(clarsimp)\n   apply(simp add: F_CFG_AUGMENT_def)\n   apply(rule subsetI)\n   apply(rename_tac x)(*strict*)\n   apply(simp (no_asm))\n   apply(simp (no_asm_use))\n   apply(clarsimp)\n   apply(erule disjE)\n    apply(simp add: F_CFG_AUGMENT_def)\n   apply(simp add: valid_cfg_def)\n   apply(clarsimp)\n   apply(thin_tac \"\\<forall>e \\<in> cfg_productions G.\n            setA (prod_rhs e)\n           \\<subseteq> insert (F_FRESH (cfg_nonterminals G))\n                (cfg_nonterminals G) \\<and>\n            setB (prod_rhs e)\n           \\<subseteq> insert (F_FRESH (cfg_events G)) (cfg_events G)\")\n   apply(erule_tac\n      x=\"p\"\n      in ballE)\n    prefer 2\n    apply(force)\n   apply(subgoal_tac \"prod_lhs p \\<notin> cfg_nonterminals G\")\n    apply(rename_tac p)(*strict*)\n    apply(force)\n   apply(rename_tac p)(*strict*)\n   apply(rule_tac\n      t=\"prod_lhs p\"\n      and s=\"F_FRESH (cfg_nonterminals G)\"\n      in ssubst)\n    apply(rename_tac p)(*strict*)\n    apply(simp add: F_CFG_AUGMENT_def)\n   apply(rename_tac p)(*strict*)\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: valid_cfg_def)\n  apply(subgoal_tac \"I \\<in> F_VALID_ITEM_SET_GOTO__descent__fp G' F k {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>}\")\n   prefer 2\n   apply(force)\n  apply(thin_tac \"{\\<lparr>cfg_item_lhs = cfg_initial G', cfg_item_rhs1 = [],\n        cfg_item_rhs2 = prod_rhs p, cfg_item_look_ahead = []\\<rparr> |\n     p. p \\<in> cfg_productions G' \\<and> prod_lhs p = cfg_initial G'} =\n    {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [],\n        cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do],\n        cfg_item_look_ahead = []\\<rparr>}\")\n  apply(thin_tac \"I \\<in> F_VALID_ITEM_SET_GOTO__descent__fp G' F k\n          {\\<lparr>cfg_item_lhs = cfg_initial G', cfg_item_rhs1 = [],\n              cfg_item_rhs2 = prod_rhs p, cfg_item_look_ahead = []\\<rparr> |\n           p. p \\<in> cfg_productions G' \\<and>\n              prod_lhs p = cfg_initial G'} \")\n  apply(subgoal_tac \"F_VALID_ITEM_SET_GOTO__descent__fp G' F k {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>} = {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>}\")\n   apply(force)\n  apply(thin_tac \"I \\<in> F_VALID_ITEM_SET_GOTO__descent__fp G' F k {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>}\")\n  apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO__descent__fp G' F k {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>}\"\n      and s=\"(if F_VALID_ITEM_SET_GOTO__descent__fp_one_1s SSG SSF SSk {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>} = {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>} then {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>} else F_VALID_ITEM_SET_GOTO__descent__fp SSG SSF SSk (F_VALID_ITEM_SET_GOTO__descent__fp_one_1s SSG SSF SSk {\\<lparr>cfg_item_lhs = S', cfg_item_rhs1 = [], cfg_item_rhs2 = [teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead = []\\<rparr>}))\" for SSG SSF SSk\n      in ssubst)\n   apply(rule F_VALID_ITEM_SET_GOTO__descent__fp.psimps)\n   apply(rule F_VALID_ITEM_SET_GOTO__descent__fp_termination)\n   apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_valid_input_def)\n   apply(simp add: valid_item_def)\n   apply(rule_tac\n      x=\"\\<lparr>prod_lhs=S', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>\"\n      in bexI)\n    apply(clarsimp)\n   apply(simp add: F_CFG_AUGMENT_def)\n  apply(simp add: F_VALID_ITEM_SET_GOTO__descent__fp_one_1s_def F_VALID_ITEM_SET_GOTO__descent__fp_one_1_def)\n  done\n\nlemma F_LR_MACHINE_preserves_Sentential: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> cfgRM.Nonblockingness_branching G'\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> set w \\<subseteq> epda_events M\n  \\<Longrightarrow> q = last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\n  \\<Longrightarrow> I \\<in> q\n  \\<Longrightarrow> Sentential G' (w @ (cfg_item_rhs2 I) @ (liftB (cfg_item_look_ahead I)))\"\n  apply(subgoal_tac \"every_state_in_some_accessible_configuration M\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_Connected)\n      prefer 3\n      apply(simp add:)\n     apply(force)\n    apply(simp add:)\n   apply(simp add:)\n  apply(induct w arbitrary: q I rule: rev_induct)\n   apply(rename_tac q I)(*strict*)\n   apply(subgoal_tac \"q=epda_initial M\")\n    apply(rename_tac q I)(*strict*)\n    apply(subgoal_tac \"I=\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[], cfg_item_rhs2=[teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>\")\n     apply(rename_tac q I)(*strict*)\n     apply(rule Sentential_from_viable_prefix)\n      apply(rename_tac q I)(*strict*)\n      apply(force)\n     apply(rename_tac q I)(*strict*)\n     apply(rule_tac\n      p=\"\\<lparr>prod_lhs=S', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>\"\n      in F_CFG_AUGMENT__ONE_step_viable_prefix)\n        apply(rename_tac q I)(*strict*)\n        apply(force)\n       apply(rename_tac q I)(*strict*)\n       apply(simp add: F_CFG_AUGMENT_def)\n      apply(rename_tac q I)(*strict*)\n      apply(simp add: F_CFG_AUGMENT_def)\n     apply(rename_tac q I)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac q I)(*strict*)\n    apply(rule F_LR_MACHINE_Single_Initial_Item)\n             apply(rename_tac q I)(*strict*)\n             apply(force)\n            apply(rename_tac q I)(*strict*)\n            apply(force)\n           apply(rename_tac q I)(*strict*)\n           apply(force)\n          apply(rename_tac q I)(*strict*)\n          apply(force)\n         apply(force)\n        apply(rename_tac q I)(*strict*)\n        apply(force)\n       apply(rename_tac q I)(*strict*)\n       apply(force)\n      apply(rename_tac q I)(*strict*)\n      apply(force)\n     apply(rename_tac q I)(*strict*)\n     apply(force)\n    apply(rename_tac q I)(*strict*)\n    apply(force)\n   apply(rename_tac q I)(*strict*)\n   apply(subgoal_tac \"length [] = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [])\")\n    apply(rename_tac q I)(*strict*)\n    apply(force)\n   apply(rename_tac q I)(*strict*)\n   apply(rule_tac\n      w=\"[]\"\n      and q=\"(epda_initial M)\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac q I)(*strict*)\n        apply(force)\n       apply(rename_tac q I)(*strict*)\n       apply(force)\n      apply(rename_tac q I)(*strict*)\n      apply(force)\n     apply(rename_tac q I)(*strict*)\n     apply(simp add:  valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(rename_tac q I)(*strict*)\n    apply(force)\n   apply(rename_tac q I)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I)(*strict*)\n  apply(subgoal_tac \"q=valid_item_set G' k (xs@[x])\")\n   apply(rename_tac x xs q I)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"valid_item_set G' k (xs @ [x])\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) (xs @ [x]))\"\n      in ssubst)\n    apply(rename_tac x xs q I)(*strict*)\n    apply(rule F_LR_MACHINE_all_SOUND_NotNil2)\n           apply(rename_tac x xs q I)(*strict*)\n           apply(force)\n          apply(rename_tac x xs q I)(*strict*)\n          apply(force)\n         apply(force)\n        apply(rename_tac x xs q I)(*strict*)\n        apply(force)\n       apply(rename_tac x xs q I)(*strict*)\n       apply(force)\n      apply(rename_tac x xs q I)(*strict*)\n      apply(rule two_elements_construct_domain_setA)\n      apply(simp add: F_LR_MACHINE_def)\n     apply(rename_tac x xs q I)(*strict*)\n     apply(rule two_elements_construct_domain_setB)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rename_tac x xs q I)(*strict*)\n    apply(force)\n   apply(rename_tac x xs q I)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I)(*strict*)\n  apply(thin_tac \"q = last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) (xs@[x]))\")\n  apply(erule_tac\n      x=\"valid_item_set G' k xs\"\n      in meta_allE)\n  apply(subgoal_tac \"q=F_VALID_ITEM_SET_GOTO G' F k x (valid_item_set G' k xs)\")\n   apply(rename_tac x xs q I)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO G' F k x (valid_item_set G' k xs)\"\n      and s=\"valid_item_set G' k (xs @ [x])\"\n      in subst)\n    apply(rename_tac x xs q I)(*strict*)\n    apply(rule Lemma6__26)\n       apply(rename_tac x xs q I)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac x xs q I)(*strict*)\n     apply(rule two_elements_construct_domain_setA)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rename_tac x xs q I)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(simp add: F_LR_MACHINE_def)\n   apply(rename_tac x xs q I)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I)(*strict*)\n  apply(thin_tac \"q = valid_item_set G' k (xs @ [x])\")\n  apply(simp (no_asm_use) add: F_VALID_ITEM_SET_GOTO_def)\n  apply(subgoal_tac \"\\<exists>J \\<in> valid_item_set G' k xs. I \\<in> F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_GOTO__basis x {J})\")\n   apply(rename_tac x xs q I)(*strict*)\n   prefer 2\n   apply(rule F_VALID_ITEM_SET_GOTO__descent__fp_exists_origin)\n       apply(rename_tac x xs q I)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac x xs q I)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xs I xa)(*strict*)\n     apply(rule Fact6_12__2)\n      apply(rename_tac x xs I xa)(*strict*)\n      apply(force)\n     apply(rename_tac x xs I xa)(*strict*)\n     apply(force)\n    apply(rename_tac x xs q I)(*strict*)\n    apply(force)\n   apply(rename_tac x xs q I)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I)(*strict*)\n  apply(erule bexE)+\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule_tac\n      x=\"J\"\n      in meta_allE)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(rule_tac\n      t=\"valid_item_set G' k xs\"\n      and s=\"(if xs=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) xs))\"\n      in ssubst)\n    apply(rename_tac x xs q I J)(*strict*)\n    apply(rule F_LR_MACHINE_all_SOUND)\n          apply(rename_tac x xs q I J)(*strict*)\n          apply(force)\n         apply(rename_tac x xs q I J)(*strict*)\n         apply(force)\n        apply(rename_tac x xs q I J)(*strict*)\n        apply(force)\n       apply(rename_tac x xs q I J)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac x xs q I J)(*strict*)\n     apply(rule two_elements_construct_domain_setA)\n     apply(simp add: F_LR_MACHINE_def)\n     apply(force)\n    apply(rename_tac x xs q I J)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(simp add: F_LR_MACHINE_def)\n    apply(force)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(subgoal_tac \"xs=[] \\<longleftrightarrow> F_DFA_GOTO_SEQUENCE M (epda_initial M) xs = []\")\n    apply(rename_tac x xs q I J)(*strict*)\n    apply(force)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(subgoal_tac \"length xs = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) xs)\")\n    apply(rename_tac x xs q I J)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"M\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n         apply(rename_tac x xs q I J)(*strict*)\n         apply(force)\n        apply(rename_tac x xs q I J)(*strict*)\n        apply(force)\n       apply(rename_tac x xs q I J)(*strict*)\n       apply(force)\n      apply(rename_tac x xs q I J)(*strict*)\n      apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n     apply(rename_tac x xs q I J)(*strict*)\n     apply(force)\n    apply(rename_tac x xs q I J)(*strict*)\n    apply(force)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(thin_tac \"q = F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_GOTO__basis x (valid_item_set G' k xs))\")\n  apply(thin_tac \"I \\<in> q\")\n  apply(erule conjE)+\n  apply(rule GOTO_preserves_Sentential)\n      apply(rename_tac x xs q I J)(*strict*)\n      apply(force)\n     apply(force)\n    apply(rename_tac x xs q I J)(*strict*)\n    prefer 3\n    apply(force)\n   apply(rename_tac x xs q I J)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(rule Fact6_12__2)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_preserves_SententialRM: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> cfgRM.Nonblockingness_branching G'\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> set w \\<subseteq> epda_events M\n  \\<Longrightarrow> q = last ((epda_initial M) # F_DFA_GOTO_SEQUENCE M (epda_initial M) w)\n  \\<Longrightarrow> I \\<in> q\n  \\<Longrightarrow> SententialRM G' (w @ (cfg_item_rhs2 I) @ (liftB (cfg_item_look_ahead I)))\"\n  apply(subgoal_tac \"every_state_in_some_accessible_configuration M\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_Connected)\n      prefer 3\n      apply(simp add:)\n     apply(force)\n    apply(simp add:)\n   apply(simp add:)\n  apply(induct w arbitrary: q I rule: rev_induct)\n   apply(rename_tac q I)(*strict*)\n   apply(subgoal_tac \"q=epda_initial M\")\n    apply(rename_tac q I)(*strict*)\n    apply(subgoal_tac \"I=\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[], cfg_item_rhs2=[teB Do, teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>\")\n     apply(rename_tac q I)(*strict*)\n     apply(rule SententialRM_from_viable_prefix)\n      apply(rename_tac q I)(*strict*)\n      apply(force)\n     apply(rename_tac q I)(*strict*)\n     apply(rule_tac\n      p=\"\\<lparr>prod_lhs=S', prod_rhs=[teB Do, teA (cfg_initial G), teB Do]\\<rparr>\"\n      in F_CFG_AUGMENT__ONE_step_viable_prefix)\n        apply(rename_tac q I)(*strict*)\n        apply(force)\n       apply(rename_tac q I)(*strict*)\n       apply(simp add: F_CFG_AUGMENT_def)\n      apply(rename_tac q I)(*strict*)\n      apply(simp add: F_CFG_AUGMENT_def)\n     apply(rename_tac q I)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac q I)(*strict*)\n    apply(rule F_LR_MACHINE_Single_Initial_Item)\n             apply(rename_tac q I)(*strict*)\n             apply(force)\n            apply(rename_tac q I)(*strict*)\n            apply(force)\n           apply(rename_tac q I)(*strict*)\n           apply(force)\n          apply(rename_tac q I)(*strict*)\n          apply(force)\n         apply(rename_tac q I)(*strict*)\n         apply(force)\n        apply(rename_tac q I)(*strict*)\n        apply(force)\n       apply(rename_tac q I)(*strict*)\n       apply(force)\n      apply(rename_tac q I)(*strict*)\n      apply(force)\n     apply(rename_tac q I)(*strict*)\n     apply(force)\n    apply(force)\n   apply(rename_tac q I)(*strict*)\n   apply(subgoal_tac \"length [] = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [])\")\n    apply(rename_tac q I)(*strict*)\n    apply(force)\n   apply(rename_tac q I)(*strict*)\n   apply(rule_tac\n      w=\"[]\"\n      and q=\"(epda_initial M)\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(rename_tac q I)(*strict*)\n        apply(force)\n       apply(rename_tac q I)(*strict*)\n       apply(force)\n      apply(rename_tac q I)(*strict*)\n      apply(force)\n     apply(rename_tac q I)(*strict*)\n     apply(simp add:  valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(rename_tac q I)(*strict*)\n    apply(force)\n   apply(rename_tac q I)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I)(*strict*)\n  apply(subgoal_tac \"q=valid_item_set G' k (xs@[x])\")\n   apply(rename_tac x xs q I)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"valid_item_set G' k (xs @ [x])\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) (xs @ [x]))\"\n      in ssubst)\n    apply(rename_tac x xs q I)(*strict*)\n    apply(rule F_LR_MACHINE_all_SOUND_NotNil2)\n           apply(rename_tac x xs q I)(*strict*)\n           apply(force)\n          apply(rename_tac x xs q I)(*strict*)\n          apply(force)\n         apply(rename_tac x xs q I)(*strict*)\n         apply(force)\n        apply(rename_tac x xs q I)(*strict*)\n        apply(force)\n       apply(force)\n      apply(rename_tac x xs q I)(*strict*)\n      apply(rule two_elements_construct_domain_setA)\n      apply(simp add: F_LR_MACHINE_def)\n     apply(rename_tac x xs q I)(*strict*)\n     apply(rule two_elements_construct_domain_setB)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rename_tac x xs q I)(*strict*)\n    apply(force)\n   apply(rename_tac x xs q I)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I)(*strict*)\n  apply(thin_tac \"q = last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) (xs@[x]))\")\n  apply(erule_tac\n      x=\"valid_item_set G' k xs\"\n      in meta_allE)\n  apply(subgoal_tac \"q=F_VALID_ITEM_SET_GOTO G' F k x (valid_item_set G' k xs)\")\n   apply(rename_tac x xs q I)(*strict*)\n   prefer 2\n   apply(rule_tac\n      t=\"F_VALID_ITEM_SET_GOTO G' F k x (valid_item_set G' k xs)\"\n      and s=\"valid_item_set G' k (xs @ [x])\"\n      in subst)\n    apply(rename_tac x xs q I)(*strict*)\n    apply(rule Lemma6__26)\n       apply(rename_tac x xs q I)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac x xs q I)(*strict*)\n     apply(rule two_elements_construct_domain_setA)\n     apply(simp add: F_LR_MACHINE_def)\n    apply(rename_tac x xs q I)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(simp add: F_LR_MACHINE_def)\n   apply(rename_tac x xs q I)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I)(*strict*)\n  apply(thin_tac \"q = valid_item_set G' k (xs @ [x])\")\n  apply(simp (no_asm_use) add: F_VALID_ITEM_SET_GOTO_def)\n  apply(subgoal_tac \"\\<exists>J \\<in> valid_item_set G' k xs. I \\<in> F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_GOTO__basis x {J})\")\n   apply(rename_tac x xs q I)(*strict*)\n   prefer 2\n   apply(rule F_VALID_ITEM_SET_GOTO__descent__fp_exists_origin)\n       apply(rename_tac x xs q I)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac x xs q I)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac x xs I xa)(*strict*)\n     apply(rule Fact6_12__2)\n      apply(rename_tac x xs I xa)(*strict*)\n      apply(force)\n     apply(rename_tac x xs I xa)(*strict*)\n     apply(force)\n    apply(rename_tac x xs q I)(*strict*)\n    apply(force)\n   apply(rename_tac x xs q I)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I)(*strict*)\n  apply(erule bexE)+\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule_tac\n      x=\"J\"\n      in meta_allE)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(rule_tac\n      t=\"valid_item_set G' k xs\"\n      and s=\"(if xs=[] then (epda_initial M) else last (F_DFA_GOTO_SEQUENCE M (epda_initial M) xs))\"\n      in ssubst)\n    apply(rename_tac x xs q I J)(*strict*)\n    apply(rule F_LR_MACHINE_all_SOUND)\n          apply(rename_tac x xs q I J)(*strict*)\n          apply(force)\n         apply(rename_tac x xs q I J)(*strict*)\n         apply(force)\n        apply(rename_tac x xs q I J)(*strict*)\n        apply(force)\n       apply(rename_tac x xs q I J)(*strict*)\n       apply(force)\n      apply(force)\n     apply(rename_tac x xs q I J)(*strict*)\n     apply(rule two_elements_construct_domain_setA)\n     apply(simp add: F_LR_MACHINE_def)\n     apply(force)\n    apply(rename_tac x xs q I J)(*strict*)\n    apply(rule two_elements_construct_domain_setB)\n    apply(simp add: F_LR_MACHINE_def)\n    apply(force)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(subgoal_tac \"xs=[] \\<longleftrightarrow> F_DFA_GOTO_SEQUENCE M (epda_initial M) xs = []\")\n    apply(rename_tac x xs q I J)(*strict*)\n    apply(force)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(subgoal_tac \"length xs = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) xs)\")\n    apply(rename_tac x xs q I J)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"M\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n         apply(rename_tac x xs q I J)(*strict*)\n         apply(force)\n        apply(rename_tac x xs q I J)(*strict*)\n        apply(force)\n       apply(rename_tac x xs q I J)(*strict*)\n       apply(force)\n      apply(rename_tac x xs q I J)(*strict*)\n      apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n     apply(rename_tac x xs q I J)(*strict*)\n     apply(force)\n    apply(rename_tac x xs q I J)(*strict*)\n    apply(force)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(erule meta_impE)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(thin_tac \"q = F_VALID_ITEM_SET_GOTO__descent__fp G' F k (F_VALID_ITEM_SET_GOTO__basis x (valid_item_set G' k xs))\")\n  apply(thin_tac \"I \\<in> q\")\n  apply(erule conjE)+\n  apply(rule GOTO_preserves_SententialRM)\n       apply(rename_tac x xs q I J)(*strict*)\n       apply(force)\n      apply(rename_tac x xs q I J)(*strict*)\n      apply(force)\n     apply(force)\n    apply(rename_tac x xs q I J)(*strict*)\n    prefer 3\n    apply(force)\n   apply(rename_tac x xs q I J)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(rule Fact6_12__2)\n   apply(rename_tac x xs q I J)(*strict*)\n   apply(force)\n  apply(rename_tac x xs q I J)(*strict*)\n  apply(force)\n  done\n\nlemma F_DFA_GOTO_SEQUENCE_append_valid_item_set: \"\n  valid_cfg G'\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> set (x # y) \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\n  \\<Longrightarrow> F_DFA_GOTO_SEQUENCE M (epda_initial M) (butlast (x # y)) @ [valid_item_set G' k (x # y)] = F_DFA_GOTO_SEQUENCE M (epda_initial M) (x # y)\"\n  apply(subgoal_tac \"every_state_in_some_accessible_configuration M\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_Connected)\n      prefer 3\n      apply(simp add:)\n     apply(force)\n    apply(simp add:)\n   apply(simp add:)\n  apply(rule_tac\n      t=\"valid_item_set G' k (x#y)\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) (x#y))\"\n      in ssubst)\n   apply(rule_tac\n      w=\"x#y\"\n      and M=\"M\"\n      and G=\"G'\"\n      in F_LR_MACHINE_all_SOUND_NotNil)\n          apply(force)\n         apply(simp add:)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(rule two_elements_construct_domain_setA)\n     apply(force)\n    apply(rule two_elements_construct_domain_setB)\n    apply(force)\n   apply(force)\n  apply(subgoal_tac \"\\<exists>y' x'. x#y=y'@[x']\")\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(erule exE)+\n  apply(rename_tac y' x')(*strict*)\n  apply(rule_tac\n      t=\"butlast (x#y)\"\n      and s=\"y'\"\n      in ssubst)\n   apply(rename_tac y' x')(*strict*)\n   apply(force)\n  apply(rename_tac y' x')(*strict*)\n  apply(rule_tac\n      t=\"x#y\"\n      and s=\"y'@[x']\"\n      in ssubst)\n   apply(rename_tac y' x')(*strict*)\n   apply(force)\n  apply(rename_tac y' x')(*strict*)\n  apply(rule F_DFA_GOTO_SEQUENCE_butlast_last)\n      apply(rename_tac y' x')(*strict*)\n      apply(force)\n     apply(rename_tac y' x')(*strict*)\n     apply(force)\n    apply(rename_tac y' x')(*strict*)\n    apply(force)\n   apply(rename_tac y' x')(*strict*)\n   apply(rule_tac\n      t=\"epda_events M\"\n      and s=\"two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\"\n      in ssubst)\n    apply(rename_tac y' x')(*strict*)\n    apply(simp add:  F_LR_MACHINE_def)\n   apply(rename_tac y' x')(*strict*)\n   apply(force)\n  apply(rename_tac y' x')(*strict*)\n  apply(rule_tac\n      t=\"epda_events M\"\n      and s=\"two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\"\n      in ssubst)\n   apply(rename_tac y' x')(*strict*)\n   apply(simp add:  F_LR_MACHINE_def)\n  apply(rename_tac y' x')(*strict*)\n  apply(force)\n  done\n\nlemma F_LR_MACHINE_DFAGTOTO_differs2_prime: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> x \\<noteq> y\n  \\<Longrightarrow> \\<exists>v. x @ v = [teB Do, teA (cfg_initial G), teB Do]\n  \\<Longrightarrow> \\<exists>v. y @ v = [teB Do, teA (cfg_initial G), teB Do]\n  \\<Longrightarrow> x \\<noteq> []\n  \\<Longrightarrow> y \\<noteq> []\n  \\<Longrightarrow> last (F_DFA_GOTO_SEQUENCE M (epda_initial M) y) \\<noteq> last (F_DFA_GOTO_SEQUENCE M (epda_initial M) x)\"\n  apply(subgoal_tac \"every_state_in_some_accessible_configuration M\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_Connected)\n      prefer 3\n      apply(simp add:)\n     apply(force)\n    apply(simp add:)\n   apply(simp add:)\n  apply(subgoal_tac \"length x = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) x)\")\n   apply(subgoal_tac \"length y = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) y)\")\n    apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) y)\"\n      and s=\"last ((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) y)\"\n      in subst)\n     defer\n     apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) x)\"\n      and s=\"last ((epda_initial M)#F_DFA_GOTO_SEQUENCE M (epda_initial M) x)\"\n      in subst)\n      defer\n      apply(rule F_LR_MACHINE_DFAGTOTO_differs2)\n                 apply(force)\n                apply(force)\n               apply(force)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(erule exE)+\n     apply(rename_tac v va)(*strict*)\n     apply(rule_tac\n      M=\"M\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n          apply(rename_tac v va)(*strict*)\n          apply(force)\n         apply(rename_tac v va)(*strict*)\n         apply(force)\n        apply(rename_tac v va)(*strict*)\n        apply(force)\n       apply(rename_tac v va)(*strict*)\n       apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n      apply(rename_tac v va)(*strict*)\n      apply(rule_tac\n      B=\"set [teB Do, teA (cfg_initial G), teB Do]\"\n      in subset_trans)\n       apply(rename_tac v va)(*strict*)\n       apply(rule_tac\n      t=\"[teB Do, teA (cfg_initial G), teB Do]\"\n      and s=\"y@va\"\n      in ssubst)\n        apply(rename_tac v va)(*strict*)\n        apply(force)\n       apply(rename_tac v va)(*strict*)\n       apply(rule set_append1)\n      apply(rename_tac v va)(*strict*)\n      apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def valid_cfg_def two_elements_construct_domain_def)\n     apply(rename_tac v va)(*strict*)\n     apply(clarsimp)\n    apply(erule exE)+\n    apply(rename_tac v va)(*strict*)\n    apply(rule_tac\n      M=\"M\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n         apply(rename_tac v va)(*strict*)\n         apply(force)\n        apply(rename_tac v va)(*strict*)\n        apply(force)\n       apply(rename_tac v va)(*strict*)\n       apply(force)\n      apply(rename_tac v va)(*strict*)\n      apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n     apply(rename_tac v va)(*strict*)\n     apply(rule_tac\n      B=\"set [teB Do, teA (cfg_initial G), teB Do]\"\n      in subset_trans)\n      apply(rename_tac v va)(*strict*)\n      apply(rule_tac\n      t=\"[teB Do, teA (cfg_initial G), teB Do]\"\n      and s=\"x@v\"\n      in ssubst)\n       apply(rename_tac v va)(*strict*)\n       apply(force)\n      apply(rename_tac v va)(*strict*)\n      apply(rule set_append1)\n     apply(rename_tac v va)(*strict*)\n     apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def valid_cfg_def two_elements_construct_domain_def)\n    apply(rename_tac v va)(*strict*)\n    apply(clarsimp)\n   apply(rule last_ConsR)\n   apply(force)\n  apply(rule last_ConsR)\n  apply(force)\n  done\n\nlemma AF_LR_PARSER_final_sequence_contains_nonterms: \"\n  valid_cfg G\n  \\<Longrightarrow> cfgSTD_first_compatible F k\n  \\<Longrightarrow> Do = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S' = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G' = F_CFG_AUGMENT G S' Do\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> valid_dfa M\n  \\<Longrightarrow> some_step_from_every_configuration M\n  \\<Longrightarrow> M = F_LR_MACHINE G' F k\n  \\<Longrightarrow> teA (cfg_initial G) \\<in> epda_events M\n  \\<Longrightarrow> set (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) \\<subseteq> epda_states M - {epda_initial M, last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G), teB Do]), F_DFA_GOTO M (epda_initial M) (teA (cfg_initial G))}\"\n  apply(subgoal_tac \"every_state_in_some_accessible_configuration M\")\n   prefer 2\n   apply(rule F_LR_MACHINE_all_Connected)\n      prefer 3\n      apply(simp add:)\n     apply(force)\n    apply(simp add:)\n   apply(simp add:)\n  apply(rule_tac\n      t=\"set (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      and s=\"{last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]), last(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])}\"\n      in ssubst)\n   apply(rule_tac\n      t=\"set (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      and s=\" {F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]!i| i. i<length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])} \"\n      in ssubst)\n    apply(rule set_conv_nth)\n   apply(rule_tac\n      t=\"length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      and s=\"length [teB Do, teA (cfg_initial G)]\"\n      in subst)\n    apply(rule_tac\n      M=\"M\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n     apply(rule set_take_head2)\n      apply(simp add:  F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n     apply(simp (no_asm_use))\n    apply(force)\n   apply(subgoal_tac \"{y. \\<exists>i. y = F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! i \\<and> i < length [teB Do, teA (cfg_initial G)]} = {last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]), last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])}\")\n    apply(force)\n   apply(rule order_antisym)\n    apply(rule subsetI)\n    apply(rename_tac x)(*strict*)\n    apply(subgoal_tac \"\\<exists>i. x=F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! i \\<and> i < length [teB Do, teA (cfg_initial G)]\")\n     apply(rename_tac x)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(thin_tac \"x \\<in> {F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! i |i. i < length [teB Do, teA (cfg_initial G)]}\")\n    apply(rename_tac x)(*strict*)\n    apply(erule exE)+\n    apply(rename_tac x i)(*strict*)\n    apply(erule conjE)+\n    apply(rule_tac\n      t=\"x\"\n      and s=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! i\"\n      in ssubst)\n     apply(rename_tac x i)(*strict*)\n     apply(force)\n    apply(rename_tac x i)(*strict*)\n    apply(case_tac i)\n     apply(rename_tac x i)(*strict*)\n     apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! i\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      in ssubst)\n      apply(rename_tac x i)(*strict*)\n      apply(rule_tac\n      t=\"[teB Do]\"\n      and s=\"take (Suc 0) [teB Do, teA (cfg_initial G)]\"\n      in subst)\n       apply(rename_tac x i)(*strict*)\n       apply(force)\n      apply(rename_tac x i)(*strict*)\n      apply(rule_tac\n      t=\"i\"\n      and s=\"0\"\n      in ssubst)\n       apply(rename_tac x i)(*strict*)\n       apply(force)\n      apply(rename_tac x i)(*strict*)\n      apply(rule nth_last_commutes_over_F_DFA_GOTO_SEQUENCE)\n           apply(rename_tac x i)(*strict*)\n           apply(force)\n          apply(rename_tac x i)(*strict*)\n          apply(force)\n         apply(rename_tac x i)(*strict*)\n         apply(force)\n        apply(rename_tac x i)(*strict*)\n        apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n       apply(rename_tac x i)(*strict*)\n       apply(force)\n      apply(rename_tac x i)(*strict*)\n      apply(rule set_take_head2)\n       apply(rename_tac x i)(*strict*)\n       apply(simp add:  F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n      apply(rename_tac x i)(*strict*)\n      apply(simp (no_asm_use))\n     apply(rename_tac x i)(*strict*)\n     apply(force)\n    apply(rename_tac x i nat)(*strict*)\n    apply(case_tac nat)\n     apply(rename_tac x i nat)(*strict*)\n     apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! i\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      in ssubst)\n      apply(rename_tac x i nat)(*strict*)\n      apply(rule_tac\n      t=\"i\"\n      and s=\"Suc 0\"\n      in ssubst)\n       apply(rename_tac x i nat)(*strict*)\n       apply(force)\n      apply(rename_tac x i nat)(*strict*)\n      apply(rule_tac\n      P=\"\\<lambda>qq. F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! Suc 0 = last (F_DFA_GOTO_SEQUENCE M (epda_initial M) qq)\"\n      and s=\"take (Suc (Suc 0)) [teB Do, teA (cfg_initial G)]\"\n      in ssubst)\n       apply(rename_tac x i nat)(*strict*)\n       apply(force)\n      apply(rename_tac x i nat)(*strict*)\n      apply(rule nth_last_commutes_over_F_DFA_GOTO_SEQUENCE)\n           apply(rename_tac x i nat)(*strict*)\n           apply(force)\n          apply(rename_tac x i nat)(*strict*)\n          apply(force)\n         apply(rename_tac x i nat)(*strict*)\n         apply(force)\n        apply(rename_tac x i nat)(*strict*)\n        apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n       apply(rename_tac x i nat)(*strict*)\n       apply(force)\n      apply(rename_tac x i nat)(*strict*)\n      apply(rule set_take_head2)\n       apply(rename_tac x i nat)(*strict*)\n       apply(simp add:  F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n      apply(rename_tac x i nat)(*strict*)\n      apply(simp (no_asm_use))\n     apply(rename_tac x i nat)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x i nat nata)(*strict*)\n    apply(force)\n   apply(rule subsetI)\n   apply(rename_tac x)(*strict*)\n   apply(case_tac \"x=last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\")\n    apply(rename_tac x)(*strict*)\n    apply(thin_tac \"x \\<in> {last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]), last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])}\")\n    apply(rename_tac x)(*strict*)\n    apply(rule_tac\n      t=\"x\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      in ssubst)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(subgoal_tac \"\\<exists>i. last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) = F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! i \\<and> i < length [teB Do, teA (cfg_initial G)]\")\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(rule_tac\n      x=\"Suc 0\"\n      in exI)\n    apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! Suc 0\"\n      and s=\"last(F_DFA_GOTO_SEQUENCE M (epda_initial M) (take (Suc (Suc 0)) [teB Do, teA (cfg_initial G)]))\"\n      in ssubst)\n     apply(rename_tac x)(*strict*)\n     apply(rule nth_last_commutes_over_F_DFA_GOTO_SEQUENCE)\n          apply(rename_tac x)(*strict*)\n          apply(force)\n         apply(rename_tac x)(*strict*)\n         apply(force)\n        apply(rename_tac x)(*strict*)\n        apply(force)\n       apply(rename_tac x)(*strict*)\n       apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n      apply(rename_tac x)(*strict*)\n      apply(force)\n     apply(rename_tac x)(*strict*)\n     apply(rule set_take_head2)\n      apply(rename_tac x)(*strict*)\n      apply(simp add:  F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n     apply(rename_tac x)(*strict*)\n     apply(simp (no_asm_use))\n    apply(rename_tac x)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(subgoal_tac \"x=last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\")\n    apply(rename_tac x)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(thin_tac \"x \\<noteq> last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\")\n   apply(thin_tac \"x \\<in> {last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]), last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])}\")\n   apply(rename_tac x)(*strict*)\n   apply(subgoal_tac \"\\<exists>i. x=F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! i \\<and> i < length [teB Do, teA (cfg_initial G)]\")\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(rule_tac\n      t=\"x\"\n      and s=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      in ssubst)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(rule_tac\n      x=\"0\"\n      in exI)\n   apply(rule_tac\n      t=\"F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)] ! 0\"\n      and s=\"last(F_DFA_GOTO_SEQUENCE M (epda_initial M) (take (Suc 0) [teB Do, teA (cfg_initial G)]))\"\n      in ssubst)\n    apply(rename_tac x)(*strict*)\n    apply(rule nth_last_commutes_over_F_DFA_GOTO_SEQUENCE)\n         apply(rename_tac x)(*strict*)\n         apply(force)\n        apply(rename_tac x)(*strict*)\n        apply(force)\n       apply(rename_tac x)(*strict*)\n       apply(force)\n      apply(rename_tac x)(*strict*)\n      apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(rule set_take_head2)\n     apply(rename_tac x)(*strict*)\n     apply(simp add:  F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n    apply(rename_tac x)(*strict*)\n    apply(simp (no_asm_use))\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n  apply(subgoal_tac \"length [] = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [])\")\n   apply(subgoal_tac \"length [teB Do, teA (cfg_initial G)] = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\")\n    apply(subgoal_tac \"length [teB Do] = length (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\")\n     apply(subgoal_tac \"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) =last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]))\")\n      apply(subgoal_tac \"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) =last ((epda_initial M)#(F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]))\")\n       apply(simp (no_asm))\n       apply(rule conjI)\n        apply(rule_tac\n      ?q0.0=\"epda_initial M\"\n      and w=\"[teB Do, teA (cfg_initial G)]\"\n      in DFA_F_DFA_GOTO_SEQUENCE_last_in_states)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n          apply(rule set_take_head2)\n           apply(simp add:  F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(rule conjI)\n        apply(rule_tac\n      P=\"\\<lambda>qq. last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) \\<noteq> qq\"\n      and s=\"last(epda_initial M # (F_DFA_GOTO_SEQUENCE M (epda_initial M) []))\"\n      in subst)\n         apply(rule last_ConsL)\n         apply(force)\n        apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      in ssubst)\n         apply(force)\n        apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_DFAGTOTO_differs2)\n                   apply(simp add:)\n                  apply(force)\n                 apply(force)\n                apply(force)\n               apply(simp add:)\n              apply(simp add:)\n             apply(force)\n            apply(simp add:)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(simp add:)\n       apply(rule conjI)\n        apply(rule_tac G=\"G\" in F_LR_MACHINE_DFAGTOTO_differs2_prime)\n                     apply(simp add:)\n                    apply(force)\n                   apply(force)\n                  apply(force)\n                 apply(simp add:)\n                apply(simp add:)\n               apply(force)\n              apply(simp add:)\n             apply(force)\n            apply(simp add:)\n           apply(simp add:)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(rule_tac\n      t=\"F_DFA_GOTO M (epda_initial M) (teA (cfg_initial G))\"\n      and s=\"{}\"\n      in ssubst)\n        apply(rule_tac\n      G=\"G\"\n      in ReadInitialIsEmpty)\n                 apply(simp add:)\n                apply(force)\n               apply(force)\n              apply(force)\n             apply(force)\n            apply(simp add:)\n           apply(simp add:)\n          apply(simp add:)\n         apply(simp add:)\n        apply(simp add:)\n       apply(rule conjI)\n        apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])\"\n      in ssubst)\n         apply(force)\n        apply(subgoal_tac \"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)])-{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} \\<noteq> {}\")\n         apply(force)\n        apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do, teA (cfg_initial G)]) - {I. valid_item G' k I \\<and> item_core I \\<in> cfg_productions G}\"\n      and s=\"{\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do, teA (cfg_initial G)], cfg_item_rhs2=[teB Do], cfg_item_look_ahead=[]\\<rparr>}\"\n      in ssubst)\n         apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_prefix_closureise_additionalItems_2)\n                   apply(simp add:)\n                  apply(simp add:)\n                 apply(simp add:)\n                apply(simp add:)\n               apply(simp add:)\n              apply(force)\n             apply(simp add:)\n            apply(simp add:)\n           apply(simp add:)\n          apply(simp add:)\n         apply(simp add:)\n        apply(force)\n       apply(rule conjI)\n        apply(rule_tac\n      ?q0.0=\"epda_initial M\"\n      and w=\"[teB Do]\"\n      in DFA_F_DFA_GOTO_SEQUENCE_last_in_states)\n              apply(force)\n             apply(force)\n            apply(force)\n           apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n          apply(rule set_take_head2)\n           apply(simp add:  F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def)\n          apply(force)\n         apply(force)\n        apply(force)\n       apply(rule conjI)\n        apply(rule_tac\n      P=\"\\<lambda>qq. last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) \\<noteq> qq\"\n      and s=\"last(epda_initial M # (F_DFA_GOTO_SEQUENCE M (epda_initial M) []))\"\n      in subst)\n         apply(rule last_ConsL)\n         apply(force)\n        apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      in ssubst)\n         apply(force)\n        apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_DFAGTOTO_differs2)\n                   apply(simp add:)\n                  apply(force)\n                 apply(force)\n                apply(force)\n               apply(simp add:)\n              apply(simp add:)\n             apply(force)\n            apply(simp add:)\n           apply(force)\n          apply(force)\n         apply(force)\n        apply(simp add:)\n       apply(rule conjI)\n        apply(rule_tac G=\"G\" in F_LR_MACHINE_DFAGTOTO_differs2_prime)\n                     apply(simp add:)\n                    apply(force)\n                   apply(force)\n                  apply(force)\n                 apply(simp add:)\n                apply(simp add:)\n               apply(force)\n              apply(simp add:)\n             apply(force)\n            apply(force)\n           apply(simp add:)\n          apply(simp add:)\n         apply(force)\n        apply(force)\n       apply(rule_tac\n      t=\"last (F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      and s=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])\"\n      in ssubst)\n        apply(force)\n       apply(subgoal_tac \"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do])-{I. (valid_item G' k I) \\<and> (item_core I \\<in> cfg_productions G)} \\<noteq> {}\")\n        apply(force)\n       apply(rule_tac\n      t=\"last (epda_initial M # F_DFA_GOTO_SEQUENCE M (epda_initial M) [teB Do]) - {I. valid_item G' k I \\<and> item_core I \\<in> cfg_productions G}\"\n      and s=\"{\\<lparr>cfg_item_lhs=S', cfg_item_rhs1=[teB Do], cfg_item_rhs2=[teA (cfg_initial G), teB Do], cfg_item_look_ahead=[]\\<rparr>}\"\n      in ssubst)\n        apply(rule_tac\n      G=\"G\"\n      in F_LR_MACHINE_prefix_closureise_additionalItems_1)\n                  apply(simp add:)\n                 apply(simp add:)\n                apply(simp add:)\n               apply(simp add:)\n              apply(simp add:)\n             apply(simp add:)\n            apply(force)\n           apply(simp add:)\n          apply(simp add:)\n         apply(simp add:)\n        apply(simp add:)\n       apply(force)\n      apply(rule sym)\n      apply(rule last_ConsR)\n      apply(force)\n     apply(rule sym)\n     apply(rule last_ConsR)\n     apply(force)\n    apply(rule_tac\n      M=\"M\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n         apply(force)\n        apply(force)\n       apply(force)\n      apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n     apply(simp add:  F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def)\n    apply(force)\n   apply(rule_tac\n      M=\"M\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n        apply(force)\n       apply(force)\n      apply(force)\n     apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n    apply(rule set_take_head2)\n     apply(simp add:  F_LR_MACHINE_def two_elements_construct_domain_def F_CFG_AUGMENT_def)\n    apply(force)\n   apply(force)\n  apply(rule_tac\n      M=\"M\"\n      and q=\"epda_initial M\"\n      in F_DFA_GOTO_SEQUENCESound_main1)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(simp add: valid_dfa_def valid_dpda_def valid_pda_def valid_epda_def)\n   apply(force)\n  apply(force)\n  done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_06_04/FUNCTION__LR_MACHINE.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.3103032397479641}}
{"text": "section \\<open> Reactive Healthiness Conditions \\<close>\n\ntheory utp_rea_healths\n  imports utp_rea_core\nbegin\n\nsubsection \\<open> R1: Events cannot be undone \\<close>\n\ndefinition R1 :: \"('t::trace, '\\<alpha>, '\\<beta>) rel_rp \\<Rightarrow> ('t, '\\<alpha>, '\\<beta>) rel_rp\" where\nR1_def [upred_defs]: \"R1 (P) = (P \\<and> ($tr \\<le>\\<^sub>u $tr\\<acute>))\"\n\nutp_const R1\n\nlemma R1_idem: \"R1(R1(P)) = R1(P)\"\n  by pred_auto\n\nlemma R1_Idempotent [closure]: \"Idempotent R1\"\n  by (simp add: Idempotent_def R1_idem)\n\nlemma R1_mono: \"P \\<sqsubseteq> Q \\<Longrightarrow> R1(P) \\<sqsubseteq> R1(Q)\"\n  by pred_auto\n\nlemma R1_Monotonic: \"Monotonic R1\"\n  by (simp add: mono_def R1_mono)\n\nlemma R1_Continuous: \"Continuous R1\"\n  by (auto simp add: Continuous_def, rel_auto)\n\nlemma R1_unrest [unrest]: \"\\<lbrakk> x \\<bowtie> in_var tr; x \\<bowtie> out_var tr; x \\<sharp> P \\<rbrakk> \\<Longrightarrow> x \\<sharp> R1(P)\"\n  by (simp add: R1_def unrest lens_indep_sym)\n\nlemma R1_false: \"R1(false) = false\"\n  by pred_auto\n\nlemma R1_conj: \"R1(P \\<and> Q) = (R1(P) \\<and> R1(Q))\"\n  by pred_auto\n\nlemma conj_R1_closed_1 [closure]: \"P is R1 \\<Longrightarrow> (P \\<and> Q) is R1\"\n  by (rel_blast)\n\nlemma conj_R1_closed_2 [closure]: \"Q is R1 \\<Longrightarrow> (P \\<and> Q) is R1\"\n  by (rel_blast)\n\nlemma R1_disj: \"R1(P \\<or> Q) = (R1(P) \\<or> R1(Q))\"\n  by pred_auto\n\nlemma disj_R1_closed [closure]: \"\\<lbrakk> P is R1; Q is R1 \\<rbrakk> \\<Longrightarrow> (P \\<or> Q) is R1\"\n  by (simp add: Healthy_def R1_def utp_pred_laws.inf_sup_distrib2)\n\nlemma R1_impl: \"R1(P \\<Rightarrow> Q) = ((\\<not> R1(\\<not> P)) \\<Rightarrow> R1(Q))\"\n  by (rel_auto)\n\nlemma R1_inf: \"R1(P \\<sqinter> Q) = (R1(P) \\<sqinter> R1(Q))\"\n  by pred_auto\n\nlemma R1_USUP:\n  \"R1(\\<Sqinter> i \\<in> A \\<bullet> P(i)) = (\\<Sqinter> i \\<in> A \\<bullet> R1(P(i)))\"\n  by (rel_auto)\n\nlemma R1_Sup [closure]: \"\\<lbrakk> \\<And> P. P \\<in> A \\<Longrightarrow> P is R1; A \\<noteq> {} \\<rbrakk> \\<Longrightarrow> \\<Sqinter> A is R1\"\n  using R1_Continuous by (auto simp add: Continuous_def Healthy_def)\n\nlemma R1_UINF:\n  assumes \"A \\<noteq> {}\"\n  shows \"R1(\\<Squnion> i \\<in> A \\<bullet> P(i)) = (\\<Squnion> i \\<in> A \\<bullet> R1(P(i)))\"\n  using assms by (rel_auto)\n\nlemma R1_UINF_ind:\n  \"R1(\\<Squnion> i \\<bullet> P(i)) = (\\<Squnion> i \\<bullet> R1(P(i)))\"\n  by (rel_auto)\n\nlemma UINF_ind_R1_closed [closure]:\n  \"\\<lbrakk> \\<And> i. P(i) is R1 \\<rbrakk> \\<Longrightarrow> (\\<Sqinter> i \\<bullet> P(i)) is R1\"\n  by (rel_blast)\n\nlemma UINF_R1_closed [closure]:\n  \"\\<lbrakk> \\<And> i. P i is R1 \\<rbrakk> \\<Longrightarrow> (\\<Sqinter> i \\<in> A \\<bullet> P i) is R1\"\n  by (rel_blast)\n    \nlemma tr_ext_conj_R1 [closure]: \n  \"$tr\\<acute> =\\<^sub>u $tr ^\\<^sub>u e \\<and> P is R1\"\n  by (rel_auto, simp add: Prefix_Order.prefixI)\n\nlemma tr_id_conj_R1 [closure]: \n  \"$tr\\<acute> =\\<^sub>u $tr \\<and> P is R1\"\n  by (rel_auto)\n\nlemma R1_extend_conj: \"R1(P \\<and> Q) = (R1(P) \\<and> Q)\"\n  by pred_auto\n\nlemma R1_extend_conj': \"R1(P \\<and> Q) = (P \\<and> R1(Q))\"\n  by pred_auto\n\nlemma R1_cond: \"R1(P \\<triangleleft> b \\<triangleright> Q) = (R1(P) \\<triangleleft> b \\<triangleright> R1(Q))\"\n  by (rel_auto)\n\nlemma R1_cond': \"R1(P \\<triangleleft> b \\<triangleright> Q) = (R1(P) \\<triangleleft> R1(b) \\<triangleright> R1(Q))\"\n  by (rel_auto)\n\nlemma R1_negate_R1: \"R1(\\<not> R1(P)) = R1(\\<not> P)\"\n  by pred_auto\n\nlemma R1_wait_true [usubst]: \"(R1 P)\\<^sub>t = R1(P)\\<^sub>t\"\n  by pred_auto\n\nlemma R1_wait_false [usubst]: \"(R1 P) \\<^sub>f = R1(P) \\<^sub>f\"\n  by pred_auto\n\nlemma R1_wait'_true [usubst]: \"(R1 P)\\<lbrakk>true/$wait\\<acute>\\<rbrakk> = R1(P\\<lbrakk>true/$wait\\<acute>\\<rbrakk>)\"\n  by (rel_auto)\n\nlemma R1_wait'_false [usubst]: \"(R1 P)\\<lbrakk>false/$wait\\<acute>\\<rbrakk> = R1(P\\<lbrakk>false/$wait\\<acute>\\<rbrakk>)\"\n  by (rel_auto)\n\nlemma R1_wait_false_closed [closure]: \"P is R1 \\<Longrightarrow> P\\<lbrakk>false/$wait\\<rbrakk> is R1\"\n  by (rel_auto)\n\nlemma R1_wait'_false_closed [closure]: \"P is R1 \\<Longrightarrow> P\\<lbrakk>false/$wait\\<acute>\\<rbrakk> is R1\"\n  by (rel_auto)\n\nlemma R1_skip: \"R1(II) = II\"\n  by (rel_auto)\n\nlemma skip_is_R1 [closure]: \"II is R1\"\n  by (rel_auto)\n\nlemma subst_R1: \"\\<lbrakk> $tr \\<sharp>\\<^sub>s \\<sigma>; $tr\\<acute> \\<sharp>\\<^sub>s \\<sigma>  \\<rbrakk> \\<Longrightarrow> \\<sigma> \\<dagger> (R1 P) = R1(\\<sigma> \\<dagger> P)\"\n  by (simp add: R1_def usubst usubst_apply_unrest)\n  \nlemma subst_R1_closed [closure]: \"\\<lbrakk> $tr \\<sharp>\\<^sub>s \\<sigma>; $tr\\<acute> \\<sharp>\\<^sub>s \\<sigma>; P is R1 \\<rbrakk> \\<Longrightarrow> \\<sigma> \\<dagger> P is R1\"\n  by (metis Healthy_def subst_R1)\n\nlemma R1_by_refinement:\n  \"P is R1 \\<longleftrightarrow> (($tr \\<le>\\<^sub>u $tr\\<acute>) \\<sqsubseteq> P)\"\n  by (rel_blast)\n\nlemma R1_trace_extension [closure]:\n  \"$tr\\<acute> \\<ge>\\<^sub>u $tr ^\\<^sub>u e is R1\"\n  by (rel_auto)\n    \nlemma tr_le_trans:\n  \"(($tr \\<le>\\<^sub>u $tr\\<acute>) ;; ($tr \\<le>\\<^sub>u $tr\\<acute>)) = ($tr \\<le>\\<^sub>u $tr\\<acute>)\"\n  by (rel_auto)\n    \nlemma R1_seqr:\n  \"R1(R1(P) ;; R1(Q)) = (R1(P) ;; R1(Q))\"\n  by (rel_auto)\n\nlemma R1_seqr_closure [closure]:\n  assumes \"P is R1\" \"Q is R1\"\n  shows \"(P ;; Q) is R1\"\n  using assms unfolding R1_by_refinement\n  by (metis seqr_mono tr_le_trans)\n\nlemma R1_power [closure]: \"P is R1 \\<Longrightarrow> P\\<^bold>^n is R1\"\n  by (induct n, simp_all add: upred_semiring.power_Suc closure)\n\nlemma R1_true_comp [simp]: \"(R1(true) ;; R1(true)) = R1(true)\"\n  by (rel_auto)\n\nlemma R1_ok'_true: \"(R1(P))\\<^sup>t = R1(P\\<^sup>t)\"\n  by pred_auto\n\nlemma R1_ok'_false: \"(R1(P))\\<^sup>f = R1(P\\<^sup>f)\"\n  by pred_auto\n\nlemma R1_ok_true: \"(R1(P))\\<lbrakk>true/$ok\\<rbrakk> = R1(P\\<lbrakk>true/$ok\\<rbrakk>)\"\n  by pred_auto\n\nlemma R1_ok_false: \"(R1(P))\\<lbrakk>false/$ok\\<rbrakk> = R1(P\\<lbrakk>false/$ok\\<rbrakk>)\"\n  by pred_auto\n\nlemma seqr_R1_true_right: \"((P ;; R1(true)) \\<or> P) = (P ;; ($tr \\<le>\\<^sub>u $tr\\<acute>))\"\n  by (rel_auto)\n\nlemma conj_R1_true_right: \"(P;;R1(true) \\<and> Q;;R1(true)) ;; R1(true) = (P;;R1(true) \\<and> Q;;R1(true))\"\n  apply (rel_auto) using dual_order.trans by blast+\n\nlemma R1_extend_conj_unrest: \"\\<lbrakk> $tr \\<sharp> Q; $tr\\<acute> \\<sharp> Q \\<rbrakk> \\<Longrightarrow> R1(P \\<and> Q) = (R1(P) \\<and> Q)\"\n  by pred_auto\n\nlemma R1_extend_conj_unrest': \"\\<lbrakk> $tr \\<sharp> P; $tr\\<acute> \\<sharp> P \\<rbrakk> \\<Longrightarrow> R1(P \\<and> Q) = (P \\<and> R1(Q))\"\n  by pred_auto\n\nlemma R1_tr'_eq_tr: \"R1($tr\\<acute> =\\<^sub>u $tr) = ($tr\\<acute> =\\<^sub>u $tr)\"\n  by (rel_auto)\n\nlemma R1_tr_less_tr': \"R1($tr <\\<^sub>u $tr\\<acute>) = ($tr <\\<^sub>u $tr\\<acute>)\"\n  by (rel_auto)\n\nlemma tr_strict_prefix_R1_closed [closure]: \"$tr <\\<^sub>u $tr\\<acute> is R1\"\n  by (rel_auto)\n    \nlemma R1_H2_commute: \"R1(H2(P)) = H2(R1(P))\"\n  by (simp add: H2_split R1_def usubst, rel_auto)\n\nsubsection \\<open> R2: No dependence upon trace history \\<close>\n\ntext \\<open> There are various ways of expressing $R2$, which are enumerated below. \\<close>\n\ndefinition R2a :: \"('t::trace, '\\<alpha>, '\\<beta>) rel_rp \\<Rightarrow> ('t,'\\<alpha>,'\\<beta>) rel_rp\" where\n[upred_defs]: \"R2a (P) = (\\<Sqinter> s \\<bullet> P\\<lbrakk>\\<guillemotleft>s\\<guillemotright>,(\\<guillemotleft>s\\<guillemotright>+($tr\\<acute>-$tr))/$tr,$tr\\<acute>\\<rbrakk>)\"\n\ndefinition R2a' :: \"('t::trace, '\\<alpha>, '\\<beta>) rel_rp \\<Rightarrow> ('t,'\\<alpha>,'\\<beta>) rel_rp\" where\n[upred_defs]: \"R2a' P = (R2a(P) \\<triangleleft> R1(true) \\<triangleright> P)\"\n\ndefinition R2s :: \"('t::trace, '\\<alpha>, '\\<beta>) rel_rp \\<Rightarrow> ('t,'\\<alpha>,'\\<beta>) rel_rp\" where\n[upred_defs]: \"R2s (P) = (P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>($tr\\<acute>-$tr)/$tr\\<acute>\\<rbrakk>)\"\n\ndefinition R2 :: \"('t::trace, '\\<alpha>, '\\<beta>) rel_rp \\<Rightarrow> ('t, '\\<alpha>, '\\<beta>) rel_rp\" where\n[upred_defs]: \"R2(P) = R1(R2s(P))\"\n\ndefinition R2c :: \"('t::trace, '\\<alpha>, '\\<beta>) rel_rp \\<Rightarrow> ('t, '\\<alpha>, '\\<beta>) rel_rp\" where\n[upred_defs]: \"R2c(P) = (R2s(P) \\<triangleleft> R1(true) \\<triangleright> P)\"\n\ntext \\<open> @{term R2a} and @{term R2s} are the standard definitions from the UTP book~\\cite{Hoare&98}.\n  An issue with these forms is that their definition depends upon @{term R1} also being \n  satisfied~\\cite{Foster17b}, since otherwise the trace minus operator is not well defined. \n  We overcome this with our own version, @{term R2c}, which applies @{term R2s} if @{term R1} holds,\n  and otherwise has no effect. This latter healthiness condition can therefore be reasoned about\n  independently of @{term R1}, which is useful in some circumstances. \\<close>\n\nlemma unrest_ok_R2s [unrest]: \"$ok \\<sharp> P \\<Longrightarrow> $ok \\<sharp> R2s(P)\"\n  by (simp add: R2s_def unrest)\n\nlemma unrest_ok'_R2s [unrest]: \"$ok\\<acute> \\<sharp> P \\<Longrightarrow> $ok\\<acute> \\<sharp> R2s(P)\"\n  by (simp add: R2s_def unrest)\n\nlemma unrest_ok_R2c [unrest]: \"$ok \\<sharp> P \\<Longrightarrow> $ok \\<sharp> R2c(P)\"\n  by (simp add: R2c_def unrest)\n\nlemma unrest_ok'_R2c [unrest]: \"$ok\\<acute> \\<sharp> P \\<Longrightarrow> $ok\\<acute> \\<sharp> R2c(P)\"\n  by (simp add: R2c_def unrest)\n\nlemma R2s_unrest [unrest]: \"\\<lbrakk> vwb_lens x; x \\<bowtie> in_var tr; x \\<bowtie> out_var tr; x \\<sharp> P \\<rbrakk> \\<Longrightarrow> x \\<sharp> R2s(P)\"\n  by (simp add: R2s_def unrest usubst lens_indep_sym)\n\nlemma R2s_subst_wait_true [usubst]:\n  \"(R2s(P))\\<lbrakk>true/$wait\\<rbrakk> = R2s(P\\<lbrakk>true/$wait\\<rbrakk>)\"\n  by (simp add: R2s_def usubst unrest)\n\nlemma R2s_subst_wait'_true [usubst]:\n  \"(R2s(P))\\<lbrakk>true/$wait\\<acute>\\<rbrakk> = R2s(P\\<lbrakk>true/$wait\\<acute>\\<rbrakk>)\"\n  by (simp add: R2s_def usubst unrest)\n\nlemma R2_subst_wait_true [usubst]:\n  \"(R2(P))\\<lbrakk>true/$wait\\<rbrakk> = R2(P\\<lbrakk>true/$wait\\<rbrakk>)\"\n  by (simp add: R2_def R1_def R2s_def usubst unrest)\n\nlemma R2_subst_wait'_true [usubst]:\n  \"(R2(P))\\<lbrakk>true/$wait\\<acute>\\<rbrakk> = R2(P\\<lbrakk>true/$wait\\<acute>\\<rbrakk>)\"\n  by (simp add: R2_def R1_def R2s_def usubst unrest)\n\nlemma R2_subst_wait_false [usubst]:\n  \"(R2(P))\\<lbrakk>false/$wait\\<rbrakk> = R2(P\\<lbrakk>false/$wait\\<rbrakk>)\"\n  by (simp add: R2_def R1_def R2s_def usubst unrest)\n\nlemma R2_subst_wait'_false [usubst]:\n  \"(R2(P))\\<lbrakk>false/$wait\\<acute>\\<rbrakk> = R2(P\\<lbrakk>false/$wait\\<acute>\\<rbrakk>)\"\n  by (simp add: R2_def R1_def R2s_def usubst unrest)\n\nlemma R2c_R2s_absorb: \"R2c(R2s(P)) = R2s(P)\"\n  by (rel_auto)\n\nlemma R2a_R2s: \"R2a(R2s(P)) = R2s(P)\"\n  by (rel_auto)\n\nlemma R2s_R2a: \"R2s(R2a(P)) = R2a(P)\"\n  by (rel_auto)\n\nlemma R2a_equiv_R2s: \"P is R2a \\<longleftrightarrow> P is R2s\"\n  by (metis Healthy_def' R2a_R2s R2s_R2a)\n\nlemma R2a_idem: \"R2a(R2a(P)) = R2a(P)\"\n  by (rel_auto)\n\nlemma R2a'_idem: \"R2a'(R2a'(P)) = R2a'(P)\"\n  by (rel_auto)\n\nlemma R2a_mono: \"P \\<sqsubseteq> Q \\<Longrightarrow> R2a(P) \\<sqsubseteq> R2a(Q)\"\n  by (rel_blast)\n\nlemma R2a'_mono: \"P \\<sqsubseteq> Q \\<Longrightarrow> R2a'(P) \\<sqsubseteq> R2a'(Q)\"\n  by (rel_blast)\n\nlemma R2a'_weakening: \"R2a'(P) \\<sqsubseteq> P\"\n  apply (rel_simp)\n  apply (rename_tac ok wait tr more ok' wait' tr' more')\n  apply (rule_tac x=\"tr\" in exI)\n  apply (simp add: diff_add_cancel_left')\n  done\n\nlemma R2s_idem: \"R2s(R2s(P)) = R2s(P)\"\n  by (pred_auto)\n\nlemma R2_idem: \"R2(R2(P)) = R2(P)\"\n  by (pred_auto)\n\nlemma R2_mono: \"P \\<sqsubseteq> Q \\<Longrightarrow> R2(P) \\<sqsubseteq> R2(Q)\"\n  by (pred_auto)\n\nlemma R2_implies_R1 [closure]: \"P is R2 \\<Longrightarrow> P is R1\"\n  by (rel_blast)\n\nlemma R2_implies_R2c [closure]: \"P is R2 \\<Longrightarrow> P is R2c\"\n  by (rel_blast)\n\nlemma R2c_Continuous: \"Continuous R2c\"\n  by (rel_simp)\n\nlemma R2c_lit: \"R2c(\\<guillemotleft>x\\<guillemotright>) = \\<guillemotleft>x\\<guillemotright>\"\n  by (rel_auto)\n\nlemma tr_strict_prefix_R2c_closed [closure]: \"$tr <\\<^sub>u $tr\\<acute> is R2c\"\n  by (rel_auto)\n\nlemma R2s_conj: \"R2s(P \\<and> Q) = (R2s(P) \\<and> R2s(Q))\"\n  by (pred_auto)\n\nlemma R2_conj: \"R2(P \\<and> Q) = (R2(P) \\<and> R2(Q))\"\n  by (pred_auto)\n\nlemma R2s_disj: \"R2s(P \\<or> Q) = (R2s(P) \\<or> R2s(Q))\"\n  by pred_auto\n\nlemma R2s_USUP:\n  \"R2s(\\<Sqinter> i \\<in> A \\<bullet> P(i)) = (\\<Sqinter> i \\<in> A \\<bullet> R2s(P(i)))\"\n  by (simp add: R2s_def usubst)\n\nlemma R2c_USUP:\n  \"R2c(\\<Sqinter> i \\<in> A \\<bullet> P(i)) = (\\<Sqinter> i \\<in> A \\<bullet> R2c(P(i)))\"\n  by (rel_auto)\n\nlemma R2s_UINF:\n  \"R2s(\\<Squnion> i \\<in> A \\<bullet> P(i)) = (\\<Squnion> i \\<in> A \\<bullet> R2s(P(i)))\"\n  by (simp add: R2s_def usubst)\n\nlemma R2c_UINF:\n  \"R2c(\\<Squnion> i \\<in> A \\<bullet> P(i)) = (\\<Squnion> i \\<in> A \\<bullet> R2c(P(i)))\"\n  by (rel_auto)\n\nlemma R2_disj: \"R2(P \\<or> Q) = (R2(P) \\<or> R2(Q))\"\n  by (pred_auto)\n\nlemma R2s_not: \"R2s(\\<not> P) = (\\<not> R2s(P))\"\n  by pred_auto\n\nlemma R2s_condr: \"R2s(P \\<triangleleft> b \\<triangleright> Q) = (R2s(P) \\<triangleleft> R2s(b) \\<triangleright> R2s(Q))\"\n  by (rel_auto)\n\nlemma R2_condr: \"R2(P \\<triangleleft> b \\<triangleright> Q) = (R2(P) \\<triangleleft> R2(b) \\<triangleright> R2(Q))\"\n  by (rel_auto)\n\nlemma R2_condr': \"R2(P \\<triangleleft> b \\<triangleright> Q) = (R2(P) \\<triangleleft> R2s(b) \\<triangleright> R2(Q))\"\n  by (rel_auto)\n\nlemma R2s_ok: \"R2s($ok) = $ok\"\n  by (rel_auto)\n\nlemma R2s_ok': \"R2s($ok\\<acute>) = $ok\\<acute>\"\n  by (rel_auto)\n\nlemma R2s_wait: \"R2s($wait) = $wait\"\n  by (rel_auto)\n\nlemma R2s_wait': \"R2s($wait\\<acute>) = $wait\\<acute>\"\n  by (rel_auto)\n\nlemma R2s_true: \"R2s(true) = true\"\n  by pred_auto\n\nlemma R2s_false: \"R2s(false) = false\"\n  by pred_auto\n\nlemma true_is_R2s:\n  \"true is R2s\"\n  by (simp add: Healthy_def R2s_true)\n\nlemma R2s_lift_rea: \"R2s(\\<lceil>P\\<rceil>\\<^sub>R) = \\<lceil>P\\<rceil>\\<^sub>R\"\n  by (simp add: R2s_def usubst unrest)\n\nlemma R2c_lift_rea: \"R2c(\\<lceil>P\\<rceil>\\<^sub>R) = \\<lceil>P\\<rceil>\\<^sub>R\"\n  by (simp add: R2c_def R2s_lift_rea cond_idem usubst unrest)\n\nlemma R2c_true: \"R2c(true) = true\"\n  by (rel_auto)\n\nlemma R2c_false: \"R2c(false) = false\"\n  by (rel_auto)\n\nlemma R2c_and: \"R2c(P \\<and> Q) = (R2c(P) \\<and> R2c(Q))\"\n  by (rel_auto)\n\nlemma conj_R2c_closed [closure]: \"\\<lbrakk> P is R2c; Q is R2c \\<rbrakk> \\<Longrightarrow> (P \\<and> Q) is R2c\"\n  by (simp add: Healthy_def R2c_and)\n\nlemma R2c_disj: \"R2c(P \\<or> Q) = (R2c(P) \\<or> R2c(Q))\"\n  by (rel_auto)\n\nlemma R2c_inf: \"R2c(P \\<sqinter> Q) = (R2c(P) \\<sqinter> R2c(Q))\"\n  by (rel_auto)\n\nlemma R2c_not: \"R2c(\\<not> P) = (\\<not> R2c(P))\"\n  by (rel_auto)\n\nlemma R2c_ok: \"R2c($ok) = ($ok)\"\n  by (rel_auto)\n\nlemma R2c_ok': \"R2c($ok\\<acute>) = ($ok\\<acute>)\"\n  by (rel_auto)\n\nlemma R2c_wait: \"R2c($wait) = $wait\"\n  by (rel_auto)\n\nlemma R2c_wait': \"R2c($wait\\<acute>) = $wait\\<acute>\"\n  by (rel_auto)\n\nlemma R2c_wait'_true [usubst]: \"(R2c P)\\<lbrakk>true/$wait\\<acute>\\<rbrakk> = R2c(P\\<lbrakk>true/$wait\\<acute>\\<rbrakk>)\"\n  by (rel_auto)\n\nlemma R2c_wait'_false [usubst]: \"(R2c P)\\<lbrakk>false/$wait\\<acute>\\<rbrakk> = R2c(P\\<lbrakk>false/$wait\\<acute>\\<rbrakk>)\"\n  by (rel_auto)\n\nlemma R2c_tr'_minus_tr: \"R2c($tr\\<acute> =\\<^sub>u $tr) = ($tr\\<acute> =\\<^sub>u $tr)\"\n  apply (rel_auto) using minus_zero_eq by blast\n\nlemma R2c_tr_le_tr': \"R2c($tr \\<le>\\<^sub>u $tr\\<acute>) = ($tr \\<le>\\<^sub>u $tr\\<acute>)\"\n  by (rel_auto)\n\nlemma R2c_tr'_ge_tr: \"R2c($tr\\<acute> \\<ge>\\<^sub>u $tr) = ($tr\\<acute> \\<ge>\\<^sub>u $tr)\"\n  by (rel_auto)\n\nlemma R2c_tr_less_tr': \"R2c($tr <\\<^sub>u $tr\\<acute>) = ($tr <\\<^sub>u $tr\\<acute>)\"\n  by (rel_auto)\n\nlemma R2c_condr: \"R2c(P \\<triangleleft> b \\<triangleright> Q) = (R2c(P) \\<triangleleft> R2c(b) \\<triangleright> R2c(Q))\"\n  by (rel_auto)\n\nlemma R2c_shAll: \"R2c (\\<^bold>\\<forall> x \\<bullet> P x) = (\\<^bold>\\<forall> x \\<bullet> R2c(P x))\"\n  by (rel_auto)\n\nlemma R2c_impl: \"R2c(P \\<Rightarrow> Q) = (R2c(P) \\<Rightarrow> R2c(Q))\"\n  by (metis (no_types, lifting) R2c_and R2c_not double_negation impl_alt_def not_conj_deMorgans)\n\nlemma R2c_skip_r: \"R2c(II) = II\"\nproof -\n  have \"R2c(II) = R2c($tr\\<acute> =\\<^sub>u $tr \\<and> II\\<restriction>\\<^sub>\\<alpha>tr)\"\n    by (subst skip_r_unfold[of tr], simp_all)\n  also have \"... = (R2c($tr\\<acute> =\\<^sub>u $tr) \\<and> II\\<restriction>\\<^sub>\\<alpha>tr)\"\n    by (simp add: R2c_and, simp add: R2c_def R2s_def usubst unrest cond_idem)\n  also have \"... = ($tr\\<acute> =\\<^sub>u $tr \\<and> II\\<restriction>\\<^sub>\\<alpha>tr)\"\n    by (simp add: R2c_tr'_minus_tr)\n  finally show ?thesis\n    by (subst skip_r_unfold[of tr], simp_all)\nqed\n\nlemma R1_R2c_commute: \"R1(R2c(P)) = R2c(R1(P))\"\n  by (rel_auto)\n\nlemma R1_R2c_is_R2: \"R1(R2c(P)) = R2(P)\"\n  by (rel_auto)\n\nlemma R1_R2s_R2c: \"R1(R2s(P)) = R1(R2c(P))\"\n  by (rel_auto)\n\nlemma R1_R2s_tr_wait:\n  \"R1 (R2s ($tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute>)) = ($tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute>)\"\n  apply rel_auto using minus_zero_eq by blast\n\nlemma R1_R2s_tr'_eq_tr:\n  \"R1 (R2s ($tr\\<acute> =\\<^sub>u $tr)) = ($tr\\<acute> =\\<^sub>u $tr)\"\n  apply (rel_auto) using minus_zero_eq by blast\n\nlemma R1_R2s_tr'_extend_tr:\n  \"\\<lbrakk> $tr \\<sharp> v; $tr\\<acute> \\<sharp> v \\<rbrakk> \\<Longrightarrow> R1 (R2s ($tr\\<acute> =\\<^sub>u $tr ^\\<^sub>u v)) = ($tr\\<acute> =\\<^sub>u $tr  ^\\<^sub>u v)\"\n  apply (rel_auto)\n   apply (metis append_minus)\n  apply (simp add: Prefix_Order.prefixI)\n  done\n\nlemma R2_tr_prefix: \"R2($tr \\<le>\\<^sub>u $tr\\<acute>) = ($tr \\<le>\\<^sub>u $tr\\<acute>)\"\n  by (pred_auto)\n\nlemma R2_form:\n  \"R2(P) = (\\<^bold>\\<exists> tt\\<^sub>0 \\<bullet> P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>0\\<guillemotright>/$tr\\<acute>\\<rbrakk> \\<and> $tr\\<acute> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>0\\<guillemotright>)\"\n  by (rel_auto, metis trace_class.add_diff_cancel_left trace_class.le_iff_add)\n\nlemma R2_subst_tr: \n  assumes \"P is R2\" \n  shows \"[$tr \\<mapsto>\\<^sub>s tr\\<^sub>0, $tr\\<acute> \\<mapsto>\\<^sub>s tr\\<^sub>0 + t] \\<dagger> P = [$tr \\<mapsto>\\<^sub>s 0, $tr\\<acute> \\<mapsto>\\<^sub>s t] \\<dagger> P\"\nproof -\n  have \"[$tr \\<mapsto>\\<^sub>s tr\\<^sub>0, $tr\\<acute> \\<mapsto>\\<^sub>s tr\\<^sub>0 + t] \\<dagger> R2 P = [$tr \\<mapsto>\\<^sub>s 0, $tr\\<acute> \\<mapsto>\\<^sub>s t] \\<dagger> R2 P\"\n    by (rel_auto)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma R2_seqr_form:\n  shows \"(R2(P) ;; R2(Q)) =\n         (\\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> ((P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk>) ;; (Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk>))\n                        \\<and> ($tr\\<acute> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>))\"\nproof -\n  have \"(R2(P) ;; R2(Q)) = (\\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> (R2(P))\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; (R2(Q))\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<rbrakk>)\"\n    by (subst seqr_middle[of tr], simp_all)\n  also have \"... =\n       (\\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> ((P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk> \\<and> \\<guillemotleft>tr\\<^sub>0\\<guillemotright> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>1\\<guillemotright>) ;;\n                                (Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk> \\<and> $tr\\<acute> =\\<^sub>u \\<guillemotleft>tr\\<^sub>0\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>)))\"\n    by (simp add: R2_form usubst unrest uquant_lift, rel_blast)\n  also have \"... =\n       (\\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> ((\\<guillemotleft>tr\\<^sub>0\\<guillemotright> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>1\\<guillemotright> \\<and> P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk>) ;;\n                                (Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk> \\<and> $tr\\<acute> =\\<^sub>u \\<guillemotleft>tr\\<^sub>0\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>)))\"\n    by (simp add: conj_comm)\n  also have \"... =\n       (\\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> \\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> ((P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk>) ;; (Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk>))\n                                \\<and> \\<guillemotleft>tr\\<^sub>0\\<guillemotright> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>1\\<guillemotright> \\<and> $tr\\<acute> =\\<^sub>u \\<guillemotleft>tr\\<^sub>0\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>)\"\n    by (rel_blast)\n  also have \"... =\n       (\\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> ((P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk>) ;; (Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk>))\n                        \\<and> (\\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> \\<guillemotleft>tr\\<^sub>0\\<guillemotright> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>1\\<guillemotright> \\<and> $tr\\<acute> =\\<^sub>u \\<guillemotleft>tr\\<^sub>0\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>))\"\n    by (rel_auto)\n  also have \"... =\n       (\\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> ((P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk>) ;; (Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk>))\n                        \\<and> ($tr\\<acute> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>))\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nlemma R2_seqr_form':\n  assumes \"P is R2\" \"Q is R2\"\n  shows \"P ;; Q =\n         (\\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> ((P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk>) ;; (Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk>))\n                        \\<and> ($tr\\<acute> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>))\"\n  using R2_seqr_form[of P Q] by (simp add: Healthy_if assms)\n\nlemma R2_seqr_form'':\n  assumes \"P is R2\" \"Q is R2\"\n  shows \"P ;; Q =\n         (\\<^bold>\\<exists> (tt\\<^sub>1, tt\\<^sub>2) \\<bullet> ((P\\<lbrakk>0,\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr,$tr\\<acute>\\<rbrakk>) ;; (Q\\<lbrakk>0,\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr,$tr\\<acute>\\<rbrakk>))\n                         \\<and> ($tr\\<acute> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>))\"\n  by (subst R2_seqr_form', simp_all add: assms, rel_auto)\n\nlemma R2_tr_middle:\n  assumes \"P is R2\" \"Q is R2\"\n  shows \"(\\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> (P\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; Q\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<rbrakk>) \\<and> \\<guillemotleft>tr\\<^sub>0\\<guillemotright> \\<le>\\<^sub>u $tr\\<acute>) = (P ;; Q)\"\nproof -\n  have \"(P ;; Q) = (\\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> (P\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; Q\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<rbrakk>))\"\n    by (simp add: seqr_middle)\n  also have \"... = (\\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> ((R2 P)\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; (R2 Q)\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<rbrakk>))\"\n    by (simp add: assms Healthy_if)\n  also have \"... = (\\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> ((R2 P)\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; (R2 Q)\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<rbrakk>) \\<and> \\<guillemotleft>tr\\<^sub>0\\<guillemotright> \\<le>\\<^sub>u $tr\\<acute>)\"\n    by (rel_auto)\n  also have \"... = (\\<^bold>\\<exists> tr\\<^sub>0 \\<bullet> (P\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; Q\\<lbrakk>\\<guillemotleft>tr\\<^sub>0\\<guillemotright>/$tr\\<rbrakk>) \\<and> \\<guillemotleft>tr\\<^sub>0\\<guillemotright> \\<le>\\<^sub>u $tr\\<acute>)\"\n    by (simp add: assms Healthy_if)\n  finally show ?thesis ..\nqed\n\nlemma R2_seqr_distribute:\n  fixes P :: \"('t::trace,'\\<alpha>,'\\<beta>) rel_rp\" and Q :: \"('t,'\\<beta>,'\\<gamma>) rel_rp\"\n  shows \"R2(R2(P) ;; R2(Q)) = (R2(P) ;; R2(Q))\"\nproof -\n  have \"R2(R2(P) ;; R2(Q)) =\n    ((\\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> (P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk>)\\<lbrakk>($tr\\<acute> - $tr)/$tr\\<acute>\\<rbrakk>\n      \\<and> $tr\\<acute> - $tr =\\<^sub>u \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>) \\<and> $tr\\<acute> \\<ge>\\<^sub>u $tr)\"\n    by (simp add: R2_seqr_form, simp add: R2s_def usubst unrest, rel_auto)\n  also have \"... =\n    ((\\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> (P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk>)\\<lbrakk>(\\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>)/$tr\\<acute>\\<rbrakk>\n      \\<and> $tr\\<acute> - $tr =\\<^sub>u \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>) \\<and> $tr\\<acute> \\<ge>\\<^sub>u $tr)\"\n      by (subst subst_eq_replace, simp)\n  also have \"... =\n    ((\\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> (P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk>)\n      \\<and> $tr\\<acute> - $tr =\\<^sub>u \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>) \\<and> $tr\\<acute> \\<ge>\\<^sub>u $tr)\"\n      by (rel_auto)\n  also have \"... =\n    (\\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> (P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk>)\n      \\<and> ($tr\\<acute> - $tr =\\<^sub>u \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright> \\<and> $tr\\<acute> \\<ge>\\<^sub>u $tr))\"\n    by pred_auto\n  also have \"... =\n    ((\\<^bold>\\<exists> tt\\<^sub>1 \\<bullet> \\<^bold>\\<exists> tt\\<^sub>2 \\<bullet> (P\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>1\\<guillemotright>/$tr\\<acute>\\<rbrakk> ;; Q\\<lbrakk>0/$tr\\<rbrakk>\\<lbrakk>\\<guillemotleft>tt\\<^sub>2\\<guillemotright>/$tr\\<acute>\\<rbrakk>)\n      \\<and> $tr\\<acute> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>))\"\n  proof -\n    have \"\\<And> tt\\<^sub>1 tt\\<^sub>2. ((($tr\\<acute> - $tr =\\<^sub>u \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>) \\<and> $tr\\<acute> \\<ge>\\<^sub>u $tr) :: ('t,'\\<alpha>,'\\<gamma>) rel_rp)\n           = ($tr\\<acute> =\\<^sub>u $tr + \\<guillemotleft>tt\\<^sub>1\\<guillemotright> + \\<guillemotleft>tt\\<^sub>2\\<guillemotright>)\"\n      apply (rel_auto)\n        apply (metis add.assoc diff_add_cancel_left')\n       apply (simp add: add.assoc)\n      apply (meson le_add order_trans)\n      done\n    thus ?thesis by simp\n  qed\n  also have \"... = (R2(P) ;; R2(Q))\"\n    by (simp add: R2_seqr_form)\n  finally show ?thesis .\nqed\n\nlemma R2_seqr_closure [closure]:\n  assumes \"P is R2\" \"Q is R2\"\n  shows \"(P ;; Q) is R2\"\n  by (metis Healthy_def' R2_seqr_distribute assms(1) assms(2))\n\nlemma false_R2 [closure]: \"false is R2\"\n  by (rel_auto)\n    \nlemma R1_R2_commute:\n  \"R1(R2(P)) = R2(R1(P))\"\n  by pred_auto\n\nlemma R2_R1_form: \"R2(R1(P)) = R1(R2s(P))\"\n  by (rel_auto)\n\nlemma R2s_H1_commute:\n  \"R2s(H1(P)) = H1(R2s(P))\"\n  by (rel_auto)\n\nlemma R2s_H2_commute:\n  \"R2s(H2(P)) = H2(R2s(P))\"\n  by (simp add: H2_split R2s_def usubst)\n\nlemma R2_R1_seq_drop_left:\n  \"R2(R1(P) ;; R1(Q)) = R2(P ;; R1(Q))\"\n  by (rel_auto)\n\nlemma R2c_idem: \"R2c(R2c(P)) = R2c(P)\"\n  by (rel_auto)\n\nlemma R2c_Idempotent [closure]: \"Idempotent R2c\"\n  by (simp add: Idempotent_def R2c_idem)\n\nlemma R2c_Monotonic [closure]: \"Monotonic R2c\"\n  by (rel_auto)\n\nlemma R2c_H2_commute: \"R2c(H2(P)) = H2(R2c(P))\"\n  by (simp add: H2_split R2c_disj R2c_def R2s_def usubst, rel_auto)\n\nlemma R2c_seq: \"R2c(R2(P) ;; R2(Q)) = (R2(P) ;; R2(Q))\"\n  by (metis (no_types, lifting) R1_R2c_commute R1_R2c_is_R2 R2_seqr_distribute R2c_idem)\n\nlemma R2_R2c_def: \"R2(P) = R1(R2c(P))\"\n  by (rel_auto)\n\nlemma R2_comp_def: \"R2 = R1 \\<circ> R2c\"\n  by (auto simp add: R2_R2c_def)\n    \nlemma R2c_R1_seq: \"R2c(R1(R2c(P)) ;; R1(R2c(Q))) = (R1(R2c(P)) ;; R1(R2c(Q)))\"\n  using R2c_seq[of P Q] by (simp add: R2_R2c_def)\n\nlemma R1_R2c_seqr_distribute:\n  fixes P :: \"('t::trace,'\\<alpha>,'\\<beta>) rel_rp\" and Q :: \"('t,'\\<beta>,'\\<gamma>) rel_rp\"\n  assumes \"P is R1\" \"P is R2c\" \"Q is R1\" \"Q is R2c\"\n  shows \"R1(R2c(P ;; Q)) = P ;; Q\"\n  by (metis Healthy_if R1_seqr R2c_R1_seq assms)\n\nlemma R2_R1_true:\n  \"R2(R1(true)) = R1(true)\"\n  by (simp add: R2_R1_form R2s_true)\n    \nlemma R1_true_R2 [closure]: \"R1(true) is R2\"\n  by (rel_auto)\n\nlemma R1_R2s_R1_true_lemma:\n  \"R1(R2s(R1 (\\<not> R2s P) ;; R1 true)) = R1(R2s((\\<not> P) ;; R1 true))\"\n  by (rel_auto)\n\nlemma R2c_healthy_R2s: \"P is R2c \\<Longrightarrow> R1(R2s(P)) = R1(P)\"\n  by (simp add: Healthy_def R1_R2s_R2c) \n\nsubsection \\<open> R3: No activity while predecessor is waiting \\<close>\n\ndefinition R3 :: \"('t::trace, '\\<alpha>) hrel_rp \\<Rightarrow> ('t, '\\<alpha>) hrel_rp\" where\n[upred_defs]: \"R3(P) = (II \\<triangleleft> $wait \\<triangleright> P)\"\n\nlemma R3_idem: \"R3(R3(P)) = R3(P)\"\n  by (rel_auto)\n\nlemma R3_Idempotent [closure]: \"Idempotent R3\"\n  by (simp add: Idempotent_def R3_idem)\n\nlemma R3_mono: \"P \\<sqsubseteq> Q \\<Longrightarrow> R3(P) \\<sqsubseteq> R3(Q)\"\n  by (rel_auto)\n\nlemma R3_Monotonic: \"Monotonic R3\"\n  by (simp add: mono_def R3_mono)\n\nlemma R3_Continuous: \"Continuous R3\"\n  by (rel_auto)\n\nlemma R3_conj: \"R3(P \\<and> Q) = (R3(P) \\<and> R3(Q))\"\n  by (rel_auto)\n\nlemma R3_disj: \"R3(P \\<or> Q) = (R3(P) \\<or> R3(Q))\"\n  by (rel_auto)\n\nlemma R3_USUP:\n  assumes \"A \\<noteq> {}\"\n  shows \"R3(\\<Sqinter> i \\<in> A \\<bullet> P(i)) = (\\<Sqinter> i \\<in> A \\<bullet> R3(P(i)))\"\n  using assms by (rel_auto)\n\nlemma R3_UINF:\n  assumes \"A \\<noteq> {}\"\n  shows \"R3(\\<Squnion> i \\<in> A \\<bullet> P(i)) = (\\<Squnion> i \\<in> A \\<bullet> R3(P(i)))\"\n  using assms by (rel_auto)\n\nlemma R3_condr: \"R3(P \\<triangleleft> b \\<triangleright> Q) = (R3(P) \\<triangleleft> b \\<triangleright> R3(Q))\"\n  by (rel_auto)\n\nlemma R3_skipr: \"R3(II) = II\"\n  by (rel_auto)\n\nlemma R3_form: \"R3(P) = (($wait \\<and> II) \\<or> (\\<not> $wait \\<and> P))\"\n  by (rel_auto)\n\nlemma wait_R3:\n  \"($wait \\<and> R3(P)) = (II \\<and> $wait\\<acute>)\"\n  by (rel_auto)\n\nlemma nwait_R3:\n  \"(\\<not>$wait \\<and> R3(P)) = (\\<not>$wait \\<and> P)\"\n  by (rel_auto)\n\nlemma R3_semir_form:\n  \"(R3(P) ;; R3(Q)) = R3(P ;; R3(Q))\"\n  by (rel_auto)\n\nlemma R3_semir_closure:\n  assumes \"P is R3\" \"Q is R3\"\n  shows \"(P ;; Q) is R3\"\n  using assms\n  by (metis Healthy_def' R3_semir_form)\n\nlemma R1_R3_commute: \"R1(R3(P)) = R3(R1(P))\"\n  by (rel_auto)\n\nlemma R2_R3_commute: \"R2(R3(P)) = R3(R2(P))\"\n  apply (rel_auto)\n  using minus_zero_eq apply blast+\n  done\n\nsubsection \\<open> R4: The trace strictly increases \\<close>\n\ndefinition R4 :: \"('t::trace, '\\<alpha>, '\\<beta>) rel_rp \\<Rightarrow> ('t, '\\<alpha>, '\\<beta>) rel_rp\" where\n[upred_defs]: \"R4(P) = (P \\<and> $tr <\\<^sub>u $tr\\<acute>)\"\n\nlemma R4_implies_R1 [closure]: \"P is R4 \\<Longrightarrow> P is R1\"\n  using less_iff by rel_blast\n\nlemma R4_iff_refine:\n  \"P is R4 \\<longleftrightarrow> ($tr <\\<^sub>u $tr\\<acute>) \\<sqsubseteq> P\"\n  by (rel_blast)\n\nlemma R4_idem: \"R4 (R4 P) = R4 P\"\n  by (rel_auto)\n\nlemma R4_false: \"R4(false) = false\"\n  by (rel_auto)\n\nlemma R4_conj: \"R4(P \\<and> Q) = (R4(P) \\<and> R4(Q))\"\n  by (rel_auto)\n\nlemma R4_disj: \"R4(P \\<or> Q) = (R4(P) \\<or> R4(Q))\"\n  by (rel_auto)\n\nlemma R4_is_R4 [closure]: \"R4(P) is R4\"\n  by (rel_auto)\n\nlemma false_R4 [closure]: \"false is R4\"\n  by (rel_auto)\n\nlemma UINF_R4_closed [closure]: \n  \"\\<lbrakk> \\<And> i. P i is R4 \\<rbrakk> \\<Longrightarrow> (\\<Sqinter> i \\<bullet> P i) is R4\"\n  by (rel_blast)\n\nlemma conj_R4_closed [closure]:\n  \"\\<lbrakk> P is R4; Q is R4 \\<rbrakk> \\<Longrightarrow> (P \\<and> Q) is R4\"\n  by (simp add: Healthy_def R4_conj)\n\nlemma disj_R4_closed [closure]:\n  \"\\<lbrakk> P is R4; Q is R4 \\<rbrakk> \\<Longrightarrow> (P \\<or> Q) is R4\"\n  by (simp add: Healthy_def R4_disj)\n\nlemma seq_R4_closed_1 [closure]:\n  \"\\<lbrakk> P is R4; Q is R1 \\<rbrakk> \\<Longrightarrow> (P ;; Q) is R4\"\n  using less_le_trans by rel_blast\n\nlemma seq_R4_closed_2 [closure]:\n  \"\\<lbrakk> P is R1; Q is R4 \\<rbrakk> \\<Longrightarrow> (P ;; Q) is R4\"\n  using le_less_trans by rel_blast\n\nsubsection \\<open> R5: The trace does not increase \\<close>\n\ndefinition R5 :: \"('t::trace, '\\<alpha>, '\\<beta>) rel_rp \\<Rightarrow> ('t, '\\<alpha>, '\\<beta>) rel_rp\" where\n[upred_defs]: \"R5(P) = (P \\<and> $tr =\\<^sub>u $tr\\<acute>)\"\n\nlemma R5_implies_R1 [closure]: \"P is R5 \\<Longrightarrow> P is R1\"\n  using eq_iff by rel_blast\n\nlemma R5_iff_refine:\n  \"P is R5 \\<longleftrightarrow> ($tr =\\<^sub>u $tr\\<acute>) \\<sqsubseteq> P\"\n  by (rel_blast)\n\nlemma R5_conj: \"R5(P \\<and> Q) = (R5(P) \\<and> R5(Q))\"\n  by (rel_auto)\n\nlemma R5_disj: \"R5(P \\<or> Q) = (R5(P) \\<or> R5(Q))\"\n  by (rel_auto)\n\nlemma R4_R5: \"R4 (R5 P) = false\"\n  by (rel_auto)\n\nlemma R5_R4: \"R5 (R4 P) = false\"\n  by (rel_auto)\n\nlemma UINF_R5_closed [closure]: \n  \"\\<lbrakk> \\<And> i. P i is R5 \\<rbrakk> \\<Longrightarrow> (\\<Sqinter> i \\<bullet> P i) is R5\"\n  by (rel_blast)\n\nlemma conj_R5_closed [closure]:\n  \"\\<lbrakk> P is R5; Q is R5 \\<rbrakk> \\<Longrightarrow> (P \\<and> Q) is R5\"\n  by (simp add: Healthy_def R5_conj)\n\nlemma disj_R5_closed [closure]:\n  \"\\<lbrakk> P is R5; Q is R5 \\<rbrakk> \\<Longrightarrow> (P \\<or> Q) is R5\"\n  by (simp add: Healthy_def R5_disj)\n\nlemma seq_R5_closed [closure]:\n  \"\\<lbrakk> P is R5; Q is R5 \\<rbrakk> \\<Longrightarrow> (P ;; Q) is R5\"\n  by (rel_auto, metis)\n\nsubsection {* RP laws *}\n\ndefinition RP_def [upred_defs]: \"RP(P) = R1(R2c(R3(P)))\"\n\nlemma RP_comp_def: \"RP = R1 \\<circ> R2c \\<circ> R3\"\n  by (auto simp add: RP_def)\n\nlemma RP_alt_def: \"RP(P) = R1(R2(R3(P)))\"\n  by (metis R1_R2c_is_R2 R1_idem RP_def)\n\nlemma RP_intro: \"\\<lbrakk> P is R1; P is R2; P is R3 \\<rbrakk> \\<Longrightarrow> P is RP\"\n  by (simp add: Healthy_def' RP_alt_def)\n\nlemma RP_idem: \"RP(RP(P)) = RP(P)\"\n  by (simp add: R1_R2c_is_R2 R2_R3_commute R2_idem R3_idem RP_def)\n\nlemma RP_Idempotent [closure]: \"Idempotent RP\"\n  by (simp add: Idempotent_def RP_idem)\n\nlemma RP_mono: \"P \\<sqsubseteq> Q \\<Longrightarrow> RP(P) \\<sqsubseteq> RP(Q)\"\n  by (simp add: R1_R2c_is_R2 R2_mono R3_mono RP_def)\n\nlemma RP_Monotonic: \"Monotonic RP\"\n  by (simp add: mono_def RP_mono)\n\nlemma RP_Continuous: \"Continuous RP\"\n  by (simp add: Continuous_comp R1_Continuous R2c_Continuous R3_Continuous RP_comp_def)\n\nlemma RP_skip:\n  \"RP(II) = II\"\n  by (simp add: R1_skip R2c_skip_r R3_skipr RP_def)\n\nlemma RP_skip_closure [closure]:\n  \"II is RP\"\n  by (simp add: Healthy_def' RP_skip)\n\nlemma RP_seq_closure [closure]:\n  assumes \"P is RP\" \"Q is RP\"\n  shows \"(P ;; Q) is RP\"\nproof (rule RP_intro)\n  show \"(P ;; Q) is R1\"\n    by (metis Healthy_def R1_seqr RP_def assms)\n  thus \"(P ;; Q) is R2\"\n    by (metis Healthy_def' R2_R2c_def R2c_R1_seq RP_def  assms)\n  show \"(P ;; Q) is R3\"\n    by (metis (no_types, lifting) Healthy_def' R1_R2c_is_R2 R2_R3_commute R3_idem R3_semir_form RP_def assms)\nqed\n\nsubsection \\<open> UTP theories \\<close>\n\ninterpretation rea_theory: utp_theory_continuous RP\n  rewrites \"P \\<in> carrier rea_theory.thy_order \\<longleftrightarrow> P is RP\"\n  and \"le des_theory.thy_order = (\\<sqsubseteq>)\"\n  and \"eq des_theory.thy_order = (=)\"  \nproof -\n  show \"utp_theory_continuous RP\"\n    by (unfold_locales, simp_all add: RP_idem RP_Continuous)\nqed (simp_all)\n\nnotation rea_theory.utp_top (\"\\<^bold>\\<top>\\<^sub>r\")\nnotation rea_theory.utp_bottom (\"\\<^bold>\\<bottom>\\<^sub>r\")\n\ninterpretation rea_theory_rel: utp_theory_unital RP skip_r\n  by (unfold_locales, simp_all add: closure)\n\nlemma rea_top: \"\\<^bold>\\<top>\\<^sub>r = ($wait \\<and> II)\"\nproof -\n  have \"\\<^bold>\\<top>\\<^sub>r = RP(false)\"\n    by (simp add: rea_theory.healthy_top)\n  also have \"... = ($wait \\<and> II)\"\n    by (rel_auto, metis minus_zero_eq)\n  finally show ?thesis .\nqed\n\nlemma rea_top_left_zero:\n  assumes \"P is RP\"\n  shows \"(\\<^bold>\\<top>\\<^sub>r ;; P) = \\<^bold>\\<top>\\<^sub>r\"\nproof -\n  have \"(\\<^bold>\\<top>\\<^sub>r ;; P) = (($wait \\<and> II) ;; R3(P))\"\n    by (metis (no_types, lifting) Healthy_def R1_R2c_is_R2 R2_R3_commute R3_idem RP_def assms rea_top)\n  also have \"... = ($wait \\<and> R3(P))\"\n    by (rel_auto)\n  also have \"... = ($wait \\<and> II)\"\n    by (metis R3_skipr wait_R3)\n  also have \"... = \\<^bold>\\<top>\\<^sub>r\"\n    by (simp add: rea_top)\n  finally show ?thesis .\nqed\n\nlemma rea_bottom: \"\\<^bold>\\<bottom>\\<^sub>r = R1($wait \\<Rightarrow> II)\"\nproof -\n  have \"\\<^bold>\\<bottom>\\<^sub>r = RP(true)\"\n    by (simp add: rea_theory.healthy_bottom)\n  also have \"... = R1($wait \\<Rightarrow> II)\"\n    by (rel_auto, metis minus_zero_eq)\n  finally show ?thesis .\nqed\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/reactive/utp_rea_healths.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5926666143434, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3102137660825322}}
{"text": "(* A particular case of the second calculus, with policy constant on types: *)\ntheory Mcalc2C\nimports Mcalc2\nbegin\n\nsubsection{* Constant policy on types *}\n\ntext{* Currently our soundness proof only covers the case of the calculus\nhaving different extension policies for different predicates, but not\nfor differnt types versus the same predicate. This is sufficient for our purpose\nof proving soundness of the guard encodings.  *}\n\nlocale ProblemIkPolMcalc2C =\nProblemIkPolMcalc2 wtFsym wtPsym arOf resOf parOf \\<Phi> infTp pol grdOf\nfor wtFsym :: \"'fsym \\<Rightarrow> bool\" and wtPsym :: \"'psym \\<Rightarrow> bool\"\nand arOf :: \"'fsym \\<Rightarrow> 'tp list\"\nand resOf and parOf and \\<Phi> and infTp and pol and grdOf\n+ assumes pol_ct: \"pol \\<sigma>1 P = pol \\<sigma>2 P\"\n\ncontext ProblemIkPolMcalc2C begin\n\ndefinition \"polC \\<equiv> pol any\"\n\nlemma pol_polC: \"pol \\<sigma> P = polC P\"\nunfolding polC_def using pol_ct by auto\n\nlemma nv2L_simps[simp]:\n\"nv2L (Pos (Pr p Tl)) = (case polC p of Fext \\<Rightarrow> \\<Union> set (map nv2T Tl) |_ \\<Rightarrow> {})\"\n\"nv2L (Neg (Pr p Tl)) = (case polC p of Text \\<Rightarrow> \\<Union> set (map nv2T Tl) |_ \\<Rightarrow> {})\"\nby (auto split: epol.splits simp: pol_polC)\n\ndeclare nv2L.simps(3,4)[simp del]\n\nlemma isGuard_simps[simp]:\n\"isGuard x (Pos (Pr p Tl)) \\<longleftrightarrow> x \\<in> \\<Union> set (map nv2T Tl) \\<and> polC p = Text\"\n\"isGuard x (Neg (Pr p Tl)) \\<longleftrightarrow> x \\<in> \\<Union> set (map nv2T Tl) \\<and> polC p = Fext\"\nby (auto simp: pol_polC)\n\ndeclare isGuard.simps(3,4)[simp del]\n\n\nend (* context  ProblemIkPolMcalc2 *)\n\n\nlocale ModelIkPolMcalc2C =\nModelIk wtFsym wtPsym arOf resOf parOf \\<Phi> infTp intT intF intP +\nProblemIkPolMcalc2C wtFsym wtPsym arOf resOf parOf \\<Phi> infTp pol grdOf\nfor wtFsym :: \"'fsym \\<Rightarrow> bool\" and wtPsym :: \"'psym \\<Rightarrow> bool\"\nand arOf :: \"'fsym \\<Rightarrow> 'tp list\"\nand resOf and parOf and \\<Phi> and infTp pol and grdOf and intT and intF and intP\n\n\nsubsection{* Extension of a structure to an infinte structure\nby adding indistinguishable elements *}\n\ncontext ModelIkPolMcalc2C begin\n\n(* The projection from univ to a structure: *)\ndefinition proj where \"proj \\<sigma> a \\<equiv> if intT \\<sigma> a then a else pickT \\<sigma>\"\n\nlemma intT_proj[simp]: \"intT \\<sigma> (proj \\<sigma> a)\"\nunfolding proj_def using pickT by auto\n\nlemma proj_id[simp]: \"intT \\<sigma> a \\<Longrightarrow> proj \\<sigma> a = a\"\nunfolding proj_def by auto\n\nlemma map_proj_id[simp]:\nassumes \"list_all2 intT \\<sigma>l al\"\nshows \"map2 proj \\<sigma>l al = al\"\napply(rule nth_equalityI)\nusing assms unfolding list_all2_length by auto\n\nlemma surj_proj:\nassumes \"intT \\<sigma> a\"   shows \"\\<exists> b. proj \\<sigma> b = a\"\nusing assms by (intro exI[of _ a]) simp\n\ndefinition \"I_intT \\<sigma> (a::univ) \\<equiv> infTp \\<sigma> \\<longrightarrow> intT \\<sigma> a\"\ndefinition \"I_intF f al \\<equiv> intF f (map2 proj (arOf f) al)\"\ndefinition\n\"I_intP p al \\<equiv>\n case polC p of\n   Cext \\<Rightarrow> intP p (map2 proj (parOf p) al)\n  |Text \\<Rightarrow> if list_all2 intT (parOf p) al then intP p al else True\n  |Fext \\<Rightarrow> if list_all2 intT (parOf p) al then intP p al else False\"\n\nlemma not_infTp_I_intT[simp]: \"\\<not> infTp \\<sigma> \\<Longrightarrow> I_intT \\<sigma> a\"\nunfolding I_intT_def by simp\n\nlemma infTp_I_intT[simp]: \"infTp \\<sigma> \\<Longrightarrow> I_intT \\<sigma> a = intT \\<sigma> a\"\nunfolding I_intT_def by simp\n\nlemma NE_I_intT: \"NE (I_intT \\<sigma>)\"\nusing NE_intT by (cases \"infTp \\<sigma>\", auto)\n\nlemma I_intP_Cext[simp]:\n\"polC p = Cext \\<Longrightarrow> I_intP p al = intP p (map2 proj (parOf p) al)\"\nunfolding I_intP_def by simp\n\nlemma I_intP_Text_imp[simp]:\nassumes \"polC p = Text\" and \"intP p al\"\nshows \"I_intP p al\"\nusing assms unfolding I_intP_def by auto\n\nlemma I_intP_Fext_imp[simp]:\nassumes \"polC p = Fext\" and \"\\<not> intP p al\"\nshows \"\\<not> I_intP p al\"\nusing assms unfolding I_intP_def by (cases \"list_all2 intT (parOf p) al\", auto)\n\nlemma I_intP_intT[simp]:\nassumes \"list_all2 intT (parOf p) al\"\nshows \"I_intP p al = intP p al\"\nusing assms unfolding I_intP_def by (cases \"polC p\") auto\n\nlemma I_intP_Text_not_intT[simp]:\nassumes \"polC p = Text\" and \"\\<not> list_all2 intT (parOf p) al\"\nshows \"I_intP p al\"\nusing assms unfolding I_intP_def by auto\n\nlemma I_intP_Fext_not_intT[simp]:\nassumes \"polC p = Fext\" and \"\\<not> list_all2 intT (parOf p) al\"\nshows \"\\<not> I_intP p al\"\nusing assms unfolding I_intP_def by auto\n\nlemma I_intF:\nassumes f: \"wtFsym f\" and al: \"list_all2 I_intT (arOf f) al\"\nshows \"I_intT (resOf f) (I_intF f al)\"\nunfolding I_intT_def I_intF_def apply safe apply(rule intF[OF f])\nusing al unfolding list_all2_length by auto\n\nlemma Tstruct_I_intT: \"Tstruct I_intT\"\napply default using NE_I_intT .\n\nlemma inf_I_intT: \"infinite {a. I_intT \\<sigma> a}\"\nby (cases \"infTp \\<sigma>\", auto)\n\nlemma InfStruct: \"IInfStruct I_intT I_intF I_intP\"\napply default using NE_I_intT I_intF Tstruct_I_intT inf_I_intT by auto\n\nend (* context ModelIkPolMcalc2C *)\n\nsublocale ModelIkPolMcalc2C < InfStruct where\nintT = I_intT and intF = I_intF and intP = I_intP\nusing InfStruct .\n\nsubsection{* The soundness of the calculus *}\n\n(* In what follows, ``Ik\" stands for the original\n(augmented with infiniteness-knowledge)\nand ``I\" for the infinite structure constructed from it\nthrough the above sublocale statement. *)\n\ncontext ModelIkPolMcalc2C begin\n(* The environment translation along the projection: *)\ndefinition \"transE \\<xi> \\<equiv> \\<lambda> x. proj (tpOfV x) (\\<xi> x)\"\n\n\n\nlemma wtE_transE[simp]: \"I.wtE \\<xi> \\<Longrightarrow> Ik.wtE (transE \\<xi>)\"\nunfolding Ik.wtE_def I.wtE_def transE_def by auto\n\nabbreviation \"Ik_intT \\<equiv> intT\"\nabbreviation \"Ik_intF \\<equiv> intF\"\nabbreviation \"Ik_intP \\<equiv> intP\"\n\nlemma Ik_intT_int:\nassumes wt: \"Ik.wt T\" and \\<xi>: \"I.wtE \\<xi>\"\nand nv2T: \"infTp (Ik.tpOf T) \\<or> (\\<forall> x \\<in> nv2T T. tpOfV x \\<noteq> Ik.tpOf T)\"\nshows \"Ik_intT (Ik.tpOf T) (I.int \\<xi> T)\"\nproof(cases \"\\<exists> x. T = Var x\")\n  case True then obtain x where T: \"T = Var x\" by auto\n  show ?thesis proof(cases \"infTp (tpOf T)\")\n    case True thus ?thesis using T using wtE_transE[OF \\<xi>]\n    by (metis I.wt_int I_intT_def \\<xi> wt)\n  next\n    case False hence \"\\<forall> x \\<in> nv2T T. tpOfV x \\<noteq> tpOf T\" using nv2T by auto\n    hence \"Ik.full (tpOf T)\" using T by (cases T, simp_all)\n    thus ?thesis unfolding Ik.full_def by simp\n  qed\nnext\n  case False hence nonVar: \"\\<not> (\\<exists> x. T = Var x)\" by (cases T, auto)\n  thus ?thesis using nonVar wt apply(induct T, force)\n  unfolding I_intF_def tpOf.simps int.simps\n  apply(rule Ik.intF, simp) apply(rule listAll2_map2I) by auto\nqed\n\nlemma int_transE_proj:\nassumes wt: \"Ik.wt T\"\nshows \"Ik.int (transE \\<xi>) T = proj (tpOf T) (I.int \\<xi> T)\"\nusing wt proof (induct T)\n  case (Fn f Tl)\n  have 0: \"Ik_intT (resOf f) (I_intF f (map (int \\<xi>) Tl))\" (is \"Ik_intT ?\\<sigma> ?a\")\n  unfolding I_intF_def apply(rule Ik.intF)\n  using Fn unfolding list_all2_length list_all_iff by auto\n  have 1: \"proj ?\\<sigma> ?a = ?a\" using proj_id[OF 0] .\n  show ?case\n  unfolding Ik.int.simps int.simps tpOf.simps 1\n  unfolding I_intF_def apply(rule arg_cong[of _ _ \"intF f\"])\n  proof (rule nth_equalityI, safe)\n    have l[simp]: \"length (arOf f) = length Tl\" using Fn by simp\n    fix i assume \"i < length (map (Ik.int (transE \\<xi>)) Tl)\"\n    hence i[simp]: \"i < length Tl\" by simp\n    have 0: \"arOf f ! i = tpOf (Tl ! i)\" using Fn by simp\n    have [simp]: \"Ik.int (transE \\<xi>) (Tl ! i) = proj (arOf f ! i) (I.int \\<xi> (Tl ! i))\"\n    unfolding 0 using Fn by (auto simp: list_all_length transE_def)\n    show \"map (Ik.int (transE \\<xi>)) Tl ! i =\n          map2 proj (arOf f) (map (I.int \\<xi>) Tl) ! i\"\n    using Fn unfolding list_all_length by simp\n  qed(insert Fn, simp)\nqed simp\n\nlemma int_transE_nv2T:\nassumes wt: \"Ik.wt T\" and \\<xi>: \"I.wtE \\<xi>\"\nand nv2T: \"infTp (Ik.tpOf T) \\<or> (\\<forall> x \\<in> nv2T T. tpOfV x \\<noteq> Ik.tpOf T)\"\nshows \"Ik.int (transE \\<xi>) T = I.int \\<xi> T\"\nunfolding int_transE_proj[OF wt] apply(rule proj_id)\nusing Ik_intT_int[OF wt \\<xi> nv2T] .\n\nlemma isGuard_not_satL_intT:\nassumes wtL: \"Ik.wtL l\"\nand (* crucial hypothesis--the essence of guarding:*) ns: \"\\<not> I.satL \\<xi> l\"\nand g: \"isGuard x l\" and \\<xi>: \"I.wtE \\<xi>\"\nshows \"Ik_intT (tpOfV x) (\\<xi> x)\" (is \"Ik_intT ?\\<sigma> (\\<xi> x)\")\n(* \"proj \\<sigma> (\\<xi> \\<sigma> x) = \\<xi> \\<sigma> x\" *)\n(* \"Ik.int (transE \\<xi>) (Var \\<sigma> x) = I.int \\<xi> (Var \\<sigma> x)\" *)\nproof(cases l)\n  case (Pos at)  show ?thesis proof(cases at)\n    case (Pr p Tl)\n    then obtain T where Tin: \"T \\<in> set Tl\" and x: \"x \\<in> nv2T T\" and pol: \"polC p = Text\"\n    using g unfolding Pos Pr by auto\n    hence T: \"T = Var x\" by (simp add: in_nv2T)\n    obtain i where i: \"i < length Tl\" and Ti: \"T = Tl!i\" using Tin\n    by (metis in_set_conv_nth)\n    hence 0 : \"wt T\" \"parOf p ! i = ?\\<sigma>\" using wtL unfolding Pos Pr T\n    apply (simp_all add: list_all_iff) by (metis T x in_nv2T tpOf.simps)\n    have \"list_all2 Ik_intT (parOf p) (map (I.int \\<xi>) Tl)\" (is ?phi)\n    using ns unfolding Pos Pr using pol by (cases ?phi, auto)\n    hence \"Ik_intT ?\\<sigma> (I.int \\<xi> T)\"\n    using ns 0 i Ti unfolding Pos Pr by (auto simp add: list_all2_length nth_map)\n    thus ?thesis unfolding T by simp\n  qed(insert g, unfold Pos, simp)\nnext\n  case (Neg at)  show ?thesis proof(cases at)\n    case (Eq T1 T2)\n    hence 0: \"T1 = Var x \\<or> T2 = Var x\" using g unfolding Neg by auto\n    hence wt1: \"Ik.wt T1\" \"Ik.tpOf T1 = tpOfV x\"\n    and wt2: \"Ik.wt T2\" \"Ik.tpOf T2 = tpOfV x\"\n    using wtL unfolding Neg Eq by auto\n    have eq: \"I.int \\<xi> T1 = I.int \\<xi> T2\" using ns unfolding Neg Eq by simp\n    show ?thesis proof(cases \"T1 = Var x\")\n      case True note T1 = True obtain f Tl where \"T2 = Fn f Tl\"\n      using g T1 Eq unfolding Neg by auto\n      hence \"\\<And> \\<sigma>. infTp \\<sigma> \\<or> (\\<forall> x \\<in> nv2T T2. tpOfV x \\<noteq> \\<sigma>)\" by auto\n      hence 1: \"I.int \\<xi> T2 = Ik.int (transE \\<xi>) T2\" using int_transE_nv2T wt2 \\<xi> by auto\n      have \"Ik_intT ?\\<sigma> (I.int \\<xi> T1)\" unfolding eq 1 using wt2 \\<xi> Ik.wt_int by force\n      thus ?thesis unfolding T1 by simp\n    next\n      case False then obtain f Tl where T2: \"T2 = Var x\" and \"T1 = Fn f Tl\"\n      using Eq Neg g by auto\n      hence \"\\<And> \\<sigma>. infTp \\<sigma> \\<or> (\\<forall> x \\<in> nv2T T1. tpOfV x \\<noteq> \\<sigma>)\" by simp\n      hence 1: \"I.int \\<xi> T1 = Ik.int (transE \\<xi>) T1\" using int_transE_nv2T wt1 \\<xi> by auto\n      have \"Ik_intT ?\\<sigma> (I.int \\<xi> T2)\" unfolding eq[symmetric] 1\n      using wt1 \\<xi> Ik.wt_int by force\n      thus ?thesis unfolding T2 by simp\n    qed\n  next\n    case (Pr p Tl)\n    then obtain T where Tin: \"T \\<in> set Tl\" and x: \"x \\<in> nv2T T\" and pol: \"polC p = Fext\"\n    using g unfolding Neg Pr by auto\n    hence T: \"T = Var x\" by (simp add: in_nv2T)\n    obtain i where i: \"i < length Tl\" and Ti: \"T = Tl!i\" using Tin\n    by (metis in_set_conv_nth)\n    hence 0 : \"wt T\" \"parOf p ! i = ?\\<sigma>\" using wtL unfolding Neg Pr T\n    apply (simp_all add: list_all_iff) by (metis T x in_nv2T tpOf.simps)\n    have \"list_all2 Ik_intT (parOf p) (map (I.int \\<xi>) Tl)\" (is ?phi)\n    using ns unfolding Neg Pr using pol by (cases ?phi, auto)\n    hence \"Ik_intT ?\\<sigma> (I.int \\<xi> T)\"\n    using ns 0 i Ti unfolding Neg Pr by (auto simp add: list_all2_length nth_map)\n    thus ?thesis unfolding T by simp\n  qed\nqed\n\nlemma int_transE[simp]:\nassumes wt: \"Ik.wt T\" and \\<xi>: \"I.wtE \\<xi>\" and\nnv2T: \"\\<And> x. \\<lbrakk>\\<not> infTp (tpOfV x); x \\<in> nv2T T\\<rbrakk> \\<Longrightarrow>\n           \\<exists> l. Ik.wtL l \\<and> \\<not> I.satL \\<xi> l \\<and> isGuard x l\"\nshows \"Ik.int (transE \\<xi>) T = I.int \\<xi> T\"\nproof(cases \"infTp (Ik.tpOf T) \\<or> (\\<forall> x \\<in> nv2T T. tpOfV x \\<noteq> Ik.tpOf T)\")\n  case True thus ?thesis using int_transE_nv2T[OF wt \\<xi>] by auto\nnext\n  def \\<sigma> \\<equiv> \"Ik.tpOf T\"\n  case False then obtain x where i: \"\\<not> infTp \\<sigma>\" and x: \"x \\<in> nv2T T\"\n  unfolding \\<sigma>_def by auto\n  hence T: \"T = Var x\" by (simp add: in_nv2T)\n  hence \\<sigma>: \"\\<sigma> = tpOfV x\" unfolding \\<sigma>_def by simp\n  obtain l where 0: \"Ik.wtL l\" \"\\<not> I.satL \\<xi> l\" \"isGuard x l\"\n  using nv2T[OF i[unfolded \\<sigma>] x] by auto\n  show ?thesis unfolding T using isGuard_not_satL_intT[OF 0 \\<xi>] by simp\nqed\n\nlemma intT_int_transE[simp]:\nassumes wt: \"Ik.wt T\" and \\<xi>: \"I.wtE \\<xi>\" and\nnv2T: \"\\<And> x. \\<lbrakk>\\<not> infTp (tpOfV x); x \\<in> nv2T T\\<rbrakk> \\<Longrightarrow>\n           \\<exists> l. Ik.wtL l \\<and> \\<not> I.satL \\<xi> l \\<and> isGuard x l\"\nshows \"Ik_intT (Ik.tpOf T) (I.int \\<xi> T)\"\nproof-\n  have 0: \"I.int \\<xi> T = Ik.int (transE \\<xi>) T\" using int_transE[OF assms] by simp\n  show ?thesis unfolding 0 using Ik.wt_int[OF wtE_transE[OF \\<xi>] wt] .\nqed\n\nlemma map_int_transE_nv2T[simp]:\nassumes wt: \"list_all Ik.wt Tl\" and \\<xi>: \"I.wtE \\<xi>\" and\nnv2T: \"\\<And> x. \\<lbrakk>\\<not> infTp (tpOfV x); \\<exists>T\\<in>set Tl. x \\<in> nv2T T\\<rbrakk> \\<Longrightarrow>\n           \\<exists> l. Ik.wtL l \\<and> \\<not> I.satL \\<xi> l \\<and> isGuard x l\"\nshows \"map (Ik.int (transE \\<xi>)) Tl = map (I.int \\<xi>) Tl\"\napply(rule nth_equalityI) using assms by (force simp: list_all_iff intro: int_transE)+\n\nlemma list_all2_intT_int_transE_nv2T[simp]:\nassumes wt: \"list_all Ik.wt Tl\" and \\<xi>: \"I.wtE \\<xi>\" and\nnv2T: \"\\<And> x. \\<lbrakk>\\<not> infTp (tpOfV x); \\<exists>T\\<in>set Tl. x \\<in> nv2T T\\<rbrakk> \\<Longrightarrow>\n           \\<exists> l. Ik.wtL l \\<and> \\<not> I.satL \\<xi> l \\<and> isGuard x l\"\nshows \"list_all2 Ik_intT (map Ik.tpOf Tl) (map (I.int \\<xi>) Tl)\"\nunfolding list_all2_length using assms\nunfolding list_all_iff apply simp_all by (metis intT_int_transE nth_mem)\n\nlemma map_proj_transE[simp]:\nassumes wt: \"list_all wt Tl\"\nshows \"map (Ik.int (transE \\<xi>)) Tl =\n       map2 proj (map tpOf Tl) (map (I.int \\<xi>) Tl)\"\napply(rule nth_equalityI) using assms\nusing int_transE_proj unfolding list_all_length by auto\n\nlemma satL_transE[simp]:\nassumes wtL: \"Ik.wtL l\" and \\<xi>: \"I.wtE \\<xi>\" and\nnv2T:  \"\\<And> x. \\<lbrakk>\\<not> infTp (tpOfV x); x \\<in> nv2L l\\<rbrakk> \\<Longrightarrow>\n             \\<exists> l'. Ik.wtL l' \\<and> \\<not> I.satL \\<xi> l' \\<and> isGuard x l'\"\nand \"Ik.satL (transE \\<xi>) l\"\nshows \"I.satL \\<xi> l\"\nproof(cases l)\n  case (Pos at) show ?thesis proof (cases at)\n    case (Pr p Tl) show ?thesis using assms unfolding Pos Pr\n    apply(cases \"polC p\")\n      apply force\n      apply(cases \"list_all2 intT (map Ik.tpOf Tl) (map (I.int \\<xi>) Tl)\", force, force)\n      by simp\n  qed(insert assms, unfold Pos, simp)\nnext\n  case (Neg at) show ?thesis proof (cases at)\n    case (Pr p Tl) show ?thesis using assms unfolding Neg Pr\n    apply(cases \"polC p\")\n      apply force apply force\n      by (cases \"list_all2 intT (map Ik.tpOf Tl) (map (I.int \\<xi>) Tl)\", force, force)\n  qed(insert assms int_transE_proj, unfold Neg, auto)\nqed\n\nlemma satPB_transE[simp]:\nassumes \\<xi>: \"I.wtE \\<xi>\"  shows \"I.satPB \\<xi> \\<Phi>\"\nunfolding I.satPB_def proof safe\n  fix c assume cin: \"c \\<in> \\<Phi>\"  let ?thesis = \"I.satC \\<xi> c\"\n  have mc: \"\\<And> \\<sigma>. \\<sigma> \\<turnstile>2 c\" using mcalc2[OF cin] .\n  have c: \"Ik.satC (transE \\<xi>) c\"\n  using sat_\\<Phi> wtE_transE[OF \\<xi>] cin unfolding Ik.satPB_def by auto\n  have wtC: \"Ik.wtC c\" using wt_\\<Phi> cin unfolding wtPB_def by auto\n  obtain l where lin: \"l \\<in> set c\" and l: \"Ik.satL (transE \\<xi>) l\"\n  using c unfolding Ik.satC_iff_set by auto\n  have wtL: \"Ik.wtL l\" using wtC unfolding wtC_def\n  by (metis (lifting) lin list_all_iff)\n  {assume \"\\<not> ?thesis\"\n   hence 0: \"\\<And> l'. l' \\<in> set c \\<Longrightarrow> \\<not> I.satL \\<xi> l'\" unfolding I.satC_iff_set by auto\n   have \"I.satL \\<xi> l\"\n   proof (rule satL_transE[OF wtL \\<xi> _ l])\n     fix x let ?\\<sigma> = \"tpOfV x\"\n     assume \\<sigma>: \"\\<not> infTp ?\\<sigma>\" and x: \"x \\<in> nv2L l\"\n     hence g: \"isGuard x (grdOf c l x)\" using mc[of ?\\<sigma>] lin unfolding mcalc2_iff by simp\n     show \"\\<exists> l'. Ik.wtL l' \\<and> \\<not> I.satL \\<xi> l' \\<and> isGuard x l'\"\n     apply(rule exI[of _ \"grdOf c l x\"]) apply safe\n     using g \\<sigma> cin lin wtL_grdOf x 0 grdOf x by auto\n   qed\n   hence False using 0 lin by auto\n   hence ?thesis by simp\n  }\n  thus ?thesis by auto\nqed\n\nlemma I_SAT: \"I.SAT \\<Phi>\"\nunfolding I.SAT_def by simp\n\nlemma InfModel: \"IInfModel I_intT I_intF I_intP\"\napply default using I_SAT .\n\nend (* context ModelIkPolMcalc2C *)\n\nsublocale ModelIkPolMcalc2C < InfModel where\nintT = I_intT and intF = I_intF and intP = I_intP\nusing InfModel .\n\ncontext ProblemIkPolMcalc2C begin\n\nabbreviation\n\"MModelIkPolMcalc2C \\<equiv> ModelIkPolMcalc2C wtFsym wtPsym arOf resOf parOf \\<Phi> infTp pol grdOf\"\n\n\n\nend (* context ProblemIkPolMcalc2 *)\n\ntext{* Final theorem in sublocale form: Any problem that passes the\n  monotonicity calculus is monotonic:  *}\nsublocale ProblemIkPolMcalc2C < MonotProblem\napply default using monot .\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Sort_Encodings/Mcalc2C.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.31021375855086397}}
{"text": "section {* Designs *}\n\ntheory utp_designs\nimports\n  \"../utp/utp\"\nbegin\n\ntext {* In UTP, in order to explicitly record the termination of a program,\na subset of alphabetized relations is introduced. These relations are called\ndesigns and their alphabet should contain the special boolean observational variable ok.\nIt is used to record the start and termination of a program. *}\n\nsubsection {* Definitions *}\n\ntext {* In the following, the definitions of designs alphabets, designs and\nhealthiness (well-formedness) conditions are given. The healthiness conditions of\ndesigns are defined by $H1$, $H2$, $H3$ and $H4$.*}\n\nalphabet des_vars =\n  ok :: bool\nupdate_uexpr_rep_eq_thms\n\ntext {*\n  The two locale interpretations below are a technicality to improve automatic\n  proof support via the predicate and relational tactics. This is to enable the\n  (re-)interpretation of state spaces to remove any occurrences of lens types\n  after the proof tactics @{method pred_simp} and @{method rel_simp}, or any\n  of their derivatives have been applied. Eventually, it would be desirable to\n  automate both interpretations as part of a custom outer command for defining\n  alphabets.\n*}\n\ninterpretation des_vars: lens_interp \"\\<lambda>r. (ok\\<^sub>v r, more r)\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\ninterpretation des_vars_rel:\n  lens_interp \"\\<lambda>(r, r'). (ok\\<^sub>v r, ok\\<^sub>v r', more r, more r')\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\nlemma ok_ord [usubst]:\n  \"$ok \\<prec>\\<^sub>v $ok\\<acute>\"\n  by (simp add: var_name_ord_def)\n\ntype_synonym '\\<alpha> des  = \"'\\<alpha> des_vars_scheme\"\ntype_synonym ('\\<alpha>, '\\<beta>) rel_des = \"('\\<alpha> des, '\\<beta> des) rel\"\ntype_synonym '\\<alpha> hrel_des = \"('\\<alpha> des) hrel\"\n\ntranslations\n  (type) \"'\\<alpha> des\" <= (type) \"'\\<alpha> des_vars_scheme\"\n  (type) \"'\\<alpha> des\" <= (type) \"'\\<alpha> des_vars_ext\"\n  (type) \"('\\<alpha>, '\\<beta>) rel_des\" <= (type) \"('\\<alpha> des, '\\<beta> des) rel\"\n\nnotation des_vars_child_lens (\"\\<Sigma>\\<^sub>D\")\n\nlemma ok_des_bij_lens: \"bij_lens (ok +\\<^sub>L \\<Sigma>\\<^sub>D)\"\n  by (unfold_locales, simp_all add: ok_def des_vars_child_lens_def lens_plus_def prod.case_eq_if)\n\ntext {* Define the lens functor for designs *}\n\ndefinition lmap_des_vars :: \"('\\<alpha> \\<Longrightarrow> '\\<beta>) \\<Rightarrow> ('\\<alpha> des_vars_scheme \\<Longrightarrow> '\\<beta> des_vars_scheme)\" (\"lmap\\<^sub>D\")\n  where \"lmap_des_vars f = \\<lparr> lens_get = \\<lambda> v. extend (truncate v) (get\\<^bsub>f\\<^esub> (more v))\n                           , lens_put = \\<lambda> s v. extend (truncate v) (put\\<^bsub>f\\<^esub> (more s) (more v)) \\<rparr>\"\n\nlemma lmap_des_vars: \"vwb_lens f \\<Longrightarrow> vwb_lens (lmap_des_vars f)\"\n  by (unfold_locales, simp_all add: lmap_des_vars_def extend_def truncate_def)\n\nlemma lmap_id: \"lmap\\<^sub>D 1\\<^sub>L = 1\\<^sub>L\"\n  by (simp add: lmap_des_vars_def id_lens_def extend_def truncate_def fun_eq_iff)\n\nlemma lmap_comp: \"lmap\\<^sub>D (f ;\\<^sub>L g) = lmap\\<^sub>D f ;\\<^sub>L lmap\\<^sub>D g\"\n  by (simp add: lmap_des_vars_def id_lens_def lens_comp_def extend_def truncate_def fun_eq_iff)\n\ntext {* The following notations define liftings from non-design predicates into design\n  predicates using alphabet extensions. *}\n\nabbreviation lift_desr (\"\\<lceil>_\\<rceil>\\<^sub>D\")\nwhere \"\\<lceil>P\\<rceil>\\<^sub>D \\<equiv> P \\<oplus>\\<^sub>p (\\<Sigma>\\<^sub>D \\<times>\\<^sub>L \\<Sigma>\\<^sub>D)\"\n\nabbreviation lift_pre_desr (\"\\<lceil>_\\<rceil>\\<^sub>D\\<^sub><\")\nwhere \"\\<lceil>p\\<rceil>\\<^sub>D\\<^sub>< \\<equiv> \\<lceil>\\<lceil>p\\<rceil>\\<^sub><\\<rceil>\\<^sub>D\"\n\nabbreviation lift_post_desr (\"\\<lceil>_\\<rceil>\\<^sub>D\\<^sub>>\")\nwhere \"\\<lceil>p\\<rceil>\\<^sub>D\\<^sub>> \\<equiv> \\<lceil>\\<lceil>p\\<rceil>\\<^sub>>\\<rceil>\\<^sub>D\"\n\nabbreviation drop_desr (\"\\<lfloor>_\\<rfloor>\\<^sub>D\")\nwhere \"\\<lfloor>P\\<rfloor>\\<^sub>D \\<equiv> P \\<restriction>\\<^sub>p (\\<Sigma>\\<^sub>D \\<times>\\<^sub>L \\<Sigma>\\<^sub>D)\" \n\ndefinition design::\"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (infixl \"\\<turnstile>\" 60)\nwhere \"P \\<turnstile> Q = ($ok \\<and> P \\<Rightarrow> $ok\\<acute> \\<and> Q)\"\n\ntext {* An rdesign is a design that uses the Isabelle type system to prevent reference to ok in the\n        assumption and commitment. *}\n\ndefinition rdesign::\"('\\<alpha>, '\\<beta>) rel \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (infixl \"\\<turnstile>\\<^sub>r\" 60)\nwhere \"(P \\<turnstile>\\<^sub>r Q) = \\<lceil>P\\<rceil>\\<^sub>D \\<turnstile> \\<lceil>Q\\<rceil>\\<^sub>D\"\n\ntext {* An ndesign is a normal design, i.e. where the assumption is a condition *}\n\ndefinition ndesign::\"'\\<alpha> cond \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (infixl \"\\<turnstile>\\<^sub>n\" 60)\nwhere \"(p \\<turnstile>\\<^sub>n Q) = (\\<lceil>p\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q)\"\n\ndefinition skip_d :: \"'\\<alpha> hrel_des\" (\"II\\<^sub>D\")\nwhere \"II\\<^sub>D \\<equiv> (true \\<turnstile>\\<^sub>r II)\"\n\ndefinition assigns_d :: \"'\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\" (\"\\<langle>_\\<rangle>\\<^sub>D\")\nwhere \"assigns_d \\<sigma> = (true \\<turnstile>\\<^sub>r assigns_r \\<sigma>)\"\n\nsyntax\n  \"_assignmentd\" :: \"svid_list \\<Rightarrow> uexprs \\<Rightarrow> logic\"  (infixr \":=\\<^sub>D\" 55)\n\ntranslations\n  \"_assignmentd xs vs\" => \"CONST assigns_d (_mk_usubst (CONST id) xs vs)\"\n  \"x :=\\<^sub>D v\" <= \"CONST assigns_d (CONST subst_upd (CONST id) (CONST svar x) v)\"\n  \"x :=\\<^sub>D v\" <= \"CONST assigns_d (CONST subst_upd (CONST id) x v)\"\n  \"x,y :=\\<^sub>D u,v\" <= \"CONST assigns_d (CONST subst_upd (CONST subst_upd (CONST id) (CONST svar x) u) (CONST svar y) v)\"\n\n\ndefinition J :: \"'\\<alpha> hrel_des\"\nwhere \"J = (($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\"\n\ndefinition \"H1 (P)  \\<equiv>  $ok \\<Rightarrow> P\"\n\ndefinition \"H2 (P)  \\<equiv>  P ;; J\"\n\ndefinition \"H3 (P)  \\<equiv>  P ;; II\\<^sub>D\"\n\ndefinition \"H4 (P)  \\<equiv> ((P;;true) \\<Rightarrow> P)\"\n\nsyntax\n  \"_ok_f\"  :: \"logic \\<Rightarrow> logic\" (\"_\\<^sup>f\" [1000] 1000)\n  \"_ok_t\"  :: \"logic \\<Rightarrow> logic\" (\"_\\<^sup>t\" [1000] 1000)\n  \"_top_d\" :: \"logic\" (\"\\<top>\\<^sub>D\")\n  \"_bot_d\" :: \"logic\" (\"\\<bottom>\\<^sub>D\")\n\ntranslations\n  \"P\\<^sup>f\" \\<rightleftharpoons> \"CONST usubst (CONST subst_upd CONST id (CONST ovar CONST ok) false) P\"\n  \"P\\<^sup>t\" \\<rightleftharpoons> \"CONST usubst (CONST subst_upd CONST id (CONST ovar CONST ok) true) P\"\n  \"\\<top>\\<^sub>D\" => \"CONST not_upred (CONST utp_expr.var (CONST ivar CONST ok))\"\n  \"\\<bottom>\\<^sub>D\" => \"true\"\n\ndefinition pre_design :: \"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel\" (\"pre\\<^sub>D'(_')\") where\n\"pre\\<^sub>D(P) = \\<lfloor>\\<not> P\\<lbrakk>true,false/$ok,$ok\\<acute>\\<rbrakk>\\<rfloor>\\<^sub>D\"\n\ndefinition post_design :: \"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel\" (\"post\\<^sub>D'(_')\") where\n\"post\\<^sub>D(P) = \\<lfloor>P\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>\\<rfloor>\\<^sub>D\"\n\ndefinition wp_design :: \"('\\<alpha>, '\\<beta>) rel_des \\<Rightarrow> '\\<beta> cond \\<Rightarrow> '\\<alpha> cond\" (infix \"wp\\<^sub>D\" 60) where\n\"Q wp\\<^sub>D r = (\\<lfloor>pre\\<^sub>D(Q) ;; true :: ('\\<alpha>, '\\<beta>) rel\\<rfloor>\\<^sub>< \\<and> (post\\<^sub>D(Q) wp r))\"\n\ndeclare design_def [upred_defs]\ndeclare rdesign_def [upred_defs]\ndeclare ndesign_def [upred_defs]\ndeclare skip_d_def [upred_defs]\ndeclare J_def [upred_defs]\ndeclare pre_design_def [upred_defs]\ndeclare post_design_def [upred_defs]\ndeclare wp_design_def [upred_defs]\ndeclare assigns_d_def [upred_defs]\n\ndeclare H1_def [upred_defs]\ndeclare H2_def [upred_defs]\ndeclare H3_def [upred_defs]\ndeclare H4_def [upred_defs]\n\nlemma drop_desr_inv [simp]: \"\\<lfloor>\\<lceil>P\\<rceil>\\<^sub>D\\<rfloor>\\<^sub>D = P\"\n  by (simp add: arestr_aext prod_mwb_lens)\n\nlemma lift_desr_inv:\n  fixes P :: \"('\\<alpha>, '\\<beta>) rel_des\"\n  assumes \"$ok \\<sharp> P\" \"$ok\\<acute> \\<sharp> P\"\n  shows \"\\<lceil>\\<lfloor>P\\<rfloor>\\<^sub>D\\<rceil>\\<^sub>D = P\"\nproof -\n  have \"bij_lens (\\<Sigma>\\<^sub>D \\<times>\\<^sub>L \\<Sigma>\\<^sub>D +\\<^sub>L (in_var ok +\\<^sub>L out_var ok) :: (_, '\\<alpha> des_vars_scheme \\<times> '\\<beta> des_vars_scheme) lens)\"\n    (is \"bij_lens (?P)\")\n  proof -\n    have \"?P \\<approx>\\<^sub>L (ok +\\<^sub>L \\<Sigma>\\<^sub>D) \\<times>\\<^sub>L (ok +\\<^sub>L \\<Sigma>\\<^sub>D)\" (is \"?P \\<approx>\\<^sub>L ?Q\")\n      apply (simp add: in_var_def out_var_def prod_as_plus)\n      apply (simp add: prod_as_plus[THEN sym])\n      apply (meson lens_equiv_sym lens_equiv_trans lens_indep_prod lens_plus_comm lens_plus_prod_exchange des_vars_indeps(1))\n    done\n    moreover have \"bij_lens ?Q\"\n      by (simp add: ok_des_bij_lens prod_bij_lens)\n    ultimately show ?thesis\n      by (metis bij_lens_equiv lens_equiv_sym)\n  qed\n\n  with assms show ?thesis\n    apply (rule_tac aext_arestr[of _ \"in_var ok +\\<^sub>L out_var ok\"])\n    apply (simp add: prod_mwb_lens)\n    apply (simp)\n    apply (metis alpha_in_var lens_indep_prod lens_indep_sym des_vars_indeps(1) out_var_def prod_as_plus)\n    using unrest_var_comp apply blast\n  done\nqed\n\nsubsection {* Design laws *}\n\nlemma unrest_out_des_lift [unrest]: \"out\\<alpha> \\<sharp> p \\<Longrightarrow> out\\<alpha> \\<sharp> \\<lceil>p\\<rceil>\\<^sub>D\"\n  by (pred_simp, auto simp add: out\\<alpha>_def des_vars_child_lens_def)\n\nlemma lift_dist_seq [simp]:\n  \"\\<lceil>P ;; Q\\<rceil>\\<^sub>D = (\\<lceil>P\\<rceil>\\<^sub>D ;; \\<lceil>Q\\<rceil>\\<^sub>D)\"\n  by (rel_auto)\n\nlemma lift_des_skip_dr_unit_unrest: \"$ok\\<acute> \\<sharp> P \\<Longrightarrow> (P ;; \\<lceil>II\\<rceil>\\<^sub>D) = P\"\n  by (rel_auto)\n\nlemma true_is_design:\n  \"(false \\<turnstile> true) = true\"\n  by (rel_auto)\n\nlemma true_is_rdesign:\n  \"(false \\<turnstile>\\<^sub>r true) = true\"\n  by (rel_auto)\n\nlemma design_false_pre:\n  \"(false \\<turnstile> P) = true\"\n  by (rel_auto)\n\nlemma rdesign_false_pre:\n  \"(false \\<turnstile>\\<^sub>r P) = true\"\n  by (rel_auto)\n\nlemma ndesign_false_pre:\n  \"(false \\<turnstile>\\<^sub>n P) = true\"\n  by (rel_auto)\n\ntheorem design_refinement:\n  assumes\n    \"$ok \\<sharp> P1\" \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\" \"$ok\\<acute> \\<sharp> P2\"\n    \"$ok \\<sharp> Q1\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\" \"$ok\\<acute> \\<sharp> Q2\"\n  shows \"(P1 \\<turnstile> Q1 \\<sqsubseteq> P2 \\<turnstile> Q2) \\<longleftrightarrow> (`P1 \\<Rightarrow> P2` \\<and> `P1 \\<and> Q2 \\<Rightarrow> Q1`)\"\nproof -\n  have \"(P1 \\<turnstile> Q1) \\<sqsubseteq> (P2 \\<turnstile> Q2) \\<longleftrightarrow> `($ok \\<and> P2 \\<Rightarrow> $ok\\<acute> \\<and> Q2) \\<Rightarrow> ($ok \\<and> P1 \\<Rightarrow> $ok\\<acute> \\<and> Q1)`\"\n    by (pred_auto)\n  also with assms have \"... = `(P2 \\<Rightarrow> $ok\\<acute> \\<and> Q2) \\<Rightarrow> (P1 \\<Rightarrow> $ok\\<acute> \\<and> Q1)`\"\n    by (subst subst_bool_split[of \"in_var ok\"], simp_all, subst_tac)\n  also with assms have \"... = `(\\<not> P2 \\<Rightarrow> \\<not> P1) \\<and> ((P2 \\<Rightarrow> Q2) \\<Rightarrow> P1 \\<Rightarrow> Q1)`\"\n    by (subst subst_bool_split[of \"out_var ok\"], simp_all, subst_tac)\n  also have \"... \\<longleftrightarrow> `(P1 \\<Rightarrow> P2)` \\<and> `P1 \\<and> Q2 \\<Rightarrow> Q1`\"\n    by (pred_auto)\n  finally show ?thesis .\nqed\n\ntheorem rdesign_refinement:\n  \"(P1 \\<turnstile>\\<^sub>r Q1 \\<sqsubseteq> P2 \\<turnstile>\\<^sub>r Q2) \\<longleftrightarrow> (`P1 \\<Rightarrow> P2` \\<and> `P1 \\<and> Q2 \\<Rightarrow> Q1`)\"\n  by (rel_auto)\n\nlemma design_refine_intro:\n  assumes \"`P1 \\<Rightarrow> P2`\" \"`P1 \\<and> Q2 \\<Rightarrow> Q1`\"\n  shows \"P1 \\<turnstile> Q1 \\<sqsubseteq> P2 \\<turnstile> Q2\"\n  using assms unfolding upred_defs\n  by (pred_auto)\n\nlemma design_refine_intro':\n  assumes \"P\\<^sub>2 \\<sqsubseteq> P\\<^sub>1\" \"Q\\<^sub>1 \\<sqsubseteq> (P\\<^sub>1 \\<and> Q\\<^sub>2)\"\n  shows \"P\\<^sub>1 \\<turnstile> Q\\<^sub>1 \\<sqsubseteq> P\\<^sub>2 \\<turnstile> Q\\<^sub>2\"\n  using assms design_refine_intro[of P\\<^sub>1 P\\<^sub>2 Q\\<^sub>2 Q\\<^sub>1] by (simp add: refBy_order)\n\nlemma rdesign_refine_intro:\n  assumes \"`P1 \\<Rightarrow> P2`\" \"`P1 \\<and> Q2 \\<Rightarrow> Q1`\"\n  shows \"P1 \\<turnstile>\\<^sub>r Q1 \\<sqsubseteq> P2 \\<turnstile>\\<^sub>r Q2\"\n  using assms unfolding upred_defs\n  by (pred_auto)\n\nlemma ndesign_refine_intro:\n  assumes \"`p1 \\<Rightarrow> p2`\" \"`\\<lceil>p1\\<rceil>\\<^sub>< \\<and> Q2 \\<Rightarrow> Q1`\"\n  shows \"p1 \\<turnstile>\\<^sub>n Q1 \\<sqsubseteq> p2 \\<turnstile>\\<^sub>n Q2\"\n  using assms unfolding upred_defs\n  by (pred_auto)\n\nlemma design_subst [usubst]:\n  \"\\<lbrakk> $ok \\<sharp> \\<sigma>; $ok\\<acute> \\<sharp> \\<sigma> \\<rbrakk> \\<Longrightarrow> \\<sigma> \\<dagger> (P \\<turnstile> Q) = (\\<sigma> \\<dagger> P) \\<turnstile> (\\<sigma> \\<dagger> Q)\"\n  by (simp add: design_def usubst)\n\ntheorem design_ok_false [usubst]: \"(P \\<turnstile> Q)\\<lbrakk>false/$ok\\<rbrakk> = true\"\n  by (simp add: design_def usubst)\n\ntheorem design_npre:\n  \"(P \\<turnstile> Q)\\<^sup>f = (\\<not> $ok \\<or> \\<not> P\\<^sup>f)\"\n  by (rel_auto)\n\ntheorem design_pre:\n  \"\\<not> (P \\<turnstile> Q)\\<^sup>f = ($ok \\<and> P\\<^sup>f)\"\n  by (simp add: design_def, subst_tac)\n     (metis (no_types, hide_lams) not_conj_deMorgans true_not_false(2) utp_pred.compl_top_eq\n            utp_pred.sup.idem utp_pred.sup_compl_top)\n\ntheorem design_post:\n  \"(P \\<turnstile> Q)\\<^sup>t = (($ok \\<and> P\\<^sup>t) \\<Rightarrow> Q\\<^sup>t)\"\n  by (rel_auto)\n\ntheorem rdesign_pre [simp]: \"pre\\<^sub>D(P \\<turnstile>\\<^sub>r Q) = P\"\n  by (pred_auto)\n\ntheorem rdesign_post [simp]: \"post\\<^sub>D(P \\<turnstile>\\<^sub>r Q) = (P \\<Rightarrow> Q)\"\n  by (pred_auto)\n\ntheorem design_true_left_zero: \"(true ;; (P \\<turnstile> Q)) = true\"\nproof -\n  have \"(true ;; (P \\<turnstile> Q)) = (\\<^bold>\\<exists> ok\\<^sub>0 \\<bullet> true\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<acute>\\<rbrakk> ;; (P \\<turnstile> Q)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<rbrakk>)\"\n    by (subst seqr_middle[of ok], simp_all)\n  also have \"... = ((true\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; (P \\<turnstile> Q)\\<lbrakk>false/$ok\\<rbrakk>) \\<or> (true\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (P \\<turnstile> Q)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: disj_comm false_alt_def true_alt_def)\n  also have \"... = ((true\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; true\\<^sub>h) \\<or> (true ;; ((P \\<turnstile> Q)\\<lbrakk>true/$ok\\<rbrakk>)))\"\n    by (subst_tac, rel_auto)\n  also have \"... = true\"\n    by (subst_tac, simp add: precond_right_unit unrest)\n  finally show ?thesis .\nqed\n\ntheorem design_top_left_zero: \"(\\<top>\\<^sub>D ;; (P \\<turnstile> Q)) = \\<top>\\<^sub>D\"\n  by (rel_auto)\n\ntheorem design_choice:\n  \"(P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<sqinter> (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2) = ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<or> Q\\<^sub>2))\"\n  by (rel_auto)\n\ntheorem design_inf:\n  \"(P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<squnion> (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2) = ((P\\<^sub>1 \\<or> Q\\<^sub>1) \\<turnstile> ((P\\<^sub>1 \\<Rightarrow> P\\<^sub>2) \\<and> (Q\\<^sub>1 \\<Rightarrow> Q\\<^sub>2)))\"\n  by (rel_auto)\n\ntheorem rdesign_choice:\n  \"(P\\<^sub>1 \\<turnstile>\\<^sub>r P\\<^sub>2) \\<sqinter> (Q\\<^sub>1 \\<turnstile>\\<^sub>r Q\\<^sub>2) = ((P\\<^sub>1 \\<and> Q\\<^sub>1) \\<turnstile>\\<^sub>r (P\\<^sub>2 \\<or> Q\\<^sub>2))\"\n  by (rel_auto)\n\ntheorem design_condr:\n  \"((P\\<^sub>1 \\<turnstile> P\\<^sub>2) \\<triangleleft> b \\<triangleright> (Q\\<^sub>1 \\<turnstile> Q\\<^sub>2)) = ((P\\<^sub>1 \\<triangleleft> b \\<triangleright> Q\\<^sub>1) \\<turnstile> (P\\<^sub>2 \\<triangleleft> b \\<triangleright> Q\\<^sub>2))\"\n  by (rel_auto)\n\nlemma design_top:\n  \"(P \\<turnstile> Q) \\<sqsubseteq> \\<top>\\<^sub>D\"\n  by (rel_auto)\n\nlemma design_bottom:\n  \"\\<bottom>\\<^sub>D \\<sqsubseteq> (P \\<turnstile> Q)\"\n  by simp\n\nlemma design_USUP:\n  assumes \"A \\<noteq> {}\"\n  shows \"(\\<Sqinter> i \\<in> A \\<bullet> P(i) \\<turnstile> Q(i)) = (\\<Squnion> i \\<in> A \\<bullet> P(i)) \\<turnstile> (\\<Sqinter> i \\<in> A \\<bullet> Q(i))\"\n  using assms by (rel_auto)\n\nlemma design_UINF:\n  \"(\\<Squnion> i \\<in> A \\<bullet> P(i) \\<turnstile> Q(i)) = (\\<Sqinter> i \\<in> A \\<bullet> P(i)) \\<turnstile> (\\<Squnion> i \\<in> A \\<bullet> P(i) \\<Rightarrow> Q(i))\"\n  by (rel_auto)\n\ntheorem design_composition_subst:\n  assumes\n    \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\"\n  shows \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) =\n         (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (\\<not> P2))) \\<turnstile> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; Q2\\<lbrakk>true/$ok\\<rbrakk>))\"\nproof -\n  have \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = (\\<^bold>\\<exists> ok\\<^sub>0 \\<bullet> ((P1 \\<turnstile> Q1)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<acute>\\<rbrakk> ;; (P2 \\<turnstile> Q2)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<rbrakk>))\"\n    by (rule seqr_middle, simp)\n  also have \" ...\n        = (((P1 \\<turnstile> Q1)\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; (P2 \\<turnstile> Q2)\\<lbrakk>false/$ok\\<rbrakk>)\n            \\<or> ((P1 \\<turnstile> Q1)\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (P2 \\<turnstile> Q2)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: true_alt_def false_alt_def, pred_auto)\n  also from assms\n  have \"... = ((($ok \\<and> P1 \\<Rightarrow> Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk>) ;; (P2 \\<Rightarrow> $ok\\<acute> \\<and> Q2\\<lbrakk>true/$ok\\<rbrakk>)) \\<or> ((\\<not> ($ok \\<and> P1)) ;; true))\"\n    by (simp add: design_def usubst unrest, pred_auto)\n  also have \"... = ((\\<not>$ok ;; true\\<^sub>h) \\<or> ((\\<not>P1) ;; true) \\<or> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (\\<not>P2)) \\<or> ($ok\\<acute> \\<and> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; Q2\\<lbrakk>true/$ok\\<rbrakk>)))\"\n    by (rel_auto)\n  also have \"... = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (\\<not> P2))) \\<turnstile> (Q1\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; Q2\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: precond_right_unit design_def unrest, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma design_export_ok:\n  \"P \\<turnstile> Q = (P \\<turnstile> ($ok \\<and> Q))\"\n  by (rel_auto)\n\nlemma design_export_ok':\n  \"P \\<turnstile> Q = (P \\<turnstile> ($ok\\<acute> \\<and> Q))\"\n  by (rel_auto)\n\nlemma design_export_pre: \"P \\<turnstile> (P \\<and> Q) = P \\<turnstile> Q\"\n  by (rel_auto)\n\nlemma design_ok_pre_conj: \"($ok \\<and> P) \\<turnstile> Q = P \\<turnstile> Q\"\n  by (rel_auto)\n\ntheorem design_composition:\n  assumes\n    \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\"\n  shows \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile> (Q1 ;; Q2))\"\n  using assms by (simp add: design_composition_subst usubst)\n\nlemma runrest_ident_var:\n  assumes \"x \\<sharp>\\<sharp> P\"\n  shows \"($x \\<and> P) = (P \\<and> $x\\<acute>)\"\nproof -\n  have \"P = ($x\\<acute> =\\<^sub>u $x \\<and> P)\"\n    by (metis RID_def assms unrest_relation_def utp_pred.inf.cobounded2 utp_pred.inf_absorb2)\n  moreover have \"($x\\<acute> =\\<^sub>u $x \\<and> ($x \\<and> P)) = ($x\\<acute> =\\<^sub>u $x \\<and> (P \\<and> $x\\<acute>))\"\n    by (rel_auto)\n  ultimately show ?thesis\n    by (metis utp_pred.inf.assoc utp_pred.inf_left_commute)\nqed\n\ntheorem design_composition_runrest:\n  assumes\n    \"$ok\\<acute> \\<sharp> P1\" \"$ok \\<sharp> P2\" \"ok \\<sharp>\\<sharp> Q1\" \"ok \\<sharp>\\<sharp> Q2\"\n  shows \"((P1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1\\<^sup>t ;; (\\<not> P2))) \\<turnstile> (Q1 ;; Q2))\"\nproof -\n  have \"($ok \\<and> $ok\\<acute> \\<and> (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>)) = ($ok \\<and> $ok\\<acute> \\<and> (Q1 ;; Q2))\"\n  proof -\n    have \"($ok \\<and> $ok\\<acute> \\<and> (Q1 ;; Q2)) = (($ok \\<and> Q1) ;; (Q2 \\<and> $ok\\<acute>))\"\n      by (metis (no_types, lifting) conj_comm seqr_post_var_out seqr_pre_var_out)\n    also have \"... = ((Q1 \\<and> $ok\\<acute>) ;; ($ok \\<and> Q2))\"\n      by (simp add: assms(3) assms(4) runrest_ident_var)\n    also have \"... = (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>)\"\n      by (metis ok_vwb_lens seqr_pre_transfer seqr_right_one_point true_alt_def uovar_convr upred_eq_true utp_pred.inf.left_idem utp_urel_laws.unrest_ouvar vwb_lens_mwb)\n    finally show ?thesis\n      by (metis utp_pred.inf.left_commute utp_pred.inf_left_idem)\n  qed\n  moreover have \"(\\<not> (\\<not> P1 ;; true) \\<and> \\<not> (Q1\\<^sup>t ;; (\\<not> P2))) \\<turnstile> (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>) =\n                 (\\<not> (\\<not> P1 ;; true) \\<and> \\<not> (Q1\\<^sup>t ;; (\\<not> P2))) \\<turnstile> ($ok \\<and> $ok\\<acute> \\<and> (Q1\\<^sup>t ;; Q2\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (metis design_export_ok design_export_ok')\n  ultimately show ?thesis using assms\n    by (simp add: design_composition_subst usubst, metis design_export_ok design_export_ok')\nqed\n\ntheorem rdesign_composition:\n  \"((P1 \\<turnstile>\\<^sub>r Q1) ;; (P2 \\<turnstile>\\<^sub>r Q2)) = (((\\<not> ((\\<not> P1) ;; true)) \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile>\\<^sub>r (Q1 ;; Q2))\"\n  by (simp add: rdesign_def design_composition unrest alpha)\n\nlemma skip_d_alt_def: \"II\\<^sub>D = true \\<turnstile> II\"\n  by (rel_auto)\n\ntheorem design_skip_idem [simp]:\n  \"(II\\<^sub>D ;; II\\<^sub>D) = II\\<^sub>D\"\n  by (rel_auto)\n\ntheorem design_composition_cond:\n  assumes\n    \"out\\<alpha> \\<sharp> p1\" \"$ok \\<sharp> P2\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\"\n  shows \"((p1 \\<turnstile> Q1) ;; (P2 \\<turnstile> Q2)) = ((p1 \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile> (Q1 ;; Q2))\"\n  using assms\n  by (simp add: design_composition unrest precond_right_unit)\n\ntheorem rdesign_composition_cond:\n  assumes \"out\\<alpha> \\<sharp> p1\"\n  shows \"((p1 \\<turnstile>\\<^sub>r Q1) ;; (P2 \\<turnstile>\\<^sub>r Q2)) = ((p1 \\<and> \\<not> (Q1 ;; (\\<not> P2))) \\<turnstile>\\<^sub>r (Q1 ;; Q2))\"\n  using assms\n  by (simp add: rdesign_def design_composition_cond unrest alpha)\n\ntheorem design_composition_wp:\n  assumes\n    \"ok \\<sharp> p1\" \"ok \\<sharp> p2\"\n    \"$ok \\<sharp> Q1\" \"$ok\\<acute> \\<sharp> Q1\" \"$ok \\<sharp> Q2\" \"$ok\\<acute> \\<sharp> Q2\"\n  shows \"((\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile> Q1) ;; (\\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile> Q2)) = ((\\<lceil>p1 \\<and> Q1 wp p2\\<rceil>\\<^sub><) \\<turnstile> (Q1 ;; Q2))\"\n  using assms by (rel_blast)\n\ntheorem rdesign_composition_wp:\n  \"((\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q1) ;; (\\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q2)) = ((\\<lceil>p1 \\<and> Q1 wp p2\\<rceil>\\<^sub><) \\<turnstile>\\<^sub>r (Q1 ;; Q2))\"\n  by (rel_blast)\n\ntheorem ndesign_composition_wp:\n  \"((p1 \\<turnstile>\\<^sub>n Q1) ;; (p2 \\<turnstile>\\<^sub>n Q2)) = ((p1 \\<and> Q1 wp p2) \\<turnstile>\\<^sub>n (Q1 ;; Q2))\"\n  by (rel_blast)\n\ntheorem rdesign_wp [wp]:\n  \"(\\<lceil>p\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q) wp\\<^sub>D r = (p \\<and> Q wp r)\"\n  by (rel_auto)\n\ntheorem ndesign_wp [wp]:\n  \"(p \\<turnstile>\\<^sub>n Q) wp\\<^sub>D r = (p \\<and> Q wp r)\"\n  by (simp add: ndesign_def rdesign_wp)\n\ntheorem wpd_seq_r:\n  fixes Q1 Q2 :: \"'\\<alpha> hrel\"\n  shows \"(\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q1 ;; \\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q2) wp\\<^sub>D r = (\\<lceil>p1\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q1) wp\\<^sub>D ((\\<lceil>p2\\<rceil>\\<^sub>< \\<turnstile>\\<^sub>r Q2) wp\\<^sub>D r)\"\n  apply (simp add: wp)\n  apply (subst rdesign_composition_wp)\n  apply (simp only: wp)\n  apply (rel_auto)\ndone\n\ntheorem wpnd_seq_r [wp]:\n  fixes Q1 Q2 :: \"'\\<alpha> hrel\"\n  shows \"(p1 \\<turnstile>\\<^sub>n Q1 ;; p2 \\<turnstile>\\<^sub>n Q2) wp\\<^sub>D r = (p1 \\<turnstile>\\<^sub>n Q1) wp\\<^sub>D ((p2 \\<turnstile>\\<^sub>n Q2) wp\\<^sub>D r)\"\n  by (simp add: ndesign_def wpd_seq_r)\n\nlemma design_subst_ok:\n  \"(P\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> Q\\<lbrakk>true/$ok\\<rbrakk>) = (P \\<turnstile> Q)\"\n  by (rel_auto)\n\nlemma design_subst_ok_ok':\n  \"(P\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> Q\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>) = (P \\<turnstile> Q)\"\nproof -\n  have \"(P \\<turnstile> Q) = (($ok \\<and> P) \\<turnstile> ($ok \\<and> $ok\\<acute> \\<and> Q))\"\n    by (pred_auto)\n  also have \"... = (($ok \\<and> P\\<lbrakk>true/$ok\\<rbrakk>) \\<turnstile> ($ok \\<and> ($ok\\<acute> \\<and> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (metis conj_eq_out_var_subst conj_pos_var_subst upred_eq_true utp_pred.inf_commute ok_vwb_lens)\n  also have \"... = (($ok \\<and> P\\<lbrakk>true/$ok\\<rbrakk>) \\<turnstile> ($ok \\<and> $ok\\<acute> \\<and> Q\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>))\"\n    by (simp add: usubst)\n  also have \"... = (P\\<lbrakk>true/$ok\\<rbrakk> \\<turnstile> Q\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>)\"\n    by (pred_auto)\n  finally show ?thesis ..\nqed\n\nlemma design_subst_ok':\n  \"(P \\<turnstile> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>) = (P \\<turnstile> Q)\"\nproof -\n  have \"(P \\<turnstile> Q) = (P \\<turnstile> ($ok\\<acute> \\<and> Q))\"\n    by (pred_auto)\n  also have \"... = (P \\<turnstile> ($ok\\<acute> \\<and> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>))\"\n    by (metis conj_eq_out_var_subst upred_eq_true utp_pred.inf_commute ok_vwb_lens)\n  also have \"... = (P \\<turnstile> Q\\<lbrakk>true/$ok\\<acute>\\<rbrakk>)\"\n    by (pred_auto)\n  finally show ?thesis ..\nqed\n\ntheorem design_left_unit_hom:\n  fixes P Q :: \"'\\<alpha> hrel_des\"\n  shows \"(II\\<^sub>D ;; P \\<turnstile>\\<^sub>r Q) = (P \\<turnstile>\\<^sub>r Q)\"\nproof -\n  have \"(II\\<^sub>D ;; P \\<turnstile>\\<^sub>r Q) = (true \\<turnstile>\\<^sub>r II ;; P \\<turnstile>\\<^sub>r Q)\"\n    by (simp add: skip_d_def)\n  also have \"... = (true \\<and> \\<not> (II ;; (\\<not> P))) \\<turnstile>\\<^sub>r (II ;; Q)\"\n  proof -\n    have \"out\\<alpha> \\<sharp> true\"\n      by unrest_tac\n    thus ?thesis\n      using rdesign_composition_cond by blast\n  qed\n  also have \"... = (\\<not> (\\<not> P)) \\<turnstile>\\<^sub>r Q\"\n    by simp\n  finally show ?thesis by simp\nqed\n\ntheorem design_left_unit [simp]:\n  \"(II\\<^sub>D ;; P \\<turnstile>\\<^sub>r Q) = (P \\<turnstile>\\<^sub>r Q)\"\n  by (rel_auto)\n\ntheorem design_right_semi_unit:\n  \"(P \\<turnstile>\\<^sub>r Q ;; II\\<^sub>D) = ((\\<not> (\\<not> P) ;; true) \\<turnstile>\\<^sub>r Q)\"\n  by (simp add: skip_d_def rdesign_composition)\n\ntheorem design_right_cond_unit [simp]:\n  assumes \"out\\<alpha> \\<sharp> p\"\n  shows \"(p \\<turnstile>\\<^sub>r Q ;; II\\<^sub>D) = (p \\<turnstile>\\<^sub>r Q)\"\n  using assms\n  by (simp add: skip_d_def rdesign_composition_cond)\n\nlemma lift_des_skip_dr_unit [simp]:\n  \"(\\<lceil>P\\<rceil>\\<^sub>D ;; \\<lceil>II\\<rceil>\\<^sub>D) = \\<lceil>P\\<rceil>\\<^sub>D\"\n  \"(\\<lceil>II\\<rceil>\\<^sub>D ;; \\<lceil>P\\<rceil>\\<^sub>D) = \\<lceil>P\\<rceil>\\<^sub>D\"\n  by (rel_auto)+\n\nlemma assigns_d_id [simp]: \"\\<langle>id\\<rangle>\\<^sub>D = II\\<^sub>D\"\n  by (rel_auto)\n\nlemma assign_d_left_comp:\n  \"(\\<langle>f\\<rangle>\\<^sub>D ;; (P \\<turnstile>\\<^sub>r Q)) = (\\<lceil>f\\<rceil>\\<^sub>s \\<dagger> P \\<turnstile>\\<^sub>r \\<lceil>f\\<rceil>\\<^sub>s \\<dagger> Q)\"\n  by (simp add: assigns_d_def rdesign_composition assigns_r_comp subst_not)\n\nlemma assign_d_right_comp:\n  \"((P \\<turnstile>\\<^sub>r Q) ;; \\<langle>f\\<rangle>\\<^sub>D) = ((\\<not> ((\\<not> P) ;; true)) \\<turnstile>\\<^sub>r (Q ;; \\<langle>f\\<rangle>\\<^sub>a))\"\n  by (simp add: assigns_d_def rdesign_composition)\n\nlemma assigns_d_comp:\n  \"(\\<langle>f\\<rangle>\\<^sub>D ;; \\<langle>g\\<rangle>\\<^sub>D) = \\<langle>g \\<circ> f\\<rangle>\\<^sub>D\"\n  by (simp add: assigns_d_def rdesign_composition assigns_comp)\n\nsubsection {* Design preconditions *}\n\nlemma design_pre_choice [simp]:\n  \"pre\\<^sub>D(P \\<sqinter> Q) = (pre\\<^sub>D(P) \\<and> pre\\<^sub>D(Q))\"\n  by (rel_auto)\n\nlemma design_post_choice [simp]:\n  \"post\\<^sub>D(P \\<sqinter> Q) = (post\\<^sub>D(P) \\<or> post\\<^sub>D(Q))\"\n  by (rel_auto)\n\nlemma design_pre_condr [simp]:\n  \"pre\\<^sub>D(P \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>D \\<triangleright> Q) = (pre\\<^sub>D(P) \\<triangleleft> b \\<triangleright> pre\\<^sub>D(Q))\"\n  by (rel_auto)\n\nlemma design_post_condr [simp]:\n  \"post\\<^sub>D(P \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>D \\<triangleright> Q) = (post\\<^sub>D(P) \\<triangleleft> b \\<triangleright> post\\<^sub>D(Q))\"\n  by (rel_auto)\n\nsubsection {* H1: No observation is allowed before initiation *}\nterm \"\\<lambda>x . \\<lambda>y. x (y x)\"\nterm \"Fun.comp\"\nterm \"P o P\"\nlemma H1_idem:\n  \"H1 (H1 P) = H1(P)\"\n  by (pred_auto)\n\nlemma H1_monotone:\n  \"P \\<sqsubseteq> Q \\<Longrightarrow> H1(P) \\<sqsubseteq> H1(Q)\"\n  by (pred_auto)\n\nlemma H1_Continuous: \"Continuous H1\"\n  apply (rel_auto)\n  unfolding SUP_def \n  apply transfer apply auto \n  unfolding SUP_def \n  apply transfer apply auto \n  unfolding SUP_def \n  apply transfer apply auto \ndone\n\nlemma H1_below_top:\n  \"H1(P) \\<sqsubseteq> \\<top>\\<^sub>D\"\n  by (pred_auto)\n\nlemma H1_design_skip:\n  \"H1(II) = II\\<^sub>D\"\n  by (rel_auto)\n\nlemma H1_cond: \"H1(P \\<triangleleft> b \\<triangleright> Q) = H1(P) \\<triangleleft> b \\<triangleright> H1(Q)\"\n  by (rel_auto)\n\nlemma H1_conj: \"H1(P \\<and> Q) = (H1(P) \\<and> H1(Q))\"\n  by (rel_auto)\n\nlemma H1_disj: \"H1(P \\<or> Q) = (H1(P) \\<or> H1(Q))\"\n  by (rel_auto)\n\nlemma design_export_H1: \"(P \\<turnstile> Q) = (P \\<turnstile> H1(Q))\"\n  by (rel_auto)\n\ntext {* The H1 algebraic laws are valid only when $\\alpha(R)$ is homogeneous. This should maybe be\n        generalised. *}\n\ntheorem H1_algebraic_intro:\n  assumes\n    \"(true\\<^sub>h ;; R) = true\\<^sub>h\"\n    \"(II\\<^sub>D ;; R) = R\"\n  shows \"R is H1\"\nproof -\n  have \"R = (II\\<^sub>D ;; R)\" by (simp add: assms(2))\n  also have \"... = (H1(II) ;; R)\"\n    by (simp add: H1_design_skip)\n  also have \"... = (($ok \\<Rightarrow> II) ;; R)\"\n    by (simp add: H1_def)\n  also have \"... = (((\\<not> $ok) ;; R) \\<or> R)\"\n    by (simp add: impl_alt_def seqr_or_distl)\n  also have \"... = ((((\\<not> $ok) ;; true\\<^sub>h) ;; R) \\<or> R)\"\n    by (simp add: precond_right_unit unrest)\n  also have \"... = (((\\<not> $ok) ;; true\\<^sub>h) \\<or> R)\"\n    by (metis assms(1) seqr_assoc)\n  also have \"... = ($ok \\<Rightarrow> R)\"\n    by (simp add: impl_alt_def precond_right_unit unrest)\n  finally show ?thesis by (metis H1_def Healthy_def')\nqed\n\nlemma nok_not_false:\n  \"(\\<not> $ok) \\<noteq> false\"\n  by (pred_auto)\n\ntheorem H1_left_zero:\n  assumes \"P is H1\"\n  shows \"(true ;; P) = true\"\nproof -\n  from assms have \"(true ;; P) = (true ;; ($ok \\<Rightarrow> P))\"\n    by (simp add: H1_def Healthy_def')\n  (* The next step ensures we get the right alphabet for true by copying it *)\n  also from assms have \"... = (true ;; (\\<not> $ok \\<or> P))\" (is \"_ = (?true ;; _)\")\n    by (simp add: impl_alt_def)\n  also from assms have \"... = ((?true ;; (\\<not> $ok)) \\<or> (?true ;; P))\"\n    using seqr_or_distr by blast\n  also from assms have \"... = (true \\<or> (true ;; P))\"\n    by (simp add: nok_not_false precond_left_zero unrest)\n  finally show ?thesis\n    by (simp add: upred_defs urel_defs)\nqed\n\ntheorem H1_left_unit:\n  fixes P :: \"'\\<alpha> hrel_des\"\n  assumes \"P is H1\"\n  shows \"(II\\<^sub>D ;; P) = P\"\nproof -\n  have \"(II\\<^sub>D ;; P) = (($ok \\<Rightarrow> II) ;; P)\"\n    by (metis H1_def H1_design_skip)\n  also have \"... = (((\\<not> $ok) ;; P) \\<or> P)\"\n    by (simp add: impl_alt_def seqr_or_distl)\n  also from assms have \"... = ((((\\<not> $ok) ;; true\\<^sub>h) ;; P) \\<or> P)\"\n    by (simp add: precond_right_unit unrest)\n  also have \"... = (((\\<not> $ok) ;; (true\\<^sub>h ;; P)) \\<or> P)\"\n    by (simp add: seqr_assoc)\n  also from assms have \"... = ($ok \\<Rightarrow> P)\"\n    by (simp add: H1_left_zero impl_alt_def precond_right_unit unrest)\n  finally show ?thesis using assms\n    by (simp add: H1_def Healthy_def')\nqed\n\ntheorem H1_algebraic:\n  \"P is H1 \\<longleftrightarrow> (true\\<^sub>h ;; P) = true\\<^sub>h \\<and> (II\\<^sub>D ;; P) = P\"\n  using H1_algebraic_intro H1_left_unit H1_left_zero by blast\n\ntheorem H1_nok_left_zero:\n  fixes P :: \"'\\<alpha> hrel_des\"\n  assumes \"P is H1\"\n  shows \"((\\<not> $ok) ;; P) = (\\<not> $ok)\"\nproof -\n  have \"((\\<not> $ok) ;; P) = (((\\<not> $ok) ;; true\\<^sub>h) ;; P)\"\n    by (simp add: precond_right_unit unrest)\n  also have \"... = ((\\<not> $ok) ;; true\\<^sub>h)\"\n    by (metis H1_left_zero assms seqr_assoc)\n  also have \"... = (\\<not> $ok)\"\n    by (simp add: precond_right_unit unrest)\n  finally show ?thesis .\nqed\n\nlemma H1_design:\n  \"H1(P \\<turnstile> Q) = (P \\<turnstile> Q)\"\n  by (rel_auto)\n\nlemma H1_rdesign:\n  \"H1(P \\<turnstile>\\<^sub>r Q) = (P \\<turnstile>\\<^sub>r Q)\"\n  by (rel_auto)\n\nlemma H1_choice_closed:\n  \"\\<lbrakk> P is H1; Q is H1 \\<rbrakk> \\<Longrightarrow> P \\<sqinter> Q is H1\"\n  by (simp add: H1_def Healthy_def' disj_upred_def impl_alt_def semilattice_sup_class.sup_left_commute)\n\nlemma H1_inf_closed:\n  \"\\<lbrakk> P is H1; Q is H1 \\<rbrakk> \\<Longrightarrow> P \\<squnion> Q is H1\"\n  by (rel_blast)\n\nlemma H1_USUP:\n  assumes \"A \\<noteq> {}\"\n  shows \"H1(\\<Sqinter> i \\<in> A \\<bullet> P(i)) = (\\<Sqinter> i \\<in> A \\<bullet> H1(P(i)))\"\n  using assms by (rel_auto)\n\nlemma H1_Sup:\n  assumes \"A \\<noteq> {}\" \"\\<forall> P \\<in> A. P is H1\"\n  shows \"(\\<Sqinter> A) is H1\"\nproof -\n  from assms(2) have \"H1 ` A = A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  with H1_USUP[of A id, OF assms(1)] show ?thesis\n    unfolding SUP_def\n    by (simp add:  USUP_as_Sup_image Healthy_def)\nqed\n\nlemma H1_UINF:\n  shows \"H1(\\<Squnion> i \\<in> A \\<bullet> P(i)) = (\\<Squnion> i \\<in> A \\<bullet> H1(P(i)))\"\n  by (rel_auto)\n\nlemma H1_Inf:\n  assumes \"\\<forall> P \\<in> A. P is H1\"\n  shows \"(\\<Squnion> A) is H1\"\nproof -\n  from assms have \"H1 ` A = A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  with H1_UINF[of A id] show ?thesis\n    by (simp add: UINF_as_Inf_image Healthy_def)\nqed\n\nsubsection {* H2: A specification cannot require non-termination *}\n\nlemma J_split:\n  shows \"(P ;; J) = (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))\"\nproof -\n  have \"(P ;; J) = (P ;; (($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D))\"\n    by (simp add: H2_def J_def design_def)\n  also have \"... = (P ;; (($ok \\<Rightarrow> $ok \\<and> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D))\"\n    by (rel_auto)\n  also have \"... = ((P ;; (\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D)) \\<or> (P ;; ($ok \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<and> $ok\\<acute>))))\"\n    by (rel_auto)\n  also have \"... = (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))\"\n  proof -\n    have \"(P ;; (\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D)) = P\\<^sup>f\"\n    proof -\n      have \"(P ;; (\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D)) = ((P \\<and> \\<not> $ok\\<acute>) ;; \\<lceil>II\\<rceil>\\<^sub>D)\"\n        by (rel_auto)\n      also have \"... = (\\<exists> $ok\\<acute> \\<bullet> P \\<and> $ok\\<acute> =\\<^sub>u false)\"\n        by (rel_auto)\n      also have \"... = P\\<^sup>f\"\n        by (metis C1 one_point out_var_uvar unrest_as_exists ok_vwb_lens vwb_lens_mwb)\n     finally show ?thesis .\n    qed\n    moreover have \"(P ;; ($ok \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<and> $ok\\<acute>))) = (P\\<^sup>t \\<and> $ok\\<acute>)\"\n    proof -\n      have \"(P ;; ($ok \\<and> (\\<lceil>II\\<rceil>\\<^sub>D \\<and> $ok\\<acute>))) = (P ;; ($ok \\<and> II))\"\n        by (rel_auto)\n      also have \"... = (P\\<^sup>t \\<and> $ok\\<acute>)\"\n        by (rel_auto)\n      finally show ?thesis .\n    qed\n    ultimately show ?thesis\n      by simp\n  qed\n  finally show ?thesis .\nqed\n\nlemma H2_split:\n  shows \"H2(P) = (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))\"\n  by (simp add: H2_def J_split)\n\ntheorem H2_equivalence:\n  \"P is H2 \\<longleftrightarrow> `P\\<^sup>f \\<Rightarrow> P\\<^sup>t`\"\nproof -\n  have \"`P \\<Leftrightarrow> (P ;; J)` \\<longleftrightarrow> `P \\<Leftrightarrow> (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>))`\"\n    by (simp add: J_split)\n  also have \"... \\<longleftrightarrow> `(P \\<Leftrightarrow> P\\<^sup>f \\<or> P\\<^sup>t \\<and> $ok\\<acute>)\\<^sup>f \\<and> (P \\<Leftrightarrow> P\\<^sup>f \\<or> P\\<^sup>t \\<and> $ok\\<acute>)\\<^sup>t`\"\n    by (simp add: subst_bool_split)\n  also have \"... = `(P\\<^sup>f \\<Leftrightarrow> P\\<^sup>f) \\<and> (P\\<^sup>t \\<Leftrightarrow> P\\<^sup>f \\<or> P\\<^sup>t)`\"\n    by subst_tac\n  also have \"... = `P\\<^sup>t \\<Leftrightarrow> (P\\<^sup>f \\<or> P\\<^sup>t)`\"\n    by (pred_auto robust)\n  also have \"... = `(P\\<^sup>f \\<Rightarrow> P\\<^sup>t)`\"\n    by (pred_auto)\n  finally show ?thesis\n    by (metis H2_def Healthy_def' taut_iff_eq)\nqed\n\nlemma H2_equiv:\n  \"P is H2 \\<longleftrightarrow> P\\<^sup>t \\<sqsubseteq> P\\<^sup>f\"\n  using H2_equivalence refBy_order by blast\n\nlemma H2_design:\n  assumes \"$ok\\<acute> \\<sharp> P\" \"$ok\\<acute> \\<sharp> Q\"\n  shows \"H2(P \\<turnstile> Q) = P \\<turnstile> Q\"\n  using assms\n  by (simp add: H2_split design_def usubst unrest, pred_auto)\n\nlemma H2_rdesign:\n  \"H2(P \\<turnstile>\\<^sub>r Q) = P \\<turnstile>\\<^sub>r Q\"\n  by (simp add: H2_design unrest rdesign_def)\n\ntheorem J_idem:\n  \"(J ;; J) = J\"\n  by (rel_auto)\n\ntheorem H2_idem:\n  \"H2(H2(P)) = H2(P)\"\n  by (metis H2_def J_idem seqr_assoc)\n \ntheorem H2_Continuous: \"Continuous H2\"\n  apply (rel_auto)\n  unfolding  SUP_def apply rel_simp\n  unfolding  SUP_def INF_def\n  apply transfer apply force \n  apply rel_simp\n  unfolding  SUP_def INF_def\n  apply transfer apply force\n  apply rel_simp\n  unfolding  SUP_def INF_def\n  apply transfer apply auto\n  apply (metis des_vars.surjective)+\ndone\n\ntheorem H2_not_okay: \"H2 (\\<not> $ok) = (\\<not> $ok)\"\nproof -\n  have \"H2 (\\<not> $ok) = ((\\<not> $ok)\\<^sup>f \\<or> ((\\<not> $ok)\\<^sup>t \\<and> $ok\\<acute>))\"\n    by (simp add: H2_split)\n  also have \"... = (\\<not> $ok \\<or> (\\<not> $ok) \\<and> $ok\\<acute>)\"\n    by (subst_tac)\n  also have \"... = (\\<not> $ok)\"\n    by (pred_auto)\n  finally show ?thesis .\nqed\n\nlemma H2_true: \"H2(true) = true\"\n  by (rel_auto)\n\nlemma H2_choice_closed:\n  \"\\<lbrakk> P is H2; Q is H2 \\<rbrakk> \\<Longrightarrow> P \\<sqinter> Q is H2\"\n  by (metis H2_def Healthy_def' disj_upred_def seqr_or_distl)\n\nlemma H2_inf_closed:\n  assumes \"P is H2\" \"Q is H2\"\n  shows \"P \\<squnion> Q is H2\"\nproof -\n  have \"P \\<squnion> Q = (P\\<^sup>f \\<or> P\\<^sup>t \\<and> $ok\\<acute>) \\<squnion> (Q\\<^sup>f \\<or> Q\\<^sup>t \\<and> $ok\\<acute>)\"\n    by (metis H2_def Healthy_def J_split assms(1) assms(2))\n  moreover have \"H2(...) = ...\"\n    by (simp add: H2_split usubst, pred_auto)\n  ultimately show ?thesis\n    by (simp add: Healthy_def)\nqed\n\nlemma H2_USUP:\n  shows \"H2(\\<Sqinter> i \\<in> A \\<bullet> P(i)) = (\\<Sqinter> i \\<in> A \\<bullet> H2(P(i)))\"\n  by (rel_auto)\n\ntheorem H1_H2_commute:\n  \"H1 (H2 P) = H2 (H1 P)\"\nproof -\n  have \"H2 (H1 P) = (($ok \\<Rightarrow> P) ;; J)\"\n    by (simp add: H1_def H2_def)\n  also have \"... = ((\\<not> $ok \\<or> P) ;; J)\"\n    by (rel_auto)\n  also have \"... = (((\\<not> $ok) ;; J) \\<or> (P ;; J))\"\n    using seqr_or_distl by blast\n  also have \"... =  ((H2 (\\<not> $ok)) \\<or> H2(P))\"\n    by (simp add: H2_def)\n  also have \"... =  ((\\<not> $ok) \\<or> H2(P))\"\n    by (simp add: H2_not_okay)\n  also have \"... = H1(H2(P))\"\n    by (rel_auto)\n  finally show ?thesis by simp\nqed\n\nlemma ok_pre: \"($ok \\<and> \\<lceil>pre\\<^sub>D(P)\\<rceil>\\<^sub>D) = ($ok \\<and> (\\<not> P\\<^sup>f))\"\n  by (pred_auto robust)\n\nlemma ok_post: \"($ok \\<and> \\<lceil>post\\<^sub>D(P)\\<rceil>\\<^sub>D) = ($ok \\<and> (P\\<^sup>t))\"\n  by (pred_auto robust)\n\nabbreviation \"H1_H2 P \\<equiv> H1 (H2 P)\"\n\nnotation H1_H2 (\"\\<^bold>H\")\n\nlemma H1_H2_comp: \"\\<^bold>H = H1 \\<circ> H2\"\n  by (auto)\n\ntheorem H1_H2_eq_design:\n  \"\\<^bold>H(P) = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\nproof -\n  have \"\\<^bold>H(P) = ($ok \\<Rightarrow> H2(P))\"\n    by (simp add: H1_def)\n  also have \"... = ($ok \\<Rightarrow> (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>)))\"\n    by (metis H2_split)\n  also have \"... = ($ok \\<and> (\\<not> P\\<^sup>f) \\<Rightarrow> $ok\\<acute> \\<and> $ok \\<and> P\\<^sup>t)\"\n    by (rel_auto)\n  also have \"... = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\ntheorem H1_H2_is_design:\n  assumes \"P is H1\" \"P is H2\"\n  shows \"P = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\n  using assms by (metis H1_H2_eq_design Healthy_def)\n\ntheorem H1_H2_eq_rdesign:\n  \"\\<^bold>H(P) = pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\nproof -\n  have \"\\<^bold>H(P) = ($ok \\<Rightarrow> H2(P))\"\n    by (simp add: H1_def Healthy_def')\n  also have \"... = ($ok \\<Rightarrow> (P\\<^sup>f \\<or> (P\\<^sup>t \\<and> $ok\\<acute>)))\"\n    by (metis H2_split)\n  also have \"... = ($ok \\<and> (\\<not> P\\<^sup>f) \\<Rightarrow> $ok\\<acute> \\<and> P\\<^sup>t)\"\n    by (pred_auto)\n  also have \"... = ($ok \\<and> (\\<not> P\\<^sup>f) \\<Rightarrow> $ok\\<acute> \\<and> $ok \\<and> P\\<^sup>t)\"\n    by (pred_auto)\n  also have \"... = ($ok \\<and> \\<lceil>pre\\<^sub>D(P)\\<rceil>\\<^sub>D \\<Rightarrow> $ok\\<acute> \\<and> $ok \\<and> \\<lceil>post\\<^sub>D(P)\\<rceil>\\<^sub>D)\"\n    by (simp add: ok_post ok_pre)\n  also have \"... = ($ok \\<and> \\<lceil>pre\\<^sub>D(P)\\<rceil>\\<^sub>D \\<Rightarrow> $ok\\<acute> \\<and> \\<lceil>post\\<^sub>D(P)\\<rceil>\\<^sub>D)\"\n    by (pred_auto)\n  also have \"... =  pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\n    by (simp add: rdesign_def design_def)\n  finally show ?thesis .\nqed\n\ntheorem H1_H2_is_rdesign:\n  assumes \"P is H1\" \"P is H2\"\n  shows \"P = pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\n  by (metis H1_H2_eq_rdesign Healthy_def assms(1) assms(2))\n\nlemma H1_H2_idempotent: \"\\<^bold>H (\\<^bold>H P) = \\<^bold>H P\"\n  by (simp add: H1_H2_commute H1_idem H2_idem)\n\nlemma H1_H2_Idempotent: \"Idempotent \\<^bold>H\"\n  by (simp add: Idempotent_def H1_H2_idempotent)\n\nlemma H1_H2_monotonic: \"Monotonic \\<^bold>H\"\n  by (simp add: H1_monotone H2_def Monotonic_def seqr_mono)\n\nlemma H1_H2_Continuous: \"Continuous \\<^bold>H\"\n  by (simp add: Continuous_comp H1_Continuous H1_H2_comp H2_Continuous)\n\nlemma design_is_H1_H2 [closure]:\n  \"\\<lbrakk> $ok\\<acute> \\<sharp> P; $ok\\<acute> \\<sharp> Q \\<rbrakk> \\<Longrightarrow> (P \\<turnstile> Q) is \\<^bold>H\"\n  by (simp add: H1_design H2_design Healthy_def')\n\nlemma rdesign_is_H1_H2 [closure]:\n  \"(P \\<turnstile>\\<^sub>r Q) is \\<^bold>H\"\n  by (simp add: Healthy_def H1_rdesign H2_rdesign)\n\nlemma assigns_d_is_H1_H2 [closure]:\n  \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D is \\<^bold>H\"\n  by (simp add: assigns_d_def rdesign_is_H1_H2)\n\nlemma seq_r_H1_H2_closed [closure]:\n  assumes \"P is \\<^bold>H\" \"Q is \\<^bold>H\"\n  shows \"(P ;; Q) is \\<^bold>H\"\nproof -\n  obtain P\\<^sub>1 P\\<^sub>2 where \"P = P\\<^sub>1 \\<turnstile>\\<^sub>r P\\<^sub>2\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def assms(1))\n  moreover obtain Q\\<^sub>1 Q\\<^sub>2 where \"Q = Q\\<^sub>1 \\<turnstile>\\<^sub>r Q\\<^sub>2\"\n   by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def assms(2))\n  moreover have \"((P\\<^sub>1 \\<turnstile>\\<^sub>r P\\<^sub>2) ;; (Q\\<^sub>1 \\<turnstile>\\<^sub>r Q\\<^sub>2)) is \\<^bold>H\"\n    by (simp add: rdesign_composition rdesign_is_H1_H2)\n  ultimately show ?thesis by simp\nqed\n\nlemma assigns_d_comp_ext:\n  fixes P :: \"'\\<alpha> hrel_des\"\n  assumes \"P is \\<^bold>H\"\n  shows \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; P) = \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> P\"\nproof -\n  have \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; P) = (\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P))\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def' assms)\n  also have \"... = \\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> pre\\<^sub>D(P) \\<turnstile>\\<^sub>r \\<lceil>\\<sigma>\\<rceil>\\<^sub>s \\<dagger> post\\<^sub>D(P)\"\n    by (simp add: assign_d_left_comp)\n  also have \"... = \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> (pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P))\"\n    by (rel_auto)\n  also have \"... = \\<lceil>\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D\\<rceil>\\<^sub>s \\<dagger> P\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H2_idem Healthy_def' assms)\n  finally show ?thesis .\nqed\n\nlemma USUP_H1_H2_closed:\n  assumes \"A \\<noteq> {}\" \"\\<forall> P \\<in> A. P is \\<^bold>H\"\n  shows \"(\\<Sqinter> A) is H1_H2\"\nproof -\n  from assms have A: \"A = H1_H2 ` A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  also have \"(\\<Sqinter> ...) = (\\<Sqinter> P \\<in> A \\<bullet> H1_H2(P))\"\n    by (simp add: USUP_as_Sup_collect)\n  also have \"... = (\\<Sqinter> P \\<in> A \\<bullet> (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t)\"\n    by (meson H1_H2_eq_design)\n  also have \"... = (\\<Squnion> P \\<in> A \\<bullet> \\<not> P\\<^sup>f) \\<turnstile> (\\<Sqinter> P \\<in> A \\<bullet> P\\<^sup>t)\"\n    by (simp add: design_USUP assms)\n  also have \"... is H1_H2\"\n    by (simp add: design_is_H1_H2 unrest)\n  finally show ?thesis .\nqed\n\ndefinition design_sup :: \"('\\<alpha>, '\\<beta>) rel_des set \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (\"\\<Sqinter>\\<^sub>D_\" [900] 900) where\n\"\\<Sqinter>\\<^sub>D A = (if (A = {}) then \\<top>\\<^sub>D else \\<Sqinter> A)\"\n\nlemma design_sup_H1_H2_closed:\n  assumes \"\\<forall> P \\<in> A. P is \\<^bold>H\"\n  shows \"(\\<Sqinter>\\<^sub>D A) is \\<^bold>H\"\n  apply (auto simp add: design_sup_def)\n  apply (simp add: H1_def H2_not_okay Healthy_def impl_alt_def)\n  using USUP_H1_H2_closed assms apply blast\ndone\n\nlemma design_sup_empty [simp]: \"\\<Sqinter>\\<^sub>D {} = \\<top>\\<^sub>D\"\n  by (simp add: design_sup_def)\n\nlemma design_sup_non_empty [simp]: \"A \\<noteq> {} \\<Longrightarrow> \\<Sqinter>\\<^sub>D A = \\<Sqinter> A\"\n  by (simp add: design_sup_def)\n\nlemma UINF_H1_H2_closed:\n  assumes \"\\<forall> P \\<in> A. P is \\<^bold>H\"\n  shows \"(\\<Squnion> A) is \\<^bold>H\"\nproof -\n  from assms have A: \"A = \\<^bold>H ` A\"\n    by (auto simp add: Healthy_def rev_image_eqI)\n  also have \"(\\<Squnion> ...) = (\\<Squnion> P \\<in> A \\<bullet> \\<^bold>H(P))\"\n    by (simp add: UINF_as_Inf_collect)\n  also have \"... = (\\<Squnion> P \\<in> A \\<bullet> (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t)\"\n    by (meson H1_H2_eq_design)\n  also have \"... = (\\<Sqinter> P \\<in> A \\<bullet> \\<not> P\\<^sup>f) \\<turnstile> (\\<Squnion> P \\<in> A \\<bullet> \\<not> P\\<^sup>f \\<Rightarrow> P\\<^sup>t)\"\n    by (simp add: design_UINF)\n  also have \"... is \\<^bold>H\"\n    by (simp add: design_is_H1_H2 unrest)\n  finally show ?thesis .\nqed\n\nabbreviation design_inf :: \"('\\<alpha>, '\\<beta>) rel_des set \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel_des\" (\"\\<Squnion>\\<^sub>D_\" [900] 900) where\n\"\\<Squnion>\\<^sub>D A \\<equiv> \\<Squnion> A\"\n\nsubsection {* H3: The design assumption is a precondition *}\n\ntheorem H3_idem:\n  \"H3(H3(P)) = H3(P)\"\n  by (metis H3_def design_skip_idem seqr_assoc)\n\ntheorem H3_mono:\n  \"P \\<sqsubseteq> Q \\<Longrightarrow> H3(P) \\<sqsubseteq> H3(Q)\"\n  by (simp add: H3_def seqr_mono)\n\ntheorem H3_Monotonic:\n  \"Monotonic H3\"\n  by (simp add: H3_mono Monotonic_def)\n\ntheorem H3_Continuous: \"Continuous H3\"\n   apply (rel_auto)\n  unfolding  SUP_def apply rel_simp\n  unfolding  SUP_def INF_def\n  apply transfer apply force \n  apply rel_simp\n  unfolding  SUP_def INF_def\n  apply transfer apply force\n  apply rel_simp\n  unfolding  SUP_def INF_def\n  apply transfer apply auto\n  apply (metis des_vars.surjective)+\ndone\n\ntheorem design_condition_is_H3:\n  assumes \"out\\<alpha> \\<sharp> p\"\n  shows \"(p \\<turnstile> Q) is H3\"\nproof -\n  have \"((p \\<turnstile> Q) ;; II\\<^sub>D) = (\\<not> ((\\<not> p) ;; true)) \\<turnstile> (Q\\<^sup>t ;; II\\<lbrakk>true/$ok\\<rbrakk>)\"\n    by (simp add: skip_d_alt_def design_composition_subst unrest assms)\n  also have \"... = p \\<turnstile> (Q\\<^sup>t ;; II\\<lbrakk>true/$ok\\<rbrakk>)\"\n    using assms precond_equiv seqr_true_lemma by force\n  also have \"... = p \\<turnstile> Q\"\n    by (rel_auto)\n  finally show ?thesis\n    by (simp add: H3_def Healthy_def')\nqed\n\ntheorem rdesign_H3_iff_pre:\n  \"P \\<turnstile>\\<^sub>r Q is H3 \\<longleftrightarrow> P = (P ;; true)\"\nproof -\n  have \"(P \\<turnstile>\\<^sub>r Q ;; II\\<^sub>D) = (P \\<turnstile>\\<^sub>r Q ;; true \\<turnstile>\\<^sub>r II)\"\n    by (simp add: skip_d_def)\n  also have \"... = (\\<not> ((\\<not> P) ;; true) \\<and> \\<not> (Q ;; (\\<not> true))) \\<turnstile>\\<^sub>r (Q ;; II)\"\n    by (simp add: rdesign_composition)\n  also have \"... = (\\<not> ((\\<not> P) ;; true) \\<and> \\<not> (Q ;; (\\<not> true))) \\<turnstile>\\<^sub>r Q\"\n    by simp\n  also have \"... = (\\<not> ((\\<not> P) ;; true)) \\<turnstile>\\<^sub>r Q\"\n    by (pred_auto)\n  finally have \"P \\<turnstile>\\<^sub>r Q is H3 \\<longleftrightarrow> P \\<turnstile>\\<^sub>r Q = (\\<not> ((\\<not> P) ;; true)) \\<turnstile>\\<^sub>r Q\"\n    by (metis H3_def Healthy_def')\n  also have \"... \\<longleftrightarrow> P = (\\<not> ((\\<not> P) ;; true))\"\n    by (metis rdesign_pre)\n  also have \"... \\<longleftrightarrow> P = (P ;; true)\"\n    by (simp add: seqr_true_lemma)\n  finally show ?thesis .\nqed\n\ntheorem design_H3_iff_pre:\n  assumes \"$ok \\<sharp> P\" \"$ok\\<acute> \\<sharp> P\" \"$ok \\<sharp> Q\" \"$ok\\<acute> \\<sharp> Q\"\n  shows \"P \\<turnstile> Q is H3 \\<longleftrightarrow> P = (P ;; true)\"\nproof -\n  have \"P \\<turnstile> Q = \\<lfloor>P\\<rfloor>\\<^sub>D \\<turnstile>\\<^sub>r \\<lfloor>Q\\<rfloor>\\<^sub>D\"\n    by (simp add: assms lift_desr_inv rdesign_def)\n  moreover hence \"\\<lfloor>P\\<rfloor>\\<^sub>D \\<turnstile>\\<^sub>r \\<lfloor>Q\\<rfloor>\\<^sub>D is H3 \\<longleftrightarrow> \\<lfloor>P\\<rfloor>\\<^sub>D = (\\<lfloor>P\\<rfloor>\\<^sub>D ;; true)\"\n    using rdesign_H3_iff_pre by blast\n  ultimately show ?thesis\n    by (metis assms(1,2) drop_desr_inv lift_desr_inv lift_dist_seq aext_true)\nqed\n\ntheorem H1_H3_commute:\n  \"H1 (H3 P) = H3 (H1 P)\"\n  by (rel_auto)\n\nlemma skip_d_absorb_J_1:\n  \"(II\\<^sub>D ;; J) = II\\<^sub>D\"\n  by (metis H2_def H2_rdesign skip_d_def)\n\nlemma skip_d_absorb_J_2:\n  \"(J ;; II\\<^sub>D) = II\\<^sub>D\"\nproof -\n  have \"(J ;; II\\<^sub>D) = ((($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D) ;; true \\<turnstile> II)\"\n    by (simp add: J_def skip_d_alt_def)\n  also have \"... = (\\<^bold>\\<exists> ok\\<^sub>0 \\<bullet> (($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<acute>\\<rbrakk> ;; (true \\<turnstile> II)\\<lbrakk>\\<guillemotleft>ok\\<^sub>0\\<guillemotright>/$ok\\<rbrakk>)\"\n    by (subst seqr_middle[of ok], simp_all)\n  also have \"... = (((($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\\<lbrakk>false/$ok\\<acute>\\<rbrakk> ;; (true \\<turnstile> II)\\<lbrakk>false/$ok\\<rbrakk>)\n                  \\<or> ((($ok \\<Rightarrow> $ok\\<acute>) \\<and> \\<lceil>II\\<rceil>\\<^sub>D)\\<lbrakk>true/$ok\\<acute>\\<rbrakk> ;; (true \\<turnstile> II)\\<lbrakk>true/$ok\\<rbrakk>))\"\n    by (simp add: disj_comm false_alt_def true_alt_def)\n  also have \"... = ((\\<not> $ok \\<and> \\<lceil>II\\<rceil>\\<^sub>D ;; true) \\<or> (\\<lceil>II\\<rceil>\\<^sub>D ;; $ok\\<acute> \\<and> \\<lceil>II\\<rceil>\\<^sub>D))\"\n    by (rel_auto)\n  also have \"... = II\\<^sub>D\"\n    by (rel_auto)\n  finally show ?thesis .\nqed\n\nlemma H2_H3_absorb:\n  \"H2 (H3 P) = H3 P\"\n  by (metis H2_def H3_def seqr_assoc skip_d_absorb_J_1)\n\nlemma H3_H2_absorb:\n  \"H3 (H2 P) = H3 P\"\n  by (metis H2_def H3_def seqr_assoc skip_d_absorb_J_2)\n\ntheorem H2_H3_commute:\n  \"H2 (H3 P) = H3 (H2 P)\"\n  by (simp add: H2_H3_absorb H3_H2_absorb)\n\ntheorem H3_design_pre:\n  assumes \"$ok \\<sharp> p\" \"out\\<alpha> \\<sharp> p\" \"$ok \\<sharp> Q\" \"$ok\\<acute> \\<sharp> Q\"\n  shows \"H3(p \\<turnstile> Q) = p \\<turnstile> Q\"\n  using assms\n  by (metis Healthy_def' design_H3_iff_pre precond_right_unit unrest_out\\<alpha>_var ok_vwb_lens vwb_lens_mwb)\n\ntheorem H3_rdesign_pre:\n  assumes \"out\\<alpha> \\<sharp> p\"\n  shows \"H3(p \\<turnstile>\\<^sub>r Q) = p \\<turnstile>\\<^sub>r Q\"\n  using assms\n  by (simp add: H3_def)\n\ntheorem H3_ndesign:\n  \"H3(p \\<turnstile>\\<^sub>n Q) = (p \\<turnstile>\\<^sub>n Q)\"\n  by (simp add: H3_def ndesign_def unrest_pre_out\\<alpha>)\n\ntheorem H1_H3_is_design:\n  assumes \"P is H1\" \"P is H3\"\n  shows \"P = (\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t\"\n  by (metis H1_H2_eq_design H2_H3_absorb Healthy_def' assms(1) assms(2))\n\ntheorem H1_H3_is_rdesign:\n  assumes \"P is H1\" \"P is H3\"\n  shows \"P = pre\\<^sub>D(P) \\<turnstile>\\<^sub>r post\\<^sub>D(P)\"\n  by (metis H1_H2_is_rdesign H2_H3_absorb Healthy_def' assms)\n\ntheorem H1_H3_is_normal_design:\n  assumes \"P is H1\" \"P is H3\"\n  shows \"P = \\<lfloor>pre\\<^sub>D(P)\\<rfloor>\\<^sub>< \\<turnstile>\\<^sub>n post\\<^sub>D(P)\"\n  by (metis H1_H3_is_rdesign assms drop_pre_inv ndesign_def precond_equiv rdesign_H3_iff_pre)\n\nabbreviation \"H1_H3 p \\<equiv> H1 (H3 p)\"\n\nnotation H1_H3 (\"\\<^bold>N\")\n\nlemma H1_H3_comp: \"H1_H3 = H1 \\<circ> H3\"\n  by (auto)\n\nlemma H1_H3_idempotent: \"\\<^bold>N (\\<^bold>N P) = \\<^bold>N P\"\n  by (simp add: H1_H3_commute H1_idem H3_idem)\n\nlemma H1_H3_Idempotent: \"Idempotent \\<^bold>N\"\n  by (simp add: Idempotent_def H1_H3_idempotent)\n\nlemma H1_H3_monotonic: \"Monotonic \\<^bold>N\"\n  by (simp add: H1_monotone H3_mono Monotonic_def)\n\nlemma H1_H3_Continuous: \"Continuous \\<^bold>N\"\n  by (simp add: Continuous_comp H1_Continuous H1_H3_comp H3_Continuous)\n\nlemma H1_H3_impl_H2: \"P is H1_H3 \\<Longrightarrow> P is H1_H2\"\n  by (metis H1_H2_commute H1_idem H2_H3_absorb Healthy_def')\n\nlemma H1_H3_eq_design_d_comp: \"H1 (H3 P) = ((\\<not> P\\<^sup>f) \\<turnstile> P\\<^sup>t ;; II\\<^sub>D)\"\n  by (metis H1_H2_eq_design H1_H3_commute H3_H2_absorb H3_def)\n\nlemma H1_H3_eq_design: \"H1 (H3 P) = (\\<not> (P\\<^sup>f ;; true)) \\<turnstile> P\\<^sup>t\"\n  apply (simp add: H1_H3_eq_design_d_comp skip_d_alt_def)\n  apply (subst design_composition_subst)\n  apply (simp_all add: usubst unrest)\n  apply (rel_auto)\ndone\n\nlemma H3_unrest_out_alpha_nok [unrest]:\n  assumes \"P is H1_H3\"\n  shows \"out\\<alpha> \\<sharp> P\\<^sup>f\"\nproof -\n  have \"P = (\\<not> (P\\<^sup>f ;; true)) \\<turnstile> P\\<^sup>t\"\n    by (metis H1_H3_eq_design Healthy_def assms)\n  also have \"out\\<alpha> \\<sharp> (...\\<^sup>f)\"\n    by (simp add: design_def usubst unrest, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma H3_unrest_out_alpha [unrest]: \"P is H1_H3 \\<Longrightarrow> out\\<alpha> \\<sharp> pre\\<^sub>D(P)\"\n  by (metis H1_H3_commute H1_H3_is_rdesign H1_idem Healthy_def' precond_equiv rdesign_H3_iff_pre)\n\nlemma ndesign_H1_H3 [closure]: \"p \\<turnstile>\\<^sub>n Q is \\<^bold>N\"\n  by (simp add: H1_rdesign H3_def Healthy_def' ndesign_def unrest_pre_out\\<alpha>)\n\nlemma des_bot_H1_H3 [closure]: \"\\<bottom>\\<^sub>D is \\<^bold>N\"\n  by (metis H1_design H3_def Healthy_def' design_false_pre design_true_left_zero skip_d_alt_def)\n\nlemma assigns_d_H1_H3 [closure]: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D is \\<^bold>N\"\n  by (metis H1_rdesign H3_ndesign Healthy_def' aext_true assigns_d_def ndesign_def)\n\nlemma seq_r_H1_H3_closed [closure]:\n  assumes \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n  shows \"(P ;; Q) is \\<^bold>N\"\n  by (metis (no_types) H1_H2_eq_design H1_H3_eq_design_d_comp H1_H3_impl_H2 Healthy_def assms(1) assms(2) seq_r_H1_H2_closed seqr_assoc)\n\nlemma wp_assigns_d [wp]: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D wp\\<^sub>D r = \\<sigma> \\<dagger> r\"\n  by (rel_auto)\n\ntheorem wpd_seq_r_H1_H3 [wp]:\n  fixes P Q :: \"'\\<alpha> hrel_des\"\n  assumes \"P is \\<^bold>N\" \"Q is \\<^bold>N\"\n  shows \"(P ;; Q) wp\\<^sub>D r = P wp\\<^sub>D (Q wp\\<^sub>D r)\"\n  by (metis H1_H3_commute H1_H3_is_normal_design H1_idem Healthy_def' assms(1) assms(2) wpnd_seq_r)\n\ntext {* If two normal designs have the same weakest precondition for any given postcondition, then\n  the two designs are equivalent. *}\n\ntheorem wpd_eq_intro: \"\\<lbrakk> \\<And> r. (p\\<^sub>1 \\<turnstile>\\<^sub>n Q\\<^sub>1) wp\\<^sub>D r = (p\\<^sub>2 \\<turnstile>\\<^sub>n Q\\<^sub>2) wp\\<^sub>D r \\<rbrakk> \\<Longrightarrow> (p\\<^sub>1 \\<turnstile>\\<^sub>n Q\\<^sub>1) = (p\\<^sub>2 \\<turnstile>\\<^sub>n Q\\<^sub>2)\"\napply (rel_simp robust; metis curry_conv)\ndone\n\ntheorem wpd_H3_eq_intro: \"\\<lbrakk> P is H1_H3; Q is H1_H3; \\<And> r. P wp\\<^sub>D r = Q wp\\<^sub>D r \\<rbrakk> \\<Longrightarrow> P = Q\"\n  by (metis H1_H3_commute H1_H3_is_normal_design H3_idem Healthy_def' wpd_eq_intro)\n\nsubsection {* H4: Feasibility *}\n\ntheorem H4_idem:\n  \"H4(H4(P)) = H4(P)\"\n  by (pred_auto)\n\nlemma is_H4_alt_def:\n  \"P is H4 \\<longleftrightarrow> (P ;; true) = true\"\n  by (rel_auto)\n\nlemma H4_assigns_d: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>D is H4\"\nproof -\n  have \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>D ;; (false \\<turnstile>\\<^sub>r true\\<^sub>h)) = (false \\<turnstile>\\<^sub>r true)\"\n    by (simp add: assigns_d_def rdesign_composition assigns_r_feasible)\n  moreover have \"... = true\"\n    by (rel_auto)\n  ultimately show ?thesis\n    using is_H4_alt_def by auto\nqed\n\nsubsection {* UTP theories *}\n\ntypedecl DES\ntypedecl NDES\n\nabbreviation \"DES \\<equiv> UTHY(DES, '\\<alpha> des)\"\nabbreviation \"NDES \\<equiv> UTHY(NDES, '\\<alpha> des)\"\n\noverloading\n  des_hcond == \"utp_hcond :: (DES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\"\n  des_unit == \"utp_unit :: (DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" (unchecked)\n\n  ndes_hcond == \"utp_hcond :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\"\n  ndes_unit == \"utp_unit :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" (unchecked)\n\nbegin\n  definition des_hcond :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\" where\n  [upred_defs]: \"des_hcond t = H1_H2\"\n\n  definition des_unit :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"des_unit t = II\\<^sub>D\"\n\n  definition ndes_hcond :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> ('\\<alpha> des \\<times> '\\<alpha> des) health\" where\n  [upred_defs]: \"ndes_hcond t = H1_H3\"\n\n  definition ndes_unit :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"ndes_unit t = II\\<^sub>D\"\n\nend\n\ninterpretation des_utp_theory: utp_theory DES\n  by (simp add: H1_H2_commute H1_idem H2_idem des_hcond_def utp_theory_def)\n\ninterpretation ndes_utp_theory: utp_theory NDES\n  by (simp add: H1_H3_commute H1_idem H3_idem ndes_hcond_def utp_theory.intro)\n\ninterpretation des_left_unital: utp_theory_left_unital DES\n  apply (unfold_locales)\n  apply (simp_all add: des_hcond_def des_unit_def)\n  using seq_r_H1_H2_closed apply blast\n  apply (simp add: rdesign_is_H1_H2 skip_d_def)\n  apply (metis H1_idem H1_left_unit Healthy_def')\ndone\n\ninterpretation ndes_unital: utp_theory_unital NDES\n  apply (unfold_locales, simp_all add: ndes_hcond_def ndes_unit_def)\n  using seq_r_H1_H3_closed apply blast\n  apply (metis H1_rdesign H3_def Healthy_def' design_skip_idem skip_d_def)\n  apply (metis H1_idem H1_left_unit Healthy_def')\n  apply (metis H1_H3_commute H3_def H3_idem Healthy_def')\ndone\n\ninterpretation design_theory_continuous: utp_theory_continuous DES\n  rewrites \"\\<And> P. P \\<in> carrier (uthy_order DES) \\<longleftrightarrow> P is \\<^bold>H\"\n  and \"carrier (uthy_order DES) \\<rightarrow> carrier (uthy_order DES) \\<equiv> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n  and \"le (uthy_order DES) = op \\<sqsubseteq>\"\n  and \"eq (uthy_order DES) = op =\"\n  by (unfold_locales, simp_all add: des_hcond_def H1_H2_Continuous utp_order_def)\n\ninterpretation normal_design_theory_mono: utp_theory_continuous NDES\n  rewrites \"\\<And> P. P \\<in> carrier (uthy_order NDES) \\<longleftrightarrow> P is \\<^bold>N\"\n  and \"carrier (uthy_order NDES) \\<rightarrow> carrier (uthy_order NDES) \\<equiv> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>N\\<rbrakk>\\<^sub>H\"\n  and \"le (uthy_order NDES) = op \\<sqsubseteq>\"\n  and \"eq (uthy_order NDES) = op =\"\n  by (unfold_locales, simp_all add: ndes_hcond_def H1_H3_Continuous utp_order_def)\n\nlemma design_lat_top: \"\\<^bold>\\<top>\\<^bsub>DES\\<^esub> = \\<^bold>H(false)\"\n  by (simp add: design_theory_continuous.healthy_top, simp add: des_hcond_def)\n\nlemma design_lat_bottom: \"\\<^bold>\\<bottom>\\<^bsub>DES\\<^esub> = \\<^bold>H(true)\"\n  by (simp add: design_theory_continuous.healthy_bottom, simp add: des_hcond_def)\n\nabbreviation design_lfp :: \"('\\<alpha> hrel_des \\<Rightarrow> '\\<alpha> hrel_des) \\<Rightarrow> '\\<alpha> hrel_des\" (\"\\<mu>\\<^sub>D\") where\n\"\\<mu>\\<^sub>D F \\<equiv> \\<mu>\\<^bsub>uthy_order DES\\<^esub> F\"\n\nabbreviation design_gfp :: \"('\\<alpha> hrel_des \\<Rightarrow> '\\<alpha> hrel_des) \\<Rightarrow> '\\<alpha> hrel_des\" (\"\\<nu>\\<^sub>D\") where\n\"\\<nu>\\<^sub>D F \\<equiv> \\<nu>\\<^bsub>uthy_order DES\\<^esub> F\"\n\nthm design_theory_continuous.GFP_unfold\nthm design_theory_continuous.LFP_unfold\n\ntext {* We also set up local variables for designs. *}\n\noverloading\n  des_pvar == \"pvar :: (DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\"\n  des_assigns == \"pvar_assigns :: (DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\"\n  ndes_pvar == \"pvar :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\"\n  ndes_assigns == \"pvar_assigns :: (NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\"\nbegin\n  definition des_pvar :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\" where\n  [upred_defs]: \"des_pvar T = \\<Sigma>\\<^sub>D\"\n  definition des_assigns :: \"(DES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"des_assigns T \\<sigma> = \\<langle>\\<sigma>\\<rangle>\\<^sub>D\"\n  definition ndes_pvar :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> \\<Longrightarrow> '\\<alpha> des\" where\n  [upred_defs]: \"ndes_pvar T = \\<Sigma>\\<^sub>D\"\n  definition ndes_assigns :: \"(NDES, '\\<alpha> des) uthy \\<Rightarrow> '\\<alpha> usubst \\<Rightarrow> '\\<alpha> hrel_des\" where\n  [upred_defs]: \"ndes_assigns T \\<sigma> = \\<langle>\\<sigma>\\<rangle>\\<^sub>D\"\n\nend\n\ninterpretation des_prog_var: utp_prog_var \"UTHY(DES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>DES\\<^esub> = \\<^bold>H\"\n  apply (unfold_locales, simp_all add: des_pvar_def des_assigns_def des_hcond_def)\n  apply (simp add: assigns_d_def rdesign_is_H1_H2)\n  apply (simp add: assigns_d_comp_ext assigns_d_is_H1_H2)\n  apply (rel_auto)\ndone\n\ninterpretation ndes_prog_var: utp_prog_var \"UTHY(NDES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>NDES\\<^esub> = \\<^bold>N\"\n  apply (unfold_locales, simp_all add: ndes_pvar_def ndes_assigns_def ndes_hcond_def)\n  apply (simp add: assigns_d_H1_H3)\n  apply (rel_auto)\ndone\n\ninterpretation des_local_var: utp_local_var \"UTHY(DES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>DES\\<^esub> = \\<^bold>H\"\n  by (unfold_locales, simp_all add: des_unit_def des_assigns_def des_hcond_def)\n\ninterpretation ndes_local_var: utp_local_var \"UTHY(NDES, '\\<alpha> des)\" \"TYPE('\\<alpha>)\"\n  rewrites \"\\<H>\\<^bsub>NDES\\<^esub> = \\<^bold>N\"\n  by (unfold_locales, simp_all add: ndes_unit_def ndes_assigns_def ndes_hcond_def)\n\ntext {* Weakest precondition laws for design variable scopes *}\n\nlemma wpd_var_begin [wp]:\n  fixes x :: \"'a list \\<Longrightarrow> '\\<alpha>\" and r :: \"'\\<alpha> upred\"\n  shows \"(var_begin NDES x) wp\\<^sub>D r = r\\<lbrakk>\\<langle>\\<guillemotleft>undefined\\<guillemotright>\\<rangle> ^\\<^sub>u &x/x\\<rbrakk>\"\n  by (simp add: var_begin_def ndes_assigns_def wp)\n\nlemma wpd_var_end [wp]:\n  fixes x :: \"'a list \\<Longrightarrow> '\\<alpha>\" and r :: \"'\\<alpha> upred\"\n  shows \"(var_end NDES x) wp\\<^sub>D r = r\\<lbrakk>tail\\<^sub>u(&x)/x\\<rbrakk>\"\n  by (simp add: var_end_def ndes_assigns_def wp)\n\ntext {* Example Galois connection between designs and relations. Based on Jim's example in COMPASS\n        deliverable D23.5. *}\n\ndefinition [upred_defs]: \"Des(R) = \\<^bold>H(\\<lceil>R\\<rceil>\\<^sub>D \\<and> $ok\\<acute>)\"\ndefinition [upred_defs]: \"Rel(D) = \\<lfloor>D\\<lbrakk>true,true/$ok,$ok\\<acute>\\<rbrakk>\\<rfloor>\\<^sub>D\"\n\nlemma Des_design: \"Des(R) = true \\<turnstile>\\<^sub>r R\"\n  by (rel_auto)\n\nlemma Rel_design: \"Rel(P \\<turnstile>\\<^sub>r Q) = (P \\<Rightarrow> Q)\"\n  by (rel_auto)\n\ninterpretation Des_Rel_coretract:\n  coretract \"DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\"\n  rewrites\n    \"\\<And> x. x \\<in> carrier \\<X>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = (x is \\<^bold>H)\" and\n    \"\\<And> x. x \\<in> carrier \\<Y>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = True\" and\n    \"\\<pi>\\<^sub>*\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = Des\" and\n    \"\\<pi>\\<^sup>*\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = Rel\" and\n    \"le \\<X>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = op \\<sqsubseteq>\" and\n    \"le \\<Y>\\<^bsub>DES \\<leftarrow>\\<langle>Des,Rel\\<rangle>\\<rightarrow> REL\\<^esub> = op \\<sqsubseteq>\"\nproof (unfold_locales, simp_all add: rel_hcond_def des_hcond_def)\n  show \"\\<And>x. x is id\"\n    by (simp add: Healthy_def)\nnext\n  show \"Rel \\<in> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>id\\<rbrakk>\\<^sub>H\"\n    by (auto simp add: Rel_def rel_hcond_def Healthy_def)\nnext\n  show \"Des \\<in> \\<lbrakk>id\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>\\<^bold>H\\<rbrakk>\\<^sub>H\"\n    by (auto simp add: Des_def des_hcond_def Healthy_def H1_H2_commute H1_idem H2_idem)\nnext\n  fix R :: \"'a hrel\"\n  show \"R \\<sqsubseteq> Rel (Des R)\"\n    by (simp add: Des_design Rel_design)\nnext\n  fix R :: \"'a hrel\" and D :: \"'a hrel_des\"\n  assume a: \"D is \\<^bold>H\"\n  then obtain D\\<^sub>1 D\\<^sub>2 where D: \"D = D\\<^sub>1 \\<turnstile>\\<^sub>r D\\<^sub>2\"\n    by (metis H1_H2_commute H1_H2_is_rdesign H1_idem Healthy_def')\n  show \"(Rel D \\<sqsubseteq> R) = (D \\<sqsubseteq> Des R)\"\n  proof -\n    have \"(D \\<sqsubseteq> Des R) = (D\\<^sub>1 \\<turnstile>\\<^sub>r D\\<^sub>2 \\<sqsubseteq> true \\<turnstile>\\<^sub>r R)\"\n      by (simp add: D Des_design)\n    also have \"... = `D\\<^sub>1 \\<and> R \\<Rightarrow> D\\<^sub>2`\"\n      by (simp add: rdesign_refinement)\n    also have \"... = ((D\\<^sub>1 \\<Rightarrow> D\\<^sub>2) \\<sqsubseteq> R)\"\n      by (rel_auto)\n    also have \"... = (Rel D \\<sqsubseteq> R)\"\n      by (simp add: D Rel_design)\n    finally show ?thesis ..\n  qed\nqed\n\ntext {* From this interpretation we gain many Galois theorems. Some require simplification to\n        remove superfluous assumptions. *}\n\nthm Des_Rel_coretract.deflation[simplified]\nthm Des_Rel_coretract.inflation\nthm Des_Rel_coretract.upper_comp[simplified]\nthm Des_Rel_coretract.lower_comp\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/theories/utp_designs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.31021375855086397}}
{"text": "(*  Title:      HOL/IOA/Solve.thy\n    Author:     Tobias Nipkow & Konrad Slind\n    Copyright   1994  TU Muenchen\n*)\n\nsection \\<open>Weak possibilities mapping (abstraction)\\<close>\n\ntheory Solve\nimports IOA\nbegin\n\ndefinition is_weak_pmap :: \"['c => 'a, ('action,'c)ioa,('action,'a)ioa] => bool\" where\n  \"is_weak_pmap f C A ==\n   (!s:starts_of(C). f(s):starts_of(A)) &\n   (!s t a. reachable C s &\n            (s,a,t):trans_of(C)\n            --> (if a:externals(asig_of(C)) then\n                   (f(s),a,f(t)):trans_of(A)\n                 else f(s)=f(t)))\"\n\ndeclare mk_trace_thm [simp] trans_in_actions [simp]\n\nlemma trace_inclusion: \n  \"[| IOA(C); IOA(A); externals(asig_of(C)) = externals(asig_of(A));  \n           is_weak_pmap f C A |] ==> traces(C) <= traces(A)\"\n  apply (unfold is_weak_pmap_def traces_def)\n\n  apply (simp (no_asm) add: has_trace_def)\n  apply safe\n  apply (rename_tac ex1 ex2)\n\n  (* choose same trace, therefore same NF *)\n  apply (rule_tac x = \"mk_trace C ex1\" in exI)\n  apply simp\n\n  (* give execution of abstract automata *)\n  apply (rule_tac x = \"(mk_trace A ex1,%i. f (ex2 i))\" in bexI)\n\n  (* Traces coincide *)\n   apply (simp (no_asm_simp) add: mk_trace_def filter_oseq_idemp)\n\n  (* Use lemma *)\n  apply (frule states_of_exec_reachable)\n\n  (* Now show that it's an execution *)\n  apply (simp add: executions_def)\n  apply safe\n\n  (* Start states map to start states *)\n  apply (drule bspec)\n  apply assumption\n\n  (* Show that it's an execution fragment *)\n  apply (simp add: is_execution_fragment_def)\n  apply safe\n\n  apply (erule_tac x = \"ex2 n\" in allE)\n  apply (erule_tac x = \"ex2 (Suc n)\" in allE)\n  apply (erule_tac x = a in allE)\n  apply simp\n  done\n\n(* Lemmata *)\n\nlemma imp_conj_lemma: \"(P ==> Q-->R) ==> P&Q --> R\"\n  by blast\n\n\n(* fist_order_tautology of externals_of_par *)\nlemma externals_of_par_extra:\n  \"a:externals(asig_of(A1||A2)) =     \n   (a:externals(asig_of(A1)) & a:externals(asig_of(A2)) |   \n   a:externals(asig_of(A1)) & a~:externals(asig_of(A2)) |   \n   a~:externals(asig_of(A1)) & a:externals(asig_of(A2)))\"\n  apply (auto simp add: externals_def asig_of_par asig_comp_def asig_inputs_def asig_outputs_def)\n  done\n\nlemma comp1_reachable: \"[| reachable (C1||C2) s |] ==> reachable C1 (fst s)\"\n  apply (simp add: reachable_def)\n  apply (erule bexE)\n  apply (rule_tac x =\n    \"(filter_oseq (%a. a:actions (asig_of (C1))) (fst ex) , %i. fst (snd ex i))\" in bexI)\n(* fst(s) is in projected execution *)\n  apply force\n(* projected execution is indeed an execution *)\n  apply (simp cong del: if_weak_cong\n    add: executions_def is_execution_fragment_def par_def starts_of_def\n      trans_of_def filter_oseq_def\n    split: option.split)\n  done\n\n\n(* Exact copy of proof of comp1_reachable for the second\n   component of a parallel composition.     *)\nlemma comp2_reachable: \"[| reachable (C1||C2) s|] ==> reachable C2 (snd s)\"\n  apply (simp add: reachable_def)\n  apply (erule bexE)\n  apply (rule_tac x =\n    \"(filter_oseq (%a. a:actions (asig_of (C2))) (fst ex) , %i. snd (snd ex i))\" in bexI)\n(* fst(s) is in projected execution *)\n  apply force\n(* projected execution is indeed an execution *)\n  apply (simp cong del: if_weak_cong\n    add: executions_def is_execution_fragment_def par_def starts_of_def\n    trans_of_def filter_oseq_def\n    split: option.split)\n  done\n\ndeclare if_split [split del] if_weak_cong [cong del]\n\n(*Composition of possibility-mappings *)\nlemma fxg_is_weak_pmap_of_product_IOA: \n     \"[| is_weak_pmap f C1 A1;  \n         externals(asig_of(A1))=externals(asig_of(C1)); \n         is_weak_pmap g C2 A2;   \n         externals(asig_of(A2))=externals(asig_of(C2));  \n         compat_ioas C1 C2; compat_ioas A1 A2  |]      \n   ==> is_weak_pmap (%p.(f(fst(p)),g(snd(p)))) (C1||C2) (A1||A2)\"\n  apply (unfold is_weak_pmap_def)\n  apply (rule conjI)\n(* start_states *)\n  apply (simp add: par_def starts_of_def)\n(* transitions *)\n  apply (rule allI)+\n  apply (rule imp_conj_lemma)\n  apply (simp (no_asm) add: externals_of_par_extra)\n  apply (simp (no_asm) add: par_def)\n  apply (simp add: trans_of_def)\n  apply (simplesubst if_split)\n  apply (rule conjI)\n  apply (rule impI)\n  apply (erule disjE)\n(* case 1      a:e(A1) | a:e(A2) *)\n  apply (simp add: comp1_reachable comp2_reachable ext_is_act)\n  apply (erule disjE)\n(* case 2      a:e(A1) | a~:e(A2) *)\n  apply (simp add: comp1_reachable comp2_reachable ext_is_act ext1_ext2_is_not_act2)\n(* case 3      a:~e(A1) | a:e(A2) *)\n  apply (simp add: comp1_reachable comp2_reachable ext_is_act ext1_ext2_is_not_act1)\n(* case 4      a:~e(A1) | a~:e(A2) *)\n  apply (rule impI)\n  apply (subgoal_tac \"a~:externals (asig_of (A1)) & a~:externals (asig_of (A2))\")\n(* delete auxiliary subgoal *)\n  prefer 2\n  apply force\n  apply (simp (no_asm) add: conj_disj_distribR cong add: conj_cong split: if_split)\n  apply (tactic \\<open>\n    REPEAT((resolve_tac @{context} [conjI, impI] 1 ORELSE eresolve_tac @{context} [conjE] 1) THEN\n      asm_full_simp_tac(@{context} addsimps [@{thm comp1_reachable}, @{thm comp2_reachable}]) 1)\\<close>)\n  done\n\n\nlemma reachable_rename_ioa: \"[| reachable (rename C g) s |] ==> reachable C s\"\n  apply (simp add: reachable_def)\n  apply (erule bexE)\n  apply (rule_tac x = \"((%i. case (fst ex i) of None => None | Some (x) => g x) ,snd ex)\" in bexI)\n  apply (simp (no_asm))\n(* execution is indeed an execution of C *)\n  apply (simp add: executions_def is_execution_fragment_def par_def\n    starts_of_def trans_of_def rename_def split: option.split)\n  apply force\n  done\n\n\nlemma rename_through_pmap: \"[| is_weak_pmap f C A |] \n                       ==> (is_weak_pmap f (rename C g) (rename A g))\"\n  apply (simp add: is_weak_pmap_def)\n  apply (rule conjI)\n  apply (simp add: rename_def starts_of_def)\n  apply (rule allI)+\n  apply (rule imp_conj_lemma)\n  apply (simp (no_asm) add: rename_def)\n  apply (simp add: externals_def asig_inputs_def asig_outputs_def asig_of_def trans_of_def)\n  apply safe\n  apply (simplesubst if_split)\n  apply (rule conjI)\n  apply (rule impI)\n  apply (erule disjE)\n  apply (erule exE)\n  apply (erule conjE)\n(* x is input *)\n  apply (drule sym)\n  apply (drule sym)\n  apply simp\n  apply hypsubst+\n  apply (cut_tac C = \"C\" and g = \"g\" and s = \"s\" in reachable_rename_ioa)\n  apply assumption\n  apply simp\n(* x is output *)\n  apply (erule exE)\n  apply (erule conjE)\n  apply (drule sym)\n  apply (drule sym)\n  apply simp\n  apply hypsubst+\n  apply (cut_tac C = \"C\" and g = \"g\" and s = \"s\" in reachable_rename_ioa)\n  apply assumption\n  apply simp\n(* x is internal *)\n  apply (simp (no_asm) cong add: conj_cong)\n  apply (rule impI)\n  apply (erule conjE)\n  apply (cut_tac C = \"C\" and g = \"g\" and s = \"s\" in reachable_rename_ioa)\n  apply auto\n  done\n\ndeclare if_split [split] if_weak_cong [cong]\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/IOA/Solve.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5926665999540697, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3102137585508639}}
{"text": "section \\<open>Two approaches that failed \\label{sec:two-approaches-that}\\<close>\n\n(*<*) theory Failure imports RealRandVar begin (*>*)\n\ntext\\<open>\nDefining Lebesgue integration can be quite involved, judging by the\nprocess in \\ref{sec:stepwise-approach} that imitates Bauer's way\n\\cite{Bauer}.  So it is quite tempting to try cutting a corner. The\nfollowing two alternative approaches back up my experience that this\nalmost never pays in formalization. The theory that seems most complex\nat first sight is often the one that is closest to formal reasoning\nand deliberately avoids ``hand-waving''.\n\\<close>\n\nsubsection \\<open>A closed expression \\label{sec:closed-expression}\\<close>\n\ntext \\<open>\n  In contrast, Billingsley's definition \\cite[p.~172]{Billingsley86} is\n  strikingly short. For nonnegative measurable functions $f$:\n\n  \\begin{quote}\n  \n  $\\int f d\\mu = \\mathit{sup} \\sum_i \\big[ \\mathit{inf}_{\\omega \\in A_i} f(w) \\big] \\mu(A_i).$\n  \n  The supremum here extends over all finite decompositions $\\{A_i\\}$ of\n  $\\Omega$ into $\\mathcal{F}$-sets.\\footnote{The $\\mathcal{F}$-sets are just the measurable sets of a measure\n  space.}\n\n  \\end{quote}\n  \n  Like the definition, the proofs of the essential properties are also\n  rather\n  short, about three pages in the textbook for almost all the theorems\n  in \\ref{sec:stepwise-approach}; and a proof of uniqueness is obsolete\n  for a closed expression like this. Therefore, I found this approach\n  quite tempting. It turns out, however, that it is unfortunately not\n  well suited for formalization, at least with the background we use.\n  \n  A complication shared by all possible styles of definition is the lack\n  of infinite values in our theory, combined with the lack of partial\n  functions in HOL. Like the sum operator in\n  \\ref{sec:measure-spaces}, the integral has to be defined\n  indirectly. The classical way to do this employs predicates, invoking \\<open>\\<epsilon>\\<close>\n  to choose the value that satisfies the condition:\n\n  \\<open>\\<integral> f dM \\<equiv> (\\<epsilon> i. is_integral M f i)\\<close>\n\n  To sensibly apply this principle, the predicate has to be \\<open>\\<epsilon>\\<close>-free to supply the information if the integral is\n  defined or not. Now the above definition contains up to three additional\n  \\<open>\\<epsilon>\\<close> when formalized naively in HOL, namely in the supremum,\n  infimum and sum operators. The sum is over a finite set, so it can\n  be replaced by a total function. For nonnegative functions, the\n  infimum can also be shown to exist everywhere, but, like the\n  supremum,  must\n  itself be replaced by a predicate. \n\n  Also note that predicates require a proof of uniqueness, thus losing\n  the prime advantage of a closed formula anyway. In this case,\n  uniqueness can be reduced to uniqueness of the supremum/infimum. The\n  problem is that neither suprema nor infima come predefined in\n  Isabelle/Isar as of yet. It is an easy task to make up for this ---\n  and I did --- but a much harder one to establish all the properties\n  needed for reasoning with the defined entities.\n\n  A lot of such reasoning is necessary to deduce from the above definition\n  (or a formal version of it, as just outlined) the basic behavior of\n  integration, which includes additivity, monotonicity and especially the\n  integral of simple functions. It turns out that the brevity of the\n  proofs in the textbook stems from a severely informal style that\n  assumes ample background knowledge. Formalizing all this knowledge\n  started to become overwhelming when the idea of a contrarian approach\n  emerged.\n\\<close>\n\nsubsection \\<open>A one-step inductive definition \\label{sec:one-step}\\<close>\n\ntext \\<open>\n  This idea was sparked by the following note: ``(\\ldots) the integral\n  is uniquely determined by certain simple properties it is natural to\n  require of it'' \\cite[p.~175]{Billingsley86}. Billingsley goes on\n  discussing exactly those properties that are so hard to derive\n  from his definition. So why not simply define integration using\n  these properties? That is the gist of an inductive set definition, like\n  the one we have seen in \\ref{sec:sigma}. This time a functional operator is\n  to be defined, but it can be represented as a set of pairs, where\n  the first component is the function and the second its integral.\n  To cut a long story short, here is the definition.\\<close>\n\ninductive_set\n  integral_set:: \"('a set set * ('a set \\<Rightarrow> real)) \\<Rightarrow> (('a \\<Rightarrow> real) * real) set\"\n  for M :: \"'a set set * ('a set \\<Rightarrow> real)\"\n  where\n    char: \"\\<lbrakk>f = \\<chi> A; A \\<in> measurable_sets M\\<rbrakk> \\<Longrightarrow> (f,measure M A) \\<in> integral_set M\"\n  | add: \"\\<lbrakk>f = (\\<lambda>w. g w + h w); (g,x) \\<in> integral_set M; (h,y) \\<in> integral_set M\\<rbrakk> \n    \\<Longrightarrow> (f,(x + y)) \\<in> integral_set M\"\n  | times: \"\\<lbrakk>f = (\\<lambda>w. a*g w); (g,x) \\<in> integral_set M\\<rbrakk> \\<Longrightarrow> (f,a*x) \\<in> integral_set M\"\n  | mon_conv: \"\\<lbrakk>u\\<up>f; \\<And>n. (u n, x n) \\<in> integral_set M; x\\<up>y\\<rbrakk> \n    \\<Longrightarrow> (f,y) \\<in> integral_set M\"\n\n  text \\<open>The technique is also encountered in the \\<open>Finite_Set\\<close> theory from the Isabelle library. It is used there\n    to define the \\<open>sum\\<close> function, which calculates a sum\n    indexed over a finite set and is employed in\n    \\ref{sec:stepwise-approach}. The definition here is much more\n    intricate though. \n\n    An obvious advantage of this approach is that almost all\n    important properties are gained without effort. The\n    introduction rule \\<open>mon_conv\\<close> corresponds to what is known as\n    the Monotone Convergence Theorem in scientific literature; negative functions are also provided for via\n    the \\<open>times\\<close> rule. \n    To be precise,\n    there is exactly one important theorem missing ---\n    uniqueness. That is, every function appears in at most one pair. \n    \n    From uniqueness together with the introduction rules, all the\n    other statements about integration, monotonicity for example,\n    could be derived. On the other hand, monotonicity implies\n    uniqueness. Much to my regret, none of these two could be proven.\n    The proof would basically amount to a double induction to show\n    that an integral gained via one rule is the same when derived by\n    another. A lot of effort was spent trying to strengthen the\n    induction hypothesis or reduce the goal to a simpler case. All of\n    this was in vain though, and it seems that the hypothesis would\n    have to be strengthened as far as to include the concept of\n    integration in the first place, which in a way defeats the\n    advantages of the approach.\\<close>\n    \n\n  (*<*)end  (*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Integration/Failure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5926665999540697, "lm_q1q2_score": 0.3102137585508639}}
{"text": "theory Reordering_Quantifiers\n  imports Main \"HOL-Eisbach.Eisbach\"\nbegin\n\n(* Printing util *)\nML \\<open>\n  fun pretty_cterm ctxt ctm = Syntax.pretty_term ctxt (Thm.term_of ctm)\n  val string_of_cterm = Pretty.string_of oo pretty_cterm\n  val string_of_term = Pretty.string_of oo Syntax.pretty_term\n\\<close>\n\nML_val \\<open>tracing (Syntax.string_of_term @{context} @{term \"a < b\"})\\<close>\n\nML_val \\<open>tracing (ML_Syntax.print_term @{term \"a < b\"})\\<close>\n\nML \\<open>\n  fun strip_prop (Const (@{const_name HOL.Trueprop}, _) $ t) = t\n    | strip_prop t = t\n\\<close>\n\ndeclare [[ML_print_depth = 50]]\n\nML \\<open>\n  signature QUANTIFIER1_DATA =\nsig\n  (*functionality*)\n  (*terms to be moved around*)\n  (*arguments: preceding quantifies, term under question, preceding terms*)\n  val move: (term * string * typ) list -> term -> term list -> bool\n  (*always move? if false then moves appear if a non-mover was encountered before*)\n  val force_move: bool\n  (*rotate quantifiers after moving*)\n  val rotate: bool\n  (*abstract syntax*)\n  val dest_eq: term -> (term * term) option\n  val dest_conj: term -> (term * term) option\n  val dest_imp: term -> (term * term) option\n  val conj: term\n  val imp: term\n  (*rules*)\n  val iff_reflection: thm (* P <-> Q ==> P == Q *)\n  val iffI: thm\n  val iff_trans: thm\n  val conjI: thm\n  val conjE: thm\n  val impI: thm\n  val mp: thm\n  val exI: thm\n  val exE: thm\n  val uncurry: thm (* P --> Q --> R ==> P & Q --> R *)\n  val iff_allI: thm (* !!x. P x <-> Q x ==> (!x. P x) = (!x. Q x) *)\n  val iff_exI: thm (* !!x. P x <-> Q x ==> (? x. P x) = (? x. Q x) *)\n  val all_comm: thm (* (!x y. P x y) = (!y x. P x y) *)\n  val ex_comm: thm (* (? x y. P x y) = (? y x. P x y) *)\nend;\n\nsignature QUANTIFIER1 =\nsig\n  val prove_one_point_all_tac: Proof.context -> tactic\n  val prove_one_point_ex_tac: Proof.context -> tactic\n  val rearrange_all: Proof.context -> cterm -> thm option\n  (* XXX Need to export this ?*)\n  val rearrange_ex': Proof.context -> term -> thm option\n  val rearrange_ex: Proof.context -> cterm -> thm option\n  val rotate_ex: Proof.context -> cterm -> thm option\n  val miniscope_ex: Proof.context -> cterm -> thm option\n  val rotate_all: Proof.context -> cterm -> thm option\n  val rearrange_ball: (Proof.context -> tactic) -> Proof.context -> cterm -> thm option\n  val rearrange_bex: (Proof.context -> tactic) -> Proof.context -> cterm -> thm option\n  val rearrange_Collect: (Proof.context -> tactic) -> Proof.context -> cterm -> thm option\nend;\n\nfunctor Quantifier(Data: QUANTIFIER1_DATA): QUANTIFIER1 =\nstruct\n\nfun extract_conj trms fst xs t =\n  (case Data.dest_conj t of\n    NONE => NONE\n  | SOME (P, Q) =>\n      let\n        val mover = Data.move xs P trms\n      in\n        if Data.force_move andalso mover then (if fst then NONE else SOME (xs, P, Q))\n        else if Data.force_move andalso Data.move xs Q (P :: trms) then SOME (xs, Q, P)\n        else if mover andalso not fst then SOME (xs, P, Q)\n        else if\n          not Data.force_move andalso (not mover orelse not fst) andalso Data.move xs Q (P :: trms)\n          then SOME (xs, Q, P)\n        else\n          (case extract_conj trms (if Data.force_move then false else fst) xs P of\n            SOME (xs, eq, P') => SOME (xs, eq, Data.conj $ P' $ Q)\n          | NONE =>\n              (case extract_conj (P :: trms)\n                    (if Data.force_move then false else (fst andalso mover)) xs Q\n               of\n                SOME (xs, eq, Q') => SOME (xs, eq, Data.conj $ P $ Q')\n              | NONE => NONE))\n      end);\n(* XXX This is not regularized with respect to term context *)\nfun extract_imp fst xs t =\n  (case Data.dest_imp t of\n    NONE => NONE\n  | SOME (P, Q) =>\n      if Data.move xs P [] then (if fst then NONE else SOME (xs, P, Q))\n      else\n        (case extract_conj [] false xs P of\n          SOME (xs, eq, P') => SOME (xs, eq, Data.imp $ P' $ Q)\n        | NONE =>\n            (case extract_imp false xs Q of\n              NONE => NONE\n            | SOME (xs, eq, Q') => SOME (xs, eq, Data.imp $ P $ Q'))));\n\nfun extract_quant extract q =\n  let\n    fun exqu xs ((qC as Const (qa, _)) $ Abs (x, T, Q)) =\n          if qa = q then exqu ((qC, x, T) :: xs) Q else NONE\n      | exqu xs P = extract (if Data.force_move then null xs else true) xs P\n  in exqu [] end;\n\nfun prove_conv ctxt tu tac =\n  let\n    val (goal, ctxt') =\n      yield_singleton (Variable.import_terms true) (Logic.mk_equals tu) ctxt;\n    val thm =\n      Goal.prove ctxt' [] [] goal\n        (fn {context = ctxt'', ...} =>\n          resolve_tac ctxt'' [Data.iff_reflection] 1 THEN tac ctxt'');\n  in singleton (Variable.export ctxt' ctxt) thm end;\n\nfun maybe_tac tac = if Data.rotate then tac else K all_tac;\n\nfun qcomm_tac ctxt qcomm qI i =\n  REPEAT_DETERM (maybe_tac (resolve_tac ctxt [qcomm]) i THEN resolve_tac ctxt [qI] i);\n\n(* Proves (? x0..xn. ... & x0 = t & ...) = (? x1..xn x0. x0 = t & ... & ...)\n   Better: instantiate exI\n*)\nlocal\n  val excomm = Data.ex_comm RS Data.iff_trans;\nin\n  fun prove_rotate_ex_tac ctxt i = qcomm_tac ctxt excomm Data.iff_exI i\n  fun prove_one_point_ex_tac ctxt =\n    prove_rotate_ex_tac ctxt 1 THEN resolve_tac ctxt [Data.iffI] 1 THEN\n    ALLGOALS\n      (EVERY' [maybe_tac (eresolve_tac ctxt [Data.exE]),\n        REPEAT_DETERM o eresolve_tac ctxt [Data.conjE],\n        maybe_tac (resolve_tac ctxt [Data.exI]),\n        DEPTH_SOLVE_1 o ares_tac ctxt [Data.conjI]])\nend;\n\n(* Proves (! x0..xn. (... & x0 = t & ...) --> P x0) =\n          (! x1..xn x0. x0 = t --> (... & ...) --> P x0)\n*)\nlocal\n  fun tac ctxt =\n    SELECT_GOAL\n      (EVERY1 [REPEAT o dresolve_tac ctxt [Data.uncurry],\n        REPEAT o resolve_tac ctxt [Data.impI],\n        eresolve_tac ctxt [Data.mp],\n        REPEAT o eresolve_tac ctxt [Data.conjE],\n        REPEAT o ares_tac ctxt [Data.conjI]]);\n  val allcomm = Data.all_comm RS Data.iff_trans;\nin\n  fun prove_one_point_all_tac ctxt =\n    EVERY1 [qcomm_tac ctxt allcomm Data.iff_allI,\n      resolve_tac ctxt [Data.iff_allI],\n      resolve_tac ctxt [Data.iffI], tac ctxt, tac ctxt];\nend\n\n(* Proves (! x0..xn. (... & x0 = t & ...) --> P x0) =\n          (! x1..xn x0. x0 = t --> (... & ...) --> P x0)\n*)\nlocal\n  val allcomm = Data.all_comm RS Data.iff_trans;\nin\n  fun prove_one_point_all_tac2 ctxt =\n    EVERY1 [qcomm_tac ctxt allcomm Data.iff_allI,\n      resolve_tac ctxt [Data.iff_allI],\n      resolve_tac ctxt [Data.iffI], blast_tac ctxt, blast_tac ctxt];\nend\n\nfun renumber l u (Bound i) =\n      Bound (if i < l orelse i > u then i else if i = u then l else i + 1)\n  | renumber l u (s $ t) = renumber l u s $ renumber l u t\n  | renumber l u (Abs (x, T, t)) = Abs (x, T, renumber (l + 1) (u + 1) t)\n  | renumber _ _ atom = atom;\n\nfun quantify qC x T xs P =\n  let\n    fun quant [] P = P\n      | quant ((qC, x, T) :: xs) P = quant xs (qC $ Abs (x, T, P));\n    val n = length xs;\n    val Q = if n = 0 then P else renumber 0 n P;\n  in if Data.rotate then quant xs (qC $ Abs (x, T, Q)) else qC $ Abs (x, T, quant xs P) end;\n\nfun rearrange_all ctxt ct =\n  (case Thm.term_of ct of\n    F as (all as Const (q, _)) $ Abs (x, T, P) =>\n      (case extract_quant extract_imp q P of\n        NONE => NONE\n      | SOME (xs, eq, Q) =>\n          let val R = quantify all x T xs (Data.imp $ eq $ Q)\n          in SOME (prove_conv ctxt (F, R) prove_one_point_all_tac) end)\n  | _ => NONE);\n\nfun rotate_all ctxt ct =\n  let\n    fun extract fst xs P =\n      if fst then NONE else SOME (xs, P, P)\n    in\n  (case strip_prop (Thm.term_of ct) of\n    F as (ex as Const (q, _)) $ Abs (x, T, P) =>\n      (case extract_quant extract q P of\n        NONE => NONE\n      | SOME (xs, _, Q) =>\n          let val R = quantify ex x T xs Q\n          in SOME (prove_conv ctxt (F, R) prove_one_point_all_tac2) end)\n  | _ => NONE) end;\n\nfun rearrange_ball tac ctxt ct =\n  (case Thm.term_of ct of\n    F as Ball $ A $ Abs (x, T, P) =>\n      (case extract_imp true [] P of\n        NONE => NONE\n      | SOME (xs, eq, Q) =>\n          if not (null xs) then NONE\n          else\n            let val R = Data.imp $ eq $ Q\n            in SOME (prove_conv ctxt (F, Ball $ A $ Abs (x, T, R)) tac) end)\n  | _ => NONE);\n\nfun rearrange_ex' ctxt trm =\n  (case strip_prop trm of\n    F as (ex as Const (q, _)) $ Abs (x, T, P) =>\n      (case extract_quant (extract_conj []) q P of\n        NONE => NONE\n      | SOME (xs, eq, Q) =>\n          let val R = quantify ex x T xs (Data.conj $ eq $ Q)\n          in SOME (prove_conv ctxt (F, R) prove_one_point_ex_tac) end)\n  | _ => NONE);\n\nfun rearrange_ex ctxt = rearrange_ex' ctxt o Thm.term_of\n\nfun rotate_ex ctxt ct =\n  let\n    fun extract fst xs P =\n      if fst then NONE else SOME (xs, P, P)\n    in\n  (case strip_prop (Thm.term_of ct) of\n    F as (ex as Const (q, _)) $ Abs (x, T, P) =>\n      (case extract_quant extract q P of\n        NONE => NONE\n      | SOME (xs, _, Q) =>\n          let val R = quantify ex x T xs Q\n          in SOME (prove_conv ctxt (F, R) prove_one_point_ex_tac) end)\n  | _ => NONE) end;\n\nfun miniscope_ex ctxt ct =\n  let\n    fun extract fst xs t =\n      case Data.dest_conj t of\n        SOME (P, _) => if Data.move xs P [] andalso not fst then SOME (xs, t, t) else NONE\n      | NONE => NONE\n    in\n  (case strip_prop (Thm.term_of ct) of\n    F as (ex as Const (q, _)) $ Abs (x, T, P) =>\n      (case extract_quant extract q P of\n        NONE => NONE\n      | SOME (xs, _, Q) =>\n          let val R = quantify ex x T xs Q\n          in SOME (prove_conv ctxt (F, R) prove_one_point_ex_tac) end)\n  | _ => NONE) end;\n\nfun rearrange_bex tac ctxt ct =\n  (case Thm.term_of ct of\n    F as Bex $ A $ Abs (x, T, P) =>\n      (case extract_conj [] true [] P of\n        NONE => NONE\n      | SOME (xs, eq, Q) =>\n          if not (null xs) then NONE\n          else SOME (prove_conv ctxt (F, Bex $ A $ Abs (x, T, Data.conj $ eq $ Q)) tac))\n  | _ => NONE);\n\nfun rearrange_Collect tac ctxt ct =\n  (case Thm.term_of ct of\n    F as Collect $ Abs (x, T, P) =>\n      (case extract_conj [] true [] P of\n        NONE => NONE\n      | SOME (_, eq, Q) =>\n          let val R = Collect $ Abs (x, T, Data.conj $ eq $ Q)\n          in SOME (prove_conv ctxt (F, R) tac) end)\n  | _ => NONE);\n\nend;\n\nstructure Quantifier1 = Quantifier\n(\n  (*abstract syntax*)\n  fun dest_eq (Const(@{const_name HOL.eq},_) $ s $ t) = SOME (s, t)\n    | dest_eq _ = NONE;\n  fun dest_conj (Const(@{const_name HOL.conj},_) $ s $ t) = SOME (s, t)\n    | dest_conj _ = NONE;\n  fun dest_imp (Const(@{const_name HOL.implies},_) $ s $ t) = SOME (s, t)\n    | dest_imp _ = NONE;\n  val conj = HOLogic.conj\n  val imp  = HOLogic.imp\n  fun move xs eq _ =\n  (case dest_eq eq of\n    SOME (s, t) =>\n      let val n = length xs in\n        s = Bound n andalso not (loose_bvar1 (t, n)) orelse\n        t = Bound n andalso not (loose_bvar1 (s, n))\n      end\n  | NONE => false);\n  val force_move = true\n  val rotate = true\n  (*rules*)\n  val iff_reflection = @{thm eq_reflection}\n  val iffI = @{thm iffI}\n  val iff_trans = @{thm trans}\n  val conjI= @{thm conjI}\n  val conjE= @{thm conjE}\n  val impI = @{thm impI}\n  val mp   = @{thm mp}\n  val uncurry = @{thm uncurry}\n  val exI  = @{thm exI}\n  val exE  = @{thm exE}\n  val iff_allI = @{thm iff_allI}\n  val iff_exI = @{thm iff_exI}\n  val all_comm = @{thm all_comm}\n  val ex_comm = @{thm ex_comm}\n);\n\n(* loose_bvar2(t,k) iff t contains a 'loose' bound variable referring to\n   a level below k. *)\nfun loose_bvar2(Bound i,k) = i < k\n  | loose_bvar2(f$t, k) = loose_bvar2(f,k) orelse loose_bvar2(t,k)\n  | loose_bvar2(Abs(_,_,t),k) = loose_bvar2(t,k+1)\n  | loose_bvar2 _ = false;\n\nstructure Quantifier2 = Quantifier\n(\n  (*abstract syntax*)\n  fun dest_eq (Const(@{const_name HOL.eq},_) $ s $ t) = SOME (s, t)\n    | dest_eq _ = NONE;\n  fun dest_conj (Const(@{const_name HOL.conj},_) $ s $ t) = SOME (s, t)\n    | dest_conj _ = NONE;\n  fun dest_imp (Const(@{const_name HOL.implies},_) $ s $ t) = SOME (s, t)\n    | dest_imp _ = NONE;\n  val conj = HOLogic.conj\n  val imp  = HOLogic.imp\n  fun move xs t _ =  \n      let val n = length xs in\n        loose_bvar1 (t, n) andalso not (loose_bvar2 (t, n))\n      end\n  val force_move = false\n  val rotate = false\n  (*rules*)\n  val iff_reflection = @{thm eq_reflection}\n  val iffI = @{thm iffI}\n  val iff_trans = @{thm trans}\n  val conjI= @{thm conjI}\n  val conjE= @{thm conjE}\n  val impI = @{thm impI}\n  val mp   = @{thm mp}\n  val uncurry = @{thm uncurry}\n  val exI  = @{thm exI}\n  val exE  = @{thm exE}\n  val iff_allI = @{thm iff_allI}\n  val iff_exI = @{thm iff_exI}\n  val all_comm = @{thm all_comm}\n  val ex_comm = @{thm ex_comm}\n);\n\nstructure Quantifier3 = Quantifier\n(\n  (*abstract syntax*)\n  fun dest_eq (Const(@{const_name HOL.eq},_) $ s $ t) = SOME (s, t)\n    | dest_eq _ = NONE;\n  fun dest_conj (Const(@{const_name HOL.conj},_) $ s $ t) = SOME (s, t)\n    | dest_conj _ = NONE;\n  fun dest_imp (Const(@{const_name HOL.implies},_) $ s $ t) = SOME (s, t)\n    | dest_imp _ = NONE;\n  val conj = HOLogic.conj\n  val imp  = HOLogic.imp\n  fun move xs t _ =  \n      let val n = length xs in\n        loose_bvar1 (t, n) andalso not (loose_bvar (t, n + 1))\n      end\n  val force_move = false\n  val rotate = false\n  (*rules*)\n  val iff_reflection = @{thm eq_reflection}\n  val iffI = @{thm iffI}\n  val iff_trans = @{thm trans}\n  val conjI= @{thm conjI}\n  val conjE= @{thm conjE}\n  val impI = @{thm impI}\n  val mp   = @{thm mp}\n  val uncurry = @{thm uncurry}\n  val exI  = @{thm exI}\n  val exE  = @{thm exE}\n  val iff_allI = @{thm iff_allI}\n  val iff_exI = @{thm iff_exI}\n  val all_comm = @{thm all_comm}\n  val ex_comm = @{thm ex_comm}\n);\n\nsignature Int_Param =\n  sig\n    val x : int\n  end;\n\nfun is_conj (Const(@{const_name HOL.conj},_) $ _ $ _) = true\n    | is_conj _ = false;\n\nfunctor Quantifier4 (to_move: Int_Param) = Quantifier\n(\n  (*abstract syntax*)\n  fun dest_eq (Const(@{const_name HOL.eq},_) $ s $ t) = SOME (s, t)\n    | dest_eq _ = NONE;\n  fun dest_conj (Const(@{const_name HOL.conj},_) $ s $ t) = SOME (s, t)\n    | dest_conj _ = NONE;\n  fun dest_imp (Const(@{const_name HOL.implies},_) $ s $ t) = SOME (s, t)\n    | dest_imp _ = NONE;\n  val conj = HOLogic.conj\n  val imp  = HOLogic.imp\n  fun move _ P trms = length trms + 1 = to_move.x andalso not (is_conj P)\n  val force_move = true\n  val rotate = false\n  (*rules*)\n  val iff_reflection = @{thm eq_reflection}\n  val iffI = @{thm iffI}\n  val iff_trans = @{thm trans}\n  val conjI= @{thm conjI}\n  val conjE= @{thm conjE}\n  val impI = @{thm impI}\n  val mp   = @{thm mp}\n  val uncurry = @{thm uncurry}\n  val exI  = @{thm exI}\n  val exE  = @{thm exE}\n  val iff_allI = @{thm iff_allI}\n  val iff_exI = @{thm iff_exI}\n  val all_comm = @{thm all_comm}\n  val ex_comm = @{thm ex_comm}\n);\n\nstructure Quantifier5 = Quantifier\n(\n  (*abstract syntax*)\n  fun dest_eq (Const(@{const_name HOL.eq},_) $ s $ t) = SOME (s, t)\n    | dest_eq _ = NONE;\n  fun dest_conj (Const(@{const_name HOL.conj},_) $ s $ t) = SOME (s, t)\n    | dest_conj _ = NONE;\n  fun dest_imp (Const(@{const_name HOL.implies},_) $ s $ t) = SOME (s, t)\n    | dest_imp _ = NONE;\n  val conj = HOLogic.conj\n  val imp  = HOLogic.imp\n  fun move _ t _ = is_conj t\n  val force_move = true\n  val rotate = false\n  (*rules*)\n  val iff_reflection = @{thm eq_reflection}\n  val iffI = @{thm iffI}\n  val iff_trans = @{thm trans}\n  val conjI= @{thm conjI}\n  val conjE= @{thm conjE}\n  val impI = @{thm impI}\n  val mp   = @{thm mp}\n  val uncurry = @{thm uncurry}\n  val exI  = @{thm exI}\n  val exE  = @{thm exE}\n  val iff_allI = @{thm iff_allI}\n  val iff_exI = @{thm iff_exI}\n  val all_comm = @{thm all_comm}\n  val ex_comm = @{thm ex_comm}\n);\n\nstructure Quantifier6 = Quantifier\n(\n  (*abstract syntax*)\n  fun dest_eq (Const(@{const_name HOL.eq},_) $ s $ t) = SOME (s, t)\n    | dest_eq _ = NONE;\n  fun dest_conj (Const(@{const_name HOL.conj},_) $ s $ t) = SOME (s, t)\n    | dest_conj _ = NONE;\n  fun dest_imp (Const(@{const_name HOL.implies},_) $ s $ t) = SOME (s, t)\n    | dest_imp _ = NONE;\n  val conj = HOLogic.conj\n  val imp  = HOLogic.imp\n  fun move xs t _ =  \n      let val n = length xs in\n        not (loose_bvar1 (t, n))\n      end\n  val force_move = true\n  val rotate = true\n  (*rules*)\n  val iff_reflection = @{thm eq_reflection}\n  val iffI = @{thm iffI}\n  val iff_trans = @{thm trans}\n  val conjI= @{thm conjI}\n  val conjE= @{thm conjE}\n  val impI = @{thm impI}\n  val mp   = @{thm mp}\n  val uncurry = @{thm uncurry}\n  val exI  = @{thm exI}\n  val exE  = @{thm exE}\n  val iff_allI = @{thm iff_allI}\n  val iff_exI = @{thm iff_exI}\n  val all_comm = @{thm all_comm}\n  val ex_comm = @{thm ex_comm}\n);\n\nstructure Quantifier7 = Quantifier\n(\n  (*abstract syntax*)\n  fun dest_eq (Const(@{const_name HOL.eq},_) $ s $ t) = SOME (s, t)\n    | dest_eq _ = NONE;\n  fun dest_conj (Const(@{const_name HOL.conj},_) $ s $ t) = SOME (s, t)\n    | dest_conj _ = NONE;\n  fun dest_imp (Const(@{const_name HOL.implies},_) $ s $ t) = SOME (s, t)\n    | dest_imp _ = NONE;\n  val conj = HOLogic.conj\n  val imp  = HOLogic.imp\n  fun move xs t _ =  \n      let val n = length xs in\n        not (loose_bvar1 (t, n))\n      end\n  val force_move = true\n  val rotate = true\n  (*rules*)\n  val iff_reflection = @{thm eq_reflection}\n  val iffI = @{thm iffI}\n  val iff_trans = @{thm trans}\n  val conjI= @{thm conjI}\n  val conjE= @{thm conjE}\n  val impI = @{thm impI}\n  val mp   = @{thm mp}\n  val uncurry = @{thm uncurry}\n  val exI  = @{thm exI}\n  val exE  = @{thm exE}\n  val iff_allI = @{thm iff_allI}\n  val iff_exI = @{thm iff_exI}\n  val all_comm = @{thm all_comm}\n  val ex_comm = @{thm ex_comm}\n);\n\n\\<close>\n\nML_val \\<open>Quantifier1.rearrange_ex @{context} @{cterm \"\\<exists> a c. c < n \\<and> a \\<in> A\"}\\<close>\nML_val \\<open>Quantifier1.rearrange_ex @{context} @{cterm \"\\<exists> a c. c < n \\<and> a = b\"}\\<close>\nML_val \\<open>Quantifier2.rearrange_ex @{context} @{cterm \"\\<exists> a c. a = b \\<and> c < n\"}\\<close>\nML_val \\<open>Quantifier1.rearrange_ex @{context} @{cterm \"\\<exists> a c. a = b \\<and> c < n\"}\\<close>\nML_val \\<open>Quantifier2.rearrange_ex @{context} @{cterm \"\\<exists> a c. c < n \\<and> a = b\"}\\<close>\nML_val \\<open>Quantifier2.rearrange_ex @{context} @{cterm \"\\<exists> a c. a < n \\<and> a = b\"}\\<close>\nML_val \\<open>Quantifier2.rearrange_ex @{context} @{cterm \"\\<exists> a c. a < n \\<and> c < n \\<and> a = b\"}\\<close>\nML_val \\<open>Quantifier2.rearrange_ex @{context} @{cterm \"\\<exists> a c. c < n \\<and> a > c\"}\\<close>\nML_val \\<open>Quantifier3.rearrange_ex @{context} @{cterm \"\\<exists> a c. c < n \\<and> a > c\"}\\<close>\nML_val \\<open>Quantifier2.rearrange_ex @{context} @{cterm \"\\<exists> a c. c < n \\<and> a > b\"}\\<close>\nML_val \\<open>Quantifier2.rearrange_ex @{context} @{cterm \"\\<exists> a c. c < n \\<and> (P a c \\<and> a > b) \\<and> Q c\"}\\<close>\nML_val \\<open>Quantifier2.rearrange_ex @{context} @{cterm \"finite {(a, c) | a c. c < n \\<and> a \\<in> A}\"}\\<close>\nML_val \\<open>Quantifier2.rearrange_ex @{context} @{cterm \"finite {t. \\<exists> a c. a \\<in> A \\<and> c < n \\<and> t = (a,c)}\"}\\<close>\nML_val \\<open>Quantifier1.rotate_ex @{context} @{cterm \"\\<exists> a c. c < n \\<and> a > b\"}\\<close>\nML_val \\<open>Quantifier1.rotate_ex @{context} @{cterm \"\\<exists> a c d. c < n \\<and> a > b \\<and> P d\"}\\<close>\nML_val \\<open>Quantifier1.rearrange_ex @{context} @{cterm \"\\<exists> a c. a < n \\<and> c = b\"}\\<close>\nML_val \\<open>Quantifier1.rearrange_ex @{context} @{cterm \"\\<forall> a. \\<exists> c. a < n \\<and> c = b\"}\\<close>\nML_val \\<open>Quantifier1.rearrange_ex @{context} @{cterm \"\\<forall> a c. a < n \\<and> c = b\"}\\<close>\nML_val \\<open>Quantifier6.rearrange_ex @{context} @{cterm \"\\<exists> a b c. a < n \\<and> b < 3 \\<and> b > c\"}\\<close>\nML_val \\<open>Quantifier6.rearrange_ex @{context} @{cterm \"\\<exists>b c. a < n \\<and> b < 3 \\<and> b > c\"}\\<close>\nML_val \\<open>Quantifier7.miniscope_ex @{context} @{cterm \"\\<exists> a b c. a < n \\<and> b < 3 \\<and> b > c\"}\\<close>\nML_val \\<open>Quantifier7.miniscope_ex @{context} @{cterm \"\\<exists>b c. a < n \\<and> b < 3 \\<and> b > c\"}\\<close>\n\nsimproc_setup ex_reorder (\"\\<exists>x. P x\") = \\<open>fn _ => Quantifier2.rearrange_ex\\<close>\ndeclare [[simproc del: ex_reorder]]\nsimproc_setup ex_reorder2 (\"\\<exists>x. P x\") = \\<open>fn _ => Quantifier3.rearrange_ex\\<close>\ndeclare [[simproc del: ex_reorder2]]\nsimproc_setup ex_reorder3 (\"\\<exists>x. P x\") = \\<open>fn _ => Quantifier6.rearrange_ex\\<close>\ndeclare [[simproc del: ex_reorder3]]\nsimproc_setup ex_reorder4 (\"\\<exists>x. P x\") = \\<open>fn _ => Quantifier7.miniscope_ex\\<close>\ndeclare [[simproc del: ex_reorder4]]\n\nML_val \\<open>@{term \"\\<exists> a c. c < n \\<and> a \\<in> A\"}\\<close>\n\nML_val \\<open>@{term \"finite {(a, c). c < n \\<and> a \\<in> A}\"}\\<close>\n\nML_val \\<open>@{term \"finite {(a, c) | a c. c < n \\<and> a \\<in> A}\"}\\<close>\n\nlemma\n  fixes n :: nat\n  assumes A: \"finite A\"\n  shows \"finite {(a, c). c < n \\<and> a \\<in> A}\"\n  using assms\n    using [[simproc add: finite_Collect]]\n    by simp\n\nlemma\n  fixes n :: nat\n  assumes A: \"finite A\"\n  shows \"finite {(a, c) | a c. c < n \\<and> a \\<in> A}\"\n  using assms\n  using [[simproc add: ex_reorder]]\n    by simp\n\nlemma\n  fixes n :: nat\n  assumes A: \"finite A\"\n  shows \"finite {t. \\<exists> a c. a \\<in> A \\<and> c < n \\<and> t = (a,c)}\"\n  apply simp\n  using assms apply simp\n  oops\n\nlemma\n  fixes n :: nat\n  assumes A: \"finite A\"\n  shows \"finite {t. \\<exists> a c. (t = (a,c) \\<and> c < n) \\<and> a \\<in> A}\"\n      using [[simproc add: ex_reorder]]\n  using [[simp_trace]] apply simp\n  using assms by simp\n\nlemma\n  fixes n :: nat\n  assumes A: \"finite A\"\n  shows \"finite {t. \\<exists> a c. (t = (a,c) \\<and> a \\<in> A) \\<and> c < n}\"\n  using [[simp_trace]] apply (simp del: Product_Type.Collect_case_prod)\n  using assms by simp\n  \nlemma\n  fixes n :: nat\n  assumes A: \"finite A\"\n  shows \"finite {t. \\<exists> a c. (a \\<in> A \\<and> t = (a,c)) \\<and> c < n}\"\n  using [[simp_trace]] apply simp\n  using assms by simp\n  \nlemma\n  fixes n :: nat\n  assumes A: \"finite A\"\n  shows \"finite {t. \\<exists> a c. a \\<in> A \\<and> c < n \\<and> t = (a,c)}\"\n  using [[simp_trace]] apply simp\n  using assms by simp\n  \nlemma\n  assumes A: \"finite A\"\n  shows \"finite {t. \\<exists> a c. a \\<in> A \\<and> P c \\<and> t = (a,c)}\"\n  using [[simp_trace]] apply simp\n  using assms apply simp\n  oops\n\nML \\<open>\n  fun rotate_quant reorder_thm n ctxt =\n    let\n      fun subst j =\n        if j > n then K all_tac else\n          (\n            EqSubst.eqsubst_tac ctxt [j] [reorder_thm]\n          ) THEN' subst (j + 1)\n    in subst 1 end;\n\\<close>\n\nML_val Pretty.string_of\nML_val Syntax.pretty_term\n\nML \\<open>\n  fun rotate_ex_tac ctxt =\n    let\n      fun foc_tac {concl, ...} =\n        case Quantifier1.rotate_ex ctxt concl of\n          NONE => no_tac\n        | SOME thm => rewrite_goals_tac ctxt [thm]\n    in\n      Subgoal.FOCUS foc_tac ctxt\n    end;\n\\<close>\n\nML \\<open>\n  fun rotate_all_tac ctxt =\n    let\n      fun foc_tac {concl, ...} =\n        case Quantifier1.rotate_all ctxt concl of\n          NONE => no_tac\n        | SOME thm => rewrite_goals_tac ctxt [thm]\n    in\n      Subgoal.FOCUS foc_tac ctxt\n    end;\n\\<close>\n\nML \\<open>\n  fun rearrange_ex_tac ctxt =\n    let\n      fun foc_tac {concl, ...} =\n        case Quantifier2.rearrange_ex ctxt concl of\n          NONE => no_tac\n        | SOME thm => rewrite_goals_tac ctxt [thm]\n    in\n      Subgoal.FOCUS foc_tac ctxt\n    end;\n\\<close>\n\nML \\<open>\n  fun rearrange_ex_tac2 ctxt =\n    let\n      fun foc_tac {concl, ...} =\n        case Quantifier3.rearrange_ex ctxt concl of\n          NONE => no_tac\n        | SOME thm => rewrite_goals_tac ctxt [thm]\n    in\n      Subgoal.FOCUS foc_tac ctxt\n    end;\n\\<close>\n\n(* XXX How to do this? *)\n(*\nML \\<open>\n  fun rearrange_ex_tac2 n ctxt =\n    let\n      struct Quant = Quantifier4(val x = n);\n      fun foc_tac {concl, ...} =\n        case Quantifier4.rearrange_ex ctxt concl of\n          NONE => no_tac\n        | SOME thm => rewrite_goals_tac ctxt [thm]\n    in\n      Subgoal.FOCUS foc_tac ctxt\n    end;\n\\<close>\n*)\n\nML_val Abs\n\nML_val Conv.rewr_conv\n\nML \\<open>\n\n  fun strip_fin (Const (@{const_name \"finite\"}, _) $ (Const (@{const_name \"Collect\"}, _) $ t)) = t\n    | strip_fin t = t\n\n  fun wrap_fin tac ctxt = tac ctxt o strip_fin\n\n  structure Quant2 = Quantifier4(val x = 2);\n  structure Quant3 = Quantifier4(val x = 3);\n  structure Quant4 = Quantifier4(val x = 4);\n  structure Quant5 = Quantifier4(val x = 5);\n\n  fun rearrange_ex_fixed_n rearrange_n ctxt =\n    let\n      fun foc_tac {concl, ...} =\n        case rearrange_n ctxt concl of\n          NONE => no_tac\n        | SOME thm => rewrite_goals_tac ctxt [thm, @{thm HOL.conj_assoc} RS @{thm HOL.eq_reflection}]\n    in\n      Subgoal.FOCUS foc_tac ctxt\n    end;\n  \n  val rearrange_ex_fixed_2 = rearrange_ex_fixed_n Quant2.rearrange_ex;\n  val rearrange_ex_fixed_3 = rearrange_ex_fixed_n Quant3.rearrange_ex;\n  val rearrange_ex_fixed_4 = rearrange_ex_fixed_n Quant4.rearrange_ex;\n  val rearrange_ex_fixed_5 = rearrange_ex_fixed_n Quant5.rearrange_ex;\n\n  (* val defer_ex = rearrange_ex_fixed_n (wrap_fin Quantifier5.rearrange_ex); *)\n\n  fun CONV conv ctxt =\n    let\n      fun foc_tac {concl, ...} =\n        rewrite_goals_tac ctxt [conv ctxt concl]\n    in\n      Subgoal.FOCUS foc_tac ctxt\n    end;\n\n  fun mk_conv f ctxt ct =\n    case (f ctxt ct) of\n      SOME thm => thm\n    | _ => raise CTERM (\"no conversion\", [])\n\n  fun success_conv cv ct =\n    let\n      val eq = cv ct\n    in\n      if Thm.is_reflexive eq then raise CTERM (\"no conversion\", []) else eq\n    end\n\n  fun mk_conv' f ctxt ct = the_default (Thm.reflexive ct) (f ctxt ct)\n  val assoc_conv = Conv.rewr_conv (@{thm HOL.conj_assoc} RS @{thm HOL.eq_reflection})\n  val comm_conv = Conv.rewr_conv (@{thm HOL.conj_commute} RS @{thm HOL.eq_reflection})\n  fun wrap_conv f ctxt =\n    success_conv (\n      Conv.top_sweep_conv (fn ctxt => mk_conv f ctxt then_conv Conv.repeat_conv assoc_conv) ctxt\n    )\n  fun mk_tac conv ctxt = CONVERSION (Conv.concl_conv ~1 (Object_Logic.judgment_conv ctxt (conv ctxt)))\n\n  val defer_conv = mk_conv Quantifier5.rearrange_ex\n  val conv = wrap_conv Quantifier5.rearrange_ex\n  fun defer_ex_tac ctxt = CONVERSION (Conv.params_conv ~1 (fn ctxt => Conv.concl_conv ~1 (conv ctxt)) ctxt)\n  val defer_ex_tac = CONV conv\n  fun defer_ex_tac ctxt i =\n    CHANGED (mk_tac (fn ctxt => wrap_conv Quantifier5.rearrange_ex ctxt else_conv Conv.top_sweep_conv (K comm_conv) ctxt) ctxt i)\n  val mini_ex_tac = mk_tac (wrap_conv Quantifier6.rearrange_ex)\n  val mini_ex_tac2 = mk_tac (wrap_conv Quantifier7.miniscope_ex)\n\n  val rearrange_ex_fixed_2 = mk_tac (wrap_conv Quant2.rearrange_ex);\n  val rearrange_ex_fixed_3 = mk_tac (wrap_conv Quant3.rearrange_ex);\n  val rearrange_ex_fixed_4 = mk_tac (wrap_conv Quant4.rearrange_ex);\n  val rearrange_ex_fixed_5 = mk_tac (wrap_conv Quant5.rearrange_ex);\n\\<close>\n\nML_val Object_Logic.judgment_conv\n\nML_val \\<open>defer_conv @{context} @{cterm \"\\<exists> a b c d. a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"}\\<close>\nML_val \\<open>assoc_conv @{cterm \"(a < 1 \\<and> b < 2) \\<and> c < 3 \\<and> d < 4\"}\\<close>\nML_val \\<open>Conv.binder_conv (K assoc_conv) @{context} @{cterm \"\\<exists> a. (a < 1 \\<and> b < 2) \\<and> c < 3 \\<and> d < 4\"}\\<close>\nML_val \\<open>Conv.top_sweep_conv (K assoc_conv) @{context}\n  @{cterm \"\\<exists> a b c d. (a < 1 \\<and> b < 2) \\<and> c < 3 \\<and> d < 4\"}\\<close>\nML_val \\<open>Conv.bottom_conv (K (Conv.try_conv assoc_conv)) @{context}\n  @{cterm \"\\<exists> a b c d. (a < 1 \\<and> b < 2) \\<and> c < 3 \\<and> d < 4\"}\\<close>\nML_val \\<open>Conv.every_conv [defer_conv @{context}, Conv.try_conv assoc_conv]\n  @{cterm \"\\<exists> a b c d. a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"}\\<close>\nML_val \\<open>conv @{context} @{cterm \"\\<exists> a b c d. a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"}\\<close>\nML_val \\<open>conv @{context} @{cterm \"finite {t. \\<exists> a b c d. a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4}\"}\\<close>\nML_val \\<open>conv @{context} @{cterm \"\\<exists>a b c d. d = 4 \\<and> c = 3 \\<and> b < 2 \\<and> a < 1\"}\\<close>\n\nML_val \\<open>CONVERSION (Conv.concl_conv ~1 (conv @{context}))\\<close>\nML_val Conv.concl_conv\n\nML_val \\<open>Quantifier1.rotate_ex @{context} @{cterm \"\\<exists> a b c d. a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"}\\<close>\n\nML_val \\<open>Quantifier1.rotate_all @{context} @{cterm \"\\<forall> a b c d. a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"}\\<close>\n\nlemma\n  \"\\<forall> a b c d. a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"\n  apply (tactic \\<open>rotate_all_tac @{context} 1\\<close>)\n  apply (tactic \\<open>rotate_all_tac @{context} 1\\<close>)\n  apply (tactic \\<open>rotate_all_tac @{context} 1\\<close>)\n  apply (tactic \\<open>rotate_all_tac @{context} 1\\<close>)\n  apply (tactic \\<open>rotate_all_tac @{context} 1\\<close>)\n  oops\n\nlemmas a = HOL.refl[THEN eq_reflection]\nlemmas b = enum_the_def[THEN eq_reflection]\nML_val \\<open>Thm.is_reflexive @{thm a}\\<close>\nML_val \\<open>Thm.is_reflexive @{thm b}\\<close>\nlemma\n  \"\\<exists> a b c d. a < 1 \\<and> b < 2 \\<and> c = 3 \\<and> d = 4\"\n  apply (tactic \\<open>rearrange_ex_fixed_2 @{context} 1\\<close>)\n  apply (tactic \\<open>rearrange_ex_fixed_3 @{context} 1\\<close>)\n  apply (tactic \\<open>rearrange_ex_fixed_4 @{context} 1\\<close>)\n  apply (tactic \\<open>defer_ex_tac @{context} 1\\<close>)\n  apply (subst conj_assoc)+\n  oops\n\n  ML_val \\<open>@{const_name finite}\\<close>\n  ML_val \\<open>@{const_name Collect}\\<close>\nML_val \\<open>strip_fin @{term \\<open>finite {t. \\<exists>a b c d. a < 1 \\<and> b < 2 \\<and> c = 3 \\<and> d = 4}\\<close>}\\<close>\n\n\nlemma\n  \"finite {t. \\<exists> a b c d. a < 1 \\<and> b < 2 \\<and> c = 3 \\<and> d = 4}\"\n  apply (tactic \\<open>rearrange_ex_fixed_2 @{context} 1\\<close>)\n  apply (tactic \\<open>rearrange_ex_fixed_3 @{context} 1\\<close>)\n  apply (tactic \\<open>rearrange_ex_fixed_4 @{context} 1\\<close>)\n  apply (tactic \\<open>defer_ex_tac @{context} 1\\<close>)\n  oops\n  \nlemma\n  \"finite S \\<Longrightarrow> finite {t. \\<exists> a b c d. a < 1 \\<and> b < 2 \\<and> c = 3 \\<and> d = 4}\"\n  apply (tactic \\<open>rearrange_ex_fixed_2 @{context} 1\\<close>)\n  apply (tactic \\<open>rearrange_ex_fixed_3 @{context} 1\\<close>)\n  apply (tactic \\<open>rearrange_ex_fixed_4 @{context} 1\\<close>)\n  apply (tactic \\<open>defer_ex_tac @{context} 1\\<close>, simp only: conj_assoc)\n  oops\n\nlemma\n  \"finite S \\<Longrightarrow> finite {t. \\<exists> a b c d. P a b d \\<and> c > 3}\"\n  apply (tactic \\<open>defer_ex_tac @{context} 1\\<close>)\n  apply (tactic \\<open>mini_ex_tac @{context} 1\\<close>)\n  apply (simp only: ex_simps)\n  oops\n\nlemma\n  \"\\<exists> a b c d. d < 4 \\<and> a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"\n  using [[simproc add: ex_reorder3]]\n  apply simp\n  oops\n\nlemma\n  \"\\<exists> a b c d. d < 4 \\<and> a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"\n  using [[simproc add: ex_reorder4]]\n  apply simp\n  oops\n\nlemma\n  \"\\<exists> a b c d. d < 4 \\<and> a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"\n  apply (tactic \\<open>mini_ex_tac @{context} 1\\<close>)\n  apply simp\n  apply (tactic \\<open>mini_ex_tac @{context} 1\\<close>)\n  apply simp\n  apply (tactic \\<open>mini_ex_tac @{context} 1\\<close>)\n  apply simp\n  apply (tactic \\<open>mini_ex_tac @{context} 1\\<close>)\n  apply simp\n  apply (tactic \\<open>mini_ex_tac @{context} 1\\<close>)\n  apply simp\n  apply (tactic \\<open>mini_ex_tac @{context} 1\\<close>)\n  apply simp\n  oops\n\nlemma\n  \"\\<exists> a b c d. d < 4 \\<and> a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"\n  apply (tactic \\<open>mini_ex_tac2 @{context} 1\\<close>)\n  apply simp\n  apply (tactic \\<open>mini_ex_tac2 @{context} 1\\<close>)\n  apply simp\n  apply (tactic \\<open>mini_ex_tac2 @{context} 1\\<close>)\n  apply simp\n  apply (tactic \\<open>mini_ex_tac @{context} 1\\<close>)\n  apply simp\n  apply (tactic \\<open>mini_ex_tac @{context} 1\\<close>)\n  apply simp\n  apply (tactic \\<open>mini_ex_tac @{context} 1\\<close>)\n  apply simp\n  oops\n  \nlemma\n  \"\\<exists> a c b d. d < 4 \\<and> a < 1 \\<and> b < 2 \\<and> c < 3\"\n  apply simp\n  oops\n  \nlemma\n  \"\\<exists> a b c d. a < 1 \\<and> b < 2 \\<and> c < 3 \\<and> d < 4\"\n  apply (tactic \\<open>rotate_ex_tac @{context} 1\\<close>)\n  apply (tactic \\<open>rotate_ex_tac @{context} 1\\<close>)\n  apply (tactic \\<open>rotate_ex_tac @{context} 1\\<close>)\n  apply (tactic \\<open>rotate_ex_tac @{context} 1\\<close>)\n  apply (tactic \\<open>rotate_ex_tac @{context} 1\\<close>)\n  oops\n\nlemma\n  \"\\<exists> a b c d. b < 2 \\<and> c < 3 \\<and> d < 4 \\<and> a < 1\"\n  apply (tactic \\<open>rearrange_ex_tac @{context} 1\\<close>)\n  oops\n\nlemma\n  \"\\<exists> a b c d. b < 2 \\<and> c < 3 \\<and> d < 4 \\<and> a < c\"\n  apply (tactic \\<open>rearrange_ex_tac2 @{context} 1\\<close>; simp only: conj_assoc)+\n  oops\n\nlemma\n  \"\\<exists> a b c d. b < 2 \\<and> c < 3 \\<and> d < 4 \\<and> a < c\"\n  apply (tactic \\<open>rearrange_ex_tac2 @{context} 1\\<close>; simp del: ex_simps)+\n  oops\n\nlemma\n  \"\\<exists> a b c d. b < 2 \\<and> c < 3 \\<and> d < 4 \\<and> a < c\"\n  apply (tactic \\<open>rearrange_ex_tac2 @{context} 1\\<close>)\n  apply (simp del: ex_simps)\n  apply (tactic \\<open>rearrange_ex_tac2 @{context} 1\\<close>)\n  apply (simp del: ex_simps)\n  apply (tactic \\<open>rearrange_ex_tac2 @{context} 1\\<close>)\n  using [[simp_trace]]\n  apply (simp del: ex_simps)\n  oops\n\nlemma finite_Collect_bounded_ex_4:\n  assumes \"finite {(a,b,c,d) . P a b c d}\"\n  shows\n    \"finite {x. \\<exists>a b c d. P a b c d \\<and> Q x a b c d}\n    \\<longleftrightarrow> (\\<forall> a b c d. P a b c d \\<longrightarrow> finite {x. Q x a b c d})\"\nproof -\n  have *:\n    \"{x. \\<exists>a b c d. P a b c d \\<and> Q x a b c d}\n    = {x. \\<exists> t. t \\<in> {(a,b,c,d). P a b c d} \\<and> (\\<exists>a b c d. t = (a, b, c, d) \\<and> Q x a b c d)}\"\n    by simp\n  show ?thesis apply (subst *)\n    apply (subst finite_Collect_bounded_ex)\n    using assms by simp+\noops\n  \nlemma finite_Collect_bounded_ex_4':\n  assumes \"finite {(a,b,c,d) | a b c d. P a b c d}\"\n  shows\n    \"finite {x. \\<exists>a b c d. P a b c d \\<and> Q x a b c d}\n    \\<longleftrightarrow> (\\<forall> a b c d. P a b c d \\<longrightarrow> finite {x. Q x a b c d})\"\nproof -\n  have *:\n    \"{x. \\<exists>a b c d. P a b c d \\<and> Q x a b c d}\n    = {x. \\<exists> t. t \\<in> {(a,b,c,d) | a b c d. P a b c d} \\<and> (\\<exists>a b c d. t = (a, b, c, d) \\<and> Q x a b c d)}\"\n    by simp\n  show ?thesis apply (subst *)\n    apply (subst finite_Collect_bounded_ex)\n    using assms by simp+\nqed\n\nlemma finite_Collect_bounded_ex_2 [simp]:\n  assumes \"finite {(a,b). P a b}\"\n  shows\n    \"finite {x. \\<exists>a b. P a b \\<and> Q x a b}\n    \\<longleftrightarrow> (\\<forall> a b. P a b \\<longrightarrow> finite {x. Q x a b})\"\n  using assms finite_Collect_bounded_ex[OF assms, where Q = \"\\<lambda> x. \\<lambda> (a, b). Q x a b\"]\n  by clarsimp (* force, simp *)\n\nlemma finite_Collect_bounded_ex_3 [simp]:\n  assumes \"finite {(a,b,c) . P a b c}\"\n  shows\n    \"finite {x. \\<exists>a b c. P a b c \\<and> Q x a b c}\n    \\<longleftrightarrow> (\\<forall> a b c. P a b c \\<longrightarrow> finite {x. Q x a b c})\"\n  using assms finite_Collect_bounded_ex\n    [OF assms, where Q = \"\\<lambda> x. \\<lambda> (a, b, c). Q x a b c\"]\n  by clarsimp\n\nlemma finite_Collect_bounded_ex_4 [simp]:\n  assumes \"finite {(a,b,c,d) . P a b c d}\"\n  shows\n    \"finite {x. \\<exists>a b c d. P a b c d \\<and> Q x a b c d}\n    \\<longleftrightarrow> (\\<forall> a b c d. P a b c d \\<longrightarrow> finite {x. Q x a b c d})\"\n  using assms finite_Collect_bounded_ex[OF assms, where Q = \"\\<lambda> x. \\<lambda> (a, b, c, d). Q x a b c d\"]\n  by clarsimp (* force, simp *)\n\nlemma finite_Collect_bounded_ex_5 [simp]:\n  assumes \"finite {(a,b,c,d,e) . P a b c d e}\"\n  shows\n    \"finite {x. \\<exists>a b c d e. P a b c d e \\<and> Q x a b c d e}\n    \\<longleftrightarrow> (\\<forall> a b c d e. P a b c d e \\<longrightarrow> finite {x. Q x a b c d e})\"\n  using assms finite_Collect_bounded_ex\n    [OF assms, where Q = \"\\<lambda> x. \\<lambda> (a, b, c, d, e). Q x a b c d e\"]\n  by clarsimp (* force, simp *)\n\nlemma finite_Collect_bounded_ex_6 [simp]:\n  assumes \"finite {(a,b,c,d,e,f) . P a b c d e f}\"\n  shows\n    \"finite {x. \\<exists>a b c d e f. P a b c d e f \\<and> Q x a b c d e f}\n    \\<longleftrightarrow> (\\<forall> a b c d e f. P a b c d e f \\<longrightarrow> finite {x. Q x a b c d e f})\"\n  using assms finite_Collect_bounded_ex\n    [OF assms, where Q = \"\\<lambda> x. \\<lambda> (a, b, c, d, e, f). Q x a b c d e f\"]\n  by clarsimp (* force, simp *)\n\nlemma finite_Collect_bounded_ex_7 [simp]:\n  assumes \"finite {(a,b,c,d,e,f,g) . P a b c d e f g}\"\n  shows\n    \"finite {x. \\<exists>a b c d e f g. P a b c d e f g \\<and> Q x a b c d e f g}\n    \\<longleftrightarrow> (\\<forall> a b c d e f g. P a b c d e f g \\<longrightarrow> finite {x. Q x a b c d e f g})\"\n  using assms finite_Collect_bounded_ex\n    [OF assms, where Q = \"\\<lambda> x. \\<lambda> (a, b, c, d, e, f, g). Q x a b c d e f g\"]\n  by clarsimp (* force, simp *)\n\nlemma finite_Collect_bounded_ex_8 [simp]:\n  assumes \"finite {(a,b,c,d,e,f,g,h) . P a b c d e f g h}\"\n  shows\n    \"finite {x. \\<exists>a b c d e f g h. P a b c d e f g h \\<and> Q x a b c d e f g h}\n    \\<longleftrightarrow> (\\<forall> a b c d e f g h. P a b c d e f g h \\<longrightarrow> finite {x. Q x a b c d e f g h})\"\n  using assms finite_Collect_bounded_ex\n    [OF assms, where Q = \"\\<lambda> x. \\<lambda> (a, b, c, d, e, f, g, h). Q x a b c d e f g h\"]\n  by clarsimp (* force, simp *)\n\nlemma finite_Collect_bounded_ex_9 [simp]:\n  assumes \"finite {(a,b,c,d,e,f,g,h,i) . P a b c d e f g h i}\"\n  shows\n    \"finite {x. \\<exists>a b c d e f g h i. P a b c d e f g h i \\<and> Q x a b c d e f g h i}\n    \\<longleftrightarrow> (\\<forall> a b c d e f g h i. P a b c d e f g h i \\<longrightarrow> finite {x. Q x a b c d e f g h i})\"\n  using assms finite_Collect_bounded_ex\n    [OF assms, where Q = \"\\<lambda> x. \\<lambda> (a, b, c, d, e, f, g, h, i). Q x a b c d e f g h i\"]\n  by clarsimp (* force, simp *)\n\nlemma finite_Collect_bounded_ex_10 [simp]:\n  assumes \"finite {(a,b,c,d,e,f,g,h,i,j) . P a b c d e f g h i j}\"\n  shows\n    \"finite {x. \\<exists>a b c d e f g h i j. P a b c d e f g h i j \\<and> Q x a b c d e f g h i j}\n    \\<longleftrightarrow> (\\<forall> a b c d e f g h i j. P a b c d e f g h i j \\<longrightarrow> finite {x. Q x a b c d e f g h i j})\"\n  using assms finite_Collect_bounded_ex\n    [OF assms, where Q = \"\\<lambda> x. \\<lambda> (a, b, c, d, e, f, g, h, i, j). Q x a b c d e f g h i j\"]\n  by clarsimp (* force, simp *)\n\n\nML \\<open>fun mini_ex ctxt = SIMPLE_METHOD (mini_ex_tac ctxt 1)\\<close>\nML \\<open>fun defer_ex ctxt = SIMPLE_METHOD (defer_ex_tac ctxt 1)\\<close>\n\nmethod_setup mini_existential =\n  \\<open>Scan.succeed mini_ex\\<close> \\<open>Miniscope existential quantifiers\\<close>\nmethod_setup defer_existential =\n  \\<open>Scan.succeed defer_ex\\<close> \\<open>Rotate first conjunct under existential quantifiers to last position\\<close>\n\nmethod mini_ex = ((simp only: ex_simps[symmetric])?, mini_existential, (simp)?)\nmethod defer_ex = ((simp only: ex_simps[symmetric])?, defer_existential, (simp)?)\nmethod defer_ex' = (defer_existential, (simp)?)\n\nend", "meta": {"author": "wimmers", "repo": "isabelle-finite", "sha": "5ac13bd9712dd98a21a6d2a0944c6844579859f5", "save_path": "github-repos/isabelle/wimmers-isabelle-finite", "path": "github-repos/isabelle/wimmers-isabelle-finite/isabelle-finite-5ac13bd9712dd98a21a6d2a0944c6844579859f5/Reordering_Quantifiers.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.5926665999540697, "lm_q1q2_score": 0.3102137585508639}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2009-2       |\n            |                October 2010  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory Domain_T_cpo \nimports Domain_T CPO\nbegin\n\n(*****************************************************************\n\n         1. Domain_T is a pointed cpo.\n         2. \n         3. \n         4. \n\n *****************************************************************)\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n\n(*********************************************************\n                      Bottom in Dom_T\n *********************************************************)\n(* isabelle 2009-1\ninstance domT :: (type) bot0\nby (intro_classes)\n\ndefs (overloaded)\n  bottom_domT_def   :  \"Bot == {<>}t\"\n*)\n\ninstantiation domT :: (type) bot0\nbegin\n\ndefinition\n  bottom_domT_def : \"Bot == {<>}t\"\n\ninstance ..\n\nend\n\n\nlemma bottom_domT : \"Bot <= (T::'a domT)\"\nby (simp add: bottom_domT_def)\n\ninstance domT :: (type) bot\napply (intro_classes)\nby (simp add: bottom_domT)\n\n(********************************************************** \n      lemmas used in a proof that domain_T is a cpo.\n **********************************************************)\n\n(* UnionT Ts is an upper bound of Ts *)\n\nlemma UnionT_isUB : \"(UnionT Ts) isUB Ts\"\napply (simp add: isUB_def)\napply (simp add: subdomT_iff)\napply (intro allI impI)\napply (subgoal_tac \"Ts ~= {}\")\napply (simp)\napply (rule_tac x=y in bexI)\nby (auto)\n\n(* UnionT Ts is the least upper bound of Ts *)\n\nlemma UnionT_isLUB : \"Ts ~= {} ==> UnionT Ts isLUB Ts\"\napply (simp add: isLUB_def UnionT_isUB)\napply (simp add: isUB_def)\napply (simp add: subdomT_iff)\napply (intro allI impI)\napply (erule bexE)\napply (drule_tac x=\"T\" in spec)\nby (simp)\n\n(* the least upper bound of Ts is UnionT Ts *)\n\nlemma isLUB_UnionT_only_if: \"[| Ts ~= {} ; T isLUB Ts |] ==> T = UnionT Ts\"\napply (insert UnionT_isLUB[of Ts])\napply (simp)\napply (rule LUB_unique)\nby (simp_all)\n\n(* iff *)\n\nlemma isLUB_UnionT : \"Ts ~= {} ==> (T isLUB Ts) = (T = UnionT Ts)\"\napply (rule iffI)\napply (simp add: isLUB_UnionT_only_if)\napply (simp add: UnionT_isLUB)\ndone\n\n(* LUB is UnionT Ts *)\n\nlemma LUB_UnionT : \"Ts ~= {} ==> LUB Ts = UnionT Ts\"\nby (simp add: isLUB_LUB UnionT_isLUB)\n\n(********************************************************** \n                 ( domT, <= ) is a CPO\n **********************************************************)\n\ninstance domT :: (type) cpo\napply (intro_classes)\napply (simp add: hasLUB_def)\napply (rule_tac x=\"UnionT X\" in exI)\napply (simp add: directed_def UnionT_isLUB)\ndone\n\n(********************************************************** \n              ( domT, <= ) is a pointed CPO\n **********************************************************)\n\ninstance domT :: (type) cpo_bot\nby (intro_classes)\n\n(****************** to add them again ******************)\n\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_T/Domain_T_cpo.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5926665855647395, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3102137510191957}}
{"text": "section \\<open>Infrastructures\\<close>\ntext \\<open>The Isabelle Infrastructure framework supports the representation of infrastructures \nas graphs with actors and policies attached to nodes. These infrastructures \nare the {\\it states} of the Kripke structure. \nThe transition between states is triggered by non-parametrized\nactions @{text \\<open>get, move, eval, put\\<close>} executed by actors. \nActors are given by an abstract type @{text \\<open>actor\\<close>} and a function \n@{text \\<open>Actor\\<close>} that creates elements of that type from identities \n(of type @{text \\<open>string\\<close>}). Policies are given by pairs of predicates \n(conditions) and sets of (enabled) actions.\\<close>\nsubsection \\<open>Actors, actions, and data labels\\<close>\ntheory Infrastructure\n  imports AT \nbegin\ndatatype action = get | move | eval | put\n\ntypedecl actor \ntype_synonym identity = string\nconsts Actor :: \"string \\<Rightarrow> actor\"\ntype_synonym policy = \"((actor \\<Rightarrow> bool) * action set)\"\n\ndefinition ID :: \"[actor, string] \\<Rightarrow> bool\"\n  where \"ID a s \\<equiv> (a = Actor s)\"\ntext \\<open>The Decentralised Label Model (DLM) \\<^cite>\\<open>\"ml:98\"\\<close> introduced the idea to\nlabel data by owners and readers. We pick up this idea and formalize\na new type to encode the owner and the set of readers as a pair.\nThe first element is the owner of a data item, the second one is the\nset of all actors that may access the data item.\nThis enables the unique security \nlabelling of data within the system additionally taking the ownership into \naccount.\\<close>\ntype_synonym data = nat  \ntype_synonym dlm = \"actor * actor set\"\n\nsubsection \\<open>Infrastructure graphs and policies\\<close>\ntext\\<open>Actors are contained in an infrastructure graph. An @{text \\<open>igraph\\<close>} contains\na set of location pairs representing the topology of the infrastructure\nas a graph of nodes and a list of actor identities associated to each node \n(location) in the graph.\nAlso an @{text \\<open>igraph\\<close>} associates actors to a pair of string sets by\na pair-valued function whose first range component is a set describing\nthe credentials in the possession of an actor and the second component\nis a set defining the roles the actor can take on. More importantly in this \ncontext, an  @{text \\<open>igraph\\<close>} assigns locations to a pair of a string that defines\nthe state of the component and an element of type @{text \\<open>(dlm * data) set\\<close>}. This\nset of labelled data may represent a condition on that data.\nCorresponding projection functions for each of these components of an \n@{text \\<open>igraph\\<close>} are provided; they are named @{text \\<open>gra\\<close>} for the actual set of pairs of\nlocations, @{text \\<open>agra\\<close>} for the actor map, @{text \\<open>cgra\\<close>} for the credentials,\nand @{text \\<open>lgra\\<close>} for the state of a location and the data at that location.\\<close>\ndatatype location = Location nat\n  datatype igraph = Lgraph \"(location * location)set\" \"location \\<Rightarrow> identity set\"\n                           \"actor \\<Rightarrow> (string set * string set)\"  \n                           \"location \\<Rightarrow> string * (dlm * data) set\"\ndatatype infrastructure = \n         Infrastructure \"igraph\" \n                        \"[igraph, location] \\<Rightarrow> policy set\" \n                       \nprimrec loc :: \"location \\<Rightarrow> nat\"\nwhere  \"loc(Location n) = n\"\nprimrec gra :: \"igraph \\<Rightarrow> (location * location)set\"\nwhere  \"gra(Lgraph g a c l) = g\"\nprimrec agra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> identity set)\"\nwhere  \"agra(Lgraph g a c l) = a\"\nprimrec cgra :: \"igraph \\<Rightarrow> (actor \\<Rightarrow> string set * string set)\"\nwhere  \"cgra(Lgraph g a c l) = c\"\nprimrec lgra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> string * (dlm * data) set)\"\nwhere  \"lgra(Lgraph g a c l) = l\"\n\ndefinition nodes :: \"igraph \\<Rightarrow> location set\" \nwhere \"nodes g == { x. (? y. ((x,y): gra g) | ((y,x): gra g))}\"\n\ndefinition actors_graph :: \"igraph \\<Rightarrow> identity set\"  \nwhere  \"actors_graph g == {x. ? y. y : nodes g \\<and> x \\<in> (agra g y)}\"\n\ntext \\<open>There are projection functions text{@ \\<open>graphI\\<close>} and text{@ \\<open>delta\\<close>} when applied\nto an infrastructure return the graph and the policy, respectively. Other projections\nare introduced for the labels, the credential, and roles and to express their meaning.\\<close>\nprimrec graphI :: \"infrastructure \\<Rightarrow> igraph\"\nwhere \"graphI (Infrastructure g d) = g\"\nprimrec delta :: \"[infrastructure, igraph, location] \\<Rightarrow> policy set\"\nwhere \"delta (Infrastructure g d) = d\"\nprimrec tspace :: \"[infrastructure, actor ] \\<Rightarrow> string set * string set\"\n  where \"tspace (Infrastructure g d) = cgra g\"\nprimrec lspace :: \"[infrastructure, location ] \\<Rightarrow> string * (dlm * data)set\"\nwhere \"lspace (Infrastructure g d) = lgra g\"\n\ndefinition credentials :: \"string set * string set \\<Rightarrow> string set\"\n  where  \"credentials lxl \\<equiv> (fst lxl)\"\ndefinition has :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"has G ac \\<equiv> snd ac \\<in> credentials(cgra G (fst ac))\"\ndefinition roles :: \"string set * string set \\<Rightarrow> string set\"\n  where  \"roles lxl \\<equiv> (snd lxl)\"\ndefinition role :: \"[igraph, actor * string] \\<Rightarrow> bool\"\n  where \"role G ac \\<equiv> snd ac \\<in> roles(cgra G (fst ac))\"\ndefinition isin :: \"[igraph,location, string] \\<Rightarrow> bool\" \n  where \"isin G l s \\<equiv> s = fst (lgra G l)\"\n\ntext \\<open>Predicates and projections for the labels to encode their meaning.\\<close>\ndefinition owner :: \"dlm * data \\<Rightarrow> actor\" where \"owner d \\<equiv> fst(fst d)\"\ndefinition owns :: \"[igraph, location, actor, dlm * data] \\<Rightarrow> bool\"\n  where \"owns G l a d \\<equiv> owner d = a\"\ndefinition readers :: \"dlm * data \\<Rightarrow> actor set\"\n  where \"readers d \\<equiv> snd (fst d)\"\n\ntext \\<open>The predicate @{text \\<open>has_access\\<close>} is true for owners or readers.\\<close> \ndefinition has_access :: \"[igraph, location, actor, dlm * data] \\<Rightarrow> bool\"    \nwhere \"has_access G l a d \\<equiv> owns G l a d \\<or> a \\<in> readers d\"\n\n(*\ntext \\<open>Actors can delete data.\\<close>\ndefinition actor_can_delete ::   \"[infrastructure, actor, location] \\<Rightarrow> bool\"\nwhere actor_can_delete_def: \"actor_can_delete I h l \\<equiv>  \n                   (\\<forall> as n. ((h, as), n) \\<notin> (snd (lgra (graphI I) l)))\"\n*)\ntext \\<open>We define a type of functions that preserves the security labeling and a \n   corresponding function application  operator.\\<close>  \ntypedef label_fun = \"{f :: dlm * data \\<Rightarrow> dlm * data. \n                        \\<forall> x:: dlm * data. fst x = fst (f x)}\"  \n  by (fastforce)\n\ndefinition secure_process :: \"label_fun \\<Rightarrow> dlm * data \\<Rightarrow> dlm * data\" (infixr \"\\<Updown>\" 50)\n  where \"f  \\<Updown> d \\<equiv> (Rep_label_fun f) d\" \n\n(* This part is relevant to model Insiders but is not needed for Infrastructures.\n\ndatatype psy_states = happy | depressed | disgruntled | angry | stressed\ndatatype motivations = financial | political | revenge | curious | competitive_advantage | power | peer_recognition\n\ndatatype actor_state = Actor_state \"psy_states\" \"motivations set\"\nprimrec motivation :: \"actor_state \\<Rightarrow> motivations set\" \nwhere \"motivation  (Actor_state p m) =  m\"\nprimrec psy_state :: \"actor_state \\<Rightarrow> psy_states\" \nwhere \"psy_state  (Actor_state p m) = p\"\n\ndefinition tipping_point :: \"actor_state \\<Rightarrow> bool\" where\n  \"tipping_point a \\<equiv> ((motivation a \\<noteq> {}) \\<and> (happy \\<noteq> psy_state a))\"\n\nconsts astate :: \"identity \\<Rightarrow> actor_state\"\n\n(* Two versions of an impersonation predicate \"a can act as b\". \n   The first one is stronger and allows substitution of the insider in any context; \n   the second one is parameterized over a context predicate to describe this.   *)\ndefinition UasI ::  \"[identity, identity] \\<Rightarrow> bool \" \nwhere \"UasI a b \\<equiv> (Actor a = Actor b) \\<and> (\\<forall> x y. x \\<noteq> a \\<and> y \\<noteq> a \\<and> Actor x = Actor y \\<longrightarrow> x = y)\"\n\ndefinition UasI' ::  \"[actor => bool, identity, identity] \\<Rightarrow> bool \" \nwhere \"UasI' P a b \\<equiv> P (Actor b) \\<longrightarrow> P (Actor a)\"\n\ndefinition Insider :: \"[identity, identity set] \\<Rightarrow> bool\" \nwhere \"Insider a C \\<equiv> (tipping_point (astate a) \\<longrightarrow> (\\<forall> b\\<in>C. UasI a b))\"\n\ndefinition Insider' :: \"[actor \\<Rightarrow> bool, identity, identity set] \\<Rightarrow> bool\" \nwhere \"Insider' P a C \\<equiv> (tipping_point (astate a) \\<longrightarrow> (\\<forall> b\\<in>C. UasI' P a b \\<and> inj_on Actor C))\"\n*)\n\ntext \\<open>The predicate atI -- mixfix syntax @{text \\<open>@\\<^bsub>G\\<^esub>\\<close>} -- expresses that an actor (identity) \n      is at a certain location in an igraph.\\<close>\ndefinition atI :: \"[identity, igraph, location] \\<Rightarrow> bool\" (\"_ @\\<^bsub>(_)\\<^esub> _\" 50)\nwhere \"a @\\<^bsub>G\\<^esub> l \\<equiv> a \\<in> (agra G l)\"\n\ntext \\<open>Policies specify the expected behaviour of actors of an infrastructure. \nThey are defined by the @{text \\<open>enables\\<close>} predicate:\nan actor @{text \\<open>h\\<close>} is enabled to perform an action @{text \\<open>a\\<close>} \nin infrastructure @{text \\<open>I\\<close>}, at location @{text \\<open>l\\<close>}\nif there exists a pair @{text \\<open>(p,e)\\<close>} in the local policy of @{text \\<open>l\\<close>}\n(@{text \\<open>delta I l\\<close>} projects to the local policy) such that the action \n@{text \\<open>a\\<close>} is a member of the action set @{text \\<open>e\\<close>} and the policy \npredicate @{text \\<open>p\\<close>} holds for actor @{text \\<open>h\\<close>}.\\<close>\ndefinition enables :: \"[infrastructure, location, actor, action] \\<Rightarrow> bool\"\nwhere\n\"enables I l a a' \\<equiv>  (\\<exists> (p,e) \\<in> delta I (graphI I) l. a' \\<in> e \\<and> p a)\"\n\ntext \\<open>The behaviour is the good behaviour, i.e. everything allowed by the policy of infrastructure I.\\<close>\ndefinition behaviour :: \"infrastructure \\<Rightarrow> (location * actor * action)set\"\nwhere \"behaviour I \\<equiv> {(t,a,a'). enables I t a a'}\"\n\ntext \\<open>The misbehaviour is the complement of the behaviour of an infrastructure I.\\<close>\ndefinition misbehaviour :: \"infrastructure \\<Rightarrow> (location * actor * action)set\"\nwhere \"misbehaviour I \\<equiv> -(behaviour I)\"\n\nsubsection \"State transition on infrastructures\"\ntext \\<open>The state transition defines how actors may act on infrastructures through actions\n    within the boundaries of the policy. It is given as an inductive definition over the \n    states which are infrastructures.  This state transition relation is dependent on actions but also on\n    enabledness and the current state of the infrastructure.\n\n    First we introduce some auxiliary functions dealing\n    with repetitions in lists and actors moving in an igraph.\\<close>\nprimrec jonce :: \"['a, 'a list] \\<Rightarrow> bool\"\nwhere\njonce_nil: \"jonce a [] = False\" |\njonce_cons: \"jonce a (x#ls) = (if x = a then (a \\<notin> (set ls)) else jonce a ls)\"\n(*\nprimrec nodup :: \"['a, 'a list] \\<Rightarrow> bool\"\n  where \n    nodup_nil: \"nodup a [] = True\" |\n    nodup_step: \"nodup a (x # ls) = (if x = a then (a \\<notin> (set ls)) else nodup a ls)\"\n*)\ndefinition move_graph_a :: \"[identity, location, location, igraph] \\<Rightarrow> igraph\"\nwhere \"move_graph_a n l l' g \\<equiv> Lgraph (gra g) \n                    (if n \\<in> ((agra g) l) &  n \\<notin> ((agra g) l') then \n                     ((agra g)(l := (agra g l) - {n}))(l' := (insert n (agra g l')))\n                     else (agra g))(cgra g)(lgra g)\"\n\ninductive state_transition_in :: \"[infrastructure, infrastructure] \\<Rightarrow> bool\" (\"(_ \\<rightarrow>\\<^sub>n _)\" 50)\nwhere\n  move: \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; l \\<in> nodes G; l' \\<in> nodes G;\n          (a) \\<in> actors_graph(graphI I); enables I l' (Actor a) move;\n         I' = Infrastructure (move_graph_a a l l' (graphI I))(delta I) \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\" \n| get : \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; a' @\\<^bsub>G\\<^esub> l; has G (Actor a, z);\n        enables I l (Actor a) get;\n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)\n                           ((cgra G)(Actor a' := \n                                (insert z (fst(cgra G (Actor a'))), snd(cgra G (Actor a')))))\n                           (lgra G))\n                   (delta I)\n         \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| get_data : \"G = graphI I \\<Longrightarrow> a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n        enables I l' (Actor a) get \\<Longrightarrow> \n       ((Actor a', as), n) \\<in> snd (lgra G l') \\<Longrightarrow> Actor a \\<in> as \\<Longrightarrow> \n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := (fst (lgra G l), \n                                   snd (lgra G l)  \\<union> {((Actor a', as), n)}))))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| process : \"G = graphI I \\<Longrightarrow> a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n        enables I l (Actor a) eval \\<Longrightarrow> \n       ((Actor a', as), n) \\<in> snd (lgra G l) \\<Longrightarrow> Actor a \\<in> as \\<Longrightarrow>\n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := (fst (lgra G l), \n                    snd (lgra G l)  - {((Actor a', as), n)}\n                    \\<union> {(f :: label_fun) \\<Updown> ((Actor a', as), n)}))))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"  \n| del_data : \"G = graphI I \\<Longrightarrow> a \\<in> actors G \\<Longrightarrow> l \\<in> nodes G \\<Longrightarrow>\n       ((Actor a, as), n) \\<in> snd (lgra G l) \\<Longrightarrow> \n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)\n                   ((lgra G)(l := (fst (lgra G l), snd (lgra G l) - {((Actor a, as), n)}))))\n                   (delta I)\n         \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| put : \"G = graphI I \\<Longrightarrow> a @\\<^bsub>G\\<^esub> l \\<Longrightarrow> enables I l (Actor a) put \\<Longrightarrow>\n        I' = Infrastructure \n                  (Lgraph (gra G)(agra G)(cgra G)\n                          ((lgra G)(l := (s, snd (lgra G l) \\<union> {((Actor a, as), n)}))))\n                   (delta I)\n          \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n\ntext \\<open>Note that the type infrastructure can now be instantiated to the axiomatic type class \n      @{text\\<open>state\\<close>} which enables the use of the underlying Kripke structures and CTL.\\<close>\ninstantiation \"infrastructure\" :: state\nbegin\ndefinition \n   state_transition_infra_def: \"(i \\<rightarrow>\\<^sub>i i') =  (i \\<rightarrow>\\<^sub>n (i' :: infrastructure))\"\n\ninstance\n  by (rule MC.class.MC.state.of_class.intro)\n\ndefinition state_transition_in_refl (\"(_ \\<rightarrow>\\<^sub>n* _)\" 50)\nwhere \"s \\<rightarrow>\\<^sub>n* s' \\<equiv> ((s,s') \\<in> {(x,y). state_transition_in x y}\\<^sup>*)\"\n\nend\n      \nlemma move_graph_eq: \"move_graph_a a l l g = g\"  \n  by (simp add: move_graph_a_def, case_tac g, force)\n     \nend\n\n  ", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Attack_Trees/Infrastructure.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.629774621301746, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3099675967827764}}
{"text": "(*  Title:       Conflict analysis/Flowgraphs\n    Author:      Peter Lammich <peter.lammich@uni-muenster.de>\n    Maintainer:  Peter Lammich <peter.lammich@uni-muenster.de>\n*)\nsection \"Flowgraphs\"\ntheory Flowgraph\nimports Main Misc\nbegin\ntext_raw \\<open>\\label{thy:Flowgraph}\\<close>\n\ntext \\<open>\n  We use a flowgraph-based program model that extends the one we used previously \\<^cite>\\<open>\"LM07\"\\<close>. \n  A program is represented as an edge annotated graph and a set of procedures. The nodes of the graph are partitioned by the procedures, i.e. every node belongs to exactly one procedure. There are no edges\n  between nodes of different procedures. Every procedure has a distinguished entry and return node and a set of monitors it synchronizes on. Additionally, the program has a distinguished {\\em main} procedure.\n  The edges are annotated with statements. A statement is either a base statement, a procedure call or a thread creation (spawn). Procedure calls and thread creations refer to the called procedure or to the initial procedure\n  of the spawned thread, respectively.\n\n  We require that the main procedure and any initial procedure of a spawned thread does not to synchronize on any monitors. This avoids that spawning of a procedure together with entering a monitor is available in our \n  model as an atomic step, which would be an unrealistic assumption for practical problems. Technically, our model would become strictly more powerful without this assumption.\n\n\n  If we allowed this, our model would become strictly more powerful, \n\\<close>\n\nsubsection \"Definitions\"\n  \ndatatype ('p,'ba) edgeAnnot = Base 'ba | Call 'p | Spawn 'p\ntype_synonym ('n,'p,'ba) edge = \"('n \\<times> ('p,'ba) edgeAnnot \\<times> 'n)\"\n\nrecord ('n,'p,'ba,'m) flowgraph_rec =\n  edges :: \"('n,'p,'ba) edge set\" \\<comment> \\<open>Set of annotated edges\\<close>\n  main :: \"'p\" \\<comment> \\<open>Main procedure\\<close>\n  entry :: \"'p \\<Rightarrow> 'n\" \\<comment> \\<open>Maps a procedure to its entry point\\<close>\n  return :: \"'p \\<Rightarrow> 'n\" \\<comment> \\<open>Maps a procedure to its return point\\<close>\n  mon :: \"'p \\<Rightarrow> 'm set\" \\<comment> \\<open>Maps procedures to the set of monitors they allocate\\<close>\n  proc_of :: \"'n \\<Rightarrow> 'p\" \\<comment> \\<open>Maps a node to the procedure it is contained in\\<close>\n\ndefinition \n  \"initialproc fg p == p=main fg \\<or> (\\<exists>u v. (u,Spawn p,v)\\<in>edges fg)\"\n\nlemma main_is_initial[simp]: \"initialproc fg (main fg)\"\n  by (unfold initialproc_def) simp\n\nlocale flowgraph =\n  fixes fg :: \"('n,'p,'ba,'m,'more) flowgraph_rec_scheme\" (structure)\n  (* Type annotation unnecessary, but perhaps makes it more readable\n     for the unaware reader ;) *)\n  \\<comment> \\<open>Edges are inside procedures only\\<close>\n  assumes edges_part: \"(u,a,v)\\<in>edges fg \\<Longrightarrow> proc_of fg u = proc_of fg v\" \n  \\<comment> \\<open>The entry point of a procedure must be in that procedure\\<close>\n  assumes entry_valid[simp]: \"proc_of fg (entry fg p) = p\" \n  \\<comment> \\<open>The return point of a procedure must be in that procedure\\<close>\n  assumes return_valid[simp]: \"proc_of fg (return fg p) = p\" \n  \\<comment> \\<open>Initial procedures do not synchronize on any monitors\\<close>\n  assumes initial_no_mon[simp]: \"initialproc fg p \\<Longrightarrow> mon fg p = {}\" \n\nsubsection \"Basic properties\"\nlemma (in flowgraph) spawn_no_mon[simp]: \n  \"(u, Spawn p, v) \\<in> edges fg \\<Longrightarrow> mon fg p = {}\" \n  using initial_no_mon by (unfold initialproc_def, blast)\nlemma (in flowgraph) main_no_mon[simp]: \"mon fg (main fg) = {}\" \n  using initial_no_mon by (unfold initialproc_def, blast)\n\n\n\nlemma (in flowgraph) entry_entry_same_proc[simp]: \n  \"entry fg p = entry fg p' \\<Longrightarrow> p=p'\"\n  apply (subgoal_tac \"proc_of fg (entry fg p) = proc_of fg (entry fg p')\")\n  apply (simp (no_asm_use))\n  by simp\n\nlemma (in flowgraph) return_return_same_proc[simp]: \n  \"return fg p = return fg p' \\<Longrightarrow> p=p'\"\n  apply (subgoal_tac \"proc_of fg (return fg p) = proc_of fg (entry fg p')\")\n  apply (simp (no_asm_use))\n  by simp\n\nsubsection \"Extra assumptions for flowgraphs\"\ntext_raw \\<open>\\label{sec:Flowgraph:extra_asm}\\<close>\ntext \\<open>\n  In order to simplify the definition of our restricted schedules (cf. Section~\\ref{thy:Normalization}), we make some extra constraints on flowgraphs. \n  Note that these are no real restrictions, as we can always rewrite flowgraphs to match these constraints, preserving the set of conflicts. We leave it to future work to consider such a rewriting formally. \n\n  The background of this restrictions is that we want to start an execution of a thread with a procedure call that never returns. This will allow easier technical treatment in Section~\\ref{thy:Normalization}. Here we enforce this\n  semantic restrictions by syntactic properties of the flowgraph.\n\\<close>\n\ntext \\<open>The return node of a procedure is called {\\em isolated}, if it has no incoming edges and is different from the entry node. A procedure with an isolated return node will never return. \n  See Section~\\ref{sec:Normalization:eflowgraph} for a proof of this.\\<close>\ndefinition \n  \"isolated_ret fg p == \n    (\\<forall>u l. \\<not>(u,l,return fg p)\\<in>edges fg) \\<and> entry fg p \\<noteq> return fg p\"\n\ntext \\<open>The following syntactic restrictions guarantee that each thread's execution starts with a non-returning call. See Section~\\ref{sec:Normalization:eflowgraph} for a proof of this.\\<close>\nlocale eflowgraph = flowgraph +\n  \\<comment> \\<open>Initial procedure's entry node isn't equal to its return node\\<close>\n  assumes initial_no_ret: \"initialproc fg p \\<Longrightarrow> entry fg p \\<noteq> return fg p\" \n  \\<comment> \\<open>The only outgoing edges of initial procedures' entry nodes are call edges to procedures with isolated return node\\<close>\n  assumes initial_call_no_ret: \"\\<lbrakk>initialproc fg p; (entry fg p,l,v)\\<in>edges fg\\<rbrakk> \n    \\<Longrightarrow> \\<exists>p'. l=Call p' \\<and> isolated_ret fg p'\" \n\nsubsection \\<open>Example Flowgraph\\<close>\ntext_raw \\<open>\\label{sec:Flowgraph:ex_flowgraph}\\<close>\ntext \\<open>This section contains a check that there exists a (non-trivial) flowgraph, i.e. that the assumptions made in the \\<open>flowgraph\\<close> and \\<open>eflowgraph\\<close> \n  locales are consistent and have at least one non-trivial model.\\<close>\ndefinition \n  \"example_fg == \\<lparr> \n    edges = {((0::nat,0::nat),Call 1,(0,1)), ((1,0),Spawn 0,(1,0)), \n             ((1,0),Call 0, (1,0))}, \n    main = 0, \n    entry = \\<lambda>p. (p,0), \n    return = \\<lambda>p. (p,1), \n    mon = \\<lambda>p. if p=1 then {0} else {}, \n    proc_of= \\<lambda> (p,x). p \\<rparr>\"\n\nlemma exists_eflowgraph: \"eflowgraph example_fg\"\n  apply (unfold_locales)\n  apply (unfold example_fg_def)\n  apply simp\n  apply fast\n  apply simp\n  apply simp\n  apply (simp add: initialproc_def)\n  apply (simp add: initialproc_def)\n  apply (simp add: initialproc_def isolated_ret_def)\n  done\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Program-Conflict-Analysis/Flowgraph.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297745935070806, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3099675831025719}}
{"text": "(* TODO: Rename. *)\ntheory Idk\n  imports\n    Walk\nbegin\n\ncontext other\nbegin\n\ndefinition tbd :: \"('a, 'b) multigraph \\<Rightarrow> 'b set \\<Rightarrow> ('a, 'b) edge \\<Rightarrow> ('a, 'b) multigraph\" where\n  \"tbd G X e \\<equiv>\n   {e'. \\<exists>p u v. walk G p u v \\<and>\n                e \\<in> set p \\<and>\n                e' \\<in> set p \\<and>\n                set (tl (butlast (walk_vertices p u))) \\<inter> X = {}}\"\n\nlemma tbd_subset:\n  shows \"tbd G X e \\<subseteq> G\"\n  sorry\n\ndefinition tbds :: \"('a, 'b) multigraph \\<Rightarrow> 'b set \\<Rightarrow> ('a, 'b) multigraph set\" where\n  \"tbds G X \\<equiv> {E. \\<exists>e\\<in>G. E = tbd G X e}\"\n\nlemma tbds_image_cong:\n  shows \"tbds G X = (tbd G X) ` G\"\n  by (auto simp add: tbds_def)\n\nend\n\nend", "meta": {"author": "mitjakrebs", "repo": "master-s-thesis", "sha": "103462c6116a90004f6c0654748bccaf4bfd67be", "save_path": "github-repos/isabelle/mitjakrebs-master-s-thesis", "path": "github-repos/isabelle/mitjakrebs-master-s-thesis/master-s-thesis-103462c6116a90004f6c0654748bccaf4bfd67be/Graph/Undirected_Graph/Idk.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723317123102956, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.309956200638827}}
{"text": "theory AxiomaticSoundProof\nimports Main SC11 AxiomaticModel\nbegin\n\nlocale axiomaticProof = axiomaticModel\nbegin\n\ndefinition locMentioned where\n\"locMentioned T rho = {loc . \\<exists> t tid aid . t \\<in> T \\<and> rho t = Some (tid,aid,Create loc)}\"\n\ndefinition modificationOrder where\n\"modificationOrder T rho x = {(a,b) . a \\<in> T \\<and> b \\<in> T \\<and> a < b \\<and>\n          (\\<exists> tid1 aid1 tid2 aid2 ac1 ac2 . rho a = Some (tid1,aid1, ac1) \\<and> rho b = Some (tid2,aid2,ac2)\n             \\<and> isWrite ac1 \\<and> isWrite ac2 \\<and> acLoc ac1 = Some x \\<and> acLoc ac2 = Some x)}\"\n\n(*first, we prove that our model satisfies modification rules on all locations of all threads \n   it means that there is a modification order of writes on every location that no thread will violate. *)\nlemma satMo : \"\\<forall> Tid T rho sb rf Locs . validExecution Tid T rho sb rf \\<and> Locs = locMentioned T rho \\<longrightarrow> \n               (\\<forall> S x tid a b t1 t2 . S = observeMem Tid T rho sb rf Locs \\<and>\n                    (tid,a,x,Some t1) \\<in> S \\<and> (tid,b,x,Some t2) \\<in> S \\<and> a < b\n                  \\<longrightarrow> (t1 = t2 \\<or> (t1,t2) \\<in> (modificationOrder T rho x)))\"\n  apply simp\n  sorry\n\n(* second, we show that our model satisfy SRA model, with satMo lemma and sb U rf U Ux mo is acyclic. *)\ndefinition acqRelAbove where\n\"acqRelAbove T rho = (\\<forall> a tid aid ac . a \\<in> T \\<and> rho a = Some (tid,aid,ac) \\<and> \\<not> isFenceLike ac\n                     \\<longrightarrow> hasAtLeastAcqRel ac)\"\n\ndefinition moUnion where\n\"moUnion T rho Locs = {(a,b) . (\\<exists> x \\<in> Locs . (a,b) \\<in> modificationOrder T rho x)}\"\n\ndefinition sbUnion where\n\"sbUnion sb' Tid = {(a,b) . (\\<exists> x \\<in> Tid . (a,b) \\<in> the (sb' x))}\"\n\nlemma sbRfMosAcyclic : \"\\<forall> Tid T rho sb rf Locs . validExecution Tid T rho sb rf \\<and>\n             acqRelAbove T rho \\<longrightarrow> acyclic ((moUnion T rho Locs) \\<union> sbUnion sb Tid \\<union> rf)\"\n  sorry\n\n\n\n(* definition and proof of the sat of SeqCst ops, atomicity is guaranteed since we do not \n   split rmw to two different ops. \n   Only need for coherence, sc and no-thin-air *)\n\ndefinition onlySeq where\n\"onlySeq T rho = (\\<forall> a tid aid ac or . a \\<in> T \\<and> rho a = Some (tid,aid,ac) \\<and> acOrder ac = Some or\n                     \\<longrightarrow> or = SeqCst)\"\n\ndefinition rb where\n\"rb T rho rf' Locs = relcomp (converse rf') (moUnion T rho Locs)\"\n\ndefinition eco where\n\"eco T rho rf' Locs = trancl ((rb T rho rf' Locs) \\<union> rf' \\<union> (moUnion T rho Locs))\"\n\nfun rseMyModel where\n\"rseMyModel rho a b =\n    (sameThread rho a b \\<or> isRMWInTuple (rho b))\"\n\nfun rsMyModel where\n\"rsMyModel T rho mo' a_rel b =\n   (isRelWrite rho a_rel \\<and>\n    ((b = a_rel) \\<or>\n      (rseMyModel rho a_rel b \\<and> (a_rel,b) \\<in> mo' \\<and>\n        (\\<forall> c \\<in> T . ((a_rel,c) \\<in> mo' \\<and> (c,b) \\<in> mo') \\<longrightarrow> rseMyModel rho a_rel c))))\"\n\nfun rsMyModelSet where\n\"rsMyModelSet T rho Locs =\n {(a,b) . a \\<in> T \\<and> b \\<in> T \\<and> rsMyModel T rho (moUnion T rho Locs) a b}\"\n\nfun hrsMyModel where\n\"hrsMyModel T rho mo' a b =\n   ((a = b) \\<or>\n      (rseMyModel rho a b \\<and> (a,b) \\<in> mo' \\<and> \n        (\\<forall> c \\<in> T . ((a,c) \\<in> mo' \\<and> (c,b) \\<in> mo') \\<longrightarrow> rseMyModel rho a c)))\"\n\nfun hrsMyModelSet where\n\"hrsMyModelSet T rho Locs =\n  {(a,b) . a \\<in> T \\<and> b \\<in> T \\<and> hrsMyModel T rho (moUnion T rho Locs) a b}\"\n\nfun swMyModel where\n\"swMyModel T rho sb' rf' rs hrs a b =\n    (sameLocInTuple rho a b \\<and>\n     (( isRelWrite rho a \\<and> isAcqRead rho b \\<and> \\<not> (sameThread rho a b) \\<and>\n          (\\<exists> c \\<in> T . (a,c) \\<in> rs \\<and> (c,b) \\<in> rf' )) \\<or>\n        (\\<not> (sameThread rho a b) \\<and>\n          isRealFenceInTuple rho a \\<and> isRelWrite rho a \\<and> isRealFenceInTuple rho b \\<and> isAcqRead rho b \\<and>\n          (\\<exists> x \\<in> T . (\\<exists> y \\<in> T . sameLocInTuple rho x y \\<and>\n              isAtomicInTuple rho x \\<and> isAtomicInTuple rho y \\<and> isWriteInTuple (rho x) \\<and>\n              (a,x) \\<in> sb' \\<and> (y,b) \\<in> sb' \\<and>\n              (\\<exists> z \\<in> T . (x,z) \\<in> hrs \\<and> (z,y) \\<in> rf')))) \\<or> \n        (\\<not> (sameThread rho a b) \\<and>\n          isRealFenceInTuple rho a \\<and> isRelWrite rho a \\<and> isAtomicInTuple rho b \\<and> isAcqRead rho b \\<and>\n          (\\<exists> x \\<in> T . sameLocInTuple rho x b \\<and>\n            isAtomicInTuple rho x \\<and> isWriteInTuple (rho x) \\<and> (a,x) \\<in> sb' \\<and>\n            (\\<exists> z \\<in> T . (x,z) \\<in> hrs \\<and> (z,b) \\<in> rf' ) ) ) \\<or>\n        (\\<not> (sameThread rho a b) \\<and>\n          isAtomicInTuple rho a \\<and> isRelWrite rho a \\<and>\n          isRealFenceInTuple rho b \\<and> isAcqRead rho b \\<and>\n          (\\<exists> x \\<in> T . sameLocInTuple rho a x \\<and> isAtomicInTuple rho x \\<and>\n            (x,b) \\<in> sb' \\<and>\n            (\\<exists> z \\<in> T . (a,z) \\<in> rs \\<and> (z,x) \\<in> rf' ) ) )))\"\n\nfun swMyModelSet where\n\"swMyModelSet T rho sb' rf' Locs =\n {(a,b) . a \\<in> T \\<and> b \\<in> T \\<and> swMyModel T rho sb' rf' (rsMyModelSet T rho Locs) (hrsMyModelSet T rho Locs) a b}\"\n\nfun hbMyModelSet where\n\"hbMyModelSet T rho sb' rf' Locs = trancl (sb' \\<union> swMyModelSet T rho sb' rf' Locs)\"\n\n\nlemma coherence : \"\\<forall> Tid T rho sb rf Locs . validExecution Tid T rho sb rf \\<and> acqRelAbove T rho\n                    \\<longrightarrow> (\\<forall> a \\<in> T . (a,a) \\<notin> (relcomp (hbMyModelSet T rho (sbUnion sb Tid) rf Locs) (eco T rho rf Locs)))\"\n  sorry\n\nlemma noThinAir : \"\\<forall> Tid T rho sb rf Locs . validExecution Tid T rho sb rf \\<and>\n             acqRelAbove T rho \\<longrightarrow> acyclic (sbUnion sb Tid \\<union> rf)\"\n  apply simp\n  sorry\n\n\n\n\nend\n\nend", "meta": {"author": "liyili2", "repo": "timed-relaxed-memory-model", "sha": "6d85bc75d8b04228b3e581b945e3f672395f0c66", "save_path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model", "path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model/timed-relaxed-memory-model-6d85bc75d8b04228b3e581b945e3f672395f0c66/AxiomaticSoundProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878696277513, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3099465729230105}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory L2Opt\nimports L2Defs L2Peephole\nbegin\n\n(* Flow-sensitive simplification rules for L2 programs. *)\nnamed_theorems L2flow\n\n(*\n * The monads \"A\" and \"B\" are equivalent under precondition \"P\".\n * Additionally, under this precondition, they always leave the\n * postcondition \"Q\" (normally) or \"E\" (if an exception occurs).\n *)\ndefinition\n  \"monad_equiv P A B Q E \\<equiv> (\\<forall>s. P s \\<longrightarrow> A s = B s) \\<and> \\<lbrace> P \\<rbrace> A \\<lbrace> Q \\<rbrace>, \\<lbrace> E \\<rbrace>\"\n\nlemma monad_equivI [intro]:\n  \"\\<lbrakk> \\<And>s. P s \\<Longrightarrow> A s = B s; \\<lbrace> P \\<rbrace> A \\<lbrace> Q \\<rbrace>, \\<lbrace> E \\<rbrace> \\<rbrakk> \\<Longrightarrow> monad_equiv P A B Q E\"\n  apply (clarsimp simp: monad_equiv_def)\n  done\n\nlemma monad_equiv_eqI [intro]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> A \\<lbrace> Q \\<rbrace>, \\<lbrace> E \\<rbrace> \\<rbrakk> \\<Longrightarrow> monad_equiv P A A Q E\"\n  apply (clarsimp simp: monad_equiv_def)\n  done\n\nlemma monad_equiv_eq:\n    \"monad_equiv (\\<lambda>_. True) A B X Y \\<Longrightarrow> A = B\"\n  apply (rule ext)\n  apply (clarsimp simp: monad_equiv_def)\n  done\n\nlemma monad_equiv_triv [L2flow]:\n    \"monad_equiv P A A (\\<lambda>_ _. \\<exists>s. P s) (\\<lambda>_ _. \\<exists>s. P s)\"\n  apply rule\n  apply wp\n  apply force\n  done\n\nlemma monad_equiv_symmetric:\n  \"monad_equiv P A B X Y = monad_equiv P B A X Y\"\n  apply (clarsimp simp: monad_equiv_def validE_def2 Ball_def split: sum.splits)\n  apply force\n  done\n\nlemma monad_equivD: \"\\<lbrakk> monad_equiv P A B R E; P s \\<rbrakk> \\<Longrightarrow> A s = B s\"\n  apply (clarsimp simp: monad_equiv_def)\n  done\n\n(*\n * Show that under condition \"P\", the values \"A\" and \"B\" are equal.\n *\n * We use this to simplify expressions inside our monads in a (somewhat)\n * controlled fashion.\n *)\ndefinition \"simp_expr P A B \\<equiv> P \\<longrightarrow> A = B\"\n\nlemma simp_expr_triv: \"simp_expr P A A\"\n  apply (clarsimp simp: simp_expr_def)\n  done\n\nlemma simp_expr_P_cong:\n  \"\\<lbrakk> P = P' \\<rbrakk> \\<Longrightarrow> simp_expr P A B = simp_expr P' A B\"\n  apply (clarsimp simp: simp_expr_def)\n  done\n\nlemma simp_expr_rhs_cong [cong]:\n  \"\\<lbrakk> P = P'; P' \\<Longrightarrow> B = B' \\<rbrakk> \\<Longrightarrow> simp_expr P A B = simp_expr P' A B'\"\n  apply (clarsimp simp: simp_expr_def simp_implies_def)\n  done\n\nlemma simp_expr_weaken:\n  \"\\<lbrakk> simp_expr P A B; Q \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> simp_expr Q A B\"\n  apply (clarsimp simp: simp_expr_def)\n  done\n\n(*\n * Monad simplification rules.\n *\n * When solving \"monad_equiv P A B R E\", the l2_opt tactics assume that P is concrete;\n * to ensure this, monad_equiv rules should result in R being instantiated.\n * See e.g. monad_equiv_unreachable where we have to constrain the rule.\n *)\n\nlemma monad_equiv_gets [L2flow]:\n    \"simp_expr True v v' \\<Longrightarrow> monad_equiv P (L2_gets (\\<lambda>s. v s) n) (L2_gets (\\<lambda>s. v' s) n)\n        (\\<lambda>r s. P s \\<and> r = v' s) (\\<lambda>_ _. False)\"\n  apply rule\n   apply (clarsimp simp: L2_defs simp_expr_def)+\n  apply wpsimp\n  done\n\nlemma monad_equiv_throw [L2flow]:\n    \"simp_expr True v v' \\<Longrightarrow>\n       monad_equiv P (L2_throw v n) (L2_throw v' n) (\\<lambda>_ _. False) (\\<lambda>r s. P s \\<and> r = v')\"\n  apply (clarsimp simp: monad_equiv_def L2_defs simp_expr_def)\n  apply wp\n  apply force\n  done\n\nlemma monad_equiv_guard:\n    \"\\<lbrakk> \\<And>s. simp_expr (P s) (G s) (G' s) \\<rbrakk> \\<Longrightarrow>\n        monad_equiv P (L2_guard (\\<lambda>s. G s)) (L2_guard (\\<lambda>s. G' s)) (\\<lambda>r s. P s \\<and> G' s \\<and> r = ()) (\\<lambda>_ _. False)\"\n  apply (clarsimp simp: monad_equiv_def L2_defs simp_expr_def)\n  apply rule\n   apply (clarsimp simp: liftE_def guard_def bind_def in_return snd_return)\n  apply wp\n  apply force\n  done\n\n(* We use this weaker form of guard simplification to prevent bound\n * variables being expanded inside of guard statements. *)\nlemma monad_equiv_guard' [L2flow]:\n    \"\\<lbrakk> \\<And>s. simp_expr True (G s) (G' s) \\<rbrakk> \\<Longrightarrow>\n        monad_equiv P (L2_guard (\\<lambda>s. G s)) (L2_guard (\\<lambda>s. G' s)) (\\<lambda>r s. P s \\<and> G' s \\<and> r = ()) (\\<lambda>_ _. False)\"\n  apply (rule monad_equiv_guard)\n  apply (rule simp_expr_weaken)\n   apply assumption\n  apply simp\n  done\n\nlemma monad_equiv_guard_False [L2flow]:\n    \"\\<lbrakk> \\<And>s. simp_expr (P s) False (G s) \\<rbrakk>\n          \\<Longrightarrow> monad_equiv P (L2_guard G) (L2_fail) (\\<lambda>_ _. False) (\\<lambda>_ _. False)\"\n  apply (monad_eq simp: L2_defs monad_equiv_def simp_expr_def validE_def2)\n  done\n\nlemma monad_equiv_guard_True [L2flow]:\n    \"\\<lbrakk> \\<And>s. simp_expr (P s) True (G s) \\<rbrakk>\n          \\<Longrightarrow> monad_equiv P (L2_guard G) L2_skip (\\<lambda>r s. P s \\<and> r = ()) (\\<lambda>_ _. False)\"\n  apply (auto simp: L2_defs simp_expr_def guard_def liftE_def return_def returnOk_def bind_def validE_def valid_def)\n  done\n\nlemma monad_equiv_guard_conj [L2flow]:\n    \"\\<lbrakk> monad_equiv P (L2_guard G1) G1' R1 E1;\n       monad_equiv (\\<lambda>s. R1 () s) (L2_guard G2) G2' R2 E2 \\<rbrakk> \\<Longrightarrow>\n        monad_equiv P (L2_guard (\\<lambda>s. G1 s \\<and> G2 s)) (L2_seq G1' (\\<lambda>_. G2')) (\\<lambda>r s. R2 () s) (\\<lambda>_ _. False)\"\n  apply (subst (asm) (1 2) monad_equiv_symmetric)\n  apply (subst monad_equiv_symmetric)\n  apply rule\n   apply (monad_eq simp: L2_defs monad_equiv_def validE_def2 Bex_def Ball_def split: sum.splits)\n   apply fast\n  apply (monad_eq simp: monad_equiv_def L2_defs validE_def2 Ball_def split: sum.splits)\n  apply fast\n  done\n\nlemma monad_equiv_unknown [L2flow]:\n    \"monad_equiv P (L2_unknown name) (L2_unknown name) (\\<lambda>r s. P s) (\\<lambda>_ _. False)\"\n  apply (clarsimp simp: monad_equiv_def L2_defs)\n  apply (wp select_wp)\n  apply force\n  done\n\nlemma monad_equiv_modify [L2flow]:\n    \"\\<lbrakk> \\<And>s. simp_expr True (m s) (m' s) \\<rbrakk> \\<Longrightarrow>\n        monad_equiv P (L2_modify (\\<lambda>s. m s)) (L2_modify (\\<lambda>s. m' s)) (\\<lambda>r s'. \\<exists>s. P s \\<and> m' s = s' \\<and> r = ()) (\\<lambda>_ _. False)\"\n  apply rule\n   apply (clarsimp simp: L2_defs simp_expr_def liftE_def modify_def put_def get_def bind_def)\n  apply (clarsimp simp: L2_defs simp_expr_def)\n  apply wp\n  apply force\n  done\n\nlemma monad_equiv_spec [L2flow]:\n    \"\\<lbrakk> \\<And>s s'. simp_expr True ((s, s') \\<in> S) (S' s s') \\<rbrakk> \\<Longrightarrow>\n        monad_equiv P (L2_spec S) (L2_spec ({(s, s'). S' s s'})) (\\<lambda>r s. \\<exists>s. P s) (\\<lambda>_ _. False)\"\n  apply rule\n   apply (clarsimp simp: L2_defs simp_expr_def liftE_def spec_def bind_def)\n  apply (clarsimp simp: L2_defs)\n  apply wp\n  apply force\n  done\n\nlemma monad_equiv_fail [L2flow]:\n    \"monad_equiv P L2_fail L2_fail (\\<lambda>_ _. False) (\\<lambda>_ _. False)\"\n  apply (clarsimp simp: monad_equiv_def L2_defs)\n  done\n\nlemma monad_equiv_condition [L2flow]:\n  \"\\<lbrakk> \\<And>s. simp_expr True (C s) (C' s);\n     monad_equiv (\\<lambda>s. P s \\<and> C' s) L L' QL EL;\n     monad_equiv (\\<lambda>s. P s \\<and> \\<not> C' s) R R' QR ER \\<rbrakk> \\<Longrightarrow>\n   monad_equiv P (L2_condition (\\<lambda>s. C s) L R) (L2_condition (\\<lambda>s. C' s) L' R')\n      (\\<lambda>r s. \\<exists>s. P s) \\<comment> \\<open>Deliberately weak to avoid exponential growth.\\<close>\n      (\\<lambda>r s. \\<exists>s. P s)\"\n  apply rule\n   apply (monad_eq simp: L2_defs monad_equiv_def simp_expr_def split: condition_splits)\n  apply (monad_eq simp: L2_defs monad_equiv_def validE_def2 split: condition_splits sum.splits)\n  apply force\n  done\n\nlemma monad_equiv_condition_True [L2flow]:\n  \"\\<lbrakk> \\<And>s. simp_expr (P s) (C s) True;\n     monad_equiv P L L' QL EL \\<rbrakk> \\<Longrightarrow>\n     monad_equiv P (L2_condition C L R) L' QL EL\"\n  unfolding L2_defs condition_def\n  apply (monad_eq simp: simp_expr_def monad_equiv_def validE_def2 Ball_def split: sum.splits)\n  done\n\nlemma monad_equiv_condition_False [L2flow]:\n  \"\\<lbrakk> \\<And>s. simp_expr (P s) (C s) False;\n     monad_equiv P R R' QR ER \\<rbrakk> \\<Longrightarrow>\n     monad_equiv P (L2_condition C L R) R' QR ER\"\n  unfolding L2_defs condition_def\n  apply (monad_eq simp: simp_expr_def monad_equiv_def validE_def2 Ball_def split: sum.splits)\n  done\n\n(* C-parser sometimes generates boolean expressions like\n     if P then (if P then 1 else 0) else Q\n   This simplifies the branches. *)\nlemma monad_equiv_gets_if [L2flow]:\n   \"\\<lbrakk> \\<And>s. simp_expr (P s) True (b s) \\<rbrakk> \\<Longrightarrow>\n       monad_equiv P (L2_gets (\\<lambda>s. if (b s) then L else R) f)\n                     (L2_gets (\\<lambda>s. L) f) (%r s. P s) (\\<lambda>r s. False)\"\n   \"\\<lbrakk> \\<And>s. simp_expr (P s) False (b s) \\<rbrakk> \\<Longrightarrow>\n       monad_equiv P (L2_gets (\\<lambda>s. if (b s) then L else R) f)\n                     (L2_gets (\\<lambda>s. R) f) (%r s. P s) (\\<lambda>r s. False)\"\n  apply (monad_eq simp: L2_defs simp_expr_def monad_equiv_def\n         validE_def valid_def split: sum.splits)+\n  done\n\nlemma monad_equiv_seq [L2flow]:\n  \"\\<lbrakk> monad_equiv P A A' Q E;\n     \\<And>x. monad_equiv (Q x) (B x) (B' x) (R x) (E2 x) \\<rbrakk> \\<Longrightarrow>\n   monad_equiv P (L2_seq A (\\<lambda>x. B x)) (L2_seq A' (\\<lambda>x. B' x)) (\\<lambda>r s. \\<exists>r'. R r' r s) (\\<lambda>r s. \\<exists>s. P s)\"\n  apply rule\n   apply (clarsimp simp: monad_equiv_def L2_defs simp_expr_def)\n   apply (rule bindE_apply_cong)\n    apply simp\n   apply (clarsimp simp: validE_def valid_def)\n   apply force\n  apply (clarsimp simp: monad_equiv_def L2_defs\n               validE_def valid_def in_bindE simp_expr_def split: sum.splits)\n  apply (erule allE, erule (1) impE)+\n  apply fastforce\n  done\n\nlemma monad_equiv_catch [L2flow]:\n  \"\\<lbrakk> monad_equiv P A A' Q E;\n    \\<And>x. monad_equiv (E x) (B x) (B' x) (Q' x) (E2 x) \\<rbrakk> \\<Longrightarrow>\n   monad_equiv P (L2_catch A (\\<lambda>x. B x)) (L2_catch A' (\\<lambda>x. B' x)) (\\<lambda>r s. \\<exists>s. P s) (\\<lambda>r s. \\<exists>r'. E2 r' r s)\"\n  apply rule\n   apply atomize\n   apply (clarsimp simp: simp_expr_def L2_defs monad_equiv_def)\n   apply (erule allE, erule impE, assumption)\n   apply (clarsimp simp: validE_def2 split: sum.splits)\n   apply (erule allE, erule impE, assumption)\n   apply (rule monad_state_eqI)\n     apply (clarsimp simp: in_handleE')\n     apply force\n    apply (clarsimp simp: in_handleE')\n    apply force\n   apply (fastforce simp: snd_handleE')\n  apply (clarsimp simp: monad_equiv_def L2_defs\n      validE_def valid_def simp_expr_def in_handleE' split: sum.splits)\n  apply (erule allE, erule (1) impE)+\n  apply fastforce\n  done\n\nlemma monad_equiv_cong:\n  \"\\<lbrakk> \\<And>s. P s = P' s;\n     \\<And>s. P s \\<Longrightarrow> A s = A' s;\n     \\<And>s. P s \\<Longrightarrow> B s = B' s;\n     \\<And>s s' r. P s \\<Longrightarrow> Q r s' = Q' r s';\n     \\<And>s s' r. P s \\<Longrightarrow> R r s' = R' r s' \\<rbrakk> \\<Longrightarrow>\n   monad_equiv P A B Q R = monad_equiv P' A' B' Q' R'\"\n  apply atomize\n  apply (clarsimp simp: monad_equiv_def validE_def valid_def split: sum.splits)\n  apply (rule iffI)\n   apply clarsimp\n   apply fastforce\n  apply clarsimp\n  apply fastforce\n  done\n\nlemma monad_equiv_while [L2flow]:\n  assumes cond_simp: \"\\<And>s r. simp_expr True (c r s) (c' r s)\"\n  assumes body_equiv: \"\\<And>r. monad_equiv (\\<lambda>s. (\\<exists>s'. P s') \\<and> c' r s) (B r) (B' r) (Q r) (E r)\"\n  assumes init_simp: \"\\<And>s r. simp_expr True x x'\"\n  shows \"monad_equiv P (L2_while (\\<lambda>r s. c r s) B x n) (L2_while (\\<lambda>r s. c' r s) B' x' n) (\\<lambda>r s. \\<not> c' r s \\<and> (\\<exists>x. P x)) (\\<lambda>r s. \\<exists>x. E x r s)\"\n  apply (insert cond_simp [unfolded simp_expr_def] init_simp [unfolded simp_expr_def])\n  apply rule\n   apply (clarsimp simp: L2_while_def)\n   apply (rule whileLoopE_cong [THEN fun_cong, THEN fun_cong])\n     apply force\n    apply (cut_tac r=r in body_equiv)\n    apply (clarsimp simp: monad_equiv_def)\n    apply (erule allE, erule impE, auto)[1]\n   apply simp\n  apply (clarsimp simp: L2_while_def)\n  apply (rule validE_whileLoopE [where I=\"\\<lambda>r s. \\<exists>s. P s\"])\n    apply force\n   apply (cut_tac r=r in body_equiv)\n   apply (clarsimp simp: validE_def valid_def monad_equiv_def split: sum.splits)\n   apply blast\n  apply simp\n  done\n\nlemma monad_equiv_recguard [L2flow]:\n  \"\\<lbrakk> monad_equiv P B B' Q E \\<rbrakk> \\<Longrightarrow>\n    monad_equiv P (L2_recguard a B) (L2_recguard a B') Q E\"\n  apply rule\n   apply (clarsimp simp: L2_recguard_def monad_equiv_def valid_def validE_def\n        split: sum.splits condition_splits)\n  apply (clarsimp simp: L2_recguard_def monad_equiv_def valid_def validE_def in_fail\n       split: sum.splits condition_splits)\n  done\n\nlemma monad_equiv_unreachable' [L2flow]:\n  \"monad_equiv (\\<lambda>_. False) L (L2_gets (\\<lambda>_. undefined) [''L2Opt_internal_var'']) Q R\"\n  by (simp add: monad_equiv_def)\n\n(* avoid leaving schematic Q in goal *)\nlemma monad_equiv_unreachable [L2flow]:\n  \"monad_equiv (\\<lambda>_. False) L (L2_gets (\\<lambda>_. undefined) [''L2Opt_internal_var'']) (\\<lambda>_ _. False) R\"\n  by (rule monad_equiv_unreachable')\n\nlemma monad_equiv_split [L2flow]:\n  \"\\<lbrakk> \\<And>a b. monad_equiv (P (a, b)) (X a b) (Y a b) (Q a b) (E a b) \\<rbrakk> \\<Longrightarrow>\n    monad_equiv (P x) (case x of (a, b) \\<Rightarrow> X a b) (case x of (a, b) \\<Rightarrow> Y a b)\n          (case x of (a, b) \\<Rightarrow> Q a b) (case x of (a, b) \\<Rightarrow> E a b)\"\n  apply (clarsimp simp: monad_equiv_def validE_def valid_def split_def)\n  done\n\nlemma simp_expr_solve_constant: \"\\<lbrakk> A \\<Longrightarrow> B = C \\<rbrakk> \\<Longrightarrow> simp_expr A B C\"\n  by (clarsimp simp: simp_expr_def)\n\nlemma monad_equiv_weaken_pre':\n  \"\\<lbrakk> \\<And>s. P' s \\<Longrightarrow> P s; monad_equiv P L R Q E \\<rbrakk> \\<Longrightarrow> monad_equiv P' L R Q E\"\n  by (fastforce simp: monad_equiv_def validE_def valid_def)\n\nlemma monad_equiv_weaken_pre'':\n  \"\\<lbrakk> P' \\<equiv> P; monad_equiv P L R Q E \\<rbrakk> \\<Longrightarrow> monad_equiv P' L R Q E\"\n  by (fastforce simp: monad_equiv_def validE_def valid_def)\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/L2Opt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.30994656581204544}}
{"text": "theory Converter_Rewrite imports\n  Converter\nbegin\n\nsection \\<open>Equivalence of converters restricted by interfaces\\<close>\n\ncoinductive eq_resource_on :: \"'a set \\<Rightarrow> ('a, 'b) resource \\<Rightarrow> ('a, 'b) resource \\<Rightarrow> bool\" (\"_ \\<turnstile>\\<^sub>R/ _ \\<sim>/ _\" [100, 99, 99] 99)\n  for A where\n    eq_resource_onI: \"A \\<turnstile>\\<^sub>R res \\<sim> res'\" if\n    \"\\<And>a. a \\<in> A \\<Longrightarrow> rel_spmf (rel_prod (=) (eq_resource_on A)) (run_resource res a) (run_resource res' a)\"\n\nlemma eq_resource_on_coinduct [consumes 1, case_names eq_resource_on, coinduct pred: eq_resource_on]:\n  assumes \"X res res'\"\n    and \"\\<And>res res' a. \\<lbrakk> X res res'; a \\<in> A \\<rbrakk>\n      \\<Longrightarrow> rel_spmf (rel_prod (=) (\\<lambda>res res'. X res res' \\<or> A \\<turnstile>\\<^sub>R res \\<sim> res')) (run_resource res a) (run_resource res' a)\"\n  shows \"A \\<turnstile>\\<^sub>R res \\<sim> res'\"\n  using assms(1) by(rule eq_resource_on.coinduct)(auto dest: assms(2))\n\nlemma eq_resource_onD:\n  assumes \"A \\<turnstile>\\<^sub>R res \\<sim> res'\" \"a \\<in> A\"\n  shows \"rel_spmf (rel_prod (=) (eq_resource_on A)) (run_resource res a) (run_resource res' a)\"\n  using assms by(auto elim: eq_resource_on.cases)\n\nlemma eq_resource_on_refl [simp]: \"A \\<turnstile>\\<^sub>R res \\<sim> res\"\n  by(coinduction arbitrary: res)(auto intro: rel_spmf_reflI)\n\n\n\nlemma eq_resource_on_sym: \"A \\<turnstile>\\<^sub>R res \\<sim> res'\" if \"A \\<turnstile>\\<^sub>R res' \\<sim> res\"\n  using that\n  by(coinduction arbitrary: res res')\n    (drule (1) eq_resource_onD, rewrite in \"\\<hole>\" conversep_iff[symmetric]\n      , auto simp add: spmf_rel_conversep[symmetric] elim!: rel_spmf_mono)\n\n\n\n\n\nlemma eq_resource_on_UNIV_iff: \"UNIV \\<turnstile>\\<^sub>R res \\<sim> res' \\<longleftrightarrow> res = res'\"\n  by(auto dest: eq_resource_on_UNIV_D)\n\nlemma eq_resource_on_mono: \"\\<lbrakk> A' \\<turnstile>\\<^sub>R res \\<sim> res'; A \\<subseteq> A' \\<rbrakk> \\<Longrightarrow> A \\<turnstile>\\<^sub>R res \\<sim> res'\"\n  by(coinduction arbitrary: res res')(auto dest: eq_resource_onD elim!: rel_spmf_mono)\n\nlemma eq_resource_on_empty [simp]: \"{} \\<turnstile>\\<^sub>R res \\<sim> res'\"\n  by(rule eq_resource_onI; simp)\n\nlemma eq_resource_on_resource_of_oracleI:\n  includes lifting_syntax \n  fixes S\n  assumes sim: \"(S ===> eq_on A ===> rel_spmf (rel_prod (=) S)) r1 r2\"\n    and S: \"S s1 s2\"\n  shows \"A \\<turnstile>\\<^sub>R resource_of_oracle r1 s1 \\<sim> resource_of_oracle r2 s2\"\n  using S  by(coinduction arbitrary: s1 s2)\n    (drule sim[THEN rel_funD, THEN rel_funD], simp add: eq_on_def\n      , fastforce simp add: eq_on_def spmf_rel_map elim: rel_spmf_mono)\n\nlemma exec_gpv_eq_resource_on:\n  assumes \"outs_\\<I> \\<I> \\<turnstile>\\<^sub>R res \\<sim> res'\"\n    and \"\\<I> \\<turnstile>g gpv \\<surd>\"\n    and \"\\<I> \\<turnstile>res res \\<surd>\"\n  shows \"rel_spmf (rel_prod (=) (eq_resource_on (outs_\\<I> \\<I>))) (exec_gpv run_resource gpv res) (exec_gpv run_resource gpv res')\"\n  using assms\nproof(induction arbitrary: res res' gpv rule: exec_gpv_fixp_induct)\n  case (step exec_gpv')\n  have[simp]: \"\\<lbrakk>(s, r1) \\<in> set_spmf (run_resource res g1); (s, r2) \\<in> set_spmf (run_resource res' g1);\n    IO g1 g2 \\<in> set_spmf (the_gpv gpv); outs_\\<I> \\<I> \\<turnstile>\\<^sub>R r1 \\<sim> r2\\<rbrakk> \\<Longrightarrow> rel_spmf (rel_prod (=) (eq_resource_on (outs_\\<I> \\<I>))) \n        (exec_gpv' (g2 s) r1) (exec_gpv' (g2 s) r2)\" for g1 g2 r1 s r2\n    by(rule step.IH, simp, rule WT_gpv_ContD[OF step.prems(2)], assumption)\n      (auto elim: outs_gpv.IO WT_calleeD[OF run_resource.WT_callee, OF step.prems(3)]\n        dest!: WT_resourceD[OF step.prems(3), rotated 1] intro: WT_gpv_outs_gpv[THEN subsetD, OF step.prems(2)])\n\n  show ?case\n    by(clarsimp intro!: rel_spmf_bind_reflI step.prems split!: generat.split)\n      (rule rel_spmf_bindI', rule eq_resource_onD[OF step.prems(1)]\n        , auto elim: outs_gpv.IO intro:  eq_resource_onD[OF step.prems(1)] WT_gpv_outs_gpv[THEN subsetD, OF step.prems(2)])\nqed simp_all\n\ninductive eq_\\<I>_generat :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('out, 'in) \\<I> \\<Rightarrow> ('c \\<Rightarrow> 'd \\<Rightarrow> bool) \\<Rightarrow> ('a, 'out, 'in \\<Rightarrow> 'c) generat \\<Rightarrow> ('b, 'out, 'in \\<Rightarrow> 'd) generat \\<Rightarrow> bool\"\n  for A \\<I> D where\n    Pure: \"eq_\\<I>_generat A \\<I> D (Pure x) (Pure y)\" if \"A x y\"\n  | IO: \"eq_\\<I>_generat A \\<I> D (IO out c) (IO out c')\" if \"out \\<in> outs_\\<I> \\<I>\" \"\\<And>input. input \\<in> responses_\\<I> \\<I> out \\<Longrightarrow> D (c input) (c' input)\"\n\nhide_fact (open) Pure IO\n\ninductive_simps eq_\\<I>_generat_simps [simp, code]:\n  \"eq_\\<I>_generat A \\<I> D (Pure x) (Pure y)\"\n  \"eq_\\<I>_generat A \\<I> D (IO out c) (Pure y)\"\n  \"eq_\\<I>_generat A \\<I> D (Pure x) (IO out' c')\"\n  \"eq_\\<I>_generat A \\<I> D (IO out c) (IO out' c')\"\n\ninductive_simps eq_\\<I>_generat_iff1:\n  \"eq_\\<I>_generat A \\<I> D (Pure x) g'\"\n  \"eq_\\<I>_generat A \\<I> D (IO out c) g'\"\n\ninductive_simps eq_\\<I>_generat_iff2:\n  \"eq_\\<I>_generat A \\<I> D g (Pure x)\"\n  \"eq_\\<I>_generat A \\<I> D g (IO out c)\"\n\nlemma eq_\\<I>_generat_mono':\n  \"\\<lbrakk> eq_\\<I>_generat A \\<I> D x y; \\<And>x y. A x y \\<Longrightarrow> A' x y; \\<And>x y. D x y \\<Longrightarrow> D' x y; \\<I> \\<le> \\<I>' \\<rbrakk>\n  \\<Longrightarrow> eq_\\<I>_generat A' \\<I>' D' x y\"\n  by(auto 4 4 elim!: eq_\\<I>_generat.cases simp add: le_\\<I>_def)\n\nlemma eq_\\<I>_generat_mono: \"eq_\\<I>_generat A \\<I> D \\<le> eq_\\<I>_generat A' \\<I>' D'\" if \"A \\<le> A'\" \"D \\<le> D'\" \"\\<I> \\<le> \\<I>'\"\n  using that by(auto elim!: eq_\\<I>_generat_mono' dest: predicate2D)\n\nlemma eq_\\<I>_generat_mono'' [mono]:\n  \"\\<lbrakk> \\<And>x y. A x y \\<longrightarrow> A' x y; \\<And>x y. D x y \\<longrightarrow> D' x y \\<rbrakk>\n  \\<Longrightarrow> eq_\\<I>_generat A \\<I> D x y \\<longrightarrow> eq_\\<I>_generat A' \\<I> D' x y\"\n  by(auto elim: eq_\\<I>_generat_mono')\n\nlemma eq_\\<I>_generat_conversep: \"eq_\\<I>_generat A\\<inverse>\\<inverse> \\<I> D\\<inverse>\\<inverse> = (eq_\\<I>_generat A \\<I> D)\\<inverse>\\<inverse>\"\n  by(fastforce elim: eq_\\<I>_generat.cases)\n\nlemma eq_\\<I>_generat_reflI:\n  assumes  \"\\<And>x. x \\<in> generat_pures generat \\<Longrightarrow> A x x\"\n    and \"\\<And>out c. generat = IO out c \\<Longrightarrow> out \\<in> outs_\\<I> \\<I> \\<and> (\\<forall>input\\<in>responses_\\<I> \\<I> out. D (c input) (c input))\"\n  shows \"eq_\\<I>_generat A \\<I> D generat generat\"\n  using assms by(cases generat) auto\n\nlemma eq_\\<I>_generat_relcompp:\n  \"eq_\\<I>_generat A \\<I> D OO eq_\\<I>_generat A' \\<I> D' = eq_\\<I>_generat (A OO A') \\<I> (D OO D')\"\n  by(auto 4 3 intro!: ext elim!: eq_\\<I>_generat.cases simp add: eq_\\<I>_generat_iff1 eq_\\<I>_generat_iff2 relcompp.simps) metis\n\nlemma eq_\\<I>_generat_map1:\n  \"eq_\\<I>_generat A \\<I> D (map_generat f id ((\\<circ>) g) generat) generat' \\<longleftrightarrow>\n   eq_\\<I>_generat (\\<lambda>x. A (f x)) \\<I> (\\<lambda>x. D (g x)) generat generat'\"\n  by(cases generat; cases generat') auto\n\nlemma eq_\\<I>_generat_map2:\n  \"eq_\\<I>_generat A \\<I> D generat (map_generat f id ((\\<circ>) g) generat') \\<longleftrightarrow>\n   eq_\\<I>_generat (\\<lambda>x y. A x (f y)) \\<I> (\\<lambda>x y. D x (g y)) generat generat'\"\n  by(cases generat; cases generat') auto\n\nlemmas eq_\\<I>_generat_map [simp] = \n  eq_\\<I>_generat_map1[abs_def] eq_\\<I>_generat_map2\n  eq_\\<I>_generat_map1[where g=id, unfolded fun.map_id0, abs_def] eq_\\<I>_generat_map2[where g=id, unfolded fun.map_id0]\n\nlemma eq_\\<I>_generat_into_rel_generat:\n  \"eq_\\<I>_generat A \\<I>_full D generat generat' \\<Longrightarrow> rel_generat A (=) (rel_fun (=) D) generat generat'\"\n  by(erule eq_\\<I>_generat.cases) auto\n\ncoinductive eq_\\<I>_gpv :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('out, 'in) \\<I> \\<Rightarrow> ('a, 'out, 'in) gpv \\<Rightarrow> ('b, 'out, 'in) gpv \\<Rightarrow> bool\"\n  for A \\<I> where\n    eq_\\<I>_gpvI: \"eq_\\<I>_gpv A \\<I> gpv gpv'\" \n  if \"rel_spmf (eq_\\<I>_generat A \\<I> (eq_\\<I>_gpv A \\<I>)) (the_gpv gpv) (the_gpv gpv')\"\n\nlemma eq_\\<I>_gpv_coinduct [consumes 1, case_names eq_\\<I>_gpv, coinduct pred: eq_\\<I>_gpv]:\n  assumes \"X gpv gpv'\"\n    and \"\\<And>gpv gpv'. X gpv gpv'\n      \\<Longrightarrow> rel_spmf (eq_\\<I>_generat A \\<I> (\\<lambda>gpv gpv'. X gpv gpv' \\<or> eq_\\<I>_gpv A \\<I> gpv gpv')) (the_gpv gpv) (the_gpv gpv')\"\n  shows \"eq_\\<I>_gpv A \\<I> gpv gpv'\"\n  using assms(1) by(rule eq_\\<I>_gpv.coinduct)(blast dest: assms(2))\n\nlemma eq_\\<I>_gpvD:\n  \"eq_\\<I>_gpv A \\<I> gpv gpv' \\<Longrightarrow> rel_spmf (eq_\\<I>_generat A \\<I> (eq_\\<I>_gpv A \\<I>)) (the_gpv gpv) (the_gpv gpv')\"\n  by(blast elim!: eq_\\<I>_gpv.cases)\n\nlemma eq_\\<I>_gpv_Done [intro!]: \"A x y \\<Longrightarrow> eq_\\<I>_gpv A \\<I> (Done x) (Done y)\"\n  by(rule eq_\\<I>_gpvI) simp\n\nlemma eq_\\<I>_gpv_Done_iff [simp]: \"eq_\\<I>_gpv A \\<I> (Done x) (Done y) \\<longleftrightarrow> A x y\"\n  by(auto dest: eq_\\<I>_gpvD)\n\nlemma eq_\\<I>_gpv_Pause:\n  \"\\<lbrakk> out \\<in> outs_\\<I> \\<I>; \\<And>input. input \\<in> responses_\\<I> \\<I> out \\<Longrightarrow> eq_\\<I>_gpv A \\<I> (rpv input) (rpv' input) \\<rbrakk>\n  \\<Longrightarrow> eq_\\<I>_gpv A \\<I> (Pause out rpv) (Pause out rpv')\"\n  by(rule eq_\\<I>_gpvI) simp\n\nlemma eq_\\<I>_gpv_mono: \"eq_\\<I>_gpv A \\<I> \\<le> eq_\\<I>_gpv A' \\<I>'\" if A: \"A \\<le> A'\" \"\\<I> \\<le> \\<I>'\"\nproof\n  show \"eq_\\<I>_gpv A' \\<I>' gpv gpv'\" if \"eq_\\<I>_gpv A \\<I> gpv gpv'\" for gpv gpv' using that\n    by(coinduction arbitrary: gpv gpv')\n      (drule eq_\\<I>_gpvD, auto dest: eq_\\<I>_gpvD elim: rel_spmf_mono eq_\\<I>_generat_mono[OF A(1) _ A(2), THEN predicate2D, rotated -1])\nqed\n\nlemma eq_\\<I>_gpv_mono':\n  \"\\<lbrakk> eq_\\<I>_gpv A \\<I> gpv gpv'; \\<And>x y. A x y \\<Longrightarrow> A' x y; \\<I> \\<le> \\<I>' \\<rbrakk> \\<Longrightarrow> eq_\\<I>_gpv A' \\<I>' gpv gpv'\"\n  by(blast intro: eq_\\<I>_gpv_mono[THEN predicate2D])\n\nlemma eq_\\<I>_gpv_mono'' [mono]:\n  \"eq_\\<I>_gpv A \\<I> gpv gpv' \\<longrightarrow> eq_\\<I>_gpv A' \\<I> gpv gpv'\" if \"\\<And>x y. A x y \\<longrightarrow> A' x y\"\n  using that by(blast intro: eq_\\<I>_gpv_mono')\n\nlemma eq_\\<I>_gpv_conversep: \"eq_\\<I>_gpv A\\<inverse>\\<inverse> \\<I> = (eq_\\<I>_gpv A \\<I>)\\<inverse>\\<inverse>\"\nproof(intro ext iffI; simp)\n  show \"eq_\\<I>_gpv A \\<I> gpv gpv'\" if \"eq_\\<I>_gpv A\\<inverse>\\<inverse> \\<I> gpv' gpv\" for A and gpv gpv' using that\n    by(coinduction arbitrary: gpv gpv')\n      (drule eq_\\<I>_gpvD, rewrite in \\<hole> conversep_iff[symmetric]\n        , auto simp add: pmf.rel_conversep[symmetric] option.rel_conversep[symmetric] eq_\\<I>_generat_conversep[symmetric] elim: eq_\\<I>_generat_mono' rel_spmf_mono)\n\n  from this[of \"conversep A\"] show \"eq_\\<I>_gpv A\\<inverse>\\<inverse> \\<I> gpv' gpv\" if \"eq_\\<I>_gpv A \\<I> gpv gpv'\" for gpv gpv'\n    using that by simp\nqed\n\nlemma eq_\\<I>_gpv_reflI:\n  \"\\<lbrakk> \\<And>x. x \\<in> results_gpv \\<I> gpv \\<Longrightarrow> A x x; \\<I> \\<turnstile>g gpv \\<surd> \\<rbrakk> \\<Longrightarrow> eq_\\<I>_gpv A \\<I> gpv gpv\"\n  by(coinduction arbitrary: gpv)(auto intro!: rel_spmf_reflI eq_\\<I>_generat_reflI elim!: generat.set_cases intro: results_gpv.intros dest: WT_gpvD)\n\nlemma eq_\\<I>_gpv_into_rel_gpv: \"eq_\\<I>_gpv A \\<I>_full gpv gpv' \\<Longrightarrow> rel_gpv A (=) gpv gpv'\"\n  by(coinduction arbitrary: gpv gpv')\n    (drule eq_\\<I>_gpvD, auto elim: spmf_rel_mono_strong generat.rel_mono_strong dest: eq_\\<I>_generat_into_rel_generat )\n\nlemma eq_\\<I>_gpv_relcompp: \"eq_\\<I>_gpv (A OO A') \\<I> = eq_\\<I>_gpv A \\<I> OO eq_\\<I>_gpv A' \\<I>\" (is \"?lhs = ?rhs\")\nproof(intro ext iffI relcomppI; (elim relcomppE)?)\n  fix gpv gpv''\n  assume *: \"?lhs gpv gpv''\"\n  define middle where \"middle = corec_gpv (\\<lambda>(gpv, gpv'').\n    map_spmf (map_generat (relcompp_witness A A') (relcompp_witness (=) (=)) ((\\<circ>) Inr \\<circ> rel_witness_fun (=) (=)) \\<circ> \n              rel_witness_generat)\n    (rel_witness_spmf (eq_\\<I>_generat (A OO A') \\<I> (eq_\\<I>_gpv (A OO A') \\<I>)) (the_gpv gpv, the_gpv gpv'')))\"\n  have middle_sel [simp]: \"the_gpv (middle (gpv, gpv'')) = \n     map_spmf (map_generat (relcompp_witness A A') (relcompp_witness (=) (=)) ((\\<circ>) middle \\<circ> rel_witness_fun (=) (=)) \\<circ> \n              rel_witness_generat)\n    (rel_witness_spmf (eq_\\<I>_generat (A OO A') \\<I> (eq_\\<I>_gpv (A OO A') \\<I>)) (the_gpv gpv, the_gpv gpv''))\"\n    for gpv gpv'' by(auto simp add: middle_def spmf.map_comp o_def generat.map_comp)\n  show \"eq_\\<I>_gpv A \\<I> gpv (middle (gpv, gpv''))\" using *\n    by(coinduction arbitrary: gpv gpv'')\n      (drule eq_\\<I>_gpvD, simp add: spmf_rel_map, erule rel_witness_spmf1[THEN rel_spmf_mono]\n        , auto 4 3 del: relcomppE elim!: relcompp_witness eq_\\<I>_generat.cases)\n\n  show \"eq_\\<I>_gpv A' \\<I> (middle (gpv, gpv'')) gpv''\" using *\n    by(coinduction arbitrary: gpv gpv'')\n      (drule eq_\\<I>_gpvD, simp add: spmf_rel_map, erule rel_witness_spmf2[THEN rel_spmf_mono]\n        , auto 4 3 del: relcomppE elim: rel_witness_spmf2[THEN rel_spmf_mono] elim!: relcompp_witness eq_\\<I>_generat.cases)\nnext\n  show \"?lhs gpv gpv''\" if \"eq_\\<I>_gpv A \\<I> gpv gpv'\" and \"eq_\\<I>_gpv A' \\<I> gpv' gpv''\" for gpv gpv' gpv'' using that\n    by(coinduction arbitrary: gpv gpv' gpv'')\n      ((drule eq_\\<I>_gpvD)+, simp, drule (1) rel_spmf_OO_trans, erule rel_spmf_mono\n        , auto simp add: eq_\\<I>_generat_relcompp elim: eq_\\<I>_generat_mono')\nqed\n\nlemma eq_\\<I>_gpv_map_gpv1: \"eq_\\<I>_gpv A \\<I> (map_gpv f id gpv) gpv' \\<longleftrightarrow> eq_\\<I>_gpv (\\<lambda>x. A (f x)) \\<I> gpv gpv'\" (is \"?lhs \\<longleftrightarrow> ?rhs\")\nproof\n  show ?rhs if ?lhs using that\n    by(coinduction arbitrary: gpv gpv')\n      (drule eq_\\<I>_gpvD, auto simp add: gpv.map_sel spmf_rel_map elim!: rel_spmf_mono eq_\\<I>_generat_mono')\n  show ?lhs if ?rhs using that\n    by(coinduction arbitrary: gpv gpv')\n      (drule eq_\\<I>_gpvD, auto simp add: gpv.map_sel spmf_rel_map elim!: rel_spmf_mono eq_\\<I>_generat_mono')\nqed\n\nlemma eq_\\<I>_gpv_map_gpv2: \"eq_\\<I>_gpv A \\<I> gpv (map_gpv f id gpv') = eq_\\<I>_gpv (\\<lambda>x y. A x (f y)) \\<I> gpv gpv'\"\n  using eq_\\<I>_gpv_map_gpv1[of \"conversep A\" \\<I> f gpv' gpv]\n  by(rewrite in \"_ = \\<hole>\" conversep_iff[symmetric] , simp add: eq_\\<I>_gpv_conversep[symmetric])\n    (subst (asm) eq_\\<I>_gpv_conversep , simp add: conversep_iff[abs_def])\n\nlemmas eq_\\<I>_gpv_map_gpv [simp] = eq_\\<I>_gpv_map_gpv1[abs_def] eq_\\<I>_gpv_map_gpv2\n\nlemma (in callee_invariant_on) eq_\\<I>_exec_gpv:\n  \"\\<lbrakk> eq_\\<I>_gpv A \\<I> gpv gpv'; I s \\<rbrakk> \\<Longrightarrow> rel_spmf (rel_prod A (eq_onp I)) (exec_gpv callee gpv s) (exec_gpv callee gpv' s)\"\nproof(induction arbitrary: s gpv gpv' rule: parallel_fixp_induct_2_2[OF partial_function_definitions_spmf partial_function_definitions_spmf exec_gpv.mono exec_gpv.mono exec_gpv_def exec_gpv_def, unfolded lub_spmf_empty, case_names adm bottom step])\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step exec_gpv' exec_gpv'')\n  show ?case using step.prems\n    by - (drule eq_\\<I>_gpvD, erule rel_spmf_bindI\n        , auto split!: generat.split simp add: eq_onp_same_args \n        intro: WT_callee[THEN WT_calleeD] callee_invariant step.IH intro!: rel_spmf_bind_reflI)\nqed\n\nlemma eq_\\<I>_gpv_coinduct_bind [consumes 1, case_names eq_\\<I>_gpv]:\n  fixes gpv :: \"('a, 'out, 'in) gpv\" and gpv' :: \"('a', 'out, 'in) gpv\"\n  assumes X: \"X gpv gpv'\"\n    and step: \"\\<And>gpv gpv'. X gpv gpv'\n      \\<Longrightarrow> rel_spmf (eq_\\<I>_generat A \\<I> (\\<lambda>gpv gpv'. X gpv gpv' \\<or> eq_\\<I>_gpv A \\<I> gpv gpv' \\<or> \n      (\\<exists>gpv'' gpv''' (B :: 'b \\<Rightarrow> 'b' \\<Rightarrow> bool) f g. gpv = bind_gpv gpv'' f \\<and> gpv' = bind_gpv gpv''' g \\<and> eq_\\<I>_gpv B \\<I> gpv'' gpv''' \\<and> (rel_fun B X) f g))) (the_gpv gpv) (the_gpv gpv')\"\n  shows \"eq_\\<I>_gpv A \\<I> gpv gpv'\"\nproof -\n  fix x y\n  define gpv'' :: \"('b, 'out, 'in) gpv\" where \"gpv'' \\<equiv> Done x\"\n  define f :: \"'b \\<Rightarrow> ('a, 'out, 'in) gpv\" where \"f \\<equiv> \\<lambda>_. gpv\"\n  define gpv''' :: \"('b', 'out, 'in) gpv\" where \"gpv''' \\<equiv> Done y\"\n  define g :: \"'b' \\<Rightarrow> ('a', 'out, 'in) gpv\" where \"g \\<equiv> \\<lambda>_. gpv'\"\n  have \"eq_\\<I>_gpv (\\<lambda>x y. X (f x) (g y)) \\<I> gpv'' gpv'''\" using X\n    by(simp add: f_def g_def gpv''_def gpv'''_def)\n  then have \"eq_\\<I>_gpv A \\<I> (bind_gpv gpv'' f) (bind_gpv gpv''' g)\"\n    by(coinduction arbitrary: gpv'' f gpv''' g)\n      (drule eq_\\<I>_gpvD, (clarsimp simp add: bind_gpv.sel spmf_rel_map simp del: bind_gpv_sel' elim!: rel_spmf_bindI split!: generat.split dest!: step)\n        , erule rel_spmf_mono, (erule eq_\\<I>_generat.cases; clarsimp), (erule meta_allE, erule (1) meta_impE)\n        , (fastforce | force intro: exI[where x=\"Done _\"] elim!: eq_\\<I>_gpv_mono' dest: rel_funD)+)\n\n  then show ?thesis unfolding gpv''_def gpv'''_def f_def g_def by simp\nqed\n\ncontext\n  fixes S :: \"'s1 \\<Rightarrow> 's2 \\<Rightarrow> bool\"\n    and callee1 :: \"'s1 \\<Rightarrow> 'out \\<Rightarrow> ('in \\<times> 's1, 'out', 'in') gpv\"\n    and callee2 :: \"'s2 \\<Rightarrow> 'out \\<Rightarrow> ('in \\<times> 's2, 'out', 'in') gpv\"\n    and \\<I> :: \"('out, 'in) \\<I>\"\n    and \\<I>' :: \"('out', 'in') \\<I>\"\n  assumes callee: \"\\<And>s1 s2 q. \\<lbrakk> S s1 s2; q \\<in> outs_\\<I> \\<I> \\<rbrakk> \\<Longrightarrow> eq_\\<I>_gpv (rel_prod (eq_onp (\\<lambda>r. r \\<in> responses_\\<I> \\<I> q)) S) \\<I>' (callee1 s1 q) (callee2 s2 q)\"\nbegin\n\nlemma eq_\\<I>_gpv_inline1:\n  includes lifting_syntax\n  assumes \"S s1 s2\" \"eq_\\<I>_gpv A \\<I> gpv1 gpv2\"\n  shows \"rel_spmf (rel_sum (rel_prod A S) \n      (\\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \\<and> q' \\<in> outs_\\<I> \\<I>' \\<and> (\\<exists>q'' \\<in> outs_\\<I> \\<I>. \n          (\\<forall>r \\<in> responses_\\<I> \\<I>' q'. eq_\\<I>_gpv (rel_prod (eq_onp (\\<lambda>r'. r' \\<in> responses_\\<I> \\<I> q'')) S) \\<I>' (rpv1 r) (rpv1' r)) \\<and> \n          (\\<forall>r' \\<in> responses_\\<I> \\<I> q''. eq_\\<I>_gpv A \\<I> (rpv2 r') (rpv2' r')))))\n     (inline1 callee1 gpv1 s1) (inline1 callee2 gpv2 s2)\"\n  using assms\nproof(induction arbitrary: gpv1 gpv2 s1 s2 rule: parallel_fixp_induct_2_2[OF partial_function_definitions_spmf partial_function_definitions_spmf inline1.mono inline1.mono inline1_def inline1_def, unfolded lub_spmf_empty, case_names adm bottom step])\n  case adm show ?case by simp\n  case bottom show ?case by simp\n  case (step inline1' inline1'')\n  from step.prems show ?case\n    by - (erule eq_\\<I>_gpvD[THEN rel_spmf_bindI]\n        , clarsimp split!: generat.split\n        , erule eq_\\<I>_gpvD[OF callee(1), THEN rel_spmf_bindI]\n        , auto simp add: eq_onp_def intro: step.IH[THEN rel_spmf_mono] elim: eq_\\<I>_gpvD[OF callee(1), THEN rel_spmf_bindI] split!: generat.split)\nqed\n\nlemma eq_\\<I>_gpv_inline:\n  assumes S: \"S s1 s2\"\n    and gpv: \"eq_\\<I>_gpv A \\<I> gpv1 gpv2\"\n  shows \"eq_\\<I>_gpv (rel_prod A S) \\<I>' (inline callee1 gpv1 s1) (inline callee2 gpv2 s2)\"\n  using S gpv\n  by (coinduction arbitrary: gpv1 gpv2 s1 s2 rule: eq_\\<I>_gpv_coinduct_bind)\n    (clarsimp simp add: inline_sel spmf_rel_map, drule (1) eq_\\<I>_gpv_inline1\n      , fastforce split!: generat.split sum.split del: disjCI intro!: disjI2 rel_funI elim: rel_spmf_mono simp add: eq_onp_def)\n\nend\n\nlemma eq_\\<I>_gpv_left_gpv_cong:\n  \"eq_\\<I>_gpv A \\<I> gpv gpv' \\<Longrightarrow> eq_\\<I>_gpv A (\\<I> \\<oplus>\\<^sub>\\<I> \\<I>') (left_gpv gpv) (left_gpv gpv')\"\n  by(coinduction arbitrary: gpv gpv')\n    (drule eq_\\<I>_gpvD, auto 4 4 simp add: spmf_rel_map elim!: rel_spmf_mono eq_\\<I>_generat.cases)\n\nlemma eq_\\<I>_gpv_right_gpv_cong:\n  \"eq_\\<I>_gpv A \\<I>' gpv gpv' \\<Longrightarrow> eq_\\<I>_gpv A (\\<I> \\<oplus>\\<^sub>\\<I> \\<I>') (right_gpv gpv) (right_gpv gpv')\"\n  by(coinduction arbitrary: gpv gpv')\n    (drule eq_\\<I>_gpvD, auto 4 4 simp add: spmf_rel_map elim!: rel_spmf_mono eq_\\<I>_generat.cases)\n\nlemma eq_\\<I>_gpvD_WT1: \"\\<lbrakk> eq_\\<I>_gpv A \\<I> gpv gpv'; \\<I> \\<turnstile>g gpv \\<surd> \\<rbrakk> \\<Longrightarrow> \\<I> \\<turnstile>g gpv' \\<surd>\"\n  by(coinduction arbitrary: gpv gpv')(fastforce simp add: eq_\\<I>_generat_iff2 dest: WT_gpv_ContD eq_\\<I>_gpvD dest!: rel_setD2 set_spmf_parametric[THEN rel_funD])\n\nlemma eq_\\<I>_gpvD_results_gpv2: \n  assumes \"eq_\\<I>_gpv A \\<I> gpv gpv'\" \"y \\<in> results_gpv \\<I> gpv'\"\n  shows \"\\<exists>x \\<in> results_gpv \\<I> gpv. A x y\"\n  using assms(2,1)\n  by(induction arbitrary: gpv)\n    (fastforce dest!: set_spmf_parametric[THEN rel_funD] rel_setD2 dest: eq_\\<I>_gpvD simp add: eq_\\<I>_generat_iff2 intro: results_gpv.intros)+\n\n\ncoinductive eq_\\<I>_converter :: \"('a, 'b) \\<I> \\<Rightarrow> ('out, 'in) \\<I> \\<Rightarrow> ('a, 'b, 'out, 'in) converter \\<Rightarrow> ('a, 'b, 'out, 'in) converter \\<Rightarrow> bool\"\n  (\"_,_ \\<turnstile>\\<^sub>C/ _ \\<sim>/ _\" [100, 0, 99, 99] 99)\n  for \\<I> \\<I>' where\n    eq_\\<I>_converterI: \"\\<I>, \\<I>' \\<turnstile>\\<^sub>C conv \\<sim> conv'\" if\n    \"\\<And>q. q \\<in> outs_\\<I> \\<I> \\<Longrightarrow> eq_\\<I>_gpv (rel_prod (eq_onp (\\<lambda>r. r \\<in> responses_\\<I> \\<I> q)) (eq_\\<I>_converter \\<I> \\<I>')) \\<I>' (run_converter conv q) (run_converter conv' q)\"\n\n\n\nlemma eq_\\<I>_converterD: \n  \"eq_\\<I>_gpv (rel_prod (eq_onp (\\<lambda>r. r \\<in> responses_\\<I> \\<I> q)) (eq_\\<I>_converter \\<I> \\<I>')) \\<I>' (run_converter conv q) (run_converter conv' q)\"\n  if \"\\<I>, \\<I>' \\<turnstile>\\<^sub>C conv \\<sim> conv'\" \"q \\<in> outs_\\<I> \\<I>\"\n  using that by(blast elim: eq_\\<I>_converter.cases)\n\nlemma eq_\\<I>_converter_reflI: \"\\<I>, \\<I>' \\<turnstile>\\<^sub>C conv \\<sim> conv\" if \"\\<I>, \\<I>' \\<turnstile>\\<^sub>C conv \\<surd>\"\n  using that by(coinduction arbitrary: conv)(auto intro!: eq_\\<I>_gpv_reflI dest: WT_converterD simp add: eq_onp_same_args)\n\nlemma eq_\\<I>_converter_sym [sym]: \"\\<I>, \\<I>' \\<turnstile>\\<^sub>C conv \\<sim> conv'\" if \"\\<I>, \\<I>' \\<turnstile>\\<^sub>C conv' \\<sim> conv\"\n  using that\n  by(coinduction arbitrary: conv conv')\n    (drule (1) eq_\\<I>_converterD, rewrite in \\<hole> conversep_iff[symmetric]\n      ,  auto simp add: eq_\\<I>_gpv_conversep[symmetric] eq_onp_def elim: eq_\\<I>_gpv_mono')\n\nlemma eq_\\<I>_converter_trans [trans]:\n  \"\\<lbrakk> \\<I>, \\<I>' \\<turnstile>\\<^sub>C conv \\<sim> conv'; \\<I>, \\<I>' \\<turnstile>\\<^sub>C conv' \\<sim> conv'' \\<rbrakk> \\<Longrightarrow> \\<I>, \\<I>' \\<turnstile>\\<^sub>C conv \\<sim> conv''\"\n  by(coinduction arbitrary: conv conv' conv'')\n    ((drule (1) eq_\\<I>_converterD)+, drule (1) eq_\\<I>_gpv_relcompp[THEN fun_cong, THEN fun_cong, THEN iffD2, OF relcomppI]\n      , auto simp add: eq_OO prod.rel_compp[symmetric] eq_onp_def elim!: eq_\\<I>_gpv_mono')\n\nlemma eq_\\<I>_converter_mono:\n  assumes *: \"\\<I>1, \\<I>2 \\<turnstile>\\<^sub>C conv \\<sim> conv'\"\n    and le: \"\\<I>1' \\<le> \\<I>1\" \"\\<I>2 \\<le> \\<I>2'\"\n  shows \"\\<I>1', \\<I>2' \\<turnstile>\\<^sub>C conv \\<sim> conv'\"\n  using *\n  by(coinduction arbitrary: conv conv')\n    (auto simp add: eq_onp_def dest!:eq_\\<I>_converterD  intro: responses_\\<I>_mono[THEN subsetD, OF le(1)] \n      elim!: eq_\\<I>_gpv_mono'[OF _ _ le(2)] outs_\\<I>_mono[THEN subsetD, OF le(1)])\n\nlemma eq_\\<I>_converter_eq: \"conv1 = conv2\" if \"\\<I>_full, \\<I>_full \\<turnstile>\\<^sub>C conv1 \\<sim> conv2\"\n  using that\n  by(coinduction arbitrary: conv1 conv2)\n    (auto simp add: eq_\\<I>_gpv_into_rel_gpv eq_onp_def intro!: rel_funI elim!: gpv.rel_mono_strong eq_\\<I>_gpv_into_rel_gpv dest:eq_\\<I>_converterD)\n\nlemma eq_\\<I>_attach_on: (* TODO: generalise to eq_resource_on *)\n  assumes \"\\<I>' \\<turnstile>res res \\<surd>\" \"\\<I>_uniform A UNIV, \\<I>' \\<turnstile>\\<^sub>C conv \\<sim> conv'\"\n  shows \"A \\<turnstile>\\<^sub>R attach conv res \\<sim> attach conv' res\"\n  using assms\n  by(coinduction arbitrary: conv conv' res)\n    (auto 4 4 simp add: eq_onp_def spmf_rel_map dest: eq_\\<I>_converterD intro!: rel_funI run_resource.eq_\\<I>_exec_gpv[THEN rel_spmf_mono])\n\nlemma eq_\\<I>_attach_on':\n  assumes \"\\<I>' \\<turnstile>res res \\<surd>\" \"\\<I>, \\<I>' \\<turnstile>\\<^sub>C conv \\<sim> conv'\" \"A \\<subseteq> outs_\\<I> \\<I>\"\n  shows \"A \\<turnstile>\\<^sub>R attach conv res \\<sim> attach conv' res\"\n  using assms(1) assms(2)[THEN eq_\\<I>_converter_mono]\n  by(rule eq_\\<I>_attach_on)(use assms(3) in \\<open>auto simp add: le_\\<I>_def\\<close>)\n\nlemma eq_\\<I>_attach:\n  \"\\<lbrakk> \\<I>' \\<turnstile>res res \\<surd>; \\<I>_full, \\<I>' \\<turnstile>\\<^sub>C conv \\<sim> conv' \\<rbrakk> \\<Longrightarrow> attach conv res = attach conv' res\"\n  by(rule eq_resource_on_UNIV_D)(simp add: eq_\\<I>_attach_on)\n\nlemma eq_\\<I>_comp_cong:\n  \"\\<lbrakk> \\<I>1, \\<I>2 \\<turnstile>\\<^sub>C conv1 \\<sim> conv1'; \\<I>2, \\<I>3 \\<turnstile>\\<^sub>C conv2 \\<sim> conv2' \\<rbrakk>\n  \\<Longrightarrow> \\<I>1, \\<I>3 \\<turnstile>\\<^sub>C comp_converter conv1 conv2 \\<sim> comp_converter conv1' conv2'\"\n  by(coinduction arbitrary: conv1 conv2 conv1' conv2')\n    (clarsimp, rule eq_\\<I>_gpv_mono'[OF eq_\\<I>_gpv_inline[where S=\"eq_\\<I>_converter \\<I>2 \\<I>3\"]]\n      , (fastforce elim!: eq_\\<I>_converterD)+)\n\nlemma comp_converter_cong: \"comp_converter conv1 conv2 = comp_converter conv1' conv2'\"\n  if \"\\<I>_full, \\<I> \\<turnstile>\\<^sub>C conv1 \\<sim> conv1'\" \"\\<I>, \\<I>_full \\<turnstile>\\<^sub>C conv2 \\<sim> conv2'\"\n  by(rule eq_\\<I>_converter_eq)(rule eq_\\<I>_comp_cong[OF that])\n\nlemma parallel_converter2_id_id: \n  \"\\<I>1 \\<oplus>\\<^sub>\\<I> \\<I>2, \\<I>1 \\<oplus>\\<^sub>\\<I> \\<I>2 \\<turnstile>\\<^sub>C parallel_converter2 id_converter id_converter \\<sim> id_converter\"\n  by(coinduction)(auto split: sum.split intro!: eq_\\<I>_gpv_Pause simp add: eq_onp_same_args)\n\nlemma parallel_converter2_eq_\\<I>_cong:\n  \"\\<lbrakk> \\<I>1, \\<I>1' \\<turnstile>\\<^sub>C conv1 \\<sim> conv1'; \\<I>2, \\<I>2' \\<turnstile>\\<^sub>C conv2 \\<sim> conv2' \\<rbrakk>\n  \\<Longrightarrow> \\<I>1 \\<oplus>\\<^sub>\\<I> \\<I>2, \\<I>1' \\<oplus>\\<^sub>\\<I> \\<I>2' \\<turnstile>\\<^sub>C parallel_converter2 conv1 conv2 \\<sim> parallel_converter2 conv1' conv2'\"\n  by(coinduction arbitrary: conv1 conv2 conv1' conv2')\n    (fastforce intro!: eq_\\<I>_gpv_left_gpv_cong eq_\\<I>_gpv_right_gpv_cong dest: eq_\\<I>_converterD elim!: eq_\\<I>_gpv_mono' simp add: eq_onp_def)\n\nlemma id_converter_eq_self: \"\\<I>,\\<I>' \\<turnstile>\\<^sub>C id_converter \\<sim> id_converter\" if \"\\<I> \\<le> \\<I>'\"\n  by(rule eq_\\<I>_converter_mono[OF _ order_refl that])(rule eq_\\<I>_converter_reflI[OF WT_converter_id])\n\nlemma eq_\\<I>_converterD_WT1:\n  assumes \"\\<I>,\\<I>' \\<turnstile>\\<^sub>C conv1 \\<sim> conv2\" and \"\\<I>,\\<I>' \\<turnstile>\\<^sub>C conv1 \\<surd>\"\n  shows \"\\<I>,\\<I>' \\<turnstile>\\<^sub>C conv2 \\<surd>\"\n  using assms\n  by(coinduction arbitrary: conv1 conv2)\n    (drule (1) eq_\\<I>_converterD, auto 4 3 dest: eq_\\<I>_converterD eq_\\<I>_gpvD_WT1 WT_converterD_WT WT_converterD_results eq_\\<I>_gpvD_results_gpv2 simp add: eq_onp_def)\n\nlemma eq_\\<I>_converterD_WT:\n  assumes \"\\<I>,\\<I>' \\<turnstile>\\<^sub>C conv1 \\<sim> conv2\"\n  shows \"\\<I>,\\<I>' \\<turnstile>\\<^sub>C conv1 \\<surd> \\<longleftrightarrow> \\<I>,\\<I>' \\<turnstile>\\<^sub>C conv2 \\<surd>\"\nproof(rule iffI, goal_cases)\n  case 1 then show ?case using assms by (auto intro: eq_\\<I>_converterD_WT1) \nnext\n  case 2 then show ?case using assms[symmetric] by (auto intro: eq_\\<I>_converterD_WT1)\nqed\n\nlemma eq_\\<I>_gpv_Fail [simp]: \"eq_\\<I>_gpv A \\<I> Fail Fail\"\n  by(rule eq_\\<I>_gpv.intros) simp\n\nlemma eq_\\<I>_restrict_gpv:\n  assumes \"eq_\\<I>_gpv A \\<I> gpv gpv'\"\n  shows \"eq_\\<I>_gpv A \\<I> (restrict_gpv \\<I> gpv) gpv'\"\n  using assms\n  by(coinduction arbitrary: gpv gpv')\n    (fastforce dest: eq_\\<I>_gpvD simp add: spmf_rel_map pmf.rel_map option_rel_Some1 eq_\\<I>_generat_iff1 elim!: pmf.rel_mono_strong eq_\\<I>_generat_mono' split: option.split generat.split)\n\nlemma eq_\\<I>_restrict_converter:\n  assumes \"\\<I>,\\<I>' \\<turnstile>\\<^sub>C cnv \\<surd>\"\n    and \"outs_\\<I> \\<I> \\<subseteq> A\"\n  shows \"\\<I>,\\<I>' \\<turnstile>\\<^sub>C restrict_converter A \\<I>' cnv \\<sim> cnv\"\n  using assms(1)\n  by(coinduction arbitrary: cnv)\n    (use assms(2) in \\<open>auto intro!: eq_\\<I>_gpv_reflI eq_\\<I>_restrict_gpv simp add: eq_onp_def dest: WT_converterD\\<close>)\n\nlemma eq_\\<I>_restrict_gpv_full:\n  \"eq_\\<I>_gpv A \\<I>_full (restrict_gpv \\<I> gpv) (restrict_gpv \\<I> gpv')\"\n  if \"eq_\\<I>_gpv A \\<I> gpv gpv'\"\n  using that\n  by(coinduction arbitrary: gpv gpv')\n    (fastforce dest: eq_\\<I>_gpvD simp add: pmf.rel_map in_set_spmf[symmetric] elim!: pmf.rel_mono_strong split!: option.split generat.split)\n\nlemma eq_\\<I>_restrict_converter_cong:\n  assumes \"\\<I>,\\<I>' \\<turnstile>\\<^sub>C cnv \\<sim> cnv'\"\n    and \"A \\<subseteq> outs_\\<I> \\<I>\"\n  shows \"restrict_converter A \\<I>' cnv = restrict_converter A \\<I>' cnv'\"\n  using assms\n  by(coinduction arbitrary: cnv cnv')\n    (fastforce intro: eq_\\<I>_gpv_into_rel_gpv eq_\\<I>_restrict_gpv_full elim!: eq_\\<I>_gpv_mono' simp add: eq_onp_def rel_fun_def gpv.rel_map dest: eq_\\<I>_converterD)\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Constructive_Cryptography/Converter_Rewrite.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331606115021, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.3098597440569525}}
{"text": "section {*FUNCTION\\_\\_VALID\\_ITEM\\_SETS\\_CONFLICTFREE*}\ntheory\n  FUNCTION__VALID_ITEM_SETS_CONFLICTFREE\n\nimports\n  FUNCTION__VALID_ITEM_SETS\n\nbegin\n\ndefinition item_shift_reduce_conflict :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('nonterminal, 'event) DT_cfg_item\n  \\<Rightarrow> ('nonterminal, 'event) DT_cfg_item\n  \\<Rightarrow> bool\"\n  where\n    \"item_shift_reduce_conflict G k I1 I2 \\<equiv>\n  case cfg_item_rhs2 I1 of\n    teB a # \\<beta> \\<Rightarrow>\n      cfg_item_rhs2 I2 = []\n      \\<and> cfg_item_look_ahead I2 \\<in> cfgSTD_first G k (cfg_item_rhs2 I1 @ liftB (cfg_item_look_ahead I1))\n    | _  \\<Rightarrow> False\"\n\ndefinition item_reduce_reduce_conflict :: \"\n  ('nonterminal, 'event) DT_cfg_item\n  \\<Rightarrow> ('nonterminal, 'event) DT_cfg_item\n  \\<Rightarrow> bool\"\n  where\n    \"item_reduce_reduce_conflict I1 I2 \\<equiv>\n  cfg_item_rhs2 I1 = []\n  \\<and> cfg_item_rhs2 I2 = []\n  \\<and> cfg_item_look_ahead I1 = cfg_item_look_ahead I2\n  \\<and> I1 \\<noteq> I2\"\n\ndefinition conflict_free :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('nonterminal, 'event) cfg\n  \\<Rightarrow> nat\n  \\<Rightarrow> bool\"\n  where\n    \"conflict_free G G' k \\<equiv>\n  \\<forall>w.\n    set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G') (cfg_events G')\n    \\<longrightarrow> (\\<forall>I1 I2.\n            I1 \\<in> valid_item_set G' k w\n            \\<and> I2 \\<in> valid_item_set G' k w\n            \\<and> item_core I1 \\<in> cfg_productions G\n            \\<and> item_core I2 \\<in> cfg_productions G\n            \\<longrightarrow> (\\<not> (item_reduce_reduce_conflict I1 I2)))\n  \\<and> (\\<forall>I1 I2.\n      I1 \\<in> valid_item_set G' k w\n      \\<and> I2 \\<in> valid_item_set G' k w\n      \\<and> item_core I1 \\<in> cfg_productions G\n      \\<and> item_core I2 \\<in> cfg_productions G\n      \\<longrightarrow> (\\<not> (item_shift_reduce_conflict G' k I1 I2)))\"\n\ndefinition conflict_free_ALT :: \"\n  ('nonterminal, 'event) cfg\n  \\<Rightarrow> ('nonterminal, 'event) cfg\n  \\<Rightarrow> nat\n  \\<Rightarrow> bool\"\n  where\n    \"conflict_free_ALT G G' k \\<equiv>\n  \\<forall>w I1 I2.\n    setA w \\<subseteq> cfg_nonterminals G'\n    \\<longrightarrow> setB w \\<subseteq> cfg_events G'\n    \\<longrightarrow> I1 \\<in> valid_item_set G' k w\n    \\<longrightarrow> I2 \\<in> valid_item_set G' k w\n    \\<longrightarrow> item_core I1 \\<in> cfg_productions G\n    \\<longrightarrow> item_core I2 \\<in> cfg_productions G\n    \\<longrightarrow> (\\<not> item_reduce_reduce_conflict I1 I2\n      \\<and> \\<not> item_shift_reduce_conflict G' k I1 I2)\"\n\nlemma conflict_free_vs_conflict_free_ALT: \"\n  conflict_free G G' k = conflict_free_ALT G G' k\"\n  apply(simp add: conflict_free_ALT_def conflict_free_def)\n  apply(rule antisym)\n   apply(clarsimp)\n   apply(erule_tac x=\"w\" in allE)\n   apply(erule impE)\n    apply (metis SetxBiElem_check_vs_set_two_elements_construct_domain_check)\n   apply(clarsimp)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(erule_tac x=\"w\" in allE)\n   apply(erule impE)\n    apply (metis two_elements_construct_domain_setA)\n   apply(erule impE)\n    apply (metis two_elements_construct_domain_setB)\n   apply(clarsimp)\n  apply(erule_tac x=\"w\" in allE)\n  apply(erule impE)\n   apply (metis two_elements_construct_domain_setA)\n  apply(erule impE)\n   apply (metis two_elements_construct_domain_setB)\n  apply(clarsimp)\n  done\n\nlemma from_dollaraugmented_to_input_derivation: \"\n  F_CFG_AUGMENT__input G Do S' G'\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> cfgRM.derivation_initial G' d\n  \\<Longrightarrow> cfgRM.derivation G' d\n  \\<Longrightarrow> d (Suc 0) \\<noteq> None\n  \\<Longrightarrow> cfgRM.derivation G (derivation_drop (derivation_map d (\\<lambda>c. c\\<lparr>cfg_conf := drop (Suc 0) (butlast (cfg_conf c)) \\<rparr>)) (Suc 0))\"\n  apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n   prefer 2\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: F_CFG_AUGMENT__input_def valid_cfg_def)\n  apply(simp (no_asm) add: cfgRM.derivation_def)\n  apply(clarsimp)\n  apply(rename_tac y i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac y i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac y)(*strict*)\n   apply(simp add: derivation_drop_def derivation_map_def)\n   apply(case_tac y)\n   apply(rename_tac y option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y nat)(*strict*)\n  apply(simp add: derivation_drop_def derivation_map_def)\n  apply(case_tac \"d (Suc (Suc nat))\")\n   apply(rename_tac y nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y nat a)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d (Suc nat) = Some (pair e1 c1) \\<and> d (Suc (Suc nat)) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G' c1 e2 c2\")\n   apply(rename_tac y nat a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc(Suc nat)\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac y nat a)(*strict*)\n     apply(force)\n    apply(rename_tac y nat a)(*strict*)\n    apply(force)\n   apply(rename_tac y nat a)(*strict*)\n   apply(force)\n  apply(rename_tac y nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y nat e1 e2 c1 c2)(*strict*)\n  apply(subgoal_tac \"\\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> cfg_conf c1=[teB Do]@w@[teB Do]\")\n   apply(rename_tac y nat e1 e2 c1 c2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d\"\n      in F_CFG_AUGMENT__reachableConf_of_certain_form)\n     apply(rename_tac y nat e1 e2 c1 c2)(*strict*)\n     apply(force)\n    apply(rename_tac y nat e1 e2 c1 c2)(*strict*)\n    apply(rule cfgSTD.derivation_initialI)\n     apply(rename_tac y nat e1 e2 c1 c2)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac y nat e1 e2 c1 c2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac y nat e1 e2 c1 c2 c)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(clarsimp)\n   apply(rename_tac y nat e1 e2 c1 c2)(*strict*)\n   apply(force)\n  apply(rename_tac y nat e1 e2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y nat e1 e2 c1 c2 w)(*strict*)\n  apply(simp add: derivation_drop_def derivation_map_def)\n  apply(case_tac nat)\n   apply(rename_tac y nat e1 e2 c1 c2 w)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 w)(*strict*)\n   apply(simp add: cfgRM_step_relation_def)\n   apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 w l r)(*strict*)\n   apply(case_tac l)\n    apply(rename_tac e1 e2 c1 c2 w l r)(*strict*)\n    apply(force)\n   apply(rename_tac e1 e2 c1 c2 w l r a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 w r list)(*strict*)\n   apply(case_tac r)\n    apply(rename_tac e1 e2 c1 c2 w r list)(*strict*)\n    apply(force)\n   apply(rename_tac e1 e2 c1 c2 w r list a lista)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. r = w' @ [x']\")\n    apply(rename_tac e1 e2 c1 c2 w r list a lista)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac e1 e2 c1 c2 w r list a lista)(*strict*)\n   apply(thin_tac \"r=a#lista\")\n   apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 list w')(*strict*)\n   apply(rule conjI)\n    apply(rename_tac e1 e2 c1 c2 list w')(*strict*)\n    apply(simp add: F_CFG_AUGMENT__input_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n    apply(clarsimp)\n    apply(rename_tac e1 c1 c2 list w')(*strict*)\n    apply(erule disjE)\n     apply(rename_tac e1 c1 c2 list w')(*strict*)\n     prefer 2\n     apply(clarsimp)\n    apply(rename_tac e1 c1 c2 list w')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac e1 e2 c1 c2 list w')(*strict*)\n   apply(rule_tac\n      x=\"list\"\n      in exI)\n   apply(rule_tac\n      x=\"w'\"\n      in exI)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(rename_tac e1 e2 c1 c2 list w')(*strict*)\n    apply (metis butlast_snoc_3)\n   apply(rename_tac e1 e2 c1 c2 list w')(*strict*)\n   apply (metis setA_Concat2 empty_subsetI subset_empty)\n  apply(rename_tac y nat e1 e2 c1 c2 w nata)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y e1 e2 c1 c2 w nata)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac y e1 e2 c1 c2 w nata l r)(*strict*)\n  apply(case_tac l)\n   apply(rename_tac y e1 e2 c1 c2 w nata l r)(*strict*)\n   apply(force)\n  apply(rename_tac y e1 e2 c1 c2 w nata l r a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac y e1 e2 c1 c2 w nata r list)(*strict*)\n  apply(case_tac r)\n   apply(rename_tac y e1 e2 c1 c2 w nata r list)(*strict*)\n   apply(force)\n  apply(rename_tac y e1 e2 c1 c2 w nata r list a lista)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. r = w' @ [x']\")\n   apply(rename_tac y e1 e2 c1 c2 w nata r list a lista)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac y e1 e2 c1 c2 w nata r list a lista)(*strict*)\n  apply(thin_tac \"r=a#lista\")\n  apply(clarsimp)\n  apply(rename_tac y e1 e2 c1 c2 nata list w')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac y e1 e2 c1 c2 nata list w')(*strict*)\n   apply(simp add: F_CFG_AUGMENT__input_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n   apply(clarsimp)\n   apply(rename_tac y e1 c1 c2 nata list w')(*strict*)\n   apply(erule disjE)\n    apply(rename_tac y e1 c1 c2 nata list w')(*strict*)\n    prefer 2\n    apply(clarsimp)\n   apply(rename_tac y e1 c1 c2 nata list w')(*strict*)\n   apply(clarsimp)\n  apply(rename_tac y e1 e2 c1 c2 nata list w')(*strict*)\n  apply(rule_tac\n      x=\"list\"\n      in exI)\n  apply(rule_tac\n      x=\"w'\"\n      in exI)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac y e1 e2 c1 c2 nata list w')(*strict*)\n   apply (metis butlast_snoc_3)\n  apply(rename_tac y e1 e2 c1 c2 nata list w')(*strict*)\n  apply (metis setA_Concat2 empty_subsetI subset_empty)\n  done\n\nlemma from_dollaraugmented_to_input_derivation_initial: \"\n  F_CFG_AUGMENT__input G Do S' G'\n  \\<Longrightarrow> valid_cfg G'\n  \\<Longrightarrow> d (Suc 0) \\<noteq> None\n  \\<Longrightarrow> cfgRM.derivation_initial G' d\n  \\<Longrightarrow> cfgRM.derivation_initial G (derivation_drop (derivation_map d (\\<lambda>c. c\\<lparr>cfg_conf := drop (Suc 0) (butlast (cfg_conf c)) \\<rparr>)) (Suc 0))\"\n  apply(rule cfgRM.derivation_initialI)\n   apply(rule from_dollaraugmented_to_input_derivation)\n       apply(force)\n      apply(force)\n     apply(force)\n    apply(simp add: cfgRM.derivation_initial_def)\n   apply(force)\n  apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G',prod_rhs=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>)\")\n   prefer 2\n   apply(rule F_CFG_AUGMENT__FirstStep)\n          apply(simp add: F_CFG_AUGMENT__input_def)\n         apply(simp add: F_CFG_AUGMENT__input_def)\n        apply(simp add: F_CFG_AUGMENT__input_def)\n       apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(simp add: F_CFG_AUGMENT__input_def)\n     apply(simp add: F_CFG_AUGMENT__input_def)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(clarsimp)\n    apply(rename_tac y c)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def)\n    apply(case_tac \"d 0\")\n     apply(rename_tac y c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac y c a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac y c a option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac y c b)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: derivation_drop_def derivation_map_def)\n  apply(simp add: cfgRM.derivation_initial_def)\n  apply(case_tac \"d 0\")\n   apply(rename_tac c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac c a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b)(*strict*)\n  apply(simp add: get_configuration_def cfg_initial_configurations_def cfg_configurations_def)\n  apply(clarsimp)\n  apply(simp add: valid_cfg_def F_CFG_AUGMENT__input_def)\n  done\n\nlemma cfg_LRk_to_cfg_LRkDo: \"\n  F_CFG_AUGMENT__input G Do S' G'\n  \\<Longrightarrow> cfg_LRk G k\n  \\<Longrightarrow> cfg_LRkDo G' Do S' k\"\n  apply(subgoal_tac \"valid_cfg G'\")\n   prefer 2\n   apply(rule F_CFG_AUGMENT__makes_CFG)\n   apply(force)\n  apply(subgoal_tac \"teB Do \\<notin> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n   prefer 2\n   apply(simp add: F_CFG_AUGMENT__input_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(force)\n   apply(clarsimp)\n   apply(subgoal_tac \"F_FRESH (cfg_events G) \\<notin> cfg_events G\")\n    apply(force)\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n  apply(unfold cfg_LRkDo_def)\n  apply(rule allI)+\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(rule impI)+\n  apply(erule conjE)+\n  apply(subgoal_tac \"\\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> cfg_conf \\<lparr>cfg_conf = \\<delta>1 @ [teA A1] @ liftB y1\\<rparr>=[teB Do]@w@[teB Do]\")\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d1\"\n      in F_CFG_AUGMENT__reachableConf_of_certain_form)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(force)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(rule cfgSTD.derivation_initialI)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v c)(*strict*)\n    apply(case_tac \"d2 0\")\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v c a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v c a option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v c b)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(simp add: valid_cfg_def)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(clarsimp)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(subgoal_tac \"\\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> cfg_conf \\<lparr>cfg_conf = \\<delta>2 @ [teA A2] @ liftB y2\\<rparr>=[teB Do]@w@[teB Do]\")\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d2\"\n      in F_CFG_AUGMENT__reachableConf_of_certain_form)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(force)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(rule cfgSTD.derivation_initialI)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w c)(*strict*)\n    apply(case_tac \"d1 0\")\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w c a)(*strict*)\n    apply(clarsimp)\n    apply(case_tac a)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w c a option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w c b)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(simp add: valid_cfg_def)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w)(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(unfold cfg_LRk_def)\n  apply(erule_tac\n      x=\"derivation_drop (derivation_map d1 (\\<lambda>c. c\\<lparr>cfg_conf:=drop(Suc 0)(butlast(cfg_conf c))\\<rparr>)) (Suc 0)\"\n      in allE)\n  apply(erule_tac\n      x=\"n1\"\n      in allE)\n  apply(erule_tac\n      x=\"drop (Suc 0) \\<delta>1\"\n      in allE)\n  apply(erule_tac\n      x=\"A1\"\n      in allE)\n  apply(erule_tac\n      x=\"butlast y1\"\n      in allE)\n  apply(erule_tac\n      x=\"if n1=0 then None else e1\"\n      in allE)\n  apply(erule_tac\n      x=\"e1'\"\n      in allE)\n  apply(erule_tac\n      x=\"\\<omega>1\"\n      in allE)\n  apply(erule_tac\n      x=\"derivation_drop (derivation_map d2 (\\<lambda>c. c\\<lparr>cfg_conf:=drop(Suc 0)(butlast(cfg_conf c))\\<rparr>)) (Suc 0)\"\n      in allE)\n  apply(erule_tac\n      x=\"n2\"\n      in allE)\n  apply(erule_tac\n      x=\"drop (Suc 0) \\<delta>2\"\n      in allE)\n  apply(erule_tac\n      x=\"A2\"\n      in allE)\n  apply(erule_tac\n      x=\"butlast y2\"\n      in allE)\n  apply(erule_tac\n      x=\"if n2=0 then None else e2\"\n      in allE)\n  apply(erule_tac\n      x=\"e2'\"\n      in allE)\n  apply(erule_tac\n      x=\"\\<omega>2\"\n      in allE)\n  apply(erule_tac\n      x=\"v\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   prefer 2\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 y1 e1 e1' d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n   apply(case_tac \"\\<delta>1\")\n    apply(rename_tac d1 n1 \\<delta>1 y1 e1 e1' d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 y1 e1 e1' d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list)(*strict*)\n   apply(case_tac \"\\<delta>2\")\n    apply(rename_tac d1 n1 \\<delta>1 y1 e1 e1' d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 y1 e1 e1' d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list aa lista)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(subgoal_tac \"d1 (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G',prod_rhs=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>)\")\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   prefer 2\n   apply(rule F_CFG_AUGMENT__FirstStep)\n          apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n          apply(simp add: F_CFG_AUGMENT__input_def)\n         apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n         apply(simp add: F_CFG_AUGMENT__input_def)\n        apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n        apply(simp add: F_CFG_AUGMENT__input_def)\n       apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n       apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n      apply(force)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def)\n    apply(case_tac \"d1 0\")\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v a w wa)(*strict*)\n    apply(case_tac a)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v a w wa option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa b)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(rule from_dollaraugmented_to_input_derivation_initial)\n      apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n      apply(force)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(force)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(subgoal_tac \"\\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> cfg_conf \\<lparr>cfg_conf = \\<delta>1 @ [teA A1] @ liftB y1\\<rparr>=[teB Do]@w@[teB Do]\")\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d1\"\n      in F_CFG_AUGMENT__reachableConf_of_certain_form)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(force)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(rule cfgSTD.derivation_initialI)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa c)(*strict*)\n    apply(case_tac \"d1 0\")\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa c a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa c)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(simp add: valid_cfg_def)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(simp add: derivation_drop_def derivation_map_def)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n   apply(case_tac \"\\<delta>1\")\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list)(*strict*)\n   apply(case_tac y1)\n    apply(rename_tac d1 n1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. y1 = w' @ [x']\")\n    apply(rename_tac d1 n1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac d1 n1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n   apply(thin_tac \"y1=a#lista\")\n   apply(clarsimp)\n   apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list w' x')(*strict*)\n   apply(simp add: liftB_commutes_over_concat)\n   apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(simp add: derivation_drop_def derivation_map_def)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n   apply(case_tac \"\\<delta>1\")\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list)(*strict*)\n   apply(case_tac y1)\n    apply(rename_tac d1 n1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. y1 = w' @ [x']\")\n    apply(rename_tac d1 n1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac d1 n1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n   apply(thin_tac \"y1=a#lista\")\n   apply(clarsimp)\n   apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa list w' x')(*strict*)\n   apply(simp add: liftB_commutes_over_concat)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v wa list w')(*strict*)\n   apply (metis butlast_snoc_3)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(subgoal_tac \"d2 (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G',prod_rhs=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>)\")\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   prefer 2\n   apply(rule F_CFG_AUGMENT__FirstStep)\n          apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n          apply(simp add: F_CFG_AUGMENT__input_def)\n         apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n         apply(simp add: F_CFG_AUGMENT__input_def)\n        apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n        apply(simp add: F_CFG_AUGMENT__input_def)\n       apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n       apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n      apply(force)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def)\n    apply(case_tac \"d2 0\")\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v a w wa)(*strict*)\n    apply(case_tac a)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v a w wa option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa b)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(rule from_dollaraugmented_to_input_derivation_initial)\n      apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n      apply(force)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(force)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(subgoal_tac \"\\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> cfg_conf \\<lparr>cfg_conf = \\<delta>2 @ [teA A2] @ liftB y2\\<rparr>=[teB Do]@w@[teB Do]\")\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d2\"\n      in F_CFG_AUGMENT__reachableConf_of_certain_form)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(force)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(rule cfgSTD.derivation_initialI)\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa c)(*strict*)\n    apply(case_tac \"d2 0\")\n     apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa c a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa c)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(simp add: valid_cfg_def)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(simp add: derivation_drop_def derivation_map_def)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n   apply(case_tac \"\\<delta>2\")\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list)(*strict*)\n   apply(case_tac y2)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. y2 = w' @ [x']\")\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n   apply(thin_tac \"y2=a#lista\")\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w wa list w' x')(*strict*)\n   apply(simp add: liftB_commutes_over_concat)\n   apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(simp add: derivation_drop_def derivation_map_def)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n   apply(case_tac \"\\<delta>2\")\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list)(*strict*)\n   apply(case_tac y2)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. y2 = w' @ [x']\")\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n   apply(thin_tac \"y2=a#lista\")\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w wa list w' x')(*strict*)\n   apply(simp add: liftB_commutes_over_concat)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w list w')(*strict*)\n   apply (metis butlast_snoc_3)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n   apply(case_tac \"\\<delta>2\")\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list)(*strict*)\n   apply(case_tac y2)\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list)(*strict*)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. y2 = w' @ [x']\")\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 y2 e2 e2' \\<omega>2 v w wa list a lista)(*strict*)\n   apply(thin_tac \"y2=a#lista\")\n   apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w wa list w' x')(*strict*)\n   apply(case_tac \"\\<delta>1\")\n    apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w wa list w' x')(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w wa list w' x' a lista)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n  apply(case_tac y2)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa)(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. y2 = w' @ [x']\")\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 y2 e2 e2' \\<omega>2 v w wa a list)(*strict*)\n  apply(thin_tac \"y2=a#list\")\n  apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 e2 e2' \\<omega>2 v w wa w' x')(*strict*)\n  apply(case_tac y1)\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 e2 e2' \\<omega>2 v w wa w' x')(*strict*)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 e2 e2' \\<omega>2 v w wa w' x' a list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. y1 = w' @ [x']\")\n   apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 e2 e2' \\<omega>2 v w wa w' x' a list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac d1 n1 \\<delta>1 A1 y1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 e2 e2' \\<omega>2 v w wa w' x' a list)(*strict*)\n  apply(thin_tac \"y1=a#list\")\n  apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 e2 e2' \\<omega>2 v w wa w' x' w'nonterminal x'nonterminal)(*strict*)\n  apply(simp add: liftB_commutes_over_concat)\n  apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 e2 e2' \\<omega>2 v w wa w' w'nonterminal)(*strict*)\n  apply(case_tac \"\\<delta>2\")\n   apply(rename_tac d1 n1 \\<delta>1 A1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 e2 e2' \\<omega>2 v w wa w' w'nonterminal)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 e1 e1' \\<omega>1 d2 n2 \\<delta>2 A2 e2 e2' \\<omega>2 v w wa w' w'nonterminal a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w w' w'nonterminal list)(*strict*)\n  apply(case_tac \"\\<delta>1\")\n   apply(rename_tac d1 n1 \\<delta>1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w w' w'nonterminal list)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d1 n1 \\<delta>1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w w' w'nonterminal list a lista)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n  apply(simp add: kPrefix_def)\n  apply(subgoal_tac \"\\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> cfg_conf \\<lparr>cfg_conf = teB Do # list @ \\<omega>2 @ liftB w' @ [teB Do]\\<rparr>=[teB Do]@w@[teB Do]\")\n   apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d2\"\n      and i=\"Suc n2\"\n      in F_CFG_AUGMENT__reachableConf_of_certain_form)\n     apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n     apply(force)\n    apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n    apply(rule cfgSTD.derivation_initialI)\n     apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista c)(*strict*)\n    apply(case_tac \"d2 0\")\n     apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista c a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista c)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(simp add: valid_cfg_def)\n   apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n   apply(clarsimp)\n   apply(force)\n  apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n  apply(subgoal_tac \"\\<exists>w. set w \\<subseteq> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G) \\<and> cfg_conf \\<lparr>cfg_conf = teB Do # lista @ \\<omega>1 @ liftB w'nonterminal @ [teB Do]\\<rparr>=[teB Do]@w@[teB Do]\")\n   apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d1\"\n      and i=\"Suc n1\"\n      in F_CFG_AUGMENT__reachableConf_of_certain_form)\n     apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n     apply(force)\n    apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n    apply(rule cfgSTD.derivation_initialI)\n     apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n     apply(rule cfgRM_derivations_are_cfg_derivations)\n     apply(simp add: cfgRM.derivation_initial_def)\n    apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista c)(*strict*)\n    apply(case_tac \"d1 0\")\n     apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista c a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista c)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def get_configuration_def cfg_configurations_def)\n    apply(simp add: valid_cfg_def)\n   apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n   apply(clarsimp)\n   apply(force)\n  apply(rename_tac d1 n1 A1 e1 e1' \\<omega>1 d2 n2 A2 e2 e2' \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n  apply(thin_tac \"cfgRM.derivation_initial G' d1\")\n  apply(thin_tac \"d1 (Suc n1) = Some (pair e1 \\<lparr>cfg_conf = teB Do # lista @ teA A1 # liftB w'nonterminal @ [teB Do]\\<rparr>)\")\n  apply(thin_tac \"d1 (Suc (Suc n1)) = Some (pair (Some e1') \\<lparr>cfg_conf = teB Do # lista @ \\<omega>1 @ liftB w'nonterminal @ [teB Do]\\<rparr>)\")\n  apply(thin_tac \"cfgRM.derivation_initial G' d2\")\n  apply(thin_tac \"d2 (Suc n2) = Some (pair e2 \\<lparr>cfg_conf = teB Do # list @ teA A2 # liftB w' @ [teB Do]\\<rparr>)\")\n  apply(thin_tac \"d2 (Suc (Suc n2)) = Some (pair (Some e2') \\<lparr>cfg_conf = teB Do # list @ \\<omega>2 @ liftB w' @ [teB Do]\\<rparr>)\")\n  apply(thin_tac \"d1 (Suc 0) = Some (pair (Some \\<lparr>prod_lhs = cfg_initial G', prod_rhs = [teB Do, teA (cfg_initial G), teB Do]\\<rparr>) \\<lparr>cfg_conf = [teB Do, teA (cfg_initial G), teB Do]\\<rparr>)\")\n  apply(thin_tac \"cfgRM.derivation_initial G (derivation_drop (derivation_map d1 (\\<lambda>c. c\\<lparr>cfg_conf := drop (Suc 0) (butlast (cfg_conf c))\\<rparr>)) (Suc 0))\")\n  apply(thin_tac \"d2 (Suc 0) = Some (pair (Some \\<lparr>prod_lhs = cfg_initial G', prod_rhs = [teB Do, teA (cfg_initial G), teB Do]\\<rparr>) \\<lparr>cfg_conf = [teB Do, teA (cfg_initial G), teB Do]\\<rparr>)\")\n  apply(thin_tac \"cfgRM.derivation_initial G (derivation_drop (derivation_map d2 (\\<lambda>c. c\\<lparr>cfg_conf := drop (Suc 0) (butlast (cfg_conf c))\\<rparr>)) (Suc 0))\")\n  apply(thin_tac \"teA A2 \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n  apply(thin_tac \"teA A1 \\<in> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n  apply(clarsimp)\n  apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n  apply(case_tac \"take (k - length w'nonterminal) [Do]\")\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"take (k - (length v + length w')) [Do]\")\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista a listb)(*strict*)\n   apply(case_tac \"k - (length v + length w')\")\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista a listb)(*strict*)\n    apply(force)\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista a listb nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n   apply(subgoal_tac \"teB Do \\<in> set(liftB w'nonterminal)\")\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply(subgoal_tac \"teB Do \\<notin> set(liftB w'nonterminal)\")\n     apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n     apply(force)\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply(rule_tac\n      B=\"two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\"\n      in nset_mp)\n     apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n     apply(force)\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply(force)\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n   apply(rule_tac\n      A=\"set(liftB(take k w'nonterminal))\"\n      in set_mp)\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply (metis set_liftB_commute List.set_take_subset)\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n   apply(rule_tac\n      t=\"take k w'nonterminal\"\n      and s=\"v @ w' @ [Do]\"\n      in ssubst)\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply(force)\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n   apply(simp add: liftB_commutes_over_concat)\n  apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista a listb)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"k-length w'nonterminal\")\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista a listb)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista a listb nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n  apply(case_tac \"take (k - (length v + length w')) [Do]\")\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"teB Do \\<in> set (liftB(w'nonterminal@[Do]))\")\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply(subgoal_tac \"teB Do \\<notin> set (liftB(w'nonterminal@[Do]))\")\n     apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n     apply(force)\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    prefer 2\n    apply(simp (no_asm) add: liftB_commutes_over_concat)\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n   apply(rule_tac\n      t=\"w'nonterminal@[Do]\"\n      and s=\"take k v @ take (k - length v) w'\"\n      in ssubst)\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply(force)\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n   apply(rule_tac\n      B=\"set(liftB(v@w'))\"\n      in nset_mp)\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply(simp (no_asm) add: liftB_commutes_over_concat)\n    apply(rule conjI)\n     apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n     apply(rule le_supI1)\n     apply (smt set_liftB_commute List.set_take_subset)\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply(rule le_supI2)\n    apply (smt set_liftB_commute List.set_take_subset)\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n   apply(rule_tac\n      B=\"two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\"\n      in nset_mp)\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply(simp (no_asm) add: liftB_commutes_over_concat)\n    apply(rule conjI)\n     apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n     apply(rule_tac\n      B=\"set(lista @ \\<omega>1 @ liftB v)\"\n      in subset_trans)\n      apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n      apply(simp (no_asm))\n      apply(force)\n     apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n     apply(rule_tac\n      t=\"lista @ \\<omega>1 @ liftB v\"\n      and s=\"list @ \\<omega>2\"\n      in ssubst)\n      apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n      apply(force)\n     apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n     apply(force)\n    apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n    apply(force)\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat)(*strict*)\n   apply(force)\n  apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat a listb)(*strict*)\n  apply(clarsimp)\n  apply(case_tac \"(k - (length v + length w'))\")\n   apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat a listb)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac \\<omega>1 \\<omega>2 v w' w'nonterminal list lista nat a listb nata)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma cfg_LRkDo_implies_no_reduce_reduce_item_conflict: \"\n  F_CFG_AUGMENT__input G Do S' G'\n  \\<Longrightarrow> cfg_LRkDo G' Do S' k\n  \\<Longrightarrow> \\<forall>I1 I2. I1 \\<in> valid_item_set G' k w \\<and> I2 \\<in> valid_item_set G' k w \\<and> (item_core I1 \\<in> cfg_productions G) \\<and> (item_core I2 \\<in> cfg_productions G) \\<longrightarrow> (\\<not> (item_reduce_reduce_conflict I1 I2))\"\n  apply(subgoal_tac \"valid_cfg G'\")\n   prefer 2\n   apply(rule F_CFG_AUGMENT__makes_CFG)\n   apply(force)\n  apply(subgoal_tac \"teB Do \\<notin> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n   prefer 2\n   apply(simp add: F_CFG_AUGMENT__input_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(force)\n   apply(clarsimp)\n   apply(subgoal_tac \"F_FRESH (cfg_events G) \\<notin> cfg_events G\")\n    apply(force)\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n  apply(clarsimp)\n  apply(rename_tac I1 I2)(*strict*)\n  apply(simp add: item_reduce_reduce_conflict_def)\n  apply(clarsimp)\n  apply(simp add: valid_item_set_def valid_item_set_n_def)\n  apply(clarsimp)\n  apply(rename_tac n na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za)(*strict*)\n  apply(case_tac n)\n   apply(rename_tac n na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n   apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G',prod_rhs=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>)\")\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n    prefer 2\n    apply(rule F_CFG_AUGMENT__FirstStep)\n           apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n           apply(simp add: F_CFG_AUGMENT__input_def)\n          apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n          apply(simp add: F_CFG_AUGMENT__input_def)\n         apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n         apply(simp add: F_CFG_AUGMENT__input_def)\n        apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n        apply(simp add: F_CFG_AUGMENT__input_def)\n       apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n       apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n      apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rule cfgRM_derivations_are_cfg_derivations)\n      apply(simp add: cfgRM.derivation_initial_def)\n     apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def)\n    apply(case_tac \"d 0\")\n     apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n    apply(force)\n   apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e2 z \\<delta>' e1a e2a za)(*strict*)\n   apply(simp add: item_core_def)\n   apply(clarsimp)\n   apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> z \\<delta>' e1a e2a za)(*strict*)\n   apply(case_tac \"\\<delta>\")\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> z \\<delta>' e1a e2a za)(*strict*)\n    prefer 2\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> z \\<delta>' e1a e2a za a list)(*strict*)\n    apply(force)\n   apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> z \\<delta>' e1a e2a za)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac na Aa \\<alpha>' ya d da \\<delta>' e1a e2a za)(*strict*)\n   apply(case_tac ya)\n    apply(rename_tac na Aa \\<alpha>' ya d da \\<delta>' e1a e2a za)(*strict*)\n    prefer 2\n    apply(rename_tac na Aa \\<alpha>' ya d da \\<delta>' e1a e2a za a list)(*strict*)\n    apply(force)\n   apply(rename_tac na Aa \\<alpha>' ya d da \\<delta>' e1a e2a za)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac na Aa \\<alpha>' d da \\<delta>' e1a e2a za)(*strict*)\n   apply(simp add: F_CFG_AUGMENT__input_def F_CFG_AUGMENT_def valid_cfg_def two_elements_construct_domain_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = \\<delta>' @ \\<alpha>'\\<rparr>\"\n      and P=\"\\<lambda>e. setA (prod_rhs e) \\<subseteq> insert (F_FRESH (cfg_nonterminals G)) (cfg_nonterminals G) \\<and> setB (prod_rhs e) \\<subseteq> insert (F_FRESH (cfg_events G)) (cfg_events G)\"\n      in ballE)\n    apply(rename_tac na Aa \\<alpha>' d da \\<delta>' e1a e2a za)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac na Aa \\<alpha>' d da \\<delta>' e1a e2a za)(*strict*)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = \\<delta>' @ \\<alpha>'\\<rparr>\"\n      in ballE)\n    apply(rename_tac na Aa \\<alpha>' d da \\<delta>' e1a e2a za)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac na Aa \\<alpha>' d da \\<delta>' e1a e2a za)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n    apply(rename_tac na Aa \\<alpha>' d da \\<delta>' e1a e2a za)(*strict*)\n    apply(force)\n   apply(rename_tac na Aa \\<alpha>' d da \\<delta>' e1a e2a za)(*strict*)\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n  apply(rename_tac n na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat)(*strict*)\n  apply(case_tac na)\n   apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n   apply(subgoal_tac \"da (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G',prod_rhs=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>)\")\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n    prefer 2\n    apply(rule F_CFG_AUGMENT__FirstStep)\n           apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n           apply(simp add: F_CFG_AUGMENT__input_def)\n          apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n          apply(simp add: F_CFG_AUGMENT__input_def)\n         apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n         apply(simp add: F_CFG_AUGMENT__input_def)\n        apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n        apply(simp add: F_CFG_AUGMENT__input_def)\n       apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n       apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n      apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rule cfgRM_derivations_are_cfg_derivations)\n      apply(simp add: cfgRM.derivation_initial_def)\n     apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def)\n    apply(case_tac \"da 0\")\n     apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e2a za nat)(*strict*)\n   apply(simp add: item_core_def)\n   apply(clarsimp)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' za nat)(*strict*)\n   apply(case_tac \"\\<delta>'\")\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' za nat)(*strict*)\n    prefer 2\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' za nat a list)(*strict*)\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' za nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A \\<alpha> ya d da \\<delta> e1 e2 z nat)(*strict*)\n   apply(simp add: F_CFG_AUGMENT__input_def F_CFG_AUGMENT_def valid_cfg_def two_elements_construct_domain_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = \\<delta> @ \\<alpha>\\<rparr>\"\n      and P=\"\\<lambda>e. setA (prod_rhs e) \\<subseteq> insert (F_FRESH (cfg_nonterminals G)) (cfg_nonterminals G) \\<and> setB (prod_rhs e) \\<subseteq> insert (F_FRESH (cfg_events G)) (cfg_events G)\"\n      in ballE)\n    apply(rename_tac A \\<alpha> ya d da \\<delta> e1 e2 z nat)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac A \\<alpha> ya d da \\<delta> e1 e2 z nat)(*strict*)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = \\<delta> @ \\<alpha>\\<rparr>\"\n      in ballE)\n    apply(rename_tac A \\<alpha> ya d da \\<delta> e1 e2 z nat)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac A \\<alpha> ya d da \\<delta> e1 e2 z nat)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n    apply(rename_tac A \\<alpha> ya d da \\<delta> e1 e2 z nat)(*strict*)\n    apply(force)\n   apply(rename_tac A \\<alpha> ya d da \\<delta> e1 e2 z nat)(*strict*)\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n  apply(rename_tac na A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n  apply(unfold cfg_LRkDo_def)\n  apply(erule_tac\n      x=\"d\"\n      in allE)\n  apply(erule_tac\n      x=\"nat\"\n      in allE)\n  apply(erule_tac\n      x=\"\\<delta>\"\n      in allE)\n  apply(erule_tac\n      x=\"A\"\n      in allE)\n  apply(erule_tac\n      x=\"filterB z\"\n      in allE)\n  apply(erule_tac\n      x=\"e1\"\n      in allE)\n  apply(erule_tac\n      x=\"the e2\"\n      in allE)\n  apply(erule_tac\n      x=\"\\<alpha>\"\n      in allE)\n  apply(erule_tac\n      x=\"da\"\n      in allE)\n  apply(erule_tac\n      x=\"nata\"\n      in allE)\n  apply(erule_tac\n      x=\"\\<delta>'\"\n      in allE)\n  apply(erule_tac\n      x=\"Aa\"\n      in allE)\n  apply(erule_tac\n      x=\"filterB za\"\n      in allE)\n  apply(erule_tac\n      x=\"e1a\"\n      in allE)\n  apply(erule_tac\n      x=\"the e2a\"\n      in allE)\n  apply(erule_tac\n      x=\"\\<alpha>'\"\n      in allE)\n  apply(erule_tac\n      x=\"[]\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n   apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def cfg_configurations_def valid_cfg_def)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n   apply(clarsimp)\n   apply (metis liftBDeConv2)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d (Suc nat) = Some (pair e1 c1) \\<and> d (Suc (Suc nat)) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G' c1 e2 c2\")\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc(Suc nat)\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n     apply(force)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n   apply(force)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za nat nata)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a e2a za nat nata e2b)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. da (Suc nata) = Some (pair e1 c1) \\<and> da (Suc (Suc nata)) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G' c1 e2 c2\")\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a e2a za nat nata e2b)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc(Suc nata)\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a e2a za nat nata e2b)(*strict*)\n     apply(force)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a e2a za nat nata e2b)(*strict*)\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a e2a za nat nata e2b)(*strict*)\n   apply(force)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a e2a za nat nata e2b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a za nat nata e2b e2)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a za nat nata e2b e2)(*strict*)\n   apply (metis liftBDeConv2)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a za nat nata e2b e2)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a za nat nata e2b e2)(*strict*)\n   apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def cfg_configurations_def valid_cfg_def)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a za nat nata e2b e2)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a za nat nata e2b e2)(*strict*)\n   apply (metis liftBDeConv2)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' ya d da \\<delta> e1 z \\<delta>' e1a za nat nata e2b e2)(*strict*)\n  apply(simp add: kPrefix_def)\n  apply(metis liftBDeConv1 filterB_take)\n  done\n\nlemma cfg_LRkDo_implies_no_shift_reduce_item_conflict: \"\n  F_CFG_AUGMENT__input G Do S' G'\n  \\<Longrightarrow> cfg_LRkDo G' Do S' k\n  \\<Longrightarrow> \\<forall>I1 I2. I1 \\<in> valid_item_set G' k w \\<and> I2 \\<in> valid_item_set G' k w \\<and> (item_core I1 \\<in> cfg_productions G) \\<and> (item_core I2 \\<in> cfg_productions G) \\<longrightarrow> (\\<not> (item_shift_reduce_conflict G' k I1 I2))\"\n  apply(subgoal_tac \"valid_cfg G'\")\n   prefer 2\n   apply(rule F_CFG_AUGMENT__makes_CFG)\n   apply(force)\n  apply(subgoal_tac \"teB Do \\<notin> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n   prefer 2\n   apply(simp add: F_CFG_AUGMENT__input_def F_CFG_AUGMENT_def two_elements_construct_domain_def)\n   apply(clarsimp)\n   apply(rule conjI)\n    apply(force)\n   apply(clarsimp)\n   apply(subgoal_tac \"F_FRESH (cfg_events G) \\<notin> cfg_events G\")\n    apply(force)\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n  apply(clarsimp)\n  apply(rename_tac I1 I2)(*strict*)\n  apply(simp add: item_shift_reduce_conflict_def)\n  apply(simp add: valid_item_set_def valid_item_set_n_def)\n  apply(clarsimp)\n  apply(rename_tac n na A Aa \\<alpha> \\<alpha>' \\<beta> \\<beta>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za)(*strict*)\n  apply(case_tac \"\\<beta>\")\n   apply(rename_tac n na A Aa \\<alpha> \\<alpha>' \\<beta> \\<beta>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za)(*strict*)\n   apply(force)\n  apply(rename_tac n na A Aa \\<alpha> \\<alpha>' \\<beta> \\<beta>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za a list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n na A Aa \\<alpha> \\<alpha>' \\<beta>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za a list)(*strict*)\n  apply(case_tac a)\n   apply(rename_tac n na A Aa \\<alpha> \\<alpha>' \\<beta>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za a list aa)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac n na A Aa \\<alpha> \\<alpha>' \\<beta>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za a list b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac n na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b)(*strict*)\n  apply(case_tac n)\n   apply(rename_tac n na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n   apply(subgoal_tac \"d (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G',prod_rhs=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>)\")\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n    prefer 2\n    apply(rule F_CFG_AUGMENT__FirstStep)\n           apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n           apply(simp add: F_CFG_AUGMENT__input_def)\n          apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n          apply(simp add: F_CFG_AUGMENT__input_def)\n         apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n         apply(simp add: F_CFG_AUGMENT__input_def)\n        apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n        apply(simp add: F_CFG_AUGMENT__input_def)\n       apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n       apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n      apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rule cfgRM_derivations_are_cfg_derivations)\n      apply(simp add: cfgRM.derivation_initial_def)\n     apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def)\n    apply(case_tac \"d 0\")\n     apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n    apply(force)\n   apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e2 z \\<delta>' e1a e2a za list b)(*strict*)\n   apply(simp add: item_core_def)\n   apply(clarsimp)\n   apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> z \\<delta>' e1a e2a za list b)(*strict*)\n   apply(case_tac \"\\<delta>\")\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> z \\<delta>' e1a e2a za list b)(*strict*)\n    prefer 2\n    apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> z \\<delta>' e1a e2a za list b a lista)(*strict*)\n    apply(force)\n   apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> z \\<delta>' e1a e2a za list b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac na Aa \\<alpha>' y ya d da \\<delta>' e1a e2a za list b)(*strict*)\n   apply(simp add: F_CFG_AUGMENT__input_def F_CFG_AUGMENT_def valid_cfg_def two_elements_construct_domain_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = \\<delta>' @ \\<alpha>' @ teB b # list\\<rparr>\"\n      and P=\"\\<lambda>e. setA (prod_rhs e) \\<subseteq> insert (F_FRESH (cfg_nonterminals G)) (cfg_nonterminals G) \\<and> setB (prod_rhs e) \\<subseteq> insert (F_FRESH (cfg_events G)) (cfg_events G)\"\n      in ballE)\n    apply(rename_tac na Aa \\<alpha>' y ya d da \\<delta>' e1a e2a za list b)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac na Aa \\<alpha>' y ya d da \\<delta>' e1a e2a za list b)(*strict*)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = \\<delta>' @ \\<alpha>' @ teB b # list\\<rparr>\"\n      in ballE)\n    apply(rename_tac na Aa \\<alpha>' y ya d da \\<delta>' e1a e2a za list b)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac na Aa \\<alpha>' y ya d da \\<delta>' e1a e2a za list b)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n    apply(rename_tac na Aa \\<alpha>' y ya d da \\<delta>' e1a e2a za list b)(*strict*)\n    apply(force)\n   apply(rename_tac na Aa \\<alpha>' y ya d da \\<delta>' e1a e2a za list b)(*strict*)\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n  apply(rename_tac n na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat)(*strict*)\n  apply(case_tac na)\n   apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n   apply(subgoal_tac \"da (Suc 0)= Some (pair (Some \\<lparr>prod_lhs=cfg_initial G',prod_rhs=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>) \\<lparr>cfg_conf=[teB Do,teA (cfg_initial G),teB Do]\\<rparr>)\")\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n    prefer 2\n    apply(rule F_CFG_AUGMENT__FirstStep)\n           apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n           apply(simp add: F_CFG_AUGMENT__input_def)\n          apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n          apply(simp add: F_CFG_AUGMENT__input_def)\n         apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n         apply(simp add: F_CFG_AUGMENT__input_def)\n        apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n        apply(simp add: F_CFG_AUGMENT__input_def)\n       apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n       apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n      apply(simp add: F_CFG_AUGMENT__input_def)\n      apply(rule cfgRM_derivations_are_cfg_derivations)\n      apply(simp add: cfgRM.derivation_initial_def)\n     apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def)\n    apply(case_tac \"da 0\")\n     apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat a)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e2a za list b nat)(*strict*)\n   apply(simp add: item_core_def)\n   apply(clarsimp)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' za list b nat)(*strict*)\n   apply(case_tac \"\\<delta>'\")\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' za list b nat)(*strict*)\n    prefer 2\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' za list b nat a lista)(*strict*)\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' za list b nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A \\<alpha> y ya d da \\<delta> e1 e2 z list b nat)(*strict*)\n   apply(simp add: F_CFG_AUGMENT__input_def F_CFG_AUGMENT_def valid_cfg_def two_elements_construct_domain_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = \\<delta> @ \\<alpha>\\<rparr>\"\n      and P=\"\\<lambda>e. setA (prod_rhs e) \\<subseteq> insert (F_FRESH (cfg_nonterminals G)) (cfg_nonterminals G) \\<and> setB (prod_rhs e) \\<subseteq> insert (F_FRESH (cfg_events G)) (cfg_events G)\"\n      in ballE)\n    apply(rename_tac A \\<alpha> y ya d da \\<delta> e1 e2 z list b nat)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac A \\<alpha> y ya d da \\<delta> e1 e2 z list b nat)(*strict*)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = F_FRESH (cfg_nonterminals G), prod_rhs = \\<delta> @ \\<alpha>\\<rparr>\"\n      in ballE)\n    apply(rename_tac A \\<alpha> y ya d da \\<delta> e1 e2 z list b nat)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac A \\<alpha> y ya d da \\<delta> e1 e2 z list b nat)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"F_FRESH (cfg_nonterminals G) \\<notin> cfg_nonterminals G\")\n    apply(rename_tac A \\<alpha> y ya d da \\<delta> e1 e2 z list b nat)(*strict*)\n    apply(force)\n   apply(rename_tac A \\<alpha> y ya d da \\<delta> e1 e2 z list b nat)(*strict*)\n   apply(rule F_FRESH_is_fresh)\n   apply(simp add: F_LR_MACHINE_def F_CFG_AUGMENT_def two_elements_construct_domain_def valid_cfg_def)\n  apply(rename_tac na A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' y ya d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata)(*strict*)\n  apply(simp add: cfgSTD_first_def)\n  apply(clarsimp)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db e1b n)(*strict*)\n  apply(case_tac n)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db e1b n)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n   apply(unfold cfg_LRkDo_def)[1]\n   apply(erule_tac\n      x=\"da\"\n      in allE)\n   apply(erule_tac\n      x=\"nata\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<delta>'\"\n      in allE)\n   apply(erule_tac\n      x=\"Aa\"\n      in allE)\n   apply(erule_tac\n      x=\"filterB za\"\n      in allE)\n   apply(erule_tac\n      x=\"e1a\"\n      in allE)\n   apply(erule_tac\n      x=\"the e2a\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<alpha>'\"\n      in allE)\n   apply(erule_tac\n      x=\"d\"\n      in allE)\n   apply(erule_tac\n      x=\"nat\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<delta>\"\n      in allE)\n   apply(erule_tac\n      x=\"A\"\n      in allE)\n   apply(erule_tac\n      x=\"filterB z\"\n      in allE)\n   apply(erule_tac\n      x=\"e1\"\n      in allE)\n   apply(erule_tac\n      x=\"the e2\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<alpha>@teB b#list\"\n      in allE)\n   apply(erule_tac\n      x=\"filterB (teB b# list)\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def cfg_configurations_def valid_cfg_def)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n    apply(clarsimp)\n    apply (metis liftBDeConv2)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d (Suc nat) = Some (pair e1 c1) \\<and> d (Suc (Suc nat)) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G' c1 e2 c2\")\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc(Suc nat)\"\n      in cfgRM.step_detail_before_some_position)\n      apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n      apply(force)\n     apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n     apply(force)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a e2a za list b nat nata x db e2b)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. da (Suc nata) = Some (pair e1 c1) \\<and> da (Suc (Suc nata)) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G' c1 e2 c2\")\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a e2a za list b nat nata x db e2b)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc(Suc nata)\"\n      in cfgRM.step_detail_before_some_position)\n      apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a e2a za list b nat nata x db e2b)(*strict*)\n      apply(force)\n     apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a e2a za list b nat nata x db e2b)(*strict*)\n     apply(force)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a e2a za list b nat nata x db e2b)(*strict*)\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a e2a za list b nat nata x db e2b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply (metis liftBDeConv2)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def cfg_configurations_def valid_cfg_def)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply (metis liftBDeConv2)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply (metis setA_Concat2 setA_liftB setA_take_head liftB.simps(2) liftBDeConv2 append_eq_appendI subset_empty)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(simp add: kPrefix_def)\n   apply(rule_tac\n      t=\"take k (filterB za)\"\n      and s=\"filterB (take k za)\"\n      in ssubst)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply (metis filterB_take)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(rule_tac\n      t=\"take k za\"\n      and s=\"liftB (take k x)\"\n      in ssubst)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(rule_tac\n      t=\"filterB (liftB (take k x))\"\n      and s=\"take k x\"\n      in ssubst)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply (metis filterB_take take_liftB_co)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(rule liftB_inj)\n   apply(rule_tac\n      t=\"liftB (take k x)\"\n      and s=\"take k (liftB x)\"\n      in ssubst)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply (smt take_liftB)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(rule_tac\n      t=\"liftB x\"\n      and s=\"teB b # list @ liftB y\"\n      in ssubst)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply(force)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(rule_tac\n      t=\"liftB (take k (b # filterB list @ filterB z))\"\n      and s=\" (take k (liftB (b # filterB list @ filterB z))) \"\n      in ssubst)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply (metis take_liftB)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(simp (no_asm) add: liftB_commutes_over_concat)\n   apply(rule_tac\n      t=\"liftB (filterB z)\"\n      and s=\"z\"\n      in ssubst)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply (metis liftBDeConv2)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply(rule_tac\n      t=\"liftB (filterB list)\"\n      and s=\"list\"\n      in ssubst)\n    apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n    apply (rule liftBDeConv2)\n    apply (metis setA_Concat2 setA_liftB setA_take_head subset_empty)\n   apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 z \\<delta>' e1a za list b nat nata x db e2b e2)(*strict*)\n   apply (metis append_Cons take_liftB take_shift)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db e1b n natb)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A Aa \\<alpha> \\<alpha>' y d da \\<delta> e1 e2 z \\<delta>' e1a e2a za list b nat nata x db e1b natb)(*strict*)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n3)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n3)(*strict*)\n  apply(rename_tac n)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n)(*strict*)\n  apply(subgoal_tac \"\\<exists>d' e. cfgRM.derivation G' d' \\<and> maximum_of_domain d' (Suc n) \\<and> d' 0 = Some (pair None \\<lparr>cfg_conf = teB a # \\<beta> @ liftB z\\<rparr>) \\<and> d' (Suc n) = Some (pair e \\<lparr>cfg_conf=liftB x\\<rparr>)\")\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"db\"\n      in cfg_derivation_can_be_translated_to_cfgRM_derivation)\n        apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n)(*strict*)\n        apply(force)\n       apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n)(*strict*)\n       apply(force)\n      apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n)(*strict*)\n      apply(force)\n     apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n)(*strict*)\n     apply(force)\n    apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n)(*strict*)\n   apply (metis setA_liftB)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x db e1b n)(*strict*)\n  apply(thin_tac \"cfgSTD.derivation G' db\")\n  apply(thin_tac \"maximum_of_domain db (Suc n)\")\n  apply(thin_tac \"db 0 = Some (pair None \\<lparr>cfg_conf = teB a # \\<beta> @ liftB z\\<rparr>)\")\n  apply(thin_tac \"db (Suc n) = Some (pair e1b \\<lparr>cfg_conf = liftB x\\<rparr>)\")\n  apply(clarsimp)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e)(*strict*)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d' n = Some (pair e1 c1) \\<and> d' (Suc n) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G' c1 e2 c2\")\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc n\"\n      in cfgRM.step_detail_before_some_position)\n     apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e)(*strict*)\n     apply(force)\n    apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e)(*strict*)\n   apply(force)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b e2b c1)(*strict*)\n  apply(simp add: cfgRM_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b e2b c1 l r)(*strict*)\n  apply(case_tac e2b)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b e2b c1 l r prod_lhsa prod_rhsa)(*strict*)\n  apply(rename_tac A2 \\<omega>2)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b e2b c1 l r A2 \\<omega>2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b c1 l r A2 \\<omega>2)(*strict*)\n  apply(case_tac c1)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b c1 l r A2 \\<omega>2 cfg_confa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2)(*strict*)\n  apply(subgoal_tac \"\\<exists>w. [teB a]@w@(liftB z)=l @ teA A2 # r\")\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2)(*strict*)\n   prefer 2\n   apply(rule_tac\n      d=\"d'\"\n      and i=\"0\"\n      and j=\"n\"\n      in CFGRM_terminals_stays_context)\n         apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2)(*strict*)\n         apply(force)\n        apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2)(*strict*)\n        apply(force)\n       apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2)(*strict*)\n       apply(force)\n      apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2)(*strict*)\n      apply (metis setA_liftB)\n     apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2)(*strict*)\n     apply(force)\n    apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2)(*strict*)\n   apply(force)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2 w)(*strict*)\n  apply(case_tac l)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2 w)(*strict*)\n   apply(force)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b l r A2 \\<omega>2 w aa list)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b r A2 \\<omega>2 w list)(*strict*)\n  apply(subgoal_tac \"suffix r (liftB z)\")\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b r A2 \\<omega>2 w list)(*strict*)\n   prefer 2\n   apply(rule_tac\n      l=\"[]\"\n      and v=\"w\"\n      and w=\"list\"\n      and A=\"A2\"\n      and ra=\"r\"\n      in suffix_tails_terminal)\n     apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b r A2 \\<omega>2 w list)(*strict*)\n     apply (metis setA_liftB)\n    apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b r A2 \\<omega>2 w list)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b r A2 \\<omega>2 w list)(*strict*)\n   apply(force)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b r A2 \\<omega>2 w list)(*strict*)\n  apply(simp add: suffix_def)\n  apply(clarsimp)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 list c)(*strict*)\n  apply(rename_tac \\<alpha>' y')\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n  apply(subgoal_tac \"\\<exists>d. cfgRM.derivation G' d \\<and> d 0 = Some (pair None \\<lparr>cfg_conf = [teA (cfg_initial G')]\\<rparr>) \\<and> d (Suc n1) = Some (pair e1 \\<lparr>cfg_conf = \\<delta>2' @ teA A # y2'\\<rparr>) \\<and> d(Suc (Suc n1)) = Some (pair e2 \\<lparr>cfg_conf = \\<delta>2' @ \\<alpha> @ teB a # \\<beta> @ y2'\\<rparr>) \\<and> d (Suc (Suc n1)+n) = Some (pair (if n=0 then e2 else e1b) \\<lparr>cfg_conf = \\<delta>2' @ \\<alpha> @ teB a # \\<alpha>' @ teA A2 # y' @ liftB z @ (drop k y2')\\<rparr>) \\<and> d (Suc(Suc n1)+Suc n) = Some (pair (Some \\<lparr>prod_lhs = A2, prod_rhs = \\<omega>2\\<rparr>) \\<lparr>cfg_conf = \\<delta>2' @ \\<alpha> @ teB a # \\<alpha>' @ \\<omega>2 @ y' @ liftB z @ (drop k y2')\\<rparr>) \\<and> maximum_of_domain d (Suc(Suc n1)+Suc n) \")\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(thin_tac \"cfgRM.derivation G' d1\")\n   apply(thin_tac \"d1 0 = Some (pair None \\<lparr>cfg_conf = [teA (cfg_initial G')]\\<rparr>)\")\n   apply(thin_tac \"d1 (Suc n1) = Some (pair e1 \\<lparr>cfg_conf = \\<delta>2' @ teA A # y2'\\<rparr>)\")\n   apply(thin_tac \"d1 (Suc (Suc n1)) = Some (pair e2 \\<lparr>cfg_conf = \\<delta>2' @ \\<alpha> @ teB a # \\<beta> @ y2'\\<rparr>)\")\n   apply(thin_tac \"maximum_of_domain d1 (Suc (Suc n1))\")\n   apply(thin_tac \"cfgRM.derivation G' d'\")\n   apply(thin_tac \"maximum_of_domain d' (Suc n)\")\n   apply(thin_tac \"d' 0 = Some (pair None \\<lparr>cfg_conf = teB a # \\<beta> @ liftB z\\<rparr>)\")\n   apply(thin_tac \"d' (Suc n) = Some (pair (Some \\<lparr>prod_lhs = A2, prod_rhs = \\<omega>2\\<rparr>) \\<lparr>cfg_conf = teB a # \\<alpha>' @ \\<omega>2 @ y' @ liftB z\\<rparr>)\")\n   apply(thin_tac \"d' n = Some (pair e1b \\<lparr>cfg_conf = teB a # \\<alpha>' @ teA A2 # y' @ liftB z\\<rparr>)\")\n   apply(clarsimp)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n   apply(unfold cfg_LRkDo_def)[1]\n   apply(erule_tac\n      x=\"d2\"\n      in allE)\n   apply(erule_tac\n      x=\"n2\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<delta>1\"\n      in allE)\n   apply(erule_tac\n      x=\"B\"\n      in allE)\n   apply(erule_tac\n      x=\"filterB y1\"\n      in allE)\n   apply(erule_tac\n      x=\"e1a\"\n      in allE)\n   apply(erule_tac\n      x=\"the e2a\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<omega>\"\n      in allE)\n   apply(erule_tac\n      x=\"d\"\n      in allE)\n   apply(erule_tac\n      x=\"(Suc (n1 + n))\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<delta>2' @ \\<alpha> @ teB a # \\<alpha>'\"\n      in allE)\n   apply(erule_tac\n      x=\"A2\"\n      in allE)\n   apply(erule_tac\n      x=\"filterB (y'@y2')\"\n      in allE)\n   apply(erule_tac\n      x=\"if n=0 then e2 else e1b\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<lparr>prod_lhs = A2, prod_rhs = \\<omega>2\\<rparr>\"\n      in allE)\n   apply(erule_tac\n      x=\"\\<omega>2\"\n      in allE)\n   apply(erule_tac\n      x=\"filterB (teB a # \\<alpha>' @ \\<omega>2)\"\n      in allE)\n   apply(erule impE)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    prefer 2\n    apply(clarsimp)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def cfg_configurations_def valid_cfg_def)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    apply(clarsimp)\n    apply (metis liftBDeConv2)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n   apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d2 (Suc n2) = Some (pair e1 c1) \\<and> d2 (Suc (Suc n2)) = Some (pair (Some e2) c2) \\<and> cfgRM_step_relation G' c1 e2 c2\")\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    prefer 2\n    apply(rule_tac\n      m=\"Suc(Suc n2)\"\n      in cfgRM.step_detail_before_some_position)\n      apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n      apply(force)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n     apply(force)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply (metis liftBDeConv2)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    apply(simp add: cfgRM.derivation_initial_def cfg_initial_configurations_def cfg_configurations_def valid_cfg_def)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(rule_tac\n      t=\"liftB (filterB (y' @ y2'))\"\n      and s=\"y'@y2'\"\n      in ssubst)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n     apply (rule liftBDeConv2)\n     apply (metis setA_Concat2 setA_app empty_subsetI subset_empty)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      t=\"liftB z\"\n      and s=\"take k y2'\"\n      in subst)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n     apply(force)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(rule_tac\n      t=\"take k y2' @ drop k y2'\"\n      and s=\"y2'\"\n      in ssubst)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n     apply(rule append_take_drop_id)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    apply(rule_tac\n      t=\"liftB (filterB (y' @ y2'))\"\n      and s=\"y'@y2'\"\n      in ssubst)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n     apply (rule liftBDeConv2)\n     apply (metis setA_Concat2 setA_app empty_subsetI subset_empty)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(rule_tac\n      t=\"liftB z\"\n      and s=\"take k y2'\"\n      in subst)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n     apply(force)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(rule_tac\n      t=\"take k y2' @ drop k y2'\"\n      and s=\"y2'\"\n      in ssubst)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n     apply(rule append_take_drop_id)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(rule_tac\n      t=\"liftB (filterB (\\<alpha>' @ \\<omega>2))\"\n      and s=\"\\<alpha>'@\\<omega>2\"\n      in ssubst)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n     apply (rule liftBDeConv2)\n     apply(rule order_antisym)\n      apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n      apply(rule_tac\n      B=\"setA(teB a # \\<alpha>' @ \\<omega>2 @ y' @ liftB z)\"\n      in subset_trans)\n       apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n       apply(simp (no_asm))\n       apply(simp add: setAConcat)\n      apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n      apply(rule_tac\n      t=\"teB a # \\<alpha>' @ \\<omega>2 @ y' @ liftB z\"\n      and s=\"liftB x\"\n      in ssubst)\n       apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n       apply(force)\n      apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n      apply(simp (no_asm))\n      apply(rule setA_liftB_empty)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n     apply(force)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      t=\"a # filterB (\\<alpha>' @ \\<omega>2) @ filterB (y' @ y2')\"\n      and s=\"filterB (teB a # \\<alpha>' @ \\<omega>2 @ y' @ y2')\"\n      in ssubst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(simp add: filterB_commutes_over_concat)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      t=\"y2'\"\n      and s=\"take k y2' @ (drop k y2')\"\n      in subst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(rule append_take_drop_id)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      t=\"teB a # \\<alpha>' @ \\<omega>2 @ y' @ take k y2' @ drop k y2'\"\n      and s=\"(teB a # \\<alpha>' @ \\<omega>2 @ y' @ take k y2') @ drop k y2'\"\n      in ssubst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      t=\"take k y2'\"\n      and s=\"liftB z\"\n      in ssubst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      t=\"(teB a # \\<alpha>' @ \\<omega>2 @ y' @ liftB z)\"\n      and s=\"liftB x\"\n      in ssubst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      t=\"kPrefix k (filterB y1)\"\n      and s=\"take k (filterB y1)\"\n      in ssubst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(simp add: kPrefix_def)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      t=\"kPrefix k (filterB (liftB x @ drop k y2'))\"\n      and s=\"take k (filterB (liftB x @ drop k y2'))\"\n      in ssubst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(simp add: kPrefix_def)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      t=\"take k (filterB y1)\"\n      and s=\"filterB(take k y1)\"\n      in ssubst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply (metis filterB_take)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      t=\"take k (filterB (liftB x @ drop k y2'))\"\n      and s=\"filterB(take k ((liftB x @ drop k y2')))\"\n      in subst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply (rule filterB_take)\n    apply(simp (no_asm) add: setAConcat)\n    apply(rule conjI)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n     apply(rule setA_liftB_empty)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply (metis setADropIndexSubset2 subset_empty)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      f=\"filterB\"\n      in arg_cong)\n   apply(rule_tac\n      t=\"take k y1\"\n      and s=\"liftB (take k x)\"\n      in ssubst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(simp (no_asm))\n   apply(rule_tac\n      t=\"take k (liftB x)\"\n      and s=\"liftB (take k x)\"\n      in ssubst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply (metis take_liftB)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(simp (no_asm))\n   apply(case_tac \"length y2' \\<le> k\")\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule disjI1)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"liftB z\"\n      and s=\"take k y2'\"\n      in ssubst)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(rule_tac\n      j=\"length(take k y2')\"\n      in le_trans)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(rule_tac\n      t=\"length (take k y2')\"\n      and s=\"k\"\n      in ssubst)\n     apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n     apply(rule take_all_length)\n     apply(force)\n    apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n    apply(force)\n   apply(rename_tac A B \\<alpha> \\<omega> z d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a y1 \\<beta> a n1 n2 x n e1b A2 \\<omega>2 \\<alpha>' y' d e2b)(*strict*)\n   apply(force)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n  apply(thin_tac \"cfg_LRkDo G' Do S' k\")\n  apply(thin_tac \"teB Do \\<notin> two_elements_construct_domain (cfg_nonterminals G) (cfg_events G)\")\n  apply(thin_tac \"item_core \\<lparr>cfg_item_lhs = A, cfg_item_rhs1 = \\<alpha>, cfg_item_rhs2 = teB a # \\<beta>, cfg_item_look_ahead = z\\<rparr> \\<in> cfg_productions G\")\n  apply(thin_tac \"item_core \\<lparr>cfg_item_lhs = B, cfg_item_rhs1 = \\<omega>, cfg_item_rhs2 = [], cfg_item_look_ahead = take k x\\<rparr> \\<in> cfg_productions G\")\n  apply(thin_tac \"cfgRM.derivation G' d2\")\n  apply(thin_tac \"d2 0 = Some (pair None \\<lparr>cfg_conf = [teA (cfg_initial G')]\\<rparr>)\")\n  apply(thin_tac \"d2 (Suc n2) = Some (pair e1a \\<lparr>cfg_conf = \\<delta>1 @ teA B # y1\\<rparr>)\")\n  apply(thin_tac \"d2 (Suc (Suc n2)) = Some (pair e2a \\<lparr>cfg_conf = \\<delta>1 @ \\<omega> @ y1\\<rparr>)\")\n  apply(thin_tac \"take k y1 = liftB (take k x)\")\n  apply(thin_tac \"\\<delta>2' @ \\<alpha> = \\<delta>1 @ \\<omega>\")\n  apply(thin_tac \"maximum_of_domain d1 (Suc (Suc n1))\")\n  apply(thin_tac \"maximum_of_domain d2 (Suc (Suc n2))\")\n  apply(thin_tac \"setA y1 = {}\")\n  apply(thin_tac \"\\<lparr>prod_lhs = A2, prod_rhs = \\<omega>2\\<rparr> \\<in> cfg_productions G'\")\n  apply(thin_tac \"liftB x = teB a # \\<alpha>' @ \\<omega>2 @ y' @ liftB z\")\n  apply(thin_tac \"setA (y' @ liftB z) = {}\")\n  apply(rule_tac\n      x=\"derivation_append d1 (derivation_map d' (\\<lambda>v. \\<lparr>cfg_conf = \\<delta>2' @ \\<alpha> @ cfg_conf v @ (drop k y2')\\<rparr>)) (Suc (Suc n1))\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(rule cfgRM.derivation_append_preserves_derivation)\n     apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n     apply(force)\n    apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n    apply(rule cfgRM.derivation_map_preserves_derivation2)\n     apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n     apply(force)\n    apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n    apply(clarsimp)\n    apply(rename_tac A \\<alpha> z d1 \\<delta>2' e1 e2 y2' \\<beta> a n1 n d' e1b A2 \\<omega>2 \\<alpha>' y' aa e b)(*strict*)\n    apply(simp add: cfgRM_step_relation_def)\n    apply(clarsimp)\n    apply(rename_tac A \\<alpha> z d1 \\<delta>2' e1 e2 y2' \\<beta> a n1 n d' e1b A2 \\<omega>2 \\<alpha>' y' aa e b l r)(*strict*)\n    apply(rule_tac\n      x=\"\\<delta>2' @ \\<alpha> @ l\"\n      in exI)\n    apply(rule_tac\n      x=\"r @ drop k y2'\"\n      in exI)\n    apply(clarsimp)\n    apply(simp (no_asm) add: setAConcat)\n    apply(clarsimp)\n    apply(rule setA_drop)\n    apply(simp add: setAConcat)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A \\<alpha> z d1 \\<delta>2' e1 e2 y2' \\<beta> a n1 n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(simp add: derivation_map_def)\n   apply(rule_tac\n      t=\"liftB z\"\n      and s=\"take k y2'\"\n      in ssubst)\n    apply(rename_tac A \\<alpha> z d1 \\<delta>2' e1 e2 y2' \\<beta> a n1 n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n    apply(force)\n   apply(rename_tac A \\<alpha> z d1 \\<delta>2' e1 e2 y2' \\<beta> a n1 n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(rule sym)\n   apply(rule append_take_drop_id)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(simp add: derivation_append_def derivation_map_def)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(simp add: derivation_append_def derivation_map_def)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(simp add: derivation_append_def derivation_map_def)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(simp add: derivation_append_def derivation_map_def)\n   apply(rename_tac A \\<alpha> z d1 \\<delta>2' e1 e2 y2' \\<beta> a n1 n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac A \\<alpha> z d1 \\<delta>2' e1 e2 y2' a n1 d' A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(rule_tac\n      t=\"liftB z\"\n      and s=\"take k y2'\"\n      in ssubst)\n    apply(rename_tac A \\<alpha> z d1 \\<delta>2' e1 e2 y2' a n1 d' A2 \\<omega>2 \\<alpha>' y')(*strict*)\n    apply(force)\n   apply(rename_tac A \\<alpha> z d1 \\<delta>2' e1 e2 y2' a n1 d' A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(rule sym)\n   apply(rule append_take_drop_id)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n   apply(simp add: derivation_append_def derivation_map_def)\n  apply(rename_tac A B \\<alpha> \\<omega> z d1 d2 \\<delta>2' e1 e2 y2' \\<delta>1 e1a e2a y1 \\<beta> a n1 n2 x n d' e1b A2 \\<omega>2 \\<alpha>' y')(*strict*)\n  apply(simp add: derivation_append_def derivation_map_def maximum_of_domain_def)\n  done\n\ntheorem cfg_LRk_implies_conflict_free: \"\n  F_CFG_AUGMENT__input G Do S' G'\n  \\<Longrightarrow> cfg_LRk G k\n  \\<Longrightarrow> conflict_free G G' k\"\n  apply(simp add: conflict_free_def)\n  apply(rule allI)\n  apply(rename_tac w)(*strict*)\n  apply(rule impI)\n  apply(rule conjI)\n   apply(rename_tac w)(*strict*)\n   apply(rule cfg_LRkDo_implies_no_reduce_reduce_item_conflict)\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(rule cfg_LRk_to_cfg_LRkDo)\n    apply(rename_tac w)(*strict*)\n    apply(force)\n   apply(rename_tac w)(*strict*)\n   apply(force)\n  apply(rename_tac w)(*strict*)\n  apply(rule cfg_LRkDo_implies_no_shift_reduce_item_conflict)\n   apply(rename_tac w)(*strict*)\n   apply(force)\n  apply(rename_tac w)(*strict*)\n  apply(rule cfg_LRk_to_cfg_LRkDo)\n   apply(rename_tac w)(*strict*)\n   apply(force)\n  apply(rename_tac w)(*strict*)\n  apply(force)\n  done\n\ntheorem cfg_LRk_implies_conflict_free_ALT: \"\n  valid_cfg G\n  \\<Longrightarrow> E_F = F_FRESH (cfg_events G)\n  \\<Longrightarrow> S_F = F_FRESH (cfg_nonterminals G)\n  \\<Longrightarrow> G_AUG = F_CFG_AUGMENT G S_F E_F\n  \\<Longrightarrow> cfg_LRk G k\n  \\<Longrightarrow> conflict_free G G_AUG k\"\n  apply(rule cfg_LRk_implies_conflict_free)\n   apply(unfold F_CFG_AUGMENT__input_def)\n   apply(force)\n  apply(force)\n  done\n\nend\n\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_06_03/FUNCTION__VALID_ITEM_SETS_CONFLICTFREE.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.30985973660344424}}
{"text": "section \\<open>Annotated Syntax\\<close>\ntheory Annotated_Syntax\nimports \"Semantics\"\nbegin\n\n  text \\<open>Unfold theorems to strip annotations from program, before it is defined as constant\\<close>\n  named_theorems vcg_annotation_defs \\<open>Definitions of Annotations\\<close>\n\n  text \\<open>Marker that is inserted around all annotations by the specification parser.\\<close>\n  definition \"ANNOTATION \\<equiv> \\<lambda>x. x\"\n  \n  subsection \\<open>Annotations\\<close>\n  text \\<open>The specification parser must interpret the annotations in the program.\\<close>\n  \n  definition WHILE_annotI :: \"(state \\<Rightarrow> bool) \\<Rightarrow> bexp \\<Rightarrow> com \\<Rightarrow> com\" \n    (\"(WHILE {_} _/ DO _)\"  [0, 0, 61] 61) \n    where [vcg_annotation_defs]: \"WHILE_annotI (I::state \\<Rightarrow> bool) \\<equiv> While\"\n    \n  lemmas annotate_whileI = WHILE_annotI_def[symmetric]\n  \n  definition WHILE_annotRVI :: \"'a rel \\<Rightarrow> (state \\<Rightarrow> 'a) \\<Rightarrow> (state \\<Rightarrow> bool) \\<Rightarrow> bexp \\<Rightarrow> com \\<Rightarrow> com\" \n      (\"(WHILE {_} {_} {_} _/ DO _)\"  [0, 0, 0, 0, 61] 61)\n    where [vcg_annotation_defs]: \"WHILE_annotRVI R V I \\<equiv> While\" for R V I\n    \n  lemmas annotate_whileRVI = WHILE_annotRVI_def[symmetric]\n  \n  definition WHILE_annotVI :: \"(state \\<Rightarrow> int) \\<Rightarrow> (state \\<Rightarrow> bool) \\<Rightarrow> bexp \\<Rightarrow> com \\<Rightarrow> com\" \n    (\"(WHILE {_} {_} _/ DO _)\"  [0, 0, 0, 61] 61)\n  where [vcg_annotation_defs]: \"WHILE_annotVI V I \\<equiv> While\" for V I\n  lemmas annotate_whileVI = WHILE_annotVI_def[symmetric]\n  \n\n  subsection \\<open>Hoare-Triples for Annotated Commands\\<close>\n  text \\<open>The command is a function from pre-state to command, as the annotations that are \n    contained in the command may depend on the pre-state!\\<close>\n  \n  type_synonym HT'_type = \"program \\<Rightarrow> (state \\<Rightarrow> bool) \\<Rightarrow> (state \\<Rightarrow> com) \\<Rightarrow> (state \\<Rightarrow> state\\<Rightarrow>bool) \\<Rightarrow> bool\"\n  \n  definition HT'_partial :: HT'_type\n    where \"HT'_partial \\<pi> P c Q \\<equiv> (\\<forall>s\\<^sub>0. P s\\<^sub>0 \\<longrightarrow> wlp \\<pi> (c s\\<^sub>0) (Q s\\<^sub>0) s\\<^sub>0)\"\n  \n  definition HT' :: HT'_type\n    where \"HT' \\<pi> P c Q \\<equiv> (\\<forall>s\\<^sub>0. P s\\<^sub>0 \\<longrightarrow> wp \\<pi> (c s\\<^sub>0) (Q s\\<^sub>0) s\\<^sub>0)\"\n  \n  lemma HT'_eq_HT: \"HT' \\<pi> P (\\<lambda>_. c) Q = HT \\<pi> P c Q\"\n    unfolding HT_def HT'_def ..  \n    \n  lemma HT'_partial_eq_HT: \"HT'_partial \\<pi> P (\\<lambda>_. c) Q = HT_partial \\<pi> P c Q\"\n    unfolding HT_partial_def HT'_partial_def ..  \n  \n  lemmas HT'_unfolds = HT'_eq_HT HT'_partial_eq_HT\n  \n  \n  type_synonym 'a \\<Theta>elem_t = \"(state\\<Rightarrow>'a) \\<times> ((state \\<Rightarrow> bool) \\<times> (state \\<Rightarrow> com) \\<times> (state \\<Rightarrow> state\\<Rightarrow>bool))\"\n  \n  definition HT'set :: \"program \\<Rightarrow> 'a \\<Theta>elem_t set \\<Rightarrow> bool\" where \"HT'set \\<pi> \\<Theta> \\<equiv> \\<forall>(n,(P,c,Q))\\<in>\\<Theta>. HT' \\<pi> P c Q\"\n  \n  definition HT'set_r :: \"_ \\<Rightarrow> program \\<Rightarrow> 'a \\<Theta>elem_t set \\<Rightarrow> bool\" where \"HT'set_r r \\<pi> \\<Theta> \\<equiv> \\<forall>(n,(P,c,Q))\\<in>\\<Theta>. HT' \\<pi> (\\<lambda>s. r n s \\<and> P s) c Q\"\n  \n  lemma HT'setI:    \n    assumes \"wf R\"\n    assumes RL: \"\\<And>f P c Q s\\<^sub>0. \\<lbrakk> HT'set_r (\\<lambda>f' s'. ((f' s'),(f s\\<^sub>0))\\<in>R ) \\<pi> \\<Theta>; (f,(P,c,Q))\\<in>\\<Theta>; P s\\<^sub>0 \\<rbrakk> \\<Longrightarrow> wp \\<pi> (c s\\<^sub>0) (Q s\\<^sub>0) s\\<^sub>0\"\n    shows \"HT'set \\<pi> \\<Theta>\"\n    unfolding HT'set_def HT'_def \n  proof clarsimp\n    fix f\\<^sub>0 P c Q s\\<^sub>0\n    assume \"(f\\<^sub>0,(P,c,Q))\\<in>\\<Theta>\" \"P s\\<^sub>0\"\n    with \\<open>wf R\\<close> show \"wp \\<pi> (c s\\<^sub>0) (Q s\\<^sub>0) s\\<^sub>0\"\n    proof (induction \"f\\<^sub>0 s\\<^sub>0\" arbitrary: f\\<^sub>0 c s\\<^sub>0 P Q)\n      case less\n      note RL' = RL[of f\\<^sub>0 s\\<^sub>0 P, OF _ less.prems]\n      show ?case\n        apply (rule RL')\n        unfolding HT'set_r_def HT'_def using less.hyps by auto\n    qed\n  qed  \n  \n  lemma HT'setD:\n    assumes \"HT'set \\<pi> (insert (f,(P,c,Q)) \\<Theta>)\"\n    shows \"HT' \\<pi> P c Q\" and \"HT'set \\<pi> \\<Theta>\"\n    using assms unfolding HT'set_def by auto\n  \n  \n  \n  \n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/IMP2/basic/Annotated_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331319177487, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.30985972914993587}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory AbstractArrays\nimports\n  \"../lib/TypHeapLib\"\n  \"../lib/WordLemmaBucket\"\nbegin\n\n(*\n * Return a list of addresses that contain an element for an array at location\n * \"p\" of length \"n\".\n *)\nprimrec\n  array_addrs :: \"('a::mem_type) ptr \\<Rightarrow> nat \\<Rightarrow> 'a ptr list\"\nwhere\n  \"array_addrs _ 0 = []\"\n| \"array_addrs p (Suc n) = p # (array_addrs (p +\\<^sub>p 1) n)\"\n\ndeclare array_addrs.simps(2) [simp del]\n\n(* The first element is in the array if the array has non-zero length. *)\nlemma hd_in_array_addrs [simp]:\n  \"(x \\<in> set (array_addrs x n)) = (n > 0)\"\n  by (case_tac n, auto simp: array_addrs.simps(2))\n\nlemma array_addrs_1 [simp]:\n  \"array_addrs p (Suc 0) = [p]\"\n  \"array_addrs p 1 = [p]\"\n  by (auto simp: array_addrs.simps(2))\n\n(* All array elements are aligned if the array itself is aligned. *)\nlemma array_addrs_ptr_aligned:\n     \"\\<lbrakk> x \\<in> set (array_addrs p n); ptr_aligned p \\<rbrakk> \\<Longrightarrow> ptr_aligned x\"\n  apply (induct n arbitrary: x p)\n   apply clarsimp\n  apply (clarsimp simp: array_addrs.simps(2))\n  apply (erule disjE)\n   apply clarsimp\n  apply atomize\n  apply (drule_tac x=x in spec)\n  apply (drule_tac x=\"p +\\<^sub>p 1\" in spec)\n  apply (clarsimp simp: ptr_aligned_plus)\n  done\n\n(* Split off the last element in an array. *)\nlemma set_array_addrs_unfold_last:\n  shows \"set (array_addrs a (Suc n)) = set (array_addrs a n) \\<union> {(a :: ('a::mem_type) ptr) +\\<^sub>p int n}\"\n    (is \"?LHS a n = ?RHS a n\")\nproof (induct n arbitrary: a)\n  fix a\n  show \"?LHS a 0 = ?RHS a 0\"\n    by clarsimp\nnext\n  fix a n\n  assume induct: \"\\<And>a. ?LHS a n = ?RHS a n\"\n  show \"?LHS a (Suc n) = ?RHS a (Suc n)\"\n  apply (subst array_addrs.simps(2))\n  apply (subst set_simps)\n  apply (subst induct [where a=\"a +\\<^sub>p 1\"])\n  apply (subst array_addrs.simps(2))\n  apply (subst set_simps)\n  apply (clarsimp simp: CTypesDefs.ptr_add_def field_simps insert_commute)\n  done\nqed\n\n(* Alternative representation of the set of array elements. *)\nlemma set_array_addrs:\n  \"set (array_addrs (p :: ('a::mem_type) ptr) n)\n           = {x. \\<exists>k. x = p +\\<^sub>p int k \\<and> k < n }\"\n  apply (induct n arbitrary: p)\n   apply (clarsimp simp: not_less)\n  apply (subst set_array_addrs_unfold_last)\n  apply atomize\n  apply (drule_tac x=p in spec)\n  apply (erule ssubst)\n  apply (rule set_eqI)\n  apply (rule iffI)\n   apply clarsimp\n   apply (erule disjE)\n    apply clarsimp\n    apply force\n   apply force\n  apply clarsimp\n  apply (drule_tac x=k in spec)\n  apply (clarsimp simp: not_less)\n  apply (subgoal_tac \"k = n\")\n   apply clarsimp\n  apply clarsimp\n  done\n\nend\n\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/autocorres/AbstractArrays.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5544704796847395, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.30957583637007385}}
{"text": "(*\n    Author:     Gerwin Klein\n    Copyright   1999 Technische Universitaet Muenchen\n*)\n\nsection \\<open>Correctness of the LBV\\<close>\n\ntheory LBVCorrect\nimports LBVSpec Typing_Framework_1\nbegin\n\nlocale lbvs = lbv +\n  fixes s\\<^sub>0  :: 'a\n  fixes c   :: \"'a list\"\n  fixes ins :: \"'b list\"\n  fixes \\<tau>s  :: \"'a list\"\n  defines phi_def:\n  \"\\<tau>s \\<equiv> map (\\<lambda>pc. if c!pc = \\<bottom> then wtl (take pc ins) c 0 s\\<^sub>0 else c!pc) \n       [0..<size ins]\"\n\n  assumes bounded: \"bounded step (size ins)\"\n  assumes cert: \"cert_ok c (size ins) \\<top> \\<bottom> A\"\n  assumes pres: \"pres_type step (size ins) A\"\n\nlemma (in lbvs) phi_None [intro?]:\n  \"\\<lbrakk> pc < size ins; c!pc = \\<bottom> \\<rbrakk> \\<Longrightarrow> \\<tau>s!pc = wtl (take pc ins) c 0 s\\<^sub>0\"\n(*<*) by (simp add: phi_def) (*>*)\n\nlemma (in lbvs) phi_Some [intro?]:\n  \"\\<lbrakk> pc < size ins; c!pc \\<noteq> \\<bottom> \\<rbrakk> \\<Longrightarrow> \\<tau>s!pc = c!pc\"\n(*<*) by (simp add: phi_def) (*>*)\n\nlemma (in lbvs) phi_len [simp]: \"size \\<tau>s = size ins\"\n(*<*) by (simp add: phi_def) (*>*)\n\nlemma (in lbvs) wtl_suc_pc:\n  assumes all: \"wtl ins c 0 s\\<^sub>0 \\<noteq> \\<top>\" \n  assumes pc:  \"pc+1 < size ins\"\n  assumes sA: \"s\\<^sub>0 \\<in> A\" \n  shows \"wtl (take (pc+1) ins) c 0 s\\<^sub>0 \\<sqsubseteq>\\<^sub>r \\<tau>s!(pc+1)\"\n(*<*)\nproof -\n  from all pc\n  have \"wtc c (pc+1) (wtl (take (pc+1) ins) c 0 s\\<^sub>0) \\<noteq> T\" by (rule wtl_all)\n  with pc show ?thesis using sA pres cert all wtl_pres by (simp add: phi_def wtc split: if_split_asm)\nqed\n(*>*)\n\nlemma (in lbvs) wtl_stable:\n  assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\<noteq> \\<top>\" \n  assumes s\\<^sub>0:  \"s\\<^sub>0 \\<in> A\" and  pc:  \"pc < size ins\" \n  shows \"stable r step \\<tau>s pc\"\n(*<*)\nproof (unfold stable_def, clarify)\n  fix pc' s' assume step: \"(pc',s') \\<in> set (step pc (\\<tau>s ! pc))\" \n                      (is \"(pc',s') \\<in> set (?step pc)\")\n  \n  from bounded pc step have pc': \"pc' < size ins\" by (rule boundedD)\n\n  have tkpc: \"wtl (take pc ins) c 0 s\\<^sub>0 \\<noteq> \\<top>\" (is \"?s\\<^sub>1 \\<noteq> _\") using wtl by (rule wtl_take)\n  have s\\<^sub>2: \"wtl (take (pc+1) ins) c 0 s\\<^sub>0 \\<noteq> \\<top>\" (is \"?s\\<^sub>2 \\<noteq> _\") using wtl by (rule wtl_take)\n  \n  from wtl pc have wt_s\\<^sub>1: \"wtc c pc ?s\\<^sub>1 \\<noteq> \\<top>\" by (rule wtl_all)\n\n  have c_Some: \"\\<forall>pc t. pc < size ins \\<longrightarrow> c!pc \\<noteq> \\<bottom> \\<longrightarrow> \\<tau>s!pc = c!pc\" \n    by (simp add: phi_def)\n  have c_None: \"c!pc = \\<bottom> \\<Longrightarrow> \\<tau>s!pc = ?s\\<^sub>1\" using pc ..\n\n  from wt_s\\<^sub>1 pc c_None c_Some\n  have inst: \"wtc c pc ?s\\<^sub>1  = wti c pc (\\<tau>s!pc)\"\n    by (simp add: wtc split: if_split_asm)\n\n  have \"?s\\<^sub>1 \\<in> A\" using pres cert s\\<^sub>0 wtl pc by (rule wtl_pres)\n  with pc c_Some cert c_None\n  have \"\\<tau>s!pc \\<in> A\" by (cases \"c!pc = \\<bottom>\") (auto dest: cert_okD1)\n  with pc pres\n  have step_in_A: \"snd`set (?step pc) \\<subseteq> A\" by (auto dest: pres_typeD2)\n  then have inA1: \"s' \\<in> A\" using step by auto\n\n  show \"s' \\<sqsubseteq>\\<^sub>r \\<tau>s!pc'\" \n  proof (cases \"pc' = pc+1\")\n    case True\n    with pc' cert\n    have cert_in_A: \"c!(pc+1) \\<in> A\" by (auto dest: cert_okD1)\n    from True pc' have pc1: \"pc+1 < size ins\" by simp\n    with pres cert s\\<^sub>0 wtl have inA2: \"wtl (take (pc + 1) ins) c 0 s\\<^sub>0 \\<in> A\" by (auto dest:wtl_pres)\n\n    have c_None': \"c!(pc +1)= \\<bottom> \\<Longrightarrow> \\<tau>s!(pc + 1)= ?s\\<^sub>2\" using pc1 ..\n    have \"?s\\<^sub>2 \\<in> A\" using pres cert s\\<^sub>0 wtl pc1 by (rule wtl_pres)\n    with pc1 c_Some cert c_None'\n    have inA3: \"\\<tau>s!(pc+1) \\<in> A\" by (cases \"c!(pc+1) = \\<bottom>\") (auto dest: cert_okD1)\n\n    from pc1 tkpc have \"?s\\<^sub>2 = wtc c pc ?s\\<^sub>1\" by - (rule wtl_Suc)\n    with inst \n    have merge: \"?s\\<^sub>2 = merge c pc (?step pc) (c!(pc+1))\" by (simp add: wti)\n    also from s\\<^sub>2 merge have \"\\<dots> \\<noteq> \\<top>\" (is \"?merge \\<noteq> _\") by simp\n    with cert_in_A step_in_A\n    have \"?merge = (map snd [(p',t') \\<leftarrow> ?step pc. p'=pc+1] \\<Squnion>\\<^bsub>f\\<^esub> c!(pc+1))\"\n      by (rule merge_not_top_s) \n    finally have \"s' \\<sqsubseteq>\\<^sub>r ?s\\<^sub>2\" using step_in_A cert_in_A True step \n      by (auto intro: pp_ub1')\n    also from wtl pc1 have \"?s\\<^sub>2 \\<sqsubseteq>\\<^sub>r \\<tau>s!(pc+1)\" using s\\<^sub>0 by (auto dest: wtl_suc_pc)\n    also note True [symmetric]\n    finally show ?thesis  using inA1 inA2 inA3 by simp    \n  next\n    case False\n    from wt_s\\<^sub>1 inst \n    have \"merge c pc (?step pc) (c!(pc+1)) \\<noteq> \\<top>\" by (simp add: wti)\n    with step_in_A have \"\\<forall>(pc', s')\\<in>set (?step pc). pc'\\<noteq>pc+1 \\<longrightarrow> s' \\<sqsubseteq>\\<^sub>r c!pc'\"\n      by - (rule merge_not_top)\n    with step False  have ok: \"s' \\<sqsubseteq>\\<^sub>r c!pc'\" by blast\n    moreover from ok have \"c!pc' = \\<bottom> \\<Longrightarrow> s' = \\<bottom>\" using inA1 by simp\n    moreover from c_Some pc'  have \"c!pc' \\<noteq> \\<bottom> \\<Longrightarrow> \\<tau>s!pc' = c!pc'\" by auto\n    ultimately show ?thesis by (cases \"c!pc' = \\<bottom>\") auto \n  qed\nqed\n(*>*)\n  \nlemma (in lbvs) phi_not_top:\n  assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\<noteq> \\<top>\" and pc:  \"pc < size ins\"\n  shows \"\\<tau>s!pc \\<noteq> \\<top>\"\n(*<*)\nproof (cases \"c!pc = \\<bottom>\")\n  case False with pc\n  have \"\\<tau>s!pc = c!pc\" ..\n  also from cert pc have \"\\<dots> \\<noteq> \\<top>\" by (rule cert_okD4)\n  finally show ?thesis .\nnext\n  case True with pc\n  have \"\\<tau>s!pc = wtl (take pc ins) c 0 s\\<^sub>0\" ..\n  also from wtl have \"\\<dots> \\<noteq> \\<top>\" by (rule wtl_take)\n  finally show ?thesis .\nqed\n(*>*)\n\nlemma (in lbvs) phi_in_A:\n  assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\<noteq> \\<top>\" and s\\<^sub>0: \"s\\<^sub>0 \\<in> A\"\n  shows \"\\<tau>s \\<in> nlists (size ins) A\"\n(*<*)\nproof -\n  { fix x assume \"x \\<in> set \\<tau>s\"\n    then obtain xs ys where \"\\<tau>s = xs @ x # ys\" \n      by (auto simp add: in_set_conv_decomp)\n    then obtain pc where pc: \"pc < size \\<tau>s\" and x: \"\\<tau>s!pc = x\"\n      by (simp add: that [of \"size xs\"] nth_append)\n    \n    from pres cert wtl s\\<^sub>0 pc \n    have \"wtl (take pc ins) c 0 s\\<^sub>0 \\<in> A\" by (auto intro!: wtl_pres)\n    moreover\n    from pc have \"pc < size ins\" by simp\n    with cert have \"c!pc \\<in> A\" ..\n    ultimately\n    have \"\\<tau>s!pc \\<in> A\" using pc by (simp add: phi_def)\n    hence \"x \\<in> A\" using x by simp\n  } \n  hence \"set \\<tau>s \\<subseteq> A\" ..\n  thus ?thesis by (unfold nlists_def) simp\nqed\n(*>*)\n\nlemma (in lbvs) phi0:\n  assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\<noteq> \\<top>\" and 0: \"0 < size ins\" and s\\<^sub>0: \"s\\<^sub>0 \\<in> A\" \n  shows \"s\\<^sub>0 \\<sqsubseteq>\\<^sub>r \\<tau>s!0\"\n(*<*)\nproof (cases \"c!0 = \\<bottom>\")\n  case True\n  with 0 have \"\\<tau>s!0 = wtl (take 0 ins) c 0 s\\<^sub>0\" ..\n  moreover have \"wtl (take 0 ins) c 0 s\\<^sub>0 = s\\<^sub>0\" by simp\n  ultimately have \"\\<tau>s!0 = s\\<^sub>0\" by simp\n  thus ?thesis using s\\<^sub>0 by simp\nnext\n  case False\n  with 0 have \"\\<tau>s!0 = c!0\" ..\n  moreover \n  have \"wtl (take 1 ins) c 0 s\\<^sub>0 \\<noteq> \\<top>\" using wtl by (rule wtl_take)\n  with 0 False \n  have \"s\\<^sub>0 \\<sqsubseteq>\\<^sub>r c!0\" by (auto simp add: neq_Nil_conv wtc split: if_split_asm)\n  ultimately\n  show ?thesis by simp\nqed\n(*>*)\n\n\n\n\n\ntheorem (in lbvs) wtl_sound_strong:\n  assumes wtl: \"wtl ins c 0 s\\<^sub>0 \\<noteq> \\<top>\" \n  assumes s\\<^sub>0: \"s\\<^sub>0 \\<in> A\" and ins: \"0 < size ins\"\n  shows \"\\<exists>\\<tau>s \\<in> nlists (size ins) A. wt_step r \\<top> step \\<tau>s \\<and> s\\<^sub>0 \\<sqsubseteq>\\<^sub>r \\<tau>s!0\"\n(*<*)\nproof -\n  have \"\\<tau>s \\<in> nlists (size ins) A\" using wtl s\\<^sub>0 by (rule phi_in_A)\n  moreover\n  have \"wt_step r \\<top> step \\<tau>s\"\n  proof (unfold wt_step_def, intro strip conjI)\n    fix pc assume \"pc < size \\<tau>s\"\n    then obtain pc: \"pc < size ins\" by simp\n    with wtl show \"\\<tau>s!pc \\<noteq> \\<top>\" by (rule phi_not_top)\n    from wtl s\\<^sub>0 and pc show \"stable r step \\<tau>s pc\" by (rule wtl_stable)\n  qed\n  moreover from wtl ins have \"s\\<^sub>0 \\<sqsubseteq>\\<^sub>r \\<tau>s!0\" using s\\<^sub>0  by (rule phi0)\n  ultimately show ?thesis by fast\nqed\n(*>*)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Jinja/DFA/LBVCorrect.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947155710233, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.3095579109764608}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Sep_Attribs\nimports Separation_Algebra Sep_Tactic_Helpers\nbegin\n\ntext{* Beyond the tactics above, there is also a set of attributes implemented to make proving\n       things in separation logic easier. These rules should be considered internals and are not\n       intended for direct use. *}\n\n\nlemma sep_curry_atomised: \"\\<lbrakk>(\\<And>s. (P \\<and>* Q) s \\<longrightarrow> R s); P s \\<rbrakk> \\<Longrightarrow> (Q \\<longrightarrow>* R) s\"\n  by (clarsimp simp: sep_conj_sep_impl)\n\nlemma sep_remove_pure_imp_sep_imp: \"( P \\<longrightarrow>* (\\<lambda>s. P' \\<longrightarrow> Q s)) s \\<Longrightarrow> P' \\<Longrightarrow> (P \\<longrightarrow>* Q) s\"\n  by (clarsimp)\n\nlemma sep_backward: \"\\<lbrakk>\\<And>s. P s \\<longrightarrow> (Q \\<and>* T) s; (P \\<and>* (Q \\<longrightarrow>* R)) s \\<rbrakk> \\<Longrightarrow> (T \\<and>* R) s\"\n  by (metis sep_conj_commute sep_conj_impl1 sep_mp_frame)\n\nlemma sep_remove_conj: \"\\<lbrakk>(P \\<and>* R) s ; Q\\<rbrakk> \\<Longrightarrow> ((\\<lambda>s. P s \\<and> Q) \\<and>* R) s \"\n  apply (clarsimp)\n  done\n\nlemma curry: \"(P \\<longrightarrow> Q \\<longrightarrow> R) \\<Longrightarrow> (P \\<and> Q) \\<longrightarrow> R\"\n  apply (safe)\n  done\n\n\nML {*\nlocal\n  fun atomize_thm ctxt thm = Conv.fconv_rule (Object_Logic.atomize ctxt) thm\n  fun setup_simpset ctxt = put_simpset HOL_basic_ss ctxt addsimps [(sym OF [@{thm sep_conj_assoc}])]\n  fun simp ctxt thm = simplify (setup_simpset ctxt) thm\n\n  fun REPEAT_TRYOF_N _ thm2 0 = thm2\n    | REPEAT_TRYOF_N thm1 thm2 n = REPEAT_TRYOF_N thm1 (thm1 OF [thm2]) (n-1)\n\n  fun REPEAT_TRYOF'_N thm1 _    0 = thm1\n    | REPEAT_TRYOF'_N thm1 thm2 n = REPEAT_TRYOF'_N (thm1 OF [thm2]) thm2 (n-1)\n\n  fun attribute_thm ctxt thm  thm' =\n    REPEAT_TRYOF_N @{thm sep_remove_pure_imp_sep_imp} (thm OF [atomize_thm ctxt thm']) (Thm.nprems_of thm' - 1)\n\n  fun attribute_thm' thm ctxt thm' =\n    thm OF [REPEAT_TRYOF_N @{thm curry} (thm' |> atomize_thm ctxt o simp ctxt) (Thm.nprems_of thm' - 1)]\n\nin\n\n(*\n By attributing a theorem with [sep_curry], we can now take a rule (A \\<and>* B) \\<Longrightarrow> C and turn it into A \\<Longrightarrow> (B \\<longrightarrow>* C)\n*)\n\nfun sep_curry_inner ctxt = attribute_thm ( ctxt) @{thm sep_curry_atomised}\nval sep_curry = Thm.rule_attribute [] (fn ctxt => sep_curry_inner (Context.proof_of ctxt))\n\n(*\n The attribute sep_back takes a rule of the form A \\<Longrightarrow> B and returns a rule (A \\<and>* (B \\<longrightarrow>* R)) \\<Longrightarrow> R.\n The R then matches with any conclusion. If the theorem is of form (A \\<and>* B) \\<Longrightarrow> C, it is advised to\n use sep_curry on the theorem first, and then sep_back. This aids sep_cancel in simplifying the result.\n*)\n\nfun backward ctxt thm =\n  REPEAT_TRYOF'_N (attribute_thm' @{thm sep_backward} ctxt thm) @{thm sep_remove_conj} (Thm.nprems_of thm - 1)\n\nfun backward' ctxt thm = backward (Context.proof_of ctxt) thm\n\nval sep_backward = Thm.rule_attribute [] (backward')\n\nend\n*}\n\nattribute_setup sep_curry =  {* Scan.succeed sep_curry *}\nattribute_setup sep_backward =  {* Scan.succeed sep_backward *}\n\nend\n", "meta": {"author": "carl88888", "repo": "filesystem", "sha": "2700e011249e8a675f675c5e0fd13efc1a0957f7", "save_path": "github-repos/isabelle/carl88888-filesystem", "path": "github-repos/isabelle/carl88888-filesystem/filesystem-2700e011249e8a675f675c5e0fd13efc1a0957f7/lib/sep_algebra/Sep_Attribs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073802837478, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3095385304098133}}
{"text": "theory ResMapDisj\n  imports ResMap AltNormEnv\nbegin\n  \nlemma lift_sub_use_env: \"\\<lbrakk> sub_use_env s r_s \\<rbrakk> \\<Longrightarrow> sub_use_env s (lift_use_env r_s r)\"   \n  apply (simp add: sub_use_env_def)\n  apply (case_tac r)\n    apply (auto)\n  done\n  \n    (* strong disjointness *)\n  \ndefinition strong_disj_use_env where\n  \"strong_disj_use_env r_x r_s = (\\<forall> x. r_x x = NoPerm \\<or> r_s x = NoPerm)\"  \n    \nlemma empty_strong_disj_use_env1: \"strong_disj_use_env empty_use_env r_s\"\n  apply (simp add: strong_disj_use_env_def)\n  apply (simp add: empty_use_env_def)\n  done\n\nlemma empty_strong_disj_use_env2: \"strong_disj_use_env r_s empty_use_env\"\n  apply (simp add: strong_disj_use_env_def)\n  apply (simp add: empty_use_env_def)\n  done    \n  \nlemma comm_strong_disj_use_env: \"\\<lbrakk> strong_disj_use_env r_s r_x \\<rbrakk> \\<Longrightarrow> strong_disj_use_env r_x r_s\"    \n  apply (simp add: strong_disj_use_env_def)\n  apply (auto)\n  done        \n    \nlemma strong_disj_leq_use_env1: \"\\<lbrakk> strong_disj_use_env r_s r_ex; leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> strong_disj_use_env r_x r_ex\"\n  apply (simp add: strong_disj_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done        \n\nlemma strong_disj_leq_use_env2: \"\\<lbrakk> strong_disj_use_env r_ex r_s; leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> strong_disj_use_env r_ex r_x\"\n  apply (rule_tac comm_strong_disj_use_env)  \n  apply (rule_tac r_s=\"r_s\" in strong_disj_leq_use_env1)\n   apply (rule_tac comm_strong_disj_use_env)\n   apply (auto)\n  done\n    \nlemma reduce_strong_disj_use_env: \"\\<lbrakk> disj_use_env r_s r_x; strong_use_env r_x \\<rbrakk> \\<Longrightarrow> strong_disj_use_env r_s r_x\"\n  apply (simp add: disj_use_env_def)\n  apply (simp add: strong_use_env_def)\n  apply (simp add: strong_disj_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done\n    \nlemma add_strong_disj_use_env: \"\\<lbrakk> strong_disj_use_env r_x r_s; r_s x = NoPerm \\<rbrakk> \\<Longrightarrow> strong_disj_use_env (add_use_env r_x x r) r_s\"\n  apply (simp add: strong_disj_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (auto)\n  apply (simp add: add_use_env_def)\n  apply (auto)\n  done\n    \nlemma diff_strong_disj_use_env: \"\\<lbrakk> strong_use_env r_x \\<rbrakk> \\<Longrightarrow> strong_disj_use_env (diff_use_env r_s r_x) r_x\"    \n  apply (simp add: strong_disj_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: strong_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done    \n \nlemma strong_disj_comp_use_env1: \"\\<lbrakk> strong_disj_use_env r_ex r_x; strong_disj_use_env r_ex r_s \\<rbrakk> \\<Longrightarrow> strong_disj_use_env r_ex (comp_use_env r_x r_s)\"    \n  apply (simp add: strong_disj_use_env_def)\n  apply (simp add: comp_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  done\n \nlemma strong_disj_comp_use_env2: \"\\<lbrakk> strong_disj_use_env r_x r_ex; strong_disj_use_env r_s r_ex \\<rbrakk> \\<Longrightarrow> strong_disj_use_env (comp_use_env r_x r_s) r_ex\"     \n  apply (rule_tac comm_strong_disj_use_env)\n  apply (rule_tac strong_disj_comp_use_env1)\n   apply (simp_all add: comm_strong_disj_use_env)\n  done \n    \n    (* ### NEW DISJOINTNESS *)\n\n    \ndefinition disj_nres_map where\n  \"disj_nres_map rs_map = (\\<forall> x y. x \\<noteq> y \\<longrightarrow> strong_disj_use_env (nres_lookup rs_map x) (nres_lookup rs_map y))\"  \n  \n  \n  \ndefinition sep_nres_map where\n  \"sep_nres_map r_s rs_map = (\\<forall> x. strong_disj_use_env r_s (nres_lookup rs_map x))\"     \n    \nlemma add_sep_nres_map: \"\\<lbrakk> sep_nres_map r_x rs_map; strong_disj_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> sep_nres_map r_x (add_env rs_map x r_s)\"    \n  apply (simp add: sep_nres_map_def)\n  apply (simp add: nres_lookup_def)\n  apply (simp add: add_env_def)\n  done  \n  \nlemma leq_sep_nres_map: \"\\<lbrakk> leq_use_env r_x r_s; sep_nres_map r_s rs_map \\<rbrakk> \\<Longrightarrow> sep_nres_map r_x rs_map\"      \n  apply (simp add: sep_nres_map_def)\n  apply (auto)\n  apply (rule_tac r_s=\"r_s\" in strong_disj_leq_use_env1)\n   apply (auto)\n  done\n    \nlemma comp_sep_nres_map: \"\\<lbrakk> sep_nres_map r_s rs_map; sep_nres_map r_x rs_map \\<rbrakk> \\<Longrightarrow> sep_nres_map (comp_use_env r_s r_x) rs_map\"    \n  apply (simp add: sep_nres_map_def)\n  apply (auto)\n  apply (rule_tac strong_disj_comp_use_env2)\n   apply (auto)\n  done    \n    \nlemma disj_add_nres_map: \"\\<lbrakk> disj_nres_map rs_map;\n  sep_nres_map r_s (rem_env rs_map x) \\<rbrakk> \\<Longrightarrow> disj_nres_map (add_env rs_map x r_s)\"\n  apply (simp add: disj_nres_map_def)\n  apply (auto)\n  apply (case_tac \"x = xa\")\n   apply (auto)\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" and y=\"y\" in nres_add_diff)\n    apply (auto)\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" in nres_add_same)\n   apply (auto)\n    apply (simp add: sep_nres_map_def)\n   apply (erule_tac x=\"x\" in allE)\n   apply (erule_tac x=\"y\" in allE)\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and y=\"y\" in nres_rem_diff)\n    apply (auto)\n  apply (case_tac \"x = y\")\n   apply (auto)\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" and y=\"xa\" in nres_add_diff)\n    apply (auto)\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" in nres_add_same)\n   apply (auto)\n   apply (rule_tac comm_strong_disj_use_env)\n   apply (simp add: sep_nres_map_def)\n   apply (erule_tac x=\"x\" in allE)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and y=\"xa\" in nres_rem_diff)  \n    apply (auto)\n  apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" and y=\"xa\" in nres_add_diff)\n  apply (auto)\n  apply (cut_tac rs_map=\"rs_map\" and x=\"x\" and r_s=\"r_s\" and y=\"y\" in nres_add_diff)\n  apply (auto)\n  done    \n    \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/ResMapDisj.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765155565327, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3095385301963635}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory MultByAdd\nimports\n  \"AutoCorres.AutoCorres\"\nbegin\n\n(* Parse the input file. *)\nexternal_file \"mult_by_add.c\"\ninstall_C_file \"mult_by_add.c\"\n\n(* Abstract the input file. *)\nautocorres [ ts_force nondet = mult_by_add ] \"mult_by_add.c\"\n\ncontext mult_by_add begin\n\n(*\n * Prove the function returns the correct result, and (simultaneously)\n * does not fail and terminates.\n *)\nlemma \"\\<lbrace> \\<lambda>s. True \\<rbrace> mult_by_add' a b \\<lbrace> \\<lambda>r s. r = a * b \\<rbrace>!\"\n  (* Unfold function definition. *)\n  apply (clarsimp simp: mult_by_add'_def)\n\n  (* Annotate while loop with an invariant and measure. *)\n  apply (subst whileLoop_add_inv\n    [where I=\"\\<lambda>(a', r) s. (a' * b) + r = (a * b)\"\n       and M=\"\\<lambda>((a', _), s). unat a'\"])\n\n  (* Run \"wp\" weakest precondition tactic, and solve verification *\n   * conditions generated by it. *)\n  apply wp\n     apply (simp add: field_simps)\n    apply unat_arith\n   apply (simp add: split_def word_neq_0_conv[symmetric])\n  apply (simp add: split_def | wp)+\n  done\n\n(*\n * Equivalent partial-correctness proof using Simpl framework.\n *)\nlemma \"\\<Gamma> \\<turnstile> {s. s = t} \\<acute>ret__unsigned :== CALL mult_by_add(\\<acute>a, \\<acute>b) \\<lbrace> (\\<acute>ret__unsigned = \\<^bsup>t\\<^esup>a * \\<^bsup>t\\<^esup>b) \\<rbrace>\"\n  (* Unfold the body. *)\n  apply vcg_step\n   defer\n\n   (* Annotate the while loop with an invariant and variant. *)\n   apply (subst whileAnno_def)\n   apply (subst whileAnno_def [symmetric,\n     where I=\" \\<lbrace> (\\<acute>a * \\<acute>b + \\<acute>result) = (\\<^bsup>t\\<^esup>a * \\<^bsup>t\\<^esup>b) \\<rbrace>\"\n     and V=\"measure (\\<lambda>s. unat (a_' s))\"])\n\n  (* Solve the remaining conditions. *)\n   apply vcg\n   apply (fastforce intro: unat_mono simp: gt0_iff_gem1 field_simps less_1_simp scast_id)+\n  done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/autocorres/tests/examples/MultByAdd.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5621765008857982, "lm_q1q2_score": 0.30953852211854904}}
{"text": "(*\n * Copyright (C) 2014 NICTA\n * All rights reserved.\n *)\n\n(* Authors: David Cock - David.Cock@nicta.com.au, Thomas Sewell - Thomas.Sewell@nicta.com.au *)\n\nsection \"Loop Termination\"\n \ntheory Termination imports Embedding StructuredReasoning Loops begin\n\ntext_raw \\<open>\\label{s:termination}\\<close>\n\ntext \\<open>Termination for loops can be shown by classical means (using a variant, or a measure\nfunction), or by probabilistic means: We only need that the loop terminates \\emph{with probability\none}.\\<close>\n\nsubsection \\<open>Trivial Termination\\<close>\n\ntext \\<open>A maximal transformer (program) doesn't affect termination. This is\n  essentially saying that such a program doesn't abort (or diverge).\\<close>\nlemma maximal_Seq_term:\n  fixes r::\"'s prog\" and s::\"'s prog\"\n  assumes mr: \"maximal (wp r)\"\n      and ws: \"well_def s\"\n      and ts: \"(\\<lambda>s. 1) \\<tturnstile> wp s (\\<lambda>s. 1)\"\n  shows \"(\\<lambda>s. 1) \\<tturnstile> wp (r ;; s) (\\<lambda>s. 1)\"\nproof -\n  note hs = well_def_wp_healthy[OF ws]\n  have \"wp s (\\<lambda>s. 1) = (\\<lambda>s. 1)\"\n  proof(rule antisym)\n    show \"(\\<lambda>s. 1) \\<tturnstile> wp s (\\<lambda>s. 1)\" by(rule ts)\n    have \"bounded_by 1 (wp s (\\<lambda>s. 1))\"\n      by(auto intro!:healthy_bounded_byD[OF hs])\n    thus \"wp s (\\<lambda>s. 1) \\<tturnstile> (\\<lambda>s. 1)\" by(auto intro!:le_funI)\n  qed\n  with mr show ?thesis\n    by(simp add:wp_eval embed_bool_def maximalD)\nqed\n\ntext \\<open>From any state where the guard does not hold, a loop terminates\n  in a single step.\\<close>\nlemma term_onestep:\n  assumes wb: \"well_def body\"\n  shows \"\\<guillemotleft>\\<N> G\\<guillemotright> \\<tturnstile> wp do G \\<longrightarrow> body od (\\<lambda>s. 1)\"\nproof(rule le_funI)\n  note hb = well_def_wp_healthy[OF wb]\n  fix s\n  show \"\\<guillemotleft>\\<N> G\\<guillemotright> s \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\"\n  proof(cases \"G s\", simp_all add:wp_loop_nguard hb)\n    from hb have \"sound (wp do G \\<longrightarrow> body od (\\<lambda>s. 1))\"\n      by(auto intro:healthy_sound[OF healthy_wp_loop])\n    thus \"0 \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\" by(auto)\n  qed\nqed\n\nsubsection \\<open>Classical Termination\\<close>\n\ntext \\<open>The first non-trivial termination result is quite standard: If we can provide a\nnatural-number-valued measure, that decreases on every iteration, and implies termination on\nreaching zero, the loop terminates.\\<close>\n\nlemma loop_term_nat_measure_noinv:\n  fixes m :: \"'s \\<Rightarrow> nat\" and body :: \"'s prog\"\n  assumes wb: \"well_def body\"\n  and guard: \"\\<And>s. m s = 0 \\<longrightarrow> \\<not> G s\"\n  and variant: \"\\<And>n. \\<guillemotleft>\\<lambda>s. m s = Suc n\\<guillemotright> \\<tturnstile> wp body \\<guillemotleft>\\<lambda>s. m s = n\\<guillemotright>\"\n  shows \"\\<lambda>s. 1 \\<tturnstile> wp do G \\<longrightarrow> body od (\\<lambda>s. 1)\"\nproof -\n  note hb = well_def_wp_healthy[OF wb]\n  have \"\\<And>n. (\\<forall>s. m s = n \\<longrightarrow> 1 \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s)\"\n  proof(induct_tac n)\n    fix n\n    show \"\\<forall>s. m s = 0 \\<longrightarrow> 1 \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\"\n    proof(clarify)\n      fix s\n      assume \"m s = 0\"\n      with guard have \"\\<not> G s\" by(blast)\n      with hb show \"1 \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\"\n        by(simp add:wp_loop_nguard)\n    qed\n    assume IH: \"\\<forall>s. m s = n \\<longrightarrow> 1 \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\"\n    hence IH': \"\\<forall>s. m s = n \\<longrightarrow> 1 \\<le> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n      by(simp add:embed_bool_def)\n    have \"\\<forall>s. m s = Suc n \\<longrightarrow> 1 \\<le> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n    proof(intro fold_premise healthy_intros hb, rule le_funI)\n      fix s\n      show \"\\<guillemotleft>\\<lambda>s. m s = Suc n\\<guillemotright> s \\<le> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n      proof(cases \"G s\")\n        case False\n        hence \"1 = \\<guillemotleft>\\<N> G\\<guillemotright> s\" by(auto)\n        also from wb have \"... \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\"\n          by(rule le_funD[OF term_onestep])\n        finally show ?thesis by(simp add:embed_bool_def)\n      next\n        case True note G = this\n        from IH' have \"\\<guillemotleft>\\<lambda>s. m s = n\\<guillemotright> \\<tturnstile> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright>\"\n          by(blast intro:use_premise healthy_intros hb)\n        with variant wb\n        have \"\\<guillemotleft>\\<lambda>s. m s = Suc n\\<guillemotright> \\<tturnstile> wp (body ;; do G \\<longrightarrow> body od) \\<guillemotleft>\\<lambda>s. True\\<guillemotright>\"\n          by(blast intro:wp_Seq wd_intros)\n        hence \"\\<guillemotleft>\\<lambda>s. m s = Suc n\\<guillemotright> s \\<le> wp (body ;; do G \\<longrightarrow> body od) \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n          by(auto)\n        also from hb G have \"... = wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n          by(simp add:wp_loop_guard)\n        finally show ?thesis .\n      qed\n    qed\n    thus \"\\<forall>s. m s = Suc n \\<longrightarrow> 1 \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\"\n      by(simp add:embed_bool_def)\n  qed\n  thus ?thesis by(auto)\nqed\n\ntext \\<open>This version allows progress to depend on an invariant. Termination is then determined by\nthe invariant's value in the initial state.\\<close>\nlemma loop_term_nat_measure:\n  fixes m :: \"'s \\<Rightarrow> nat\" and body :: \"'s prog\"\n  assumes wb:  \"well_def body\"\n  and guard:   \"\\<And>s. m s = 0 \\<longrightarrow> \\<not> G s\"\n  and variant: \"\\<And>n. \\<guillemotleft>\\<lambda>s. m s = Suc n\\<guillemotright> && \\<guillemotleft>I\\<guillemotright> \\<tturnstile> wp body \\<guillemotleft>\\<lambda>s. m s = n\\<guillemotright>\"\n  and inv:     \"wp_inv G body \\<guillemotleft>I\\<guillemotright>\"\n  shows \"\\<guillemotleft>I\\<guillemotright> \\<tturnstile> wp do G \\<longrightarrow> body od (\\<lambda>s. 1)\"\nproof -\n  note hb = well_def_wp_healthy[OF wb]\n  note scb = sublinear_sub_conj[OF well_def_wp_sublinear, OF wb]\n  have \"\\<guillemotleft>I\\<guillemotright> \\<tturnstile> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright>\"\n  proof(rule use_premise, intro healthy_intros hb)\n    fix s\n    have \"\\<And>n. (\\<forall>s. m s = n \\<and> I s \\<longrightarrow> 1 \\<le> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s)\"\n    proof(induct_tac n)\n      fix n\n      show \"\\<forall>s. m s = 0 \\<and> I s \\<longrightarrow> 1 \\<le> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n      proof(clarify)\n        fix s\n        assume \"m s = 0\"\n        with guard have \"\\<not> G s\" by(blast)\n        with hb show \"1 \\<le> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n          by(simp add:wp_loop_nguard)\n      qed\n      assume IH: \"\\<forall>s. m s = n \\<and> I s \\<longrightarrow> 1 \\<le> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n      show \"\\<forall>s. m s = Suc n \\<and> I s \\<longrightarrow> 1 \\<le> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n      proof(intro fold_premise healthy_intros hb le_funI)\n        fix s\n        show \"\\<guillemotleft>\\<lambda>s. m s = Suc n \\<and> I s\\<guillemotright> s \\<le> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n        proof(cases \"G s\")\n          case False with hb show ?thesis\n            by(simp add:wp_loop_nguard)\n        next\n          case True note G = this\n          have \"\\<guillemotleft>\\<lambda>s. m s = Suc n\\<guillemotright> && \\<guillemotleft>I\\<guillemotright> && \\<guillemotleft>G\\<guillemotright> =\n                \\<guillemotleft>\\<lambda>s. m s = Suc n\\<guillemotright> && (\\<guillemotleft>I\\<guillemotright> && \\<guillemotleft>I\\<guillemotright>) && \\<guillemotleft>G\\<guillemotright>\"\n            by(simp)\n          also have \"... = (\\<guillemotleft>\\<lambda>s. m s = Suc n\\<guillemotright> && \\<guillemotleft>I\\<guillemotright>) && (\\<guillemotleft>I\\<guillemotright> && \\<guillemotleft>G\\<guillemotright>)\"\n            by(simp add:exp_conj_assoc exp_conj_unitary del:exp_conj_idem)\n          also have \"... = (\\<guillemotleft>\\<lambda>s. m s = Suc n\\<guillemotright> && \\<guillemotleft>I\\<guillemotright>) && (\\<guillemotleft>G\\<guillemotright> && \\<guillemotleft>I\\<guillemotright>)\"\n            by(simp only:exp_conj_comm)\n          also {\n            from inv hb have \"\\<guillemotleft>G\\<guillemotright> && \\<guillemotleft>I\\<guillemotright> \\<tturnstile> wp body \\<guillemotleft>I\\<guillemotright>\"\n              by(rule wp_inv_stdD)\n            with variant\n            have \"(\\<guillemotleft>\\<lambda>s. m s = Suc n\\<guillemotright> && \\<guillemotleft>I\\<guillemotright>) && (\\<guillemotleft>G\\<guillemotright> && \\<guillemotleft>I\\<guillemotright>) \\<tturnstile>\n                  wp body \\<guillemotleft>\\<lambda>s. m s = n\\<guillemotright> && wp body \\<guillemotleft>I\\<guillemotright>\"\n              by(rule entails_frame)\n          }\n          also from scb\n          have \"wp body \\<guillemotleft>\\<lambda>s. m s = n\\<guillemotright> && wp body \\<guillemotleft>I\\<guillemotright> \\<tturnstile>\n                wp body (\\<guillemotleft>\\<lambda>s. m s = n\\<guillemotright> && \\<guillemotleft>I\\<guillemotright>)\"\n            by(blast)\n          finally have \"\\<guillemotleft>\\<lambda>s. m s = Suc n \\<guillemotright> && \\<guillemotleft> I \\<guillemotright> && \\<guillemotleft> G \\<guillemotright> \\<tturnstile>\n                        wp body (\\<guillemotleft> \\<lambda>s. m s = n \\<guillemotright> && \\<guillemotleft> I \\<guillemotright>)\" .\n          moreover {\n            from IH have \"\\<guillemotleft>\\<lambda>s. m s = n \\<and> I s\\<guillemotright> \\<tturnstile> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright>\"\n              by(blast intro:use_premise healthy_intros hb)\n            hence \"\\<guillemotleft>\\<lambda>s. m s = n\\<guillemotright> && \\<guillemotleft>I\\<guillemotright> \\<tturnstile> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright>\"\n              by(simp add:exp_conj_std_split)\n          }\n          ultimately\n          have \"\\<guillemotleft>\\<lambda>s. m s = Suc n \\<guillemotright> && \\<guillemotleft> I \\<guillemotright> && \\<guillemotleft> G \\<guillemotright> \\<tturnstile>\n                wp (body ;; do G \\<longrightarrow> body od) \\<guillemotleft>\\<lambda>s. True\\<guillemotright>\"\n            using wb by(blast intro:wp_Seq wd_intros)\n          hence \"(\\<guillemotleft>\\<lambda>s. m s = Suc n \\<and> I s\\<guillemotright> && \\<guillemotleft> G \\<guillemotright>) s \\<le>\n                 wp (body ;; do G \\<longrightarrow> body od) \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n            by(auto simp:exp_conj_std_split)\n          with G have \"\\<guillemotleft>\\<lambda>s. m s = Suc n \\<and> I s\\<guillemotright> s \\<le>\n                       wp (body ;; do G \\<longrightarrow> body od) \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n            by(simp add:exp_conj_def)\n          also from hb G have \"... = wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n            by(simp add:wp_loop_guard)\n          finally show ?thesis .\n        qed\n      qed\n    qed\n    moreover assume \"I s\"\n    ultimately show \"1 \\<le> wp do G \\<longrightarrow> body od \\<guillemotleft>\\<lambda>s. True\\<guillemotright> s\"\n      by(auto)\n  qed\n  thus ?thesis by(simp add:embed_bool_def)\nqed\n\nsubsection \\<open>Probabilistic Termination\\<close>\n\ntext \\<open>Any loop that has a non-zero chance of terminating after each step terminates with\nprobability 1.\\<close>\n\nlemma termination_0_1:\n  fixes body :: \"'s prog\"\n  assumes wb: \"well_def body\"\n      \\<comment> \\<open>The loop terminates in one step with nonzero probability\\<close>\n      and onestep: \"(\\<lambda>s. p) \\<tturnstile> wp body \\<guillemotleft>\\<N> G\\<guillemotright>\"\n      and nzp:     \"0 < p\"\n      \\<comment> \\<open>The body is maximal i.e.~it terminates absolutely.\\<close>\n      and mb:      \"maximal (wp body)\"\n  shows \"\\<lambda>s. 1 \\<tturnstile> wp do G \\<longrightarrow> body od (\\<lambda>s. 1)\"\nproof -\n  note hb = well_def_wp_healthy[OF wb]\n  note sb = healthy_scalingD[OF hb]\n  note sab = sublinear_subadd[OF well_def_wp_sublinear, OF wb, OF healthy_feasibleD, OF hb]\n\n  from hb have hloop: \"healthy (wp do G \\<longrightarrow> body od)\"\n    by(rule healthy_intros)\n  hence swp: \"sound (wp do G \\<longrightarrow> body od (\\<lambda>s. 1))\" by(blast)\n\n  txt \\<open>@{term p} is no greater than $1$, by feasibility.\\<close>\n  from onestep have onestep': \"\\<And>s. p \\<le> wp body \\<guillemotleft>\\<N> G\\<guillemotright> s\" by(auto)\n  also {\n    from hb have \"unitary (wp body \\<guillemotleft>\\<N> G\\<guillemotright>)\" by(auto)\n    hence \"\\<And>s. wp body \\<guillemotleft>\\<N> G\\<guillemotright> s \\<le> 1\" by(auto)\n  }\n  finally have p1: \"p \\<le> 1\" .\n\n  txt \\<open>This is the crux of the proof: that given a lower bound below $1$, we can find another,\n    higher one.\\<close>\n  have new_bound: \"\\<And>k. 0 \\<le> k \\<Longrightarrow> k \\<le> 1 \\<Longrightarrow> (\\<lambda>s. k) \\<tturnstile> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) \\<Longrightarrow>\n            (\\<lambda>s. p * (1-k) + k) \\<tturnstile> wp do G \\<longrightarrow> body od (\\<lambda>s. 1)\"\n  proof(rule le_funI)\n    fix k s\n    assume X: \"\\<lambda>s. k \\<tturnstile> wp do G \\<longrightarrow> body od (\\<lambda>s. 1)\"\n       and k0: \"0 \\<le> k\" and k1: \"k \\<le> 1\"\n\n    from k1 have nz1k: \"0 \\<le> 1 - k\" by(auto)\n    with p1 have \"p * (1-k) + k \\<le> 1 * (1-k) + k\"\n      by(blast intro:mult_right_mono add_mono)\n    hence \"p * (1 - k) + k \\<le> 1\"\n      by(simp)\n    txt \\<open>The new bound is @{term \"p * (1-k) + k\"}.\\<close>\n    hence \"p * (1-k) + k \\<le> \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * (p * (1-k) + k)\"\n      by(cases \"G s\", simp_all)\n    txt \\<open>By the one-step termination assumption:\\<close>\n    also from onestep' nz1k\n    have \"... \\<le> \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * (wp body \\<guillemotleft>\\<N> G\\<guillemotright> s * (1-k) + k)\"\n      by (simp add: mult_right_mono ordered_comm_semiring_class.comm_mult_left_mono)\n    txt \\<open>By scaling:\\<close>\n    also from nz1k\n    have \"... =  \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * (wp body (\\<lambda>s. \\<guillemotleft>\\<N> G\\<guillemotright> s * (1-k)) s + k)\"\n      by(simp add:right_scalingD[OF sb])\n    txt \\<open>By the maximality (termination) of the loop body:\\<close>\n    also from mb k0\n    have \"... =  \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * (wp body (\\<lambda>s. \\<guillemotleft>\\<N> G\\<guillemotright> s * (1-k)) s + wp body (\\<lambda>s. k) s)\"\n      by(simp add:maximalD)\n    txt \\<open>By sub-additivity of the loop body:\\<close>\n    also from k0 nz1k\n    have \"... \\<le> \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * (wp body (\\<lambda>s. \\<guillemotleft>\\<N> G\\<guillemotright> s * (1-k) + k) s)\"\n      by(auto intro!:add_left_mono mult_left_mono sub_addD[OF sab] sound_intros)\n    also\n    have \"... = \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * (wp body (\\<lambda>s. \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * k) s)\"\n      by(simp add:negate_embed algebra_simps)\n    txt \\<open>By monotonicity of the loop body, and that @{term k} is a lower bound:\\<close>\n    also from k0 hloop le_funD[OF X]\n    have \"... \\<le> \\<guillemotleft>\\<N> G\\<guillemotright> s +\n      \\<guillemotleft>G\\<guillemotright> s * (wp body (\\<lambda>s. \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s) s)\"\n      by(iprover intro:add_left_mono mult_left_mono le_funI embed_ge_0\n                       le_funD[OF mono_transD, OF healthy_monoD, OF hb]\n                       sound_sum standard_sound sound_intros swp)\n    txt \\<open>Unrolling the loop once and simplifying:\\<close>\n    also {\n      have \"\\<And>s. \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * wp body (wp do G \\<longrightarrow> body od (\\<lambda>s. 1)) s =\n        \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * (\\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * wp body (wp do G \\<longrightarrow> body od (\\<lambda>s. 1)) s)\"\n        by(simp only:distrib_left mult.assoc[symmetric] embed_bool_idem embed_bool_cancel)\n      also have \"\\<And>s. ... s = \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\"\n        by(simp add:fun_cong[OF wp_loop_unfold[symmetric, where P=\"\\<lambda>s. 1\", simplified, OF hb]])\n      finally have X: \"\\<And>s. \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * wp body (wp do G \\<longrightarrow> body od (\\<lambda>s. 1)) s =\n        \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\" .\n      have \"\\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * (wp body (\\<lambda>s. \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s *\n              wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s) s) =\n            \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * (wp body (\\<lambda>s. \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s *\n              wp body (wp do G \\<longrightarrow> body od (\\<lambda>s. 1)) s) s)\"\n        by(simp only:X)\n    }\n    txt \\<open>Lastly, by folding two loop iterations:\\<close>\n    also\n    have \"\\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s * (wp body (\\<lambda>s. \\<guillemotleft>\\<N> G\\<guillemotright> s + \\<guillemotleft>G\\<guillemotright> s *\n            wp body (wp do G \\<longrightarrow> body od (\\<lambda>s. 1)) s) s) =\n          wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\"\n      by(simp add:wp_loop_unfold[OF _ hb, where P=\"\\<lambda>s. 1\", simplified, symmetric]\n                  fun_cong[OF wp_loop_unfold[OF _ hb, where P=\"\\<lambda>s. 1\", simplified, symmetric]])\n    finally show \"p * (1-k) + k \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\" .\n  qed\n\n  txt \\<open>If the previous bound lay in $[0,1)$, the new bound is strictly greater.  This is where\n    we appeal to the fact that @{term p} is nonzero.\\<close>\n  from nzp have inc: \"\\<And>k. 0 \\<le> k \\<Longrightarrow> k < 1 \\<Longrightarrow> k < p * (1 - k) + k\"\n    by(auto intro:mult_pos_pos)\n\n  txt \\<open>The result follows by contradiction.\\<close>\n  show ?thesis\n  proof(rule ccontr)\n    txt \\<open>If the loop does not terminate everywhere, then there must exist some state\n      from which the probability of termination is strictly less than one.\\<close>\n    assume \"\\<not> ?thesis\"\n    hence \"\\<not> (\\<forall>s. 1 \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s)\" by(auto)\n    then obtain s where point: \"\\<not> 1 \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\" by(auto)\n\n    let ?k = \"Inf (range (wp do G \\<longrightarrow> body od (\\<lambda>s. 1)))\"\n\n    from hloop\n    have Inflb: \"\\<And>s. ?k \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\"\n      by(intro cInf_lower bdd_belowI, auto)\n    also from point have \"wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s < 1\" by(auto)\n    txt \\<open>Thus the least (infimum) probabilty of termination is strictly less than one.\\<close>\n    finally have k1: \"?k < 1\" .\n    hence \"?k \\<le> 1\" by(auto)\n    moreover from hloop have k0: \"0 \\<le> ?k\"\n      by(intro cInf_greatest, auto)\n    txt \\<open>The infimum is, naturally, a lower bound.\\<close>\n    moreover from Inflb have \"(\\<lambda>s. ?k) \\<tturnstile> wp do G \\<longrightarrow> body od (\\<lambda>s. 1)\" by(auto)\n    ultimately\n    txt \\<open>We can therefore use the previous result to find a new bound, \\ldots\\<close>\n    have \"\\<And>s. p * (1 - ?k) + ?k \\<le> wp do G \\<longrightarrow> body od (\\<lambda>s. 1) s\"\n      by(blast intro:le_funD[OF new_bound])\n    txt \\<open>\\ldots which is lower than the infimum, by minimality, \\ldots\\<close>\n    hence \"p * (1 - ?k) + ?k \\<le> ?k\"\n      by(blast intro:cInf_greatest)\n    txt \\<open>\\ldots yet also strictly greater than it.\\<close>\n    moreover from k0 k1 have \"?k < p * (1 - ?k) + ?k\" by(rule inc)\n    txt \\<open>We thus have a contradiction.\\<close>\n    ultimately show False by(simp)\n  qed\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/pGCL/Termination.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.309538522118549}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Step_Sim_Pres\n  imports Weak_Late_Step_Sim\nbegin\n\nlemma tauPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"\\<tau>.(P) \\<leadsto><Rel> \\<tau>.(Q)\"\nproof(induct rule: simCases)\n  case(Bound Q' a y)\n  have \"\\<tau>.(Q) \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Input Q' a x)\n  have \"\\<tau>.(Q) \\<longmapsto>a<x> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Free Q' \\<alpha>)\n  have \"\\<tau>.(Q) \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n  thus ?case using PRelQ\n  proof(induct rule: tauCases, auto simp add: pi.inject residual.inject)\n    have \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P\" by(rule Weak_Late_Step_Semantics.Tau)\n    moreover assume \"(P, Q') \\<in> Rel\"\n    ultimately show \"\\<exists>P'. \\<tau>.(P) \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P' \\<and> (P', Q') \\<in> Rel\" by blast\n  qed\nqed\n\nlemma inputPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   x    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"\\<forall>y. (P[x::=y], Q[x::=y]) \\<in> Rel\"\n  and     Eqvt: \"eqvt Rel\"\n\n  shows \"a<x>.P \\<leadsto><Rel> a<x>.Q\"\nproof -\n  show ?thesis using Eqvt\n  proof(induct rule: simCasesCont[of _ \"(P, a, x, Q)\"])\n    case(Bound Q' b y)\n    have \"a<x>.Q \\<longmapsto>b<\\<nu>y> \\<prec> Q'\" by fact\n    hence False by auto\n    thus ?case by simp\n  next\n    case(Input Q' b y)\n    have \"y \\<sharp> (P, a, x, Q)\" by fact\n    hence yFreshP: \"(y::name) \\<sharp> P\" and yineqx: \"y \\<noteq> x\" and \"y \\<noteq> a\" and \"y \\<sharp> Q\"\n      by(simp add: fresh_prod)+\n    have \"a<x>.Q \\<longmapsto>b<y> \\<prec> Q'\" by fact\n    thus ?case using \\<open>y \\<noteq> a\\<close> \\<open>y \\<noteq> x\\<close> \\<open>y \\<sharp> Q\\<close>\n    proof(induct rule: inputCases, auto simp add: subject.inject)\n      have \"\\<forall>u. \\<exists>P'. a<x>.P \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> P' \\<and> (P', ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\"\n      proof(rule allI)\n        fix u\n        have \"a<x>.P \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> ([(x, y)] \\<bullet> P)[y::=u]\" (is \"?goal\")\n        proof -\n          from yFreshP have \"a<x>.P = a<y>.([(x, y)] \\<bullet> P)\" by(rule Agent.alphaInput)\n          moreover have \"a<y>.([(x, y)] \\<bullet> P) \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> ([(x, y)] \\<bullet> P)[y::=u]\" \n            by(rule Weak_Late_Step_Semantics.Input)\n          ultimately show ?goal by(simp add: name_swap)\n        qed\n\n        moreover have \"(([(x, y)] \\<bullet> P)[y::=u], ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\"\n        proof -\n          from PRelQ have \"(P[x::=u], Q[x::=u]) \\<in> Rel\" by auto\n          with \\<open>y \\<sharp> P\\<close> \\<open>y \\<sharp> Q\\<close> show ?thesis by(simp add: renaming)\n        qed\n        \n        ultimately show \"\\<exists>P'. a<x>.P \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> P' \\<and> (P', ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\" \n          by blast\n      qed\n      \n      thus \"\\<exists>P''. \\<forall>u. \\<exists>P'. a<x>.P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<y> \\<prec> P' \\<and> (P', ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\" by blast\n    qed\n  next\n    case(Free Q' \\<alpha>)\n    have \"a<x>.Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    hence False by auto\n    thus ?case by simp\n  qed\nqed\n\nlemma outputPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"a{b}.P \\<leadsto><Rel> a{b}.Q\"\nproof(induct rule: simCases)\n  case(Bound Q' c x)\n  have \"a{b}.Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Input Q' c x)\n  have \"a{b}.Q \\<longmapsto>c<x> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Free Q' \\<alpha>)\n  have \"a{b}.Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case using PRelQ\n  proof(induct rule: outputCases, auto simp add: pi.inject residual.inject)\n    have \"a{b}.P \\<Longrightarrow>\\<^sub>la[b] \\<prec> P\" by(rule Weak_Late_Step_Semantics.Output)\n    moreover assume \"(P, Q') \\<in> Rel\"\n    ultimately show \"\\<exists>P'. a{b}.P \\<Longrightarrow>\\<^sub>la[b] \\<prec> P' \\<and> (P', Q') \\<in> Rel\" by blast\n  qed\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"[a\\<frown>b]P \\<leadsto><Rel'> [a\\<frown>b]Q\"\nproof(induct rule: simCases)\n  case(Bound Q' c x)\n  have \"x \\<sharp> [a\\<frown>b]P\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n  have \"[a\\<frown>b]Q \\<longmapsto> c<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case cMatch\n    have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lc<\\<nu>x> \\<prec> P'\"\n                                   and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>\\<^sub>lc<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Match)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nnext\n  case(Input Q' c x)\n  have \"x \\<sharp> [a\\<frown>b]P\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n  have \"[a\\<frown>b]Q \\<longmapsto>c<x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case cMatch\n    have \"Q \\<longmapsto> c<x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\"\n      by(blast dest: simE)\n    have \"\\<forall>u. \\<exists>P'. [a\\<frown>a]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n    proof(rule allI)\n      fix u\n      from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\"\n        by blast\n      from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Match)\n      with P'RelQ' RelRel' show \"\\<exists>P'. [a\\<frown>a]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n        by blast\n    qed\n    thus ?case by blast\n  qed\nnext\n  case(Free Q' \\<alpha>)\n  have \"[a\\<frown>b]Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case cMatch\n    have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Match)\n    with PRel RelRel' show ?case by blast\n  qed\nqed\n\nlemma mismatchPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"[a\\<noteq>b]P \\<leadsto><Rel'> [a\\<noteq>b]Q\"\nproof(cases \"a=b\")\n  assume \"a=b\"\n  thus ?thesis\n    by(auto simp add: weakStepSimDef)\nnext\n  assume aineqb: \"a\\<noteq>b\"\n  show ?thesis\n  proof(induct rule: simCases)\n    case(Bound Q' c x)\n    have \"x \\<sharp> [a\\<noteq>b]P\" by fact\n    hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n    have \"[a\\<noteq>b]Q \\<longmapsto> c<\\<nu>x> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case cMismatch\n      have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n      with PSimQ xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lc<\\<nu>x> \\<prec> P'\"\n                                     and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans aineqb have \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lc<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Mismatch)\n      moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n      ultimately show ?case by blast\n    qed\n  next\n    case(Input Q' c x)\n    have \"x \\<sharp> [a\\<noteq>b]P\" by fact\n    hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n    have \"[a\\<noteq>b]Q \\<longmapsto>c<x> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case cMismatch\n      have \"Q \\<longmapsto> c<x> \\<prec> Q'\" by fact\n      with PSimQ xFreshP obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\"\n        by(blast dest: simE)\n      have \"\\<forall>u. \\<exists>P'. [a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n      proof(rule allI)\n        fix u\n        from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\"\n          by blast\n        from PTrans aineqb have \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Mismatch)\n        with P'RelQ' RelRel' show \"\\<exists>P'. [a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n          by blast\n      qed\n      thus ?case by blast\n    qed\n  next\n    case(Free Q' \\<alpha>)\n    have \"[a\\<noteq>b]Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case cMismatch\n      have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans \\<open>a \\<noteq> b\\<close> have \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Mismatch)\n      with PRel RelRel' show ?case by blast\n    qed\n  qed\nqed\n\nlemma sumCompose:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n  and   T :: pi\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     RSimT: \"R \\<leadsto><Rel> T\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"P \\<oplus> R \\<leadsto><Rel'> Q \\<oplus> T\"\nproof(induct rule: simCases)\n  case(Bound Q' a x)\n  have \"x \\<sharp> P \\<oplus> R\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n  have \"Q \\<oplus> T \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: sumCases)\n    case cSum1\n    have \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n    with xFreshP PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Sum1)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  next\n    case cSum2\n    have \"T \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n    with xFreshR RSimT obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> R'\" and R'RelQ': \"(R', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from RTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> R'\" by(rule Weak_Late_Step_Semantics.Sum2)\n    moreover from R'RelQ' RelRel' have \"(R', Q') \\<in> Rel'\" by blast\n    ultimately show ?thesis by blast\n  qed\nnext\n  case(Input Q' a x)\n  have \"x \\<sharp> P \\<oplus> R\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n  have \"Q \\<oplus> T \\<longmapsto>a<x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: sumCases)\n    case cSum1\n    have \"Q \\<longmapsto>a<x> \\<prec> Q'\" by fact\n    with xFreshP PSimQ obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\"\n      by(blast dest: simE)\n    have \"\\<forall>u. \\<exists>P'. P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n    proof(rule allI)\n      fix u\n      from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                          and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\" by blast\n      from PTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Sum1)\n      with P'RelQ' RelRel' show \"\\<exists>P'. P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\" by blast\n    qed\n    thus ?case by blast\n  next\n    case cSum2\n    have \"T \\<longmapsto>a<x> \\<prec> Q'\" by fact\n    with xFreshR RSimT obtain R'' where L1: \"\\<forall>u. \\<exists>R'. R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R' \\<and> (R', Q'[x::=u]) \\<in> Rel\" \n      by(blast dest: simE)\n    have \"\\<forall>u. \\<exists>P'. P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n    proof(rule allI)\n      fix u\n      from L1 obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R'\"\n                          and R'RelQ': \"(R', Q'[x::=u]) \\<in> Rel\" by blast\n      from RTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R'\" by(rule Weak_Late_Step_Semantics.Sum2)\n      with R'RelQ' RelRel' show  \"\\<exists>P'. P \\<oplus> R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\" by blast\n    qed    \n    thus ?case by blast\n  qed\nnext\n  case(Free Q' \\<alpha>)\n  have \"Q \\<oplus> T \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: sumCases)\n    case cSum1\n    have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\" \n      by(blast dest: simE)\n    from PTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Sum1)\n    with RelRel' PRel show ?case by blast\n  next\n    case cSum2\n    have \"T \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    with RSimT obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> R'\" and RRel: \"(R', Q') \\<in> Rel\" \n      by(blast dest: simE)\n    from RTrans have \"P \\<oplus> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> R'\" by(rule Weak_Late_Step_Semantics.Sum2)\n    with RelRel' RRel show ?case by blast\n  qed\nqed\n      \nlemma sumPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     Id: \"Id \\<subseteq> Rel\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"P \\<oplus> R \\<leadsto><Rel'> Q \\<oplus> R\"\nproof -\n  from Id have Refl: \"R \\<leadsto><Rel> R\" by(rule reflexive)\n  from PSimQ Refl RelRel' show ?thesis by(rule sumCompose)\nqed\n\nlemma parPres:\n  fixes P     :: pi\n  and   Q     :: pi\n  and   R     :: pi\n  and   Rel   :: \"(pi \\<times> pi) set\"\n  and   Rel'  :: \"(pi \\<times> pi) set\"\n  \n  assumes PSimQ:    \"P \\<leadsto><Rel> Q\"\n  and     PRelQ:    \"(P, Q) \\<in> Rel\"\n  and     Par:      \"\\<And>P Q R. (P, Q) \\<in> Rel \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> R) \\<in> Rel'\"\n  and     Res:      \"\\<And>P Q a. (P, Q) \\<in> Rel' \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> Rel'\"\n  and     EqvtRel:  \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"P \\<parallel> R \\<leadsto><Rel'> Q \\<parallel> R\"\nusing EqvtRel'\nproof(induct rule: simCasesCont[where C=\"(P, Q, R)\"])\n  case(Bound Q' a x)\n  have \"x \\<sharp> (P, Q, R)\" by fact\n  hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" and \"x \\<sharp> Q\" by simp+\n  from \\<open>Q \\<parallel> R \\<longmapsto> a<\\<nu>x> \\<prec> Q'\\<close> \\<open>x \\<sharp> Q\\<close> \\<open>x \\<sharp> R\\<close> show ?case\n  proof(induct rule: parCasesB)\n    case(cPar1 Q')\n    have QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n      \n    from xFreshP PSimQ QTrans obtain P' where PTrans:\"P \\<Longrightarrow>\\<^sub>l a<\\<nu>x> \\<prec> P'\"\n                                          and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l a<\\<nu>x> \\<prec> (P' \\<parallel> R)\" by(rule Weak_Late_Step_Semantics.Par1B)\n    moreover from P'RelQ' have \"(P' \\<parallel> R, Q' \\<parallel> R) \\<in> Rel'\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cPar2 R')\n    have RTrans: \"R \\<longmapsto> a<\\<nu>x> \\<prec> R'\" by fact\n    hence \"R \\<Longrightarrow>\\<^sub>l a<\\<nu>x> \\<prec> R'\"\n      by(auto simp add: weakTransition_def dest: Weak_Late_Step_Semantics.singleActionChain)\n    with xFreshP xFreshR have ParTrans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P \\<parallel> R'\"\n      by(blast intro: Weak_Late_Step_Semantics.Par2B)\n    moreover from PRelQ  have \"(P \\<parallel> R', Q \\<parallel>  R') \\<in> Rel'\" by(rule Par)\n    ultimately show ?case by blast\n  qed\nnext\n  case(Input Q' a x)\n  have \"x \\<sharp> (P, Q, R)\" by fact\n  hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" and \"x \\<sharp> Q\" by simp+\n  from \\<open>Q \\<parallel> R \\<longmapsto>a<x> \\<prec> Q'\\<close> \\<open>x \\<sharp> Q\\<close> \\<open>x \\<sharp> R\\<close>\n  show ?case\n  proof(induct rule: parCasesB)\n    case(cPar1 Q')\n    have QTrans: \"Q \\<longmapsto>a<x> \\<prec> Q'\" by fact\n    from xFreshP PSimQ QTrans obtain P''\n      where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\" \n      by(blast dest: simE)\n    have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u] \\<parallel> R[x::=u]) \\<in> Rel'\"\n    proof(rule allI)\n      fix u\n      from L1 obtain P' where PTrans:\"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                          and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\" by blast\n      from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> (P' \\<parallel> R)\"\n        by(rule Weak_Late_Step_Semantics.Par1B)\n      moreover from P'RelQ'  have \"(P' \\<parallel> R, Q'[x::=u] \\<parallel> R) \\<in> Rel'\" \n        by(rule Par)\n      ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u] \\<parallel> (R[x::=u])) \\<in> Rel'\"\n        using xFreshR\n        by(force simp add: forget)\n    qed\n    thus ?case by force\n  next\n    case(cPar2 R')\n    have RTrans: \"R \\<longmapsto>a<x> \\<prec> R'\" by fact\n    have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R')\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q \\<parallel> R'[x::=u]) \\<in> Rel'\"\n    proof \n      fix u\n      from RTrans have \"R \\<Longrightarrow>\\<^sub>lu in R'\\<rightarrow>a<x> \\<prec> R'[x::=u]\"\n        by(rule Weak_Late_Step_Semantics.singleActionChain)\n      hence \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in P \\<parallel> R'\\<rightarrow>a<x> \\<prec> P \\<parallel> R'[x::=u]\" using \\<open>x \\<sharp> P\\<close>\n        by(rule Weak_Late_Step_Semantics.Par2B)\n      moreover from PRelQ have \"(P \\<parallel> R'[x::=u], Q \\<parallel>  R'[x::=u]) \\<in> Rel'\" by(rule Par)\n      ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R')\\<rightarrow>a<x> \\<prec> P' \\<and>\n                           (P', Q \\<parallel> R'[x::=u]) \\<in> Rel'\" by blast\n    qed\n    thus ?case using \\<open>x \\<sharp> Q\\<close> by(fastforce simp add: forget)\n  qed\nnext\n  case(Free QR' \\<alpha>)\n  have \"Q \\<parallel> R \\<longmapsto> \\<alpha> \\<prec> QR'\" by fact\n  thus ?case\n  proof(induct rule: parCasesF[of _ _ _ _ _ \"(P, R)\"])\n    case(cPar1 Q')\n    have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Late_Step_Semantics.Par1F)\n    moreover from PRel have \"(P' \\<parallel> R, Q' \\<parallel> R) \\<in> Rel'\" by(blast intro: Par)\n    ultimately show ?case by blast\n  next\n    case(cPar2 R')\n    have \"R \\<longmapsto> \\<alpha> \\<prec> R'\" by fact\n    hence \"R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> R'\"\n      by(rule Weak_Late_Step_Semantics.singleActionChain)\n    hence \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> (P \\<parallel> R')\" by(rule Weak_Late_Step_Semantics.Par2F)\n    moreover from PRelQ have \"(P \\<parallel> R', Q \\<parallel> R') \\<in> Rel'\" by(blast intro: Par)\n    ultimately show ?case by blast\n  next\n    case(cComm1 Q' R' a b x)\n    have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" and RTrans: \"R \\<longmapsto> a[b] \\<prec> R'\" by fact+\n    have \"x \\<sharp> (P, R)\" by fact\n    hence xFreshP: \"x \\<sharp> P\" by(simp add: fresh_prod)\n    \n    from PSimQ QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>lb in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=b]) \\<in> Rel\"\n      by(blast dest: simE)\n      \n    from RTrans have \"R \\<Longrightarrow>\\<^sub>la[b] \\<prec> R'\"\n      by(rule Weak_Late_Step_Semantics.singleActionChain)\n    \n    with PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P' \\<parallel> R'\" by(rule Weak_Late_Step_Semantics.Comm1)\n    moreover from P'RelQ' have \"(P' \\<parallel> R', Q'[x::=b] \\<parallel> R') \\<in> Rel'\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cComm2 Q' R' a b x)\n    have QTrans: \"Q \\<longmapsto>a[b] \\<prec> Q'\" and RTrans: \"R \\<longmapsto>a<x> \\<prec> R'\" by fact+\n    have \"x \\<sharp> (P, R)\" by fact\n    hence xFreshR: \"x \\<sharp> R\" by(simp add: fresh_prod)\n      \n    from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la[b] \\<prec> P'\"\n                                  and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from RTrans have \"R \\<Longrightarrow>\\<^sub>lb in R'\\<rightarrow>a<x> \\<prec> R'[x::=b]\"\n      by(rule Weak_Late_Step_Semantics.singleActionChain)\n    with PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> P' \\<parallel> R'[x::=b]\" by(rule Weak_Late_Step_Semantics.Comm2)\n    moreover from PRel have \"(P' \\<parallel> R'[x::=b], Q' \\<parallel> R'[x::=b]) \\<in> Rel'\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cClose1 Q' R' a x y)\n    have QTrans: \"Q \\<longmapsto>a<x> \\<prec> Q'\" and RTrans: \"R \\<longmapsto>a<\\<nu>y> \\<prec> R'\" by fact+\n    have \"x \\<sharp> (P, R)\" and \"y \\<sharp> (P, R)\" by fact+\n    hence xFreshP: \"x \\<sharp> P\" and yFreshR: \"y \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" by(simp add: fresh_prod)+\n    \n    from PSimQ QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>ly in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=y]) \\<in> Rel\"\n      by(blast dest: simE)\n    from RTrans have \"R \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> R'\" \n      by(auto simp add: weakTransition_def dest: Weak_Late_Step_Semantics.singleActionChain)\n    with PTrans have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R')\" using yFreshP yFreshR \n      by(rule Weak_Late_Step_Semantics.Close1)\n    moreover from P'RelQ' have \"(<\\<nu>y>(P' \\<parallel> R'), <\\<nu>y>(Q'[x::=y] \\<parallel> R')) \\<in> Rel'\"\n      by(blast intro: Par Res)\n    ultimately show ?case by blast\n  next\n    case(cClose2 Q' R' a x y)\n    have QTrans: \"Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" and RTrans: \"R \\<longmapsto>a<x> \\<prec> R'\" by fact+\n    have \"x \\<sharp> (P, R)\" and \"y \\<sharp> (P, R)\" by fact+\n    hence xFreshR: \"x \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" and yFreshR: \"y \\<sharp> R\" by(simp add: fresh_prod)+\n\n    from PSimQ QTrans yFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> P'\"\n                                          and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n\n    from RTrans have \"R \\<Longrightarrow>\\<^sub>ly in R'\\<rightarrow>a<x> \\<prec> R'[x::=y]\"\n      by(rule Weak_Late_Step_Semantics.singleActionChain)\n    with PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R'[x::=y])\" using yFreshP yFreshR\n      by(rule Weak_Late_Step_Semantics.Close2)\n    moreover from P'RelQ' have \"(<\\<nu>y>(P' \\<parallel> R'[x::=y]), <\\<nu>y>(Q' \\<parallel> R'[x::=y])) \\<in> Rel'\"\n      by(blast intro: Par Res)\n    ultimately show ?case by blast\n  qed\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     ResRel: \"\\<And>(P::pi) (Q::pi) (x::name). (P, Q) \\<in> Rel \\<Longrightarrow> (<\\<nu>x>P, <\\<nu>x>Q) \\<in> Rel'\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     EqvtRel: \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"<\\<nu>x>P \\<leadsto><Rel'> <\\<nu>x>Q\"\nproof -\n  from EqvtRel' show ?thesis\n  proof(induct rule: simCasesCont[of _ \"(P, Q, x)\"])\n    case(Bound Q' a y)\n    have Trans: \"<\\<nu>x>Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n    have \"y \\<sharp> (P, Q, x)\" by fact\n    hence yineqx: \"y \\<noteq> x\" and yFreshP: \"y \\<sharp> P\" and \"y \\<sharp> Q\" by(simp add: fresh_prod)+\n    from Trans \\<open>y \\<noteq> x\\<close> \\<open>y \\<sharp> Q\\<close> show ?case\n    proof(induct rule: resCasesB)\n      case(cOpen a Q')\n      have QTrans: \"Q \\<longmapsto>a[x] \\<prec> Q'\" and aineqx: \"a \\<noteq> x\" by fact+\n\n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la[x] \\<prec> P'\"\n                                    and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n\n      have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> ([(y, x)] \\<bullet> P')\"\n      proof -\n        from PTrans aineqx have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Open)\n        moreover from PTrans yFreshP have \"y \\<sharp> P'\" by(force intro: Weak_Late_Step_Semantics.freshTransition)\n        ultimately show ?thesis by(simp add: alphaBoundResidual name_swap) \n      qed\n      moreover from EqvtRel P'RelQ' RelRel' have \"([(y, x)] \\<bullet> P', [(y, x)] \\<bullet> Q') \\<in> Rel'\"\n        by(blast intro: eqvtRelI)\n      ultimately show ?case by blast\n    next\n      case(cRes Q')\n      have QTrans: \"Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n      from \\<open>x \\<sharp> BoundOutputS a\\<close> have \"x \\<noteq> a\" by simp\n\n      from PSimQ yFreshP QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> P'\"\n                                            and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans \\<open>x \\<noteq> a\\<close> yineqx yFreshP have ResTrans: \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> (<\\<nu>x>P')\"\n        by(blast intro: Weak_Late_Step_Semantics.ResB)\n      moreover from P'RelQ' have \"((<\\<nu>x>P'), (<\\<nu>x>Q')) \\<in> Rel'\"\n        by(rule ResRel)\n      ultimately show ?case by blast\n    qed\n  next\n    case(Input Q' a y)\n    have \"y \\<sharp> (P, Q, x)\" by fact\n    hence yineqx: \"y \\<noteq> x\" and yFreshP: \"y \\<sharp> P\" and \"y \\<sharp> Q\" by(simp add: fresh_prod)+   \n    have \"<\\<nu>x>Q \\<longmapsto>a<y> \\<prec> Q'\" by fact\n    thus ?case using yineqx \\<open>y \\<sharp> Q\\<close>\n    proof(induct rule: resCasesB)\n      case(cOpen a Q')\n      thus ?case by simp\n    next\n      case(cRes Q')\n      have QTrans: \"Q \\<longmapsto>a<y> \\<prec> Q'\" by fact\n      from \\<open>x \\<sharp> InputS a\\<close> have \"x \\<noteq> a\" by simp\n      \n      from PSimQ QTrans yFreshP obtain P''\n        where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<y> \\<prec> P' \\<and> (P', Q'[y::=u]) \\<in> Rel\"\n        by(blast dest: simE)\n      have \"\\<forall>u. \\<exists>P'. <\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> P' \\<and> (P', (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n      proof(rule allI)\n        fix u\n        show \"\\<exists>P'. <\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in <\\<nu>x>P''\\<rightarrow>a<y> \\<prec> P' \\<and> (P', (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n        proof(cases \"x=u\")\n          assume xequ: \"x=u\"\n\n          have \"\\<exists>c::name. c \\<sharp> (P, P'', Q', x, y, a)\" by(blast intro: name_exists_fresh)\n          then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshP'': \"c \\<sharp> P''\" and cFreshQ': \"c \\<sharp> Q'\"\n                                and cineqx: \"c \\<noteq> x\" and cineqy: \"c \\<noteq> y\" and cineqa: \"c \\<noteq> a\"\n            by(force simp add: fresh_prod)\n        \n          from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lc in P''\\<rightarrow>a<y> \\<prec> P'\"\n                              and P'RelQ': \"(P', Q'[y::=c]) \\<in> Rel\"\n            by blast\n          have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> <\\<nu>c>([(x, c)] \\<bullet> P')\"\n          proof -\n            from PTrans yineqx \\<open>x \\<noteq> a\\<close> cineqx have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>lc in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> <\\<nu>x>P'\"\n              by(blast intro: Weak_Late_Step_Semantics.ResB)\n            hence \"([(x, c)] \\<bullet> <\\<nu>x>P) \\<Longrightarrow>\\<^sub>l([(x, c)] \\<bullet> c) in ([(x, c)] \\<bullet> <\\<nu>x>P'')\\<rightarrow>([(x, c)] \\<bullet> a)<([(x, c)] \\<bullet> y)> \\<prec> [(x, c)] \\<bullet> <\\<nu>x>P'\"\n              by(rule Weak_Late_Step_Semantics.eqvtI)\n            moreover from cFreshP have \"<\\<nu>c>([(x, c)] \\<bullet> P) = <\\<nu>x>P\" by(simp add: alphaRes)\n            moreover from cFreshP'' have \"<\\<nu>c>([(x, c)] \\<bullet> P'') = <\\<nu>x>P''\" by(simp add: alphaRes)\n            ultimately show ?thesis using \\<open>x \\<noteq> a\\<close> cineqa yineqx cineqy cineqx xequ by(simp add: name_calc)\n          qed\n          moreover have \"(<\\<nu>c>([(x, c)] \\<bullet> P'), (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n          proof -\n            from P'RelQ' have \"(<\\<nu>x>P', <\\<nu>x>(Q'[y::=c])) \\<in> Rel'\" by(rule ResRel)\n            with EqvtRel' have \"([(x, c)] \\<bullet> <\\<nu>x>P', [(x, c)] \\<bullet> <\\<nu>x>(Q'[y::=c])) \\<in> Rel'\"  by(rule eqvtRelI)\n            with cineqy yineqx cineqx have \"(<\\<nu>c>([(x, c)] \\<bullet> P'), (<\\<nu>c>([(x, c)] \\<bullet> Q'))[y::=x]) \\<in> Rel'\"\n              by(simp add: name_calc eqvt_subs)\n            with cFreshQ' xequ show ?thesis by(simp add: alphaRes)\n          qed\n          ultimately show ?thesis by blast\n        next\n          assume xinequ: \"x \\<noteq> u\"\n          from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<y> \\<prec> P'\"\n                             and P'RelQ': \"(P', Q'[y::=u]) \\<in> Rel\" by blast\n          \n          from PTrans \\<open>x \\<noteq> a\\<close> yineqx xinequ have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> <\\<nu>x>P'\"\n            by(blast intro: Weak_Late_Step_Semantics.ResB)\n          moreover from P'RelQ' xinequ yineqx have \"(<\\<nu>x>P', (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n            by(force intro: ResRel)\n          ultimately show ?thesis by blast\n        qed\n      qed\n      thus ?case by blast\n    qed\n  next\n    case(Free Q' \\<alpha>)\n    have \"<\\<nu>x>Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: resCasesF)\n      case(cRes Q')\n      have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\"\n                             and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      \n      have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> <\\<nu>x>P'\"\n      proof -\n        have xFreshAlpha: \"x \\<sharp> \\<alpha>\" by fact\n        with PTrans show ?thesis by(rule Weak_Late_Step_Semantics.ResF)\n      qed\n      moreover from P'RelQ' have \"(<\\<nu>x>P', <\\<nu>x>Q') \\<in> Rel'\" by(rule ResRel)\n      ultimately show ?case by blast\n    qed\n  qed\nqed\n\n\n\n  shows \"!P \\<leadsto><bangRel Rel'> !Q\"\nproof -\n  from eqvtRel' have EqvtBangRel': \"eqvt(bangRel Rel')\" by(rule eqvtBangRel)  \n  from RelRel' have BRelRel': \"\\<And>P Q. (P, Q) \\<in> bangRel Rel \\<Longrightarrow> (P, Q) \\<in> bangRel Rel'\"\n    by(auto intro: bangRelSubset)\n\n  have \"\\<And>Rs P. \\<lbrakk>!Q \\<longmapsto> Rs; (P, !Q) \\<in> bangRel Rel\\<rbrakk> \\<Longrightarrow> weakStepSimAct P Rs P (bangRel Rel')\"\n  proof -\n    fix Rs P\n    assume \"!Q \\<longmapsto> Rs\" and \"(P, !Q) \\<in> bangRel Rel\"\n    thus \"weakStepSimAct P Rs P (bangRel Rel')\"\n    proof(nominal_induct avoiding: P rule: bangInduct)\n      case(cPar1B aa x Q' P)\n      have QTrans: \"Q \\<longmapsto>aa\\<guillemotleft>x\\<guillemotright> \\<prec> Q'\" and xFreshQ: \"x \\<sharp> Q\" by fact+\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        from PRelQ have PSimQ: \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n        from EqvtBangRel' show ?case\n        proof(induct rule: simActBoundCases)\n          case(Input a)\n          have \"aa = InputS a\" by fact\n          with PSimQ QTrans xFreshP obtain P''\n            where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n            by(blast dest: simE)\n          have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and> (P', (Q' \\<parallel> !Q)[x::=u]) \\<in> bangRel Rel'\"\n          proof(rule allI)\n            fix u\n            from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel'\"\n              by blast\n            from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x>\\<prec> P' \\<parallel> R\"\n              by(rule Weak_Late_Step_Semantics.Par1B)\n            moreover have \"(P' \\<parallel> R, (Q' \\<parallel> !Q)[x::=u]) \\<in> bangRel Rel'\"\n            proof -\n              from P'RelQ' RBangRelQ have \"(P' \\<parallel> R, Q'[x::=u] \\<parallel> !Q) \\<in> bangRel Rel'\"\n                by(blast intro: BRelRel' Rel.BRPar)\n              with xFreshQ show ?thesis by(force simp add: forget)\n            qed\n            ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and>\n                                  (P', (Q' \\<parallel> !Q)[x::=u]) \\<in> bangRel Rel'\"\n              by blast\n          qed\n          thus ?case by blast\n        next\n          case(BoundOutput a)\n          have \"aa = BoundOutputS a\" by fact\n          with PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(force dest: simE)\n          from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>la<\\<nu>x>\\<prec> P' \\<parallel> R\"\n            by(rule Weak_Late_Step_Semantics.Par1B)\n          moreover from P'RelQ' RBangRelQ have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel'\"\n            by(blast intro: Rel.BRPar BRelRel')\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cPar1F \\<alpha> Q' P)\n      have QTrans: \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n        \n          from PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Late_Step_Semantics.Par1F)\n          moreover from P'RelQ' RBangRelQ have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel'\"\n            by(blast intro: BRelRel' Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cPar2B aa x Q' P)\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (aa\\<guillemotleft>x\\<guillemotright> \\<prec> Q') P (bangRel Rel')\" by fact\n      have xFreshQ: \"x \\<sharp> Q\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        from RBangRelQ have IH: \"weakStepSimAct R (aa\\<guillemotleft>x\\<guillemotright> \\<prec> Q') R (bangRel Rel')\" by(rule IH)\n        from EqvtBangRel' show ?case\n        proof(induct rule: simActBoundCases)\n          case(Input a)\n          have \"aa = InputS a\" by fact\n          with xFreshR IH obtain  R'' where L1: \"\\<forall>u. \\<exists>R'. R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R' \\<and>\n                                                 (R', Q'[x::=u]) \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n          have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P' \\<and> (P', (Q \\<parallel> Q')[x::=u]) \\<in> bangRel Rel'\"\n          proof(rule allI)\n            fix u\n            from L1 obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                and R'BangRelT': \"(R', Q'[x::=u]) \\<in> bangRel Rel'\"\n              by blast\n            \n            from RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P \\<parallel> R'\"\n              by(rule Weak_Late_Step_Semantics.Par2B)\n            moreover have \"(P \\<parallel> R', (Q \\<parallel> Q')[x::=u]) \\<in> bangRel Rel'\"\n            proof -\n              from PRelQ R'BangRelT' have \"(P \\<parallel> R', Q \\<parallel> Q'[x::=u]) \\<in> bangRel Rel'\"\n                by(blast intro: RelRel' Rel.BRPar)\n              with xFreshQ show ?thesis by(simp add: forget)\n            qed\n            ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P' \\<and> (P', (Q \\<parallel> Q')[x::=u]) \\<in> bangRel Rel'\"\n              by blast\n          qed\n          thus ?case by blast\n        next\n          case(BoundOutput a)\n          have \"aa = BoundOutputS a\" by fact\n          with IH xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> R'\"\n                                      and R'BangRelT': \"(R', Q') \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n\n          from RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P \\<parallel> R'\"\n            by(auto intro: Weak_Late_Step_Semantics.Par2B)\n          moreover from PRelQ R'BangRelT' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> bangRel Rel'\"\n            by(blast intro: RelRel' Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cPar2F \\<alpha> Q')\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (\\<alpha> \\<prec> Q') P (bangRel Rel')\" by fact+\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          from RBangRelQ have \"weakStepSimAct R (\\<alpha> \\<prec> Q') R (bangRel Rel')\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> R'\" and R'BangRelQ': \"(R', Q') \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n\n          from RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P \\<parallel> R'\" by(rule Weak_Late_Step_Semantics.Par2F)\n          moreover from PRelQ R'BangRelQ' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> bangRel Rel'\"\n            by(blast intro: RelRel' Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cComm1 a x Q' b Q'' P)\n      have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (a[b] \\<prec> Q'') P (bangRel Rel')\" by fact+\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" by simp\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>lb in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=b]) \\<in> Rel'\"\n            by(blast dest: simE)\n        \n          from RBangRelQ have \"weakStepSimAct R (a[b] \\<prec> Q'') R (bangRel Rel')\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>la[b] \\<prec> R'\"\n                           and R'RelT': \"(R', Q'') \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> (P' \\<parallel> R')\"\n            by(rule Weak_Late_Step_Semantics.Comm1)\n          moreover from P'RelQ' R'RelT' have \"(P' \\<parallel> R', Q'[x::=b] \\<parallel> Q'') \\<in> bangRel Rel'\"\n            by(blast intro: RelRel' Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cComm2 a b Q' x Q'' P)\n      have QTrans: \"Q \\<longmapsto>a[b] \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (a<x> \\<prec> Q'') P (bangRel Rel')\"\n        by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshR: \"x \\<sharp> R\" by simp\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          \n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la[b] \\<prec> P'\"\n                                  and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n        \n          from RBangRelQ have \"weakStepSimAct R (a<x> \\<prec> Q'') R (bangRel Rel')\"\n            by(rule IH)\n          with xFreshR obtain R' R'' where RTrans: \"R \\<Longrightarrow>\\<^sub>lb in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                       and R'BangRelQ'': \"(R', Q''[x::=b]) \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n        \n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> (P' \\<parallel> R')\"\n            by(rule Weak_Late_Step_Semantics.Comm2)\n          moreover from P'RelQ' R'BangRelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q''[x::=b]) \\<in> bangRel Rel'\"\n            by(rule Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cClose1 a x Q' y Q'' P)\n      have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (a<\\<nu>y> \\<prec> Q'') P (bangRel Rel')\"\n        by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" and \"y \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" and \"y \\<sharp> P \\<parallel> R\" by fact+\n        hence xFreshP: \"x \\<sharp> P\" and yFreshR: \"y \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" by simp+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>ly in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=y]) \\<in> Rel'\"\n            by(blast dest: simE)\n        \n          from RBangRelQ have \"weakStepSimAct R (a<\\<nu>y> \\<prec> Q'') R (bangRel Rel')\" by(rule IH)\n          with yFreshR obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> R'\"\n                                   and R'BangRelQ'': \"(R', Q'') \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n          from PTrans RTrans yFreshP yFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R')\"\n            by(rule Weak_Late_Step_Semantics.Close1)\n          moreover from P'RelQ' R'BangRelQ'' have \"(<\\<nu>y>(P' \\<parallel> R'), <\\<nu>y>(Q'[x::=y] \\<parallel> Q'')) \\<in> bangRel Rel'\"\n            by(force intro: Rel.BRPar Rel.BRRes)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cClose2 a y Q' x Q'')\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>y> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P (a<x> \\<prec> Q'') P (bangRel Rel')\"\n        by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" and \"y \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" and \"y \\<sharp> P \\<parallel> R\" by fact+\n        hence xFreshR: \"x \\<sharp> R\" and yFreshR: \"y \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" by simp+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Free\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans yFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>la<\\<nu>y> \\<prec> P'\"\n                                          and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n\n          from RBangRelQ have \"weakStepSimAct R (a<x> \\<prec> Q'') R (bangRel Rel')\"\n            by(rule IH)\n          with xFreshR obtain R' R'' where RTrans: \"R \\<Longrightarrow>\\<^sub>ly in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                       and R'BangRelT': \"(R', Q''[x::=y]) \\<in> bangRel Rel'\"\n            by(simp add: weakStepSimAct_def, blast)\n        \n          from PTrans RTrans yFreshP yFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R')\"\n            by(rule Weak_Late_Step_Semantics.Close2)\n          moreover from P'RelQ' R'BangRelT' have \"(<\\<nu>y>(P' \\<parallel> R'), <\\<nu>y>(Q' \\<parallel> Q''[x::=y])) \\<in> bangRel Rel'\"\n            by(force intro: Rel.BRPar Rel.BRRes)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cBang Rs)\n      have IH: \"\\<And>P. (P, Q \\<parallel> !Q) \\<in> bangRel Rel \\<Longrightarrow> weakStepSimAct P Rs P (bangRel Rel')\"\n        by fact\n      have \"(P, !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRBangCases)\n        case(BRBang P)\n        have PRelQ: \"(P, Q) \\<in> Rel\" by fact\n        hence \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n        with PRelQ have \"(P \\<parallel> !P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by(rule Rel.BRPar)\n        hence \"weakStepSimAct (P \\<parallel> !P) Rs (P \\<parallel> !P) (bangRel Rel')\" by(rule IH)\n        thus ?case\n        proof(simp (no_asm) add: weakStepSimAct_def, auto)\n          fix Q' a x\n          assume \"weakStepSimAct (P \\<parallel> !P) (a<\\<nu>x> \\<prec> Q') (P \\<parallel> !P) (bangRel Rel')\" and \"x \\<sharp> P\"\n          then obtain P' where PTrans: \"(P \\<parallel> !P) \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\"\n                           and P'RelQ': \"(P', Q') \\<in> (bangRel Rel')\"\n            by(simp add: weakStepSimAct_def, blast)\n          from PTrans have \"!P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P'\"\n            by(rule Weak_Late_Step_Semantics.Bang)\n          with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>\\<^sub>la<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> bangRel Rel'\" by blast\n        next\n          fix Q' a x\n          assume \"weakStepSimAct (P \\<parallel> !P) (a<x> \\<prec> Q') (P \\<parallel> !P) (bangRel Rel')\" and \"x \\<sharp> P\"\n          then obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<parallel> !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> (bangRel Rel')\"\n            by(simp add: weakStepSimAct_def, blast)\n          have \"\\<forall>u. \\<exists>P'. !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> (bangRel Rel')\"\n          proof(rule allI)\n            fix u\n            from L1 obtain P' where PTrans: \"P \\<parallel> !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                and P'RelQ': \"(P', Q'[x::=u]) \\<in> (bangRel Rel')\"\n              by blast\n            from PTrans have \"!P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Bang)\n            with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> (bangRel Rel')\" by blast\n          qed\n          thus \"\\<exists>P''. \\<forall>u. \\<exists>P'. !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> (bangRel Rel')\" by blast\n        next\n          fix Q' \\<alpha>\n          assume \"weakStepSimAct (P \\<parallel> !P) (\\<alpha> \\<prec> Q') (P \\<parallel> !P) (bangRel Rel')\"\n          then obtain P' where PTrans: \"(P \\<parallel> !P) \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\"\n                           and P'RelQ': \"(P', Q') \\<in> (bangRel Rel')\"\n            by(simp add: weakStepSimAct_def, blast)\n          from PTrans have \"!P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\"\n            by(rule Weak_Late_Step_Semantics.Bang)\n          with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> (bangRel Rel')\" by blast\n        qed\n      qed\n    qed\n  qed   \n  moreover from PRelQ have \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n  ultimately show ?thesis by(simp add: weakStepSim_def)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Late_Step_Sim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.309538522118549}}
{"text": "theory flash15Bra  imports flash15Rev\n \n  begin\nlemma onInv15:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv15  iInv1  iInv2  iInv3 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX1VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_GetXVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ShWbVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX7VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak2VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX5VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_WbVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_GetVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceShrVldVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_2VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak2VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_ReplaceVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_HomeVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put2VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX11VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX6VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put2VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1_HomeVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak1VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak1VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak2VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak3VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX2VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put1VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutXVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis StoreVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_FAckVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX3VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutXVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put1VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis StoreHomeVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_NakVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_PutXVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX4VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_NakVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak1VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_ClearVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_PutXVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak3VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX9VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetXVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv15  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put3VsInv15 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash15Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251201477015, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.3095364340938217}}
{"text": "theory flash89Bra  imports flash89Rev\n \n  begin\nlemma onInv89:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv89  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv89  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv89 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash89Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.309536427529843}}
{"text": "theory inFM\n\nimports bundle.SB\nbegin\n\ntypedef inFM=\"{cin1,cin2}\"\n  by auto\n\n\ninstantiation inFM::\"{somechan,finite}\"\nbegin\ndefinition \"Rep = Rep_inFM\"\ninstance\n  apply(standard)\n  apply(auto simp add: Rep_inFM_def cEmpty_def)\n  apply(auto simp add: ctype_empty_iff)\n  using ctype_empty_iff\n  apply (metis Rep_inFM cMsg.simps ex_in_conv insertE insert_iff)\n  apply (meson Rep_inFM_inject injI) using cMsg.elims Rep_inFM apply simp\n  apply (metis cMsg.simps emptyE image_iff iso_tuple_UNIV_I)\n  using type_definition.Abs_image type_definition_inFM typedef_finite_UNIV by fastforce\nend\n\ndefinition \"FMin1 \\<equiv> Abs_inFM cin1\"\ndefinition \"FMin2 \\<equiv> Abs_inFM cin2\"\n\nfree_constructors inFM for \"FMin1\"  | \"FMin2\"\n  apply auto\n  unfolding FMin1_def FMin2_def\n  apply (metis Rep_inFM Rep_inFM_inverse empty_iff insert_iff)\n  by (simp add: Abs_inFM_inject)\n\nlemma FMin1_rep [simp]: \"Rep (FMin1) = cin1\"\n  by (simp add: Abs_inFM_inverse FMin1_def Rep_inFM_def)\n\nlemma FMin2_rep [simp]: \"Rep (FMin2) = cin2\"\n  unfolding Rep_inFM_def FMin2_def\n  by (simp add: Abs_inFM_inverse)\n\nfun inFMChan::\"('nat::type \\<Rightarrow> 'a::type) \\<Rightarrow> ('bool::type \\<Rightarrow> 'a) \\<Rightarrow>('nat\\<times>'bool) \\<Rightarrow> inFM \\<Rightarrow> 'a\" where\n\"inFMChan Cc1 Cc2 (port_c1, port_c2) FMin1 = Cc1 port_c1\" |\n\"inFMChan Cc1 Cc2 (port_c1, port_c2) FMin2 = Cc2 port_c2\"\n\nabbreviation \"buildFMinSBE \\<equiv> inFMChan (Tsyn o (map_option) \\<N>) (Tsyn o (map_option) \\<N>)\" \n\nlemma buildfmin_ctype: \"buildFMinSBE a c \\<in> ctype (Rep c)\"\n  apply(cases c; cases a;simp)\n  by(simp_all add: ctype_def,auto)\n \nlemma buildfmin_inj: \"inj buildFMinSBE\"\n  apply (auto simp add: inj_def)\n  sorry\n\nlemma buildfmin_range: \"range (\\<lambda>a. buildFMinSBE a c) = ctype (Rep c)\"\n  sorry\n\nlemma buildfmin_surj: assumes \"sbElem_well (Some sbe)\"\n  shows \"sbe \\<in> range buildFMinSBE\"\nproof -\n  have ctypewell:\"\\<And> c. sbe c\\<in> ctype (Rep c)\"\n    using assms by auto\n  hence \"\\<And>c. sbe c \\<in> range (\\<lambda>a. buildFMinSBE a c)\"\n    by (simp add: buildfmin_range)\n  hence \"\\<exists>prod. sbe = buildFMinSBE prod\"\n    apply(subst fun_eq_iff,auto)\n    sorry\n  thus ?thesis\n    by auto\nqed\n\nabbreviation \"buildFMinSB \\<equiv> inFMChan (Rep_cfun (smap (Tsyn o (map_option) \\<N>))) (Rep_cfun (smap (Tsyn o (map_option) \\<N>)))\" \n\nend", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/demo/fairmerge/inFM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.309536427529843}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoarePartial.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection {* Derived Hoare Rules for Partial Correctness *}\n\ntheory HoarePartial imports HoarePartialProps begin\n\nlemma conseq_no_aux:\n  \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A';\n    \\<forall>s. s \\<in> P \\<longrightarrow> (s\\<in>P' \\<and> (Q' \\<subseteq> Q) \\<and> (A' \\<subseteq> A))\\<rbrakk>\n  \\<Longrightarrow>\n  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq [where P'=\"\\<lambda>Z. P'\" and Q'=\"\\<lambda>Z. Q'\" and A'=\"\\<lambda>Z. A'\"]) auto\n\n\nlemma conseq_exploit_pre:\n             \"\\<lbrakk>\\<forall>s \\<in> P. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s} \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  apply (rule Conseq)\n  apply clarify\n  apply (rule_tac x=\"{s} \\<inter> P\" in exI)  \n  apply (rule_tac x=\"Q\" in exI)  \n  apply (rule_tac x=\"A\" in exI)  \n  by simp\n\n\nlemma conseq:\"\\<lbrakk>\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n              \\<forall>s. s \\<in> P \\<longrightarrow> (\\<exists> Z. s\\<in>P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A))\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule Conseq') blast\n\nlemma Lem: \"\\<lbrakk>\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n             P \\<subseteq> {s. \\<exists> Z. s\\<in>P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A)}\\<rbrakk>\n             \\<Longrightarrow>\n             \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n  apply (unfold lem_def) \n  apply (erule conseq)\n  apply blast\n  done\n\nlemma LemAnno:\nassumes conseq:  \"P \\<subseteq> {s. \\<exists>Z. s\\<in>P' Z \\<and> \n                     (\\<forall>t. t \\<in> Q' Z \\<longrightarrow> t \\<in> Q) \\<and> (\\<forall>t. t \\<in> A' Z \\<longrightarrow> t \\<in> A)}\"\nassumes lem: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (lem x c) Q,A\"\n  apply (rule Lem [OF lem])\n  using conseq\n  by blast\n\nlemma LemAnnoNoAbrupt:\nassumes conseq:  \"P \\<subseteq>  {s. \\<exists>Z. s\\<in>P' Z \\<and> (\\<forall>t. t \\<in> Q' Z \\<longrightarrow> t \\<in> Q)}\"\nassumes lem: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (lem x c) Q,{}\"\n  apply (rule Lem [OF lem])\n  using conseq\n  by blast\n\nlemma TrivPost: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)\n                 \\<Longrightarrow>\n                 \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c UNIV,UNIV\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma TrivPostNoAbr: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),{}\n                 \\<Longrightarrow>\n                 \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) c UNIV,{}\"\napply (rule allI)\napply (erule conseq)\napply auto\ndone\n\nlemma conseq_under_new_pre:\"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P' c Q',A';\n        \\<forall>s \\<in> P. s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A\\<rbrakk>\n\\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P c Q,A\"\napply (rule conseq)\napply (rule allI)\napply assumption\napply auto\ndone\n\n\n\nlemma DynComConseq:\n  assumes \"P \\<subseteq> {s. \\<exists>P' Q' A'.  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P' (c s) Q',A' \\<and> P \\<subseteq> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A}\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P DynCom c Q,A\"\n  using assms\n  apply -\n  apply (rule DynCom)\n  apply clarsimp\n  apply (rule Conseq)\n  apply clarsimp\n  apply blast\n  done\n\nlemma SpecAnno: \n assumes consequence: \"P \\<subseteq> {s. (\\<exists> Z. s\\<in>P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A))}\"\n assumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z)\"\n assumes bdy_constant:  \"\\<forall>Z. c Z = c undefined\"\n shows   \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\nproof -\n  from spec bdy_constant\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ((P' Z)) (c undefined) (Q' Z),(A' Z)\"\n    apply - \n    apply (rule allI)\n    apply (erule_tac x=Z in allE)\n    apply (erule_tac x=Z in allE)\n    apply simp\n    done\n  with consequence show ?thesis\n    apply (simp add: specAnno_def)\n    apply (erule conseq)\n    apply blast\n    done\nqed\n\nlemma SpecAnno': \n \"\\<lbrakk>P \\<subseteq> {s.  \\<exists> Z. s\\<in>P' Z \\<and> \n            (\\<forall>t. t \\<in> Q' Z \\<longrightarrow>  t \\<in> Q) \\<and> (\\<forall>t. t \\<in> A' Z \\<longrightarrow> t \\<in>  A)};\n   \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),(A' Z);\n   \\<forall>Z. c Z = c undefined\n  \\<rbrakk> \\<Longrightarrow>\n    \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (specAnno P' c Q' A') Q,A\"\napply (simp only: subset_iff [THEN sym])\napply (erule (1) SpecAnno)\napply assumption\ndone\n\n\nlemma SpecAnnoNoAbrupt: \n \"\\<lbrakk>P \\<subseteq> {s.  \\<exists> Z. s\\<in>P' Z \\<and> \n            (\\<forall>t. t \\<in> Q' Z \\<longrightarrow>  t \\<in> Q)};\n   \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) (c Z) (Q' Z),{};\n   \\<forall>Z. c Z = c undefined\n  \\<rbrakk> \\<Longrightarrow>\n    \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (specAnno P' c Q' (\\<lambda>s. {})) Q,A\"\napply (rule SpecAnno')\napply auto\ndone\n\nlemma Skip: \"P \\<subseteq> Q \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Skip Q,A\"\n  by (rule hoarep.Skip [THEN conseqPre],simp)\n\nlemma Basic: \"P \\<subseteq> {s. (f s) \\<in> Q} \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Basic f) Q,A\"\n  by (rule hoarep.Basic [THEN conseqPre])\n\nlemma BasicCond: \n  \"\\<lbrakk>P \\<subseteq> {s. (b s \\<longrightarrow> f s\\<in>Q) \\<and> (\\<not> b s \\<longrightarrow> g s\\<in>Q)}\\<rbrakk> \\<Longrightarrow>\n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Basic (\\<lambda>s. if b s then f s else g s) Q,A\"\n  apply (rule Basic)\n  apply auto\n  done\n\nlemma Spec: \"P \\<subseteq> {s. (\\<forall>t. (s,t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s,t) \\<in> r)} \n            \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Spec r) Q,A\"\nby (rule hoarep.Spec [THEN conseqPre])\n\nlemma SpecIf: \n  \"\\<lbrakk>P \\<subseteq> {s. (b s \\<longrightarrow> f s \\<in> Q) \\<and> (\\<not> b s \\<longrightarrow> g s \\<in> Q \\<and> h s \\<in> Q)}\\<rbrakk> \\<Longrightarrow>\n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Spec (if_rel b f g h) Q,A\"\n  apply (rule Spec)\n  apply (auto simp add: if_rel_def)\n  done\n\n\nlemma Seq [trans, intro?]: \n  \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Seq c\\<^sub>1 c\\<^sub>2) Q,A\"\n  by (rule hoarep.Seq)\n\nlemma SeqSwap: \n  \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c2 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c1 R,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Seq c1 c2) Q,A\"\n  by (rule Seq)\n\nlemma BSeq:\n  \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (bseq c\\<^sub>1 c\\<^sub>2) Q,A\"\n  by (unfold bseq_def) (rule Seq)\n\n\nlemma Cond: \n  assumes wp: \"P \\<subseteq> {s. (s\\<in>b \\<longrightarrow> s\\<in>P\\<^sub>1) \\<and> (s\\<notin>b \\<longrightarrow> s\\<in>P\\<^sub>2)}\" \n  assumes deriv_c1: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\" \n  assumes deriv_c2: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof (rule hoarep.Cond [THEN conseqPre])\n  from deriv_c1 \n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. (s \\<in> b \\<longrightarrow> s \\<in> P\\<^sub>1) \\<and> (s \\<notin> b \\<longrightarrow> s \\<in> P\\<^sub>2)} \\<inter> b) c\\<^sub>1 Q,A\"\n    by (rule conseqPre) blast\nnext\n  from deriv_c2 \n  show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. (s \\<in> b \\<longrightarrow> s \\<in> P\\<^sub>1) \\<and> (s \\<notin> b \\<longrightarrow> s \\<in> P\\<^sub>2)} \\<inter> - b) c\\<^sub>2 Q,A\"\n    by (rule conseqPre) blast\nnext\n  show \"P \\<subseteq> {s. (s\\<in>b \\<longrightarrow> s\\<in>P\\<^sub>1) \\<and> (s\\<notin>b \\<longrightarrow> s\\<in>P\\<^sub>2)}\" by (rule wp)\nqed \n\n\nlemma CondSwap: \n  \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P2 c2 Q,A; P \\<subseteq> {s. (s\\<in>b \\<longrightarrow> s\\<in>P1) \\<and> (s\\<notin>b \\<longrightarrow> s\\<in>P2)}\\<rbrakk>\n   \\<Longrightarrow> \n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n  by (rule Cond)\n\nlemma Cond': \n  \"\\<lbrakk>P \\<subseteq> {s. (b \\<subseteq> P1) \\<and> (- b \\<subseteq> P2)};\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P1 c1 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P2 c2 Q,A\\<rbrakk>\n   \\<Longrightarrow> \n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n  by (rule CondSwap) blast+\n\nlemma CondInv: \n  assumes wp: \"P \\<subseteq> Q\" \n  assumes inv: \"Q \\<subseteq> {s. (s\\<in>b \\<longrightarrow> s\\<in>P\\<^sub>1) \\<and> (s\\<notin>b \\<longrightarrow> s\\<in>P\\<^sub>2)}\" \n  assumes deriv_c1: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 Q,A\" \n  assumes deriv_c2: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n  from wp inv\n  have \"P \\<subseteq> {s. (s\\<in>b \\<longrightarrow> s\\<in>P\\<^sub>1) \\<and> (s\\<notin>b \\<longrightarrow> s\\<in>P\\<^sub>2)}\"\n    by blast\n  from Cond [OF this deriv_c1 deriv_c2]\n  show ?thesis .\nqed\n\nlemma CondInv': \n  assumes wp: \"P \\<subseteq> I\" \n  assumes inv: \"I \\<subseteq> {s. (s\\<in>b \\<longrightarrow> s\\<in>P\\<^sub>1) \\<and> (s\\<notin>b \\<longrightarrow> s\\<in>P\\<^sub>2)}\" \n  assumes wp': \"I \\<subseteq> Q\" \n  assumes deriv_c1: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P\\<^sub>1 c\\<^sub>1 I,A\" \n  assumes deriv_c2: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P\\<^sub>2 c\\<^sub>2 I,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\nproof -\n  from CondInv [OF wp inv deriv_c1 deriv_c2]\n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) I,A\".\n  from conseqPost [OF this wp' subset_refl]\n  show ?thesis .\nqed\n    \n\nlemma switchNil:\n  \"P \\<subseteq> Q \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P (switch v []) Q,A\"\n  by (simp add: Skip)\n \nlemma switchCons:\n  \"\\<lbrakk>P \\<subseteq> {s. (v s \\<in> V \\<longrightarrow> s \\<in> P\\<^sub>1) \\<and> (v s \\<notin> V \\<longrightarrow> s \\<in> P\\<^sub>2)}; \n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P\\<^sub>1 c Q,A;\n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P\\<^sub>2 (switch v vs) Q,A\\<rbrakk>\n\\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P (switch v ((V,c)#vs)) Q,A\"\n  by (simp add: Cond)\n\nlemma Guard:\n \"\\<lbrakk>P \\<subseteq> g \\<inter> R; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guard [THEN conseqPre, of _ _ _ _ R])\napply (erule conseqPre)\napply auto\ndone\n\nlemma Await:\n \"\\<lbrakk>P \\<subseteq> R \\<inter> b; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Await b c) Q,A\"\napply (rule Await [THEN conseqPre, of _ _ _ R])\napply (erule conseqPre)\napply auto\ndone\n\nlemma GuardSwap:\n \"\\<lbrakk> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A; P \\<subseteq> g \\<inter> R\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n  by (rule Guard)\n\nlemma AwaitSwap:\n \"\\<lbrakk> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A; P \\<subseteq> R \\<inter> b\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Await b c) Q,A\"\n  by (rule Await, auto)\n\nlemma Guarantee:\n \"\\<lbrakk>P \\<subseteq> {s. s \\<in> g \\<longrightarrow> s \\<in> R}; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A; f \\<in> F\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre, of _ _ _ _ _ \"{s. s \\<in> g \\<longrightarrow> s \\<in> R}\"])\napply   assumption\napply  (erule conseqPre)\napply auto\ndone\n\nlemma GuaranteeSwap:\n \"\\<lbrakk> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A; P \\<subseteq> {s. s \\<in> g \\<longrightarrow> s \\<in> R}; f \\<in> F\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n  by (rule Guarantee)\n\nlemma GuardStrip:\n \"\\<lbrakk>P \\<subseteq> R; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A; f \\<in> F\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\napply (rule Guarantee [THEN conseqPre])\napply auto\ndone\n\nlemma GuardStripSwap:\n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A; P \\<subseteq> R; f \\<in> F\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n  by (rule GuardStrip)\n\nlemma GuaranteeStrip:\n \"\\<lbrakk>P \\<subseteq> R; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A; f \\<in> F\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n  by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeStripSwap:\n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A; P \\<subseteq> R; f \\<in> F\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n  by (unfold guaranteeStrip_def) (rule GuardStrip)\n\nlemma GuaranteeAsGuard:\n \"\\<lbrakk>P \\<subseteq> g \\<inter> R; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n  by (unfold guaranteeStrip_def) (rule Guard)\n\n\nlemma GuaranteeAsGuardSwap:\n \"\\<lbrakk> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c Q,A; P \\<subseteq> g \\<inter> R\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (guaranteeStrip f g c) Q,A\"\n  by (rule GuaranteeAsGuard)\n\nlemma GuardsNil:\n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow> \n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (guards [] c) Q,A\"\n  by simp\n\n\n\nlemma GuardsConsGuaranteeStrip:\n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P guaranteeStrip f g (guards gs c) Q,A \\<Longrightarrow> \n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (guards (guaranteeStripPair f g#gs) c) Q,A\"\n  by (simp add: guaranteeStripPair_def guaranteeStrip_def)\n\nlemma While: \n  assumes P_I: \"P \\<subseteq> I\" \n  assumes deriv_body: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (I \\<inter> b) c I,A\"\n  assumes I_Q: \"I \\<inter> -b \\<subseteq> Q\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\"\nproof -\n  from deriv_body P_I I_Q\n  show ?thesis\n    apply (simp add: whileAnno_def)\n    apply (erule conseqPrePost [OF HoarePartialDef.While]) \n    apply simp_all\n    done\nqed\n\ntext {* @{term \"J\"} will be instantiated by tactic with @{term \"gs' \\<inter> I\"} for\n  those guards that are not stripped.*} \nlemma  WhileAnnoG:\n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (guards gs \n                    (whileAnno  b J V (Seq c (guards gs Skip)))) Q,A \n        \\<Longrightarrow> \n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\"\n  by (simp add: whileAnnoG_def whileAnno_def while_def)\n\n\ntext {* This form stems from @{term \"strip_guards F (whileAnnoG gs b I V c)\"} *}\n\n\n\n\n\nlemma WhileAnnoGFix:\nassumes whileAnnoFix:\n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (guards gs \n                (whileAnnoFix  b J V (\\<lambda>Z. (Seq (c Z) (guards gs Skip))))) Q,A\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (whileAnnoGFix gs b I V c) Q,A\"\n  using whileAnnoFix\n  by (simp add: whileAnnoGFix_def whileAnnoFix_def while_def)\n\nlemma Bind:\n  assumes adapt: \"P \\<subseteq> {s. s \\<in> P' s}\" \n  assumes c: \"\\<forall>s. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' s) (c (e s)) Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (bind e c) Q,A\" \napply (rule conseq [where P'=\"\\<lambda>Z. {s. s=Z \\<and> s \\<in> P' Z}\" and Q'=\"\\<lambda>Z. Q\" and \nA'=\"\\<lambda>Z. A\"])\napply  (rule allI)\napply  (unfold bind_def)\napply  (rule DynCom)\napply  (rule ballI)\napply  simp\napply  (rule conseqPre)\napply   (rule c [rule_format])\napply  blast\nusing adapt\napply blast\ndone\n\nlemma Block:\nassumes adapt: \"P \\<subseteq> {s. init s \\<in> P' s}\"\nassumes bdy: \"\\<forall>s. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\<in> R s t},{t. return s t \\<in> A}\"\nassumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\" \napply (rule conseq [where P'=\"\\<lambda>Z. {s. s=Z \\<and> init s \\<in> P' Z}\" and Q'=\"\\<lambda>Z. Q\" and \nA'=\"\\<lambda>Z. A\"])\nprefer 2\nusing adapt\napply  blast\napply (rule allI)\napply (unfold block_def)\napply (rule DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return Z t \\<in> R Z t}\" in SeqSwap )\napply  (rule_tac  P'=\"\\<lambda>Z'. {t. t=Z' \\<and> return Z t \\<in> R Z t}\" and \n          Q'=\"\\<lambda>Z'. Q\" and A'=\"\\<lambda>Z'. A\" in conseq)\nprefer 2 apply simp\napply  (rule allI)\napply  (rule DynCom)\napply  (clarsimp)\napply  (rule SeqSwap)\napply   (rule c [rule_format])\napply  (rule Basic)\napply  clarsimp\napply (rule_tac R=\"{t. return Z t \\<in> A}\" in Catch)\napply  (rule_tac R=\"{i. i \\<in> P' Z}\" in Seq)\napply   (rule Basic)\napply   clarsimp\napply  simp\napply  (rule bdy [rule_format])\napply (rule SeqSwap)\napply  (rule Throw)\napply (rule Basic)\napply simp\ndone\n\n\nlemma BlockSwap:\nassumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes bdy: \"\\<forall>s. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' s) bdy {t. return s t \\<in> R s t},{t. return s t \\<in> A}\"\nassumes adapt: \"P \\<subseteq> {s. init s \\<in> P' s}\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\"\nusing adapt bdy c  \n  by (rule Block)\n\n\nlemma BlockSpec:\n  assumes adapt: \"P \\<subseteq> {s. \\<exists>Z. init s \\<in> P' Z \\<and> \n                             (\\<forall>t. t \\<in> Q' Z \\<longrightarrow> return s t \\<in> R s t) \\<and>\n                             (\\<forall>t. t \\<in> A' Z \\<longrightarrow> return s t \\<in> A)}\"\n  assumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n  assumes bdy: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) bdy (Q' Z),(A' Z)\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (block init bdy return c) Q,A\" \napply (rule conseq [where P'=\"\\<lambda>Z. {s. init s \\<in> P' Z \\<and> \n                             (\\<forall>t. t \\<in> Q' Z \\<longrightarrow> return s t \\<in> R s t) \\<and>\n                             (\\<forall>t. t \\<in> A' Z \\<longrightarrow> return s t \\<in> A)}\" and Q'=\"\\<lambda>Z. Q\" and \nA'=\"\\<lambda>Z. A\"])\nprefer 2\nusing adapt\napply  blast\napply (rule allI)\napply (unfold block_def)\napply (rule DynCom)\napply (rule ballI)\napply clarsimp\napply (rule_tac R=\"{t. return s t \\<in> R s t}\" in SeqSwap )\napply  (rule_tac  P'=\"\\<lambda>Z'. {t. t=Z' \\<and> return s t \\<in> R s t}\" and \n          Q'=\"\\<lambda>Z'. Q\" and A'=\"\\<lambda>Z'. A\" in conseq)\nprefer 2 apply simp\napply  (rule allI)\napply  (rule DynCom)\napply  (clarsimp)\napply  (rule SeqSwap)\napply   (rule c [rule_format])\napply  (rule Basic)\napply  clarsimp\napply (rule_tac R=\"{t. return s t \\<in> A}\" in Catch)\napply  (rule_tac R=\"{i. i \\<in> P' Z}\" in Seq)\napply   (rule Basic)\napply   clarsimp\napply  simp\napply  (rule conseq [OF bdy])\napply  clarsimp\napply  blast\napply (rule SeqSwap)\napply  (rule Throw)\napply (rule Basic)\napply simp\ndone\n\nlemma Throw: \"P \\<subseteq> A \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Throw Q,A\"\n  by (rule hoarep.Throw [THEN conseqPre])\n\nlemmas Catch = hoarep.Catch\nlemma CatchSwap: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n  by (rule hoarep.Catch)\n\nlemma raise: \"P \\<subseteq> {s. f s \\<in> A} \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P raise f Q,A\"\n  apply (simp add: raise_def)\n  apply (rule Seq)\n  apply  (rule Basic)\n  apply  (assumption)\n  apply (rule Throw)\n  apply (rule subset_refl)\n  done\n\nlemma condCatch: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\<inter> R) \\<union> (-b \\<inter> A));\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk> \n                  \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n  apply (simp add: condCatch_def)\n  apply (rule Catch)\n  apply  assumption\n  apply (rule CondSwap)\n  apply   (assumption)\n  apply  (rule hoarep.Throw)\n  apply blast\n  done\n\nlemma condCatchSwap: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A;\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,((b \\<inter> R) \\<union> (-b \\<inter> A))\\<rbrakk> \n                  \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>P condCatch c\\<^sub>1 b c\\<^sub>2 Q,A\"\n  by (rule condCatch)\n\n\nlemma ProcSpec:\n  assumes adapt: \"P \\<subseteq> {s. \\<exists>Z. init s \\<in> P' Z \\<and> \n                             (\\<forall>t. t \\<in> Q' Z \\<longrightarrow> return s t \\<in> R s t) \\<and>\n                             (\\<forall>t. t \\<in> A' Z \\<longrightarrow> return s t \\<in> A)}\"\n  assumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n  assumes p: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nusing adapt c p\napply (unfold call_def) \nby (rule BlockSpec)\n\nlemma ProcSpec':\n  assumes adapt: \"P \\<subseteq> {s. \\<exists>Z. init s \\<in> P' Z \\<and> \n                             (\\<forall>t \\<in> Q' Z. return s t \\<in> R s t) \\<and>\n                             (\\<forall>t \\<in> A' Z. return s t \\<in> A)}\"\n  assumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n  assumes p: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),(A' Z)\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\napply (insert adapt)\napply clarsimp\napply (drule (1) subsetD)\napply (clarsimp)\napply (rule_tac x=Z in exI)\napply blast\ndone\n\nlemma ProcSpecNoAbrupt:\n  assumes adapt: \"P \\<subseteq> {s. \\<exists>Z. init s \\<in> P' Z \\<and> \n                             (\\<forall>t. t \\<in> Q' Z \\<longrightarrow> return s t \\<in> R s t)}\"\n  assumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n  assumes p: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) Call p (Q' Z),{}\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (rule ProcSpec [OF _ c p])\nusing adapt\napply simp\ndone\n\nlemma FCall:  \n\"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return (\\<lambda>s t. c (result t))) Q,A\n\\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (fcall init p return result c) Q,A\"\n  by (simp add: fcall_def)\n\n\nlemma ProcRec:\n  assumes deriv_bodies:  \n   \"\\<forall>p\\<in>Procs. \n    \\<forall>Z. \\<Gamma>,\\<Theta>\\<union>(\\<Union>p\\<in>Procs. \\<Union>Z. {(P p Z,p,Q p Z,A p Z)})\n        \\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n  assumes Procs_defined: \"Procs \\<subseteq> dom \\<Gamma>\"\n  shows \"\\<forall>p\\<in>Procs. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n  by (intro strip)\n     (rule CallRec' \n     [OF _   Procs_defined deriv_bodies],\n     simp_all)\n\nlemma ProcRec':\n  assumes ctxt: \"\\<Theta>' = \\<Theta>\\<union>(\\<Union>p\\<in>Procs. \\<Union>Z. {(P p Z,p,Q p Z,A p Z)})\"\n  assumes deriv_bodies:  \n   \"\\<forall>p\\<in>Procs. \\<forall>Z. \\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n  assumes Procs_defined: \"Procs \\<subseteq> dom \\<Gamma>\"\n  shows \"\\<forall>p\\<in>Procs. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n  using ctxt deriv_bodies\n  apply simp\n  apply (erule ProcRec [OF _ Procs_defined])\n  done\n\n\nlemma ProcRecList:\n  assumes deriv_bodies:  \n   \"\\<forall>p\\<in>set Procs. \n    \\<forall>Z. \\<Gamma>,\\<Theta>\\<union>(\\<Union>p\\<in>set Procs. \\<Union>Z. {(P p Z,p,Q p Z,A p Z)})\n        \\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n  assumes dist: \"distinct Procs\"\n  assumes Procs_defined: \"set Procs \\<subseteq> dom \\<Gamma>\"\n  shows \"\\<forall>p\\<in>set Procs. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>(P p Z) Call p (Q p Z),(A p Z)\"\n  using deriv_bodies Procs_defined\n  by (rule ProcRec)\n\nlemma  ProcRecSpecs:\n  \"\\<lbrakk>\\<forall>(P,p,Q,A) \\<in> Specs. \\<Gamma>,\\<Theta>\\<union>Specs\\<turnstile>\\<^bsub>/F\\<^esub> P (the (\\<Gamma> p)) Q,A;\n    \\<forall>(P,p,Q,A) \\<in> Specs. p \\<in> dom \\<Gamma>\\<rbrakk>\n  \\<Longrightarrow> \\<forall>(P,p,Q,A) \\<in> Specs. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\napply (auto intro: CallRec)\ndone\n\n\nlemma ProcRec1:\n  assumes deriv_body:  \n   \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<union>(\\<Union>Z. {(P Z,p,Q Z,A Z)})\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) (the (\\<Gamma> p)) (Q Z),(A Z)\"\n  assumes p_defined: \"p \\<in> dom \\<Gamma>\"\n  shows \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\n  from deriv_body p_defined\n  have \"\\<forall>p\\<in>{p}. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\n    by - (rule ProcRec [where A=\"\\<lambda>p. A\" and P=\"\\<lambda>p. P\" and Q=\"\\<lambda>p. Q\"],\n          simp_all)\n  thus ?thesis\n    by simp\nqed\n\nlemma ProcNoRec1:\n  assumes deriv_body:  \n   \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) (the (\\<Gamma> p)) (Q Z),(A Z)\"\n  assumes p_def: \"p \\<in> dom \\<Gamma>\"\n  shows \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) Call p (Q Z),(A Z)\"\nproof -\nfrom deriv_body\n  have \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<union>(\\<Union>Z. {(P Z,p,Q Z,A Z)})\n             \\<turnstile>\\<^bsub>/F\\<^esub> (P Z) (the (\\<Gamma> p)) (Q Z),(A Z)\"\n    by (blast intro: hoare_augment_context)\n  from this p_def\n  show ?thesis \n    by (rule ProcRec1)\nqed\n\nlemma ProcBody:\n assumes WP: \"P \\<subseteq> P'\"\n assumes deriv_body: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' body Q,A\" \n assumes body: \"\\<Gamma> p = Some body\"\n shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Call p Q,A\"\napply (rule conseqPre [OF _ WP])\napply (rule ProcNoRec1 [rule_format, where P=\"\\<lambda>Z. P'\" and Q=\"\\<lambda>Z. Q\" and A=\"\\<lambda>Z. A\"]) \napply  (insert body)\napply  simp\napply  (rule hoare_augment_context [OF deriv_body])\napply  blast\napply fastforce\ndone\n\nlemma CallBody:\nassumes adapt: \"P \\<subseteq> {s. init s \\<in> P' s}\"\nassumes bdy: \"\\<forall>s. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' s) body {t. return s t \\<in> R s t},{t. return s t \\<in> A}\"\nassumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes body: \"\\<Gamma> p = Some body\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\napply (unfold call_def)\napply (rule Block [OF adapt _ c])\napply (rule allI)\napply (rule ProcBody [where \\<Gamma>=\\<Gamma>, OF _ bdy [rule_format] body])\napply simp\ndone\n\nlemmas ProcModifyReturn = HoarePartialProps.ProcModifyReturn \nlemmas ProcModifyReturnSameFaults = HoarePartialProps.ProcModifyReturnSameFaults\n\nlemma ProcModifyReturnNoAbr:\n  assumes spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n  assumes result_conform:\n      \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes modifies_spec:  \n  \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),{}\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturn [OF spec result_conform _ modifies_spec]) simp\n\nlemma ProcModifyReturnNoAbrSameFaults:\n  assumes spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return' c) Q,A\"\n  assumes result_conform:\n      \"\\<forall>s t. t \\<in> Modif (init s) \\<longrightarrow> (return' s t) = (return s t)\"\n  assumes modifies_spec:  \n  \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} Call p (Modif \\<sigma>),{}\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (call init p return c) Q,A\"\nby (rule ProcModifyReturnSameFaults [OF spec result_conform _ modifies_spec]) simp\n\n\nlemma DynProc: \n  assumes adapt: \"P \\<subseteq> {s. \\<exists>Z. init s \\<in> P' s Z \\<and>\n                          (\\<forall>t. t \\<in> Q' s Z \\<longrightarrow>  return s t \\<in> R s t) \\<and>\n                          (\\<forall>t. t \\<in> A' s Z \\<longrightarrow> return s t \\<in> A)}\"\n  assumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n  assumes p: \"\\<forall>s\\<in> P. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\napply (rule conseq [where P'=\"\\<lambda>Z. {s. s=Z \\<and> s \\<in> P}\"\n  and Q'=\"\\<lambda>Z. Q\" and A'=\"\\<lambda>Z. A\"])\nprefer 2\nusing adapt\napply  blast\napply (rule allI)\napply (unfold dynCall_def call_def block_def)\napply (rule DynCom)\napply clarsimp\napply (rule DynCom)\napply clarsimp\napply (frule in_mono [rule_format, OF adapt])\napply clarsimp\napply (rename_tac Z')\napply (rule_tac R=\"Q' Z Z'\" in Seq)\napply  (rule CatchSwap)\napply   (rule SeqSwap)\napply    (rule Throw) \napply    (rule subset_refl)\napply   (rule Basic)\napply   (rule subset_refl)\napply  (rule_tac R=\"{i. i \\<in> P' Z Z'}\" in Seq)\napply   (rule Basic) \napply   clarsimp\napply  simp\napply  (rule_tac Q'=\"Q' Z Z'\" and A'=\"A' Z Z'\" in conseqPost)\nusing p\napply    clarsimp\napply   simp\napply  clarsimp\napply  (rule_tac  P'=\"\\<lambda>Z''. {t. t=Z'' \\<and> return Z t \\<in> R Z t}\" and \n          Q'=\"\\<lambda>Z''. Q\" and A'=\"\\<lambda>Z''. A\" in conseq)\nprefer 2 apply simp\napply (rule allI)\napply (rule DynCom)\napply clarsimp\napply (rule SeqSwap)\napply  (rule c [rule_format])\napply (rule Basic)\napply clarsimp\ndone\n\nlemma DynProc': \n  assumes adapt: \"P \\<subseteq> {s. \\<exists>Z. init s \\<in> P' s Z \\<and>\n                          (\\<forall>t \\<in> Q' s Z. return s t \\<in> R s t) \\<and>\n                          (\\<forall>t \\<in> A' s Z. return s t \\<in> A)}\"\n  assumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\n  assumes p: \"\\<forall>s\\<in> P. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' s Z) Call (p s) (Q' s Z),(A' s Z)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P dynCall init p return c Q,A\"\nproof -\n  from adapt have \"P \\<subseteq> {s. \\<exists>Z. init s \\<in> P' s Z \\<and>\n                          (\\<forall>t. t \\<in> Q' s Z \\<longrightarrow>  return s t \\<in> R s t) \\<and>\n                          (\\<forall>t. t \\<in> A' s Z \\<longrightarrow> return s t \\<in> A)}\"\n    by blast\n  from this c p show ?thesis\n    by (rule DynProc)\nqed\n\n\nlemma DynProcStaticSpec: \nassumes adapt: \"P \\<subseteq> {s. s \\<in> S \\<and> (\\<exists>Z. init s \\<in> P' Z  \\<and> \n                            (\\<forall>\\<tau>. \\<tau> \\<in> Q' Z \\<longrightarrow> return s \\<tau> \\<in> R s \\<tau>) \\<and>\n                            (\\<forall>\\<tau>. \\<tau> \\<in> A' Z \\<longrightarrow> return s \\<tau> \\<in> A))}\"\nassumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\<forall>s\\<in>S. \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) Call (p s) (Q' Z),(A' Z)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n  from adapt have P_S: \"P \\<subseteq> S\"\n    by blast\n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> S) (dynCall init p return c) Q,A\"\n    apply (rule DynProc [where P'=\"\\<lambda>s Z. P' Z\" and Q'=\"\\<lambda>s Z. Q' Z\" \n                         and A'=\"\\<lambda>s Z. A' Z\", OF _ c])\n    apply  clarsimp\n    apply  (frule in_mono [rule_format, OF adapt])\n    apply  clarsimp\n    using spec\n    apply clarsimp\n    done\n  thus ?thesis\n    by (rule conseqPre) (insert P_S,blast)\nqed\n\n\nlemma DynProcProcPar: \nassumes adapt: \"P \\<subseteq> {s. p s = q \\<and> (\\<exists>Z. init s \\<in> P' Z  \\<and> \n                            (\\<forall>\\<tau>. \\<tau> \\<in> Q' Z \\<longrightarrow> return s \\<tau> \\<in> R s \\<tau>) \\<and>\n                            (\\<forall>\\<tau>. \\<tau> \\<in> A' Z \\<longrightarrow> return s \\<tau> \\<in> A))}\"\nassumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),(A' Z)\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\n  apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF adapt c])\n  using spec\n  apply simp\n  done\n\n\nlemma DynProcProcParNoAbrupt: \nassumes adapt: \"P \\<subseteq> {s. p s = q \\<and> (\\<exists>Z. init s \\<in> P' Z  \\<and> \n                            (\\<forall>\\<tau>. \\<tau> \\<in> Q' Z \\<longrightarrow> return s \\<tau> \\<in> R s \\<tau>))}\"\nassumes c: \"\\<forall>s t. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (R s t) (c s t) Q,A\"\nassumes spec: \"\\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P' Z) Call q (Q' Z),{}\"\nshows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -  \n  have \"P \\<subseteq> {s. p s = q \\<and> (\\<exists> Z. init s \\<in> P' Z \\<and> \n                      (\\<forall>t. t \\<in> Q' Z \\<longrightarrow> return s t \\<in> R s t) \\<and>\n                      (\\<forall>t. t \\<in> {} \\<longrightarrow> return s t \\<in> A))}\"\n    (is \"P \\<subseteq> ?P'\")\n  proof \n    fix s\n    assume P: \"s\\<in>P\"\n    with adapt obtain Z where\n      Pre: \"p s = q \\<and> init s \\<in> P' Z\" and\n      adapt_Norm: \"\\<forall>\\<tau>. \\<tau> \\<in> Q' Z \\<longrightarrow> return s \\<tau> \\<in> R s \\<tau>\" \n      by blast\n    from  adapt_Norm \n    have \"\\<forall>t. t \\<in> Q' Z \\<longrightarrow> return s t \\<in> R s t\"\n      by auto\n    then\n    show \"s\\<in>?P'\"\n      using Pre by blast\n  qed\n  note P = this\n  show ?thesis\n    apply -\n    apply (rule DynProcStaticSpec [where S=\"{s. p s = q}\",simplified, OF P c])\n    apply (insert spec)\n    apply auto\n    done\nqed\n\n\nlemma DynProcModifyReturnNoAbr: \n  assumes to_prove: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n  assumes ret_nrm_modif: \"\\<forall>s t. t \\<in> (Modif (init s)) \n                            \\<longrightarrow> return' s t = return s t\"\n  assumes modif_clause: \n            \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} Call (p s)  (Modif \\<sigma>),{}\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n  from ret_nrm_modif\n  have \"\\<forall>s t. t  \\<in> (Modif (init s)) \n        \\<longrightarrow> return' s t = return s t\"\n    by iprover\n  then \n  have ret_nrm_modif': \"\\<forall>s t. t \\<in> (Modif (init s)) \n                      \\<longrightarrow> return' s t = return s t\"\n    by simp\n  have ret_abr_modif': \"\\<forall>s t. t \\<in> {} \n                        \\<longrightarrow> return' s t = return s t\"\n    by simp\n  from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n    by (rule dynProcModifyReturn)\nqed\n\n\nlemma ProcDynModifyReturnNoAbrSameFaults: \n  assumes to_prove: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return' c) Q,A\"\n  assumes ret_nrm_modif: \"\\<forall>s t. t \\<in> (Modif (init s)) \n                            \\<longrightarrow> return' s t = return s t\"\n  assumes modif_clause: \n            \"\\<forall>s \\<in> P. \\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} (Call (p s)) (Modif \\<sigma>),{}\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n  from ret_nrm_modif\n  have \"\\<forall>s t. t  \\<in> (Modif (init s)) \n        \\<longrightarrow> return' s t = return s t\"\n    by iprover\n  then\n  have ret_nrm_modif': \"\\<forall>s t. t \\<in> (Modif (init s)) \n                      \\<longrightarrow> return' s t = return s t\"\n    by simp\n  have ret_abr_modif': \"\\<forall>s t. t \\<in> {} \n                        \\<longrightarrow> return' s t = return s t\"\n    by simp\n  from to_prove ret_nrm_modif' ret_abr_modif' modif_clause show ?thesis\n    by (rule dynProcModifyReturnSameFaults)\nqed\n\n\nlemma ProcProcParModifyReturn: \n  assumes q: \"P \\<subseteq> {s. p s = q} \\<inter> P'\"\n   --{* @{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in \n         @{term P'}, so the vcg can simplify it. *}\n  assumes to_prove: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n  assumes ret_nrm_modif: \"\\<forall>s t. t \\<in> (Modif (init s)) \n                            \\<longrightarrow> return' s t = return s t\"\n  assumes ret_abr_modif: \"\\<forall>s t. t \\<in> (ModifAbr (init s)) \n                            \\<longrightarrow> return' s t = return s t\"\n  assumes modif_clause: \n          \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} (Call q) (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n  from to_prove have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. p s = q} \\<inter> P') (dynCall init p return' c) Q,A\"\n    by (rule conseqPre) blast\n  from this ret_nrm_modif \n       ret_abr_modif \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. p s = q} \\<inter> P') (dynCall init p return c) Q,A\"\n    by (rule dynProcModifyReturn) (insert modif_clause,auto)\n  from this q show ?thesis\n    by (rule conseqPre) \nqed\n\n\nlemma ProcProcParModifyReturnSameFaults: \n  assumes q: \"P \\<subseteq> {s. p s = q} \\<inter> P'\"\n   --{* @{thm[source] DynProcProcPar} introduces the same constraint as first conjunction in \n         @{term P'}, so the vcg can simplify it. *}\n  assumes to_prove: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n  assumes ret_nrm_modif: \"\\<forall>s t. t \\<in> (Modif (init s)) \n                            \\<longrightarrow> return' s t = return s t\"\n  assumes ret_abr_modif: \"\\<forall>s t. t \\<in> (ModifAbr (init s)) \n                            \\<longrightarrow> return' s t = return s t\"\n  assumes modif_clause: \n          \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} Call q (Modif \\<sigma>),(ModifAbr \\<sigma>)\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n  from to_prove \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. p s = q} \\<inter> P') (dynCall init p return' c) Q,A\"\n    by (rule conseqPre) blast\n  from this ret_nrm_modif \n       ret_abr_modif \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. p s = q} \\<inter> P') (dynCall init p return c) Q,A\"\n    by (rule dynProcModifyReturnSameFaults) (insert modif_clause,auto)\n  from this q show ?thesis\n    by (rule conseqPre) \nqed\n\n\nlemma ProcProcParModifyReturnNoAbr: \n  assumes q: \"P \\<subseteq> {s. p s = q} \\<inter> P'\"\n   --{* @{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as \n      first conjunction in @{term P'}, so the vcg can simplify it. *}\n  assumes to_prove: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n  assumes ret_nrm_modif: \"\\<forall>s t. t \\<in> (Modif (init s)) \n                            \\<longrightarrow> return' s t = return s t\"\n  assumes modif_clause: \n            \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/UNIV\\<^esub> {\\<sigma>} (Call q) (Modif \\<sigma>),{}\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n  from to_prove have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. p s = q} \\<inter> P') (dynCall init p return' c) Q,A\"\n    by (rule conseqPre) blast\n  from this ret_nrm_modif \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. p s = q} \\<inter> P') (dynCall init p return c) Q,A\"\n    by (rule DynProcModifyReturnNoAbr) (insert modif_clause,auto)\n  from this q show ?thesis\n    by (rule conseqPre) \nqed\n\nlemma ProcProcParModifyReturnNoAbrSameFaults: \n  assumes q: \"P \\<subseteq> {s. p s = q} \\<inter> P'\"\n   --{* @{thm[source] DynProcProcParNoAbrupt} introduces the same constraint as \n      first conjunction in @{term P'}, so the vcg can simplify it. *}\n  assumes to_prove: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' (dynCall init p return' c) Q,A\"\n  assumes ret_nrm_modif: \"\\<forall>s t. t \\<in> (Modif (init s)) \n                            \\<longrightarrow> return' s t = return s t\"\n  assumes modif_clause: \n            \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {\\<sigma>} (Call q) (Modif \\<sigma>),{}\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (dynCall init p return c) Q,A\"\nproof -\n  from to_prove have \n    \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. p s = q} \\<inter> P') (dynCall init p return' c) Q,A\"\n    by (rule conseqPre) blast\n  from this ret_nrm_modif \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({s. p s = q} \\<inter> P') (dynCall init p return c) Q,A\"\n    by (rule ProcDynModifyReturnNoAbrSameFaults) (insert modif_clause,auto)\n  from this q show ?thesis\n    by (rule conseqPre) \nqed\n\nlemma MergeGuards_iff: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P merge_guards c Q,A = \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto intro: MergeGuardsI MergeGuardsD)\n\nlemma CombineStrip': \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c' Q,A\"\n  assumes deriv_strip_triv: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n  assumes c'': \"c''= mark_guards False (strip_guards (-F) c')\"\n  assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\nproof -\n  from deriv_strip_triv have deriv_strip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n    by (auto intro: hoare_augment_context)\n  from deriv_strip [simplified c'']\n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P (strip_guards (- F) c') UNIV,UNIV\"\n    by (rule MarkGuardsD)\n  with deriv \n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c' Q,A\"\n    by (rule CombineStrip)\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P mark_guards False c' Q,A\"\n    by (rule MarkGuardsI)\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P merge_guards (mark_guards False c') Q,A\"\n    by (rule MergeGuardsI)\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P merge_guards c Q,A\"\n    by (simp add: c)\n  thus ?thesis\n    by (rule MergeGuardsD)\nqed\n\nlemma CombineStrip'': \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{True}\\<^esub> P c' Q,A\"\n  assumes deriv_strip_triv: \"\\<Gamma>,{}\\<turnstile>\\<^bsub>/{}\\<^esub> P c'' UNIV,UNIV\"\n  assumes c'': \"c''= mark_guards False (strip_guards ({False}) c')\"\n  assumes c: \"merge_guards c = merge_guards (mark_guards False c')\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/{}\\<^esub> P c Q,A\"\n  apply (rule CombineStrip' [OF deriv deriv_strip_triv _ c]) \n  apply (insert c'')\n  apply (subgoal_tac \"- {True} = {False}\")\n  apply auto\n  done\n\nlemma AsmUN:\n  \"(\\<Union>Z. {(P Z, p, Q Z,A Z)}) \\<subseteq> \\<Theta> \n  \\<Longrightarrow> \n  \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) (Call p) (Q Z),(A Z)\"\n  by (blast intro: hoarep.Asm)\n\nlemma augment_context': \n  \"\\<lbrakk>\\<Theta> \\<subseteq> \\<Theta>'; \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P Z)  p (Q Z),(A Z)\\<rbrakk> \n   \\<Longrightarrow> \\<forall>Z. \\<Gamma>,\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n  by (iprover intro: hoare_augment_context)\n\n\nlemma hoarep_strip: \n \"\\<lbrakk>\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z); F' \\<subseteq> -F\\<rbrakk> \\<Longrightarrow> \n    \\<forall>Z. strip F' \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n  by (iprover intro: hoare_strip_\\<Gamma>)\n\nlemma augment_emptyFaults:\n \"\\<lbrakk>\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/{}\\<^esub> (P Z) p (Q Z),(A Z)\\<rbrakk> \\<Longrightarrow> \n    \\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\"\n  by (blast intro: augment_Faults)\n\nlemma augment_FaultsUNIV:\n \"\\<lbrakk>\\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/F\\<^esub> (P Z) p (Q Z),(A Z)\\<rbrakk> \\<Longrightarrow> \n    \\<forall>Z. \\<Gamma>,{}\\<turnstile>\\<^bsub>/UNIV\\<^esub> (P Z) p (Q Z),(A Z)\"\n  by (blast intro: augment_Faults)\n\nlemma PostConjI [trans]:\n  \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c R,B\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\"\n  by (rule PostConjI)\n\nlemma PostConjI' :\n  \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c R,B\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\"\n  by (rule PostConjI) iprover+\n\nlemma PostConjE [consumes 1]: \n  assumes conj: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c (Q \\<inter> R),(A \\<inter> B)\" \n  assumes E: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c R,B\\<rbrakk> \\<Longrightarrow> S\"\n  shows \"S\"\nproof -\n  from conj have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A\" by (rule conseqPost) blast+\n  moreover\n  from conj have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c R,B\" by (rule conseqPost) blast+\n  ultimately show \"S\" \n    by (rule E)\nqed\n\n\nsubsection {* Rules for Single-Step Proof \\label{sec:hoare-isar} *}\n\ntext {*\n We are now ready to introduce a set of Hoare rules to be used in\n single-step structured proofs in Isabelle/Isar.  \n\n \\medskip Assertions of Hoare Logic may be manipulated in\n calculational proofs, with the inclusion expressed in terms of sets\n or predicates.  Reversed order is supported as well.\n*}\n\nlemma annotateI [trans]:\n\"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>P anno Q,A; c = anno\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>P c Q,A\" \n  by simp\n\nlemma annotate_normI:\n  assumes deriv_anno: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>P anno Q,A\" \n  assumes norm_eq: \"normalize c = normalize anno\" \n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>P c Q,A\"\nproof -\n  from NormalizeI [OF deriv_anno] norm_eq\n  have \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F \\<^esub>P normalize c Q,A\"\n    by simp\n  from NormalizeD [OF this]\n  show ?thesis .\nqed\n\nlemma annotateWhile:\n\"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (while gs b c) Q,A\"\n  by (simp add: whileAnnoG_def)\n\n\nlemma reannotateWhile:\n\"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (whileAnnoG gs b I V c) Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (whileAnnoG gs b J V c) Q,A\"\n  by (simp add: whileAnnoG_def)\n\nlemma reannotateWhileNoGuard:\n\"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (whileAnno b I V c) Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (whileAnno b J V c) Q,A\"\n  by (simp add: whileAnno_def)\n\nlemma [trans] : \"P' \\<subseteq> P \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q,A\"\n  by (rule conseqPre)\n \nlemma [trans]: \"Q \\<subseteq> Q' \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P c Q',A\"\n  by (rule conseqPost) blast+\n\nlemma [trans]:\n    \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\<Longrightarrow> (\\<And>s. P' s \\<longrightarrow> P s) \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n  by (rule conseqPre) auto\n\nlemma [trans]:\n    \"(\\<And>s. P' s \\<longrightarrow> P s) \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P s} c Q,A \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P' s} c Q,A\"\n  by (rule conseqPre) auto\n\nlemma [trans]:\n    \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>P c {s. Q s},A \\<Longrightarrow> (\\<And>s. Q s \\<longrightarrow> Q' s) \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>P c {s. Q' s},A\"\n  by (rule conseqPost) auto\n\nlemma [trans]:\n    \"(\\<And>s. Q s \\<longrightarrow> Q' s) \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>P c {s. Q s},A \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub>P c {s. Q' s},A\"\n  by (rule conseqPost) auto\n\nlemma [intro?]: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P Skip P,A\"\n  by (rule Skip) auto\n\nlemma CondInt [trans,intro?]:\n  \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c1 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> - b) c2 Q,A\\<rbrakk>\n   \\<Longrightarrow>\n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (Cond b c1 c2) Q,A\"\n  by (rule Cond) auto\n \nlemma CondConj [trans, intro?]:\n  \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P s \\<and> b s} c1 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P s \\<and> \\<not> b s} c2 Q,A\\<rbrakk>\n   \\<Longrightarrow> \n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P s} (Cond {s. b s} c1 c2) Q,A\"\n  by (rule Cond) auto\n \nlemma WhileInvInt [intro?]:\n    \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (whileAnno b P V c) (P \\<inter> -b),A\"\n  by (rule While) auto\n\nlemma WhileInt [intro?]:\n    \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A \n    \\<Longrightarrow> \n    \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P (whileAnno b {s. undefined} V c) (P \\<inter> -b),A\"\n  by (unfold whileAnno_def) \n     (rule HoarePartialDef.While [THEN conseqPrePost],auto)\n\nlemma WhileInvConj [intro?]:\n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P s \\<and> b s} c {s. P s},A\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P s} (whileAnno {s. b s} {s. P s} V c) {s. P s \\<and> \\<not> b s},A\"\n  by (simp add: While Collect_conj_eq Collect_neg_eq)\n\nlemma WhileConj [intro?]:\n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P s \\<and> b s} c {s. P s},A\n    \\<Longrightarrow> \n\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> {s. P s} (whileAnno {s. b s} {s. undefined} V c) {s. P s \\<and> \\<not> b s},A\"\n  by (unfold whileAnno_def) \n     (simp add: HoarePartialDef.While [THEN conseqPrePost] \n      Collect_conj_eq Collect_neg_eq)\n\n(* FIXME: Add rules for guarded while *)\n\nend", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/ConCSimpl/HoarePartial.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3094690712196819}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Step_Sim_Pres\n  imports Weak_Early_Step_Sim\nbegin\n\nlemma tauPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"\\<tau>.(P) \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> \\<tau>.(Q)\"\nproof(induct rule: simCases)\n  case(Bound a x Q')\n  have \"\\<tau>.(Q) \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n  hence False by(induct rule: tauCases', auto)\n  thus ?case by simp\nnext\n  case(Free \\<alpha> Q')\n  have \"\\<tau>.(Q) \\<longmapsto>(\\<alpha> \\<prec> Q')\" by fact\n  thus ?case\n  proof(induct rule: tauCases', auto simp add: pi.inject residual.inject)\n    have \"\\<tau>.(P) \\<Longrightarrow> \\<tau> \\<prec> P\" by(rule Weak_Early_Step_Semantics.Tau)\n    with PRelQ show \"\\<exists>P'. \\<tau>.(P) \\<Longrightarrow> \\<tau> \\<prec> P' \\<and> (P', Q) \\<in> Rel\" by blast\n  qed\nqed\n\nlemma inputPres:\n  fixes P    :: pi\n  and   x    :: name\n  and   Q    :: pi\n  and   a    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"\\<forall>y. (P[x::=y], Q[x::=y]) \\<in> Rel\"\n  and     Eqvt: \"eqvt Rel\"\n\n  shows \"a<x>.P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> a<x>.Q\"\nusing Eqvt\nproof(induct rule: simCasesCont[where C=\"(x, a, P, Q)\"])\n  case(Bound b y Q')\n  from \\<open>y \\<sharp> (x, a, P, Q)\\<close> have \"y \\<noteq> x\" \"y \\<noteq> a\" \"y \\<sharp> P\" \"y \\<sharp> Q\" by simp+\n  from \\<open>a<x>.Q \\<longmapsto>b<\\<nu>y> \\<prec> Q'\\<close> \\<open>y \\<noteq> a\\<close> \\<open>y \\<noteq> x\\<close> \\<open>y \\<sharp> Q\\<close> show ?case\n    by(erule_tac inputCases') auto\nnext\n  case(Free \\<alpha> Q')\n  from \\<open>a<x>.Q \\<longmapsto> \\<alpha> \\<prec> Q'\\<close>\n  show ?case\n  proof(induct rule: inputCases)\n    case(cInput u)\n    have \"a<x>.P \\<Longrightarrow>(a<u>) \\<prec> (P[x::=u])\"\n      by(rule Weak_Early_Step_Semantics.Input)\n    moreover from PRelQ have \"(P[x::=u], Q[x::=u]) \\<in> Rel\" by auto\n    ultimately show ?case by blast\n  qed\nqed\n\nlemma outputPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"a{b}.P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> a{b}.Q\"\nproof(induct rule: simCases)\n  case(Bound c x Q')\n  have \"a{b}.Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n  hence False by(induct rule: outputCases', auto)\n  thus ?case by simp\nnext\n  case(Free \\<alpha> Q')\n  have \"a{b}.Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus \"\\<exists>P'. a{b}.P \\<Longrightarrow> \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  proof(induct rule: outputCases', auto simp add: pi.inject residual.inject)\n    have \"a{b}.P \\<Longrightarrow> a[b] \\<prec> P\" by(rule Weak_Early_Step_Semantics.Output)\n    with PRelQ show \"\\<exists>P'. a{b}.P \\<Longrightarrow> a[b] \\<prec> P' \\<and> (P', Q) \\<in> Rel\" by blast\n  qed\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"[a\\<frown>b]P \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> [a\\<frown>b]Q\"\nproof(induct rule: simCases)\n  case(Bound c x Q')\n  have \"x \\<sharp> [a\\<frown>b]P\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n  have \"[a\\<frown>b]Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case Match\n    have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>c<\\<nu>x> \\<prec> P'\"\n                                   and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>c<\\<nu>x> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Match)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nnext\n  case(Free \\<alpha> Q')\n  have \"[a\\<frown>b]Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case Match\n    have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>\\<alpha> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Match)\n    with RelRel' PRel show ?case by blast\n  qed\nqed\n\nlemma mismatchPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"[a\\<noteq>b]P \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> [a\\<noteq>b]Q\"\nproof(induct rule: simCases)\n  case(Bound c x Q')\n  have \"x \\<sharp> [a\\<noteq>b]P\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n  have \"[a\\<noteq>b]Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: mismatchCases)\n    case Mismatch\n    have aineqb: \"a \\<noteq> b\" by fact\n    have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>c<\\<nu>x> \\<prec> P'\"\n                                   and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans aineqb have \"[a\\<noteq>b]P \\<Longrightarrow>c<\\<nu>x> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Mismatch)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nnext\n  case(Free \\<alpha> Q')\n  have \"[a\\<noteq>b]Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: mismatchCases)\n    case Mismatch\n    have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans \\<open>a \\<noteq> b\\<close> have \"[a\\<noteq>b]P \\<Longrightarrow>\\<alpha> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Mismatch)\n    with RelRel' PRel show ?case by blast\n  qed\nqed\n\nlemma sumPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n\n  assumes PSimQ: \"P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     C: \"Id \\<subseteq> Rel'\"\n\n  shows \"P \\<oplus> R \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> Q \\<oplus> R\"\nproof(induct rule: simCases)\n  case(Bound a x Q')\n  have \"x \\<sharp> P \\<oplus> R\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n  have \"Q \\<oplus> R \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: sumCases)\n    case Sum1\n    have \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n    with xFreshP PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"P \\<oplus> R \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Sum1)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  next\n    case Sum2\n    from \\<open>R \\<longmapsto>a<\\<nu>x> \\<prec> Q'\\<close> have \"P \\<oplus> R \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by(rule Early_Semantics.Sum2)\n    hence \"P \\<oplus> R \\<Longrightarrow>a<\\<nu>x> \\<prec> Q'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n    moreover from C have \"(Q', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nnext\n  case(Free \\<alpha> Q')\n  have \"Q \\<oplus> R \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: sumCases)\n    case Sum1\n    have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\" \n      by(blast dest: simE)\n    from PTrans have \"P \\<oplus> R \\<Longrightarrow>\\<alpha> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Sum1)\n    with RelRel' PRel show ?case by blast\n  next\n    case Sum2\n    from \\<open>R \\<longmapsto>\\<alpha> \\<prec> Q'\\<close> have \"P \\<oplus> R \\<longmapsto>\\<alpha> \\<prec> Q'\" by(rule Early_Semantics.Sum2)\n    hence \"P \\<oplus> R \\<Longrightarrow>\\<alpha> \\<prec> Q'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n    moreover from C have \"(Q', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nqed\n      \nlemma parPres:\n  fixes P     :: pi\n  and   Q     :: pi\n  and   R     :: pi\n  and   T     :: pi\n  and   Rel   :: \"(pi \\<times> pi) set\"\n  and   Rel'  :: \"(pi \\<times> pi) set\"\n  and   Rel'' :: \"(pi \\<times> pi) set\"\n  \n  assumes PSimQ:    \"P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> Q\"\n  and     PRelQ:    \"(P, Q) \\<in> Rel\"\n  and     Par:      \"\\<And>S T U. (S, T) \\<in> Rel \\<Longrightarrow> (S \\<parallel> U, T \\<parallel> U) \\<in> Rel'\"\n  and     Res:      \"\\<And>S T x. (S, T) \\<in> Rel' \\<Longrightarrow> (<\\<nu>x>S, <\\<nu>x>T) \\<in> Rel'\"\n\n  shows \"P \\<parallel> R \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> Q \\<parallel> R\"\nproof -\n  show ?thesis\n  proof(induct rule: simCases)\n    case(Bound a x Q')\n    have \"x \\<sharp> P \\<parallel> R\" by fact\n    hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n    have \"Q \\<parallel> R \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: parCasesB)\n      case(cPar1 Q')\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n      from xFreshP PSimQ QTrans obtain P' where PTrans:\"P \\<Longrightarrow> a<\\<nu>x> \\<prec> P'\"\n                                            and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow> a<\\<nu>x> \\<prec> (P' \\<parallel> R)\" by(rule Weak_Early_Step_Semantics.Par1B)\n      moreover from P'RelQ' have \"(P' \\<parallel> R, Q' \\<parallel> R) \\<in> Rel'\" by(rule Par)\n      ultimately show ?case by blast\n    next\n      case(cPar2 R')\n      from \\<open>R \\<longmapsto> a<\\<nu>x> \\<prec> R'\\<close> \\<open>x \\<sharp> P\\<close> have \"P \\<parallel> R \\<longmapsto>a<\\<nu>x> \\<prec> (P \\<parallel> R')\"\n        by(rule Early_Semantics.Par2B)\n      hence \"P \\<parallel> R \\<Longrightarrow> a<\\<nu>x> \\<prec> (P \\<parallel> R')\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n      moreover from PRelQ have \"(P \\<parallel> R', Q \\<parallel>  R') \\<in> Rel'\" by(rule Par)\n      ultimately show ?case by blast\n    qed\n  next\n    case(Free \\<alpha> QR')\n    have \"Q \\<parallel> R \\<longmapsto> \\<alpha> \\<prec> QR'\" by fact\n    thus ?case\n    proof(induct rule: parCasesF[of _ _ _ _ _ \"(P, R)\"])\n      case(cPar1 Q')\n      have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n      with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow> \\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans have Trans: \"P \\<parallel> R \\<Longrightarrow> \\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Early_Step_Semantics.Par1F)\n      moreover from PRel have \"(P' \\<parallel> R, Q' \\<parallel> R) \\<in> Rel'\" by(blast intro: Par)\n      ultimately show ?case by blast\n    next\n      case(cPar2 R')\n      from \\<open>R \\<longmapsto>\\<alpha> \\<prec> R'\\<close> have \"P \\<parallel> R \\<longmapsto>\\<alpha> \\<prec> (P \\<parallel> R')\"\n        by(rule Early_Semantics.Par2F)\n      hence \"P \\<parallel> R \\<Longrightarrow>\\<alpha> \\<prec> (P \\<parallel> R')\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n      moreover from PRelQ have \"(P \\<parallel> R', Q \\<parallel>  R') \\<in> Rel'\" by(rule Par)\n      ultimately show ?case by blast\n    next\n      case(cComm1 Q' R' a b)\n      have QTrans: \"Q \\<longmapsto> a<b> \\<prec> Q'\" and RTrans: \"R \\<longmapsto> a[b] \\<prec> R'\" by fact+\n\n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<b> \\<prec> P'\"\n                                    and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from RTrans have \"R \\<Longrightarrow>a[b] \\<prec> R'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n      with PTrans have \"P \\<parallel> R \\<Longrightarrow> \\<tau> \\<prec> P' \\<parallel> R'\" by(rule Weak_Early_Step_Semantics.Comm1)\n      moreover from P'RelQ' have \"(P' \\<parallel> R', Q' \\<parallel> R') \\<in> Rel'\" by(rule Par)\n      ultimately show ?case by blast\n    next\n      case(cComm2 Q' R' a b)\n      have QTrans: \"Q \\<longmapsto>a[b] \\<prec> Q'\" and RTrans: \"R \\<longmapsto>a<b> \\<prec> R'\" by fact+\n      \n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a[b] \\<prec> P'\"\n                                    and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      \n      from RTrans have \"R \\<Longrightarrow>a<b> \\<prec> R'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n      with PTrans have \"P \\<parallel> R \\<Longrightarrow> \\<tau> \\<prec> P' \\<parallel> R'\" by(rule Weak_Early_Step_Semantics.Comm2)\n      moreover from P'RelQ' have \"(P' \\<parallel> R', Q' \\<parallel> R') \\<in> Rel'\" by(rule Par)\n      ultimately show ?case by blast\n    next\n      case(cClose1 Q' R' a x)\n      have QTrans: \"Q \\<longmapsto>a<x> \\<prec> Q'\" and RTrans: \"R \\<longmapsto>a<\\<nu>x> \\<prec> R'\" by fact+\n      have \"x \\<sharp> (P, R)\" by fact\n      hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by(simp add: fresh_prod)+\n      \n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<x> \\<prec> P'\"\n                                    and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      \n      from RTrans have \"R \\<Longrightarrow>a<\\<nu>x> \\<prec> R'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n      with PTrans have Trans: \"P \\<parallel> R \\<Longrightarrow> \\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\" using \\<open>x \\<sharp> P\\<close>\n        by(rule Weak_Early_Step_Semantics.Close1)\n      moreover from P'RelQ' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> R')) \\<in> Rel'\"\n        by(blast intro: Par Res)\n      ultimately show ?case by blast\n    next\n      case(cClose2 Q' R' a x)\n      have QTrans: \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" and RTrans: \"R \\<longmapsto>a<x> \\<prec> R'\" by fact+\n      have \"x \\<sharp> (P, R)\" by fact\n      hence xFreshR: \"x \\<sharp> R\" and xFreshP: \"x \\<sharp> P\" by(simp add: fresh_prod)+\n\n      from PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n                                            and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      \n      from RTrans have \"R \\<Longrightarrow>a<x> \\<prec> R'\" by(rule Weak_Early_Step_Semantics.singleActionChain)\n      with PTrans have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\" using \\<open>x \\<sharp> R\\<close>\n        by(rule Weak_Early_Step_Semantics.Close2)\n      moreover from P'RelQ' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> R')) \\<in> Rel'\"\n        by(blast intro: Par Res)\n      ultimately show ?case by blast\n    qed\n  qed\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> Q\"\n  and     C1: \"\\<And>R S x. (R, S) \\<in> Rel \\<Longrightarrow> (<\\<nu>x>R, <\\<nu>x>S) \\<in> Rel'\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     EqvtRel: \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"<\\<nu>x>P \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> <\\<nu>x>Q\"\nproof -\n  from EqvtRel' show ?thesis\n  proof(induct rule: simCasesCont[of _ \"(P, x)\"])\n    case(Bound a y Q')\n    have Trans: \"<\\<nu>x>Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n    have \"y \\<sharp> (P, x)\" by fact\n    hence yineqx: \"y \\<noteq> x\" and yFreshP: \"y \\<sharp> P\" by(simp add: fresh_prod)+\n    from Trans yineqx show ?case\n    proof(induct rule: resCasesB)\n      case(Open Q')\n      have QTrans: \"Q \\<longmapsto>a[x] \\<prec> Q'\" and aineqx: \"a \\<noteq> x\" by fact+\n\n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a[x] \\<prec> P'\"\n                                    and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n\n      from PTrans aineqx have \"<\\<nu>x>P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Open)\n      hence \"<\\<nu>x>P \\<Longrightarrow>a<\\<nu>y> \\<prec> ([(y, x)] \\<bullet> P')\" using \\<open>y \\<sharp> P\\<close> \\<open>y \\<noteq> x\\<close>\n        by(force simp add: weakTransitionAlpha abs_fresh name_swap)\n\n      moreover from EqvtRel P'RelQ' RelRel' have \"([(y, x)] \\<bullet> P', [(y, x)] \\<bullet> Q') \\<in> Rel'\"\n        by(blast intro: eqvtRelI)\n      ultimately show ?case by blast\n    next\n      case(Res Q')\n      have QTrans: \"Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" and xineqa: \"x \\<noteq> a\" by fact+\n\n      from PSimQ yFreshP QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>y> \\<prec> P'\"\n                                            and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans xineqa yineqx yFreshP have ResTrans: \"<\\<nu>x>P \\<Longrightarrow>a<\\<nu>y> \\<prec> (<\\<nu>x>P')\"\n        by(blast intro: Weak_Early_Step_Semantics.ResB)\n      moreover from P'RelQ' have \"((<\\<nu>x>P'), (<\\<nu>x>Q')) \\<in> Rel'\"\n        by(rule C1)\n      ultimately show ?case by blast\n    qed\n  next\n    case(Free \\<alpha> Q')\n    have QTrans: \"<\\<nu>x>Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    have \"\\<exists>c::name. c \\<sharp> (P, Q, Q', \\<alpha>)\" by(blast intro: name_exists_fresh)\n    then obtain c::name where cFreshQ: \"c \\<sharp> Q\" and cFreshAlpha: \"c \\<sharp> \\<alpha>\" and cFreshQ': \"c \\<sharp> Q'\" and cFreshP: \"c \\<sharp> P\"\n      by(force simp add: fresh_prod)\n    from cFreshP have \"<\\<nu>x>P = <\\<nu>c>([(x, c)] \\<bullet> P)\" by(simp add: alphaRes)\n    moreover have \"\\<exists>P'.<\\<nu>c>([(x, c)] \\<bullet> P) \\<Longrightarrow> \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel'\"\n    proof -\n      from QTrans cFreshQ have \"<\\<nu>c>([(x, c)] \\<bullet> Q) \\<longmapsto>\\<alpha> \\<prec> Q'\" by(simp add: alphaRes)\n      moreover have \"c \\<sharp> \\<alpha>\" by(rule cFreshAlpha)\n      moreover from PSimQ EqvtRel have \"([(x, c)] \\<bullet> P) \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> ([(x, c)] \\<bullet> Q)\"\n        by(blast intro: eqvtI)\n      ultimately show ?thesis\n        apply(induct rule: resCasesF, auto simp add: residual.inject pi.inject name_abs_eq)\n        by(blast intro: Weak_Early_Step_Semantics.ResF C1 dest: simE)\n    qed\n\n    ultimately show ?case by force\n  qed\nqed\n\nlemma resChainI:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   lst :: \"name list\"\n\n  assumes eqvtRel: \"eqvt Rel\"\n  and     Res:     \"\\<And>R S x. (R, S) \\<in> Rel \\<Longrightarrow> (<\\<nu>x>R, <\\<nu>x>S) \\<in> Rel\"\n  and     PRelQ:   \"P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> Q\"\n\n  shows \"(resChain lst) P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> (resChain lst) Q\"\nproof -\n  show ?thesis\n  proof(induct lst) (* Base case *)\n    from PRelQ show \"resChain [] P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> resChain [] Q\" by simp\n  next (* Inductive step *)\n    fix a lst\n    assume IH: \"(resChain lst P) \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> (resChain lst Q)\"\n    moreover from Res have \"\\<And>P Q a. (P, Q) \\<in> Rel \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> Rel\"\n      by simp\n    moreover have \"Rel \\<subseteq> Rel\" by simp\n    ultimately have \"<\\<nu>a>(resChain lst P) \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> <\\<nu>a>(resChain lst Q)\" using eqvtRel\n      by(rule_tac resPres)\n\n    thus \"resChain (a # lst) P \\<leadsto>\\<guillemotleft>Rel\\<guillemotright> resChain (a # lst) Q\"\n      by simp\n  qed\nqed\n\n\n\n  shows \"!P \\<leadsto>\\<guillemotleft>bangRel Rel'\\<guillemotright> !Q\"\nproof -\n  let ?Sim = \"\\<lambda>P Rs. (\\<forall>a x Q'. Rs = a<\\<nu>x> \\<prec> Q' \\<longrightarrow> x \\<sharp> P \\<longrightarrow> (\\<exists>P'. P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> bangRel Rel')) \\<and>\n                     (\\<forall>\\<alpha> Q'. Rs = \\<alpha> \\<prec> Q' \\<longrightarrow> (\\<exists>P'. P \\<Longrightarrow>\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> bangRel Rel'))\"\n  from eqvtRel have EqvtBangRel: \"eqvt(bangRel Rel')\" by(rule eqvtBangRel)\n  from C1 have BRelRel': \"\\<And>P Q. (P, Q) \\<in> bangRel Rel \\<Longrightarrow> (P, Q) \\<in> bangRel Rel'\"\n    by(auto intro: bangRelSubset)\n\n  {\n    fix Pa Rs\n    assume \"!Q \\<longmapsto> Rs\" and \"(Pa, !Q) \\<in> bangRel Rel\"\n    hence \"?Sim Pa Rs\" using PRelQ \n    proof(nominal_induct avoiding: Pa P rule: bangInduct)\n      case(Par1B a x Q' Pa P)\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> Pa\" by fact+\n      thus \"?Sim Pa (a<\\<nu>x> \\<prec> (Q' \\<parallel> !Q))\"\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" by fact\n        have PBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        show ?case \n        proof(auto simp add: residual.inject alpha')\n          from PRelQ have \"P \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> Q\" by(rule Sim)\n\n          with QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n\n          from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>x> \\<prec> (P' \\<parallel> R)\"\n            by(force intro: Weak_Early_Step_Semantics.Par1B)\n          moreover from P'RelQ' PBRQ BRelRel' have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel'\" by(blast intro: Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q' \\<parallel> !Q) \\<in> bangRel Rel'\" by blast\n        next\n          fix y\n          assume \"(y::name) \\<sharp> Q'\" and \"y \\<sharp> P\" and \"y \\<sharp> R\" and \"y \\<sharp> Q\"\n          from QTrans \\<open>y \\<sharp> Q'\\<close> have \"Q \\<longmapsto>a<\\<nu>y> \\<prec> ([(x, y)] \\<bullet> Q')\"\n            by(simp add: alphaBoundOutput)\n          moreover from PRelQ have \"P \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> Q\" by(rule Sim)\n          ultimately obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>y> \\<prec> P'\" and P'RelQ': \"(P', [(x, y)] \\<bullet> Q') \\<in> Rel'\"\n            using \\<open>y \\<sharp> P\\<close>\n            by(blast dest: simE)\n          from PTrans \\<open>y \\<sharp> R\\<close> have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>y> \\<prec> (P' \\<parallel> R)\" by(force intro: Weak_Early_Step_Semantics.Par1B)\n          moreover from P'RelQ' PBRQ BRelRel' have \"(P' \\<parallel> R, ([(x, y)] \\<bullet> Q') \\<parallel> !Q) \\<in> bangRel Rel'\" by(metis Rel.BRPar)\n          with \\<open>x \\<sharp> Q\\<close> \\<open>y \\<sharp> Q\\<close> have \"(P' \\<parallel> R, ([(y, x)] \\<bullet> Q') \\<parallel> !([(y, x)] \\<bullet> Q)) \\<in> bangRel Rel'\"\n            by(simp add: name_fresh_fresh name_swap)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>a<\\<nu>y> \\<prec> P' \\<and> (P', ([(y, x)] \\<bullet> Q') \\<parallel> !([(y, x)] \\<bullet> Q)) \\<in> bangRel Rel'\"\n            by blast\n        qed\n      qed\n    next\n      case(Par1F \\<alpha> Q' Pa P)\n      have QTrans: \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and BR: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<alpha> \\<prec> P'\" and RRel: \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n          \n          from PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Early_Step_Semantics.Par1F)\n          moreover from RRel BR BRelRel' have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel'\" by(metis Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<alpha> \\<prec> P' \\<and> (P', Q' \\<parallel> !Q) \\<in> bangRel Rel'\" by blast\n        qed\n      qed\n    next\n      case(Par2B a x Q' Pa P)\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa (a<\\<nu>x> \\<prec> Q')\" by simp\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> Pa\" by fact+\n      thus \"?Sim Pa (a<\\<nu>x> \\<prec> (Q \\<parallel> Q'))\"\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n\n        from EqvtBangRel show \"?Sim (P \\<parallel> R) (a<\\<nu>x> \\<prec> (Q \\<parallel> Q'))\"\n        proof(auto simp add: residual.inject alpha')\n          from RBRQ have \"?Sim R (a<\\<nu>x> \\<prec> Q')\" by(rule IH)\n          with xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>a<\\<nu>x> \\<prec> R'\" and R'BRQ': \"(R', Q') \\<in> (bangRel Rel')\"\n            by(metis simE)\n          from RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>x> \\<prec> (P \\<parallel> R')\" by(auto intro: Weak_Early_Step_Semantics.Par2B)\n          moreover from PRelQ R'BRQ' C1 have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> (bangRel Rel')\" by(blast dest: Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q \\<parallel> Q') \\<in> bangRel Rel'\" by blast\n        next\n          fix y\n          assume \"(y::name) \\<sharp> Q\" and \"y \\<sharp> Q'\" and \"y \\<sharp> P\" and \"y \\<sharp> R\"\n          from RBRQ have \"?Sim R (a<\\<nu>x> \\<prec> Q')\" by(rule IH)\n          with \\<open>y \\<sharp> Q'\\<close> have \"?Sim R (a<\\<nu>y> \\<prec> ([(x, y)] \\<bullet> Q'))\" by(simp add: alphaBoundOutput)\n          with \\<open>y \\<sharp> R\\<close> obtain R' where RTrans: \"R \\<Longrightarrow>a<\\<nu>y> \\<prec> R'\" and R'BRQ': \"(R', ([(x, y)] \\<bullet> Q')) \\<in> (bangRel Rel')\"\n            by(metis simE)\n          from RTrans \\<open>y \\<sharp> P\\<close> have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>y> \\<prec> (P \\<parallel> R')\" by(auto intro: Weak_Early_Step_Semantics.Par2B)\n          moreover from PRelQ R'BRQ' C1 have \"(P \\<parallel> R', Q \\<parallel> ([(x, y)] \\<bullet> Q')) \\<in> (bangRel Rel')\" by(blast dest: Rel.BRPar)\n          with \\<open>y \\<sharp> Q\\<close> \\<open>x \\<sharp> Q\\<close> have \"(P \\<parallel> R', ([(y, x)] \\<bullet> Q) \\<parallel> ([(y, x)] \\<bullet> Q')) \\<in> (bangRel Rel')\"\n            by(simp add: name_swap name_fresh_fresh)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>a<\\<nu>y> \\<prec> P' \\<and> (P', ([(y, x)] \\<bullet> Q) \\<parallel> ([(y, x)] \\<bullet> Q')) \\<in> bangRel Rel'\" by blast\n        qed\n      qed\n    next\n      case(Par2F \\<alpha> Q' Pa P)\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa (\\<alpha> \\<prec> Q')\" by simp\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from RBRQ IH have \"\\<exists>R'. R \\<Longrightarrow>\\<alpha> \\<prec> R' \\<and> (R', Q') \\<in> bangRel Rel'\"\n            by(metis simE)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>\\<alpha> \\<prec> R'\" and R'RelQ': \"(R', Q') \\<in> bangRel Rel'\"\n            by blast\n\n          from RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<alpha> \\<prec> P \\<parallel> R'\" by(rule Weak_Early_Step_Semantics.Par2F)\n          moreover from PRelQ R'RelQ' C1 have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> bangRel Rel'\" by(blast dest: Rel.BRPar)\n          ultimately show \" \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<alpha> \\<prec> P' \\<and> (P', Q \\<parallel> Q') \\<in> bangRel Rel'\" by blast\n        qed\n      qed\n    next\n      case(Comm1 a Q' b Q'' Pa P)\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa (a[b] \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto>a<b> \\<prec> Q'\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<b> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n          \n          from IH RBRQ have RTrans: \"\\<exists>R'. R \\<Longrightarrow>a[b] \\<prec> R' \\<and> (R', Q'') \\<in> bangRel Rel'\"\n            by(metis simE)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>a[b] \\<prec> R'\" and R'RelQ'': \"(R', Q'') \\<in> bangRel Rel'\"\n            by blast\n          \n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> P' \\<parallel> R'\" by(rule Weak_Early_Step_Semantics.Comm1)\n          moreover from P'RelQ' R'RelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q'') \\<in> bangRel Rel'\" by(rule Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> P' \\<and> (P', Q' \\<parallel> Q'') \\<in> bangRel Rel'\" by blast\n        qed\n      qed\n    next\n      case(Comm2 a b Q' Q'')\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa (a<b> \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto> a[b] \\<prec> Q'\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a[b] \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n\n          from IH RBRQ have RTrans: \"\\<exists>R'. R \\<Longrightarrow>a<b> \\<prec> R' \\<and> (R', Q'') \\<in> bangRel Rel'\"\n            by(metis simE)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>a<b> \\<prec> R'\" and R'RelQ'': \"(R', Q'') \\<in> bangRel Rel'\"\n            by blast\n\n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> P' \\<parallel> R'\" by(rule Weak_Early_Step_Semantics.Comm2)\n          moreover from P'RelQ' R'RelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q'') \\<in> bangRel Rel'\" by(rule Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> P' \\<and> (P', Q' \\<parallel> Q'') \\<in> bangRel Rel'\" by blast\n        qed\n      qed\n    next\n      case(Close1 a x Q' Q'' Pa P)\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<longrightarrow> ?Sim Pa (a<\\<nu>x> \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n      have xFreshQ: \"x \\<sharp> Q\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      moreover have xFreshPa: \"x \\<sharp> Pa\" by fact\n      ultimately show ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>a<x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n             by(blast dest: simE)\n\n           from RBRQ xFreshR IH have \"\\<exists>R'. R \\<Longrightarrow>a<\\<nu>x> \\<prec> R' \\<and> (R', Q'') \\<in> bangRel Rel'\"\n             by(metis simE)\n           then obtain R' where RTrans: \"R \\<Longrightarrow>a<\\<nu>x> \\<prec> R'\" and R'RelQ'': \"(R', Q'') \\<in> bangRel Rel'\"\n             by blast\n\n           from PTrans RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n             by(rule Weak_Early_Step_Semantics.Close1)   \n           moreover from P'RelQ' R'RelQ'' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> bangRel Rel'\"\n             by(force intro: Rel.BRPar BRRes)\n           ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> P' \\<and> (P', <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> bangRel Rel'\" by blast\n         qed\n      qed\n    next\n      case(Close2 a x Q' Q'' Pa P)\n      hence IH: \"\\<And>Pa. (Pa, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa (a<x> \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n      have xFreshQ: \"x \\<sharp> Q\" by fact\n      have \"(Pa, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> Pa\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBRQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto>\\<guillemotleft>Rel'\\<guillemotright> Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n\n          from RBRQ IH have \"\\<exists>R'.  R \\<Longrightarrow>a<x> \\<prec> R' \\<and> (R', Q'') \\<in> bangRel Rel'\"\n            by auto\n          then obtain R' where RTrans: \"R \\<Longrightarrow>a<x> \\<prec> R'\" and R'RelQ'': \"(R', Q'') \\<in> bangRel Rel'\"\n            by blast\n\n          from PTrans RTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n            by(rule Weak_Early_Step_Semantics.Close2)    \n          moreover from P'RelQ' R'RelQ'' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> bangRel Rel'\"\n            by(force intro: Rel.BRPar BRRes)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> P' \\<and> (P', <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> bangRel Rel'\" by blast\n        qed\n      qed\n    next\n      case(Bang Rs Pa P)\n      hence IH: \"\\<And>Pa. (Pa, Q \\<parallel> !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim Pa Rs\" by simp\n      have \"(Pa, !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRBangCases)\n        case(BRBang P)\n        have PRelQ: \"(P, Q) \\<in> Rel\" by fact\n        hence \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n        with PRelQ have \"(P \\<parallel> !P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by(rule BRPar)\n        with IH have \"?Sim (P \\<parallel> !P) Rs\" by simp\n        thus ?case by(force intro: Weak_Early_Step_Semantics.Bang)\n      qed\n    qed\n  }\n\n  moreover from PRelQ have \"(!P, !Q) \\<in> bangRel Rel\" by(rule BRBang) \n  ultimately show ?thesis by(auto simp add: weakStepSimulation_def)\nqed\n(*\nlemma bangPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n \n  assumes PRelQ:      \"(P, Q) \\<in> Rel\"\n  and     Sim:        \"\\<And>P Q. (P, Q) \\<in> Rel \\<Longrightarrow> P \\<leadsto><Rel'> Q\"\n  and     RelRel':    \"\\<And>P Q. (P, Q) \\<in> Rel \\<Longrightarrow> (P, Q) \\<in> Rel'\"\n  and     eqvtRel':   \"eqvt Rel'\"\n\n  shows \"!P \\<leadsto><bangRel Rel'> !Q\"\nproof -\n  from eqvtRel' have EqvtBangRel': \"eqvt (bangRel Rel')\" by(rule eqvtBangRel)\n  from RelRel' have BRelRel': \"\\<And>P Q. (P, Q) \\<in> bangRel Rel \\<Longrightarrow> (P, Q) \\<in> bangRel Rel'\"\n    by(auto intro: bangRelSubset)\n  have \"\\<And>Rs P. \\<lbrakk>!Q \\<longmapsto> Rs; (P, !Q) \\<in> bangRel Rel\\<rbrakk> \\<Longrightarrow> weakSimStepAct P Rs P (bangRel Rel')\"\n  proof -\n    fix Rs P\n    assume \"!Q \\<longmapsto> Rs\" and \"(P, !Q) \\<in> bangRel Rel\"\n    thus \"weakSimStepAct P Rs P (bangRel Rel')\"\n    proof(nominal_induct avoiding: P rule: bangInduct)\n      case(Par1B a x Q')\n      have QTrans: \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" and xFreshQ: \"x \\<sharp> Q\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelT: \"(R, !Q) \\<in> bangRel Rel\" by fact\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        from PRelQ have PSimQ: \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n        from EqvtBangRel' show ?case\n        proof(induct rule: simActBoundCases)\n          case BoundOutput\n          with PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n                                                and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n          from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>x>\\<prec> (P' \\<parallel> R)\"\n            by(rule Weak_Early_Step_Semantics.Par1B)\n          moreover from P'RelQ' RBangRelT have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel'\"\n            by(blast intro: Rel.BRPar BRelRel')\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(Par1F \\<alpha> Q' P)\n      have QTrans: \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n\n          from PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Early_Step_Semantics.Par1F)\n          moreover from P'RelQ' RBangRelQ have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel'\"\n            by(blast intro: Rel.BRPar BRelRel')\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(Par2B a x Q' P)\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimStepAct P (a<\\<nu>x> \\<prec> Q') P (bangRel Rel')\" by fact\n      have xFreshQ: \"x \\<sharp> Q\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        from EqvtBangRel' show ?case\n        proof(induct rule: simActBoundCases)\n          case BoundOutput\n          with IH RBangRelQ have \"weakSimStepAct R (a<\\<nu>x> \\<prec> Q') R (bangRel Rel')\" by blast\n          with xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>a<\\<nu>x> \\<prec> R'\"\n                                   and R'BangRelQ': \"(R', Q') \\<in> bangRel Rel'\"\n            by(simp add: weakSimStepAct_def, blast)\n          \n          from RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>x> \\<prec> (P \\<parallel> R')\"\n            by(auto intro: Weak_Early_Step_Semantics.Par2B)\n          moreover from PRelQ R'BangRelQ' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> (bangRel Rel')\"\n            by(blast intro: Rel.BRPar RelRel')\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(Par2F \\<alpha> Q' P)\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimStepAct P (\\<alpha> \\<prec> Q') P (bangRel Rel')\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from RBangRelQ have \"weakSimStepAct R (\\<alpha> \\<prec> Q') R (bangRel Rel')\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>\\<alpha> \\<prec> R'\" and R'RelQ': \"(R', Q') \\<in> (bangRel Rel')\"\n            by(simp add: weakSimStepAct_def, blast)\n\n          from RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<alpha> \\<prec> P \\<parallel> R'\" by(rule Weak_Early_Step_Semantics.Par2F)\n          moreover from PRelQ R'RelQ' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> (bangRel Rel')\" \n            by(blast intro: Rel.BRPar RelRel')\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(Comm1 a Q' b Q'' P)\n      have QTrans: \"Q \\<longmapsto> a<b> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimStepAct P (a[b] \\<prec> Q'') P (bangRel Rel')\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<b> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n\n          from RBangRelQ have \"weakSimStepAct R (a[b] \\<prec> Q'') R (bangRel Rel')\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>a[b] \\<prec> R'\"\n                           and R'RelQ'': \"(R', Q'') \\<in> (bangRel Rel')\"\n            by(simp add: weakSimStepAct_def, blast)\n        \n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> (P' \\<parallel> R')\"\n            by(rule Weak_Early_Step_Semantics.Comm1)\n          moreover from P'RelQ' R'RelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q'') \\<in> (bangRel Rel')\"\n            by(rule Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(Comm2 a b Q' Q'' P)\n      have QTrans: \"Q \\<longmapsto>a[b] \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimStepAct P (a<b> \\<prec> Q'') P (bangRel Rel')\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a[b] \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n\n          from RBangRelQ have \"weakSimStepAct R (a<b> \\<prec> Q'') R (bangRel Rel')\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>a<b> \\<prec> R'\" and R'BangRelQ'': \"(R', Q'') \\<in> (bangRel Rel')\"\n            by(simp add: weakSimStepAct_def, blast)\n        \n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> (P' \\<parallel> R')\"\n            by(rule Weak_Early_Step_Semantics.Comm2)\n          moreover from P'RelQ' R'BangRelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q'') \\<in> (bangRel Rel')\"\n            by(rule Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(Close1 a x Q' Q'' P)\n      have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimStepAct P (a<\\<nu>x> \\<prec> Q'') P (bangRel Rel')\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshR: \"x \\<sharp> R\" and xFreshP: \"x \\<sharp> P\" by simp+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n          \n          from RBangRelQ have \"weakSimStepAct R (a<\\<nu>x> \\<prec> Q'') R (bangRel Rel')\" by(rule IH)\n          with xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>a<\\<nu>x> \\<prec> R'\"\n                                   and R'RelQ'': \"(R', Q'') \\<in> (bangRel Rel')\"\n            by(simp add: weakSimStepAct_def, blast)\n        \n          from PTrans RTrans xFreshP xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n            by(rule Weak_Early_Step_Semantics.Close1)\n          moreover from P'RelQ' R'RelQ'' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> (bangRel Rel')\"\n            by(force intro: Rel.BRPar Rel.BRRes)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(Close2 a x Q' Q'' P)\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimStepAct P (a<x> \\<prec> Q'') P (bangRel Rel')\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from PRelQ have \"P \\<leadsto><Rel'> Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n                                          and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n\n          from RBangRelQ have \"weakSimStepAct R (a<x> \\<prec> Q'') R (bangRel Rel')\" by(rule IH)\n          with xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>a<x> \\<prec> R'\"\n                                       and R'RelQ'': \"(R', Q'') \\<in> (bangRel Rel')\"\n            by(simp add: weakSimStepAct_def, blast)\n        \n          from PTrans RTrans xFreshP xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n            by(rule Weak_Early_Step_Semantics.Close2)\n          moreover from P'RelQ' R'RelQ'' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> (bangRel Rel')\"\n            by(force intro: Rel.BRPar Rel.BRRes)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(Bang Rs)\n      have IH: \"\\<And>P. (P, Q \\<parallel> !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimStepAct P Rs P (bangRel Rel')\" by fact\n      have \"(P, !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRBangCases)\n        case(BRBang P)\n        have PRelQ: \"(P, Q) \\<in> Rel\" by fact\n        hence \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n        with PRelQ have \"(P \\<parallel> !P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by(rule Rel.BRPar)\n        hence \"weakSimStepAct (P \\<parallel> !P) Rs (P \\<parallel> !P) (bangRel Rel')\" by(rule IH)\n        thus ?case\n        proof(simp (no_asm) add: weakSimStepAct_def, auto)\n          fix Q' a x\n          assume \"weakSimStepAct (P \\<parallel> !P) (a<\\<nu>x> \\<prec> Q') (P \\<parallel> !P) (bangRel Rel')\" and \"x \\<sharp> P\"\n          then obtain P' where PTrans: \"(P \\<parallel> !P) \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n                           and P'RelQ': \"(P', Q') \\<in> (bangRel Rel')\"\n            by(simp add: weakSimStepAct_def, blast)\n          from PTrans have \"!P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n            by(force intro: Weak_Early_Step_Semantics.Bang simp add: weakTransition_def)\n          with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> (bangRel Rel')\" by blast\n        next\n          fix Q' \\<alpha>\n          assume \"weakSimStepAct (P \\<parallel> !P) (\\<alpha> \\<prec> Q') (P \\<parallel> !P) (bangRel Rel')\"\n          then obtain P' where PTrans: \"(P \\<parallel> !P) \\<Longrightarrow>\\<alpha> \\<prec> P'\"\n                           and P'RelQ': \"(P', Q') \\<in> (bangRel Rel')\"\n            by(simp add: weakSimStepAct_def, blast)\n          from PTrans have \"!P \\<Longrightarrow>\\<alpha> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Bang)\n          with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> (bangRel Rel')\" by blast\n        qed\n      qed\n    qed\n  qed\n  moreover from PRelQ have \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n  ultimately show ?thesis by(simp add: simDef)\nqed\n*)\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Early_Step_Sim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.30946907121968187}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory SubMonadLib\nimports\n  EmptyFailLib\n  Corres_UL\nbegin\n\nlocale submonad_args =\n  fixes fetch :: \"'a \\<Rightarrow> 'b\"\n  fixes replace :: \"'b \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  fixes guard :: \"'a \\<Rightarrow> bool\"\n\n  assumes args:\n   \"\\<forall>x s. guard s \\<longrightarrow> fetch (replace x s) = x\"\n   \"\\<forall>x y s. replace x (replace y s) = replace x s\"\n   \"\\<forall>s. replace (fetch s) s = s\"\n\n  assumes replace_preserves_guard:\n   \"\\<And>s x. guard (replace x s) = guard s\"\n\ndefinition\n  submonad_fn :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow>\n                  ('b, 'c) nondet_monad \\<Rightarrow> ('a, 'c) nondet_monad\"\nwhere\n \"submonad_fn fetch replace guard m \\<equiv> do\n    stateAssert guard [];\n    substate \\<leftarrow> gets fetch;\n    (rv, substate') \\<leftarrow> select_f (m substate);\n    modify (replace substate');\n    return rv\n  od\"\n\nlocale submonad = submonad_args +\n  fixes fn :: \"('b, 'c) nondet_monad \\<Rightarrow> ('a, 'c) nondet_monad\"\n\n  assumes fn_is_sm: \"fn = submonad_fn fetch replace guard\"\n\nlemma (in submonad_args) argsD1:\n  \"\\<And>x s. guard s \\<Longrightarrow> fetch (replace x s) = x\"\n  by (simp add: args)\n\nlemma (in submonad) guarded_sm:\n  \"\\<And>s. guard s \\<Longrightarrow>\n   fn m s = (do\n     substate \\<leftarrow> gets fetch;\n     (rv, substate') \\<leftarrow> select_f (m substate);\n     modify (replace substate');\n     return rv\n   od) s\"\n  unfolding fn_is_sm submonad_fn_def\n  by (simp add: stateAssert_def get_def assert_def bind_def return_def)\n\nlemma modify_modify:\n  \"modify fn1 >>= (\\<lambda>x. modify fn2) = modify (fn2 \\<circ> fn1)\"\n  by (simp add: bind_def modify_def get_def put_def)\n\nlemma select_f_walk:\n  assumes m1: \"empty_fail m1\" \n  assumes S: \"fst S = {} \\<Longrightarrow> snd S\"\n  shows \"(do a \\<leftarrow> m1; b \\<leftarrow> select_f S; m2 a b od) = (do b \\<leftarrow> select_f S; a \\<leftarrow> m1; m2 a b od)\"\n  apply (rule ext)\n  apply (rule prod.expand)\n  apply (rule conjI)\n   apply (simp add: select_f_def bind_def split_def)\n   apply fastforce\n  apply (simp add: select_f_def bind_def split_def)\n  apply (case_tac \"fst S = {}\")   \n   apply clarsimp\n   apply (case_tac \"fst (m1 x) = {}\")\n    apply (simp add: empty_failD [OF m1] S)\n   apply (frule S)\n   apply force\n  apply safe\n     apply clarsimp\n     apply force\n    apply force\n   apply clarsimp\n   apply force\n  apply clarsimp\n  apply (case_tac \"fst (m1 x) = {}\", simp add: empty_failD [OF m1])\n  apply force\n  done\n\nlemma stateAssert_stateAssert:\n  \"(stateAssert g [] >>= (\\<lambda>u. stateAssert g' [])) = stateAssert (g and g') []\"\n  by (simp add: ext stateAssert_def bind_def get_def assert_def fail_def return_def)\n\nlemma modify_stateAssert:\n  \"\\<lbrakk> \\<And>s x. g (r x s) = g s \\<rbrakk> \\<Longrightarrow>\n   (modify (r x) >>= (\\<lambda>u. stateAssert g []))\n            = (stateAssert g [] >>= (\\<lambda>u. modify (r x)))\"\n  by (simp add: ext stateAssert_def bind_def get_def assert_def fail_def\n                return_def modify_def put_def)\n\nlemma gets_stateAssert:\n  \"(gets f >>= (\\<lambda>x. stateAssert g' [] >>= (\\<lambda>u. m x)))\n            = (stateAssert g' [] >>= (\\<lambda>u. gets f >>= (\\<lambda>x. m x)))\"\n  by (simp add: ext stateAssert_def bind_def gets_def get_def\n                assert_def fail_def return_def)\n\nlemma select_f_stateAssert:\n  \"empty_fail m \\<Longrightarrow>\n   (select_f (m a) >>= (\\<lambda>x. stateAssert g [] >>= (\\<lambda>u. n x))) =\n   (stateAssert g [] >>= (\\<lambda>u. select_f (m a) >>= (\\<lambda>x. n x)))\"\n  apply (rule ext)\n  apply (clarsimp simp: stateAssert_def bind_def select_f_def get_def\n                        assert_def return_def fail_def split_def image_image)\n  apply (simp only: image_def)\n  apply (clarsimp simp: stateAssert_def bind_def select_f_def get_def\n                        assert_def return_def fail_def split_def image_image)\n  apply (simp only: image_def mem_simps empty_fail_def simp_thms)  \n  apply fastforce\n  done\n\nlemma bind_select_f_bind':\n  shows \"(select_f (m s) >>= (\\<lambda>x. select_f (split n x))) = (select_f ((m >>= n) s))\"\n  apply (rule ext)\n  apply (force simp: select_f_def bind_def split_def)\n  done\n\nlemma bind_select_f_bind:\n  \"(select_f (m1 s) >>= (\\<lambda>x. select_f (m2 (fst x) (snd x)))) = (select_f ((m1 >>= m2) s))\"\n  by (insert bind_select_f_bind' [where m=m1 and n=m2 and s=s],\n      simp add: split_def)\n\nlemma select_from_gets: \"select_f (gets f s) = return (f s, s)\"\n  apply (rule ext)\n  apply (simp add: select_f_def return_def simpler_gets_def)\n  done\n\nlemma select_from_gets':\n  \"(select_f \\<circ> gets f) = (\\<lambda>s. return (f s, s))\"\n  apply (rule ext)\n  apply (simp add: o_def select_from_gets)\n  done\n\nlemma bind_subst_lift:\n  \"(f >>= g) = h \\<Longrightarrow> (do x \\<leftarrow> f; y \\<leftarrow> g x; j y od) = (h >>= j)\"\n  by (simp add: bind_assoc[symmetric])\n\nlemma modify_gets:\n  \"\\<lbrakk> \\<And>x s. g (r x s) = g s; \\<And>x s. g s \\<longrightarrow> f (r x s) = x \\<rbrakk>\n   \\<Longrightarrow> (modify (r x) >>= (\\<lambda>u. stateAssert g [] >>= (\\<lambda>u'. gets f)))\n            = (stateAssert g [] >>= (\\<lambda>u'. modify (r x) >>= (\\<lambda>u. return x)))\"\n  by (simp add: ext stateAssert_def assert_def modify_def bind_def get_def\n                put_def gets_def return_def fail_def)\n\nlemma (in submonad_args) gets_modify:\n  \"\\<And>s. guard s \\<Longrightarrow>\n   (do x \\<leftarrow> gets fetch; u \\<leftarrow> modify (replace x); f x od) s = ((gets fetch) >>= f) s\"\n  by (clarsimp simp: modify_def gets_def return_def bind_def\n                     put_def args get_def\n              split: option.split)\n\nlemma submonad_bind:\n  \"\\<lbrakk> submonad f r g m; submonad f r g m'; submonad f r g m'';\n     empty_fail a; \\<And>x. empty_fail (b x) \\<rbrakk> \\<Longrightarrow>\n   m (a >>= b) = (m' a) >>= (\\<lambda>rv. m'' (b rv))\"\n  apply (subst submonad.fn_is_sm, assumption)+\n  apply (clarsimp simp: submonad_def bind_assoc split_def submonad_fn_def)\n  apply (subst bind_subst_lift [OF modify_gets, unfolded bind_assoc])\n    apply (simp add: submonad_args.args submonad_args.replace_preserves_guard)+\n  apply (subst select_f_stateAssert, assumption)\n  apply (subst gets_stateAssert)\n  apply (subst bind_subst_lift [OF stateAssert_stateAssert])\n  apply (clarsimp simp: pred_conj_def)\n  apply (clarsimp simp: bind_assoc split_def select_f_walk\n                empty_fail_stateAssert empty_failD\n                bind_subst_lift[OF modify_modify] submonad_args.args o_def\n                bind_subst_lift[OF bind_select_f_bind])\n  done\n\nlemma (in submonad) guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> (rv, s') \\<in> fst (fn m s) \\<rbrakk> \\<Longrightarrow> guard s'\"\n  unfolding fn_is_sm submonad_fn_def\n  by (clarsimp simp: stateAssert_def gets_def get_def bind_def modify_def put_def\n                     return_def select_f_def replace_preserves_guard in_monad)\n\nlemma fst_stateAssertD:\n  \"\\<And>s s' v. (v, s') \\<in> fst (stateAssert g [] s) \\<Longrightarrow> s' = s \\<and> g s\"\n  by (clarsimp simp: stateAssert_def in_monad)\n\nlemma(in submonad) guarded_gets:\n  \"\\<And>s. guard s \\<Longrightarrow> fn (gets f) s = gets (f \\<circ> fetch) s\"\n  apply (simp add: guarded_sm select_from_gets gets_modify)\n  apply (simp add: gets_def)\n  done\n\nlemma (in submonad) guarded_return:\n  \"\\<And>s. guard s \\<Longrightarrow> fn (return x) s = return x s\"\n  using args guarded_gets\n  by (fastforce simp: gets_def bind_def get_def)\n\nlemma (in submonad_args) submonad_fn_gets:\n  \"submonad_fn fetch replace guard (gets f) =\n   (stateAssert guard [] >>= (\\<lambda>u. gets (f \\<circ> fetch)))\"\n  apply (simp add: ext select_from_gets submonad_fn_def)\n  apply (rule bind_cong [OF refl])\n  apply (clarsimp simp: gets_modify dest!: fst_stateAssertD)\n  apply (simp add: gets_def)\n  done\n\nlemma(in submonad) gets:\n  \"fn (gets f) = (stateAssert guard [] >>= (\\<lambda>u. gets (f \\<circ> fetch)))\"\n  unfolding fn_is_sm submonad_fn_gets\n  by (rule refl)\n\nlemma (in submonad) return:\n  \"fn (return x) = (stateAssert guard [] >>= (\\<lambda>u. return x))\"\n  using args gets\n  by (fastforce simp: gets_def bind_def get_def)\n\nlemma (in submonad) mapM_guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> guard s; \\<exists>rv. (rv, s') \\<in> fst (mapM (fn \\<circ> m) xs s)\\<rbrakk> \\<Longrightarrow> guard s'\"\nproof (induct xs)\n  case Nil\n  thus ?case\n    by (simp add: mapM_def sequence_def return_def)\n  next\n  case (Cons x xs)\n  thus ?case \n    apply (clarsimp simp: o_def mapM_Cons return_def bind_def)\n    apply (drule guard_preserved)\n    apply fastforce\n    done\nqed\n\nlemma (in submonad) mapM_x_guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> guard s; \\<exists>rv. (rv, s') \\<in> fst (mapM_x (fn \\<circ> m) xs s)\\<rbrakk> \\<Longrightarrow> guard s'\"\nproof (induct xs)\n  case Nil\n  thus ?case\n    by (simp add: mapM_x_def sequence_x_def return_def)\n  next\n  case (Cons x xs)\n  thus ?case \n    apply (clarsimp simp: o_def mapM_x_Cons return_def bind_def)\n    apply (drule guard_preserved)\n    apply fastforce\n    done\nqed\n\nlemma (in submonad) stateAssert_fn:\n  \"stateAssert guard [] >>= (\\<lambda>u. fn m) = fn m\"\n  by (simp add: fn_is_sm submonad_fn_def pred_conj_def\n                bind_subst_lift [OF stateAssert_stateAssert])\n\nlemma (in submonad) fn_stateAssert:\n  \"fn m >>= (\\<lambda>x. stateAssert guard [] >>= (\\<lambda>u. n x)) = (fn m >>= n)\"\n  apply (simp add: fn_is_sm submonad_fn_def bind_assoc split_def)\n  apply (rule ext)\n  apply (rule bind_apply_cong [OF refl])+\n  apply (clarsimp simp: stateAssert_def bind_assoc in_monad select_f_def) \n  apply (drule iffD2 [OF replace_preserves_guard])\n  apply (fastforce simp: bind_def assert_def get_def return_def)\n  done\n\nlemma submonad_mapM:\n  assumes sm: \"submonad f r g sm\" and sm': \"submonad f r g sm'\"\n  assumes efm: \"\\<And>x. empty_fail (m x)\"\n  shows\n  \"(sm (mapM m l)) = (stateAssert g [] >>= (\\<lambda>u. mapM (sm' \\<circ> m) l))\" \nproof (induct l)\n  case Nil\n  thus ?case\n    by (simp add: mapM_def sequence_def bind_def submonad.return [OF sm])\n  next\n  case (Cons x xs)\n  thus ?case\n    using sm sm' efm\n    apply (simp add: mapM_Cons)\n    apply (simp add: bind_subst_lift [OF submonad.stateAssert_fn])\n    apply (simp add: bind_assoc submonad_bind submonad.return)\n    apply (subst submonad.fn_stateAssert [OF sm'])\n    apply (intro ext bind_apply_cong [OF refl])\n    apply (subgoal_tac \"g sta\")\n     apply (clarsimp simp: stateAssert_def bind_def get_def assert_def return_def)\n    apply (frule(1) submonad.guard_preserved)\n    apply (erule(1) submonad.mapM_guard_preserved, fastforce simp: o_def)\n    done\nqed\n\nlemma submonad_mapM_x:\n  assumes sm: \"submonad f r g sm\" and sm': \"submonad f r g sm'\"\n  assumes efm: \"\\<And>x. empty_fail (m x)\"\n  shows\n  \"(sm (mapM_x m l)) = (stateAssert g [] >>= (\\<lambda>u. mapM_x (sm' \\<circ> m) l))\" \nproof (induct l)\n  case Nil\n  thus ?case\n    by (simp add: mapM_x_def sequence_x_def bind_def submonad.return [OF sm])\n  next\n  case (Cons x xs)\n  thus ?case\n    using sm sm' efm\n    apply (simp add: mapM_x_Cons)\n    apply (simp add: bind_subst_lift [OF submonad.stateAssert_fn])\n    apply (simp add: bind_assoc submonad_bind submonad.return)\n    apply (subst submonad.fn_stateAssert [OF sm'])\n    apply (intro ext bind_apply_cong [OF refl])\n    apply (subgoal_tac \"g st\")\n     apply (clarsimp simp: stateAssert_def bind_def get_def assert_def return_def)\n    apply (frule(1) submonad.guard_preserved, simp)\n    done\nqed\n\nlemma corres_select:\n  \"(\\<forall>s' \\<in> S'. \\<exists>s \\<in> S. rvr s s') \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select S) (select S')\"\n  by (clarsimp simp: select_def corres_underlying_def)\n\nlemma corres_select_f:\n  \"\\<lbrakk> \\<forall>s' \\<in> fst S'. \\<exists>s \\<in> fst S. rvr s s'; nf' \\<Longrightarrow> \\<not> snd S' \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select_f S) (select_f S')\"\n  by (clarsimp simp: select_f_def corres_underlying_def)\n\nlemma corres_modify':\n  \"\\<lbrakk> (\\<forall>s s'. (s, s') \\<in> sr \\<longrightarrow> (f s, f' s') \\<in> sr); r () () \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' r \\<top> \\<top> (modify f) (modify f')\"\n  by (clarsimp simp: modify_def corres_underlying_def bind_def get_def put_def)\n\n(* FIXME: this should only be used for the lemma below *)\nlemma corres_select_f_stronger:\n  \"\\<lbrakk> \\<forall>s' \\<in> fst S'. \\<exists>s \\<in> fst S. rvr s s'; nf' \\<Longrightarrow> \\<not> snd S' \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select_f S) (select_f S')\"\n  by (clarsimp simp: select_f_def corres_underlying_def)\n\nlemma stateAssert_sp:\n  \"\\<lbrace>P\\<rbrace> stateAssert Q l \\<lbrace>\\<lambda>_. P and Q\\<rbrace>\"\n  by (clarsimp simp: valid_def stateAssert_def in_monad)\n\nlemma corres_submonad:\n  \"\\<lbrakk> submonad f r g fn; submonad f' r' g' fn';\n     \\<forall>s s'. (s, s') \\<in> sr \\<and> g s \\<and> g' s' \\<longrightarrow> (f s, f' s') \\<in> ssr;\n     \\<forall>s s' ss ss'. ((s, s') \\<in> sr \\<and> (ss, ss') \\<in> ssr) \\<longrightarrow> (r ss s, r' ss' s') \\<in> sr;\n     corres_underlying ssr False nf' rvr \\<top> \\<top> x x'\\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr False nf' rvr g g' (fn x) (fn' x')\"\n  apply (subst submonad.fn_is_sm, assumption)+\n  apply (clarsimp simp: submonad_fn_def)\n  apply (rule corres_split' [OF _ _ stateAssert_sp stateAssert_sp])\n   apply (fastforce simp: corres_underlying_def stateAssert_def get_def\n                         assert_def return_def bind_def)\n  apply (rule corres_split' [where r'=\"\\<lambda>x y. (x, y) \\<in> ssr\",\n                             OF _ _ hoare_post_taut hoare_post_taut])\n   apply clarsimp\n  apply (rule corres_split' [where r'=\"\\<lambda>(x, x') (y, y'). rvr x y \\<and> (x', y') \\<in> ssr\",\n                             OF _ _ hoare_post_taut hoare_post_taut])\n   defer\n   apply clarsimp\n   apply (rule corres_split' [where r'=dc, OF _ _ hoare_post_taut hoare_post_taut])\n    apply (simp add: corres_modify')\n   apply clarsimp\n  apply (rule corres_select_f_stronger)\n   apply (clarsimp simp: corres_underlying_def)\n   apply (drule (1) bspec, clarsimp)\n   apply (drule (1) bspec, simp)\n   apply blast\n  apply (clarsimp simp: corres_underlying_def)\n  apply (drule (1) bspec, clarsimp)\n  done\n\nlemma stateAssert_top [simp]:\n  \"stateAssert \\<top> l >>= f = f ()\"\n  by (clarsimp simp add: stateAssert_def get_def bind_def return_def)\n\nlemma stateAssert_A_top [simp]:\n  \"stateAssert \\<top> l = return ()\"\n  by (simp add: stateAssert_def get_def bind_def return_def)\n\ntext {* Use of the submonad concept to demonstrate commutativity. *}\n\nlemma gets_modify_comm:\n  \"\\<And> s. \\<lbrakk> g (f s) = g s \\<rbrakk> \\<Longrightarrow>\n   (do x \\<leftarrow> modify f; y \\<leftarrow> gets g; m x y od) s =\n   (do y \\<leftarrow> gets g; x \\<leftarrow> modify f; m x y od) s\"\n  by (simp add: modify_def gets_def get_def bind_def put_def return_def)\n\nlemma bind_subst_lhs_inv:\n  \"\\<And>s. \\<lbrakk> \\<And>x s'. P s' \\<Longrightarrow> (f x >>= g x) s' = h x s'; \\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>_. P\\<rbrace>; P s \\<rbrakk> \\<Longrightarrow>\n   (do x \\<leftarrow> a; y \\<leftarrow> f x; g x y od) s = (a >>= h) s\"\n  apply (rule bind_apply_cong [OF refl])\n  apply (drule(2) use_valid)\n  apply simp\n  done\n\nlemma gets_comm:\n  \"do x \\<leftarrow> gets f; y \\<leftarrow> gets g; m x y od = do y \\<leftarrow> gets g; x \\<leftarrow> gets f; m x y od\"\n  by (simp add: gets_def get_def return_def bind_def)\n\nlemma submonad_comm:\n  assumes x1: \"submonad_args f r g\" and x2: \"submonad_args f' r' g'\"\n  assumes y: \"m = submonad_fn f r g im\" \"m' = submonad_fn f' r' g' im'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"(do x \\<leftarrow> m; y \\<leftarrow> m'; n x y od) = (do y \\<leftarrow> m'; x \\<leftarrow> m; n x y od)\"\nproof -\n  have P: \"\\<And>x s. g s \\<Longrightarrow> f (r' x s) = f s\"\n    apply (subgoal_tac \"f (r' x (r (f s) s)) = f s\")\n     apply (simp add: submonad_args.args[OF x1])\n    apply (simp add: z[symmetric])\n    apply (subst(asm) gp [symmetric])\n    apply (fastforce dest: submonad_args.argsD1[OF x1])\n    done\n  have Q: \"\\<And>x s. g' s \\<Longrightarrow> f' (r x s) = f' s\"\n    apply (subgoal_tac \"f' (r x (r' (f' s) s)) = f' s\")\n     apply (simp add: submonad_args.args[OF x2])\n    apply (simp add: z)\n    apply (subst(asm) gp' [symmetric])\n    apply (fastforce dest: submonad_args.argsD1[OF x2])\n    done\n  note empty_failD [OF efim, simp]\n  note empty_failD [OF efim', simp]\n  show ?thesis\n    apply (clarsimp simp: submonad_fn_def y bind_assoc split_def)\n    apply (subst bind_subst_lift [OF modify_stateAssert], rule gp gp')+\n    apply (simp add: bind_assoc)\n    apply (subst select_f_stateAssert, rule efim efim')+\n    apply (subst gets_stateAssert bind_subst_lift [OF stateAssert_stateAssert])+\n    apply (rule bind_cong)\n     apply (simp add: pred_conj_def conj_comms)\n    apply (simp add: bind_assoc select_f_walk[symmetric])\n    apply (clarsimp dest!: fst_stateAssertD)\n    apply (subst bind_assoc[symmetric],\n           subst bind_subst_lhs_inv [OF gets_modify_comm],\n           erule P Q, wp, simp, simp)+\n    apply (simp add: bind_assoc)\n    apply (simp add: select_f_walk[symmetric])\n    apply (subst gets_comm)\n    apply (rule bind_apply_cong [OF refl])+\n    apply (subst select_f_walk, simp, simp,\n           subst select_f_walk, simp, simp,\n           rule bind_apply_cong [OF refl])\n    apply (subst select_f_walk, simp, simp, rule bind_apply_cong [OF refl])\n    apply (clarsimp simp: simpler_gets_def select_f_def)\n    apply (simp add: bind_def get_def put_def modify_def z)\n    done\nqed\n\nlemma submonad_comm2:\n  assumes x1: \"submonad_args f r g\" and x2: \"m = submonad_fn f r g im\"\n  assumes y: \"submonad f' r' g' m'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"do x \\<leftarrow> m; y \\<leftarrow> m' im'; n x y od = do y \\<leftarrow> m' im'; x \\<leftarrow> m; n x y od\"\n  apply (rule submonad_comm[where f'=f' and r'=r', OF x1 _ x2 _ z])\n       apply (insert y)\n       apply (fastforce simp add: submonad_def)\n      apply (fastforce dest: submonad.fn_is_sm)\n     apply (simp add: efim efim' gp gp')+\n  done\n\nlemma submonad_bind_alt:\n  assumes x: \"submonad_args f r g\"\n  assumes y: \"a = submonad_fn f r g a'\" \"\\<And>rv. b rv = submonad_fn f r g (b' rv)\"\n  assumes efa: \"empty_fail a'\" and efb: \"\\<And>x. empty_fail (b' x)\"\n  shows      \"(a >>= b) = submonad_fn f r g (a' >>= b')\"\nproof -\n  have P: \"submonad f r g (submonad_fn f r g)\"\n    by (simp add: x submonad_def submonad_axioms_def)\n  have Q: \"b = (\\<lambda>rv. submonad_fn f r g (b' rv))\"\n    by (rule ext) fact+\n  show ?thesis\n    by (simp add: y Q submonad_bind [OF P P P efa efb])\nqed\n\nlemma submonad_singleton:\n  \"submonad_fn fetch replace \\<top> (\\<lambda>s. ({(rv s, s' s)}, False))\n     = (\\<lambda>s. ({(rv (fetch s), replace (s' (fetch s)) s)}, False))\"\n  apply (rule ext)\n  apply (simp add: submonad_fn_def bind_def gets_def\n                put_def get_def modify_def return_def\n                select_f_def UNION_eq)\n  done\n\nlemma gets_submonad:\n  \"\\<lbrakk> submonad_args fetch replace \\<top>; \\<And>s. f s = f' (fetch s); m = gets f' \\<rbrakk>\n   \\<Longrightarrow> gets f = submonad_fn fetch replace \\<top> m\"\n  apply (drule submonad_args.args(3))\n  apply (clarsimp simp add: simpler_gets_def submonad_singleton)\n  done\n\nlemma modify_submonad:\n  \"\\<lbrakk> \\<And>s. f s = replace (K_record (f' (fetch s))) s; m = modify f' \\<rbrakk>\n     \\<Longrightarrow> modify f = submonad_fn fetch (replace o K_record) \\<top> m\"\n  by (simp add: simpler_modify_def submonad_singleton)\n\nlemma fail_submonad:\n  \"fail = submonad_fn fetch replace \\<top> fail\"\n  by (simp add: submonad_fn_def simpler_gets_def return_def\n                simpler_modify_def select_f_def bind_def fail_def)\n\nlemma return_submonad:\n  \"submonad_args fetch replace guard \\<Longrightarrow>\n   return v = submonad_fn fetch replace \\<top> (return v)\"\n  by (simp add: return_def submonad_singleton submonad_args.args)\n\nlemma assert_opt_submonad:\n  \"submonad_args fetch replace \\<top> \\<Longrightarrow>\n   assert_opt v = submonad_fn fetch replace \\<top> (assert_opt v)\"\n  apply (case_tac v, simp_all add: assert_opt_def)\n   apply (rule fail_submonad)\n  apply (rule return_submonad)\n  apply assumption\n  done \n\nlemma is_stateAssert_gets:\n  \"\\<lbrakk> \\<forall>s. \\<lbrace>op = s\\<rbrace> f \\<lbrace>\\<lambda>_. op = s\\<rbrace>; \\<lbrace>\\<top>\\<rbrace> f \\<lbrace>\\<lambda>_. guard\\<rbrace>;\n     empty_fail f; no_fail guard f; \\<lbrace>guard\\<rbrace> f \\<lbrace>\\<lambda>rv s. fetch s = rv\\<rbrace> \\<rbrakk>\n    \\<Longrightarrow> f = do stateAssert guard []; gets fetch od\"\n  apply (rule ext)\n  apply (clarsimp simp: bind_def empty_fail_def valid_def no_fail_def\n                        stateAssert_def assert_def gets_def get_def\n                        return_def fail_def image_def split_def)\n  apply (case_tac \"f x\")\n  apply (intro conjI impI)\n   apply (drule_tac x=x in spec)+\n   apply (subgoal_tac \"\\<forall>xa\\<in>fst (f x). fst xa = fetch x \\<and> snd xa = x\")\n    apply fastforce\n   apply clarsimp\n  apply (drule_tac x=x in spec)+\n  apply fastforce\n  done\n\nlemma is_modify:\n  \"\\<And>s. \\<lbrakk> \\<lbrace>op = s\\<rbrace> f \\<lbrace>\\<lambda>_. op = (replace s)\\<rbrace>; empty_fail f;\n          no_fail guard f; guard s \\<rbrakk>\n    \\<Longrightarrow> f s = modify replace s\"\n  apply (clarsimp simp: bind_def empty_fail_def valid_def no_fail_def\n                        stateAssert_def assert_def modify_def get_def put_def\n                        return_def fail_def image_def split_def)\n  apply (case_tac \"f s\")\n  apply force\n  done\n\nlemma submonad_comm':\n  assumes sm1: \"submonad f r g m\" and sm2: \"submonad f' r' g' m'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"(do x \\<leftarrow> m im; y \\<leftarrow> m' im'; n x y od) =\n              (do y \\<leftarrow> m' im'; x \\<leftarrow> m im; n x y od)\"\n  apply (rule submonad_comm [where f'=f' and r'=r', OF _ _ _ _ z])\n         apply (insert sm1 sm2)\n         apply (fastforce dest: submonad.fn_is_sm simp: submonad_def)+\n     apply (simp add: efim efim' gp gp')+\n  done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/lib/SubMonadLib.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381667555713, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.30946393628279034}}
{"text": "theory TypingML        \n  imports TypingHelper HelperML\nbegin               \n\nML \\<open>\n\n(*\nTo prove a typing relation in the presence of type variables, one needs to know what \ntype variable substitution to use for equality and inequality.\nThe tactic implemented here takes this information in the form of a tree (see typing_poly_hint) that\nreflects the structure of the expression to be typed. At each node of the tree, the hint is either\nNoPolyHint (in which case no hint is required for that entire subtree) or PolyHintNode (in which\ncase there is a potential theorem indicating what needs to be applied at that point and a hint tree\nfor each subnode). \nFor optimization reasons, we use trees that only reflect nodes that can branch (i.e., binary\noperations and function calls currently). For all other nodes (i.e., those with only one subnode)\nno hint is required and the hint tree should not represent them using a separate node. This means\nthe hint tree reflects the structure of the expression where consecutive nodes with only single \nsubnodes are merged.\n*)\n\ndatatype typing_poly_hint = NoPolyHint | PolyHintNode of (thm option * (typing_poly_hint list))\n\nfun has_poly_hint NoPolyHint = false\n |  has_poly_hint (PolyHintNode (NONE, _ )) = false\n |  has_poly_hint (PolyHintNode (SOME _, _ )) = true\n\nfun the_poly_hint NoPolyHint = error(\"invoked the_poly_hint on NoPolyHint\")\n  | the_poly_hint (PolyHintNode (thm, hints)) = (thm, hints)\n\nfun typing_tac ctxt hint_thm_tree lookup_assms func_assms =  \n  FIRST_AND_THEN' \n    [ resolve_tac ctxt [@{thm TypVar}],\n      resolve_tac ctxt [@{thm TypBVar}],\n      resolve_tac ctxt [@{thm TypPrim}],\n      resolve_tac ctxt [@{thm TypUnOp}],\n      resolve_tac ctxt [@{thm TypBinOpMono}] THEN' assm_full_simp_solved_tac ctxt,\n      if has_poly_hint hint_thm_tree then\n        resolve_tac ctxt [@{thm typ_binop_poly_helper_2}] THEN' assm_full_simp_solved_tac ctxt\n      else \n        resolve_tac ctxt [@{thm typ_binop_poly_helper_empty}] THEN' assm_full_simp_solved_tac ctxt,\n      resolve_tac ctxt [@{thm typ_funexp_helper}],\n      resolve_tac ctxt [@{thm TypOld}],\n      resolve_tac ctxt [@{thm TypForall}],\n      resolve_tac ctxt [@{thm TypExists}],\n      resolve_tac ctxt [@{thm TypForallT}],\n      resolve_tac ctxt [@{thm TypExistsT}]\n    ]\n    [ (* Var *)\n      assm_full_simp_solved_tac (ctxt addsimps lookup_assms),\n      (* BVar *)\n      assm_full_simp_solved_tac ctxt,\n      (* Prim *)\n      assm_full_simp_solved_tac ctxt, \n      (* Unop *)\n      fn i => fn st => (((typing_tac ctxt hint_thm_tree lookup_assms func_assms) |> SOLVED') THEN' \n                      assm_full_simp_solved_tac ctxt) i st,\n      (* Binop Mono *)\n      fn i => fn st => (i,st) |-> (\n                        let val (hints1, hints2) = \n                                case hint_thm_tree of\n                                  NoPolyHint => (NoPolyHint, NoPolyHint)\n                                | PolyHintNode (_, ([h1, h2])) => (h1, h2)\n                                | _ => error(\"hints not in correct format for binop mono\")\n\n                                   in\n                        (typing_tac ctxt hints1 lookup_assms func_assms |> SOLVED') THEN'\n                        (typing_tac ctxt hints2 lookup_assms func_assms |> SOLVED') THEN' \n                        assm_full_simp_solved_tac ctxt\n                        end\n                       ),\n\n      (* Binop Poly *)\n      binop_poly_tac ctxt hint_thm_tree lookup_assms func_assms,\n      (* FunExp *)\n      (assm_full_simp_solved_tac (ctxt addsimps func_assms)) THEN'\n      assm_full_simp_solved_tac ctxt THEN' assm_full_simp_solved_tac ctxt THEN' \n        (* goal: \\<tau> = (msubstT_opt ty_params ret_ty) *)\n      asm_full_simp_tac (ctxt addsimps [@{thm msubstT_opt_def}]) THEN'\n        (* before this final tactic the goal is of the form \\<open>map (msubstT_opt ty_params) args_ty\\<close>, which we want to simplify fully *)\n      asm_full_simp_tac (ctxt addsimps [@{thm msubstT_opt_def}]) THEN'\n      typing_list_tac ctxt hint_thm_tree lookup_assms func_assms,\n\n      (* Old *)\n      fn i => fn st  => ((typing_tac ctxt hint_thm_tree lookup_assms func_assms) |> SOLVED') i st,\n    \n      (* Forall *)\n      fn i => fn st => ((typing_tac ctxt hint_thm_tree lookup_assms func_assms) |> SOLVED') i st,\n\n      (* Exists *)\n      fn i => fn st => ((typing_tac ctxt hint_thm_tree lookup_assms func_assms) |> SOLVED') i st,\n\n      (* ForallT *)\n      fn i => fn st => ((typing_tac ctxt hint_thm_tree lookup_assms func_assms) |> SOLVED') i st,\n\n      (* ExistsT *)\n      fn i => fn st => ((typing_tac ctxt hint_thm_tree lookup_assms func_assms) |> SOLVED') i st\n    ]\n and  \n   typing_list_tac ctxt hint_thm_tree lookup_assms func_assms = \n      resolve_tac ctxt [@{thm TypListNil}] ORELSE'\n      (resolve_tac ctxt [@{thm TypListCons}] THEN' \n       (fn i => fn st => (i, st) |-> \n                          ( let val (hint1, hint_tail) = \n                                  case hint_thm_tree of\n                                    NoPolyHint => (NoPolyHint, NoPolyHint)\n                                  | PolyHintNode (t, h1 :: htail) => (h1, PolyHintNode (t, htail))\n                                  | _ => error(\"hints not in correct format for binop mono\")\n                            in\n                            (typing_tac ctxt hint1 lookup_assms func_assms |> SOLVED') THEN' \n                            (typing_list_tac ctxt hint_tail lookup_assms func_assms)\n                            end\n                          )\n       )\n      )\n and \n   binop_poly_tac ctxt hint_thm_tree lookup_assms func_assms i st = \n      case hint_thm_tree of\n       PolyHintNode (hint_thm_opt, [h1,h2]) => \n        (i, st) |->\n        ( (if is_some hint_thm_opt then resolve_tac ctxt [the hint_thm_opt] else K all_tac) THEN'\n          ((typing_tac ctxt h1 lookup_assms func_assms) |> SOLVED') THEN'\n          ((typing_tac ctxt h2 lookup_assms func_assms) |> SOLVED') THEN' \n          assm_full_simp_solved_tac (ctxt addsimps [@{thm msubstT_opt_def}])\n        )\n      | NoPolyHint => \n        (i, st) |->\n        ( \n          ((typing_tac ctxt NoPolyHint lookup_assms func_assms) |> SOLVED') THEN'\n          ((typing_tac ctxt NoPolyHint lookup_assms func_assms) |> SOLVED') THEN' \n          assm_full_simp_solved_tac ctxt\n        )\n     | _ => error(\"hints not in correct format for binop mono\")\n\nfun typing_tac_no_hints ctxt lookup_assms func_assms = typing_tac ctxt NoPolyHint lookup_assms func_assms\n\\<close>\n\nend", "meta": {"author": "gauravpartha", "repo": "foundational_boogie", "sha": "4667c538759128ad88588ff2c1ae821d7a78b16b", "save_path": "github-repos/isabelle/gauravpartha-foundational_boogie", "path": "github-repos/isabelle/gauravpartha-foundational_boogie/foundational_boogie-4667c538759128ad88588ff2c1ae821d7a78b16b/BoogieLang/TypingML.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3094639279221546}}
{"text": "(* Author: Andreas Lochbihler, ETH Zurich\n   Author: Joshua Schneider, ETH Zurich *)\n\nsection \\<open>Simple operations: demotion, merging, composition\\<close>\n\ntheory Composition imports\n  Axiomatised_BNF_CC\nbegin\n\ntext \\<open>\n  We illustrate the composition of \\BNFCC{}s with one example for each kind of parameters\n  (live/co-/contravariant/fixed). We do not show demotion and merging in isolation, as the\n  examples for composition use these operations, too.\n\\<close>\n\nsubsection \\<open>Composition in a live position\\<close>\n\ntype_synonym\n  ('l1, 'l2, 'l3, 'co1, 'co2, 'co3, 'co4, 'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGl =\n    \"(('l1, 'l2, 'co1, 'co2, 'contra1, 'contra2, 'f1) G,\n    'l1, 'l3, 'co1, 'co3, 'co4, 'contra1, 'contra3, 'contra4, 'f2) F\"\n\ntext \\<open>The type variables @{typ 'l1}, @{typ 'co1} and @{typ 'contra1} have each been merged.\\<close>\n\ndefinition \"rel_FGl L1 L2 L3 Co1 Co2 Co3 Co4 Contra1 Contra2 Contra3 Contra4 =\n  rel_F (rel_G L1 L2 Co1 Co2 Contra1 Contra2) L1 L3 Co1 Co3 Co4 Contra1 Contra3 Contra4\"\n\ndefinition \"map_FGl l1 l2 l3 co1 co2 co3 co4 contra1 contra2 contra3 contra4 =\n  map_F (map_G l1 l2 co1 co2 contra1 contra2) l1 l3 co1 co3 co4 contra1 contra3 contra4\"\n\nlemma rel_FGl_mono:\n  \"\\<lbrakk> L1 \\<le> L1'; L2 \\<le> L2'; L3 \\<le> L3'; Co1 \\<le> Co1'; Co2 \\<le> Co2'; Co3 \\<le> Co3'; Co4 \\<le> Co4';\n     Contra1' \\<le> Contra1; Contra2' \\<le> Contra2; Contra3' \\<le> Contra3; Contra4' \\<le> Contra4 \\<rbrakk> \\<Longrightarrow>\n  rel_FGl L1 L2 L3 Co1 Co2 Co3 Co4 Contra1 Contra2 Contra3 Contra4 \\<le>\n  rel_FGl L1' L2' L3' Co1' Co2' Co3' Co4' Contra1' Contra2' Contra3' Contra4'\"\n  unfolding rel_FGl_def\n  apply (rule rel_F_mono)\n          apply (rule rel_G_mono)\n               apply (assumption)+\n  done\n\nlemma rel_FGl_eq: \"rel_FGl (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) = (=)\"\n  unfolding rel_FGl_def by (simp add: rel_F_eq rel_G_eq)\n\nlemma rel_FGl_conversep:\n  \"rel_FGl L1\\<inverse>\\<inverse> L2\\<inverse>\\<inverse> L3\\<inverse>\\<inverse> Co1\\<inverse>\\<inverse> Co2\\<inverse>\\<inverse> Co3\\<inverse>\\<inverse> Co4\\<inverse>\\<inverse> Contra1\\<inverse>\\<inverse> Contra2\\<inverse>\\<inverse> Contra3\\<inverse>\\<inverse> Contra4\\<inverse>\\<inverse> =\n  (rel_FGl L1 L2 L3 Co1 Co2 Co3 Co4 Contra1 Contra2 Contra3 Contra4)\\<inverse>\\<inverse>\"\n  unfolding rel_FGl_def by (simp add: rel_F_conversep rel_G_conversep)\n\nlemma map_FGl_id0: \"map_FGl id id id id id id id id id id id = id\"\n  unfolding map_FGl_def by (simp add: map_F_id0 map_G_id0)\n\nlemma map_FGl_comp: \"map_FGl l1 l2 l3 co1 co2 co3 co4 contra1 contra2 contra3 contra4 \\<circ>\n  map_FGl l1' l2' l3' co1' co2' co3' co4' contra1' contra2' contra3' contra4' =\n  map_FGl (l1 \\<circ> l1') (l2 \\<circ> l2') (l3 \\<circ> l3') (co1 \\<circ> co1') (co2 \\<circ> co2') (co3 \\<circ> co3') (co4 \\<circ> co4')\n    (contra1' \\<circ> contra1) (contra2' \\<circ> contra2) (contra3' \\<circ> contra3) (contra4' \\<circ> contra4)\"\n  unfolding map_FGl_def by (simp add: map_F_comp map_G_comp)\n\nlemma map_FGl_parametric:\n  \"rel_fun (rel_fun L1 L1') (rel_fun (rel_fun L2 L2') (rel_fun (rel_fun L3 L3')\n  (rel_fun (rel_fun Co1 Co1') (rel_fun (rel_fun Co2 Co2')\n    (rel_fun (rel_fun Co3 Co3') (rel_fun (rel_fun Co4 Co4')\n  (rel_fun (rel_fun Contra1' Contra1) (rel_fun (rel_fun Contra2' Contra2)\n    (rel_fun (rel_fun Contra3' Contra3) (rel_fun (rel_fun Contra4' Contra4)\n  (rel_fun (rel_FGl L1 L2 L3 Co1 Co2 Co3 Co4 Contra1 Contra2 Contra3 Contra4)\n  (rel_FGl L1' L2' L3' Co1' Co2' Co3' Co4' Contra1' Contra2' Contra3' Contra4'))))))))))))\n  map_FGl map_FGl\"\n  unfolding rel_FGl_def map_FGl_def\n  apply (intro rel_funI)\n  apply (elim map_F_rel_cong map_G_rel_cong)\n               apply (erule (2) rel_funE)+\n  done\n\ndefinition rel_FGl_pos_distr_cond :: \"('co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool) \\<Rightarrow> ('co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool) \\<Rightarrow> ('co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co3 \\<Rightarrow> 'co3' \\<Rightarrow> bool) \\<Rightarrow> ('co3' \\<Rightarrow> 'co3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co4 \\<Rightarrow> 'co4' \\<Rightarrow> bool) \\<Rightarrow> ('co4' \\<Rightarrow> 'co4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool) \\<Rightarrow> ('contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool) \\<Rightarrow> ('contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra3 \\<Rightarrow> 'contra3' \\<Rightarrow> bool) \\<Rightarrow> ('contra3' \\<Rightarrow> 'contra3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra4 \\<Rightarrow> 'contra4' \\<Rightarrow> bool) \\<Rightarrow> ('contra4' \\<Rightarrow> 'contra4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times> 'l3 \\<times> 'l3' \\<times> 'l3'' \\<times> 'f1 \\<times> 'f2) itself \\<Rightarrow> bool\"\n  where\n  \"rel_FGl_pos_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' _ \\<longleftrightarrow>\n  (\\<forall>(L1 :: 'l1 \\<Rightarrow> 'l1' \\<Rightarrow> bool) (L1' :: 'l1' \\<Rightarrow> 'l1'' \\<Rightarrow> bool)\n    (L2 :: 'l2 \\<Rightarrow> 'l2' \\<Rightarrow> bool) (L2' :: 'l2' \\<Rightarrow> 'l2'' \\<Rightarrow> bool)\n    (L3 :: 'l3 \\<Rightarrow> 'l3' \\<Rightarrow> bool) (L3' :: 'l3' \\<Rightarrow> 'l3'' \\<Rightarrow> bool).\n    (rel_FGl L1 L2 L3 Co1 Co2 Co3 Co4 Contra1 Contra2 Contra3 Contra4 ::\n      (_, _, _, _, _, _, _, _, _, _, _, 'f1, 'f2) FGl \\<Rightarrow> _) OO\n      rel_FGl L1' L2' L3' Co1' Co2' Co3' Co4' Contra1' Contra2' Contra3' Contra4' \\<le>\n    rel_FGl (L1 OO L1') (L2 OO L2') (L3 OO L3') (Co1 OO Co1') (Co2 OO Co2') (Co3 OO Co3') (Co4 OO Co4')\n      (Contra1 OO Contra1') (Contra2 OO Contra2') (Contra3 OO Contra3') (Contra4 OO Contra4'))\"\n\ndefinition rel_FGl_neg_distr_cond :: \"('co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool) \\<Rightarrow> ('co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool) \\<Rightarrow> ('co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co3 \\<Rightarrow> 'co3' \\<Rightarrow> bool) \\<Rightarrow> ('co3' \\<Rightarrow> 'co3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co4 \\<Rightarrow> 'co4' \\<Rightarrow> bool) \\<Rightarrow> ('co4' \\<Rightarrow> 'co4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool) \\<Rightarrow> ('contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool) \\<Rightarrow> ('contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra3 \\<Rightarrow> 'contra3' \\<Rightarrow> bool) \\<Rightarrow> ('contra3' \\<Rightarrow> 'contra3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra4 \\<Rightarrow> 'contra4' \\<Rightarrow> bool) \\<Rightarrow> ('contra4' \\<Rightarrow> 'contra4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times> 'l3 \\<times> 'l3' \\<times> 'l3'' \\<times> 'f1 \\<times> 'f2) itself \\<Rightarrow> bool\"\n  where\n  \"rel_FGl_neg_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' _ \\<longleftrightarrow>\n  (\\<forall>(L1 :: 'l1 \\<Rightarrow> 'l1' \\<Rightarrow> bool) (L1' :: 'l1' \\<Rightarrow> 'l1'' \\<Rightarrow> bool)\n    (L2 :: 'l2 \\<Rightarrow> 'l2' \\<Rightarrow> bool) (L2' :: 'l2' \\<Rightarrow> 'l2'' \\<Rightarrow> bool)\n    (L3 :: 'l3 \\<Rightarrow> 'l3' \\<Rightarrow> bool) (L3' :: 'l3' \\<Rightarrow> 'l3'' \\<Rightarrow> bool).\n    rel_FGl (L1 OO L1') (L2 OO L2') (L3 OO L3')\n      (Co1 OO Co1') (Co2 OO Co2') (Co3 OO Co3') (Co4 OO Co4')\n      (Contra1 OO Contra1') (Contra2 OO Contra2') (Contra3 OO Contra3') (Contra4 OO Contra4') \\<le>\n    (rel_FGl L1 L2 L3 Co1 Co2 Co3 Co4 Contra1 Contra2 Contra3 Contra4 ::\n      (_, _, _, _, _, _, _, _, _, _, _, 'f1, 'f2) FGl \\<Rightarrow> _) OO\n      rel_FGl L1' L2' L3' Co1' Co2' Co3' Co4' Contra1' Contra2' Contra3' Contra4')\"\n\ntext \\<open>Sufficient conditions for subdistributivity over relation composition.\\<close>\n\nlemma rel_FGl_pos_distr_imp:\n  fixes Co1 :: \"'co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool\" and Co1' :: \"'co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool\"\n    and Co2 :: \"'co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool\" and Co2' :: \"'co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool\"\n    and Contra1 :: \"'contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool\" and Contra1' :: \"'contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool\"\n    and Contra2 :: \"'contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool\" and Contra2' :: \"'contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool\"\n    and tytok_F :: \"(('l1, 'l2, 'co1, 'co2, 'contra1, 'contra2, 'f1) G \\<times>\n      ('l1', 'l2', 'co1', 'co2', 'contra1', 'contra2', 'f1) G \\<times>\n      ('l1'', 'l2'', 'co1'', 'co2'', 'contra1'', 'contra2'', 'f1) G \\<times>\n      'l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l3 \\<times> 'l3' \\<times> 'l3'' \\<times> 'f2) itself\"\n    and tytok_G :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times> 'f1) itself\"\n    and tytok_FGl :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times> 'l3 \\<times> 'l3' \\<times> 'l3'' \\<times>\n      'f1 \\<times> 'f2) itself\"\n  assumes \"rel_F_pos_distr_cond Co1 Co1' Co3 Co3' Co4 Co4'\n      Contra1 Contra1' Contra3 Contra3' Contra4 Contra4' tytok_F\"\n    and \"rel_G_pos_distr_cond Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' tytok_G\"\n  shows \"rel_FGl_pos_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' tytok_FGl\"\n  unfolding rel_FGl_pos_distr_cond_def rel_FGl_def\n  apply (intro allI)\n  apply (rule order_trans)\n   apply (rule rel_F_pos_distr)\n   apply (rule assms(1))\n  apply (rule rel_F_mono)\n          apply (rule rel_G_pos_distr)\n          apply (rule assms(2))\n         apply (rule order_refl)+\n  done\n\nlemma rel_FGl_neg_distr_imp:\n  fixes Co1 :: \"'co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool\" and Co1' :: \"'co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool\"\n    and Co2 :: \"'co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool\" and Co2' :: \"'co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool\"\n    and Contra1 :: \"'contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool\" and Contra1' :: \"'contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool\"\n    and Contra2 :: \"'contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool\" and Contra2' :: \"'contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool\"\n    and tytok_F :: \"(('l1, 'l2, 'co1, 'co2, 'contra1, 'contra2, 'f1) G \\<times>\n      ('l1', 'l2', 'co1', 'co2', 'contra1', 'contra2', 'f1) G \\<times>\n      ('l1'', 'l2'', 'co1'', 'co2'', 'contra1'', 'contra2'', 'f1) G \\<times>\n      'l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l3 \\<times> 'l3' \\<times> 'l3'' \\<times> 'f2) itself\"\n    and tytok_G :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times> 'f1) itself\"\n    and tytok_FGl :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times> 'l3 \\<times> 'l3' \\<times> 'l3'' \\<times>\n      'f1 \\<times> 'f2) itself\"\n  assumes \"rel_F_neg_distr_cond Co1 Co1' Co3 Co3' Co4 Co4'\n      Contra1 Contra1' Contra3 Contra3' Contra4 Contra4' tytok_F\"\n    and \"rel_G_neg_distr_cond Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' tytok_G\"\n  shows \"rel_FGl_neg_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' tytok_FGl\"\n  unfolding rel_FGl_neg_distr_cond_def rel_FGl_def\n  apply (intro allI)\n  apply (rule order_trans[rotated])\n   apply (rule rel_F_neg_distr)\n   apply (rule assms(1))\n  apply (rule rel_F_mono)\n          apply (rule rel_G_neg_distr)\n          apply (rule assms(2))\n         apply (rule order_refl)+\n  done\n\nlemma rel_FGl_pos_distr_cond_eq:\n  fixes tytok :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times> 'l3 \\<times> 'l3' \\<times> 'l3'' \\<times>\n    'f1 \\<times> 'f2) itself\"\n  shows \"rel_FGl_pos_distr_cond (=) (=) (=) (=) (=) (=) (=) (=)\n    (=) (=) (=) (=) (=) (=) (=) (=) tytok\"\n  by (rule rel_FGl_pos_distr_imp rel_F_pos_distr_cond_eq rel_G_pos_distr_cond_eq)+\n\nlemma rel_FGl_neg_distr_cond_eq:\n  fixes tytok :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times> 'l3 \\<times> 'l3' \\<times> 'l3'' \\<times>\n    'f1 \\<times> 'f2) itself\"\n  shows \"rel_FGl_neg_distr_cond (=) (=) (=) (=) (=) (=) (=) (=)\n    (=) (=) (=) (=) (=) (=) (=) (=) tytok\"\n  by (rule rel_FGl_neg_distr_imp rel_F_neg_distr_cond_eq rel_G_neg_distr_cond_eq)+\n\ndefinition \"rell_FGl L1 L2 L3 = rel_FGl L1 L2 L3 (=) (=) (=) (=) (=) (=) (=) (=)\"\ndefinition \"mapl_FGl l1 l2 l3 = map_FGl l1 l2 l3 id id id id id id id id\"\n\ntype_synonym ('co1, 'co2, 'co3, 'co4, 'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGlbd =\n  \"('co1, 'co3, 'co4, 'contra1, 'contra3, 'contra4, 'f2) Fbd \\<times>\n    ('co1, 'co2, 'contra1, 'contra2, 'f1) Gbd +\n    ('co1, 'co3, 'co4, 'contra1, 'contra3, 'contra4, 'f2) Fbd\"\n\ndefinition set1_FGl :: \"('l1, 'l2, 'l3, 'co1, 'co2, 'co3, 'co4,\n    'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGl \\<Rightarrow> 'l1 set\" where\n  \"set1_FGl x = (\\<Union>y\\<in>set1_F x. set1_G y) \\<union> set2_F x\"\n\ndefinition set2_FGl :: \"('l1, 'l2, 'l3, 'co1, 'co2, 'co3, 'co4,\n    'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGl \\<Rightarrow> 'l2 set\" where\n  \"set2_FGl x = (\\<Union>y\\<in>set1_F x. set2_G y)\"\n\ndefinition set3_FGl :: \"('l1, 'l2, 'l3, 'co1, 'co2, 'co3, 'co4,\n    'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGl \\<Rightarrow> 'l3 set\" where\n  \"set3_FGl x = set3_F x\"\n\ndefinition\n  bd_FGl :: \"('co1, 'co2, 'co3, 'co4, 'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGlbd rel\"\n  where \"bd_FGl = bd_F *c bd_G +c bd_F\"\n\nlemma set1_FGl_map: \"set1_FGl \\<circ> mapl_FGl l1 l2 l3 = image l1 \\<circ> set1_FGl\"\n  by (simp add: fun_eq_iff set1_FGl_def mapl_FGl_def map_FGl_def\n      mapl_F_def[symmetric] mapl_G_def[symmetric]\n      set1_F_map[THEN fun_cong, simplified] set2_F_map[THEN fun_cong, simplified]\n      set1_G_map[THEN fun_cong, simplified]\n      image_Un image_UN)\n\nlemma set2_FGl_map: \"set2_FGl \\<circ> mapl_FGl l1 l2 l3 = image l2 \\<circ> set2_FGl\"\n  by (simp add: fun_eq_iff set2_FGl_def mapl_FGl_def map_FGl_def\n      mapl_F_def[symmetric] mapl_G_def[symmetric]\n      set1_F_map[THEN fun_cong, simplified] set2_G_map[THEN fun_cong, simplified] image_UN)\n\nlemma set3_FGl_map: \"set3_FGl \\<circ> mapl_FGl l1 l2 l3 = image l3 \\<circ> set3_FGl\"\n  by (simp add: fun_eq_iff set3_FGl_def mapl_FGl_def map_FGl_def\n      mapl_F_def[symmetric] mapl_G_def[symmetric] set3_F_map[THEN fun_cong, simplified])\n\nlemma bd_FGl_card_order: \"card_order bd_FGl\"\n  unfolding bd_FGl_def using bd_F_card_order bd_G_card_order\n  by (intro card_order_csum card_order_cprod)\n\nlemma bd_FGl_cinfinite: \"cinfinite bd_FGl\"\n  unfolding bd_FGl_def using bd_F_cinfinite bd_G_cinfinite\n  by (intro cinfinite_csum disjI2)\n\nlemma\n  fixes x :: \"(_, _, _, 'co1, 'co2, 'co3, 'co4, 'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGl\"\n  shows set1_FGl_bound: \"card_of (set1_FGl x) \\<le>o\n      (bd_FGl :: ('co1, 'co2, 'co3, 'co4, 'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGlbd rel)\"\n    and set2_FGl_bound: \"card_of (set2_FGl x) \\<le>o\n      (bd_FGl :: ('co1, 'co2, 'co3, 'co4, 'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGlbd rel)\"\n    and set3_FGl_bound: \"card_of (set3_FGl x) \\<le>o\n      (bd_FGl :: ('co1, 'co2, 'co3, 'co4, 'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGlbd rel)\"\n  unfolding set1_FGl_def set2_FGl_def set3_FGl_def bd_FGl_def\n    apply (simp)\n    apply (rule ordLeq_transitive)\n     apply (rule Un_csum)\n    apply (rule csum_mono)\n     apply (rule comp_single_set_bd[where fset=set1_G and gset=set1_F, rotated])\n       apply (rule set1_G_bound)\n      apply (rule set1_F_bound)\n     apply (rule card_order_on_Card_order[THEN conjunct2, OF bd_G_card_order])\n    apply (rule set2_F_bound)\n   apply (rule ordLeq_transitive)\n    apply (rule comp_single_set_bd[where fset=set2_G and gset=set1_F, rotated])\n      apply (rule set2_G_bound)\n     apply (rule set1_F_bound)\n    apply (rule card_order_on_Card_order[THEN conjunct2, OF bd_G_card_order])\n   apply (rule ordLeq_csum1)\n   apply (rule Card_order_cprod)\n  apply (rule ordLeq_transitive)\n   apply (rule set3_F_bound)\n  apply (rule ordLeq_csum2)\n  apply (rule card_order_on_Card_order[THEN conjunct2, OF bd_F_card_order])\n  done\n\nlemma mapl_FGl_cong:\n  assumes \"\\<And>z. z \\<in> set1_FGl x \\<Longrightarrow> l1 z = l1' z\" and \"\\<And>z. z \\<in> set2_FGl x \\<Longrightarrow> l2 z = l2' z\"\n    and \"\\<And>z. z \\<in> set3_FGl x \\<Longrightarrow> l3 z = l3' z\"\n  shows \"mapl_FGl l1 l2 l3 x = mapl_FGl l1' l2' l3' x\"\n  unfolding mapl_FGl_def map_FGl_def mapl_G_def[symmetric] mapl_F_def[symmetric]\n  by (auto 0 5 intro: mapl_F_cong mapl_G_cong assms simp add: set1_FGl_def set2_FGl_def set3_FGl_def)\n\nlemma rell_FGl_mono_strong:\n  assumes \"rell_FGl L1 L2 L3 x y\"\n    and \"\\<And>a b. a \\<in> set1_FGl x \\<Longrightarrow> b \\<in> set1_FGl y \\<Longrightarrow> L1 a b \\<Longrightarrow> L1' a b\"\n    and \"\\<And>a b. a \\<in> set2_FGl x \\<Longrightarrow> b \\<in> set2_FGl y \\<Longrightarrow> L2 a b \\<Longrightarrow> L2' a b\"\n    and \"\\<And>a b. a \\<in> set3_FGl x \\<Longrightarrow> b \\<in> set3_FGl y \\<Longrightarrow> L3 a b \\<Longrightarrow> L3' a b\"\n  shows \"rell_FGl L1' L2' L3' x y\"\n  using assms(1) unfolding rell_FGl_def rel_FGl_def rell_G_def[symmetric] rell_F_def[symmetric]\n  by (auto 0 5 intro: rell_F_mono_strong rell_G_mono_strong assms(2-4)\n      simp add: set1_FGl_def set2_FGl_def set3_FGl_def)\n\n\nsubsection \\<open>Composition in a covariant position\\<close>\n\ntype_synonym\n  ('l1, 'co1, 'co2, 'co3, 'co4, 'co5, 'co6, 'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGco =\n    \"('l1, 'co1, 'co5, ('co1, 'co2, 'co3, 'co4, 'contra1, 'contra2, 'f1) G, 'co3, 'co6,\n    'contra1, 'contra3, 'contra4, 'f2) F\"\n\ntext \\<open>The type variables @{typ 'co1}, @{typ 'co3} and @{typ 'contra1} have each been merged.\\<close>\n\ndefinition \"rel_FGco L1 Co1 Co2 Co3 Co4 Co5 Co6 Contra1 Contra2 Contra3 Contra4 =\n  rel_F L1 Co1 Co5 (rel_G Co1 Co2 Co3 Co4 Contra1 Contra2) Co3 Co6 Contra1 Contra3 Contra4\"\n\ndefinition \"map_FGco l1 co1 co2 co3 co4 co5 co6 contra1 contra2 contra3 contra4 =\n  map_F l1 co1 co5 (map_G co1 co2 co3 co4 contra1 contra2) co3 co6 contra1 contra3 contra4\"\n\nlemma rel_FGco_mono:\n  \"\\<lbrakk> L1 \\<le> L1'; Co1 \\<le> Co1'; Co2 \\<le> Co2'; Co3 \\<le> Co3'; Co4 \\<le> Co4'; Co5 \\<le> Co5'; Co6 \\<le> Co6';\n     Contra1' \\<le> Contra1; Contra2' \\<le> Contra2; Contra3' \\<le> Contra3; Contra4' \\<le> Contra4 \\<rbrakk> \\<Longrightarrow>\n  rel_FGco L1 Co1 Co2 Co3 Co4 Co5 Co6 Contra1 Contra2 Contra3 Contra4 \\<le>\n  rel_FGco L1' Co1' Co2' Co3' Co4' Co5' Co6' Contra1' Contra2' Contra3' Contra4'\"\n  unfolding rel_FGco_def\n  apply (rule rel_F_mono)\n          apply (assumption)+\n       apply (rule rel_G_mono)\n            apply (assumption)+\n  done\n\nlemma rel_FGco_eq: \"rel_FGco (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) = (=)\"\n  unfolding rel_FGco_def by (simp add: rel_F_eq rel_G_eq)\n\n\n\nlemma map_FGco_id0: \"map_FGco id id id id id id id id id id id = id\"\n  unfolding map_FGco_def by (simp add: map_F_id0 map_G_id0)\n\nlemma map_FGco_comp: \"map_FGco l1 co1 co2 co3 co4 co5 co6 contra1 contra2 contra3 contra4 \\<circ>\n  map_FGco l1' co1' co2' co3' co4' co5' co6' contra1' contra2' contra3' contra4' =\n  map_FGco (l1 \\<circ> l1') (co1 \\<circ> co1') (co2 \\<circ> co2') (co3 \\<circ> co3') (co4 \\<circ> co4') (co5 \\<circ> co5') (co6 \\<circ> co6')\n    (contra1' \\<circ> contra1) (contra2' \\<circ> contra2) (contra3' \\<circ> contra3) (contra4' \\<circ> contra4)\"\n  unfolding map_FGco_def by (simp add: map_F_comp map_G_comp)\n\nlemma map_FGco_parametric:\n  \"rel_fun (rel_fun L1 L1') (rel_fun (rel_fun Co1 Co1') (rel_fun (rel_fun Co2 Co2')\n    (rel_fun (rel_fun Co3 Co3') (rel_fun (rel_fun Co4 Co4')\n    (rel_fun (rel_fun Co5 Co5') (rel_fun (rel_fun Co6 Co6')\n  (rel_fun (rel_fun Contra1' Contra1) (rel_fun (rel_fun Contra2' Contra2)\n    (rel_fun (rel_fun Contra3' Contra3) (rel_fun (rel_fun Contra4' Contra4)\n  (rel_fun (rel_FGco L1 Co1 Co2 Co3 Co4 Co5 Co6 Contra1 Contra2 Contra3 Contra4)\n  (rel_FGco L1' Co1' Co2' Co3' Co4' Co5' Co6' Contra1' Contra2' Contra3' Contra4'))))))))))))\n  map_FGco map_FGco\"\n  unfolding rel_FGco_def map_FGco_def\n  apply (intro rel_funI)\n  apply (elim map_F_rel_cong map_G_rel_cong)\n               apply (erule (2) rel_funE)+\n  done\n\ndefinition rel_FGco_pos_distr_cond :: \"('co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool) \\<Rightarrow> ('co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool) \\<Rightarrow> ('co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co3 \\<Rightarrow> 'co3' \\<Rightarrow> bool) \\<Rightarrow> ('co3' \\<Rightarrow> 'co3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co4 \\<Rightarrow> 'co4' \\<Rightarrow> bool) \\<Rightarrow> ('co4' \\<Rightarrow> 'co4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co5 \\<Rightarrow> 'co5' \\<Rightarrow> bool) \\<Rightarrow> ('co5' \\<Rightarrow> 'co5'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co6 \\<Rightarrow> 'co6' \\<Rightarrow> bool) \\<Rightarrow> ('co6' \\<Rightarrow> 'co6'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool) \\<Rightarrow> ('contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool) \\<Rightarrow> ('contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra3 \\<Rightarrow> 'contra3' \\<Rightarrow> bool) \\<Rightarrow> ('contra3' \\<Rightarrow> 'contra3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra4 \\<Rightarrow> 'contra4' \\<Rightarrow> bool) \\<Rightarrow> ('contra4' \\<Rightarrow> 'contra4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself \\<Rightarrow> bool\" where\n  \"rel_FGco_pos_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4' Co5 Co5' Co6 Co6'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' _ \\<longleftrightarrow>\n  (\\<forall>(L1 :: 'l1 \\<Rightarrow> 'l1' \\<Rightarrow> bool) (L1' :: 'l1' \\<Rightarrow> 'l1'' \\<Rightarrow> bool).\n    (rel_FGco L1 Co1 Co2 Co3 Co4 Co5 Co6 Contra1 Contra2 Contra3 Contra4 ::\n      (_, _, _, _, _, _, _, _, _, _, _, 'f1, 'f2) FGco \\<Rightarrow> _) OO\n      rel_FGco L1' Co1' Co2' Co3' Co4' Co5' Co6' Contra1' Contra2' Contra3' Contra4' \\<le>\n    rel_FGco (L1 OO L1') (Co1 OO Co1') (Co2 OO Co2') (Co3 OO Co3')\n      (Co4 OO Co4') (Co5 OO Co5') (Co6 OO Co6')\n      (Contra1 OO Contra1') (Contra2 OO Contra2') (Contra3 OO Contra3') (Contra4 OO Contra4'))\"\n\ndefinition rel_FGco_neg_distr_cond :: \"('co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool) \\<Rightarrow> ('co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool) \\<Rightarrow> ('co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co3 \\<Rightarrow> 'co3' \\<Rightarrow> bool) \\<Rightarrow> ('co3' \\<Rightarrow> 'co3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co4 \\<Rightarrow> 'co4' \\<Rightarrow> bool) \\<Rightarrow> ('co4' \\<Rightarrow> 'co4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co5 \\<Rightarrow> 'co5' \\<Rightarrow> bool) \\<Rightarrow> ('co5' \\<Rightarrow> 'co5'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co6 \\<Rightarrow> 'co6' \\<Rightarrow> bool) \\<Rightarrow> ('co6' \\<Rightarrow> 'co6'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool) \\<Rightarrow> ('contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool) \\<Rightarrow> ('contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra3 \\<Rightarrow> 'contra3' \\<Rightarrow> bool) \\<Rightarrow> ('contra3' \\<Rightarrow> 'contra3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra4 \\<Rightarrow> 'contra4' \\<Rightarrow> bool) \\<Rightarrow> ('contra4' \\<Rightarrow> 'contra4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself \\<Rightarrow> bool\" where\n  \"rel_FGco_neg_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4' Co5 Co5' Co6 Co6'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' _ \\<longleftrightarrow>\n  (\\<forall>(L1 :: 'l1 \\<Rightarrow> 'l1' \\<Rightarrow> bool) (L1' :: 'l1' \\<Rightarrow> 'l1'' \\<Rightarrow> bool).\n    rel_FGco (L1 OO L1') (Co1 OO Co1') (Co2 OO Co2') (Co3 OO Co3')\n      (Co4 OO Co4') (Co5 OO Co5') (Co6 OO Co6')\n      (Contra1 OO Contra1') (Contra2 OO Contra2') (Contra3 OO Contra3') (Contra4 OO Contra4') \\<le>\n    (rel_FGco L1 Co1 Co2 Co3 Co4 Co5 Co6 Contra1 Contra2 Contra3 Contra4 ::\n      (_, _, _, _, _, _, _, _, _, _, _, 'f1, 'f2) FGco \\<Rightarrow> _) OO\n      rel_FGco L1' Co1' Co2' Co3' Co4' Co5' Co6' Contra1' Contra2' Contra3' Contra4')\"\n\ntext \\<open>Sufficient conditions for subdistributivity over relation composition.\\<close>\n\nlemma rel_FGco_pos_distr_imp:\n  fixes Co1 :: \"'co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool\" and Co1' :: \"'co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool\"\n    and Co2 :: \"'co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool\" and Co2' :: \"'co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool\"\n    and Co5 :: \"'co5 \\<Rightarrow> 'co5' \\<Rightarrow> bool\" and Co5' :: \"'co5' \\<Rightarrow> 'co5'' \\<Rightarrow> bool\"\n    and tytok_F :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'co1 \\<times> 'co1' \\<times> 'co1'' \\<times> 'co5 \\<times> 'co5' \\<times> 'co5'' \\<times>\n      'f2) itself\"\n    and tytok_G :: \"('co1 \\<times> 'co1' \\<times> 'co1'' \\<times> 'co2 \\<times> 'co2' \\<times> 'co2'' \\<times> 'f1) itself\"\n    and tytok_FGco :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself\"\n  assumes \"rel_F_pos_distr_cond\n      (rel_G Co1 Co2 Co3 Co4 Contra1 Contra2 :: (_, _, _, _, _, _, 'f1) G \\<Rightarrow> _)\n      (rel_G Co1' Co2' Co3' Co4' Contra1' Contra2') Co3 Co3' Co6 Co6'\n      Contra1 Contra1' Contra3 Contra3' Contra4 Contra4' tytok_F\"\n    and \"rel_G_pos_distr_cond Co3 Co3' Co4 Co4' Contra1 Contra1' Contra2 Contra2' tytok_G\"\n  shows \"rel_FGco_pos_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4' Co5 Co5' Co6 Co6'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' tytok_FGco\"\n  unfolding rel_FGco_pos_distr_cond_def rel_FGco_def\n  apply (intro allI)\n  apply (rule order_trans)\n   apply (rule rel_F_pos_distr)\n   apply (rule assms(1))\n  apply (rule rel_F_mono)\n          apply (rule order_refl)+\n       apply (rule rel_G_pos_distr)\n       apply (rule assms(2))\n      apply (rule order_refl)+\n  done\n\nlemma rel_FGco_neg_distr_imp:\n  fixes Co1 :: \"'co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool\" and Co1' :: \"'co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool\"\n    and Co2 :: \"'co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool\" and Co2' :: \"'co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool\"\n    and Co5 :: \"'co5 \\<Rightarrow> 'co5' \\<Rightarrow> bool\" and Co5' :: \"'co5' \\<Rightarrow> 'co5'' \\<Rightarrow> bool\"\n    and tytok_F :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'co1 \\<times> 'co1' \\<times> 'co1'' \\<times> 'co5 \\<times> 'co5' \\<times> 'co5'' \\<times> 'f2) itself\"\n    and tytok_G :: \"('co1 \\<times> 'co1' \\<times> 'co1'' \\<times> 'co2 \\<times> 'co2' \\<times> 'co2'' \\<times> 'f1) itself\"\n    and tytok_FGco :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself\"\n  assumes \"rel_F_neg_distr_cond\n      (rel_G Co1 Co2 Co3 Co4 Contra1 Contra2 :: (_, _, _, _, _, _, 'f1) G \\<Rightarrow> _)\n      (rel_G Co1' Co2' Co3' Co4' Contra1' Contra2') Co3 Co3' Co6 Co6'\n      Contra1 Contra1' Contra3 Contra3' Contra4 Contra4' tytok_F\"\n    and \"rel_G_neg_distr_cond Co3 Co3' Co4 Co4' Contra1 Contra1' Contra2 Contra2' tytok_G\"\n  shows \"rel_FGco_neg_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4' Co5 Co5' Co6 Co6'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' tytok_FGco\"\n  unfolding rel_FGco_neg_distr_cond_def rel_FGco_def\n  apply (intro allI)\n  apply (rule order_trans[rotated])\n   apply (rule rel_F_neg_distr)\n   apply (rule assms(1))\n  apply (rule rel_F_mono)\n          apply (rule order_refl)+\n       apply (rule rel_G_neg_distr)\n       apply (rule assms(2))\n      apply (rule order_refl)+\n  done\n\nlemma rel_FGco_pos_distr_cond_eq:\n  fixes tytok :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself\"\n  shows \"rel_FGco_pos_distr_cond (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) (=)\n    (=) (=) (=) (=) (=) (=) (=) (=) tytok\"\n  apply (rule rel_FGco_pos_distr_imp)\n   apply (simp add: rel_G_eq)\n   apply (rule rel_F_pos_distr_cond_eq rel_G_pos_distr_cond_eq)+\n  done\n\nlemma rel_FGco_neg_distr_cond_eq:\n  fixes tytok :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself\"\n  shows \"rel_FGco_neg_distr_cond (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) (=)\n    (=) (=) (=) (=) (=) (=) (=) (=) tytok\"\n  apply (rule rel_FGco_neg_distr_imp)\n   apply (simp add: rel_G_eq)\n   apply (rule rel_F_neg_distr_cond_eq rel_G_neg_distr_cond_eq)+\n  done\n\ndefinition \"rell_FGco L1 = rel_FGco L1 (=) (=) (=) (=) (=) (=) (=) (=) (=) (=)\"\ndefinition \"mapl_FGco l1 = map_FGco l1 id id id id id id id id id id\"\n\ntype_synonym ('co1, 'co2, 'co3, 'co4, 'co5, 'co6,\n    'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGcobd =\n  \"(('co1, 'co2, 'co3, 'co4, 'contra1, 'contra2, 'f1) G,\n    'co3, 'co6, 'contra1, 'contra3, 'contra4, 'f2) Fbd\"\n\ndefinition set1_FGco :: \"('l1, 'co1, 'co2, 'co3, 'co4, 'co5, 'co6,\n    'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGco \\<Rightarrow> 'l1 set\" where\n  \"set1_FGco x = set1_F x\"\n\ndefinition bd_FGco :: \"('co1, 'co2, 'co3, 'co4, 'co5, 'co6,\n    'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGcobd rel\" where\n  \"bd_FGco = bd_F\"\n\nlemma set1_FGco_map: \"set1_FGco \\<circ> mapl_FGco l1 = image l1 \\<circ> set1_FGco\"\n  by (simp add: fun_eq_iff set1_FGco_def mapl_FGco_def map_FGco_def\n      mapl_F_def[symmetric] mapl_G_def[symmetric] mapl_G_id0\n      set1_F_map[THEN fun_cong, simplified])\n\nlemma bd_FGco_card_order: \"card_order bd_FGco\"\n  unfolding bd_FGco_def using bd_F_card_order .\n\nlemma bd_FGco_cinfinite: \"cinfinite bd_FGco\"\n  unfolding bd_FGco_def using bd_F_cinfinite .\n\nlemma set1_FGco_bound:\n  fixes x :: \"(_, 'co1, 'co2, 'co3, 'co4, 'co5, 'co6,\n    'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGco\"\n  shows \"card_of (set1_FGco x) \\<le>o (bd_FGco :: ('co1, 'co2, 'co3, 'co4, 'co5, 'co6,\n    'contra1, 'contra2, 'contra3, 'contra4, 'f1, 'f2) FGcobd rel)\"\n  unfolding set1_FGco_def bd_FGco_def using set1_F_bound .\n\nlemma mapl_FGco_cong:\n  assumes \"\\<And>z. z \\<in> set1_FGco x \\<Longrightarrow> l1 z = l1' z\"\n  shows \"mapl_FGco l1 x = mapl_FGco l1' x\"\n  unfolding mapl_FGco_def map_FGco_def mapl_G_def[symmetric] mapl_F_def[symmetric] mapl_G_id0\n  by (auto 0 3 intro: mapl_F_cong assms simp add: set1_FGco_def)\n\nlemma rell_FGco_mono_strong:\n  assumes \"rell_FGco L1 x y\"\n    and \"\\<And>a b. a \\<in> set1_FGco x \\<Longrightarrow> b \\<in> set1_FGco y \\<Longrightarrow> L1 a b \\<Longrightarrow> L1' a b\"\n  shows \"rell_FGco L1' x y\"\n  using assms(1) unfolding rell_FGco_def rel_FGco_def rel_G_eq rell_F_def[symmetric]\n  by (auto 0 3 intro: rell_F_mono_strong assms(2) simp add: set1_FGco_def)\n\n\nsubsection \\<open>Composition in a contravariant position\\<close>\n\ntype_synonym\n  ('l1, 'co1, 'co2, 'co3, 'co4, 'co5, 'contra1,\n    'contra2, 'contra3, 'contra4, 'contra5, 'f1, 'f2) FGcontra =\n  \"('l1, 'co1, 'co3, 'co1, 'co4, 'co5, ('contra1, 'contra2, 'contra3, 'contra4, 'co1, 'co2, 'f1) G,\n    'contra1, 'contra5, 'f2) F\"\n\ntext \\<open>The type variables @{typ 'co1} and @{typ 'contra1} have each been merged.\\<close>\n\ndefinition \"rel_FGcontra L1 Co1 Co2 Co3 Co4 Co5 Contra1 Contra2 Contra3 Contra4 Contra5 =\n  rel_F L1 Co1 Co3 Co1 Co4 Co5 (rel_G Contra1 Contra2 Contra3 Contra4 Co1 Co2) Contra1 Contra5\"\n\ndefinition \"map_FGcontra l1 co1 co2 co3 co4 co5 contra1 contra2 contra3 contra4 contra5 =\n  map_F l1 co1 co3 co1 co4 co5 (map_G contra1 contra2 contra3 contra4 co1 co2) contra1 contra5\"\n\n\n\nlemma rel_FGcontra_eq: \"rel_FGcontra (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) = (=)\"\n  unfolding rel_FGcontra_def by (simp add: rel_F_eq rel_G_eq)\n\nlemma rel_FGcontra_conversep:\n  \"rel_FGcontra L1\\<inverse>\\<inverse> Co1\\<inverse>\\<inverse> Co2\\<inverse>\\<inverse> Co3\\<inverse>\\<inverse> Co4\\<inverse>\\<inverse> Co5\\<inverse>\\<inverse> Contra1\\<inverse>\\<inverse> Contra2\\<inverse>\\<inverse> Contra3\\<inverse>\\<inverse> Contra4\\<inverse>\\<inverse> Contra5\\<inverse>\\<inverse> =\n  (rel_FGcontra L1 Co1 Co2 Co3 Co4 Co5 Contra1 Contra2 Contra3 Contra4 Contra5)\\<inverse>\\<inverse>\"\n  unfolding rel_FGcontra_def by (simp add: rel_F_conversep rel_G_conversep)\n\nlemma map_FGcontra_id0: \"map_FGcontra id id id id id id id id id id id = id\"\n  unfolding map_FGcontra_def by (simp add: map_F_id0 map_G_id0)\n\nlemma map_FGcontra_comp:\n  \"map_FGcontra l1 co1 co2 co3 co4 co5 contra1 contra2 contra3 contra4 contra5 \\<circ>\n  map_FGcontra l1' co1' co2' co3' co4' co5' contra1' contra2' contra3' contra4' contra5' =\n  map_FGcontra (l1 \\<circ> l1') (co1 \\<circ> co1') (co2 \\<circ> co2') (co3 \\<circ> co3') (co4 \\<circ> co4') (co5 \\<circ> co5')\n    (contra1' \\<circ> contra1) (contra2' \\<circ> contra2) (contra3' \\<circ> contra3)\n    (contra4' \\<circ> contra4) (contra5' \\<circ> contra5)\"\n  unfolding map_FGcontra_def by (simp add: map_F_comp map_G_comp)\n\nlemma map_FGcontra_parametric:\n  \"rel_fun (rel_fun L1 L1') (rel_fun (rel_fun Co1 Co1') (rel_fun (rel_fun Co2 Co2')\n    (rel_fun (rel_fun Co3 Co3') (rel_fun (rel_fun Co4 Co4') (rel_fun (rel_fun Co5 Co5')\n  (rel_fun (rel_fun Contra1' Contra1) (rel_fun (rel_fun Contra2' Contra2)\n    (rel_fun (rel_fun Contra3' Contra3) (rel_fun (rel_fun Contra4' Contra4)\n    (rel_fun (rel_fun Contra5' Contra5)\n  (rel_fun (rel_FGcontra L1 Co1 Co2 Co3 Co4 Co5 Contra1 Contra2 Contra3 Contra4 Contra5)\n  (rel_FGcontra L1' Co1' Co2' Co3' Co4' Co5' Contra1' Contra2' Contra3' Contra4' Contra5'))))))))))))\n  map_FGcontra map_FGcontra\"\n  unfolding rel_FGcontra_def map_FGcontra_def\n  apply (intro rel_funI)\n  apply (elim map_F_rel_cong map_G_rel_cong)\n               apply (erule (2) rel_funE)+\n  done\n\ndefinition rel_FGcontra_pos_distr_cond :: \"('co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool) \\<Rightarrow> ('co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool) \\<Rightarrow> ('co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co3 \\<Rightarrow> 'co3' \\<Rightarrow> bool) \\<Rightarrow> ('co3' \\<Rightarrow> 'co3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co4 \\<Rightarrow> 'co4' \\<Rightarrow> bool) \\<Rightarrow> ('co4' \\<Rightarrow> 'co4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co5 \\<Rightarrow> 'co5' \\<Rightarrow> bool) \\<Rightarrow> ('co5' \\<Rightarrow> 'co5'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool) \\<Rightarrow> ('contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool) \\<Rightarrow> ('contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra3 \\<Rightarrow> 'contra3' \\<Rightarrow> bool) \\<Rightarrow> ('contra3' \\<Rightarrow> 'contra3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra4 \\<Rightarrow> 'contra4' \\<Rightarrow> bool) \\<Rightarrow> ('contra4' \\<Rightarrow> 'contra4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra5 \\<Rightarrow> 'contra5' \\<Rightarrow> bool) \\<Rightarrow> ('contra5' \\<Rightarrow> 'contra5'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself \\<Rightarrow> bool\" where\n  \"rel_FGcontra_pos_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4' Co5 Co5'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' Contra5 Contra5' _ \\<longleftrightarrow>\n  (\\<forall>(L1 :: 'l1 \\<Rightarrow> 'l1' \\<Rightarrow> bool) (L1' :: 'l1' \\<Rightarrow> 'l1'' \\<Rightarrow> bool).\n    (rel_FGcontra L1 Co1 Co2 Co3 Co4 Co5 Contra1 Contra2 Contra3 Contra4 Contra5 ::\n      (_, _, _, _, _, _, _, _, _, _, _, 'f1, 'f2) FGcontra \\<Rightarrow> _) OO\n      rel_FGcontra L1' Co1' Co2' Co3' Co4' Co5' Contra1' Contra2' Contra3' Contra4' Contra5' \\<le>\n    rel_FGcontra (L1 OO L1') (Co1 OO Co1') (Co2 OO Co2') (Co3 OO Co3') (Co4 OO Co4') (Co5 OO Co5')\n      (Contra1 OO Contra1') (Contra2 OO Contra2') (Contra3 OO Contra3')\n      (Contra4 OO Contra4') (Contra5 OO Contra5'))\"\n\ndefinition rel_FGcontra_neg_distr_cond :: \"('co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool) \\<Rightarrow> ('co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool) \\<Rightarrow> ('co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co3 \\<Rightarrow> 'co3' \\<Rightarrow> bool) \\<Rightarrow> ('co3' \\<Rightarrow> 'co3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co4 \\<Rightarrow> 'co4' \\<Rightarrow> bool) \\<Rightarrow> ('co4' \\<Rightarrow> 'co4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co5 \\<Rightarrow> 'co5' \\<Rightarrow> bool) \\<Rightarrow> ('co5' \\<Rightarrow> 'co5'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool) \\<Rightarrow> ('contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool) \\<Rightarrow> ('contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra3 \\<Rightarrow> 'contra3' \\<Rightarrow> bool) \\<Rightarrow> ('contra3' \\<Rightarrow> 'contra3'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra4 \\<Rightarrow> 'contra4' \\<Rightarrow> bool) \\<Rightarrow> ('contra4' \\<Rightarrow> 'contra4'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra5 \\<Rightarrow> 'contra5' \\<Rightarrow> bool) \\<Rightarrow> ('contra5' \\<Rightarrow> 'contra5'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself \\<Rightarrow> bool\" where\n  \"rel_FGcontra_neg_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4' Co5 Co5'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' Contra5 Contra5' _ \\<longleftrightarrow>\n  (\\<forall>(L1 :: 'l1 \\<Rightarrow> 'l1' \\<Rightarrow> bool) (L1' :: 'l1' \\<Rightarrow> 'l1'' \\<Rightarrow> bool).\n    rel_FGcontra (L1 OO L1') (Co1 OO Co1') (Co2 OO Co2') (Co3 OO Co3') (Co4 OO Co4') (Co5 OO Co5')\n      (Contra1 OO Contra1') (Contra2 OO Contra2') (Contra3 OO Contra3')\n      (Contra4 OO Contra4') (Contra5 OO Contra5') \\<le>\n    (rel_FGcontra L1 Co1 Co2 Co3 Co4 Co5 Contra1 Contra2 Contra3 Contra4 Contra5 ::\n      (_, _, _, _, _, _, _, _, _, _, _, 'f1, 'f2) FGcontra \\<Rightarrow> _) OO\n      rel_FGcontra L1' Co1' Co2' Co3' Co4' Co5' Contra1' Contra2' Contra3' Contra4' Contra5')\"\n\ntext \\<open>Sufficient conditions for subdistributivity over relation composition.\\<close>\n\nlemma rel_FGcontra_pos_distr_imp:\n  fixes Co1 :: \"'co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool\" and Co1' :: \"'co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool\"\n    and Co3 :: \"'co3 \\<Rightarrow> 'co3' \\<Rightarrow> bool\" and Co3' :: \"'co3' \\<Rightarrow> 'co3'' \\<Rightarrow> bool\"\n    and Contra1 :: \"'contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool\" and Contra1' :: \"'contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool\"\n    and Contra2 :: \"'contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool\" and Contra2' :: \"'contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool\"\n    and tytok_F :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'co1 \\<times> 'co1' \\<times> 'co1'' \\<times> 'co3 \\<times> 'co3' \\<times> 'co3'' \\<times>\n      'f2) itself\"\n    and tytok_G :: \"('contra1 \\<times> 'contra1' \\<times> 'contra1'' \\<times> 'contra2 \\<times> 'contra2' \\<times> 'contra2'' \\<times>\n      'f1) itself\"\n    and tytok_FGcontra :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself\"\n  assumes \"rel_F_pos_distr_cond Co1 Co1' Co4 Co4' Co5 Co5'\n      (rel_G Contra1 Contra2 Contra3 Contra4 Co1 Co2 :: (_, _, _, _, _, _, 'f1) G \\<Rightarrow> _)\n      (rel_G Contra1' Contra2' Contra3' Contra4' Co1' Co2')\n      Contra1 Contra1' Contra5 Contra5' tytok_F\"\n    and \"rel_G_neg_distr_cond Contra3 Contra3' Contra4 Contra4' Co1 Co1' Co2 Co2' tytok_G\"\n  shows \"rel_FGcontra_pos_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4' Co5 Co5'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' Contra5 Contra5'\n    tytok_FGcontra\"\n  unfolding rel_FGcontra_pos_distr_cond_def rel_FGcontra_def\n  apply (intro allI)\n  apply (rule order_trans)\n   apply (rule rel_F_pos_distr)\n   apply (rule assms(1))\n  apply (rule rel_F_mono)\n          apply (rule order_refl)+\n    apply (rule rel_G_neg_distr)\n    apply (rule assms(2))\n   apply (rule order_refl)+\n  done\n\nlemma rel_FGcontra_neg_distr_imp:\n  fixes Co1 :: \"'co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool\" and Co1' :: \"'co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool\"\n    and Co3 :: \"'co3 \\<Rightarrow> 'co3' \\<Rightarrow> bool\" and Co3' :: \"'co3' \\<Rightarrow> 'co3'' \\<Rightarrow> bool\"\n    and Contra1 :: \"'contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool\" and Contra1' :: \"'contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool\"\n    and Contra2 :: \"'contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool\" and Contra2' :: \"'contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool\"\n    and tytok_F :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'co1 \\<times> 'co1' \\<times> 'co1'' \\<times> 'co3 \\<times> 'co3' \\<times> 'co3'' \\<times>\n      'f2) itself\"\n    and tytok_G :: \"('contra1 \\<times> 'contra1' \\<times> 'contra1'' \\<times> 'contra2 \\<times> 'contra2' \\<times> 'contra2'' \\<times>\n      'f1) itself\"\n    and tytok_FGcontra :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself\"\n  assumes \"rel_F_neg_distr_cond Co1 Co1' Co4 Co4' Co5 Co5'\n      (rel_G Contra1 Contra2 Contra3 Contra4 Co1 Co2 :: (_, _, _, _, _, _, 'f1) G \\<Rightarrow> _)\n      (rel_G Contra1' Contra2' Contra3' Contra4' Co1' Co2')\n      Contra1 Contra1' Contra5 Contra5' tytok_F\"\n    and \"rel_G_pos_distr_cond Contra3 Contra3' Contra4 Contra4' Co1 Co1' Co2 Co2' tytok_G\"\n  shows \"rel_FGcontra_neg_distr_cond Co1 Co1' Co2 Co2' Co3 Co3' Co4 Co4' Co5 Co5'\n    Contra1 Contra1' Contra2 Contra2' Contra3 Contra3' Contra4 Contra4' Contra5 Contra5' tytok_FGcontra\"\n  unfolding rel_FGcontra_neg_distr_cond_def rel_FGcontra_def\n  apply (intro allI)\n  apply (rule order_trans[rotated])\n   apply (rule rel_F_neg_distr)\n   apply (rule assms(1))\n  apply (rule rel_F_mono)\n          apply (rule order_refl)+\n    apply (rule rel_G_pos_distr)\n    apply (rule assms(2))\n   apply (rule order_refl)+\n  done\n\nlemma rel_FGcontra_pos_distr_cond_eq:\n  fixes tytok :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself\"\n  shows \"rel_FGcontra_pos_distr_cond (=) (=) (=) (=) (=) (=) (=) (=) (=) (=)\n    (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) tytok\"\n  apply (rule rel_FGcontra_pos_distr_imp)\n   apply (simp add: rel_G_eq)\n   apply (rule rel_F_pos_distr_cond_eq rel_G_neg_distr_cond_eq)+\n  done\n\nlemma rel_FGcontra_neg_distr_cond_eq:\n  fixes tytok :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'f1 \\<times> 'f2) itself\"\n  shows \"rel_FGcontra_neg_distr_cond (=) (=) (=) (=) (=) (=) (=) (=) (=) (=)\n    (=) (=) (=) (=) (=) (=) (=) (=) (=) (=) tytok\"\n  apply (rule rel_FGcontra_neg_distr_imp)\n   apply (simp add: rel_G_eq)\n   apply (rule rel_F_neg_distr_cond_eq rel_G_pos_distr_cond_eq)+\n  done\n\ndefinition \"rell_FGcontra L1 = rel_FGcontra L1 (=) (=) (=) (=) (=) (=) (=) (=) (=) (=)\"\ndefinition \"mapl_FGcontra l1 = map_FGcontra l1 id id id id id id id id id id\"\n\ntype_synonym ('co1, 'co2, 'co3, 'co4, 'co5, 'contra1, 'contra2, 'contra3, 'contra4, 'contra5,\n    'f1, 'f2) FGcontrabd =\n  \"('co1, 'co4, 'co5, ('contra1, 'contra2, 'contra3, 'contra4, 'co1, 'co2, 'f1) G,\n    'contra1, 'contra5, 'f2) Fbd\"\n\ndefinition set1_FGcontra :: \"('l1, 'co1, 'co2, 'co3, 'co4, 'co5,\n    'contra1, 'contra2, 'contra3, 'contra4, 'contra5, 'f1, 'f2) FGcontra \\<Rightarrow> 'l1 set\" where\n  \"set1_FGcontra x = set1_F x\"\n\ndefinition bd_FGcontra :: \"('co1, 'co2, 'co3, 'co4, 'co5,\n    'contra1, 'contra2, 'contra3, 'contra4, 'contra5, 'f1, 'f2) FGcontrabd rel\" where\n  \"bd_FGcontra = bd_F\"\n\nlemma set1_FGcontra_map: \"set1_FGcontra \\<circ> mapl_FGcontra l1 = image l1 \\<circ> set1_FGcontra\"\n  by (simp add: fun_eq_iff set1_FGcontra_def mapl_FGcontra_def map_FGcontra_def\n      mapl_F_def[symmetric] mapl_G_def[symmetric] mapl_G_id0\n      set1_F_map[THEN fun_cong, simplified])\n\nlemma bd_FGcontra_card_order: \"card_order bd_FGcontra\"\n  unfolding bd_FGcontra_def using bd_F_card_order .\n\nlemma bd_FGcontra_cinfinite: \"cinfinite bd_FGcontra\"\n  unfolding bd_FGcontra_def using bd_F_cinfinite .\n\nlemma set1_FGcontra_bound:\n  fixes x :: \"(_, 'co1, 'co2, 'co3, 'co4, 'co5,\n    'contra1, 'contra2, 'contra3, 'contra4, 'contra5, 'f1, 'f2) FGcontra\"\n  shows \"card_of (set1_FGcontra x) \\<le>o (bd_FGcontra :: ('co1, 'co2, 'co3, 'co4, 'co5,\n    'contra1, 'contra2, 'contra3, 'contra4, 'contra5, 'f1, 'f2) FGcontrabd rel)\"\n  unfolding set1_FGcontra_def bd_FGcontra_def using set1_F_bound .\n\n\n\nlemma rell_FGcontra_mono_strong:\n  assumes \"rell_FGcontra L1 x y\"\n    and \"\\<And>a b. a \\<in> set1_FGcontra x \\<Longrightarrow> b \\<in> set1_FGcontra y \\<Longrightarrow> L1 a b \\<Longrightarrow> L1' a b\"\n  shows \"rell_FGcontra L1' x y\"\n  using assms(1) unfolding rell_FGcontra_def rel_FGcontra_def rel_G_eq rell_F_def[symmetric]\n  by (auto 0 3 intro: rell_F_mono_strong assms(2) simp add: set1_FGcontra_def)\n\n\nsubsection \\<open>Composition in a fixed position\\<close>\n\ntype_synonym ('l1, 'l2, 'co1, 'co2, 'contra1, 'contra2, 'f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) FGf =\n  \"('l1, 'l2, 'f2, 'co1, 'co2, 'f4, 'contra1, 'contra2, 'f6, ('f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) G) F\"\n\ntext \\<open>The type variables @{typ 'f2}, @{typ 'f4} and @{typ 'f6} have each been merged.\\<close>\n\ndefinition \"rel_FGf L1 L2 Co1 Co2 Contra1 Contra2 =\n  rel_F L1 L2 (=) Co1 Co2 (=) Contra1 Contra2 (=)\"\n\ndefinition \"map_FGf l1 l2 co1 co2 contra1 contra2 = map_F l1 l2 id co1 co2 id contra1 contra2 id\"\n\nlemma rel_FGf_mono:\n  \"\\<lbrakk> L1 \\<le> L1'; L2 \\<le> L2'; Co1 \\<le> Co1'; Co2 \\<le> Co2'; Contra1' \\<le> Contra1; Contra2' \\<le> Contra2 \\<rbrakk> \\<Longrightarrow>\n  rel_FGf L1 L2 Co1 Co2 Contra1 Contra2 \\<le> rel_FGf L1' L2' Co1' Co2' Contra1' Contra2'\"\n  unfolding rel_FGf_def by (rule rel_F_mono) (auto)\n\nlemma rel_FGf_eq: \"rel_FGf (=) (=) (=) (=) (=) (=) = (=)\"\n  unfolding rel_FGf_def by (simp add: rel_F_eq)\n\nlemma rel_FGf_conversep:\n  \"rel_FGf L1\\<inverse>\\<inverse> L2\\<inverse>\\<inverse> Co1\\<inverse>\\<inverse> Co2\\<inverse>\\<inverse> Contra1\\<inverse>\\<inverse> Contra2\\<inverse>\\<inverse> = (rel_FGf L1 L2 Co1 Co2 Contra1 Contra2)\\<inverse>\\<inverse>\"\n  unfolding rel_FGf_def by (simp add: rel_F_conversep[symmetric])\n\nlemma map_FGf_id0: \"map_FGf id id id id id id = id\"\n  unfolding map_FGf_def by (simp add: map_F_id0)\n\nlemma map_FGf_comp: \"map_FGf l1 l2 co1 co2 contra1 contra2 \\<circ>\n  map_FGf l1' l2' co1' co2' contra1' contra2' =\n  map_FGf (l1 \\<circ> l1') (l2 \\<circ> l2') (co1 \\<circ> co1') (co2 \\<circ> co2') (contra1' \\<circ> contra1) (contra2' \\<circ> contra2)\"\n  unfolding map_FGf_def by (simp add: map_F_comp)\n\nlemma map_FGf_parametric:\n  \"rel_fun (rel_fun L1 L1') (rel_fun (rel_fun L2 L2')\n    (rel_fun (rel_fun Co1 Co1') (rel_fun (rel_fun Co2 Co2')\n  (rel_fun (rel_fun Contra1' Contra1) (rel_fun (rel_fun Contra2' Contra2)\n  (rel_fun (rel_FGf L1 L2 Co1 Co2 Contra1 Contra2)\n  (rel_FGf L1' L2' Co1' Co2' Contra1' Contra2')))))))\n  map_FGf map_FGf\"\n  unfolding rel_FGf_def map_FGf_def\n  apply (intro rel_funI)\n  apply (elim map_F_rel_cong)\n          apply (simp_all)\n       apply (erule (2) rel_funE)+\n  done\n\ndefinition rel_FGf_pos_distr_cond :: \"('co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool) \\<Rightarrow> ('co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool) \\<Rightarrow> ('co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool) \\<Rightarrow> ('contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool) \\<Rightarrow> ('contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times>\n      'f1 \\<times> 'f2 \\<times> 'f3 \\<times> 'f4 \\<times> 'f5 \\<times> 'f6 \\<times> 'f7) itself \\<Rightarrow> bool\" where\n  \"rel_FGf_pos_distr_cond Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' _ \\<longleftrightarrow>\n  (\\<forall>(L1 :: 'l1 \\<Rightarrow> 'l1' \\<Rightarrow> bool) (L1' :: 'l1' \\<Rightarrow> 'l1'' \\<Rightarrow> bool)\n    (L2 :: 'l2 \\<Rightarrow> 'l2' \\<Rightarrow> bool) (L2' :: 'l2' \\<Rightarrow> 'l2'' \\<Rightarrow> bool).\n    (rel_FGf L1 L2 Co1 Co2 Contra1 Contra2 ::\n      (_, _, _, _, _, _, 'f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) FGf \\<Rightarrow> _) OO\n      rel_FGf L1' L2' Co1' Co2' Contra1' Contra2' \\<le>\n    rel_FGf (L1 OO L1') (L2 OO L2') (Co1 OO Co1') (Co2 OO Co2')\n      (Contra1 OO Contra1') (Contra2 OO Contra2'))\"\n\ndefinition rel_FGf_neg_distr_cond :: \"('co1 \\<Rightarrow> 'co1' \\<Rightarrow> bool) \\<Rightarrow> ('co1' \\<Rightarrow> 'co1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('co2 \\<Rightarrow> 'co2' \\<Rightarrow> bool) \\<Rightarrow> ('co2' \\<Rightarrow> 'co2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra1 \\<Rightarrow> 'contra1' \\<Rightarrow> bool) \\<Rightarrow> ('contra1' \\<Rightarrow> 'contra1'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('contra2 \\<Rightarrow> 'contra2' \\<Rightarrow> bool) \\<Rightarrow> ('contra2' \\<Rightarrow> 'contra2'' \\<Rightarrow> bool) \\<Rightarrow>\n    ('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times>\n      'f1 \\<times> 'f2 \\<times> 'f3 \\<times> 'f4 \\<times> 'f5 \\<times> 'f6 \\<times> 'f7) itself \\<Rightarrow> bool\" where\n  \"rel_FGf_neg_distr_cond Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' _ \\<longleftrightarrow>\n  (\\<forall>(L1 :: 'l1 \\<Rightarrow> 'l1' \\<Rightarrow> bool) (L1' :: 'l1' \\<Rightarrow> 'l1'' \\<Rightarrow> bool)\n    (L2 :: 'l2 \\<Rightarrow> 'l2' \\<Rightarrow> bool) (L2' :: 'l2' \\<Rightarrow> 'l2'' \\<Rightarrow> bool).\n    rel_FGf (L1 OO L1') (L2 OO L2') (Co1 OO Co1') (Co2 OO Co2')\n      (Contra1 OO Contra1') (Contra2 OO Contra2') \\<le>\n    (rel_FGf L1 L2 Co1 Co2 Contra1 Contra2 ::\n      (_, _, _, _, _, _,'f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) FGf \\<Rightarrow> _) OO\n      rel_FGf L1' L2' Co1' Co2' Contra1' Contra2')\"\n\ntext \\<open>Sufficient conditions for subdistributivity over relation composition.\\<close>\n\nlemma rel_FGf_pos_distr_imp:\n  fixes tytok_F :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times> 'f2 \\<times> 'f2 \\<times> 'f2 \\<times>\n      ('f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) G) itself\"\n    and tytok_FGf :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times>\n      'f1 \\<times> 'f2 \\<times> 'f3 \\<times> 'f4 \\<times> 'f5 \\<times> 'f6 \\<times> 'f7) itself\"\n  assumes \"rel_F_pos_distr_cond Co1 Co1' Co2 Co2' ((=) :: 'f4 \\<Rightarrow> _) ((=) :: 'f4 \\<Rightarrow> _)\n      Contra1 Contra1' Contra2 Contra2' ((=) :: 'f6 \\<Rightarrow> _) ((=) :: 'f6 \\<Rightarrow> _) tytok_F\"\n  shows \"rel_FGf_pos_distr_cond Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' tytok_FGf\"\n  unfolding rel_FGf_pos_distr_cond_def rel_FGf_def\n  apply (intro allI)\n  apply (rule order_trans)\n   apply (rule rel_F_pos_distr)\n   apply (rule assms(1))\n  apply (rule rel_F_mono)\n          apply (simp_all add: eq_OO)\n  done\n\nlemma rel_FGf_neg_distr_imp:\n  fixes tytok_F :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times> 'f2 \\<times> 'f2 \\<times> 'f2 \\<times>\n      ('f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) G) itself\"\n    and tytok_FGf :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times>\n      'f1 \\<times> 'f2 \\<times> 'f3 \\<times> 'f4 \\<times> 'f5 \\<times> 'f6 \\<times> 'f7) itself\"\n  assumes \"rel_F_neg_distr_cond Co1 Co1' Co2 Co2' ((=) :: 'f4 \\<Rightarrow> _) ((=) :: 'f4 \\<Rightarrow> _)\n      Contra1 Contra1' Contra2 Contra2' ((=) :: 'f6 \\<Rightarrow> _) ((=) :: 'f6 \\<Rightarrow> _) tytok_F\"\n  shows \"rel_FGf_neg_distr_cond Co1 Co1' Co2 Co2' Contra1 Contra1' Contra2 Contra2' tytok_FGf\"\n  unfolding rel_FGf_neg_distr_cond_def rel_FGf_def\n  apply (intro allI)\n  apply (rule order_trans[rotated])\n   apply (rule rel_F_neg_distr)\n   apply (rule assms(1))\n  apply (rule rel_F_mono)\n          apply (simp_all add: eq_OO)\n  done\n\nlemma rel_FGf_pos_distr_cond_eq:\n  fixes tytok :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times>\n      'f1 \\<times> 'f2 \\<times> 'f3 \\<times> 'f4 \\<times> 'f5 \\<times> 'f6 \\<times> 'f7) itself\"\n  shows \"rel_FGf_pos_distr_cond (=) (=) (=) (=) (=) (=) (=) (=) tytok\"\n  by (intro rel_FGf_pos_distr_imp rel_F_pos_distr_cond_eq)\n\nlemma rel_FGf_neg_distr_cond_eq:\n  fixes tytok :: \"('l1 \\<times> 'l1' \\<times> 'l1'' \\<times> 'l2 \\<times> 'l2' \\<times> 'l2'' \\<times>\n      'f1 \\<times> 'f2 \\<times> 'f3 \\<times> 'f4 \\<times> 'f5 \\<times> 'f6 \\<times> 'f7) itself\"\n  shows \"rel_FGf_neg_distr_cond (=) (=) (=) (=) (=) (=) (=) (=) tytok\"\n  by (intro rel_FGf_neg_distr_imp rel_F_neg_distr_cond_eq)\n\ndefinition \"rell_FGf L1 L2 = rel_FGf L1 L2 (=) (=) (=) (=)\"\ndefinition \"mapl_FGf l1 l2 = map_FGf l1 l2 id id id id\"\n\ntype_synonym ('co1, 'co2, 'contra1, 'contra2, 'f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) FGfbd =\n  \"('co1, 'co2, 'f4, 'contra1, 'contra2, 'f6, ('f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) G) Fbd\"\n\ndefinition set1_FGf :: \"('l1, 'l2, 'co1, 'co2, 'contra1, 'contra2,\n    'f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) FGf \\<Rightarrow> 'l1 set\" where\n  \"set1_FGf x = set1_F x\"\n\ndefinition set2_FGf :: \"('l1, 'l2, 'co1, 'co2, 'contra1, 'contra2,\n    'f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) FGf \\<Rightarrow> 'l2 set\" where\n  \"set2_FGf x = set2_F x\"\n\ndefinition bd_FGf :: \"('co1, 'co2, 'contra1, 'contra2, 'f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) FGfbd rel\"\n  where \"bd_FGf = bd_F\"\n\nlemma set1_FGf_map: \"set1_FGf \\<circ> mapl_FGf l1 l2 = image l1 \\<circ> set1_FGf\"\n  by (simp add: fun_eq_iff set1_FGf_def mapl_FGf_def map_FGf_def mapl_F_def[symmetric]\n      set1_F_map[THEN fun_cong, simplified])\n\nlemma bd_FGf_card_order: \"card_order bd_FGf\"\n  unfolding bd_FGf_def using bd_F_card_order .\n\nlemma bd_FGf_cinfinite: \"cinfinite bd_FGf\"\n  unfolding bd_FGf_def using bd_F_cinfinite .\n\nlemma\n  fixes x :: \"(_, _, 'co1, 'co2, 'contra1, 'contra2, 'f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) FGf\"\n  shows set1_FGf_bound: \"card_of (set1_FGf x) \\<le>o (bd_FGf :: ('co1, 'co2, 'contra1, 'contra2,\n      'f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) FGfbd rel)\"\n    and set2_FGf_bound: \"card_of (set2_FGf x) \\<le>o (bd_FGf :: ('co1, 'co2, 'contra1, 'contra2,\n      'f1, 'f2, 'f3, 'f4, 'f5, 'f6, 'f7) FGfbd rel)\"\n  unfolding set1_FGf_def set2_FGf_def bd_FGf_def by (rule set1_F_bound set2_F_bound)+\n\nlemma mapl_FGf_cong:\n  assumes \"\\<And>z. z \\<in> set1_FGf x \\<Longrightarrow> l1 z = l1' z\" and \"\\<And>z. z \\<in> set2_FGf x \\<Longrightarrow> l2 z = l2' z\"\n  shows \"mapl_FGf l1 l2 x = mapl_FGf l1' l2' x\"\n  unfolding mapl_FGf_def map_FGf_def mapl_F_def[symmetric]\n  by (auto 0 3 intro: mapl_F_cong assms simp add: set1_FGf_def set2_FGf_def)\n\nlemma rell_FGf_mono_strong:\n  assumes \"rell_FGf L1 L2 x y\"\n    and \"\\<And>a b. a \\<in> set1_FGf x \\<Longrightarrow> b \\<in> set1_FGf y \\<Longrightarrow> L1 a b \\<Longrightarrow> L1' a b\"\n    and \"\\<And>a b. a \\<in> set2_FGf x \\<Longrightarrow> b \\<in> set2_FGf y \\<Longrightarrow> L2 a b \\<Longrightarrow> L2' a b\"\n  shows \"rell_FGf L1' L2' x y\"\n  using assms(1) unfolding rell_FGf_def rel_FGf_def rell_F_def[symmetric]\n  by (auto 0 3 intro: rell_F_mono_strong assms(2-3) simp add: set1_FGf_def set2_FGf_def)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BNF_CC/Composition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.3094639279221546}}
{"text": "(*\n * Copyright (c) 2020, CleanQ Project - Systems Group, ETH Zurich\n * All rights reserved.\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n *\n * See \"LICENSE\" for details.\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n\n\ntheory Refinements\n  imports SimplEmbedding\nbegin\n\ntext \\<open>A `program', or the subject of the refinement relation is a computation plus its function-call\n  closure and a precondition.\\<close>\ntype_synonym ('s,'p,'f) program_s =\n  \"(('s,'p,'f) Semantic.body \\<times> ('s,'f) Semantic.xstate set \\<times> ('s,'p,'f) Language.com)\"\n\ntext \\<open>The state relation is a lifting function from concrete to abstract.\\<close>\ntype_synonym ('sa,'fa,'sc,'fc) xstate_lift_s =\n  \"('sc,'fc) Semantic.xstate \\<Rightarrow> ('sa,'fa) Semantic.xstate\"\n\ntext \\<open>Refinement is a relation on programs.\\<close>\ntype_synonym ('sa,'pa,'fa,'sc,'pc,'fc) refinement_s =\n  \"(('sa,'pa,'fa) program_s \\<times> ('sc,'pc,'fc) program_s) set\"\n\ntext \\<open>General data refinement of abstract computation ca with context \\<Gamma>a by concrete computation\n  cc with context \\<Gamma>c.  For any concrete state xsc satisfying the concrete precondition,\n  if the concrete computation takes a step to a state xsc', then the abstract computation must be\n  able to step from the lifted xsc to the lifted xsc', such that the remaining abstract computation\n  is still refined by the remaining concrete computation.  This inductive refinment need only hold\n  for this specific new state.\n\n  The abstract precondition must be weak enough to encompass all valid concrete starting states, and\n  is thus satisfied by construction.  This condition is necessary for refinement to compose.\n\n  Moreover, the refinement may only terminate if the specification also terminates, and throws a\n  fault exactly when the specification does.\\<close>\ninductive_set refinement_s ::\n  \"('sa,'fa,'sc,'fc) xstate_lift_s \\<Rightarrow> ('sa,'pa,'fa,'sc,'pc,'fc) refinement_s\"\n  for xsl :: \"('sa,'fa,'sc,'fc) xstate_lift_s\"\n  where Step:\n    \"(\\<And>xsc xsc' cc'.\n      xsc \\<in> Pc \\<Longrightarrow>\n      SmallStep.step \\<Gamma>c (cc,xsc) (cc',xsc') \\<Longrightarrow>\n      (\\<exists>ca'. SmallStep.step \\<Gamma>a (ca,xsl xsc) (ca',xsl xsc') \\<and>\n             ((\\<Gamma>a,{xsl xsc'},ca'),(\\<Gamma>c,{xsc'},cc')) \\<in> refinement_s xsl)) \\<Longrightarrow>\n      xsl ` Pc \\<subseteq> Pa \\<Longrightarrow>\n      (cc = Language.Skip \\<Longrightarrow> ca = Language.Skip) \\<Longrightarrow>\n      (cc = Language.Throw \\<longleftrightarrow> ca = Language.Throw) \\<Longrightarrow>\n      ((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n\ntext \\<open>An elimination rule form of the above lemma, making it easy to access an equivalent abstract\n  transition in proofs.\\<close>\nlemma refinement_s_stepE:\n    fixes Pa Pc xsl \\<Gamma>a \\<Gamma>c xsc xsc' ca cc cc'\n    assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and Pc: \"xsc \\<in> Pc\"\n      and concrete_step: \"SmallStep.step \\<Gamma>c (cc,xsc) (cc',xsc')\"\n  obtains (abstract_step) ca'\n    where \"SmallStep.step \\<Gamma>a (ca,xsl xsc) (ca',xsl xsc')\"\n      and \"((\\<Gamma>a,{xsl xsc'},ca'),(\\<Gamma>c,{xsc'},cc')) \\<in> refinement_s xsl\"\n  using refines\nproof(cases rule:refinement_s.cases)\n  case Step\n  with Pc concrete_step obtain ca'\n    where stepa: \"SmallStep.step \\<Gamma>a (ca, xsl xsc) (ca', xsl xsc')\"\n      and refines': \"((\\<Gamma>a,{xsl xsc'},ca'),(\\<Gamma>c,{xsc'},cc')) \\<in> refinement_s xsl\"\n    by(blast)\n\n  from stepa refines' show ?thesis\n    by(rule abstract_step)\nqed\n\ntext \\<open>The concrete precondition is stricter than the abstract.\\<close>\nlemma refinement_s_stricter_pre:\n  fixes Pa Pc xsl \\<Gamma>a \\<Gamma>c ca cc\n  assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n  shows \"xsl ` Pc \\<subseteq> Pa\"\n  using assms by(cases, auto)\n\ntext \\<open>A mode-preserving lifting function only relates Normal-Normal etc.\\<close>\ndefinition\n  mode_preserving :: \"('sa,'fa,'sc,'fc) xstate_lift_s \\<Rightarrow> bool\"\nwhere\n  \"mode_preserving xsl \\<longleftrightarrow> (\\<forall>xsc.\n    (((\\<exists>sa. xsl xsc = Semantic.Normal sa) \\<longleftrightarrow> (\\<exists>sc. xsc = Semantic.Normal sc)) \\<and>\n     ((\\<exists>sa. xsl xsc = Semantic.Abrupt sa) \\<longleftrightarrow> (\\<exists>sc. xsc = Semantic.Abrupt sc)) \\<and>\n     ((\\<exists>fa. xsl xsc = Semantic.Fault fa) \\<longleftrightarrow> (\\<exists>fc. xsc = Semantic.Fault fc)) \\<and>\n     (xsl xsc = Semantic.Stuck \\<longleftrightarrow> xsc = Semantic.Stuck)))\"\n\nlemma mode_preserving_NormalaE:\n  assumes mp: \"mode_preserving xsl\"\n      and normala: \"xsl xsc = Semantic.Normal sa\"\n  obtains (normalc) sc where \"xsc = Semantic.Normal sc\"\nproof -\n  from normala have \"\\<exists>sa. xsl xsc = Semantic.Normal sa\"\n    by(auto)\n  with allE[OF mp[unfolded mode_preserving_def], of xsc]\n  have \"\\<exists>sc. xsc = Semantic.Normal sc\"\n    by(blast)\n  then obtain sc where \"xsc = Semantic.Normal sc\"\n    by(blast)\n  thus thesis\n    by(rule normalc)\nqed\n\nlemma mode_preserving_NormalcE:\n  assumes mp: \"mode_preserving xsl\"\n      and normalc: \"xsc = Semantic.Normal sc\"\n  obtains (normala) sa where \"xsl xsc = Semantic.Normal sa\"\nproof -\n  from normalc have \"\\<exists>sc. xsc = Semantic.Normal sc\"\n    by(auto)\n  with allE[OF mp[unfolded mode_preserving_def], of xsc]\n  have \"\\<exists>sa. xsl xsc = Semantic.Normal sa\"\n    by(blast)\n  then obtain sa where \"xsl xsc = Semantic.Normal sa\"\n    by(blast)\n  thus thesis\n    by(rule normala)\nqed\n\nlemma mode_preserving_AbruptaE:\n  assumes mp: \"mode_preserving xsl\"\n      and abrupta: \"xsl xsc = Semantic.Abrupt sa\"\n  obtains (abruptc) sc where \"xsc = Semantic.Abrupt sc\"\nproof -\n  from abrupta have \"\\<exists>sa. xsl xsc = Semantic.Abrupt sa\"\n    by(auto)\n  with allE[OF mp[unfolded mode_preserving_def], of xsc]\n  have \"\\<exists>sc. xsc = Semantic.Abrupt sc\"\n    by(blast)\n  then obtain sc where \"xsc = Semantic.Abrupt sc\"\n    by(blast)\n  thus thesis\n    by(rule abruptc)\nqed\n\nlemma mode_preserving_AbruptcE:\n  assumes mp: \"mode_preserving xsl\"\n      and abruptc: \"xsc = Semantic.Abrupt sc\"\n  obtains (abrupta) sa where \"xsl xsc = Semantic.Abrupt sa\"\nproof -\n  from abruptc have \"\\<exists>sc. xsc = Semantic.Abrupt sc\"\n    by(auto)\n  with allE[OF mp[unfolded mode_preserving_def], of xsc]\n  have \"\\<exists>sa. xsl xsc = Semantic.Abrupt sa\"\n    by(blast)\n  then obtain sa where \"xsl xsc = Semantic.Abrupt sa\"\n    by(blast)\n  thus thesis\n    by(rule abrupta)\nqed\n\nlemma mode_preserving_FaultaE:\n  assumes mp: \"mode_preserving xsl\"\n      and faulta: \"xsl xsc = Semantic.Fault fa\"\n  obtains (faultc) sc where \"xsc = Semantic.Fault sc\"\nproof -\n  from faulta have \"\\<exists>sa. xsl xsc = Semantic.Fault sa\"\n    by(auto)\n  with allE[OF mp[unfolded mode_preserving_def], of xsc]\n  have \"\\<exists>sc. xsc = Semantic.Fault sc\"\n    by(blast)\n  then obtain sc where \"xsc = Semantic.Fault sc\"\n    by(blast)\n  thus thesis\n    by(rule faultc)\nqed\n\nlemma mode_preserving_FaultcE:\n  assumes mp: \"mode_preserving xsl\"\n      and faultc: \"xsc = Semantic.Fault sc\"\n  obtains (faulta) sa where \"xsl xsc = Semantic.Fault sa\"\nproof -\n  from faultc have \"\\<exists>sc. xsc = Semantic.Fault sc\"\n    by(auto)\n  with allE[OF mp[unfolded mode_preserving_def], of xsc]\n  have \"\\<exists>sa. xsl xsc = Semantic.Fault sa\"\n    by(blast)\n  then obtain sa where \"xsl xsc = Semantic.Fault sa\"\n    by(blast)\n  thus thesis\n    by(rule faulta)\nqed\n\nlemma mode_preserving_StuckaE:\n  assumes mp: \"mode_preserving xsl\"\n      and stucka: \"xsl xsc = Semantic.Stuck\"\n    shows \"xsc = Semantic.Stuck\"\nproof -\n  from stucka have \"xsl xsc = Semantic.Stuck\"\n    by(auto)\n  with allE[OF mp[unfolded mode_preserving_def], of xsc]\n  show \"xsc = Semantic.Stuck\"\n    by(blast)\nqed\n\nlemma mode_preserving_StuckcE:\n  assumes mp: \"mode_preserving xsl\"\n      and stuckc: \"xsc = Semantic.Stuck\"\n    shows \"xsl xsc = Semantic.Stuck\"\nproof -\n  from stuckc have \"xsc = Semantic.Stuck\"\n    by(auto)\n  with allE[OF mp[unfolded mode_preserving_def], of xsc]\n  show \"xsl xsc = Semantic.Stuck\"\n    by(blast)\nqed\n\nlemma refinement_s_finalE:\n    fixes Pa Pc xsl \\<Gamma>a \\<Gamma>c ca cc\n  assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and mp: \"mode_preserving xsl\"\n      and finalc: \"SmallStep.final (cc,xsc)\"\n    shows \"SmallStep.final (ca,xsl xsc)\"\n  using assms unfolding mode_preserving_def SmallStep.final_def\n  by(auto elim:refinement_s.cases)\n\nlemma refinement_s_skipcE:\n  fixes Pa Pc xsl \\<Gamma>a \\<Gamma>c ca cc\n  assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and throw: \"cc = Language.Skip\"\n  shows \"ca = Language.Skip\"\n  using assms by(auto elim:refinement_s.cases)\n\nlemma refinement_s_throwcE:\n  fixes Pa Pc xsl \\<Gamma>a \\<Gamma>c ca cc\n  assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and throw: \"cc = Language.Throw\"\n  shows \"ca = Language.Throw\"\n  using assms by(auto elim:refinement_s.cases)\n\nlemma refinement_s_throwaE:\n  fixes Pa Pc xsl \\<Gamma>a \\<Gamma>c ca cc\n  assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and throw: \"ca = Language.Throw\"\n  shows \"cc = Language.Throw\"\n  using assms by(auto elim:refinement_s.cases)\n\nlemma refinement_s_throweq:\n  fixes Pa Pc xsl \\<Gamma>a \\<Gamma>c ca cc\n  assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n  shows \"(cc = Language.Throw) = (ca = Language.Throw)\"\n  using assms by(auto elim:refinement_s.cases)\n\nlemma refinement_s_strengthen:\n    fixes xsl \\<Gamma>a \\<Gamma>c Pa Pc Pa' Pc' ca cc\n  assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and strengthenc: \"Pc' \\<subseteq> Pc\"\n      and consistent: \"xsl ` Pc' \\<subseteq> Pa'\"\n    shows \"((\\<Gamma>a, Pa', ca), (\\<Gamma>c, Pc', cc)) \\<in> refinement_s xsl\"\nproof\n    fix xsc xsc' cc'\n\n    assume \"xsc \\<in> Pc'\"\n    with strengthenc have Pc: \"xsc \\<in> Pc\" by(auto)\n\n    assume step: \"SmallStep.step \\<Gamma>c (cc,xsc) (cc',xsc')\"\n    \n    from refinement_s_stepE[OF refines Pc step]\n    obtain ca'\n      where \"SmallStep.step \\<Gamma>a (ca,xsl xsc) (ca',xsl xsc')\"\n        and \"((\\<Gamma>a,{xsl xsc'},ca'),(\\<Gamma>c,{xsc'},cc')) \\<in> refinement_s xsl\"\n      by(blast)\n    thus \"\\<exists>ca'.\n          SmallStep.step \\<Gamma>a (ca, xsl xsc) (ca', xsl xsc') \\<and>\n          ((\\<Gamma>a, {xsl xsc'}, ca'), \\<Gamma>c, {xsc'}, cc') \\<in> refinement_s xsl\"\n      by(blast)\n  next\n    from consistent show \"xsl ` Pc' \\<subseteq> Pa'\" .\n  next\n    assume \"cc = Language.Skip\"\n    with refines show \"ca = Language.Skip\"\n      by(rule refinement_s_skipcE)\n  next\n    from refines show \"(cc = Language.Throw) = (ca = Language.Throw)\"\n      by(auto elim:refinement_s_throwcE refinement_s_throwaE)\nqed\n\ntext \\<open>Refinement composes transitively.\\<close>\nlemma refinement_s_trans:\n  shows \"(refinement_s xsl_ab :: ('sa,'pa,'fa,'sb,'pb,'fb) refinement_s) O\n         (refinement_s xsl_bc :: ('sb,'pb,'fb,'sc,'pc,'fc) refinement_s) \\<subseteq>\n          refinement_s (xsl_ab o xsl_bc)\"\nproof\n  fix x :: \"('sa,'pa,'fa) program_s \\<times> ('sc,'pc,'fc) program_s\"\n  obtain \\<Gamma>a \\<Gamma>c Pa Pc ca cc\n    where rw_x: \"x = ((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc))\"\n    by(cases x, auto)\n\n  assume \"x \\<in> (refinement_s xsl_ab :: ('sa,'pa,'fa,'sb,'pb,'fb) refinement_s) O\n              (refinement_s xsl_bc :: ('sb,'pb,'fb,'sc,'pc,'fc) refinement_s)\"\n  hence \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in>\n            (refinement_s xsl_ab :: ('sa,'pa,'fa,'sb,'pb,'fb) refinement_s) O\n            (refinement_s xsl_bc :: ('sb,'pb,'fb,'sc,'pc,'fc) refinement_s)\"\n    by(simp add:rw_x)\n\n  then obtain \\<Gamma>b :: \"('sb,'pb,'fb) Semantic.body\"\n          and Pb :: \"('sb,'fb) Semantic.xstate set\"\n          and cb :: \"('sb,'pb,'fb) Language.com\"\n    where refines_ab: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>b,Pb,cb)) \\<in> refinement_s xsl_ab\"\n      and refines_bc: \"((\\<Gamma>b,Pb,cb),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl_bc\"\n    by(auto)\n\n  from refines_ab refines_bc\n  show \"x \\<in> refinement_s (xsl_ab o xsl_bc)\"\n    unfolding rw_x\n  proof(induct \\<Gamma>a Pa ca \\<Gamma>b Pb cb arbitrary:Pc cc rule: refinement_s.induct)\n    case (Step Pb \\<Gamma>b cb \\<Gamma>a ca Pa)\n\n    show ?case\n    proof(rule refinement_s.Step)\n      fix xsc xsc' cc'\n\n      assume Pc: \"xsc \\<in> Pc\"\n         and stepc: \"SmallStep.step \\<Gamma>c (cc,xsc) (cc',xsc')\"\n\n      from Pc refinement_s_stricter_pre[OF Step.prems]\n      have Pb: \"xsl_bc xsc \\<in> Pb\"\n        by(auto)\n\n      from refinement_s_stepE[OF Step.prems Pc stepc] obtain cb'\n        where stepb: \"SmallStep.step \\<Gamma>b (cb,xsl_bc xsc) (cb',xsl_bc xsc')\"\n          and refines_bc': \"((\\<Gamma>b, {xsl_bc xsc'}, cb'), \\<Gamma>c, {xsc'}, cc') \\<in> refinement_s xsl_bc\"\n        by(blast)\n\n      from Step.hyps(1)[OF Pb stepb] obtain ca'\n        where stepa: \"SmallStep.step \\<Gamma>a (ca,xsl_ab (xsl_bc xsc)) (ca',xsl_ab (xsl_bc xsc'))\"\n          and refines_ab': \"((\\<Gamma>a,{xsl_ab (xsl_bc xsc')},ca'), (\\<Gamma>b,{xsl_bc xsc'},cb')) \\<in> refinement_s xsl_ab\"\n          and IH: \"(\\<forall>x xa.\n            ((\\<Gamma>b, {xsl_bc xsc'}, cb'), (\\<Gamma>c, x, xa)) \\<in> refinement_s xsl_bc \\<longrightarrow>\n            ((\\<Gamma>a, {xsl_ab (xsl_bc xsc')}, ca'), (\\<Gamma>c, x, xa)) \\<in> refinement_s (xsl_ab \\<circ> xsl_bc))\"\n        by(blast)\n\n      from stepa have \"SmallStep.step \\<Gamma>a (ca,(xsl_ab \\<circ> xsl_bc) xsc) (ca',(xsl_ab \\<circ> xsl_bc) xsc')\"\n        by(simp)\n      moreover from refines_bc' IH\n      have \"((\\<Gamma>a,{(xsl_ab \\<circ> xsl_bc) xsc'},ca'), (\\<Gamma>c,{xsc'},cc')) \\<in> refinement_s (xsl_ab \\<circ> xsl_bc)\"\n        by(auto)\n      ultimately show \"\\<exists>ca'.\n        SmallStep.step \\<Gamma>a (ca, (xsl_ab \\<circ> xsl_bc) xsc) (ca', (xsl_ab \\<circ> xsl_bc) xsc') \\<and>\n        ((\\<Gamma>a,{(xsl_ab \\<circ> xsl_bc) xsc'},ca'), (\\<Gamma>c,{xsc'},cc')) \\<in> refinement_s (xsl_ab \\<circ> xsl_bc)\"\n        by(blast)\n\n    next\n      show \"(xsl_ab \\<circ> xsl_bc) ` Pc \\<subseteq> Pa\"\n      proof\n        fix xsa\n        assume \"xsa \\<in> (xsl_ab \\<circ> xsl_bc) ` Pc\"\n        moreover {\n          from Step.prems have \"xsl_bc ` Pc \\<subseteq> Pb\"\n            by(rule refinement_s_stricter_pre)\n          hence \"(xsl_ab o xsl_bc) ` Pc \\<subseteq> xsl_ab ` Pb\"\n            by(auto)\n        }\n        also note Step.hyps(2)\n        finally show \"xsa \\<in> Pa\" .\n      qed\n\n    next\n      assume \"cc = Language.Skip\"\n      with Step.prems have \"cb = Language.Skip\"\n        by(rule refinement_s_skipcE)\n      thus \"ca = Language.Skip\"\n        by(rule Step.hyps(3))\n\n    next\n      from Step.prems have \"(cc = Language.Throw) = (cb = Language.Throw)\"\n        by(rule refinement_s_throweq)\n      also note Step.hyps(4)\n      finally show \"(cc = THROW) = (ca = THROW)\" .\n    qed\n  qed\nqed\n\nlemma refinement_steps:\n    fixes xsl \\<Gamma>a \\<Gamma>c Pa Pc xsc xsc' ca cc cc'\n  assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and Pc: \"xsc \\<in> Pc\"\n      and concrete_steps: \"(rtranclp (SmallStep.step \\<Gamma>c)) (cc,xsc) (cc',xsc')\"\n    shows \"\\<exists>ca'.\n      ((\\<Gamma>a,{xsl xsc'},ca'),(\\<Gamma>c,{xsc'},cc')) \\<in> refinement_s xsl \\<and>\n      (rtranclp (SmallStep.step \\<Gamma>a)) (ca,xsl xsc) (ca',xsl xsc')\"\n  using concrete_steps\nproof(induct cc' xsc' rule:rtranclp_induct2)\n  case refl\n\n  from refines Pc\n  have \"((\\<Gamma>a, {xsl xsc}, ca), \\<Gamma>c, {xsc}, cc) \\<in> refinement_s xsl\"\n    by(auto intro:refinement_s_strengthen)\n  moreover have \"(rtranclp (SmallStep.step \\<Gamma>a)) (ca,xsl xsc) (ca,xsl xsc)\"\n    by(blast)\n  ultimately show ?case\n    by(blast)\n\nnext\n  case (step cc' xsc' cc'' xsc'')\n  then obtain ca'\n    where refines': \"((\\<Gamma>a,{xsl xsc'},ca'), (\\<Gamma>c,{xsc'},cc')) \\<in> refinement_s xsl\"\n      and stepsa: \"(rtranclp (SmallStep.step \\<Gamma>a)) (ca, xsl xsc) (ca',xsl xsc')\"\n    by(blast)\n\n  from refines' step(2)\n  obtain ca''\n    where refines'': \"((\\<Gamma>a,{xsl xsc''},ca''),(\\<Gamma>c,{xsc''},cc'')) \\<in> refinement_s xsl\"\n      and stepa: \"SmallStep.step \\<Gamma>a (ca',xsl xsc') (ca'',xsl xsc'')\"\n    by(blast elim:refinement_s_stepE)\n\n  from stepsa stepa have \"(rtranclp (SmallStep.step \\<Gamma>a)) (ca, xsl xsc) (ca'',xsl xsc'')\"\n    by(auto)\n  with refines'' show ?case by(blast)\nqed\n\nlemma refinement_s_stepsE:\n    fixes xsl \\<Gamma>a \\<Gamma>c Pa Pc xsc xsc' ca cc cc'\n  assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and Pc: \"xsc \\<in> Pc\"\n      and concrete_steps: \"(rtranclp (SmallStep.step \\<Gamma>c)) (cc,xsc) (cc',xsc')\"\n  obtains (abstract_steps) ca'\n    where \"((\\<Gamma>a,{xsl xsc'},ca'),(\\<Gamma>c,{xsc'},cc')) \\<in> refinement_s xsl\"\n      and \"(rtranclp (SmallStep.step \\<Gamma>a)) (ca,xsl xsc) (ca',xsl xsc')\"\n  using refinement_steps[OF assms] by(blast)\n\ntype_synonym ('s,'p,'f) trace_s = \"(('s,'p,'f) Language.com \\<times> ('s,'f) Semantic.xstate) list\"\n\ntext \\<open>The finite traces of a computation are those reachable from some starting state.\\<close>\ninductive_set finite_traces_s ::\n  \"('s,'p,'f) Semantic.body \\<Rightarrow> ('s,'p,'f) Language.com \\<Rightarrow> ('s,'p,'f) trace_s set\"\n  for \\<Gamma> :: \"('s,'p,'f) Semantic.body\"\n  and c :: \"('s,'p,'f) Language.com\"\nwhere\n  Start: \"[(c, xs)] \\<in> finite_traces_s \\<Gamma> c\" |\n  Step: \"(cf,xsf) # T \\<in> finite_traces_s \\<Gamma> c \\<Longrightarrow> SmallStep.step \\<Gamma> (cf,xsf) (cf',xsf') \\<Longrightarrow>\n         (cf',xsf') # (cf,xsf) # T \\<in> finite_traces_s \\<Gamma> c\"\n\nlemma finite_trace_nonempty_s:\n  \"T \\<in> finite_traces_s \\<Gamma> c \\<Longrightarrow> T \\<noteq> []\"\n  by(induct T rule:finite_traces_s.induct, auto)\n\ntext \\<open>Refinement is pointwise between traces of the same length.\\<close>\ninductive trace_refines_s ::\n  \"('sa,'fa,'sc,'fc) xstate_lift_s \\<Rightarrow> ('sa,'pa,'fa) trace_s \\<Rightarrow> ('sc,'pc,'fc) trace_s \\<Rightarrow> bool\"\n  for xsl :: \"('sa,'fa,'sc,'fc) xstate_lift_s\"\n  where\n    Start: \"trace_refines_s xsl [] []\" |\n    Step:  \"trace_refines_s xsl Ta Tc \\<Longrightarrow>\n              trace_refines_s xsl ((ca,xsl xsc)#Ta) ((cc,xsc)#Tc)\"\n\ntype_synonym ('s,'f) state_trace_s = \"('s,'f) Semantic.xstate list\"\n\ntext \\<open>Project the state component.\\<close>\ndefinition state_trace_of :: \"('s,'p,'f) trace_s \\<Rightarrow> ('s,'f) state_trace_s\"\n  where \"state_trace_of T = map snd T\"\n\ndefinition finite_state_traces_s ::\n  \"('s,'p,'f) Semantic.body \\<Rightarrow> ('s,'p,'f) Language.com \\<Rightarrow> ('s,'f) state_trace_s set\"\n  where\n    \"finite_state_traces_s \\<Gamma> c = state_trace_of ` (finite_traces_s \\<Gamma> c)\"\n\nlemma finite_state_trace_nonempty_s:\n  \"T \\<in> finite_state_traces_s \\<Gamma> c \\<Longrightarrow> T \\<noteq> []\"\n  using finite_trace_nonempty_s unfolding finite_state_traces_s_def state_trace_of_def by(auto)\n\ntext \\<open>If cc refines ca, then for any trace of cc there exists a corresponding abstract trace of\n  which the concrete trace is a refinement, in the sense defined above i.e. program refinement\n  implies trace refinement.\\<close>\nlemma trace_refinement_s:\n  fixes Tc \\<Gamma>a \\<Gamma>c Pa Pc ca cc xsl\n  assumes pre: \"snd (last Tc) \\<in> Pc\"\n      and refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and concrete_trace: \"Tc \\<in> finite_traces_s \\<Gamma>c cc\"\n    shows \"\\<exists>Ta.\n      ((\\<Gamma>a,{xsl (snd (hd Tc))},fst (hd Ta)),(\\<Gamma>c,{snd (hd Tc)},fst (hd Tc))) \\<in> refinement_s xsl \\<and>\n      Ta \\<in> finite_traces_s \\<Gamma>a ca \\<and>\n      trace_refines_s xsl Ta Tc\"\n  using concrete_trace pre\nproof(induct)\n  case (Start xsc)\n\n  from Start refines\n  have \"((\\<Gamma>a,{xsl (snd (hd [(cc, xsc)]))},fst (hd [(ca,xsl xsc)])),\n         (\\<Gamma>c, {snd (hd [(cc, xsc)])},fst (hd [(cc, xsc)])))\n               \\<in> refinement_s xsl\"\n    by(auto elim:refinement_s_strengthen)\n  moreover have \"[(ca,xsl xsc)] \\<in> finite_traces_s \\<Gamma>a ca\"\n    by(rule finite_traces_s.Start)\n  moreover have \"trace_refines_s xsl [(ca, xsl xsc)] [(cc, xsc)]\"\n    by(auto intro:trace_refines_s.intros)\n  ultimately show ?case by(blast)\n\nnext\n  case (Step cc' xsc' Tc cc'' xsc'')\n\n  from Step obtain Ta\n    where refines': \"((\\<Gamma>a, {xsl xsc'}, fst (hd Ta)), (\\<Gamma>c, {xsc'}, cc')) \\<in> refinement_s xsl\"\n      and abstract_trace: \"Ta \\<in> finite_traces_s \\<Gamma>a ca\"\n      and IH: \"trace_refines_s xsl Ta ((cc', xsc') # Tc)\"\n    by(auto)\n\n  from IH have match: \"snd (hd Ta) = xsl xsc'\"\n    by(cases, auto)\n\n  from refinement_s_stepE[OF refines' _ Step(3)]\n  obtain ca''\n    where stepa: \"SmallStep.step \\<Gamma>a (fst (hd Ta), snd (hd Ta)) (ca'', xsl xsc'')\"\n      and refines'': \"((\\<Gamma>a, {xsl xsc''}, ca''), (\\<Gamma>c, {xsc''}, cc'')) \\<in> refinement_s xsl\"\n    by(auto simp:match)\n\n  from refines''\n  have \"((\\<Gamma>a, {xsl (snd (hd ((cc'', xsc'') # (cc', xsc') # Tc)))}, fst (hd ((ca'',xsl xsc'') # Ta))),\n         (\\<Gamma>c, {snd (hd ((cc'', xsc'') # (cc', xsc') # Tc))}, fst (hd ((cc'', xsc'') # (cc', xsc') # Tc))))\n           \\<in> refinement_s xsl\"\n    by(simp)\n  moreover {\n    from abstract_trace have \"(fst (hd Ta), snd (hd Ta)) # tl Ta \\<in> finite_traces_s \\<Gamma>a ca\"\n      by(cases, auto)\n    from finite_traces_s.Step[OF this stepa] finite_trace_nonempty_s[OF abstract_trace]\n    have \"(ca'',xsl xsc'') # Ta \\<in> finite_traces_s \\<Gamma>a ca\"\n      by(simp)\n  }\n  moreover from IH\n  have \"trace_refines_s xsl ((ca'',xsl xsc'') # Ta) ((cc'', xsc'') # (cc', xsc') # Tc)\"\n    by(rule trace_refines_s.Step)\n  ultimately show ?case by(blast)\nqed\n\ntext \\<open>Elimination form of the above, for getting one's grubby little hands on an abstract trace.\\<close>\nlemma trace_refinement_sE:\n  fixes Tc \\<Gamma>a \\<Gamma>c Pa Pc ca cc xsl\n  assumes pre: \"snd (last Tc) \\<in> Pc\"\n      and refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and concrete_trace: \"Tc \\<in> finite_traces_s \\<Gamma>c cc\"\n  obtains (abstract_trace) Ta\n    where \"((\\<Gamma>a,{xsl (snd (hd Tc))},fst (hd Ta)),(\\<Gamma>c,{snd (hd Tc)},fst (hd Tc))) \\<in> refinement_s xsl\"\n      and \"Ta \\<in> finite_traces_s \\<Gamma>a ca\"\n      and \"trace_refines_s xsl Ta Tc\"\n  using trace_refinement_s[OF assms] by(blast)\n\ndefinition separable_lift :: \"('sc \\<Rightarrow> 'sa) \\<Rightarrow> ('fc \\<Rightarrow> 'fa) \\<Rightarrow> ('sa,'fa,'sc,'fc) xstate_lift_s\"\n  where \"separable_lift sl fl = (\\<lambda>xsc. case xsc of\n    Semantic.Stuck \\<Rightarrow> Semantic.Stuck\n  | Semantic.Normal sc \\<Rightarrow> Semantic.Normal (sl sc)\n  | Semantic.Abrupt sc \\<Rightarrow> Semantic.Abrupt (sl sc)\n  | Semantic.Fault fc \\<Rightarrow> Semantic.Fault (fl fc))\"\n\n(* XXX - move *)\nlemma final_s_cases:\n  assumes \"SmallStep.final cfg\"\n  obtains\n    (Skip) xs where \"cfg = (Language.Skip, xs)\"\n  | (Throw) s where \"cfg = (Language.Throw, Semantic.Normal s)\"\n  using assms unfolding SmallStep.final_def by(cases cfg, auto)\n\ndefinition abrupt_consistent :: \"('sa,'fa,'sc,'fc) xstate_lift_s \\<Rightarrow> bool\"\n  where \"abrupt_consistent xsl \\<longleftrightarrow> (\\<forall>sa sc.\n          Semantic.Normal sa = xsl (Semantic.Normal sc) \\<longrightarrow>\n          Semantic.Abrupt sa = xsl (Semantic.Abrupt sc)\n        )\"\n\nlemma abrupt_consistentE:\n  fixes xsl sa sc\n  assumes \"abrupt_consistent xsl\" and \"Semantic.Normal sa = xsl (Semantic.Normal sc)\"\n  shows \"Semantic.Abrupt sa = xsl (Semantic.Abrupt sc)\"\n  using assms unfolding abrupt_consistent_def by(auto)\n\nlemma separable_lift_mp:\n  \"mode_preserving (separable_lift sl fl)\"\n  unfolding mode_preserving_def\nproof\n  fix xsc\n  show \"(\\<exists>sa. separable_lift sl fl xsc = Semantic.xstate.Normal sa) = (\\<exists>sc. xsc = Semantic.xstate.Normal sc) \\<and>\n        (\\<exists>sa. separable_lift sl fl xsc = Abrupt sa) = (\\<exists>sc. xsc = Abrupt sc) \\<and>\n        (\\<exists>fa. separable_lift sl fl xsc = Semantic.xstate.Fault fa) = (\\<exists>fc. xsc = Semantic.xstate.Fault fc) \\<and>\n        (separable_lift sl fl xsc = Semantic.xstate.Stuck) = (xsc = Semantic.xstate.Stuck)\"\n    by(cases xsc, auto simp:separable_lift_def)\nqed\n\nlemma separable_lift_ac:\n  \"abrupt_consistent (separable_lift sl fl)\"\n  unfolding abrupt_consistent_def separable_lift_def\n  by(auto)\n\nlemma refinement_exec_s:\n    fixes ca cc xsl \\<Gamma>a \\<Gamma>c Pa Pc xsc xsc'\n  assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s xsl\"\n      and bigstepc: \"Semantic.exec \\<Gamma>c cc xsc xsc'\"\n      and Pc: \"xsc \\<in> Pc\"\n      and mp: \"mode_preserving xsl\"\n      and ac: \"abrupt_consistent xsl\"\n    shows \"Semantic.exec \\<Gamma>a ca (xsl xsc) (xsl xsc')\"\nproof(cases \"isAbr xsc'\")\n  case True\n  then obtain sc where rw_xsc': \"xsc' = Semantic.Abrupt sc\" by(auto elim:isAbrE)\n\n  show ?thesis\n  proof(cases \"xsc = xsc'\")\n    case True\n    with rw_xsc' exec_impl_steps[OF bigstepc]\n    have stepsc: \"(rtranclp (SmallStep.step \\<Gamma>c)) (cc,xsc) (Language.Skip,xsc)\"\n      by(auto)\n\n    from refines Pc stepsc\n    obtain ca'\n      where refines': \"((\\<Gamma>a,{xsl xsc},ca'), (\\<Gamma>c,{xsc},Language.Skip)) \\<in> refinement_s xsl\"\n        and bigstepa: \"(rtranclp (SmallStep.step \\<Gamma>a)) (ca, xsl xsc) (ca', xsl xsc)\"\n      by(auto elim:refinement_s_stepsE)\n\n    have \"SmallStep.final (Language.Skip,xsc)\"\n      unfolding SmallStep.final_def by(auto)\n    with mp refines' have finala: \"SmallStep.final (ca',xsl xsc)\"\n      by(auto elim:refinement_s_finalE)\n\n    from finala show ?thesis\n    proof(cases rule:final_s_cases)\n      case (Skip xs)\n      with bigstepa True show ?thesis\n        by(auto intro:steps_Skip_impl_exec)                         \n\n    next\n      case (Throw sa)\n      with True rw_xsc' mp show ?thesis\n        by(auto elim!:mode_preserving_AbruptcE)\n    qed\n\n  next\n    case False\n    with rw_xsc' exec_impl_steps[OF bigstepc]\n    have stepsc: \"(rtranclp (SmallStep.step \\<Gamma>c)) (cc,xsc) (Language.Throw, Semantic.Normal sc)\"\n      by(auto)\n\n    from refines Pc stepsc\n    obtain ca'\n      where refines': \"((\\<Gamma>a,{xsl (Semantic.Normal sc)},ca'),\n                        (\\<Gamma>c,{Semantic.Normal sc},Language.Throw)) \\<in> refinement_s xsl\"\n        and bigstepa: \"(rtranclp (SmallStep.step \\<Gamma>a)) (ca, xsl xsc) (ca', xsl (Semantic.Normal sc))\"\n      by(auto elim:refinement_s_stepsE)\n\n    have \"SmallStep.final (Language.Throw, Semantic.Normal sc)\"\n      unfolding SmallStep.final_def by(auto)\n    with mp  refines' have finala: \"SmallStep.final (ca',xsl (Semantic.Normal sc))\"\n      by(auto elim:refinement_s_finalE)\n\n    from finala show ?thesis\n    proof(cases rule:final_s_cases)\n      case (Skip xs)\n      with refines' show ?thesis by(auto dest:refinement_s_throwcE)\n    next\n      case (Throw sa)\n      with bigstepa have \"Semantic.exec \\<Gamma>a ca (xsl xsc) (Semantic.Abrupt sa)\"\n        by(auto intro:steps_Throw_impl_exec)\n      moreover from Throw abrupt_consistentE[OF ac] rw_xsc'\n      have \"Semantic.Abrupt sa = xsl xsc'\"\n        by(simp)\n      ultimately show ?thesis by(simp)\n    qed\n  qed\nnext\n  case False\n  with exec_impl_steps[OF bigstepc]\n  have stepsc: \"(rtranclp (SmallStep.step \\<Gamma>c)) (cc,xsc) (Language.Skip,xsc')\"\n    unfolding isAbr_def by(cases xsc', auto)\n\n    from refines Pc stepsc\n    obtain ca'\n      where refines': \"((\\<Gamma>a,{xsl xsc'},ca'), (\\<Gamma>c,{xsc'},Language.Skip)) \\<in> refinement_s xsl\"\n        and bigstepa: \"(rtranclp (SmallStep.step \\<Gamma>a)) (ca, xsl xsc) (ca', xsl xsc')\"\n      by(auto elim:refinement_s_stepsE)\n\n  have \"SmallStep.final (Language.Skip, xsc')\"\n    unfolding SmallStep.final_def by(auto)\n  with mp refines' have finala: \"SmallStep.final (ca',xsl xsc')\"\n    by(auto elim:refinement_s_finalE)\n\n  from finala show ?thesis\n  proof(cases rule:final_s_cases)\n    case (Skip xs)\n    with bigstepa show \"Semantic.exec \\<Gamma>a ca (xsl xsc) (xsl xsc')\"\n      by(auto intro:steps_Skip_impl_exec)\n  next\n    case (Throw sa)\n    with refines' show ?thesis by(auto dest:refinement_s_throwaE)\n  qed\nqed\n\nlemma valid_sE:\n  fixes \\<Gamma> F P c Q A s t\n  assumes valid: \"HoarePartialDef.valid \\<Gamma> F P c Q A\" \n      and exec: \"Semantic.exec \\<Gamma> c s t\"\n      and pre: \"s \\<in> Semantic.Normal ` P\"\n      and nofault: \"t \\<notin> Semantic.Fault ` F\"\n    obtains (Normal) \"t \\<in> Semantic.Normal ` Q\" | (Abrupt) \"t \\<in> Semantic.Abrupt ` A\"\n  using assms unfolding HoarePartialDef.valid_def by(blast)\n\ntext \\<open>Refinement preserves (partial) Hoare triples\\<close>\nlemma refinement_valid_s:\n    fixes ca cc sl fl \\<Gamma>a \\<Gamma>c Pa Pc F P Q A\n    assumes refines: \"((\\<Gamma>a,Pa,ca),(\\<Gamma>c,Pc,cc)) \\<in> refinement_s (separable_lift sl fl)\"\n      and weakenc: \"Semantic.Normal ` sl -` P \\<subseteq> Pc\"\n      and valida: \"HoarePartialDef.valid \\<Gamma>a F P ca Q A\"\n    shows \"HoarePartialDef.valid \\<Gamma>c (fl-`F) (sl-`P) cc (sl-`Q) (sl-`A)\"\nproof(rule HoarePartialDef.validI)\n  fix sc xsc'\n  assume execc: \"Semantic.exec \\<Gamma>c cc (Semantic.Normal sc) xsc'\"\n     and imgP: \"sc \\<in> sl -` P\"\n     and noF: \"xsc' \\<notin> Semantic.xstate.Fault ` fl -` F\"\n\n  from imgP weakenc have Pc: \"Semantic.Normal sc \\<in> Pc\" by(auto)\n\n  from refinement_exec_s[OF refines execc Pc separable_lift_mp separable_lift_ac]\n  have execa: \"Semantic.exec \\<Gamma>a ca (separable_lift sl fl (Semantic.xstate.Normal sc))\n                 (separable_lift sl fl xsc')\" .\n\n  note valida execa\n  moreover {\n    have \"separable_lift sl fl (Semantic.Normal sc) = Semantic.Normal (sl sc)\"\n      by(simp add:separable_lift_def)\n    also from imgP have \"... \\<in> Semantic.Normal ` P\"\n      by(auto)\n    finally have \"separable_lift sl fl (Semantic.Normal sc) \\<in> Semantic.Normal ` P\" .\n  }\n  moreover from noF have \"separable_lift sl fl xsc' \\<notin> Semantic.Fault ` F\"\n  proof(rule contrapos_nn)\n    assume \"separable_lift sl fl xsc' \\<in> Semantic.Fault ` F\"\n    then obtain fa\n      where faulta: \"separable_lift sl fl xsc' = Semantic.Fault fa\"\n        and saF: \"fa \\<in> F\"\n      by(auto)\n\n    from mode_preserving_FaultaE[OF separable_lift_mp faulta]\n    obtain fc where faultc: \"xsc' = Semantic.Fault fc\"\n      by(blast)\n\n    from faulta faultc have \"fa = fl fc\"\n      by(simp add:separable_lift_def)\n    with saF have \"fc \\<in> fl -` F\"\n      by(auto)\n    with faultc\n    show \"xsc' \\<in> Semantic.Fault ` fl -` F\"\n      by(auto)\n  qed\n  ultimately show \"xsc' \\<in> Semantic.Normal ` sl -` Q \\<union> Semantic.Abrupt ` sl -` A\"\n  proof(cases rule:valid_sE)\n    case Normal\n    then obtain sa\n      where normala: \"separable_lift sl fl xsc' = Semantic.Normal sa\"\n        and saQ: \"sa \\<in> Q\"\n      by(auto)\n\n    from mode_preserving_NormalaE[OF separable_lift_mp normala]\n    obtain sc where normalc: \"xsc' = Semantic.Normal sc\"\n      by(blast)\n\n    from normala normalc have \"sa = sl sc\"\n      by(simp add:separable_lift_def)\n    with saQ have \"sc \\<in> sl -` Q\"\n      by(auto)\n    with normalc\n    have \"xsc' \\<in> Semantic.Normal ` sl -` Q\"\n      by(auto)\n    thus ?thesis\n      by(blast)\n  next\n    case Abrupt\n    then obtain sa\n      where abrupta: \"separable_lift sl fl xsc' = Semantic.Abrupt sa\"\n        and saA: \"sa \\<in> A\"\n      by(auto)\n\n    from mode_preserving_AbruptaE[OF separable_lift_mp abrupta]\n    obtain sc where abruptc: \"xsc' = Semantic.Abrupt sc\"\n      by(blast)\n\n    from abrupta abruptc have \"sa = sl sc\"\n      by(simp add:separable_lift_def)\n    with saA have \"sc \\<in> sl -` A\"\n      by(auto)\n    with abruptc\n    have \"xsc' \\<in> Semantic.Abrupt ` sl -` A\"\n      by(auto)\n    thus ?thesis\n      by(blast)\n  qed\nqed\n\nlemma refinement_s_SkipI:\n  assumes stricter: \"xsl ` Pc \\<subseteq> Pa\"\n  shows \"((\\<Gamma>a,Pa,Language.Skip), (\\<Gamma>c,Pc,Language.Skip)) \\<in> refinement_s xsl\"\nproof(rule refinement_s.Step[OF _ stricter])\n  show \"(Language.Skip = Language.Throw) = (Language.Skip = Language.Throw)\" by(auto)\nnext\n  fix xsa\n  show \"Language.Skip = Language.Skip\" by(simp)\nnext\n  fix xsa xsc xsc' cc'\n  assume stepc: \"SmallStep.step \\<Gamma>c (Language.com.Skip, xsc) (cc', xsc')\"\n  thus \"\\<exists>ca'.\n          SmallStep.step \\<Gamma>a (Language.com.Skip, xsa) (ca', xsl xsc') \\<and>\n          ((\\<Gamma>a,{xsl xsc'},ca'), (\\<Gamma>c,{xsc'},cc')) \\<in> refinement_s xsl\"\n    by(blast elim:SmallStep.step.cases)\nqed\n\nlemma refinement_s_ThrowI:\n  assumes stricter: \"separable_lift sl fl ` Pc \\<subseteq> Pa\"\n  shows \"((\\<Gamma>a,Pa,Language.Throw), (\\<Gamma>c,Pc,Language.Throw)) \\<in> refinement_s (separable_lift sl fl)\"\nproof(rule refinement_s.Step[OF _ stricter])\n  show \"(Language.Throw = Language.Throw) = (Language.Throw = Language.Throw)\" by(simp)\nnext\n  assume \"Language.Throw = Language.Skip\"\n  thus \"Language.Throw = Language.Skip\"\n    by(simp)\nnext\n  fix xsc xsc' cc'\n  assume Pc: \"xsc \\<in> Pc\"\n\n  assume \"SmallStep.step \\<Gamma>c(Language.com.Throw, xsc) (cc', xsc')\"\n  thus \"\\<exists>ca'.\n          SmallStep.step \\<Gamma>a (Language.com.Throw, separable_lift sl fl xsc)\n                            (ca', separable_lift sl fl xsc') \\<and>\n          ((\\<Gamma>a,{separable_lift sl fl xsc'},ca'), (\\<Gamma>c,{xsc'},cc'))\n            \\<in> refinement_s (separable_lift sl fl)\"\n  proof(cases rule:SmallStep.step.cases)\n    case (FaultProp fc)\n\n    have \"SmallStep.step \\<Gamma>a (Language.Throw, separable_lift sl fl xsc)\n                            (Language.Skip, separable_lift sl fl xsc')\"\n      by(auto simp:FaultProp separable_lift_def intro:SmallStep.step.FaultProp)\n    moreover {\n      have \"separable_lift sl fl xsc' = Semantic.xstate.Fault (fl fc)\"\n        by(simp add:FaultProp separable_lift_def)\n    \n      hence \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Skip),\n                      (\\<Gamma>c, {xsc'}, cc')) \\<in> refinement_s (separable_lift sl fl)\"\n        by(auto simp:FaultProp intro:refinement_s_SkipI)\n    }\n    ultimately show ?thesis by(blast)\n\n  next\n    case StuckProp\n\n    have \"SmallStep.step \\<Gamma>a (Language.Throw, separable_lift sl fl xsc)\n                            (Language.Skip, separable_lift sl fl xsc')\"\n      by(auto simp:StuckProp separable_lift_def intro:SmallStep.step.StuckProp)\n    moreover {\n      have \"separable_lift sl fl xsc' = Semantic.Stuck\"\n        by(simp add:StuckProp separable_lift_def)\n    \n      hence \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Skip),\n                      (\\<Gamma>c, {xsc'}, cc')) \\<in> refinement_s (separable_lift sl fl)\"\n        by(auto simp:StuckProp intro:refinement_s_SkipI)\n    }\n    ultimately show ?thesis by(blast)\n\n  next\n    case (AbruptProp sc)\n\n    have \"SmallStep.step \\<Gamma>a (Language.Throw, separable_lift sl fl xsc)\n                            (Language.Skip, separable_lift sl fl xsc')\"\n      by(auto simp:AbruptProp separable_lift_def intro:SmallStep.step.AbruptProp)\n    moreover {\n      have \"separable_lift sl fl xsc' = Semantic.xstate.Abrupt (sl sc)\"\n        by(simp add:AbruptProp separable_lift_def)\n    \n      hence \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Skip),\n                      (\\<Gamma>c, {xsc'}, cc')) \\<in> refinement_s (separable_lift sl fl)\"\n        by(auto simp:AbruptProp intro:refinement_s_SkipI)\n    }\n    ultimately show ?thesis by(blast)\n  qed\nqed\n\nlemma refinement_s_BasicI:\n  assumes fun_rel: \"\\<And>sc. Semantic.Normal sc \\<in> Pc \\<Longrightarrow> sl (g sc) = f (sl sc)\"\n      and stricter: \"separable_lift sl fl ` Pc \\<subseteq> Pa\"\n    shows \"((\\<Gamma>a,Pa,Language.Basic f), (\\<Gamma>c,Pc,Language.Basic g)) \\<in> refinement_s (separable_lift sl fl)\"\nproof(rule refinement_s.Step[OF _ stricter])\n  show \"(Language.com.Basic g = THROW) = (Language.com.Basic f = THROW)\"\n    by(auto)\nnext\n  fix xsa xsc\n  assume \"Language.com.Basic g = Language.Skip\"\n  thus \"Language.com.Basic f = Language.Skip\"\n    by(simp)\nnext\n  fix xsc xsc' cc'\n  assume Pc: \"xsc \\<in> Pc\"\n     and stepc: \"SmallStep.step \\<Gamma>c(Language.com.Basic g, xsc) (cc', xsc')\"\n\n  from stepc\n  show \"\\<exists>ca'.\n          SmallStep.step \\<Gamma>a (Language.com.Basic f, separable_lift sl fl xsc)\n                            (ca', separable_lift sl fl xsc') \\<and>\n          ((\\<Gamma>a, {separable_lift sl fl xsc'}, ca'), (\\<Gamma>c, {xsc'}, cc'))\n            \\<in> refinement_s (separable_lift sl fl)\"\n  proof(cases rule:SmallStep.step.cases)\n    case (Basic sc)\n\n    from Basic Pc have \"Semantic.Normal sc \\<in> Pc\" by(simp)\n    hence \"separable_lift sl fl xsc' = Semantic.Normal (f (sl sc))\"\n      by(simp add:Basic separable_lift_def fun_rel)\n    hence \"SmallStep.step \\<Gamma>a (Language.Basic f, separable_lift sl fl xsc)\n                            (Language.Skip, separable_lift sl fl xsc')\"\n      by(auto simp:Basic separable_lift_def intro:SmallStep.step.Basic)\n    moreover have \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Skip),\n                    (\\<Gamma>c, {xsc'}, cc')) \\<in> refinement_s (separable_lift sl fl)\"\n      by(auto simp:Basic intro:refinement_s_SkipI)\n    ultimately show ?thesis by(blast)\n\n  next\n    case (FaultProp fc)\n\n    have \"SmallStep.step \\<Gamma>a (Language.Basic f, separable_lift sl fl xsc)\n                            (Language.Skip, separable_lift sl fl xsc')\"\n      by(auto simp:FaultProp separable_lift_def intro:SmallStep.step.FaultProp)\n    moreover {\n      have \"separable_lift sl fl xsc' = Semantic.xstate.Fault (fl fc)\"\n        by(simp add:FaultProp separable_lift_def)\n    \n      hence \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Skip),\n                      (\\<Gamma>c, {xsc'}, cc')) \\<in> refinement_s (separable_lift sl fl)\"\n        by(auto simp:FaultProp intro:refinement_s_SkipI)\n    }\n    ultimately show ?thesis by(blast)\n\n\n  next\n    case StuckProp\n\n    have \"SmallStep.step \\<Gamma>a (Language.Basic f, separable_lift sl fl xsc)\n                            (Language.Skip, separable_lift sl fl xsc')\"\n      by(auto simp:StuckProp separable_lift_def intro:SmallStep.step.StuckProp)\n    moreover {\n      have \"separable_lift sl fl xsc' = Semantic.Stuck\"\n        by(simp add:StuckProp separable_lift_def)\n    \n      hence \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Skip),\n                      (\\<Gamma>c, {xsc'}, cc')) \\<in> refinement_s (separable_lift sl fl)\"\n        by(auto simp:StuckProp intro:refinement_s_SkipI)\n    }\n    ultimately show ?thesis by(blast)\n\n  next\n    case (AbruptProp sc)\n\n    have \"SmallStep.step \\<Gamma>a (Language.Basic f, separable_lift sl fl xsc)\n                            (Language.Skip, separable_lift sl fl xsc')\"\n      by(auto simp:AbruptProp separable_lift_def intro:SmallStep.step.AbruptProp)\n    moreover {\n      have \"separable_lift sl fl xsc' = Semantic.xstate.Abrupt (sl sc)\"\n        by(simp add:AbruptProp separable_lift_def)\n    \n      hence \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Skip),\n                      (\\<Gamma>c, {xsc'}, cc')) \\<in> refinement_s (separable_lift sl fl)\"\n        by(auto simp:AbruptProp intro:refinement_s_SkipI)\n    }\n    ultimately show ?thesis by(blast)\n  qed\nqed\n\nlemma valid_step:\n  assumes valid: \"HoarePartialDef.valid \\<Gamma> F P c Q A\"\n      and step: \"SmallStep.step \\<Gamma> (c,Semantic.Normal s) (c',Semantic.Normal s')\"\n      and pre: \"s \\<in> P\"\n    shows \"HoarePartialDef.valid \\<Gamma> F {s'} c' Q A\"\nproof(rule HoarePartialDef.validI)\n  fix s_h t\n  assume \"Semantic.exec \\<Gamma> c' (Semantic.Normal s_h) t\"\n     and \"s_h \\<in> {s'}\"\n  hence exec': \"Semantic.exec \\<Gamma> c' (Semantic.Normal s') t\"\n    by(simp)\n  with step have exec: \"Semantic.exec \\<Gamma> c (Semantic.Normal s) t\"\n    by(rule SmallStep.step_extend)\n\n  from pre have Ps: \"Semantic.Normal s \\<in> Semantic.Normal ` P\"\n    by(auto)\n\n  assume nofault: \"t \\<notin> Semantic.Fault ` F\"\n\n  from valid exec Ps nofault\n  show \"t \\<in> Semantic.xstate.Normal ` Q \\<union> Abrupt ` A\"\n    by(cases rule:valid_sE, auto)\nqed\n\nlemma valid_s_emptypre:\n  \"HoarePartialDef.valid \\<Gamma> F {} c Q A\"\n  by(blast intro:HoarePartialDef.validI)\n\nlemma step_NormalE:\n  fixes c c'::\"('s,'p,'f) Language.com\"\n    and xs::\"('s,'f) Semantic.xstate\"\n    and s'::'s\n  assumes \"SmallStep.step \\<Gamma> (c,xs) (c',Semantic.Normal s')\"\n  obtains s where \"xs = Semantic.Normal s\"\n  using assms\n    by(induct cfg \\<equiv> \"(c,xs)\"\n              cfg' \\<equiv> \"(c',Semantic.Normal s')::('s,'p,'f) Language.com \\<times> ('s,'f) Semantic.xstate\"\n              arbitrary:c c'\n              rule:SmallStep.step.induct,\n       auto)\n\nlemma step_AbruptE:\n  fixes c c'::\"('s,'p,'f) Language.com\"\n    and xs::\"('s,'f) Semantic.xstate\"\n    and s::'s\n  assumes \"SmallStep.step \\<Gamma> (c,xs) (c',Semantic.Abrupt s)\"\n  shows \"xs = Semantic.Abrupt s\"\n  using assms\n    by(induct cfg \\<equiv> \"(c,xs)\"\n              cfg' \\<equiv> \"(c',Semantic.Abrupt s)::('s,'p,'f) Language.com \\<times> ('s,'f) Semantic.xstate\"\n              arbitrary:c c'\n              rule:SmallStep.step.induct,\n       auto)\n\nlemma step_FaultE:\n  fixes c c'::\"('s,'p,'f) Language.com\"\n    and xs::\"('s,'f) Semantic.xstate\"\n    and f::'f\n  assumes \"SmallStep.step \\<Gamma> (c,xs) (c',Semantic.Fault f)\"\n  obtains (FaultProp) \"xs = Semantic.Fault f\" |\n          (NewFault) s where \"xs = Semantic.Normal s\"\n  using assms\n  by(induct cfg \\<equiv> \"(c,xs)\"\n            cfg' \\<equiv> \"(c',Semantic.Fault f)::('s,'p,'f) Language.com \\<times> ('s,'f) Semantic.xstate\"\n            arbitrary:c c'\n            rule:SmallStep.step.induct,\n     auto)\n\nlemma refinement_s_SeqI:\n  assumes refines_c1: \"((\\<Gamma>a,P1a,c1a),(\\<Gamma>c,P1c,c1c)) \\<in> refinement_s (separable_lift sl fl)\"\n      and refines_c2: \"((\\<Gamma>a,P2a,c2a),(\\<Gamma>c,P2c,c2c)) \\<in> refinement_s (separable_lift sl fl)\"\n      and valid: \"HoarePartialDef.valid \\<Gamma>a F P c1a Q A\"\n      and preFault: \"\\<And>fa. Semantic.Fault fa \\<in> P1a \\<Longrightarrow> fa \\<in> F\"\n      and preAbrupt: \"\\<And>sa. Semantic.Abrupt sa \\<in> P1a \\<Longrightarrow> sa \\<in> A\"\n      and preNormal: \"\\<And>sa. Semantic.Normal sa \\<in> P1a \\<Longrightarrow> sa \\<in> P\"\n      and propStuck: \"(\\<forall>xsc. xsc \\<in> P1c \\<longrightarrow> \\<not>Semantic.exec \\<Gamma>c c1c xsc Semantic.Stuck) \\<or>\n                      Semantic.Stuck \\<in> P2c\"\n      and postFault: \"\\<And>fc. fl fc \\<in> F \\<Longrightarrow> Semantic.Fault fc \\<in> P2c\"\n      and postAbrupt: \"\\<And>sc. sl sc \\<in> A \\<Longrightarrow> Semantic.Abrupt sc \\<in> P2c\"\n      and postNormal: \"\\<And>sc. sl sc \\<in> Q \\<Longrightarrow> Semantic.Normal sc \\<in> P2c\"\n    shows \"((\\<Gamma>a,P1a,Language.Seq c1a c2a), (\\<Gamma>c,P1c,Language.Seq c1c c2c))\n            \\<in> refinement_s (separable_lift sl fl)\"\n  using refines_c1 refines_c2 valid preNormal preAbrupt preFault propStuck\nproof(induct arbitrary:P)\n  case (Step P1c \\<Gamma>c c1c \\<Gamma>a c1a P1a)\n\n  show ?case\n  proof(rule refinement_s.Step)\n    show \"(Language.Seq c1c c2c = THROW) = (Language.Seq c1a c2a = THROW)\" by(auto)\n\n  next\n    fix xsa xsc\n    assume \"Language.Seq c1c c2c = Language.Skip\"\n    thus \"Language.Seq c1a c2a = Language.Skip\"\n      by(simp)\n\n  next\n    from Step.hyps(2) show \"separable_lift sl fl ` P1c \\<subseteq> P1a\" .\n\n  next\n    fix xsc xsc' cc'\n    assume Pc: \"xsc \\<in> P1c\"\n       and stepc: \"SmallStep.step \\<Gamma>c (Language.Seq c1c c2c, xsc) (cc', xsc')\"\n\n    from stepc\n    show \"\\<exists>ca'.\n            SmallStep.step \\<Gamma>a (Language.Seq c1a c2a, separable_lift sl fl xsc)\n                              (ca', separable_lift sl fl xsc') \\<and>\n            ((\\<Gamma>a, {separable_lift sl fl xsc'}, ca'), \\<Gamma>c, {xsc'}, cc')\n              \\<in> refinement_s (separable_lift sl fl)\"\n    proof(cases rule:SmallStep.step.cases)\n      case (Seq c1c')\n\n      from Step.hyps(1)[OF Pc Seq(2)] Step.prems(1) obtain c1a'\n        where step_c1a: \"SmallStep.step \\<Gamma>a (c1a, separable_lift sl fl xsc)\n                                           (c1a', separable_lift sl fl xsc')\"\n          and refines_c1a': \"((\\<Gamma>a, {separable_lift sl fl xsc'}, c1a'), (\\<Gamma>c, {xsc'}, c1c'))\n                              \\<in> refinement_s (separable_lift sl fl)\"\n          and IH: \"\\<forall>P. HoarePartialDef.valid \\<Gamma>a F P c1a' Q A \\<longrightarrow>\n                      (\\<forall>sa'. Semantic.Normal sa' \\<in> {separable_lift sl fl xsc'} \\<longrightarrow> sa' \\<in> P) \\<longrightarrow>\n                      (\\<forall>sa'. Semantic.Abrupt sa' \\<in> {separable_lift sl fl xsc'} \\<longrightarrow> sa' \\<in> A) \\<longrightarrow>\n                      (\\<forall>fa'. Semantic.xstate.Fault fa' \\<in> {separable_lift sl fl xsc'} \\<longrightarrow> fa' \\<in> F) \\<longrightarrow>\n                      ((\\<forall>xsc. xsc \\<in> {xsc'} \\<longrightarrow> \\<not> Semantic.exec \\<Gamma>c c1c' xsc Semantic.xstate.Stuck) \\<or>\n                          Semantic.xstate.Stuck \\<in> P2c) \\<longrightarrow>\n                      ((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Seq c1a' c2a),\n                       (\\<Gamma>c, {xsc'}, Language.Seq c1c' c2c)) \\<in> refinement_s (separable_lift sl fl)\"\n        by(blast)\n\n      from step_c1a have \"SmallStep.step \\<Gamma>a (Language.Seq c1a c2a, separable_lift sl fl xsc)\n                                            (Language.Seq c1a' c2a, separable_lift sl fl xsc')\"\n        by(rule SmallStep.step.Seq)\n      moreover {\n        let ?P' = \"case xsc' of Semantic.Normal sc' \\<Rightarrow> {sl sc'} | _ \\<Rightarrow> {}\"\n        have \"HoarePartialDef.valid \\<Gamma>a F ?P' c1a' Q A\"\n        proof(cases xsc')\n          case (Normal sc')\n          hence rw_xsa': \"separable_lift sl fl xsc' = Semantic.Normal (sl sc')\"\n            by(simp add:separable_lift_def)\n\n          from step_c1a rw_xsa' obtain sa\n            where rw_xsa_initial: \"separable_lift sl fl xsc = Semantic.Normal sa\"\n            by(auto elim:step_NormalE)\n          then obtain sc\n            where rw_xsc: \"xsc = Semantic.Normal sc\"\n            by(auto elim:mode_preserving_NormalaE[OF separable_lift_mp])\n          with rw_xsa_initial have rw_sa: \"sa = sl sc\"\n            by(simp add:separable_lift_def)\n          with rw_xsa_initial have rw_xsa: \"separable_lift sl fl xsc = Semantic.Normal (sl sc)\"\n            by(simp)\n\n          note rw_xsa[symmetric]\n          also from Pc have \"separable_lift sl fl xsc \\<in> separable_lift sl fl ` P1c\"\n            by(auto)\n          also note Step.hyps(2)\n          finally have P1a: \"Semantic.xstate.Normal (sl sc) \\<in> P1a\" .\n          hence P: \"sl sc \\<in> P\"\n            by(rule Step.prems(3))\n\n          from Step.prems(2) step_c1a[unfolded rw_xsa rw_xsa'] P\n          have \"HoarePartialDef.valid \\<Gamma>a F {sl sc'} c1a' Q A\"\n            by(rule valid_step)\n          with Normal show ?thesis by(simp)\n\n        next\n          case (Abrupt sc')\n          then show ?thesis by(simp add:valid_s_emptypre)\n\n        next\n          case (Fault x3)\n          then show ?thesis by(simp add:valid_s_emptypre)\n\n        next\n          case Stuck\n          then show ?thesis by(simp add:valid_s_emptypre)\n        qed\n        moreover have \"\\<forall>sa'. Semantic.xstate.Normal sa' \\<in> {separable_lift sl fl xsc'} \\<longrightarrow> sa' \\<in> ?P'\"\n          by(cases xsc', simp_all add:separable_lift_def)\n        moreover have \"\\<forall>sa'. Semantic.Abrupt sa' \\<in> {separable_lift sl fl xsc'} \\<longrightarrow> sa' \\<in> A\"\n        proof(clarify)\n          fix sa\n          assume abr: \"Semantic.Abrupt sa = separable_lift sl fl xsc'\"\n\n          from step_c1a have [symmetric] : \"separable_lift sl fl xsc = Semantic.Abrupt sa\"\n            unfolding abr[symmetric] by(rule step_AbruptE)\n          also from Pc have \"separable_lift sl fl xsc \\<in> separable_lift sl fl ` P1c\"\n            by(auto)\n          also note Step.hyps(2)\n          finally show \"sa \\<in> A\"\n            by(rule Step.prems(4))\n        qed\n        moreover have \"(\\<forall>fa'. Semantic.xstate.Fault fa' \\<in> {separable_lift sl fl xsc'} \\<longrightarrow> fa' \\<in> F)\"\n        proof(clarify, rule contrapos_pp, assumption)\n          fix fa'\n          assume fault: \"Semantic.Fault fa' = separable_lift sl fl xsc'\"\n             and nF: \"fa' \\<notin> F\"\n\n          from step_c1a fault\n          have fault_step: \"SmallStep.step  \\<Gamma>a (c1a, separable_lift sl fl xsc) (c1a', Semantic.Fault fa')\"\n            by(simp)\n          moreover have \"Semantic.exec \\<Gamma>a c1a' (Semantic.Fault fa') (Semantic.Fault fa')\"\n            by(auto)\n          ultimately\n          have execa: \"Semantic.exec \\<Gamma>a c1a (separable_lift sl fl xsc) (Semantic.Fault fa')\"\n            by(rule step_extend)\n\n          from Pc have \"separable_lift sl fl xsc \\<in> separable_lift sl fl ` P1c\"\n            by(auto)\n          also note Step.hyps(2)\n          finally have P1a: \"separable_lift sl fl xsc \\<in> P1a\" .\n\n          from fault_step\n          show \"Semantic.xstate.Fault fa' \\<noteq> separable_lift sl fl xsc'\"\n          proof(cases rule:step_FaultE)\n            case FaultProp\n            with Step.prems(5) P1a have \"fa' \\<in> F\"\n              by(auto)\n            with nF show ?thesis\n              by(auto)\n          next\n            case (NewFault s)\n            with Step.prems(3) P1a\n            have \"separable_lift sl fl xsc \\<in> Semantic.xstate.Normal ` P\"\n              by(auto)\n            moreover from nF have \"Semantic.xstate.Fault fa' \\<notin> Semantic.xstate.Fault ` F\"\n              by(auto)\n            moreover note Step.prems(2) execa\n            ultimately show ?thesis\n              by(auto elim:valid_sE)\n          qed\n        qed\n        moreover from Step.prems(6)\n        have \"((\\<forall>xsc. xsc \\<in> {xsc'} \\<longrightarrow> \\<not> Semantic.exec \\<Gamma>c c1c' xsc Semantic.xstate.Stuck) \\<or>\n              Semantic.xstate.Stuck \\<in> P2c)\"\n        proof\n          assume \"Semantic.xstate.Stuck \\<in> P2c\"\n          thus ?thesis by(auto)\n        next\n          assume nostuck: \"\\<forall>xsc. xsc \\<in> P1c \\<longrightarrow> \\<not> Semantic.exec \\<Gamma>c c1c xsc Semantic.xstate.Stuck\"\n          hence \"\\<forall>xsc. xsc \\<in> {xsc'} \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c',xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck\"\n          proof(rule contrapos_pp)\n            assume \"\\<not> (\\<forall>xsc. xsc \\<in> {xsc'} \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c',xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck)\"\n            hence \"\\<Gamma>c\\<turnstile> \\<langle>c1c',xsc'\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck\"\n              by(blast)\n            with Seq(2) have \"\\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck\"\n              by(rule step_extend)\n            with Pc show \"\\<not> (\\<forall>xsc. xsc \\<in> P1c \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck)\"\n              by(blast)\n          qed\n          thus ?thesis by(auto)\n        qed\n        ultimately have \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Seq c1a' c2a),\n                          (\\<Gamma>c, {xsc'}, Language.Seq c1c' c2c))\n                            \\<in> refinement_s (separable_lift sl fl)\"\n          using IH by(auto)\n      }\n      ultimately show \"\\<exists>ca'.\n        SmallStep.step \\<Gamma>a (c1a;; c2a, separable_lift sl fl xsc) (ca', separable_lift sl fl xsc') \\<and>\n        ((\\<Gamma>a,{separable_lift sl fl xsc'},ca'), (\\<Gamma>c,{xsc'},cc'))\n          \\<in> refinement_s (separable_lift sl fl)\"\n        by(auto simp:Seq)\n\n    next\n      case SeqSkip\n      with Step have skipa: \"c1a = Language.Skip\" by(blast)\n\n      have \"SmallStep.step \\<Gamma>a (c1a;; c2a, separable_lift sl fl xsc)\n                              (c2a, separable_lift sl fl xsc')\"\n        unfolding SeqSkip skipa\n        by(rule SmallStep.step.SeqSkip)\n      moreover {\n        have execa: \"Semantic.exec \\<Gamma>a c1a (separable_lift sl fl xsc) (separable_lift sl fl xsc)\"\n          unfolding skipa\n          by(cases \"separable_lift sl fl xsc\", auto intro:Semantic.exec.Skip)\n\n        have \"xsc \\<in> P2c\"\n        proof(cases xsc)\n          case (Normal sc)\n          hence \"Semantic.Normal (sl sc) = separable_lift sl fl xsc\"\n            by(simp add:separable_lift_def)\n          also from Pc have \"separable_lift sl fl xsc \\<in> separable_lift sl fl ` P1c\"\n            by(auto)\n          also note Step.hyps(2)\n          finally have \"sl sc \\<in> P\"\n            by(rule Step.prems(3))\n          with Normal have Pa: \"separable_lift sl fl xsc \\<in> Semantic.xstate.Normal ` P\"\n            by(simp add:separable_lift_def)\n          moreover from Normal have nofault: \"separable_lift sl fl xsc \\<notin> Semantic.xstate.Fault ` F\"\n            by(auto simp:separable_lift_def)\n\n          from Step.prems(2) execa Pa nofault show ?thesis\n            by(cases rule:valid_sE, auto simp:Normal separable_lift_def intro:postNormal)\n\n        next\n          case (Abrupt sc)\n          hence \"Semantic.Abrupt (sl sc) = separable_lift sl fl xsc\"\n            by(simp add:separable_lift_def)\n          also from Pc have \"separable_lift sl fl xsc \\<in> separable_lift sl fl ` P1c\"\n            by(auto)\n          also note Step.hyps(2)\n          finally have \"sl sc \\<in> A\"\n            by(rule Step.prems(4))\n          thus ?thesis\n            unfolding Abrupt by(rule postAbrupt)\n\n        next\n          case (Fault fc)\n          hence \"Semantic.Fault (fl fc) = separable_lift sl fl xsc\"\n            by(simp add:separable_lift_def)\n          also from Pc have \"separable_lift sl fl xsc \\<in> separable_lift sl fl ` P1c\"\n            by(auto)\n          also note Step.hyps(2)\n          finally have \"fl fc \\<in> F\"\n            by(rule Step.prems(5))\n          thus ?thesis\n            unfolding Fault by(rule postFault)\n\n        next\n          case Stuck\n\n          from Step.prems(6)\n          show \"xsc \\<in> P2c\"\n            unfolding Stuck\n          proof\n            assume \"Semantic.xstate.Stuck \\<in> P2c\"\n            thus \"Semantic.xstate.Stuck \\<in> P2c\" .\n          next\n            assume ns: \"\\<forall>xsc. xsc \\<in> P1c \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.Stuck\"\n\n            have \"Semantic.exec \\<Gamma>c c1c xsc Semantic.Stuck\"\n              unfolding Stuck by(rule Semantic.exec.StuckProp)\n            with Pc ns\n            show \"Semantic.xstate.Stuck \\<in> P2c\"\n              by(auto)\n          qed\n        qed\n        hence \"((\\<Gamma>a, {separable_lift sl fl xsc'}, c2a), (\\<Gamma>c, {xsc'}, cc'))\n                        \\<in> refinement_s (separable_lift sl fl)\"\n          unfolding SeqSkip by(auto intro:refinement_s_strengthen[OF Step.prems(1)])\n      }\n      ultimately show ?thesis by(blast)\n\n    next\n      case (SeqThrow sc)\n\n      from SeqThrow\n      have normala: \"separable_lift sl fl xsc = Semantic.Normal (sl sc)\"\n       and normala': \"separable_lift sl fl xsc' = Semantic.Normal (sl sc)\"\n        unfolding separable_lift_def by(auto)\n\n      from SeqThrow Step.hyps\n      have throwa: \"c1a = Language.Throw\"\n        by(simp)\n\n      have \"SmallStep.step \\<Gamma>a (Language.Seq c1a c2a, separable_lift sl fl xsc)\n                              (Language.Throw, separable_lift sl fl xsc')\"\n        unfolding throwa normala normala'\n        by(rule SmallStep.step.SeqThrow)\n      moreover have \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Throw),\n                      (\\<Gamma>c, {xsc'}, cc')) \\<in> refinement_s (separable_lift sl fl)\"\n      proof(rule refinement_s.Step)\n        show \"separable_lift sl fl ` {xsc'} \\<subseteq> {separable_lift sl fl xsc'}\"\n          by(auto)\n        show \"(cc' = THROW) = (THROW = THROW)\"\n          by(simp add:SeqThrow)\n\n        assume \"cc' = SKIP\" thus \"THROW = SKIP\"\n          by(simp add:SeqThrow)\n\n      next\n        fix xsc'_h xsc'' cc''\n        assume \"xsc'_h \\<in> {xsc'}\"\n           and \"SmallStep.step \\<Gamma>c (cc',xsc'_h) (cc'',xsc'')\"\n        hence \"SmallStep.step \\<Gamma>c (cc',xsc') (cc'',xsc'')\"\n          by(simp)\n        then show \"\\<exists>ca'.\n          SmallStep.step \\<Gamma>a (Language.Throw, separable_lift sl fl xsc'_h)\n                            (ca', separable_lift sl fl xsc'') \\<and>\n             ((\\<Gamma>a, {separable_lift sl fl xsc''}, ca'), (\\<Gamma>c, {xsc''}, cc''))\n                  \\<in> refinement_s (separable_lift sl fl)\"\n          unfolding SeqThrow by(cases)\n      qed\n      ultimately show \"\\<exists>ca'.\n        SmallStep.step \\<Gamma>a (Language.Seq c1a c2a, separable_lift sl fl xsc)\n                          (ca', separable_lift sl fl xsc') \\<and>\n        ((\\<Gamma>a, {separable_lift sl fl xsc'}, ca'), (\\<Gamma>c, {xsc'}, cc'))\n               \\<in> refinement_s (separable_lift sl fl)\"\n        by(blast)\n  \n    next\n      case (FaultProp f)\n      then show ?thesis\n        using redex_Seq_ne by(auto)\n  \n    next\n      case StuckProp\n      then show ?thesis\n        using redex_Seq_ne by(auto)\n  \n    next\n      case (AbruptProp f)\n      then show ?thesis\n        using redex_Seq_ne by(auto)\n    qed\n  qed\nqed\n\nsection \\<open>Utility predicates.\\<close>\ndefinition \"noFault = - Semantic.Fault ` UNIV\"\ndefinition \"noAbrupt = - Semantic.Abrupt ` UNIV\"\ndefinition \"noStuck = - {Semantic.Stuck}\"\n\nlemma refinement_s_noAbrupt_SeqI:\n  assumes refines_c1: \"((\\<Gamma>a,P1a \\<inter> noAbrupt,c1a),(\\<Gamma>c,P1c \\<inter> noAbrupt,c1c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and refines_c2: \"((\\<Gamma>a,P2a \\<inter> noAbrupt,c2a),(\\<Gamma>c,P2c \\<inter> noAbrupt,c2c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and valid: \"HoarePartialDef.valid \\<Gamma>a F P c1a Q {}\"\n      and preFault: \"\\<And>fa. Semantic.Fault fa \\<in> P1a \\<Longrightarrow> fa \\<in> F\"\n      and preNormal: \"\\<And>sa. Semantic.Normal sa \\<in> P1a \\<Longrightarrow> sa \\<in> P\"\n      and propStuck: \"(\\<forall>xsc. xsc \\<in> P1c \\<longrightarrow> \\<not>Semantic.exec \\<Gamma>c c1c xsc Semantic.Stuck) \\<or>\n                      Semantic.Stuck \\<in> P2c\"\n      and postFault: \"\\<And>fc. fl fc \\<in> F \\<Longrightarrow> Semantic.Fault fc \\<in> P2c\"\n      and postNormal: \"\\<And>sc. sl sc \\<in> Q \\<Longrightarrow> Semantic.Normal sc \\<in> P2c\"\n    shows \"((\\<Gamma>a,P1a \\<inter> noAbrupt,Language.Seq c1a c2a), (\\<Gamma>c,P1c \\<inter> noAbrupt,Language.Seq c1c c2c))\n            \\<in> refinement_s (separable_lift sl fl)\"\nproof(rule refinement_s_SeqI[where P1a=\"P1a \\<inter> noAbrupt\" and P1c=\"P1c \\<inter> noAbrupt\" and\n                                   P2a=\"P2a \\<inter> noAbrupt\" and P2c=\"P2c \\<inter> noAbrupt\" and A=\"{}\",\n                             OF refines_c1 refines_c2 valid])\n  from preFault show \"\\<And>fa. Semantic.xstate.Fault fa \\<in> P1a \\<inter> noAbrupt \\<Longrightarrow> fa \\<in> F\"\n    unfolding noAbrupt_def by(auto)\n  show \"\\<And>sa. Abrupt sa \\<in> P1a \\<inter> noAbrupt \\<Longrightarrow> sa \\<in> {}\"\n    unfolding noAbrupt_def by(auto)\n  from preNormal show \"\\<And>sa. Semantic.xstate.Normal sa \\<in> P1a \\<inter> noAbrupt \\<Longrightarrow> sa \\<in> P\"\n    unfolding noAbrupt_def by(auto)\n  from propStuck show \"(\\<forall>xsc. xsc \\<in> P1c \\<inter> noAbrupt \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck) \\<or>\n                       Semantic.xstate.Stuck \\<in> P2c \\<inter> noAbrupt\"\n    unfolding noAbrupt_def by(auto)\n  from postFault show \"\\<And>fc. fl fc \\<in> F \\<Longrightarrow> Semantic.xstate.Fault fc \\<in> P2c \\<inter> noAbrupt\"\n    unfolding noAbrupt_def by(auto)\n  show \"\\<And>sc. sl sc \\<in> {} \\<Longrightarrow> Abrupt sc \\<in> P2c \\<inter> noAbrupt\"\n    unfolding noAbrupt_def by(auto)\n  from postNormal show \"\\<And>sc. sl sc \\<in> Q \\<Longrightarrow> Semantic.xstate.Normal sc \\<in> P2c \\<inter> noAbrupt\"\n    unfolding noAbrupt_def by(auto)\nqed\n\nlemma refinement_s_noStuck_noAbrupt_SeqI:\n  assumes refines_c1: \"((\\<Gamma>a,P1a \\<inter> noStuck \\<inter> noAbrupt,c1a),(\\<Gamma>c,P1c \\<inter> noStuck \\<inter> noAbrupt,c1c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and refines_c2: \"((\\<Gamma>a,P2a \\<inter> noStuck \\<inter> noAbrupt,c2a),(\\<Gamma>c,P2c \\<inter> noStuck \\<inter> noAbrupt,c2c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and valid: \"HoarePartialDef.valid \\<Gamma>a F P c1a Q {}\"\n      and preFault: \"\\<And>fa. Semantic.Fault fa \\<in> P1a \\<Longrightarrow> fa \\<in> F\"\n      and preNormal: \"\\<And>sa. Semantic.Normal sa \\<in> P1a \\<Longrightarrow> sa \\<in> P\"\n      and noStuck: \"\\<And>xsc. xsc \\<in> P1c \\<Longrightarrow> xsc \\<noteq> Semantic.Stuck \\<Longrightarrow>\n                            \\<not> Semantic.exec \\<Gamma>c c1c xsc Semantic.Stuck\"\n      and postFault: \"\\<And>fc. fl fc \\<in> F \\<Longrightarrow> Semantic.Fault fc \\<in> P2c\"\n      and postNormal: \"\\<And>sc. sl sc \\<in> Q \\<Longrightarrow> Semantic.Normal sc \\<in> P2c\"\n    shows \"((\\<Gamma>a,P1a \\<inter> noStuck \\<inter> noAbrupt,Language.Seq c1a c2a),\n           (\\<Gamma>c,P1c \\<inter> noStuck \\<inter> noAbrupt,Language.Seq c1c c2c))\n            \\<in> refinement_s (separable_lift sl fl)\"\nproof(rule refinement_s_noAbrupt_SeqI[where P1a=\"P1a \\<inter> noStuck\" and P1c=\"P1c \\<inter> noStuck\" and\n                                            P2a=\"P2a \\<inter> noStuck\" and P2c=\"P2c \\<inter> noStuck\",\n                                      OF refines_c1 refines_c2 valid])\n  from preFault show \"\\<And>fa. Semantic.xstate.Fault fa \\<in> P1a \\<inter> noStuck \\<Longrightarrow> fa \\<in> F\"\n    unfolding noStuck_def by(auto)\n  from preNormal show \"\\<And>sa. Semantic.xstate.Normal sa \\<in> P1a \\<inter> noStuck \\<Longrightarrow> sa \\<in> P\"\n    unfolding noStuck_def by(auto)\n  from noStuck show \"(\\<forall>xsc. xsc \\<in> P1c \\<inter> noStuck \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck) \\<or>\n                     Semantic.xstate.Stuck \\<in> P2c \\<inter> noStuck\"\n    unfolding noStuck_def by(auto)\n  from postFault show \"\\<And>fc. fl fc \\<in> F \\<Longrightarrow> Semantic.xstate.Fault fc \\<in> P2c \\<inter> noStuck\"\n    unfolding noStuck_def by(auto)\n  from postNormal show \"\\<And>sc. sl sc \\<in> Q \\<Longrightarrow> Semantic.xstate.Normal sc \\<in> P2c \\<inter> noStuck\"\n    unfolding noStuck_def by(auto)\nqed\n\nlemma refinement_s_noFault_noStuck_noAbrupt_SeqI:\n  assumes refines_c1: \"((\\<Gamma>a,P1a \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,c1a),\n                        (\\<Gamma>c,P1c \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,c1c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and refines_c2: \"((\\<Gamma>a,P2a \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,c2a),\n                        (\\<Gamma>c,P2c \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,c2c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and valid: \"HoarePartialDef.valid \\<Gamma>a {} P c1a Q {}\"\n      and preNormal: \"\\<And>sa. Semantic.Normal sa \\<in> P1a \\<Longrightarrow> sa \\<in> P\"\n      and noStuck: \"\\<And>xsc. xsc \\<in> P1c \\<Longrightarrow> xsc \\<noteq> Semantic.Stuck \\<Longrightarrow> \\<nexists>fc. xsc = Semantic.Fault fc \\<Longrightarrow>\n                            \\<not> Semantic.exec \\<Gamma>c c1c xsc Semantic.Stuck\"\n      and postNormal: \"\\<And>sc. sl sc \\<in> Q \\<Longrightarrow> Semantic.Normal sc \\<in> P2c\"\n    shows \"((\\<Gamma>a,P1a \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,Language.Seq c1a c2a),\n           (\\<Gamma>c,P1c \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,Language.Seq c1c c2c))\n            \\<in> refinement_s (separable_lift sl fl)\"\nproof(rule refinement_s_noStuck_noAbrupt_SeqI[where P1a=\"P1a \\<inter> noFault\" and P1c=\"P1c \\<inter> noFault\" and\n                                                    P2a=\"P2a \\<inter> noFault\" and P2c=\"P2c \\<inter> noFault\" and\n                                                    F=\"{}\",\n                                              OF refines_c1 refines_c2 valid])\n  show \"\\<And>fa. Semantic.xstate.Fault fa \\<in> P1a \\<inter> noFault \\<Longrightarrow> fa \\<in> {}\"\n    unfolding noFault_def by(auto)\n  from preNormal show \"\\<And>sa. Semantic.xstate.Normal sa \\<in> P1a \\<inter> noFault \\<Longrightarrow> sa \\<in> P\"\n    unfolding noFault_def by(auto)\n  from noStuck show \"\\<And>xsc. xsc \\<in> P1c \\<inter> noFault \\<Longrightarrow>\n                           xsc \\<noteq> Semantic.xstate.Stuck \\<Longrightarrow>\n                           \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck\"\n    unfolding noFault_def by(auto)\n  show \"\\<And>fc. fl fc \\<in> {} \\<Longrightarrow> Semantic.xstate.Fault fc \\<in> P2c \\<inter> noFault\"\n    unfolding noFault_def by(auto)\n  from postNormal show \"\\<And>sc. sl sc \\<in> Q \\<Longrightarrow> Semantic.xstate.Normal sc \\<in> P2c \\<inter> noFault\"\n    unfolding noFault_def by(auto)\nqed\n\nlemma refinement_s_SeqI':\n  assumes refines_c1: \"((\\<Gamma>a,P1a,c1a),(\\<Gamma>c,P1c,c1c)) \\<in> refinement_s (separable_lift sl fl)\"\n      and refines_c2: \"((\\<Gamma>a,P2a,c2a),(\\<Gamma>c,P2c,c2c)) \\<in> refinement_s (separable_lift sl fl)\"\n      and valid: \"HoarePartialDef.valid \\<Gamma>c F P c1c Q A\"\n      and preFault: \"\\<And>fc. Semantic.Fault fc \\<in> P1c \\<Longrightarrow> fc \\<in> F\"\n      and preAbrupt: \"\\<And>sc. Semantic.Abrupt sc \\<in> P1c \\<Longrightarrow> sc \\<in> A\"\n      and preNormal: \"\\<And>sc. Semantic.Normal sc \\<in> P1c \\<Longrightarrow> sc \\<in> P\"\n      and propStuck: \"(\\<forall>xsc. xsc \\<in> P1c \\<longrightarrow> \\<not>Semantic.exec \\<Gamma>c c1c xsc Semantic.Stuck) \\<or>\n                      Semantic.Stuck \\<in> P2c\"\n      and postFault: \"\\<And>fc. fc \\<in> F \\<Longrightarrow> Semantic.Fault fc \\<in> P2c\"\n      and postAbrupt: \"\\<And>sc. sc \\<in> A \\<Longrightarrow> Semantic.Abrupt sc \\<in> P2c\"\n      and postNormal: \"\\<And>sc. sc \\<in> Q \\<Longrightarrow> Semantic.Normal sc \\<in> P2c\"\n    shows \"((\\<Gamma>a,P1a,Language.Seq c1a c2a), (\\<Gamma>c,P1c,Language.Seq c1c c2c))\n            \\<in> refinement_s (separable_lift sl fl)\"\n  using refines_c1 refines_c2 valid preNormal preAbrupt preFault propStuck\nproof(induct arbitrary:P)\n  case (Step P1c \\<Gamma>c c1c \\<Gamma>a c1a P1a)\n\n  show ?case\n  proof(rule refinement_s.Step)\n    show \"(Language.Seq c1c c2c = THROW) = (Language.Seq c1a c2a = THROW)\" by(auto)\n\n  next\n    fix xsa xsc\n    assume \"Language.Seq c1c c2c = Language.Skip\"\n    thus \"Language.Seq c1a c2a = Language.Skip\"\n      by(simp)\n\n  next\n    from Step.hyps(2) show \"separable_lift sl fl ` P1c \\<subseteq> P1a\" .\n\n  next\n    fix xsc xsc' cc'\n    assume Pc: \"xsc \\<in> P1c\"\n       and stepc: \"SmallStep.step \\<Gamma>c (Language.Seq c1c c2c, xsc) (cc', xsc')\"\n\n    from stepc\n    show \"\\<exists>ca'.\n            SmallStep.step \\<Gamma>a (Language.Seq c1a c2a, separable_lift sl fl xsc)\n                              (ca', separable_lift sl fl xsc') \\<and>\n            ((\\<Gamma>a, {separable_lift sl fl xsc'}, ca'), \\<Gamma>c, {xsc'}, cc')\n              \\<in> refinement_s (separable_lift sl fl)\"\n    proof(cases rule:SmallStep.step.cases)\n      case (Seq c1c')\n\n      from Step.hyps(1)[OF Pc Seq(2)] Step.prems(1) obtain c1a'\n        where step_c1a: \"SmallStep.step \\<Gamma>a (c1a, separable_lift sl fl xsc)\n                                           (c1a', separable_lift sl fl xsc')\"\n          and refines_c1a': \"((\\<Gamma>a, {separable_lift sl fl xsc'}, c1a'), (\\<Gamma>c, {xsc'}, c1c'))\n                              \\<in> refinement_s (separable_lift sl fl)\"\n          and IH: \"\\<forall>P. HoarePartialDef.valid \\<Gamma>c F P c1c' Q A \\<longrightarrow>\n                      (\\<forall>sa'. Semantic.Normal sa' \\<in> {xsc'} \\<longrightarrow> sa' \\<in> P) \\<longrightarrow>\n                      (\\<forall>sa'. Semantic.Abrupt sa' \\<in> {xsc'} \\<longrightarrow> sa' \\<in> A) \\<longrightarrow>\n                      (\\<forall>fa'. Semantic.xstate.Fault fa' \\<in> {xsc'} \\<longrightarrow> fa' \\<in> F) \\<longrightarrow>\n                      ((\\<forall>xsc. xsc \\<in> {xsc'} \\<longrightarrow> \\<not> Semantic.exec \\<Gamma>c c1c' xsc Semantic.xstate.Stuck) \\<or>\n                          Semantic.xstate.Stuck \\<in> P2c) \\<longrightarrow>\n                      ((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Seq c1a' c2a),\n                       (\\<Gamma>c, {xsc'}, Language.Seq c1c' c2c)) \\<in> refinement_s (separable_lift sl fl)\"\n        by(blast)\n\n      from step_c1a have \"SmallStep.step \\<Gamma>a (Language.Seq c1a c2a, separable_lift sl fl xsc)\n                                            (Language.Seq c1a' c2a, separable_lift sl fl xsc')\"\n        by(rule SmallStep.step.Seq)\n      moreover {\n        let ?P' = \"case xsc' of Semantic.Normal sc' \\<Rightarrow> {sc'} | _ \\<Rightarrow> {}\"\n        have \"HoarePartialDef.valid \\<Gamma>c F ?P' c1c' Q A\"\n        proof(cases xsc')\n          case (Normal sc')\n          hence rw_xsa': \"separable_lift sl fl xsc' = Semantic.Normal (sl sc')\"\n            by(simp add:separable_lift_def)\n\n          from step_c1a rw_xsa' obtain sa\n            where rw_xsa_initial: \"separable_lift sl fl xsc = Semantic.Normal sa\"\n            by(auto elim:step_NormalE)\n          then obtain sc\n            where rw_xsc: \"xsc = Semantic.Normal sc\"\n            by(auto elim:mode_preserving_NormalaE[OF separable_lift_mp])\n          with rw_xsa_initial have rw_sa: \"sa = sl sc\"\n            by(simp add:separable_lift_def)\n          with rw_xsa_initial have rw_xsa: \"separable_lift sl fl xsc = Semantic.Normal (sl sc)\"\n            by(simp)\n\n          from Pc have \"Semantic.xstate.Normal sc \\<in> P1c\"\n            by(simp add:rw_xsc)\n          hence P: \"sc \\<in> P\"\n            by(rule Step.prems(3))\n\n          from Step.prems(2) Seq(2)[unfolded rw_xsc Normal] P\n          have \"HoarePartialDef.valid \\<Gamma>c F {sc'} c1c' Q A\"\n            by(rule valid_step)\n          with Normal show ?thesis by(simp)\n\n        next\n          case (Abrupt sc')\n          then show ?thesis by(simp add:valid_s_emptypre)\n\n        next\n          case (Fault x3)\n          then show ?thesis by(simp add:valid_s_emptypre)\n\n        next\n          case Stuck\n          then show ?thesis by(simp add:valid_s_emptypre)\n        qed\n        moreover have \"\\<forall>sc'. Semantic.xstate.Normal sc' \\<in> {xsc'} \\<longrightarrow> sc' \\<in> ?P'\"\n          by(cases xsc', simp_all add:separable_lift_def)\n        moreover have \"\\<forall>sc'. Semantic.Abrupt sc' \\<in> {xsc'} \\<longrightarrow> sc' \\<in> A\"\n        proof(clarify)\n          fix sc\n          assume abr: \"xsc' = Semantic.Abrupt sc\"\n\n          from Seq(2) have [symmetric] : \"xsc = Semantic.Abrupt sc\"\n            unfolding abr by(rule step_AbruptE)\n          also note Pc\n          finally show \"sc \\<in> A\"\n            by(rule Step.prems(4))\n        qed\n        moreover have \"(\\<forall>fc'. Semantic.xstate.Fault fc' \\<in> {xsc'} \\<longrightarrow> fc' \\<in> F)\"\n        proof(clarify, rule contrapos_pp, assumption)\n          fix fc'\n          assume fault: \"xsc' = Semantic.Fault fc'\"\n             and nF: \"fc' \\<notin> F\"\n\n          from Seq(2) fault\n          have fault_step: \"SmallStep.step  \\<Gamma>c (c1c, xsc) (c1c', Semantic.Fault fc')\"\n            by(simp)\n          moreover have \"Semantic.exec \\<Gamma>c c1c' (Semantic.Fault fc') (Semantic.Fault fc')\"\n            by(auto)\n          ultimately\n          have execc: \"Semantic.exec \\<Gamma>c c1c xsc (Semantic.Fault fc')\"\n            by(rule step_extend)\n\n          from Pc have \"separable_lift sl fl xsc \\<in> separable_lift sl fl ` P1c\"\n            by(auto)\n          also note Step.hyps(2)\n          finally have P1a: \"separable_lift sl fl xsc \\<in> P1a\" .\n\n          from fault_step\n          show \"xsc' \\<noteq> Semantic.xstate.Fault fc'\"\n          proof(cases rule:step_FaultE)\n            case FaultProp\n            with Step.prems(5) Pc have \"fc' \\<in> F\"\n              by(auto)\n            with nF show ?thesis\n              by(auto)\n          next\n            case (NewFault s)\n            with Step.prems(3) Pc\n            have \"xsc \\<in> Semantic.xstate.Normal ` P\"\n              by(auto)\n            moreover from nF have \"Semantic.xstate.Fault fc' \\<notin> Semantic.xstate.Fault ` F\"\n              by(auto)\n            moreover note Step.prems(2) execc\n            ultimately show ?thesis\n              by(auto elim:valid_sE)\n          qed\n        qed\n        moreover from Step.prems(6)\n        have \"((\\<forall>xsc. xsc \\<in> {xsc'} \\<longrightarrow> \\<not> Semantic.exec \\<Gamma>c c1c' xsc Semantic.xstate.Stuck) \\<or>\n              Semantic.xstate.Stuck \\<in> P2c)\"\n        proof\n          assume \"Semantic.xstate.Stuck \\<in> P2c\"\n          thus ?thesis by(auto)\n        next\n          assume nostuck: \"\\<forall>xsc. xsc \\<in> P1c \\<longrightarrow> \\<not> Semantic.exec \\<Gamma>c c1c xsc Semantic.xstate.Stuck\"\n          hence \"\\<forall>xsc. xsc \\<in> {xsc'} \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c',xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck\"\n          proof(rule contrapos_pp)\n            assume \"\\<not> (\\<forall>xsc. xsc \\<in> {xsc'} \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c',xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck)\"\n            hence \"\\<Gamma>c\\<turnstile> \\<langle>c1c',xsc'\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck\"\n              by(blast)\n            with Seq(2) have \"\\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck\"\n              by(rule step_extend)\n            with Pc show \"\\<not> (\\<forall>xsc. xsc \\<in> P1c \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck)\"\n              by(blast)\n          qed\n          thus ?thesis by(auto)\n        qed\n        ultimately have \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Seq c1a' c2a),\n                          (\\<Gamma>c, {xsc'}, Language.Seq c1c' c2c))\n                            \\<in> refinement_s (separable_lift sl fl)\"\n          using IH by(auto)\n      }\n      ultimately show \"\\<exists>ca'.\n        SmallStep.step \\<Gamma>a (c1a;; c2a, separable_lift sl fl xsc) (ca', separable_lift sl fl xsc') \\<and>\n        ((\\<Gamma>a,{separable_lift sl fl xsc'},ca'), (\\<Gamma>c,{xsc'},cc'))\n          \\<in> refinement_s (separable_lift sl fl)\"\n        by(auto simp:Seq)\n\n    next\n      case SeqSkip\n      with Step have skipa: \"c1a = Language.Skip\" by(blast)\n\n      have \"SmallStep.step \\<Gamma>a (c1a;; c2a, separable_lift sl fl xsc)\n                              (c2a, separable_lift sl fl xsc')\"\n        unfolding SeqSkip skipa\n        by(rule SmallStep.step.SeqSkip)\n      moreover {\n        have execc: \"Semantic.exec \\<Gamma>c c1c xsc xsc\"\n          unfolding SeqSkip\n          by(cases xsc, auto intro:Semantic.exec.Skip)\n\n        have \"xsc \\<in> P2c\"\n        proof(cases xsc)\n          case (Normal sc)\n          with Pc have \"Semantic.xstate.Normal sc \\<in> P1c\" by(simp)\n          hence \"sc \\<in> P\" by(rule Step.prems(3))\n          hence P: \"xsc \\<in> Semantic.Normal ` P\" by(simp add:Normal)\n\n          from Normal have nofault: \"xsc \\<notin> Semantic.xstate.Fault ` F\" by(auto)\n\n          from Step.prems(2) execc P nofault show ?thesis\n            by(cases rule:valid_sE, auto simp:Normal intro:postNormal)\n\n        next\n          case (Abrupt sc)\n          with Pc have \"Semantic.xstate.Abrupt sc \\<in> P1c\" by(simp)\n          hence \"sc \\<in> A\" by(rule Step.prems(4))\n          thus ?thesis unfolding Abrupt by(rule postAbrupt)\n\n        next\n          case (Fault fc)\n          with Pc have \"Semantic.xstate.Fault fc \\<in> P1c\" by(simp)\n          hence \"fc \\<in> F\" by(rule Step.prems(5))\n          thus ?thesis unfolding Fault by(rule postFault)\n\n        next\n          case Stuck\n\n          from Step.prems(6)\n          show \"xsc \\<in> P2c\"\n            unfolding Stuck\n          proof\n            assume \"Semantic.xstate.Stuck \\<in> P2c\"\n            thus \"Semantic.xstate.Stuck \\<in> P2c\" .\n          next\n            assume ns: \"\\<forall>xsc. xsc \\<in> P1c \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.Stuck\"\n\n            have \"Semantic.exec \\<Gamma>c c1c xsc Semantic.Stuck\"\n              unfolding Stuck by(rule Semantic.exec.StuckProp)\n            with Pc ns\n            show \"Semantic.xstate.Stuck \\<in> P2c\"\n              by(auto)\n          qed\n        qed\n        hence \"((\\<Gamma>a, {separable_lift sl fl xsc'}, c2a), (\\<Gamma>c, {xsc'}, cc'))\n                        \\<in> refinement_s (separable_lift sl fl)\"\n          unfolding SeqSkip by(auto intro:refinement_s_strengthen[OF Step.prems(1)])\n      }\n      ultimately show ?thesis by(blast)\n\n    next\n      case (SeqThrow sc)\n\n      from SeqThrow\n      have normala: \"separable_lift sl fl xsc = Semantic.Normal (sl sc)\"\n       and normala': \"separable_lift sl fl xsc' = Semantic.Normal (sl sc)\"\n        unfolding separable_lift_def by(auto)\n\n      from SeqThrow Step.hyps\n      have throwa: \"c1a = Language.Throw\"\n        by(simp)\n\n      have \"SmallStep.step \\<Gamma>a (Language.Seq c1a c2a, separable_lift sl fl xsc)\n                              (Language.Throw, separable_lift sl fl xsc')\"\n        unfolding throwa normala normala'\n        by(rule SmallStep.step.SeqThrow)\n      moreover have \"((\\<Gamma>a, {separable_lift sl fl xsc'}, Language.Throw),\n                      (\\<Gamma>c, {xsc'}, cc')) \\<in> refinement_s (separable_lift sl fl)\"\n      proof(rule refinement_s.Step)\n        show \"separable_lift sl fl ` {xsc'} \\<subseteq> {separable_lift sl fl xsc'}\"\n          by(auto)\n        show \"(cc' = THROW) = (THROW = THROW)\"\n          by(simp add:SeqThrow)\n\n        assume \"cc' = SKIP\" thus \"THROW = SKIP\"\n          by(simp add:SeqThrow)\n\n      next\n        fix xsc'_h xsc'' cc''\n        assume \"xsc'_h \\<in> {xsc'}\"\n           and \"SmallStep.step \\<Gamma>c (cc',xsc'_h) (cc'',xsc'')\"\n        hence \"SmallStep.step \\<Gamma>c (cc',xsc') (cc'',xsc'')\"\n          by(simp)\n        then show \"\\<exists>ca'.\n          SmallStep.step \\<Gamma>a (Language.Throw, separable_lift sl fl xsc'_h)\n                            (ca', separable_lift sl fl xsc'') \\<and>\n             ((\\<Gamma>a, {separable_lift sl fl xsc''}, ca'), (\\<Gamma>c, {xsc''}, cc''))\n                  \\<in> refinement_s (separable_lift sl fl)\"\n          unfolding SeqThrow by(cases)\n      qed\n      ultimately show \"\\<exists>ca'.\n        SmallStep.step \\<Gamma>a (Language.Seq c1a c2a, separable_lift sl fl xsc)\n                          (ca', separable_lift sl fl xsc') \\<and>\n        ((\\<Gamma>a, {separable_lift sl fl xsc'}, ca'), (\\<Gamma>c, {xsc'}, cc'))\n               \\<in> refinement_s (separable_lift sl fl)\"\n        by(blast)\n  \n    next\n      case (FaultProp f)\n      then show ?thesis\n        using redex_Seq_ne by(auto)\n  \n    next\n      case StuckProp\n      then show ?thesis\n        using redex_Seq_ne by(auto)\n  \n    next\n      case (AbruptProp f)\n      then show ?thesis\n        using redex_Seq_ne by(auto)\n    qed\n  qed\nqed\n\nlemma refinement_s_noAbrupt_SeqI':\n  assumes refines_c1: \"((\\<Gamma>a,P1a \\<inter> noAbrupt,c1a),(\\<Gamma>c,P1c \\<inter> noAbrupt,c1c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and refines_c2: \"((\\<Gamma>a,P2a \\<inter> noAbrupt,c2a),(\\<Gamma>c,P2c \\<inter> noAbrupt,c2c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and valid: \"HoarePartialDef.valid \\<Gamma>c F P c1c Q {}\"\n      and preFault: \"\\<And>fc. Semantic.Fault fc \\<in> P1c \\<Longrightarrow> fc \\<in> F\"\n      and preNormal: \"\\<And>sc. Semantic.Normal sc \\<in> P1c \\<Longrightarrow> sc \\<in> P\"\n      and propStuck: \"(\\<forall>xsc. xsc \\<in> P1c \\<longrightarrow> \\<not>Semantic.exec \\<Gamma>c c1c xsc Semantic.Stuck) \\<or>\n                      Semantic.Stuck \\<in> P2c\"\n      and postFault: \"\\<And>fc. fc \\<in> F \\<Longrightarrow> Semantic.Fault fc \\<in> P2c\"\n      and postNormal: \"\\<And>sc. sc \\<in> Q \\<Longrightarrow> Semantic.Normal sc \\<in> P2c\"\n    shows \"((\\<Gamma>a,P1a \\<inter> noAbrupt,Language.Seq c1a c2a), (\\<Gamma>c,P1c \\<inter> noAbrupt,Language.Seq c1c c2c))\n            \\<in> refinement_s (separable_lift sl fl)\"\nproof(rule refinement_s_SeqI'[where P1a=\"P1a \\<inter> noAbrupt\" and P1c=\"P1c \\<inter> noAbrupt\" and\n                                    P2a=\"P2a \\<inter> noAbrupt\" and P2c=\"P2c \\<inter> noAbrupt\" and A=\"{}\",\n                              OF refines_c1 refines_c2 valid])\n  from preFault show \"\\<And>fc. Semantic.xstate.Fault fc \\<in> P1c \\<inter> noAbrupt \\<Longrightarrow> fc \\<in> F\"\n    unfolding noAbrupt_def by(auto)\n  show \"\\<And>sc. Abrupt sc \\<in> P1c \\<inter> noAbrupt \\<Longrightarrow> sc \\<in> {}\"\n    unfolding noAbrupt_def by(auto)\n  from preNormal show \"\\<And>sc. Semantic.xstate.Normal sc \\<in> P1c \\<inter> noAbrupt \\<Longrightarrow> sc \\<in> P\"\n    unfolding noAbrupt_def by(auto)\n  from propStuck show \"(\\<forall>xsc. xsc \\<in> P1c \\<inter> noAbrupt \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck) \\<or>\n                       Semantic.xstate.Stuck \\<in> P2c \\<inter> noAbrupt\"\n    unfolding noAbrupt_def by(auto)\n  from postFault show \"\\<And>fc. fc \\<in> F \\<Longrightarrow> Semantic.xstate.Fault fc \\<in> P2c \\<inter> noAbrupt\"\n    unfolding noAbrupt_def by(auto)\n  show \"\\<And>sc. sc \\<in> {} \\<Longrightarrow> Abrupt sc \\<in> P2c \\<inter> noAbrupt\"\n    unfolding noAbrupt_def by(auto)\n  from postNormal show \"\\<And>sc. sc \\<in> Q \\<Longrightarrow> Semantic.xstate.Normal sc \\<in> P2c \\<inter> noAbrupt\"\n    unfolding noAbrupt_def by(auto)\nqed\n\nlemma refinement_s_noStuck_noAbrupt_SeqI':\n  assumes refines_c1: \"((\\<Gamma>a,P1a \\<inter> noStuck \\<inter> noAbrupt,c1a),(\\<Gamma>c,P1c \\<inter> noStuck \\<inter> noAbrupt,c1c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and refines_c2: \"((\\<Gamma>a,P2a \\<inter> noStuck \\<inter> noAbrupt,c2a),(\\<Gamma>c,P2c \\<inter> noStuck \\<inter> noAbrupt,c2c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and valid: \"HoarePartialDef.valid \\<Gamma>c F P c1c Q {}\"\n      and preFault: \"\\<And>fc. Semantic.Fault fc \\<in> P1c \\<Longrightarrow> fc \\<in> F\"\n      and preNormal: \"\\<And>sc. Semantic.Normal sc \\<in> P1c \\<Longrightarrow> sc \\<in> P\"\n      and noStuck: \"\\<And>xsc. xsc \\<in> P1c \\<Longrightarrow> xsc \\<noteq> Semantic.Stuck \\<Longrightarrow>\n                            \\<not> Semantic.exec \\<Gamma>c c1c xsc Semantic.Stuck\"\n      and postFault: \"\\<And>fc. fc \\<in> F \\<Longrightarrow> Semantic.Fault fc \\<in> P2c\"\n      and postNormal: \"\\<And>sc. sc \\<in> Q \\<Longrightarrow> Semantic.Normal sc \\<in> P2c\"\n    shows \"((\\<Gamma>a,P1a \\<inter> noStuck \\<inter> noAbrupt,Language.Seq c1a c2a),\n           (\\<Gamma>c,P1c \\<inter> noStuck \\<inter> noAbrupt,Language.Seq c1c c2c))\n            \\<in> refinement_s (separable_lift sl fl)\"\nproof(rule refinement_s_noAbrupt_SeqI'[where P1a=\"P1a \\<inter> noStuck\" and P1c=\"P1c \\<inter> noStuck\" and\n                                             P2a=\"P2a \\<inter> noStuck\" and P2c=\"P2c \\<inter> noStuck\",\n                                       OF refines_c1 refines_c2 valid])\n  from preFault show \"\\<And>fc. Semantic.xstate.Fault fc \\<in> P1c \\<inter> noStuck \\<Longrightarrow> fc \\<in> F\"\n    unfolding noStuck_def by(auto)\n  from preNormal show \"\\<And>sc. Semantic.xstate.Normal sc \\<in> P1c \\<inter> noStuck \\<Longrightarrow> sc \\<in> P\"\n    unfolding noStuck_def by(auto)\n  from noStuck show \"(\\<forall>xsc. xsc \\<in> P1c \\<inter> noStuck \\<longrightarrow> \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck) \\<or>\n                     Semantic.xstate.Stuck \\<in> P2c \\<inter> noStuck\"\n    unfolding noStuck_def by(auto)\n  from postFault show \"\\<And>fc. fc \\<in> F \\<Longrightarrow> Semantic.xstate.Fault fc \\<in> P2c \\<inter> noStuck\"\n    unfolding noStuck_def by(auto)\n  from postNormal show \"\\<And>sc. sc \\<in> Q \\<Longrightarrow> Semantic.xstate.Normal sc \\<in> P2c \\<inter> noStuck\"\n    unfolding noStuck_def by(auto)\nqed\n\nlemma refinement_s_noFault_noStuck_noAbrupt_SeqI':\n  assumes refines_c1: \"((\\<Gamma>a,P1a \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,c1a),\n                        (\\<Gamma>c,P1c \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,c1c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and refines_c2: \"((\\<Gamma>a,P2a \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,c2a),\n                        (\\<Gamma>c,P2c \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,c2c))\n                          \\<in> refinement_s (separable_lift sl fl)\"\n      and valid: \"HoarePartialDef.valid \\<Gamma>c {} P c1c Q {}\"\n      and preNormal: \"\\<And>sc. Semantic.Normal sc \\<in> P1c \\<Longrightarrow> sc \\<in> P\"\n      and noStuck: \"\\<And>xsc. xsc \\<in> P1c \\<Longrightarrow> xsc \\<noteq> Semantic.Stuck \\<Longrightarrow> \\<nexists>fc. xsc = Semantic.Fault fc \\<Longrightarrow>\n                            \\<not> Semantic.exec \\<Gamma>c c1c xsc Semantic.Stuck\"\n      and postNormal: \"\\<And>sc. sc \\<in> Q \\<Longrightarrow> Semantic.Normal sc \\<in> P2c\"\n    shows \"((\\<Gamma>a,P1a \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,Language.Seq c1a c2a),\n           (\\<Gamma>c,P1c \\<inter> noFault \\<inter> noStuck \\<inter> noAbrupt,Language.Seq c1c c2c))\n            \\<in> refinement_s (separable_lift sl fl)\"\nproof(rule refinement_s_noStuck_noAbrupt_SeqI'[where P1a=\"P1a \\<inter> noFault\" and P1c=\"P1c \\<inter> noFault\" and\n                                                     P2a=\"P2a \\<inter> noFault\" and P2c=\"P2c \\<inter> noFault\" and\n                                                     F=\"{}\",\n                                               OF refines_c1 refines_c2 valid])\n  show \"\\<And>fc. Semantic.xstate.Fault fc \\<in> P1c \\<inter> noFault \\<Longrightarrow> fc \\<in> {}\"\n    unfolding noFault_def by(auto)\n  from preNormal show \"\\<And>sc. Semantic.xstate.Normal sc \\<in> P1c \\<inter> noFault \\<Longrightarrow> sc \\<in> P\"\n    unfolding noFault_def by(auto)\n  from noStuck show \"\\<And>xsc. xsc \\<in> P1c \\<inter> noFault \\<Longrightarrow>\n                           xsc \\<noteq> Semantic.xstate.Stuck \\<Longrightarrow>\n                           \\<not> \\<Gamma>c\\<turnstile> \\<langle>c1c,xsc\\<rangle> \\<Rightarrow> Semantic.xstate.Stuck\"\n    unfolding noFault_def by(auto)\n  show \"\\<And>fc. fc \\<in> {} \\<Longrightarrow> Semantic.xstate.Fault fc \\<in> P2c \\<inter> noFault\"\n    unfolding noFault_def by(auto)\n  from postNormal show \"\\<And>sc. sc \\<in> Q \\<Longrightarrow> Semantic.xstate.Normal sc \\<in> P2c \\<inter> noFault\"\n    unfolding noFault_def by(auto)\nqed\n\nend", "meta": {"author": "CleanQ-Project", "repo": "cleanq-proofs", "sha": "5212fcd2aceba0028bd1474e0553578a6091ca63", "save_path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs", "path": "github-repos/isabelle/CleanQ-Project-cleanq-proofs/cleanq-proofs-5212fcd2aceba0028bd1474e0553578a6091ca63/refinements/Refinements.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381372136563, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.30946391956151886}}
{"text": "theory NullableClassFieldValue\n  imports\n    Main\n    \"Ecore-GROOVE-Mapping.Instance_Model_Graph_Mapping\"\n    NullableClassField\nbegin\n\nsection \"Definition of an instance model which introduces values for a field typed by a class that can be nullable\"\n\ndefinition imod_nullable_class_field :: \"'t Id \\<Rightarrow> 't \\<Rightarrow> 't Id \\<Rightarrow> 'o set \\<Rightarrow> 'o set \\<Rightarrow> ('o \\<Rightarrow> 't) \\<Rightarrow> ('o \\<Rightarrow> 'o) \\<Rightarrow> ('o, 't) instance_model\" where\n  \"imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values = \\<lparr>\n    Tm = tmod_nullable_class_field classtype name fieldtype,\n    Object = nilobjects \\<union> valobjects \\<union> values ` valobjects,\n    ObjectClass = (\\<lambda>x. if x \\<in> nilobjects \\<union> valobjects then classtype else if x \\<in> values ` valobjects then fieldtype else undefined),\n    ObjectId = (\\<lambda>x. if x \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects then obids x else undefined),\n    FieldValue = (\\<lambda>x. if fst x \\<in> nilobjects \\<and> snd x = (classtype, name) then nil else \n      if fst x \\<in> valobjects \\<and> snd x = (classtype, name) then obj (values (fst x)) else\n      if fst x \\<in> values ` valobjects \\<and> snd x = (classtype, name) then unspecified else undefined),\n    DefaultValue = (\\<lambda>x. undefined)\n  \\<rparr>\"\n\nlemma imod_nullable_class_field_correct:\n  assumes valid_ns: \"\\<not>id_in_ns fieldtype (Identifier classtype) \\<and> \\<not>id_in_ns classtype (Identifier fieldtype)\"\n  assumes unique_ids: \"\\<And>o1 o2. o1 \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects \\<Longrightarrow> \n    o2 \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects \\<Longrightarrow> obids o1 = obids o2 \\<Longrightarrow> o1 = o2\"\n  assumes unique_value: \"valobjects \\<inter> nilobjects = {}\"\n  assumes all_objects: \"classtype = fieldtype \\<Longrightarrow> values ` valobjects \\<subseteq> nilobjects \\<union> valobjects\"\n  assumes no_objects: \"classtype \\<noteq> fieldtype \\<Longrightarrow> values ` valobjects \\<inter> (nilobjects \\<union> valobjects) = {}\"\n  shows \"instance_model (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\nproof (intro instance_model.intro)\n  fix ob\n  assume \"ob \\<in> Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n  then have \"ob \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects\"\n    unfolding imod_nullable_class_field_def\n    by simp\n  then have \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = classtype \\<or>\n    ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = fieldtype\"\n    unfolding imod_nullable_class_field_def\n    by fastforce\n  then show \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob \\<in> \n    Class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n    unfolding imod_nullable_class_field_def tmod_nullable_class_field_def\n    by simp\nnext\n  show \"type_model (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n    unfolding imod_nullable_class_field_def\n    using tmod_nullable_class_field_correct valid_ns\n    by simp\nnext\n  fix ob f\n  assume \"ob \\<notin> Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) \\<or> \n    f \\<notin> type_model.Field (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n  then have \"ob \\<notin> nilobjects \\<union> valobjects \\<union> values ` valobjects \\<or> f \\<noteq> (classtype, name)\"\n    unfolding imod_nullable_class_field_def tmod_nullable_class_field_def\n    by simp\n  then show \"FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f) = undefined\"\n    unfolding imod_nullable_class_field_def\n    by auto\nnext\n  fix ob f\n  assume \"ob \\<in> Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n  then have ob_def: \"ob \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects\"\n    unfolding imod_nullable_class_field_def\n    by simp\n  assume \"f \\<in> type_model.Field (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n  then have f_def: \"f = (classtype, name)\"\n    unfolding imod_nullable_class_field_def tmod_nullable_class_field_def\n    by simp\n  assume no_inh: \"\\<not>\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \n    \\<sqsubseteq>[Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)] \n    \\<exclamdown>(class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f)\"\n  show \"FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f) = unspecified\"\n    using ob_def\n  proof (elim UnE)\n    assume \"ob \\<in> nilobjects\"\n    then have ob_class_def: \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = classtype\"\n      unfolding imod_nullable_class_field_def\n      by simp\n    then have \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \\<in> \n      ProperClassType (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n      by (simp add: ProperClassType.rule_proper_classes imod_nullable_class_field_def tmod_nullable_class_field_def)\n    then have ob_type_def: \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \\<in> \n      Type (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n      unfolding Type_def NonContainerType_def ClassType_def\n      by blast\n    have \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = \n      class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f\"\n      unfolding class_def\n      by (simp add: f_def ob_class_def)\n    then have \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \n      \\<sqsubseteq>[Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)] \n      \\<exclamdown>(class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f)\"\n      unfolding subtype_def\n      using ob_type_def subtype_rel.reflexivity\n      by simp\n    then show ?thesis\n      using no_inh\n      by blast\n  next\n    assume \"ob \\<in> valobjects\"\n    then have ob_class_def: \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = classtype\"\n      unfolding imod_nullable_class_field_def\n      by simp\n    then have \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \\<in> \n      ProperClassType (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n      by (simp add: ProperClassType.rule_proper_classes imod_nullable_class_field_def tmod_nullable_class_field_def)\n    then have ob_type_def: \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \\<in> \n      Type (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n      unfolding Type_def NonContainerType_def ClassType_def\n      by blast\n    have \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = \n      class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f\"\n      unfolding class_def\n      by (simp add: f_def ob_class_def)\n    then have \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \n      \\<sqsubseteq>[Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)] \n      \\<exclamdown>(class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f)\"\n      unfolding subtype_def\n      using ob_type_def subtype_rel.reflexivity\n      by simp\n    then show ?thesis\n      using no_inh\n      by blast\n  next\n    assume \"ob \\<in> values ` valobjects\"\n    then show ?thesis\n    proof (induct \"classtype = fieldtype\")\n      case True\n      then have ob_class_def: \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = classtype\"\n        unfolding imod_nullable_class_field_def\n        by simp\n      then have \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \\<in> \n        ProperClassType (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n        by (simp add: ProperClassType.rule_proper_classes imod_nullable_class_field_def tmod_nullable_class_field_def)\n      then have ob_type_def: \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \\<in> \n        Type (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n        unfolding Type_def NonContainerType_def ClassType_def\n        by blast\n      have \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = \n        class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f\"\n        unfolding class_def\n        by (simp add: f_def ob_class_def)\n      then have \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \n        \\<sqsubseteq>[Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)] \n        \\<exclamdown>(class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f)\"\n        unfolding subtype_def\n        using ob_type_def subtype_rel.reflexivity\n        by simp\n      then show ?case\n        using no_inh\n        by blast\n    next\n      case False\n      then show ?case\n        unfolding imod_nullable_class_field_def\n        using no_objects f_def\n        by auto\n    qed\n  qed\nnext\n  have type_model_correct: \"type_model (tmod_nullable_class_field classtype name fieldtype)\"\n    using tmod_nullable_class_field_correct valid_ns\n    by metis\n  fix ob f\n  assume \"ob \\<in> Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n  then have ob_cases: \"ob \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects\"\n    unfolding imod_nullable_class_field_def\n    by simp\n  assume \"f \\<in> type_model.Field (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n  then have f_def: \"f = (classtype, name)\"\n    unfolding imod_nullable_class_field_def tmod_nullable_class_field_def\n    by simp\n  then have f_type: \"Type_Model.type (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f = \\<questiondown>fieldtype\"\n    unfolding Type_Model.type_def imod_nullable_class_field_def tmod_nullable_class_field_def\n    by simp\n  have f_lower: \"lower (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f = \\<^bold>0\"\n    unfolding lower_def imod_nullable_class_field_def tmod_nullable_class_field_def\n    using f_def\n    by simp\n  have f_upper: \"upper (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f = \\<^bold>1\"\n    unfolding upper_def imod_nullable_class_field_def tmod_nullable_class_field_def\n    using f_def\n    by simp\n  assume \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob)\n    \\<sqsubseteq>[Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)]\n    \\<exclamdown>(class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f)\"\n  then have \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob)\n    \\<sqsubseteq>[tmod_nullable_class_field classtype name fieldtype] \\<exclamdown>(fst f)\"\n    unfolding imod_nullable_class_field_def class_def\n    by simp\n  then have \"(\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob), \\<exclamdown>(fst f)) \\<in> \n    subtype_rel_altdef (tmod_nullable_class_field classtype name fieldtype)\"\n    using subtype_def subtype_rel_alt type_model.structure_inh_wellformed_classes type_model_correct\n    by blast\n  then have ob_def: \"ob \\<in> nilobjects \\<union> valobjects\"\n    unfolding subtype_rel_altdef_def\n  proof (elim UnE)\n    assume \"(\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob), \\<exclamdown>(fst f)) \\<in> \n      subtype_tuple ` Type (tmod_nullable_class_field classtype name fieldtype)\"\n    then have eq: \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = fst f\"\n      by (simp add: image_iff subtype_tuple_def)\n    show ?thesis\n      using ob_cases\n    proof (elim UnE)\n      assume \"ob \\<in> nilobjects\"\n      then show ?thesis\n        by simp\n    next\n      assume \"ob \\<in> valobjects\"\n      then show ?thesis\n        by simp\n    next\n      assume \"ob \\<in> values ` valobjects\"\n      then show ?thesis\n      proof (induct \"classtype = fieldtype\")\n        case True\n        then show ?case\n          using all_objects\n          by fastforce\n      next\n        case False\n        then have \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = fieldtype\"\n          unfolding imod_nullable_class_field_def\n          using no_objects\n          by fastforce\n        then show ?case\n          using False.hyps eq f_def\n          by simp\n      qed\n    qed\n  next\n    assume \"(\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob), \\<exclamdown>(fst f)) \\<in> \n      subtype_conv nullable nullable ` (Inh (tmod_nullable_class_field classtype name fieldtype))\\<^sup>+\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob), \\<exclamdown>(fst f)) \\<in> \n      subtype_conv proper proper ` (Inh (tmod_nullable_class_field classtype name fieldtype))\\<^sup>+\"\n    then show ?thesis\n      unfolding tmod_nullable_class_field_def\n      by auto\n  next\n    assume \"(\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob), \\<exclamdown>(fst f)) \\<in> \n      subtype_conv proper nullable ` subtype_tuple ` Class (tmod_nullable_class_field classtype name fieldtype)\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob), \\<exclamdown>(fst f)) \\<in>\n      subtype_conv proper nullable ` (Inh (tmod_nullable_class_field classtype name fieldtype))\\<^sup>+\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  qed\n  then have value_def: \"FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f) = obj (values ob) \\<or>\n    FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f) = nil\"\n    unfolding imod_nullable_class_field_def\n    using f_def\n    by fastforce\n  have value_valid: \"FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f) \n    :[imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values] \\<questiondown>fieldtype\"\n    using ob_def\n  proof (elim UnE)\n    assume value_def: \"ob \\<in> nilobjects\"\n    have \"nil :[imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values] \\<questiondown>fieldtype\"\n      unfolding Valid_def\n    proof (intro Valid_rel.valid_rule_nullable_classes)\n      show \"\\<questiondown>fieldtype \\<in> NullableClassType (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n        unfolding imod_nullable_class_field_def tmod_nullable_class_field_def \n        by (simp add: NullableClassType.rule_nullable_classes)\n    qed\n    then show ?thesis\n      unfolding imod_nullable_class_field_def\n      using value_def unique_value f_def\n      by fastforce\n  next\n    assume value_def: \"ob \\<in> valobjects\"\n    have \"obj (values ob) :[imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values] \\<questiondown>fieldtype\"\n      unfolding Valid_def\n    proof (intro Valid_rel.valid_rule_proper_classes)\n      show \"values ob \\<in> Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n        unfolding imod_nullable_class_field_def\n        by (simp add: value_def)\n    next\n      show \"\\<questiondown>fieldtype \\<in> ClassType (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n        unfolding ClassType_def imod_nullable_class_field_def tmod_nullable_class_field_def \n        by (simp add: NullableClassType.rule_nullable_classes)\n    next\n      have subtype_def: \"\\<exclamdown>fieldtype \\<sqsubseteq>[Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)] \\<questiondown>fieldtype\"\n        unfolding subtype_def\n      proof (intro subtype_rel.nullable_proper_classes)\n        show \"fieldtype \\<in> Class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n          unfolding imod_nullable_class_field_def tmod_nullable_class_field_def\n          by simp\n      qed\n      have \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (values ob) = fieldtype\"\n        unfolding imod_nullable_class_field_def\n        using no_objects value_def\n        by auto\n      then show \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (values ob)) \n        \\<sqsubseteq>[Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)]\n        \\<questiondown>fieldtype\"\n        by (simp add: local.subtype_def)\n    qed\n    then show ?thesis\n      unfolding imod_nullable_class_field_def\n      using value_def unique_value f_def\n      by fastforce\n  qed\n  then show \"FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f) \n    :[imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values] \n    Type_Model.type (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f\"\n    using value_def f_type\n    by simp\n  have values_are_class_values: \"FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f) \\<in> \n    ClassValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n    using value_valid\n    unfolding Valid_def\n  proof (cases)\n    case (valid_rule_proper_classes v)\n    then show ?thesis\n      unfolding ClassValue_def\n      by (simp add: ProperClassValue.rule_proper_objects)\n  next\n    case valid_rule_nullable_classes\n    then show ?thesis\n      unfolding ClassValue_def\n      by blast\n  next\n    case valid_rule_userdata_values\n    then show ?thesis\n      using valid_type_nullable_classes_values_unique value_valid\n      by blast\n  next\n    case valid_rule_bags\n    then show ?thesis\n      using valid_type_nullable_classes_values_unique value_valid\n      by blast\n  next\n    case valid_rule_sets\n    then show ?thesis\n      using valid_type_nullable_classes_values_unique value_valid\n      by blast\n  next\n    case valid_rule_seqs\n    then show ?thesis\n      using valid_type_nullable_classes_values_unique value_valid\n      by blast\n  next\n    case valid_rule_ords\n    then show ?thesis \n      using valid_type_nullable_classes_values_unique value_valid\n      by blast\n  qed\n  then show \"FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f) \\<in>\n    Value (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n    unfolding Value_def AtomValue_def\n    by (simp add: value_def)\n  have \"validMul (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ((ob, f), \n    FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f))\"\n    unfolding validMul_def\n  proof (intro conjI)\n    show \"snd ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f)) \\<in> \n      ContainerValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) \\<longrightarrow>\n      lower (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) (snd (fst ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f)))) \\<le> \n      \\<^bold>(length (contained_list (snd ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f))))) \\<and>\n      \\<^bold>(length (contained_list (snd ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f))))) \\<le> \n      upper (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) (snd (fst ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f))))\"\n    proof\n      assume \"snd ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f)) \\<in> \n        ContainerValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n      then have \"FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f) \\<in> \n        ContainerValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n        by simp\n      then show \"lower (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) (snd (fst ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f)))) \\<le> \n        \\<^bold>(length (contained_list (snd ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f))))) \\<and>\n        \\<^bold>(length (contained_list (snd ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f))))) \\<le> \n        upper (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) (snd (fst ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f))))\"\n        using values_are_class_values container_values_class_values_intersect\n        by blast\n    qed\n  qed (simp_all add: value_valid f_type)\n  then show \"validMul (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ((ob, f), FieldValue (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ob, f))\"\n    by (simp add: value_def)\nqed (simp_all add: assms imod_nullable_class_field_def tmod_nullable_class_field_def)\n\nlemma imod_nullable_class_field_combine_correct:\n  assumes \"instance_model Imod\"\n  assumes existing_classes: \"{classtype, fieldtype} \\<subseteq> Class (Tm Imod)\"\n  assumes new_field: \"(classtype, name) \\<notin> Field (Tm Imod)\"\n  assumes valid_ns: \"\\<not>id_in_ns fieldtype (Identifier classtype) \\<and> \\<not>id_in_ns classtype (Identifier fieldtype)\"\n  assumes no_inh_classtype: \"\\<And>x. (x, classtype) \\<notin> Inh (Tm Imod)\"\n  assumes no_objects: \"classtype \\<noteq> fieldtype \\<Longrightarrow> values ` valobjects \\<inter> (nilobjects \\<union> valobjects) = {}\"\n  assumes existing_objects: \"(nilobjects \\<union> valobjects \\<union> values ` valobjects) \\<inter> Object Imod = valobjects \\<union> nilobjects \\<union> values ` valobjects\"\n  assumes all_objects: \"\\<And>ob. ob \\<in> Object Imod \\<Longrightarrow> ObjectClass Imod ob = classtype \\<longleftrightarrow> ob \\<in> nilobjects \\<union> valobjects\"\n  assumes classes_valid: \"\\<And>ob. ob \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects \\<Longrightarrow> \n    ObjectClass Imod ob = ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob\"\n  assumes ids_valid: \"\\<And>ob. ob \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects \\<Longrightarrow> ObjectId Imod ob = obids ob\"\n  assumes unique_value: \"valobjects \\<inter> nilobjects = {}\"\n  shows \"instance_model (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\nproof (intro imod_combine_merge_no_containment_imod2_correct)\n  show \"instance_model (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n  proof (intro imod_nullable_class_field_correct)\n    fix o1 o2\n    assume o1_object: \"o1 \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects\"\n    then have o1_def: \"o1 \\<in> Object Imod\"\n      using existing_objects\n      by blast\n    assume o2_object: \"o2 \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects\"\n    then have o2_def: \"o2 \\<in> Object Imod\"\n      using existing_objects\n      by blast\n    assume \"obids o1 = obids o2\"\n    then have \"ObjectId Imod o1 = ObjectId Imod o2\"\n      using ids_valid o1_object o2_object\n      by simp\n    then show \"o1 = o2\"\n      using assms(1) instance_model.property_object_id_uniqueness o1_def o2_def\n      by fastforce\n  next\n    assume classtype_fieldtype_eq: \"classtype = fieldtype\"\n    show \"values ` valobjects \\<subseteq> nilobjects \\<union> valobjects\"\n    proof\n      fix x\n      assume x_def: \"x \\<in> values ` valobjects\"\n      then have \"ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) x = classtype\"\n        unfolding imod_nullable_class_field_def\n        using classtype_fieldtype_eq\n        by simp\n      then have ob_class_def: \"ObjectClass Imod x = classtype\"\n        using classes_valid x_def\n        by simp\n      have \"x \\<in> Object Imod\"\n        using existing_objects x_def\n        by blast\n      then show \"x \\<in> nilobjects \\<union> valobjects\"\n        using all_objects ob_class_def\n        by simp\n    qed\n  qed (simp_all add: assms)\nnext\n  fix ob\n  assume \"ob \\<in> Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n  then have ob_in_objects: \"ob \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects\"\n    unfolding imod_nullable_class_field_def\n    by simp\n  then have \"ObjectId (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob = obids ob\"\n    unfolding imod_nullable_class_field_def\n    by simp\n  then show \"ObjectId Imod ob = ObjectId (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob\"\n    using ids_valid ob_in_objects\n    by simp\nnext\n  fix o1 o2\n  assume \"o1 \\<in> Object Imod - Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n  assume \"o2 \\<in> Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) - Object Imod\"\n  then have \"o2 \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects - Object Imod\"\n    unfolding imod_nullable_class_field_def\n    by simp\n  then have \"o2 \\<in> {}\"\n    using existing_objects\n    by blast\n  then show \"o1 = o2\"\n    by blast\nnext\n  have type_model_valid: \"type_model (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    using assms(1) instance_model.validity_type_model_consistent existing_classes new_field valid_ns\n    by (intro tmod_nullable_class_field_combine_correct) (simp_all)\n  fix ob f\n  assume ob_def: \"ob \\<in> Object Imod\"\n  then have ob_class_def: \"ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob = ObjectClass Imod ob\"\n    by (simp add: classes_valid imod_combine_def imod_combine_object_class_def imod_nullable_class_field_def)\n  assume \"f \\<in> Field (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n  then have f_def: \"f = (classtype, name)\"\n    unfolding imod_nullable_class_field_def tmod_nullable_class_field_def\n    by simp\n  assume \"\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob)\n    \\<sqsubseteq>[Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))]\n    \\<exclamdown>(class (Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))) f)\"\n  then have \"\\<exclamdown>(ObjectClass Imod ob) \\<sqsubseteq>[Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))] \\<exclamdown>classtype\"\n    unfolding class_def\n    using ob_class_def f_def\n    by simp\n  then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>classtype) \\<in> subtype_rel_altdef (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    unfolding subtype_def imod_nullable_class_field_def imod_combine_def\n    by (simp add: subtype_rel_alt type_model.structure_inh_wellformed_classes type_model_valid)\n  then have ob_class_is_classtype: \"\\<exclamdown>(ObjectClass Imod ob) = \\<exclamdown>classtype\"\n    unfolding subtype_rel_altdef_def\n  proof (elim UnE)\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>classtype) \\<in> subtype_tuple ` Type (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    then show ?thesis\n      unfolding subtype_tuple_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>classtype) \\<in> subtype_conv nullable nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>classtype) \\<in> subtype_conv proper proper ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then have ob_extends_classtype: \"(ObjectClass Imod ob, classtype) \\<in> (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n      unfolding subtype_conv_def\n      by fastforce\n    have \"(ObjectClass Imod ob, classtype) \\<notin> (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    proof\n      assume \"(ObjectClass Imod ob, classtype) \\<in> (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n      then show \"False\"\n      proof (cases)\n        case base\n        then show ?thesis\n          unfolding tmod_nullable_class_field_def tmod_combine_def\n          using no_inh_classtype\n          by simp\n      next\n        case (step c)\n        then show ?thesis\n          unfolding tmod_nullable_class_field_def tmod_combine_def\n          using no_inh_classtype\n          by simp\n      qed\n    qed\n    then show ?thesis\n      using ob_extends_classtype\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>classtype) \\<in> subtype_conv proper nullable ` subtype_tuple ` Class (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>classtype) \\<in> subtype_conv proper nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  qed\n  then have ob_in_objects: \"ob \\<in> nilobjects \\<union> valobjects\"\n    using all_objects ob_def\n    by blast\n  have \"\\<exclamdown>classtype \\<in> ProperClassType (tmod_nullable_class_field classtype name fieldtype)\"\n    unfolding tmod_nullable_class_field_def\n    by (simp add: ProperClassType.rule_proper_classes)\n  then have \"\\<exclamdown>classtype \\<in> Type (tmod_nullable_class_field classtype name fieldtype)\"\n    unfolding Type_def NonContainerType_def ClassType_def\n    by blast\n  then show \"ob \\<in> Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) \\<and>\n    \\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) \n    \\<sqsubseteq>[Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)]\n    \\<exclamdown>(class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f)\"\n    unfolding imod_nullable_class_field_def class_def subtype_def\n    using ob_in_objects f_def\n    by (simp add: subtype_rel.reflexivity)\nnext\n  have type_model_valid: \"type_model (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    using assms(1) instance_model.validity_type_model_consistent existing_classes new_field valid_ns\n    by (intro tmod_nullable_class_field_combine_correct) (simp_all)\n  fix ob f\n  assume \"ob \\<in> Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n  then have ob_def: \"ob \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects\"\n    unfolding imod_nullable_class_field_def\n    by simp\n  then have ob_in_imod: \"ob \\<in> Object Imod\"\n    using existing_objects\n    by blast\n  then have ob_class_def: \"ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob = ObjectClass Imod ob\"\n    using ob_def classes_valid\n    unfolding imod_combine_def imod_nullable_class_field_def imod_combine_object_class_def\n    by simp\n  have \"ObjectClass Imod ob \\<in> Class (Tm Imod)\"\n    by (simp add: assms(1) instance_model.structure_object_class_wellformed ob_in_imod)\n  then have \"\\<exclamdown>(ObjectClass Imod ob) \\<in> ProperClassType (Tm Imod)\"\n    by (simp add: ProperClassType.rule_proper_classes)\n  then have object_class_is_type: \"\\<exclamdown>(ObjectClass Imod ob) \\<in> Type (Tm Imod)\"\n    unfolding Type_def NonContainerType_def ClassType_def\n    by blast\n  assume f_def: \"f \\<in> Field (Tm Imod)\"\n  assume \"\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob)\n    \\<sqsubseteq>[Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))]\n    \\<exclamdown>(class (Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))) f)\"\n  then have \"\\<exclamdown>(ObjectClass Imod ob) \\<sqsubseteq>[Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))] \\<exclamdown>(fst f)\"\n    unfolding class_def\n    using ob_class_def\n    by simp\n  then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_rel_altdef (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    unfolding subtype_def imod_nullable_class_field_def imod_combine_def\n    by (simp add: subtype_rel_alt type_model.structure_inh_wellformed_classes type_model_valid)\n  then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_tuple ` Type (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)) \\<union> \n    subtype_conv nullable nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+ \\<union>\n    subtype_conv proper proper ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+ \\<union>\n    subtype_conv proper nullable ` subtype_tuple ` Class (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)) \\<union>\n    subtype_conv proper nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    unfolding subtype_rel_altdef_def\n    by simp\n  then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_rel_altdef (Tm Imod)\"\n  proof (elim UnE)\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_tuple ` Type (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    then have \"ObjectClass Imod ob = fst f\"\n      unfolding subtype_tuple_def\n      by fastforce\n    then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_tuple ` Type (Tm Imod)\"\n      unfolding subtype_tuple_def\n      using object_class_is_type\n      by fastforce\n    then show ?thesis\n      unfolding subtype_rel_altdef_def\n      by simp\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_conv nullable nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_conv proper proper ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_conv proper proper ` (Inh (Tm Imod))\\<^sup>+\"\n      unfolding subtype_conv_def tmod_combine_def tmod_nullable_class_field_def\n      by simp\n    then show ?thesis\n      unfolding subtype_rel_altdef_def\n      by simp\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_conv proper nullable ` subtype_tuple ` Class (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_conv proper nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  qed\n  then have \"\\<exclamdown>(ObjectClass Imod ob) \\<sqsubseteq>[Tm (Imod)] \\<exclamdown>(fst f)\"\n    unfolding subtype_def\n    by (simp add: assms(1) instance_model.validity_type_model_consistent subtype_rel_alt type_model.structure_inh_wellformed_classes)\n  then show \"ob \\<in> Object Imod \\<and> \\<exclamdown>(ObjectClass Imod ob) \\<sqsubseteq>[Tm Imod] \\<exclamdown>(class (Tm Imod) f)\"\n    unfolding class_def\n    using ob_in_imod\n    by blast\nnext\n  have type_model_valid: \"type_model (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    using assms(1) instance_model.validity_type_model_consistent existing_classes new_field valid_ns\n    by (intro tmod_nullable_class_field_combine_correct) (simp_all)\n  fix ob f\n  assume ob_def: \"ob \\<in> Object Imod\"\n  then have ob_class_def: \"ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob = ObjectClass Imod ob\"\n    using classes_valid\n    unfolding imod_combine_def imod_nullable_class_field_def imod_combine_object_class_def\n    by simp\n  then have \"ObjectClass Imod ob \\<in> Class (Tm Imod)\"\n    by (simp add: assms(1) instance_model.structure_object_class_wellformed ob_def)\n  then have \"\\<exclamdown>(ObjectClass Imod ob) \\<in> ProperClassType (Tm Imod)\"\n    by (fact ProperClassType.rule_proper_classes)\n  then have ob_class_is_type: \"\\<exclamdown>(ObjectClass Imod ob) \\<in> Type (Tm Imod)\"\n    unfolding Type_def NonContainerType_def ClassType_def\n    by blast\n  assume f_def: \"f \\<in> Field (Tm Imod)\"\n  assume \"\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob)\n    \\<sqsubseteq>[Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))]\n    \\<exclamdown>(class (Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))) f)\"\n  then have \"\\<exclamdown>(ObjectClass Imod ob) \\<sqsubseteq>[Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))] \\<exclamdown>(fst f)\"\n    unfolding class_def\n    using ob_class_def\n    by simp\n  then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_rel_altdef (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    unfolding subtype_def imod_nullable_class_field_def imod_combine_def\n    by (simp add: subtype_rel_alt type_model.structure_inh_wellformed_classes type_model_valid)\n  then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_tuple ` Type (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)) \\<union> \n    subtype_conv nullable nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+ \\<union>\n    subtype_conv proper proper ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+ \\<union>\n    subtype_conv proper nullable ` subtype_tuple ` Class (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)) \\<union>\n    subtype_conv proper nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    unfolding subtype_rel_altdef_def\n    by simp\n  then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_rel_altdef (Tm Imod)\"\n  proof (elim UnE)\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_tuple ` Type (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    then have \"ObjectClass Imod ob = fst f\"\n      unfolding subtype_tuple_def\n      by fastforce\n    then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_tuple ` Type (Tm Imod)\"\n      unfolding subtype_tuple_def\n      using ob_class_is_type\n      by simp\n    then show ?thesis\n      unfolding subtype_rel_altdef_def\n      by simp\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_conv nullable nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_conv proper proper ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then have \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_conv proper proper ` (Inh (Tm Imod))\\<^sup>+\"\n      unfolding subtype_conv_def tmod_combine_def tmod_nullable_class_field_def\n      by simp\n    then show ?thesis\n      unfolding subtype_rel_altdef_def\n      by simp\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_conv proper nullable ` subtype_tuple ` Class (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass Imod ob), \\<exclamdown>(fst f)) \\<in> subtype_conv proper nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  qed\n  then show \"\\<exclamdown>(ObjectClass Imod ob) \\<sqsubseteq>[Tm (Imod)] \\<exclamdown>(class (Tm Imod) f)\"\n    unfolding subtype_def class_def\n    by (simp add: assms(1) instance_model.validity_type_model_consistent subtype_rel_alt type_model.structure_inh_wellformed_classes)\nnext\n  have type_model_valid: \"type_model (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    using assms(1) instance_model.validity_type_model_consistent existing_classes new_field valid_ns\n    by (intro tmod_nullable_class_field_combine_correct) (simp_all)\n  fix ob f\n  assume \"ob \\<in> Object (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\n  then have ob_def: \"ob \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects\"\n    unfolding imod_nullable_class_field_def\n    by simp\n  assume \"f \\<in> Field (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n  then have f_def: \"f = (classtype, name)\"\n    unfolding imod_nullable_class_field_def tmod_nullable_class_field_def\n    by simp\n  have \"\\<exclamdown>classtype \\<in> ProperClassType (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n    unfolding imod_nullable_class_field_def tmod_nullable_class_field_def\n    by (simp add: ProperClassType.rule_proper_classes)\n  then have \"\\<exclamdown>classtype \\<in> Type (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))\"\n    unfolding Type_def NonContainerType_def ClassType_def\n    by blast\n  then have classtype_extend: \"\\<exclamdown>classtype \\<sqsubseteq>[Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)] \\<exclamdown>classtype\"\n    unfolding subtype_def\n    by (simp add: subtype_rel.reflexivity)\n  assume \"\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob)\n    \\<sqsubseteq>[Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))]\n    \\<exclamdown>(class (Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))) f)\"\n  then have \"\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob)\n    \\<sqsubseteq>[Tm (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values))] \\<exclamdown>classtype\"\n    unfolding class_def\n    using f_def\n    by simp\n  then have \"(\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob), \\<exclamdown>classtype) \\<in> \n    subtype_rel_altdef (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    unfolding subtype_def imod_nullable_class_field_def imod_combine_def\n    by (simp add: subtype_rel_alt type_model.structure_inh_wellformed_classes type_model_valid)\n  then have \"\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob) = \\<exclamdown>classtype\"\n    unfolding subtype_rel_altdef_def\n  proof (elim UnE)\n    assume \"(\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob), \\<exclamdown>classtype) \\<in> \n      subtype_tuple ` Type (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    then show ?thesis\n      unfolding subtype_tuple_def\n      by fastforce\n  next\n    assume \"(\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob), \\<exclamdown>classtype) \\<in> \n      subtype_conv nullable nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob), \\<exclamdown>classtype) \\<in> \n      subtype_conv proper proper ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then have ob_extends_classtype: \"(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob, classtype) \\<in> \n      (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n      unfolding subtype_conv_def\n      by fastforce\n    have \"(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob, classtype) \\<notin> \n      (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    proof\n      assume \"(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob, classtype) \\<in> \n        (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n      then show \"False\"\n      proof (cases)\n        case base\n        then show ?thesis\n          unfolding tmod_nullable_class_field_def tmod_combine_def\n          using no_inh_classtype\n          by simp\n      next\n        case (step c)\n        then show ?thesis\n          unfolding tmod_nullable_class_field_def tmod_combine_def\n          using no_inh_classtype\n          by simp\n      qed\n    qed\n    then show ?thesis\n      using ob_extends_classtype\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob), \\<exclamdown>classtype) \\<in> \n      subtype_conv proper nullable ` subtype_tuple ` Class (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  next\n    assume \"(\\<exclamdown>(ObjectClass (imod_combine Imod (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) ob), \\<exclamdown>classtype) \\<in> \n      subtype_conv proper nullable ` (Inh (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype)))\\<^sup>+\"\n    then show ?thesis\n      unfolding subtype_conv_def\n      by blast\n  qed\n  then have \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob) = \\<exclamdown>classtype\"\n    using existing_objects classes_valid ob_def\n    unfolding imod_nullable_class_field_def imod_combine_def imod_combine_object_class_def\n    by fastforce\n  then show \"\\<exclamdown>(ObjectClass (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) ob)\n    \\<sqsubseteq>[Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)]\n    \\<exclamdown>(class (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)) f)\"\n    unfolding class_def\n    using f_def classtype_extend\n    by simp\nnext\n  have \"type_model (tmod_combine (Tm Imod) (tmod_nullable_class_field classtype name fieldtype))\"\n    using assms(1) instance_model.validity_type_model_consistent existing_classes new_field valid_ns\n    by (intro tmod_nullable_class_field_combine_correct) (simp_all)\n  then show \"type_model (tmod_combine (Tm Imod) (Tm (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)))\"\n    unfolding imod_nullable_class_field_def\n    by simp\nqed (simp_all add: assms imod_nullable_class_field_def tmod_nullable_class_field_def)\n\n\n\nsection \"Encoding of a class-typed field as edge type in GROOVE\"\n\ndefinition ig_nullable_class_field_as_edge_type :: \"'t Id \\<Rightarrow> 't \\<Rightarrow> 't Id \\<Rightarrow> 'o set \\<Rightarrow> 'o set \\<Rightarrow> ('o \\<Rightarrow> 't) \\<Rightarrow> ('o \\<Rightarrow> 'o) \\<Rightarrow> ('o, 't list, 't) instance_graph\" where\n  \"ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values = \\<lparr>\n    TG = tg_nullable_class_field_as_edge_type classtype name fieldtype,\n    Id = obids ` nilobjects \\<union> obids ` valobjects \\<union> obids ` values ` valobjects,\n    N = typed (type (id_to_list classtype)) ` nilobjects \\<union> typed (type (id_to_list classtype)) ` valobjects \\<union> typed (type (id_to_list fieldtype)) ` values ` valobjects,\n    E = (\\<lambda>x. (typed (type (id_to_list classtype)) x, (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), typed (type (id_to_list fieldtype)) (values x))) ` valobjects,\n    ident = (\\<lambda>x. if x \\<in> obids ` nilobjects \\<union> obids ` valobjects then typed (type (id_to_list classtype)) (THE y. obids y = x) else \n      if x \\<in> obids ` values ` valobjects then typed (type (id_to_list fieldtype)) (THE y. obids y = x) else undefined)\n  \\<rparr>\"\n\nlemma ig_nullable_class_field_as_edge_type_correct:\n  assumes unique_ids: \"\\<And>o1 o2. o1 \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects \\<Longrightarrow> obids o1 = obids o2 \\<Longrightarrow> o1 = o2\"\n  assumes unique_value: \"valobjects \\<inter> nilobjects = {}\"\n  assumes all_objects: \"classtype = fieldtype \\<Longrightarrow> values ` valobjects \\<subseteq> nilobjects \\<union> valobjects\"\n  assumes no_objects: \"classtype \\<noteq> fieldtype \\<Longrightarrow> values ` valobjects \\<inter> (nilobjects \\<union> valobjects) = {}\"\n  shows \"instance_graph (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\nproof (intro instance_graph.intro)\n  fix n\n  assume \"n \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  then have \"n \\<in> typed (type (id_to_list classtype)) ` nilobjects \\<union> typed (type (id_to_list classtype)) ` valobjects \\<union> typed (type (id_to_list fieldtype)) ` values ` valobjects\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  then have type_and_node_def: \"type\\<^sub>n n \\<in> NT (tg_nullable_class_field_as_edge_type classtype name fieldtype) \\<and> n \\<in> Node\"\n  proof (elim UnE)\n    assume \"n \\<in> typed (LabDef.type (id_to_list classtype)) ` nilobjects\"\n    then show \"type\\<^sub>n n \\<in> NT (tg_nullable_class_field_as_edge_type classtype name fieldtype) \\<and> n \\<in> Node\"\n    proof (intro conjI)\n      assume \"n \\<in> typed (LabDef.type (id_to_list classtype)) ` nilobjects\"\n      then show \"type\\<^sub>n n \\<in> NT (tg_nullable_class_field_as_edge_type classtype name fieldtype)\"\n        unfolding tg_nullable_class_field_as_edge_type_def\n        by fastforce\n    next\n      assume \"n \\<in> typed (LabDef.type (id_to_list classtype)) ` nilobjects\"\n      then show \"n \\<in> Node\"\n        unfolding Node_def\n        using Lab\\<^sub>t.rule_type_labels Node\\<^sub>t.rule_typed_nodes\n        by fastforce\n    qed\n  next\n    assume \"n \\<in> typed (LabDef.type (id_to_list classtype)) ` valobjects\"\n    then show \"type\\<^sub>n n \\<in> NT (tg_nullable_class_field_as_edge_type classtype name fieldtype) \\<and> n \\<in> Node\"\n    proof (intro conjI)\n      assume \"n \\<in> typed (LabDef.type (id_to_list classtype)) ` valobjects\"\n      then show \"type\\<^sub>n n \\<in> NT (tg_nullable_class_field_as_edge_type classtype name fieldtype)\"\n        unfolding tg_nullable_class_field_as_edge_type_def\n        by fastforce\n    next\n      assume \"n \\<in> typed (LabDef.type (id_to_list classtype)) ` valobjects\"\n      then show \"n \\<in> Node\"\n        unfolding Node_def\n        using Lab\\<^sub>t.rule_type_labels Node\\<^sub>t.rule_typed_nodes\n        by fastforce\n    qed\n  next\n    assume \"n \\<in> typed (LabDef.type (id_to_list fieldtype)) ` values ` valobjects\"\n    then show \"type\\<^sub>n n \\<in> NT (tg_nullable_class_field_as_edge_type classtype name fieldtype) \\<and> n \\<in> Node\"\n    proof (intro conjI)\n      assume \"n \\<in> typed (LabDef.type (id_to_list fieldtype)) ` values ` valobjects\"\n      then show \"type\\<^sub>n n \\<in> NT (tg_nullable_class_field_as_edge_type classtype name fieldtype)\"\n        unfolding tg_nullable_class_field_as_edge_type_def\n        by fastforce\n    next\n      assume \"n \\<in> typed (LabDef.type (id_to_list fieldtype)) ` values ` valobjects\"\n      then show \"n \\<in> Node\"\n        unfolding Node_def\n        using Lab\\<^sub>t.rule_type_labels Node\\<^sub>t.rule_typed_nodes\n        by fastforce\n    qed\n  qed\n  then show \"type\\<^sub>n n \\<in> NT (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values))\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  show \"n \\<in> Node\"\n    by (simp add: type_and_node_def)\nnext\n  fix s l t\n  assume \"(s, l, t) \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  then have edge_def: \"(s, l, t) \\<in> (\\<lambda>x. (typed (type (id_to_list classtype)) x, \n    (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), \n    typed (type (id_to_list fieldtype)) (values x))) ` valobjects\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  show \"s \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) \\<and> \n    l \\<in> ET (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)) \\<and> \n    t \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  proof (intro conjI)\n    show \"s \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n      unfolding ig_nullable_class_field_as_edge_type_def\n      using edge_def\n      by fastforce\n  next\n    have \"l = (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype))\"\n      using edge_def\n      by blast\n    then show \"l \\<in> ET (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values))\"\n      unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n      by simp\n  next\n    show \"t \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n      unfolding ig_nullable_class_field_as_edge_type_def\n      using edge_def\n      by fastforce\n  qed\nnext\n  fix i\n  assume \"i \\<in> Id (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  then have i_in_id: \"i \\<in> obids ` nilobjects \\<union> obids ` valobjects \\<union> obids ` values ` valobjects\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  then show \"ident (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) i \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) \\<and> \n    type\\<^sub>n (ident (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) i) \\<in> Lab\\<^sub>t\"\n  proof (elim UnE)\n    assume i_in_id: \"i \\<in> obids ` nilobjects\"\n    then show ?thesis\n    proof (intro conjI)\n      assume \"i \\<in> obids ` nilobjects\"\n      then have \"(THE y. obids y = i) \\<in> nilobjects\"\n      proof\n        fix x\n        assume i_def: \"i = obids x\"\n        assume x_is_object: \"x \\<in> nilobjects\"\n        have \"(THE y. obids y = obids x) \\<in> nilobjects\"\n        proof (rule the1I2)\n          show \"\\<exists>!y. obids y = obids x\"\n            using Un_iff unique_ids x_is_object\n            by metis\n        next\n          fix y\n          assume \"obids y = obids x\"\n          then show \"y \\<in> nilobjects\"\n            using Un_iff unique_ids x_is_object\n            by metis\n        qed\n        then show \"(THE y. obids y = i) \\<in> nilobjects\"\n          by (simp add: i_def)\n      qed\n      then have \"typed (type (id_to_list classtype)) (THE y. obids y = i) \\<in> typed (type (id_to_list classtype)) ` nilobjects\"\n        by simp\n      then show \"ident (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) i \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n        unfolding ig_nullable_class_field_as_edge_type_def\n        using i_in_id\n        by simp\n    next\n      have \"type\\<^sub>n (typed (type (id_to_list classtype)) (THE y. obids y = i)) \\<in> Lab\\<^sub>t\"\n        by (simp add: Lab\\<^sub>t.rule_type_labels)\n      then show \"type\\<^sub>n (ident (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) i) \\<in> Lab\\<^sub>t\"\n        unfolding ig_nullable_class_field_as_edge_type_def\n        using i_in_id\n        by simp\n    qed\n  next\n    assume i_in_id: \"i \\<in> obids ` valobjects\"\n    then show ?thesis\n    proof (intro conjI)\n      assume \"i \\<in> obids ` valobjects\"\n      then have \"(THE y. obids y = i) \\<in> valobjects\"\n      proof\n        fix x\n        assume i_def: \"i = obids x\"\n        assume x_is_object: \"x \\<in> valobjects\"\n        have \"(THE y. obids y = obids x) \\<in> valobjects\"\n        proof (rule the1I2)\n          show \"\\<exists>!y. obids y = obids x\"\n            using Un_iff unique_ids x_is_object\n            by metis\n        next\n          fix y\n          assume \"obids y = obids x\"\n          then show \"y \\<in> valobjects\"\n            using Un_iff unique_ids x_is_object\n            by metis\n        qed\n        then show \"(THE y. obids y = i) \\<in> valobjects\"\n          by (simp add: i_def)\n      qed\n      then have \"typed (type (id_to_list classtype)) (THE y. obids y = i) \\<in> typed (type (id_to_list classtype)) ` valobjects\"\n        by simp\n      then show \"ident (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) i \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n        unfolding ig_nullable_class_field_as_edge_type_def\n        using i_in_id\n        by simp\n    next\n      have \"type\\<^sub>n (typed (type (id_to_list classtype)) (THE y. obids y = i)) \\<in> Lab\\<^sub>t\"\n        by (simp add: Lab\\<^sub>t.rule_type_labels)\n      then show \"type\\<^sub>n (ident (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) i) \\<in> Lab\\<^sub>t\"\n        unfolding ig_nullable_class_field_as_edge_type_def\n        using i_in_id\n        by simp\n    qed\n  next\n    assume i_in_id: \"i \\<in> obids ` values ` valobjects\"\n    then show ?thesis\n    proof (intro conjI)\n      assume \"i \\<in> obids ` values ` valobjects\"\n      then have \"(THE y. obids y = i) \\<in> values ` valobjects\"\n      proof\n        fix x\n        assume i_def: \"i = obids x\"\n        assume x_is_object: \"x \\<in> values ` valobjects\"\n        have \"(THE y. obids y = obids x) \\<in> values ` valobjects\"\n        proof (rule the1I2)\n          show \"\\<exists>!y. obids y = obids x\"\n            using Un_iff unique_ids x_is_object\n            by metis\n        next\n          fix y\n          assume \"obids y = obids x\"\n          then show \"y \\<in> values ` valobjects\"\n            using Un_iff unique_ids x_is_object\n            by metis\n        qed\n        then show \"(THE y. obids y = i) \\<in> values ` valobjects\"\n          by (simp add: i_def)\n      qed\n      then have \"typed (type (id_to_list fieldtype)) (THE y. obids y = i) \\<in> typed (type (id_to_list fieldtype)) ` values ` valobjects\"\n        by simp\n      then show \"ident (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) i \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n      proof (induct \"classtype = fieldtype\")\n        case True\n        then have \"typed (type (id_to_list fieldtype)) (THE y. obids y = i) \\<in> typed (type (id_to_list fieldtype)) ` valobjects \\<union> typed (type (id_to_list fieldtype)) ` nilobjects\"\n          using all_objects\n          by blast\n        then show ?case\n          unfolding ig_nullable_class_field_as_edge_type_def\n          using True.hyps i_in_id\n          by fastforce\n      next\n        case False\n        then have \"i \\<notin> obids ` nilobjects \\<union> obids ` valobjects\"\n          using no_objects unique_ids i_in_id\n          by blast\n        then show ?case\n          unfolding ig_nullable_class_field_as_edge_type_def\n          using False.prems i_in_id\n          by simp\n      qed\n    next\n      have \"type\\<^sub>n (typed (type (id_to_list classtype)) (THE y. obids y = i)) \\<in> Lab\\<^sub>t \\<and> type\\<^sub>n (typed (type (id_to_list fieldtype)) (THE y. obids y = i)) \\<in> Lab\\<^sub>t\"\n        by (simp add: Lab\\<^sub>t.rule_type_labels)\n      then show \"type\\<^sub>n (ident (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) i) \\<in> Lab\\<^sub>t\"\n        unfolding ig_nullable_class_field_as_edge_type_def\n        using i_in_id\n        by simp\n    qed\n  qed\nnext\n  show \"type_graph (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values))\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    using tg_nullable_class_field_as_edge_type_correct\n    by simp\nnext\n  fix e\n  assume \"e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  then have e_def: \"e \\<in> (\\<lambda>x. (typed (type (id_to_list classtype)) x, \n    (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), \n    typed (type (id_to_list fieldtype)) (values x))) ` valobjects\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  have type_n_def: \"type\\<^sub>n (src e) = type (id_to_list classtype)\"\n    using e_def\n    by fastforce\n  have type_e_def: \"src (type\\<^sub>e e) = type (id_to_list classtype)\"\n    using e_def\n    by fastforce\n  have \"(type\\<^sub>n (src e), src (type\\<^sub>e e)) \\<in> {(type (id_to_list classtype), type (id_to_list classtype)), (type (id_to_list fieldtype), type (id_to_list fieldtype))}\"\n    using type_n_def type_e_def\n    by blast\n  then show \"(type\\<^sub>n (src e), src (type\\<^sub>e e)) \\<in> inh (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values))\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    by simp\nnext\n  fix e\n  assume \"e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  then have e_def: \"e \\<in> (\\<lambda>x. (typed (type (id_to_list classtype)) x, \n    (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), \n    typed (type (id_to_list fieldtype)) (values x))) ` valobjects\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  have type_n_def: \"type\\<^sub>n (tgt e) = type (id_to_list fieldtype)\"\n    using e_def\n    by fastforce\n  have type_e_def: \"tgt (type\\<^sub>e e) = type (id_to_list fieldtype)\"\n    using e_def\n    by fastforce\n  have \"(type\\<^sub>n (tgt e), tgt (type\\<^sub>e e)) \\<in> {(type (id_to_list classtype), type (id_to_list classtype)), (type (id_to_list fieldtype), type (id_to_list fieldtype))}\"\n    using type_n_def type_e_def\n    by blast\n  then show \"(type\\<^sub>n (tgt e), tgt (type\\<^sub>e e)) \\<in> inh (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values))\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    by simp\nnext\n  fix et n\n  assume \"et \\<in> ET (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values))\"\n  then have et_def: \"et = (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype))\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    by simp\n  then have src_et_def: \"src et = type (id_to_list classtype)\"\n    by simp\n  have mult_et_def: \"m_out (mult (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)) et) = \\<^bold>0..\\<^bold>1\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    by (simp add: et_def)\n  assume \"n \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  then have n_def: \"n \\<in> typed (type (id_to_list classtype)) ` nilobjects \\<union> typed (type (id_to_list classtype)) ` valobjects \\<union> typed (type (id_to_list fieldtype)) ` values ` valobjects\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  assume \"(type\\<^sub>n n, src et) \\<in> inh (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values))\"\n  then have \"(type\\<^sub>n n, src et) \\<in> {(type (id_to_list classtype), type (id_to_list classtype)), (type (id_to_list fieldtype), type (id_to_list fieldtype))}\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    by simp\n  then have type_n_def: \"type\\<^sub>n n = type (id_to_list classtype)\"\n    using src_et_def\n    by fastforce\n  then have \"n \\<in> typed (type (id_to_list classtype)) ` nilobjects \\<union> typed (type (id_to_list classtype)) ` valobjects\"\n  proof (induct \"classtype = fieldtype\")\n    case True\n    then show ?case\n      using n_def all_objects\n      by fastforce\n  next\n    case False\n    then have \"type (id_to_list classtype) \\<noteq> type (id_to_list fieldtype)\"\n      using LabDef.inject(1) id_to_list_inverse\n      by metis\n    then show ?case\n      using False.prems n_def\n      by fastforce\n  qed\n  then have \"card {e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et} in \\<^bold>0..\\<^bold>1\"\n  proof (elim UnE)\n    assume \"n \\<in> typed (LabDef.type (id_to_list classtype)) ` nilobjects\"\n    then show ?thesis\n    proof (elim imageE)\n      fix x\n      assume x_def: \"x \\<in> nilobjects\"\n      assume n_def: \"n = typed (LabDef.type (id_to_list classtype)) x\"\n      then have n_not_def: \"n \\<notin> typed (LabDef.type (id_to_list classtype)) ` valobjects\"\n        using x_def n_def unique_value\n        by blast\n      have \"{e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et} = {}\"\n      proof\n        show \"{e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et} \\<subseteq> {}\"\n        proof\n          fix y\n          assume \"y \\<in> {e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et}\"\n          then show \"y \\<in> {}\"\n          proof\n            assume \"y \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) \\<and> src y = n \\<and> type\\<^sub>e y = et\"\n            then show \"y \\<in> {}\"\n              unfolding ig_nullable_class_field_as_edge_type_def\n              using et_def n_not_def\n              by fastforce\n          qed\n        qed\n      next\n        show \"{} \\<subseteq> {e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et}\"\n          by simp\n      qed\n      then have \"card {e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et} = 0\"\n        using card_empty\n        by metis\n      then show ?thesis\n        unfolding within_multiplicity_def\n        by simp\n    qed\n  next\n    assume \"n \\<in> typed (LabDef.type (id_to_list classtype)) ` valobjects\"\n    then show ?thesis\n    proof (elim imageE)\n      fix x\n      assume x_def: \"x \\<in> valobjects\"\n      assume n_def: \"n = typed (LabDef.type (id_to_list classtype)) x\"\n      have \"{e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et} = \n        {(typed (type (id_to_list classtype)) x, (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), typed (type (id_to_list fieldtype)) (values x))}\"\n      proof\n        show \"{e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et} \\<subseteq> \n          {(typed (type (id_to_list classtype)) x, (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), typed (type (id_to_list fieldtype)) (values x))}\"\n        proof\n          fix y\n          assume \"y \\<in> {e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et}\"\n          then show \"y \\<in> {(typed (type (id_to_list classtype)) x, (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), typed (type (id_to_list fieldtype)) (values x))}\"\n          proof\n            assume \"y \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) \\<and> src y = n \\<and> type\\<^sub>e y = et\"\n            then show \"y \\<in> {(typed (type (id_to_list classtype)) x, (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), typed (type (id_to_list fieldtype)) (values x))}\"\n              unfolding ig_nullable_class_field_as_edge_type_def\n              using et_def n_def\n              by fastforce\n          qed\n        qed\n      next\n        show \"{(typed (type (id_to_list classtype)) x, (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), typed (type (id_to_list fieldtype)) (values x))} \\<subseteq> \n          {e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et}\"\n        proof\n          fix y\n          assume \"y \\<in> {(typed (type (id_to_list classtype)) x, (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), typed (type (id_to_list fieldtype)) (values x))}\"\n          then have \"y = (typed (type (id_to_list classtype)) x, (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), typed (type (id_to_list fieldtype)) (values x))\"\n            by simp\n          then show \"y \\<in> {e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et}\"\n            unfolding ig_nullable_class_field_as_edge_type_def\n            using et_def n_def x_def\n            by simp\n        qed\n      qed\n      then have \"card {e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et} = 1\"\n        by simp\n      then show ?thesis\n        unfolding within_multiplicity_def\n        by simp\n    qed\n  qed\n  then show \"card {e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et} in \n    m_out (mult (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)) et)\"\n    using mult_et_def\n    by simp\nnext\n  fix p\n  show \"\\<not>pre_digraph.cycle (instance_graph_containment_proj (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)) p\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def instance_graph_containment_proj_def pre_digraph.cycle_def pre_digraph.awalk_def\n    by simp\nqed (simp_all add: assms ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def)\n\nlemma ig_nullable_class_field_as_edge_type_combine_correct:\n  assumes \"instance_graph IG\"\n  assumes existing_node_types: \"{type (id_to_list classtype), type (id_to_list fieldtype)} \\<subseteq> NT (TG IG)\"\n  assumes new_edge_type: \"\\<And>s l t. (type (id_to_list classtype), s) \\<in> inh (TG IG) \\<Longrightarrow> l = LabDef.edge [name] \\<Longrightarrow> (s, l, t) \\<notin> ET (TG IG)\"\n  assumes no_inh_classtype: \"\\<And>x. (x, type (id_to_list classtype)) \\<in> inh (TG IG) \\<Longrightarrow> x = type (id_to_list classtype)\"\n  assumes existing_objects: \"N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) \\<subseteq> N IG\"\n  assumes all_objects: \"\\<And>n. n \\<in> N IG \\<Longrightarrow> type\\<^sub>n n = type (id_to_list classtype) \\<Longrightarrow> \n    n \\<in> typed (type (id_to_list classtype)) ` nilobjects \\<union> typed (type (id_to_list classtype)) ` valobjects\"\n  assumes unique_ids: \"\\<And>o1 o2. o1 \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects \\<Longrightarrow> obids o1 = obids o2 \\<Longrightarrow> o1 = o2\"\n  assumes unique_value: \"valobjects \\<inter> nilobjects = {}\"\n  assumes no_objects: \"classtype \\<noteq> fieldtype \\<Longrightarrow> values ` valobjects \\<inter> (nilobjects \\<union> valobjects) = {}\"\n  assumes existing_ids: \"obids ` nilobjects \\<union> obids ` valobjects \\<union> obids ` values ` valobjects \\<subseteq> Id IG\"\n  assumes valid_ids: \"\\<And>i. i \\<in> obids ` nilobjects \\<union> obids ` valobjects \\<union> obids ` values ` valobjects \\<Longrightarrow> \n    ident IG i = ident (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) i\"\n  shows \"instance_graph (ig_combine IG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values))\"\nproof (intro ig_combine_merge_no_containment_imod2_correct)\n  show \"instance_graph (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  proof (intro ig_nullable_class_field_as_edge_type_correct)\n    assume classtype_fieldtype_eq: \"classtype = fieldtype\"\n    show \"values ` valobjects \\<subseteq> nilobjects \\<union> valobjects\"\n    proof\n      fix x\n      assume \"x \\<in> values ` valobjects\"\n      then have \"typed (type (id_to_list classtype)) x \\<in> \n        N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n        unfolding ig_nullable_class_field_as_edge_type_def\n        by (simp add: classtype_fieldtype_eq)\n      then have \"typed (type (id_to_list classtype)) x \\<in> N IG\"\n        using existing_objects\n        by blast\n      then have \"typed (type (id_to_list classtype)) x \\<in> typed (type (id_to_list classtype)) ` nilobjects \\<union> typed (type (id_to_list classtype)) ` valobjects\"\n        using all_objects\n        by simp\n      then show \"x \\<in> nilobjects \\<union> valobjects\"\n        by blast\n    qed\n  qed (simp_all add: assms)\nnext\n  have \"type_graph (tg_combine (TG IG) (tg_nullable_class_field_as_edge_type classtype name fieldtype))\"\n    using existing_node_types \n  proof (intro tg_nullable_class_field_as_edge_type_combine_correct)\n    fix s l t\n    assume \"(s, LabDef.type (id_to_list classtype)) \\<in> inh (TG IG) \\<or> (LabDef.type (id_to_list classtype), s) \\<in> inh (TG IG)\"\n    then have s_def: \"(LabDef.type (id_to_list classtype), s) \\<in> inh (TG IG)\"\n      using no_inh_classtype\n      by blast\n    assume \"l = LabDef.edge [name]\"\n    then show \"(s, l, t) \\<notin> ET (TG IG)\"\n      by (simp add: new_edge_type s_def)\n  qed (simp_all add: assms(1) instance_graph.validity_type_graph new_edge_type)\n  then show \"type_graph (tg_combine (TG IG) (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)))\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\nnext\n  show \"ET (TG IG) \\<inter> ET (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)) = {}\"\n    using existing_node_types\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    by (simp add: assms(1) instance_graph.validity_type_graph new_edge_type type_graph.validity_inh_node)\nnext\n  fix et n\n  assume et_def: \"et \\<in> ET (TG IG)\"\n  assume \"n \\<in> N IG \\<union> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  then have n_def: \"n \\<in> N IG\"\n    using existing_objects\n    by blast\n  assume \"(type\\<^sub>n n, src et) \\<in> (inh (TG IG) \\<union> inh (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)))\\<^sup>+\"\n  then have \"(type\\<^sub>n n, src et) \\<in> (inh (TG IG) \\<union> inh (tg_nullable_class_field_as_edge_type classtype name fieldtype))\\<^sup>+\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  then have \"(type\\<^sub>n n, src et) \\<in> (inh (TG IG))\\<^sup>+\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    using Un_absorb2 existing_node_types assms(1) insert_subset instance_graph.validity_type_graph sup.orderI sup_bot.right_neutral type_graph.select_convs(3) type_graph.validity_inh_node\n    by metis\n  then have \"(type\\<^sub>n n, src et) \\<in> inh (TG IG)\"\n    by (simp add: assms(1) instance_graph.validity_type_graph type_graph.validity_inh_trans)\n  then show \"card {e \\<in> E IG. src e = n \\<and> type\\<^sub>e e = et} in m_out (mult (TG IG) et)\"\n    using et_def n_def assms(1) instance_graph.validity_outgoing_mult\n    by blast\nnext\n  have instance_graph_valid: \"instance_graph (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  proof (intro ig_nullable_class_field_as_edge_type_correct)\n    assume classtype_fieldtype_eq: \"classtype = fieldtype\"\n    show \"values ` valobjects \\<subseteq> nilobjects \\<union> valobjects\"\n    proof\n      fix x\n      assume \"x \\<in> values ` valobjects\"\n      then have \"typed (type (id_to_list classtype)) x \\<in> \n        N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n        unfolding ig_nullable_class_field_as_edge_type_def\n        by (simp add: classtype_fieldtype_eq)\n      then have \"typed (type (id_to_list classtype)) x \\<in> N IG\"\n        using existing_objects\n        by blast\n      then have \"typed (type (id_to_list classtype)) x \\<in> typed (type (id_to_list classtype)) ` nilobjects \\<union> typed (type (id_to_list classtype)) ` valobjects\"\n        using all_objects\n        by simp\n      then show \"x \\<in> nilobjects \\<union> valobjects\"\n        by blast\n    qed\n  qed (simp_all add: assms)\n  fix et n\n  assume et_in_ig: \"et \\<in> ET (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values))\"\n  then have et_def: \"et = (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype))\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    by simp\n  assume n_set: \"n \\<in> N IG \\<union> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  then have n_def: \"n \\<in> N IG \\<union> typed (type (id_to_list classtype)) ` nilobjects \\<union> typed (type (id_to_list classtype)) ` valobjects \\<union> typed (type (id_to_list fieldtype)) ` values ` valobjects\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  assume \"(type\\<^sub>n n, src et) \\<in> (inh (TG IG) \\<union> inh (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)))\\<^sup>+\"\n  then have \"(type\\<^sub>n n, src et) \\<in> (inh (TG IG) \\<union> inh (tg_nullable_class_field_as_edge_type classtype name fieldtype))\\<^sup>+\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  then have \"(type\\<^sub>n n, src et) \\<in> (inh (TG IG))\\<^sup>+\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    using Un_absorb2 existing_node_types assms(1) insert_subset instance_graph.validity_type_graph sup.orderI sup_bot.right_neutral type_graph.select_convs(3) type_graph.validity_inh_node\n    by metis\n  then have \"(type\\<^sub>n n, src et) \\<in> inh (TG IG)\"\n    by (simp add: assms(1) instance_graph.validity_type_graph type_graph.validity_inh_trans)\n  then have \"(type\\<^sub>n n, type (id_to_list classtype)) \\<in> inh (TG IG)\"\n    using et_def\n    by simp\n  then have type_n_def: \"type\\<^sub>n n = type (id_to_list classtype)\"\n    using no_inh_classtype\n    by simp\n  then have edge_extend_def: \"(type\\<^sub>n n, type (id_to_list classtype)) \\<in> inh (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values))\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    by simp\n  have \"n \\<in> typed (type (id_to_list classtype)) ` nilobjects \\<union> typed (type (id_to_list classtype)) ` valobjects\"\n    using all_objects existing_objects n_set type_n_def\n    by blast\n  then have \"n \\<in> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  then show \"card {e \\<in> E (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values). src e = n \\<and> type\\<^sub>e e = et} in \n    m_out (mult (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)) et)\"\n    using edge_extend_def et_def et_in_ig instance_graph_valid instance_graph.validity_outgoing_mult\n    by fastforce\nnext\n  fix et n\n  assume et_def: \"et \\<in> ET (TG IG)\"\n  assume \"n \\<in> N IG \\<union> N (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  then have n_def: \"n \\<in> N IG\"\n    using existing_objects\n    by blast\n  assume \"(type\\<^sub>n n, tgt et) \\<in> (inh (TG IG) \\<union> inh (TG (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)))\\<^sup>+\"\n  then have \"(type\\<^sub>n n, tgt et) \\<in> (inh (TG IG) \\<union> inh (tg_nullable_class_field_as_edge_type classtype name fieldtype))\\<^sup>+\"\n    unfolding ig_nullable_class_field_as_edge_type_def\n    by simp\n  then have \"(type\\<^sub>n n, tgt et) \\<in> (inh (TG IG))\\<^sup>+\"\n    unfolding ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def\n    using Un_absorb2 existing_node_types assms(1) insert_subset instance_graph.validity_type_graph sup.orderI sup_bot.right_neutral type_graph.select_convs(3) type_graph.validity_inh_node\n    by metis\n  then have \"(type\\<^sub>n n, tgt et) \\<in> inh (TG IG)\"\n    by (simp add: assms(1) instance_graph.validity_type_graph type_graph.validity_inh_trans)\n  then show \"card {e \\<in> E IG. tgt e = n \\<and> type\\<^sub>e e = et} in m_in (mult (TG IG) et)\"\n    using et_def n_def assms(1) instance_graph.validity_ingoing_mult\n    by blast\nqed (simp_all add: ig_nullable_class_field_as_edge_type_def tg_nullable_class_field_as_edge_type_def assms)\n\n\n\nsubsection \"Transformation functions\"\n\ndefinition imod_nullable_class_field_to_ig_nullable_class_field_as_edge_type :: \"'t Id \\<Rightarrow> 't \\<Rightarrow> 't Id \\<Rightarrow> 'o set \\<Rightarrow> 'o set \\<Rightarrow> ('o \\<Rightarrow> 't) \\<Rightarrow> ('o \\<Rightarrow> 'o) \\<Rightarrow> ('o, 't) instance_model \\<Rightarrow> ('o, 't list, 't) instance_graph\" where\n  \"imod_nullable_class_field_to_ig_nullable_class_field_as_edge_type classtype name fieldtype nilobjects valobjects obids values Imod = \\<lparr>\n    TG = tg_nullable_class_field_as_edge_type classtype name fieldtype,\n    Id = obids ` Object Imod,\n    N = typed (type (id_to_list classtype)) ` {ob \\<in> Object Imod. ob \\<in> nilobjects \\<union> valobjects} \\<union> typed (type (id_to_list fieldtype)) ` {ob \\<in> Object Imod. ob \\<in> values ` valobjects},\n    E = (\\<lambda>x. (typed (type (id_to_list classtype)) x, (type (id_to_list classtype), LabDef.edge [name], type (id_to_list fieldtype)), typed (type (id_to_list fieldtype)) (values x))) ` {ob \\<in> Object Imod. ob \\<in> valobjects},\n    ident = (\\<lambda>x. if x \\<in> obids ` nilobjects \\<or> x \\<in> obids ` valobjects then typed (type (id_to_list classtype)) (THE y. obids y = x) else \n      if x \\<in> obids ` values ` valobjects then typed (type (id_to_list fieldtype)) (THE y. obids y = x) else undefined)\n  \\<rparr>\"\n\nlemma imod_nullable_class_field_to_ig_nullable_class_field_as_edge_type_proj:\n  shows \"imod_nullable_class_field_to_ig_nullable_class_field_as_edge_type classtype name fieldtype nilobjects valobjects obids values (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) = \n    ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values\"\n  unfolding imod_nullable_class_field_to_ig_nullable_class_field_as_edge_type_def ig_nullable_class_field_as_edge_type_def imod_nullable_class_field_def\n  by auto\n\nlemma imod_nullable_class_field_to_ig_nullable_class_field_as_edge_type_func:\n  shows \"ig_combine_mapping_function (imod_nullable_class_field_to_ig_nullable_class_field_as_edge_type classtype name fieldtype nilobjects valobjects obids values)\n    (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values) (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values)\"\n  by (intro ig_combine_mapping_function.intro)\n    (auto simp add: imod_nullable_class_field_to_ig_nullable_class_field_as_edge_type_def imod_nullable_class_field_def ig_nullable_class_field_as_edge_type_def imod_combine_def)\n\ndefinition ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field :: \"'t Id \\<Rightarrow> 't \\<Rightarrow> 't Id \\<Rightarrow> 'o set \\<Rightarrow> 'o set \\<Rightarrow> ('o \\<Rightarrow> 't) \\<Rightarrow> ('o \\<Rightarrow> 'o) \\<Rightarrow> ('o, 't list, 't) instance_graph \\<Rightarrow> ('o, 't) instance_model\" where\n  \"ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field classtype name fieldtype nilobjects valobjects obids values IG = \\<lparr>\n    Tm = tmod_nullable_class_field classtype name fieldtype,\n    Object = nodeId ` N IG,\n    ObjectClass = (\\<lambda>x. if x \\<in> nilobjects \\<union> valobjects then classtype else \n      if x \\<in> values ` valobjects then fieldtype else undefined),\n    ObjectId = (\\<lambda>x. if x \\<in> nilobjects \\<union> valobjects \\<union> values ` valobjects then obids x else undefined),\n    FieldValue = (\\<lambda>x. if fst x \\<in> nilobjects \\<and> snd x = (classtype, name) then nil else \n      if fst x \\<in> valobjects \\<and> snd x = (classtype, name) then obj (values (fst x)) else\n      if fst x \\<in> values ` valobjects \\<and> snd x = (classtype, name) then unspecified else undefined),\n    DefaultValue = (\\<lambda>x. undefined)\n  \\<rparr>\"\n\nlemma ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field_proj:\n  shows \"ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field classtype name fieldtype nilobjects valobjects obids values (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) = \n    imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values\"\nproof-\n  have \"nodeId ` (typed (LabDef.type (id_to_list classtype)) ` nilobjects) = nilobjects\"\n    by force\n  then have nilobjects_def: \"\\<And>x. x \\<in> nilobjects \\<Longrightarrow> \n    x \\<in> nodeId ` (typed (LabDef.type (id_to_list classtype)) ` nilobjects \\<union> typed (LabDef.type (id_to_list classtype)) ` valobjects \\<union> typed (LabDef.type (id_to_list fieldtype)) ` values ` valobjects)\"\n    by blast\n  have \"nodeId ` (typed (LabDef.type (id_to_list classtype)) ` valobjects) = valobjects\"\n    by force\n  then have valobjects_def: \"\\<And>x. x \\<in> valobjects \\<Longrightarrow> \n    x \\<in> nodeId ` (typed (LabDef.type (id_to_list classtype)) ` nilobjects \\<union> typed (LabDef.type (id_to_list classtype)) ` valobjects \\<union> typed (LabDef.type (id_to_list fieldtype)) ` values ` valobjects)\"\n    by blast\n  have \"nodeId ` (typed (LabDef.type (id_to_list fieldtype)) ` values ` valobjects) = values ` valobjects\"\n    by force\n  then have values_def: \"\\<And>x. x \\<in> values ` valobjects \\<Longrightarrow> \n    x \\<in> nodeId ` (typed (LabDef.type (id_to_list classtype)) ` nilobjects \\<union> typed (LabDef.type (id_to_list classtype)) ` valobjects \\<union> typed (LabDef.type (id_to_list fieldtype)) ` values ` valobjects)\"\n    by blast\n  show \"ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field classtype name fieldtype nilobjects valobjects obids values (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) = \n    imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values\"\n    unfolding ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field_def imod_nullable_class_field_def ig_nullable_class_field_as_edge_type_def\n    using nilobjects_def valobjects_def values_def\n    by auto\nqed\n\nlemma ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field_func:\n  shows \"imod_combine_mapping_function (ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field classtype name fieldtype nilobjects valobjects obids values)\n    (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) (imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values)\"\nproof (intro imod_combine_mapping_function.intro)\n  show \"ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field classtype name fieldtype nilobjects valobjects obids values (ig_nullable_class_field_as_edge_type classtype name fieldtype valobjects nilobjects obids values) =\n    imod_nullable_class_field classtype name fieldtype valobjects nilobjects obids values\"\n    by (fact ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field_proj)\nqed (auto simp add: ig_nullable_class_field_as_edge_type_to_imod_nullable_class_field_def imod_nullable_class_field_def ig_nullable_class_field_as_edge_type_def ig_combine_def)\n\nend", "meta": {"author": "RemcodM", "repo": "thesis-ecore-groove-formalisation", "sha": "a0e860c4b60deb2f3798ae2ffc09f18a98cf42ca", "save_path": "github-repos/isabelle/RemcodM-thesis-ecore-groove-formalisation", "path": "github-repos/isabelle/RemcodM-thesis-ecore-groove-formalisation/thesis-ecore-groove-formalisation-a0e860c4b60deb2f3798ae2ffc09f18a98cf42ca/isabelle/Ecore-GROOVE-Mapping-Library/NullableClassFieldValue.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.682573734412324, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.3093846322664934}}
{"text": "(* \n   Title: Psi-calculi   \n   Based on the AFP entry by Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weaken_Bisimulation\n  imports Weaken_Simulation Weaken_Stat_Imp\nbegin\n\ncontext weak\nbegin\n\nlemma weakenMonoCoinduct: \"\\<And>x y xa xb xc P Q \\<Psi>.\n                      x \\<le> y \\<Longrightarrow>\n                      (\\<Psi> \\<rhd> Q \\<leadsto>\\<^sub>w<{(xc, xb, xa). x xc xb xa}> P) \\<longrightarrow>\n                     (\\<Psi> \\<rhd> Q \\<leadsto>\\<^sub>w<{(xb, xa, xc). y xb xa xc}> P)\"\napply auto\napply(rule weakenSimMonotonic)\nby(auto dest: le_funE)\n\nlemma weakenMonoCoinduct2: \"\\<And>x y xa xb xc P Q \\<Psi>.\n                      x \\<le> y \\<Longrightarrow>\n                      (\\<Psi> \\<rhd> Q \\<lessapprox>\\<^sub>w<{(xc, xb, xa). x xc xb xa}> P) \\<longrightarrow>\n                     (\\<Psi> \\<rhd> Q \\<lessapprox>\\<^sub>w<{(xb, xa, xc). y xb xa xc}> P)\"\napply auto\napply(rule weakenStatImpMonotonic)\nby(auto dest: le_funE)\n\ncoinductive_set weakenBisim :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\" \nwhere\n  step: \"\\<lbrakk>\\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<weakenBisim> Q; \\<Psi> \\<rhd> P \\<leadsto>\\<^sub>w<weakenBisim> Q;\n          \\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>',  P, Q) \\<in> weakenBisim; (\\<Psi>, Q, P) \\<in> weakenBisim\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, Q) \\<in> weakenBisim\"\nmonos weakenMonoCoinduct weakenMonoCoinduct2\n\nabbreviation\n  weakenBisimJudge (\"_ \\<rhd> _ \\<approx>\\<^sub>w _\" [70, 70, 70] 65) where \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>w Q \\<equiv> (\\<Psi>, P, Q) \\<in> weakenBisim\"\nabbreviation\n  weakenBisimNilJudge (\"_ \\<approx>\\<^sub>w _\" [70, 70] 65) where \"P \\<approx>\\<^sub>w Q \\<equiv> \\<one> \\<rhd> P \\<approx>\\<^sub>w Q\"\n\nlemma weakenBisimCoinductAux[consumes 1]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<(X \\<union> weakenBisim)> Q) \\<and>\n                                    (\\<Psi> \\<rhd> P \\<leadsto>\\<^sub>w<(X \\<union> weakenBisim)> Q) \\<and>\n                                    (\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X \\<or> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> weakenBisim) \\<and>\n                                    ((\\<Psi>, Q, P) \\<in> X \\<or> (\\<Psi>, Q, P) \\<in> weakenBisim)\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> weakenBisim\"\nproof -\n  have \"X \\<union> weakenBisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> weakenBisim}\" by auto\n  with assms show ?thesis\n    by coinduct (simp add: rtrancl_def)\nqed\n\nlemma weakenBisimCoinduct[consumes 1, case_names cStatImp cSim cExt cSym]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> \\<Psi>' \\<rhd> R \\<lessapprox>\\<^sub>w<(X \\<union> weakenBisim)> S\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> \\<Psi>' \\<rhd> R \\<leadsto>\\<^sub>w<(X \\<union> weakenBisim)> S\"\n  and     \"\\<And>\\<Psi>' R S \\<Psi>''. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>' \\<otimes> \\<Psi>'', R, S) \\<in> X \\<or> \\<Psi>' \\<otimes> \\<Psi>'' \\<rhd> R \\<approx>\\<^sub>w S\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>', S, R) \\<in> X \\<or> \\<Psi>' \\<rhd> S \\<approx>\\<^sub>w R\"\n\n  shows \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>w Q\"\nproof -\n  have \"X \\<union> weakenBisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> weakenBisim}\" by auto\n  with assms show ?thesis\n    by coinduct (simp add: rtrancl_def)\nqed\n\nlemma weakenBisimWeakCoinductAux[consumes 1]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<X> Q \\<and>\n                                     \\<Psi> \\<rhd> P \\<leadsto>\\<^sub>w<X> Q \\<and> (\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X) \\<and> \n                                    (\\<Psi>, Q, P) \\<in> X\" \n\n  shows \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>w Q\"\nusing assms\nby(coinduct rule: weakenBisimCoinductAux) (blast intro: weakenSimMonotonic weakenStatImpMonotonic)\n\nlemma weakenBisimE:\n  fixes P  :: \"('a, 'b, 'c) psi\"\n  and   Q  :: \"('a, 'b, 'c) psi\"\n  and   \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n\n  assumes \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>w Q\"\n\n  shows \"\\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<weakenBisim> Q\"\n  and   \"\\<Psi> \\<rhd> P \\<leadsto>\\<^sub>w<weakenBisim> Q\"\n  and   \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P \\<approx>\\<^sub>w Q\"\n  and   \"\\<Psi> \\<rhd> Q \\<approx>\\<^sub>w P\"\nusing assms\nby(auto intro: weakenBisim.cases simp add: rtrancl_def)\n\nlemma weakenBisimWeakCoinduct[consumes 1, case_names cStatImp cSim cExt cSym]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<X> Q\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>\\<^sub>w<X> Q\"\n  and     \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi>, Q, P) \\<in> X\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> weakenBisim\"\nproof -\n  have \"X \\<union> weakenBisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> weakenBisim}\" by auto\n  with assms show ?thesis\n    by(coinduct rule: weakenBisimWeakCoinductAux) blast\nqed\n\nlemma weakenBisimEqWeakBisim[simp]: \"weakenBisim = weakBisim\"\nproof auto\n  fix \\<Psi> P Q\n  assume \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>w Q\" thus \"\\<Psi> \\<rhd> P \\<approx> Q\"\n  proof(coinduct rule: weakBisimWeakCoinduct)\n    case(cStatImp \\<Psi> P Q)\n    from `\\<Psi> \\<rhd> P \\<approx>\\<^sub>w Q` have \"\\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<weakenBisim> Q\" by(rule weakenBisimE)\n    thus ?case using weakenBisimE(3) by(rule weakenStatImpWeakStatImp)\n  next\n    case(cSim \\<Psi> P Q)\n    from `\\<Psi> \\<rhd> P \\<approx>\\<^sub>w Q` weakenBisimE\n    show ?case by(rule weakenSimWeakSim)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(rule weakenBisimE)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(rule weakenBisimE)\n  qed\nnext\n  fix \\<Psi> P Q\n  assume \"\\<Psi> \\<rhd> P \\<approx> Q\" thus \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>w Q\"\n  proof(coinduct rule: weakenBisimWeakCoinduct)\n    case(cStatImp \\<Psi> P Q)\n    from `\\<Psi> \\<rhd> P \\<approx> Q` have \"\\<Psi> \\<rhd> P \\<lessapprox><weakBisim> Q\" by(rule weakBisimE)\n    thus ?case using statEqWeakBisim by(rule weak_stat_impWeakenStatImp)\n  next\n    case(cSim \\<Psi> P Q)\n    from `\\<Psi> \\<rhd> P \\<approx> Q` have \"\\<Psi> \\<rhd> P \\<leadsto><weakBisim> Q\" by(rule weakBisimE)\n    thus ?case using statEqWeakBisim by(rule weakSimWeakenSim)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(rule weakBisimE)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(rule weakBisimE)\n  qed\nqed\n\nlemma weakenTransitiveWeakCoinduct[case_names cStatImp cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and rStatImp: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<X> Q\"\n  and rSim: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>\\<^sub>w<({(\\<Psi>, P, Q) | \\<Psi> P Q. \\<exists>P' Q'. \\<Psi> \\<rhd> P \\<sim> P' \\<and>\n                                                                        (\\<Psi>, P', Q') \\<in> X \\<and>\n                                                                        \\<Psi> \\<rhd> Q' \\<sim> Q})> Q\"\n  and rExt: \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X\"\n  and rSym: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi>, Q, P) \\<in> X\"\n\n  shows \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>w Q\"\nproof -\n  from p `eqvt X` have \"\\<Psi> \\<rhd> P \\<approx> Q\"\n  proof(coinduct rule: weakTransitiveWeakCoinduct)\n    case(cStatImp \\<Psi> P Q)\n    from `(\\<Psi>, P, Q) \\<in> X` have \"\\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<X> Q\" by(rule rStatImp)\n    thus ?case using rExt by(rule weakenStatImpWeakStatImp)\n  next\n    case(cSim \\<Psi> P Q)\n    let ?Y = \"{(\\<Psi>, P, Q) | \\<Psi> P Q. \\<exists>P' Q'. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n    note `(\\<Psi>, P, Q) \\<in> X`\n    moreover note rStatImp rSim\n    moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> ?Y \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> ?Y\"\n      by(blast dest: bisimE rExt)\n    ultimately show ?case using rSym by(rule weakenSimWeakSim)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(rule rExt) \n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(rule rSym)\n  qed\n  thus ?thesis by(simp add: weakenBisimEqWeakBisim)\nqed\n\nlemma weakenTransitiveCoinduct[case_names cStatImp cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and rStatImp: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<lessapprox>\\<^sub>w<(X \\<union> weakenBisim)> Q\"\n  and rSim: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>\\<^sub>w<({(\\<Psi>, P, Q) | \\<Psi> P Q. \\<exists>P' Q'. \\<Psi> \\<rhd> P \\<sim> P' \\<and>\n                                                                        (\\<Psi>, P', Q') \\<in> (X \\<union> weakenBisim) \\<and>\n                                                                        \\<Psi> \\<rhd> Q' \\<sim> Q})> Q\"\n  and rExt: \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X \\<union> weakenBisim\"\n  and rSym: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi>, Q, P) \\<in> X \\<union> weakenBisim\"\n\n  shows \"\\<Psi> \\<rhd> P \\<approx>\\<^sub>w Q\"\nproof -\n  from p have \"(\\<Psi>, P, Q) \\<in> X \\<union> weakenBisim\" by auto\n  moreover from `eqvt X` have \"eqvt(X \\<union> weakenBisim)\" by auto\n  ultimately show ?thesis\n  proof(coinduct rule: weakenTransitiveWeakCoinduct)\n    case(cStatImp \\<Psi> P Q)\n    thus ?case by(fastforce intro: rStatImp weakenBisimE(1) weakenStatImpMonotonic)\n  next\n    case(cSim \\<Psi> P Q)\n    thus ?case by(fastforce intro: rSim weakenBisimE(2) weakenSimMonotonic bisim_reflexive)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(blast dest: weakenBisimE rExt) \n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(blast dest: weakenBisimE rSym)\n  qed\nqed\n\nend\n\nend\n\n", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Weaken_Bisimulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526660244838, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3093520892026564}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2005         |\n            |                January 2006               |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory FNF_F_sf_int\nimports FNF_F_sf_def\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*  The following simplification rules are deleted in this theory file *)\n(*       P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y))        *)\n(* Isabelle 2017: split_if --> if_split *)\n\ndeclare if_split  [split del]\n\n(*****************************************************************\n\n         1. full sequentialization for Rep_int_choice_nat\n         2. full sequentialization for Rep_int_choice_set\n         3. full sequentialization for Int_choice\n         3. \n\n *****************************************************************)\n\n(*============================================================*\n |                                                            |\n |                    Rep_int_choice_nat                      |\n |                                                            |\n *============================================================*)\n\ndefinition\n  fsfF_Rep_int_choice ::\n  \"'a sets_nats => ('a aset_anat => ('p,'a) proc) => ('p,'a) proc\"\n  where\n  fsfF_Rep_int_choice_def :\n    \"fsfF_Rep_int_choice C SPf == \n     if (sumset C = {}) then SDIV else !! :C .. SPf\"\n\nsyntax\n  \"_fsfF_Rep_int_choice\" :: \n      \"'a sets_nats => ('a aset_anat => ('p,'a) proc) => ('p,'a) proc\"\n                                     (\"(1!! :_ ..seq /_)\" [900,68] 68) \n  \"@fsfF_Rep_int_choice\":: \n      \"pttrn => 'a sets_nats => ('p,'a) proc => ('p,'a) proc\"  \n                               (\"(1!! _:_ ..seq /_)\" [900,900,68] 68)\n\ntranslations\n  \"!! :C ..seq SPf\"  == \"CONST fsfF_Rep_int_choice C SPf\"\n  \"!! c:C ..seq SP\"  == \"!! :C ..seq (%c. SP)\"\n\n(*------------------------------------------------------------*\n |                        in fsfF_proc                        |\n *------------------------------------------------------------*)\n\nlemma fsfF_Rep_int_choice_in:\n  \"ALL c: sumset C. SPf c : fsfF_proc ==> !! :C ..seq SPf : fsfF_proc\"\napply (simp add: fsfF_Rep_int_choice_def)\n\n(* Isabelle 2017 *)\n apply (simp split: if_split)\n apply (intro impI)\n\n apply (rule fsfF_procI)\n apply (simp)\ndone\n\n(*------------------------------------------------------------*\n |             syntactical transformation to fsfF             |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Rep_int_choice_eqF:\n  \"!! :C .. SPf =F !! :C ..seq SPf\"\napply (simp add: fsfF_Rep_int_choice_def)\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_Rep_int_choice_DIV)\napply (simp)\napply (rule cspF_SDIV_eqF)\n\n      (* N~={} *)\napply (simp)\ndone\n\n(* =F also can be semi-automatically proven by using tactics. *)\n(*\nlemma \"!! :C .. SPf =F !! :C ..seq SPf\"\napply (simp add: fsfF_Rep_int_choice_def)\n  apply (case_tac \"sumset C={}\")\n  apply (cspF_hsf)\napply (rule cspF_SDIV_eqF)\ndone\n*)\n\nlemmas cspF_fsfF_Rep_int_choice_eqF_sym =\n       cspF_fsfF_Rep_int_choice_eqF[THEN cspF_sym]\n\n(*============================================================*\n |                                                            |\n |                       for convenience                      |\n |                                                            |\n *============================================================*)\n\ndefinition\n  fsfF_Rep_int_choice_set :: \n    \"'a set set => ('a set => ('p,'a) proc) => ('p,'a) proc\"\n                                      (\"(1!set :_ ..seq /_)\" [900,68] 68)\n  where\n  fsfF_Rep_int_choice_set_def:\n        \"!set :Xs ..seq Pf == !! c:(type1 Xs) ..seq (Pf ((inv type1) c))\"\n        \ndefinition\n  fsfF_Rep_int_choice_nat ::\n    \"nat set => (nat => ('p,'a) proc) => ('p,'a) proc\"\n                                      (\"(1!nat :_ ..seq /_)\" [900,68] 68)\n  where\n  fsfF_Rep_int_choice_nat_def:\n        \"!nat :N ..seq Pf == !! c:(type2 N) ..seq (Pf ((inv type2) c))\"\n\nsyntax\n  \"@fsfF_Rep_int_choice_set\" :: \n       \"pttrn => ('a set) set => ('a set => ('p,'a) proc) => ('p,'a) proc\"\n                                      (\"(1!set _:_ ..seq /_)\" [900,900,68] 68)\n  \"@fsfF_Rep_int_choice_nat\" :: \n       \"pttrn => nat set => (nat => ('p,'a) proc) => ('p,'a) proc\"\n                                      (\"(1!nat _:_ ..seq /_)\" [900,900,68] 68)\n\ntranslations\n    \"!set X:Xs ..seq P\" == \"!set :Xs ..seq (%X. P)\"\n    \"!nat n:N ..seq P\"  == \"!nat :N ..seq (%n. P)\"\n\n(* com *)\n\ndefinition\n  fsfF_Rep_int_choice_com :: \"'a set => ('a => ('p,'a) proc) => ('p,'a) proc\"\n                                      (\"(1! :_ ..seq /_)\" [900,68] 68)\n  where\n  fsfF_Rep_int_choice_com_def:\n     \"! :A ..seq Pf == !set X:{{a} |a. a : A} ..seq Pf (the_elem(X))\"\n\nsyntax\n  \"@fsfF_Rep_int_choice_com\" :: \n      \"pttrn => 'a set => ('a => ('p,'a) proc) => ('p,'a) proc\"\n                                      (\"(1! _:_ ..seq /_)\" [900,900,68] 68)\ntranslations\n    \"! x:X ..seq P\"    == \"! :X ..seq (%x. P)\"\n\n(* f *)\n\ndefinition\n  fsfF_Rep_int_choice_f :: \"('b => 'a)\n          => 'b set => ('b => ('p,'a) proc) => ('p,'a) proc\"\n                                        (\"(1!<_> :_ ..seq /_)\" [0,900,68] 68)\n  where\n  fsfF_Rep_int_choice_f_def : \n        \"!<f> :X ..seq Pf == ! :(f ` X) ..seq (%x. (Pf ((inv f) x)))\"\n\nsyntax\n  \"@fsfF_Rep_int_choice_f\":: \n  \"('b => 'a) => pttrn => 'b set => ('p,'a) proc => ('p,'a) proc\"\n                               (\"(1!<_> _:_ ..seq /_)\" [0,900,900,68] 68)\ntranslations\n  \"!<f> x:X ..seq P\"   == \"!<f> :X ..seq (%x. P)\"\n\n(*============================================================*\n |                                                            |\n |                 convenient expressions                     |\n |                                                            |\n *============================================================*)\n\n(*------------------------------------*\n |                 in                 |\n *------------------------------------*)\n\nlemma fsfF_Rep_int_choice_nat_in:\n  \"ALL n:N. SPf n : fsfF_proc ==>\n       !nat :N ..seq SPf : fsfF_proc\"\napply (simp add: fsfF_Rep_int_choice_nat_def)\napply (rule fsfF_Rep_int_choice_in)\napply (auto)\ndone\n\nlemma fsfF_Rep_int_choice_set_in:\n  \"ALL X:Xs. SPf X : fsfF_proc ==>\n       !set :Xs ..seq SPf : fsfF_proc\"\napply (simp add: fsfF_Rep_int_choice_set_def)\napply (rule fsfF_Rep_int_choice_in)\napply (auto)\ndone\n\nlemma fsfF_Rep_int_choice_com_in:\n  \"ALL x:X. SPf x : fsfF_proc ==>\n       ! :X ..seq SPf : fsfF_proc\"\napply (simp add: fsfF_Rep_int_choice_com_def)\napply (rule fsfF_Rep_int_choice_set_in)\napply (auto)\ndone\n\nlemma fsfF_Rep_int_choice_f_in:\n  \"[| inj f ; ALL x:X. SPf x : fsfF_proc |] ==>\n    !<f> :X ..seq SPf : fsfF_proc\"\napply (insert fsfF_Rep_int_choice_com_in[of \"(f ` X)\" \"(%x. SPf (inv f x))\"])\napply (simp add: fsfF_Rep_int_choice_f_def)\ndone\n\n(*------------------------------------*\n |                 eqF                |\n *------------------------------------*)\n\nlemma cspF_fsfF_Rep_int_choice_nat_eqF:\n  \"!nat :N .. SPf =F !nat :N ..seq SPf\"\napply (simp add: fsfF_Rep_int_choice_nat_def)\napply (simp add: Rep_int_choice_nat_def)\napply (simp add: cspF_fsfF_Rep_int_choice_eqF)\ndone\n\nlemma cspF_fsfF_Rep_int_choice_set_eqF:\n  \"!set :Xs .. SPf =F !set :Xs ..seq SPf\"\napply (simp add: fsfF_Rep_int_choice_set_def)\napply (simp add: Rep_int_choice_set_def)\napply (simp add: cspF_fsfF_Rep_int_choice_eqF)\ndone\n\nlemma cspF_fsfF_Rep_int_choice_com_eqF:\n  \"! :X .. SPf =F ! :X ..seq SPf\"\napply (simp add: fsfF_Rep_int_choice_com_def)\napply (simp add: Rep_int_choice_com_def)\napply (simp add: cspF_fsfF_Rep_int_choice_set_eqF)\ndone\n\nlemma cspF_fsfF_Rep_int_choice_f_eqF:\n  \"inj f ==>\n   !<f> :X .. SPf =F !<f> :X ..seq SPf\"\napply (insert cspF_fsfF_Rep_int_choice_com_eqF\n              [of \"(f ` X)\" \"(%x. SPf (inv f x))\"])\napply (simp add: Rep_int_choice_f_def)\napply (simp add: fsfF_Rep_int_choice_f_def)\ndone\n\n(*============================================================*\n |                                                            |\n |                        Int_choice                          |\n |                                                            |\n *============================================================*)\n\ndefinition\n  fsfF_Int_choice ::\n  \"('p,'a) proc => ('p,'a) proc => ('p,'a) proc\"\n        (\"(1_ /|~|seq _)\" [64,65] 64)\n\n  where\n  fsfF_Int_choice_def :\n    \"P |~|seq Q ==\n           !nat : {0, (Suc 0)} ..\n               (%x. if (x = 0) then P else Q)\"\n\n(*------------------------------------------------------------*\n |                        in fsfF_proc                        |\n *------------------------------------------------------------*)\n\nlemma fsfF_Int_choice_in:\n  \"[| P : fsfF_proc ; Q : fsfF_proc |] ==>\n   P |~|seq Q : fsfF_proc\"\napply (simp add: fsfF_Int_choice_def)\napply (simp add: Rep_int_choice_ss_def)\napply (rule fsfF_proc_int)\napply (auto)\ndone\n\n(*------------------------------------------------------------*\n |             syntactical transformation to fsfF             |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Int_choice_eqF:\n  \"P |~| Q =F P |~|seq Q\"\napply (simp add: fsfF_Int_choice_def)\napply (rule cspF_rw_left)\napply (rule cspF_Int_choice_to_Rep)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_IF_split)\napply (auto)\ndone\n\n(****************** to add them again ******************)\n\ndeclare if_split    [split]\ndeclare disj_not1   [simp]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/FNF_F/FNF_F_sf_int.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526660244837, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.30935208920265633}}
{"text": "(*\n  Author: Mohammad Abdulaziz\n*)\n\ntheory Solve_SASP\n  imports AST_SAS_Plus_Equivalence \"SAT_Solve_SAS_Plus\" \n          \"HOL-Data_Structures.RBT_Map\" \"HOL-Library.Code_Target_Nat\" HOL.String\n          AI_Planning_Languages_Semantics.SASP_Checker Set2_Join_RBT\nbegin\n\nsubsection \\<open>SAT encoding works for Fast-Downward's representation\\<close>\n\ncontext abs_ast_prob\nbegin\n\ntheorem is_serial_sol_then_valid_plan_encoded:\n  \"\\<A> \\<Turnstile> \\<Phi>\\<^sub>\\<forall> (\\<phi> (prob_with_noop abs_prob)) t \\<Longrightarrow>\n   valid_plan \n        (decode_abs_plan\n           (rem_noops\n                   (map (\\<lambda>op. \\<phi>\\<^sub>O\\<inverse> (prob_with_noop abs_prob) op)\n                        (concat (\\<Phi>\\<inverse> (\\<phi> (prob_with_noop abs_prob)) \\<A> t)))))\"\n  by (fastforce intro!: is_serial_sol_then_valid_plan abs_prob_valid\n                        sas_plus_problem_has_serial_solution_iff_i')\n  \nlemma length_abs_ast_plan: \"length \\<pi>s = length (abs_ast_plan \\<pi>s)\"\n  by (auto simp: abs_ast_plan_def)\n\ntheorem valid_plan_then_is_serial_sol_encoded:\n  \"valid_plan \\<pi>s \\<Longrightarrow> length \\<pi>s \\<le>  h \\<Longrightarrow> \\<exists>\\<A>. \\<A> \\<Turnstile> \\<Phi>\\<^sub>\\<forall> (\\<phi> (prob_with_noop abs_prob)) h\"\n  apply(subst (asm) length_abs_ast_plan)\n  by (fastforce intro!: sas_plus_problem_has_serial_solution_iff_ii' abs_prob_valid\n                        valid_plan_then_is_serial_sol)\nend\n\nsection \\<open>DIMACS-like semantics for CNF formulae\\<close>\n\ntext \\<open>We now push the SAT encoding towards a lower-level representation by replacing the atoms which\n      have variable IDs and time steps into natural numbers.\\<close>\n\nlemma gtD: \"((l::nat) < n) \\<Longrightarrow> (\\<exists>m. n = Suc m \\<and> l \\<le> m)\"\n  by (induction n) auto\n\nlocale cnf_to_dimacs =\n  fixes h :: nat and n_ops :: nat\nbegin\n\nfun var_to_dimacs where\n  \"var_to_dimacs (Operator t k) = 1 + t + k * h\"\n| \"var_to_dimacs (State t k) = 1 + n_ops * h + t + k * (h)\"\n\ndefinition dimacs_to_var where\n  \"dimacs_to_var v \\<equiv>\n     if v < 1 + n_ops * h then\n       Operator ((v - 1) mod (h)) ((v - 1) div (h))\n     else\n       (let k = ((v - 1) - n_ops * h) in \n          State (k mod (h)) (k div (h)))\"\n\nfun valid_state_var where\n  \"valid_state_var (Operator t k) \\<longleftrightarrow> t < h \\<and> k < n_ops\"\n| \"valid_state_var (State t k) \\<longleftrightarrow> t < h\"\n\nlemma State_works:\n\"valid_state_var (State t k) \\<Longrightarrow>\n      dimacs_to_var (var_to_dimacs (State t k)) = \n         (State t k)\"\n  by (induction k) (auto simp add: dimacs_to_var_def add.left_commute Let_def)\n\nlemma Operator_works:\n   \"valid_state_var (Operator t k) \\<Longrightarrow>\n      dimacs_to_var (var_to_dimacs (Operator t k)) = \n         (Operator t k)\"\n  by (induction k) (auto simp add: algebra_simps dimacs_to_var_def gr0_conv_Suc nat_le_iff_add dest!: gtD)\n\nlemma sat_plan_to_dimacs_works:\n  \"valid_state_var sv \\<Longrightarrow>\n     dimacs_to_var (var_to_dimacs sv) = sv\"\n  apply(cases sv)\n  using State_works Operator_works\n  by auto\n\nend\n\nlemma changing_atoms_works:\n  \"(\\<And>x. P x \\<Longrightarrow> (f o g) x = x) \\<Longrightarrow> (\\<forall>x\\<in>atoms phi. P x) \\<Longrightarrow> M \\<Turnstile> phi \\<longleftrightarrow> M o f \\<Turnstile> map_formula g phi\"  \n  by (induction phi) auto  \n\nlemma changing_atoms_works':\n  \"M o g \\<Turnstile> phi \\<longleftrightarrow> M  \\<Turnstile> map_formula g phi\"  \n  by (induction phi) auto  \n\ncontext cnf_to_dimacs\nbegin\n\nlemma sat_plan_to_dimacs:\n  \"(\\<And>sv. sv\\<in>atoms sat_plan_formula \\<Longrightarrow> valid_state_var sv) \\<Longrightarrow>\n       M \\<Turnstile> sat_plan_formula\n         \\<longleftrightarrow> M o dimacs_to_var \\<Turnstile> map_formula var_to_dimacs sat_plan_formula\"\n  by(auto intro!: changing_atoms_works[where P = valid_state_var] simp: sat_plan_to_dimacs_works)\n\nlemma dimacs_to_sat_plan:\n  \"M o var_to_dimacs \\<Turnstile> sat_plan_formula\n     \\<longleftrightarrow> M \\<Turnstile> map_formula var_to_dimacs sat_plan_formula\"\n  using changing_atoms_works' .\n\nend\n\nlocale sat_solve_sasp = abs_ast_prob \"\\<Pi>\" + cnf_to_dimacs \"Suc h\" \"Suc (length ast\\<delta>)\"\n  for \\<Pi> h\nbegin\n\nlemma encode_initial_state_valid: \n  \"sv \\<in> atoms (encode_initial_state Prob) \\<Longrightarrow> valid_state_var sv\"\n  by (auto simp add: encode_state_variable_def Let_def encode_initial_state_def split: sat_plan_variable.splits bool.splits)\n\nlemma length_operators: \"length (operators_of (\\<phi> (prob_with_noop abs_prob))) = Suc (length ast\\<delta>)\"\n  by(simp add: abs_prob_def abs_ast_operator_section_def sas_plus_problem_to_strips_problem_def prob_with_noop_def)\n\nlemma encode_operator_effect_valid_1: \"t < h \\<Longrightarrow> op \\<in> set (operators_of (\\<phi> (prob_with_noop abs_prob))) \\<Longrightarrow> \n       sv \\<in> atoms \n        (\\<^bold>\\<And>(map (\\<lambda>v. \n              \\<^bold>\\<not>(Atom (Operator t (index (operators_of (\\<phi> (prob_with_noop abs_prob))) op)))\n              \\<^bold>\\<or> Atom (State (Suc t) (index vs v))) \n            asses)) \\<Longrightarrow>\n       valid_state_var sv\"\n  using length_operators\n  by (induction asses) (auto simp: simp add: cnf_to_dimacs.valid_state_var.simps)\n  \n  \nlemma encode_operator_effect_valid_2: \"t < h \\<Longrightarrow> op \\<in> set (operators_of (\\<phi> (prob_with_noop abs_prob))) \\<Longrightarrow>\n       sv \\<in> atoms \n        (\\<^bold>\\<And>(map (\\<lambda>v.\n              \\<^bold>\\<not>(Atom (Operator t (index (operators_of (\\<phi> (prob_with_noop abs_prob))) op)))\n               \\<^bold>\\<or> \\<^bold>\\<not> (Atom (State (Suc t) (index vs v))))\n            asses)) \\<Longrightarrow>\n       valid_state_var sv\"\n  using length_operators\n  by (induction asses) (auto simp: simp add: cnf_to_dimacs.valid_state_var.simps)\n\nend\n\nlemma atoms_And_append: \"atoms (\\<^bold>\\<And> (as1 @ as2)) = atoms (\\<^bold>\\<And> as1) \\<union>  atoms (\\<^bold>\\<And> as2)\"\n  by (induction as1) auto\n\ncontext sat_solve_sasp\nbegin\n\nlemma encode_operator_effect_valid: \n  \"sv \\<in> atoms (encode_operator_effect (\\<phi> (prob_with_noop abs_prob)) t op) \\<Longrightarrow> \n    t < h \\<Longrightarrow> op \\<in> set (operators_of (\\<phi> (prob_with_noop abs_prob))) \\<Longrightarrow>\n    valid_state_var sv\"\n  by (force simp: encode_operator_effect_def Let_def atoms_And_append \n            intro!: encode_operator_effect_valid_1 encode_operator_effect_valid_2)\n\nend\n\nlemma foldr_And: \"foldr (\\<^bold>\\<and>) as (\\<^bold>\\<not> \\<bottom>) = (\\<^bold>\\<And> as)\"\n  by (induction as) auto\n\ncontext sat_solve_sasp\nbegin\n\nlemma encode_all_operator_effects_valid:\n   \"t < Suc h \\<Longrightarrow>\n    sv \\<in> atoms (encode_all_operator_effects (\\<phi> (prob_with_noop abs_prob)) (operators_of (\\<phi> (prob_with_noop abs_prob))) t) \\<Longrightarrow> \n    valid_state_var sv\"\n  unfolding encode_all_operator_effects_def foldr_And \n  by (force simp add: encode_operator_effect_valid)\n\nlemma encode_operator_precondition_valid_1: \n  \"t < h \\<Longrightarrow> op \\<in> set (operators_of (\\<phi> (prob_with_noop abs_prob))) \\<Longrightarrow> \n       sv \\<in> atoms \n        (\\<^bold>\\<And>(map (\\<lambda>v. \n        \\<^bold>\\<not> (Atom (Operator t (index (operators_of (\\<phi> (prob_with_noop abs_prob))) op))) \\<^bold>\\<or> Atom (State t (f v))) \n      asses)) \\<Longrightarrow>\n       valid_state_var sv\"\n  using length_operators\n  by (induction asses) (auto simp: simp add: cnf_to_dimacs.valid_state_var.simps)\n  \nlemma encode_operator_precondition_valid: \n  \"sv \\<in> atoms (encode_operator_precondition (\\<phi> (prob_with_noop abs_prob)) t op) \\<Longrightarrow> \n    t < h \\<Longrightarrow> op \\<in> set (operators_of (\\<phi> (prob_with_noop abs_prob))) \\<Longrightarrow>\n    valid_state_var sv\"\n  by (force simp: encode_operator_precondition_def Let_def \n            intro!: encode_operator_precondition_valid_1)\n\nlemma encode_all_operator_preconditions_valid:\n   \"t < Suc h \\<Longrightarrow>\n    sv \\<in> atoms (encode_all_operator_preconditions (\\<phi> (prob_with_noop abs_prob)) (operators_of (\\<phi> (prob_with_noop abs_prob))) t) \\<Longrightarrow> \n    valid_state_var sv\"\n  unfolding encode_all_operator_preconditions_def foldr_And \n  by (force simp add: encode_operator_precondition_valid)\n\nlemma encode_operators_valid:\n   \"sv \\<in> atoms (encode_operators (\\<phi> (prob_with_noop abs_prob)) t) \\<Longrightarrow> t < Suc h \\<Longrightarrow>\n    valid_state_var sv\" \n  unfolding encode_operators_def Let_def \n  by (force simp add: encode_all_operator_preconditions_valid encode_all_operator_effects_valid)\n\nlemma encode_negative_transition_frame_axiom':\n  \"t < h \\<Longrightarrow>\n   set deleting_operators \\<subseteq> set (operators_of (\\<phi> (prob_with_noop abs_prob))) \\<Longrightarrow>\n    sv \\<in> atoms \n       (\\<^bold>\\<not>(Atom (State t v_idx)) \n          \\<^bold>\\<or> (Atom (State (Suc t) v_idx)\n          \\<^bold>\\<or> \\<^bold>\\<Or> (map (\\<lambda>op. Atom (Operator t (index (operators_of (\\<phi> (prob_with_noop abs_prob))) op)))\n          deleting_operators))) \\<Longrightarrow> \n    valid_state_var sv\"\n  by (induction deleting_operators) (auto simp: length_operators[symmetric] cnf_to_dimacs.valid_state_var.simps)\n\nlemma encode_negative_transition_frame_axiom_valid:\n  \"sv \\<in> atoms (encode_negative_transition_frame_axiom (\\<phi> (prob_with_noop abs_prob)) t v) \\<Longrightarrow>  t < h \\<Longrightarrow> \n    valid_state_var sv\"\n  unfolding encode_negative_transition_frame_axiom_def Let_def\n  apply(intro encode_negative_transition_frame_axiom'[of t])\n  by auto\n\nlemma encode_positive_transition_frame_axiom_valid:\n  \"sv \\<in> atoms (encode_positive_transition_frame_axiom (\\<phi> (prob_with_noop abs_prob)) t v) \\<Longrightarrow> t < h \\<Longrightarrow> \n    valid_state_var sv\"\n  unfolding encode_positive_transition_frame_axiom_def Let_def\n  apply(intro encode_negative_transition_frame_axiom'[of t])\n  by auto\n\nlemma encode_all_frame_axioms_valid:\n  \"sv \\<in> atoms (encode_all_frame_axioms (\\<phi> (prob_with_noop abs_prob)) t) \\<Longrightarrow> t < Suc h \\<Longrightarrow>\n    valid_state_var sv\"\n  unfolding encode_all_frame_axioms_def Let_def atoms_And_append\n  by (force simp add: encode_negative_transition_frame_axiom_valid encode_positive_transition_frame_axiom_valid)\n\nlemma encode_goal_state_valid: \n  \"sv \\<in> atoms (encode_goal_state Prob t) \\<Longrightarrow> t < Suc h \\<Longrightarrow> valid_state_var sv\"\n  by (auto simp add: encode_state_variable_def Let_def encode_goal_state_def split: sat_plan_variable.splits bool.splits)\n\nlemma encode_problem_valid:\n  \"sv \\<in> atoms (encode_problem (\\<phi> (prob_with_noop abs_prob)) h) \\<Longrightarrow> valid_state_var sv\"\n  unfolding encode_problem_def\n  using encode_initial_state_valid encode_operators_valid encode_all_frame_axioms_valid encode_goal_state_valid\n  by fastforce\n\nlemma encode_interfering_operator_pair_exclusion_valid:\n  \"sv \\<in> atoms (encode_interfering_operator_pair_exclusion (\\<phi> (prob_with_noop abs_prob)) t op\\<^sub>1 op\\<^sub>2) \\<Longrightarrow> t < Suc h \\<Longrightarrow> \n       op\\<^sub>1 \\<in> set (operators_of (\\<phi> (prob_with_noop abs_prob))) \\<Longrightarrow> op\\<^sub>2 \\<in> set (operators_of (\\<phi> (prob_with_noop abs_prob))) \\<Longrightarrow>       \n       valid_state_var sv\"\n  by (auto simp: encode_interfering_operator_pair_exclusion_def Let_def length_operators[symmetric] cnf_to_dimacs.valid_state_var.simps)\n\nlemma encode_interfering_operator_exclusion_valid: \n  \"sv \\<in> atoms (encode_interfering_operator_exclusion (\\<phi> (prob_with_noop abs_prob)) t) \\<Longrightarrow> t < Suc h \\<Longrightarrow> \n      valid_state_var sv\"\n  unfolding encode_interfering_operator_exclusion_def Let_def foldr_And\n  by (force simp add: encode_interfering_operator_pair_exclusion_valid)\n\nlemma encode_problem_with_operator_interference_exclusion_valid:\n  \"sv \\<in> atoms (encode_problem_with_operator_interference_exclusion (\\<phi> (prob_with_noop abs_prob)) h) \\<Longrightarrow> valid_state_var sv\"\n  unfolding encode_problem_with_operator_interference_exclusion_def\n  using encode_initial_state_valid encode_operators_valid encode_all_frame_axioms_valid encode_goal_state_valid\n        encode_interfering_operator_exclusion_valid\n  by fastforce\n\nlemma planning_by_cnf_dimacs_complete:\n  \"valid_plan \\<pi>s \\<Longrightarrow> length \\<pi>s \\<le> h \\<Longrightarrow>\n     \\<exists>M. M \\<Turnstile> map_formula var_to_dimacs (\\<Phi>\\<^sub>\\<forall> (\\<phi> (prob_with_noop  abs_prob)) h)\"\n  using valid_plan_then_is_serial_sol_encoded\n        sat_plan_to_dimacs[OF encode_problem_with_operator_interference_exclusion_valid]\n  by meson\n\nlemma planning_by_cnf_dimacs_sound:\n  \"\\<A> \\<Turnstile> map_formula var_to_dimacs (\\<Phi>\\<^sub>\\<forall> (\\<phi> (prob_with_noop abs_prob)) t) \\<Longrightarrow>\n   valid_plan \n        (decode_abs_plan\n           (rem_noops\n             (map (\\<lambda>op. \\<phi>\\<^sub>O\\<inverse> (prob_with_noop abs_prob) op) \n                (concat (\\<Phi>\\<inverse> (\\<phi> (prob_with_noop abs_prob)) (\\<A> o var_to_dimacs) t)))))\"\n  using changing_atoms_works'\n  by (fastforce intro!: is_serial_sol_then_valid_plan_encoded)\n\nend\n\nsubsection \\<open>Going from Formualae to DIMACS-like CNF\\<close>\n\ntext \\<open>We now represent the CNF formulae into a very low-level representation that is reminiscent to\n      the DIMACS representation, where a CNF formula is a list of list of integers.\\<close>\n\nfun disj_to_dimacs::\"nat formula \\<Rightarrow> int list\" where\n  \"disj_to_dimacs (\\<phi>\\<^sub>1 \\<^bold>\\<or> \\<phi>\\<^sub>2) = disj_to_dimacs \\<phi>\\<^sub>1 @ disj_to_dimacs \\<phi>\\<^sub>2\"\n| \"disj_to_dimacs \\<bottom> = []\"\n| \"disj_to_dimacs (Not \\<bottom>) = [-1::int,1::int]\"\n| \"disj_to_dimacs (Atom v) = [int v]\"\n| \"disj_to_dimacs (Not (Atom v)) = [-(int v)]\"\n\nfun cnf_to_dimacs::\"nat formula \\<Rightarrow> int list list\" where\n  \"cnf_to_dimacs (\\<phi>\\<^sub>1 \\<^bold>\\<and> \\<phi>\\<^sub>2) = cnf_to_dimacs \\<phi>\\<^sub>1 @ cnf_to_dimacs \\<phi>\\<^sub>2\"\n| \"cnf_to_dimacs d = [disj_to_dimacs d]\"\n\ndefinition \"dimacs_lit_to_var l \\<equiv> nat (abs l)\"\n\ndefinition \"find_max (xs::nat list)\\<equiv> (fold max xs 1)\"\n\nlemma find_max_works:\n\"x \\<in> set xs \\<Longrightarrow> x \\<le> find_max xs\" (is \"?P \\<Longrightarrow> ?Q\")\nproof-\n  have \"x \\<in> set xs \\<Longrightarrow> (x::nat) \\<le> (fold max xs m)\" for m\n    unfolding max_def\n    apply (induction xs arbitrary: m rule: rev_induct)\n    using nat_le_linear\n    by (auto dest:  le_trans simp add:)\n  thus \"?P \\<Longrightarrow> ?Q\"\n    by(auto simp add: find_max_def max_def)\nqed\n\nfun formula_vars where\n\"formula_vars (\\<bottom>) = []\" |\n\"formula_vars (Atom k) = [k]\" |\n\"formula_vars (Not F) = formula_vars F\" |\n\"formula_vars (And F G) = formula_vars F @ formula_vars G\" |\n\"formula_vars (Imp F G) = formula_vars F @ formula_vars G\" |\n\"formula_vars (Or F G) = formula_vars F @ formula_vars G\"\n\nlemma atoms_formula_vars: \"atoms f = set (formula_vars f)\"\n  by (induction f) auto\n\nlemma max_var: \"v \\<in> atoms (f::nat formula) \\<Longrightarrow> v \\<le> find_max (formula_vars f)\"\n  using find_max_works\n  by(simp add: atoms_formula_vars)\n\ndefinition \"dimacs_max_var cs \\<equiv> find_max (map (find_max o (map (nat o abs))) cs)\"\n\nlemma fold_max_ge: \"b \\<le> a \\<Longrightarrow> (b::nat) \\<le> fold (\\<lambda>x m. if m \\<le> x then x else m) ys a\"\n  by (induction ys arbitrary: a b) auto\n\nlemma find_max_append:  \"find_max (xs @ ys) = max (find_max xs) (find_max ys) \"\n  apply(simp only: Max.set_eq_fold[symmetric] append_Cons[symmetric] set_append find_max_def)\n  by (metis List.finite_set Max.union Un_absorb Un_insert_left Un_insert_right list.distinct(1) list.simps(15) set_empty)\n\ndefinition dimacs_model::\"int list \\<Rightarrow> int list list \\<Rightarrow> bool\" where\n  \"dimacs_model ls cs \\<equiv> (\\<forall>c\\<in>set cs. (\\<exists>l\\<in>set ls. l \\<in> set c)) \\<and>\n                              distinct (map dimacs_lit_to_var ls)\"\n\nfun model_to_dimacs_model where\n  \"model_to_dimacs_model M (v#vs) = (if M v then int v else - (int v)) # (model_to_dimacs_model M vs)\"\n| \"model_to_dimacs_model _ [] = []\"\n\nlemma model_to_dimacs_model_append:\n \"set (model_to_dimacs_model M (vs @ vs')) = set (model_to_dimacs_model M vs) \\<union> set (model_to_dimacs_model M vs')\"\n  by (induction vs) auto\n\nlemma upt_append_sing: \"xs @ [x] = [a..<n_vars] \\<Longrightarrow> a < n_vars \\<Longrightarrow> (xs = [a..<n_vars - 1] \\<and> x = n_vars-1 \\<and> n_vars > 0)\"\n  by (induction \"n_vars\") auto\n\nlemma upt_eqD: \"upt a b = upt a b' \\<Longrightarrow> (b = b' \\<or> b' \\<le> a \\<or> b \\<le> a)\"\n  by (induction b) (auto dest!: upt_append_sing split: if_splits)\n\nlemma pos_in_model: \"M n \\<Longrightarrow> 0 < n \\<Longrightarrow> n < n_vars \\<Longrightarrow> int n \\<in> set (model_to_dimacs_model M [1..<n_vars])\"\n  by (induction n_vars) (auto simp add: less_Suc_eq model_to_dimacs_model_append )\n\nlemma neg_in_model: \"\\<not> M n \\<Longrightarrow> 0 < n \\<Longrightarrow> n < n_vars \\<Longrightarrow> - (int n) \\<in> set (model_to_dimacs_model M [1..<n_vars])\"\n  by (induction n_vars) (auto simp add: less_Suc_eq model_to_dimacs_model_append)\n\nlemma in_model: \"0 < n \\<Longrightarrow> n < n_vars \\<Longrightarrow> int n \\<in> set (model_to_dimacs_model M [1..<n_vars]) \\<or> - (int n) \\<in> set (model_to_dimacs_model M [1..<n_vars])\"\n  using pos_in_model neg_in_model\n  by metis\n\nlemma model_to_dimacs_model_all_vars:\n  \"(\\<forall>v\\<in>atoms f. 0 < v \\<and> v < n_vars) \\<Longrightarrow> is_cnf f \\<Longrightarrow> M \\<Turnstile> f \\<Longrightarrow>\n        (\\<forall>n<n_vars. 0 < n \\<longrightarrow> (int n \\<in> set (model_to_dimacs_model M [(1::nat)..<n_vars]) \\<or>\n                              -(int n) \\<in> set (model_to_dimacs_model M [(1::nat)..<n_vars])))\"\n  using in_model neg_in_model pos_in_model  \n  by (auto simp add: le_less model_to_dimacs_model_append split: if_splits)\n\nlemma cnf_And: \"set (cnf_to_dimacs (f1 \\<^bold>\\<and> f2)) = set (cnf_to_dimacs f1) \\<union> set (cnf_to_dimacs f2)\"\n  by auto\n\nlemma one_always_in:\n  \"1 < n_vars \\<Longrightarrow> 1 \\<in> set (model_to_dimacs_model M ([1..<n_vars])) \\<or> - 1 \\<in> set (model_to_dimacs_model M ([1..<n_vars]))\"\n  by (induction n_vars) (auto simp add: less_Suc_eq model_to_dimacs_model_append)\n\n\n\nlemma [simp]: \"(atoms (f1 \\<^bold>\\<or> f2)) = atoms f1 \\<union> atoms f2\"\n  by auto\n\nlemma isdisj_disjD: \"(is_disj (f1 \\<^bold>\\<or> f2)) \\<Longrightarrow> is_disj f1 \\<and> is_disj f2\"\n  by (cases f1; auto)\n\nlemma disj_to_dimacs_sound:\n   \"1 < n_vars \\<Longrightarrow> (\\<forall>v\\<in>atoms f. 0 < v \\<and> v < n_vars) \\<Longrightarrow> is_disj f \\<Longrightarrow> M \\<Turnstile> f\n     \\<Longrightarrow> \\<exists>l\\<in>set (model_to_dimacs_model M [(1::nat)..<n_vars]). l \\<in> set (disj_to_dimacs f)\"\n  apply(induction f)\n  using neg_in_model pos_in_model one_always_in\n  by (fastforce elim!: is_lit_plus.elims dest!: isdisj_disjD)+\n\nlemma is_cnf_disj: \"is_cnf (f1 \\<^bold>\\<or> f2) \\<Longrightarrow> (\\<And>f. f1 \\<^bold>\\<or> f2 = f \\<Longrightarrow> is_disj f \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by auto\n\nlemma cnf_to_dimacs_disj: \"is_disj f \\<Longrightarrow> cnf_to_dimacs f = [disj_to_dimacs f]\"\n  by (induction f) auto\n\nlemma model_to_dimacs_model_all_clauses:\n  \"1 < n_vars \\<Longrightarrow> (\\<forall>v\\<in>atoms f. 0 < v \\<and> v < n_vars) \\<Longrightarrow> is_cnf f \\<Longrightarrow> M \\<Turnstile> f \\<Longrightarrow>\n        c\\<in>set (cnf_to_dimacs f) \\<Longrightarrow> \\<exists>l\\<in>set (model_to_dimacs_model M [(1::nat)..<n_vars]). l \\<in> set c\"\nproof(induction f arbitrary: )\n  case (Not f)\n  then show ?case\n    using in_model neg_in_model\n    by (fastforce elim!: is_lit_plus.elims)+\nnext\n  case (Or f1 f2)\n  then show ?case\n    using cnf_to_dimacs_disj disj_to_dimacs_sound\n    by(elim is_cnf_disj, simp)\nqed (insert in_model neg_in_model pos_in_model, auto)\n\nlemma upt_eq_Cons_conv:\n  \"(x#xs = [i..<j]) = (i < j \\<and> i = x \\<and> [i+1..<j] = xs)\"\n  using upt_eq_Cons_conv\n  by metis\n\nlemma model_to_dimacs_model_append':\n \"(model_to_dimacs_model M (vs @ vs')) = (model_to_dimacs_model M vs) @ (model_to_dimacs_model M vs')\"\n  by (induction vs) auto\n\nlemma model_to_dimacs_neg_nin:\n \"n_vars \\<le> x \\<Longrightarrow> int x \\<notin> set (model_to_dimacs_model M [a..<n_vars])\"\n  by (induction n_vars arbitrary: a) (auto simp: model_to_dimacs_model_append')\n\nlemma model_to_dimacs_pos_nin:\n \"n_vars \\<le> x \\<Longrightarrow> - int x \\<notin> set (model_to_dimacs_model M [a..<n_vars])\"\n  by (induction n_vars arbitrary: a) (auto simp: model_to_dimacs_model_append')\n\nlemma int_cases2':\n  \"z \\<noteq> 0 \\<Longrightarrow> (\\<And>n. 0 \\<noteq> (int n) \\<Longrightarrow> z = int n \\<Longrightarrow> P) \\<Longrightarrow> (\\<And>n. 0 \\<noteq> - (int n) \\<Longrightarrow> z = - (int n) \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (metis (full_types) int_cases2)\n\nlemma model_to_dimacs_model_distinct:\n  \"1 < n_vars \\<Longrightarrow> distinct (map dimacs_lit_to_var (model_to_dimacs_model M [1..<n_vars]))\"\n  by (induction n_vars)\n     (fastforce elim!: int_cases2'\n                simp add: dimacs_lit_to_var_def model_to_dimacs_model_append'\n                          model_to_dimacs_neg_nin model_to_dimacs_pos_nin)+\n\nlemma model_to_dimacs_model_sound:\n  \"1 < n_vars \\<Longrightarrow> (\\<forall>v\\<in>atoms f. 0 < v \\<and> v < n_vars) \\<Longrightarrow> is_cnf f \\<Longrightarrow> M \\<Turnstile> f \\<Longrightarrow>\n        dimacs_model (model_to_dimacs_model M [(1::nat)..<n_vars]) (cnf_to_dimacs f)\"\n  unfolding dimacs_model_def\n  using model_to_dimacs_model_all_vars model_to_dimacs_model_all_clauses model_to_dimacs_model_distinct\n  by auto  \n\nlemma model_to_dimacs_model_sound_exists:\n  \"1 < n_vars \\<Longrightarrow> (\\<forall>v\\<in>atoms f. 0 < v \\<and> v < n_vars) \\<Longrightarrow> is_cnf f \\<Longrightarrow> M \\<Turnstile> f \\<Longrightarrow>\n        \\<exists>M_dimacs. dimacs_model M_dimacs (cnf_to_dimacs f)\"\n  using model_to_dimacs_model_sound\n  by metis\n\ndefinition dimacs_to_atom ::\"int \\<Rightarrow> nat formula\" where\n  \"dimacs_to_atom l \\<equiv> if (l < 0) then Not (Atom (nat (abs l))) else Atom (nat (abs l))\"\n\ndefinition dimacs_to_disj::\"int list \\<Rightarrow> nat formula\" where\n  \"dimacs_to_disj f \\<equiv> \\<^bold>\\<Or> (map dimacs_to_atom f)\"\n\ndefinition dimacs_to_cnf::\"int list list \\<Rightarrow> nat formula\" where\n  \"dimacs_to_cnf f \\<equiv> \\<^bold>\\<And>map dimacs_to_disj f\"\n\ndefinition \"dimacs_model_to_abs dimacs_M M \\<equiv> \n  fold (\\<lambda>l M. if (l > 0) then M((nat (abs l)):= True) else M((nat (abs l)):= False)) dimacs_M M\"\n\nlemma dimacs_model_to_abs_atom:\n  \"0 < x \\<Longrightarrow> int x \\<in> set dimacs_M \\<Longrightarrow> distinct (map dimacs_lit_to_var  dimacs_M) \\<Longrightarrow> dimacs_model_to_abs dimacs_M M x\"\nproof (induction dimacs_M arbitrary: M rule: rev_induct)\n  case (snoc a dimacs_M)\n  thus ?case \n    by (auto simp add: dimacs_model_to_abs_def dimacs_lit_to_var_def image_def)\nqed auto\n\nlemma dimacs_model_to_abs_atom':\n  \"0 < x \\<Longrightarrow> -(int x) \\<in> set dimacs_M \\<Longrightarrow> distinct (map dimacs_lit_to_var  dimacs_M) \\<Longrightarrow> \\<not> dimacs_model_to_abs dimacs_M M x\"\nproof (induction dimacs_M arbitrary: M rule: rev_induct)\n  case (snoc a dimacs_M)\n  thus ?case \n    by (auto simp add: dimacs_model_to_abs_def dimacs_lit_to_var_def image_def)\nqed auto\n\nlemma model_to_dimacs_model_complete_disj:\n  \"(\\<forall>v\\<in>atoms f. 0 < v \\<and> v < n_vars) \\<Longrightarrow> is_disj f \\<Longrightarrow> distinct (map dimacs_lit_to_var dimacs_M)\n     \\<Longrightarrow> dimacs_model dimacs_M (cnf_to_dimacs f) \\<Longrightarrow> dimacs_model_to_abs dimacs_M (\\<lambda>_. False) \\<Turnstile> f\"\n  by (induction f)\n     (fastforce elim!: is_lit_plus.elims dest!: isdisj_disjD\n                simp: cnf_to_dimacs_disj dimacs_model_def dimacs_model_to_abs_atom'\n                      dimacs_model_to_abs_atom)+\n\nlemma model_to_dimacs_model_complete:\n  \"(\\<forall>v\\<in>atoms f. 0 < v \\<and> v < n_vars) \\<Longrightarrow> is_cnf f \\<Longrightarrow> distinct (map dimacs_lit_to_var dimacs_M)\n     \\<Longrightarrow> dimacs_model dimacs_M (cnf_to_dimacs f) \\<Longrightarrow> dimacs_model_to_abs dimacs_M (\\<lambda>_. False) \\<Turnstile> f\"\nproof(induction f)\n  case (Not f)\n  then show ?case\n    by (auto elim!: is_lit_plus.elims simp add: dimacs_model_to_abs_atom' dimacs_model_def)\nnext\n  case (Or f1 f2)\n  then show ?case\n    using cnf_to_dimacs_disj model_to_dimacs_model_complete_disj\n    by(elim is_cnf_disj, simp add: dimacs_model_def)\nqed (insert dimacs_model_to_abs_atom, auto simp: dimacs_model_def)\n\nlemma model_to_dimacs_model_complete_max_var:\n  \"(\\<forall>v\\<in>atoms f. 0 < v) \\<Longrightarrow> is_cnf f \\<Longrightarrow> \n   dimacs_model dimacs_M (cnf_to_dimacs f) \\<Longrightarrow>\n     dimacs_model_to_abs dimacs_M (\\<lambda>_. False) \\<Turnstile> f\"\n  using le_imp_less_Suc[OF max_var]\n  by (auto intro!: model_to_dimacs_model_complete simp: dimacs_model_def)\n\nlemma model_to_dimacs_model_sound_max_var:\n  \"(\\<forall>v\\<in>atoms f. 0 < v) \\<Longrightarrow> is_cnf f \\<Longrightarrow> M \\<Turnstile> f \\<Longrightarrow>\n     dimacs_model (model_to_dimacs_model M [(1::nat)..<(find_max (formula_vars f) + 2)])\n                  (cnf_to_dimacs f)\"\n  using le_imp_less_Suc[unfolded Suc_eq_plus1, OF max_var]\n  by (fastforce intro!: model_to_dimacs_model_sound)\n\ncontext sat_solve_sasp\nbegin\n\nlemma [simp]: \"var_to_dimacs sv > 0\"\n  by(cases sv) auto\n\nlemma var_to_dimacs_pos: \n  \"v \\<in> atoms (map_formula var_to_dimacs f) \\<Longrightarrow> 0 < v\"\n  by (induction f) auto\n\nlemma map_is_disj: \"is_disj f \\<Longrightarrow> is_disj (map_formula F f)\"\n  by (induction f) (auto elim: is_lit_plus.elims)\n\nlemma map_is_cnf: \"is_cnf f \\<Longrightarrow> is_cnf (map_formula F f)\"\n  by (induction f) (auto elim: is_lit_plus.elims simp: map_is_disj)\n\nlemma planning_dimacs_complete:\n  \"valid_plan \\<pi>s \\<Longrightarrow> length \\<pi>s \\<le> h \\<Longrightarrow>\n   let cnf_formula = (map_formula var_to_dimacs \n                                  (\\<Phi>\\<^sub>\\<forall> (\\<phi> (prob_with_noop abs_prob)) h))\n   in\n       \\<exists>dimacs_M. dimacs_model dimacs_M (cnf_to_dimacs cnf_formula)\"\n  unfolding Let_def\n  by (fastforce simp: var_to_dimacs_pos\n                dest!: planning_by_cnf_dimacs_complete\n                intro: model_to_dimacs_model_sound_max_var map_is_cnf\n                       is_cnf_encode_problem_with_operator_interference_exclusion\n                       is_valid_problem_sas_plus_then_strips_transformation_too\n                       noops_valid abs_prob_valid)\n\nlemma planning_dimacs_sound:\n  \"let cnf_formula =\n     (map_formula var_to_dimacs\n                  (\\<Phi>\\<^sub>\\<forall> (\\<phi> (prob_with_noop abs_prob)) h))\n   in\n     dimacs_model dimacs_M (cnf_to_dimacs cnf_formula) \\<Longrightarrow>\n   valid_plan \n        (decode_abs_plan\n            (rem_noops\n              (map (\\<lambda>op. \\<phi>\\<^sub>O\\<inverse> (prob_with_noop abs_prob) op)\n                   (concat\n                    (\\<Phi>\\<inverse> (\\<phi> (prob_with_noop abs_prob)) ((dimacs_model_to_abs dimacs_M (\\<lambda>_. False)) o var_to_dimacs) h)))))\"\n  by(fastforce simp: var_to_dimacs_pos Let_def\n               intro: planning_by_cnf_dimacs_sound model_to_dimacs_model_complete_max_var\n                      map_is_cnf is_cnf_encode_problem_with_operator_interference_exclusion \n                      is_valid_problem_sas_plus_then_strips_transformation_too abs_prob_valid\n                      noops_valid)\n\nend\n\nsection \\<open>Code Generation\\<close>\n\ntext \\<open>We now generate SML code equivalent to the functions that encode a problem as a CNF formula\n      and that decode the model of the given encodings into a plan.\\<close>\n\n\n\ndefinition \n\"SASP_to_DIMACS h prob \\<equiv>\n   cnf_to_dimacs\n     (map_formula \n       (cnf_to_dimacs.var_to_dimacs (Suc h) (Suc (length (ast_problem.ast\\<delta> prob))))\n         (\\<Phi>\\<^sub>\\<forall> (\\<phi> (prob_with_noop (ast_problem.abs_prob prob))) h))\"\n\nlemma planning_dimacs_complete_code:\n  \"\\<lbrakk>ast_problem.well_formed prob;\n    \\<forall>\\<pi>\\<in>set (ast_problem.ast\\<delta> prob). is_standard_operator' \\<pi>;\n    ast_problem.valid_plan prob \\<pi>s;\n    length \\<pi>s \\<le> h\\<rbrakk> \\<Longrightarrow>\n   let cnf_formula = (SASP_to_DIMACS h prob) in\n       \\<exists>dimacs_M. dimacs_model dimacs_M cnf_formula\"\n  unfolding SASP_to_DIMACS_def Let_def\n  apply(rule sat_solve_sasp.planning_dimacs_complete[unfolded Let_def])\n  apply unfold_locales\n  by auto\n\ndefinition \"SASP_to_DIMACS' h prob \\<equiv> SASP_to_DIMACS h (rem_implicit_pres_ops prob)\"\n\nlemma planning_dimacs_complete_code':\n  \"\\<lbrakk>ast_problem.well_formed prob;\n    (\\<And>op. op \\<in> set (ast_problem.ast\\<delta> prob) \\<Longrightarrow> consistent_pres_op op);\n    (\\<And>op. op \\<in> set (ast_problem.ast\\<delta> prob) \\<Longrightarrow> is_standard_operator op);\n    ast_problem.valid_plan prob \\<pi>s;\n    length \\<pi>s \\<le> h\\<rbrakk> \\<Longrightarrow>\n   let cnf_formula = (SASP_to_DIMACS' h prob) in\n       \\<exists>dimacs_M. dimacs_model dimacs_M cnf_formula\"\n  unfolding Let_def SASP_to_DIMACS'_def\n  by (auto simp add: rem_implicit_pres_ops_valid_plan[symmetric] wf_ast_problem_def\n           simp del: rem_implicit_pres.simps\n           intro!: rem_implicit_pres_is_standard_operator'\n                   planning_dimacs_complete_code[unfolded Let_def]\n                   rem_implicit_pres_ops_well_formed\n           dest!: rem_implicit_pres_ops_in\\<delta>D)\n\ntext \\<open>A function that does the checks required by the completeness theorem above, and returns\n      appropriate error messages if any of the checks fail.\\<close>\n\ndefinition\n  \"encode h prob \\<equiv>\n     if ast_problem.well_formed prob then\n       if (\\<forall>op \\<in> set (ast_problem.ast\\<delta> prob). consistent_pres_op op) then\n         if (\\<forall>op \\<in> set (ast_problem.ast\\<delta> prob). is_standard_operator op) then\n           Inl (SASP_to_DIMACS' h prob)\n         else\n           Inr (STR ''Error: Conditional effects!'')\n       else\n         Inr (STR ''Error: Preconditions inconsistent'')\n     else\n       Inr (STR ''Error: Problem malformed!'')\"\n\nlemma encode_sound:\n  \"\\<lbrakk>ast_problem.valid_plan prob \\<pi>s; length \\<pi>s \\<le> h;\n        encode h prob = Inl cnf_formula\\<rbrakk> \\<Longrightarrow> \n         (\\<exists>dimacs_M. dimacs_model dimacs_M cnf_formula)\"\n  unfolding encode_def\n  by (auto split: if_splits simp: list.pred_set\n           intro: planning_dimacs_complete_code'[unfolded Let_def])\n\nlemma encode_complete:\n  \"encode h prob = Inr err \\<Longrightarrow> \n     \\<not>(ast_problem.well_formed prob \\<and> (\\<forall>op \\<in> set (ast_problem.ast\\<delta> prob). consistent_pres_op op) \\<and>\n     (\\<forall>op \\<in> set (ast_problem.ast\\<delta> prob). is_standard_operator op))\"\n  unfolding encode_def\n  by (auto split: if_splits simp: list.pred_set\n           intro: planning_dimacs_complete_code'[unfolded Let_def])\n\ndefinition match_pre where\n    \"match_pre \\<equiv> \\<lambda>(x,v) s. s x = Some v\"\n    \ndefinition match_pres where \n    \"match_pres pres s \\<equiv> \\<forall>pre\\<in>set pres. match_pre pre s\"\n\nlemma match_pres_distinct: \n  \"distinct (map fst pres) \\<Longrightarrow> match_pres pres s \\<longleftrightarrow> Map.map_of pres \\<subseteq>\\<^sub>m s\"\n  unfolding match_pres_def match_pre_def \n  using map_le_def map_of_SomeD\n  apply (auto split: prod.splits)\n   apply fastforce\n  using domI map_of_is_SomeI\n  by smt\n\nfun tree_map_of where\n  \"tree_map_of updatea T [] = T\"\n| \"tree_map_of updatea T ((v,a)#m) = updatea v a (tree_map_of updatea T m)\"\n\ncontext Map\nbegin\n\nabbreviation \"tree_map_of' \\<equiv> tree_map_of update\"\n\nlemma tree_map_of_invar: \"invar T \\<Longrightarrow> invar (tree_map_of' T pres)\"\n  by (induction pres) (auto simp add: invar_update)\n\nlemma tree_map_of_works: \"lookup (tree_map_of' empty pres) x = map_of pres x\"\n  by (induction pres) (auto simp: map_empty map_update[OF tree_map_of_invar[OF invar_empty]])\n\nlemma tree_map_of_dom: \"dom (lookup (tree_map_of' empty pres)) = dom (map_of pres)\"\n  by (induction pres) (auto simp: map_empty map_update[OF tree_map_of_invar[OF invar_empty]] tree_map_of_works)\nend\n\nlemma distinct_if_sorted: \"sorted xs \\<Longrightarrow> distinct xs\"\n  by (induction xs rule: induct_list012) auto\n\ncontext Map_by_Ordered\nbegin\n\nlemma tree_map_of_distinct: \"distinct (map fst (inorder (tree_map_of' empty pres)))\"\n  apply(induction pres) \n   apply(clarsimp simp: map_empty inorder_empty)\n  using distinct_if_sorted invar_def invar_empty invar_update tree_map_of_invar\n  by blast\n\nend\n\nlemma set_tree_intorder: \"set_tree t = set (inorder t)\"\n  by (induction t) auto\n\nlemma map_of_eq:\n  \"map_of xs = Map.map_of xs\"\n  by (induction xs) (auto simp: map_of_simps split: option.split)\n\nlemma lookup_someD: \"lookup T x = Some y \\<Longrightarrow> \\<exists>p. p \\<in> set (inorder T) \\<and> p = (x, y)\"\n  by (induction T) (auto split: if_splits)\n\nlemma map_of_lookup: \"sorted1 (inorder T) \\<Longrightarrow> Map.map_of (inorder T) = lookup T\"\n  apply(induction T)\n   apply (auto split: prod.splits intro!: map_le_antisym\n      simp: lookup_map_of map_add_Some_iff map_of_None2 sorted_wrt_append)\n  using lookup_someD\n  by (force simp: map_of_eq map_add_def map_le_def\n            split: option.splits)+\n\nlemma map_le_cong: \"(\\<And>x. m1 x = m2 x) \\<Longrightarrow> m1 \\<subseteq>\\<^sub>m s \\<longleftrightarrow> m2 \\<subseteq>\\<^sub>m s\"\n  by presburger\n\nlemma match_pres_submap:\n  \"match_pres (inorder (M.tree_map_of' empty pres)) s \\<longleftrightarrow> Map.map_of pres \\<subseteq>\\<^sub>m s\"\n  using match_pres_distinct[OF M.tree_map_of_distinct]\n  by (smt M.invar_def M.invar_empty M.tree_map_of_invar M.tree_map_of_works map_le_cong map_of_eq map_of_lookup)  \n\nlemma [code]:\n  \"SAS_Plus_Representation.is_operator_applicable_in s op \\<longleftrightarrow> \n      match_pres (inorder (M.tree_map_of' empty (SAS_Plus_Representation.precondition_of op))) s\"\n  by (simp add: match_pres_submap SAS_Plus_Representation.is_operator_applicable_in_def)\n\ndefinition \"decode_DIMACS_model dimacs_M h prob \\<equiv> \n  (ast_problem.decode_abs_plan prob\n      (rem_noops\n         (map (\\<lambda>op. \\<phi>\\<^sub>O\\<inverse> (prob_with_noop (ast_problem.abs_prob prob)) op)\n           (concat \n              (\\<Phi>\\<inverse> (\\<phi> (prob_with_noop (ast_problem.abs_prob prob)))\n                   ((dimacs_model_to_abs dimacs_M (\\<lambda>_. False)) o\n                     (cnf_to_dimacs.var_to_dimacs (Suc h)\n                        (Suc (length (ast_problem.ast\\<delta> prob)))))\n                   h)))))\"\n\nlemma planning_dimacs_sound_code:\n  \"\\<lbrakk>ast_problem.well_formed prob;\n    \\<forall>\\<pi>\\<in>set (ast_problem.ast\\<delta> prob). is_standard_operator' \\<pi>\\<rbrakk> \\<Longrightarrow>\n    let\n      cnf_formula = (SASP_to_DIMACS h prob);\n      decoded_plan = decode_DIMACS_model dimacs_M h prob\n    in\n     (dimacs_model dimacs_M cnf_formula \\<longrightarrow> ast_problem.valid_plan prob decoded_plan)\"\n  unfolding SASP_to_DIMACS_def decode_DIMACS_model_def Let_def\n  apply(rule impI sat_solve_sasp.planning_dimacs_sound[unfolded Let_def])+\n  apply unfold_locales\n  by auto\n\ndefinition\n  \"decode_DIMACS_model' dimacs_M h prob \\<equiv> \n     decode_DIMACS_model dimacs_M h (rem_implicit_pres_ops prob)\"\n\nlemma planning_dimacs_sound_code':\n  \"\\<lbrakk>ast_problem.well_formed prob;\n   (\\<And>op. op \\<in> set (ast_problem.ast\\<delta> prob) \\<Longrightarrow> consistent_pres_op op);\n    \\<forall>\\<pi>\\<in>set (ast_problem.ast\\<delta> prob). is_standard_operator \\<pi>\\<rbrakk> \\<Longrightarrow>\n    let\n      cnf_formula = (SASP_to_DIMACS' h prob);\n      decoded_plan = decode_DIMACS_model' dimacs_M h prob\n    in\n     (dimacs_model dimacs_M cnf_formula \\<longrightarrow> ast_problem.valid_plan prob decoded_plan)\"\n  unfolding SASP_to_DIMACS'_def decode_DIMACS_model'_def\n  apply(subst rem_implicit_pres_ops_valid_plan[symmetric])\n  by(fastforce simp only: rem_implicit_pres_ops_valid_plan wf_ast_problem_def\n           intro!: rem_implicit_pres_is_standard_operator'\n                   rem_implicit_pres_ops_well_formed\n                   rev_iffD2[OF _ rem_implicit_pres_ops_valid_plan]\n                   planning_dimacs_sound_code wf_ast_problem.intro\n           dest!: rem_implicit_pres_ops_in\\<delta>D)+\n\ntext \\<open>Checking if the model satisfies the formula takes the longest time in the decoding function.\n      We reimplement that part using red black trees, which makes it 10 times faster, on average!\\<close>\n\nfun list_to_rbt :: \"int list \\<Rightarrow> int rbt\" where\n  \"list_to_rbt [] = Leaf\"\n| \"list_to_rbt (x#xs) = insert_rbt x (list_to_rbt xs)\"\n\nlemma inv_list_to_rbt: \"invc (list_to_rbt xs) \\<and> invh (list_to_rbt xs)\"\n  by (induction xs) (auto simp: rbt_def RBT.inv_insert)\n\nlemma Tree2_list_to_rbt: \"Tree2.bst (list_to_rbt xs)\"\n  by (induction xs) (auto simp: RBT.bst_insert)\n\nlemma set_list_to_rbt: \"Tree2.set_tree (list_to_rbt xs) = set xs\"\n  by (induction xs) (simp add: RBT.set_tree_insert Tree2_list_to_rbt)+\n\ntext \\<open>The following \\<close>\n\nlemma dimacs_model_code[code]:\n  \"dimacs_model ls cs \\<longleftrightarrow> \n        (let tls = list_to_rbt ls in\n          (\\<forall>c\\<in>set cs. size (inter_rbt (tls) (list_to_rbt c)) \\<noteq> 0) \\<and>\n               distinct (map dimacs_lit_to_var ls))\"\n  using RBT.set_tree_inter[OF Tree2_list_to_rbt Tree2_list_to_rbt]\n  apply (auto simp: dimacs_model_def Let_def set_list_to_rbt inter_rbt_def)\n  apply (metis IntI RBT.set_empty empty_iff)\n  by (metis Tree2.eq_set_tree_empty disjoint_iff_not_equal)\n\ndefinition\n  \"decode M h prob \\<equiv>\n     if ast_problem.well_formed prob then\n       if (\\<forall>op\\<in>set (ast_problem.ast\\<delta> prob). consistent_pres_op op) then\n         if (\\<forall>op\\<in>set (ast_problem.ast\\<delta> prob). is_standard_operator op) then\n           if (dimacs_model M (SASP_to_DIMACS' h prob)) then\n             Inl (decode_DIMACS_model' M h prob)\n           else Inr (STR ''Error: Model does not solve the problem!'')\n         else\n           Inr (STR ''Error: Conditional effects!'')\n       else\n         Inr (STR ''Error: Preconditions inconsistent'')\n     else\n       Inr (STR ''Error: Problem malformed!'')\"\n\nlemma decode_sound:\n  \"decode M h prob = Inl plan \\<Longrightarrow> \n         ast_problem.valid_plan prob plan\"\n  unfolding decode_def\n  apply (auto split: if_splits simp: list.pred_set)\n  using planning_dimacs_sound_code'\n  by auto\n\nlemma decode_complete:\n  \"decode M h prob = Inr err \\<Longrightarrow>\n         \\<not> (ast_problem.well_formed prob \\<and> \n            (\\<forall>op \\<in> set (ast_problem.ast\\<delta> prob). consistent_pres_op op) \\<and>\n            (\\<forall>\\<pi>\\<in>set (ast_problem.ast\\<delta> prob). is_standard_operator \\<pi>) \\<and> \n            dimacs_model M (SASP_to_DIMACS' h prob))\"\n  unfolding decode_def\n  by (auto split: if_splits simp: list.pred_set)\n\nlemma [code]:\n  \"ListMem x' []= False\"\n  \"ListMem x' (x#xs) = (x' = x \\<or> ListMem x' xs)\"\n  by (simp add: ListMem_iff)+\n\nlemmas [code] = SASP_to_DIMACS_def ast_problem.abs_prob_def\n                ast_problem.abs_ast_variable_section_def ast_problem.abs_ast_operator_section_def\n                ast_problem.abs_ast_initial_state_def ast_problem.abs_range_map_def\n                ast_problem.abs_ast_goal_def cnf_to_dimacs.var_to_dimacs.simps\n                ast_problem.ast\\<delta>_def ast_problem.astDom_def ast_problem.abs_ast_operator_def\n                ast_problem.astI_def ast_problem.astG_def ast_problem.lookup_action_def\n                ast_problem.I_def execute_operator_sas_plus_def ast_problem.decode_abs_plan_def\n\ndefinition nat_opt_of_integer :: \"integer \\<Rightarrow> nat option\" where\n       \"nat_opt_of_integer i = (if (i \\<ge> 0) then Some (nat_of_integer i) else None)\"\n\ndefinition max_var :: \"int list \\<Rightarrow> int\" where\n       \"max_var xs \\<equiv> fold (\\<lambda>(x::int) (y::int). if abs x \\<ge> abs y then (abs x) else y) xs (0::int)\"\n\nexport_code encode nat_of_integer integer_of_nat nat_opt_of_integer Inl Inr String.explode\n    String.implode max_var concat char_of_nat Int.nat integer_of_int length int_of_integer\n  in SML module_name exported file_prefix SASP_to_DIMACS\n\nexport_code decode nat_of_integer integer_of_nat nat_opt_of_integer Inl Inr String.explode\n    String.implode max_var concat char_of_nat Int.nat integer_of_int length int_of_integer\n  in SML module_name exported file_prefix decode_DIMACS_model\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Verified_SAT_Based_AI_Planning/Solve_SASP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6654105454764747, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.3093504082004367}}
{"text": "theory Proof_4_589\n  imports Proofs4\nbegin\n\nthm VC589_def\n\nabbreviation s where \" s s0 PdOut'value paid'value opened'value \\<equiv>\n (toEnv\n   (setPstate\n     (setPstate\n       (setVarBool\n         (setVarBool\n           (setPstate\n             (setVarBool\n               (setVarBool (setVarBool (setVarBool s0 PdOut' PdOut'value) paid' paid'value) opened'\n                 opened'value)\n               Controller'minimalOpened' False)\n             Init'init' Controller'isClosed')\n           EntranceController'isClosed' False)\n         Controller'isOpened' True)\n       Controller'minimalOpened' Unlocker'unlock')\n     Controller'isClosed' EntranceController'isClosed'))\"\n\ntheorem proof_4_589: \"VC589 inv4 env s0 PdOut_value paid_value opened_value\"\n  apply(simp only: VC589_def inv4_def R4_def extraInv_def)\n  apply(rule impI)\n  apply(rule conjI)\n   apply(rule conjI)\n    apply simp\n   apply(drule conjE)\n    prefer 2\n    apply assumption\n   apply(drule conjE)\n    prefer 2\n    apply assumption\n   apply((rule allI)+)\n  subgoal premises vc_prems for s1 s2\n    using vc_prems(2) apply -\n    apply(drule conjE)\n     prefer 2\n     apply assumption\n    subgoal premises invs0\n      apply(rule impI)\n      apply(rule disjE[of \"100 < toEnvNum s2 (s s0 PdOut_value paid_value opened_value)\" \n\"100 = toEnvNum s2 (s s0 PdOut_value paid_value opened_value)\"])\n      using le_imp_less_or_eq apply blast\n      apply(rule cut_rl[of \"\\<exists>s4. toEnvP s4 \\<and>\n         substate s2 s4 \\<and>\n         substate s4 s0 \\<and>\n         toEnvNum s2 s4 \\<le> 100 \\<and>\n         \\<not> getVarBool s4 Controller'minimalOpened' \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow> getVarBool s3 Controller'minimalOpened')\"])\n        apply(drule exE)\n         prefer 2\n         apply assumption\n      subgoal for s4\n        apply(rule exI[of _ s4])\n        by simp\n      subgoal premises req_prems\n        using invs0(1) req_prems apply -\n        apply(drule conjE)\n         prefer 2\n         apply assumption\n        apply(drule allE[of _ s1])\n        prefer 2\n         apply assumption\n        apply(drule allE[of _ s2])\n        prefer 2\n         apply assumption\n        by(simp split: if_splits)\n      apply(rule cut_rl[of \"\\<forall> s5. toEnvP s5 \\<and> substate s2 s5 \\<and> substate s5 (s s0 PdOut_value paid_value opened_value) \\<longrightarrow>\npred4 s1 s2 (s s0 PdOut_value paid_value opened_value) s5\"])\n       apply(drule allE[of _ s2])\n      prefer 2\n        apply assumption\n       apply(drule impE)\n      prefer 3\n      apply assumption\n      using substate_refl apply blast\n       apply(simp only: pred4_def)\n       apply(drule impE)\n      prefer 3\n      apply assumption\n      using substate_refl substate_trans substate_antisym apply blast\n       apply assumption\n      apply(rule allI)\n      subgoal premises prems for s5\n        apply(induction rule: state_ind)\n        using prems(1) apply simp\n         apply(simp only: pred4_def)\n         apply(rule impI)\n\n         apply(rule exI[of _  \"s s0 PdOut_value paid_value opened_value\"])\n         apply(((rule conjI),simp)+)\n        using substate_trans substate_antisym apply blast\n\n        subgoal for s5\n          apply(simp only: pred4_def)\n          apply(rule impI)\n          apply(cases \"getVarBool (predEnv s5) open' = False\")\n           apply(rule exI[of _ \"predEnv s5\"])\n           apply(rule conjI)\n        apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n            apply blast\n       apply(rule conjI)\n          using substate_refl apply simp\n       apply(rule conjI)\n      using predEnv_substate substate_trans apply blast\n       apply(rule conjI)\n      using toEnvNum3[of s2 \"predEnv s5\"\n \"(s s0 PdOut_value paid_value opened_value) \"] \n        apply force\n       apply(rule conjI)\n        apply blast\n      using substate_antisym apply blast\n      apply(drule impE)\n        prefer 3\n        apply assumption\n       apply(((rule conjI),blast)+)\n      using substate_imp_substatete_predEnv_or_eq apply blast\n      apply(drule exE)\n       prefer 2\n       apply assumption\n      subgoal for s4\n        apply(rule exI[of _ s4])\n       apply(rule conjI)\n         apply blast\n        apply(rule conjI)\n        using predEnv_substate substate_trans apply blast\n        apply(((rule conjI),blast)+)\n        using predEnv_substate_imp_substate_or_eq by blast\n      done\n    done\n  done\n  done\n", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/turnstile/Proof_4_589.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.63341027751814, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.3092837209218343}}
{"text": "(*  Title:      HOL/Auth/n_deadlock_lemma_inv__3_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_deadlock Protocol Case Study*}*) \n\ntheory n_deadlock_lemma_inv__3_on_rules imports n_deadlock_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__3  p__Inv3 p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_TryVsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_CritVsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_ExitVsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_IdleVsinv__3) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_deadlock/n_deadlock_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.712232184238947, "lm_q2_score": 0.4339814648038985, "lm_q1q2_score": 0.3090955665964983}}
{"text": "(*  File:       Maximum_Parallel_Composition.thy\n    Copyright   2021  Karlsruhe Institute of Technology (KIT)\n*)\n\\<^marker>\\<open>creator \"Karsten Diekhoff, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\\<^marker>\\<open>contributor \"Jonas Kraemer, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\\<^marker>\\<open>contributor \"Michael Kirsten, Karlsruhe Institute of Technology (KIT)\"\\<close>\n\nsection \\<open>Maximum Parallel Composition\\<close>\n\ntheory Maximum_Parallel_Composition\n  imports \"Basic_Modules/Component_Types/Maximum_Aggregator\"\n          Parallel_Composition\nbegin\n\ntext \\<open>\n  This is a family of parallel compositions. It composes a new electoral module\n  from two electoral modules combined with the maximum aggregator. Therein, the\n  two modules each make a decision and then a partition is returned where every\n  alternative receives the maximum result of the two input partitions. This\n  means that, if any alternative is elected by at least one of the modules,\n  then it gets elected, if any non-elected alternative is deferred by at least\n  one of the modules, then it gets deferred, only alternatives rejected by both\n  modules get rejected.\n\\<close>\n\nsubsection \\<open>Definition\\<close>\n\nfun maximum_parallel_composition :: \"'a Electoral_Module \\<Rightarrow>\n        'a Electoral_Module \\<Rightarrow> 'a Electoral_Module\" where\n  \"maximum_parallel_composition m n =\n    (let a = max_aggregator in (m \\<parallel>\\<^sub>a n))\"\n\nabbreviation max_parallel :: \"'a Electoral_Module \\<Rightarrow> 'a Electoral_Module \\<Rightarrow>\n        'a Electoral_Module\" (infix \"\\<parallel>\\<^sub>\\<up>\" 50) where\n  \"m \\<parallel>\\<^sub>\\<up> n == maximum_parallel_composition m n\"\n\nsubsection \\<open>Soundness\\<close>\n\ntheorem max_par_comp_sound:\n  assumes\n    mod_m: \"electoral_module m\" and\n    mod_n: \"electoral_module n\"\n  shows \"electoral_module (m \\<parallel>\\<^sub>\\<up> n)\"\n  using mod_m mod_n\n  by simp\n\nsubsection \\<open>Lemmata\\<close>\n\nlemma max_agg_eq_result:\n  assumes\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    f_prof: \"finite_profile A p\" and\n    in_A: \"x \\<in> A\"\n  shows\n    \"mod_contains_result (m \\<parallel>\\<^sub>\\<up> n) m A p x \\<or>\n      mod_contains_result (m \\<parallel>\\<^sub>\\<up> n) n A p x\"\nproof (cases)\n  assume a1: \"x \\<in> elect (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    have mod_contains_inst:\n      \"\\<forall> p_mod q_mod a_set prof a.\n        mod_contains_result p_mod q_mod a_set prof (a::'a) =\n          (electoral_module p_mod \\<and> electoral_module q_mod \\<and>\n            finite a_set \\<and> profile a_set prof \\<and> a \\<in> a_set \\<and>\n            (a \\<notin> elect p_mod a_set prof \\<or> a \\<in> elect q_mod a_set prof) \\<and>\n            (a \\<notin> reject p_mod a_set prof \\<or> a \\<in> reject q_mod a_set prof) \\<and>\n            (a \\<notin> defer p_mod a_set prof \\<or> a \\<in> defer q_mod a_set prof))\"\n      unfolding mod_contains_result_def\n      by simp\n    have module_mn: \"electoral_module (m \\<parallel>\\<^sub>\\<up> n)\"\n      using module_m module_n\n      by simp\n  have not_defer_mn: \"x \\<notin> defer (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    using module_mn IntI a1 empty_iff f_prof result_disj\n    by (metis (no_types))\n  have not_reject_mn: \"x \\<notin> reject (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    using module_mn IntI a1 empty_iff f_prof result_disj\n    by (metis (no_types))\n  from a1 have\n    \"let (e1, r1, d1) = m A p;\n        (e2, r2, d2) = n A p in\n      x \\<in> e1 \\<union> e2\"\n    by auto\n  hence union_mn: \"x \\<in> (elect m A p) \\<union> (elect n A p)\"\n    by auto\n  thus ?thesis\n    using f_prof in_A module_m module_mn module_n\n          not_defer_mn not_reject_mn union_mn\n          mod_contains_inst\n      by blast\nnext\n  assume not_a1: \"x \\<notin> elect (m \\<parallel>\\<^sub>\\<up> n) A p\"\n  thus ?thesis\n  proof (cases)\n    assume x_in_def: \"x \\<in> defer (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    thus ?thesis\n    proof (safe)\n      assume not_mod_cont_mn:\n        \"\\<not> mod_contains_result (m \\<parallel>\\<^sub>\\<up> n) n A p x\"\n      have par_emod:\n        \"\\<forall> f g.\n          (electoral_module (f::'a set \\<Rightarrow> 'a Profile \\<Rightarrow> 'a Result) \\<and>\n            electoral_module g) \\<longrightarrow>\n              electoral_module (f \\<parallel>\\<^sub>\\<up> g)\"\n        using max_par_comp_sound\n        by blast\n      hence \"electoral_module (m \\<parallel>\\<^sub>\\<up> n)\"\n        using module_m module_n\n        by blast\n      hence max_par_emod:\n        \"electoral_module (m \\<parallel>\\<^sub>max_aggregator n)\"\n        by simp\n      have set_intersect:\n        \"\\<forall>(a::'a) A B. (a \\<in> A \\<inter> B) = (a \\<in> A \\<and> a \\<in> B)\"\n        by blast\n      obtain\n        s_func :: \"('a set \\<Rightarrow> 'a Profile \\<Rightarrow> 'a Result) \\<Rightarrow> 'a set\" and\n        p_func :: \"('a set \\<Rightarrow> 'a Profile \\<Rightarrow> 'a Result) \\<Rightarrow> 'a Profile\" where\n        well_f:\n        \"\\<forall> f.\n          (\\<not> electoral_module f \\<or>\n            (\\<forall> A prof. (finite A \\<and> profile A prof) \\<longrightarrow> well_formed A (f A prof))) \\<and>\n          (electoral_module f \\<or> finite (s_func f) \\<and> profile (s_func f) (p_func f) \\<and>\n            \\<not> well_formed (s_func f) (f (s_func f) (p_func f)))\"\n        unfolding electoral_module_def\n        by moura\n      hence wf_n: \"well_formed A (n A p)\"\n        using f_prof module_n\n        by blast\n      have wf_m: \"well_formed A (m A p)\"\n        using well_f f_prof module_m\n        by blast\n      have a_exists: \"\\<forall>(a::'a). a \\<notin> {}\"\n        by blast\n      have e_mod_par: \"electoral_module (m \\<parallel>\\<^sub>\\<up> n)\"\n        using par_emod module_m module_n\n        by blast\n      hence \"electoral_module (m \\<parallel>\\<^sub>max_aggregator n)\"\n        by simp\n      hence result_disj_max:\n        \"elect (m \\<parallel>\\<^sub>max_aggregator n) A p \\<inter> reject (m \\<parallel>\\<^sub>max_aggregator n) A p = {} \\<and>\n          elect (m \\<parallel>\\<^sub>max_aggregator n) A p \\<inter> defer (m \\<parallel>\\<^sub>max_aggregator n) A p = {} \\<and>\n          reject (m \\<parallel>\\<^sub>max_aggregator n) A p \\<inter> defer (m \\<parallel>\\<^sub>max_aggregator n) A p = {}\"\n        using f_prof result_disj\n        by metis\n      have x_not_elect:\n        \"x \\<notin> elect (m \\<parallel>\\<^sub>max_aggregator n) A p\"\n        using result_disj_max x_in_def\n        by force\n      have result_m:\n        \"(elect m A p, reject m A p, defer m A p) = m A p\"\n        by auto\n      have result_n:\n        \"(elect n A p, reject n A p, defer n A p) = n A p\"\n        by auto\n      have max_pq:\n        \"\\<forall>(A::'a set) p q.\n          elect_r (max_aggregator A p q) = elect_r p \\<union> elect_r q\"\n        by force\n      have\n        \"x \\<notin> elect (m \\<parallel>\\<^sub>max_aggregator n) A p\"\n        using x_not_elect\n        by blast\n      with max_pq\n      have \"x \\<notin> elect m A p \\<union> elect n A p\"\n        by (simp add: max_pq)\n      hence x_not_elect_mn:\n        \"x \\<notin> elect m A p \\<and> x \\<notin> elect n A p\"\n        by blast\n      have x_not_mpar_rej:\n        \"x \\<notin> reject (m \\<parallel>\\<^sub>max_aggregator n) A p\"\n        using result_disj_max x_in_def\n        by fastforce\n      hence x_not_par_rej:\n        \"x \\<notin> reject (m \\<parallel>\\<^sub>\\<up> n) A p\"\n        by auto\n      have mod_cont_res_fg:\n        \"\\<forall> f g A prof (a::'a).\n          mod_contains_result f g A prof a =\n            (electoral_module f \\<and> electoral_module g \\<and>\n              finite A \\<and> profile A prof \\<and> a \\<in> A \\<and>\n                (a \\<notin> elect f A prof \\<or> a \\<in> elect g A prof) \\<and>\n                (a \\<notin> reject f A prof \\<or> a \\<in> reject g A prof) \\<and>\n                (a \\<notin> defer f A prof \\<or> a \\<in> defer g A prof))\"\n        by (simp add: mod_contains_result_def)\n      have max_agg_res:\n        \"max_aggregator A (elect m A p, reject m A p, defer m A p)\n          (elect n A p, reject n A p, defer n A p) = (m \\<parallel>\\<^sub>max_aggregator n) A p\"\n        by simp\n      have well_f_max:\n        \"\\<forall> r2 r1 e2 e1 d2 d1 A.\n          well_formed A (e1, r1, d1) \\<and> well_formed A (e2, r2, d2) \\<longrightarrow>\n            reject_r (max_aggregator A (e1, r1, d1) (e2, r2, d2)) = r1 \\<inter> r2\"\n        using max_agg_rej_set\n        by metis\n      have e_mod_disj:\n        \"\\<forall> f (A::'a set) prof.\n          (electoral_module f \\<and> finite (A::'a set) \\<and> profile A prof) \\<longrightarrow>\n            elect f A prof \\<union> reject f A prof \\<union> defer f A prof = A\"\n        using result_presv_alts\n        by blast\n      hence e_mod_disj_n:\n        \"elect n A p \\<union> reject n A p \\<union> defer n A p = A\"\n        using f_prof module_n\n        by metis\n      have\n        \"\\<forall> f g A prof (a::'a).\n          mod_contains_result f g A prof a =\n            (electoral_module f \\<and> electoral_module g \\<and>\n              finite A \\<and> profile A prof \\<and> a \\<in> A \\<and>\n              (a \\<notin> elect f A prof \\<or> a \\<in> elect g A prof) \\<and>\n              (a \\<notin> reject f A prof \\<or> a \\<in> reject g A prof) \\<and>\n              (a \\<notin> defer f A prof \\<or> a \\<in> defer g A prof))\"\n        by (simp add: mod_contains_result_def)\n      with e_mod_disj_n\n      have \"x \\<in> reject n A p\"\n        using e_mod_par f_prof in_A module_n not_mod_cont_mn\n              x_not_elect x_not_elect_mn x_not_mpar_rej\n        by auto\n      hence \"x \\<notin> reject m A p\"\n        using well_f_max max_agg_res result_m result_n\n              set_intersect wf_m wf_n x_not_mpar_rej\n        by (metis (no_types))\n      with max_agg_res\n      have\n        \"x \\<notin> defer (m \\<parallel>\\<^sub>\\<up> n) A p \\<or> x \\<in> defer m A p\"\n          using e_mod_disj f_prof in_A module_m x_not_elect_mn\n          by blast\n      with x_not_mpar_rej\n      show \"mod_contains_result (m \\<parallel>\\<^sub>\\<up> n) m A p x\"\n        using mod_cont_res_fg x_not_par_rej e_mod_par f_prof\n              in_A module_m x_not_elect\n        by auto\n    qed\n  next\n    assume not_a2: \"x \\<notin> defer (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    have el_rej_defer:\n      \"(elect m A p, reject m A p, defer m A p) = m A p\"\n      by auto\n    from not_a1 not_a2 have a3:\n      \"x \\<in> reject (m \\<parallel>\\<^sub>\\<up> n) A p\"\n      using electoral_mod_defer_elem in_A module_m module_n\n            f_prof max_par_comp_sound\n      by metis\n    hence\n      \"case snd (m A p) of (Aa, Ab) \\<Rightarrow>\n        case n A p of (Ac, Ad, Ae) \\<Rightarrow>\n          x \\<in> reject_r\n            (max_aggregator A\n              (elect m A p, Aa, Ab) (Ac, Ad, Ae))\"\n      using el_rej_defer\n      by force\n    hence\n      \"let (e1, r1, d1) = m A p;\n          (e2, r2, d2) = n A p in\n        x \\<in> fst (snd (max_aggregator A\n          (e1, r1, d1) (e2, r2, d2)))\"\n      by (simp add: case_prod_unfold)\n    hence\n      \"let (e1, r1, d1) = m A p;\n          (e2, r2, d2) = n A p in\n        x \\<in> A - (e1 \\<union> e2 \\<union> d1 \\<union> d2)\"\n      by simp\n    hence \"x \\<notin> elect m A p \\<union> (defer n A p \\<union> defer m A p)\"\n      by force\n    thus ?thesis\n      using mod_contains_result_comm mod_contains_result_def Un_iff\n            a3 f_prof in_A module_m module_n max_par_comp_sound\n      by (metis (no_types))\n  qed\nqed\n\nlemma max_agg_rej_iff_both_reject:\n  assumes\n    f_prof: \"finite_profile A p\" and\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\"\n  shows\n    \"x \\<in> reject (m \\<parallel>\\<^sub>\\<up> n) A p \\<longleftrightarrow>\n      (x \\<in> reject m A p \\<and> x \\<in> reject n A p)\"\nproof\n  assume a: \"x \\<in> reject (m \\<parallel>\\<^sub>\\<up> n) A p\"\n  hence\n    \"case n A p of (Aa, Ab, Ac) \\<Rightarrow>\n      x \\<in> reject_r (max_aggregator A\n        (elect m A p, reject m A p, defer m A p) (Aa, Ab, Ac))\"\n    by auto\n  hence\n    \"case snd (m A p) of (Aa, Ab) \\<Rightarrow>\n      case n A p of (Ac, Ad, Ae) \\<Rightarrow>\n        x \\<in> reject_r (max_aggregator A\n          (elect m A p, Aa, Ab) (Ac, Ad, Ae))\"\n    by force\n  with a have\n    \"let (e1, r1, d1) = m A p;\n          (e2, r2, d2) = n A p in\n      x \\<in> fst (snd (max_aggregator A (e1, r1, d1) (e2, r2, d2)))\"\n    by (simp add: prod.case_eq_if)\n  hence\n    \"let (e1, r1, d1) = m A p;\n        (e2, r2, d2) = n A p in\n      x \\<in> A - (e1 \\<union> e2 \\<union> d1 \\<union> d2)\"\n    by simp\n  hence\n    \"x \\<in> A - (elect m A p \\<union> elect n A p \\<union> defer m A p \\<union> defer n A p)\"\n    by auto\n  thus \"x \\<in> reject m A p \\<and> x \\<in> reject n A p\"\n    using Diff_iff Un_iff electoral_mod_defer_elem\n          f_prof module_m module_n\n    by metis\nnext\n  assume a: \"x \\<in> reject m A p \\<and> x \\<in> reject n A p\"\n  hence\n    \"x \\<notin> elect m A p \\<and> x \\<notin> defer m A p \\<and>\n      x \\<notin> elect n A p \\<and> x \\<notin> defer n A p\"\n    using IntI empty_iff module_m module_n f_prof result_disj\n    by metis\n  thus \"x \\<in> reject (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    using DiffD1 a f_prof max_agg_eq_result module_m module_n\n          mod_contains_result_comm mod_contains_result_def\n          reject_not_elec_or_def\n      by (metis (no_types))\nqed\n\nlemma max_agg_rej1:\n  assumes\n    f_prof: \"finite_profile A p\" and\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    rejected: \"x \\<in> reject n A p\"\n  shows \"mod_contains_result m (m \\<parallel>\\<^sub>\\<up> n) A p x\"\nproof (unfold mod_contains_result_def, safe)\n  show \"electoral_module m\"\n    using module_m\n    by simp\nnext\n  show \"electoral_module (m \\<parallel>\\<^sub>\\<up> n)\"\n    using module_m module_n\n    by simp\nnext\n  show \"finite A\"\n    using f_prof\n    by simp\nnext\n  show \"profile A p\"\n    using f_prof\n    by simp\nnext\n  show \"x \\<in> A\"\n    using f_prof module_n reject_in_alts rejected\n    by auto\nnext\n  assume x_in_elect: \"x \\<in> elect m A p\"\n  hence x_not_reject:\n    \"x \\<notin> reject m A p\"\n    using disjoint_iff_not_equal f_prof module_m result_disj\n    by metis\n  have rej_in_A:\n    \"reject n A p \\<subseteq> A\"\n    using f_prof module_n\n    by (simp add: reject_in_alts)\n  have x_in_A: \"x \\<in> A\"\n    using rej_in_A in_mono rejected\n    by metis\n  with x_in_elect x_not_reject\n  show \"x \\<in> elect (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    using f_prof max_agg_eq_result module_m module_n rejected\n          max_agg_rej_iff_both_reject mod_contains_result_comm\n          mod_contains_result_def\n      by metis\nnext\n  assume \"x \\<in> reject m A p\"\n  hence\n    \"x \\<in> reject m A p \\<and> x \\<in> reject n A p\"\n    using rejected\n    by simp\n  thus \"x \\<in> reject (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    using f_prof max_agg_rej_iff_both_reject module_m module_n\n    by (metis (no_types))\nnext\n  assume x_in_defer: \"x \\<in> defer m A p\"\n  hence defer_a:\n    \"\\<exists> a. a \\<in> defer m A p \\<and> x = a\"\n    by simp\n  then obtain x_inst :: 'a where\n    inst_x: \"x = x_inst \\<and> x_inst \\<in> defer m A p\"\n    by metis\n  hence x_not_rej:\n    \"x \\<notin> reject m A p\"\n    using disjoint_iff_not_equal f_prof inst_x module_m result_disj\n    by (metis (no_types))\n  have\n    \"\\<forall> f A prof.\n      (electoral_module f \\<and> finite (A::'a set) \\<and> profile A prof) \\<longrightarrow>\n        elect f A prof \\<union> reject f A prof \\<union> defer f A prof = A\"\n    using result_presv_alts\n    by metis\n  with x_in_defer\n  have \"x \\<in> A\"\n    using f_prof module_m\n    by blast\n  with inst_x x_not_rej\n  show \"x \\<in> defer (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    using f_prof max_agg_eq_result\n          max_agg_rej_iff_both_reject\n          mod_contains_result_comm\n          mod_contains_result_def\n          module_m module_n rejected\n    by metis\nqed\n\nlemma max_agg_rej2:\n  assumes\n    f_prof: \"finite_profile A p\" and\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    rejected: \"x \\<in> reject n A p\"\n  shows \"mod_contains_result (m \\<parallel>\\<^sub>\\<up> n) m A p x\"\n  using mod_contains_result_comm max_agg_rej1\n        module_m module_n f_prof rejected\n  by metis\n\nlemma max_agg_rej3:\n  assumes\n    f_prof:  \"finite_profile A p\" and\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    rejected: \"x \\<in> reject m A p\"\n  shows \"mod_contains_result n (m \\<parallel>\\<^sub>\\<up> n) A p x\"\nproof (unfold mod_contains_result_def, safe)\n  show \"electoral_module n\"\n    using module_n\n    by simp\nnext\n  show \"electoral_module (m \\<parallel>\\<^sub>\\<up> n)\"\n    using module_m module_n\n    by simp\nnext\n  show \"finite A\"\n    using f_prof\n    by simp\nnext\n  show \"profile A p\"\n    using f_prof\n    by simp\nnext\n  show \"x \\<in> A\"\n    using f_prof in_mono module_m reject_in_alts rejected\n    by (metis (no_types))\nnext\n  assume \"x \\<in> elect n A p\"\n  thus \"x \\<in> elect (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    using Un_iff combine_ele_rej_def fst_conv\n          maximum_parallel_composition.simps\n          max_aggregator.simps\n    unfolding parallel_composition.simps\n    by (metis (mono_tags, lifting))\nnext\n  assume \"x \\<in> reject n A p\"\n  thus \"x \\<in> reject (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    using f_prof max_agg_rej_iff_both_reject module_m module_n rejected\n    by metis\nnext\n  assume x_in_def: \"x \\<in> defer n A p\"\n  have \"x \\<in> A\"\n    using f_prof max_agg_rej1 mod_contains_result_def module_m rejected\n    by metis\n  thus \"x \\<in> defer (m \\<parallel>\\<^sub>\\<up> n) A p\"\n    using x_in_def disjoint_iff_not_equal f_prof\n          max_agg_eq_result max_agg_rej_iff_both_reject\n          mod_contains_result_comm mod_contains_result_def\n          module_m module_n rejected result_disj\n      by metis\nqed\n\nlemma max_agg_rej4:\n  assumes\n    f_prof: \"finite_profile A p\" and\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    rejected: \"x \\<in> reject m A p\"\n  shows \"mod_contains_result (m \\<parallel>\\<^sub>\\<up> n) n A p x\"\n  using mod_contains_result_comm max_agg_rej3\n        module_m module_n f_prof rejected\n  by metis\n\nlemma max_agg_rej_intersect:\n  assumes\n    module_m: \"electoral_module m\" and\n    module_n: \"electoral_module n\" and\n    f_prof: \"finite_profile A p\"\n  shows \"reject (m \\<parallel>\\<^sub>\\<up> n) A p = (reject m A p) \\<inter> (reject n A p)\"\nproof -\n  have\n    \"A = (elect m A p) \\<union> (reject m A p) \\<union> (defer m A p) \\<and>\n      A = (elect n A p) \\<union> (reject n A p) \\<union> (defer n A p)\"\n    using module_m module_n f_prof result_presv_alts\n    by metis\n  hence\n    \"A - ((elect m A p) \\<union> (defer m A p)) = (reject m A p) \\<and>\n      A - ((elect n A p) \\<union> (defer n A p)) = (reject n A p)\"\n    using module_m module_n f_prof reject_not_elec_or_def\n    by auto\n  hence\n    \"A - ((elect m A p) \\<union> (elect n A p) \\<union> (defer m A p) \\<union> (defer n A p)) =\n      (reject m A p) \\<inter> (reject n A p)\"\n    by blast\n  hence\n    \"let (e1, r1, d1) = m A p;\n        (e2, r2, d2) = n A p in\n      A - (e1 \\<union> e2 \\<union> d1 \\<union> d2) = r1 \\<inter> r2\"\n    by fastforce\n  thus ?thesis\n    by auto\nqed\n\nlemma dcompat_dec_by_one_mod:\n  assumes\n    compatible: \"disjoint_compatibility m n\" and\n    in_A: \"x \\<in> A\"\n  shows\n    \"(\\<forall> p. finite_profile A p \\<longrightarrow>\n          mod_contains_result m (m \\<parallel>\\<^sub>\\<up> n) A p x) \\<or>\n        (\\<forall> p. finite_profile A p \\<longrightarrow>\n          mod_contains_result n (m \\<parallel>\\<^sub>\\<up> n) A p x)\"\n  using DiffI compatible in_A max_agg_rej1 max_agg_rej3\n  unfolding disjoint_compatibility_def\n  by metis\n\nsubsection \\<open>Composition Rules\\<close>\n\ntext \\<open>\n  Using a conservative aggregator, the parallel composition\n  preserves the property non-electing.\n\\<close>\n\ntheorem conserv_max_agg_presv_non_electing[simp]:\n  assumes\n    non_electing_m: \"non_electing m\" and\n    non_electing_n: \"non_electing n\"\n  shows \"non_electing (m \\<parallel>\\<^sub>\\<up> n)\"\n  using non_electing_m non_electing_n\n  by simp\n\ntext \\<open>\n  Using the max aggregator, composing two compatible\n  electoral modules in parallel preserves defer-lift-invariance.\n\\<close>\n\ntheorem par_comp_def_lift_inv[simp]:\n  assumes\n    compatible: \"disjoint_compatibility m n\" and\n    monotone_m: \"defer_lift_invariance m\" and\n    monotone_n: \"defer_lift_invariance n\"\n  shows \"defer_lift_invariance (m \\<parallel>\\<^sub>\\<up> n)\"\nproof (unfold defer_lift_invariance_def, safe)\n  have electoral_mod_m: \"electoral_module m\"\n    using monotone_m\n    unfolding defer_lift_invariance_def\n    by simp\n  have electoral_mod_n: \"electoral_module n\"\n    using monotone_n\n    unfolding defer_lift_invariance_def\n    by simp\n  show \"electoral_module (m \\<parallel>\\<^sub>\\<up> n)\"\n    using electoral_mod_m electoral_mod_n\n    by simp\nnext\n  fix\n    S :: \"'a set\" and\n    p :: \"'a Profile\" and\n    q :: \"'a Profile\" and\n    x :: \"'a\"\n  assume\n    defer_x: \"x \\<in> defer (m \\<parallel>\\<^sub>\\<up> n) S p\" and\n    lifted_x: \"Profile.lifted S p q x\"\n  hence f_profs: \"finite_profile S p \\<and> finite_profile S q\"\n    unfolding lifted_def\n    by simp\n  from compatible\n  obtain A :: \"'a set\" where A:\n    \"A \\<subseteq> S \\<and> (\\<forall> x \\<in> A. indep_of_alt m S x \\<and>\n      (\\<forall> p. finite_profile S p \\<longrightarrow> x \\<in> reject m S p)) \\<and>\n        (\\<forall> x \\<in> S - A. indep_of_alt n S x \\<and>\n      (\\<forall> p. finite_profile S p \\<longrightarrow> x \\<in> reject n S p))\"\n    using f_profs\n    unfolding disjoint_compatibility_def\n    by (metis (no_types, lifting))\n  have \"\\<forall> x \\<in> S. prof_contains_result (m \\<parallel>\\<^sub>\\<up> n) S p q x\"\n  proof (cases)\n    assume a0: \"x \\<in> A\"\n    hence \"x \\<in> reject m S p\"\n      using A f_profs\n      by blast\n    with defer_x\n    have defer_n: \"x \\<in> defer n S p\"\n      using compatible f_profs max_agg_rej4\n      unfolding disjoint_compatibility_def mod_contains_result_def\n      by metis\n    have \"\\<forall> x \\<in> A. mod_contains_result (m \\<parallel>\\<^sub>\\<up> n) n S p x\"\n      using A compatible max_agg_rej4 f_profs\n      unfolding disjoint_compatibility_def\n      by metis\n    moreover have \"\\<forall> x \\<in> S. prof_contains_result n S p q x\"\n    proof (unfold prof_contains_result_def, clarify)\n      fix x :: \"'a\"\n      assume x_in_S: \"x \\<in> S\"\n      show\n        \"electoral_module n \\<and>\n         finite_profile S p \\<and>\n         finite_profile S q \\<and>\n         x \\<in> S \\<and>\n         (x \\<in> elect n S p \\<longrightarrow> x \\<in> elect n S q) \\<and>\n         (x \\<in> reject n S p \\<longrightarrow> x \\<in> reject n S q) \\<and>\n         (x \\<in> defer n S p \\<longrightarrow> x \\<in> defer n S q)\"\n      proof (safe)\n        show \"electoral_module n\"\n          using monotone_n\n          unfolding defer_lift_invariance_def\n          by metis\n      next\n        show \"finite S\"\n          using f_profs\n          by simp\n      next\n        show \"profile S p\"\n          using f_profs\n          by simp\n      next\n        show \"finite S\"\n          using f_profs\n          by simp\n      next\n        show \"profile S q\"\n          using f_profs\n          by simp\n      next\n        show \"x \\<in> S\"\n          using x_in_S\n          by simp\n      next\n        assume \"x \\<in> elect n S p\"\n        thus \"x \\<in> elect n S q\"\n          using defer_n lifted_x monotone_n f_profs\n          unfolding defer_lift_invariance_def\n          by metis\n      next\n        assume \"x \\<in> reject n S p\"\n        thus \"x \\<in> reject n S q\"\n          using defer_n lifted_x monotone_n f_profs\n          unfolding defer_lift_invariance_def\n          by metis\n      next\n        assume \"x \\<in> defer n S p\"\n        thus \"x \\<in> defer n S q\"\n          using defer_n lifted_x monotone_n f_profs\n          unfolding defer_lift_invariance_def\n          by metis\n      qed\n    qed\n    moreover have\n      \"\\<forall> x \\<in> A. mod_contains_result n (m \\<parallel>\\<^sub>\\<up> n) S q x\"\n      using A compatible max_agg_rej3 f_profs\n      unfolding disjoint_compatibility_def\n      by metis\n    ultimately have 00:\n      \"\\<forall> x \\<in> A. prof_contains_result (m \\<parallel>\\<^sub>\\<up> n) S p q x\"\n      unfolding mod_contains_result_def prof_contains_result_def\n      by simp\n    have\n      \"\\<forall> x \\<in> S - A. mod_contains_result (m \\<parallel>\\<^sub>\\<up> n) m S p x\"\n      using A max_agg_rej2 monotone_m monotone_n f_profs\n      unfolding defer_lift_invariance_def\n      by metis\n    moreover have \"\\<forall> x \\<in> S. prof_contains_result m S p q x\"\n    proof (unfold prof_contains_result_def, clarify)\n      fix x :: \"'a\"\n      assume x_in_S: \"x \\<in> S\"\n      show\n        \"electoral_module m \\<and>\n         finite_profile S p \\<and>\n         finite_profile S q \\<and>\n         x \\<in> S \\<and>\n         (x \\<in> elect m S p \\<longrightarrow> x \\<in> elect m S q) \\<and>\n         (x \\<in> reject m S p \\<longrightarrow> x \\<in> reject m S q) \\<and>\n         (x \\<in> defer m S p \\<longrightarrow> x \\<in> defer m S q)\"\n      proof (safe)\n        show \"electoral_module m\"\n          using monotone_m\n          unfolding defer_lift_invariance_def\n          by metis\n      next\n        show \"finite S\"\n          using f_profs\n          by simp\n      next\n        show \"profile S p\"\n          using f_profs\n          by simp\n      next\n        show \"finite S\"\n          using f_profs\n          by simp\n      next\n        show \"profile S q\"\n          using f_profs\n          by simp\n      next\n        show \"x \\<in> S\"\n          using x_in_S\n          by simp\n      next\n        assume \"x \\<in> elect m S p\"\n        thus \"x \\<in> elect m S q\"\n          using A a0 lifted_x lifted_imp_equiv_prof_except_a\n          unfolding indep_of_alt_def\n          by metis\n      next\n        assume \"x \\<in> reject m S p\"\n        thus \"x \\<in> reject m S q\"\n          using A a0 lifted_x lifted_imp_equiv_prof_except_a\n          unfolding indep_of_alt_def\n          by metis\n      next\n        assume \"x \\<in> defer m S p\"\n        thus \"x \\<in> defer m S q\"\n          using A a0 lifted_x lifted_imp_equiv_prof_except_a\n          unfolding indep_of_alt_def\n          by metis\n      qed\n    qed\n    moreover have\n      \"\\<forall> x \\<in> S - A. mod_contains_result m (m \\<parallel>\\<^sub>\\<up> n) S q x\"\n      using A max_agg_rej1 monotone_m monotone_n f_profs\n      unfolding defer_lift_invariance_def\n      by metis\n    ultimately have 01:\n      \"\\<forall> x \\<in> S - A. prof_contains_result (m \\<parallel>\\<^sub>\\<up> n) S p q x\"\n      unfolding mod_contains_result_def prof_contains_result_def\n      by simp\n    from 00 01\n    show ?thesis\n      by blast\n  next\n    assume \"x \\<notin> A\"\n    hence a1: \"x \\<in> S - A\"\n      using DiffI lifted_x compatible f_profs\n      unfolding Profile.lifted_def\n      by (metis (no_types, lifting))\n    hence \"x \\<in> reject n S p\"\n      using A f_profs\n      by blast\n    with defer_x\n    have defer_m: \"x \\<in> defer m S p\"\n      using DiffD1 DiffD2 compatible dcompat_dec_by_one_mod f_profs\n            defer_not_elec_or_rej max_agg_sound par_comp_sound\n            disjoint_compatibility_def not_rej_imp_elec_or_def\n            mod_contains_result_def\n      unfolding maximum_parallel_composition.simps\n      by metis\n    have\n      \"\\<forall> x \\<in> A. mod_contains_result (m \\<parallel>\\<^sub>\\<up> n) n S p x\"\n      using A compatible max_agg_rej4 f_profs\n      unfolding disjoint_compatibility_def\n      by metis\n    moreover have \"\\<forall> x \\<in> S. prof_contains_result n S p q x\"\n    proof (unfold prof_contains_result_def, clarify)\n      fix x :: \"'a\"\n      assume x_in_S: \"x \\<in> S\"\n      show\n        \"electoral_module n \\<and>\n         finite_profile S p \\<and>\n         finite_profile S q \\<and>\n         x \\<in> S \\<and>\n         (x \\<in> elect n S p \\<longrightarrow> x \\<in> elect n S q) \\<and>\n         (x \\<in> reject n S p \\<longrightarrow> x \\<in> reject n S q) \\<and>\n         (x \\<in> defer n S p \\<longrightarrow> x \\<in> defer n S q)\"\n      proof (safe)\n        show \"electoral_module n\"\n          using monotone_n\n          unfolding defer_lift_invariance_def\n          by metis\n      next\n        show \"finite S\"\n          using f_profs\n          by simp\n      next\n        show \"profile S p\"\n          using f_profs\n          by simp\n      next\n        show \"finite S\"\n          using f_profs\n          by simp\n      next\n        show \"profile S q\"\n          using f_profs\n          by simp\n      next\n        show \"x \\<in> S\"\n          using x_in_S\n          by simp\n      next\n        assume \"x \\<in> elect n S p\"\n        thus \"x \\<in> elect n S q\"\n          using A a1 lifted_x lifted_imp_equiv_prof_except_a\n          unfolding indep_of_alt_def\n          by metis\n      next\n        assume \"x \\<in> reject n S p\"\n        thus \"x \\<in> reject n S q\"\n          using A a1 lifted_x lifted_imp_equiv_prof_except_a\n          unfolding indep_of_alt_def\n          by metis\n      next\n        assume \"x \\<in> defer n S p\"\n        thus \"x \\<in> defer n S q\"\n          using A a1 lifted_x lifted_imp_equiv_prof_except_a\n          unfolding indep_of_alt_def\n          by metis\n      qed\n  qed\n  moreover have \"\\<forall> x \\<in> A. mod_contains_result n (m \\<parallel>\\<^sub>\\<up> n) S q x\"\n    using A compatible max_agg_rej3 f_profs\n    unfolding disjoint_compatibility_def\n    by metis\n  ultimately have 10:\n    \"\\<forall> x \\<in> A. prof_contains_result (m \\<parallel>\\<^sub>\\<up> n) S p q x\"\n    unfolding mod_contains_result_def prof_contains_result_def\n    by simp\n  have \"\\<forall> x \\<in> S - A. mod_contains_result (m \\<parallel>\\<^sub>\\<up> n) m S p x\"\n    using A max_agg_rej2 monotone_m monotone_n f_profs\n    unfolding defer_lift_invariance_def\n    by metis\n  moreover have \"\\<forall> x \\<in> S. prof_contains_result m S p q x\"\n  proof (unfold prof_contains_result_def, clarify)\n    fix x :: \"'a\"\n    assume x_in_S: \"x \\<in> S\"\n    show\n      \"electoral_module m \\<and>\n        finite_profile S p \\<and>\n        finite_profile S q \\<and>\n        x \\<in> S \\<and>\n        (x \\<in> elect m S p \\<longrightarrow> x \\<in> elect m S q) \\<and>\n        (x \\<in> reject m S p \\<longrightarrow> x \\<in> reject m S q) \\<and>\n        (x \\<in> defer m S p \\<longrightarrow> x \\<in> defer m S q)\"\n    proof (safe)\n      show \"electoral_module m\"\n        using monotone_m\n        unfolding defer_lift_invariance_def\n        by simp\n    next\n      show \"finite S\"\n        using f_profs\n        by simp\n    next\n      show \"profile S p\"\n        using f_profs\n        by simp\n    next\n      show \"finite S\"\n        using f_profs\n        by simp\n    next\n      show \"profile S q\"\n        using f_profs\n        by simp\n    next\n      show \"x \\<in> S\"\n        using x_in_S\n        by simp\n    next\n      assume \"x \\<in> elect m S p\"\n      thus \"x \\<in> elect m S q\"\n        using defer_m lifted_x monotone_m\n        unfolding defer_lift_invariance_def\n        by metis\n    next\n      assume \"x \\<in> reject m S p\"\n      thus \"x \\<in> reject m S q\"\n        using defer_m lifted_x monotone_m\n        unfolding defer_lift_invariance_def\n        by metis\n    next\n      assume \"x \\<in> defer m S p\"\n      thus \"x \\<in> defer m S q\"\n        using defer_m lifted_x monotone_m\n        unfolding defer_lift_invariance_def\n        by metis\n    qed\n  qed\n  moreover have\n    \"\\<forall> x \\<in> S - A. mod_contains_result m (m \\<parallel>\\<^sub>\\<up> n) S q x\"\n    using A max_agg_rej1 monotone_m monotone_n f_profs\n    unfolding defer_lift_invariance_def\n    by metis\n  ultimately have 11:\n    \"\\<forall> x \\<in> S - A. prof_contains_result (m \\<parallel>\\<^sub>\\<up> n) S p q x\"\n    using electoral_mod_defer_elem\n    unfolding mod_contains_result_def prof_contains_result_def\n    by simp\n  from 10 11\n  show ?thesis\n    by blast\n  qed\n  thus \"(m \\<parallel>\\<^sub>\\<up> n) S p = (m \\<parallel>\\<^sub>\\<up> n) S q\"\n    using compatible f_profs eq_alts_in_profs_imp_eq_results\n          max_par_comp_sound\n    unfolding disjoint_compatibility_def\n    by metis\nqed\n\nlemma par_comp_rej_card:\n  assumes\n    compatible: \"disjoint_compatibility x y\" and\n    f_prof: \"finite_profile S p\" and\n    reject_sum: \"card (reject x S p) + card (reject y S p) = card S + n\"\n  shows \"card (reject (x \\<parallel>\\<^sub>\\<up> y) S p) = n\"\nproof -\n  from compatible obtain A where A:\n    \"A \\<subseteq> S \\<and>\n      (\\<forall> a \\<in> A. indep_of_alt x S a \\<and>\n          (\\<forall> p. finite_profile S p \\<longrightarrow> a \\<in> reject x S p)) \\<and>\n      (\\<forall> a \\<in> S - A. indep_of_alt y S a \\<and>\n          (\\<forall> p. finite_profile S p \\<longrightarrow> a \\<in> reject y S p))\"\n    using f_prof\n    unfolding disjoint_compatibility_def\n    by metis\n  from f_prof compatible have reject_representation:\n    \"reject (x \\<parallel>\\<^sub>\\<up> y) S p = (reject x S p) \\<inter> (reject y S p)\"\n    using max_agg_rej_intersect\n    unfolding disjoint_compatibility_def\n    by metis\n  have \"electoral_module x \\<and> electoral_module y\"\n    using compatible\n    unfolding disjoint_compatibility_def\n    by simp\n  hence subsets: \"(reject x S p) \\<subseteq> S \\<and> (reject y S p) \\<subseteq> S\"\n    by (simp add: f_prof reject_in_alts)\n  hence \"finite (reject x S p) \\<and> finite (reject y S p)\"\n    using rev_finite_subset f_prof\n    by metis\n  hence 0:\n    \"card (reject (x \\<parallel>\\<^sub>\\<up> y) S p) =\n        card S + n -\n          card ((reject x S p) \\<union> (reject y S p))\"\n    using card_Un_Int reject_representation reject_sum\n    by fastforce\n  have \"\\<forall> a \\<in> S. a \\<in> (reject x S p) \\<or> a \\<in> (reject y S p)\"\n    using A f_prof\n    by blast\n  hence \"S = reject x S p \\<union> reject y S p\"\n    using subsets\n    by force\n  hence 1: \"card ((reject x S p) \\<union> (reject y S p)) = card S\"\n    by presburger\n  from 0 1\n  show \"card (reject (x \\<parallel>\\<^sub>\\<up> y) S p) = n\"\n    by simp\nqed\n\ntext \\<open>\n  Using the max-aggregator for composing two compatible modules in parallel,\n  whereof the first one is non-electing and defers exactly one alternative,\n  and the second one rejects exactly two alternatives, the composition\n  results in an electoral module that eliminates exactly one alternative.\n\\<close>\n\ntheorem par_comp_elim_one[simp]:\n  assumes\n    defers_m_1: \"defers 1 m\" and\n    non_elec_m: \"non_electing m\" and\n    rejec_n_2: \"rejects 2 n\" and\n    disj_comp: \"disjoint_compatibility m n\"\n  shows \"eliminates 1 (m \\<parallel>\\<^sub>\\<up> n)\"\nproof (unfold eliminates_def, safe)\n  have electoral_mod_m: \"electoral_module m\"\n    using non_elec_m\n    unfolding non_electing_def\n    by simp\n  have electoral_mod_n: \"electoral_module n\"\n    using rejec_n_2\n    unfolding rejects_def\n    by simp\n  show \"electoral_module (m \\<parallel>\\<^sub>\\<up> n)\"\n    using electoral_mod_m electoral_mod_n\n    by simp\nnext\n  fix\n    A :: \"'a set\" and\n    p :: \"'a Profile\"\n  assume\n    min_2_card: \"1 < card A\" and\n    fin_A: \"finite A\" and\n    prof_A: \"profile A p\"\n  have card_geq_1: \"card A \\<ge> 1\"\n    using min_2_card dual_order.strict_trans2 less_imp_le_nat\n    by blast\n  have module: \"electoral_module m\"\n    using non_elec_m\n    unfolding non_electing_def\n    by simp\n  have elec_card_0: \"card (elect m A p) = 0\"\n    using fin_A prof_A non_elec_m card_eq_0_iff\n    unfolding non_electing_def\n    by simp\n  moreover\n  from card_geq_1 have def_card_1:\n    \"card (defer m A p) = 1\"\n    using defers_m_1 module fin_A prof_A\n    unfolding defers_def\n    by simp\n  ultimately have card_reject_m:\n    \"card (reject m A p) = card A - 1\"\n  proof -\n    have \"finite A\"\n      using fin_A\n      by simp\n    moreover have\n      \"well_formed A\n        (elect m A p, reject m A p, defer m A p)\"\n      using fin_A prof_A module\n      unfolding electoral_module_def\n      by simp\n    ultimately have\n      \"card A =\n        card (elect m A p) + card (reject m A p) +\n          card (defer m A p)\"\n      using result_count\n      by blast\n    thus ?thesis\n      using def_card_1 elec_card_0\n      by simp\n  qed\n  have case1: \"card A \\<ge> 2\"\n    using min_2_card\n    by simp\n  from case1\n  have card_reject_n: \"card (reject n A p) = 2\"\n    using fin_A prof_A rejec_n_2\n    unfolding rejects_def\n    by blast\n  from card_reject_m card_reject_n\n  have \"card (reject m A p) + card (reject n A p) = card A + 1\"\n    using card_geq_1\n    by linarith\n  with disj_comp prof_A fin_A card_reject_m card_reject_n\n  show \"card (reject (m \\<parallel>\\<^sub>\\<up> n) A p) = 1\"\n    using par_comp_rej_card\n    by blast\nqed\n\nend\n", "meta": {"author": "VeriVote", "repo": "verifiedVotingRuleConstruction", "sha": "17bf689350c733dc7b419f4924d099a0e65de036", "save_path": "github-repos/isabelle/VeriVote-verifiedVotingRuleConstruction", "path": "github-repos/isabelle/VeriVote-verifiedVotingRuleConstruction/verifiedVotingRuleConstruction-17bf689350c733dc7b419f4924d099a0e65de036/theories/Compositional_Structures/Maximum_Parallel_Composition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.30901686245007903}}
{"text": "(*  Title:      HOL/Extraction.thy\n    Author:     Stefan Berghofer, TU Muenchen\n*)\n\nsection \\<open>Program extraction for HOL\\<close>\n\ntheory Extraction\nimports Option\nbegin\n\nML_file \"Tools/rewrite_hol_proof.ML\"\n\nsubsection \\<open>Setup\\<close>\n\nsetup \\<open>\n  Extraction.add_types\n      [(\"bool\", ([], NONE))] #>\n  Extraction.set_preprocessor (fn thy =>\n    let val ctxt = Proof_Context.init_global thy in\n      Proofterm.rewrite_proof_notypes\n        ([], RewriteHOLProof.elim_cong :: ProofRewriteRules.rprocs true) o\n      Proofterm.rewrite_proof thy\n        (RewriteHOLProof.rews,\n         ProofRewriteRules.rprocs true @ [ProofRewriteRules.expand_of_class ctxt]) o\n      ProofRewriteRules.elim_vars (curry Const @{const_name default})\n    end)\n\\<close>\n\nlemmas [extraction_expand] =\n  meta_spec atomize_eq atomize_all atomize_imp atomize_conj\n  allE rev_mp conjE Eq_TrueI Eq_FalseI eqTrueI eqTrueE eq_cong2\n  notE' impE' impE iffE imp_cong simp_thms eq_True eq_False\n  induct_forall_eq induct_implies_eq induct_equal_eq induct_conj_eq\n  induct_atomize induct_atomize' induct_rulify induct_rulify'\n  induct_rulify_fallback induct_trueI\n  True_implies_equals implies_True_equals TrueE\n  False_implies_equals implies_False_swap\n\nlemmas [extraction_expand_def] =\n  HOL.induct_forall_def HOL.induct_implies_def HOL.induct_equal_def HOL.induct_conj_def\n  HOL.induct_true_def HOL.induct_false_def\n\ndatatype (plugins only: code extraction) sumbool = Left | Right\n\nsubsection \\<open>Type of extracted program\\<close>\n\nextract_type\n  \"typeof (Trueprop P) \\<equiv> typeof P\"\n\n  \"typeof P \\<equiv> Type (TYPE(Null)) \\<Longrightarrow> typeof Q \\<equiv> Type (TYPE('Q)) \\<Longrightarrow>\n     typeof (P \\<longrightarrow> Q) \\<equiv> Type (TYPE('Q))\"\n\n  \"typeof Q \\<equiv> Type (TYPE(Null)) \\<Longrightarrow> typeof (P \\<longrightarrow> Q) \\<equiv> Type (TYPE(Null))\"\n\n  \"typeof P \\<equiv> Type (TYPE('P)) \\<Longrightarrow> typeof Q \\<equiv> Type (TYPE('Q)) \\<Longrightarrow>\n     typeof (P \\<longrightarrow> Q) \\<equiv> Type (TYPE('P \\<Rightarrow> 'Q))\"\n\n  \"(\\<lambda>x. typeof (P x)) \\<equiv> (\\<lambda>x. Type (TYPE(Null))) \\<Longrightarrow>\n     typeof (\\<forall>x. P x) \\<equiv> Type (TYPE(Null))\"\n\n  \"(\\<lambda>x. typeof (P x)) \\<equiv> (\\<lambda>x. Type (TYPE('P))) \\<Longrightarrow>\n     typeof (\\<forall>x::'a. P x) \\<equiv> Type (TYPE('a \\<Rightarrow> 'P))\"\n\n  \"(\\<lambda>x. typeof (P x)) \\<equiv> (\\<lambda>x. Type (TYPE(Null))) \\<Longrightarrow>\n     typeof (\\<exists>x::'a. P x) \\<equiv> Type (TYPE('a))\"\n\n  \"(\\<lambda>x. typeof (P x)) \\<equiv> (\\<lambda>x. Type (TYPE('P))) \\<Longrightarrow>\n     typeof (\\<exists>x::'a. P x) \\<equiv> Type (TYPE('a \\<times> 'P))\"\n\n  \"typeof P \\<equiv> Type (TYPE(Null)) \\<Longrightarrow> typeof Q \\<equiv> Type (TYPE(Null)) \\<Longrightarrow>\n     typeof (P \\<or> Q) \\<equiv> Type (TYPE(sumbool))\"\n\n  \"typeof P \\<equiv> Type (TYPE(Null)) \\<Longrightarrow> typeof Q \\<equiv> Type (TYPE('Q)) \\<Longrightarrow>\n     typeof (P \\<or> Q) \\<equiv> Type (TYPE('Q option))\"\n\n  \"typeof P \\<equiv> Type (TYPE('P)) \\<Longrightarrow> typeof Q \\<equiv> Type (TYPE(Null)) \\<Longrightarrow>\n     typeof (P \\<or> Q) \\<equiv> Type (TYPE('P option))\"\n\n  \"typeof P \\<equiv> Type (TYPE('P)) \\<Longrightarrow> typeof Q \\<equiv> Type (TYPE('Q)) \\<Longrightarrow>\n     typeof (P \\<or> Q) \\<equiv> Type (TYPE('P + 'Q))\"\n\n  \"typeof P \\<equiv> Type (TYPE(Null)) \\<Longrightarrow> typeof Q \\<equiv> Type (TYPE('Q)) \\<Longrightarrow>\n     typeof (P \\<and> Q) \\<equiv> Type (TYPE('Q))\"\n\n  \"typeof P \\<equiv> Type (TYPE('P)) \\<Longrightarrow> typeof Q \\<equiv> Type (TYPE(Null)) \\<Longrightarrow>\n     typeof (P \\<and> Q) \\<equiv> Type (TYPE('P))\"\n\n  \"typeof P \\<equiv> Type (TYPE('P)) \\<Longrightarrow> typeof Q \\<equiv> Type (TYPE('Q)) \\<Longrightarrow>\n     typeof (P \\<and> Q) \\<equiv> Type (TYPE('P \\<times> 'Q))\"\n\n  \"typeof (P = Q) \\<equiv> typeof ((P \\<longrightarrow> Q) \\<and> (Q \\<longrightarrow> P))\"\n\n  \"typeof (x \\<in> P) \\<equiv> typeof P\"\n\nsubsection \\<open>Realizability\\<close>\n\nrealizability\n  \"(realizes t (Trueprop P)) \\<equiv> (Trueprop (realizes t P))\"\n\n  \"(typeof P) \\<equiv> (Type (TYPE(Null))) \\<Longrightarrow>\n     (realizes t (P \\<longrightarrow> Q)) \\<equiv> (realizes Null P \\<longrightarrow> realizes t Q)\"\n\n  \"(typeof P) \\<equiv> (Type (TYPE('P))) \\<Longrightarrow>\n   (typeof Q) \\<equiv> (Type (TYPE(Null))) \\<Longrightarrow>\n     (realizes t (P \\<longrightarrow> Q)) \\<equiv> (\\<forall>x::'P. realizes x P \\<longrightarrow> realizes Null Q)\"\n\n  \"(realizes t (P \\<longrightarrow> Q)) \\<equiv> (\\<forall>x. realizes x P \\<longrightarrow> realizes (t x) Q)\"\n\n  \"(\\<lambda>x. typeof (P x)) \\<equiv> (\\<lambda>x. Type (TYPE(Null))) \\<Longrightarrow>\n     (realizes t (\\<forall>x. P x)) \\<equiv> (\\<forall>x. realizes Null (P x))\"\n\n  \"(realizes t (\\<forall>x. P x)) \\<equiv> (\\<forall>x. realizes (t x) (P x))\"\n\n  \"(\\<lambda>x. typeof (P x)) \\<equiv> (\\<lambda>x. Type (TYPE(Null))) \\<Longrightarrow>\n     (realizes t (\\<exists>x. P x)) \\<equiv> (realizes Null (P t))\"\n\n  \"(realizes t (\\<exists>x. P x)) \\<equiv> (realizes (snd t) (P (fst t)))\"\n\n  \"(typeof P) \\<equiv> (Type (TYPE(Null))) \\<Longrightarrow>\n   (typeof Q) \\<equiv> (Type (TYPE(Null))) \\<Longrightarrow>\n     (realizes t (P \\<or> Q)) \\<equiv>\n     (case t of Left \\<Rightarrow> realizes Null P | Right \\<Rightarrow> realizes Null Q)\"\n\n  \"(typeof P) \\<equiv> (Type (TYPE(Null))) \\<Longrightarrow>\n     (realizes t (P \\<or> Q)) \\<equiv>\n     (case t of None \\<Rightarrow> realizes Null P | Some q \\<Rightarrow> realizes q Q)\"\n\n  \"(typeof Q) \\<equiv> (Type (TYPE(Null))) \\<Longrightarrow>\n     (realizes t (P \\<or> Q)) \\<equiv>\n     (case t of None \\<Rightarrow> realizes Null Q | Some p \\<Rightarrow> realizes p P)\"\n\n  \"(realizes t (P \\<or> Q)) \\<equiv>\n   (case t of Inl p \\<Rightarrow> realizes p P | Inr q \\<Rightarrow> realizes q Q)\"\n\n  \"(typeof P) \\<equiv> (Type (TYPE(Null))) \\<Longrightarrow>\n     (realizes t (P \\<and> Q)) \\<equiv> (realizes Null P \\<and> realizes t Q)\"\n\n  \"(typeof Q) \\<equiv> (Type (TYPE(Null))) \\<Longrightarrow>\n     (realizes t (P \\<and> Q)) \\<equiv> (realizes t P \\<and> realizes Null Q)\"\n\n  \"(realizes t (P \\<and> Q)) \\<equiv> (realizes (fst t) P \\<and> realizes (snd t) Q)\"\n\n  \"typeof P \\<equiv> Type (TYPE(Null)) \\<Longrightarrow>\n     realizes t (\\<not> P) \\<equiv> \\<not> realizes Null P\"\n\n  \"typeof P \\<equiv> Type (TYPE('P)) \\<Longrightarrow>\n     realizes t (\\<not> P) \\<equiv> (\\<forall>x::'P. \\<not> realizes x P)\"\n\n  \"typeof (P::bool) \\<equiv> Type (TYPE(Null)) \\<Longrightarrow>\n   typeof Q \\<equiv> Type (TYPE(Null)) \\<Longrightarrow>\n     realizes t (P = Q) \\<equiv> realizes Null P = realizes Null Q\"\n\n  \"(realizes t (P = Q)) \\<equiv> (realizes t ((P \\<longrightarrow> Q) \\<and> (Q \\<longrightarrow> P)))\"\n\nsubsection \\<open>Computational content of basic inference rules\\<close>\n\ntheorem disjE_realizer:\n  assumes r: \"case x of Inl p \\<Rightarrow> P p | Inr q \\<Rightarrow> Q q\"\n  and r1: \"\\<And>p. P p \\<Longrightarrow> R (f p)\" and r2: \"\\<And>q. Q q \\<Longrightarrow> R (g q)\"\n  shows \"R (case x of Inl p \\<Rightarrow> f p | Inr q \\<Rightarrow> g q)\"\nproof (cases x)\n  case Inl\n  with r show ?thesis by simp (rule r1)\nnext\n  case Inr\n  with r show ?thesis by simp (rule r2)\nqed\n\ntheorem disjE_realizer2:\n  assumes r: \"case x of None \\<Rightarrow> P | Some q \\<Rightarrow> Q q\"\n  and r1: \"P \\<Longrightarrow> R f\" and r2: \"\\<And>q. Q q \\<Longrightarrow> R (g q)\"\n  shows \"R (case x of None \\<Rightarrow> f | Some q \\<Rightarrow> g q)\"\nproof (cases x)\n  case None\n  with r show ?thesis by simp (rule r1)\nnext\n  case Some\n  with r show ?thesis by simp (rule r2)\nqed\n\ntheorem disjE_realizer3:\n  assumes r: \"case x of Left \\<Rightarrow> P | Right \\<Rightarrow> Q\"\n  and r1: \"P \\<Longrightarrow> R f\" and r2: \"Q \\<Longrightarrow> R g\"\n  shows \"R (case x of Left \\<Rightarrow> f | Right \\<Rightarrow> g)\"\nproof (cases x)\n  case Left\n  with r show ?thesis by simp (rule r1)\nnext\n  case Right\n  with r show ?thesis by simp (rule r2)\nqed\n\ntheorem conjI_realizer:\n  \"P p \\<Longrightarrow> Q q \\<Longrightarrow> P (fst (p, q)) \\<and> Q (snd (p, q))\"\n  by simp\n\ntheorem exI_realizer:\n  \"P y x \\<Longrightarrow> P (snd (x, y)) (fst (x, y))\" by simp\n\ntheorem exE_realizer: \"P (snd p) (fst p) \\<Longrightarrow>\n  (\\<And>x y. P y x \\<Longrightarrow> Q (f x y)) \\<Longrightarrow> Q (let (x, y) = p in f x y)\"\n  by (cases p) (simp add: Let_def)\n\ntheorem exE_realizer': \"P (snd p) (fst p) \\<Longrightarrow>\n  (\\<And>x y. P y x \\<Longrightarrow> Q) \\<Longrightarrow> Q\" by (cases p) simp\n\nrealizers\n  impI (P, Q): \"\\<lambda>pq. pq\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q pq (h: _). allI \\<cdot> _ \\<bullet> c \\<bullet> (\\<^bold>\\<lambda>x. impI \\<cdot> _ \\<cdot> _ \\<bullet> (h \\<cdot> x))\"\n\n  impI (P): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) P Q (h: _). allI \\<cdot> _ \\<bullet> c \\<bullet> (\\<^bold>\\<lambda>x. impI \\<cdot> _ \\<cdot> _ \\<bullet> (h \\<cdot> x))\"\n\n  impI (Q): \"\\<lambda>q. q\" \"\\<^bold>\\<lambda>(c: _) P Q q. impI \\<cdot> _ \\<cdot> _\"\n\n  impI: \"Null\" \"impI\"\n\n  mp (P, Q): \"\\<lambda>pq. pq\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q pq (h: _) p. mp \\<cdot> _ \\<cdot> _ \\<bullet> (spec \\<cdot> _ \\<cdot> p \\<bullet> c \\<bullet> h)\"\n\n  mp (P): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) P Q (h: _) p. mp \\<cdot> _ \\<cdot> _ \\<bullet> (spec \\<cdot> _ \\<cdot> p \\<bullet> c \\<bullet> h)\"\n\n  mp (Q): \"\\<lambda>q. q\" \"\\<^bold>\\<lambda>(c: _) P Q q. mp \\<cdot> _ \\<cdot> _\"\n\n  mp: \"Null\" \"mp\"\n\n  allI (P): \"\\<lambda>p. p\" \"\\<^bold>\\<lambda>(c: _) P (d: _) p. allI \\<cdot> _ \\<bullet> d\"\n\n  allI: \"Null\" \"allI\"\n\n  spec (P): \"\\<lambda>x p. p x\" \"\\<^bold>\\<lambda>(c: _) P x (d: _) p. spec \\<cdot> _ \\<cdot> x \\<bullet> d\"\n\n  spec: \"Null\" \"spec\"\n\n  exI (P): \"\\<lambda>x p. (x, p)\" \"\\<^bold>\\<lambda>(c: _) P x (d: _) p. exI_realizer \\<cdot> P \\<cdot> p \\<cdot> x \\<bullet> c \\<bullet> d\"\n\n  exI: \"\\<lambda>x. x\" \"\\<^bold>\\<lambda>P x (c: _) (h: _). h\"\n\n  exE (P, Q): \"\\<lambda>p pq. let (x, y) = p in pq x y\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q (e: _) p (h: _) pq. exE_realizer \\<cdot> P \\<cdot> p \\<cdot> Q \\<cdot> pq \\<bullet> c \\<bullet> e \\<bullet> d \\<bullet> h\"\n\n  exE (P): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) P Q (d: _) p. exE_realizer' \\<cdot> _ \\<cdot> _ \\<cdot> _ \\<bullet> c \\<bullet> d\"\n\n  exE (Q): \"\\<lambda>x pq. pq x\"\n    \"\\<^bold>\\<lambda>(c: _) P Q (d: _) x (h1: _) pq (h2: _). h2 \\<cdot> x \\<bullet> h1\"\n\n  exE: \"Null\"\n    \"\\<^bold>\\<lambda>P Q (c: _) x (h1: _) (h2: _). h2 \\<cdot> x \\<bullet> h1\"\n\n  conjI (P, Q): \"Pair\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q p (h: _) q. conjI_realizer \\<cdot> P \\<cdot> p \\<cdot> Q \\<cdot> q \\<bullet> c \\<bullet> d \\<bullet> h\"\n\n  conjI (P): \"\\<lambda>p. p\"\n    \"\\<^bold>\\<lambda>(c: _) P Q p. conjI \\<cdot> _ \\<cdot> _\"\n\n  conjI (Q): \"\\<lambda>q. q\"\n    \"\\<^bold>\\<lambda>(c: _) P Q (h: _) q. conjI \\<cdot> _ \\<cdot> _ \\<bullet> h\"\n\n  conjI: \"Null\" \"conjI\"\n\n  conjunct1 (P, Q): \"fst\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q pq. conjunct1 \\<cdot> _ \\<cdot> _\"\n\n  conjunct1 (P): \"\\<lambda>p. p\"\n    \"\\<^bold>\\<lambda>(c: _) P Q p. conjunct1 \\<cdot> _ \\<cdot> _\"\n\n  conjunct1 (Q): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) P Q q. conjunct1 \\<cdot> _ \\<cdot> _\"\n\n  conjunct1: \"Null\" \"conjunct1\"\n\n  conjunct2 (P, Q): \"snd\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q pq. conjunct2 \\<cdot> _ \\<cdot> _\"\n\n  conjunct2 (P): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) P Q p. conjunct2 \\<cdot> _ \\<cdot> _\"\n\n  conjunct2 (Q): \"\\<lambda>p. p\"\n    \"\\<^bold>\\<lambda>(c: _) P Q p. conjunct2 \\<cdot> _ \\<cdot> _\"\n\n  conjunct2: \"Null\" \"conjunct2\"\n\n  disjI1 (P, Q): \"Inl\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q p. iffD2 \\<cdot> _ \\<cdot> _ \\<bullet> (sum.case_1 \\<cdot> P \\<cdot> _ \\<cdot> p \\<bullet> arity_type_bool \\<bullet> c \\<bullet> d)\"\n\n  disjI1 (P): \"Some\"\n    \"\\<^bold>\\<lambda>(c: _) P Q p. iffD2 \\<cdot> _ \\<cdot> _ \\<bullet> (option.case_2 \\<cdot> _ \\<cdot> P \\<cdot> p \\<bullet> arity_type_bool \\<bullet> c)\"\n\n  disjI1 (Q): \"None\"\n    \"\\<^bold>\\<lambda>(c: _) P Q. iffD2 \\<cdot> _ \\<cdot> _ \\<bullet> (option.case_1 \\<cdot> _ \\<cdot> _ \\<bullet> arity_type_bool \\<bullet> c)\"\n\n  disjI1: \"Left\"\n    \"\\<^bold>\\<lambda>P Q. iffD2 \\<cdot> _ \\<cdot> _ \\<bullet> (sumbool.case_1 \\<cdot> _ \\<cdot> _ \\<bullet> arity_type_bool)\"\n\n  disjI2 (P, Q): \"Inr\"\n    \"\\<^bold>\\<lambda>(d: _) (c: _) Q P q. iffD2 \\<cdot> _ \\<cdot> _ \\<bullet> (sum.case_2 \\<cdot> _ \\<cdot> Q \\<cdot> q \\<bullet> arity_type_bool \\<bullet> c \\<bullet> d)\"\n\n  disjI2 (P): \"None\"\n    \"\\<^bold>\\<lambda>(c: _) Q P. iffD2 \\<cdot> _ \\<cdot> _ \\<bullet> (option.case_1 \\<cdot> _ \\<cdot> _ \\<bullet> arity_type_bool \\<bullet> c)\"\n\n  disjI2 (Q): \"Some\"\n    \"\\<^bold>\\<lambda>(c: _) Q P q. iffD2 \\<cdot> _ \\<cdot> _ \\<bullet> (option.case_2 \\<cdot> _ \\<cdot> Q \\<cdot> q \\<bullet> arity_type_bool \\<bullet> c)\"\n\n  disjI2: \"Right\"\n    \"\\<^bold>\\<lambda>Q P. iffD2 \\<cdot> _ \\<cdot> _ \\<bullet> (sumbool.case_2 \\<cdot> _ \\<cdot> _ \\<bullet> arity_type_bool)\"\n\n  disjE (P, Q, R): \"\\<lambda>pq pr qr.\n     (case pq of Inl p \\<Rightarrow> pr p | Inr q \\<Rightarrow> qr q)\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) (e: _) P Q R pq (h1: _) pr (h2: _) qr.\n       disjE_realizer \\<cdot> _ \\<cdot> _ \\<cdot> pq \\<cdot> R \\<cdot> pr \\<cdot> qr \\<bullet> c \\<bullet> d \\<bullet> e \\<bullet> h1 \\<bullet> h2\"\n\n  disjE (Q, R): \"\\<lambda>pq pr qr.\n     (case pq of None \\<Rightarrow> pr | Some q \\<Rightarrow> qr q)\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q R pq (h1: _) pr (h2: _) qr.\n       disjE_realizer2 \\<cdot> _ \\<cdot> _ \\<cdot> pq \\<cdot> R \\<cdot> pr \\<cdot> qr \\<bullet> c \\<bullet> d \\<bullet> h1 \\<bullet> h2\"\n\n  disjE (P, R): \"\\<lambda>pq pr qr.\n     (case pq of None \\<Rightarrow> qr | Some p \\<Rightarrow> pr p)\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q R pq (h1: _) pr (h2: _) qr (h3: _).\n       disjE_realizer2 \\<cdot> _ \\<cdot> _ \\<cdot> pq \\<cdot> R \\<cdot> qr \\<cdot> pr \\<bullet> c \\<bullet> d \\<bullet> h1 \\<bullet> h3 \\<bullet> h2\"\n\n  disjE (R): \"\\<lambda>pq pr qr.\n     (case pq of Left \\<Rightarrow> pr | Right \\<Rightarrow> qr)\"\n    \"\\<^bold>\\<lambda>(c: _) P Q R pq (h1: _) pr (h2: _) qr.\n       disjE_realizer3 \\<cdot> _ \\<cdot> _ \\<cdot> pq \\<cdot> R \\<cdot> pr \\<cdot> qr \\<bullet> c \\<bullet> h1 \\<bullet> h2\"\n\n  disjE (P, Q): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q R pq. disjE_realizer \\<cdot> _ \\<cdot> _ \\<cdot> pq \\<cdot> (\\<lambda>x. R) \\<cdot> _ \\<cdot> _ \\<bullet> c \\<bullet> d \\<bullet> arity_type_bool\"\n\n  disjE (Q): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) P Q R pq. disjE_realizer2 \\<cdot> _ \\<cdot> _ \\<cdot> pq \\<cdot> (\\<lambda>x. R) \\<cdot> _ \\<cdot> _ \\<bullet> c \\<bullet> arity_type_bool\"\n\n  disjE (P): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) P Q R pq (h1: _) (h2: _) (h3: _).\n       disjE_realizer2 \\<cdot> _ \\<cdot> _ \\<cdot> pq \\<cdot> (\\<lambda>x. R) \\<cdot> _ \\<cdot> _ \\<bullet> c \\<bullet> arity_type_bool \\<bullet> h1 \\<bullet> h3 \\<bullet> h2\"\n\n  disjE: \"Null\"\n    \"\\<^bold>\\<lambda>P Q R pq. disjE_realizer3 \\<cdot> _ \\<cdot> _ \\<cdot> pq \\<cdot> (\\<lambda>x. R) \\<cdot> _ \\<cdot> _ \\<bullet> arity_type_bool\"\n\n  FalseE (P): \"default\"\n    \"\\<^bold>\\<lambda>(c: _) P. FalseE \\<cdot> _\"\n\n  FalseE: \"Null\" \"FalseE\"\n\n  notI (P): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) P (h: _). allI \\<cdot> _ \\<bullet> c \\<bullet> (\\<^bold>\\<lambda>x. notI \\<cdot> _ \\<bullet> (h \\<cdot> x))\"\n\n  notI: \"Null\" \"notI\"\n\n  notE (P, R): \"\\<lambda>p. default\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P R (h: _) p. notE \\<cdot> _ \\<cdot> _ \\<bullet> (spec \\<cdot> _ \\<cdot> p \\<bullet> c \\<bullet> h)\"\n\n  notE (P): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) P R (h: _) p. notE \\<cdot> _ \\<cdot> _ \\<bullet> (spec \\<cdot> _ \\<cdot> p \\<bullet> c \\<bullet> h)\"\n\n  notE (R): \"default\"\n    \"\\<^bold>\\<lambda>(c: _) P R. notE \\<cdot> _ \\<cdot> _\"\n\n  notE: \"Null\" \"notE\"\n\n  subst (P): \"\\<lambda>s t ps. ps\"\n    \"\\<^bold>\\<lambda>(c: _) s t P (d: _) (h: _) ps. subst \\<cdot> s \\<cdot> t \\<cdot> P ps \\<bullet> d \\<bullet> h\"\n\n  subst: \"Null\" \"subst\"\n\n  iffD1 (P, Q): \"fst\"\n    \"\\<^bold>\\<lambda>(d: _) (c: _) Q P pq (h: _) p.\n       mp \\<cdot> _ \\<cdot> _ \\<bullet> (spec \\<cdot> _ \\<cdot> p \\<bullet> d \\<bullet> (conjunct1 \\<cdot> _ \\<cdot> _ \\<bullet> h))\"\n\n  iffD1 (P): \"\\<lambda>p. p\"\n    \"\\<^bold>\\<lambda>(c: _) Q P p (h: _). mp \\<cdot> _ \\<cdot> _ \\<bullet> (conjunct1 \\<cdot> _ \\<cdot> _ \\<bullet> h)\"\n\n  iffD1 (Q): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) Q P q1 (h: _) q2.\n       mp \\<cdot> _ \\<cdot> _ \\<bullet> (spec \\<cdot> _ \\<cdot> q2 \\<bullet> c \\<bullet> (conjunct1 \\<cdot> _ \\<cdot> _ \\<bullet> h))\"\n\n  iffD1: \"Null\" \"iffD1\"\n\n  iffD2 (P, Q): \"snd\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q pq (h: _) q.\n       mp \\<cdot> _ \\<cdot> _ \\<bullet> (spec \\<cdot> _ \\<cdot> q \\<bullet> d \\<bullet> (conjunct2 \\<cdot> _ \\<cdot> _ \\<bullet> h))\"\n\n  iffD2 (P): \"\\<lambda>p. p\"\n    \"\\<^bold>\\<lambda>(c: _) P Q p (h: _). mp \\<cdot> _ \\<cdot> _ \\<bullet> (conjunct2 \\<cdot> _ \\<cdot> _ \\<bullet> h)\"\n\n  iffD2 (Q): \"Null\"\n    \"\\<^bold>\\<lambda>(c: _) P Q q1 (h: _) q2.\n       mp \\<cdot> _ \\<cdot> _ \\<bullet> (spec \\<cdot> _ \\<cdot> q2 \\<bullet> c \\<bullet> (conjunct2 \\<cdot> _ \\<cdot> _ \\<bullet> h))\"\n\n  iffD2: \"Null\" \"iffD2\"\n\n  iffI (P, Q): \"Pair\"\n    \"\\<^bold>\\<lambda>(c: _) (d: _) P Q pq (h1 : _) qp (h2 : _). conjI_realizer \\<cdot>\n       (\\<lambda>pq. \\<forall>x. P x \\<longrightarrow> Q (pq x)) \\<cdot> pq \\<cdot>\n       (\\<lambda>qp. \\<forall>x. Q x \\<longrightarrow> P (qp x)) \\<cdot> qp \\<bullet>\n       (arity_type_fun \\<bullet> c \\<bullet> d) \\<bullet>\n       (arity_type_fun \\<bullet> d \\<bullet> c) \\<bullet>\n       (allI \\<cdot> _ \\<bullet> c \\<bullet> (\\<^bold>\\<lambda>x. impI \\<cdot> _ \\<cdot> _ \\<bullet> (h1 \\<cdot> x))) \\<bullet>\n       (allI \\<cdot> _ \\<bullet> d \\<bullet> (\\<^bold>\\<lambda>x. impI \\<cdot> _ \\<cdot> _ \\<bullet> (h2 \\<cdot> x)))\"\n\n  iffI (P): \"\\<lambda>p. p\"\n    \"\\<^bold>\\<lambda>(c: _) P Q (h1 : _) p (h2 : _). conjI \\<cdot> _ \\<cdot> _ \\<bullet>\n       (allI \\<cdot> _ \\<bullet> c \\<bullet> (\\<^bold>\\<lambda>x. impI \\<cdot> _ \\<cdot> _ \\<bullet> (h1 \\<cdot> x))) \\<bullet>\n       (impI \\<cdot> _ \\<cdot> _ \\<bullet> h2)\"\n\n  iffI (Q): \"\\<lambda>q. q\"\n    \"\\<^bold>\\<lambda>(c: _) P Q q (h1 : _) (h2 : _). conjI \\<cdot> _ \\<cdot> _ \\<bullet>\n       (impI \\<cdot> _ \\<cdot> _ \\<bullet> h1) \\<bullet>\n       (allI \\<cdot> _ \\<bullet> c \\<bullet> (\\<^bold>\\<lambda>x. impI \\<cdot> _ \\<cdot> _ \\<bullet> (h2 \\<cdot> x)))\"\n\n  iffI: \"Null\" \"iffI\"\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Extraction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953651858118, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.30901686245007903}}
{"text": "theory M_Basic_No_Repl\n  imports \"ZF-Constructible.Relative\"\nbegin\n\ntxt\\<open>This locale is exactly \\<^locale>\\<open>M_basic\\<close> without its only replacement\ninstance.\\<close>\n\nlocale M_basic_no_repl = M_trivial +\n  assumes Inter_separation:\n    \"M(A) ==> separation(M, \\<lambda>x. \\<forall>y[M]. y\\<in>A \\<longrightarrow> x\\<in>y)\"\n    and Diff_separation:\n    \"M(B) ==> separation(M, \\<lambda>x. x \\<notin> B)\"\n    and cartprod_separation:\n    \"[| M(A); M(B) |]\n      ==> separation(M, \\<lambda>z. \\<exists>x[M]. x\\<in>A & (\\<exists>y[M]. y\\<in>B & pair(M,x,y,z)))\"\n    and image_separation:\n    \"[| M(A); M(r) |]\n      ==> separation(M, \\<lambda>y. \\<exists>p[M]. p\\<in>r & (\\<exists>x[M]. x\\<in>A & pair(M,x,y,p)))\"\n    and converse_separation:\n    \"M(r) ==> separation(M,\n         \\<lambda>z. \\<exists>p[M]. p\\<in>r & (\\<exists>x[M]. \\<exists>y[M]. pair(M,x,y,p) & pair(M,y,x,z)))\"\n    and restrict_separation:\n    \"M(A) ==> separation(M, \\<lambda>z. \\<exists>x[M]. x\\<in>A & (\\<exists>y[M]. pair(M,x,y,z)))\"\n    and comp_separation:\n    \"[| M(r); M(s) |]\n      ==> separation(M, \\<lambda>xz. \\<exists>x[M]. \\<exists>y[M]. \\<exists>z[M]. \\<exists>xy[M]. \\<exists>yz[M].\n                  pair(M,x,z,xz) & pair(M,x,y,xy) & pair(M,y,z,yz) &\n                  xy\\<in>s & yz\\<in>r)\"\n    and pred_separation:\n    \"[| M(r); M(x) |] ==> separation(M, \\<lambda>y. \\<exists>p[M]. p\\<in>r & pair(M,y,x,p))\"\n    and Memrel_separation:\n    \"separation(M, \\<lambda>z. \\<exists>x[M]. \\<exists>y[M]. pair(M,x,y,z) & x \\<in> y)\"\n    and is_recfun_separation:\n    \\<comment> \\<open>for well-founded recursion: used to prove \\<open>is_recfun_equal\\<close>\\<close>\n    \"[| M(r); M(f); M(g); M(a); M(b) |]\n     ==> separation(M,\n            \\<lambda>x. \\<exists>xa[M]. \\<exists>xb[M].\n                pair(M,x,a,xa) & xa \\<in> r & pair(M,x,b,xb) & xb \\<in> r &\n                (\\<exists>fx[M]. \\<exists>gx[M]. fun_apply(M,f,x,fx) & fun_apply(M,g,x,gx) &\n                                   fx \\<noteq> gx))\"\n    and power_ax:         \"power_ax(M)\"\n\nlemma (in M_basic_no_repl) cartprod_iff:\n  \"[| M(A); M(B); M(C) |]\n      ==> cartprod(M,A,B,C) \\<longleftrightarrow>\n          (\\<exists>p1[M]. \\<exists>p2[M]. powerset(M,A \\<union> B,p1) & powerset(M,p1,p2) &\n                   C = {z \\<in> p2. \\<exists>x\\<in>A. \\<exists>y\\<in>B. z = <x,y>})\"\n  apply (simp add: Pair_def cartprod_def, safe)\n    defer 1\n    apply (simp add: powerset_def)\n   apply blast\n  txt\\<open>Final, difficult case: the left-to-right direction of the theorem.\\<close>\n  apply (insert power_ax, simp add: power_ax_def)\n  apply (frule_tac x=\"A \\<union> B\" and P=\"\\<lambda>x. rex(M,Q(x))\" for Q in rspec)\n   apply (blast, clarify)\n  apply (drule_tac x=z and P=\"\\<lambda>x. rex(M,Q(x))\" for Q in rspec)\n   apply assumption\n  apply (blast intro: cartprod_iff_lemma)\n  done\n\nlemma (in M_basic_no_repl) cartprod_closed_lemma:\n  \"[| M(A); M(B) |] ==> \\<exists>C[M]. cartprod(M,A,B,C)\"\n  apply (simp del: cartprod_abs add: cartprod_iff)\n  apply (insert power_ax, simp add: power_ax_def)\n  apply (frule_tac x=\"A \\<union> B\" and P=\"\\<lambda>x. rex(M,Q(x))\" for Q in rspec)\n   apply (blast, clarify)\n  apply (drule_tac x=z and P=\"\\<lambda>x. rex(M,Q(x))\" for Q in rspec, auto)\n  apply (intro rexI conjI, simp+)\n  apply (insert cartprod_separation [of A B], simp)\n  done\n\ntext\\<open>All the lemmas above are necessary because Powerset is not absolute.\n      I should have used Replacement instead!\\<close>\nlemma (in M_basic_no_repl) cartprod_closed [intro,simp]:\n  \"[| M(A); M(B) |] ==> M(A*B)\"\n  by (frule cartprod_closed_lemma, assumption, force)\n\nlemma (in M_basic_no_repl) sum_closed [intro,simp]:\n  \"[| M(A); M(B) |] ==> M(A+B)\"\n  by (simp add: sum_def)\n\nlemma (in M_basic_no_repl) sum_abs [simp]:\n  \"[| M(A); M(B); M(Z) |] ==> is_sum(M,A,B,Z) \\<longleftrightarrow> (Z = A+B)\"\n  by (simp add: is_sum_def sum_def singleton_0 nat_into_M)\n\nlemma (in M_basic_no_repl) M_converse_iff:\n  \"M(r) ==>\n      converse(r) =\n      {z \\<in> \\<Union>(\\<Union>(r)) * \\<Union>(\\<Union>(r)).\n       \\<exists>p\\<in>r. \\<exists>x[M]. \\<exists>y[M]. p = \\<langle>x,y\\<rangle> & z = \\<langle>y,x\\<rangle>}\"\n  apply (rule equalityI)\n   prefer 2 apply (blast dest: transM, clarify, simp)\n  apply (simp add: Pair_def)\n  apply (blast dest: transM)\n  done\n\nlemma (in M_basic_no_repl) converse_closed [intro,simp]:\n  \"M(r) ==> M(converse(r))\"\n  apply (simp add: M_converse_iff)\n  apply (insert converse_separation [of r], simp)\n  done\n\nlemma (in M_basic_no_repl) converse_abs [simp]:\n  \"[| M(r); M(z) |] ==> is_converse(M,r,z) \\<longleftrightarrow> z = converse(r)\"\n  apply (simp add: is_converse_def)\n  apply (rule iffI)\n   prefer 2 apply blast\n  apply (rule M_equalityI)\n    apply simp\n    apply (blast dest: transM)+\n  done\n\n\nsubsubsection \\<open>image, preimage, domain, range\\<close>\n\nlemma (in M_basic_no_repl) image_closed [intro,simp]:\n  \"[| M(A); M(r) |] ==> M(r``A)\"\n  apply (simp add: image_iff_Collect)\n  apply (insert image_separation [of A r], simp)\n  done\n\nlemma (in M_basic_no_repl) vimage_abs [simp]:\n  \"[| M(r); M(A); M(z) |] ==> pre_image(M,r,A,z) \\<longleftrightarrow> z = r-``A\"\n  apply (simp add: pre_image_def)\n  apply (rule iffI)\n   apply (blast intro!: equalityI dest: transM, blast)\n  done\n\nlemma (in M_basic_no_repl) vimage_closed [intro,simp]:\n  \"[| M(A); M(r) |] ==> M(r-``A)\"\n  by (simp add: vimage_def)\n\n\nsubsubsection\\<open>Domain, range and field\\<close>\n\nlemma (in M_basic_no_repl) domain_closed [intro,simp]:\n  \"M(r) ==> M(domain(r))\"\n  apply (simp add: domain_eq_vimage)\n  done\n\nlemma (in M_basic_no_repl) range_closed [intro,simp]:\n  \"M(r) ==> M(range(r))\"\n  apply (simp add: range_eq_image)\n  done\n\nlemma (in M_basic_no_repl) field_abs [simp]:\n  \"[| M(r); M(z) |] ==> is_field(M,r,z) \\<longleftrightarrow> z = field(r)\"\n  by (simp add: is_field_def field_def)\n\nlemma (in M_basic_no_repl) field_closed [intro,simp]:\n  \"M(r) ==> M(field(r))\"\n  by (simp add: field_def)\n\n\nsubsubsection\\<open>Relations, functions and application\\<close>\n\nlemma (in M_basic_no_repl) apply_closed [intro,simp]:\n  \"[|M(f); M(a)|] ==> M(f`a)\"\n  by (simp add: apply_def)\n\nlemma (in M_basic_no_repl) apply_abs [simp]:\n  \"[| M(f); M(x); M(y) |] ==> fun_apply(M,f,x,y) \\<longleftrightarrow> f`x = y\"\n  apply (simp add: fun_apply_def apply_def, blast)\n  done\n\nlemma (in M_basic_no_repl) injection_abs [simp]:\n  \"[| M(A); M(f) |] ==> injection(M,A,B,f) \\<longleftrightarrow> f \\<in> inj(A,B)\"\n  apply (simp add: injection_def apply_iff inj_def)\n  apply (blast dest: transM [of _ A])\n  done\n\nlemma (in M_basic_no_repl) surjection_abs [simp]:\n  \"[| M(A); M(B); M(f) |] ==> surjection(M,A,B,f) \\<longleftrightarrow> f \\<in> surj(A,B)\"\n  by (simp add: surjection_def surj_def)\n\nlemma (in M_basic_no_repl) bijection_abs [simp]:\n  \"[| M(A); M(B); M(f) |] ==> bijection(M,A,B,f) \\<longleftrightarrow> f \\<in> bij(A,B)\"\n  by (simp add: bijection_def bij_def)\n\n\nsubsubsection\\<open>Composition of relations\\<close>\n\nlemma (in M_basic_no_repl) M_comp_iff:\n  \"[| M(r); M(s) |]\n      ==> r O s =\n          {xz \\<in> domain(s) * range(r).\n            \\<exists>x[M]. \\<exists>y[M]. \\<exists>z[M]. xz = \\<langle>x,z\\<rangle> & \\<langle>x,y\\<rangle> \\<in> s & \\<langle>y,z\\<rangle> \\<in> r}\"\n  apply (simp add: comp_def)\n  apply (rule equalityI)\n   apply clarify\n   apply simp\n   apply  (blast dest:  transM)+\n  done\n\nlemma (in M_basic_no_repl) comp_closed [intro,simp]:\n  \"[| M(r); M(s) |] ==> M(r O s)\"\n  apply (simp add: M_comp_iff)\n  apply (insert comp_separation [of r s], simp)\n  done\n\nlemma (in M_basic_no_repl) composition_abs [simp]:\n  \"[| M(r); M(s); M(t) |] ==> composition(M,r,s,t) \\<longleftrightarrow> t = r O s\"\n  apply safe\n  txt\\<open>Proving \\<^term>\\<open>composition(M, r, s, r O s)\\<close>\\<close>\n   prefer 2\n   apply (simp add: composition_def comp_def)\n   apply (blast dest: transM)\n  txt\\<open>Opposite implication\\<close>\n  apply (rule M_equalityI)\n    apply (simp add: composition_def comp_def)\n    apply (blast del: allE dest: transM)+\n  done\n\ntext\\<open>no longer needed\\<close>\nlemma (in M_basic_no_repl) restriction_is_function:\n  \"[| restriction(M,f,A,z); function(f); M(f); M(A); M(z) |]\n      ==> function(z)\"\n  apply (simp add: restriction_def ball_iff_equiv)\n  apply (unfold function_def, blast)\n  done\n\nlemma (in M_basic_no_repl) restrict_closed [intro,simp]:\n  \"[| M(A); M(r) |] ==> M(restrict(r,A))\"\n  apply (simp add: M_restrict_iff)\n  apply (insert restrict_separation [of A], simp)\n  done\n\nlemma (in M_basic_no_repl) Inter_closed [intro,simp]:\n  \"M(A) ==> M(\\<Inter>(A))\"\n  by (insert Inter_separation, simp add: Inter_def)\n\nlemma (in M_basic_no_repl) Int_closed [intro,simp]:\n  \"[| M(A); M(B) |] ==> M(A \\<inter> B)\"\n  apply (subgoal_tac \"M({A,B})\")\n   apply (frule Inter_closed, force+)\n  done\n\nlemma (in M_basic_no_repl) Diff_closed [intro,simp]:\n  \"[|M(A); M(B)|] ==> M(A-B)\"\n  by (insert Diff_separation, simp add: Diff_def)\n\nsubsubsection\\<open>Some Facts About Separation Axioms\\<close>\n\nlemma (in M_basic_no_repl) separation_conj:\n  \"[|separation(M,P); separation(M,Q)|] ==> separation(M, \\<lambda>z. P(z) & Q(z))\"\n  by (simp del: separation_closed\n      add: separation_iff Collect_Int_Collect_eq [symmetric])\n\nlemma (in M_basic_no_repl) separation_disj:\n  \"[|separation(M,P); separation(M,Q)|] ==> separation(M, \\<lambda>z. P(z) | Q(z))\"\n  by (simp del: separation_closed\n      add: separation_iff Collect_Un_Collect_eq [symmetric])\n\nlemma (in M_basic_no_repl) separation_neg:\n  \"separation(M,P) ==> separation(M, \\<lambda>z. ~P(z))\"\n  by (simp del: separation_closed\n      add: separation_iff Diff_Collect_eq [symmetric])\n\nlemma (in M_basic_no_repl) separation_imp:\n  \"[|separation(M,P); separation(M,Q)|]\n      ==> separation(M, \\<lambda>z. P(z) \\<longrightarrow> Q(z))\"\n  by (simp add: separation_neg separation_disj not_disj_iff_imp [symmetric])\n\ntext\\<open>This result is a hint of how little can be done without the Reflection\n  Theorem.  The quantifier has to be bounded by a set.  We also need another\n  instance of Separation!\\<close>\nlemma (in M_basic_no_repl) separation_rall:\n  \"[|M(Y); \\<forall>y[M]. separation(M, \\<lambda>x. P(x,y));\n        \\<forall>z[M]. strong_replacement(M, \\<lambda>x y. y = {u \\<in> z . P(u,x)})|]\n      ==> separation(M, \\<lambda>x. \\<forall>y[M]. y\\<in>Y \\<longrightarrow> P(x,y))\"\n  apply (simp del: separation_closed rall_abs\n      add: separation_iff Collect_rall_eq)\n  apply (blast intro!:  RepFun_closed dest: transM)\n  done\n\n\nsubsubsection\\<open>Functions and function space\\<close>\n\nlemma (in M_basic_no_repl) succ_fun_eq2:\n  \"[|M(B); M(n->B)|] ==>\n      succ(n) -> B =\n      \\<Union>{z. p \\<in> (n->B)*B, \\<exists>f[M]. \\<exists>b[M]. p = <f,b> & z = {cons(<n,b>, f)}}\"\n  apply (simp add: succ_fun_eq)\n  apply (blast dest: transM)\n  done\n\nlemma (in M_basic_no_repl) list_case'_closed [intro,simp]:\n  \"[|M(k); M(a); \\<forall>x[M]. \\<forall>y[M]. M(b(x,y))|] ==> M(list_case'(a,b,k))\"\n  apply (case_tac \"quasilist(k)\")\n   apply (simp add: quasilist_def, force)\n  apply (simp add: non_list_case)\n  done\n\nlemma (in M_basic_no_repl) tl'_closed: \"M(x) ==> M(tl'(x))\"\n  apply (simp add: tl'_def)\n  apply (force simp add: quasilist_def)\n  done\n\nsublocale M_basic \\<subseteq> mbnr:M_basic_no_repl\n  using Inter_separation Diff_separation cartprod_separation image_separation\n    converse_separation restrict_separation comp_separation pred_separation\n    Memrel_separation is_recfun_separation power_ax by unfold_locales\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Transitive_Models/M_Basic_No_Repl.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.30901686245007903}}
{"text": "theory Proof_3_6\n  imports Proofs_3\nbegin\n\nthm VC6_def\n\ncontext\n  fixes s2 s0:: state\nfixes user_value pressure_value:: bool\nassumes toEnvPs2:  \"toEnvP s2 \\<and> toEnvP s0\" and extraInvs0: \"extraInv s0\" \nand vc: \" env (setVarAny s0 user_value pressure_value) \\<and>\n         getPstate (setVarAny s0 user_value pressure_value) ERROR = Controller'rotating \\<and>\n getVarBool (setVarAny s0 user_value pressure_value) pressure \\<and>\n\\<not> DELAY'TIMEOUT\n   \\<le> ltime\n       (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) ERROR\n         Controller'suspended)\n       ERROR\"\nbegin\n\nlemma VC6_R3_ind_step_aux1: \" toEnvP s2a \\<Longrightarrow>\n         substate s2 s2a \\<and>\n         substate s2a\n        (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n         s2 \\<noteq> s2a \\<Longrightarrow>\n         substate s1 s2 \\<and>\n         substate s2\n          (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n         toEnvP s1 \\<and>\n         toEnvP s2 \\<and>\n         toEnvNum s1 s2 = ERROR \\<and>\n         DELAY'TIMEOUT =\n         toEnvNum s2\n          (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n         getVarBool s1 rotation = True \\<and>\n         \\<not> getVarBool s2 user \\<and>\n         (\\<forall>s4. toEnvP s4 \\<and> substate s2 s4 \\<and> substate s4 s2a \\<and> s4 \\<noteq> s2a \\<longrightarrow>\n               getVarBool s4 rotation = True \\<and> \\<not> getVarBool s4 user) \\<longrightarrow>\n         (\\<exists>s4. toEnvP s4 \\<and>\n               substate s2a s4 \\<and>\n               substate s4\n                (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n               toEnvNum s2 s4 \\<le> DELAY'TIMEOUT \\<and>\n               (getVarBool s4 rotation = False \\<or> getVarBool s4 user) \\<and>\n               (\\<forall>s3. toEnvP s3 \\<and> substate s2a s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                     getVarBool s3 rotation = True \\<and> \\<not> getVarBool s3 user)) \\<Longrightarrow>\n         substate s1 s2 \\<and>\n         substate s2\n         (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended))\\<and>\n         toEnvP s1 \\<and>\n         toEnvP s2 \\<and>\n         toEnvNum s1 s2 = ERROR \\<and>\n         DELAY'TIMEOUT =\n         toEnvNum s2\n         (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n         getVarBool s1 rotation = True \\<and>\n         \\<not> getVarBool s2 user \\<and>\n         (\\<forall>s4. toEnvP s4 \\<and> substate s2 s4 \\<and> substate s4 (predEnv s2a) \\<and> s4 \\<noteq> predEnv s2a \\<longrightarrow>\n               getVarBool s4 rotation = True \\<and> \\<not> getVarBool s4 user) \\<Longrightarrow>\n         \\<not> (getVarBool (predEnv s2a) rotation = False \\<or> getVarBool (predEnv s2a) user) \\<Longrightarrow>\n         toEnvP x \\<and>\n         substate s2a x \\<and>\n         substate x\n         (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n         toEnvNum s2 x \\<le> DELAY'TIMEOUT \\<and>\n         (getVarBool x rotation = False \\<or> getVarBool x user) \\<and>\n         (\\<forall>s3. toEnvP s3 \\<and> substate s2a s3 \\<and> substate s3 x \\<and> s3 \\<noteq> x \\<longrightarrow>\n               getVarBool s3 rotation = True \\<and> \\<not> getVarBool s3 user) \\<Longrightarrow>\n         \\<exists>s4. toEnvP s4 \\<and>\n              substate (predEnv s2a) s4 \\<and>\n              substate s4\n              (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n              toEnvNum s2 s4 \\<le> DELAY'TIMEOUT \\<and>\n              (getVarBool s4 rotation = False \\<or> getVarBool s4 user) \\<and>\n              (\\<forall>s3. toEnvP s3 \\<and> substate (predEnv s2a) s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                    getVarBool s3 rotation = True \\<and> \\<not> getVarBool s3 user)\"\n  apply(rule exI[of _ x])\n  by (smt (z3) predEnv_substate predEnv_substate_imp_eq_or_substate substate_trans)\n  \nlemma VC6_R3_ind_step: \" toEnvP s2a \\<Longrightarrow>\n           substate s2 s2a \\<and>\n           substate s2a\n           (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n           s2 \\<noteq> s2a \\<Longrightarrow>\n           substate s1 s2 \\<and>\n           substate s2\n           (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n           toEnvP s1 \\<and>\n           toEnvP s2 \\<and>\n           toEnvNum s1 s2 = ERROR \\<and>\n           DELAY'TIMEOUT =\n           toEnvNum s2\n            (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n           getVarBool s1 rotation = True \\<and>\n           \\<not> getVarBool s2 user \\<and>\n           (\\<forall>s4. toEnvP s4 \\<and> substate s2 s4 \\<and> substate s4 s2a \\<and> s4 \\<noteq> s2a \\<longrightarrow>\n                 getVarBool s4 rotation = True \\<and> \\<not> getVarBool s4 user) \\<longrightarrow>\n           (\\<exists>s4. toEnvP s4 \\<and>\n                 substate s2a s4 \\<and>\n                 substate s4\n                 (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n                 toEnvNum s2 s4 \\<le> DELAY'TIMEOUT \\<and>\n                 (getVarBool s4 rotation = False \\<or> getVarBool s4 user) \\<and>\n                 (\\<forall>s3. toEnvP s3 \\<and> substate s2a s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                       getVarBool s3 rotation = True \\<and> \\<not> getVarBool s3 user)) \\<Longrightarrow>\n           substate s1 s2 \\<and>\n           substate s2\n           (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n           toEnvP s1 \\<and>\n           toEnvP s2 \\<and>\n           toEnvNum s1 s2 = ERROR \\<and>\n           DELAY'TIMEOUT =\n           toEnvNum s2\n            (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n           getVarBool s1 rotation = True \\<and>\n           \\<not> getVarBool s2 user \\<and>\n           (\\<forall>s4. toEnvP s4 \\<and> substate s2 s4 \\<and> substate s4 (predEnv s2a) \\<and> s4 \\<noteq> predEnv s2a \\<longrightarrow>\n                 getVarBool s4 rotation = True \\<and> \\<not> getVarBool s4 user) \\<longrightarrow>\n           (\\<exists>s4. toEnvP s4 \\<and>\n                 substate (predEnv s2a) s4 \\<and>\n                 substate s4\n                 (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n                 toEnvNum s2 s4 \\<le> DELAY'TIMEOUT \\<and>\n                 (getVarBool s4 rotation = False \\<or> getVarBool s4 user) \\<and>\n                 (\\<forall>s3. toEnvP s3 \\<and> substate (predEnv s2a) s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                       getVarBool s3 rotation = True \\<and> \\<not> getVarBool s3 user))\"\n  apply(rule impI)\n  apply(cases \"(getVarBool (predEnv s2a) rotation = False \\<or> getVarBool (predEnv s2a) user)\")\n   apply(rule exI[of _ \"predEnv s2a\"])\n   apply(rule conjI)\n    apply(rule toEnvP_substate_pred_imp_toEnvP_pred[of s2])\n  using toEnvPs2 substate_eq_or_predEnv apply fast\n   apply(rule conjI)\n  using substate_refl apply fast\n   apply(rule conjI)\n  using predEnv_substate substate_trans apply fast\n   apply(rule conjI)\n    apply(rule cut_rl[of \"substate s2 (predEnv s2a) \\<and>\n substate (predEnv s2a)\n(toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended))\"])\n  using toEnvNum3[of s2 \"predEnv s2a\" \n\"(toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended))\"]\n     apply arith\n  using substate_eq_or_predEnv predEnv_substate substate_trans apply fast\n   apply(rule conjI)\n    apply assumption\n  using substate_asym apply fast\n  apply(rule exE[of \"\\<lambda> s4. toEnvP s4 \\<and>\n          substate s2a s4 \\<and>\n          substate s4\n          (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended)) \\<and>\n          toEnvNum s2 s4 \\<le> DELAY'TIMEOUT \\<and>\n          (getVarBool s4 rotation = False \\<or> getVarBool s4 user) \\<and>\n          (\\<forall>s3. toEnvP s3 \\<and> substate s2a s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                getVarBool s3 rotation = True \\<and> \\<not> getVarBool s3 user)\"])\n  using substate_eq_or_predEnv apply blast\n  by (rule VC6_R3_ind_step_aux1)\n\n \nlemma VC6_R3_ind_proof:   \"toEnvP s5 \\<and>  substate s2 s5 \\<and>\n substate s5 (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended))\n \\<longrightarrow> pred3 s1 s2 (toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended))\n s5\"\n  apply(induction rule: state_down_ind)\n  using toEnvPs2 apply simp\n   apply(simp only: pred3_def)\n   apply(rule impI)\n  apply(rule exI[of _ \"(toEnv\n   (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) Controller\n     Controller'suspended))\"])\n   apply(rule conjI)\n    apply simp\n   apply(rule conjI)\n    apply simp\napply(rule conjI)\n    apply simp\napply(rule conjI)\n    apply simp\napply(rule conjI)\n    apply simp\n  using substate_asym apply blast\n   apply(simp only: pred3_def) \n  by ((rule VC6_R3_ind_step);fast) \nend\n\n\nlemma VC6_R3: \" (((((toEnvP s0 \\<and>\n            (\\<forall>s1 s2.\n                substate s1 s2 \\<and>\n                substate s2 s0 \\<and>\n                toEnvP s1 \\<and>\n                toEnvP s2 \\<and>\n                toEnvNum s1 s2 = ERROR \\<and>\n                DELAY'TIMEOUT \\<le> toEnvNum s2 s0 \\<and> getVarBool s1 rotation = True \\<and> \\<not> getVarBool s2 user \\<longrightarrow>\n                (\\<exists>s4. toEnvP s4 \\<and>\n                      substate s2 s4 \\<and>\n                      substate s4 s0 \\<and>\n                      toEnvNum s2 s4 \\<le> DELAY'TIMEOUT \\<and>\n                      (getVarBool s4 rotation = False \\<or> getVarBool s4 user) \\<and>\n                      (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                            getVarBool s3 rotation = True \\<and> \\<not> getVarBool s3 user)))) \\<and>\n           extraInv s0) \\<and>\n          env (setVarAny s0 user_value pressure_value)) \\<and>\n         getPstate (setVarAny s0 user_value pressure_value) ERROR = Controller'rotating) \\<and>\n        getVarBool (setVarAny s0 user_value pressure_value) pressure) \\<and>\n       \\<not> DELAY'TIMEOUT\n          \\<le> ltime\n              (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True)\n                ERROR Controller'suspended)\n              ERROR \\<Longrightarrow>\n       substate s1 s2 \\<and>\n       substate s2\n        (toEnv\n          (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) ERROR\n            Controller'suspended)) \\<and>\n       toEnvP s1 \\<and>\n       toEnvP s2 \\<and>\n       toEnvNum s1 s2 = ERROR \\<and>\n       DELAY'TIMEOUT\n       \\<le> toEnvNum s2\n           (toEnv\n             (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True)\n               ERROR Controller'suspended)) \\<and>\n       getVarBool s1 rotation = True \\<and> \\<not> getVarBool s2 user \\<longrightarrow>\n       (\\<exists>s4. toEnvP s4 \\<and>\n             substate s2 s4 \\<and>\n             substate s4\n              (toEnv\n                (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True)\n                  ERROR Controller'suspended)) \\<and>\n             toEnvNum s2 s4 \\<le> DELAY'TIMEOUT \\<and>\n             (getVarBool s4 rotation = False \\<or> getVarBool s4 user) \\<and>\n             (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                   getVarBool s3 rotation = True \\<and> \\<not> getVarBool s3 user))\"\n  apply(rule impI)\n  apply(rule disjE[of \"DELAY'TIMEOUT < toEnvNum s2 (toEnv\n          (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) ERROR\n            Controller'suspended))\"\n\"DELAY'TIMEOUT = toEnvNum s2 (toEnv\n          (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) ERROR\n            Controller'suspended))\"])\n  using le_imp_less_or_eq apply fast\n   apply(rule cut_rl[of \"substate s2 s0 \\<and> toEnvNum s2 s0 \\<ge> DELAY'TIMEOUT\"])\n  apply(rule cut_rl[of \"(\\<exists>s4. toEnvP s4 \\<and>\n                   substate s2 s4 \\<and>\n                   substate s4 s0 \\<and>\n                   toEnvNum s2 s4 \\<le> DELAY'TIMEOUT \\<and>\n                   (getVarBool s4 rotation = False \\<or> getVarBool s4 user) \\<and>\n                   (\\<forall>s3. toEnvP s3 \\<and> substate s2 s3 \\<and> substate s3 s4 \\<and> s3 \\<noteq> s4 \\<longrightarrow>\n                         getVarBool s3 rotation = True \\<and> \\<not> getVarBool s3 user))\"])\n  apply (metis substate.simps(10) substate.simps(2) substate.simps(3) substate.simps(9))\n    apply blast\n   apply(simp split: if_splits)\n  apply(rule cut_rl[of \"pred3 s1 s2 \n (toEnv\n          (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) ERROR\n            Controller'suspended))\ns2\"])\n   apply(simp only: pred3_def)\n   apply (smt (z3) substate_asym)\n   apply(rule mp[of \"toEnvP s2 \\<and>  substate s2 s2 \\<and>\n substate s2 (toEnv\n          (setPstate (setVarBool (setVarBool (setVarAny s0 user_value pressure_value) rotation False) brake True) ERROR\n            Controller'suspended))\"])\n   apply((rule VC6_R3_ind_proof);blast)\n  using substate_refl by fast\n  \n  \n\ntheorem proof_3_6: \"VC6 inv3 env s0 user_value pressure_value\"\n  apply(simp only: VC6_def inv3_def R3_def)\n  apply(rule impI)\n  apply(rule conjI)\n  apply(rule conjI)\n   apply(simp)\n   apply((rule allI);(rule allI))\n  print_state\n   apply((rule VC6_R3);blast)", "meta": {"author": "ivchernenko", "repo": "post_vcgenerator", "sha": "fadfff131086870a027d6bd1c78b8d5a3baf183b", "save_path": "github-repos/isabelle/ivchernenko-post_vcgenerator", "path": "github-repos/isabelle/ivchernenko-post_vcgenerator/post_vcgenerator-fadfff131086870a027d6bd1c78b8d5a3baf183b/case-studies/revolvingDoor/Proof_3_6.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.3089168110580893}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2005         |\n            |               February 2006               |\n            |                  April 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                  May 2016  (modified)     |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory FNF_F_nf_def\nimports CSP_F_Main\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*  The following simplification rules are deleted in this theory file *)\n(*       P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y))        *)\n(* Isabelle 2017: split_if --> if_split *)\n\ndeclare if_split  [split del]\n\n(*****************************************************************\n\n         1. definition of full normalisation\n         2. \n         3. \n\n *****************************************************************)\n\n(*----------------------------------------------------------------------*\n |                         full normal form                             |\n *----------------------------------------------------------------------*)\n\ndefinition\n  fnfF_set_condition  :: \"'a set => 'a set set => bool\"\n  where\n  fnfF_set_condition_def :\n   \"fnfF_set_condition A Ys == \n    (ALL Y. ((EX Y0:Ys. Y0 <= Y) & Y <= A Un Union Ys) --> Y:Ys)\"\n  \ndefinition  \n  fnfF_set_completion :: \"'a set => 'a set set => 'a set set\"\n  where\n  fnfF_set_completion_def :\n   \"fnfF_set_completion A Ys == {Y. (EX Y0:Ys. Y0 <= Y) & Y <= (A Un Union Ys)}\"\n\n   \n(* Isabelle 2005\nconsts\n  fnfF_proc      :: \"('p,'a) proc set\"\n\ninductive \"fnfF_proc\"\nintros\nfnfF_proc_rule:\n  \"[| (ALL a. if a:A then Pf a : fnfF_proc else Pf a = DIV) ;\n      fnfF_set_condition A Ys ; Union Ys <= A ;\n      Q = SKIP | Q = DIV |]\n   ==> ((? :A -> Pf) [+] Q) |~| (!set Y:Ys .. (? a:Y -> DIV))\n        : fnfF_proc\"\n*)\n\ninductive_set\n  fnfF_proc      :: \"('p,'a) proc set\"\nwhere\nfnfF_proc_rule:\n  \"[| (ALL a. if a:A then Pf a : fnfF_proc else Pf a = DIV) ;\n      fnfF_set_condition A Ys ; Union Ys <= A ;\n      Q = SKIP | Q = DIV |]\n   ==> ((? :A -> Pf) [+] Q) |~| (!set Y:Ys .. (? a:Y -> DIV))\n        : fnfF_proc\"\n\n(* .elims ---> .cases *)\n\n\ndefinition  \n  XfnfF_proc           :: \"('p,'a) proc set\"\n  where\n  XfnfF_proc_def :\n   \"XfnfF_proc == {!nat n .. Pf n |Pf.\n                  (ALL n. Pf n =F (!nat n .. Pf n) |. n) &\n                  (ALL n. Pf n : fnfF_proc) }\"\n\n(*** convenient lemmas ***)\n\nlemma fnfF_set_completion_sat_condition[simp]:\n  \"fnfF_set_condition A (fnfF_set_completion A Ys)\"\napply (simp add: fnfF_set_condition_def)\napply (intro allI impI)\napply (elim conjE bexE)\n\napply (simp add: fnfF_set_completion_def)\napply (elim conjE bexE)\napply (rule conjI)\napply (rule_tac x=\"Y0a\" in bexI)\napply (simp)\napply (simp)\n\napply (rule subsetI)\napply (erule subsetE)\napply (drule_tac x=\"x\" in bspec, simp)\napply (simp)\napply (elim disjE conjE exE bexE)\napply (simp)\n\napply (rotate_tac 5)\napply (erule subsetE)\napply (simp)\ndone\n\nlemma fnfF_set_completion_subset:\n  \"Ys <= fnfF_set_completion A Ys\"\nby (auto simp add: fnfF_set_completion_def)\n\nlemma fnfF_set_completion_Union_subset:\n  \"Union Ys <= A ==>\n   Union (fnfF_set_completion A Ys) <= A\"\napply (auto simp add: fnfF_set_completion_def)\napply (subgoal_tac \"x : A Un Union Ys\")\napply (simp)\napply (erule disjE)\napply (auto)\ndone\n\n(*----------------------------------------------------------*\n |                   intro, elim, simp                      |\n *----------------------------------------------------------*)\n\nlemma fnfF_proc_iff:\n  \"(NP : fnfF_proc) = \n     (EX A Ys Pf Q.\n      NP = ((? :A -> Pf) [+] Q) |~| (!set Y:Ys .. (? a:Y -> DIV)) &\n      (ALL a. if a:A then Pf a : fnfF_proc else Pf a = DIV) &\n       fnfF_set_condition A Ys & Union Ys <= A &\n       (Q = SKIP | Q = DIV))\"\napply (rule iffI)\n\n(* => *)\n(* apply (erule fnfF_proc.elims) *)\n apply (erule fnfF_proc.cases)\n apply (force)\n\n(* <= *)\n apply (elim conjE exE)\n apply (simp add: fnfF_proc.intros)\ndone\n\nlemma fnfF_proc_EX_I:\n     \"(EX A Ys Pf Q.\n      NP = ((? :A -> Pf) [+] Q) |~| (!set Y:Ys .. (? a:Y -> DIV)) &\n      (ALL a. if a:A then Pf a : fnfF_proc else Pf a = DIV) &\n       fnfF_set_condition A Ys & Union Ys <= A &\n       (Q = SKIP | Q = DIV))\n    ==> NP : fnfF_proc\"\napply (simp add: fnfF_proc_iff[of NP])\ndone\n\nlemma fnfF_proc_EX_E:\n  \"[| NP : fnfF_proc ;\n     (EX A Ys Pf Q.\n      NP = ((? :A -> Pf) [+] Q) |~| (!set Y:Ys .. (? a:Y -> DIV)) &\n      (ALL a. if a:A then Pf a : fnfF_proc else Pf a = DIV) &\n       fnfF_set_condition A Ys & Union Ys <= A &\n       (Q = SKIP | Q = DIV))\n      ==> S |]\n    ==> S\"\napply (simp add: fnfF_proc_iff[of NP])\ndone\n\n(*----------------------------------------------------------*\n |                 ALL fnfF_proc_iff                   |\n *----------------------------------------------------------*)\n\nlemma ALL_fnfF_proc_only_if:\n  \"ALL x:X. NPf x : fnfF_proc\n   ==>\n     (EX Af Ysf Pff Qf.\n      NPf = (%x. if x:X then (((? :(Af x) -> (Pff x)) [+] Qf x) |~| \n                             (!set Y:(Ysf x) .. (? a:Y -> DIV)))\n                        else NPf x) &\n      (ALL x:X. ALL a. if a:(Af x) then (Pff x a) : fnfF_proc \n                       else (Pff x a) = DIV) &\n      (ALL x:X. fnfF_set_condition (Af x) (Ysf x)) &\n      (ALL x:X. Union (Ysf x) <= Af x) &\n      (ALL x:X. Qf x = SKIP | Qf x = DIV))\"\napply (simp add: fnfF_proc_iff)\napply (simp add: choice_BALL_EX)\napply (elim exE)\napply (rule_tac x=\"f\" in exI)\napply (rule_tac x=\"fa\" in exI)\napply (rule_tac x=\"fb\" in exI)\napply (rule_tac x=\"fc\" in exI)\n\n(* NPf *)\napply (rule conjI)\napply (simp add: fun_eq_iff)\napply (rule allI)\napply (case_tac \"x:X\")\napply (simp_all)\n\napply (intro allI ballI)\napply (drule_tac x=\"x\" in bspec, simp)\napply (elim conjE)\napply (drule_tac x=\"a\" in spec)\napply (simp)\ndone\n\nlemma ALL_fnfF_proc_iff:\n  \"(ALL x:X. NPf x : fnfF_proc)\n   =\n     (EX Af Ysf Pff Qf.\n      NPf = (%x. if x:X then (((? :(Af x) -> (Pff x)) [+] Qf x) |~| \n                             (!set Y:(Ysf x) .. (? a:Y -> DIV)))\n                        else NPf x) &\n      (ALL x:X. ALL a. if a:(Af x) then (Pff x a) : fnfF_proc \n                       else (Pff x a) = DIV) &\n      (ALL x:X. fnfF_set_condition (Af x) (Ysf x)) &\n      (ALL x:X. Union (Ysf x) <= Af x) &\n      (ALL x:X. Qf x = SKIP | Qf x = DIV))\"\napply (rule)\napply (simp add: ALL_fnfF_proc_only_if)\n\napply (elim conjE exE)\napply (intro ballI)\napply (simp add: fun_eq_iff)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in bspec, simp)+\napply (simp)\napply (simp add: fnfF_proc.intros)\ndone\n\nlemma ALL_fnfF_procI:\n  \"(EX Af Ysf Pff Qf.\n      NPf = (%x. if x:X then (((? :(Af x) -> (Pff x)) [+] Qf x) |~| \n                             (!set Y:(Ysf x) .. (? a:Y -> DIV)))\n                        else NPf x) &\n      (ALL x:X. ALL a. if a:(Af x) then (Pff x a) : fnfF_proc \n                       else (Pff x a) = DIV) &\n      (ALL x:X. fnfF_set_condition (Af x) (Ysf x)) &\n      (ALL x:X. Union (Ysf x) <= Af x) &\n      (ALL x:X. Qf x = SKIP | Qf x = DIV))\n   ==> ALL x:X. NPf x : fnfF_proc\"\napply (simp add: ALL_fnfF_proc_iff)\ndone\n\nlemma ALL_fnfF_procE:\n  \"[| ALL x:X. NPf x : fnfF_proc ;\n      (EX Af Ysf Pff Qf.\n      NPf = (%x. if x:X then (((? :(Af x) -> (Pff x)) [+] Qf x) |~| \n                             (!set Y:(Ysf x) .. (? a:Y -> DIV)))\n                        else NPf x) &\n      (ALL x:X. ALL a. if a:(Af x) then (Pff x a) : fnfF_proc \n                       else (Pff x a) = DIV) &\n      (ALL x:X. fnfF_set_condition (Af x) (Ysf x)) &\n      (ALL x:X. Union (Ysf x) <= Af x) &\n      (ALL x:X. Qf x = SKIP | Qf x = DIV))\n   ==> S |] ==> S\"\napply (simp add: ALL_fnfF_proc_iff)\ndone\n\n(*======================================================*\n |         function to decompose : fnfF_decompo         |\n *======================================================*)\n(* \nisabelle 2011\n\nconsts\n  fnfF_A ::\n     \"('p,'a) proc => ('a set)\"\n  fnfF_Ys ::\n     \"('p,'a) proc => ('a set set)\"\n  fnfF_Pf ::\n     \"('p,'a) proc => ('a => ('p,'a) proc)\"\n  fnfF_Q ::\n     \"('p,'a) proc => ('p,'a) proc\"\n\n(* they are partial functions *)\n\nrecdef fnfF_A \"{}\"\n  \"fnfF_A (((? :A -> Pf) [+] Q) |~| R) = A\"\n\nrecdef fnfF_Ys \"{}\"\n  \"fnfF_Ys (P |~| !! : type1 Ys .. Pf) = Ys\"\n\nrecdef fnfF_Pf \"{}\"\n  \"fnfF_Pf (((? :A -> Pf) [+] Q) |~| R) = Pf\"\n\nrecdef fnfF_Q \"{}\"\n  \"fnfF_Q (((? :A -> Pf) [+] Q) |~| R) = Q\"\n*)\n\n(* they are partial functions *)\n\nfun\n  fnfF_A ::\n     \"('p,'a) proc => ('a set)\"\nwhere\n  \"fnfF_A (((? :A -> Pf) [+] Q) |~| R) = A\"\n\nfun\n  fnfF_Ys ::\n     \"('p,'a) proc => ('a set set)\"\nwhere\n  \"fnfF_Ys (P |~| !! : type1 Ys .. Pf) = Ys\"\n\nfun\n  fnfF_Pf ::\n     \"('p,'a) proc => ('a => ('p,'a) proc)\"\nwhere\n  \"fnfF_Pf (((? :A -> Pf) [+] Q) |~| R) = Pf\"\n\nfun\n  fnfF_Q ::\n     \"('p,'a) proc => ('p,'a) proc\"\nwhere\n  \"fnfF_Q (((? :A -> Pf) [+] Q) |~| R) = Q\"\n\nlemma fnfF_Ys_get[simp]:\n  \"fnfF_Ys (P |~| !set :Ys .. Pf) = Ys\"\nby (simp add: Rep_int_choice_ss_def)\n\n(*------------------------*\n |     decomposition      |\n *------------------------*)\n\nlemma cspF_fnfF_nat_decompo:\n   \"P : fnfF_proc ==>\n    P =F ((? : (fnfF_A P) -> (fnfF_Pf P)) [+] fnfF_Q P) \n         |~| (!set Y: fnfF_Ys P .. (? a:Y -> DIV))\"\n(* apply (erule fnfF_proc.elims) *)\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\n(*--------------------------------------*\n |   properties of fnfF decomposition   |\n *--------------------------------------*)\n\nlemma fnfF_Pf_A:\n   \"[| P : fnfF_proc ; a : (fnfF_A P) |]\n    ==> (fnfF_Pf P) a : fnfF_proc\"\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\nlemma fnfF_Pf_DIV:\n   \"[| P : fnfF_proc ; a ~: (fnfF_A P) |]\n    ==> (fnfF_Pf P) a = DIV\"\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\nlemma fnfF_Q_range:\n   \"P : fnfF_proc\n    ==> (fnfF_Q P) = SKIP | (fnfF_Q P) = DIV\"\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\nlemma fnfF_condition_A_Ys:\n   \"P : fnfF_proc ==>\n    fnfF_set_condition (fnfF_A P) (fnfF_Ys P)\"\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\nlemma fnfF_Union_Ys_A:\n   \"P : fnfF_proc ==>\n    Union (fnfF_Ys P)  <= (fnfF_A P)\"\napply (erule fnfF_proc.cases)\napply (simp)\ndone\n\n(*-----------------------*\n |    DIV, SKIP, STOP    |\n *-----------------------*)\n\ndefinition\n  NSKIP     :: \"('p,'a) proc\"\n  where\n  NSKIP_def : \"NSKIP == ((? a:{} -> DIV) [+] SKIP) |~| (!set Y:{} .. (? a:Y -> DIV))\"\n  \ndefinition\n  NDIV      :: \"('p,'a) proc\"\n  where\n  NDIV_def  : \"NDIV  == ((? a:{} -> DIV) [+] DIV)  |~| (!set Y:{} .. (? a:Y -> DIV))\"\n\ndefinition  \n  NSTOP     :: \"('p,'a) proc\"\n  where\n  NSTOP_def : \"NSTOP == ((? a:{} -> DIV) [+] DIV)  |~| (!set Y:{{}} .. (? a:Y -> DIV))\"\n\n(*** in fnfF ***)\n\nlemma fnfF_NSKIP[simp]: \"NSKIP : fnfF_proc\"\napply (simp add: NSKIP_def)\napply (rule fnfF_proc.intros)\napply (simp_all add: fnfF_set_condition_def)\ndone\n\nlemma fnfF_NDIV[simp]: \"NDIV : fnfF_proc\"\napply (simp add: NDIV_def)\napply (rule fnfF_proc.intros)\napply (simp_all add: fnfF_set_condition_def)\ndone\n\nlemma fnfF_NSTOP[simp]: \"NSTOP : fnfF_proc\"\napply (simp add: NSTOP_def)\napply (rule fnfF_proc.intros)\napply (simp_all add: fnfF_set_condition_def)\ndone\n\n(*** eqF ***)\n\nlemma cspF_NSKIP_eqF: \"SKIP =F NSKIP\"\napply (simp add: NSKIP_def)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (rule cspF_choice_rule)\napply (rule cspF_Rep_int_choice_DIV)\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_reflex)\ndone\n\nlemma cspF_NDIV_eqF: \"DIV =F NDIV\"\napply (simp add: NDIV_def)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (rule cspF_choice_rule)\napply (rule cspF_Rep_int_choice_DIV)\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_reflex)\ndone\n\nlemma cspF_NSTOP_eqF: \"STOP =F NSTOP\"\napply (simp add: NSTOP_def)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (rule cspF_choice_rule)\napply (rule cspF_Rep_int_choice_singleton)\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_step)\ndone\n\n(*==============================================================*\n |               convenient rules for fnfF                      |\n *==============================================================*)\n\nlemma cspF_fnfF_Depth_rest_dist:\n  \"Q = SKIP | Q = DIV ==>\n   (? :A -> Pf [+] Q\n   |~| !set Y:Ys .. ? a:Y -> DIV) |. Suc n\n  =F \n   (? a:A -> (Pf a |. n) [+] Q\n   |~| !set Y:Ys .. ? a:Y -> DIV)\"\napply (rule cspF_rw_left)\napply (rule cspF_dist)\napply (rule cspF_decompo)\napply (rule cspF_rw_left)\napply (rule cspF_Ext_dist)\napply (rule cspF_decompo)\napply (rule cspF_rw_left)\napply (rule cspF_step)\napply (rule cspF_reflex)\napply (erule disjE)\napply (simp_all)\n\napply (rule cspF_rw_left)\napply (rule cspF_Dist)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_step)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_DIV_Depth_rest)\ndone\n\n(* left DIV *)\n\nlemma cspF_fsfF_left_DIV:\n  \"(? a:{} -> DIV [+] DIV) |~| P =F P\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_Ext_choice_rule)\napply (rule cspF_reflex)\napply (rule cspF_unit)\ndone\n\nlemma cspF_fsfF_right_DIV:\n  \"P |~| (!set :{} .. Pf) =F P\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_reflex)\napply (rule cspF_Rep_int_choice_DIV)\napply (rule cspF_unit)\ndone\n\n(****************** to add them again ******************)\n\ndeclare if_split    [split]\ndeclare disj_not1   [simp]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/FNF_F/FNF_F_nf_def.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5813031051514763, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.30879365822773447}}
{"text": "section\\<open>Option Helpers\\<close>\ntext\\<open>These definitions were contributed by Peter Lammich.\\<close>\ntheory Option_Helpers\nimports Main \"~~/src/HOL/Library/Monad_Syntax\"\nbegin\n\nprimrec oassert :: \"bool \\<Rightarrow> unit option\" where\n  \"oassert True = Some ()\" | \"oassert False = None\"\n\nlemma oassert_iff[simp]: \n  \"oassert \\<Phi> = Some x \\<longleftrightarrow> \\<Phi>\" \n  \"oassert \\<Phi> = None \\<longleftrightarrow> \\<not>\\<Phi>\"  \n  by (cases \\<Phi>) auto\n\ntext\\<open>The idea is that we want the result of some computation to be @{term \"Some v\"} and the contents of @{term v} to satisfy some property @{term Q}.\\<close>\n\nprimrec ospec :: \"('a option) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow> bool\" where\n  \"ospec None _ = False\"\n| \"ospec (Some v) Q = Q v\"\n\nnamed_theorems ospec_rules\n\nlemma oreturn_rule[ospec_rules]: \"\\<lbrakk> P r \\<rbrakk> \\<Longrightarrow> ospec (Some r) P\" by simp\n\nlemma obind_rule[ospec_rules]: \"\\<lbrakk> ospec m Q; \\<And>r. Q r \\<Longrightarrow> ospec (f r) P \\<rbrakk> \\<Longrightarrow> ospec (m \\<bind> f) P\"\n  apply (cases m)\n   apply (auto split: Option.bind_splits)\n  done\n\nlemma ospec_alt: \"ospec m P = (case m of None \\<Rightarrow> False | Some x \\<Rightarrow> P x)\"\n  by (auto split: option.splits)\n\nlemma ospec_bind_simp: \"ospec (m \\<bind> f) P \\<longleftrightarrow> (ospec m (\\<lambda>r. ospec (f r) P))\"\n  apply (cases m)\n   apply (auto split: Option.bind_splits)\n  done\n\nlemma ospec_cons: \n  assumes \"ospec m Q\"\n  assumes \"\\<And>r. Q r \\<Longrightarrow> P r\"\n  shows \"ospec m P\"\n  using assms by (cases m) auto\n\nlemma oreturn_synth: \"ospec (Some x) (\\<lambda>r. r=x)\" by simp\n\nlemma ospecD: \"ospec x P \\<Longrightarrow> x = Some y \\<Longrightarrow> P y\" by simp\nlemma ospecD2: \"ospec x P \\<Longrightarrow> \\<exists>y. x = Some y \\<and> P y\" by(cases x) simp_all\n\nend\n", "meta": {"author": "jcaesar", "repo": "bdd", "sha": "c61d3cb0a33e13a7da1b92b179ddbe470ce4e8c4", "save_path": "github-repos/isabelle/jcaesar-bdd", "path": "github-repos/isabelle/jcaesar-bdd/bdd-c61d3cb0a33e13a7da1b92b179ddbe470ce4e8c4/thy/Option_Helpers.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5312093733737562, "lm_q2_score": 0.5813030906443133, "lm_q1q2_score": 0.30879365052139346}}
{"text": "section \\<open> Semantic Model for Stateful-Failures \\<close>\n\ntheory utp_action_circus\n  imports \"UTP1-Stateful-Failures.utp_sf_rdes\" utp_action_language\nbegin\n\nfun sfrd_sem :: \"('s, 'e) Action \\<Rightarrow> ('s, 'e) action\" (\"\\<lbrakk>_\\<rbrakk>\\<^sub>C\") where\n\"\\<lbrakk>P ; Q\\<rbrakk>\\<^sub>C = \\<lbrakk>P\\<rbrakk>\\<^sub>C ;; \\<lbrakk>Q\\<rbrakk>\\<^sub>C\" |\n\"\\<lbrakk>if b then P else Q end\\<rbrakk>\\<^sub>C = \\<lbrakk>P\\<rbrakk>\\<^sub>C \\<triangleleft> b \\<triangleright>\\<^sub>R \\<lbrakk>Q\\<rbrakk>\\<^sub>C\" |\n\"\\<lbrakk>intchoice P Q\\<rbrakk>\\<^sub>C = \\<lbrakk>P\\<rbrakk>\\<^sub>C \\<sqinter> \\<lbrakk>Q\\<rbrakk>\\<^sub>C\" |\n\"\\<lbrakk>assigns \\<sigma>\\<rbrakk>\\<^sub>C = \\<langle>\\<sigma>\\<rangle>\\<^sub>C\" |\n\"\\<lbrakk>stop\\<rbrakk>\\<^sub>C = Stop\" |\n\"\\<lbrakk>event E\\<rbrakk>\\<^sub>C = (\\<box> e\\<in>UNIV \\<bullet> ev_pred E e &\\<^sub>C do\\<^sub>C(\\<guillemotleft>e\\<guillemotright>) ;; \\<langle>ev_update E e\\<rangle>\\<^sub>C)\" |\n\"\\<lbrakk>extchoice P Q\\<rbrakk>\\<^sub>C = (\\<lbrakk>P\\<rbrakk>\\<^sub>C \\<box> \\<lbrakk>Q\\<rbrakk>\\<^sub>C)\" |\n\"\\<lbrakk>guard b P\\<rbrakk>\\<^sub>C = (b &\\<^sub>C \\<lbrakk>P\\<rbrakk>\\<^sub>C)\"\n\nlemma sfrd_sem_NCSP [closure]: \"\\<lbrakk>A\\<rbrakk>\\<^sub>C is NCSP\"\n  by (induct A, simp_all add: closure)\n\ndefinition sfrd_semantics :: \"('s, 'e, ('s, 'e) sfrd \\<times> ('s, 'e) sfrd) Action_Semantics\" where\n\"sfrd_semantics = \\<lparr> act_sem = sfrd_sem, act_hcond = NCSP \\<rparr>\"\n\ninterpretation sfrd_semantic: action_semantics sfrd_semantics\n  by (unfold_locales, \n      simp_all add: sfrd_semantics_def asem_eq_def skips_def csp_theory.Unit_Left \n      csp_theory.Unit_Right AssignsCSP_id seqr_assoc cond_st_true cond_st_false closure)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/actions/utp_action_circus.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982315512489, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.30872745515236055}}
{"text": "theory flash87Bra  imports flash87Rev\n \n  begin\nlemma onInv87:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv87  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv87  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv87 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash87Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.3087274486712879}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory CustomWordAbs\nimports \"../../AutoCorres\"\nbegin\n\ninstall_C_file \"custom_word_abs.c\"\n\nlemma [word_abs]:\n  \"\\<lbrakk> abstract_val P x sint x'; abstract_val Q y sint y' \\<rbrakk> \\<Longrightarrow>\n        abstract_val (P \\<and> Q) (max x y)\n          sint (x' xor (x' xor y') && - (if x' <s y' then (1 :: sword32) else 0))\"\n  apply (clarsimp simp: max_def word_sless_def word_sle_def)\n  done\n\nlemma [word_abs]:\n  \"\\<lbrakk> abstract_val P x unat x'; abstract_val Q y unat y' \\<rbrakk> \\<Longrightarrow>\n         abstract_val (P \\<and> Q \\<and> y < 32) (x mod (2 ^ y)) unat (x' && 2 ^ unat y' - (1 :: word32))\"\n  apply (clarsimp simp del: shiftl_1 simp: shiftl_1 [symmetric])\n  apply (fold mask_def)\n  apply (subst word_mod_2p_is_mask [symmetric])\n  apply (subst p2_gt_0)\n   apply simp\n  apply (metis unat_mod unat_power_lower32 word_bits_conv)\n  done\n\nlemma [word_abs]:\n  \"\\<lbrakk> abstract_val P x unat (x' :: word32);\n     abstract_val Q y unat y' \\<rbrakk> \\<Longrightarrow>\n      abstract_val (P \\<and> Q) (x + y > UINT_MAX) id (x' + y' < x')\"\n  apply (subst not_le [symmetric], subst no_plus_overflow_unat_size)\n  apply (clarsimp simp: not_less UINT_MAX_def word_size)\n  apply arith\n  done\n\nautocorres [unsigned_word_abs = b c] \"custom_word_abs.c\"\n\ncontext custom_word_abs begin\n\nlemma \"a' x y = max x y\"\n  by (unfold a'_def, rule refl)\n\nlemma \"b' x 4 s = Some (x mod 16)\"\n  by (unfold b'_def, simp)\n\nlemma \"c' x y = (if UINT_MAX < x + y then 1 else 0)\"\n  by (unfold c'_def, simp)\n\nend\n\nend\n", "meta": {"author": "8l", "repo": "AutoCorres", "sha": "47d800912e6e0d9b1b8009660e8b20c785a2ea8b", "save_path": "github-repos/isabelle/8l-AutoCorres", "path": "github-repos/isabelle/8l-AutoCorres/AutoCorres-47d800912e6e0d9b1b8009660e8b20c785a2ea8b/autocorres/tests/proof-tests/CustomWordAbs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6477982043529715, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.30872744219021503}}
{"text": "(*  Title:      JinjaDCI/J/JWellForm.thy\n\n    Author:     Tobias Nipkow, Susannah Mansky\n    Copyright   2003 Technische Universitaet Muenchen, 2019-20 UIUC\n\n    Based on the Jinja theory J/JWellForm.thy by Tobias Nipkow\n*)\n\nsection \\<open> Well-formedness Constraints \\<close>\n\ntheory JWellForm\nimports \"../Common/WellForm\" WWellForm WellType DefAss\nbegin\n\ndefinition wf_J_mdecl :: \"J_prog \\<Rightarrow> cname \\<Rightarrow> J_mb mdecl \\<Rightarrow> bool\"\nwhere\n  \"wf_J_mdecl P C  \\<equiv>  \\<lambda>(M,b,Ts,T,(pns,body)).\n  length Ts = length pns \\<and>\n  distinct pns \\<and>\n  \\<not>sub_RI body \\<and>\n (case b of\n    NonStatic \\<Rightarrow> this \\<notin> set pns \\<and>\n        (\\<exists>T'. P,[this\\<mapsto>Class C,pns[\\<mapsto>]Ts] \\<turnstile> body :: T' \\<and> P \\<turnstile> T' \\<le> T) \\<and>\n        \\<D> body \\<lfloor>{this} \\<union> set pns\\<rfloor>\n  | Static \\<Rightarrow> (\\<exists>T'. P,[pns[\\<mapsto>]Ts] \\<turnstile> body :: T' \\<and> P \\<turnstile> T' \\<le> T) \\<and>\n        \\<D> body \\<lfloor>set pns\\<rfloor>)\"\n\nlemma wf_J_mdecl_NonStatic[simp]:\n  \"wf_J_mdecl P C (M,NonStatic,Ts,T,pns,body) \\<equiv>\n  (length Ts = length pns \\<and>\n  distinct pns \\<and>\n  \\<not>sub_RI body \\<and>\n  this \\<notin> set pns \\<and>\n  (\\<exists>T'. P,[this\\<mapsto>Class C,pns[\\<mapsto>]Ts] \\<turnstile> body :: T' \\<and> P \\<turnstile> T' \\<le> T) \\<and>\n  \\<D> body \\<lfloor>{this} \\<union> set pns\\<rfloor>)\"\n(*<*)by(simp add:wf_J_mdecl_def)(*>*)\n\nlemma wf_J_mdecl_Static[simp]:\n  \"wf_J_mdecl P C (M,Static,Ts,T,pns,body) \\<equiv>\n  (length Ts = length pns \\<and>\n  distinct pns \\<and>\n  \\<not>sub_RI body \\<and>\n  (\\<exists>T'. P,[pns[\\<mapsto>]Ts] \\<turnstile> body :: T' \\<and> P \\<turnstile> T' \\<le> T) \\<and>\n  \\<D> body \\<lfloor>set pns\\<rfloor>)\"\n(*<*)by(simp add:wf_J_mdecl_def)(*>*)\n\n\nabbreviation\n  wf_J_prog :: \"J_prog \\<Rightarrow> bool\" where\n  \"wf_J_prog == wf_prog wf_J_mdecl\"\n\nlemma wf_J_prog_wf_J_mdecl:\n  \"\\<lbrakk> wf_J_prog P; (C, D, fds, mths) \\<in> set P; jmdcl \\<in> set mths \\<rbrakk>\n  \\<Longrightarrow> wf_J_mdecl P C jmdcl\"\n(*<*)by(fastforce simp: wf_prog_def wf_cdecl_def wf_mdecl_def)(*>*)\n                                  \n\n\nlemma wf_prog_wwf_prog: \"wf_J_prog P \\<Longrightarrow> wwf_J_prog P\"\n(*<*)\nby (simp add:wf_prog_def wf_cdecl_def wf_mdecl_def)\n   (fast intro:wf_mdecl_wwf_mdecl)\n(*>*)\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/J/JWellForm.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417487156366, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.30865994638570965}}
{"text": "section {* Imperative Programs *}\n  \ntheory utp_prog\n  imports \"../../Isabelle-UTP-Extended/HoareLogic/TotalCorrectness/utp_hoare_des\"\nbegin\n  \nsubsection {* Program Type *}\n  \ntypedef '\\<alpha> prog = \"{P :: '\\<alpha> hrel_des. P is \\<^bold>N}\"\n  by (rule_tac x=\"true\" in exI, simp add: closure)\n    \nnamed_theorems prog_rep_eq\n    \nnotation Rep_prog (\"\\<lbrakk>_\\<rbrakk>\\<^sub>p\")\n\nlemma Rep_prog_H1_H3_closed [closure]: \"\\<lbrakk>P\\<rbrakk>\\<^sub>p is \\<^bold>N\"\n  using Rep_prog by auto\n    \nsetup_lifting type_definition_prog\n    \ninstantiation prog :: (type) refine\nbegin\n  lift_definition less_eq_prog :: \"'a prog \\<Rightarrow> 'a prog \\<Rightarrow> bool\" is\n  \"op \\<le>\" .\n  lift_definition less_prog :: \"'a prog \\<Rightarrow> 'a prog \\<Rightarrow> bool\" is\n  \"op <\" .\n  instance by (intro_classes, (transfer, simp add: less_uexpr_def)+)\nend\n  \nlemma Rep_prog_refine [prog_rep_eq]:\n  \"P \\<sqsubseteq> Q \\<longleftrightarrow> \\<lbrakk>P\\<rbrakk>\\<^sub>p \\<sqsubseteq> \\<lbrakk>Q\\<rbrakk>\\<^sub>p\"\n  by (simp add: less_eq_prog.rep_eq)\n\nlemma Rep_prog_eq [prog_rep_eq]:\n  \"P = Q \\<longleftrightarrow> \\<lbrakk>P\\<rbrakk>\\<^sub>p = \\<lbrakk>Q\\<rbrakk>\\<^sub>p\"\n  by (metis Rep_prog_inverse)\n\nmethod ptransfer = (simp add: prog_rep_eq)\n    \nsubsection {* Operators *}\n  \nlift_definition abort    :: \"'\\<alpha> prog\" (\"ABORT\") is \"true\" by (simp add: closure)\nlift_definition magic    :: \"'\\<alpha> prog\" (\"MAGIC\") is \"\\<top>\\<^sub>D\" by (simp add: closure)\nlift_definition skip     :: \"'\\<alpha> prog\" (\"SKIP\")is \"II\\<^sub>D\" by (simp add: closure)\nlift_definition pseq     :: \"'\\<alpha> prog \\<Rightarrow> '\\<alpha> prog \\<Rightarrow> '\\<alpha> prog\" (infixr \";\" 71) is \"op ;;\" by (simp add: closure)\nlift_definition passigns :: \"'\\<alpha> usubst \\<Rightarrow> '\\<alpha> prog\" (\"\\<langle>_\\<rangle>\\<^sub>p\") is \"assigns_d\" by (simp add: closure)\nlift_definition psubst   :: \"'\\<alpha> usubst \\<Rightarrow> '\\<alpha> prog \\<Rightarrow> '\\<alpha> prog\" is \"\\<lambda> \\<sigma> P. ((\\<sigma> \\<oplus>\\<^sub>s \\<Sigma>\\<^sub>D) \\<oplus>\\<^sub>s in\\<alpha>) \\<dagger> P\" by (simp add: closure)\n\ndeclare abort.rep_eq [prog_rep_eq]\ndeclare magic.rep_eq [prog_rep_eq]\ndeclare skip.rep_eq [prog_rep_eq]\ndeclare pseq.rep_eq [prog_rep_eq]\ndeclare passigns.rep_eq [prog_rep_eq]\ndeclare psubst.rep_eq [prog_rep_eq]\n  \nsubsection {* Syntax Translations *}\n    \nadhoc_overloading\n  usubst psubst and\n  uassigns passigns\n\ntranslations\n  \"_assignment xs vs\" => \"CONST passigns (_mk_usubst (CONST id) xs vs)\"\n  \"x :== v\" <= \"CONST passigns (CONST subst_upd (CONST id) (CONST svar x) v)\"\n  \nsubsection {* Proof Tactics *}\n  \nmethod pauto   = (ptransfer, rel_auto)\nmethod prefine = (ptransfer, ndes_refine)\nmethod peq     = (ptransfer, ndes_eq)\n  \nsubsection {* Substitution Laws *}\n  \nlemma psubst_seq [usubst]:\n  \"\\<sigma> \\<dagger> (P ; Q) = (\\<sigma> \\<dagger> P) ; Q\"\n  by pauto\n  \nsubsection {* Laws of Programming *}\n\ntheorem skip_left_unit [simp]:\n  \"skip ; P = P\"\n  by (transfer, metis H1_idem H1_left_unit Healthy_def')\n  \ntheorem skip_right_unit [simp]:\n  \"P ; skip = P\"\n  by (transfer, metis H1_H3_commute H1_idem H3_def Healthy_if)\n\ntheorem abort_left_zero [simp]:\n  \"abort ; P = abort\"\n  by (transfer, metis H1_idem H1_left_zero Healthy_def')\n\ntheorem magic_left_zero [simp]:\n  \"magic ; P = magic\"\n  by (transfer, metis H1_idem H1_nok_left_zero Healthy_def')\n    \nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP/impl/utp_prog.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.658417487156366, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.3086599463857096}}
{"text": "section \\<open>A collection of lemmas and definition that aid the certification of the VC phase\\<close>\n\ntheory VCExprHelper\nimports Semantics Util\nbegin\n\nabbreviation ite_vc :: \"bool \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  where \"ite_vc cond thn els \\<equiv> if cond then thn else els\"\n\nsubsection \\<open>vc_to_expr and expr_to_vc\\<close>\n\nlemma vc_to_expr:\"\\<lbrakk>vc; A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,ns\\<rangle> \\<Down> LitV (LBool vc)\\<rbrakk> \\<Longrightarrow> A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e,ns\\<rangle> \\<Down> LitV (LBool True)\"\n  by simp\n\ntext \\<open>vc_to_expr is used in the certification of the VC phase when handling an \"assert e\": We know\nthe vc expression corresponding to e holds and we must show that e evaluates to true (otherwise the\nprogram fails\\<close>\n\nlemma expr_to_vc:\"\\<lbrakk>A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, ns\\<rangle> \\<Down> LitV (LBool True); A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, ns\\<rangle> \\<Down> LitV (LBool vc)\\<rbrakk> \\<Longrightarrow> vc\"\n  by (blast dest: expr_eval_determ)\n\ntext \\<open>expr_to_vc is used in the certification of the VC phase when handling an \"assume e\": We know \nthat if the program execution continues, then e must evaluate to true. In this case, we must show\nthat the vc expression corresponding to e holds.\\<close>\n\ntext \\<open>The key point is that the second premise is the same in both vc_to_expr and expr_to_vc, which\nallows us to handle both \"assert e\" and \"assume e\" in a uniform way when automating the proofs\\<close>\n\nsubsection \\<open>Boogie expression - VC relation lemmas for non-quantified expressions\\<close>\n\ntext \\<open>The following lemmas are used to relate Boogie expressions with corresponding VC expressions,\nwhich follow the same structure.\\<close>\n\nlemma eq_bool_vc_rel:\n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> BoolV vc1\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> BoolV vc2\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Eq\\<guillemotright> e2, ns\\<rangle> \\<Down> BoolV (vc1 = vc2)\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma eq_int_vc_rel:\n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> IntV vc1\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> IntV vc2\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Eq\\<guillemotright> e2, ns\\<rangle> \\<Down> BoolV (vc1 = vc2)\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma eq_real_vc_rel:\n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> RealV vc1\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> RealV vc2\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Eq\\<guillemotright> e2, ns\\<rangle> \\<Down> BoolV (vc1 = vc2)\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma eq_abs_vc_rel:\n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> vc1\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> vc2\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Eq\\<guillemotright> e2, ns\\<rangle> \\<Down> BoolV (vc1 = vc2)\"\n  using assms\n  by (auto intro: RedBinOp)\n\ntext \\<open>boolean operations\\<close>\n\nlemma conj_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LBool vc1)\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LBool vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>And\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LBool (vc1 \\<and> vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma disj_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LBool vc1)\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LBool vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Or\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LBool (vc1 \\<or> vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma imp_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LBool vc1)\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LBool vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Imp\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LBool (vc1 \\<longrightarrow> vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma iff_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LBool vc1)\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LBool vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Iff\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LBool (vc1 = vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma not_vc_rel:\n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, ns\\<rangle> \\<Down> LitV (LBool vc)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>UnOp Not e, ns\\<rangle> \\<Down> LitV (LBool (\\<not> vc))\"\n  using assms\n  by (auto intro: RedUnOp)\n\ntext \\<open>integer operations\\<close>\n\nlemma add_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LInt vc1)\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LInt vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Add\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LInt (vc1 + vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma sub_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LInt (vc1))\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LInt vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Sub\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LInt (vc1 - vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma mul_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LInt vc1)\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LInt vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Mul\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LInt (vc1 * vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma gt_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LInt vc1)\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LInt vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Gt\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LBool (vc1 > vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma ge_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LInt vc1)\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LInt vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Ge\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LBool (vc1 \\<ge> vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma lt_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LInt vc1)\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LInt vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Lt\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LBool (vc1 < vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma le_vc_rel: \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1, ns\\<rangle> \\<Down> LitV (LInt vc1)\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e2, ns\\<rangle> \\<Down> LitV (LInt vc2)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e1 \\<guillemotleft>Le\\<guillemotright> e2, ns\\<rangle> \\<Down> LitV (LBool (vc1 \\<le> vc2))\"\n  using assms\n  by (auto intro: RedBinOp)\n\nlemma uminus_vc_rel:\n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, ns\\<rangle> \\<Down> LitV (LInt vc)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>UnOp UMinus e, ns\\<rangle> \\<Down> LitV (LInt (0 - vc))\"\n  using assms\n  by (auto intro: RedUnOp)\n\ntext \\<open>conditional expressions\\<close>\n\ntext \\<open>In the following, \\<^term>\\<open>C\\<close> is either the identity function or a literal value constructor such \nas \\<^const>\\<open>BoolV\\<close> and \\<^const>\\<open>IntV\\<close>.\\<close>\nlemma condexp_vc_rel:        \n  assumes \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>cond, ns\\<rangle> \\<Down> BoolV vc_cond\" and \n          \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>thn, ns\\<rangle> \\<Down> C vc_thn\" and\n          \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>els, ns\\<rangle> \\<Down> C vc_els\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>CondExp cond thn els, ns\\<rangle> \\<Down> C (ite_vc vc_cond vc_thn vc_els)\"\n  using assms\n  by (auto intro: RedCondExpTrue RedCondExpFalse)\n\nsubsection \\<open>Closed types\\<close>\n\ntext \\<open>We define a new data type to model the closed types. We (implicitly) instantiate the type sort \nin the VC using this type). We define various functions on these closed types that show up in \nthe VC and that we must instantiate appropriately.\\<close>\n\ndatatype closed_ty = \n  TPrimC prim_ty | TConC tcon_id \"closed_ty list\"\n\nfun ty_to_closed :: \"ty \\<Rightarrow> closed_ty\"\n  where \n    \"ty_to_closed (TPrim t) = TPrimC t\"\n |  \"ty_to_closed (TCon tcon_id ts) = TConC tcon_id (map ty_to_closed ts)\"\n |  \"ty_to_closed (TVar v) =  undefined\"\n\nfun closed_to_ty :: \"closed_ty \\<Rightarrow> ty\"\n  where \n    \"closed_to_ty (TPrimC t) = TPrim t\"\n |  \"closed_to_ty (TConC tcon_id ts) = TCon tcon_id (map closed_to_ty ts)\"\n\nlemma closed_closed_to_ty: \"closed (closed_to_ty t)\"\n  by (induction t) (auto simp: list.pred_set)\n\nlemma closed_inv1: \"ty_to_closed (closed_to_ty t) = t\"\n  by (induction t) (auto simp: map_idI)\n\nlemma closed_inv2: \"closed t \\<Longrightarrow> closed_to_ty (ty_to_closed t) = t\"\n  by (induction t) (auto simp add: list.pred_set map_idI)\n\nlemma closed_inv2_2: \"closed t \\<Longrightarrow> t = closed_to_ty (ty_to_closed t)\"\n  by (induction t) (auto simp add: list.pred_set map_idI)\n\nlemma type_definition_closed_ty:\n \"type_definition closed_to_ty ty_to_closed {t. closed t}\"\n  by standard (auto simp add: closed_closed_to_ty closed_inv1 closed_inv2)\n\nsetup_lifting type_definition_closed_ty\n\nfun vc_type_of_val :: \"(('a)absval_ty_fun) \\<Rightarrow> 'a val \\<Rightarrow> closed_ty\"\n  where\n   \"vc_type_of_val A v = ty_to_closed (type_of_val A v)\"\n\ntext\\<open>We use \\<^term>\\<open>vc_type_of_val\\<close> to instantiate the \"type\" function in the VC, which maps values \nto their (closed) type. Note that procedure correctness assumes that values must have a closed type.\\<close>\n\nlemma vc_type_of_val_int: \"vc_type_of_val A (IntV i) = TPrimC TInt\"\n  by simp\n\nlemma vc_type_of_val_real: \"vc_type_of_val A (RealV i) = TPrimC TReal\"\n  by simp\n\nlemma vc_type_of_val_bool: \"vc_type_of_val A (IntV i) = TPrimC TInt\"\n  by simp\n\ntext\\<open>Return some arbitrary value of correct type\\<close>\n\nfun val_of_type :: \"'a absval_ty_fun \\<Rightarrow> ty \\<Rightarrow> 'a val\"\n  where\n   \"val_of_type A t = (SOME v. type_of_val A v = t)\"\n\ndefinition val_of_closed_type ::\"'a absval_ty_fun \\<Rightarrow> closed_ty \\<Rightarrow> 'a val\"\n  where\n   \"val_of_closed_type A t  = (val_of_type A (closed_to_ty t))\"\n\nlemma val_of_type_correct:\n  assumes \"\\<And> t. closed t \\<Longrightarrow> \\<exists>v. type_of_val A v = t\" and\n         \"closed t'\"\n  shows \"type_of_val A (val_of_type A t') = t'\"\n  by (metis (mono_tags, lifting) assms(1) assms(2) someI val_of_type.simps)\n\nlemma val_of_closed_type_correct: \n  assumes \"\\<And> t. closed t \\<Longrightarrow> \\<exists>v. type_of_val A v = t\"\n  shows \"ty_to_closed (type_of_val A (val_of_closed_type A ct)) = ct\"\n  by (metis assms closed_closed_to_ty closed_inv1 val_of_closed_type_def val_of_type_correct)\n\nlemma type_of_val_instantiate:\nassumes \"closed (instantiate \\<Omega> ty)\" and\n        \"closed (type_of_val A v)\" and\n        \"ty_to_closed (type_of_val A v) = ty_to_closed (instantiate \\<Omega> ty)\"\nshows \"(type_of_val A v) = (instantiate \\<Omega> ty)\"\n  by (metis assms(1) assms(2) assms(3) closed_inv2)\n\nsubsection \\<open>Boogie-VC Quantifier relation\\<close>\n\ntext \\<open>lifted implication simplification\\<close>\nlemma imp_vc:\nassumes \"vc0\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, ns\\<rangle> \\<Down> BoolV vc\"\nshows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, ns\\<rangle> \\<Down> BoolV (vc0 \\<longrightarrow> vc)\"\nusing assms\n  by simp\n\ntext\\<open>lifted conjunction simplification\\<close>\nlemma conj_vc:\nassumes \"vc0\" and \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, ns\\<rangle> \\<Down> BoolV vc\"\nshows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, ns\\<rangle> \\<Down> BoolV (vc0 \\<and> vc)\"\nusing assms\n  by simp\n\ntext \\<open>Value quantification relation\\<close>\n\n(** primitive types **)\nlemma forall_vc_rel_general: \n  assumes \"\\<And> i. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env ns (LitV (C i))\\<rangle> \\<Down> LitV (LBool (P i))\" and\n          \"\\<And> i v. type_of_val A v = TPrim primty \\<Longrightarrow> \\<exists>i. v = LitV (C i)\"\n          \"\\<And> i. type_of_val A (LitV (C i)) = TPrim primty\"\n  shows  \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Forall (TPrim primty) e, ns\\<rangle> \\<Down> LitV (LBool (\\<forall>i. P i))\"\nproof (cases \"(\\<forall>i. P i)\")\n  case True\n  thus ?thesis using assms by (fastforce intro: RedForAllTrue)\nnext\n  case False\n  from this obtain z where \"\\<not>(P z)\" by auto\n  have \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Forall (TPrim primty) e, ns\\<rangle> \\<Down> LitV (LBool False)\"\n    apply (rule RedForAllFalse[where ?v = \"LitV (C z)\"])\n    apply simp\n    using assms(3) apply auto[1]\n    by (metis (full_types) \\<open>\\<not> P z\\<close> assms(1))\n  then show ?thesis by (simp add: False)\nqed\n\nlemma exists_vc_rel_general:\n  assumes \"\\<And> i. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env ns (LitV (C i))\\<rangle> \\<Down> LitV (LBool (P i))\"\n          \"\\<And> i v. type_of_val A v = TPrim primty \\<Longrightarrow> \\<exists>i. v = LitV (C i)\"\n          \"\\<And> i. type_of_val A (LitV (C i)) = TPrim primty\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Exists (TPrim primty) e, ns\\<rangle> \\<Down> LitV (LBool (\\<exists>i. P i))\"\nproof (cases \"\\<exists>i. P i\")\n  case True\n  from this obtain z where \"P z\" by auto\n  have \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Exists (TPrim primty) e, ns\\<rangle> \\<Down> LitV (LBool True)\"\n    apply (rule RedExistsTrue[where ?v = \"LitV (C z)\"])\n    apply simp\n    using assms(3) apply auto[1]\n    using assms \\<open>P z\\<close> by (metis (full_types))     \n  thus ?thesis by (simp add: True)\nnext\n  case False\n  thus ?thesis using assms by (fastforce intro: RedExistsFalse)\nqed\n\nlemma forall_vc_rel_int: \n  assumes \"\\<And> i. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env ns (LitV (LInt i))\\<rangle> \\<Down> LitV (LBool (P i))\"\n  shows  \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Forall (TPrim TInt) e, ns\\<rangle> \\<Down> LitV (LBool (\\<forall>i. P i))\"\n  using assms\n  by (rule forall_vc_rel_general, auto elim: type_of_val_int_elim)\n\nlemma forall_vc_rel_bool: \n  assumes \"\\<And> b. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env ns (LitV (LBool b))\\<rangle> \\<Down> LitV (LBool (P b))\"\n  shows  \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Forall (TPrim TBool) e, ns\\<rangle> \\<Down> LitV (LBool (\\<forall>b. P b))\"\n  using assms\n  by (rule forall_vc_rel_general, auto elim: type_of_val_bool_elim)\n\nlemma forall_vc_rel_real: \n  assumes \"\\<And> i. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env ns (LitV (LReal i))\\<rangle> \\<Down> LitV (LBool (P i))\"\n  shows  \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Forall (TPrim TReal) e, ns\\<rangle> \\<Down> LitV (LBool (\\<forall>i. P i))\"\n  using assms\n  by (rule forall_vc_rel_general, auto elim: type_of_val_real_elim)\n\nlemma exists_vc_rel_int:\n  assumes \"\\<And> i. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env ns (LitV (LInt i))\\<rangle> \\<Down> LitV (LBool (P i))\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Exists (TPrim TInt) e, ns\\<rangle> \\<Down> LitV (LBool (\\<exists>i. P i))\"\n  using assms\n  by (rule exists_vc_rel_general, auto elim: type_of_val_int_elim)\n\nlemma exists_vc_rel_bool:\n  assumes \"\\<And> b. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env ns (LitV (LBool b))\\<rangle> \\<Down> LitV (LBool (P b))\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Exists (TPrim TBool) e, ns\\<rangle> \\<Down> LitV (LBool (\\<exists>b. P b))\"\n  using assms\n  by (rule exists_vc_rel_general, auto elim: type_of_val_bool_elim)\n\nlemma exists_vc_rel_real:\n  assumes \"\\<And> i. A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env ns (LitV (LReal i))\\<rangle> \\<Down> LitV (LBool (P i))\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Exists (TPrim TReal) e, ns\\<rangle> \\<Down> LitV (LBool (\\<exists>i. P i))\"\n  using assms\n  by (rule exists_vc_rel_general, auto elim: type_of_val_real_elim)\n\n(** general types **)\nlemma forall_vc_type:\n  assumes closedTypeOfVal:\"\\<And> v. closed (type_of_val A v)\" and\n   closedInstTy:\"closed (instantiate \\<Omega> ty)\" and\n   vcTypeFalse:\"\\<And> i. \\<not> (P i) \\<Longrightarrow> vc_type_of_val A i = ty_to_closed (instantiate \\<Omega> ty)\" and\n   body: \"\\<And> i. type_of_val A i = instantiate \\<Omega> ty \\<Longrightarrow> A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env ns i\\<rangle> \\<Down> BoolV (P i)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Forall ty e, ns\\<rangle> \\<Down> LitV (LBool (\\<forall>i. P i))\"\nproof (cases \"\\<forall>i. P i\")\n  case True\n  then show ?thesis\n    apply simp\n    apply rule\n    using True body by simp\nnext\n  case False\n  from this obtain z where \"\\<not>(P z)\" by auto\n  hence \"vc_type_of_val A z = ty_to_closed (instantiate \\<Omega> ty)\" using vcTypeFalse by auto\n  hence zType:\"type_of_val A z  = instantiate \\<Omega> ty\" by (metis closedTypeOfVal closedInstTy closed_inv2 vc_type_of_val.simps)\n  thus ?thesis\n    apply (subst False)\n    apply (rule RedForAllFalse[OF zType])\n    using \\<open>\\<not> P z\\<close> body by fastforce\nqed\n\nlemma exists_vc_type:\n  assumes closedTypeOfVal:\"\\<And> v. closed (type_of_val A v)\" and\n   closedInstTy:\"closed (instantiate \\<Omega> ty)\" and\n   vcTypeTrue:\"\\<And> i. (P i) \\<Longrightarrow> vc_type_of_val A i = ty_to_closed (instantiate \\<Omega> ty)\" and\n   body: \"\\<And> i. type_of_val A i = instantiate \\<Omega> ty \\<Longrightarrow> A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>e, full_ext_env ns i\\<rangle> \\<Down> BoolV (P i)\"\n  shows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>Exists ty e, ns\\<rangle> \\<Down> LitV (LBool (\\<exists>i. P i))\"\nproof (cases \"\\<exists>i. P i\")\n  case True\n  from this obtain z where \"P z\" by auto\n  hence witnessType:\"type_of_val A z = instantiate \\<Omega> ty\" using vcTypeTrue\n    by (simp add: closedInstTy closedTypeOfVal type_of_val_instantiate) \n  then show ?thesis\n    apply (subst True)\n    apply rule\n     apply (rule witnessType)\n    using \\<open>P z\\<close> body by fastforce    \nnext\n  case False\n  hence False2: \"(\\<exists>i. P i) = False\" by simp\n  show ?thesis\n    apply (subst False2)\n    apply rule\n    using body False by simp\nqed\n\ntext \\<open>Type quantification relation\\<close>\n\nlemma forallt_vc:\nassumes \"\\<And>\\<tau>. closed \\<tau> \\<Longrightarrow> A,\\<Lambda>,\\<Gamma>,\\<tau>#\\<Omega> \\<turnstile> \\<langle>e,ns\\<rangle> \\<Down> BoolV (P (ty_to_closed \\<tau>))\"\nshows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>ForallT e, ns\\<rangle> \\<Down> BoolV (\\<forall>t :: closed_ty. P t)\"\nproof (cases \"\\<forall>t :: closed_ty. P t\")\n  case True\n  then show ?thesis \n    apply (subst True)\n    apply simp\n    apply rule\n    using assms by auto\nnext\n  case False\n  from this obtain \\<tau> where \"\\<not> P \\<tau>\" by auto\n  have \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>ForallT e,ns\\<rangle> \\<Down> BoolV False\"\n    apply (rule RedForallT_False[where ?\\<tau>=\"closed_to_ty \\<tau>\"])\n     apply (rule closed_closed_to_ty)\n    by (metis (full_types) \\<open>\\<not> P \\<tau>\\<close> assms closed_closed_to_ty closed_inv1)\n  thus ?thesis  by (simp add: \\<open>\\<not> (\\<forall>t. P t)\\<close>)\nqed\n\nlemma forallt_vc_extract:\nassumes \"\\<And>\\<tau>. closed \\<tau> \\<Longrightarrow> A,\\<Lambda>,\\<Gamma>,\\<tau>#\\<Omega> \\<turnstile> \\<langle>e,ns\\<rangle> \\<Down> BoolV P\"\nshows \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>ForallT e, ns\\<rangle> \\<Down> BoolV P\"\nproof (cases P)\n  case True\n  thus ?thesis using assms by (auto intro: RedForallT_True)\nnext\n  case False\n  have \"A,\\<Lambda>,\\<Gamma>,\\<Omega> \\<turnstile> \\<langle>ForallT e,ns\\<rangle> \\<Down> BoolV False\"\n    apply (rule RedForallT_False[where ?\\<tau>=\"TPrim TInt\"])\n     apply simp\n    using False assms by auto\n  thus ?thesis using \\<open>\\<not>P\\<close> by auto\nqed\n\nsubsection \\<open>Constructor and inverse functions\\<close>\n\ntext \\<open>We use these constructor and inverse functions to instantiate parts of the VC.\\<close>\n\nfun vc_inv :: \"nat \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty\"\n  where\n   \"vc_inv n (TConC tcon_id xs) = (if n < length xs then xs ! n else TPrimC (TInt))\" \n | \"vc_inv n _ = TPrimC (TInt)\"\n\nfun vc_inv_closed :: \"nat \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty\"\n  where\n   \"vc_inv_closed n (TConC tcon_id xs) = (if (n < length xs) then xs ! n else TPrimC (TInt))\" \n | \"vc_inv_closed n _ = TPrimC (TInt)\"\n\n(* Type constructor functions *)\nfun vc_type_constr0 :: \"string \\<Rightarrow> closed_ty\"\n  where\n    \"vc_type_constr0 s = TConC s []\"\n\nfun vc_type_constr1 :: \"string \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty\"\n  where\n   \"vc_type_constr1 s t = TConC s [t]\"\n\nfun vc_type_constr2 :: \"string \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty\"\n  where\n   \"vc_type_constr2 s t1 t2 = TConC s [t1,t2]\"\n\nfun vc_type_constr3 :: \"string \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty\"\n  where\n   \"vc_type_constr3 s t1 t2 t3 = TConC s [t1,t2,t3]\"\n\nfun vc_type_constr4 :: \"string \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty\"\n  where\n   \"vc_type_constr4 s t1 t2 t3 t4 = TConC s [t1,t2,t3,t4]\"\n\nfun vc_type_constr5 :: \"string \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty \\<Rightarrow> closed_ty\"\n  where\n   \"vc_type_constr5 s t1 t2 t3 t4 t5 = TConC s [t1,t2,t3,t4,t5]\"\n\n(* inverse lemmas *)\nlemma vc_inv_constr_10:\"\\<forall> t1. vc_inv_closed 0 (vc_type_constr1 s t1) = t1\" by simp\nlemma vc_inv_constr_20:\"\\<forall> t1 t2. vc_inv_closed 0 (vc_type_constr2 s t1 t2) = t1\" by simp\nlemma vc_inv_constr_21:\"\\<forall> t1 t2. vc_inv_closed 1 (vc_type_constr2 s t1 t2) = t2\" by simp\nlemma vc_inv_constr_30:\"\\<forall> t1 t2 t3. vc_inv_closed 0 (vc_type_constr3 s t1 t2 t3) = t1\" by simp\nlemma vc_inv_constr_31:\"\\<forall> t1 t2 t3. vc_inv_closed 1 (vc_type_constr3 s t1 t2 t3) = t2\" by simp\nlemma vc_inv_constr_32:\"\\<forall> t1 t2 t3. vc_inv_closed 2 (vc_type_constr3 s t1 t2 t3) = t3\" by simp\nlemma vc_inv_constr_40:\"\\<forall> t1 t2 t3 t4. vc_inv_closed 0 (vc_type_constr4 s t1 t2 t3 t4) = t1\" by simp\nlemma vc_inv_constr_41:\"\\<forall> t1 t2 t3 t4. vc_inv_closed 1 (vc_type_constr4 s t1 t2 t3 t4) = t2\" by simp\nlemma vc_inv_constr_42:\"\\<forall> t1 t2 t3 t4. vc_inv_closed 2 (vc_type_constr4 s t1 t2 t3 t4) = t3\" by simp\nlemma vc_inv_constr_43:\"\\<forall> t1 t2 t3 t4. vc_inv_closed 3 (vc_type_constr4 s t1 t2 t3 t4) = t4\" by simp\nlemma vc_inv_constr_50:\"\\<forall> t1 t2 t3 t4 t5. vc_inv_closed 0 (vc_type_constr5 s t1 t2 t3 t4 t5) = t1\" by simp\nlemma vc_inv_constr_51:\"\\<forall> t1 t2 t3 t4 t5. vc_inv_closed 1 (vc_type_constr5 s t1 t2 t3 t4 t5) = t2\" by simp\nlemma vc_inv_constr_52:\"\\<forall> t1 t2 t3 t4 t5. vc_inv_closed 2 (vc_type_constr5 s t1 t2 t3 t4 t5) = t3\" by simp\nlemma vc_inv_constr_53:\"\\<forall> t1 t2 t3 t4 t5. vc_inv_closed 3 (vc_type_constr5 s t1 t2 t3 t4 t5) = t4\" by simp\nlemma vc_inv_constr_54:\"\\<forall> t1 t2 t3 t4 t5. vc_inv_closed 4 (vc_type_constr5 s t1 t2 t3 t4 t5) = t5\" by simp\n\ntext\\<open>Conversions\\<close>\nfun convert_val_to_int :: \"'a val \\<Rightarrow> int\"\n  where \"convert_val_to_int (LitV (LInt i)) = i\"\n  |  \"convert_val_to_int _ = undefined\"\n\nfun convert_val_to_bool :: \"'a val \\<Rightarrow> bool\"\n  where \"convert_val_to_bool (LitV (LBool b)) = b\"\n  | \"convert_val_to_bool _ = undefined\"\n\nfun convert_val_to_real :: \"'a val \\<Rightarrow> real\"\n  where \"convert_val_to_real (LitV (LReal r)) = r\"\n  |  \"convert_val_to_real _ = undefined\"\n\nlemma tint_intv: \"\\<lbrakk> type_of_val A v = TPrim TInt \\<rbrakk> \\<Longrightarrow> \\<exists>i. v = LitV (LInt i)\"\n  by (auto elim: type_of_val_int_elim)\n\nlemma tbool_boolv: \"\\<lbrakk> type_of_val A v = TPrim TBool \\<rbrakk> \\<Longrightarrow> \\<exists>b. v = LitV (LBool b)\"\n  by (auto elim: type_of_val_bool_elim)\n\n\nlemma treal_realv: \"\\<lbrakk> type_of_val A v = TPrim TReal \\<rbrakk> \\<Longrightarrow> \\<exists>i. v = LitV (LReal i)\"\n  by (auto elim: type_of_val_real_elim)\n\nlemma vc_tint_intv: \"vc_type_of_val A v = TPrimC TInt \\<Longrightarrow> \\<exists>i. v = IntV i\"\n  by (metis closed.simps(2) closed_inv2_2 closed_to_ty.simps(1) closed_ty.distinct(1) ty_to_closed.simps(2) type_of_val.elims type_of_val_int_elim vc_type_of_val.simps)\n\nlemma vc_tbool_boolv: \"vc_type_of_val A v = TPrimC TBool \\<Longrightarrow> \\<exists>i. v = BoolV i\"\n  by (metis closed.simps(2) closed_inv2_2 closed_to_ty.simps(1) closed_ty.distinct(1) ty_to_closed.simps(2) type_of_val.elims type_of_val_bool_elim vc_type_of_val.simps)\n\nlemma vc_treal_realv: \"vc_type_of_val A v = TPrimC TReal \\<Longrightarrow> \\<exists>i. v = RealV i\"\n  by (metis closed.simps(2) closed_inv2_2 closed_to_ty.simps(1) closed_ty.distinct(1) ty_to_closed.simps(2) type_of_val.elims type_of_val_real_elim vc_type_of_val.simps)\n\ntext \\<open>Lemmas used for proving equivalence between VC quantifiers with and without extractors\\<close>\n\nlemmas prim_type_vc_lemmas = vc_type_of_val_int vc_type_of_val_bool vc_type_of_val_real vc_tint_intv vc_tbool_boolv vc_treal_realv\n\nlemmas vc_extractor_lemmas = \n  prim_type_vc_lemmas \n  vc_inv_constr_10  \n  vc_inv_constr_20 vc_inv_constr_21\n  vc_inv_constr_30 vc_inv_constr_31 vc_inv_constr_32\n  vc_inv_constr_40 vc_inv_constr_41 vc_inv_constr_42 vc_inv_constr_43\n  vc_inv_constr_50 vc_inv_constr_51 vc_inv_constr_52 vc_inv_constr_53 vc_inv_constr_54\n\n(* VC axioms *)\nlemma int_inverse_1:\"\\<forall> i. convert_val_to_int (IntV i) = i\"\n  by simp\n\nlemma int_inverse_2:\"\\<forall> v. vc_type_of_val A v = TPrimC TInt \\<longrightarrow> IntV (convert_val_to_int v) = v\"\nproof (rule allI, rule impI)\n  fix v\n  assume \"vc_type_of_val A v = TPrimC TInt\"\n  from this obtain i where \"v = IntV i\"\n    by (metis closed.simps(2) closed_inv2 closed_to_ty.simps(1) closed_ty.distinct(1) ty_to_closed.simps(2) type_of_val.elims type_of_val_int_elim vc_type_of_val.simps) \n  thus \"IntV (convert_val_to_int v) = v\"\n    by auto\nqed\n\nlemma int_inverse_3:\n\"type_of_val A v = TPrim TInt \\<Longrightarrow> IntV (convert_val_to_int v) = v\"\n  using convert_val_to_int.simps(1) tint_intv by blast\n\nlemma bool_inverse_1:\"\\<forall>b. convert_val_to_bool (BoolV b) = b\"\n  by simp\n\nlemma bool_inverse_2:\"\\<forall> v. vc_type_of_val A v = TPrimC TBool \\<longrightarrow> BoolV (convert_val_to_bool v) = v\"\nproof (rule allI, rule impI)\n  fix v\n  assume \"vc_type_of_val A v = TPrimC TBool\"\n  hence \"type_of_val A v = TPrim TBool\"\n    by (metis closed.simps(2) closed_inv2 closed_to_ty.simps(1) closed_ty.distinct(1) ty_to_closed.simps(2) type_of_val.elims vc_type_of_val.simps) \n  from this obtain b where \"v = BoolV b\"\n    using tbool_boolv by auto  \n  thus \"BoolV (convert_val_to_bool v) = v\"\n    by auto\nqed\n\nlemma bool_inverse_3:\n\"type_of_val A v = TPrim TBool \\<Longrightarrow> BoolV (convert_val_to_bool v) = v\"\n  using bool_inverse_1 tbool_boolv by blast\n\nlemma int_type:\"\\<forall>b. vc_type_of_val A (IntV b) = TPrimC TInt\"\n  by simp\n\nlemma bool_type:\"\\<forall>b. vc_type_of_val A (BoolV b) = TPrimC TBool\"\n  by simp\n\nlemma real_type:\"\\<forall>r. vc_type_of_val A (RealV r) = TPrimC TReal\"\n  by simp\n\nlemma real_inverse_1:\"\\<forall> r. convert_val_to_real (RealV r) = r\"\n  by simp\n\nlemma real_inverse_2:\"\\<forall> v. vc_type_of_val A v = TPrimC TReal \\<longrightarrow> RealV (convert_val_to_real v) = v\"\nproof (rule allI, rule impI)\n  fix v\n  assume \"vc_type_of_val A v = TPrimC TReal\"\n  from this obtain i where \"v = RealV i\"\n    using vc_treal_realv by blast\n  thus \"RealV (convert_val_to_real v) = v\"\n    by auto\nqed\n\nlemma real_inverse_3:\n\"type_of_val A v = TPrim TReal \\<Longrightarrow> RealV (convert_val_to_real v) = v\"\n  using convert_val_to_real.simps(1) treal_realv by blast\n\nsubsection \\<open>Basic tactics\\<close>\n\nmethod fun_output_axiom uses NonEmptyTypes =\n(  (simp add: Let_def),(rule allI)+, (simp split: option.split),(rule conjI), (rule impI),\n  (rule val_of_closed_type_correct[OF NonEmptyTypes]), assumption, rule allI, rule impI\n)\n\nlemma convert_type_of_val_vc: \n  assumes \"type_of_val A v = t\" and \"closed t\" and \"ty_to_closed t = tc\"\n  shows \"vc_type_of_val A v = tc\"\n  using assms\n  by simp\n\nmethod var_type_axiom uses TypeEq = \n( (rule convert_type_of_val_vc[OF TypeEq], solves \\<open>simp\\<close>, solves \\<open>simp\\<close>))\n\nend", "meta": {"author": "gauravpartha", "repo": "foundational_boogie", "sha": "4667c538759128ad88588ff2c1ae821d7a78b16b", "save_path": "github-repos/isabelle/gauravpartha-foundational_boogie", "path": "github-repos/isabelle/gauravpartha-foundational_boogie/foundational_boogie-4667c538759128ad88588ff2c1ae821d7a78b16b/BoogieLang/VCExprHelper.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.607663184043154, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.30857857434279135}}
{"text": "theory ProcLemma\n  imports ProcSendCase\nbegin\n\n    (* ##### 3. process reduction validity for thread case ##### *)\n\nlemma id_sub_env: \"sub_env s s\"\n  apply (simp add: sub_env_def)\n  done\n  \nlemma super_sub_use_env: \"\\<lbrakk> sub_env s' s; sub_use_env s r_s \\<rbrakk> \\<Longrightarrow> sub_use_env s' r_s\"    \n  apply (simp add: sub_env_def)\n  apply (simp add: sub_use_env_def)\n  done  \n  \nlemma app_red_exp_sub_env: \"\\<lbrakk> app_red_exp are (s1, e1) ax (s2, e2) \\<rbrakk> \\<Longrightarrow> sub_env s2 s1\"\n  apply (case_tac are)\n        apply (auto)\n        apply (rule_tac id_sub_env)\n       apply (rule_tac id_sub_env)\n      apply (case_tac c)\n                  apply (auto)\n        apply (rule_tac add_sub_env)\n        apply (rule_tac id_sub_env)\n       apply (rule_tac id_sub_env)\n      apply (rule_tac add_sub_env)\n      apply (rule_tac add_sub_env)\n      apply (rule_tac id_sub_env)\n     apply (rule_tac id_sub_env)\n    apply (rule_tac id_sub_env)\n   apply (rule_tac id_sub_env)\n  apply (case_tac c)\n              apply (auto)\n     apply (rule_tac add_sub_env)\n     apply (rule_tac id_sub_env)\n    apply (rule_tac id_sub_env)  \n   apply (rule_tac add_sub_env)\n   apply (rule_tac id_sub_env)\n  done   \n    \n  \n    (* MAIN PROCESS REDUCTION LEMMA *)\n   \nlemma srps_thread_case: \"\\<lbrakk>well_typed_system env rs_map p_map s1 ps1; valid_reduct app_red_exp; r_ax = ThreadAct; ps1 u = Some (app_hole h e1); wf_hole h;\n        ps2 = add_env ps1 u (app_hole h e2); app_red_exp are (s1, e1) ax (s2, e2)\\<rbrakk>\n       \\<Longrightarrow> \\<exists>r_s g_ax. (\\<exists>p_map'. well_typed_system (red_env env g_ax) (red_nres_map rs_map g_ax) p_map' s2 (add_env ps1 u (app_hole h e2))) \\<and> safe_act s1 r_s g_ax\"\n    (* case where action is performed on single thread 'u'. *)\n  apply (case_tac \"\\<not> (well_typed_state s1 env rs_map \\<and> well_typed_proc_set env rs_map p_map ps1 \\<and> sub_nres_map s1 p_map \\<and> (\\<forall> u. case p_map u of\n      None \\<Rightarrow> True | Some r_s \\<Rightarrow> sep_nres_map r_s rs_map))\")\n   apply (simp add: well_typed_system_def)\n  apply (auto)\n    (* we start by obtaining the well-typedness and validity for thread 'u' *)\n  apply (simp add: well_typed_proc_set_def)\n  apply (auto)\n  apply (erule_tac x=\"u\" in allE)\n  apply (erule_tac x=\"u\" in allE)\n  apply (auto)\n  apply (case_tac \"p_map u\")\n   apply (auto)\n    (* using the gsre lemma, we know that the resulting expression will be well-typed. *)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"a\" and ?e1.0=\"app_hole h e1\" and tau=\"UnitTy\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and ?s1.0=\"s1\" and\n        rs_map=\"rs_map\" and ?e2.0=\"app_hole h e2\" and ax=\"ax\" and ?s2.0=\"s2\" and r_f=\"a\" in safe_full_red_exp)\n         apply (auto)\n    apply (simp add: valid_exp_use_env_def)\n    apply (simp add: sub_nres_map_def)\n    apply (simp add: nres_lookup_def)\n    apply (erule_tac x=\"u\" in allE)\n    apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"g_ax\" in exI)  \n  apply (auto)\n  apply (rule_tac x=\"add_env p_map u (exp_red_use_env a g_ax)\" in exI)\n    (* prove that the resulting system is well-typed overall *)\n  apply (simp add: well_typed_system_def)\n    (* prove that the process set in particular remains well-typed *)\n  apply (simp add: well_typed_proc_set_def)\n  apply (auto)\n    (* prove that the new map still covers the state *)\n       apply (rule_tac add_full_nres_map)\n       apply (simp)\n    (* prove that it is still disjoint *)\n      apply (rule_tac disj_add_nres_map)\n       apply (simp)\n      apply (rule_tac ?s1.0=\"s1\" in red_sep_nres_map)\n          apply (auto)\n       apply (rule_tac r_x=\"infl_use_env a r_s2\" in leq_safe_act)\n        apply (simp)\n       apply (rule_tac lhs_infl_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n      apply (simp add: sub_nres_map_def)\n       apply (erule_tac x=\"u\" in allE)\n      apply (simp add: nres_lookup_def)\n    (* prove that everything is still well-typed. we start with the original expressions from ps1 *)  \n      apply (case_tac \"u \\<noteq> ua\")\n       apply (case_tac \"add_env ps1 u (app_hole h e2) ua\")\n        apply (auto)\n       apply (erule_tac x=\"ua\" in allE)\n       apply (simp add: add_env_def)\n       apply (case_tac \"p_map ua\")\n        apply (auto)\n       apply (rule_tac x=\"rxa\" in exI)\n       apply (rule_tac x=\"r_s2a\" in exI)\n       apply (rule_tac env'=\"env\" in well_typed_contain_env)\n        apply (rule_tac s=\"s1\" in red_contain_env)\n         apply (simp_all)\n       apply (simp add: well_typed_state_def)\n    (* - proving that it's still proper as well *)\n      apply (rule_tac s=\"s1\" in red_proper_exp)\n        apply (auto)\n      apply (simp add: well_typed_state_def)\n    (* - it's true for the modified res map by valid_reduct's def *)\n      apply (simp add: add_env_def)\n      apply (erule_tac x=\"u\" in allE)\n      apply (erule_tac x=\"u\" in allE)\n      apply (auto)\n    (* prove that each res map in p_map is still contained in s2. this is true for the original\n        res maps since s1 <: s2 *)\n     apply (simp add: sub_nres_map_def)\n     apply (auto)\n     apply (case_tac \"u \\<noteq> x\")\n      apply (rule_tac s=\"s1\" in super_sub_use_env)\n       apply (simp add: nres_lookup_def)\n       apply (simp add: add_env_def)\n      apply (rule_tac are=\"are\" in app_red_exp_sub_env)\n      apply (auto)\n    (* - it's true for the modified res map by valid_exp *) \n     apply (simp add: nres_lookup_def)\n     apply (simp add: add_env_def)\n    apply (simp add: valid_exp_use_env_def)\n    apply (simp add: nres_lookup_def)\n    apply (simp add: add_env_def)\n    (* prove that each res map in p_map is disjoint from the new rs_map. this is true for the original\n        res maps by lemma *)\n   apply (case_tac \"u \\<noteq> ua\")\n    apply (simp add: add_env_def)\n    apply (auto)\n    apply (erule_tac x=\"ua\" in allE)\n    apply (erule_tac x=\"ua\" in allE)\n    apply (case_tac \"p_map ua\")\n     apply (auto)\n    apply (simp add: valid_exp_use_env_def)\n     apply (rule_tac p_map=\"p_map\" and u=\"u\" and v=\"ua\" and r_p=\"aa\" and r_s=\"a\" and ?s1.0=\"s1\" in red_sep_nres_map2)\n           apply (auto)\n      apply (rule_tac r_x=\"infl_use_env a r_s2\" in leq_safe_act)\n       apply (simp)\n      apply (rule_tac lhs_infl_leq_use_env)\n      apply (rule_tac id_leq_use_env)\n    (* - it's true for the modified res map by valid_reduct's def *)\n   apply (simp add: add_env_def)\n   apply (simp add: valid_exp_use_env_def)\n    (* - action safety *)\n  apply (rule_tac r_x=\"infl_use_env a r_s2\" in leq_safe_act)\n   apply (simp)\n  apply (rule_tac lhs_infl_leq_use_env)\n  apply (rule_tac id_leq_use_env)\n  done      \n      \n    (* ##### 4a. fork lemma: proves well-typedness of new thread ##### *)\n    \ndefinition unit_app_abbrev where\n  \"unit_app_abbrev e = (AppExp e (ConstExp UnitConst))\"\n    \n    (* this lemma allows us to type the expression passed into a fork so that it can be moved into another thread. since it will be\n        stored in another thread, the requirements must be contained by r_s1, yet completely removable from it.\n        from the previous lemma, we know that this can be taken from just the non-prim vars in e *)\n\nlemma safe_fork_lam: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; is_value e; is_own r \\<rbrakk> \\<Longrightarrow>\n  well_typed env (np_dom_use_env env e) (unit_app_abbrev e) UnitTy empty_use_env empty_use_env\"\n  apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n    apply (auto)\n  apply (simp add: unit_app_abbrev_def)\n    (* base case *)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"e\" and tau=\"FunTy UnitTy UnitTy UsePerm a\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n    apply (simp)\n   apply (rule_tac value_is_sexp)\n   apply (auto)\n  apply (rule_tac x=\"UsePerm\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"np_dom_use_env env e\" in exI)\n  apply (rule_tac x=\"np_dom_use_env env e\" in exI)\n  apply (auto)\n    (* the idea is that the infl_sexp_wp requirements are strictly greater than np_dom, and since np_dom is strong, there is an exact way of\n        subtracting to get to np_dom. (we do cheat a little by lifting rx2). *)\n   apply (rule_tac t=\"np_dom_use_env env e\" and s=\"diff_use_env (comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3))\n    (diff_use_env (lift_use_env (comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3)) r) (np_dom_use_env env e))\" in subst)\n    apply (rule_tac sfl_diff_use_env)\n      apply (simp add: np_dom_use_env_def)\n      apply (rule_tac strong_dom_use_env)\n     apply (simp add: leq_use_env_def)\n     apply (auto)\n    (* to prove that the infl_sexp_wp reqs are greater than np_dom, we use the fact that any npv must have a permission *)\n    apply (simp add: np_dom_use_env_def)\n    apply (simp add: dom_use_env_def)\n    apply (auto)\n    apply (case_tac \"comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3) x \\<noteq> OwnPerm\")\n     apply (case_tac \"comp_use_env rx2 (infl_use_env r_s2a r_s3) x = NoPerm\")\n      apply (cut_tac x=\"x\" and env=\"env\" and e=\"e\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_no_npv_use)\n        apply (auto)\n    apply (cut_tac r_sa=\"lift_use_env rx2 ra\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_no_own_both)\n     apply (auto)\n    apply (case_tac \"rx2 x \\<noteq> NoPerm\")\n     apply (simp add: is_own_def)\n    apply (case_tac \"rx2 x\")\n      apply (auto)\n    apply (case_tac \"infl_use_env r_s2a r_s3 x \\<noteq> NoPerm\")\n     apply (simp add: infl_use_env_def)\n     apply (case_tac \"r_s2a x = OwnPerm \\<and> r_s3 x = NoPerm\")\n      apply (auto)\n    apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n      apply (auto)\n    (* with that in mind, we manipulate until we match the infl sexp lemma *)\n   apply (rule_tac well_typed_diff_perms)\n    apply (rule_tac rx=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_req)\n      apply (rule_tac r_s=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_incr_simul_perm)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac comp_leq_use_env1)\n        apply (rule_tac self_lift_leq_use_env)\n       apply (rule_tac self_comp_leq_use_env2)\n      apply (simp)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac comp_leq_use_env1)\n      apply (rule_tac self_lift_leq_use_env)\n     apply (rule_tac self_comp_leq_use_env2)\n    apply (rule_tac id_leq_use_env)\n    (* next, we must show that the differential is actually subtractible, which is true since it removes all non-prim vars *)\n  apply (auto)\n   apply (case_tac \"np_dom_use_env env e x \\<noteq> OwnPerm\")\n    apply (simp add: np_dom_use_env_def)\n    apply (simp add: dom_use_env_def)\n   apply (cut_tac r_s=\"lift_use_env (comp_use_env (lift_use_env rx2 ra) (infl_use_env r_s2a r_s3)) r\" and\n       r_ex=\"np_dom_use_env env e\" and x=\"x\" in diff_use_none_ex)\n    apply (simp)\n   apply (simp add: own_env_vars_def)\n    (* lastly, we prove the various inequalities for application to a unit const *)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (rule_tac x=\"np_dom_use_env env e\" in exI)\n  apply (auto)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (auto)\n         apply (rule_tac leq_empty_use_env)(*\n        apply (simp add: empty_use_env_def)\n       apply (simp add: unlim_def)*)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac disj_empty_use_env1)\n    apply (rule_tac leq_empty_use_env)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: app_req_def)\n  apply (rule_tac leq_empty_use_env)\n  done      \n    \n    (* ##### 4b. fork lemma: if x is an npv in 'e', then we have ownership permissions for 'h (fork e)' ##### *)\n \nlemma safe_fork_own_npv_use: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n is_value e; x \\<in> non_prim_vars env e \\<rbrakk> \\<Longrightarrow> r_s1 x = OwnPerm\"\n  apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n        apply (auto)\n    (* base case *)\n     apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"e\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n       apply (auto)\n      apply (rule_tac value_is_sexp)\n      apply (simp)\n     apply (case_tac \"comp_use_env rx2 (infl_use_env r_s2a r_s3) x = NoPerm\")\n      apply (cut_tac env=\"env\" and x=\"x\" and e=\"e\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" in well_typed_no_npv_use)\n        apply (auto)\n     apply (case_tac \"rx2 x \\<noteq> NoPerm\")\n      apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" and x=\"x\" in leq_use_own)\n        apply (simp add: is_own_def)\n       apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n        apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n         apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n          apply (auto)\n       apply (rule_tac well_typed_perm_leq)\n       apply (auto)\n      apply (rule_tac self_comp_leq_use_env2)\n     apply (case_tac \"infl_use_env r_s2a r_s3 x \\<noteq> NoPerm\")\n      apply (simp add: infl_use_env_def)\n      apply (case_tac \"r_s2a x = OwnPerm \\<and> r_s3 x = NoPerm\")\n       apply (auto)\n      apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n       apply (auto)\n     apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n       apply (auto)\n    (* rhs induct *)\n    apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n     apply (simp)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n    (* rhs pair *)\n    apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n    apply (simp)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n    (* unpack *)(*\n  apply (rule_tac r_x=\"r_s2a\" in leq_use_own)\n   apply (simp)\n  apply (rule_tac r_sb=\"diff_use_env r_s3a (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa)\" in trans_leq_use_env)\n   apply (rule_tac diff_leq_use_env)\n   apply (rule_tac r_sb=\"r_s2b\" in trans_leq_use_env)\n    apply (auto)\n  apply (rule_tac well_typed_perm_leq)\n  apply (auto)*)\n  done    \n    \n    (* ##### 4c. fork lemma: proves well-typedness of original thread post-fork ##### *)\n\n    (* this lemma proves that e should be removable from the fork. combined with the previous lemmas, we can also remove the\n      permissions of e, and type the two resultant expressions disjointly. *)\n    \nlemma safe_fork_exp_ih: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; is_value e \\<rbrakk> \\<Longrightarrow>\n  well_typed env r_s1 (app_hole h (ConstExp UnitConst)) tau r_s2 rx\"\n  apply (induct h arbitrary: env r_s1 e tau r_s2 rx)\n        apply (auto)\n    (* base case *)\n        apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n         apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n          apply (simp)\n         apply (rule_tac diff_leq_use_env)\n         apply (rule_tac well_typed_perm_leq)\n         apply (auto)\n    (* lhs induct *)\n       apply (rule_tac x=\"t1\" in exI)\n       apply (rule_tac x=\"r\" in exI)\n       apply (rule_tac x=\"a\" in exI)\n       apply (rule_tac x=\"r_s2a\" in exI)\n       apply (rule_tac x=\"rx1\" in exI)\n       apply (auto)\n    (* rhs induct *)\n      apply (rule_tac x=\"t1\" in exI)\n      apply (rule_tac x=\"r\" in exI)\n      apply (rule_tac x=\"a\" in exI)\n      apply (rule_tac x=\"r_s2a\" in exI)\n      apply (rule_tac x=\"rx1\" in exI)\n      apply (auto)\n      apply (rule_tac x=\"rx2\" in exI)\n      apply (rule_tac x=\"r_s3\" in exI)\n      apply (auto)\n    (* if case *)\n     apply (rule_tac x=\"rx'\" in exI)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (auto)\n    (* lhs pair case *)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (rule_tac x=\"r_s3\" in exI)\n    apply (rule_tac x=\"rx1\" in exI)\n    apply (auto)\n    (* rhs pair case *)\n   apply (rule_tac x=\"r_s2a\" in exI)\n   apply (rule_tac x=\"r_s3\" in exI)\n   apply (rule_tac x=\"rx1\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"rx2\" in exI)\n   apply (auto)\n    (* unpack case *)(*\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n   apply (rule_tac x=\"t1a\" in exI)\n   apply (rule_tac x=\"ra\" in exI)\n   apply (auto)\n    apply (rule_tac x=\"aa\" in exI)\n    apply (rule_tac x=\"t1b\" in exI)\n    apply (rule_tac x=\"t2\" in exI)\n    apply (rule_tac x=\"tx\" in exI)\n    apply (auto)\n   apply (rule_tac x=\"r_s2b\" in exI)\n   apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)*)\n  done\n    \n    (* uses:\n        - safe_fork_hole_npv_use: to determine that if x is an np-var, it is not in h\n        - 4b (safe_fork_own_npv_use) to determine that if x is an np-var, we own it\n    *)\n  \nlemma safe_fork_exp: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n  valid_nres_map s rs_map; valid_exp_use_env s rs_map r_s1; wf_hole h; is_value e \\<rbrakk> \\<Longrightarrow>\n  well_typed env (diff_use_env r_s1 (full_dom_use_env env rs_map e)) (app_hole h (ConstExp UnitConst)) tau\n  (diff_use_env r_s2 (full_dom_use_env env rs_map e)) (diff_use_env rx (full_dom_use_env env rs_map e))\"\n  apply (rule_tac well_typed_diff_perms)\n   apply (rule_tac safe_fork_exp_ih)\n    apply (auto)\n  apply (simp add: non_prim_vars_def)\n  apply (auto)\n    (* we want to show that if x is in the dominator, it is not an np-var in h.\n        > if x is an np-var itself, it cannot be in e by lemma *)\n  apply (case_tac \"x \\<in> non_prim_vars env e\")\n   apply (cut_tac h=\"h\" and x=\"x\" and e=\"ConstExp UnitConst\" in app_hole_free_vars_rev)\n    apply (auto)\n   apply (cut_tac h=\"h\" and x=\"x\" and env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" in safe_fork_hole_npv_use)\n       apply (auto)\n    (* otherwise, x is in the completion. we identify its ancestor z. *)\n  apply (simp add: own_env_vars_def)\n  apply (simp add: full_dom_use_env_def)\n  apply (simp add: dom_use_env_def)\n  apply (case_tac \"\\<exists>l z. z \\<in> non_prim_vars env e \\<and> path_lookup rs_map z l x\")\n   apply (auto)\n    (* we note that z is a np-var of e therefore r_s1 z = Own *)\n  apply (cut_tac x=\"z\" and env=\"env\" in safe_fork_own_npv_use)\n     apply (auto)\n    (* x then is in the lookup map of some parent y. *)\n  apply (cut_tac rs_map=\"rs_map\" and z=\"z\" and x=\"x\" in path_lookup_parent)\n     apply (auto)\n    (* with that in mind, by separation, x is disjoint from r_s1. *)\n  apply (case_tac \"r_s1 x \\<noteq> NoPerm\")\n   apply (simp add: valid_exp_use_env_def)\n   apply (simp add: sep_nres_map_def)\n   apply (auto)\n   apply (erule_tac x=\"y\" in allE)\n   apply (simp add: nres_lookup_def)\n   apply (simp add: strong_disj_use_env_def)\n   apply (erule_tac x=\"x\" in allE)\n   apply (auto)\n    (* by extension, x is not in 'h (fork e)' *)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and x=\"x\" in well_typed_no_npv_use)\n    apply (auto)\n  apply (simp add: non_prim_vars_def)\n    (* the very last part is showing that x not in 'h (fork e)' implies x not in 'h ()'. *)\n  apply (cut_tac x=\"x\" and h=\"h\" and e=\"ConstExp UnitConst\" in app_hole_free_vars_rev)\n   apply (auto)\n  apply (cut_tac x=\"x\" and h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" in app_hole_free_vars2)\n   apply (auto)\n  done\n  \n    (*\nlemma safe_fork_exp_full: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n  scope_res_map rs_map; valid_use_env s rs_map r_c r_s1; wf_hole h; is_value e \\<rbrakk> \\<Longrightarrow>\n  well_typed env (diff_use_env r_s1 (full_dom_use_env env rs_map e)) (app_hole h (ConstExp UnitConst)) tau\n  (diff_use_env r_s2 (full_dom_use_env env rs_map e)) (diff_use_env rx (full_dom_use_env env rs_map e))\"\n  apply (rule_tac well_typed_diff_perms)\n   apply (rule_tac safe_fork_exp_ih)\n    apply (auto)\n  apply (simp add: non_prim_vars_def)\n  apply (auto)\n    (* we want to show that if x is in the dominator, it is not an np-var in h.\n        > if x is an np-var itself, it cannot be in h by lemma *)\n  apply (case_tac \"x \\<in> non_prim_vars env e\")\n   apply (cut_tac h=\"h\" and x=\"x\" and e=\"ConstExp UnitConst\" in app_hole_free_vars_rev)\n    apply (auto)\n   apply (cut_tac h=\"h\" and x=\"x\" and env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" in safe_fork_hole_npv_use)\n       apply (auto)\n    (* otherwise, x is in the completion. we identify its ancestor z. *)\n  apply (simp add: own_env_vars_def)\n  apply (simp add: full_dom_use_env_def)\n  apply (simp add: dom_use_env_def)\n  apply (case_tac \"\\<exists>l z. z \\<in> non_prim_vars env e \\<and> path_lookup rs_map z l x\")\n   apply (auto)\n    (* we note that z is a np-var of e therefore r_c z = Own *)\n  apply (cut_tac r_x=\"r_s1\" and r_s=\"r_c\" and x=\"z\" in leq_use_own)\n    apply (rule_tac x=\"z\" and env=\"env\" in safe_fork_own_npv_use)\n      apply (auto)\n   apply (simp add: valid_use_env_def)\n    (* x is also in the lookup map of some parent y. we claim that r_c y = Own.\n        if y = z, because of the prev, otherwise by path lookup. *)\n  apply (cut_tac rs_map=\"rs_map\" and z=\"z\" and x=\"x\" in path_lookup_parent)\n     apply (auto)\n  apply (case_tac \"r_c y \\<noteq> OwnPerm\")\n   apply (case_tac \"y = z\")\n    apply (auto)\n   apply (cut_tac r_c=\"r_c\" and x=\"y\" and z=\"z\" in path_lookup_own)\n        apply (auto)\n   apply (simp add: valid_use_env_def)\n   apply (simp add: valid_use_entry_def)\n   apply (simp add: part_valid_entry_def)\n    (* with that in mind, its lookup map should be disjoint from r_s, and by extension np-vars of h *)\n  apply (case_tac \"r_s1 x \\<noteq> NoPerm\")\n   apply (simp add: valid_use_env_def)\n   apply (simp add: valid_use_entry_def)\n   apply (auto)\n   apply (erule_tac x=\"y\" in allE)\n   apply (auto)\n   apply (simp add: strong_disj_use_env_def)\n   apply (simp add: lookup_res_def)\n    apply (\n   apply (simp add: mini_disj_use_env_def)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and x=\"x\" in well_typed_no_npv_use)\n    apply (auto)\n  apply (simp add: non_prim_vars_def)\n    (* the very last part is showing that x not in h (fork e) implies x not in h (). *)\n  apply (cut_tac x=\"x\" and h=\"h\" and e=\"ConstExp UnitConst\" in app_hole_free_vars_rev)\n   apply (auto)\n  apply (cut_tac x=\"x\" and h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" in app_hole_free_vars2)\n   apply (auto)\n  done   *) \n    \n    (* ##### 4d. fork lemma: structural lemma for thread-disjointness in fork case ###### *)\n    \nlemma alift_strong_disj_use_env1: \"\\<lbrakk> strong_disj_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> strong_disj_use_env (lift_use_env r_x r) r_s\"    \n  apply (simp add: strong_disj_use_env_def)\n  apply (auto)\n  apply (case_tac r)\n    apply (auto)\n  done\n  \n    (* a special lemma that makes it easier to comprehend our strategy for proving the disjointness of the fork *)\nlemma fork_disj_nres_map: \"\\<lbrakk> disj_nres_map p_map; p_map u = Some r_s; is_own r;\n  leq_use_env r_xa (lift_use_env r_s r); leq_use_env r_xb (lift_use_env r_s r);\n  strong_disj_use_env r_xa r_xb \\<rbrakk> \\<Longrightarrow> disj_nres_map (add_env (add_env p_map u r_xa) v r_xb)\"\n  apply (rule_tac disj_add_nres_map)\n   apply (rule_tac disj_add_nres_map)\n    apply (simp)\n    (* first we must prove the disjointness of the new assignment to u *)\n   apply (simp add: sep_nres_map_def)\n   apply (auto)\n   apply (case_tac \"u = x\")\n    apply (cut_tac rs_map=\"p_map\" and x=\"u\" in nres_rem_same)\n    apply (auto)\n    apply (rule_tac empty_strong_disj_use_env2)\n   apply (cut_tac rs_map=\"p_map\" and x=\"u\" and y=\"x\" in nres_rem_diff)\n    apply (auto)\n   apply (simp add: disj_nres_map_def)\n   apply (erule_tac x=\"u\" in allE)\n   apply (erule_tac x=\"x\" in allE)\n   apply (auto)\n   apply (rule_tac r_s=\"lift_use_env r_s r\" in strong_disj_leq_use_env1)\n    apply (rule_tac alift_strong_disj_use_env1)\n    apply (simp add: nres_lookup_def)\n   apply (simp)\n    (* next we prove the disjointness of v, starting with its disjointness to u *)\n  apply (simp add: sep_nres_map_def)\n  apply (auto)\n  apply (case_tac \"x = v\")\n   apply (cut_tac rs_map=\"add_env p_map u r_xa\" and x=\"v\" in nres_rem_same)\n   apply (auto)\n   apply (rule_tac empty_strong_disj_use_env2)\n  apply (case_tac \"x = u\")\n   apply (auto)\n   apply (case_tac \"\\<not> nres_lookup (add_env p_map u r_xa) u = r_xa\")\n    apply (simp add: nres_lookup_def)\n    apply (simp add: add_env_def)\n   apply (cut_tac rs_map=\"add_env p_map u r_xa\" and x=\"v\" and y=\"u\" in nres_rem_diff)\n    apply (auto)\n   apply (rule_tac comm_strong_disj_use_env)\n   apply (simp)\n    (* next we prove its disjointess to the rest of the map *)\n  apply (cut_tac rs_map=\"add_env p_map u r_xa\" and x=\"v\" and y=\"x\" in nres_rem_diff)\n   apply (auto)\n  apply (cut_tac rs_map=\"p_map\" and x=\"u\" and y=\"x\" and r_s=\"r_xa\" in nres_add_diff)\n   apply (auto)\n  apply (simp add: disj_nres_map_def)\n  apply (erule_tac x=\"u\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (rule_tac r_s=\"lift_use_env r_s r\" in strong_disj_leq_use_env1)\n   apply (rule_tac alift_strong_disj_use_env1)\n   apply (simp add: nres_lookup_def)\n  apply (simp)\n  done\n\n    (* ##### 4_X. process reduction validity for fork case ##### *)    \n  \nlemma lift_sep_nres_map: \"\\<lbrakk> sep_nres_map r_s rs_map \\<rbrakk> \\<Longrightarrow> sep_nres_map (lift_use_env r_s r) rs_map\"  \n  apply (simp add: sep_nres_map_def)\n  apply (auto)\n  apply (rule_tac alift_strong_disj_use_env1)\n  apply (auto)\n  done\n  \nlemma lift_sub_use_env: \"\\<lbrakk> sub_use_env s r_s \\<rbrakk> \\<Longrightarrow> sub_use_env s (lift_use_env r_s r)\"    \n  apply (simp add: sub_use_env_def)\n  apply (auto)\n  apply (case_tac r)\n    apply (auto)\n  done\n  \nlemma srps_fork_case: \"\\<lbrakk>well_typed_system env rs_map p_map s2 ps1; r_ax = ForkAct; ps1 u = Some (app_hole h (AppExp (ConstExp ForkConst) e));\n                wf_hole h; is_value e; ps2 = add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)); fresh_var ps1 v;\n                s1 = s2\\<rbrakk>\n               \\<Longrightarrow> \\<exists>r_s g_ax. (\\<exists>p_map'. well_typed_system (red_env env g_ax) (red_nres_map rs_map g_ax) p_map' s2\n                                     (add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)))) \\<and>\n                          safe_act s2 r_s g_ax\"    \n    (* fork case. no resources are generated in this step *)\n  apply (rule_tac x=\"empty_use_env\" in exI)\n  apply (rule_tac x=\"NoResAct\" in exI)\n  apply (auto)\n  apply (simp add: well_typed_system_def)\n  apply (auto)\n    (* before we can give the new process map types, we have to get the well-typedness statement for h (fork e) *)\n  (*apply (case_tac \"\\<not> (case ps1 u of None \\<Rightarrow> True\n                     | Some e \\<Rightarrow> (case lookup_mem p_map u of None \\<Rightarrow> False\n                                 | Some (r_c, s') \\<Rightarrow> \\<exists>rx r_s r_s2. well_typed env r_s e UnitTy r_s2 rx \\<and> valid_use_env s2 rs_map r_c r_s))\")*)\n  apply (case_tac \"\\<not> (full_nres_map ps1 p_map \\<and>\n     disj_nres_map p_map \\<and> (\\<forall>u. case ps1 u of None \\<Rightarrow> True | Some e \\<Rightarrow>\n      (case p_map u of None \\<Rightarrow> False | Some r_s \\<Rightarrow> \\<exists>rx r_s2. well_typed env r_s e UnitTy r_s2 rx \\<and> proper_exp rs_map e)))\")\n   apply (simp add: well_typed_proc_set_def)\n  apply (auto)\n  apply (case_tac \"\\<not> (case ps1 u of None \\<Rightarrow> True | Some e \\<Rightarrow> (case p_map u of None \\<Rightarrow> False | Some r_s \\<Rightarrow> \\<exists>rx r_s2. well_typed env r_s e UnitTy r_s2 rx \\<and> proper_exp rs_map e))\")\n   apply (erule_tac x=\"u\" in allE)\n   apply (erule_tac x=\"u\" in allE)\n   apply (auto)\n  apply (case_tac \"p_map u\")\n   apply (auto)\n    (* using the fork lemmas, we can generate a type for e + a type for h () *)\n  apply (cut_tac eq_own)\n  apply (auto)\n  apply (cut_tac env=\"env\" and e=\"e\" and ?r_s1.0=\"a\" and tau=\"UnitTy\" and h=\"h\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and r=\"r\" in safe_fork_lam)\n     apply (auto)\n  apply (cut_tac env=\"env\" and e=\"e\" and ?r_s1.0=\"a\" and tau=\"UnitTy\" and h=\"h\" and ?r_s2.0=\"r_s2\" and rx=\"rx\" and s=\"s2\" and rs_map=\"rs_map\" in safe_fork_exp)\n       apply (auto)\n    apply (simp add: well_typed_state_def)\n    (* - complete proof that a is still valid *)\n   apply (simp add: valid_exp_use_env_def)\n   apply (simp add: well_typed_proc_set_def)\n   apply (simp add: sub_nres_map_def)\n   apply (erule_tac x=\"u\" in allE)\n   apply (erule_tac x=\"u\" in allE)\n   apply (simp add: nres_lookup_def)\n    (* - prelim: prove that (full_dom_use_env env rs_map e) \\<le> a (old complete map) *)(*\n  apply (cut_tac rs_map=\"rs_map\" and e=\"e\" and r_c=\"a\" and h=\"h\" and env=\"env\" in valid_full_dom_leq_use_env)\n      apply (auto)\n   apply (simp add: well_typed_state_def)*)\n    (* - prelim: np_dom_use_env env e \\<le> lift_use_env a r *)\n  apply (cut_tac r_sc=\"np_dom_use_env env e\" and r_sb=\"np_dom_use_env env (app_hole h (AppExp (ConstExp ForkConst) e))\" \n      and r_sa=\"lift_use_env a r\" in trans_leq_use_env)\n    apply (rule_tac wt_np_leq_use_env)\n     apply (auto)\n   apply (simp add: np_dom_use_env_def)\n   apply (rule_tac dist_dom_leq_use_env)\n   apply (auto)\n   apply (simp add: non_prim_vars_def)\n   apply (cut_tac x=\"x\" and e=\"AppExp (ConstExp ForkConst) e\" in app_hole_free_vars)\n    apply (auto)\n    (* we fill in the  new process map, by taking perms from 'u' [[ h () ]] and giving them to 'v' [[ e () ]] *)\n  apply (rule_tac x=\"add_env (add_env p_map u (diff_use_env a (full_dom_use_env env rs_map e))) v (np_dom_use_env env e)\" in exI)\n  apply (simp add: well_typed_proc_set_def)\n  apply (auto)\n    (* completeness of the new process map *)\n      apply (rule_tac add_full_nres_map)\n      apply (rule_tac add_full_nres_map)\n      apply (simp)\n    (* disjointness of the new process map *)\n     apply (rule_tac r_s=\"a\" and r=\"r\" in fork_disj_nres_map)\n          apply (auto)\n      apply (rule_tac lift_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (rule_tac r_s=\"full_dom_use_env env rs_map e\" in strong_disj_leq_use_env2)\n      apply (rule_tac reduce_strong_disj_use_env)\n       apply (simp add: disj_use_env_def)\n       apply (auto)\n        apply (rule_tac r_s=\"a\" in mini_disj_strong_use_env)\n         apply (rule_tac id_leq_use_env)\n        apply (simp add: full_dom_use_env_def)\n        apply (rule_tac strong_dom_use_env)\n       apply (rule_tac mini_disj_diff_use_env)\n      apply (simp add: full_dom_use_env_def)\n      apply (rule_tac strong_dom_use_env)\n     apply (rule_tac full_dom_leq_use_env)\n    (* proving everything is still well-typed. we start with ua = v, ie the 'e ()' thread. *)\n    apply (case_tac \"ua = v\")\n     apply (case_tac \"\\<not> add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)) ua =\n      Some (unit_app_abbrev e)\")\n      apply (simp add: add_env_def)\n      apply (simp add: unit_app_abbrev_def)\n     apply (auto)\n     apply (case_tac \"\\<not> (add_env (add_env p_map u (diff_use_env a (full_dom_use_env env rs_map e))) v (np_dom_use_env env e)) v =\n      Some (np_dom_use_env env e)\")\n      apply (simp add: add_env_def)\n     apply (auto)\n    (* - properness *)\n     apply (cut_tac rs_map=\"rs_map\" and h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" in proper_app_hole_split2)\n      apply (simp)\n     apply (simp add: unit_app_abbrev_def)\n     apply (simp add: proper_exp_def)\n    (* - well-typedness for ua = u, the 'h ()' thread*)\n    apply (case_tac \"ua = u\")\n     apply (case_tac \"\\<not> add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)) ua =\n        Some (app_hole h (ConstExp UnitConst))\")\n      apply (simp add: add_env_def)\n     apply (auto)\n     apply (case_tac \"\\<not> (add_env (add_env p_map u (diff_use_env a (full_dom_use_env env rs_map e))) v (np_dom_use_env env e)) u =\n        Some (diff_use_env a (full_dom_use_env env rs_map e))\")\n      apply (simp add: add_env_def)\n     apply (auto)\n    (* - properness *)\n     apply (cut_tac rs_map=\"rs_map\" and h=\"h\" in proper_app_hole_split1)\n      apply (simp)\n     apply (rule_tac proper_app_hole_recon)\n      apply (simp)\n     apply (simp add: proper_exp_def)\n    (* - well-typedness for unaltered threads *)\n    apply (erule_tac x=\"ua\" in allE)\n    apply (case_tac \"\\<not> add_env (add_env ps1 u (app_hole h (ConstExp UnitConst))) v (AppExp e (ConstExp UnitConst)) ua = ps1 ua\")\n     apply (simp add: add_env_def)\n    apply (case_tac \"ps1 ua\")\n     apply (auto)\n    apply (case_tac \"\\<not> (add_env (add_env p_map u (diff_use_env a (full_dom_use_env env rs_map e))) v (np_dom_use_env env e)) ua =\n      p_map ua\")\n     apply (simp add: add_env_def)\n    apply (auto)\n    apply (erule_tac x=\"ua\" in allE)\n    apply (auto)\n    (* proving the new process map is contained in the state *)\n   apply (rule_tac add_sub_nres_map1)\n    apply (rule_tac add_sub_nres_map1)\n     apply (simp)\n    apply (rule_tac r_s=\"a\" in trans_sub_use_env)\n     apply (simp add: sub_nres_map_def)\n     apply (erule_tac x=\"u\" in allE)\n     apply (erule_tac x=\"u\" in allE)\n     apply (simp add: nres_lookup_def)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (rule_tac r_s=\"lift_use_env a r\" in trans_sub_use_env)\n    apply (rule_tac lift_sub_use_env)\n    apply (simp add: sub_nres_map_def)\n    apply (erule_tac x=\"u\" in allE)\n    apply (erule_tac x=\"u\" in allE)\n    apply (simp add: nres_lookup_def)\n   apply (simp)\n    (* proving that separation still holds. we again start with ua = v, the 'e ()' thread *)\n  apply (case_tac \"ua = v\")\n   apply (simp add: add_env_def)\n   apply (rule_tac r_s=\"lift_use_env a r\" in leq_sep_nres_map)\n    apply (simp)\n   apply (rule_tac lift_sep_nres_map)\n   apply (erule_tac x=\"u\" in allE)\n   apply (simp)\n    (* - same for ua = u, ie the 'h ()' thread *)\n  apply (case_tac \"ua = u\")\n   apply (simp add: add_env_def)\n   apply (rule_tac r_s=\"a\" in leq_sep_nres_map)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (erule_tac x=\"u\" in allE)\n   apply (simp)\n    (* - lastly prove separation for original threads *)\n  apply (simp add: add_env_def)\n  done\n  \n  (*\nlemma valid_fork: \"valid_reduct fork_reduce\"  \n  apply (simp add: valid_reduct_def)\n  apply (auto)\n  apply (case_tac e1)\n       apply (auto)\n  apply (case_tac x61)\n       apply (auto)\n  apply (case_tac x1)\n               apply (auto)\n  apply (case_tac e2)\n       apply (auto)\n   apply (case_tac x1)\n                apply (auto)\n   apply (case_tac \"aa\")\n    apply (auto)\n  apply (rule_tac x=\"NoResAct\" in exI)\n  apply (auto)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac r_sb=\"r_s2a\" in trans_leq_use_env)\n      apply (auto)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (case_tac x1)\n                apply (auto)\n  apply (case_tac x1)\n               apply (auto)\n  done*)\n  \n    (* the main gsre lemma is intended to prove that given a hole, an expression in that hole, and a reduction on that expression,\n        we can re-type the hole entirely.\n\n      this lemma aims to do something similar, but in addition to re-typing the hole, we pull out the old expression and type it\n        disjointly from the old hole. this is not achievable with the standard gsre lemma because it's not really true that in general\n        they will end up disjoint.\n\n      in this case they will end up disjoint because the expression being put into the hole has permissions disjoint from the rest\n        of the expression.\n    *)\n    \n    (* if e appears on the lhs of an expression, it will be subtracted out before you get to e2.\n        if e appears on the rhs, it can be assumed that you will subtract it out then.\n\n       but either way, the point is that we can get rxa, the exact permissions for e, and type h () in a manner disjoint from rxa.\n    *)\n\n    \n\n    (*\nlemma valid_np_dom_leq_use_env: \"\\<lbrakk> well_typed env r_s (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; is_value e;\n  valid_use_env s rs_map r_c r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (np_dom_use_env env e) r_s\"      \n  apply (simp add: leq_use_env_def)\n  apply (simp add: np_dom_use_env_def)\n  apply (simp add: dom_use_env_def)\n  apply (simp add: valid_use_env_def)\n  apply (auto)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s\" and h=\"h\" and e=\"e\" and x=\"x\" in safe_fork_own_npv_use)\n     apply (simp_all)\n  done\n    \nlemma valid_full_dom_leq_use_env: \"\\<lbrakk> well_typed env r_s (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; is_value e;\n  valid_res_map s rs_map; valid_use_env s rs_map r_c r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (full_dom_use_env env rs_map e) r_c\"  \n  apply (simp add: leq_use_env_def)\n  apply (simp add: full_dom_use_env_def)\n  apply (simp add: dom_use_env_def)\n  apply (auto)\n    (* if x is in the non-prim var set, we must have ownership in r_s, and thus r_c *)\n  apply (case_tac \"x \\<in> non_prim_vars env e\")\n   apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s\" and h=\"h\" and e=\"e\" and x=\"x\" in safe_fork_own_npv_use)\n      apply (simp_all)\n   apply (cut_tac r_x=\"r_s\" and r_s=\"r_c\" and x=\"x\" in leq_use_own)\n     apply (simp_all)\n   apply (simp add: valid_use_env_def)\n    (* otherwise x has ancestor z. z is in the non-prim var set, so c has a value on it *)\n  apply (case_tac \"r_c z = NoPerm\")\n   apply (cut_tac r_x=\"r_s\" and r_s=\"r_c\" and x=\"z\" in leq_use_none)\n     apply (simp add: valid_use_env_def)\n    apply (simp)\n   apply (cut_tac x=\"z\" and ?r_s1.0=\"r_s\" and env=\"env\" in well_typed_no_npv_use)\n     apply (auto)\n   apply (cut_tac x=\"z\" and h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" in app_hole_free_vars)\n    apply (simp add: non_prim_vars_def)\n   apply (simp add: non_prim_vars_def)\n    (* by path lookup, r_c x has ownership  *)\n  apply (cut_tac r_c=\"r_c\" and z=\"z\" and l=\"l\" in path_lookup_own)\n       apply (auto)\n   apply (simp add: valid_res_map_def)\n  apply (simp add: valid_use_env_def)\n  apply (simp add: valid_use_entry_def)\n  apply (simp add: part_valid_entry_def)\n  done    \n\n    (*\nlemma safe_fork_exp: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; wf_hole h; is_value e \\<rbrakk> \\<Longrightarrow>\n  well_typed env (diff_use_env r_s1 (np_dom_use_env env e)) (app_hole h (ConstExp UnitConst)) tau\n  (diff_use_env r_s2 (np_dom_use_env env e)) (diff_use_env rx (np_dom_use_env env e))\"\n  apply (rule_tac well_typed_diff_perms)\n   apply (rule_tac safe_fork_exp_ih)\n    apply (auto)\n  apply (simp add: non_prim_vars_def)\n  apply (auto)\n  apply (cut_tac h=\"h\" and x=\"x\" and e=\"ConstExp UnitConst\" in app_hole_free_vars_rev)\n   apply (auto)\n  apply (cut_tac h=\"h\" and x=\"x\" and env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"e\" in safe_fork_hole_npv_use)\n      apply (auto)\n  apply (simp add: non_prim_vars_def)\n  apply (simp add: own_env_vars_def)\n  apply (simp add: np_dom_use_env_def)\n  apply (simp add: dom_use_env_def)\n  apply (simp add: non_prim_vars_def)\n  apply (case_tac \"x \\<in> free_vars e\")\n   apply (auto)\n  done*)\n    \nlemma trans_sub_use_env: \"\\<lbrakk> sub_use_env s r_s; leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> sub_use_env s r_x\"    \n  apply (simp add: sub_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_x x\")\n    apply (auto)\n  done\n  \nlemma red_valid_use_env: \"\\<lbrakk> app_red_exp are (s1, e1) ax (s2, e2); valid_use_env s1 rs_map r_c r_s;\n  safe_act s1 g_ax; corr_act ax g_ax \\<rbrakk> \\<Longrightarrow> valid_use_env s2 (red_res_map rs_map g_ax) r_c r_s\"\n  apply (simp add: valid_use_env_def)\n  apply (auto)\n    (* r_c still contained in s2 *)\n   apply (rule_tac s=\"s1\" in contain_sub_use_env)\n    apply (simp)\n   apply (rule_tac app_red_exp_contain_env)\n   apply (auto)\n    (* the map for each element of r_s is still valid *)\n  apply (case_tac g_ax)\n    apply (auto)\n  apply (case_tac \"x = x21\")\n   apply (auto)\n   apply (cut_tac rs_map=\"rs_map\" and x=\"x21\" and r_s=\"x23\" in lookup_add_mem_same)\n   apply (simp)\n   apply (simp add: sub_use_env_def)\n  apply (cut_tac rs_map=\"rs_map\" and x=\"x21\" and r_s=\"x23\" and y=\"x\" in lookup_add_mem_diff)\n   apply (simp_all)\n  done\n    (*\nlemma sep_red_nres_map: \"\\<lbrakk> app_red_exp are (s1, e1) ax (s2, e2); corr_act ax g_ax; sep_nres_map r_s rs_map \\<rbrakk> \\<Longrightarrow> sep_nres_map r_s (red_nres_map rs_map g_ax)\"\n  apply (case_tac g_ax)\n    apply (auto)\n  apply (simp add: sep_nres_map_def)\n  apply (auto)\n  apply (case_tac \"x \\<noteq> x21\")\n   apply (simp add: nres_lookup_def)\n   apply (simp add: add_env_def)\n  apply (simp add: nres_lookup_def)\n  apply (simp add: add_env_def)\n  apply (case_tac are)\n        apply (auto)\n  apply (case_tac c)\n              apply (auto)\n    *)\n  \n    \n    \n    (*\nfun parent_res where\n  \"parent_res NilStack y x = False\"\n| \"parent_res (ConsStack a r_s rs_map') y x = (parent_res rs_map' y x \\<or>\n    (a = y \\<and> (r_s x \\<noteq> NoPerm \\<or> (\\<exists> y'. r_s y' \\<noteq> NoPerm \\<and> parent_res rs_map' y' x))))\"\n\nlemma fpr_coerce: \"\\<lbrakk> \\<And>s. \\<lbrakk>x \\<in> complete_vars rs_map s; x \\<notin> s \\<rbrakk> \\<Longrightarrow> \\<exists>y. y \\<in> s \\<and> parent_res rs_map y x;\n  x \\<in> complete_vars rs_map s; x \\<notin> s \\<rbrakk> \\<Longrightarrow> \\<exists>y. y \\<in> s \\<and> parent_res rs_map y x\"  \n  apply (auto)\n  done\n\n    *)(*\n\n    (* if x is in the completion of s, it is in the completion of t + s *)\nlemma union_complete_vars: \"\\<lbrakk> x \\<in> complete_vars rs_map t \\<rbrakk> \\<Longrightarrow> x \\<in> complete_vars rs_map (t \\<union> s)\"\n  apply (induct rs_map arbitrary: s t)\n   apply (auto)\n   apply (rule_tac t=\"use_env_vars x2 \\<union> (t \\<union> s)\" and s=\"(use_env_vars x2 \\<union> t) \\<union> s\" in subst)\n    apply (auto)\n  apply (case_tac \"x1 \\<in> t\")\n   apply (auto)\n   apply (rule_tac t=\"use_env_vars x2 \\<union> (t \\<union> s)\" and s=\"(use_env_vars x2 \\<union> t) \\<union> s\" in subst)\n    apply (auto)\n  apply (rule_tac t=\"use_env_vars x2 \\<union> (t \\<union> s)\" and s=\"t \\<union> (use_env_vars x2 \\<union> s)\" in subst)\n   apply (auto)\n  done\n    \n    (* if x is in the completion of t + s, but not in the completion of s, it must be in the completion of t *)\nlemma union_complete_vars_rev: \"\\<lbrakk> x \\<in> complete_vars rs_map (t \\<union> s) \\<rbrakk> \\<Longrightarrow> x \\<in> complete_vars rs_map s \\<or> x \\<in> complete_vars rs_map t\"\n  apply (induct rs_map arbitrary: t s)\n   apply (auto)\n     apply (case_tac \"x \\<in> complete_vars rs_map t\")\n      apply (cut_tac rs_map=\"rs_map\" and t=\"t\" and s=\"use_env_vars x2\" and x=\"x\" in union_complete_vars)\n       apply (auto)\n     apply (case_tac \"t \\<union> use_env_vars x2 \\<noteq> use_env_vars x2 \\<union> t\")\n      apply (auto)\n    apply (case_tac \"use_env_vars x2 \\<union> (t \\<union> s) \\<noteq> (use_env_vars x2 \\<union> s) \\<union> t\")\n     apply (auto)\n   apply (case_tac \"use_env_vars x2 \\<union> (t \\<union> s) \\<noteq> (use_env_vars x2 \\<union> s) \\<union> t\")\n    apply (auto)\n  apply (case_tac \"use_env_vars x2 \\<union> (t \\<union> s) \\<noteq> (use_env_vars x2 \\<union> t) \\<union> s\")\n   apply (auto)\n  done\n\n  \nlemma complete_vars_subset_ih: \"\\<lbrakk> s \\<subseteq> s' \\<rbrakk> \\<Longrightarrow> s \\<subseteq> complete_vars rs_map s'\"    \n  apply (induct rs_map arbitrary: s')\n   apply (auto)\n  apply (case_tac \"s \\<subseteq> (use_env_vars x2 \\<union> s')\")\n   apply (auto)\n  done    \n    \nlemma complete_vars_subset: \"s \\<subseteq> complete_vars rs_map s\"    \n  apply (rule_tac complete_vars_subset_ih)\n  apply (simp)\n  done\n  \n\n*)\n    \n    \nlemma full_dom_child_leq_use_env: \"\\<lbrakk> scope_res_map rs_map; full_dom_use_env env rs_map e x \\<noteq> NoPerm \\<rbrakk>\n       \\<Longrightarrow> leq_use_env (lookup_res rs_map x) (full_dom_use_env env rs_map e)\"\n  apply (simp add: lookup_res_def)\n  apply (case_tac \"lookup_mem rs_map x\")\n   apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (case_tac \"a xa = NoPerm\")\n   apply (auto)\n  apply (cut_tac env=\"env\" and rs_map=\"rs_map\" and x=\"x\" and y=\"xa\" in full_dom_recall)\n     apply (auto)\n   apply (simp add: lookup_res_def)\n   apply (cut_tac rs_map=\"rs_map\" and r_s=\"a\" in scope_res_map_strong)\n     apply (auto)\n   apply (simp add: strong_use_env_def)\n   apply (case_tac \"a xa\")\n     apply (auto)\n  apply (simp add: full_dom_use_env_def)\n  apply (simp add: dom_use_env_def)\n  apply (auto)\n  apply (case_tac \"\\<exists>l z. z \\<in> non_prim_vars env e \\<and> path_lookup rs_map z l xa\")\n   apply (auto)\n  done\n\n    \nlemma valid_np_dom_disj_use_env: \"\\<lbrakk> well_typed env r_s (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; is_value e;\n  full_dom_use_env env rs_map e x \\<noteq> NoPerm; valid_res_map s rs_map; valid_use_env s rs_map r_c r_s \\<rbrakk> \\<Longrightarrow>\n  disj_use_env (lookup_res rs_map x) (np_dom_use_env env e)\"\n  apply (case_tac \"r_c x = NoPerm\")\n   apply (cut_tac r_x=\"full_dom_use_env env rs_map e\" and r_s=\"r_c\" and x=\"x\" in leq_use_none)\n     apply (rule_tac valid_full_dom_leq_use_env)\n        apply (auto)\n  apply (rule_tac r_s=\"r_s\" in disj_leq_use_env2)\n   apply (simp add: valid_use_env_def)\n   apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (auto)\n   apply (simp add: valid_use_entry_def)\n  apply (rule_tac valid_np_dom_leq_use_env)\n    apply (auto)\n  done\n    \n    (* in theory we know that x is non-prim *)\nlemma valid_full_dom_disj_use_env: \"\\<lbrakk>\n  well_typed env r_s (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx; is_value e;\n  r_c x \\<noteq> NoPerm; full_dom_use_env env rs_map e x = NoPerm; valid_res_map s rs_map; valid_use_env s rs_map r_c r_s \\<rbrakk> \\<Longrightarrow>\n  mini_disj_use_env (full_dom_use_env env rs_map e) (lookup_res rs_map x)\"    \n  apply (simp add: mini_disj_use_env_def)\n  apply (auto)\n  apply (simp add: full_dom_use_env_def)\n  apply (simp add: dom_use_env_def)\n  apply (case_tac \"\\<exists>l z. z \\<in> non_prim_vars env e \\<and> path_lookup rs_map z l xa\")\n   apply (auto)\n    (* if l = [], xa is a non_prim_var, which means xa is in r_s xa *)\n  apply (case_tac l)\n   apply (auto)\n   apply (case_tac \"r_s xa \\<noteq> OwnPerm\")\n    apply (cut_tac ?r_s1.0=\"r_s\" and env=\"env\" and x=\"xa\" in safe_fork_own_npv_use)\n       apply (auto)\n    (* however the map of x should be disjoint *)\n   apply (simp add: valid_use_env_def)\n   apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (auto)\n   apply (simp add: valid_use_entry_def)\n   apply (simp add: disj_use_env_def)\n   apply (simp add: mini_disj_use_env_def)\n    (* in that case, we use path lookup to get the parent of xa *)\n  apply (case_tac \"lookup_mem rs_map z\")\n   apply (auto)\n  apply (cut_tac rs_map=\"rs_map\" and z=\"z\" and l=\"a # list\" and x=\"xa\" in path_lookup_parent)\n     apply (auto)\n   apply (simp add: valid_res_map_def)\n    (* because y contains xa, if x also contains xa, we break map disjointness. to prove y \\<noteq> x, we use the fact that\n        x is not in the completion *)\n  apply (case_tac \"\\<exists>l z. z \\<in> non_prim_vars env e \\<and> path_lookup rs_map z l x\")\n   apply (auto)\n  apply (case_tac \"x = y\")\n   apply (erule_tac x=\"l'\" in allE)\n   apply (erule_tac x=\"z\" in allE)\n   apply (auto)\n    (* map disjointness *)\n  apply (simp add: valid_res_map_def)\n  apply (simp add: disj_res_map_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"y\" in allE)\n  apply (auto)\n  apply (simp add: strong_disj_use_env_def)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (auto)\n  apply (simp add: lookup_res_def)\n  done*)\n    \n    \n    (* ##### 5. final proof composition ##### *)  \n    \nlemma safe_red_proc_set: \"\\<lbrakk> well_typed_system env rs_map p_map s1 ps1; red_proc_set (s1, ps1) r_ax (s2, ps2); valid_reduct app_red_exp \\<rbrakk> \\<Longrightarrow>\n  (\\<exists> r_s g_ax p_map'. well_typed_system (red_env env g_ax) (red_nres_map rs_map g_ax) p_map' s2 ps2 \\<and> safe_act s1 r_s g_ax)\"\n    (* split over process reduction type. *)\n  apply (case_tac \"r_ax\")\n    apply (auto)\n    (* single thread action case. *)\n    apply (rule_tac srps_thread_case)\n          apply (auto)\n    (* fork case. *)\n   apply (rule_tac srps_fork_case)\n          apply (auto)\n    (* send case. *)\n  apply (rule_tac srps_send_case)\n                apply (auto)\ndone\n  \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/ProcLemma.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3085785671266515}}
{"text": "subsection \\<open>Big-step semantics with conflation of constants and variables\\<close>\n\ntheory Big_Step_Value_ML\nimports Big_Step_Value\nbegin\n\ndefinition mk_rec_env :: \"(name, sclauses) fmap \\<Rightarrow> (name, value) fmap \\<Rightarrow> (name, value) fmap\" where\n\"mk_rec_env css \\<Gamma>' = fmmap_keys (\\<lambda>name cs. Vrecabs css name \\<Gamma>') css\"\n\ncontext special_constants begin\n\ninductive veval' :: \"(name, value) fmap \\<Rightarrow> sterm \\<Rightarrow> value \\<Rightarrow> bool\"  (\"_/ \\<turnstile>\\<^sub>v/ _ \\<down>/ _\" [50,0,50] 50) where\nconst: \"name |\\<notin>| C \\<Longrightarrow> fmlookup \\<Gamma> name = Some val \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>v Sconst name \\<down> val\" |\nvar: \"fmlookup \\<Gamma> name = Some val \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>v Svar name \\<down> val\" |\nabs: \"\\<Gamma> \\<turnstile>\\<^sub>v Sabs cs \\<down> Vabs cs \\<Gamma>\" |\ncomb: \"\n  \\<Gamma> \\<turnstile>\\<^sub>v t \\<down> Vabs cs \\<Gamma>' \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>v u \\<down> u' \\<Longrightarrow>\n  vfind_match cs u' = Some (env, _, rhs) \\<Longrightarrow>\n  \\<Gamma>' ++\\<^sub>f env \\<turnstile>\\<^sub>v rhs \\<down> val \\<Longrightarrow>\n  \\<Gamma> \\<turnstile>\\<^sub>v t $\\<^sub>s u \\<down> val\" |\nrec_comb: \"\n  \\<Gamma> \\<turnstile>\\<^sub>v t \\<down> Vrecabs css name \\<Gamma>' \\<Longrightarrow>\n  fmlookup css name = Some cs \\<Longrightarrow>\n  \\<Gamma> \\<turnstile>\\<^sub>v u \\<down> u' \\<Longrightarrow>\n  vfind_match cs u' = Some (env, _, rhs) \\<Longrightarrow>\n  \\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env \\<turnstile>\\<^sub>v rhs \\<down> val \\<Longrightarrow>\n  \\<Gamma> \\<turnstile>\\<^sub>v t $\\<^sub>s u \\<down> val\" |\nconstr: \"name |\\<in>| C \\<Longrightarrow> list_all2 (veval' \\<Gamma>) ts us \\<Longrightarrow> \\<Gamma> \\<turnstile>\\<^sub>v name $$ ts \\<down> Vconstr name us\"\n\nlemma veval'_sabs_svarE:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>v Sabs cs $\\<^sub>s Svar n \\<down> v\"\n  obtains u' env pat rhs\n    where \"fmlookup \\<Gamma> n = Some u'\"\n          \"vfind_match cs u' = Some (env, pat, rhs)\"\n          \"\\<Gamma> ++\\<^sub>f env \\<turnstile>\\<^sub>v rhs \\<down> v\"\nusing assms proof cases\n  case (constr name ts)\n  hence \"strip_comb (Sabs cs $\\<^sub>s Svar n) = strip_comb (name $$ ts)\"\n    by simp\n  hence False\n    apply (fold app_sterm_def)\n    apply (simp add: strip_list_comb_const)\n    apply (simp add: const_sterm_def)\n    done\n  thus ?thesis by simp\nnext\n  case rec_comb\n  hence False by cases\n  thus ?thesis by simp\nnext\n  case (comb cs' \\<Gamma>' u' env pat rhs)\n  moreover have \"fmlookup \\<Gamma> n = Some u'\"\n    using \\<open>\\<Gamma> \\<turnstile>\\<^sub>v Svar n \\<down> u'\\<close>\n    proof cases\n      case (constr name ts)\n      hence False\n        by (fold free_sterm_def) simp\n      thus ?thesis by simp\n    qed auto\n  moreover have \"cs = cs'\" \"\\<Gamma> = \\<Gamma>'\"\n    using \\<open>\\<Gamma> \\<turnstile>\\<^sub>v Sabs cs \\<down> Vabs cs' \\<Gamma>'\\<close>\n    by (cases; auto)+\n\n  ultimately show ?thesis\n    using that by auto\nqed\n\nlemma veval'_wellformed:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>v t \\<down> v\" \"wellformed t\" \"wellformed_venv \\<Gamma>\"\n  shows \"vwellformed v\"\nusing assms proof induction\n  case comb\n  show ?case\n    apply (rule comb)\n    using comb by (auto simp: list_all_iff dest: vfind_match_elem intro: vwellformed.vmatch_env)\nnext\n  case (rec_comb \\<Gamma> t css name \\<Gamma>' cs u u' env pat rhs val)\n  have \"(pat, rhs) \\<in> set cs\"\n    by (rule vfind_match_elem) fact\n  show ?case\n    proof (rule rec_comb)\n      show \"wellformed_venv (\\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env)\"\n        proof (intro fmpred_add)\n          show \"wellformed_venv \\<Gamma>'\"\n            using rec_comb by auto\n        next\n          show \"wellformed_venv env\"\n            using rec_comb by (auto dest: vfind_match_elem intro: vwellformed.vmatch_env)\n        next\n          show \"wellformed_venv (mk_rec_env css \\<Gamma>')\"\n            unfolding mk_rec_env_def\n            using rec_comb by (auto intro: fmdomI)\n        qed\n    next\n      have \"vwellformed (Vrecabs css name \\<Gamma>')\"\n        unfolding mk_rec_env_def\n        using rec_comb by (auto intro: fmdom'I)\n      thus \"wellformed rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> rec_comb by (auto simp: list_all_iff)\n    qed\nnext\n  case (constr name \\<Gamma> ts us)\n  have \"list_all vwellformed us\"\n    using \\<open>list_all2 _ _ _\\<close> \\<open>wellformed (_ $$ _)\\<close>\n    proof (induction ts us rule: list.rel_induct)\n      case (Cons v vs u us)\n      thus ?case\n        using constr by (auto simp: app_sterm_def wellformed.list_comb)\n    qed simp\n  thus ?case\n    by (simp add: list_all_iff)\nqed auto\n\nlemma (in constants) veval'_shadows:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>v t \\<down> v\" \"not_shadows_vconsts_env \\<Gamma>\" \"\\<not> shadows_consts t\"\n  shows \"not_shadows_vconsts v\"\nusing assms proof induction\n  case comb\n  show ?case\n    apply (rule comb)\n    using comb by (auto simp: list_all_iff dest: vfind_match_elem intro: not_shadows_vconsts.vmatch_env)\nnext\n  case (rec_comb \\<Gamma> t css name \\<Gamma>' cs u u' env pat rhs val)\n  have \"(pat, rhs) \\<in> set cs\"\n    by (rule vfind_match_elem) fact\n  show ?case\n    proof (rule rec_comb)\n      show \"not_shadows_vconsts_env (\\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env)\"\n        proof (intro fmpred_add)\n          show \"not_shadows_vconsts_env env\"\n            using rec_comb by (auto dest: vfind_match_elem intro: not_shadows_vconsts.vmatch_env)\n        next\n          show \"not_shadows_vconsts_env (mk_rec_env css \\<Gamma>')\"\n            unfolding mk_rec_env_def\n            using rec_comb by (auto intro: fmdomI)\n        next\n          show \"not_shadows_vconsts_env \\<Gamma>'\"\n            using rec_comb by auto\n        qed\n    next\n      have \"not_shadows_vconsts (Vrecabs css name \\<Gamma>')\"\n        using rec_comb by auto\n      thus \"\\<not> shadows_consts rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> rec_comb by (auto simp: list_all_iff)\n    qed\nnext\n  case (constr name \\<Gamma> ts us)\n  have \"list_all (not_shadows_vconsts) us\"\n    using \\<open>list_all2 _ _ _\\<close> \\<open>\\<not> shadows_consts (name $$ ts)\\<close>\n    proof (induction ts us rule: list.rel_induct)\n      case (Cons v vs u us)\n      thus ?case\n        using constr by (auto simp: shadows.list_comb app_sterm_def)\n    qed simp\n  thus ?case\n    by (simp add: list_all_iff)\nqed (auto simp: list_all_iff list_ex_iff)\n\nlemma veval'_closed:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>v t \\<down> v\" \"closed_except t (fmdom \\<Gamma>)\" \"closed_venv \\<Gamma>\"\n  assumes \"wellformed t\" \"wellformed_venv \\<Gamma>\"\n  shows \"vclosed v\"\nusing assms proof induction\n  case (comb \\<Gamma> t cs \\<Gamma>' u u' env pat rhs val)\n  hence \"vclosed (Vabs cs \\<Gamma>')\"\n    by (auto simp: closed_except_def)\n\n  have \"(pat, rhs) \\<in> set cs\" \"vmatch (mk_pat pat) u' = Some env\"\n    by (rule vfind_match_elem; fact)+\n  hence \"fmdom env = patvars (mk_pat pat)\"\n    by (simp add: vmatch_dom)\n\n  have \"vwellformed (Vabs cs \\<Gamma>')\"\n    apply (rule veval'_wellformed)\n    using comb by auto\n  hence \"linear pat\"\n    using \\<open>(pat, rhs) \\<in> set cs\\<close>\n    by (auto simp: list_all_iff)\n  hence \"fmdom env = frees pat\"\n    unfolding \\<open>fmdom env = _\\<close>\n    by (simp add: mk_pat_frees)\n\n  show ?case\n    proof (rule comb)\n      show \"wellformed rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>vwellformed (Vabs cs \\<Gamma>')\\<close>\n        by (auto simp: list_all_iff)\n    next\n      show \"closed_venv (\\<Gamma>' ++\\<^sub>f env)\"\n        apply rule\n        using \\<open>vclosed (Vabs cs \\<Gamma>')\\<close> apply auto[]\n        apply (rule vclosed.vmatch_env)\n         apply (rule vfind_match_elem)\n        using comb by (auto simp: closed_except_def)\n    next\n      show \"closed_except rhs (fmdom (\\<Gamma>' ++\\<^sub>f env))\"\n        using \\<open>vclosed (Vabs cs \\<Gamma>')\\<close> \\<open>fmdom env = frees pat\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n        by (auto simp: list_all_iff)\n    next\n      show \"wellformed_venv (\\<Gamma>' ++\\<^sub>f env)\"\n        apply rule\n        using \\<open>vwellformed (Vabs cs \\<Gamma>')\\<close> apply auto[]\n        apply (rule vwellformed.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_wellformed)\n        using comb by auto\n    qed\nnext\n  case (rec_comb \\<Gamma> t css name \\<Gamma>' cs u u' env pat rhs val)\n  have \"(pat, rhs) \\<in> set cs\" \"vmatch (mk_pat pat) u' = Some env\"\n    by (rule vfind_match_elem; fact)+\n  hence \"fmdom env = patvars (mk_pat pat)\"\n    by (simp add: vmatch_dom)\n\n  have \"vwellformed (Vrecabs css name \\<Gamma>')\"\n    apply (rule veval'_wellformed)\n    using rec_comb by auto\n  hence \"wellformed_clauses cs\"\n    using rec_comb by auto\n  hence \"linear pat\"\n    using \\<open>(pat, rhs) \\<in> set cs\\<close>\n    by (auto simp: list_all_iff)\n  hence \"fmdom env = frees pat\"\n    unfolding \\<open>fmdom env = _\\<close>\n    by (simp add: mk_pat_frees)\n  show ?case\n    proof (rule rec_comb)\n      show \"closed_venv (\\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env)\"\n        proof (intro fmpred_add)\n          show \"closed_venv \\<Gamma>'\"\n            using rec_comb by (auto simp: closed_except_def)\n        next\n          show \"closed_venv env\"\n            using rec_comb by (auto simp: closed_except_def dest: vfind_match_elem intro: vclosed.vmatch_env)\n        next\n          show \"closed_venv (mk_rec_env css \\<Gamma>')\"\n            unfolding mk_rec_env_def\n            using rec_comb by (auto simp: closed_except_def intro: fmdomI)\n        qed\n    next\n      have \"vclosed (Vrecabs css name \\<Gamma>')\"\n        using mk_rec_env_def\n        using rec_comb by (auto simp: closed_except_def intro: fmdom'I)\n      hence \"closed_except rhs (fmdom \\<Gamma>' |\\<union>| frees pat)\"\n        apply simp\n        apply (elim conjE)\n        apply (drule fmpredD[where m = css])\n         apply (rule rec_comb)\n        using \\<open>(pat, rhs) \\<in> set cs\\<close>\n        unfolding list_all_iff by auto\n\n      thus \"closed_except rhs (fmdom (\\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env))\"\n        unfolding closed_except_def\n        using \\<open>fmdom env = frees pat\\<close>\n        by auto\n    next\n      show \"wellformed rhs\"\n        using \\<open>wellformed_clauses cs\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n        by (auto simp: list_all_iff)\n    next\n      show \"wellformed_venv (\\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env)\"\n        proof (intro fmpred_add)\n          show \"wellformed_venv \\<Gamma>'\"\n            using \\<open>vwellformed (Vrecabs css name \\<Gamma>')\\<close> by auto\n        next\n          show \"wellformed_venv env\"\n            using rec_comb by (auto dest: vfind_match_elem intro: veval'_wellformed vwellformed.vmatch_env)\n        next\n          show \"wellformed_venv (mk_rec_env css \\<Gamma>')\"\n            unfolding mk_rec_env_def\n            using \\<open>vwellformed (Vrecabs css name \\<Gamma>')\\<close> by (auto intro: fmdomI)\n        qed\n    qed\nnext\n  case (constr name \\<Gamma> ts us)\n  have \"list_all vclosed us\"\n    using \\<open>list_all2 _ _ _\\<close> \\<open>closed_except (_ $$ _) _\\<close> \\<open>wellformed (_ $$ _)\\<close>\n    proof (induction ts us rule: list.rel_induct)\n      case (Cons v vs u us)\n      with constr show ?case\n        unfolding closed.list_comb wellformed.list_comb\n        by (auto simp: Sterm.closed_except_simps)\n    qed simp\n  thus ?case\n    by (simp add: list_all_iff)\nqed (auto simp: Sterm.closed_except_simps)\n\nprimrec vwelldefined' :: \"value \\<Rightarrow> bool\" where\n\"vwelldefined' (Vconstr name vs) \\<longleftrightarrow> list_all vwelldefined' vs\" |\n\"vwelldefined' (Vabs cs \\<Gamma>) \\<longleftrightarrow>\n  pred_fmap id (fmmap vwelldefined' \\<Gamma>) \\<and>\n  list_all (\\<lambda>(pat, t). consts t |\\<subseteq>| (fmdom \\<Gamma> |\\<union>| C)) cs \\<and>\n  fdisjnt C (fmdom \\<Gamma>)\" |\n\"vwelldefined' (Vrecabs css name \\<Gamma>) \\<longleftrightarrow>\n  pred_fmap id (fmmap vwelldefined' \\<Gamma>) \\<and>\n  pred_fmap (\\<lambda>cs.\n    list_all (\\<lambda>(pat, t). consts t |\\<subseteq>| fmdom \\<Gamma> |\\<union>| (C |\\<union>| fmdom css)) cs \\<and>\n    fdisjnt C (fmdom \\<Gamma>)) css \\<and>\n  name |\\<in>| fmdom css \\<and>\n  fdisjnt C (fmdom css)\"\n\nlemma vmatch_welldefined':\n  assumes \"vmatch pat v = Some env\" \"vwelldefined' v\"\n  shows \"fmpred (\\<lambda>_. vwelldefined') env\"\nusing assms proof (induction pat v arbitrary: env rule: vmatch_induct)\n  case (constr name ps name' vs)\n  hence\n    \"map_option (foldl (++\\<^sub>f) fmempty) (those (map2 vmatch ps vs)) = Some env\"\n    \"name = name'\" \"length ps = length vs\"\n    by (auto split: if_splits)\n  then obtain envs where \"env = foldl (++\\<^sub>f) fmempty envs\" \"map2 vmatch ps vs = map Some envs\"\n    by (blast dest: those_someD)\n\n  moreover have \"fmpred (\\<lambda>_. vwelldefined') env\" if \"env \\<in> set envs\" for env\n    proof -\n      from that have \"Some env \\<in> set (map2 vmatch ps vs)\"\n        unfolding \\<open>map2 _ _ _ = _\\<close> by simp\n      then obtain p v where \"p \\<in> set ps\" \"v \\<in> set vs\" \"vmatch p v = Some env\"\n        by (auto elim: map2_elemE)\n      hence \"vwelldefined' v\"\n        using constr by (simp add: list_all_iff)\n      show ?thesis\n        by (rule constr; safe?) fact+\n    qed\n\n    ultimately show ?case\n      by auto\nqed auto\n\n(* FIXME ad hoc rules after introduction of \"constants\" locale *)\n\n\nlemma sconsts_sabs:\n  \"consts (Sabs cs) |\\<subseteq>| S \\<longleftrightarrow> list_all (\\<lambda>(_, t). consts t |\\<subseteq>| S) cs\"\n  apply (auto simp: list_all_iff ffUnion_alt_def dest!: ffUnion_least_rev)\n   apply (subst (asm) list_all_iff_fset[symmetric])\n   apply (auto simp: list_all_iff fset_of_list_elem)\n  done\n\nlemma (in constants) veval'_welldefined':\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>v t \\<down> v\" \"fdisjnt C (fmdom \\<Gamma>)\"\n  assumes \"consts t |\\<subseteq>| fmdom \\<Gamma> |\\<union>| C\" \"fmpred (\\<lambda>_. vwelldefined') \\<Gamma>\"\n  assumes \"wellformed t\" \"wellformed_venv \\<Gamma>\"\n  assumes \"\\<not> shadows_consts t\" \"not_shadows_vconsts_env \\<Gamma>\"\n  shows \"vwelldefined' v\"\nusing assms proof induction\n  case (abs \\<Gamma> cs)\n  thus ?case\n    unfolding sconsts_sabs\n    by (auto simp: list_all_iff list_ex_iff)\nnext\n  case (comb \\<Gamma> t cs \\<Gamma>' u u' env pat rhs val)\n  hence \"(pat, rhs) \\<in> set cs\"\n    by (auto dest: vfind_match_elem)\n  moreover have \"vwelldefined' (Vabs cs \\<Gamma>')\"\n    using comb by auto\n  ultimately have \"consts rhs |\\<subseteq>| fmdom \\<Gamma>' |\\<union>| C\"\n    by (auto simp: list_all_iff)\n\n  have \"vwellformed (Vabs cs \\<Gamma>')\"\n    apply (rule veval'_wellformed)\n    using comb by auto\n  hence \"linear pat\"\n    using \\<open>(pat, rhs) \\<in> set cs\\<close>\n    by (auto simp: list_all_iff)\n  hence \"frees pat = patvars (mk_pat pat)\"\n    by (simp add: mk_pat_frees)\n  hence \"fmdom env = frees pat\"\n    apply simp\n    apply (rule vmatch_dom)\n    apply (rule vfind_match_elem)\n    apply (rule comb)\n    done\n\n  have \"not_shadows_vconsts (Vabs cs \\<Gamma>')\"\n    apply (rule veval'_shadows)\n    using comb by auto\n\n  have \"vwelldefined' (Vabs cs \\<Gamma>')\"\n    using comb by auto\n\n  show ?case\n    proof (rule comb)\n      show \"consts rhs |\\<subseteq>| fmdom (\\<Gamma>' ++\\<^sub>f env) |\\<union>| C\"\n        using \\<open>consts rhs |\\<subseteq>| fmdom \\<Gamma>' |\\<union>| C\\<close>\n        by auto\n    next\n      have \"vwelldefined' u'\"\n        using comb by auto\n      hence \"fmpred (\\<lambda>_. vwelldefined') env\"\n        using comb\n        by (auto intro: vmatch_welldefined' dest: vfind_match_elem)\n      thus \"fmpred (\\<lambda>_. vwelldefined') (\\<Gamma>' ++\\<^sub>f env)\"\n        using \\<open>vwelldefined' (Vabs cs \\<Gamma>')\\<close> by auto\n    next\n      have \"fdisjnt C (fmdom \\<Gamma>')\"\n        using \\<open>vwelldefined' (Vabs cs \\<Gamma>')\\<close>\n        by simp\n      moreover have \"fdisjnt C (fmdom env)\"\n        unfolding \\<open>fmdom env = frees pat\\<close>\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>')\\<close>\n        by (auto simp: list_all_iff all_consts_def fdisjnt_alt_def)\n      ultimately show \"fdisjnt C (fmdom (\\<Gamma>' ++\\<^sub>f env))\"\n        unfolding fdisjnt_alt_def by auto\n    next\n      show \"wellformed rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>vwellformed (Vabs cs \\<Gamma>')\\<close>\n        by (auto simp: list_all_iff)\n    next\n      have \"wellformed_venv \\<Gamma>'\"\n        using \\<open>vwellformed (Vabs cs \\<Gamma>')\\<close> by simp\n      moreover have \"wellformed_venv env\"\n        apply (rule vwellformed.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_wellformed)\n        using comb by auto\n      ultimately show \"wellformed_venv (\\<Gamma>' ++\\<^sub>f env)\"\n        by blast\n    next\n      have \"not_shadows_vconsts_env \\<Gamma>'\"\n        using \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>')\\<close> by simp\n      moreover have \"not_shadows_vconsts_env env\"\n        apply (rule not_shadows_vconsts.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_shadows)\n        using comb by auto\n      ultimately show \"not_shadows_vconsts_env (\\<Gamma>' ++\\<^sub>f env)\"\n        by blast\n    next\n      show \"\\<not> shadows_consts rhs\"\n        using \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>')\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n        by (auto simp: list_all_iff)\n    qed\nnext\n  case (rec_comb \\<Gamma> t css name \\<Gamma>' cs u u' env pat rhs val)\n  hence \"(pat, rhs) \\<in> set cs\"\n    by (auto dest: vfind_match_elem)\n  moreover have \"vwelldefined' (Vrecabs css name \\<Gamma>')\"\n    using rec_comb by auto\n  ultimately have \"consts rhs |\\<subseteq>| fmdom \\<Gamma>' |\\<union>| (C |\\<union>| fmdom css)\"\n    using \\<open>fmlookup css name = Some cs\\<close>\n    by (auto simp: list_all_iff dest!: fmpredD[where m = css])\n\n  have \"vwellformed (Vrecabs css name \\<Gamma>')\"\n    apply (rule veval'_wellformed)\n    using rec_comb by auto\n  hence \"wellformed_clauses cs\"\n    using rec_comb by auto\n  hence \"linear pat\"\n    using \\<open>(pat, rhs) \\<in> set cs\\<close>\n    by (auto simp: list_all_iff)\n  hence \"frees pat = patvars (mk_pat pat)\"\n    by (simp add: mk_pat_frees)\n  hence \"fmdom env = frees pat\"\n    apply simp\n    apply (rule vmatch_dom)\n    apply (rule vfind_match_elem)\n    apply (rule rec_comb)\n    done\n\n  have \"not_shadows_vconsts (Vrecabs css name \\<Gamma>')\"\n    apply (rule veval'_shadows)\n    using rec_comb by auto\n\n  have \"vwelldefined' (Vrecabs css name \\<Gamma>')\"\n    using rec_comb by auto\n\n  show ?case\n    proof (rule rec_comb)\n      show \"consts rhs |\\<subseteq>| fmdom (\\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env) |\\<union>| C\"\n        using \\<open>consts rhs |\\<subseteq>| _\\<close> unfolding mk_rec_env_def\n        by auto\n    next\n      have \"fmpred (\\<lambda>_. vwelldefined') \\<Gamma>'\"\n        using \\<open>vwelldefined' (Vrecabs css name \\<Gamma>')\\<close> by auto\n      moreover have \"fmpred (\\<lambda>_. vwelldefined') (mk_rec_env css \\<Gamma>')\"\n        unfolding mk_rec_env_def\n        using rec_comb by (auto intro: fmdomI)\n      moreover have \"fmpred (\\<lambda>_. vwelldefined') env\"\n        using rec_comb by (auto dest: vfind_match_elem intro: vmatch_welldefined')\n      ultimately show \"fmpred (\\<lambda>_. vwelldefined') (\\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env)\"\n        by blast\n    next\n      have \"fdisjnt C (fmdom \\<Gamma>')\"\n        using rec_comb by auto\n      moreover have \"fdisjnt C (fmdom env)\"\n        unfolding \\<open>fmdom env = frees pat\\<close>\n        using \\<open>fmlookup css name = Some cs\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>not_shadows_vconsts (Vrecabs css name \\<Gamma>')\\<close>\n        apply auto\n        apply (drule fmpredD[where m = css])\n        by (auto simp: list_all_iff all_consts_def fdisjnt_alt_def)\n      moreover have \"fdisjnt C (fmdom (mk_rec_env css \\<Gamma>'))\"\n        unfolding mk_rec_env_def\n        using \\<open>vwelldefined' (Vrecabs css name \\<Gamma>')\\<close>\n        by simp\n      ultimately show \"fdisjnt C (fmdom (\\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env))\"\n        unfolding fdisjnt_alt_def by auto\n    next\n      show \"wellformed rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>wellformed_clauses cs\\<close>\n        by (auto simp: list_all_iff)\n    next\n      have \"wellformed_venv \\<Gamma>'\"\n        using \\<open>vwellformed (Vrecabs css name \\<Gamma>')\\<close> by simp\n      moreover have \"wellformed_venv (mk_rec_env css \\<Gamma>')\"\n        unfolding mk_rec_env_def\n        using \\<open>vwellformed (Vrecabs css name \\<Gamma>')\\<close>\n        by (auto intro: fmdomI)\n      moreover have \"wellformed_venv env\"\n        apply (rule vwellformed.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_wellformed)\n        using rec_comb by auto\n      ultimately show \"wellformed_venv (\\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env)\"\n        by blast\n    next\n      have \"not_shadows_vconsts_env \\<Gamma>'\"\n        using \\<open>not_shadows_vconsts (Vrecabs css name \\<Gamma>')\\<close> by simp\n      moreover have \"not_shadows_vconsts_env (mk_rec_env css \\<Gamma>')\"\n        unfolding mk_rec_env_def\n        using \\<open>not_shadows_vconsts (Vrecabs css name \\<Gamma>')\\<close>\n        by (auto intro: fmdomI)\n      moreover have \"not_shadows_vconsts_env env\"\n        apply (rule not_shadows_vconsts.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_shadows)\n        using rec_comb by auto\n      ultimately show \"not_shadows_vconsts_env (\\<Gamma>' ++\\<^sub>f mk_rec_env css \\<Gamma>' ++\\<^sub>f env)\"\n        by blast\n    next\n      show \"\\<not> shadows_consts rhs\"\n        using rec_comb \\<open>not_shadows_vconsts (Vrecabs css name \\<Gamma>')\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n        by (auto simp: list_all_iff)\n    qed\nnext\n  case (constr name \\<Gamma> ts us)\n  have \"list_all vwelldefined' us\"\n    using \\<open>list_all2 _ _ _\\<close> \\<open>consts (name $$ ts) |\\<subseteq>| _\\<close>\n    using \\<open>wellformed (name $$ ts)\\<close> \\<open>\\<not> shadows_consts (name $$ ts)\\<close>\n    proof (induction ts us rule: list.rel_induct)\n      case (Cons v vs u us)\n      with constr show ?case\n        unfolding wellformed.list_comb shadows.list_comb\n        by (auto simp: consts_list_comb)\n    qed simp\n  thus ?case\n    by (simp add: list_all_iff)\nqed auto\n\nend\n\n\nsubsubsection (in special_constants) \\<open>Correctness wrt @{const veval}\\<close>\n\ncontext vrules begin\n\ntext \\<open>\n  The following relation can be characterized as follows:\n  \\<^item> Values have to have the same structure. (We prove an interpretation of @{const value_struct_rel}.)\n  \\<^item> For closures, the captured environments must agree on constants and variables occurring in the\n    body.\n  The first @{typ value} argument is from @{const veval} (i.e. from\n  @{theory CakeML_Codegen.Big_Step_Value}), the second from @{const veval'}.\n\\<close>\n\n(* FIXME move into locale *)\n\ncoinductive vrelated :: \"value \\<Rightarrow> value \\<Rightarrow> bool\" (\"\\<turnstile>\\<^sub>v/ _ \\<approx> _\" [0, 50] 50) where\nconstr: \"list_all2 vrelated ts us \\<Longrightarrow> \\<turnstile>\\<^sub>v Vconstr name ts \\<approx> Vconstr name us\" |\nabs:\n  \"fmrel_on_fset (frees (Sabs cs)) vrelated \\<Gamma>\\<^sub>1 \\<Gamma>\\<^sub>2 \\<Longrightarrow>\n   fmrel_on_fset (consts (Sabs cs)) vrelated (fmap_of_list rs) \\<Gamma>\\<^sub>2 \\<Longrightarrow>\n     \\<turnstile>\\<^sub>v Vabs cs \\<Gamma>\\<^sub>1 \\<approx> Vabs cs \\<Gamma>\\<^sub>2\" |\nrec_abs:\n  \"pred_fmap (\\<lambda>cs.\n    fmrel_on_fset (frees (Sabs cs)) vrelated \\<Gamma>\\<^sub>1 \\<Gamma>\\<^sub>2 \\<and>\n    fmrel_on_fset (consts (Sabs cs)) vrelated (fmap_of_list rs) (\\<Gamma>\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>2)) css \\<Longrightarrow>\n     name |\\<in>| fmdom css \\<Longrightarrow>\n     \\<turnstile>\\<^sub>v Vrecabs css name \\<Gamma>\\<^sub>1 \\<approx> Vrecabs css name \\<Gamma>\\<^sub>2\"\n\ntext \\<open>\n  Perhaps unexpectedly, @{term vrelated} is not reflexive. The reason is that it does not just check\n  syntactic equality including captured environments, but also adherence to the external rules.\n\\<close>\n\nsublocale vrelated: value_struct_rel vrelated\nproof\n  fix t\\<^sub>1 t\\<^sub>2\n  assume \"\\<turnstile>\\<^sub>v t\\<^sub>1 \\<approx> t\\<^sub>2\"\n  thus \"veq_structure t\\<^sub>1 t\\<^sub>2\"\n    apply (induction t\\<^sub>1 arbitrary: t\\<^sub>2)\n      apply (erule vrelated.cases; auto)\n      apply (erule list.rel_mono_strong)\n      apply simp\n     apply (erule vrelated.cases; auto)\n    apply (erule vrelated.cases; auto)\n    done\nnext\n  fix name name' and ts us :: \"value list\"\n  show \"\\<turnstile>\\<^sub>v Vconstr name ts \\<approx> Vconstr name' us \\<longleftrightarrow> (name = name' \\<and> list_all2 vrelated ts us)\"\n    proof safe\n      assume \"\\<turnstile>\\<^sub>v Vconstr name ts \\<approx> Vconstr name' us\"\n      thus \"name = name'\" \"list_all2 vrelated ts us\"\n        by (cases; auto)+\n    qed (auto intro: vrelated.intros)\nqed\n\ntext \\<open>\n  The technically involved relation @{term vrelated} implies a weaker, but more intuitive property:\n  If @{prop \"\\<turnstile>\\<^sub>v t \\<approx> u\"} then \\<open>t\\<close> and \\<open>u\\<close> are equal after termification (i.e. conversion with\n  @{term value_to_sterm}). In fact, if both terms are ground terms, it collapses to equality. This\n  follows directly from the interpretation of @{const value_struct_rel}.\n\\<close>\n\nlemma veval'_correct:\n  assumes \"\\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>v t \\<down> v\\<^sub>2\" \"wellformed t\" \"wellformed_venv \\<Gamma>\\<^sub>2\"\n  assumes \"\\<not> shadows_consts t\" \"not_shadows_vconsts_env \\<Gamma>\\<^sub>2\"\n  assumes \"welldefined t\"\n  assumes \"fmpred (\\<lambda>_. vwelldefined) \\<Gamma>\\<^sub>1\"\n  assumes \"fmrel_on_fset (frees t) vrelated \\<Gamma>\\<^sub>1 \\<Gamma>\\<^sub>2\"\n  assumes \"fmrel_on_fset (consts t) vrelated (fmap_of_list rs) \\<Gamma>\\<^sub>2\"\n  obtains v\\<^sub>1 where \"rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v t \\<down> v\\<^sub>1\" \"\\<turnstile>\\<^sub>v v\\<^sub>1 \\<approx> v\\<^sub>2\"\napply atomize_elim\nusing assms proof (induction arbitrary: \\<Gamma>\\<^sub>1)\n  case (const name \\<Gamma>\\<^sub>2 val\\<^sub>2)\n  hence \"fmrel_on_fset {|name|} vrelated (fmap_of_list rs) \\<Gamma>\\<^sub>2\"\n    by simp\n  have \"rel_option vrelated (fmlookup (fmap_of_list rs) name) (fmlookup \\<Gamma>\\<^sub>2 name)\"\n    apply (rule fmrel_on_fsetD[where S = \"{|name|}\"])\n     apply simp\n    apply fact\n    done\n  then obtain val\\<^sub>1 where \"fmlookup (fmap_of_list rs) name = Some val\\<^sub>1\" \"\\<turnstile>\\<^sub>v val\\<^sub>1 \\<approx> val\\<^sub>2\"\n    using const by cases auto\n  hence \"(name, val\\<^sub>1) \\<in> set rs\"\n    by (auto dest: fmap_of_list_SomeD)\n\n  show ?case\n    apply (intro conjI exI)\n     apply (rule veval.const)\n     apply fact+\n    done\nnext\n  case (var \\<Gamma>\\<^sub>2 name val\\<^sub>2)\n  hence \"fmrel_on_fset {|name|} vrelated \\<Gamma>\\<^sub>1 \\<Gamma>\\<^sub>2\"\n    by simp\n  have \"rel_option vrelated (fmlookup \\<Gamma>\\<^sub>1 name) (fmlookup \\<Gamma>\\<^sub>2 name)\"\n    apply (rule fmrel_on_fsetD[where S = \"{|name|}\"])\n     apply simp\n    apply fact\n    done\n  then obtain val\\<^sub>1 where \"fmlookup \\<Gamma>\\<^sub>1 name = Some val\\<^sub>1\" \"\\<turnstile>\\<^sub>v val\\<^sub>1 \\<approx> val\\<^sub>2\"\n    using var by cases auto\n  show ?case\n    apply (intro conjI exI)\n     apply (rule veval.var)\n     apply fact+\n    done\nnext\n  case abs\n  thus ?case\n    by (auto intro!: veval.abs vrelated.abs)\nnext\n  case (comb \\<Gamma>\\<^sub>2 t cs \\<Gamma>'\\<^sub>2 u u'\\<^sub>2 env\\<^sub>2 pat rhs val\\<^sub>2)\n  hence \"\\<exists>v. rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v t \\<down> v \\<and> \\<turnstile>\\<^sub>v v \\<approx> Vabs cs \\<Gamma>'\\<^sub>2\"\n    by (auto intro: fmrel_on_fsubset)\n  then obtain v where \"\\<turnstile>\\<^sub>v v \\<approx> Vabs cs \\<Gamma>'\\<^sub>2\" \"rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v t \\<down> v\"\n    by blast\n  moreover then obtain \\<Gamma>'\\<^sub>1\n    where \"v = Vabs cs \\<Gamma>'\\<^sub>1\"\n      and \"fmrel_on_fset (frees (Sabs cs)) vrelated \\<Gamma>'\\<^sub>1 \\<Gamma>'\\<^sub>2\"\n      and \"fmrel_on_fset (consts (Sabs cs)) vrelated (fmap_of_list rs) \\<Gamma>'\\<^sub>2\"\n    by cases auto\n  ultimately have \"rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v t \\<down> Vabs cs \\<Gamma>'\\<^sub>1\"\n    by simp\n\n  have \"\\<exists>u\\<^sub>1'. rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v u \\<down> u\\<^sub>1' \\<and> \\<turnstile>\\<^sub>v u\\<^sub>1' \\<approx> u'\\<^sub>2\"\n    using comb by (auto intro: fmrel_on_fsubset)\n  then obtain u'\\<^sub>1 where \"\\<turnstile>\\<^sub>v u'\\<^sub>1 \\<approx> u'\\<^sub>2\" \"rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v u \\<down> u'\\<^sub>1\"\n    by blast\n\n  have \"rel_option (rel_prod (fmrel vrelated) (=)) (vfind_match cs u'\\<^sub>1) (vfind_match cs u'\\<^sub>2)\"\n    by (rule vrelated.vfind_match_rel') fact\n  then obtain env\\<^sub>1 where \"vfind_match cs u'\\<^sub>1 = Some (env\\<^sub>1, pat, rhs)\" \"fmrel vrelated env\\<^sub>1 env\\<^sub>2\"\n    using \\<open>vfind_match cs u'\\<^sub>2 = _\\<close>\n    by cases auto\n\n  have \"(pat, rhs) \\<in> set cs\"\n    by (rule vfind_match_elem) fact\n\n  have \"vwellformed (Vabs cs \\<Gamma>'\\<^sub>2)\"\n    apply (rule veval'_wellformed)\n      apply fact\n    using \\<open>wellformed (t $\\<^sub>s u)\\<close> apply simp\n    apply fact+\n    done\n  hence \"wellformed_venv \\<Gamma>'\\<^sub>2\"\n    by simp\n\n  have \"vwelldefined v\"\n    apply (rule veval_welldefined)\n      apply fact+\n    using comb by simp\n  hence \"vwelldefined (Vabs cs \\<Gamma>'\\<^sub>1)\"\n    unfolding \\<open>v = _\\<close> .\n\n  have \"linear pat\"\n    using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>vwellformed (Vabs cs \\<Gamma>'\\<^sub>2)\\<close>\n    by (auto simp: list_all_iff)\n\n  have \"fmdom env\\<^sub>1 = patvars (mk_pat pat)\"\n    apply (rule vmatch_dom)\n    apply (rule vfind_match_elem)\n    apply fact\n    done\n  with \\<open>linear pat\\<close> have \"fmdom env\\<^sub>1 = frees pat\"\n    by (simp add: mk_pat_frees)\n\n  have \"fmdom env\\<^sub>2 = patvars (mk_pat pat)\"\n    apply (rule vmatch_dom)\n    apply (rule vfind_match_elem)\n    apply fact\n    done\n  with \\<open>linear pat\\<close> have \"fmdom env\\<^sub>2 = frees pat\"\n    by (simp add: mk_pat_frees)\n\n  note fset_of_list_map[simp del]\n  have \"\\<exists>val\\<^sub>1. rs, \\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1 \\<turnstile>\\<^sub>v rhs \\<down> val\\<^sub>1 \\<and> \\<turnstile>\\<^sub>v val\\<^sub>1 \\<approx> val\\<^sub>2\"\n    proof (rule comb)\n      show \"fmrel_on_fset (frees rhs) vrelated (\\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1) (\\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2)\"\n        proof\n          fix name\n          assume \"name |\\<in>| frees rhs\"\n          show \"rel_option vrelated (fmlookup (\\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1) name) (fmlookup (\\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2) name)\"\n            proof (cases \"name |\\<in>| frees pat\")\n              case True\n              hence \"name |\\<in>| fmdom env\\<^sub>1\" \"name |\\<in>| fmdom env\\<^sub>2\"\n                using \\<open>fmdom env\\<^sub>1 = frees pat\\<close> \\<open>fmdom env\\<^sub>2 = frees pat\\<close>\n                by simp+\n              hence \"fmlookup (\\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1) name = fmlookup env\\<^sub>1 name\" \"fmlookup (\\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2) name = fmlookup env\\<^sub>2 name\"\n                by auto\n              thus ?thesis\n                using \\<open>fmrel vrelated env\\<^sub>1 env\\<^sub>2\\<close>\n                by auto\n            next\n              case False\n              hence \"name |\\<notin>| fmdom env\\<^sub>1\" \"name |\\<notin>| fmdom env\\<^sub>2\"\n                using \\<open>fmdom env\\<^sub>1 = frees pat\\<close> \\<open>fmdom env\\<^sub>2 = frees pat\\<close>\n                by simp+\n              hence \"fmlookup (\\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1) name = fmlookup \\<Gamma>'\\<^sub>1 name\" \"fmlookup (\\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2) name = fmlookup \\<Gamma>'\\<^sub>2 name\"\n                by auto\n\n              moreover have \"name |\\<in>| frees (Sabs cs)\"\n                using False \\<open>name |\\<in>| frees rhs\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n                apply (auto simp: ffUnion_alt_def)\n                apply (rule fBexI[where x = \"frees rhs |-| frees pat\"])\n                 apply (auto simp: fset_of_list_elem)\n                done\n\n              ultimately show ?thesis\n                using \\<open>fmrel_on_fset (frees (Sabs cs)) vrelated \\<Gamma>'\\<^sub>1 \\<Gamma>'\\<^sub>2\\<close>\n                by (auto dest: fmrel_on_fsetD)\n            qed\n        qed\n    next\n      have \"not_shadows_vconsts (Vabs cs \\<Gamma>'\\<^sub>2)\"\n        apply (rule veval'_shadows)\n          apply fact+\n        using comb by auto\n      thus \"\\<not> shadows_consts rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close>\n        by (auto simp: list_all_iff)\n\n      show \"not_shadows_vconsts_env (\\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2)\"\n        apply rule\n        using \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>'\\<^sub>2)\\<close> apply simp\n        apply (rule not_shadows_vconsts.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_shadows)\n          apply fact\n         apply fact\n        using comb by auto\n\n      show \"fmrel_on_fset (consts rhs) vrelated (fmap_of_list rs) (\\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2)\"\n        proof\n          fix name\n          assume \"name |\\<in>| consts rhs\"\n          hence \"name |\\<in>| consts (Sabs cs)\"\n            using \\<open>(pat, rhs) \\<in> set cs\\<close>\n            by (auto intro!: fBexI simp: fset_of_list_elem ffUnion_alt_def)\n          hence \"rel_option vrelated (fmlookup (fmap_of_list rs) name) (fmlookup \\<Gamma>'\\<^sub>2 name)\"\n            using \\<open>fmrel_on_fset (consts (Sabs cs)) vrelated (fmap_of_list rs) \\<Gamma>'\\<^sub>2\\<close>\n            by (auto dest: fmrel_on_fsetD)\n          moreover have \"name |\\<notin>| fmdom env\\<^sub>2\"\n            proof\n              assume \"name |\\<in>| fmdom env\\<^sub>2\"\n              hence \"fmlookup env\\<^sub>2 name \\<noteq> None\"\n                by (meson fmdom_notI)\n              then obtain v where \"fmlookup env\\<^sub>2 name = Some v\"\n                by blast\n              hence \"name |\\<in>| fmdom env\\<^sub>2\"\n                by (auto intro: fmdomI)\n              hence \"name |\\<in>| frees pat\"\n                using \\<open>fmdom env\\<^sub>2 = frees pat\\<close>\n                by simp\n\n              have \"welldefined rhs\"\n                using \\<open>vwelldefined (Vabs cs \\<Gamma>'\\<^sub>1)\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n                by (auto simp: list_all_iff)\n              hence \"name |\\<in>| fst |`| fset_of_list rs |\\<union>| C\"\n                using \\<open>name |\\<in>| consts rhs\\<close>\n                by (auto simp: all_consts_def)\n              moreover have \"\\<not> shadows_consts pat\"\n                using \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>'\\<^sub>2)\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n                by (auto simp: list_all_iff shadows_consts_def all_consts_def)\n              ultimately show False\n                using \\<open>name |\\<in>| frees pat\\<close>\n                unfolding shadows_consts_def fdisjnt_alt_def all_consts_def\n                by auto\n            qed\n          ultimately show \"rel_option vrelated (fmlookup (fmap_of_list rs) name) (fmlookup (\\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2) name)\"\n            by simp\n        qed\n    next\n      show \"wellformed rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>vwellformed (Vabs cs \\<Gamma>'\\<^sub>2)\\<close>\n        by (auto simp: list_all_iff)\n    next\n      have \"wellformed_venv \\<Gamma>'\\<^sub>2\"\n        by fact\n      moreover have \"wellformed_venv env\\<^sub>2\"\n        apply (rule vwellformed.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_wellformed)\n          apply fact\n        using \\<open>wellformed (t $\\<^sub>s u)\\<close> apply simp\n        apply fact+\n        done\n      ultimately show \"wellformed_venv (\\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2)\"\n        by blast\n    next\n      show \"welldefined rhs\"\n        using \\<open>vwelldefined (Vabs cs \\<Gamma>'\\<^sub>1)\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n        by (auto simp: list_all_iff)\n    next\n      have \"fmpred (\\<lambda>_. vwelldefined) \\<Gamma>'\\<^sub>1\"\n        using \\<open>vwelldefined (Vabs cs \\<Gamma>'\\<^sub>1)\\<close> by simp\n\n      moreover have \"fmpred (\\<lambda>_. vwelldefined) env\\<^sub>1\"\n        apply (rule vwelldefined.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval_welldefined)\n          apply fact\n         apply fact\n        using comb apply simp\n        done\n\n      ultimately show \"fmpred (\\<lambda>_. vwelldefined) (\\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1)\"\n        by blast\n    qed\n\n  then obtain val\\<^sub>1 where \"rs, \\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1 \\<turnstile>\\<^sub>v rhs \\<down> val\\<^sub>1\" \"\\<turnstile>\\<^sub>v val\\<^sub>1 \\<approx> val\\<^sub>2\"\n    by blast\n\n  show ?case\n    apply (intro conjI exI)\n     apply (rule veval.comb)\n        apply fact+\n    done\nnext\n  \\<comment> \\<open>Almost verbatim copy from \\<open>comb\\<close> case.\\<close>\n  case (rec_comb \\<Gamma>\\<^sub>2 t css name \\<Gamma>'\\<^sub>2 cs u u'\\<^sub>2 env\\<^sub>2 pat rhs val\\<^sub>2)\n  hence \"\\<exists>v. rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v t \\<down> v \\<and> \\<turnstile>\\<^sub>v v \\<approx> Vrecabs css name \\<Gamma>'\\<^sub>2\"\n    by (auto intro: fmrel_on_fsubset)\n  then obtain v where \"\\<turnstile>\\<^sub>v v \\<approx> Vrecabs css name \\<Gamma>'\\<^sub>2\" \"rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v t \\<down> v\"\n    by blast\n  moreover then obtain \\<Gamma>'\\<^sub>1\n    where \"v = Vrecabs css name \\<Gamma>'\\<^sub>1\"\n      and \"fmrel_on_fset (frees (Sabs cs)) vrelated \\<Gamma>'\\<^sub>1 \\<Gamma>'\\<^sub>2\"\n      and \"fmrel_on_fset (consts (Sabs cs)) vrelated (fmap_of_list rs) (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2)\"\n    using \\<open>fmlookup css name = Some cs\\<close>\n    by cases auto\n  ultimately have \"rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v t \\<down> Vrecabs css name \\<Gamma>'\\<^sub>1\"\n    by simp\n\n  have \"\\<exists>u\\<^sub>1'. rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v u \\<down> u\\<^sub>1' \\<and> \\<turnstile>\\<^sub>v u\\<^sub>1' \\<approx> u'\\<^sub>2\"\n    using rec_comb by (auto intro: fmrel_on_fsubset)\n  then obtain u'\\<^sub>1 where \"\\<turnstile>\\<^sub>v u'\\<^sub>1 \\<approx> u'\\<^sub>2\" \"rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v u \\<down> u'\\<^sub>1\"\n    by blast\n\n  have \"rel_option (rel_prod (fmrel vrelated) (=)) (vfind_match cs u'\\<^sub>1) (vfind_match cs u'\\<^sub>2)\"\n    by (rule vrelated.vfind_match_rel') fact\n  then obtain env\\<^sub>1 where \"vfind_match cs u'\\<^sub>1 = Some (env\\<^sub>1, pat, rhs)\" \"fmrel vrelated env\\<^sub>1 env\\<^sub>2\"\n    using \\<open>vfind_match cs u'\\<^sub>2 = _\\<close>\n    by cases auto\n\n  have \"(pat, rhs) \\<in> set cs\"\n    by (rule vfind_match_elem) fact\n\n  have \"vwellformed (Vrecabs css name \\<Gamma>'\\<^sub>2)\"\n    apply (rule veval'_wellformed)\n      apply fact\n    using \\<open>wellformed (t $\\<^sub>s u)\\<close> apply simp\n    apply fact+\n    done\n  hence \"wellformed_venv \\<Gamma>'\\<^sub>2\" \"vwellformed (Vabs cs \\<Gamma>'\\<^sub>2)\"\n    using rec_comb by auto\n\n  have \"vwelldefined v\"\n    apply (rule veval_welldefined)\n      apply fact+\n    using rec_comb by simp\n  hence \"vwelldefined (Vrecabs css name \\<Gamma>'\\<^sub>1)\"\n    unfolding \\<open>v = _\\<close> .\n  hence \"vwelldefined (Vabs cs \\<Gamma>'\\<^sub>1)\"\n    using rec_comb by auto\n\n  have \"linear pat\"\n    using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>vwellformed (Vabs cs \\<Gamma>'\\<^sub>2)\\<close>\n    by (auto simp: list_all_iff)\n\n  have \"fmdom env\\<^sub>1 = patvars (mk_pat pat)\"\n    apply (rule vmatch_dom)\n    apply (rule vfind_match_elem)\n    apply fact\n    done\n  with \\<open>linear pat\\<close> have \"fmdom env\\<^sub>1 = frees pat\"\n    by (simp add: mk_pat_frees)\n\n  have \"fmdom env\\<^sub>2 = patvars (mk_pat pat)\"\n    apply (rule vmatch_dom)\n    apply (rule vfind_match_elem)\n    apply fact\n    done\n  with \\<open>linear pat\\<close> have \"fmdom env\\<^sub>2 = frees pat\"\n    by (simp add: mk_pat_frees)\n\n  note fset_of_list_map[simp del]\n  have \"\\<exists>val\\<^sub>1. rs, \\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1 \\<turnstile>\\<^sub>v rhs \\<down> val\\<^sub>1 \\<and> \\<turnstile>\\<^sub>v val\\<^sub>1 \\<approx> val\\<^sub>2\"\n    proof (rule rec_comb)\n      have \"not_shadows_vconsts (Vrecabs css name \\<Gamma>'\\<^sub>2)\"\n        apply (rule veval'_shadows)\n          apply fact+\n        using rec_comb by auto\n      thus \"\\<not> shadows_consts rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> rec_comb\n        by (auto simp: list_all_iff)\n      hence \"fdisjnt all_consts (frees rhs)\"\n        by (rule shadows_consts_frees)\n\n      have \"not_shadows_vconsts_env \\<Gamma>'\\<^sub>2\"\n        using \\<open>not_shadows_vconsts (Vrecabs css name \\<Gamma>'\\<^sub>2)\\<close>\n        by simp\n\n      moreover have \"not_shadows_vconsts_env (mk_rec_env css \\<Gamma>'\\<^sub>2)\"\n        unfolding mk_rec_env_def\n        using \\<open>not_shadows_vconsts (Vrecabs css name \\<Gamma>'\\<^sub>2)\\<close>\n        by (auto intro: fmdomI)\n\n      moreover have \"not_shadows_vconsts_env env\\<^sub>2\"\n        apply (rule not_shadows_vconsts.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_shadows)\n          apply fact\n         apply fact\n        using rec_comb by auto\n\n      ultimately show \"not_shadows_vconsts_env (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2)\"\n        by auto\n\n      have \"not_shadows_vconsts (Vabs cs \\<Gamma>'\\<^sub>2)\"\n        using \\<open>not_shadows_vconsts (Vrecabs _ _ _)\\<close> rec_comb\n        by auto\n\n      show \"fmrel_on_fset (frees rhs) vrelated (\\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1) (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2)\"\n        proof\n          fix name\n          assume \"name |\\<in>| frees rhs\"\n          moreover have \"fmdom css |\\<subseteq>| all_consts\"\n            using \\<open>vwelldefined (Vrecabs _ _ _)\\<close> unfolding all_consts_def\n            by auto\n          ultimately have \"name |\\<notin>| fmdom css\"\n            using \\<open>fdisjnt _ (frees rhs)\\<close>\n            unfolding fdisjnt_alt_def\n            by (metis (full_types) fempty_iff finterI fset_rev_mp)\n\n          show \"rel_option vrelated (fmlookup (\\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1) name) (fmlookup (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2) name)\"\n            proof (cases \"name |\\<in>| frees pat\")\n              case True\n              hence \"name |\\<in>| fmdom env\\<^sub>1\" \"name |\\<in>| fmdom env\\<^sub>2\"\n                using \\<open>fmdom env\\<^sub>1 = frees pat\\<close> \\<open>fmdom env\\<^sub>2 = frees pat\\<close>\n                by simp+\n              hence\n                \"fmlookup (\\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1) name = fmlookup env\\<^sub>1 name\"\n                \"fmlookup (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2) name = fmlookup env\\<^sub>2 name\"\n                by auto\n              thus ?thesis\n                using \\<open>fmrel vrelated env\\<^sub>1 env\\<^sub>2\\<close>\n                by auto\n            next\n              case False\n              hence \"name |\\<notin>| fmdom env\\<^sub>1\" \"name |\\<notin>| fmdom env\\<^sub>2\"\n                using \\<open>fmdom env\\<^sub>1 = frees pat\\<close> \\<open>fmdom env\\<^sub>2 = frees pat\\<close>\n                by simp+\n              hence\n                \"fmlookup (\\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1) name = fmlookup \\<Gamma>'\\<^sub>1 name\"\n                \"fmlookup (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2) name = fmlookup \\<Gamma>'\\<^sub>2 name\"\n                unfolding mk_rec_env_def using \\<open>name |\\<notin>| fmdom css\\<close>\n                by auto\n\n              moreover have \"name |\\<in>| frees (Sabs cs)\"\n                using False \\<open>name |\\<in>| frees rhs\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n                apply (auto simp: ffUnion_alt_def)\n                apply (rule fBexI[where x = \"frees rhs |-| frees pat\"])\n                 apply (auto simp: fset_of_list_elem)\n                done\n\n              ultimately show ?thesis\n                using \\<open>fmrel_on_fset (frees (Sabs cs)) vrelated \\<Gamma>'\\<^sub>1 \\<Gamma>'\\<^sub>2\\<close>\n                by (auto dest: fmrel_on_fsetD)\n            qed\n        qed\n\n      show \"fmrel_on_fset (consts rhs) vrelated (fmap_of_list rs) (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2)\"\n        proof\n          fix name\n          assume \"name |\\<in>| consts rhs\"\n          hence \"name |\\<in>| consts (Sabs cs)\"\n            using \\<open>(pat, rhs) \\<in> set cs\\<close>\n            by (auto intro!: fBexI simp: fset_of_list_elem ffUnion_alt_def)\n          hence \"rel_option vrelated (fmlookup (fmap_of_list rs) name) (fmlookup (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2) name)\"\n            using \\<open>fmrel_on_fset (consts (Sabs cs)) vrelated (fmap_of_list rs) (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2)\\<close>\n            by (auto dest: fmrel_on_fsetD)\n          moreover have \"name |\\<notin>| fmdom env\\<^sub>2\"\n            proof\n              assume \"name |\\<in>| fmdom env\\<^sub>2\"\n              hence \"fmlookup env\\<^sub>2 name \\<noteq> None\"\n                by (meson fmdom_notI)\n              then obtain v where \"fmlookup env\\<^sub>2 name = Some v\"\n                by blast\n              hence \"name |\\<in>| fmdom env\\<^sub>2\"\n                by (auto intro: fmdomI)\n              hence \"name |\\<in>| frees pat\"\n                using \\<open>fmdom env\\<^sub>2 = frees pat\\<close>\n                by simp\n\n              have \"vwelldefined (Vabs cs \\<Gamma>'\\<^sub>1)\"\n                using \\<open>vwelldefined (Vrecabs css _ \\<Gamma>'\\<^sub>1)\\<close>\n                using rec_comb\n                by auto\n\n              hence \"welldefined rhs\"\n                using \\<open>(pat, rhs) \\<in> set cs\\<close> rec_comb\n                by (auto simp: list_all_iff)\n              hence \"name |\\<in>| fst |`| fset_of_list rs |\\<union>| C\"\n                using \\<open>name |\\<in>| consts rhs\\<close> all_consts_def\n                by blast\n              moreover have \"\\<not> shadows_consts pat\"\n                using \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>'\\<^sub>2)\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n                by (auto simp: list_all_iff shadows_consts_def all_consts_def)\n              ultimately show False\n                using \\<open>name |\\<in>| frees pat\\<close>\n                unfolding shadows_consts_def fdisjnt_alt_def all_consts_def\n                by auto\n            qed\n          ultimately show \"rel_option vrelated (fmlookup (fmap_of_list rs) name) (fmlookup (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2) name)\"\n            by simp\n        qed\n    next\n      show \"wellformed rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>vwellformed (Vabs cs \\<Gamma>'\\<^sub>2)\\<close>\n        by (auto simp: list_all_iff)\n    next\n      have \"wellformed_venv \\<Gamma>'\\<^sub>2\"\n        by fact\n      moreover have \"wellformed_venv env\\<^sub>2\"\n        apply (rule vwellformed.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_wellformed)\n          apply fact\n        using \\<open>wellformed (t $\\<^sub>s u)\\<close> apply simp\n        apply fact+\n        done\n      moreover have \"wellformed_venv (mk_rec_env css \\<Gamma>'\\<^sub>2)\"\n        unfolding mk_rec_env_def\n        using \\<open>vwellformed (Vrecabs _ _ _)\\<close>\n        by (auto intro: fmdomI)\n      ultimately show \"wellformed_venv (\\<Gamma>'\\<^sub>2 ++\\<^sub>f mk_rec_env css \\<Gamma>'\\<^sub>2 ++\\<^sub>f env\\<^sub>2)\"\n        by blast\n    next\n      show \"welldefined rhs\"\n        using \\<open>vwelldefined (Vabs cs \\<Gamma>'\\<^sub>1)\\<close> \\<open>(pat, rhs) \\<in> set cs\\<close>\n        by (auto simp: list_all_iff)\n    next\n      have \"fmpred (\\<lambda>_. vwelldefined) \\<Gamma>'\\<^sub>1\"\n        using \\<open>vwelldefined (Vabs cs \\<Gamma>'\\<^sub>1)\\<close> by simp\n\n      moreover have \"fmpred (\\<lambda>_. vwelldefined) env\\<^sub>1\"\n        apply (rule vwelldefined.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval_welldefined)\n          apply fact\n         apply fact\n        using rec_comb apply simp\n        done\n\n      ultimately show \"fmpred (\\<lambda>_. vwelldefined) (\\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1)\"\n        by blast\n    qed\n\n  then obtain val\\<^sub>1 where \"rs, \\<Gamma>'\\<^sub>1 ++\\<^sub>f env\\<^sub>1 \\<turnstile>\\<^sub>v rhs \\<down> val\\<^sub>1\" \"\\<turnstile>\\<^sub>v val\\<^sub>1 \\<approx> val\\<^sub>2\"\n    by blast\n\n  show ?case\n    apply (intro conjI exI)\n     apply (rule veval.rec_comb)\n         apply fact+\n    done\nnext\n  case (constr name \\<Gamma>\\<^sub>2 ts us\\<^sub>2)\n\n  have \"list_all2 (\\<lambda>t u\\<^sub>2. (\\<exists>u\\<^sub>1. rs, \\<Gamma>\\<^sub>1 \\<turnstile>\\<^sub>v t \\<down> u\\<^sub>1 \\<and> \\<turnstile>\\<^sub>v u\\<^sub>1 \\<approx> u\\<^sub>2)) ts us\\<^sub>2\"\n    using \\<open>list_all2 _ ts us\\<^sub>2\\<close>\n    proof (rule list.rel_mono_strong, elim conjE impE allE exE)\n      fix t u\\<^sub>2\n      assume \"t \\<in> set ts\" \"u\\<^sub>2 \\<in> set us\\<^sub>2\"\n      assume \"\\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>v t \\<down> u\\<^sub>2\"\n\n      show \"wellformed t\" \"welldefined t\" \"\\<not> shadows_consts t\"\n        using constr \\<open>t \\<in> set ts\\<close>\n        unfolding welldefined.list_comb wellformed.list_comb shadows.list_comb\n        by (auto simp: list_all_iff list_ex_iff)\n\n      show\n        \"wellformed_venv \\<Gamma>\\<^sub>2\"\n        \"not_shadows_vconsts_env \\<Gamma>\\<^sub>2\"\n        \"fmpred (\\<lambda>_. vwelldefined) \\<Gamma>\\<^sub>1\"\n        by fact+\n\n      have \"consts t |\\<in>| fset_of_list (map consts ts)\"\n        using \\<open>t \\<in> set ts\\<close> by (simp add: fset_of_list_elem)\n      hence \"consts t |\\<subseteq>| consts (name $$ ts)\"\n        unfolding consts_list_comb\n        by (metis ffUnion_subset_elem le_supI2)\n      thus \"fmrel_on_fset (consts t) vrelated (fmap_of_list rs) \\<Gamma>\\<^sub>2\"\n        using constr by (blast intro: fmrel_on_fsubset)\n\n      have \"frees t |\\<in>| fset_of_list (map frees ts)\"\n        using \\<open>t \\<in> set ts\\<close> by (simp add: fset_of_list_elem)\n      hence \"frees t |\\<subseteq>| frees (name $$ ts)\"\n        unfolding frees_list_comb const_sterm_def freess_def\n        by (auto intro!: ffUnion_subset_elem)\n      thus \"fmrel_on_fset (frees t) vrelated \\<Gamma>\\<^sub>1 \\<Gamma>\\<^sub>2\"\n        using constr by (blast intro: fmrel_on_fsubset)\n    qed auto\n\n  then obtain us\\<^sub>1 where \"list_all2 (veval rs \\<Gamma>\\<^sub>1) ts us\\<^sub>1\" \"list_all2 vrelated us\\<^sub>1 us\\<^sub>2\"\n    by induction auto\n\n  thus ?case\n    using constr\n    by (auto intro: veval.constr vrelated.constr)\nqed\n\nlemma veval'_correct':\n  assumes \"\\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>v t \\<down> v\\<^sub>2\" \"wellformed t\" \"wellformed_venv \\<Gamma>\\<^sub>2\"\n  assumes \"\\<not> shadows_consts t\" \"not_shadows_vconsts_env \\<Gamma>\\<^sub>2\"\n  assumes \"welldefined t\"\n  assumes \"closed t\"\n  assumes \"fmrel_on_fset (consts t) vrelated (fmap_of_list rs) \\<Gamma>\\<^sub>2\"\n  obtains v\\<^sub>1 where \"rs, fmempty \\<turnstile>\\<^sub>v t \\<down> v\\<^sub>1\" \"\\<turnstile>\\<^sub>v v\\<^sub>1 \\<approx> v\\<^sub>2\"\nproof (rule veval'_correct[where \\<Gamma>\\<^sub>1 = fmempty])\n  show \"fmpred (\\<lambda>_. vwelldefined) fmempty\" by simp\nnext\n  show \"fmrel_on_fset (frees t) vrelated fmempty \\<Gamma>\\<^sub>2\"\n    using \\<open>closed t\\<close> unfolding closed_except_def by auto\nqed (rule assms)+\n\nend\n\nsubsubsection \\<open>Preservation of extensional equality\\<close>\n\nlemma (in constants) veval'_agree_eq:\n  assumes \"\\<Gamma> \\<turnstile>\\<^sub>v t \\<down> v\" \"fmrel_on_fset (ids t) erelated \\<Gamma>' \\<Gamma>\"\n  assumes \"closed_venv \\<Gamma>\" \"closed_except t (fmdom \\<Gamma>)\"\n  assumes \"wellformed t\" \"wellformed_venv \\<Gamma>\" \"fdisjnt C (fmdom \\<Gamma>)\"\n  assumes \"consts t |\\<subseteq>| fmdom \\<Gamma> |\\<union>| C\" \"fmpred (\\<lambda>_. vwelldefined') \\<Gamma>\"\n  assumes \"\\<not> shadows_consts t\" \"not_shadows_vconsts_env \\<Gamma>\"\n  obtains v' where \"\\<Gamma>' \\<turnstile>\\<^sub>v t \\<down> v'\" \"v' \\<approx>\\<^sub>e v\"\nusing assms proof (induction arbitrary: \\<Gamma>' thesis)\n  case (const name \\<Gamma> val)\n  hence \"name |\\<in>| ids (Sconst name)\"\n    unfolding ids_def by simp\n  with const have \"rel_option erelated (fmlookup \\<Gamma>' name) (fmlookup \\<Gamma> name)\"\n    by (auto dest: fmrel_on_fsetD)\n  then obtain val' where \"fmlookup \\<Gamma>' name = Some val'\" \"val' \\<approx>\\<^sub>e val\"\n    using \\<open>fmlookup \\<Gamma> name = Some val\\<close>\n    by cases auto\n  thus ?case\n    using const by (auto intro: veval'.const)\nnext\n  case (var \\<Gamma> name val)\n  hence \"name |\\<in>| ids (Svar name)\"\n    unfolding ids_def by simp\n  with var have \"rel_option erelated (fmlookup \\<Gamma>' name) (fmlookup \\<Gamma> name)\"\n    by (auto dest: fmrel_on_fsetD)\n  then obtain val' where \"fmlookup \\<Gamma>' name = Some val'\" \"val' \\<approx>\\<^sub>e val\"\n    using \\<open>fmlookup \\<Gamma> name = Some val\\<close>\n    by cases auto\n  thus ?case\n    using var by (auto intro: veval'.var)\nnext\n  case (abs \\<Gamma> cs)\n  hence \"Vabs cs \\<Gamma>' \\<approx>\\<^sub>e Vabs cs \\<Gamma>\"\n    by (auto intro: erelated.abs)\n  thus ?case\n    using abs by (auto intro: veval'.abs)\nnext\n  case (comb \\<Gamma> t cs \\<Gamma>\\<^sub>\\<Lambda> u v\\<^sub>2 env pat rhs val)\n\n  have \"fmrel_on_fset (ids t) erelated \\<Gamma>' \\<Gamma>\"\n    apply (rule fmrel_on_fsubset)\n     apply fact\n    unfolding ids_def by auto\n  then obtain v\\<^sub>1' where \"\\<Gamma>' \\<turnstile>\\<^sub>v t \\<down> v\\<^sub>1'\" \"v\\<^sub>1' \\<approx>\\<^sub>e Vabs cs \\<Gamma>\\<^sub>\\<Lambda>\"\n    using comb by (auto simp: closed_except_def)\n  then obtain \\<Gamma>\\<^sub>\\<Lambda>' where \"v\\<^sub>1' = Vabs cs \\<Gamma>\\<^sub>\\<Lambda>'\" \"fmrel_on_fset (ids (Sabs cs)) erelated \\<Gamma>\\<^sub>\\<Lambda>' \\<Gamma>\\<^sub>\\<Lambda>\"\n    by (auto elim: erelated.cases)\n\n  have \"fmrel_on_fset (ids u) erelated \\<Gamma>' \\<Gamma>\"\n    apply (rule fmrel_on_fsubset)\n     apply fact\n    unfolding ids_def by auto\n  then obtain v\\<^sub>2' where \"\\<Gamma>' \\<turnstile>\\<^sub>v u \\<down> v\\<^sub>2'\" \"v\\<^sub>2' \\<approx>\\<^sub>e v\\<^sub>2\"\n    apply -\n    apply (erule comb.IH(2))\n    using comb by (auto simp: closed_except_def)\n\n  have \"rel_option (rel_prod (fmrel erelated) (=)) (vfind_match cs v\\<^sub>2') (vfind_match cs v\\<^sub>2)\"\n    using \\<open>v\\<^sub>2' \\<approx>\\<^sub>e v\\<^sub>2\\<close> by (rule erelated.vfind_match_rel')\n  then obtain env' where \"fmrel erelated env' env\" \"vfind_match cs v\\<^sub>2' = Some (env', pat, rhs)\"\n    using comb by cases auto\n\n  have \"vclosed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\"\n    apply (rule veval'_closed)\n    using comb by (auto simp: closed_except_def)\n  have \"vclosed v\\<^sub>2\"\n    apply (rule veval'_closed)\n    using comb by (auto simp: closed_except_def)\n\n  have \"closed_except (Sabs cs) (fmdom \\<Gamma>\\<^sub>\\<Lambda>)\"\n    using \\<open>vclosed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> by (auto simp: Sterm.closed_except_simps)\n  hence \"frees (Sabs cs) |\\<subseteq>| fmdom \\<Gamma>\\<^sub>\\<Lambda>\"\n    unfolding closed_except_def .\n\n  have \"vwellformed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\"\n    apply (rule veval'_wellformed)\n      apply fact\n    using comb by auto\n\n  have \"(pat, rhs) \\<in> set cs\"\n    by (rule vfind_match_elem) fact\n  hence \"linear pat\"\n    using \\<open>vwellformed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close>\n    by (auto simp: list_all_iff)\n  hence \"frees pat = patvars (mk_pat pat)\"\n    by (simp add: mk_pat_frees)\n  hence \"fmdom env = frees pat\"\n    apply simp\n    apply (rule vmatch_dom)\n    apply (rule vfind_match_elem)\n    apply (rule comb)\n    done\n\n  have \"vwelldefined' (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\"\n    apply (rule veval'_welldefined')\n           apply fact\n    using comb by auto\n  hence \"consts rhs |\\<subseteq>| fmdom \\<Gamma>\\<^sub>\\<Lambda> |\\<union>| C\" \"fdisjnt C (fmdom \\<Gamma>\\<^sub>\\<Lambda>)\"\n    using \\<open>(pat, rhs) \\<in> set cs\\<close>\n    by (auto simp: list_all_iff)\n\n  have \"not_shadows_vconsts (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\"\n    apply (rule veval'_shadows)\n    using comb by auto\n\n  obtain val' where \"\\<Gamma>\\<^sub>\\<Lambda>' ++\\<^sub>f env' \\<turnstile>\\<^sub>v rhs \\<down> val'\" \"val' \\<approx>\\<^sub>e val\"\n    proof (erule comb.IH)\n      show \"closed_venv (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env)\"\n        apply rule\n        using \\<open>vclosed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> apply simp\n        apply (rule vclosed.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply fact\n        done\n    next\n      show \"wellformed rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>vwellformed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close>\n        by (auto simp: list_all_iff)\n    next\n      show \"wellformed_venv (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env)\"\n        apply rule\n        using \\<open>vwellformed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> apply simp\n        apply (rule vwellformed.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply (rule comb)\n        apply (rule veval'_wellformed)\n          apply fact\n        using comb by auto\n    next\n      show \"closed_except rhs (fmdom (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env))\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>vclosed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> \\<open>fmdom env = frees pat\\<close>\n        by (auto simp: list_all_iff)\n\n      have \"fmdom env = fmdom env'\"\n        using \\<open>fmrel erelated env' env\\<close>\n        by (metis fmrel_fmdom_eq)\n\n      show \"fmrel_on_fset (ids rhs) erelated (\\<Gamma>\\<^sub>\\<Lambda>' ++\\<^sub>f env') (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env)\"\n        proof\n          fix id\n          assume \"id |\\<in>| ids rhs\"\n\n          thus \"rel_option erelated (fmlookup (\\<Gamma>\\<^sub>\\<Lambda>' ++\\<^sub>f env') id) (fmlookup (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env) id)\"\n            unfolding ids_def\n            proof (cases rule: funion_strictE)\n              case A\n              hence \"id |\\<in>| fmdom env |\\<union>| fmdom \\<Gamma>\\<^sub>\\<Lambda>\"\n                using \\<open>closed_except rhs (fmdom (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env))\\<close>\n                unfolding closed_except_def\n                by auto\n\n              thus ?thesis\n                proof (cases rule: funion_strictE)\n                  case A\n                  hence \"id |\\<in>| fmdom env'\"\n                    using \\<open>fmdom env = frees pat\\<close> \\<open>fmdom env = fmdom env'\\<close> by simp\n                  with A show ?thesis\n                    using \\<open>fmrel erelated env' env\\<close> by auto\n                next\n                  case B\n                  hence \"id |\\<notin>| frees pat\"\n                    using \\<open>fmdom env = frees pat\\<close> by simp\n                  hence \"id |\\<in>| frees (Sabs cs)\"\n                    apply auto\n                    unfolding ffUnion_alt_def\n                    apply simp\n                    apply (rule fBexI[where x = \"(pat, rhs)\"])\n                    using \\<open>id |\\<in>| frees rhs\\<close> apply simp\n                    unfolding fset_of_list_elem\n                    apply (rule \\<open>(pat, rhs) \\<in> set cs\\<close>)\n                    done\n                  hence \"id |\\<in>| ids (Sabs cs)\"\n                    unfolding ids_def by simp\n\n                  have \"id |\\<notin>| fmdom env'\"\n                    using B unfolding \\<open>fmdom env = fmdom env'\\<close> by simp\n                  thus ?thesis\n                    using \\<open>id |\\<notin>| fmdom env\\<close>\n                    apply simp\n                    apply (rule fmrel_on_fsetD)\n                     apply (rule \\<open>id |\\<in>| ids (Sabs cs)\\<close>)\n                    apply (rule \\<open>fmrel_on_fset (ids (Sabs cs)) erelated \\<Gamma>\\<^sub>\\<Lambda>' \\<Gamma>\\<^sub>\\<Lambda>\\<close>)\n                    done\n                qed\n            next\n              case B\n              have \"id |\\<in>| consts (Sabs cs)\"\n                apply auto\n                unfolding ffUnion_alt_def\n                apply simp\n                apply (rule fBexI[where x = \"(pat, rhs)\"])\n                 apply simp\n                 apply fact\n                unfolding fset_of_list_elem\n                apply (rule \\<open>(pat, rhs) \\<in> set cs\\<close>)\n                done\n              hence \"id |\\<in>| ids (Sabs cs)\"\n                unfolding ids_def by auto\n\n              show ?thesis\n                using \\<open>fmdom env = fmdom env'\\<close>\n                apply auto\n                 apply (rule fmrelD)\n                 apply (rule \\<open>fmrel erelated env' env\\<close>)\n                apply (rule fmrel_on_fsetD)\n                 apply (rule \\<open>id |\\<in>| ids (Sabs cs)\\<close>)\n                apply (rule \\<open>fmrel_on_fset (ids (Sabs cs)) erelated \\<Gamma>\\<^sub>\\<Lambda>' \\<Gamma>\\<^sub>\\<Lambda>\\<close>)\n                done\n            qed\n        qed\n    next\n      show \"fmpred (\\<lambda>_. vwelldefined') (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env)\"\n        proof\n          have \"vwelldefined' (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\"\n            apply (rule veval'_welldefined')\n                   apply fact\n            using comb by auto\n          thus \"fmpred (\\<lambda>_. vwelldefined') \\<Gamma>\\<^sub>\\<Lambda>\"\n            by simp\n        next\n          have \"vwelldefined' v\\<^sub>2\"\n            apply (rule veval'_welldefined')\n                   apply fact\n            using comb by auto\n\n          show \"fmpred (\\<lambda>_. vwelldefined') env\"\n            apply (rule vmatch_welldefined')\n             apply (rule vfind_match_elem)\n             apply fact+\n            done\n        qed\n    next\n      have \"fdisjnt C (fmdom \\<Gamma>\\<^sub>\\<Lambda>)\"\n        using \\<open>vwelldefined' (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> by simp\n      moreover have \"fdisjnt C (fmdom env)\"\n        unfolding \\<open>fmdom env = _\\<close>\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close>\n        by (auto simp: list_all_iff all_consts_def fdisjnt_alt_def)\n      ultimately show \"fdisjnt C (fmdom (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env))\"\n        unfolding fdisjnt_alt_def by auto\n    next\n      show \"\\<not> shadows_consts rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close>\n        by (auto simp: list_all_iff)\n    next\n      have \"not_shadows_vconsts_env \\<Gamma>\\<^sub>\\<Lambda>\"\n        using \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> by auto\n      moreover have \"not_shadows_vconsts_env env\"\n        apply (rule not_shadows_vconsts.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_shadows)\n        using comb by auto\n      ultimately show \"not_shadows_vconsts_env (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env)\"\n        by blast\n    next\n      show \"consts rhs |\\<subseteq>| fmdom (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env) |\\<union>| C\"\n        using \\<open>consts rhs |\\<subseteq>| _\\<close>\n        by auto\n    qed\n\n  moreover have \"\\<Gamma>' \\<turnstile>\\<^sub>v t $\\<^sub>s u \\<down> val'\"\n    proof (rule veval'.comb)\n      show \"\\<Gamma>' \\<turnstile>\\<^sub>v t \\<down> Vabs cs \\<Gamma>\\<^sub>\\<Lambda>'\"\n        using \\<open>\\<Gamma>' \\<turnstile>\\<^sub>v t \\<down> v\\<^sub>1'\\<close>\n        unfolding \\<open>v\\<^sub>1' = _\\<close> .\n    qed fact+\n\n  ultimately show ?case\n    using comb by metis\nnext\n  case (rec_comb \\<Gamma> t css name \\<Gamma>\\<^sub>\\<Lambda> cs u v\\<^sub>2 env pat rhs val)\n\n  have \"fmrel_on_fset (ids t) erelated \\<Gamma>' \\<Gamma>\"\n    apply (rule fmrel_on_fsubset)\n    apply fact\n    unfolding ids_def by auto\n  then obtain v\\<^sub>1' where \"\\<Gamma>' \\<turnstile>\\<^sub>v t \\<down> v\\<^sub>1'\" \"v\\<^sub>1' \\<approx>\\<^sub>e Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>\"\n    using rec_comb by (auto simp: closed_except_def)\n  then obtain \\<Gamma>\\<^sub>\\<Lambda>'\n    where \"v\\<^sub>1' = Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>'\"\n      and \"pred_fmap (\\<lambda>cs. fmrel_on_fset (ids (Sabs cs)) erelated \\<Gamma>\\<^sub>\\<Lambda>' \\<Gamma>\\<^sub>\\<Lambda>) css\"\n    by (auto elim: erelated.cases)\n\n  have \"fmrel_on_fset (ids u) erelated \\<Gamma>' \\<Gamma>\"\n    apply (rule fmrel_on_fsubset)\n     apply fact\n    unfolding ids_def by auto\n  then obtain v\\<^sub>2' where \"\\<Gamma>' \\<turnstile>\\<^sub>v u \\<down> v\\<^sub>2'\" \"v\\<^sub>2' \\<approx>\\<^sub>e v\\<^sub>2\"\n    apply -\n    apply (erule rec_comb.IH(2))\n    using rec_comb by (auto simp: closed_except_def)\n\n  have \"rel_option (rel_prod (fmrel erelated) (=)) (vfind_match cs v\\<^sub>2') (vfind_match cs v\\<^sub>2)\"\n    using \\<open>v\\<^sub>2' \\<approx>\\<^sub>e v\\<^sub>2\\<close> by (rule erelated.vfind_match_rel')\n  then obtain env' where \"fmrel erelated env' env\" \"vfind_match cs v\\<^sub>2' = Some (env', pat, rhs)\"\n    using rec_comb by cases auto\n\n  have \"vclosed (Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>)\"\n    apply (rule veval'_closed)\n    using rec_comb by (auto simp: closed_except_def)\n  hence \"vclosed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\"\n    using rec_comb by (auto simp: closed_except_def)\n  have \"vclosed v\\<^sub>2\"\n    apply (rule veval'_closed)\n    using rec_comb by (auto simp: closed_except_def)\n\n  have \"closed_except (Sabs cs) (fmdom \\<Gamma>\\<^sub>\\<Lambda>)\"\n    using \\<open>vclosed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> by (auto simp: Sterm.closed_except_simps)\n  hence \"frees (Sabs cs) |\\<subseteq>| fmdom \\<Gamma>\\<^sub>\\<Lambda>\"\n    unfolding closed_except_def .\n\n  have \"vwellformed (Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>)\"\n    apply (rule veval'_wellformed)\n      apply fact\n    using rec_comb by auto\n  hence \"vwellformed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\"\n    using rec_comb by (auto simp: closed_except_def)\n\n  have \"(pat, rhs) \\<in> set cs\"\n    by (rule vfind_match_elem) fact\n  hence \"linear pat\"\n    using \\<open>vwellformed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close>\n    by (auto simp: list_all_iff)\n  hence \"frees pat = patvars (mk_pat pat)\"\n    by (simp add: mk_pat_frees)\n  hence \"fmdom env = frees pat\"\n    apply simp\n    apply (rule vmatch_dom)\n    apply (rule vfind_match_elem)\n    apply (rule rec_comb)\n    done\n\n  have \"vwelldefined' (Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>)\"\n    apply (rule veval'_welldefined')\n           apply fact\n    using rec_comb by auto\n  hence \"consts rhs |\\<subseteq>| fmdom \\<Gamma>\\<^sub>\\<Lambda> |\\<union>| (C |\\<union>| fmdom css)\" \"fdisjnt C (fmdom \\<Gamma>\\<^sub>\\<Lambda>)\"\n    using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>fmlookup css name = Some cs\\<close>\n    by (auto simp: list_all_iff dest!: fmpredD[where m = css])\n\n  have \"not_shadows_vconsts (Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>)\"\n    apply (rule veval'_shadows)\n    using rec_comb by auto\n  hence \"not_shadows_vconsts (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\"\n    using rec_comb by auto\n\n  obtain val' where \"\\<Gamma>\\<^sub>\\<Lambda>' ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>' ++\\<^sub>f env' \\<turnstile>\\<^sub>v rhs \\<down> val'\" \"val' \\<approx>\\<^sub>e val\"\n    proof (erule rec_comb.IH)\n      show \"closed_venv (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env)\"\n        apply rule\n         apply rule\n        using \\<open>vclosed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> apply simp\n        unfolding mk_rec_env_def\n        using \\<open>vclosed (Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>)\\<close> apply (auto intro: fmdomI)[]\n        apply (rule vclosed.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply fact\n        done\n    next\n      show \"wellformed rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>vwellformed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close>\n        by (auto simp: list_all_iff)\n    next\n      show \"wellformed_venv (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env)\"\n        apply rule\n         apply rule\n        using \\<open>vwellformed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> apply simp\n        unfolding mk_rec_env_def\n        using \\<open>vwellformed (Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>)\\<close> apply (auto intro: fmdomI)[]\n        apply (rule vwellformed.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_wellformed)\n          apply fact\n        using rec_comb by auto\n    next\n      have \"closed_except rhs (fmdom (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env))\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>vclosed (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> \\<open>fmdom env = frees pat\\<close>\n        by (auto simp: list_all_iff closed_except_def)\n      thus \"closed_except rhs (fmdom (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env))\"\n        unfolding closed_except_def\n        by auto\n\n      have \"fmdom env = fmdom env'\"\n        using \\<open>fmrel erelated env' env\\<close>\n        by (metis fmrel_fmdom_eq)\n\n      have \"fmrel_on_fset (ids rhs) erelated (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>') (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>)\"\n        unfolding mk_rec_env_def\n        apply rule\n        apply simp\n        unfolding option.rel_map\n        apply (rule option.rel_refl)\n        apply (rule erelated.intros)\n        apply (rule \\<open>pred_fmap (\\<lambda>cs. fmrel_on_fset (ids (Sabs cs)) erelated \\<Gamma>\\<^sub>\\<Lambda>' \\<Gamma>\\<^sub>\\<Lambda>) css\\<close>)\n        done\n\n      have \"fmrel_on_fset (ids (Sabs cs)) erelated \\<Gamma>\\<^sub>\\<Lambda>' \\<Gamma>\\<^sub>\\<Lambda>\"\n        using \\<open>pred_fmap (\\<lambda>cs. fmrel_on_fset (ids (Sabs cs)) erelated \\<Gamma>\\<^sub>\\<Lambda>' \\<Gamma>\\<^sub>\\<Lambda>) css\\<close> rec_comb\n        by auto\n\n      have \"fmdom (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>) = fmdom (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>')\"\n        unfolding mk_rec_env_def by auto\n\n      show \"fmrel_on_fset (ids rhs) erelated (\\<Gamma>\\<^sub>\\<Lambda>' ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>' ++\\<^sub>f env') (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env)\"\n        proof\n          fix id\n          assume \"id |\\<in>| ids rhs\"\n\n          thus \"rel_option erelated (fmlookup (\\<Gamma>\\<^sub>\\<Lambda>' ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>' ++\\<^sub>f env') id) (fmlookup (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env) id)\"\n            unfolding ids_def\n            proof (cases rule: funion_strictE)\n              case A\n              hence \"id |\\<in>| fmdom env |\\<union>| fmdom \\<Gamma>\\<^sub>\\<Lambda>\"\n                using \\<open>closed_except rhs (fmdom (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env))\\<close>\n                unfolding closed_except_def\n                by auto\n\n              thus ?thesis\n                proof (cases rule: funion_strictE)\n                  case A\n                  hence \"id |\\<in>| fmdom env'\"\n                    using \\<open>fmdom env = frees pat\\<close> \\<open>fmdom env = fmdom env'\\<close> by simp\n                  with A show ?thesis\n                    using \\<open>fmrel erelated env' env\\<close> by auto\n                next\n                  case B\n                  hence \"id |\\<notin>| frees pat\"\n                    using \\<open>fmdom env = frees pat\\<close> by simp\n                  hence \"id |\\<in>| frees (Sabs cs)\"\n                    apply auto\n                    unfolding ffUnion_alt_def\n                    apply simp\n                    apply (rule fBexI[where x = \"(pat, rhs)\"])\n                    using \\<open>id |\\<in>| frees rhs\\<close> apply simp\n                    unfolding fset_of_list_elem\n                    apply (rule \\<open>(pat, rhs) \\<in> set cs\\<close>)\n                    done\n                  hence \"id |\\<in>| ids (Sabs cs)\"\n                    unfolding ids_def by simp\n\n                  have \"id |\\<notin>| fmdom env'\"\n                    using B unfolding \\<open>fmdom env = fmdom env'\\<close> by simp\n                  thus ?thesis\n                    using \\<open>id |\\<notin>| fmdom env\\<close> \\<open>fmdom (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>) = fmdom (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>')\\<close>\n                    apply auto\n                     apply (rule fmrel_on_fsetD)\n                      apply (rule \\<open>id |\\<in>| ids rhs\\<close>)\n                     apply (rule \\<open>fmrel_on_fset (ids rhs) erelated (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>') (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>)\\<close>)\n                    apply (rule fmrel_on_fsetD)\n                     apply (rule \\<open>id |\\<in>| ids (Sabs cs)\\<close>)\n                    apply (rule \\<open>fmrel_on_fset (ids (Sabs cs)) erelated \\<Gamma>\\<^sub>\\<Lambda>' \\<Gamma>\\<^sub>\\<Lambda>\\<close>)\n                    done\n                qed\n            next\n              case B\n              have \"id |\\<in>| consts (Sabs cs)\"\n                apply auto\n                unfolding ffUnion_alt_def\n                apply simp\n                apply (rule fBexI[where x = \"(pat, rhs)\"])\n                 apply simp\n                 apply fact\n                unfolding fset_of_list_elem\n                apply (rule \\<open>(pat, rhs) \\<in> set cs\\<close>)\n                done\n              hence \"id |\\<in>| ids (Sabs cs)\"\n                unfolding ids_def by auto\n\n              show ?thesis\n                using \\<open>fmdom env = fmdom env'\\<close> \\<open>fmdom (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>) = fmdom (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>')\\<close>\n                apply auto\n                   apply (rule fmrelD)\n                   apply (rule \\<open>fmrel erelated env' env\\<close>)\n                  apply (rule fmrel_on_fsetD)\n                   apply (rule \\<open>id |\\<in>| ids rhs\\<close>)\n                  apply (rule \\<open>fmrel_on_fset (ids rhs) erelated (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>') (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>)\\<close>)\n                 apply (rule fmrelD)\n                 apply (rule \\<open>fmrel erelated env' env\\<close>)\n                apply (rule fmrel_on_fsetD)\n                 apply (rule \\<open>id |\\<in>| ids (Sabs cs)\\<close>)\n                apply (rule \\<open>fmrel_on_fset (ids (Sabs cs)) erelated \\<Gamma>\\<^sub>\\<Lambda>' \\<Gamma>\\<^sub>\\<Lambda>\\<close>)\n                done\n            qed\n        qed\n    next\n      show \"fmpred (\\<lambda>_. vwelldefined') (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env)\"\n        proof (intro fmpred_add)\n          have \"vwelldefined' (Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>)\"\n            apply (rule veval'_welldefined')\n                   apply fact\n            using rec_comb by auto\n          thus \"fmpred (\\<lambda>_. vwelldefined') \\<Gamma>\\<^sub>\\<Lambda>\" \"fmpred (\\<lambda>_. vwelldefined') (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>)\"\n            unfolding mk_rec_env_def\n            by (auto intro: fmdomI)\n        next\n          have \"vwelldefined' v\\<^sub>2\"\n            apply (rule veval'_welldefined')\n                   apply fact\n            using rec_comb by auto\n\n          show \"fmpred (\\<lambda>_. vwelldefined') env\"\n            apply (rule vmatch_welldefined')\n             apply (rule vfind_match_elem)\n             apply fact+\n            done\n        qed\n    next\n      have \"fdisjnt C (fmdom env)\"\n        unfolding \\<open>fmdom env = _\\<close>\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close>\n        by (auto simp: list_all_iff all_consts_def fdisjnt_alt_def)\n      moreover have \"fdisjnt C (fmdom css)\"\n        using \\<open>vwelldefined' (Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>)\\<close> by simp\n      ultimately show \"fdisjnt C (fmdom (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env))\"\n        using \\<open>fdisjnt C (fmdom \\<Gamma>\\<^sub>\\<Lambda>)\\<close>\n        unfolding fdisjnt_alt_def mk_rec_env_def by auto\n    next\n      show \"\\<not> shadows_consts rhs\"\n        using \\<open>(pat, rhs) \\<in> set cs\\<close> \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close>\n        by (auto simp: list_all_iff)\n    next\n      have \"not_shadows_vconsts_env \\<Gamma>\\<^sub>\\<Lambda>\"\n        using \\<open>not_shadows_vconsts (Vabs cs \\<Gamma>\\<^sub>\\<Lambda>)\\<close> by auto\n      moreover have \"not_shadows_vconsts_env env\"\n        apply (rule not_shadows_vconsts.vmatch_env)\n         apply (rule vfind_match_elem)\n         apply fact\n        apply (rule veval'_shadows)\n        using rec_comb by auto\n      moreover have \"not_shadows_vconsts_env (mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda>)\"\n        unfolding mk_rec_env_def\n        using \\<open>not_shadows_vconsts (Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>)\\<close>\n        by (auto intro: fmdomI)\n      ultimately show \"not_shadows_vconsts_env (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env)\"\n        by blast\n    next\n      show \"consts rhs |\\<subseteq>| fmdom (\\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f mk_rec_env css \\<Gamma>\\<^sub>\\<Lambda> ++\\<^sub>f env) |\\<union>| C\"\n        using \\<open>consts rhs |\\<subseteq>| _\\<close> unfolding mk_rec_env_def\n        by auto\n    qed\n\n  moreover have \"\\<Gamma>' \\<turnstile>\\<^sub>v t $\\<^sub>s u \\<down> val'\"\n    proof (rule veval'.rec_comb)\n      show \"\\<Gamma>' \\<turnstile>\\<^sub>v t \\<down> Vrecabs css name \\<Gamma>\\<^sub>\\<Lambda>'\"\n        using \\<open>\\<Gamma>' \\<turnstile>\\<^sub>v t \\<down> v\\<^sub>1'\\<close>\n        unfolding \\<open>v\\<^sub>1' = _\\<close> .\n    qed fact+\n\n  ultimately show ?case\n    using rec_comb by metis\nnext\n  case (constr name \\<Gamma> ts us)\n\n  have \"list_all (\\<lambda>t. fmrel_on_fset (ids t) erelated \\<Gamma>' \\<Gamma> \\<and> closed_except t (fmdom \\<Gamma>) \\<and> wellformed t \\<and> consts t |\\<subseteq>| fmdom \\<Gamma> |\\<union>| C \\<and> \\<not> shadows_consts t) ts\"\n    apply (rule list_allI)\n    apply rule\n     apply (rule fmrel_on_fsubset)\n      apply (rule constr)\n    subgoal\n      unfolding ids_list_comb\n      by (induct ts; auto)\n    subgoal\n      apply (intro conjI)\n      subgoal\n        using \\<open>closed_except (name $$ ts) (fmdom \\<Gamma>)\\<close>\n        unfolding closed.list_comb by (auto simp: list_all_iff)\n      subgoal\n        using \\<open>wellformed (name $$ ts)\\<close>\n        unfolding wellformed.list_comb by (auto simp: list_all_iff)\n      subgoal\n        using \\<open>consts (name $$ ts) |\\<subseteq>| fmdom \\<Gamma> |\\<union>| C\\<close>\n        unfolding consts_list_comb\n        by (metis Ball_set constr.prems(8) special_constants.sconsts_list_comb)\n      subgoal\n        using \\<open>\\<not> shadows_consts (name $$ ts)\\<close>\n        unfolding shadows.list_comb by (auto simp: list_ex_iff)\n      done\n    done\n\n  obtain us' where \"list_all3 (\\<lambda>t u u'. \\<Gamma>' \\<turnstile>\\<^sub>v t \\<down> u' \\<and> u' \\<approx>\\<^sub>e u) ts us us'\"\n    using \\<open>list_all2 _ _ _\\<close> \\<open>list_all _ ts\\<close>\n    proof (induction arbitrary: thesis rule: list.rel_induct)\n      case (Cons t ts u us)\n      then obtain us' where \"list_all3 (\\<lambda>t u u'. \\<Gamma>' \\<turnstile>\\<^sub>v t \\<down> u' \\<and> u' \\<approx>\\<^sub>e u) ts us us'\"\n        by auto\n      have\n        \"fmrel_on_fset (ids t) erelated \\<Gamma>' \\<Gamma>\" \"closed_except t (fmdom \\<Gamma>)\"\n        \"wellformed t\" \"consts t |\\<subseteq>| fmdom \\<Gamma> |\\<union>| C\" \"\\<not> shadows_consts t\"\n        using Cons by auto\n\n      then obtain u' where \"\\<Gamma>' \\<turnstile>\\<^sub>v t \\<down> u'\" \"u' \\<approx>\\<^sub>e u\"\n        using \\<open>closed_venv \\<Gamma>\\<close> \\<open>wellformed_venv \\<Gamma>\\<close> \\<open>fdisjnt C (fmdom \\<Gamma>)\\<close> \\<open>fmpred (\\<lambda>_. vwelldefined') \\<Gamma>\\<close>\n        using \\<open>not_shadows_vconsts_env \\<Gamma>\\<close> Cons.hyps\n        by blast\n\n      show ?case\n        apply (rule Cons.prems)\n        apply (rule list_all3_cons)\n         apply fact\n        apply (rule conjI)\n         apply fact+\n        done\n    qed auto\n\n  show ?case\n    apply (rule constr.prems)\n     apply (rule veval'.constr[where us = us'])\n      apply fact\n    using \\<open>list_all3 _ ts us us'\\<close>\n     apply (induct; auto)\n    apply (rule erelated.intros)\n    using \\<open>list_all3 _ ts us us'\\<close>\n    apply (induct; auto)\n    done\nqed\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CakeML_Codegen/Rewriting/Big_Step_Value_ML.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3085785599105116}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\n(*\n  Structures supporting CTypes.\n  Primarily sets up types, defines pointers and the raw heap view.\n*)\n\ntheory CTypesBase\nimports\n  \"./$L4V_ARCH/Addr_Type\"\n  \"HOL-Library.Prefix_Order\"\n  \"Word_Lib.Signed_Words\"\nbegin\n\nsection \"Type setup\"\n\ntype_synonym byte = \"8 word\"\n\ntype_synonym memory = \"addr \\<Rightarrow> byte\"\ntype_synonym 'a mem_upd = \"addr \\<Rightarrow> 'a \\<Rightarrow> memory \\<Rightarrow> memory\"\ntype_synonym 'a mem_read = \"addr \\<Rightarrow> memory \\<Rightarrow> 'a\"\n\nclass unit_class =\n  assumes there_is_only_one: \"x = y\"\n\ninstantiation unit :: unit_class\nbegin\ninstance by (intro_classes, simp)\nend\n\nsubsection \"Pointers\"\n\ndatatype 'a ptr = Ptr addr\n\nabbreviation\n  NULL :: \"'a ptr\" where\n  \"NULL \\<equiv> Ptr 0\"\n\nML \\<open>\nstructure Ptr_Syntax =\nstruct\n\n  val show_ptr_types = Attrib.setup_config_bool @{binding show_ptr_types} (K true)\n\n  fun ptr_tr' cnst ctxt typ ts = if Config.get ctxt show_ptr_types then\n      case Term.strip_type typ of\n        ([@{typ addr}], Type (@{type_name \"ptr\"}, [T])) =>\n          list_comb\n            (Syntax.const cnst $ Syntax_Phases.term_of_typ ctxt T\n            , ts)\n        | _ => raise Match\n  else raise Match\n\n  fun ptr_coerce_tr' cnst ctxt typ ts = if Config.get ctxt show_ptr_types then\n      case Term.strip_type typ of\n        ([Type (@{type_name ptr}, [S])], Type (@{type_name \"ptr\"}, [T])) =>\n          list_comb\n            (Syntax.const cnst $ Syntax_Phases.term_of_typ ctxt S\n                               $ Syntax_Phases.term_of_typ ctxt T\n            , ts)\n        | _ => raise Match\n  else raise Match\nend\n\\<close>\n\nsyntax\n  \"_Ptr\" :: \"type \\<Rightarrow> logic\" (\"(1PTR/(1'(_')))\")\ntranslations\n  \"PTR('a)\" => \"CONST Ptr :: (addr \\<Rightarrow> 'a ptr)\"\ntyped_print_translation\n  \\<open> [(@{const_syntax Ptr}, Ptr_Syntax.ptr_tr' @{syntax_const \"_Ptr\"})] \\<close>\n\nprimrec\n  ptr_val :: \"'a ptr \\<Rightarrow> addr\"\nwhere\n  ptr_val_def: \"ptr_val (Ptr a) = a\"\n\nprimrec\n  ptr_coerce :: \"'a ptr \\<Rightarrow> 'b ptr\" where\n  \"ptr_coerce (Ptr a) = Ptr a\"\n\nsyntax\n  \"_Ptr_coerce\" :: \"type \\<Rightarrow> type \\<Rightarrow> logic\" (\"(1PTR'_COERCE/(1'(_ \\<rightarrow> _')))\")\ntranslations\n  \"PTR_COERCE('a \\<rightarrow> 'b)\" => \"CONST ptr_coerce :: ('a ptr \\<Rightarrow> 'b ptr)\"\ntyped_print_translation\n  \\<open> [(@{const_syntax ptr_coerce}, Ptr_Syntax.ptr_coerce_tr' @{syntax_const \"_Ptr_coerce\"})] \\<close>\n\ndefinition\n  (* no ctype/memtype-class constraints on these so as to allow comparison of\n     void * pointers, which are represented as Isabelle type unit ptr *)\n  ptr_less :: \"'a ptr \\<Rightarrow> 'a ptr \\<Rightarrow> bool\" (infixl \"<\\<^sub>p\" 50) where\n  \"p <\\<^sub>p q \\<equiv> ptr_val p < ptr_val q\"\n\ndefinition\n  ptr_le :: \"'a ptr \\<Rightarrow> 'a ptr \\<Rightarrow> bool\" (infixl \"\\<le>\\<^sub>p\" 50) where\n  \"p \\<le>\\<^sub>p q \\<equiv> ptr_val p \\<le> ptr_val q\"\n\ninstantiation ptr :: (type) ord\nbegin\n\ndefinition\n  ptr_less_def': \"p < q \\<equiv> p <\\<^sub>p q\"\ndefinition\n  ptr_le_def': \"p \\<le> q \\<equiv> p \\<le>\\<^sub>p q\"\n\ninstance ..\n\nend\n\nlemma ptr_val_case: \"ptr_val p = (case p of Ptr v \\<Rightarrow> v)\"\n  by (cases p) simp\n\ninstantiation ptr :: (type) linorder\nbegin\ninstance\n  by (intro_classes)\n     (unfold ptr_le_def' ptr_le_def ptr_less_def' ptr_less_def ptr_val_case,\n      auto split: ptr.splits)\nend\n\nsubsection \"Raw heap\"\n\ntext \\<open>A raw map from addresses to bytes\\<close>\n\ntype_synonym heap_mem = \"addr \\<Rightarrow> byte\"\n\ntext \\<open>For heap h, pointer p and nat n, (heap_list h n p) returns the list\n        of bytes in the heap taken from addresses {p..+n}\\<close>\n\nprimrec\n  heap_list :: \"heap_mem \\<Rightarrow> nat \\<Rightarrow> addr \\<Rightarrow> byte list\"\nwhere\n  heap_list_base: \"heap_list h 0 p = []\"\n| heap_list_rec:  \"heap_list h (Suc n) p = h p # heap_list h n (p + 1)\"\n\n\nsection \"Intervals\"\n\ntext \\<open>\n  For word a and nat b, {a..+b} is the set of words x,\n  with unat (x - a) < b.\\<close>\n\ndefinition\n  intvl :: \"'a::len word \\<times> nat \\<Rightarrow> 'a::len word set\" where\n  \"intvl x \\<equiv> {z. \\<exists>k. z = fst x + of_nat k \\<and> k < snd x}\"\n\nabbreviation\n  \"intvl_abbr\" :: \"'a::len word \\<Rightarrow> nat \\<Rightarrow> 'a word set\" (\"{_..+_}\") where\n  \"{a..+b} \\<equiv> intvl (a,b)\"\n\n\nsection \"dt_pair: a reimplementation of 2 item tuples\"\n\ndatatype\n    ('a,'b) dt_pair = DTPair 'a 'b\n\nprimrec\n  dt_fst :: \"('a,'b) dt_pair \\<Rightarrow> 'a\"\nwhere\n  \"dt_fst (DTPair a b) = a\"\n\nprimrec\n  dt_snd :: \"('a,'b) dt_pair \\<Rightarrow> 'b\"\nwhere\n  \"dt_snd (DTPair a b) = b\"\n\n\nlemma split_DTPair_All:\n  \"(\\<forall>x. P x) = (\\<forall>a b. P (DTPair a b))\"\n  by (rule iffI; clarsimp) (case_tac x, simp)\n\nlemma surjective_dt_pair:\n  \"p = DTPair (dt_fst p) (dt_snd p)\"\n  by (cases p) simp\n\nlemmas dt_pair_collapse [simp] = surjective_dt_pair[symmetric]\n\nlemma split_DTPair_all[no_atp]: \"(\\<And>x. PROP P x) \\<equiv> (\\<And>a b. PROP P (DTPair a b))\"\nproof\n  fix a b\n  assume \"\\<And>x. PROP P x\"\n  then show \"PROP P (DTPair a b)\" .\nnext\n  fix x\n  assume \"\\<And>a b. PROP P (DTPair a b)\"\n  from \\<open>PROP P (DTPair (dt_fst x) (dt_snd x))\\<close> show \"PROP P x\" by simp\nqed\n\n\ntype_synonym normalisor = \"byte list \\<Rightarrow> byte list\"\n\n\nsection \"Properties of pointers\"\n\nlemma Ptr_ptr_val [simp]:\n  \"Ptr (ptr_val p) = p\"\n  by (case_tac p) simp\n\nlemma ptr_val_ptr_coerce [simp]:\n  \"ptr_val (ptr_coerce p) = ptr_val p\"\n  by (case_tac p) simp\n\nlemma Ptr_ptr_coerce [simp]:\n  \"Ptr (ptr_val p) = ptr_coerce p\"\n  by (case_tac p) simp\n\nlemma ptr_coerce_id [simp]:\n  \"ptr_coerce p = p\"\n  by (case_tac p) simp\n\nlemma ptr_coerce_idem [simp]:\n  \"ptr_coerce (ptr_coerce p) = ptr_coerce p\"\n  by (case_tac p) simp\n\nlemma ptr_val_inj [simp]:\n  \"(ptr_val p = ptr_val q) = (p = q)\"\n  by (case_tac p, case_tac q) auto\n\nlemma ptr_coerce_NULL [simp]:\n  \"(ptr_coerce p = NULL) = (p = NULL)\"\n  by (case_tac p) simp\n\nlemma NULL_ptr_val:\n  \"(p = NULL) = (ptr_val p = 0)\"\n  by (case_tac p) simp\n\ninstantiation ptr :: (type) finite\nbegin\ninstance\n  by (intro_classes)\n     (auto intro!: finite_code finite_imageD [where f=ptr_val] injI)\nend\n\nsection \"Properties of the raw heap\"\n\nlemma heap_list_length [simp]:\n  \"length (heap_list h n p) = n\"\n  by (induct n arbitrary: p) auto\n\nlemma heap_list_split:\n  shows \"k \\<le> n \\<Longrightarrow> heap_list h n x = heap_list h k x @ heap_list h (n - k) (x + of_nat k)\"\nproof (induct n arbitrary: k x)\n  case 0 thus ?case by simp\nnext\n  case (Suc n) thus ?case\n    by (cases k, auto simp: ac_simps)\nqed\n\nlemma heap_list_split2:\n  \"heap_list h (x + y) p = heap_list h x p @ heap_list h y (p + of_nat x)\"\n  by (subst heap_list_split [where k=x], auto)\n\n\nsection \"Properties of intervals\"\n\nlemma intvlI:\n  \"x < n \\<Longrightarrow> p + of_nat x \\<in> {p..+n}\"\n  by (force simp: intvl_def)\n\nlemma intvlD:\n  \"q \\<in> {p..+n} \\<Longrightarrow> \\<exists>k. q = p + of_nat k \\<and> k < n\"\n  by (force simp: intvl_def)\n\nlemma intvl_empty [simp]:\n  \"{p..+0} = {}\"\n  by (fast dest: intvlD)\n\nlemma intvl_Suc:\n  \"q \\<in> {p..+Suc 0} \\<Longrightarrow> p = q\"\n  by (force dest: intvlD)\n\nlemma intvl_self:\n  \"0 < n \\<Longrightarrow> x \\<in> {x..+n}\"\n  by (force simp: intvl_def)\n\nlemma intvl_start_inter:\n  \"\\<lbrakk> 0 < m; 0 < n \\<rbrakk> \\<Longrightarrow> {p..+m} \\<inter> {p..+n} \\<noteq> {}\"\n  by (force simp: disjoint_iff_not_equal dest: intvl_self)\n\nlemma intvl_overflow:\n  assumes \"2^len_of TYPE('a) \\<le> n\"\n  shows \"{(p::'a::len word)..+n} = UNIV\"\nproof -\n  have witness:\n    \"\\<And>x. x = p + of_nat (unat (x - p)) \\<and> unat (x - p) < n\"\n    using assms by simp unat_arith\n  show ?thesis unfolding intvl_def by (auto intro!: witness)\nqed\n\ndeclare of_nat_diff [simp]\n\nlemma intvl_self_offset:\n  fixes p::\"'a::len word\"\n  assumes a: \"2^len_of TYPE('a) - n < x\" and b: \"x < 2^len_of TYPE('a)\" and\n      c: \"(p::'a::len word) \\<notin> {p + of_nat x..+n}\"\n  shows False\nproof -\n  let ?j = \"2^len_of TYPE('a) - x\"\n  from b have b': \"of_nat x + of_nat ?j  = (0::'a::len word)\" using of_nat_2p by auto\n  moreover from a b have \"?j < n\" by arith\n  with b b' c show  ?thesis by (force simp: intvl_def)\nqed\n\nlemma intvl_mem_offset:\n  \"\\<lbrakk> q \\<in> {p..+unat x}; q \\<notin> {p..+unat y}; unat y \\<le> unat x \\<rbrakk> \\<Longrightarrow>\n      q \\<in> {p + y..+unat x - unat y}\"\n  by (clarsimp simp: intvl_def) (rule_tac x=\"k - unat y\" in exI, auto)\n\nlemma intvl_plus_sub_offset:\n  \"x \\<in> {p + y..+q - unat y} \\<Longrightarrow> x \\<in> {p..+q}\"\n  by (clarsimp simp: intvl_def) (rule_tac x=\"k + unat y\" in exI, auto)\n\nlemma intvl_plus_sub_Suc:\n  \"x \\<in> {p + 1..+q - Suc 0} \\<Longrightarrow> x \\<in> {p..+q}\"\n  by (rule intvl_plus_sub_offset [where y=1], simp)\n\nlemma intvl_neq_start:\n  \"\\<lbrakk> (q::'a::len word) \\<in> {p..+n}; p \\<noteq> q \\<rbrakk> \\<Longrightarrow> q \\<in> {p + 1..+n - Suc 0}\"\n  by (clarsimp simp: intvl_def)\n     (metis (no_types) Suc_diff_1 add.commute add_Suc_right diff_diff_left neq0_conv\n                       of_nat_Suc semiring_1_class.of_nat_0 zero_less_diff)\n\nlemmas unat_simps' =\n  word_arith_nat_defs word_unat.eq_norm len_of_addr_card mod_less\n\nlemma intvl_offset_nmem:\n  \"\\<lbrakk> q \\<in> {(p::'a::len word)..+unat x}; y \\<le>  2^len_of TYPE('a) - unat x \\<rbrakk> \\<Longrightarrow>\n      q \\<notin> {p + x..+y}\"\n  apply (clarsimp simp: intvl_def)\n  apply (simp only: unat_simps')\n  apply (subst (asm) word_unat.Abs_inject)\n    apply (auto simp: unats_def)\n  done\n\nlemma intvl_Suc_nmem' [simp]:\n  \"n < 2^len_of TYPE('a) \\<Longrightarrow> (p::'a::len word) \\<notin> {p + 1..+n - Suc 0}\"\n  by (clarsimp simp: intvl_def)\n     (unat_arith, simp only: unat_simps')\n\nlemma intvl_start_le:\n  \"x \\<le> y \\<Longrightarrow> {p..+x} \\<subseteq> {p..+y}\"\n  by (force simp: intvl_def)\n\nlemma intvl_sub_eq:\n  assumes \"x \\<le> y\"\n  shows \"{p + x..+unat (y - x)} = {p..+unat y} - {p..+unat x}\"\nproof -\n  have \"unat y - unat x \\<le> 2 ^ len_of TYPE('a) - unat x\"\n    by (insert unat_lt2p [of y], arith)\n  moreover have \"x \\<le> y\" by fact\n  moreover hence \"unat (y - x) = unat y - unat x\"\n    by (simp add: word_le_nat_alt, unat_arith)\n  ultimately show ?thesis\n    by (force dest: intvl_offset_nmem intvl_mem_offset elim: intvl_plus_sub_offset\n              simp: word_le_nat_alt)\n\nqed\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/CParser/tools/c-parser/umm_heap/CTypesBase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6076631556226291, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3085785599105116}}
{"text": "theory WordArray_Update\n  imports WordArray_Abstractions\n\nbegin\n\ntype_synonym ('f, 'a, 'l) ufoldmapdef = \"('f, 'a, 'l) uabsfuns \\<Rightarrow> ('f, 'a, 'l) store \\<Rightarrow>\n                                          'l \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 'f expr \\<Rightarrow> \n                                          type \\<Rightarrow> ('f, 'a, 'l) uval \\<Rightarrow> type \\<Rightarrow> ('f, 'a, 'l) uval \\<Rightarrow>\n                                          (('f, 'a, 'l) store \\<times> ('f, 'a, 'l) uval) \\<Rightarrow> bool\"\n\ndefinition upd_wa_length_0\n  where\n  \"upd_wa_length_0 x y =\n      (let (x1, x2) = x;\n           (y1, y2) = y\n      in x1 = y1 \\<and> (\\<exists>p t len arr. x2 = UPtr p (RCon ''WordArray'' [RPrim (Num t)]) \\<and>\n          x1 p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\<and> y2 = UPrim (LU32 len)))\"\n\ndefinition upd_wa_get_0\n  where\n  \"upd_wa_get_0 x y =\n      (let (x1, x2) = x;\n           (y1, y2) = y\n      in x1 = y1 \\<and> (\\<exists>p idx t len arr. x2 = URecord [\n          (UPtr p (RCon ''WordArray'' [RPrim (Num t)]), RPtr (RCon ''WordArray'' [RPrim (Num t)])),\n          (UPrim (LU32 idx), RPrim (Num U32))] None \\<and> x1 p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\<and>\n          (idx < len \\<longrightarrow> x1 (arr + size_of_num_type t * idx) = option.Some y2) \\<and>\n            (\\<not> idx < len \\<longrightarrow> y2 = UPrim (zero_num_lit t))))\"\n\ndefinition upd_wa_put2_0\n  where\n  \"upd_wa_put2_0 x y =\n      (let (x1, x2) = x;\n           (y1, y2) = y\n      in (\\<exists>p idx val t len arr. x2 = URecord [\n          (UPtr p (RCon ''WordArray'' [RPrim (Num t)]), RPtr (RCon ''WordArray'' [RPrim (Num t)])),\n          (UPrim (LU32 idx), RPrim (Num U32)), (val, RPrim (Num t))] None \\<and>\n          x1 p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\<and>\n          y2 = UPtr p (RCon ''WordArray'' [RPrim (Num t)]) \\<and>\n          (if idx < len \n              then y1 = x1((arr + size_of_num_type t * idx) \\<mapsto> val)\n              else y1 = x1)))\"\n\nfunction upd_wa_foldnb_bod :: \"(funtyp, abstyp, ptrtyp) ufoldmapdef\"\n  where\n  \"upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f \\<tau>a acc \\<tau>o obsv res = (\\<exists>t len arr. \n    \\<sigma> p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\<and>\n    (if frm < min to len then (\\<exists>v acc' \\<sigma>'. \\<sigma> (arr + size_of_num_type t * frm) = option.Some v \\<and> \n          (\\<xi>\\<^sub>u, [(URecord [(v, RPrim (Num t)), (acc, type_repr \\<tau>a), \n            (obsv, type_repr \\<tau>o)] None)] \\<turnstile> (\\<sigma>, App f (Var 0)) \\<Down>! (\\<sigma>', acc')) \\<and>\n          upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma>' p (frm + 1) to f \\<tau>a acc' \\<tau>o obsv res) \n    else (\\<sigma>, acc) = res))\"\n  by pat_completeness auto\ntermination\n  apply (relation \"measure (\\<lambda>(_, _, _, frm, to, _, _, _, _, _, _). unat to - unat frm)\"; clarsimp)\n  apply (clarsimp simp: word_less_nat_alt)\n  apply (cut_tac n = frm in unat_Suc2; clarsimp)\n   apply (cut_tac y = to in word_not_simps(3); clarsimp simp: word_less_nat_alt)\n  apply linarith\n  done\ndeclare upd_wa_foldnb_bod.simps[simp del]\n\nfunction upd_wa_mapAccumnb_bod :: \"(char list, atyp, ptrtyp) ufoldmapdef\"\n  where\n  \"upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f \\<tau>a acc \\<tau>o obsv res = (\\<exists>t len arr. \n    \\<sigma> p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr)) \\<and> \n    (if frm < min to len then \n      (\\<exists>v v' acc' \\<sigma>'. \\<sigma> (arr + size_of_num_type t * frm) = option.Some v \\<and>\n      (\\<xi>\\<^sub>u, [(URecord [(v, RPrim (Num t)), (acc, type_repr \\<tau>a), (obsv, type_repr \\<tau>o)] None)]\n        \\<turnstile> (\\<sigma>, App f (Var 0)) \\<Down>! (\\<sigma>', URecord [ (v', RPrim (Num t)), (acc', type_repr \\<tau>a)] None)) \\<and>\n      upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u (\\<sigma>'((arr + size_of_num_type t * frm) \\<mapsto> v')) p (frm + 1) to f \n        \\<tau>a acc' \\<tau>o obsv res) \n    else res = (\\<sigma>, URecord [\n      (UPtr p (RCon ''WordArray'' [RPrim (Num t)]), RPtr (RCon ''WordArray'' [RPrim (Num t)])), \n      (acc, type_repr \\<tau>a)] None)))\"\n  by pat_completeness auto\ntermination\n  apply (relation \"measure (\\<lambda>(_, _, _, frm, to, _, _, _,_,_,_). unat to - unat frm)\"; clarsimp)\n  apply (clarsimp simp: word_less_nat_alt)\n  apply (cut_tac n = frm in unat_Suc2; clarsimp)\n   apply (cut_tac y = to in word_not_simps(3); clarsimp simp: word_less_nat_alt)\n  apply linarith\n  done\ndeclare upd_wa_mapAccumnb_bod.simps[simp del]\n\ndefinition upd_wa_foldnb\n  where\n  \"upd_wa_foldnb \\<Xi>' \\<xi>\\<^sub>u \\<tau> y z = \n    (let (y1, y2) = y\n      in (\\<exists>p frm to func acc obsv t u v a0 a1 a2.\n        y2 = URecord [(UPtr p (RCon ''WordArray'' [RPrim (Num t)]), RPtr (RCon ''WordArray'' [RPrim (Num t)])),\n                      (UPrim (LU32 frm), RPrim (Num U32)), (UPrim (LU32 to), RPrim (Num U32)),\n                      (func, RFun), (acc, type_repr u), (obsv, type_repr v)] None \\<and>\n        (\\<exists>len arr. y1 p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr))) \\<and>\n        is_uval_fun func \\<and> \n        \\<tau> = TRecord [(a0, TPrim (Num t), Present), (a1, u, Present), (a2, v, Present)] Unboxed \\<and>\n        distinct [a0, a1, a2] \\<and> (\\<Xi>', 0,[], {}, [option.Some \\<tau>] \\<turnstile> (App (uvalfun_to_exprfun func) (Var 0)) : u) \\<and>\n        upd_wa_foldnb_bod \\<xi>\\<^sub>u y1 p frm to (uvalfun_to_exprfun func) u acc v obsv z))\"\n\ndefinition upd_wa_mapAccumnb\n  where\n  \"upd_wa_mapAccumnb \\<Xi>' \\<xi>\\<^sub>u \\<tau>i \\<tau>o y z = \n    (let (y1, y2) = y\n      in (\\<exists>p frm to func acc obsv t u v a0 a1 a2 b0 b1.\n        y2 = URecord [(UPtr p (RCon ''WordArray'' [RPrim (Num t)]), RPtr (RCon ''WordArray'' [RPrim (Num t)])),\n                      (UPrim (LU32 frm), RPrim (Num U32)), (UPrim (LU32 to), RPrim (Num U32)),\n                      (func, RFun), (acc, type_repr u), (obsv,type_repr v)] None \\<and> \n        (\\<exists>len arr. y1 p = option.Some (UAbstract (UWA (TPrim (Num t)) len arr))) \\<and> \n        is_uval_fun func \\<and>\n        \\<tau>i = TRecord [(a0, TPrim (Num t), Present), (a1, u, Present), (a2, v, Present)] Unboxed \\<and>\n        \\<tau>o = TRecord [(b0, TPrim (Num t), Present), (b1, u, Present)] Unboxed \\<and>\n        distinct [a0, a1, a2] \\<and> distinct [b0, b1] \\<and>\n        (\\<Xi>', 0, [], {}, [option.Some \\<tau>i] \\<turnstile> (App (uvalfun_to_exprfun func) (Var 0)) : \\<tau>o) \\<and> \n        upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u y1 p frm to (uvalfun_to_exprfun func) u acc v obsv z))\"\n\ncontext update_sem begin\nlemma discardable_or_shareable_not_writable:\nassumes \"D \\<in> k \\<or> S \\<in> k\"\nshows \"\\<lbrakk> \\<Xi>', \\<sigma> \\<turnstile>  v  :u  \\<tau>  \\<langle> r , w \\<rangle>; 0, K', {} \\<turnstile>  \\<tau>  :\\<kappa>  k \\<rbrakk> \\<Longrightarrow> w = {}\"\nand   \"\\<lbrakk> \\<Xi>', \\<sigma> \\<turnstile>* fs :ur \\<tau>s \\<langle> r , w \\<rangle>; 0, K', {} \\<turnstile>* \\<tau>s :\\<kappa>r k \\<rbrakk> \\<Longrightarrow> w = {}\"\n  using assms\n  by (induct rule: uval_typing_uval_typing_record.inducts)\n    (force simp add: kinding_simps kinding_record_simps kinding_variant_set\n      dest: abs_typing_readonly[where s = Unboxed,simplified])+\n\nlemma frame_noalias_abs_typing:\nassumes \"frame \\<sigma> u \\<sigma>' u'\"\nand     \"abs_typing \\<Xi>' v name \\<tau>s s r w \\<sigma>\"\nshows   \"u  \\<inter> w = {} \\<Longrightarrow> u' \\<inter> w = {}\"\nand     \"u  \\<inter> r = {} \\<Longrightarrow> u' \\<inter> r = {}\"\n  using assms \n  by (auto iff:  set_eq_iff\n           simp: frame_def\n           dest: abs_typing_valid)\n\nlemma frame_noalias_abs_typing':\nassumes \"frame \\<sigma> u \\<sigma>' u'\"\nand     \"abs_typing \\<Xi>' v name \\<tau>s s r w \\<sigma>\"\nshows   \"u  \\<inter> w = {} \\<Longrightarrow> w \\<inter> u' = {}\"\nand     \"u  \\<inter> r = {} \\<Longrightarrow> r \\<inter> u' = {}\"\n  using assms \n  by (auto iff:  set_eq_iff\n           simp: frame_def\n           dest: abs_typing_valid)\n\n\nend (* of context *)\n\n\ncontext WordArray begin\n\nsection wordarray_length\n\nlemma upd_wa_length_preservation:\n  \"\\<lbrakk>uval_typing \\<Xi>' \\<sigma> v (TCon ''WordArray'' [t] (Boxed ReadOnly ptrl)) r w;\n    upd_wa_length_0 (\\<sigma>, v) (\\<sigma>', v')\\<rbrakk>\n    \\<Longrightarrow> \\<exists>r' w'. uval_typing \\<Xi>' \\<sigma>' v' (TPrim (Num U32)) r' w' \\<and> r' \\<subseteq> r \\<and> frame \\<sigma> w \\<sigma>' w'\"\n  apply (clarsimp simp: upd_wa_length_0_def)\n  apply (erule u_t_ptrE; clarsimp)\n  apply (rule_tac x = \"{}\" in exI)+\n  apply (clarsimp simp: frame_def intro!: u_t_prim')\n  done\n\nsection wordarray_get\n\nlemma upd_wa_get_preservation:\n  \"\\<lbrakk>uval_typing \\<Xi>' \\<sigma> v (TRecord [(a, TCon ''WordArray'' [t] (Boxed ReadOnly ptrl), Present),\n      (b, TPrim (Num U32), Present)] Unboxed) r w; upd_wa_get_0 (\\<sigma>, v) (\\<sigma>', v')\\<rbrakk>\n    \\<Longrightarrow> \\<exists>r' w'. uval_typing \\<Xi>' \\<sigma>' v' t r' w' \\<and> r' \\<subseteq> r \\<and> frame \\<sigma> w \\<sigma>' w'\"\n apply (clarsimp simp: upd_wa_get_0_def)\n  apply (erule u_t_recE; clarsimp)\n  apply (erule u_t_r_consE; clarsimp)\n  apply (erule u_t_ptrE; clarsimp)\n  apply (drule_tac t = \"type_repr _\" in sym)+\n  apply clarsimp\n  apply (erule u_t_r_consE; simp)\n  apply (erule conjE)+\n  apply (drule_tac t = \"type_repr _\" in sym)+\n  apply (erule u_t_r_emptyE; clarsimp)\n  apply (erule u_t_primE; subst (asm) lit_type.simps; clarsimp)+\n  apply (rule_tac x = \"{}\" in exI)+\n  apply (frule wa_abs_typing_u_elims(1))\n  apply (frule wa_abs_typing_u_elims(5))\n  apply (clarsimp simp: frame_id)\n  apply (erule_tac x = idx in allE)\n  apply (case_tac \"idx < len\"; clarsimp)\n   apply (rule u_t_prim'; clarsimp)+\n  apply (case_tac ta; clarsimp intro!: u_t_prim')\n  done\n\nsection wordarray_put2\n\nlemma upd_wa_put2_preservation:\n  \"\\<lbrakk>uval_typing \\<Xi>' \\<sigma> v (TRecord [(a, TCon ''WordArray'' [t] (Boxed Writable ptrl), Present),\n      (b, TPrim (Num U32), Present), (c, t, Present)] Unboxed) r w; upd_wa_put2_0 (\\<sigma>, v) (\\<sigma>', v')\\<rbrakk>\n    \\<Longrightarrow> \\<exists>r' w'. uval_typing \\<Xi>' \\<sigma>' v' (TCon ''WordArray'' [t] (Boxed Writable ptrl)) r' w' \\<and>\n      r' \\<subseteq> r \\<and> frame \\<sigma> w \\<sigma>' w'\"\n  apply (clarsimp simp: upd_wa_put2_0_def)\n  apply (erule u_t_recE; clarsimp)\n  apply (erule u_t_r_consE; clarsimp)\n  apply (erule u_t_ptrE; clarsimp)\n  apply (drule_tac t = \"type_repr _\" in sym)+\n  apply clarsimp\n  apply (erule u_t_r_consE; simp)\n  apply (erule conjE)+\n  apply (subst (asm) type_repr.simps[symmetric])+\n  apply clarsimp\n  apply (erule u_t_r_consE; simp)\n  apply (erule conjE)+\n  apply (subst (asm) type_repr.simps[symmetric])+\n  apply clarsimp\n  apply (erule u_t_r_emptyE)\n  apply (erule u_t_primE)+\n  apply (subst (asm) lit_type.simps)+\n  apply clarsimp\n  apply (drule_tac t = \"type_repr _\" in sym)+\n  apply (erule type_repr.elims[where y = \"RPrim _\", simplified]; clarsimp)\n  apply (frule tprim_no_pointers(1); clarsimp)\n  apply (frule tprim_no_pointers(2); clarsimp)\n  apply (rule_tac x = r in exI)\n  apply (rule_tac x = \"insert p wa\" in exI)\n  apply (erule u_t_primtE; clarsimp)\n  apply (drule_tac t = \"lit_type _\" in sym)\n  apply (rule conjI)\n   apply (rule_tac ptrl = ptrl and a = \"UWA (TPrim (Num ta)) len arr\" \n      in u_t_p_abs_w[where ts = \"[TPrim _]\", simplified]; simp?)\n    apply (clarsimp split: if_split_asm)\n    apply (rule wa_abs_typing_u_update; simp)\n   apply (frule wa_abs_typing_u_elims(3); clarsimp split: if_splits)\n  apply (clarsimp split: if_splits simp: frame_id)\n  apply (frule wa_abs_typing_u_elims(3); clarsimp)\n  apply (clarsimp simp: frame_def)\n  apply (rule conjI; clarsimp)\n   apply (rule conjI, clarsimp)\n    apply (erule_tac x = idx in allE; clarsimp)+\n   apply (rule conjI; clarsimp)\n  apply (rule conjI; clarsimp)\n  done\n\nsection wordarray_fold_no_break\n\nlemma upd_wa_foldnb_bod_to_geq_len:\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [t] (Boxed ReadOnly ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [],{}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present), \n      (a2, v, Present)] Unboxed)] \\<turnstile> (App f (Var 0)) : u;\n     distinct [a0, a1, a2];\n     upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm len f u acc v obsv (\\<sigma>', res);\n     to \\<ge> len\n    \\<rbrakk> \\<Longrightarrow> upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res)\"\n  apply (induct arbitrary: rb wb\n                rule: upd_wa_foldnb_bod.induct[of _ \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv \"(\\<sigma>', res)\"])\n  apply clarsimp\n  apply (drule_tac x = len in meta_spec)\n  apply (erule upd_wa_foldnb_bod.elims)\n  apply (clarsimp split: if_splits)\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (rename_tac \\<xi>\\<^sub>u \\<sigma> p frm f \\<tau>a acc \\<tau>o obsv \\<sigma>' res ta taa)\n  apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n  apply (rule conjI; clarsimp; simp?)\n   apply (rename_tac va acc' \\<sigma>a)\n   apply (drule_tac x = acc' in meta_spec)\n   apply (drule_tac x = \\<sigma>a in meta_spec)\n   apply clarsimp\n   apply (intro exI conjI, assumption)\n   apply (drule_tac r = \"rb \\<union> rc\" and\n                    w = wb \n                    in preservation_mono(1)[rotated 2]; simp?)\n    apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n     apply (rule u_t_struct; simp?)\n     apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n      apply (drule wa_abs_typing_u_elims(5))\n      apply (erule_tac x = frm in allE; clarsimp)\n      apply (rule u_t_prim'; clarsimp)\n     apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_empty)\n     apply (subst Int_commute; assumption)\n    apply (drule wa_abs_typing_u_elims(5))\n    apply (erule_tac x = frm in allE; clarsimp)\n    apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>=\"[]\", simplified])\n   apply clarsimp\n   apply (rename_tac r' w')\n   apply (drule_tac x = r' in meta_spec)\n   apply (drule_tac x = w' in meta_spec)\n   apply clarsimp\n   apply (erule meta_impE)\n    apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n   apply (erule meta_impE)\n    apply (drule abs_typing_frame[rotated 1]; simp?)\n   apply (erule meta_impE)\n    apply (drule_tac u = obsv in uval_typing_frame(1); simp?)\n   apply (erule meta_impE)\n    apply (drule_tac p = p in readonly_not_in_frame; simp?)\n   apply (erule meta_impE)\n    apply (drule frame_noalias_abs_typing'(2); simp?)\n     apply blast\n   apply (erule meta_impE)\n    apply (drule wa_abs_typing_u_elims(2); clarsimp)\n   apply (erule meta_impE)\n    apply (drule_tac v = obsv in frame_noalias_uval_typing'(2); simp?)\n   apply (drule wa_abs_typing_u_elims(2); clarsimp)\n  apply (erule disjE; clarsimp)\n  apply (rule FalseE)\n  by auto\n\nlemma upd_wa_foldnb_bod_to_geq_lenD:\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [t] (Boxed ReadOnly ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [],{}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present),\n      (a2, v, Present)] Unboxed)] \\<turnstile> (App f (Var 0)) : u;\n      distinct [a0, a1, a2];\n     upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res);\n     to \\<ge> len\n    \\<rbrakk> \\<Longrightarrow> upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm len f u acc v obsv (\\<sigma>', res)\"\n  apply (induct arbitrary: rb wb\n                rule: upd_wa_foldnb_bod.induct[of _ \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv \"(\\<sigma>', res)\"])\n  apply clarsimp\n  apply (drule_tac x = len in meta_spec)\n  apply (erule upd_wa_foldnb_bod.elims)\n  apply (clarsimp split: if_splits)\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (rename_tac \\<xi>\\<^sub>u \\<sigma> p frm to f \\<tau>a acc \\<tau>o obsv \\<sigma>' res ta taa)\n  apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n  apply (rule conjI; clarsimp; simp?)\n  apply (erule impE, simp)\n  apply clarsimp\n  apply (rename_tac va acc' \\<sigma>a)\n  apply (drule_tac x = acc' in meta_spec)\n  apply (drule_tac x = \\<sigma>a in meta_spec)\n  apply (intro exI conjI, assumption)\n  apply (drule_tac r = \"rb \\<union> rc\" and w = wb in preservation_mono(1)[rotated 2]; simp?)\n  apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n    apply (rule u_t_struct; simp?)\n    apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n     apply (drule wa_abs_typing_u_elims(5))\n     apply (erule_tac x = frm in allE; clarsimp)\n     apply (rule u_t_prim'; clarsimp)\n    apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n     apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n     apply (rule u_t_r_empty)\n    apply (subst Int_commute; assumption)\n   apply (drule wa_abs_typing_u_elims(5))\n   apply (erule_tac x = frm in allE; clarsimp)\n   apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>=\"[]\", simplified])\n  apply clarsimp\n  apply (rename_tac r' w')\n  apply (drule_tac x = r' in meta_spec)\n  apply (drule_tac x = w' in meta_spec)\n  apply clarsimp\n  apply (erule meta_impE)\n   apply simp\n  apply (erule meta_impE)\n   apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n  apply (erule meta_impE)\n   apply (drule abs_typing_frame[rotated 1]; simp?)\n  apply (erule meta_impE)\n   apply (drule_tac u = obsv in uval_typing_frame(1); simp?)\n  apply (erule meta_impE)\n   apply (drule_tac p = p in readonly_not_in_frame; simp?)\n  apply (erule meta_impE)\n   apply (drule frame_noalias_abs_typing'(2); simp?)\n   apply blast\n  apply (erule meta_impE)\n   apply (drule wa_abs_typing_u_elims(2); clarsimp)\n  apply (erule meta_impE)\n  apply (drule_tac v = obsv in frame_noalias_uval_typing'(2); simp?)\n  apply (drule wa_abs_typing_u_elims(2); clarsimp)\n  done\n\nlemma upd_wa_foldnb_bod_back_step':\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [t] (Boxed ReadOnly ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [], {}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present),\n      (a2, v, Present)] Unboxed)] \\<turnstile> (App f (Var 0)) : u;\n     distinct [a0, a1, a2];\n     upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm (1 + to) f u acc v obsv (\\<sigma>', res);\n     len < 1 + to\n    \\<rbrakk> \\<Longrightarrow> upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res)\"\n  apply (induct arbitrary: rb wb\n                rule: upd_wa_foldnb_bod.induct[of _ \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv \"(\\<sigma>', res)\"])\n  apply clarsimp\n  apply (drule_tac x = len in meta_spec)\n  apply (erule upd_wa_foldnb_bod.elims)\n  apply (clarsimp split: if_splits)\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (rename_tac \\<xi>\\<^sub>u \\<sigma> p frm f \\<tau>a acc \\<tau>o obsv \\<sigma>' res ta taa)\n  apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n  apply (rule conjI; clarsimp; simp?)\n   apply (erule impE, simp)\n   apply clarsimp\n   apply (rename_tac va acc' \\<sigma>a)\n   apply (drule_tac x = acc' in meta_spec)\n   apply (drule_tac x = \\<sigma>a in meta_spec)\n   apply (intro exI conjI, assumption)\n   apply (drule_tac r = \"rb \\<union> rc\" and w = wb in preservation_mono(1)[rotated 2]; simp?)\n    apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n     apply (rule u_t_struct; simp?)\n     apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n      apply (drule wa_abs_typing_u_elims(5))\n      apply (erule_tac x = frm in allE; clarsimp)\n      apply (rule u_t_prim'; clarsimp)\n     apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_empty)\n     apply (subst Int_commute; assumption)\n    apply (drule wa_abs_typing_u_elims(5))\n    apply (erule_tac x = frm in allE; clarsimp)\n    apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n   apply clarsimp\n   apply (rename_tac r' w')\n   apply (drule_tac x = r' in meta_spec)\n   apply (drule_tac x = w' in meta_spec)\n   apply clarsimp\n   apply (erule meta_impE)\n    apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n   apply (erule meta_impE)\n    apply (drule abs_typing_frame[rotated 1]; simp?)\n   apply (erule meta_impE)\n    apply (drule_tac u = obsv in uval_typing_frame(1); simp?)\n   apply (erule meta_impE)\n    apply (drule_tac p = p in readonly_not_in_frame; simp?)\n   apply (erule meta_impE)\n    apply (drule frame_noalias_abs_typing'(2); simp?)\n    apply blast\n   apply (erule meta_impE)\n    apply (drule wa_abs_typing_u_elims(2); clarsimp)\n   apply (erule meta_impE)\n    apply (drule_tac v= obsv in frame_noalias_uval_typing'(2); simp?)\n   apply (drule wa_abs_typing_u_elims(2); clarsimp)\n  apply (erule disjE; clarsimp)\n  apply (rule FalseE)\n  apply (cut_tac a = 1 and b = to in add.commute; clarsimp)\n  apply (drule plus_one_helper)\n  apply (drule order_class.order.strict_trans2; simp)\n  done\n\nlemma upd_wa_foldnb_bod_back_step:\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [TPrim (Num ta)] (Boxed ReadOnly ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [], {}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present),\n      (a2, v, Present)] Unboxed)] \\<turnstile> (App f (Var 0)) : u;\n     distinct [a0, a1, a2];\n     upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm (1 + to) f u acc v obsv (\\<sigma>'', res');\n     1 + to \\<le> len; frm < 1 + to\n    \\<rbrakk> \\<Longrightarrow> \\<exists>\\<sigma>' res va. upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res)\n                    \\<and> \\<sigma>' (arr + size_of_num_type ta * to) = option.Some va\n                    \\<and> (\\<xi>\\<^sub>u, [URecord [(va, RPrim (Num ta)), (res, type_repr u),\n                        (obsv, type_repr v)] None] \\<turnstile> (\\<sigma>', App f (Var 0))\\<Down>! (\\<sigma>'', res'))\"\n  apply (induct arbitrary: rb wb\n                rule: upd_wa_foldnb_bod.induct[of _ \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv \"(\\<sigma>'', res')\"])\n  apply clarsimp\n  apply (drule_tac x = len in meta_spec)\n  apply (erule upd_wa_foldnb_bod.elims)\n  apply (clarsimp split: if_splits)\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (rename_tac \\<xi>\\<^sub>u \\<sigma> p frm f \\<tau>a acc \\<tau>o obsv \\<sigma>'' res')\n  apply (erule impE, simp)\n  apply clarsimp\n  apply (rename_tac va acc' \\<sigma>a)\n  apply (case_tac \"frm < to\"; clarsimp)\n   apply (drule_tac x = acc' in meta_spec)\n   apply (drule_tac x = \\<sigma>a in meta_spec)\n   apply clarsimp\n   apply (drule_tac r = \"rb \\<union> rc\" and w = wb in preservation_mono(1)[rotated 2]; simp?)\n    apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n     apply (rule u_t_struct; simp?)\n     apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n      apply (drule wa_abs_typing_u_elims(5))\n      apply (erule_tac x = frm in allE; clarsimp)\n      apply (erule impE, simp)\n      apply clarsimp\n      apply (rule u_t_prim'; clarsimp)\n     apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_empty)\n     apply (subst Int_commute; assumption)\n    apply (drule wa_abs_typing_u_elims(5))\n    apply (erule_tac x = frm in allE; clarsimp)\n    apply (erule impE, simp)\n    apply clarsimp\n    apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n   apply clarsimp\n   apply (rename_tac r' w')\n   apply (drule_tac x = r' in meta_spec)\n   apply (drule_tac x = w' in meta_spec)\n   apply clarsimp\n   apply (erule meta_impE, simp)\n   apply (erule meta_impE)\n    apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n   apply (erule meta_impE)\n    apply (drule abs_typing_frame[rotated 1]; simp?)\n   apply (erule meta_impE)\n    apply (drule_tac u = obsv in uval_typing_frame(1); simp?)\n   apply (erule meta_impE)\n    apply (drule_tac p = p in readonly_not_in_frame; simp?)\n   apply (erule meta_impE)\n    apply (drule frame_noalias_abs_typing'(2); simp?)\n    apply blast\n   apply (erule meta_impE)\n    apply (drule wa_abs_typing_u_elims(2); clarsimp)\n   apply (erule meta_impE)\n    apply (drule_tac v = obsv in frame_noalias_uval_typing'(2); simp?)\n   apply (erule meta_impE)\n    apply (drule wa_abs_typing_u_elims(2); clarsimp)\n   apply (erule meta_impE)\n    apply (metis add.commute inc_le plus_one_helper2 word_not_simps(1))\n   apply clarsimp\n   apply (rename_tac \\<sigma>' res vb)\n   apply (rule_tac x = \\<sigma>' in exI)\n   apply (rule_tac x = res in exI)\n   apply (intro conjI exI; simp?)\n   apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n   apply (rule conjI; clarsimp; simp?)\n   apply (intro exI conjI; assumption)\n  apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n  apply (cut_tac a = 1 and b = to in add.commute; clarsimp)\n  apply (drule plus_one_helper; simp)\n  apply (erule upd_wa_foldnb_bod.elims; clarsimp)\n  done\n\nlemma upd_wa_foldnb_bod_step:\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [TPrim (Num ta)] (Boxed ReadOnly ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [], {}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present),\n      (a2, v, Present)] Unboxed)] \\<turnstile> (App f (Var 0)) : u;\n     distinct [a0, a1, a2];\n     upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res);\n     \\<sigma>' (arr + size_of_num_type ta * to) = option.Some va;\n     (\\<xi>\\<^sub>u, [URecord [(va, RPrim (Num ta)), (res, type_repr u),\n      (obsv, type_repr v)] None] \\<turnstile> (\\<sigma>', App f (Var 0))\\<Down>! (\\<sigma>'', res'));\n     frm \\<le> to; to < len\n    \\<rbrakk> \\<Longrightarrow> upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm (to + 1) f u acc v obsv (\\<sigma>'', res')\"\n  apply (induct arbitrary: \\<sigma>' res rb wb\n                rule: upd_wa_foldnb_bod.induct[of _ \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv \"(\\<sigma>', res)\"])\n  apply clarsimp\n  apply (drule_tac x = len in meta_spec)\n  apply (erule upd_wa_foldnb_bod.elims)\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (rename_tac \\<xi>\\<^sub>u \\<sigma> p frm to f \\<tau>a acc \\<tau>o obsv \\<sigma>' res)\n  apply (clarsimp split: if_splits)\n   apply (rename_tac vb acc' \\<sigma>a)\n   apply (drule_tac x = acc' in meta_spec)\n   apply (drule_tac x = \\<sigma>a in meta_spec)\n   apply (drule_tac x = \\<sigma>' in meta_spec)\n   apply (drule_tac x = res in meta_spec)\n   apply clarsimp\n   apply (drule_tac r = \"rb \\<union> rc\" and\n                    w = wb and\n                    \\<gamma> = \"[URecord [(vb, RPrim (Num ta)), (acc, type_repr \\<tau>a),\n                          (obsv, type_repr \\<tau>o)] None]\"\n                    in preservation_mono(1); simp?)\n    apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n     apply (rule u_t_struct; simp?)\n     apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n      apply (drule wa_abs_typing_u_elims(5))\n      apply (erule_tac x = frm in allE; clarsimp)\n      apply (rule u_t_prim'; clarsimp)\n     apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_empty)\n     apply (subst Int_commute; assumption)\n    apply (drule wa_abs_typing_u_elims(5))\n    apply (erule_tac x = frm in allE; clarsimp)\n    apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n   apply clarsimp\n   apply (rename_tac r' w')\n   apply (drule_tac x = r' in meta_spec)\n   apply (drule_tac x = w' in meta_spec)\n   apply clarsimp\n   apply (erule meta_impE)\n    apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n   apply (erule meta_impE)\n    apply (drule abs_typing_frame[rotated 1]; simp?)\n   apply (erule meta_impE)\n    apply (drule_tac u = obsv in uval_typing_frame(1); simp?)\n   apply (erule meta_impE)\n    apply (drule_tac p = p in readonly_not_in_frame; simp?)\n   apply (erule meta_impE)\n    apply (drule frame_noalias_abs_typing'(2); simp?)\n    apply blast\n   apply (erule meta_impE)\n    apply (drule wa_abs_typing_u_elims(2); clarsimp)\n   apply (erule meta_impE)\n    apply (drule_tac v = obsv in frame_noalias_uval_typing'(2); simp?)\n   apply (erule meta_impE)\n    apply (drule wa_abs_typing_u_elims(2); clarsimp)\n   apply (erule meta_impE)\n    apply (simp add: inc_le)\n   apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n   apply (rule conjI; clarsimp)\n    apply (intro exI conjI; assumption)\n   apply (rule FalseE)\n   apply (simp add: less_is_non_zero_p1 plus_one_helper2)\n  apply (erule disjE, clarsimp)\n   apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n   apply (rule conjI; clarsimp)\n    apply (subst upd_wa_foldnb_bod.simps; clarsimp)\n    apply (drule_tac r = \"rb \\<union> rc\" and w = wb in preservation_mono(1); simp?)\n     apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n      apply (rule u_t_struct; simp?)\n      apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n       apply (drule wa_abs_typing_u_elims(5))\n       apply (erule_tac x = to in allE; clarsimp)\n       apply (rule u_t_prim'; clarsimp)\n      apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n       apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n       apply (rule u_t_r_empty)\n      apply (subst Int_commute; assumption)\n     apply (drule wa_abs_typing_u_elims(5))\n     apply (erule_tac x = to in allE; clarsimp)\n     apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n    apply clarsimp\n    apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n    apply (intro exI, assumption)\n   apply (rule FalseE)\n   apply (simp add: less_is_non_zero_p1 plus_one_helper2)\n  apply (rule FalseE)\n  by auto\n\nlemma upd_wa_foldnb_bod_preservation:\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [t] (Boxed ReadOnly ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [], {}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present),\n      (a2, v, Present)] Unboxed)] \\<turnstile> (App f (Var 0)) : u;\n     distinct [a0, a1, a2];\n     upd_wa_foldnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res)\n    \\<rbrakk> \\<Longrightarrow> \\<exists>r' w'. uval_typing \\<Xi>' \\<sigma>' res u r' w' \n                \\<and> r' \\<subseteq> rb \\<union> rc \n                \\<and> frame \\<sigma> wb \\<sigma>' w'\"\n  apply (induct to arbitrary: \\<sigma>' res)\n   apply (erule upd_wa_foldnb_bod.elims; clarsimp)\n   apply (intro exI conjI, assumption, blast, simp add: frame_id)\n  apply clarsimp\n  apply (case_tac \"len < 1 + to\")\n   apply (drule_tac ptrl = ptrl and\n                      ra = ra and\n                      wa = wa and\n                      rb = rb and\n                      rc = rc in upd_wa_foldnb_bod_back_step'; simp?)\n   apply (elim meta_allE meta_impE; assumption)\n  apply (case_tac \"1 + to \\<le> frm\")\n   apply (frule_tac y = \"1 + to\" and x = frm in leD)\n   apply (erule upd_wa_foldnb_bod.elims; clarsimp)\n   apply (intro exI conjI, assumption, blast, simp add: frame_id)\n  apply (frule wa_abs_typing_u_elims(1))\n  apply (clarsimp simp: not_le not_less)\n  apply (rename_tac ta)\n  apply (frule_tac ptrl = ptrl and\n                     ta = ta and\n                     ra = ra and\n                     wa = wa and\n                     rb = rb and\n                     wb = wb and\n                     rc = rc \n                   in upd_wa_foldnb_bod_back_step; simp?)\n  apply clarsimp\n  apply (rename_tac \\<sigma>a resa va)\n  apply (elim meta_allE meta_impE, assumption)\n  apply clarsimp\n  apply (rename_tac rb' wb')\n  apply (frule_tac r = \"rb' \\<union> rc\" and w = wb' in preservation_mono(1)[rotated 3]; simp?)\n  apply (drule (1) abs_typing_frame[rotated 1]; simp?)\n   apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n    apply (rule u_t_struct; simp?)\n    apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n     apply (drule wa_abs_typing_u_elims(5))\n     apply (erule_tac x = to in allE)\n     apply (erule impE)\n      apply (metis add.commute plus_one_helper2 word_le_not_less)\n     apply clarsimp\n     apply (rule u_t_prim'; clarsimp)\n    apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n     apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (drule_tac u = obsv in uval_typing_frame(1); simp?)\n     apply (rule u_t_r_empty)\n    apply (drule_tac v = obsv in frame_noalias_uval_typing(2)[rotated 1]; simp?)\n    apply blast\n   apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n  apply clarsimp\n  apply (intro exI conjI, assumption, blast)\n  apply (rule frame_trans; simp)\n  done\n\nsection wordarray_map_no_break\n\nlemma upd_wa_mapAccumnb_bod_to_geq_len:\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [t] (Boxed Writable ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [], {}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present), (a2, v, Present)] Unboxed)]\n      \\<turnstile> (App f (Var 0)) : TRecord [(b0, t, Present), (b1, u, Present)] Unboxed;\n     distinct [a0, a1, a2]; distinct [b0, b1];\n     upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm len f u acc v obsv (\\<sigma>', res);\n     to \\<ge> len\n    \\<rbrakk> \\<Longrightarrow> upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res)\"\n  apply (induct arbitrary: rb wb\n                rule: upd_wa_mapAccumnb_bod.induct[of _ \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv \"(\\<sigma>', res)\"])\n  apply clarsimp\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (rename_tac ta)\n  apply (drule_tac x = ta in meta_spec)\n  apply (drule_tac x = len in meta_spec)\n  apply (drule_tac x = arr in meta_spec)\n  apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp)\n  apply (rename_tac \\<xi>\\<^sub>u \\<sigma> p frm f \\<tau>a acc \\<tau>o obsv \\<sigma>' res)\n  apply (clarsimp split: if_splits)\n   apply (rename_tac x x' acc' \\<sigma>a)\n   apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n   apply (rule conjI; clarsimp; simp?)\n   apply (drule_tac x = x' in meta_spec)\n   apply (drule_tac x = acc' in meta_spec)\n   apply (drule_tac x = \\<sigma>a in meta_spec)\n   apply clarsimp\n   apply (intro exI conjI, assumption)\n   apply (drule_tac r = \"rb \\<union> rc\" and w = wb in preservation_mono(1)[rotated 2]; simp?)\n    apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n     apply (rule u_t_struct; simp?)\n     apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n      apply (drule wa_abs_typing_u_elims(5))\n      apply (erule_tac x = frm in allE; clarsimp)\n      apply (rule u_t_prim'; clarsimp)\n     apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_empty)\n     apply (subst Int_commute; assumption)\n    apply (drule wa_abs_typing_u_elims(5))\n    apply (erule_tac x = frm in allE; clarsimp)\n    apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n   apply clarsimp\n   apply (rename_tac r' w')\n   apply (drule_tac x = r' in meta_spec)\n   apply (drule_tac x = w' in meta_spec)\n   apply (erule u_t_recE; clarsimp)\n   apply (erule u_t_r_consE; simp?)\n   apply (erule conjE)+\n   apply (drule_tac t= \"type_repr _\" in sym; clarsimp)\n   apply (frule tprim_no_pointers(1); clarsimp)\n   apply (frule tprim_no_pointers(2); clarsimp)\n   apply (erule u_t_r_consE; clarsimp)\n   apply (erule u_t_r_emptyE; clarsimp)\n   apply (rename_tac xa xb tb r' w')\n   apply (erule meta_impE)\n    apply (drule wa_abs_typing_u_elims(3); clarsimp)\n    apply (erule_tac x = frm in allE; clarsimp)\n    apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n   apply (erule meta_impE)\n    apply (erule u_t_primtE; clarsimp)\n    apply (drule_tac t = \"lit_type _\" in sym; clarsimp)\n    apply (drule_tac u = wb and\n                     u' = w' and\n                     \\<sigma> = \\<sigma> and\n                     \\<sigma>' = \\<sigma>a \n                     in abs_typing_frame[rotated 1]; simp?)\n    apply (drule wa_abs_typing_u_update; simp?)\n   apply (cut_tac \\<sigma> = \\<sigma>a and\n                  l = \"arr + size_of_num_type ta * frm\" and\n                  v = xa\n                  in frame_single_update)\n   apply (frule wa_abs_typing_u_elims(3); clarsimp)\n   apply (erule meta_impE)\n    apply (drule_tac u = xb and \\<sigma> = \\<sigma>a in uval_typing_frame(1); simp?)\n     apply (drule_tac p = \"arr + size_of_num_type ta * frm\" and\n                      \\<sigma> = \\<sigma>\n                      in readonly_not_in_frame; simp?; blast)\n    apply blast\n   apply (erule meta_impE)\n    apply (drule_tac u = obsv and \\<sigma> = \\<sigma> in uval_typing_frame(1); simp?)\n    apply (drule_tac u = obsv and \\<sigma> = \\<sigma>a in uval_typing_frame(1); simp?)\n    apply blast\n   apply (erule meta_impE)\n    apply (drule_tac p = p in readonly_not_in_frame; simp?)\n   apply (erule meta_impE)\n    apply blast\n   apply (erule meta_impE)\n    apply (drule_tac v = obsv in frame_noalias_uval_typing'(2); simp?)\n   apply (erule meta_impE; simp?)\n   apply (drule frame_noalias_abs_typing'(1)[rotated 1]; simp?)\n   apply blast\n  apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n  done\n\nlemma upd_wa_mapAccumnb_bod_to_geq_lenD:\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [t] (Boxed Writable ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [], {}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present), (a2, v, Present)] Unboxed)]\n      \\<turnstile> (App f (Var 0)) : TRecord [(b0, t, Present), (b1, u, Present)] Unboxed;\n     distinct [a0, a1, a2]; distinct [b0, b1];\n     upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res);\n     to \\<ge> len\n    \\<rbrakk> \\<Longrightarrow> upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm len f u acc v obsv (\\<sigma>', res)\"\n  apply (induct arbitrary: rb wb\n                rule: upd_wa_mapAccumnb_bod.induct[of _ \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv \"(\\<sigma>', res)\"])\n  apply clarsimp\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (rename_tac ta)\n  apply (drule_tac x = ta in meta_spec)\n  apply (drule_tac x = len in meta_spec)\n  apply (drule_tac x = arr in meta_spec)\n  apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp)\n  apply (rename_tac \\<xi>\\<^sub>u \\<sigma> p frm to f \\<tau>a acc \\<tau>o obsv \\<sigma>' res)\n  apply (clarsimp split: if_splits)\n   apply (rename_tac x x' acc' \\<sigma>a)\n   apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n   apply (drule_tac x = x' in meta_spec)\n   apply (drule_tac x = acc' in meta_spec)\n   apply (drule_tac x = \\<sigma>a in meta_spec)\n   apply clarsimp\n   apply (intro exI conjI, assumption)\n   apply (drule_tac r = \"rb \\<union> rc\" and w = wb in preservation_mono(1)[rotated 2]; simp?)\n    apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n     apply (rule u_t_struct; simp?)\n     apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n      apply (drule wa_abs_typing_u_elims(5))\n      apply (erule_tac x = frm in allE; clarsimp)\n      apply (rule u_t_prim'; clarsimp)\n     apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_empty)\n     apply (subst Int_commute; assumption)\n    apply (drule wa_abs_typing_u_elims(5))\n    apply (erule_tac x = frm in allE; clarsimp)\n    apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n   apply clarsimp\n   apply (rename_tac r' w')\n   apply (drule_tac x = r' in meta_spec)\n   apply (drule_tac x = w' in meta_spec)\n   apply (erule u_t_recE; clarsimp)\n   apply (erule u_t_r_consE; simp)\n   apply (erule conjE)+\n   apply (drule_tac t = \"type_repr _\" in sym; clarsimp)\n   apply (frule tprim_no_pointers(1); clarsimp)\n   apply (frule tprim_no_pointers(2); clarsimp)\n   apply (erule u_t_r_consE; clarsimp)\n   apply (erule u_t_r_emptyE; clarsimp)\n   apply (rename_tac xa xb tb r' w')\n   apply (erule meta_impE)\n    apply (drule wa_abs_typing_u_elims(3); clarsimp)\n    apply (erule_tac x = frm in allE; clarsimp)\n    apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n   apply (erule meta_impE)\n    apply (erule u_t_primtE; clarsimp)\n    apply (drule_tac t = \"lit_type _\" in sym; clarsimp)\n    apply (drule_tac u = wb and\n                     u' = w' and\n                     \\<sigma> = \\<sigma> and\n                     \\<sigma>' = \\<sigma>a \n                     in abs_typing_frame[rotated 1]; simp?)\n    apply (drule wa_abs_typing_u_update; simp?)\n   apply (cut_tac \\<sigma> = \\<sigma>a and\n                  l = \"arr + size_of_num_type ta * frm\" and\n                  v = xa \n                  in frame_single_update)\n   apply (frule wa_abs_typing_u_elims(3); clarsimp)\n   apply (erule meta_impE)\n    apply (drule_tac u = xb and \\<sigma> = \\<sigma>a in uval_typing_frame(1); simp?)\n     apply (drule_tac p = \"arr + size_of_num_type ta * frm\" and\n                      \\<sigma> = \\<sigma> \n                      in readonly_not_in_frame; simp?; blast)\n    apply blast\n   apply (erule meta_impE)\n    apply (drule_tac u = obsv and \\<sigma> = \\<sigma> in uval_typing_frame(1); simp?)\n    apply (drule_tac u = obsv and \\<sigma> = \\<sigma>a in uval_typing_frame(1); simp?)\n    apply blast\n   apply (erule meta_impE)\n    apply (drule_tac p = p in readonly_not_in_frame; simp?)\n   apply (erule meta_impE)\n    apply blast\n   apply (erule meta_impE)\n    apply (drule_tac v = obsv in frame_noalias_uval_typing'(2); simp?)\n   apply (erule meta_impE; simp?)\n   apply (drule frame_noalias_abs_typing'(1); simp?)\n   apply blast\n  apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n  apply (rule FalseE)\n  by auto\n\nlemma upd_wa_mapAccumnb_bod_back_step':\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [t] (Boxed Writable ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [], {}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present), (a2, v, Present)] Unboxed)]\n      \\<turnstile> (App f (Var 0)) : TRecord [(b0, t, Present), (b1, u, Present)] Unboxed;\n     distinct [a0, a1, a2]; distinct [b0, b1];\n     upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm (1 + to) f u acc v obsv (\\<sigma>', res);\n     len < 1 + to\n    \\<rbrakk> \\<Longrightarrow> upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res)\"\n apply (induct arbitrary: rb wb\n                rule: upd_wa_mapAccumnb_bod.induct[of _ \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv \"(\\<sigma>', res)\"])\n  apply clarsimp\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (rename_tac ta)\n  apply (drule_tac x = ta in meta_spec)\n  apply (drule_tac x = len in meta_spec)\n  apply (drule_tac x = arr in meta_spec)\n  apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp)\n  apply (rename_tac \\<xi>\\<^sub>u \\<sigma> p frm f \\<tau>a acc \\<tau>o obsv \\<sigma>' res)\n  apply (clarsimp split: if_splits)\n   apply (rename_tac x x' acc' \\<sigma>a)\n   apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n   apply (drule_tac x = x' in meta_spec)\n   apply (drule_tac x = acc' in meta_spec)\n   apply (drule_tac x = \\<sigma>a in meta_spec)\n   apply clarsimp\n   apply (rule conjI; clarsimp)\n    apply (intro exI conjI, assumption)\n    apply (drule_tac r = \"rb \\<union> rc\" and w = wb in preservation_mono(1)[rotated 2]; simp?)\n     apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n      apply (rule u_t_struct; simp?)\n      apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n       apply (drule wa_abs_typing_u_elims(5))\n       apply (erule_tac x = frm in allE; clarsimp)\n       apply (rule u_t_prim'; clarsimp)\n      apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n       apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n       apply (rule u_t_r_empty)\n      apply (subst Int_commute; assumption)\n     apply (drule wa_abs_typing_u_elims(5))\n     apply (erule_tac x = frm in allE; clarsimp)\n     apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n    apply clarsimp\n    apply (rename_tac r' w')\n    apply (drule_tac x = r' in meta_spec)\n    apply (drule_tac x = w' in meta_spec)\n    apply (erule u_t_recE; clarsimp)\n    apply (erule u_t_r_consE; simp)\n    apply (erule conjE)+\n    apply (drule_tac t = \"type_repr _\" in sym; clarsimp)\n    apply (frule tprim_no_pointers(1); clarsimp)\n    apply (frule tprim_no_pointers(2); clarsimp)\n    apply (erule u_t_r_consE; clarsimp)\n    apply (erule u_t_r_emptyE; clarsimp)\n    apply (rename_tac xa xb tb r' w')\n    apply (erule meta_impE)\n     apply (drule wa_abs_typing_u_elims(3); clarsimp)\n     apply (erule_tac x = frm in allE; clarsimp)\n     apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n    apply (erule meta_impE)\n     apply (erule u_t_primtE; clarsimp)\n     apply (drule_tac t = \"lit_type _\" in sym; clarsimp)\n     apply (drule_tac u = wb and\n                      u' = w' and\n                      \\<sigma> = \\<sigma> and\n                      \\<sigma>' = \\<sigma>a\n                      in abs_typing_frame[rotated 1]; simp?)\n     apply (drule wa_abs_typing_u_update; simp?)\n    apply (cut_tac \\<sigma> = \\<sigma>a and\n                   l = \"arr + size_of_num_type ta * frm\" and\n                   v = xa \n                   in frame_single_update)\n    apply (frule wa_abs_typing_u_elims(3); clarsimp)\n    apply (erule meta_impE)\n     apply (drule_tac u = xb and \\<sigma> = \\<sigma>a in uval_typing_frame(1); simp?)\n      apply (drule_tac p = \"arr + size_of_num_type ta * frm\" and\n                       \\<sigma> = \\<sigma> \n                       in readonly_not_in_frame; simp?; blast)\n     apply blast\n    apply (erule meta_impE)\n     apply (drule_tac u = obsv and \\<sigma> = \\<sigma> in uval_typing_frame(1); simp?)\n     apply (drule_tac u = obsv and \\<sigma> = \\<sigma>a in uval_typing_frame(1); simp?)\n     apply blast\n    apply (erule meta_impE)\n     apply (drule_tac p = p in readonly_not_in_frame; simp?)\n    apply (erule meta_impE)\n     apply blast\n    apply (erule meta_impE)\n     apply (drule_tac v = obsv in frame_noalias_uval_typing'(2); simp?)\n    apply (erule meta_impE; simp?)\n    apply (drule frame_noalias_abs_typing'(1); simp?)\n    apply blast\n   apply (rule FalseE)\n   apply (metis add.commute le_step not_less_iff_gr_or_eq)\n  apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n  apply (rule FalseE)\n  by auto\n\nlemma upd_wa_mapAccumnb_bod_back_step:\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [TPrim (Num ta)] (Boxed Writable ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [], {}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present), (a2, v, Present)] Unboxed)]\n      \\<turnstile> (App f (Var 0)) : TRecord [(b0, t, Present), (b1, u, Present)] Unboxed;\n     distinct [a0, a1, a2]; distinct [b0, b1];\n     upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm (1 + to) f u acc v obsv (\\<sigma>''', res');\n     1 + to \\<le> len; frm < 1 + to\n    \\<rbrakk> \\<Longrightarrow> \\<exists>\\<sigma>' \\<sigma>'' res racc racc' x x' rp. upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res)\n      \\<and> res = URecord [(rp, uval_repr rp), (racc, type_repr u)] None\n      \\<and> \\<sigma>' (arr + size_of_num_type ta * to) = option.Some x\n      \\<and> (\\<xi>\\<^sub>u, [URecord [(x, RPrim (Num ta)), (racc, type_repr u),\n          (obsv, type_repr v)] None]  \\<turnstile> (\\<sigma>', App f (Var 0)) \\<Down>! \n          (\\<sigma>'', URecord [(x', RPrim (Num ta)), (racc', type_repr u)] None))\n      \\<and> res' = URecord [(rp, uval_repr rp), (racc', type_repr u)] None\n      \\<and> \\<sigma>''' = \\<sigma>''(arr + size_of_num_type ta * to \\<mapsto> x')\n      \\<and> rp = UPtr p (RCon ''WordArray'' [type_repr t])\"\n  apply (induct arbitrary: \\<sigma>''' res' rb wb\n                rule: upd_wa_mapAccumnb_bod.induct[of _ \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv \"(\\<sigma>''', res')\"])\n  apply clarsimp\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (drule_tac x = ta in meta_spec)\n  apply (drule_tac x = len in meta_spec)\n  apply (drule_tac x = arr in meta_spec)\n  apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp)\n  apply (rename_tac \\<xi>\\<^sub>u \\<sigma> p frm f \\<tau>a acc \\<tau>o obsv \\<sigma>''' res')\n  apply (clarsimp split: if_splits)\n   apply (rename_tac x x' acc' \\<sigma>a)\n   apply (drule_tac x = x' in meta_spec)\n   apply (drule_tac x = acc' in meta_spec)\n   apply (drule_tac x = \\<sigma>a in meta_spec)\n   apply (drule_tac x = \\<sigma>''' in meta_spec)\n   apply (drule_tac x = res' in meta_spec)\n   apply clarsimp\n   apply (drule_tac r = \"rb \\<union> rc\" and w = wb in preservation_mono(1)[rotated 2]; simp?)\n    apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n     apply (rule u_t_struct; simp?)\n     apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n      apply (drule wa_abs_typing_u_elims(5))\n      apply (erule_tac x = frm in allE; clarsimp)\n      apply (rule u_t_prim'; clarsimp)\n     apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_empty)\n     apply (subst Int_commute; assumption)\n    apply (drule wa_abs_typing_u_elims(5))\n    apply (erule_tac x = frm in allE; clarsimp)\n    apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n   apply clarsimp\n   apply (rename_tac r' w')\n   apply (drule_tac x = r' in meta_spec)\n   apply (drule_tac x = w' in meta_spec)\n   apply (erule u_t_recE; clarsimp)\n   apply (erule u_t_r_consE; simp)\n   apply (erule conjE)+\n   apply (drule_tac t = \"type_repr _\" in sym; clarsimp)\n   apply (frule tprim_no_pointers(1); clarsimp)\n   apply (frule tprim_no_pointers(2); clarsimp)\n   apply (erule u_t_r_consE; clarsimp)\n   apply (erule u_t_r_emptyE; clarsimp)\n   apply (rename_tac x' acc' tb r' w')\n   apply (case_tac \"frm < to\"; clarsimp)\n    apply (erule meta_impE)\n     apply (drule wa_abs_typing_u_elims(3); clarsimp)\n     apply (erule_tac x = frm in allE; clarsimp)\n     apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n    apply (erule meta_impE)\n     apply (erule u_t_primtE; clarsimp)\n     apply (drule_tac t = \"lit_type _\" in sym; clarsimp)\n     apply (drule_tac u = wb and\n                      u' = w' and\n                      \\<sigma> = \\<sigma> and\n                      \\<sigma>' = \\<sigma>a \n                      in abs_typing_frame[rotated 1]; simp?)\n     apply (drule wa_abs_typing_u_update; simp?)\n    apply (cut_tac \\<sigma> = \\<sigma>a and\n      l = \"arr + size_of_num_type ta * frm\" and\n      v = x' in frame_single_update)\n    apply (frule wa_abs_typing_u_elims(3); clarsimp)\n    apply (erule meta_impE)\n     apply (drule_tac u = acc' and \\<sigma> = \\<sigma>a in uval_typing_frame(1); simp?)\n      apply (drule_tac p = \"arr + size_of_num_type ta * frm\" and\n                       \\<sigma> = \\<sigma> \n                       in readonly_not_in_frame; simp?; blast)\n     apply blast\n    apply (erule meta_impE)\n     apply (drule_tac u = obsv and \\<sigma> = \\<sigma> in uval_typing_frame(1); simp?)\n     apply (drule_tac u = obsv and \\<sigma> = \\<sigma>a in uval_typing_frame(1); simp?)\n     apply blast\n    apply (erule meta_impE)\n     apply (drule_tac p = p in readonly_not_in_frame; simp?)\n    apply (erule meta_impE)\n     apply blast\n    apply (erule meta_impE)\n     apply (drule_tac v = obsv in frame_noalias_uval_typing'(2); simp?)\n    apply (erule meta_impE)\n     apply (drule frame_noalias_abs_typing'(1); simp?)\n     apply blast\n    apply (erule meta_impE)\n     apply (metis (no_types, hide_lams) add.commute inc_le plus_le_left_cancel_wrap word_le_less_eq word_le_not_less word_plus_strict_mono_right)\n    apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n    apply (intro exI conjI; simp?)\n   apply (clarsimp simp: not_less_iff_gr_or_eq)\n   apply (erule disjE; clarsimp?)\n    apply (rule FalseE)\n    apply (metis add.commute inc_le not_less)\n   apply (cut_tac a = 1 and b = to in add.commute)\n   apply (drule wa_abs_typing_u_elims(3); clarsimp)\n   apply (erule_tac x = to in allE; clarsimp)\n   apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n   apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp)\n   apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n   apply (intro exI conjI; simp?)\n  apply (rule FalseE)\n  by auto\n\nlemma word_set_compr_helper: \n  \"(c :: ('a :: len8) word) < 1 + e \\<Longrightarrow>\n    {a + b * i | i. i < c \\<and> d \\<le> i \\<and> i < e} = {a + b * i | i. i < c \\<and> d \\<le> i \\<and> i < 1 + e}\"\n  apply (rule equalityI)\n   apply (rule subsetI; clarsimp)\n   apply (rule_tac x = i in exI; simp)\n  apply (rule subsetI; clarsimp)\n  apply (rule_tac x = i in exI; simp)\n  by (metis add.commute inc_le word_le_less_eq word_le_not_less)\n\nlemma word_set_compr_helper2: \n  \"(e :: ('a :: len8) word) \\<le> d \\<Longrightarrow>\n    {a + b * i | i. i < c \\<and> d \\<le> i \\<and> i < e} = {}\"\n  by auto\n\nlemma word_set_compr_helper3: \n  \"\\<lbrakk>1 + (e::('a::len8) word) \\<noteq> 0; 1 + e \\<le> c; d < 1 + e; \\<forall>i < c. \\<forall>j < c. i = j \\<longleftrightarrow> b * i = b * j\\<rbrakk> \\<Longrightarrow>\n    insert (a + b * e) {a + b * i | i. i < c \\<and> d \\<le> i \\<and> i < e} = {a + b * i | i. i < c \\<and> d \\<le> i \\<and> i < 1 + e}\"\n  apply (rule equalityI)\n   apply (drule unatSuc)\n   apply (rule subsetI; clarsimp simp: word_le_nat_alt word_less_nat_alt)\n   apply (erule disjE)\n    apply (rule_tac x = e in exI; clarsimp)\n   apply clarsimp\n   apply (rename_tac i)\n   apply (rule_tac x = i in exI; clarsimp)\n  apply (rule subsetI; clarsimp)\n  apply (rename_tac i)\n  apply (erule_tac x = i in allE; clarsimp)\n  apply (erule_tac x = i in allE; clarsimp)\n  apply (erule_tac x = e in allE)\n  apply (erule impE)\n   apply (drule unatSuc; clarsimp simp: word_le_nat_alt word_less_nat_alt)\n  apply clarsimp\n  apply (clarsimp simp: not_less)\n  apply (subgoal_tac \"i = e\", clarsimp)\n  apply (thin_tac \"i \\<noteq> e\")\n  apply (thin_tac \"b * i \\<noteq> b * e\")\n  apply (drule unatSuc; clarsimp simp: word_le_nat_alt word_less_nat_alt)\n  apply (subst unat_arith_simps(3))\n  apply unat_arith\n  done\n\nlemma upd_wa_mapAccumnb_bod_preservation:\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' \\<tau>s (Boxed Writable ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb; p \\<notin> rb; p \\<notin> rc;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [], {}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present), (a2, v, Present)] Unboxed)]\n      \\<turnstile> (App f (Var 0)) : TRecord [(b0, t, Present), (b1, u, Present)] Unboxed;\n     distinct [a0, a1, a2]; distinct [b0, b1];\n     upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv (\\<sigma>', res)\n  \\<rbrakk> \\<Longrightarrow> \\<exists>rp ta racc r' w'. \n      res = URecord [(rp, uval_repr rp), (racc, type_repr u)] None\n    \\<and> rp = UPtr p (RCon ''WordArray'' [type_repr t])\n    \\<and> t = TPrim (Num ta)\n    \\<and> wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' \\<tau>s (Boxed Writable ptrl) ra wa \\<sigma>'\n    \\<and> uval_typing \\<Xi>' \\<sigma>' racc u r' w'\n    \\<and> r' \\<subseteq> rb \\<union> rc\n    \\<and> (insert p wa) \\<inter> r' = {}\n    \\<and> (insert p wa) \\<inter> w' = {}\n    \\<and> ra \\<inter> w' = {}\n    \\<and> frame \\<sigma> ({arr + size_of_num_type ta * i | i. i < len \\<and> frm \\<le> i \\<and> i < to } \\<union> wb) \\<sigma>' \n        ({arr + size_of_num_type ta * i | i. i < len \\<and> frm \\<le> i \\<and> i < to } \\<union> w')\"\n  apply (induct to arbitrary: \\<sigma>' res)\n   apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp)\n   apply (rule_tac x = rb in exI)\n   apply (rule_tac x = wb in exI)\n   apply (clarsimp simp: frame_id)\n   apply blast\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (rename_tac ta)\n  apply (case_tac \"len < 1 + to\")\n   apply (drule_tac ptrl = ptrl and\n                      ra = ra and\n                      wa = wa and\n                      rb = rb and\n                      wb = wb and\n                      rc = rc \n                    in upd_wa_mapAccumnb_bod_back_step'[rotated -2]; simp?)\n   apply (elim meta_allE meta_impE; simp?)\n   apply clarsimp\n   apply (rename_tac racc r' w')\n   apply (rule_tac x = r' in exI)\n   apply (rule_tac x = w' in exI)\n   apply (clarsimp simp: word_set_compr_helper)\n  apply (case_tac \"1 + to \\<le> frm\")\n   apply (frule_tac y = \"1 + to\" and x = frm in leD)\n   apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp)\n   apply (rule_tac x = rb in exI)\n   apply (rule_tac x = wb in exI)\n   apply (clarsimp simp: frame_id word_set_compr_helper2)\n   apply blast\n  apply (drule_tac ptrl = ptrl and\n                     ra = ra and\n                     wa = wa and\n                     rb = rb and\n                     wb = wb and\n                     rc = rc \n                   in upd_wa_mapAccumnb_bod_back_step[rotated -3]; simp?)\n  apply clarsimp\n  apply (elim meta_allE meta_impE, assumption)\n  apply clarsimp\n  apply (rename_tac \\<sigma>'' \\<sigma>''' racc racc' x x' r' w')\n  apply (drule wa_abs_typing_u_elims(5))\n  apply (drule_tac r = \"r' \\<union> rc\" and w = w' in preservation_mono(1)[rotated 3]; simp?)\n   apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n    apply (rule u_t_struct; simp?)\n    apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n     apply (drule wa_abs_typing_u_elims(5))\n     apply (erule_tac x = to in allE; clarsimp)\n     apply (erule impE)\n      apply (drule unatSuc; clarsimp simp: word_less_nat_alt word_le_nat_alt)\n     apply clarsimp\n     apply (rule u_t_prim'; clarsimp)\n    apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n     apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (drule_tac u = obsv in uval_typing_frame(1); simp?)\n      apply (drule wa_abs_typing_u_elims(3); clarsimp)\n      apply blast\n     apply (rule u_t_r_empty)\n    apply (frule_tac v = obsv in frame_noalias_uval_typing'(2); (simp add: Int_Un_distrib)?; clarsimp?)\n     apply (drule wa_abs_typing_u_elims(3); clarsimp)\n     apply blast\n    apply (subst Int_commute; blast)\n   apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n  apply clarsimp\n  apply (rename_tac r'' w'')\n  apply (erule u_t_recE; clarsimp)\n  apply (erule u_t_r_consE; simp)+\n  apply (erule conjE)+\n  apply (drule_tac t = \"type_repr _\" in sym; clarsimp)\n  apply (erule u_t_r_emptyE; clarsimp)\n  apply (erule u_t_primtE; clarsimp)\n  apply (drule_tac t = \"lit_type _\" in sym)\n  apply clarsimp\n  apply (rename_tac racc' r'' w'' l)\n  apply (rule conjI)\n   apply (rule wa_abs_typing_u_update; simp?)\n    apply (frule_tac u = w' and u' = w'' in abs_typing_frame; simp?)\n   apply (drule unatSuc; clarsimp simp: word_less_nat_alt word_le_nat_alt)\n  apply (cut_tac \\<sigma> = \\<sigma>''' and\n                 l = \"arr + size_of_num_type ta * to\" and\n                 v = \"UPrim l\" \n                 in frame_single_update)\n  apply (rule_tac x = r'' in exI)\n  apply (rule_tac x = w'' in exI)\n  apply (rule conjI)\n   apply (drule_tac u = racc' in uval_typing_frame(1)[rotated 3]; simp?)\n    apply (drule_tac p = \"arr + size_of_num_type ta * to\" and \\<sigma> = \\<sigma>'' in readonly_not_in_frame; simp?)\n    apply (rule_tac S = wa in orthD1; simp?)\n    apply (drule wa_abs_typing_u_elims(3); clarsimp)\n    apply (intro exI conjI, simp)\n    apply (drule unatSuc; clarsimp simp: word_less_nat_alt word_le_nat_alt)\n   apply simp\n   apply (rule contra_subsetD; simp?)\n   apply simp\n   apply (drule wa_abs_typing_u_elims(3); clarsimp)\n   apply (rule conjI)\n    apply (rule_tac S = wa in orthD1; simp?)\n    apply (intro exI conjI, simp)\n    apply (drule unatSuc; clarsimp simp: word_less_nat_alt word_le_nat_alt)\n   apply (rule_tac S' = wa in orthD2; simp?)\n   apply (intro exI conjI, simp)\n   apply (drule unatSuc; clarsimp simp: word_less_nat_alt word_le_nat_alt)\n  apply (intro conjI)\n        apply clarsimp\n        apply (rename_tac x)\n        apply (drule_tac A = r'' and B = \"r' \\<union> rc\" and c = x in subsetD; simp)\n        apply (drule_tac A = r' and B = \"rb \\<union> rc\" and c = x in subsetD; simp)\n       apply clarsimp\n       apply (drule_tac A = r'' and B = \"r' \\<union> rc\" and c = p in subsetD; simp)\n      apply (rule disjointI)\n      apply (rename_tac x y)\n      apply (drule_tac A = r'' and B = \"r' \\<union> rc\" and c = y in subsetD; simp)\n      apply (rule disjE; blast)\n     apply (frule wa_abs_typing_u_elims(3); clarsimp)\n     apply (drule_tac p = p and \\<sigma> = \\<sigma> in valid_ptr_not_in_frame_same; simp?)\n      apply (drule unatSuc; clarsimp simp: word_less_nat_alt word_le_nat_alt)\n     apply (drule_tac p = p and w = w' in readonly_not_in_frame; simp?)\n    apply (rule disjointI)\n    apply (rename_tac x y)\n    apply (frule wa_abs_typing_u_elims(5))\n    apply (frule wa_abs_typing_u_elims(3); clarsimp)\n    apply (rename_tac i)\n    apply (erule_tac x = i in allE; clarsimp)+\n    apply (drule_tac p = \"arr + size_of_num_type ta * i\" and \\<sigma> = \\<sigma>'' in readonly_not_in_frame; simp?)\n    apply (drule_tac x = \"arr + size_of_num_type ta * i\" and S' = w' in orthD1; simp?)\n    apply (intro exI conjI; simp)\n   apply (drule wa_abs_typing_u_elims(3); clarsimp)\n  apply (drule_tac s = \"{arr + size_of_num_type ta * i |i. i < len \\<and> frm \\<le> i \\<and> i < 1 + to}\" and\n      \\<sigma> = \\<sigma>''' in frame_expand(2); simp?)\n   apply (drule_tac u = w' and u' = w'' in abs_typing_frame[rotated 1]; simp?)\n   apply (drule wa_abs_typing_u_elims(5); clarsimp)\n   apply (rename_tac i)\n   apply (erule_tac x = i in allE; clarsimp)+\n  apply (drule_tac s = \"{arr + size_of_num_type ta * i |i. i < len \\<and> frm \\<le> i \\<and> i < 1 + to}\" and \n      \\<sigma> = \\<sigma>'' in frame_expand(2); simp?)\n   apply (frule wa_abs_typing_u_elims(5); clarsimp)\n   apply (rename_tac i)\n   apply (erule_tac x = i in allE; clarsimp)+\n  apply (drule_tac p = \"arr + size_of_num_type ta * to\" and \\<sigma> = \\<sigma> in frame_expand(1))\n   apply (erule_tac x = to in allE; clarsimp)\n   apply (drule unatSuc; clarsimp simp: word_less_nat_alt word_le_nat_alt)  \n  apply (subst (asm) Un_insert_left[symmetric])\n  apply (subst (asm) word_set_compr_helper3; simp?)\n   apply (drule distinct_indices; simp?)\n  apply (subst (asm) Un_insert_left[symmetric])\n  apply (subst (asm) word_set_compr_helper3; simp?)\n   apply (drule distinct_indices; simp?)\n  apply (drule unatSuc; clarsimp simp: word_less_nat_alt word_le_nat_alt)\n  apply (subst (asm) insert_absorb, clarsimp)\n   apply (intro exI conjI; simp?; unat_arith?; simp?)\n  apply (subst (asm) insert_absorb, clarsimp)\n   apply (intro exI conjI; simp?; unat_arith?; simp?)\n  apply (drule_tac \\<sigma> = \\<sigma> and \\<sigma>' = \\<sigma>'' and \\<sigma>'' = \\<sigma>''' in frame_trans; simp?)\n  apply (drule_tac s = w'' in frame_expand(2))\n   apply clarsimp\n   apply (rename_tac pa)\n   apply (drule_tac p = pa and u = racc' in uval_typing_valid(1)[rotated 1]; simp?)\n  apply (erule frame_trans; simp?)\n  apply (clarsimp simp: Un_commute)\n  done\n\nlemma upd_wa_mapAccumnb_bod_step:\n  \"\\<lbrakk> proc_ctx_wellformed \\<Xi>';\n     proc_env_matches_ptrs \\<xi>\\<^sub>u \\<Xi>';\n     \\<sigma> p = option.Some (UAbstract (UWA t len arr));\n     wa_abs_typing_u \\<Xi>' (UWA t len arr) ''WordArray'' [TPrim (Num ta)] (Boxed Writable ptrl) ra wa \\<sigma>;\n     uval_typing \\<Xi>' \\<sigma> acc u rb wb;\n     uval_typing \\<Xi>' \\<sigma> obsv v rc {};\n     p \\<notin> wa; p \\<notin> wb; p \\<notin> rb; p \\<notin> rc;\n     ra \\<inter> wb = {}; \n     rb \\<inter> wa = {}; \n     rc \\<inter> wa = {}; rc \\<inter> wb = {};\n     wa \\<inter> wb = {};\n     \\<Xi>', 0, [], {}, [option.Some (TRecord [(a0, t, Present), (a1, u, Present), (a2, v, Present)] Unboxed)]\n      \\<turnstile> (App f (Var 0)) : TRecord [(b0, t, Present), (b1, u, Present)] Unboxed;\n     distinct [a0, a1, a2]; distinct [b0, b1];\n     upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv\n      (\\<sigma>', URecord [(rp, uval_repr rp), (racc, type_repr u)] None); \n     rp = UPtr p (RCon ''WordArray'' [type_repr t]) ;\n     \\<sigma>' (arr + size_of_num_type ta * to) = option.Some va;\n     (\\<xi>\\<^sub>u, [URecord [(va, RPrim (Num ta)), (racc, type_repr u),\n      (obsv, type_repr v)] None] \\<turnstile> (\\<sigma>', App f (Var 0)) \\<Down>!\n      (\\<sigma>'', URecord [(va', RPrim (Num ta)), (racc', type_repr u)] None));\n     frm \\<le> to; to < len\n    \\<rbrakk> \\<Longrightarrow> upd_wa_mapAccumnb_bod \\<xi>\\<^sub>u \\<sigma> p frm (to + 1) f u acc v obsv\n        (\\<sigma>''(arr + size_of_num_type ta * to \\<mapsto> va'),\n        URecord [(rp, uval_repr rp), (racc', type_repr u)] None)\"\n    apply (induct arbitrary: \\<sigma>' racc rb wb\n                rule: upd_wa_mapAccumnb_bod.induct[of _ \\<xi>\\<^sub>u \\<sigma> p frm to f u acc v obsv \"(\\<sigma>',  URecord [(rp, uval_repr rp), (racc, type_repr u)] None)\"])\n  apply clarsimp\n  apply (drule_tac x = ta in meta_spec)\n  apply (drule_tac x = len in meta_spec)\n  apply (drule_tac x = arr in meta_spec)\n  apply (erule upd_wa_mapAccumnb_bod.elims; clarsimp split: if_splits)\n  apply (rename_tac \\<xi>\\<^sub>u \\<sigma> p frm to f \\<tau>a acc \\<tau>o obsv \\<sigma>' tb)\n  apply (erule impE)\n   apply (clarsimp simp: word_le_nat_alt word_less_nat_alt)\n  apply (frule wa_abs_typing_u_elims(1); clarsimp)\n  apply (case_tac \"frm < to\"; clarsimp)\n   apply (frule_tac a = frm and b = to in order.strict_implies_not_eq; clarsimp)\n   apply (frule_tac a = frm and b = to and c = len in order.strict_trans; clarsimp)\n   apply (rename_tac vb v' acc' \\<sigma>''')\n   apply (drule_tac x = v' in meta_spec)\n   apply (drule_tac x = acc' in meta_spec)\n   apply (drule_tac x = \\<sigma>''' in meta_spec)\n   apply (drule_tac x = \\<sigma>' in meta_spec)\n   apply (drule_tac x = racc in meta_spec)\n   apply clarsimp\n   apply (drule_tac r = \"rb \\<union> rc\" and\n                    w = wb and\n                    \\<gamma> = \"[URecord [(vb, RPrim (Num ta)), (acc, type_repr \\<tau>a),\n                          (obsv, type_repr \\<tau>o)] None]\"\n                    in preservation_mono(1); simp?)\n    apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n     apply (rule u_t_struct; simp?)\n     apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n      apply (drule wa_abs_typing_u_elims(5))\n      apply (erule_tac x = frm in allE; clarsimp)\n      apply (rule u_t_prim'; clarsimp)\n     apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_empty)\n     apply (subst Int_commute; assumption)\n    apply (drule wa_abs_typing_u_elims(5))\n    apply (erule_tac x = frm in allE; clarsimp)\n    apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n   apply clarsimp\n   apply (rename_tac r' w')\n   apply (drule_tac x = r' in meta_spec)\n   apply (drule_tac x = w' in meta_spec)\n   apply (erule meta_impE)\n    apply (drule wa_abs_typing_u_elims(3); clarsimp)\n    apply (rule conjI; clarsimp)\n    apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n   apply (erule u_t_recE; clarsimp)\n   apply (erule u_t_r_consE; simp)\n   apply (erule conjE)+\n   apply (drule_tac t = \"type_repr _\" in sym; clarsimp)\n   apply (erule u_t_primtE; clarsimp)\n   apply (drule_tac t = \"lit_type _\"  in sym; clarsimp)\n   apply (erule meta_impE)\n    apply (drule (1) abs_typing_frame; simp?)\n    apply (rule wa_abs_typing_u_update; simp?)\n   apply (rename_tac l)\n   apply (frule_tac u = obsv and ?w1.0 = wb in uval_typing_frame(1)[rotated -1]; simp?)\n   apply (drule_tac u = obsv and\n      \\<sigma> = \\<sigma>''' and\n      l1 = \"arr + size_of_num_type ta * frm\" and \n      v1 = \"UPrim l\" in uval_typing_frame(1)[OF frame_single_update, rotated -1]; simp?)\n    apply (drule wa_abs_typing_u_elims(3))\n    apply (rule_tac S' = wa in orthD2; clarsimp)\n    apply (intro exI conjI, simp, clarsimp simp: word_le_nat_alt word_less_nat_alt)\n   apply (erule u_t_r_consE; clarsimp)\n   apply (erule u_t_r_emptyE; clarsimp)\n   apply (rename_tac acc' tb r' w')\n   apply (frule wa_abs_typing_u_elims(3))\n   apply (drule_tac u = acc' and \n      l1 = \"arr + size_of_num_type ta * frm\" and \n      v1 = \"UPrim l\" in uval_typing_frame(1)[OF frame_single_update, rotated -1]; simp?)\n     apply (rule_tac \\<sigma> = \\<sigma> in readonly_not_in_frame; simp?)\n     apply (rule_tac S' = wa in orthD2; clarsimp simp: Int_commute)\n     apply (intro exI conjI, simp, clarsimp simp: word_le_nat_alt word_less_nat_alt)\n    apply (erule contra_subsetD; simp?)\n    apply (rule conjI)\n     apply (rule_tac S' = wa in orthD2; clarsimp)\n     apply (intro exI conjI, simp, clarsimp simp: word_le_nat_alt word_less_nat_alt)\n    apply (rule_tac S' = wa in orthD2; clarsimp)\n    apply (intro exI conjI, simp, clarsimp simp: word_le_nat_alt word_less_nat_alt)\n   apply (erule meta_impE)\n    apply (rule_tac \\<sigma> = \\<sigma> in readonly_not_in_frame; simp?)\n   apply (erule meta_impE)\n    apply (erule contra_subsetD; simp?)\n   apply (erule meta_impE)\n    apply clarsimp\n    apply (erule disjoint_subset; simp?)\n    apply (clarsimp simp: Int_Un_distrib2)\n   apply (erule meta_impE)\n    apply (frule_tac v = obsv in frame_noalias_uval_typing'(2); simp?)\n   apply (erule meta_impE)\n    apply (rule disjointI)\n    apply (rename_tac x y)\n    apply clarsimp\n    apply (rename_tac i)\n    apply (drule wa_abs_typing_u_elims(5))\n    apply (erule_tac x = i in allE; clarsimp)+\n    apply (drule_tac p = \"arr + size_of_num_type ta * i\" in readonly_not_in_frame; simp?)\n    apply (rule_tac S = wa and S' = wb in orthD1; simp?)\n    apply (intro exI conjI; simp)\n   apply (erule meta_impE)\n    apply (meson inc_le word_le_less_eq)\n   apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)  \n   apply (rule conjI; clarsimp)\n    apply (rule_tac x = \"UPrim l\" in exI)\n    apply (rule_tac x = acc' in exI)\n    apply (rule_tac x = \\<sigma>''' in exI)\n    apply (rule conjI; simp)\n   apply (rule FalseE)\n   apply (simp add: less_is_non_zero_p1 plus_one_helper2)\n  apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n  apply (rule conjI; clarsimp)\n   apply (intro exI conjI, simp)\n   apply (subst upd_wa_mapAccumnb_bod.simps; clarsimp)\n   apply (frule wa_abs_typing_u_elims(3))\n   apply (rule conjI; clarsimp)\n   apply (drule_tac r = \"rb \\<union> rc\" and\n                    w = wb and\n                    \\<gamma> = \"[URecord [(va, RPrim (Num ta)), (acc, type_repr \\<tau>a),\n                          (obsv, type_repr \\<tau>o)] None]\"\n                    in preservation_mono(1); simp?)\n    apply (rule matches_ptrs_some[where r' = \"{}\" and w' = \"{}\", simplified])\n     apply (rule u_t_struct; simp?)\n     apply (rule u_t_r_cons1[where r = \"{}\" and w = \"{}\", simplified]; simp?)\n      apply (drule wa_abs_typing_u_elims(5))\n      apply (erule_tac x = to in allE; clarsimp)+\n      apply (rule u_t_prim'; clarsimp)\n     apply (rule u_t_r_cons1[where r' = rc and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_cons1[where r' = \"{}\" and w' = \"{}\", simplified]; simp?)\n      apply (rule u_t_r_empty)\n     apply (subst Int_commute; assumption)\n    apply (drule wa_abs_typing_u_elims(5))\n    apply (erule_tac x = to in allE; clarsimp)+\n    apply (rule matches_ptrs_empty[where \\<tau>s = \"[]\" and \\<epsilon>= \"[]\", simplified])\n   apply clarsimp\n   apply (drule_tac p = p in valid_ptr_not_in_frame_same; simp?)\n   apply (intro exI, assumption)\n  apply (rule FalseE)\n  apply (meson less_is_non_zero_p1 word_overflow)\n  done\n\nend (* of context *)\n\nend", "meta": {"author": "zilinc", "repo": "popl23-artefact", "sha": "1fe1490d2d34f93dc01ada940c160477db3b9b72", "save_path": "github-repos/isabelle/zilinc-popl23-artefact", "path": "github-repos/isabelle/zilinc-popl23-artefact/popl23-artefact-1fe1490d2d34f93dc01ada940c160477db3b9b72/arrays/sum-example/WordArray_Update.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307806984443, "lm_q2_score": 0.48438008427698437, "lm_q1q2_score": 0.3085650232417456}}
{"text": "(*  Title:      AF_Stream_Exec.thy\n    Date:       Dec 2006\n    Author:     David Trachtenherz\n*)\n\nsection \\<open>Processing of message streams\\<close>\n\ntheory AF_Stream_Exec\nimports AF_Stream \"List-Infinite.ListInf_Prefix\" \"List-Infinite.SetIntervalStep\"\nbegin\n\nsubsection \\<open>Executing components with state transition functions\\<close>\n\nsubsubsection \\<open>Basic definitions\\<close>\n\ntext \\<open>\n  Function type for functions converting\n  an input value to an input port message for a component\\<close>\ntype_synonym ('a, 'in) Port_Input_Value = \"'a \\<Rightarrow> 'in message_af\"\n\ntext \\<open>\n  Function type for functions extracting\n  the output value of a single output port from\n  a component value\\<close>\ntype_synonym ('comp, 'out) Port_Output_Value = \"'comp \\<Rightarrow> 'out message_af\"\n\ntext \\<open>\n  Function type for functions extracting\n  the local state of a component from\n  a component value\\<close>\ntype_synonym ('comp, 'state) Comp_Local_State = \"'comp \\<Rightarrow> 'state\"\n\ntext \\<open>\n  Function type for transition functions\n  computing the component's value after processing\n  an input for a single time unit\\<close>\ntype_synonym ('comp, 'input) Comp_Trans_Fun = \"'input \\<Rightarrow> 'comp \\<Rightarrow> 'comp\"\n\n\n\\<comment> \\<open>Execute a component for all inputs in the input stream @{typ \"'input list\"}\\<close>\nprimrec f_Exec_Comp :: \"('comp, 'input) Comp_Trans_Fun \\<Rightarrow> 'input list \\<Rightarrow> 'comp \\<Rightarrow> 'comp\"\nwhere\n  f_Exec_Nil:  \"f_Exec_Comp trans_fun [] c = c\"\n| f_Exec_Cons: \"f_Exec_Comp trans_fun (x#xs) c = f_Exec_Comp trans_fun xs (trans_fun x c)\"\n\n\\<comment> \\<open>Execute the component for at most n steps\\<close>\ndefinition f_Exec_Comp_N :: \"('comp, 'input) Comp_Trans_Fun \\<Rightarrow> nat \\<Rightarrow> 'input list \\<Rightarrow> 'comp \\<Rightarrow> 'comp\"\n  where \"f_Exec_Comp_N trans_fun n xs c \\<equiv> f_Exec_Comp trans_fun (xs \\<down> n) c\"\n\n\\<comment> \\<open>Produce the component stream for all inputs in the input stream\\<close>\nprimrec f_Exec_Comp_Stream :: \"('comp, 'input) Comp_Trans_Fun \\<Rightarrow> 'input list \\<Rightarrow> 'comp \\<Rightarrow> 'comp list\"\nwhere\n  f_Exec_Stream_Nil:  \"f_Exec_Comp_Stream trans_fun [] c = []\"\n| f_Exec_Stream_Cons: \"f_Exec_Comp_Stream trans_fun (x # xs) c =\n    (trans_fun x c) # ( f_Exec_Comp_Stream trans_fun xs (trans_fun x c) )\"\n\nprimrec f_Exec_Comp_Stream_Init ::\n  \"('comp, 'input) Comp_Trans_Fun \\<Rightarrow> 'input list \\<Rightarrow> 'comp \\<Rightarrow> 'comp list\"\nwhere\n  f_Exec_Stream_Init_Nil:  \"f_Exec_Comp_Stream_Init trans_fun [] c = [c]\"\n| f_Exec_Stream_Init_Cons: \"f_Exec_Comp_Stream_Init trans_fun (x # xs) c =\n    c # ( f_Exec_Comp_Stream_Init trans_fun xs (trans_fun x c) )\"\n\ndefinition i_Exec_Comp_Stream ::\n    \"('comp, 'input) Comp_Trans_Fun \\<Rightarrow> 'input ilist \\<Rightarrow> 'comp \\<Rightarrow> 'comp ilist\"\n  where \"i_Exec_Comp_Stream \\<equiv> \\<lambda>trans_fun input c n. f_Exec_Comp trans_fun (input \\<Down> Suc n) c\"\n\ndefinition i_Exec_Comp_Stream_Init ::\n    \"('comp, 'input) Comp_Trans_Fun \\<Rightarrow> 'input ilist \\<Rightarrow> 'comp \\<Rightarrow> 'comp ilist\"\n  where \"i_Exec_Comp_Stream_Init \\<equiv> \\<lambda>trans_fun input c n. f_Exec_Comp trans_fun (input \\<Down> n) c\"\n\n\nsubsubsection \\<open>Basic results\\<close>\n\nlemma f_Exec_one: \"f_Exec_Comp trans_fun [m] c = trans_fun m c\"\nby simp\n\nlemma f_Exec_Stream_length[rule_format, simp]:\"\n  \\<forall>c. length (f_Exec_Comp_Stream trans_fun xs c) = length xs\"\nby (induct xs, simp_all)\n\nlemma f_Exec_Stream_empty_conv:\"\n  (f_Exec_Comp_Stream trans_fun xs c = []) = (xs = [])\"\nby (simp add: length_0_conv[symmetric] del: length_0_conv)\n\nlemma f_Exec_Stream_not_empty_conv:\"\n  (f_Exec_Comp_Stream trans_fun xs c \\<noteq> []) = (xs \\<noteq> [])\"\nby (simp add: f_Exec_Stream_empty_conv)\n\nlemma f_Exec_eq_f_Exec_Stream_last[rule_format]:\"\n  \\<forall>c. f_Exec_Comp trans_fun xs c = last (c # (f_Exec_Comp_Stream trans_fun xs c))\"\nby (induct xs, simp_all)\n\ncorollary f_Exec_eq_f_Exec_Stream_last2[rule_format]: \"\n  xs \\<noteq> [] \\<Longrightarrow>\n  f_Exec_Comp trans_fun xs c = last (f_Exec_Comp_Stream trans_fun xs c)\"\nby (simp add: f_Exec_eq_f_Exec_Stream_last f_Exec_Stream_empty_conv[symmetric, of xs trans_fun c])\n\ncorollary f_Exec_eq_f_Exec_Stream_last_if: \"\n  f_Exec_Comp trans_fun xs c = (if xs = [] then c else last (f_Exec_Comp_Stream trans_fun xs c))\"\nby (simp add: f_Exec_eq_f_Exec_Stream_last2)\n\ncorollary f_Exec_take_eq_last_f_Exec_Stream_take:\"\n  \\<lbrakk> xs \\<noteq> []; 0 < n \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp trans_fun (xs \\<down> n) c =\n  last (f_Exec_Comp_Stream trans_fun (xs \\<down> n) c)\"\nby (simp add: f_Exec_eq_f_Exec_Stream_last2 take_not_empty_conv)\n\ncorollary f_Exec_N_eq_last_f_Exec_Stream_take:\"\n  \\<lbrakk> xs \\<noteq> []; 0 < n \\<rbrakk> \\<Longrightarrow>\n    f_Exec_Comp_N trans_fun n xs c =\n    last (f_Exec_Comp_Stream trans_fun (xs \\<down> n) c)\"\nby (simp add: f_Exec_Comp_N_def f_Exec_take_eq_last_f_Exec_Stream_take)\n\nlemma f_Exec_Stream_nth: \"\n  \\<And>n c. n < length xs \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun xs c ! n = f_Exec_Comp trans_fun (xs \\<down> Suc n) c\"\napply (induct xs, simp)\napply (simp add: nth_Cons')\ndone\n\nlemma f_Exec_Stream_nth2: \"\n  n \\<le> length xs \\<Longrightarrow>\n  (c # f_Exec_Comp_Stream trans_fun xs c) ! n = f_Exec_Comp trans_fun (xs \\<down> n) c\"\nby (simp add: nth_Cons' f_Exec_Stream_nth)\n\nlemma f_Exec_N_all:\"\n  length xs \\<le> n \\<Longrightarrow>\n    f_Exec_Comp_N trans_fun n xs c = f_Exec_Comp trans_fun xs c\"\nby (simp add: f_Exec_Comp_N_def)\n\nlemma f_Exec_Stream_append[rule_format]:\"\\<forall>c.\n  f_Exec_Comp_Stream trans_fun (xs @ ys) c =\n    (f_Exec_Comp_Stream trans_fun xs c) @\n    (f_Exec_Comp_Stream trans_fun ys (f_Exec_Comp trans_fun xs c))\"\nby (induct xs, simp_all)\n\ncorollary f_Exec_Stream_append_last_Cons[rule_format]:\"\n  f_Exec_Comp_Stream trans_fun (xs @ ys) c =\n    (f_Exec_Comp_Stream trans_fun xs c) @\n    (f_Exec_Comp_Stream trans_fun ys (last (c # (f_Exec_Comp_Stream  trans_fun xs c))))\"\nby (simp add: f_Exec_Stream_append f_Exec_eq_f_Exec_Stream_last)\n\ncorollary f_Exec_Stream_append_last[rule_format]:\"\n  xs \\<noteq> [] \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun (xs @ ys) c =\n    (f_Exec_Comp_Stream trans_fun xs c) @\n    (f_Exec_Comp_Stream trans_fun ys (last (f_Exec_Comp_Stream  trans_fun xs c)))\"\nby (simp add: f_Exec_Stream_append_last_Cons f_Exec_Stream_empty_conv)\n\ncorollary f_Exec_Stream_append_if:\"\n  f_Exec_Comp_Stream trans_fun (xs @ ys) c =\n    (f_Exec_Comp_Stream trans_fun xs c) @\n    (f_Exec_Comp_Stream trans_fun ys (\n      if xs = [] then c else last (f_Exec_Comp_Stream trans_fun xs c)))\"\nby (simp add: f_Exec_Stream_append f_Exec_eq_f_Exec_Stream_last_if)\ncorollary f_Exec_append:\"\n  f_Exec_Comp trans_fun (xs @ ys) c =\n  f_Exec_Comp trans_fun ys (f_Exec_Comp trans_fun xs c)\"\nby (simp add: f_Exec_eq_f_Exec_Stream_last f_Exec_Stream_append_if f_Exec_Stream_empty_conv)\n\ncorollary f_Exec_Stream_Cons_rev: \"\n  xs \\<noteq> [] \\<Longrightarrow>\n  (trans_fun (hd xs) c) #\n  f_Exec_Comp_Stream trans_fun (tl xs) (trans_fun (hd xs) c) =\n  f_Exec_Comp_Stream trans_fun xs c\"\nby (subst f_Exec_Stream_Cons[symmetric], simp)\n\nlemma f_Exec_Stream_snoc: \"\n  f_Exec_Comp_Stream trans_fun (xs @ [x]) c =\n    f_Exec_Comp_Stream trans_fun xs c @\n    [trans_fun x (f_Exec_Comp trans_fun xs c)]\"\nby (simp add: f_Exec_Stream_append)\n\nlemma f_Exec_snoc: \"\n  f_Exec_Comp trans_fun (xs @ [x]) c =\n  trans_fun x (f_Exec_Comp trans_fun xs c)\"\nby (simp add: f_Exec_append)\n\n\nlemma f_Exec_N_append[rule_format]:\"\n  f_Exec_Comp_N trans_fun (a + b) xs c =\n  f_Exec_Comp_N trans_fun b (xs \\<up> a) (f_Exec_Comp_N trans_fun a xs c)\"\napply (simp add: f_Exec_Comp_N_def f_Exec_append[symmetric])\napply (simp add: take_drop add.commute[of b])\napply (rule subst[of \"xs \\<down> (a + b) \\<down> a\" \"xs \\<down> a\" ], simp add: min_eqL)\napply (subst append_take_drop_id, simp)\ndone\n\ncorollary f_Exec_N_Suc[rule_format]:\"\n  f_Exec_Comp_N trans_fun (Suc n) xs c =\n  f_Exec_Comp_N trans_fun (Suc 0) (xs \\<up> n) (f_Exec_Comp_N trans_fun n xs c)\"\nby (simp add: f_Exec_N_append[symmetric])\n\ncorollary f_Exec_N_Suc2[rule_format]:\"\n  n < length xs \\<Longrightarrow>\n  f_Exec_Comp_N trans_fun (Suc n) xs c =\n  trans_fun (xs ! n) (f_Exec_Comp_N trans_fun n xs c)\"\nby (simp add: f_Exec_Comp_N_def take_Suc_conv_app_nth f_Exec_append)\n\ntheorem f_Exec_Stream_take:\"\n  (f_Exec_Comp_Stream trans_fun xs c) \\<down> n =\n  f_Exec_Comp_Stream trans_fun (xs \\<down> n) c\"\napply (case_tac \"length xs \\<le> n\", simp)\napply (rule subst[OF append_take_drop_id, of _ n xs])\napply (simp add: f_Exec_Stream_append del: append_take_drop_id)\ndone\n\ntheorem f_Exec_Stream_drop:\"\n  (f_Exec_Comp_Stream trans_fun xs c) \\<up> n =\n  f_Exec_Comp_Stream trans_fun (xs \\<up> n)\n    (f_Exec_Comp trans_fun (xs \\<down> n) c)\"\napply (case_tac \"length xs \\<le> n\", simp)\napply (rule subst[OF append_take_drop_id, of _ n xs])\napply (simp add: f_Exec_Stream_append del: append_take_drop_id)\ndone\n\nlemma i_Exec_Stream_nth: \"\n  i_Exec_Comp_Stream trans_fun input c n = f_Exec_Comp trans_fun (input \\<Down> Suc n) c\"\nby (simp add: i_Exec_Comp_Stream_def)\n\nlemma i_Exec_Stream_nth_Suc: \"\n  i_Exec_Comp_Stream trans_fun input c (Suc n) =\n  trans_fun (input (Suc n)) (i_Exec_Comp_Stream trans_fun input c n)\"\nby (simp add: i_Exec_Stream_nth i_take_Suc_conv_app_nth f_Exec_append)\n\nlemma i_Exec_Stream_nth_Suc_first: \"\n  i_Exec_Comp_Stream trans_fun input c (Suc n) =\n  (i_Exec_Comp_Stream trans_fun (input \\<Up> Suc 0) (trans_fun (input 0) c) n)\"\nby (simp add: i_Exec_Stream_nth i_take_Suc)\n\nlemma f_Exec_Stream_nth_eq_i_Exec_Stream_nth: \"\n  n < n' \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun (input \\<Down> n') c ! n =\n  i_Exec_Comp_Stream trans_fun input c n\"\nby (simp add: f_Exec_Stream_nth i_Exec_Stream_nth min_eqR)\n\n\nlemma i_Exec_Stream_append: \"\n  i_Exec_Comp_Stream trans_fun (xs \\<frown> input) c =\n  f_Exec_Comp_Stream trans_fun xs c \\<frown>\n  i_Exec_Comp_Stream trans_fun input (f_Exec_Comp trans_fun xs c)\"\nby (simp add: ilist_eq_iff i_Exec_Stream_nth f_Exec_Stream_nth f_Exec_append i_append_nth Suc_diff_le)\n\nlemma i_Exec_Stream_append_last_Cons: \"\n  i_Exec_Comp_Stream trans_fun (xs \\<frown> input) c =\n  f_Exec_Comp_Stream trans_fun xs c \\<frown>\n  i_Exec_Comp_Stream trans_fun input (\n    last (c # f_Exec_Comp_Stream trans_fun xs c))\"\nby (simp add: f_Exec_eq_f_Exec_Stream_last i_Exec_Stream_append)\n\nlemma i_Exec_Stream_append_last: \"\n  xs \\<noteq> [] \\<Longrightarrow>\n  i_Exec_Comp_Stream trans_fun (xs \\<frown> input) c =\n  f_Exec_Comp_Stream trans_fun xs c \\<frown>\n  i_Exec_Comp_Stream trans_fun input (\n    last (f_Exec_Comp_Stream trans_fun xs c))\"\nby (simp add: f_Exec_Stream_empty_conv i_Exec_Stream_append_last_Cons)\n\nlemma i_Exec_Stream_append_if: \"\n  i_Exec_Comp_Stream trans_fun (xs \\<frown> input) c =\n  f_Exec_Comp_Stream trans_fun xs c \\<frown>\n  i_Exec_Comp_Stream trans_fun input (\n    if xs = [] then c\n    else last (f_Exec_Comp_Stream trans_fun xs c))\"\nby (simp add: i_Exec_Stream_append_last)\n\ncorollary i_Exec_Stream_Cons: \"\n  i_Exec_Comp_Stream trans_fun ([x] \\<frown> input) c =\n  [trans_fun x c] \\<frown> i_Exec_Comp_Stream trans_fun input (trans_fun x c)\"\nby (simp add: i_Exec_Stream_append)\n\ncorollary i_Exec_Stream_Cons_rev: \"\n  [trans_fun (input 0) c] \\<frown>\n  i_Exec_Comp_Stream trans_fun (input \\<Up> Suc 0) (trans_fun (input 0) c) =\n  i_Exec_Comp_Stream trans_fun input c\"\napply (insert i_Exec_Stream_append[of trans_fun \"[input 0]\" \"input \\<Up> Suc 0\" c])\napply (simp add: i_drop_Suc_conv_tl)\ndone\n\ntheorem i_Exec_Stream_take:\"\n  (i_Exec_Comp_Stream trans_fun input c) \\<Down> n =\n  f_Exec_Comp_Stream trans_fun (input \\<Down> n) c\"\nby (simp add: list_eq_iff f_Exec_Stream_nth i_Exec_Stream_nth min_eqR)\n\ntheorem i_Exec_Stream_drop:\"\n  (i_Exec_Comp_Stream trans_fun input c) \\<Up> n =\n  i_Exec_Comp_Stream trans_fun (input \\<Up> n) (f_Exec_Comp trans_fun (input \\<Down> n) c)\"\napply (rule subst[OF i_append_i_take_i_drop_id, of _ n input])\napply (simp add: i_Exec_Stream_append  i_drop_def del: i_append_i_take_i_drop_id)\ndone\n\nlemma f_Exec_Stream_expand_aggregate_map_take: \"\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c)) k ag \\<down> n =\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun ((xs \\<down> n) \\<odot>\\<^sub>f k) c)) k ag\"\nby (simp add: f_aggregate_take_mult[symmetric] take_map f_Exec_Stream_take f_expand_take_mult)\n\ncorollary f_Exec_Stream_expand_aggregate_take: \"\n  f_aggregate (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c) k ag \\<down> n =\n  f_aggregate (f_Exec_Comp_Stream trans_fun ((xs \\<down> n) \\<odot>\\<^sub>f k) c) k ag\"\nby (insert f_Exec_Stream_expand_aggregate_map_take[of n id trans_fun xs k c ag], simp add: map_id)\n\nlemma i_Exec_Stream_expand_aggregate_map_take: \"\n  0 < k \\<Longrightarrow>\n  i_aggregate (f \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c)) k ag \\<Down> n =\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun ((input \\<Down> n) \\<odot>\\<^sub>f k) c)) k ag\"\nby (simp add: i_aggregate_i_take_mult[symmetric] i_Exec_Stream_take i_expand_i_take_mult)\n\ncorollary i_Exec_Stream_expand_aggregate_take: \"\n  0 < k \\<Longrightarrow>\n  i_aggregate (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c) k ag \\<Down> n =\n  f_aggregate (f_Exec_Comp_Stream trans_fun ((input \\<Down> n) \\<odot>\\<^sub>f k) c) k ag\"\nby (drule i_Exec_Stream_expand_aggregate_map_take[of k n id trans_fun input c ag], simp add: map_id)\n\nlemma f_Exec_Stream_expand_aggregate_map_drop: \"\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c)) k ag \\<up> n =\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun ((xs \\<up> n) \\<odot>\\<^sub>f k) (\n    f_Exec_Comp trans_fun ((xs \\<down> n) \\<odot>\\<^sub>f k) c))) k ag\"\nby (simp add: f_aggregate_drop_mult[symmetric] drop_map f_Exec_Stream_drop f_expand_take_mult f_expand_drop_mult)\n\ncorollary f_Exec_Stream_expand_aggregate_drop: \"\n  f_aggregate (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c) k ag \\<up> n =\n  f_aggregate (f_Exec_Comp_Stream trans_fun ((xs \\<up> n) \\<odot>\\<^sub>f k) (\n    f_Exec_Comp trans_fun ((xs \\<down> n) \\<odot>\\<^sub>f k) c)) k ag\"\nby (insert f_Exec_Stream_expand_aggregate_map_drop[of n id trans_fun xs k c ag], simp add: map_id)\n\nlemma i_Exec_Stream_expand_aggregate_map_drop: \"\n  0 < k \\<Longrightarrow>\n  i_aggregate (f \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c)) k ag \\<Up> n =\n  i_aggregate (f \\<circ> (i_Exec_Comp_Stream trans_fun ((input \\<Up> n) \\<odot>\\<^sub>i k) (\n    f_Exec_Comp trans_fun ((input \\<Down> n) \\<odot>\\<^sub>f k) c))) k ag\"\nby (simp add: i_aggregate_i_drop_mult[symmetric] i_Exec_Stream_drop i_expand_i_take_mult i_expand_i_drop_mult)\n\ncorollary i_Exec_Stream_expand_aggregate_drop: \"\n  0 < k \\<Longrightarrow>\n  i_aggregate (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c) k ag \\<Up> n =\n  i_aggregate (i_Exec_Comp_Stream trans_fun ((input \\<Up> n) \\<odot>\\<^sub>i k) (\n    f_Exec_Comp trans_fun ((input \\<Down> n) \\<odot>\\<^sub>f k) c)) k ag\"\nby (drule i_Exec_Stream_expand_aggregate_map_drop[of k n id trans_fun input c ag], simp)\n\n\nlemma f_Exec_Stream_expand_aggregate_map_nth_eq_i_nth: \"\n  \\<lbrakk> 0 < k; n < n' \\<rbrakk> \\<Longrightarrow>\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun (input \\<Down> n' \\<odot>\\<^sub>f k) c)) k ag ! n =\n  i_aggregate (f \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c)) k ag n\"\napply (simp add: f_aggregate_nth i_aggregate_nth f_Exec_Stream_take f_Exec_Stream_drop i_Exec_Stream_take i_Exec_Stream_drop drop_map take_map)\napply (simp add: f_expand_take_mod i_expand_i_take_mod f_expand_drop_mod i_expand_i_drop_mod i_drop_i_take_1 drop_take_1 min_eqR)\ndone\n\ncorollary f_Exec_Stream_expand_aggregate_map_nth_eq_i_nth': \"\n  0 < k \\<Longrightarrow>\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun (input \\<Down> Suc n \\<odot>\\<^sub>f k) c)) k ag ! n =\n  i_aggregate (f \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c)) k ag n\"\nby (simp add: f_Exec_Stream_expand_aggregate_map_nth_eq_i_nth)\n\ncorollary f_Exec_Stream_expand_aggregate_nth_eq_i_nth: \"\n  \\<lbrakk> 0 < k; n < n' \\<rbrakk> \\<Longrightarrow>\n  f_aggregate (f_Exec_Comp_Stream trans_fun (input \\<Down> n' \\<odot>\\<^sub>f k) c) k ag ! n =\n  i_aggregate (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c) k ag n\"\nby (drule f_Exec_Stream_expand_aggregate_map_nth_eq_i_nth[where f=id], simp_all add: map_id)\n\ncorollary f_Exec_Stream_expand_aggregate_nth_eq_i_nth': \"\n  0 < k \\<Longrightarrow>\n  f_aggregate (f_Exec_Comp_Stream trans_fun (input \\<Down> Suc n \\<odot>\\<^sub>f k) c) k ag ! n =\n  i_aggregate (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c) k ag n\"\nby (simp add: f_Exec_Stream_expand_aggregate_nth_eq_i_nth)\n\n\nlemma f_Exec_Stream_expand_shrink_last_map_nth_eq_f_Exec_Comp: \"\n  \\<lbrakk> 0 < k; n < length xs \\<rbrakk> \\<Longrightarrow>\n  map f (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c) \\<div>\\<^bsub>fl\\<^esub> k ! n =\n  f (f_Exec_Comp trans_fun ((xs \\<down> Suc n) \\<odot>\\<^sub>f k) c)\"\napply (simp add: f_shrink_last_map f_shrink_last_length f_shrink_last_nth)\napply (subgoal_tac \"n * k + k - Suc 0 < length xs * k\")\n prefer 2\n apply (drule Suc_leI[of n])\n apply (drule mult_le_mono1[of _ _ k], simp)\napply (simp add: f_Exec_Stream_nth add.commute[of k] f_expand_take_mult[symmetric])\ndone\n\ncorollary f_Exec_Stream_expand_shrink_last_nth_eq_f_Exec_Comp: \"\n  \\<lbrakk> 0 < k; n < length xs \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c \\<div>\\<^bsub>fl\\<^esub> k ! n =\n  f_Exec_Comp trans_fun ((xs \\<down> Suc n) \\<odot>\\<^sub>f k) c\"\nby (drule f_Exec_Stream_expand_shrink_last_map_nth_eq_f_Exec_Comp[where f=id], simp_all add: map_id)\n\nlemma f_Exec_Stream_expand_aggregate_map_nth: \"\n  \\<lbrakk> 0 < k; n < length xs \\<rbrakk> \\<Longrightarrow>\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c)) k ag ! n =\n  ag (map f (f_Exec_Comp_Stream trans_fun (xs ! n # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>)\n    (f_Exec_Comp trans_fun (xs \\<down> n \\<odot>\\<^sub>f k) c)))\"\napply (simp add: f_aggregate_nth take_map drop_map)\napply (simp add: take_map drop_map f_Exec_Stream_drop f_Exec_Stream_take f_expand_take_mod f_expand_drop_mod drop_take_1)\ndone\n\ncorollary f_Exec_Stream_expand_aggregate_nth: \"\n  \\<lbrakk> 0 < k; n < length xs \\<rbrakk> \\<Longrightarrow>\n  f_aggregate (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c) k ag ! n =\n  ag (f_Exec_Comp_Stream trans_fun (xs ! n # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>)\n    (f_Exec_Comp trans_fun (xs \\<down> n \\<odot>\\<^sub>f k) c))\"\nby (drule f_Exec_Stream_expand_aggregate_map_nth[where f=id], simp_all add: map_id)\n\ncorollary f_Exec_Stream_expand_shrink_map_nth: \"\n  \\<lbrakk> 0 < k; n < length xs \\<rbrakk> \\<Longrightarrow>\n  (map f (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c)) \\<div>\\<^sub>f k ! n =\n  last_message (map f (f_Exec_Comp_Stream trans_fun (xs ! n # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>)\n    (f_Exec_Comp trans_fun (xs \\<down> n \\<odot>\\<^sub>f k) c)))\"\nby (simp add: f_shrink_def f_Exec_Stream_expand_aggregate_map_nth)\n\nlemma i_Exec_Stream_expand_aggregate_map_nth: \"\n  0 < k \\<Longrightarrow>\n  i_aggregate (f \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c)) k ag n =\n  ag (map f (f_Exec_Comp_Stream trans_fun (input n # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>)\n    (f_Exec_Comp trans_fun ((input \\<Down> n) \\<odot>\\<^sub>f k) c)))\"\nby (simp add: i_aggregate_nth i_Exec_Stream_drop i_Exec_Stream_take i_expand_i_take_mod i_expand_i_drop_mod i_drop_i_take_1)\n\ncorollary i_Exec_Stream_expand_aggregate_nth: \"\n  0 < k \\<Longrightarrow>\n  i_aggregate (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c) k ag n =\n  ag (f_Exec_Comp_Stream trans_fun (input n # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>)\n    (f_Exec_Comp trans_fun ((input \\<Down> n) \\<odot>\\<^sub>f k) c))\"\nby (drule i_Exec_Stream_expand_aggregate_map_nth[where f=id], simp add: map_id)\n\ncorollary i_Exec_Stream_expand_shrink_map_nth: \"\n  0 < k \\<Longrightarrow>\n  ((f \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c)) \\<div>\\<^sub>i k) n =\n  last_message (map f (f_Exec_Comp_Stream trans_fun (input n # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>)\n    (f_Exec_Comp trans_fun (input \\<Down> n \\<odot>\\<^sub>f k) c)))\"\nby (simp add: i_shrink_def i_Exec_Stream_expand_aggregate_map_nth)\n\nlemma f_Exec_Stream_expand_snoc: \"\n  \\<lbrakk> 0 < k; n < length xs \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c \\<up> (n * k) \\<down> k =\n  f_Exec_Comp_Stream trans_fun (xs ! n # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>)\n    (f_Exec_Comp trans_fun (xs \\<down> n \\<odot>\\<^sub>f k) c)\"\nby (simp add: f_Exec_Stream_drop f_Exec_Stream_take f_expand_take_mod f_expand_drop_mod drop_take_1)\n\nlemma f_Exec_Stream_expand_map_aggregate_append: \"\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun ((xs @ ys) \\<odot>\\<^sub>f k) c)) k ag =\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c)) k ag @\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun (ys \\<odot>\\<^sub>f k) (\n    f_Exec_Comp trans_fun (xs \\<odot>\\<^sub>f k) c))) k ag\"\nby (simp add: f_Exec_Stream_append f_aggregate_append_mod)\n\nlemma i_Exec_Stream_expand_map_aggregate_append: \"\n  i_aggregate (f \\<circ> (i_Exec_Comp_Stream trans_fun ((xs \\<frown> input) \\<odot>\\<^sub>i k) c)) k ag =\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c)) k ag \\<frown>\n  i_aggregate (f \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) (\n    f_Exec_Comp trans_fun (xs \\<odot>\\<^sub>f k) c))) k ag\"\nby (simp add: i_expand_i_append i_Exec_Stream_append i_aggregate_i_append_mod)\n\nlemma f_Exec_Stream_expand_map_aggregate_Cons: \"\n  0 < k \\<Longrightarrow>\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun ((x # xs) \\<odot>\\<^sub>f k) c)) k ag =\n  ag (map f (f_Exec_Comp_Stream trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c)) #\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) (\n    f_Exec_Comp trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c))) k ag\"\napply (subst append_eq_Cons[of x xs, symmetric])\napply (subst f_Exec_Stream_expand_map_aggregate_append)\napply (simp add: f_aggregate_one)\ndone\n\nlemma f_Exec_Stream_expand_map_aggregate_snoc: \"\n  0 < k \\<Longrightarrow>\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun ((xs @ [x]) \\<odot>\\<^sub>f k) c)) k ag =\n  f_aggregate (map f (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c)) k ag @\n  [ag (map f (f_Exec_Comp_Stream trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) (\n    f_Exec_Comp trans_fun (xs \\<odot>\\<^sub>f k) c)))]\"\napply (subst f_Exec_Stream_expand_map_aggregate_append)\napply (simp add: f_aggregate_one)\ndone\n\nlemma i_Exec_Stream_expand_map_aggregate_Cons: \"\n  0 < k \\<Longrightarrow>\n  i_aggregate (f \\<circ> (i_Exec_Comp_Stream trans_fun (([x] \\<frown> input) \\<odot>\\<^sub>i k) c)) k ag =\n  [ag (map f (f_Exec_Comp_Stream trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c))] \\<frown>\n  i_aggregate (f \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) (\n    f_Exec_Comp trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c))) k ag\"\napply (subst i_Exec_Stream_expand_map_aggregate_append)\napply (simp add: f_aggregate_one)\ndone\n\nlemma f_Exec_N_eq_f_Exec_Stream_nth:\"\n  n \\<le> length xs \\<Longrightarrow>\n  f_Exec_Comp_N trans_fun n xs c = (c # f_Exec_Comp_Stream trans_fun xs c) ! n\"\nby (simp add: f_Exec_Comp_N_def f_Exec_Stream_nth2)\n\ntheorem f_Exec_Stream_causal: \"\n  xs \\<down> n = ys \\<down> n \\<Longrightarrow>\n  (f_Exec_Comp_Stream trans_fun xs c) \\<down> n = (f_Exec_Comp_Stream trans_fun ys c) \\<down> n\"\nby (simp add: f_Exec_Stream_take)\ntheorem i_Exec_Stream_causal: \"\n  input1 \\<Down> n = input2 \\<Down> n \\<Longrightarrow>\n  (i_Exec_Comp_Stream trans_fun input1 c) \\<Down> n = (i_Exec_Comp_Stream trans_fun input2 c) \\<Down> n\"\nby (simp add: i_Exec_Stream_take)\n\n\ntext \\<open>Results for \\<open>f_Exec_Comp_Stream_Init\\<close>\\<close>\n\ntext \\<open>\n  \\<open>f_Exec_Comp_Stream_Init\\<close> computes the execution stream of a component\n  with the initial value of the component\n  at the beginning of the result stream.\\<close>\n\nlemma f_Exec_Stream_Init_length[rule_format, simp]:\"\n  \\<forall>c. length (f_Exec_Comp_Stream_Init trans_fun xs c) = Suc (length xs)\"\nby (induct xs, simp_all)\n\nlemma f_Exec_Stream_Init_not_empty:\"\n  (f_Exec_Comp_Stream_Init trans_fun xs c \\<noteq> [])\"\nby (simp add: length_0_conv[symmetric] del: length_0_conv)\n\nlemma f_Exec_eq_f_Exec_Stream_Init_last[rule_format]:\"\n  \\<forall>c. f_Exec_Comp trans_fun xs c = last (f_Exec_Comp_Stream_Init trans_fun xs c)\"\nby (induct xs, simp_all add: f_Exec_Stream_Init_not_empty)\n\nlemma f_Exec_Stream_Init_eq_f_Exec_Stream_Cons[rule_format]: \"\n  \\<forall>c. f_Exec_Comp_Stream_Init trans_fun xs c = c # f_Exec_Comp_Stream trans_fun xs c\"\nby (induct xs, simp_all)\n\ncorollary f_Exec_Stream_Init_eq_f_Exec_Stream_Cons_output: \"\n  output_fun c = \\<NoMsg> \\<Longrightarrow>\n  map output_fun (f_Exec_Comp_Stream_Init trans_fun xs c) =\n  \\<NoMsg> # map output_fun (f_Exec_Comp_Stream trans_fun xs c)\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons)\n\ncorollary f_Exec_Stream_Init_tl_eq_f_Exec_Stream: \"\n  tl (f_Exec_Comp_Stream_Init trans_fun xs c) = f_Exec_Comp_Stream trans_fun xs c\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons)\n\nlemma f_Exec_N_eq_last_f_Exec_Stream_Init_take:\"\n  f_Exec_Comp_N trans_fun n xs c =\n  last (f_Exec_Comp_Stream_Init trans_fun (xs \\<down> n) c)\"\nby (simp add: f_Exec_Comp_N_def f_Exec_eq_f_Exec_Stream_Init_last)\n\nlemma f_Exec_Stream_Init_nth: \"\n  n \\<le> length xs \\<Longrightarrow>\n  f_Exec_Comp_Stream_Init trans_fun xs c ! n = f_Exec_Comp trans_fun (xs \\<down> n) c\"\napply (subst f_Exec_Stream_Init_eq_f_Exec_Stream_Cons)\napply (case_tac n, simp)\napply (simp add: f_Exec_Stream_nth)\ndone\n\nlemma f_Exec_Stream_Init_nth_0: \"f_Exec_Comp_Stream_Init trans_fun xs c ! 0 = c\"\nby (simp add: f_Exec_Stream_Init_nth)\n\nlemma f_Exec_Stream_Init_hd: \"hd (f_Exec_Comp_Stream_Init trans_fun xs c) = c\"\nby (simp add: hd_conv_nth f_Exec_Stream_Init_not_empty f_Exec_Stream_Init_nth_0)\n\nlemma f_Exec_Stream_Init_nth_Suc_eq_f_Exec_Stream_nth: \"\n  f_Exec_Comp_Stream_Init trans_fun xs c ! (Suc n) = f_Exec_Comp_Stream trans_fun xs c ! n\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons)\n\nlemma f_Exec_Stream_Init_append:\"\n  f_Exec_Comp_Stream_Init trans_fun (xs @ ys) c =\n    (f_Exec_Comp_Stream_Init trans_fun xs c) @\n    tl (f_Exec_Comp_Stream_Init trans_fun ys (f_Exec_Comp trans_fun xs c))\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons f_Exec_Stream_append)\n\ncorollary f_Exec_Stream_Init_append_last:\"\n  f_Exec_Comp_Stream_Init trans_fun (xs @ ys) c =\n    (f_Exec_Comp_Stream_Init trans_fun xs c) @\n    tl (f_Exec_Comp_Stream_Init trans_fun ys (last (f_Exec_Comp_Stream_Init trans_fun xs c)))\"\nby (simp add: f_Exec_Stream_Init_append f_Exec_eq_f_Exec_Stream_Init_last)\n\nlemma f_Exec_Stream_Init_f_Exec_Stream_append:\"\n  f_Exec_Comp_Stream_Init trans_fun (xs @ ys) c =\n    (f_Exec_Comp_Stream_Init trans_fun xs c) @\n    (f_Exec_Comp_Stream trans_fun ys (f_Exec_Comp trans_fun xs c))\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons f_Exec_Stream_append)\n\nlemma f_Exec_Stream_Init_take:\"\n  (f_Exec_Comp_Stream_Init trans_fun xs c) \\<down> Suc n =\n  f_Exec_Comp_Stream_Init trans_fun (xs \\<down> n) c\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons f_Exec_Stream_take)\n\nlemma f_Exec_Stream_Init_drop:\"\n  n \\<le> length xs \\<Longrightarrow>\n  (f_Exec_Comp_Stream_Init trans_fun xs c) \\<up> n =\n  f_Exec_Comp_Stream_Init trans_fun (xs \\<up> n)\n    (f_Exec_Comp trans_fun (xs \\<down> n) c)\"\napply (case_tac n, simp)\napply (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons f_Exec_Stream_drop)\napply (simp add: take_Suc_conv_app_nth f_Exec_append Cons_nth_drop_Suc[symmetric])\ndone\n\nlemma f_Exec_Stream_Init_drop_geq_not_valid:\"\n  length xs \\<le> n \\<Longrightarrow>\n  (f_Exec_Comp_Stream_Init trans_fun xs c) \\<up> Suc n \\<noteq>\n  f_Exec_Comp_Stream_Init trans_fun arbitrary_input arbitrary_comp\"\nby (simp add: f_Exec_Stream_Init_not_empty[symmetric])\n\nlemma i_Exec_Stream_Init_nth: \"\n  i_Exec_Comp_Stream_Init trans_fun input c n = f_Exec_Comp trans_fun (input \\<Down> n) c\"\nby (simp add: i_Exec_Comp_Stream_Init_def)\n\nlemma i_Exec_Stream_Init_nth_0: \"\n  i_Exec_Comp_Stream_Init trans_fun input c 0 = c\"\nby (simp add: i_Exec_Stream_Init_nth)\n\nlemma i_Exec_Stream_Init_nth_Suc_eq_i_Exec_Stream_nth: \"\n  i_Exec_Comp_Stream_Init trans_fun input c (Suc n) = i_Exec_Comp_Stream trans_fun input c n\"\nby (simp add: i_Exec_Stream_Init_nth i_Exec_Stream_nth)\n\nlemma i_Exec_Stream_Init_eq_i_Exec_Stream_Cons: \"\n  i_Exec_Comp_Stream_Init trans_fun input c = [c] \\<frown> i_Exec_Comp_Stream trans_fun input c\"\nby (simp add: ilist_eq_iff i_Exec_Stream_Init_nth i_append_nth i_Exec_Stream_nth)\n\ncorollary i_Exec_Stream_Init_eq_i_Exec_Stream_Cons_output: \"\n  output_fun c = \\<NoMsg> \\<Longrightarrow>\n  output_fun \\<circ> i_Exec_Comp_Stream_Init trans_fun input c =\n  [\\<NoMsg>] \\<frown> (output_fun \\<circ> i_Exec_Comp_Stream trans_fun input c)\"\nby (simp add: i_Exec_Stream_Init_eq_i_Exec_Stream_Cons)\n\nlemma i_Exec_Stream_Init_append:\"\n  i_Exec_Comp_Stream_Init trans_fun (input1 \\<frown> input2) c =\n    (f_Exec_Comp_Stream_Init trans_fun input1 c) \\<frown>\n    ((i_Exec_Comp_Stream_Init trans_fun input2 (f_Exec_Comp trans_fun input1 c)) \\<Up> Suc 0)\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons i_Exec_Stream_Init_eq_i_Exec_Stream_Cons i_Exec_Stream_append)\n\ncorollary i_Exec_Stream_Init_append_last:\"\n  i_Exec_Comp_Stream_Init trans_fun (input1 \\<frown> input2) c =\n    (f_Exec_Comp_Stream_Init trans_fun input1 c) \\<frown>\n    ((i_Exec_Comp_Stream_Init trans_fun input2 (last (f_Exec_Comp_Stream_Init trans_fun input1 c))) \\<Up> Suc 0)\"\nby (simp add: i_Exec_Stream_Init_append f_Exec_eq_f_Exec_Stream_Init_last)\n\nlemma i_Exec_Stream_Init_i_Exec_Stream_append:\"\n  i_Exec_Comp_Stream_Init trans_fun (input1 \\<frown> input2) c =\n    (f_Exec_Comp_Stream_Init trans_fun input1 c) \\<frown>\n    (i_Exec_Comp_Stream trans_fun input2 (f_Exec_Comp trans_fun input1 c))\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons i_Exec_Stream_Init_eq_i_Exec_Stream_Cons i_Exec_Stream_append)\n\nlemma i_Exec_Stream_Init_take:\"\n  (i_Exec_Comp_Stream_Init trans_fun input c) \\<Down> Suc n =\n  f_Exec_Comp_Stream_Init trans_fun (input \\<Down> n) c\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons i_Exec_Stream_Init_eq_i_Exec_Stream_Cons i_Exec_Stream_take)\nlemma i_Exec_Stream_Init_drop:\"\n  (i_Exec_Comp_Stream_Init trans_fun input c) \\<Up> n =\n  i_Exec_Comp_Stream_Init trans_fun (input \\<Up> n)\n    (f_Exec_Comp trans_fun (input \\<Down> n) c)\"\napply (case_tac n, simp)\napply (simp add: i_Exec_Stream_Init_eq_i_Exec_Stream_Cons i_Exec_Stream_drop)\napply (simp add: ilist_eq_iff i_take_Suc_conv_app_nth f_Exec_append i_Exec_Stream_nth i_append_nth i_take_first i_take_drop_eq_map)\napply (simp add: upt_conv_Cons)\ndone\n\ntheorem f_Exec_Stream_Init_strictly_causal: \"\n  xs \\<down> n = ys \\<down> n \\<Longrightarrow>\n  (f_Exec_Comp_Stream_Init trans_fun xs c) \\<down> Suc n = (f_Exec_Comp_Stream_Init trans_fun ys c) \\<down> Suc n\"\nby (simp add: f_Exec_Stream_Init_take)\n\ntheorem i_Exec_Stream_Init_strictly_causal: \"\n  input1 \\<Down> n = input2 \\<Down> n \\<Longrightarrow>\n  (i_Exec_Comp_Stream_Init trans_fun input1 c) \\<Down> Suc n = (i_Exec_Comp_Stream_Init trans_fun input2 c) \\<Down> Suc n\"\nby (simp add: i_Exec_Stream_Init_take)\n\ntheorem f_Exec_N_eq_f_Exec_Stream_Init_nth:\"\n  n \\<le> length xs \\<Longrightarrow>\n  f_Exec_Comp_N trans_fun n xs c = f_Exec_Comp_Stream_Init trans_fun xs c ! n\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons f_Exec_N_eq_f_Exec_Stream_nth)\n\n\ntext \\<open>Basic results for previous element functions\\<close>\n\ntext \\<open>\n  The functions \\<open>list_Previous\\<close> and \\<open>ilist_Previous\\<close>\n  return the previous element of the list relatively to the specified position @{term n}\n  or the initial element if @{term n} is 0,\\<close>\n\ndefinition list_Previous :: \"'value list \\<Rightarrow> 'value \\<Rightarrow> nat \\<Rightarrow> 'value\"\n  where \"list_Previous xs init n \\<equiv>\n    case n of\n      0 \\<Rightarrow> init\n    | Suc n' \\<Rightarrow> xs ! n'\"\n\ndefinition ilist_Previous :: \"'value ilist \\<Rightarrow> 'value \\<Rightarrow> nat \\<Rightarrow> 'value\"\n  where \"ilist_Previous f init n \\<equiv>\n    case n of\n      0 \\<Rightarrow> init\n    | Suc n' \\<Rightarrow> f n'\"\n\nabbreviation \"list_Previous'\" :: \"'value list \\<Rightarrow> 'value \\<Rightarrow> nat \\<Rightarrow> 'value\"\n    ( \"_\\<^bsup>\\<leftarrow>'' _\\<^esup> _\" [1000, 10, 100] 100)\n  where \"xs\\<^bsup>\\<leftarrow>' init\\<^esup> n \\<equiv> list_Previous xs init n\"\n\nabbreviation \"ilist_Previous'\" :: \"'value ilist \\<Rightarrow> 'value \\<Rightarrow> nat \\<Rightarrow> 'value\"\n    ( \"_\\<^bsup>\\<leftarrow> _\\<^esup> _\" [1000, 10, 100] 100)\n  where \"f\\<^bsup>\\<leftarrow> init\\<^esup> n \\<equiv> ilist_Previous f init n\"\n\nlemma list_Previous_nth: \"xs\\<^bsup>\\<leftarrow>' init\\<^esup> n = (case n of 0 \\<Rightarrow> init | Suc n' \\<Rightarrow> xs ! n')\"\nby (simp add: list_Previous_def)\n\nlemma ilist_Previous_nth: \"f\\<^bsup>\\<leftarrow> init\\<^esup> n = (case n of 0 \\<Rightarrow> init | Suc n' \\<Rightarrow> f n')\"\nby (simp add: ilist_Previous_def)\n\nlemma list_Previous_nth_if: \"xs\\<^bsup>\\<leftarrow>' init\\<^esup> n = (if n = 0 then init else xs ! (n - Suc 0))\"\nby (case_tac n, simp_all add: list_Previous_nth)\n\nlemma ilist_Previous_nth_if: \"f\\<^bsup>\\<leftarrow> init\\<^esup> n = (if n = 0 then init else f (n - Suc 0))\"\nby (case_tac n, simp_all add: ilist_Previous_nth)\n\nlemma list_Previous_Cons: \"xs\\<^bsup>\\<leftarrow>' init\\<^esup> n = (init # xs) ! n\"\nby (case_tac n, simp_all add: list_Previous_nth)\n\nlemma ilist_Previous_Cons: \"f\\<^bsup>\\<leftarrow> init\\<^esup> n = ([init] \\<frown> f) n\"\nby (case_tac n, simp_all add: ilist_Previous_nth)\n\nlemma list_Previous_0: \"xs\\<^bsup>\\<leftarrow>' init\\<^esup> 0 = init\"\nby (simp add: list_Previous_def)\n\nlemma ilist_Previous_0: \"f\\<^bsup>\\<leftarrow> init\\<^esup> 0 = init\"\nby (simp add: ilist_Previous_def)\n\nlemma list_Previous_gr0: \"0 < n \\<Longrightarrow> xs\\<^bsup>\\<leftarrow>' init\\<^esup> n = xs ! (n - Suc 0)\"\nby (case_tac n, simp_all add: list_Previous_nth)\n\nlemma ilist_Previous_gr0: \"0 < n \\<Longrightarrow> f\\<^bsup>\\<leftarrow> init\\<^esup> n = f (n - Suc 0)\"\nby (case_tac n, simp_all add: ilist_Previous_nth)\n\nlemma list_Previous_Suc: \"xs\\<^bsup>\\<leftarrow>' init\\<^esup> (Suc n) = xs ! n\"\nby (simp add: list_Previous_def)\n\nlemma ilist_Previous_Suc: \"f\\<^bsup>\\<leftarrow> init\\<^esup> (Suc n) = f n\"\nby (simp add: ilist_Previous_def)\n\n\nlemma f_Exec_Stream_Previous_f_Exec_Stream_Init: \"\n  f_Exec_Comp_Stream_Init trans_fun xs c ! n =\n  (f_Exec_Comp_Stream trans_fun xs c)\\<^bsup>\\<leftarrow>' c\\<^esup> n\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons list_Previous_Cons)\n\nlemma i_Exec_Stream_Previous_i_Exec_Stream_Init: \"\n  i_Exec_Comp_Stream_Init trans_fun input c n =\n  (i_Exec_Comp_Stream trans_fun input c)\\<^bsup>\\<leftarrow> c\\<^esup> n\"\nby (simp add: i_Exec_Stream_Init_eq_i_Exec_Stream_Cons ilist_Previous_Cons)\n\n\nlemma f_Exec_Stream_hd: \"\n  0 < length xs \\<Longrightarrow> hd (f_Exec_Comp_Stream trans_fun xs c) = trans_fun (hd xs) c\"\nby (case_tac xs, simp+)\n\nlemma f_Exec_Stream_nth_0: \"\n  0 < length xs \\<Longrightarrow> (f_Exec_Comp_Stream trans_fun xs c) ! 0= trans_fun (xs ! 0) c\"\nby (case_tac xs, simp+)\n\ntext \\<open>\n  The calculation of the n-th result stream element\n  from the previous result stream element and the current input stream element.\\<close>\nlemma f_Exec_Stream_nth_gr0_calc: \"\n  \\<lbrakk> n < length xs; 0 < n \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun xs c ! n =\n  trans_fun (xs ! n) (f_Exec_Comp_Stream trans_fun xs c ! (n - 1))\"\nby (simp add: f_Exec_Stream_nth take_Suc_conv_app_nth f_Exec_append)\n\nlemma f_Exec_Stream_nth_calc_Previous: \"\n  n < length xs \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun xs c ! n =\n  trans_fun (xs ! n) ((f_Exec_Comp_Stream trans_fun xs c)\\<^bsup>\\<leftarrow>' c\\<^esup> n)\"\napply (case_tac n)\n apply (simp add: list_Previous_0 f_Exec_Stream_nth_0)\napply (simp add: list_Previous_def f_Exec_Stream_nth_gr0_calc)\ndone\n\n\nlemma i_Exec_Stream_nth_0: \"\n  (i_Exec_Comp_Stream trans_fun input c) 0 = trans_fun (input 0) c\"\nby (simp add: i_Exec_Stream_nth i_take_first)\n\nlemma i_Exec_Stream_nth_gr0_calc: \"\n  0 < n \\<Longrightarrow>\n  (i_Exec_Comp_Stream trans_fun input c) n =\n  trans_fun (input n) ((i_Exec_Comp_Stream trans_fun input c) (n - 1))\"\nby (simp add: i_Exec_Stream_nth i_take_Suc_conv_app_nth f_Exec_append)\n\ntext \\<open>\n  The component state (and thus its output) at time point @{term \"n\"}\n  is computed from the previous state\n  (the state at time @{term \"n-1\"} for @{term \"n > 0\"}\n  or the initial state for @{term \"n = 0\"})\n  and the input at time @{term \"n\"}.\\<close>\nlemma i_Exec_Stream_nth_calc_Previous: \"\n  i_Exec_Comp_Stream trans_fun input c n =\n  trans_fun (input n) ((i_Exec_Comp_Stream trans_fun input c)\\<^bsup>\\<leftarrow> c\\<^esup> n)\"\nby (simp add: i_Exec_Stream_nth ilist_Previous_nth_if i_take_first i_take_Suc_conv_app_nth f_Exec_append)\n\nlemma f_Exec_Stream_Init_nth_Suc_calc: \"\n  n < length xs \\<Longrightarrow>\n  f_Exec_Comp_Stream_Init trans_fun xs c ! Suc n =\n  trans_fun (xs ! n) (f_Exec_Comp_Stream_Init trans_fun xs c ! n)\"\nby (simp add: f_Exec_Stream_Init_eq_f_Exec_Stream_Cons f_Exec_Stream_nth nth_Cons' length_greater_0_conv[THEN iffD1, OF gr_implies_gr0] take_Suc_conv_app_nth f_Exec_append)\n\nlemma f_Exec_Stream_Init_nth_Plus1_calc: \"\n  n < length xs \\<Longrightarrow>\n  f_Exec_Comp_Stream_Init trans_fun xs c ! (n + 1)=\n  trans_fun (xs ! n) (f_Exec_Comp_Stream_Init trans_fun xs c ! n)\"\nby (simp add: f_Exec_Stream_Init_nth_Suc_calc)\n\nlemma f_Exec_Stream_Init_nth_gr0_calc: \"\n  \\<lbrakk> n \\<le> length xs; 0 < n \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Init trans_fun xs c ! n =\n  trans_fun (xs ! (n - 1)) (f_Exec_Comp_Stream_Init trans_fun xs c ! (n - 1))\"\nby (clarsimp simp: gr0_conv_Suc f_Exec_Stream_Init_nth_Suc_calc)\n\ntext \\<open>\n  At the beginning,\n  the component state (and thus its output)\n  for the execution stream with initial state\n  is represented by the initial state,\n  contrary to the @{term \"i_Exec_Comp_Stream\"}\n  that does not contain the initial state.\\<close>\n\ntext \\<open>\n  The component state (and thus its output) at time point @{term \"n + 1\"}\n  for the execution stream with initial state\n  is computed from the previous state\n  (the state at time @{term \"n\"})\n  and the previous input\n  (input at time @{term \"n\"}),\n  contrary to the @{term \"i_Exec_Comp_Stream\"},\n  where each state at time @{term \"n\"}\n  represents the resulting state after processing the input at time @{term \"n\"}.\\<close>\n\nlemma i_Exec_Stream_Init_nth_Suc_calc: \"\n  i_Exec_Comp_Stream_Init trans_fun input c (Suc n) =\n  trans_fun (input n) (i_Exec_Comp_Stream_Init trans_fun input c n)\"\nby (simp add: i_Exec_Stream_Init_nth i_take_Suc_conv_app_nth f_Exec_append)\n\nlemma i_Exec_Stream_Init_nth_Plus1_calc: \"\n  i_Exec_Comp_Stream_Init trans_fun input c (n + 1) =\n  trans_fun (input n) (i_Exec_Comp_Stream_Init trans_fun input c n)\"\nby (simp add: i_Exec_Stream_Init_nth_Suc_calc)\n\nlemma i_Exec_Stream_Init_nth_gr0_calc: \"\n  0 < n \\<Longrightarrow>\n  i_Exec_Comp_Stream_Init trans_fun input c n =\n  trans_fun (input (n - 1)) (i_Exec_Comp_Stream_Init trans_fun input c (n - 1))\"\nby (clarsimp simp: gr0_conv_Suc i_Exec_Stream_Init_nth_Suc_calc)\n\n\ntext \\<open>Correlation between Pre/Post-Conditions for\n  \\<open>f_Exec_Comp_Stream\\<close> and \\<open>f_Exec_Comp_Stream_Init\\<close>\\<close>\n\nlemma f_Exec_Stream_Pre_Post1: \"\n  \\<lbrakk> n < length xs;\n    c_n = (f_Exec_Comp_Stream trans_fun xs c)\\<^bsup>\\<leftarrow>' c\\<^esup> n; x_n = xs ! n \\<rbrakk> \\<Longrightarrow>\n  (P1 x_n \\<and> P2 c_n \\<longrightarrow> Q (f_Exec_Comp_Stream trans_fun xs c ! n)) =\n  (P1 x_n \\<and> P2 c_n \\<longrightarrow> Q (trans_fun x_n c_n))\"\nby (simp add: f_Exec_Stream_nth_calc_Previous)\n\ntext \\<open>Direct relation between input and result after transition\\<close>\nlemma f_Exec_Stream_Pre_Post2: \"\n  \\<lbrakk> n < length xs;\n    c_n = (f_Exec_Comp_Stream trans_fun xs c)\\<^bsup>\\<leftarrow>' c\\<^esup> n; x_n = xs ! n \\<rbrakk> \\<Longrightarrow>\n  (P c_n \\<longrightarrow> Q (xs ! n) (f_Exec_Comp_Stream trans_fun xs c ! n)) =\n  (P c_n \\<longrightarrow> Q x_n (trans_fun x_n c_n))\"\nby (simp add: f_Exec_Stream_nth_calc_Previous)\n\nlemma f_Exec_Stream_Pre_Post2_Suc: \"\n  \\<lbrakk> Suc n < length xs;\n    c_n = f_Exec_Comp_Stream trans_fun xs c ! n; x_n1 = xs ! Suc n \\<rbrakk> \\<Longrightarrow>\n  (P c_n \\<longrightarrow> Q (xs ! Suc n) (f_Exec_Comp_Stream trans_fun xs c ! Suc n)) =\n  (P c_n \\<longrightarrow> Q x_n1 (trans_fun x_n1 c_n))\"\nby (simp add: f_Exec_Stream_nth_gr0_calc)\n\nlemma f_Exec_Stream_Init_Pre_Post1: \"\n  \\<lbrakk> n < length xs;\n    c_n = f_Exec_Comp_Stream_Init trans_fun xs c ! n; x_n = xs ! n \\<rbrakk> \\<Longrightarrow>\n  (P1 x_n \\<and> P2 c_n \\<longrightarrow> Q (f_Exec_Comp_Stream_Init trans_fun xs c ! Suc n)) =\n  (P1 x_n \\<and> P2 c_n \\<longrightarrow> Q (trans_fun x_n c_n))\"\nby (simp add: f_Exec_Stream_Init_nth_Suc_calc)\n\ntext \\<open>Direct relation between input and state before transition\\<close>\nlemma f_Exec_Stream_Init_Pre_Post2: \"\n  \\<lbrakk> n < length xs;\n    c_n = f_Exec_Comp_Stream_Init trans_fun xs c ! n; x_n = xs ! n \\<rbrakk> \\<Longrightarrow>\n  (P (xs ! n) (f_Exec_Comp_Stream_Init trans_fun xs c ! n) \\<longrightarrow>\n     Q (f_Exec_Comp_Stream_Init trans_fun xs c ! Suc n)) =\n  (P x_n c_n \\<longrightarrow> Q (trans_fun x_n c_n))\"\nby (simp add: f_Exec_Stream_Init_nth_Suc_calc)\n\n\nlemma i_Exec_Stream_Pre_Post1: \"\n  \\<lbrakk> c_n = (i_Exec_Comp_Stream trans_fun input c)\\<^bsup>\\<leftarrow> c\\<^esup> n; x_n = input n \\<rbrakk> \\<Longrightarrow>\n  (P1 x_n \\<and> P2 c_n \\<longrightarrow> Q (i_Exec_Comp_Stream trans_fun input c n)) =\n  (P1 x_n \\<and> P2 c_n \\<longrightarrow> Q (trans_fun x_n c_n))\"\nby (simp add: i_Exec_Stream_nth_calc_Previous)\n\ntext \\<open>Direct relation between input and result after transition\\<close>\nlemma i_Exec_Stream_Pre_Post2: \"\n  \\<lbrakk> c_n = (i_Exec_Comp_Stream trans_fun input c)\\<^bsup>\\<leftarrow> c\\<^esup> n; x_n = input n \\<rbrakk> \\<Longrightarrow>\n  (P c_n \\<longrightarrow> Q (input n) (i_Exec_Comp_Stream trans_fun input c n)) =\n  (P c_n \\<longrightarrow> Q x_n (trans_fun x_n c_n))\"\nby (simp add: i_Exec_Stream_nth_calc_Previous)\n\nlemma i_Exec_Stream_Pre_Post2_Suc: \"\n  \\<lbrakk> c_n = i_Exec_Comp_Stream trans_fun input c n; x_n1 = input (Suc n) \\<rbrakk> \\<Longrightarrow>\n  (P c_n \\<longrightarrow> Q (input (Suc n)) (i_Exec_Comp_Stream trans_fun input c (Suc n))) =\n  (P c_n \\<longrightarrow> Q x_n1 (trans_fun x_n1 c_n))\"\nby (simp add: i_Exec_Stream_nth_gr0_calc)\n\nlemma i_Exec_Stream_Init_Pre_Post1: \"\n  \\<lbrakk> c_n = i_Exec_Comp_Stream_Init trans_fun input c n; x_n = input n \\<rbrakk> \\<Longrightarrow>\n  (P1 x_n \\<and> P2 c_n \\<longrightarrow> Q (i_Exec_Comp_Stream_Init trans_fun input c (Suc n))) =\n  (P1 x_n \\<and> P2 c_n \\<longrightarrow> Q (trans_fun x_n c_n))\"\nby (simp add: i_Exec_Stream_Init_nth_Suc_calc)\n\ntext \\<open>Direct relation between input and state before transition\\<close>\nlemma i_Exec_Stream_Init_Pre_Post2: \"\n  \\<lbrakk> c_n = i_Exec_Comp_Stream_Init trans_fun input c n; x_n = input n \\<rbrakk> \\<Longrightarrow>\n  (P (input n) (i_Exec_Comp_Stream_Init trans_fun input c n) \\<longrightarrow>\n     Q (i_Exec_Comp_Stream_Init trans_fun input c (Suc n))) =\n  (P x_n c_n \\<longrightarrow> Q (trans_fun x_n c_n))\"\nby (simp add: i_Exec_Stream_Init_nth_Suc_calc)\n\n\ntext \\<open>Basic results for stream prefices\\<close>\n\nlemma f_Exec_Stream_prefix: \"\n  prefix xs ys \\<Longrightarrow>\n  prefix (f_Exec_Comp_Stream trans_fun xs c)\n         (f_Exec_Comp_Stream trans_fun ys c)\"\nby (clarsimp simp: prefix_def f_Exec_Stream_append)\n\nlemma i_Exec_Stream_prefix: \"\n xs \\<sqsubseteq> input \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun xs c \\<sqsubseteq>\n  i_Exec_Comp_Stream trans_fun input c\"\nby (simp add: iprefix_eq_iprefix_take i_Exec_Stream_take)\n\nlemma f_Exec_N_prefix: \"\n  \\<lbrakk> n \\<le> length xs; prefix xs ys \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_N trans_fun n xs c =\n  f_Exec_Comp_N trans_fun n ys c\"\nby (simp add: f_Exec_Comp_N_def prefix_imp_take_eq)\n\ntheorem f_Exec_Stream_prefix_causal[rule_format]:\"\n  n \\<le> length (xs \\<sqinter> ys) \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun xs c \\<down> n =\n  f_Exec_Comp_Stream trans_fun ys c \\<down> n\"\nby (rule f_Exec_Stream_causal, rule inf_prefix_take_correct)\n\nlemma f_Exec_Stream_Init_prefix:\"\n  prefix xs ys \\<Longrightarrow>\n  prefix (f_Exec_Comp_Stream_Init trans_fun xs c)\n         (f_Exec_Comp_Stream_Init trans_fun ys c)\"\nby (clarsimp simp: prefix_def f_Exec_Stream_Init_append)\n\nlemma i_Exec_Stream_Init_prefix: \"\n xs \\<sqsubseteq> input \\<Longrightarrow>\n  f_Exec_Comp_Stream_Init trans_fun xs c \\<sqsubseteq>\n  i_Exec_Comp_Stream_Init trans_fun input c\"\nby (simp add: iprefix_eq_iprefix_take i_Exec_Stream_Init_take)\n\ntheorem f_Exec_Stream_Init_prefix_strictly_causal[rule_format]:\"\n  n \\<le> length (xs \\<sqinter> ys) \\<Longrightarrow>\n  f_Exec_Comp_Stream_Init trans_fun xs c \\<down> Suc n =\n  f_Exec_Comp_Stream_Init trans_fun ys c \\<down> Suc n\"\nby (rule f_Exec_Stream_Init_strictly_causal, rule inf_prefix_take_correct)\n\ntext \\<open>\n  A predicate indicating\n  whether a component is deterministically dependent\n  on the local state extracted by the the given local state function.\\<close>\ndefinition Deterministic_Trans_Fun ::\n    \"('comp, 'input) Comp_Trans_Fun \\<Rightarrow> ('comp, 'state) Comp_Local_State \\<Rightarrow> bool\"\n  where \"Deterministic_Trans_Fun trans_fun localState \\<equiv>\n    \\<forall>c1 c2 x. localState c1 = localState c2 \\<longrightarrow> trans_fun x c1 = trans_fun x c2\"\n\nlemma Deterministic_f_Exec: \"\n  \\<lbrakk> Deterministic_Trans_Fun trans_fun localState; localState c1 = localState c2; xs \\<noteq> [] \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp trans_fun xs c1 = f_Exec_Comp trans_fun xs c2\"\napply (unfold Deterministic_Trans_Fun_def)\napply (case_tac xs, simp)\napply (rename_tac y ys)\napply (drule_tac x=c1 in spec)\napply (drule_tac x=c2 in spec)\napply simp\ndone\n\nlemma Deterministic_f_Exec_Stream: \"\n  \\<lbrakk> Deterministic_Trans_Fun trans_fun localState; localState c1 = localState c2 \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun xs c1 = f_Exec_Comp_Stream trans_fun xs c2\"\napply (clarsimp simp: list_eq_iff f_Exec_Stream_nth)\napply (rule Deterministic_f_Exec)\napply (simp add: length_greater_0_conv[THEN iffD1, OF gr_implies_gr0])+\ndone\n\nlemma Deterministic_i_Exec_Stream: \"\n  \\<lbrakk> Deterministic_Trans_Fun trans_fun localState; localState c1 = localState c2 \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream trans_fun input c1 = i_Exec_Comp_Stream trans_fun input c2\"\napply (clarsimp simp: ilist_eq_iff i_Exec_Stream_nth)\napply (rule Deterministic_f_Exec)\napply simp+\ndone\n\n\nsubsubsection \\<open>Connected streams\\<close>\n\ntext \\<open>\n  A predicate indicating for two message streams,\n  that the ports, they correspond to, are connected.\n  The predicate implies strict causality.\\<close>\n\ndefinition f_Streams_Connected :: \"'a fstream_af \\<Rightarrow> 'a fstream_af \\<Rightarrow> bool\"\n  where \"f_Streams_Connected outS inS \\<equiv> inS = \\<NoMsg> # outS\"\n\ndefinition i_Streams_Connected :: \"'a istream_af \\<Rightarrow> 'a istream_af \\<Rightarrow> bool\"\n  where \"i_Streams_Connected outS inS \\<equiv> inS = [\\<NoMsg>] \\<frown> outS\"\n\nlemmas Streams_Connected_defs =\n  f_Streams_Connected_def\n  i_Streams_Connected_def\n\nlemma f_Streams_Connected_imp_not_empty: \"f_Streams_Connected outS inS \\<Longrightarrow> inS \\<noteq> []\"\nby (simp add: f_Streams_Connected_def)\n\nlemma f_Streams_Connected_nth_conv: \"\n  f_Streams_Connected outS inS =\n  (length inS = Suc (length outS) \\<and>\n  (\\<forall>i<length inS. inS ! i = (case i of 0 \\<Rightarrow> \\<NoMsg> | Suc k \\<Rightarrow> outS ! k)))\"\nby (simp add: f_Streams_Connected_def list_eq_iff nth_Cons)\n\nlemma f_Streams_Connected_nth_conv_if: \"\n  f_Streams_Connected outS inS =\n  (length inS = Suc (length outS) \\<and>\n  (\\<forall>i<length inS. inS ! i = (if i = 0 then \\<NoMsg> else outS ! (i - Suc 0))))\"\napply (subst f_Streams_Connected_nth_conv)\napply (rule conj_cong, simp)\napply (rule all_imp_eqI, simp)\napply (rename_tac i, case_tac i, simp+)\ndone\n\nlemma i_Streams_Connected_nth_conv: \"\n  i_Streams_Connected outS inS =\n  (\\<forall>i. inS i = (case i of 0 \\<Rightarrow> \\<NoMsg> | Suc k \\<Rightarrow> outS k))\"\nby (simp add: i_Streams_Connected_def ilist_eq_iff i_append_nth_Cons)\n\nlemma i_Streams_Connected_nth_conv_if: \"\n  i_Streams_Connected outS inS =\n  (\\<forall>i. inS i = (if i = 0 then \\<NoMsg> else outS (i - Suc 0)))\"\napply (subst i_Streams_Connected_nth_conv)\napply (rule all_eqI)\napply (rename_tac i, case_tac i, simp+)\ndone\n\n\nlemma f_Exec_Stream_Init_eq_output_channel: \"\n  \\<lbrakk> output_fun c = \\<NoMsg>;\n    f_Streams_Connected\n      (map output_fun (f_Exec_Comp_Stream trans_fun xs c))\n      channel \\<rbrakk> \\<Longrightarrow>\n  map output_fun (f_Exec_Comp_Stream_Init trans_fun xs c) = channel\"\nby (simp add: f_Streams_Connected_def f_Exec_Stream_Init_eq_f_Exec_Stream_Cons)\n\nlemma i_Exec_Stream_Init_eq_output_channel: \"\n  \\<lbrakk> output_fun c = \\<NoMsg>;\n    i_Streams_Connected\n      (output_fun \\<circ> (i_Exec_Comp_Stream trans_fun input c))\n      channel \\<rbrakk> \\<Longrightarrow>\n  output_fun \\<circ> (i_Exec_Comp_Stream_Init trans_fun input c) = channel\"\nby (simp add: i_Streams_Connected_def i_Exec_Stream_Init_eq_i_Exec_Stream_Cons)\n\n\nlemma f_Exec_Stream_output_causal: \"\n  \\<lbrakk> xs \\<down> n = ys \\<down> n;\n    output1 = map output_fun (f_Exec_Comp_Stream trans_fun xs c);\n    output2 = map output_fun (f_Exec_Comp_Stream trans_fun ys c) \\<rbrakk> \\<Longrightarrow>\n  output1 \\<down> n = output2 \\<down> n\"\nby (simp add: take_map f_Exec_Stream_causal[of n xs])\n\nlemma f_Exec_Stream_Init_output_strictly_causal: \"\n  \\<lbrakk> xs \\<down> n = ys \\<down> n;\n    output1 = map output_fun (f_Exec_Comp_Stream_Init trans_fun xs c);\n    output2 = map output_fun (f_Exec_Comp_Stream_Init trans_fun ys c) \\<rbrakk> \\<Longrightarrow>\n  output1 \\<down> Suc n = output2 \\<down> Suc n\"\nby (simp add: take_map f_Exec_Stream_Init_strictly_causal[of n xs])\n\nlemma i_Exec_Stream_output_causal: \"\n  \\<lbrakk> input1 \\<Down> n = input2 \\<Down> n;\n    output1 = output_fun \\<circ> i_Exec_Comp_Stream trans_fun input1 c;\n    output2 = output_fun \\<circ> i_Exec_Comp_Stream trans_fun input2 c \\<rbrakk> \\<Longrightarrow>\n  output1 \\<Down> n = output2 \\<Down> n\"\nby (simp add: i_Exec_Stream_causal[of n input1])\n\nlemma i_Exec_Stream_Init_output_strictly_causal: \"\n  \\<lbrakk> input1 \\<Down> n = input2 \\<Down> n;\n    output1 = output_fun \\<circ> i_Exec_Comp_Stream_Init trans_fun input1 c;\n    output2 = output_fun \\<circ> i_Exec_Comp_Stream_Init trans_fun input2 c \\<rbrakk> \\<Longrightarrow>\n  output1 \\<Down> Suc n = output2 \\<Down> Suc n\"\nby (simp add: i_Exec_Stream_Init_strictly_causal[of n input1])\n\nlemma f_Exec_Stream_Connected_strictly_causal: \"\n  \\<lbrakk> xs \\<down> n = ys \\<down> n;\n    f_Streams_Connected\n      (map output_fun (f_Exec_Comp_Stream trans_fun xs c))\n      channel1;\n    f_Streams_Connected\n      (map output_fun (f_Exec_Comp_Stream trans_fun ys c))\n      channel2 \\<rbrakk> \\<Longrightarrow>\n  channel1 \\<down> Suc n = channel2 \\<down> Suc n\"\nby (simp add: f_Streams_Connected_def take_map f_Exec_Stream_take)\n\nlemma i_Exec_Stream_Connected_strictly_causal: \"\n  \\<lbrakk> input1 \\<Down> n = input2 \\<Down> n;\n    i_Streams_Connected\n      (portOutput \\<circ> (i_Exec_Comp_Stream trans_fun input1 c))\n      channel1;\n    i_Streams_Connected\n      (portOutput \\<circ> (i_Exec_Comp_Stream trans_fun input2 c))\n      channel2 \\<rbrakk> \\<Longrightarrow>\n  channel1 \\<Down> Suc n = channel2 \\<Down> Suc n\"\nby (simp add: i_Streams_Connected_def i_take_Suc_Cons i_Exec_Stream_take)\n\n\ntext \\<open>\n  A predicate for the semantics with initial state in result stream\n  indicating for two message streams that the ports, they correspond to, are connected.\\<close>\ndefinition f_Streams_Connected_Init :: \"'a fstream_af \\<Rightarrow> 'a fstream_af \\<Rightarrow> bool\"\n  where \"f_Streams_Connected_Init outS inS \\<equiv> inS = outS\"\n\ndefinition i_Streams_Connected_Init :: \"'a istream_af \\<Rightarrow> 'a istream_af \\<Rightarrow> bool\"\n  where \"i_Streams_Connected_Init outS inS \\<equiv> inS = outS\"\n\nlemmas Streams_Connected_Init_defs =\n  f_Streams_Connected_Init_def\n  i_Streams_Connected_Init_def\n\nlemma f_Streams_Connected_Init_nth_conv: \"\n  f_Streams_Connected_Init outS inS =\n  (length inS = length outS \\<and> (\\<forall>i<length inS. inS ! i = outS ! i))\"\nby (simp add: f_Streams_Connected_Init_def list_eq_iff)\n\nlemma i_Streams_Connected_Init_nth_conv: \"\n  i_Streams_Connected_Init outS inS =\n  (\\<forall>i. inS i = outS i)\"\nby (simp add: i_Streams_Connected_Init_def ilist_eq_iff)\n\n\nlemma f_Exec_Stream_Init_eq_output_channel2: \"\n  \\<lbrakk> output_fun c = \\<NoMsg>;\n    f_Streams_Connected_Init\n      (map output_fun (f_Exec_Comp_Stream_Init trans_fun xs c))\n      channel \\<rbrakk> \\<Longrightarrow>\n  map output_fun (f_Exec_Comp_Stream_Init trans_fun xs c) = channel\"\nby (simp add: f_Streams_Connected_Init_def f_Exec_Stream_Init_eq_f_Exec_Stream_Cons)\nlemma i_Exec_Stream_Init_eq_output_channel2: \"\n  \\<lbrakk> output_fun c = \\<NoMsg>;\n    i_Streams_Connected_Init\n      (output_fun \\<circ> (i_Exec_Comp_Stream_Init trans_fun input c))\n      channel \\<rbrakk> \\<Longrightarrow>\n  output_fun \\<circ> (i_Exec_Comp_Stream_Init trans_fun input c) = channel\"\nby (simp add: i_Streams_Connected_Init_def i_Exec_Stream_Init_eq_i_Exec_Stream_Cons)\n\nlemma f_Exec_Stream_Connected_Init_strictly_causal: \"\n  \\<lbrakk> xs \\<down> n = ys \\<down> n;\n    f_Streams_Connected_Init\n      (map output_fun (f_Exec_Comp_Stream_Init trans_fun xs c))\n      channel1;\n    f_Streams_Connected_Init\n      (map output_fun (f_Exec_Comp_Stream_Init trans_fun ys c))\n      channel2 \\<rbrakk> \\<Longrightarrow>\n  channel1 \\<down> Suc n = channel2 \\<down> Suc n\"\nby (simp add: f_Streams_Connected_Init_def f_Exec_Stream_Init_eq_f_Exec_Stream_Cons take_map f_Exec_Stream_take)\n\nlemma i_Exec_Stream_Connected_Init_strictly_causal: \"\n  \\<lbrakk> input1 \\<Down> n = input2 \\<Down> n;\n    i_Streams_Connected_Init\n      (portOutput \\<circ> (i_Exec_Comp_Stream_Init trans_fun input1 c))\n      channel1;\n    i_Streams_Connected_Init\n      (portOutput \\<circ> (i_Exec_Comp_Stream_Init trans_fun input2 c))\n      channel2 \\<rbrakk> \\<Longrightarrow>\n  channel1 \\<Down> Suc n = channel2 \\<Down> Suc n\"\nby (simp add: i_Streams_Connected_Init_def i_Exec_Stream_Init_eq_i_Exec_Stream_Cons i_Exec_Stream_take)\n\n\nsubsubsection \\<open>Additional auxiliary results\\<close>\n\ntext \\<open>The following lemma shows that,\n  if the system state is different at some time points\n  with respect to a certain predicate @{term P},\n  then there exists a defined time point between these two,\n  where the state change has taken place\\<close>\n\nlemma f_State_Change_exists_set: \"\n  \\<lbrakk> n1 \\<le> n2; n1 \\<in> I; n2 \\<in> I;\n    \\<not> P (f_Exec_Comp trans_fun (input \\<down> n1) c);\n    P (f_Exec_Comp trans_fun (input \\<down> n2) c) \\<rbrakk> \\<Longrightarrow>\n  \\<exists>n\\<in>I. n1 \\<le> n \\<and> n < n2 \\<and>\n    \\<not> P (f_Exec_Comp trans_fun (input \\<down> n) c) \\<and>\n    P (f_Exec_Comp trans_fun (input \\<down> (inext n I)) c)\"\nby (rule inext_predicate_change_exists)\n\nlemma f_State_Change_exists: \"\n  \\<lbrakk> n1 \\<le> n2;\n    \\<not> P (f_Exec_Comp trans_fun (input \\<down> n1) c);\n    P (f_Exec_Comp trans_fun (input \\<down> n2) c) \\<rbrakk> \\<Longrightarrow>\n  \\<exists>n\\<ge>n1. n < n2 \\<and>\n    \\<not> P (f_Exec_Comp trans_fun (input \\<down> n) c) \\<and>\n    P (f_Exec_Comp trans_fun (input \\<down> (Suc n)) c)\"\nby (rule nat_Suc_predicate_change_exists)\n\nlemma i_State_Change_exists_set: \"\n  \\<lbrakk> n1 \\<le> n2; n1 \\<in> I; n2 \\<in> I;\n    \\<not> P (i_Exec_Comp_Stream trans_fun input c n1);\n    P (i_Exec_Comp_Stream trans_fun input c n2) \\<rbrakk> \\<Longrightarrow>\n  \\<exists>n\\<in>I. n1 \\<le> n \\<and> n < n2 \\<and>\n    \\<not> P (i_Exec_Comp_Stream trans_fun input c n) \\<and>\n    P (i_Exec_Comp_Stream trans_fun input c (inext n I))\"\nby (rule inext_predicate_change_exists)\n\nlemma i_State_Change_exists: \"\n  \\<lbrakk> n1 \\<le> n2;\n    \\<not> P (i_Exec_Comp_Stream trans_fun input c n1);\n    P (i_Exec_Comp_Stream trans_fun input c n2) \\<rbrakk> \\<Longrightarrow>\n  \\<exists>n\\<ge>n1. n < n2 \\<and>\n    \\<not> P (i_Exec_Comp_Stream trans_fun input c n) \\<and>\n    P (i_Exec_Comp_Stream trans_fun input c (Suc n))\"\nby (rule nat_Suc_predicate_change_exists)\n\nlemma i_State_Change_Init_exists_set: \"\n  \\<lbrakk> n1 \\<le> n2; n1 \\<in> I; n2 \\<in> I;\n    \\<not> P (i_Exec_Comp_Stream_Init trans_fun input c n1);\n    P (i_Exec_Comp_Stream_Init trans_fun input c n2) \\<rbrakk> \\<Longrightarrow>\n  \\<exists>n\\<in>I. n1 \\<le> n \\<and> n < n2 \\<and>\n    \\<not> P (i_Exec_Comp_Stream_Init trans_fun input c n) \\<and>\n    P (i_Exec_Comp_Stream_Init trans_fun input c (inext n I))\"\nby (rule inext_predicate_change_exists)\n\nlemma i_State_Change_Init_exists: \"\n  \\<lbrakk> n1 \\<le> n2;\n    \\<not> P (i_Exec_Comp_Stream_Init trans_fun input c n1);\n    P (i_Exec_Comp_Stream_Init trans_fun input c n2) \\<rbrakk> \\<Longrightarrow>\n  \\<exists>n\\<ge>n1. n < n2 \\<and>\n    \\<not> P (i_Exec_Comp_Stream_Init trans_fun input c n) \\<and>\n    P (i_Exec_Comp_Stream_Init trans_fun input c (Suc n))\"\nby (rule nat_Suc_predicate_change_exists)\n\n\nsubsection \\<open>Components with accelerated execution\\<close>\n\ntext \\<open>\n  This section deals with variable execution speed components.\n  A component accelerated by a (clocking) factor @{term k}\n  processes streams expanded by factor @{term k}\n  and its output streams are compressed by factor @{term k}.\\<close>\n\n\nsubsubsection \\<open>Equivalence relation for executions\\<close>\n\ntext \\<open>\n  A predicate indicating for\n  two components together with transition functions\n  and a given equivalence predicate for their local states,\n  that the components exhibit equivalent observable behaviour\n  after expanding input streams and shrinking output streams\n  by a constant factor,\n  given that their local states are equivalent\n  with respect to the specified equivalence relations.\\<close>\n\ndefinition\n  Equiv_Exec :: \"\n    'input \\<Rightarrow>\n    ('state1 \\<Rightarrow> 'state2 \\<Rightarrow> bool) \\<Rightarrow> \\<comment> \\<open>Equivalence predicate for local states\\<close>\n    ('comp1, 'state1) Comp_Local_State \\<Rightarrow>\n    ('comp2, 'state2) Comp_Local_State \\<Rightarrow>\n    ('input, 'input1) Port_Input_Value \\<Rightarrow> \\<comment> \\<open>Input adaptor for first component\\<close>\n    ('input, 'input2) Port_Input_Value \\<Rightarrow> \\<comment> \\<open>Input adaptor for second component\\<close>\n    ('comp1, 'output) Port_Output_Value \\<Rightarrow>\n    ('comp2, 'output) Port_Output_Value \\<Rightarrow>\n    ('comp1, 'input1 message_af) Comp_Trans_Fun \\<Rightarrow>\n    ('comp2, 'input2 message_af) Comp_Trans_Fun \\<Rightarrow>\n    nat \\<Rightarrow> nat \\<Rightarrow> 'comp1 \\<Rightarrow> 'comp2 \\<Rightarrow> bool\"\nwhere\n  \"Equiv_Exec\n    m equiv_states\n      localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n      trans_fun1 trans_fun2 k1 k2 c1 c2 \\<equiv>\n    equiv_states (localState1 c1) (localState2 c2) \\<longrightarrow> (\n      last_message (map output_fun1 (\n        f_Exec_Comp_Stream trans_fun1 (input_fun1 m # \\<NoMsg>\\<^bsup>k1 - Suc 0\\<^esup>) c1)) =\n      last_message (map output_fun2 (\n        f_Exec_Comp_Stream trans_fun2 (input_fun2 m # \\<NoMsg>\\<^bsup>k2 - Suc 0\\<^esup>) c2)) \\<and>\n      equiv_states\n        (localState1 (f_Exec_Comp trans_fun1 (input_fun1 m # \\<NoMsg>\\<^bsup>k1 - Suc 0\\<^esup>) c1))\n        (localState2 (f_Exec_Comp trans_fun2 (input_fun2 m # \\<NoMsg>\\<^bsup>k2 - Suc 0\\<^esup>) c2)))\"\n\ntext \\<open>\n  Predicate indicating for\n  two components together with transition functions\n  and a given equivalence predicate for their local states,\n  that the equivalence predicate is stable\n  with respect to component execution,\n  i.e., it determines the equivalence\n  of components' local states\n  both for the initial states and after the components\n  have processed an arbitrary input.\n  The restricting version @{term \"Equiv_Exec_stable_set\"}\n  guarantees stability only for inputs from a given restriction set,\n  the not-restricting version guarantees stability for all inputs.\\<close>\ndefinition\n  Equiv_Exec_stable_set :: \"\n    'input set \\<Rightarrow>\n    ('state1 \\<Rightarrow> 'state2 \\<Rightarrow> bool) \\<Rightarrow> \\<comment> \\<open>Equivalence predicate for local states\\<close>\n    ('comp1, 'state1) Comp_Local_State \\<Rightarrow>\n    ('comp2, 'state2) Comp_Local_State \\<Rightarrow>\n    ('input, 'input1) Port_Input_Value \\<Rightarrow> \\<comment> \\<open>Input adaptor for first component\\<close>\n    ('input, 'input2) Port_Input_Value \\<Rightarrow> \\<comment> \\<open>Input adaptor for second component\\<close>\n    ('comp1, 'output) Port_Output_Value \\<Rightarrow>\n    ('comp2, 'output) Port_Output_Value \\<Rightarrow>\n    ('comp1, 'input1 message_af) Comp_Trans_Fun \\<Rightarrow>\n    ('comp2, 'input2 message_af) Comp_Trans_Fun \\<Rightarrow>\n    nat \\<Rightarrow> nat \\<Rightarrow> 'comp1 \\<Rightarrow> 'comp2 \\<Rightarrow> bool\"\nwhere\n  \"Equiv_Exec_stable_set A\n    equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n    trans_fun1 trans_fun2 k1 k2 c1 c2 \\<equiv>\n   \\<forall>input m. set input \\<subseteq> A \\<and> m \\<in> A \\<longrightarrow>\n     Equiv_Exec m\n       equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n       trans_fun1 trans_fun2 k1 k2\n       (f_Exec_Comp trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1)\n       (f_Exec_Comp trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2)\"\n\ndefinition\n  Equiv_Exec_stable :: \"\n    ('state1 \\<Rightarrow> 'state2 \\<Rightarrow> bool) \\<Rightarrow> \\<comment> \\<open>Equivalence predicate for local states\\<close>\n    ('comp1, 'state1) Comp_Local_State \\<Rightarrow>\n    ('comp2, 'state2) Comp_Local_State \\<Rightarrow>\n    ('input, 'input1) Port_Input_Value \\<Rightarrow> \\<comment> \\<open>Input adaptor for first component\\<close>\n    ('input, 'input2) Port_Input_Value \\<Rightarrow> \\<comment> \\<open>Input adaptor for second component\\<close>\n    ('comp1, 'output) Port_Output_Value \\<Rightarrow>\n    ('comp2, 'output) Port_Output_Value \\<Rightarrow>\n    ('comp1, 'input1 message_af) Comp_Trans_Fun \\<Rightarrow>\n    ('comp2, 'input2 message_af) Comp_Trans_Fun \\<Rightarrow>\n    nat \\<Rightarrow> nat \\<Rightarrow> 'comp1 \\<Rightarrow> 'comp2 \\<Rightarrow> bool\"\nwhere\n  \"Equiv_Exec_stable\n    equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n    trans_fun1 trans_fun2 k1 k2 c1 c2 \\<equiv>\n   \\<forall>input m.\n     Equiv_Exec m\n       equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n       trans_fun1 trans_fun2 k1 k2\n       (f_Exec_Comp trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1)\n       (f_Exec_Comp trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2)\"\n\nlemma Equiv_Exec_equiv_statesI: \"\n  \\<lbrakk> equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec\n      m equiv_states\n        localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n        trans_fun1 trans_fun2 k1 k2 c1 c2 \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n    (localState1 (f_Exec_Comp trans_fun1 (input_fun1 m # \\<NoMsg>\\<^bsup>k1 - Suc 0\\<^esup>) c1))\n    (localState2 (f_Exec_Comp trans_fun2 (input_fun2 m # \\<NoMsg>\\<^bsup>k2 - Suc 0\\<^esup>) c2))\"\nby (simp add: Equiv_Exec_def)\n\nlemma Equiv_Exec_output_eqI: \"\n  \\<lbrakk> equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec\n      m equiv_states\n      localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n        trans_fun1 trans_fun2 k1 k2 c1 c2 \\<rbrakk> \\<Longrightarrow>\n  last_message (map output_fun1 (\n    f_Exec_Comp_Stream trans_fun1 (input_fun1 m # \\<NoMsg>\\<^bsup>k1 - Suc 0\\<^esup>) c1)) =\n  last_message (map output_fun2 (\n    f_Exec_Comp_Stream trans_fun2 (input_fun2 m # \\<NoMsg>\\<^bsup>k2 - Suc 0\\<^esup>) c2))\"\nby (simp add: Equiv_Exec_def)\n\nlemma Equiv_Exec_equiv_statesI': \"\n  \\<lbrakk> equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec\n      m equiv_states\n        localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n        trans_fun1 trans_fun2 k1 k2 c1 c2 \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n   (localState1 (f_Exec_Comp trans_fun1 NoMsg\\<^bsup>k1 - Suc 0\\<^esup> (trans_fun1 (input_fun1 m) c1)))\n   (localState2 (f_Exec_Comp trans_fun2 NoMsg\\<^bsup>k2 - Suc 0\\<^esup> (trans_fun2 (input_fun2 m) c2)))\"\nby (simp add: Equiv_Exec_def)\n\nlemma Equiv_Exec_le1: \"\n  \\<lbrakk> k1 \\<le> Suc 0; k2 \\<le> Suc 0;\n    equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec m\n      equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n      trans_fun1 trans_fun2 k1 k2 c1 c2 \\<rbrakk> \\<Longrightarrow>\n  output_fun1 (trans_fun1 (input_fun1 m) c1) =\n  output_fun2 (trans_fun2 (input_fun2 m) c2) \\<and>\n  equiv_states\n    (localState1 (trans_fun1 (input_fun1 m) c1))\n    (localState2 (trans_fun2 (input_fun2 m) c2))\"\nby (simp add: Equiv_Exec_def)\n\n\nlemma Equiv_Exec_stable_set_UNIV: \"\n  Equiv_Exec_stable_set\n    UNIV equiv_states\n    localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n    trans_fun1 trans_fun2 k1 k2 c1 c2 =\n  Equiv_Exec_stable\n    equiv_states\n    localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n    trans_fun1 trans_fun2 k1 k2 c1 c2\"\nby (simp add: Equiv_Exec_stable_set_def Equiv_Exec_stable_def)\n\nlemma Equiv_Exec_stable_setI: \"\n  \\<lbrakk> Equiv_Exec_stable_set A\n    equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n    trans_fun1 trans_fun2 k1 k2 c1 c2;\n    set input \\<subseteq> A; m \\<in> A \\<rbrakk> \\<Longrightarrow>\n  Equiv_Exec\n        m equiv_states\n        localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n        trans_fun1 trans_fun2 k1 k2\n        (f_Exec_Comp trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1)\n        (f_Exec_Comp trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2)\"\nby (simp add: Equiv_Exec_stable_set_def)\n\nlemma Equiv_Exec_stableI: \"\n  Equiv_Exec_stable\n    equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n    trans_fun1 trans_fun2 k1 k2 c1 c2 \\<Longrightarrow>\n  Equiv_Exec m\n    equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n    trans_fun1 trans_fun2 k1 k2\n    (f_Exec_Comp trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1)\n    (f_Exec_Comp trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2)\"\nby (simp add: Equiv_Exec_stable_def)\n\n\ntext \\<open>Reflexitity, symmetry and transitivity results for @{term \"Equiv_Exec\"}\\<close>\n\nlemma Equiv_Exec_refl: \"\n  \\<lbrakk> \\<And>c. equiv_states (localState c) (localState c) \\<rbrakk> \\<Longrightarrow>\n  Equiv_Exec\n    m equiv_states\n    localState localState input_fun input_fun output_fun output_fun\n    trans_fun trans_fun k k c c\"\nby (simp add: Equiv_Exec_def)\n\nlemma Equiv_Exec_sym[rule_format]: \"\n  \\<lbrakk> \\<forall>c1 c2.\n      equiv_states (localState1 c1) (localState2 c2) =\n      equiv_states (localState2 c2) (localState1 c1) \\<rbrakk> \\<Longrightarrow>\n  Equiv_Exec\n    m equiv_states\n    localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n    trans_fun1 trans_fun2 k1 k2 c1 c2 =\n  Equiv_Exec\n    m equiv_states\n    localState2 localState1 input_fun2 input_fun1 output_fun2 output_fun1\n    trans_fun2 trans_fun1 k2 k1 c2 c1\"\nby (fastforce simp: Equiv_Exec_def)\n\nlemma Equiv_Exec_sym2: \"\n  \\<lbrakk> equiv_states_sym = (\\<lambda>s1 s2. equiv_states s2 s1) \\<rbrakk> \\<Longrightarrow>\n  Equiv_Exec\n    m equiv_states\n    localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n    trans_fun1 trans_fun2 k1 k2 c1 c2 =\n  Equiv_Exec\n    m equiv_states_sym\n    localState2 localState1 input_fun2 input_fun1 output_fun2 output_fun1\n    trans_fun2 trans_fun1 k2 k1 c2 c1\"\nby (fastforce simp: Equiv_Exec_def)\n\nlemma Equiv_Exec_sym2_ex: \"\n  \\<exists>equiv_states_sym.\n    Equiv_Exec\n      m equiv_states\n      localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n      trans_fun1 trans_fun2 k1 k2 c1 c2 =\n    Equiv_Exec\n      m equiv_states_sym\n      localState2 localState1 input_fun2 input_fun1 output_fun2 output_fun1\n      trans_fun2 trans_fun1 k2 k1 c2 c1\"\nby (rule exI, rule Equiv_Exec_sym2, simp)\n\nlemma Equiv_Exec_trans: \"\n  \\<lbrakk> Equiv_Exec\n      m equiv_states12\n      localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n      trans_fun1 trans_fun2 k1 k2 c1 c2;\n    Equiv_Exec\n      m equiv_states23\n      localState2 localState3 input_fun2 input_fun3 output_fun2 output_fun3\n      trans_fun2 trans_fun3 k2 k3 c2 c3;\n    equiv_states13 = (\\<lambda>s1 s3. (\n      if s1 = localState1 c1 \\<and> s3 = localState3 c3 then\n        equiv_states12 s1 (localState2 c2) \\<and>\n        equiv_states23 (localState2 c2) s3\n      else\n        equiv_states12 s1 (\n          localState2 (f_Exec_Comp trans_fun2 (input_fun2 m # \\<NoMsg>\\<^bsup>k2 - Suc 0\\<^esup>) c2))) \\<and>\n        equiv_states23 (\n          localState2 (f_Exec_Comp trans_fun2 (input_fun2 m # \\<NoMsg>\\<^bsup>k2 - Suc 0\\<^esup>) c2)) s3) \\<rbrakk> \\<Longrightarrow>\n    Equiv_Exec\n      m equiv_states13\n      localState1 localState3 input_fun1 input_fun3 output_fun1 output_fun3\n      trans_fun1 trans_fun3 k1 k3 c1 c3\"\nby (fastforce simp: Equiv_Exec_def)\n\nlemma Equiv_Exec_trans_ex: \"\n  \\<lbrakk> Equiv_Exec\n      m equiv_states12\n      localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n      trans_fun1 trans_fun2 k1 k2 c1 c2;\n    Equiv_Exec\n      m equiv_states23\n      localState2 localState3 input_fun2 input_fun3 output_fun2 output_fun3\n      trans_fun2 trans_fun3 k2 k3 c2 c3 \\<rbrakk> \\<Longrightarrow>\n    \\<exists>equiv_states13. Equiv_Exec\n      m equiv_states13\n      localState1 localState3 input_fun1 input_fun3 output_fun1 output_fun3\n      trans_fun1 trans_fun3 k1 k3 c1 c3\"\nby (blast intro: Equiv_Exec_trans)\n\n\ntext \\<open>A predicate indicating for\n  a given local state extraction function and\n  a given transition function,\n  that components, whose states are equal with regard to the\n  local state extraction function,\n  are transformed into equal componenents,\n  when the transition function is applied with the same input.\\<close>\ndefinition Exec_Equal_State ::\n    \"('comp, 'state) Comp_Local_State \\<Rightarrow> ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow> bool\"\n  where \"Exec_Equal_State localState trans_fun \\<equiv>\n    \\<forall>c1 c2 m. localState c1 = localState c2 \\<longrightarrow> trans_fun m c1 = trans_fun m c2\"\n\nlemma Exec_Equal_StateD: \"\n  \\<lbrakk> Exec_Equal_State localState trans_fun;\n    localState c1 = localState c2 \\<rbrakk> \\<Longrightarrow>\n  trans_fun m c1 = trans_fun m c2\"\nby (unfold Exec_Equal_State_def, blast)\n\nlemma Exec_Equal_StateD': \"\n  Exec_Equal_State localState trans_fun \\<Longrightarrow>\n  \\<forall>c1 c2 m. localState c1 = localState c2 \\<longrightarrow> trans_fun m c1 = trans_fun m c2\"\nby (unfold Exec_Equal_State_def, blast)\n\nlemma Exec_Equal_StateI: \"\n  (\\<And>c1 c2 m. localState c1 = localState c2 \\<Longrightarrow> trans_fun m c1 = trans_fun m c2)\n  \\<Longrightarrow> Exec_Equal_State localState trans_fun\"\nby (unfold Exec_Equal_State_def, blast)\n\nlemma f_Exec_Equal_State: \"\\<And>c1 c2.\n  \\<lbrakk> Exec_Equal_State localState trans_fun;\n    localState c1 = localState c2; xs \\<noteq> [] \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp trans_fun xs c1 = f_Exec_Comp trans_fun xs c2\"\napply (induct xs, simp)\napply (case_tac \"xs = []\")\n apply simp\n apply (rule Exec_Equal_StateD, assumption+)\napply (drule_tac x=\"trans_fun a c1\" in meta_spec)\napply (drule_tac x=\"trans_fun a c2\" in meta_spec)\napply (drule_tac ?c1.0=c1 and ?c2.0=c2 and m=a in Exec_Equal_StateD, assumption)\napply simp\ndone\n\nlemma f_Exec_Stream_Equal_State: \"\n  \\<lbrakk> Exec_Equal_State localState trans_fun;\n    localState c1 = localState c2 \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream trans_fun xs c1 =\n  f_Exec_Comp_Stream trans_fun xs c2\"\napply (clarsimp simp: list_eq_iff f_Exec_Stream_nth)\napply (drule gr_implies_gr0)\napply (rule f_Exec_Equal_State)\napply simp+\ndone\n\nlemma i_Exec_Stream_Equal_State: \"\n  \\<lbrakk> Exec_Equal_State localState trans_fun;\n    localState c1 = localState c2 \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream trans_fun input c1 =\n  i_Exec_Comp_Stream trans_fun input c2\"\napply (clarsimp simp: ilist_eq_iff i_Exec_Stream_nth)\napply (rule f_Exec_Equal_State)\napply simp+\ndone\n\n\nsubsubsection \\<open>Idle states\\<close>\n\ndefinition State_Idle ::\n  \"('comp, 'state) Comp_Local_State \\<Rightarrow> ('comp \\<Rightarrow> 'output message_af) \\<Rightarrow>\n    ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow> 'state \\<Rightarrow> bool\"\n  where \"State_Idle localState output_fun trans_fun state \\<equiv>\n    \\<forall>c. localState c = state \\<longrightarrow>\n      localState (trans_fun \\<NoMsg> c) = state \\<and>\n      output_fun (trans_fun \\<NoMsg> c) = \\<NoMsg>\"\n\nlemma State_IdleD: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun state;\n    localState c = state \\<rbrakk> \\<Longrightarrow>\n  localState (trans_fun \\<NoMsg> c) = state \\<and>\n  output_fun (trans_fun \\<NoMsg> c) = \\<NoMsg>\"\nby (unfold State_Idle_def, blast)\n\nlemma State_IdleD': \"\n  State_Idle localState output_fun trans_fun state \\<Longrightarrow>\n  \\<forall>c. localState c = state \\<longrightarrow>\n  localState (trans_fun \\<NoMsg> c) = state \\<and>\n  output_fun (trans_fun \\<NoMsg> c) = \\<NoMsg>\"\nby (unfold State_Idle_def, blast)\n\nlemma State_IdleI: \"\n  \\<lbrakk> \\<And>c. localState c = state \\<Longrightarrow>\n    localState (trans_fun \\<NoMsg> c) = state \\<and>\n    output_fun (trans_fun \\<NoMsg> c) = \\<NoMsg> \\<rbrakk> \\<Longrightarrow>\n  State_Idle localState output_fun trans_fun state\"\nby (unfold State_Idle_def, blast)\n\nlemma State_Idle_step[rule_format]: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (localState c) \\<rbrakk> \\<Longrightarrow>\n  State_Idle localState output_fun trans_fun (localState (trans_fun \\<NoMsg> c))\"\napply (frule State_IdleD[OF _ refl], erule conjE)\napply (rule State_IdleI, rename_tac c0)\napply (drule_tac c=c0 in State_IdleD)\napply simp+\ndone\n\nlemma f_Exec_State_Idle_replicate_NoMsg_state[rule_format]: \"\n  \\<And>c. State_Idle localState output_fun trans_fun (localState c) \\<Longrightarrow>\n  localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>n\\<^esup> c) = localState c\"\napply (induct n, simp)\napply (frule State_Idle_step)\napply (drule_tac c=c in State_IdleD, rule refl)\napply simp\ndone\n\n\nlemma f_Exec_State_Idle_replicate_NoMsg_gr0_output[rule_format]: \"\\<And>c.\n  \\<lbrakk> State_Idle localState output_fun trans_fun (localState c); 0 < n \\<rbrakk> \\<Longrightarrow>\n  output_fun (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>n\\<^esup> c) = \\<NoMsg>\"\napply (induct n, simp)\napply (case_tac \"n = 0\")\n apply simp\n apply (rule State_IdleD[THEN conjunct2], assumption, simp)\napply (drule State_Idle_step)\napply simp\ndone\n\nlemma f_Exec_State_Idle_replicate_NoMsg_output[rule_format]: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (localState c);\n    output_fun c = \\<NoMsg> \\<rbrakk> \\<Longrightarrow>\n  output_fun (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>n\\<^esup> c) = \\<NoMsg>\"\napply (case_tac \"n = 0\", simp)\napply (simp add: f_Exec_State_Idle_replicate_NoMsg_gr0_output)\ndone\n\nlemma f_Exec_Stream_State_Idle_replicate_NoMsg_output[rule_format]: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (localState c) \\<rbrakk> \\<Longrightarrow>\n  map output_fun (f_Exec_Comp_Stream trans_fun \\<NoMsg>\\<^bsup>n\\<^esup> c) = \\<NoMsg>\\<^bsup>n\\<^esup>\"\nby (simp add: list_eq_iff f_Exec_Stream_nth min_eqL f_Exec_State_Idle_replicate_NoMsg_gr0_output del: replicate.simps)\n\ncorollary f_Exec_State_Idle_append_replicate_NoMsg_state: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun xs c)) \\<rbrakk> \\<Longrightarrow>\n  localState (f_Exec_Comp trans_fun (xs @ \\<NoMsg>\\<^bsup>n\\<^esup>) c) =\n  localState (f_Exec_Comp trans_fun xs c)\"\nby (simp add: f_Exec_append f_Exec_State_Idle_replicate_NoMsg_state)\n\ncorollary f_Exec_State_Idle_append_replicate_NoMsg_ge_state: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun (xs @ \\<NoMsg>\\<^bsup>m\\<^esup>) c));\n    m \\<le> n \\<rbrakk> \\<Longrightarrow>\n  localState (f_Exec_Comp trans_fun (xs @ \\<NoMsg>\\<^bsup>n\\<^esup>) c) =\n  localState (f_Exec_Comp trans_fun (xs @ \\<NoMsg>\\<^bsup>m\\<^esup>) c)\"\napply (rule_tac t=n and s=\"m + (n - m)\" in subst, simp)\napply (simp only: replicate_add append_assoc[symmetric])\napply (rule f_Exec_State_Idle_append_replicate_NoMsg_state, simp)\ndone\n\ncorollary f_Exec_State_Idle_replicate_NoMsg_ge_state: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>m\\<^esup> c));\n    m \\<le> n \\<rbrakk> \\<Longrightarrow>\n  localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>n\\<^esup> c) =\n  localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>m\\<^esup> c)\"\nby (cut_tac f_Exec_State_Idle_append_replicate_NoMsg_ge_state[where xs=\"[]\"], simp+)\n\ncorollary f_Exec_State_Idle_append_replicate_NoMsg_gr0_output: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun xs c));\n    0 < n \\<rbrakk> \\<Longrightarrow>\n  output_fun (f_Exec_Comp trans_fun (xs @ \\<NoMsg>\\<^bsup>n\\<^esup>) c) = \\<NoMsg>\"\nby (simp add: f_Exec_append f_Exec_State_Idle_replicate_NoMsg_gr0_output)\n\ncorollary f_Exec_Stream_State_Idle_append_replicate_NoMsg_gr0_output: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun xs c)) \\<rbrakk> \\<Longrightarrow>\n  map output_fun (f_Exec_Comp_Stream trans_fun (xs @ \\<NoMsg>\\<^bsup>n\\<^esup>) c) =\n  map output_fun (f_Exec_Comp_Stream trans_fun xs c) @ \\<NoMsg>\\<^bsup>n\\<^esup>\"\nby (simp add: f_Exec_Stream_append f_Exec_Stream_State_Idle_replicate_NoMsg_output)\n\ncorollary f_Exec_State_Idle_append_replicate_NoMsg_gr_output: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun (xs @ \\<NoMsg>\\<^bsup>m\\<^esup>) c));\n    m < n \\<rbrakk> \\<Longrightarrow>\n  output_fun (f_Exec_Comp trans_fun (xs @ \\<NoMsg>\\<^bsup>n\\<^esup>) c) = \\<NoMsg>\"\napply (rule_tac t=n and s=\"m + (n - m)\" in subst, simp)\napply (simp only: replicate_add append_assoc[symmetric])\napply (rule f_Exec_State_Idle_append_replicate_NoMsg_gr0_output, simp+)\ndone\n\ncorollary f_Exec_State_Idle_append_replicate_NoMsg_ge_output: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun (xs @ \\<NoMsg>\\<^bsup>m\\<^esup>) c));\n    output_fun (f_Exec_Comp trans_fun (xs @ \\<NoMsg>\\<^bsup>m\\<^esup>) c) = \\<NoMsg>; m \\<le> n \\<rbrakk> \\<Longrightarrow>\n  output_fun (f_Exec_Comp trans_fun (xs @ \\<NoMsg>\\<^bsup>n\\<^esup>) c) = \\<NoMsg>\"\nby (fastforce simp: order_le_less f_Exec_State_Idle_append_replicate_NoMsg_gr_output)\n\ncorollary f_Exec_State_Idle_replicate_NoMsg_gr_output: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>m\\<^esup> c));\n    m < n \\<rbrakk> \\<Longrightarrow>\n  output_fun (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>n\\<^esup> c) = \\<NoMsg>\"\nby (cut_tac xs=\"[]\" in f_Exec_State_Idle_append_replicate_NoMsg_gr_output, simp+)\n\ncorollary f_Exec_State_Idle_replicate_NoMsg_ge_output: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>m\\<^esup> c));\n    output_fun (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>m\\<^esup> c) = \\<NoMsg>; m \\<le> n \\<rbrakk> \\<Longrightarrow>\n  output_fun (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>n\\<^esup> c) = \\<NoMsg>\"\nby (fastforce simp: order_le_less f_Exec_State_Idle_replicate_NoMsg_gr_output)\n\n\nlemma State_Idle_append_replicate_NoMsg_output_last_message: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun xs c)) \\<rbrakk> \\<Longrightarrow>\n  last_message (map output_fun (f_Exec_Comp_Stream trans_fun (xs @ \\<NoMsg>\\<^bsup>n\\<^esup>) c)) =\n  last_message (map output_fun (f_Exec_Comp_Stream trans_fun xs c))\"\nby (simp add: f_Exec_Stream_State_Idle_append_replicate_NoMsg_gr0_output last_message_append_replicate_NoMsg)\n\nlemma State_Idle_append_replicate_NoMsg_output_Msg_eq_last_message: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun xs c));\n    output_fun (f_Exec_Comp trans_fun xs c) \\<noteq> \\<NoMsg>;\n    xs \\<noteq> [] \\<rbrakk> \\<Longrightarrow>\n  last_message (map output_fun (f_Exec_Comp_Stream trans_fun (xs @ \\<NoMsg>\\<^bsup>n\\<^esup>) c)) =\n  output_fun (f_Exec_Comp trans_fun xs c)\"\napply (simp add: State_Idle_append_replicate_NoMsg_output_last_message f_Exec_eq_f_Exec_Stream_last2 )\napply (subst last_message_Msg_eq_last)\napply (simp add: map_last f_Exec_Stream_not_empty_conv)+\ndone\n\ncorollary State_Idle_output_Msg_eq_last_message: \"\n  \\<lbrakk> State_Idle localState output_fun trans_fun (\n      localState (f_Exec_Comp trans_fun xs c));\n    output_fun (f_Exec_Comp trans_fun xs c) \\<noteq> \\<NoMsg>;\n    xs \\<noteq> [] \\<rbrakk> \\<Longrightarrow>\n  last_message (map output_fun (f_Exec_Comp_Stream trans_fun xs c)) =\n  output_fun (f_Exec_Comp trans_fun xs c)\"\nby (rule_tac n=0 in subst[OF State_Idle_append_replicate_NoMsg_output_Msg_eq_last_message, rule_format], simp+)\n\nlemma State_Idle_imp_exists_state_change: \"\n  \\<lbrakk> \\<not> State_Idle localState output_fun trans_fun (localState c);\n    State_Idle localState output_fun trans_fun (localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>n\\<^esup> c)) \\<rbrakk> \\<Longrightarrow>\n  \\<exists>i<n. (\n    \\<not> State_Idle localState output_fun trans_fun (localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>i\\<^esup> c)) \\<and> (\n    \\<forall>j\\<le>n. i < j \\<longrightarrow> State_Idle localState output_fun trans_fun (localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>j\\<^esup> c))))\"\napply (cut_tac\n  a=0 and b=n and\n  P=\"\\<lambda>x. State_Idle localState output_fun trans_fun (localState (f_Exec_Comp trans_fun NoMsg\\<^bsup>x\\<^esup> c))\"\n  in nat_Suc_predicate_change_exists, simp+)\napply (clarify, rename_tac n1)\napply (rule_tac x=n1 in exI)\napply clarsimp\napply (rule_tac t=\"j\" and s=\"Suc n1 + (j - Suc n1)\" in subst, simp)\napply (subst replicate_add)\napply (simp add: replicate_add f_Exec_State_Idle_append_replicate_NoMsg_state)\ndone\n\nlemma State_Idle_imp_exists_state_change2: \"\n  \\<lbrakk> \\<not> State_Idle localState output_fun trans_fun (localState c);\n    State_Idle localState output_fun trans_fun (localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>n\\<^esup> c)) \\<rbrakk> \\<Longrightarrow>\n  \\<exists>i<n. (\n    (\\<forall>j\\<le>i. \\<not> State_Idle localState output_fun trans_fun (localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>i\\<^esup> c))) \\<and>\n    (\\<forall>j\\<le>n. i < j \\<longrightarrow> State_Idle localState output_fun trans_fun (localState (f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>j\\<^esup> c))))\"\napply (frule State_Idle_imp_exists_state_change, assumption)\napply (clarify, rename_tac i)\napply (rule_tac x=i in exI)\napply simp\ndone\n\n\nsubsubsection \\<open>Basic definitions for accelerated execution\\<close>\n\ntext \\<open>Stream processing with accelerated components\\<close>\n\ndefinition f_Exec_Comp_Stream_Acc_Output ::\n  \"nat \\<Rightarrow> \\<comment> \\<open>Acceleration factor\\<close>\n    ('comp \\<Rightarrow> 'output message_af) \\<Rightarrow> \\<comment> \\<open>Output extraction function\\<close>\n    ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow>\n    'input fstream_af \\<Rightarrow> 'comp \\<Rightarrow>\n    'output fstream_af\"\n  where \"f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c \\<equiv>\n    (map output_fun (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c)) \\<div>\\<^sub>f k\"\n\ndefinition f_Exec_Comp_Stream_Acc_LocalState ::\n  \"nat \\<Rightarrow> \\<comment> \\<open>Acceleration factor\\<close>\n    ('comp \\<Rightarrow> 'state) \\<Rightarrow> \\<comment> \\<open>Local state extraction function\\<close>\n    ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow>\n    'input fstream_af \\<Rightarrow> 'comp \\<Rightarrow>\n    'state list\"\n  where \"f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c \\<equiv>\n    (map localState (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c)) \\<div>\\<^bsub>fl\\<^esub> k\"\n\ndefinition i_Exec_Comp_Stream_Acc_Output ::\n  \"nat \\<Rightarrow> \\<comment> \\<open>Acceleration factor\\<close>\n    ('comp \\<Rightarrow> 'output message_af) \\<Rightarrow> \\<comment> \\<open>Output extraction function\\<close>\n    ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow>\n    'input istream_af \\<Rightarrow> 'comp \\<Rightarrow>\n    'output istream_af\"\n  where \"i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c \\<equiv>\n    (output_fun \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c)) \\<div>\\<^sub>i k\"\n\ndefinition i_Exec_Comp_Stream_Acc_LocalState ::\n  \"nat \\<Rightarrow> \\<comment> \\<open>Acceleration factor\\<close>\n    ('comp \\<Rightarrow> 'state) \\<Rightarrow> \\<comment> \\<open>Local state extraction function\\<close>\n    ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow>\n    'input istream_af \\<Rightarrow> 'comp \\<Rightarrow>\n    'state ilist\"\n  where \"i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c \\<equiv>\n    (localState \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c)) \\<div>\\<^bsub>il\\<^esub> k\"\n\ndefinition f_Exec_Comp_Stream_Acc_Output_Init ::\n  \"nat \\<Rightarrow> \\<comment> \\<open>Acceleration factor\\<close>\n    ('comp \\<Rightarrow> 'output message_af) \\<Rightarrow> \\<comment> \\<open>Output extraction function\\<close>\n    ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow>\n    'input fstream_af \\<Rightarrow> 'comp \\<Rightarrow>\n    'output fstream_af\"\n  where \"f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c \\<equiv>\n    (output_fun c) # f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c\"\n\ndefinition f_Exec_Comp_Stream_Acc_LocalState_Init ::\n  \"nat \\<Rightarrow> \\<comment> \\<open>Acceleration factor\\<close>\n    ('comp \\<Rightarrow> 'state) \\<Rightarrow> \\<comment> \\<open>Local state extraction function\\<close>\n    ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow> 'input fstream_af \\<Rightarrow> 'comp \\<Rightarrow>\n    'state list\"\n  where \"f_Exec_Comp_Stream_Acc_LocalState_Init k localState trans_fun xs c \\<equiv>\n    (localState c) # f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c\"\n\ndefinition i_Exec_Comp_Stream_Acc_Output_Init ::\n  \"nat \\<Rightarrow> \\<comment> \\<open>Acceleration factor\\<close>\n    ('comp \\<Rightarrow> 'output message_af) \\<Rightarrow> \\<comment> \\<open>Output extraction function\\<close>\n    ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow>\n    'input istream_af \\<Rightarrow> 'comp \\<Rightarrow>\n    'output istream_af\"\n  where \"i_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun input c \\<equiv>\n    [output_fun c] \\<frown> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c)\"\n\ndefinition i_Exec_Comp_Stream_Acc_LocalState_Init ::\n  \"nat \\<Rightarrow> \\<comment> \\<open>Acceleration factor\\<close>\n    ('comp \\<Rightarrow> 'state) \\<Rightarrow> \\<comment> \\<open>Local state extraction function\\<close>\n    ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow>\n    'input istream_af \\<Rightarrow> 'comp \\<Rightarrow>\n    'state ilist\"\n  where \"i_Exec_Comp_Stream_Acc_LocalState_Init k localState trans_fun input c \\<equiv>\n    [localState c] \\<frown> (i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c)\"\n\nlemma f_Exec_Stream_Acc_Output_length[simp]: \"\n  0 < k \\<Longrightarrow>\n  length (f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c) = length xs\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_def f_shrink_length)\n\nlemma f_Exec_Stream_Acc_LocalState_length[simp]: \"\n  0 < k \\<Longrightarrow>\n  length (f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c) = length xs\"\nby (simp add: f_Exec_Comp_Stream_Acc_LocalState_def f_shrink_last_length)\n\nlemmas f_Exec_Stream_Acc_length =\n  f_Exec_Stream_Acc_LocalState_length\n  f_Exec_Stream_Acc_Output_length\n\n\nsubsubsection \\<open>Basic results for accelerated execution\\<close>\n\nlemma f_Exec_Stream_Acc_Output_Nil[simp]: \"\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun [] c = []\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_def)\n\nlemma f_Exec_Stream_Acc_LocalState_Nil[simp]: \"\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun [] c = []\"\nby (simp add: f_Exec_Comp_Stream_Acc_LocalState_def)\n\nlemmas f_Exec_Stream_Acc_Nil =\n  f_Exec_Stream_Acc_LocalState_Nil\n  f_Exec_Stream_Acc_Output_Nil\n\nlemma f_Exec_Stream_Acc_Output_0[simp]: \"\n  f_Exec_Comp_Stream_Acc_Output 0 output_fun trans_fun xs c = []\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_def)\n\nlemma f_Exec_Stream_Acc_LocalState_0[simp]: \"\n  f_Exec_Comp_Stream_Acc_LocalState 0 localState trans_fun xs c = []\"\nby (simp add: f_Exec_Comp_Stream_Acc_LocalState_def)\n\nlemmas f_Exec_Stream_Acc_0 =\n  f_Exec_Stream_Acc_LocalState_0\n  f_Exec_Stream_Acc_Output_0\n\nlemma f_Exec_Stream_Acc_Output_1[simp]: \"\n  f_Exec_Comp_Stream_Acc_Output (Suc 0) output_fun trans_fun xs c =\n  map output_fun (f_Exec_Comp_Stream trans_fun xs c)\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_def)\n\nlemma f_Exec_Stream_Acc_LocalState_1[simp]: \"\n  f_Exec_Comp_Stream_Acc_LocalState (Suc 0) localState trans_fun xs c =\n  map localState (f_Exec_Comp_Stream trans_fun xs c)\"\nby (simp add: f_Exec_Comp_Stream_Acc_LocalState_def)\n\nlemma i_Exec_Stream_Acc_Output_1[simp]: \"\n  i_Exec_Comp_Stream_Acc_Output (Suc 0) output_fun trans_fun input c =\n  output_fun \\<circ> (i_Exec_Comp_Stream trans_fun input c)\"\nby (simp add: i_Exec_Comp_Stream_Acc_Output_def)\n\nlemma i_Exec_Stream_Acc_LocalState_1[simp]: \"\n  i_Exec_Comp_Stream_Acc_LocalState (Suc 0) localState trans_fun input c =\n  localState \\<circ> (i_Exec_Comp_Stream trans_fun input c)\"\nby (simp add: i_Exec_Comp_Stream_Acc_LocalState_def)\n\nlemma f_Exec_Stream_Acc_Output_eq_last_message_hold: \"\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c =\n  (map output_fun (f_Exec_Comp_Stream trans_fun (xs \\<odot>\\<^sub>f k) c)) \\<longmapsto>\\<^sub>f k \\<div>\\<^bsub>fl\\<^esub> k\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_def f_shrink_eq_f_last_message_hold_shrink_last)\n\nlemma i_Exec_Stream_Acc_Output_eq_last_message_hold: \"0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c =\n  (output_fun \\<circ> (i_Exec_Comp_Stream trans_fun (input \\<odot>\\<^sub>i k) c)) \\<longmapsto>\\<^sub>i k \\<div>\\<^bsub>il\\<^esub> k\"\nby (simp add: i_Exec_Comp_Stream_Acc_Output_def i_shrink_eq_i_last_message_hold_shrink_last)\n\nlemma f_Exec_Stream_Acc_Output_take: \"\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c \\<down> n =\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (xs \\<down> n) c\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_def f_shrink_def f_Exec_Stream_expand_aggregate_map_take)\n\nlemma f_Exec_Stream_Acc_Output_drop: \"\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c \\<up> n =\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (xs \\<up> n) (\n    f_Exec_Comp trans_fun (xs \\<down> n \\<odot>\\<^sub>f k) c)\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_def f_shrink_def f_Exec_Stream_expand_aggregate_map_drop)\n\nlemma i_Exec_Stream_Acc_Output_take: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c \\<Down> n =\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (input \\<Down> n) c\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_def i_Exec_Comp_Stream_Acc_Output_def\n  f_shrink_def i_shrink_def i_Exec_Stream_expand_aggregate_map_take)\n\nlemma i_Exec_Stream_Acc_Output_drop: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c \\<Up> n =\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (input \\<Up> n) (\n    f_Exec_Comp trans_fun (input \\<Down> n \\<odot>\\<^sub>f k) c)\"\nby (simp add: i_Exec_Comp_Stream_Acc_Output_def i_shrink_def i_Exec_Stream_expand_aggregate_map_drop)\n\nlemma i_Exec_Stream_Acc_LocalState_take: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c \\<Down> n =\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun (input \\<Down> n) c\"\nby (simp add: f_Exec_Comp_Stream_Acc_LocalState_def i_Exec_Comp_Stream_Acc_LocalState_def\n  f_shrink_last_def i_shrink_last_def i_Exec_Stream_expand_aggregate_map_take)\n\nlemma i_Exec_Stream_Acc_LocalState_drop: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c \\<Up> n =\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun (input \\<Up> n) (\n    f_Exec_Comp trans_fun (input \\<Down> n \\<odot>\\<^sub>f k) c)\"\nby (simp add: i_Exec_Comp_Stream_Acc_LocalState_def i_shrink_last_def i_Exec_Stream_expand_aggregate_map_drop)\n\nlemma f_Exec_Stream_Acc_Output_append: \"\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (xs @ ys) c =\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c @\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun ys (\n    f_Exec_Comp trans_fun (xs \\<odot>\\<^sub>f k) c)\"\nby (simp only: f_Exec_Comp_Stream_Acc_Output_def f_shrink_def f_Exec_Stream_expand_map_aggregate_append)\n\nlemma f_Exec_Stream_Acc_Output_Cons: \"\n  0 < k \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (x # xs) c =\n  last_message (map output_fun (f_Exec_Comp_Stream trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c)) #\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs (\n    f_Exec_Comp trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c)\"\nby (simp only: f_Exec_Comp_Stream_Acc_Output_def f_shrink_def f_Exec_Stream_expand_map_aggregate_Cons)\n\nlemma f_Exec_Stream_Acc_Output_one: \"\n  0 < k \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun [x] c =\n  [last_message (map output_fun (f_Exec_Comp_Stream trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c))]\"\nby (simp add: f_Exec_Stream_Acc_Output_Cons)\n\nlemma f_Exec_Stream_Acc_Output_snoc: \"\n  0 < k \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (xs @ [x]) c =\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c @\n  [last_message (map output_fun (f_Exec_Comp_Stream trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) (\n    f_Exec_Comp trans_fun (xs \\<odot>\\<^sub>f k) c)))]\"\nby (simp add: f_Exec_Stream_Acc_Output_append f_Exec_Stream_Acc_Output_one)\n\nlemma i_Exec_Stream_Acc_Output_append: \"\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (xs \\<frown> input) c =\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c \\<frown>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input (\n    f_Exec_Comp trans_fun (xs \\<odot>\\<^sub>f k) c)\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_def i_Exec_Comp_Stream_Acc_Output_def f_shrink_def i_shrink_def i_Exec_Stream_expand_map_aggregate_append)\n\nlemma i_Exec_Stream_Acc_Output_Cons: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun ([x] \\<frown> input) c =\n  [last_message (map output_fun (f_Exec_Comp_Stream trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c))] \\<frown>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input (\n    f_Exec_Comp trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c)\"\nby (simp add: i_Exec_Stream_Acc_Output_append f_Exec_Stream_Acc_Output_one)\n\nlemma f_Exec_Stream_Acc_LocalState_append: \"\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun (xs @ ys) c =\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c @\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun ys (\n    f_Exec_Comp trans_fun (xs \\<odot>\\<^sub>f k) c)\"\nby (simp only: f_Exec_Comp_Stream_Acc_LocalState_def f_shrink_last_def f_Exec_Stream_expand_map_aggregate_append)\n\nlemma f_Exec_Stream_Acc_LocalState_Cons: \"\n  0 < k \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun (x # xs) c =\n  localState (f_Exec_Comp trans_fun (x #  \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c) #\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs (\n    f_Exec_Comp trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c)\"\napply (unfold f_Exec_Comp_Stream_Acc_LocalState_def)\napply (simp only: f_shrink_last_map f_expand_Cons append_Cons[symmetric])\napply (simp add: f_Exec_Stream_append replicate_pred_Cons_length f_shrink_last_Cons del: f_Exec_Stream_Cons append_Cons)\napply (simp add: f_Exec_eq_f_Exec_Stream_last2[symmetric] f_Exec_Stream_empty_conv)\ndone\n\nlemma f_Exec_Stream_Acc_LocalState_one: \"\n  0 < k \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun [x] c =\n  [localState (f_Exec_Comp trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c)]\"\nby (simp add: f_Exec_Stream_Acc_LocalState_Cons)\n\nlemma f_Exec_Stream_Acc_LocalState_snoc: \"\n  0 < k \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun (xs @ [x]) c =\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c @\n  [localState (f_Exec_Comp trans_fun ((xs @ [x]) \\<odot>\\<^sub>f k) c)]\"\nby (simp add: f_Exec_Stream_Acc_LocalState_append f_Exec_Stream_Acc_LocalState_Cons f_Exec_append)\n\nlemma i_Exec_Stream_Acc_LocalState_append: \"\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun (xs \\<frown> input) c =\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c \\<frown>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input (\n    f_Exec_Comp trans_fun (xs \\<odot>\\<^sub>f k) c)\"\nby (simp add: f_Exec_Comp_Stream_Acc_LocalState_def i_Exec_Comp_Stream_Acc_LocalState_def f_shrink_last_def i_shrink_last_def i_Exec_Stream_expand_map_aggregate_append)\n\nlemma i_Exec_Stream_Acc_LocalState_Cons: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun ([x] \\<frown> input) c =\n  [localState (f_Exec_Comp trans_fun (x #  \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c)] \\<frown>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input (\n    f_Exec_Comp trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c)\"\nby (simp add: i_Exec_Stream_Acc_LocalState_append f_Exec_Stream_Acc_LocalState_one f_expand_one)\n\nlemma f_Exec_Stream_Acc_Output_nth: \"\n  \\<lbrakk> 0 < k; n < length xs \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c ! n =\n  last_message (map output_fun (\n    f_Exec_Comp_Stream trans_fun (xs ! n # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) (\n      f_Exec_Comp trans_fun (xs \\<down> n \\<odot>\\<^sub>f k) c)))\"\nby (unfold f_Exec_Comp_Stream_Acc_Output_def f_shrink_def, rule f_Exec_Stream_expand_aggregate_map_nth)\n\nlemma f_Exec_Stream_Acc_Output_nth_eq_i_nth: \"\n  \\<lbrakk> 0 < k; n < n' \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (input \\<Down> n') c ! n =\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c n\"\nby (unfold f_Exec_Comp_Stream_Acc_Output_def i_Exec_Comp_Stream_Acc_Output_def f_shrink_def i_shrink_def, rule f_Exec_Stream_expand_aggregate_map_nth_eq_i_nth)\n\nlemma i_Exec_Stream_Acc_Output_nth: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c n =\n  last_message (map output_fun (\n    f_Exec_Comp_Stream trans_fun (input n # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) (\n      f_Exec_Comp trans_fun (input \\<Down> n \\<odot>\\<^sub>f k) c)))\"\nby (unfold i_Exec_Comp_Stream_Acc_Output_def i_shrink_def, rule i_Exec_Stream_expand_aggregate_map_nth)\n\ncorollary i_Exec_Stream_Acc_Output_nth_f_nth: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c n =\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (input \\<Down> Suc n) c ! n\"\nby (simp add: f_Exec_Stream_Acc_Output_nth_eq_i_nth)\n\ncorollary i_Exec_Stream_Acc_Output_nth_f_last: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c n =\n  last (f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun (input \\<Down> Suc n) c)\"\nby (simp add: i_Exec_Stream_Acc_Output_nth_f_nth last_nth length_greater_0_conv[THEN iffD1])\n\nlemma f_Exec_Stream_Acc_LocalState_nth: \"\n  \\<lbrakk> 0 < k; n < length xs \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c ! n =\n  localState (f_Exec_Comp trans_fun (xs \\<down> Suc n \\<odot>\\<^sub>f k) c)\"\napply (simp add: f_Exec_Comp_Stream_Acc_LocalState_def f_shrink_last_map)\napply (simp add: f_shrink_last_nth' f_shrink_last_length del: mult_Suc)\napply (simp add: f_Exec_Stream_nth less_imp_Suc_mult_pred_less f_expand_take_mod del: mult_Suc)\ndone\n\nlemma f_Exec_Stream_Acc_LocalState_nth_eq_i_nth: \"\n  \\<lbrakk> 0 < k; n < n' \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun (input \\<Down> n') c ! n =\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c n\"\nby (unfold f_Exec_Comp_Stream_Acc_LocalState_def i_Exec_Comp_Stream_Acc_LocalState_def f_shrink_last_def i_shrink_last_def, rule f_Exec_Stream_expand_aggregate_map_nth_eq_i_nth)\n\ncorollary i_Exec_Stream_Acc_LocalState_nth_f_nth: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_LocalState k output_fun trans_fun input c n =\n  f_Exec_Comp_Stream_Acc_LocalState k output_fun trans_fun (input \\<Down> Suc n) c ! n\"\nby (simp add: f_Exec_Stream_Acc_LocalState_nth_eq_i_nth)\n\ncorollary i_Exec_Stream_Acc_LocalState_nth_f_last: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c n =\n  last (f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun (input \\<Down> Suc n) c)\"\nby (simp add: i_Exec_Stream_Acc_LocalState_nth_f_nth last_nth length_greater_0_conv[THEN iffD1])\n\nlemma i_Exec_Stream_Acc_LocalState_nth: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c n =\n  localState (f_Exec_Comp trans_fun (input \\<Down> Suc n \\<odot>\\<^sub>f k) c)\"\nby (simp add: i_Exec_Stream_Acc_LocalState_nth_f_nth f_Exec_Stream_Acc_LocalState_nth)\n\nlemma f_Exec_Stream_Acc_Output_causal: \"\n  xs \\<down> n = ys \\<down> n \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c \\<down> n =\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun ys c \\<down> n\"\nby (simp add: f_Exec_Stream_Acc_Output_take)\n\nlemma i_Exec_Stream_Acc_Output_causal: \"\n  input1 \\<Down> n = input2 \\<Down> n \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input1 c \\<Down> n =\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input2 c \\<Down> n\"\napply (case_tac \"k = 0\")\n apply (simp add: i_Exec_Comp_Stream_Acc_Output_def)\napply (simp add: i_Exec_Stream_Acc_Output_take)\ndone\n\nlemma f_Exec_Stream_Acc_Output_Connected_strictly_causal: \"\n  \\<lbrakk> xs \\<down> n = ys \\<down> n;\n    f_Streams_Connected\n      (f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c)\n      channel1;\n    f_Streams_Connected\n      (f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun ys c)\n      channel2 \\<rbrakk> \\<Longrightarrow>\n  channel1 \\<down> Suc n = channel2 \\<down> Suc n\"\nby (simp add: f_Streams_Connected_def f_Exec_Stream_Acc_Output_take)\n\nlemma i_Exec_Stream_Acc_Output_Connected_strictly_causal: \"\n  \\<lbrakk> input1 \\<Down> n = input2 \\<Down> n;\n    i_Streams_Connected\n      (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input1 c)\n      channel1;\n    i_Streams_Connected\n      (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input2 c)\n      channel2 \\<rbrakk> \\<Longrightarrow>\n  channel1 \\<Down> Suc n = channel2 \\<Down> Suc n\"\napply (unfold i_Streams_Connected_def)\napply (case_tac \"k = 0\")\n apply (simp add: i_Exec_Comp_Stream_Acc_Output_def)\napply (simp add: i_Exec_Stream_Acc_Output_take)\ndone\n\n\ntext \\<open>Complete execution cycles/steps of accelrated execution\\<close>\n\ndefinition Acc_Trans_Fun_Step ::\n  \"nat \\<Rightarrow> \\<comment> \\<open>Acceleration factor\\<close>\n    ('comp, 'input message_af) Comp_Trans_Fun \\<Rightarrow>\n    ('comp list \\<Rightarrow> 'comp) \\<Rightarrow> \\<comment> \\<open>Pointwise output shrink function\\<close>\n    'input message_af \\<Rightarrow> 'comp \\<Rightarrow>\n    'comp\"\n  where \"Acc_Trans_Fun_Step k trans_fun pointwise_shrink x c \\<equiv>\n    pointwise_shrink (f_Exec_Comp_Stream trans_fun (x # \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>) c)\"\n\ndefinition is_Pointwise_Output_Shrink ::\n  \"('comp list \\<Rightarrow> 'comp) \\<Rightarrow> \\<comment> \\<open>Pointwise output shrink function\\<close>\n    ('comp \\<Rightarrow> 'output message_af) \\<Rightarrow> \\<comment> \\<open>Output extraction function for consideration\\<close>\n    bool\"\n  where \"is_Pointwise_Output_Shrink pointwise_shrink output_fun \\<equiv>\n    \\<forall>cs. output_fun (pointwise_shrink cs) = last_message (map output_fun cs)\"\n\nprimrec is_Pointwise_Output_Shrink_list ::\n  \"('comp list \\<Rightarrow> 'comp) \\<Rightarrow> \\<comment> \\<open>Pointwise output shrink function\\<close>\n    ('comp \\<Rightarrow> 'output message_af) list \\<Rightarrow> \\<comment> \\<open>List of output extraction functions for consideration\\<close>\n    bool\"\nwhere\n  \"is_Pointwise_Output_Shrink_list pointwise_shrink [] = True\"\n| \"is_Pointwise_Output_Shrink_list pointwise_shrink (f # fs) =\n    (is_Pointwise_Output_Shrink pointwise_shrink f \\<and>\n     is_Pointwise_Output_Shrink_list pointwise_shrink fs)\"\n\ndefinition is_correct_localState_Pointwise_Output_Shrink ::\n  \"('comp list \\<Rightarrow> 'comp) \\<Rightarrow> \\<comment> \\<open>Pointwise output shrink function\\<close>\n    ('comp \\<Rightarrow> 'state) \\<Rightarrow> \\<comment> \\<open>Local state extraction function\\<close>\n    bool\"\n  where \"is_correct_localState_Pointwise_Output_Shrink pointwise_shrink localState \\<equiv>\n    \\<forall>cs. cs \\<noteq> [] \\<longrightarrow> localState (pointwise_shrink cs) = localState (last cs)\"\n\nlemma Deterministic_trans_fun_imp_acc_trans_fun:\n  \"Deterministic_Trans_Fun trans_fun localState \\<Longrightarrow>\n    Deterministic_Trans_Fun (Acc_Trans_Fun_Step k trans_fun pointwise_shrink) localState\"\napply (simp (no_asm) only: Deterministic_Trans_Fun_def Acc_Trans_Fun_Step_def)\napply clarify\napply (subst Deterministic_f_Exec_Stream, simp+)\ndone\n\nlemma is_Pointwise_Output_Shrink_list_imp_is_Pointwise_Output_Shrink:\n  \"\\<lbrakk> is_Pointwise_Output_Shrink_list pointwise_shrink fs; output_fun \\<in> set fs \\<rbrakk> \\<Longrightarrow>\n    is_Pointwise_Output_Shrink pointwise_shrink output_fun\"\napply (induct fs, simp)\napply fastforce\ndone\n\nlemma is_Pointwise_Output_Shrink_list_eq_is_Pointwise_Output_Shrink_all:\n  \"(is_Pointwise_Output_Shrink_list pointwise_shrink fs) =\n    (\\<forall>output_fun \\<in> set fs. is_Pointwise_Output_Shrink pointwise_shrink output_fun)\"\napply (rule iffI)\n apply (rule ballI)\n apply (rule is_Pointwise_Output_Shrink_list_imp_is_Pointwise_Output_Shrink)\n apply (simp add: member_def)+\napply (induct fs, simp)\napply simp\ndone\n\nlemma is_Pointwise_Output_Shrink_subset:\n  \"\\<lbrakk> is_Pointwise_Output_Shrink_list pointwise_shrink fs; set fs' \\<subseteq> set fs \\<rbrakk> \\<Longrightarrow>\n    is_Pointwise_Output_Shrink_list pointwise_shrink fs'\"\nby (fastforce simp: is_Pointwise_Output_Shrink_list_eq_is_Pointwise_Output_Shrink_all)\n\nlemma f_Exec_Stream_Acc_LocalState_eq_Acc_Trans_Fun_Step_LocalState: \"\\<And>c.\n  \\<lbrakk> 0 < k;\n    Deterministic_Trans_Fun trans_fun localState;\n    is_correct_localState_Pointwise_Output_Shrink pointwise_shrink localState \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c =\n  map localState (f_Exec_Comp_Stream (Acc_Trans_Fun_Step k trans_fun pointwise_shrink) xs c)\"\napply (drule Deterministic_trans_fun_imp_acc_trans_fun[of trans_fun localState k pointwise_shrink])\napply (clarsimp simp: list_eq_iff)\napply (simp add: f_Exec_Stream_Acc_LocalState_nth f_Exec_Stream_nth)\napply (induct xs, simp)\napply (rename_tac x xs c i)\napply (simp add: Acc_Trans_Fun_Step_def f_expand_Cons f_Exec_append)\napply (case_tac i)\n apply simp\n apply (simp only: is_correct_localState_Pointwise_Output_Shrink_def)\n apply (drule_tac x=\"f_Exec_Comp_Stream trans_fun (x # NoMsg\\<^bsup>k - Suc 0\\<^esup>) c\" in spec)\n apply (simp add: f_Exec_Stream_not_empty_conv f_Exec_eq_f_Exec_Stream_last)\napply (rename_tac i2)\napply (drule_tac x=\"f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup> (trans_fun x c)\" in meta_spec)\napply (drule_tac x=i2 in meta_spec)\napply (simp add: is_correct_localState_Pointwise_Output_Shrink_def)\napply (drule_tac x=\"f_Exec_Comp_Stream trans_fun (x # NoMsg\\<^bsup>k - Suc 0\\<^esup>) c\" in spec)\napply (simp add: f_Exec_Stream_not_empty_conv)\napply (rule arg_cong[where f=localState])\napply (rule Deterministic_f_Exec)\n  apply assumption\n apply (simp add: f_Exec_eq_f_Exec_Stream_last)\napply (simp add: length_greater_0_conv[symmetric] del: length_greater_0_conv)\ndone\n\nlemma f_Exec_Stream_Acc_Output_eq_Acc_Trans_Fun_Step_Output: \"\\<And>c.\n  \\<lbrakk> 0 < k;\n    Deterministic_Trans_Fun trans_fun localState;\n    is_correct_localState_Pointwise_Output_Shrink pointwise_shrink localState;\n    is_Pointwise_Output_Shrink pointwise_shrink output_fun \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c =\n  map output_fun (f_Exec_Comp_Stream (Acc_Trans_Fun_Step k trans_fun pointwise_shrink) xs c)\"\napply (drule Deterministic_trans_fun_imp_acc_trans_fun[of trans_fun localState k pointwise_shrink])\napply (clarsimp simp: list_eq_iff)\napply (simp add: f_Exec_Stream_Acc_Output_nth f_Exec_Stream_nth del: f_Exec_Stream_Cons)\napply (induct xs, simp)\napply (rename_tac x xs c i)\napply (simp add: Acc_Trans_Fun_Step_def del: f_Exec_Stream_Cons)\napply (case_tac i)\n apply (simp add: is_Pointwise_Output_Shrink_def)\napply (rename_tac i2)\napply (simp add: f_Exec_append)\napply (drule_tac x=\"f_Exec_Comp trans_fun \\<NoMsg>\\<^bsup>k - Suc 0\\<^esup> (trans_fun x c)\" in meta_spec)\napply (drule_tac x=i2 in meta_spec)\napply (simp add: is_correct_localState_Pointwise_Output_Shrink_def)\napply (drule_tac x=\"f_Exec_Comp_Stream trans_fun (x # NoMsg\\<^bsup>k - Suc 0\\<^esup>) c\" in spec)\napply (simp add: f_Exec_Stream_not_empty_conv)\napply (rule arg_cong[where f=output_fun])\napply (rule Deterministic_f_Exec)\n  apply assumption\n apply (simp add: f_Exec_eq_f_Exec_Stream_last)\napply (simp add: length_greater_0_conv[symmetric] del: length_greater_0_conv)\ndone\n\nlemma i_Exec_Stream_Acc_LocalState_eq_Acc_Trans_Fun_Step_LocalState: \"\\<And>c.\n  \\<lbrakk> 0 < k;\n    Deterministic_Trans_Fun trans_fun localState;\n    is_correct_localState_Pointwise_Output_Shrink pointwise_shrink localState \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c =\n  localState \\<circ> (i_Exec_Comp_Stream (Acc_Trans_Fun_Step k trans_fun pointwise_shrink) input c)\"\napply (rule ilist_i_take_eq_conv[THEN iffD2], rule allI)\napply (simp add: i_Exec_Stream_Acc_LocalState_take i_Exec_Stream_take f_Exec_Stream_Acc_LocalState_eq_Acc_Trans_Fun_Step_LocalState)\ndone\n\nlemma i_Exec_Stream_Acc_Output_eq_Acc_Trans_Fun_Step_Output: \"\\<And>c.\n  \\<lbrakk> 0 < k;\n    Deterministic_Trans_Fun trans_fun localState;\n    is_correct_localState_Pointwise_Output_Shrink pointwise_shrink localState;\n    is_Pointwise_Output_Shrink pointwise_shrink output_fun \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c =\n  output_fun \\<circ> (i_Exec_Comp_Stream (Acc_Trans_Fun_Step k trans_fun pointwise_shrink) input c)\"\napply (rule ilist_i_take_eq_conv[THEN iffD2], rule allI)\napply (simp add: i_Exec_Stream_Acc_Output_take i_Exec_Stream_take f_Exec_Stream_Acc_Output_eq_Acc_Trans_Fun_Step_Output)\ndone\n\n\nsubsubsection \\<open>Basic results for accelerated execution with initial state in the resulting stream\\<close>\n\nlemma f_Exec_Stream_Acc_Output_Init_length: \"\n  0 < k \\<Longrightarrow>\n  length (f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c) = Suc (length xs)\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_Init_def)\n\nlemma f_Exec_Stream_Acc_LocalState_Init_length: \"\n  0 < k \\<Longrightarrow>\n  length (f_Exec_Comp_Stream_Acc_LocalState_Init k localState trans_fun xs c) = Suc (length xs)\"\nby (simp add: f_Exec_Comp_Stream_Acc_LocalState_Init_def)\n\nlemma f_Exec_Stream_Acc_Output_Init_Nil: \"\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun [] c = [output_fun c]\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_Init_def)\n\nlemma f_Exec_Stream_Acc_LocalState_Init_Nil: \"\n  f_Exec_Comp_Stream_Acc_LocalState_Init k localState trans_fun [] c = [localState c]\"\nby (simp add: f_Exec_Comp_Stream_Acc_LocalState_Init_def)\n\nlemma f_Exec_Stream_Acc_Output_Init_1: \"\n  f_Exec_Comp_Stream_Acc_Output_Init (Suc 0) output_fun trans_fun xs c =\n  map output_fun (f_Exec_Comp_Stream_Init trans_fun xs c)\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_Init_def f_Exec_Stream_Init_eq_f_Exec_Stream_Cons)\n\nlemma f_Exec_Stream_Acc_LocalState_Init_1: \"\n  f_Exec_Comp_Stream_Acc_LocalState_Init (Suc 0) localState trans_fun xs c =\n  map localState (f_Exec_Comp_Stream_Init trans_fun xs c)\"\nby (simp add: f_Exec_Comp_Stream_Acc_LocalState_Init_def f_Exec_Stream_Init_eq_f_Exec_Stream_Cons)\n\nlemma i_Exec_Stream_Acc_Output_Init_1: \"\n  i_Exec_Comp_Stream_Acc_Output_Init (Suc 0) output_fun trans_fun input c =\n  output_fun \\<circ> (i_Exec_Comp_Stream_Init trans_fun input c)\"\nby (simp add: i_Exec_Comp_Stream_Acc_Output_Init_def i_Exec_Stream_Init_eq_i_Exec_Stream_Cons)\n\nlemma i_Exec_Stream_Acc_LocalState_Init_1: \"\n  i_Exec_Comp_Stream_Acc_LocalState_Init (Suc 0) localState trans_fun input c =\n  localState \\<circ> (i_Exec_Comp_Stream_Init trans_fun input c)\"\nby (simp add: i_Exec_Comp_Stream_Acc_LocalState_Init_def i_Exec_Stream_Init_eq_i_Exec_Stream_Cons)\n\nlemma f_Exec_Stream_Acc_Output_Init_take: \"\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c \\<down> (Suc n) =\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun (xs \\<down> n) c\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_Init_def f_Exec_Stream_Acc_Output_take)\n\nlemma f_Exec_Stream_Acc_Output_Init_drop': \"\n  \\<lbrakk> 0 < k; n < length xs \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c \\<up> Suc n =\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c \\<up> n\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_Init_def)\n\n\nlemma i_Exec_Stream_Acc_Output_Init_take: \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun input c \\<Down> (Suc n) =\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun (input \\<Down> n) c\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_Init_def i_Exec_Comp_Stream_Acc_Output_Init_def i_Exec_Stream_Acc_Output_take)\n\nlemma i_Exec_Stream_Acc_Output_Init_drop': \"\n  0 < k \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c \\<Up> Suc n =\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c \\<Up> n\"\nby (simp add: i_Exec_Comp_Stream_Acc_Output_Init_def)\n\nlemma f_Exec_Stream_Acc_Output_Init_strictly_causal: \"\n  xs \\<down> n = ys \\<down> n \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c \\<down> Suc n =\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun ys c \\<down> Suc n\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_Init_def, rule f_Exec_Stream_Acc_Output_causal)\n\nlemma i_Exec_Stream_Acc_Output_Init_strictly_causal: \"\n  input1 \\<Down> n = input2 \\<Down> n \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun input1 c \\<Down> Suc n =\n  i_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun input2 c \\<Down> Suc n\"\nby (simp add: i_Exec_Comp_Stream_Acc_Output_Init_def, rule i_Exec_Stream_Acc_Output_causal)\n\nlemma f_Exec_Stream_Acc_Output_Init_eq_f_Exec_Stream_Acc_Output_Cons: \"\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c =\n  output_fun c # f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c\"\nby (simp add: f_Exec_Comp_Stream_Acc_Output_def f_Exec_Comp_Stream_Acc_Output_Init_def)\n\nlemma f_Exec_Stream_Acc_Output_Init_eq_f_Exec_Stream_Acc_Output_Cons_output: \"\n  output_fun c = \\<NoMsg> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c =\n  \\<NoMsg> # f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c\"\nby (simp add: f_Exec_Stream_Acc_Output_Init_eq_f_Exec_Stream_Acc_Output_Cons)\n\nlemma f_Exec_Stream__Acc_OutputInit_tl_eq_f_Exec_Stream_Acc_Output: \"\n  tl (f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c) =\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c\"\nby (simp add: f_Exec_Stream_Acc_Output_Init_eq_f_Exec_Stream_Acc_Output_Cons)\n\nlemma f_Exec_Stream_Previous_f_Exec_Stream_Acc_Output_Init: \"\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c ! n =\n  (f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c)\\<^bsup>\\<leftarrow>' output_fun c\\<^esup> n\"\nby (simp add: f_Exec_Stream_Acc_Output_Init_eq_f_Exec_Stream_Acc_Output_Cons list_Previous_nth_if nth_Cons')\n\nlemma f_Exec_Stream_Acc_Output_Init_eq_output_channel: \"\n  \\<lbrakk> output_fun c = \\<NoMsg>;\n    f_Streams_Connected\n      (f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c)\n      channel \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun xs c = channel\"\nby (simp add: f_Streams_Connected_def f_Exec_Stream_Acc_Output_Init_eq_f_Exec_Stream_Acc_Output_Cons_output)\n\n\nlemma i_Exec_Stream_Acc_Output_Init_eq_i_Exec_Stream_Acc_Output_Cons: \"\n  i_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun input c =\n  [output_fun c] \\<frown> i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c\"\nby (simp add: i_Exec_Comp_Stream_Acc_Output_def i_Exec_Comp_Stream_Acc_Output_Init_def)\n\nlemma i_Exec_Stream_Acc_Output_Init_eq_i_Exec_Stream_Acc_Output_Cons_output: \"\n  output_fun c = \\<NoMsg> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun input c =\n  [\\<NoMsg> ] \\<frown> i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c\"\nby (simp add: i_Exec_Stream_Acc_Output_Init_eq_i_Exec_Stream_Acc_Output_Cons)\n\nlemma i_Exec_Stream_Previous_i_Exec_Stream_Acc_Output_Init: \"\n  i_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun input c n =\n  (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c)\\<^bsup>\\<leftarrow> output_fun c\\<^esup> n\"\nby (simp add: i_Exec_Stream_Acc_Output_Init_eq_i_Exec_Stream_Acc_Output_Cons ilist_Previous_nth_if)\n\nlemma i_Exec_Stream_Acc_Output_Init_eq_output_channel: \"\n  \\<lbrakk> output_fun c = \\<NoMsg>;\n    i_Streams_Connected\n      (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c)\n      channel \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output_Init k output_fun trans_fun input c = channel\"\nby (simp add: i_Streams_Connected_def i_Exec_Stream_Acc_Output_Init_eq_i_Exec_Stream_Acc_Output_Cons_output)\n\n\nsubsubsection \\<open>Rules for proving execution equivalence\\<close>\n\ntext \\<open>\n  A required precondition is that the @{term equiv_states} relation,\n  which indicates whether the local states of @{term c1} and @{term c2}\n  are equivalent with respect to observable behaviour,\n  is preserved also after executing an input stream,\n  because the @{term equiv_states} relation\n  should deliver valid results not only at the time point @{term 0}\n  but at every time point.\\<close>\n\nlemma f_Equiv_Exec_Stream_expand_shrink_equiv_state_set[rule_format]: \"\n  \\<And>c1 c2 i. \\<lbrakk>\n   0 < k1; 0 < k2;\n   equiv_states (localState1 c1) (localState2 c2);\n   \\<forall>input0. set input0 \\<subseteq> A \\<longrightarrow> (\\<forall>m\\<in>A.\n      Equiv_Exec m equiv_states\n      localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n      trans_fun1 trans_fun2 k1 k2\n      (f_Exec_Comp trans_fun1 (map input_fun1 input0 \\<odot>\\<^sub>f k1) c1)\n      (f_Exec_Comp trans_fun2 (map input_fun2 input0 \\<odot>\\<^sub>f k2) c2));\n      \\<comment> \\<open>\\<open>equiv_states\\<close> relation implies equivalent executions\\<close>\n      \\<comment> \\<open>not only at the beginning but also after processing an input\\<close>\n   set input \\<subseteq> A; i < length input \\<rbrakk> \\<Longrightarrow>\n   equiv_states\n     (localState1 ((f_Exec_Comp_Stream trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1) \\<div>\\<^bsub>fl\\<^esub> k1 ! i))\n     (localState2 ((f_Exec_Comp_Stream trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2) \\<div>\\<^bsub>fl\\<^esub> k2 ! i))\"\napply (induct input, simp)\napply (clarsimp simp: append_Cons[symmetric] f_Exec_Stream_append_if f_shrink_last_Cons nth_Cons simp del: last.simps f_Exec_Stream_Cons append_Cons)\napply (case_tac i)\n apply (drule_tac x=\"[]\" in spec)\n apply (drule mp, simp)\n apply (drule_tac x=a in bspec, assumption)\n apply (simp del: last.simps f_Exec_Stream_Cons)\n apply (subst f_Exec_eq_f_Exec_Stream_last2[symmetric], simp)+\n apply (rule Equiv_Exec_equiv_statesI[of equiv_states localState1 _ localState2 _ _ input_fun1], assumption+)\napply (rename_tac i')\napply (subst f_Exec_eq_f_Exec_Stream_last2[symmetric], simp)+\napply (drule_tac x=\"f_Exec_Comp trans_fun1 (input_fun1 a # \\<NoMsg>\\<^bsup>k1 - Suc 0\\<^esup>) c1\" in meta_spec)\napply (drule_tac x=\"f_Exec_Comp trans_fun2 (input_fun2 a # \\<NoMsg>\\<^bsup>k2 - Suc 0\\<^esup>) c2\" in meta_spec)\napply (drule_tac x=i' in meta_spec)\napply (drule meta_mp, simp)+\n apply (drule_tac x=\"[]\" in spec, simp)\n apply (drule_tac x=a in bspec, assumption)\n apply (rule Equiv_Exec_equiv_statesI'[of equiv_states localState1 _ localState2 _ _ input_fun1], simp+)\napply clarsimp\napply (drule meta_mp)\n apply clarify\n apply (drule_tac x=\"a # input0\" in spec)\n apply (simp add: f_Exec_append)\napply simp\ndone\n\ncorollary f_Equiv_Exec_Stream_expand_shrink_equiv_state: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    \\<And>input0 m. Equiv_Exec m\n       equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n       trans_fun1 trans_fun2 k1 k2\n       (f_Exec_Comp trans_fun1 (map input_fun1 input0 \\<odot>\\<^sub>f k1) c1)\n       (f_Exec_Comp trans_fun2 (map input_fun2 input0 \\<odot>\\<^sub>f k2) c2);\n    i<length input \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n    (localState1 ((f_Exec_Comp_Stream trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1) \\<div>\\<^bsub>fl\\<^esub> k1 ! i))\n    (localState2 ((f_Exec_Comp_Stream trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2) \\<div>\\<^bsub>fl\\<^esub> k2 ! i))\"\nby (rule f_Equiv_Exec_Stream_expand_shrink_equiv_state_set[of k1 k2 equiv_states localState1 c1 localState2 c2 UNIV input_fun1 input_fun2 output_fun1 output_fun2], simp+)\n\nlemma f_Equiv_Exec_expand_shrink_equiv_state_set:\"\n  \\<lbrakk> 0 < k1; 0 < k2; equiv_states (localState1 c1) (localState2 c2);\n    \\<And>input0 m. \\<lbrakk>set input0 \\<subseteq> A; m \\<in> A\\<rbrakk> \\<Longrightarrow>\n       Equiv_Exec\n         m equiv_states localState1 localState2\n         input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2\n         (f_Exec_Comp trans_fun1 (map input_fun1 input0 \\<odot>\\<^sub>f k1) c1)\n         (f_Exec_Comp trans_fun2 (map input_fun2 input0 \\<odot>\\<^sub>f k2) c2);\n    set input \\<subseteq> A \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n    (localState1 (f_Exec_Comp trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1))\n    (localState2 (f_Exec_Comp trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2))\"\napply (case_tac \"input = []\", simp)\napply (subgoal_tac \"map input_fun1 input \\<odot>\\<^sub>f k1 \\<noteq> [] \\<and> map input_fun2 input \\<odot>\\<^sub>f k2 \\<noteq> []\")\n prefer 2\n apply (simp add: length_greater_0_conv[symmetric] del: length_greater_0_conv)\napply (simp add: f_Exec_eq_f_Exec_Stream_last2 last_nth f_Exec_Stream_not_empty_conv)\napply (insert f_shrink_last_nth[of \"length input - Suc 0\" \"f_Exec_Comp_Stream trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1\" k1, symmetric])\napply (insert f_shrink_last_nth[of \"length input - Suc 0\" \"f_Exec_Comp_Stream trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2\" k2, symmetric])\napply (simp add: diff_mult_distrib gr0_imp_self_le_mult2)\napply (rule f_Equiv_Exec_Stream_expand_shrink_equiv_state_set[of k1 k2 equiv_states localState1 _ localState2 _ A input_fun1 input_fun2 output_fun1 output_fun2])\napply simp+\ndone\n\nlemma f_Equiv_Exec_expand_shrink_equiv_state:\"\n  \\<lbrakk> 0 < k1; 0 < k2; equiv_states (localState1 c1) (localState2 c2);\n    \\<And>input0 m.\n       Equiv_Exec\n         m equiv_states localState1 localState2\n         input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2\n         (f_Exec_Comp trans_fun1 (map input_fun1 input0 \\<odot>\\<^sub>f k1) c1)\n         (f_Exec_Comp trans_fun2 (map input_fun2 input0 \\<odot>\\<^sub>f k2) c2) \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n    (localState1 (f_Exec_Comp trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1))\n    (localState2 (f_Exec_Comp trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2))\"\nby (rule f_Equiv_Exec_expand_shrink_equiv_state_set[of k1 k2 equiv_states localState1 _ localState2 _ UNIV input_fun1 input_fun2 output_fun1 output_fun2], simp+)\n\nlemma i_Equiv_Exec_Stream_expand_shrink_equiv_state_set[rule_format]: \"\n  \\<lbrakk> 0 < k1; 0 < k2; equiv_states (localState1 c1) (localState2 c2);\n    \\<And>input0 m. \\<lbrakk>set input0 \\<subseteq> A; m \\<in> A\\<rbrakk> \\<Longrightarrow>\n       Equiv_Exec\n        m equiv_states localState1 localState2\n        input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2\n       (f_Exec_Comp trans_fun1 (map input_fun1 input0 \\<odot>\\<^sub>f k1) c1)\n       (f_Exec_Comp trans_fun2 (map input_fun2 input0 \\<odot>\\<^sub>f k2) c2);\n    range input \\<subseteq> A \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n    (localState1 ((i_Exec_Comp_Stream trans_fun1 ((input_fun1 \\<circ> input) \\<odot>\\<^sub>i k1) c1 \\<div>\\<^bsub>il\\<^esub> k1) i))\n    (localState2 ((i_Exec_Comp_Stream trans_fun2 ((input_fun2 \\<circ> input) \\<odot>\\<^sub>i k2) c2 \\<div>\\<^bsub>il\\<^esub> k2) i))\"\napply (simp add: i_shrink_last_nth i_Exec_Stream_nth i_expand_i_take_mod)\napply (rule f_Equiv_Exec_expand_shrink_equiv_state_set[of\n  k1 k2 equiv_states localState1 c1 localState2 c2 A input_fun1 input_fun2 output_fun1 output_fun2])\napply (simp add: subset_trans[OF set_i_take_subset])+\ndone\n\nlemma i_Equiv_Exec_Stream_expand_shrink_equiv_state: \"\n  \\<lbrakk> 0 < k1; 0 < k2; equiv_states (localState1 c1) (localState2 c2);\n    \\<And>input0 m.\n       Equiv_Exec\n        m equiv_states localState1 localState2\n        input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2\n       (f_Exec_Comp trans_fun1 (map input_fun1 input0 \\<odot>\\<^sub>f k1) c1)\n       (f_Exec_Comp trans_fun2 (map input_fun2 input0 \\<odot>\\<^sub>f k2) c2) \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n    (localState1 ((i_Exec_Comp_Stream trans_fun1 ((input_fun1 \\<circ> input) \\<odot>\\<^sub>i k1) c1 \\<div>\\<^bsub>il\\<^esub> k1) i))\n    (localState2 ((i_Exec_Comp_Stream trans_fun2 ((input_fun2 \\<circ> input) \\<odot>\\<^sub>i k2) c2 \\<div>\\<^bsub>il\\<^esub> k2) i))\"\nby (rule i_Equiv_Exec_Stream_expand_shrink_equiv_state_set[of k1 k2 equiv_states localState1 c1 localState2 c2 UNIV input_fun1 input_fun2 output_fun1 output_fun2], simp+)\n\nlemma f_Equiv_Exec_Stream_expand_shrink_output_set_eq: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    \\<And>input0 m. \\<lbrakk> set input0 \\<subseteq> A; m \\<in> A \\<rbrakk> \\<Longrightarrow>\n       Equiv_Exec\n         m equiv_states localState1 localState2\n         input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2\n         (f_Exec_Comp trans_fun1 (map input_fun1 input0 \\<odot>\\<^sub>f k1) c1)\n         (f_Exec_Comp trans_fun2 (map input_fun2 input0 \\<odot>\\<^sub>f k2) c2);\n    set input \\<subseteq> A \\<rbrakk> \\<Longrightarrow>\n  (map output_fun1 (\n    f_Exec_Comp_Stream trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1)) \\<div>\\<^sub>f k1 =\n  (map output_fun2 (\n    f_Exec_Comp_Stream trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2)) \\<div>\\<^sub>f k2\"\napply (subst list_eq_iff)\napply (clarsimp simp: f_shrink_length)\napply (simp del: last.simps f_Exec_Stream_Cons add: f_shrink_nth take_map drop_map f_Exec_Stream_take f_Exec_Stream_drop f_expand_take_mod f_expand_drop_mod take_first)\napply (frule_tac n=i in subset_trans[OF set_take_subset, rule_format])\napply (unfold atomize_all atomize_imp, intro allI impI)\napply (frule_tac x=\"take i input\" in spec)\napply (drule_tac x=\"input ! i\" in spec)\napply (erule impE, assumption)\napply (erule impE)\n apply (blast intro: nth_mem)\napply (simp del: last.simps f_Exec_Stream_Cons)\napply (rule Equiv_Exec_output_eqI[of equiv_states localState1 _ localState2 _ _ input_fun1 input_fun2])\n apply (case_tac i, simp)\n apply (simp add: take_map[symmetric] f_Exec_Stream_expand_shrink_last_nth_eq_f_Exec_Comp[symmetric])\n apply (frule Suc_lessD)\n apply (simp add: f_Equiv_Exec_Stream_expand_shrink_equiv_state_set[of k1 k2 equiv_states localState1 _ localState2 _ A input_fun1 input_fun2 output_fun1 output_fun2])\napply simp\ndone\n\nlemma f_Equiv_Exec_Stream_expand_shrink_output_eq: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    \\<And>input0 m.\n       Equiv_Exec\n         m equiv_states localState1 localState2\n         input_fun1 input_fun2 output_fun1 output_fun2\n         trans_fun1 trans_fun2 k1 k2\n         (f_Exec_Comp trans_fun1 (map input_fun1 input0 \\<odot>\\<^sub>f k1) c1)\n         (f_Exec_Comp trans_fun2 (map input_fun2 input0 \\<odot>\\<^sub>f k2) c2) \\<rbrakk> \\<Longrightarrow>\n  (map output_fun1 (\n    f_Exec_Comp_Stream trans_fun1 (map input_fun1 input \\<odot>\\<^sub>f k1) c1)) \\<div>\\<^sub>f k1 =\n  (map output_fun2 (\n    f_Exec_Comp_Stream trans_fun2 (map input_fun2 input \\<odot>\\<^sub>f k2) c2)) \\<div>\\<^sub>f k2\"\nby (rule f_Equiv_Exec_Stream_expand_shrink_output_set_eq[of k1 k2 equiv_states localState1 _ localState2 _ UNIV], simp+)\n\nlemma i_Equiv_Exec_Stream_expand_shrink_output_set_eq: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    \\<And>input0 m. \\<lbrakk> set input0 \\<subseteq> A; m \\<in> A \\<rbrakk> \\<Longrightarrow>\n       Equiv_Exec\n         m equiv_states localState1 localState2\n         input_fun1 input_fun2 output_fun1 output_fun2\n         trans_fun1 trans_fun2 k1 k2\n         (f_Exec_Comp trans_fun1 (map input_fun1 input0 \\<odot>\\<^sub>f k1) c1)\n         (f_Exec_Comp trans_fun2 (map input_fun2 input0 \\<odot>\\<^sub>f k2) c2);\n    range input \\<subseteq> A \\<rbrakk> \\<Longrightarrow>\n  (output_fun1 \\<circ>\n    i_Exec_Comp_Stream trans_fun1 ((input_fun1 \\<circ> input) \\<odot>\\<^sub>i k1) c1) \\<div>\\<^sub>i k1 =\n  (output_fun2 \\<circ>\n    i_Exec_Comp_Stream trans_fun2 ((input_fun2 \\<circ> input) \\<odot>\\<^sub>i k2) c2) \\<div>\\<^sub>i k2\"\napply (clarsimp simp: ilist_eq_iff, rename_tac i)\napply (simp del: last.simps f_Exec_Stream_Cons add: i_shrink_nth i_Exec_Stream_take i_Exec_Stream_drop i_expand_i_take_mod i_expand_i_drop_mod i_take_first map_one f_expand_one)\napply (rule Equiv_Exec_output_eqI[of\n  equiv_states localState1 _ localState2 _ _\n  input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2])\napply (rule f_Equiv_Exec_expand_shrink_equiv_state_set[of\n  k1 k2 equiv_states localState1 _ localState2 _ A\n  input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2])\napply (simp add: subset_trans[OF set_i_take_subset] subsetD[OF _ rangeI])+\ndone\n\nlemma i_Equiv_Exec_Stream_expand_shrink_output_eq: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    \\<And>input0 m.\n       Equiv_Exec\n         m equiv_states localState1 localState2\n         input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2\n         (f_Exec_Comp trans_fun1 (map input_fun1 input0 \\<odot>\\<^sub>f k1) c1)\n         (f_Exec_Comp trans_fun2 (map input_fun2 input0 \\<odot>\\<^sub>f k2) c2) \\<rbrakk> \\<Longrightarrow>\n  (output_fun1 \\<circ>\n    i_Exec_Comp_Stream trans_fun1 ((input_fun1 \\<circ> input) \\<odot>\\<^sub>i k1) c1) \\<div>\\<^sub>i k1 =\n  (output_fun2 \\<circ>\n    i_Exec_Comp_Stream trans_fun2 ((input_fun2 \\<circ> input) \\<odot>\\<^sub>i k2) c2) \\<div>\\<^sub>i k2\"\napply (rule i_Equiv_Exec_Stream_expand_shrink_output_set_eq[of\n  k1 k2 equiv_states localState1 c1 localState2 c2 UNIV\n  input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2])\napply simp+\ndone\n\n\nlemma f_Equiv_Exec_Stream_Acc_LocalState_set: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec_stable_set A\n      equiv_states localState1 localState2\n      input_fun1 input_fun2 output_fun1 output_fun2\n      trans_fun1 trans_fun2 k1 k2 c1 c2;\n      \\<comment> \\<open>\\<open>equiv_states\\<close> relation implies equivalent executions\\<close>\n      \\<comment> \\<open>not only at the beginning but also after processing an input\\<close>\n    set input \\<subseteq> A;\n    i < length input \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n    (f_Exec_Comp_Stream_Acc_LocalState k1 localState1 trans_fun1 (map input_fun1 input) c1 ! i)\n    (f_Exec_Comp_Stream_Acc_LocalState k2 localState2 trans_fun2 (map input_fun2 input) c2 ! i)\"\napply (unfold f_Exec_Comp_Stream_Acc_LocalState_def Equiv_Exec_stable_set_def)\napply (simp add: f_shrink_last_map f_shrink_last_length)\napply (rule f_Equiv_Exec_Stream_expand_shrink_equiv_state_set[of\n  k1 k2 equiv_states localState1 c1 localState2 c2 A\n  input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 input, rule_format])\napply simp+\ndone\n\nlemma f_Equiv_Exec_Stream_Acc_LocalState: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec_stable\n      equiv_states localState1 localState2\n      input_fun1 input_fun2 output_fun1 output_fun2\n      trans_fun1 trans_fun2 k1 k2 c1 c2;\n      \\<comment> \\<open>\\<open>equiv_states\\<close> relation implies equivalent executions\\<close>\n      \\<comment> \\<open>not only at the beginning but also after processing an input\\<close>\n    i < length input \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n    (f_Exec_Comp_Stream_Acc_LocalState k1 localState1 trans_fun1 (map input_fun1 input) c1 ! i)\n    (f_Exec_Comp_Stream_Acc_LocalState k2 localState2 trans_fun2 (map input_fun2 input) c2 ! i)\"\napply (rule f_Equiv_Exec_Stream_Acc_LocalState_set[where A=UNIV])\napply (simp add: Equiv_Exec_stable_set_UNIV)+\ndone\n\nlemma f_Equiv_Exec_Stream_Acc_Output_set_eq: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec_stable_set A\n      equiv_states localState1 localState2\n      input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2 c1 c2;\n    set input \\<subseteq> A \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k1 output_fun1 trans_fun1 (map input_fun1 input) c1 =\n  f_Exec_Comp_Stream_Acc_Output k2 output_fun2 trans_fun2 (map input_fun2 input) c2\"\napply (unfold f_Exec_Comp_Stream_Acc_Output_def Equiv_Exec_stable_set_def)\napply (rule f_Equiv_Exec_Stream_expand_shrink_output_set_eq[of\n  k1 k2 equiv_states localState1 c1 localState2 c2\n  A input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 input])\napply simp+\ndone\n\nlemma f_Equiv_Exec_Stream_Acc_Output_eq: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec_stable\n      equiv_states localState1 localState2\n      input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2 c1 c2 \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k1 output_fun1 trans_fun1 (map input_fun1 input) c1 =\n  f_Exec_Comp_Stream_Acc_Output k2 output_fun2 trans_fun2 (map input_fun2 input) c2\"\napply (rule f_Equiv_Exec_Stream_Acc_Output_set_eq[of k1 k2 equiv_states localState1 c1 localState2 c2 UNIV])\napply (simp add: Equiv_Exec_stable_set_UNIV)+\ndone\n\n\nlemma i_Equiv_Exec_Stream_Acc_LocalState_set: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec_stable_set A\n      equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2\n      trans_fun1 trans_fun2 k1 k2 c1 c2;\n    range input \\<subseteq> A \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n    (i_Exec_Comp_Stream_Acc_LocalState k1 localState1 trans_fun1 (input_fun1 \\<circ> input) c1 i)\n    (i_Exec_Comp_Stream_Acc_LocalState k2 localState2 trans_fun2 (input_fun2 \\<circ> input) c2 i)\"\napply (simp add: i_Exec_Stream_Acc_LocalState_nth_f_nth)\napply (rule f_Equiv_Exec_Stream_Acc_LocalState_set)\napply (simp add:  subset_trans[OF set_i_take_subset])+\ndone\n\nlemma i_Equiv_Exec_Stream_Acc_LocalState: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec_stable\n      equiv_states localState1 localState2\n      input_fun1 input_fun2 output_fun1 output_fun2\n      trans_fun1 trans_fun2 k1 k2 c1 c2 \\<rbrakk> \\<Longrightarrow>\n  equiv_states\n    (i_Exec_Comp_Stream_Acc_LocalState k1 localState1 trans_fun1 (input_fun1 \\<circ> input) c1 i)\n    (i_Exec_Comp_Stream_Acc_LocalState k2 localState2 trans_fun2 (input_fun2 \\<circ> input) c2 i)\"\napply (rule i_Equiv_Exec_Stream_Acc_LocalState_set[where A=UNIV])\napply (simp add: Equiv_Exec_stable_set_UNIV)+\ndone\n\nlemma i_Equiv_Exec_Stream_Acc_Output_set_eq: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec_stable_set A\n      equiv_states localState1 localState2\n      input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2 c1 c2;\n    range input \\<subseteq> A \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k1 output_fun1 trans_fun1 (input_fun1 \\<circ> input) c1 =\n  i_Exec_Comp_Stream_Acc_Output k2 output_fun2 trans_fun2 (input_fun2 \\<circ> input) c2\"\napply (clarsimp simp: ilist_eq_iff i_Exec_Stream_Acc_Output_nth_f_nth, rename_tac i)\napply (drule_tac n=\"Suc i\" in subset_trans[OF set_i_take_subset, rule_format])\napply (simp add: f_Equiv_Exec_Stream_Acc_Output_set_eq[where equiv_states=equiv_states])\ndone\n\nlemma i_Equiv_Exec_Stream_Acc_Output_eq: \"\n  \\<lbrakk> 0 < k1; 0 < k2;\n    equiv_states (localState1 c1) (localState2 c2);\n    Equiv_Exec_stable\n      equiv_states localState1 localState2\n      input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2 c1 c2 \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k1 output_fun1 trans_fun1 (input_fun1 \\<circ> input) c1 =\n  i_Exec_Comp_Stream_Acc_Output k2 output_fun2 trans_fun2 (input_fun2 \\<circ> input) c2\"\napply (rule i_Equiv_Exec_Stream_Acc_Output_set_eq[of k1 k2 equiv_states localState1 c1 localState2 c2 UNIV])\napply (simp add: Equiv_Exec_stable_set_UNIV)+\ndone\n\n\nsubsubsection \\<open>Idle states and accelerated execution\\<close>\n\nlemma f_Exec_Stream_Acc_LocalState__State_Idle_nth[rule_format]: \"\n  \\<And>c i.\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    \\<forall>n\\<le>i. State_Idle localState output_fun trans_fun (\n      f_Exec_Comp_Stream_Acc_LocalState l localState trans_fun xs c ! n);\n    i < length xs \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c ! i =\n  f_Exec_Comp_Stream_Acc_LocalState l localState trans_fun xs c ! i\"\napply (frule length_greater_0_conv[THEN iffD1, OF gr_implies_gr0])\napply (simp only: f_Exec_Stream_Acc_LocalState_nth take_Suc_conv_app_nth)\napply (simp only: f_expand_snoc f_Exec_append)\napply (rule_tac s=\"\\<NoMsg>\\<^bsup>l - Suc 0\\<^esup> @ \\<NoMsg>\\<^bsup>k-l\\<^esup>\" and t=\"\\<NoMsg>\\<^bsup>k - Suc 0\\<^esup>\" in subst)\n apply (simp add: replicate_le_diff2)\napply (subst append_Cons[symmetric])\napply (induct xs, simp)\napply (case_tac i)\n apply (simp add: f_Exec_Stream_Acc_LocalState_Cons f_Exec_State_Idle_append_replicate_NoMsg_state)\napply (rename_tac n)\napply (drule_tac x=\"f_Exec_Comp trans_fun (a # \\<NoMsg>\\<^bsup>l - Suc 0\\<^esup>) c\" in meta_spec)\napply (drule_tac x=n in meta_spec)\napply (simp del: f_Exec_Cons)\napply (frule length_greater_imp_not_empty)\napply (drule meta_mp)\n apply (simp add: f_Exec_Stream_Acc_LocalState_nth f_Exec_append)\napply (simp add: append_Cons[symmetric] f_expand_Cons f_Exec_append del: append_Cons)\napply (subgoal_tac \"\n  localState (f_Exec_Comp trans_fun (a # NoMsg\\<^bsup>k - Suc 0\\<^esup>) c) =\n  localState (f_Exec_Comp trans_fun (a # NoMsg\\<^bsup>l - Suc 0\\<^esup>) c)\")\n prefer 2\n apply (drule_tac x=0 in spec)\n apply (simp add: f_Exec_Stream_Acc_LocalState_Cons)\n apply (subst replicate_le_diff2[OF Suc_leI, symmetric], assumption+)\n apply (simp add: append_Cons[symmetric] f_Exec_append del: append_Cons)\n apply (rule f_Exec_State_Idle_replicate_NoMsg_state, assumption)\napply (case_tac \"n = 0\")\n apply (frule_tac\n   ?c1.0=\"f_Exec_Comp trans_fun (a # NoMsg\\<^bsup>k - Suc 0\\<^esup>) c\" and\n   xs = \"xs ! 0 # NoMsg\\<^bsup>l - Suc 0\\<^esup>\" in f_Exec_Equal_State)\n apply simp+\napply (frule_tac\n  ?c1.0=\"f_Exec_Comp trans_fun (a # NoMsg\\<^bsup>k - Suc 0\\<^esup>) c\" and\n  xs = \"xs \\<down> n \\<odot>\\<^sub>f k\" in f_Exec_Equal_State)\napply (simp add: f_expand_not_empty_conv)+\ndone\n\ncorollary f_Exec_Stream_Acc_LocalState__State_Idle_eq[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    \\<forall>n<length xs. State_Idle localState output_fun trans_fun (\n      f_Exec_Comp_Stream_Acc_LocalState l localState trans_fun xs c ! n) \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c =\n  f_Exec_Comp_Stream_Acc_LocalState l localState trans_fun xs c\"\napply (clarsimp simp: list_eq_iff)\napply (rule f_Exec_Stream_Acc_LocalState__State_Idle_nth)\napply simp_all\napply (drule_tac x=n in spec)\napply simp\ndone\n\nlemma i_Exec_Stream_Acc_LocalState__State_Idle_nth[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    \\<forall>n\\<le>i. State_Idle localState output_fun trans_fun (\n      i_Exec_Comp_Stream_Acc_LocalState l localState trans_fun input c n) \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c i =\n  i_Exec_Comp_Stream_Acc_LocalState l localState trans_fun input c i\"\napply (simp only: f_Exec_Stream_Acc_LocalState_nth_eq_i_nth[of _ _ \"Suc i\", symmetric])\napply (rule f_Exec_Stream_Acc_LocalState__State_Idle_nth)\napply simp_all\napply (drule_tac x=n in spec)\napply (simp add: f_Exec_Stream_Acc_LocalState_nth_eq_i_nth)\ndone\n\ncorollary i_Exec_Stream_Acc_LocalState__State_Idle_eq[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    \\<forall>n. State_Idle localState output_fun trans_fun (\n      i_Exec_Comp_Stream_Acc_LocalState l localState trans_fun input c n) \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun input c =\n  i_Exec_Comp_Stream_Acc_LocalState l localState trans_fun input c\"\napply (clarsimp simp: ilist_eq_iff)\napply (rule i_Exec_Stream_Acc_LocalState__State_Idle_nth)\napply simp_all\napply (drule_tac x=n in spec)\napply simp\ndone\n\nlemma f_Exec_Stream_Acc_Output__State_Idle_nth[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    \\<forall>n\\<le>i. State_Idle localState output_fun trans_fun (\n      f_Exec_Comp_Stream_Acc_LocalState l localState trans_fun xs c ! n);\n    i < length xs \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c ! i =\n  f_Exec_Comp_Stream_Acc_Output l output_fun trans_fun xs c ! i\"\napply (drule order_le_less[THEN iffD1], erule disjE)\n prefer 2\n apply simp\napply (frule zero_less_diff[of k l, THEN iffD2])\napply (frule length_greater_imp_not_empty)\napply (simp add: f_Exec_Stream_Acc_Output_nth del: f_Exec_Stream_Cons)\napply (subst replicate_le_diff2[OF Suc_leI, symmetric])\n apply (simp del: f_Exec_Stream_Cons)+\napply (subst append_Cons[symmetric])\napply (case_tac i)\n apply (drule_tac x=0 in spec)\n apply (simp add: f_Exec_Stream_Acc_LocalState_nth take_first f_expand_one del: last.simps f_Exec_Cons f_Exec_Stream_Cons append_Cons replicate.simps)\n apply (simp only: f_Exec_Stream_append map_append last_message_append)\n apply (rule if_P')\n  apply (clarsimp simp: last_message_NoMsg_conv f_Exec_Stream_nth min_eqL simp del: last.simps f_Exec_Comp.simps append_Cons replicate.simps)\n  apply (rule f_Exec_State_Idle_replicate_NoMsg_gr0_output)\n  apply (simp del: last.simps f_Exec_Comp_Stream.simps append_Cons)+\napply (rename_tac n)\napply (simp only: f_Exec_Stream_append map_append last_message_append)\napply (subgoal_tac \"\n  localState (f_Exec_Comp trans_fun (xs \\<down> Suc n \\<odot>\\<^sub>f k) c) =\n  localState (f_Exec_Comp trans_fun (xs \\<down> Suc n \\<odot>\\<^sub>f l) c)\")\n prefer 2\n apply (simp add: f_Exec_Stream_Acc_LocalState_nth[symmetric])\n apply (rule f_Exec_Stream_Acc_LocalState__State_Idle_nth)\n apply simp+\n apply (rename_tac n, drule_tac x=n in spec, simp)\n apply simp\napply (rule if_P')\n apply (simp add: last_message_NoMsg_conv f_Exec_Stream_nth min_eqL del: f_Exec_Comp.simps replicate.simps)\n apply (clarify, rename_tac j)\n apply (frule_tac x=\"Suc n\" in spec)\n apply (simp only: f_Exec_Stream_Acc_LocalState_nth)\n apply (rule_tac\n   ?c1.0=\"f_Exec_Comp trans_fun (xs \\<down> Suc n \\<odot>\\<^sub>f l) c\"\n   and ?c2.0=\"f_Exec_Comp trans_fun (xs \\<down> Suc n \\<odot>\\<^sub>f k) c\"\n   in subst[OF f_Exec_Equal_State, rule_format])\n  apply (simp del: f_Exec_Comp.simps replicate.simps)+\n apply (simp only: take_Suc_conv_app_nth f_expand_snoc f_Exec_append)\n apply (rule f_Exec_State_Idle_replicate_NoMsg_gr0_output, assumption)\n apply simp\napply (rule arg_cong[where f=\"\\<lambda>x. last_message (map output_fun x)\"])\napply (rule f_Exec_Stream_Equal_State, assumption+)\ndone\n\nlemma f_Exec_Stream_Acc_Output__State_Idle_eq[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    \\<forall>n<length xs. State_Idle localState output_fun trans_fun (\n      f_Exec_Comp_Stream_Acc_LocalState l localState trans_fun xs c ! n) \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c =\n  f_Exec_Comp_Stream_Acc_Output l output_fun trans_fun xs c\"\napply (clarsimp simp: list_eq_iff)\napply (rule f_Exec_Stream_Acc_Output__State_Idle_nth)\napply simp_all\napply (drule_tac x=n in spec)\napply simp\ndone\n\nlemma i_Exec_Stream_Acc_Output__State_Idle_nth[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    \\<forall>n\\<le>i. State_Idle localState output_fun trans_fun (\n      i_Exec_Comp_Stream_Acc_LocalState l localState trans_fun input c n) \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c i =\n  i_Exec_Comp_Stream_Acc_Output l output_fun trans_fun input c i\"\napply (simp only: i_Exec_Stream_Acc_Output_nth_f_nth)\napply (rule f_Exec_Stream_Acc_Output__State_Idle_nth)\napply simp_all\napply (drule_tac x=n in spec)\napply (simp add: f_Exec_Stream_Acc_LocalState_nth_eq_i_nth)\ndone\n\nlemma i_Exec_Stream_Acc_Output__State_Idle_eq[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    \\<forall>n. State_Idle localState output_fun trans_fun (\n      i_Exec_Comp_Stream_Acc_LocalState l localState trans_fun input c n) \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c =\n  i_Exec_Comp_Stream_Acc_Output l output_fun trans_fun input c\"\napply (clarsimp simp: ilist_eq_iff)\napply (rule i_Exec_Stream_Acc_Output__State_Idle_nth)\napply simp_all\napply (drule_tac x=n in spec)\napply simp\ndone\n\n\ntext \\<open>\n  When a certain number @{term l} of steps suffices to reach\n  an idle state from any other idle state,\n  than for any acceleration factor @{term \"k \\<ge> l\"}\n  the accelerated processing of every input message\n  will be finished in an idle state.\\<close>\nlemma f_Exec_Stream_Acc_LocalState__State_Idle_all[rule_format]: \"\n  \\<And>c xs. \\<lbrakk> 0 < l; l \\<le> k;\n    State_Idle localState output_fun trans_fun (localState c);\n    \\<forall>c m. State_Idle localState output_fun trans_fun (localState c) \\<longrightarrow>\n      State_Idle localState output_fun trans_fun (\n        localState (f_Exec_Comp trans_fun (m # \\<NoMsg>\\<^bsup>l - Suc 0\\<^esup>) c));\n    i < length xs \\<rbrakk> \\<Longrightarrow>\n  State_Idle localState output_fun trans_fun (\n    f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c ! i)\"\napply (frule length_greater_imp_not_empty)\napply (subgoal_tac \"\n  State_Idle localState output_fun trans_fun (\n    localState (f_Exec_Comp trans_fun (hd xs # NoMsg\\<^bsup>k - Suc 0\\<^esup>) c))\")\n prefer 2\n apply (drule_tac x=c in spec, drule_tac x=\"hd xs\" in spec)\n apply (rule subst[OF replicate_le_diff2[OF Suc_leI], of 0 l k], assumption+)\n apply (simp add: f_Exec_append f_Exec_State_Idle_replicate_NoMsg_state)\napply (induct i)\n apply (simp add: f_Exec_Stream_Acc_LocalState_nth take_first hd_eq_first)\napply (drule_tac x=\"f_Exec_Comp trans_fun (hd xs # NoMsg\\<^bsup>k - Suc 0\\<^esup>) c\" in meta_spec)\napply (drule_tac x=\"tl xs\" in meta_spec)\napply (subgoal_tac \"i < length (tl xs) \\<and> tl xs \\<noteq> []\", elim conjE)\n prefer 2\n apply (simp add: length_greater_0_conv[symmetric] del: length_greater_0_conv)\napply (simp add: f_Exec_Stream_Acc_LocalState_nth)\napply (rule_tac n=\"Suc i\" in ssubst[OF take_Suc, rule_format], assumption)\napply (simp add: append_Cons[symmetric] f_Exec_append del: append_Cons)\napply (drule meta_mp)\n apply (drule_tac x=\"f_Exec_Comp trans_fun (hd xs # NoMsg\\<^bsup>k - Suc 0\\<^esup>) c\" in spec)\n apply (drule mp, simp)\n apply (drule_tac x=\"hd (tl xs)\" in spec)\n apply (subst replicate_le_diff2[OF Suc_leI, of 0 l k, symmetric], simp+)\n apply (simp add: f_Exec_append f_Exec_State_Idle_replicate_NoMsg_state)\napply (simp add: f_Exec_Stream_Acc_LocalState_nth)\ndone\n\nlemma i_Exec_Stream_Acc_LocalState__State_Idle_all[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k;\n    State_Idle localState output_fun trans_fun (localState c);\n    \\<forall>c m. State_Idle localState output_fun trans_fun (localState c) \\<longrightarrow>\n      State_Idle localState output_fun trans_fun (\n        localState (f_Exec_Comp trans_fun (m # \\<NoMsg>\\<^bsup>l - Suc 0\\<^esup>) c)) \\<rbrakk> \\<Longrightarrow>\n  State_Idle localState output_fun trans_fun (\n    i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c i)\"\napply (simp only: i_Exec_Stream_Acc_LocalState_nth_f_nth)\napply (rule f_Exec_Stream_Acc_LocalState__State_Idle_all)\napply simp_all\napply (rename_tac c' m, drule_tac x=c' in spec)\napply simp\ndone\n\nlemma f_Exec_Stream_Acc_Output__State_Idle_all_imp_eq[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    State_Idle localState output_fun trans_fun (localState c);\n    \\<forall>c m. State_Idle localState output_fun trans_fun (localState c) \\<longrightarrow>\n      State_Idle localState output_fun trans_fun (\n        localState (f_Exec_Comp trans_fun (m # \\<NoMsg>\\<^bsup>l - Suc 0\\<^esup>) c)) \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_Output k output_fun trans_fun xs c =\n  f_Exec_Comp_Stream_Acc_Output l output_fun trans_fun xs c\"\napply (rule f_Exec_Stream_Acc_Output__State_Idle_eq, assumption+)\napply (simp add: f_Exec_Stream_Acc_LocalState__State_Idle_all)\ndone\n\nlemma i_Exec_Stream_Acc_Output__State_Idle_all_imp_eq[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    State_Idle localState output_fun trans_fun (localState c);\n    \\<forall>c m. State_Idle localState output_fun trans_fun (localState c) \\<longrightarrow>\n      State_Idle localState output_fun trans_fun (\n        localState (f_Exec_Comp trans_fun (m # \\<NoMsg>\\<^bsup>l - Suc 0\\<^esup>) c)) \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun input c =\n  i_Exec_Comp_Stream_Acc_Output l output_fun trans_fun input c\"\napply (rule i_Exec_Stream_Acc_Output__State_Idle_eq, assumption+)\napply (simp add: i_Exec_Stream_Acc_LocalState__State_Idle_all)\ndone\n\nlemma f_Exec_Stream_Acc_LocalState__State_Idle_all_imp_eq[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    State_Idle localState output_fun trans_fun (localState c);\n    \\<forall>c m. State_Idle localState output_fun trans_fun (localState c) \\<longrightarrow>\n      State_Idle localState output_fun trans_fun (\n        localState (f_Exec_Comp trans_fun (m # \\<NoMsg>\\<^bsup>l - Suc 0\\<^esup>) c)) \\<rbrakk> \\<Longrightarrow>\n  f_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c =\n  f_Exec_Comp_Stream_Acc_LocalState l localState trans_fun xs c\"\napply (rule f_Exec_Stream_Acc_LocalState__State_Idle_eq, assumption+)\napply (rule f_Exec_Stream_Acc_LocalState__State_Idle_all)\napply simp+\ndone\n\nlemma i_Exec_Stream_Acc_LocalState__State_Idle_all_imp_eq[rule_format]: \"\n  \\<lbrakk> 0 < l; l \\<le> k; Exec_Equal_State localState trans_fun;\n    State_Idle localState output_fun trans_fun (localState c);\n    \\<forall>c m. State_Idle localState output_fun trans_fun (localState c) \\<longrightarrow>\n      State_Idle localState output_fun trans_fun (\n        localState (f_Exec_Comp trans_fun (m # \\<NoMsg>\\<^bsup>l - Suc 0\\<^esup>) c)) \\<rbrakk> \\<Longrightarrow>\n  i_Exec_Comp_Stream_Acc_LocalState k localState trans_fun xs c =\n  i_Exec_Comp_Stream_Acc_LocalState l localState trans_fun xs c\"\napply (rule i_Exec_Stream_Acc_LocalState__State_Idle_eq, assumption+)\napply (rule i_Exec_Stream_Acc_LocalState__State_Idle_all)\napply simp+\ndone\n\n\ntext \\<open>Converting inputs\\<close>\n\nlemma f_Exec_input_map: \"\\<And>c.\n  f_Exec_Comp trans_fun (map f xs) c = f_Exec_Comp (trans_fun \\<circ> f) xs c\"\nby (induct xs, simp+)\nlemma f_Exec_Stream_input_map: \"\n  f_Exec_Comp_Stream trans_fun (map f xs) c =\n  f_Exec_Comp_Stream (trans_fun \\<circ> f) xs c\"\nby (simp add: list_eq_iff f_Exec_Stream_nth take_map f_Exec_input_map)\nlemma i_Exec_Stream_input_map: \"\n  i_Exec_Comp_Stream trans_fun (f \\<circ> input) c =\n  i_Exec_Comp_Stream (trans_fun \\<circ> f) input c\"\nby (simp add: ilist_eq_iff i_Exec_Stream_nth f_Exec_input_map)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AutoFocus-Stream/AF_Stream_Exec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011686727231, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.30853351408982205}}
{"text": "section \\<open>Library Additions\\<close>\ntheory Analysis_More\n  imports \"HOL-Analysis.Equivalence_Lebesgue_Henstock_Integration\"\n    \"HOL-Library.Function_Algebras\"\n    \"HOL-Types_To_Sets.Linear_Algebra_On\"\nbegin\n\n\nlemma openin_open_Int'[intro]:\n  \"open S \\<Longrightarrow> openin (top_of_set U) (S \\<inter> U)\"\n  by (auto simp: openin_open)\n\nsubsection \\<open>Parametricity rules for topology\\<close>\n\ntext \\<open>TODO: also check with theory \\<open>Transfer_Euclidean_Space_Vector\\<close> in AFP/ODE...\\<close>\n\ncontext includes lifting_syntax begin\n\nlemma Sigma_transfer[transfer_rule]:\n  \"(rel_set A ===> (A ===> rel_set B) ===> rel_set (rel_prod A B)) Sigma Sigma\"\n  unfolding Sigma_def\n  by transfer_prover\n\nlemma filterlim_transfer[transfer_rule]:\n  \"((A ===> B) ===> rel_filter B ===> rel_filter A ===> (=)) filterlim filterlim\"\n  if [transfer_rule]: \"bi_unique B\"\n  unfolding filterlim_iff\n  by transfer_prover\n\nlemma nhds_transfer[transfer_rule]:\n  \"(A ===> rel_filter A) nhds nhds\"\n  if [transfer_rule]: \"bi_unique A\" \"bi_total A\" \"(rel_set A ===> (=)) open open\"\n  unfolding nhds_def\n  by transfer_prover\n\nlemma at_within_transfer[transfer_rule]:\n  \"(A ===> rel_set A ===> rel_filter A) at_within at_within\"\n  if [transfer_rule]: \"bi_unique A\" \"bi_total A\" \"(rel_set A ===> (=)) open open\"\n  unfolding at_within_def\n  by transfer_prover\n\nlemma continuous_on_transfer[transfer_rule]:\n  \"(rel_set A ===> (A ===> B) ===> (=)) continuous_on continuous_on\"\n  if [transfer_rule]: \"bi_unique A\" \"bi_total A\" \"(rel_set A ===> (=)) open open\"\n    \"bi_unique B\" \"bi_total B\" \"(rel_set B ===> (=)) open open\"\n  unfolding continuous_on_def\n  by transfer_prover\n\nlemma continuous_on_transfer_right_total[transfer_rule]:\n  \"(rel_set A ===> (A ===> B) ===> (=)) (\\<lambda>X::'a::t2_space set. continuous_on (X \\<inter> Collect AP)) (\\<lambda>Y::'b::t2_space set. continuous_on Y)\"\n  if DomainA: \"Domainp A = AP\"\n    and [folded DomainA, transfer_rule]: \"bi_unique A\" \"right_total A\" \"(rel_set A ===> (=)) (openin (top_of_set (Collect AP))) open\"\n    \"bi_unique B\" \"bi_total B\" \"(rel_set B ===> (=)) open open\"\n  unfolding DomainA[symmetric]\nproof (intro rel_funI)\n  fix X Y f g\n  assume H[transfer_rule]: \"rel_set A X Y\" \"(A ===> B) f g\"\n  from H(1) have XA: \"x \\<in> X \\<Longrightarrow> Domainp A x\" for x\n    by (auto simp: rel_set_def)\n  then have *: \"X \\<inter> Collect (Domainp A) = X\" by auto\n  have \"openin (top_of_set (Collect (Domainp A))) (Collect (Domainp A))\" by auto\n  show \" continuous_on (X \\<inter> Collect (Domainp A)) f = continuous_on Y g\"\n    unfolding continuous_on_eq_continuous_within continuous_within_topological *\n    apply transfer\n    apply safe\n    subgoal for x B\n      apply (drule bspec, assumption, drule spec, drule mp, assumption, drule mp, assumption)\n      apply clarsimp\n      subgoal for AA\n        apply (rule exI[where x=\"AA \\<inter> Collect (Domainp A)\"])\n        by (auto intro: XA)\n      done\n    subgoal using XA by (force simp: openin_subtopology)\n    done\nqed\n\nlemma continuous_on_transfer_right_total2[transfer_rule]:\n  \"(rel_set A ===> (A ===> B) ===> (=)) (\\<lambda>X::'a::t2_space set. continuous_on X) (\\<lambda>Y::'b::t2_space set. continuous_on Y)\"\n  if DomainB: \"Domainp B = BP\"\n  and [folded DomainB, transfer_rule]: \"bi_unique A\" \"bi_total A\" \"(rel_set A ===> (=)) open open\"\n    \"bi_unique B\" \"right_total B\" \"(rel_set B ===> (=)) ((openin (top_of_set (Collect BP)))) open\"\n  unfolding DomainB[symmetric]\nproof (intro rel_funI)\n  fix X Y f g\n  assume H[transfer_rule]: \"rel_set A X Y\" \"(A ===> B) f g\"\n  show \"continuous_on X f = continuous_on Y g\"\n    unfolding continuous_on_eq_continuous_within continuous_within_topological\n    apply transfer\n    apply safe\n    subgoal for x C\n      apply (clarsimp simp: openin_subtopology)\n      apply (drule bspec, assumption, drule spec, drule mp, assumption, drule mp, assumption)\n      apply clarsimp\n      by (meson Domainp_applyI H(1) H(2) rel_setD1)\n    subgoal for x C\n    proof -\n      let ?sub = \"top_of_set (Collect (Domainp B))\"\n      assume cont: \"\\<forall>x\\<in>X. \\<forall>Ba\\<in>{A. Ball A (Domainp B)}.\n          openin (top_of_set (Collect (Domainp B))) Ba \\<longrightarrow> f x \\<in> Ba \\<longrightarrow> (\\<exists>Aa.  open Aa \\<and> x \\<in> Aa \\<and> (\\<forall>y\\<in>X. y \\<in> Aa \\<longrightarrow> f y \\<in> Ba))\"\n        and x: \"x \\<in> X\" \"open C\" \"f x \\<in> C\"\n      let ?B = \"C \\<inter> Collect (Domainp B)\"\n      have \"?B \\<in> {A. Ball A (Domainp B)}\" by auto\n      have \"openin ?sub (Collect (Domainp B))\" by auto\n      then have \"openin ?sub ?B\" using \\<open>open C\\<close> by auto\n      moreover have \"f x \\<in> ?B\" using x\n        apply transfer apply auto\n        by (meson Domainp_applyI H(1) H(2) rel_setD1)\n      ultimately obtain D where \"open D \\<and> x \\<in> D \\<and> (\\<forall>y\\<in>X. y \\<in> D \\<longrightarrow> f y \\<in> ?B)\"\n        using cont x\n        by blast\n      then show \"\\<exists>A. open A \\<and> x \\<in> A \\<and> (\\<forall>y\\<in>X. y \\<in> A \\<longrightarrow> f y \\<in> C)\" by auto\n    qed\n    done\nqed\n\n\nlemma generate_topology_transfer[transfer_rule]:\n  includes lifting_syntax\n  assumes [transfer_rule]: \"right_total A\" \"bi_unique A\"\n  shows \"(rel_set (rel_set A) ===> rel_set A ===> (=)) (generate_topology o (insert (Collect (Domainp A)))) generate_topology\"\nproof (intro rel_funI)\n  fix B C X Y assume t[transfer_rule]: \"rel_set (rel_set A) B C\" \"rel_set A X Y\"\n  then have \"X \\<subseteq> Collect (Domainp A)\" by (auto simp: rel_set_def)\n  with t have rI: \"rel_set A (X \\<inter> Collect (Domainp A)) Y\"\n    by (auto simp: inf_absorb1)\n  have eq_UNIV_I: \"Z = UNIV\" if [transfer_rule]: \"rel_set A {a. Domainp A a} Z\" for Z\n    using that assms\n    apply (auto simp: right_total_def rel_set_def)\n    using bi_uniqueDr by fastforce\n  show \"(generate_topology \\<circ> insert (Collect (Domainp A))) B X = generate_topology C Y\"\n    unfolding o_def\n  proof (rule iffI)\n    fix x\n    assume \"generate_topology (insert (Collect (Domainp A)) B) X\"\n    then show \"generate_topology C Y\" unfolding o_def\n      using rI\n    proof (induction X arbitrary: Y)\n      case [transfer_rule]: UNIV\n      with eq_UNIV_I[of Y] show ?case\n        by (simp add: generate_topology.UNIV)\n    next\n      case (Int a b)\n      note [transfer_rule] = Int(5)\n      obtain a' where a'[transfer_rule]: \"rel_set A (a \\<inter> Collect (Domainp A)) a'\"\n        by (metis Domainp_iff Domainp_set Int_Collect)\n      obtain b' where b'[transfer_rule]: \"rel_set A (b \\<inter> Collect (Domainp A)) b'\"\n        by (metis Domainp_iff Domainp_set Int_Collect)\n      from Int.IH(1)[OF a'] Int.IH(2)[OF b']\n      have \"generate_topology C a'\" \"generate_topology C b'\" by auto\n      from generate_topology.Int[OF this] have \"generate_topology C (a' \\<inter> b')\" .\n      also have \"a' \\<inter> b' = Y\"\n        by transfer auto\n      finally show ?case\n        by (simp add: generate_topology.Int)\n    next\n      case (UN K)\n      note [transfer_rule] = UN(3)\n      have \"\\<exists>K'. \\<forall>k. rel_set A (k \\<inter> Collect (Domainp A)) (K' k)\"\n        by (rule choice) (metis Domainp_iff Domainp_set Int_Collect)\n      then obtain K' where K': \"\\<And>k. rel_set A (k \\<inter> Collect (Domainp A)) (K' k)\" by metis\n      from UN.IH[OF _ this] have \"generate_topology C k'\" if \"k' \\<in> K'`K\" for k' using that by auto\n      from generate_topology.UN[OF this] have \"generate_topology C (\\<Union>(K' ` K))\" .\n      also\n      from K' have [transfer_rule]: \"(rel_set (=) ===> rel_set A) (\\<lambda>x. x \\<inter> Collect (Domainp A)) K'\"\n        by (fastforce simp: rel_fun_def rel_set_def)\n      have \"\\<Union>(K' ` K) = Y\"\n        by transfer auto\n      finally show ?case\n        by (simp add: generate_topology.UN)\n    next\n      case (Basis s)\n      from this(1) show ?case\n      proof\n        assume \"s = Collect (Domainp A)\" \n        with eq_UNIV_I[of Y] Basis(2)\n        show ?case\n          by (simp add: generate_topology.UNIV)\n      next\n        assume \"s \\<in> B\"\n        with Basis(2) obtain t where [transfer_rule]: \"rel_set A (s \\<inter> Collect (Domainp A)) t\" by auto\n        from Basis(1) t(1) have s: \"s \\<inter> Collect (Domainp A) = s\"\n          by (force simp: rel_set_def)\n        have \"t \\<in> C\" using \\<open>s \\<in> B\\<close> s\n          by transfer auto\n        also note [transfer_rule] = Basis(2)\n        have \"t = Y\"\n          by transfer auto\n        finally show ?case\n          by (rule generate_topology.Basis)\n      qed\n    qed\n  next\n    assume \"generate_topology C Y\"\n    then show \"generate_topology (insert (Collect (Domainp A)) B) X\"\n      using \\<open>rel_set A X Y\\<close>\n    proof (induction arbitrary: X)\n      case [transfer_rule]: UNIV\n      have \"UNIV = (UNIV::'b set)\" by auto\n      then have \"X = {a. Domainp A a}\" by transfer\n      then show ?case by (intro generate_topology.Basis) auto\n    next\n      case (Int a b)\n      obtain a' b' where [transfer_rule]: \"rel_set A a' a\" \"rel_set A b' b\"\n        by (meson assms(1) right_total_def right_total_rel_set)\n      from generate_topology.Int[OF Int.IH(1)[OF this(1)] Int.IH(2)[OF this(2)]]\n      have \"generate_topology (insert {a. Domainp A a} B) (a' \\<inter> b')\" by simp\n      also\n      define I where \"I = a \\<inter> b\"\n      from \\<open>rel_set A X (a \\<inter> b)\\<close> have [transfer_rule]: \"rel_set A X I\" by (simp add: I_def)\n      from I_def\n      have \"a' \\<inter> b' = X\" by transfer simp\n      finally show ?case .\n    next\n      case (UN K)\n      have \"\\<exists>K'. \\<forall>k. rel_set A (K' k) k\"\n        by (rule choice) (meson assms(1) right_total_def right_total_rel_set)\n      then obtain K' where K': \"\\<And>k. rel_set A (K' k) k\" by metis\n      from UN.IH[OF _ this] have \"generate_topology (insert {a. Domainp A a} B) k\"\n        if \"k \\<in> K'`K\" for k using that by auto\n      from generate_topology.UN[OF this]\n      have \"generate_topology (insert {a. Domainp A a} B) (\\<Union>(K'`K))\" by auto\n      also\n      from K' have [transfer_rule]: \"(rel_set (=) ===> rel_set A) K' id\"\n        by (fastforce simp: rel_fun_def rel_set_def)\n      define U where \"U =  (\\<Union>(id ` K))\"\n      from \\<open>rel_set A X _\\<close> have [transfer_rule]: \"rel_set A X U\" by (simp add: U_def)\n      from U_def have \"\\<Union>(K' ` K) = X\" by transfer simp\n      finally show ?case .\n    next\n      case (Basis s)\n      note [transfer_rule] = \\<open>rel_set A X s\\<close>\n      from \\<open>s \\<in> C\\<close> have \"X \\<in> B\" by transfer\n      then show ?case by (intro generate_topology.Basis) auto\n    qed\n  qed\nqed\n\nend\n\n\nsubsection \\<open>Miscellaneous\\<close>\n\nlemmas [simp del] = mem_ball\n\nlemma in_closureI[intro, simp]: \"x \\<in> X \\<Longrightarrow> x \\<in> closure X\"\n  using closure_subset by auto\n\nlemmas open_continuous_vimage = continuous_on_open_vimage[THEN iffD1, rule_format]\nlemma open_continuous_vimage': \"open s \\<Longrightarrow> continuous_on s f \\<Longrightarrow> open B \\<Longrightarrow> open (s \\<inter> f -` B)\"\n  using open_continuous_vimage[of s f B] by (auto simp: Int_commute)\n\nlemma support_on_mono: \"support_on carrier f \\<subseteq> support_on carrier g\"\n  if \"\\<And>x. x \\<in> carrier \\<Longrightarrow> f x \\<noteq> 0 \\<Longrightarrow> g x \\<noteq> 0\"\n  using that\n  by (auto simp: support_on_def)\n\n\n\n\n\nsubsection \\<open>Closed support\\<close>\n\ndefinition \"csupport_on X S = closure (support_on X S)\"\n\nlemma closed_csupport_on[intro, simp]: \"closed (csupport_on carrier \\<phi>)\"\n  by (auto simp: csupport_on_def)\n\nlemma not_in_csupportD: \"x \\<notin> csupport_on carrier \\<phi> \\<Longrightarrow> x \\<in> carrier \\<Longrightarrow> \\<phi> x = 0\"\n  by (auto simp: csupport_on_def support_on_def)\n\nlemma csupport_on_mono: \"csupport_on carrier f \\<subseteq> csupport_on carrier g\"\n  if \"\\<And>x. x \\<in> carrier \\<Longrightarrow> f x \\<noteq> 0 \\<Longrightarrow> g x \\<noteq> 0\"\n  unfolding csupport_on_def\n  apply (rule closure_mono)\n  using that\n  by (rule support_on_mono)\n\nsubsection \\<open>Homeomorphism\\<close>\n\nlemma homeomorphism_empty[simp]:\n  \"homeomorphism {} t f f' \\<longleftrightarrow> t = {}\"\n  \"homeomorphism s {} f f' \\<longleftrightarrow> s = {}\"\n  by (auto simp: homeomorphism_def)\n\nlemma homeomorphism_add:\n  \"homeomorphism UNIV UNIV (\\<lambda>x. x + c) (\\<lambda>x. x - c)\"\n  for c::\"_::real_normed_vector\"\n  unfolding homeomorphism_def\n  by (auto simp: algebra_simps continuous_intros intro!: image_eqI[where x=\"x - c\" for x])\n\nlemma in_range_scaleR_iff: \"x \\<in> range ((*\\<^sub>R) c) \\<longleftrightarrow> c = 0 \\<longrightarrow> x = 0\"\n  for x::\"_::real_vector\"\n  by (auto simp: intro!: image_eqI[where x=\"x /\\<^sub>R c\"])\n\nlemma homeomorphism_scaleR:\n  \"homeomorphism UNIV UNIV (\\<lambda>x. c *\\<^sub>R x::_::real_normed_vector) (\\<lambda>x. x /\\<^sub>R c)\"\n  if \"c \\<noteq> 0\"\n  using that\n  unfolding homeomorphism_def\n  by (auto simp: in_range_scaleR_iff algebra_simps intro!: continuous_intros)\n\n\nlemma homeomorphism_prod:\n  \"homeomorphism (a \\<times> b) (c \\<times> d) (\\<lambda>(x, y). (f x, g y)) (\\<lambda>(x, y). (f' x, g' y))\"\n  if \"homeomorphism a c f f'\"\n     \"homeomorphism b d g g'\"\n  using that by (simp add: homeomorphism_def image_prod)\n    (auto simp add: split_beta intro!: continuous_intros elim: continuous_on_compose2)\n\n\nsubsection \\<open>Generalizations\\<close>\n\nlemma openin_subtopology_eq_generate_topology:\n  \"openin (top_of_set S) x = generate_topology (insert S ((\\<lambda>B. B \\<inter> S) ` BB)) x\"\n  if open_gen: \"open = generate_topology BB\" and subset: \"x \\<subseteq> S\"\nproof -\n  have \"generate_topology (insert S ((\\<lambda>B. B \\<inter> S) ` BB)) (T \\<inter> S)\"\n    if \"generate_topology BB T\"\n    for T\n    using that\n  proof (induction)\n    case UNIV\n    then show ?case by (auto intro!: generate_topology.Basis)\n  next\n    case (Int a b)\n    have \"generate_topology (insert S ((\\<lambda>B. B \\<inter> S) ` BB)) (a \\<inter> S \\<inter> (b \\<inter> S))\"\n      by (rule generate_topology.Int) (use Int in auto)\n    then show ?case by (simp add: ac_simps)\n  next\n    case (UN K)\n    then have \"generate_topology (insert S ((\\<lambda>B. B \\<inter> S) ` BB)) (\\<Union>k\\<in>K. k \\<inter> S)\"\n      by (intro generate_topology.UN) auto\n    then show ?case by simp\n  next\n    case (Basis s)\n    then show ?case\n      by (intro generate_topology.Basis) auto\n  qed\n  moreover\n  have \"\\<exists>T. generate_topology BB T \\<and> x = T \\<inter> S\"\n    if \"generate_topology (insert S ((\\<lambda>B. B \\<inter> S) ` BB)) x\" \"x \\<noteq> UNIV\"\n    using that\n  proof (induction)\n    case UNIV\n    then show ?case by simp\n  next\n    case (Int a b)\n    then show ?case\n      using generate_topology.Int \n      by auto\n  next\n    case (UN K)\n    from UN.IH have \"\\<forall>k\\<in>K-{UNIV}. \\<exists>T. generate_topology BB T \\<and> k = T \\<inter> S\" by auto\n    from this[THEN bchoice] obtain T where T: \"\\<And>k. k \\<in> T ` (K - {UNIV}) \\<Longrightarrow> generate_topology BB k\" \"\\<And>k. k \\<in> K - {UNIV} \\<Longrightarrow> k = (T k) \\<inter> S\"\n      by auto\n    from generate_topology.UN[OF T(1)]\n    have \"generate_topology BB (\\<Union>(T ` (K - {UNIV})))\" by auto\n    moreover have \"\\<Union>K = (\\<Union>(T ` (K - {UNIV}))) \\<inter> S\" if \"UNIV \\<notin> K\" using T(2) UN that by auto\n    ultimately show ?case\n      apply (cases \"UNIV \\<in> K\") subgoal using UN by auto\n      subgoal by auto\n      done\n  next\n    case (Basis s)\n    then show ?case\n      using generate_topology.UNIV generate_topology.Basis by blast\n  qed\n  moreover\n  have \"\\<exists>T. generate_topology BB T \\<and> UNIV = T \\<inter> S\" if \"generate_topology (insert S ((\\<lambda>B. B \\<inter> S) ` BB)) x\"\n     \"x = UNIV\"\n  proof -\n    have \"S = UNIV\"\n      using that \\<open>x \\<subseteq> S\\<close>\n      by auto\n    then show ?thesis by (simp add: generate_topology.UNIV)\n  qed\n  ultimately show ?thesis\n    by (metis open_gen open_openin openin_open_Int' openin_subtopology)\nqed\n\nsubsection \\<open>Equal topologies\\<close>\n\nlemma topology_eq_iff: \"t = s \\<longleftrightarrow> (topspace t = topspace s \\<and>\n  (\\<forall>x\\<subseteq>topspace t. openin t x = openin s x))\"\n  by (metis (full_types) openin_subset topology_eq)\n\n\nsubsection \\<open>Finer topologies\\<close>\n\ndefinition finer_than (infix \"(finer'_than)\" 50)\n  where \"T1 finer_than T2 \\<longleftrightarrow> continuous_map T1 T2 (\\<lambda>x. x)\"\n\nlemma finer_than_iff_nhds:\n  \"T1 finer_than T2 \\<longleftrightarrow> (\\<forall>X. openin T2 X \\<longrightarrow> openin T1 (X \\<inter> topspace T1)) \\<and> (topspace T1 \\<subseteq> topspace T2)\"\n  by (auto simp: finer_than_def continuous_map_alt)\n\nlemma continuous_on_finer_topo:\n  \"continuous_map s t f\"\n  if \"continuous_map s' t f\" \"s finer_than s'\"\n  using that\n  by (auto simp: finer_than_def o_def dest: continuous_map_compose)\n\n\n\nlemma antisym_finer_than: \"S = T\" if \"S finer_than T\" \"T finer_than S\"\n  using that\n  apply (auto simp: finer_than_def topology_eq_iff continuous_map_alt)\n  apply (metis inf.orderE)+\n  done\n\nlemma subtopology_finer_than[simp]: \"top_of_set X finer_than euclidean\"\n  by (auto simp: finer_than_iff_nhds openin_subtopology)\n\nsubsection \\<open>Support\\<close>\n\nlemma support_on_nonneg_sum:\n  \"support_on X (\\<lambda>x. \\<Sum>i\\<in>S. f i x) = (\\<Union>i\\<in>S. support_on X (f i))\"\n  if \"finite S\" \"\\<And>x i . x \\<in> X \\<Longrightarrow> i \\<in> S \\<Longrightarrow> f i x \\<ge> 0\"\n  for f::\"_\\<Rightarrow>_\\<Rightarrow>_::ordered_comm_monoid_add\"\n  using that by (auto simp: support_on_def sum_nonneg_eq_0_iff)\n\nlemma support_on_nonneg_sum_subset:\n  \"support_on X (\\<lambda>x. \\<Sum>i\\<in>S. f i x) \\<subseteq> (\\<Union>i\\<in>S. support_on X (f i))\"\n  for f::\"_\\<Rightarrow>_\\<Rightarrow>_::ordered_comm_monoid_add\"\nby (cases \"finite S\") (auto simp: support_on_def, meson sum.neutral)\n\n\n\nsubsection \\<open>Final topology (Bourbaki, General Topology I, 4.)\\<close>\n\ndefinition \"final_topology X Y f =\n  topology (\\<lambda>U. U \\<subseteq> X \\<and>\n    (\\<forall>i. openin (Y i) (f i -` U \\<inter> topspace (Y i))))\"\n\nlemma openin_final_topology:\n  \"openin (final_topology X Y f) =\n    (\\<lambda>U. U \\<subseteq> X \\<and> (\\<forall>i. openin (Y i) (f i -` U \\<inter> topspace (Y i))))\"\n  unfolding final_topology_def\n  apply (rule topology_inverse')\n  unfolding istopology_def\nproof safe\n  fix S T i\n  assume \"\\<forall>i. openin (Y i) (f i -` S \\<inter> topspace (Y i))\"\n    \"\\<forall>i. openin (Y i) (f i -` T \\<inter> topspace (Y i))\"\n  then have \"openin (Y i) (f i -` S \\<inter> topspace (Y i) \\<inter> (f i -` T \\<inter> topspace (Y i)))\"\n    (is \"openin _ ?I\")\n    by auto\n  also have \"?I = f i -` (S \\<inter> T) \\<inter> topspace (Y i)\"\n    (is \"_ = ?R\")\n    by auto\n  finally show \"openin (Y i) ?R\" .\nnext\n  fix K i\n  assume \"\\<forall>U\\<in>K. U \\<subseteq> X \\<and> (\\<forall>i. openin (Y i) (f i -` U \\<inter> topspace (Y i)))\"\n  then have \"openin (Y i) (\\<Union>X\\<in>K. f i -` X \\<inter> topspace (Y i))\"\n    by (intro openin_Union) auto\n  then show \"openin (Y i) (f i -` \\<Union>K \\<inter> topspace (Y i))\"\n    by (auto simp: vimage_Union)\nqed force+\n\n\n\nlemma continuous_on_final_topologyI2:\n  \"continuous_map (Y i) (final_topology X Y f) (f i)\"\n  if \"\\<And>i. f i \\<in> topspace (Y i) \\<rightarrow> X\"\n  using that\n  by (auto simp: openin_final_topology continuous_map_alt topspace_final_topology)\n\nlemma continuous_on_final_topologyI1:\n  \"continuous_map (final_topology X Y f) Z g\"\n  if hyp: \"\\<And>i. continuous_map (Y i) Z (g o f i)\"\n    and that: \"\\<And>i. f i \\<in> topspace (Y i) \\<rightarrow> X\" \"g \\<in> X \\<rightarrow> topspace Z\"\n  unfolding continuous_map_alt\nproof safe\n  fix V assume V: \"openin Z V\"\n  have oV: \"openin (Y i) (f i -` g -` V \\<inter> topspace (Y i))\"\n    for i\n    using hyp[rule_format, of i] V\n    by (auto simp: continuous_map_alt vimage_comp dest!: spec[where x=V])\n  have *: \"f i -` g -` V \\<inter> f i -` X \\<inter> topspace (Y i) =\n      f i -` g -` V \\<inter> topspace (Y i)\"\n    (is \"_ = ?rhs i\")\n    for i using that\n    by auto\n  show \"openin (final_topology X Y f) (g -` V \\<inter> topspace (final_topology X Y f))\"\n    by (auto simp: openin_final_topology oV topspace_final_topology that *)\nqed (use that in \\<open>auto simp: topspace_final_topology\\<close>)\n\n\nlemma continuous_on_final_topology_iff:\n  \"continuous_map (final_topology X Y f) Z g \\<longleftrightarrow> (\\<forall>i. continuous_map (Y i) Z (g o f i))\"\n  if \"\\<And>i. f i \\<in> topspace (Y i) \\<rightarrow> X\" \"g \\<in> X \\<rightarrow> topspace Z\"\n  using that\n  by (auto intro!: continuous_on_final_topologyI1[OF _ that]\n      intro: continuous_map_compose[OF continuous_on_final_topologyI2[OF that(1)]])\n\n\nsubsection \\<open>Quotient topology\\<close>\n\ndefinition map_topology :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a topology \\<Rightarrow> 'b topology\" where\n  \"map_topology p X = final_topology (p ` topspace X) (\\<lambda>_. X) (\\<lambda>(_::unit). p)\"\n\nlemma openin_map_topology:\n  \"openin (map_topology p X) = (\\<lambda>U. U \\<subseteq> p ` topspace X \\<and> openin X (p -` U \\<inter> topspace X))\"\n  by (auto simp: map_topology_def openin_final_topology)\n\nlemma topspace_map_topology[simp]: \"topspace (map_topology f T) = f ` topspace T\"\n  unfolding map_topology_def\n  by (subst topspace_final_topology) auto\n\nlemma continuous_on_map_topology:\n  \"continuous_map T (map_topology f T) f\"\n  unfolding continuous_map_alt openin_map_topology\n  by auto\n\nlemma continuous_map_composeD:\n  \"continuous_map T X (g \\<circ> f) \\<Longrightarrow> g \\<in> f ` topspace T \\<rightarrow> topspace X\"\n  by (auto simp: continuous_map_def)\n\nlemma continuous_on_map_topology2:\n  \"continuous_map T X (g \\<circ> f) \\<longleftrightarrow> continuous_map (map_topology f T) X g\"\n  unfolding map_topology_def\n  apply safe\n  subgoal\n    apply (rule continuous_on_final_topologyI1)\n    subgoal by assumption\n    subgoal by force\n    subgoal by (rule continuous_map_composeD)\n    done\n  subgoal\n    apply (erule continuous_map_compose[rotated])\n    apply (rule continuous_on_final_topologyI2)\n    by force\n  done\n\nlemma map_sub_finer_than_commute:\n  \"map_topology f (subtopology T (f -` X)) finer_than subtopology (map_topology f T) X\"\n  by (auto simp: finer_than_def continuous_map_def openin_subtopology openin_map_topology\n      topspace_subtopology)\n\nlemma sub_map_finer_than_commute:\n  \"subtopology (map_topology f T) X finer_than map_topology f (subtopology T (f -` X))\"\n  if \"openin T (f -` X)\"\\<comment> \\<open>this is more or less the condition from\n    \\<^url>\\<open>https://math.stackexchange.com/questions/705840/quotient-topology-vs-subspace-topology\\<close>\\<close>\n  unfolding finer_than_def continuous_map_alt\nproof (rule conjI, clarsimp)\n  fix U\n  assume \"openin (map_topology f (subtopology T (f -` X))) U\"\n  then obtain W where W: \"U \\<subseteq> f ` (topspace T \\<inter> f -` X)\" \"openin T W\" \"f -` U \\<inter> (topspace T \\<inter> f -` X) = W \\<inter> f -` X\"\n    by (auto simp: topspace_subtopology openin_subtopology openin_map_topology)\n  have \"(f -` f ` W \\<inter> f -` X) \\<inter> topspace T = W \\<inter> topspace T \\<inter> f -` X\"\n    apply auto\n    by (metis Int_iff W(3) vimage_eq)\n  also have \"openin T \\<dots>\"\n    by (auto intro!: W that)\n  finally show \"openin (subtopology (map_topology f T) X) (U \\<inter> (f ` topspace T \\<inter> X))\"\n    using W\n    unfolding topspace_subtopology topspace_map_topology openin_subtopology openin_map_topology\n    by (intro exI[where x=\"(f ` W \\<inter> X)\"]) auto\nqed auto\n\nlemma subtopology_map_topology:\n  \"subtopology (map_topology f T) X = map_topology f (subtopology T (f -` X))\"\n  if \"openin T (f -` X)\"\n  apply (rule antisym_finer_than)\n  using sub_map_finer_than_commute[OF that] map_sub_finer_than_commute[of f T X]\n  by auto\n\nlemma quotient_map_map_topology:\n  \"quotient_map X (map_topology f X) f\"\n  by (auto simp: quotient_map_def openin_map_topology ac_simps)\n    (simp_all add: vimage_def Int_def)\n\nlemma topological_space_quotient: \"class.topological_space (openin (map_topology f euclidean))\"\n  if \"surj f\"\n  apply standard\n    apply (auto simp: )\n  using that\n  by (auto simp: openin_map_topology)\n\nlemma t2_space_quotient: \"class.t2_space (open::'b set \\<Rightarrow> bool)\"\n  if open_def: \"open = (openin (map_topology (p::'a::t2_space\\<Rightarrow>'b::topological_space) euclidean))\"\n    \"surj p\" and open_p: \"\\<And>X. open X \\<Longrightarrow> open (p ` X)\" and \"closed {(x, y). p x = p y}\" (is \"closed ?R\")\n  apply (rule class.t2_space.intro)\n  subgoal by (unfold open_def, rule topological_space_quotient; fact)\nproof standard\n  fix a b::'b\n  obtain x y where a_def: \"a = p x\" and b_def: \"b = p y\" using \\<open>surj p\\<close> by fastforce\n  assume \"a \\<noteq> b\"\n  with \\<open>closed ?R\\<close> have \"open (-?R)\" \"(x, y) \\<in> -?R\" by (auto simp add: a_def b_def)\n  from open_prod_elim[OF this]\n  obtain N\\<^sub>x N\\<^sub>y where \"open N\\<^sub>x\" \"open N\\<^sub>y\" \"(x, y) \\<in> N\\<^sub>x \\<times> N\\<^sub>y\" \"N\\<^sub>x \\<times> N\\<^sub>y \\<subseteq> -?R\" .\n  then have \"p ` N\\<^sub>x \\<inter> p ` N\\<^sub>y = {}\" by auto\n  moreover\n  from \\<open>open N\\<^sub>x\\<close> \\<open>open N\\<^sub>y\\<close> have \"open (p ` N\\<^sub>x)\" \"open (p ` N\\<^sub>y)\"\n    using open_p by blast+\n  moreover have \"a \\<in> p ` N\\<^sub>x\" \"b \\<in> p ` N\\<^sub>y\" using \\<open>(x, y) \\<in> _ \\<times> _\\<close> by (auto simp: a_def b_def)\n  ultimately show \"\\<exists>U V. open U \\<and> open V \\<and> a \\<in> U \\<and> b \\<in> V \\<and> U \\<inter> V = {}\" by blast\nqed\n\nlemma second_countable_topology_quotient: \"class.second_countable_topology (open::'b set \\<Rightarrow> bool)\"\n  if open_def: \"open = (openin (map_topology (p::'a::second_countable_topology\\<Rightarrow>'b::topological_space) euclidean))\"\n    \"surj p\" and open_p: \"\\<And>X. open X \\<Longrightarrow> open (p ` X)\"\n  apply (rule class.second_countable_topology.intro)\n  subgoal by (unfold open_def, rule topological_space_quotient; fact)\nproof standard\n  have euclidean_def: \"euclidean = map_topology p euclidean\"\n    by (simp add: openin_inverse open_def)\n  have continuous_on: \"continuous_on UNIV p\"\n    using continuous_map_iff_continuous2 continuous_on_map_topology euclidean_def by fastforce\n  from ex_countable_basis[where 'a='a] obtain A::\"'a set set\" where \"countable A\" \"topological_basis A\"\n    by auto\n  define B where \"B = (\\<lambda>X. p ` X) ` A\"\n  have \"countable (B::'b set set)\"\n    by (auto simp: B_def intro!: \\<open>countable A\\<close>)\n  moreover have \"topological_basis B\"\n  proof (rule topological_basisI)\n    fix B' assume \"B' \\<in> B\" then show \"open B'\" using \\<open>topological_basis A\\<close>\n      by (auto simp: B_def topological_basis_open intro!: open_p)\n  next\n    fix x::'b and O' assume \"open O'\" \"x \\<in> O'\"\n    have \"open (p -` O')\"\n      using \\<open>open O'\\<close>\n      by (rule open_vimage) (auto simp: continuous_on)\n    obtain y where y: \"y \\<in> p -` {x}\"\n      using \\<open>x \\<in> O'\\<close>\n      by auto (metis UNIV_I open_def(2) rangeE)\n    then have \"y \\<in> p -` O'\" using \\<open>x \\<in> O'\\<close> by auto\n    from topological_basisE[OF \\<open>topological_basis A\\<close> \\<open>open (p -` O')\\<close> this]\n    obtain C where \"C \\<in> A\" \"y \\<in> C\" \"C \\<subseteq> p -` O'\" .\n    let ?B' = \"p ` C\"\n    have \"?B' \\<in> B\"\n      using \\<open>C \\<in> A\\<close> by (auto simp: B_def)\n    moreover\n    have \"x \\<in> ?B'\" using y \\<open>y \\<in> C\\<close> \\<open>x \\<in> O'\\<close>\n      by auto\n    moreover\n    have \"?B' \\<subseteq> O'\"\n      using \\<open>C \\<subseteq> _\\<close> by auto\n    ultimately show \"\\<exists>B'\\<in>B. x \\<in> B' \\<and> B' \\<subseteq> O'\" by metis\n  qed\n  ultimately show \"\\<exists>B::'b set set. countable B \\<and> open = generate_topology B\"\n    by (auto simp: topological_basis_imp_subbasis)\nqed\n\n\nsubsection \\<open>Closure\\<close>\n\nlemma closure_Union: \"closure (\\<Union>X) = (\\<Union>x\\<in>X. closure x)\" if \"finite X\"\n  using that\n  by (induction X) auto\n\nsubsection \\<open>Compactness\\<close>\n\nlemma compact_if_closed_subset_of_compact:\n  \"compact S\" if \"closed S\" \"compact T\" \"S \\<subseteq> T\"\nproof (rule compactI)\n  fix UU assume UU: \"\\<forall>t\\<in>UU. open t\" \"S \\<subseteq> \\<Union>UU\"\n  have \"T \\<subseteq> \\<Union>(insert (- S) (UU))\" \"\\<And>B. B \\<in> insert (- S) UU \\<Longrightarrow> open B\"\n    using UU \\<open>S \\<subseteq> T\\<close>\n    by (auto simp: open_Compl \\<open>closed S\\<close>)\n  from compactE[OF \\<open>compact T\\<close> this]\n  obtain \\<T>' where \\<T>: \"\\<T>' \\<subseteq> insert (- S) UU\" \"finite \\<T>'\" \"T \\<subseteq> \\<Union>\\<T>'\"\n    by metis\n  show \"\\<exists>C'\\<subseteq>UU. finite C' \\<and> S \\<subseteq> \\<Union>C'\"\n    apply (rule exI[where x=\"\\<T>' - {-S}\"])\n    using \\<T> UU\n    apply auto\n  proof -\n    fix x assume \"x \\<in> S\"\n    with \\<T> \\<open>S \\<subseteq> T\\<close> obtain U where \"x \\<in> U\" \"U \\<in> \\<T>'\" using \\<T>\n      by auto\n    then show \"\\<exists>X\\<in>\\<T>' - {- S}. x \\<in> X\"\n      using \\<T> UU \\<open>x \\<in> S\\<close>\n      apply -\n      apply (rule bexI[where x=U])\n      by auto\n  qed\nqed\n\nsubsection \\<open>Locally finite\\<close>\n\ndefinition \"locally_finite_on X I U \\<longleftrightarrow> (\\<forall>p\\<in>X. \\<exists>N. p\\<in>N \\<and> open N \\<and> finite {i\\<in>I. U i \\<inter> N \\<noteq> {}})\"\n\nlemmas locally_finite_onI = locally_finite_on_def[THEN iffD2, rule_format]\n\nlemma locally_finite_onE:\n  assumes \"locally_finite_on X I U\"\n  assumes \"p \\<in> X\"\n  obtains N where \"p \\<in> N\" \"open N\" \"finite {i\\<in>I. U i \\<inter> N \\<noteq> {}}\"\n  using assms\n  by (auto simp: locally_finite_on_def)\n\nlemma locally_finite_onD:\n  assumes \"locally_finite_on X I U\"\n  assumes \"p \\<in> X\"\n  shows \"finite {i\\<in>I. p \\<in> U i}\"\n  apply (rule locally_finite_onE[OF assms])\n  apply (rule finite_subset)\n  by auto\n\nlemma locally_finite_on_open_coverI: \"locally_finite_on X I U\"\n  if fin: \"\\<And>j. j \\<in> I \\<Longrightarrow> finite {i\\<in>I. U i \\<inter> U j \\<noteq> {}}\"\n    and open_cover: \"X \\<subseteq> (\\<Union>i\\<in>I. U i)\" \"\\<And>i. i \\<in> I \\<Longrightarrow> open (U i)\"\nproof (rule locally_finite_onI)\n  fix p assume \"p \\<in> X\"\n  then obtain i where i: \"i \\<in> I\" \"p \\<in> U i\" \"open (U i)\"\n    using open_cover\n    by blast\n  show \"\\<exists>N. p \\<in> N \\<and> open N \\<and> finite {i \\<in> I. U i \\<inter> N \\<noteq> {}}\"\n    by (intro exI[where x=\"U i\"] conjI i fin)\nqed\n\nlemma locally_finite_compactD:\n  \"finite {i\\<in>I. U i \\<inter> V \\<noteq> {}}\"\n  if lf: \"locally_finite_on X I U\"\n    and compact: \"compact V\"\n    and subset: \"V \\<subseteq> X\"\nproof -\n  have \"\\<exists>N. \\<forall>p \\<in> X. p \\<in> N p \\<and> open (N p) \\<and> finite {i\\<in>I. U i \\<inter> N p \\<noteq> {}}\"\n    by (rule bchoice) (auto elim!: locally_finite_onE[OF lf, rule_format])\n  then obtain N where N: \"\\<And>p. p \\<in> X \\<Longrightarrow> p \\<in> N p\"\n    \"\\<And>p. p \\<in> X \\<Longrightarrow> open (N p)\"\n    \"\\<And>p. p \\<in> X \\<Longrightarrow> finite {i\\<in>I. U i \\<inter> N p \\<noteq> {}}\"\n    by blast\n  have \"V \\<subseteq> (\\<Union>p\\<in>X. N p)\" \"\\<And>B. B \\<in> N ` X \\<Longrightarrow> open B\"\n    using N subset by force+\n  from compactE[OF compact this]\n  obtain C where C: \"C \\<subseteq> X\" \"finite C\" \"V \\<subseteq> \\<Union>(N ` C)\"\n    by (metis finite_subset_image)\n  then have \"{i\\<in>I. U i \\<inter> V \\<noteq> {}} \\<subseteq> {i\\<in>I. U i \\<inter> \\<Union>(N ` C) \\<noteq> {}}\"\n    by force\n  also have \"\\<dots> \\<subseteq> (\\<Union>c\\<in>C. {i\\<in>I. U i \\<inter> N c \\<noteq> {}})\"\n    by force\n  also have \"finite \\<dots>\"\n    apply (rule finite_Union)\n    using C by (auto intro!: C N)\n  finally (finite_subset) show ?thesis .\nqed\n\nlemma closure_Int_open_eq_empty: \"open S \\<Longrightarrow> (closure T \\<inter> S) = {} \\<longleftrightarrow> T \\<inter> S = {}\"\n  by (auto simp: open_Int_closure_eq_empty ac_simps)\n\nlemma locally_finite_on_subset:\n  assumes \"locally_finite_on X J U\"\n  assumes \"\\<And>i. i \\<in> I \\<Longrightarrow> V i \\<subseteq> U i\" \"I \\<subseteq> J\"\n  shows \"locally_finite_on X I V\"\nproof (rule locally_finite_onI)\n  fix p assume \"p \\<in> X\"\n  from locally_finite_onE[OF assms(1) this]\n  obtain N where \"p \\<in> N\" \"open N\" \"finite {i \\<in> J. U i \\<inter> N \\<noteq> {}}\" .\n  then show \"\\<exists>N. p \\<in> N \\<and> open N \\<and> finite {i \\<in> I. V i \\<inter> N \\<noteq> {}}\"\n    apply (intro exI[where x=N])\n    using assms\n    by (auto elim!: finite_subset[rotated])\nqed\n\nlemma locally_finite_on_closure:\n  \"locally_finite_on X I (\\<lambda>x. closure (U x))\"\n  if \"locally_finite_on X I U\"\nproof (rule locally_finite_onI)\n  fix p assume \"p \\<in> X\"\n  from locally_finite_onE[OF that this] obtain N\n    where \"p \\<in> N\" \"open N\" \"finite {i \\<in> I. U i \\<inter> N \\<noteq> {}}\" .\n  then show \"\\<exists>N. p \\<in> N \\<and> open N \\<and> finite {i \\<in> I. closure (U i) \\<inter> N \\<noteq> {}}\"\n    by (auto intro!: exI[where x=N] simp: closure_Int_open_eq_empty)\nqed\n\n\nlemma locally_finite_on_closedin_Union_closure:\n  \"closedin (top_of_set X) (\\<Union>i\\<in>I. closure (U i))\"\n  if \"locally_finite_on X I U\" \"\\<And>i. i \\<in> I \\<Longrightarrow> closure (U i) \\<subseteq> X\"\n  unfolding closedin_def\n  apply safe\n  subgoal using that(2) by auto\n  subgoal\n    apply (subst openin_subopen)\n  proof clarsimp\n    fix x\n    assume x: \"x \\<in> X\" \"\\<forall>i\\<in>I. x \\<notin> closure (U i)\"\n    from locally_finite_onE[OF that(1) \\<open>x \\<in> X\\<close>]\n    obtain N where N: \"x \\<in> N\" \"open N\" \"finite {i \\<in> I. U i \\<inter> N \\<noteq> {}}\" (is \"finite ?I\").\n    define N' where \"N' = N - (\\<Union>i \\<in> ?I. closure (U i))\"\n    have \"open N'\"\n      by (auto simp: N'_def intro!: N)\n    then have \"openin (top_of_set X) (X \\<inter> N')\"\n      by (rule openin_open_Int)\n    moreover\n    have \"x \\<in> X \\<inter> N'\" using x\n      by (auto simp: N'_def N)\n    moreover\n    have \"X \\<inter> N' \\<subseteq> X - (\\<Union>i\\<in>I. closure (U i))\"\n      using x that(2)\n      apply (auto simp: N'_def)\n      by (meson N(2) closure_iff_nhds_not_empty dual_order.refl)\n    ultimately show \"\\<exists>T. openin (top_of_set X) T \\<and> x \\<in> T \\<and> T \\<subseteq> X - (\\<Union>i\\<in>I. closure (U i))\"\n      by auto\n  qed\n  done\n\nlemma closure_subtopology_minimal:\n  \"S \\<subseteq> T \\<Longrightarrow> closedin (top_of_set X) T \\<Longrightarrow> closure S \\<inter> X \\<subseteq> T\"\n  apply (auto simp: closedin_closed)\n  using closure_minimal by blast\n\nlemma locally_finite_on_closure_Union:\n  \"(\\<Union>i\\<in>I. closure (U i)) = closure (\\<Union>i\\<in>I. (U i)) \\<inter> X\"\n  if \"locally_finite_on X I U\" \"\\<And>i. i \\<in> I \\<Longrightarrow> closure (U i) \\<subseteq> X\"\nproof (rule antisym)\n  show \"(\\<Union>i\\<in>I. closure (U i)) \\<subseteq> closure (\\<Union>i\\<in>I. U i) \\<inter> X\"\n    using that\n    apply auto\n    by (metis (no_types, lifting) SUP_le_iff closed_closure closure_minimal closure_subset subsetCE)\n  show \"closure (\\<Union>i\\<in>I. U i) \\<inter> X \\<subseteq> (\\<Union>i\\<in>I. closure (U i))\"\n    apply (rule closure_subtopology_minimal)\n    apply auto\n    using that\n    by (auto intro!: locally_finite_on_closedin_Union_closure)\nqed\n\n\nsubsection \\<open>Refinement of cover\\<close>\n\ndefinition refines :: \"'a set set \\<Rightarrow> 'a set set \\<Rightarrow> bool\" (infix \"refines\" 50)\n  where \"A refines B \\<longleftrightarrow> (\\<forall>s\\<in>A. (\\<exists>t. t \\<in> B \\<and> s \\<subseteq> t))\"\n\nlemma refines_subset: \"x refines y\" if \"z refines y\" \"x \\<subseteq> z\"\n  using that by (auto simp: refines_def)\n\nsubsection \\<open>Functions as vector space\\<close>\n\ninstantiation \"fun\" :: (type, scaleR) scaleR begin\n\ndefinition scaleR_fun :: \"real \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b\" where\n  \"scaleR_fun r f = (\\<lambda>x. r *\\<^sub>R f x)\"\n\nlemma scaleR_fun_beta[simp]: \"(r *\\<^sub>R f) x = r *\\<^sub>R f x\"\n  by (simp add: scaleR_fun_def)\n\ninstance ..\n\nend\n\ninstance \"fun\" :: (type, real_vector) real_vector\n  by standard (auto simp: scaleR_fun_def algebra_simps)\n\n\nsubsection \\<open>Additional lemmas\\<close>\n\nlemmas [simp del] = vimage_Un vimage_Int\n\nlemma finite_Collect_imageI: \"finite {U \\<in> f ` X. P U}\" if \"finite {x\\<in>X. P (f x)}\"\nproof -\n  have \"{d \\<in> f ` X. P d} \\<subseteq> f ` {c \\<in> X. P (f c)}\"\n    by blast\n  then show ?thesis\n    using finite_surj that by blast\nqed\n\nlemma plus_compose: \"(x + y) \\<circ> f = (x \\<circ> f) + (y \\<circ> f)\"\n  by auto\n\nlemma mult_compose: \"(x * y) \\<circ> f = (x \\<circ> f) * (y \\<circ> f)\"\n  by auto\n\nlemma scaleR_compose: \"(c *\\<^sub>R x) \\<circ> f = c *\\<^sub>R (x \\<circ> f)\"\n  by (auto simp:)\n\nlemma image_scaleR_ball:\n  fixes a :: \"'a::real_normed_vector\"\n  shows \"c \\<noteq> 0 \\<Longrightarrow> (*\\<^sub>R) c ` ball a r = ball (c *\\<^sub>R a) (abs c *\\<^sub>R r)\"\nproof (auto simp: mem_ball dist_norm, goal_cases)\n  case (1 b)\n  have \"norm (c *\\<^sub>R a - c *\\<^sub>R b)  = abs c * norm (a - b)\"\n    by (auto simp: norm_scaleR[symmetric] algebra_simps simp del: norm_scaleR)\n  also have \"\\<dots> < abs c * r\"\n    apply (rule mult_strict_left_mono)\n    using 1 by auto\n  finally show ?case .\nnext\n  case (2 x)\n  have \"norm (a - x /\\<^sub>R c) < r\"\n  proof -\n    have \"norm (a - x /\\<^sub>R c) = abs c *\\<^sub>R norm (a - x /\\<^sub>R c) /\\<^sub>R abs c\"\n      using 2 by auto\n    also have \"abs c *\\<^sub>R norm (a - x /\\<^sub>R c) = norm (c *\\<^sub>R a - x)\"\n      using 2\n      by (auto simp: norm_scaleR[symmetric] algebra_simps simp del: norm_scaleR)\n    also have \"\\<dots> < \\<bar>c\\<bar> * r\"\n      by fact\n    also have \"\\<bar>c\\<bar> * r /\\<^sub>R \\<bar>c\\<bar> = r\" using 2 by auto\n    finally show ?thesis using 2 by auto\n  qed\n  then have xdc: \"x /\\<^sub>R c \\<in> ball a r\"\n    by (auto simp: mem_ball dist_norm)\n  show ?case\n    apply (rule image_eqI[OF _ xdc])\n    using 2 by simp\nqed\n\n\nsubsection \\<open>Continuity\\<close>\n\nlemma continuous_within_topologicalE:\n  assumes \"continuous (at x within s) f\"\n    \"open B\" \"f x \\<in> B\"\n  obtains A where \"open A\" \"x \\<in> A\" \"\\<And>y. y \\<in> s \\<Longrightarrow> y \\<in> A \\<Longrightarrow> f y \\<in> B\"\n  using assms continuous_within_topological by metis\n\nlemma continuous_within_topologicalE':\n  assumes \"continuous (at x) f\"\n    \"open B\" \"f x \\<in> B\"\n  obtains A where \"open A\" \"x \\<in> A\" \"f ` A \\<subseteq> B\"\n  using assms continuous_within_topologicalE[OF assms]\n  by (metis UNIV_I image_subsetI)\n\nlemma continuous_on_inverse: \"continuous_on S f \\<Longrightarrow> 0 \\<notin> f ` S \\<Longrightarrow> continuous_on S (\\<lambda>x. inverse (f x))\"\n  for f::\"_\\<Rightarrow>_::real_normed_div_algebra\"\n  by (auto simp: continuous_on_def intro!: tendsto_inverse)\n\n\nsubsection \\<open>@{term \"(has_derivative)\"}\\<close>\n\nlemma has_derivative_plus_fun[derivative_intros]:\n  \"(x + y has_derivative x' + y') (at a within A)\"\n  if [derivative_intros]:\n    \"(x has_derivative x') (at a within A)\"\n    \"(y has_derivative y') (at a within A)\"\n  by (auto simp: plus_fun_def intro!: derivative_eq_intros)\n\nlemma has_derivative_scaleR_fun[derivative_intros]:\n  \"(x *\\<^sub>R y has_derivative x *\\<^sub>R y') (at a within A)\"\n  if [derivative_intros]:\n    \"(y has_derivative y') (at a within A)\"\n  by (auto simp: scaleR_fun_def intro!: derivative_eq_intros)\n\nlemma has_derivative_times_fun[derivative_intros]:\n  \"(x * y has_derivative (\\<lambda>h. x a * y' h + x' h * y a)) (at a within A)\"\n  if [derivative_intros]:\n    \"(x has_derivative x') (at a within A)\"\n    \"(y has_derivative y') (at a within A)\"\n  for x y::\"_\\<Rightarrow>'a::real_normed_algebra\"\n  by (auto simp: times_fun_def intro!: derivative_eq_intros)\n\nlemma real_sqrt_has_derivative_generic:\n  \"x \\<noteq> 0 \\<Longrightarrow> (sqrt has_derivative (*) ((if x > 0 then 1 else -1) * inverse (sqrt x) / 2)) (at x within S)\"\n  apply (rule has_derivative_at_withinI)\n  using DERIV_real_sqrt_generic[of x \"(if x > 0 then 1 else -1) * inverse (sqrt x) / 2\"] at_within_open[of x \"UNIV - {0}\"]\n  by (auto simp: has_field_derivative_def open_delete ac_simps split: if_splits)\n\nlemma sqrt_has_derivative:\n  \"((\\<lambda>x. sqrt (f x)) has_derivative (\\<lambda>xa. (if 0 < f x then 1 else - 1) / (2 * sqrt (f x)) * f' xa)) (at x within S)\"\n  if \"(f has_derivative f') (at x within S)\" \"f x \\<noteq> 0\"\n  by (rule has_derivative_eq_rhs[OF has_derivative_compose[OF that(1) real_sqrt_has_derivative_generic, OF that(2)]])\n    (auto simp: divide_simps)\n\nlemmas has_derivative_norm_compose[derivative_intros] = has_derivative_compose[OF _ has_derivative_norm]\n\nsubsection \\<open>Differentiable\\<close>\n\nlemmas differentiable_on_empty[simp]\n\nlemma differentiable_transform_eventually: \"f differentiable (at x within X)\"\n  if \"g differentiable (at x within X)\"\n    \"f x = g x\"\n    \"\\<forall>\\<^sub>F x in (at x within X). f x = g x\"\n  using that\n  apply (auto simp: differentiable_def)\n  subgoal for D\n    apply (rule exI[where x=D])\n    apply (auto simp: has_derivative_within)\n    by (simp add: eventually_mono Lim_transform_eventually)\n  done\n\nlemma differentiable_within_eqI: \"f differentiable at x within X\"\n  if \"g differentiable at x within X\" \"\\<And>x. x \\<in> X \\<Longrightarrow> f x = g x\"\n    \"x \\<in> X\" \"open X\"\n  apply (rule differentiable_transform_eventually)\n    apply (rule that)\n   apply (auto simp: that)\nproof -\n  have \"\\<forall>\\<^sub>F x in at x within X. x \\<in> X\"\n    using \\<open>open X\\<close>\n    using eventually_at_topological by blast\n  then show \" \\<forall>\\<^sub>F x in at x within X. f x = g x\"\n    by eventually_elim (auto simp: that)\nqed\n\nlemma differentiable_eqI: \"f differentiable at x\"\n  if \"g differentiable at x\" \"\\<And>x. x \\<in> X \\<Longrightarrow> f x = g x\" \"x \\<in> X\" \"open X\"\n  using that\n  unfolding at_within_open[OF that(3,4), symmetric]\n  by (rule differentiable_within_eqI)\n\nlemma differentiable_on_eqI:\n  \"f differentiable_on S\"\n  if \"g differentiable_on S\" \"\\<And>x. x \\<in> S \\<Longrightarrow> f x = g x\" \"open S\"\n  using that differentiable_eqI[of g _ S f]\n  by (auto simp: differentiable_on_eq_differentiable_at)\n\nlemma differentiable_on_comp: \"(f o g) differentiable_on S\"\n  if \"g differentiable_on S\" \"f differentiable_on (g ` S)\"\n  using that\n  by (auto simp: differentiable_on_def intro: differentiable_chain_within)\n\nlemma differentiable_on_comp2: \"(f o g) differentiable_on S\"\n  if  \"f differentiable_on T\" \"g differentiable_on S\" \"g ` S \\<subseteq> T\"\n  apply (rule differentiable_on_comp)\n   apply (rule that)\n  apply (rule differentiable_on_subset)\n  apply (rule that)\n  apply (rule that)\n  done\n\nlemmas differentiable_on_compose2 = differentiable_on_comp2[unfolded o_def]\n\nlemma differentiable_on_openD: \"f differentiable at x\"\n  if \"f differentiable_on X\" \"open X\" \"x \\<in> X\"\n  using differentiable_on_eq_differentiable_at that by blast\n\nlemma differentiable_on_add_fun[intro, simp]:\n  \"x differentiable_on UNIV \\<Longrightarrow> y differentiable_on UNIV \\<Longrightarrow> x + y differentiable_on UNIV\"\n  by (auto simp: plus_fun_def)\n\nlemma differentiable_on_mult_fun[intro, simp]:\n  \"x differentiable_on UNIV \\<Longrightarrow> y differentiable_on UNIV \\<Longrightarrow> x * y differentiable_on UNIV\"\n  for x y::\"_\\<Rightarrow>'a::real_normed_algebra\"\n  by (auto simp: times_fun_def)\n\nlemma differentiable_on_scaleR_fun[intro, simp]:\n  \"y differentiable_on UNIV \\<Longrightarrow> x *\\<^sub>R y differentiable_on UNIV\"\n  by (auto simp: scaleR_fun_def)\n\nlemma sqrt_differentiable:\n  \"(\\<lambda>x. sqrt (f x)) differentiable (at x within S)\"\n  if \"f differentiable (at x within S)\" \"f x \\<noteq> 0\"\n  using that\n  using sqrt_has_derivative[of f _ x S]\n  by (auto simp: differentiable_def)\n\nlemma sqrt_differentiable_on: \"(\\<lambda>x. sqrt (f x)) differentiable_on S\"\n  if \"f differentiable_on S\" \"0 \\<notin> f ` S\"\n  using sqrt_differentiable[of f _ S] that\n  by (force simp: differentiable_on_def)\n\nlemma differentiable_on_inverse: \"f differentiable_on S \\<Longrightarrow> 0 \\<notin> f ` S \\<Longrightarrow> (\\<lambda>x. inverse (f x)) differentiable_on S\"\n  for f::\"_\\<Rightarrow>_::real_normed_field\"\n  by (auto simp: differentiable_on_def intro!: differentiable_inverse)\n\nlemma differentiable_on_openI:\n  \"f differentiable_on S\"\n  if \"open S\" \"\\<And>x. x \\<in> S \\<Longrightarrow> \\<exists>f'. (f has_derivative f') (at x)\"\n  using that\n  by (auto simp: differentiable_on_def at_within_open[where S=S] differentiable_def)\n\nlemmas differentiable_norm_compose_at = differentiable_compose[OF differentiable_norm_at]\n\nlemma differentiable_on_Pair:\n  \"f differentiable_on S \\<Longrightarrow> g differentiable_on S \\<Longrightarrow> (\\<lambda>x. (f x, g x)) differentiable_on S\"\n  unfolding differentiable_on_def\n  using differentiable_Pair[of f _ S g] by auto\n\nlemma differentiable_at_fst:\n  \"(\\<lambda>x. fst (f x)) differentiable at x within X\" if \"f differentiable at x within X\"\n  using that\n  by (auto simp: differentiable_def dest!: has_derivative_fst)\n\nlemma differentiable_at_snd:\n  \"(\\<lambda>x. snd (f x)) differentiable at x within X\" if \"f differentiable at x within X\"\n  using that\n  by (auto simp: differentiable_def dest!: has_derivative_snd)\n\nlemmas frechet_derivative_worksI = frechet_derivative_works[THEN iffD1]\n\nlemma sin_differentiable_at: \"(\\<lambda>x. sin (f x::real)) differentiable at x within X\"\n  if \"f differentiable at x within X\"\n  using differentiable_def has_derivative_sin that by blast\n\nlemma cos_differentiable_at: \"(\\<lambda>x. cos (f x::real)) differentiable at x within X\"\n  if \"f differentiable at x within X\"\n  using differentiable_def has_derivative_cos that by blast\n\n\nsubsection \\<open>Frechet derivative\\<close>\n\nlemmas frechet_derivative_transform_within_open_ext =\n  fun_cong[OF frechet_derivative_transform_within_open]\n\nlemmas frechet_derivative_at' = frechet_derivative_at[symmetric]\n\nlemma frechet_derivative_plus_fun:\n  \"x differentiable at a \\<Longrightarrow> y differentiable at a \\<Longrightarrow>\n  frechet_derivative (x + y) (at a) =\n    frechet_derivative x (at a) + frechet_derivative y (at a)\"\n  by (rule frechet_derivative_at')\n    (auto intro!: derivative_eq_intros frechet_derivative_worksI)\n\nlemmas frechet_derivative_plus = frechet_derivative_plus_fun[unfolded plus_fun_def]\n\nlemma frechet_derivative_zero_fun: \"frechet_derivative 0 (at a) = 0\"\n  by (auto simp: frechet_derivative_const zero_fun_def)\n\nlemma frechet_derivative_sin:\n  \"frechet_derivative (\\<lambda>x. sin (f x)) (at x) = (\\<lambda>xa. frechet_derivative f (at x) xa * cos (f x))\"\n  if \"f differentiable (at x)\"\n  for f::\"_\\<Rightarrow>real\"\n  by (rule frechet_derivative_at'[OF has_derivative_sin[OF frechet_derivative_worksI[OF that]]])\n\nlemma frechet_derivative_cos:\n  \"frechet_derivative (\\<lambda>x. cos (f x)) (at x) = (\\<lambda>xa. frechet_derivative f (at x) xa * - sin (f x))\"\n  if \"f differentiable (at x)\"\n  for f::\"_\\<Rightarrow>real\"\n  by (rule frechet_derivative_at'[OF has_derivative_cos[OF frechet_derivative_worksI[OF that]]])\n\nlemma differentiable_sum_fun:\n  \"(\\<And>i. i \\<in> I \\<Longrightarrow> (f i differentiable at a)) \\<Longrightarrow> sum f I differentiable at a\"\n  by (induction I rule: infinite_finite_induct) (auto simp: zero_fun_def plus_fun_def)\n\nlemma frechet_derivative_sum_fun:\n  \"(\\<And>i. i \\<in> I \\<Longrightarrow> (f i differentiable at a)) \\<Longrightarrow>\n  frechet_derivative (\\<Sum>i\\<in>I. f i) (at a) = (\\<Sum>i\\<in>I. frechet_derivative (f i) (at a))\"\n  by (induction I rule: infinite_finite_induct)\n    (auto simp: frechet_derivative_zero_fun frechet_derivative_plus_fun differentiable_sum_fun)\n\nlemma sum_fun_def: \"(\\<Sum>i\\<in>I. f i) = (\\<lambda>x. \\<Sum>i\\<in>I. f i x)\"\n  by (induction I rule: infinite_finite_induct) auto\n\nlemmas frechet_derivative_sum = frechet_derivative_sum_fun[unfolded sum_fun_def]\n\n\nlemma frechet_derivative_times_fun:\n  \"f differentiable at a \\<Longrightarrow> g differentiable at a \\<Longrightarrow>\n  frechet_derivative (f * g) (at a) =\n  (\\<lambda>x. f a * frechet_derivative g (at a) x + frechet_derivative f (at a) x * g a)\"\n  for f g::\"_\\<Rightarrow>'a::real_normed_algebra\"\n  by (rule frechet_derivative_at') (auto intro!: derivative_eq_intros frechet_derivative_worksI)\n\nlemmas frechet_derivative_times = frechet_derivative_times_fun[unfolded times_fun_def]\n\nlemma frechet_derivative_scaleR_fun:\n  \"y differentiable at a \\<Longrightarrow>\n  frechet_derivative (x *\\<^sub>R y) (at a) =\n    x *\\<^sub>R frechet_derivative y (at a)\"\n  by (rule frechet_derivative_at')\n    (auto intro!: derivative_eq_intros frechet_derivative_worksI)\n\nlemmas frechet_derivative_scaleR = frechet_derivative_scaleR_fun[unfolded scaleR_fun_def]\n\nlemma frechet_derivative_compose:\n  \"frechet_derivative (f o g) (at x) = frechet_derivative (f) (at (g x)) o frechet_derivative g (at x)\"\n  if \"g differentiable at x\" \"f differentiable at (g x)\"\n  by (meson diff_chain_at frechet_derivative_at' frechet_derivative_works that)\n\nlemma frechet_derivative_compose_eucl:\n  \"frechet_derivative (f o g) (at x) =\n    (\\<lambda>v. \\<Sum>i\\<in>Basis. ((frechet_derivative g (at x) v) \\<bullet> i) *\\<^sub>R frechet_derivative f (at (g x)) i)\"\n  (is \"?l = ?r\")\n  if \"g differentiable at x\" \"f differentiable at (g x)\"\nproof (rule ext)\n  fix v\n  interpret g: linear \"frechet_derivative g (at x)\"\n    using that(1)\n    by (rule linear_frechet_derivative)\n  interpret f: linear \"frechet_derivative f (at (g x))\"\n    using that(2)\n    by (rule linear_frechet_derivative)\n  have \"frechet_derivative (f o g) (at x) v =\n    frechet_derivative f (at (g x)) (\\<Sum>i\\<in>Basis. (frechet_derivative g (at x) v \\<bullet> i) *\\<^sub>R i)\"\n    unfolding frechet_derivative_compose[OF that] o_apply\n    by (simp add: euclidean_representation)\n  also have \"\\<dots> = ?r v\"\n    by (auto simp: g.sum g.scaleR f.sum f.scaleR)\n  finally show \"?l v = ?r v\" .\nqed\n\n\nlemma frechet_derivative_works_on_open:\n  \"f differentiable_on X \\<Longrightarrow> open X \\<Longrightarrow> x \\<in> X \\<Longrightarrow>\n    (f has_derivative frechet_derivative f (at x)) (at x)\"\n  and frechet_derivative_works_on:\n  \"f differentiable_on X \\<Longrightarrow> x \\<in> X \\<Longrightarrow>\n    (f has_derivative frechet_derivative f (at x within X)) (at x within X)\"\n  by (auto simp: differentiable_onD differentiable_on_openD frechet_derivative_worksI)\n\nlemma frechet_derivative_inverse: \"frechet_derivative (\\<lambda>x. inverse (f x)) (at x) =\n    (\\<lambda>h. - 1 / (f x)\\<^sup>2 * frechet_derivative f (at x) h)\"\n  if \"f differentiable at x\" \"f x \\<noteq> 0\" for f::\"_\\<Rightarrow>_::real_normed_field\"\n  apply (rule frechet_derivative_at')\n  using that\n  by (auto intro!: derivative_eq_intros frechet_derivative_worksI\n      simp: divide_simps algebra_simps power2_eq_square)\n\nlemma frechet_derivative_sqrt: \"frechet_derivative (\\<lambda>x. sqrt (f x)) (at x) =\n  (\\<lambda>v. (if f x > 0 then 1 else -1) / (2 * sqrt (f x)) * frechet_derivative f (at x) v)\"\n  if \"f differentiable at x\" \"f x \\<noteq> 0\" \n  apply (rule frechet_derivative_at')\n  apply (rule sqrt_has_derivative[THEN has_derivative_eq_rhs])\n  by (auto intro!: frechet_derivative_worksI that simp: divide_simps)\n\nlemma frechet_derivative_norm: \"frechet_derivative (\\<lambda>x. norm (f x)) (at x) =\n    (\\<lambda>v. frechet_derivative f (at x) v \\<bullet> sgn (f x))\"\n  if \"f differentiable at x\" \"f x \\<noteq> 0\" \n  for f::\"_\\<Rightarrow>_::real_inner\"\n  apply (rule frechet_derivative_at')\n  by (auto intro!: derivative_eq_intros frechet_derivative_worksI that simp: divide_simps)\n\nlemma (in bounded_linear) frechet_derivative:\n  \"frechet_derivative f (at x) = f\"\n  apply (rule frechet_derivative_at')\n  apply (rule has_derivative_eq_rhs)\n   apply (rule has_derivative)\n  by (auto intro!: derivative_eq_intros)\n\nbundle no_matrix_mult begin\nno_notation matrix_matrix_mult (infixl \"**\" 70)\nend\n\nlemma (in bounded_bilinear) frechet_derivative:\n  includes no_matrix_mult\n  shows\n    \"x differentiable at a \\<Longrightarrow> y differentiable at a \\<Longrightarrow>\n      frechet_derivative (\\<lambda>a. x a ** y a) (at a) =\n        (\\<lambda>h. x a ** frechet_derivative y (at a) h + frechet_derivative x (at a) h ** y a)\"\n  by (rule frechet_derivative_at') (auto intro!: FDERIV frechet_derivative_worksI)\n\nlemma frechet_derivative_divide: \"frechet_derivative (\\<lambda>x. f x / g x) (at x) =\n    (\\<lambda>h. frechet_derivative f (at x) h / (g x) -frechet_derivative g (at x) h * f x / (g x)\\<^sup>2)\"\n  if \"f differentiable at x\" \"g differentiable at x\" \"g x \\<noteq> 0\" for f::\"_\\<Rightarrow>_::real_normed_field\"\n  using that\n  by (auto simp: divide_inverse_commute bounded_bilinear.frechet_derivative[OF bounded_bilinear_mult]\n      frechet_derivative_inverse)\n\nlemma frechet_derivative_pair:\n  \"frechet_derivative (\\<lambda>x. (f x, g x)) (at x) = (\\<lambda>v. (frechet_derivative f (at x) v, frechet_derivative g (at x) v))\"\n  if \"f differentiable (at x)\" \"g differentiable (at x)\"\n  apply (rule frechet_derivative_at')\n  apply (rule derivative_eq_intros)\n    apply (rule frechet_derivative_worksI) apply fact    \n    apply (rule frechet_derivative_worksI) apply fact\n  ..\n\nlemma frechet_derivative_fst:\n  \"frechet_derivative (\\<lambda>x. fst (f x)) (at x) = (\\<lambda>xa. fst (frechet_derivative f (at x) xa))\"\n  if \"(f differentiable at x)\"\n  for f::\"_\\<Rightarrow>(_::real_normed_vector \\<times> _::real_normed_vector)\"\n  apply (rule frechet_derivative_at')\n  using that\n  by (auto intro!: derivative_eq_intros frechet_derivative_worksI)\n\nlemma frechet_derivative_snd:\n  \"frechet_derivative (\\<lambda>x. snd (f x)) (at x) = (\\<lambda>xa. snd (frechet_derivative f (at x) xa))\"\n  if \"(f differentiable at x)\"\n  for f::\"_\\<Rightarrow>(_::real_normed_vector \\<times> _::real_normed_vector)\"\n  apply (rule frechet_derivative_at')\n  using that\n  by (auto intro!: derivative_eq_intros frechet_derivative_worksI)\n\nlemma frechet_derivative_eq_vector_derivative_1:\n  assumes \"f differentiable at t\"\n  shows \"frechet_derivative f (at t) 1 = vector_derivative f (at t)\"\n  apply (subst frechet_derivative_eq_vector_derivative)\n   apply (rule assms) by auto\n\n\nsubsection \\<open>Linear algebra\\<close>\n\nlemma (in vector_space) dim_pos_finite_dimensional_vector_spaceE:\n  assumes \"dim (UNIV::'b set) > 0\"\n  obtains basis where \"finite_dimensional_vector_space scale basis\"\nproof -\n  from assms obtain b where b: \"local.span b = local.span UNIV\" \"local.independent b\"\n    by (auto simp: dim_def split: if_splits)\n  then have \"dim UNIV = card b\"\n    by (rule dim_eq_card)\n  with assms have \"finite b\" by (auto simp: card_ge_0_finite)\n  then have \"finite_dimensional_vector_space scale b\"\n    by unfold_locales (auto simp: b)\n  then show ?thesis ..\nqed\n\ncontext vector_space_on begin\n\ncontext includes lifting_syntax assumes \"\\<exists>(Rep::'s \\<Rightarrow> 'b) (Abs::'b \\<Rightarrow> 's). type_definition Rep Abs S\" begin\n\ninterpretation local_typedef_vector_space_on S scale \"TYPE('s)\" by unfold_locales fact\n\nlemmas_with [var_simplified explicit_ab_group_add,\n    unoverload_type 'd,\n    OF type.ab_group_add_axioms type_vector_space_on_with,\n    folded dim_S_def,\n    untransferred,\n    var_simplified implicit_ab_group_add]:\n    lt_dim_pos_finite_dimensional_vector_spaceE = vector_space.dim_pos_finite_dimensional_vector_spaceE\n\nend\n\nlemmas_with [cancel_type_definition,\n    OF S_ne,\n    folded subset_iff',\n    simplified pred_fun_def, folded finite_dimensional_vector_space_on_with,\n    simplified\\<comment>\\<open>too much?\\<close>]:\n    dim_pos_finite_dimensional_vector_spaceE = lt_dim_pos_finite_dimensional_vector_spaceE\n\nend\n\n\nsubsection \\<open>Extensional function space\\<close>\n\ntext \\<open>f is zero outside A. We use such functions to canonically represent\n  functions whose domain is A\\<close>\ndefinition extensional0 :: \"'a set \\<Rightarrow> ('a \\<Rightarrow> 'b::zero) \\<Rightarrow> bool\"\n  where \"extensional0 A f = (\\<forall>x. x \\<notin> A \\<longrightarrow> f x = 0)\"\n\nlemma extensional0_0[intro, simp]: \"extensional0 X 0\"\n  by (auto simp: extensional0_def)\n\nlemma extensional0_UNIV[intro, simp]: \"extensional0 UNIV f\"\n  by (auto simp: extensional0_def)\n\nlemma ext_extensional0:\n  \"f = g\" if \"extensional0 S f\" \"extensional0 S g\" \"\\<And>x. x \\<in> S \\<Longrightarrow> f x = g x\"\n  using that by (force simp: extensional0_def fun_eq_iff)\n\nlemma extensional0_add[intro, simp]:\n  \"extensional0 S f \\<Longrightarrow> extensional0 S g \\<Longrightarrow> extensional0 S (f + g::_\\<Rightarrow>'a::comm_monoid_add)\"\n  by (auto simp: extensional0_def)\n\nlemma extensinoal0_mult[intro, simp]:\n  \"extensional0 S x \\<Longrightarrow> extensional0 S y \\<Longrightarrow> extensional0 S (x * y)\"\n  for x y::\"_\\<Rightarrow>'a::mult_zero\"\n  by (auto simp: extensional0_def)\n\nlemma extensional0_scaleR[intro, simp]: \"extensional0 S f \\<Longrightarrow> extensional0 S (c *\\<^sub>R f::_\\<Rightarrow>'a::real_vector)\"\n  by (auto simp: extensional0_def)\n\nlemma extensional0_outside: \"x \\<notin> S \\<Longrightarrow> extensional0 S f \\<Longrightarrow> f x = 0\"\n  by (auto simp: extensional0_def)\n\nlemma subspace_extensional0: \"subspace (Collect (extensional0 X))\"\n  by (auto simp: subspace_def)\n\ntext \\<open>Send the function f to its canonical representative as a function with domain A\\<close>\ndefinition restrict0 :: \"'a set \\<Rightarrow> ('a \\<Rightarrow> 'b::zero) \\<Rightarrow> 'a \\<Rightarrow> 'b\"\n  where \"restrict0 A f x = (if x \\<in> A then f x else 0)\"\n\nlemma restrict0_UNIV[simp]: \"restrict0 UNIV = (\\<lambda>x. x)\"\n  by (intro ext) (auto simp: restrict0_def)\n\nlemma extensional0_restrict0[intro, simp]: \"extensional0 A (restrict0 A f)\"\n  by (auto simp: extensional0_def restrict0_def)\n\nlemma restrict0_times: \"restrict0 A (x * y) = restrict0 A x * restrict0 A y\"\n  for x::\"'a\\<Rightarrow>'b::mult_zero\"\n  by (auto simp: restrict0_def[abs_def])\n\nlemma restrict0_apply_in[simp]: \"x \\<in> A \\<Longrightarrow> restrict0 A f x = f x\"\n  by (auto simp: restrict0_def)\n\nlemma restrict0_apply_out[simp]: \"x \\<notin> A \\<Longrightarrow> restrict0 A f x = 0\"\n  by (auto simp: restrict0_def)\n\nlemma restrict0_scaleR: \"restrict0 A (c *\\<^sub>R f::_\\<Rightarrow>'a::real_vector) = c *\\<^sub>R restrict0 A f\"\n  by (auto simp: restrict0_def[abs_def])\n\nlemma restrict0_add: \"restrict0 A (f + g::_\\<Rightarrow>'a::real_vector) = restrict0 A f + restrict0 A g\"\n  by (auto simp: restrict0_def[abs_def])\n\nlemma restrict0_restrict0: \"restrict0 X (restrict0 Y f) = restrict0 (X \\<inter> Y) f\"\n  by (auto simp: restrict0_def)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Smooth_Manifolds/Analysis_More.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032313, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3085335064598199}}
{"text": "(*  Title:       AWN.thy\n    License:     BSD 2-Clause. See LICENSE.\n    Author:      Timothy Bourke\n*)\n\nsection \"Terms of the Algebra for Wireless Networks\"\n\ntheory AWN\nimports Lib\nbegin\n\nsubsection \"Sequential Processes\"\n\ntype_synonym ip = nat\ntype_synonym data = nat\n\ntext \\<open>\n  Most of AWN is independent of the type of messages, but the closed layer turns\n  newpkt actions into the arrival of newpkt messages. We use a type class to maintain\n  some abstraction (and independence from the definition of particular protocols).\n\\<close>\n\nclass msg =\n  fixes newpkt :: \"data \\<times> ip \\<Rightarrow> 'a\"\n    and eq_newpkt :: \"'a \\<Rightarrow> bool\"\n  assumes eq_newpkt_eq [simp]: \"eq_newpkt (newpkt (d, i))\"\n\ntext \\<open>\n  Sequential process terms abstract over the types of data states (@{typ 's}),\n  messages (@{typ 'm}), process names (@{typ 'p}),and labels (@{typ 'l}).\n\\<close>\n\ndatatype (dead 's, dead 'm, dead 'p, 'l) seqp =\n    GUARD \"'l\" \"'s \\<Rightarrow> 's set\" \"('s, 'm, 'p, 'l) seqp\"\n  | ASSIGN \"'l\" \"'s \\<Rightarrow> 's\" \"('s, 'm, 'p, 'l) seqp\"\n  | CHOICE \"('s, 'm, 'p, 'l) seqp\" \"('s, 'm, 'p, 'l) seqp\"\n  | UCAST \"'l\" \"'s \\<Rightarrow> ip\" \"'s \\<Rightarrow> 'm\" \"('s, 'm, 'p, 'l) seqp\" \"('s, 'm, 'p, 'l) seqp\"\n  | BCAST \"'l\" \"'s \\<Rightarrow> 'm\" \"('s, 'm, 'p, 'l) seqp\"\n  | GCAST \"'l\" \"'s \\<Rightarrow> ip set\" \"'s \\<Rightarrow> 'm\" \"('s, 'm, 'p, 'l) seqp\"\n  | SEND \"'l\" \"'s \\<Rightarrow> 'm\" \"('s, 'm, 'p, 'l) seqp\"\n  | DELIVER \"'l\" \"'s \\<Rightarrow> data\" \"('s, 'm, 'p, 'l) seqp\"\n  | RECEIVE \"'l\" \"'m \\<Rightarrow> 's \\<Rightarrow> 's\" \"('s, 'm, 'p, 'l) seqp\"\n  | CALL 'p\n  for map: labelmap\n\nsyntax\n  \"_guard\"    :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(\\<open>unbreakable\\<close>\\<langle>_\\<rangle>)//_\" [0, 60] 60)\n  \"_lguard\"   :: \"['a, 'a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"{_}(\\<open>unbreakable\\<close>\\<langle>_\\<rangle>)//_\" [0, 0, 60] 60)\n  \"_ifguard\"  :: \"[pttrn, bool,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(\\<open>unbreakable\\<close>\\<langle>_. _\\<rangle>)//_\" [0, 0, 60] 60)\n\n  \"_bassign\"  :: \"[pttrn, 'a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(\\<open>unbreakable\\<close>\\<lbrakk>_. _\\<rbrakk>)//_\" [0, 0, 60] 60)\n  \"_lbassign\" :: \"['a, pttrn, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"{_}(\\<open>unbreakable\\<close>\\<lbrakk>_. _\\<rbrakk>)//_\" [0, 0, 0, 60] 60)\n\n  \"_assign\"  :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"((\\<open>unbreakable\\<close>\\<lbrakk>_\\<rbrakk>))//_\" [0, 60] 60)\n  \"_lassign\" :: \"['a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"({_}(\\<open>unbreakable\\<close>\\<lbrakk>_\\<rbrakk>))//_\" [0, 0, 60] 60)\n\n  \"_unicast\"  :: \"['a, 'a,  ('s, 'm, 'p, unit) seqp,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3unicast'((1(3_),/ (3_))') .//(_)/ (2\\<triangleright> _))\" [0, 0, 60, 60] 60)\n  \"_lunicast\" :: \"['a, 'a, 'a, ('s, 'm, 'p, 'a) seqp, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}unicast'((1(3_),/ (3_))') .//(_)/ (2\\<triangleright> _))\" [0, 0, 0, 60, 60] 60)\n\n  \"_bcast\"    :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3broadcast'((1(_))') .)//_\" [0, 60] 60)\n  \"_lbcast\"   :: \"['a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}broadcast'((1(_))') .)//_\" [0, 0, 60] 60)\n\n  \"_gcast\"    :: \"['a, 'a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3groupcast'((1(_),/ (_))') .)//_\" [0, 0, 60] 60)\n  \"_lgcast\"   :: \"['a, 'a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}groupcast'((1(_),/ (_))') .)//_\" [0, 0, 0, 60] 60)\n\n  \"_send\"     :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3send'((_)') .)//_\" [0, 60] 60)\n  \"_lsend\"    :: \"['a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}send'((_)') .)//_\" [0, 0, 60] 60)\n\n  \"_deliver\"  :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3deliver'((_)') .)//_\" [0, 60] 60)\n  \"_ldeliver\" :: \"['a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}deliver'((_)') .)//_\" [0, 0, 60] 60)\n\n  \"_receive\"  :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3receive'((_)') .)//_\" [0, 60] 60)\n  \"_lreceive\" :: \"['a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}receive'((_)') .)//_\" [0, 0, 60] 60)\n\ntranslations\n  \"_guard f p\"     \\<rightleftharpoons> \"CONST GUARD () f p\"\n  \"_lguard l f p\"  \\<rightleftharpoons> \"CONST GUARD l f p\"\n  \"_ifguard \\<xi> e p\" \\<rightharpoonup> \"CONST GUARD () (\\<lambda>\\<xi>. if e then {\\<xi>} else {}) p\"\n\n  \"_assign f p\"    \\<rightleftharpoons> \"CONST ASSIGN () f p\"\n  \"_lassign l f p\" \\<rightleftharpoons> \"CONST ASSIGN l f p\"\n\n  \"_bassign \\<xi> e p\"    \\<rightleftharpoons> \"CONST ASSIGN () (\\<lambda>\\<xi>. e) p\"\n  \"_lbassign l \\<xi> e p\" \\<rightleftharpoons> \"CONST ASSIGN l (\\<lambda>\\<xi>. e) p\"\n\n  \"_unicast fip fmsg p q\"    \\<rightleftharpoons> \"CONST UCAST () fip fmsg p q\"\n  \"_lunicast l fip fmsg p q\" \\<rightleftharpoons> \"CONST UCAST l fip fmsg p q\"\n\n  \"_bcast fmsg p\"    \\<rightleftharpoons> \"CONST BCAST () fmsg p\"\n  \"_lbcast l fmsg p\" \\<rightleftharpoons> \"CONST BCAST l fmsg p\"\n\n  \"_gcast fipset fmsg p\"    \\<rightleftharpoons> \"CONST GCAST () fipset fmsg p\"\n  \"_lgcast l fipset fmsg p\" \\<rightleftharpoons> \"CONST GCAST l fipset fmsg p\"\n\n  \"_send fmsg p\"    \\<rightleftharpoons> \"CONST SEND () fmsg p\"\n  \"_lsend l fmsg p\" \\<rightleftharpoons> \"CONST SEND l fmsg p\"\n\n  \"_deliver fdata p\"    \\<rightleftharpoons> \"CONST DELIVER () fdata p\"\n  \"_ldeliver l fdata p\" \\<rightleftharpoons> \"CONST DELIVER l fdata p\"\n\n  \"_receive fmsg p\"    \\<rightleftharpoons> \"CONST RECEIVE () fmsg p\"\n  \"_lreceive l fmsg p\" \\<rightleftharpoons> \"CONST RECEIVE l fmsg p\"\n\nnotation \"CHOICE\" (\"((_)//\\<oplus>//(_))\" [56, 55] 55)\n     and \"CALL\"   (\"(3call'((3_)'))\" [0] 60)\n\ndefinition not_call :: \"('s, 'm, 'p, 'l) seqp \\<Rightarrow> bool\"\nwhere \"not_call p \\<equiv> \\<forall>pn. p \\<noteq> call(pn)\"\n\nlemma not_call_simps [simp]:\n  \"\\<And>l fg p.         not_call ({l}\\<langle>fg\\<rangle> p)\"\n  \"\\<And>l fa p.         not_call ({l}\\<lbrakk>fa\\<rbrakk> p)\"\n  \"\\<And>p1 p2.          not_call (p1 \\<oplus> p2)\"\n  \"\\<And>l fip fmsg p q. not_call ({l}unicast(fip, fmsg).p \\<triangleright> q)\"\n  \"\\<And>l fmsg p.       not_call ({l}broadcast(fmsg).p)\"\n  \"\\<And>l fips fmsg p.  not_call ({l}groupcast(fips, fmsg).p)\"\n  \"\\<And>l fmsg p.       not_call ({l}send(fmsg).p)\"\n  \"\\<And>l fdata p.      not_call ({l}deliver(fdata).p)\"\n  \"\\<And>l fmsg p.       not_call ({l}receive(fmsg).p)\"\n  \"\\<And>l pn.         \\<not>(not_call (call(pn)))\"\n  unfolding not_call_def by auto\n\ndefinition not_choice :: \"('s, 'm, 'p, 'l) seqp \\<Rightarrow> bool\"\nwhere \"not_choice p \\<equiv> \\<forall>p1 p2. p \\<noteq> p1 \\<oplus> p2\"\n\nlemma not_choice_simps [simp]:\n  \"\\<And>l fg p.         not_choice ({l}\\<langle>fg\\<rangle> p)\"\n  \"\\<And>l fa p.         not_choice ({l}\\<lbrakk>fa\\<rbrakk> p)\"\n  \"\\<And>p1 p2.        \\<not>(not_choice (p1 \\<oplus> p2))\"\n  \"\\<And>l fip fmsg p q. not_choice ({l}unicast(fip, fmsg).p \\<triangleright> q)\"\n  \"\\<And>l fmsg p.       not_choice ({l}broadcast(fmsg).p)\"\n  \"\\<And>l fips fmsg p.  not_choice ({l}groupcast(fips, fmsg).p)\"\n  \"\\<And>l fmsg p.       not_choice ({l}send(fmsg).p)\"\n  \"\\<And>l fdata p.      not_choice ({l}deliver(fdata).p)\"\n  \"\\<And>l fmsg p.       not_choice ({l}receive(fmsg).p)\"\n  \"\\<And>l pn.           not_choice (call(pn))\"\n  unfolding not_choice_def by auto\n\nlemma seqp_congs:\n  \"\\<And>l fg p. {l}\\<langle>fg\\<rangle> p = {l}\\<langle>fg\\<rangle> p\"\n  \"\\<And>l fa p. {l}\\<lbrakk>fa\\<rbrakk> p = {l}\\<lbrakk>fa\\<rbrakk> p\"\n  \"\\<And>p1 p2. p1 \\<oplus> p2 = p1 \\<oplus> p2\"\n  \"\\<And>l fip fmsg p q. {l}unicast(fip, fmsg).p \\<triangleright> q = {l}unicast(fip, fmsg).p \\<triangleright> q\"\n  \"\\<And>l fmsg p. {l}broadcast(fmsg).p = {l}broadcast(fmsg).p\"\n  \"\\<And>l fips fmsg p. {l}groupcast(fips, fmsg).p = {l}groupcast(fips, fmsg).p\"\n  \"\\<And>l fmsg p. {l}send(fmsg).p = {l}send(fmsg).p\"\n  \"\\<And>l fdata p. {l}deliver(fdata).p = {l}deliver(fdata).p\"\n  \"\\<And>l fmsg p. {l}receive(fmsg).p = {l}receive(fmsg).p\"\n  \"\\<And>l pn. call(pn) = call(pn)\"\n  by auto\n\ntext \\<open>Remove data expressions from process terms.\\<close>\n\nfun seqp_skeleton :: \"('s, 'm, 'p, 'l) seqp \\<Rightarrow> (unit, unit, 'p, 'l) seqp\"\nwhere\n    \"seqp_skeleton ({l}\\<langle>_\\<rangle> p)                 = {l}\\<langle>\\<lambda>_. {()}\\<rangle> (seqp_skeleton p)\"\n  | \"seqp_skeleton ({l}\\<lbrakk>_\\<rbrakk> p)                 = {l}\\<lbrakk>\\<lambda>_. ()\\<rbrakk> (seqp_skeleton p)\"\n  | \"seqp_skeleton (p \\<oplus> q)                   = (seqp_skeleton p) \\<oplus> (seqp_skeleton q)\"\n  | \"seqp_skeleton ({l}unicast(_, _). p \\<triangleright> q) = {l}unicast(\\<lambda>_. 0, \\<lambda>_. ()). (seqp_skeleton p) \\<triangleright> (seqp_skeleton q)\"\n  | \"seqp_skeleton ({l}broadcast(_). p)      = {l}broadcast(\\<lambda>_. ()). (seqp_skeleton p)\"\n  | \"seqp_skeleton ({l}groupcast(_, _). p)   = {l}groupcast(\\<lambda>_. {}, \\<lambda>_. ()). (seqp_skeleton p)\"\n  | \"seqp_skeleton ({l}send(_). p)           = {l}send(\\<lambda>_. ()). (seqp_skeleton p)\"\n  | \"seqp_skeleton ({l}deliver(_). p)        = {l}deliver(\\<lambda>_. 0). (seqp_skeleton p)\"\n  | \"seqp_skeleton ({l}receive(_). p)        = {l}receive(\\<lambda>_ _. ()). (seqp_skeleton p)\"\n  | \"seqp_skeleton (call(pn))                = call(pn)\"\n\ntext \\<open>Calculate the subterms of a term.\\<close>\n\nfun subterms :: \"('s, 'm, 'p, 'l) seqp \\<Rightarrow> ('s, 'm, 'p, 'l) seqp set\"\nwhere\n    \"subterms ({l}\\<langle>fg\\<rangle> p) = {{l}\\<langle>fg\\<rangle> p} \\<union> subterms p\"\n  | \"subterms ({l}\\<lbrakk>fa\\<rbrakk> p) = {{l}\\<lbrakk>fa\\<rbrakk> p} \\<union> subterms p\"\n  | \"subterms (p1 \\<oplus> p2) = {p1 \\<oplus> p2} \\<union> subterms p1 \\<union> subterms p2\"\n  | \"subterms ({l}unicast(fip, fmsg). p \\<triangleright> q) =\n       {{l}unicast(fip, fmsg). p \\<triangleright> q} \\<union> subterms p \\<union> subterms q\"\n  | \"subterms ({l}broadcast(fmsg). p) = {{l}broadcast(fmsg). p} \\<union> subterms p\"\n  | \"subterms ({l}groupcast(fips, fmsg). p) = {{l}groupcast(fips, fmsg). p} \\<union> subterms p\"\n  | \"subterms ({l}send(fmsg). p) = {{l}send(fmsg).p} \\<union> subterms p\"\n  | \"subterms ({l}deliver(fdata). p) = {{l}deliver(fdata).p} \\<union> subterms p\"\n  | \"subterms ({l}receive(fmsg). p) = {{l}receive(fmsg).p} \\<union> subterms p\"\n  | \"subterms (call(pn)) = {call(pn)}\"\n\nlemma subterms_refl [simp]: \"p \\<in> subterms p\"\n  by (cases p) simp_all\n\nlemma subterms_trans [elim]:\n  assumes \"q \\<in> subterms p\"\n      and \"r \\<in> subterms q\"\n    shows \"r \\<in> subterms p\"\n  using assms by (induction p) auto\n\nlemma root_in_subterms [simp]:\n   \"\\<And>\\<Gamma> pn. \\<exists>pn'. \\<Gamma> pn \\<in> subterms (\\<Gamma> pn')\"\n  by (rule_tac x=pn in exI) simp\n\nlemma deriv_in_subterms [elim, dest]:\n  \"\\<And>l f p q. {l}\\<langle>f\\<rangle> q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fa p q. {l}\\<lbrakk>fa\\<rbrakk> q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>p1 p2 p. p1 \\<oplus> p2 \\<in> subterms p \\<Longrightarrow> p1 \\<in> subterms p\"\n  \"\\<And>p1 p2 p. p1 \\<oplus> p2 \\<in> subterms p \\<Longrightarrow> p2 \\<in> subterms p\"\n  \"\\<And>l fip fmsg p q r. {l}unicast(fip, fmsg). q \\<triangleright> r \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fip fmsg p q r. {l}unicast(fip, fmsg). q \\<triangleright> r \\<in> subterms p \\<Longrightarrow> r \\<in> subterms p\"\n  \"\\<And>l fmsg p q. {l}broadcast(fmsg). q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fips fmsg p q. {l}groupcast(fips, fmsg). q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fmsg p q. {l}send(fmsg). q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fdata p q. {l}deliver(fdata). q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fmsg p q. {l}receive(fmsg). q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  by auto\n\nsubsection \"Actions\"\n\ntext \\<open>\n  There are two sorts of \\<open>\\<tau>\\<close> actions in AWN: one at the level of individual processes\n  (within nodes), and one at the network level (outside nodes). We define a class so that\n  we can ignore this distinction whenever it is not critical.\n\\<close>\n\nclass tau =\n  fixes tau :: \"'a\" (\"\\<tau>\")\n\nsubsubsection \"Sequential Actions (and related predicates)\"\n\ndatatype 'm seq_action =\n    broadcast 'm\n  | groupcast \"ip set\" 'm\n  | unicast ip 'm\n  | notunicast ip           (\"\\<not>unicast _\" [1000] 60)\n  | send 'm\n  | deliver data\n  | receive 'm\n  | seq_tau                 (\"\\<tau>\\<^sub>s\")\n\ninstantiation \"seq_action\" :: (type) tau\nbegin\ndefinition step_seq_tau [simp]: \"\\<tau> \\<equiv> \\<tau>\\<^sub>s\"\ninstance ..\nend\n\ndefinition recvmsg :: \"('m \\<Rightarrow> bool) \\<Rightarrow> 'm seq_action \\<Rightarrow> bool\"\nwhere \"recvmsg P a \\<equiv> case a of receive m \\<Rightarrow> P m\n                             | _ \\<Rightarrow> True\"\n\nlemma recvmsg_simps[simp]:\n  \"\\<And>m.     recvmsg P (broadcast m)     = True\"\n  \"\\<And>ips m. recvmsg P (groupcast ips m) = True\"\n  \"\\<And>ip m.  recvmsg P (unicast ip m)    = True\"\n  \"\\<And>ip.    recvmsg P (notunicast ip)   = True\"\n  \"\\<And>m.     recvmsg P (send m)          = True\"\n  \"\\<And>d.     recvmsg P (deliver d)       = True\"\n  \"\\<And>m.     recvmsg P (receive m)       = P m\"\n  \"        recvmsg P \\<tau>\\<^sub>s                 = True\"\n  unfolding recvmsg_def by simp_all\n\nlemma recvmsgTT [simp]: \"recvmsg TT a\"\n  by (cases a) simp_all\n\nlemma recvmsgE [elim]:\n  assumes \"recvmsg (R \\<sigma>) a\"\n      and \"\\<And>m. R \\<sigma> m \\<Longrightarrow> R \\<sigma>' m\"\n    shows \"recvmsg (R \\<sigma>') a\"\n  using assms(1) by (cases a) (auto elim!: assms(2))\n\ndefinition anycast :: \"('m \\<Rightarrow> bool) \\<Rightarrow> 'm seq_action \\<Rightarrow> bool\"\nwhere \"anycast P a \\<equiv> case a of broadcast m \\<Rightarrow> P m\n                             | groupcast _ m \\<Rightarrow> P m\n                             | unicast _ m \\<Rightarrow> P m\n                             | _ \\<Rightarrow> True\"\n\nlemma anycast_simps [simp]:\n  \"\\<And>m.     anycast P (broadcast m)     = P m\"\n  \"\\<And>ips m. anycast P (groupcast ips m) = P m\"\n  \"\\<And>ip m.  anycast P (unicast ip m)    = P m\"\n  \"\\<And>ip.    anycast P (notunicast ip)   = True\"\n  \"\\<And>m.     anycast P (send m)          = True\"\n  \"\\<And>d.     anycast P (deliver d)       = True\"\n  \"\\<And>m.     anycast P (receive m)       = True\"\n  \"        anycast P \\<tau>\\<^sub>s                 = True\"\n  unfolding anycast_def by simp_all\n\ndefinition orecvmsg :: \"((ip \\<Rightarrow> 's) \\<Rightarrow> 'm \\<Rightarrow> bool) \\<Rightarrow> (ip \\<Rightarrow> 's) \\<Rightarrow> 'm seq_action \\<Rightarrow> bool\"\nwhere \"orecvmsg P \\<sigma> a \\<equiv> (case a of receive m \\<Rightarrow> P \\<sigma> m\n                                         | _ \\<Rightarrow> True)\"\n\nlemma orecvmsg_simps [simp]:\n  \"\\<And>m.     orecvmsg P \\<sigma> (broadcast m)     = True\"\n  \"\\<And>ips m. orecvmsg P \\<sigma> (groupcast ips m) = True\"\n  \"\\<And>ip m.  orecvmsg P \\<sigma> (unicast ip m)    = True\"\n  \"\\<And>ip.    orecvmsg P \\<sigma> (notunicast ip)   = True\"\n  \"\\<And>m.     orecvmsg P \\<sigma> (send m)          = True\"\n  \"\\<And>d.     orecvmsg P \\<sigma> (deliver d)       = True\"\n  \"\\<And>m.     orecvmsg P \\<sigma> (receive m)       = P \\<sigma> m\"\n  \"         orecvmsg P \\<sigma> \\<tau>\\<^sub>s                = True\"\n  unfolding orecvmsg_def by simp_all\n\nlemma orecvmsgEI [elim]:\n  \"\\<lbrakk> orecvmsg P \\<sigma> a; \\<And>\\<sigma> a. P \\<sigma> a \\<Longrightarrow> Q \\<sigma> a \\<rbrakk> \\<Longrightarrow> orecvmsg Q \\<sigma> a\"\n  by (cases a) simp_all\n\nlemma orecvmsg_stateless_recvmsg [elim]:\n  \"orecvmsg (\\<lambda>_. P) \\<sigma> a \\<Longrightarrow> recvmsg P a\"\n  by (cases a) simp_all\n\nlemma orecvmsg_recv_weaken [elim]:\n  \"\\<lbrakk> orecvmsg P \\<sigma> a; \\<And>\\<sigma> a. P \\<sigma> a \\<Longrightarrow> Q a \\<rbrakk> \\<Longrightarrow> recvmsg Q a\"\n  by (cases a) simp_all\n\nlemma orecvmsg_recvmsg [elim]:\n  \"orecvmsg P \\<sigma> a \\<Longrightarrow> recvmsg (P \\<sigma>) a\"\n  by (cases a) simp_all\n\ndefinition sendmsg :: \"('m \\<Rightarrow> bool) \\<Rightarrow> 'm seq_action \\<Rightarrow> bool\"\nwhere \"sendmsg P a \\<equiv> case a of send m \\<Rightarrow> P m | _ \\<Rightarrow> True\"\n\nlemma sendmsg_simps [simp]:\n  \"\\<And>m.     sendmsg P (broadcast m)     = True\"\n  \"\\<And>ips m. sendmsg P (groupcast ips m) = True\"\n  \"\\<And>ip m.  sendmsg P (unicast ip m)    = True\"\n  \"\\<And>ip.    sendmsg P (notunicast ip)   = True\"\n  \"\\<And>m.     sendmsg P (send m)          = P m\"\n  \"\\<And>d.     sendmsg P (deliver d)       = True\"\n  \"\\<And>m.     sendmsg P (receive m)       = True\"\n  \"        sendmsg P \\<tau>\\<^sub>s                 = True\"\n  unfolding sendmsg_def by simp_all\n\ntype_synonym ('s, 'm, 'p, 'l) seqp_env = \"'p \\<Rightarrow> ('s, 'm, 'p, 'l) seqp\"\n\nsubsubsection \"Node Actions (and related predicates)\"\n\ndatatype 'm node_action =\n    node_cast \"ip set\" 'm             (\"_:*cast'(_')\"       [200, 200] 200)                                                 \n  | node_deliver ip data              (\"_:deliver'(_')\"     [200, 200] 200)\n  | node_arrive \"ip set\" \"ip set\" 'm  (\"_\\<not>_:arrive'(_')\"    [200, 200, 200] 200)\n  | node_connect ip ip                (\"connect'(_, _')\"    [200, 200] 200)\n  | node_disconnect ip ip             (\"disconnect'(_, _')\" [200, 200] 200)\n  | node_newpkt ip data ip            (\"_:newpkt'(_, _')\"   [200, 200, 200] 200)\n  | node_tau                          (\"\\<tau>\\<^sub>n\")\n\ninstantiation \"node_action\" :: (type) tau\nbegin\ndefinition step_node_tau [simp]: \"\\<tau> \\<equiv> \\<tau>\\<^sub>n\"\ninstance ..\nend\n\ndefinition arrivemsg :: \"ip \\<Rightarrow> ('m \\<Rightarrow> bool) \\<Rightarrow> 'm node_action \\<Rightarrow> bool\"\nwhere \"arrivemsg i P a \\<equiv> case a of node_arrive ii ni m \\<Rightarrow> ((ii = {i} \\<longrightarrow> P m))\n                                  | _ \\<Rightarrow> True\"\n\nlemma arrivemsg_simps[simp]:\n  \"\\<And>R m.       arrivemsg i P (R:*cast(m))         = True\"\n  \"\\<And>d m.       arrivemsg i P (d:deliver(m))       = True\"\n  \"\\<And>i ii ni m. arrivemsg i P (ii\\<not>ni:arrive(m))    = (ii = {i} \\<longrightarrow> P m)\"\n  \"\\<And>i1 i2.     arrivemsg i P (connect(i1, i2))    = True\"\n  \"\\<And>i1 i2.     arrivemsg i P (disconnect(i1, i2)) = True\"\n  \"\\<And>i i' d di. arrivemsg i P (i':newpkt(d, di))   = True\"\n  \"             arrivemsg i P \\<tau>\\<^sub>n                   = True\"\n  unfolding arrivemsg_def by simp_all\n\nlemma arrivemsgTT [simp]: \"arrivemsg i TT = TT\"\n  by (rule ext) (clarsimp simp: arrivemsg_def split: node_action.split)\n\ndefinition oarrivemsg :: \"((ip \\<Rightarrow> 's) \\<Rightarrow> 'm \\<Rightarrow> bool) \\<Rightarrow> (ip \\<Rightarrow> 's) \\<Rightarrow> 'm node_action \\<Rightarrow> bool\"\nwhere \"oarrivemsg P \\<sigma> a \\<equiv> case a of node_arrive ii ni m \\<Rightarrow> P \\<sigma> m | _ \\<Rightarrow> True\"\n\nlemma oarrivemsg_simps[simp]:\n  \"\\<And>R m.       oarrivemsg P \\<sigma> (R:*cast(m))         = True\"\n  \"\\<And>d m.       oarrivemsg P \\<sigma> (d:deliver(m))       = True\"\n  \"\\<And>i ii ni m. oarrivemsg P \\<sigma> (ii\\<not>ni:arrive(m))    = P \\<sigma> m\"\n  \"\\<And>i1 i2.     oarrivemsg P \\<sigma> (connect(i1, i2))    = True\"\n  \"\\<And>i1 i2.     oarrivemsg P \\<sigma> (disconnect(i1, i2)) = True\"\n  \"\\<And>i i' d di. oarrivemsg P \\<sigma> (i':newpkt(d, di))   = True\"\n  \"             oarrivemsg P \\<sigma> \\<tau>\\<^sub>n                   = True\"\n  unfolding oarrivemsg_def by simp_all\n\nlemma oarrivemsg_True [simp, intro]: \"oarrivemsg (\\<lambda>_ _. True) \\<sigma> a\"\n  by (cases a) auto\n\ndefinition castmsg :: \"('m \\<Rightarrow> bool) \\<Rightarrow> 'm node_action \\<Rightarrow> bool\"\nwhere \"castmsg P a \\<equiv> case a of _:*cast(m) \\<Rightarrow> P m\n                              | _ \\<Rightarrow> True\"\n\nlemma castmsg_simps[simp]:\n  \"\\<And>R m.       castmsg P (R:*cast(m))         = P m\"\n  \"\\<And>d m.       castmsg P (d:deliver(m))       = True\"\n  \"\\<And>i ii ni m. castmsg P (ii\\<not>ni:arrive(m))    = True\"\n  \"\\<And>i1 i2.     castmsg P (connect(i1, i2))    = True\"\n  \"\\<And>i1 i2.     castmsg P (disconnect(i1, i2)) = True\"\n  \"\\<And>i i' d di. castmsg P (i':newpkt(d, di))   = True\"\n  \"             castmsg P \\<tau>\\<^sub>n                   = True\"\n  unfolding castmsg_def by simp_all\n\nsubsection \"Networks\"\n\ndatatype net_tree =\n    Node ip \"ip set\"          (\"\\<langle>_; _\\<rangle>\")\n  | Subnet net_tree net_tree  (infixl \"\\<parallel>\" 90)\n\ndeclare net_tree.induct [[induct del]]\nlemmas net_tree_induct [induct type: net_tree] = net_tree.induct [rename_abs i R p1 p2]\n\ndatatype 's net_state =\n    NodeS ip 's \"ip set\"\n  | SubnetS \"'s net_state\" \"'s net_state\"\n\nfun net_ips :: \"'s net_state \\<Rightarrow> ip set\"\nwhere\n    \"net_ips (NodeS i s R) = {i}\"\n  | \"net_ips (SubnetS n1 n2) = net_ips n1 \\<union> net_ips n2\"\n\nfun net_tree_ips :: \"net_tree \\<Rightarrow> ip set\"\nwhere\n    \"net_tree_ips (p1 \\<parallel> p2) = net_tree_ips p1 \\<union> net_tree_ips p2\"\n  | \"net_tree_ips (\\<langle>i; R\\<rangle>) = {i}\"\n\nlemma net_tree_ips_commute:\n  \"net_tree_ips (p1 \\<parallel> p2) = net_tree_ips (p2 \\<parallel> p1)\"\n  by simp (rule Un_commute)\n\nfun wf_net_tree :: \"net_tree \\<Rightarrow> bool\"\nwhere\n   \"wf_net_tree (p1 \\<parallel> p2) = (net_tree_ips p1 \\<inter> net_tree_ips p2 = {}\n                             \\<and> wf_net_tree p1 \\<and> wf_net_tree p2)\"\n | \"wf_net_tree (\\<langle>i; R\\<rangle>) = True\"\n\nlemma wf_net_tree_children [elim]:\n  assumes \"wf_net_tree (p1 \\<parallel> p2)\"\n  obtains \"wf_net_tree p1\"\n      and \"wf_net_tree p2\"\n  using assms by simp\n\nfun netmap :: \"'s net_state \\<Rightarrow> ip \\<Rightarrow> 's option\"\nwhere\n    \"netmap (NodeS i p R\\<^sub>i) = [i \\<mapsto> p]\"\n  | \"netmap (SubnetS s t) = netmap s ++ netmap t\"\n\nlemma not_in_netmap [simp]:\n  assumes \"i \\<notin> net_ips ns\"\n    shows \"netmap ns i = None\"\n  using assms by (induction ns) simp_all\n\nlemma netmap_none_not_in_net_ips:\n  assumes \"netmap ns i = None\"\n    shows \"i\\<notin>net_ips ns\"\n  using assms by (induction ns) auto\n\nlemma net_ips_is_dom_netmap: \"net_ips s = dom(netmap s)\"\n  proof (induction s)\n    fix i R\\<^sub>i and p :: 's\n    show \"net_ips (NodeS i p R\\<^sub>i) = dom (netmap (NodeS i p R\\<^sub>i))\"\n      by auto\n  next\n    fix s1 s2 :: \"'s net_state\"\n    assume \"net_ips s1 = dom (netmap s1)\"\n       and \"net_ips s2 = dom (netmap s2)\"\n    thus \"net_ips (SubnetS s1 s2) = dom (netmap (SubnetS s1 s2))\"\n      by auto\n  qed\n\nlemma in_netmap [simp]:\n  assumes \"i \\<in> net_ips ns\"\n    shows \"netmap ns i \\<noteq> None\"\n  using assms by (auto simp add: net_ips_is_dom_netmap)\n\nlemma netmap_subnets_same:\n  assumes \"netmap s1 i = x\"\n      and \"netmap s2 i = x\"\n    shows \"netmap (SubnetS s1 s2) i = x\"\n  using assms by simp (metis map_add_dom_app_simps(1) map_add_dom_app_simps(3))\n\nlemma netmap_subnets_samef:\n  assumes \"netmap s1 = f\"\n      and \"netmap s2 = f\"\n    shows \"netmap (SubnetS s1 s2) = f\"\n  using assms by simp (metis map_add_le_mapI map_le_antisym map_le_map_add map_le_refl)\n\nlemma netmap_add_disjoint [elim]:\n  assumes \"\\<forall>i\\<in>net_ips s1 \\<union> net_ips s2. the ((netmap s1 ++ netmap s2) i) = \\<sigma> i\"\n      and \"net_ips s1 \\<inter> net_ips s2 = {}\"\n    shows \"\\<forall>i\\<in>net_ips s1. the (netmap s1 i) = \\<sigma> i\"\n  proof\n    fix i\n    assume \"i \\<in> net_ips s1\"\n    hence \"i \\<in> dom(netmap s1)\" by (simp add: net_ips_is_dom_netmap)\n    moreover with assms(2) have \"i \\<notin> dom(netmap s2)\" by (auto simp add: net_ips_is_dom_netmap)\n    ultimately have \"the (netmap s1 i) = the ((netmap s1 ++ netmap s2) i)\"\n      by (simp add: map_add_dom_app_simps)\n    with assms(1) and \\<open>i\\<in>net_ips s1\\<close> show \"the (netmap s1 i) = \\<sigma> i\" by simp\n  qed\n\nlemma netmap_add_disjoint2 [elim]:\n  assumes \"\\<forall>i\\<in>net_ips s1 \\<union> net_ips s2. the ((netmap s1 ++ netmap s2) i) = \\<sigma> i\"\n    shows \"\\<forall>i\\<in>net_ips s2. the (netmap s2 i) = \\<sigma> i\"\n  using assms by (simp add: net_ips_is_dom_netmap)\n                 (metis Un_iff map_add_dom_app_simps(1))\n\nlemma net_ips_netmap_subnet [elim]:\n  assumes \"net_ips s1 \\<inter> net_ips s2 = {}\"\n      and \"\\<forall>i\\<in>net_ips (SubnetS s1 s2). the (netmap (SubnetS s1 s2) i) = \\<sigma> i\"\n    shows \"\\<forall>i\\<in>net_ips s1. the (netmap s1 i) = \\<sigma> i\"\n      and \"\\<forall>i\\<in>net_ips s2. the (netmap s2 i) = \\<sigma> i\"\n  proof -\n    from assms(2) have \"\\<forall>i\\<in>net_ips s1 \\<union> net_ips s2. the ((netmap s1 ++ netmap s2) i) = \\<sigma> i\" by auto\n    with assms(1) show \"\\<forall>i\\<in>net_ips s1. the (netmap s1 i) = \\<sigma> i\"\n      by - (erule(1) netmap_add_disjoint)\n  next\n    from assms(2) have \"\\<forall>i\\<in>net_ips s1 \\<union> net_ips s2. the ((netmap s1 ++ netmap s2) i) = \\<sigma> i\" by auto\n    thus \"\\<forall>i\\<in>net_ips s2. the (netmap s2 i) = \\<sigma> i\"\n      by - (erule netmap_add_disjoint2)\n  qed\n\nfun inoclosed :: \"'s \\<Rightarrow> 'm::msg node_action \\<Rightarrow> bool\"\nwhere\n    \"inoclosed _ (node_arrive ii ni m) = eq_newpkt m\"\n  | \"inoclosed _ (node_newpkt i d di)  = False\"\n  | \"inoclosed _ _ = True\"\n\nlemma inclosed_simps [simp]:\n  \"\\<And>\\<sigma> ii ni. inoclosed \\<sigma> (ii\\<not>ni:arrive(m))   = eq_newpkt m\"\n  \"\\<And>\\<sigma> d di.  inoclosed \\<sigma> (i:newpkt(d, di))   = False\"\n  \"\\<And>\\<sigma> R m.   inoclosed \\<sigma> (R:*cast(m))        = True\"\n  \"\\<And>\\<sigma> i d.   inoclosed \\<sigma> (i:deliver(d))      = True\"\n  \"\\<And>\\<sigma> i i'.  inoclosed \\<sigma> (connect(i, i'))    = True\"\n  \"\\<And>\\<sigma> i i'.  inoclosed \\<sigma> (disconnect(i, i')) = True\"\n  \"\\<And>\\<sigma>.       inoclosed \\<sigma> (\\<tau>)                 = True\"\n  by auto\n\ndefinition\n  netmask :: \"ip set \\<Rightarrow> ((ip \\<Rightarrow> 's) \\<times> 'l) \\<Rightarrow> ((ip \\<Rightarrow> 's option) \\<times> 'l)\"\nwhere\n  \"netmask I s \\<equiv> (\\<lambda>i. if i\\<in>I then Some (fst s i) else None, snd s)\"\n\nlemma netmask_def' [simp]:\n  \"netmask I (\\<sigma>, \\<zeta>) = (\\<lambda>i. if i\\<in>I then Some (\\<sigma> i) else None, \\<zeta>)\"\n  unfolding netmask_def by auto\n\nfun netgmap :: \"('s \\<Rightarrow> 'g \\<times> 'l) \\<Rightarrow> 's net_state \\<Rightarrow> (nat \\<Rightarrow> 'g option) \\<times> 'l net_state\"\n  where\n    \"netgmap sr (NodeS i s R) = ([i \\<mapsto> fst (sr s)], NodeS i (snd (sr s)) R)\"\n  | \"netgmap sr (SubnetS s\\<^sub>1 s\\<^sub>2) = (let (\\<sigma>\\<^sub>1, ss) = netgmap sr s\\<^sub>1 in\n                                   let (\\<sigma>\\<^sub>2, tt) = netgmap sr s\\<^sub>2 in\n                                   (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2, SubnetS ss tt))\"\n\nlemma dom_fst_netgmap [simp, intro]: \"dom (fst (netgmap sr n)) = net_ips n\"\n  proof (induction n)\n    fix i s R\n    show \"dom (fst (netgmap sr (NodeS i s R))) = net_ips (NodeS i s R)\"\n      by simp\n  next\n    fix n1 n2\n    assume a1: \"dom (fst (netgmap sr n1)) = net_ips n1\"\n       and a2: \"dom (fst (netgmap sr n2)) = net_ips n2\"\n    obtain \\<sigma>\\<^sub>1 \\<zeta>\\<^sub>1 \\<sigma>\\<^sub>2 \\<zeta>\\<^sub>2 where nm1: \"netgmap sr n1 = (\\<sigma>\\<^sub>1, \\<zeta>\\<^sub>1)\"\n                        and nm2: \"netgmap sr n2 = (\\<sigma>\\<^sub>2, \\<zeta>\\<^sub>2)\"\n      by (metis surj_pair)\n    hence \"netgmap sr (SubnetS n1 n2) = (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2, SubnetS \\<zeta>\\<^sub>1 \\<zeta>\\<^sub>2)\" by simp\n    hence \"dom (fst (netgmap sr (SubnetS n1 n2))) = dom (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2)\" by simp\n    also from a1 a2 nm1 nm2 have \"dom (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2) = net_ips (SubnetS n1 n2)\" by auto\n    finally show \"dom (fst (netgmap sr (SubnetS n1 n2))) = net_ips (SubnetS n1 n2)\" .\n  qed\n\nlemma netgmap_pair_dom [elim]:\n  obtains \\<sigma> \\<zeta> where \"netgmap sr n = (\\<sigma>, \\<zeta>)\"\n                and \"dom \\<sigma> = net_ips n\"\n    by (metis dom_fst_netgmap surjective_pairing)\n\nlemma net_ips_netgmap [simp]:\n  \"net_ips (snd (netgmap sr s)) = net_ips s\"\n  proof (induction s)\n    fix s1 s2\n    assume \"net_ips (snd (netgmap sr s1)) = net_ips s1\"\n       and \"net_ips (snd (netgmap sr s2)) = net_ips s2\"\n    thus \"net_ips (snd (netgmap sr (SubnetS s1 s2))) = net_ips (SubnetS s1 s2)\"\n      by (cases \"netgmap sr s1\", cases \"netgmap sr s2\") auto\n  qed simp\n\nlemma some_the_fst_netgmap:\n  assumes \"i \\<in> net_ips s\"\n    shows \"Some (the (fst (netgmap sr s) i)) = fst (netgmap sr s) i\"\n  using assms by (metis domIff dom_fst_netgmap option.collapse)\n\n\nlemma fst_netgmap_none [simp]:\n  assumes \"i \\<notin> net_ips s\"\n    shows \"fst (netgmap sr s) i = None\"\n  using assms by (metis domIff dom_fst_netgmap)\n\nlemma fst_netgmap_subnet [simp]:\n  \"fst (case netgmap sr s1 of (\\<sigma>\\<^sub>1, ss) \\<Rightarrow>\n        case netgmap sr s2 of (\\<sigma>\\<^sub>2, tt) \\<Rightarrow>\n        (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2, SubnetS ss tt)) = (fst (netgmap sr s1) ++ fst (netgmap sr s2))\"\n  by (metis (mono_tags) fst_conv netgmap_pair_dom split_conv)\n\nlemma snd_netgmap_subnet [simp]:\n  \"snd (case netgmap sr s1 of (\\<sigma>\\<^sub>1, ss) \\<Rightarrow>\n        case netgmap sr s2 of (\\<sigma>\\<^sub>2, tt) \\<Rightarrow>\n        (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2, SubnetS ss tt)) = (SubnetS (snd (netgmap sr s1)) (snd (netgmap sr s2)))\"\n  by (metis (lifting, no_types) Pair_inject split_beta' surjective_pairing)\n\nlemma fst_netgmap_not_none [simp]:\n  assumes \"i \\<in> net_ips s\"\n    shows \"fst (netgmap sr s) i \\<noteq> None\"\n  using assms by (induction s) auto\n\nlemma netgmap_netgmap_not_rhs [simp]:\n  assumes \"i \\<notin> net_ips s2\"\n    shows \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i = (fst (netgmap sr s1)) i\"\n  proof -\n    from assms(1) have \"i \\<notin> dom (fst (netgmap sr s2))\" by simp\n    thus ?thesis by (simp add: map_add_dom_app_simps)\n  qed\n\nlemma netgmap_netgmap_rhs [simp]:\n  assumes \"i \\<in> net_ips s2\"\n    shows \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i = (fst (netgmap sr s2)) i\"\n  using assms by (simp add: map_add_dom_app_simps)\n\nlemma netgmap_netmask_subnets [elim]:\n  assumes \"netgmap sr s1 = netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1))\"\n      and \"netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\"\n    shows \"fst (netgmap sr (SubnetS s1 s2))\n            = fst (netmask (net_tree_ips (n1 \\<parallel> n2)) (\\<sigma>, snd (netgmap sr (SubnetS s1 s2))))\"\n  proof (rule ext)\n    fix i\n    have \"i \\<in> net_tree_ips n1 \\<or> i \\<in> net_tree_ips n2 \\<or> (i\\<notin>net_tree_ips n1 \\<union> net_tree_ips n2)\"\n      by auto\n    thus \"fst (netgmap sr (SubnetS s1 s2)) i\n            = fst (netmask (net_tree_ips (n1 \\<parallel> n2)) (\\<sigma>, snd (netgmap sr (SubnetS s1 s2)))) i\"\n    proof (elim disjE)\n      assume \"i \\<in> net_tree_ips n1\"\n      with \\<open>netgmap sr s1 = netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1))\\<close>\n           \\<open>netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\\<close>\n        show ?thesis\n          by (cases \"netgmap sr s1\", cases \"netgmap sr s2\", clarsimp)\n             (metis (lifting, mono_tags) map_add_Some_iff)\n    next\n      assume \"i \\<in> net_tree_ips n2\"\n      with \\<open>netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\\<close>\n        show ?thesis\n          by simp (metis (lifting, mono_tags) fst_conv map_add_find_right)\n    next\n      assume \"i\\<notin>net_tree_ips n1 \\<union> net_tree_ips n2\"\n      with \\<open>netgmap sr s1 = netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1))\\<close>\n           \\<open>netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\\<close>\n        show ?thesis\n          by simp (metis (lifting, mono_tags) fst_conv)\n    qed\n  qed\n\nlemma netgmap_netmask_subnets' [elim]:\n  assumes \"netgmap sr s1 = netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1))\"\n      and \"netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\"\n      and \"s = SubnetS s1 s2\"\n    shows \"netgmap sr s = netmask (net_tree_ips (n1 \\<parallel> n2)) (\\<sigma>, snd (netgmap sr s))\"\n  by (simp only: assms(3))\n     (rule prod_eqI [OF netgmap_netmask_subnets [OF assms(1-2)]], simp)\n\nlemma netgmap_subnet_split1:\n  assumes \"netgmap sr (SubnetS s1 s2) = netmask (net_tree_ips (n1 \\<parallel> n2)) (\\<sigma>, \\<zeta>)\"\n      and \"net_tree_ips n1 \\<inter> net_tree_ips n2 = {}\"\n      and \"net_ips s1 = net_tree_ips n1\"\n      and \"net_ips s2 = net_tree_ips n2\"\n    shows \"netgmap sr s1 = netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1))\"\n  proof (rule prod_eqI)\n    show \"fst (netgmap sr s1) = fst (netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1)))\"\n    proof (rule ext, simp, intro conjI impI)\n      fix i\n      assume \"i\\<in>net_tree_ips n1\"\n      with \\<open>net_tree_ips n1 \\<inter> net_tree_ips n2 = {}\\<close> have \"i\\<notin>net_tree_ips n2\"\n        by auto\n      from assms(1) [simplified prod_eq_iff]\n        have \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i =\n                 (if i \\<in> net_tree_ips n1 \\<or> i \\<in> net_tree_ips n2 then Some (\\<sigma> i) else None)\"\n          by simp\n      also from \\<open>i\\<notin>net_tree_ips n2\\<close> and \\<open>net_ips s2 = net_tree_ips n2\\<close>\n        have \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i = fst (netgmap sr s1) i\"\n          by (metis dom_fst_netgmap map_add_dom_app_simps(3))\n      finally show \"fst (netgmap sr s1) i = Some (\\<sigma> i)\"\n        using \\<open>i\\<in>net_tree_ips n1\\<close> by simp\n    next\n      fix i\n      assume \"i \\<notin> net_tree_ips n1\"\n      with \\<open>net_ips s1 = net_tree_ips n1\\<close> have \"i \\<notin> net_ips s1\" by simp\n      thus \"fst (netgmap sr s1) i = None\" by simp\n    qed\n  qed simp\n\nlemma netgmap_subnet_split2:\n  assumes \"netgmap sr (SubnetS s1 s2) = netmask (net_tree_ips (n1 \\<parallel> n2)) (\\<sigma>, \\<zeta>)\"\n      and \"net_ips s1 = net_tree_ips n1\"\n      and \"net_ips s2 = net_tree_ips n2\"\n    shows \"netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\"\n  proof (rule prod_eqI)\n    show \"fst (netgmap sr s2) = fst (netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2)))\"\n    proof (rule ext, simp, intro conjI impI)\n      fix i\n      assume \"i\\<in>net_tree_ips n2\"\n      from assms(1) [simplified prod_eq_iff]\n        have \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i =\n                 (if i \\<in> net_tree_ips n1 \\<or> i \\<in> net_tree_ips n2 then Some (\\<sigma> i) else None)\"\n          by simp\n      also from \\<open>i\\<in>net_tree_ips n2\\<close> and \\<open>net_ips s2 = net_tree_ips n2\\<close>\n        have \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i = fst (netgmap sr s2) i\"\n          by (metis dom_fst_netgmap map_add_dom_app_simps(1))\n      finally show \"fst (netgmap sr s2) i = Some (\\<sigma> i)\"\n        using \\<open>i\\<in>net_tree_ips n2\\<close> by simp\n    next\n      fix i\n      assume \"i \\<notin> net_tree_ips n2\"\n      with \\<open>net_ips s2 = net_tree_ips n2\\<close> have \"i \\<notin> net_ips s2\" by simp\n      thus \"fst (netgmap sr s2) i = None\" by simp\n    qed\n  qed simp\n\nlemma netmap_fst_netgmap_rel:\n  shows \"(\\<lambda>i. map_option (fst o sr) (netmap s i)) = fst (netgmap sr s)\"\n  proof (induction s)\n    fix ii s R\n    show \"(\\<lambda>i. map_option (fst \\<circ> sr) (netmap (NodeS ii s R) i)) = fst (netgmap sr (NodeS ii s R))\"\n      by auto\n  next\n    fix s1 s2\n    assume a1: \"(\\<lambda>i. map_option (fst \\<circ> sr) (netmap s1 i)) = fst (netgmap sr s1)\"\n       and a2: \"(\\<lambda>i. map_option (fst \\<circ> sr) (netmap s2 i)) = fst (netgmap sr s2)\"\n    show \"(\\<lambda>i. map_option (fst \\<circ> sr) (netmap (SubnetS s1 s2) i)) = fst (netgmap sr (SubnetS s1 s2))\"\n    proof (rule ext)\n      fix i\n      from a1 a2 have \"map_option (fst \\<circ> sr) ((netmap s1 ++ netmap s2) i)\n                                    = (fst (netgmap sr s1) ++ fst (netgmap sr s2)) i\"\n        by (metis fst_conv map_add_dom_app_simps(1) map_add_dom_app_simps(3)\n                  net_ips_is_dom_netmap netgmap_pair_dom)\n      thus \"map_option (fst \\<circ> sr) (netmap (SubnetS s1 s2) i) = fst (netgmap sr (SubnetS s1 s2)) i\"\n        by simp\n    qed\n  qed\n\nlemma netmap_is_fst_netgmap:\n  assumes \"netmap s' = netmap s\"\n    shows \"fst (netgmap sr s') = fst (netgmap sr s)\"\n  using assms by (metis netmap_fst_netgmap_rel)\n\nlemma netmap_is_fst_netgmap':\n  assumes \"netmap s' i = netmap s i\"\n    shows \"fst (netgmap sr s') i = fst (netgmap sr s) i\"\n  using assms by (metis netmap_fst_netgmap_rel)\n\nlemma fst_netgmap_pair_fst [simp]:\n  \"fst (netgmap (\\<lambda>(p, q). (fst p, snd p, q)) s) = fst (netgmap fst s)\"\n  by (induction s) auto\n\ntext \\<open>Introduce streamlined alternatives to netgmap to simplify certain property\n        statements and thus make them easier to understand and to present.\\<close>\n\nfun netlift :: \"('s \\<Rightarrow> 'g \\<times> 'l) \\<Rightarrow> 's net_state \\<Rightarrow> (nat \\<Rightarrow> 'g option)\"\n  where\n    \"netlift sr (NodeS i s R) = [i \\<mapsto> fst (sr s)]\"\n  | \"netlift sr (SubnetS s t) = (netlift sr s) ++ (netlift sr t)\"\n\nlemma fst_netgmap_netlift:\n  \"fst (netgmap sr s) = netlift sr s\"\n  by (induction s) simp_all\n\nfun netliftl :: \"('s \\<Rightarrow> 'g \\<times> 'l) \\<Rightarrow> 's net_state \\<Rightarrow> 'l net_state\"\n  where\n    \"netliftl sr (NodeS i s R) = NodeS i (snd (sr s)) R\"\n  | \"netliftl sr (SubnetS s t) = SubnetS (netliftl sr s) (netliftl sr t)\"\n\nlemma snd_netgmap_netliftl:\n  \"snd (netgmap sr s) = netliftl sr s\"\n  by (induction s) simp_all\n \nlemma netgmap_netlift_netliftl: \"netgmap sr s = (netlift sr s, netliftl sr s)\"\n  by rule (simp_all add: fst_netgmap_netlift snd_netgmap_netliftl)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/AWN/AWN.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.5273165233795672, "lm_q1q2_score": 0.3085335064598199}}
{"text": "section \"Implementation Language\"\ntheory impl_language\n  imports Main \n    \"HOL-Library.Monad_Syntax\"\n  repliss_sem\nbegin\n\n\ntext \"So far, we have assumed that procedure implementations are given by arbitrary state machines.\nHere we define an implementation language using a shallow embedding with the monad syntax package.\n\"\n\ncontext begin\n\n\n\ndatatype ('a,'op, 'any) io =\n    WaitLocalStep bool \"('a,'op, 'any) io\"\n  | WaitBeginAtomic \"('a,'op, 'any) io\"\n  | WaitEndAtomic \"('a,'op, 'any) io\"\n  | WaitNewId \"'any \\<Rightarrow> bool\" \"'any \\<Rightarrow> ('a,'op, 'any) io\"\n  | WaitDbOperation 'op \"'any \\<Rightarrow> ('a,'op, 'any) io\"\n  | WaitReturn \"'a\" \n\n\nfunction (domintros) bind :: \"('a, 'op, 'any) io \\<Rightarrow> ('a \\<Rightarrow> ('b, 'op,'any) io) \\<Rightarrow> ('b, 'op,'any) io\"  where\n  \"bind (WaitLocalStep ok n) f = (WaitLocalStep ok (bind n f))\"\n| \"bind (WaitBeginAtomic n) f = (WaitBeginAtomic (bind n f))\"\n| \"bind (WaitEndAtomic n) f = (WaitEndAtomic (bind n f))\"\n| \"bind (WaitNewId P n) f = (WaitNewId P (\\<lambda>i.  bind (n i) f))\"\n| \"bind (WaitDbOperation op n) f = (WaitDbOperation op (\\<lambda>i.  bind (n i) f))\"\n| \"bind (WaitReturn s) f = (f s)\"\n\n  by (pat_completeness, auto)\ntermination\n  using [[show_sorts]]\nproof auto\n  show \"bind_dom (a, b)\" for a b\n    by (induct a, auto simp add: bind.domintros)\nqed\n\nadhoc_overloading Monad_Syntax.bind bind\n\ndefinition pause :: \"(unit,'op,'any) io\" where\n\"pause \\<equiv> WaitLocalStep True (WaitReturn ())\"\n\ndefinition beginAtomic :: \"(unit,'op,'any) io\" where\n\"beginAtomic \\<equiv> WaitBeginAtomic (WaitReturn ())\"\n\ndefinition endAtomic :: \"(unit,'op,'any) io\" where\n\"endAtomic \\<equiv> WaitEndAtomic (WaitReturn ())\"\n\n\ndefinition newId :: \"('any \\<Rightarrow> bool) \\<Rightarrow> ('any,'op,'any) io\" where\n\"newId P \\<equiv> WaitNewId P (\\<lambda>i. WaitReturn i)\"\n\ndefinition call :: \"'op \\<Rightarrow> ('any,'op,'any) io\" where\n\"call op \\<equiv> WaitDbOperation op (\\<lambda>i. WaitReturn i)\"\n\ndefinition return :: \"'a  \\<Rightarrow> ('a,'op, 'any) io\" where\n\"return x \\<equiv> WaitReturn x\"\n\n\ndefinition atomic ::\"('a,'op, 'any) io \\<Rightarrow> ('a,'op, 'any) io\"  where\n\"atomic f \\<equiv> do {\n  beginAtomic;\n  r \\<leftarrow> f;\n  endAtomic;\n  return r\n}\"\n\n\ndefinition \n\"skip \\<equiv> return undefined\"\n\nfun toImpl :: \"(('val,'op, 'val) io, 'op, 'val) procedureImpl\" where\n\"toImpl (WaitLocalStep ok n) = LocalStep ok n\"\n| \"toImpl (WaitBeginAtomic n) = BeginAtomic n\"\n| \"toImpl (WaitEndAtomic n) = EndAtomic n\"\n| \"toImpl (WaitNewId P n) = NewId (\\<lambda>i. if P i then Some (n i) else None)\"\n| \"toImpl (WaitDbOperation op n) = DbOperation op n\"\n| \"toImpl (WaitReturn v) = Return v\"\n\n\n\n\n\nlemma toImpl_simps[simp]:\n\"toImpl (newId P) = NewId (\\<lambda>i. if P i then Some (return i) else None)\"\n\"toImpl (pause) = LocalStep True (return ())\"\n\"toImpl (beginAtomic) = BeginAtomic (return ())\"\n\"toImpl (endAtomic) = EndAtomic (return ())\"\n\"toImpl (call op ) = DbOperation op  (\\<lambda>r. return r)\"\n\"toImpl (return x) = Return x\"\n  by (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def return_def intro!: ext split: io.splits)\n\n\nlemma toImpl_bind_simps[simp]:\n\"\\<And>P x. toImpl (newId P \\<bind> x) = NewId (\\<lambda>i. if P i then Some (x i) else None)\"\n\"\\<And> x. toImpl (pause \\<bind> x) = LocalStep True (x ())\"\n\"\\<And> x. toImpl (beginAtomic \\<bind> x) = BeginAtomic (x ())\"\n\"\\<And> x. toImpl (endAtomic \\<bind> x) = EndAtomic (x ())\"\n\"\\<And> x. toImpl (call op  \\<bind> x) = DbOperation op  (\\<lambda>r. x r)\"\n  by (auto simp add: newId_def pause_def beginAtomic_def endAtomic_def call_def intro!: ext split: io.splits)\n\n\n\nparagraph \"Monad Laws\"\n\ntext \"We prove the typical monad laws: identity of return and associativity.\"\n\nlemma return_left_ident[simp]: \n  fixes x and f :: \"'a \\<Rightarrow> ('b,'op, 'any) io\"\n  shows \"return x \\<bind> f = f x\"\n  by (auto simp add: return_def)\n\nlemma right_ident[simp]: \n  fixes m :: \"('a,'op, 'any) io\"\n  shows \"(m \\<bind> return) = m\"\n  by (induct m, auto simp add: return_def)\n\nlemma bind_assoc[simp]: \n  fixes x :: \"('a,'op, 'any) io\"\n    and y :: \"'a \\<Rightarrow> ('b,'op, 'any) io\"\n    and z :: \"'b \\<Rightarrow> ('c,'op, 'any) io\"\n  shows \"((x \\<bind> y) \\<bind> z) = (x \\<bind> (\\<lambda>a. y a \\<bind> z))\"\n  by (induct x, auto)\n\n\n\n\nlemma atomic_simp1[simp]: \n\"toImpl (atomic f) = BeginAtomic (f \\<bind> (\\<lambda>r. endAtomic \\<bind> (\\<lambda>_. return r)))\"\n  by (auto simp add: atomic_def bind_assoc)\n\nlemma atomic_simp2[simp]: \n\"toImpl (atomic f \\<bind> x) = BeginAtomic (f \\<bind> (\\<lambda>a. endAtomic \\<bind> (\\<lambda>b. x a)))\"\n  by (auto simp add: atomic_def bind_assoc)\n\n\n\nend\n\n\nend\n", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/impl_language.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011397337391, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3085334988298176}}
{"text": "section \\<open>Basic Definitions\\<close>\ntheory Sepref_Basic\nimports \n  \"../ds/LLVM_DS_NArray\"\n  \"HOL-Eisbach.Eisbach\"\n  Refine_Monadic_Add\n  \"Lib/Sepref_Misc\"\n  \"Lib/Structured_Apply\"\n  Sepref_Id_Op\nbegin\nno_notation i_ANNOT (infixr \":::\\<^sub>i\" 10)\nno_notation CONST_INTF (infixr \"::\\<^sub>i\" 10)\n\nno_notation pred_K (\"\\<langle>_\\<rangle>\")\n\n\ntype_synonym assn = ll_assn\n\n\n\ntext \\<open>\n  In this theory, we define the basic concept of refinement \n  from a nondeterministic program specified in the \n  Isabelle Refinement Framework to an imperative deterministic one \n  specified in Imperative/HOL.\n\\<close>\n\nsubsection {* Values on Heap *}\ntext \\<open>We tag every refinement assertion with the tag @{text hn_ctxt}, to\n  avoid higher-order unification problems when the refinement assertion \n  is schematic.\\<close>\ndefinition hn_ctxt :: \"('a\\<Rightarrow>'c\\<Rightarrow>assn) \\<Rightarrow> 'a \\<Rightarrow> 'c \\<Rightarrow> assn\" \n  \\<comment> \\<open>Tag for refinement assertion\\<close>\n  where\n  \"hn_ctxt P a c \\<equiv> P a c\"\n\ndefinition pure :: \"('b \\<times> 'a) set \\<Rightarrow> 'a \\<Rightarrow> 'b \\<Rightarrow> assn\"\n  \\<comment> \\<open>Pure binding, not involving the heap\\<close>\n  where \"pure R \\<equiv> (\\<lambda>a c. \\<up>((c,a)\\<in>R))\"\n\nlemma pure_app_eq: \"pure R a c = \\<up>((c,a)\\<in>R)\" by (auto simp: pure_def)\n\nlemma pure_eq_conv[simp]: \"pure R = pure R' \\<longleftrightarrow> R=R'\"\n  unfolding pure_def \n  apply (rule iffI)\n  apply safe\n  apply (meson pure_assn_eq_conv)\n  apply (meson pure_assn_eq_conv)\n  done\n\nlemma pure_rel_eq_false_iff: \"pure R x y = sep_false \\<longleftrightarrow> (y,x)\\<notin>R\"\n  by (auto simp: pure_def sep_algebra_simps)\n    \nlemma pure_part_pure[simp]: \"pure_part (pure R a c) \\<longleftrightarrow> (c,a)\\<in>R\"  \n  by (simp add: pure_app_eq)\n  \ndefinition is_pure :: \"(_ \\<Rightarrow> _ \\<Rightarrow> assn) \\<Rightarrow> bool\" where \"is_pure P \\<equiv> \\<exists>P'. \\<forall>x x'. P x x'=\\<up>(P' x x')\"\nlemma is_pureI[intro?]: \n  assumes \"\\<And>x x'. P x x' = \\<up>(P' x x')\"\n  shows \"is_pure P\"\n  using assms unfolding is_pure_def by blast\n\nlemma is_pureE:\n  assumes \"is_pure P\"\n  obtains P' where \"\\<And>x x'. P x x' = \\<up>(P' x x')\"\n  using assms unfolding is_pure_def by blast\n\nlemma pure_pure[simp]: \"is_pure (pure P)\"\n  unfolding pure_def by rule blast\nlemma pure_hn_ctxt[intro!]: \"is_pure P \\<Longrightarrow> is_pure (hn_ctxt P)\"\n  unfolding hn_ctxt_def[abs_def] .\n\n\ndefinition the_pure :: \"('b \\<Rightarrow> 'a \\<Rightarrow> assn) \\<Rightarrow> ('a \\<times> 'b) set\" \n  where \"the_pure P \\<equiv> THE P'. \\<forall>x x'. P x x'=\\<up>((x',x)\\<in>P')\"\n\nlemma the_pure_pure[simp]: \"the_pure (pure R) = R\"\n  unfolding pure_def the_pure_def\n  by (rule theI2[where a=R]) auto\n\nlemma is_pure_alt_def: \"is_pure R \\<longleftrightarrow> (\\<exists>Ri. \\<forall>x y. R x y = \\<up>((y,x)\\<in>Ri))\"\n  unfolding is_pure_def\n  apply auto\n  apply (rename_tac P')\n  apply (rule_tac x=\"{(x,y). P' y x}\" in exI)\n  apply auto\n  done\n\nlemma pure_the_pure[simp]: \"is_pure R \\<Longrightarrow> pure (the_pure R) = R\"\n  unfolding is_pure_alt_def pure_def the_pure_def\n  apply (intro ext)\n  apply clarsimp\n  apply (rename_tac a c Ri)\n  apply (rule_tac a=Ri in theI2)\n  apply auto\n  done\n  \nlemma is_pure_conv: \"is_pure R \\<longleftrightarrow> (\\<exists>R'. R = pure R')\"\n  unfolding pure_def is_pure_alt_def by force\n\nlemma is_pure_the_pure_id_eq[simp]: \"is_pure R \\<Longrightarrow> the_pure R = Id \\<longleftrightarrow> R=pure Id\"  \n  by (auto simp: is_pure_conv)\n\nlemma is_pure_iff_pure_assn: \"is_pure P = (\\<forall>x x'. sep_is_pure_assn (P x x'))\"\n  unfolding is_pure_def \n  apply (rule iffI)\n  apply auto []\n  apply (rule exI[where x=\"\\<lambda>a c. pure_part (P a c)\"])\n  apply auto\n  done\n\n\nabbreviation \"hn_val R \\<equiv> hn_ctxt (pure R)\"\n\nlemma hn_val_unfold: \"hn_val R a b = \\<up>((b,a)\\<in>R)\"\n  by (simp add: hn_ctxt_def pure_def)\n\n\ndefinition \"invalid_assn R x y \\<equiv> \\<up>(pure_part (R x y))\"\n\nabbreviation \"hn_invalid R \\<equiv> hn_ctxt (invalid_assn R)\"\n\nlemma invalidate_clone: \"R x y = (invalid_assn R x y ** R x y)\"\n  unfolding invalid_assn_def\n  by (metis (mono_tags, lifting) pure_partI pure_part_pure_eq pure_part_split_conj pure_true_conv sep.add.right_neutral sep_conj_commute sep_is_pure_assn_def)\n\nlemma invalidate_clone': \"hn_ctxt R x y = (hn_invalid R x y ** hn_ctxt R x y)\"\n  unfolding hn_ctxt_def using invalidate_clone .\n\nlemma invalid_pure_recover: \"invalid_assn (pure R) x y = pure R x y\"\n  unfolding invalid_assn_def pure_def by auto\n\nlemma hn_invalidI: \"hn_ctxt P x y s \\<Longrightarrow> hn_invalid P x y = \\<box>\"\n  by (auto simp: invalid_assn_def hn_ctxt_def pure_partI pure_true_conv)\n\nlemma invalid_assn_cong[cong]:\n  assumes \"x\\<equiv>x'\"\n  assumes \"y\\<equiv>y'\"\n  assumes \"R x' y' \\<equiv> R' x' y'\"\n  shows \"invalid_assn R x y = invalid_assn R' x' y'\"\n  using assms unfolding invalid_assn_def\n  by simp\n\nsubsection \\<open>Constraints in Refinement Relations\\<close>\n\ndefinition rdomp :: \"('a \\<Rightarrow> 'c \\<Rightarrow> assn) \\<Rightarrow> 'a \\<Rightarrow> bool\" where\n  \"rdomp R a \\<equiv> \\<exists>h c. R a c h\"\n\n(*abbreviation \"rdom R \\<equiv> Collect (rdomp R)\"*)\n\nlemma rdomp_ctxt[simp]: \"rdomp (hn_ctxt R) = rdomp R\"\n  by (simp add: hn_ctxt_def[abs_def])  \n\nlemma rdomp_pure[simp]: \"rdomp (pure R) a \\<longleftrightarrow> a\\<in>Range R\"\n  unfolding rdomp_def pure_def by (auto simp: pred_lift_extract_simps)\n\n(*\n\nlemma rdomp_invalid_simp[simp]: \"rdomp (invalid_assn P) x = rdomp P x\"\n  by (auto simp: invalid_assn_def rdomp_def pure_part_def pred_lift_extract_simps)\n\nlemma Range_of_constraint_conv[simp]: \"Range (A\\<inter>UNIV\\<times>C) = Range A \\<inter> C\"\n  by auto\n\n\nsubsection \\<open>Heap-Nres Refinement Calculus\\<close>\n\ntext {* Predicate that expresses refinement. Given a heap\n  @{text \"\\<Gamma>\"}, program @{text \"c\"} produces a heap @{text \"\\<Gamma>'\"} and\n  a concrete result that is related with predicate @{text \"R\"} to some\n  abstract result from @{text \"m\"}*}\n  \ndefinition \"hn_refine \\<Gamma> c \\<Gamma>' R m \\<equiv> nofail m \\<longrightarrow>\n  llvm_htriple \\<Gamma> c (\\<lambda>r. \\<Gamma>' ** (EXS x. R x r ** \\<up>(RETURN x \\<le> m)))\"\n\nlemma hn_refineI[intro?]:\n  assumes \"nofail m \n    \\<Longrightarrow> llvm_htriple \\<Gamma> c (\\<lambda>r. \\<Gamma>' ** (EXS x. R x r ** \\<up>(RETURN x \\<le> m)))\"\n  shows \"hn_refine \\<Gamma> c \\<Gamma>' R m\"\n  using assms unfolding hn_refine_def by blast\n\nlemma hn_refineD:\n  assumes \"hn_refine \\<Gamma> c \\<Gamma>' R m\"\n  assumes \"nofail m\"\n  shows \"llvm_htriple \\<Gamma> c (\\<lambda>r. \\<Gamma>' ** (EXS x. R x r ** \\<up>(RETURN x \\<le> m)))\"\n  using assms unfolding hn_refine_def by blast\n\nlemma hn_refine_preI: \n  assumes \"\\<And>h. \\<Gamma> h \\<Longrightarrow> hn_refine \\<Gamma> c \\<Gamma>' R a\"\n  shows \"hn_refine \\<Gamma> c \\<Gamma>' R a\"\n  using assms unfolding hn_refine_def\n  apply auto\n  using htripleI sep_conjD by blast\n\nlemma hn_refine_nofailI: \n  assumes \"nofail a \\<Longrightarrow> hn_refine \\<Gamma> c \\<Gamma>' R a\"  \n  shows \"hn_refine \\<Gamma> c \\<Gamma>' R a\"\n  using assms by (auto simp: hn_refine_def)\n\nlemma hn_refine_false[simp]: \"hn_refine sep_false c \\<Gamma>' R m\"\n  by rule auto\n\nlemma hnr_FAIL[simp, intro!]: \"hn_refine \\<Gamma> c \\<Gamma>' R FAIL\"\n  by rule auto\n\nlemma hn_refine_frame:\n  assumes \"hn_refine P' c Q' R m\"\n  assumes \"P \\<turnstile> P' ** F\"\n  shows \"hn_refine P c (Q' ** F) R m\"\n  using assms\n  unfolding hn_refine_def entails_def\n  apply clarsimp\n  apply (rule cons_rule[where P=\"P'**F\", rotated])\n  apply simp\n  apply simp\n  apply (rule cons_post_rule)\n  apply (erule frame_rule)\n  apply (auto simp: sep_algebra_simps pred_lift_extract_simps)\n  by (metis sep.mult_commute)\n\nlemma hn_refine_frame': \"hn_refine \\<Gamma> c \\<Gamma>' R m \\<Longrightarrow> hn_refine (\\<Gamma>**F) c (\\<Gamma>'**F) R m\"  \n  by (simp add: hn_refine_frame)\n  \nlemma hn_refine_cons:\n  assumes I: \"P\\<turnstile>P'\"\n  assumes R: \"hn_refine P' c Q R m\"\n  assumes I': \"Q\\<turnstile>Q'\"\n  assumes R': \"\\<And>x y. R x y \\<turnstile> R' x y\"\n  shows \"hn_refine P c Q' R' m\"\n  using R unfolding hn_refine_def\n  apply clarify\n  apply (erule cons_rule)\n  using I apply (simp add: entails_def)\n  using I' R'\n  by (smt entails_def sep_conj_impl)\n\n(*lemma hn_refine_cons:\n  assumes I: \"P\\<Longrightarrow>\\<^sub>AP'\"\n  assumes R: \"hn_refine P' c Q R m\"\n  assumes I': \"Q\\<Longrightarrow>\\<^sub>AQ'\"\n  assumes R': \"\\<And>x y. R x y \\<Longrightarrow>\\<^sub>A R' x y\"\n  shows \"hn_refine P c Q' R' m\"\n  using R unfolding hn_refine_def\n  apply clarsimp\n  apply (rule cons_pre_rule[OF I])\n  apply (erule cons_post_rule)\n  apply (rule ent_star_mono ent_refl I' R' ent_ex_preI ent_ex_postI)+\n  done\n*)\nlemma hn_refine_cons_pre:\n  assumes I: \"P \\<turnstile> P'\"\n  assumes R: \"hn_refine P' c Q R m\"\n  shows \"hn_refine P c Q R m\"\n  apply (rule hn_refine_cons[OF I R])\n  by auto\n\nlemma hn_refine_cons_post:\n  assumes R: \"hn_refine P c Q R m\"\n  assumes I: \"Q\\<turnstile>Q'\"\n  shows \"hn_refine P c Q' R m\"\n  using assms\n  by (rule hn_refine_cons[OF entails_refl _ _ entails_refl])\n\nlemma hn_refine_cons_res: \n  \"\\<lbrakk> hn_refine \\<Gamma> f \\<Gamma>' R g; \\<And>a c. R a c \\<turnstile> R' a c \\<rbrakk> \\<Longrightarrow> hn_refine \\<Gamma> f \\<Gamma>' R' g\"\n  by (erule hn_refine_cons[OF entails_refl]) auto\n\nlemma hn_refine_ref:\n  assumes LE: \"m\\<le>m'\"\n  assumes R: \"hn_refine P c Q R m\"\n  shows \"hn_refine P c Q R m'\"\n  apply rule\n  apply (rule cons_post_rule)\n  apply (rule hn_refineD[OF R])\n  using LE apply (simp add: pw_le_iff)\n  by (smt LE order_trans pred_lift_extract_simps(2) sep_conj_commute sep_conj_impl)\n\nlemma hn_refine_cons_complete:\n  assumes I: \"P\\<turnstile>P'\"\n  assumes R: \"hn_refine P' c Q R m\"\n  assumes I': \"Q\\<turnstile>Q'\"\n  assumes R': \"\\<And>x y. R x y \\<turnstile> R' x y\"\n  assumes LE: \"m\\<le>m'\"\n  shows \"hn_refine P c Q' R' m'\"\n  apply (rule hn_refine_ref[OF LE])\n  apply (rule hn_refine_cons[OF I R I' R'])\n  done\n \nlemma hn_refine_augment_res:\n  assumes A: \"hn_refine \\<Gamma> f \\<Gamma>' R g\"\n  assumes B: \"g \\<le>\\<^sub>n SPEC \\<Phi>\"\n  shows \"hn_refine \\<Gamma> f \\<Gamma>' (\\<lambda>a c. R a c ** \\<up>(\\<Phi> a)) g\"\n  apply (rule hn_refineI)\n  apply (rule cons_post_rule)\n  apply (erule A[THEN hn_refineD])\n  apply (erule sep_conj_impl, simp)\n  apply clarsimp apply (rule exI)\n  apply (erule sep_conj_impl, simp)\n  using B\n  apply (auto simp: pred_lift_extract_simps pw_le_iff pw_leof_iff)\n  done\n\nsubsection \\<open>Product Types\\<close>\ntext \\<open>Some notion for product types is already defined here, as it is used \n  for currying and uncurrying, which is fundamental for the sepref tool\\<close>\ndefinition prod_assn :: \"('a1\\<Rightarrow>'c1\\<Rightarrow>assn) \\<Rightarrow> ('a2\\<Rightarrow>'c2\\<Rightarrow>assn) \n  \\<Rightarrow> 'a1*'a2 \\<Rightarrow> 'c1*'c2 \\<Rightarrow> assn\" where\n  \"prod_assn P1 P2 a c \\<equiv> case (a,c) of ((a1,a2),(c1,c2)) \\<Rightarrow>\n  P1 a1 c1 ** P2 a2 c2\"\n\nnotation prod_assn (infixr \"\\<times>\\<^sub>a\" 70)\n  \nlemma prod_assn_pure_conv[simp]: \"prod_assn (pure R1) (pure R2) = pure (R1 \\<times>\\<^sub>r R2)\"\n  by (auto simp: pure_def prod_assn_def pred_lift_extract_simps intro!: ext)\n\nlemma prod_assn_pair_conv[simp]: \n  \"prod_assn A B (a1,b1) (a2,b2) = (A a1 a2 ** B b1 b2)\"\n  unfolding prod_assn_def by auto\n\nlemma prod_assn_true[simp]: \"prod_assn (\\<lambda>_ _. sep_true) (\\<lambda>_ _. sep_true) = (\\<lambda>_ _. sep_true)\"\n  by (auto intro!: ext simp: hn_ctxt_def prod_assn_def)\n\nsubsection \"Convenience Lemmas\"\n\nlemma hn_refine_guessI:\n  assumes \"hn_refine P f P' R f'\"\n  assumes \"f=f_conc\"\n  shows \"hn_refine P f_conc P' R f'\"\n  \\<comment> \\<open>To prove a refinement, first synthesize one, and then prove equality\\<close>\n  using assms by simp\n\n\nlemma imp_correctI:\n  assumes R: \"hn_refine \\<Gamma> c \\<Gamma>' R a\"\n  assumes C: \"a \\<le> SPEC \\<Phi>\"\n  shows \"llvm_htriple \\<Gamma> c (\\<lambda>r'. EXS r. \\<Gamma>' ** R r r' ** \\<up>(\\<Phi> r))\"\n  apply (rule cons_post_rule)\n  apply (rule hn_refineD[OF R])\n  apply (rule le_RES_nofailI[OF C])\n  apply (force simp: sep_algebra_simps pred_lift_extract_simps dest: order_trans[OF _ C])\n  done\n\nlemma hnr_pre_ex_conv: \n  shows \"hn_refine (EXS x. \\<Gamma> x) c \\<Gamma>' R a \\<longleftrightarrow> (\\<forall>x. hn_refine (\\<Gamma> x) c \\<Gamma>' R a)\"\n  unfolding hn_refine_def\n  apply (safe; clarsimp?)\n  subgoal by (metis (mono_tags, lifting) cons_rule)\n  subgoal premises prems\n    supply [vcg_rules] = prems(1)[THEN spec]\n    by vcg\n  done\n\nlemma hnr_pre_pure_conv:  \n  shows \"hn_refine (\\<up>P ** \\<Gamma>) c \\<Gamma>' R a \\<longleftrightarrow> (P \\<longrightarrow> hn_refine \\<Gamma> c \\<Gamma>' R a)\"\n  unfolding hn_refine_def\n  by (auto simp: sep_algebra_simps htriple_extract_pre_pure)\n\nlemma hn_refine_split_post:\n  assumes \"hn_refine \\<Gamma> c \\<Gamma>' R a\"\n  shows \"hn_refine \\<Gamma> c (\\<Gamma>' or \\<Gamma>'') R a\"\n  apply (rule hn_refine_cons_post[OF assms])\n  apply (auto simp: entails_def)\n  done\n\nlemma hn_refine_post_other: \n  assumes \"hn_refine \\<Gamma> c \\<Gamma>'' R a\"\n  shows \"hn_refine \\<Gamma> c (\\<Gamma>' or \\<Gamma>'') R a\"\n  apply (rule hn_refine_cons_post[OF assms])\n  apply (auto simp: entails_def)\n  done\n\n\nsubsubsection \\<open>Return\\<close>\n\nlemma hnr_RETURN_pass:\n  \"hn_refine (hn_ctxt R x p) (return p) (hn_invalid R x p) R (RETURN x)\"\n  \\<comment> \\<open>Pass on a value from the heap as return value\\<close>\n  apply (subst invalidate_clone')\n  apply rule unfolding hn_ctxt_def\n  apply vcg\n  done\n\nlemma hnr_RETURN_pure:\n  assumes \"(c,a)\\<in>R\"\n  shows \"hn_refine emp (return c) emp (pure R) (RETURN a)\"\n  \\<comment> \\<open>Return pure value\\<close>\n  unfolding hn_refine_def using assms\n  supply [simp] = pure_def\n  by vcg\n  \nsubsubsection \\<open>Assertion\\<close>\n\nlemma hnr_ASSERT:\n  assumes \"\\<Phi> \\<Longrightarrow> hn_refine \\<Gamma> c \\<Gamma>' R c'\"\n  shows \"hn_refine \\<Gamma> c \\<Gamma>' R (do { ASSERT \\<Phi>; c'})\"\n  using assms\n  apply (cases \\<Phi>)\n  by auto\n\nsubsubsection \\<open>Bind\\<close>\nlemma bind_det_aux: \"\\<lbrakk> RETURN x \\<le> m; RETURN y \\<le> f x \\<rbrakk> \\<Longrightarrow> RETURN y \\<le> m \\<bind> f\"\n  apply (rule order_trans[rotated])\n  apply (rule Refine_Basic.bind_mono)\n  apply assumption\n  apply (rule order_refl)\n  apply simp\n  done\n\n  \ndefinition \"MK_FREE R f \\<equiv> \\<forall>a c. llvm_htriple (R a c) (f c) (\\<lambda>_::unit. \\<box>)\"  \n\nlemma MK_FREEI[intro?]: \"\\<lbrakk>\\<And>a c. llvm_htriple (R a c) (f c) (\\<lambda>_. \\<box>)\\<rbrakk> \\<Longrightarrow> MK_FREE R f\"\n  by (auto simp: MK_FREE_def)\n\nlemma MK_FREED: \"MK_FREE R f \\<Longrightarrow> llvm_htriple (R a c) (f c) (\\<lambda>_. \\<box>)\"\n  by (auto simp: MK_FREE_def)\n  \nlemma mk_free_pure: \"MK_FREE (pure R) (\\<lambda>_. return ())\"\n  apply rule unfolding pure_def\n  by vcg\n\n(*\n  TODO: Should be synthesized once relations are known\n*)\nlemma mk_free_is_pure: \"is_pure A \\<Longrightarrow> MK_FREE A (\\<lambda>_. return ())\"\n  apply rule unfolding pure_def is_pure_def\n  by vcg\n\n  \n  \nlemma mk_free_invalid: \"MK_FREE (invalid_assn R) (\\<lambda>_. return ())\"\n  apply rule unfolding invalid_assn_def\n  by vcg\n\nlemma mk_free_pair: \n  assumes \"MK_FREE R\\<^sub>1 f\\<^sub>1\" \n  assumes \"MK_FREE R\\<^sub>2 f\\<^sub>2\"  \n  shows \"MK_FREE (R\\<^sub>1\\<times>\\<^sub>aR\\<^sub>2) (\\<lambda>(c\\<^sub>1,c\\<^sub>2). doM {f\\<^sub>1 c\\<^sub>1; f\\<^sub>2 c\\<^sub>2})\"\n  supply [vcg_rules] = assms[THEN MK_FREED]\n  apply (rule)\n  by vcg\n  \n  \n\n  \nlemma hnr_bind:\n  assumes D1: \"hn_refine \\<Gamma> m' \\<Gamma>1 Rh m\"\n  assumes D2: \n    \"\\<And>x x'. RETURN x \\<le> m \\<Longrightarrow> hn_refine (hn_ctxt Rh x x' ** \\<Gamma>1) (f' x') (\\<Gamma>2 x x') R (f x)\"\n  assumes IMP: \"\\<And>x x'. \\<Gamma>2 x x' \\<turnstile> hn_ctxt Rx x x' ** \\<Gamma>'\"\n  assumes MKF: \"MK_FREE Rx fr\"\n  shows \"hn_refine \\<Gamma> (doM {x\\<leftarrow>m'; r \\<leftarrow> f' x; fr x; return r}) \\<Gamma>' R (m\\<bind>f)\"\n  apply rule\n  supply [vcg_rules] = D1[THEN hn_refineD]\n  supply [simp] = pw_bind_nofail\n  apply vcg\nproof goal_cases\n  case C: (1 F r s x)\n  hence \"nofail (f x)\" by (simp add: refine_pw_simps pw_le_iff)\n  \n  note [vcg_rules] = D2[unfolded hn_ctxt_def, OF \\<open>RETURN x \\<le> m\\<close>, THEN hn_refineD, OF \\<open>nofail (f x)\\<close>, of r]\n  \n  note [vcg_rules] = MKF[THEN MK_FREED]\n  \n  \n  have [fri_red_rules]: \"is_sep_red (\\<Gamma>') \\<box> (\\<Gamma>2 x x') (Rx x x')\" for x x'\n    using IMP\n    apply (auto simp: is_sep_red_def hn_ctxt_def)\n  proof -\n    fix Ps :: \"llvm_amemory \\<Rightarrow> bool\" and Qs :: \"llvm_amemory \\<Rightarrow> bool\"\n    assume \"\\<Gamma>' \\<and>* Ps \\<turnstile> Qs\"\n    then have f1: \"Ps \\<and>* \\<Gamma>' \\<turnstile> Qs\"\n      by (simp add: sep.mult_commute)\n    have \"\\<Gamma>2 x x' \\<turnstile> \\<Gamma>' \\<and>* Rx x x'\"\n      by (metis (no_types) IMP hn_ctxt_def sep.mult_commute)\n    then have \"Ps \\<and>* \\<Gamma>2 x x' \\<turnstile> Qs \\<and>* Rx x x'\"\n      using f1 by (simp add: conj_entails_mono entails_mp)\n    then show \"\\<Gamma>2 x x' \\<and>* Ps \\<turnstile> Rx x x' \\<and>* Qs\"\n      by (simp add: sep.mult_commute)\n  qed\n  \n  note [simp] = refine_pw_simps pw_le_iff\n  show ?case using C by vcg\nqed  \n\ntext \\<open>Version fro manual synthesis, if freeing of bound variable has been inserted manually\\<close>\nlemma hnr_bind_manual_free:\n  assumes D1: \"hn_refine \\<Gamma> m' \\<Gamma>1 Rh m\"\n  assumes D2: \n    \"\\<And>x x'. RETURN x \\<le> m \\<Longrightarrow> hn_refine (hn_ctxt Rh x x' ** \\<Gamma>1) (f' x') (\\<Gamma>') R (f x)\"\n  shows \"hn_refine \\<Gamma> (m'\\<bind>f') \\<Gamma>' R (m\\<bind>f)\"\n  apply rule\n  supply [vcg_rules] = D1[THEN hn_refineD]\n  supply [simp] = pw_bind_nofail\n  apply vcg\nproof goal_cases\n  case C: (1 F r s x)\n  hence \"nofail (f x)\" by (simp add: refine_pw_simps pw_le_iff)\n  \n  note [vcg_rules] = D2[unfolded hn_ctxt_def, OF \\<open>RETURN x \\<le> m\\<close>, THEN hn_refineD, OF \\<open>nofail (f x)\\<close>, of r]\n  \n  note [simp] = refine_pw_simps pw_le_iff\n  show ?case using C by vcg\nqed  \n\n\n\n\n\nsubsubsection \\<open>Recursion\\<close>\n\ndefinition \"hn_rel P m \\<equiv> \\<lambda>r. EXS x. \\<up>(RETURN x \\<le> m) ** P x r\"\n\nlemma hn_refine_alt: \"hn_refine Fpre c Fpost P m \\<equiv> nofail m \\<longrightarrow>\n  llvm_htriple Fpre c (\\<lambda>r. hn_rel P m r ** Fpost)\"\n  apply (rule eq_reflection)\n  unfolding hn_refine_def hn_rel_def\n  by (auto simp: sep_conj_commute)\n\n\nterm \"Monad.REC  \"\nfind_theorems \"Monad.REC\"\n  \nlemma hnr_RECT:\n  assumes S: \"\\<And>cf af ax px. \\<lbrakk>\n    \\<And>ax px. hn_refine (hn_ctxt Rx ax px ** F) (cf px) (F' ax px) Ry (af ax)\\<rbrakk> \n    \\<Longrightarrow> hn_refine (hn_ctxt Rx ax px ** F) (cB cf px) (F' ax px) Ry (aB af ax)\"\n  assumes M: \"(\\<And>x. M.mono_body (\\<lambda>f. cB f x))\"\n  shows \"hn_refine \n    (hn_ctxt Rx ax px ** F) (Monad.REC cB px) (F' ax px) Ry (RECT aB ax)\"\n  unfolding RECT_def Monad.REC_def\nproof (simp, intro conjI impI)\n  assume \"trimono aB\"\n  hence \"flatf_mono_ge aB\" by (simp add: trimonoD)\n  have \"\\<forall>ax px. \n    hn_refine (hn_ctxt Rx ax px ** F) (M.fixp_fun cB px) (F' ax px) Ry \n      (flatf_gfp aB ax)\"\n      \n    apply (rule flatf_ord.fixp_induct[OF _ \\<open>flatf_mono_ge aB\\<close>])  \n\n    apply (rule flatf_admissible_pointwise)\n    apply simp\n\n    apply (auto simp: hn_refine_alt) []\n\n    apply clarsimp\n    apply (subst M.mono_body_fixp[of cB, OF M])\n    apply (rule S)\n    apply blast\n    done\n  thus \"hn_refine (hn_ctxt Rx ax px ** F) (M.fixp_fun cB px) (F' ax px) Ry (flatf_gfp aB ax)\" \n    by simp\nqed\n\nsubsubsection \\<open>Merging\\<close>\n\ndefinition \"MERGE \\<Gamma>1 f1 \\<Gamma>2 f2 \\<Gamma>' \\<equiv> llvm_htriple \\<Gamma>1 f1 (\\<lambda>_. \\<Gamma>') \\<and> llvm_htriple \\<Gamma>2 f2 (\\<lambda>_. \\<Gamma>')\"\n\nlemma MERGED: \n  assumes \"MERGE \\<Gamma>1 f1 \\<Gamma>2 f2 \\<Gamma>'\"\n  shows \"llvm_htriple \\<Gamma>1 f1 (\\<lambda>_. \\<Gamma>')\" \"llvm_htriple \\<Gamma>2 f2 (\\<lambda>_. \\<Gamma>')\"\n  using assms by (auto simp: MERGE_def)\n\nlemma MERGEI[intro?]: \n  assumes \"llvm_htriple \\<Gamma>1 f1 (\\<lambda>_. \\<Gamma>')\" \"llvm_htriple \\<Gamma>2 f2 (\\<lambda>_. \\<Gamma>')\"\n  shows \"MERGE \\<Gamma>1 f1 \\<Gamma>2 f2 \\<Gamma>'\"\n  using assms by (auto simp: MERGE_def)\n\ndefinition \"MERGE1 R1 f1 R2 f2 R' \\<equiv> \\<forall> a c. MERGE (R1 a c) (f1 c) (R2 a c) (f2 c) (R' a c)\"\n\nlemma MERGE1I[intro?]: \n  assumes \"\\<And>a c. llvm_htriple (R1 a c) (f1 c) (\\<lambda>_. R' a c)\" \n      and \"\\<And>a c. llvm_htriple (R2 a c) (f2 c) (\\<lambda>_. R' a c)\"\n  shows \"MERGE1 R1 f1 R2 f2 R'\"\n  using assms by (auto simp: MERGE1_def MERGE_def)\n\nlemma MERGE1D: \n  assumes \"MERGE1 R1 f1 R2 f2 R'\"\n  shows \"\\<And>a c. llvm_htriple (R1 a c) (f1 c) (\\<lambda>_. R' a c)\" \n    and \"\\<And>a c. llvm_htriple (R2 a c) (f2 c) (\\<lambda>_. R' a c)\"\n  using assms by (auto simp: MERGE1_def MERGE_def)\n  \nlemma MERGE_STAR:\n  assumes \"MERGE1 R1 f1 R2 f2 R'\" \"MERGE \\<Gamma>1 fs1 \\<Gamma>2 fs2 \\<Gamma>'\" \n  shows \"MERGE (hn_ctxt R1 a c ** \\<Gamma>1) (doM {f1 c;fs1}) (hn_ctxt R2 a c ** \\<Gamma>2) (doM {f2 c;fs2}) (hn_ctxt R' a c ** \\<Gamma>')\"\nproof -\n  note [vcg_rules] = MERGE1D[OF assms(1)] MERGED[OF assms(2)]\n\n  show ?thesis unfolding hn_ctxt_def by rule vcg\nqed  \n\nlemma MERGE_triv: \"MERGE \\<Gamma> (return ()) \\<Gamma> (return ()) \\<Gamma>\"\n  apply (rule) unfolding FRI_END_def by vcg\n\nlemma MERGE_END: \"MERGE FRI_END (return ()) FRI_END (return ()) \\<box>\"\n  apply (rule) unfolding FRI_END_def by vcg\n\nlemma MERGE1_eq: \"MERGE1 P (\\<lambda>_. return ()) P (\\<lambda>_. return ()) P\"  \n  by rule vcg\n  \nlemma MERGE1_invalids: \n  assumes \"MK_FREE R f\"  \n  shows \"MERGE1 (invalid_assn R) (\\<lambda>_. return ()) R f (invalid_assn R)\" (is ?left)\n    and \"MERGE1 R f (invalid_assn R) (\\<lambda>_. return ()) (invalid_assn R)\" (is ?right)\nproof -\n  note [vcg_rules] = MK_FREED[OF assms]\n\n  show ?left\n    apply rule\n    apply vcg []\n    apply (subst invalidate_clone[of R])\n    unfolding invalid_assn_def\n    by vcg\n    \n  show ?right\n    apply rule\n    apply (subst invalidate_clone[of R])\n    unfolding invalid_assn_def\n    by vcg\n    \nqed  \n  \n\nsubsection \\<open>ML-Level Utilities\\<close>\nML \\<open>\n  signature SEPREF_BASIC = sig\n    (* Destroy lambda term, return function to reconstruct. Bound var is replaced by free. *)\n    val dest_lambda_rc: Proof.context -> term -> ((term * (term -> term)) * Proof.context)\n    (* Apply function under lambda. Bound var is replaced by free. *)\n    val apply_under_lambda: (Proof.context -> term -> term) -> Proof.context -> term -> term\n\n    (* 'a nres type *)\n    val is_nresT: typ -> bool\n    val mk_nresT: typ -> typ\n    val dest_nresT: typ -> typ\n\n    (* Make certified == *)\n    val mk_cequals: cterm * cterm -> cterm\n    (* Make \\<Longrightarrow>\\<^sub>A *)\n    val mk_entails: term * term -> term\n\n\n    (* Operations on pre-terms *)\n    val constrain_type_pre: typ -> term -> term (* t::T *)\n\n    val mk_pair_in_pre: term -> term -> term -> term (* (c,a) \\<in> R *)\n\n    val mk_compN_pre: int -> term -> term -> term  (* f o...o g*)\n\n    val mk_curry0_pre: term -> term                (* curry0 f *) \n    val mk_curry_pre: term -> term                 (* curry f *) \n    val mk_curryN_pre: int -> term -> term         (* curry (...(curry f)...) *) \n\n    val mk_uncurry0_pre: term -> term              (* uncurry0 f *)       \n    val mk_uncurry_pre: term -> term               (* uncurry f *)\n    val mk_uncurryN_pre: int -> term -> term       (* uncurry (...(uncurry f)...) *)\n\n\n\n    (* Conversion for hn_refine - term*)\n    val hn_refine_conv: conv -> conv -> conv -> conv -> conv -> conv\n\n    (* Conversion on abstract value (last argument) of hn_refine - term *)\n    val hn_refine_conv_a: conv -> conv\n\n    (* Conversion on abstract value of hn_refine term in conclusion of theorem *)\n    val hn_refine_concl_conv_a: (Proof.context -> conv) -> Proof.context -> conv\n\n    (* Destruct hn_refine term *)\n    val dest_hn_refine: term -> term * term * term * term * term \n    (* Make hn_refine term *)\n    val mk_hn_refine: term * term * term * term * term -> term\n    (* Check if given term is Trueprop (hn_refine ...). Use with CONCL_COND'. *)\n    val is_hn_refine_concl: term -> bool\n\n    (* Destruct abs-fun, returns RETURN-flag, (f, args) *)\n    val dest_hnr_absfun: term -> bool * (term * term list)\n    (* Make abs-fun. *)\n    val mk_hnr_absfun: bool * (term * term list) -> term\n    (* Make abs-fun. Guess RETURN-flag from type. *)\n    val mk_hnr_absfun': (term * term list) -> term\n    \n    (* Prove permutation of *. To be used with f_tac_conv. *)\n    val star_permute_tac: Proof.context -> tactic\n\n    (* Make separation conjunction *)\n    val mk_star: term * term -> term\n    (* Make separation conjunction from list. \"[]\" yields \"\\<box>\". *)\n    val list_star: term list -> term\n    (* Decompose separation conjunction. \"\\<box>\" yields \"[]\". *)\n    val strip_star: term -> term list\n\n    (* Check if true-assertion *)\n    val is_true: term -> bool\n\n    (* Check if term is hn_ctxt-assertion *)\n    val is_hn_ctxt: term -> bool \n    (* Decompose hn_ctxt-assertion *)\n    val dest_hn_ctxt: term -> term * term * term\n    (* Decompose hn_ctxt-assertion, NONE if term has wrong format *)\n    val dest_hn_ctxt_opt: term -> (term * term * term) option\n      \n\n    type phases_ctrl = {\n      trace: bool,            (* Trace phases *)\n      trace_goals: bool,      (* Trace intermediate goal states *)\n      int_res: bool,          (* Stop with intermediate result *)\n      start: string option,   (* Start with this phase. NONE: First phase *)\n      stop: string option     (* Stop after this phase. NONE: Last phase *)\n    }\n\n    (* No tracing or intermediate result, all phases *)\n    val dflt_phases_ctrl: phases_ctrl \n    (* Tracing, intermediate result, all phases *)\n    val dbg_phases_ctrl: phases_ctrl\n    (* Tracing, goal-tracing, intermediate result, all phases *)\n    val full_dbg_phases_ctrl: phases_ctrl\n    \n    val cfg_trace_phase_goals: bool Config.T\n    val flag_phases_ctrl: Proof.context -> bool -> phases_ctrl\n\n    (* Name, tactic, expected number of created goals (may be negative for solved goals) *)\n    type phase = string * (Proof.context -> tactic') * int\n\n    (* Perform sequence of tactics (tac,n), each expected to create n new goals, \n       or solve goals if n is negative. \n       Debug-flag: Stop with intermediate state after tactic \n       fails or produces less/more goals as expected. *)   \n    val PHASES': phase list -> phases_ctrl -> Proof.context -> tactic'\n\n  end\n\n  structure Sepref_Basic: SEPREF_BASIC = struct\n\n    fun is_nresT (Type (@{type_name nres},[_])) = true | is_nresT _ = false\n    fun mk_nresT T = Type(@{type_name nres},[T])\n    fun dest_nresT (Type (@{type_name nres},[T])) = T | dest_nresT T = raise TYPE(\"dest_nresT\",[T],[])\n\n\n    fun dest_lambda_rc ctxt (Abs (x,T,t)) = let\n        val (u,ctxt) = yield_singleton Variable.variant_fixes x ctxt\n        val u = Free (u,T)\n        val t = subst_bound (u,t)\n        val reconstruct = Term.lambda_name (x,u)\n      in\n        ((t,reconstruct),ctxt)\n      end\n    | dest_lambda_rc _ t = raise TERM(\"dest_lambda_rc\",[t])\n\n    fun apply_under_lambda f ctxt t = let\n      val ((t,rc),ctxt) = dest_lambda_rc ctxt t\n      val t = f ctxt t\n    in\n      rc t\n    end\n\n\n    (* Functions on pre-terms *)\n    fun mk_pair_in_pre x y r = Const (@{const_name Set.member}, dummyT) $\n      (Const (@{const_name Product_Type.Pair}, dummyT) $ x $ y) $ r\n\n\n    fun mk_uncurry_pre t = Const(@{const_name uncurry}, dummyT)$t\n    fun mk_uncurry0_pre t = Const(@{const_name uncurry0}, dummyT)$t\n    fun mk_uncurryN_pre 0 = mk_uncurry0_pre\n      | mk_uncurryN_pre 1 = I\n      | mk_uncurryN_pre n = mk_uncurry_pre o mk_uncurryN_pre (n-1)\n\n    fun mk_curry_pre t = Const(@{const_name curry}, dummyT)$t\n    fun mk_curry0_pre t = Const(@{const_name curry0}, dummyT)$t\n    fun mk_curryN_pre 0 = mk_curry0_pre\n      | mk_curryN_pre 1 = I\n      | mk_curryN_pre n = mk_curry_pre o mk_curryN_pre (n-1)\n\n\n    fun mk_compN_pre 0 f g = f $ g\n      | mk_compN_pre n f g = let\n          val g = fold (fn i => fn t => t$Bound i) (n-2 downto 0) g\n          val t = Const(@{const_name \"Fun.comp\"},dummyT) $ f $ g\n\n          val t = fold (fn i => fn t => Abs (\"x\"^string_of_int i,dummyT,t)) (n-1 downto 1) t\n        in\n          t\n        end\n\n    fun constrain_type_pre T t = Const(@{syntax_const \"_type_constraint_\"},T-->T) $ t\n\n\n\n\n    local open Conv in\n      fun hn_refine_conv c1 c2 c3 c4 c5 ct = case Thm.term_of ct of\n        @{mpat \"hn_refine _ _ _ _ _\"} => let\n          val cc = combination_conv\n        in\n          cc (cc (cc (cc (cc all_conv c1) c2) c3) c4) c5 ct\n        end\n      | _ => raise CTERM (\"hn_refine_conv\",[ct])\n  \n      val hn_refine_conv_a = hn_refine_conv all_conv all_conv all_conv all_conv\n  \n      fun hn_refine_concl_conv_a conv ctxt = Refine_Util.HOL_concl_conv \n        (fn ctxt => hn_refine_conv_a (conv ctxt)) ctxt\n  \n    end\n\n    (* FIXME: Strange dependency! *)\n    val mk_cequals = uncurry SMT_Util.mk_cequals\n  \n    val mk_entails = HOLogic.mk_binrel @{const_name \"entails\"}\n  \n    val mk_star = HOLogic.mk_binop @{const_name \"sep_conj\"}\n\n    fun list_star [] = @{term \"\\<box>::assn\"}\n      | list_star [a] = a\n      | list_star (a::l) = mk_star (a,list_star l)\n\n    fun strip_star @{mpat \"?a**?b\"} = strip_star a @ strip_star b\n      | strip_star @{mpat \"\\<box>\"} = []\n      | strip_star t = [t]\n\n    fun is_true @{mpat \"sep_true\"} = true | is_true _ = false\n  \n    fun is_hn_ctxt @{mpat \"hn_ctxt _ _ _\"} = true | is_hn_ctxt _ = false\n    fun dest_hn_ctxt @{mpat \"hn_ctxt ?R ?a ?p\"} = (R,a,p) \n      | dest_hn_ctxt t = raise TERM(\"dest_hn_ctxt\",[t])\n  \n    fun dest_hn_ctxt_opt @{mpat \"hn_ctxt ?R ?a ?p\"} = SOME (R,a,p) \n      | dest_hn_ctxt_opt _ = NONE\n  \n    fun strip_abs_args (t as @{mpat \"PR_CONST _\"}) = (t,[])\n      | strip_abs_args @{mpat \"?f$?a\"} = (case strip_abs_args f of (f,args) => (f,args@[a]))\n      | strip_abs_args t = (t,[])\n  \n    fun dest_hnr_absfun @{mpat \"RETURN$?a\"} = (true, strip_abs_args a)\n      | dest_hnr_absfun f = (false, strip_abs_args f)\n  \n    fun mk_hnr_absfun (true,fa) = Autoref_Tagging.list_APP fa |> (fn a => @{mk_term \"RETURN$?a\"})\n      | mk_hnr_absfun (false,fa) = Autoref_Tagging.list_APP fa\n  \n    fun mk_hnr_absfun' fa = let\n      val t = Autoref_Tagging.list_APP fa\n      val T = fastype_of t\n    in\n      case T of\n        Type (@{type_name nres},_) => t\n      | _ => @{mk_term \"RETURN$?t\"}\n  \n    end  \n  \n    fun dest_hn_refine @{mpat \"hn_refine ?P ?c ?Q ?R ?a\"} = (P,c,Q,R,a)\n      | dest_hn_refine t = raise TERM(\"dest_hn_refine\",[t])\n  \n    fun mk_hn_refine (P,c,Q,R,a) = @{mk_term \"hn_refine ?P ?c ?Q ?R ?a\"}\n  \n    val is_hn_refine_concl = can (HOLogic.dest_Trueprop #> dest_hn_refine)\n  \n    fun star_permute_tac ctxt = ALLGOALS (\n      VCG_Lib.simp_only_tac @{thms sep_conj_empty sep_conj_empty' sep_conj_ac} ctxt)\n      \n\n    type phases_ctrl = {\n      trace: bool,            \n      trace_goals: bool,\n      int_res: bool,          \n      start: string option,   \n      stop: string option     \n    }\n\n    val dflt_phases_ctrl = {trace=false,trace_goals=false,int_res=false,start=NONE,stop=NONE} \n    val dbg_phases_ctrl = {trace=true,trace_goals=false,int_res=true,start=NONE,stop=NONE}\n    val full_dbg_phases_ctrl = {trace=true,trace_goals=true,int_res=true,start=NONE,stop=NONE}\n    \n    val cfg_trace_phase_goals = Attrib.setup_config_bool @{binding sepref_trace_phase_goals} (K false)\n    \n    fun flag_phases_ctrl ctxt dbg =\n      case (Config.get ctxt cfg_trace_phase_goals, dbg) of\n        (_, false) => dflt_phases_ctrl\n      | (false, true) => dbg_phases_ctrl\n      | (true,true) => full_dbg_phases_ctrl\n\n    type phase = string * (Proof.context -> tactic') * int\n\n    local\n      fun ph_range phases start stop = let\n        fun find_phase name = let\n          val i = find_index (fn (n,_,_) => n=name) phases\n          val _ = if i<0 then error (\"No such phase: \" ^ name) else ()\n        in\n          i\n        end\n\n        val i = case start of NONE => 0 | SOME n => find_phase n\n        val j = case stop of NONE => length phases - 1 | SOME n => find_phase n\n\n        val phases = take (j+1) phases |> drop i\n\n        val _ = case phases of [] => error \"No phases selected, range is empty\" | _ => ()\n      in\n        phases\n      end\n    in  \n  \n      fun PHASES' phases ctrl ctxt = let\n        val phases = ph_range phases (#start ctrl) (#stop ctrl)\n        val phases = map (fn (n,tac,d) => (n,tac ctxt,d)) phases\n  \n        fun r [] _ st = Seq.single st\n          | r ((name,tac,d)::tacs) i st = let\n              val n = Thm.nprems_of st\n              val bailout_tac = if #int_res ctrl then all_tac else no_tac\n              fun trace_tac msg st = (if #trace ctrl then tracing msg else (); Seq.single st)\n              \n              val trace_goal_tac = if #trace_goals ctrl then print_tac ctxt \"Proof state\" else all_tac\n              \n              val trace_start_tac = trace_tac (\"Phase \" ^ name)\n            in\n              K trace_goal_tac THEN' K trace_start_tac THEN' IF_EXGOAL (tac)\n              THEN_ELSE' (\n                fn i => fn st => \n                  (* Bail out if a phase does not solve/create exactly the expected subgoals *)\n                  if Thm.nprems_of st = n+d then\n                    ((trace_tac \"  Done\" THEN r tacs i) st)\n                  else\n                    (trace_tac \"*** Wrong number of produced goals\" THEN bailout_tac) st\n                \n              , \n                K (trace_tac \"*** Phase tactic failed\" THEN bailout_tac))\n            end i st\n  \n      in\n        r phases\n      end\n\n\n    end\n\n  end\n\n\n  signature SEPREF_DEBUGGING = sig\n    (*************************)\n    (* Debugging *)\n    (* Centralized debugging mode flag *)\n    val cfg_debug_all: bool Config.T\n\n    val is_debug: bool Config.T -> Proof.context -> bool\n    val is_debug': Proof.context -> bool\n\n    (* Conversion, trace errors if custom or central debugging flag is activated *)\n    val DBG_CONVERSION: bool Config.T -> Proof.context -> conv -> tactic'\n\n    (* Conversion, trace errors if central debugging flag is activated *)\n    val DBG_CONVERSION': Proof.context -> conv -> tactic'\n\n    (* Tracing message and current subgoal *)\n    val tracing_tac': string -> Proof.context -> tactic'\n    (* Warning message and current subgoal *)\n    val warning_tac': string -> Proof.context -> tactic'\n    (* Error message and current subgoal *)\n    val error_tac': string -> Proof.context -> tactic'\n\n    (* Trace debug message *)\n    val dbg_trace_msg: bool Config.T -> Proof.context -> string -> unit\n    val dbg_trace_msg': Proof.context -> string -> unit\n    \n    val dbg_trace: bool Config.T -> Proof.context -> (Proof.context -> string) -> unit\n    val dbg_trace': Proof.context -> (Proof.context -> string) -> unit\n\n    val dbg_msg_tac: bool Config.T -> (Proof.context -> int -> thm -> string) -> Proof.context -> tactic'\n    val dbg_msg_tac': (Proof.context -> int -> thm -> string) -> Proof.context -> tactic'\n\n    val msg_text: string -> Proof.context -> int -> thm -> string\n    val msg_subgoal: string -> Proof.context -> int -> thm -> string\n    val msg_from_subgoal: string -> (term -> Proof.context -> string) -> Proof.context -> int -> thm -> string\n    val msg_allgoals: string -> Proof.context -> int -> thm -> string\n\n  end\n\n  structure Sepref_Debugging: SEPREF_DEBUGGING = struct\n\n    val cfg_debug_all = \n      Attrib.setup_config_bool @{binding sepref_debug_all} (K false)\n\n    fun is_debug cfg ctxt = Config.get ctxt cfg orelse Config.get ctxt cfg_debug_all\n    fun is_debug' ctxt = Config.get ctxt cfg_debug_all\n\n    fun dbg_trace cfg ctxt obj = \n      if is_debug cfg ctxt then  \n        tracing ((obj ctxt))\n      else ()\n\n    fun dbg_trace' ctxt obj = \n      if is_debug' ctxt then  \n        tracing ((obj ctxt))\n      else ()\n\n    fun dbg_trace_msg cfg ctxt msg =   \n      if is_debug cfg ctxt then  \n        tracing msg\n      else ()\n    fun dbg_trace_msg' ctxt msg = \n      if is_debug' ctxt then  \n        tracing msg\n      else ()\n\n    fun DBG_CONVERSION cfg ctxt cv i st = \n      Seq.single (Conv.gconv_rule cv i st)\n      handle e as THM _   => (dbg_trace cfg ctxt (K (@{make_string} e)); Seq.empty)\n           | e as CTERM _ => (dbg_trace cfg ctxt (K (@{make_string} e)); Seq.empty)\n           | e as TERM _  => (dbg_trace cfg ctxt (K (@{make_string} e)); Seq.empty)\n           | e as TYPE _  => (dbg_trace cfg ctxt (K (@{make_string} e)); Seq.empty);\n\n    fun DBG_CONVERSION' ctxt cv i st = \n      Seq.single (Conv.gconv_rule cv i st)\n      handle e as THM _   => (dbg_trace' ctxt (K (@{make_string} e)); Seq.empty)\n           | e as CTERM _ => (dbg_trace' ctxt (K (@{make_string} e)); Seq.empty)\n           | e as TERM _  => (dbg_trace' ctxt (K (@{make_string} e)); Seq.empty)\n           | e as TYPE _  => (dbg_trace' ctxt (K (@{make_string} e)); Seq.empty);\n\n\n    local \n      fun gen_subgoal_msg_tac do_msg msg ctxt = IF_EXGOAL (fn i => fn st => let\n        val t = nth (Thm.prems_of st) (i-1)\n        val _ = Pretty.block [Pretty.str msg, Pretty.fbrk, Syntax.pretty_term ctxt t]\n          |> Pretty.string_of |> do_msg\n\n      in\n        Seq.single st\n      end)\n    in       \n      val tracing_tac' = gen_subgoal_msg_tac tracing\n      val warning_tac' = gen_subgoal_msg_tac warning\n      val error_tac' = gen_subgoal_msg_tac error\n    end\n\n\n    fun dbg_msg_tac cfg msg ctxt =\n      if is_debug cfg ctxt then (fn i => fn st => (tracing (msg ctxt i st); Seq.single st))\n      else K all_tac\n    fun dbg_msg_tac' msg ctxt =\n      if is_debug' ctxt then (fn i => fn st => (tracing (msg ctxt i st); Seq.single st))\n      else K all_tac\n\n    fun msg_text msg _ _ _ = msg\n\n    fun msg_from_subgoal msg sgmsg ctxt i st = \n      case try (nth (Thm.prems_of st)) (i-1) of\n        NONE => msg ^ \"\\n\" ^ \"Subgoal out of range\"\n      | SOME t => msg ^ \"\\n\" ^ sgmsg t ctxt\n\n    fun msg_subgoal msg = msg_from_subgoal msg (fn t => fn ctxt =>\n      Syntax.pretty_term ctxt t |> Pretty.string_of\n    )\n\n    fun msg_allgoals msg ctxt _ st = \n      msg ^ \"\\n\" ^ Pretty.string_of (Pretty.chunks (Goal_Display.pretty_goals ctxt st))\n\n  end\n\\<close>\n\n\nML \\<open>\n  (* Tactics for produced subgoals *)\n  infix 1 THEN_NEXT THEN_ALL_NEW_LIST THEN_ALL_NEW_LIST'\n  signature STACTICAL = sig\n    (* Apply first tactic on this subgoal, and then second tactic on next subgoal *)\n    val THEN_NEXT: tactic' * tactic' -> tactic'\n    (* Apply tactics to the current and following subgoals *)\n    val APPLY_LIST: tactic' list -> tactic'\n    (* Apply list of tactics on subgoals emerging from tactic. \n      Requires exactly one tactic per emerging subgoal.*)\n    val THEN_ALL_NEW_LIST: tactic' * tactic' list -> tactic'\n    (* Apply list of tactics to subgoals emerging from tactic, use fallback for additional subgoals. *)\n    val THEN_ALL_NEW_LIST': tactic' * (tactic' list * tactic') -> tactic'\n\n  end\n\n  structure STactical : STACTICAL = struct\n    infix 1 THEN_WITH_GOALDIFF\n    fun (tac1 THEN_WITH_GOALDIFF tac2) st = let\n      val n1 = Thm.nprems_of st\n    in\n      st |> (tac1 THEN (fn st => tac2 (Thm.nprems_of st - n1) st ))\n    end\n\n    fun (tac1 THEN_NEXT tac2) i = \n      tac1 i THEN_WITH_GOALDIFF (fn d => (\n        if d < ~1 then \n          (error \"THEN_NEXT: Tactic solved more than one goal\"; no_tac) \n        else \n          tac2 (i+1+d)\n      ))\n\n    fun APPLY_LIST [] = K all_tac\n      | APPLY_LIST (tac::tacs) = tac THEN_NEXT APPLY_LIST tacs\n            \n    fun (tac1 THEN_ALL_NEW_LIST tacs) i = \n      tac1 i \n      THEN_WITH_GOALDIFF (fn d =>\n        if d+1 <> length tacs then (\n          error \"THEN_ALL_NEW_LIST: Tactic produced wrong number of goals\"; no_tac\n        ) else APPLY_LIST tacs i\n      )\n\n    fun (tac1 THEN_ALL_NEW_LIST' (tacs,rtac)) i =  \n      tac1 i \n      THEN_WITH_GOALDIFF (fn d => let\n        val _ = if d+1 < length tacs then error \"THEN_ALL_NEW_LIST': Tactic produced too few goals\" else ();\n        val tacs' = tacs @ replicate (d + 1 - length tacs) rtac\n      in    \n        APPLY_LIST tacs' i\n      end)\n\n\n  end\n\n\n  open STactical\n\\<close>\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/sepref/Sepref_Basic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.585101139733739, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.30853349882981757}}
{"text": "(*  Title:      HOL/Auth/Guard/Guard_Public.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2002  University of Cambridge\n\nLemmas on guarded messages for public protocols.\n*)\n\ntheory Guard_Public imports Guard \"../Public\" Extensions begin\n\nsubsection\\<open>Extensions to Theory \\<open>Public\\<close>\\<close>\n\ndeclare initState.simps [simp del]\n\nsubsubsection\\<open>signature\\<close>\n\ndefinition sign :: \"agent => msg => msg\" where\n\"sign A X == \\<lbrace>Agent A, X, Crypt (priK A) (Hash X)\\<rbrace>\"\n\nlemma sign_inj [iff]: \"(sign A X = sign A' X') = (A=A' & X=X')\"\nby (auto simp: sign_def)\n\nsubsubsection\\<open>agent associated to a key\\<close>\n\ndefinition agt :: \"key => agent\" where\n\"agt K == SOME A. K = priK A | K = pubK A\"\n\nlemma agt_priK [simp]: \"agt (priK A) = A\"\nby (simp add: agt_def)\n\nlemma agt_pubK [simp]: \"agt (pubK A) = A\"\nby (simp add: agt_def)\n\nsubsubsection\\<open>basic facts about \\<^term>\\<open>initState\\<close>\\<close>\n\nlemma no_Crypt_in_parts_init [simp]: \"Crypt K X \\<notin> parts (initState A)\"\nby (cases A, auto simp: initState.simps)\n\nlemma no_Crypt_in_analz_init [simp]: \"Crypt K X \\<notin> analz (initState A)\"\nby auto\n\nlemma no_priK_in_analz_init [simp]: \"A \\<notin> bad\n\\<Longrightarrow> Key (priK A) \\<notin> analz (initState Spy)\"\nby (auto simp: initState.simps)\n\nlemma priK_notin_initState_Friend [simp]: \"A \\<noteq> Friend C\n\\<Longrightarrow> Key (priK A) \\<notin> parts (initState (Friend C))\"\nby (auto simp: initState.simps)\n\nlemma keyset_init [iff]: \"keyset (initState A)\"\nby (cases A, auto simp: keyset_def initState.simps)\n\nsubsubsection\\<open>sets of private keys\\<close>\n\ndefinition priK_set :: \"key set => bool\" where\n\"priK_set Ks \\<equiv> \\<forall>K. K \\<in> Ks \\<longrightarrow> (\\<exists>A. K = priK A)\"\n\nlemma in_priK_set: \"[| priK_set Ks; K \\<in> Ks |] ==> \\<exists>A. K = priK A\"\nby (simp add: priK_set_def)\n\nlemma priK_set1 [iff]: \"priK_set {priK A}\"\nby (simp add: priK_set_def)\n\nlemma priK_set2 [iff]: \"priK_set {priK A, priK B}\"\nby (simp add: priK_set_def)\n\nsubsubsection\\<open>sets of good keys\\<close>\n\ndefinition good :: \"key set => bool\" where\n\"good Ks == \\<forall>K. K \\<in> Ks \\<longrightarrow> agt K \\<notin> bad\"\n\nlemma in_good: \"[| good Ks; K \\<in> Ks |] ==> agt K \\<notin> bad\"\nby (simp add: good_def)\n\nlemma good1 [simp]: \"A \\<notin> bad \\<Longrightarrow> good {priK A}\"\nby (simp add: good_def)\n\nlemma good2 [simp]: \"[| A \\<notin> bad; B \\<notin> bad |] ==> good {priK A, priK B}\"\nby (simp add: good_def)\n\nsubsubsection\\<open>greatest nonce used in a trace, 0 if there is no nonce\\<close>\n\nprimrec greatest :: \"event list => nat\"\nwhere\n  \"greatest [] = 0\"\n| \"greatest (ev # evs) = max (greatest_msg (msg ev)) (greatest evs)\"\n\nlemma greatest_is_greatest: \"Nonce n \\<in> used evs \\<Longrightarrow> n \\<le> greatest evs\"\napply (induct evs, auto simp: initState.simps)\napply (drule used_sub_parts_used, safe)\napply (drule greatest_msg_is_greatest, arith)\nby simp\n\nsubsubsection\\<open>function giving a new nonce\\<close>\n\ndefinition new :: \"event list \\<Rightarrow> nat\" where\n\"new evs \\<equiv> Suc (greatest evs)\"\n\nlemma new_isnt_used [iff]: \"Nonce (new evs) \\<notin> used evs\"\nby (clarify, drule greatest_is_greatest, auto simp: new_def)\n\nsubsection\\<open>Proofs About Guarded Messages\\<close>\n\nsubsubsection\\<open>small hack necessary because priK is defined as the inverse of pubK\\<close>\n\nlemma pubK_is_invKey_priK: \"pubK A = invKey (priK A)\"\nby simp\n\nlemmas pubK_is_invKey_priK_substI = pubK_is_invKey_priK [THEN ssubst]\n\nlemmas invKey_invKey_substI = invKey [THEN ssubst]\n\nlemma \"Nonce n \\<in> parts {X} \\<Longrightarrow> Crypt (pubK A) X \\<in> guard n {priK A}\"\napply (rule pubK_is_invKey_priK_substI, rule invKey_invKey_substI)\nby (rule Guard_Nonce, simp+)\n\nsubsubsection\\<open>guardedness results\\<close>\n\nlemma sign_guard [intro]: \"X \\<in> guard n Ks \\<Longrightarrow> sign A X \\<in> guard n Ks\"\nby (auto simp: sign_def)\n\nlemma Guard_init [iff]: \"Guard n Ks (initState B)\"\nby (induct B, auto simp: Guard_def initState.simps)\n\nlemma Guard_knows_max': \"Guard n Ks (knows_max' C evs)\n==> Guard n Ks (knows_max C evs)\"\nby (simp add: knows_max_def)\n\nlemma Nonce_not_used_Guard_spies [dest]: \"Nonce n \\<notin> used evs\n\\<Longrightarrow> Guard n Ks (spies evs)\"\nby (auto simp: Guard_def dest: not_used_not_known parts_sub)\n\nlemma Nonce_not_used_Guard [dest]: \"[| evs \\<in> p; Nonce n \\<notin> used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_used parts_trans)\n\nlemma Nonce_not_used_Guard_max [dest]: \"[| evs \\<in> p; Nonce n \\<notin> used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max (Friend C) evs)\"\nby (auto simp: Guard_def dest: known_max_used parts_trans)\n\nlemma Nonce_not_used_Guard_max' [dest]: \"[| evs \\<in> p; Nonce n \\<notin> used evs;\nGets_correct p; one_step p |] ==> Guard n Ks (knows_max' (Friend C) evs)\"\napply (rule_tac H=\"knows_max (Friend C) evs\" in Guard_mono)\nby (auto simp: knows_max_def)\n\nsubsubsection\\<open>regular protocols\\<close>\n\ndefinition regular :: \"event list set \\<Rightarrow> bool\" where\n\"regular p \\<equiv> \\<forall>evs A. evs \\<in> p \\<longrightarrow> (Key (priK A) \\<in> parts (spies evs)) = (A \\<in> bad)\"\n\nlemma priK_parts_iff_bad [simp]: \"[| evs \\<in> p; regular p |] ==>\n(Key (priK A) \\<in> parts (spies evs)) = (A \\<in> bad)\"\nby (auto simp: regular_def)\n\nlemma priK_analz_iff_bad [simp]: \"[| evs \\<in> p; regular p |] ==>\n(Key (priK A) \\<in> analz (spies evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Guard_Nonce_analz: \"[| Guard n Ks (spies evs); evs \\<in> p;\npriK_set Ks; good Ks; regular p |] ==> Nonce n \\<notin> analz (spies evs)\"\napply (clarify, simp only: knows_decomp)\napply (drule Guard_invKey_keyset, simp+, safe)\napply (drule in_good, simp)\napply (drule in_priK_set, simp+, clarify)\napply (frule_tac A=A in priK_analz_iff_bad)\nby (simp add: knows_decomp)+\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Auth/Guard/Guard_Public.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802735722128, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.3083650294678023}}
{"text": "theory RingBuffer_BD_latest_2\nimports Main HOL.List\nbegin \n\n\n(*\n      W_step_side                           R_step_side\n\nLOCAL preserves inv    (done)         LOCAL preserves inv    (done)\n\nLOCAL shows preW       (done)         LOCAL shows preR       (done) \n\nGLOBAL preserves preR  (done)         GLOBAL preserves preW  (done)  \n*)\n\n\ndatatype PCW =\n  A1 | A2 | A3 | A4 | A5 | A6 | A7 | A8\n| Enqueue | idleW | OOM | FinishedW |  Write | BTS\n\ndatatype PCR =\n Release | idleR | Read\n\ndatatype F = W | R | Q | B | D | None\ndatatype Pointer = Head | Tail\nconsts N :: nat   (*size of buffer, input*)\nconsts n :: nat   (*number of Arr\\<^sub>W entries*)\n\ndefinition \"F1_set={W,B,Q,R}\"\ndefinition \"W_pre_acquire_set={A1,A2,A3,A4,A5,A6,A7,A8,idleW,FinishedW,OOM,BTS}\"\ndefinition \"W_post_acquire_set={Write,Enqueue}\"\ndefinition \"R_pre_dequeue_set={idleR}\"\ndefinition \"R_post_dequeue_set={Read, Release}\"\n\nlemmas sets [simp]= F1_set_def W_pre_acquire_set_def W_post_acquire_set_def\n                              R_pre_dequeue_set_def R_post_dequeue_set_def\n\n(*Recorded variables*)\nrecord rb_state =\n  H :: nat\n  T :: nat\n  hW ::  nat               (*local copy of W*)\n  tW ::  nat               (*local copy of W*)\n  offset :: nat\n  q :: \"(nat \\<times> nat) list\"\n  tempR :: \"(nat \\<times> nat)\"          (*local copy of word by R*)\n\n\n  data_index :: \"(nat \\<times> nat) \\<Rightarrow> nat\"   (*state of the buffer contents*)\n  pcW :: PCW           (*records program counter of W*)\n  pcR :: PCR           (*records program counter of W*)\n  Data:: \"nat  \\<Rightarrow> nat\"     (*returns a word Data_i*)\n\n  tR :: nat\n  numReads :: nat     (* how many words the reader has read *)\n  numWrites :: nat    (* how many words the writer has written *)\n  numEnqs :: nat  (* how many words from Data the writer has enqueued  *)\n  numDeqs :: nat  (* how many words from Data the reader has retrieved *)\n  ownT ::  F\n  ownD :: \"nat \\<Rightarrow> F\" (* ownership of Data indices *)\n  ownB :: \"nat \\<Rightarrow> F\" (* ownership of bytes in buffer *)\n\n  \n\ndefinition \"con_assms s \\<equiv>   0 < N \\<and> 0<n  \\<and> N>n \\<and> numEnqs s\\<le>n \\<and> (numDeqs s\\<le>numEnqs s)\n                             \\<and> (\\<forall>i.(i<n)\\<longrightarrow>Data s i\\<le>N \\<and> Data s i>0 )\"\n\ndefinition push_H :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`H := _\" [200])\n  where \n  \"push_H v \\<equiv> \\<lambda>s. s \\<lparr>H := v\\<rparr>\"\ndefinition push_T :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`T := _\" [200])\n  where \n  \"push_T v \\<equiv> \\<lambda>s. s \\<lparr>T := v\\<rparr>\"\ndefinition write_data_index :: \"nat \\<times> nat \\<Rightarrow> nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`B.write _ := _\" [200])  where\n  \"write_data_index a v  \\<equiv>  \n      \\<lambda>s. s \\<lparr> data_index  := \\<lambda> x. if  a = x  then v else data_index s x \\<rparr>\"  \ndefinition change_writes :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`numWrites := _\" [200])\n  where \n  \"change_writes v \\<equiv> \\<lambda>s. s \\<lparr>numWrites := v\\<rparr>\"\ndefinition change_reads :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`numReads := _\" [200])\n  where \n  \"change_reads v \\<equiv> \\<lambda>s. s \\<lparr>numReads := v\\<rparr>\"\ndefinition push_offset :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`offset := _\" [200])\n  where \n  \"push_offset v \\<equiv> \\<lambda>s. s \\<lparr>offset := v\\<rparr>\"\n\n\ndefinition trans_ownT :: \"F \\<Rightarrow> F \\<Rightarrow> rb_state \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"transownT [_ _ _]\" [200]) where\n  \"trans_ownT a b s \\<equiv> if ownT s = a then (\\<lambda>s. s \\<lparr> ownT := b \\<rparr>)\n                                    else (\\<lambda>s. s \\<lparr> ownT := ownT s\\<rparr>)\"\n\ndefinition transfer_ownB :: \"F \\<Rightarrow> F \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"transownB [_ _]\" [200]) where\n  \"transfer_ownB a b \\<equiv> (\\<lambda>s. s \\<lparr> ownB := \\<lambda> i. if (ownB s i = a)\\<and>i\\<le>N then b else (ownB s) i\\<rparr>)\"\n\ndefinition set_ownB :: \"nat\\<times>nat\\<Rightarrow> F \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"setownB [_ _]\" [200]) where\n  \"set_ownB x a \\<equiv> (\\<lambda>s. s \\<lparr> ownB := \\<lambda> i. if ((i\\<ge>fst(x)) \\<and> (i<snd(x))) then a else (ownB s) i\\<rparr>)\"\n\ndefinition transfer_ownD :: \"nat\\<Rightarrow> F \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"transownD [_ _]\" [200]) where\n  \"transfer_ownD x a \\<equiv> (\\<lambda>s. s \\<lparr> ownD := \\<lambda> i. if i=x then a else (ownD s) i\\<rparr>)\"\n\n\n\n\n(*-----------------------*)\n\ndefinition set_hW :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`hW := _\" [200])  where\n  \"set_hW v  \\<equiv> \\<lambda>s. s \\<lparr> hW  := v\\<rparr>\"\ndefinition set_tW :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`tW := _\" [200])  where\n  \"set_tW v  \\<equiv> \\<lambda>s. s \\<lparr> tW  := v\\<rparr>\"\ndefinition set_tR :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`tR := _\" [200])  where\n  \"set_tR v  \\<equiv> \\<lambda>s. s \\<lparr> tR  := v\\<rparr>\"\ndefinition set_tempR :: \"(nat \\<times> nat) \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`tempR := _\" [200]) where\n  \"set_tempR v \\<equiv> \\<lambda>s. s \\<lparr> tempR := v\\<rparr>\"\ndefinition update_numEnqs :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`numEnqs := _\" [200]) where\n  \"update_numEnqs v\\<equiv> \\<lambda>s. s \\<lparr> numEnqs := v\\<rparr>\"\ndefinition update_numDeqs :: \"nat \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`numDeqs := _\" [200]) where\n  \"update_numDeqs v\\<equiv> \\<lambda>s. s \\<lparr> numDeqs := v\\<rparr>\"\ndefinition update_pcW :: \"PCW \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`pcW := _\" [200]) where\n  \"update_pcW v \\<equiv> \\<lambda>s. s \\<lparr> pcW := v\\<rparr>\"\ndefinition update_pcR :: \"PCR \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`pcR := _\" [200]) where\n  \"update_pcR v \\<equiv> \\<lambda>s. s \\<lparr> pcR := v\\<rparr>\"\nabbreviation update_b_err :: \"rb_state \\<Rightarrow> rb_state\" (\"ERROOM\") where\n  \"update_b_err \\<equiv> \\<lambda>s. s \\<lparr> pcW := OOM \\<rparr>\"\nabbreviation update_bts_err :: \"rb_state \\<Rightarrow> rb_state\" (\"ERRBTS\") where\n  \"update_bts_err \\<equiv> \\<lambda>s. s \\<lparr> pcW := BTS \\<rparr>\"\ndefinition update_q :: \"(nat \\<times> nat) list \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" (\"`q := _\" [200])\n  where \n  \"update_q v  \\<equiv> \\<lambda>s. s \\<lparr>q := v\\<rparr>\"\nlemmas functs [simp] = push_H_def push_T_def set_hW_def set_tW_def\n                        update_numEnqs_def update_numDeqs_def\n                        set_tempR_def \n                        update_pcW_def update_pcR_def\n                        transfer_ownB_def transfer_ownD_def trans_ownT_def\n                        update_q_def\n                        push_offset_def write_data_index_def\n                        change_writes_def change_reads_def\n                        set_tR_def set_ownB_def\n\n\n\n\n\n(*  Define the if statement \"guards\"  *)\n\ndefinition \"off bo \\<equiv> fst bo\"\ndefinition \"len bo \\<equiv> snd bo\"\ndefinition \"grd1 s \\<equiv> (tW s = hW s) \\<and> (Data s (numEnqs s) \\<le> N)\"\ndefinition \"grd2 s \\<equiv> (tW s > hW s) \\<and> (Data s (numEnqs s) < (tW s - hW s))\"\ndefinition \"grd3 s \\<equiv> tW s < hW s\"\ndefinition \"grd4 s \\<equiv> Data s (numEnqs s) \\<le> N - hW s\"\ndefinition \"grd5 s \\<equiv> Data s (numEnqs s) < tW s\"\ndefinition \"no_space_for_word s \\<equiv> (grd1 s \\<longrightarrow> \\<not>(Data s (numEnqs s) \\<le> N))\\<and>\n                                  (grd2 s \\<longrightarrow> \\<not>(Data s (numEnqs s) < (tW s - hW s)))\\<and>\n                                  (grd3 s \\<longrightarrow> \\<not>(Data s (numEnqs s) \\<le> N - hW s \\<or> Data s (numEnqs s) < tW s))\"\nlemmas grd_simps [simp] = off_def len_def grd1_def grd2_def grd3_def grd4_def grd5_def no_space_for_word_def \n(***********************************************************************)\n\n\n\n\n\n(*  Initial State  *)\n\ndefinition \"init s \\<equiv> (H s = 0) \\<and> (T s = 0) \\<and> (offset s = 0) \\<and> q s = [] \\<and> (hW s = 0) \\<and> (tW s = 0) \\<and> (tR s = 0)\n                        \\<and> numReads s = 0 \\<and> numWrites s = 0 \\<and> (numEnqs s = 0) \\<and> (numDeqs s = 0)\n                        \\<and> ( pcW s = idleW)\n                        \\<and> ( pcR s = idleR)\n                        \\<and> (\\<forall>l. (l<n) \\<longrightarrow>  ((Data s l > 0)\\<and>(Data s l \\<le> N)))\n                        \\<and> (\\<forall>i. (i<n) \\<longrightarrow>  ownD s i = W)\n                        \\<and> (\\<forall>i. (i<N) \\<longrightarrow>  ownB s i = B)\n                        \\<and> (ownB s N = None)\n                        \\<and> (ownT s = Q)\n                        \\<and> (tempR s = (0,0))\n                        \\<and> (\\<forall>i. (i\\<le>N)\\<longrightarrow>(\\<forall>j.(j\\<le>N)\\<longrightarrow>data_index s (i,j) <n))\"\n(***********************************************************************)\n\n\n\ndefinition \"case_1 s  \\<equiv> \\<exists>a b c d. (0\\<le>a \\<and> a\\<le>b \\<and> b\\<le>c \\<and> c\\<le>d \\<and> d\\<le>N \n                                        \\<and>(\\<forall>i.(0\\<le>i \\<and> i<a)\\<longrightarrow>ownB s i = B)\n                                        \\<and>(\\<forall>i.(a\\<le>i \\<and> i<b)\\<longrightarrow>ownB s i = R)\n                                        \\<and>(\\<forall>i.(b\\<le>i \\<and> i<c)\\<longrightarrow>ownB s i = Q)\n                                        \\<and>(\\<forall>i.(c\\<le>i \\<and> i<d)\\<longrightarrow>ownB s i = W)\n                                        \\<and>(\\<forall>i.(d\\<le>i \\<and> i<N)\\<longrightarrow>ownB s i = B)\n                                        \\<and>(ownB s N = None)\n                                \\<comment>\\<open>general case rules\\<close>\n                                      \\<comment>\\<open>rules are simple\\<close>\n                                \\<comment>\\<open>describe T using ownB\\<close>\n                                  \\<and>(T s = a)\n                                \\<comment>\\<open>describe H using ownB\\<close>\n                                  \\<and>(H s = d)\n                                \\<comment>\\<open>describe W view (tempW) using ownB\\<close>\n                                  \\<and>(d>c\\<longrightarrow>offset s=c)\n                                  \\<and>(d>c\\<longrightarrow>Data s (numEnqs s)=d-c)\n                                \\<comment>\\<open>describe R view (tempR) using ownB\\<close>\n                                  \\<and>(b>a\\<longrightarrow>fst(tempR s)=a)\n                                  \\<and>(b>a\\<longrightarrow>snd(tempR s)=b-a)\n                                \\<comment>\\<open>describe Q view (hd(Q), last(Q)) using ownB\\<close>\n                                  \\<and>(c>b\\<longleftrightarrow>length(q s)>0)\n                                  \\<and>(c>b\\<longrightarrow>fst(hd(q s)) =b)\n                                  \\<and>(c>b\\<longrightarrow>fst(last(q s))+snd(last(q s)) =c)\n                                \\<comment>\\<open>describe ownT using ownB\\<close>\n                                  \\<and>(ownT s = R\\<longrightarrow>b>a)\n                                  \\<and>((b=a\\<and>c>b)\\<longrightarrow>ownT s = Q)\n                                  \\<and>((b=a\\<and>c=b)\\<longrightarrow>ownT s \\<in> {Q,W})\n                                  \\<and> (ownT s=W\\<longrightarrow>((c=0\\<and>d>0)\\<or>(H s=T s)))\n)\"\n\n\nlemma can_a_equal_d:\n  assumes \"\\<forall>i.(i<N)\\<longrightarrow>ownB s i=B\"\n  and \"ownT s=Q\"\n  and \"H s=k\"\n  and \"T s=k\"\n  and \"k<N\"  \n  and \"q s=[]\"\n  and \"ownB s N=None\"\n  shows \"case_1 s\"\n  using assms apply (simp add:case_1_def)\n  apply (rule_tac exI [where x =\"k\"])\n  apply (rule_tac exI [where x =\"k\"])\n  apply simp\n  apply (rule_tac exI [where x =\"k\"])\n  by simp\n\n\n\ndefinition \"case_2 s  \\<equiv> \\<exists>a b c d e f. (0\\<le>a \\<and> a\\<le>b \\<and> b\\<le>c \\<and> c<d \\<and> d\\<le>e \\<and> e\\<le>f \\<and> f\\<le>N\n                                        \\<and>(\\<forall>i.(0\\<le>i \\<and> i<a)\\<longrightarrow>ownB s i = R)\n                                        \\<and>(\\<forall>i.(a\\<le>i \\<and> i<b)\\<longrightarrow>ownB s i = Q)\n                                        \\<and>(\\<forall>i.(b\\<le>i \\<and> i<c)\\<longrightarrow>ownB s i = W)\n                                        \\<and>(\\<forall>i.(c\\<le>i \\<and> i<d)\\<longrightarrow>ownB s i = B)\n                                        \\<and>(\\<forall>i.(d\\<le>i \\<and> i<e)\\<longrightarrow>ownB s i = R)\n                                        \\<and>(\\<forall>i.(e\\<le>i \\<and> i<f)\\<longrightarrow>ownB s i = Q)\n                                        \\<and>(\\<forall>i.(f\\<le>i \\<and> i<N)\\<longrightarrow>ownB s i = D)\n                                        \\<and>(ownB s N = None)\n                                \\<comment>\\<open>general case rules\\<close>\n                                  \\<and>(a>0\\<longrightarrow>e=d)                  \\<comment>\\<open>only 1 continuous read\\<close>  \n                                  \\<and>(e>d\\<longrightarrow>a=0)                  \\<comment>\\<open>only 1 continuous read\\<close>  \n                                  \\<and>(f>e\\<longrightarrow>a=0)                  \\<comment>\\<open>only 1 continuous queue\\<close> \n                                  \\<and>(c>0)                  \\<comment>\\<open>create the overlap, any way possible\\<close> \n                                \\<comment>\\<open>describe T using ownB\\<close>\n                                  \\<and>(T s = d)\n                                \\<comment>\\<open>describe H using ownB\\<close>\n                                  \\<and>(H s = c)\n                                \\<comment>\\<open>describe W view (tempW) using ownB\\<close>\n                                  \\<and>(c>b\\<longrightarrow>offset s = b)\n                                  \\<and>(c>b\\<longrightarrow>Data s (numEnqs s) = c-b)\n                                \\<comment>\\<open>describe R view (tempR) using ownB\\<close>\n                                  \\<and>(a>0\\<longrightarrow>fst(tempR s)=0) \n                                  \\<and>(a>0\\<longrightarrow>snd(tempR s)=a)  \n                                  \\<and>(e>d\\<longrightarrow>fst(tempR s)=d) \n                                  \\<and>(e>d\\<longrightarrow>snd(tempR s)=e-d)  \n                                \\<comment>\\<open>describe Q view (hd(Q), last(Q)) using ownB\\<close>\n                                  \\<and>((f>e\\<or>b>a)\\<longleftrightarrow>length(q s)>0)\n                                  \\<and>(f>e\\<longrightarrow>fst(hd(q s)) =e)\n                                  \\<and>((f=e\\<and>b>a)\\<longrightarrow>fst(hd(q s)) =a)\n                                  \\<and>(b>a\\<longrightarrow>fst(last(q s))+snd(last(q s)) =b)\n                                  \\<and>((b=a\\<and>f>e)\\<longrightarrow>fst(last(q s))+snd(last(q s)) =f)\n                                \\<comment>\\<open>describe ownT using ownB\\<close>\n                                  \\<and>(ownT s = R\\<longrightarrow>(a>0\\<or>e>d))\n                                  \\<and>((a=0\\<and>e=d)\\<longrightarrow>ownT s = Q)\n                                  \\<and>(ownT s\\<noteq>W)\n)\"\n\n\n\nlemma natural:\n  assumes \"a\\<in>{0,3,4}\"\n  shows \"a\\<in>\\<nat>\"\n  using assms apply simp\n  by auto\n\n\n\nlemma case_split:\n  shows \"H s\\<ge>T s\\<Longrightarrow> (case_1 s \\<or> case_2 s) \\<Longrightarrow> case_1 s\"\n  apply (simp add:case_1_def case_2_def) apply clarify\n  by linarith\n\n\nlemma case_split_2:\n  shows \"H s\\<ge>T s\\<Longrightarrow> (case_1 s \\<or> case_2 s) \\<Longrightarrow>\\<not> case_2 s\"\n  by (simp add:case_1_def case_2_def) \n\nlemma case_split_3:\n  shows \"H s<T s\\<Longrightarrow> (case_1 s \\<or> case_2 s) \\<Longrightarrow> case_2 s\"\n  apply (simp add:case_1_def case_2_def) apply clarify\n  by linarith\n\n\nlemma case_split_4:\n  shows \"H s<T s\\<Longrightarrow> (case_1 s \\<or> case_2 s) \\<Longrightarrow>\\<not> case_1 s\"\n  by (simp add:case_1_def case_2_def)\n\n\nlemma case_split_5:\n  shows \"(case_1 s \\<and> case_2 s) \\<Longrightarrow>False\"\n  apply (simp add:case_1_def case_2_def) \n  apply clarify\n  apply (case_tac \"H s\\<ge>T s\") \n  apply(subgoal_tac \"case_1 s\") prefer 2 \n  apply (metis leD)\n  apply (metis case_split_4)\n  apply(subgoal_tac \"T s>H s\") prefer 2\n  apply blast\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply (metis le_trans)\n  using case_split_2 [where s=s] \n  by (metis le_trans)\n\n\n\n\n(*\ndeclare [[show_types]]\n*)\n\n\n\n\n(*   State of the queue   *)\n(*   What Q should look like   *)\n\ndefinition  \"end x \\<equiv> fst x + snd x\"\n\nlemmas end_simp [simp] = end_def \n\ndefinition \"Q_boundness s \\<equiv> (\\<forall>x. (x \\<in> set (q s)) \\<longrightarrow> end x \\<le> N)\" \n\ndefinition \"Q_offsets_differ s \\<equiv> (\\<forall>i j.(i<length(q s)\\<and> j<length(q s)\\<and> i\\<noteq>j)\\<longrightarrow>(fst(q s!i)\\<noteq>fst(q s!j)))\"\n\ndefinition \"Q_gap_structure s   \\<equiv> \n          (\\<forall>i. (i < length(q s) \\<and> i > 0) \\<longrightarrow>((end(q s!(i-1)) = fst(q s!i))\\<or> (fst(q s!i) =0)))\"\n\ndefinition \"Q_has_no_uroboros s \\<equiv>\n(\\<forall>x. x \\<in> set (q s)\\<longrightarrow> fst x \\<noteq> end (last (q s)))\"\n\ndefinition \"Q_has_no_overlaps s \\<equiv>\n(\\<forall> x y. (x \\<in> set (q s) \\<and> y \\<in> set (q s)) \\<longrightarrow> (fst(x) < fst(y) \\<longrightarrow> end x \\<le> fst y))\"\n\ndefinition \"Q_elem_size s       \\<equiv> \\<forall>x.(x\\<in>set(q s))\\<longrightarrow>snd(x)>0\"\n\ndefinition \"Q_basic_struct s \\<equiv> Q_boundness s \\<and> Q_gap_structure s \\<and> Q_offsets_differ s\n                              \\<and> Q_has_no_overlaps s \\<and> Q_has_no_uroboros s \\<and> Q_elem_size s\"\n\n\nlemmas Q_basic_lemmas = Q_basic_struct_def  Q_has_no_overlaps_def \n                        Q_gap_structure_def Q_has_no_uroboros_def\n                        Q_boundness_def     Q_offsets_differ_def\n                        Q_elem_size_def\n\nlemma proof_no_overlaps:\n  assumes \"Q_gap_structure s\"\n  and \"Q_offsets_differ s\"\n  and \"\\<forall>i.(i<length(q s))\\<longrightarrow> snd(q s!i)>0\"\n  and \"length(q s)>1\"\n  and \"Q_has_no_overlaps s\"\nshows \"\\<forall>x y.(x\\<in>set(q s)\\<and>y\\<in>set(q s)\\<and>length(q s)>1\\<and>fst(x)\\<noteq>fst(y))\\<longrightarrow>\n  (\\<forall>j.(fst(x)\\<le>j \\<and> j<end(x))\\<longrightarrow>(j<fst(y)\\<or>j\\<ge>end(y)))\"\n  using assms apply (simp add:Q_basic_lemmas) \n  apply safe \n  by (smt (verit, best) bot_nat_0.not_eq_extremum diff_is_0_eq le_trans linorder_neqE_nat zero_less_diff)\n\nlemma tail_preserves_Q_boundness:\n  assumes \"Q_boundness s\"\n  and \"tl(q s)\\<noteq>[]\"\nshows \"(\\<forall>x. (x \\<in> set (tl(q s))) \\<longrightarrow> end x \\<le> N)\"\n  using assms  apply (simp add:Q_boundness_def)\n  by (simp add: list.set_sel(2) tl_Nil)\n\nlemma tail_preserves_Q_offsets_differ:\n  assumes \"Q_offsets_differ s\"\n  and \"tl(q s)\\<noteq>[]\"\nshows \"(\\<forall>i j.(i<length(tl(q s))\\<and> j<length(tl(q s))\\<and> i\\<noteq>j)\\<longrightarrow>(fst((tl(q s))!i)\\<noteq>fst((tl(q s))!j)))\"\n  using assms  apply (simp add:Q_offsets_differ_def) \n  by (simp add: Nitpick.size_list_simp(2) nth_tl tl_Nil)\n\nlemma tail_preserves_Q_gap_structure:\n  assumes \"Q_gap_structure s\"\n  and \"tl(q s)\\<noteq>[]\"\nshows \"(\\<forall>i. (i < length(tl(q s)) \\<and> i > 0) \\<longrightarrow>((end((tl(q s))!(i-1)) = fst((tl(q s))!i))\\<or> (fst((tl(q s))!i) =0)))\"\n  using assms  apply (simp add:Q_gap_structure_def) \n  by (smt (verit) One_nat_def Suc_pred add_diff_cancel_left' length_tl less_Suc_eq less_diff_conv not_less_eq nth_tl plus_1_eq_Suc)\n\nlemma tail_preserves_Q_has_no_uroboros:\n  assumes \"Q_has_no_uroboros s\"\n  and \"tl(q s)\\<noteq>[]\"\nshows \"(\\<forall>x. x \\<in> set (tl(q s)) \\<longrightarrow> fst x \\<noteq> end (last (tl(q s))))\"\n  using assms  apply (simp add:Q_has_no_uroboros_def)\n  by (metis last_tl list.sel(2) list.set_sel(2))\n\nlemma tail_preserves_Q_has_no_overlaps:\n  assumes \"Q_has_no_overlaps s\"\n  and \"tl(q s)\\<noteq>[]\"\nshows \"(\\<forall> x y. (fst(x) < fst(y) \\<and> x \\<in> set (tl(q s)) \\<and> y \\<in> set (tl(q s))) \\<longrightarrow> (end x \\<le> fst y))\"\n  using assms  apply (simp add:Q_has_no_overlaps_def) \n  by (metis list.sel(2) list.set_sel(2))\n\nlemma tail_preserves_Q_basic_struct:\n  assumes \"Q_basic_struct s\"\n  and \"tl(q s)\\<noteq>[]\"\nshows \"(\\<forall>x. (x \\<in> set (tl(q s))) \\<longrightarrow> end x \\<le> N) \\<and> \n       (\\<forall>i j.(i<length(tl(q s))\\<and> j<length(tl(q s))\\<and> i\\<noteq>j)\\<longrightarrow>(fst((tl(q s))!i)\\<noteq>fst((tl(q s))!j))) \\<and>\n       (\\<forall>i. (i < length(tl(q s)) \\<and> i > 0) \\<longrightarrow>((end((tl(q s))!(i-1)) = fst((tl(q s))!i))\\<or> (fst((tl(q s))!i) =0)))\\<and>\n       (\\<forall>x. x \\<in> set (tl(q s)) \\<longrightarrow> fst x \\<noteq> end (last (tl(q s)))) \\<and>\n       (\\<forall> x y. (fst(x) < fst(y) \\<and> x \\<in> set (tl(q s)) \\<and> y \\<in> set (tl(q s))) \\<longrightarrow> (end x \\<le> fst y))\"\n  using assms  apply (simp add:Q_basic_lemmas)\n  apply(intro conjI impI)\n  apply (metis list.sel(2) list.set_sel(2))\n  using tail_preserves_Q_offsets_differ apply (metis One_nat_def Q_basic_struct_def assms(1) length_tl)\n  using tail_preserves_Q_gap_structure apply (metis One_nat_def Q_basic_struct_def assms(1) end_simp length_tl)\n  using tail_preserves_Q_has_no_uroboros apply (metis Q_basic_struct_def assms(1) end_simp old.prod.inject prod.collapse)\n  by (metis list.sel(2) list.set_sel(2))\n\n\n\n\n\n\n\n\n\n\n\n(*\n(*have the idea of \"can fit between T-N or not\"*)\ndefinition \"T_is_outside_Q s    \\<equiv> (\\<forall>i.(i<length(q s) \\<and> q s\\<noteq>[])\\<longrightarrow>(end(q s!i)<T s))\"\n\ndefinition \"tempR_describes_T s \\<equiv> ((fst(tempR s) =0) \\<longrightarrow> (T s=0 \\<or> T_is_outside_Q s))\n                                 \\<and>((fst(tempR s) >0) \\<longrightarrow> (T s=fst(tempR s)))\"\n\ndefinition \"Q_describes_T s     \\<equiv> ((fst(hd(q s)) =0) \\<longrightarrow> (T s=0 \\<or> T_is_outside_Q s))\n                                 \\<and>((fst(hd(q s)) >0) \\<longrightarrow> (T s=fst(hd(q s))))\"\n*)\n\n\n(*have the idea of \"can we describe ownB s i=R\"*)\n(*\ndefinition \"R_owns_no_bytes s   \\<equiv> (\\<forall>i.(i\\<ge>0)\\<longrightarrow>ownB s i\\<noteq>R)\"\n\ndefinition \"tempR_describes_ownB s \\<equiv> (\\<forall>i.(i<fst(tempR s))\\<longrightarrow>ownB s i\\<noteq>R)\n                                    \\<and>(\\<forall>i.(i\\<ge>end(tempR s))\\<longrightarrow>ownB s i\\<noteq>R)\n                                    \\<and>(\\<forall>i.(fst(tempR s)\\<le>i \\<and> i<end(tempR s))\\<longrightarrow>ownB s i=R)\"\n*)\n\n\n\n\n\n\ndefinition \"tempR_bounded s     \\<equiv> end(tempR s)\\<le>N\"\ndefinition \"Q_no_overlap_tempR s\\<equiv> (\\<forall>x. (x \\<in> set (q s))\\<longrightarrow>\n                  ((fst(tempR s)<fst(x)\\<and>end(tempR s)\\<le> fst(x))\n                  \\<or>(fst(x)<fst(tempR s)\\<and>end(x)<fst(tempR s))))\"\ndefinition \"Q_relates_tempR s   \\<equiv> (end(tempR s) = fst(hd (q s))) \\<or> (fst(hd(q s)) = 0)\"\nlemmas tmepR_extra_lemmas [simp] = tempR_bounded_def Q_no_overlap_tempR_def Q_relates_tempR_def\n\n\n(*   Relating Q to other variables   *)\n(*\ndefinition \"Q_bytes s     \\<equiv> {i  . \\<exists> k l. (k, l) \\<in> set(q s) \\<and> k \\<le> i \\<and> i < k+l}\"\n\ndefinition \"Q_bytes_inv s \\<equiv> \\<forall> i. i \\<in> Q_bytes s \\<longleftrightarrow>  ownB s i = Q\"\n\n*)\n\n\n\n  \n\n\n\n\ndefinition \"Q_holds_bytes s     \\<equiv> q s\\<noteq>[]\\<longrightarrow>(\\<forall>i.(i\\<in>set(q s))\\<longrightarrow>(\\<forall>j.(fst(i)\\<le>j \\<and> j<end(i))\\<longrightarrow>ownB s j=Q))\"\n\ndefinition \"Q_reflects_writes s \\<equiv> (\\<forall>i.(i<length(q s))\\<longrightarrow>data_index s (q s!i) = ((numDeqs s) +i))\"\n\ndefinition \"Q_elem_rel s        \\<equiv> (\\<forall>i.(i<length(q s))\\<longrightarrow>snd(q s!i) =Data s ((numDeqs s) +i))\"\n\ndefinition \"Q_reflects_ownD s   \\<equiv> (\\<forall>i.(i<length(q s))\\<longrightarrow>ownD s (i+(numDeqs s)) =B)\"\n\n\n\n\n\nlemma tail_preserves_Q_holds_bytes:\n  assumes \"Q_holds_bytes s\"\n  and \"(tl(q s))\\<noteq>[]\"\nshows \"(tl(q s))\\<noteq>[]\\<longrightarrow>(\\<forall>i.(i\\<in>set(tl(q s)))\\<longrightarrow>(\\<forall>j.(fst(i)\\<le>j \\<and> j<end(i))\\<longrightarrow>ownB s j=Q))\"\n  using assms  apply (simp add:Q_holds_bytes_def)\n  by (metis list.sel(2) list.set_sel(2))\n\nlemma tail_preserves_Q_reflects_writes:\n  assumes \"Q_reflects_writes s\"\n  and \"(tl(q s))\\<noteq>[]\"\nshows \"(\\<forall>i.(i<length(tl(q s)))\\<longrightarrow>data_index s ((tl(q s))!i) = ((numDeqs s) +i +1))\"\n  using assms  apply (simp add:Q_reflects_writes_def)\n  by (simp add: nth_tl)\n\nlemma tail_preserves_Q_elem_size:\n  assumes \"Q_elem_rel s\"\n  and \"(tl(q s))\\<noteq>[]\"\nshows \"(\\<forall>i.(i<length(tl(q s)))\\<longrightarrow>snd((tl(q s))!i) =Data s ((numDeqs s) +i +1))\"\n  using assms  apply (simp add:Q_elem_size_def)\n  by (simp add: Q_elem_rel_def nth_tl)\n\nlemma tail_preserves_Q_reflects_ownD:\n  assumes \"Q_reflects_ownD s\"\n  and \"(tl(q s))\\<noteq>[]\"\nshows \"(\\<forall>i.(i<length(tl(q s)))\\<longrightarrow>ownD s (i+(numDeqs s) +1) =B)\"\n  using assms  apply (simp add:Q_reflects_ownD_def) \n  by (metis One_nat_def Suc_eq_plus1 add.assoc less_diff_conv plus_1_eq_Suc)\n\nlemma Q_offsets_imply_tail_offsets:\n  assumes \"Q_offsets_differ s\"\n  shows \"(\\<forall>i j.(i<length(tl(q s))\\<and> j<length(tl(q s))\\<and> i\\<noteq>j)\\<longrightarrow>(fst(tl(q s)!i)\\<noteq>fst(tl(q s)!j)))\"\n  using assms apply (simp add:Q_offsets_differ_def)\n  by (metis (no_types, lifting) Nat.lessE One_nat_def Suc_pred length_tl less_Suc_eq_0_disj nth_tl old.nat.inject zero_less_diff)\n\nlemma Q_head_relates_tail:\n  assumes \"Q_offsets_differ s\"\n  shows \"\\<forall>i.(i<length(tl(q s)))\\<longrightarrow>fst(q s!0)\\<noteq> fst(tl(q s)!i)\"\n  using assms apply (simp add:Q_offsets_differ_def)\n  by (metis One_nat_def Suc_pred length_tl less_Suc_eq_0_disj not_less_eq nth_tl zero_less_diff)\n\nlemma Exists_one_implies_exist_no_more:\n  assumes \"Q_offsets_differ s\"\n  and \"Q_gap_structure s\"\nshows \"if \\<exists>j.(fst(q s!j) =0 \\<and> j<length(q s)) then (\\<exists>j.(\\<forall>i.(i<length(q s) \\<and> i\\<noteq>j \\<and> i>0)\\<longrightarrow>(end(q s!(i-1)) =fst(q s!i))))\n  else (\\<forall>i.(i>0 \\<and> i<length(q s))\\<longrightarrow>end(q s!(i-1)) = fst(q s!i))\"\n  using assms apply (simp add:Q_basic_lemmas)\n  apply (case_tac \"\\<exists>j.(fst(q s!j) =0 \\<and> j<length(q s))\", simp_all)\n  apply (metis gr_implies_not0)\n  by (metis less_nat_zero_code)\n  \nlemma Q_hd_zero_implies_structure:\n  assumes \"Q_offsets_differ s\"\n  and \"Q_gap_structure s\"\n  and \"fst(hd(q s)) =0\"\nshows \"\\<forall>i.(i>0 \\<and> i<length(q s))\\<longrightarrow>end(q s!(i-1)) =fst(q s!i)\"\n  using assms apply(simp add:Q_basic_lemmas)\n  by (metis drop0 hd_drop_conv_nth less_Suc_eq_0_disj less_imp_Suc_add not_gr_zero)\n\nlemma data_index_preserved_lemma:\n  assumes \"Q_reflects_writes s\"\n  and \"length(q s)>0\"\n  shows \"data_index s(q s!0) = numDeqs s\"\n  using assms by (simp add:Q_reflects_writes_def)\n\n\ndefinition \"Q_structure s \\<equiv>q s\\<noteq>[]\\<longrightarrow>(Q_basic_struct s \\<and> \n                                      \\<comment> \\<open>Q_holds_bytes s \\<and>\\<close>\n                                      Q_reflects_writes s \\<and> \n                                      Q_elem_rel s \\<and> \n                                      Q_reflects_ownD s)\"\n\n\n \nlemmas Q_lemmas = Q_holds_bytes_def Q_reflects_writes_def Q_reflects_ownD_def\n                  Q_structure_def Q_relates_tempR_def Q_elem_rel_def\n                  Q_elem_size_def Q_no_overlap_tempR_def\n\n\n\nlemma head_q0:\n  assumes \"length(q s)>0\"\n  shows \"hd(q s) = (q s!0)\"\n  using assms apply (simp add:Q_reflects_writes_def)\n  by (simp add: hd_conv_nth)\n\nlemma overlap:\n  assumes \"Q_structure s \\<and> length(q s)>1\"\n  shows \"\\<nexists>k.(\\<forall>i j.(i<length(q s)\\<and> j<length(q s)\\<and> i\\<noteq>j)\\<longrightarrow>(k\\<ge>fst(q s!i)\\<and> k<end(q s!i)\\<and>k\\<ge>fst(q s!j)\\<and>k<end(q s!j)))\"\n  using assms apply simp \n  apply(simp add:Q_lemmas Q_basic_lemmas) \n  apply(elim conjE impE) apply clarify \n  apply simp \n  by (smt One_nat_def Suc_lessD add_diff_cancel_left' le_0_eq le_less_trans less_numeral_extra(1) not_less nth_mem plus_1_eq_Suc prod.collapse)\n\nlemma Q_has_0_elem:\n  assumes \"Q_gap_structure s\"\n  and \"Q_offsets_differ s\"\n  and \"hd(q s) =(0,a)\"\nshows \"fst(hd(q s)) =0\\<longrightarrow>(\\<forall>i.(i<length(q s)\\<and> i>0)\\<longrightarrow>end(q s!(i-1)) =fst(q s!i))\"\n  using assms apply auto\n  apply (simp add:Q_gap_structure_def Q_offsets_differ_def)\n  by (metis gr_implies_not_zero head_q0 not_gr_zero old.prod.inject prod.collapse)\n\n\nlemma Q_gap_lemmas_1:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"last(q s)\\<in>set(q s)\"\n  using assms by (simp add:con_assms_def)\n\nlemma Q_gap_lemmas_2:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>i.(i<length(q s))\\<longrightarrow>(q s!i)\\<in>set(q s)\"\n  using assms by (simp add:con_assms_def)\n\nlemma Q_gap_lemmas_3:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> fst(y)\\<noteq>fst(x))\\<longrightarrow>(fst(x)>fst(y)\\<or>fst(y)>fst(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by linarith\n\n\nlemma Q_gap_lemmas_4:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> fst(y)>fst(x))\\<longrightarrow>end(y)>fst(x)\"\n  using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n\nlemma Q_gap_lemmas_5:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> fst(y)>fst(x))\\<longrightarrow>(fst(y)\\<ge>end(x))\"\n  using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n\nlemma Q_gap_lemmas_6:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> fst(y)>fst(x))\\<longrightarrow>(end(y)>end(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (smt (verit, best) diff_add_inverse diff_is_0_eq le_add1 le_neq_implies_less le_trans length_greater_0_conv list.size(3))\n\nlemma Q_gap_lemmas_7:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> fst(y)\\<ge>end(x))\\<longrightarrow>(end(y)>fst(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis add_leD1 le_neq_implies_less less_add_same_cancel1 trans_less_add1)\n\nlemma Q_gap_lemmas_8:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> fst(y)\\<ge>end(x))\\<longrightarrow>(fst(y)>fst(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis add_leD1 diff_add_0 diff_add_inverse diff_diff_cancel minus_nat.diff_0 nat_less_le)\n\nlemma Q_gap_lemmas_9:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> fst(y)\\<ge>end(x))\\<longrightarrow>(end(y)>end(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis le_eq_less_or_eq less_add_same_cancel1 trans_less_add1)\n\nlemma Q_gap_lemmas_10:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> end(y)>fst(x) \\<and> fst(y)\\<noteq>fst(x))\\<longrightarrow>(fst(y)>fst(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis le_antisym less_or_eq_imp_le nat_neq_iff)\n\nlemma Q_gap_lemmas_11:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> end(y)>fst(x) \\<and> fst(y)\\<noteq>fst(x))\\<longrightarrow>(end(y)>end(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (smt (verit, ccfv_SIG) diff_add_inverse diff_is_0_eq le_antisym le_trans less_or_eq_imp_le nat_neq_iff)\n\n\nlemma Q_gap_lemmas_12:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> end(y)>fst(x) \\<and> fst(y)\\<noteq>fst(x))\\<longrightarrow>(fst(y)\\<ge>end(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis le_antisym less_or_eq_imp_le nat_neq_iff)\n\n\nlemma Q_gap_lemmas_13:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> end(y)>end(x))\\<longrightarrow>(end(y)>fst(x))\"\n  using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n\n\n\nlemma Q_gap_lemmas_14:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> end(y)>end(x) \\<and> fst(y)\\<noteq>fst(x))\\<longrightarrow>(fst(y)\\<ge>end(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis diff_diff_left diff_is_0_eq less_nat_zero_code linorder_neqE_nat zero_less_diff)\n\n\nlemma Q_gap_lemmas_15:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> end(y)>end(x))\\<longrightarrow>(fst(y)\\<noteq>fst(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis fst_conv in_set_conv_nth nat_neq_iff old.prod.inject)\n\nlemma Q_gap_lemmas_16_B:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  and \"x\\<in>set(q s)\" \n  and \"y\\<in>set(q s)\" \n  and \"end(y)>end(x)\"\nshows \"fst(y)\\<ge>end(x)\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n  using Q_gap_lemmas_14 Q_gap_lemmas_15\n  by (metis assms(1) assms(2) end_simp fst_conv snd_conv)\n\n\nlemma Q_gap_lemmas_16:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> end(y)>end(x))\\<longrightarrow>(fst(y)\\<ge>end(x))\"\n  using Q_gap_lemmas_16_B assms by blast\n\n\n\nlemma Q_gap_lemmas_17:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  shows \"\\<forall>x y.(x\\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> end(y)>end(x))\\<longrightarrow>(fst(y)>fst(x))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis Q_gap_lemmas_15 Q_gap_lemmas_10 add_lessD1 assms(1) assms(2) end_simp fst_conv snd_conv)\n\n\n\n\n\nlemma Q_gap_lemmas_1_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j)\\<longrightarrow>(fst(q s!i)>fst(q s!j) \\<or>\n                                                     fst(q s!i)<fst(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n  by (meson nat_neq_iff)\n\n\nlemma Q_gap_lemmas_2_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> fst(q s!i)>fst(q s!j))\\<longrightarrow>\n                            (end(q s!i)>fst(q s!j))\"\n  using assms by (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n\n\nlemma Q_gap_lemmas_3_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> fst(q s!i)>fst(q s!j))\\<longrightarrow>\n                            (end(q s!i)>end(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis Q_gap_lemmas_6 assms(1) end_simp length_pos_if_in_set nth_mem)\n\n\nlemma Q_gap_lemmas_4_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> fst(q s!i)>fst(q s!j))\\<longrightarrow>\n                            (fst(q s!i)\\<ge>end(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis Q_gap_lemmas_2 assms(1) assms(2) prod.collapse)\n\n\n\nlemma Q_gap_lemmas_5_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> fst(q s!i)\\<ge>end(q s!j))\\<longrightarrow>\n                            (fst(q s!i)>fst(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis Q_gap_lemmas_8 assms(1) end_simp length_pos_if_in_set nth_mem)\n\n\n\nlemma Q_gap_lemmas_6_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> fst(q s!i)\\<ge>end(q s!j))\\<longrightarrow>\n                            (end(q s!i)>fst(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis Q_gap_lemmas_7 assms(1) end_simp length_pos_if_in_set nth_mem)\n\n\nlemma Q_gap_lemmas_7_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> fst(q s!i)\\<ge>end(q s!j))\\<longrightarrow>\n                            (end(q s!i)>end(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis le_eq_less_or_eq less_add_same_cancel1 nth_mem surjective_pairing trans_less_add1)\n\n\nlemma Q_gap_lemmas_8_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> end(q s!i)>fst(q s!j) \\<and> i\\<noteq>j)\\<longrightarrow>\n                            (fst(q s!i)>fst(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n  using Q_gap_lemmas_10\n  by (metis assms(1) end_simp length_pos_if_in_set nth_mem)\n\nlemma Q_gap_lemmas_9_list_B:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\n  and \"i<length(q s)\" \n  and \"j<length(q s)\" \n  and \"end(q s!i)>fst(q s!j)\" \n  and \"i\\<noteq>j\"\nshows \"end(q s!i)>end(q s!j)\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas) \n  by (metis Q_gap_lemmas_11 assms(1) end_simp length_pos_if_in_set nth_mem)\n\n\nlemma Q_gap_lemmas_9_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> end(q s!i)>fst(q s!j) \\<and> i\\<noteq>j)\\<longrightarrow>\n                            (end(q s!i)>end(q s!j))\"\n  using assms Q_gap_lemmas_9_list_B by blast\n\n\nlemma Q_gap_lemmas_10_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> end(q s!i)>fst(q s!j) \\<and> i\\<noteq>j)\\<longrightarrow>\n                            (fst(q s!i)\\<ge>end(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  using Q_gap_lemmas_12\n  by (metis assms(1) end_simp length_pos_if_in_set nth_mem)\n\n\n\nlemma Q_gap_lemmas_11_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> end(q s!i)>end(q s!j))\\<longrightarrow>\n                            (end(q s!i)>fst(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  by (metis add_lessD1)\n\n\nlemma Q_gap_lemmas_12_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> end(q s!i)>end(q s!j))\\<longrightarrow>\n                            (fst(q s!i)\\<ge>end(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  using Q_gap_lemmas_16 \n  by (metis Q_gap_lemmas_2 assms(1) assms(2) end_simp)\n\n\nlemma Q_gap_lemmas_13_list:\n  assumes \"Q_structure s\"\n  and \"length(q s) >0\"\nshows \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> end(q s!i)>end(q s!j))\\<longrightarrow>\n                            (fst(q s!i)>fst(q s!j))\"\n  using assms apply (simp add:con_assms_def Q_lemmas Q_basic_lemmas)\n  using Q_gap_lemmas_17\n  by (metis Q_gap_lemmas_2 assms(1) assms(2) end_simp)\n\n\n\n\n  \n\n\n\n(**********)\nlemma ownB_lemma:\n  assumes \"length(q s) =2\"\n  and \"Q_holds_bytes s\"\n  and \"Q_has_no_overlaps s\"\n  and \"Q_offsets_differ s\"\n  and \"s' = (`q:= (tl(q s)) \\<circ> (setownB [(fst(hd(q s)),(end(hd(q s)))) R])) s\"\nshows \"Q_holds_bytes s' \"\n  using assms apply (simp add:Q_lemmas Q_basic_lemmas)\n  apply (intro conjI impI) apply clarify apply safe\n  apply simp\n      apply simp\n     apply auto[1]\n  apply(case_tac \"a<fst(hd(q s))\", simp_all)\n  defer\n  apply(case_tac \"fst(hd(q s))<a\", simp_all)\n\n  apply (smt Suc_1 head_q0 le_less_trans length_greater_0_conv list.set_sel(2) not_less nth_mem plus_1_eq_Suc prod.collapse zero_less_two)\n  apply(case_tac \"fst(hd(q s)) =fst(a,b)\") \n  apply (metis (mono_tags, hide_lams) One_nat_def Suc_1 Suc_leI diff_Suc_1 diff_is_0_eq' hd_conv_nth in_set_conv_nth length_tl lessI list.sel(2) nat.simps(3) nth_tl zero_less_Suc)\n  apply(simp add:fst_def) \n  apply (metis (no_types, lifting) One_nat_def Suc_1 add_diff_cancel_left' in_set_conv_nth length_tl less_one nat_neq_iff nth_tl plus_1_eq_Suc zero_less_two)\n  apply (metis list.sel(2) list.set_sel(2)) \n  by (metis (no_types, lifting) hd_in_set le_add_diff_inverse2 length_0_conv list.set_sel(2) prod.collapse trans_le_add2 verit_comp_simplify1(3) zero_neq_numeral)\n\n(*\nlemma ownB_lemma2:\n  assumes \"Q_holds_bytes s\"\n  and \"Q_structure s\"\n  and \"\\<forall>i.(i<n)\\<longrightarrow>Data s i>0\"\n  and \"q s\\<noteq>[]\"\n  and \"s' = (`q:= (tl(q s)) \\<circ> (setownB [(fst(hd(q s)),(end(hd(q s)))) R]) \\<circ> (`tempR := (hd(q s))) \n          \\<circ> (transownT [Q R s])\n          \\<circ> (`numDeqs :=(numDeqs s+1))) s\"\nshows \"Q_holds_bytes s'\"\n  using assms apply (simp add:Q_lemmas Q_basic_lemmas)\n  apply(elim conjE impE) \n  apply(case_tac \"ownT s=Q\", simp_all)\n   apply(case_tac \"length(q s) =1\", simp_all)\n  apply (metis diff_Suc_1 length_pos_if_in_set length_tl less_numeral_extra(3))\n   apply(case_tac \"length(q s) =2\", simp_all)\n  apply (smt Suc_1 add_diff_cancel_left' fst_conv fst_def hd_conv_nth in_set_conv_nth le_less_trans length_tl less_2_cases_iff less_Suc0 nat_arith.rule0 not_less nth_tl plus_1_eq_Suc prod.collapse)\n  apply clarify apply safe\n  apply(case_tac \"fst(hd(q s)) >a\", simp add:fst_def snd_def)\n  apply (smt fst_def hd_in_set le_imp_less_Suc le_less_trans list.set_sel(2) not_less_eq prod.collapse)\n       defer\n  apply(case_tac \"fst(hd(q s))<a\", simp add:fst_def snd_def)\n  apply (meson list.set_sel(2))\n  apply (meson list.set_sel(2))\n  apply(case_tac \"fst(hd(q s)) =fst(a,b)\", simp add:fst_def snd_def) \n  apply (smt One_nat_def Suc_mono Suc_pred fst_conv fst_def hd_conv_nth in_set_conv_nth length_greater_0_conv length_tl less_antisym not_less_zero nth_tl zero_induct)\n     apply(simp add:fst_def snd_def)\n  apply (smt Suc_leI fst_def hd_in_set le_trans linorder_neqE_nat list.set_sel(2) not_less_eq_eq prod.collapse snd_def)\n  apply(simp add:fst_def snd_def)\n  apply (meson list.set_sel(2))\n  apply (meson list.set_sel(2))\n  apply clarsimp \n  apply (case_tac \"a<fst(hd(q s))\", simp_all add:fst_def snd_def)\n  apply (case_tac \"a>fst(hd(q s))\", simp_all add:fst_def snd_def)\n  apply (smt fst_def hd_in_set le_less_trans list.set_sel(2) not_less prod.collapse snd_def)\n  by (smt One_nat_def Suc_mono Suc_pred fst_conv fst_def hd_conv_nth in_set_conv_nth length_greater_0_conv length_tl less_antisym not_less_zero nth_tl zero_induct)\n  \nlemma Q_type_1:\n  assumes \"q s=[(3,2),(5,2),(0,1)] \\<and> N=10\"\n  shows \"Q_basic_struct s\"\n  using assms apply(simp add:Q_basic_struct_def) \n  apply(intro conjI impI)\n  apply(simp add:Q_boundness_def)\n  apply(simp add:Q_gap_structure_def)\n  using less_Suc_eq apply force\n  apply(simp add:Q_offsets_differ_def)\n  using less_Suc_eq apply fastforce\n  apply(simp add:Q_has_no_overlaps_def)\n  using less_Suc_eq apply force\n  by(simp add:Q_has_no_uroboros_def) \n\nlemma Q_tail_props:\n  shows \"\\<forall>i.(i<length(q s) \\<and> i>0)\\<longrightarrow>(((q s)!i) = (tl(q s)!(i-1)))\"\n  apply simp\n  by (simp add: diff_less_mono nth_tl)\n\nlemma Q_basic_preserved:\n  assumes \"Q_basic_struct s\"\n  and \"s' = (`q:= (tl(q s))) s\"\n  shows \"Q_basic_struct s'\"\n  using assms apply(simp add:Q_basic_struct_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_basic_struct_def Q_boundness_def) \n  apply (metis list.sel(2) list.set_sel(2))\n     apply(simp add:Q_basic_struct_def Q_gap_structure_def)\n    defer\n     apply(simp add:Q_offsets_differ_def)\n  apply (metis One_nat_def Suc_eq_plus1 diff_Suc_1 length_tl less_diff_conv nth_tl)\n    apply(simp add:Q_has_no_overlaps_def)\n    apply (metis list.sel(2) list.set_sel(2))\n  prefer 2 \n   apply (metis One_nat_def assms(1) end_simp length_tl less_nat_zero_code list.size(3) tail_preserves_Q_basic_struct)\n  using assms Q_tail_props apply (simp add:Q_has_no_uroboros_def Q_basic_struct_def)\n  by (smt (z3) assms(1) empty_iff end_simp fst_conv in_set_butlastD list.set(1) tail_preserves_Q_basic_struct)\n(*\nlemma Q_basic_preserved2:\n  assumes \"Q_structure s\"\n  and \"ownT s=Q\"\n  and \"s' =((`q:= (tl(q s)))\n          \\<circ> (`pcR := Read) \n          \\<circ> (`tempR := (hd(q s))) \n          \\<circ> (transownT [Q R s])\n          \\<circ> (`numDeqs :=(numDeqs s+1))\n          \\<circ> (setownB [(fst(hd(q s)),(end(hd(q s)))) R]))  s\"\n  shows \"Q_structure s'\"\n  using assms apply simp\n  apply(simp add:Q_structure_def)                                        \n  apply(intro conjI impI)\n      apply(simp add:Q_basic_struct_def)\n      apply(intro conjI impI)\n  apply(simp add:Q_boundness_def)\n  apply (metis list.sel(2) list.set_sel(2))\n  apply(simp add:Q_gap_structure_def)\n  apply (smt One_nat_def Q_tail_props Suc_diff_le Suc_leI Suc_mono Suc_pred length_greater_0_conv less_SucI list.sel(2))\n  apply(simp add:Q_offsets_differ_def)\n  apply (metis (no_types, lifting) Nitpick.size_list_simp(2) One_nat_def Suc_mono length_tl list.sel(2) nat.inject nth_tl)\n  apply(simp add:Q_has_no_overlaps_def) \n  apply (metis (no_types, lifting) list.sel(2) list.set_sel(2))\n  apply(simp add:Q_has_no_uroboros_def)\n  apply (metis butlast_tl last_tl list.sel(2) list.set_sel(2))\n  using ownB_lemma2 apply (simp add:Q_holds_bytes_def)\n     apply clarify\n  apply safe \n  apply simp_all apply(case_tac \"fst(hd(q s))>a\", simp_all)\n       apply(simp add:Q_lemmas Q_basic_lemmas fst_def snd_def)\n  apply (smt fst_def hd_in_set le_imp_less_Suc le_less_trans list.sel(2) list.set_sel(2) not_less_eq prod.collapse)\n       defer\n  apply(case_tac \"fst(hd(q s))<a\", simp_all)\n  apply (metis list.sel(2) list.set_sel(2))\n  apply (metis list.sel(2) list.set_sel(2))\n     defer defer defer \n  apply(case_tac \"fst(hd(q s)) =fst(a,b)\", simp add:fst_def snd_def Q_lemmas Q_basic_lemmas) \n  apply (smt One_nat_def Suc_mono Suc_pred fst_conv fst_def hd_conv_nth in_set_conv_nth length_greater_0_conv length_tl less_antisym list.sel(2) not_less_zero nth_tl zero_induct)\n  apply(simp add:Q_basic_struct_def Q_has_no_overlaps_def fst_def snd_def)\n  apply clarify\n  apply(simp add:Q_lemmas Q_basic_lemmas fst_def snd_def butlast_def)\n  apply (smt fst_def hd_in_set le_less_trans linorder_neqE_nat list.sel(2) list.set_sel(2) not_less prod.collapse snd_def)\n  (*finally Q_holds_bytes done*)\n  apply(simp add:Q_reflects_writes_def)\n  apply (simp add: nth_tl)\n   apply(simp add:Q_elem_size_def)\n  apply (simp add: nth_tl)\n  apply(simp add:Q_reflects_ownD_def)\n  using less_diff_conv by auto\n  *)\n\n*)\n\n(*tempR used to be part of Q so:.....*)\n\n definition \"tempR_boundness s \\<equiv> (end (tempR s) \\<le> N)\" \n\ndefinition \"tempR_offsets_differ s \\<equiv> (\\<forall>i.(i<length(q s))\\<longrightarrow>(fst(q s!i)\\<noteq>fst(tempR s)))\"\n\ndefinition \"tempR_gap_structure s   \\<equiv> (end(tempR s) = fst(hd(q s)))\\<or> (fst(hd(q s)) =0)\"\n\ndefinition \"tempR_has_no_uroboros s \\<equiv> (fst (tempR s) \\<noteq> end (last (q s)))\"\n\ndefinition \"tempR_has_no_overlaps s \\<equiv>(\\<forall>i.(i<length(q s))\\<longrightarrow>((fst(tempR s)<fst(q s!i)\\<longrightarrow>end(tempR s)\\<le>fst(q s!i))\n                                                           \\<and>(fst(tempR s)>fst(q s!i)\\<longrightarrow>end(q s!i)\\<le>fst(tempR s))))\"\n\ndefinition \"tempR_basic_struct s \\<equiv> tempR_boundness s \\<and> (q s\\<noteq>[]\\<longrightarrow> (tempR_gap_structure s \\<and> tempR_offsets_differ s\n                              \\<and> tempR_has_no_overlaps s \\<and> tempR_has_no_uroboros s)) \"\n\n\nlemmas tempR_basic_lemmas = tempR_basic_struct_def  tempR_has_no_overlaps_def \n                            tempR_gap_structure_def tempR_has_no_uroboros_def\n                            tempR_boundness_def     tempR_offsets_differ_def\n\n\ndefinition \"tempR_holds_bytes s     \\<equiv> (\\<forall>j.(fst(tempR s)\\<le>j \\<and> j<end(tempR s))\\<longrightarrow>ownB s j=R)\"\n\ndefinition \"tempR_reflects_writes s \\<equiv> (data_index s (tempR s) = ((numDeqs s) -1))\"\n\ndefinition \"tempR_elem_size s       \\<equiv> (snd(tempR s) =Data s ((numDeqs s) -1))\"\n\n\ndefinition \"tempR_structure s \\<equiv>(tempR_basic_struct s \\<and> \n                                      tempR_holds_bytes s \\<and> tempR_reflects_writes s \\<and> tempR_elem_size s)\"\n\n\nlemmas tempR_lemmas = tempR_holds_bytes_def tempR_reflects_writes_def \n                      tempR_elem_size_def   tempR_structure_def\n                      \n\n\n(*tempW will be part of Q so:.....*)\ndefinition \"tempW s \\<equiv> (offset s, Data s (numEnqs s))\"\n\n definition \"tempW_boundness s \\<equiv> (end (tempW s) \\<le> N)\" \n\ndefinition \"tempW_offsets_differ s \\<equiv> (\\<forall>i.(i<length(q s))\\<longrightarrow>(fst(q s!i)\\<noteq>fst(tempW s)))\"\n\ndefinition \"tempW_gap_structure s   \\<equiv> (fst(tempW s) = end(last(q s)))\\<or> (fst(tempW s) =0)\"\n\ndefinition \"tempW_has_no_uroboros s \\<equiv> (end((tempW s)) \\<noteq> fst (hd (q s)))\"\n\ndefinition \"tempW_has_no_overlaps s \\<equiv>(\\<forall>i.(i<length(q s))\\<longrightarrow>((fst(tempW s)<fst(q s!i)\\<longrightarrow>end(tempW s)<fst(q s!i))\n                                                           \\<and>(fst(tempW s)>fst(q s!i)\\<longrightarrow>end(q s!i)\\<le>fst(tempW s))))\"\n\ndefinition \"tempW_basic_struct s \\<equiv> tempW_boundness s \\<and> (q s\\<noteq>[]\\<longrightarrow> (tempW_gap_structure s \\<and> tempW_offsets_differ s\n                              \\<and> tempW_has_no_overlaps s \\<and> tempW_has_no_uroboros s))\"\n\n\nlemmas tempW_basic_lemmas = tempW_basic_struct_def  tempW_has_no_overlaps_def \n                            tempW_gap_structure_def tempW_has_no_uroboros_def\n                            tempW_boundness_def     tempW_offsets_differ_def\n                            tempW_def\n\n\ndefinition \"tempW_holds_bytes s     \\<equiv> (\\<forall>j.(fst(tempW s)\\<le>j \\<and> j<end(tempW s))\\<longrightarrow>ownB s j=W)\"\n\ndefinition \"tempW_reflects_writes s \\<equiv> (data_index s (offset s, Data s (numEnqs s)) = numEnqs s)\"\n\ndefinition \"tempW_structure s \\<equiv>(tempW_basic_struct s \\<and> \n                                      tempW_holds_bytes s )\"\n\n\nlemmas tempW_lemmas = tempW_holds_bytes_def tempW_reflects_writes_def \n                      tempW_structure_def\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*Writer Thread Behaviour*)\n\n\nfun rbW_step :: \"PCW \\<Rightarrow> rb_state \\<Rightarrow> rb_state\" where\n  \"rbW_step A1 s = ((`hW := (H s)) \\<circ> (`tW := (T s)) \\<circ> (`pcW := A2)) s \"\n| \"rbW_step A2 s = (if grd1 s then ((`pcW := A3) \\<circ> (transownT [Q W s]))\n                     else if grd2 s then (`pcW := A4) \n                     else if grd3 s then (`pcW := A5) \n                     else (`pcW :=A8)) s\"\n| \"rbW_step A3 s = ((`T := 0) \\<circ> (`H := (Data s (numEnqs s))) \\<circ> (`offset := 0) \\<circ> (`pcW := Write) \n                        \\<circ> setownB [(0,(Data s (numEnqs s))) W]) s\" \n| \"rbW_step A4 s = ((`H := ((hW s) + (Data s (numEnqs s)))) \\<circ> (`offset := (hW s)) \\<circ> (`pcW := Write)\n                        \\<circ> setownB [(hW s,hW s+Data s (numEnqs s)) W]) s\"\n| \"rbW_step A5 s = (if grd4 s then (`pcW := A6)  \n                     else if grd5 s then (`pcW := A7)\n                     else (`pcW := A8)) s\"\n| \"rbW_step A6 s = (`H := ((hW s) + (Data s (numEnqs s))) \\<circ> (`offset := (hW s)) \\<circ> (`pcW := Write)\n                        \\<circ> setownB [(hW s,hW s+Data s (numEnqs s)) W]) s\"\n| \"rbW_step A7 s = ((`H := (Data s (numEnqs s))) \\<circ> (`offset := 0) \\<circ> (`pcW := Write)\n                        \\<circ> (setownB [(hW s,N) D])\n                        \\<circ> (setownB [(0,Data s (numEnqs s)) W])) s\"\n| \"rbW_step A8 s = (if ((Data s (numEnqs s))>N) then ERRBTS s\n                        else (ERROOM \\<circ> (`tW := (T s))) s)\"\n\n| \"rbW_step Write s = s\"\n| \"rbW_step Enqueue s = s\"| \"rbW_step idleW s = s\" | \"rbW_step FinishedW s = s\"| \"rbW_step BTS s = s\"| \"rbW_step OOM s = s\"\n\n\n\ndefinition \"B_acquire s s' \\<equiv> s' = (`pcW := A1) s\"\n\ndefinition \"Q_enqueue s s' \\<equiv> s' = (`q:=(append (q s) [(offset s,Data s (numEnqs s))])\n                     \\<circ> `pcW := idleW\n                     \\<circ>  transownB [W Q]\n                     \\<circ> `numEnqs := (numEnqs s + 1)\n                     \\<circ>  transownT [W Q s]) s\"\n\ndefinition \"B_write s s' \\<equiv> s' = ((`B.write ((offset s), (Data s (numEnqs s))):= (numEnqs s))\n                      \\<circ> (transownD [(numWrites s) B]) \\<circ> `pcW := Enqueue \\<circ> (`numWrites := ((numWrites s )+1))) s\"\n\ndefinition cW_step :: \"PCW \\<Rightarrow> rb_state \\<Rightarrow> rb_state \\<Rightarrow> bool\" where\n \"cW_step pcw s s' \\<equiv> \n    case pcw of\n        idleW     \\<Rightarrow>  if ((numEnqs s) < n) then B_acquire s s'\n                          else s' = (`pcW := FinishedW ) s\n      | Write     \\<Rightarrow>  B_write s s'   \n      | Enqueue   \\<Rightarrow>  Q_enqueue s s'\n      | OOM       \\<Rightarrow>  if tW s \\<noteq> T s then s' = (`pcW := idleW ) s else s = s'\n      | FinishedW \\<Rightarrow>  s = s'\n      | BTS       \\<Rightarrow>  s = s'\n      | _         \\<Rightarrow>  s' = rbW_step pcw s \"\n\n\nlemmas W_functs [simp] = B_acquire_def B_write_def Q_enqueue_def\n(*---------Tailored assertions to Writer-------*)\ndefinition \"pre_acquire_inv s   \\<equiv> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq> W)\n                                \\<and> (T s=H s \\<longrightarrow> (\\<forall>i.(i\\<ge>0 \\<and> i<N)\\<longrightarrow>ownB s i=B) \\<and> ownT s = Q \\<and> q s= [] \\<and> numDeqs s = numEnqs s)\n                                \\<and> (T s>H s \\<longrightarrow> (\\<forall>i.(i\\<ge>H s \\<and> i<T s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (T s<H s \\<longrightarrow> (\\<forall>i.((i\\<ge>H s \\<and> i<N) \\<or> i<T s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[]) \n                                \\<and> (numEnqs s\\<le>n)\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n\"\ndefinition \"pre_A1_inv s        \\<equiv> (T s=H s\\<longrightarrow>((\\<forall>i.(i\\<ge>0 \\<and> i<N)\\<longrightarrow>ownB s i=B) \\<and> ownT s =Q \\<and> q s=[]))\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (T s>H s \\<longrightarrow> (\\<forall>i.(i\\<ge>H s \\<and> i<T s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (T s<H s \\<longrightarrow> (\\<forall>i.((i\\<ge>H s \\<and> i<N) \\<or> i<T s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A2_inv s        \\<equiv> (tW s=hW s\\<longrightarrow>((\\<forall>i.(i\\<ge>0 \\<and> i<N)\\<longrightarrow>ownB s i=B) \\<and> ownT s =Q \\<and> q s=[] \\<and> tW s=T s))\n                                \\<and> (tW s>hW s \\<longrightarrow> ((\\<forall>i.(i\\<ge>hW s \\<and> i<tW s)\\<longrightarrow>ownB s i=B) \\<and> (T s\\<ge>tW s \\<or> T s\\<le>H s)))\n                                \\<and> (tW s<hW s \\<longrightarrow> ((\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B) \\<and> T s\\<ge>tW s \\<and> H s\\<ge>T s))\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A3_inv s        \\<equiv> ((\\<forall>i.(i\\<ge>0 \\<and> i<N)\\<longrightarrow>ownB s i=B))\n                                \\<and> (grd1 s)\n                                \\<and> (ownT s =W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s) \\<and> q s=[]\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s=tW s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A4_inv s        \\<equiv> (\\<forall>i.(i\\<ge>hW s \\<and> i<tW s)\\<longrightarrow>ownB s i=B)\n                                \\<and> (grd2 s) \\<and> (\\<not>grd1 s)\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s) \n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s\\<ge>tW s \\<or> T s\\<le>H s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A5_inv s        \\<equiv> (\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B)\n                                \\<and> (grd3 s) \\<and> (\\<not>grd1 s) \\<and> (\\<not>grd2 s)\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s\\<ge>tW s \\<and> T s\\<le>H s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A6_inv s        \\<equiv> (\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B)\n                                \\<and> (grd4 s) \\<and> (grd3 s) \\<and> (\\<not>grd1 s) \\<and> (\\<not>grd2 s)\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s) \n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s\\<ge>tW s \\<and> T s\\<le>H s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A7_inv s        \\<equiv> (\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B)\n                                \\<and> (grd5 s) \\<and> (grd3 s) \\<and> (\\<not>grd1 s) \\<and> (\\<not>grd2 s) \\<and> (\\<not>grd4 s)\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s) \n                                \\<and> (numEnqs s<n) \n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s\\<ge>tW s \\<and> T s\\<le>H s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_A8_inv s        \\<equiv> (tW s\\<le>hW s \\<longrightarrow>(\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (tW s>hW s \\<longrightarrow>(\\<forall>i.(hW s \\<le>i \\<and> i<tW s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (no_space_for_word s) \n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[])\n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s\\<ge>tW s \\<or> T s\\<le>H s)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n\"\ndefinition \"pre_write_inv s     \\<equiv> (\\<forall>i.(i\\<ge>offset s \\<and> i< ((offset s)+(Data s (numEnqs s))))\\<longrightarrow>ownB s i=W)\n                                \\<and> ((tW s>hW s)\\<longrightarrow>(\\<forall>i.(i\\<ge>((offset s)+(Data s (numEnqs s)))\\<and>i<tW s)\\<longrightarrow>ownB s i =B))\n                                \\<and> ((tW s<hW s \\<and> offset s\\<noteq>0)\\<longrightarrow>(\\<forall>i.((i\\<ge>((offset s)+(Data s (numEnqs s))) \\<and> i<N)\\<or>i<tW s)\\<longrightarrow>ownB s i =B))\n                                \\<and> ((tW s<hW s \\<and> offset s=0)\\<longrightarrow>((\\<forall>i.(i\\<ge>((offset s)+(Data s (numEnqs s))) \\<and> i<tW s)\\<longrightarrow>ownB s i =B) \\<and> (\\<forall>i.(i\\<ge>hW s \\<and> i<N)\\<longrightarrow>ownB s i=D)))\n                                \\<and> (tW s=hW s\\<longrightarrow>(ownT s=W \\<and> q s=[]))\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (tempW_structure s)\n                                \\<and> (ownD s(numWrites s) =W)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[]) \n                                \\<and> (offset s=hW s \\<or> offset s=0)\n                                \\<and> (H s=offset s + Data s (numEnqs s))\n                                \" \ndefinition \"pre_enqueue_inv s   \\<equiv> (\\<forall>i.(i\\<ge>offset s \\<and> i< end(tempW s))\\<longrightarrow>ownB s i=W)\n                                \\<and> (\\<forall>i.(i<offset s \\<or> (i\\<ge> end(tempW s)\\<and>i\\<le>N))\\<longrightarrow>ownB s i\\<noteq>W)\n                                \\<and> ((tW s>hW s)\\<longrightarrow>(\\<forall>i.(i\\<ge>end(tempW s)\\<and>i<tW s)\\<longrightarrow>ownB s i =B))\n                                \\<and> ((tW s<hW s \\<and> offset s\\<noteq>0)\\<longrightarrow>(\\<forall>i.((i\\<ge>end(tempW s) \\<and> i<N)\\<or>i<tW s)\\<longrightarrow>ownB s i =B))\n                                \\<and> ((tW s<hW s \\<and> offset s=0)\\<longrightarrow>((\\<forall>i.(i\\<ge>end(tempW s) \\<and> i<tW s)\\<longrightarrow>ownB s i =B) \\<and> (\\<forall>i.(i\\<ge>hW s \\<and> i<N)\\<longrightarrow>ownB s i=D)))\n                                \\<and> (tW s=hW s\\<longrightarrow>(ownT s=W \\<and> q s=[]))\n                                \\<and> (numWrites s=numEnqs s +1)\n                                \\<and> (numEnqs s<n)\n                                \\<and> ((ownT s = W)\\<longrightarrow>q s=[])\n                                \\<and> (tempW_structure s)\n                                \\<and> (tempW_reflects_writes s)\n                                \\<and> (ownD s(numEnqs s) =B)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[]) \n                                \\<and> (offset s=hW s \\<or> offset s=0)\n                                \\<and> (H s=offset s + Data s (numEnqs s))\n                                \" \ndefinition \"pre_OOM_inv s       \\<equiv> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (tW s>hW s \\<longrightarrow> (\\<forall>i.(i\\<ge>tW s \\<and> i<hW s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (tW s<hW s \\<longrightarrow> (\\<forall>i.((i\\<ge>hW s \\<and> i<N) \\<or> i<tW s)\\<longrightarrow>ownB s i=B))\n                                \\<and> (numWrites s=numEnqs s) \n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[]) \n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \ndefinition \"pre_finished_inv s  \\<equiv> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s=n)\n                                \\<and> (H s>0)\n                                \" \ndefinition \"pre_BTS_inv s       \\<equiv> (\\<forall>j.(j\\<ge>0\\<and> j\\<le>N)\\<longrightarrow>ownB s j\\<noteq>W)\n                                \\<and> (ownT s \\<noteq>W)\n                                \\<and> (numWrites s=numEnqs s)\n                                \\<and> (numEnqs s<n)\n                                \\<and> (H s=hW s)\n                                \\<and> (numEnqs s=0\\<longrightarrow>q s=[]) \n                                \\<and> (numEnqs s>0\\<longleftrightarrow>H s>0)\n                                \\<and> (numEnqs s=0\\<longleftrightarrow>H s=0)\n                                \\<and> (T s = 0 \\<and> H s = 0) = (numWrites s = 0)\n                                \" \n\nlemmas writer_lemmas  = pre_A1_inv_def pre_A2_inv_def pre_A3_inv_def pre_A4_inv_def\n                              pre_A5_inv_def pre_A6_inv_def pre_A7_inv_def pre_A8_inv_def\n                              pre_BTS_inv_def pre_OOM_inv_def pre_acquire_inv_def\n                              pre_finished_inv_def pre_enqueue_inv_def pre_write_inv_def\n(***********************************************************************)\n\n\n(*Reader Thread Behaviour*)\n\ndefinition \"B_release s s' \\<equiv> s' = (`T := (end(tempR s)) \n                        \\<circ> (`pcR := idleR) \n                        \\<circ> (`tempR := (0,0))\n                        \\<circ> (transownB [R B]) \n                        \\<circ> (if tR s\\<noteq> fst(tempR s) then setownB [(tR s,N) B] else id) \n                        \\<circ> transownT [R Q s]) s\"\n\ndefinition \"B_read s s' \\<equiv> s' = (((transownD [(data_index s (tempR s)) R]) \n                        \\<circ> (`pcR := Release)) \n                        \\<circ> (`numReads := (numReads s+1))  \n                        \\<circ> (`tR := (T s))) s\"\n\ndefinition \"Q_dequeue s s' \\<equiv>  s' = ((`q:= (tl(q s)))\n                                          \\<circ> (`pcR := Read)\n                                          \\<circ> (`tempR := (hd(q s)))\n                                          \\<circ> (transownT [Q R s])\n                                          \\<circ> (`numDeqs :=(numDeqs s+1))\n                                          \\<circ> (setownB [(off(hd(q s)),(end(hd(q s)))) R])) s\"\n\ndefinition cR_step :: \"PCR \\<Rightarrow> rb_state \\<Rightarrow> rb_state \\<Rightarrow> bool\" where\n \"cR_step pcr s s' \\<equiv> \n    case pcr of\n        idleR \\<Rightarrow> if (q s=[]) then (s=s') else (Q_dequeue s s')\n      | Read \\<Rightarrow>  B_read s s' \n      | Release \\<Rightarrow>  B_release s s'\"\n\n\nlemmas R_functs [simp] = B_release_def B_read_def Q_dequeue_def\n(*---------Tailored assertions to Reader-------*)\ndefinition \"pre_dequeue_inv s \\<equiv>  (tempR s = (0,0))\n                              \\<and> (numDeqs s \\<le> n)\n                              \\<and> (numDeqs s \\<ge> 0)\n                              \\<and> (numDeqs s = numReads s)\n                              \\<and> (numDeqs s \\<le> numEnqs s)\n                              \\<and> (pcR s = idleR)\n                              \\<and> (q s\\<noteq>[] \\<longrightarrow> ownT s=Q)\n                              \\<and> (q s\\<noteq>[] \\<longrightarrow> H s>0)\n                              \\<and> ((T s\\<noteq>fst(hd(q s))\\<and>q s\\<noteq>[])\\<longrightarrow>(\\<forall>x j.(x\\<in>set(q s) \\<and> j<N \\<and> j\\<ge>T s)\\<longrightarrow>end(x)<j))\n                              \\<and> (q s\\<noteq>[]\\<longrightarrow>(\\<forall>i.(fst(hd(q s))\\<le>i \\<and> i<end(hd(q s)))\\<longrightarrow>ownB s i = Q))\n                              \\<and> (\\<forall>i.(i<fst(tempR s) \\<or> (i\\<ge>end(tempR s)\\<and> i\\<le>N))\\<longrightarrow>ownB s i \\<noteq> R)\n\n\"\n\ndefinition \"pre_Read_inv s    \\<equiv>  (snd(tempR s) = Data s (numReads s))\n                              \\<and> (numReads s=data_index s (tempR s))\n                              \\<and> (numDeqs s\\<le>n) \n                              \\<and> (numDeqs s\\<ge>0) \n                              \\<and> (numReads s+1=numDeqs s)\n                              \\<and> (numDeqs s\\<ge>1)\n                              \\<and> (numEnqs s\\<ge>numDeqs s) \n                              \\<and> (pcR s=Read)\n                              \\<and> (ownT s = R)\n                              \\<and> (ownD s (numReads s) = B)\n                              \\<and> (tempR s\\<noteq>(0,0))\n                              \\<and> (tempR_structure s)\n                              \\<and> (\\<forall>i.(fst(tempR s)\\<le>i \\<and> i<end(tempR s))\\<longrightarrow>ownB s i = R)\n                              \\<and> (\\<forall>i.(i<fst(tempR s) \\<or> (i\\<ge>end(tempR s)\\<and> i\\<le>N))\\<longrightarrow>ownB s i \\<noteq> R)\n\n                              \\<and> (H s>0)\n\"\n\ndefinition \"pre_Release_inv s \\<equiv> (snd(tempR s) = Data s (numReads s -1))\n                              \\<and> (data_index s (tempR s) = numReads s -1)\n                              \\<and> (q s\\<noteq>[]\\<longrightarrow>(numReads s=data_index s (hd(q s))))\n                              \\<and> (ownT s = R)\n                              \\<and> (numEnqs s\\<ge>numDeqs s)\n                              \\<and> (ownD s (numReads s -1) = R)\n                              \\<and> (numDeqs s\\<le>n \\<and> numDeqs s\\<ge>1)\n                              \\<and> (numDeqs s = numReads s)\n                              \\<and> (pcR s=Release)\n                              \\<and> (tR s=T s)\n                              \\<and> (tempR s\\<noteq>(0,0))\n                              \\<and> (tempR_structure s)\n                              \\<and> (\\<forall>i.(fst(tempR s)\\<le>i \\<and> i<end(tempR s))\\<longrightarrow>ownB s i = R)\n                              \\<and> (\\<forall>i.(i<fst(tempR s) \\<or> (i\\<ge>end(tempR s)\\<and> i\\<le>N))\\<longrightarrow>ownB s i \\<noteq> R)\n\n\n                              \\<and> (H s>0)\n\" \n\n\n\nlemmas reader_lemmas  = pre_Release_inv_def pre_Read_inv_def pre_dequeue_inv_def\n(***********************************************************************)\n\n\n\nlemma Q_structure_preserved1:\n  assumes \"Q_structure s\"\n  and \"pre_dequeue_inv s\"\n  and \"q s\\<noteq>[]\"\n  and \"Q_dequeue s s'\"\n  shows \"Q_structure s'\"\n  using assms apply(simp add:Q_structure_def pre_dequeue_inv_def)\n  apply (intro conjI impI)\n  apply(simp add:Q_basic_struct_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_boundness_def )\n  apply (metis  list.set_sel(2))\n  apply(simp add:Q_gap_structure_def) \n  apply (metis (no_types, hide_lams) One_nat_def Q_gap_structure_def end_simp length_tl tail_preserves_Q_gap_structure)\n  apply(simp add:Q_offsets_differ_def)\n  apply (metis (no_types, lifting) One_nat_def add.commute add_right_cancel length_tl less_diff_conv nth_tl plus_1_eq_Suc)\n  apply(simp add:Q_has_no_overlaps_def)\n  apply (metis (no_types, lifting) list.set_sel(2))\n  apply(simp add:Q_has_no_uroboros_def)\n  apply (metis butlast_tl last_tl list.sel(2) list.set_sel(2))\n  apply(simp add:Q_reflects_writes_def) apply(simp add:Q_elem_size_def)\n  apply (meson list.set_sel(2)) apply(simp add:Q_reflects_writes_def)\n  apply (metis One_nat_def Suc_eq_plus1 add_Suc_right length_tl less_diff_conv nth_tl)\n  apply(simp add:Q_reflects_ownD_def) apply(simp add:Q_elem_rel_def) \n  apply (metis (no_types, hide_lams) One_nat_def Q_structure_def Suc_eq_plus1_left add.commute assms(1) length_tl tail_preserves_Q_elem_size)\n  apply(simp add:Q_reflects_ownD_def)\n  by (metis Nat.add_0_right add_Suc add_Suc_right less_diff_conv)\n\nlemma Q_structure_preserved2:\n  assumes \"Q_structure s\"\n  and \"ownT s=R\"\n  and \"pre_Read_inv s\"\n  and \"B_read s s'\"\n  shows \"Q_structure s'\"\n  using assms apply(simp add:Q_structure_def)\n  apply(intro conjI impI) apply(simp add:Q_basic_struct_def) apply(intro conjI impI)\n  apply(simp add:Q_boundness_def)\n  apply(simp add:Q_gap_structure_def)\n  apply(simp add:Q_offsets_differ_def)\n  apply(simp add:Q_has_no_overlaps_def)\n  apply(simp add:Q_has_no_uroboros_def)\n  apply(simp add:Q_elem_size_def)\n  apply(simp add:Q_holds_bytes_def)\n  apply(simp add:Q_reflects_writes_def)\n  apply(simp add:Q_elem_size_def)\n  apply(simp add:Q_reflects_ownD_def)\n  apply(simp add:Q_elem_rel_def)\n  apply(simp add:Q_reflects_ownD_def)\n  by(simp add:Q_structure_def pre_Read_inv_def)\n\nlemma Q_structure_preserved3:\n  assumes \"Q_structure s\"\n  and \"pre_Release_inv s\"\n  and \"s' = (`T := (off(tempR s) +len(tempR s)) \n          \\<circ> (`pcR := idleR) \n          \\<circ> (`tempR := (0,0))\n          \\<circ> (transownB [R B]) \n          \\<circ> (if tR s\\<noteq> fst(tempR s) then setownB [(tR s,N) B] else id) \n          \\<circ> transownT [R Q s]) s\"\n  shows \"Q_structure s'\"\n  using assms \n  apply (simp add:Q_structure_def) \n  apply(intro conjI impI)\n  apply(simp add:Q_basic_struct_def)\n  apply(intro conjI impI) \n  apply(simp add:pre_Release_inv_def Q_boundness_def)\n  apply(simp add:pre_Release_inv_def Q_gap_structure_def)\n  apply(simp add:pre_Release_inv_def Q_offsets_differ_def)\n  apply(simp add:pre_Release_inv_def Q_has_no_overlaps_def)\n  apply(simp add:pre_Release_inv_def Q_has_no_uroboros_def)\n  apply(simp add:pre_Release_inv_def Q_holds_bytes_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Release_inv_def Q_reflects_writes_def)\n  apply(simp add:pre_Release_inv_def Q_elem_size_def)\n  apply(simp add:pre_Release_inv_def Q_reflects_ownD_def)\n  apply(simp add:pre_Release_inv_def Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def Q_reflects_writes_def)\n  apply(simp add:pre_Release_inv_def Q_elem_rel_def)\n  apply(simp add:pre_Release_inv_def Q_reflects_ownD_def)\n  apply(simp add:pre_Release_inv_def Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def Q_reflects_writes_def)\n  apply(simp add:pre_Release_inv_def Q_elem_rel_def)\n  apply(simp add:pre_Release_inv_def Q_reflects_ownD_def)\n  apply(simp add:pre_Release_inv_def Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def Q_reflects_writes_def)\n  apply(simp add:pre_Release_inv_def Q_elem_rel_def)\n  apply(simp add:pre_Release_inv_def Q_reflects_ownD_def)\n  apply(simp add:pre_Release_inv_def Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def Q_reflects_writes_def)\n  apply(simp add:pre_Release_inv_def Q_elem_rel_def)\n  by(simp add:pre_Release_inv_def Q_reflects_ownD_def)\n\n  \n\n\n\n\n\ndefinition \"inRange v \\<equiv> 0 \\<le> v \\<and> v \\<le> N\"\ndefinition \"inRangeHT s \\<equiv> inRange (H s) \\<and> inRange (T s)\"\ndefinition \"H0_T0 s \\<equiv> H s = 0 \\<longrightarrow> T s = 0\"\ndefinition \"inRangeht s \\<equiv> inRange (hW s) \\<and> inRange (tW s)\"\ndefinition \"basic_pointer_movement s \\<equiv> inRangeHT s \\<and> inRangeht s \\<and> H0_T0 s \"\n\nlemmas basic_pointer_movement_lemmas [simp] = basic_pointer_movement_def inRangeHT_def inRangeht_def H0_T0_def inRange_def\n\n\ndefinition \"mainInv s \\<equiv> \\<forall> i. (i<numReads s \\<longrightarrow> ownD s i=R) \n                           \\<and> (numReads s \\<le> i \\<and> i < numWrites s \\<longrightarrow> ownD s i = B) \n                           \\<and> (numWrites s \\<le> i \\<and> i < n \\<longrightarrow> ownD s i = W) \"\ndefinition \"counter_bounds s \\<equiv> numReads s \\<le>n \\<and> numWrites s\\<le>n \\<and> numEnqs s\\<le>n \\<and> numDeqs s \\<le> n\"\ndefinition \"counter_q_rel s \\<equiv> (numEnqs s-numDeqs s=length(q s))\\<and> numWrites s\\<ge>numReads s \\<and> numEnqs s\\<ge>numDeqs s\" \n\n\n(*new lemmas, take 2*)\ndefinition \"data_index_bouded s \\<equiv> \\<forall>i. (i\\<le>N)\\<longrightarrow>(\\<forall>j.(j\\<le>N)\\<longrightarrow>data_index s (i,j)<n)\"\n\n\n\n\nlemmas invariant_lemmas [simp] = con_assms_def mainInv_def\n                          counter_q_rel_def \n                          counter_bounds_def data_index_bouded_def\n                          \n\ndefinition \"Q_ownB_rel s        \\<equiv> \\<forall>j.(ownB s j=Q \\<and> j<N)\\<longrightarrow>(\\<exists>a b. ((a, b)\\<in>set(q s)\\<and> a\\<le>j \\<and> j<a+b))\"\n\ndefinition \"ran_indices a b \\<equiv> {i . a \\<le> i \\<and> i < b}\"\n\ndefinition \"Q_indices s \\<equiv> \\<Union> {ran_indices a (a + b) | a b. (a, b) \\<in> set(q s)}\"\n\ndefinition \"Q_tail_indices s \\<equiv> \\<Union> {ran_indices a (a + b) | a b. (a, b) \\<in> set(tl(q s))}\"\n\nlemma ran_ind_imp_Q_ind:\n  \"\\<forall>i a b. (i\\<in> ran_indices a b \\<and> (a, b)\\<in>set(q s))\\<longrightarrow>i\\<in>Q_indices s\"\n  apply(simp add:Q_indices_def ran_indices_def) \n  by (smt (z3) add.assoc add_lessD1 less_add_eq_less mem_Collect_eq)\n\nlemma Q_ind_imp_tail_ind_1:\n  \"tl(q s)\\<noteq>[] \\<Longrightarrow> hd(q s) = (q s!0)\"\n  apply (simp add:hd_def) \n  by (metis Nil_tl hd_conv_nth hd_def)\n\nlemma Q_ind_imp_tail_ind_2:\n  \"tl(q s)\\<noteq> [] \\<Longrightarrow>i\\<in>Q_indices s\\<Longrightarrow> \\<exists>a b.((a,b)\\<in>set(tl(q s))\\<and>a\\<le>i \\<and> i<b)\\<Longrightarrow>i\\<in>Q_tail_indices s\"\n  apply(simp add:Q_indices_def ran_indices_def Q_tail_indices_def) \n  by (metis (no_types, lifting) leD leI le_iff_add mem_Collect_eq nat_add_left_cancel_less trans_le_add2)\n\nlemma Q_ind_imp_tail_ind_3:\n  \"tl(q s)\\<noteq> [] \\<Longrightarrow>i\\<in>Q_indices s\\<Longrightarrow> s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n                   numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n \\<Longrightarrow>\\<exists>a b.((a,b)\\<in>set(tl(q s))\\<and>a\\<le>i \\<and> i<b)\\<Longrightarrow>i\\<in>Q_indices s'\"\n  apply(simp add:Q_indices_def ran_indices_def Q_tail_indices_def) \n  by (metis (no_types, lifting) leD leI le_iff_add mem_Collect_eq nat_add_left_cancel_less trans_le_add2)\n\n\n\n(*\n[(1, 3), (4,1)]\nran_indices 1 4 = {1,2,3}\nran_indicies 4,5 = {4}\nQ_indicies s = {1,2,3,4}\n*)\n\ndefinition \"Q_owns_bytes s \\<equiv> \\<forall>i.(i\\<in>Q_indices s)\\<longleftrightarrow>(i\\<le>N \\<and> ownB s i=Q)\"\n\ndefinition \"Q_tail_owns_bytes s \\<equiv> \\<forall>i.(i\\<in>Q_tail_indices s)\\<longleftrightarrow>(i\\<le>N \\<and> ownB s i=Q \\<and> i\\<notin>ran_indices (fst(hd(q s))) (end(hd(q s))))\"\n\n\n\n(*------------------------ Invariant ------------------------------------*)\ndefinition inv  where\n\"inv   s \\<equiv> basic_pointer_movement s \n               \\<and> mainInv s\n               \\<and> counter_q_rel s\n               \\<and> counter_bounds s \n               \\<and> Q_structure s\n               \\<and> data_index_bouded s\n               \\<and> (case_1 s \\<or> case_2 s)\n               \\<and> Q_owns_bytes s\n\"\n\ndefinition pre_W where\n  \"pre_W pcw s \\<equiv> (case pcw of\n      idleW \\<Rightarrow> pre_acquire_inv s \n    | A1 \\<Rightarrow> pre_A1_inv s \n    | A2 \\<Rightarrow> pre_A2_inv s \n    | A3 \\<Rightarrow> pre_A3_inv s \n    | A4 \\<Rightarrow> pre_A4_inv s \n    | A5 \\<Rightarrow> pre_A5_inv s \n    | A6 \\<Rightarrow> pre_A6_inv s \n    | A7 \\<Rightarrow> pre_A7_inv s \n    | A8 \\<Rightarrow> pre_A8_inv s \n    | Write \\<Rightarrow> pre_write_inv s \n    | OOM \\<Rightarrow> pre_OOM_inv s \n    | BTS \\<Rightarrow> pre_BTS_inv s \n    | Enqueue \\<Rightarrow> pre_enqueue_inv s  \n    | FinishedW \\<Rightarrow> pre_finished_inv s)\"\n\ndefinition pre_R where\n  \"pre_R pcr s \\<equiv>\n  (case pcr of\n     idleR \\<Rightarrow> pre_dequeue_inv s \n    | Read \\<Rightarrow> pre_Read_inv s  \n    | Release \\<Rightarrow> pre_Release_inv s)\"\n\n\nlemmas inv_simps =  inv_def cW_step_def cR_step_def init_def\n\n\n\n\n\nlemma Q_not_empty:\n  \"q s \\<noteq> [] \\<Longrightarrow> \\<forall>x.(x\\<in>set(q s))\\<longrightarrow>snd(x)>0 \\<Longrightarrow> Q_indices s\\<noteq>{}\"\n  apply (simp add: Q_indices_def ran_indices_def)\n  apply (rule_tac exI [where x =\"{i. fst(hd(q s)) \\<le> i \\<and> i < end(hd(q s))}\"])\n  apply safe defer apply(simp add:end_def)\n  apply auto \n  apply (metis add.commute le_refl less_add_same_cancel2 list.set_sel(1) prod.exhaust_sel)\n  apply (rule_tac exI [where x =\"fst(hd(q s))\"])\n  apply (rule_tac exI [where x =\"snd(hd(q s))\"])\n  by simp\n\n\nlemma case_1_Q_struct:\n  assumes \"case_1 s\"\n  and \"Q_structure s\"\n  and \"Q_owns_bytes s\"\nshows \"\\<forall>i.(i>0 \\<and> i<length(q s))\\<longrightarrow>fst(q s!i) = end(q s!(i-1))\"\n  apply (cases \"q s = []\")\n  apply simp \n  using assms apply (simp add:Q_lemmas Q_basic_lemmas case_1_def Q_owns_bytes_def Q_indices_def ran_indices_def) \n  apply clarify\n  apply(subgoal_tac \"\\<forall>a b aa. (a,b)\\<in>set(q s) \\<and> (\\<exists>b.(aa, b)\\<in>set(q s)) \\<longrightarrow> a<aa\\<longrightarrow>a+b\\<le>aa\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s)\\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> (q s!i) = (a,b)))\") prefer 2\n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i j.(i<length(q s)\\<and>j<length(q s))\\<longrightarrow>(\\<exists>a b aa bb.((a,b)\\<in>set(q s)\\<and>(aa,bb)\\<in>set(q s)))\")\n  prefer 2 \n  apply (metis last_in_set surjective_pairing)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> i>0)\\<longrightarrow>(fst(q s!i) = 0 \\<or> fst(q s!i) = end(q s!(i-1)))\")\n  prefer 2 \n  apply (metis (no_types, lifting) One_nat_def end_simp)\n  apply(case_tac \"ownB s 0 = Q\") \n  apply (metis (no_types, lifting) F.distinct(11) F.distinct(19) F.distinct(23) F.distinct(3) bot_nat_0.not_eq_extremum head_q0 le_numeral_extra(3) length_greater_0_conv)\n  apply(subgoal_tac \"ownB s 0\\<noteq>Q\") prefer 2 apply blast\n  (*trying to use the fact that ownB s 0\\<noteq>Q and Q_gap_structure to show that all \n    Q entries start where the last left off, rather than any starting from 0*)\n  apply(subgoal_tac \"(\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a = 0))\\<longrightarrow>ownB s 0=Q\")\n  prefer 2\n  apply (metis (no_types, lifting) add_gr_0 mem_Collect_eq nat_le_linear)\n  apply(subgoal_tac \"ownB s 0\\<noteq>Q\\<longrightarrow>(\\<nexists>a b.((a,b)\\<in>set(q s) \\<and> a = 0))\")\n  prefer 2 \n  apply meson\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a\\<noteq>0\") prefer 2\n  apply metis\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> (a,b)=(q s!i)))\") prefer 2\n  apply metis\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s)\\<and>(q s!i) = (a, b))\\<longrightarrow>a=fst(q s!i)\") prefer 2\n  apply (metis fst_conv)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>fst(q s!i)\\<noteq>0\") prefer 2\n  apply (metis nth_mem prod.collapse)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s)\\<and>i>0)\\<longrightarrow>(fst(q s!i) =end(q s!(i-1)) \\<or> fst(q s!i) =0)\")\n  prefer 2 \n  apply (metis (no_types, hide_lams))\n  apply(subgoal_tac \"(\\<forall>i.(i<length(q s))\\<longrightarrow>fst(q s!i)\\<noteq>0) \\<and> (\\<forall>i.(i<length(q s)\\<and>i>0)\\<longrightarrow>(fst(q s!i) =end(q s!(i-1)) \\<or> fst(q s!i) =0))\n                      \\<longrightarrow>(\\<forall>i.(i<length(q s)\\<and>i>0)\\<longrightarrow>(fst(q s!i) =end(q s!(i-1))))\")\n  prefer 2 \n  apply (metis (no_types, hide_lams))\n  by (metis (no_types, lifting))\n\nlemma ran_indices_lem:\n  \"Q_structure s \\<Longrightarrow> \\<forall>i.(i<length(q s))\\<longrightarrow> fst(q s!i) \\<in> ran_indices (fst(q s ! i)) (fst(q s!i)+snd(q s!i))\"\n  apply (simp add: Q_lemmas Q_basic_lemmas ran_indices_def)\n  by (metis bot_nat_0.not_eq_extremum length_0_conv length_pos_if_in_set nth_mem prod.exhaust_sel)\n\nlemma ran_indices_lem2:\n  \"q s \\<noteq> [] \\<Longrightarrow> Q_structure s \\<Longrightarrow> case_1 s \\<Longrightarrow> \\<forall>i.(i\\<ge>end(last(q s)) \\<and> i\\<le>N)\\<longrightarrow>ownB s i\\<noteq>Q\"\n  apply (simp add: Q_lemmas Q_basic_lemmas ran_indices_def case_1_def) \n  by (metis F.distinct(11) F.distinct(19) F.distinct(23) F.distinct(3) le_eq_less_or_eq nat_neq_iff)\n \n\nlemma ran_indices_lem3:              \n  \"q s \\<noteq> [] \\<Longrightarrow> Q_structure s \\<Longrightarrow> case_1 s \\<Longrightarrow> end(last(q s)) \\<le> N \\<Longrightarrow> ownB s (end(last(q s))) \\<noteq>Q\"\n  apply (simp add: Q_lemmas Q_basic_lemmas ran_indices_def case_1_def) \n  by (smt (z3) F.distinct(11) F.distinct(19) F.distinct(23) F.distinct(3) last_in_set le_eq_less_or_eq less_eq_Suc_le not_less_eq_eq prod.collapse)\n\nlemma ran_indices_lem4:\n  \"q s \\<noteq> [] \\<Longrightarrow> Q_structure s \\<Longrightarrow> case_1 s \\<Longrightarrow>  end(last(q s))\\<le>N\"\n  by (simp add: Q_lemmas Q_basic_lemmas ran_indices_def case_1_def)\n\nlemma ran_indices_lem5:\n  \"q s\\<noteq>[] \\<Longrightarrow>Q_structure s \\<Longrightarrow> case_1 s \\<Longrightarrow> Q_owns_bytes s \\<Longrightarrow> \\<forall>i.(i<length(q s)) \\<longrightarrow> fst(q s!i)\\<in>Q_indices s\"\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  by (metis (mono_tags, lifting) mem_Collect_eq nth_mem prod.collapse ran_indices_def ran_indices_lem)\n\n\nlemma case_1_Q_struct_inf:\n  assumes \"Q_structure s\"\n  and \"case_1 s\"\n  and \"Q_owns_bytes s\"\nshows  \"\\<forall>i<length (q s). fst (q s ! i) < end(q s!(length(q s)-1))\"\n  apply(case_tac \"q s=[]\")\n  apply simp\n  using assms apply(case_tac \"length (q s) =1\") \n  apply(simp add:Q_lemmas Q_basic_lemmas )\n  apply (metis lessI nth_mem prod.collapse)\n  apply safe[1]\n  apply(subgoal_tac \"\\<forall>i.(i<N \\<and> i\\<ge>end(last(q s)))\\<longrightarrow> ownB s i\\<noteq>Q\") prefer 2\n  apply(simp add:case_1_def) \n  apply (metis assms(2) end_simp less_or_eq_imp_le ran_indices_lem2)\n  apply(simp add:case_1_def)\n  apply clarify\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>ownB s (fst(q s!i)) = Q\") prefer 2\n  using ran_indices_lem [where s = s] \n   defer \n  apply(subgoal_tac \"\\<forall>i.(ownB s i =Q \\<and> i\\<le>N)\\<longrightarrow>i<end(last(q s))\") prefer 2\n  apply (metis (no_types, lifting) assms(2) nat_le_linear nat_less_le ran_indices_lem2)\n  apply(subgoal_tac \"(\\<forall>i.(i\\<ge>end(last(q s)) \\<and> i\\<le>N)\\<longrightarrow>ownB s i\\<noteq>Q)\\<longrightarrow>(\\<forall>i.(ownB s i=Q \\<and> i\\<le>N)\\<longrightarrow>i<end(last(q s)))\") prefer 2\n  apply(unfold Q_owns_bytes_def Q_indices_def ran_indices_def)[1]\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>ownB s (fst(q s!i)) =Q\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(ownB s i=Q \\<and> i\\<le>N)\\<longrightarrow>i<end(last(q s))\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>(\\<exists>a b. (a,b)\\<in>set(q s) \\<and> a=fst(q s!i))\") prefer 2\n  apply (metis nth_mem prod.exhaust_sel)\n  apply(unfold Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"\\<nexists>j.(j<length(q s) \\<and> ownB s (fst(q s!j))\\<noteq>Q)\") prefer 2\n  apply metis\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i<end(last(q s))\") prefer 2\n  apply meson\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow> fst(q s!i) \\<in> {j. ownB s j = Q}\") prefer 2\n  apply (metis (mono_tags, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s)) \\<longrightarrow> end(q s!i)\\<le>N\") prefer 2\n  apply (metis nth_mem)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>snd(q s!i)>0\") prefer 2\n  apply (metis nth_mem)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>fst(q s!i)<end(q s!i)\") prefer 2\n  apply (metis (no_types, lifting) end_simp less_add_same_cancel1)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>fst(q s!i)<N\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(23) add_leD1 end_simp nat_less_le)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow> fst(q s!i) \\<in> {j. j<N}\") prefer 2 \n  apply (metis mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>fst(q s!i) \\<in> {j. ownB s j = Q \\<and> j<N}\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply (metis (no_types, lifting) One_nat_def end_simp last_conv_nth less_imp_le_nat)\n  apply clarify\n  by (metis Q_owns_bytes_def assms(1) assms(2) ran_indices_lem5)\n\n(*******************************************************************)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(**********************Supporting lemmas for LOCAL W transitions*********************************)\n\n\nlemma case_trans_A2_to_A3_1:\n  shows \"s'=(s\\<lparr>ownT := W, pcW := A3\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> (i\\<le>N)\\<longrightarrow>ownB s' i = ownB s i\"\n  by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A3_2:\n  shows \"s'=(s\\<lparr>ownT := W, pcW := A3\\<rparr>) \\<Longrightarrow> T s=H s\\<Longrightarrow> case_1 s \n            \\<Longrightarrow> case_1 s'\"\n  apply (simp add:case_1_def cW_step_def)\n  apply clarify\n  by (smt (z3) diff_is_0_eq le_trans less_irrefl_nat zero_less_diff)\n\n\nlemma case_trans_A2_to_A4_1:\n  shows \"s'=(s\\<lparr>pcW := A4\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> (i\\<le>N)\\<longrightarrow>ownB s' i = ownB s i\"\n  by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A4_2:\n  shows \"s'=(s\\<lparr>pcW := A4\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> case_1 s'\"\n  by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A4_3:\n  shows \"s'=(s\\<lparr>pcW := A4\\<rparr>) \\<Longrightarrow> case_2 s \\<Longrightarrow> T s>H s\n            \\<Longrightarrow> case_2 s'\"\n  by (simp add:case_2_def cW_step_def)\n\n\n\n\nlemma case_trans_A2_to_A5_1:\n  shows \"s'=(s\\<lparr>pcW := A5\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> (i\\<le>N)\\<longrightarrow>ownB s' i = ownB s i\"\n  by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A5_2:\n  shows \"s'=(s\\<lparr>pcW := A5\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> case_1 s'\"\n  by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A5_3:\n  shows \"s'=(s\\<lparr>pcW := A5\\<rparr>) \\<Longrightarrow> case_2 s \\<Longrightarrow> T s\\<le>H s\n            \\<Longrightarrow> case_2 s'\"\n  by (simp add:case_2_def cW_step_def)\n\n\n\n\n\n\n\nlemma case_trans_A2_to_A8_1:\n  shows \"s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> (i\\<le>N)\\<longrightarrow>ownB s' i = ownB s i\"\n  by (simp add:case_1_def cW_step_def)\n\n\nlemma case_trans_A2_to_A8_2:\n  shows \"s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow> case_1 s \n            \\<Longrightarrow> case_1 s'\"\n  by (simp add:case_1_def cW_step_def)\n\nlemma case_trans_A2_to_A8_3:\n  shows \"s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow> case_2 s \\<Longrightarrow> T s\\<le>H s\n            \\<Longrightarrow> case_2 s'\"\n  by (simp add:case_2_def cW_step_def)\n\nlemma case_trans_A2_to_A8_4:\n  shows \"s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow> case_2 s \\<Longrightarrow> T s>H s\n            \\<Longrightarrow> case_2 s'\"\n  by (simp add:case_2_def cW_step_def)\n\nlemma case_trans_A3_1:\n  shows \"pre_A3_inv s \\<Longrightarrow> case_2 s \\<Longrightarrow> False\"\n  by (simp add:case_2_def pre_A3_inv_def)\n\nlemma case_trans_A3_2:\n  shows \"pre_A3_inv s \\<Longrightarrow>con_assms s\\<Longrightarrow>inv s\\<Longrightarrow> case_1 s\"\n  apply (simp add:pre_A3_inv_def con_assms_def basic_pointer_movement_def inv_def)\n  apply(subgoal_tac \"H s=T s\") prefer 2\n  apply simp apply clarify \n  apply(subgoal_tac \"\\<not>case_2 s\") prefer 2\n  apply (metis case_split_2 less_or_eq_imp_le)\n  by blast\n\nlemma case_trans_A3_to_write_1:\n  shows \"pre_A3_inv s \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if i < Data s (numEnqs s) then W else ownB s i,\n             pcW := Write, offset := 0, H := Data s (numEnqs s), T := 0\\<rparr>)\\<Longrightarrow>inv s\\<Longrightarrow> H s'\\<ge>T s'\"\n  by (simp add:pre_A3_inv_def inv_def)\n\nlemma case_trans_A3_to_write_2:\n  shows \"pre_A3_inv s \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if i < Data s (numEnqs s) then W else ownB s i,\n             pcW := Write, offset := 0, H := Data s (numEnqs s), T := 0\\<rparr>)\\<Longrightarrow>inv s\\<Longrightarrow> \\<not>case_2 s'\"\n  by (simp add:pre_A3_inv_def inv_def case_2_def)\n\nlemma case_trans_A3_to_write_3:\n  shows \"pre_A3_inv s \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if i < Data s (numEnqs s) then W else ownB s i,\n             pcW := Write, offset := 0, H := Data s (numEnqs s), T := 0\\<rparr>)\\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> (i\\<ge>T s' \\<and> i<H s')\\<longrightarrow>ownB s' i=W\"\n  by (simp add:pre_A3_inv_def inv_def case_1_def)\n\nlemma case_trans_A3_to_write_4:\n  shows \"pre_A3_inv s \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if i < Data s (numEnqs s) then W else ownB s i,\n             pcW := Write, offset := 0, H := Data s (numEnqs s), T := 0\\<rparr>)\\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> (i\\<ge>H s'\\<and> i<N)\\<longrightarrow>ownB s' i=B\"\n  by (simp add:pre_A3_inv_def inv_def case_1_def)\n\nlemma case_trans_A3_to_write_7:\n  shows \"pre_A3_inv s \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if i < Data s (numEnqs s) then W else ownB s i,\n             pcW := Write, offset := 0, H := Data s (numEnqs s), T := 0\\<rparr>)\\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> case_1 s'\"\n  apply (simp add:pre_A3_inv_def inv_def case_1_def)\n  apply (rule_tac exI [where x =\"0\"])\n  apply (rule_tac exI [where x =\"0\"]) apply simp\n  apply (subgoal_tac \"Data s (numEnqs s)\\<le>N\")\n  apply (metis case_split_2 le_refl)\n  by blast\n\n\nlemma case_trans_A4_1:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<ge>tW s\\<Longrightarrow> case_1 s \\<Longrightarrow> False\"\n  apply (simp add:case_1_def pre_A4_inv_def)\n  by (metis diff_is_0_eq le_trans less_nat_zero_code)\n\nlemma case_trans_A4_2:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<le>hW s\\<Longrightarrow> case_2 s \\<Longrightarrow> False\"\n  apply (simp add:case_2_def pre_A4_inv_def) \n  by (metis le_antisym less_irrefl_nat less_or_eq_imp_le)\n\nlemma case_trans_A4_3:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s>hW s \\<and> T s<tW s  \\<Longrightarrow> False\"\n  by (simp add:case_2_def pre_A4_inv_def) \n\nlemma case_trans_A4_4:\n  shows \"pre_A4_inv s \\<Longrightarrow> inv s\\<Longrightarrow> T s\\<ge>tW s\\<Longrightarrow> case_2 s\"\n  apply (simp add: pre_A4_inv_def inv_def) using case_trans_A4_1 [where s=s]\n  by (metis case_split_4 less_eqE trans_less_add1) \n\n\nlemma case_trans_A4_5:\n  shows \"pre_A4_inv s \\<Longrightarrow> inv s\\<Longrightarrow> T s\\<le>hW s\\<Longrightarrow> case_1 s\"\n  apply (simp add: pre_A4_inv_def inv_def) using case_trans_A4_2 [where s=s]\n  by (metis RingBuffer_BD_latest_2.case_split) \n\n\nlemma case_trans_A4_to_write_1:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<ge>tW s  \\<Longrightarrow> s'=(s\\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n          offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>) \\<Longrightarrow> inv s \\<Longrightarrow>\n    (i<offset s')\\<longrightarrow>ownB s i=ownB s' i\"\n  by (simp add:case_2_def pre_A4_inv_def inv_def) \n\nlemma case_trans_A4_to_write_2:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<ge>tW s  \\<Longrightarrow> s'=(s\\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n          offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>) \\<Longrightarrow> inv s \\<Longrightarrow>\n    (i\\<ge>H s')\\<longrightarrow>ownB s i=ownB s' i\"\n  by (simp add:case_2_def pre_A4_inv_def inv_def) \n\nlemma case_trans_A4_to_write_3:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<ge>tW s  \\<Longrightarrow> s'=(s\\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n          offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>) \\<Longrightarrow> inv s \\<Longrightarrow>\n    (hW s \\<le>i \\<and> i<H s')\\<longrightarrow>W=ownB s' i\"\n  by (simp add:case_2_def pre_A4_inv_def inv_def) \n\nlemma case_trans_A4_to_write_4:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<ge>tW s  \\<Longrightarrow> s'=(s\\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n          offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>) \\<Longrightarrow> inv s \\<Longrightarrow>\n    T s'=T s\"\n  by (simp add:case_2_def pre_A4_inv_def inv_def) \n\nlemma case_trans_A4_to_write_5:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<ge>tW s  \\<Longrightarrow> s'=(s\\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n          offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>) \\<Longrightarrow> inv s \\<Longrightarrow> con_assms s \\<Longrightarrow>\n    T s'> H s' \\<and> H s<H s' \\<and> T s=T s' \\<and> offset s'=hW s \\<and> Data s (numEnqs s) = Data s' (numEnqs s') \\<and> H s'-H s=Data s (numEnqs s) \\<and> tempR s=tempR s' \\<and> q s=q s' \\<and> ownT s=ownT s'\"\n  apply (simp add:case_2_def pre_A4_inv_def inv_def) \n  by (simp add: le_Suc_ex less_diff_conv) \n\n\nlemma case_trans_A4_to_write_6:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<ge>tW s  \\<Longrightarrow> s'=(s\\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n          offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_2 s\"\n  using case_trans_A4_4 [where s=s] \n  by blast\n\nlemma case_trans_A4_to_write_7:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<ge>tW s  \\<Longrightarrow> s'=(s\\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n          offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_2 s'\"\n  apply(subgoal_tac \"H s'<T s'\") prefer 2 \n  using case_trans_A4_to_write_5 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"H s<H s'\") prefer 2 \n  using case_trans_A4_to_write_5 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"T s=T s'\") prefer 2 \n  using case_trans_A4_to_write_5 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"q s=q s'\") prefer 2 \n  using case_trans_A4_to_write_5 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"ownT s=ownT s'\") prefer 2 \n  using case_trans_A4_to_write_5 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"Data s (numEnqs s) = Data s' (numEnqs s')\") prefer 2 \n  using case_trans_A4_to_write_5 [where s=s and s'=s']\n   apply blast\n  apply(subgoal_tac \"H s'-H s=Data s (numEnqs s)\") prefer 2 \n  using case_trans_A4_to_write_5 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<offset s')\\<longrightarrow>ownB s i=ownB s' i\") prefer 2\n  using case_trans_A4_to_write_1 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(hW s \\<le>i \\<and> i<H s')\\<longrightarrow>W=ownB s' i\") prefer 2\n  using case_trans_A4_to_write_3 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(i\\<ge>H s')\\<longrightarrow>ownB s i=ownB s' i\") prefer 2\n  using case_trans_A4_to_write_2 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"offset s'=hW s\") prefer 2\n  using case_trans_A4_to_write_5 [where s=s and s'=s']\n  apply blast\n  apply(subgoal_tac \"tempR s = tempR s'\") prefer 2\n  using case_trans_A4_to_write_5 [where s=s and s'=s']\n  apply blast\n  apply(unfold inv_def)[1]\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  using case_trans_A4_to_write_6 [where s=s and s'=s']\n  using RingBuffer_BD_latest_2.inv_def apply blast \n  apply(subgoal_tac \"\\<not>case_1 s\") prefer 2\n  using case_trans_A4_1 apply blast\n  apply(unfold pre_A4_inv_def grd1_def grd2_def basic_pointer_movement_def)[1]\n  apply(clarify) \n  apply(thin_tac \"case_2 s\")\n  apply(thin_tac \"\\<not>case_1 s\")\n  apply(thin_tac \"mainInv s\")\n   apply(unfold case_2_def)[1]\n    (*apply instance*) apply clarify\n  apply(rule_tac ?x = \"a\" in exI)\n  apply(rule_tac ?x = \"b\" in exI) \n  apply(rule_tac exI [where x =\"H s'\"])\n  apply(rule_tac exI [where x =\"T s'\"])\n  apply(rule_tac ?x = \"e\" in exI)\n  apply(rule_tac ?x = \"f\" in exI)\n  apply (intro conjI impI)\n  apply blast \n  apply meson\n  apply (metis le_trans less_imp_le_nat)\n  apply meson\n  apply metis\n  apply blast\n  apply meson\n  apply clarify\n  apply(subgoal_tac \"i<a\\<longrightarrow>ownB s i=R\") prefer 2\n  apply (metis zero_le)\n  apply(subgoal_tac \"hW s = b\") prefer 2\n  apply (metis F.distinct(17) F.distinct(23) nat_le_linear nat_less_le zero_le)\n  apply(subgoal_tac \"(i<offset s')\\<longrightarrow>ownB s i=ownB s' i\") prefer 2\n  using case_trans_A4_to_write_1 [where s=s and s'=s']\n  apply metis\n  apply (metis le_trans nat_less_le)\n  apply(subgoal_tac \"i\\<ge>a \\<and> i<b\\<longrightarrow>ownB s i=Q\") prefer 2\n  apply (metis zero_le)\n  apply(subgoal_tac \"(i<offset s')\\<longrightarrow>ownB s i=ownB s' i\") prefer 2\n  using case_trans_A4_to_write_1 [where s=s and s'=s']\n  apply metis\n  apply (metis le_trans nat_less_le)\n  apply (metis le_eq_less_or_eq le_trans)\n  apply(subgoal_tac \"(i\\<ge>H s')\\<longrightarrow>ownB s i=ownB s' i\") prefer 2\n  using case_trans_A4_to_write_1 [where s=s and s'=s']\n  apply metis\n  apply (metis le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"(i\\<ge>H s')\\<longrightarrow>ownB s i=ownB s' i\") prefer 2\n  using case_trans_A4_to_write_1 [where s=s and s'=s']\n  apply metis\n  apply (metis le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"(i\\<ge>H s')\\<longrightarrow>ownB s i=ownB s' i\") prefer 2\n  using case_trans_A4_to_write_1 [where s=s and s'=s']\n  apply metis\n  apply (metis le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"(i\\<ge>H s')\\<longrightarrow>ownB s i=ownB s' i\") prefer 2\n  using case_trans_A4_to_write_1 [where s=s and s'=s']\n  apply metis\n  apply (metis le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"(i\\<ge>H s')\\<longrightarrow>ownB s i=ownB s' i\") prefer 2\n  using case_trans_A4_to_write_1 [where s=s and s'=s']\n  apply metis\n  apply (metis le_trans less_or_eq_imp_le)\n  apply meson\n  apply metis\n  apply metis\n  apply (metis gr_zeroI less_nat_zero_code)\n  apply meson\n  apply force\n  apply (metis F.distinct(17) F.distinct(23) less_eq_nat.simps(1) nat_le_linear nat_less_le)\n  apply(subgoal_tac \"b=H s\") prefer 2\n  apply (metis F.distinct(17) F.distinct(23) less_eq_nat.simps(1) nat_le_linear nat_less_le)\n  apply(subgoal_tac \"H s'-H s=Data s (numEnqs s)\") prefer 2\n  apply meson\n  apply metis\n  apply metis\n  apply metis\n  apply metis\n  apply metis\n  apply metis\n  apply metis\n  apply metis\n  apply metis\n  apply metis\n  apply metis\n  apply metis\n  by metis\n \n\n\n\n\nlemma case_trans_A4_to_write_8:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<le>H s  \\<Longrightarrow> s'=(s\\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n          offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s\"\n  using case_trans_A4_5 [where s=s] apply (simp add:case_1_def)\n  by (simp add: pre_A4_inv_def)\n\n\nlemma case_trans_A4_to_write_9:\n  shows \"pre_A4_inv s \\<Longrightarrow> T s\\<le>H s  \\<Longrightarrow> s'=(s\\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i, pcW := Write,\n          offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s'\"\n  apply(simp add:inv_def)\n  using case_trans_A4_to_write_8 [where s=s] \n  apply (meson case_split_2) apply(simp add:pre_A4_inv_def)\n  apply(simp add:case_1_def)\n  apply(intro conjI impI) prefer 2\n   apply clarify\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = b in exI) apply(intro conjI impI) prefer 2\n  apply(rule_tac ?x = \"hW s\" in exI)\n  apply(intro conjI impI)\n  apply(linarith)\n  apply(linarith)\n  apply clarify apply(intro conjI impI) apply clarify\n  apply linarith\n  apply metis\n  apply (metis le_neq_implies_less le_trans less_imp_le_nat)\n  apply (metis le_eq_less_or_eq)\n  apply blast\n  apply (metis add_leE)\n  apply blast\n  apply blast\n  apply blast\n  apply (metis add_diff_cancel_left')\n  apply meson\n  apply meson\n  apply (metis le_refl nat_less_le)\n  apply (metis nat_less_le) \n  apply (metis le_refl nat_less_le)\n  apply (metis le_refl nat_less_le)\n  apply (metis le_refl nat_less_le)\n  apply (metis le_refl nat_less_le)\n  apply (metis le_refl nat_less_le)\n  by (metis (no_types, lifting) add.commute add_lessD1 less_diff_conv less_eqE less_imp_add_positive not_add_less1)\n\n\n\n\n\n\nlemma case_trans_A5_1:\n  shows \"pre_A5_inv s \\<Longrightarrow> inv s\\<Longrightarrow> case_1 s\"\n  apply (simp add: pre_A5_inv_def inv_def)\n  by (metis RingBuffer_BD_latest_2.case_split) \n\nlemma case_trans_A5_2:\n  shows \"pre_A5_inv s \\<Longrightarrow> inv s\\<Longrightarrow> \\<not>case_2 s\"\n  apply (simp add: pre_A5_inv_def inv_def)\n  by (metis case_split_2)\n\n\nlemma case_trans_A5_to_A6_1:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A6\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    i\\<le>N\\<longrightarrow>ownB s i=ownB s' i\"\n  by(simp add:case_1_def pre_A5_inv_def inv_def)\n\n\nlemma case_trans_A5_to_A6_2:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A6\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s' = case_1 s\"\n  by(simp add:case_1_def)\n\nlemma case_trans_A5_to_A6_3:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A6\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s'\"\n  using case_trans_A5_to_A6_2 [where s=s and s'=s']\n  using case_trans_A5_1 by blast\n\n\nlemma case_trans_A5_to_A6_4:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A7\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    i\\<le>N\\<longrightarrow>ownB s i=ownB s' i\"\n  by(simp add:case_1_def pre_A5_inv_def inv_def)\n\nlemma case_trans_A5_to_A6_5:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A7\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s' = case_1 s\"\n  by(simp add:case_1_def)\n\nlemma case_trans_A5_to_A6_6:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A7\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s'\"\n  using case_trans_A5_to_A6_5 [where s=s and s'=s']\n  using case_trans_A5_1 by blast\n\n\nlemma case_trans_A5_to_A6_7:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    i\\<le>N\\<longrightarrow>ownB s i=ownB s' i\"\n  by(simp add:case_1_def pre_A5_inv_def inv_def)\n\n\nlemma case_trans_A5_to_A6_8:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s' = case_1 s\"\n  by(simp add:case_1_def)\n\n\nlemma case_trans_A5_to_A6_9:\n  shows \"pre_A5_inv s  \\<Longrightarrow> s'=(s\\<lparr>pcW := A8\\<rparr>) \\<Longrightarrow>con_assms s \\<Longrightarrow> inv s \\<Longrightarrow>\n    case_1 s'\"\n  using case_trans_A5_to_A6_7 [where s=s and s'=s']\n  by (metis case_trans_A2_to_A8_2 case_trans_A5_1)\n\n\nlemma case_trans_A6_1:\n  shows \"pre_A6_inv s \\<Longrightarrow> inv s\\<Longrightarrow> case_1 s\"\n  apply (simp add: pre_A6_inv_def inv_def) \n  by (metis RingBuffer_BD_latest_2.case_split) \n\nlemma case_trans_A6_2:\n  shows \"pre_A6_inv s \\<Longrightarrow> inv s\\<Longrightarrow> case_2 s \\<Longrightarrow> False\"\n  apply (simp add: pre_A6_inv_def inv_def)\n  by (metis case_split_2)\n\n\n\nlemma case_trans_A6_to_write_1:\n  shows \"pre_A6_inv s \\<Longrightarrow> s' = s\n    \\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i,\n       pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>\\<Longrightarrow>inv s\\<Longrightarrow> H s'\\<ge>T s'\"\n  by (simp add:pre_A6_inv_def inv_def)\n\nlemma case_trans_A6_to_write_2:\n  shows \"pre_A6_inv s \\<Longrightarrow> s' = s\n    \\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i,\n       pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>\\<Longrightarrow>inv s\\<Longrightarrow>con_assms s\\<Longrightarrow> \\<not>case_2 s'\"\n  by (simp add:pre_A6_inv_def inv_def case_2_def)\n\nlemma case_trans_A6_to_write_3:\n  shows \"pre_A6_inv s \\<Longrightarrow> s' = s\n    \\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i,\n       pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>\\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> (i\\<ge>hW s' \\<and> i<H s')\\<longrightarrow>ownB s' i=W\"\n  by (simp add:pre_A6_inv_def inv_def case_1_def)\n\nlemma case_trans_A6_to_write_4:\n  shows \"pre_A6_inv s \\<Longrightarrow> s' = s\n    \\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i,\n       pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>\\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> (i\\<ge>H s'\\<and> i<N)\\<longrightarrow>ownB s' i=B\"\n  by (simp add:pre_A6_inv_def inv_def case_1_def)\n\nlemma case_trans_A6_to_write_7:\n  shows \"pre_A6_inv s \\<Longrightarrow> s' = s\n    \\<lparr>ownB := \\<lambda>i. if hW s \\<le> i \\<and> i < hW s + Data s (numEnqs s) then W else ownB s i,\n       pcW := Write, offset := hW s, H := hW s + Data s (numEnqs s)\\<rparr>\\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> case_1 s'\"\n  apply(subgoal_tac \"\\<not>case_2 s\") prefer 2\n  using case_trans_A6_to_write_2 [where s=s and s'=s']\n  using case_trans_A6_2 apply blast\n  apply (simp add:pre_A6_inv_def inv_def case_1_def)\n  apply(intro conjI impI) \n  apply (metis (no_types, lifting) add_le_cancel_left le_add_diff_inverse le_antisym less_imp_le_nat nat_neq_iff)\n  apply clarify\n  apply (rule_tac exI [where x =\"T s\"]) \n  apply(rule_tac ?x = \"b\" in exI) apply (intro conjI impI)\n  apply blast \n  apply(rule_tac ?x = \"c\" in exI)\n  apply (intro conjI impI)\n  apply linarith\n  apply linarith \n  apply (metis le_trans nat_less_le)\n  apply (metis le_trans nat_less_le)\n  apply (metis le_trans nat_less_le)\n  apply (metis F.distinct(17) F.distinct(23) le_refl nat_less_le nat_neq_iff)\n  apply (metis)\n  apply (metis le_trans nat_less_le)\n  apply (metis le_neq_implies_less le_refl le_trans)\n  apply (metis Nat.add_diff_assoc2 diff_self_eq_0 le_refl le_trans nat_less_le plus_nat.add_0)\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  by meson\n\n\n\nlemma case_trans_A7_1:\n  shows \"pre_A7_inv s \\<Longrightarrow> inv s\\<Longrightarrow> case_1 s\"\n  apply (simp add: pre_A7_inv_def inv_def) \n  by (metis RingBuffer_BD_latest_2.case_split) \n\nlemma case_trans_A7_2:\n  shows \"pre_A7_inv s \\<Longrightarrow> inv s\\<Longrightarrow> case_2 s \\<Longrightarrow> False\"\n  apply (simp add: pre_A7_inv_def inv_def)\n  by (metis case_split_2)\n\nlemma case_trans_A7_to_write_1:\n  shows \"pre_A7_inv s \\<Longrightarrow> s' = (s\\<lparr>ownB :=\n          \\<lambda>i. if hW s \\<le> i \\<and> i < N then D\n              else ownB (s\\<lparr>ownB := \\<lambda>i. if i < Data s (numEnqs s) then W else ownB s i\\<rparr>) i,\n          pcW := Write, offset := 0, H := Data s (numEnqs s)\\<rparr>)\\<Longrightarrow>inv s\\<Longrightarrow> H s'<T s'\"\n  by (simp add:pre_A7_inv_def inv_def)\n\nlemma case_trans_A7_to_write_2:\n  shows \"pre_A7_inv s \\<Longrightarrow> s' = (s\\<lparr>ownB :=\n          \\<lambda>i. if hW s \\<le> i \\<and> i < N then D\n              else ownB (s\\<lparr>ownB := \\<lambda>i. if i < Data s (numEnqs s) then W else ownB s i\\<rparr>) i,\n          pcW := Write, offset := 0, H := Data s (numEnqs s)\\<rparr>)\\<Longrightarrow>inv s\\<Longrightarrow>con_assms s\\<Longrightarrow> \\<not>case_1 s'\"\n  by (simp add:pre_A7_inv_def inv_def case_1_def)\n  \n\n\n\nlemma case_trans_A7_to_write_3:\n  shows \"pre_A7_inv s \\<Longrightarrow> s' = (s\\<lparr>ownB :=\n          \\<lambda>i. if hW s \\<le> i \\<and> i < N then D\n              else ownB (s\\<lparr>ownB := \\<lambda>i. if i < Data s (numEnqs s) then W else ownB s i\\<rparr>) i,\n          pcW := Write, offset := 0, H := Data s (numEnqs s)\\<rparr>)\\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> (i\\<ge>0 \\<and> i<H s')\\<longrightarrow>ownB s' i=W\"\n  by (simp add:pre_A7_inv_def inv_def case_2_def)\n\nlemma case_trans_A7_to_write_4:\n  shows \"pre_A7_inv s \\<Longrightarrow> s' = (s\\<lparr>ownB :=\n          \\<lambda>i. if hW s \\<le> i \\<and> i < N then D\n              else ownB (s\\<lparr>ownB := \\<lambda>i. if i < Data s (numEnqs s) then W else ownB s i\\<rparr>) i,\n          pcW := Write, offset := 0, H := Data s (numEnqs s)\\<rparr>)\\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> (i\\<ge>hW s\\<and> i<N)\\<longrightarrow>ownB s' i=D\"\n  by (simp add:pre_A7_inv_def inv_def case_2_def)\n\nlemma case_trans_A7_to_write_7:\n  shows \"pre_A7_inv s \\<Longrightarrow> s' = (s\\<lparr>ownB :=\n          \\<lambda>i. if hW s \\<le> i \\<and> i < N then D\n              else ownB (s\\<lparr>ownB := \\<lambda>i. if i < Data s (numEnqs s) then W else ownB s i\\<rparr>) i,\n          pcW := Write, offset := 0, H := Data s (numEnqs s)\\<rparr>)\\<Longrightarrow>inv s\\<Longrightarrow> con_assms s\\<Longrightarrow> case_2 s'\"\n  apply(subgoal_tac \"\\<not>case_2 s\") prefer 2\n  using case_trans_A7_to_write_2 [where s=s and s'=s']\n  using case_trans_A7_2 apply blast \n  apply (simp add:pre_A7_inv_def inv_def) apply(thin_tac \"\\<not>case_2 s\") apply(simp add:case_1_def case_2_def)\n  \n  apply clarify\n  apply(rule_tac ?x = \"0\" in exI) \n  apply(rule_tac ?x = \"0\" in exI) apply (intro conjI impI)\n  apply blast \n  apply(rule_tac ?x = \"Data s (numEnqs s)\" in exI)\n  apply (intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply (intro conjI impI) \n  apply linarith \n  apply(rule_tac ?x = \"b\" in exI) \n  apply (intro conjI impI) \n  apply linarith \n  apply(rule_tac ?x = \"c\" in exI) \n  apply (intro conjI impI) \n  apply linarith \n  apply (metis le_trans)\n  apply blast\n  apply blast\n  apply blast  \n  apply (metis le_antisym le_trans nat_less_le) \n  apply (metis le_antisym le_trans nat_less_le)\n  apply (metis le_antisym le_trans nat_less_le)\n  apply (metis le_trans nat_le_linear nat_less_le)\n  apply blast\n  apply fastforce\n  apply blast  \n  apply blast  \n  apply metis\n  apply blast\n  apply blast\n  apply blast \n  apply (metis diff_zero) \n  apply force\n  apply fastforce\n  apply meson\n  apply meson \n  apply (metis zero_less_iff_neq_zero)\n  apply force\n  apply force\n  apply force\n  apply fastforce\n  apply meson\n  by (metis le_neq_implies_less)\n  \n\n\n\n\nlemma case_trans_Enqueue_to_idleW_case_1_1:\n  shows \"pre_enqueue_inv s \\<Longrightarrow> inv s\\<Longrightarrow> s'= (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s),\n          ownB :=\n            \\<lambda>i. if ownB s i = W \\<and> i \\<le> N then Q else ownB (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s)\\<rparr>) i,\n          pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\<rparr>) \\<Longrightarrow>case_1 s \\<Longrightarrow> con_assms s\n      \\<Longrightarrow> H s\\<ge>T s\"\n  apply (simp add: pre_enqueue_inv_def inv_def case_1_def)\n  by (metis (no_types, lifting) le_trans) \n\nlemma case_trans_Enqueue_to_idleW_case_1_2:\n  shows \"pre_enqueue_inv s \\<Longrightarrow> inv s\\<Longrightarrow> s'= (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s),\n          ownB :=\n            \\<lambda>i. if ownB s i = W \\<and> i \\<le> N then Q else ownB (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s)\\<rparr>) i,\n          pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\<rparr>) \\<Longrightarrow>case_1 s \\<Longrightarrow> con_assms s\n      \\<Longrightarrow> H s'\\<ge>T s'\"\n  apply (simp add: pre_enqueue_inv_def inv_def case_1_def) \n  by (metis (no_types, lifting) le_trans)\n\nlemma case_trans_Enqueue_to_idleW_case_1_3:\n  shows \"pre_enqueue_inv s \\<Longrightarrow> inv s\\<Longrightarrow> s'= (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s),\n          ownB :=\n            \\<lambda>i. if ownB s i = W \\<and> i \\<le> N then Q else ownB (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s)\\<rparr>) i,\n          pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\<rparr>) \\<Longrightarrow>case_1 s \\<Longrightarrow> con_assms s\n      \\<Longrightarrow> i<offset s\\<Longrightarrow>ownB s i=ownB s' i\"\n  by (simp add: pre_enqueue_inv_def inv_def case_1_def) \n\nlemma case_trans_Enqueue_to_idleW_case_1_4:\n  shows \"pre_enqueue_inv s \\<Longrightarrow> inv s\\<Longrightarrow> s'= (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s),\n          ownB :=\n            \\<lambda>i. if ownB s i = W \\<and> i \\<le> N then Q else ownB (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s)\\<rparr>) i,\n          pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\<rparr>) \\<Longrightarrow>case_1 s \\<Longrightarrow> con_assms s\n      \\<Longrightarrow> i\\<ge>H s'\\<and> i\\<le>N\\<Longrightarrow>ownB s i=ownB s' i\"\n  apply (simp add: pre_enqueue_inv_def inv_def case_1_def)\n  by (metis F.distinct(5) F.distinct(9) nat_less_le)\n\nlemma case_trans_Enqueue_to_idleW_case_1_5:\n  shows \"pre_enqueue_inv s \\<Longrightarrow> inv s\\<Longrightarrow> s'= (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s),\n          ownB :=\n            \\<lambda>i. if ownB s i = W \\<and> i \\<le> N then Q else ownB (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s)\\<rparr>) i,\n          pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\<rparr>) \\<Longrightarrow>case_1 s \\<Longrightarrow> con_assms s\n      \\<Longrightarrow> offset s \\<le> i \\<and> i < offset s + Data s (numEnqs s) \\<Longrightarrow>Q=ownB s' i\"\n  by (simp add: pre_enqueue_inv_def inv_def case_1_def tempW_def) \n\n\n\n\n\nlemma case_trans_Enqueue_to_idleW_case_1_6:\n  shows \"pre_enqueue_inv s \\<Longrightarrow> inv s\\<Longrightarrow> q s = [] \\<Longrightarrow> s'= (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s),\n          ownB :=\n            \\<lambda>i. if ownB s i = W \\<and> i \\<le> N then Q else ownB (s\\<lparr>ownT := Q, numEnqs := Suc (numEnqs s)\\<rparr>) i,\n          pcW := idleW, q := [(offset s, Data s (numEnqs s))]\\<rparr>) \\<Longrightarrow>case_1 s \\<Longrightarrow> con_assms s\n     \\<Longrightarrow>case_1 s'\"\n  apply(simp add:inv_def)\n  apply(subgoal_tac \"\\<not>case_2 s \") prefer 2\n  apply (meson case_split_5) apply(thin_tac \"\\<not> case_2 s\")\n  apply (simp add: pre_enqueue_inv_def inv_def case_1_def tempW_def) \n  apply clarify apply simp\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = \"b\" in exI) apply (intro conjI impI)\n  apply meson\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply (intro conjI impI)\n  apply (metis F.distinct(5))\n  apply (metis (mono_tags, hide_lams) le_trans less_or_eq_imp_le linorder_neqE_nat) \n  apply (metis F.distinct(5)) \n  apply (metis F.distinct(1))\n  apply (metis le_trans less_or_eq_imp_le)\n  apply (metis Suc_leI not_less_eq_eq)\n  apply blast\n  apply (metis less_irrefl_nat)\n  apply (metis less_irrefl_nat)\n  apply meson\n  apply meson \n  apply (metis (no_types, hide_lams) F.distinct(1) F.distinct(5) diff_diff_left diff_is_0_eq' linorder_neqE_nat nat_add_left_cancel_less nat_le_linear zero_less_diff)\n  apply metis\n  by (metis F.distinct(1) F.distinct(5) Suc_pred bot_nat_0.not_eq_extremum diff_0_eq_0 diff_Suc_Suc diff_diff_cancel diff_diff_left diff_is_0_eq diff_is_0_eq' diff_self_eq_0 le_refl less_nat_zero_code linorder_neqE_nat nat_add_left_cancel_less nat_le_linear not0_implies_Suc old.nat.inject zero_less_Suc zero_less_diff)\n\n            \n            \n\n\n\n\n\nlemma case_trans_Write_to_Enqueue_case_1:\n  shows \"pre_write_inv s \\<Longrightarrow> inv s\\<Longrightarrow> s'=s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n       ownD :=\n         \\<lambda>i. if i = numWrites s then B\n             else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n       data_index :=\n         \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s\n             else data_index\n                   (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                        ownD :=\n                          \\<lambda>i. if i = numWrites s then B\n                              else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>)\n                   x\\<rparr> \\<Longrightarrow>case_1 s \\<Longrightarrow> con_assms s\n     \\<Longrightarrow>case_1 s'\"\n  by (simp add:pre_write_inv_def case_1_def)\n\n\nlemma case_trans_Write_to_Enqueue_case_2:\n  shows \"pre_write_inv s \\<Longrightarrow> inv s\\<Longrightarrow> s'=s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n       ownD :=\n         \\<lambda>i. if i = numWrites s then B\n             else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n       data_index :=\n         \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s\n             else data_index\n                   (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                        ownD :=\n                          \\<lambda>i. if i = numWrites s then B\n                              else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>)\n                   x\\<rparr> \\<Longrightarrow>case_2 s \\<Longrightarrow> con_assms s\n     \\<Longrightarrow>case_2 s'\"\n  by (simp add:pre_write_inv_def case_2_def)\n\nlemma case_trans_Write_to_Enqueue_case_3:\n  shows \"pre_write_inv s \\<Longrightarrow> inv s\\<Longrightarrow> s'=s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n       ownD :=\n         \\<lambda>i. if i = numWrites s then B\n             else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n       data_index :=\n         \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s\n             else data_index\n                   (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                        ownD :=\n                          \\<lambda>i. if i = numWrites s then B\n                              else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>)\n                   x\\<rparr> \\<Longrightarrow>case_1 s \\<or> case_2 s \\<Longrightarrow> con_assms s\n     \\<Longrightarrow>case_1 s' \\<or> case_2 s'\"\n  by (simp add:pre_write_inv_def case_1_def case_2_def)\n\nlemma case_trans_Write_to_Enqueue_case_4:\n  shows \" s'=s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n       ownD :=\n         \\<lambda>i. if i = numWrites s then B\n             else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n       data_index :=\n         \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s\n             else data_index\n                   (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                        ownD :=\n                          \\<lambda>i. if i = numWrites s then B\n                              else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>)\n                   x\\<rparr> \n     \\<Longrightarrow>\\<forall>i::nat. ownB s i=ownB s' i \\<and> T s = T s' \\<and> H s = H s' \\<and> offset s = offset s' \\<and> tempR s=tempR s' \\<and> q s=q s'\"\n  by simp \n\n(************************************* queue transition lemmas **************************************************)\n\n\n\nlemma peculiar_1:\n  assumes \"Q_gap_structure s\"\n  and \"Q_offsets_differ s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\n  shows \"fst(q s!1) = end(q s!0) \\<or> fst(q s!1) =0\"\n  using assms apply(simp add:Q_gap_structure_def Q_offsets_differ_def Q_structure_def) \n  by (metis One_nat_def diff_add_zero length_greater_0_conv length_tl less_numeral_extra(1) plus_1_eq_Suc zero_less_diff)\n  \nlemma peculiar_2:\n  assumes \"Q_gap_structure s\"\n  and \"Q_offsets_differ s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\n  shows \"(end(hd(q s)) = fst(hd(tl(q s)))\\<and> fst(hd(tl(q s)))\\<noteq>0) \\<or> fst(hd(tl(q s))) =0\"\n  using assms apply(simp add:Q_gap_structure_def Q_offsets_differ_def Q_structure_def) \n  by (metis Nitpick.size_list_simp(2) One_nat_def diff_add_zero hd_conv_nth less_Suc_eq_0_disj not_gr_zero nth_tl plus_1_eq_Suc)\n  \nlemma peculiar_3:\n  assumes \"Q_structure s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"(end(hd(q s)) = fst(hd(tl(q s)))\\<and> fst(hd(tl(q s)))\\<noteq>0) \\<or> fst(hd(tl(q s))) =0\"\n  using peculiar_1 peculiar_2 Q_structure_def Q_basic_struct_def \nproof -\n  have \"Q_basic_struct s\"\nby (metis (no_types) Nil_tl Q_structure_def assms(1) assms(3))\nthen show ?thesis\nby (metis Nil_tl Q_basic_struct_def assms(3) peculiar_2)\nqed\n\nlemma peculiar_4:\n  assumes \"Q_offsets_differ s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i.(i<length(q s) \\<and> i>0)\\<longrightarrow>fst(q s!0) \\<noteq> fst(q s!i)\"\n  using assms by (simp add:Q_offsets_differ_def) \n\nlemma peculiar_5:\n  assumes \"Q_offsets_differ s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i.(i<length(q s) \\<and> i>0)\\<longrightarrow>fst(hd(q s)) \\<noteq> fst(q s!i)\"\n  using assms peculiar_4 \n  by (simp add: peculiar_4 hd_conv_nth)\n\nlemma peculiar_6:\n  assumes \"Q_offsets_differ s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i.(i<length(tl(q s)))\\<longrightarrow>fst(hd(q s)) \\<noteq> fst(tl(q s)!i)\"\n  using peculiar_4 peculiar_5 \n  by (simp add: Q_head_relates_tail assms(1) assms(2) hd_conv_nth)\n\nlemma peculiar_7:\n  assumes \"Q_offsets_differ s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i.(i<(length((q s))-1))\\<longrightarrow>fst(hd(q s)) \\<noteq> fst(tl(q s)!i)\"\n  using assms peculiar_6 \n  by (simp add: peculiar_6)\n\nlemma peculiar_8:\n  assumes \"Q_has_no_overlaps s\"\n  and \"Q_has_no_uroboros s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>x.(x\\<in>set(q s) \\<and> x\\<noteq>hd(q s) \\<and> fst(hd(q s))<fst(x))\\<longrightarrow>end(hd(q s))\\<le>fst(x)\"\n  using assms Q_has_no_overlaps_def Q_has_no_uroboros_def\n  using hd_in_set by blast\n\nlemma peculiar_9:\n  assumes \"Q_has_no_overlaps s\"\n  and \"Q_has_no_uroboros s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>x.(x\\<in>set(tl(q s)) \\<and> fst(hd(q s))<fst(x))\\<longrightarrow>end(hd(q s))\\<le>fst(x)\"\n  using peculiar_8 \n  by (metis assms(1) assms(2) assms(3) assms(4) dual_order.irrefl list.set_sel(2))\n\nlemma peculiar_10:\n  assumes \"Q_has_no_overlaps s\"\n  and \"Q_has_no_uroboros s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i.(i<(length(q s)-1) \\<and> fst(hd(q s))<fst(tl(q s)!i))\\<longrightarrow>end(hd(q s))\\<le>fst(tl(q s)!i)\"\n  by (metis assms(1) assms(2) assms(3) assms(4) length_tl nth_mem peculiar_9)\n\nlemma peculiar_11:\n  assumes \"Q_has_no_overlaps s\"\n  and \"Q_has_no_uroboros s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>x.(x\\<in>set(q s) \\<and> x\\<noteq>hd(q s) \\<and> fst(hd(q s))>fst(x))\\<longrightarrow>fst(hd(q s))\\<ge>end(x)\"\n  using assms Q_has_no_overlaps_def Q_has_no_uroboros_def \n  using hd_in_set by blast\n\nlemma peculiar_12:\n  assumes \"Q_has_no_overlaps s\"\n  and \"Q_has_no_uroboros s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>x.(x\\<in>set(tl(q s)) \\<and> fst(hd(q s))>fst(x))\\<longrightarrow>fst(hd(q s))\\<ge>end(x)\"\n  using assms Q_has_no_overlaps_def peculiar_11 \n  by (metis list.set_sel(2))\n\nlemma peculiar_13:\n  assumes \"Q_has_no_overlaps s\"\n  and \"Q_has_no_uroboros s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i.(i<(length(q s)-1) \\<and> fst(hd(q s))>fst(tl(q s)!i))\\<longrightarrow>fst(hd(q s))\\<ge>end(tl(q s)!i)\"\n  using assms peculiar_12 \n  by (metis length_tl nth_mem)\n\nlemma peculiar_14:\n  assumes \"Q_has_no_overlaps s\"\n  and \"Q_has_no_uroboros s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"(\\<forall>i.(i<(length(q s)-1) \\<and> fst(hd(q s))>fst(tl(q s)!i))\\<longrightarrow>fst(hd(q s))\\<ge>end(tl(q s)!i))\n      \\<and>(\\<forall>i.(i<(length(q s)-1) \\<and> fst(hd(q s))<fst(tl(q s)!i))\\<longrightarrow>end(hd(q s))\\<le>fst(tl(q s)!i))\"\n  using peculiar_13 peculiar_10 \n  using assms(1) assms(2) assms(3) assms(4) by blast\n\nlemma peculiar_15:\n  assumes \"Q_has_no_overlaps s\"\n  and \"Q_has_no_uroboros s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i<length (q s) - Suc 0.\n       (fst (hd (q s)) < fst (tl (q s) ! i) \\<longrightarrow>\n        fst (hd (q s)) + snd (hd (q s)) \\<le> fst (tl (q s) ! i)) \\<and>\n       (fst (tl (q s) ! i) < fst (hd (q s)) \\<longrightarrow>\n        fst (tl (q s) ! i) + snd (tl (q s) ! i) \\<le> fst (hd (q s)))\"\n  using peculiar_14 \n  by (metis One_nat_def assms(1) assms(2) assms(3) assms(4) end_simp)\n\n\nlemma peculiar_16:\n  assumes \"Q_structure s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i<length (q s) - Suc 0.\n       (fst (hd (q s)) < fst (tl (q s) ! i) \\<longrightarrow>\n        fst (hd (q s)) + snd (hd (q s)) \\<le> fst (tl (q s) ! i)) \\<and>\n       (fst (tl (q s) ! i) < fst (hd (q s)) \\<longrightarrow>\n        fst (tl (q s) ! i) + snd (tl (q s) ! i) \\<le> fst (hd (q s)))\"\n  using peculiar_15 Q_structure_def \n  using Q_basic_struct_def assms(1) assms(2) assms(3) by auto\n\nlemma peculiar_17 :\n  assumes \"inv s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i<length (q s) - Suc 0.\n       (fst (hd (q s)) < fst (tl (q s) ! i) \\<longrightarrow>\n        fst (hd (q s)) + snd (hd (q s)) \\<le> fst (tl (q s) ! i)) \\<and>\n       (fst (tl (q s) ! i) < fst (hd (q s)) \\<longrightarrow>\n        fst (tl (q s) ! i) + snd (tl (q s) ! i) \\<le> fst (hd (q s)))\"\n  using peculiar_16 inv_def Q_structure_def \n  using assms(1) assms(2) assms(3) by blast\n\nlemma peculiar_18:\n  assumes \"Q_has_no_uroboros s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"fst (q s!0) \\<noteq> end (last (q s))\"\n  using Q_has_no_uroboros_def \n  by (metis assms(1) assms(2) assms(3) butlast.simps(2) list.exhaust_sel list.set_intros(1) nth_Cons_0)\n\nlemma peculiar_19:\n  assumes \"Q_structure s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"fst (q s!0) \\<noteq> end (last (q s))\"\n  using Q_has_no_uroboros_def Q_structure_def peculiar_18 \n  using Q_basic_struct_def assms(1) assms(2) assms(3) by blast\n\nlemma peculiar_20:\n  assumes \"Q_structure s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"fst (hd(q s)) \\<noteq> end (last (q s))\"\n  using peculiar_19\n  by (metis assms(1) assms(2) assms(3) hd_conv_nth)\n\nlemma peculiar_21:\n  assumes \"Q_structure s\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"fst (hd(q s)) \\<noteq> end (last (tl(q s)))\"\n  using peculiar_20\n  by (metis assms(1) assms(2) assms(3) last_tl)\n\nlemma peculiar_22:\n  assumes \"Q_structure s\"\n  and \"tempR_structure s\"\n  and \"fst(tempR s) =0\"\nshows \"\\<forall>i.(i<length(q s)\\<and> i>0)\\<longrightarrow>fst(q s!i) = end(q s!(i-1))\"\n  using assms apply (simp add:Q_lemmas Q_basic_lemmas tempR_lemmas tempR_basic_lemmas)\n  by (metis length_0_conv less_nat_zero_code)\n\nlemma peculiar_23:\n  assumes \"Q_structure s\"\n  and \"tempR_structure s\"\n  and \"fst(tempR s) =0\"\nshows \"\\<forall>i.(i<length(q s))\\<longrightarrow>fst(q s!i) >0\"\n  using assms apply (simp add:Q_lemmas Q_basic_lemmas tempR_lemmas tempR_basic_lemmas)\n  by (metis length_0_conv less_nat_zero_code)\n\nlemma peculiar_24:\n  assumes \"Q_structure s\"\n  and \"tempR_structure s\"\n  and \"fst(tempR s) =0\"\n  and \"q s\\<noteq>[]\" and \"tl(q s)\\<noteq>[]\"\nshows \"fst(q s!0) =end(tempR s)\"\n  using assms apply (simp add:Q_lemmas Q_basic_lemmas tempR_lemmas tempR_basic_lemmas)\n  by (metis hd_conv_nth length_greater_0_conv zero_less_iff_neq_zero)\n\nlemma peculiar_25:\n  assumes \"Q_offsets_differ s\"\n  and \"Q_gap_structure s\"\n  and \"fst(hd(q s)) =0\"\n  and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i.(i<length(q s)\\<and>i>0)\\<longrightarrow>fst(q s!i) = end(q s!(i-1))\"\n  using assms \n  by (metis Q_hd_zero_implies_structure)\n\nlemma peculiar_26:\n  assumes \"Q_offsets_differ s\"\n  and \"Q_gap_structure s\"\n  and \"fst(hd(q s)) =0\"\n  and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i.(i<length(q s)\\<and>i>0)\\<longrightarrow>(q s!i) = (tl(q s)!(i-1))\"\n  using assms apply(simp add:Q_lemmas Q_basic_lemmas)\n  by (metis Nitpick.size_list_simp(2) Suc_pred add_less_cancel_left list.sel(2) nth_tl plus_1_eq_Suc)\n\n\nlemma peculiar_27:\n  assumes \"Q_offsets_differ s\"\n  and \"Q_gap_structure s\"\n  and \"fst(hd(q s)) =0\"\n  and \"tl(q s)\\<noteq>[]\"\nshows \"\\<forall>i.(i<length(q s)\\<and>i>1)\\<longrightarrow>fst(tl(q s)!(i-1)) = end(tl(q s)!(i-2))\"\n  using assms apply(simp add:Q_lemmas Q_basic_lemmas)\n  by (smt (verit, ccfv_SIG) Nitpick.size_list_simp(2) Suc_diff_Suc add_less_cancel_left assms(1) assms(2) diff_less less_trans_Suc list.sel(2) nth_tl numeral_1_eq_Suc_0 numeral_2_eq_2 numerals(1) peculiar_26 peculiar_5 plus_1_eq_Suc zero_less_two)\n\n\n\n\nlemma peculiar_28:\n  assumes \"Q_offsets_differ s\"\n  and \"Q_gap_structure s\"\n  and \"Q_has_no_uroboros s\"\n  and \"fst(hd(q s)) =0\"\n  and \"tl(q s)\\<noteq>[]\"\n  and \"butlast(tl(q s))\\<noteq>[]\"\nshows \"last(tl(q s)) =last(q s)\"\n  using assms \n  by (simp add: last_tl)\n\n\n\nlemma peculiar_29:\n  assumes \"Q_offsets_differ s\"\n  and \"Q_gap_structure s\"\n  and \"Q_has_no_uroboros s\"\n  and \"fst(hd(q s)) =0\"\n  and \"tl(q s)\\<noteq>[]\"\n  and \"butlast(tl(q s))\\<noteq>[]\"\nshows \"\\<forall>i.(i<length(butlast(tl(q s))))\\<longrightarrow>(tl(q s)!i) = (q s!(i+1))\"\n  using assms \n  by (simp add: peculiar_26)\n\nlemma peculiar_30:\n  assumes \"Q_offsets_differ s\"\n  and \"Q_gap_structure s\"\n  and \"Q_has_no_uroboros s\"\n  and \"fst(hd(q s)) =0\"\n  and \"tl(q s)\\<noteq>[]\"\n  and \"butlast(tl(q s))\\<noteq>[]\"\nshows \"end(last(q s)) = end(last(tl(q s)))\"\n  using assms \n  by (simp add: last_tl)\n\n\nlemma peculiar_31:\n  assumes \"Q_offsets_differ s\"\n  and \"Q_gap_structure s\"\n  and \"Q_has_no_uroboros s\"\n  and \"fst(hd(q s)) =0\"\n  and \"tl(q s)\\<noteq>[]\"\n  and \"butlast(tl(q s))\\<noteq>[]\"\nshows \"\\<forall>i.(i<(length(tl(q s))-1))\\<longrightarrow>fst(tl(q s)!i) \\<noteq>end(last(tl(q s)))\"\n  using assms peculiar_30 peculiar_29 apply simp\n  unfolding Q_lemmas Q_basic_lemmas apply safe apply(subgoal_tac \"last(tl(q s)) =(tl(q s)!(length(tl(q s))-1))\")\n  prefer 2 \n  apply (simp add: last_conv_nth) apply simp\n  by (metis One_nat_def Suc_eq_plus1 Suc_lessD assms(5) diff_Suc_eq_diff_pred in_set_conv_nth last_tl length_butlast length_tl less_diff_conv nth_butlast nth_tl prod.exhaust_sel)\n\n\n\nlemma tail_preserves_struct:\n  \"Q_gap_structure s \\<Longrightarrow> fst (q s ! 0) = 0 \\<Longrightarrow>\\<forall> i . i<length (q s) \\<longrightarrow> snd(q s ! i) > 0 \\<Longrightarrow>\n  Q_offsets_differ s \\<Longrightarrow> length(q s)>0 \\<Longrightarrow>\n\\<forall> i . (i<length (q s) \\<and> i>0)\\<longrightarrow> fst(q s ! i) > fst (q s ! 0)\"\n  apply(simp add:Q_gap_structure_def Q_offsets_differ_def)\n  by (metis gr_implies_not_zero not_gr_zero)\n\n\nlemma queue_is_finite_set:\n  assumes \"con_assms s\"\n  and \"Q_structure s\"\nshows \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longleftrightarrow>(\\<exists>i.(i<length(q s) \\<and> (a, b) =(q s!i)))\"\n  using assms apply(simp add:Q_lemmas Q_basic_lemmas)\n  by (metis in_set_conv_nth)\n  \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(**********************Supporting lemmas for R trans*********************************)\n\n\n\n\nlemma R_idle_to_nidle_lemma_case_1_1:\n  \"case_1 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s\n\\<Longrightarrow>i<fst(hd(q s))\\<longrightarrow>ownB s i=ownB s' i\"\n  by(simp add:case_1_def) \n\n\nlemma R_idle_to_nidle_lemma_case_1_2:\n  \"case_1 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s\n\\<Longrightarrow>i>end(hd(q s))\\<longrightarrow>ownB s i=ownB s' i\"\n  by(simp add:case_1_def) \n\n\n\nlemma R_idle_to_nidle_lemma_case_1_3:\n  \"case_1 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s\n\\<Longrightarrow>fst(hd(q s))\\<le>i \\<and> i<end(hd(q s))\\<longrightarrow>R=ownB s' i\"\n  by(simp add:case_1_def) \n\n\n\nlemma R_idle_to_nidle_lemma_case_1_4:\n  \"case_1 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s\n\\<Longrightarrow>T s=T s'\\<and>H s=H s'\\<and>offset s=offset s'\\<and>ownT s'=R\"\n  by(simp add:case_1_def) \n\n\nlemma sum_of_things:\n  \"q s!0 = (2,3) \\<Longrightarrow> (length(q s) = 1)\\<longrightarrow>\\<Sum>{j. j=(snd(q s!0))} = 3\"\n  by simp \n\nlemma sum_of_things_2:\n  \"q s=[(0,1)] \\<Longrightarrow> length(q s) = 1\"\n  by simp\n\n\nlemma sum_of_things_3:\n  \" length(q s)>0 \\<Longrightarrow> \\<forall>i. i<length(q s) \\<longrightarrow> snd(q s!i) =1\\<Longrightarrow> (\\<Sum>i::nat=0..length(q s)-1. 1) = length(q s)\"\n  by auto \n\nlemma sum_of_things_4:\n  \" length(q s)>1 \\<Longrightarrow> \\<forall>i. i<length(q s) \\<longrightarrow> snd(q s!i) =1\\<Longrightarrow> (\\<Sum>i::nat=0..(length(q s)-1). snd(q s!i)) = length(q s)\"\n  by auto\n\nlemma sum_of_things_5:\n  \"n>0\\<Longrightarrow> (\\<Sum>i::nat=0..n. k) = (\\<Sum>i::nat=1..n. k) + k \"\nproof (induct n)\n  show \"0 = n \\<Longrightarrow>\n    0 < n \\<Longrightarrow>\n    (\\<Sum>i = 0..n. k) = (\\<Sum>i = 1..n. k) + k\" by simp\nnext show \"\\<And>x. (x = n \\<Longrightarrow>\n          0 < n \\<Longrightarrow>\n          (\\<Sum>i = 0..n. k) =\n          (\\<Sum>i = 1..n. k) + k) \\<Longrightarrow>\n         Suc x = n \\<Longrightarrow>\n         0 < n \\<Longrightarrow>\n         (\\<Sum>i = 0..n. k) =\n         (\\<Sum>i = 1..n. k) + k\" \n    by (metis add.commute add_diff_cancel_left' le_add1 plus_1_eq_Suc sum.atLeast0_atMost_Suc_shift sum.atLeastAtMost_shift_0)\nqed\n\n\n\nlemma sum_of_things_6:\n  \"length(q s) =n+2\\<Longrightarrow> (\\<Sum>i::nat=0..(length(q s)-1). 1) = (\\<Sum>i::nat=1..(length(q s)-1). 1) + 1 \"\n  apply auto\nproof (induct n)\n  case 0\n  then show ?case  \n    by simp\nnext\n  case (Suc x)\n  then show ?case \n    by (metis add.commute add.right_neutral nat.distinct(1) not_gr_zero plus_1_eq_Suc sum_of_things_5)\nqed\n\n\nlemma sum_of_things_7:\n  \"length(q s) =n+2\\<Longrightarrow> \\<forall>i. (i<length(q s)) \\<longrightarrow> snd(q s!i) =1\\<Longrightarrow>\n (\\<Sum>i::nat=0..(length(q s)-1). snd(q s!i)) = (\\<Sum>i::nat=1..(length(q s)-1). snd(q s!i)) + snd(q s!0) \"\n  by auto\n\n\nlemma sum_of_things_8:\n  \"length(q s) =n+2\\<Longrightarrow>\n (\\<Sum>i::nat=0..(length(q s)-1). snd(q s!i)) = (\\<Sum>i::nat=1..(length(q s)-1). snd(q s!i)) + snd(q s!0) \"\n  apply auto\nproof (induct n)\n  case 0\n  then show ?case \n    by auto\nnext \n  case (Suc x)\n  then show ?case\n    by (simp add: sum.atLeast_Suc_atMost)\nqed\n\n\nlemma sum_of_things_9:\n  \" length(q s)=n+2 \\<Longrightarrow> \\<forall>i. (i<length(q s) \\<and> i>0) \\<longrightarrow> snd(q s!i) =1\\<Longrightarrow> \n(\\<Sum>i::nat=0..(length(q s)-1). snd(q s!i)) = (\\<Sum>i::nat=1..(length(q s)-1). snd(q s!i)) + snd(q s!0) \"\n  apply auto \nproof (induct n) case 0 then show ?case   by auto\nnext  case (Suc x) then show ?case  by (simp add: sum.atLeast_Suc_atMost)\nqed  \n\n\nlemma sum_of_things_10:\n  \" length(q s)\\<ge>2 \\<Longrightarrow> \\<forall>i. (i<length(q s) \\<and> i>0) \\<longrightarrow> snd(q s!i) =1\\<Longrightarrow> \n(\\<Sum>i::nat=0..(length(q s)-1). snd(q s!i)) = (\\<Sum>i::nat=1..(length(q s)-1). snd(q s!i)) + snd(q s!0) \"\n  apply auto\n  by (metis add.commute sum.atLeast_Suc_atMost zero_le)\n\nlemma sum_of_things_11:\n  \" length(q s) = n+2 \\<Longrightarrow> \\<forall>i. (i<length(q s) \\<and> i>0) \\<longrightarrow> snd(q s!i) =1\\<Longrightarrow> \n(\\<Sum>i::nat=0..(length(q s)-1). snd(q s!i)) = length(q s)-1 + snd(q s!0) \"\n  apply auto \nproof (induct n) case 0 then show ?case   by auto\nnext  case (Suc x) then show ?case by (simp add: sum.atLeast_Suc_atMost)\nqed  \n\n\nlemma sum_of_things_12:\n  \" length(q s) = n+2 \\<Longrightarrow> \\<forall>i. (i<length(q s) \\<and> i>0) \\<longrightarrow> snd(q s!i) =1\\<Longrightarrow> \n(\\<Sum>i::nat=1..(length(q s)-1). snd(q s!i)) = length(q s)-1  \"\n  by auto \n\nlemma sum_of_things_13:\n  \" \\<forall>n.(n\\<ge>0) \\<longrightarrow>length(q s) = n+2 \\<Longrightarrow> \\<forall>i. (i<length(q s) \\<and> i>0) \\<longrightarrow> snd(q s!i) =1\\<Longrightarrow> \n(\\<Sum>i::nat=1..(length(q s)-1). snd(q s!i)) = length(q s)-1  \"\n  using sum_of_things_12 [where s=s] \n  by blast\n\nlemma sum_of_things_14:\n  \" \\<forall>k.(k\\<ge>2)\\<longrightarrow>length(q s) = k \\<Longrightarrow> \\<forall>i. (i<length(q s) \\<and> i>0) \\<longrightarrow> snd(q s!i) =1\\<Longrightarrow> \n(\\<Sum>i::nat=1..(length(q s)-1). snd(q s!i)) = length(q s)-1  \"\n  using sum_of_things_13 [where s=s]\n  using le_add2 by blast\n\n\n\n\n\n\n\nlemma R_idle_to_nidle_lemma_case_1_5_1:\n  \"inv s \\<Longrightarrow>q s\\<noteq>[]\n\\<Longrightarrow>\\<forall>a b aa bb.((a,b)\\<in>set(q s) \\<and> (aa,bb)\\<in>set(q s) \\<and> a<aa)\\<longrightarrow>a+b\\<le>aa\"\n  apply simp\n  by(simp add:inv_def Q_lemmas Q_basic_lemmas)\n\nlemma R_idle_to_nidle_lemma_case_1_5_2:\n  \"inv s \\<Longrightarrow>q s\\<noteq>[]\n\\<Longrightarrow>\\<forall>a b aa bb.((a,b)\\<in>set(q s) \\<and> (aa,bb)\\<in>set(q s) \\<and> a+b\\<le>aa)\\<longrightarrow>a+b<aa+bb\"\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  by (metis less_add_same_cancel1 nat_less_le trans_less_add1)\n\n\nlemma R_idle_to_nidle_lemma_case_1_5:\n  \"case_1 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[]\n\\<Longrightarrow>case_1 s'\"\n  apply(simp add:case_1_def inv_def) \n  apply(clarify) apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(subgoal_tac \"fst (last (q s)) + snd (last (q s))\\<le>N\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"q s\\<noteq>[]\\<longrightarrow>hd(q s) \\<in>set(q s)\") prefer 2 \n  apply (metis list.set_sel(1))\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 \n  apply blast\n  apply (metis diff_is_0_eq less_nat_zero_code prod.collapse zero_less_diff)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = \"end(hd(q s))\" in exI)\n  apply(intro conjI impI)\n  apply (metis cancel_comm_monoid_add_class.diff_cancel end_simp le_0_eq le_neq_implies_less length_0_conv trans_le_add1)\n  apply(rule_tac ?x = \"fst (last (q s)) + snd (last (q s))\" in exI)\n  apply(simp add:pre_R_def  pre_dequeue_inv_def) \n  apply(intro conjI impI) \n  apply(subgoal_tac \"last(q s) \\<in>set(q s) \\<and> hd(q s)\\<in>set(q s)\") prefer 2 \n  apply (metis last_in_set list.set_sel(1))\n  defer\n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(3) diff_is_0_eq le_0_eq le_neq_implies_less length_0_conv nat_le_linear)\n  apply (metis (no_types, hide_lams) F.distinct(3)) \n  defer\n  apply (metis le_neq_implies_less le_refl)\n  apply (metis diff_add_inverse eq_imp_le le_neq_implies_less) \n  apply (subgoal_tac \"((fst (hd (q s)) + snd (hd (q s)) < fst (last (q s)) + snd (last (q s))) \\<longrightarrow> (Suc 0 < length (q s))) \\<and>\n   ((Suc 0 < length (q s)\\<longrightarrow>fst (hd (q s)) + snd (hd (q s)) < fst (last (q s)) + snd (last (q s))))\")\n  apply blast defer\n  apply(subgoal_tac \"hd(q s) = (q s!0)\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = (q s!1)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def diff_add_inverse2 hd_conv_nth last_conv_nth length_greater_0_conv length_tl less_diff_conv list.size(3) nth_tl)\n  apply(case_tac \"fst(q s!0) = 0\") \n  apply(subgoal_tac \"fst(hd(q s)) = 0\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j \\<longrightarrow> fst(q s!i) \\<noteq>fst(q s!j)\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"i<(length(q s))\\<and>i>0\\<and> fst(q s!0) = 0\\<longrightarrow> fst(q s!(i-1)) + snd(q s!(i-1)) = fst(q s!i)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def length_greater_0_conv)\n  apply(case_tac \"length(q s) > 1\") \n  apply(subgoal_tac \"fst(q s!0) = 0\\<longrightarrow> fst(q s!(0)) + snd(q s!(0)) = fst(q s!1)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 length_greater_0_conv less_one)\n  apply presburger\n  apply (metis diff_self_eq_0 last_conv_nth length_0_conv less_nat_zero_code less_one nat_neq_iff)\n  apply(subgoal_tac \"fst(hd(q s))>0\") prefer 2 \n  using gr0I apply presburger\n  apply(subgoal_tac \"ownB s 0 \\<noteq> Q\") prefer 2 \n  apply (metis F.distinct(19) gr0I le_numeral_extra(3))\n  apply(subgoal_tac \" \\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"0\\<le>N\") prefer 2\n  apply blast\n  apply(subgoal_tac \"(\\<nexists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\")\n  prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<nexists>a b. (a,b) \\<in> set(q s) \\<and> a=0\") prefer 2 \n  apply (metis (no_types, lifting) bot_nat_0.extremum mem_Collect_eq plus_nat.add_0)\n  apply(subgoal_tac \"i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"(sta,wlength)\\<in>set(q s) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> (sta,wlength) = q s!i))\") prefer 2\n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>sta wlength. (sta,wlength)\\<in>set(q s) \\<longrightarrow> sta\\<noteq>0\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"i<length(q s) \\<longrightarrow>fst(q s!i)\\<noteq>0\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"i<(length(q s))\\<and>i>0\\<longrightarrow> fst(q s!(i-1)) + snd(q s!(i-1)) = fst(q s!i)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def)\n  apply(case_tac \"length(q s)>1\") \n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 less_one nth_mem prod.collapse)\n  apply(case_tac \"length(q s) = 0\")\n  apply fastforce\n  apply(subgoal_tac \"length(q s) = 1\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"length(tl(q s)) = 0\") prefer 2\n  apply (metis diff_self_eq_0 length_tl)\n  apply (metis diff_self_eq_0 last_conv_nth le_neq_implies_less less_irrefl_nat not_one_le_zero)\n  apply(case_tac \"length(q s) \\<le>1\")\n  apply (metis bot_nat_0.extremum_uniqueI diff_add_inverse2 diff_is_0_eq' head_q0 last_conv_nth le_neq_implies_less length_greater_0_conv less_diff_conv less_numeral_extra(3))\n  apply (metis (no_types, lifting) One_nat_def diff_is_0_eq last_tl le_Suc_eq le_neq_implies_less length_tl list.size(3))\n  apply (metis (no_types, lifting) diff_add_inverse diff_is_0_eq' le_0_eq le_eq_less_or_eq length_0_conv linorder_neqE_nat list.set_sel(1) nat_less_le not_add_less1 prod.collapse)\n  apply (metis diff_add_inverse diff_is_0_eq' le_eq_less_or_eq less_nat_zero_code list.set_sel(1) prod.collapse)                       \n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"(\\<forall>a b aa bb . ((a, b) \\<in> set (q s) \\<and>  (aa, bb) \\<in> set (q s)) \\<longrightarrow> a + b \\<ge> aa + bb \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, lifting) less_add_same_cancel1 nat_le_iff_add trans_less_add1)\n  apply(subgoal_tac \"(\\<forall>a b aa bb . ((a, b) \\<in> set (q s) \\<and>  (aa, bb) \\<in> set (q s)) \\<longrightarrow> a <  aa \\<longrightarrow> a + b \\<le> aa + bb)\") prefer 2\n  apply (meson trans_le_add1)\n  apply(case_tac \"hd(q s) \\<noteq> last(q s)\")\n  apply(subgoal_tac \"fst(hd(q s)) < fst(last(q s))\")\n  apply (metis (no_types, lifting) prod.collapse)\n  apply(subgoal_tac \"i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j \\<longrightarrow> fst(q s!i)\\<noteq>fst(q s!j)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s (fst(q s!0)) = Q\") prefer 2 \n  apply (metis (no_types, lifting) head_q0 le_eq_less_or_eq length_greater_0_conv)\n  apply(subgoal_tac \"ownB s (fst(last(q s))) = Q\") prefer 2\n  apply (metis (no_types, lifting) less_add_same_cancel1 prod.collapse)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i=Q \\<and> i\\<le>N)\\<longrightarrow>i\\<ge>fst(q s!0)\") prefer 2 \n  apply (metis F.distinct(19) hd_conv_nth less_Suc_eq_le not_less_eq)\n  apply(subgoal_tac \"hd(q s) = (q s!0) \\<and> last(q s) = (q s!(length(q s)-1))\") prefer 2\n  apply (metis hd_conv_nth last_conv_nth) \n  apply (metis (no_types, lifting) diff_less length_pos_if_in_set less_one nat_less_le prod.collapse)\n  using le_eq_less_or_eq apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply blast\n  apply(subgoal_tac \"hd(q s) \\<in>set(q s)\") prefer 2\n  apply (metis hd_in_set)\n  apply(case_tac \"hd(q s) = last(q s)\") \n  apply (metis Suc_diff_le Suc_leI Suc_neq_Zero diff_is_0_eq le_trans)\n  apply(subgoal_tac \"i\\<ge>H s \\<and> i\\<le>N \\<longrightarrow> ownB s i \\<noteq>Q\") prefer 2\n  apply (metis F.distinct(19) F.distinct(23) le_eq_less_or_eq)\n  apply(subgoal_tac \"i\\<ge>fst(q s!0) \\<and> i<fst(q s!0) + snd(q s!0)\\<longrightarrow> ownB s i = Q\") prefer 2\n  apply (metis (no_types, lifting) head_q0 length_greater_0_conv)\n  defer (*SMT*)\n  apply(intro conjI impI)\n  apply(subgoal_tac \"hd(q s) = (q s!0) \\<and> last(q s) = (q s!(length(q s)-1))\") prefer 2 \n  apply (meson hd_conv_nth last_conv_nth)\n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_self_eq_0 length_greater_0_conv less_not_refl2)\n  apply(subgoal_tac \"hd(q s)\\<in> set(q s) \\<and> last(q s) \\<in>set(q s)\") prefer 2 \n  apply (metis last_in_set list.set_sel(1))\n  apply(subgoal_tac \"(a,b)\\<in>set(q s)\\<longrightarrow>b>0\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"fst(hd(q s)) < fst(last(q s))\") \n  apply (metis (no_types, lifting) linorder_neqE_nat nat_less_le prod.collapse trans_less_add1)\n  apply(subgoal_tac \"i<fst(hd(q s)) \\<longrightarrow> ownB s i \\<noteq>Q\") prefer 2\n  apply (metis F.distinct(19) le_eq_less_or_eq)\n  apply(subgoal_tac \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j)\\<longrightarrow>fst(q s!i)\\<noteq>fst(q s!j)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \n   \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> a\\<le>i \\<and> i<a+b) \\<longrightarrow>ownB s i = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow>ownB s a = Q\") prefer 2 \n  apply (metis le_eq_less_or_eq less_add_same_cancel1)\n  apply(subgoal_tac \"i<length(q s) \\<longrightarrow> (\\<exists>a b.((a,b)\\<in>set(q s) \\<and> (a,b) = (q s!i)))\") prefer 2\n  apply (metis nth_mem prod.collapse)\n  apply(subgoal_tac \"i<length(q s) \\<longrightarrow> ownB s (fst(q s!i)) = Q\") prefer 2\n  apply (metis fst_eqD)\n  apply(subgoal_tac \"hd(q s) = (q s!0) \\<and> last(q s) = (q s!(length(q s)-1))\") prefer 2\n  apply (metis hd_conv_nth last_conv_nth)\n  defer (*SMT*)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> a\\<le>i \\<and> i<a+b) \\<longrightarrow> ownB s i = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"hd(q s) \\<in> set (q s)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.( fst(hd(q s))\\<le>i \\<and> i<fst(hd(q s))+snd(hd(q s))) \\<longrightarrow> ownB s i = Q\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i.(ownB s i\\<noteq>Q \\<and> i>fst(hd(q s))) \\<longrightarrow> i\\<ge>end(last(q s))\") prefer 2 \n  apply (metis (no_types, lifting) end_simp le_eq_less_or_eq nat_le_linear)\n  apply(subgoal_tac \"end(last(q s))\\<le>H s\") prefer 2 \n  apply (metis end_simp)\n  apply (metis (no_types, lifting) F.distinct(19) add_lessD1 le_add_diff_inverse less_imp_le_nat nat_neq_iff)\n  apply(subgoal_tac \"hd(q s)\\<noteq>last(q s)\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessD diff_less less_one zero_less_diff)\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"(\\<forall>a b aa bb . ((a, b) \\<in> set (q s) \\<and>  (aa, bb) \\<in> set (q s)) \\<longrightarrow> a + b \\<ge> aa + bb \\<longrightarrow>a \\<ge> aa )\") prefer 2\n  apply (metis (no_types, lifting) less_add_same_cancel1 nat_le_iff_add trans_less_add1)\n  apply(subgoal_tac \"(\\<forall>a b aa bb . ((a, b) \\<in> set (q s) \\<and>  (aa, bb) \\<in> set (q s)) \\<longrightarrow> a <  aa \\<longrightarrow> a + b \\<le> aa + bb)\") prefer 2\n  apply (metis (no_types, lifting) trans_le_add1)\n  by (metis (no_types, lifting) Suc_lessD diff_less less_one nat_less_le prod.collapse)\n\n  \nlemma R_idle_to_nidle_lemma_case_1_6_1_supp:\n  \"case_2 s\\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> fst(hd(q s)) = T s\n\\<Longrightarrow>H s = fst(last(q s))+snd(last(q s)) \\<longrightarrow> (\\<nexists>j.(j\\<le>N \\<and> ownB s j = W))\"\n  apply(simp add:case_2_def ) \n  apply(clarify) \n  by (metis F.distinct(5) F.distinct(7) F.distinct(9) diff_is_0_eq less_nat_zero_code linorder_neqE_nat zero_less_diff)\n\nlemma R_idle_to_nidle_lemma_case_1_6_1_supp_2:\n  \"case_2 s\\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> fst(hd(q s)) = T s\n\\<Longrightarrow>H s \\<noteq> fst(last(q s))+snd(last(q s)) \\<longrightarrow> (H s =offset s + Data s (numEnqs s))\"\n  apply(simp add:case_2_def ) \n  apply(clarify) \n  by (metis le_add_diff_inverse le_neq_implies_less)\n  \nlemma pec_prelim_1:\n\" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n  \\<Longrightarrow> 0\\<le>N \\<and> ownB s 0=Q \\<Longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s))\\<and> 0\\<in>x)\"\n  by (metis (no_types, lifting) mem_Collect_eq)\n\n\nlemma pec_prelim_2:\n\" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n  \\<Longrightarrow> 0\\<le>N \\<and> ownB s 0=Q \\<Longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s))\\<and> 0\\<in>x) \\<Longrightarrow> \\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\"\n  by fastforce\n\n\n\n\nlemma pec_prelim_3:\n\" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n\\<Longrightarrow> ownB s (fst(hd(q s)) + snd(hd(q s))) = Q \\<and> (fst(hd(q s)) + snd(hd(q s)))\\<le>N  \n\\<Longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s))\\<and> fst(hd(q s)) + snd(hd(q s))\\<in>x) \n\\<Longrightarrow> \\<exists>a b.((a,b)\\<in>set(q s) \\<and> a\\<le>fst(hd(q s)) + snd(hd(q s)) \\<and> fst(hd(q s)) + snd(hd(q s))<a+b)\" \n  by blast\n\n\nlemma pec_prelim_4:\n\"Q_structure s \\<Longrightarrow> length(q s)>1\n\\<Longrightarrow>\n\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j \\<and> fst(q s!j)<fst(q s!i))\\<longrightarrow>fst(q s!j) + snd(q s!j) < fst(q s!i)+ snd(q s!i)\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply clarify \n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>(q s!i)\\<in>set(q s)\") prefer 2 \n  apply (meson nth_mem)\n  apply(subgoal_tac \"\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j)\\<longrightarrow>fst(q s!i)\\<noteq>fst(q s!j)\") prefer 2\n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"(\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa)\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> b>0\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"\\<forall>a b aa ba. ((a, b) \\<in> set (q s) \\<and>  (aa, ba) \\<in> set (q s) \\<and> a < aa) \\<longrightarrow> a + b < aa+ba\") prefer 2\n  apply (metis Nat.add_diff_assoc2 add_gr_0 zero_less_diff)\n  apply(subgoal_tac \"(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j \\<and> fst(q s!j)<fst(q s!i)) \n\\<longrightarrow> ((q s!i)\\<in>set(q s) \\<and> (q s!j)\\<in>set(q s) \\<and> fst(q s!j)<fst(q s!i))\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(\\<exists>a b aa ba.((a, b) \\<in> set (q s) \\<and>  (aa, ba) \\<in> set (q s) \\<and> a < aa) \\<and> (q s!i) = (aa, ba) \\<and> (q s!j) =(a,b))\") prefer 2 \n  apply (metis prod.collapse)\n  apply(clarify)\n  apply(subgoal_tac \"a+b<aa+ba\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"fst(q s!i) = aa\") prefer 2\n  apply (metis fst_conv)\n  apply(subgoal_tac \"fst(q s!j) = a\") prefer 2\n  apply (metis fst_conv)\n  apply(subgoal_tac \"snd(q s!j) = b\") prefer 2\n  apply (metis snd_conv)\n  apply(subgoal_tac \"snd(q s!i) = ba\") prefer 2\n  apply (metis snd_conv)\n  by meson\n\nlemma pec_prelim_5:\n\"Q_structure s \\<Longrightarrow> length(q s)>1\n\\<Longrightarrow>\n\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j )\\<longrightarrow>fst(q s!j) + snd(q s!j) \\<noteq> fst(q s!i)+ snd(q s!i)\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply clarify apply(case_tac \"fst(q s!i)<fst(q s!j)\") \n  using pec_prelim_4 [where s=s]\n  apply (metis diff_add_inverse diff_is_0_eq less_nat_zero_code list.size(3) nth_mem prod.collapse)\n  using pec_prelim_4 [where s=s]\n  apply(subgoal_tac \"fst(q s!i)>fst(q s!j)\") \n  apply (metis diff_add_inverse diff_is_0_eq less_nat_zero_code list.size(3) nth_mem prod.collapse)\n  by (metis less_nat_zero_code linorder_neqE_nat list.size(3))\n\n\nlemma pec_prelim_6:\n\"Q_structure s \\<Longrightarrow> length(q s)>2\n\\<Longrightarrow>\n\\<forall>i j.(i<length(q s) \\<and> j<length(q s) \\<and> i\\<noteq>j )\\<longrightarrow>fst(q s!j) + snd(q s!j) \\<noteq> fst(q s!i)+ snd(q s!i)\"\n  using pec_prelim_5 [where s=s]\n  by (metis add_lessD1 nat_1_add_1)\n\n\nlemma pec_prelim_7:\n\"Q_structure s \\<Longrightarrow> length(q s)>2\n\\<Longrightarrow> fst(q s!1) = 0 \\<Longrightarrow>\n\\<forall>i.(i<length(q s) \\<and> i>1)\\<longrightarrow>fst(q s!0) + snd(q s!0) \\<noteq> fst(q s!i)\"\n  using pec_prelim_6 [where s=s] Q_lemmas Q_basic_lemmas\n  by (smt (verit, ccfv_threshold) add.commute add_lessD1 add_less_same_cancel2 canonically_ordered_monoid_add_class.lessE diff_add_inverse end_simp linorder_neqE_nat list.size(3) not_add_less2)\n\nlemma pec_prelim_8:\n\"Q_structure s \\<Longrightarrow> \n\\<forall>a b aa bb.((a,b)\\<in>set(q s) \\<and> (aa,bb)\\<in>set(q s) \\<and> a+b<aa+bb)\\<longrightarrow>a+b\\<le>aa\"\n  using Q_lemmas Q_basic_lemmas \n  by (smt (verit) Q_gap_lemmas_14 Q_gap_lemmas_15 end_simp fst_eqD length_pos_if_in_set snd_eqD)\n\n\n\n\n  \n\n\nlemma pec_prelim_9:\n\"(\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N) \\<and>\n    (\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow> fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0) \\<and>\n    (\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)) \\<and>\n    (\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa) \\<and>\n    (\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s))) \\<and>\n    (\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b) \\<and>\n    (\\<forall>i<length (q s). data_index s (q s ! i) = numDeqs s + i) \\<and>\n    (\\<forall>i<length (q s). snd (q s ! i) = Data s (numDeqs s + i)) \\<and>\n    (\\<forall>i<length (q s). ownD s (i + numDeqs s) = B) \\<and> (\\<forall>i\\<le>N. \\<forall>j\\<le>N. data_index s (i, j) < n)\n\\<Longrightarrow> Q_structure s\"\n  by (simp add:Q_lemmas Q_basic_lemmas)\n\nlemma pec_prelim_10:\n\"(\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N) \\<and>\n    (\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow> fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0) \\<and>\n    (\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)) \\<and>\n    (\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa) \\<and>\n    (\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s))) \\<and>\n    (\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b) \\<and>\n    (\\<forall>i<length (q s). data_index s (q s ! i) = numDeqs s + i) \\<and>\n    (\\<forall>i<length (q s). snd (q s ! i) = Data s (numDeqs s + i)) \\<and>\n    (\\<forall>i<length (q s). ownD s (i + numDeqs s) = B)\n\\<Longrightarrow> Q_structure s\"\n  by (simp add:Q_lemmas Q_basic_lemmas)\n\n\n\nlemma pec_prelim_11:\n\"Q_structure s \\<Longrightarrow> \nlength(q s)>2 \\<Longrightarrow> \ni<length(q s) \\<Longrightarrow> \nj<length(q s)\\<Longrightarrow> \nfst(q s!i) = 0 \\<Longrightarrow>\ni\\<noteq>0 \\<Longrightarrow> \nfst(q s!j) = fst(q s!0)+snd(q s!0) \\<Longrightarrow>\nj=1\"\n  apply(simp add: Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using pec_prelim_10 [where s=s]\n  apply auto[1]\n  apply (subgoal_tac \"fst(q s!j)\\<noteq>0\") prefer 2 \n  apply (metis add_is_0 bot_nat_0.not_eq_extremum length_0_conv not_numeral_less_zero nth_mem prod.collapse) \n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> i>1)\\<longrightarrow>fst(q s!0) + snd(q s!0) \\<noteq> fst(q s!i)\")\n  prefer 2 using pec_prelim_7 [where s=s] \n  apply (metis One_nat_def Suc_1 Suc_lessD diff_is_0_eq' le_numeral_extra(4) less_numeral_extra(1) list.size(3) nat_neq_iff)\n  apply(subgoal_tac \"j\\<noteq>i\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> fst(q s!0) + snd(q s!0) =fst(q s!i))\\<longrightarrow>i\\<le>1\")\n  prefer 2 \n  apply (meson less_Suc_eq_le not_less_eq)\n  apply(subgoal_tac \"(i<length(q s) \\<and> fst(q s!0) + snd(q s!0) =fst(q s!i))\\<longrightarrow>i=1\")\n  prefer 2 \n  apply presburger\n  by (metis Suc_diff_1 bot_nat_0.not_eq_extremum diff_add_inverse diff_is_0_eq' diff_self_eq_0 length_0_conv nth_mem surjective_pairing)\n\n\n\n\nlemma R_idle_to_nidle_lemma_case_1_6_1:\n  \"case_2 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> fst(hd(q s)) = T s \\<Longrightarrow> H s = fst(last(q s))+snd(last(q s))\n\\<Longrightarrow>case_2 s'\"\n  apply(subgoal_tac \"T s\\<noteq>0\") prefer 2\n  apply(simp add:case_2_def) \n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply (metis RingBuffer_BD_latest_2.inv_def)\n  apply (metis gr0I less_nat_zero_code)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using pec_prelim_9 [where s=s]\n  apply blast\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:pre_R_def pre_dequeue_inv_def)\n  apply(simp add:case_2_def ) \n  apply(clarify) \n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) le_antisym less_or_eq_imp_le list.set_sel(1) nat_neq_iff prod.collapse)\n  apply(rule_tac ?x = \"0\" in exI)\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI)  \n  apply blast\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) \n  apply fastforce  \n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply(subgoal_tac \"H s < T s\") prefer 2\n  apply linarith\n  apply linarith\n  apply(rule_tac ?x = \"fst(hd(q s)) + snd(hd(q s))\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"f\" in exI)\n  apply(intro conjI impI)  \n  apply (metis (no_types, lifting) F.distinct(21) le_eq_less_or_eq linorder_neqE_nat)\n  apply linarith \n  apply metis \n  apply (metis Suc_leI le_less_Suc_eq le_trans less_or_eq_imp_le not_less_eq not_less_eq_eq)\n  apply (metis le_antisym less_irrefl_nat less_or_eq_imp_le)\n  apply (metis Suc_leI not_less_eq_eq)\n  apply (metis trans_less_add1)\n  apply (metis diff_is_0_eq' le_add1 le_less_Suc_eq le_trans not_less_eq zero_less_diff)\n  apply clarify\n  apply(intro conjI impI)\n  apply(subgoal_tac \"ownB s i = Q\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"j\\<ge>f \\<and> j\\<le>N \\<longrightarrow> ownB s j \\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(21) F.distinct(23) le_neq_implies_less)\n  apply(subgoal_tac \" T s + snd (hd (q s)) \\<le>N\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \" T s + snd (hd (q s)) \\<le>f\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(21) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"i < T s + snd (hd (q s))\") prefer 2\n  apply meson\n  apply linarith\n  apply metis\n  apply metis\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  using add_gr_0 apply presburger\n  apply meson\n  apply linarith\n  apply force\n  apply force\n  apply force\n  apply force\n  apply force\n  using diff_add_inverse apply presburger\n  apply(intro iffI) prefer 2 \n  apply (metis bot_nat_0.not_eq_extremum)\n  apply(subgoal_tac \"H s>0\") prefer 2 \n  using add_gr_0 apply presburger\n  apply(subgoal_tac \" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \") prefer 2\n  apply presburger\n  apply(subgoal_tac \"ownB s 0 = Q \\<and> 0\\<le>N\") prefer 2\n  apply (metis gr_zeroI zero_le)\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\") prefer 2        \n  using pec_prelim_1 [where s=s]\n  apply presburger  \n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\") prefer 2 using pec_prelim_2 [where s=s]\n  apply presburger\n  apply(subgoal_tac \"hd(q s) \\<in> set(q s)\") prefer 2\n  apply (metis list.set_sel(1))\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"\\<exists>j.(j<length(q s) \\<and> fst(q s!j) = 0)\") prefer 2 \n  apply (metis (no_types, lifting) fst_eqD in_set_conv_nth)\n  apply(subgoal_tac \"fst(q s!j) = 0 \\<longrightarrow> j\\<noteq>0\") prefer 2\n  apply metis\n  apply(subgoal_tac \"length(q s)\\<ge>2\") prefer 2\n  apply (metis (no_types, hide_lams) diff_is_0_eq length_0_conv less_2_cases_iff less_Suc0 neq0_conv zero_less_diff)\n  apply linarith\n  defer\n  apply(subgoal_tac \"ownB s (f) \\<noteq> Q\") prefer 2 \n  apply (metis F.distinct(21) F.distinct(23) eq_imp_le le_neq_implies_less)\n  apply(subgoal_tac \"length(q s) > 1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_Suc_1 hd_conv_nth last_conv_nth length_greater_0_conv not_add_less1)\n  apply(subgoal_tac \" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {j. a \\<le> j \\<and> j < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<forall>star b.((star,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> star \\<in> x)\") prefer 2\n  apply (metis (no_types, lifting) diff_add_inverse le_refl mem_Collect_eq zero_less_diff)\n  apply(subgoal_tac \"\\<forall>star b.((star,b)\\<in>set(q s))\\<longrightarrow> (star \\<le> N \\<and> ownB s star = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s 0 = Q\") prefer 2\n  apply (metis bot_nat_0.extremum bot_nat_0.not_eq_extremum)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> (a,b) = (q s!i)))\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"fst(q s!1) = fst(q s!0)+snd(q s!0) \\<longrightarrow> ownB s f = Q\") prefer 2 \n  apply (metis hd_conv_nth nth_mem prod.collapse)\n  apply(subgoal_tac \"fst(q s!1) = fst(tl(q s)!0)\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def Suc_leI diff_is_0_eq diffs0_imp_equal length_0_conv length_greater_0_conv length_tl less_not_refl3 nth_tl)\n  apply(subgoal_tac \"fst(q s!1) = fst(hd(tl(q s)))\") prefer 2 \n  apply (metis diff_is_0_eq' hd_conv_nth length_tl list.size(3) zero_less_diff)\n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 zero_less_Suc)\n  apply(subgoal_tac \"tl(q s)\\<noteq>[]\")\n  apply (metis last_tl)\n  defer\n  apply (metis bot_nat_0.not_eq_extremum)\n  apply (metis add_cancel_right_right hd_in_set less_SucE less_add_Suc1 prod.exhaust_sel)\n  apply (metis add_eq_self_zero list.set_sel(1) prod.collapse)\n  apply(subgoal_tac \" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \") prefer 2\n  apply presburger\n  apply(subgoal_tac \"ownB s (fst (hd (q s)) + snd (hd (q s))) = Q\") prefer 2\n  apply (metis le_add1 le_less_Suc_eq not_less_eq)\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_Suc_1 hd_conv_nth last_conv_nth length_greater_0_conv not_add_less1)\n  apply(subgoal_tac \"(hd (tl (q s))) = (q s!1) \") prefer 2\n  apply (metis (no_types, lifting) One_nat_def hd_conv_nth length_tl lessI list.size(3) not_less_eq nth_tl zero_less_diff)\n  apply(subgoal_tac \"(hd (q s)) = (q s!0) \") prefer 2\n  apply (metis hd_conv_nth)\n  defer\n  apply(subgoal_tac \"ownB s 0 = Q\") prefer 2\n  apply (metis gr_zeroI zero_le)\n  apply(subgoal_tac \" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {j. a \\<le> j \\<and> j < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<forall>star b.((star,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> star \\<in> x)\") prefer 2\n  apply (metis (no_types, lifting) diff_add_inverse le_refl mem_Collect_eq zero_less_diff)\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {j. a \\<le> j \\<and> j < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\") prefer 2 \n  using bot_nat_0.extremum apply presburger\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\") prefer 2 \n  using \\<open>\\<lbrakk>\\<forall>i. i \\<le> N \\<and> ownB s i = Q \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x); 0 \\<le> N \\<and> ownB s 0 = Q; \\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x\\<rbrakk> \\<Longrightarrow> \\<exists>a b. (a, b) \\<in> set (q s) \\<and> a = 0\\<close> apply presburger\n  apply(subgoal_tac \"fst(hd(q s)) \\<noteq> 0\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> (a,b) = (q s!i)))\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"fst(q s!k) = 0 \\<longrightarrow> k\\<noteq>0\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_Suc_1 hd_conv_nth last_conv_nth length_pos_if_in_set not_add_less1)\n  apply (metis Suc_diff_Suc Zero_not_Suc length_0_conv length_tl)\n  apply(subgoal_tac \"\\<not>(fst (hd (tl (q s))) \\<noteq> fst (hd (q s)) + snd (hd (q s)))\") \n  apply meson\n  apply(subgoal_tac \"fst (hd (tl (q s))) \\<noteq> 0\") \n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 less_one)\n  apply(subgoal_tac \"ownB s (fst (hd (q s)) + snd (hd (q s))) = Q\") prefer 2 \n  apply blast\n  apply(subgoal_tac \" \\<forall>i.  (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {j. a \\<le> j \\<and> j < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \") prefer 2\n  apply presburger\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s))\\<le>N \\<and> ownB s (fst (hd (q s)) + snd (hd (q s))) = Q\")\n  prefer 2 \n  apply (metis Suc_le_lessD not_less_eq_eq)\n  apply(subgoal_tac \" (\\<exists>x. (\\<exists>a b. x = {j. a \\<le> j \\<and> j < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> (fst (hd (q s)) + snd (hd (q s))) \\<in> x) \") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a \\<le> fst (hd (q s)) + snd (hd (q s)) \\<and> fst (hd (q s)) + snd (hd (q s))<a+b)\") prefer 2\n  using pec_prelim_3 [where s=s] \n  apply presburger\n  apply(subgoal_tac \"ownB s 0 = Q \\<and> 0\\<le>N\") prefer 2 \n  apply (metis bot_nat_0.not_eq_extremum zero_le)\n  apply clarify\n  apply(subgoal_tac \"ab+bb>fst(hd(q s)) + snd(hd(q s))\") prefer 2\n  apply meson\n  apply(subgoal_tac \"(fst(hd(q s)),snd(hd(q s))) \\<in>set (q s)\") prefer 2 \n  apply (metis hd_in_set prod.collapse)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"ab\\<ge> fst(hd(q s)) + snd(hd(q s))\") prefer 2\n  using pec_prelim_8 [where s=s] \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"fst(hd(q s)) > 0\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"ab> 0\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a \\<le> 0 \\<and> 0<a+b)\") prefer 2\n  using pec_prelim_3 [where s=s] \n  apply (metis (no_types, lifting) \\<open>\\<lbrakk>\\<forall>i. i \\<le> N \\<and> ownB s i = Q \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x); 0 \\<le> N \\<and> ownB s 0 = Q\\<rbrakk> \\<Longrightarrow> \\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x\\<close> mem_Collect_eq)\n  apply(clarify)\n  apply(subgoal_tac \"(aa,ba)\\<noteq>(hd(q s))\") prefer 2\n  apply (metis Pair_inject less_irrefl_nat prod.collapse)\n  apply(subgoal_tac \"(0,bc)\\<noteq>(hd(q s))\") prefer 2 \n  apply (metis fst_conv)\n  apply(subgoal_tac \"(aa,ba)\\<noteq>(0,bc)\") prefer 2 \n  apply (metis (no_types, lifting) \\<open>Q_structure s \\<Longrightarrow> \\<forall>a b aa bb. (a, b) \\<in> set (q s) \\<and> (aa, bb) \\<in> set (q s) \\<and> a + b < aa + bb \\<longrightarrow> a + b \\<le> aa\\<close> add_eq_0_iff_both_eq_0 le_zero_eq prod.inject)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> (q s!i) = (a,b)))\") prefer 2\n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<exists>i.(i<length(q s) \\<and> (aa,ba) =(q s!i))\") prefer 2\n  apply metis\n  apply(subgoal_tac \"\\<exists>i.(i<length(q s) \\<and> (0,bc) =(q s!i))\") prefer 2\n  apply metis\n  apply(subgoal_tac \"(hd(q s)) = (q s!0)\") prefer 2\n  apply force\n  apply(subgoal_tac \"(aa,ba) =(q s!second) \\<and> (0,bc) =(q s!third)\\<longrightarrow> second\\<noteq>third\") prefer 2\n  apply metis\n  apply(subgoal_tac \"(aa,ba) =(q s!second) \\<and> (0,bc) =(q s!third) \\<longrightarrow> second\\<noteq>0 \\<and> third\\<noteq>0\") prefer 2\n  apply metis\n  apply (subgoal_tac \"length(q s) > 2\") prefer 2 \n  apply (metis Suc_1 Suc_lessI less_2_cases_iff)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = 0 \\<longrightarrow> False\") \n  apply fastforce\n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply meson\n  apply(subgoal_tac \"\\<exists>ass.(ass <length(q s) \\<and> (q s!ass) = (0,bc) \\<and> fst(q s!ass) = 0)\") prefer 2 \n  apply (metis prod.collapse prod.inject)\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a = fst(hd(q s)) + snd(hd(q s)))\") prefer 2\n  apply (metis le_antisym)\n  apply clarify \n  apply(subgoal_tac \"\\<exists>tru.(tru<length(q s) \\<and> (fst (hd (q s)) + snd (hd (q s)), bd) =(q s!tru))\")\n  prefer 2 \n  apply metis\n  apply clarify\n  apply(subgoal_tac \"ass<length(q s)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"tru<length(q s)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"ass\\<noteq>0\") prefer 2 \n  apply metis\n  apply(subgoal_tac \" fst(q s!ass) = 0\") prefer 2 \n  apply meson\n  apply(subgoal_tac \"fst(q s!tru) = fst(q s!0)+snd(q s!0) \") prefer 2 \n  apply (metis prod.collapse prod.inject)\n  apply(subgoal_tac \"tru = 1\") \n  apply (metis add_is_0)\n  using pec_prelim_11 [where s=s and i=ass and j=tru] \n  proof -\n  fix a :: nat and b :: nat and c :: nat and d :: nat and e :: nat and f :: nat and x :: \"nat set\" and aa :: nat and ba :: nat and ab :: nat and bb :: nat and ac :: nat and bc :: nat and i :: nat and ia :: nat and assa :: nat and ad :: nat and bd :: nat and trua :: nat\n  assume a1: \"Q_structure s\"\n  assume a2: \"2 < length (q s)\"\n  assume a3: \"assa < length (q s)\"\n  assume a4: \"fst (q s ! assa) = 0\"\n  assume a5: \"trua < length (q s)\"\n  assume a6: \"assa \\<noteq> 0\"\n  assume \"fst (q s ! trua) = fst (q s ! 0) + snd (q s ! 0)\"\n  then show \"trua = 1\"\n    using a6 a5 a4 a3 a2 a1 by (meson pec_prelim_11)\n  next\n  qed\n\n\n\nlemma str_pec_1:\n  \"Q_structure s \\<Longrightarrow> fst(hd(q s)) = 0 \\<Longrightarrow> length(q s)>1\n\\<Longrightarrow> (i>0 \\<and> i<length(q s))\\<longrightarrow>fst(q s!i)\\<ge>fst(q s!0)+snd(q s!0)\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  by (metis hd_conv_nth le_add2 le_add_same_cancel2 le_eq_less_or_eq less_nat_zero_code list.size(3) nth_mem prod.collapse)\n\nlemma str_pec_2:\n  \"Q_structure s \\<Longrightarrow> fst(hd(q s)) = 0 \\<Longrightarrow> length(q s)>1 \\<Longrightarrow> k=(length(q s) -1)\n\\<Longrightarrow> fst(q s!k)\\<ge>fst(q s!0)+snd(q s!0)\"\n  apply(simp add:Q_lemmas Q_basic_lemmas) \n  apply(subgoal_tac \"k>0\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"k<length(q s)\") prefer 2 \n   apply linarith\n  apply(subgoal_tac \"(k>0 \\<and> k<length(q s))\\<longrightarrow>fst(q s!k)\\<ge>fst(q s!0)+snd(q s!0)\")\n  using str_pec_1 [where s=s and i=k] \n  apply meson\n  apply(subgoal_tac \"(k>0 \\<and> k<length(q s))\") prefer 2 \n  apply blast\n  by (metis hd_conv_nth less_nat_zero_code list.size(3) nat_neq_iff nth_mem prod.collapse)\n\nlemma str_pec_3:\n  \"Q_structure s \\<Longrightarrow> fst(hd(q s)) = 0 \\<Longrightarrow> length(q s)>1 \n\\<Longrightarrow> fst(q s!(length(q s) -1))\\<ge>fst(q s!0)+snd(q s!0)\"\n  apply(simp add:Q_lemmas Q_basic_lemmas) \n  apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n  apply (metis Suc_lessD head_q0)\n  by (metis diff_less lessI less_nat_zero_code list.size(3) nat_neq_iff nth_mem prod.collapse zero_less_diff)\n  \n\nlemma str_pec_4:\n  \"Q_structure s \\<Longrightarrow> fst(hd(q s)) = 0 \\<Longrightarrow> length(q s)>1 \n\\<Longrightarrow> fst(last(q s))\\<ge>fst(hd(q s))+snd(hd(q s))\"\n  apply(subgoal_tac \"fst(q s!(length(q s) -1))\\<ge>fst(q s!0)+snd(q s!0)\") prefer 2\n  using str_pec_3 [where s=s]\n  apply blast\n  apply(simp add:Q_lemmas Q_basic_lemmas) \n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis Suc_lessD head_q0)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1)\") prefer 2\n  apply (metis last_conv_nth less_nat_zero_code list.size(3))\n  by (metis One_nat_def plus_nat.add_0)\n  \n\nlemma str_pec_5:\n  \"Q_structure s \\<Longrightarrow> fst(hd(q s)) = 0 \\<Longrightarrow> length(q s)>1 \n\\<Longrightarrow> snd(last(q s))+fst(last(q s))>fst(hd(q s))+snd(hd(q s))\"\n  apply(subgoal_tac \"fst(last(q s))\\<ge>fst(hd(q s))+snd(hd(q s))\") prefer 2\n  using str_pec_4 [where s=s]\n  apply blast \n  apply(simp add:Q_lemmas Q_basic_lemmas) apply(subgoal_tac \"snd(last(q s))>0\") prefer 2 \n  apply (metis last_in_set less_nat_zero_code list.size(3) prod.collapse)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis Suc_lessD head_q0)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1)\") prefer 2\n  apply (metis last_conv_nth less_nat_zero_code list.size(3)) \n  by linarith\n\n\nlemma R_idle_to_nidle_lemma_case_1_6_2:\n  \"case_2 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> fst(hd(q s)) \\<noteq> T s \\<Longrightarrow> H s \\<noteq> fst(last(q s))+snd(last(q s))\n\\<Longrightarrow>case_2 s'\"\n  apply(subgoal_tac \"T s\\<noteq>0\") prefer 2\n  apply(simp add:case_2_def) \n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply (metis RingBuffer_BD_latest_2.inv_def)\n  apply (metis gr0I less_nat_zero_code)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using pec_prelim_9 [where s=s]\n  apply blast\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:pre_R_def pre_dequeue_inv_def)\n  apply(simp add:case_2_def ) \n  apply(clarify) \n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) le_antisym less_or_eq_imp_le list.set_sel(1) nat_neq_iff prod.collapse)\n  apply(rule_tac ?x = \"fst (hd (q s))+snd(hd(q s))\" in exI)\n  apply(rule_tac ?x = \"fst (last (q s)) + snd (last (q s))\" in exI)\n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) F.distinct(3) bot_nat_0.not_eq_extremum diff_diff_cancel diff_is_0_eq diff_is_0_eq' eq_imp_le le_antisym linorder_neqE_nat zero_less_diff)\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) \n  apply (metis le_neq_implies_less)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply linarith \n  apply (metis bot_nat_0.extremum le_neq_implies_less)\n  apply (metis Suc_leI le_add1 le_neq_implies_less le_trans not_less_eq_eq) \n  apply (metis (no_types, lifting) F.distinct(3) le_neq_implies_less)\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply (metis le_neq_implies_less)\n  apply (metis Suc_diff_Suc Zero_not_Suc diff_is_0_eq')\n  apply (metis (no_types, hide_lams) F.distinct(21) nat_less_le)\n  apply blast\n  apply blast\n  apply fastforce\n  apply fastforce\n  apply blast\n  apply blast\n  apply blast \n  apply (metis nat_less_le)\n  apply (metis nat_less_le)\n  apply (metis le_neq_implies_less)\n  apply (metis add_cancel_right_left le_neq_implies_less)\n  apply (metis le_neq_implies_less)\n  apply (metis le_neq_implies_less)\n  defer \n  apply fastforce\n  defer defer \n  apply force\n  apply (metis add_cancel_right_left le_neq_implies_less list.set_sel(1) prod.collapse)\n  apply (metis add_cancel_right_left le_neq_implies_less list.set_sel(1) prod.collapse)\n  apply(intro iffI)\n  prefer 2 \n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1 ) \") prefer 2 \n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"last(q s) \\<noteq> hd(q s) \\<longrightarrow> length(q s)>1\") prefer 2 \n  apply (metis One_nat_def)\n  using str_pec_5 [where s=s] \n  apply (metis (no_types, hide_lams) One_nat_def add.commute nat_less_le)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s)) < fst (last (q s)) + snd (last (q s))\") prefer 2\n  apply force\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1 ) \") prefer 2 \n  apply (metis last_conv_nth)\n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_self_eq_0 length_greater_0_conv less_not_refl2)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = q s!1\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def hd_conv_nth last_conv_nth length_greater_0_conv length_tl list.size(3) nat_neq_iff nth_tl)\n  apply(subgoal_tac \"fst(q s!0) = 0\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s)) = fst(q s!0) + snd(q s!0)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)\") prefer 2\n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_add_inverse last_conv_nth length_greater_0_conv nat_neq_iff plus_1_eq_Suc)\n  apply(subgoal_tac \"fst(q s!0) \\<noteq> fst(q s!1)\") prefer 2 \n  apply (metis (no_types, hide_lams) bot_nat_0.not_eq_extremum length_greater_0_conv less_one)\n  apply (metis (no_types, hide_lams) Suc_diff_1 diff_self_eq_0 less_one)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s)-1)\") prefer 2 \n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"length(tl(q s)) = length(q s)-1\") prefer 2\n  apply (metis length_tl)\n  apply(subgoal_tac \"last(tl(q s)) = (tl(q s)!(length(tl(q s)) -1))\") prefer 2 \n  apply (metis (no_types, lifting) hd_conv_nth last_conv_nth length_0_conv less_not_refl2)\n  apply(subgoal_tac \"last(tl(q s)) = (tl(q s)!(length(q s) -2))\") prefer 2 \n  apply (metis Suc_1 diff_Suc_eq_diff_pred)\n  by (metis (no_types, hide_lams) hd_conv_nth last_tl length_0_conv nat_less_le)\n\n\n\n\n\n\n\n\nlemma R_idle_to_nidle_lemma_case_1_6_3:\n  \"case_2 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> fst(hd(q s)) = T s \\<Longrightarrow> H s \\<noteq> fst(last(q s))+snd(last(q s))\n\\<Longrightarrow>case_2 s'\"\n  apply(subgoal_tac \"T s\\<noteq>0\") prefer 2\n  apply(simp add:case_2_def) \n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply (metis RingBuffer_BD_latest_2.inv_def)\n  apply (metis gr0I less_nat_zero_code)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using pec_prelim_9 [where s=s]\n  apply blast\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:pre_R_def pre_dequeue_inv_def)\n  apply(simp add:case_2_def ) \n  apply(clarify) \n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) le_antisym less_or_eq_imp_le list.set_sel(1) nat_neq_iff prod.collapse)\n  apply(rule_tac ?x = \"0\" in exI)\n  apply(rule_tac ?x = \"offset s\" in exI)\n  apply(intro conjI impI)  \n  apply blast\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) \n  apply (metis nat_less_le)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply(subgoal_tac \"H s < T s\") prefer 2\n  apply linarith\n  apply linarith\n  apply(rule_tac ?x = \"fst(hd(q s)) + snd(hd(q s))\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"f\" in exI)\n  apply(intro conjI impI)  \n  apply (metis (no_types, lifting) F.distinct(21) le_eq_less_or_eq linorder_neqE_nat)\n  apply linarith \n  apply metis \n  apply (metis Suc_leI le_less_Suc_eq le_trans less_or_eq_imp_le not_less_eq not_less_eq_eq) \n  apply (metis F.distinct(3) bot_nat_0.not_eq_extremum le_neq_implies_less)\n  apply (metis Suc_leI not_less_eq_eq)\n  apply (metis trans_less_add1)\n  apply (metis diff_is_0_eq' le_add1 le_less_Suc_eq le_trans not_less_eq zero_less_diff)\n  apply clarify\n  apply(intro conjI impI)\n  apply(subgoal_tac \"ownB s i = Q\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"j\\<ge>f \\<and> j\\<le>N \\<longrightarrow> ownB s j \\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(21) F.distinct(23) le_neq_implies_less)\n  apply(subgoal_tac \" T s + snd (hd (q s)) \\<le>N\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \" T s + snd (hd (q s)) \\<le>f\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(21) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"i < T s + snd (hd (q s))\") prefer 2\n  apply meson\n  apply linarith\n  apply metis\n  apply metis\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  using add_gr_0 apply presburger\n  apply meson\n  apply linarith\n  apply force \n  apply (metis nat_less_le)\n  apply force\n  apply force\n  apply force\n  using diff_add_inverse apply presburger\n  apply(intro iffI) prefer 2 \n  apply(subgoal_tac \"(fst(q s!1) = fst(q s!0)+snd(q s!0)) \\<or> fst(q s!1) =0\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 less_one)\n  apply(subgoal_tac \"(q s!0) =hd(q s)\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"(q s!1) =hd(tl(q s))\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def hd_conv_nth length_tl lessI list.size(3) not_less_eq nth_tl zero_less_diff)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"(q s!1)\\<in>set(q s)\") prefer 2 \n  apply (metis One_nat_def nth_mem)\n  apply(subgoal_tac \"(q s!1) = (sta,leng) \\<longrightarrow> (sta,leng)\\<in>set(q s)\") prefer 2 \n  apply metis\n  apply(case_tac \"fst(q s!1) = 0\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(21) le_eq_less_or_eq linorder_neqE_nat prod.collapse)\n  apply(subgoal_tac \"0<offset s\") \n  apply meson\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. ( x = {i. fst(hd(tl(q s))) \\<le> i \\<and> i < fst(hd(tl(q s))) + snd(hd(tl(q s)))} ) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\") prefer 2\n  apply(subgoal_tac \"(fst(hd(tl(q s))),snd(hd(tl(q s))))\\<in>set(q s)\") prefer 2 \n  apply (metis prod.collapse)\n  apply (metis (no_types, lifting) mem_Collect_eq) defer (*the isar*)\n  apply(case_tac \"0<offset s\") \n  apply(subgoal_tac \"\\<exists>i.(fst(q s!i) =0 \\<and> i<length(q s))\") \n  apply (metis Suc_lessI hd_conv_nth length_greater_0_conv less_Suc0)\n  apply(subgoal_tac \"ownB s 0 = Q\") prefer 2 \n  apply (metis gr_zeroI zero_le)\n  apply(subgoal_tac \"\\<forall>i. (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(0 \\<le> N \\<and> ownB s 0 = Q)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<exists>sta leng.((sta,leng)\\<in>set(q s) \\<and> sta=0)\") prefer 2 \n  apply (metis gr_implies_not_zero mem_Collect_eq nat_less_le)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> q s!i=(a,b)))\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply clarify\n  apply(subgoal_tac \"k<length(q s) \\<and> (q s!k) = (0,leng) \\<longrightarrow> k\\<noteq>0\") prefer 2\n  apply (metis fst_conv hd_conv_nth)\n  apply (metis fst_eqD)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s)) < f\") prefer 2 \n  apply meson\n  apply(subgoal_tac \"i\\<ge>fst (hd (q s)) + snd (hd (q s)) \\<and> i<f \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis add_leD1 le_eq_less_or_eq)\n  apply(subgoal_tac \"\\<forall>i. (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s))\\<le>N \\<and> ownB s (fst (hd (q s)) + snd (hd (q s))) = Q\") prefer 2\n  apply (metis Suc_le_lessD le_add1 le_neq_implies_less not_less_eq_eq)\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a\\<le>fst (hd (q s)) + snd (hd (q s)) \\<and> fst (hd (q s)) + snd (hd (q s))<a+b)\")\n  prefer 2 \n  using pec_prelim_3 [where s=s ]\n  apply presburger apply clarify\n  apply(subgoal_tac \"\\<exists>i.(i<length(q s) \\<and> q s!i = (aa,ba))\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"aa\\<noteq>fst(hd(q s))\") prefer 2 \n  apply (metis (no_types, lifting) fst_eqD hd_conv_nth length_pos_if_in_set nat_neq_iff snd_eqD)\n  apply clarify\n  apply(subgoal_tac \"ia\\<noteq>0\") prefer 2 \n  apply (metis fst_eqD hd_conv_nth)\n  apply linarith\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = q s!1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def diff_is_0_eq' hd_conv_nth last_conv_nth le_add1 le_add_diff_inverse2 le_less_Suc_eq le_trans length_greater_0_conv length_tl less_or_eq_imp_le list.size(3) not_less_eq nth_tl)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2\n  apply presburger\n  apply(case_tac \"b=0\")\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s 0\\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(3))\n  apply(subgoal_tac \"i<fst(q s!0) \\<longrightarrow> ownB s i\\<noteq>Q\") prefer 2 \n  apply (metis (no_types, hide_lams) F.distinct(19) bot_nat_0.extremum diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x.(x = {i. a\\<le>i \\<and> i < a + b} \\<and> a\\<in>x))\") prefer 2\n  apply (metis Nat.add_0_right le_refl mem_Collect_eq nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> ownB s a = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis One_nat_def Suc_lessI diff_Suc_1 last_conv_nth length_greater_0_conv nat_neq_iff)\n  apply(subgoal_tac \"\\<nexists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\") prefer 2\n  apply metis\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> q s!i = (a,b)))\")\n  prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"fst(q s!1)\\<noteq>0\") prefer 2\n  apply (metis nth_mem prod.collapse)\n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 less_one)\n  apply(subgoal_tac \"\\<forall>i.  (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s 0 = Q \\<and> 0\\<le>N\") prefer 2\n  apply (metis gr_zeroI zero_le)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\") prefer 2\n  using pec_prelim_2 [where s=s] \n  apply presburger\n  apply clarify\n  apply(subgoal_tac \"ownB s (fst (hd (q s)) + snd (hd (q s))) = Q \\<and> fst (hd (q s)) + snd (hd (q s))\\<le>N\") prefer 2 \n  apply (metis Suc_le_lessD le_add1 le_less_Suc_eq not_less_eq_eq)\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> fst (hd (q s)) + snd (hd (q s)) \\<in> x)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.(a\\<le>fst (hd (q s)) + snd (hd (q s)) \\<and> fst (hd (q s)) + snd (hd (q s))<a+b \\<and> (a,b)\\<in>set(q s))\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply clarify\n  apply(subgoal_tac \"\\<exists>ass. (ass<length(q s) \\<and> q s!ass = (0,ba))\") prefer 2 \n  apply (metis in_set_conv_nth) \n  apply(subgoal_tac \"\\<exists>tru. (tru<length(q s) \\<and> q s!tru = (ad,bd))\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(clarify)\n  apply(subgoal_tac \"ad = fst(hd(q s))+snd(hd(q s))\") prefer 2\n  apply (metis (no_types, lifting) hd_in_set le_antisym pec_prelim_8 prod.collapse)\n  apply(subgoal_tac \"ad\\<noteq>0\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"ass\\<noteq>tru\") prefer 2\n  apply (metis fst_conv)\n  apply(subgoal_tac \"ass\\<noteq>0\") prefer 2 \n  apply (metis fst_conv)\n  apply(subgoal_tac \"tru\\<noteq>0\") prefer 2\n  apply (metis fst_conv less_irrefl_nat snd_conv)\n  apply(subgoal_tac \"length(q s)>2\") prefer 2\n  using Nat.lessE Suc_1 Suc_diff_1 Suc_lessI bot_nat_0.not_eq_extremum apply linarith\n  apply(subgoal_tac \"Q_structure s\") prefer 2 apply presburger \n  apply(subgoal_tac \"fst(q s!ass) = 0\") prefer 2\n  apply (metis prod.collapse prod.inject)\n  apply(subgoal_tac \"fst(q s!tru) = fst(q s!0) + snd(q s!0)\") prefer 2 \n  apply (metis prod.collapse prod.inject)\n  apply(subgoal_tac \"ass<length(q s) \\<and> tru<length(q s)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"tru=1\") prefer 2   \n  defer (*another ISAR*) using pec_prelim_11 [where s=s and i=ass and j=tru]\n  apply metis\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI add_leD1 diff_Suc_1 hd_conv_nth last_conv_nth le_antisym le_neq_implies_less length_greater_0_conv less_or_eq_imp_le)\n  apply(subgoal_tac \"ownB s (fst(hd(q s))+snd(hd(q s))) \\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(21) F.distinct(23) eq_imp_le le_neq_implies_less)\n  apply(subgoal_tac \"\\<forall>i.  (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x.(x = {i. a\\<le>i \\<and> i < a + b} \\<and> a\\<in>x))\") prefer 2\n  apply (metis Nat.add_0_right le_refl mem_Collect_eq nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> ownB s a = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow>(a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.set_sel(2))\n  apply(subgoal_tac \"hd(tl(q s))\\<in>set(tl(q s))\") prefer 2 \n  apply (metis diff_is_0_eq' hd_in_set length_tl list.size(3) zero_less_diff)\n  apply(subgoal_tac \"hd(tl(q s)) \\<in>set (q s)\") prefer 2\n  apply (metis list.set_sel(2))\n  apply(subgoal_tac \"ownB s (fst(hd(tl(q s)))) = Q\") prefer 2 \n  apply (metis prod.collapse)\n  apply(subgoal_tac \"ownB s (fst(hd(q s))+snd(hd(q s))) \\<noteq>Q\") prefer 2\n  apply blast\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = q s!1\") prefer 2 \n  apply (metis One_nat_def hd_conv_nth length_greater_0_conv length_pos_if_in_set nth_tl)\n  apply(subgoal_tac \"fst(hd(tl(q s)))\\<noteq>fst(hd(q s))+snd(hd(q s))\") prefer 2\n  apply metis\n  apply (metis (no_types, lifting) One_nat_def diff_Suc_1 less_one)\n  apply(subgoal_tac \"fst(last(q s)) + snd(last(q s)) = offset s\") prefer 2\n  apply (metis nat_less_le)\n  apply(subgoal_tac \"0<b\") prefer 2 \n  apply (metis bot_nat_0.not_eq_extremum)\n  apply(subgoal_tac \"\\<forall>i.  (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s 0 = Q \\<and> 0\\<le>N\") prefer 2\n  apply (metis gr_zeroI zero_le)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> 0 \\<in> x)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=0)\") prefer 2\n  using pec_prelim_2 [where s=s] \n  apply presburger\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>i.(i<length(q s) \\<and> (a,b) = q s!i))\") prefer 2\n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"length(q s)>1\") prefer 2\n  apply (metis One_nat_def Suc_lessI add_leD1 diff_Suc_1 hd_conv_nth last_conv_nth le_antisym length_pos_if_in_set less_or_eq_imp_le nat_neq_iff)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s)-1)\") prefer 2\n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"length(tl(q s)) = length(q s)-1\") prefer 2 \n  apply (metis length_tl)\n  apply(subgoal_tac \"last(tl(q s)) = q s!(length(q s)-1)\") prefer 2\n  apply (metis F.distinct(11) last_tl list.size(3) zero_less_diff)\n  apply metis\n  apply(subgoal_tac \"offset s = b\") prefer 2\n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"\\<forall>i.  (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x.(x = {i. a\\<le>i \\<and> i < a + b} \\<and> a\\<in>x))\") prefer 2\n  apply (metis Nat.add_0_right le_refl mem_Collect_eq nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> ownB s a = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow>(a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.set_sel(2))\n  apply(subgoal_tac \"ownB s (fst (hd (q s)) + snd (hd (q s))) = Q \\<and> fst (hd (q s)) + snd (hd (q s))\\<le>N\") prefer 2 \n  apply (metis Suc_le_lessD le_add1 le_less_Suc_eq not_less_eq_eq)\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> fst (hd (q s)) + snd (hd (q s)) \\<in> x)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.(a\\<le>fst (hd (q s)) + snd (hd (q s)) \\<and> fst (hd (q s)) + snd (hd (q s))<a+b \\<and> (a,b)\\<in>set(q s))\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply clarify\n  apply(subgoal_tac \"\\<exists>tru. (tru<length(q s) \\<and> q s!tru = (ab,bb))\") prefer 2 \n  apply (metis (no_types, lifting) in_set_conv_nth)\n  apply(clarify)\n  apply(subgoal_tac \"tru\\<noteq>0\") prefer 2 \n  apply (metis fst_conv hd_conv_nth less_irrefl_nat snd_conv) apply(subgoal_tac \"length(q s)>1\") \n  prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow>(a,b)\\<in>set(q s)\") prefer 2\n  apply meson\n  apply(subgoal_tac \"last(q s) = last(tl(q s))\") prefer 2\n  apply (metis diff_is_0_eq' last_tl length_tl list.size(3) zero_less_diff)\n  apply (metis nat_less_le)\n  apply (metis diff_add_inverse diff_is_0_eq' le_less_Suc_eq linorder_neqE_nat list.set_sel(1) not_add_less1 not_less_eq prod.collapse)\n  apply (metis add_eq_self_zero list.set_sel(1) prod.collapse)\n  proof -\n  fix a :: nat and b :: nat and c :: nat and d :: nat and e :: nat and f :: nat and x :: \"nat set\" and aa :: nat and ba :: nat and ab :: nat and bb :: nat and xa :: \"nat set\" and ac :: nat and bc :: nat and ad :: nat and bd :: nat and assa :: nat and trua :: nat\n  assume a1: \"Q_structure s\"\n  assume a2: \"assa < length (q s)\"\n  assume a3: \"trua < length (q s)\"\n  assume a4: \"assa \\<noteq> 0\"\n  assume a5: \"2 < length (q s)\"\n  assume a6: \"fst (q s ! assa) = 0\"\n  assume \"fst (q s ! trua) = fst (q s ! 0) + snd (q s ! 0)\"\n  then show \"trua = 1\"\n  using a6 a5 a4 a3 a2 a1 by (metis (no_types) pec_prelim_11)\n  next\n  show \" \\<And>a b c d e f.\n       pcR s = idleR \\<Longrightarrow> s' = s\n       \\<lparr>ownB := \\<lambda>i. if T s \\<le> i \\<and> i < T s + snd (hd (q s)) then R else ownB s i, numDeqs := Suc (numReads s), ownT := R,\n          tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr> \\<Longrightarrow>  q s \\<noteq> [] \\<Longrightarrow>  fst (hd (q s)) = T s \\<Longrightarrow> H s \\<noteq> fst (last (q s)) + snd (last (q s)) \\<Longrightarrow> 0 < T s \\<Longrightarrow> Q_structure s \\<Longrightarrow> 0 < n \\<Longrightarrow> tempR s = (0, 0) \\<Longrightarrow> H s \\<le> N \\<Longrightarrow> 0 \\<le> b \\<Longrightarrow> n < N \\<Longrightarrow>  numDeqs s = numReads s \\<Longrightarrow> T s \\<le> N \\<Longrightarrow>   b \\<le> H s \\<Longrightarrow>  numEnqs s \\<le> n \\<Longrightarrow> ownT s = Q \\<Longrightarrow> hW s \\<le> N \\<Longrightarrow>   H s < T s \\<Longrightarrow> numReads s \\<le> numEnqs s \\<Longrightarrow> \\<forall>i<n. Data s i \\<le> N \\<and> 0 < Data s i \\<Longrightarrow> \\<forall>i. T s \\<le> i \\<and> i < T s + snd (hd (q s)) \\<longrightarrow> ownB s i = Q \\<Longrightarrow> \\<forall>i. (i < fst (tempR s) \\<longrightarrow> ownB s i \\<noteq> R) \\<and> (fst (tempR s) + snd (tempR s) \\<le> i \\<and> i \\<le> N \\<longrightarrow> ownB s i \\<noteq> R) \\<Longrightarrow>\n       tW s \\<le> N \\<Longrightarrow>  T s \\<le> e \\<Longrightarrow>  0 < H s \\<Longrightarrow> e \\<le> f \\<Longrightarrow> \\<forall>i. (i < numReads s \\<longrightarrow> ownD s i = R) \\<and>\n           (numReads s \\<le> i \\<and> i < numWrites s \\<longrightarrow> ownD s i = B) \\<and> (numWrites s \\<le> i \\<and> i < n \\<longrightarrow> ownD s i = W) \\<Longrightarrow>\n       f \\<le> N \\<Longrightarrow>  numEnqs s - numReads s = length (q s) \\<Longrightarrow> \\<forall>i<0. ownB s i = R \\<Longrightarrow> numReads s \\<le> numWrites s \\<Longrightarrow>\\<forall>i. 0 \\<le> i \\<and> i < b \\<longrightarrow> ownB s i = Q \\<Longrightarrow> numWrites s \\<le> n \\<Longrightarrow> \\<forall>i. b \\<le> i \\<and> i < H s \\<longrightarrow> ownB s i = W \\<Longrightarrow>\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N \\<Longrightarrow> \\<forall>i. H s \\<le> i \\<and> i < T s \\<longrightarrow> ownB s i = B \\<Longrightarrow> \\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n           fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \\<Longrightarrow>\n       \\<forall>i. T s \\<le> i \\<and> i < e \\<longrightarrow> ownB s i = R \\<Longrightarrow>\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j) \\<Longrightarrow>\\<forall>i. e \\<le> i \\<and> i < f \\<longrightarrow> ownB s i = Q \\<Longrightarrow> \\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa \\<Longrightarrow>\\<forall>i. f \\<le> i \\<and> i < N \\<longrightarrow> ownB s i = D \\<Longrightarrow>\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s)) \\<Longrightarrow> ownB s N = F.None \\<Longrightarrow> \\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b \\<Longrightarrow> 0 < 0 \\<longrightarrow> e = T s \\<Longrightarrow> \\<forall>i<length (q s). data_index s (q s ! i) = numReads s + i \\<Longrightarrow>\n       T s < e \\<longrightarrow> 0 = 0 \\<Longrightarrow>\\<forall>i<length (q s). snd (q s ! i) = Data s (numReads s + i) \\<Longrightarrow>e < f \\<longrightarrow> 0 = 0 \\<Longrightarrow> \\<forall>i<length (q s). ownD s (i + numReads s) = B \\<Longrightarrow> 0 < H s \\<Longrightarrow>\\<forall>i\\<le>N. \\<forall>j\\<le>N. data_index s (i, j) < n \\<Longrightarrow>\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q) \\<Longrightarrow>\n       b < H s \\<longrightarrow> offset s = b \\<Longrightarrow>b < H s \\<longrightarrow> Data s (numEnqs s) = H s - b \\<Longrightarrow> T s < e \\<longrightarrow> T s = 0 \\<Longrightarrow>\\<not> T s < e \\<Longrightarrow> e < f \\<or> 0 < b \\<Longrightarrow> e < f \\<longrightarrow> T s = e \\<Longrightarrow> f = e \\<and> 0 < b \\<longrightarrow> T s = 0 \\<Longrightarrow>0 < b \\<longrightarrow> fst (last (q s)) + snd (last (q s)) = b \\<Longrightarrow>b = 0 \\<and> e < f \\<longrightarrow> fst (last (q s)) + snd (last (q s)) = f \\<Longrightarrow>\\<not> N < T s + snd (hd (q s)) \\<Longrightarrow>Suc 0 < length (q s) \\<Longrightarrow>fst (q s ! 1) = fst (q s ! 0) + snd (q s ! 0) \\<or> fst (q s ! 1) = 0 \\<Longrightarrow>q s ! 0 = hd (q s) \\<Longrightarrow> q s ! 1 = hd (tl (q s)) \\<Longrightarrow>\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> i \\<le> N \\<and> ownB s i = Q \\<Longrightarrow>\n       q s ! 1 \\<in> set (q s) \\<Longrightarrow> q s ! 1 = (sta, leng) \\<longrightarrow> (sta, leng) \\<in> set (q s) \\<Longrightarrow>fst (q s ! 1) = 0 \\<Longrightarrow> \\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> i \\<le> N \\<and> ownB s i = Q \\<Longrightarrow>\n       \\<forall>i. (\\<exists>x. x = {i. fst (hd (tl (q s))) \\<le> i \\<and> i < fst (hd (tl (q s))) + snd (hd (tl (q s)))} \\<and> i \\<in> x) \\<longrightarrow>\n           i \\<le> N \\<and> ownB s i = Q \\<Longrightarrow>0 < offset s\"\n  proof -\n  fix a :: nat and b :: nat and c :: nat and d :: nat and e :: nat and f :: nat\n  assume a1: \"H s \\<noteq> fst (last (q s)) + snd (last (q s))\"\n  assume \"0 < n\"\n  assume a2: \"0 \\<le> b\"\n  assume a3: \"b \\<le> H s\"\n  assume \"H s < T s\"\n  assume \"T s \\<le> e\"\n  assume a4: \"0 < H s\"\n  assume a5: \"\\<forall>i. b \\<le> i \\<and> i < H s \\<longrightarrow> ownB s i = W\"\n  assume a6: \"\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b\"\n  assume a7: \"b < H s \\<longrightarrow> offset s = b\"\n  assume \"\\<not> T s < e\"\n  assume \"e < f \\<or> 0 < b\"\n  assume a8: \"0 < b \\<longrightarrow> fst (last (q s)) + snd (last (q s)) = b\"\n  assume a9: \"q s ! 1 = hd (tl (q s))\"\n  assume a10: \"q s ! 1 \\<in> set (q s)\"\n  assume a11: \"fst (q s ! 1) = 0\"\n  assume a12: \"\\<forall>i. (\\<exists>x. x = {i. fst (hd (tl (q s))) \\<le> i \\<and> i < fst (hd (tl (q s))) + snd (hd (tl (q s)))} \\<and> i \\<in> x) \\<longrightarrow> i \\<le> N \\<and> ownB s i = Q\"\n  have \"\\<not> (0::nat) \\<le> 0 \\<or> fst (hd (tl (q s))) \\<le> 0 \\<and> 0 < fst (hd (tl (q s))) + snd (hd (tl (q s)))\"\n  using a11 a10 a9 a6 by (metis (no_types) plus_nat.add_0 prod.collapse)\n  then have \"0 \\<noteq> b\"\n  using a12 a5 a4 by force\n  then show \"0 < offset s\"\n  using a8 a7 a3 a2 a1 by (metis nat_less_le)\n  qed\n  qed\n  \n  \n\n\n\n\n\n\n\n\nlemma R_idle_to_nidle_lemma_case_1_6_4:\n  \"case_2 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> fst(hd(q s)) \\<noteq> T s \\<Longrightarrow> H s = fst(last(q s))+snd(last(q s))\n\\<Longrightarrow>case_2 s'\"\n  apply(subgoal_tac \"T s\\<noteq>0\") prefer 2\n  apply(simp add:case_2_def) \n  apply(subgoal_tac \"Q_structure s\") prefer 2 \n  apply (metis RingBuffer_BD_latest_2.inv_def)\n  apply (metis gr0I less_nat_zero_code)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using pec_prelim_9 [where s=s]\n  apply blast\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:pre_R_def pre_dequeue_inv_def)\n  apply(simp add:case_2_def ) \n  apply(clarify) \n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) le_antisym less_or_eq_imp_le list.set_sel(1) nat_neq_iff prod.collapse)\n  apply(rule_tac ?x = \"fst (hd (q s))+snd(hd(q s))\" in exI)\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) defer\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) \n  apply (metis le_neq_implies_less)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply linarith \n  apply (metis bot_nat_0.extremum le_neq_implies_less)\n  apply (metis Suc_leI le_add1 le_neq_implies_less le_trans not_less_eq_eq) \n  apply (metis (no_types, lifting) F.distinct(3) le_neq_implies_less)\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply (metis le_neq_implies_less)\n  apply (metis Suc_diff_Suc Zero_not_Suc diff_is_0_eq')\n  apply (metis (no_types, hide_lams) F.distinct(21) nat_less_le)\n  apply blast\n  apply blast\n  apply fastforce\n  apply fastforce\n  using add_gr_0 apply presburger\n  apply blast \n  apply presburger\n  apply (metis nat_less_le)\n  apply (metis nat_less_le)\n  apply (metis le_neq_implies_less)\n  apply (metis add_cancel_right_left le_neq_implies_less)\n  apply (metis le_neq_implies_less)\n  apply (metis le_neq_implies_less) \n  defer \n  apply fastforce\n  apply(subgoal_tac \"fst(hd(q s)) = 0\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"fst (hd (tl (q s))) = fst(q s!1)\") prefer 2 \n  apply (metis One_nat_def hd_conv_nth last_conv_nth length_greater_0_conv length_tl list.size(3) nat_neq_iff nth_tl)\n  apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"fst (hd (tl (q s))) = fst(q s!1)\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"hd (q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd (tl(q s)) = q s!1\") prefer 2\n  apply (metis One_nat_def hd_conv_nth last_conv_nth length_greater_0_conv length_tl list.size(3) nat_neq_iff nth_tl)\n  defer defer\n  apply force\n  apply (metis add_cancel_right_left le_neq_implies_less list.set_sel(1) prod.collapse)\n  apply (metis add_cancel_right_left le_neq_implies_less list.set_sel(1) prod.collapse)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N) \\<longrightarrow> i<H s\") prefer 2 \n  apply (metis F.distinct(19) F.distinct(21) F.distinct(23) le_neq_implies_less less_or_eq_imp_le linorder_neqE_nat)\n  apply(subgoal_tac \"\\<forall>i.(fst(hd(q s))\\<le>i \\<and> i<fst(hd(q s))+snd(hd(q s))) \\<longrightarrow> ownB s i = Q\") prefer 2\n  apply meson\n  apply (metis (no_types, hide_lams) bot_nat_0.not_eq_extremum diff_diff_cancel diff_is_0_eq diff_self_eq_0 zero_less_diff)\n  apply(intro iffI)\n  apply(case_tac \"T s < T s\") \n  apply force apply(subgoal_tac \"\\<not>T s < T s \\<and> ((T s < T s \\<or> fst (hd (q s)) + snd (hd (q s)) < H s)) \\<longrightarrow> H s > fst (hd (q s)) + snd (hd (q s))\") prefer 2\n  apply blast\n  apply(subgoal_tac \"H s > fst (hd (q s)) + snd (hd (q s))\") prefer 2\n  apply force\n  apply(subgoal_tac \"\\<forall>i.  (i \\<le> N \\<and> ownB s i = Q)\\<longrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>x.(x = {i. a\\<le>i \\<and> i < a + b} \\<and> a\\<in>x))\") prefer 2\n  apply (metis Nat.add_0_right le_refl mem_Collect_eq nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> ownB s a = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow>(a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.set_sel(2))\n  apply(subgoal_tac \"fst (hd (q s)) + snd(hd(q s)) \\<le>N\") prefer 2 \n  apply (metis (no_types, lifting) Suc_le_lessD bot_nat_0.extremum le_neq_implies_less not_less_eq_eq)\n  apply(subgoal_tac \"ownB s (fst (hd (q s)) + snd(hd(q s))) = Q\") prefer 2 \n  apply (metis le_add1 le_neq_implies_less)\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> fst (hd (q s)) + snd (hd (q s)) \\<in> x)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<exists>a b.(a\\<le>fst (hd (q s)) + snd (hd (q s)) \\<and> fst (hd (q s)) + snd (hd (q s))<a+b \\<and> (a,b)\\<in>set(q s))\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply clarify\n  apply(subgoal_tac \"\\<exists>tru. (tru<length(q s) \\<and> q s!tru = (ab,bb))\") prefer 2 \n  apply (metis (no_types, lifting) in_set_conv_nth)\n  apply(clarify)\n  apply(subgoal_tac \"tru\\<noteq>0\") prefer 2 \n  apply (metis fst_conv hd_conv_nth less_irrefl_nat snd_conv) apply(subgoal_tac \"length(q s)>1\") \n  prefer 2 \n  apply linarith\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1 ) \") prefer 2 \n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"last(q s) \\<noteq> hd(q s) \\<longrightarrow> length(q s)>1\") prefer 2 \n  apply (metis One_nat_def)\n  using str_pec_5 [where s=s] \n  apply (metis (no_types, hide_lams) One_nat_def add.commute nat_less_le)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s)) < H s\") prefer 2 \n  apply (metis (no_types, hide_lams) One_nat_def add.commute le_neq_implies_less str_pec_5)\n  apply force\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1 ) \") prefer 2 \n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2\n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"hd(tl(q s)) = q s!1\") prefer 2\n  apply (metis (no_types, lifting) One_nat_def hd_conv_nth last_conv_nth length_greater_0_conv length_tl list.size(3) nat_neq_iff nth_tl)\n  apply(subgoal_tac \"fst(q s!0) = 0\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"fst (hd (q s)) + snd (hd (q s)) = fst(q s!0) + snd(q s!0)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)\") prefer 2\n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"length(q s)>1\") prefer 2 \n  apply (metis (no_types, lifting) One_nat_def Suc_lessI diff_add_inverse last_conv_nth length_greater_0_conv nat_neq_iff plus_1_eq_Suc)\n  apply(subgoal_tac \"fst(q s!0) \\<noteq> fst(q s!1)\") prefer 2 \n  apply (metis (no_types, hide_lams) bot_nat_0.not_eq_extremum length_greater_0_conv less_one)\n  apply (metis (no_types, hide_lams) Suc_diff_1 diff_self_eq_0 less_one)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s)-1)\") prefer 2 \n  apply (metis last_conv_nth)\n  apply(subgoal_tac \"length(tl(q s)) = length(q s)-1\") prefer 2\n  apply (metis length_tl)\n  apply(subgoal_tac \"last(tl(q s)) = (tl(q s)!(length(tl(q s)) -1))\") prefer 2 \n  apply (metis (no_types, lifting) hd_conv_nth last_conv_nth length_0_conv less_not_refl2)\n  apply(subgoal_tac \"last(tl(q s)) = (tl(q s)!(length(q s) -2))\") prefer 2 \n  apply (metis Suc_1 diff_Suc_eq_diff_pred)\n  by (metis (no_types, hide_lams) hd_conv_nth last_tl length_0_conv nat_less_le)\n\n\n\n\nlemma R_idle_to_nidle_lemma_case_1_6:\n  \"case_2 s\\<Longrightarrow>con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[]\n\\<Longrightarrow>case_2 s'\"\n  apply (case_tac \"fst(hd(q s)) = T s\") \n  apply (case_tac[!] \"H s = fst(last(q s))+snd(last(q s))\") \n  using R_idle_to_nidle_lemma_case_1_6_1 [where s=s and s'=s'] \n  apply blast \n  using R_idle_to_nidle_lemma_case_1_6_3 [where s=s and s'=s']\n  apply blast \n  using R_idle_to_nidle_lemma_case_1_6_4 [where s=s and s'=s'] \n  apply blast\n  using R_idle_to_nidle_lemma_case_1_6_2 [where s=s and s'=s'] \n  by blast\n    \n\n\n\n\n\n\nlemma strange_things_1:\n  \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n\\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\n\\<Longrightarrow>\n\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl(q s))) \\<and> (i \\<in> x)) \n\\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\"\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow> (a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.sel(2) list.set_sel(2))\n  by blast\n\nlemma strange_things_2:\n  \"Q_structure s\n\\<Longrightarrow> ((a,b)\\<in>set((q s)) \\<and> (a,b)\\<noteq>hd(q s)) \\<longrightarrow> a\\<noteq>fst(hd(q s))\n\" apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> q s!i = (a,b)))\") prefer 2\n  apply (meson in_set_conv_nth)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2 \n  using hd_conv_nth apply auto[1]\n  by (metis fst_conv length_pos_if_in_set)\n\nlemma strange_things_3:\n  \"Q_structure s\n\\<Longrightarrow> (a,b)\\<in>set((q s)) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> q s!i = (a,b)))\n\" apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> q s!i = (a,b)))\") prefer 2\n  apply (meson in_set_conv_nth)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2 \n  using hd_conv_nth apply auto[1]\n  by (metis)\n\nlemma strange_things_4:\n  \"Q_structure s\n\\<Longrightarrow> ((a,b)\\<in>set(q s)) \\<Longrightarrow> \\<exists>j.(j<length(q s) \\<and> q s!j =(a,b))\" \n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"fst(q s!0) = fst(hd(q s))\") prefer 2 \n  apply (metis hd_conv_nth) \n  by (meson in_set_conv_nth)\n  \n\nlemma strange_things_5:\n  \"Q_structure s\n\\<Longrightarrow> ((a,b)\\<in>set(q s)) \\<Longrightarrow> (a,b)\\<noteq>hd(q s) \\<Longrightarrow> \\<exists>j.(j<length(q s) \\<and> q s!j =(a,b) \\<and> j>0)\" \n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"fst(q s!0) = fst(hd(q s))\") prefer 2 \n  apply (metis hd_conv_nth) \n  by (metis bot_nat_0.not_eq_extremum hd_conv_nth in_set_conv_nth)\n\nlemma strange_things_6:\n  \"Q_structure s\n\\<Longrightarrow> ((a,b)\\<in>set(q s)) \\<Longrightarrow> (a,b)\\<noteq>hd(q s) \\<Longrightarrow> a\\<noteq>fst(hd(q s))\" \n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"fst(q s!0) = fst(hd(q s))\") prefer 2 \n  apply (metis hd_conv_nth) \n  by (metis fst_conv hd_conv_nth in_set_conv_nth length_pos_if_in_set) \n\n\nlemma strange_things_7_1:\n  \" Q_structure s\n\\<Longrightarrow> \\<forall>y x.(x \\<in>set(q s) \\<and> y\\<in>set(q s) \\<and> fst(x)>fst(y))\\<longrightarrow>fst(x)\\<ge>end(y)\n\"\n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  by(simp add:Q_lemmas Q_basic_lemmas)\n\nlemma strange_things_7_2:\n  \" Q_structure s\n\\<Longrightarrow> \\<forall>a b aa bb.((a,b) \\<in>set(q s) \\<and> (aa,bb)\\<in>set(q s) \\<and> a>aa)\\<longrightarrow>a\\<ge>aa+bb\n\"\n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  using strange_things_7_1 fst_def end_def \n  by (metis old.prod.inject surjective_pairing)\n  \n\nlemma strange_things_7_3:\n  \" Q_structure s\n\\<Longrightarrow> \\<forall>a b aa bb.((a,b) \\<in>set(q s) \\<and> (aa,bb)\\<in>set(q s) \\<and> a\\<noteq>aa)\\<longrightarrow>(a>aa \\<or> a<aa)\n\"\n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  using strange_things_7_1 fst_def end_def\n  using nat_neq_iff by blast\n\n\nlemma strange_things_7_5:\n  \" Q_structure s \n\\<Longrightarrow> \\<forall>x.(x \\<in>set(tl(q s)))\\<longrightarrow>(fst(x)\\<noteq>fst(hd(q s)))\n\" apply clarify \n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"(\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j))\")\n  prefer 2 \n  apply (metis less_nat_zero_code list.size(3)) apply clarify\n  apply(subgoal_tac \"\\<nexists>i.(i<length(q s) \\<and> i>0 \\<and> (fst (hd (q s)), b) = q s!i)\") prefer 2 \n  apply (metis fst_conv gr_implies_not_zero hd_conv_nth length_greater_0_conv)\n  apply(subgoal_tac \"\\<forall>i j.(fst (q s ! i) = fst (q s ! j))\\<longrightarrow> (i=j\\<or>i \\<ge> length (q s) \\<or> j \\<ge>  length (q s))\") prefer 2 \n  apply (meson bot_nat_0.not_eq_extremum diff_is_0_eq zero_less_diff) \n  apply(case_tac \"tl(q s) = []\") \n  apply (metis length_greater_0_conv length_pos_if_in_set)\n  apply clarsimp\n  apply(subgoal_tac \"(fst (hd (q s)), b) \\<in> set (tl (q s))\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set((q s)) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> q s!i = (a, b)))\") prefer 2 \n  apply (meson in_set_conv_nth)\n  apply(subgoal_tac \"length(q s) -1 = length(tl(q s))\") prefer 2 \n  apply (metis length_tl)\n  apply(subgoal_tac \"hd(q s) = q s !0\") prefer 2 \n  apply (meson Q_ind_imp_tail_ind_1)\n  apply(subgoal_tac \"\\<forall>i.(i<length(tl(q s)))\\<longrightarrow>tl(q s)!i = q s!(i+1)\") prefer 2 \n  apply (metis Suc_eq_plus1 nth_tl)\n  by (smt (z3) One_nat_def diff_Suc_less gr_implies_not0 in_set_conv_nth length_greater_0_conv lessI less_trans_Suc nth_tl)\n\nlemma strange_things_7_almost_there_1:\n  \" Q_structure s\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> tl(q s)\\<noteq>[]\n\\<Longrightarrow>\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a + b > aa \\<longrightarrow>a \\<ge> aa \"\n  apply(simp add:Q_lemmas Q_basic_lemmas) \n  by (metis le_antisym le_eq_less_or_eq nat_neq_iff)\n\nlemma strange_things_7_almost_there_2:\n  \" Q_structure s\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> tl(q s)\\<noteq>[]\n\\<Longrightarrow>\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a \\<ge> aa \\<and> a\\<noteq>aa \\<longrightarrow> a>aa\"\n  by(simp add:Q_lemmas Q_basic_lemmas) \n\n\nlemma strange_things_7_almost_there_3:\n  \" Q_structure s\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> tl(q s)\\<noteq>[]\n\\<Longrightarrow>\\<forall>a b aa ba. (a, b) \\<in> set (q s) \\<and> (aa, ba) \\<in> set (q s) \\<longrightarrow> a>aa \\<longrightarrow> a\\<ge>aa+ba\"\n  by (meson strange_things_7_2)\n\nlemma strange_things_7_almost_there_4:\n  \" Q_structure s\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> tl(q s)\\<noteq>[]\n\\<Longrightarrow>\\<forall>a b aa ba. (a, b) \\<in> set (q s) \\<and> (aa, ba) \\<in> set (q s) \\<longrightarrow> a\\<ge>aa+ba \\<longrightarrow> a+b>aa+ba\"\n  apply(simp add:Q_lemmas Q_basic_lemmas) \n  by (metis le_eq_less_or_eq less_add_same_cancel1 trans_less_add1)\n\nlemma strange_things_7:\n  \" Q_structure s\n\\<Longrightarrow> i \\<in> {i. fst(hd(q s)) \\<le>i \\<and> i<fst(hd(q s)) + snd(hd(q s))}\n\\<Longrightarrow>\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow> (a\\<ge>fst(hd(q s)) + snd(hd(q s)) \\<or> a+b\\<le>fst(hd(q s)))\n\\<Longrightarrow> \\<forall>a b.(a,b)\\<in>set(tl(q s)) \\<longrightarrow> i \\<notin> {i. a \\<le>i \\<and> i<a+b}\n\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  by (meson Suc_leI le_trans not_less_eq_eq)\n\n\nlemma strange_things_8_1_1:\n  \"Q_structure s \\<Longrightarrow>\n\\<forall>a b.(a,b)\\<in>set(tl(q s)) \\<longrightarrow> (\\<exists>i. (i<length(q s) \\<and> i>0 \\<and> (q s!i) = (a,b)))\"\n  by (metis list.sel(2) list.set_sel(2) strange_things_5 strange_things_7_5)\n\n\nlemma strange_things_8_1_2:\n  \"Q_structure s \\<Longrightarrow>\n\\<forall>i.(i<length(q s) \\<and> i>0)\\<longrightarrow> q s!i\\<noteq>q s!0\"\n  by (metis Q_basic_struct_def Q_lemmas(4) Q_offsets_differ_def gr_implies_not0 length_0_conv length_greater_0_conv)\n\nlemma strange_things_8_1_3:\n  \"Q_structure s \\<Longrightarrow>\n\\<forall>i.(i<length(q s) \\<and> i>0)\\<longrightarrow> (fst(q s!i)>fst(q s!0) \\<or> fst(q s!i)<fst(q s!0))\" \n  using Q_gap_lemmas_1_list less_trans by blast\n\n\nlemma strange_things_8_1_4_1:\n  \"Q_structure s \\<Longrightarrow>\n\\<forall>a b.((a,b)\\<in>set(q s) \\<and> (a,b)\\<noteq>hd(q s) \\<and> a<fst(hd(q s)))\\<longrightarrow> a+b\\<le>fst(hd(q s))\" \n  by (metis Q_gap_lemmas_2 eq_fst_iff head_q0 length_pos_if_in_set strange_things_7_2)\n\nlemma strange_things_8_1_4_2:\n  \"Q_structure s \\<Longrightarrow>\n\\<forall>i.(i<length(q s) \\<and> i>0)\\<longrightarrow> (fst(q s!i)\\<noteq>fst(q s!0))\" \n  apply(clarify)\n  by (metis nat_neq_iff strange_things_8_1_3)\n\nlemma strange_things_8_1_4_3:\n  \"Q_structure s \\<Longrightarrow>\n\\<forall>i.(i<length(q s) \\<and> i>0\\<and>fst(q s!i)>fst(q s!0))\\<longrightarrow> fst(q s!i)\\<ge>end(q s!0)\" \n  by (meson Q_gap_lemmas_4_list less_trans)\n\n\nlemma strange_things_8_1_4_4:\n  \"Q_structure s \\<Longrightarrow> case_1 s \\<or> case_2 s \\<Longrightarrow> Q_owns_bytes s \\<Longrightarrow>\n\\<forall>i.(i<length(q s) \\<and> i>0 \\<and> fst(q s!i)<fst(q s!0)) \\<longrightarrow> end(q s!i)<fst(q s!0)\" \n  apply(simp add:Q_lemmas Q_basic_lemmas) apply(clarify)\n  apply(subgoal_tac \"(fst(q s!i), snd(q s!i)) \\<in>set(q s)\") prefer 2 \n  apply (metis nth_mem prod.collapse)\n  apply(subgoal_tac \"(fst(q s!0), snd(q s!0)) \\<in>set(q s)\") prefer 2 \n  apply (metis length_pos_if_in_set nth_mem prod.exhaust_sel)\n  apply(subgoal_tac \"fst (q s ! i) + snd (q s ! i) \\<le> fst (q s ! 0)\") prefer 2\n  apply (metis less_asym' list.size(3))\n  apply(subgoal_tac \"fst (q s ! i) + snd (q s ! i) \\<noteq> fst (q s ! 0)\") \n  apply linarith\n  apply(case_tac \"i=length(q s)-1\") \n  apply (metis last_conv_nth less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"fst(q s!(i+1)) = end(q s!i) \\<or> fst(q s!(i+1)) = 0\") prefer 2 \n  apply (smt (z3) Nat.add_0_right One_nat_def add_Suc_right add_diff_cancel_right' add_gr_0 end_simp list.size(3) nat_neq_iff not_less_eq)\n  apply(case_tac \"fst(q s!(i+1)) = end(q s!i)\") apply simp \n  apply (metis One_nat_def Suc_mono diff_add_inverse less_zeroE list.size(3) not_gr0 not_less_less_Suc_eq plus_1_eq_Suc)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add:case_1_def) \n  apply(clarify)\n  apply(subgoal_tac \"b = fst(q s!0)\") prefer 2 \n  apply (metis head_q0 length_greater_0_conv less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"snd(q s!i)>0\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"b>0\") prefer 2 \n  apply linarith\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(subgoal_tac \"(q s!i)\\<in>set(q s)\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply fastforce\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply meson\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) = q s!i))\") prefer 2\n  apply (metis prod.exhaust_sel)\n  apply(clarify)\n  apply(subgoal_tac \"fst(q s!i)>fst(q s!0)\") \n  apply linarith\n  apply(subgoal_tac \"fst(q s!i)\\<noteq>fst(q s!0)\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>i.(\\<exists>x.( x = {i. a \\<le> i \\<and> i < a + ba} )\\<and> i\\<in>x)\\<longrightarrow>ownB s i = Q\") prefer 2\n  apply metis\n  apply(subgoal_tac \"ba>0\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"a\\<in>{i. a \\<le> i \\<and> i < a + ba}\") prefer 2\n  apply (metis le_eq_less_or_eq less_add_same_cancel1 mem_Collect_eq)\n  apply(subgoal_tac \"ownB s a = Q\") prefer 2 \n  apply presburger\n  apply (metis F.distinct(11) F.distinct(19) fst_eqD leI linorder_neqE_nat)\n  apply(subgoal_tac \"case_2 s\") prefer 2 \n  apply fastforce\n  apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:case_2_def)\n  apply clarify\n  apply(subgoal_tac \"f>e \\<or> a<b\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"e= fst(hd(q s)) \\<or> a = fst(hd(q s))\") prefer 2 \n  apply (metis le_eq_less_or_eq)\n  apply(case_tac \"a = fst(hd(q s))\")\n  apply(subgoal_tac \"(q s!i)\\<in>set(q s)\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply fastforce\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply meson\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) = q s!i))\") prefer 2\n  apply (metis prod.exhaust_sel)\n  apply(clarify)\n  apply(subgoal_tac \"fst(q s!i)>fst(q s!0)\") \n  apply linarith\n  apply(subgoal_tac \"fst(q s!i)\\<noteq>fst(q s!0)\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>i.(\\<exists>x.( x = {i. aa \\<le> i \\<and> i < aa + ba} )\\<and> i\\<in>x)\\<longrightarrow>ownB s i = Q\") prefer 2 sledgehammer\n  apply metis\n  apply(subgoal_tac \"ba>0\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"aa\\<in>{i. aa \\<le> i \\<and> i < aa + ba}\") prefer 2\n  apply (metis le_eq_less_or_eq less_add_same_cancel1 mem_Collect_eq)\n  apply(subgoal_tac \"ownB s aa = Q\") prefer 2 \n  apply metis \n  apply (metis F.distinct(11) fst_conv hd_conv_nth)\n  apply(subgoal_tac \"e = fst (hd (q s))\") prefer 2 \n  apply force\n  apply(subgoal_tac \"b = end(last(q s)) \\<or> f = end(last(q s))\") prefer 2 \n  apply (metis end_simp nat_less_le)\n  apply(case_tac \"f = end(last(q s))\") \n  apply(subgoal_tac \"(q s!i)\\<in>set(q s)\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply fastforce\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply meson\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) = q s!i))\") prefer 2\n  apply (metis prod.exhaust_sel)\n  apply(clarify)\n  apply(subgoal_tac \"fst(q s!i)>fst(q s!0)\") \n  apply linarith\n  apply(subgoal_tac \"fst(q s!i)\\<noteq>fst(q s!0)\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>i.(\\<exists>x.( x = {i. aa \\<le> i \\<and> i < aa + ba} )\\<and> i\\<in>x)\\<longrightarrow>ownB s i = Q\") prefer 2 sledgehammer\n  apply metis\n  apply(subgoal_tac \"ba>0\") prefer 2 \n  apply (metis less_nat_zero_code list.size(3))\n  apply(subgoal_tac \"aa\\<in>{i. aa \\<le> i \\<and> i < aa + ba}\") prefer 2\n  apply (metis le_eq_less_or_eq less_add_same_cancel1 mem_Collect_eq)\n  apply(subgoal_tac \"ownB s aa = Q\") prefer 2 \n  apply metis \n  apply(subgoal_tac \"a=b\") prefer 2 \n  apply (metis (no_types, lifting) end_simp less_trans nat_less_le)\n  apply(subgoal_tac \"\\<forall>i.(i<fst(q s!0))\\<longrightarrow>ownB s i\\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(11) F.distinct(19) F.distinct(3) hd_conv_nth leI)\n  apply (metis fst_eqD)\n  apply(subgoal_tac \"f>e \\<and> b>a\") prefer 2 \n  apply (metis end_simp nat_less_le)\n  apply(subgoal_tac \"fst(q s!i)<fst(hd(q s))\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(subgoal_tac \"(q s!i)\\<in>set(q s)\") prefer 2 \n  apply (metis in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply fastforce\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\")\n  prefer 2\n  apply meson\n  apply(subgoal_tac \"(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) = q s!i))\") prefer 2\n  apply (metis prod.exhaust_sel)\n  apply(clarify)\n  apply(subgoal_tac \"fst(q s!i)>fst(q s!0)\") \n  apply linarith\n  apply(subgoal_tac \"fst(q s!i)\\<noteq>fst(q s!0)\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>i.(\\<exists>x.( x = {i. aa \\<le> i \\<and> i < aa + ba} )\\<and> i\\<in>x)\\<longrightarrow>ownB s i = Q\") prefer 2 sledgehammer\n  apply metis\n  apply(subgoal_tac \"ba>0\") prefer 2 \n  apply (metis)\n  apply(subgoal_tac \"aa\\<in>{i. aa \\<le> i \\<and> i < aa + ba}\") prefer 2\n  apply (metis le_eq_less_or_eq less_add_same_cancel1 mem_Collect_eq)\n  apply(subgoal_tac \"ownB s aa = Q\") prefer 2 \n  apply metis \n  apply(subgoal_tac \"\\<forall>i.(i<fst(q s!0) \\<and> i\\<ge>end(last(q s)))\\<longrightarrow>ownB s i\\<noteq>Q\") prefer 2 \n  apply (metis F.distinct(11) F.distinct(19) F.distinct(3) hd_conv_nth leI)\n  apply(subgoal_tac \"fst(q s!i)<end(last(q s))\") prefer 2 \n  apply (metis fst_eqD leI)\n  apply(subgoal_tac \"\\<forall>i.(i\\<in>{j. j\\<le>aa \\<and> j<aa+ba})\\<longrightarrow>ownB s i = Q\") prefer 2 \n  apply (metis fst_eqD leI le_trans less_eq_nat.simps(1) mem_Collect_eq)\n  apply(subgoal_tac \"aa\\<le>aa+ba \\<and> aa+ba\\<le>end(last(q s))\") prefer 2\n  apply (metis fst_eqD leI le_eq_less_or_eq mem_Collect_eq snd_conv)  \n  apply(subgoal_tac \"fst(q s!i)<aa+ba\") prefer 2 \n  apply (metis fst_conv snd_conv)\n  apply(subgoal_tac \"fst(q s!i)<end(last(q s))\") prefer 2 \n  apply fastforce\n  apply(subgoal_tac \"end(last(q s)) < fst(q s!0)\") prefer 2 \n  apply (metis (no_types, hide_lams) fst_conv head_q0 le_imp_less_Suc le_trans not_less_eq order.strict_trans snd_conv)\n  by (metis eq_fst_iff not_le snd_conv)\n\n\n\n\nlemma strange_things_8_1_4:\n  \"Q_structure s \\<Longrightarrow>case_1 s \\<or> case_2 s \\<Longrightarrow> Q_owns_bytes s \\<Longrightarrow>\n\\<forall>i.(i<length(q s) \\<and> i>0)\\<longrightarrow> ((fst(q s!i)>fst(q s!0) \\<and> fst(q s!i)\\<ge>end(q s!0)) \\<or> (fst(q s!i)<fst(q s!0)) \\<and> end(q s!i)<fst(q s!0))\" \n  apply(simp) \n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> i>0\\<and>fst(q s!i)>fst(q s!0))\\<longrightarrow> fst(q s!i)\\<ge>end(q s!0)\") prefer 2 \n  using strange_things_8_1_4_3 apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> i>0 \\<and> fst(q s!i)<fst(q s!0)) \\<longrightarrow> end(q s!i)<fst(q s!0)\") prefer 2 \n  using strange_things_8_1_4_4 apply blast\n  by (metis end_simp nat_neq_iff strange_things_8_1_4_2)\n\n\n\nlemma strange_things_8_1_5:\n  \"Q_structure s \\<Longrightarrow> case_1 s \\<or> case_2 s \\<Longrightarrow> Q_owns_bytes s \\<Longrightarrow>\n\\<forall>i.(i<length(q s) \\<and> i>0)\\<longrightarrow> ((fst(q s!i)>fst(q s!0) \\<longrightarrow> fst(q s!i)\\<ge>end(q s!0)) \\<and> (fst(q s!i)<fst(q s!0)) \\<longrightarrow> end(q s!i)<fst(q s!0))\" \n  apply(simp) \n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> i>0\\<and>fst(q s!i)>fst(q s!0))\\<longrightarrow> fst(q s!i)\\<ge>end(q s!0)\") prefer 2 \n  using strange_things_8_1_4_3 apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> i>0 \\<and> fst(q s!i)<fst(q s!0)) \\<longrightarrow> end(q s!i)<fst(q s!0)\") prefer 2 \n  using strange_things_8_1_4_4 apply blast \n  by simp\n\n\nlemma strange_things_8_1:\n  \" Q_structure s \\<Longrightarrow> case_1 s \\<or> case_2 s \\<Longrightarrow> Q_owns_bytes s \n\\<Longrightarrow>\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow> (a\\<ge>fst(hd(q s)) + snd(hd(q s)) \\<or> a+b<fst(hd(q s)))\"\n  apply clarify \n  apply(case_tac \"q s=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"tl(q s)=[]\") \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (simp add:Q_lemmas Q_basic_lemmas)apply(subgoal_tac \"Q_structure s\") prefer 2 \n  using pec_prelim_9 [where s=s] \n  apply (simp add: pec_prelim_10)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2 \n  using Q_ind_imp_tail_ind_1 apply auto[1]\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s)) \\<longrightarrow> (a,b)\\<in>set(q s)\") prefer 2\n  apply (meson list.set_sel(2))\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s) \\<and> (a,b)\\<noteq>hd(q s)) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> i>0 \\<and> (a,b) = q s!i))\") prefer 2\n  apply (metis gr0I in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s)) \\<longrightarrow> a>fst(hd(q s)) \\<or> a<fst(hd(q s))\") prefer 2\n  using strange_things_7_3 [where s=s] pec_prelim_10 [where s=s] strange_things_7_5 [where s=s]  \n   apply clarsimp \n  apply (meson nat_neq_iff)\n  apply(subgoal_tac \"hd(q s) = q s!0\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set((q s)) \\<longrightarrow> (\\<exists>i.(i<length(q s) \\<and> q s!i = (a, b)))\") prefer 2 \n  apply (meson in_set_conv_nth)\n  apply(subgoal_tac \"length(q s) -1 = length(tl(q s))\") prefer 2 \n  apply (metis length_tl)\n  apply(subgoal_tac \"hd(q s) = q s !0\") prefer 2 \n  apply (meson Q_ind_imp_tail_ind_1)\n  apply(subgoal_tac \"\\<forall>i.(i<length(tl(q s)))\\<longrightarrow>tl(q s)!i = q s!(i+1)\") prefer 2 \n   apply (metis Suc_eq_plus1 nth_tl) apply clarsimp \n  apply(subgoal_tac \"\\<exists>i.(i<length(q s) \\<and> i>0 \\<and> (a,b)\\<in>set(q s))\") prefer 2 \n  apply (metis \\<open>Q_structure s \\<Longrightarrow> \\<forall>x. x \\<in> set (tl (q s)) \\<longrightarrow> fst x \\<noteq> fst (hd (q s))\\<close>)\n  apply(subgoal_tac \"fst (q s ! 0)\\<le>a\") \n   apply (metis add_cancel_right_right le_imp_less_Suc length_pos_if_in_set less_SucE nth_mem surjective_pairing)\n  apply(subgoal_tac \"fst(q s!0) < a\")  \n  apply linarith\n  apply clarsimp\n  apply (thin_tac \"\\<forall>i<length (q s). snd (q s ! i) = Data s (numDeqs s + i)\")\n  apply (thin_tac \"\\<forall>i<length (q s). data_index s (q s ! i) = numDeqs s + i\")\n  apply (thin_tac \"\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)\")\n  apply(thin_tac \"\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n           fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \")\n  apply (thin_tac \"\\<forall>a. (\\<exists>b. (a, b) \\<in> set (tl (q s))) \\<longrightarrow> fst (q s ! 0) < a \\<or> a < fst (q s ! 0)\")\n  apply (subgoal_tac \"(a,b)\\<in>set(q s)\") prefer 2 \n  apply meson\n  apply(case_tac \"(a,b)= last(q s)\")\n  apply (metis Q_gap_lemmas_2 Suc_le_lessD \\<open>Q_structure s \\<Longrightarrow> \\<forall>x. x \\<in> set (tl (q s)) \\<longrightarrow> fst x \\<noteq> fst (hd (q s))\\<close> fst_conv le_neq_implies_less length_greater_0_conv not_less_eq_eq prod.collapse snd_conv)\n  apply(subgoal_tac \" a + b \\<noteq> fst (q s ! 0)\")\n  apply (metis \\<open>Q_structure s \\<Longrightarrow> \\<forall>x. x \\<in> set (tl (q s)) \\<longrightarrow> fst x \\<noteq> fst (hd (q s))\\<close> fst_conv hd_in_set le_neq_implies_less linorder_neqE_nat prod.collapse)\n  apply(subgoal_tac \"a + b > fst (q s ! 0)\") \n  apply linarith\n  apply(subgoal_tac \"(a,b) \\<noteq> last(q s)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"(a,b) \\<noteq> last(tl(q s))\") prefer 2 \n   apply (metis last_tl)\n  apply(subgoal_tac \"last(q s) = q s!(length(q s) -1)\") prefer 2\n  apply (meson last_conv_nth)\n  apply(subgoal_tac \"(a,b)\\<noteq> q s!(length(q s) -1)\") prefer 2 \n   apply metis\n  apply(subgoal_tac \"(a,b)\\<noteq> q s!0\") prefer 2 \n  apply (metis \\<open>Q_structure s \\<Longrightarrow> \\<forall>x. x \\<in> set (tl (q s)) \\<longrightarrow> fst x \\<noteq> fst (hd (q s))\\<close>)\n  apply(subgoal_tac \"\\<exists>k.((a,b) = q s!k \\<and> k>0 \\<and> k<length(q s)-1)\") prefer 2 \n  apply (metis Suc_diff_1 length_greater_0_conv not_less_less_Suc_eq)\n  apply clarify \n  apply(case_tac \"fst(q s!k) <fst(q s!0)\") prefer 2 \n  apply (metis fst_conv less_add_same_cancel1 linorder_neqE_nat)\n  apply(subgoal_tac \"fst(q s!k) < fst(q s!0)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"fst(q s!k) +snd(q s!k) \\<le> fst(q s!0)\") prefer 2 \n  apply (metis hd_in_set prod.collapse)\n  apply(subgoal_tac \"a+b \\<le> fst(q s!0)\") prefer 2 \n  apply (metis fst_conv snd_conv)\n  by (metis end_simp fst_conv snd_conv strange_things_8_1_4_4)\n\n\n\nlemma strange_things_8:\n  \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n\\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\n\\<Longrightarrow>\n\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl(q s))) \\<and> (i \\<in> x)) \n\\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\n\\<Longrightarrow> Q_structure s\n\\<Longrightarrow>\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow> (a\\<ge>fst(hd(q s)) + snd(hd(q s)) \\<or> a+b<fst(hd(q s)))\n\\<Longrightarrow> i \\<in> {i. fst(hd(q s)) \\<le>i \\<and> i<fst(hd(q s)) + snd(hd(q s))}\n\\<Longrightarrow> \\<forall>a b.(a,b)\\<in>set(tl(q s)) \\<longrightarrow> i \\<notin> {i. a \\<le>i \\<and> i<a+b}\n\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(tl(q s))) \\<longrightarrow> (a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.sel(2) list.set_sel(2))\n  apply clarify \n  by (meson Suc_leI le_trans less_or_eq_imp_le not_less_eq_eq)\n  \n  \n\nlemma strange_things_9:\n  \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n\\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\n\n\\<Longrightarrow> Q_structure s\n\\<Longrightarrow>\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow> (a\\<ge>fst(hd(q s)) + snd(hd(q s)) \\<or> a+b\\<le>fst(hd(q s)))\n\\<Longrightarrow> i \\<in> {i. fst(hd(q s)) \\<le>i \\<and> i<fst(hd(q s)) + snd(hd(q s))}\n\\<Longrightarrow> \\<forall>a b.(a,b)\\<in>set(tl(q s)) \\<longrightarrow> i \\<notin> {i. a \\<le>i \\<and> i<a+b}\\<Longrightarrow>\n\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl(q s))) \\<and> (i \\<in> x)) \n\\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\n\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(tl(q s))) \\<longrightarrow> (a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.sel(2) list.set_sel(2))\n  apply clarify \n  by (metis (mono_tags, lifting) mem_Collect_eq)\n  \n\nlemma strange_things_10:\n  \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \n\\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\n\\<Longrightarrow> Q_structure s\n\\<Longrightarrow>\n\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl(q s))) \\<and> (i \\<in> x)) \n\\<longrightarrow> (i \\<le> N \\<and> ownB s i = Q)\n\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(tl(q s))) \\<longrightarrow> (a,b)\\<in>set(q s)\") prefer 2\n  apply (metis list.sel(2) list.set_sel(2))\n  apply clarify \n  by (metis (mono_tags, lifting) mem_Collect_eq)\n\nlemma strange_things_11_1:\n  \"Q_structure s\n\\<Longrightarrow> (i\\<le>N \\<and> ownB s i = Q)\\<longrightarrow>\n((\\<exists>a b. i\\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set ([hd(q s)]))) \\<or> \n     (i\\<in> {i. fst(hd(q s)) \\<le> i \\<and> i < fst(hd(q s))+snd(hd(q s))}))\n\\<Longrightarrow>\\<forall>i.\n ((\\<exists>a b. i\\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (tl(q s)))))\n\\<longrightarrow>((\\<exists>a b. i \\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set ((q s)))) )\n\n\"\n  by (metis list.sel(2) list.set_sel(2))\n\nlemma strange_things_11_2:\n  \"Q_structure s\n\\<Longrightarrow> (i\\<le>N \\<and> ownB s i = Q)\\<longrightarrow>\n((\\<exists>a b. i\\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set ([hd(q s)]))) \\<or> \n     (i\\<in> {i. fst(hd(q s)) \\<le> i \\<and> i < fst(hd(q s))+snd(hd(q s))}))\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow>\\<forall>i.\n ((\\<exists>a b. i\\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set ([hd(q s)]))))\n\\<longrightarrow>((\\<exists>a b. i \\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set ((q s)))) )\n\n\" \n  by (metis ex_in_conv hd_in_set set_ConsD set_empty)\n\nlemma strange_things_11_3:\n  \"Q_structure s\n\\<Longrightarrow> (i\\<le>N \\<and> ownB s i = Q)\\<longrightarrow>\n((\\<exists>a b. i\\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (tl(q s)))) \\<or> \n     (i\\<in> {i. fst(hd(q s)) \\<le> i \\<and> i < fst(hd(q s))+snd(hd(q s))}))\n\\<Longrightarrow>(i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow>\n(\\<exists>x. (((\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (tl(q s)))) \\<and> i \\<in> x) \\<or> \n     (x = {i. fst(hd(q s)) \\<le> i \\<and> i < fst(hd(q s))+snd(hd(q s))} \\<and> i\\<in>x)))\"\n  by blast\n\n\nlemma strange_things_11_4:\n  \"Q_structure s\n\\<Longrightarrow>(i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow>\n(\\<exists>x. (((\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (tl(q s)))) \\<and> i \\<in> x) \\<or> \n     (x = {i. fst(hd(q s)) \\<le> i \\<and> i < fst(hd(q s))+snd(hd(q s))} \\<and> i\\<in>x)))\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> (i\\<le>N \\<and> ownB s i = Q)\\<longrightarrow>\n(\\<exists>a b. i\\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set ((q s))))\"\n  using list.set_sel(2) by fastforce\n\n\nlemma strange_things_11_5:\n  \"Q_structure s\n\\<Longrightarrow> (i\\<le>N \\<and> ownB s i = Q)\\<longrightarrow>\n(\\<exists>a b. i\\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set ((q s))))\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow>(i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow>\n(\\<exists>x. (((\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (tl(q s)))) \\<and> i \\<in> x) \\<or> \n     (x = {i. fst(hd(q s)) \\<le> i \\<and> i < fst(hd(q s))+snd(hd(q s))} \\<and> i\\<in>x)))\" \n  by (metis (no_types, lifting) fst_conv list.collapse mem_Collect_eq set_ConsD snd_conv)\n\n\nlemma strange_things_11_6:\n  \"Q_structure s\n\\<Longrightarrow> (i\\<le>N \\<and> ownB s i = Q)\\<longrightarrow>\n(\\<exists>a b. i\\<in> {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set ((q s))))\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> fst(hd(q s)) \\<le> i \\<longrightarrow> \\<not>i < fst(hd(q s))+snd(hd(q s))\n\\<Longrightarrow>(i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow>\n(\\<exists>x. (((\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (tl(q s)))) \\<and> i \\<in> x)))\" \n  by (metis (no_types, lifting) fst_conv list.collapse mem_Collect_eq set_ConsD snd_conv)\n\n\n\n\nlemma strange_things_11:\n  \" Q_structure s\n\\<Longrightarrow> \\<forall>i. (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow>\n(\\<exists>x. (((\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (q s))) \\<and> i \\<in> x)))\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow>fst(hd(q s))\\<le>i\\<longrightarrow>\\<not>i<fst(hd(q s))+snd(hd(q s))\n\\<Longrightarrow> (i \\<le> N \\<and> ownB s i = Q) \\<Longrightarrow>\n(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x)\"\n  using strange_things_11_6 [where s=s and i=i] \n  by fastforce\n\nlemma strange_things_12:\n  \" Q_structure s\n\\<Longrightarrow> \\<forall>i. (i \\<le> N \\<and> ownB s i = Q) \\<longrightarrow>\n(\\<exists>x. (((\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> ((a, b) \\<in> set (q s))) \\<and> i \\<in> x)))\n\\<Longrightarrow> q s\\<noteq>[]\n\\<Longrightarrow> \\<forall>i. (i \\<le> N \\<and> ownB s i = Q \\<and> (fst(hd(q s))\\<le>i\\<longrightarrow>\\<not>i<fst(hd(q s))+snd(hd(q s))) ) \\<longrightarrow>\n(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x)\"\n  using strange_things_11 [where s=s and i=i] \n  by (simp add: strange_things_11)\n\n\nlemma R_idle_to_nidle_lemma_case_1_7:\n  \"con_assms s \\<Longrightarrow> pcR s = idleR\\<Longrightarrow>pre_R (pcR s) s\n  \\<Longrightarrow>s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\\<Longrightarrow>inv s \\<Longrightarrow>q s\\<noteq>[]\n\\<Longrightarrow>Q_owns_bytes s'\"\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply(simp add: Q_owns_bytes_def )\n  apply(simp add:Q_lemmas Q_basic_lemmas) apply(subgoal_tac \"Q_structure s\") prefer 2 \n  using pec_prelim_9 [where s=s] apply presburger\n  apply(intro allI conjI)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(tl(q s))\\<longrightarrow> (a\\<ge>fst(hd(q s)) + snd(hd(q s)) \\<or> a+b<fst(hd(q s)))\")\n  apply(simp add:Q_indices_def ran_indices_def)\n  using strange_things_8 [where s=s and i=i] apply clarsimp \n  (*SMT*)\n  defer using strange_things_8_1 [where s=s]   (*Sorry*)\n  apply (simp add: pec_prelim_9) \n  using Q_owns_bytes_def apply auto[1]\n  \n  apply clarify\n  apply(intro iffI)\n  apply(simp add:Q_indices_def ran_indices_def)  \n  defer \n  apply(simp add:Q_indices_def ran_indices_def)\n    apply clarify\n  apply(subgoal_tac \"(i \\<le> N \\<and> ownB s i = Q)\") prefer 2 \n     apply fastforce\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> i \\<le> N \\<and> ownB s i = Q\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"Q_structure s\") prefer 2 apply presburger\n  apply(subgoal_tac \"\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x\")\n  using strange_things_11 [where s=s and i=i]  \n     apply blast\n  using strange_things_11 [where s=s and i=i]  \n    defer\n    apply simp\n  apply safe[1] apply clarsimp \n  using Suc_leI le_trans less_or_eq_imp_le not_less_eq_eq\nproof -\n  fix ia :: nat and a :: nat and b :: nat\nassume a1: \"(a, b) \\<in> set (tl (q s))\"\n  assume a2: \"ia < a + b\"\nassume a3: \"a \\<le> ia\"\nassume a4: \"ia < fst (hd (q s)) + snd (hd (q s))\"\nassume a5: \"fst (hd (q s)) \\<le> ia\"\nassume a6: \"\\<forall>a b. (a, b) \\<in> set (tl (q s)) \\<longrightarrow> fst (hd (q s)) + snd (hd (q s)) \\<le> a \\<or> a + b < fst (hd (q s))\"\n  have f7: \"\\<not> Suc ia \\<le> fst (hd (q s))\"\n    using a5 by simp\n  have \"\\<not> Suc ia \\<le> a\"\n    using a3 by (metis (full_types) not_less_eq_eq)\n  then show False\n    using f7 a6 a4 a2 a1 by (meson Suc_leI le_trans less_or_eq_imp_le)\nnext \n  fix ia :: nat and a :: nat and b :: nat\nassume a1: \"(a, b) \\<in> set (tl (q s))\"\n  assume a2: \"ia < a + b\"\nassume a3: \"a \\<le> ia\"\nassume a4: \"ia < fst (hd (q s)) + snd (hd (q s))\"\nassume a5: \"fst (hd (q s)) \\<le> ia\"\nassume a6: \"\\<forall>a b. (a, b) \\<in> set (tl (q s)) \\<longrightarrow> fst (hd (q s)) + snd (hd (q s)) \\<le> a \\<or> a + b < fst (hd (q s))\"\n  have f7: \"\\<not> Suc ia \\<le> fst (hd (q s))\"\n    using a5 by simp\n  have \"\\<not> Suc ia \\<le> a\"\n    using a3 by (metis (full_types) not_less_eq_eq)\n  then show False\n    using f7 a6 a4 a2 a1 by (meson Suc_leI le_trans less_or_eq_imp_le)\nnext\n  fix ia :: nat and a :: nat and b :: nat\nassume a1: \"(a, b) \\<in> set (tl (q s))\"\n  assume a2: \"ia < a + b\"\nassume a3: \"a \\<le> ia\"\nassume a4: \"ia < fst (hd (q s)) + snd (hd (q s))\"\nassume a5: \"fst (hd (q s)) \\<le> ia\"\nassume a6: \"\\<forall>a b. (a, b) \\<in> set (tl (q s)) \\<longrightarrow> fst (hd (q s)) + snd (hd (q s)) \\<le> a \\<or> a + b < fst (hd (q s))\"\n  have f7: \"\\<not> Suc ia \\<le> fst (hd (q s))\"\n    using a5 by simp\n  have \"\\<not> Suc ia \\<le> a\"\n    using a3 by (metis (full_types) not_less_eq_eq)\n  then show False\n    using f7 a6 a4 a2 a1 by (meson Suc_leI le_trans less_or_eq_imp_le)\nnext \n  fix ia :: nat and a :: nat and b :: nat\nassume a1: \"(a, b) \\<in> set (tl (q s))\"\n  assume a2: \"ia < a + b\"\nassume a3: \"a \\<le> ia\"\nassume a4: \"ia < fst (hd (q s)) + snd (hd (q s))\"\nassume a5: \"fst (hd (q s)) \\<le> ia\"\nassume a6: \"\\<forall>a b. (a, b) \\<in> set (tl (q s)) \\<longrightarrow> fst (hd (q s)) + snd (hd (q s)) \\<le> a \\<or> a + b < fst (hd (q s))\"\n  have f7: \"\\<not> Suc ia \\<le> fst (hd (q s))\"\n    using a5 by simp\n  have \"\\<not> Suc ia \\<le> a\"\n    using a3 by (metis (full_types) not_less_eq_eq)\n  then show False\n    using f7 a6 a4 a2 a1 by (meson Suc_leI le_trans less_or_eq_imp_le)\n\nnext show \"\\<And>i. pcR s = idleR \\<Longrightarrow>  s' = s   \\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n            numDeqs := Suc (numReads s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr> \\<Longrightarrow>  q s \\<noteq> [] \\<Longrightarrow>  Q_structure s \\<Longrightarrow>   0 < n \\<Longrightarrow>   tempR s = (0, 0) \\<Longrightarrow>   H s \\<le> N \\<Longrightarrow>    n < N \\<Longrightarrow>    numDeqs s = numReads s \\<Longrightarrow>   T s \\<le> N \\<Longrightarrow>    numEnqs s \\<le> n \\<Longrightarrow>   ownT s = Q \\<Longrightarrow>  hW s \\<le> N \\<Longrightarrow>   numReads s \\<le> numEnqs s \\<Longrightarrow>  \\<forall>i<n. Data s i \\<le> N \\<and> 0 < Data s i \\<Longrightarrow>  0 < H s \\<Longrightarrow>  tW s \\<le> N \\<Longrightarrow> T s \\<noteq> fst (hd (q s)) \\<longrightarrow> (\\<forall>a b j. (a, b) \\<in> set (q s) \\<and> j < N \\<and> T s \\<le> j \\<longrightarrow> a + b < j) \\<Longrightarrow> \\<forall>i. (i < numReads s \\<longrightarrow> ownD s i = R) \\<and>\n             (numReads s \\<le> i \\<and> i < numWrites s \\<longrightarrow> ownD s i = B) \\<and> (numWrites s \\<le> i \\<and> i < n \\<longrightarrow> ownD s i = W) \\<Longrightarrow>\n         \\<forall>i. fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) \\<longrightarrow> ownB s i = Q \\<Longrightarrow>    \\<forall>i\\<le>N. ownB s i \\<noteq> R \\<Longrightarrow>  numEnqs s - numReads s = length (q s) \\<Longrightarrow>   numReads s \\<le> numWrites s \\<Longrightarrow>numWrites s \\<le> n \\<Longrightarrow>\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N \\<Longrightarrow>  \\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \\<Longrightarrow>  \\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j) \\<Longrightarrow>  \\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa \\<Longrightarrow>  \\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s)) \\<Longrightarrow> \\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b \\<Longrightarrow> \\<forall>i<length (q s). data_index s (q s ! i) = numReads s + i \\<Longrightarrow> \\<forall>i<length (q s). snd (q s ! i) = Data s (numReads s + i) \\<Longrightarrow> \\<forall>i<length (q s). ownD s (i + numReads s) = B \\<Longrightarrow>  \\<forall>i\\<le>N. \\<forall>j\\<le>N. data_index s (i, j) < n \\<Longrightarrow> case_1 s \\<or> case_2 s \\<Longrightarrow> \\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q) \\<Longrightarrow>\n         fst (hd (q s)) \\<le> i \\<longrightarrow> \\<not> i < fst (hd (q s)) + snd (hd (q s)) \\<Longrightarrow> i \\<le> N \\<Longrightarrow> ownB s i = Q \\<Longrightarrow>i \\<le> N \\<and> ownB s i = Q \\<Longrightarrow> \\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) \\<longrightarrow> i \\<le> N \\<and> ownB s i = Q \\<Longrightarrow>\n         Q_structure s \\<Longrightarrow> (\\<And>m n. m < n \\<Longrightarrow> Suc m \\<le> n) \\<Longrightarrow>(\\<And>i j k. i \\<le> j \\<Longrightarrow> j \\<le> k \\<Longrightarrow> i \\<le> k) \\<Longrightarrow> (\\<And>m n. m < n \\<or> m = n \\<Longrightarrow> m \\<le> n) \\<Longrightarrow>(\\<And>m n. (\\<not> m \\<le> n) = (Suc n \\<le> m)) \\<Longrightarrow>\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x\"\n    apply(case_tac \"q s=[]\") \n     apply blast\n    apply(subgoal_tac \" \\<forall>i. i \\<le> N \\<and> ownB s i = Q \\<longrightarrow> (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x)\") prefer 2 \n     apply presburger\n    apply(subgoal_tac \"Q_structure s\") prefer 2 apply presburger \n    apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 apply presburger \n    apply(subgoal_tac \"fst (hd (q s)) \\<le> i \\<longrightarrow> \\<not> i < fst (hd (q s)) + snd (hd (q s))\") prefer 2 \n    apply meson\n    using strange_things_12 [where s=s] \n    by blast\nnext show \"\\<And>i. pcR s = idleR \\<Longrightarrow>  s' = s \\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n            numDeqs := Suc (numReads s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr> \\<Longrightarrow>  q s \\<noteq> [] \\<Longrightarrow>\n         Q_structure s \\<Longrightarrow>  0 < n \\<Longrightarrow> tempR s = (0, 0) \\<Longrightarrow>   H s \\<le> N \\<Longrightarrow>   n < N \\<Longrightarrow>numDeqs s = numReads s \\<Longrightarrow>\n         T s \\<le> N \\<Longrightarrow> numEnqs s \\<le> n \\<Longrightarrow> ownT s = Q \\<Longrightarrow>   hW s \\<le> N \\<Longrightarrow>   numReads s \\<le> numEnqs s \\<Longrightarrow>    \\<forall>i<n. Data s i \\<le> N \\<and> 0 < Data s i \\<Longrightarrow>\n         0 < H s \\<Longrightarrow> tW s \\<le> N \\<Longrightarrow>  T s \\<noteq> fst (hd (q s)) \\<longrightarrow> (\\<forall>a b j. (a, b) \\<in> set (q s) \\<and> j < N \\<and> T s \\<le> j \\<longrightarrow> a + b < j) \\<Longrightarrow>\n         \\<forall>i. (i < numReads s \\<longrightarrow> ownD s i = R) \\<and> (numReads s \\<le> i \\<and> i < numWrites s \\<longrightarrow> ownD s i = B) \\<and> (numWrites s \\<le> i \\<and> i < n \\<longrightarrow> ownD s i = W) \\<Longrightarrow>\n         \\<forall>i. fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) \\<longrightarrow> ownB s i = Q \\<Longrightarrow> \\<forall>i\\<le>N. ownB s i \\<noteq> R \\<Longrightarrow>\n         numEnqs s - numReads s = length (q s) \\<Longrightarrow>  numReads s \\<le> numWrites s \\<Longrightarrow>  numWrites s \\<le> n \\<Longrightarrow>  \\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N \\<Longrightarrow>    \\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n             fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \\<Longrightarrow>  \\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j) \\<Longrightarrow> \\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa \\<Longrightarrow>  \\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s)) \\<Longrightarrow>  \\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b \\<Longrightarrow>   \\<forall>i<length (q s). data_index s (q s ! i) = numReads s + i \\<Longrightarrow> \\<forall>i<length (q s). snd (q s ! i) = Data s (numReads s + i) \\<Longrightarrow>  \\<forall>i<length (q s). ownD s (i + numReads s) = B \\<Longrightarrow>  \\<forall>i\\<le>N. \\<forall>j\\<le>N. data_index s (i, j) < n \\<Longrightarrow>  case_1 s \\<or> case_2 s \\<Longrightarrow>  \\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q) \\<Longrightarrow>\n         fst (hd (q s)) \\<le> i \\<longrightarrow> \\<not> i < fst (hd (q s)) + snd (hd (q s)) \\<Longrightarrow>  \\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x \\<Longrightarrow>   (\\<And>m n. m < n \\<Longrightarrow> Suc m \\<le> n) \\<Longrightarrow> (\\<And>i j k. i \\<le> j \\<Longrightarrow> j \\<le> k \\<Longrightarrow> i \\<le> k) \\<Longrightarrow>   (\\<And>m n. m < n \\<or> m = n \\<Longrightarrow> m \\<le> n) \\<Longrightarrow> (\\<And>m n. (\\<not> m \\<le> n) = (Suc n \\<le> m)) \\<Longrightarrow> i \\<le> N \\<and> ownB s i = Q\" \n\n  proof -\n    fix i :: nat\n    assume a1: \"q s \\<noteq> []\"\n    assume a2: \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\"\n    assume a3: \"\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (tl (q s))) \\<and> i \\<in> x\"\n    have \"\\<forall>n. ((\\<exists>N. n \\<in> N \\<and> (\\<exists>n na. (n, na) \\<in> set (q s) \\<and> {nb. n \\<le> nb \\<and> nb < n + na} = N)) \\<or> Q \\<noteq> ownB s n \\<or> \\<not> n \\<le> N) \\<and> (Q = ownB s n \\<and> n \\<le> N \\<or> (\\<forall>N. n \\<notin> N \\<or> (\\<forall>n na. (n, na) \\<notin> set (q s) \\<or> {nb. n \\<le> nb \\<and> nb < n + na} \\<noteq> N)))\"\n      using a2 by (metis (full_types))\n    then show \"i \\<le> N \\<and> ownB s i = Q\"\n      using a3 a1 by (metis (no_types) list.set_sel(2))\n  qed\nqed\n\n\n\nlemma R_read_to_release_lemma_1:\n  \"con_assms s \\<Longrightarrow> pcR s = Read\\<Longrightarrow>pre_Read_inv s\n  \\<Longrightarrow>s'=(s\\<lparr>tR := T s, numReads := Suc (data_index s (tempR s)),\n          pcR := Release,\n          ownD :=\n            \\<lambda>i. if i = data_index s (tempR s) then R\n                 else ownD\n                       (s\\<lparr>tR := T s,\n                            numReads := Suc (data_index s (tempR s)),\n                            pcR := Release\\<rparr>)\n                       i\\<rparr>)\n\\<Longrightarrow>inv s \n\\<Longrightarrow>i>0\\<longrightarrow>ownB s' i = ownB s i \\<and> T s = T s' \\<and> H s = H s' \\<and>\n  tempR s = tempR s' \\<and> offset s = offset s' \\<and> Data s (numEnqs s) = Data s' (numEnqs s')\n  \\<and> q s = q s' \\<and> ownT s = ownT s'\"\n  by simp\n\n\nlemma R_read_to_release_lemma_case_1:\n  \"con_assms s \\<Longrightarrow> pcR s = Read\\<Longrightarrow>pre_Read_inv s\n  \\<Longrightarrow>s'=(s\\<lparr>tR := T s, numReads := Suc (data_index s (tempR s)),\n          pcR := Release,\n          ownD :=\n            \\<lambda>i. if i = data_index s (tempR s) then R\n                 else ownD\n                       (s\\<lparr>tR := T s,\n                            numReads := Suc (data_index s (tempR s)),\n                            pcR := Release\\<rparr>)\n                       i\\<rparr>)\n\\<Longrightarrow>inv s \n\\<Longrightarrow>case_1 s\n\\<Longrightarrow>case_1 s'\"\n  by(simp add:case_1_def)\n\nlemma R_read_to_release_lemma_case_2:\n  \"con_assms s \\<Longrightarrow> pcR s = Read\\<Longrightarrow>pre_Read_inv s\n  \\<Longrightarrow>s'=(s\\<lparr>tR := T s, numReads := Suc (data_index s (tempR s)),\n          pcR := Release,\n          ownD :=\n            \\<lambda>i. if i = data_index s (tempR s) then R\n                 else ownD\n                       (s\\<lparr>tR := T s,\n                            numReads := Suc (data_index s (tempR s)),\n                            pcR := Release\\<rparr>)\n                       i\\<rparr>)\n\\<Longrightarrow>inv s \n\\<Longrightarrow>case_2 s\n\\<Longrightarrow>case_2 s'\"\n  by(simp add:case_2_def)\n\nlemma R_read_to_release_lemma_2:\n  \"con_assms s \\<Longrightarrow> pcR s = Read\\<Longrightarrow>pre_Read_inv s\n  \\<Longrightarrow>s'=(s\\<lparr>tR := T s, numReads := Suc (data_index s (tempR s)),\n          pcR := Release,\n          ownD :=\n            \\<lambda>i. if i = data_index s (tempR s) then R\n                 else ownD\n                       (s\\<lparr>tR := T s,\n                            numReads := Suc (data_index s (tempR s)),\n                            pcR := Release\\<rparr>)\n                       i\\<rparr>)\n\\<Longrightarrow>inv s \n\\<Longrightarrow>Q_owns_bytes s\n\\<Longrightarrow>Q_owns_bytes s'\"\n  by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\nlemma T_modification_rule:\n  \"s'=(s\\<lparr>T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>) \\<Longrightarrow> T s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n  by simp\n\nlemma T_modification_rule_2:\n  \"s'=(s\\<lparr>ownT := Q,\n          ownB :=\n            \\<lambda>i. if (if T s \\<le> i \\<and> i < N then B else ownB (s\\<lparr>ownT := Q\\<rparr>) i) = R \\<and> i \\<le> N then B\n                else ownB (setownB [(tR s, N) B] (s\\<lparr>ownT := Q\\<rparr>)) i,\n          tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>) \\<Longrightarrow> T s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n  by simp\n\nlemma T_push:\n  \" T s = fst (tempR s) \\<Longrightarrow>s'=s \\<lparr>ownT := Q,\n          ownB :=\n            \\<lambda>i. if ownB s i = R \\<and> i \\<le> N then B\n                else ownB ((if T s \\<noteq> fst (tempR s) then setownB [(tR s, N) B] else id) (s\\<lparr>ownT := Q\\<rparr>)) i,\n          tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr> \\<Longrightarrow>\nT s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n  by simp\n\nlemma T_push_2 :\n  \" T s = fst (tempR s) \\<Longrightarrow>s'=(s\\<lparr>ownT := Q, ownB := \\<lambda>i. if ownB s i = R \\<and> i \\<le> N then B else ownB (id (s\\<lparr>ownT := Q\\<rparr>)) i, tempR := (0, 0), pcR := idleR,\n          T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>) \\<Longrightarrow>\nT s' = fst (tempR s) + Data s (numReads s - Suc 0)\"\n  by simp\n\nlemma R_release_to_idle_lemma_1:\n  \"con_assms s \\<Longrightarrow> pcR s = Release \\<Longrightarrow> pre_Release_inv s\n  \\<Longrightarrow> s'=s \\<lparr>ownT := Q,\n          ownB :=\n            \\<lambda>i. if ownB s i = R \\<and> i \\<le> N then B\n                else ownB ((if T s \\<noteq> fst (tempR s) then setownB [(tR s, N) B] else id) (s\\<lparr>ownT := Q\\<rparr>)) i,\n          tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>\n\\<Longrightarrow>inv s \\<Longrightarrow> T s = fst (tempR s)\n\\<Longrightarrow>case_1 s\n\\<Longrightarrow>case_1 s'\"\n  apply (simp add:inv_def)       \n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"T s' = fst (tempR s) + Data s (numReads s - Suc 0)\") prefer 2 \n  using T_push [where s =s and s'=s'] \n  apply fastforce\n  apply(simp add:case_1_def)\n  apply clarify \n  apply(rule_tac ?x = \"b\" in exI)\n  apply(rule_tac ?x = \"b\" in exI) \n  apply(intro conjI impI)\n  apply fastforce \n  apply(rule_tac ?x = \"c\" in exI) \n  apply(intro conjI impI) \n  apply blast\n  apply blast \n  apply (metis (no_types, lifting) le_trans less_or_eq_imp_le linorder_neqE_nat)\n  apply (metis Suc_leI not_less_eq_eq)\n  apply (metis F.distinct(11)) \n  apply (metis F.distinct(1)) \n  apply metis    \n  apply meson\n  apply (metis le_add_diff_inverse)\n  apply meson\n  apply meson\n  apply fastforce\n  apply blast\n  apply blast\n  apply meson\n  by meson\n\n\n\nlemma R_release_nequal_case_2:\n  \"con_assms s \\<Longrightarrow> pcR s = Release \\<Longrightarrow> pre_Release_inv s\n\\<Longrightarrow>inv s \\<Longrightarrow> T s \\<noteq> fst (tempR s)\n\\<Longrightarrow>case_2 s\"\n  apply (simp add:inv_def)       \n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) \n  apply(simp add:case_1_def)\n  apply(subgoal_tac \"H s>T s\") prefer 2 \n  apply metis\n  apply(simp add:case_2_def)\n  by metis\n\n\nlemma R_release_nequal_case_2_2:\n  \"con_assms s \\<Longrightarrow> pcR s = Release \\<Longrightarrow> pre_Release_inv s\n\\<Longrightarrow>inv s \\<Longrightarrow> T s \\<noteq> fst (tempR s) \\<Longrightarrow> s' = s\n    \\<lparr>ownT := Q,\n       ownB :=\n         \\<lambda>i. if (if T s \\<le> i \\<and> i < N then B else ownB (s\\<lparr>ownT := Q\\<rparr>) i) = R \\<and> i \\<le> N then B\n             else ownB ((if T s \\<noteq> fst (tempR s) then setownB [(tR s, N) B] else id) (s\\<lparr>ownT := Q\\<rparr>)) i,\n       tempR := (0, 0), pcR := idleR, T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>\n\\<Longrightarrow>case_1 s'\"\n  apply(subgoal_tac \"case_2 s\") prefer 2 using  R_release_nequal_case_2 [where s=s]\n  apply blast\n  apply (simp add:inv_def)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"H s < T s\") prefer 2 \n  apply(simp add:case_2_def)\n  apply meson\n  apply(simp add:case_2_def case_1_def)\n  apply clarify\n  apply(rule_tac ?x = \"a\" in exI)\n  apply(rule_tac ?x = \"a\" in exI)\n  apply(intro conjI impI)\n  apply blast\n  apply(rule_tac ?x = \"b\" in exI)\n  apply(intro conjI impI)\n  apply blast\n  apply blast\n  apply (metis add_cancel_left_left le_trans less_or_eq_imp_le)\n  apply (metis le_antisym less_irrefl_nat less_or_eq_imp_le)\n  apply (metis F.distinct(11) F.distinct(21) gr0_conv_Suc nat.discI nat_less_le)\n  apply (metis F.distinct(1))\n  apply (metis nat_le_linear nat_less_le)\n  apply meson\n  apply (metis add_cancel_right_left)\n  apply fastforce\n  apply meson\n  apply force\n  apply blast\n  apply (metis add_cancel_left_left diff_self_eq_0 le_neq_implies_less)\n  apply (metis le_neq_implies_less)\n  by meson\n\n\nlemma R_release_nequal_case_1_1:\n  \"con_assms s \\<Longrightarrow> pcR s = Release \\<Longrightarrow> pre_Release_inv s\n\\<Longrightarrow>inv s \\<Longrightarrow> T s = fst (tempR s) \\<Longrightarrow> s'=(s\\<lparr>ownT := Q, ownB := \\<lambda>i. if ownB s i = R \\<and> i \\<le> N then B else ownB (id (s\\<lparr>ownT := Q\\<rparr>)) i, tempR := (0, 0), pcR := idleR,\n          T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>) \\<Longrightarrow> case_1 s\n\\<Longrightarrow>case_1 s'\"\n  apply (simp add:inv_def)       \n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"T s' = fst (tempR s) + Data s (numReads s - Suc 0)\") prefer 2 \n  using T_push_2 [where s=s and s'=s']\n  apply fastforce\n  apply(simp add:case_1_def) \n  apply clarify \n  apply(rule_tac ?x = \"b\" in exI)\n  apply(rule_tac ?x = \"b\" in exI) \n  apply(intro conjI impI)\n  apply fastforce \n  apply(rule_tac ?x = \"c\" in exI) \n  apply(intro conjI impI) \n  apply blast\n  apply blast\n  apply (metis diff_commute diff_diff_cancel diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply (metis le_imp_less_Suc not_less_eq)\n  apply (metis F.distinct(11))\n  apply (metis F.distinct(1))\n  apply metis\n  apply blast\n  apply (metis le_add_diff_inverse)\n  apply meson\n  apply fastforce\n  apply fastforce\n  apply force\n  apply blast\n  apply meson\n  by fastforce\n\n\n\nlemma R_release_equal_case_2_3:\n  \"con_assms s \\<Longrightarrow> pcR s = Release \\<Longrightarrow> pre_Release_inv s\n\\<Longrightarrow>inv s \\<Longrightarrow> T s = fst (tempR s) \\<Longrightarrow> s'=(s\\<lparr>ownT := Q, ownB := \\<lambda>i. if ownB s i = R \\<and> i \\<le> N then B else ownB (id (s\\<lparr>ownT := Q\\<rparr>)) i, tempR := (0, 0), pcR := idleR,\n          T := fst (tempR s) + Data s (numReads s - Suc 0)\\<rparr>) \\<Longrightarrow> case_2 s\n\\<Longrightarrow>case_2 s'\"\n  apply (simp add:inv_def)       \n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"T s' = fst (tempR s) + Data s (numReads s - Suc 0)\") prefer 2 \n  using T_push_2 [where s =s and s'=s'] \n  apply fastforce apply(simp_all)\n  apply(simp add:case_2_def)\n  apply clarify \n  apply(rule_tac ?x = \"0\" in exI)\n  apply(rule_tac ?x = \"b\" in exI) \n  apply(intro conjI impI)\n  apply fastforce \n  apply(rule_tac ?x = \"H s\" in exI) \n  apply(intro conjI impI) \n  apply fastforce\n  apply(rule_tac ?x = \"e\" in exI)\n  apply(intro conjI impI) \n  apply (metis le_add_diff_inverse trans_less_add1)\n  apply(rule_tac ?x = \"e\" in exI)\n  apply(intro conjI impI) \n  apply fastforce\n  apply(rule_tac ?x = \"f\" in exI)\n  apply(intro conjI impI) \n  apply fastforce\n  apply blast\n  apply blast\n  apply (metis F.distinct(11) less_nat_zero_code)\n  apply (metis F.distinct(1))\n  apply (metis (mono_tags, hide_lams) diff_is_0_eq' le_trans linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply (metis le_imp_less_Suc not_less_eq)\n  apply (metis F.distinct(11))\n  apply (metis F.distinct(15))\n  apply fastforce\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply (metis gr_implies_not_zero le_add_diff_inverse)\n  apply blast\n  apply meson\n  apply meson\n  apply blast\n  apply fastforce\n  apply blast\n  apply (metis less_nat_zero_code)\n  apply meson\n  apply (metis less_nat_zero_code)\n  apply (metis less_nat_zero_code)\n  by (metis less_nat_zero_code)\n\n\n\n  \n\n\n\n\nlemma Q_continues_to_own_through_release:\n  \"Q_owns_bytes s \\<Longrightarrow> inv s \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \n  \\<Longrightarrow> pre_Release_inv s\n  \\<Longrightarrow> Q_owns_bytes s'\"\n  apply simp\n  apply(simp add:Q_lemmas Q_basic_lemmas inv_def pre_Release_inv_def)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply metis\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\") \n  by (metis F.distinct(21) nat_less_le)\n\n\n\nlemma Q_structure_continues_to_own_through_release:\n  \"Q_structure s \\<Longrightarrow> inv s \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \n  \\<Longrightarrow> pre_Release_inv s\n  \\<Longrightarrow> Q_structure s'\"\n  apply simp\n  apply(simp add:Q_lemmas Q_basic_lemmas inv_def pre_Release_inv_def)\n  by(simp add:cR_step_def)\n\n\n\n\n(************************************Local R_step shows inv  *********************************************)\n\n\nlemma R_local_release_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = Release\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n  using assms apply simp \n  apply(subgoal_tac \"Q_owns_bytes s\") prefer 2\n  using inv_def\n  apply blast\n  apply(subgoal_tac \"inv s\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"cR_step (pcR s) s s'\") prefer 2\n  apply metis\n  apply(subgoal_tac \"pcR s = Release \") prefer 2\n   apply metis \n  apply(subgoal_tac \"pre_Release_inv s\") prefer 2 \n  apply(simp add:pre_R_def)\n  apply(subgoal_tac \"Q_owns_bytes s'\") prefer 2\n  using Q_continues_to_own_through_release [where s=s and s'=s'] \n  apply blast\n  apply(subgoal_tac \"Q_structure s\") prefer 2 using inv_def\n  apply blast\n  apply(subgoal_tac \"Q_structure s'\") prefer 2 \n  using Q_structure_continues_to_own_through_release [where s=s and s'=s']\n  apply blast\n(*prelimiaries go here*)\n  apply(simp add:inv_def)\n  apply(subgoal_tac \"inv s\") prefer 2 \n  using assms(1) apply linarith\n  apply(simp add:pre_R_def)\n  apply(subgoal_tac \"B_release s s'\") prefer 2 using B_release_def [where s=s and s'=s']\n  apply (metis PCR.simps(7) cR_step_def) \n  apply(subgoal_tac \"ownT s = R\") prefer 2 using pre_Release_inv_def [where s=s] \n  apply presburger\n  apply(subgoal_tac \"Q_structure s'\")\n  using Q_structure_preserved3 [where s=s and s'=s']  prefer 2 \n  apply (metis \\<open>B_release s s' \\<equiv> s' = (`T := end (tempR s) \\<circ> `pcR := idleR \\<circ> `tempR := (0, 0) \\<circ> transownB [R B] \\<circ> (if tR s \\<noteq> fst (tempR s) then setownB [(tR s, N) B] else id) \\<circ> transownT [R Q s]) s\\<close> end_simp len_def off_def)\n  apply(simp add:pre_Release_inv_def)\n  apply(intro conjI impI) apply(simp add:tempR_lemmas tempR_basic_lemmas) prefer 2\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(subgoal_tac \"T s \\<noteq> fst (tempR s)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"pre_R Release s\") prefer 2 using assms \n  apply presburger\n  apply(simp add:pre_R_def)\n  apply(subgoal_tac \"pre_Release_inv s\") prefer 2\n  apply blast\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  using R_release_nequal_case_2 [where s=s]\n  using assms(2) apply fastforce\n  apply(simp_all)\n  apply(subgoal_tac \"case_1 s'\") prefer 2 using R_release_nequal_case_2_2 [where s'=s' and s=s] \n  using assms(2) apply blast\n  apply presburger\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(case_tac[!] \"T s = fst(tempR s)\") apply(simp_all)\n  apply(subgoal_tac \"case_1 s'\") \n  using R_release_nequal_case_1_1 [where s=s and s'=s'] \n  apply presburger\n  apply(subgoal_tac \"pre_R (pcR s) s\") prefer 2 \n  using assms(4) apply blast\n  apply(simp add:pre_R_def) apply(subgoal_tac \"pre_Release_inv s\") prefer 2 \n  apply blast\n  using R_release_nequal_case_1_1 [where s=s and s'=s']\n  using assms(2) apply presburger\n  apply(subgoal_tac \"case_2 s'\")\n  using R_release_equal_case_2_3 [where s=s and s'=s']\n  apply presburger\n  apply(subgoal_tac \"pre_R (pcR s) s\") prefer 2 \n  using assms(4) apply blast\n  apply(simp add:pre_R_def) apply(subgoal_tac \"pre_Release_inv s\") prefer 2 \n  apply blast\n  using R_release_equal_case_2_3 [where s=s and s'=s']\n  using assms(2) by presburger\n\n\n\nlemma R_local_idle_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = idleR\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n  using assms apply simp\n  apply(simp add:pre_R_def cR_step_def)\n  apply(case_tac \"q s=[]\")  apply(case_tac \"pcR s'\") apply (simp,simp,simp)\n  apply(subgoal_tac \"Q_structure s'\") prefer 2 \n  using Q_structure_preserved1 [where s=s and s'=s'] inv_def\n  apply meson \n  apply (simp add: RingBuffer_BD_latest_2.inv_def)  apply simp\n  apply(simp add:pre_dequeue_inv_def)\n  apply(subgoal_tac \"s'=(s\\<lparr>ownB := \\<lambda>i. if fst (hd (q s)) \\<le> i \\<and> i < fst (hd (q s)) + snd (hd (q s)) then R else ownB s i,\n          numDeqs := Suc (numDeqs s), ownT := R, tempR := hd (q s), pcR := Read, q := tl (q s)\\<rparr>)\n\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"Q_owns_bytes s'\") prefer 2\n  using R_idle_to_nidle_lemma_case_1_7 [where s=s and s'=s'] assms\n  apply fastforce\n  apply(simp add:inv_def)\n  apply(clarify)\n  apply(intro conjI impI)\n  apply (metis add.right_neutral add_Suc_right diff_diff_left)\n  apply (metis diff_is_0_eq length_0_conv not_less_eq_eq)\n  apply (metis diff_is_0_eq' le_trans length_0_conv not_less_eq_eq)\n  apply(case_tac \"case_1 s\") apply simp \n  apply(subgoal_tac \"case_1 s'\\<longrightarrow>case_1 s' \\<or> case_2 s'\") prefer 2\n  apply linarith\n  apply(subgoal_tac \"case_1 s'\") \n  apply blast\n  apply simp \n  using R_idle_to_nidle_lemma_case_1_5 [where s=s and s'=s'] \n  using assms(1) assms(2) assms(4) \n  apply presburger\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast\n  apply(thin_tac \"\\<not>case_1 s\") apply simp \n  using R_idle_to_nidle_lemma_case_1_6 [where s=s and s'=s'] \n  using assms(1) assms(2) assms(4) by presburger\n\n\n\nlemma R_local_read_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = Read\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n  using assms apply simp\n  apply(simp add:inv_def)\n  apply(simp add:pre_R_def)\n  apply(subgoal_tac \"B_read s s'\") prefer 2 using B_read_def [where s=s and s'=s'] \n   apply (metis PCR.simps(9) cR_step_def)\n  apply(subgoal_tac \"ownT s = R\") prefer 2 using pre_Read_inv_def [where s=s] \n  apply presburger\n  apply(subgoal_tac \"Q_structure s'\")\n  using Q_structure_preserved2 [where s=s and s'=s']  prefer 2\n  apply blast\n  apply(simp add:pre_Read_inv_def)\n  apply(intro conjI impI)\n  apply (metis F.distinct(5) le_antisym le_eq_less_or_eq not_less_eq_eq)\n  apply (metis F.distinct(5) Suc_leI le_eq_less_or_eq not_less_eq_eq)\n   apply(case_tac \"case_1 s\")\n    apply(subgoal_tac \"case_1 s'\")\n     apply fastforce\n  apply(subgoal_tac \"pre_Read_inv s\") prefer 2\n  apply (metis PCR.simps(9) assms(4) pre_R_def)\n  using R_read_to_release_lemma_case_1 [where s=s and s'=s']\n  using assms(1) assms(2) apply fastforce\n  apply(subgoal_tac \"case_2 s\") prefer 2\n    apply blast\n   apply(thin_tac \"\\<not>case_1 s\") \n  apply(subgoal_tac \"case_2 s'\")\n  apply force\n  using R_read_to_release_lemma_case_2 [where s=s and s'=s']\n  apply (metis PCR.simps(9) assms(1) assms(2) assms(4) pre_R_def)\n  using R_read_to_release_lemma_2 [where s=s and s'=s']\n  by (metis PCR.simps(9) assms(1) assms(2) assms(4) pre_R_def)\n\n\nlemma R_step_preserves_inv:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"inv s'\"\n  using assms apply(case_tac \"pcR s\") \n  using R_local_release_lemma [where s=s and s'=s'] apply blast       \n  using R_local_idle_lemma [where s=s and s'=s'] apply blast         \n  using R_local_read_lemma [where s=s and s'=s'] by blast         \n\n\n\n\n\n\n\n\n\n(*******************************LOCAL W_step shows inv s'*************************************)\n\n\nlemma W_inv_A1_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A1\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A1_inv_def)\n  apply (intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\")\n  apply(simp add:case_1_def)\n  apply(simp add:case_2_def)\n  by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\n\n\nlemma W_inv_A2_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A2\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A2_inv_def)\n  apply(case_tac \"tW s = hW s\", simp_all)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (elim conjE disjE)\n  apply(case_tac \"case_1 s'\") \n  using case_trans_A2_to_A3_2 [where s=s]\n  apply blast \n  using \\<open>\\<And>s'. \\<lbrakk>s' = s\\<lparr>ownT := W, pcW := A3\\<rparr>; T s = H s; case_1 s\\<rbrakk> \\<Longrightarrow> case_1 s'\\<close> apply presburger\n  apply (metis case_split_2 le_refl)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(case_tac \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (elim conjE disjE)\n  apply(subgoal_tac \"\\<not>case_1 s\") prefer 2\n  apply (metis case_split_4 less_eqE trans_less_add1)\n  apply meson\n  apply(subgoal_tac \"case_2 s'\")\n  apply blast apply simp\n  using  case_trans_A2_to_A4_3 [where s=s]\n  apply (meson case_split_2 not_less)\n  apply (metis case_trans_A2_to_A4_2)\n  apply (metis case_split_2)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(case_tac \"tW s < hW s\", simp_all)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (metis case_split_2 case_trans_A2_to_A5_2)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply (elim conjE disjE)\n  apply (metis case_split_4 less_eqE linorder_neqE_nat trans_less_add1)\n  apply (metis case_split_2 case_trans_A2_to_A8_4 linear nat_less_le)\n  apply (metis case_trans_A2_to_A8_2)\n  apply (metis case_split_2)\n  by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\n\nlemma W_inv_A3_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A3\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A3_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas) defer\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) \n  apply(subgoal_tac \"case_1 s\") prefer 2 \n  apply (metis RingBuffer_BD_latest_2.case_split le_refl)\n  apply(subgoal_tac \"\\<not>case_2 s'\") prefer 2 \n  using case_trans_A3_to_write_2 [where s=s and s'=s'] \n  apply (simp add: assms(1) pre_A3_inv_def)\n  apply simp\n  using case_trans_A3_to_write_7 [where s=s]\n  by (simp add: assms(1) pre_A3_inv_def)\n\n\nlemma W_inv_A4_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A4\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def)\n  apply(intro conjI impI)  apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def)\n  apply (simp add: less_diff_conv)  apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas) defer  apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)  \n  apply (metis (no_types, lifting) F.distinct(19) add.commute add_lessD1 canonically_ordered_monoid_add_class.lessE less_diff_conv) \n  apply(case_tac \"T s\\<ge>tW s\")\n  apply(subgoal_tac \"case_2 s'\") prefer 2 \n  using case_trans_A4_to_write_7 [where s=s and s'=s'] \n  apply (simp add: assms(1) assms(2) pre_A4_inv_def)\n  apply meson \n  using case_trans_A4_to_write_9 [where s=s and s'=s'] \n  using assms(1) pre_A4_inv_def by auto\n\n\n\nlemma W_inv_A5_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A5\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A5_inv_def)\n  apply(case_tac \"Data s (numEnqs s) \\<le> N - hW s\", simp_all) defer\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all) defer defer\n  apply(intro conjI impI) apply(simp add:Q_lemmas Q_basic_lemmas)\n  prefer 2 \n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) defer\n  apply(intro conjI impI) apply(simp add:Q_lemmas Q_basic_lemmas)\n  prefer 2 \n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) defer\n  apply(intro conjI impI) apply(simp add:Q_lemmas Q_basic_lemmas)\n  prefer 2 \n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) defer\n  using case_trans_A5_to_A6_3 [where s=s and s'=s'] \n  apply (metis PCW.simps(187) assms(1) assms(2) assms(4) pre_W_def)\n  using case_trans_A5_to_A6_6 [where s=s and s'=s']\n  apply (simp add: assms(1) pre_A5_inv_def)\n  using case_trans_A5_to_A6_9 [where s=s and s'=s']\n  by (metis case_split_2 case_trans_A2_to_A8_2)\n\n\n\nlemma W_inv_A6_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A6\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A6_inv_def)\n  apply(intro conjI impI)\n  apply (metis Nat.le_diff_conv2 add.commute)\n  apply(simp add:Q_lemmas Q_basic_lemmas) prefer 2\n   apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) prefer 2 \n  using case_trans_A6_to_write_7 [where s=s and s'=s']\n  apply (metis (no_types, lifting) PCW.simps(188) assms(1) assms(2) assms(4) pre_W_def)\n  by (smt (z3) F.distinct(19) diff_add_inverse le_diff_iff le_neq_implies_less le_trans less_imp_add_positive less_or_eq_imp_le not_add_less1)\n\n\n\nlemma W_inv_A7_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A7\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A7_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas) prefer 2\n   apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def) \n  using case_trans_A7_to_write_7 [where s=s and s'=s'] \n  by (metis (no_types, lifting) PCW.simps(189) assms(1) assms(2) assms(4) pre_W_def)\n  \n\n\n\n\nlemma W_inv_A8_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A8\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_A8_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n  apply (metis leD)\n  apply (metis leD)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) \n  apply(simp add:case_2_def)\n  by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\nlemma W_inv_Enqueue_lemma_prelim_1:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \\<Longrightarrow> cW_step (pcW s) s s'\n  \\<Longrightarrow> q s= []\n\\<Longrightarrow> Q_structure s'\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \" q s' = [(offset s, Data s (numDeqs s))]\")\n  prefer 2 apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply (metis le_antisym)\n  apply(intro conjI impI)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis gr0I)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  by (metis le_antisym)\n\nlemma W_inv_Enqueue_lemma_prelim_2:\n  \"con_assms s \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> cW_step (pcW s) s s'\n  \\<Longrightarrow> ownT s \\<noteq> W\n\\<Longrightarrow> q s @ [(offset s, Data s (numEnqs s))] = q s'\"\n  apply simp\n  by(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n\nlemma W_inv_Enqueue_lemma_prelim_3:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \\<Longrightarrow> cW_step (pcW s) s s'\n  \\<Longrightarrow> ownT s \\<noteq> W \\<Longrightarrow> q s = []\n\\<Longrightarrow> Q_structure s'\"\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \" q s' = [(offset s, Data s (numDeqs s))]\")\n  prefer 2 apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply (metis le_antisym)\n  apply(intro conjI impI)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis gr0I)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  by (metis le_antisym)\n\nlemma W_inv_Enqueue_lemma_prelim_4:\n  \"\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> a + b \\<le> N \\<Longrightarrow> offset s + Data s (numEnqs s)\\<le>N\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>a b. (a, b) \\<in> set (q s') \\<longrightarrow> a + b \\<le> N\"\n  by (metis old.prod.inject rotate1.simps(2) set_ConsD set_rotate1)\n\n\nlemma W_inv_Enqueue_lemma_prelim_5:\n  \"length(q s)>0\\<Longrightarrow>\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n        fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \\<Longrightarrow>\noffset s = fst(last(q s)) + snd(last(q s)) \\<or> offset s = 0\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>i. i < length (q s') \\<and> 0 < i \\<longrightarrow>\n        fst (q s' ! (i - Suc 0)) + snd (q s' ! (i - Suc 0)) = fst (q s' ! i) \\<or> fst (q s' ! i) = 0\"\n  apply (subgoal_tac \"last(q s) = q s!(length(q s)-1)\") prefer 2 \n  using last_conv_nth apply blast\n  by (smt (z3) One_nat_def Suc_diff_1 Suc_less_eq fst_conv length_append_singleton less_antisym nth_append nth_append_length)\n\nlemma W_inv_Enqueue_lemma_prelim_6:\n  \"length(q s)>0\\<Longrightarrow>\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j) \\<Longrightarrow>\n\\<forall>i.(i<length(q s))\\<longrightarrow>offset s \\<noteq> fst(q s!i)\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>i j. i < length (q s') \\<and> j < length (q s') \\<and> i \\<noteq> j \\<longrightarrow> fst (q s' ! i) \\<noteq> fst (q s' ! j)\"\n  by (smt (z3) butlast_snoc diff_diff_cancel diff_less_mono2 fstI le_eq_less_or_eq length_butlast less_one linorder_neqE_nat nth_append nth_append_length zero_less_diff zero_less_one)\n  \nlemma W_inv_Enqueue_lemma_prelim_7:\n  \"q s\\<noteq>[]\\<Longrightarrow>\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa \\<Longrightarrow>\n\\<forall>a b. (a, b) \\<in> set (q s)  \\<longrightarrow> ((offset s> a \\<longrightarrow> a+b\\<le>offset s) \\<and> (offset s< a \\<longrightarrow> offset s + Data s (numEnqs s) \\<le>a))\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>a b aa. (a, b) \\<in> set (q s') \\<and> (\\<exists>b. (aa, b) \\<in> set (q s')) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa\" \n  by (metis nat_neq_iff old.prod.inject rotate1.simps(2) set_ConsD set_rotate1)\n  \nlemma pec_1:\n  \"q s\\<noteq>[] \\<Longrightarrow>(\\<forall>i<length (q s).\n        (offset s < fst (q s ! i) \\<longrightarrow> offset s + Data s (numEnqs s) < fst (q s ! i)) \\<and>\n        (fst (q s ! i) < offset s \\<longrightarrow> fst (q s ! i) + snd (q s ! i) \\<le> offset s)) \\<Longrightarrow>\n\\<forall>a b. (a, b) \\<in> set (q s)  \\<longrightarrow> ((offset s> a \\<longrightarrow> a+b\\<le>offset s) \\<and> (offset s< a \\<longrightarrow> offset s + Data s (numEnqs s) \\<le>a))\n\"\n  by (metis fst_conv in_set_conv_nth less_or_eq_imp_le snd_conv)\n\nlemma pec_2:\n  \"q s\\<noteq>[] \\<Longrightarrow>(\\<forall>i<length (q s).\n        (offset s < fst (q s ! i) \\<longrightarrow> offset s + Data s (numEnqs s) < fst (q s ! i)) \\<and>\n        (fst (q s ! i) < offset s \\<longrightarrow> fst (q s ! i) + snd(q s!i) \\<le> offset s)) \\<Longrightarrow>\nData s (numEnqs s)>0\\<Longrightarrow>\n\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s))\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> a\"\n  by (metis fst_conv in_set_conv_nth less_add_same_cancel1 less_irrefl_nat)\n  \n\n\n\nlemma W_inv_Enqueue_lemma_prelim_8:\n  \"q s\\<noteq>[]\\<Longrightarrow>\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s)) \\<longrightarrow> a \\<noteq> fst (last (q s)) + snd (last (q s)) \\<Longrightarrow>\n    \\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s))  \\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> a \\<Longrightarrow> Data s (numEnqs s)>0\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s')) \\<longrightarrow> a \\<noteq> fst (last (q s')) + snd (last (q s'))\" \n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>(\\<exists>i. (i<length(q s) \\<and> (q s!i) = (a,b)))\") prefer 2\n  apply (simp add: in_set_conv_nth)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow> q s!i = q s'!i\") prefer 2\n  apply (metis length_append_singleton nat_diff_split_asm nth_append plus_1_eq_Suc)\n  apply(subgoal_tac \"i=length(q s')-1 \\<longrightarrow> q s'!i = (offset s, Data s (numEnqs s))\") prefer 2\n  apply (metis Nil_is_append_conv last_conv_nth last_snoc)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> fst(q s!i)\") prefer 2\n  apply (metis nth_mem prod.exhaust_sel)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> fst(q s'!i)\") prefer 2\n  apply (metis diff_Suc_1 length_append_singleton)\n  apply(subgoal_tac \"fst (last (q s')) + snd (last (q s')) = offset s + Data s (numEnqs s)\") prefer 2 \n  apply (metis fst_conv last_snoc snd_conv)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s'))\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> fst(q s'!i)\") prefer 2\n  apply (metis One_nat_def Suc_pred add_eq_self_zero append_is_Nil_conv bot_nat_0.not_eq_extremum last_conv_nth last_snoc length_greater_0_conv less_SucE snd_conv)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s'))\\<longrightarrow>fst (last (q s')) + snd (last (q s')) \\<noteq> fst(q s'!i)\") prefer 2\n  apply presburger\n  by (metis fst_conv in_set_conv_nth)\n\nlemma W_inv_Enqueue_lemma_prelim_9:\n  \"q s\\<noteq>[]\\<Longrightarrow>\\<forall>a b. (a, b) \\<in> set (q s) \\<longrightarrow> 0 < b \\<Longrightarrow>\n    0< Data s (numEnqs s) \n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> \\<forall>a b. (a, b) \\<in> set (q s') \\<longrightarrow> 0 < b\" \n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow> q s!i = q s'!i\") prefer 2\n  apply (metis length_append_singleton nat_diff_split_asm nth_append plus_1_eq_Suc)\n  apply(subgoal_tac \"i=length(q s')-1 \\<longrightarrow> q s'!i = (offset s, Data s (numEnqs s))\") prefer 2\n  apply (metis Nil_is_append_conv last_conv_nth last_snoc)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow>0< snd(q s!i)\") prefer 2\n  apply (metis nth_mem prod.exhaust_sel)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow>0< snd(q s'!i)\") prefer 2\n  apply (metis diff_Suc_1 length_append_singleton)\n  apply(subgoal_tac \"last(q s') = (offset s, Data s (numEnqs s))\") prefer 2 \n  apply (metis fst_conv last_snoc snd_conv)\n  apply(subgoal_tac \"snd(last(q s')) = Data s (numEnqs s)\") prefer 2 \n  apply (metis snd_conv)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s'))\\<longrightarrow>0< snd(q s'!i)\") prefer 2\n  apply (metis One_nat_def Suc_pred add_eq_self_zero append_is_Nil_conv bot_nat_0.not_eq_extremum last_conv_nth last_snoc length_greater_0_conv less_SucE snd_conv)\n  by (metis in_set_conv_nth snd_conv)\n  \n\nlemma W_inv_Enqueue_lemma_prelim_10:\n  \"q s\\<noteq>[]\\<Longrightarrow>\\<forall>i<length (q s). data_index s (q s ! i) = numDeqs s + i \\<Longrightarrow>\n    data_index s ((offset s, Data s (numEnqs s))) = numEnqs s\n\\<Longrightarrow> q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> numDeqs s = numDeqs s'\n\\<Longrightarrow> length(q s) = numEnqs s - numDeqs s\n\\<Longrightarrow> data_index s = data_index s'\n\\<Longrightarrow> numEnqs s +1 = numEnqs s'\n\\<Longrightarrow> Data s = Data s'\n\\<Longrightarrow> offset s= offset s'\n\\<Longrightarrow> \\<forall>i<length (q s'). data_index s' (q s' ! i) = numDeqs s' + i\" \n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow> q s!i = q s'!i\") prefer 2\n  apply (metis length_append_singleton nat_diff_split_asm nth_append plus_1_eq_Suc)\n  apply(subgoal_tac \"\\<forall>i<length (q s). data_index s' (q s' ! i) = numDeqs s' + i\") prefer 2 \n  apply (metis nth_append)\n  apply(subgoal_tac \"data_index s ((offset s, Data s (numEnqs s' -1))) = numEnqs s' -1\") prefer 2\n  apply (metis add_implies_diff)\n  apply(subgoal_tac \"data_index s' ((offset s, Data s (numEnqs s' -1))) = numEnqs s' -1\") prefer 2\n  apply metis\n  apply(subgoal_tac \"data_index s' ((offset s', Data s' (numEnqs s' -1))) = numEnqs s' -1\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"\\<forall>i<length (q s')-1. data_index s' (q s' ! i) = numDeqs s' + i\") prefer 2\n  apply (metis add.commute append.left_neutral append_Cons length_append length_tl list.sel(3))\n  apply(subgoal_tac \"(q s' ! (length (q s')-1 )) = (offset s, Data s (numEnqs s))\") prefer 2 \n  apply (metis append_is_Nil_conv last_conv_nth last_snoc)\n  apply(subgoal_tac \"(q s' ! (length (q s')-1 )) = (offset s', Data s' (numEnqs s' -1))\") prefer 2\n  apply (metis add.commute diff_add_inverse)\n  apply(subgoal_tac \"numDeqs s + length (q s) = data_index s' (offset s', Data s' (numEnqs s' -1))\") prefer 2\n  apply (metis diff_is_0_eq' le_add_diff_inverse length_0_conv nat_le_linear)\n  apply(subgoal_tac \"length (q s') -1  = length(q s)\") prefer 2\n  apply (metis add.comm_neutral add_implies_diff length_0_conv length_append length_tl less_one linordered_semidom_class.add_diff_inverse list.sel(3) not_Cons_self2)\n  apply(subgoal_tac \"numDeqs s + length (q s') -1 = data_index s' (offset s', Data s' (numEnqs s' -1))\") prefer 2\n  apply (metis Nat.add_diff_assoc diff_is_0_eq' length_0_conv nat_le_linear)\n  by (metis Nat.lessE diff_Suc_1)\n\n\nlemma pec_3:\n  \"inv s \\<Longrightarrow> cW_step (pcW s) s s' \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \\<Longrightarrow> con_assms s \n\\<Longrightarrow> length(q s) = numEnqs s - numDeqs s\n\"\n  by(simp add:cW_step_def pre_W_def inv_def )\n\n\nlemma pec_4:\n  \"cW_step (pcW s) s s' \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \\<Longrightarrow> con_assms s \\<Longrightarrow> \n     numDeqs s = numDeqs s' \n  \\<and> data_index s = data_index s' \n  \\<and> numEnqs s +1 = numEnqs s'\n  \\<and> Data s = Data s'\n  \\<and> offset s= offset s'\n  \\<and> ownD s = ownD s'\n\"\n  by(simp add:cW_step_def )\n\n\n\n\nlemma W_inv_Enqueue_lemma_prelim_11:\n  \"q s\\<noteq>[]\\<Longrightarrow> \\<forall>i<length (q s). snd (q s ! i) = Data s (numDeqs s + i) \\<Longrightarrow>\nq s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow> numDeqs s = numDeqs s'\n\\<Longrightarrow> length(q s) = numEnqs s - numDeqs s\n\\<Longrightarrow> data_index s = data_index s'\n\\<Longrightarrow> numEnqs s +1 = numEnqs s'\n\\<Longrightarrow> Data s = Data s'\n\\<Longrightarrow> offset s= offset s'\n\\<Longrightarrow>  \\<forall>i<length (q s'). snd (q s' ! i) = Data s' (numDeqs s' + i)\"\n  apply(subgoal_tac \"snd(offset s, Data s (numEnqs s)) = Data s (numEnqs s)\") prefer 2\n  apply simp\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s')-1)\\<longrightarrow> q s!i = q s'!i\") prefer 2\n  apply (metis length_append_singleton nat_diff_split_asm nth_append plus_1_eq_Suc)\n  apply(subgoal_tac \"\\<forall>i<length (q s). snd(q s' ! i) = Data s' (numDeqs s' + i)\") prefer 2 \n  apply (metis nth_append)\n  apply(subgoal_tac \"snd ((offset s, Data s (numEnqs s' -1))) = Data s(numEnqs s' -1)\") prefer 2\n  apply (metis add_implies_diff)\n  apply(subgoal_tac \"snd((offset s', Data s' (numEnqs s' -1))) = Data s' (numEnqs s' -1)\") prefer 2\n  apply metis\n  apply(subgoal_tac \"\\<forall>i<length (q s')-1. snd (q s' ! i) = Data s' (numDeqs s' + i)\") prefer 2\n  apply (metis add.commute append.left_neutral append_Cons length_append length_tl list.sel(3))\n  apply(subgoal_tac \"(q s' ! (length (q s')-1 )) = (offset s, Data s (numEnqs s))\") prefer 2 \n  apply (metis append_is_Nil_conv last_conv_nth last_snoc)\n  apply(subgoal_tac \"(q s' ! (length (q s')-1 )) = (offset s', Data s' (numEnqs s' -1))\") prefer 2\n  apply (metis add.commute diff_add_inverse) \n  apply(subgoal_tac \"length (q s') -1  = length(q s)\") prefer 2\n  apply (metis add.comm_neutral add_implies_diff length_0_conv length_append length_tl less_one linordered_semidom_class.add_diff_inverse list.sel(3) not_Cons_self2)\n  by (metis Nat.lessE add.commute diff_Suc_1 le_add_diff_inverse2 length_greater_0_conv less_or_eq_imp_le zero_less_diff)\n\nlemma W_inv_Enqueue_lemma_prelim_12:\n  \"length(q s)>0\\<Longrightarrow>\\<forall>i<length (q s). ownD s (i + numDeqs s) = B\n\\<Longrightarrow>q s @ [(offset s, Data s (numEnqs s))] = q s'\n\\<Longrightarrow>ownD s = ownD s'\n\\<Longrightarrow>numDeqs s = numDeqs s'\n\\<Longrightarrow>length(q s) = numEnqs s - numDeqs s\n\\<Longrightarrow>ownD s (numEnqs s) = B\n\\<Longrightarrow> \\<forall>i<length (q s'). ownD s' (i + numDeqs s') = B\"\n  apply(subgoal_tac \"length(q s)+1 = length(q s')\") prefer 2 \n  apply (metis Suc_eq_plus1 length_append_singleton)\n  apply(subgoal_tac \" \\<forall>i<length (q s')-1 . ownD s (i + numDeqs s) = B\")\n  prefer 2 \n  apply simp\n  apply(subgoal_tac \" \\<forall>i<length (q s')-1 . ownD s' (i + numDeqs s') = B\")\n  prefer 2 \n  apply simp\n  apply(subgoal_tac \"ownD s' (length (q s')-1 + numDeqs s') = B\") \n  apply (smt (z3) add.commute add_diff_cancel_left' discrete le_eq_less_or_eq less_diff_conv)\n  apply(subgoal_tac \"length (q s')-1 + numDeqs s' = numEnqs s\") prefer 2 \n  apply linarith\n  by presburger\n\n\nlemma W_inv_Enqueue_lemma_prelim_13:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \\<Longrightarrow> cW_step (pcW s) s s'\n  \\<Longrightarrow> ownT s \\<noteq> W\n\\<Longrightarrow> Q_structure s'\"\n  apply(subgoal_tac \"numDeqs s = numDeqs s' \\<and> ownD s = ownD s' \\<and> data_index s = data_index s' \\<and> numEnqs s +1 = numEnqs s'\\<and>  Data s = Data s'\\<and> offset s= offset s'\") \n   prefer 2 using pec_4 [where s=s and s'=s']\n   apply blast\n  apply(subgoal_tac \"length(q s) = numEnqs s - numDeqs s\") prefer 2\n  using pec_3 apply blast\n  apply(subgoal_tac \"q s @ [(offset s, Data s (numEnqs s))] = q s'\") prefer 2\n  using W_inv_Enqueue_lemma_prelim_2 [where s=s and s'=s'] \n   apply linarith\n  apply(case_tac \"q s=[]\")\n  using W_inv_Enqueue_lemma_prelim_3 [where s=s and s'=s'] \n  apply blast\n  apply(simp add:Q_structure_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_basic_struct_def)\n  apply(intro conjI impI)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  using W_inv_Enqueue_lemma_prelim_4 [where s=s and s'=s'] \n  apply presburger\n  apply(simp add:Q_gap_structure_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n        fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0 \\<Longrightarrow>\n        offset s = fst(last(q s)) + snd(last(q s)) \\<or> offset s = 0\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"q s @ [(offset s, Data s (numEnqs s))] = q s'\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"length(q s) > 0\") prefer 2 \n  apply blast\n  using W_inv_Enqueue_lemma_prelim_5 [where s=s and s'=s']\n  apply presburger\n  apply(simp add:Q_offsets_differ_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"length(q s) > 0\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>i j. i < length (q s) \\<and> j < length (q s) \\<and> i \\<noteq> j \\<longrightarrow> fst (q s ! i) \\<noteq> fst (q s ! j)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"\\<forall>i<length (q s). offset s \\<noteq> fst (q s ! i)\") prefer 2\n  apply metis\n  using W_inv_Enqueue_lemma_prelim_6 [where s=s and s'=s']\n  apply presburger\n  apply(simp add:Q_has_no_overlaps_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>a b. (a, b) \\<in> set (q s)  \\<longrightarrow> ((offset s> a \\<longrightarrow> a+b\\<le>offset s) \\<and> (offset s< a \\<longrightarrow> offset s + Data s (numEnqs s) \\<le>a))\")\n  prefer 2 using pec_1 [where s=s] \n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_7 [where s=s and s'=s']\n  apply presburger\n  apply(simp add: Q_has_no_uroboros_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>a. (\\<exists>b. (a, b) \\<in> set (q s))\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> a\") prefer 2\n  using pec_2 [where s=s] \n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_8 [where s=s and s'=s'] \n  apply presburger\n  apply(simp add: Q_elem_size_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  using W_inv_Enqueue_lemma_prelim_9 [where s=s and s'=s']\n  apply presburger\n  apply(simp add: Q_reflects_writes_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"data_index s ((offset s, Data s (numEnqs s))) = numEnqs s\") prefer 2\n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_10 [where s=s and s'=s']\n  apply (metis (no_types, lifting) Suc_eq_plus1)\n  apply(simp add:Q_elem_rel_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  using W_inv_Enqueue_lemma_prelim_11 [where s=s and s'=s'] \n  apply (metis (no_types, lifting) Suc_eq_plus1)\n  apply(simp add:Q_reflects_ownD_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas cW_step_def)\n  apply(simp add:pre_W_def pre_enqueue_inv_def tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"ownD s (numEnqs s) = B\") prefer 2\n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_12 [where s=s and s'=s']\n  by (metis (no_types, lifting) length_greater_0_conv)\n \nlemma pec_5:\n  \"cW_step (pcW s) s s' \\<Longrightarrow> pcW s = Enqueue \\<Longrightarrow> pre_W (pcW s) s \n\\<Longrightarrow> H s = H s' \\<and> T s = T s'\n\"\n  by(simp add:cW_step_def pre_W_def inv_def )\n\nlemma W_inv_Enqueue_cases_split_1:\n  \"case_1 s \\<Longrightarrow>  pcW s = Enqueue \\<Longrightarrow>pre_W (pcW s) s \\<Longrightarrow> cW_step (pcW s) s s'\n\\<Longrightarrow> \\<not>case_2 s'\"    \n  apply(subgoal_tac \"H s = H s' \\<and> T s = T s'\") prefer 2 using pec_5 apply blast\n  apply(simp add:case_1_def) apply(simp add:case_2_def)\n  by (metis dual_order.strict_iff_order less_trans)\n\nlemma W_inv_Enqueue_cases_split_2:\n  \"case_2 s \\<Longrightarrow>  pcW s = Enqueue \\<Longrightarrow>pre_W (pcW s) s \\<Longrightarrow> cW_step (pcW s) s s'\n\\<Longrightarrow> \\<not>case_1 s'\"    \n  apply(subgoal_tac \"H s = H s' \\<and> T s = T s'\") prefer 2 using pec_5 apply blast\n  apply(simp add:case_1_def) apply(simp add:case_2_def) \n  by (metis leD le_trans)\n\n\n\n\n\nlemma W_inv_Enqueue_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = Enqueue\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  apply(subgoal_tac \"H s = H s' \\<and> T s = T s'\") prefer 2 \n  using pec_5\n  using assms(1) assms(2) assms(3) assms(4) assms(5) apply blast\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_enqueue_inv_def)\n  apply(intro conjI impI)\n  apply (metis Suc_diff_le length_0_conv)\n  defer\n  defer \n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:tempW_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_1_def) apply clarify apply(intro conjI impI)\n  apply (metis F.distinct(5) diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply (metis (mono_tags, hide_lams) F.distinct(5) F.distinct(9) le_antisym less_Suc_eq_le minus_nat.diff_0 not_less_eq plus_nat.add_0)\n  apply(subgoal_tac \"i<N \\<and> ownB s i=W\\<longrightarrow>offset s\\<le>i \\<and> i<offset s + Data s (numEnqs s)\") prefer 2\n  apply (metis nat_less_le)\n  apply(subgoal_tac \"i>N \\<and> ownB s i=W\\<longrightarrow>i>offset s + Data s (numEnqs s)\")\n  apply (metis (no_types, lifting) diff_is_0_eq le_eq_less_or_eq linorder_neqE_nat zero_less_diff)\n  apply(subgoal_tac \"end(tempW s)\\<le>N\", unfold tempW_def)[1] prefer 2\n  apply (metis end_simp fst_conv snd_conv) \n  apply (metis (no_types, lifting) less_trans_Suc nat_less_le nat_neq_iff not_less_eq_eq)\n  apply(subgoal_tac \"case_2 s\") apply simp apply(thin_tac \"\\<not>case_1 s\")[1]\n  prefer 2 apply blast apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_2_def) apply clarify \n  using Suc_diff_le apply presburger\n  defer defer\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply clarify\n  apply(intro conjI impI)\n  apply(rule_tac ?x = \"{i. offset s \\<le> i \\<and> i < offset s + Data s (numEnqs s)}\" in exI)\n  apply (intro conjI impI)\n  apply metis\n  apply(case_tac \"case_1 s\") apply(simp)\n  apply(simp add:case_1_def) apply clarify apply(intro conjI impI)\n  apply (metis F.distinct(5) diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply (metis (no_types, lifting) Suc_le_lessD fst_conv not_less_eq_eq snd_conv tempW_def)\n  apply(subgoal_tac \"case_2 s\") apply simp apply(thin_tac \"\\<not>case_1 s\")[1]\n  prefer 2 apply blast apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_2_def) apply clarify \n  apply (intro conjI impI)\n  apply (metis le_eq_less_or_eq nat_le_linear)\n  apply(subgoal_tac \"i\\<ge>H s\\<and>i<T s\\<longrightarrow>ownB s i=B\") prefer 2\n  apply metis\n  apply(subgoal_tac \"i\\<ge>T s\\<and>i<e\\<longrightarrow>ownB s i=R\") prefer 2\n  apply metis\n  apply(subgoal_tac \"i\\<ge>e\\<and>i<f\\<longrightarrow>ownB s i=Q\") prefer 2\n  apply metis\n  apply(subgoal_tac \"i\\<ge>f\\<and>i<N\\<longrightarrow>ownB s i=D\") prefer 2\n  apply metis\n  apply(subgoal_tac \"i\\<ge>H s\\<and>i<N\\<longrightarrow>ownB s i\\<noteq>W\") prefer 2 \n  apply (metis F.distinct(1) F.distinct(3) F.distinct(5) F.distinct(7) diff_is_0_eq neq0_conv zero_less_diff)\n  apply (metis (no_types, lifting) diff_is_0_eq gr0I zero_less_diff)\n  apply(clarsimp)\n  apply(intro iffI)\n  apply clarify apply simp\n  apply(case_tac \"(a, b) \\<in> set (q s)\") apply simp \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"(i\\<le>N \\<and> ownB s i\\<noteq>Q)\\<longrightarrow>(\\<nexists>a b. ((a,b)\\<in>set(q s)\\<and> a\\<le>i \\<and> i<a+b))\")\n  prefer 2 \n  apply (metis fst_eqD snd_eqD tempW_def)\n  apply(subgoal_tac \"a = offset s \\<and> b = Data s (numEnqs s)\") prefer 2\n  apply meson\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply clarify apply simp\n  apply(subgoal_tac \"ownB s i=Q \\<and> i\\<le>N\\<longleftrightarrow>(\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x)\")\n  prefer 2 \n  apply presburger\n  apply simp \n  apply metis\n  apply clarify\n  apply(case_tac \"ownT s = W\", simp_all)\n  apply(subgoal_tac \"Q_structure s'\") \n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_1 [where s=s and s'=s'] assms \n  apply fastforce\n  prefer 2\n  apply(subgoal_tac \"Q_structure s'\") \n  apply presburger\n  using W_inv_Enqueue_lemma_prelim_13 [where s=s and s'=s'] assms \n  apply fastforce\n  apply(case_tac \"case_1 s\", simp_all) prefer 2 apply(simp add:case_2_def)\n  prefer 2\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(subgoal_tac \"\\<not>case_2 s'\") prefer 2 using W_inv_Enqueue_cases_split_1 [where s=s and s'=s'] assms\n  apply fastforce\n  prefer 2\n  apply(subgoal_tac \"\\<not>case_1 s'\") prefer 2 using W_inv_Enqueue_cases_split_2 [where s=s and s'=s'] assms\n  apply fastforce\n  apply(simp_all)\n  apply(thin_tac \"\\<not>case_1 s\") \n  apply(subgoal_tac \"case_2 s'\") \n  apply presburger\n  apply(thin_tac \"\\<not> case_1(s\\<lparr>numEnqs := Suc (numEnqs s),ownB := \\<lambda>i. if ownB s i = W \\<and> i \\<le> N then Q\n                   else ownB ((if ownT s = W then ownT_update (\\<lambda>_. Q) else (\\<lambda>s. s\\<lparr>ownT := ownT s\\<rparr>)) s\\<lparr>numEnqs := Suc (numEnqs s)\\<rparr>)i, pcW := idleW, q := q s @ [(offset s, Data s (numEnqs s))]\\<rparr>)\")\n  defer\n  apply(subgoal_tac \"case_1 s'\") \n  apply presburger\n  apply(thin_tac \"\\<not> case_2 (s\\<lparr>numEnqs := Suc (numEnqs s),ownB := \\<lambda>i. if ownB s i = W \\<and> i \\<le> N then Q\n                   else ownB ((if ownT s = W then ownT_update (\\<lambda>_. Q) else (\\<lambda>s. s\\<lparr>ownT := ownT s\\<rparr>)) s\\<lparr>numEnqs := Suc (numEnqs s)\\<rparr>)  i,  pcW := idleW, q := q s @ [(offset s, Data s (numEnqs s))]\\<rparr>)\")\n  defer\n  apply(subgoal_tac \"case_1 s'\")\n  apply presburger\n  defer                         (*start case2 to case2*)\n  apply(simp add:case_2_def)\n  apply clarify\n  apply(intro conjI impI) \n  using F.distinct(9) apply presburger\n  apply(rule_tac ?x = \"a\" in exI)\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"e\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"f\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply linarith\n  apply (metis F.distinct(1))\n  apply (metis (mono_tags, hide_lams) le_eq_less_or_eq le_trans nat_le_linear)\n  apply (metis Suc_diff_Suc Zero_not_Suc diff_is_0_eq')\n  apply (metis F.distinct(5))\n  apply (metis F.distinct(1))\n  apply (metis (mono_tags, hide_lams))\n  apply (metis F.distinct(7))\n  apply blast\n  apply meson\n  apply meson\n  apply meson\n  apply blast\n  apply meson\n  apply meson\n  apply force\n  apply force\n  apply force\n  apply force\n  apply force\n  apply force\n  apply (metis (mono_tags, hide_lams) F.distinct(1) F.distinct(13) add_diff_cancel_left' eq_imp_le fst_eqD linorder_neqE_nat snd_eqD tempW_def zero_less_diff)\n  apply (metis hd_append2)\n  apply (metis fst_eqD hd_append le_neq_implies_less less_irrefl_nat list.sel(1))\n  apply force\n  apply (metis add_is_0)\n  apply force\n  apply fastforce\n  (*start case1 to case1 and ownT \\<noteq>W *)\n  apply(case_tac \"q s=[]\")\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_1_def)\n   apply(clarify)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = \"b\" in exI)\n  apply(intro conjI impI)\n  apply linarith\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply linarith\n  apply (metis F.distinct(5))\n  apply (metis F.distinct(1))\n  apply (metis le_trans less_eq_Suc_le less_or_eq_imp_le not_less_eq_eq)\n  apply (metis le_imp_less_Suc not_less_eq)\n  apply (metis)\n  apply blast\n  apply blast\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  apply (metis F.distinct(1) F.distinct(5) Nat.add_0_right le_eq_less_or_eq nat_add_left_cancel_less nat_le_linear)\n  apply (metis fst_eqD hd_append2 list.sel(1) nat_less_le self_append_conv2)\n  apply blast\n  apply meson\n  apply (metis le_neq_implies_less)\n  apply (metis le_neq_implies_less)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_1_def)\n  apply(clarify)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = \"fst (hd (q s))\" in exI)\n  apply(intro conjI impI)\n  apply blast\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply linarith\n  apply (metis F.distinct(5))\n  apply (metis F.distinct(1))\n  apply (smt (z3) le_eq_less_or_eq le_trans linorder_neqE_nat)\n  apply (metis le_trans less_eq_Suc_le less_or_eq_imp_le not_less_eq_eq)\n  apply (metis le_imp_less_Suc not_less_eq)\n  apply (metis)\n  apply blast\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  apply fastforce\n  apply linarith\n  apply fastforce\n  apply (metis F.distinct(1) F.distinct(5) Nat.add_0_right le_eq_less_or_eq nat_add_left_cancel_less nat_le_linear)\n  apply metis\n  apply force\n  apply meson\n  (*start case1 to case1 and ownT =W *)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:case_1_def)\n  apply(clarify)\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(rule_tac ?x = \"b\" in exI)\n  apply(intro conjI impI)\n  apply blast\n  apply(rule_tac ?x = \"offset s + Data s (numEnqs s)\" in exI)\n  apply(intro conjI impI) \n  apply linarith\n  apply blast\n  apply (metis F.distinct(5))\n  apply (metis F.distinct(1))\n  apply (metis le_neq_implies_less le_trans less_imp_le_nat)\n  apply (metis le_imp_less_Suc not_less_eq)\n  apply (metis F.distinct(5))\n  apply metis\n  apply metis\n  apply fastforce\n  apply force\n  apply metis\n  apply meson\n  apply (metis (mono_tags, hide_lams) F.distinct(5) Nat.add_0_right le_refl less_nat_zero_code linorder_neqE_nat nat_add_left_cancel_less)\n  apply (metis nat_less_le)\n  by blast\n\n\n\nlemma W_inv_idleW_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = idleW\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_acquire_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply (metis leD)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) \n  apply(simp add:case_2_def)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) \n  apply(subgoal_tac \"case_2 (s\\<lparr>pcW := FinishedW\\<rparr>)\")\n  apply blast apply simp apply(thin_tac \"\\<not> case_1 s \") \n  apply(simp add:case_2_def)\n  prefer 2 \n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply clarify\n  apply(rule_tac ?x = \"a\" in exI)\n  apply(rule_tac ?x = \"b\" in exI)\n  apply(intro conjI impI) apply metis\n  apply(rule_tac ?x = \"H s\" in exI)\n  apply(intro conjI impI) \n  apply blast\n  apply(rule_tac ?x = \"T s\" in exI)\n  apply(intro conjI impI) \n  apply blast\n  apply(rule_tac ?x = \"e\" in exI)\n  apply(intro conjI impI) \n  apply blast\n  apply(rule_tac ?x = \"f\" in exI)\n  apply(intro conjI impI) \n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  apply blast \n  apply meson\n  apply metis\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  apply meson\n  by meson\n\n\n\nlemma W_inv_OOM_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = OOM\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply(simp add:inv_def pre_W_def cW_step_def pre_OOM_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n  apply(simp add:case_2_def)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  by(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n\n\n\n\n\nlemma W_inv_FinishedW_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = FinishedW\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms by(simp add:inv_def pre_W_def cW_step_def pre_OOM_inv_def)\n\n\n\nlemma W_inv_Write_lemma_prelim_1:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\n\\<Longrightarrow>q s=q s' \\<and> numDeqs s = numDeqs s'\"\n  apply simp \n  by(simp add:cW_step_def)\n\n\nlemma W_inv_Write_lemma_prelim_2:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\n\\<Longrightarrow>\\<forall>a b. ((a,b)\\<noteq>(offset s, Data s (numEnqs s)))\\<longrightarrow> data_index s' (a,b) = data_index s (a,b)\"\n  apply simp \n  by(simp add:cW_step_def)\n\nlemma W_inv_Write_lemma_prelim_3:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\n\\<Longrightarrow>\\<forall>i. i<length(q s) \\<longrightarrow> ((q s ! i)\\<noteq>(offset s, Data s (numEnqs s)))\\<longrightarrow> data_index s' ((q s ! i)) = data_index s ((q s ! i))\"\n  apply simp \n  by(simp add:cW_step_def)\n\n\nlemma W_inv_Write_lemma_prelim_4:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s\n\\<Longrightarrow>\\<forall>i<length (q s). data_index s' (q s ! i) = data_index s (q s ! i)\"\n  apply simp \n  apply(simp add:cW_step_def pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  by (metis fst_conv less_nat_zero_code list.size(3))\n\nlemma W_inv_Write_lemma_prelim_5:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s). Data s (numDeqs s + i) = snd(q s ! i)\"\n  apply simp \n  apply(simp add:cW_step_def pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas) \n  by (metis length_0_conv less_nat_zero_code)\n\nlemma W_inv_Write_lemma_prelim_6:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s). Data s (numDeqs s + i) = Data s' (numDeqs s' + i)\"\n  apply simp \n  by(simp add:cW_step_def pre_write_inv_def)\n\nlemma W_inv_Write_lemma_prelim_7:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s). snd(q s ! i) = snd(q s' ! i)\"\n  apply simp \n  using W_inv_Write_lemma_prelim_1 by auto\n\nlemma W_inv_Write_lemma_prelim_8:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s'). Data s' (numDeqs s' + i) = snd(q s' ! i)\"\n  apply simp \n  using W_inv_Write_lemma_prelim_1 W_inv_Write_lemma_prelim_5 W_inv_Write_lemma_prelim_6 by presburger\n  \nlemma W_inv_Write_lemma_prelim_9:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s). ownD s (numDeqs s + i) = B\"\n  apply simp \n  apply(simp add:cW_step_def pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  by (metis add.commute less_nat_zero_code list.size(3))\n  \nlemma W_inv_Write_lemma_prelim_10:\n  \"pcW s = Write\\<Longrightarrow>cW_step (pcW s) s s'\\<Longrightarrow>pre_write_inv s \\<Longrightarrow> inv s\n\\<Longrightarrow>\\<forall>i<length (q s'). ownD s' (numDeqs s' + i) = B\"\n  apply simp \n  apply(simp add:cW_step_def pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  by (metis add.commute less_nat_zero_code list.size(3))\n\nlemma W_inv_Write_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = Write\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms apply simp\n  apply(subgoal_tac \"case_1 s \\<or> case_2 s\") prefer 2 using inv_def pre_W_def\n  apply blast\n  apply(subgoal_tac \"pre_write_inv s\") prefer 2 using inv_def pre_W_def assms\n  apply (metis PCW.simps(195))\n  apply(simp add:pre_W_def cW_step_def)\n  apply(simp add:inv_def)\n  apply(intro conjI impI) \n  apply (simp add: pre_write_inv_def) defer\n  apply (simp add: pre_write_inv_def) defer defer defer \n  apply(subgoal_tac \"case_1 s' \\<or> case_2 s'\")\n  apply meson using case_trans_Write_to_Enqueue_case_3 [where s=s and s'=s']\n  using assms(1) assms(2) apply blast\n   apply(simp add:Q_indices_def ran_indices_def Q_owns_bytes_def)\n  apply(subgoal_tac \"q s= q s'\") prefer 2 using W_inv_Write_lemma_prelim_1 [where s=s and s'=s'] \n  using assms(5) apply blast\n  apply(unfold Q_lemmas Q_basic_lemmas)\n  apply(intro conjI impI)\n  apply presburger\n  apply (metis (no_types, lifting))\n  apply force\n  apply presburger\n  apply metis\n  apply presburger\n  apply(subgoal_tac \"numDeqs s = numDeqs s'\") prefer 2\n  using case_trans_Write_to_Enqueue_case_3 [where s=s and s'=s'] using assms(1) assms(2) \n\n  using \\<open>\\<lbrakk>pcW s = Write; cW_step (pcW s) s s'\\<rbrakk> \\<Longrightarrow> q s = q s' \\<and> numDeqs s = numDeqs s'\\<close> assms(5) apply fastforce\n  apply(subgoal_tac \"data_index(s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n             ownD :=\n               \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n             data_index :=\\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s else data_index  (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                              ownD :=\\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>) x\\<rparr>) = data_index s'\") prefer 2\n  \n  apply meson\n  apply(subgoal_tac \"(\\<forall>i. (i<length(q s')) \\<longrightarrow> data_index s' (q s' ! i) =\n       numDeqs s' + i) \\<longrightarrow> (\\<forall>i<length (q (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n                data_index := \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s else data_index (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                                 ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>) x\\<rparr>)).\n       data_index (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n             ownD :=  \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n             data_index :=  \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s  else data_index (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                              ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>) x\\<rparr>)  (q (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n                ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n                data_index := \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s  else data_index\n                            (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue, ownD := \\<lambda>i. if i = numWrites s then B  else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>)  x\\<rparr>) !  i) =\n       numDeqs (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue,\n             ownD := \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i,\n             data_index := \\<lambda>x. if (offset s, Data s (numEnqs s)) = x then numEnqs s else data_index (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue, ownD :=\n                                \\<lambda>i. if i = numWrites s then B else ownD (s\\<lparr>numWrites := Suc (numWrites s), pcW := Enqueue\\<rparr>) i\\<rparr>) x\\<rparr>) + i) \") prefer 2 \n  apply force\n  apply(subgoal_tac \"(\\<forall>i. (i<length (q s')) \\<longrightarrow> data_index s' (q s' ! i) = numDeqs s' + i)\") \n  apply meson\n  apply(subgoal_tac \"q s'\\<noteq>[]\") prefer 2\n  apply meson\n  apply(subgoal_tac \"length(q s)= length(q s')\") prefer 2 \n     apply presburger\n    apply(subgoal_tac \"\\<forall>i<length (q s). data_index s' (q s ! i) = numDeqs s' + i\")\n  apply presburger\n  apply(subgoal_tac \"\\<forall>i<length (q s). data_index s' (q s ! i) = data_index s (q s!i)\")\n  apply metis\n  apply(subgoal_tac \"\\<forall>a b. ((a,b)\\<noteq>(offset s, Data s (numEnqs s)))\\<longrightarrow> data_index s' (a,b) = data_index s (a,b)\")\n     prefer 2 \n  using W_inv_Write_lemma_prelim_2 [where s=s and s'=s']\n  using assms(5) apply fastforce\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> ((q s ! i)\\<noteq>(offset s, Data s (numEnqs s)))\\<longrightarrow> data_index s' ((q s ! i)) = data_index s ((q s ! i))\")\n  prefer 2 using W_inv_Write_lemma_prelim_3 [where s=s and s'=s']\n  using assms(5) apply fastforce \n  using W_inv_Write_lemma_prelim_4 [where s=s and s'=s']\n  using assms(5) apply fastforce\n  using W_inv_Write_lemma_prelim_8 [where s=s and s'=s']\n  using assms(1) assms(5) apply presburger\n  using W_inv_Write_lemma_prelim_10 [where s=s and s'=s']\n  using assms(1) assms(5) \n  by (metis add.commute)\n\n\n\n\nlemma W_inv_BTS_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = BTS\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"    \nshows \"inv s'\"\n  using assms by(simp add:inv_def pre_W_def cW_step_def pre_OOM_inv_def)\n\n\n\n\nlemma local_pre_W_inv: \n  assumes \"con_assms s\"\n  and \"pcw = pcW s\"\n  and \"pre_W pcw s\"\n  and \"inv s\"\n  and \"cW_step pcw s s'\"\nshows \"inv s'\"\n  using assms apply(case_tac \"pcW s\") \n  using W_inv_A1_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A2_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A3_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A4_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A5_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A6_lemma [where s=s and s'=s'] apply blast \n  using W_inv_A7_lemma [where s=s and s'=s'] apply blast\n  using W_inv_A8_lemma [where s=s and s'=s'] apply blast \n  using W_inv_Enqueue_lemma [where s=s and s'=s'] apply blast             \n  using W_inv_idleW_lemma [where s=s and s'=s'] apply blast \n  using W_inv_OOM_lemma [where s=s and s'=s'] apply blast    \n  using W_inv_FinishedW_lemma [where s=s and s'=s'] apply blast \n  using W_inv_Write_lemma [where s=s and s'=s'] apply blast \n  using W_inv_BTS_lemma [where s=s and s'=s'] by blast   \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************LOCAL W_step shows preW*************************************)\n\n\nlemma W_local_A1_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A1\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  by(simp add:inv_def pre_W_def cW_step_def pre_A1_inv_def pre_A2_inv_def)\n\nlemma W_local_A2_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A2\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:inv_def pre_W_def cW_step_def pre_A2_inv_def pre_A3_inv_def)\n  apply(case_tac \"tW s = hW s\") apply simp_all \n  apply(case_tac \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\") \n  apply(simp_all add: pre_A4_inv_def)\n  apply metis\n  apply(case_tac \"tW s < hW s\", simp_all) \n  apply(simp add:pre_A5_inv_def) \n  apply(simp add:pre_A8_inv_def)\n  by metis\n\n\n\n\nlemma W_local_A3_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A3\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:inv_def pre_W_def cW_step_def pre_A3_inv_def pre_write_inv_def)\n  by(simp add:tempW_lemmas tempW_basic_lemmas)\n\n\n\nlemma W_local_A4_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A4\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:inv_def pre_W_def cW_step_def pre_A4_inv_def pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(intro conjI impI)\n  apply (simp add: less_diff_conv)\n  apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\<not>case_2 s\") apply simp \n  apply(thin_tac \"\\<not> case_2 s\")\n  apply(simp add:case_1_def) \n  apply(subgoal_tac \"hW s = fst (last (q s)) + snd (last (q s))\") \n  apply blast\n  apply (metis cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq length_0_conv less_nat_zero_code)\n  apply (metis case_split_5)\n  apply(subgoal_tac \"case_2 s\") apply simp \n  apply(thin_tac \"\\<not>case_1 s\") \n  apply(simp add:case_2_def) \n  apply (metis (no_types, lifting) add_diff_cancel_left' cancel_comm_monoid_add_class.diff_cancel diff_is_0_eq diff_zero le_trans length_greater_0_conv nat_less_le)\n  apply (metis)\n  apply(simp add:Q_lemmas Q_basic_lemmas tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\<not>case_2 s\") apply simp\n  apply(thin_tac \"\\<not> case_2 s\")\n  apply(simp add:case_1_def)\n  apply (metis (no_types, hide_lams) diff_is_0_eq' le_eq_less_or_eq length_pos_if_in_set nth_mem prod.exhaust_sel zero_less_diff)\n  apply (metis case_split_5)\n  apply(subgoal_tac \"case_2 s\") apply simp \n  apply(thin_tac \"\\<not>case_1 s\") \n  apply(simp add:case_2_def)\n  apply clarify \n  apply(subgoal_tac \"ownB s (H s) \\<noteq> Q\") prefer 2 \n  apply (metis F.distinct(19) le_refl)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\") prefer 2\n  apply blast\n  apply(subgoal_tac \"i<length(q s) \\<longrightarrow> snd(q s!i) > 0\") prefer 2\n  apply (metis nth_mem prod.collapse)\n  apply(subgoal_tac \"hW s = end(last(q s))\") prefer 2 \n  apply (metis add.commute add_diff_inverse_nat diff_is_0_eq' end_simp le_eq_less_or_eq le_trans minus_nat.diff_0 nat_less_le)\n  apply (metis end_simp nth_mem prod.collapse)\n  apply metis\n  apply(simp add:Q_lemmas Q_basic_lemmas) (*doable*)\n  defer \n  apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\<not>case_2 s\") apply simp \n  apply(thin_tac \"\\<not> case_2 s\")\n  apply(simp add:case_1_def)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply (metis (no_types, lifting) add_leD1 cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq le_zero_eq length_0_conv)\n  apply (metis case_split_5)\n  apply(subgoal_tac \"case_2 s\") apply simp \n  apply(thin_tac \"\\<not>case_1 s\") \n  apply(simp add:case_2_def)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(clarify)\n  apply(case_tac \"fst(hd(q s)) = 0\") \n  apply (metis add_is_0)\n  apply(subgoal_tac \"fst(hd(q s)) = e\") prefer 2\n  apply (metis (no_types, lifting) add_diff_cancel_right' add_lessD1 cancel_comm_monoid_add_class.diff_cancel le_neq_implies_less length_greater_0_conv not_add_less1 ordered_cancel_comm_monoid_diff_class.add_diff_inverse)\n  apply(subgoal_tac \"hW s<T s\") prefer 2\n  apply blast\n  apply(subgoal_tac \" hW s + Data s (numEnqs s) = hW s\") prefer 2\n  apply (metis add.commute diff_add less_diff_conv nat_less_le trans_less_add2)\n  apply(subgoal_tac \"T s \\<le> fst(hd(q s))\") prefer 2\n  apply meson\n  apply(subgoal_tac \"d> Data s (numEnqs s) + hW s \") prefer 2 \n  apply (metis add.commute less_add_same_cancel2)\n  apply(subgoal_tac \"d=e\") prefer 2 \n  apply (metis less_add_same_cancel1)\n  apply (metis not_add_less2)\n  apply blast\n  apply(clarify)\n  apply(intro conjI impI)\n  apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\<not>case_2 s\") apply simp \n  apply(thin_tac \"\\<not> case_2 s\")\n  apply(simp add:case_1_def)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(subgoal_tac \"\\<forall>j. j<length(q s) \\<longrightarrow> hW s > fst(q s!j)\")\n  apply (metis Suc_lessD less_natE not_add_less1)\n  apply(subgoal_tac \"\\<forall> a b j. ((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b) \\<longrightarrow> ownB s (j) = Q\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(clarify) \n  apply(subgoal_tac \"\\<forall>i.(ownB s i=Q \\<and> i\\<le>N) \\<longrightarrow> i<fst (last (q s)) + snd (last (q s))\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow> ownB s (fst(q s!0)) = Q\") prefer 2\n  apply (metis (no_types, lifting) hd_conv_nth le_eq_less_or_eq)\n  \n  apply(subgoal_tac \"fst (last (q s)) + snd (last (q s))\\<le>hW s\") prefer 2\n  apply blast\n  apply(subgoal_tac \"fst(q s!j) + snd(q s!j) \\<le>N\") prefer 2 \n  apply (metis nth_mem prod.collapse)\n  apply(subgoal_tac \"fst(q s!j) \\<le>N\") prefer 2 \n  apply (metis add_leD1)\n  apply (metis (no_types, lifting) le_eq_less_or_eq less_add_same_cancel1 nth_mem prod.collapse)\n  apply (metis case_split_5)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(case_tac \"case_1 s\") apply(subgoal_tac \"\\<not>case_2 s\") apply simp \n  apply (metis case_split_5)\n  apply(simp add:case_2_def)\n  apply(thin_tac \"\\<not> case_1 s\")\n  apply clarify\n  apply(case_tac \"H s \\<ge> T s\") \n  apply (metis le_imp_less_Suc less_or_eq_imp_le not_less_eq)\n  apply(subgoal_tac \"H s < T s \") prefer 2\n  apply metis\n  apply(thin_tac \"\\<not> T s \\<le> H s\")\n  apply(subgoal_tac \"\\<forall>i.(hW s \\<le>i \\<and> i<hW s + Data s (numEnqs s)) \\<longrightarrow> ownB s i = B\") prefer 2 \n  apply (metis (no_types, lifting) Suc_lessD add.commute less_diff_conv less_trans_Suc)\n  apply(case_tac \"e=f\") \n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i<b\") prefer 2\n  apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) F.distinct(21) F.distinct(23) F.distinct(3) Suc_pred bot_nat_0.not_eq_extremum diff_Suc_Suc diff_diff_cancel diff_is_0_eq old.nat.inject zero_less_Suc zero_less_diff)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2\n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>i. (i<length(q s)) \\<longrightarrow> (\\<exists>a b. ((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b = snd(q s!i)))\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> ownB s (fst(q s!i)) = Q\") prefer 2 \n  apply (metis (no_types, hide_lams))\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> fst(q s!i) < N)\\<longrightarrow> fst(q s!i)<b\") prefer 2 \n  apply (metis less_imp_le_nat)\n  apply(subgoal_tac \"fst(q s!i) + snd(q s!i)\\<le>N\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse)\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s))\\<longrightarrow> fst(q s!i)<b\") prefer 2 \n  apply (metis (no_types, lifting) add_leD1)\n  apply (metis (no_types, lifting) add_lessD1 le_imp_less_Suc less_imp_add_positive not_less_eq)\n  apply(case_tac \"fst(q s!i) < hW s\") \n  apply linarith\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2\n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>i. (i<length(q s)) \\<longrightarrow> (\\<exists>a b. ((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b = snd(q s!i)))\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> ownB s (fst(q s!i)) = Q\") prefer 2 \n  apply (metis (no_types, hide_lams))\n  apply(subgoal_tac \"fst(q s!i) + snd(q s!i)\\<le>N\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse)\n  apply(subgoal_tac \"fst(q s!i) \\<ge>e\") \n  apply (metis (no_types, lifting) F.distinct(19) add.commute less_diff_conv less_or_eq_imp_le linorder_neqE_nat)\n  apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) bot_nat_0.not_eq_extremum diff_is_0_eq diff_self_eq_0 zero_less_diff)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n  apply clarify \n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2\n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>i. (i<length(q s)) \\<longrightarrow> (\\<exists>a b. ((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b = snd(q s!i)))\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j\\<le>a+b-1)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 le_imp_less_Suc)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a+b\\<le>hW s\")\n  apply (metis (no_types, lifting) less_or_eq_imp_le)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N) \\<longrightarrow> i<fst (last (q s)) + snd (last (q s))\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a+b\\<le>N\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>b>0\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s) \\<and> a\\<le>a+b-1 \\<and> a+b-1\\<le>a+b-1)\\<longrightarrow>ownB s (a+b-1) = Q\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 le_imp_less_Suc)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a\\<le>a+b-1 \\<and> a+b-1\\<le>a+b-1\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 le_eq_less_or_eq less_Suc_eq_le less_add_same_cancel1)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>ownB s (a+b-1) = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a+b-1 <fst (last (q s)) + snd (last (q s))\") prefer 2 \n  apply (metis diff_le_self le_trans)\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a+b-1 <a+b\") prefer 2 \n  apply (metis Suc_pred' add_gr_0 lessI)\n  apply(subgoal_tac \"hW s\\<ge>fst (last (q s)) + snd (last (q s))\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a+b-1 <hW s\") prefer 2 \n  apply (metis (no_types, lifting) eq_imp_le le_neq_implies_less)\n  apply (metis (no_types, lifting) Suc_leI Suc_pred' add_gr_0)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply(clarify)\n  apply(case_tac \"e=f\") \n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i<b\") prefer 2\n  apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) F.distinct(21) F.distinct(23) F.distinct(3) Suc_pred bot_nat_0.not_eq_extremum diff_Suc_Suc diff_diff_cancel diff_is_0_eq old.nat.inject zero_less_Suc zero_less_diff)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j\\<le>a+b-1)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 le_imp_less_Suc)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> b>0\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a\\<le>a+b-1 \\<and> a+b-1\\<le>a+b\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 diff_le_self less_Suc_eq_le less_add_same_cancel1)\n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a+b-1) = Q\") prefer 2\n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>i. (i<length(q s)) \\<longrightarrow> (\\<exists>a b. ((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b = snd(q s!i)))\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> ownB s (fst(q s!i)+snd(q s!i)-1) = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) \\<and> fst(q s!i)+snd(q s!i)-1 \\<le> N)\\<longrightarrow> fst(q s!i)+snd(q s!i)-1<b\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"fst(q s!i) + snd(q s!i)\\<le>N\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse)\n  apply(subgoal_tac \"fst(q s!i) + snd(q s!i)-1\\<le>N\") prefer 2 \n  apply linarith\n  apply(subgoal_tac \"i<length(q s)\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"fst(q s!i)+snd(q s!i)-1<b\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply (metis Suc_leI diff_Suc_1 le_trans less_natE)\n  apply(case_tac \"fst(q s!i) > hW s\") \n  apply linarith\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j<a+b)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s) \\<and> a\\<le>j \\<and> j\\<le>a+b-1)\\<longrightarrow>ownB s j = Q\") prefer 2 \n  apply (metis Suc_pred' add_gr_0 le_imp_less_Suc)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> (q s!i) \\<in> set(q s)\") prefer 2 \n  apply (metis nth_mem)\n  apply(subgoal_tac \"fst(q s!i)< fst(q s!i) + snd(q s!i)\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2\n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b. (a,b)\\<in>set(q s) \\<longrightarrow> b>0\") prefer 2\n  apply meson\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s))\\<longrightarrow>a\\<le>a+b-1\\<and> a+b-1\\<le>a+b-1\") prefer 2  \n  apply (metis Suc_diff_1 add_gr_0 le_eq_less_or_eq less_Suc_eq_le less_add_same_cancel1)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s))\\<longrightarrow>ownB s (a+b-1) = Q\") prefer 2 \n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<forall>i. (i<length(q s)) \\<longrightarrow> (\\<exists>a b. ((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b = snd(q s!i)))\") prefer 2\n  apply (metis prod.collapse)\n  apply(subgoal_tac \"\\<forall>i. i<length(q s) \\<longrightarrow> ownB s (fst(q s!i)+snd(q s!i)-1) = Q\") prefer 2 \n  apply (metis (no_types, hide_lams))\n  apply(subgoal_tac \"fst(q s!i) + snd(q s!i)\\<le>N\") prefer 2 \n  apply (metis less_add_same_cancel1 prod.collapse) \n  apply(subgoal_tac \"fst(q s!i) < hW s\") prefer 2 \n  apply blast\n  by (metis (no_types, hide_lams) F.distinct(19) diff_is_0_eq' less_nat_zero_code linorder_neqE_nat nat_le_linear zero_less_diff)\n\n\n\n    \n\n\nlemma W_local_A5_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A5\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:inv_def pre_W_def cW_step_def pre_A5_inv_def pre_write_inv_def)\n  apply(case_tac \"Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(simp_all add: pre_A6_inv_def)\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(simp_all add: pre_A7_inv_def)  \n  by(simp_all add: pre_A8_inv_def)\n\n\nlemma W_local_A6_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A6\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def)\n  apply(simp add:inv_def pre_A6_inv_def)\n  apply(subgoal_tac \"H s\\<ge>T s\") prefer 2 \n  apply meson apply(subgoal_tac \"\\<not>case_2 s\") prefer 2\n  apply (metis case_split_2)\n  apply(subgoal_tac \"case_1 s\") prefer 2\n  apply blast\n  apply(thin_tac \"\\<not>case_2 s\") \n  apply(simp add:pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(intro conjI impI)\n  apply (metis Nat.le_diff_conv2 add.commute)\n  apply(simp add:case_1_def)\n  apply (metis cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq le_zero_eq length_0_conv)\n  apply (metis (no_types, hide_lams) F.distinct(19) Q_owns_bytes_def diff_self_eq_0 le_eq_less_or_eq less_nat_zero_code ran_indices_lem5)\n  apply(simp add:case_1_def)\n  defer\n  apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) cancel_comm_monoid_add_class.diff_cancel le_eq_less_or_eq le_zero_eq length_0_conv trans_le_add1)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(subgoal_tac \"hW s = H s\") prefer 2 \n  apply presburger\n  apply(clarify)\n  apply(intro conjI impI)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i<fst (last (q s)) + snd (last (q s))\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s)\\<and>a \\<le> j \\<and> j<a+b ) \\<longrightarrow> ownB s j = Q\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2 \n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> a<N\") prefer 2 \n  apply (metis F.distinct(23) add_leD1 nat_less_le)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> a<hW s\")\n  apply (metis (no_types, lifting) le_eq_less_or_eq nth_mem prod.collapse)\n  apply (metis le_neq_implies_less less_or_eq_imp_le)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i<fst (last (q s)) + snd (last (q s))\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) le_eq_less_or_eq linorder_neqE_nat)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s)\\<and>a \\<le> j \\<and> j<a+b ) \\<longrightarrow> ownB s j = Q\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s)\\<longrightarrow>a \\<le> a+b-1 \\<and> a+b-1<a+b\") prefer 2 \n  apply (metis Suc_diff_1 add_gr_0 diff_less less_Suc_eq_le less_add_same_cancel1 less_one)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a+b-1) = Q\") prefer 2\n  apply (metis (no_types, lifting))\n  apply(subgoal_tac \"\\<exists>a b.((a,b)\\<in>set(q s) \\<and> a=fst(q s!i) \\<and> b=Data s (numDeqs s + i))\") prefer 2\n  apply (metis nth_mem prod.collapse)\n  by (metis (no_types, hide_lams) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n\n\n\n\nlemma W_local_A7_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A7\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def)\n  apply(simp add:inv_def pre_A7_inv_def)\n  apply(subgoal_tac \"H s\\<ge>T s\") prefer 2 \n  apply meson apply(subgoal_tac \"\\<not>case_2 s\") prefer 2\n  apply (metis case_split_2)\n  apply(subgoal_tac \"case_1 s\") prefer 2\n  apply blast\n  apply(thin_tac \"\\<not>case_2 s\") \n  apply(simp add:pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(intro conjI impI)\n  apply (metis (no_types, hide_lams) F.distinct(19) Q_owns_bytes_def bot_nat_0.not_eq_extremum less_nat_zero_code ran_indices_lem5)\n  apply(simp add:case_1_def) \n  defer\n  apply(simp add:case_1_def)\n  apply (metis F.distinct(19) cancel_comm_monoid_add_class.diff_cancel diff_is_0_eq le_neq_implies_less le_zero_eq length_0_conv)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(subgoal_tac \"hW s = H s\") prefer 2 \n  apply presburger\n  apply(clarify)\n  apply(subgoal_tac \"\\<forall>i.(ownB s i = Q \\<and> i\\<le>N)\\<longrightarrow>i\\<ge>fst (hd (q s))\") prefer 2 \n  apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(subgoal_tac \"\\<forall>a b j.((a,b)\\<in>set(q s)\\<and>a \\<le> j \\<and> j<a+b ) \\<longrightarrow> ownB s j = Q\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> ownB s (a) = Q\") prefer 2 \n  apply (metis (no_types, hide_lams) Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> a<N\") prefer 2 \n  apply (metis F.distinct(23) add_leD1 nat_less_le)\n  apply(subgoal_tac \"\\<forall>i.(i\\<le>Data s (numEnqs s))\\<longrightarrow>ownB s i = B\") prefer 2 \n  apply (metis add_lessD1 nat_le_iff_add)\n  apply(subgoal_tac \"\\<forall>a b.(a,b)\\<in>set(q s) \\<longrightarrow> a>Data s (numEnqs s)\") prefer 2\n  apply (metis F.distinct(19) Suc_le_lessD not_less_eq_eq)\n  by (metis nth_mem prod.collapse)\n   \n   \n\n\n\nlemma W_local_A8_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = A8\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def)\n  apply(simp add:inv_def pre_A8_inv_def)\n  apply(case_tac \"N < Data s (numEnqs s)\") \n  apply (metis leD) apply(intro conjI impI) \n  apply linarith apply(simp add:pre_OOM_inv_def) apply(intro conjI impI)\n  defer \n  apply(case_tac \"case_1 s\") apply simp  apply(simp add:case_1_def)\n  apply metis\n  apply meson apply(case_tac \"case_1 s\") apply simp  apply(simp add:case_1_def)\n  apply metis\n  apply(simp add:case_2_def)\n  by (metis le_antisym less_or_eq_imp_le)\n\n\n\n\n\nlemma W_local_Enqueue_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = Enqueue\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def)\n  apply(simp add:inv_def pre_enqueue_inv_def)\n  apply(intro conjI impI) \n  apply(simp add:pre_acquire_inv_def) apply(intro conjI impI)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) \n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis F.distinct(5) eq_imp_le less_add_same_cancel1)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply clarify\n  apply(intro conjI impI)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n  apply (metis add_cancel_left_left less_imp_le_nat old.prod.inject prod.collapse tempW_def)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply(simp add:pre_acquire_inv_def)\n  apply(intro conjI impI) \n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis F.distinct(5) le_eq_less_or_eq less_add_same_cancel1)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  by (metis Suc_diff_Suc Zero_not_Suc diff_is_0_eq' less_or_eq_imp_le)\n\n\n\nlemma W_local_idleW_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = idleW\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def)\n  apply(simp add:inv_def pre_acquire_inv_def) \n  apply(case_tac \" numEnqs s < n\", simp_all)\n  apply(simp add: pre_A1_inv_def) \n  apply blast\n  by(simp add: pre_finished_inv_def) \n\n\n\nlemma W_local_OOM_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = OOM\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:cW_step_def pre_W_def)\n  apply(simp add:inv_def pre_OOM_inv_def)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:inv_def pre_acquire_inv_def)\n  apply(case_tac \"case_1 s\") apply(simp ) apply(simp add:case_1_def)\n  apply(intro conjI impI) \n  apply (metis eq_imp_le less_imp_le_nat linorder_neqE_nat)\n  apply (metis le_neq_implies_less le_refl)\n  apply (metis diff_self_eq_0 le_neq_implies_less le_refl le_zero_eq length_0_conv) \n  apply (metis le_refl length_0_conv nat_less_le ordered_cancel_comm_monoid_diff_class.le_imp_diff_is_add plus_nat.add_0)\n  apply (metis diff_self_eq_0 le_antisym le_refl nat_less_le zero_less_diff)\n  apply metis\n  apply(simp add:case_2_def)\n  apply(intro conjI impI) \n  apply (metis)\n  apply (metis)\n  apply (metis)\n  apply (metis)\n  apply metis \n  apply (metis le_antisym nat_less_le)\n  apply(simp add:pre_OOM_inv_def)\n  by blast\n\n\n\nlemma W_local_FinishedW_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = FinishedW\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  by(simp add:cW_step_def pre_W_def)\n\n\n\n\nlemma W_local_Write_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = Write\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(simp add:pre_W_def cW_step_def)\n  apply(simp add:inv_def pre_write_inv_def)\n  apply(simp add:pre_enqueue_inv_def)\n  apply(intro conjI impI)\n  apply clarify\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) apply clarify\n  apply(intro conjI impI)\n  apply(subgoal_tac \"i<T s\\<longrightarrow>ownB s i=B\") prefer 2\n  apply metis\n  apply(subgoal_tac \"T s\\<le>i \\<and> i<b\\<longrightarrow>ownB s i = R\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"b\\<le>i \\<and> i<c\\<longrightarrow>ownB s i = Q\") prefer 2 \n  apply metis\n  apply (metis (mono_tags, lifting) F.distinct(1) F.distinct(3) F.distinct(5) Suc_le_lessD le_eq_less_or_eq not_less_eq_eq trans_less_add1)\n  apply(subgoal_tac \"end(tempW s)\\<le>i \\<and> i<N\\<longrightarrow> ownB s i = B\") prefer 2\n  apply metis\n  apply (metis F.distinct(5) F.distinct(9) le_neq_implies_less)\n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(clarify)\n  apply(intro conjI impI) \n  apply (metis F.distinct(1) F.distinct(3) eq_imp_le linorder_neqE_nat nat_less_le trans_less_add1)\n  apply (metis F.distinct(1) F.distinct(3) F.distinct(5) F.distinct(7) F.distinct(9) le_neq_implies_less less_or_eq_imp_le linorder_neqE_nat)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(subgoal_tac \"case_2 s\") prefer 2\n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def) \n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp add:case_1_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(subgoal_tac \"case_2 s\") prefer 2 \n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp add:case_1_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply(subgoal_tac \"case_2 s\") prefer 2 \n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"case_1 s\") apply(simp add:case_1_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas) \n  apply (metis le_antisym le_trans less_nat_zero_code)\n  apply(subgoal_tac \"case_2 s\") prefer 2 \n  apply blast apply(simp) apply(thin_tac \"\\<not>case_1 s\") apply(simp add:case_2_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  by(simp add:tempW_lemmas tempW_basic_lemmas)\n\n\n\n\n\nlemma W_local_BTS_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcW s = BTS\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  by(simp add:cW_step_def pre_W_def)\n\n\n\nlemma local_pre_W_pre: \n  assumes \"con_assms s\"\n  and \"pcw = pcW s\"\n  and \"pre_W pcw s\"\n  and \"inv s\"\n  and \"cW_step pcw s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply(case_tac \"pcW s\") \n  using W_local_A1_lemma [where s=s and s'=s'] apply blast \n  using W_local_A2_lemma [where s=s and s'=s'] apply blast \n  using W_local_A3_lemma [where s=s and s'=s'] apply blast  \n  using W_local_A4_lemma [where s=s and s'=s'] apply blast   \n  using W_local_A5_lemma [where s=s and s'=s'] apply blast  \n  using W_local_A6_lemma [where s=s and s'=s'] apply blast    \n  using W_local_A7_lemma [where s=s and s'=s'] apply blast     \n  using W_local_A8_lemma [where s=s and s'=s'] apply blast       \n  using W_local_Enqueue_lemma [where s=s and s'=s'] apply blast  \n  using W_local_idleW_lemma [where s=s and s'=s'] apply blast    \n  using W_local_OOM_lemma [where s=s and s'=s'] apply blast         \n  using W_local_FinishedW_lemma [where s=s and s'=s'] apply blast   \n  using W_local_Write_lemma [where s=s and s'=s'] apply blast   \n  using W_local_BTS_lemma [where s=s and s'=s'] by blast       \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************Local R pre post lemmas*************************************)\nlemma R_local_release_pre_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = Release\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n  using assms apply(simp add:pre_R_def) apply clarify\n  apply(subgoal_tac \"ownT s' \\<noteq> R\") prefer 2 \n  apply(simp add:pre_dequeue_inv_def)\n  apply(simp add:cR_step_def)\n  apply(subgoal_tac \"ownT s = R\") prefer 2 \n  apply(simp add:pre_Release_inv_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s = fst(tempR s)\") apply simp_all\n  apply(simp add:pre_dequeue_inv_def)\n   apply(intro conjI impI)\n  apply(simp add:pre_Release_inv_def)\n  apply(simp add:pre_Release_inv_def)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"hd(q s)\\<in>set(q s)\") prefer 2 \n  apply (metis hd_in_set)\n  apply(subgoal_tac \"fst(q s!0) = 0\") prefer 2 \n  apply (metis hd_conv_nth)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(case_tac \"case_1 s \") apply simp apply(simp add:case_1_def)\n  apply (metis diff_self_eq_0 le_neq_implies_less length_pos_if_in_set less_nat_zero_code)\n  apply(simp) apply(thin_tac \"\\<not> case_1 s\") apply(simp add:case_2_def)\n  apply(clarify)\n  apply(subgoal_tac \"e=f\") prefer 2\n  apply (metis gr_implies_not0 le_neq_implies_less)\n  apply(subgoal_tac \"(i<N \\<and> ownB s i = Q )\\<longrightarrow> i<ba\") prefer 2 \n  apply (metis (mono_tags, hide_lams) F.distinct(11) F.distinct(19) F.distinct(21) F.distinct(3) diff_is_0_eq neq0_conv zero_less_diff)\n  apply(subgoal_tac \"aa=0\") prefer 2\n  apply (metis gr_implies_not0)\n  apply(subgoal_tac \"a+b\\<le>ba\")\n  apply (metis (no_types, lifting) Suc_le_eq le_add1 le_trans not_less_eq_eq)\n  apply(subgoal_tac \"(a\\<le>i \\<and> i<a+b) \\<longrightarrow> (ownB s i = Q)\") prefer 2\n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"a = i\\<longrightarrow> ownB s i = Q\") prefer 2\n  apply (metis le_refl less_add_same_cancel1)\n  apply(subgoal_tac \"fst(tempR s) = T s \\<longrightarrow> ownB s (T s) =R\") prefer 2\n  apply (metis gr_implies_not0 le_refl)\n  apply(subgoal_tac \"T s > ba\") prefer 2\n  apply (metis le0 less_nat_zero_code nat_neq_iff)\n  apply(subgoal_tac \"a=i\\<longrightarrow>i<ba\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(23) le_add1 le_neq_implies_less le_trans)\n  apply(subgoal_tac \"a+b-1 = i \\<longrightarrow>ownB s i=Q\") prefer 2\n  apply (metis Suc_diff_1 add_gr_0 lessI less_Suc_eq_le less_add_same_cancel1)\n  apply(subgoal_tac \"\\<nexists>i.(i\\<ge>ba \\<and> ownB s i = Q \\<and> i\\<le>N)\") prefer 2 \n  apply (metis (no_types, hide_lams) F.distinct(11) F.distinct(19) F.distinct(21) F.distinct(23) F.distinct(3) bot_nat_0.not_eq_extremum diff_diff_cancel diff_is_0_eq diff_self_eq_0 zero_less_diff)\n  apply(subgoal_tac \"a=i \\<and> ownB s i = Q \\<longrightarrow> i<ba\") prefer 2\n  apply meson\n  defer defer\n  apply(simp add:pre_dequeue_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:pre_Release_inv_def)\n  apply(simp add:pre_Release_inv_def)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"fst(hd(q s)) = 0\") prefer 2 \n  apply blast\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def)\n  apply metis\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis head_q0 length_greater_0_conv)\n  prefer 3 \n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def pre_Release_inv_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(clarify) apply(intro conjI impI)\n  apply (metis (no_types, lifting) bot_nat_0.extremum_uniqueI diff_self_eq_0 le_neq_implies_less length_0_conv)\n  apply(subgoal_tac \"hd(q s) \\<in> set(q s)\") prefer 2\n  apply (metis hd_in_set)\n  apply(subgoal_tac \"i\\<le>N\") prefer 2\n  apply (metis (no_types, lifting) le_trans less_or_eq_imp_le prod.collapse)\n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\") prefer 2 apply blast\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply (metis (no_types, lifting) prod.collapse)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:case_1_def pre_Release_inv_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(clarify) apply(intro conjI impI) \n  apply(subgoal_tac \"\\<forall>i. (\\<exists>x. (\\<exists>a b. x = {i. a \\<le> i \\<and> i < a + b} \\<and> (a, b) \\<in> set (q s)) \\<and> i \\<in> x) = (i \\<le> N \\<and> ownB s i = Q)\") prefer 2 apply blast\n  apply(subgoal_tac \"hd(q s) \\<in> set(q s)\") prefer 2\n  apply (metis hd_in_set)\n  apply(subgoal_tac \"a = 0\") prefer 2 \n  apply (metis less_nat_zero_code)\n  apply(case_tac \"fst(hd(q s)) = e\") \n  apply (metis gr_implies_not0)\n  apply(subgoal_tac \"fst(hd(q s)) = 0\") prefer 2\n  apply metis\n  apply(subgoal_tac \"b\\<le>H s\") prefer 2\n  apply fastforce\n  apply(subgoal_tac \"H s< T s\") prefer 2\n  apply fastforce\n  apply(subgoal_tac \"b< T s\") prefer 2\n  apply (metis le0 le_refl less_nat_zero_code nat_neq_iff)\n  apply(subgoal_tac \"i\\<ge>end(hd(q s))\") \n  apply (metis Suc_leI end_simp not_less_eq_eq)\n  apply(subgoal_tac \"e = f\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"i\\<ge>T s\") prefer 2\n  apply (metis less_Suc_eq_le not_less_eq)\n  apply(subgoal_tac \"\\<forall>i.(i\\<ge>a \\<and> i<end(hd(q s))) \\<longrightarrow> ownB s i = Q\")\n  prefer 2 \n  apply (metis (no_types, lifting) end_simp prod.collapse)\n  apply (metis F.distinct(11) less_Suc_eq_le not_less_eq)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\") apply simp \n  apply(simp add:case_1_def pre_Release_inv_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply metis\n  apply(simp add:case_2_def pre_Release_inv_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_Release_inv_def tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(clarify)\n  apply(intro conjI impI)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply (metis (no_types, hide_lams) F.distinct(21) less_imp_Suc_add list.set_sel(1) nat.distinct(1) nat_less_le prod.exhaust_sel)\n  apply (metis head_q0 length_greater_0_conv)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"aa=0\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>a b.((a,b)\\<in>set(q s)) \\<longrightarrow> a+b\\<le>N\") prefer 2\n  apply meson\n  apply(subgoal_tac \"\\<forall>a b i.((a,b)\\<in>set(q s) \\<and> i\\<ge>a \\<and> i<a+b) \\<longrightarrow> ownB s i=Q\") prefer 2 \n  apply (metis (no_types, lifting) mem_Collect_eq)\n  apply(subgoal_tac \"\\<forall>j.(a\\<le>j \\<and> j<b+a) \\<longrightarrow> ownB s j = Q\") prefer 2\n  apply (metis add.commute)\n  by (metis (no_types, hide_lams) Suc_eq_plus1 add_diff_inverse_nat add_leD1 diff_add_inverse2 diff_le_self less_eq_Suc_le zero_less_diff)\n\n\n\n\nlemma R_local_idle_pre_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = idleR\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n  using assms apply(simp add:pre_R_def) apply clarify\n  apply(case_tac \"q s=[]\") \n  using cR_step_def apply auto[1] apply(subgoal_tac \"ownT s = Q\") prefer 2 \n  apply(simp add:pre_dequeue_inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis add_cancel_right_right head_q0 length_greater_0_conv)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis add_cancel_right_right head_q0 length_greater_0_conv)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis diff_is_0_eq' le_trans length_0_conv not_less_eq_eq)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis diff_is_0_eq' length_0_conv not_less_eq_eq)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis length_greater_0_conv plus_nat.add_0)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis hd_in_set less_nat_zero_code)\n  apply(simp add:inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI) \n  apply(subgoal_tac \"(\\<forall>i. i < length (q s) \\<and> 0 < i \\<longrightarrow>\n         fst (q s ! (i - Suc 0)) + snd (q s ! (i - Suc 0)) = fst (q s ! i) \\<or> fst (q s ! i) = 0)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n  apply (metis Q_ind_imp_tail_ind_1)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2 \n  apply (metis One_nat_def hd_conv_nth length_greater_0_conv nth_tl)\n  apply (metis (no_types, lifting) One_nat_def Q_ind_imp_tail_ind_1 diff_Suc_1 length_greater_0_conv length_tl less_one zero_less_diff)\n  apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n  apply (metis Q_ind_imp_tail_ind_1)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2 \n  apply (metis One_nat_def hd_conv_nth length_greater_0_conv nth_tl)\n  apply (metis (no_types, lifting) One_nat_def Suc_eq_plus1 Suc_neq_Zero length_greater_0_conv length_tl less_diff_conv nth_tl)\n  apply(subgoal_tac \"fst(hd(q s)) = fst(q s!0)\") prefer 2\n  apply (metis Q_ind_imp_tail_ind_1)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2 \n  apply (metis One_nat_def hd_conv_nth length_greater_0_conv nth_tl)\n  apply(subgoal_tac \"i<length(q s) - Suc 0 \\<longrightarrow> (tl (q s) ! i )\\<in>set (q s)\") prefer 2\n  apply (metis One_nat_def length_tl list.set_sel(2) nth_mem)\n  apply(subgoal_tac \"(hd (q s))\\<in>set (q s)\") prefer 2\n  apply (metis hd_in_set)\n  apply simp apply clarify\n  apply (intro conjI impI) apply(subgoal_tac \"snd(hd(q s)) = snd(q s!0)\") prefer 2 \n  apply (metis Q_ind_imp_tail_ind_1) apply simp \n  apply(subgoal_tac \"\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) -1)\\<longrightarrow>(tl(q s)!i)\\<in>set(q s)\") prefer 2\n  apply (metis length_tl list.set_sel(2) nth_mem)\n  apply(subgoal_tac \"tl(q s)!ia \\<in>set(q s)\") prefer 2\n  apply (metis One_nat_def)\n  apply(subgoal_tac \"fst(tl(q s)!ia) >fst(hd(q s))\") prefer 2\n  apply presburger\n  apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n  apply(subgoal_tac \"\\<forall>a b aa. (a, b) \\<in> set (q s) \\<and> (\\<exists>b. (aa, b) \\<in> set (q s)) \\<longrightarrow> a < aa \\<longrightarrow> a + b \\<le> aa\") prefer 2\n  apply blast\n  apply(subgoal_tac \"\\<forall>i.(i<length(q s) -1)\\<longrightarrow>(tl(q s)!i)\\<in>set(q s)\") prefer 2\n  apply (metis length_tl list.set_sel(2) nth_mem)\n  apply(subgoal_tac \"tl(q s)!ia \\<in>set(q s)\") prefer 2\n  apply (metis One_nat_def)\n  apply(subgoal_tac \"fst(tl(q s)!ia) <fst(hd(q s))\") prefer 2\n  apply presburger\n  apply (metis (no_types, lifting) list.set_sel(1) prod.collapse)\n  apply(subgoal_tac \"hd(q s)\\<in>set(q s)\") prefer 2 \n  apply (metis hd_in_set)\n  apply(subgoal_tac \"last (tl (q s))\\<in>set(q s)\") prefer 2\n  apply (metis last_in_set last_tl) \n  apply (metis fst_conv last_tl surj_pair)\n  apply (metis Nat.add_0_right hd_conv_nth length_greater_0_conv)\n  apply (metis add_cancel_right_right head_q0 length_greater_0_conv) defer\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\") apply(simp) apply(simp add:case_1_def) \n  apply (metis bot_nat_0.extremum_uniqueI bot_nat_0.not_eq_extremum diff_is_0_eq' length_greater_0_conv)\n  apply(simp) apply(thin_tac \"\\<not> case_1 s\") apply(simp add:case_2_def)\n  apply meson\n  apply(simp add:inv_def)\n  apply(simp add:Q_owns_bytes_def Q_indices_def ran_indices_def)\n  apply(subgoal_tac \"hd(q s)\\<in>set(q s)\") prefer 2 \n  apply (metis hd_in_set) \n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis F.distinct(13) bot_nat_0.extremum_uniqueI diff_self_eq_0 le_neq_implies_less length_0_conv)\n  apply simp apply(thin_tac \"\\<not>case_1 s\")  apply(simp add:case_2_def)\n  apply(simp add:pre_dequeue_inv_def)\n  by (metis diff_self_eq_0 fst_conv le0 le_trans length_greater_0_conv nat_less_le plus_nat.add_0 snd_conv)\n\n\n\n\nlemma R_local_read_pre_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pcR s = Read\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n  using assms apply(simp add:pre_R_def) apply clarify\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_Release_inv_def)\n  apply(intro conjI impI)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:inv_def) apply(simp add:Q_lemmas Q_basic_lemmas) apply(subgoal_tac \"hd(q s)\\<in>set(q s)\")\n  prefer 2 \n  apply (meson list.set_sel(1))\n  apply (metis Nat.add_0_right hd_conv_nth length_pos_if_in_set)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(intro conjI impI)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"snd (tempR s) = Data s (numDeqs s - Suc 0)\") prefer 2\n  apply blast\n  apply metis\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"snd (tempR s) = Data s (numDeqs s - Suc 0)\") prefer 2\n  apply blast \n  apply force\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  apply(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n  by(simp add:pre_Read_inv_def tempR_lemmas tempR_basic_lemmas)\n\n\nlemma R_local_pre_lemma:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_R (pcR s') s'\"\n  using assms apply(case_tac \"pcR s\") \n  using R_local_release_pre_lemma [where s=s and s'=s'] apply blast           (*done*)\n  using R_local_idle_pre_lemma [where s=s and s'=s'] apply blast           (*done*)\n  using R_local_read_pre_lemma [where s=s and s'=s'] by blast           (*done*)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************GLOBAL W_step shows preR*************************************)\n\n\nlemma pcR_doesnt_change_with_W:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pcR s'=pcR s\"\n using assms apply simp\n  apply(case_tac \"pcW s \", simp add:cW_step_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def)\n  apply(simp add:cW_step_def) apply(cases \"numEnqs s < n\") \n  apply(simp add:B_acquire_def) apply(simp add:B_acquire_def) \n  apply(simp add:cW_step_def) apply(cases \"tW s \\<noteq> T s\") \n  apply(simp add:cW_step_def) \n  apply(simp add:cW_step_def) \n  apply(simp add:cW_step_def) \n  apply(simp add:cW_step_def) \n  by(simp add:cW_step_def) \n\n\nlemma supporting_strange:\n  \"\\<forall>i<(length (q s)).\n       (fst (tempR s) < fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) \\<longrightarrow>\n        fst (tempR s) + snd (tempR s) \\<le> fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i)) \\<and>\n       (fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) < fst (tempR s) \\<longrightarrow>\n        fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) +\n        snd ((q s @ [(offset s, Data s (numEnqs s))]) ! i)\n        \\<le> fst (tempR s)) \\<Longrightarrow> \n       (fst (tempR s) < fst ((offset s, Data s (numEnqs s))) \\<longrightarrow>\n        fst (tempR s) + snd (tempR s) \\<le> fst ((offset s, Data s (numEnqs s)))) \\<and>\n       (fst ((offset s, Data s (numEnqs s))) < fst (tempR s) \\<longrightarrow>\n        fst ((offset s, Data s (numEnqs s))) +\n        snd ((offset s, Data s (numEnqs s)))\n        \\<le> fst (tempR s))\n\\<Longrightarrow>\n \\<forall>i<Suc (length (q s)).\n       (fst (tempR s) < fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) \\<longrightarrow>\n        fst (tempR s) + snd (tempR s) \\<le> fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i)) \\<and>\n       (fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) < fst (tempR s) \\<longrightarrow>\n        fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) +\n        snd ((q s @ [(offset s, Data s (numEnqs s))]) ! i)\n        \\<le> fst (tempR s))\"\n  by (metis less_SucE nth_append_length)\n\n\n\nlemma preRead_doesnt_change_with_W:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_Read_inv s\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_Read_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_Read_inv_def) \n  apply(intro conjI impI)\n  apply(simp add:pre_W_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(cases \"pcW s\", simp_all)\n  apply(simp_all add:cW_step_def)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:pre_W_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(cases \"pcW s\", simp_all)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:pre_write_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def)\n  apply (metis F.distinct(1) eq_imp_le fst_eqD less_add_same_cancel1 snd_eqD)\n  apply(cases \"pcW s\", simp_all)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply(cases \"numEnqs s<n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all)\n  apply metis\n  apply(case_tac \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply metis\n  apply(case_tac \" hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all, metis)\n  apply(case_tac \"tW s < hW s\", simp_all, metis, metis, metis, metis)\n  apply(case_tac \" Data s (numEnqs s) \\<le> N - hW s\", simp_all, metis)\n  apply(case_tac \" Data s (numEnqs s) < tW s\", simp_all, metis, metis, metis, metis, metis, metis)\n  apply(case_tac \"numEnqs s < n\", simp_all, metis, metis)\n  apply(cases \"tW s \\<noteq> T s\", simp_all, metis, metis, metis, metis, metis)\n  apply(case_tac \"pcW s\", simp_all add:cW_step_def)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)  \n  apply(cases \"pcW s\", simp_all) \n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(case_tac \" tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all) \n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(case_tac \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(case_tac \"tW s < hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply (metis (no_types, lifting) F.distinct(13) Suc_lessD add.commute less_diff_conv less_trans_Suc)\n  apply(case_tac \" Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply metis\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply metis\n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le nat_neq_iff)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(clarify)\n  apply(intro conjI impI)\n  apply (metis F.distinct(13) Suc_lessD less_trans_Suc)\n  apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le linorder_neqE_nat)\n  apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n  apply(simp add:pre_W_def pre_A8_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_A8_inv_def)  defer\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(simp add:pre_W_def pre_acquire_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_acquire_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_OOM_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply metis\n  apply metis\n  apply(simp add:pre_W_def pre_write_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right eq_imp_le fst_eqD nat_add_left_cancel_less snd_eqD)\n  defer\n  defer\n  defer \n  apply(simp add:pre_W_def pre_enqueue_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(intro conjI impI)\n  apply(simp add: tempW_def)\n  apply(case_tac \"q s\\<noteq>[]\") \n  apply (metis (no_types, hide_lams) hd_append2)\n  apply(subgoal_tac \"q s=[]\") prefer 2 \n  apply force\n  apply(subgoal_tac \"tempR s \\<noteq>(0,0)\") prefer 2 \n  apply blast\n  apply(case_tac \"offset s = 0\")\n  apply (metis append_Nil fst_conv list.sel(1))\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply clarify \n  apply(subgoal_tac \"c=b\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"end(tempR s) = b\") prefer 2 \n  apply (metis end_simp le_add_diff_inverse)\n  apply(subgoal_tac \"offset s = hW s\") prefer 2\n  apply meson \n  apply(subgoal_tac \"i\\<ge>c \\<and> i<H s \\<longrightarrow>ownB s i = W\") prefer 2\n  apply metis\n  apply(subgoal_tac \"H s\\<le>N\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"(i<c \\<or> i\\<ge>H s \\<and> i\\<le>N) \\<longrightarrow>ownB s i\\<noteq>W\") prefer 2 \n  apply (metis F.distinct(1) F.distinct(5) bot_nat_0.not_eq_extremum diff_is_0_eq zero_less_diff)\n  apply (metis F.distinct(1) add_leD1 end_simp le_eq_less_or_eq linorder_neqE_nat nat_less_le)  \n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\") \n  apply clarify \n  apply (metis eq_imp_le le_add1 le_neq_implies_less plus_nat.add_0)\n  apply(simp add: tempW_def)\n  apply(case_tac \"q s=[]\")\n  apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right Suc_le_lessD Suc_lessD Suc_pred add_lessD1 fst_eqD le_add_diff_inverse less_Suc0 less_Suc_eq_le less_add_same_cancel1 list.size(3) nat_add_left_cancel_le nth_Cons_0 self_append_conv2)\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>i<length (q s). fst ((q s) ! i) \\<noteq> fst (tempR s)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"fst((offset s, Data s (numEnqs s))) \\<noteq> fst(tempR s)\") \n  apply (metis less_SucE nth_append nth_append_length)\n  apply(subgoal_tac \"offset s \\<noteq> fst(tempR s)\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n  apply(case_tac \"case_1 s\", simp_all) \n  apply(subgoal_tac \"Data s (numReads s) = snd(tempR s)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"Data s (numDeqs s - Suc 0) = snd(tempR s)\") prefer 2\n  apply presburger \n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(subgoal_tac \"\\<forall>i<length (q s).\n       (fst (tempR s) < fst ((q s ) ! i) \\<longrightarrow>\n        fst (tempR s) + Data s (numDeqs s - Suc 0) \\<le> fst ((q s ) ! i)) \\<and>\n       (fst ((q s) ! i) < fst (tempR s) \\<longrightarrow>\n        fst ((q s) ! i) + snd ((q s ) ! i)\n        \\<le> fst (tempR s))\")\n       prefer 2 \n  apply (metis (no_types, lifting) gr_implies_not0 length_0_conv)\n  apply(subgoal_tac \"(fst (tempR s) < fst(offset s, Data s (numEnqs s)) \\<longrightarrow>\n        fst (tempR s) + Data s (numDeqs s - Suc 0) \\<le> fst(offset s, Data s (numEnqs s))) \\<and>\n       (fst(offset s, Data s (numEnqs s)) < fst (tempR s) \\<longrightarrow>\n        fst(offset s, Data s (numEnqs s)) +\n        snd(offset s, Data s (numEnqs s))\n        \\<le> fst (tempR s))\") \n  apply(subgoal_tac \"((q s @ [(offset s, Data s (numEnqs s))]) ! length (q s)) = (offset s, Data s (numEnqs s))\") prefer 2 \n  apply (metis nth_append_length)\n  apply(subgoal_tac \"\\<forall>i<(length (q s)).\n       (fst (tempR s) < fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) \\<longrightarrow>\n        fst (tempR s) + snd (tempR s) \\<le> fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i)) \\<and>\n       (fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) < fst (tempR s) \\<longrightarrow>\n        fst ((q s @ [(offset s, Data s (numEnqs s))]) ! i) +\n        snd ((q s @ [(offset s, Data s (numEnqs s))]) ! i)\n        \\<le> fst (tempR s))\") prefer 2 \n  apply (metis (no_types, hide_lams) nth_append)\n  using supporting_strange [where s=s] \n  apply presburger\n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) Nat.add_0_right fst_eqD le_eq_less_or_eq less_add_same_cancel1 less_nat_zero_code nat_neq_iff snd_eqD tempW_def)\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply (simp add:case_1_def)\n  apply(clarify)\n  apply (metis (no_types, lifting) F.distinct(1) diff_is_0_eq le_refl less_imp_le_nat not_gr0 prod.collapse prod.inject tempW_def zero_less_diff)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\") \n  apply clarify\n  apply (metis less_or_eq_imp_le zero_less_iff_neq_zero)\n  apply(simp add: tempW_def)\n  apply(subgoal_tac \"fst((offset s, Data s (numEnqs s))) + snd((offset s, Data s (numEnqs s)))  \\<noteq> fst(tempR s)\")\n  apply (metis fst_eqD snd_eqD)\n  apply(subgoal_tac \"offset s \\<noteq> fst(tempR s)\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add:case_1_def)\n  apply(clarify)\n  apply linarith\n  apply(simp add:case_2_def) apply (thin_tac \"\\<not>case_1 s\") \n  apply(clarify)\n  apply (metis add_gr_0 nat_neq_iff)\n  apply(case_tac \"pcW s\", simp_all add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:case_2_def)\n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply (metis (no_types, lifting) le_add_diff_inverse le_eq_less_or_eq less_trans_Suc not_less_eq_eq)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not> case_1 s\")\n  apply(simp add:pre_W_def pre_A4_inv_def) \n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(clarify)\n  apply(subgoal_tac \"fst(tempR s) = 0 \\<or> fst(tempR s) = T s\") prefer 2\n  apply meson\n  apply(case_tac \"fst(tempR s) = T s\")\n  apply(subgoal_tac \"hW s = b\") prefer 2 \n  apply (metis le_imp_less_Suc le_refl le_trans not_less_less_Suc_eq)\n  apply(subgoal_tac \"T s > hW s + Data s (numEnqs s)\") prefer 2 \n  apply(subgoal_tac \"ownB s (T s) = R\") prefer 2\n  apply (metis gr_implies_not0 le_refl)\n  apply(subgoal_tac \"tW s = T s\") prefer 2\n  apply (metis (no_types, lifting) add.commute le_trans less_diff_conv nat_less_le)\n  apply(subgoal_tac \"Data s (numEnqs s) < (tW s - hW s)\") prefer 2 \n  apply fastforce\n  apply (metis add.commute less_diff_conv)\n  apply (metis Suc_leI le_trans less_or_eq_imp_le not_less_eq_eq)\n  apply(subgoal_tac \"fst(tempR s) = 0\") prefer 2\n  apply fastforce\n  apply(subgoal_tac \"end(tempR s) = a\") prefer 2 \n  apply (metis add_cancel_left_left end_simp)\n  apply(subgoal_tac \"hW s\\<ge>a\") prefer 2 \n  apply (metis le_trans)\n  apply (metis Suc_leI end_simp le_trans not_less_eq_eq)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply(simp add:pre_W_def pre_A6_inv_def) \n  apply (metis le_add_diff_inverse le_trans less_or_eq_imp_le)\n  apply(simp add:case_2_def)\n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply(simp add:pre_W_def pre_A7_inv_def) \n  apply clarify\n  apply(intro conjI impI)\n  apply linarith\n  apply (metis le_add_diff_inverse le_trans less_or_eq_imp_le)\n  apply(simp add:case_2_def)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply clarify\n  apply(intro conjI impI)\n  apply linarith\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  prefer 2\n  apply(case_tac \"pcW s\", simp_all)\n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"pcW s \", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  by(case_tac \"tW s \\<noteq> T s\", simp_all)\n  \n\n\n\nlemma preIdleR_doesnt_change_with_W:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_dequeue_inv s\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_dequeue_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_dequeue_inv_def) \n  apply(intro conjI impI)\n  apply(simp add:pre_W_def)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def pre_W_def)\n  apply(cases \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply(cases \"ownT s = Q\", simp_all)\n  apply(simp add:pre_A2_inv_def)\n  apply(cases \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(cases \"tW s < hW s\", simp_all)\n  apply(cases \"Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(cases \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(cases \"N < Data s (numEnqs s)\", simp_all)\n  apply(cases \"ownT s = W\", simp_all add:pre_enqueue_inv_def inv_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n  apply (metis nat_less_le)\n  apply simp apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis nat_less_le)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply(cases \"ownT s = W\", simp_all add:pre_enqueue_inv_def inv_def)\n  apply(cases \"ownT s = W\", simp_all add:pre_A2_inv_def inv_def)\n  apply(cases \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(cases \"tW s < hW s\", simp_all)\n  apply(simp add:pre_A3_inv_def)\n  apply(simp add:pre_A4_inv_def)\n  apply(simp add:pre_A5_inv_def)\n  apply(simp add:pre_A6_inv_def)\n  apply(simp add:pre_A7_inv_def)\n  apply(simp add:pre_A8_inv_def)\n  apply(cases \"N < Data s (numEnqs s)\", simp_all)\n  apply(simp add:pre_acquire_inv_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all) defer\n  apply(cases \"pcW s\", simp_all add:cW_step_def  B_acquire_def)\n  apply(cases \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all add:pre_enqueue_inv_def inv_def)\n  apply(cases \"ownT s = W\", simp_all add:pre_A2_inv_def inv_def)\n  apply(cases \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(cases \"tW s < hW s\", simp_all)\n  apply(simp add:pre_A3_inv_def)\n  apply(simp add:pre_A4_inv_def)\n  apply (metis (no_types, lifting) F.distinct(19) add.commute add_lessD1 less_diff_conv less_imp_add_positive)\n  apply(simp add:pre_A5_inv_def)\n  apply(cases \"Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(cases \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(simp add:pre_A6_inv_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply clarify\n  apply(subgoal_tac \"offset s = hW s\") prefer 2\n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) add_lessD1 diff_is_0_eq' le_0_eq le_eq_less_or_eq length_0_conv nat_le_iff_add)\n  apply (metis (no_types, lifting) F.distinct(19) add_lessD1 diff_self_eq_0 le_0_eq le_add_diff_inverse le_neq_implies_less length_0_conv)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\") \n  apply (metis Suc_leI not_less_eq_eq)\n  apply(simp add:pre_A7_inv_def) \n  apply(simp add:Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply clarify\n  apply (metis (no_types, lifting) F.distinct(19) F.distinct(23) add_lessD1 diff_is_0_eq' le_0_eq le_eq_less_or_eq length_0_conv nat_le_iff_add)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\") \n  apply (metis Suc_leI not_less_eq_eq)\n  apply(simp add:pre_A8_inv_def)\n  apply(cases \"N < Data s (numEnqs s)\", simp_all)\n  apply(cases \"ownT s = W\", simp_all)\n  apply (metis fst_conv le_trans nat_less_le snd_conv tempW_def)\n  apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add:case_1_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"q s=[]\")\n  apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = offset s\") prefer 2\n  apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n  apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = Data s (numEnqs s)\") prefer 2\n  apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n  apply (metis le_trans less_imp_le_nat)\n  apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = fst(hd(q s))\") prefer 2\n  apply (metis (no_types, lifting) hd_append2)\n  apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = snd(hd(q s))\") prefer 2\n  apply (metis (no_types, lifting) hd_append2)\n  apply presburger\n  apply(simp add:case_2_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"q s=[]\")\n  apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = offset s\") prefer 2\n  apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n  apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = Data s (numEnqs s)\") prefer 2\n  apply (metis append_self_conv2 list.sel(1) old.prod.inject prod.collapse)\n  apply (metis le_trans less_imp_le_nat)\n  apply(subgoal_tac \"fst(hd (q s @ [(offset s, Data s (numEnqs s))])) = fst(hd(q s))\") prefer 2\n  apply (metis (no_types, lifting) hd_append2)\n  apply(subgoal_tac \"snd(hd (q s @ [(offset s, Data s (numEnqs s))])) = snd(hd(q s))\") prefer 2\n  apply (metis (no_types, lifting) hd_append2)\n  apply presburger\n  apply(case_tac \"numEnqs s< n\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"pcW s\", simp_all)\n  apply(case_tac \"numEnqs s< n\", simp_all)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  apply(case_tac \"pcW s\", simp_all)\n  apply(case_tac \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \" hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s \", simp_all)\n  apply(case_tac \"tW s < hW s\", simp_all)\n  apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply (simp add: pre_A3_inv_def)\n  apply(case_tac \" Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n  apply(case_tac \"ownT s = W\", simp_all)\n  apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(simp add:pre_enqueue_inv_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply clarify\n  apply (metis (no_types, hide_lams) Nat.add_0_right diff_is_0_eq le_refl nat_add_left_cancel_less nat_neq_iff zero_less_diff)\n  apply(simp add:case_2_def) \n  apply(simp add:Q_lemmas Q_basic_lemmas Q_indices_def Q_owns_bytes_def ran_indices_def)\n  apply(simp add:pre_enqueue_inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply clarify\n  apply (metis (no_types, hide_lams) diff_self_eq_0 fst_eqD hd_append le_zero_eq length_0_conv less_add_same_cancel1 less_or_eq_imp_le list.sel(1) nat_less_le snd_eqD tempW_def)\n  apply(simp add:case_2_def) \n  apply(subgoal_tac \"\\<forall>a b j.\n       ((a, b) \\<in> set (q s)) \\<and> j < N \\<and> T s \\<le> j \\<longrightarrow>\n       a + b < j\") prefer 2\n  apply (metis (no_types, lifting) hd_append length_greater_0_conv length_pos_if_in_set)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"offset s + Data s (numEnqs s)<T s\") prefer 2 \n  apply force\n  apply(subgoal_tac \"\\<forall> j. T s \\<le> j \\<longrightarrow>\n       offset s + Data s (numEnqs s) < j\") prefer 2 \n  apply (metis (mono_tags, hide_lams) diff_is_0_eq le_trans nat_less_le zero_less_diff)\n  apply (metis (no_types, lifting))\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  by(case_tac \"tW s \\<noteq> T s\", simp_all)\n  \n\n\n\n\n\n\n\nlemma preRelease_doesnt_change_with_W:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_Release_inv s\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_Release_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_Release_inv_def) \n  apply(intro conjI impI)\n  apply(simp add:cW_step_def)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp_all add:cW_step_def)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:pre_W_def pre_write_inv_def)\n  apply (metis F.distinct(1) fst_eqD less_add_same_cancel1 nat_le_linear snd_eqD)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all)\n  apply(cases \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(cases \"tW s < hW s\", simp_all)\n  apply(case_tac \"Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n  apply(simp add:pre_W_def pre_enqueue_inv_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply (metis Nat.le_imp_diff_is_add hd_append length_0_conv list.sel(1) plus_nat.add_0 tempW_reflects_writes_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:pre_W_def pre_write_inv_def)\n  apply(simp add:inv_def Q_lemmas Q_basic_lemmas)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis fst_eqD head_q0 length_greater_0_conv)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(simp add:pre_W_def pre_write_inv_def)\n  apply (metis F.distinct(1))\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all) \n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all) defer\n  apply(cases \"pcW s\", simp_all) \n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply (metis (no_types, lifting) F.distinct(13) Suc_lessD add.commute less_diff_conv less_trans_Suc) \n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply (metis (mono_tags, hide_lams) F.distinct(13) le_antisym le_trans less_or_eq_imp_le nat_neq_iff)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply (metis (no_types, hide_lams) F.distinct(13) Suc_lessD less_trans_Suc)  \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all) \n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply(cases \"pcW s\", simp_all) \n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)     (*tempR doesnt change:*)\n  apply(cases \"pcW s\", simp_all) \n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(case_tac \" tW s = hW s \\<and> Data s (numEnqs s) \\<le> N\", simp_all) \n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(case_tac \"hW s < tW s \\<and> Data s (numEnqs s) < tW s - hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(case_tac \"tW s < hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(simp add:pre_W_def pre_A3_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(simp add:pre_W_def pre_A4_inv_def)\n  apply (metis (no_types, lifting) F.distinct(13) Suc_lessD add.commute less_diff_conv less_trans_Suc)\n  apply(case_tac \" Data s (numEnqs s) \\<le> N - hW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply metis\n  apply(case_tac \"Data s (numEnqs s) < tW s\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply metis\n  apply(simp add:pre_W_def pre_A5_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply metis\n  apply(simp add:pre_W_def pre_A6_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le nat_neq_iff)\n  apply(simp add:pre_W_def pre_A7_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas) \n  apply(intro conjI impI)\n  apply metis\n  apply (metis (no_types, lifting))\n  apply(clarify)\n  apply(intro conjI impI)\n  apply (metis F.distinct(13) Suc_lessD less_trans_Suc)\n  apply (metis (mono_tags, hide_lams) F.distinct(13) le_trans less_or_eq_imp_le linorder_neqE_nat)\n  apply(case_tac \"N < Data s (numEnqs s)\", simp_all)\n  apply(simp add:pre_W_def pre_A8_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_A8_inv_def)  defer\n  apply(cases \"numEnqs s < n\", simp_all)\n  apply(simp add:pre_W_def pre_acquire_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_acquire_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply metis\n  apply(simp add:pre_W_def pre_OOM_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(cases \"tW s \\<noteq> T s\", simp_all)\n  apply metis\n  apply metis\n  apply(simp add:pre_W_def pre_write_inv_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right eq_imp_le fst_eqD nat_add_left_cancel_less snd_eqD)\n  apply(simp add:pre_W_def pre_enqueue_inv_def)   \n  apply(simp add:tempR_lemmas tempR_basic_lemmas)\n  apply(intro conjI impI)\n  (*solved trivially by case ownership observation*)\n  apply(simp add: tempW_def)\n  apply(case_tac \"q s\\<noteq>[]\") \n  apply (metis (no_types, hide_lams) hd_append2)\n  apply(subgoal_tac \"q s=[]\") prefer 2 \n  apply force\n  apply(subgoal_tac \"tempR s \\<noteq>(0,0)\") prefer 2 \n  apply blast\n  apply(case_tac \"offset s = 0\")\n  apply (metis append_Nil fst_conv list.sel(1))\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply clarify \n  apply(subgoal_tac \"c=b\") prefer 2 \n  apply (metis le_neq_implies_less)\n  apply(subgoal_tac \"end(tempR s) = b\") prefer 2 \n  apply (metis end_simp le_add_diff_inverse)\n  apply(subgoal_tac \"offset s = hW s\") prefer 2\n  apply meson \n  apply(subgoal_tac \"i\\<ge>c \\<and> i<H s \\<longrightarrow>ownB s i = W\") prefer 2\n  apply metis\n  apply(subgoal_tac \"H s\\<le>N\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"(i<c \\<or> i\\<ge>H s \\<and> i\\<le>N) \\<longrightarrow>ownB s i\\<noteq>W\") prefer 2 \n  apply (metis F.distinct(1) F.distinct(5) bot_nat_0.not_eq_extremum diff_is_0_eq zero_less_diff)\n  apply (metis F.distinct(1) add_leD1 end_simp le_eq_less_or_eq linorder_neqE_nat nat_less_le)  \n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\") \n  apply clarify \n  apply (metis eq_imp_le le_add1 le_neq_implies_less plus_nat.add_0)\n  apply(simp add: tempW_def)\n  apply(case_tac \"q s=[]\")\n  apply (metis (no_types, lifting) F.distinct(1) Nat.add_0_right Suc_le_lessD Suc_lessD Suc_pred add_lessD1 fst_eqD le_add_diff_inverse less_Suc0 less_Suc_eq_le less_add_same_cancel1 list.size(3) nat_add_left_cancel_le nth_Cons_0 self_append_conv2)\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 \n  apply blast\n  apply(subgoal_tac \"\\<forall>i<length (q s). fst ((q s) ! i) \\<noteq> fst (tempR s)\") prefer 2\n  apply presburger\n  apply(subgoal_tac \"fst((offset s, Data s (numEnqs s))) \\<noteq> fst(tempR s)\") \n  apply (metis less_SucE nth_append nth_append_length)\n  apply(subgoal_tac \"offset s \\<noteq> fst(tempR s)\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n  apply(case_tac \"case_1 s\", simp_all) \n  apply(subgoal_tac \"\\<forall>i<length (q s).\n       (fst (tempR s) < fst ((q s ) ! i) \\<longrightarrow>\n        fst (tempR s) + Data s (numReads s - Suc 0) \\<le> fst ((q s ) ! i)) \\<and>\n       (fst ((q s) ! i) < fst (tempR s) \\<longrightarrow>\n        fst ((q s) ! i) + snd ((q s ) ! i)\n        \\<le> fst (tempR s))\")\n  prefer 2 \n  apply (metis (no_types, lifting) gr_implies_not0 length_0_conv)\n  apply(subgoal_tac \"(fst (tempR s) < fst(offset s, Data s (numEnqs s)) \\<longrightarrow>\n        fst (tempR s) + Data s (numReads s - Suc 0) \\<le> fst(offset s, Data s (numEnqs s))) \\<and>\n       (fst(offset s, Data s (numEnqs s)) < fst (tempR s) \\<longrightarrow>\n        end(offset s, Data s (numEnqs s))\n        \\<le> fst (tempR s))\")\n  apply (smt (z3) end_simp less_SucE nth_append nth_append_length)\n  apply(intro conjI impI)\n  apply (metis (no_types, lifting) Nat.add_0_right fst_eqD le_eq_less_or_eq less_add_same_cancel1 less_nat_zero_code nat_neq_iff snd_eqD tempW_def)\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply (simp add:case_1_def)\n  apply(clarify)\n  apply (metis (no_types, lifting) F.distinct(1) diff_is_0_eq le_refl less_imp_le_nat not_gr0 prod.collapse prod.inject tempW_def zero_less_diff)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\") \n  apply clarify\n  apply (metis less_or_eq_imp_le zero_less_iff_neq_zero)\n  apply(simp add: tempW_def)\n  apply(subgoal_tac \"end((offset s, Data s (numEnqs s))) \\<noteq> fst(tempR s)\") \n  apply (metis end_simp fst_conv snd_conv)\n  apply(subgoal_tac \"offset s \\<noteq> fst(tempR s)\") prefer 2 \n  apply (metis (no_types, lifting) F.distinct(1) Suc_le_lessD Suc_lessD Suc_pred add_lessD1 le_add_diff_inverse le_refl less_add_same_cancel1)\n  apply(simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add:case_1_def)\n  apply(clarify)\n  apply linarith\n  apply(simp add:case_2_def) apply (thin_tac \"\\<not>case_1 s\") \n  apply(clarify)\n  by (metis add_gr_0 nat_neq_iff)\n\n\n\n\nlemma GLOBAL_W_step_shows_preR:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"pre_W (pcW s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"pre_R (pcR s') s'\"\n  using assms apply simp\n  apply(subgoal_tac \"pcR s' = pcR s\") prefer 2\n  using pcR_doesnt_change_with_W [where s=s and s'=s']\n  apply simp\n  apply(simp add:pre_R_def) apply(case_tac \"pcR s\") apply simp_all\n  using preRelease_doesnt_change_with_W [where s=s and s'=s'] apply simp    \n  using preIdleR_doesnt_change_with_W [where s=s and s'=s'] apply simp     \n  using preRead_doesnt_change_with_W [where s=s and s'=s'] \n  by simp\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*******************************GLOBAL R_step shows preW*************************************)\n\nlemma pcW_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"pre_W (pcW s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pcW s'=pcW s\"\n using assms apply simp\n  apply(case_tac \"pcR s \", simp_all add:cR_step_def)\n  by(case_tac \"q s=[]\", simp_all)\n\n\nlemma ownB_by_W_doesnt_change_after_release:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Release_inv s \\<Longrightarrow> cR_step Release s s'\n  \\<Longrightarrow>ownB s i = W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_Release_inv_def)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\") \n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n  apply metis\n  apply simp apply(simp add:case_2_def)\n  apply (metis F.distinct(7) nat_less_le) \n  apply(case_tac \"case_1 s\") apply simp by(simp add:case_1_def)\n  \nlemma ownB_not_by_W_doesnt_change_after_release:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Release_inv s \\<Longrightarrow> cR_step Release s s'\n  \\<Longrightarrow>ownB s i \\<noteq> W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i \\<noteq> W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\nlemma ownB_by_W_doesnt_change_after_read:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Read_inv s \\<Longrightarrow> cR_step Read s s'\n  \\<Longrightarrow>ownB s i = W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\nlemma ownB_not_by_W_doesnt_change_after_read:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Read_inv s \\<Longrightarrow> cR_step Read s s'\n  \\<Longrightarrow>ownB s i \\<noteq> W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i \\<noteq> W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\nlemma ownB_by_W_doesnt_change_after_dequeue:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_dequeue_inv s \\<Longrightarrow> cR_step idleR s s'\n  \\<Longrightarrow>ownB s i = W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"q s=[]\")\n  apply presburger\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n  apply (metis (no_types, hide_lams) F.distinct(3))\n  apply simp apply(simp add:case_2_def)\n  by (metis (no_types, hide_lams) F.distinct(3))\n\n\nlemma ownB_not_by_W_doesnt_change_after_dequeue:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_dequeue_inv s \\<Longrightarrow> cR_step idleR s s'\n  \\<Longrightarrow>ownB s i \\<noteq> W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i \\<noteq> W \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"q s=[]\")\n  apply presburger\n  apply(case_tac \"case_1 s\") apply simp by(simp add:case_1_def) \n\nlemma ownB_by_W_doesnt_change_with_R:\n  \"inv s \\<Longrightarrow> con_assms s  \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \\<longrightarrow> pre_Release_inv s \\<Longrightarrow>\n     pcR s = Read \\<longrightarrow> pre_Read_inv s \\<Longrightarrow> pcR s = idleR \\<longrightarrow> pre_dequeue_inv s\n  \\<Longrightarrow>ownB s i = W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = W \\<and> i\\<le>N\"\n  apply(case_tac \"pcR s \") apply simp_all\n  using ownB_by_W_doesnt_change_after_release [where s=s and s'=s' and i=i]\n  apply auto[1] \n  using ownB_by_W_doesnt_change_after_dequeue [where s=s and s'=s' and i=i]\n  apply auto[1]\n  using ownB_by_W_doesnt_change_after_read [where s=s and s'=s' and i=i]\n  by auto[1]\n\nlemma ownB_not_by_W_doesnt_change_with_R:\n  \"inv s \\<Longrightarrow> con_assms s  \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \\<longrightarrow> pre_Release_inv s \\<Longrightarrow>\n     pcR s = Read \\<longrightarrow> pre_Read_inv s \\<Longrightarrow> pcR s = idleR \\<longrightarrow> pre_dequeue_inv s\n  \\<Longrightarrow>ownB s i \\<noteq> W \\<and> i\\<le>N \\<Longrightarrow> ownB s' i \\<noteq> W \\<and> i\\<le>N\"\n  apply(case_tac \"pcR s \") apply simp_all\n  using ownB_not_by_W_doesnt_change_after_release [where s=s and s'=s' and i=i]\n  apply auto[1] \n  using ownB_not_by_W_doesnt_change_after_dequeue [where s=s and s'=s' and i=i]\n  apply auto[1]\n  using ownB_not_by_W_doesnt_change_after_read [where s=s and s'=s' and i=i]\n  by auto[1]\n\n\nlemma ownB_by_B_doesnt_change_after_release:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Release_inv s \\<Longrightarrow> cR_step Release s s'\n  \\<Longrightarrow>ownB s i = B \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = B \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\nlemma ownB_by_B_doesnt_change_after_read:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Read_inv s \\<Longrightarrow> cR_step Read s s'\n  \\<Longrightarrow>ownB s i = B \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = B \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\nlemma ownB_by_B_doesnt_change_after_dequeue:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_dequeue_inv s \\<Longrightarrow> cR_step idleR s s'\n  \\<Longrightarrow>ownB s i = B \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = B \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"q s=[]\")\n  apply presburger\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  by force\n\nlemma ownB_by_B_doesnt_change_with_R:\n  \"inv s \\<Longrightarrow> con_assms s  \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \\<longrightarrow> pre_Release_inv s \\<Longrightarrow>\n     pcR s = Read \\<longrightarrow> pre_Read_inv s \\<Longrightarrow> pcR s = idleR \\<longrightarrow> pre_dequeue_inv s\n  \\<Longrightarrow>ownB s i = B \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = B \\<and> i\\<le>N\"\n  apply(case_tac \"pcR s \") apply simp_all\n  using ownB_by_B_doesnt_change_after_release [where s=s and s'=s' and i=i]\n  apply auto[1] \n  using ownB_by_B_doesnt_change_after_dequeue [where s=s and s'=s' and i=i]\n  apply auto[1]\n  using ownB_by_B_doesnt_change_after_read [where s=s and s'=s' and i=i]\n  by auto[1]\n\n\n\nlemma ownB_by_D_doesnt_change_after_release:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Release_inv s \\<Longrightarrow> cR_step Release s s' \\<Longrightarrow>tR s = fst(tempR s)\n  \\<Longrightarrow>ownB s i = D \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = D \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n  \n\nlemma ownB_by_D_doesnt_change_after_read:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_Read_inv s \\<Longrightarrow> cR_step Read s s'\n  \\<Longrightarrow>ownB s i = D \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = D \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  by(simp add:cR_step_def)\n\n\n\nlemma ownB_by_D_doesnt_change_after_dequeue:\n  \"inv s \\<Longrightarrow> con_assms s \\<Longrightarrow> pre_dequeue_inv s \\<Longrightarrow> cR_step idleR s s'\n  \\<Longrightarrow>ownB s i = D \\<and> i\\<le>N \\<Longrightarrow> ownB s' i = D \\<and> i\\<le>N\"\n  apply(simp add:inv_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"q s=[]\", simp_all) \n  by force\n\n\nlemma W_items_dont_change_with_R:\n  \"cR_step (pcR s) s s' \n  \\<Longrightarrow>offset s = offset s' \\<and> Data s (numEnqs s) = Data s' (numEnqs s') \\<and> numEnqs s = numEnqs s' \"\n  apply(case_tac \"pcR s \") apply simp_all apply(simp_all add:cR_step_def)\n  by(cases \"q s=[]\", simp_all) \n\nlemma W_items_dont_change_with_R_2:\n  \"cR_step (pcR s) s s' \n  \\<Longrightarrow>tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\"\n  apply(case_tac \"pcR s \") apply simp_all apply(simp_all add:cR_step_def tempW_def)\n  by(cases \"q s=[]\", simp_all) \n\nlemma W_items_dont_change_with_R_3:\n  \"cR_step (pcR s) s s' \n  \\<Longrightarrow>numWrites s=numWrites s' \\<and> H s= H s'\"\n  apply(case_tac \"pcR s \") apply simp_all apply(simp_all add:cR_step_def tempW_def)\n  by(cases \"q s=[]\", simp_all) \n\nlemma ownB_by_D_relation_with_R:\n  \"inv s \\<Longrightarrow>con_assms s  \\<Longrightarrow> pre_Read_inv s \\<Longrightarrow> pre_enqueue_inv s \\<Longrightarrow>  \noffset s \\<noteq> fst(tempR s)\"\n  apply (simp add:inv_def pre_Read_inv_def pre_enqueue_inv_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply(clarify)\n  apply(case_tac \"q s=[]\")\n  apply(subgoal_tac \"b=c\") prefer 2\n  apply (metis nat_less_le) apply(unfold tempW_lemmas tempW_basic_lemmas)\n  apply(subgoal_tac \"offset s = c\") prefer 2\n  apply (metis F.distinct(1) F.distinct(5) fst_conv le_iff_add less_or_eq_imp_le nat_less_le snd_conv)\n  apply(subgoal_tac \"offset s = b\") prefer 2 \n  apply force\n  apply(subgoal_tac \"fst(tempR s )\\<ge>T s\") prefer 2 \n  apply linarith apply(unfold tempR_lemmas tempR_basic_lemmas)\n  apply(subgoal_tac \"snd( tempR s )>0\")\n  apply metis\n  apply metis\n  apply(subgoal_tac \"b<c\") prefer 2 \n  apply (metis diff_self_eq_0 le_zero_eq length_0_conv nat_less_le)\n  apply(subgoal_tac \"offset s = c\") prefer 2\n  apply (metis F.distinct(1) F.distinct(5) fst_conv le_iff_add less_or_eq_imp_le nat_less_le snd_conv)\n  apply(subgoal_tac \"snd(tempR s)>0\") \n  apply (metis end_simp)\n  apply (metis end_simp)\n  apply simp\n  apply(simp add:case_2_def)\n  apply clarify\n  apply(case_tac \"q s=[]\")\n  apply(subgoal_tac \"d = fst(tempR s)\") prefer 2 \n  apply (metis F.distinct(1) Nat.add_0_right le0 less_nat_zero_code nat_add_left_cancel_less)\n  apply(subgoal_tac \"fst(tempW s) = b\") prefer 2 \n  apply (metis F.distinct(1) diff_is_0_eq le0 nat_neq_iff zero_less_diff)\n  apply(subgoal_tac \"snd(tempW s) > 0\") prefer 2\n  apply (metis snd_eqD tempW_def)\n  apply (metis fst_eqD le_neq_implies_less tempW_def)\n  by (metis F.distinct(1) add_gr_0 le0)\n\n\nlemma R_doesnt_change_q_read_release:\n  \"inv s \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s\\<noteq>idleR \\<Longrightarrow> q s=q s'\"\n  apply(simp add:inv_def cR_step_def)\n  by(case_tac \"pcR s\", simp_all)\n\nlemma R_changes_q_dequeue:\n  \"inv s \\<Longrightarrow> cR_step (pcR s) s s' \\<Longrightarrow> pcR s=idleR \\<Longrightarrow>q s\\<noteq>[] \\<Longrightarrow> tl(q s)=q s'\"\n  by(simp add:inv_def cR_step_def)\n\nlemma strange_but_Q_1:\n  \"q s\\<noteq>[] \\<Longrightarrow> hd(q s) = q s!0\"\n  by (simp add: hd_conv_nth)\n\nlemma strange_but_Q_2:\n  \"length(q s)>1 \\<Longrightarrow>hd(tl(q s)) = tl(q s)!0\"\n  by (metis One_nat_def hd_conv_nth length_tl less_nat_zero_code list.size(3) zero_less_diff)\n\nlemma strange_but_Q_3:\n  \"length(q s)>1 \\<Longrightarrow>tl(q s)\\<noteq>[]\"\n  by (metis Nitpick.size_list_simp(2) One_nat_def less_numeral_extra(4) not_one_less_zero)\n\nlemma strange_but_Q_4:\n  \"length(q s)>1 \\<Longrightarrow>hd(tl(q s)) = q s!1\"\n  by (simp add: nth_tl strange_but_Q_2)\n\nlemma R_doesnt_change_ownD_release_dequeue:\n  \"cR_step (pcR s) s s'\\<Longrightarrow> pcR s\\<noteq>Read \\<Longrightarrow>\n  ownD s= ownD s'\"\n  apply(simp add: cR_step_def) \n  apply(case_tac \"pcR s\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n\nlemma R_doesnt_change_ownD_read_except:\n  \"cR_step (pcR s) s s'\\<Longrightarrow> pcR s=Read \\<Longrightarrow> \n  i\\<ge>0 \\<and> i\\<noteq> data_index s (tempR s) \\<longrightarrow> ownD s i= ownD s' i\"\n  by(simp add: cR_step_def) \n\nlemma Q_empty_R_step_result:\n  \"cR_step (pcR s) s s' \\<Longrightarrow> q s=[] \\<Longrightarrow> pcR s=idleR \\<Longrightarrow>\nq s'=[]\"\n  by (simp add:cR_step_def)\n\nlemma Q_W_relation_through_R_1:\n  \"cR_step (pcR s) s s' \\<Longrightarrow> q s'\\<noteq>[] \\<Longrightarrow> q s\\<noteq>[] \\<Longrightarrow> pcR s = idleR \\<Longrightarrow>\n\\<forall>i<length (q s).\n       (offset s < fst (q s ! i) \\<longrightarrow> offset s + Data s (numEnqs s) < fst (q s ! i)) \\<and>\n       (fst (q s ! i) < offset s \\<longrightarrow> fst (q s ! i) + snd (q s ! i) \\<le> offset s)\n\\<Longrightarrow>\n\\<forall>i<length (q s').\n       (offset s' < fst (q s' ! i) \\<longrightarrow> offset s' + Data s' (numEnqs s') < fst (q s' ! i)) \\<and>\n       (fst (q s' ! i) < offset s' \\<longrightarrow> fst (q s' ! i) + snd (q s' ! i) \\<le> offset s')\"\n  apply(simp add:cR_step_def)\n  by (simp add: length_greater_0_conv nth_tl)\n\nlemma Q_W_relation_through_R_2:\n  \"cR_step (pcR s) s s'  \\<Longrightarrow> pcR s = Read \\<Longrightarrow>\n\\<forall>i<length (q s).\n       (offset s < fst (q s ! i) \\<longrightarrow> offset s + Data s (numEnqs s) < fst (q s ! i)) \\<and>\n       (fst (q s ! i) < offset s \\<longrightarrow> fst (q s ! i) + snd (q s ! i) \\<le> offset s)\n\\<Longrightarrow>\n\\<forall>i<length (q s').\n       (offset s' < fst (q s' ! i) \\<longrightarrow> offset s' + Data s' (numEnqs s') < fst (q s' ! i)) \\<and>\n       (fst (q s' ! i) < offset s' \\<longrightarrow> fst (q s' ! i) + snd (q s' ! i) \\<le> offset s')\"\n  by(simp add:cR_step_def)\n\n\nlemma Q_W_relation_through_R_3:\n  \"cR_step (pcR s) s s' \\<Longrightarrow> pcR s = Release \\<Longrightarrow>\n\\<forall>i<length (q s).\n       (offset s < fst (q s ! i) \\<longrightarrow> offset s + Data s (numEnqs s) < fst (q s ! i)) \\<and>\n       (fst (q s ! i) < offset s \\<longrightarrow> fst (q s ! i) + snd (q s ! i) \\<le> offset s)\n\\<Longrightarrow>\n\\<forall>i<length (q s').\n       (offset s' < fst (q s' ! i) \\<longrightarrow> offset s' + Data s' (numEnqs s') < fst (q s' ! i)) \\<and>\n       (fst (q s' ! i) < offset s' \\<longrightarrow> fst (q s' ! i) + snd (q s' ! i) \\<le> offset s')\"\n  by(simp add:cR_step_def) \n\n\n\n\nlemma pre_write_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_write_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_write_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_write_inv_def)\n  apply(subgoal_tac \"end(tempW s )\\<le>N\") prefer 2 apply(simp_all add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:pre_R_def)\n  apply(intro conjI impI)\n  apply(case_tac[!] \"pcR s\")\n  apply simp_all apply(subgoal_tac \"\\<forall>i. offset s \\<le> i \\<and> i < fst (tempW s) + snd (tempW s) \\<longrightarrow> ownB s i = W\") prefer 2 \n  apply (metis fst_eqD snd_eqD tempW_def)\n  apply(subgoal_tac \"hW s = hW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s = tW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  using ownB_by_W_doesnt_change_after_release [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (smt (z3) PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (smt (z3) PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (smt (z3) PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply clarify   \n  apply(intro conjI impI)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(1) assms(2) less_or_eq_imp_le)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (smt (z3) PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) le_add_same_cancel1 le_trans less_or_eq_imp_le not_gr_zero)\n  apply clarify\n  apply(intro conjI impI)        \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_dequeue prod.inject tempW_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify\n  apply(intro conjI impI)        \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_read prod.inject tempW_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify       \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (smt (z3) PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply clarify       \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (smt (z3) PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply clarify\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (smt (z3) PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply(case_tac \"tR s = fst(tempR s)\")\n  using ownB_by_D_doesnt_change_after_release [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) nat_less_le)\n  apply (simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add: case_1_def) \n  apply (metis (no_types, hide_lams) F.distinct(25) F.distinct(7) \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> le0 le_refl nat_less_le nat_neq_iff prod.inject tempW_def)\n  apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:pre_Release_inv_def)\n  apply(subgoal_tac \"T s\\<noteq>fst(tempR s)\") prefer 2 \n  apply blast\n  apply(simp add:case_2_def)\n  apply clarify\n  apply(subgoal_tac \"fst(tempR s) = T s \\<or> fst(tempR s) = 0\") prefer 2 \n  apply meson\n  apply(subgoal_tac \"fst(tempR s) = 0\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s (fst(tempR s)) = R\") prefer 2\n  apply metis\n  apply(subgoal_tac \"ownB s (offset s) = W\") prefer 2 \n  apply (metis Nat.add_0_right le_refl nat_add_left_cancel_less)\n  apply (metis F.distinct(1) W_items_dont_change_with_R)\n  using ownB_by_D_doesnt_change_after_dequeue [where s=s and s'=s'] \n  using W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) less_or_eq_imp_le \n  apply presburger\n  using ownB_by_D_doesnt_change_after_read [where s=s and s'=s'] \n  using W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) less_or_eq_imp_le \n  apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply (simp add: pre_Release_inv_def) \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply (simp add: pre_dequeue_inv_def inv_def Q_lemmas Q_basic_lemmas cR_step_def) \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(simp add: pre_Read_inv_def) \n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply (metis last_tl)\n  apply (metis last_tl)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis assms(5))\n  apply(subgoal_tac \"(\\<forall>i<length (q s). fst (q s ! i) \\<noteq> offset s)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(\\<forall>i<length (tl(q s)). fst (tl(q s) ! i) \\<noteq> offset s)\") prefer 2\n  apply (metis Suc_diff_Suc diff_Suc_eq_diff_pred diff_add_0 length_tl linordered_semidom_class.add_diff_inverse nat.discI nth_tl)\n  apply(subgoal_tac \"length(q s) - Suc 0 = length(tl(q s))\") prefer 2 \n  apply (metis One_nat_def length_tl)\n  apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis assms(5))\n  apply(subgoal_tac \"(\\<forall>i<length (q s). fst (q s ! i) \\<noteq> offset s)\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"(\\<forall>i<length (tl(q s)). fst (tl(q s) ! i) \\<noteq> offset s)\") prefer 2                  \n  apply (metis Suc_diff_Suc diff_Suc_eq_diff_pred diff_add_0 length_tl linordered_semidom_class.add_diff_inverse nat.discI nth_tl)\n  apply (metis One_nat_def length_tl)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis assms(5))\n  apply(subgoal_tac \"(\\<forall>i<length (q s). fst (q s ! i) \\<noteq> offset s)\") prefer 2 \n  apply (metis length_0_conv less_nat_zero_code)\n  apply(subgoal_tac \"offset s' = offset s\") prefer 2\n  apply (metis fst_conv tempW_def)\n  apply(subgoal_tac \"q s= q s'\") \n  apply metis\n  using R_doesnt_change_q_read_release [where s=s and s'=s']\n  apply (metis PCR.distinct(5) assms(5))                \n  using Q_W_relation_through_R_3 [where s=s and s'=s'] \n  apply (simp add: \\<open>\\<lbrakk>RingBuffer_BD_latest_2.inv s; cR_step (pcR s) s s'; pcR s \\<noteq> idleR\\<rbrakk> \\<Longrightarrow> q s = q s'\\<close>)\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 \n  apply (metis Q_empty_R_step_result)\n  using Q_W_relation_through_R_1 [where s=s and s'=s']\n  apply presburger       \n  using Q_W_relation_through_R_2 [where s=s and s'=s']\n  apply (simp add: \\<open>\\<lbrakk>RingBuffer_BD_latest_2.inv s; cR_step (pcR s) s s'; pcR s \\<noteq> idleR\\<rbrakk> \\<Longrightarrow> q s = q s'\\<close>)\n  apply(subgoal_tac \"q s=q s'\") prefer 2 \n  using R_doesnt_change_q_read_release [where s=s and s'=s']\n  using PCR.distinct(1) apply presburger\n  apply(subgoal_tac \"offset s + Data s (numEnqs s) \\<noteq> fst (hd (q s))\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"tempW s=tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis)\n  apply (metis W_items_dont_change_with_R)\n  apply(subgoal_tac \"offset s + Data s (numEnqs s) \\<noteq> fst (hd (q s))\") prefer 2   \n  using cR_step_def apply force\n  apply(subgoal_tac \"i<length(q s)\\<longrightarrow>offset s + Data s (numEnqs s) \\<noteq> fst(q s ! i)\") prefer 2 \n  apply (metis diff_add_zero length_0_conv less_irrefl_nat less_nat_zero_code linordered_semidom_class.add_diff_inverse)\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2 \n  using PCR.simps(8) cR_step_def apply force\n  apply(subgoal_tac \"fst(hd(q s')) = fst(hd(tl(q s)))\") prefer 2 \n  using R_changes_q_dequeue apply presburger\n  apply(subgoal_tac \"tempW s=tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"offset s' = offset s\") prefer 2\n  apply (metis fst_conv tempW_def)\n  apply(subgoal_tac \"fst(hd(tl(q s))) = fst(q s!1)\") prefer 2\n  using strange_but_Q_4 [where s=s] fst_def \n  apply (metis R_changes_q_dequeue length_greater_0_conv length_tl zero_less_diff)\n  apply (metis R_changes_q_dequeue cancel_comm_monoid_add_class.diff_cancel le_iff_add length_0_conv length_tl less_one linorder_neqE_nat nat_less_le snd_conv tempW_def)\n  apply(subgoal_tac \"q s=q s'\") prefer 2 \n  using R_doesnt_change_q_read_release [where s=s and s'=s']\n  using PCR.distinct(5) apply presburger\n  apply(subgoal_tac \"offset s + Data s (numEnqs s) \\<noteq> fst (hd (q s))\") prefer 2 \n  apply metis\n  apply(subgoal_tac \"tempW s=tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis)\n  apply (metis W_items_dont_change_with_R)\n  apply clarify\n  using W_items_dont_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s' and i=j]\n  apply (metis \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_2.inv s; con_assms s; pre_Release_inv s; cR_step Release s s'; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> assms(1) assms(2) le_trans less_imp_le_nat)\n  apply clarify\n  using W_items_dont_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s' and i=j]\n  apply (metis PCR.distinct(1) PCR.distinct(5) \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_2.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\<longrightarrow> pre_Release_inv s; pcR s = Read \\<longrightarrow> pre_Read_inv s; pcR s = idleR \\<longrightarrow> pre_dequeue_inv s; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> assms(2) le_trans less_imp_le_nat)\n  using W_items_dont_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s' and i=j]\n  apply (metis PCR.distinct(3) PCR.distinct(5) \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_2.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\<longrightarrow> pre_Release_inv s; pcR s = Read \\<longrightarrow> pre_Read_inv s; pcR s = idleR \\<longrightarrow> pre_dequeue_inv s; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> assms(2) le_trans less_imp_le_nat)\n  apply(subgoal_tac \"numWrites s= numWrites s'\") prefer 2\n  apply (metis W_items_dont_change_with_R_3 assms(5))\n  using R_doesnt_change_ownD_release_dequeue [where s=s and s'=s']\n  apply (metis PCR.distinct(3))\n  apply(subgoal_tac \"numWrites s= numWrites s'\") prefer 2\n  apply (metis W_items_dont_change_with_R_3 assms(5))\n  using R_doesnt_change_ownD_release_dequeue [where s=s and s'=s']\n  apply (metis PCR.distinct(5))\n  apply(subgoal_tac \"numWrites s= numWrites s'\") prefer 2\n  apply (metis W_items_dont_change_with_R_3 assms(5))\n  apply(subgoal_tac \"numWrites s \\<noteq> data_index s (tempR s) \") prefer 2 \n  apply(simp add:pre_Read_inv_def)\n  using R_doesnt_change_ownD_read_except [where s=s and s'=s']\n  apply (metis less_eq_nat.simps(1))\n  apply(subgoal_tac \"q s=q s'\") prefer 2\n  using R_doesnt_change_q_read_release [where s=s and s'=s']\n  using PCR.distinct(1) apply presburger\n  apply (metis W_items_dont_change_with_R)\n  apply(simp add:inv_def pre_dequeue_inv_def)\n  apply(subgoal_tac \"numEnqs s= 0\") prefer 2\n  using W_items_dont_change_with_R apply presburger\n  apply(subgoal_tac \"numDeqs s = 0\") prefer 2\n  apply (metis less_nat_zero_code nat_less_le)\n  apply(subgoal_tac \"q s=[]\") prefer 2\n  apply meson\n  apply(simp add:cR_step_def) \n  apply(subgoal_tac \"q s=q s'\") prefer 2\n  using R_doesnt_change_q_read_release [where s=s and s'=s']\n  using PCR.distinct(5) apply presburger\n  apply (metis W_items_dont_change_with_R)\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply metis\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply metis\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply metis\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using W_items_dont_change_with_R_3 [where s=s and s'=s']\n  apply (metis)\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using W_items_dont_change_with_R_3 [where s=s and s'=s']\n  apply (metis)\n  using W_items_dont_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using W_items_dont_change_with_R_3 [where s=s and s'=s']\n  by (metis)\n\n\n\nlemma pre_enqueue_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_enqueue_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_enqueue_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_enqueue_inv_def)\n  apply(subgoal_tac \"end(tempW s )\\<le>N\") prefer 2 apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:pre_R_def)\n  apply(intro conjI impI)\n  apply(case_tac[!] \"pcR s\")\n  apply simp_all apply(subgoal_tac \"\\<forall>i. offset s \\<le> i \\<and> i < fst (tempW s) + snd (tempW s) \\<longrightarrow> ownB s i = W\") prefer 2\n  apply metis   apply(subgoal_tac \"\\<forall>i. offset s > i \\<or> i \\<ge> fst (tempW s) + snd (tempW s) \\<and> i\\<le>N \\<longrightarrow> ownB s i \\<noteq> W\") prefer 2\n  apply metis\n  apply(subgoal_tac \"hW s = hW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s = tW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  using ownB_by_W_doesnt_change_after_release [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(3) W_items_dont_change_with_R assms(2) end_simp le_trans less_or_eq_imp_le)\n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  using ownB_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) le_trans less_or_eq_imp_le)\n  apply clarify\n  apply (intro conjI impI)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply clarify\n  apply (intro conjI impI)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv le_imp_less_Suc nat_le_linear not_less_eq order_trans tempW_def)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv le_imp_less_Suc nat_le_linear not_less_eq order_trans tempW_def)\n  apply clarify\n  apply (intro conjI impI) \n  apply(subgoal_tac \"i<offset s \\<longrightarrow>ownB s i\\<noteq>W\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"offset s = offset s'\") prefer 2 \n  using PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R assms(2) apply presburger\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  using ownB_not_by_W_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(3) assms(2) le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(1) PCR.distinct(5) assms(2) le_trans less_or_eq_imp_le)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply (metis RingBuffer_BD_latest_2.inv_def basic_pointer_movement_def inRange_def inRangeht_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s'] \n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(3) PCR.distinct(5) assms(2) le_trans less_or_eq_imp_le)\n  apply clarify\n  apply(intro conjI impI)        \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def)\n  apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_release prod.inject tempW_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify\n  apply(intro conjI impI)        \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_dequeue prod.inject tempW_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify\n  apply(intro conjI impI)        \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  apply (metis assms(1) assms(2) less_or_eq_imp_le ownB_by_B_doesnt_change_after_read prod.inject tempW_def)\n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify       \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(3) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify       \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis PCR.distinct(1) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply clarify\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(subgoal_tac \"tW s \\<le>N\") prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(simp add:inv_def) \n  using ownB_by_B_doesnt_change_with_R [where s=s and s'=s']\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis PCR.distinct(3) PCR.distinct(5) add_leD1 assms(2) fst_conv less_le_not_le order_trans tempW_def)\n  apply(case_tac \"tR s = fst(tempR s)\")\n  using ownB_by_D_doesnt_change_after_release [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) nat_less_le)\n  apply (simp add:inv_def)\n  apply(case_tac \"case_1 s\", simp_all)\n  apply(simp add: case_1_def)\n  apply (metis F.distinct(15) F.distinct(21) F.distinct(25) F.distinct(7) W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> less_eq_Suc_le not_less_eq_eq)\n  apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:pre_Release_inv_def)\n  apply(subgoal_tac \"T s\\<noteq>fst(tempR s)\") prefer 2 \n  apply blast\n  apply(simp add:case_2_def)\n  apply clarify\n  apply(subgoal_tac \"fst(tempR s) = T s \\<or> fst(tempR s) = 0\") prefer 2 \n  apply meson\n  apply(subgoal_tac \"fst(tempR s) = 0\") prefer 2 \n  apply presburger\n  apply(subgoal_tac \"ownB s (fst(tempR s)) = R\") prefer 2\n  apply metis\n  apply(subgoal_tac \"ownB s (offset s) = W\") prefer 2 \n  apply (metis \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> fst_eqD nat_le_iff_add plus_nat.add_0 snd_eqD tempW_def)\n  apply (metis F.distinct(1) W_items_dont_change_with_R)\n  using ownB_by_D_doesnt_change_after_dequeue [where s=s and s'=s'] \n  using W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) less_or_eq_imp_le \n  apply presburger\n  using ownB_by_D_doesnt_change_after_read [where s=s and s'=s'] \n  using W_items_dont_change_with_R \\<open>cR_step (pcR s) s s' \\<Longrightarrow> tempW s = tempW s' \\<and> tW s = tW s' \\<and> hW s = hW s' \\<and> data_index s = data_index s'\\<close> assms(2) less_or_eq_imp_le \n  apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply (simp add: pre_Release_inv_def) \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply (simp add: pre_dequeue_inv_def inv_def Q_lemmas Q_basic_lemmas cR_step_def) \n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(simp add: pre_Read_inv_def) \n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(intro conjI impI)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger \n  apply (metis fst_conv snd_conv tempW_def)\n  apply (metis PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n  apply (metis PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n  apply (metis (no_types, lifting) PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R assms(1) assms(5))\n  apply (metis PCR.distinct(1) R_doesnt_change_q_read_release W_items_dont_change_with_R) \n  apply (metis W_items_dont_change_with_R \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_2.inv s; con_assms s; pre_Release_inv s; cR_step Release s s'; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> assms(2) le_trans less_imp_le_nat)\n  prefer 2\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)\n  apply(intro conjI impI)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger \n  apply (metis fst_conv snd_conv tempW_def) \n  apply (metis PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n  apply (metis PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n  apply (metis (no_types, lifting) PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R assms(1) assms(5))\n  apply (metis PCR.distinct(5) R_doesnt_change_q_read_release W_items_dont_change_with_R)\n  apply (metis PCR.distinct(3) PCR.distinct(5) W_items_dont_change_with_R \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_2.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\<longrightarrow> pre_Release_inv s; pcR s = Read \\<longrightarrow> pre_Read_inv s; pcR s = idleR \\<longrightarrow> pre_dequeue_inv s; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_2.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\<longrightarrow> pre_Release_inv s; pcR s = Read \\<longrightarrow> pre_Read_inv s; pcR s = idleR \\<longrightarrow> pre_dequeue_inv s; ownB s i \\<noteq> W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i \\<noteq> W \\<and> i \\<le> N\\<close> assms(2) le_trans less_imp_le_nat)\n  apply(simp add:tempW_lemmas tempW_basic_lemmas)   \n  apply(intro conjI impI) apply(simp add:pre_dequeue_inv_def)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger               \n  apply (metis fst_conv snd_conv tempW_def) \n  apply(case_tac \"length(q s)>1\", simp_all)\n  apply(subgoal_tac \"last(q s) = last(tl(q s))\") prefer 2 \n  apply (metis R_changes_q_dequeue last_tl)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger    \n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2\n  apply (metis length_0_conv less_nat_zero_code)\n  apply (simp add: R_changes_q_dequeue W_items_dont_change_with_R)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger    \n  apply(subgoal_tac \"length(q s) = 1 \\<longrightarrow> tl(q s) = []\") prefer 2 \n  apply (metis cancel_comm_monoid_add_class.diff_cancel length_greater_0_conv length_tl not_gr0)\n  apply(case_tac \"q s=[]\") prefer 2 \n  apply (metis One_nat_def R_changes_q_dequeue Suc_lessI length_greater_0_conv)\n  apply(simp add:pre_dequeue_inv_def)\n  apply(subgoal_tac \"q s= []\") prefer 2\n  apply blast\n  apply(subgoal_tac \"q s'=[]\") prefer 2\n  using Q_empty_R_step_result [where s=s and s'=s'] \n  apply presburger\n  apply linarith\n  apply(subgoal_tac \"q s\\<noteq>[]\") prefer 2\n  using \\<open>\\<lbrakk>cR_step (pcR s) s s'; q s = []; pcR s = idleR\\<rbrakk> \\<Longrightarrow> q s' = []\\<close> apply presburger\n  apply(subgoal_tac \"q s'= tl(q s)\") prefer 2\n  using R_changes_q_dequeue apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger  \n  apply (metis in_set_conv_nth list.set_sel(2) prod.inject tempW_def)\n  using Q_W_relation_through_R_1 [where s=s and s'=s']\n  using \\<open>\\<lbrakk>cR_step (pcR s) s s'; q s = []; pcR s = idleR\\<rbrakk> \\<Longrightarrow> q s' = []\\<close> apply presburger\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger  \n  apply(subgoal_tac \"q s'= tl(q s)\") prefer 2\n  using R_changes_q_dequeue \n  using \\<open>\\<lbrakk>cR_step (pcR s) s s'; q s = []; pcR s = idleR\\<rbrakk> \\<Longrightarrow> q s' = []\\<close> apply presburger\n  apply(subgoal_tac \"offset s = offset s' \\<and>  numEnqs s = numEnqs s'\") prefer 2\n  using W_items_dont_change_with_R [where s=s and s'=s']\n  apply presburger\n  apply (metis Nat.add_0_right \\<open>\\<lbrakk>cR_step (pcR s) s s'; q s = []; pcR s = idleR\\<rbrakk> \\<Longrightarrow> q s' = []\\<close> \\<open>cR_step (pcR s) s s' \\<Longrightarrow> offset s = offset s' \\<and> Data s (numEnqs s) = Data s' (numEnqs s') \\<and> numEnqs s = numEnqs s'\\<close> hd_in_set in_set_conv_nth less_not_refl list.set_sel(2) nat_add_left_cancel_less)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply presburger  \n  apply(subgoal_tac \"offset s = offset s'\") prefer 2\n  using \\<open>cR_step (pcR s) s s' \\<Longrightarrow> offset s = offset s' \\<and> Data s (numEnqs s) = Data s' (numEnqs s') \\<and> numEnqs s = numEnqs s'\\<close> apply presburger\n  apply(subgoal_tac \"Data s' (numEnqs s') = Data s (numEnqs s)\") prefer 2 \n  apply (metis \\<open>cR_step (pcR s) s s' \\<Longrightarrow> offset s = offset s' \\<and> Data s (numEnqs s) = Data s' (numEnqs s') \\<and> numEnqs s = numEnqs s'\\<close>)\n  apply(subgoal_tac \"\\<forall>j. offset s \\<le> j \\<and> j < offset s + Data s (numEnqs s) \\<longrightarrow> ownB s j = W\") prefer 2 \n  apply presburger\n  apply(clarify)  \n  using ownB_by_W_doesnt_change_after_dequeue [where s=s and s'=s' and i=j]\n  apply (metis PCR.distinct(1) PCR.distinct(5) \\<open>\\<And>i. \\<lbrakk>RingBuffer_BD_latest_2.inv s; con_assms s; cR_step (pcR s) s s'; pcR s = Release \\<longrightarrow> pre_Release_inv s; pcR s = Read \\<longrightarrow> pre_Read_inv s; pcR s = idleR \\<longrightarrow> pre_dequeue_inv s; ownB s i = W \\<and> i \\<le> N\\<rbrakk> \\<Longrightarrow> ownB s' i = W \\<and> i \\<le> N\\<close> assms(2) le_trans less_or_eq_imp_le)\n  apply(simp add:tempW_reflects_writes_def)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  apply(simp add: pre_Read_inv_def)\n  apply(subgoal_tac \"data_index s (offset s, Data s (numEnqs s)) = numEnqs s\") prefer 2\n  apply meson\n  apply(subgoal_tac \"data_index s = data_index s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(3) assms(2) apply presburger\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R)\n  apply(simp add:tempW_reflects_writes_def)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  apply(simp add: pre_Read_inv_def)\n  apply(subgoal_tac \"data_index s (offset s, Data s (numEnqs s)) = numEnqs s\") prefer 2\n  apply meson\n  apply(subgoal_tac \"data_index s = data_index s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(1) PCR.distinct(5) assms(2) apply presburger\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R)\n  apply(simp add:tempW_reflects_writes_def)\n  apply(subgoal_tac \"hW s = hW s' \\<and> tW s = tW s' \\<and> tempW s = tempW s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  using PCR.distinct(3) PCR.distinct(5) assms(2) apply presburger\n  apply(simp add: pre_Read_inv_def)\n  apply(subgoal_tac \"data_index s (offset s, Data s (numEnqs s)) = numEnqs s\") prefer 2\n  apply meson\n  apply(subgoal_tac \"data_index s = data_index s'\") prefer 2\n  using W_items_dont_change_with_R_2 [where s=s and s'=s']\n  apply (metis)\n  using W_items_dont_change_with_R_2 [where s=s and s'=s'] \n  apply (metis W_items_dont_change_with_R)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:pre_Read_inv_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \" tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \" ownT s = R\", simp_all)\n  apply(case_tac \" ownT s = R\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \" ownT s = Q\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(simp add:cR_step_def)\n\n\n\n\n\n\n\n\nlemma pre_A1_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A1_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A1_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A1_inv_def) \n  apply(intro conjI impI)\n  apply(simp add:cR_step_def)\n  apply(cases \"pcR s\", simp_all) \n  apply(cases \" tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def) \n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) apply metis\n  apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) diff_is_0_eq le0 nat_neq_iff zero_less_diff)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n  apply (metis Nat.add_diff_assoc diff_diff_left diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis not_add_less1)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \" ownT s = Q \", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def)\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply(simp add:cR_step_def)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n  apply(simp add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) apply metis\n  apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis diff_self_eq_0 le_antisym le_neq_implies_less length_greater_0_conv less_imp_Suc_add nat.distinct(1) plus_nat.add_0)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n  apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n  apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis not_add_less1)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \" ownT s = Q \", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) apply metis\n  apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_refl)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) le_add_diff_inverse le_trans less_or_eq_imp_le linorder_neqE_nat nat_less_le)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \" ownT s = Q \", simp_all)\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def)\n  apply (metis le_antisym nat_less_le)\n  apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n  apply (metis F.distinct(13) F.distinct(17) le_eq_less_or_eq)\n  apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\") apply simp apply(simp add:case_1_def) \n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp) apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) le_add_diff_inverse le_trans less_or_eq_imp_le linorder_neqE_nat nat_less_le)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply (metis le_eq_less_or_eq nat_le_linear)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \" ownT s = Q \", simp_all)\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(simp add:pre_R_def pre_dequeue_inv_def inv_def)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(cases \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(simp add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  by(case_tac \"q s = []\", simp_all)\n\n\n\nlemma pre_A2_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A2_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A2_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A2_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all) \n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all) \n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"ownT s = R\", simp_all) \n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all) \n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def) \n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all) \n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all) \n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def) \n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply metis\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"q s = []\", simp_all)\n  apply metis\n  apply metis\n  apply metis\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply(case_tac \"q s = []\", simp_all)\n  apply blast\n  by(simp_all add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n\n\n\n\n\nlemma pre_A3_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A3_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A3_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A3_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  by(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n\n\n\n\nlemma pre_A4_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A4_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A4_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A4_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply metis+\n  apply(case_tac \"q s=[]\", simp_all)\n  by metis+\n  \n\n\n\nlemma pre_A5_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A5_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A5_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A5_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis le_add_diff_inverse le_trans)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n  \n\n\n\nlemma pre_A6_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A6_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A6_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A6_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis le_add_diff_inverse le_trans)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n\n\n\n\n\n\nlemma pre_A7_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A7_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A7_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A7_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis F.distinct(13) eq_imp_le less_imp_le_nat linorder_neqE_nat trans_le_add1)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(simp add:tempR_lemmas tempR_basic_lemmas Q_lemmas Q_basic_lemmas)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis le_add_diff_inverse le_trans)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n\n\n\n\n\nlemma pre_A8_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_A8_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_A8_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_A8_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis (no_types, hide_lams) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all) \n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply metis\n  apply metis\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply metis\n  apply metis\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left le_trans)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis Suc_leI not_less_eq_eq trans_le_add1)\n  apply(case_tac \"q s=[]\", simp_all) \n  apply metis+\n  apply(case_tac \"q s=[]\", simp_all)\n  by metis+\n\n\n\n\n\nlemma pre_acquire_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_acquire_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_acquire_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_acquire_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply metis\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis eq_imp_le less_imp_le_nat linorder_neqE_nat plus_nat.add_0)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis eq_imp_le less_imp_le_nat linorder_neqE_nat plus_nat.add_0)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis diff_is_0_eq' linorder_neqE_nat nat_le_linear zero_less_diff)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis add_cancel_right_left diff_add_inverse2 le_0_eq le_antisym length_0_conv nat_less_le)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis not_add_less1)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\") \n  apply (metis add_cancel_left_left diff_is_0_eq' le_neq_implies_less length_greater_0_conv zero_less_diff)\n  apply(case_tac \"ownT s =R\", simp_all) \n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def) \n  apply (metis le_add_diff_inverse le_imp_less_Suc length_greater_0_conv nat_less_le not_less_eq zero_less_diff)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis not_add_less1)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis bot_nat_0.extremum_uniqueI diff_self_eq_0 le_add_diff_inverse le_antisym length_0_conv)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis less_or_eq_imp_le plus_nat.add_0)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis le_add_diff_inverse le_trans less_nat_zero_code less_or_eq_imp_le nat_less_le nat_neq_iff)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis (mono_tags, hide_lams) F.distinct(19))\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply (metis le_add_diff_inverse le_eq_less_or_eq)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply (metis plus_nat.add_0)\n  apply (metis le_add_diff_inverse le_trans less_nat_zero_code less_or_eq_imp_le nat_less_le nat_neq_iff)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp add:pre_dequeue_inv_def)\n  apply (metis (mono_tags, hide_lams) F.distinct(19))\n  apply(simp add:pre_dequeue_inv_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n\n\n\nlemma pre_OOM_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_OOM_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_OOM_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_OOM_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all) \n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"case_1 s\", simp_all) apply(simp add:case_1_def)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp add:case_2_def) apply(thin_tac \"\\<not>case_1 s\")\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all) \n  apply (metis (no_types, lifting) F.distinct(19))\n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"T s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all) \n  apply(case_tac \"q s=[]\", simp_all) \n  apply blast\n  by(simp_all add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n  \n\n\n\n\nlemma pre_finished_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_finished_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_finished_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_finished_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  by(case_tac \"q s=[]\", simp_all)\n\n\n\n\n\n\nlemma pre_BTS_doesnt_change_with_R:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_BTS_inv s\"\n  and \"pre_R (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_BTS_inv s'\"\n  using assms apply simp\n  apply(simp add:pre_BTS_inv_def) \n  apply(intro conjI impI)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s =R\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"ownT s = Q\", simp_all)\n  apply(simp_all add:pre_R_def pre_dequeue_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply(case_tac \"tR s \\<noteq> fst (tempR s)\", simp_all)\n  apply(case_tac \"ownT s = R\", simp_all)\n  apply(simp_all add:pre_R_def pre_Release_inv_def inv_def cR_step_def)\n  apply(case_tac \"q s=[]\", simp_all)\n  apply blast\n  by(simp_all add:pre_R_def pre_Read_inv_def inv_def cR_step_def)\n \n\n\n\n(*******************************GLOBAL R_step preserves preW*************************************)\n\n\n\nlemma GLOBAL_R_step_shows_preW:\n  assumes \"inv s\"\n  and \"con_assms s\"\n  and \"pre_R (pcR s) s\"\n  and \"pre_W (pcW s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"pre_W (pcW s') s'\"\n  using assms apply simp\n  apply(subgoal_tac \"pcW s' = pcW s\") prefer 2\n  using pcW_doesnt_change_with_R [where s=s and s'=s']\n  apply simp\n  apply(simp add:pre_W_def) apply(case_tac \"pcW s\") apply simp_all\n  using pre_A1_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A2_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A3_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A4_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A5_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A6_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A7_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_A8_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_enqueue_doesnt_change_with_R [where s=s and s'=s'] apply simp \n  using pre_acquire_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_OOM_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_finished_doesnt_change_with_R [where s=s and s'=s'] apply simp\n  using pre_write_doesnt_change_with_R [where s=s and s'=s'] apply simp  \n  using pre_BTS_doesnt_change_with_R [where s=s and s'=s'] by simp\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n(*(*\n\n(*------------------------showing progress----------------------*)\n(*\nlemma tries_are_bounded:\n  assumes \"con_assms s\"\n  and \"cW_step pcw s s'\"\n  and \"inv pcw pcr s\"\nshows \"tries s'\\<le>N\"\n  using assms\n  apply (simp_all add:cW_step_def)\n  using less_le_trans apply auto[1]\n  apply (case_tac \"pcw\", simp_all)\n  using less_imp_le_nat apply blast\n  using less_imp_le_nat apply blast\n  using less_imp_le_nat apply blast\n  using less_imp_le_nat apply blast\n  using less_imp_le_nat apply blast\n  using less_imp_le_nat apply blast\n  using less_imp_le_nat apply blast\n  using less_imp_le_nat apply blast\n  apply(case_tac \"numEnqs s < n\", simp_all add:less_imp_le)\n  apply(case_tac \"tW s \\<noteq> T s\", simp_all)\n  using Suc_leI apply blast\n  by (meson less_imp_le_nat)\n\n\nlemma when_W_moves_prog_less:\n  assumes \"con_assms s\"\n  and \"inv (pcW s) (pcR s) s\"\n  and \"cW_step (pcW s) s s'\"\nshows \"lex_prog s s'\"\nproof - \n  from assms(1) have sp1: \"numEnqs s \\<le> n \\<and> numDeqs s \\<le> n\"\n    using con_assms_def by auto\n  from assms show ?thesis\n  apply (simp_all add:cW_step_def inv_def  progress_lemmas tries_left_def)\n  apply(case_tac \"pcW s\", simp_all)\n  apply(case_tac[!] \"pcR s\", simp_all)\n  apply (simp_all add: diff_less_mono2)\n  apply (case_tac[!] \"tW s = T s\", simp_all add:cW_step_def)\n  apply(case_tac[1-6] \"numEnqs s < n\", simp_all)\n  using diff_less_mono2 by auto\nqed\n\nlemma W_counter_implies_notown:\n  assumes \"con_assms s\"\n  and \"mainInv s\"\nshows \"\\<forall>i.(i<numEnqs s)\\<longrightarrow>ownD s i \\<in> {R,B}\"\n  using assms\n  apply (simp_all add:inv_def)\n  by (meson le_less_linear)\n\n\nlemma least_prog_W_implies:\n  assumes \"con_assms s\"\n  and \"inv (pcW s) pcr s\"\n  and \"cW_step (pcW s) s s'\"\n  and \"inv (pcW s') pcr s'\"\n  and \"lex_prog s s'\"\nshows \"end_W_prog s'=True\\<longrightarrow>end_W_prog s \\<or> ((\\<forall>i.(i<n)\\<longrightarrow>ownD s' i\\<noteq>W) \\<and> (pcW s=idleW) \\<and> numEnqs s=n)\"\n  using assms W_counter_implies_notown\n  apply (simp_all add: end_W_prog_def progress_lemmas tries_left_def cW_step_def inv_def)\n  apply (case_tac \"pcW s\", simp_all)\n  apply(case_tac \"numEnqs s < n\", simp_all)\n  apply(case_tac \"pcr\", simp_all)\n  apply (metis F.distinct(1) F.distinct(5) le_less_linear)\n  apply (metis F.distinct(1) F.distinct(5) le_less_linear)\n  apply (metis F.distinct(1) F.distinct(5) le_less_linear)\n  by(case_tac \"tW s \\<noteq> T s\", simp_all)\n\n\nlemma when_R_moves_prog_less:\n  assumes \"con_assms s\"\n  and \"inv (pcW s) (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\nshows \"lex_prog s s'\"\n  using assms apply (simp_all add:inv_def cR_step_def progress_lemmas)\n  apply(case_tac \"pcR s\", simp_all add:tries_left_def)\n  apply(case_tac[!] \"pcW s\", simp_all)\n                      apply(case_tac[!] \"q s=[]\", simp_all add: Let_def)\n                      apply clarify\noops\n  apply(case_tac \" T s < fst (hd (q s)) + snd (hd (q s))\", simp_all)\n  apply(case_tac \" T s < fst (hd (q s)) + snd (hd (q s))\", simp_all)\n  apply (metis (no_types, lifting) add_less_mono diff_less_mono2 diff_self_eq_0 length_greater_0_conv lessI less_le_trans mult_2 nat_add_left_cancel_less nat_less_le)\n  apply (metis (no_types, lifting) add_less_mono diff_less_mono2 diff_self_eq_0 length_greater_0_conv lessI less_le_trans mult_2 nat_add_left_cancel_less nat_less_le)\n  apply(case_tac \" T s < fst (hd (q s)) + snd (hd (q s))\", simp_all)\n  apply (metis diff_less_mono2 length_greater_0_conv lessI zero_less_diff)\n  apply (metis diff_less_mono2 diff_self_eq_0 le_eq_less_or_eq length_0_conv lessI)\n  oops\n\n\n\n\nlemma least_prog_R_implies:\n  assumes \"con_assms s\"\n  and \"inv (pcW s) (pcR s) s\"\n  and \"cR_step (pcR s) s s'\"\n  and \"inv (pcW s) (pcR s) s'\"\n  and \"lex_prog s s'\"\nshows \"end_R_prog s'=True\\<longrightarrow>(end_R_prog s \\<or> ((\\<forall>i.(i<n)\\<longrightarrow>ownD s' i=R) \\<and> pcR s=Release))\\<and>end_W_prog s\"\n  using assms apply (simp_all add: end_R_prog_def end_W_prog_def tries_left_def cR_step_def inv_def)\n  apply(case_tac \"pcR s\", simp_all)\n  by(case_tac \"q s=[]\", simp_all add:Let_def)\n\n\nlemma initial_progress:\n  assumes  \"cR_step (pcR s) s s' \\<or> cW_step (pcW s) s s'\"\n  and \"inv (pcW s) (pcR s) s\"\n  and \"init s'\"\n  and \"con_assms s\"\nshows \"lex_prog s s'\\<longrightarrow>s=s'\"\n  using assms apply(simp_all add:cR_step_def cW_step_def init_def progress_lemmas tries_left_def inv_def)\n  apply(case_tac \"pcR s\", simp_all)\n  apply(case_tac \"pcW s\", simp_all)\n  apply (metis add.commute add_less_mono diff_less less_le_trans less_nat_zero_code mult.commute mult_2_right nat_le_iff_add order_less_irrefl zero_less_iff_neq_zero)\n  apply (metis add.commute add_cancel_right_left add_cancel_right_right add_is_0 diff_less diff_zero le_iff_add length_0_conv length_greater_0_conv less_add_eq_less less_irrefl_nat less_le_trans mult.commute mult_2_right nat_diff_split zero_less_iff_neq_zero)\n  apply (metis (no_types, hide_lams) add.commute diff_less le_iff_add le_less_trans less_eq_nat.simps(1) less_le_trans mult.commute mult_2_right order_less_irrefl trans_less_add2)\n  apply (metis add.commute add_strict_mono diff_less le_iff_add less_le_trans less_nat_zero_code less_not_refl mult.commute mult_2_right zero_less_iff_neq_zero)\n  apply (metis add_is_0 diff_diff_cancel diff_le_self nat_0_less_mult_iff nat_less_le not_le zero_less_diff zero_less_numeral)\n  apply (metis add.commute diff_less le0 le_less_trans less_le_trans mult.commute mult_2_right nat_le_iff_add order_less_irrefl trans_less_add2)\n  apply (metis add.commute diff_less le_iff_add le_less_trans less_eq_nat.simps(1) less_le_trans less_not_refl mult.commute mult_2_right trans_less_add2)\n  apply (metis add.commute diff_less le0 le_less_trans less_le_trans less_not_refl mult.commute mult_2_right nat_le_iff_add trans_less_add1)\n  apply (metis add.commute add_cancel_right_right diff_less gr_implies_not0 le0 le_iff_add le_less_trans le_neq_implies_less less_add_eq_less less_le_trans mult.commute mult_2_right order_less_irrefl zero_le)\n  apply (metis add_is_0 diff_diff_cancel diff_self_eq_0 nat_0_less_mult_iff nat_less_le zero_less_diff zero_less_numeral)\n  apply (metis add.commute diff_less le_iff_add le_less_trans less_le_trans mult.commute mult_2_right order_less_irrefl trans_less_add2 zero_le)\n  apply (metis diff_add_zero diff_diff_cancel less_numeral_extra(3) mult_2)\n  apply (metis add.commute diff_less le_iff_add less_le_trans mult.commute mult_2_right order_less_irrefl)\n  apply (metis add.commute diff_less le_iff_add less_le_trans less_not_refl mult.commute mult_2_right)\n  apply (simp add: leD)\n  by (simp add: leD)\n  \n\n\n\n(*--------------------------------------------------------------*)\n\n\n\n(*--------------lexicographical progress------------------------------*)\ndefinition \"ltpcW i j \\<equiv> \n(i \\<noteq> j \\<and>\n(i=FinishedW)\n\\<or>(i \\<in> {Enqueue, OOM, BTS} \\<and> j\\<noteq>FinishedW)\n\\<or> (i \\<in> {A8, Write} \\<and> j \\<notin> {Enqueue, OOM, BTS, FinishedW})\n\\<or> (i \\<in> {A6, A7} \\<and> j \\<in> {idleW, A1, A2, A3, A4, A5})\n\\<or> (i \\<in> {A3, A4, A5} \\<and> j \\<in> {idleW, A1, A2})\n\\<or> (i = A2 \\<and> j \\<in> {idleW, A1})\n\\<or> (i = A1 \\<and> j = idleW)) \n\"\n\ndefinition \"ltpcR i j \\<equiv> \ni = idleR \\<and> j =Release \\<or> i=Release \\<and> j=Read \\<or> i=Read \\<and> j=idleR\"\n\ndefinition \"state_pv s \\<equiv> (2*n - numEnqs s - numDeqs s)\"\ndefinition \"tries_left s \\<equiv> N-tries s\"\n\ndefinition \"lex_prog s s' \\<equiv> s = s' \\<or> \n(state_pv s' < state_pv s \n\\<or> (state_pv s' = state_pv s \\<and> tries_left s' < tries_left s)\n\\<or> (state_pv s' = state_pv s \\<and> tries_left s' = tries_left s \\<and> ltpcR (pcR s') (pcR s)) \n\\<or> (state_pv s' = state_pv s \\<and> tries_left s' = tries_left s \\<and> ltpcW (pcW s') (pcW s)))\"\n\nlemmas progress_lemmas = ltpcW_def ltpcR_def state_pv_def lex_prog_def \n\ndefinition \"end_W_prog s \\<equiv> ((n-numEnqs s)=0) \\<and> tries_left s=N \\<and> pcW s=FinishedW\" \ndefinition \"end_R_prog s \\<equiv> end_W_prog s\\<and> pcR s=idleR \\<and> numDeqs s=numEnqs s\"\ndefinition \"start_state_prog s\\<equiv> state_pv s=2*n \\<and> pcR s=idleR \\<and> pcW s=idleW \\<and> tries_left s=N\"\n*)\n(*a\n\\<and> right_to_addresses s\n               \\<and> no_ownB s\n               \\<and> H_T_ownB s\n               \\<and> Buff_entries_transfer_numDeqs s*)*)*)\n*)", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Amazon Ring Buffer/RingBuffer_BD_latest_2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.3083650233818257}}
{"text": "theory \"USubst\"\nimports\n  Ordinary_Differential_Equations.ODE_Analysis\n  \"./Ids\"\n  \"./Lib\"\n  \"./Syntax\"\n  \"./Denotational_Semantics\"\n  \"./Static_Semantics\"\nbegin \nsection \\<open>Uniform Substitution Definitions\\<close>\ntext\\<open>This section defines substitutions and implements the substitution operation.\n  Every part of substitution comes in two flavors. The \"Nsubst\" variant of each function\n  returns a term/formula/ode/program which (as encoded in the type system) has less symbols\n  that the input. We use this operation when substitution into functions and function-like\n  constructs to make it easy to distinguish identifiers that stand for arguments to functions\n  from other identifiers. In order to expose a simpler interface, we also have a \"subst\" variant\n  which does not delete variables.\n  \n  Naive substitution without side conditions would not always be sound. The various admissibility \n  predicates *admit describe conditions under which the various substitution operations are sound.\n  \\<close>\n\ntext\\<open> \nExplicit data structure for substitutions.\n\nThe RHS of a function or predicate substitution is a term or formula\nwith extra variables, which are used to refer to arguments. \\<close>\nrecord subst =\n  SFunctions       :: \"ident \\<rightharpoonup> trm\"\n  SFunls           :: \"ident \\<rightharpoonup> trm\"\n  SPredicates      :: \"ident \\<rightharpoonup> formula\"\n  SContexts        :: \"ident \\<rightharpoonup> formula\"\n  SPrograms        :: \"ident \\<rightharpoonup> hp\"\n  SODEs            :: \"ident \\<Rightarrow> space \\<Rightarrow> ODE option\"\n\n\n(* ident_expose *)\n\n(*\nrecord  subst =\n  SFunctions       :: \"'a \\<rightharpoonup> ('a + 'c, 'c) trm\"\n  SFunls           :: \"'a \\<rightharpoonup> ('a, 'c) trm\"\n  SPredicates      :: \"'c \\<rightharpoonup> ('a + 'c, 'b, 'c) formula\"\n  SContexts        :: \"'b \\<rightharpoonup> ('a, 'b + unit, 'c) formula\"\n  SPrograms        :: \"'c \\<rightharpoonup> ('a, 'b, 'c) hp\"\n  SODEs            :: \"'c \\<Rightarrow> 'c space \\<Rightarrow> ('a, 'c) ODE option\"*)\n\n\n(* definition NTUadmit :: \"('d \\<Rightarrow> ('a, 'c) trm) \\<Rightarrow> ('a + 'd, 'c) trm \\<Rightarrow> ('c + 'c) set \\<Rightarrow> bool\" *)\ndefinition NTUadmit :: \"(ident \\<Rightarrow> trm) \\<Rightarrow>  trm \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\nwhere \"NTUadmit \\<sigma> \\<theta> U \\<longleftrightarrow> ((\\<Union> i \\<in> {i. (debase i) \\<in> SIGT \\<theta> \\<or> (Debase i) \\<in> SIGT \\<theta>}. FVT (\\<sigma> i)) \\<inter> U) = {}\"\n\n\n(* TadmitFFO :: \"('d \\<Rightarrow> ('a, 'c) trm) \\<Rightarrow> ('a + 'd, 'c) trm \\<Rightarrow> bool *)\ninductive TadmitFFO :: \"(ident \\<Rightarrow> trm) \\<Rightarrow> trm \\<Rightarrow> bool\"\nwhere \n  TadmitFFO_Diff:\"TadmitFFO \\<sigma> \\<theta> \\<Longrightarrow> NTUadmit \\<sigma> \\<theta> UNIV \\<Longrightarrow> TadmitFFO \\<sigma> (Differential \\<theta>)\"\n| TadmitFFO_Fun:\"(\\<forall>i. TadmitFFO \\<sigma> (args i)) \\<Longrightarrow> ilength f < MAX_STR \\<Longrightarrow> nonbase f \\<Longrightarrow> dfree (\\<sigma> (rebase f)) \\<Longrightarrow> TadmitFFO \\<sigma> (Function f args)\"\n(*| TadmitFFO_Fun2:\"(\\<forall>i. TadmitFFO \\<sigma> (args i)) \\<Longrightarrow> ilength f < MAX_STR \\<Longrightarrow> nonbase f \\<Longrightarrow> dfree (\\<sigma> (rebase f)) \\<Longrightarrow> TadmitFFO \\<sigma> (Function f args)\"*)\n| TadmitFFO_Plus:\"TadmitFFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFFO \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitFFO \\<sigma> (Plus \\<theta>1 \\<theta>2)\"\n| TadmitFFO_Times:\"TadmitFFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFFO \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitFFO \\<sigma> (Times \\<theta>1 \\<theta>2)\"\n| TadmitFFO_Max:\"TadmitFFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFFO \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitFFO \\<sigma> (Max \\<theta>1 \\<theta>2)\"\n| TadmitFFO_Min:\"TadmitFFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFFO \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitFFO \\<sigma> (Min \\<theta>1 \\<theta>2)\"\n| TadmitFFO_Abs:\"TadmitFFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFFO \\<sigma> (Abs \\<theta>1)\"\n| TadmitFFO_Div:\"TadmitFFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFFO \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitFFO \\<sigma> (Div \\<theta>1 \\<theta>2)\"\n| TadmitFFO_Neg:\"TadmitFFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFFO \\<sigma> (Neg \\<theta>1)\"\n| TadmitFFO_Var:\"TadmitFFO \\<sigma> (Var x)\"\n| TadmitFFO_Const:\"TadmitFFO \\<sigma> (Const r)\"\n\ninductive_simps\n  TadmitFFO_Diff_simps[simp]: \"TadmitFFO \\<sigma> (Differential \\<theta>)\"\nand TadmitFFO_Fun_simps[simp]: \"TadmitFFO \\<sigma> (Function f args)\"\nand TadmitFFO_Plus_simps[simp]: \"TadmitFFO \\<sigma> (Plus t1 t2)\"\nand TadmitFFO_Times_simps[simp]: \"TadmitFFO \\<sigma> (Times t1 t2)\"\nand TadmitFFO_Div_simps[simp]: \"TadmitFFO \\<sigma> (Div t1 t2)\"\nand TadmitFFO_Var_simps[simp]: \"TadmitFFO \\<sigma> (Var x)\"\nand TadmitFFO_Abs_simps[simp]: \"TadmitFFO \\<sigma> (Abs x)\"\nand TadmitFFO_Neg_simps[simp]: \"TadmitFFO \\<sigma> (Neg x)\"\nand TadmitFFO_Const_simps[simp]: \"TadmitFFO \\<sigma> (Const r)\"\n\n(* primrec TsubstFO::\"('a + 'b, 'c) trm \\<Rightarrow> ('b \\<Rightarrow> ('a, 'c) trm) \\<Rightarrow> ('a, 'c) trm\" *)\n\nprimrec TsubstFO::\" trm \\<Rightarrow> (ident \\<Rightarrow> trm) \\<Rightarrow> trm\"\nwhere\n  TFO_Var:\"TsubstFO (Var v) \\<sigma> = Var v\"\n| TFO_DiffVar:\"TsubstFO (DiffVar v) \\<sigma> = DiffVar v\"\n| TFO_Const:\"TsubstFO (Const r) \\<sigma> = Const r\"  \n(* TODO: So weird to replicate between function vs. funl case but might actually work*)\n| TFO_Funl:\"TsubstFO ($$F f) \\<sigma> = (case args_to_id f of Some (Inl ff) \\<Rightarrow> ($$F f) | Some (Inr ff) \\<Rightarrow> \\<sigma> ff)\"\n| TFO_Funl_rep:\"TsubstFO (Function f args) \\<sigma> =\n    (case args_to_id f of \n      Some (Inl f') \\<Rightarrow> Function f (\\<lambda> i. TsubstFO (args i) \\<sigma>) \n    | Some (Inr f') \\<Rightarrow> \\<sigma> f')\"  \n| TFO_Neg:\"TsubstFO (Neg \\<theta>1) \\<sigma> = Neg (TsubstFO \\<theta>1 \\<sigma>)\"  \n| TFO_Plus:\"TsubstFO (Plus \\<theta>1 \\<theta>2) \\<sigma> = Plus (TsubstFO \\<theta>1 \\<sigma>) (TsubstFO \\<theta>2 \\<sigma>)\"  \n| TFO_Times:\"TsubstFO (Times \\<theta>1 \\<theta>2) \\<sigma> = Times (TsubstFO \\<theta>1 \\<sigma>) (TsubstFO \\<theta>2 \\<sigma>)\"  \n| TFO_Div:\"TsubstFO (Div \\<theta>1 \\<theta>2) \\<sigma> = Div (TsubstFO \\<theta>1 \\<sigma>) (TsubstFO \\<theta>2 \\<sigma>)\"  \n| TFO_Max:\"TsubstFO (Max \\<theta>1 \\<theta>2) \\<sigma> = Max (TsubstFO \\<theta>1 \\<sigma>) (TsubstFO \\<theta>2 \\<sigma>)\"  \n| TFO_Min:\"TsubstFO (Min \\<theta>1 \\<theta>2) \\<sigma> = Min (TsubstFO \\<theta>1 \\<sigma>) (TsubstFO \\<theta>2 \\<sigma>)\"  \n| TFO_Abs:\"TsubstFO (Abs \\<theta>1) \\<sigma> = Abs (TsubstFO \\<theta>1 \\<sigma>)\"  \n| TFO_Diff:\"TsubstFO (Differential \\<theta>) \\<sigma> = Differential (TsubstFO \\<theta> \\<sigma>)\"\n\ninductive TadmitFO :: \"(ident \\<Rightarrow> trm) \\<Rightarrow> trm \\<Rightarrow> bool\"\nwhere \n  TadmitFO_Diff:\"TadmitFFO \\<sigma> \\<theta> \\<Longrightarrow> NTUadmit \\<sigma> \\<theta> UNIV \\<Longrightarrow> dfree (TsubstFO \\<theta> \\<sigma>) \\<Longrightarrow> TadmitFO \\<sigma> (Differential \\<theta>)\"\n| TadmitFO_Fun:\"(\\<forall>i. TadmitFO \\<sigma> (args i)) \\<Longrightarrow> TadmitFO \\<sigma> (Function f args)\"\n| TadmitFO_Funl:\"TadmitFO \\<sigma> ($$F f)\" (*Inl *)\n| TadmitFO_Neg:\"TadmitFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFO \\<sigma> (Neg \\<theta>1)\"\n| TadmitFO_Plus:\"TadmitFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFO \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitFO \\<sigma> (Plus \\<theta>1 \\<theta>2)\"\n| TadmitFO_Times:\"TadmitFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFO \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitFO \\<sigma> (Times \\<theta>1 \\<theta>2)\"\n| TadmitFO_Div:\"TadmitFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFO \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitFO \\<sigma> (Div \\<theta>1 \\<theta>2)\"\n| TadmitFO_Max:\"TadmitFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFO \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitFO \\<sigma> (Max \\<theta>1 \\<theta>2)\"\n| TadmitFO_Min:\"TadmitFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFO \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitFO \\<sigma> (Min \\<theta>1 \\<theta>2)\"\n| TadmitFO_Abs:\"TadmitFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFO \\<sigma> (Abs \\<theta>1)\"\n| TadmitFO_DiffVar:\"TadmitFO \\<sigma> (DiffVar x)\"\n| TadmitFO_Var:\"TadmitFO \\<sigma> (Var x)\"\n| TadmitFO_Const:\"TadmitFO \\<sigma> (Const r)\"\n\ninductive_simps\n      TadmitFO_Plus_simps[simp]: \"TadmitFO \\<sigma> (Plus a b)\"\n  and TadmitFO_Times_simps[simp]: \"TadmitFO \\<sigma> (Times a b)\"\n  and TadmitFO_Max_simps[simp]: \"TadmitFO \\<sigma> (Max a b)\"\n  and TadmitFO_Div_simps[simp]: \"TadmitFO \\<sigma> (Div a b)\"\n  and TadmitFO_Min_simps[simp]: \"TadmitFO \\<sigma> (Min a b)\"\n  and TadmitFO_Abs_simps[simp]: \"TadmitFO \\<sigma> (Abs a)\"\n  and TadmitFO_Var_simps[simp]: \"TadmitFO \\<sigma> (Var x)\"\n  and TadmitFO_DiffVar_simps[simp]: \"TadmitFO \\<sigma> (DiffVar x)\"\n  and TadmitFO_Differential_simps[simp]: \"TadmitFO \\<sigma> (Differential \\<theta>)\"\n  and TadmitFO_Const_simps[simp]: \"TadmitFO \\<sigma> (Const r)\"\n  and TadmitFO_Fun_simps[simp]: \"TadmitFO \\<sigma> (Function i args)\"\n  and TadmitFO_Funl_simps[simp]: \"TadmitFO \\<sigma> ($$F f)\"\n\nprimrec Tsubst::\" trm \\<Rightarrow> subst \\<Rightarrow> trm\"\nwhere\n  TVar:\"Tsubst (Var x) \\<sigma> = Var x\"\n| TDiffVar:\"Tsubst (DiffVar x) \\<sigma> = DiffVar x\"  \n| TConst:\"Tsubst (Const r) \\<sigma> = Const r\"  \n| TFun:\"Tsubst (Function f args) \\<sigma> = (case SFunctions \\<sigma> f of Some f' \\<Rightarrow> TsubstFO f' | None \\<Rightarrow> Function f) (\\<lambda> i. Tsubst (args i) \\<sigma>)\"  \n| TFunl:\"Tsubst ($$F f) \\<sigma> = (case SFunls \\<sigma> f of Some f' \\<Rightarrow>  f' | None \\<Rightarrow>  ($$F f))\"  \n| TNeg:\"Tsubst (Neg \\<theta>1) \\<sigma> = Neg (Tsubst \\<theta>1 \\<sigma>)\"  \n| TPlus:\"Tsubst (Plus \\<theta>1 \\<theta>2) \\<sigma> = Plus (Tsubst \\<theta>1 \\<sigma>) (Tsubst \\<theta>2 \\<sigma>)\"  \n| TTimes:\"Tsubst (Times \\<theta>1 \\<theta>2) \\<sigma> = Times (Tsubst \\<theta>1 \\<sigma>) (Tsubst \\<theta>2 \\<sigma>)\"  \n| TDiv:\"Tsubst (Div \\<theta>1 \\<theta>2) \\<sigma> = Div (Tsubst \\<theta>1 \\<sigma>) (Tsubst \\<theta>2 \\<sigma>)\"  \n| TMax:\"Tsubst (Max \\<theta>1 \\<theta>2) \\<sigma> = Max (Tsubst \\<theta>1 \\<sigma>) (Tsubst \\<theta>2 \\<sigma>)\"  \n| TMin:\"Tsubst (Min \\<theta>1 \\<theta>2) \\<sigma> = Min (Tsubst \\<theta>1 \\<sigma>) (Tsubst \\<theta>2 \\<sigma>)\"  \n| TAbs:\"Tsubst (Abs \\<theta>1) \\<sigma> = Abs (Tsubst \\<theta>1 \\<sigma>) \"  \n| TDiff:\"Tsubst (Differential \\<theta>) \\<sigma> = Differential (Tsubst \\<theta> \\<sigma>)\"\n\nlemma TZero[simp]: \"Tsubst \\<^bold>0 \\<sigma> = \\<^bold>0\"\n  unfolding Zero_def by simp\n\nlemma TOne[simp]: \"Tsubst \\<^bold>1 \\<sigma> = \\<^bold>1\"\n  unfolding One_def by simp\n\nprimrec OsubstFO::\"ODE \\<Rightarrow> (ident \\<Rightarrow> trm) \\<Rightarrow> ODE\"\n  where\n  \"OsubstFO (OVar c sp) \\<sigma> = OVar c sp\"\n| \"OsubstFO (OSing x \\<theta>) \\<sigma> = OSing x (TsubstFO \\<theta> \\<sigma>)\"\n| \"OsubstFO (OProd ODE1 ODE2) \\<sigma> = oprod (OsubstFO ODE1 \\<sigma>) (OsubstFO ODE2 \\<sigma>)\"\n\nprimrec Osubst::\"ODE \\<Rightarrow> subst \\<Rightarrow> ODE\"\nwhere\n  \"Osubst (OVar c sp ) \\<sigma> = (case SODEs \\<sigma> c sp of Some c' \\<Rightarrow> c' | None \\<Rightarrow> OVar c sp)\"\n| \"Osubst (OSing x \\<theta>) \\<sigma> = OSing x (Tsubst \\<theta> \\<sigma>)\"\n| \"Osubst (OProd ODE1 ODE2) \\<sigma> = oprod (Osubst ODE1 \\<sigma>) (Osubst ODE2 \\<sigma>)\"\n  \nfun PsubstFO::\"hp \\<Rightarrow> (ident \\<Rightarrow> trm) \\<Rightarrow> hp\"\nand FsubstFO::\"formula \\<Rightarrow> (ident \\<Rightarrow> trm) \\<Rightarrow> formula\"\nwhere\n  \"PsubstFO (Pvar a) \\<sigma> = Pvar a\"\n| \"PsubstFO (Assign x \\<theta>) \\<sigma> = Assign x (TsubstFO \\<theta> \\<sigma>)\"\n| \"PsubstFO (AssignAny x) \\<sigma> = AssignAny x\"\n| \"PsubstFO (DiffAssign x \\<theta>) \\<sigma> = DiffAssign x (TsubstFO \\<theta> \\<sigma>)\"\n| \"PsubstFO (Test \\<phi>) \\<sigma> = Test (FsubstFO \\<phi> \\<sigma>)\"\n| \"PsubstFO (EvolveODE ODE \\<phi>) \\<sigma> = EvolveODE (OsubstFO ODE \\<sigma>) (FsubstFO \\<phi> \\<sigma>)\"\n| \"PsubstFO (Choice \\<alpha> \\<beta>) \\<sigma> = Choice (PsubstFO \\<alpha> \\<sigma>) (PsubstFO \\<beta> \\<sigma>)\"\n| \"PsubstFO (Sequence \\<alpha> \\<beta>) \\<sigma> = Sequence (PsubstFO \\<alpha> \\<sigma>) (PsubstFO \\<beta> \\<sigma>)\"\n| \"PsubstFO (Loop \\<alpha>) \\<sigma> = Loop (PsubstFO \\<alpha> \\<sigma>)\"\n\n| \"FsubstFO (Geq \\<theta>1 \\<theta>2) \\<sigma> = Geq (TsubstFO \\<theta>1 \\<sigma>) (TsubstFO \\<theta>2 \\<sigma>)\"\n| \"FsubstFO (Prop p args) \\<sigma> = Prop p (\\<lambda>i. TsubstFO (args i) \\<sigma>)\"\n| \"FsubstFO (Not \\<phi>) \\<sigma> = Not (FsubstFO \\<phi> \\<sigma>)\"\n| \"FsubstFO (And \\<phi> \\<psi>) \\<sigma> = And (FsubstFO \\<phi> \\<sigma>) (FsubstFO \\<psi> \\<sigma>)\"\n| \"FsubstFO (Exists x \\<phi>) \\<sigma> = Exists x (FsubstFO \\<phi> \\<sigma>)\"\n| \"FsubstFO (Diamond \\<alpha> \\<phi>) \\<sigma> = Diamond (PsubstFO \\<alpha> \\<sigma>) (FsubstFO \\<phi> \\<sigma>)\"\n| \"FsubstFO (InContext C \\<phi>) \\<sigma> = InContext C (FsubstFO \\<phi> \\<sigma>)\"\n  \nfun PPsubst::\"hp \\<Rightarrow> (ident \\<Rightarrow> formula) \\<Rightarrow> hp\"\nand PFsubst::\"formula \\<Rightarrow> (ident \\<Rightarrow> formula) \\<Rightarrow> formula\"\nwhere\n  \"PPsubst (Pvar a) \\<sigma> = Pvar a\"\n| \"PPsubst (Assign x \\<theta>) \\<sigma> = Assign x \\<theta>\"\n| \"PPsubst (AssignAny x) \\<sigma> = AssignAny x\"\n| \"PPsubst (DiffAssign x \\<theta>) \\<sigma> = DiffAssign x \\<theta>\"\n| \"PPsubst (Test \\<phi>) \\<sigma> = Test (PFsubst \\<phi> \\<sigma>)\"\n| \"PPsubst (EvolveODE ODE \\<phi>) \\<sigma> = EvolveODE ODE (PFsubst \\<phi> \\<sigma>)\"\n| \"PPsubst (Choice \\<alpha> \\<beta>) \\<sigma> = Choice (PPsubst \\<alpha> \\<sigma>) (PPsubst \\<beta> \\<sigma>)\"\n| \"PPsubst (Sequence \\<alpha> \\<beta>) \\<sigma> = Sequence (PPsubst \\<alpha> \\<sigma>) (PPsubst \\<beta> \\<sigma>)\"\n| \"PPsubst (Loop \\<alpha>) \\<sigma> = Loop (PPsubst \\<alpha> \\<sigma>)\"\n\n| \"PFsubst (Geq \\<theta>1 \\<theta>2) \\<sigma> = (Geq \\<theta>1 \\<theta>2)\"\n| \"PFsubst (Prop p args) \\<sigma> = Prop p args\"\n| \"PFsubst (Not \\<phi>) \\<sigma> = Not (PFsubst \\<phi> \\<sigma>)\"\n| \"PFsubst (And \\<phi> \\<psi>) \\<sigma> = And (PFsubst \\<phi> \\<sigma>) (PFsubst \\<psi> \\<sigma>)\"\n| \"PFsubst (Exists x \\<phi>) \\<sigma> = Exists x (PFsubst \\<phi> \\<sigma>)\"\n| \"PFsubst (Diamond \\<alpha> \\<phi>) \\<sigma> = Diamond (PPsubst \\<alpha> \\<sigma>) (PFsubst \\<phi> \\<sigma>)\"\n| \"PFsubst (InContext C \\<phi>) \\<sigma> = (case args_to_id C of Some (Inl C') \\<Rightarrow> InContext C' (PFsubst \\<phi> \\<sigma>) | Some (Inr p') \\<Rightarrow> \\<sigma> p')\"\n\n  \nfun Psubst::\"hp \\<Rightarrow> subst \\<Rightarrow> hp\"\nand Fsubst::\"formula \\<Rightarrow> subst \\<Rightarrow> formula\"\nwhere\n  \"Psubst (Pvar a) \\<sigma> = (case SPrograms \\<sigma> a of Some a' \\<Rightarrow> a' | None \\<Rightarrow> Pvar a)\"\n| \"Psubst (Assign x \\<theta>) \\<sigma> = Assign x (Tsubst \\<theta> \\<sigma>)\"\n| \"Psubst (AssignAny x) \\<sigma> = AssignAny x\"\n| \"Psubst (DiffAssign x \\<theta>) \\<sigma> = DiffAssign x (Tsubst \\<theta> \\<sigma>)\"\n| \"Psubst (Test \\<phi>) \\<sigma> = Test (Fsubst \\<phi> \\<sigma>)\"\n| \"Psubst (EvolveODE ODE \\<phi>) \\<sigma> = EvolveODE (Osubst ODE \\<sigma>) (Fsubst \\<phi> \\<sigma>)\"\n| \"Psubst (Choice \\<alpha> \\<beta>) \\<sigma> = Choice (Psubst \\<alpha> \\<sigma>) (Psubst \\<beta> \\<sigma>)\"\n| \"Psubst (Sequence \\<alpha> \\<beta>) \\<sigma> = Sequence (Psubst \\<alpha> \\<sigma>) (Psubst \\<beta> \\<sigma>)\"\n| \"Psubst (Loop \\<alpha>) \\<sigma> = Loop (Psubst \\<alpha> \\<sigma>)\"\n\n| \"Fsubst (Geq \\<theta>1 \\<theta>2) \\<sigma> = Geq (Tsubst \\<theta>1 \\<sigma>) (Tsubst \\<theta>2 \\<sigma>)\"\n| \"Fsubst (Prop p args) \\<sigma> = (case SPredicates \\<sigma> p of Some p' \\<Rightarrow> FsubstFO p' (\\<lambda>i. Tsubst (args i) \\<sigma>) | None \\<Rightarrow> Prop p (\\<lambda>i. Tsubst (args i) \\<sigma>))\"\n| \"Fsubst (Not \\<phi>) \\<sigma> = Not (Fsubst \\<phi> \\<sigma>)\"\n| \"Fsubst (And \\<phi> \\<psi>) \\<sigma> = And (Fsubst \\<phi> \\<sigma>) (Fsubst \\<psi> \\<sigma>)\"\n| \"Fsubst (Exists x \\<phi>) \\<sigma> = Exists x (Fsubst \\<phi> \\<sigma>)\"\n| \"Fsubst (Diamond \\<alpha> \\<phi>) \\<sigma> = Diamond (Psubst \\<alpha> \\<sigma>) (Fsubst \\<phi> \\<sigma>)\"\n| \"Fsubst (InContext C \\<phi>) \\<sigma> = (case SContexts \\<sigma> C of Some C' \\<Rightarrow> PFsubst C' (\\<lambda> _. (Fsubst \\<phi> \\<sigma>)) | None \\<Rightarrow>  InContext C (Fsubst \\<phi> \\<sigma>))\"\n\ndefinition FVA :: \"(ident \\<Rightarrow> trm) \\<Rightarrow> (ident + ident) set\"\nwhere \"FVA args = (\\<Union> i. FVT (args i))\"\n\nfun SFV :: \"subst \\<Rightarrow> (ident + ident + ident) \\<Rightarrow> (ident + ident) set\"\nwhere \"SFV \\<sigma> (Inl i) = (case SFunctions \\<sigma> i of Some f' \\<Rightarrow> FVT f' | None \\<Rightarrow> {}) \" (* \\<union> (case SFunls \\<sigma> i of Some f' \\<Rightarrow> FVT f' | None \\<Rightarrow> {}) *)\n| \"SFV \\<sigma> (Inr (Inl i)) = {}\"\n| \"SFV \\<sigma> (Inr (Inr i)) = (case SPredicates \\<sigma> i of Some p' \\<Rightarrow> FVF p' | None \\<Rightarrow> {})\"\n\ndefinition FVS :: \"subst \\<Rightarrow> (ident + ident) set\"\nwhere \"FVS \\<sigma> = (\\<Union>i. SFV \\<sigma> i)\"\n\ndefinition SDom :: \"subst \\<Rightarrow> (ident + ident + ident) set\"\nwhere \"SDom \\<sigma> = \n   {Inl x | x. x \\<in> dom (SFunctions \\<sigma>)}\n \\<union> {Inl x | x. x \\<in> dom (SFunls \\<sigma>)}\n \\<union> {Inr (Inl x) | x. x \\<in> dom (SContexts \\<sigma>)}\n \\<union> {Inr (Inr x) | x. x \\<in> dom (SPredicates \\<sigma>)} \n \\<union> {Inr (Inr x) | x. x \\<in> dom (SPrograms \\<sigma>)}\"\n\ndefinition TUadmit :: \"subst \\<Rightarrow> trm \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\n  where \"TUadmit \\<sigma> \\<theta> U \\<longleftrightarrow> \n  ((\\<Union> i \\<in> SIGT \\<theta>. (case SFunctions \\<sigma> i of Some f' \\<Rightarrow> FVT f'  | None \\<Rightarrow> {}) \n                \\<union> (case SFunls \\<sigma> i of Some f' \\<Rightarrow> FVT f'  | None \\<Rightarrow> {})) \\<inter> U) = {}\"\n\ninductive Tadmit :: \"subst \\<Rightarrow> trm \\<Rightarrow> bool\"\nwhere \n  Tadmit_Diff:\"Tadmit \\<sigma> \\<theta> \\<Longrightarrow> TUadmit \\<sigma> \\<theta> UNIV \\<Longrightarrow> Tadmit \\<sigma> (Differential \\<theta>)\"\n| Tadmit_Fun1:\"(\\<forall>i. Tadmit \\<sigma> (args i)) \\<Longrightarrow> SFunctions \\<sigma> f = Some f' \\<Longrightarrow> TadmitFO (\\<lambda> i. Tsubst (args i) \\<sigma>) f' \\<Longrightarrow> Tadmit \\<sigma> (Function f args)\"\n| Tadmit_Fun2:\"(\\<forall>i. Tadmit \\<sigma> (args i)) \\<Longrightarrow> SFunctions \\<sigma> f = None \\<Longrightarrow> Tadmit \\<sigma> (Function f args)\"\n| Tadmit_Funl:\"SFunls \\<sigma> f = Some f' \\<Longrightarrow> Tadmit \\<sigma> f' \\<Longrightarrow> Tadmit \\<sigma> ($$F f)\"\n| Tadmit_Neg:\"Tadmit \\<sigma> \\<theta>1 \\<Longrightarrow>  Tadmit \\<sigma> (Neg \\<theta>1)\"\n| Tadmit_Plus:\"Tadmit \\<sigma> \\<theta>1 \\<Longrightarrow> Tadmit \\<sigma> \\<theta>2 \\<Longrightarrow> Tadmit \\<sigma> (Plus \\<theta>1 \\<theta>2)\"\n| Tadmit_Times:\"Tadmit \\<sigma> \\<theta>1 \\<Longrightarrow> Tadmit \\<sigma> \\<theta>2 \\<Longrightarrow> Tadmit \\<sigma> (Times \\<theta>1 \\<theta>2)\"\n| Tadmit_Max:\"Tadmit \\<sigma> \\<theta>1 \\<Longrightarrow> Tadmit \\<sigma> \\<theta>2 \\<Longrightarrow> Tadmit \\<sigma> (Max \\<theta>1 \\<theta>2)\"\n| Tadmit_Min:\"Tadmit \\<sigma> \\<theta>1 \\<Longrightarrow> Tadmit \\<sigma> \\<theta>2 \\<Longrightarrow> Tadmit \\<sigma> (Min \\<theta>1 \\<theta>2)\"\n| Tadmit_Abs:\"Tadmit \\<sigma> \\<theta>1 \\<Longrightarrow> Tadmit \\<sigma> (Abs \\<theta>1)\"\n| Tadmit_DiffVar:\"Tadmit \\<sigma> (DiffVar x)\"\n| Tadmit_Var:\"Tadmit \\<sigma> (Var x)\"\n| Tadmit_Const:\"Tadmit \\<sigma> (Const r)\"\n\ninductive_simps\n      Tadmit_Plus_simps[simp]: \"Tadmit \\<sigma> (Plus a b)\"\n  and Tadmit_Neg_simps[simp]: \"Tadmit \\<sigma> (Neg a)\"\n  and Tadmit_Times_simps[simp]: \"Tadmit \\<sigma> (Times a b)\"\n  and Tadmit_Max_simps[simp]: \"Tadmit \\<sigma> (Max a b)\"\n  and Tadmit_Min_simps[simp]: \"Tadmit \\<sigma> (Min a b)\"\n  and Tadmit_Abs_simps[simp]: \"Tadmit \\<sigma> (Abs a)\"\n  and Tadmit_Var_simps[simp]: \"Tadmit \\<sigma> (Var x)\"\n  and Tadmit_DiffVar_simps[simp]: \"Tadmit \\<sigma> (DiffVar x)\"\n  and Tadmit_Differential_simps[simp]: \"Tadmit \\<sigma> (Differential \\<theta>)\"\n  and Tadmit_Const_simps[simp]: \"Tadmit \\<sigma> (Const r)\"\n  and Tadmit_Fun_simps[simp]: \"Tadmit \\<sigma> (Function i args)\"\n  and Tadmit_Funl_simps[simp]: \"Tadmit \\<sigma> ($$F i)\"\n\ninductive TadmitF :: \"subst \\<Rightarrow> trm \\<Rightarrow> bool\"\nwhere \n  TadmitF_Diff:\"TadmitF \\<sigma> \\<theta> \\<Longrightarrow> TUadmit \\<sigma> \\<theta> UNIV \\<Longrightarrow> TadmitF \\<sigma> (Differential \\<theta>)\"\n| TadmitF_Fun1:\"(\\<forall>i. TadmitF \\<sigma> (args i)) \\<Longrightarrow> SFunctions \\<sigma> f = Some f' \\<Longrightarrow> nonbase f \\<Longrightarrow> ilength f < MAX_STR \\<Longrightarrow> (\\<forall>i. dfree (Tsubst (args i) \\<sigma>)) \\<Longrightarrow> TadmitFFO (\\<lambda> i. Tsubst (args i) \\<sigma>) f' \\<Longrightarrow> TadmitF \\<sigma> (Function f args)\"\n| TadmitF_Fun2:\"(\\<forall>i. TadmitF \\<sigma> (args i)) \\<Longrightarrow> SFunctions \\<sigma> f = None    \\<Longrightarrow> nonbase f \\<Longrightarrow> ilength f < MAX_STR \\<Longrightarrow> TadmitF \\<sigma> (Function f args)\"\n| TadmitF_Neg:\"TadmitF \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitF \\<sigma> (Neg \\<theta>1)\"\n| TadmitF_Plus:\"TadmitF \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitF \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitF \\<sigma> (Plus \\<theta>1 \\<theta>2)\"\n| TadmitF_Times:\"TadmitF \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitF \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitF \\<sigma> (Times \\<theta>1 \\<theta>2)\"\n| TadmitF_Max:\"TadmitF \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitF \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitF \\<sigma> (Max \\<theta>1 \\<theta>2)\"\n| TadmitF_Min:\"TadmitF \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitF \\<sigma> \\<theta>2 \\<Longrightarrow> TadmitF \\<sigma> (Min \\<theta>1 \\<theta>2)\"\n| TadmitF_Abs:\"TadmitF \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitF \\<sigma> (Abs \\<theta>1)\"\n| TadmitF_DiffVar:\"TadmitF \\<sigma> (DiffVar x)\"\n| TadmitF_Var:\"TadmitF \\<sigma> (Var x)\"\n| TadmitF_Const:\"TadmitF \\<sigma> (Const r)\"\n\ninductive_simps\n      TadmitF_Plus_simps[simp]: \"TadmitF \\<sigma> (Plus a b)\"\n  and TadmitF_Times_simps[simp]: \"TadmitF \\<sigma> (Times a b)\"\n  and TadmitF_Neg_simps[simp]: \"TadmitF \\<sigma> (Neg a)\"\n  and TadmitF_Max_simps[simp]: \"TadmitF \\<sigma> (Max a b)\"\n  and TadmitF_Min_simps[simp]: \"TadmitF \\<sigma> (Min a b)\"\n  and TadmitF_Abs_simps[simp]: \"TadmitF \\<sigma> (Abs a)\"\n  and TadmitF_Var_simps[simp]: \"TadmitF \\<sigma> (Var x)\"\n  and TadmitF_DiffVar_simps[simp]: \"TadmitF \\<sigma> (DiffVar x)\"\n  and TadmitF_Differential_simps[simp]: \"TadmitF \\<sigma> (Differential \\<theta>)\"\n  and TadmitF_Const_simps[simp]: \"TadmitF \\<sigma> (Const r)\"\n  and TadmitF_Fun_simps[simp]: \"TadmitF \\<sigma> (Function i args)\"\n  and TadmitF_Funl_simps[simp]: \"TadmitF \\<sigma> ($$F i)\"\n\ninductive Oadmit:: \"subst \\<Rightarrow> ODE \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\nwhere \n  Oadmit_Var:\"Oadmit \\<sigma> (OVar c None) U\"\n| Oadmit_VarNB:\"(case SODEs \\<sigma> c (Some x) of Some ode \\<Rightarrow> Inl x \\<notin> BVO ode | None \\<Rightarrow> False) \\<Longrightarrow> Oadmit \\<sigma> (OVar c (Some x)) U\"\n| Oadmit_Sing:\"TUadmit \\<sigma> \\<theta> U \\<Longrightarrow> TadmitF \\<sigma> \\<theta> \\<Longrightarrow> Oadmit \\<sigma> (OSing x \\<theta>) U\"\n| Oadmit_Prod:\"Oadmit \\<sigma> ODE1 U \\<Longrightarrow> Oadmit \\<sigma> ODE2 U \\<Longrightarrow> ODE_dom (Osubst ODE1 \\<sigma>) \\<inter> ODE_dom (Osubst ODE2 \\<sigma>) = {} \\<Longrightarrow> Oadmit \\<sigma> (OProd ODE1 ODE2) U\"\n\ninductive_simps\n      Oadmit_Var_simps[simp]: \"Oadmit \\<sigma> (OVar c sp) U\"\n  and Oadmit_Sing_simps[simp]: \"Oadmit \\<sigma> (OSing x e) U\"\n  and Oadmit_Prod_simps[simp]: \"Oadmit \\<sigma> (OProd ODE1 ODE2) U\"\n\ndefinition PUadmit :: \"subst \\<Rightarrow> hp \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\nwhere \"PUadmit \\<sigma> \\<theta> U \\<longleftrightarrow> ((\\<Union> i \\<in> (SDom \\<sigma> \\<inter> SIGP \\<theta>).  SFV \\<sigma> i) \\<inter> U) = {}\"\n\ndefinition FUadmit :: \"subst \\<Rightarrow> formula \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\nwhere \"FUadmit \\<sigma> \\<theta> U \\<longleftrightarrow> ((\\<Union> i \\<in> (SDom \\<sigma> \\<inter> SIGF \\<theta>).  SFV \\<sigma> i) \\<inter> U) = {}\"\n\ndefinition OUadmitFO :: \"(ident \\<Rightarrow> trm) \\<Rightarrow> ODE \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\nwhere \"OUadmitFO \\<sigma> \\<theta> U \\<longleftrightarrow> ((\\<Union> i \\<in> {i. Inl (debase i) \\<in> SIGO \\<theta>}. FVT (\\<sigma> i)) \\<inter> U) = {}\"\n \ninductive OadmitFO :: \"(ident \\<Rightarrow> trm) \\<Rightarrow> ODE \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\nwhere \n  OadmitFO_OVar:\"OUadmitFO \\<sigma> (OVar c sp) U \\<Longrightarrow> OadmitFO \\<sigma> (OVar c sp) U\"\n| OadmitFO_OSing:\"OUadmitFO \\<sigma> (OSing x \\<theta>) U \\<Longrightarrow> TadmitFFO \\<sigma> \\<theta> \\<Longrightarrow> OadmitFO \\<sigma> (OSing x \\<theta>) U\"\n| OadmitFO_OProd:\"OadmitFO \\<sigma> ODE1 U \\<Longrightarrow> OadmitFO \\<sigma> ODE2 U \\<Longrightarrow> OadmitFO \\<sigma> (OProd ODE1 ODE2) U\"\n\ninductive_simps\n      OadmitFO_OVar_simps[simp]: \"OadmitFO \\<sigma> (OVar a sp) U\"\n  and OadmitFO_OProd_simps[simp]: \"OadmitFO \\<sigma> (OProd ODE1 ODE2) U\"\n  and OadmitFO_OSing_simps[simp]: \"OadmitFO \\<sigma> (OSing x e) U\"\n  \ndefinition FUadmitFO :: \"(ident \\<Rightarrow> trm) \\<Rightarrow> formula \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\nwhere \"FUadmitFO \\<sigma> \\<theta> U \\<longleftrightarrow> ((\\<Union> i \\<in> {i. Inl (debase i) \\<in> SIGF \\<theta> \\<or> Inl (Debase i) \\<in> SIGF \\<theta>}. FVT (\\<sigma> i)) \\<inter> U) = {}\"\n\ndefinition PUadmitFO :: \"(ident \\<Rightarrow> trm) \\<Rightarrow> hp \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\nwhere \"PUadmitFO \\<sigma> \\<theta> U \\<longleftrightarrow> ((\\<Union> i  \\<in> {i. Inl (debase i) \\<in> SIGP \\<theta> \\<or> Inl (Debase i) \\<in> SIGP \\<theta>}. FVT (\\<sigma> i)) \\<inter> U) = {}\"\n\ninductive NPadmit :: \"(ident \\<Rightarrow> trm) \\<Rightarrow> hp \\<Rightarrow> bool\" \nand NFadmit :: \"(ident \\<Rightarrow> trm) \\<Rightarrow> formula \\<Rightarrow> bool\"\nwhere\n  NPadmit_Pvar:\"NPadmit \\<sigma> (Pvar a)\"\n| NPadmit_Sequence:\"NPadmit \\<sigma> a \\<Longrightarrow> NPadmit \\<sigma> b \\<Longrightarrow> PUadmitFO \\<sigma> b (BVP (PsubstFO a \\<sigma>))\\<Longrightarrow> hpsafe (PsubstFO a \\<sigma>) \\<Longrightarrow> NPadmit \\<sigma> (Sequence a b)\"  \n| NPadmit_Loop:\"NPadmit \\<sigma> a \\<Longrightarrow> PUadmitFO \\<sigma> a (BVP (PsubstFO a \\<sigma>)) \\<Longrightarrow> hpsafe (PsubstFO a \\<sigma>) \\<Longrightarrow> NPadmit \\<sigma> (Loop a)\"        \n| NPadmit_ODE:\"OadmitFO \\<sigma> ODE (BVO ODE) \\<Longrightarrow> NFadmit \\<sigma> \\<phi> \\<Longrightarrow> FUadmitFO \\<sigma> \\<phi> (BVO ODE) \\<Longrightarrow> fsafe (FsubstFO \\<phi> \\<sigma>) \\<Longrightarrow> osafe (OsubstFO ODE \\<sigma>) \\<Longrightarrow> NPadmit \\<sigma> (EvolveODE ODE \\<phi>)\"\n| NPadmit_Choice:\"NPadmit \\<sigma> a \\<Longrightarrow> NPadmit \\<sigma> b \\<Longrightarrow> NPadmit \\<sigma> (Choice a b)\"            \n| NPadmit_Assign:\"TadmitFO \\<sigma> \\<theta> \\<Longrightarrow> NPadmit \\<sigma> (Assign x \\<theta>)\"  \n| NPadmit_AssignAny:\" NPadmit \\<sigma> (AssignAny x)\"  \n| NPadmit_DiffAssign:\"TadmitFO \\<sigma> \\<theta> \\<Longrightarrow> NPadmit \\<sigma> (DiffAssign x \\<theta>)\"  \n| NPadmit_Test:\"NFadmit \\<sigma> \\<phi> \\<Longrightarrow> NPadmit \\<sigma> (Test \\<phi>)\"\n\n| NFadmit_Geq:\"TadmitFO \\<sigma> \\<theta>1 \\<Longrightarrow> TadmitFO \\<sigma> \\<theta>2 \\<Longrightarrow> NFadmit \\<sigma> (Geq \\<theta>1 \\<theta>2)\"\n| NFadmit_Prop:\"(\\<forall>i. TadmitFO \\<sigma> (args i)) \\<Longrightarrow> NFadmit \\<sigma> (Prop f args)\"\n| NFadmit_Not:\"NFadmit \\<sigma> \\<phi> \\<Longrightarrow> NFadmit \\<sigma> (Not \\<phi>)\"\n| NFadmit_And:\"NFadmit \\<sigma> \\<phi> \\<Longrightarrow> NFadmit \\<sigma> \\<psi> \\<Longrightarrow> NFadmit \\<sigma> (And \\<phi> \\<psi>)\"\n| NFadmit_Exists:\"NFadmit \\<sigma> \\<phi> \\<Longrightarrow> FUadmitFO \\<sigma> \\<phi> {Inl x} \\<Longrightarrow> NFadmit \\<sigma> (Exists x \\<phi>)\"\n| NFadmit_Diamond:\"NFadmit \\<sigma> \\<phi> \\<Longrightarrow> NPadmit \\<sigma> a \\<Longrightarrow> FUadmitFO \\<sigma> \\<phi> (BVP (PsubstFO a \\<sigma>)) \\<Longrightarrow> hpsafe (PsubstFO a \\<sigma>) \\<Longrightarrow> NFadmit \\<sigma> (Diamond a \\<phi>)\"\n| NFadmit_Context:\"NFadmit \\<sigma> \\<phi> \\<Longrightarrow> FUadmitFO \\<sigma> \\<phi> UNIV \\<Longrightarrow> NFadmit \\<sigma> (InContext C \\<phi>)\"\n\ninductive_simps\n      NPadmit_Pvar_simps[simp]: \"NPadmit \\<sigma> (Pvar a)\"\n  and NPadmit_Sequence_simps[simp]: \"NPadmit \\<sigma> (a ;; b)\"\n  and NPadmit_Loop_simps[simp]: \"NPadmit \\<sigma> (a**)\"\n  and NPadmit_ODE_simps[simp]: \"NPadmit \\<sigma> (EvolveODE ODE p)\"\n  and NPadmit_Choice_simps[simp]: \"NPadmit \\<sigma> (a \\<union>\\<union> b)\"\n  and NPadmit_Assign_simps[simp]: \"NPadmit \\<sigma> (Assign x e)\"\n  and NPadmit_AssignAny_simps[simp]: \"NPadmit \\<sigma> (AssignAny x)\"\n  and NPadmit_DiffAssign_simps[simp]: \"NPadmit \\<sigma> (DiffAssign x e)\"\n  and NPadmit_Test_simps[simp]: \"NPadmit \\<sigma> (? p)\"\n  \n  and NFadmit_Geq_simps[simp]: \"NFadmit \\<sigma> (Geq t1 t2)\"\n  and NFadmit_Prop_simps[simp]: \"NFadmit \\<sigma> (Prop p args)\"\n  and NFadmit_Not_simps[simp]: \"NFadmit \\<sigma> (Not p)\"\n  and NFadmit_And_simps[simp]: \"NFadmit \\<sigma> (And p q)\"\n  and NFadmit_Exists_simps[simp]: \"NFadmit \\<sigma> (Exists x p)\"\n  and NFadmit_Diamond_simps[simp]: \"NFadmit \\<sigma> (Diamond a p)\"\n  and NFadmit_Context_simps[simp]: \"NFadmit \\<sigma> (InContext C p)\"\n\ndefinition PFUadmit :: \"(ident \\<Rightarrow> formula) \\<Rightarrow> formula \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\nwhere \"PFUadmit \\<sigma> \\<theta> U \\<longleftrightarrow> True\"\n\ndefinition PPUadmit :: \"(ident \\<Rightarrow> formula) \\<Rightarrow> hp \\<Rightarrow> (ident + ident) set \\<Rightarrow> bool\"\nwhere \"PPUadmit \\<sigma> \\<theta> U \\<longleftrightarrow> ((\\<Union> i \\<in> {i | i. Inr(Inl(debase i)) \\<in> SIGP \\<theta>}. FVF (\\<sigma> i)) \\<inter> U) = {}\"\n\ninductive PPadmit:: \"(ident \\<Rightarrow> formula) \\<Rightarrow> hp \\<Rightarrow> bool\"\nand PFadmit:: \"(ident \\<Rightarrow> formula) \\<Rightarrow>  formula \\<Rightarrow> bool\"\nwhere \n  PPadmit_Pvar:\"PPadmit \\<sigma> (Pvar a)\"\n| PPadmit_Sequence:\"PPadmit \\<sigma> a \\<Longrightarrow> PPadmit \\<sigma> b \\<Longrightarrow> PPUadmit \\<sigma> b (BVP (PPsubst a \\<sigma>))\\<Longrightarrow> hpsafe (PPsubst a \\<sigma>) \\<Longrightarrow> PPadmit \\<sigma> (Sequence a b)\"  \n| PPadmit_Loop:\"PPadmit \\<sigma> a \\<Longrightarrow> PPUadmit \\<sigma> a (BVP (PPsubst a \\<sigma>)) \\<Longrightarrow> hpsafe (PPsubst a \\<sigma>) \\<Longrightarrow> PPadmit \\<sigma> (Loop a)\"        \n| PPadmit_ODE:\"PFadmit \\<sigma> \\<phi> \\<Longrightarrow> PFUadmit \\<sigma> \\<phi> (BVO ODE) \\<Longrightarrow> PPadmit \\<sigma> (EvolveODE ODE \\<phi>)\"\n| PPadmit_Choice:\"PPadmit \\<sigma> a \\<Longrightarrow> PPadmit \\<sigma> b \\<Longrightarrow> PPadmit \\<sigma> (Choice a b)\"            \n| PPadmit_Assign:\"PPadmit \\<sigma> (Assign x \\<theta>)\"  \n| PPadmit_AssignAny:\"PPadmit \\<sigma> (AssignAny x)\"  \n| PPadmit_DiffAssign:\"PPadmit \\<sigma> (DiffAssign x \\<theta>)\"  \n| PPadmit_Test:\"PFadmit \\<sigma> \\<phi> \\<Longrightarrow> PPadmit \\<sigma> (Test \\<phi>)\"\n\n| PFadmit_Geq:\"PFadmit \\<sigma> (Geq \\<theta>1 \\<theta>2)\"\n| PFadmit_Prop:\"PFadmit \\<sigma> (Prop f args)\"\n| PFadmit_Not:\"PFadmit \\<sigma> \\<phi> \\<Longrightarrow> PFadmit \\<sigma> (Not \\<phi>)\"\n| PFadmit_And:\"PFadmit \\<sigma> \\<phi> \\<Longrightarrow> PFadmit \\<sigma> \\<psi> \\<Longrightarrow> PFadmit \\<sigma> (And \\<phi> \\<psi>)\"\n| PFadmit_Exists:\"PFadmit \\<sigma> \\<phi> \\<Longrightarrow> PFUadmit \\<sigma> \\<phi> {Inl x} \\<Longrightarrow> PFadmit \\<sigma> (Exists x \\<phi>)\"\n| PFadmit_Diamond:\"PFadmit \\<sigma> \\<phi> \\<Longrightarrow> PPadmit \\<sigma> a \\<Longrightarrow> PFUadmit \\<sigma> \\<phi> (BVP (PPsubst a \\<sigma>)) \\<Longrightarrow> PFadmit \\<sigma> (Diamond a \\<phi>)\"\n| PFadmit_Context:\"PFadmit \\<sigma> \\<phi> \\<Longrightarrow> PFUadmit \\<sigma> \\<phi> UNIV \\<Longrightarrow> PFadmit \\<sigma> (InContext C \\<phi>)\"\n\ninductive_simps\n      PPadmit_Pvar_simps[simp]: \"PPadmit \\<sigma> (Pvar a)\"\n  and PPadmit_Sequence_simps[simp]: \"PPadmit \\<sigma> (a ;; b)\"\n  and PPadmit_Loop_simps[simp]: \"PPadmit \\<sigma> (a**)\"\n  and PPadmit_ODE_simps[simp]: \"PPadmit \\<sigma> (EvolveODE ODE p)\"\n  and PPadmit_Choice_simps[simp]: \"PPadmit \\<sigma> (a \\<union>\\<union> b)\"\n  and PPadmit_Assign_simps[simp]: \"PPadmit \\<sigma> (Assign x e)\"\n  and PPadmit_AssignAny_simps[simp]: \"PPadmit \\<sigma> (AssignAny x)\"\n  and PPadmit_DiffAssign_simps[simp]: \"PPadmit \\<sigma> (DiffAssign x e)\"\n  and PPadmit_Test_simps[simp]: \"PPadmit \\<sigma> (? p)\"\n  \n  and PFadmit_Geq_simps[simp]: \"PFadmit \\<sigma> (Geq t1 t2)\"\n  and PFadmit_Prop_simps[simp]: \"PFadmit \\<sigma> (Prop p args)\"\n  and PFadmit_Not_simps[simp]: \"PFadmit \\<sigma> (Not p)\"\n  and PFadmit_And_simps[simp]: \"PFadmit \\<sigma> (And p q)\"\n  and PFadmit_Exists_simps[simp]: \"PFadmit \\<sigma> (Exists x p)\"\n  and PFadmit_Diamond_simps[simp]: \"PFadmit \\<sigma> (Diamond a p)\"\n  and PFadmit_Context_simps[simp]: \"PFadmit \\<sigma> (InContext C p)\"\n  \ninductive Padmit:: \"subst \\<Rightarrow> hp \\<Rightarrow> bool\"\nand Fadmit:: \"subst \\<Rightarrow> formula \\<Rightarrow> bool\"\nwhere\n  Padmit_Pvar:\"Padmit \\<sigma> (Pvar a)\"\n| Padmit_Sequence:\"Padmit \\<sigma> a \\<Longrightarrow> Padmit \\<sigma> b \\<Longrightarrow> PUadmit \\<sigma> b (BVP (Psubst a \\<sigma>))\\<Longrightarrow> hpsafe (Psubst a \\<sigma>) \\<Longrightarrow> Padmit \\<sigma> (Sequence a b)\"  \n| Padmit_Loop:\"Padmit \\<sigma> a \\<Longrightarrow> PUadmit \\<sigma> a (BVP (Psubst a \\<sigma>)) \\<Longrightarrow> hpsafe (Psubst a \\<sigma>) \\<Longrightarrow> Padmit \\<sigma> (Loop a)\"        \n| Padmit_ODE:\"Oadmit \\<sigma> ODE (BVO ODE) \\<Longrightarrow> Fadmit \\<sigma> \\<phi> \\<Longrightarrow> FUadmit \\<sigma> \\<phi> (BVO ODE) \\<Longrightarrow> Padmit \\<sigma> (EvolveODE ODE \\<phi>)\"\n| Padmit_Choice:\"Padmit \\<sigma> a \\<Longrightarrow> Padmit \\<sigma> b \\<Longrightarrow> Padmit \\<sigma> (Choice a b)\"            \n| Padmit_Assign:\"Tadmit \\<sigma> \\<theta> \\<Longrightarrow> Padmit \\<sigma> (Assign x \\<theta>)\"  \n| Padmit_AssignAny:\" Padmit \\<sigma> (AssignAny x)\"  \n| Padmit_DiffAssign:\"Tadmit \\<sigma> \\<theta> \\<Longrightarrow> Padmit \\<sigma> (DiffAssign x \\<theta>)\"  \n| Padmit_Test:\"Fadmit \\<sigma> \\<phi> \\<Longrightarrow> Padmit \\<sigma> (Test \\<phi>)\"\n\n| Fadmit_Geq:\"Tadmit \\<sigma> \\<theta>1 \\<Longrightarrow> Tadmit \\<sigma> \\<theta>2 \\<Longrightarrow> Fadmit \\<sigma> (Geq \\<theta>1 \\<theta>2)\"\n| Fadmit_Prop1:\"(\\<forall>i. Tadmit \\<sigma> (args i)) \\<Longrightarrow> SPredicates \\<sigma> p = Some p' \\<Longrightarrow> NFadmit (\\<lambda> i. Tsubst (args i) \\<sigma>) p' \\<Longrightarrow> (\\<forall>i. dsafe (Tsubst (args i) \\<sigma>))\\<Longrightarrow> Fadmit \\<sigma> (Prop p args)\"\n| Fadmit_Prop2:\"(\\<forall>i. Tadmit \\<sigma> (args i)) \\<Longrightarrow> SPredicates \\<sigma> p = None \\<Longrightarrow> Fadmit \\<sigma> (Prop p args)\"\n| Fadmit_Not:\"Fadmit \\<sigma> \\<phi> \\<Longrightarrow> Fadmit \\<sigma> (Not \\<phi>)\"\n| Fadmit_And:\"Fadmit \\<sigma> \\<phi> \\<Longrightarrow> Fadmit \\<sigma> \\<psi> \\<Longrightarrow> Fadmit \\<sigma> (And \\<phi> \\<psi>)\"\n| Fadmit_Exists:\"Fadmit \\<sigma> \\<phi> \\<Longrightarrow> FUadmit \\<sigma> \\<phi> {Inl x} \\<Longrightarrow> Fadmit \\<sigma> (Exists x \\<phi>)\"\n| Fadmit_Diamond:\"Fadmit \\<sigma> \\<phi> \\<Longrightarrow> Padmit \\<sigma> a \\<Longrightarrow> FUadmit \\<sigma> \\<phi> (BVP (Psubst a \\<sigma>)) \\<Longrightarrow> hpsafe (Psubst a \\<sigma>) \\<Longrightarrow> Fadmit \\<sigma> (Diamond a \\<phi>)\"\n| Fadmit_Context1:\"Fadmit \\<sigma> \\<phi> \\<Longrightarrow> FUadmit \\<sigma> \\<phi> UNIV \\<Longrightarrow> SContexts \\<sigma> C = Some C' \\<Longrightarrow> PFadmit (\\<lambda> _. Fsubst \\<phi> \\<sigma>) C' \\<Longrightarrow> fsafe(Fsubst \\<phi> \\<sigma>) \\<Longrightarrow> Fadmit \\<sigma> (InContext C \\<phi>)\"\n| Fadmit_Context2:\"Fadmit \\<sigma> \\<phi> \\<Longrightarrow> FUadmit \\<sigma> \\<phi> UNIV \\<Longrightarrow> SContexts \\<sigma> C = None \\<Longrightarrow> Fadmit \\<sigma> (InContext C \\<phi>)\"\n  \ninductive_simps\n      Padmit_Pvar_simps[simp]: \"Padmit \\<sigma> (Pvar a)\"\n  and Padmit_Sequence_simps[simp]: \"Padmit \\<sigma> (a ;; b)\"\n  and Padmit_Loop_simps[simp]: \"Padmit \\<sigma> (a**)\"\n  and Padmit_ODE_simps[simp]: \"Padmit \\<sigma> (EvolveODE ODE p)\"\n  and Padmit_Choice_simps[simp]: \"Padmit \\<sigma> (a \\<union>\\<union> b)\"\n  and Padmit_Assign_simps[simp]: \"Padmit \\<sigma> (Assign x e)\"\n  and Padmit_AssignAny_simps[simp]: \"Padmit \\<sigma> (AssignAny x)\"\n  and Padmit_DiffAssign_simps[simp]: \"Padmit \\<sigma> (DiffAssign x e)\"\n  and Padmit_Test_simps[simp]: \"Padmit \\<sigma> (? p)\"\n  \n  and Fadmit_Geq_simps[simp]: \"Fadmit \\<sigma> (Geq t1 t2)\"\n  and Fadmit_Prop_simps[simp]: \"Fadmit \\<sigma> (Prop p args)\"\n  and Fadmit_Not_simps[simp]: \"Fadmit \\<sigma> (Not p)\"\n  and Fadmit_And_simps[simp]: \"Fadmit \\<sigma> (And p q)\"\n  and Fadmit_Exists_simps[simp]: \"Fadmit \\<sigma> (Exists x p)\"\n  and Fadmit_Diamond_simps[simp]: \"Fadmit \\<sigma> (Diamond a p)\"\n  and Fadmit_Context_simps[simp]: \"Fadmit \\<sigma> (InContext C p)\"\n    \nfun extendf :: \"interp \\<Rightarrow>  Rvec \\<Rightarrow> interp\"\nwhere \"extendf I R =\n\\<lparr>Functions = (\\<lambda>f. case args_to_id f of Some (Inl f') \\<Rightarrow> Functions I f | Some (Inr f') \\<Rightarrow> (\\<lambda>_. R $ f') | None \\<Rightarrow> Functions I f),\n Funls = (\\<lambda>f. case args_to_id f of Some (Inl f') \\<Rightarrow> Funls I f | Some (Inr f') \\<Rightarrow> (\\<lambda>_. R $ f')  | None \\<Rightarrow> Funls I f),\n Predicates = Predicates I,\n Contexts = Contexts I,\n Programs = Programs I,\n ODEs = ODEs I,\n ODEBV = ODEBV I\n \\<rparr>\"\n\nfun extendc :: \"interp \\<Rightarrow> state set \\<Rightarrow> interp\"\nwhere \"extendc I R =\n\\<lparr>Functions =  Functions I,\n Funls = Funls I,\n Predicates = Predicates I,\n Contexts = (\\<lambda>C. case args_to_id C of Some (Inl C') \\<Rightarrow> Contexts I C' | Some (Inr _) \\<Rightarrow> (\\<lambda>_.  R) | None \\<Rightarrow> Contexts I C),\n Programs = Programs I,\n ODEs = ODEs I,\n ODEBV = ODEBV I\\<rparr>\"\n\ndefinition adjoint :: \"interp \\<Rightarrow> subst \\<Rightarrow> state \\<Rightarrow> interp\" \nwhere adjoint_def:\"adjoint I \\<sigma> \\<nu> =\n\\<lparr>Functions =   (\\<lambda>f. case SFunctions \\<sigma> f of Some f' \\<Rightarrow> (\\<lambda>R. dterm_sem (extendf I R) f' \\<nu>) | None \\<Rightarrow> Functions I f),\n Funls =       (\\<lambda>f. case SFunls \\<sigma> f of Some f' \\<Rightarrow> (\\<lambda>R. dterm_sem I f' R) | None \\<Rightarrow> Funls I f),\n Predicates = (\\<lambda>p. case SPredicates \\<sigma> p of Some p' \\<Rightarrow> (\\<lambda>R. \\<nu> \\<in> fml_sem (extendf I R) p') | None \\<Rightarrow> Predicates I p),\n Contexts =   (\\<lambda>c. case SContexts \\<sigma> c of Some c' \\<Rightarrow> (\\<lambda>R. fml_sem (extendc I R) c') | None \\<Rightarrow> Contexts I c),\n Programs =   (\\<lambda>a. case SPrograms \\<sigma> a of Some a' \\<Rightarrow> prog_sem I a' | None \\<Rightarrow> Programs I a),\n ODEs =     (\\<lambda>ode sp. case SODEs \\<sigma> ode sp of Some ode' \\<Rightarrow> ODE_sem I ode' | None \\<Rightarrow> ODEs I ode sp),\n ODEBV = (\\<lambda>ode sp . case SODEs \\<sigma> ode sp of Some ode' \\<Rightarrow> ODE_vars I ode' | None \\<Rightarrow> ODEBV I ode sp)\n \\<rparr>\"\n\nlemma dsem_to_ssem:\"dfree \\<theta> \\<Longrightarrow> dterm_sem I \\<theta> \\<nu> = sterm_sem I \\<theta> (fst \\<nu>)\"\n    by (induct rule: dfree.induct) (auto)\n\ndefinition adjointFO::\"interp \\<Rightarrow> (ident \\<Rightarrow> trm) \\<Rightarrow> state \\<Rightarrow> interp\" \nwhere \"adjointFO I \\<sigma> \\<nu> =\n\\<lparr>Functions =   (\\<lambda>f. case args_to_id f of Some (Inl f') \\<Rightarrow> Functions I f | Some (Inr f') \\<Rightarrow> (\\<lambda>_. dterm_sem I (\\<sigma> f') \\<nu>) | None \\<Rightarrow> Functions I f),\n Funls =  (\\<lambda>f. case args_to_id f of Some (Inl f') \\<Rightarrow> Funls I f | Some (Inr f') \\<Rightarrow> (\\<lambda>_. dterm_sem I (\\<sigma> f') \\<nu>) | None \\<Rightarrow> Funls I f),\n Predicates = Predicates I,\n Contexts = Contexts I,\n Programs = Programs I,\n ODEs = ODEs I,\n ODEBV = ODEBV I\n \\<rparr>\"\n\nlemma adjoint_free:\n  assumes sfree:\"(\\<And>i f'. SFunctions \\<sigma> i = Some f' \\<Longrightarrow> dfree f')\"\n  shows \"adjoint I \\<sigma> \\<nu> =\n  \\<lparr>Functions =  (\\<lambda>f. case SFunctions \\<sigma> f of Some f' \\<Rightarrow> (\\<lambda>R. sterm_sem (extendf I R) f' (fst \\<nu>)) | None \\<Rightarrow> Functions I f),\n   Funls =  (\\<lambda>f. case SFunls \\<sigma> f of Some f' \\<Rightarrow> (\\<lambda>R. dterm_sem I f' R) | None \\<Rightarrow> Funls I f),\n   Predicates = (\\<lambda>p. case SPredicates \\<sigma> p of Some p' \\<Rightarrow> (\\<lambda>R. \\<nu> \\<in> fml_sem (extendf I R) p') | None \\<Rightarrow> Predicates I p),\n   Contexts =   (\\<lambda>c. case SContexts \\<sigma> c of Some c' \\<Rightarrow> (\\<lambda>R. fml_sem (extendc I R) c') | None \\<Rightarrow> Contexts I c),\n   Programs =   (\\<lambda>a. case SPrograms \\<sigma> a of Some a' \\<Rightarrow> prog_sem I a' | None \\<Rightarrow> Programs I a),\n   ODEs =     (\\<lambda>ode sp. case SODEs \\<sigma> ode sp of Some ode' \\<Rightarrow> ODE_sem I ode' | None \\<Rightarrow> ODEs I ode sp),\n   ODEBV = (\\<lambda>ode sp. case SODEs \\<sigma> ode sp of Some ode' \\<Rightarrow> ODE_vars I ode' | None \\<Rightarrow> ODEBV I ode sp)\\<rparr>\"\n  using dsem_to_ssem[OF sfree] \n  apply (cases \\<nu>)\n  by (auto simp add: adjoint_def fun_eq_iff   dsem_to_ssem sfree split: option.split)\n(*  subgoal for a b x x2\n(*   apply (simp add: dsem_to_ssem sfree)*)\n  using sfree[of x ]  sledgehammer*)\n                                                 \nlemma adjointFO_free:\"(\\<And>i. dfree (\\<sigma> i)) \\<Longrightarrow> (adjointFO I \\<sigma> \\<nu> =\n\\<lparr>Functions =   (\\<lambda>f. case args_to_id f of Some (Inl f') \\<Rightarrow> Functions I f | Some (Inr f') \\<Rightarrow> (\\<lambda>_. sterm_sem I (\\<sigma> f') (fst \\<nu>)) | None \\<Rightarrow> Functions I f),\n Funls =   (\\<lambda>f. case args_to_id f of Some (Inl f') \\<Rightarrow> Funls I f | Some (Inr f') \\<Rightarrow> (\\<lambda>_. sterm_sem I (\\<sigma> f') (fst \\<nu>)) | None \\<Rightarrow> Funls I f),\n Predicates = Predicates I,\n Contexts = Contexts I,\n Programs = Programs I,\n ODEs = ODEs I,\n ODEBV = ODEBV I\\<rparr>)\" \n  apply (auto simp add: dsem_to_ssem adjointFO_def)\n  using dsem_to_ssem by presburger+\n\ndefinition PFadjoint::\"interp \\<Rightarrow> (ident \\<Rightarrow> formula) \\<Rightarrow> interp\" \nwhere \"PFadjoint I \\<sigma> =\n\\<lparr>Functions =  Functions I,\n Funls =  Funls I,\n Predicates = Predicates I,\n Contexts = (\\<lambda>f. case args_to_id f of Some (Inl f') \\<Rightarrow> Contexts I f' | Some (Inr f') \\<Rightarrow> (\\<lambda>_. fml_sem I (\\<sigma> f')) | None \\<Rightarrow> Contexts I f),\n Programs = Programs I,\n ODEs = ODEs I,\n ODEBV = ODEBV I\\<rparr>\"\n\n\nfun Ssubst::\"sequent \\<Rightarrow> subst \\<Rightarrow> sequent\"\nwhere \"Ssubst (\\<Gamma>,\\<Delta>) \\<sigma> = (map (\\<lambda> \\<phi>. Fsubst \\<phi> \\<sigma>) \\<Gamma>, map (\\<lambda> \\<phi>. Fsubst \\<phi> \\<sigma>) \\<Delta>)\"\n  \nfun Rsubst::\"rule \\<Rightarrow> subst \\<Rightarrow> rule\"\nwhere \"Rsubst (SG,C) \\<sigma> = (map (\\<lambda> \\<phi>. Ssubst \\<phi> \\<sigma>) SG, Ssubst C \\<sigma>)\"\n\ndefinition Sadmit::\"subst \\<Rightarrow> sequent \\<Rightarrow> bool\"\nwhere \"Sadmit \\<sigma> S \\<longleftrightarrow> ((\\<forall>i. i \\<ge> 0 \\<longrightarrow> i < length (fst S) \\<longrightarrow> Fadmit \\<sigma> (nth (fst S) i))\n                      \\<and>(\\<forall>i. i \\<ge> 0 \\<longrightarrow> i < length (snd S) \\<longrightarrow> Fadmit \\<sigma> (nth (snd S) i)))\"\n\nlemma Sadmit_code[code]:\"Sadmit \\<sigma> (A,S) \\<longleftrightarrow> (list_all (Fadmit \\<sigma>) A \\<and> list_all (Fadmit \\<sigma>) S)\"\n  apply (auto simp add: Sadmit_def)\n  using list_all_length by blast+\n\n\ndefinition Radmit::\"subst \\<Rightarrow> rule \\<Rightarrow> bool\"\nwhere \"Radmit \\<sigma> R \\<longleftrightarrow> (((\\<forall>i. i \\<ge> 0 \\<longrightarrow> i < length (fst R) \\<longrightarrow> Sadmit \\<sigma> (nth (fst R) i)) \n                   \\<and> Sadmit \\<sigma> (snd R)))\"\n\nlemma Radmit_code[code]:\"\nRadmit \\<sigma> R \\<longleftrightarrow> (list_all (Sadmit \\<sigma>) (fst R) \\<and> Sadmit \\<sigma> (snd R))\"\n  apply (auto simp add: Radmit_def)\n  using list_all_length by blast+\n\n\nend", "meta": {"author": "LS-Lab", "repo": "Isabelle-dL", "sha": "97770ed9ca8d6a633c59d11d799247f44cc62dc2", "save_path": "github-repos/isabelle/LS-Lab-Isabelle-dL", "path": "github-repos/isabelle/LS-Lab-Isabelle-dL/Isabelle-dL-97770ed9ca8d6a633c59d11d799247f44cc62dc2/USubst.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.3082365543113072}}
{"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n *  Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Subtraction_Hoare\n  imports VHDL_Hoare_Complete Bits_Int_Aux\nbegin\n\ndatatype sig = A | B | C\n\ndefinition sub :: \"sig conc_stmt\" where\n  \"sub \\<equiv> process {A, B} : Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1\"\n\nlemma potential_tyenv:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1)\"\n  shows \"\\<exists>len1>0. \\<exists>len2>0. \\<Gamma> A = Lty Uns len1 \\<and> \\<Gamma> B = Lty Uns len2 \\<and> \\<Gamma> C = Lty Uns (max len1 len2)\n                   \\<or> \\<Gamma> A = Lty Sig len1 \\<and> \\<Gamma> B = Lty Sig len2 \\<and> \\<Gamma> C = Lty Sig (max len1 len2)\"\nproof (rule seq_wt_cases(4)[OF assms])\n  assume \"bexp_wt \\<Gamma> (Bsub (Bsig A) (Bsig B)) (\\<Gamma> C)\"\n  obtain len1 len2 where \" \\<Gamma> A = Lty Uns len1 \\<and> \\<Gamma> B = Lty Uns len2 \\<and> \\<Gamma> C = Lty Uns (max len1 len2)\n                              \\<or> \\<Gamma> A = Lty Sig len1 \\<and> \\<Gamma> B = Lty Sig len2 \\<and> \\<Gamma> C = Lty Sig (max len1 len2)\"\n      and \"0 < len1\" and \"0 < len2\"\n    apply (rule bexp_wt_cases_slice(6)[OF \\<open>bexp_wt \\<Gamma> (Bsub (Bsig A) (Bsig B)) (\\<Gamma> C)\\<close>])\n    by (metis bexp_wt_cases_slice(2))+\n  thus ?thesis\n    by auto\nqed\n\nlocale unsigned_subition =\n  fixes \\<Gamma> :: \"sig tyenv\"\n  fixes len len1 len2 :: nat\n  assumes len_def: \"len = max len1 len2\"\n  assumes atype: \"\\<Gamma> A = Lty Uns len1\" and btype: \"\\<Gamma> B = Lty Uns len2\" and ctype: \"\\<Gamma> C = Lty Uns len\"\n  assumes len1: \"0 < len1\" and len2: \"0 < len2\"\nbegin\n\nlemma well_typed:\n  \"seq_wt \\<Gamma> (Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1)\"\n  apply (rule seq_wt.intros(4))\n  unfolding ctype len_def apply (rule bexp_wt.intros(19))\n      apply (rule bexp_wt.intros(3))\n      apply (rule atype[symmetric])\n     apply (rule bexp_wt.intros)\n     apply (rule btype[symmetric])\n  using len1 len2 by auto\n\nabbreviation \"lof_wline tw sig n \\<equiv> lval_of (wline_of tw sig n)\"\n\ntext \\<open>Here we factor out common expression in both inv1 and inv2. It is parametrised by the index\nwe are interested with for C (first argument) and A (the second argument). Note that the index\nwe are interested with for A should be the same as the index for B.\\<close>\n\ndefinition property :: \"nat \\<Rightarrow> nat \\<Rightarrow> sig assn2\" where\n  \"property idxc idx =\n      (\\<lambda>tw. lof_wline tw C idxc =\n                  bin_to_bl len (bl_to_bin (lof_wline tw A idx) - bl_to_bin (lof_wline tw B idx)))\"\n\ndefinition inv :: \"sig assn2\" where\n  \"inv tw \\<equiv> (\\<forall>i < fst tw. property (i + 1) i tw)\"\n\ndefinition inv2 :: \"sig assn2\" where\n  \"inv2 tw \\<equiv> (disjnt {A, B} (event_of tw) \\<longrightarrow> (\\<forall>i \\<ge> fst tw. property (i + 1) (fst tw) tw))\"\n\nabbreviation \"next_world tw \\<equiv> (next_time_world tw, snd tw)\"\n\nlemma inv_next_time:\n  assumes \"inv tw\"\n  assumes \"beval_world_raw2 tw (Bsub (Bsig A) (Bsig B)) v\" and \"type_of v = Lty Uns len\"\n  defines \"tw' \\<equiv> tw[C, 1 :=\\<^sub>2 v]\"\n  shows   \"inv (next_time_world tw', snd tw')\"\n  unfolding inv_def\nproof (rule, rule)\n  fix i\n  assume \"i < fst (next_world tw')\"\n  hence \"i < next_time_world tw'\"\n    by auto\n  have \"fst tw' < next_time_world tw'\"\n    using next_time_world_at_least  using nat_less_le by blast\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  ultimately have \"fst tw < next_time_world tw'\"\n    by auto\n  hence \"i < fst tw \\<or> fst tw \\<le> i \\<and> i < next_time_world tw' - 1 \\<or> i = next_time_world tw' - 1\"\n    using \\<open>i < next_time_world tw'\\<close> by linarith\n  moreover\n  { assume \"i < fst tw\"\n    have \"lof_wline tw' C (i + 1) = lof_wline tw C (i + 1)\"\n      by (metis \\<open>i < get_time tw\\<close> add_mono1 tw'_def worldline_upd2_before_dly)\n    also have \"... = bin_to_bl len (bl_to_bin (lof_wline tw A i) - bl_to_bin (lof_wline tw B i))\"\n      using assms(1) \\<open>i < fst tw\\<close> unfolding inv_def property_def by auto\n    also have \"... = bin_to_bl len (bl_to_bin (lof_wline tw' A i) - bl_to_bin (lof_wline tw' B i))\"\n      by (metis \\<open>i < get_time tw\\<close> add.commute trans_less_add2 tw'_def worldline_upd2_before_dly)\n    finally have \"property (i + 1) i (next_time_world tw', snd tw')\"\n      unfolding property_def by auto }\n  moreover\n  { assume \"fst tw \\<le> i \\<and> i < next_time_world tw' - 1\"\n    hence \"fst tw \\<le> i\" and \"i < next_time_world tw' - 1\"\n      by auto\n    hence \"lof_wline tw' C (i + 1) = lof_wline tw' C (fst tw + 1)\"\n      using unchanged_until_next_time_world\n      by (metis (mono_tags, lifting) Suc_eq_plus1 \\<open>get_time tw = get_time tw'\\<close> le_Suc_eq le_add1\n          le_less_trans less_diff_conv)\n    moreover have \"lof_wline tw' A i = lof_wline tw' A (fst tw)\" and \"lof_wline tw' B i = lof_wline tw' B (fst tw)\"\n      using unchanged_until_next_time_world\n      by (metis \\<open>get_time tw = get_time tw'\\<close> \\<open>get_time tw \\<le> i\\<close> \\<open>i < next_time_world tw'\\<close>\n      less_add_one tw'_def worldline_upd2_before_dly)+\n    moreover have \"property (fst tw + 1) (fst tw) tw'\"\n    proof -\n      have assm2: \"beval_world_raw (snd tw) (fst tw) (Bsub (Bsig A) (Bsig B)) v\"\n        using assms(2) unfolding beval_world_raw2_def by auto\n      have \"wline_of tw' C (fst tw + 1) = v\"\n        unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n      also have \"... =  Lv Uns (bin_to_bl_aux len (bl_to_bin (lof_wline tw A (fst tw)) - bl_to_bin (lof_wline tw B (fst tw))) [])\"\n        apply (rule beval_world_raw_cases[OF assm2])\n        apply ( erule beval_cases)+\n        unfolding state_of_world_def using atype btype\n        apply (metis assms(3) bin_to_bl_def comp_def size_bin_to_bl ty.inject type_of.simps(2) val.sel(3))\n        using assms(3) by auto\n      also have \"... =  Lv Uns (bin_to_bl_aux len (bl_to_bin (lof_wline tw' A (fst tw)) - bl_to_bin (lof_wline tw' B (fst tw))) [])\"\n        by (metis Suc_eq_plus1 \\<open>lval_of (wline_of tw' A i) = lval_of (wline_of tw' A (get_time tw))\\<close>\n        \\<open>lval_of (wline_of tw' B i) = lval_of (wline_of tw' B (get_time tw))\\<close> lessI tw'_def\n        worldline_upd2_before_dly)\n      finally show ?thesis\n        unfolding property_def bin_to_bl_def by auto\n    qed\n    ultimately have \"property (i + 1) i (next_world tw')\"\n      unfolding property_def by auto }\n  moreover\n  { assume \"i = next_time_world tw' - 1\"\n    hence \"lof_wline tw' C (i + 1) = lof_wline tw' C (next_time_world tw')\"\n      using \\<open>i < next_time_world tw'\\<close> by force\n    also have \"... = lof_wline tw' C (fst tw + 1)\"\n      using \\<open>fst tw < next_time_world tw'\\<close> unfolding tw'_def worldline_upd2_def\n      worldline_upd_def by auto\n    finally have \"lof_wline tw' C (i + 1) = lof_wline tw' C (fst tw + 1)\"\n      by auto\n    moreover have \"property (fst tw + 1) (fst tw) tw'\"\n    proof -\n      have assm2: \"beval_world_raw (snd tw) (fst tw) (Bsub (Bsig A) (Bsig B)) v\"\n        using assms(2) unfolding beval_world_raw2_def by auto\n      have \"wline_of tw' C (fst tw + 1) = v\"\n        unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n      also have \"... =  Lv Uns (bin_to_bl_aux len (bl_to_bin (lof_wline tw A (fst tw)) - bl_to_bin (lof_wline tw B (fst tw))) [])\"\n        apply (rule beval_world_raw_cases[OF assm2])\n        apply ( erule beval_cases)+\n        unfolding state_of_world_def using atype btype\n        apply (metis assms(3) bin_to_bl_def comp_def size_bin_to_bl ty.inject type_of.simps(2) val.sel(3))\n        using assms(3) by auto\n      also have \"... =  Lv Uns (bin_to_bl_aux len (bl_to_bin (lof_wline tw' A (fst tw)) - bl_to_bin (lof_wline tw' B (fst tw))) [])\"\n        by (metis less_add_one tw'_def worldline_upd2_before_dly)\n      finally show ?thesis\n        unfolding property_def bin_to_bl_def by auto\n    qed\n    moreover have \"lof_wline tw' A i = lof_wline tw' A (fst tw)\" and \"lof_wline tw' B i = lof_wline tw' B (fst tw)\"\n      using unchanged_until_next_time_world\n      by (metis \\<open>get_time tw < next_time_world tw'\\<close> \\<open>get_time tw = get_time tw'\\<close> \\<open>i <\n      next_time_world tw'\\<close> \\<open>i = next_time_world tw' - 1\\<close> add_le_imp_le_diff discrete)+\n    ultimately have \"property (i + 1) i (next_world tw')\"\n      unfolding property_def by auto }\n  ultimately show \"property (i + 1) i (next_world tw')\"\n    by auto\nqed\n\nlemma type_correctness_length:\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  assumes \"beval_world_raw2 tw (Bsub (Bsig A) (Bsig B)) v\"\n  shows   \"type_of v = Lty Uns len\"\nproof -\n  have \"beval_world_raw (snd tw) (fst tw) (Bsub (Bsig A) (Bsig B)) v\"\n    using assms(2) unfolding beval_world_raw2_def by auto\n  have \"type_of (state_of_world (snd tw) (fst tw) A) = Lty Uns len1\" and\n       \"type_of (state_of_world (snd tw) (fst tw) B) = Lty Uns len2\"\n    using assms(1) unfolding wityping_def\n    by (simp add: atype btype state_of_world_def wtyping_def)+\n  show ?thesis\n    apply (rule beval_world_raw_cases[OF \\<open>beval_world_raw (snd tw) (fst tw) (Bsub (Bsig A) (Bsig B)) v\\<close>])\n    apply (erule beval_cases)\n    apply (metis (no_types, lifting) \\<open>type_of (state_of_world (snd tw) (get_time tw) A) = Lty Uns len1\\<close> \\<open>type_of (state_of_world (snd tw) (get_time tw) B) = Lty Uns len2\\<close> add.right_neutral beval_cases(1) len_def list.size(3) size_bin_to_bl_aux ty.inject type_of.simps(2))\n    by  (metis (no_types, hide_lams) \\<open>type_of (state_of_world (snd tw) (get_time tw) A) = Lty Uns len1\\<close> beval_cases(1) signedness.distinct(5) ty.inject type_of.simps(2))\nqed\n\nlemma sub_seq_hoare_next_time:\n  \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1\n     [\\<lambda>tw. inv (next_world tw)]\"\n  apply (rule Conseq2[where Q=\"\\<lambda>tw. inv (next_world tw) \\<and> wityping \\<Gamma> (snd tw)\", rotated 1], rule Assign2, simp)\n  using inv_next_time type_correctness_length\n  by (metis ctype snd_conv worldline_upd2_def worldline_upd_preserve_wityping)\n\nlemma aux:\n  \"\\<And>tw. inv (next_world tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)\"\n  unfolding inv_def property_def by auto\n\nlemma sub_seq_hoare_next_time_post:\n  \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1\n     [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)]\"\n  apply (rule Conseq2[rotated])\n    apply (rule sub_seq_hoare_next_time)\n  by (auto simp add: aux)\n\nlemma sub_seq_hoare_next_time0:\n  \"\\<turnstile> [\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1\n     [\\<lambda>tw. inv (next_world tw)]\"\n  apply (rule Conseq2[where Q=\"\\<lambda>tw. inv (next_world tw) \\<and> wityping \\<Gamma> (snd tw)\", rotated 1], rule Assign2, simp)\n  using inv_next_time type_correctness_length unfolding inv_def\n  by (metis ctype gr_implies_not0 snd_conv worldline_upd2_def worldline_upd_preserve_wityping)\n\nlemma sub_conc_hoare:\n  \"\\<And>tw. inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw) \\<Longrightarrow> inv (next_world tw)\"\nproof -\n  fix tw\n  assume \"inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw)\"\n  hence \"inv tw\" and \"inv2 tw\" and \"disjnt {A, B} (event_of tw)\"\n    by auto\n  { fix i\n    assume \"i < next_time_world tw\"\n    have \"fst tw < next_time_world tw\"\n      by (simp add: next_time_world_at_least)\n    have \"i < fst tw \\<or> fst tw \\<le> i\"\n      by auto\n    moreover\n    { assume \"i < fst tw\"\n      hence \"property (i + 1) i tw\"\n        using \\<open>inv tw\\<close> unfolding inv_def by auto\n      hence \"property (i + 1) i (next_world tw)\"\n        unfolding property_def by simp }\n    moreover\n    { assume \"fst tw \\<le> i\"\n      moreover have \"\\<forall>i \\<ge> fst tw. property (i + 1) (fst tw) tw\"\n        using \\<open>inv2 tw\\<close> \\<open>disjnt {A, B} (event_of tw)\\<close> unfolding inv2_def\n        by auto\n      ultimately have \"property (i + 1) (fst tw) tw\"\n        by auto\n      hence \"property (i + 1) i tw\"\n        unfolding property_def\n        by (metis \\<open>get_time tw \\<le> i\\<close> \\<open>i < next_time_world tw\\<close> unchanged_until_next_time_world)\n      hence \"property (i + 1) i (next_world tw)\"\n        unfolding property_def by auto }\n    ultimately have \"property (i + 1) i (next_world tw)\"\n      by auto }\n  thus \"inv (next_world tw)\"\n    unfolding inv_def by auto\nqed\n\nlemma sub_conc_hoare2:\n  \"\\<And>tw. inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv2 (j, snd tw)\"\nproof (rule)\n  fix tw :: \"nat \\<times> (sig \\<Rightarrow> val) \\<times> (sig \\<Rightarrow> nat \\<Rightarrow> val)\"\n  fix j\n  assume \"j \\<in> {fst tw <.. next_time_world tw}\"\n  assume \"inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw)\"\n  hence \"inv tw\" and \"inv2 tw\" and \"disjnt {A, B} (event_of tw)\"\n    by auto\n  let ?t' = \"j\"\n  { assume \"disjnt {A, B} (event_of (j, snd tw))\"\n    hence *: \"lof_wline tw A ?t' = lof_wline tw A (?t' - 1)\" and **: \"lof_wline tw B ?t' = lof_wline tw B (?t' - 1)\"\n      unfolding event_of_alt_def\n      by (smt comp_apply diff_0_eq_0 disjnt_insert1 fst_conv mem_Collect_eq snd_conv)+\n    have \"fst tw < ?t'\"\n      using \\<open>j \\<in> {get_time tw<..next_time_world tw}\\<close> by auto\n    { fix i\n      assume \"?t' \\<le> i\"\n      have \"property (i + 1) (fst tw) tw\"\n        using \\<open>inv2 tw\\<close> \\<open>disjnt {A, B} (event_of tw)\\<close> unfolding inv2_def\n        using \\<open>get_time tw < j\\<close> \\<open>j \\<le> i\\<close> by auto\n      moreover have \"lof_wline tw A (fst tw) = lof_wline tw A (?t' - 1)\" and\n                    \"lof_wline tw B (fst tw) = lof_wline tw B (?t' - 1)\"\n        by (metis (no_types, lifting) One_nat_def Suc_eq_plus1 \\<open>j \\<in> {get_time tw<..next_time_world\n        tw}\\<close> add_le_imp_le_diff diff_add discrete gr_implies_not0 greaterThanAtMost_iff\n        not_less_iff_gr_or_eq unchanged_until_next_time_world)+\n      ultimately have \"property (i + 1) ?t' (j, snd tw)\"\n        unfolding property_def using * **  by auto }\n    hence \"\\<forall>i\\<ge>?t'. property (i + 1) ?t' (j, snd tw)\"\n      by auto }\n  thus \"inv2 (j, snd tw)\"\n    unfolding inv2_def by auto\nqed\n\nlemma inv2_next_time:\n  fixes tw\n  assumes \"beval_world_raw2 tw (Bsub (Bsig A) (Bsig B)) v\" and \"type_of v = Lty Uns len\"\n  defines \"tw' \\<equiv> tw[C, 1 :=\\<^sub>2 v]\"\n  shows   \"\\<forall>j \\<in> {fst tw' <.. next_time_world tw'}. inv2 (j, snd tw')\"\n  unfolding inv2_def\nproof (rule, rule, rule, rule)\n  fix i j\n  assume \"j \\<in> {fst tw' <..next_time_world tw'}\"\n  assume \"disjnt {A, B} (event_of (j, snd tw'))\"\n  hence \"A \\<notin> event_of (j, snd tw')\" and \"B \\<notin> event_of (j, snd tw')\"\n    by auto\n  assume \"fst (j, snd tw') \\<le> i\"\n  hence \"j \\<le> i\"\n    by auto\n  let ?t' = j\n  have \"fst tw' < ?t'\"\n    by (metis \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close> fst_conv greaterThanAtMost_iff tw'_def\n    worldline_upd2_def)\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def unfolding worldline_upd2_def by auto\n  ultimately have \"fst tw < ?t'\"\n    by auto\n  have 0: \"wline_of (next_world tw') A ?t' = wline_of tw A (fst tw)\"\n  proof -\n    have \"wline_of tw' A ?t' = wline_of tw' A (?t' - 1)\"\n      using \\<open>A \\<notin> event_of (j, snd tw')\\<close> unfolding event_of_alt_def\n      using \\<open>get_time tw' < j\\<close> by auto\n    also have \" ... = wline_of tw' A (fst tw')\"\n      using unchanged_until_next_time_world\n      by (smt Suc_diff_1 \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close> fst_conv gr_implies_not_zero\n      greaterThanAtMost_iff le_0_eq not_less not_less_eq_eq o_apply prod.sel(2) sig.simps(4) tw'_def\n      worldline_upd2_def worldline_upd_def)\n    also have \"... = wline_of tw' A (fst tw)\"\n      by (simp add: \\<open>get_time tw = get_time tw'\\<close>)\n    also have \"... = wline_of tw A (fst tw)\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    finally show \"wline_of (next_world tw') A ?t' = wline_of tw A (fst tw)\"\n      by auto\n  qed\n  have 1: \"wline_of (next_world tw') B ?t' = wline_of tw B (fst tw)\"\n  proof -\n    have \"wline_of tw' B ?t' = wline_of tw' B (?t' - 1)\"\n      using \\<open>B \\<notin> event_of (j, snd tw')\\<close> unfolding event_of_alt_def\n      using \\<open>get_time tw' < j\\<close> by auto\n    also have \" ... = wline_of tw' B (fst tw')\"\n      using unchanged_until_next_time_world\n      by (smt Suc_diff_1 \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close> comp_apply fst_conv\n      gr_implies_not_zero greaterThanAtMost_iff le_0_eq not_less not_less_eq_eq sig.simps(6)\n      snd_conv tw'_def worldline_upd2_def worldline_upd_def)\n    also have \"... = wline_of tw' B (fst tw)\"\n      by (simp add: \\<open>get_time tw = get_time tw'\\<close>)\n    also have \"... = wline_of tw B (fst tw)\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    finally show \"wline_of (next_world tw') B ?t' = wline_of tw B (fst tw)\"\n      by auto\n  qed\n  have assm2: \"beval_world_raw (snd tw) (fst tw) (Bsub (Bsig A) (Bsig B)) v\"\n    using assms(1) unfolding beval_world_raw2_def by auto\n  have \"wline_of (next_world tw') C (i + 1) = v\"\n  proof -\n    have \"wline_of tw' C (i + 1) = v\"\n      using `fst tw < ?t'` \\<open>?t' \\<le> i\\<close>\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    thus ?thesis\n      by auto\n  qed\n  also have \"lval_of ... = bin_to_bl len (bl_to_bin (lof_wline tw A (fst tw)) - bl_to_bin (lof_wline tw B (fst tw)))\"\n    apply (rule beval_world_raw_cases[OF assm2])\n    apply (erule beval_cases)+\n    apply (metis assms(2) beval_raw.intros(1) beval_world_raw.simps beval_world_raw2_Bsig beval_world_raw2_def beval_world_raw_deterministic bin_to_bl_def size_bin_to_bl ty.inject type_of.simps(2) val.sel(3))\n    using assms(2) by auto\n  finally have \"property (i + 1) ?t' (j, snd tw')\"\n    unfolding property_def using 0 1  by auto\n  thus \"property (i + 1) (get_time (j, snd tw')) (j, snd tw')\"\n    by auto\nqed\n\nlemma sub_seq_hoare_next_time1:\n  shows \"\\<turnstile> [\\<lambda>tw. wityping \\<Gamma> (snd tw)] \n              Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1 \n           [\\<lambda>tw. \\<forall>j \\<in> {fst tw <..next_time_world tw}. inv2 (j, snd tw)]\"\n  apply (rule Assign2_altI)\n  using inv2_next_time type_correctness_length by auto\n\nlemma sub_conc_hoare3:\n  \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n          sub \n     \\<lbrace>\\<lambda>tw. \\<forall>j \\<in> {fst tw <..next_time_world tw}. inv (j, snd tw) \\<and> inv2 (j, snd tw)\\<rbrace>\"\n  unfolding sub_def\n  apply (rule Single)\n   apply (rule Conj_univ_qtfd)\n    apply (rule Conseq2[rotated])\n      apply (rule sub_seq_hoare_next_time_post, simp, simp)\n  apply (rule Conseq2[rotated])\n     apply (rule sub_seq_hoare_next_time1, simp, simp)\n  using sub_conc_hoare aux sub_conc_hoare2 by blast\n\nlemma seq_wt_sub:\n  \"seq_wt \\<Gamma> (Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1)\"\n  using well_typed by blast\n\nlemma sub_conc_hoare4:\n  \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n        sub \n     \\<lbrace>\\<lambda>tw. \\<forall>i\\<in>{get_time tw<..next_time_world tw}. (local.inv (i, snd tw) \\<and> inv2 (i, snd tw)) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule Conj2_univ_qtfd[where R=\"\\<lambda>tw. wityping \\<Gamma> (snd tw)\", unfolded snd_conv])\n  apply (rule sub_conc_hoare3)\n  apply (rule strengthen_pre_conc_hoare[rotated])\n  apply (rule weaken_post_conc_hoare[rotated])\n    apply (unfold sub_def, rule single_conc_stmt_preserve_wityping_hoare)\n    apply (rule seq_wt_sub)\n  by auto \n\nlemma sub_conc_sim':\n  \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n        sub \n      \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule While)\n  apply (unfold snd_conv, rule sub_conc_hoare4)\n  done\n\nlemma sub_conc_sim2:\n  \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> sub \\<lbrace>inv\\<rbrace>\"\n  using sub_conc_sim' Conseq_sim by blast\n\nlemma init_sat_sub_inv:\n  \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) sub (\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw))\"\n  unfolding sub_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conj)\n  unfolding snd_conv apply(rule sub_seq_hoare_next_time0)\n  apply (rule strengthen_precondition2)\n  by (metis seq_stmt_preserve_wityping_hoare well_typed)\n\nlemma init_sat_sub_inv2:\n  \"init_sim_hoare (\\<lambda>tw. wityping \\<Gamma> (snd tw)) sub inv2\"\n  unfolding sub_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conseq2[rotated])\n  apply (rule sub_seq_hoare_next_time1)\n  by    (auto simp add: next_time_world_at_least)\n\nlemma init_sat_sub_inv_comb:\n  shows \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) sub  (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n  apply (rule ConjI_sim)\n  apply (rule init_sat_sub_inv)\n  apply (rule ConseqI_sim[rotated])\n  apply (rule init_sat_sub_inv2)\n  by blast+\n\nlemma sub_correctness:\n  assumes \"sim_fin w (i + 1) sub tw'\" and \"wityping \\<Gamma> w\"\n  shows   \"property (i + 1) i tw'\"\nproof -\n  obtain tw where \"init_sim (0, w) sub tw\" and  \"tw, i + 1, sub \\<Rightarrow>\\<^sub>S tw'\"\n    using premises_sim_fin_obt[OF assms(1)] by auto\n  hence \"i + 1 = fst tw'\"\n    using world_maxtime_lt_fst_tres  by blast\n  have \"conc_stmt_wf sub\"\n    unfolding conc_stmt_wf_def sub_def by auto\n  moreover have \"nonneg_delay_conc sub\"\n    unfolding sub_def by auto\n  ultimately have \"init_sim_valid (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) sub (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n    using init_sim_hoare_soundness[OF init_sat_sub_inv_comb]\n    by (metis (no_types, lifting) conc_wt_cases(1) init_sat_sub_inv_comb\n    init_sim_hoare_soundness sub_def strengthen_precondition_init_sim_hoare)\n  hence \"inv tw \\<and> wityping \\<Gamma> (snd tw) \\<and> inv2 tw\"\n    using \\<open>init_sim (0, w) sub tw\\<close> fst_conv assms(2) unfolding init_sim_valid_def\n    by (metis snd_conv)\n  hence \"inv tw\" and \"inv2 tw\" and \"wityping \\<Gamma> (snd tw)\"\n    by auto\n  moreover have \" \\<Turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (local.inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> sub \\<lbrace>local.inv\\<rbrace>\"\n    using conc_sim_soundness[OF sub_conc_sim2] \\<open>conc_stmt_wf sub\\<close> \\<open>nonneg_delay_conc sub\\<close>\n    by auto\n  ultimately have \"inv tw'\"\n    using \\<open>tw, i + 1, sub \\<Rightarrow>\\<^sub>S tw'\\<close> unfolding sim_hoare_valid_def by blast\n  with \\<open>i + 1 = fst tw'\\<close> show ?thesis\n    unfolding inv_def by (metis less_add_one)\nqed\n\ncorollary sub_correctness2:\n  assumes \"sim_fin w (i + 1) sub tw'\" and \"wityping \\<Gamma> w\"\n  defines \"bsA \\<equiv> lof_wline tw' A i\"\n  defines \"bsB \\<equiv> lof_wline tw' B i\"\n  defines \"bsC \\<equiv> lof_wline tw' C (i + 1)\"\n  shows   \"(\\<Sum>i = 0..<length bsC. (int \\<circ> of_bool) (rev bsC ! i) * 2 ^ i) =\n          ((\\<Sum>i = 0..<length bsA. (int \\<circ> of_bool) (rev bsA ! i) * 2 ^ i) -\n           (\\<Sum>i = 0..<length bsB. (int \\<circ> of_bool) (rev bsB ! i) * 2 ^ i) ) mod 2 ^ len \"\nproof -\n  have \"property (i + 1) i tw'\"\n    using sub_correctness[OF assms(1-2)] by auto\n  hence \"lof_wline tw' C (i + 1) =\n                  bin_to_bl len (bl_to_bin (lof_wline tw' A i) - bl_to_bin (lof_wline tw' B i))\"\n    unfolding property_def by auto\n  hence \"bsC = bin_to_bl len (bl_to_bin bsA - bl_to_bin bsB)\" (is \"_ = ?rhs\")\n    unfolding bsA_def bsB_def bsC_def by auto\n  hence \"bl_to_bin bsC = bl_to_bin ?rhs\"\n    by auto\n  also have \"... = bintrunc len (bl_to_bin bsA - bl_to_bin bsB)\"\n    unfolding bin_bl_bin by auto\n  also have \"... = (bl_to_bin bsA - bl_to_bin bsB) mod 2 ^ len\"\n    unfolding bintrunc_mod2p by auto\n  finally have \"bl_to_bin bsC = (bl_to_bin bsA - bl_to_bin bsB) mod 2 ^ len\"\n    by auto\n  thus ?thesis\n    unfolding bl_to_bin_correctness by auto\nqed\n\nend\n\nlocale signed_addition =\n  fixes \\<Gamma> :: \"sig tyenv\"\n  fixes len len1 len2 :: nat\n  assumes len_def: \"len = max len1 len2\"\n  assumes atype: \"\\<Gamma> A = Lty Sig len1\" and btype: \"\\<Gamma> B = Lty Sig len2\" and ctype: \"\\<Gamma> C = Lty Sig len\"\n  assumes len1: \"0 < len1\" and len2: \"0 < len2\"\nbegin\n\nlemma well_typed:\n  \"seq_wt \\<Gamma> (Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1)\"\n  by (rule seq_wt.intros(4))\n     (metis atype bexp_wt.intros(20) bexp_wt.intros(3) btype ctype len_def len1 len2)\n\nabbreviation \"lof_wline tw sig n \\<equiv> lval_of (wline_of tw sig n)\"\n\ntext \\<open>Here we factor out common expression in both inv1 and inv2. It is parametrised by the index\nwe are interested with for C (first argument) and A (the second argument). Note that the index\nwe are interested with for A should be the same as the index for B.\\<close>\n\ndefinition property :: \"nat \\<Rightarrow> nat \\<Rightarrow> sig assn2\" where\n  \"property idxc idx =\n      (\\<lambda>tw. lof_wline tw C idxc =\n                  bin_to_bl len (sbl_to_bin (lof_wline tw A idx) - sbl_to_bin (lof_wline tw B idx)))\"\n\ndefinition inv :: \"sig assn2\" where\n  \"inv tw \\<equiv> (\\<forall>i < fst tw. property (i + 1) i tw)\"\n\ndefinition inv2 :: \"sig assn2\" where\n  \"inv2 tw \\<equiv> (disjnt {A, B} (event_of tw) \\<longrightarrow> (\\<forall>i \\<ge> fst tw. property (i + 1) (fst tw) tw))\"\n\nabbreviation \"next_world tw \\<equiv> (next_time_world tw, snd tw)\"\n\nlemma inv_next_time:\n  assumes \"inv tw\"\n  assumes \"beval_world_raw2 tw (Bsub (Bsig A) (Bsig B)) v\" and \"type_of v = Lty Sig len\"\n  defines \"tw' \\<equiv> tw[C, 1 :=\\<^sub>2 v]\"\n  shows   \"inv (next_time_world tw', snd tw')\"\n  unfolding inv_def\nproof (rule, rule)\n  fix i\n  assume \"i < fst (next_world tw')\"\n  hence \"i < next_time_world tw'\"\n    by auto\n  have \"fst tw' < next_time_world tw'\"\n    using next_time_world_at_least  using nat_less_le by blast\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  ultimately have \"fst tw < next_time_world tw'\"\n    by auto\n  hence \"i < fst tw \\<or> fst tw \\<le> i \\<and> i < next_time_world tw' - 1 \\<or> i = next_time_world tw' - 1\"\n    using \\<open>i < next_time_world tw'\\<close> by linarith\n  moreover\n  { assume \"i < fst tw\"\n    have \"lof_wline tw' C (i + 1) = lof_wline tw C (i + 1)\"\n      by (metis \\<open>i < get_time tw\\<close> add_mono1 tw'_def worldline_upd2_before_dly)\n    also have \"... = bin_to_bl len (sbl_to_bin (lof_wline tw A i) - sbl_to_bin (lof_wline tw B i))\"\n      using assms(1) \\<open>i < fst tw\\<close> unfolding inv_def property_def by auto\n    also have \"... = bin_to_bl len (sbl_to_bin (lof_wline tw' A i) - sbl_to_bin (lof_wline tw' B i))\"\n      by (metis \\<open>i < get_time tw\\<close> add.commute trans_less_add2 tw'_def worldline_upd2_before_dly)\n    finally have \"property (i + 1) i (next_time_world tw', snd tw')\"\n      unfolding property_def by auto }\n  moreover\n  { assume \"fst tw \\<le> i \\<and> i < next_time_world tw' - 1\"\n    hence \"fst tw \\<le> i\" and \"i < next_time_world tw' - 1\"\n      by auto\n    hence \"lof_wline tw' C (i + 1) = lof_wline tw' C (fst tw + 1)\"\n      using unchanged_until_next_time_world\n      by (metis (mono_tags, lifting) Suc_eq_plus1 \\<open>get_time tw = get_time tw'\\<close> le_Suc_eq le_add1\n          le_less_trans less_diff_conv)\n    moreover have \"lof_wline tw' A i = lof_wline tw' A (fst tw)\" and \"lof_wline tw' B i = lof_wline tw' B (fst tw)\"\n      using unchanged_until_next_time_world\n      by (metis \\<open>get_time tw = get_time tw'\\<close> \\<open>get_time tw \\<le> i\\<close> \\<open>i < next_time_world tw'\\<close>\n      less_add_one tw'_def worldline_upd2_before_dly)+\n    moreover have \"property (fst tw + 1) (fst tw) tw'\"\n    proof -\n      have assm2: \"beval_world_raw (snd tw) (fst tw) (Bsub (Bsig A) (Bsig B)) v\"\n        using assms(2) unfolding beval_world_raw2_def by auto\n      have \"wline_of tw' C (fst tw + 1) = v\"\n        unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n      also have \"... =  Lv Sig (bin_to_bl_aux len (sbl_to_bin (lof_wline tw A (fst tw)) - sbl_to_bin (lof_wline tw B (fst tw))) [])\"\n        apply (rule beval_world_raw_cases[OF assm2])\n        apply ( erule beval_cases)\n        defer\n        apply ( erule beval_cases)+\n        unfolding state_of_world_def using atype btype\n        apply (metis assms(3) bin_to_bl_def comp_apply size_bin_to_bl ty.inject type_of.simps(2) val.sel(3))\n        using assms(3) by auto\n      also have \"... =  Lv Sig (bin_to_bl_aux len (sbl_to_bin (lof_wline tw' A (fst tw)) - sbl_to_bin (lof_wline tw' B (fst tw))) [])\"\n        by (metis Suc_eq_plus1 \\<open>lval_of (wline_of tw' A i) = lval_of (wline_of tw' A (get_time tw))\\<close>\n        \\<open>lval_of (wline_of tw' B i) = lval_of (wline_of tw' B (get_time tw))\\<close> lessI tw'_def\n        worldline_upd2_before_dly)\n      finally show ?thesis\n        unfolding property_def bin_to_bl_def by auto\n    qed\n    ultimately have \"property (i + 1) i (next_world tw')\"\n      unfolding property_def by auto }\n  moreover\n  { assume \"i = next_time_world tw' - 1\"\n    hence \"lof_wline tw' C (i + 1) = lof_wline tw' C (next_time_world tw')\"\n      using \\<open>i < next_time_world tw'\\<close> by force\n    also have \"... = lof_wline tw' C (fst tw + 1)\"\n      using \\<open>fst tw < next_time_world tw'\\<close> unfolding tw'_def worldline_upd2_def\n      worldline_upd_def by auto\n    finally have \"lof_wline tw' C (i + 1) = lof_wline tw' C (fst tw + 1)\"\n      by auto\n    moreover have \"property (fst tw + 1) (fst tw) tw'\"\n    proof -\n      have assm2: \"beval_world_raw (snd tw) (fst tw) (Bsub (Bsig A) (Bsig B)) v\"\n        using assms(2) unfolding beval_world_raw2_def by auto\n      have \"wline_of tw' C (fst tw + 1) = v\"\n        unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n      also have \"... =  Lv Sig (bin_to_bl_aux len (sbl_to_bin (lof_wline tw A (fst tw)) - sbl_to_bin (lof_wline tw B (fst tw))) [])\"\n        apply (rule beval_world_raw_cases[OF assm2])\n        apply ( erule beval_cases)\n        defer\n        apply ( erule beval_cases)+\n        unfolding state_of_world_def using atype btype\n        apply (metis assms(3) bin_to_bl_def comp_def size_bin_to_bl ty.inject type_of.simps(2) val.sel(3))\n        using assms(3) by auto\n      also have \"... =  Lv Sig (bin_to_bl_aux len (sbl_to_bin (lof_wline tw' A (fst tw)) - sbl_to_bin (lof_wline tw' B (fst tw))) [])\"\n        by (metis less_add_one tw'_def worldline_upd2_before_dly)\n      finally show ?thesis\n        unfolding property_def bin_to_bl_def by auto\n    qed\n    moreover have \"lof_wline tw' A i = lof_wline tw' A (fst tw)\" and \"lof_wline tw' B i = lof_wline tw' B (fst tw)\"\n      using unchanged_until_next_time_world\n      by (metis \\<open>get_time tw < next_time_world tw'\\<close> \\<open>get_time tw = get_time tw'\\<close> \\<open>i <\n      next_time_world tw'\\<close> \\<open>i = next_time_world tw' - 1\\<close> add_le_imp_le_diff discrete)+\n    ultimately have \"property (i + 1) i (next_world tw')\"\n      unfolding property_def by auto }\n  ultimately show \"property (i + 1) i (next_world tw')\"\n    by auto\nqed\n\nlemma type_correctness_length:\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  assumes \"beval_world_raw2 tw (Bsub (Bsig A) (Bsig B)) v\"\n  shows   \"type_of v = Lty Sig len\"\nproof -\n  have \"beval_world_raw (snd tw) (fst tw) (Bsub (Bsig A) (Bsig B)) v\"\n    using assms(2) unfolding beval_world_raw2_def by auto\n  have \"type_of (state_of_world (snd tw) (fst tw) A) = Lty Sig len1\" and\n       \"type_of (state_of_world (snd tw) (fst tw) B) = Lty Sig len2\"\n    using assms(1) unfolding wityping_def\n    by (simp add: atype btype state_of_world_def wtyping_def)+\n  show ?thesis\n    apply (rule beval_world_raw_cases[OF \\<open>beval_world_raw (snd tw) (fst tw) (Bsub (Bsig A) (Bsig B)) v\\<close>])\n    apply (erule beval_cases)\n    apply (metis (no_types, hide_lams) \\<open>type_of (state_of_world (snd tw) (get_time tw) A) = Lty Sig len1\\<close> beval_cases(1) signedness.distinct(5) ty.inject type_of.simps(2))\n    apply (metis \\<open>type_of (state_of_world (snd tw) (get_time tw) A) = Lty Sig len1\\<close> \\<open>type_of (state_of_world (snd tw) (get_time tw) B) = Lty Sig len2\\<close> beval_cases(1) bin_to_bl_def len_def size_bin_to_bl ty.inject type_of.simps(2) val.sel(3))\n    done\nqed\n\nlemma sub_seq_hoare_next_time:\n  \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1\n     [\\<lambda>tw. inv (next_world tw)]\"\n  apply (rule Conseq2[where Q=\"\\<lambda>tw. inv (next_world tw) \\<and> wityping \\<Gamma> (snd tw)\", rotated 1], rule Assign2, simp)\n  using inv_next_time type_correctness_length\n  by (metis ctype snd_conv worldline_upd2_def worldline_upd_preserve_wityping)\n\nlemma aux:\n  \"\\<And>tw. inv (next_world tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)\"\n  unfolding inv_def property_def by auto\n\nlemma sub_seq_hoare_next_time_post:\n  \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1\n     [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)]\"\n  apply (rule Conseq2[rotated])\n    apply (rule sub_seq_hoare_next_time)\n  by (auto simp add: aux)\n\nlemma seq_hoare_next_time0:\n  \"\\<turnstile> [\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)]\n        Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1\n     [\\<lambda>tw. inv (next_world tw)]\"\n  apply (rule Conseq2[where Q=\"\\<lambda>tw. inv (next_world tw) \\<and> wityping \\<Gamma> (snd tw)\", rotated 1], rule Assign2, simp)\n  using inv_next_time type_correctness_length unfolding inv_def\n  by (metis ctype gr_implies_not0 snd_conv worldline_upd2_def worldline_upd_preserve_wityping)\n\nlemma sub_conc_hoare:\n  \"\\<And>tw. inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw) \\<Longrightarrow> inv (next_world tw)\"\nproof -\n  fix tw\n  assume \"inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw)\"\n  hence \"inv tw\" and \"inv2 tw\" and \"disjnt {A, B} (event_of tw)\"\n    by auto\n  { fix i\n    assume \"i < next_time_world tw\"\n    have \"fst tw < next_time_world tw\"\n      by (simp add: next_time_world_at_least)\n    have \"i < fst tw \\<or> fst tw \\<le> i\"\n      by auto\n    moreover\n    { assume \"i < fst tw\"\n      hence \"property (i + 1) i tw\"\n        using \\<open>inv tw\\<close> unfolding inv_def by auto\n      hence \"property (i + 1) i (next_world tw)\"\n        unfolding property_def by simp }\n    moreover\n    { assume \"fst tw \\<le> i\"\n      moreover have \"\\<forall>i \\<ge> fst tw. property (i + 1) (fst tw) tw\"\n        using \\<open>inv2 tw\\<close> \\<open>disjnt {A, B} (event_of tw)\\<close> unfolding inv2_def\n        by auto\n      ultimately have \"property (i + 1) (fst tw) tw\"\n        by auto\n      hence \"property (i + 1) i tw\"\n        unfolding property_def\n        by (metis \\<open>get_time tw \\<le> i\\<close> \\<open>i < next_time_world tw\\<close> unchanged_until_next_time_world)\n      hence \"property (i + 1) i (next_world tw)\"\n        unfolding property_def by auto }\n    ultimately have \"property (i + 1) i (next_world tw)\"\n      by auto }\n  thus \"inv (next_world tw)\"\n    unfolding inv_def by auto\nqed\n\nlemma sub_conc_hoare2:\n  \"\\<And>tw. inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv2 (j, snd tw)\"\nproof (rule)\n  fix tw :: \"nat \\<times> (sig \\<Rightarrow> val) \\<times> (sig \\<Rightarrow> nat \\<Rightarrow> val)\"\n  fix j\n  assume \"j \\<in> {fst tw <.. next_time_world tw}\"\n  assume \"inv tw \\<and> inv2 tw \\<and> disjnt {A, B} (event_of tw)\"\n  hence \"inv tw\" and \"inv2 tw\" and \"disjnt {A, B} (event_of tw)\"\n    by auto\n  let ?t' = \"j\"\n  { assume \"disjnt {A, B} (event_of (j, snd tw))\"\n    hence *: \"lof_wline tw A ?t' = lof_wline tw A (?t' - 1)\" and **: \"lof_wline tw B ?t' = lof_wline tw B (?t' - 1)\"\n      unfolding event_of_alt_def\n      by (smt comp_apply diff_0_eq_0 disjnt_insert1 fst_conv mem_Collect_eq snd_conv)+\n    have \"fst tw < ?t'\"\n      using \\<open>j \\<in> {get_time tw<..next_time_world tw}\\<close> by auto\n    { fix i\n      assume \"?t' \\<le> i\"\n      have \"property (i + 1) (fst tw) tw\"\n        using \\<open>inv2 tw\\<close> \\<open>disjnt {A, B} (event_of tw)\\<close> unfolding inv2_def\n        using \\<open>get_time tw < j\\<close> \\<open>j \\<le> i\\<close> by auto\n      moreover have \"lof_wline tw A (fst tw) = lof_wline tw A (?t' - 1)\" and\n                    \"lof_wline tw B (fst tw) = lof_wline tw B (?t' - 1)\"\n        by (metis (no_types, lifting) One_nat_def Suc_eq_plus1 \\<open>j \\<in> {get_time tw<..next_time_world\n        tw}\\<close> add_le_imp_le_diff diff_add discrete gr_implies_not0 greaterThanAtMost_iff\n        not_less_iff_gr_or_eq unchanged_until_next_time_world)+\n      ultimately have \"property (i + 1) ?t' (j, snd tw)\"\n        unfolding property_def using * **  by auto }\n    hence \"\\<forall>i\\<ge>?t'. property (i + 1) ?t' (j, snd tw)\"\n      by auto }\n  thus \"inv2 (j, snd tw)\"\n    unfolding inv2_def by auto\nqed\n\nlemma inv2_next_time:\n  fixes tw\n  assumes \"beval_world_raw2 tw (Bsub (Bsig A) (Bsig B)) v\" and \"type_of v = Lty Sig len\"\n  defines \"tw' \\<equiv> tw[C, 1 :=\\<^sub>2 v]\"\n  shows   \"\\<forall>j \\<in> {fst tw' <.. next_time_world tw'}. inv2 (j, snd tw')\"\n  unfolding inv2_def\nproof (rule, rule, rule, rule)\n  fix i j\n  assume \"j \\<in> {fst tw' <..next_time_world tw'}\"\n  assume \"disjnt {A, B} (event_of (j, snd tw'))\"\n  hence \"A \\<notin> event_of (j, snd tw')\" and \"B \\<notin> event_of (j, snd tw')\"\n    by auto\n  assume \"fst (j, snd tw') \\<le> i\"\n  hence \"j \\<le> i\"\n    by auto\n  let ?t' = j\n  have \"fst tw' < ?t'\"\n    by (metis \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close> fst_conv greaterThanAtMost_iff tw'_def\n    worldline_upd2_def)\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def unfolding worldline_upd2_def by auto\n  ultimately have \"fst tw < ?t'\"\n    by auto\n  have 0: \"wline_of (next_world tw') A ?t' = wline_of tw A (fst tw)\"\n  proof -\n    have \"wline_of tw' A ?t' = wline_of tw' A (?t' - 1)\"\n      using \\<open>A \\<notin> event_of (j, snd tw')\\<close> unfolding event_of_alt_def\n      using \\<open>get_time tw' < j\\<close> by auto\n    also have \" ... = wline_of tw' A (fst tw')\"\n      using unchanged_until_next_time_world\n      by (smt Suc_diff_1 \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close> fst_conv gr_implies_not_zero\n      greaterThanAtMost_iff le_0_eq not_less not_less_eq_eq o_apply prod.sel(2) sig.simps(4) tw'_def\n      worldline_upd2_def worldline_upd_def)\n    also have \"... = wline_of tw' A (fst tw)\"\n      by (simp add: \\<open>get_time tw = get_time tw'\\<close>)\n    also have \"... = wline_of tw A (fst tw)\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    finally show \"wline_of (next_world tw') A ?t' = wline_of tw A (fst tw)\"\n      by auto\n  qed\n  have 1: \"wline_of (next_world tw') B ?t' = wline_of tw B (fst tw)\"\n  proof -\n    have \"wline_of tw' B ?t' = wline_of tw' B (?t' - 1)\"\n      using \\<open>B \\<notin> event_of (j, snd tw')\\<close> unfolding event_of_alt_def\n      using \\<open>get_time tw' < j\\<close> by auto\n    also have \" ... = wline_of tw' B (fst tw')\"\n      using unchanged_until_next_time_world\n      by (smt Suc_diff_1 \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close> comp_apply fst_conv\n      gr_implies_not_zero greaterThanAtMost_iff le_0_eq not_less not_less_eq_eq sig.simps(6)\n      snd_conv tw'_def worldline_upd2_def worldline_upd_def)\n    also have \"... = wline_of tw' B (fst tw)\"\n      by (simp add: \\<open>get_time tw = get_time tw'\\<close>)\n    also have \"... = wline_of tw B (fst tw)\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    finally show \"wline_of (next_world tw') B ?t' = wline_of tw B (fst tw)\"\n      by auto\n  qed\n  have assm2: \"beval_world_raw (snd tw) (fst tw) (Bsub (Bsig A) (Bsig B)) v\"\n    using assms(1) unfolding beval_world_raw2_def by auto\n  have \"wline_of (next_world tw') C (i + 1) = v\"\n  proof -\n    have \"wline_of tw' C (i + 1) = v\"\n      using `fst tw < ?t'` \\<open>?t' \\<le> i\\<close>\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    thus ?thesis\n      by auto\n  qed\n  also have \"lval_of ... = bin_to_bl len (sbl_to_bin (lof_wline tw A (fst tw)) - sbl_to_bin (lof_wline tw B (fst tw)))\"\n    apply (rule beval_world_raw_cases[OF assm2])\n    apply (erule beval_cases)\n    defer\n    apply (metis (mono_tags, lifting) add.right_neutral assms(2) beval_cases(1) bin_to_bl_def comp_apply list.size(3) size_bin_to_bl_aux state_of_world_def ty.distinct(1) ty.inject type_of.elims val.sel(3))\n    using assms(2) by auto\n  finally have \"property (i + 1) ?t' (j, snd tw')\"\n    unfolding property_def using 0 1  by auto\n  thus \"property (i + 1) (get_time (j, snd tw')) (j, snd tw')\"\n    by auto\nqed\n\nlemma sub_seq_hoare_next_time1:\n  shows \"\\<turnstile> [\\<lambda>tw. wityping \\<Gamma> (snd tw)] \n              Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1 \n           [\\<lambda>tw. \\<forall>j \\<in> {fst tw <..next_time_world tw}. inv2 (j, snd tw)]\"\n  apply (rule Assign2_altI)\n  using inv2_next_time type_correctness_length by auto\n\nlemma sub_conc_hoare3:\n  \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n          sub \n     \\<lbrace>\\<lambda>tw. \\<forall>j \\<in> {fst tw <..next_time_world tw}. inv (j, snd tw) \\<and> inv2 (j, snd tw)\\<rbrace>\"\n  unfolding sub_def\n  apply (rule Single)\n   apply (rule Conj_univ_qtfd)\n    apply (rule Conseq2[rotated])\n      apply (rule sub_seq_hoare_next_time_post, simp, simp)\n  apply (rule Conseq2[rotated])\n     apply (rule sub_seq_hoare_next_time1, simp, simp)\n  using sub_conc_hoare aux sub_conc_hoare2 by blast\n\nlemma seq_wt_sub:\n  \"seq_wt \\<Gamma> (Bassign_trans C (Bsub (Bsig A) (Bsig B)) 1)\"\n  using well_typed by blast\n\nlemma sub_conc_hoare4:\n  \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n        sub \n     \\<lbrace>\\<lambda>tw. \\<forall>i\\<in>{get_time tw<..next_time_world tw}. (local.inv (i, snd tw) \\<and> inv2 (i, snd tw)) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule Conj2_univ_qtfd[where R=\"\\<lambda>tw. wityping \\<Gamma> (snd tw)\", unfolded snd_conv])\n  apply (rule sub_conc_hoare3)\n  apply (rule strengthen_pre_conc_hoare[rotated])\n  apply (rule weaken_post_conc_hoare[rotated])\n    apply (unfold sub_def, rule single_conc_stmt_preserve_wityping_hoare)\n    apply (rule seq_wt_sub)\n  by auto \n\nlemma sub_conc_sim':\n  \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n        sub \n      \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule While)\n  apply (unfold snd_conv, rule sub_conc_hoare4)\n  done\n\nlemma sub_conc_sim2:\n  \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> sub \\<lbrace>inv\\<rbrace>\"\n  using sub_conc_sim' Conseq_sim by blast\n\nlemma init_sat_inv:\n  \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) sub (\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw))\"\n  unfolding sub_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conj)\n  unfolding snd_conv apply(rule seq_hoare_next_time0)\n  apply (rule strengthen_precondition2)\n  by (metis seq_stmt_preserve_wityping_hoare well_typed)\n\nlemma init_sat_inv2:\n  \"init_sim_hoare (\\<lambda>tw. wityping \\<Gamma> (snd tw)) sub inv2\"\n  unfolding sub_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conseq2[rotated])\n  apply (rule sub_seq_hoare_next_time1)\n  by    (auto simp add: next_time_world_at_least)\n\nlemma init_sat_inv_comb:\n  shows \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) sub  (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n  apply (rule ConjI_sim)\n  apply (rule init_sat_inv)\n  apply (rule ConseqI_sim[rotated])\n  apply (rule init_sat_inv2)\n  by blast+\n\nlemma correctness:\n  assumes \"sim_fin w (i + 1) sub tw'\" and \"wityping \\<Gamma> w\"\n  shows   \"property (i + 1) i tw'\"\nproof -\n  obtain tw where \"init_sim (0, w) sub tw\" and  \"tw, i + 1, sub \\<Rightarrow>\\<^sub>S tw'\"\n    using premises_sim_fin_obt[OF assms(1)] by auto\n  hence \"i + 1 = fst tw'\"\n    using world_maxtime_lt_fst_tres  by blast\n  have \"conc_stmt_wf sub\"\n    unfolding conc_stmt_wf_def sub_def by auto\n  moreover have \"nonneg_delay_conc sub\"\n    unfolding sub_def by auto\n  ultimately have \"init_sim_valid (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) sub (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n    using init_sim_hoare_soundness[OF init_sat_inv_comb]\n    by (metis (no_types, lifting) conc_wt_cases(1) init_sat_inv_comb\n    init_sim_hoare_soundness sub_def strengthen_precondition_init_sim_hoare)\n  hence \"inv tw \\<and> wityping \\<Gamma> (snd tw) \\<and> inv2 tw\"\n    using \\<open>init_sim (0, w) sub tw\\<close> fst_conv assms(2) unfolding init_sim_valid_def\n    by (metis snd_conv)\n  hence \"inv tw\" and \"inv2 tw\" and \"wityping \\<Gamma> (snd tw)\"\n    by auto\n  moreover have \"\\<Turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (local.inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> sub \\<lbrace>local.inv\\<rbrace>\"\n    using conc_sim_soundness[OF sub_conc_sim2] \\<open>conc_stmt_wf sub\\<close> \\<open>nonneg_delay_conc sub\\<close>\n    by auto\n  ultimately have \"inv tw'\"\n    using \\<open>tw, i + 1, sub \\<Rightarrow>\\<^sub>S tw'\\<close> unfolding sim_hoare_valid_def by blast\n  with \\<open>i + 1 = fst tw'\\<close> show ?thesis\n    unfolding inv_def by (metis less_add_one)\nqed\n\nlemma correctness2:\n  assumes \"sim_fin w (i + 1) sub tw'\" and \"wityping \\<Gamma> w\"\n  shows   \"wityping \\<Gamma> (snd tw')\"\nproof -\n  obtain tw where \"init_sim (0, w) sub tw\" and  \"tw, i + 1, sub \\<Rightarrow>\\<^sub>S tw'\"\n    using premises_sim_fin_obt[OF assms(1)] by auto\n  hence \"i + 1 = fst tw'\"\n    using world_maxtime_lt_fst_tres  by blast\n  have \"conc_stmt_wf sub\"\n    unfolding conc_stmt_wf_def sub_def by auto\n  moreover have \"nonneg_delay_conc sub\"\n    unfolding sub_def by auto\n  ultimately have \"init_sim_valid (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) sub(\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv2 tw)\"\n    using init_sim_hoare_soundness[OF init_sat_inv_comb]\n    by (metis (no_types, lifting) conc_wt_cases(1) init_sat_inv_comb\n    init_sim_hoare_soundness sub_def strengthen_precondition_init_sim_hoare)\n  hence \"inv tw \\<and> wityping \\<Gamma> (snd tw) \\<and> inv2 tw\"\n    using \\<open>init_sim (0, w) sub tw\\<close> fst_conv assms(2) unfolding init_sim_valid_def\n    by (metis snd_conv)\n  hence \"inv tw\" and \"inv2 tw\" and \"wityping \\<Gamma> (snd tw)\"\n    by auto\n  moreover have \" \\<Turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (local.inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> sub \\<lbrace>\\<lambda>tw. (local.inv tw \\<and> inv2 tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n    using conc_sim_soundness[OF sub_conc_sim'] \\<open>conc_stmt_wf sub\\<close> \\<open>nonneg_delay_conc sub\\<close>\n    by (metis (no_types, lifting) sim_hoare_valid_def)\n  ultimately show \"wityping \\<Gamma> (snd tw')\"\n    using \\<open>tw, i + 1, sub \\<Rightarrow>\\<^sub>S tw'\\<close> unfolding sim_hoare_valid_def by blast\nqed\n\ncorollary correctness3:\n  assumes \"sim_fin w (i + 1) sub tw'\" and \"wityping \\<Gamma> w\"\n  defines \"bsA \\<equiv> lof_wline tw' A i\"\n  defines \"bsB \\<equiv> lof_wline tw' B i\"\n  defines \"bsC \\<equiv> lof_wline tw' C (i + 1)\"\n  assumes \"0 < len1\" and \"0 < len2\" \\<comment> \\<open>bit length of less than two is senseless for signed number\\<close>\n  shows   \"sbl_to_bin bsC mod 2 ^  len = (sbl_to_bin bsA - sbl_to_bin bsB) mod 2 ^ len\" and\n          \"length bsC = len\" and \"0 < length bsB\" and  \"length bsA = len1\"\nproof -\n  have \"property (i + 1) i tw'\" and \"wityping \\<Gamma> (snd tw')\"\n    using correctness[OF assms(1-2)] correctness2[OF assms(1-2)] by auto\n  hence \"length bsA = len1\" and \"length bsB = len2\"\n    by (smt assms(3-4) atype btype o_apply ty.distinct(1) ty.inject type_of.elims val.sel(3)\n    wityping_def wtyping_def)+\n  hence \"0 < length bsA\" and \"0 < length bsB\"\n    using assms by blast+\n  hence \"0 < len\"\n    using assms unfolding len_def by auto\n  have \"lof_wline tw' C (i + 1) =\n                  bin_to_bl len (sbl_to_bin (lof_wline tw' A i) - sbl_to_bin (lof_wline tw' B i))\"\n    using \\<open>property (i + 1) i tw'\\<close> unfolding property_def by auto\n  hence \"bsC = bin_to_bl len (sbl_to_bin bsA - sbl_to_bin bsB)\" (is \"_ = ?rhs\")\n    unfolding bsA_def bsB_def bsC_def by auto\n  hence \"sbl_to_bin bsC = sbl_to_bin ?rhs\"\n    by auto\n  hence \"sbl_to_bin bsC mod 2 ^ len = sbl_to_bin ?rhs mod 2 ^ len\"\n    by auto\n  also have \"... = (sbl_to_bin bsA - sbl_to_bin bsB) mod 2 ^ len\"\n    using sbin_bl_bin' \\<open>0 < len\\<close> by auto\n  finally show \"sbl_to_bin bsC mod 2 ^ len = (sbl_to_bin bsA - sbl_to_bin bsB) mod 2 ^ len\"\n    by auto\n  show \"length bsC = len\" and \"0 < length bsB\" and \"length bsA = len1\"\n    using \\<open>bsC = bin_to_bl len (sbl_to_bin bsA - sbl_to_bin bsB)\\<close> size_bin_to_bl \\<open>0 < length bsB\\<close>\n    \\<open>length bsA = len1\\<close> by blast+\nqed\n\ncorollary correctness4:\n  assumes \"sim_fin w (i + 1) sub tw'\" and \"wityping \\<Gamma> w\"\n  defines \"bsA \\<equiv> lof_wline tw' A i\"\n  defines \"bsB \\<equiv> lof_wline tw' B i\"\n  defines \"bsC \\<equiv> lof_wline tw' C (i + 1)\"\n  assumes \"0 < len1\" and \"0 < len2\" \\<comment> \\<open>bit length of less than two is senseless for signed number\\<close>\n  defines \"repA \\<equiv> - (int \\<circ> of_bool) (hd bsA) * 2 ^ (length bsA - 1) + (\\<Sum>i = 0..<length bsA - 1. (int \\<circ> of_bool) (rev (tl bsA) ! i) * 2 ^ i)\"\n  defines \"repB \\<equiv> - (int \\<circ> of_bool) (hd bsB) * 2 ^ (length bsB - 1) + (\\<Sum>i = 0..<length bsB - 1. (int \\<circ> of_bool) (rev (tl bsB) ! i) * 2 ^ i)\"\n  defines \"repC \\<equiv> - (int \\<circ> of_bool) (hd bsC) * 2 ^ (length bsC - 1) + (\\<Sum>i = 0..<length bsC - 1. (int \\<circ> of_bool) (rev (tl bsC) ! i) * 2 ^ i)\"\n  shows   \"repC mod 2 ^ len = (repA - repB) mod 2 ^ len\"\nproof -\n  have \"sbl_to_bin bsC mod 2 ^ len =\n       (sbl_to_bin bsA - sbl_to_bin bsB) mod 2 ^ len\" and  \"length bsC = len\" and \"0 < length bsB\" and \"length bsA = len1\"\n    using correctness3 assms by auto\n  hence \"0 < length bsC\"\n    unfolding len_def using \\<open>0 < len1\\<close> \\<open>0 < len2\\<close> by auto\n  then obtain c bsC' where \"bsC = c # bsC'\" and \"hd bsC = c\" and \"tl bsC = bsC'\"\n    using list.exhaust_sel by auto\n  hence sC: \"sbl_to_bin bsC = - (int \\<circ> of_bool) (hd bsC) * 2 ^ (length bsC - 1) + (\\<Sum>i = 0..<length bsC - 1. (int \\<circ> of_bool) (rev (tl bsC) ! i) * 2 ^ i)\"\n    using sbl_to_bin_correctness by simp\n  obtain b bsB' a bsA' where \"bsA = a # bsA'\" and \"bsB = b # bsB'\" and \"hd bsA = a\" and \"tl bsA = bsA'\"\n    and \"hd bsB = b\" and \"tl bsB = bsB'\"\n    by (metis \\<open>0 < length bsB\\<close> \\<open>length bsA = len1\\<close> assms(6) list.sel(1) list.sel(3)  list_exhaust_size_gt0 )\n  hence sA: \"sbl_to_bin bsA = - (int \\<circ> of_bool) (hd bsA) * 2 ^ (length bsA - 1) + (\\<Sum>i = 0..<length bsA - 1. (int \\<circ> of_bool) (rev (tl bsA) ! i) * 2 ^ i)\"\n    and sB: \"sbl_to_bin bsB = - (int \\<circ> of_bool) (hd bsB) * 2 ^ (length bsB - 1) + (\\<Sum>i = 0..<length bsB - 1. (int \\<circ> of_bool) (rev (tl bsB) ! i) * 2 ^ i)\"\n    using sbl_to_bin_correctness by simp+\n  show ?thesis\n    using \\<open>sbl_to_bin bsC mod 2 ^ len =\n       (sbl_to_bin bsA - sbl_to_bin bsB) mod 2 ^ len\\<close> unfolding sA sB sC repA_def repB_def repC_def\n    by  metis\nqed", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Subtraction_Hoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.523420348936324, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.3082365543113072}}
{"text": "section \\<open> tock-Circus \\<close>\n\ntheory utp_tockcircus\nimports \"UTP1-Reactive-Designs.utp_rea_designs\" \"rcircus/Refusal_Tests\"\nbegin recall_syntax\n\nsubsection \\<open> Preliminaries \\<close>\n\ninstantiation list :: (type) monoid_mult\nbegin\ndefinition [simp]: \"one_list = []\"\ndefinition [simp]: \"times_list = (@)\"\ninstance by (intro_classes; simp)\nend\n\nlemma power_replicate: \"[x]^n = replicate n x\"\n  by (induct n; simp)\n\nsubsection \\<open> Foundations \\<close>\n\ntext \\<open> We try and characterise a tock-CSP like model using the standard Circus pattern and adapting\n  the CML model and bits of the refusal testing model. First we represent traces. \\<close>\n\ndatatype ('t, 'e) teva = Tock \"'t\" | Evt 'e\n\ntype_synonym 'e tev = \"('e set, 'e) teva\"\n\ntext \\<open> We don't need a tick event, because this is handled by the $wait$ flag. Nor do we need to\n  separate refusals and tocks. A refusal in tock-CSP (as I understand) can occur either (1) just\n  before a tock occurs, or (2) at the end of a trace. We gain the former by embedding refusals\n  in a tock (as in CML). We gain the latter by including the $ref'$ variable as in Circus. We encode\n  the healthiness condition that a tock can't occur in a refusal before a tock event using\n  the type system. \\<close>\n\nalphabet ('s, 'e) tc_vars = \"('e tev list, 's) rsp_vars\" +\n  ref :: \"'e refusal\"\n  pat :: \"bool\" \n\ntext \\<open> We record patience/urgency via the @{const pat} variable instead of in the refusal set. This\n  is so that conjunction works -- time is deterministic, and so a process is patient (accepts\n  Tock) only when all subprocesses do. \\<close>\n\ntext \\<open> The $ref$ variable is not simply a set, but a set augmented with the @{term \"\\<^bold>\\<bullet>\"} that denotes\n  stability. We need this because tick-tock traces can end without a refusal. Note that unlike\n  in the trace this is a refusal over @{typ \"'e tev\"} so that we can refuse tocks at the end. \\<close>\n\ntext \\<open> The interpretation of $wait$ changes to there being both stable (quiescent) and unstable.\n  Extra information is needed for refusals. What is the meaning pericondition? \\<close>\n\n(* FIXME: Nasty hack below *)\n\nlemma tc_splits:\n  \"(\\<forall>r. P r) = (\\<forall>ok wait tr st ref pat more. P \\<lparr>ok\\<^sub>v = ok, wait\\<^sub>v = wait, tr\\<^sub>v = tr, st\\<^sub>v = st, ref\\<^sub>v = ref, pat\\<^sub>v = pat, \\<dots> = more\\<rparr>)\"\n  \"(\\<exists>r. P r) = (\\<exists> ok wait tr st ref pat more. P \\<lparr>ok\\<^sub>v = ok, wait\\<^sub>v = wait, tr\\<^sub>v = tr, st\\<^sub>v = st, ref\\<^sub>v = ref, pat\\<^sub>v = pat, \\<dots> = more\\<rparr>)\"\n  by (metis rp_vars.select_convs(3) rsp_vars.surjective tc_vars.surjective)+\n\ndeclare tc_vars.splits [alpha_splits del]\ndeclare des_vars.splits [alpha_splits del]\ndeclare rp_vars.splits [alpha_splits del]\ndeclare rsp_vars.splits [alpha_splits del]\ndeclare tc_splits [alpha_splits]\ndeclare rsp_vars.splits [alpha_splits]\ndeclare rp_vars.splits [alpha_splits]\ndeclare des_vars.splits [alpha_splits]\n\ntype_synonym ('s,'e) taction  = \"('s, 'e) tc_vars hrel\"\n\nsubsubsection \\<open> Tocks \\<close>\n\ndefinition tocks :: \"'e set \\<Rightarrow> 'e tev list set\" where\n\"tocks X = {t. \\<forall> e \\<in> set(t). \\<exists> Y. e = Tock Y \\<and> Y \\<subseteq> X}\"\n\nlemma tocks_Nil [simp]: \"[] \\<in> tocks X\"\n  by (simp add: tocks_def)\n\nlemma tocks_Tock: \"t \\<in> tocks X \\<Longrightarrow> set t \\<subseteq> range Tock\"\n  by (auto simp add: tocks_def)\n\nlemma tocks_Cons [intro]: \"\\<lbrakk> Y \\<subseteq> X; t \\<in> tocks X \\<rbrakk> \\<Longrightarrow> Tock Y # t \\<in> tocks X\"\n  by (simp add: tocks_def)\n\nlemma tocks_inter [intro!]: \"\\<lbrakk> t \\<in> tocks X; t \\<in> tocks Y \\<rbrakk> \\<Longrightarrow> t \\<in> tocks (X \\<inter> Y)\"\n  by (auto simp add: tocks_def, metis teva.inject(1))\n\nlemma tocks_Evt [simp]: \"Evt e # t \\<in> tocks X = False\"\n  by (simp add: tocks_def)\n\nlemma tocks_subset: \"\\<lbrakk> A \\<subseteq> B; t \\<in> tocks A\\<rbrakk> \\<Longrightarrow> t \\<in> tocks B\"\n  by (auto simp add: tocks_def)\n\nlemma tocks_append [simp]: \"s @ t \\<in> tocks X \\<longleftrightarrow> (s \\<in> tocks X \\<and> t \\<in> tocks X)\"\n  by (auto simp add: tocks_def)\n\nlemma tocks_take [simp]: \"s \\<in> tocks X \\<Longrightarrow> take n s \\<in> tocks X\"\n  by (auto simp add: tocks_def, meson in_set_takeD)\n\nlemma tocks_drop [simp]: \"s \\<in> tocks X \\<Longrightarrow> drop n s \\<in> tocks X\"\n  by (auto simp add: tocks_def, meson in_set_dropD)\n\nlemma tocks_inter1 [dest]: \"t \\<in> tocks (X \\<inter> Y) \\<Longrightarrow> t \\<in> tocks(X)\"\n  by (auto simp add: tocks_def)\n\nlemma tocks_inter2 [dest]: \"t \\<in> tocks (X \\<inter> Y) \\<Longrightarrow> t \\<in> tocks(Y)\"\n  by (auto simp add: tocks_def)\n\ndefinition \"mk_tocks n = replicate n (Tock {})\"\n\nlemma mk_tocks: \"mk_tocks n \\<in> tocks X\"\n  by (simp add: mk_tocks_def tocks_def)\n\nlemma length_mk_tocks [simp]: \"length (mk_tocks n) = n\"\n  by (simp add: mk_tocks_def)\n\nsubsubsection \\<open> Tocks Order \\<close>\n\ntext \\<open> This order states that two traces have the same length, and agree on the order of events \n  and tocks, but each tock can refuse fewer events. \\<close>\n\ndefinition tock_ord :: \"'e tev list \\<Rightarrow> 'e tev list \\<Rightarrow> bool\" (infix \"\\<subseteq>\\<^sub>t\" 50) where\n\"(t\\<^sub>1 \\<subseteq>\\<^sub>t t\\<^sub>2) = (length t\\<^sub>1 = length t\\<^sub>2 \\<and> (\\<forall> i<length t\\<^sub>1. t\\<^sub>1!i = t\\<^sub>2!i \\<or> (\\<exists> X Y. X \\<subseteq> Y \\<and> t\\<^sub>1!i = Tock X \\<and> t\\<^sub>2!i = Tock Y)))\"\n\nlemma tock_ord_refl: \"x \\<subseteq>\\<^sub>t x\"\n  by (simp add: tock_ord_def)\n\nlemma tock_ord_trans: \"\\<lbrakk> x \\<subseteq>\\<^sub>t y; y \\<subseteq>\\<^sub>t z \\<rbrakk> \\<Longrightarrow> x \\<subseteq>\\<^sub>t z\"\n  by (auto simp add: tock_ord_def, smt dual_order.trans teva.inject(1))\n\nlemma tock_ord_antisym: \"\\<lbrakk> x \\<subseteq>\\<^sub>t y; y \\<subseteq>\\<^sub>t x \\<rbrakk> \\<Longrightarrow> x = y\"\n  by (auto simp add: tock_ord_def, metis nth_equalityI subset_antisym teva.inject(1))\n\nlemma tock_ord_least [simp]: \"t \\<subseteq>\\<^sub>t [] \\<longleftrightarrow> t = []\"\n  by (auto simp add: tock_ord_def)\n\nlemma tock_ord_Nil [simp]: \"[] \\<subseteq>\\<^sub>t t \\<longleftrightarrow> t = []\"\n  by (auto simp add: tock_ord_def)\n\nlemma tock_ord_append: \"\\<lbrakk> x\\<^sub>1 \\<subseteq>\\<^sub>t y\\<^sub>1; x\\<^sub>2 \\<subseteq>\\<^sub>t y\\<^sub>2 \\<rbrakk> \\<Longrightarrow> x\\<^sub>1 @ x\\<^sub>2 \\<subseteq>\\<^sub>t y\\<^sub>1 @ y\\<^sub>2\"\n  apply (auto simp add: tock_ord_def)\n  by (smt diff_add_cancel_left' nat_add_left_cancel_less not_less nth_append)\n\nlemma tock_ord_decompose:\n  assumes  \"x \\<subseteq>\\<^sub>t y @ z\" \n  shows \"take (length y) x \\<subseteq>\\<^sub>t y\" \"drop (length y) x \\<subseteq>\\<^sub>t z\"\n  using assms\n  by (auto simp add: tock_ord_def)\n     (metis add_leE not_less nth_append, metis nat_add_left_cancel_less nth_append_length_plus)\n\nlemma tocks_order_power:\n  assumes \"t \\<in> tocks A\"\n  shows \"t \\<subseteq>\\<^sub>t [Tock A]^length t\"\nproof -\n  from assms have \"\\<forall>i<length t. t ! i = Tock A \\<or> (\\<exists>X. X \\<subseteq> A \\<and> t ! i = Tock X)\"\n    by (simp add: tocks_def, meson in_set_conv_nth)\n  thus ?thesis\n    by (auto simp add: tock_ord_def power_replicate)\nqed\n\nlemma tock_power_in_tocks: \"[Tock A]^n \\<in> tocks A\"\n  by (simp add: tocks_def power_replicate)\n\nlemma tocks_ord_closed:\n  \"\\<lbrakk> t\\<^sub>1 \\<in> tocks A; t\\<^sub>2 \\<subseteq>\\<^sub>t t\\<^sub>1 \\<rbrakk> \\<Longrightarrow> t\\<^sub>2 \\<in> tocks A\"\n  by (auto simp add: tocks_def tock_ord_def in_set_conv_nth)\n     (metis (no_types, opaque_lifting) nth_mem subset_trans teva.inject(1))\n\nsubsubsection \\<open> Other Functions \\<close>\n\nfun events :: \"'e tev list \\<Rightarrow> 'e tev list\" where\n\"events [] = []\" |\n\"events (Tock A # t) = events t\" |\n\"events (Evt x # t) = (Evt x # events t)\"\n\nlemma events_append [simp]: \"events (xs @ ys) = events(xs) @ events(ys)\"\n  apply (induct xs, simp_all)\n  apply (rename_tac x xs)\n  apply (case_tac x)\n  apply (simp_all)\ndone\n\ntext \\<open> This function is taken from CML and I think might be useful here too. \\<close>\n\nfun idleprefix :: \"'e tev list \\<Rightarrow> 'e tev list\" where\n\"idleprefix [] = []\" |\n\"idleprefix (Tock A # t) = (Tock A # idleprefix t)\" |\n\"idleprefix (Evt x # t) = []\"\n\nlemma idleprefix_tocks [simp]: \"idleprefix t \\<in> tocks UNIV\"\n  by (induct t, simp_all, metis idleprefix.elims list.sel(3) subset_UNIV tocks_Cons tocks_Nil)\n\nfun activesuffix :: \"'e tev list \\<Rightarrow> 'e tev list\" where\n\"activesuffix [] = []\" |\n\"activesuffix (Tock A # t) = activesuffix t\" |\n\"activesuffix (Evt x # t) = (Evt x # t)\"\n\ntext \\<open> If an active suffix has elements, then the first element must be an event. \\<close>\n\nlemma hd_activesuffix:\n  \"activesuffix t \\<noteq> [] \\<Longrightarrow> hd(activesuffix t) \\<in> range(Evt)\"\n  apply (induct t, simp_all)\n  apply (rename_tac a t)\n  apply (case_tac a)\n   apply (simp_all)\n  done\n\ntext \\<open> A trace can always be decomposed into an idle prefix and an active suffix. \\<close>\n\nlemma idle_active_decomp:\n  \"idleprefix t @ activesuffix t = t\"\n  apply (induct t, simp_all)\n  apply (rename_tac a t)\n  apply (case_tac a)\n   apply (simp_all)\n  done\n\nlemma idleprefix_concat_Evt [simp]: \"idleprefix (t @ Evt e # t') = idleprefix t\"\n  by ((induct t; simp), metis idleprefix.simps(2) idleprefix.simps(3) teva.exhaust)\n\nlemma idleprefix_prefix: \"idleprefix(t) \\<le> t\"\n  by (metis Prefix_Order.prefixI idle_active_decomp)\n\nlemma tocks_idleprefix_fp [simp]:\n  \"t \\<in> tocks A \\<Longrightarrow> idleprefix(t) = t\"\n  by (metis hd_Cons_tl hd_activesuffix idle_active_decomp rangeE self_append_conv tocks_Evt tocks_append)\n\nlemma tocks_iff_idleprefix_fp: \"t \\<in> tocks UNIV \\<longleftrightarrow> idleprefix t = t\"\n  by (metis idleprefix_tocks tocks_idleprefix_fp)\n\nlemma idleprefix_idem [simp]: \"idleprefix (idleprefix t) = idleprefix t\"\n  using idleprefix_tocks tocks_idleprefix_fp by blast\n\nsubsection \\<open> Reactive Relation Constructs \\<close>\n\ndefinition tc_skip :: \"('s, 'e) taction\" (\"II\\<^sub>t\") where\n[upred_defs]: \"tc_skip = ($tr\\<acute> =\\<^sub>u $tr \\<and> $st\\<acute> =\\<^sub>u $st)\"\n\ndefinition TRR1 :: \"('s,'e) taction \\<Rightarrow> ('s,'e) taction\" where\n[upred_defs]: \"TRR1(P) = (II\\<^sub>t ;; P)\"\n\ndefinition TRR2 :: \"('s,'e) taction \\<Rightarrow> ('s,'e) taction\" where\n[upred_defs]: \"TRR2(P) = (U($tr\\<acute> = $tr \\<and> $ref\\<acute> = \\<^bold>\\<bullet>) \\<or> P)\"\n\ndefinition TRR3 :: \"('s,'e) taction \\<Rightarrow> ('s,'e) taction\" where\n[upred_defs]: \"TRR3(P) = (P ;; II\\<^sub>t)\"\n\ndefinition uns :: \"('s,'e) taction\" where\n[upred_defs]: \"uns = U($tr\\<acute> = $tr \\<and> $ref\\<acute> = \\<^bold>\\<bullet> \\<and> $pat\\<acute> = false)\"\n\ndefinition TRR4 :: \"('s,'e) taction \\<Rightarrow> ('s,'e) taction \\<Rightarrow> ('s,'e) taction\" where\n[upred_defs]: \"TRR4 P Q = (Q \\<or> P ;; uns)\"\n\ndefinition TRR :: \"('s,'e) taction \\<Rightarrow> ('s,'e) taction\" where\n[upred_defs]: \"TRR(P) = TRR1(RR(P))\"\n\ndefinition TRC :: \"('s,'e) taction \\<Rightarrow> ('s,'e) taction\" where\n[upred_defs]: \"TRC(P) = TRR1(RC(P))\"\n\ndefinition TRF :: \"('s,'e) taction \\<Rightarrow> ('s,'e) taction\" where\n[upred_defs]: \"TRF(P) = TRR3(TRR(P))\"\n\nlemma TRR_idem: \"TRR(TRR(P)) = TRR(P)\"\n  by (rel_auto)\n\nlemma TRR_Idempotent [closure]: \"Idempotent TRR\"\n  by (simp add: TRR_idem Idempotent_def)\n\nlemma TRR_Continuous [closure]: \"Continuous TRR\"\n  by (rel_blast)\n\nlemma TRR_alt_def: \"TRR(P :: ('s,'e) taction) = (\\<exists> $pat \\<bullet> \\<exists> $ref \\<bullet> RR(P))\"\n  by rel_blast\n\nlemma TRR_intro:\n  assumes \"$ref \\<sharp> P\" \"$pat \\<sharp> P\" \"P is RR\"\n  shows \"P is TRR\"\n  by (simp add: TRR_alt_def Healthy_def, simp add: Healthy_if assms ex_unrest)\n\nlemma TRR_unrest_ref [unrest]: \"P is TRR \\<Longrightarrow> $ref \\<sharp> P\"\n  by (metis (no_types, lifting) Healthy_if TRR_alt_def exists_twice in_var_indep in_var_uvar ref_vwb_lens tc_vars.indeps(2) unrest_as_exists unrest_ex_diff vwb_lens_mwb)\n\nlemma TRR_unrest_pat [unrest]: \"P is TRR \\<Longrightarrow> $pat \\<sharp> P\"\n  by (metis (no_types, opaque_lifting) Healthy_if TRR_alt_def exists_twice in_var_uvar pat_vwb_lens unrest_as_exists vwb_lens_mwb)\n\nlemma TRR_implies_RR [closure]: \n  assumes \"P is TRR\"\n  shows \"P is RR\"\nproof -\n  have \"RR(TRR(P)) = TRR(P)\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n\nlemma TRC_implies_TRR [closure]:\n  assumes \"P is TRC\"\n  shows \"P is TRR\"\nproof -\n  have \"TRC(P) is TRR\"\n    apply (rel_auto)\n    apply (meson eq_iff minus_cancel_le)\n    apply (metis (no_types, opaque_lifting) Prefix_Order.prefixE Prefix_Order.prefixI Prefix_Order.same_prefix_prefix plus_list_def trace_class.add_diff_cancel_left)\n    done\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma TRC_implies_RC2 [closure]:\n  assumes \"P is TRC\"\n  shows \"P is RC2\"\nproof -\n  have \"TRC(P) is RC2\"\n    by (rel_auto, blast)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma TRC_implies_RC [closure]: \"P is TRC \\<Longrightarrow> P is RC\"\n  by (simp add: RC_intro_prefix_closed TRC_implies_RC2 TRC_implies_TRR TRR_implies_RR)\n\nlemma TRR_closed_TRC [closure]: \"TRC(P) is TRR\"\n  by (metis (no_types, opaque_lifting) Healthy_Idempotent Healthy_if RC1_RR_closed RC_def TRC_def TRR_Idempotent TRR_def comp_apply rrel_theory.HCond_Idempotent)\n\nutp_const RR TRR \n\nlemma TRR_transfer_refine:\n  fixes P Q :: \"('s, 'e) taction\"\n  assumes \"P is TRR\" \"Q is TRR\" \n    \"(\\<And> t s s' r p. U([$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true, $tr \\<mapsto>\\<^sub>s [], $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>, $st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $ref \\<mapsto>\\<^sub>s \\<^bold>\\<bullet>, $ref\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>r\\<guillemotright>, $pat \\<mapsto>\\<^sub>s false, $pat\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>p\\<guillemotright>] \\<dagger> P) \n                   \\<sqsubseteq> U([$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true, $tr \\<mapsto>\\<^sub>s [], $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>, $st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $ref \\<mapsto>\\<^sub>s \\<^bold>\\<bullet>, $ref\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>r\\<guillemotright>, $pat \\<mapsto>\\<^sub>s false, $pat\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>p\\<guillemotright>] \\<dagger> Q))\"\n  shows \"P \\<sqsubseteq> Q\"\nproof -\n  have \"(\\<And> t s s' r p. U([$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true, $tr \\<mapsto>\\<^sub>s [], $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>, $st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $ref \\<mapsto>\\<^sub>s \\<^bold>\\<bullet>, $ref\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>r\\<guillemotright>, $pat \\<mapsto>\\<^sub>s false, $pat\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>p\\<guillemotright>] \\<dagger> TRR P) \n                     \\<sqsubseteq> U([$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true, $tr \\<mapsto>\\<^sub>s [], $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>, $st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $ref \\<mapsto>\\<^sub>s \\<^bold>\\<bullet>, $ref\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>r\\<guillemotright>, $pat \\<mapsto>\\<^sub>s false, $pat\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>p\\<guillemotright>] \\<dagger> TRR Q))\"\n    by (metis Healthy_if assms(1) assms(2) assms(3))\n  hence \"TRR P \\<sqsubseteq> TRR Q\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_if assms(1) assms(2))\nqed\n\n\nlemma TRR_transfer_eq:\n  fixes P Q :: \"('s, 'e) taction\"\n  assumes \"P is TRR\" \"Q is TRR\" \n    \"(\\<And> t s s' r p. U([$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true, $tr \\<mapsto>\\<^sub>s [], $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>, $st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $ref \\<mapsto>\\<^sub>s \\<^bold>\\<bullet>, $ref\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>r\\<guillemotright>, $pat \\<mapsto>\\<^sub>s false, $pat\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>p\\<guillemotright>] \\<dagger> P) \n                   = U([$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true, $tr \\<mapsto>\\<^sub>s [], $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>, $st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $ref \\<mapsto>\\<^sub>s \\<^bold>\\<bullet>, $ref\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>r\\<guillemotright>, $pat \\<mapsto>\\<^sub>s false, $pat\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>p\\<guillemotright>] \\<dagger> Q))\"\n  shows \"P = Q\"\nproof -\n  have \"(\\<And> t s s' r p. U([$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true, $tr \\<mapsto>\\<^sub>s [], $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>, $st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $ref \\<mapsto>\\<^sub>s \\<^bold>\\<bullet>, $ref\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>r\\<guillemotright>, $pat \\<mapsto>\\<^sub>s false, $pat\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>p\\<guillemotright>] \\<dagger> TRR P) \n                     = U([$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true, $tr \\<mapsto>\\<^sub>s [], $tr\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>t\\<guillemotright>, $st \\<mapsto>\\<^sub>s \\<guillemotleft>s\\<guillemotright>, $st\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>s'\\<guillemotright>, $ref \\<mapsto>\\<^sub>s \\<^bold>\\<bullet>, $ref\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>r\\<guillemotright>, $pat \\<mapsto>\\<^sub>s false, $pat\\<acute> \\<mapsto>\\<^sub>s \\<guillemotleft>p\\<guillemotright>] \\<dagger> TRR Q))\"\n    by (metis Healthy_if assms(1) assms(2) assms(3))\n  hence \"TRR P = TRR Q\"\n    by (rel_auto)\n  thus ?thesis\n    by (metis Healthy_if assms(1) assms(2))\nqed\n\nlemmas TRR_transfer = TRR_transfer_refine TRR_transfer_eq\n\ntext \\<open> Tailored proof strategy -- eliminates irrelevant variables like ok, wait, tr and ref. \\<close>\n\nmethod trr_simp uses cls = (rule TRR_transfer, simp add: closure cls, simp add: closure cls, rel_simp)\n\nmethod trr_auto uses cls = (rule TRR_transfer, simp add: closure cls, simp add: closure cls, rel_auto)\n\nlemma TRR_tc_skip [closure]: \"II\\<^sub>t is TRR\"\n  by (rel_auto)\n\nlemma TRR_closed_disj [closure]:\n  assumes \"P is TRR\" \"Q is TRR\"\n  shows \"(P \\<or> Q) is TRR\"\n  by (rule TRR_intro, simp_all add: unrest closure assms)\n\nlemma TRR_closed_neg [closure]: \"P is TRR \\<Longrightarrow> \\<not>\\<^sub>r P is TRR\"\n  by (rule TRR_intro, simp_all add: unrest closure)\n\nlemma TRR_closed_impl [closure]:\n  assumes \"P is TRR\" \"Q is TRR\"\n  shows \"(P \\<Rightarrow>\\<^sub>r Q) is TRR\"\n  by (simp add: TRR_closed_disj TRR_closed_neg assms(1) assms(2) rea_impl_def)\n\nlemma TRR_closed_seq [closure]: \"\\<lbrakk> P is TRR; Q is TRR \\<rbrakk> \\<Longrightarrow> P ;; Q is TRR\"\n  by (rule TRR_intro, simp_all add: closure unrest)\n\nlemma TRR_closed_wp [closure]: \"\\<lbrakk> P is TRR; Q is TRR \\<rbrakk> \\<Longrightarrow> P wp\\<^sub>r Q is TRR\"\n  by (simp add: wp_rea_def closure)\n\nlemma tc_skip_self_unit [simp]: \"II\\<^sub>t ;; II\\<^sub>t = II\\<^sub>t\"\n  by (trr_auto)\n\nlemma trr_left_unit: \n  assumes \"P is TRR\"\n  shows \"II\\<^sub>t ;; P = P\"\n  by (metis Healthy_if TRR1_def TRR_def TRR_implies_RR assms)\n\nmethod rrel_simp uses cls = (rule RR_eq_transfer, simp add: closure cls, simp add: closure cls)\n\nlemma TRR_ident_intro:\n  assumes \"P is RR\" \"II\\<^sub>t ;; P = P\"\n  shows \"P is TRR\"\n  by (metis Healthy_def TRR1_def TRR_def assms(1) assms(2))\n\nlemma TRR_wp_unit [wp]:\n  assumes \"P is TRC\"\n  shows \"II\\<^sub>t wp\\<^sub>r P = P\"\nproof -\n  have \"II\\<^sub>t wp\\<^sub>r (TRC P) = TRC P\"\n    by (trr_auto cls: assms)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma TRC_wp_intro:\n  assumes \"P is RC\" \"II\\<^sub>t wp\\<^sub>r P = P\"\n  shows \"P is TRC\"\nproof -\n  have \"II\\<^sub>t wp\\<^sub>r (RC2 (RR P)) is TRC\"\n    apply (rel_auto)\n    apply (metis (no_types, opaque_lifting) Prefix_Order.prefixE Prefix_Order.prefixI Prefix_Order.same_prefix_prefix order_refl plus_list_def trace_class.add_diff_cancel_left)\n    apply (meson minus_cancel_le order.trans)\n    done\n  thus ?thesis\n    by (simp add: Healthy_if RC_implies_RR RC_prefix_closed assms)\nqed\n\ninterpretation trel_theory: utp_theory_continuous TRR\n  rewrites \"P \\<in> carrier trel_theory.thy_order \\<longleftrightarrow> P is TRR\"\n  and \"le trel_theory.thy_order = (\\<sqsubseteq>)\"\n  and \"eq trel_theory.thy_order = (=)\"  \n  and trel_top: \"trel_theory.utp_top = false\"\n  and trel_bottom: \"trel_theory.utp_bottom = true\\<^sub>r\"\nproof -\n  interpret utp_theory_continuous TRR\n    by (unfold_locales, simp_all add: add: TRR_idem TRR_Continuous)\n  show top:\"utp_top = false\"\n    by (simp add: healthy_top, rel_auto)\n  show bot:\"utp_bottom = true\\<^sub>r\"\n    by (simp add: healthy_bottom, rel_auto)\n  show \"utp_theory_continuous TRR\"\n    by (unfold_locales, simp_all add: closure rpred top)\nqed (simp_all)\n\ntext \\<open> The following healthiness condition is a weakened form of prefix closure -- a relation must\n  admit every idle prefix with the state unchanged and the unstable refusal. \\<close>\n\ndefinition TIP :: \"('s,'e) taction \\<Rightarrow> ('s,'e) taction\" where\n[upred_defs]: \"TIP(P) = (P \\<or> U((\\<exists> $st\\<acute> \\<bullet> \\<exists> $ref\\<acute> \\<bullet> \\<exists> $pat\\<acute> \\<bullet> \\<exists> t. P\\<lbrakk>[],\\<guillemotleft>t\\<guillemotright>/$tr,$tr\\<acute>\\<rbrakk> \\<and> $tr\\<acute> = $tr @ idleprefix(\\<guillemotleft>t\\<guillemotright>)) \\<and> $st\\<acute> = $st \\<and> $ref\\<acute> = \\<^bold>\\<bullet> \\<and> $pat\\<acute> = false))\"\n\nutp_const RR TIP\n\nlemma TIP_idem [simp]: \"TIP (TIP P) = TIP P\"\n  by (rel_auto, blast)\n\nlemma TIP_prop:\n  assumes \"P is TRR\" \"P is TIP\"\n  shows \"U(P\\<lbrakk>$st,\\<^bold>\\<bullet>,false,[],idleprefix($tr\\<acute>-$tr)/$st\\<acute>,$ref\\<acute>,$pat\\<acute>,$tr,$tr\\<acute>\\<rbrakk>) \\<sqsubseteq> P\" \nproof -\n  have \"U(TIP(TRR(P))\\<lbrakk>$st,\\<^bold>\\<bullet>,false,[],idleprefix($tr\\<acute>-$tr)/$st\\<acute>,$ref\\<acute>,$pat\\<acute>,$tr,$tr\\<acute>\\<rbrakk>) \\<sqsubseteq> TRR(P)\"\n    by (rel_simp, blast)\n  thus ?thesis\n    by (simp add: Healthy_if assms(1) assms(2))\nqed\n\nno_utp_lift lift_state_rel\n\n\ndefinition TDC :: \"('s, 'e) taction \\<Rightarrow> ('s, 'e) taction\" where\n[upred_defs]: \"TDC(P) = U(\\<exists> ref\\<^sub>0. P\\<lbrakk>\\<guillemotleft>ref\\<^sub>0\\<guillemotright>/$ref\\<acute>\\<rbrakk> \\<and> $ref\\<acute> \\<le> \\<guillemotleft>ref\\<^sub>0\\<guillemotright>)\"\n\nabbreviation tsyme :: \"('e tev list, 's) uexpr \\<Rightarrow> ('s, 'e) taction\" where\n\"tsyme t \\<equiv> U(\\<exists> t\\<^sub>0. $tr\\<acute> = $tr @ \\<guillemotleft>t\\<^sub>0\\<guillemotright> \\<and> t\\<^sub>0 \\<subseteq>\\<^sub>t \\<lceil>t\\<rceil>\\<^sub>S\\<^sub><)\"\n\nutp_const tsyme\n\nlemma foldr_concat_eval [uexpr_transfer_extra]: \"\\<lbrakk>foldr (bop (@)) xs t\\<rbrakk>\\<^sub>e s = concat (map (\\<lambda> e. \\<lbrakk>e\\<rbrakk>\\<^sub>e s) xs) @ \\<lbrakk>t\\<rbrakk>\\<^sub>e s\"\n  by (induct xs, rel_auto+)\n\ndefinition [upred_defs]: \"tc_time' X t = U(replicate t (Tock (-X)))\"\n\nutp_const tc_time'\n\ntext \\<open> We introduce a small algebra for peri- and postconditions to capture timed behaviours. The\n  first operator captures stable intermediate (i.e. quiescent) behaviours. Here, @{term s} is a \n  predicate on the state (a condition), @{term t} is a trace over non-tock events, and @{term E} \n  is the set of events being accepted at this point. FIXME: Should stable observations\n  also update the state? \\<close>\n\ndefinition tc_stable :: \"'s upred \\<Rightarrow> ('e tev list, 's) uexpr \\<Rightarrow> ('e set, 's) uexpr \\<Rightarrow> 's upred \\<Rightarrow> ('s, 'e) taction\" (\"\\<E>'(_, _, _, _')\") where\n[upred_defs]: \"\\<E>(s,t,E,p) = U(\\<lceil>s\\<rceil>\\<^sub>S\\<^sub>< \\<and> tsyme t \\<and> (\\<forall> e\\<in>\\<lceil>E\\<rceil>\\<^sub>S\\<^sub><. \\<guillemotleft>e\\<guillemotright> \\<notin>\\<^sub>\\<R> $ref\\<acute>) \\<and> ($pat\\<acute> \\<Rightarrow> \\<lceil>p\\<rceil>\\<^sub>S\\<^sub><))\"\n\ntext \\<open> We also need unstable intermediate observations, which the following relation provides. It\n  has no set associated, since no refusal set is observed. \\<close>\n\ndefinition tc_unstable :: \"'s upred \\<Rightarrow> ('e tev list, 's) uexpr \\<Rightarrow> ('s, 'e) taction\" (\"\\<U>'(_, _')\") where\n[upred_defs]: \"\\<U>(s,t) = U(\\<lceil>s\\<rceil>\\<^sub>S\\<^sub>< \\<and> tsyme t \\<and> $ref\\<acute> = \\<^bold>\\<bullet> \\<and> $pat\\<acute> = false)\"\n\ntext \\<open> A final observation is similar to a stable observation, except it can update the state \n  variables and does not characterise a refusal set. \\<close>\n\ndefinition tc_final :: \"'s upred \\<Rightarrow>('e tev list, 's) uexpr \\<Rightarrow> 's usubst \\<Rightarrow> ('s, 'e) taction\" (\"\\<F>'(_, _, _')\") where\n[upred_defs]: \"\\<F>(s,t,\\<sigma>) = U(\\<lceil>s\\<rceil>\\<^sub>S\\<^sub>< \\<and> tsyme t \\<and> \\<lceil>\\<langle>\\<sigma>\\<rangle>\\<^sub>a\\<rceil>\\<^sub>S)\" \n  \ntext \\<open> A timed observation represents a period of delay. The set @{term X} characterises the set of\n  events that are accepted during this period. The set @{term A} characterises the possible delay\n  periods, for example @{term \"{0..n}\"} means a delay of between $0$ and $n$ units. \\<close>\n\ndefinition tc_time :: \"('e set, 's) uexpr \\<Rightarrow> (nat set, 's) uexpr \\<Rightarrow> ('s, 'e) taction\" (\"\\<T>'(_, _')\") where \n[upred_defs]: \"\\<T>(X, A) = U(\\<exists> t \\<in> tocks \\<lceil>- X\\<rceil>\\<^sub>S\\<^sub><. $tr\\<acute> = $tr @ \\<guillemotleft>t\\<guillemotright> \\<and> length(\\<guillemotleft>t\\<guillemotright>) \\<in> \\<lceil>A\\<rceil>\\<^sub>S\\<^sub>< \\<and> $st\\<acute> = $st)\"\n\nutp_lift_notation tc_stable\nutp_lift_notation tc_unstable\nutp_lift_notation tc_final (2)\nutp_lift_notation tc_time\n\nlemma [closure]: \"\\<E>(s, t, E, p) is TRR\"\n  by (rel_auto)\n\nlemma [closure]: \"\\<E>(s, t, E, p) is TDC\"\n  by (rel_auto, (meson refusal_mp)+)\n\nlemma [closure]: \"\\<U>(s, t) is TRR\"\n  by (rel_auto)\n\nlemma [closure]: \"\\<F>(s, t, \\<sigma>) is TRR\"\n  by (rel_auto)\n\nlemma [closure]: \"\\<T>(X, A) is TRR\"\n  by (rel_auto)\n\nlemma [closure]: \"\\<T>(X, A) is TIP\"\n  by (rel_auto)\n\nlemma [unrest]: \"$st\\<acute> \\<sharp> \\<E>(s, t, E, p)\"\n  by (rel_auto)\n\nlemma [unrest]: \"$st\\<acute> \\<sharp> \\<U>(s, t)\"\n  by (rel_auto)\n\ntext \\<open> Unstable observations are subsumed by stable ones \\<close>\n\nlemma instability_subsumed: \"\\<E>(s, t, E, p) \\<sqsubseteq> \\<U>(s, t)\"\n  by (rel_auto)\n\nlemma \"(\\<E>(s\\<^sub>1, t, E\\<^sub>1, p\\<^sub>1) \\<and> \\<E>(s\\<^sub>2, t, E\\<^sub>2, p\\<^sub>2)) = \\<E>(s\\<^sub>1 \\<and> s\\<^sub>2, t, E\\<^sub>1 \\<union> E\\<^sub>2, p\\<^sub>1 \\<and> p\\<^sub>2)\"\n  by (rel_auto)\n\nlemma stability_modulo_ref: \"(\\<exists> $pat\\<acute> \\<bullet> \\<exists> $ref\\<acute> \\<bullet> \\<E>(s, t, E, p)) = (\\<exists> $pat\\<acute> \\<bullet> \\<exists> $ref\\<acute> \\<bullet> \\<U>(s, t))\"\n  by (rel_auto, meson rmember.simps(1))\n\nlemma tc_final_compose [rpred]: \"\\<F>(s\\<^sub>1, t\\<^sub>1, \\<sigma>\\<^sub>1) ;; \\<F>(s\\<^sub>2, t\\<^sub>2, \\<sigma>\\<^sub>2) = \\<F>(s\\<^sub>1 \\<and> \\<sigma>\\<^sub>1 \\<dagger> s\\<^sub>2, t\\<^sub>1 @ \\<sigma>\\<^sub>1 \\<dagger> t\\<^sub>2, \\<sigma>\\<^sub>2 \\<circ>\\<^sub>s \\<sigma>\\<^sub>1)\"\n  apply (trr_auto)\n  using tock_ord_append apply blast\n  apply (metis append_take_drop_id tock_ord_decompose)\n  done\n\nutp_const UINFIMUM (1) USUPREMUM (1)\n\nlemma time_stable_compose:\n  \"\\<T>(X, A) ;; \\<E>(s, t, E, p) = (\\<Sqinter> n \\<bullet> \\<E>(n \\<in> A \\<and> s, bop (^) [Tock (-X)] n @ t, E, p))\"\n  apply (trr_auto)\n  apply (metis lit.rep_eq tock_ord_append tocks_order_power)\n  apply (metis lit.rep_eq tock_ord_append tocks_order_power)\n  apply (metis (mono_tags, opaque_lifting) append_take_drop_id length_replicate power_replicate tock_ord_decompose(1) tock_ord_decompose(2) tock_ord_def tock_power_in_tocks tocks_ord_closed)\n  apply (metis (mono_tags, opaque_lifting) append_take_drop_id length_replicate power_replicate tock_ord_decompose(1) tock_ord_decompose(2) tock_ord_def tock_power_in_tocks tocks_ord_closed)\n  done\n\nlemma time_unstable_compose:\n  \"\\<T>(X, A) ;; \\<U>(s, t) = (\\<Sqinter> n \\<bullet> \\<U>(\\<guillemotleft>n\\<guillemotright> \\<in> A \\<and> s, bop (^) [Tock (-X)] \\<guillemotleft>n\\<guillemotright> @ t))\"\n  apply (trr_auto)\n  apply (metis tock_ord_append tocks_order_power)\n  apply (metis (mono_tags, opaque_lifting) append_take_drop_id length_replicate power_replicate tock_ord_decompose(1) tock_ord_decompose(2) tock_ord_def tock_power_in_tocks tocks_ord_closed)\n  done\n\nlemma time_final_compose:\n  \"\\<T>(X, A) ;; \\<F>(s, t, \\<sigma>) = (\\<Sqinter> n \\<bullet> \\<F>(\\<guillemotleft>n\\<guillemotright> \\<in> A \\<and> s, bop (^) [Tock (-X)] \\<guillemotleft>n\\<guillemotright> @ t, \\<sigma>))\"\n  apply (trr_auto)\n  apply (metis tock_ord_append tocks_order_power)\n  apply (metis (mono_tags, opaque_lifting) append_take_drop_id length_replicate power_replicate tock_ord_decompose(1) tock_ord_decompose(2) tock_ord_def tock_power_in_tocks tocks_ord_closed)\n  done\n\nlemma [rpred]: \"\\<F>(s\\<^sub>1, t\\<^sub>1, \\<sigma>) ;; \\<E>(s\\<^sub>2, t\\<^sub>2, E, p) = \\<E>(s\\<^sub>1 \\<and> \\<sigma> \\<dagger> s\\<^sub>2, t\\<^sub>1 @ \\<sigma> \\<dagger> t\\<^sub>2, \\<sigma> \\<dagger> E, \\<sigma> \\<dagger> p)\"\n  apply (trr_auto)\n  apply (metis tock_ord_append)\n  using tock_ord_append apply blast\n  apply (metis append_take_drop_id tock_ord_decompose(1) tock_ord_decompose(2))\n  apply (metis append_take_drop_id tock_ord_decompose(1) tock_ord_decompose(2))\n  done\n\nlemma [rpred]: \"\\<F>(s\\<^sub>1, t\\<^sub>1, \\<sigma>) ;; \\<U>(s\\<^sub>2, t\\<^sub>2) = \\<U>(s\\<^sub>1 \\<and> \\<sigma> \\<dagger> s\\<^sub>2, t\\<^sub>1 @ \\<sigma> \\<dagger> t\\<^sub>2)\"\n  apply (trr_auto)\n  apply (metis tock_ord_append)\n  apply (metis append_take_drop_id tock_ord_decompose(1) tock_ord_decompose(2))\n  done\n\nlemma [rpred]: \"\\<T>(X, {}) = false\"\n  by (rel_auto)\n\nlemma [rpred]: \"\\<T>(X, {0}) = II\\<^sub>t\"\n  by (rel_auto)\n\nlemma [rpred]: \"\\<F>(true, [], id\\<^sub>s) = II\\<^sub>t\"\n  by (rel_simp)\n\nlemma time_single_single [rpred]: \"\\<T>(X, {m}) ;; \\<T>(X, {n}) = \\<T>(X, {m+n})\"\n  by (trr_auto)\n     (metis (mono_tags, opaque_lifting) add_right_cancel append_take_drop_id length_append length_drop plus_list_def tocks_append trace_class.add_diff_cancel_left)\n\nlemma time_single_lessthan [rpred]: \"\\<T>(X, {m}) ;; \\<T>(X, {0..<n}) = \\<T>(X, {m..<m+n})\"\n  by trr_auto\n     (metis (no_types, lifting) add_left_strict_mono add_right_cancel append_take_drop_id diff_add_cancel_left' length_append length_drop tocks_append)\n\nlemma time_single_atMost [rpred]: \"\\<T>(X, {m}) ;; \\<T>(X, {0..n}) = \\<T>(X, {m..m+n})\"\n  by trr_auto\n     (metis (no_types, opaque_lifting) add_le_cancel_left add_right_cancel append_take_drop_id diff_add_cancel_left' length_append length_drop tocks_append)\n\nlemma time_single_atLeast [rpred]: \"\\<T>(X, {m}) ;; \\<T>(X, {n..}) = \\<T>(X, {m+n..})\"\n  apply trr_auto\n  apply (rename_tac t s)\n  apply (rule_tac x=\"take (\\<lbrakk>m\\<rbrakk>\\<^sub>e s) t\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"drop (\\<lbrakk>m\\<rbrakk>\\<^sub>e s) t\" in bexI)\n   apply (auto)\n  done\n\nlemma split_time_dom:\n  fixes l :: nat\n  assumes \"m\\<^sub>1 + m\\<^sub>2 \\<le> l\" \"l \\<le> m\\<^sub>1 + m\\<^sub>2 + (n\\<^sub>1 + n\\<^sub>2)\"\n  shows \"(\\<exists> n. n \\<le> l \\<and> m\\<^sub>1 \\<le> n \\<and> m\\<^sub>2 + n \\<le> l \\<and> n \\<le> m\\<^sub>1+n\\<^sub>1 \\<and> l \\<le> m\\<^sub>2+n\\<^sub>2+n)\"\n  using assms\n  by presburger\n\nlemma [rpred]: \"\\<T>(X, {m\\<^sub>1..m\\<^sub>1+n\\<^sub>1}) ;; \\<T>(X, {m\\<^sub>2..m\\<^sub>2+n\\<^sub>2}) = \\<T>(X, {m\\<^sub>1 + m\\<^sub>2..m\\<^sub>1 + m\\<^sub>2+(n\\<^sub>1 + n\\<^sub>2)})\"\nproof (trr_auto)\n  fix t s\n\n  assume a: \"t \\<in> tocks (- \\<lbrakk>X\\<rbrakk>\\<^sub>e s)\" \"\\<lbrakk>m\\<^sub>1\\<rbrakk>\\<^sub>e s + \\<lbrakk>m\\<^sub>2\\<rbrakk>\\<^sub>e s \\<le> length t\" \"length t \\<le> \\<lbrakk>m\\<^sub>1\\<rbrakk>\\<^sub>e s + \\<lbrakk>m\\<^sub>2\\<rbrakk>\\<^sub>e s + (\\<lbrakk>n\\<^sub>1\\<rbrakk>\\<^sub>e s + \\<lbrakk>n\\<^sub>2\\<rbrakk>\\<^sub>e s)\"\n  then obtain n where n: \"n \\<le> length t\" \"\\<lbrakk>m\\<^sub>1\\<rbrakk>\\<^sub>e s \\<le> n\" \"\\<lbrakk>m\\<^sub>2\\<rbrakk>\\<^sub>e s + n \\<le> length t\" \"n \\<le> \\<lbrakk>m\\<^sub>1\\<rbrakk>\\<^sub>e s+\\<lbrakk>n\\<^sub>1\\<rbrakk>\\<^sub>e s\" \"length t \\<le> \\<lbrakk>m\\<^sub>2\\<rbrakk>\\<^sub>e s+\\<lbrakk>n\\<^sub>2\\<rbrakk>\\<^sub>e s+n\"\n    using split_time_dom by blast\n\n  with a show \"\\<exists>tr. tr \\<in> tocks (- \\<lbrakk>X\\<rbrakk>\\<^sub>e s) \\<and>\n                \\<lbrakk>m\\<^sub>1\\<rbrakk>\\<^sub>e s \\<le> length tr \\<and>\n                length tr \\<le> \\<lbrakk>m\\<^sub>1\\<rbrakk>\\<^sub>e s + \\<lbrakk>n\\<^sub>1\\<rbrakk>\\<^sub>e s \\<and> (\\<exists>x\\<in>tocks (- \\<lbrakk>X\\<rbrakk>\\<^sub>e s). t = tr @ x \\<and> \\<lbrakk>m\\<^sub>2\\<rbrakk>\\<^sub>e s \\<le> length x \\<and> length x \\<le> \\<lbrakk>m\\<^sub>2\\<rbrakk>\\<^sub>e s + \\<lbrakk>n\\<^sub>2\\<rbrakk>\\<^sub>e s)\"\n    apply (rule_tac x=\"take n t\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"drop n t\" in bexI)\n     apply (auto)\n    done\nqed\n\ndefinition filter_idle :: \"('s, 'e) taction \\<Rightarrow> ('s, 'e) taction\" (\"idle'(_')\") where\n[upred_defs]: \"filter_idle P = U(R1(P \\<and> &tt \\<in> tocks UNIV))\"\n\ndefinition filter_time :: \"('s, 'e) taction \\<Rightarrow> ('s, 'e) taction\" (\"time'(_')\") where\n[upred_defs]: \"filter_time P = U(R1(\\<exists> $st\\<acute> \\<bullet> \\<exists> $pat\\<acute> \\<bullet> \\<exists> $ref\\<acute> \\<bullet> P\\<lbrakk>idleprefix(&tt)/&tt\\<rbrakk>))\"\n\ndefinition filter_active :: \"('s, 'e) taction \\<Rightarrow> ('s, 'e) taction\" (\"active'(_')\") where \n[upred_defs]: \"filter_active(P) = U(R1(\\<exists> t e t'. P \\<and> \\<guillemotleft>t\\<guillemotright> \\<in> tocks UNIV \\<and> &tt = \\<guillemotleft>t @ (Evt e # t')\\<guillemotright>))\"\n\ntext \\<open> We make the decision that state changes are not observable during idle periods, as this\n  would complicate the semantics. They are only revealed at termination and quiescence. \\<close>\n\ndefinition merge_time :: \"('s, 'e) taction \\<Rightarrow> ('s, 'e) taction \\<Rightarrow> ('s, 'e) taction\" (infixr \"\\<triangleright>\\<^sub>t\" 65) where\n[upred_defs]: \n  \"P \\<triangleright>\\<^sub>t Q = \n    U(R1\n      (\\<exists> t es. &tt = \\<guillemotleft>t @ es\\<guillemotright> \\<comment> \\<open> The trace can be decomposed into two pieces \\<close>\n            \\<and> \\<guillemotleft>t\\<guillemotright> \\<in> tocks UNIV \\<comment> \\<open> The first piece is a sequence of tocks \\<close>\n            \\<and> (\\<guillemotleft>es\\<guillemotright> = [] \\<comment> \\<open> The second piece is either empty ... \\<close>\n               \\<or> hd(\\<guillemotleft>es\\<guillemotright>) \\<in> range(Evt)) \\<comment> \\<open> ... or begins with an event \\<close>\n            \\<and> (\\<exists> $st\\<acute> \\<bullet> \\<exists> $pat\\<acute> \\<bullet> \\<exists> $ref\\<acute> \\<bullet> P)\\<lbrakk>\\<guillemotleft>t\\<guillemotright>/&tt\\<rbrakk> \\<comment> \\<open> The first piece is a trace of @{term P} \\<close>\n            \\<and> Q \\<comment> \\<open> @{term Q} admits the whole trace \\<close>\n            ))\"\n\ntext \\<open> There is a trace whose idle prefix is shared by all elements of the set, and at least\n  one element which admits the trace plus at least one event. \\<close>\n\ndefinition tmerge :: \"'i set \\<Rightarrow> ('i \\<Rightarrow> ('s, 'e) taction) \\<Rightarrow> ('s, 'e) taction\" where\n[upred_defs]: \n  \"tmerge I P = \n      U(R1\n        (\\<exists> t es. &tt = \\<guillemotleft>t @ es\\<guillemotright>\n               \\<and> \\<guillemotleft>t\\<guillemotright> \\<in> tocks UNIV \n               \\<and> (\\<guillemotleft>es\\<guillemotright> = [] \n                  \\<or> hd(\\<guillemotleft>es\\<guillemotright>) \\<in> range(Evt))\n               \\<and> (\\<Squnion> i\\<in>I \\<bullet> (\\<exists> $st\\<acute> \\<bullet> \\<exists> $pat\\<acute> \\<bullet> \\<exists> $ref\\<acute> \\<bullet> (@P i)\\<lbrakk>\\<guillemotleft>t\\<guillemotright>/&tt\\<rbrakk>)) \n               \\<and> (\\<Sqinter> i \\<in> I \\<bullet> @P i) \n               ))\"\n\nsyntax\n  \"_tmerge\" :: \"pttrn \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"\\<And>\\<^sub>t _\\<in>_ \\<bullet> _\" [0, 0, 10] 10)\n\ntranslations\n  \"\\<And>\\<^sub>t i\\<in>I \\<bullet> P\" == \"CONST tmerge I (\\<lambda> i. P)\"\n\ntext \\<open> The time merge operator merges the delay traces of one relation with active traces of another. \\<close>\n\nutp_const filter_idle filter_active merge_time tmerge\n\nlemma idle_TRR [closure]: assumes \"P is TRR\" shows \"idle(P) is TRR\"\nproof -\n  have \"TRR(idle(TRR(P))) = idle(TRR(P))\" by rel_blast\n  thus \"idle(P) is TRR\" by (metis Healthy_def assms)\nqed\n\nlemma active_TRR [closure]: assumes \"P is TRR\" shows \"active(P) is TRR\"\nproof -\n  have \"TRR(active(TRR(P))) = active(TRR(P))\" by rel_blast\n  thus \"active(P) is TRR\" by (metis Healthy_def assms)\nqed\n\nlemma time_TRR [closure]: assumes \"P is TRR\" shows \"time(P) is TRR\"\nproof -\n  have \"TRR(time(TRR(P))) = time(TRR(P))\" by rel_blast\n  thus \"time(P) is TRR\" by (metis Healthy_def assms)\nqed\n\nlemma TRR_merge_time [closure]: \n  assumes \"P is TRR\" \"Q is TRR\" \n  shows \"P \\<triangleright>\\<^sub>t Q is TRR\"\nproof -\n  have \"TRR(P) \\<triangleright>\\<^sub>t TRR(Q) is TRR\"\n    by (rel_simp, metis)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma \n  assumes \"P is TRR\"\n  shows \"(P \\<and> time(P)) is TIP\"\n  apply (rel_auto) oops\n\nlemma active_disj [rpred]: \"active(P \\<or> Q) = (active(P) \\<or> active(Q))\"\n  by rel_auto\n\nlemma idle_conj [rpred]: \"idle(P \\<and> Q) = (idle(P) \\<and> idle(Q))\"\n  by (rel_auto)\n\nlemma idle_idem [rpred]: \"idle(idle(P)) = idle(P)\"\n  by rel_auto\n\nlemma idle_true [rpred]: \"idle(true) = \\<T>({}, {0..}) ;; \\<E>(true, [], {}, true)\"\n  by rel_auto\n\nlemma idle_true': \"idle(true) = U(R1(&tt \\<in> tocks UNIV))\"\n  by rel_auto\n\nlemma active_idem [rpred]: \"active(active(P)) = active(P)\"\n  by rel_auto\n\nlemma TRR_idle_or_active [rpred]:\n  assumes \"P is TRR\"\n  shows \"(idle(P) \\<or> active(P)) = P\"\n  by (trr_auto cls: assms)\n     (metis hd_Cons_tl hd_activesuffix idle_active_decomp idleprefix_tocks rangeE tocks_Nil tocks_append)\n\n \nlemma refine_eval_dest: \"P \\<sqsubseteq> Q \\<Longrightarrow> \\<lbrakk>Q\\<rbrakk>\\<^sub>e s \\<Longrightarrow> \\<lbrakk>P\\<rbrakk>\\<^sub>e s\"\n  by (rel_auto)\n\nlemma Healthy_after: \"\\<lbrakk> \\<And> i. P i is H \\<rbrakk> \\<Longrightarrow> H \\<circ> P = P\"\n  by (metis (mono_tags, lifting) Healthy_if fun.map_cong fun.map_id0 id_apply image_iff)\n\nlemma tmerge_cong:  \n  assumes \"\\<And> i. i \\<in> I \\<Longrightarrow> P i = Q i\"\n  shows \"(\\<And>\\<^sub>t i\\<in>I \\<bullet> P i) = (\\<And>\\<^sub>t i\\<in>I \\<bullet> Q i)\"\n  using assms apply (rel_auto)\n  apply (metis idle_active_decomp minus_cancel plus_list_def tocks_idleprefix_fp trace_class.add_diff_cancel_left)\n  apply (metis rangeI)\n  apply (metis (full_types) append_Nil2)\n  apply (metis rangeI)\n  done\n\nlemma RR_tmerge [closure]:\n  assumes \"\\<And> i. i \\<in> I \\<Longrightarrow> P i is RR\"\n  shows \"(\\<And>\\<^sub>t i\\<in>I \\<bullet> P i) is RR\"\nproof -\n  have \"(\\<And>\\<^sub>t i\\<in>I \\<bullet> RR (P i)) is RR\"\n    by (rel_auto, blast+)\n  thus ?thesis\n    by (metis Healthy_if assms tmerge_cong)\nqed\n\nlemma [closure]: \"P is RR \\<Longrightarrow> TRR P is RR\"\n  using Healthy_def TRR_implies_RR trel_theory.HCond_Idem by auto\n\nlemma TRR_tmerge [closure]:\n  assumes \"\\<And> i. i \\<in> I \\<Longrightarrow> P i is TRR\"\n  shows \"(\\<And>\\<^sub>t i\\<in>I \\<bullet> P i) is TRR\"\nproof -\n  have \"(\\<And>\\<^sub>t i\\<in>I \\<bullet> TRR (P i)) is TRR\"\n    unfolding Healthy_def by (rrel_auto cls: assms)\n  thus ?thesis\n    by (metis Healthy_if assms tmerge_cong)\nqed\n\nlemma TRR_tmerge_single [closure]: \"P i is TRR \\<Longrightarrow> tmerge {i} P is TRR\"\n  by (auto intro: closure)\n\nlemma TRR_tmerge_dual [closure]: \"\\<lbrakk> P i is TRR; P j is TRR \\<rbrakk> \\<Longrightarrow> tmerge {i, j} P is TRR\"\n  by (auto intro: closure)\n\nlemma tmerge_single:\n  assumes \"P i is TRR\" \"P i is TIP\"\n  shows \"tmerge {i} P = P i\"\n  apply (trr_auto cls: assms)\n  apply (drule refine_eval_dest[OF TIP_prop[OF assms(1) assms(2)]])\n  apply (rel_simp')\n  apply (metis hd_activesuffix idle_active_decomp idleprefix_tocks)\n  done\n\nlemma time_merge_self [rpred]:\n  assumes \"P is TRR\" \"P is TIP\"\n  shows \"P \\<triangleright>\\<^sub>t P = P\"\n  apply (trr_auto cls: assms)\n  apply (drule refine_eval_dest[OF TIP_prop[OF assms(1) assms(2)]])\n  apply (rel_simp')\n  apply (metis hd_activesuffix idle_active_decomp idleprefix_tocks)\n  done\n\nlemma time_conj:\n  \"idle(P \\<and> Q) = (idle(P) \\<and> idle(Q))\"\n  by (rel_auto)\n\nlemma time_merge_time_left:\n  \"idle(P) \\<triangleright>\\<^sub>t Q = P \\<triangleright>\\<^sub>t Q\"\n  by (rel_auto, blast+)\n\nlemma TRR_conj [closure]:\n  assumes \"P is TRR\" \"Q is TRR\"\n  shows \"P \\<and> Q is TRR\"\nproof -\n  have \"TRR(P) \\<and> TRR(Q) is TRR\"\n    unfolding Healthy_def by (rrel_auto cls: assms)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma TRR_ex_ref' [closure]:\n  assumes \"P is TRR\"\n  shows \"(\\<exists> $ref\\<acute> \\<bullet> P) is TRR\"\nproof -\n  have \"(\\<exists> $ref\\<acute> \\<bullet> TRR(P)) is TRR\"\n    by (rel_auto)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n  \nlemma shEx_or: \"(\\<^bold>\\<exists> x \\<bullet> P \\<or> Q) = ((\\<^bold>\\<exists> x \\<bullet> P) \\<or> (\\<^bold>\\<exists> x \\<bullet> Q))\"\n  by (rel_auto)\n\nlemma tock_prefix_eq:\n  assumes \"x @ (Evt a # as) = y @ (Evt b # bs)\" \"x \\<in> tocks X\" \"y \\<in> tocks Y\"\n  shows \"x = y \\<and> a = b \\<and> as = bs\"\nproof (safe)\n  show 1:\"x = y\"\n  proof (rule ccontr)\n    assume neq: \"x \\<noteq> y\"\n    from assms(1) have \"\\<forall> i. (x @ (Evt a # as))!i = (y @ (Evt b # bs))!i\"\n      by simp\n    show False\n    proof (cases \"length x\" \"length y\" rule: linorder_cases)\n      case less thus ?thesis\n        by (metis assms(1) assms(3) less nth_append nth_append_length nth_mem rangeE subsetD teva.distinct(1) tocks_Tock)\n    next\n      case equal\n      then show ?thesis\n        by (metis append_eq_append_conv assms(1) neq)\n    next\n      case greater thus ?thesis\n        by (metis assms(1) assms(2) nth_append nth_append_length nth_mem rangeE subsetD teva.distinct(1) tocks_Tock)\n    qed\n  qed\n  show \"a = b\" \n    by (metis \"1\" assms(1) nth_append_length teva.inject(2))\n  show \"as = bs\"\n    by (metis \"1\" assms(1) list.inject same_append_eq)\nqed\n\n\nlemma tmerge_dual_1:\n  assumes \"P i is TRR\" \"P j is TRR\"\n  shows \"tmerge {i, j} P = \n          ((P i \\<triangleright>\\<^sub>t P i \\<and> P j \\<triangleright>\\<^sub>t P i) \\<or> (P i \\<triangleright>\\<^sub>t P j \\<and> P j \\<triangleright>\\<^sub>t P j))\"\n  apply (trr_auto cls: assms)\n  apply blast\n\n                      apply blast\n  apply (metis (no_types) append_Nil2)\n  apply blast\n  apply blast\n  apply blast\n  apply auto\n  apply blast\n            apply blast\n           apply blast\n          apply blast\n         apply blast\n  apply (metis append_Nil2 list.collapse tocks_Evt)\n  apply (metis (no_types) append_self_conv tocks_append)\n  apply (smt append_self_conv hd_Cons_tl idleprefix_concat_Evt rangeI tocks_idleprefix_fp)\n  apply blast\n  apply (metis append_Nil2 hd_Cons_tl tocks_Evt)\n  apply (metis append_Nil2 hd_Cons_tl tocks_Evt)\n  apply (smt append_Nil2 hd_Cons_tl rangeI tock_prefix_eq tocks_Evt tocks_append)\n  done\n\n\n\nlemma tmerge_dual:\n  assumes \"P i is TRR\" \"P j is TRR\" \"P i is TIP\" \"P j is TIP\"\n  shows \"tmerge {i, j} P = (P j \\<triangleright>\\<^sub>t P i \\<or> P i \\<triangleright>\\<^sub>t P j)\"\n  by (simp add: tmerge_dual_1 assms time_merge_self)\n\nlemma [rpred]: \"(P ;; \\<E>(s, t, E, p)) \\<triangleright>\\<^sub>t Q = (P ;; \\<U>(s, t)) \\<triangleright>\\<^sub>t Q\"\n  by (simp add: merge_time_def seqr_exists_right[THEN sym] stability_modulo_ref)\n\nlemma [rpred]: \"P \\<triangleright>\\<^sub>t false = false\"\n  by (rel_auto)\n\nlemma [rpred]: \"P \\<triangleright>\\<^sub>t (Q \\<or> R) = (P \\<triangleright>\\<^sub>t Q \\<or> P \\<triangleright>\\<^sub>t R)\"\n  by (rel_blast)\n\nlemma [rpred]: \"(P \\<or> Q) \\<triangleright>\\<^sub>t R = (P \\<triangleright>\\<^sub>t R \\<or> Q \\<triangleright>\\<^sub>t R)\"\n  by (rel_simp, metis)\n\nlemma tock_ord_Evt: \"x \\<subseteq>\\<^sub>t Evt e # y \\<Longrightarrow> (\\<exists> t. x = Evt e # t \\<and> t \\<subseteq>\\<^sub>t y)\"\n  apply (simp add: tock_ord_def)\n  apply (rule_tac x=\"tl x\" in exI)\n  apply (auto)\n  apply (metis hd_Cons_tl length_0_conv nat.simps(3) nth_Cons_0 teva.distinct(1) zero_less_Suc)\n  apply (metis Nitpick.size_list_simp(2) Suc_less_eq nat.simps(3) nth_Cons_Suc nth_tl)\n  done\n\nlemma tock_ord_EvtE [elim!]: \"\\<lbrakk> x \\<subseteq>\\<^sub>t Evt e # y; \\<And> t. \\<lbrakk> x = Evt e # t; t \\<subseteq>\\<^sub>t y \\<rbrakk> \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> P\"\n  by (metis tock_ord_Evt)\n\nlemma tock_ord_Evt_hd_eq [simp]: \"Evt e # x \\<subseteq>\\<^sub>t Evt f # y \\<longleftrightarrow> (e = f \\<and> x \\<subseteq>\\<^sub>t y)\"\n  by (auto simp add: tock_ord_def)\n     (smt One_nat_def add.commute diff_add_cancel_left' length_Cons less_Suc0 list.size(4) nat_add_left_cancel_less not_less nth_Cons')\n\nlemma [rpred]: \"(\\<T>(E\\<^sub>1, T\\<^sub>1) ;; \\<U>(s\\<^sub>1, [])) \\<triangleright>\\<^sub>t (\\<T>(E\\<^sub>2, T\\<^sub>2) ;; \\<E>(s\\<^sub>2, [], B, p)) = \\<T>(E\\<^sub>1 \\<union> E\\<^sub>2, T\\<^sub>1 \\<inter> T\\<^sub>2) ;; \\<E>(s\\<^sub>1 \\<and> s\\<^sub>2, [], B, p)\"\n  apply (trr_auto)\n  apply (metis list.collapse tocks_Evt tocks_Nil)\n  apply (metis add.right_neutral list.collapse list.size(3) tocks_Evt)\n  apply (metis list.collapse tocks_Evt tocks_Nil)\n    apply (metis add.right_neutral list.collapse list.size(3) tocks_Evt)\n  apply (metis append_Nil2 tocks_idleprefix_fp tocks_iff_idleprefix_fp tocks_inter1 tocks_inter2)\n  apply (metis append_Nil2 tocks_idleprefix_fp tocks_iff_idleprefix_fp tocks_inter1 tocks_inter2)\n  done\n\nlemma [rpred]: \"(\\<T>(E\\<^sub>1, T\\<^sub>1) ;; \\<U>(s\\<^sub>1, [])) \\<triangleright>\\<^sub>t (\\<T>(E\\<^sub>2, T\\<^sub>2) ;; \\<U>(s\\<^sub>2, [])) = \\<T>(E\\<^sub>1 \\<union> E\\<^sub>2, T\\<^sub>1 \\<inter> T\\<^sub>2) ;; \\<U>(s\\<^sub>1 \\<and> s\\<^sub>2, [])\"\n  apply (trr_auto)\n  apply (metis list.collapse tocks_Evt tocks_Nil)\n  apply (metis add.right_neutral list.collapse list.size(3) tocks_Evt)\n  using tocks_idleprefix_fp tocks_iff_idleprefix_fp apply blast\n  done\n\nlemma [rpred]: \"(\\<T>(E\\<^sub>1, T\\<^sub>1) ;; \\<U>(s\\<^sub>1, [])) \\<triangleright>\\<^sub>t (\\<T>(E\\<^sub>2, T\\<^sub>2) ;; \\<E>(s\\<^sub>2, Evt e # es, B, p)) = \\<T>(E\\<^sub>1 \\<union> E\\<^sub>2, T\\<^sub>1 \\<inter> T\\<^sub>2) ;; \\<E>(s\\<^sub>1 \\<and> s\\<^sub>2, Evt e # es, B, p)\"\n  oops\n\nlemma [rpred]: \"(\\<T>(E\\<^sub>1, T\\<^sub>1) ;; \\<U>(s\\<^sub>1, [])) \\<triangleright>\\<^sub>t (\\<T>(E\\<^sub>2, T\\<^sub>2) ;; \\<U>(s\\<^sub>2, Evt e # es)) = \\<T>(E\\<^sub>1 \\<union> E\\<^sub>2, T\\<^sub>1 \\<inter> T\\<^sub>2) ;; \\<U>(s\\<^sub>1 \\<and> s\\<^sub>2, Evt e # es)\"\n  oops\n\n\nlemma tock_prefix_eq':\n  assumes \"x @ (Evt a # as) = y @ z\" \"x \\<in> tocks X\" \"y \\<in> tocks Y\" \"hd(z) \\<in> range(Evt)\"\n  shows \"x = y \\<and> z = Evt a # as\"\nproof -\n  obtain b bs where \"z = Evt b # bs\"\n    by (metis append.right_neutral assms(1) assms(3) assms(4) hd_Cons_tl image_iff tocks_Evt tocks_append)\n  thus ?thesis\n    by (metis assms(1) assms(2) assms(3) tock_prefix_eq)\nqed\n\nlemma [rpred]: \"(\\<T>(E\\<^sub>1, T\\<^sub>1) ;; \\<U>(s\\<^sub>1, [])) \\<triangleright>\\<^sub>t (\\<T>(E\\<^sub>2, T\\<^sub>2) ;; \\<F>(s\\<^sub>2, Evt e # es, \\<sigma>)) = \\<T>(E\\<^sub>1 \\<union> E\\<^sub>2, T\\<^sub>1 \\<inter> T\\<^sub>2) ;; \\<F>(s\\<^sub>1 \\<and> s\\<^sub>2, Evt e # es, \\<sigma>)\"\n  apply (trr_auto)\n  apply (metis append_Nil2 hd_Cons_tl idleprefix_concat_Evt tock_ord_Evt_hd_eq tocks_idleprefix_fp tocks_inter)\n  apply (metis (mono_tags, lifting) idleprefix_tocks list.sel(1) range_eqI semilattice_inf_class.inf_le1 semilattice_inf_class.inf_le2 tock_ord_Evt_hd_eq tocks_idleprefix_fp tocks_subset)\n  done\n\nlemma [rpred]: \"(\\<T>({}, T\\<^sub>1) ;; \\<U>(true, [])) \\<triangleright>\\<^sub>t \\<T>({}, T\\<^sub>2) = \\<T>({}, T\\<^sub>1 \\<inter> T\\<^sub>2)\"\n  by (rel_auto, metis add.right_neutral hd_Cons_tl list.size(3) tocks_Evt, blast)\n  \nlemma [rpred]: \"idle(II\\<^sub>t) = II\\<^sub>t\"\n  by (rel_auto)\n\nlemma [rpred]: \"idle(false) = false\"\n  by (rel_auto)\n\nlemma [rpred]: \"idle(\\<T>(X, A)) = \\<T>(X, A)\" \n  by (rel_auto, simp add: tocks_subset)\n\nlemma time_tocks_stable [rpred]: \"idle(\\<T>(X, A) ;; \\<E>(s, [], E, p)) = \\<T>(X, A) ;; \\<E>(s, [], E, p)\"\n  by (rel_auto; simp add: tocks_subset)\n\nlemma [rpred]: \"idle(P \\<or> Q) = (idle(P) \\<or> idle(Q))\"\n  by (rel_auto)\n\nlemma [rpred]: \"idle(\\<T>(X, A) ;; \\<U>(s, [])) = \\<T>(X, A) ;; \\<U>(s, [])\"\n  by (rel_auto, simp add: tocks_subset)\n\nlemma [rpred]: \"idle(\\<E>(s, [], E, p)) = \\<E>(s, [], E, p)\"\n  by (rel_auto)\n\nlemma [rpred]: \"idle(\\<E>(s, Evt t # ts, E, p)) = false\"\n  by (rel_simp)\n\nlemma [rpred]: \"idle(\\<U>(s, Evt t # ts)) = false\"\n  by (rel_simp)\n\nlemma [rpred]: \"(\\<T>(X\\<^sub>1, A\\<^sub>1) \\<and> \\<T>(X\\<^sub>2, A\\<^sub>2)) = \\<T>(X\\<^sub>1 \\<union> X\\<^sub>2, A\\<^sub>1 \\<inter> A\\<^sub>2)\"\n  by (rel_auto)\n\nlemma [rpred]: \"(\\<T>(A, T\\<^sub>1) ;; \\<E>(s\\<^sub>1, [], {}, true) \\<and> \\<T>(B, T\\<^sub>2) ;; \\<E>(s\\<^sub>2, [], {}, true)) \n       = \\<T>(A \\<union> B, T\\<^sub>1 \\<inter> T\\<^sub>2) ;; \\<E>(s\\<^sub>1 \\<and> s\\<^sub>2, [], {}, true)\"\n  by (rel_auto)\n\nlemma [rpred]: \"(\\<T>(X, A) ;; \\<E>(true, [], E\\<^sub>1, p\\<^sub>1) \\<and> \\<T>(Y, B) ;; \\<E>(true, [], E\\<^sub>2, p\\<^sub>2)) = \\<T>(X \\<union> Y, A \\<inter> B) ;; \\<E>(true, [], E\\<^sub>1 \\<union> E\\<^sub>2, p\\<^sub>1 \\<and> p\\<^sub>2)\"\n  by (rel_auto)\n\nlemma nat_set_simps [simp]:\n  fixes m::\"(nat, _) uexpr\"\n  shows \"U({0..<m} \\<inter> {m}) = U({})\" \"U(A \\<inter> A) = U(A)\"\n  by (rel_simp+)\n\nsubsection \\<open> Healthiness Conditions \\<close>\n\ntext \\<open> This is the same as Circus $Skip$, except that it includes an unstable intermediate state. \\<close>\n\ndefinition Skip :: \"('s,'e) taction\" where\n[rdes_def]: \"Skip = \\<^bold>R(true\\<^sub>r \\<turnstile> \\<U>(true, []) \\<diamondop> \\<F>(true, [], id\\<^sub>s))\"\n\ndefinition TC1 :: \"('s, 'e) taction \\<Rightarrow> ('s, 'e) taction\" where\n[rdes_def]: \"TC1(P) = Skip ;; P\"\n\nlemma Skip_self_unit: \"Skip ;; Skip = Skip\"\n  by rdes_eq\n\nlemma TC1_idem: \"TC1(TC1(P)) = TC1(P)\"\n  by (simp add: RA1 Skip_self_unit TC1_def)\n\ndefinition TC2 :: \"('s, 'e) taction \\<Rightarrow> ('s, 'e) taction\" where\n[rdes_def]: \"TC2(P) = P ;; Skip\"\n\nlemma TC2_idem: \"TC2(TC2(P)) = TC2(P)\"\n  by (simp add: seqr_assoc Skip_self_unit TC2_def)\n\nabbreviation \"TC \\<equiv> NRD \\<circ> TC2 \\<circ> TC1\"\n\nlemma TC_implies_NRD [closure]: \"P is TC \\<Longrightarrow> P is NRD\"\n  by (metis (no_types, opaque_lifting) Healthy_def NRD_idem comp_apply)\n\nlemma NRD_rdes [rdes_def]:\n  assumes \"P is RC\" \"Q is RR\" \"R is RR\"\n  shows \"NRD(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = (\\<^bold>R(P \\<turnstile> Q \\<diamondop> R))\"\n  by (simp add: Healthy_if NRD_rdes_intro assms)\n\nlemma TC1_rdes:\n  assumes \"P is RC\" \"Q is RR\" \"R is RR\"\n  shows \"TC1(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = \\<^bold>R(II\\<^sub>t wp\\<^sub>r P \\<turnstile> (\\<U>(true, []) \\<or> TRR(Q)) \\<diamondop> TRR(R))\"\n  using assms\n  by (rdes_simp simps: trr_left_unit, simp add: TRR_def TRR1_def Healthy_if)\n\nlemma TC1_TRR_rdes [rdes_def]:\n  assumes \"P is TRC\" \"Q is TRR\" \"R is TRR\"\n  shows \"TC1(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = \\<^bold>R(P \\<turnstile> (\\<U>(true, []) \\<or> Q) \\<diamondop> R)\"\n  by (subst TC1_rdes, simp_all add: closure assms wp Healthy_if)\n\nlemma trr_right_unit: \n  assumes \"P is TRR\" \"$ref\\<acute> \\<sharp> P\" \"$pat\\<acute> \\<sharp> P\"\n  shows \"P ;; II\\<^sub>t = P\"\nproof -\n  have \"TRR(\\<exists> $pat\\<acute> \\<bullet> \\<exists> $ref\\<acute> \\<bullet> P) ;; II\\<^sub>t = TRR(\\<exists> $pat\\<acute> \\<bullet> \\<exists> $ref\\<acute> \\<bullet> P)\"\n    by (rel_auto)\n  thus ?thesis\n    by (simp add: Healthy_if assms ex_unrest)\nqed\n\nlemma TRF_intro:\n  assumes \"P is TRR\" \"$ref\\<acute> \\<sharp> P\" \"$pat\\<acute> \\<sharp> P\"\n  shows \"P is TRF\"\n  by (metis Healthy_def TRF_def TRR3_def assms trr_right_unit)\n\nlemma TRF_unrests [unrest]:\n  assumes \"P is TRF\"\n  shows \"$ref\\<acute> \\<sharp> P\" \"$pat\\<acute> \\<sharp> P\"\nproof -\n  have \"$ref\\<acute> \\<sharp> TRF(P)\" \"$pat\\<acute> \\<sharp> TRF(P)\" \n    by (rel_auto)+\n  thus \"$ref\\<acute> \\<sharp> P\" \"$pat\\<acute> \\<sharp> P\"\n    by (simp_all add: Healthy_if assms)\nqed\n\nlemma TC2_rdes [rdes_def]:\n  assumes \"P is TRC\" \"Q is TRR\" \"R is TRR\"\n  shows \"TC2(\\<^bold>R(P \\<turnstile> Q \\<diamondop> R)) = \\<^bold>R(P \\<turnstile>(Q \\<or> R ;; \\<U>(true, [])) \\<diamondop> R ;; II\\<^sub>t)\"\n  using assms by (rdes_simp)\n\nlemma TC_implies_TC1 [closure]: \n  assumes \"P is TC\"\n  shows \"P is TC1\"\nproof -\n  have a:\"P is NRD\"\n    by (simp add: closure assms)\n  have \"TC1(TC(P)) = TC(P)\"\n    by (rdes_eq cls: a)\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n\nlemma TC_implies_TC2 [closure]: \n  assumes \"P is TC\"\n  shows \"P is TC2\"\nproof -\n  have a:\"P is NRD\"\n    by (simp add: closure assms)\n  have \"TC2(TC(P)) = TC(P)\"\n    by (rdes_eq cls: a)\n  thus ?thesis\n    by (metis Healthy_def assms)\nqed\n\nlemma TC_closed_seqr [closure]: \"\\<lbrakk> P is TC; Q is TC \\<rbrakk> \\<Longrightarrow> P ;; Q is TC\"\n  apply (auto intro!: Healthy_comp)\n  apply (simp add: closure)\n  apply (metis (no_types, opaque_lifting) Healthy_def RA1 TC2_def TC_implies_TC2)\n  apply (metis (no_types, opaque_lifting) Healthy_def RA1 TC1_def TC_implies_TC1)\n  done\n\nlemma TC_inner_TRR [closure]:\n  assumes \"P is TC\"\n  shows \"pre\\<^sub>R(P) is TRC\" \"peri\\<^sub>R(P) is TRR\" \"post\\<^sub>R(P) is TRR\"\nproof -\n  have a: \"P is NRD\"\n    using TC_implies_NRD assms by blast\n  have 1: \"P = \\<^bold>R(II\\<^sub>t wp\\<^sub>r pre\\<^sub>R P \\<turnstile> (\\<U>(true, []) \\<or> TRR (peri\\<^sub>R P)) \\<diamondop> TRR (post\\<^sub>R P))\"\n    by (metis Healthy_if NRD_is_RD NRD_neg_pre_RC RD_healths(2) RD_reactive_tri_design TC1_rdes TC_implies_TC1 a assms periR_RR postR_RR)\n  hence 2: \"II\\<^sub>t wp\\<^sub>r pre\\<^sub>R P = pre\\<^sub>R P\"\n    by (metis TRR_implies_RR TRR_tc_skip a preR_NRD_RR preR_rdes wp_rea_RR_closed)\n  thus [closure]: \"pre\\<^sub>R(P) is TRC\"\n    by (simp add: NRD_neg_pre_RC TRC_wp_intro a)\n  have \"peri\\<^sub>R(P) = (pre\\<^sub>R(P) \\<Rightarrow>\\<^sub>r (\\<U>(true, []) \\<or> TRR (peri\\<^sub>R P)))\"\n    by (subst 1, simp add: rdes closure assms 2)\n  also have \"... is TRR\"\n    by (simp add: closure assms)\n  finally show \"peri\\<^sub>R(P) is TRR\" .\n  have \"post\\<^sub>R(P) = (pre\\<^sub>R(P) \\<Rightarrow>\\<^sub>r TRR (post\\<^sub>R P))\"\n    by (metis 1 2 Healthy_Idempotent TRR_implies_RR a postR_rdes preR_NRD_RR trel_theory.HCond_Idempotent)\n  also have \"... is TRR\"\n    by (simp add: closure assms)\n  finally show \"post\\<^sub>R(P) is TRR\" .\nqed\n\nsubsection \\<open> Basic Constructs \\<close>\n\ntext \\<open> The divergent action cannot terminate and exhibits only instability in the pericondition. \\<close>\n\ndefinition Div :: \"('s,'e) taction\" where\n[rdes_def]: \"Div = \\<^bold>R(true\\<^sub>r \\<turnstile> \\<U>(true, []) \\<diamondop> false)\"\n\nlemma Div_TC [closure]: \"Div is TC\"\n  by (rule Healthy_intro, rdes_eq)\n\ndefinition AssignsT :: \"'s usubst \\<Rightarrow> ('s,'e) taction\" (\"\\<langle>_\\<rangle>\\<^sub>T\") where\n[rdes_def]: \"AssignsT \\<sigma> = \\<^bold>R(true\\<^sub>r \\<turnstile> \\<U>(true, []) \\<diamondop> \\<F>(true, [], \\<sigma>))\" \n\nlemma AssignsT_TC [closure]: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>T is TC\"\n  by (rule Healthy_intro, rdes_eq)\n\ntext \\<open> A timed deadlock does not terminate, but permits any period of time to pass, always remaining\n  in a quiescent state where another $tock$ can occur. \\<close>\n\ndefinition Stop :: \"('s,'e) taction\" where\n[rdes_def]: \"Stop = \\<^bold>R(true\\<^sub>r \\<turnstile> \\<T>({}, {0..}) ;; \\<E>(true, [], {}, true) \\<diamondop> false)\"\n\nlemma Stop_TC [closure]: \"Stop is TC\"\n  by (rule Healthy_intro, rdes_eq)\n\ntext \\<open> An untimed deadlock is stable, but does not accept any events. \\<close>\n\ndefinition Stop\\<^sub>U :: \"('s,'e) taction\" where\n[rdes_def]: \"Stop\\<^sub>U = \\<^bold>R(true\\<^sub>r \\<turnstile> \\<E>(true, [], {}, false) \\<diamondop> false)\"\n\nlemma Stop\\<^sub>U_TC [closure]: \"Stop\\<^sub>U is TC\"\n  by (rule Healthy_intro, rdes_eq)\n\ntext \\<open> SDF: Check the following definition against the tick-tock paper. It only allows prefixing\n  of non-tock events for now. \\<close>\n\ndefinition DoT :: \"('e, 's) uexpr \\<Rightarrow> ('s, 'e) taction\" (\"do\\<^sub>T'(_')\") where\n[rdes_def]: \"DoT a =\n  \\<^bold>R(true\\<^sub>r \n  \\<turnstile> \\<T>({a}, {0..}) ;; (\\<E>(true, [], {a}, true) \\<or> \\<U>(true, [Evt a]))\n  \\<diamondop> \\<T>({a}, {0..}) ;; \\<F>(true, [Evt a], id\\<^sub>s))\"\n\nlemma DoT_TC: \"do\\<^sub>T(e) is TC\"\n  by (rule Healthy_intro, rdes_eq)\n\ndefinition Wait :: \"(nat, 's) uexpr \\<Rightarrow> ('s,'e) taction\" where\n[rdes_def]: \"Wait n = \n  \\<^bold>R(true\\<^sub>r \n    \\<turnstile> ((\\<T>({}, {0..<n}) ;; \\<E>(true, [], {}, true)) \n       \\<or> (\\<T>({}, {n}) ;; \\<U>(true, [])))\n    \\<diamondop> \\<T>({}, {n}))\"\n\nutp_lift_notation Wait\n\nlemma Wait_TC: \"Wait n is TC\"\n  by (rule Healthy_intro, rdes_eq)\n\nsubsection \\<open> Algebraic Laws \\<close>\n\nlemma \"Skip ;; Stop = Stop\"\n  by (rdes_eq)\n\nlemma \"Stop \\<sqsubseteq> Div\"\n  by (rdes_refine)\n\nutp_const lift_state_pre\n\nlemma Wait_0: \"Wait 0 = Skip\"\n  by (rdes_eq)\n\nlemma Wait_Wait: \"Wait m ;; Wait n = Wait(m + n)\"\n  apply (rdes_eq_split)\n    apply (rel_auto)\n   apply (simp_all add: rpred closure seqr_assoc[THEN sym])\n  apply (rel_auto)\n  done\n\ntext \\<open> This is a pleasing result although @{const Wait} raises instability, this is swallowed up \n  by the sequential composition. \\<close>\n\nlemma Wait_Stop: \"Wait m ;; Stop = Stop\"\n  by (rdes_eq_split, simp_all add: rpred closure seqr_assoc[THEN sym], rel_auto)\n\nlemma \"\\<langle>[x \\<mapsto>\\<^sub>s &x + 1]\\<rangle>\\<^sub>T ;; do\\<^sub>T(a) ;; \\<langle>[x \\<mapsto>\\<^sub>s &x + 1]\\<rangle>\\<^sub>T = \n        \\<^bold>R (\\<^U>(R1 true) \\<turnstile>\n         (\\<U>(true, []) \\<or>\n          \\<F>(true, [], \\<^U>([x \\<mapsto>\\<^sub>s &x + 1])) ;; \\<T>({a}, {0..}) ;; \\<E>(true, [], {a}, true) \\<or>\n          \\<F>(true, [], \\<^U>([x \\<mapsto>\\<^sub>s &x + 1])) ;; \\<T>({a}, {0..}) ;; \\<U>(true, [Evt a])) \\<diamondop>\n         \\<F>(true, [], \\<^U>([x \\<mapsto>\\<^sub>s &x + 1])) ;; \\<T>({a}, {0..}) ;; \\<F>(true, [Evt a], \\<^U>([x \\<mapsto>\\<^sub>s &x + 1])))\"\n  by (rdes_simp, simp add: rpred seqr_assoc usubst)\n\nlemma \"Wait(m) ;; do\\<^sub>T(a) ;; \\<langle>[x \\<mapsto>\\<^sub>s &x + 1]\\<rangle>\\<^sub>T = \n      \\<^bold>R (true\\<^sub>r \\<turnstile>\n        (\\<T>({}, {0..<m}) ;; \\<E>(true, [], {}, true) \\<or>\n         \\<T>({}, {m}) ;; \\<U>(true, []) \\<or> \n         \\<T>({}, {m}) ;; \\<T>({a}, {0..}) ;; \\<E>(true, [], {a}, true) \\<or> \n         \\<T>({}, {m}) ;; \\<T>({a}, {0..}) ;; \\<U>(true, [Evt a])) \\<diamondop>\n         \\<T>({}, {m}) ;; \\<T>({a}, {0..}) ;; \\<F>(true, [Evt a], [x \\<mapsto>\\<^sub>s &x + 1]))\"\n  apply (rdes_simp)\n  apply (simp add: rpred seqr_assoc usubst)\n  oops\n\ndefinition ExtChoice :: \"'i set \\<Rightarrow> ('i \\<Rightarrow> ('s, 'e) taction) \\<Rightarrow> ('s, 'e) taction\" where\n[upred_defs]:\n\"ExtChoice I P =\n  \\<^bold>R(R1(\\<And> i\\<in>I \\<bullet> pre\\<^sub>R(P i)) \\<comment> \\<open> Require all preconditions \\<close>\n\n   \\<turnstile> (idle(\\<And> i\\<in>I \\<bullet> idle(peri\\<^sub>R(P i))) \\<comment> \\<open> Allow all idle behaviours \\<close>\n      \\<or> (\\<Or> i\\<in>I \\<bullet> active(peri\\<^sub>R(P i)) \\<comment> \\<open> Allow one active action to resolve the choice ...\\<close>\n         \\<and> (\\<And> j\\<in>I-{i} \\<bullet> time(peri\\<^sub>R(P j))))) \\<comment> \\<open> ... whilst the others remain idle \\<close>\n\n   \\<diamondop> ((\\<Or> i\\<in>I \\<bullet> post\\<^sub>R(P i) \\<comment> \\<open> The postcondition can terminate the external choice without an event ... \\<close>\n      \\<and> (\\<And> j\\<in>I-{i} \\<bullet> time(peri\\<^sub>R(P j))))))\" \\<comment> \\<open> ... whilst the others remain quiescent and idle \\<close>\n\n(*\ndefinition extChoice :: \"('s, 'e) taction \\<Rightarrow> ('s, 'e) taction \\<Rightarrow> ('s, 'e) taction\" (infixl \"\\<box>\" 69) where\n[upred_defs]: \"P \\<box> Q = ExtChoice {P, Q} id\"\n*)\n\ndefinition extChoice :: \"('s, 'e) taction \\<Rightarrow> ('s, 'e) taction \\<Rightarrow> ('s, 'e) taction\" (infixl \"\\<box>\" 69) where\n[upred_defs]:\n\"P \\<box> Q =\n  \\<^bold>R((pre\\<^sub>R(P) \\<and> pre\\<^sub>R(Q))\n  \\<turnstile> (idle(peri\\<^sub>R(P)) \\<and> idle(peri\\<^sub>R(Q)) \n    \\<or> time(peri\\<^sub>R(P)) \\<and> active(peri\\<^sub>R(Q))\n    \\<or> time(peri\\<^sub>R(Q)) \\<and> active(peri\\<^sub>R(P)))\n  \\<diamondop> (time(peri\\<^sub>R(P)) \\<and> post\\<^sub>R(Q) \\<or> time(peri\\<^sub>R(Q)) \\<and> post\\<^sub>R(P)))\"\n\nlemma TRR_USUP_closed [closure]:\n  assumes \"\\<And> i. P(i) is TRR\" \"I \\<noteq> {}\"\n  shows \"(\\<And> i\\<in>I \\<bullet> P(i)) is TRR\"\nproof -\n  have \"(\\<And> i\\<in>I \\<bullet> P(i)) = (\\<not>\\<^sub>r (\\<Or> i\\<in>I \\<bullet> \\<not>\\<^sub>r P(i)))\"\n    by (simp add: rpred closure assms)\n  also have \"... is TRR\"\n    by (meson TRR_closed_neg UINF_mem_Continuous_closed assms(1) assms(2) trel_theory.HCond_Cont)\n  finally show ?thesis .\nqed\n\nlemma ExtChoice_empty:\n  \"ExtChoice {} P = Stop\"\n  by (simp add: ExtChoice_def Stop_def rpred)\n\nlemma ExtChoice_single: \n  assumes \"P i is NRD\" \"peri\\<^sub>R(P i) is TRR\"\n  shows \"ExtChoice {i} P = P i\"\n  by (simp add: ExtChoice_def Healthy_if rpred closure assms RD_reactive_tri_design)\n\nlemma TRR_RC2_closed [closure]:\n   assumes \"P is TRR\" shows \"RC2(P) is TRR\"\nproof -\n  have \"RC2(TRR(P)) is TRR\"\n    by (rel_auto)\n       (metis (no_types, opaque_lifting) Prefix_Order.prefixE Prefix_Order.prefixI append.assoc plus_list_def trace_class.add_diff_cancel_left)+\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma ExtChoice_rdes_def [rdes_def]:\n  assumes \"\\<And> i. P\\<^sub>1(i) is TRC\" \"\\<And> i. P\\<^sub>2(i) is TRR\" \"\\<And> i. P\\<^sub>3(i) is TRR\"\n  shows \"ExtChoice I (\\<lambda> i. \\<^bold>R(P\\<^sub>1(i) \\<turnstile> P\\<^sub>2(i) \\<diamondop> P\\<^sub>3(i))) = \n \\<^bold>R ((\\<And> i\\<in>I \\<bullet> P\\<^sub>1(i)) \n    \\<turnstile> (idle(\\<And> i\\<in>I \\<bullet> idle(P\\<^sub>2 i)) \\<or> (\\<Or> i\\<in>I \\<bullet> active(P\\<^sub>2 i) \\<and> (\\<And> j\\<in>I - {i} \\<bullet> time(P\\<^sub>2 j)))) \\<diamondop>\n        (\\<Or> i\\<in>I \\<bullet> (P\\<^sub>3 i) \\<and> (\\<And> j\\<in>I - {i} \\<bullet> time(P\\<^sub>2 j))))\"\nproof (cases \"I = {}\")\n  case True\n  then show ?thesis by (simp add: ExtChoice_empty rpred Stop_def, rel_auto)\nnext\n  case False\n  note ne [closure] = this\n  then show ?thesis\n  proof (cases \"\\<exists> i. I = {i}\")\n    case True\n    then show ?thesis \n      by (clarsimp simp add: ExtChoice_single rdes closure assms rpred)\n  next\n    case False\n    have [closure]:\"\\<And>i. i \\<in> I \\<Longrightarrow> \\<not> I \\<subseteq> {i}\"\n      using False by blast\n    have \"((\\<And> i\\<in>I \\<bullet> RC2(P\\<^sub>1(i))) \\<Rightarrow>\\<^sub>r (idle(\\<And> i\\<in>I \\<bullet> idle(RC2(P\\<^sub>1 i) \\<Rightarrow>\\<^sub>r P\\<^sub>2 i)) \\<or> (\\<Or> i\\<in>I \\<bullet> active(RC2(P\\<^sub>1 i) \\<Rightarrow>\\<^sub>r P\\<^sub>2 i) \\<and> (\\<And> j\\<in>I - {i} \\<bullet> time(RC2(P\\<^sub>1 j) \\<Rightarrow>\\<^sub>r P\\<^sub>2 j)))))\n        = ((\\<And> i\\<in>I \\<bullet> RC2(P\\<^sub>1(i))) \\<Rightarrow>\\<^sub>r (idle(\\<And> i\\<in>I \\<bullet> idle(P\\<^sub>2 i)) \\<or> (\\<Or> i\\<in>I \\<bullet> active(P\\<^sub>2 i) \\<and> (\\<And> j\\<in>I - {i} \\<bullet> time(P\\<^sub>2 j)))))\"\n      apply (trr_simp cls: assms, safe)\n      apply meson\n      apply meson\n      apply blast\n      apply blast\n      apply (metis idleprefix_concat_Evt list_append_prefixD tocks_idleprefix_fp)\n      apply (metis idleprefix_concat_Evt list_append_prefixD tocks_idleprefix_fp)\n      apply (metis idleprefix_concat_Evt list_append_prefixD tocks_idleprefix_fp)\n      apply blast+\n      done\n    hence 1: \"((\\<And> i\\<in>I \\<bullet> P\\<^sub>1(i)) \\<Rightarrow>\\<^sub>r (idle(\\<And> i\\<in>I \\<bullet> idle(P\\<^sub>1 i \\<Rightarrow>\\<^sub>r P\\<^sub>2 i)) \\<or> (\\<Or> i\\<in>I \\<bullet> active(P\\<^sub>1 i \\<Rightarrow>\\<^sub>r P\\<^sub>2 i) \\<and> (\\<And> j\\<in>I - {i} \\<bullet> time(P\\<^sub>1 j \\<Rightarrow>\\<^sub>r P\\<^sub>2 j)))))\n            = ((\\<And> i\\<in>I \\<bullet> P\\<^sub>1(i)) \\<Rightarrow>\\<^sub>r (idle(\\<And> i\\<in>I \\<bullet> idle(P\\<^sub>2 i)) \\<or> (\\<Or> i\\<in>I \\<bullet> active(P\\<^sub>2 i) \\<and> (\\<And> j\\<in>I - {i} \\<bullet> time(P\\<^sub>2 j)))))\"\n      by (simp add: Healthy_if assms closure)\n    have \"((\\<And> i\\<in>I \\<bullet> RC2(P\\<^sub>1(i))) \\<Rightarrow>\\<^sub>r (\\<Or> i\\<in>I \\<bullet> (RC2(P\\<^sub>1 i) \\<Rightarrow>\\<^sub>r P\\<^sub>3 i) \\<and> (\\<And> j\\<in>I - {i} \\<bullet> time(RC2(P\\<^sub>1 j) \\<Rightarrow>\\<^sub>r P\\<^sub>2 j))))\n          = ((\\<And> i\\<in>I \\<bullet> RC2(P\\<^sub>1(i))) \\<Rightarrow>\\<^sub>r (\\<Or> i\\<in>I \\<bullet> (P\\<^sub>3 i) \\<and> (\\<And> j\\<in>I - {i} \\<bullet> time(P\\<^sub>2 j))))\"\n      apply (trr_simp cls: assms, safe)\n      apply auto[1]\n      apply (meson idleprefix_prefix order.trans)\n      apply blast\n      done\n    hence 2: \"((\\<And> i\\<in>I \\<bullet> P\\<^sub>1(i)) \\<Rightarrow>\\<^sub>r (\\<Or> i\\<in>I \\<bullet> (P\\<^sub>1 i \\<Rightarrow>\\<^sub>r P\\<^sub>3 i) \\<and> (\\<And> j\\<in>I - {i} \\<bullet> time(P\\<^sub>1 j \\<Rightarrow>\\<^sub>r P\\<^sub>2 j))))\n          =  ((\\<And> i\\<in>I \\<bullet> P\\<^sub>1(i)) \\<Rightarrow>\\<^sub>r (\\<Or> i\\<in>I \\<bullet> (P\\<^sub>3 i) \\<and> (\\<And> j\\<in>I - {i} \\<bullet> time(P\\<^sub>2 j))))\"\n      by (simp add: Healthy_if assms closure)\n    show ?thesis\n      by (simp add: ExtChoice_def rdes assms closure Healthy_if)\n         (metis (no_types, lifting) \"1\" \"2\" rdes_tri_eq_intro rea_impl_mp)\n  qed\nqed\n\nlemma ExtChoice_dual:\n  assumes \"P is TC\" \"Q is TC\" \"P \\<noteq> Q\"\n  shows\n    \"ExtChoice {P, Q} id = P \\<box> Q\"\n  apply (subgoal_tac \"{P, Q} - {Q} = {P}\")\n  apply (simp add: ExtChoice_def tmerge_dual closure assms extChoice_def rpred usup_and uinf_or conj_disj_distr)\n  apply (rule rdes_tri_eq_intro)\n    apply (simp_all add: assms Healthy_if closure)\n  apply (simp add: disj_comm utp_pred_laws.inf.commute utp_pred_laws.sup.left_commute rpred closure assms)\n  apply (simp add: utp_pred_laws.inf_commute utp_pred_laws.sup_commute)\n  apply (simp add: assms insert_Diff_if)\n  done\n\ntext \\<open> Proving idempotence of binary external choice is complicated by the need to show that\n  @{term \"(time(peri\\<^sub>R(P)) \\<and> post\\<^sub>R(P)) = post\\<^sub>R(P)\"} \\<close>\n\nlemma TRC_rea_true: \"true\\<^sub>r is TRC\" by rel_auto\n\nlemma extChoice_rdes_def [rdes_def]:\n  assumes \"P\\<^sub>2 is TRR\" \"P\\<^sub>3 is TRR\" \"Q\\<^sub>2 is TRR\" \"Q\\<^sub>3 is TRR\"\n  shows\n  \"\\<^bold>R(true\\<^sub>r \\<turnstile> P\\<^sub>2 \\<diamondop> P\\<^sub>3) \\<box> \\<^bold>R(true\\<^sub>r \\<turnstile> Q\\<^sub>2 \\<diamondop> Q\\<^sub>3) =\n       \\<^bold>R(true\\<^sub>r \n        \\<turnstile> (idle(P\\<^sub>2) \\<and> idle(Q\\<^sub>2) \\<or> time(P\\<^sub>2) \\<and> active(Q\\<^sub>2) \\<or> time(Q\\<^sub>2) \\<and> active(P\\<^sub>2))\n        \\<diamondop> (time(P\\<^sub>2) \\<and> Q\\<^sub>3 \\<or> time(Q\\<^sub>2) \\<and> P\\<^sub>3))\"\n  by (simp add: extChoice_def ExtChoice_def rdes closure assms rpred)\n\nlemma TIP_has_time [rpred]:\n  assumes \"P is TRR\" \"P is TIP\"\n  shows \"(P \\<and> time(P)) = P\"\n  apply (trr_auto cls: assms)\n  apply (drule refine_eval_dest[OF TIP_prop[OF assms(1) assms(2)]])\n  apply (rel_blast)\n  done\n\nlemma TIP_time_active [rpred]:\n  assumes \"P is TRR\" \"P is TIP\"\n  shows \"(active(P) \\<and> time(P)) = active(P)\"\n  apply (trr_auto cls: assms)\n  apply (drule refine_eval_dest[OF TIP_prop[OF assms(1) assms(2)]])\n  apply (rel_blast)\n  done\n\nlemma [rpred]: \"active(\\<U>(s, [])) = false\"\n  by (rel_auto)\n\nlemma [rpred]: \"idle(\\<U>(s, [])) = \\<U>(s, [])\"\n  by (rel_auto)\n\nlemma [rpred]: \"time(P \\<or> Q) = (time(P) \\<or> time(Q))\"\n  by (rel_auto)\n\nlemma [rpred]:\n  assumes \"P is TRR\"\n  shows \"time(P ;; \\<U>(true, [])) = time(P)\"\nproof -\n  have \"time(TRR(P) ;; \\<U>(true, [])) = time(TRR P)\"\n    by (rel_blast)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma ExtChoice_unary:\n  assumes \"P i is TC\"\n  shows \"ExtChoice {i} P = P i\"\n  by (simp add: ExtChoice_single TC_implies_NRD TC_inner_TRR(2) assms)\n\nlemma [dest]: \"x \\<in>\\<^sub>\\<R> \\<^bold>\\<bullet> \\<Longrightarrow> P\"\n  by (metis rmember.simps(1))\n\nlemma [rpred]: \"active(\\<T>(X, A) ;; \\<E>(s, [], E, p)) = false\"\n  by (rel_auto)\n\nlemma \"Skip \\<box> Stop = Skip\"\n  by (rdes_eq)\n  \nlemma \"Wait m \\<box> Wait m = Wait m\"\n  by (rdes_eq)\n\nlemma \"Wait m \\<box> Wait n = Wait U(min m n)\"\n  apply (rdes_eq_split, simp_all add: rpred closure)\n  oops\n\nlemma \"Skip \\<box> Stop\\<^sub>U = Skip\"\n  by (rdes_eq)\n\nlemma \"Skip \\<box> Div = Skip\"\n  by (rdes_eq)\n\nlemma \"Wait(n + 1) \\<box> Div = Div\"\n  by (rdes_eq)\n\nlemma \"Wait(n + 1) \\<box> Stop\\<^sub>U = Stop\\<^sub>U\"\n  by (rdes_eq)\n\nlemma append_in_dist_conat: \"\\<lbrakk> x \\<in> xs; y \\<in> ys \\<rbrakk> \\<Longrightarrow> x @ y \\<in> xs \\<^sup>\\<frown> ys\"\n  by (auto simp add: dist_concat_def)\n\nlemma [rpred]: \"idle(\\<T>(X, T) ;; \\<U>(true, [Evt a])) = false\"\n  by (rel_simp)\n\nlemma [simp]: \"U(insert x (insert x A)) = U(insert x A)\"\n  by (rel_auto)\n\nlemma [rpred]: \"active(\\<T>(X, {0..})) = false\"\n  by (rel_auto)\n\nlemma [rpred]: \"active(\\<T>(X, T) ;; \\<U>(s, [])) = false\"\n  by (trr_auto)\n\nlemma [rpred]: \"P \\<triangleright>\\<^sub>t (\\<Sqinter> i \\<bullet> Q(i)) = (\\<Sqinter> i \\<bullet> P \\<triangleright>\\<^sub>t Q(i))\"\n  by (rel_auto, blast+)\n\nlemma \"Stop \\<box> do\\<^sub>T(a) = do\\<^sub>T(a)\"\n  apply (rdes_eq_split)\n    apply (simp_all add: rpred closure)\n  apply (trr_auto)\n  using tocks_idleprefix_fp tocks_iff_idleprefix_fp apply blast\n  apply (trr_simp)\n  done\n\nlemma \"Wait m \\<box> Skip = Skip\"\n  by (rdes_eq)\n\nlemma \"Stop \\<box> \\<langle>\\<sigma>\\<rangle>\\<^sub>T = \\<langle>\\<sigma>\\<rangle>\\<^sub>T\"\n  by (rdes_eq)\n\nlemma [rpred]: \"idle(\\<U>(b, [])) = \\<U>(b, [])\"\n  by (rel_auto)\n\nlemma RR_idleprefix_merge' [rpred]:\n  assumes \"P is TRR\"\n  shows \"(\\<T>({}, {0..}) ;; \\<U>(true, [])) \\<triangleright>\\<^sub>t P = P\"\n  by (trr_auto cls: assms, metis (full_types) hd_activesuffix idle_active_decomp idleprefix_tocks)\n\nlemma [rpred]:\n  assumes \"P is TRR\" \n  shows \"(idle(P) \\<or> active(P \\<triangleright>\\<^sub>t P)) = (P \\<triangleright>\\<^sub>t P)\"\n  apply (trr_auto cls: assms)\n  apply blast\n  apply blast\n  apply (metis hd_Cons_tl tocks_Nil)\n  done\n\nlemma TRR_TIP_closed [closure]:\n  assumes \"P is TRR\"\n  shows \"TIP(P) is TRR\"\nproof -\n  have \"TIP(TRR(P)) is TRR\"\n    by (rel_auto; fastforce)\n  thus ?thesis by (simp add: Healthy_if assms)\nqed\n\nutp_const TRF\n\nlemma unstable_TRF:\n  assumes \"P is TRF\"\n  shows \"P ;; \\<U>(true, []) = U((\\<exists> $st\\<acute> \\<bullet> P) \\<and> $ref\\<acute> = \\<^bold>\\<bullet> \\<and> $pat\\<acute> = false)\"\nproof -\n  have \"TRF P ;; \\<U>(true, []) = U((\\<exists> $st\\<acute> \\<bullet> TRF P) \\<and> $ref\\<acute> = \\<^bold>\\<bullet> \\<and> $pat\\<acute> = false)\"\n    by (rel_blast)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma [closure]: \"P is TRR \\<Longrightarrow> TRF(P) is TRR\"\n  by (simp add: Healthy_if TRF_def TRR3_def TRR_closed_seq TRR_tc_skip)\n\nlemma [closure]: \"P is TRR \\<Longrightarrow> TRR3(P) is TRR\"\n  by (simp add: Healthy_if TRR3_def TRR_closed_seq TRR_tc_skip)\n\nthm RD_elim\n\nlemma RR_elim: \"\\<lbrakk> P is RR; Q ([$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true] \\<dagger> P) \\<rbrakk> \\<Longrightarrow> Q P\"\n  by (simp add: usubst unrest)\n\nlemma TRR_elim: \"\\<lbrakk> P is TRR; Q ([$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true] \\<dagger> P) \\<rbrakk> \\<Longrightarrow> Q P\"\n  by (simp add: usubst unrest closure)\n\nlemma [closure]: \"P is TRR \\<Longrightarrow> [$ok \\<mapsto>\\<^sub>s true, $ok\\<acute> \\<mapsto>\\<^sub>s true, $wait \\<mapsto>\\<^sub>s true, $wait\\<acute> \\<mapsto>\\<^sub>s true] \\<dagger> P is TRR\"\n  by (simp add: usubst unrest closure)\n\nlemma TRF_implies_TRR3 [closure]: \"P is TRF \\<Longrightarrow> P is TRR3\"\n  by (metis (no_types, opaque_lifting) Healthy_def RA1 TRF_def TRR3_def tc_skip_self_unit)\n\nlemma TRF_implies_TRR [closure]: \"P is TRF \\<Longrightarrow> P is TRR\"\n  by (metis Healthy_def TRF_def TRR3_def TRR_closed_seq TRR_tc_skip trel_theory.HCond_Idem)\n\nlemma TRF_time [closure]:\n  \"P is TRR \\<Longrightarrow> time(P) is TRF\"\n  by (rule TRF_intro, simp add: closure unrest, simp_all add: filter_time_def unrest)\n\nlemma TRF_right_unit:\n  \"P is TRF \\<Longrightarrow> P ;; II\\<^sub>t = P\"\n  by (metis Healthy_if TRF_def TRF_implies_TRR TRR3_def)\n\ntext \\<open> If a pericondition @{term P} contains an unstable version of each postcondition observation\n  in @{term Q}, then every time trace of the @{term P} has an extension in @{term Q}. \\<close>\n\nlemma time_peri_in_post:\n  assumes \"P is TRR\" \"P is TIP\" \"Q is TRF\" \"P \\<sqsubseteq> Q ;; \\<U>(true, [])\"\n  shows \"time(P) \\<sqsubseteq> Q\"\nproof -\n  have \"Q ;; \\<U>(true, []) ;; II\\<^sub>t \\<sqsubseteq> Q\"\n    by (trr_auto cls: assms, blast)\n  also have \"P ;; II\\<^sub>t \\<sqsubseteq> ...\"\n    by (simp add: RA1 assms(4) urel_dioid.mult_isor)\n  also have \"time(P) ;; II\\<^sub>t \\<sqsubseteq> ...\"\n    by (simp add: TIP_has_time assms(1) assms(2) urel_dioid.mult_isor utp_pred_laws.inf.orderI)\n  also have \"... = time(P)\"\n    by (simp add: TRF_right_unit TRF_time assms(1))\n  finally show ?thesis .\nqed\n\nlemma extChoice_idem:\n  assumes \"P is NRD\" \"pre\\<^sub>R(P) = true\\<^sub>r\" \"peri\\<^sub>R(P) is TRR\" \"peri\\<^sub>R(P) is TIP\" \"post\\<^sub>R(P) is TRF\"\n    \"peri\\<^sub>R P \\<sqsubseteq> post\\<^sub>R P ;; \\<U>(true, [])\"\n  shows \"P \\<box> P = P\"\n  apply (rdes_eq_split cls: assms)  \n  apply (simp add: assms rpred closure)\n   apply (simp add: TIP_time_active TRR_idle_or_active assms(3) assms(4) utp_pred_laws.inf_commute)\n  using time_peri_in_post[OF assms(3) assms(4) assms(5) assms(6)]\n  apply (simp add: utp_pred_laws.inf.absorb2)\n  done\n\ntext \\<open> Need some additional assumptions \\<close>\n\nlemma [rpred]: \"(\\<T>({}, {0..}) ;; \\<E>(true, [], {}, true) \\<and> idle(P)) = idle(P)\"\n  by (rel_auto)\n\nlemma TRR_conj_time [rpred]:\n  assumes \"P is TRR\"\n  shows \"(time(\\<T>({}, {0..}) ;; \\<E>(true, [], {}, true)) \\<and> P) = P\"\nproof -\n  have \"(time(\\<T>({}, {0..}) ;; \\<E>(true, [], {}, true)) \\<and> TRR(P)) = TRR(P)\"\n    by (rel_blast)\n  thus ?thesis\n    by (simp add: Healthy_if assms)\nqed\n\nlemma\n  assumes \"P is NRD\" \"pre\\<^sub>R(P) = true\\<^sub>r\" \"peri\\<^sub>R(P) is TRR\" \"post\\<^sub>R(P) is TRR\"\n  shows \"Stop \\<box> P = P\"\n  by (rdes_eq_split cls: assms)\n\ntext \\<open> Pedro Comment: Renaming should be a relation rather than a function. \\<close>\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/utp_tockcircus.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283035, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.3081708915197157}}
{"text": "theory SAS_Plus_Plus_To_SAS_Plus_Nat\n  imports   Primitives SAS_Plus_Plus_To_SAS_Plus\nbegin\n\ndefinition SAS_Plus_Plus_State_To_SAS_Plus_list:: \n  \"(dom \\<times> (variable,domain_element) assignment list) \\<Rightarrow> \n        (var,dom) assignment list\" where\n\"SAS_Plus_Plus_State_To_SAS_Plus_list is = (Stage, fst is) # \n map (\\<lambda>(x,y). (x,DE y)) (map (\\<lambda>(x,y). (Var x, y)) (snd is))\"\n\nlemma inj_var: \"inj Var\"\n  by (meson SAS_Plus_Plus_To_SAS_Plus.variable.inject inj_onI)\n\nlemma sublist_SAS_Plus_Plus_State_To_SAS_Plus_apply:\n  \"map_of (SAS_Plus_Plus_State_To_SAS_Plus_list is) k =\n      SAS_Plus_Plus_State_To_SAS_Plus (islist_to_map is) k\"\n  apply (cases \"is\")\n  apply (cases k)\n  apply (auto simp add: SAS_Plus_Plus_State_To_SAS_Plus_list_def  SAS_Plus_Plus_State_To_SAS_Plus_def\n        map_comp_def map_of_map simp del:map_map)\n  subgoal for a b x\n    apply (cases \"map_of b x\")\n     apply auto\n    subgoal\n    proof -\n      assume \"k = Var x\" \"map_of b x = None\"\n      hence \"\\<forall>y. (x,y) \\<notin> set b\"\n        using weak_map_of_SomeI by force\n      hence \"\\<forall>y. (Var x, y) \\<notin> set (map (\\<lambda>(x, y). (Var x, y)) b)\"\n        by auto\n      thus ?thesis\n        by (metis (no_types, lifting) imageE map_of_eq_None_iff prod.collapse) \n    qed\n    using map_of_mapk_SomeI inj_var by fast\n  done\n\nlemma sublist_SAS_Plus_Plus_State_To_SAS_Plus:\n  \"map_of (SAS_Plus_Plus_State_To_SAS_Plus_list is) =\n      SAS_Plus_Plus_State_To_SAS_Plus (islist_to_map is)\"\n  using sublist_SAS_Plus_Plus_State_To_SAS_Plus_apply by blast\n\nfun map_sasps :: \"nat\\<Rightarrow>nat\" where \n\"map_sasps n = (if n = 0 then 0 else (prod_encode (Suc(fst_nat (hd_nat n)) , Suc(Suc(snd_nat (hd_nat n))) ))## map_sasps (tl_nat n))\"\nfun map_sasps_acc :: \"nat \\<Rightarrow> nat\\<Rightarrow>nat\" where \n\"map_sasps_acc acc n = (if n = 0 then acc else map_sasps_acc ((prod_encode (Suc(fst_nat (hd_nat n)) , Suc(Suc(snd_nat (hd_nat n))) ))## acc) (tl_nat n))\"\n\n\nlemma submap_sasps:\n \"map_sasps  n = map_nat (\\<lambda>x. prod_encode (Suc(fst_nat x) , Suc(Suc(snd_nat x)) )) n\"\n  apply (induct n rule:map_sasps.induct)\n  apply auto\n  done\n\nlemma map_sasps_induct:\n\"map_sasps_acc acc n = map_acc  (\\<lambda>x. prod_encode (Suc(fst_nat x) , Suc(Suc(snd_nat x)) )) acc n \"\n  apply(induct acc n rule:map_sasps_acc.induct)\n  apply auto\n  done\n\ndefinition map_sasps_tail :: \"nat \\<Rightarrow> nat\" where \n\"map_sasps_tail n = reverse_nat (map_sasps_acc 0 n)\"\n\nlemma subtail_map_sasps:\n\"map_sasps_tail n = map_sasps n\"\n  using map_sasps_tail_def  map_sasps_induct submap_sasps subtail_map\n  by presburger\n\ndefinition SAS_Plus_Plus_State_To_SAS_Plus_nat :: \"nat \\<Rightarrow> nat\" where\n\"SAS_Plus_Plus_State_To_SAS_Plus_nat is = (prod_encode (0,fst_nat is))##\n(map_sasps (snd_nat is))\"\n\ndefinition SAS_Plus_Plus_State_To_SAS_Plus_tail:: \"nat \\<Rightarrow> nat\" where\n\"SAS_Plus_Plus_State_To_SAS_Plus_tail is = (prod_encode (0,fst_nat is))##\n(map_sasps_tail (snd_nat is))\"\n\nlemma subtail_SAS_Plus_Plus_State_To_SAS_Plus:\n\"SAS_Plus_Plus_State_To_SAS_Plus_tail is = SAS_Plus_Plus_State_To_SAS_Plus_nat is\"\n  apply(auto simp only: SAS_Plus_Plus_State_To_SAS_Plus_tail_def\nSAS_Plus_Plus_State_To_SAS_Plus_nat_def\nsubtail_map_sasps)\n  done\n\nlemma subnat_SAS_Plus_Plus_State_To_SAS_Plus:\n\"SAS_Plus_Plus_State_To_SAS_Plus_nat(islist_encode is) =\n    sas_plus_assignment_list_encode (SAS_Plus_Plus_State_To_SAS_Plus_list is)\"\n  apply (cases \"is\")\n  apply (auto simp only:sas_plus_assignment_list_encode_def)\n  apply (auto simp only: islist_encode.simps sas_assignment_list_encode_def\n      SAS_Plus_Plus_State_To_SAS_Plus_nat_def sub_cons cons0 sub_map sub_snd\n                snd_def sub_fst fst_def map_map comp_def sas_assignment_encode.simps \n                   SAS_Plus_Plus_State_To_SAS_Plus_list_def list.map\n                          list_encode_eq submap_sasps\n                  simp flip: var_encode.simps dom_encode.simps\n                            sas_plus_assignment_encode.simps)\n  apply(auto simp add: prod_encode_eq sub_fst sub_snd sas_plus_assignment_list_encode_def comp_def\n          Case_def)\n  done\n\nlemma sub_SAS_Plus_Plus_State_To_SAS_Plus: \n      \"sas_plus_state_decode (SAS_Plus_Plus_State_To_SAS_Plus_nat(islist_encode is))\n        = SAS_Plus_Plus_State_To_SAS_Plus (islist_to_map is)\"\n  using subnat_SAS_Plus_Plus_State_To_SAS_Plus sublist_SAS_Plus_Plus_State_To_SAS_Plus\n  by (simp add: sas_plus_assignment_list_id sas_plus_state_decode_def)\n\nfun map_var_de :: \"nat \\<Rightarrow> nat\" where \n\"map_var_de n = (if n = 0 then 0 else (prod_encode(Suc (fst_nat (hd_nat n)), Suc (Suc(snd_nat (hd_nat n)))))## map_var_de (tl_nat n) )\"\n\nfun map_var_de_acc :: \" nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_var_de_acc acc n = (if n = 0 then acc else  map_var_de_acc\n((prod_encode(Suc (fst_nat (hd_nat n)), Suc (Suc(snd_nat (hd_nat n)))))## acc) (tl_nat n) )\"\n\nlemma submap_var_de :\n\"map_var_de n = map_nat (\\<lambda> x. prod_encode(Suc (fst_nat x), Suc (Suc(snd_nat x)))) n\"\n  apply (induct n rule: map_var_de.induct)\n  apply auto\n  done\n\nlemma map_var_de_induct:\n\"map_var_de_acc acc n = map_acc  (\\<lambda> x. prod_encode(Suc (fst_nat x), Suc (Suc(snd_nat x)))) acc n \"\n  apply (induct acc n rule: map_var_de_acc.induct)\n  apply auto\n  done\n\ndefinition map_var_de_tail :: \"nat \\<Rightarrow> nat\" where \n\"map_var_de_tail n = reverse_nat (map_var_de_acc 0 n)\"\n\nlemma subtail_map_var_de:\n\"map_var_de_tail n = map_var_de n\"\n  using map_var_de_tail_def  submap_var_de  map_var_de_induct \n      subtail_map \n  by presburger\n      \ndefinition SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_nat:: \n  \"nat \\<Rightarrow> nat\" where\n\"SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_nat op = \n  ((prod_encode(0,0)) ## (map_var_de (nth_nat 0 op)))##\n   (( map_sasps  (nth_nat (Suc 0) op))) ## 0\"\n\ndefinition SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_tail:: \n  \"nat \\<Rightarrow> nat\" where\n\"SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_tail op = \n  ((prod_encode(0,0)) ## (map_var_de_tail (nth_nat 0 op)))##\n   (( map_sasps_tail  (nth_nat (Suc 0) op))) ## 0\"\n\nlemma subtail_SAS_Plus_Plus_Operator_To_SAS_Plus_Operator:\n\"SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_tail op =  SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_nat op\"\n  apply(auto simp only: SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_tail_def \nSAS_Plus_Plus_Operator_To_SAS_Plus_Operator_nat_def\nsubtail_map_sasps\nsubtail_map_var_de)\n  done\n\n\nlemma fst_sas_assignment : \"fst_nat (sas_assignment_encode x) = variable_encode (fst x)\"\n  apply (cases x)\n  apply (auto simp add:sub_fst)\n  done\nlemma snd_sas_assignment : \"snd_nat (sas_assignment_encode x) = domain_element_encode (snd x)\"\n  apply (cases x)\n  apply (auto simp add:sub_snd)\n  done\n\nlemma sub_SAS_Plus_Plus_Operator_To_SAS_Plus_Operator:\n  \"SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_nat (operator_encode op) =\n    operator_plus_encode (SAS_Plus_Plus_Operator_To_SAS_Plus_Operator op)\"\n  apply (auto simp only: submap_var_de\n          SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_nat_def \n           operator_encode_def sub_nth nth.simps submap_sasps\n              sas_assignment_list_encode_def sub_map sub_cons cons0 map_map comp_def\n          SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_def\n          operator_plus_encode_def sas_plus_operator.simps\n            sas_plus_assignment_list_encode_def list.simps \n            sas_plus_assignment_encode.simps var_encode.simps dom_encode.simps\n              fst_sas_assignment snd_sas_assignment\n         )\n  done\n\n\ndefinition initialization_operators_list::\n    \"(variable, domain_element) sas_plus_list_problem \\<Rightarrow> operator_plus list\" where\n\"initialization_operators_list  P = \n  concat (map (\\<lambda> v. (if v \\<in> set (map fst (initial_ofl P)) then [] \n    else map (\\<lambda> y. \\<lparr> precondition_of = [(Stage, Init)],  effect_of = [(Var v, DE y)]\\<rparr>) \n      (thef (map_list_find (range_ofl P) v)))) (variables_ofl P))\"\n\nlemma dom_map_of : \"dom (map_of x) = set ( map fst x)\"\n  apply (induct x)\n   apply auto\n  apply force\n  done\n\nlemma sublist_initialization_operators:\n\"initialization_operators_list  P = initialization_operators (list_problem_to_problem P)\"\n  apply (auto simp only:initialization_operators_list_def initialization_operators_def \n          dom_map_of sub_map_list_find[of \"range_ofl P\"] list_problem_to_problem.simps sas_plus_problem.simps) \n  done\n\nfun map_inner :: \"nat \\<Rightarrow> nat\\<Rightarrow>nat\" where \n\"map_inner v n = (if n = 0 then 0 else ((((prod_encode (0, 1)))##0) ## ((prod_encode (Suc v, Suc (Suc (hd_nat n))))## 0) ## 0) ## map_inner v (tl_nat n) )\"\n\nfun map_inner_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\\<Rightarrow>nat\" where \n\"map_inner_acc v acc n = (if n = 0 then acc else map_inner_acc v (((((prod_encode (0, 1)))##0) ## ((prod_encode (Suc v, Suc (Suc (hd_nat n))))## 0) ## 0) ## acc) (tl_nat n) )\"\n\nlemma submap_inner:\n\"map_inner v n =  map_nat (\\<lambda> y. (((prod_encode (0, 1)))##0) ## ((prod_encode (Suc v, Suc (Suc y)))## 0) ## 0) n\"\n  apply (induct v n rule:map_inner.induct)\n  apply auto\n  done\n\nlemma map_inner_induct:\n\"map_inner_acc v acc n = map_acc (\\<lambda> y. (((prod_encode (0, 1)))##0) ## ((prod_encode (Suc v, Suc (Suc y)))## 0) ## 0) acc n \"\n  apply(induct v acc n rule:map_inner_acc.induct)\n  apply auto\n  done\n\ndefinition map_inner_tail ::\"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where\n \"map_inner_tail v n = reverse_nat ( map_inner_acc v 0 n)\"\n\nlemma subtail_map_inner:\n\"map_inner_tail v n = map_inner v n\"\n  using map_inner_tail_def  map_inner_induct submap_inner\n        subtail_map by presburger\n\n\n\nfun map_fst :: \"nat\\<Rightarrow>nat\" where \n\"map_fst n  = (if n =0 then 0 else (fst_nat (hd_nat n)) ## map_fst (tl_nat n))\"\n\nfun map_fst_acc :: \"nat \\<Rightarrow> nat\\<Rightarrow>nat\" where \n\"map_fst_acc acc n  = (if n =0 then acc else map_fst_acc ((fst_nat (hd_nat n)) ## acc) (tl_nat n))\"\n\n\nlemma submap_fst :\n\"map_fst n = map_nat fst_nat n\"\n  apply (induct n rule:map_fst.induct)\n  apply auto\n  done\nlemma map_fst_induct:\n\"map_fst_acc acc n = map_acc fst_nat acc n\"\n  apply(induct acc n rule:map_fst_acc.induct)\n  apply auto\n  done\n\ndefinition map_fst_tail :: \"nat \\<Rightarrow> nat\" where \n\"map_fst_tail n = reverse_nat (map_fst_acc 0 n)\"\n\nlemma subtail_map_fst :\n\"map_fst_tail n = map_fst n\"\n  using map_fst_tail_def map_fst_induct submap_fst subtail_map \n  by presburger\n\nfunction map_outer :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where\n\"map_outer P n = (if n =0 then 0 else (if elemof (hd_nat n) (map_fst (nth_nat (Suc (Suc 0)) P)) \\<noteq> 0 then 0 \n    else (map_inner (hd_nat n) \n      (the_nat (map_list_find_nat (nth_nat (Suc (Suc (Suc (Suc 0)))) P) (hd_nat n))))) ## map_outer P (tl_nat n))\"\n   apply pat_completeness\n  apply (auto simp only:)\n  done\ntermination by lexicographic_order\n\nlemma submap_outer: \n\"map_outer P n = map_nat (\\<lambda> v. (if elemof v (map_fst (nth_nat (Suc (Suc 0)) P)) \\<noteq> 0 then 0 \n    else map_inner v \n      (the_nat (map_list_find_nat (nth_nat (Suc (Suc (Suc (Suc 0)))) P) v)))) n\"\n  apply (induct P n rule:map_outer.induct)\n  by (metis (no_types, lifting) map_nat.elims map_outer.elims)\ndeclare map_list_find_nat.simps elemof.simps [simp del]\n\nfunction  map_outer_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat\" where\n\"map_outer_acc P acc n = (if n =0 then acc else map_outer_acc P ((if elemof (hd_nat n) (map_fst_tail (nth_nat (Suc (Suc 0)) P)) \\<noteq> 0 then 0 \n    else (map_inner_tail (hd_nat n) \n      (the_nat (map_list_find_nat (nth_nat (Suc (Suc (Suc (Suc 0)))) P) (hd_nat n))))) ## acc) (tl_nat n))\"\n  apply pat_completeness\n  apply (auto simp only:)\n  done\ntermination by lexicographic_order\n\nlemma map_outer_induct : \n\"map_outer_acc P acc n = map_acc (\\<lambda> v. (if elemof v (map_fst (nth_nat (Suc (Suc 0)) P)) \\<noteq> 0 then 0 \n    else map_inner v \n      (the_nat (map_list_find_nat (nth_nat (Suc (Suc (Suc (Suc 0)))) P) v)))) acc n\"\n  apply(induct P acc n rule:map_outer_acc.induct)\n  using subtail_map_fst subtail_map_inner \n  by (metis (no_types, lifting) map_acc.elims map_outer_acc.elims)\n\ndefinition map_outer_tail :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_outer_tail P  n = reverse_nat (map_outer_acc P  0 n)\"\n\n\nlemma subtail_map_outer:\n\"map_outer_tail P  n  = map_outer P n \"\n  using map_outer_tail_def  map_outer_induct submap_outer subtail_map\n  by presburger\n\n\ndefinition initialization_operators_nat::\n    \"nat \\<Rightarrow> nat\" where\n\"initialization_operators_nat  P = \n  concat_nat (map_outer P (nth_nat 0 P))\"\n\ndefinition initialization_operators_tail::\n    \"nat \\<Rightarrow> nat\" where\n\"initialization_operators_tail  P = \n  concat_tail (map_outer_tail P (nth_nat 0 P))\"\n\nlemma subtail_initialization_operators:\n\"initialization_operators_tail  P = \ninitialization_operators_nat  P\n\"\n  apply(simp only: initialization_operators_tail_def initialization_operators_nat_def\n      subtail_concat subtail_map_outer)\n  done\n\nlemma simp_vdlist_encode: \"vdlist_encode = prod_encode o (\\<lambda>(x,y). (variable_encode x,list_encode (map domain_element_encode y)))\"\n  by force\n\nlemma simp_sas_assignment_encode: \"sas_assignment_encode = prod_encode o (\\<lambda>(x,y). (variable_encode x,domain_element_encode y))\"\n  by force\n\nlemma map_find_map:\"inj f \\<Longrightarrow> map_list_find  (map (\\<lambda>(x, y). (f x, g (h y))) l) (f x) = \n       (case map_list_find l x of None \\<Rightarrow> None | Some y \\<Rightarrow> Some (g (h y)))\"\n  apply (induct l arbitrary:x)\n   apply (auto simp add:inj_def)\n  done\n\nlemma map_find_map2:\"inj f \\<Longrightarrow> map_list_find  (map (\\<lambda>(x, y). (f x, g y)) l) (f x) = \n       (case map_list_find l x of None \\<Rightarrow> None | Some y \\<Rightarrow> Some (g  y))\"\n  apply (rule  map_find_map) apply auto\n  done\n\nlemma inj_map_set: \"inj f \\<Longrightarrow> (f x \\<in> set (map f xs)) = ( x \\<in> set xs)\"\n  apply (auto simp add:inj_def)\n  done\n\nlemma sub_the_dec: \"thef x  = list_decode (the_nat (list_option_encode x))\"\n  apply (auto simp only: sub_the list_encode_inverse)\n  done\n\nlemma sub_thedec_spec: \"thef (map_list_find (range_ofl P) x) =\nlist_decode (the_nat (list_option_encode (map_list_find (range_ofl P) x)))\n\"\n  using sub_the_dec by blast\n\nlemma thef_simps: \"thef xs  = (case xs of None \\<Rightarrow> [] | Some x \\<Rightarrow> x)\"\n  apply (cases xs)\n   apply (auto)\n  done\n\nlemma map_nat0:\"map_nat f 0 = 0\"\n  by auto\nthm \"option.case_distrib\"\nlemma subnat_initialization_operators:\n \"initialization_operators_nat (list_problem_encode P)\n  =  list_encode (map operator_plus_encode  (initialization_operators_list P)) \"\n  apply (auto simp only: initialization_operators_nat_def list_problem_encode_def\n                sas_plus_list_problem.simps sub_nth nth.simps sas_assignment_list_encode_def submap_fst\n                      submap_inner submap_outer\n                          sub_map map_map comp_def fst_sas_assignment sub_elem_of cons0 sub_cons sub_the sub_map_list_find_nat\n                          )\n  apply (auto simp only:  simp_vdlist_encode sub_map_list_find_nat sub_the \n      initialization_operators_list_def )\n  apply (auto simp only: map_map comp_def)\n  apply (simp only: flip: comp_def[of variable_encode fst] map_map)\n\n  using variable_inj   apply (auto simp only:  map_find_map inj_map_set if_distrib\n          list_encode.simps(1) list.simps)\n  apply (auto simp only: sub_map_list_find_nat map_find_map\noperator_plus_encode_def map_concat\n\n simp flip: comp_def[of \"prod_encode\" \"\\<lambda>x.(case x of\n (x, y) \\<Rightarrow> (variable_encode x, list_encode (map domain_element_encode y)))\"] map_map\n)\n  apply (auto simp only: map_map comp_def if_distrib list.simps operator_plus_encode_def\n            sas_plus_operator.simps sas_plus_assignment_list_encode_def\n            sas_plus_assignment_encode.simps option.case_distrib thefn.simps option_encode.simps\nthe_nat.simps zero_diff diff_Suc_1 sub_map map_nat0 if_cancel\n )\n  apply (auto simp only: simp flip: list_encode.simps if_distrib  option.case_distrib[of list_encode]\n       )\n  apply (auto simp only: list_encode.simps ) \n  apply (auto simp only: sub_concat thef_simps simp flip: comp_def[of list_encode \"(\\<lambda>x. case map_list_find (range_ofl P) x of None \\<Rightarrow> []\n                    | Some xa \\<Rightarrow>\n                        if x \\<in> set (map fst (initial_ofl P)) then []\n                        else map (\\<lambda>xa. Suc (prod_encode\n    (Suc (prod_encode (prod_encode (0, 1), 0)),\n     Suc (prod_encode\n           (Suc (prod_encode\n                  (prod_encode\n                    (Suc (variable_encode x),\n                     Suc (Suc (domain_element_encode xa))),\n                   0)),\n            0)))))\n                              xa)\"] map_map ) \n  apply (simp only:One_nat_def)\n  apply (auto simp only:option.case_distrib list.simps if_cancel var_encode.simps dom_encode.simps)\n  done\n\nfun map_init_seq :: \"nat \\<Rightarrow> nat\" where \n\"map_init_seq n = (if n = 0 then 0 else ((((prod_encode (0,1))##0) ## \n      ((prod_encode(Suc (fst_nat (hd_nat n)), Suc (Suc (snd_nat (hd_nat n)))))##0) ##0)) ## map_init_seq (tl_nat n))\"\n\nfun map_init_seq_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_init_seq_acc  acc n = (if n = 0 then acc else map_init_seq_acc (((((prod_encode (0,1))##0) ## \n      ((prod_encode(Suc (fst_nat (hd_nat n)), Suc (Suc (snd_nat (hd_nat n)))))##0) ##0)) ## acc) (tl_nat n))\"\n\nlemma submap_init_seq: \n\"map_init_seq n = map_nat (\\<lambda>v. (((prod_encode (0,1))##0) ## \n      ((prod_encode(Suc (fst_nat v), Suc (Suc (snd_nat v))))##0) ##0)) n\"\n  apply (induct n rule:map_init_seq.induct)\n  apply auto\n  done\n\nlemma map_init_seq_induct:\n\"map_init_seq_acc  acc n = map_acc  (\\<lambda>v. (((prod_encode (0,1))##0) ## \n      ((prod_encode(Suc (fst_nat v), Suc (Suc (snd_nat v))))##0) ##0)) acc n\"\n  apply(induct acc n rule:map_init_seq_acc.induct)\n  apply auto\n  done\n\ndefinition map_init_seq_tail :: \"nat \\<Rightarrow> nat\" where \n\"map_init_seq_tail n = reverse_nat (map_init_seq_acc 0 n) \"\n\nlemma subtail_map_init_seq:\n\"map_init_seq_tail n = map_init_seq n\"\n  using map_init_seq_tail_def map_init_seq_induct\nsubmap_init_seq subtail_map by presburger\n\ndefinition initialization_sequence_nat:: \"nat \\<Rightarrow> nat\" where\n  \"initialization_sequence_nat vs = map_init_seq vs\"\n\ndefinition initialization_sequence_tail:: \"nat \\<Rightarrow> nat\" where\n  \"initialization_sequence_tail vs = map_init_seq_tail vs\"\n\nlemma subtail_initialization_sequence:\n\"initialization_sequence_tail vs = initialization_sequence_nat vs\"\n  using initialization_sequence_nat_def\n initialization_sequence_tail_def\n subtail_map_init_seq by presburger\n\n\nlemma sub_initialization_sequence :\n  \"initialization_sequence_nat (sas_assignment_list_encode vs) =\n      list_encode (map operator_plus_encode (initialization_sequence vs)) \"\n  apply (auto simp only: submap_init_seq initialization_sequence_nat_def cons0\n              sub_cons sas_assignment_list_encode_def sub_map map_map comp_def\n                fst_sas_assignment snd_sas_assignment)\n  apply (auto simp only: initialization_sequence_def map_map comp_def\n                    sas_plus_assignment_list_encode_def\n              operator_plus_encode_def sas_plus_operator.simps simp flip: var_encode.simps \n                    dom_encode.simps sas_plus_assignment_encode.simps)\n  apply auto\n  done\n\n\n\ndefinition initial_state_list:: \n  \"(variable, domain_element) sas_plus_list_problem \\<Rightarrow> (var, dom) assignment list\" where\n\"initial_state_list P = SAS_Plus_Plus_State_To_SAS_Plus_list (Init, \n  map (\\<lambda>v. (v, case (map_list_find (initial_ofl P) v) of  Some val \\<Rightarrow> val |\n        None \\<Rightarrow> (the (map_list_find (range_ofl P) v)) ! 0 ) ) (variables_ofl P) \n)\"\n\nlemma sublist_initial_state_helper_apply: \n\" (\\<lambda>v. if v \\<in> set ((P)\\<^sub>\\<V>\\<^sub>+)\n           then Some\n                 (case map_of ((P)\\<^sub>I\\<^sub>+) v of None \\<Rightarrow> the (map_of (range_ofl P) v) ! 0\n                  | Some val \\<Rightarrow> val)\n           else None) k = \n map_of\n       (map (\\<lambda>v. (v, case map_of ((P)\\<^sub>I\\<^sub>+) v of\n                      None \\<Rightarrow> the (map_of (range_ofl P) v) ! 0 | Some val \\<Rightarrow> val))\n         ((P)\\<^sub>\\<V>\\<^sub>+)) k\n\"\n  apply (auto)\n  subgoal\nproof -\n  assume a1: \"k \\<in> set ((P)\\<^sub>\\<V>\\<^sub>+)\"\n  then have \"set ((P)\\<^sub>\\<V>\\<^sub>+) \\<noteq> {}\"\n    by force\n  then show \"Some (case map_of ((P)\\<^sub>I\\<^sub>+) k of None \\<Rightarrow> the (map_of (range_ofl P) k) ! 0 | Some a \\<Rightarrow> a) = map_of (map (\\<lambda>b. (b, case map_of ((P)\\<^sub>I\\<^sub>+) b of None \\<Rightarrow> the (map_of (range_ofl P) b) ! 0 | Some a \\<Rightarrow> a)) ((P)\\<^sub>\\<V>\\<^sub>+)) k\"\n    using a1 by (simp add: map_of_from_function_graph_is_some_if)\nqed\n  by (simp add: map_of_map_restrict)\n\nlemma sublist_initial_state_helper:\n\"(\\<lambda>v. if v \\<in> set ((P)\\<^sub>\\<V>\\<^sub>+)\n           then Some\n                 (case map_of ((P)\\<^sub>I\\<^sub>+) v of None \\<Rightarrow> the (map_of (range_ofl P) v) ! 0\n                  | Some val \\<Rightarrow> val)\n           else None)\n=  map_of\n       (map (\\<lambda>v. (v, case map_of ((P)\\<^sub>I\\<^sub>+) v of\n                      None \\<Rightarrow> the (map_of (range_ofl P) v) ! 0 | Some val \\<Rightarrow> val))\n         ((P)\\<^sub>\\<V>\\<^sub>+))\n\"\n  using  sublist_initial_state_helper_apply by fast\n\n\nlemma sublist_initial_state:\n\" map_of (initial_state_list P)  = initial_state (list_problem_to_problem P) \"\n  apply (auto simp only:initial_state_list_def sublist_SAS_Plus_Plus_State_To_SAS_Plus\n  islist_to_map.simps map_of_map  sub_map_list_find sublist_initial_state_helper\n  initial_state_def list_problem_to_problem.simps sas_plus_problem.simps\n)\n  done\n\nlemma map_op:\"a # xs = x \\<Longrightarrow> map f x = f a # map f xs\"\n  apply auto\n  done\ndeclare map_list_find_nat.simps [simp del]\nfun map_initial_state :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_initial_state P n = (if n = 0 then 0 else (prod_encode(hd_nat n, case (map_list_find_nat (nth_nat (Suc (Suc 0))  P) (hd_nat n)) of  Suc val \\<Rightarrow> val |\n        0 \\<Rightarrow> hd_nat (the_nat (map_list_find_nat (nth_nat (Suc (Suc (Suc (Suc 0)))) P) (hd_nat n))))) ## map_initial_state P (tl_nat n))\"\n\nfun map_initial_state_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow>  nat\" where \n\"map_initial_state_acc P acc n = (if n = 0 then acc else map_initial_state_acc P ((prod_encode(hd_nat n, case (map_list_find_nat (nth_nat (Suc (Suc 0))  P) (hd_nat n)) of  Suc val \\<Rightarrow> val |\n        0 \\<Rightarrow> hd_nat (the_nat (map_list_find_nat (nth_nat (Suc (Suc (Suc (Suc 0)))) P) (hd_nat n))))) ## acc )(tl_nat n))\"\n\nlemma submap_initial_state:\n\"map_initial_state P n  =  map_nat (\\<lambda>v. prod_encode(v, case (map_list_find_nat (nth_nat (Suc (Suc 0))  P) v) of  Suc val \\<Rightarrow> val |\n        0 \\<Rightarrow> hd_nat (the_nat (map_list_find_nat (nth_nat (Suc (Suc (Suc (Suc 0)))) P) v))) ) n \"\n  apply (induct P n rule:map_initial_state.induct)\n  apply auto\n  done\n\nlemma map_initial_state_induct: \n\"map_initial_state_acc P acc n = map_acc  (\\<lambda>v. prod_encode(v, case (map_list_find_nat (nth_nat (Suc (Suc 0))  P) v) of  Suc val \\<Rightarrow> val |\n        0 \\<Rightarrow> hd_nat (the_nat (map_list_find_nat (nth_nat (Suc (Suc (Suc (Suc 0)))) P) v))) ) acc n \"\n  apply(induct P acc n rule:map_initial_state_acc.induct)\n  apply auto\n  done\n\ndefinition map_initial_state_tail :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_initial_state_tail P n = reverse_nat (map_initial_state_acc P 0 n)\"\n\nlemma subtail_map_initial_state:\n\" map_initial_state_tail P n = map_initial_state P n\"\n  using  map_initial_state_tail_def  map_initial_state_induct submap_initial_state\nsubtail_map by presburger\n\ndeclare map_list_find_nat.simps [simp]\n\n\n\ndefinition initial_state_nat::\n  \"nat \\<Rightarrow> nat \" where\n\"initial_state_nat P = SAS_Plus_Plus_State_To_SAS_Plus_nat (prod_encode(1, \n  map_initial_state P (nth_nat 0 P) \n))\"\n\n\ndefinition initial_state_tail::\n  \"nat \\<Rightarrow> nat \" where\n\"initial_state_tail P = SAS_Plus_Plus_State_To_SAS_Plus_tail (prod_encode(1, \n  map_initial_state_tail P (nth_nat 0 P) \n))\"\n\nlemma subtail_initial_state:\n\"initial_state_tail P = initial_state_nat P\"\n\n  using initial_state_nat_def initial_state_tail_def subtail_SAS_Plus_Plus_State_To_SAS_Plus \nsubtail_map_initial_state by presburger\n\nlemma option_encode_case: \"(case option_encode x of 0 \\<Rightarrow>  t | Suc y \\<Rightarrow> f y) =\n (case x of None \\<Rightarrow> t | Some y \\<Rightarrow> f y)  \"\n  apply (cases x)\n   apply auto\n  done\n\nlemma some_case_unfold: \"f a = Some y \\<Longrightarrow> (case f a of None \\<Rightarrow> None | Some t \\<Rightarrow> Some (g t)) = Some (g y)\"\n  apply auto\n  done\n\n\nlemma lambda_case_simplifier:\nassumes  \"\\<forall>x \\<in> set (variables_ofl P). \\<exists>t. map_list_find (range_ofl P) x = Some t \\<and> t\\<noteq>[]\"\nshows\n\" map (\\<lambda>x. case map_list_find ((P)\\<^sub>I\\<^sub>+) x of\n                    None \\<Rightarrow>\n                      prod_encode\n                       (variable_encode x,\n                        hd_nat\n                         (the_nat\n                           (option_encode\n                             (case map_list_find (range_ofl P) x of None \\<Rightarrow> None\n                              | Some y \\<Rightarrow>\n                                  Some\n                                   (list_encode (map domain_element_encode y))))))\n                    | Some xa \\<Rightarrow>\n                        prod_encode (variable_encode x, domain_element_encode xa))\n           ((P)\\<^sub>\\<V>\\<^sub>+) = \n map (\\<lambda>x. case map_list_find ((P)\\<^sub>I\\<^sub>+) x of\n                    None \\<Rightarrow>\n                      prod_encode\n                       (variable_encode x,\n                        hd_nat\n                         (the_nat\n                           (option_encode\n                             (Some\n                                   (list_encode (map domain_element_encode  (the (map_list_find (range_ofl P) x) )))))))\n                    | Some xa \\<Rightarrow>\n                        prod_encode (variable_encode x, domain_element_encode xa))\n           ((P)\\<^sub>\\<V>\\<^sub>+)\n\"\n using assms\n  apply (induct \"((P)\\<^sub>\\<V>\\<^sub>+)\" arbitrary: P )\n   apply (simp add:  initial_state_list_def \n  sas_assignment_list_encode_def \n flip:  subnat_SAS_Plus_Plus_State_To_SAS_Plus list_encode.simps(2))\n subgoal for a x P\n    apply (auto simp add:eq_commute simp flip: list_encode.simps(2))\n    apply (cases \"map_list_find (range_ofl P) a \")\n     apply simp\n   subgoal for t aa\n apply (auto simp only:some_case_unfold option.case  option.the_def sub_thefn thefn.simps sub_hd\n              simp flip: sas_assignment_encode.simps )\n     done\n   subgoal for t aa\n     apply (metis (no_types, lifting) option.case_eq_if thef.simps(1) thef.simps(2))\n     done\n   done\n  done\n\n     \nlemma lambda_case_simplifier2:\nassumes  \"\\<forall>x \\<in> set (variables_ofl P). \\<exists>t. map_list_find (range_ofl P) x = Some t \\<and> t\\<noteq>[]\"\nshows\n\"map (\\<lambda>x. case map_list_find ((P)\\<^sub>I\\<^sub>+) x of\n                    None \\<Rightarrow>\n                      prod_encode\n                       (variable_encode x,\n                        head\n                         (map domain_element_encode\n                           (the (map_list_find (range_ofl P) x))))\n                    | Some xa \\<Rightarrow>\n                        prod_encode (variable_encode x, domain_element_encode xa))\n           ((P)\\<^sub>\\<V>\\<^sub>+)\n=\nmap (\\<lambda>x. case map_list_find ((P)\\<^sub>I\\<^sub>+) x of\n                    None \\<Rightarrow>\n                      prod_encode\n                       (variable_encode x,\n                        domain_element_encode (hd (\n                           (the (map_list_find (range_ofl P) x)))))\n                    | Some xa \\<Rightarrow>\n                        prod_encode (variable_encode x, domain_element_encode xa))\n           ((P)\\<^sub>\\<V>\\<^sub>+)\n\n\"\n using assms\n  apply (induct \"((P)\\<^sub>\\<V>\\<^sub>+)\" arbitrary: P )\n  apply auto\n  subgoal for a x P xa \n    apply (cases \"map_list_find (range_ofl P) xa\")\n     apply auto\n    subgoal for aa\n      apply (metis option.sel sub_head_map)\n      done\n    done\n  done\nlemma lambda_case_simplifier3:\nassumes  \"\\<forall>x \\<in> set (variables_ofl P). \\<exists>t. map_list_find (range_ofl P) x = Some t \\<and> t\\<noteq>[]\"\nshows\n\"map (\\<lambda>x. case map_list_find ((P)\\<^sub>I\\<^sub>+) x of\n                    None \\<Rightarrow>\n                      prod_encode\n                       (variable_encode x,\n                        domain_element_encode (hd (\n                           (the (map_list_find (range_ofl P) x)))))\n                    | Some xa \\<Rightarrow>\n                        prod_encode (variable_encode x, domain_element_encode xa))\n           ((P)\\<^sub>\\<V>\\<^sub>+)\n\n=\n\nmap (\\<lambda>x. case map_list_find ((P)\\<^sub>I\\<^sub>+) x of\n                    None \\<Rightarrow>\n                      prod_encode\n                       (variable_encode x,\n                        domain_element_encode (\n                           (the (map_list_find (range_ofl P) x))!0))\n                    | Some xa \\<Rightarrow>\n                        prod_encode (variable_encode x, domain_element_encode xa))\n           ((P)\\<^sub>\\<V>\\<^sub>+)\n\n\"\n using assms\n  apply (induct \"((P)\\<^sub>\\<V>\\<^sub>+)\" arbitrary: P )\n  apply auto\n  subgoal for a x P xa \n    apply (cases \"map_list_find (range_ofl P) xa\")\n     apply auto\n    subgoal for aa\n      apply (metis hd_conv_nth option.sel)   \n      done\n    done\n  done  \n\n\nlemma subnat_initial_state_helper:\n  assumes  \"\\<forall>x \\<in> set (variables_ofl P). \\<exists>t. map_list_find (range_ofl P) x = Some t \\<and> t\\<noteq>[]\"\n  shows \"initial_state_nat (list_problem_encode P)\n  = sas_plus_assignment_list_encode (initial_state_list P)\"\n  apply (auto simp only: initial_state_nat_def\n submap_initial_state\n  list_problem_encode_def sub_nth nth.simps sas_assignment_list_encode_def \n  sas_assignment_encode.simps sub_map_list_find_nat sub_map map_map comp_def\n    simp_sas_assignment_encode simp_vdlist_encode\n)\n  thm \"option.case\"\n  apply (auto simp only: sub_map_list_find_nat  simp flip: comp_def map_map)\n  using variable_inj apply (auto simp only: comp_def map_find_map)\n  apply (auto simp add: map_find_map2 \n        option.case_distrib)\n  apply (auto simp only: option_encode_case sub_the Case_def option.case)\n  using assms apply (auto simp only: lambda_case_simplifier) \n  apply (auto simp only:sub_thefn thefn.simps sub_hd initial_state_list_def\n        islist_encode.simps dom_encode.simps sas_assignment_list_encode_def\n          map_map comp_def sas_assignment_encode.simps option.case_distrib\n      simp flip: subnat_SAS_Plus_Plus_State_To_SAS_Plus )\n   apply (auto simp only: lambda_case_simplifier2 lambda_case_simplifier3) \n  done\n\nlemma inv_subnat_initial_state:\n  assumes \"is_valid_problem_sas_plus_plus (list_problem_to_problem P)\"\n  shows  \"\\<forall>x \\<in> set (variables_ofl P). \\<exists>t. map_list_find (range_ofl P) x = Some t \\<and> t\\<noteq>[]\"\nproof -\n  obtain P' where def: \"P' = list_problem_to_problem P\" by simp\n  then have \"sas_plus_problem.variables_of P' = variables_ofl P \" by simp\n  moreover have \"map_of (range_ofl P) = range_of P' \" using def by simp\n  moreover have \"\\<forall>x \\<in> set (sas_plus_problem.variables_of P'). \\<exists>t. (range_of P') x = Some t \\<and> t \\<noteq> []\"\n    by (metis assms def is_valid_problem_sas_plus_plus_then(1) option.collapse range_of_not_empty)\n  ultimately show ?thesis by (metis sub_map_list_find)\n      \nqed\n\nlemma subnat_initial_state:\n  assumes \"is_valid_problem_sas_plus_plus (list_problem_to_problem P)\"\n  shows \"initial_state_nat (list_problem_encode P)\n  = sas_plus_assignment_list_encode (initial_state_list P)\"\n  using assms inv_subnat_initial_state subnat_initial_state_helper\n  by fast\n\n\ndefinition SAS_Plus_Plus_To_SAS_Plus_list:: \"(variable,domain_element)sas_plus_list_problem \\<Rightarrow> (var,dom)sas_plus_list_problem\" where\n\"SAS_Plus_Plus_To_SAS_Plus_list P = \\<lparr> variables_ofl = Stage # (map Var ((P)\\<^sub>\\<V>\\<^sub>+)),\n      operators_ofl = \\<lparr> precondition_of = [(Stage, Init)], effect_of = [(Stage, NonInit)]\\<rparr> \n        # (initialization_operators_list P) \n        @ (map SAS_Plus_Plus_Operator_To_SAS_Plus_Operator ((P)\\<^sub>\\<O>\\<^sub>+)), \n      initial_ofl = initial_state_list P ,\n      goal_ofl = SAS_Plus_Plus_State_To_SAS_Plus_list (NonInit, ((P)\\<^sub>G\\<^sub>+)),\n      range_ofl = (Stage, [Init,NonInit])# \n           map  (\\<lambda>(x,y). (x, map DE y)) (map (\\<lambda>(x,y). (Var x, y)) (range_ofl P))\\<rparr>\"\n\nlemma sublist_SAS_Plus_Plus_To_SAS_Plus_helper_apply:\n\"map_of ((Stage, [Init,NonInit])# \n           map  (\\<lambda>(x,y). (x, map DE y)) (map (\\<lambda>(x,y). (Var x, y)) (range_ofl P))) k\n= \n (((\\<lambda>x. Some (map DE x)) \\<circ>\\<^sub>m (map_of (range_ofl P)) \n        \\<circ>\\<^sub>m (\\<lambda>x. (case x of Var x \\<Rightarrow> Some x | Stage \\<Rightarrow> None)))(Stage \\<mapsto> [Init, NonInit])) k \n\"\n  apply (cases k)\n   apply (auto simp add: map_of_map map_comp_def simp flip: map_map)\n  subgoal for x1\n    apply (cases \"map_of (range_ofl P) x1\")\n     apply (auto)\n    subgoal \n    proof -\n      assume asm: \"k = Var x1\" \" map_of (range_ofl P) x1 = None\"\n      then have \"\\<forall>y. (x1,y) \\<notin>  set (range_ofl P)\" \n        using weak_map_of_SomeI by force\n      then have \"\\<forall>y. (Var x1,y) \\<notin> set (map (\\<lambda>(x, y). (Var x, y)) (range_ofl P)) \"\n        by auto\n      thus \" map_of (map (\\<lambda>(x, y). (Var x, y)) (range_ofl P)) (Var x1) = None\"\n        by (meson map_of_SomeD thef.cases)\n    qed\n    subgoal for a\n    proof -\n      assume \" k = Var x1\"  \"map_of (range_ofl P) x1 = Some a\"\n      then  have \" map_of (map (\\<lambda>(x, y). (Var x, y)) (range_ofl P)) (Var x1) = Some a\"\n        using map_of_mapk_SomeI inj_var by fast\n      thus ?thesis by blast\n    qed\n    done\n  done\nlemma sublist_SAS_Plus_Plus_To_SAS_Plus_helper:\n\"map_of ((Stage, [Init,NonInit])# \n           map  (\\<lambda>(x,y). (x, map DE y)) (map (\\<lambda>(x,y). (Var x, y)) (range_ofl P)))\n= \n (((\\<lambda>x. Some (map DE x)) \\<circ>\\<^sub>m (map_of (range_ofl P)) \n        \\<circ>\\<^sub>m (\\<lambda>x. (case x of Var x \\<Rightarrow> Some x | Stage \\<Rightarrow> None)))(Stage \\<mapsto> [Init, NonInit]))\n\"\n  using sublist_SAS_Plus_Plus_To_SAS_Plus_helper_apply by fast\n\n       \n\nlemma sublist_SAS_Plus_Plus_To_SAS_Plus:\n\" list_problem_to_problem (SAS_Plus_Plus_To_SAS_Plus_list P) = \n    SAS_Plus_Plus_To_SAS_Plus (list_problem_to_problem P)\"\n  apply (auto simp only: SAS_Plus_Plus_To_SAS_Plus_list_def list_problem_to_problem.simps\n  sas_plus_problem.simps sas_plus_list_problem.simps)\n  apply (auto simp only: sublist_initialization_operators\n   sublist_initial_state sublist_SAS_Plus_Plus_State_To_SAS_Plus\n        sublist_SAS_Plus_Plus_To_SAS_Plus_helper SAS_Plus_Plus_To_SAS_Plus_def\n        sas_plus_problem.simps list_problem_to_problem.simps islist_to_map.simps\n        \n)\n  done\nlemma fst_vdlist_simp:\"fst_nat (vdlist_encode x) = variable_encode (fst x)\"\n  apply (cases x)\n  apply (auto simp add: sub_fst)\n  done\n\nlemma snd_vdlist_simp: \"snd_nat (vdlist_encode x) = list_encode (map domain_element_encode (snd x))\"\n  apply (cases x)\n  apply (auto simp add:sub_snd)\n  done\n\nfun map_sasp_to_sas_op :: \"nat \\<Rightarrow> nat\" where \n\"map_sasp_to_sas_op n = (if n = 0 then 0 else (SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_nat (hd_nat n)) ## map_sasp_to_sas_op (tl_nat n))\"\n\nfun map_sasp_to_sas_op_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_sasp_to_sas_op_acc acc n = (if n = 0 then acc else map_sasp_to_sas_op_acc ((SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_tail (hd_nat n)) ## acc) (tl_nat n))\"\n\nlemma map_sasp_to_sas_op_induct:\n\"map_sasp_to_sas_op_acc acc n = map_acc SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_nat acc n\"\n  apply(induct acc n rule:map_sasp_to_sas_op_acc.induct)\n  apply (auto simp add: subtail_SAS_Plus_Plus_Operator_To_SAS_Plus_Operator)\n  done\n\nlemma submap_sasp_to_sas_op: \n\"map_sasp_to_sas_op n = map_nat SAS_Plus_Plus_Operator_To_SAS_Plus_Operator_nat n \"\n  apply (induct  n rule: map_sasp_to_sas_op.induct)\n  apply auto\n  done\n\ndefinition map_sasp_to_sas_op_tail :: \"nat \\<Rightarrow> nat\" where \n\"map_sasp_to_sas_op_tail n = reverse_nat (map_sasp_to_sas_op_acc 0 n)\"\n\nlemma subtail_map_sasp_to_sas_op:\n\"map_sasp_to_sas_op_tail n = map_sasp_to_sas_op n \"\n  using map_sasp_to_sas_op_tail_def  submap_sasp_to_sas_op  map_sasp_to_sas_op_induct\nsubtail_map by presburger\n\nfun map_DE :: \"nat \\<Rightarrow> nat\" where \n\"map_DE n = (if n = 0 then 0 else (Suc (Suc (hd_nat n))) ## map_DE (tl_nat n))\"\n\nfun map_DE_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_DE_acc acc n = (if n = 0 then acc else map_DE_acc ((Suc (Suc (hd_nat n))) ## acc) (tl_nat n))\"\n\nlemma submap_DE : \"map_DE n =  map_nat (\\<lambda>n. Suc (Suc n)) n\"\n  apply (induct n rule:map_DE.induct)\n  apply auto\n  done\n\nlemma map_DE_induct : \n\"map_DE_acc acc n = map_acc (\\<lambda>n. Suc (Suc n)) acc n \"\n  apply(induct acc n rule:map_DE_acc.induct)\n  apply auto\n  done\n\ndefinition map_DE_tail :: \"nat \\<Rightarrow> nat\" where \n\"map_DE_tail n = reverse_nat (map_DE_acc 0 n)\"\n\nlemma subtail_map_DE:\n\"map_DE_tail n = map_DE n \"\n  using map_DE_tail_def  map_DE_induct submap_DE subtail_map\n  by presburger\n\nfun map_var :: \"nat \\<Rightarrow> nat\" where \n\"map_var n = (if n = 0 then 0 else ( prod_encode(Suc (fst_nat (hd_nat n)), snd_nat (hd_nat n))) ## map_var (tl_nat n) )\"\n\nfun map_var_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_var_acc acc n = (if n = 0 then acc else map_var_acc (( prod_encode(Suc (fst_nat (hd_nat n)), snd_nat (hd_nat n))) ## acc) (tl_nat n) )\"\n\nlemma map_var_induct:\n\"map_var_acc acc n = map_acc (\\<lambda>n. prod_encode(Suc (fst_nat n), snd_nat n)) acc n\"\n  apply(induct acc n rule:map_var_acc.induct)\n  apply auto\n  done\n\nlemma submap_var :\n\"map_var n = map_nat (\\<lambda>n. prod_encode(Suc (fst_nat n), snd_nat n)) n\"\n  apply (induct n rule:map_var.induct)\n  apply auto\n  done\n\ndefinition map_var_tail :: \"nat \\<Rightarrow> nat\" where \n\"map_var_tail n = reverse_nat (map_var_acc 0 n)\"\n\nlemma subtail_map_var:\n\"map_var_tail n = map_var n\"\n  using map_var_tail_def submap_var map_var_induct subtail_map\n  by presburger\n\nfun map_var_DE :: \"nat \\<Rightarrow> nat\" where \n\"map_var_DE n = (if n = 0 then 0 else (prod_encode(fst_nat (hd_nat n), map_DE (snd_nat (hd_nat n)))) ## map_var_DE (tl_nat n))\"\n\nfun map_var_DE_acc :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat\" where \n\"map_var_DE_acc acc n = (if n = 0 then acc else map_var_DE_acc ((prod_encode(fst_nat (hd_nat n), map_DE_tail (snd_nat (hd_nat n)))) ## acc )(tl_nat n))\"\n\nlemma map_var_DE_induct:\n\"map_var_DE_acc acc n = map_acc ( \\<lambda>n. prod_encode(fst_nat n, map_DE (snd_nat n))) acc n \"\n  apply(induct acc n rule:map_var_DE_acc.induct)\n  apply (auto simp add:subtail_map_DE)\n  done\n\nlemma submap_var_DE:\n\"map_var_DE n = map_nat  ( \\<lambda>n. prod_encode(fst_nat n, map_DE (snd_nat n))) n\"\n  apply (induct n rule: map_var_DE.induct)\n  apply auto\n  done\ndefinition map_var_DE_tail :: \"nat \\<Rightarrow> nat\" where \n\"map_var_DE_tail n = reverse_nat (map_var_DE_acc 0 n)\"\n\nlemma subtail_map_var_DE:\n\"map_var_DE_tail n = map_var_DE n\"\n  using map_var_DE_tail_def submap_var_DE map_var_DE_induct\nsubtail_map by presburger\n\nfun map_Suc :: \"nat\\<Rightarrow> nat\" where \n\"map_Suc n = (if n = 0 then 0 else ((Suc (hd_nat n)) ## map_Suc (tl_nat n)))\"\n\nfun map_Suc_acc :: \"nat \\<Rightarrow> nat\\<Rightarrow> nat\" where \n\"map_Suc_acc acc n = (if n = 0 then acc  else map_Suc_acc ((Suc (hd_nat n)) ## acc) (tl_nat n))\"\n\nlemma submap_Suc : \n\"map_Suc n = map_nat Suc n\"\n  apply (induct n rule:map_Suc.induct)\n  apply auto\n  done\nlemma map_Suc_induct :\n\"map_Suc_acc acc n = map_acc Suc acc n\"\n  apply(induct acc n rule:map_Suc_acc.induct)\n  apply auto\n  done\n\ndefinition map_Suc_tail:: \"nat\\<Rightarrow> nat\" where \n\"map_Suc_tail n = reverse_nat (map_Suc_acc 0 n)\"\n\nlemma subtail_map_Suc:\n\"map_Suc_tail n = map_Suc n\"\n  using map_Suc_induct submap_Suc map_Suc_tail_def subtail_map\n  by presburger\n\ndefinition SAS_Plus_Plus_To_SAS_Plus_nat:: \" nat \\<Rightarrow> nat \" where\n\"SAS_Plus_Plus_To_SAS_Plus_nat P = ((0 ## (map_Suc (nth_nat 0 P)))##\n      ( append_nat ((((prod_encode(0,Suc 0))##0) ## ((prod_encode(0,0))##0) ## 0 ) \n        ## (initialization_operators_nat P)) \n        (map_sasp_to_sas_op (nth_nat (Suc 0) P))) ## \n      (initial_state_nat P)  ##\n      (SAS_Plus_Plus_State_To_SAS_Plus_nat (prod_encode(0, (nth_nat (Suc (Suc (Suc 0))) P))))##\n      ((prod_encode(0, ((Suc 0) ## 0 ##0)))## \n           map_var_DE (map_var (nth_nat (Suc (Suc (Suc (Suc 0)))) P))) ## 0 )\"\n\ndefinition SAS_Plus_Plus_To_SAS_Plus_tail:: \" nat \\<Rightarrow> nat \" where\n\"SAS_Plus_Plus_To_SAS_Plus_tail P = ((0 ## (map_Suc_tail (nth_nat 0 P)))##\n      ( append_tail ((((prod_encode(0,Suc 0))##0) ## ((prod_encode(0,0))##0) ## 0 ) \n        ## (initialization_operators_tail P)) \n        (map_sasp_to_sas_op_tail (nth_nat (Suc 0) P))) ## \n      (initial_state_tail P)  ##\n      (SAS_Plus_Plus_State_To_SAS_Plus_tail (prod_encode(0, (nth_nat (Suc (Suc (Suc 0))) P))))##\n      ((prod_encode(0, ((Suc 0) ## 0 ##0)))## \n           map_var_DE_tail (map_var_tail (nth_nat (Suc (Suc (Suc (Suc 0)))) P))) ## 0 )\"\n\nlemma subtail_SAS_Plus_Plus_To_SAS_Plus:\n\"SAS_Plus_Plus_To_SAS_Plus_tail P = SAS_Plus_Plus_To_SAS_Plus_nat P\"\n  using SAS_Plus_Plus_To_SAS_Plus_nat_def\n SAS_Plus_Plus_To_SAS_Plus_tail_def \nsubtail_SAS_Plus_Plus_State_To_SAS_Plus \nsubtail_append\n subtail_initial_state \nsubtail_initialization_operators subtail_map_Suc subtail_map_sasp_to_sas_op subtail_map_var\n subtail_map_var_DE by presburger\n\nlemma lambda_equals: \" (\\<lambda>x. case x of\n                  (x1, x2) \\<Rightarrow>\n                    prod_encode\n                     ((case x of (x1, x2) \\<Rightarrow> Pair (Suc (variable_encode x1)))\n                       (list_encode\n                         (map (\\<lambda>x. Suc (Suc (domain_element_encode x))) x2))))\n=\n      (\\<lambda>x. case x of\n                  (x1, x2) \\<Rightarrow>\n                    prod_encode\n                     (Suc (variable_encode x1),\n                      list_encode\n                       (map (\\<lambda>x. Suc (Suc (domain_element_encode x))) x2)))\n\"\n  apply auto\n  done\nlemma subnat_SAS_Plus_Plus_To_SAS_Plus:\n assumes \"is_valid_problem_sas_plus_plus (list_problem_to_problem P)\"\n shows \"SAS_Plus_Plus_To_SAS_Plus_nat (list_problem_encode P)\n= list_problem_plus_encode (SAS_Plus_Plus_To_SAS_Plus_list P)\"\n  using assms\n  apply (auto simp only: SAS_Plus_Plus_To_SAS_Plus_nat_def submap_Suc\n  cons0 sub_cons sub_nth nth.simps sub_map sub_append submap_DE submap_var submap_var_DE\n submap_sasp_to_sas_op\n        subnat_initialization_operators subnat_initial_state\n )\n  apply (auto simp only:  list_problem_encode_def sub_nth nth.simps sub_map \n          sub_append map_map comp_def sub_SAS_Plus_Plus_Operator_To_SAS_Plus_Operator\n            sub_fst   fst_vdlist_simp  snd_vdlist_simp fst_def sub_snd snd_def\n          SAS_Plus_Plus_To_SAS_Plus_list_def sas_plus_list_problem.simps list_problem_plus_encode_def\n          list.simps sub_cons var_encode.simps operator_plus_encode_def sas_plus_operator.simps\n          sas_plus_assignment_list_encode_def   sas_plus_assignment_encode.simps dom_encode.simps\n          map_append\n )\n  apply (auto simp only: subnat_SAS_Plus_Plus_State_To_SAS_Plus\n          simp flip: dom_encode.simps islist_encode.simps\n    \n)\n  apply (auto simp only: dom_encode.simps islist_encode.simps sas_plus_assignment_list_encode_def\n        vdlist_plus_encode.simps prod.case_distrib )\n  apply (auto simp add: comp_def  prod.case_distrib lambda_equals simp del:list_encode.simps)\n  done\n\n    \n\n\n\n\n  \n\n\nend", "meta": {"author": "AlexiosFan", "repo": "BA_NP_Reduction", "sha": "0e37ddc58cb822b0a09b2ce7c15e7b88652e154c", "save_path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction", "path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction/BA_NP_Reduction-0e37ddc58cb822b0a09b2ce7c15e7b88652e154c/poly-reductions/Cook_Levin/IMP-_To_SAS+/SAS++_To_SAS+/SAS_Plus_Plus_To_SAS_Plus_Nat.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241632752915, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.30817088465220877}}
{"text": "(*\n * @TAG(OTHER_LGPL)\n *)\n\n(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      StateSpace.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* State Space Template *}\ntheory StateSpace imports Hoare\nbegin\n\nrecord 'g state = \"globals\"::'g\n\ndefinition\n  upd_globals:: \"('g \\<Rightarrow> 'g) \\<Rightarrow> ('g,'z) state_scheme \\<Rightarrow> ('g,'z) state_scheme\"\nwhere\n  \"upd_globals upd s = s\\<lparr>globals := upd (globals s)\\<rparr>\" \n\nrecord ('g, 'n, 'val) stateSP = \"'g state\" +\n  locals :: \"'n \\<Rightarrow> 'val\"\n\nlemma upd_globals_conv: \"upd_globals f = (\\<lambda>s. s\\<lparr>globals := f (globals s)\\<rparr>)\"\n  by (rule ext) (simp add: upd_globals_def)\n\nend\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/hoare-package/StateSpace.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.611381973294151, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3080791488931682}}
{"text": "(*  Title:      HOL/Library/RBT_Set.thy\n    Author:     Ondrej Kuncar\n*)\n\nsection {* Implementation of sets using RBT trees *}\n\ntheory RBT_Set\nimports RBT Product_Lexorder\nbegin\n\n(*\n  Users should be aware that by including this file all code equations\n  outside of List.thy using 'a list as an implementation of sets cannot be\n  used for code generation. If such equations are not needed, they can be\n  deleted from the code generator. Otherwise, a user has to provide their \n  own equations using RBT trees. \n*)\n\nsection {* Definition of code datatype constructors *}\n\ndefinition Set :: \"('a\\<Colon>linorder, unit) rbt \\<Rightarrow> 'a set\" \n  where \"Set t = {x . RBT.lookup t x = Some ()}\"\n\ndefinition Coset :: \"('a\\<Colon>linorder, unit) rbt \\<Rightarrow> 'a set\" \n  where [simp]: \"Coset t = - Set t\"\n\n\nsection {* Deletion of already existing code equations *}\n\nlemma [code, code del]:\n  \"Set.empty = Set.empty\" ..\n\nlemma [code, code del]:\n  \"Set.is_empty = Set.is_empty\" ..\n\nlemma [code, code del]:\n  \"uminus_set_inst.uminus_set = uminus_set_inst.uminus_set\" ..\n\nlemma [code, code del]:\n  \"Set.member = Set.member\" ..\n\nlemma [code, code del]:\n  \"Set.insert = Set.insert\" ..\n\nlemma [code, code del]:\n  \"Set.remove = Set.remove\" ..\n\nlemma [code, code del]:\n  \"UNIV = UNIV\" ..\n\nlemma [code, code del]:\n  \"Set.filter = Set.filter\" ..\n\nlemma [code, code del]:\n  \"image = image\" ..\n\nlemma [code, code del]:\n  \"Set.subset_eq = Set.subset_eq\" ..\n\nlemma [code, code del]:\n  \"Ball = Ball\" ..\n\nlemma [code, code del]:\n  \"Bex = Bex\" ..\n\nlemma [code, code del]:\n  \"can_select = can_select\" ..\n\nlemma [code, code del]:\n  \"Set.union = Set.union\" ..\n\nlemma [code, code del]:\n  \"minus_set_inst.minus_set = minus_set_inst.minus_set\" ..\n\nlemma [code, code del]:\n  \"Set.inter = Set.inter\" ..\n\nlemma [code, code del]:\n  \"card = card\" ..\n\nlemma [code, code del]:\n  \"the_elem = the_elem\" ..\n\nlemma [code, code del]:\n  \"Pow = Pow\" ..\n\nlemma [code, code del]:\n  \"setsum = setsum\" ..\n\nlemma [code, code del]:\n  \"setprod = setprod\" ..\n\nlemma [code, code del]:\n  \"Product_Type.product = Product_Type.product\"  ..\n\nlemma [code, code del]:\n  \"Id_on = Id_on\" ..\n\nlemma [code, code del]:\n  \"Image = Image\" ..\n\nlemma [code, code del]:\n  \"trancl = trancl\" ..\n\nlemma [code, code del]:\n  \"relcomp = relcomp\" ..\n\nlemma [code, code del]:\n  \"wf = wf\" ..\n\nlemma [code, code del]:\n  \"Min = Min\" ..\n\nlemma [code, code del]:\n  \"Inf_fin = Inf_fin\" ..\n\nlemma [code, code del]:\n  \"INFIMUM = INFIMUM\" ..\n\nlemma [code, code del]:\n  \"Max = Max\" ..\n\nlemma [code, code del]:\n  \"Sup_fin = Sup_fin\" ..\n\nlemma [code, code del]:\n  \"SUPREMUM = SUPREMUM\" ..\n\nlemma [code, code del]:\n  \"(Inf :: 'a set set \\<Rightarrow> 'a set) = Inf\" ..\n\nlemma [code, code del]:\n  \"(Sup :: 'a set set \\<Rightarrow> 'a set) = Sup\" ..\n\nlemma [code, code del]:\n  \"sorted_list_of_set = sorted_list_of_set\" ..\n\nlemma [code, code del]: \n  \"List.map_project = List.map_project\" ..\n\nlemma [code, code del]: \n  \"List.Bleast = List.Bleast\" ..\n\nsection {* Lemmas *}\n\n\nsubsection {* Auxiliary lemmas *}\n\n\n\nlemma Set_set_keys: \"Set x = dom (RBT.lookup x)\" \nby (auto simp: Set_def)\n\nlemma finite_Set [simp, intro!]: \"finite (Set x)\"\nby (simp add: Set_set_keys)\n\nlemma set_keys: \"Set t = set(RBT.keys t)\"\nby (simp add: Set_set_keys lookup_keys)\n\nsubsection {* fold and filter *}\n\nlemma finite_fold_rbt_fold_eq:\n  assumes \"comp_fun_commute f\" \n  shows \"Finite_Set.fold f A (set (RBT.entries t)) = RBT.fold (curry f) t A\"\nproof -\n  have *: \"remdups (RBT.entries t) = RBT.entries t\"\n    using distinct_entries distinct_map by (auto intro: distinct_remdups_id)\n  show ?thesis using assms by (auto simp: fold_def_alt comp_fun_commute.fold_set_fold_remdups *)\nqed\n\ndefinition fold_keys :: \"('a :: linorder \\<Rightarrow> 'b \\<Rightarrow> 'b) \\<Rightarrow> ('a, _) rbt \\<Rightarrow> 'b \\<Rightarrow> 'b\" \n  where [code_unfold]:\"fold_keys f t A = RBT.fold (\\<lambda>k _ t. f k t) t A\"\n\nlemma fold_keys_def_alt:\n  \"fold_keys f t s = List.fold f (RBT.keys t) s\"\nby (auto simp: fold_map o_def split_def fold_def_alt keys_def_alt fold_keys_def)\n\nlemma finite_fold_fold_keys:\n  assumes \"comp_fun_commute f\"\n  shows \"Finite_Set.fold f A (Set t) = fold_keys f t A\"\nusing assms\nproof -\n  interpret comp_fun_commute f by fact\n  have \"set (RBT.keys t) = fst ` (set (RBT.entries t))\" by (auto simp: fst_eq_Domain keys_entries)\n  moreover have \"inj_on fst (set (RBT.entries t))\" using distinct_entries distinct_map by auto\n  ultimately show ?thesis \n    by (auto simp add: set_keys fold_keys_def curry_def fold_image finite_fold_rbt_fold_eq \n      comp_comp_fun_commute)\nqed\n\ndefinition rbt_filter :: \"('a :: linorder \\<Rightarrow> bool) \\<Rightarrow> ('a, 'b) rbt \\<Rightarrow> 'a set\" where\n  \"rbt_filter P t = RBT.fold (\\<lambda>k _ A'. if P k then Set.insert k A' else A') t {}\"\n\nlemma Set_filter_rbt_filter:\n  \"Set.filter P (Set t) = rbt_filter P t\"\nby (simp add: fold_keys_def Set_filter_fold rbt_filter_def \n  finite_fold_fold_keys[OF comp_fun_commute_filter_fold])\n\n\nsubsection {* foldi and Ball *}\n\nlemma Ball_False: \"RBT_Impl.fold (\\<lambda>k v s. s \\<and> P k) t False = False\"\nby (induction t) auto\n\nlemma rbt_foldi_fold_conj: \n  \"RBT_Impl.foldi (\\<lambda>s. s = True) (\\<lambda>k v s. s \\<and> P k) t val = RBT_Impl.fold (\\<lambda>k v s. s \\<and> P k) t val\"\nproof (induction t arbitrary: val) \n  case (Branch c t1) then show ?case\n    by (cases \"RBT_Impl.fold (\\<lambda>k v s. s \\<and> P k) t1 True\") (simp_all add: Ball_False) \nqed simp\n\nlemma foldi_fold_conj: \"RBT.foldi (\\<lambda>s. s = True) (\\<lambda>k v s. s \\<and> P k) t val = fold_keys (\\<lambda>k s. s \\<and> P k) t val\"\nunfolding fold_keys_def including rbt.lifting by transfer (rule rbt_foldi_fold_conj)\n\n\nsubsection {* foldi and Bex *}\n\nlemma Bex_True: \"RBT_Impl.fold (\\<lambda>k v s. s \\<or> P k) t True = True\"\nby (induction t) auto\n\nlemma rbt_foldi_fold_disj: \n  \"RBT_Impl.foldi (\\<lambda>s. s = False) (\\<lambda>k v s. s \\<or> P k) t val = RBT_Impl.fold (\\<lambda>k v s. s \\<or> P k) t val\"\nproof (induction t arbitrary: val) \n  case (Branch c t1) then show ?case\n    by (cases \"RBT_Impl.fold (\\<lambda>k v s. s \\<or> P k) t1 False\") (simp_all add: Bex_True) \nqed simp\n\nlemma foldi_fold_disj: \"RBT.foldi (\\<lambda>s. s = False) (\\<lambda>k v s. s \\<or> P k) t val = fold_keys (\\<lambda>k s. s \\<or> P k) t val\"\nunfolding fold_keys_def including rbt.lifting by transfer (rule rbt_foldi_fold_disj)\n\n\nsubsection {* folding over non empty trees and selecting the minimal and maximal element *}\n\n(** concrete **)\n\n(* The concrete part is here because it's probably not general enough to be moved to RBT_Impl *)\n\ndefinition rbt_fold1_keys :: \"('a \\<Rightarrow> 'a \\<Rightarrow> 'a) \\<Rightarrow> ('a::linorder, 'b) RBT_Impl.rbt \\<Rightarrow> 'a\" \n  where \"rbt_fold1_keys f t = List.fold f (tl(RBT_Impl.keys t)) (hd(RBT_Impl.keys t))\"\n\n(* minimum *)\n\ndefinition rbt_min :: \"('a::linorder, unit) RBT_Impl.rbt \\<Rightarrow> 'a\" \n  where \"rbt_min t = rbt_fold1_keys min t\"\n\nlemma key_le_right: \"rbt_sorted (Branch c lt k v rt) \\<Longrightarrow> (\\<And>x. x \\<in>set (RBT_Impl.keys rt) \\<Longrightarrow> k \\<le> x)\"\nby  (auto simp: rbt_greater_prop less_imp_le)\n\nlemma left_le_key: \"rbt_sorted (Branch c lt k v rt) \\<Longrightarrow> (\\<And>x. x \\<in>set (RBT_Impl.keys lt) \\<Longrightarrow> x \\<le> k)\"\nby (auto simp: rbt_less_prop less_imp_le)\n\nlemma fold_min_triv:\n  fixes k :: \"_ :: linorder\"\n  shows \"(\\<forall>x\\<in>set xs. k \\<le> x) \\<Longrightarrow> List.fold min xs k = k\" \nby (induct xs) (auto simp add: min_def)\n\nlemma rbt_min_simps:\n  \"is_rbt (Branch c RBT_Impl.Empty k v rt) \\<Longrightarrow> rbt_min (Branch c RBT_Impl.Empty k v rt) = k\"\nby (auto intro: fold_min_triv dest: key_le_right is_rbt_rbt_sorted simp: rbt_fold1_keys_def rbt_min_def)\n\nfun rbt_min_opt where\n  \"rbt_min_opt (Branch c RBT_Impl.Empty k v rt) = k\" |\n  \"rbt_min_opt (Branch c (Branch lc llc lk lv lrt) k v rt) = rbt_min_opt (Branch lc llc lk lv lrt)\"\n\nlemma rbt_min_opt_Branch:\n  \"t1 \\<noteq> rbt.Empty \\<Longrightarrow> rbt_min_opt (Branch c t1 k () t2) = rbt_min_opt t1\" \nby (cases t1) auto\n\nlemma rbt_min_opt_induct [case_names empty left_empty left_non_empty]:\n  fixes t :: \"('a :: linorder, unit) RBT_Impl.rbt\"\n  assumes \"P rbt.Empty\"\n  assumes \"\\<And>color t1 a b t2. P t1 \\<Longrightarrow> P t2 \\<Longrightarrow> t1 = rbt.Empty \\<Longrightarrow> P (Branch color t1 a b t2)\"\n  assumes \"\\<And>color t1 a b t2. P t1 \\<Longrightarrow> P t2 \\<Longrightarrow> t1 \\<noteq> rbt.Empty \\<Longrightarrow> P (Branch color t1 a b t2)\"\n  shows \"P t\"\nusing assms\n  apply (induction t)\n  apply simp\n  apply (case_tac \"t1 = rbt.Empty\")\n  apply simp_all\ndone\n\nlemma rbt_min_opt_in_set: \n  fixes t :: \"('a :: linorder, unit) RBT_Impl.rbt\"\n  assumes \"t \\<noteq> rbt.Empty\"\n  shows \"rbt_min_opt t \\<in> set (RBT_Impl.keys t)\"\nusing assms by (induction t rule: rbt_min_opt.induct) (auto)\n\nlemma rbt_min_opt_is_min:\n  fixes t :: \"('a :: linorder, unit) RBT_Impl.rbt\"\n  assumes \"rbt_sorted t\"\n  assumes \"t \\<noteq> rbt.Empty\"\n  shows \"\\<And>y. y \\<in> set (RBT_Impl.keys t) \\<Longrightarrow> y \\<ge> rbt_min_opt t\"\nusing assms \nproof (induction t rule: rbt_min_opt_induct)\n  case empty\n    then show ?case by simp\nnext\n  case left_empty\n    then show ?case by (auto intro: key_le_right simp del: rbt_sorted.simps)\nnext\n  case (left_non_empty c t1 k v t2 y)\n    then have \"y = k \\<or> y \\<in> set (RBT_Impl.keys t1) \\<or> y \\<in> set (RBT_Impl.keys t2)\" by auto\n    with left_non_empty show ?case \n    proof(elim disjE)\n      case goal1 then show ?case \n        by (auto simp add: rbt_min_opt_Branch intro: left_le_key rbt_min_opt_in_set)\n    next\n      case goal2 with left_non_empty show ?case by (auto simp add: rbt_min_opt_Branch)\n    next \n      case goal3 show ?case\n      proof -\n        from goal3 have \"rbt_min_opt t1 \\<le> k\" by (simp add: left_le_key rbt_min_opt_in_set)\n        moreover from goal3 have \"k \\<le> y\" by (simp add: key_le_right)\n        ultimately show ?thesis using goal3 by (simp add: rbt_min_opt_Branch)\n      qed\n    qed\nqed\n\nlemma rbt_min_eq_rbt_min_opt:\n  assumes \"t \\<noteq> RBT_Impl.Empty\"\n  assumes \"is_rbt t\"\n  shows \"rbt_min t = rbt_min_opt t\"\nproof -\n  from assms have \"hd (RBT_Impl.keys t) # tl (RBT_Impl.keys t) = RBT_Impl.keys t\" by (cases t) simp_all\n  with assms show ?thesis\n    by (simp add: rbt_min_def rbt_fold1_keys_def rbt_min_opt_is_min\n      Min.set_eq_fold [symmetric] Min_eqI rbt_min_opt_in_set)\nqed\n\n(* maximum *)\n\ndefinition rbt_max :: \"('a::linorder, unit) RBT_Impl.rbt \\<Rightarrow> 'a\" \n  where \"rbt_max t = rbt_fold1_keys max t\"\n\nlemma fold_max_triv:\n  fixes k :: \"_ :: linorder\"\n  shows \"(\\<forall>x\\<in>set xs. x \\<le> k) \\<Longrightarrow> List.fold max xs k = k\" \nby (induct xs) (auto simp add: max_def)\n\nlemma fold_max_rev_eq:\n  fixes xs :: \"('a :: linorder) list\"\n  assumes \"xs \\<noteq> []\"\n  shows \"List.fold max (tl xs) (hd xs) = List.fold max (tl (rev xs)) (hd (rev xs))\" \n  using assms by (simp add: Max.set_eq_fold [symmetric])\n\nlemma rbt_max_simps:\n  assumes \"is_rbt (Branch c lt k v RBT_Impl.Empty)\" \n  shows \"rbt_max (Branch c lt k v RBT_Impl.Empty) = k\"\nproof -\n  have \"List.fold max (tl (rev(RBT_Impl.keys lt @ [k]))) (hd (rev(RBT_Impl.keys lt @ [k]))) = k\"\n    using assms by (auto intro!: fold_max_triv dest!: left_le_key is_rbt_rbt_sorted)\n  then show ?thesis by (auto simp add: rbt_max_def rbt_fold1_keys_def fold_max_rev_eq)\nqed\n\nfun rbt_max_opt where\n  \"rbt_max_opt (Branch c lt k v RBT_Impl.Empty) = k\" |\n  \"rbt_max_opt (Branch c lt k v (Branch rc rlc rk rv rrt)) = rbt_max_opt (Branch rc rlc rk rv rrt)\"\n\nlemma rbt_max_opt_Branch:\n  \"t2 \\<noteq> rbt.Empty \\<Longrightarrow> rbt_max_opt (Branch c t1 k () t2) = rbt_max_opt t2\" \nby (cases t2) auto\n\nlemma rbt_max_opt_induct [case_names empty right_empty right_non_empty]:\n  fixes t :: \"('a :: linorder, unit) RBT_Impl.rbt\"\n  assumes \"P rbt.Empty\"\n  assumes \"\\<And>color t1 a b t2. P t1 \\<Longrightarrow> P t2 \\<Longrightarrow> t2 = rbt.Empty \\<Longrightarrow> P (Branch color t1 a b t2)\"\n  assumes \"\\<And>color t1 a b t2. P t1 \\<Longrightarrow> P t2 \\<Longrightarrow> t2 \\<noteq> rbt.Empty \\<Longrightarrow> P (Branch color t1 a b t2)\"\n  shows \"P t\"\nusing assms\n  apply (induction t)\n  apply simp\n  apply (case_tac \"t2 = rbt.Empty\")\n  apply simp_all\ndone\n\nlemma rbt_max_opt_in_set: \n  fixes t :: \"('a :: linorder, unit) RBT_Impl.rbt\"\n  assumes \"t \\<noteq> rbt.Empty\"\n  shows \"rbt_max_opt t \\<in> set (RBT_Impl.keys t)\"\nusing assms by (induction t rule: rbt_max_opt.induct) (auto)\n\nlemma rbt_max_opt_is_max:\n  fixes t :: \"('a :: linorder, unit) RBT_Impl.rbt\"\n  assumes \"rbt_sorted t\"\n  assumes \"t \\<noteq> rbt.Empty\"\n  shows \"\\<And>y. y \\<in> set (RBT_Impl.keys t) \\<Longrightarrow> y \\<le> rbt_max_opt t\"\nusing assms \nproof (induction t rule: rbt_max_opt_induct)\n  case empty\n    then show ?case by simp\nnext\n  case right_empty\n    then show ?case by (auto intro: left_le_key simp del: rbt_sorted.simps)\nnext\n  case (right_non_empty c t1 k v t2 y)\n    then have \"y = k \\<or> y \\<in> set (RBT_Impl.keys t2) \\<or> y \\<in> set (RBT_Impl.keys t1)\" by auto\n    with right_non_empty show ?case \n    proof(elim disjE)\n      case goal1 then show ?case \n        by (auto simp add: rbt_max_opt_Branch intro: key_le_right rbt_max_opt_in_set)\n    next\n      case goal2 with right_non_empty show ?case by (auto simp add: rbt_max_opt_Branch)\n    next \n      case goal3 show ?case\n      proof -\n        from goal3 have \"rbt_max_opt t2 \\<ge> k\" by (simp add: key_le_right rbt_max_opt_in_set)\n        moreover from goal3 have \"y \\<le> k\" by (simp add: left_le_key)\n        ultimately show ?thesis using goal3 by (simp add: rbt_max_opt_Branch)\n      qed\n    qed\nqed\n\nlemma rbt_max_eq_rbt_max_opt:\n  assumes \"t \\<noteq> RBT_Impl.Empty\"\n  assumes \"is_rbt t\"\n  shows \"rbt_max t = rbt_max_opt t\"\nproof -\n  from assms have \"hd (RBT_Impl.keys t) # tl (RBT_Impl.keys t) = RBT_Impl.keys t\" by (cases t) simp_all\n  with assms show ?thesis\n    by (simp add: rbt_max_def rbt_fold1_keys_def rbt_max_opt_is_max\n      Max.set_eq_fold [symmetric] Max_eqI rbt_max_opt_in_set)\nqed\n\n\n(** abstract **)\n\ncontext includes rbt.lifting begin\nlift_definition fold1_keys :: \"('a \\<Rightarrow> 'a \\<Rightarrow> 'a) \\<Rightarrow> ('a::linorder, 'b) rbt \\<Rightarrow> 'a\"\n  is rbt_fold1_keys .\n\nlemma fold1_keys_def_alt:\n  \"fold1_keys f t = List.fold f (tl (RBT.keys t)) (hd (RBT.keys t))\"\n  by transfer (simp add: rbt_fold1_keys_def)\n\nlemma finite_fold1_fold1_keys:\n  assumes \"semilattice f\"\n  assumes \"\\<not> RBT.is_empty t\"\n  shows \"semilattice_set.F f (Set t) = fold1_keys f t\"\nproof -\n  from `semilattice f` interpret semilattice_set f by (rule semilattice_set.intro)\n  show ?thesis using assms \n    by (auto simp: fold1_keys_def_alt set_keys fold_def_alt non_empty_keys set_eq_fold [symmetric])\nqed\n\n(* minimum *)\n\nlift_definition r_min :: \"('a :: linorder, unit) rbt \\<Rightarrow> 'a\" is rbt_min .\n\nlift_definition r_min_opt :: \"('a :: linorder, unit) rbt \\<Rightarrow> 'a\" is rbt_min_opt .\n\nlemma r_min_alt_def: \"r_min t = fold1_keys min t\"\nby transfer (simp add: rbt_min_def)\n\nlemma r_min_eq_r_min_opt:\n  assumes \"\\<not> (RBT.is_empty t)\"\n  shows \"r_min t = r_min_opt t\"\nusing assms unfolding is_empty_empty by transfer (auto intro: rbt_min_eq_rbt_min_opt)\n\nlemma fold_keys_min_top_eq:\n  fixes t :: \"('a :: {linorder, bounded_lattice_top}, unit) rbt\"\n  assumes \"\\<not> (RBT.is_empty t)\"\n  shows \"fold_keys min t top = fold1_keys min t\"\nproof -\n  have *: \"\\<And>t. RBT_Impl.keys t \\<noteq> [] \\<Longrightarrow> List.fold min (RBT_Impl.keys t) top = \n    List.fold min (hd(RBT_Impl.keys t) # tl(RBT_Impl.keys t)) top\"\n    by (simp add: hd_Cons_tl[symmetric])\n  { fix x :: \"_ :: {linorder, bounded_lattice_top}\" and xs\n    have \"List.fold min (x#xs) top = List.fold min xs x\"\n    by (simp add: inf_min[symmetric])\n  } note ** = this\n  show ?thesis using assms\n    unfolding fold_keys_def_alt fold1_keys_def_alt is_empty_empty\n    apply transfer \n    apply (case_tac t) \n    apply simp \n    apply (subst *)\n    apply simp\n    apply (subst **)\n    apply simp\n  done\nqed\n\n(* maximum *)\n\nlift_definition r_max :: \"('a :: linorder, unit) rbt \\<Rightarrow> 'a\" is rbt_max .\n\nlift_definition r_max_opt :: \"('a :: linorder, unit) rbt \\<Rightarrow> 'a\" is rbt_max_opt .\n\nlemma r_max_alt_def: \"r_max t = fold1_keys max t\"\nby transfer (simp add: rbt_max_def)\n\nlemma r_max_eq_r_max_opt:\n  assumes \"\\<not> (RBT.is_empty t)\"\n  shows \"r_max t = r_max_opt t\"\nusing assms unfolding is_empty_empty by transfer (auto intro: rbt_max_eq_rbt_max_opt)\n\nlemma fold_keys_max_bot_eq:\n  fixes t :: \"('a :: {linorder, bounded_lattice_bot}, unit) rbt\"\n  assumes \"\\<not> (RBT.is_empty t)\"\n  shows \"fold_keys max t bot = fold1_keys max t\"\nproof -\n  have *: \"\\<And>t. RBT_Impl.keys t \\<noteq> [] \\<Longrightarrow> List.fold max (RBT_Impl.keys t) bot = \n    List.fold max (hd(RBT_Impl.keys t) # tl(RBT_Impl.keys t)) bot\"\n    by (simp add: hd_Cons_tl[symmetric])\n  { fix x :: \"_ :: {linorder, bounded_lattice_bot}\" and xs\n    have \"List.fold max (x#xs) bot = List.fold max xs x\"\n    by (simp add: sup_max[symmetric])\n  } note ** = this\n  show ?thesis using assms\n    unfolding fold_keys_def_alt fold1_keys_def_alt is_empty_empty\n    apply transfer \n    apply (case_tac t) \n    apply simp \n    apply (subst *)\n    apply simp\n    apply (subst **)\n    apply simp\n  done\nqed\n\nend\n\nsection {* Code equations *}\n\ncode_datatype Set Coset\n\ndeclare list.set[code] (* needed? *)\n\nlemma empty_Set [code]:\n  \"Set.empty = Set RBT.empty\"\nby (auto simp: Set_def)\n\nlemma UNIV_Coset [code]:\n  \"UNIV = Coset RBT.empty\"\nby (auto simp: Set_def)\n\nlemma is_empty_Set [code]:\n  \"Set.is_empty (Set t) = RBT.is_empty t\"\n  unfolding Set.is_empty_def by (auto simp: fun_eq_iff Set_def intro: lookup_empty_empty[THEN iffD1])\n\nlemma compl_code [code]:\n  \"- Set xs = Coset xs\"\n  \"- Coset xs = Set xs\"\nby (simp_all add: Set_def)\n\nlemma member_code [code]:\n  \"x \\<in> (Set t) = (RBT.lookup t x = Some ())\"\n  \"x \\<in> (Coset t) = (RBT.lookup t x = None)\"\nby (simp_all add: Set_def)\n\nlemma insert_code [code]:\n  \"Set.insert x (Set t) = Set (RBT.insert x () t)\"\n  \"Set.insert x (Coset t) = Coset (RBT.delete x t)\"\nby (auto simp: Set_def)\n\nlemma remove_code [code]:\n  \"Set.remove x (Set t) = Set (RBT.delete x t)\"\n  \"Set.remove x (Coset t) = Coset (RBT.insert x () t)\"\nby (auto simp: Set_def)\n\nlemma union_Set [code]:\n  \"Set t \\<union> A = fold_keys Set.insert t A\"\nproof -\n  interpret comp_fun_idem Set.insert\n    by (fact comp_fun_idem_insert)\n  from finite_fold_fold_keys[OF `comp_fun_commute Set.insert`]\n  show ?thesis by (auto simp add: union_fold_insert)\nqed\n\nlemma inter_Set [code]:\n  \"A \\<inter> Set t = rbt_filter (\\<lambda>k. k \\<in> A) t\"\nby (simp add: inter_Set_filter Set_filter_rbt_filter)\n\nlemma minus_Set [code]:\n  \"A - Set t = fold_keys Set.remove t A\"\nproof -\n  interpret comp_fun_idem Set.remove\n    by (fact comp_fun_idem_remove)\n  from finite_fold_fold_keys[OF `comp_fun_commute Set.remove`]\n  show ?thesis by (auto simp add: minus_fold_remove)\nqed\n\nlemma union_Coset [code]:\n  \"Coset t \\<union> A = - rbt_filter (\\<lambda>k. k \\<notin> A) t\"\nproof -\n  have *: \"\\<And>A B. (-A \\<union> B) = -(-B \\<inter> A)\" by blast\n  show ?thesis by (simp del: boolean_algebra_class.compl_inf add: * inter_Set)\nqed\n \nlemma union_Set_Set [code]:\n  \"Set t1 \\<union> Set t2 = Set (RBT.union t1 t2)\"\nby (auto simp add: lookup_union map_add_Some_iff Set_def)\n\nlemma inter_Coset [code]:\n  \"A \\<inter> Coset t = fold_keys Set.remove t A\"\nby (simp add: Diff_eq [symmetric] minus_Set)\n\nlemma inter_Coset_Coset [code]:\n  \"Coset t1 \\<inter> Coset t2 = Coset (RBT.union t1 t2)\"\nby (auto simp add: lookup_union map_add_Some_iff Set_def)\n\nlemma minus_Coset [code]:\n  \"A - Coset t = rbt_filter (\\<lambda>k. k \\<in> A) t\"\nby (simp add: inter_Set[simplified Int_commute])\n\nlemma filter_Set [code]:\n  \"Set.filter P (Set t) = (rbt_filter P t)\"\nby (auto simp add: Set_filter_rbt_filter)\n\nlemma image_Set [code]:\n  \"image f (Set t) = fold_keys (\\<lambda>k A. Set.insert (f k) A) t {}\"\nproof -\n  have \"comp_fun_commute (\\<lambda>k. Set.insert (f k))\" by default auto\n  then show ?thesis by (auto simp add: image_fold_insert intro!: finite_fold_fold_keys)\nqed\n\nlemma Ball_Set [code]:\n  \"Ball (Set t) P \\<longleftrightarrow> RBT.foldi (\\<lambda>s. s = True) (\\<lambda>k v s. s \\<and> P k) t True\"\nproof -\n  have \"comp_fun_commute (\\<lambda>k s. s \\<and> P k)\" by default auto\n  then show ?thesis \n    by (simp add: foldi_fold_conj[symmetric] Ball_fold finite_fold_fold_keys)\nqed\n\nlemma Bex_Set [code]:\n  \"Bex (Set t) P \\<longleftrightarrow> RBT.foldi (\\<lambda>s. s = False) (\\<lambda>k v s. s \\<or> P k) t False\"\nproof -\n  have \"comp_fun_commute (\\<lambda>k s. s \\<or> P k)\" by default auto\n  then show ?thesis \n    by (simp add: foldi_fold_disj[symmetric] Bex_fold finite_fold_fold_keys)\nqed\n\nlemma subset_code [code]:\n  \"Set t \\<le> B \\<longleftrightarrow> (\\<forall>x\\<in>Set t. x \\<in> B)\"\n  \"A \\<le> Coset t \\<longleftrightarrow> (\\<forall>y\\<in>Set t. y \\<notin> A)\"\nby auto\n\nlemma subset_Coset_empty_Set_empty [code]:\n  \"Coset t1 \\<le> Set t2 \\<longleftrightarrow> (case (RBT.impl_of t1, RBT.impl_of t2) of \n    (rbt.Empty, rbt.Empty) => False |\n    (_, _) => Code.abort (STR ''non_empty_trees'') (\\<lambda>_. Coset t1 \\<le> Set t2))\"\nproof -\n  have *: \"\\<And>t. RBT.impl_of t = rbt.Empty \\<Longrightarrow> t = RBT rbt.Empty\"\n    by (subst(asm) RBT_inverse[symmetric]) (auto simp: impl_of_inject)\n  have **: \"eq_onp is_rbt rbt.Empty rbt.Empty\" unfolding eq_onp_def by simp\n  show ?thesis  \n    by (auto simp: Set_def lookup.abs_eq[OF **] dest!: * split: rbt.split)\nqed\n\ntext {* A frequent case -- avoid intermediate sets *}\nlemma [code_unfold]:\n  \"Set t1 \\<subseteq> Set t2 \\<longleftrightarrow> RBT.foldi (\\<lambda>s. s = True) (\\<lambda>k v s. s \\<and> k \\<in> Set t2) t1 True\"\nby (simp add: subset_code Ball_Set)\n\nlemma card_Set [code]:\n  \"card (Set t) = fold_keys (\\<lambda>_ n. n + 1) t 0\"\n  by (auto simp add: card.eq_fold intro: finite_fold_fold_keys comp_fun_commute_const)\n\nlemma setsum_Set [code]:\n  \"setsum f (Set xs) = fold_keys (plus o f) xs 0\"\nproof -\n  have \"comp_fun_commute (\\<lambda>x. op + (f x))\" by default (auto simp: ac_simps)\n  then show ?thesis \n    by (auto simp add: setsum.eq_fold finite_fold_fold_keys o_def)\nqed\n\nlemma the_elem_set [code]:\n  fixes t :: \"('a :: linorder, unit) rbt\"\n  shows \"the_elem (Set t) = (case RBT.impl_of t of \n    (Branch RBT_Impl.B RBT_Impl.Empty x () RBT_Impl.Empty) \\<Rightarrow> x\n    | _ \\<Rightarrow> Code.abort (STR ''not_a_singleton_tree'') (\\<lambda>_. the_elem (Set t)))\"\nproof -\n  {\n    fix x :: \"'a :: linorder\"\n    let ?t = \"Branch RBT_Impl.B RBT_Impl.Empty x () RBT_Impl.Empty\" \n    have *:\"?t \\<in> {t. is_rbt t}\" unfolding is_rbt_def by auto\n    then have **:\"eq_onp is_rbt ?t ?t\" unfolding eq_onp_def by auto\n\n    have \"RBT.impl_of t = ?t \\<Longrightarrow> the_elem (Set t) = x\" \n      by (subst(asm) RBT_inverse[symmetric, OF *])\n        (auto simp: Set_def the_elem_def lookup.abs_eq[OF **] impl_of_inject)\n  }\n  then show ?thesis\n    by(auto split: rbt.split unit.split color.split)\nqed\n\nlemma Pow_Set [code]:\n  \"Pow (Set t) = fold_keys (\\<lambda>x A. A \\<union> Set.insert x ` A) t {{}}\"\nby (simp add: Pow_fold finite_fold_fold_keys[OF comp_fun_commute_Pow_fold])\n\nlemma product_Set [code]:\n  \"Product_Type.product (Set t1) (Set t2) = \n    fold_keys (\\<lambda>x A. fold_keys (\\<lambda>y. Set.insert (x, y)) t2 A) t1 {}\"\nproof -\n  have *:\"\\<And>x. comp_fun_commute (\\<lambda>y. Set.insert (x, y))\" by default auto\n  show ?thesis using finite_fold_fold_keys[OF comp_fun_commute_product_fold, of \"Set t2\" \"{}\" \"t1\"]  \n    by (simp add: product_fold Product_Type.product_def finite_fold_fold_keys[OF *])\nqed\n\nlemma Id_on_Set [code]:\n  \"Id_on (Set t) =  fold_keys (\\<lambda>x. Set.insert (x, x)) t {}\"\nproof -\n  have \"comp_fun_commute (\\<lambda>x. Set.insert (x, x))\" by default auto\n  then show ?thesis\n    by (auto simp add: Id_on_fold intro!: finite_fold_fold_keys)\nqed\n\nlemma Image_Set [code]:\n  \"(Set t) `` S = fold_keys (\\<lambda>(x,y) A. if x \\<in> S then Set.insert y A else A) t {}\"\nby (auto simp add: Image_fold finite_fold_fold_keys[OF comp_fun_commute_Image_fold])\n\nlemma trancl_set_ntrancl [code]:\n  \"trancl (Set t) = ntrancl (card (Set t) - 1) (Set t)\"\nby (simp add: finite_trancl_ntranl)\n\nlemma relcomp_Set[code]:\n  \"(Set t1) O (Set t2) = fold_keys \n    (\\<lambda>(x,y) A. fold_keys (\\<lambda>(w,z) A'. if y = w then Set.insert (x,z) A' else A') t2 A) t1 {}\"\nproof -\n  interpret comp_fun_idem Set.insert by (fact comp_fun_idem_insert)\n  have *: \"\\<And>x y. comp_fun_commute (\\<lambda>(w, z) A'. if y = w then Set.insert (x, z) A' else A')\"\n    by default (auto simp add: fun_eq_iff)\n  show ?thesis using finite_fold_fold_keys[OF comp_fun_commute_relcomp_fold, of \"Set t2\" \"{}\" t1]\n    by (simp add: relcomp_fold finite_fold_fold_keys[OF *])\nqed\n\nlemma wf_set [code]:\n  \"wf (Set t) = acyclic (Set t)\"\nby (simp add: wf_iff_acyclic_if_finite)\n\nlemma Min_fin_set_fold [code]:\n  \"Min (Set t) = \n  (if RBT.is_empty t\n   then Code.abort (STR ''not_non_empty_tree'') (\\<lambda>_. Min (Set t))\n   else r_min_opt t)\"\nproof -\n  have *: \"semilattice (min :: 'a \\<Rightarrow> 'a \\<Rightarrow> 'a)\" ..\n  with finite_fold1_fold1_keys [OF *, folded Min_def]\n  show ?thesis\n    by (simp add: r_min_alt_def r_min_eq_r_min_opt [symmetric])  \nqed\n\nlemma Inf_fin_set_fold [code]:\n  \"Inf_fin (Set t) = Min (Set t)\"\nby (simp add: inf_min Inf_fin_def Min_def)\n\nlemma Inf_Set_fold:\n  fixes t :: \"('a :: {linorder, complete_lattice}, unit) rbt\"\n  shows \"Inf (Set t) = (if RBT.is_empty t then top else r_min_opt t)\"\nproof -\n  have \"comp_fun_commute (min :: 'a \\<Rightarrow> 'a \\<Rightarrow> 'a)\" by default (simp add: fun_eq_iff ac_simps)\n  then have \"t \\<noteq> RBT.empty \\<Longrightarrow> Finite_Set.fold min top (Set t) = fold1_keys min t\"\n    by (simp add: finite_fold_fold_keys fold_keys_min_top_eq)\n  then show ?thesis \n    by (auto simp add: Inf_fold_inf inf_min empty_Set[symmetric] r_min_eq_r_min_opt[symmetric] r_min_alt_def)\nqed\n\ndefinition Inf' :: \"'a :: {linorder, complete_lattice} set \\<Rightarrow> 'a\" where [code del]: \"Inf' x = Inf x\"\ndeclare Inf'_def[symmetric, code_unfold]\ndeclare Inf_Set_fold[folded Inf'_def, code]\n\nlemma INF_Set_fold [code]:\n  fixes f :: \"_ \\<Rightarrow> 'a::complete_lattice\"\n  shows \"INFIMUM (Set t) f = fold_keys (inf \\<circ> f) t top\"\nproof -\n  have \"comp_fun_commute ((inf :: 'a \\<Rightarrow> 'a \\<Rightarrow> 'a) \\<circ> f)\" \n    by default (auto simp add: fun_eq_iff ac_simps)\n  then show ?thesis\n    by (auto simp: INF_fold_inf finite_fold_fold_keys)\nqed\n\nlemma Max_fin_set_fold [code]:\n  \"Max (Set t) = \n  (if RBT.is_empty t\n   then Code.abort (STR ''not_non_empty_tree'') (\\<lambda>_. Max (Set t))\n   else r_max_opt t)\"\nproof -\n  have *: \"semilattice (max :: 'a \\<Rightarrow> 'a \\<Rightarrow> 'a)\" ..\n  with finite_fold1_fold1_keys [OF *, folded Max_def]\n  show ?thesis\n    by (simp add: r_max_alt_def r_max_eq_r_max_opt [symmetric])  \nqed\n\nlemma Sup_fin_set_fold [code]:\n  \"Sup_fin (Set t) = Max (Set t)\"\nby (simp add: sup_max Sup_fin_def Max_def)\n\nlemma Sup_Set_fold:\n  fixes t :: \"('a :: {linorder, complete_lattice}, unit) rbt\"\n  shows \"Sup (Set t) = (if RBT.is_empty t then bot else r_max_opt t)\"\nproof -\n  have \"comp_fun_commute (max :: 'a \\<Rightarrow> 'a \\<Rightarrow> 'a)\" by default (simp add: fun_eq_iff ac_simps)\n  then have \"t \\<noteq> RBT.empty \\<Longrightarrow> Finite_Set.fold max bot (Set t) = fold1_keys max t\"\n    by (simp add: finite_fold_fold_keys fold_keys_max_bot_eq)\n  then show ?thesis \n    by (auto simp add: Sup_fold_sup sup_max empty_Set[symmetric] r_max_eq_r_max_opt[symmetric] r_max_alt_def)\nqed\n\ndefinition Sup' :: \"'a :: {linorder, complete_lattice} set \\<Rightarrow> 'a\" where [code del]: \"Sup' x = Sup x\"\ndeclare Sup'_def[symmetric, code_unfold]\ndeclare Sup_Set_fold[folded Sup'_def, code]\n\nlemma SUP_Set_fold [code]:\n  fixes f :: \"_ \\<Rightarrow> 'a::complete_lattice\"\n  shows \"SUPREMUM (Set t) f = fold_keys (sup \\<circ> f) t bot\"\nproof -\n  have \"comp_fun_commute ((sup :: 'a \\<Rightarrow> 'a \\<Rightarrow> 'a) \\<circ> f)\" \n    by default (auto simp add: fun_eq_iff ac_simps)\n  then show ?thesis\n    by (auto simp: SUP_fold_sup finite_fold_fold_keys)\nqed\n\nlemma sorted_list_set[code]:\n  \"sorted_list_of_set (Set t) = RBT.keys t\"\nby (auto simp add: set_keys intro: sorted_distinct_set_unique) \n\nlemma Bleast_code [code]:\n \"Bleast (Set t) P = (case filter P (RBT.keys t) of\n    x#xs \\<Rightarrow> x |\n    [] \\<Rightarrow> abort_Bleast (Set t) P)\"\nproof (cases \"filter P (RBT.keys t)\")\n  case Nil thus ?thesis by (simp add: Bleast_def abort_Bleast_def)\nnext\n  case (Cons x ys)\n  have \"(LEAST x. x \\<in> Set t \\<and> P x) = x\"\n  proof (rule Least_equality)\n    show \"x \\<in> Set t \\<and> P x\" using Cons[symmetric]\n      by(auto simp add: set_keys Cons_eq_filter_iff)\n    next\n      fix y assume \"y : Set t \\<and> P y\"\n      then show \"x \\<le> y\" using Cons[symmetric]\n        by(auto simp add: set_keys Cons_eq_filter_iff)\n          (metis sorted_Cons sorted_append sorted_keys)\n  qed\n  thus ?thesis using Cons by (simp add: Bleast_def)\nqed\n\nhide_const (open) RBT_Set.Set RBT_Set.Coset\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Library/RBT_Set.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.611381973294151, "lm_q1q2_score": 0.3080791488931682}}
{"text": "theory Failures_TickTock\n\nimports\n  Failures_BasicOps\n  TickTock.TickTock\nbegin\n\ntext \\<open> In calculating the failures, we drop tock events, both in the trace\n       and the refusals? We could still include it as part of the refusals\n       considering it as a regular event.. but that's probably unnecessary? \\<close>\n\nprimrec ttevt2F :: \"'e evt \\<Rightarrow> 'e ttevent\" where\n\"ttevt2F (evt a) = Event a\" |\n\"ttevt2F tick = Tick\"\n\nlemma\n  \"ttevt2F`(A \\<union> B) = ttevt2F`A \\<union> ttevt2F`B\"\n  by auto\n\nlemma ttevt2F_evt_set:\n  \"ttevt2F`evt ` A = (Event`A)\"\n  by (auto simp add: image_iff)\n\nfun tt2T :: \"'a tttrace \\<Rightarrow> 'a trace\" where\n\"tt2T [[Tick]\\<^sub>E] = [tick]\" |\n\"tt2T ([Event e]\\<^sub>E # \\<sigma>) = evt e # tt2T \\<sigma>\" |\n\"tt2T \\<sigma> = []\"\n\nlemma tt2T_tocks_simp [simp]:\n  assumes \"\\<rho> \\<in> tocks P\" \"\\<rho> \\<noteq> []\"\n  shows \"tt2T (\\<rho> @ \\<sigma>) = []\"\n  using assms \n  using tocks.simps by fastforce\n\nlemma tt2T_empty_concat [simp]:\n  assumes \"\\<rho> = []\"\n  shows \"tt2T (\\<rho> @ \\<sigma>) = tt2T \\<sigma>\"\n  using assms by auto\n\nfun tt2F :: \"'a tttrace \\<Rightarrow> 'a failure option\" where\n\"tt2F [[X]\\<^sub>R] = Some ([],{x. ttevt2F x \\<in> X})\" |\n\"tt2F ([Event e]\\<^sub>E # \\<sigma>) = (case (tt2F \\<sigma>) of (Some fl) \\<Rightarrow> Some (evt e # fst fl,snd fl) | None \\<Rightarrow> None)\" |\n\"tt2F \\<sigma> = None\"\n\ntext \\<open> Below is an attempt at breaking the definition of tt2F in concatenations. \\<close>\n\nfun tt2Fconcat :: \"'a failure option \\<Rightarrow> 'a failure option \\<Rightarrow> 'a failure option\" (infix \"@\\<^sub>F\" 56) where\n\"None @\\<^sub>F x = None\" |\n\"x @\\<^sub>F None = None\" |\n\"(Some fl1) @\\<^sub>F (Some fl2) = Some (fst fl1 @ fst fl2,snd fl2)\"\n\nlemma tt2F_Event_dist_tt2Fconcat:\n  \"tt2F ([Event x1]\\<^sub>E # x) = Some([evt x1],Z) @\\<^sub>F tt2F(x)\"\n  apply (induct x rule:tt2F.induct, auto)\n  by (simp add: option.case_eq_if)\n\nlemma tt2Fconcat_assoc:\n  \"x @\\<^sub>F (y @\\<^sub>F z) = (x @\\<^sub>F y) @\\<^sub>F z\"\n  apply (induct x, auto)\n  apply (induct y, auto)\n  by (induct z, auto)\n \nlemma tt2F_ev_neq_None:\n  assumes \"tt2F ([ev]\\<^sub>E # x) \\<noteq> None\"\n  shows \"tt2F x \\<noteq> None\"\n  using assms \n  apply (cases ev, auto)\n  by (smt option.exhaust option.simps(4) surj_pair)\n\nlemma tt2F_dist_tt2Fcontact:\n  assumes \"set x \\<inter> {[X]\\<^sub>R | X. True} = {}\" \"(tt2F x) \\<noteq> None\" \"ttWF(x@y)\"\n  shows \"tt2F (x@y) = (tt2F x) @\\<^sub>F (tt2F y)\"\n  using assms\n  proof (induct x)\n    case Nil\n    then show ?case by auto\n  next\n    case (Cons a x)\n    then show ?case\n    proof (cases a)\n      case (ObsEvent ev)\n      then have \"tt2F x \\<noteq> None\"\n        using Cons.prems(2) tt2F_ev_neq_None by blast\n      then have tt2F_xy:\"tt2F (x @ y) = tt2F x @\\<^sub>F tt2F y\"\n        using Cons ObsEvent\n        by (smt Cons.hyps Cons.prems Cons.prems(2) Set.is_empty_def append_Cons empty_set insert_disjoint(1) is_empty_set list.inject list.simps(15) null_rec(1) ttWF.elims(2) ttWF.simps(1) ttobs.distinct(1))\n\n      then show ?thesis\n      proof (cases ev)\n        case (Event x1)\n        then obtain Z where \"tt2F ([Event x1]\\<^sub>E # (x @ y)) = Some([evt x1],Z) @\\<^sub>F tt2F(x @ y)\"      \n            using tt2F_Event_dist_tt2Fconcat by force\n        then have \"Some([evt x1],Z) @\\<^sub>F tt2F(x @ y) = Some([evt x1],Z) @\\<^sub>F ((tt2F x) @\\<^sub>F (tt2F y))\"\n          using tt2F_xy by simp\n        then show ?thesis\n        proof (cases \"tt2F x = None\")\n          case True\n          then show ?thesis \n            using Event ObsEvent tt2F_xy by auto\n        next\n          case False\n          then show ?thesis\n            by (metis Cons_eq_appendI Event ObsEvent tt2F_Event_dist_tt2Fconcat tt2F_xy tt2Fconcat_assoc)\n        qed\n      next\n        case Tock\n        then show ?thesis \n          using Cons.prems(2) ObsEvent by auto\n      next\n        case Tick\n        then show ?thesis \n          by (metis Cons.prems(2) Nil_is_append_conv ObsEvent append_Cons list.exhaust tt2F.simps(3) tt2F.simps(5) tt2Fconcat.simps(1) ttWF.simps(10))\n        qed\n    next\n      case (Ref x2)\n      then show ?thesis\n        using Cons.prems(1) by auto\n    qed\n  qed\n\nlemma tt2F_refusal_eq:\n  assumes \"tt2F [[X]\\<^sub>R] = tt2F [[Y]\\<^sub>R]\" \"Tock \\<in> X \\<longleftrightarrow> Tock \\<in> Y\"\n  shows \"[[X]\\<^sub>R] = [[Y]\\<^sub>R]\"\n  using assms apply auto\n  by (metis mem_Collect_eq ttevent.exhaust ttevt2F.simps(1) ttevt2F.simps(2))+\n\nlemma tt2F_eq_eqsets_or_Tock:\n  assumes \"(\\<forall>e. (e \\<in> X) = (e \\<in> Y) \\<or> e = Tock)\"\n  shows \"tt2F [[X]\\<^sub>R] = tt2F [[Y]\\<^sub>R]\"\n  using assms apply auto\n  by (metis evt.exhaust ttevent.distinct(1) ttevent.distinct(5) ttevt2F.simps(1) ttevt2F.simps(2))+\n\nlemma tt2F_some_exists:\n  assumes \"Some ([], b) = tt2F \\<sigma>\" \n  shows \"\\<exists>X. \\<sigma> = [[X]\\<^sub>R]\"\n  using assms apply (cases \\<sigma> rule:tt2F.cases, auto)\n  by (metis (no_types, lifting) Pair_inject list.simps(3) not_Some_eq option.case(1) option.inject option.simps(5))\n\nlemma tt2F_tocks_simp [simp]:\n  assumes \"\\<rho> \\<in> tocks P\" \"\\<rho> \\<noteq> []\"\n  shows \"tt2F (\\<rho> @ \\<sigma>) = None\"\n  using assms \n  using tocks.simps by fastforce\n\nlemma tt2F_refusal_without_Tock: \"tt2F [[X]\\<^sub>R] = tt2F [[X-{Tock}]\\<^sub>R]\"\n  apply auto\n  by (metis evt.exhaust ttevent.distinct(1) ttevent.distinct(5) ttevt2F.simps(1) ttevt2F.simps(2))\n\nlemma tt2F_refusal_no_Tock: \"tt2F [[X\\<union>{Tock}]\\<^sub>R] = tt2F [[X]\\<^sub>R]\"\n  apply auto\n  by (metis evt.exhaust ttevent.distinct(1) ttevent.distinct(5) ttevt2F.simps(1) ttevt2F.simps(2))\n\ntext \\<open> The function mapping tick-tock processes to failures is then defined as follows. \\<close>\n\ndefinition ttproc2F :: \"'a ttprocess \\<Rightarrow> 'a process\" where\n  \"ttproc2F P = ({(s,X). \\<exists>y. Some (s,X) = tt2F y \\<and> y \\<in> P},{s. \\<exists>y. s = tt2T y \\<and> y \\<in> P})\"\n\n\nlemma Some_tt2F_set:\n  \"Some ([], b) = tt2F [[{y. \\<exists>x. y = ttevt2F x \\<and> x \\<in> b}]\\<^sub>R]\"\n  apply auto\n  by (metis evt.exhaust ttevent.distinct(3) ttevent.inject ttevt2F.simps(1) ttevt2F.simps(2))\n  \nlemma TT1_subset_single_ref:\n  assumes \"TT1 P\" \"[[X]\\<^sub>R] \\<in> P\"\n  shows \"[[X-Y]\\<^sub>R] \\<in> P\"\nproof -\n  have \"X-Y \\<subseteq> X\" by auto\n\n  then have \"[[X-Y]\\<^sub>R] \\<lesssim>\\<^sub>C [[X]\\<^sub>R]\"\n    by auto\n\n  then show ?thesis\n    using assms unfolding TT1_def by blast\nqed\n\nlemma\n  shows \"tt2T ([Event x]\\<^sub>E # ys) = (tt2T [[Event x]\\<^sub>E]) @ (tt2T ys)\"\n  by auto\n\nlemma Some_tt2F_imp_tt2T:\n  assumes \"Some (a, b) = tt2F y\"\n  shows \"tt2T y = a\"\n  using assms apply (induct a y arbitrary:b rule:list_induct2', auto)\n  using tt2F_some_exists tt2T.simps(5) apply blast\n  apply (case_tac ya, auto, case_tac x1, auto)\n    apply (metis (mono_tags, lifting) Pair_inject list.inject option.case_eq_if option.inject option.simps(3))\n   apply (smt Pair_inject list.inject option.case_eq_if option.collapse option.inject option.simps(3) prod.collapse)\n  by (metis neq_Nil_conv not_Some_eq option.inject prod.inject tt2F.simps(1) tt2F.simps(8))\n\nlemma tt2F_None_merge_traces:\n  assumes \"([] \\<lbrakk>A\\<rbrakk>\\<^sup>T\\<^sub>C q) \\<noteq> {}\"\n  shows \"tt2F`([] \\<lbrakk>A\\<rbrakk>\\<^sup>T\\<^sub>C q) = {None}\"\n  using assms apply (induct q arbitrary:A rule:ttWF.induct, auto)\n  apply (metis (no_types, lifting) Set.set_insert equals0D image_insert insertI1 option.case_eq_if singletonD)\n  by (metis (mono_tags, lifting) equals0D image_eqI mem_Collect_eq option.simps(4) singleton_iff tt2F.simps(2))\n\nlemma tt2F_None_merge_traces':\n  assumes \"y \\<in> ([] \\<lbrakk>A\\<rbrakk>\\<^sup>T\\<^sub>C q)\"\n  shows \"tt2F y = None\"\n  using assms tt2F_None_merge_traces by blast\n\nlemma tt2F_ending_Event_eq_None:\n  \"tt2F (xs @ [[Event e]\\<^sub>E]) = None\"\n  apply (induct xs, auto)\n  by (metis list.exhaust rotate1.simps(2) rotate1_is_Nil_conv tt2F.simps(8) tt2F_ev_neq_None ttobs.exhaust)\n\nlemma ttWF_tt2F_last_refusal_concat:\n  assumes \"ttWF (xs@[[R]\\<^sub>R])\" \"[Tock]\\<^sub>E \\<notin> set xs\"\n  shows \"tt2F (xs@[[R]\\<^sub>R]) = Some(tt2T xs,{x. ttevt2F x \\<in> R})\"\n  using assms apply (induct xs, auto)\n  apply (case_tac a, auto, case_tac x1, auto)\n  using ttWF.elims(2) apply auto[1]\n  by (smt append_eq_append_conv2 list.distinct(1) list.inject list.set_intros(1) same_append_eq ttWF.elims(2) tt_prefix.elims(2) tt_prefix_concat ttobs.distinct(1))\n\nlemma Some_tt2F_no_Tock:\n  assumes \"Some (s, Y) = tt2F y\"\n  shows \"[Tock]\\<^sub>E \\<notin> set y\"\n  using assms apply(induct y arbitrary:s Y, auto)\n  apply (case_tac a, auto)\n  apply (smt option.collapse option.simps(4) prod.collapse tt2F.simps(2) tt2F.simps(4) tt2F.simps(5) ttevent.exhaust)\n  by (metis list.set_cases option.distinct(1) tt2F.simps(8))\n\nlemma Some_tt2F_no_Tick:\n  assumes \"Some (s, Y) = tt2F y\"\n  shows \"[Tick]\\<^sub>E \\<notin> set y\"\n  using assms apply(induct y arbitrary:s Y, auto)\n  apply (case_tac a, auto)\n  apply (smt option.collapse option.simps(4) prod.collapse tt2F.simps(2) tt2F.simps(4) tt2F.simps(5) ttevent.exhaust)\n  by (metis list.set_cases option.distinct(1) tt2F.simps(8))\n\nlemma some_tt2F_ref_trace:\n  assumes \"Some (s, Y) = tt2F y\" \"ttWF y\"\n  shows \"\\<exists>ys R. y = ys@[[R]\\<^sub>R] \\<and> Y = {x. ttevt2F x \\<in> R} \\<and> tt2T ys = s\"\n  using assms\nproof (induct y rule:rev_induct)\n  case Nil\n  then show ?case by auto\nnext\n  case (snoc x xs)\n  then show ?case\n  proof (cases x)\n    case (ObsEvent ev)\n    then show ?thesis \n    proof (cases ev)\n      case (Event x1)\n      then have \"tt2F (xs @ [x]) = None\"\n        using ObsEvent snoc\n        by (simp add: tt2F_ending_Event_eq_None)\n      then show ?thesis\n        using snoc.prems(1) by auto\n    next\n      case Tock\n      then show ?thesis \n        using ObsEvent Some_tt2F_no_Tock snoc.prems(1) by fastforce\n    next\n      case Tick\n      then show ?thesis\n        using ObsEvent Some_tt2F_no_Tick snoc.prems(1) by fastforce\n    qed\n  next\n    case (Ref x2)\n    then have \"[Tock]\\<^sub>E \\<notin> set xs\"\n      by (metis Some_tt2F_no_Tock Un_iff set_append snoc.prems(1))\n    then show ?thesis using ttWF_tt2F_last_refusal_concat assms\n      by (metis Ref old.prod.inject option.inject snoc.prems(1) snoc.prems(2)) \n  qed\nqed\n\nlemma Some_tt2F_imp_tt2T':\n  assumes \"Some (a, b) = tt2F y\"\n  shows \"tt2T y = a\"\n  using assms apply (induct a y arbitrary:b rule:list_induct2', auto)\n  using tt2F_some_exists tt2T.simps(5) apply blast\n  apply (case_tac ya, auto, case_tac x1, auto)\n    apply (metis (mono_tags, lifting) Pair_inject list.inject option.case_eq_if option.inject option.simps(3))\n   apply (smt Pair_inject list.inject option.case_eq_if option.collapse option.inject option.simps(3) prod.collapse)\n  by (metis neq_Nil_conv not_Some_eq option.inject prod.inject tt2F.simps(1) tt2F.simps(8))\n\nlemma tocks_Some_prefix_tt2F:\n  assumes \"x\\<in>tocks P\" \"x \\<le>\\<^sub>C y\" \"Some (a, b) = tt2F y\"\n  shows \"x = []\"\n  using assms \n  apply (induct y rule:tt2F.induct, auto) \n  using tocks.simps apply fastforce\n  using tt2F_tocks_simp tt_prefix_decompose by fastforce\n\nlemma Some_tt2F_tail:\n  assumes \"Some (a # s, b) = tt2F y\"\n  shows \"Some (s,b) = tt2F (tl y)\"\n  using assms apply (induct y arbitrary:a b, auto)\n  apply (case_tac aa, auto)\n  apply (case_tac x1, auto)\n  apply (metis (no_types, lifting) Pair_inject list.inject option.case_eq_if option.expand option.sel option.simps(3) prod.collapse)\n  using Some_tt2F_imp_tt2T' by fastforce\n\nlemma Some_no_tt2F_tick:\n  assumes \"Some (a # s, b) = tt2F y\"\n  shows \"a \\<noteq> tick\"\n  using assms apply (induct y arbitrary:s b, auto)\n  apply (case_tac aa, auto)\n   apply (case_tac x1, auto)\n  apply (metis Some_tt2F_imp_tt2T' evt.distinct(1) list.sel(1) tt2F.simps(2) tt2T.simps(2))\n    using Some_tt2F_imp_tt2T' by fastforce\n\nlemma Some_tt2F_exists_filter:\n  assumes \"Some (s, b) = tt2F y\"\n  shows \"\\<exists>z. Some (filter (\\<lambda>e. e \\<notin> X) s, b) = tt2F z\"\n  using assms\nproof (induct s arbitrary:b y X)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons a s)\n  then obtain z where z:\"Some (filter (\\<lambda>e. e \\<notin> X) s, b) = tt2F z\"\n    using Some_tt2F_tail by blast\n  then show ?case using Cons \n  proof (cases a)\n    case tick\n    then have \"a \\<noteq> tick\"\n      using Cons Some_no_tt2F_tick by blast\n    then show ?thesis\n      using tick by auto\n  next\n    case (evt x2)\n    then show ?thesis\n    proof (cases \"evt x2 \\<in> X\")\n      case True\n      then show ?thesis \n        using Cons.hyps Cons.prems Some_tt2F_tail evt by fastforce\n    next\n      case False\n      then have \"filter (\\<lambda>e. e \\<notin> X) (a # s) = (a # filter (\\<lambda>e. e \\<notin> X) s)\"\n        using evt by auto\n      then have \"Some ((evt x2 # filter (\\<lambda>e. e \\<notin> X) s), b) = tt2F ([Event x2]\\<^sub>E # z)\"\n        apply auto\n        by (metis (no_types, lifting) fst_conv option.simps(5) snd_conv z)\n      then show ?thesis \n        by (metis \\<open>filter (\\<lambda>e. e \\<notin> X) (a # s) = a # filter (\\<lambda>e. e \\<notin> X) s\\<close> evt)\n    qed\n  qed\nqed\n\nlemma Some_tt2T_exists_filter:\n  assumes \"Some (s, b) = tt2F y\"\n  shows \"\\<exists>z. tt2T z = filter (\\<lambda>e. e \\<notin> X) s \\<and> z \\<noteq> []\"\n  using assms\nproof (induct s arbitrary:b y X)\n  case Nil\n  then show ?case \n    apply auto\n    using tt2T.simps(5) by blast\nnext\n  case (Cons a s)\n  then obtain c z where cz:\"Some (s, c) = tt2F z\"\n    using Cons\n    apply (induct y, auto)\n    using Some_tt2F_tail by blast\n  then obtain z2 where z2:\"tt2T z2 = filter (\\<lambda>e. e \\<notin> X) s\"\n    using Cons\n    by blast\n  then show ?case\n  proof (cases a)\n    case tick\n    then have \"a \\<noteq> tick\"\n      using Cons Some_no_tt2F_tick by blast\n    then show ?thesis\n      using tick by auto\n  next\n    case (evt x2)\n    then show ?thesis\n      by (metis Cons.hyps \\<open>\\<And>thesis. (\\<And>c z. Some (s, c) = tt2F z \\<Longrightarrow> thesis) \\<Longrightarrow> thesis\\<close> filter.simps(2) list.distinct(1) tt2T.simps(2))\n  qed\nqed\n\nlemma filter_empty_iff:\n  \"filter (\\<lambda>e. e \\<notin> HS) s = [] \\<longleftrightarrow> (s = [] \\<or> set s \\<subseteq> HS)\"\n  apply auto\n  by (auto simp add: filter_empty_conv)+\n\nlemma Some_tt2F_event_tl:\n  assumes \"Some (s, X) = tt2F ([Event e]\\<^sub>E # t)\"\n  shows \"Some(tl s,X) = tt2F t\"\n  using assms apply (induct t arbitrary:e X, auto)\n  by (metis (no_types, lifting) list.sel(3) option.case_eq_if option.distinct(1) option.expand option.sel prod.collapse prod.inject)\n\nlemma tt2T_tl_evt:\n  assumes \"tt2T z = (evt e # xs)\"\n  shows \"tt2T (tl z) = xs\"\n  using assms apply (induct z, auto)\n  apply (case_tac a, auto)\n  apply (case_tac x1, auto)\n  using tt2T.elims by auto\n\nlemma tt2T_hd_evt:\n  assumes \"tt2T z = (evt e # xs)\"\n  shows \"hd z = [Event e]\\<^sub>E\"\n  using assms apply (induct z, auto)\n  apply (case_tac a, auto)\n  apply (case_tac x1, auto)\n  using tt2T.elims by auto\n\nlemma Some_tt2F_concat_refusal:\n  assumes \"Some (s, X) = tt2F y\"\n  shows \"\\<exists>xs R. y = xs@[[R]\\<^sub>R] \\<and> tt2T xs = s \\<and> X = {x. ttevt2F x \\<in> R} \\<and> [Tock]\\<^sub>E \\<notin> set xs \\<and> ttWF(xs@[[R]\\<^sub>R])\"\n  using assms\n  proof (induct y arbitrary:s X rule:tt2F.induct)\n    case (1 X)\n    then show ?case by auto\n  next\n    case (2 e \\<sigma>)\n    then obtain t Z where s_R:\"Some (t, Z) = tt2F \\<sigma>\"\n      apply auto\n      by (meson \"2.prems\" Some_tt2F_event_tl)\n    then have \"\\<exists>xs R. \\<sigma> = xs @ [[R]\\<^sub>R] \\<and> tt2T xs = t \\<and> Z = {x. ttevt2F x \\<in> R} \\<and> [Tock]\\<^sub>E \\<notin> set xs \\<and> ttWF(xs@[[R]\\<^sub>R])\"\n      using 2 by auto\n    then have \"\\<exists>xs R. [Event e]\\<^sub>E # \\<sigma> = [Event e]\\<^sub>E # xs @ [[R]\\<^sub>R] \\<and> tt2T ([Event e]\\<^sub>E # xs @ [[R]\\<^sub>R]) = evt e # t \\<and> Z = {x. ttevt2F x \\<in> R} \\<and> [Tock]\\<^sub>E \\<notin> set ([Event e]\\<^sub>E # xs) \\<and> ttWF ([Event e]\\<^sub>E # xs @ [[R]\\<^sub>R])\"\n      apply auto\n      using ttWF_prefix_is_ttWF Some_tt2F_imp_tt2T' s_R by blast\n    then show ?case\n    proof -\n      obtain tts :: \"'a ttobs list\" and TT :: \"'a ttevent set\" where\n        f1: \"[Event e]\\<^sub>E # \\<sigma> = [Event e]\\<^sub>E # tts @ [[TT]\\<^sub>R] \\<and> tt2T ([Event e]\\<^sub>E # tts @ [[TT]\\<^sub>R]) = evt e # t \\<and> Z = {e. ttevt2F e \\<in> TT} \\<and> [Tock]\\<^sub>E \\<notin> set ([Event e]\\<^sub>E # tts) \\<and> ttWF ([Event e]\\<^sub>E # tts @ [[TT]\\<^sub>R])\"\n        using \\<open>\\<exists>xs R. [Event e]\\<^sub>E # \\<sigma> = [Event e]\\<^sub>E # xs @ [[R]\\<^sub>R] \\<and> tt2T ([Event e]\\<^sub>E # xs @ [[R]\\<^sub>R]) = evt e # t \\<and> Z = {x. ttevt2F x \\<in> R} \\<and> [Tock]\\<^sub>E \\<notin> set ([Event e]\\<^sub>E # xs) \\<and> ttWF ([Event e]\\<^sub>E # xs @ [[R]\\<^sub>R])\\<close> by blast\n      have f2: \"\\<forall>es E ts. (Some (es, E) \\<noteq> tt2F ts \\<or> \\<not> ttWF ts) \\<or> (\\<exists>tsa T. ts = tsa @ [[T]\\<^sub>R] \\<and> E = {e. ttevt2F (e::'a evt) \\<in> T} \\<and> tt2T tsa = es)\"\n        by (simp add: some_tt2F_ref_trace)\n      obtain ttsa :: \"'a ttobs list \\<Rightarrow> 'a evt set \\<Rightarrow> 'a evt list \\<Rightarrow> 'a ttobs list\" and TTa :: \"'a ttobs list \\<Rightarrow> 'a evt set \\<Rightarrow> 'a evt list \\<Rightarrow> 'a ttevent set\" where\n        \"\\<forall>x0 x1 x2. (\\<exists>v3 v4. x0 = v3 @ [[v4]\\<^sub>R] \\<and> x1 = {uua. ttevt2F uua \\<in> v4} \\<and> tt2T v3 = x2) = (x0 = ttsa x0 x1 x2 @ [[TTa x0 x1 x2]\\<^sub>R] \\<and> x1 = {uua. ttevt2F uua \\<in> TTa x0 x1 x2} \\<and> tt2T (ttsa x0 x1 x2) = x2)\"\n        by moura\n      then have f3: \"[Event e]\\<^sub>E # tts @ [[TT]\\<^sub>R] = ttsa ([Event e]\\<^sub>E # tts @ [[TT]\\<^sub>R]) X s @ [[TTa ([Event e]\\<^sub>E # tts @ [[TT]\\<^sub>R]) X s]\\<^sub>R] \\<and> X = {ea. ttevt2F ea \\<in> TTa ([Event e]\\<^sub>E # tts @ [[TT]\\<^sub>R]) X s} \\<and> tt2T (ttsa ([Event e]\\<^sub>E # tts @ [[TT]\\<^sub>R]) X s) = s\"\n        using f2 f1 \"2.prems\" by presburger\n      then have \"[Tock]\\<^sub>E \\<notin> set (ttsa ([Event e]\\<^sub>E # tts @ [[TT]\\<^sub>R]) X s)\"\n        using f1 by simp\n      then show ?thesis\n        using f3 f1 by metis\n    qed\n  next\n    case \"3_1\"\n    then show ?case by auto\n  next\n    case (\"3_2\" va)\n    then show ?case by auto\n  next\n    case (\"3_3\" va)\n    then show ?case by auto\n  next\n    case (\"3_4\" vb vc)\n    then show ?case by auto\n  next\n    case (\"3_5\" vb vc)\n    then show ?case by auto\n  next\n    case (\"3_6\" va vb vc)\n    then show ?case by auto\n  qed\n\nlemma\n  assumes \"Some (s, b) = tt2F (xs@[[X]\\<^sub>R])\"\n  shows \"s = tt2T xs \\<and> b = {x. ttevt2F x \\<in> X}\"\n  using assms\n  using Some_tt2F_concat_refusal by force\n\nlemma tt2F_Some_concat_Nil:\n  assumes \"[] = tt2T xs\" \"Some (s, b) = tt2F (xs@[[X]\\<^sub>R])\"\n  shows \"xs = []\"\n  using assms\n  by (induct xs rule:ttWF.induct, auto)\n\n\nlemma ttWF_Some_tt2F:\n  assumes \"ttWF (xs@[[X]\\<^sub>R])\" \"[Tock]\\<^sub>E \\<notin> set xs\"\n  shows \"Some (tt2T xs, {x. ttevt2F x \\<in> X}) = tt2F (xs@[[X]\\<^sub>R])\"\n  using assms\n  apply (induct xs, auto)\n  apply (case_tac a, auto)\n    apply (case_tac x1, auto)\n  apply (smt fst_conv option.simps(5) snd_conv)\n   apply (metis list.exhaust_sel option.distinct(1) tt2F.simps(3) ttWF.simps(1) ttWF.simps(8))\n  by (case_tac xsa, auto, case_tac a, auto, case_tac x1, auto)\n\n\nlemma Some_tt2F_subset:\n  assumes \"Some (s, b \\<union> HS) = tt2F y\"\n  shows \"\\<exists>z. Some (s, b) = tt2F z \\<and> z \\<lesssim>\\<^sub>C y\"\nproof -\n  obtain xs X where xs_X:\"y = xs@[[X]\\<^sub>R] \\<and> b \\<union> HS = {x. ttevt2F x \\<in> X} \\<and> [Tock]\\<^sub>E \\<notin> set xs \\<and> ttWF(xs@[[X]\\<^sub>R])\"\n    using Some_tt2F_concat_refusal assms by blast\n\n  then have \"ttevt2F`(b \\<union> HS) \\<subseteq> X\"\n    by auto\n\n  then have \"xs@[[ttevt2F`b]\\<^sub>R] \\<lesssim>\\<^sub>C xs@[[X]\\<^sub>R]\"\n    apply auto\n    by (simp add: image_Un tt_prefix_common_concat)\n\n  then have \"Some (tt2T xs, b \\<union> HS) = tt2F (xs@[[X]\\<^sub>R])\"\n    apply auto\n    using Some_tt2F_concat_refusal assms xs_X by blast\n\n  have \"ttWF (xs@[[ttevt2F`b]\\<^sub>R])\"\n    using \\<open>xs @ [[ttevt2F ` b]\\<^sub>R] \\<lesssim>\\<^sub>C xs @ [[X]\\<^sub>R]\\<close> tt_prefix_subset_ttWF xs_X by blast\n\n  have Tock_not_in_xs_b:\"[Tock]\\<^sub>E \\<notin> set (xs@[[ttevt2F`b]\\<^sub>R])\"\n    by (simp add: xs_X)\n\n  have b_ttevt2F:\"b = {x. ttevt2F x \\<in> ttevt2F`b}\"\n    using Some_tt2F_set by fastforce\n\n  then have \"Some (tt2T xs, b) = tt2F (xs@[[ttevt2F`b]\\<^sub>R])\"\n    using Tock_not_in_xs_b ttWF_Some_tt2F b_ttevt2F\n    using \\<open>ttWF (xs @ [[ttevt2F ` b]\\<^sub>R])\\<close> by fastforce\n\n  then show ?thesis\n    by (metis Pair_inject \\<open>Some (tt2T xs, b \\<union> HS) = tt2F (xs @ [[X]\\<^sub>R])\\<close> \\<open>xs @ [[ttevt2F ` b]\\<^sub>R] \\<lesssim>\\<^sub>C xs @ [[X]\\<^sub>R]\\<close> assms option.inject xs_X)\nqed\n\nlemma Some_no_tick_trace[simp]:\n  assumes \"Some (a, b) = tt2F y\" \n  shows \"tick \\<notin> set a\"\n  using assms apply (induct a arbitrary:b y, auto)\n  using Some_no_tt2F_tick apply blast\n  using Some_tt2F_tail by blast\n\nlemma tt2T_concat_dist:\n  assumes \"[Tick]\\<^sub>E \\<notin> set s\" \"[Tock]\\<^sub>E \\<notin> set s\" \"\\<not>(\\<exists>R. [R]\\<^sub>R \\<in> set s)\"\n  shows \"tt2T (s @ t) = (tt2T s) @ (tt2T t)\"\n  using assms apply (induct s arbitrary: t, auto)\n  apply (case_tac a, auto)\n  by (case_tac x1, auto)\n\nlemma Some_tt2F_no_prev_refusals:\n  assumes \"Some (a, b) = tt2F (s @ [[R]\\<^sub>R])\"\n  shows \"\\<not>(\\<exists>R. [R]\\<^sub>R \\<in> set s)\"\n  using assms apply (induct s arbitrary:a b R, auto)\n   apply (metis list.exhaust_sel option.distinct(1) snoc_eq_iff_butlast tt2F.simps(8))\n  by (metis (no_types, hide_lams) Some_tt2F_tail append_Cons append_Nil list.sel(3) neq_Nil_conv tt2F_some_exists)\n\nlemma tt2T_tick_butlast:\n  assumes \"s @ [tick] = tt2T y\"\n  shows \"tt2T (butlast y) = s\"\n  using assms apply (induct y arbitrary:s, auto)\n   apply (case_tac a, auto)\n   apply (case_tac x1, auto)\n  apply (case_tac a, auto)\n   apply (case_tac x1, auto)\n   apply (metis (no_types, lifting) append_eq_Cons_conv evt.distinct(1) list.inject)\n  by (metis list.exhaust_sel snoc_eq_iff_butlast tt2T.simps(7))\n\nlemma tt2T_tick_exists_Cons:\n  assumes \"s @ [tick] = tt2T y\"\n  shows \"\\<exists>z. z@[[Tick]\\<^sub>E] = y\"\n  using assms apply (induct y arbitrary:s, auto)\n  apply (case_tac a, auto)\n  apply (case_tac x1, auto)\n   apply (metis Cons_eq_append_conv evt.distinct(1) list.inject)\n  by (metis append_Nil list.exhaust_sel snoc_eq_iff_butlast tt2T.simps(7))\n\n\nlemma\n  assumes \"s @ [tick] = tt2T (z @ [[Tick]\\<^sub>E])\"\n  shows \"s = tt2T z\"\n  using assms\n  using tt2T_tick_butlast by fastforce\n\nlemma tick_tt2T_concat_TickE[intro?]:\n  assumes \"[tick] = tt2T (za @ [[Tick]\\<^sub>E])\"\n  shows \"za = []\"\n  using assms apply (induct za, auto)\n  apply (case_tac a, auto)\n  apply (case_tac x1, auto)\n  by (metis list.distinct(1) list.exhaust_sel snoc_eq_iff_butlast tt2T.simps(7))\n\nlemma Some_concat_extend:\n  assumes \"Some (t, b) = tt2F ya\" \"[Tick]\\<^sub>E \\<notin> set z\" \"[Tock]\\<^sub>E \\<notin> set z\" \"\\<not>(\\<exists>R. [R]\\<^sub>R \\<in> set z)\" (* *)\n  shows \"Some (tt2T z @ t, b) = tt2F (z @ ya)\"\n  using assms apply (induct z arbitrary:t ya b rule:tt2F.induct , auto)\n  by (smt fst_conv option.simps(5) snd_conv)\n\nlemma tt2T_concat_Tick_no_Tick_set:\n  assumes \"s @ [tick] = tt2T (z @ [[Tick]\\<^sub>E])\"\n  shows \"[Tick]\\<^sub>E \\<notin> set z\"\n  using assms apply (induct z arbitrary:s, auto)\n   apply (metis list.exhaust_sel snoc_eq_iff_butlast tt2T.simps(7))\n  apply (case_tac a, auto)\n  apply (case_tac x1, auto)\n   apply (metis append_Nil evt.distinct(1) list.sel(1) list.sel(3) tl_append2)\n  by (metis list.exhaust_sel snoc_eq_iff_butlast tt2T.simps(7))\n\nlemma tt2T_concat_Tick_no_Ref_set:\n  assumes \"s @ [tick] = tt2T (z @ [[Tick]\\<^sub>E])\"\n  shows \"\\<not>(\\<exists>R. [R]\\<^sub>R \\<in> set z)\"\n  using assms apply (induct z arbitrary:s, auto)\n  apply (case_tac a, auto)\n  apply (case_tac x1, auto)\n   apply (metis append_Nil evt.distinct(1) list.sel(1) list.sel(3) tl_append2)\n  by (metis list.exhaust_sel snoc_eq_iff_butlast tt2T.simps(7))\n\nlemma tt2T_concat_Tick_no_Tock_set:\n  assumes \"s @ [tick] = tt2T (z @ [[Tick]\\<^sub>E])\"\n  shows \"[Tock]\\<^sub>E \\<notin> set z\"\n  using assms apply (induct z arbitrary:s, auto)\n  apply (case_tac a, auto)\n  apply (case_tac x1, auto)\n   apply (metis append_Nil evt.distinct(1) list.sel(1) list.sel(3) tl_append2)\n  by (metis list.exhaust_sel snoc_eq_iff_butlast tt2T.simps(7))\n\nlemma Some_concat_extend':\n  assumes \"Some (t, b) = tt2F ya\" \"s @ [tick] = tt2T (z @ [[Tick]\\<^sub>E])\"\n  shows \"Some (tt2T z @ t, b) = tt2F (z @ ya)\"\n  using assms Some_concat_extend tt2T_concat_Tick_no_Tick_set tt2T_concat_Tick_no_Ref_set tt2T_concat_Tick_no_Tock_set\n  by blast\n\nlemma Tick_no_eq:\n  assumes \"[Tick]\\<^sub>E \\<notin> set y\" \n  shows \"\\<forall>s. y \\<noteq> s @ [[Tick]\\<^sub>E]\"\n  using assms by (induct y rule:rev_induct, auto)\n\nlemma Tick_set_tt2T_in:\n  assumes \"tick \\<in> set (tt2T y)\"\n  shows \"[Tick]\\<^sub>E \\<in> set y\" \n  using assms apply (induct y, auto)\n  apply (case_tac a, auto)\n  by (case_tac x1, auto)\n\nlemma Tick_set_ends_in_Tick:\n  assumes \"[Tick]\\<^sub>E \\<in> set y\" \"ttWF y\"\n  shows \"\\<exists>xs. y = xs@[[Tick]\\<^sub>E]\"\n  using assms apply (induct y, auto)\n  using ttWF.elims(2) apply auto[1]\n  by (metis append_Cons append_Nil list.exhaust_sel split_list ttWF.simps(8) ttWF_dist_notTock_cons ttevent.distinct(5))\n\nlemma Tock_in_trace_Tick_no_Tick:\n  assumes \"[Tock]\\<^sub>E \\<in> set s\"  \"ttWF (s @ [[Tick]\\<^sub>E])\"\n  shows \"tick \\<notin> set (tt2T (s @ t))\"\n  using assms by (induct s rule:tt2T.induct, auto)\n\nlemma Tock_in_trace_Refusal_no_Tick:\n  assumes \"(\\<exists>R. [R]\\<^sub>R \\<in> set s)\"  \"ttWF (s @ [[Tick]\\<^sub>E])\"\n  shows \"tick \\<notin> set (tt2T (s @ t))\"\n  using assms by (induct s rule:tt2T.induct, auto)\n\nlemma Tock_in_concat_lhs:\n  assumes \"[Tock]\\<^sub>E \\<in> set s\"\n  shows \"tt2T (s @ t) = tt2T s\"\n  using assms by (induct s rule:tt2T.induct, auto)\n\nlemma Ref_in_concat_lhs:\n  assumes \"(\\<exists>R. [R]\\<^sub>R \\<in> set s)\"\n  shows \"tt2T (s @ t) = tt2T s\"\n  using assms by (induct s rule:tt2T.induct, auto)\n\nfun F2tt_trace :: \"'a failure \\<Rightarrow> 'a tttrace set\" where\n  \"F2tt_trace ([], X) = {[[ttevt2F ` X]\\<^sub>R], [[(ttevt2F ` X) \\<union> {Tock}]\\<^sub>R]}\" |\n  \"F2tt_trace (e # t, X) = {s. \\<exists>s'. s = [ttevt2F e]\\<^sub>E # s' \\<and> s' \\<in> F2tt_trace (t, X)}\"\n\ndefinition \"F2tt\" :: \"'a process \\<Rightarrow> 'a ttprocess\" where\n  \"F2tt P = \\<Union>(F2tt_trace ` (fst P)) \\<union> map (\\<lambda>e. [ttevt2F e]\\<^sub>E) ` (snd P)\"\n\nlemma F2tt_ttproc2F_no_tocks:\n  assumes P_no_tock: \"\\<forall>t\\<in>P. [Tock]\\<^sub>E \\<notin> set t\" and P_wf: \"\\<forall>x\\<in>P. ttWF x\" and TT1_P: \"TT1 P\" and TT2_P: \"TT2 P\"\n  shows \"P = F2tt (ttproc2F P)\"\n  unfolding F2tt_def ttproc2F_def image_def\nproof auto\n  fix x :: \"'a tttrace\"\n  have \"\\<And>P. ttWF x \\<Longrightarrow> [Tock]\\<^sub>E \\<notin> set x \\<Longrightarrow> x \\<in> P \\<Longrightarrow> \\<forall>xa. (\\<forall>a b. (\\<forall>y. Some (a, b) = tt2F y \\<longrightarrow> y \\<notin> P) \\<or> xa \\<noteq> F2tt_trace (a, b)) \\<or> x \\<notin> xa \\<Longrightarrow>\n         \\<exists>xa. (\\<exists>y. xa = tt2T y \\<and> y \\<in> P) \\<and> x = map (\\<lambda>e. [ttevt2F e]\\<^sub>E) xa\"\n  proof (induct x rule:ttWF.induct, auto)\n    fix P :: \"'a ttprocess\"\n    show \"[] \\<in> P \\<Longrightarrow> \\<exists>y. [] = tt2T y \\<and> y \\<in> P\"\n      by (rule_tac x=\"[]\" in exI, auto)\n  next\n    fix X and P :: \"'a ttprocess\"\n    show \"[[X]\\<^sub>R] \\<in> P \\<Longrightarrow>\n           \\<forall>xa. (\\<forall>a b. (\\<forall>y. Some (a, b) = tt2F y \\<longrightarrow> y \\<notin> P) \\<or> xa \\<noteq> F2tt_trace (a, b)) \\<or> [[X]\\<^sub>R] \\<notin> xa \\<Longrightarrow>\n           \\<exists>xa. (\\<exists>y. xa = tt2T y \\<and> y \\<in> P) \\<and> [[X]\\<^sub>R] = map (\\<lambda>e. [ttevt2F e]\\<^sub>E) xa\"\n      apply (erule_tac x=\"{[[X\\<union>{Tock}]\\<^sub>R], [[{e\\<in>X. e \\<noteq> Tock}]\\<^sub>R]}\" in allE, auto)\n    proof (erule_tac x=\"[]\" in allE, erule_tac x=\"{e. ttevt2F e \\<in> X}\" in allE, safe, simp_all)\n      have \"insert Tock X = insert Tock (ttevt2F ` {e. ttevt2F e \\<in> X})\"\n        by (auto, smt image_eqI mem_Collect_eq ttevent.exhaust ttevt2F.simps(1) ttevt2F.simps(2))\n      then show \"insert Tock X = ttevt2F ` {e. ttevt2F e \\<in> X} \\<or> insert Tock X = insert Tock (ttevt2F ` {e. ttevt2F e \\<in> X})\"\n        by auto\n    next\n      have \"{e \\<in> X. e \\<noteq> Tock} = ttevt2F ` {e. ttevt2F e \\<in> X}\"\n        apply (auto, metis (no_types, lifting) image_iff mem_Collect_eq ttevent.exhaust ttevt2F.simps(1) ttevt2F.simps(2))\n        by (metis evt.exhaust ttevent.distinct(1) ttevent.distinct(5) ttevt2F.simps(1) ttevt2F.simps(2))\n      then show \"{e \\<in> X. e \\<noteq> Tock} = ttevt2F ` {e. ttevt2F e \\<in> X} \\<or> {e \\<in> X. e \\<noteq> Tock} = insert Tock (ttevt2F ` {e. ttevt2F e \\<in> X})\"\n        by auto\n    next\n      fix x\n      assume \"x = [[ttevt2F ` {e. ttevt2F e \\<in> X}]\\<^sub>R] \\<or> x = [[insert Tock (ttevt2F ` {e. ttevt2F e \\<in> X})]\\<^sub>R]\"\n      then show \"x \\<noteq> [[insert Tock X]\\<^sub>R] \\<Longrightarrow> x = [[{e \\<in> X. e \\<noteq> Tock}]\\<^sub>R]\"\n        by (auto, (smt image_iff mem_Collect_eq ttevent.exhaust ttevt2F.simps(1) ttevt2F.simps(2))+)\n    qed\n  next\n    fix e \\<sigma> and P :: \"'a ttprocess\"\n    assume case_assms: \"ttWF \\<sigma>\" \"[Event e]\\<^sub>E # \\<sigma> \\<in> P\"\n    assume ind_hyp: \"\\<And>P. \\<sigma> \\<in> P \\<Longrightarrow>\n             \\<forall>xa. (\\<forall>a b. (\\<forall>y. Some (a, b) = tt2F y \\<longrightarrow> y \\<notin> P) \\<or> xa \\<noteq> F2tt_trace (a, b)) \\<or> \\<sigma> \\<notin> xa \\<Longrightarrow>\n             \\<exists>xa. (\\<exists>y. xa = tt2T y \\<and> y \\<in> P) \\<and> \\<sigma> = map (\\<lambda>e. [ttevt2F e]\\<^sub>E) xa\"\n    assume \"\\<forall>xa. (\\<forall>a b. (\\<forall>y. Some (a, b) = tt2F y \\<longrightarrow> y \\<notin> P) \\<or> xa \\<noteq> F2tt_trace (a, b)) \\<or> [Event e]\\<^sub>E # \\<sigma> \\<notin> xa\"\n    then have \"\\<forall>xa. (\\<forall>a b. (\\<forall>y. Some (a, b) = tt2F y \\<longrightarrow> y \\<notin> {t. [Event e]\\<^sub>E # t \\<in> P}) \\<or> xa \\<noteq> F2tt_trace (a, b)) \\<or> \\<sigma> \\<notin> xa\"\n      apply (auto, erule_tac x=\"F2tt_trace (evt e # a, b)\" in allE, auto)\n      apply (erule_tac x=\"evt e # a\" in allE, erule_tac x=b in allE, auto)\n      by (erule_tac x=\"[Event e]\\<^sub>E # y\" in allE, auto, case_tac \"tt2F y\", auto)\n    then have \"\\<exists>xa. (\\<exists>y. xa = tt2T y \\<and> y \\<in> {t. [Event e]\\<^sub>E # t \\<in> P}) \\<and> \\<sigma> = map (\\<lambda>e. [ttevt2F e]\\<^sub>E) xa\"\n      using ind_hyp[where P=\"{t. [Event e]\\<^sub>E # t \\<in> P}\"] case_assms by auto\n    then show \"\\<exists>xa. (\\<exists>y. xa = tt2T y \\<and> y \\<in> P) \\<and> [Event e]\\<^sub>E # \\<sigma> = map (\\<lambda>e. [ttevt2F e]\\<^sub>E) xa\"\n      by auto\n  qed\n  then show \"x \\<in> P \\<Longrightarrow>\n         \\<forall>xa. (\\<forall>a b. (\\<forall>y. Some (a, b) = tt2F y \\<longrightarrow> y \\<notin> P) \\<or> xa \\<noteq> F2tt_trace (a, b)) \\<or> x \\<notin> xa \\<Longrightarrow>\n         \\<exists>xa. (\\<exists>y. xa = tt2T y \\<and> y \\<in> P) \\<and> x = map (\\<lambda>e. [ttevt2F e]\\<^sub>E) xa\"\n    by (simp add: P_no_tock P_wf)\nnext\n  fix a b and x y :: \"'a tttrace\"\n  have \"\\<And> P x a. ttWF y \\<Longrightarrow> y @ [[Tock]\\<^sub>E] \\<notin> P \\<Longrightarrow> TT1 P \\<Longrightarrow> TT2 P \\<Longrightarrow> x \\<in> F2tt_trace (a, b) \\<Longrightarrow>\n      Some (a, b) = tt2F y \\<Longrightarrow> y \\<in> P \\<Longrightarrow> x \\<in> P\"\n  proof (induct y rule:ttWF.induct, auto)\n    fix X and P :: \"'a ttprocess\"\n    show \"TT1 P \\<Longrightarrow> [[X]\\<^sub>R] \\<in> P \\<Longrightarrow> [[ttevt2F ` {x. ttevt2F x \\<in> X}]\\<^sub>R] \\<in> P\"\n      unfolding TT1_def apply auto\n      by (metis (no_types, lifting) image_Collect_subsetI tt_prefix_subset.simps(1) tt_prefix_subset.simps(2))\n  next\n    fix X and P :: \"'a ttprocess\"\n    assume \"TT2 P\" \"[[X]\\<^sub>R] \\<in> P\" \"[[X]\\<^sub>R, [Tock]\\<^sub>E] \\<notin> P\"\n    then have \"[[insert Tock X]\\<^sub>R] \\<in> P\"\n      unfolding TT2_def\n      apply (erule_tac x=\"[]\" in allE, erule_tac x=\"[]\" in allE)\n      by (erule_tac x=X in allE, erule_tac x=\"{Tock}\" in allE, auto)\n    also have \"insert Tock (ttevt2F ` {x. ttevt2F x \\<in> X}) = insert Tock X\"\n      unfolding image_def by (auto, case_tac x, auto, metis ttevt2F.simps(1), metis ttevt2F.simps(2))\n    then show \"[[insert Tock (ttevt2F ` {x. ttevt2F x \\<in> X})]\\<^sub>R] \\<in> P\"\n      using calculation by auto\n  next\n    fix e \\<sigma> x a and P :: \"'a ttprocess\"\n    assume case_assms: \"ttWF \\<sigma>\" \"[Event e]\\<^sub>E # \\<sigma> @ [[Tock]\\<^sub>E] \\<notin> P\" \"TT1 P\" \"TT2 P\" \"x \\<in> F2tt_trace (a, b)\"\n       \"Some (a, b) = (case tt2F \\<sigma> of None \\<Rightarrow> None | Some fl \\<Rightarrow> Some (evt e # fst fl, snd fl))\" \"[Event e]\\<^sub>E # \\<sigma> \\<in> P\"\n    assume ind_hyp: \"\\<And>P x a. \\<sigma> @ [[Tock]\\<^sub>E] \\<notin> P \\<Longrightarrow> TT1 P \\<Longrightarrow> TT2 P \\<Longrightarrow> x \\<in> F2tt_trace (a, b) \\<Longrightarrow> Some (a, b) = tt2F \\<sigma> \\<Longrightarrow> \\<sigma> \\<in> P \\<Longrightarrow> x \\<in> P\"\n\n    obtain a' where a'_assms: \"Some (a', b) = tt2F \\<sigma> \\<and> a = evt e # a'\"\n      using case_assms(6) by (cases \"tt2F \\<sigma>\", safe, simp_all)\n    obtain x' where x'_assms: \"x = [Event e]\\<^sub>E # x' \\<and> x' \\<in> F2tt_trace (a', b)\"\n      using case_assms(5) a'_assms by auto\n\n    thm ind_hyp[where P=\"{t. [Event e]\\<^sub>E # t \\<in> P}\", where x=x, where a=a']\n    have 1:  \"\\<sigma> @ [[Tock]\\<^sub>E] \\<notin> {t. [Event e]\\<^sub>E # t \\<in> P}\"\n      using case_assms(2) by blast\n    have 2: \"TT1 {t. [Event e]\\<^sub>E # t \\<in> P}\"\n      by (simp add: TT1_init_event case_assms(3))\n    have 3: \"TT2 {t. [Event e]\\<^sub>E # t \\<in> P}\"\n      by (simp add: TT2_init_event case_assms(4))\n\n    have \"x' \\<in> {t. [Event e]\\<^sub>E # t \\<in> P}\"\n      using ind_hyp[where P=\"{t. [Event e]\\<^sub>E # t \\<in> P}\"] 1 2 3 case_assms x'_assms a'_assms by auto\n    then show \"x \\<in> P\"\n      using x'_assms by blast\n  qed\n  then show \"x \\<in> F2tt_trace (a, b) \\<Longrightarrow> Some (a, b) = tt2F y \\<Longrightarrow> y \\<in> P \\<Longrightarrow> x \\<in> P\"\n    by (meson P_no_tock P_wf TT1_P TT2_P in_set_conv_decomp)\nnext\n  fix y :: \"'a tttrace\"\n  have \"ttWF y \\<Longrightarrow> map (\\<lambda>e. [ttevt2F e]\\<^sub>E) (tt2T y) \\<lesssim>\\<^sub>C y\"\n    by (induct y rule:ttWF.induct, auto)\n  then show \"y \\<in> P \\<Longrightarrow> map (\\<lambda>e. [ttevt2F e]\\<^sub>E) (tt2T y) \\<in> P\"\n    using P_wf TT1_P TT1_def by blast\nqed\n\nlemma ttproc2F_eq_no_tocks_imp_F2tt_eq:\n  assumes \"ttproc2F P = Q\"\n  assumes \"\\<forall>t\\<in>P. [Tock]\\<^sub>E \\<notin> set t\" \"\\<forall>x\\<in>P. ttWF x\" \"TT1 P\" \"TT2 P\"\n  shows \"P = F2tt Q\"\n  using assms F2tt_ttproc2F_no_tocks by auto\n\nend", "meta": {"author": "UoY-RoboStar", "repo": "tick-tock-CSP", "sha": "7186d2e7f70116589850112a7353bc521372c913", "save_path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP", "path": "github-repos/isabelle/UoY-RoboStar-tick-tock-CSP/tick-tock-CSP-7186d2e7f70116589850112a7353bc521372c913/Failures/Failures_TickTock.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3079029354849906}}
{"text": "(*  Title:      JinjaDCI/Compiler/PCompiler.thy\n\n    Author:     Tobias Nipkow, Susannah Mansky\n    Copyright   TUM 2003, UIUC 2019-20\n\n    Based on the Jinja theory Common/PCompiler.thy by Tobias Nipkow\n*)\n\nsection \\<open> Program Compilation \\<close>\n\ntheory PCompiler\nimports \"../Common/WellForm\"\nbegin\n\ndefinition compM :: \"(staticb \\<Rightarrow> 'a \\<Rightarrow> 'b) \\<Rightarrow> 'a mdecl \\<Rightarrow> 'b mdecl\"\nwhere\n  \"compM f  \\<equiv>  \\<lambda>(M, b, Ts, T, m). (M, b, Ts, T, f b m)\"\n\ndefinition compC :: \"(staticb \\<Rightarrow> 'a \\<Rightarrow> 'b) \\<Rightarrow> 'a cdecl \\<Rightarrow> 'b cdecl\"\nwhere\n  \"compC f  \\<equiv>  \\<lambda>(C,D,Fdecls,Mdecls). (C,D,Fdecls, map (compM f) Mdecls)\"\n\ndefinition compP :: \"(staticb \\<Rightarrow> 'a \\<Rightarrow> 'b) \\<Rightarrow> 'a prog \\<Rightarrow> 'b prog\"\nwhere\n  \"compP f  \\<equiv>  map (compC f)\"\n\ntext\\<open> Compilation preserves the program structure.  Therefore lookup\nfunctions either commute with compilation (like method lookup) or are\npreserved by it (like the subclass relation). \\<close>\n\nlemma map_of_map4:\n  \"map_of (map (\\<lambda>(x,a,b,c).(x,a,b,f c)) ts) =\n  map_option (\\<lambda>(a,b,c).(a,b,f c)) \\<circ> (map_of ts)\"\n(*<*)\nproof(induct ts)\n  case Nil then show ?case by simp\nqed fastforce\n(*>*)\n\nlemma map_of_map245:\n  \"map_of (map (\\<lambda>(x,a,b,c,d).(x,a,b,c,f a c d)) ts) =\n  map_option (\\<lambda>(a,b,c,d).(a,b,c,f a c d)) \\<circ> (map_of ts)\"\n(*<*)\nproof(induct ts)\n  case Nil then show ?case by simp\nqed fastforce\n(*>*)\n\n\nlemma class_compP:\n  \"class P C = Some (D, fs, ms)\n  \\<Longrightarrow> class (compP f P) C = Some (D, fs, map (compM f) ms)\"\n(*<*)by(simp add:class_def compP_def compC_def map_of_map4)(*>*)\n\n\nlemma class_compPD:\n  \"class (compP f P) C = Some (D, fs, cms)\n  \\<Longrightarrow> \\<exists>ms. class P C = Some(D,fs,ms) \\<and> cms = map (compM f) ms\"\n(*<*)by(clarsimp simp add:class_def compP_def compC_def map_of_map4)(*>*)\n\n\n\n\n\nlemma [simp]: \"class (compP f P) C = map_option (\\<lambda>c. snd(compC f (C,c))) (class P C)\"\n(*<*)\nby(simp add:compP_def compC_def class_def map_of_map4)\n  (simp add:split_def)\n(*>*)\n\n\nlemma sees_methods_compP:\n  \"P \\<turnstile> C sees_methods Mm \\<Longrightarrow>\n  compP f P \\<turnstile> C sees_methods (map_option (\\<lambda>((b,Ts,T,m),D). ((b,Ts,T,f b m),D)) \\<circ> Mm)\"\n(*<*)(is \"?P \\<Longrightarrow> compP f P \\<turnstile> C sees_methods (?map Mm)\")\nproof(induct rule: Methods.induct)\n  case Object: (sees_methods_Object D fs ms Mm)\n  let ?Mm1 = \"\\<lambda>x. map_option ((\\<lambda>m. (m, Object)) \\<circ> (\\<lambda>(b, Ts, T, m). (b, Ts, T, f b m))) (map_of ms x)\"\n  let ?Mm2 = \"\\<lambda>x. map_option (case_prod (\\<lambda>(b, Ts, T, m).\n                   Pair (b, Ts, T, f b m)) \\<circ> (\\<lambda>m. (m, Object))) (map_of ms x)\"\n  have Mm_eq: \"\\<And>x. ?Mm1 x = ?Mm2 x\"\n  proof -\n    fix x show \"?Mm1 x = ?Mm2 x\"\n    proof(cases \"map_of ms x\")\n      case None then show ?thesis by simp\n    qed fastforce\n  qed\n\n  have Mm: \"Mm = map_option (\\<lambda>m. (m, Object)) \\<circ> map_of ms\" by fact\n  let ?Mm = \"map_option (\\<lambda>m. (m, Object)) \\<circ> map_of (map (compM f) ms)\"\n  let ?Mm' = \"?map Mm\"\n  have \"?Mm' = ?Mm\"\n    by(rule ext) (simp add:Mm Mm_eq compM_def map_of_map245 option.map_comp)\n  then show ?case by(rule sees_methods_Object[OF class_compP[OF Object(1)]])\nnext\n  case rec: (sees_methods_rec C D fs ms Mm Mm')\n  have Mm': \"Mm' = Mm ++ (map_option (\\<lambda>m. (m, C)) \\<circ> map_of ms)\" by fact\n  let ?Mm' = \"?map Mm'\"\n  let ?Mm'' = \"(?map Mm) ++ (map_option (\\<lambda>m. (m, C)) \\<circ> map_of (map (compM f) ms))\"\n  have \"?Mm' = ?Mm''\"\n    by(rule ext) (simp add:Mm' map_add_def compM_def map_of_map245)\n  moreover have \"compP f P \\<turnstile> C sees_methods ?Mm''\"\n    using sees_methods_rec[OF class_compP[OF rec(1)] rec(2,4)] by fast\n  ultimately show \"compP f P \\<turnstile> C sees_methods ?Mm'\" by simp\nqed\n(*>*)\n\n\nlemma sees_method_compP:\n  \"P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = m in D \\<Longrightarrow>\n  compP f P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = (f b m) in D\"\n(*<*)by(fastforce elim:sees_methods_compP simp add:Method_def)(*>*)\n\n\nlemma [simp]:\n  \"P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = m in D \\<Longrightarrow>\n  method (compP f P) C M = (D,b,Ts,T,f b m)\"\n(*<*)\nproof -\n  let ?P = \"\\<lambda>(D, b, Ts, T, m). compP f P \\<turnstile> C sees M, b :  Ts\\<rightarrow>T = m in D\"\n  let ?a = \"(D, b, Ts, T, f b m)\"\n  assume cM: \"P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = m in D\"\n  have compP_cM: \"?P ?a\" using sees_method_compP[OF cM] by simp\n  moreover {\n    fix x assume \"?P x\" then have \"x = ?a\"\n      using compP_cM by(fastforce dest:sees_method_fun)\n  }\n  ultimately have \"(THE x. ?P x) = ?a\" by(rule the_equality)\n  then show ?thesis by(simp add:method_def)\nqed\n(*>*)\n\n\nlemma sees_methods_compPD:\n  \"\\<lbrakk> cP \\<turnstile> C sees_methods Mm'; cP = compP f P \\<rbrakk> \\<Longrightarrow>\n  \\<exists>Mm. P \\<turnstile> C sees_methods Mm \\<and>\n        Mm' = (map_option (\\<lambda>((b,Ts,T,m),D). ((b,Ts,T,f b m),D)) \\<circ> Mm)\"\n(*<*)(is \"\\<lbrakk> ?P; ?Q \\<rbrakk> \\<Longrightarrow> \\<exists>Mm. P \\<turnstile> C sees_methods Mm \\<and> Mm' = (?map Mm)\")\nproof(induct rule: Methods.induct)\n  case Object: (sees_methods_Object D fs ms Mm)\n  then obtain ms' where P_Obj: \"class P Object = \\<lfloor>(D, fs, ms')\\<rfloor>\"\n    and ms: \"ms = map (compM f) ms'\" by(clarsimp simp:compC_def)\n\n  let ?Mm1 = \"\\<lambda>x. map_option ((\\<lambda>m. (m, Object)) \\<circ> (\\<lambda>(b, Ts, T, m). (b, Ts, T, f b m))) (map_of ms' x)\"\n  let ?Mm2 = \"\\<lambda>x. map_option (case_prod (\\<lambda>(b, Ts, T, m). Pair (b, Ts, T, f b m)) \\<circ> (\\<lambda>m. (m, Object)))\n          (map_of ms' x)\"\n  have Mm_eq: \"\\<And>x. ?Mm1 x = ?Mm2 x\"\n  proof -\n    fix x show \"?Mm1 x = ?Mm2 x\"\n    proof(cases \"map_of ms' x\")\n      case None then show ?thesis by simp\n    qed fastforce\n  qed\n\n  let ?Mm = \"map_option (\\<lambda>m. (m,Object)) \\<circ> map_of ms'\"\n  let ?Mm' = \"?map ?Mm\"\n  have Mm: \"Mm = map_option (\\<lambda>m. (m, Object)) \\<circ> map_of ms\" by fact\n  have \"P \\<turnstile> Object sees_methods ?Mm\"\n    using sees_methods_Object[OF P_Obj] by simp\n  moreover have \"Mm = ?Mm'\"\n    by(rule ext) (simp add:Mm_eq Mm ms compM_def map_of_map245 option.map_comp)\n  ultimately show ?case by fast\nnext\n  case rec: (sees_methods_rec C D fs ms Mm Mm')\n  then obtain ms' Mm\\<^sub>D where P_D: \"class P C = \\<lfloor>(D, fs, ms')\\<rfloor>\"\n     and ms: \"ms = map (compM f) ms'\" and C_nObj: \"C \\<noteq> Object\"\n     and Mm\\<^sub>D: \"P \\<turnstile> D sees_methods Mm\\<^sub>D\"\n     and Mm: \"Mm = (\\<lambda>a. map_option (case_prod (\\<lambda>(b, Ts, T, m). Pair (b, Ts, T, f b m))) (Mm\\<^sub>D a))\"\n    by(clarsimp simp:compC_def)\n\n  let ?Mm = \"Mm\\<^sub>D ++ (map_option (\\<lambda>m. (m, C)) \\<circ> map_of ms')\"\n  let ?Mm1 = \"Mm ++ (map_option (\\<lambda>m. (m, C)) \\<circ> map_of ms)\"\n  let ?Mm2 = \"Mm ++ (map_option (\\<lambda>m. (m, C)) \\<circ> map_of (map (compM f) ms'))\"\n  let ?Mm3 = \"?map ?Mm\"\n  have \"Mm' = ?Mm1\" by fact\n  also have \"\\<dots> = ?Mm2\" using ms by simp\n  also have \"\\<dots> = ?Mm3\"\n    by(rule ext)(simp add:Mm map_add_def compM_def map_of_map245)\n  moreover have \"P \\<turnstile> C sees_methods ?Mm\"\n    using sees_methods_rec[OF P_D C_nObj Mm\\<^sub>D] by simp\n  ultimately show ?case by fast\nqed\n(*>*)\n\n\nlemma sees_method_compPD:\n  \"compP f P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = fm in D \\<Longrightarrow>\n  \\<exists>m. P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = m in D \\<and> f b m = fm\"\n(*<*)\nproof -\n  assume \"compP f P \\<turnstile> C sees M,b: Ts\\<rightarrow>T = fm in D\"\n  then obtain Mm where Mm: \"compP f P \\<turnstile> C sees_methods Mm\"\n     and MmM: \"Mm M = \\<lfloor>((b, Ts, T, fm), D)\\<rfloor>\"\n    by(clarsimp simp:Method_def)\n  show ?thesis using sees_methods_compPD[OF Mm refl] MmM\n    by(fastforce simp: Method_def)\nqed\n(*>*)\n\n\nlemma [simp]: \"subcls1(compP f P) = subcls1 P\"\n(*<*)\nby(fastforce simp add: is_class_def compC_def intro:subcls1I order_antisym dest:subcls1D)\n(*>*)\n\n\nlemma compP_widen[simp]: \"(compP f P \\<turnstile> T \\<le> T') = (P \\<turnstile> T \\<le> T')\"\n(*<*)by(cases T')(simp_all add:widen_Class)(*>*)\n\n\nlemma [simp]: \"(compP f P \\<turnstile> Ts [\\<le>] Ts') = (P \\<turnstile> Ts [\\<le>] Ts')\"\n(*<*)\nproof(induct Ts)\n  case (Cons a Ts)\n  then show ?case by(cases Ts')(auto simp:fun_of_def)\nqed simp\n(*>*)\n\n\nlemma [simp]: \"is_type (compP f P) T = is_type P T\"\n(*<*)by(cases T) simp_all(*>*)\n\n\nlemma [simp]: \"(compP (f::staticb\\<Rightarrow>'a\\<Rightarrow>'b) P \\<turnstile> C has_fields FDTs) = (P \\<turnstile> C has_fields FDTs)\"\n(*<*)\n (is \"?A = ?B\")\nproof\n  { fix cP::\"'b prog\" assume \"cP \\<turnstile> C has_fields FDTs\"\n    hence \"cP = compP f P \\<Longrightarrow> P \\<turnstile> C has_fields FDTs\"\n    proof induct\n      case has_fields_Object\n      thus ?case by(fast intro:Fields.has_fields_Object dest:class_compPD)\n    next\n      case has_fields_rec\n      thus ?case by(fast intro:Fields.has_fields_rec dest:class_compPD)\n    qed\n  } note lem = this\n  assume ?A\n  with lem show ?B by blast\nnext\n  assume ?B\n  thus ?A\n  proof induct\n    case has_fields_Object\n    thus ?case by(fast intro:Fields.has_fields_Object class_compP)\n  next\n    case has_fields_rec\n    thus ?case by(fast intro:Fields.has_fields_rec class_compP)\n  qed\nqed\n(*>*)\n\n\nlemma fields_compP [simp]: \"fields (compP f P) C = fields P C\"\n(*<*)by(simp add:fields_def)(*>*)\n\nlemma ifields_compP [simp]: \"ifields (compP f P) C = ifields P C\"\n(*<*)by(simp add:ifields_def)(*>*)\n\nlemma blank_compP [simp]: \"blank (compP f P) C = blank P C\"\n(*<*)by(simp add:blank_def)(*>*)\n\nlemma isfields_compP [simp]: \"isfields (compP f P) C = isfields P C\"\n(*<*)by(simp add:isfields_def)(*>*)\n\nlemma sblank_compP [simp]: \"sblank (compP f P) C = sblank P C\"\n(*<*)by(simp add:sblank_def)(*>*)\n\nlemma sees_fields_compP [simp]: \"(compP f P \\<turnstile> C sees F,b:T in D) = (P \\<turnstile> C sees F,b:T in D)\"\n(*<*)by(simp add:sees_field_def)(*>*)\n\nlemma has_field_compP [simp]: \"(compP f P \\<turnstile> C has F,b:T in D) = (P \\<turnstile> C has F,b:T in D)\"\n(*<*)by(simp add:has_field_def)(*>*)\n\nlemma field_compP [simp]: \"field (compP f P) F D = field P F D\"\n(*<*)by(simp add:field_def)(*>*)\n\n\nsubsection\\<open>Invariance of @{term wf_prog} under compilation \\<close>\n\n\n\n\nlemma [iff]: \"distinct_fst (map (compM f) ms) = distinct_fst ms\"\n(*<*)\nby (induct ms)\n   (auto simp:distinct_fst_def compM_def image_iff)\n(*>*)\n\n\nlemma [iff]: \"wf_syscls (compP f P) = wf_syscls P\"\n(*<*)by(simp add:wf_syscls_def compP_def compC_def image_def Bex_def)(*>*)\n\n\nlemma [iff]: \"wf_fdecl (compP f P) = wf_fdecl P\"\n(*<*)by(simp add:wf_fdecl_def)(*>*)\n\n\nlemma wf_clinit_compM [iff]: \"wf_clinit (map (compM f) ms) = wf_clinit ms\"\n(*<*)\nproof(rule iffI)\n  assume \"wf_clinit (map (compM f) ms)\"\n  then obtain m where \"(clinit, Static, [], Void, m) \\<in> set ms\"\n    by(clarsimp simp: wf_clinit_def compM_def)\n  then show \"wf_clinit ms\" by(fastforce simp: wf_clinit_def)\nnext\n  assume \"wf_clinit ms\"\n  then obtain m where \"(clinit, Static, [], Void, m) \\<in> set ms\"\n    by(clarsimp simp: wf_clinit_def compM_def)\n  then have \"\\<exists>m. (clinit, Static, [], Void, m)\n        \\<in> (\\<lambda>x. case x of (M, b, Ts, T, m) \\<Rightarrow> (M, b, Ts, T, f b m)) ` set ms\"\n    by(rule_tac x = \"f Static m\" in exI) (simp add: rev_image_eqI)\n  then show \"wf_clinit (map (compM f) ms)\"\n    by(simp add: wf_clinit_def compM_def)\nqed\n(*>*)\n\nlemma set_compP:\n \"((C,D,fs,ms') \\<in> set(compP f P)) =\n  (\\<exists>ms. (C,D,fs,ms) \\<in> set P \\<and> ms' = map (compM f) ms)\"\n(*<*)by(fastforce simp add:compP_def compC_def image_iff Bex_def)(*>*)\n\nlemma wf_cdecl_compPI:\n  \"\\<lbrakk> \\<And>C M b Ts T m. \n     \\<lbrakk> wf_mdecl wf\\<^sub>1 P C (M,b,Ts,T,m); P \\<turnstile> C sees M,b:Ts\\<rightarrow>T = m in C \\<rbrakk>\n     \\<Longrightarrow> wf_mdecl wf\\<^sub>2 (compP f P) C (M,b,Ts,T, f b m);\n    \\<forall>x\\<in>set P. wf_cdecl wf\\<^sub>1 P x; x \\<in> set (compP f P); wf_prog p P \\<rbrakk>\n  \\<Longrightarrow> wf_cdecl wf\\<^sub>2 (compP f P) x\"\n(*<*)\nproof -\n  assume\n   wfm: \"\\<And>C M b Ts T m. \\<lbrakk> wf_mdecl wf\\<^sub>1 P C (M,b,Ts,T,m); P \\<turnstile> C sees M,b:Ts\\<rightarrow>T = m in C \\<rbrakk>\n     \\<Longrightarrow> wf_mdecl wf\\<^sub>2 (compP f P) C (M,b,Ts,T, f b m)\"\n    and wfc: \"\\<forall>x\\<in>set P. wf_cdecl wf\\<^sub>1 P x\"\n    and compP: \"x \\<in> set (compP f P)\" and wf: \"wf_prog p P\"\n  obtain C D fs ms where x: \"x = (C, D, fs, map (compM f) ms)\"\n    and x_set: \"(C, D, fs, ms) \\<in> set P\"\n   using compP by(case_tac x) (clarsimp simp: set_compP)\n  have wfc': \"wf_cdecl wf\\<^sub>1 P (C, D, fs, ms)\" using wfc x_set by fast\n  let ?P = \"compP f P\" and ?ms = \"compM f ` set ms\"\n  { fix M b Ts T m\n    assume M: \"(M,b,Ts,T,m) \\<in> set ms\"\n    then have \"wf_mdecl wf\\<^sub>1 P C (M, b, Ts, T, m)\" using wfc'\n      by(simp add:wf_cdecl_def)\n    moreover have cM: \"P \\<turnstile> C sees M, b :  Ts\\<rightarrow>T = m in C\" using M\n      by(rule mdecl_visible[OF wf x_set])\n    ultimately have \"wf_mdecl wf\\<^sub>2 (compP f P) C (M, b, Ts, T, f b m)\"\n      by(rule wfm)\n  }\n  then have \"\\<forall>m \\<in> ?ms. wf_mdecl wf\\<^sub>2 ?P C m\"\n    by (clarsimp simp:compM_def)\n  moreover have \"C \\<noteq> Object \\<longrightarrow>\n   (\\<forall>(M,b,Ts,T,m)\\<in>?ms.\n      \\<forall>D' b' Ts' T' m'. ?P \\<turnstile> D sees M,b':Ts' \\<rightarrow> T' = m' in D' \\<longrightarrow>\n                       b = b' \\<and> P \\<turnstile> Ts' [\\<le>] Ts \\<and> P \\<turnstile> T \\<le> T')\"\n  proof -\n    { fix M b Ts T m D' b' Ts' T' m'\n      assume \"C \\<noteq> Object\" and \"(M,b,Ts,T,m)\\<in>?ms\"\n        and dM: \"?P \\<turnstile> D sees M,b':Ts' \\<rightarrow> T' = m' in D'\"\n      then have \"b = b' \\<and> P \\<turnstile> Ts' [\\<le>] Ts \\<and> P \\<turnstile> T \\<le> T'\"\n       using wfc' sees_method_compPD[OF dM]\n        by(fastforce simp:wf_cdecl_def image_iff compM_def)\n    }\n    then show ?thesis by fast\n  qed\n  moreover have \"(\\<forall>f\\<in>set fs. wf_fdecl P f) \\<and> distinct_fst fs\n     \\<and> distinct_fst ms \\<and> wf_clinit ms\n     \\<and> (C \\<noteq> Object \\<longrightarrow> is_class P D \\<and> \\<not> P \\<turnstile> D \\<preceq>\\<^sup>* C)\" using wfc'\n    by(simp add: wf_cdecl_def)\n  ultimately show ?thesis using x by(simp add:wf_cdecl_def)\nqed\n(*>*)\n\n\nlemma wf_prog_compPI:\nassumes lift: \n  \"\\<And>C M b Ts T m. \n    \\<lbrakk> P \\<turnstile> C sees M,b:Ts\\<rightarrow>T = m in C; wf_mdecl wf\\<^sub>1 P C (M,b,Ts,T,m) \\<rbrakk>\n    \\<Longrightarrow> wf_mdecl wf\\<^sub>2 (compP f P) C (M,b,Ts,T, f b m)\"\nand wf: \"wf_prog wf\\<^sub>1 P\"\nshows \"wf_prog wf\\<^sub>2 (compP f P)\"\n(*<*)\nusing wf\nby (simp add:wf_prog_def) (blast intro:wf_cdecl_compPI lift wf)\n(*>*)\n\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/JinjaDCI/Compiler/PCompiler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3079029354849906}}
{"text": "theory TTreeImplCardinalitySafe\nimports TTreeImplCardinality TTreeAnalysisSpec CardinalityAnalysisSpec\nbegin\n\nhide_const Multiset.single\n\nlemma pathsCard_paths_nxt:  \"pathsCard (paths (nxt f x)) \\<sqsubseteq> record_call x\\<cdot>(pathsCard (paths f))\"\n  apply transfer\n  apply (rule pathsCard_below)\n  apply auto\n  apply (erule below_trans[OF _ monofun_cfun_arg[OF paths_Card_above], rotated]) back\n  apply (auto intro: fun_belowI simp add: record_call_simp two_pred_two_add_once)\n  done\n\nlemma pathsCards_none: \"pathsCard (paths t) x = none \\<Longrightarrow> x \\<notin> carrier t\"\n  by transfer (auto dest: pathCards_noneD)\n\nlemma const_on_edom_disj: \"const_on f S empty \\<longleftrightarrow> edom f \\<inter> S = {}\"\n  by (auto simp add: empty_is_bottom edom_def)\n\ncontext TTreeAnalysisCarrier\nbegin\n  lemma carrier_Fstack: \"carrier (Fstack as S) \\<subseteq> fv S\"\n    by (induction S rule: Fstack.induct)\n       (auto simp add: empty_is_bottom[symmetric] carrier_Fexp dest!: set_mp[OF Aexp_edom])\n\n  lemma carrier_FBinds: \"carrier ((FBinds \\<Gamma>\\<cdot>ae) x) \\<subseteq> fv \\<Gamma>\"\n  apply (simp add: Texp.AnalBinds_lookup)\n  apply (auto split: option.split simp add: empty_is_bottom[symmetric] )\n  apply (case_tac \"ae x\")\n  apply (auto simp add: empty_is_bottom[symmetric] carrier_Fexp dest!: set_mp[OF Aexp_edom])\n  by (metis (poly_guards_query) contra_subsetD domA_from_set map_of_fv_subset map_of_SomeD option.sel)\nend\n\ncontext TTreeAnalysisSafe\nbegin\n\n  sublocale CardinalityPrognosisShape prognosis\n  proof\n    fix \\<Gamma> :: heap and ae ae' :: AEnv and u e S as\n    assume \"ae f|` domA \\<Gamma> = ae' f|` domA \\<Gamma>\"\n    from Texp.AnalBinds_cong[OF this]\n    show \"prognosis ae as u (\\<Gamma>, e, S) = prognosis ae' as u (\\<Gamma>, e, S)\" by simp\n  next\n    fix ae as a \\<Gamma> e S\n    show \"const_on (prognosis ae as a (\\<Gamma>, e, S)) (ap S) many\"\n    proof\n      fix x\n      assume \"x \\<in> ap S\"\n      hence \"[x,x] \\<in> paths (Fstack as S)\"\n        by (induction S rule: Fstack.induct)\n           (auto 4 4 intro: set_mp[OF both_contains_arg1] set_mp[OF both_contains_arg2] paths_Cons_nxt)\n      hence \"[x,x] \\<in> paths (Texp e\\<cdot>a \\<otimes>\\<otimes> Fstack as S)\"\n        by (rule set_mp[OF both_contains_arg2])\n      hence \"[x,x] \\<in> paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (Texp e\\<cdot>a \\<otimes>\\<otimes> Fstack as S))\" \n        by (rule set_mp[OF substitute_contains_arg])\n      hence \"pathCard [x,x] x \\<sqsubseteq> pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (Texp e\\<cdot>a \\<otimes>\\<otimes> Fstack as S))) x\"\n        by (metis fun_belowD paths_Card_above)\n      also have \"pathCard [x,x] x = many\"  by (auto simp add: pathCard_def)\n      finally\n      show \"prognosis ae as a (\\<Gamma>, e, S) x = many\"\n        by (auto intro: below_antisym)\n    qed\n  next\n    fix \\<Gamma> \\<Delta> :: heap and e :: exp and ae :: AEnv and as u S\n    assume \"map_of \\<Gamma> = map_of \\<Delta>\"\n    hence \"FBinds \\<Gamma> = FBinds \\<Delta>\" and \"thunks \\<Gamma> = thunks \\<Delta>\" by (auto intro!: cfun_eqI  thunks_cong simp add: Texp.AnalBinds_lookup)\n    thus \"prognosis ae as u (\\<Gamma>, e, S) = prognosis ae as u (\\<Delta>, e, S)\"  by simp\n  next\n    fix \\<Gamma> :: heap and e :: exp and ae :: AEnv and as u S x\n    show \"prognosis ae as u (\\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as u (\\<Gamma>, e, Upd x # S)\" by simp\n  next\n  fix \\<Gamma> :: heap and e :: exp and ae :: AEnv and as a S x\n  assume \"ae x = \\<bottom>\"\n\n  hence \"FBinds (delete x \\<Gamma>)\\<cdot>ae = FBinds \\<Gamma>\\<cdot>ae\" by (rule Texp.AnalBinds_delete_bot)\n  moreover\n  hence \"((FBinds \\<Gamma>\\<cdot>ae) x) = \\<bottom>\" by (metis Texp.AnalBinds_delete_lookup)\n  ultimately\n  show \"prognosis ae as a (\\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as a (delete x \\<Gamma>, e, S)\"\n    by (simp add: substitute_T_delete empty_is_bottom)\n  next\n    fix ae as a \\<Gamma> x S\n    have \"once \\<sqsubseteq> (pathCard [x]) x\" by (simp add: two_add_simp)\n    also have \"pathCard [x] \\<sqsubseteq> pathsCard ({[],[x]})\"\n      by (rule paths_Card_above) simp\n    also have \"\\<dots> = pathsCard (paths (single x))\" by simp\n    also have \"single x \\<sqsubseteq> (Texp (Var x)\\<cdot>a)\" by (rule Texp_Var)\n    also have \"\\<dots> \\<sqsubseteq> Texp (Var x)\\<cdot>a \\<otimes>\\<otimes> Fstack as S\" by (rule both_above_arg1)\n    also have \"\\<dots> \\<sqsubseteq> substitute  (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (Texp (Var x)\\<cdot>a \\<otimes>\\<otimes> Fstack as S)\" by (rule substitute_above_arg)\n    also have \"pathsCard (paths \\<dots>) x = prognosis ae as a (\\<Gamma>, Var x, S) x\" by simp\n    finally\n    show \"once \\<sqsubseteq> prognosis ae as a (\\<Gamma>, Var x, S) x\"\n      by this (rule cont2cont_fun, intro cont2cont)+\n  qed\n\n  sublocale CardinalityPrognosisApp prognosis\n  proof\n    fix ae as a \\<Gamma> e x S\n    have \"Texp e\\<cdot>(inc\\<cdot>a)  \\<otimes>\\<otimes> many_calls x \\<otimes>\\<otimes> Fstack as S = many_calls x  \\<otimes>\\<otimes> (Texp e)\\<cdot>(inc\\<cdot>a) \\<otimes>\\<otimes> Fstack as S\"\n      by (metis both_assoc both_comm)\n    thus \"prognosis ae as (inc\\<cdot>a) (\\<Gamma>, e, Arg x # S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, App e x, S)\"\n      by simp (intro pathsCard_mono' paths_mono substitute_mono2' both_mono1' Texp_App)\n  qed\n\n  sublocale CardinalityPrognosisLam prognosis\n  proof\n    fix ae as a \\<Gamma> e y x S\n    have \"Texp e[y::=x]\\<cdot>(pred\\<cdot>a) \\<sqsubseteq> many_calls x  \\<otimes>\\<otimes> Texp (Lam [y]. e)\\<cdot>a\"\n      by (rule below_trans[OF Texp_subst both_mono2'[OF Texp_Lam]])\n    moreover have \"Texp (Lam [y]. e)\\<cdot>a \\<otimes>\\<otimes> many_calls x \\<otimes>\\<otimes> Fstack as S = many_calls x  \\<otimes>\\<otimes> Texp (Lam [y]. e)\\<cdot>a \\<otimes>\\<otimes> Fstack as S\"\n      by (metis both_assoc both_comm)\n    ultimately  \n    show \"prognosis ae as (pred\\<cdot>a) (\\<Gamma>, e[y::=x], S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, Lam [y]. e, Arg x # S)\"\n      by simp (intro pathsCard_mono' paths_mono substitute_mono2' both_mono1')\n  qed\n\n  sublocale CardinalityPrognosisVar prognosis\n  proof\n    fix \\<Gamma> :: heap and e :: exp and x :: var and ae :: AEnv and as u a S\n    assume \"map_of \\<Gamma> x = Some e\"\n    assume \"ae x = up\\<cdot>u\"\n\n    assume \"isVal e\"\n    hence \"x \\<notin> thunks \\<Gamma>\" using `map_of \\<Gamma> x = Some e` by (metis thunksE)\n    hence [simp]: \"f_nxt (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) x = FBinds \\<Gamma>\\<cdot>ae\" by (auto simp add: f_nxt_def)\n\n    have \"prognosis ae as u (\\<Gamma>, e, S) = pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (Texp e\\<cdot>u \\<otimes>\\<otimes> Fstack as S)))\"\n      by simp\n    also have \"\\<dots> = pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (nxt (single x) x \\<otimes>\\<otimes> Texp e\\<cdot>u  \\<otimes>\\<otimes> Fstack as S)))\"\n      by simp\n    also have \"\\<dots> = pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) ((nxt (single x) x \\<otimes>\\<otimes> Fstack as S) \\<otimes>\\<otimes> Texp e\\<cdot>u )))\"\n      by (metis both_assoc both_comm)\n    also have \"\\<dots> \\<sqsubseteq> pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (nxt (single x \\<otimes>\\<otimes> Fstack as S) x \\<otimes>\\<otimes> Texp e\\<cdot>u)))\"\n      by (intro pathsCard_mono' paths_mono substitute_mono2' both_mono1'  nxt_both_left) simp\n    also have \"\\<dots> = pathsCard (paths (nxt (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (single x \\<otimes>\\<otimes> Fstack as S)) x))\"\n      using `map_of \\<Gamma> x = Some e` `ae x = up\\<cdot>u` by (simp add: Texp.AnalBinds_lookup)\n    also have \"\\<dots> \\<sqsubseteq> record_call x \\<cdot>(pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (single x \\<otimes>\\<otimes> Fstack as S))))\"\n      by (rule pathsCard_paths_nxt)\n    also have \"\\<dots> \\<sqsubseteq> record_call x \\<cdot>(pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) ((Texp (Var x)\\<cdot>a) \\<otimes>\\<otimes> Fstack as S))))\"\n      by (intro monofun_cfun_arg pathsCard_mono' paths_mono substitute_mono2' both_mono1' Texp_Var)\n    also have \"\\<dots> = record_call x \\<cdot>(prognosis ae as a (\\<Gamma>, Var x, S))\"\n      by simp\n    finally\n    show \"prognosis ae as u (\\<Gamma>, e, S) \\<sqsubseteq> record_call x\\<cdot>(prognosis ae as a (\\<Gamma>, Var x, S))\" by this simp_all\n  next\n    fix \\<Gamma> :: heap and e :: exp and x :: var and ae :: AEnv and as u a S\n    assume \"map_of \\<Gamma> x = Some e\"\n    assume \"ae x = up\\<cdot>u\"\n    assume \"\\<not> isVal e\"\n    hence \"x \\<in> thunks \\<Gamma>\" using `map_of \\<Gamma> x = Some e` by (metis thunksI)\n    hence [simp]: \"f_nxt (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) x = FBinds (delete x \\<Gamma>)\\<cdot>ae\" \n      by (auto simp add: f_nxt_def Texp.AnalBinds_delete_to_fun_upd empty_is_bottom)\n\n    have \"prognosis ae as u (delete x \\<Gamma>, e, Upd x # S) = pathsCard (paths (substitute (FBinds (delete x \\<Gamma>)\\<cdot>ae) (thunks (delete x \\<Gamma>)) (Texp e\\<cdot>u \\<otimes>\\<otimes> Fstack as S)))\"\n      by simp\n    also have \"\\<dots> = pathsCard (paths (substitute (FBinds (delete x \\<Gamma>)\\<cdot>ae) (thunks \\<Gamma>) (Texp e\\<cdot>u \\<otimes>\\<otimes> Fstack as S)))\"\n       by (rule arg_cong[OF substitute_cong_T]) (auto simp add: empty_is_bottom)\n    also have \"\\<dots> = pathsCard (paths (substitute (FBinds (delete x \\<Gamma>)\\<cdot>ae) (thunks \\<Gamma>) (nxt (single x) x \\<otimes>\\<otimes> Texp e\\<cdot>u  \\<otimes>\\<otimes> Fstack as S)))\"\n      by simp\n    also have \"\\<dots> = pathsCard (paths (substitute (FBinds (delete x \\<Gamma>)\\<cdot>ae) (thunks \\<Gamma>) ((nxt (single x) x \\<otimes>\\<otimes> Fstack as S) \\<otimes>\\<otimes> Texp e\\<cdot>u )))\"\n      by (metis both_assoc both_comm)\n    also have \"\\<dots> \\<sqsubseteq> pathsCard (paths (substitute (FBinds (delete x \\<Gamma>)\\<cdot>ae) (thunks \\<Gamma>) (nxt (single x \\<otimes>\\<otimes> Fstack as S) x  \\<otimes>\\<otimes> Texp e\\<cdot>u)))\"\n      by (intro pathsCard_mono' paths_mono substitute_mono2' both_mono1'  nxt_both_left) simp\n    also have \"\\<dots> = pathsCard (paths (nxt (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (single x \\<otimes>\\<otimes> Fstack as S)) x))\"\n      using `map_of \\<Gamma> x = Some e` `ae x = up\\<cdot>u` by (simp add: Texp.AnalBinds_lookup)\n    also have \"\\<dots> \\<sqsubseteq> record_call x \\<cdot>(pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (single x \\<otimes>\\<otimes> Fstack as S))))\"\n      by (rule pathsCard_paths_nxt)\n    also have \"\\<dots> \\<sqsubseteq> record_call x \\<cdot>(pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) ((Texp (Var x)\\<cdot>a) \\<otimes>\\<otimes> Fstack as S))))\"\n      by (intro monofun_cfun_arg pathsCard_mono' paths_mono substitute_mono2' both_mono1' Texp_Var)\n    also have \"\\<dots> = record_call x \\<cdot>(prognosis ae as a (\\<Gamma>, Var x, S))\"\n      by simp\n    finally\n    show \"prognosis ae as u (delete x \\<Gamma>, e, Upd x # S) \\<sqsubseteq> record_call x\\<cdot>(prognosis ae as a (\\<Gamma>, Var x, S))\" by this simp_all\n  next\n    fix \\<Gamma> :: heap and e :: exp and ae :: AEnv and  x :: var and as S\n    assume \"isVal e\"\n    hence \"repeatable (Texp e\\<cdot>0)\" by (rule Fun_repeatable)\n\n    assume [simp]: \"x \\<notin> domA \\<Gamma>\"\n\n    have [simp]: \"thunks ((x, e) # \\<Gamma>) = thunks \\<Gamma>\" \n      using `isVal e`\n      by (auto simp add: thunks_Cons dest: set_mp[OF thunks_domA])\n\n    have \"fup\\<cdot>(Texp e)\\<cdot>(ae x) \\<sqsubseteq> Texp e\\<cdot>0\" by (metis fup2 monofun_cfun_arg up_zero_top)\n    hence \"substitute ((FBinds \\<Gamma>\\<cdot>ae)(x := fup\\<cdot>(Texp e)\\<cdot>(ae x))) (thunks \\<Gamma>) (Texp e\\<cdot>0 \\<otimes>\\<otimes> Fstack as S) \\<sqsubseteq> substitute ((FBinds \\<Gamma>\\<cdot>ae)(x := Texp e\\<cdot>0)) (thunks \\<Gamma>) (Texp e\\<cdot>0 \\<otimes>\\<otimes> Fstack as S)\"\n      by (intro substitute_mono1' fun_upd_mono below_refl monofun_cfun_arg)\n    also have \"\\<dots> = substitute (((FBinds \\<Gamma>\\<cdot>ae)(x := Texp e\\<cdot>0))(x := empty)) (thunks \\<Gamma>) (Texp e\\<cdot>0 \\<otimes>\\<otimes> Fstack as S)\"\n      using `repeatable (Texp e\\<cdot>0)` by (rule substitute_remove_anyways, simp)\n    also have \"((FBinds \\<Gamma>\\<cdot>ae)(x := Texp e\\<cdot>0))(x := empty) = FBinds \\<Gamma>\\<cdot>ae\"\n      by (simp add: fun_upd_idem Texp.AnalBinds_not_there empty_is_bottom)\n    finally\n    show \"prognosis ae as 0 ((x, e) # \\<Gamma>, e, S) \\<sqsubseteq> prognosis ae as 0 (\\<Gamma>, e, Upd x # S)\"\n      by (simp, intro pathsCard_mono' paths_mono)\n  qed\n\n  sublocale CardinalityPrognosisIfThenElse prognosis\n  proof\n    fix ae as \\<Gamma> scrut e1 e2 S a\n    have \"Texp scrut\\<cdot>0 \\<otimes>\\<otimes> (Texp e1\\<cdot>a \\<oplus>\\<oplus> Texp e2\\<cdot>a) \\<sqsubseteq> Texp (scrut ? e1 : e2)\\<cdot>a\"\n      by (rule Texp_IfThenElse)\n    hence \"substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (Texp scrut\\<cdot>0 \\<otimes>\\<otimes> (Texp e1\\<cdot>a \\<oplus>\\<oplus> Texp e2\\<cdot>a) \\<otimes>\\<otimes> Fstack as S) \\<sqsubseteq> substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (Texp (scrut ? e1 : e2)\\<cdot>a \\<otimes>\\<otimes> Fstack as S)\"\n      by (rule substitute_mono2'[OF both_mono1'])\n    thus \"prognosis ae (a#as) 0 (\\<Gamma>, scrut, Alts e1 e2 # S) \\<sqsubseteq> prognosis ae as a (\\<Gamma>, scrut ? e1 : e2, S)\"\n      by (simp, intro pathsCard_mono' paths_mono)\n  next\n    fix ae as a \\<Gamma> b e1 e2 S\n    have \"Texp (if b then e1 else e2)\\<cdot>a \\<sqsubseteq> Texp e1\\<cdot>a \\<oplus>\\<oplus> Texp e2\\<cdot>a\"\n      by (auto simp add: either_above_arg1 either_above_arg2)\n    hence \"substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (Texp (if b then e1 else e2)\\<cdot>a \\<otimes>\\<otimes> Fstack as S) \\<sqsubseteq> substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (Texp (Bool b)\\<cdot>0 \\<otimes>\\<otimes> (Texp e1\\<cdot>a \\<oplus>\\<oplus> Texp e2\\<cdot>a) \\<otimes>\\<otimes> Fstack as S)\"\n      by (rule substitute_mono2'[OF both_mono1'[OF below_trans[OF _ both_above_arg2]]])\n    thus \"prognosis ae as a (\\<Gamma>, if b then e1 else e2, S) \\<sqsubseteq> prognosis ae (a#as) 0 (\\<Gamma>, Bool b, Alts e1 e2 # S)\"\n      by (auto intro!: pathsCard_mono' paths_mono)\n  qed\n\nend\n\ncontext TTreeAnalysisCardinalityHeap\nbegin\n\n  definition cHeap where\n    \"cHeap \\<Gamma> e = (\\<Lambda> a. pathsCard (paths (Theap \\<Gamma> e\\<cdot>a)))\"\n\n  lemma cHeap_simp: \"(cHeap \\<Gamma> e)\\<cdot>a = pathsCard (paths (Theap \\<Gamma> e\\<cdot>a))\"\n    unfolding cHeap_def  by (rule beta_cfun) (intro cont2cont)\n  \n  sublocale CardinalityHeap cHeap.\n \n  sublocale CardinalityHeapSafe cHeap Aheap\n  proof\n    fix x \\<Gamma> e a\n    assume \"x \\<in> thunks \\<Gamma>\"\n    moreover\n    assume \"many \\<sqsubseteq> (cHeap \\<Gamma> e\\<cdot>a) x\"\n    hence \"many \\<sqsubseteq> pathsCard (paths (Theap \\<Gamma> e \\<cdot>a)) x\" unfolding cHeap_def by simp\n    hence \"\\<exists>p\\<in> (paths (Theap \\<Gamma> e\\<cdot>a)). \\<not> (one_call_in_path x p)\" unfolding pathsCard_def\n      by (auto split: if_splits)\n    ultimately\n    show \"(Aheap \\<Gamma> e\\<cdot>a) x = up\\<cdot>0\"\n      by (metis Theap_thunk)\n  next\n    fix \\<Gamma> e a\n    show \"edom (cHeap \\<Gamma> e\\<cdot>a) = edom (Aheap \\<Gamma> e\\<cdot>a)\"\n    by (simp add: cHeap_def Union_paths_carrier carrier_Fheap)\n  qed\n\n  sublocale CardinalityPrognosisEdom prognosis \n  proof\n    fix ae as a \\<Gamma> e S\n    show \"edom (prognosis ae as a (\\<Gamma>, e, S)) \\<subseteq> fv \\<Gamma> \\<union> fv e \\<union> fv S\"\n      apply (simp add: Union_paths_carrier)\n      apply (rule carrier_substitute_below)\n      apply (auto simp add: carrier_Fexp dest: set_mp[OF Aexp_edom] set_mp[OF carrier_Fstack] set_mp[OF ap_fv_subset] set_mp[OF carrier_FBinds])\n      done\n  qed\n  \n  sublocale CardinalityPrognosisLet prognosis cHeap\n  proof\n    fix \\<Delta> \\<Gamma> :: heap and e :: exp and S :: stack and  ae :: AEnv and a :: Arity and as\n    assume \"atom ` domA \\<Delta> \\<sharp>* \\<Gamma>\"\n    assume \"atom ` domA \\<Delta> \\<sharp>* S\"\n    assume \"edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S\"\n\n    have \"domA \\<Delta> \\<inter> edom ae = {}\"\n      using fresh_distinct[OF `atom \\` domA \\<Delta> \\<sharp>* \\<Gamma>`] fresh_distinct_fv[OF `atom \\` domA \\<Delta> \\<sharp>* S`] \n            `edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S` ups_fv_subset[of S]\n      by auto\n\n    have const_on1:  \"\\<And> x. const_on (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (carrier ((FBinds \\<Gamma>\\<cdot>ae) x)) empty\"\n      unfolding const_on_edom_disj using fresh_distinct_fv[OF `atom \\` domA \\<Delta> \\<sharp>* \\<Gamma>`]\n      by (auto dest!: set_mp[OF carrier_FBinds] set_mp[OF Texp.edom_AnalBinds])\n    have const_on2:  \"const_on (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (carrier (Fstack as S)) empty\"\n      unfolding const_on_edom_disj using fresh_distinct_fv[OF `atom \\` domA \\<Delta> \\<sharp>* S`]\n      by (auto dest!: set_mp[OF carrier_FBinds] set_mp[OF carrier_Fstack] set_mp[OF Texp.edom_AnalBinds] set_mp[OF ap_fv_subset ])\n    have  const_on3: \"const_on (FBinds \\<Gamma>\\<cdot>ae) (- (- domA \\<Delta>)) TTree.empty\"\n      and const_on4: \"const_on (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (domA \\<Gamma>) TTree.empty\"\n      unfolding const_on_edom_disj using fresh_distinct[OF `atom \\` domA \\<Delta> \\<sharp>* \\<Gamma>`]\n      by (auto dest!:  set_mp[OF Texp.edom_AnalBinds])\n\n    have disj1: \"\\<And> x. carrier ((FBinds \\<Gamma>\\<cdot>ae) x) \\<inter> domA \\<Delta> = {}\"\n      using fresh_distinct_fv[OF `atom \\` domA \\<Delta> \\<sharp>* \\<Gamma>`]\n      by (auto dest: set_mp[OF carrier_FBinds])\n    hence disj1': \"\\<And> x. carrier ((FBinds \\<Gamma>\\<cdot>ae) x) \\<subseteq> - domA \\<Delta>\" by auto\n    have disj2: \"\\<And> x. carrier (Fstack as S) \\<inter> domA \\<Delta> = {}\"\n      using fresh_distinct_fv[OF `atom \\` domA \\<Delta> \\<sharp>* S`] by (auto dest!: set_mp[OF carrier_Fstack])\n    hence disj2': \"carrier (Fstack as S) \\<subseteq> - domA \\<Delta>\" by auto\n    \n\n    {\n    fix x\n    have \"(FBinds (\\<Delta> @ \\<Gamma>)\\<cdot>(ae \\<squnion> Aheap \\<Delta> e\\<cdot>a)) x = (FBinds \\<Gamma>\\<cdot>ae) x \\<otimes>\\<otimes> (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) x\"\n    proof (cases \"x \\<in> domA \\<Delta>\")\n      case True\n      have \"map_of \\<Gamma> x = None\" using True fresh_distinct[OF `atom \\` domA \\<Delta> \\<sharp>* \\<Gamma>`] by (metis disjoint_iff_not_equal domA_def map_of_eq_None_iff)\n      moreover\n      have \"ae x = \\<bottom>\" using True `domA \\<Delta> \\<inter> edom ae = {}` by auto\n      ultimately\n      show ?thesis using True \n          by (auto simp add: Texp.AnalBinds_lookup empty_is_bottom[symmetric] cong: option.case_cong)\n    next\n      case False\n      have \"map_of \\<Delta> x = None\" using False by (metis domA_def map_of_eq_None_iff)\n      moreover\n      have \"(Aheap \\<Delta> e\\<cdot>a) x = \\<bottom>\" using False using edom_Aheap by (metis contra_subsetD edomIff)\n      ultimately\n      show ?thesis using False\n         by (auto simp add: Texp.AnalBinds_lookup empty_is_bottom[symmetric] cong: option.case_cong)\n    qed\n    }\n    note FBinds = ext[OF this]\n    \n    {\n    have \"pathsCard (paths (substitute (FBinds (\\<Delta> @ \\<Gamma>)\\<cdot>(Aheap \\<Delta> e\\<cdot>a \\<squnion> ae)) (thunks (\\<Delta> @ \\<Gamma>)) (Texp e\\<cdot>a \\<otimes>\\<otimes> Fstack as S)))\n      = pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks (\\<Delta> @ \\<Gamma>)) (substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a))  (thunks (\\<Delta> @ \\<Gamma>))  (Texp e\\<cdot>a \\<otimes>\\<otimes> Fstack as S))))\"\n       by (simp add: substitute_substitute[OF const_on1] FBinds)\n    also have \"substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks (\\<Delta> @ \\<Gamma>)) = substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>)\"\n      apply (rule substitute_cong_T)\n      using const_on3\n      by (auto dest: set_mp[OF thunks_domA])\n    also have \"substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks (\\<Delta> @ \\<Gamma>)) = substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>)\"\n      apply (rule substitute_cong_T)\n      using const_on4\n      by (auto dest: set_mp[OF thunks_domA])\n    also have \"substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a \\<otimes>\\<otimes> Fstack as S) = substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a) \\<otimes>\\<otimes> Fstack as S\"\n      by (rule substitute_only_empty_both[OF const_on2])\n    also note calculation\n    }\n    note eq_imp_below[OF this]\n    also\n    note env_restr_split[where S = \"domA \\<Delta>\"]\n    also\n    have \"pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a) \\<otimes>\\<otimes> Fstack as S))) f|` domA \\<Delta> \n        = pathsCard (paths (ttree_restr (domA \\<Delta>) (substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a))))\"\n          by (simp add: filter_paths_conv_free_restr ttree_restr_both ttree_rest_substitute[OF disj1]  ttree_restr_is_empty[OF disj2])\n    also\n    have \"ttree_restr (domA \\<Delta>) (substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)) \\<sqsubseteq> Theap \\<Delta> e\\<cdot>a\"  by (rule Theap_substitute)\n    also\n    have \"pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a) \\<otimes>\\<otimes> Fstack as S))) f|` (- domA \\<Delta>) =\n          pathsCard (paths (substitute (FBinds \\<Gamma>\\<cdot>ae) (thunks \\<Gamma>) (ttree_restr (- domA \\<Delta>) (substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) (thunks \\<Delta>) (Texp e\\<cdot>a)) \\<otimes>\\<otimes> Fstack as S)))\"\n          by (simp add: filter_paths_conv_free_restr2 ttree_rest_substitute2[OF disj1' const_on3] ttree_restr_both  ttree_restr_noop[OF disj2'])\n    also have \"ttree_restr (- domA \\<Delta>) (substitute (FBinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a))  (thunks \\<Delta>)  (Texp e\\<cdot>a)) \\<sqsubseteq> Texp (Terms.Let \\<Delta> e)\\<cdot>a\" by (rule Texp_Let)\n    finally\n    show \"prognosis (Aheap \\<Delta> e\\<cdot>a \\<squnion> ae) as a (\\<Delta> @ \\<Gamma>, e, S) \\<sqsubseteq> cHeap \\<Delta> e\\<cdot>a \\<squnion> prognosis ae as a (\\<Gamma>, Terms.Let \\<Delta> e, S)\"\n      by (simp add: cHeap_def del: fun_meet_simp) \n  qed\n\n  sublocale CardinalityPrognosisSafe prognosis cHeap Aheap Aexp ..\nend\n\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/TTreeImplCardinalitySafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6791787121629466, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.30784579820768715}}
{"text": "(* Title:     Xml\n   Author:    Christian Sternagel\n   Author:    René Thiemann\n*)\n\nheader \\<open>A Sum Type with Bottom Element\\<close>\n\ntheory Strict_Sum\nimports\n  \"~~/src/HOL/Library/Monad_Syntax\"\n  Error_Syntax\n  \"../Partial_Function_MR/Partial_Function_MR\"\nbegin\n\ndatatype (dead 'e, 'a) sum_bot (infixr \"+\\<^sub>\\<bottom>\" 10) = Bottom | Left 'e | Right 'a for map: sum_bot_map\n\n\nsubsection \\<open>Setup for Partial Functions\\<close>\n\nabbreviation sum_bot_ord :: \"'e +\\<^sub>\\<bottom> 'a \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'a \\<Rightarrow> bool\"\nwhere\n  \"sum_bot_ord \\<equiv> flat_ord Bottom\"\n\ninterpretation sum_bot!:\n  partial_function_definitions sum_bot_ord \"flat_lub Bottom\"\n  by (rule flat_interpretation)\n\ndeclaration \\<open>\nPartial_Function.init\n  \"sum_bot\"\n  @{term sum_bot.fixp_fun}\n  @{term sum_bot.mono_body}\n  @{thm sum_bot.fixp_rule_uc}\n  @{thm sum_bot.fixp_induct_uc}\n  NONE\n\\<close>\n\n\nsubsection \\<open>Monad Setup\\<close>\n\nfun bind :: \"'e +\\<^sub>\\<bottom> 'a \\<Rightarrow> ('a \\<Rightarrow> ('e +\\<^sub>\\<bottom> 'b)) \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'b\"\nwhere\n  \"bind Bottom f = Bottom\" |\n  \"bind (Left e) f = Left e\" |\n  \"bind (Right x) f = f x\"\n\n\n\nabbreviation mono_sum_bot :: \"(('a \\<Rightarrow> ('e +\\<^sub>\\<bottom> 'b)) \\<Rightarrow> 'f +\\<^sub>\\<bottom> 'c) \\<Rightarrow> bool\"\nwhere\n  \"mono_sum_bot \\<equiv> monotone (fun_ord sum_bot_ord) sum_bot_ord\"\n\n(* TODO: perhaps use Partial_Function.bind_mono to proof this result immediately *)\nlemma bind_mono [partial_function_mono]:\n  assumes mf: \"mono_sum_bot B\" and mg: \"\\<And>y. mono_sum_bot (\\<lambda>f. C y f)\"\n  shows \"mono_sum_bot (\\<lambda>f. bind (B f) (\\<lambda>y. C y f))\"\nproof (rule monotoneI)\n  fix f g :: \"'a \\<Rightarrow> 'b +\\<^sub>\\<bottom> 'c\"\n  assume fg: \"fun_ord sum_bot_ord f g\"\n  with mf have \"sum_bot_ord (B f) (B g)\" by (rule monotoneD [of _ _ _ f g])\n  then have \"sum_bot_ord (bind (B f) (\\<lambda>y. C y f)) (bind (B g) (\\<lambda>y. C y f))\"\n    unfolding flat_ord_def by auto\n  also from mg have \"\\<And>y'. sum_bot_ord (C y' f) (C y' g)\"\n    by (rule monotoneD) (rule fg)\n  then have \"sum_bot_ord (bind (B g) (\\<lambda>y'. C y' f)) (bind (B g) (\\<lambda>y'. C y' g))\"\n    unfolding flat_ord_def by (cases \"B g\") auto\n  finally (sum_bot.leq_trans)\n  show \"sum_bot_ord (bind (B f) (\\<lambda>y. C y f)) (bind (B g) (\\<lambda>y'. C y' g))\" .\nqed\n\nadhoc_overloading\n  Monad_Syntax.bind bind\n\nhide_const (open) bind\n\nfun catch_error :: \"'e +\\<^sub>\\<bottom> 'a \\<Rightarrow> ('e \\<Rightarrow> ('f +\\<^sub>\\<bottom> 'a)) \\<Rightarrow> 'f +\\<^sub>\\<bottom> 'a\"\nwhere\n  \"catch_error Bottom f = Bottom \" |\n  \"catch_error (Left a) f = f a\" |\n  \"catch_error (Right a) f = Right a\"\n\nadhoc_overloading\n  Error_Syntax.catch catch_error\n\nlemma catch_mono [partial_function_mono]:\n  assumes mf: \"mono_sum_bot B\" and mg: \"\\<And>y. mono_sum_bot (\\<lambda>f. C y f)\"\n  shows \"mono_sum_bot (\\<lambda>f. try (B f) catch (\\<lambda>y. C y f))\"\nproof (rule monotoneI)\n  fix f g :: \"'a \\<Rightarrow> 'b +\\<^sub>\\<bottom> 'c\"\n  assume fg: \"fun_ord sum_bot_ord f g\"\n  with mf have \"sum_bot_ord (B f) (B g)\" by (rule monotoneD [of _ _ _ f g])\n  then have \"sum_bot_ord (try (B f) catch (\\<lambda>y. C y f)) (try (B g) catch (\\<lambda>y. C y f))\"\n    unfolding flat_ord_def by auto\n  also from mg\n  have \"\\<And>y'. sum_bot_ord (C y' f) (C y' g)\"\n    by (rule monotoneD) (rule fg)\n  then have \"sum_bot_ord (try (B g) catch (\\<lambda>y'. C y' f)) (try (B g) catch (\\<lambda>y'. C y' g))\"\n    unfolding flat_ord_def by (cases \"B g\") auto\n  finally (sum_bot.leq_trans)\n    show \"sum_bot_ord (try (B f) catch (\\<lambda>y. C y f)) (try (B g) catch (\\<lambda>y'. C y' g))\" .\nqed\n\ndefinition error :: \"'e \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'a\"\nwhere\n  [simp]: \"error x = Left x\"\n\ndefinition return :: \"'a \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'a\"\nwhere\n  [simp]: \"return x = Right x\"\n\nfun map_sum_bot :: \"('a \\<Rightarrow> ('e +\\<^sub>\\<bottom> 'b)) \\<Rightarrow> 'a list \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'b list\"\nwhere\n  \"map_sum_bot f [] = return []\" |\n  \"map_sum_bot f (x#xs) = do {\n    y \\<leftarrow> f x;\n    ys \\<leftarrow> map_sum_bot f xs;\n    return (y # ys)\n  }\"\n\nlemma map_sum_bot_cong [fundef_cong]:\n  assumes \"xs = ys\" and \"\\<And>x. x \\<in> set ys \\<Longrightarrow> f x = g x\"\n  shows \"map_sum_bot f xs = map_sum_bot g ys\"\n  unfolding assms(1) using assms(2) by (induct ys) auto\n\nlemmas sum_bot_const_mono =\n  sum_bot.const_mono [of \"fun_ord sum_bot_ord\"]\n\nlemma map_sum_bot_mono [partial_function_mono]:\n  fixes C :: \"'a \\<Rightarrow> ('b \\<Rightarrow> ('e +\\<^sub>\\<bottom> 'c)) \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'd\"\n  assumes \"\\<And>y. y \\<in> set B \\<Longrightarrow> mono_sum_bot (C y)\"\n  shows \"mono_sum_bot (\\<lambda>f. map_sum_bot (\\<lambda>y. C y f) B)\"\n  using assms by (induct B) (auto intro!: partial_function_mono)\n\nabbreviation update_error :: \"'e +\\<^sub>\\<bottom> 'a \\<Rightarrow> ('e \\<Rightarrow> 'f) \\<Rightarrow> 'f +\\<^sub>\\<bottom> 'a\"\nwhere\n  \"update_error r f \\<equiv> try r catch (\\<lambda> e. error (f e))\"\n\nadhoc_overloading\n  Error_Syntax.update_error update_error\n\nfun sumbot :: \"'e + 'a \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'a\"\nwhere\n  \"sumbot (Inl x) = Left x\" |\n  \"sumbot (Inr x) = Right x\"\n\ncode_datatype sumbot\n\n\n\nlemma [code]:\n  \"(try (sumbot a) catch f) = (case a of Inl b \\<Rightarrow> f b | Inr a \\<Rightarrow> sumbot (Inr a))\"\n  by (cases a) auto\n\nlemma [code]: \"Right x = sumbot (Inr x)\" by simp\n\nlemma [code]: \"Left x = sumbot (Inl x)\" by simp\n\nlemma [code]: \"return x = sumbot (Inr x)\" by simp\n\nlemma [code]: \"error x = sumbot (Inl x)\" by simp\n\nlemma [code]:\n  \"case_sum_bot f g h (sumbot p) = case_sum g h p\"\n  by (cases p) auto\n\n\nsubsection \\<open>Connection to @{theory Partial_Function_MR}\\<close>\n\nlemma sum_bot_map_mono [partial_function_mono]:\n  assumes mf: \"mono_sum_bot B\"\n  shows \"mono_sum_bot (\\<lambda>f. sum_bot_map h (B f))\"\nproof (rule monotoneI)\n  fix f g :: \"'a \\<Rightarrow> 'b +\\<^sub>\\<bottom> 'c\"\n  assume fg: \"fun_ord sum_bot_ord f g\"\n  with mf have \"sum_bot_ord (B f) (B g)\" by (rule monotoneD [of _ _ _ f g])\n  then show \"sum_bot_ord (sum_bot_map h (B f)) (sum_bot_map h (B g))\"\n    unfolding flat_ord_def by auto    \nqed\n\ndeclaration \\<open>\nPartial_Function_MR.init \n  \"sum_bot\" \n  (fn (mt, t_to_ss, mtT, msT, t_to_sTs) =>\n      list_comb (Const (@{const_name sum_bot_map}, t_to_sTs ---> mtT --> msT), t_to_ss) $ mt)\n  (fn (commonTs, argTs) => Type (@{type_name sum_bot}, commonTs @ argTs))\n  (fn mT => Term.dest_Type mT |> #2 |> (fn [err, res] => ([err], [res]))) \n  @{thms sum_bot.map_comp} \n  @{thms sum_bot.map_ident}\n\\<close>\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Certification_Monads/Strict_Sum.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635841117624, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.307811862050305}}
{"text": "(*  Title:      HOL/Auth/n_deadlock_lemma_inv__5_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\n(*header{*The n_deadlock Protocol Case Study*}*) \n\ntheory n_deadlock_lemma_inv__5_on_rules imports n_deadlock_lemma_on_inv__5\nbegin\nsection{*All lemmas on causal relation between inv__5*}\nlemma lemma_inv__5_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv3 p__Inv4. p__Inv3\\<le>N\\<and>p__Inv4\\<le>N\\<and>p__Inv3~=p__Inv4\\<and>f=inv__5  p__Inv3 p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Try  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_TryVsinv__5) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Crit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_CritVsinv__5) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Exit  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_ExitVsinv__5) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_Idle  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_IdleVsinv__5) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_deadlock/n_deadlock_lemma_inv__5_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.7154239957834733, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.30773773490095024}}
{"text": "theory Conntrack_State_Transform\nimports Common_Primitive_Matcher\n        \"../Semantics_Ternary/Semantics_Ternary\"\nbegin\n\n\ntext\\<open>The following function assumes that the packet is in a certain state.\\<close>\n\nfun ctstate_assume_state :: \"ctstate \\<Rightarrow> 'i::len  common_primitive match_expr \\<Rightarrow> 'i common_primitive match_expr\" where\n  \"ctstate_assume_state s (Match (CT_State x)) = (if s \\<in> x then MatchAny else MatchNot MatchAny)\" |\n  \"ctstate_assume_state s (Match m) = Match m\" |\n  \"ctstate_assume_state s (MatchNot m) = MatchNot (ctstate_assume_state s m)\" |\n  \"ctstate_assume_state _ MatchAny = MatchAny\" |\n  \"ctstate_assume_state s (MatchAnd m1 m2) = MatchAnd (ctstate_assume_state s m1) (ctstate_assume_state s m2)\"\n\nlemma ctstate_assume_state: \"p_tag_ctstate p = s \\<Longrightarrow>\n    matches (common_matcher, \\<alpha>) (ctstate_assume_state s m) a p \\<longleftrightarrow> matches (common_matcher, \\<alpha>) m a p\"\napply(rule matches_iff_apply_f)\nby(induction m rule: ctstate_assume_state.induct) (simp_all)\n\n\ndefinition ctstate_assume_new :: \"'i::len  common_primitive rule list \\<Rightarrow> 'i common_primitive rule list\" where\n  \"ctstate_assume_new \\<equiv> optimize_matches (ctstate_assume_state CT_New)\"\n\nlemma ctstate_assume_new_simple_ruleset: \"simple_ruleset rs \\<Longrightarrow> simple_ruleset (ctstate_assume_new rs)\"\n  by (simp add: ctstate_assume_new_def optimize_matches_simple_ruleset)\n\ntext\\<open>Usually, the interesting part of a firewall is only about the rules for setting up connections.\n      That means, we mostly only care about packets in state @{const CT_New}.\n      Use the function @{const ctstate_assume_new} to remove all state matching and just care about\n      the connection setup.\n\\<close>\ncorollary ctstate_assume_new: \"p_tag_ctstate p = CT_New \\<Longrightarrow> \n  approximating_bigstep_fun (common_matcher, \\<alpha>) p (ctstate_assume_new rs) s = approximating_bigstep_fun (common_matcher, \\<alpha>) p rs s\"\nunfolding ctstate_assume_new_def\napply(rule optimize_matches)\napply(simp add: ctstate_assume_state)\ndone\n\ntext\\<open>If we assume the CT State is @{const CT_New}, we can also assume that the TCP SYN flag (@{const ipt_tcp_syn}) is set.\\<close>\n\nfun ipt_tcp_flags_assume_flag :: \"ipt_tcp_flags \\<Rightarrow> 'i::len common_primitive match_expr \\<Rightarrow> 'i common_primitive match_expr\" where\n  \"ipt_tcp_flags_assume_flag flg (Match (L4_Flags x)) = (if ipt_tcp_flags_equal x flg then MatchAny else (case match_tcp_flags_conjunct_option x flg of None \\<Rightarrow> MatchNot MatchAny | Some f3 \\<Rightarrow> Match (L4_Flags f3)))\" |\n  \"ipt_tcp_flags_assume_flag flg (Match m) = Match m\" |\n  \"ipt_tcp_flags_assume_flag flg (MatchNot m) = MatchNot (ipt_tcp_flags_assume_flag flg m)\" |\n  \"ipt_tcp_flags_assume_flag _ MatchAny = MatchAny\" |\n  \"ipt_tcp_flags_assume_flag flg (MatchAnd m1 m2) = MatchAnd (ipt_tcp_flags_assume_flag flg m1) (ipt_tcp_flags_assume_flag flg m2)\"\n\nlemma ipt_tcp_flags_assume_flag: assumes \"match_tcp_flags flg (p_tcp_flags p)\"\n    shows \"matches (common_matcher, \\<alpha>) (ipt_tcp_flags_assume_flag flg m) a p \\<longleftrightarrow> matches (common_matcher, \\<alpha>) m a p\"\nproof(rule matches_iff_apply_f)\nshow \"ternary_ternary_eval (map_match_tac common_matcher p (ipt_tcp_flags_assume_flag flg m)) = ternary_ternary_eval (map_match_tac common_matcher p m)\"\n  using assms proof(induction m rule: ipt_tcp_flags_assume_flag.induct)\n  case (1 flg x)\n    thus ?case\n    apply(simp add: ipt_tcp_flags_equal del: match_tcp_flags.simps)\n    apply(cases \"match_tcp_flags_conjunct_option x flg\")\n     apply(simp)\n     using match_tcp_flags_conjunct_option_None bool_to_ternary_simps(2) apply metis\n    apply(simp)\n    apply(drule_tac pkt=\"(p_tcp_flags p)\" in match_tcp_flags_conjunct_option_Some)\n    by simp\n  qed(simp_all del: match_tcp_flags.simps)\nqed\n\ndefinition ipt_tcp_flags_assume_syn :: \"'i::len common_primitive rule list \\<Rightarrow> 'i common_primitive rule list\" where\n  \"ipt_tcp_flags_assume_syn \\<equiv> optimize_matches (ipt_tcp_flags_assume_flag ipt_tcp_syn)\"\n\nlemma ipt_tcp_flags_assume_syn_simple_ruleset: \"simple_ruleset rs \\<Longrightarrow> simple_ruleset (ipt_tcp_flags_assume_syn rs)\"\n  by (simp add: ipt_tcp_flags_assume_syn_def optimize_matches_simple_ruleset)\n\ncorollary ipt_tcp_flags_assume_syn: \"match_tcp_flags ipt_tcp_syn (p_tcp_flags p) \\<Longrightarrow>\n  approximating_bigstep_fun (common_matcher, \\<alpha>) p (ipt_tcp_flags_assume_syn rs) s = approximating_bigstep_fun (common_matcher, \\<alpha>) p rs s\"\nunfolding ipt_tcp_flags_assume_syn_def\napply(rule optimize_matches)\napply(simp add: ipt_tcp_flags_assume_flag)\ndone\n\n\n\n\n\ndefinition packet_assume_new :: \"'i::len common_primitive rule list \\<Rightarrow> 'i common_primitive rule list\" where\n  \"packet_assume_new \\<equiv> ctstate_assume_new \\<circ> ipt_tcp_flags_assume_syn\"\n\nlemma packet_assume_new_simple_ruleset: \"simple_ruleset rs \\<Longrightarrow> simple_ruleset (packet_assume_new rs)\"\n  by (simp add: packet_assume_new_def ipt_tcp_flags_assume_syn_simple_ruleset ctstate_assume_new_simple_ruleset)\n\ncorollary packet_assume_new: \"match_tcp_flags ipt_tcp_syn (p_tcp_flags p) \\<Longrightarrow> p_tag_ctstate p = CT_New \\<Longrightarrow> \n  approximating_bigstep_fun (common_matcher, \\<alpha>) p (packet_assume_new rs) s = approximating_bigstep_fun (common_matcher, \\<alpha>) p rs s\"\nunfolding packet_assume_new_def\nby (simp add: ctstate_assume_new ipt_tcp_flags_assume_syn)\n\n  \n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Iptables_Semantics/Primitive_Matchers/Conntrack_State_Transform.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.5, "lm_q1q2_score": 0.30754392775803324}}
{"text": "theory Affine_Arithmetic_Misc\n  imports \"HOL-ODE-Numerics.ODE_Numerics\"\nbegin\n\nsection \\<open>Branch-And-Bound Arithmetic\\<close>\n\nprimrec prove_nonneg::\"(nat * nat * string) list \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> slp \\<Rightarrow> real aform list list \\<Rightarrow> bool\" where\n  \"prove_nonneg prnt 0 p slp X = (let _ = if prnt \\<noteq> [] then print (STR ''# depth limit exceeded\\<newline>'') else () in False)\"\n| \"prove_nonneg prnt (Suc i) p slp XXS =\n    (case XXS of [] \\<Rightarrow> True | (X#XS) \\<Rightarrow>\n      let RS = approx_slp_outer p 1 slp X\n      in if RS\\<noteq>None \\<and> Inf_aform' p (hd (the RS)) \\<ge> 0\n        then\n          let _ = if prnt \\<noteq> [] then print (STR ''# Success\\<newline>'') else ();\n             _ = if prnt \\<noteq> [] then print (String.implode ((shows ''# '' o shows_box_of_aforms_hr X) ''\\<newline>'')) else ();\n             _ = fold (\\<lambda>(a, b, c) _. print (String.implode (shows_segments_of_aform a b X c ''\\<newline>''))) prnt ()\n          in prove_nonneg prnt i p slp XS\n        else let _ = if prnt \\<noteq> [] then print (STR ''# Split\\<newline>'') else () in case split_aforms_largest_uncond X of (a, b) \\<Rightarrow>\n          prove_nonneg prnt i p slp (a#b#XS))\"\n\nlemma prove_nonneg_simps[simp]:\n  \"prove_nonneg prnt 0 p slp X = False\"\n  \"prove_nonneg prnt (Suc i) p slp XXS =\n    (case XXS of [] \\<Rightarrow> True | (X#XS) \\<Rightarrow>\n      let RS = approx_slp_outer p 1 slp X\n      in if RS\\<noteq>None \\<and> Inf_aform' p (hd (the RS)) \\<ge> 0\n        then prove_nonneg prnt i p slp XS\n        else case split_aforms_largest_uncond X of (a, b) \\<Rightarrow> prove_nonneg prnt i p slp (a#b#XS))\"\n  by (auto simp: Let_def split: if_splits option.splits list.splits)\n\nlemmas [simp del] = prove_nonneg.simps\n\nlemma split_aforms_lemma:\n  fixes xs::\"real list\"\n  assumes \"split_aforms XS i = (YS, ZS)\"\n  assumes \"xs \\<in> Joints XS\"\n  shows \"xs \\<in> Joints YS \\<union> Joints ZS\"\n  using set_rev_mp[OF assms(2) Joints_map_split_aform[of XS i]] assms(1)\n  by (auto simp: split_aforms_def o_def)\n\nlemma prove_nonneg_empty[simp]: \"prove_nonneg prnt (Suc i) p slp []\"\n  by simp\n\nlemma prove_nonneg_fuel_mono:\n  \"prove_nonneg prnt (Suc i) p (slp_of_fas [fa]) YSS\"\n  if \"prove_nonneg prnt i p (slp_of_fas [fa]) YSS\"\n  using that\nproof (induction i arbitrary: YSS)\n  case 0\n  then show ?case by simp\nnext\n  case (Suc i)\n  from Suc.prems show ?case\n    supply [simp del] = prove_nonneg_simps\n    apply (subst prove_nonneg_simps)\n    apply (auto simp: Let_def split: if_splits option.splits list.splits)\n    subgoal apply (rule Suc.IH)\n      apply (subst (asm) prove_nonneg_simps)\n      by (auto simp: Let_def split: if_splits option.splits list.splits)\n    subgoal apply (rule Suc.IH)\n      apply (subst (asm) prove_nonneg.simps)\n      by (auto simp: Let_def split: if_splits option.splits list.splits)\n    subgoal apply (rule Suc.IH)\n      apply (subst (asm) prove_nonneg.simps)\n      by (auto simp: Let_def split: if_splits option.splits list.splits)\n    done\nqed\n\nlemma prove_nonneg_mono:\n  \"prove_nonneg prnt i p (slp_of_fas [fa]) YSS\" if \"prove_nonneg prnt i p (slp_of_fas [fa]) (YS # YSS)\"\n  using that\nproof (induction i arbitrary: YS YSS)\n  case 0\n  then show ?case by auto\nnext\n  case (Suc i)\n  from Suc.prems show ?case\n    supply [simp del] = prove_nonneg_simps\n    apply (subst (asm) prove_nonneg_simps)\n    apply (auto simp: Let_def split: if_splits option.splits list.splits)\n    subgoal by (rule prove_nonneg_fuel_mono)\n    subgoal for x y apply (rule prove_nonneg_fuel_mono)\n      apply (rule Suc.IH[of y])\n      by (rule Suc.IH[of x])\n    subgoal for x y apply (rule prove_nonneg_fuel_mono)\n      apply (rule Suc.IH[of y])\n      by (rule Suc.IH[of x])\n    done\nqed\n\nlemma prove_nonneg:\n  assumes \"prove_nonneg prnt i p (slp_of_fas [fa]) XSS\"\n  shows \"\\<forall>XS \\<in> set XSS. \\<forall>xs \\<in> Joints XS. interpret_floatarith fa xs \\<ge> 0\"\n  using assms\nproof (induction i arbitrary: XSS)\n  case 0\n  then show ?case\n    by (auto )\nnext\n  case (Suc i)\n  show ?case\n  proof (cases XSS)\n    case Nil then show ?thesis by auto\n  next\n    case (Cons YS YSS)\n    show ?thesis\n      unfolding Cons\n      apply auto\n      subgoal for xs using Suc.prems\n        apply (auto simp: Cons Let_def split: if_splits option.splits)\n        subgoal for ys\n          apply (drule approx_slp_outer_plain)\n             apply (rule refl)\n            apply force\n           apply assumption\n          apply simp\n          apply (frule Joints_imp_length_eq[where XS=ys])\n          apply (auto simp: Suc_length_conv)\n          by (smt Inf_aform'_Affine_le)\n        subgoal\n          apply (simp add: split_aforms_largest_uncond_def split: prod.splits)\n          apply (drule Suc.IH)\n          apply (drule split_aforms_lemma, assumption)\n          by auto\n        subgoal\n          apply (simp add: split_aforms_largest_uncond_def split: prod.splits)\n          apply (drule Suc.IH)\n          apply (drule split_aforms_lemma, assumption)\n          by auto\n        done\n      subgoal for XS xs using Suc.prems\n        apply (auto simp: Cons Let_def split: if_splits option.splits)\n        subgoal for ys by (rule Suc.IH[rule_format], assumption, assumption, assumption)\n        subgoal for ys\n          apply (drule prove_nonneg_mono)\n          apply (drule prove_nonneg_mono)\n          by (rule Suc.IH[rule_format], assumption, assumption, assumption)\n        subgoal for ys\n          apply (drule prove_nonneg_mono)\n          apply (drule prove_nonneg_mono)\n          by (rule Suc.IH[rule_format], assumption, assumption, assumption)\n        done\n      done\n  qed\nqed\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Poincare_Bendixson/Affine_Arithmetic_Misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878414043816, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3075439207021908}}
{"text": "section \"Execution Invariants (Part 2)\"\ntheory execution_invariants2\n  imports repliss_sem execution_invariants consistency commutativity \"fuzzyrule.fuzzyrule\"\nbegin\n\n\ntext \\<open>This theory includes more proofs for invariants that hold for all executions.\\<close>\n\n\n\nlemma wf_transaction_status_iff_origin_dom:\n  assumes wf: \"state_wellFormed S\"\n  shows \"dom (txOrigin S) = dom (txStatus S)\"\n  by (smt Collect_cong dom_def local.wf wf_transaction_status_iff_origin)\n\nlemma wf_generated_ids_invocation_exists:\n  assumes wf: \"state_wellFormed S\"\nand \"invocOp S i = None\"\nshows \"generatedIds S uid \\<noteq> Some i\"\n  using assms proof (induct rule: wellFormed_induct)\n  case initial\n  then show ?case by (simp add: initialState_def)\nnext\n  case (step t a s)\n  then show ?case by (auto simp add: initialState_def step.simps wf_localState_to_invocOp split: if_splits)\nqed\n\ntext \"Every query can be explained with the corresponding query specification.\n\n\"\n\n\nlemma wf_queryspec:\n  assumes wf: \"state_wellFormed S\"\n    and \"calls S c \\<triangleq> Call op r\"\n    and \"prevCalls = {c'. (c',c)\\<in>happensBefore S}\"\n    and \"ctxt = getContextH (calls S |` prevCalls) (happensBefore S |r prevCalls) (Some prevCalls)\"\n  shows \"querySpec (prog S) op ctxt r\"\n  using assms proof (induct rule: wellFormed_induct)\n  case initial\n  then show ?case \n    by (simp add: initialState_def)\nnext\n  case (step S1 a S2)\n  from ` S1 ~~ a \\<leadsto> S2`\n  show ?case\n  proof (cases rule: step.cases)\n    case (local i ls f ls')\n    then show ?thesis \n      using step by auto\n  next\n    case (newId i ls f ls' uid uidv ls'')\n    then show ?thesis using step by auto\n  next\n    case (beginAtomic i ls f ls' t vis snapshot)\n    then show ?thesis using step by auto\n  next\n    case (endAtomic i ls f ls' t)\n    then show ?thesis using step by auto\n  next\n    case (dbop i ls f Op ls' t c' res vis)\n    have [simp]: \"prog S2 = prog S1\"\n      using prog_inv step.hyps(3) by blast\n\n\n    show ?thesis \n    proof (cases \"c = c'\")\n      case True\n\n      have [simp]: \"(c', c) \\<notin> happensBefore S1\" for c\n        using local.dbop(7) step.hyps(1) wellFormed_happensBefore_calls_l by blast\n      have [simp]: \"(c, c') \\<notin> happensBefore S1\" for c\n        using local.dbop(7) step.hyps(1) wellFormed_happensBefore_calls_r by blast\n      have [simp]: \"c' \\<notin> vis\"\n        using local.dbop(7) local.dbop(9) step.hyps(1) wellFormed_visibleCallsSubsetCalls2 by blast\n\n\n      have \"ctxt = getContext S1 i\"\n        by (auto simp add: step dbop True getContextH_def operationContext_ext restrict_map_def\n            restrict_relation_def\n            intro!: ext\n            split: option.splits)\n\n\n      with `querySpec (prog S1) Op (getContext S1 i) res`\n      show ?thesis \n        using `calls S2 c \\<triangleq> Call op r`\n        by (simp add: dbop True)\n\n    next\n      case False\n      show ?thesis \n      proof (simp add: step, fuzzy_rule step.hyps; (simp add: step dbop False; fail)?)\n        show \"calls S1 c \\<triangleq> Call op r\"\n          using `calls S2 c \\<triangleq> Call op r`\n          by (simp add: dbop False)\n\n        have [simp]: \"c' \\<notin> prevCalls\"\n          using False `calls S1 c' = None` wellFormed_happensBefore_calls_l[OF `state_wellFormed S1`]\n          by (auto simp add: step dbop, blast)\n\n\n\n        have h1: \"(calls S2 |` prevCalls) = (calls S1 |` prevCalls)\"\n          by (auto simp add: restrict_map_def dbop False ) \n\n        have h2: \"happensBefore S2 |r prevCalls = happensBefore S1 |r prevCalls\"\n          by (auto simp add: restrict_relation_def dbop False) \n\n        show \"ctxt = getContextH (calls S1 |` prevCalls) (happensBefore S1 |r prevCalls) (Some prevCalls)\"\n          by (simp add: h1 h2 step.prems(3))\n      qed\n    qed\n\n  next\n    case (invocation i proc initialState impl)\n    then show ?thesis using step by auto\n  next\n    case (return i ls f res)\n    then show ?thesis using step by auto\n  next\n    case (crash i ls)\n    then show ?thesis using step by auto\n  next\n    case (invCheck res i)\n    then show ?thesis using step by auto\n  qed\n    \nqed\n\n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/execution_invariants2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.307508490360365}}
{"text": "theory ArityAnalysisAbinds\nimports ArityAnalysisSig\nbegin\n\ncontext ArityAnalysis\nbegin\n\nsubsubsection \\<open>Lifting arity analysis to recursive groups\\<close>\n\ndefinition ABind :: \"var \\<Rightarrow> exp \\<Rightarrow> (AEnv \\<rightarrow> AEnv)\"\n  where \"ABind v e = (\\<Lambda> ae. fup\\<cdot>(Aexp e)\\<cdot>(ae v))\"\n\nlemma ABind_eq[simp]: \"ABind v e \\<cdot> ae = \\<A>\\<^sup>\\<bottom>\\<^bsub>ae v\\<^esub> e\"\n  unfolding ABind_def by (simp add: cont_fun)\n\nfun ABinds :: \"heap \\<Rightarrow> (AEnv \\<rightarrow> AEnv)\"\n  where \"ABinds [] = \\<bottom>\"\n     |  \"ABinds ((v,e)#binds) = ABind v e \\<squnion> ABinds (delete v binds)\"\n\nlemma ABinds_strict[simp]: \"ABinds \\<Gamma>\\<cdot>\\<bottom>=\\<bottom>\"\n  by (induct \\<Gamma> rule: ABinds.induct) auto\n\nlemma Abinds_reorder1: \"map_of \\<Gamma> v = Some e \\<Longrightarrow> ABinds \\<Gamma> = ABind v e \\<squnion> ABinds (delete v \\<Gamma>)\"\n  by (induction \\<Gamma> rule: ABinds.induct) (auto simp add: delete_twist)\n\nlemma ABind_below_ABinds: \"map_of \\<Gamma> v = Some e \\<Longrightarrow> ABind v e \\<sqsubseteq> ABinds \\<Gamma>\"\n  by (metis \"HOLCF-Join-Classes.join_above1\" ArityAnalysis.Abinds_reorder1)\n\nlemma Abinds_reorder: \"map_of \\<Gamma> = map_of \\<Delta> \\<Longrightarrow> ABinds \\<Gamma> = ABinds \\<Delta>\"\nproof (induction  \\<Gamma> arbitrary: \\<Delta> rule: ABinds.induct)\n  case 1 thus ?case by simp\nnext\n  case (2 v e \\<Gamma> \\<Delta>)\n  from \\<open>map_of ((v, e) # \\<Gamma>) = map_of \\<Delta>\\<close>\n  have \"(map_of ((v, e) # \\<Gamma>))(v := None) = (map_of \\<Delta>)(v := None)\" by simp\n  hence \"map_of (delete v \\<Gamma>) = map_of (delete v \\<Delta>)\" unfolding delete_set_none by simp\n  hence \"ABinds (delete v \\<Gamma>) = ABinds (delete v \\<Delta>)\" by (rule 2)\n  moreover\n  from \\<open>map_of ((v, e) # \\<Gamma>) = map_of \\<Delta>\\<close>\n  have \"map_of \\<Delta> v = Some e\" by (metis map_of_Cons_code(2))\n  hence \"ABinds \\<Delta> = ABind v e \\<squnion> ABinds (delete v \\<Delta>)\" by (rule Abinds_reorder1)\n  ultimately\n  show ?case by auto\nqed\n\n(*\nlemma ABinds_above_arg: \"ae \\<sqsubseteq> ABinds \\<Gamma> \\<cdot> ae\"\nproof (induction rule:ABinds.induct)\n  show \"\\<bottom> \\<sqsubseteq> ABinds []\\<cdot>ae\" by auto\nnext\n  fix v e \\<Gamma>\n  assume assm: \"ae \\<sqsubseteq> ABinds (delete v \\<Gamma>)\\<cdot>ae\"\n  also have \"\\<dots> \\<sqsubseteq> ABinds ((v, e) # \\<Gamma>)\\<cdot>ae\"  by auto\n  finally show \"ae \\<sqsubseteq> ABinds ((v, e) # \\<Gamma>)\\<cdot>ae\" by this simp\nqed\n*)\n\nlemma Abinds_env_cong: \"(\\<And> x. x\\<in>domA \\<Delta> \\<Longrightarrow> ae x = ae' x)  \\<Longrightarrow>  ABinds \\<Delta>\\<cdot>ae = ABinds \\<Delta>\\<cdot>ae'\"\n  by (induct \\<Delta> rule: ABinds.induct) auto\n\nlemma Abinds_env_restr_cong: \" ae f|` domA \\<Delta> = ae' f|` domA \\<Delta> \\<Longrightarrow>  ABinds \\<Delta>\\<cdot>ae = ABinds \\<Delta>\\<cdot>ae'\"\n  by (rule Abinds_env_cong) (metis env_restr_eqD)\n\nlemma ABinds_env_restr[simp]: \"ABinds \\<Delta>\\<cdot>(ae f|` domA \\<Delta>) = ABinds \\<Delta>\\<cdot>ae\"\n  by (rule Abinds_env_restr_cong) simp\n\nlemma Abinds_join_fresh: \"ae' ` (domA \\<Delta>) \\<subseteq> {\\<bottom>} \\<Longrightarrow>  ABinds \\<Delta>\\<cdot>(ae \\<squnion> ae') = (ABinds \\<Delta>\\<cdot>ae)\"\n  by (rule Abinds_env_cong) auto\n\nlemma ABinds_delete_bot: \"ae x = \\<bottom> \\<Longrightarrow> ABinds (delete x \\<Gamma>)\\<cdot>ae = ABinds \\<Gamma>\\<cdot>ae\"\n  by (induction \\<Gamma> rule: ABinds.induct) (auto simp add: delete_twist)\n\nlemma ABinds_restr_fresh:\n  assumes \"atom ` S \\<sharp>* \\<Gamma>\"\n  shows \"ABinds \\<Gamma>\\<cdot>ae f|` (- S) = ABinds \\<Gamma>\\<cdot>(ae  f|` (- S)) f|` (- S)\"\n  using assms\n  apply (induction \\<Gamma> rule:ABinds.induct)\n  apply simp\n  apply (auto simp del: fun_meet_simp simp add: env_restr_join fresh_star_Pair fresh_star_Cons fresh_star_delete)\n  apply (subst lookup_env_restr)\n  apply (metis (no_types, hide_lams) ComplI fresh_at_base(2) fresh_star_def imageI)\n  apply simp\n  done\n\nlemma ABinds_restr:\n  assumes \"domA \\<Gamma> \\<subseteq> S\"\n  shows \"ABinds \\<Gamma>\\<cdot>ae f|` S = ABinds \\<Gamma>\\<cdot>(ae  f|` S) f|` S\"\n  using assms\n  by (induction \\<Gamma> rule:ABinds.induct) (fastforce simp del: fun_meet_simp simp add: env_restr_join)+\n\nlemma ABinds_restr_subst:\n  assumes \"\\<And> x' e a. (x',e) \\<in> set \\<Gamma> \\<Longrightarrow> Aexp e[x::=y]\\<cdot>a f|` S = Aexp e\\<cdot>a f|` S\"\n  assumes \"x \\<notin> S\"\n  assumes \"y \\<notin> S\"\n  assumes \"domA \\<Gamma> \\<subseteq> S\"\n  shows \"ABinds \\<Gamma>[x::h=y]\\<cdot>ae f|` S = ABinds \\<Gamma>\\<cdot>(ae  f|` S) f|` S\"\n  using assms\n  apply (induction \\<Gamma> rule:ABinds.induct)\n  apply (auto simp del: fun_meet_simp join_comm simp add: env_restr_join)\n  apply (rule arg_cong2[where f = join])\n  apply (case_tac \"ae v\")\n  apply (auto dest:  subsetD[OF set_delete_subset])\n  done\n\nlemma Abinds_append_disjoint: \"domA \\<Delta> \\<inter> domA \\<Gamma> = {} \\<Longrightarrow>  ABinds (\\<Delta> @ \\<Gamma>)\\<cdot>ae = ABinds \\<Delta>\\<cdot>ae \\<squnion> ABinds \\<Gamma>\\<cdot>ae\"\nproof (induct \\<Delta> rule: ABinds.induct)\n  case 1 thus ?case by simp\nnext\n  case (2 v e \\<Delta>)\n  from 2(2)\n  have \"v \\<notin> domA \\<Gamma>\" and  \"domA (delete v \\<Delta>) \\<inter> domA \\<Gamma> = {}\" by auto\n  from 2(1)[OF this(2)]\n  have \"ABinds (delete v \\<Delta> @ \\<Gamma>)\\<cdot>ae = ABinds (delete v \\<Delta>)\\<cdot>ae \\<squnion> ABinds \\<Gamma>\\<cdot>ae\".\n  moreover\n  have \"delete v \\<Gamma> = \\<Gamma>\" by (metis \\<open>v \\<notin> domA \\<Gamma>\\<close> delete_not_domA)\n  ultimately\n  show \" ABinds (((v, e) # \\<Delta>) @ \\<Gamma>)\\<cdot>ae = ABinds ((v, e) # \\<Delta>)\\<cdot>ae \\<squnion> ABinds \\<Gamma>\\<cdot>ae\"\n    by auto\nqed\n\nlemma ABinds_restr_subset: \"S \\<subseteq> S' \\<Longrightarrow> ABinds (restrictA S \\<Gamma>)\\<cdot>ae \\<sqsubseteq> ABinds (restrictA S' \\<Gamma>)\\<cdot>ae\"\n  by (induct \\<Gamma> rule: ABinds.induct)\n     (auto simp add: join_below_iff  restr_delete_twist intro: below_trans[OF _ join_above2])\n\nlemma ABinds_restrict_edom: \"ABinds (restrictA (edom ae) \\<Gamma>)\\<cdot>ae = ABinds \\<Gamma>\\<cdot>ae\"\n  by (induct \\<Gamma> rule: ABinds.induct) (auto simp add: edom_def restr_delete_twist)\n  \nlemma ABinds_restrict_below: \"ABinds (restrictA S \\<Gamma>)\\<cdot>ae \\<sqsubseteq> ABinds \\<Gamma>\\<cdot>ae\"\n  by (induct \\<Gamma> rule: ABinds.induct)\n     (auto simp add: join_below_iff  restr_delete_twist intro: below_trans[OF _ join_above2] simp del: fun_meet_simp join_comm)\n\nlemma ABinds_delete_below: \"ABinds (delete x \\<Gamma>)\\<cdot>ae \\<sqsubseteq> ABinds \\<Gamma>\\<cdot>ae\"\n  by (induct \\<Gamma> rule: ABinds.induct)\n     (auto simp add: join_below_iff   delete_twist[where x = x] elim: below_trans simp del: fun_meet_simp)\nend\n\nlemma ABind_eqvt[eqvt]: \"\\<pi> \\<bullet> (ArityAnalysis.ABind Aexp v e) = ArityAnalysis.ABind (\\<pi> \\<bullet> Aexp) (\\<pi> \\<bullet> v) (\\<pi> \\<bullet> e)\"\n  apply (rule cfun_eqvtI)\n  unfolding ArityAnalysis.ABind_eq\n  by perm_simp rule\n\nlemma ABinds_eqvt[eqvt]: \"\\<pi> \\<bullet> (ArityAnalysis.ABinds Aexp \\<Gamma>) = ArityAnalysis.ABinds (\\<pi> \\<bullet> Aexp) (\\<pi> \\<bullet> \\<Gamma>)\"\n  apply (rule cfun_eqvtI)\n  apply (induction \\<Gamma> rule: ArityAnalysis.ABinds.induct)\n  apply (simp add: ArityAnalysis.ABinds.simps)\n  apply (simp add: ArityAnalysis.ABinds.simps)\n  apply perm_simp\n  apply simp\n  done\n\nlemma Abinds_cong[fundef_cong]:\n  \"\\<lbrakk> (\\<And> e. e \\<in> snd ` set heap2 \\<Longrightarrow> aexp1 e = aexp2 e) ; heap1 = heap2 \\<rbrakk>\n      \\<Longrightarrow> ArityAnalysis.ABinds aexp1 heap1 = ArityAnalysis.ABinds aexp2 heap2\"    \nproof (induction heap1 arbitrary:heap2 rule:ArityAnalysis.ABinds.induct)\n  case 1\n  thus ?case by (auto simp add: ArityAnalysis.ABinds.simps)\nnext\n  case prems: (2 v e as heap2)\n  have \"snd ` set (delete v as) \\<subseteq> snd ` set as\" by (rule dom_delete_subset)\n  also have \"\\<dots> \\<subseteq> snd `set ((v, e) # as)\" by auto\n  also note prems(3)\n  finally\n  have \"(\\<And>e. e \\<in> snd ` set (delete v as) \\<Longrightarrow> aexp1 e = aexp2 e)\" by -(rule prems, auto)\n  from prems prems(1)[OF this refl] show ?case\n    by (auto simp add: ArityAnalysis.ABinds.simps ArityAnalysis.ABind_def)\nqed\n\ncontext EdomArityAnalysis\nbegin\n  lemma fup_Aexp_lookup_fresh: \"atom v \\<sharp> e \\<Longrightarrow> (fup\\<cdot>(Aexp e)\\<cdot>a) v = \\<bottom>\"\n    by (cases a) auto\n  \n  lemma edom_AnalBinds: \"edom (ABinds \\<Gamma>\\<cdot>ae) \\<subseteq> fv \\<Gamma>\"\n    by (induction \\<Gamma> rule: ABinds.induct)\n       (auto simp del: fun_meet_simp dest: subsetD[OF fup_Aexp_edom] dest: subsetD[OF fv_delete_subset])\nend \n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/ArityAnalysisAbinds.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5583269943353745, "lm_q1q2_score": 0.30741895545820963}}
{"text": "theory BPlusTree_ImpRange\nimports\n  BPlusTree_Iter\n  BPlusTree_Range\n  BPlusTree_ImpSplit\nbegin\n\nabbreviation \"blist_leafs_assn k \\<equiv> list_assn ((\\<lambda> t (ti,r',z',lptrs). bplustree_assn_leafs k t (the ti) r' z' lptrs) \\<times>\\<^sub>a id_assn)\"\n\ncontext split\\<^sub>i_tree\nbegin\n\nlemma list_induct5 [consumes 4, case_names Nil Cons]:\n  \"length xs = length ys \\<Longrightarrow> length ys = length zs \\<Longrightarrow> length zs = length ws \\<Longrightarrow> length ws = length vs \\<Longrightarrow>\n   P [] [] [] [] [] \\<Longrightarrow> (\\<And>x xs y ys z zs w ws v vs. length xs = length ys \\<Longrightarrow>\n   length ys = length zs \\<Longrightarrow> length zs = length ws \\<Longrightarrow> length ws = length vs \\<Longrightarrow> P xs ys zs ws vs \\<Longrightarrow>\n   P (x#xs) (y#ys) (z#zs) (w#ws) (v#vs)) \\<Longrightarrow> P xs ys zs ws vs\"\nproof (induct xs arbitrary: ys zs ws vs)\n  case Nil then show ?case by simp\nnext\n  case (Cons x xs ys zs ws) then show ?case by ((cases ys, simp_all), (cases zs,simp_all), (cases ws, simp_all)) (cases vs, simp_all)\nqed\n\ndeclare butlast.simps[simp del] last.simps[simp del]\nlemma blist_assn_extract_leafs: \"\nlength ts = length tsi \\<Longrightarrow>\nlength tsi = length rs \\<Longrightarrow>\nblist_assn k ts (zip (zip (map fst tsi) (zip (butlast (r#rs)) rs)) (map snd tsi))\n=\n(\\<exists>\\<^sub>Aspl. blist_leafs_assn k ts (zip (zip (map fst tsi) (zip (butlast (r#rs)) (zip rs spl))) (map snd tsi)) * \\<up>(length spl = length rs))\"\nproof(induction arbitrary: r rule: list_induct3)\n  case Nil\n  then show ?case\n    apply(intro ent_iffI)\n    by sep_auto+\nnext\n  case (Cons x xs y ys z zs r)\n  show ?case\n    using Cons.hyps\n    using Cons.hyps\n  apply (sep_auto simp add: butlast_double_Cons last_double_Cons)\n    supply R= Cons.IH[simplified, of z]\n    thm R\n    apply(subst R)\n  proof(intro ent_iffI, goal_cases)\n    case 1\n    then show ?case\n    apply(sep_auto eintros del: exI simp add: prod_assn_def bplustree_extract_leafs split!: prod.splits)\n      subgoal for _ _ spl lptrs\n      apply(inst_existentials \"lptrs#spl\")\n        apply auto\n        done\n      done\n  next\n    case 2\n    then show ?case\n    apply(sep_auto eintros del: exI)\n      subgoal for spl\n      apply(cases spl)\n        apply simp\n        subgoal for hdspl tlspl\n          apply(inst_existentials tlspl)\n          apply (auto simp add: prod_assn_def bplustree_extract_leafs split!: prod.splits)\n          done\n        done\n      done\n    qed\n  qed\ndeclare butlast.simps[simp add] last.simps[simp add]\n\nlemma blist_discard_leafs: \n  assumes \n\"length ts = length tsi\"\n\"length tsi = length rs\"\n\"length spl = length rs\"\nshows\n\"blist_leafs_assn k ts (zip (zip (map fst tsi) (zip (butlast (r#rs)) (zip rs spl))) (map snd tsi)) \\<Longrightarrow>\\<^sub>A\nblist_assn k ts (zip (zip (map fst tsi) (zip (butlast (r#rs)) rs)) (map snd tsi))\"\n  apply (subst blist_assn_extract_leafs[OF assms(1,2)])\n  using assms\n  by sep_auto\n\ndeclare butlast.simps[simp del] last.simps[simp del]\nlemma split\\<^sub>i_leafs_rule_help: \n\"sorted_less (separators ts) \\<Longrightarrow>\n  length tsi = length rs \\<Longrightarrow>\n  tsi' = (zip (zip (map fst tsi) (zip (butlast (r#rs)) (butlast (rs@[z]))))) (map snd tsi) \\<Longrightarrow>\n <is_pfa c tsi (a,n) \n  * blist_assn k ts tsi' > \n    split\\<^sub>i (a,n) p \n  <\\<lambda>i. \\<exists>\\<^sub>Aspl.\n    is_pfa c tsi (a,n)\n    * blist_leafs_assn k ts (zip (zip (map fst tsi) (zip (butlast (r#rs)) (zip (butlast (rs@[z])) spl))) (map snd tsi))\n    * \\<up>(split_relation ts (split ts p) i)\n    * \\<up>(length spl = length rs) >\\<^sub>t\" \nproof(rule hoare_triple_preI, goal_cases) \n  case 1\n  have ***: \"length tsi' = length rs\"\n    using 1 by auto\n  then have *: \"length ts = length tsi'\"\n    using 1 by (auto dest!: mod_starD list_assn_len)\n  then have **: \"length ts = length tsi\"\n    using 1 by (auto dest!: mod_starD list_assn_len)\n  note R = split\\<^sub>i_rule[of ts tsi rs \"zip (zip (subtrees tsi) (zip (butlast (r # rs)) rs)) (separators tsi)\" r]\n  from 1 show ?thesis\n    apply(vcg)\n    using ** 1(2)\n    apply(simp add: blist_assn_extract_leafs)\n    find_theorems ex_assn entails\n    apply(rule ent_ex_preI)\n    subgoal for x spl\n      apply(inst_ex_assn spl)\n      apply sep_auto\n      done\n    done\nqed\ndeclare butlast.simps[simp add] last.simps[simp add]\n\nlemma fr_refl_rot: \"P \\<Longrightarrow>\\<^sub>A R \\<Longrightarrow> F * P \\<Longrightarrow>\\<^sub>A F * R\"\n  using fr_refl[of P R F] by (simp add: mult.commute)\n\ndeclare butlast.simps[simp del] last.simps[simp del]\nlemma split\\<^sub>i_leafs_rule[sep_heap_rules]: \n  assumes \"sorted_less (separators ts)\"\n  and \"length tsi = length rs\"\n  and \"length spl = length rs\"\n  and \"tsi' = zip (zip (map fst tsi) (zip (butlast (r#rs)) (zip (butlast (rs@[z])) spl))) (map snd tsi)\"\n  shows \"\n <is_pfa c tsi (a,n) \n  * blist_leafs_assn k ts tsi' > \n    split\\<^sub>i (a,n) p \n  <\\<lambda>i. \\<exists>\\<^sub>Aspl.\n    is_pfa c tsi (a,n)\n    * blist_leafs_assn k ts (zip (zip (map fst tsi) (zip (butlast (r#rs)) (zip (butlast (rs@[z])) spl))) (map snd tsi))\n    * \\<up>(split_relation ts (split ts p) i)\n    * \\<up>(length spl = length rs) >\\<^sub>t\" \nproof(rule hoare_triple_preI, goal_cases) \n  case 1\n  have \"length tsi' = length rs\"\n    using assms by auto\n  then have *: \"length ts = length tsi'\"\n    using 1 by (auto dest!: mod_starD list_assn_len)\n  then have **: \"length ts = length tsi\"\n    using 1 assms by (auto dest!: mod_starD list_assn_len)\n  note R = split\\<^sub>i_leafs_rule_help[\n    OF assms(1,2),\n    of \"zip (zip (subtrees tsi) (zip (butlast (r # rs)) (butlast (rs @ [z])))) (separators tsi)\" r\n        z c a n k\n  ]\n  thm R\n  note R' = fi_rule[OF R, of \"is_pfa c tsi (a,n) * blist_leafs_assn k ts tsi'\" \"emp\"]\n  thm R'\n  show ?case\n    apply(vcg heap add: R')\n    subgoal\n      apply (simp add: assms)\n      apply(rule fr_refl_rot)\n      using blist_discard_leafs[OF ** assms(2,3)]\n      apply auto\n      done\n    subgoal by sep_auto\n    done\nqed\n\nend\n\n(* Adding an actual range iterator based on the normal iterator\nis trivial (just forward until we reach the first element \\<ge> and stop\nas soon as we have an element <)\nWe now try to implement a search for the first element of the range efficiently\n *)\nsubsection \"The imperative split locale\"\n\n\nlocale split\\<^sub>i_range = abs_split_range: split_range split lrange_list + split\\<^sub>i_tree split split\\<^sub>i\n  for split::\n    \"('a bplustree \\<times> 'a::{heap,default,linorder,order_top}) list \\<Rightarrow> 'a\n       \\<Rightarrow> ('a bplustree \\<times> 'a) list \\<times> ('a bplustree \\<times> 'a) list\" \n    and lrange_list ::  \"'a \\<Rightarrow> ('a::{heap,default,linorder,order_top}) list \\<Rightarrow> 'a list\"\n    and split\\<^sub>i :: \"('a btnode ref option \\<times> 'a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> 'a \\<Rightarrow> nat Heap\" +\n  fixes lrange_list\\<^sub>i:: \"'a \\<Rightarrow> ('a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> 'a pfa_it Heap\"\n  assumes lrange_list_rule [sep_heap_rules]:\"sorted_less ks \\<Longrightarrow>\n   <is_pfa c ks (a',n')> \n    lrange_list\\<^sub>i x (a',n') \n  <pfa_is_it c ks (a',n') (lrange_list x ks)>\\<^sub>t\"\nbegin\n\npartial_function (heap) leaf_nodes_lrange\\<^sub>i ::\n  \"'a btnode ref \\<Rightarrow> 'a \\<Rightarrow> 'a btnode ref option Heap\"\n  where\n    \"leaf_nodes_lrange\\<^sub>i p x = do {\n  node \\<leftarrow> !p;\n  (case node of\n     Btleaf xs z \\<Rightarrow> do {\n        return (Some p)\n      }\n       |\n     Btnode ts t \\<Rightarrow> do {\n       i \\<leftarrow> split\\<^sub>i ts x;\n       tsl \\<leftarrow> pfa_length ts;\n       if i < tsl then do {\n         s \\<leftarrow> pfa_get ts i;\n         let (sub,sep) = s in\n           leaf_nodes_lrange\\<^sub>i (the sub) x\n       } else\n           leaf_nodes_lrange\\<^sub>i t x\n    }\n)}\"\n\n\n(* HT when expressed on list of leaves \nlemma leaf_nodes_lrange\\<^sub>i_rule:\n  assumes \"k > 0\" \"root_order k t\"\n  shows \"<bplustree_assn_leafs k t ti r z lptrs>\nleaf_nodes_lrange\\<^sub>i ti x\n<\\<lambda>p. (\\<exists>\\<^sub>A xs1 xs2 lptrs1 lptrs2 ps.\n  trunk_assn k t ti r z lptrs *\n  leaf_nodes_assn k xs1 r p lptrs1 *\n  list_assn leaf_node xs2 (map bplustree.vals xs2) *\n  list_assn (is_pfa (2 * k)) (map bplustree.vals xs2) ps *\n  leafs_assn ps lptrs2 p z *\n  \\<up>(concat (map bplustree.vals xs2) = abs_split_range.leaf_nodes_lrange\\<^sub>i t x) *\n  \\<up>(lptrs = lptrs1@lptrs2) *\n  \\<up>(leaf_nodes t = xs1@xs2)\n)>\\<^sub>t\"\nsorry\n*)\n\nlemma leaf_nodes_assn_split2:\n\"length xs = length xsi \\<Longrightarrow>\n  leaf_nodes_assn k (xs @ ys) r z (xsi @ ysi) = (\\<exists>\\<^sub>Al. leaf_nodes_assn k xs r l xsi * leaf_nodes_assn k ys l z ysi)\"\nproof(induction arbitrary: r rule: list_induct2)\n  case (Nil r)\n  then show ?case\n    apply(cases r; cases ys)\n    apply clarsimp_all\n      subgoal\n        apply(rule ent_iffI)\n        by (sep_auto dest!: leaf_nodes_assn_impl_length)+\n      subgoal\n        apply(rule ent_iffI)\n        by (sep_auto dest!: leaf_nodes_assn_impl_length)+\n      subgoal\n        apply(rule ent_iffI)\n        by (sep_auto dest!: leaf_nodes_assn_impl_length)+\n    subgoal for _ t _\n      apply(cases t)\n      subgoal\n      apply clarsimp_all\n          apply(rule ent_iffI)\n          by (sep_auto dest!: leaf_nodes_assn_impl_length)+\n        subgoal by clarsimp\n        done\n    done\nnext\n  case (Cons x xs xi xsi r)\n  show ?case\n    apply(cases r; cases x)\n    apply clarsimp_all\n        apply(rule ent_iffI)\n    subgoal for _ ts\n      apply(subst Cons.IH)\n      apply simp\n      apply(rule ent_ex_preI)+\n      subgoal for tsi fwd l\n        apply(inst_ex_assn l tsi fwd)\n        apply sep_auto\n        done\n      done\n    subgoal for _ ts\n      apply(subst Cons.IH)\n      apply(simp)\n      apply(rule ent_ex_preI)+\n      subgoal for l tsi fwd\n        apply(inst_ex_assn tsi fwd l)\n        apply sep_auto\n      done\n    done\n  done\nqed\n\nlemma eq_preI: \"(\\<forall>h. h \\<Turnstile> P \\<longrightarrow> Q = Q') \\<Longrightarrow> P * Q = P * Q'\"\n  apply(intro ent_iffI)\n  using entails_def mod_starD apply blast+\n  done\n\nlemma simp_map_temp: \"(map (leaf_nodes \\<circ> fst)) = map (\\<lambda>a. (leaf_nodes (fst a)))\"\n  by (meson comp_apply)\n\n\ndeclare last.simps[simp del] butlast.simps[simp del]\nlemma blist_leafs_assn_split_help:\n\"   length tsi' = length rrs \\<Longrightarrow>\n    length rrs = length spl \\<Longrightarrow>\n    length spl = length ts \\<Longrightarrow>\n    (blist_leafs_assn k ts\n      (zip (zip (subtrees tsi') (zip (butlast (r # rrs)) (zip rrs spl))) (separators tsi'))\n      =\n     list_assn ((\\<lambda>t (ti, r', x, y). trunk_assn k t (the ti) r' x y) \\<times>\\<^sub>a id_assn) ts\n      (zip (zip (subtrees tsi') (zip (butlast (r # rrs)) (zip rrs spl))) (separators tsi')) *\n     leaf_nodes_assn k (concat (map (leaf_nodes \\<circ> fst) ts)) r (last (r#rrs)) (concat spl)\n) \"\nproof(induction tsi' rrs spl ts arbitrary: r rule: list_induct4)\n  case Nil\n  then show ?case\n    by (sep_auto simp add: last.simps butlast.simps)\nnext\n  case (Cons x xs y ys z zs w ws r)\n  show ?case\n    using Cons.hyps Cons.prems\n    apply(clarsimp simp add: butlast_double_Cons last_double_Cons)\n    apply(clarsimp simp add: prod_assn_def split!: prod.splits)\n        apply(simp add: bplustree_leaf_nodes_sep)\n    apply(subst Cons.IH[of y])\n    subgoal for sub sep\n      apply(intro ent_iffI)\n      subgoal\n      apply(rule entails_preI)\n    apply(subst leaf_nodes_assn_split2)\n        subgoal by (auto dest!: mod_starD leaf_nodes_assn_impl_length)\n        apply (simp add: simp_map_temp)\n        apply(inst_ex_assn y)\n        apply(sep_auto)\n        done\n      subgoal\n      apply(rule entails_preI)\n        apply(cases ws)\n      proof(goal_cases)\n        case 1\n        then show ?thesis\n          by (sep_auto simp add: last.simps)\n      next\n        case (2 _ a list)\n        then show ?thesis\n          apply(cases xs, simp)\n          apply(cases ys, simp)\n          apply(cases zs, simp)\n          subgoal for x' xs' y'' ys'' z' zs'\n          apply(clarsimp simp add: butlast_double_Cons last_double_Cons)\n          apply(clarsimp simp add: prod_assn_def split!: prod.splits)\n            subgoal for sub' sep'\n            apply(subgoal_tac \"y = Some (hd z')\")\n            prefer 2\n            subgoal by (auto dest!: mod_starD trunk_assn_hd)\n          apply sep_auto\n    apply(subst leaf_nodes_assn_split[where yi=\"the y\" and ysr=\"tl z'@concat zs'\"])\n        find_theorems trunk_assn length\n        subgoal by (auto dest!: mod_starD trunk_assn_leafs_len_imp)\n        apply(subgoal_tac \"z' \\<noteq> []\")\n        prefer 2\n          subgoal by (auto dest!: mod_starD trunk_assn_leafs_len_imp simp add: leaf_nodes_not_empty)\n          subgoal by simp\n        apply (simp add: simp_map_temp)\n        apply(sep_auto)\n        done\n      done\n    done\n    qed\n  done\n  done\nqed\ndeclare last.simps[simp add] butlast.simps[simp add]\n\nlemma blist_leafs_assn_split:\n\"   length tsi' = length rrs \\<Longrightarrow>\n    length rrs = length spl \\<Longrightarrow>\n    (blist_leafs_assn k ts\n      (zip (zip (subtrees tsi') (zip (butlast (r # rrs)) (zip rrs spl))) (separators tsi'))\n      =\n     list_assn ((\\<lambda>t (ti, r', x, y). trunk_assn k t (the ti) r' x y) \\<times>\\<^sub>a id_assn) ts\n      (zip (zip (subtrees tsi') (zip (butlast (r # rrs)) (zip rrs spl))) (separators tsi')) *\n     leaf_nodes_assn k (concat (map (leaf_nodes \\<circ> fst) ts)) r (last (r#rrs)) (concat spl)\n) \"\nproof((intro ent_iffI; rule entails_preI), goal_cases)\n  case 1\n  then have \"length spl = length ts\" \n    by (auto dest!: list_assn_len)\n  then show ?case \n    using blist_leafs_assn_split_help[OF 1(1,2)]\n    by auto\nnext\n  case 2\n  then have \"length spl = length ts\" \n    by (auto dest!: mod_starD list_assn_len)\n  then show ?case\n    using blist_leafs_assn_split_help[OF 2(1,2)]\n    by auto\nqed\n\nlemma split_list: \"i < length ts \\<Longrightarrow> ts ! i = x \\<Longrightarrow> \\<exists>ls rs. ts = ls@x#rs \\<and> length ls = i\"\n  by (metis id_take_nth_drop length_take min_simps(2))\n\nlemma take_butlast_Suc: \"i < length xs \\<Longrightarrow> take i (butlast xs) = butlast (take (Suc i) xs)\"\n  by (metis Suc_leI Suc_to_right take_butlast take_minus_one_conv_butlast)\n\nlemma inbetween_aligned_imp_Laligned: \"inbetween aligned l (ls@(sub,sep)#rs) t u \\<Longrightarrow> Laligned sub sep\"\n  by (induction ls arbitrary: l) (auto simp add: aligned_imp_Laligned)\n\nlemma Laligned_sub: \"Laligned (Node (ls@(sub,sep)#rs) t) u \\<Longrightarrow> Laligned sub sep\"\n  by (cases ls) (auto simp add: inbetween_aligned_imp_Laligned split!: prod.splits) \n\n(* much shorter when expressed on the nodes themselves *)\ndeclare last.simps[simp del] butlast.simps[simp del]\nlemma leaf_nodes_lrange\\<^sub>i_rule:\n  assumes \"k > 0\" \"root_order k t\" \"Laligned t u\"\n  shows \"<bplustree_assn_leafs k t ti r z lptrs >\nleaf_nodes_lrange\\<^sub>i ti x\n<\\<lambda>p. (\\<exists>\\<^sub>A lptrs xs1 lptrs1 lptrs2.\n  trunk_assn k t ti r z lptrs *\n  leaf_nodes_assn k xs1 r p lptrs1 *\n  leaf_nodes_assn k (abs_split_range.leaf_nodes_lrange t x) p z lptrs2 *\n  \\<up>(lptrs = lptrs1@lptrs2) *\n  \\<up>(leaf_nodes t = xs1@(abs_split_range.leaf_nodes_lrange t x))\n)\n>\\<^sub>t\"\n  using assms\nproof(induction t x arbitrary: ti r z u lptrs rule: abs_split_range.leaf_nodes_lrange.induct)\n  case (1 ks x)\n  then show ?case\n    apply(subst leaf_nodes_lrange\\<^sub>i.simps)\n    apply (sep_auto eintros del: exI)\n    apply(inst_existentials \"[ti]\" \"[]::'a bplustree list\" \"[]::'a btnode ref list\" \"[ti]\")\n    apply sep_auto+\n    done\nnext\n  case (2 ts t x ti r z u lptrs)\n  then have \"sorted_less (separators ts)\"\n    by (meson Laligned_sorted_separators sorted_wrt_append)\n  obtain ls rs where split_pair: \"split ts x = (ls,rs)\"\n    by (meson surj_pair)\n  show ?case\n  proof(cases rs)\n    case Nil\n    then show ?thesis\n      using split_pair\n    apply(subst leaf_nodes_lrange\\<^sub>i.simps)\n    apply simp\n    apply(vcg)\n    apply simp\n    subgoal for tsi tii tsi' rrs spl\n      apply(cases tsi)\n      subgoal for tsia tsin\n    supply R = split\\<^sub>i_leafs_rule[of ts tsi' rrs \"butlast spl\" \"(zip (zip (subtrees tsi') (zip (butlast (r # rrs)) (zip rrs (butlast spl))))\n        (separators tsi'))\" r z]\n      thm R\n    apply (vcg heap add: R)\n      subgoal using \\<open>sorted_less (separators ts)\\<close> by linarith\n      subgoal by simp\n      subgoal by simp\n      subgoal by (simp add: butlast.simps)\n      apply simp\n      apply(rule norm_pre_ex_rule)\n      apply(rule hoare_triple_preI)\n      apply(vcg)\n(* discard wrong path *)\n      subgoal by (auto simp add: split_relation_alt is_pfa_def dest!:  mod_starD list_assn_len)[]\n(* correct path *)\n      subgoal for _ spl\n      supply R = \"2.IH\"(1)[OF split_pair[symmetric] Nil, of u]\n      thm R\n      apply(vcg heap add: R)\n      subgoal using \"2.prems\" by simp\n      subgoal \n      using \"2.prems\"(2) assms(1) order_impl_root_order root_order.simps(2) by blast\n      subgoal \n      using \"2.prems\"(3) Lalign_Llast by blast\n    apply (sep_auto eintros del: exI)\n    subgoal for y lptrs xs1 lptrs1 lptrs2\n      apply(inst_existentials \"concat (spl@[lptrs])\" \"concat (map (leaf_nodes \\<circ> fst) ts) @ xs1\" \"(concat spl) @ lptrs1\" lptrs2\n            tsia tsin tii tsi' \"(zip (zip (subtrees tsi') (zip (butlast (r # rrs)) (zip rrs spl)))\n            (separators tsi'))\" rrs \"spl@[lptrs]\")\n      (*apply(inst_existentials \"concat (spl@[lptrs])\" \"concat (map (leaf_nodes \\<circ> fst) ts) @ xs1\" \"(concat (butlast spl)) @ lptrs1\" lptrs2\n                              tsia tsin tii tsi' \"(zip (zip (subtrees tsi') (zip (butlast (r # rrs)) (zip rrs (butlast spl))))\n            (separators tsi'))\" rrs spl)*)\n      subgoal\n        by (auto)\n      subgoal\n        apply sep_auto\n        apply(subst blist_leafs_assn_split)\n        subgoal by simp\n        subgoal \n          by (auto dest!: mod_starD list_assn_len)\n        apply(rule entails_preI)\n        apply(subst leaf_nodes_assn_split2)\n        subgoal \n          by (auto dest!: mod_starD leaf_nodes_assn_impl_length)\n        apply (sep_auto eintros del: exI)\n        apply(inst_existentials \"(last (r # rrs))\")\n        apply (sep_auto)\n        done\n      done\n  done\n    done\n  done\n  done\n  next\n    case (Cons subsep rrs)\n    then obtain sub sep where subsep_split[simp]:\"subsep = (sub,sep)\"\n      by (cases subsep)\n    then show ?thesis\n    apply(subst leaf_nodes_lrange\\<^sub>i.simps)\n    using split_pair Cons apply (simp split!: list.splits prod.splits)\n    apply(vcg)\n    apply simp\n    subgoal for tsi tii tsi' rs' spl_first\n      apply(cases tsi)\n      subgoal for tsia tsin\n    supply R = split\\<^sub>i_leafs_rule[of ts tsi' rs' \"butlast spl_first\" \"(zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' (butlast spl_first))))\n        (separators tsi'))\" r z]\n      thm R\n    apply (vcg heap add: R)\n      subgoal using \\<open>sorted_less (separators ts)\\<close> by linarith\n      subgoal by simp\n      subgoal by simp\n      subgoal by (simp add: butlast.simps)\n      thm split_relation_alt\n      apply simp\n      apply(rule norm_pre_ex_rule)\n         apply(auto simp add: split_relation_alt list_assn_append_Cons_left dest!: mod_starD list_assn_len)[]\n      apply(rule norm_pre_ex_rule)+\n      apply(rule hoare_triple_preI)\n      subgoal for spl lsi subsepi rsi\n        apply(cases subsepi)\n        subgoal for zz sepi\n          apply(cases zz)\n          subgoal for subi subp subfwd sublptrs\n      apply(vcg)\n(* correct path *)\n      subgoal for _ _ suba sepa \n      apply(subgoal_tac \"lsi = take (length ls) (zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' spl)))\n     (separators tsi'))\")\n      prefer 2\n    subgoal proof (goal_cases)\n      case 1\n      have *: \"length lsi = length ls\"\n        using 1 by (auto dest!: mod_starD list_assn_len)\n      then have \"take (length ls) (zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' spl))) (separators tsi')) = \n                  take (length ls) (lsi @ ((subi, subp, subfwd, sublptrs), sepi) # rsi)\"\n        using 1 by auto\n      also have \"\\<dots> = lsi\"\n        using * by auto\n      finally show ?case .. \n    qed\n      apply(subgoal_tac \"rsi = drop (length ls+1) (zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' spl)))\n     (separators tsi'))\")\n      prefer 2\n    subgoal proof (goal_cases)\n      case 1\n      have *: \"length lsi = length ls\"\n        using 1 by (auto dest!: mod_starD list_assn_len)\n      then have \"drop (length ls+1) (zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' spl))) (separators tsi')) = \n                  drop (length ls+1) (lsi @ ((subi, subp, subfwd, sublptrs), sepi) # rsi)\"\n        using 1 by auto\n      also have \"\\<dots> = rsi\"\n        using * by auto\n      finally show ?case .. \n    qed\n      apply(subgoal_tac \"subtrees tsi' = (take (length ls) (subtrees tsi'))@subi#(drop (length ls+1) (subtrees tsi'))\")\n    prefer 2\n      subgoal proof (goal_cases)\n        case 1\n        have \"length spl = length tsi'\" \"length tsi' = length rs'\"\n          using 1 by auto\n        then have \"subtrees tsi' = map fst (map fst ((zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' spl)))\n       (separators tsi'))))\"\n          by simp\n        also have \"\\<dots> = map fst (map fst (lsi @ ((subi, subp, subfwd, sublptrs), sepi) # rsi))\"\n          using 1 by simp\n        also have \"\\<dots> = map fst (map fst (lsi)) @ subi # map fst (map fst (rsi))\"\n          by auto\n        also have \"\\<dots> = (take (length ls) (subtrees tsi')) @ subi # (drop (length ls +1) (subtrees tsi'))\"\n          using 1 by (auto simp add: take_map[symmetric] drop_map[symmetric])\n        finally show ?case .\n      qed\n      apply(subgoal_tac \"separators tsi' = (take (length ls) (separators tsi'))@sepi#(drop (length ls+1) (separators tsi'))\")\n    prefer 2\n      subgoal proof (goal_cases)\n        case 1\n        have \"length spl = length tsi'\" \"length tsi' = length rs'\"\n          using 1 by auto\n        then have \"separators tsi' = map snd ((zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' spl)))\n       (separators tsi')))\"\n          by simp\n        also have \"\\<dots> = map snd (lsi @ ((subi, subp, subfwd, sublptrs), sepi) # rsi)\"\n          using 1 by simp\n        also have \"\\<dots> = map snd (lsi) @ sepi # map snd (rsi)\"\n          by auto\n        also have \"\\<dots> = (take (length ls) (separators tsi')) @ sepi # (drop (length ls +1) (separators tsi'))\"\n          using 1 by (auto simp add: take_map[symmetric] drop_map[symmetric])\n        finally show ?case .\n      qed\n      apply(subgoal_tac \"spl = (take (length ls) spl)@sublptrs#(drop (length ls+1) spl)\")\n        prefer 2\n      subgoal proof (goal_cases)\n        case 1\n        have \"length spl = length tsi'\" \"length tsi' = length rs'\"\n          using 1 by auto\n        then have \"spl = map snd (map snd (map snd (map fst ((zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' spl)))\n       (separators tsi'))))))\"\n          by simp\n        also have \"\\<dots> = map snd (map snd (map snd (map fst (lsi @ ((subi, subp, subfwd, sublptrs), sepi) # rsi))))\"\n          using 1 by simp\n        also have \"\\<dots> = map snd (map snd (map snd (map fst (lsi)))) @ sublptrs # map snd (map snd (map snd (map fst (rsi))))\"\n          by auto\n        also have \"\\<dots> = (take (length ls) spl) @ sublptrs # (drop (length ls +1) spl)\"\n          using 1 by (auto simp add: take_map[symmetric] drop_map[symmetric])\n        finally show ?case .\n      qed\n      apply(subgoal_tac \"rs' = (take (length ls) rs')@subfwd#(drop (length ls+1) rs')\")\n        prefer 2\n      subgoal proof (goal_cases)\n        case 1\n        have \"length spl = length tsi'\" \"length tsi' = length rs'\"\n          using 1 by auto\n        then have \"rs' = map fst (map snd (map snd (map fst ((zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' spl)))\n       (separators tsi'))))))\"\n          by simp\n        also have \"\\<dots> = map fst (map snd (map snd (map fst (lsi @ ((subi, subp, subfwd, sublptrs), sepi) # rsi))))\"\n          using 1 by simp\n        also have \"\\<dots> = map fst (map snd (map snd (map fst (lsi)))) @ subfwd # map fst (map snd (map snd (map fst (rsi))))\"\n          by auto\n        also have \"\\<dots> = (take (length ls) rs') @ subfwd # (drop (length ls +1) rs')\"\n          using 1 by (auto simp add: take_map[symmetric] drop_map[symmetric])\n        finally show ?case .\n      qed\n      apply(subgoal_tac \"butlast (r#rs') = (take (length ls) (butlast (r#rs')))@subp#(drop (length ls+1) (butlast (r#rs')))\")\n        prefer 2\n      subgoal proof (goal_cases)\n        case 1\n        have \"length spl = length tsi'\" \"length tsi' = length rs'\"\n          using 1 by auto\n        then have \"butlast (r#rs') = (map fst (map snd (map fst ((zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' spl)))\n       (separators tsi'))))))\"\n          by simp\n        also have \"\\<dots> = map fst (map snd (map fst (lsi @ ((subi, subp, subfwd, sublptrs), sepi) # rsi)))\"\n          using 1 by simp\n        also have \"\\<dots> = map fst (map snd (map fst (lsi))) @ subp # map fst (map snd (map fst (rsi)))\"\n          by auto\n        also have \"\\<dots> = (take (length ls) (butlast (r#rs'))) @ subp # (drop (length ls +1) (butlast (r#rs')))\"\n          using 1 by (auto simp add: take_map[symmetric] drop_map[symmetric])\n        finally show ?case .\n      qed\n          apply(subgoal_tac \"subsepi = ((suba, subp, subfwd, sublptrs), sepa)\", simp)\n        prefer 2\n    subgoal proof (goal_cases)\n      case assms: 1\n      have \"subi = suba\" \"sepi = sepa\"\n      proof(goal_cases)\n        case 1\n        have \"subtrees tsi' ! (length ls) = subi\"\n          by (metis append_take_drop_id assms(20) nth_via_drop same_append_eq)\n        moreover have \"subtrees tsi' ! (length ls) = suba\"\n          using assms by simp\n        ultimately show ?case by simp\n      next\n        case 2\n        have \"separators tsi' ! (length ls) = sepi\"\n          by (metis append_take_drop_id assms(21) nth_via_drop same_append_eq)\n        moreover have \"separators tsi' ! (length ls) = sepa\"\n          using assms by simp\n        ultimately show ?case by simp\n      qed\n      then show ?case\n        using assms by auto\n    qed\n      supply R = \"2.IH\"(2)[OF split_pair[symmetric] Cons subsep_split[symmetric], of sep]\n      thm R\n      apply(vcg heap add: R)\n      subgoal using \"2.prems\" by simp\n      subgoal \n        using \"2.prems\"(2) assms(1)  root_order.simps(2)\n        by (auto dest!: order_impl_root_order[of k sub, OF assms(1)])\n      subgoal \n        using \"2.prems\"(3) split_pair Cons subsep_split Laligned_sub[of ls sub sep rrs]\n        by simp\n    apply (sep_auto eintros del: exI)\n    subgoal for y lptrs xs1 lptrs1 lptrs2\n      thm blist_leafs_assn_split\n        apply(inst_existentials \"concat ((take (length ls) spl)@lptrs#(drop (Suc (length ls)) spl)@[last spl_first])\" \"concat (map (leaf_nodes \\<circ> fst) ls) @ xs1\"\n\"concat (take (length ls) spl) @ lptrs1\" \"lptrs2 @ (concat (drop (Suc (length ls)) spl))@last spl_first\"\ntsia tsin tii tsi' \"zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' (butlast ((take (length ls) spl)@lptrs#(drop (Suc (length ls)) spl)@[last spl_first])))))\n         (separators tsi')\" rs' \"(take (length ls) spl)@lptrs#(drop (Suc (length ls)) spl)@[last spl_first]\" \"(take (length ls)\n            (zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' spl)))\n              (separators tsi')))\" subi subp subfwd lptrs sepi \"(drop (Suc (length ls))\n            (zip (zip (subtrees tsi') (zip (butlast (r # rs')) (zip rs' ((take (length ls) spl)@lptrs#(drop (length ls+1) spl)))))\n              (separators tsi')))\")\n      (*apply(inst_existentials \"concat (spl@[lptrs])\" \"concat (map (leaf_nodes \\<circ> fst) ts) @ xs1\" \"(concat (butlast spl)) @ lptrs1\" lptrs2\n                              tsia tsin tii tsi' \"(zip (zip (subtrees tsi') (zip (butlast (r # rrs)) (zip rrs (butlast spl))))\n            (separators tsi'))\" rrs spl)*)\n      subgoal\n        find_theorems \"butlast\" \"_@[_]\"\n        apply (auto)\n      proof (goal_cases)\n        case (1 a b)\n        have *: \"(take (length ls) spl @ (lptrs1 @ lptrs2) # drop (Suc (length ls)) spl @ [last spl_first])\n = ((take (length ls) spl @ (lptrs1 @ lptrs2) # drop (Suc (length ls)) spl) @ [last spl_first])\"\n          by auto\n        have **: \n           \"subtrees tsi' = take (length ls) (subtrees tsi') @ subi # drop (Suc (length ls)) (subtrees tsi')\"\n           \"separators tsi' = take (length ls) (separators tsi') @ sepi # drop (Suc (length ls)) (separators tsi')\"\n           \"spl = take (length ls) spl @ sublptrs # drop (Suc (length ls)) spl\"\n           \"rs' = take (length ls) rs' @ subfwd # drop (Suc (length ls)) rs'\"\n           \"butlast (r # rs') =\n           take (length ls) (butlast (r # rs')) @\n           subp # drop (Suc (length ls)) (butlast (r # rs'))\"\n          using 1 by simp_all\n        have drop_sep_tsi': \"drop (length ls) (separators tsi') = sepi#(drop (length ls+1) (separators tsi'))\" \n        proof -\n          have \"take (length ls) (separators tsi') @ drop (length ls) (separators tsi') = take (length ls) (separators tsi')@sepi#(drop (length ls+1) (separators tsi'))\" \n            using 1 by auto\n          then show ?thesis\n            by (meson same_append_eq)\n        qed\n        have drop_sub_tsi': \"drop (length ls) (subtrees tsi') = subi#(drop (length ls+1) (subtrees tsi'))\" \n        proof -\n          have \"take (length ls) (subtrees tsi') @ drop (length ls) (subtrees tsi') = take (length ls) (subtrees tsi')@subi#(drop (length ls+1) (subtrees tsi'))\" \n            using 1 by auto\n          then show ?thesis\n            by (meson same_append_eq)\n        qed\n        have drop_rs': \"drop (length ls) rs' = subfwd#(drop (length ls+1) rs')\" \n        proof -\n          have \"take (length ls) rs' @ drop (length ls) rs' = take (length ls) rs'@subfwd#(drop (length ls+1) rs')\" \n            using 1 by auto\n          then show ?thesis\n            by (meson same_append_eq)\n        qed\n        have drop_butlastrs': \"drop (length ls) (butlast (r#rs')) = subp#(drop (length ls+1) (butlast (r#rs')))\" \n        proof -\n          have \"take (length ls) (butlast (r#rs')) @ drop (length ls) (butlast (r#rs')) = take (length ls) (butlast (r#rs'))@subp#(drop (length ls+1) (butlast (r#rs')))\" \n            using 1 by auto\n          then show ?thesis\n            by (meson same_append_eq)\n        qed\n        have \"length tsi' = length rs'\" \"length spl = length rs'\" \"length ls \\<le> length rs'\" \n          using 1 by auto\n        then show ?case \n          apply(subst *)\n          apply(subst butlast_snoc)\n          find_theorems \"zip\" \"_@_\"\n          apply(subst(2) zip_append2)\n          apply(subst(2) zip_append2)\n          apply(subst(2) zip_append2)\n          apply(subst zip_append1)\n          find_theorems min \"_ \\<le> _\"\n          apply (simp add: min.absorb2)\n          find_theorems \"zip\" \"_#_\"\n          find_theorems zip take\n          apply(simp add: take_zip)\n          apply(subst drop_sep_tsi')\n          apply(subst drop_sub_tsi')\n          apply(subst drop_rs')\n          apply(subst drop_butlastrs')\n          apply(simp add: drop_zip min.absorb2)\n          done\n      qed\n      subgoal\n        find_theorems butlast take\n        apply(simp add: take_zip drop_zip)\n        apply(simp add: take_butlast_Suc)\n        apply(subgoal_tac \"drop (Suc (length ls)) (butlast (r # rs')) = butlast (subfwd#(drop (Suc (length ls)) rs'))\") \n        apply (simp add: take_map drop_map)\n        thm blist_leafs_assn_split\n         supply R = blist_leafs_assn_split[of\n                  \"take (length ls) tsi'\"\n                  \"take (length ls) rs'\"\n                  \"take (length ls) spl\"\n                  k ls\n                  ]\n        thm R\n        find_theorems map take\n        apply(subst blist_leafs_assn_split)\n        subgoal by simp\n        subgoal \n          by (auto dest!: mod_starD list_assn_len)\n        apply(subst blist_leafs_assn_split)\n        subgoal by simp\n        subgoal \n          by (auto dest!: mod_starD list_assn_len)\n        apply(clarsimp)\n        apply(rule entails_preI)\n        apply(subst leaf_nodes_assn_split2)\n        subgoal \n          by (auto dest!: mod_starD leaf_nodes_assn_impl_length)\n        apply(subst leaf_nodes_assn_split2)\n        subgoal \n          by (auto dest!: mod_starD leaf_nodes_assn_impl_length)\n        apply(subst leaf_nodes_assn_split2)\n        subgoal \n          by (auto dest!: mod_starD leaf_nodes_assn_impl_length)\n        apply(subst bplustree_leaf_nodes_sep)+\n        apply (sep_auto eintros del: exI)\n        apply(inst_existentials subfwd \"(last (subfwd # drop (Suc (length ls)) rs'))\" \"(last (r # take (length ls) rs'))\")\n        apply(subgoal_tac \"last (subfwd # drop (Suc (length ls)) rs') = last (r#rs')\")\n        apply(subgoal_tac \"(last (r # take (length ls) rs')) = subp\")\n        apply(simp add: last.simps)\n        apply (solve_entails)\n      proof(goal_cases)\n        case (1 a b)\n        then have *: \"length ls < length rs'\"\n          by simp\n        have \"butlast (r # rs') =\n    butlast (r # take (length ls) rs') @ subp # butlast (subfwd # drop (Suc (length ls)) rs')\"\n          using 1 by simp\n        then have \"take (length ls + 1) (butlast (r #rs')) = butlast (r # take (length ls) rs') @ [subp]\"\n          using * by simp\n        then have \"butlast (r # rs') ! (length ls) = subp\"\n          using * take_Suc_conv_app_nth[of \"length ls\" \"butlast (r#rs')\"]\n          by simp\n        then have obt:\"(r # rs') ! (length ls) = subp\"\n          using nth_butlast[of \"length ls\" \"r#rs'\"] * by auto\n        have **: \"r#(take (length ls) rs') = take (length ls +1) (r#rs')\"\n          by simp\n        show ?case\n          apply (subst **)\n          apply(subst last_take_nth_conv)\n          using obt * by auto\n      next\n        case (2 a b)\n        then have \"rs' = take (length ls) rs' @ subfwd # drop (Suc (length ls)) rs'\"\n          by simp\n        then have \"r#rs' = (r#take (length ls) rs') @ subfwd # drop (Suc (length ls)) rs'\"\n          by simp\n        then have \"last(r#rs') = last((r#take (length ls) rs') @ subfwd # drop (Suc (length ls)) rs')\"\n          by simp\n        also have \"\\<dots> = last(subfwd # drop (Suc (length ls)) rs')\"\n          thm last_append[of \"r#take (length ls) rs'\"]\n          using last_append[of \"r#take (length ls) rs'\"]\n          by simp\n        finally show ?case ..\n      next\n        case 3\n        have \"drop (Suc (length ls)) (butlast (r # rs')) = butlast (drop (Suc (length ls)) (r#rs'))\"\n          by (auto simp add: butlast.simps butlast_drop)\n        also have \"\\<dots> = butlast (drop (length ls) rs')\"\n          by simp\n        also have \"\\<dots> = butlast (subfwd # drop (Suc (length ls)) rs')\"\n        proof -\n            have *:\"rs' = take (length ls) rs' @ subfwd # drop (Suc (length ls)) rs'\"\n              using 3 by simp\n            have \"length ls < length rs'\"\n              using 3 by simp\n            then have \"drop (length ls) rs' = subfwd # drop (Suc (length ls)) rs'\"\n              apply(subst *)\n              by (simp add: min.absorb1 min.absorb2)\n            then show ?thesis by simp\n          qed\n          finally show ?case .\n      qed\n        done\n      done\n  subgoal\n    apply(rule hoare_triple_preI)\n    subgoal by (auto simp add: split_relation_alt dest!:  mod_starD list_assn_len arg_cong[of _ _ length])[]\n  done\n  done\n  done\n  done\n  done\n  done\n  done\n  qed\nqed\ndeclare last.simps[simp add] butlast.simps[simp add]\n\n(*fun concat_leaf_nodes_lrange\\<^sub>i where\n  \"concat_leaf_nodes_lrange\\<^sub>i t x = (case leaf_nodes_lrange\\<^sub>i t x of (Leaf ks)#list \\<Rightarrow> lrange_list x ks @ (concat (map leaves list)))\"\n*)\n\ndefinition concat_leaf_nodes_lrange\\<^sub>i where\n\"concat_leaf_nodes_lrange\\<^sub>i ti x = do {\n  lp \\<leftarrow> leaf_nodes_lrange\\<^sub>i ti x;\n  li \\<leftarrow> !(the lp);\n  case li of Btleaf xs nxt \\<Rightarrow> do {\n    arr_it \\<leftarrow> lrange_list\\<^sub>i x xs;\n    fla_it \\<leftarrow> leaf_values_adjust (nxt,None) arr_it;\n    return fla_it\n  }\n}\"\n\nlemma sorted_less_leaf_nodes: \"sorted_less (leaves t) \\<Longrightarrow> (Leaf ks) \\<in> set (leaf_nodes t) \\<Longrightarrow> sorted_less ks\"\nproof(induction t arbitrary: ks rule: leaf_nodes.induct)\n  case (1 xs)\n  then show ?case by simp\nnext\n  case I: (2 ts t)\n  then have \"(\\<exists>x \\<in> set ts. Leaf ks \\<in> set (leaf_nodes (fst x))) \\<or> Leaf ks \\<in> set (leaf_nodes t)\"\n    by simp\n  then show ?case \n  proof(standard, goal_cases)\n    case 1\n    then show ?case\n      using I\n      by (metis (no_types, lifting) in_set_conv_decomp list.simps(9) map_append sorted_leaves_subtrees)\n  next\n    case 2\n    then show ?case\n      using I\n      by (meson sorted_leaves_induct_last)\n  qed\nqed\n\nlemmas leaf_values_adjust_rule = leaf_values_iter.flatten_it_adjust_rule\n\nlemma concat_leaf_nodes_lrange\\<^sub>i_rule_help:\n  assumes \"k > 0\" \"root_order k t\" \"sorted_less (leaves t)\" \"Laligned t u\"\n  shows \"<bplustree_assn_leafs k t ti r None lptrs>\nconcat_leaf_nodes_lrange\\<^sub>i ti x\n<bplustree_iter k t ti r (abs_split_range.lrange t x)>\\<^sub>t\"\n  apply(subst concat_leaf_nodes_lrange\\<^sub>i_def)\n  apply(vcg (ss) heap: leaf_nodes_lrange\\<^sub>i_rule[of k t u])+\n  subgoal using assms by simp\n  subgoal using assms by simp\n  subgoal using assms by simp\n  apply simp\n  apply(rule norm_pre_ex_rule)+\n  apply(rule hoare_triple_preI)\n  apply(auto dest!: mod_starD)\nproof(goal_cases)\n  case (1 l xs1 lptrs1 lptrs2)\n  obtain ks list where *[simp]: \"abs_split_range.leaf_nodes_lrange t x = (Leaf ks)#list \\<and> (Leaf ks) \\<in> set (leaf_nodes t)\"\n    using abs_split_range.leaf_nodes_lrange_not_empty by blast\n  then obtain r' lptrs2' where [simp]: \"lptrs2 = r' # lptrs2'\"\n    using 1\n    by (metis Suc_length_conv leaf_nodes_assn_impl_length)\n  have sorted_less_ks: \"sorted_less ks\"\n    using \\<open>abs_split_range.leaf_nodes_lrange t x = Leaf ks # list \\<and> Leaf ks \\<in> set (leaf_nodes t)\\<close> assms(3) sorted_less_leaf_nodes split\\<^sub>i_range_axioms by blast\n  then obtain pref where ks_split: \"ks = pref @ lrange_list x ks\"\n  proof (goal_cases)\n    case 1\n    have \"suffix (lrange_list x ks) ks\"\n      by (metis \\<open>sorted_less ks\\<close> abs_split_range.lrange_list_req lrange_suffix sorted_less_lrange)\n    then have \"\\<exists>pref. ks = pref @ lrange_list x ks\"\n      by (meson suffixE)\n    then show ?case\n      using 1\n      by blast\n  qed\n  show ?case\n  proof(cases l)\n    case None\n    show ?thesis\n      apply(rule hoare_triple_preI)\n      using None by simp\n  next\n  case (Some a)\n    then show ?thesis\n      apply simp\n      apply(rule norm_pre_ex_rule)+\n      apply vcg\n      apply simp\n      subgoal for xsi fwd\n        apply(cases xsi)\n        apply simp\n      thm lrange_list_rule\n      using sorted_less_ks apply (vcg  heap: lrange_list_rule)\n      apply(subst leaf_nodes_assn_flatten)+\n      apply(simp)\n      apply(rule norm_pre_ex_rule)+\n      subgoal for ksia ksin it ps2 ps1\n      supply R = fi_rule[\n            OF leaf_values_adjust_rule,\n            where F=\"list_assn leaf_node (leaf_nodes t) (leaf_lists t) *\n                     trunk_assn k t ti r None (lptrs1 @ r' # lptrs2') *\n                     true\"]\n        thm R\n        supply R' = R[of _ k \"map leaves xs1\" ps1 \"map leaves list\" ps2 \"(ksia,ksin)\"\n                         \"lptrs1@r'#lptrs2'\" r \"(fwd,None)\" pref \"lrange_list x ks\" it]\n      thm R'\n      apply(vcg heap: R')\n      apply(subst leaf_iter_assn_def)\n      apply simp\n      subgoal\n        apply(inst_ex_assn \"ps1@[(ksia,ksin)]\" \"lptrs1@[r']\" lptrs2')\n        apply sep_auto\n          subgoal\n            apply(rule entails_preI)\n            apply(subst leafs_assn_aux_append)\n            subgoal by (auto dest!: mod_starD leafs_assn_impl_length)\n            subgoal\n              apply simp\n              apply(inst_ex_assn \"Some r'\")\n              subgoal using 1(1) ks_split by sep_auto\n              done\n        done\n      done\n      subgoal\n        apply (sep_auto eintros del: exI simp add: bplustree_iter_def)\n        apply(inst_existentials \"lptrs1@lptrs2\")\n        apply(subgoal_tac \"leaves t = (concat (map leaves xs1) @ pref @ lrange_list x ks @ concat (map leaves list))\")\n        apply(subgoal_tac \"abs_split_range.lrange t x = (lrange_list x ks @ concat (map leaves list))\")\n        subgoal using 1(1) 1(2) ks_split by sep_auto\n        subgoal by (metis \\<open>abs_split_range.leaf_nodes_lrange t x = Leaf ks # list \\<and> Leaf ks \\<in> set (leaf_nodes t)\\<close> abs_split_range.split_range_axioms split_range.leaf_nodes_lrange_pre_lrange)\n        subgoal\n          using concat_leaf_nodes_leaves[symmetric, of t] 1(1) ks_split\n          by auto\n        done\n      done\n    done\n  done\n  qed\nqed\n\nlemma concat_leaf_nodes_lrange\\<^sub>i_rule:\n  assumes \"k > 0\" \"root_order k t\" \"sorted_less (leaves t)\" \"Laligned t u\"\n  shows \"<bplustree_assn k t ti r None>\nconcat_leaf_nodes_lrange\\<^sub>i ti x\n<bplustree_iter k t ti r (abs_split_range.lrange t x)>\\<^sub>t\"\n  find_theorems bplustree_assn_leafs\n  apply(simp add: bplustree_extract_leafs)\n  using assms apply(sep_auto heap add: concat_leaf_nodes_lrange\\<^sub>i_rule_help)\n  done\n\nend\n\ncontext split\\<^sub>i_list\nbegin\n\ndefinition lrange_list\\<^sub>i:: \"'a \\<Rightarrow> ('a::{heap,default,linorder,order_top}) pfarray \\<Rightarrow> 'a pfa_it Heap\"\n  where \"lrange_list\\<^sub>i x ks = do {\n    i \\<leftarrow> split\\<^sub>i_list ks x;\n    return (ks, i)\n}\"\n\nlemma lrange_list\\<^sub>i_rule [sep_heap_rules]:\n  assumes \"sorted_less ks\"\n  shows\n   \"<is_pfa c ks (a',n')> \n    lrange_list\\<^sub>i x (a',n') \n  <pfa_is_it c ks (a',n') (abs_split_list.lrange_split x ks)>\\<^sub>t\"\nproof -\n  obtain ls rs where list_split: \"split_list ks x = (ls, rs)\"\n    by (cases \"split_list ks x\")\n  then have \"lrange_list x ks = rs\"\n    by (simp add: abs_split_list.lrange_filter_split assms)\n  moreover have \"ks = ls@rs\"\n    using abs_split_list.split_list_req(1) list_split by blast\n  ultimately show ?thesis\n      apply(subst lrange_list\\<^sub>i_def)\n      using assms list_split abs_split_list.lrange_split_req\n      apply(sep_auto simp add: sorted_less_lrange pfa_is_it_def split_relation_alt list_assn_append_Cons_left dest!: mod_starD list_assn_len)\n      done\nqed\nend\n\ncontext split\\<^sub>i_full\nbegin\n\nsublocale split\\<^sub>i_range split  split\\<^sub>i_list.abs_split_list.lrange_split split\\<^sub>i split\\<^sub>i_list.lrange_list\\<^sub>i\n  using split\\<^sub>i_list.abs_split_list.lrange_split_req split\\<^sub>i_list.lrange_list\\<^sub>i_rule\n  apply unfold_locales \n  apply sep_auto +\n  done\n\nend\n\n\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/BTree/BPlusTree_ImpRange.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765155565326, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3073633492045281}}
{"text": "section \\<open>Hopcroft-Tarjan algorithm\\<close>\ntheory Hopcroft_Tarjan\n  imports\n    \"../Graph/Incidence_Structure/Directed_Incidence_Structure\"\n    \"../Graph/Graph\"\n    \"HOL-Data_Structures.Map_Specs\"\n    \"../Graph/Incidence_Structure/Undirected_Incidence_Structure\"\nbegin\n\nsubsection \\<open>Finding separation pairs\\<close>\n\ndefinition is_numbering :: \"'a set \\<Rightarrow> ('a \\<Rightarrow> nat) \\<Rightarrow> bool\" where\n  \"is_numbering S N \\<equiv> bij_betw N S {1..card S}\"\n\nlocale steps_1_2_3_high = palm_tree_2\n  where T = T\n  for T :: \"'b \\<rightharpoonup> ('a \\<times> 'b)\" +\n  fixes N :: \"'b \\<Rightarrow> nat\"\n  assumes is_numbering: \"is_numbering (Directed_Multigraph.V (edges_from_fun I)) N\"\n  assumes distinct_I: \"distinct (I v)\"\n\nlemma (in steps_1_2_3_high) N_eq_iff:\n  assumes \"u \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  shows \"N u = N v \\<longleftrightarrow> u = v\"\n  using is_numbering assms\n  unfolding is_numbering_def\n  by (metis bij_betw_iff_bijections)\n\nlemma (in steps_1_2_3_high) N_geq_1:\n  assumes \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  shows \"1 \\<le> N v\"\n  using is_numbering assms\n  by (auto simp add: is_numbering_def bij_betw_iff_bijections)\n\nlemma (in steps_1_2_3_high) distinct_incidence:\n  shows \"distinct (incidence I v)\"\n  using distinct_I inj_to_edge\n  by (fastforce simp add: incidence_def distinct_map to_edge_def dest: inj_on_if_inj)\n\ndefinition (in steps_1_2_3_high) A :: \"'b \\<Rightarrow> 'b list\" where\n  \"A v \\<equiv> map snd (I v)\"\n\nlemma (in steps_1_2_3_high) A_incidence_cong:\n  shows \"A v = map head (incidence I v)\"\n  by (simp add: A_def head_def Directed_Multigraph.endpoints_def incidence_def to_edge_def)\n\nlemma (in steps_1_2_3_high) mem_A_if_tree_arc':\n  assumes \"u \\<rightarrow> v\"\n  shows \"v \\<in> set (A u)\"\nproof -\n  obtain \\<epsilon> where\n    \"tree_arc (\\<epsilon>, u, v)\"\n    using assms\n    by (elim tree_arc'E)\n  hence \"(\\<epsilon>, u, v) \\<in> edges_from_fun I\"\n    by (intro tree_arc_imp_edge)\n  hence \"(\\<epsilon>, u, v) \\<in> set (incidence I u)\"\n    using tail_eq\n    by (fastforce simp add: edges_from_fun_def tail_def Directed_Multigraph.endpoints_def)\n  thus ?thesis\n    by (force simp add: A_incidence_cong head_def Directed_Multigraph.endpoints_def)\nqed\n\n(*\ndefinition (in steps_1_2_3_high) children :: \"'b \\<Rightarrow> 'b list\" where\n  \"children v \\<equiv> filter (tree_arc' v) (A v)\"\n*)\n\ndefinition (in steps_1_2_3_high) children :: \"'b \\<Rightarrow> 'b list\" where\n  \"children v \\<equiv> map head (filter tree_arc (incidence I v))\"\n\nlemma (in steps_1_2_3_high) mem_childrenD:\n  assumes \"v \\<in> set (children u)\"\n  shows \"u \\<rightarrow> v\"\nproof -\n  obtain e where\n    \"head e = v\"\n    \"tree_arc e\"\n    \"e \\<in> set (incidence I u)\"\n    using assms\n    by (auto simp add: children_def)\n  thus ?thesis\n    by (auto simp add: tail_eq dest: tree_arc'I)\nqed\n\nlemma (in steps_1_2_3_high) mem_childrenI:\n  assumes \"u \\<rightarrow> v\"\n  shows \"v \\<in> set (children u)\"\nproof -\n  obtain \\<epsilon> where\n    tree_arc: \"tree_arc (\\<epsilon>, u, v)\"\n    using assms\n    by (elim tree_arc'E)\n  hence \"(\\<epsilon>, u, v) \\<in> edges_from_fun I\"\n    by (intro tree_arc_imp_edge)\n  hence \"(\\<epsilon>, u, v) \\<in> set (incidence I u)\"\n    using tail_eq\n    by (fastforce simp add: edges_from_fun_def tail_def Directed_Multigraph.endpoints_def)\n  thus ?thesis\n    using tree_arc\n    by (force simp add: children_def head_def Directed_Multigraph.endpoints_def)\nqed\n\nlemma (in steps_1_2_3_high) distinct_children:\n  shows \"distinct (children u)\"\nproof -\n  { fix e e'\n    assume\n      \"e \\<in> set (filter tree_arc (incidence I u))\"\n      \"e' \\<in> set (filter tree_arc (incidence I u))\"\n      \"head e' = head e\"\n    hence \"e' = e\"\n      by (simp add: tree_arc_def head_def tail_def Directed_Multigraph.endpoints_def prod_eq_iff) }\n  thus ?thesis\n    using distinct_incidence\n    by (simp add: children_def distinct_map inj_on_def)\nqed\n\nlemma (in steps_1_2_3_high) D_children_cong:\n  shows \"{u} \\<union> \\<Union> (D ` set (children u)) = D u\"\nproof -\n  { fix v\n    have \"v = u \\<or> v \\<in> \\<Union> (D ` set (children u)) \\<longleftrightarrow> v = u \\<or> (\\<exists>x. u \\<rightarrow> x \\<and> x \\<rightarrow>\\<^sup>* v)\"\n      by (auto simp add: mem_D_iff_tree_path dest: mem_childrenD mem_childrenI)\n    also have \"... \\<longleftrightarrow> v = u \\<or> u \\<rightarrow>\\<^sup>+ v\"\n      by (blast elim: non_empty_tree_pathE intro: non_empty_tree_pathI_2)\n    also have \"... \\<longleftrightarrow> u \\<rightarrow>\\<^sup>* v\"\n      by (auto simp add: tree_path_non_empty_tree_path_cong)\n    also have \"... \\<longleftrightarrow> v \\<in> D u\"\n      by (simp add: mem_D_iff_tree_path)\n    finally have \"v = u \\<or> v \\<in> \\<Union> (D ` set (children u)) \\<longleftrightarrow> v \\<in> D u\"\n      . }\n  thus ?thesis\n    by blast\nqed\n\nlemma (in steps_1_2_3_high) ND_children_cong:\n  shows \"sum_list (map ND (children u)) + 1 = ND u\"\nproof -\n  have \"sum_list (map ND (children u)) + 1 = (\\<Sum>v\\<in>set (children u). card (D v)) + 1\"\n    using distinct_children\n    by (simp add: sum_list_distinct_conv_sum_set ND_def)\n  also have \"... = card (\\<Union> (D ` set (children u))) + 1\"\n    unfolding add_right_cancel\n    using finite_set\n  proof (rule card_UN_disjoint[symmetric], goal_cases)\n    case 1\n    show ?case\n      using finite_D\n      ..\n  next\n    case 2\n    show ?case\n      by (blast dest: mem_childrenD disjoint_siblings)\n  qed\n  also have \"... = card {u} + card (\\<Union> (D ` set (children u)))\"\n    by force\n  also have \"... = ND u\"\n    unfolding ND_def D_children_cong[of u, symmetric]\n  proof (rule card_Un_disjoint[symmetric], goal_cases)\n    case 2\n    show ?case\n      using finite_D\n      by blast\n  next\n    case 3\n    { fix v\n      assume \"v \\<in> set (children u)\"\n      hence \"u \\<notin> D v\"\n        by (auto simp add: mem_D_iff_tree_path dest: mem_childrenD no_closed_tree_path_3) }\n    thus ?case\n      by fast\n  qed simp\n  finally show ?thesis\n    .\nqed\n\ndefinition (in steps_1_2_3_high) agublagu_less :: \"'b \\<Rightarrow> nat \\<Rightarrow> 'b list\" where\n  \"agublagu_less v i \\<equiv> take i (children v)\"\n\ndefinition (in steps_1_2_3_high) agublagu_geq :: \"'b \\<Rightarrow> nat \\<Rightarrow> 'b list\" where\n  \"agublagu_geq v i \\<equiv> drop i (children v)\"\n\nlemma (in steps_1_2_3_high) children_agublagu_cong:\n  shows \"agublagu_less v i @ agublagu_geq v i = children v\"\n  unfolding agublagu_less_def agublagu_geq_def\n  using append_take_drop_id\n  .\n\nlemma (in steps_1_2_3_high) mem_agublagu_less_imp_mem_children:\n  assumes \"v \\<in> set (agublagu_less u i)\"\n  shows \"v \\<in> set (children u)\"\n  using assms\n  by (auto simp add: agublagu_less_def dest: in_set_takeD)\n\nlemma (in steps_1_2_3_high) mem_agublagu_geq_imp_mem_children:\n  assumes \"v \\<in> set (agublagu_geq u i)\"\n  shows \"v \\<in> set (children u)\"\n  using assms\n  by (auto simp add: agublagu_geq_def dest: in_set_dropD)\n\nlemma (in steps_1_2_3_high) disjoint_agublagu_less_agublagu_geq:\n  shows \"set (agublagu_less u i) \\<inter> set (agublagu_geq u i) = {}\"\n  using distinct_children\n  by (metis children_agublagu_cong distinct_append)\n\ndefinition (in steps_1_2_3_high) fukakyo_less :: \"'b \\<Rightarrow> nat \\<Rightarrow> 'b set\" where\n  \"fukakyo_less v i \\<equiv> \\<Union> (D ` set (agublagu_less v i))\"\n\nlemma (in steps_1_2_3_high) finite_fukakyo_less:\n  shows \"finite (fukakyo_less v i)\"\n  using finite_D\n  by (simp add: fukakyo_less_def)\n\ndefinition (in steps_1_2_3_high) fukakyo_geq :: \"'b \\<Rightarrow> nat \\<Rightarrow> 'b set\" where\n  \"fukakyo_geq v i \\<equiv> \\<Union> (D ` set (agublagu_geq v i))\"\n\nlemma (in steps_1_2_3_high) finite_fukakyo_geq:\n  shows \"finite (fukakyo_geq v i)\"\n  using finite_D\n  by (simp add: fukakyo_geq_def)\n\nlemma (in steps_1_2_3_high) D_fukakyo_cong:\n  shows \"{v} \\<union> fukakyo_less v i \\<union> fukakyo_geq v i = D v\"\nproof -\n  have\n    \"{v} \\<union> fukakyo_less v i \\<union> fukakyo_geq v i =\n     {v} \\<union> \\<Union> (D ` set (agublagu_less v i)) \\<union> \\<Union> (D ` set (agublagu_geq v i))\"\n    by (simp add: fukakyo_less_def fukakyo_geq_def)\n  also have \"... = {v} \\<union> \\<Union> (D ` (set (agublagu_less v i) \\<union> set (agublagu_geq v i)))\"\n    by fast\n  also have \"... = {v} \\<union> \\<Union> (D ` (set (agublagu_less v i @ agublagu_geq v i)))\"\n    by auto\n  also have \"... = {v} \\<union> \\<Union> (D ` set (children v))\"\n    by (simp add: children_agublagu_cong)\n  also have \"... = D v\"\n    using D_children_cong\n    .\n  finally show ?thesis\n    .\nqed\n\nlemma (in steps_1_2_3_high) idk_1:\n  shows \"{v} \\<inter> fukakyo_less v i = {}\"\n  by\n    (auto\n      simp add: fukakyo_less_def mem_D_iff_tree_path\n      dest: mem_agublagu_less_imp_mem_children mem_childrenD no_closed_tree_path_3)\n\nlemma (in steps_1_2_3_high) idk_2:\n  shows \"{v} \\<inter> fukakyo_geq v i = {}\"\n  by\n    (auto\n      simp add: fukakyo_geq_def mem_D_iff_tree_path\n      dest: mem_agublagu_geq_imp_mem_children mem_childrenD no_closed_tree_path_3)\n\nlemma (in steps_1_2_3_high) idk_3:\n  shows \"fukakyo_less u i \\<inter> fukakyo_geq u i = {}\"\nproof -\n  { fix x\n    assume\n      assm: \"x \\<in> fukakyo_less u i\"\n      \"x \\<in> fukakyo_geq u i\"\n    then obtain v v' where\n      \"v \\<in> set (agublagu_less u i)\"\n      \"x \\<in> D v\"\n      \"v' \\<in> set (agublagu_geq u i)\"\n      \"x \\<in> D v'\"\n      by (auto simp add: fukakyo_less_def fukakyo_geq_def)\n    hence\n      \"u \\<rightarrow> v\"\n      \"u \\<rightarrow> v'\"\n      \"v' \\<noteq> v\"\n      \"x \\<in> D v\"\n      \"x \\<in> D v'\"\n      using disjoint_agublagu_less_agublagu_geq\n      by (blast dest: mem_agublagu_less_imp_mem_children mem_agublagu_geq_imp_mem_children mem_childrenD)+\n    hence False\n      by (blast dest: disjoint_siblings) }\n  thus ?thesis\n    by blast\nqed\n\nlemma (in steps_1_2_3_high) idk_4:\n  shows \"card (fukakyo_less v i) + card (fukakyo_geq v i) + 1 = ND v\"\nproof -\n  have \"card (fukakyo_less v i) + card (fukakyo_geq v i) + 1 = card ({v} \\<union> fukakyo_less v i \\<union> fukakyo_geq v i)\"\n    using finite_fukakyo_less finite_fukakyo_geq idk_1 idk_2 idk_3\n    by (simp add: card_Un_disjoint)\n  also have \"... = ND v\"\n    unfolding D_fukakyo_cong ND_def\n    ..\n  finally show ?thesis\n    .\nqed\n\nlemma (in steps_1_2_3_high) idk_5:\n  shows \"sum_list (map ND (agublagu_less v i)) + sum_list (map ND (agublagu_geq v i)) + 1 = ND v\"\n  unfolding sum_list_append[symmetric] map_append[symmetric] children_agublagu_cong\n  using ND_children_cong\n  .\n\ndefinition (in steps_1_2_3_high) lowpt1 :: \"'b \\<Rightarrow> 'b\" where\n  \"lowpt1 u \\<equiv> arg_min_on N ({u} \\<union> {v. tree_path_snoc_frond' u v})\"\n\ndefinition (in steps_1_2_3_high) lowpt2 :: \"'b \\<Rightarrow> 'b\" where\n  \"lowpt2 u \\<equiv> arg_min_on N ({u} \\<union> ({v. tree_path_snoc_frond' u v} - {lowpt1 u}))\"\n\n(*\nTODO: This should follow from assumption palm_tree and probably be a lemma in theory Palm_Tree.\n*)\nlemma (in steps_1_2_3_high) finite_1:\n  shows \"finite {v. tree_path_snoc_frond' u v}\"\n  sorry\n\nlemma (in steps_1_2_3_high) finite_2:\n  shows \"finite ({v. tree_path_snoc_frond' u v} - {lowpt1 u})\"\n  using finite_1\n  by fast\n\nlemma (in steps_1_2_3_high) lowpt1:\n  shows \"lowpt1 u = u \\<or> tree_path_snoc_frond' u (lowpt1 u)\"\nproof -\n  have \"lowpt1 u \\<in> {u} \\<union> {v. tree_path_snoc_frond' u v}\"\n    unfolding lowpt1_def\n    using finite_1\n    by (intro arg_min_if_finite(1)) simp+\n  thus ?thesis\n    by blast\nqed\n\nlemma (in steps_1_2_3_high) lowpt1_mem_V:\n  assumes \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  shows \"lowpt1 v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  using lowpt1 assms\n  by (force dest: last_tree_path_snoc_frond'_mem_V)\n\nlemma (in steps_1_2_3_high) N_lowpt1_least:\n  assumes \"tree_path_snoc_frond' u v\"\n  shows \"N (lowpt1 u) \\<le> N v\"\n  using finite_1 assms\n  by (auto simp add: lowpt1_def intro: arg_min_least)\n\nlemma (in steps_1_2_3_high) N_lowpt1_leq:\n  shows \"N (lowpt1 v) \\<le> N v\"\n  using finite_1\n  by (auto simp add: lowpt1_def intro: arg_min_least)\n\nlemma (in steps_1_2_3_high) lowpt2:\n  shows \"lowpt2 u = u \\<or> tree_path_snoc_frond' u (lowpt2 u)\"\nproof -\n  have \"lowpt2 u \\<in> {u} \\<union> ({v. tree_path_snoc_frond' u v} - {lowpt1 u})\"\n    unfolding lowpt2_def\n    using finite_2\n    by (intro arg_min_if_finite(1)) simp+\n  thus ?thesis\n    by blast\nqed\n\nlemma (in steps_1_2_3_high) lowpt2_eq_lowpt1_iff:\n  shows \"lowpt2 u = lowpt1 u \\<longleftrightarrow> lowpt1 u = u\"\n  (* TODO: Beautify. *)\n  by (metis Diff_iff Un_Diff_cancel Un_insert_left arg_min_if_finite(1) finite.insertI finite_2 insertCI insertE lowpt1_def lowpt2_def sup_bot_left)\n\nlemma (in steps_1_2_3_high) N_lowpt2_leq:\n  assumes \"tree_path_snoc_frond' u v\"\n  assumes \"lowpt1 u \\<noteq> v\"\n  shows \"N (lowpt2 u) \\<le> N v\"\n  using assms\n  (* TODO: Beautify. *)\n  by (smt (verit, best) CollectI UnI2 arg_min_least finite.emptyI finite.insertI finite_UnI insertE insertI1 insert_Diff insert_Diff_single insert_commute insert_not_empty finite_2 lowpt2_def)\n\nfun find_2_aux :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('b \\<times> 'a) list \\<Rightarrow> 'b option\" where\n  \"find_2_aux _ [] = None\" |\n  \"find_2_aux P (p # ps) = (if P (snd p) then Some (fst p) else find_2_aux P ps)\"\n\nlemma find_2_aux_eq_None_iff:\n  shows \"find_2_aux P ps = None \\<longleftrightarrow> \\<not> (\\<exists>p. p \\<in> set ps \\<and> P (snd p))\"\nproof (induct ps)\n  case Nil\n  thus ?case\n    by simp\nnext\n  case (Cons p ps)\n  thus ?case\n    by (fastforce split: if_splits(2))\nqed\n\nlemma find_2_aux_eq_Some_iff:\n  shows\n    \"find_2_aux P ps = Some a \\<longleftrightarrow>\n     (\\<exists>i<length ps. P (snd (ps ! i)) \\<and> a = fst (ps ! i) \\<and> (\\<forall>j<i. \\<not> P (snd (ps ! j))))\"\nproof (induction ps)\n  case Nil\n  thus ?case\n    by simp\nnext\n  case (Cons p ps)\n  thus ?case\n  proof (cases \"P (snd p)\")\n    case True\n    thus ?thesis\n      by force\n  next\n    case False \n    thus ?thesis\n      (* TODO: Beautify. *)\n      by (smt (verit) diff_Suc_1 find_2_aux.simps(2) length_Cons less_Suc_eq_0_disj list.sel(3) local.Cons nat.simps(3) nth_Cons' nth_tl)\n  qed\nqed\n\ndefinition find_2 :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> nat option\" where\n  \"find_2 P l \\<equiv> find_2_aux P (enumerate 0 l)\"\n\nlemma find_2_eq_None_iff:\n  shows \"find_2 P l = None \\<longleftrightarrow> \\<not> (\\<exists>x. x \\<in> set l \\<and> P x)\"\n  unfolding find_2_def enumerate_eq_zip\n  using find_2_aux_eq_None_iff\n  (* TODO: Beautify. *)\n  by (metis add_diff_cancel_left' in_set_impl_in_set_zip2 length_upt prod.collapse set_zip_rightD snd_conv)\n\nlemma find_2_eq_Some_iff:\n  shows \"find_2 P l = Some i \\<longleftrightarrow> (i<length l \\<and> P (l ! i) \\<and> (\\<forall>j<i. \\<not> P (l ! j)))\"\n  unfolding find_2_def enumerate_eq_zip\n  using find_2_aux_eq_Some_iff\n  (* TODO: Beautify. *)\n  by (smt (verit, ccfv_threshold) Nat.add_0_right Pair_inject add.commute add.left_commute add.right_neutral add_cancel_left_left add_lessD1 add_pos_pos enumerate_eq_zip gen_length_def length_code length_enumerate less_add_eq_less less_imp_add_positive nth_enumerate_eq prod.collapse verit_sum_simplify)\n\ndefinition (in steps_1_2_3_high) i\\<^sub>0 :: \"'b \\<Rightarrow> 'b \\<Rightarrow> nat\" where\n  \"i\\<^sub>0 a b \\<equiv>\n   (case find_2 (\\<lambda>v. N a \\<le> N (lowpt1 v)) (children b) of None \\<Rightarrow> length (children b) | Some i \\<Rightarrow> i)\"\n\nlemma (in steps_1_2_3_high) i\\<^sub>0_leq_length_children:\n  shows \"i\\<^sub>0 a b \\<le> length (children b)\"\n  by (auto simp add: i\\<^sub>0_def find_2_eq_Some_iff split: option.split)\n\nlemma (in steps_1_2_3_high) idk_69:\n  shows \"\\<forall>i<i\\<^sub>0 a b. N (lowpt1 (children b ! i)) < N a\"\nproof (cases \"find_2 (\\<lambda>v. N a \\<le> N (lowpt1 v)) (children b)\")\n  case None\n  hence \"\\<not> (\\<exists>v. v \\<in> set (children b) \\<and> N a \\<le> N (lowpt1 v))\"\n    unfolding find_2_eq_None_iff\n    .\n  thus ?thesis\n    by (auto simp add: i\\<^sub>0_def None intro: nth_mem)\nnext\n  case (Some i)\n  hence \"\\<forall>j<i. N (lowpt1 (children b ! j)) < N a\"\n    by (auto simp add: find_2_eq_Some_iff)\n  thus ?thesis\n    by (simp add: i\\<^sub>0_def Some)\nqed\n\nlemma (in steps_1_2_3_high) idk_70:\n  assumes \"sorted_wrt (\\<lambda>u v. N (lowpt1 u) \\<le> N (lowpt1 v)) (children b)\"\n  assumes \"i\\<^sub>0 a b \\<le> i\"\n  assumes \"i < length (children b)\"\n  shows \"N a \\<le> N (lowpt1 (children b ! i))\"\nproof (cases \"find_2 (\\<lambda>v. N a \\<le> N (lowpt1 v)) (children b)\")\n  case None\n  hence \"\\<not> (\\<exists>v. v \\<in> set (children b) \\<and> N a \\<le> N (lowpt1 v))\"\n    unfolding find_2_eq_None_iff\n    .\n  thus ?thesis\n    using assms(2-3)\n    by (auto simp add: i\\<^sub>0_def None)\nnext\n  case Some\n  hence \"N a \\<le> N (lowpt1 (children b ! i\\<^sub>0 a b))\"\n    unfolding find_2_eq_Some_iff\n    by (simp add: i\\<^sub>0_def Some)\n  also have \"... \\<le> N (lowpt1 (children b ! i))\"\n    using assms\n    by (cases \"i\\<^sub>0 a b = i\") (auto intro: sorted_wrt_nth_less)\n  finally show ?thesis\n    .\nqed\n\nlemma (in steps_1_2_3_high) mem_agublagu_lessD:\n  assumes \"b' \\<in> set (agublagu_less b (i\\<^sub>0 a b))\"\n  shows \"N (lowpt1 b') < N a\"\nproof -\n  obtain i where\n    \"i < i\\<^sub>0 a b\"\n    \"agublagu_less b (i\\<^sub>0 a b) ! i = b'\"\n    using assms\n    by (auto simp add: agublagu_less_def in_set_conv_nth)\n  hence\n    \"i < i\\<^sub>0 a b\"\n    \"children b ! i = b'\"\n    by (simp_all add: agublagu_less_def)\n  thus ?thesis\n    using idk_69\n    by fastforce\nqed\n\nlemma (in steps_1_2_3_high) mem_agublagu_lessI:\n  assumes \"sorted_wrt (\\<lambda>u v. N (lowpt1 u) \\<le> N (lowpt1 v)) (children b)\"\n  assumes \"b \\<rightarrow> b'\"\n  assumes \"N (lowpt1 b') < N a\"\n  shows \"b' \\<in> set (agublagu_less b (i\\<^sub>0 a b))\"\nproof -\n  obtain i where\n    i: \"i < length (children b)\"\n    \"children b ! i = b'\"\n    using assms(2)\n    by (fastforce simp add: in_set_conv_nth dest: mem_childrenI)\n  hence \"i < i\\<^sub>0 a b\"\n    using assms(1, 3)\n    by (auto simp add: linorder_not_less dest: idk_70)\n  hence\n    \"i < length (agublagu_less b (i\\<^sub>0 a b))\"\n    \"agublagu_less b (i\\<^sub>0 a b) ! i = b'\"\n    using i\n    by (simp_all add: agublagu_less_def)\n  thus ?thesis\n    by fastforce\nqed\n\nlemma (in steps_1_2_3_high) mem_agublagu_geqD:\n  assumes \"sorted_wrt (\\<lambda>u v. N (lowpt1 u) \\<le> N (lowpt1 v)) (children b)\"\n  assumes \"b' \\<in> set (agublagu_geq b (i\\<^sub>0 a b))\"\n  shows \"N a \\<le> N (lowpt1 b')\"\nproof -\n  obtain i where\n    \"i < length (agublagu_geq b (i\\<^sub>0 a b))\"\n    \"agublagu_geq b (i\\<^sub>0 a b) ! i = b'\"\n    using assms(2)\n    by (auto simp add: in_set_conv_nth)\n  hence\n    \"i\\<^sub>0 a b \\<le> i\\<^sub>0 a b + i\"\n    \"i\\<^sub>0 a b + i < length (children b)\"\n    \"children b ! (i\\<^sub>0 a b + i) = b'\"\n    by (fastforce simp add: agublagu_geq_def)+\n  thus ?thesis\n    using assms(1)\n    by (blast intro: idk_70)\nqed\n\nlemma (in steps_1_2_3_high) mem_agublagu_geqI:\n  assumes \"b \\<rightarrow> b'\"\n  assumes \"N a \\<le> N (lowpt1 b')\"\n  shows \"b' \\<in> set (agublagu_geq b (i\\<^sub>0 a b))\"\nproof -\n  obtain i where\n    i: \"i < length (children b)\"\n    \"children b ! i = b'\"\n    using assms(1)\n    by (fastforce simp add: in_set_conv_nth dest: mem_childrenI)\n  hence \"i\\<^sub>0 a b \\<le> i\"\n    using assms(2) idk_69\n    by (fastforce simp add: linorder_not_less)\n  hence\n    \"i - i\\<^sub>0 a b < length (agublagu_geq b (i\\<^sub>0 a b))\"\n    \"agublagu_geq b (i\\<^sub>0 a b) ! (i - i\\<^sub>0 a b) = b'\"\n    using i\n    by (simp_all add: agublagu_geq_def)\n  thus ?thesis\n    by force\nqed\n\nlemma (in steps_1_2_3_high) mem_fukakyo_lessE:\n  assumes \"v \\<in> fukakyo_less b (i\\<^sub>0 a b)\"\n  obtains b' where\n    \"b \\<rightarrow> b'\"\n    \"b' \\<rightarrow>\\<^sup>* v\"\n    \"N (lowpt1 b') < N a\"\nproof -\n  obtain b' where\n    \"b' \\<in> set (agublagu_less b (i\\<^sub>0 a b))\"\n    \"v \\<in> D b'\"\n    using assms\n    by (auto simp add: fukakyo_less_def)\n  thus ?thesis\n    by\n      (fastforce\n        simp add: agublagu_less_def mem_D_iff_tree_path\n        dest: in_set_takeD mem_childrenD mem_agublagu_lessD\n        intro: that)\nqed\n\nlemma (in steps_1_2_3_high) mem_fukakyo_lessI:\n  assumes \"sorted_wrt (\\<lambda>u v. N (lowpt1 u) \\<le> N (lowpt1 v)) (children b)\"\n  assumes \"b \\<rightarrow> b'\"\n  assumes \"b' \\<rightarrow>\\<^sup>* v\"\n  assumes \"N (lowpt1 b') < N a\"\n  shows \"v \\<in> fukakyo_less b (i\\<^sub>0 a b)\"\n  using assms\n  by (auto simp add: fukakyo_less_def mem_D_iff_tree_path intro: mem_agublagu_lessI)\n\nlemma (in steps_1_2_3_high) mem_fukakyo_geqE:\n  assumes \"sorted_wrt (\\<lambda>u v. N (lowpt1 u) \\<le> N (lowpt1 v)) (children b)\"\n  assumes \"v \\<in> fukakyo_geq b (i\\<^sub>0 a b)\"\n  obtains b' where\n    \"b \\<rightarrow> b'\"\n    \"b' \\<rightarrow>\\<^sup>* v\"\n    \"N a \\<le> N (lowpt1 b')\"\nproof -\nobtain b' where\n    \"b' \\<in> set (agublagu_geq b (i\\<^sub>0 a b))\"\n    \"v \\<in> D b'\"\n    using assms(2)\n    by (auto simp add: fukakyo_geq_def)\n  thus ?thesis\n    using assms(1)\n    by\n      (fastforce\n        simp add: agublagu_geq_def mem_D_iff_tree_path\n        dest: in_set_dropD mem_childrenD mem_agublagu_geqD\n        intro: that)\nqed\n\nlemma (in steps_1_2_3_high) mem_fukakyo_geqI:\n  assumes \"b \\<rightarrow> b'\"\n  assumes \"b' \\<rightarrow>\\<^sup>* v\"\n  assumes \"N a \\<le> N (lowpt1 b')\"\n  shows \"v \\<in> fukakyo_geq b (i\\<^sub>0 a b)\"\n  using assms\n  by (auto simp add: fukakyo_geq_def mem_D_iff_tree_path intro: mem_agublagu_geqI)\n\ndefinition (in steps_1_2_3_high) \\<phi> :: \"'b \\<Rightarrow> 'b \\<Rightarrow> nat\" where\n  \"\\<phi> u v \\<equiv>\n   if u \\<rightarrow> v then if N (lowpt2 v) < N u then 3 * N (lowpt1 v)\n                     else 3 * N (lowpt1 v) + 2\n   else 3 * N v + 1\"\n\nlemma (in steps_1_2_3_high) sorted_wrt_\\<phi>_A:\n  assumes \"sorted_wrt (\\<lambda>e e'. \\<phi> (tail e) (head e) \\<le> \\<phi> (tail e') (head e')) (incidence I v)\"\n  shows \"sorted_wrt (\\<lambda>x y. \\<phi> v x \\<le> \\<phi> v y) (A v)\"\n  using assms\n  by\n    (auto\n      simp add: A_incidence_cong sorted_wrt_map tail_eq\n      intro: sorted_wrt_mono_rel[where ?P = \"\\<lambda>e e'. \\<phi> (tail e) (head e) \\<le> \\<phi> (tail e') (head e')\"])\n\nlemma (in steps_1_2_3_high) sorted_wrt_lowpt1_children:\n  assumes \"sorted_wrt (\\<lambda>e e'. \\<phi> (tail e) (head e) \\<le> \\<phi> (tail e') (head e')) (incidence I v)\"\n  shows \"sorted_wrt (\\<lambda>u v. N (lowpt1 u) \\<le> N (lowpt1 v)) (children v)\"\n  unfolding children_def\n  thm sorted_wrt_mono_rel\nproof (rule sorted_wrt_mono_rel[where ?P = \"\\<lambda>x y. \\<phi> v x \\<le> \\<phi> v y\"], goal_cases)\n  case (1 x y)\n  consider\n    \"N (lowpt2 x) < N v \\<and> N (lowpt2 y) < N v\" |\n    \"N (lowpt2 x) < N v \\<and> N v \\<le> N (lowpt2 y)\" |\n    \"N v \\<le> N (lowpt2 x) \\<and> N (lowpt2 y) < N v\" |\n    \"N v \\<le> N (lowpt2 x) \\<and> N v \\<le> N (lowpt2 y)\"\n    by linarith\n  thus ?case\n    using 1\n    by (cases) (fastforce simp add: children_def[symmetric] \\<phi>_def dest: mem_childrenD)+\nnext\n  case 2\n  show ?case\n    unfolding sorted_wrt_map\n  proof (rule sorted_wrt_mono_rel[where ?P = \"\\<lambda>e e'. \\<phi> (tail e) (head e) \\<le> \\<phi> (tail e') (head e')\"], goal_cases)\n    case (1 e e')\n    thus ?case\n      by (auto simp add: tail_eq)\n  next\n    case 2\n    show ?case\n      using assms\n      by (intro sorted_wrt_filter)\n  qed\nqed\n\nlocale steps_1_2_3_high_2 = steps_1_2_3_high +\n  assumes P1: \"N r = 1\"\n  assumes\n    P2: \"v \\<in> Directed_Multigraph.V (edges_from_fun I) \\<Longrightarrow>\n         N (children v ! i) = N v + sum_list (map ND (agublagu_geq v (i + 1))) + 1\"\n    (* assumes P2: \"v \\<in> Directed_Multigraph.V (edges_from_fun I) \\<Longrightarrow> N (children v ! i) = N v + card (fukakyo_geq v (i + 1)) + 1\" *)\n    (* QUESTION: Is this going to cause issues with Sorted_Less.sorted (incidence v G)? *)\n  assumes P3: \"sorted_wrt (\\<lambda>e e'. \\<phi> (tail e) (head e) \\<le> \\<phi> (tail e') (head e')) (incidence I v)\"\n\nlocale steps_1_2_3_high_3 =\n  biconnected_multigraph\n  where G = G +\n    steps_1_2_3_high_2\n  where T = T\n  for G :: \"('a, 'b) Multigraph.multigraph\"\n    and T :: \"'b \\<rightharpoonup> 'a \\<times> 'b\" +\n  assumes undirect_edges_from_fun_eq: \"undirect ` edges_from_fun I = G\"\nbegin\nsublocale palm_tree_of_2 r T other I G\nproof (standard, goal_cases)\n  case 1\n  show ?case\n    using undirect_edges_from_fun_eq\n    .\nqed\nend\n\nlemma (in steps_1_2_3_high_3) V_E_I_eq_V_G:\n  shows \"Directed_Multigraph.V (edges_from_fun I) = Multigraph.V G\"\n  using V_image_undirect_eq[symmetric]\n  unfolding undirect_P_eq_G[symmetric]\n  .\n\nlemma (in steps_1_2_3_high_2) N_less_if_tree_arc':\n  assumes \"u \\<rightarrow> v\"\n  shows \"N u < N v\"\nproof -\n  obtain i where\n    \"i < length (children u)\"\n    \"(children u) ! i = v\"\n    using assms\n    by (fastforce simp add: in_set_conv_nth dest: mem_childrenI)\n  thus ?thesis\n    using assms\n    by (auto simp add: P2 dest: tail_tree_arc'_mem_V)\nqed\n\nlemma (in steps_1_2_3_high_2) N_less_if_non_empty_tree_path:\n  assumes \"u \\<rightarrow>\\<^sup>+ v\"\n  shows \"N u < N v\"\n  using assms\n  unfolding non_empty_tree_path_def\n  by (induct rule: trancl.induct) (auto dest: N_less_if_tree_arc')\n\nlemma (in steps_1_2_3_high_2) N_leq_if_tree_path:\n  assumes \"u \\<rightarrow>\\<^sup>* v\"\n  shows \"N u \\<le> N v\"\n  using assms\n  by (auto simp add: tree_path_non_empty_tree_path_cong dest: N_less_if_non_empty_tree_path)\n\n(* TODO: Beautify. *)\nlemma (in steps_1_2_3_high_2) N_lowpt1_tree_arc':\n  assumes \"u \\<rightarrow> v\"\n  shows \"N (lowpt1 u) \\<le> N (lowpt1 v)\"\n  using assms\n  by (metis N_less_if_tree_arc' N_lowpt1_least N_lowpt1_leq lowpt1 order.strict_implies_order order.strict_trans1 tree_path_if_tree_arc' tree_path_snoc_frond'I_2)\n\nlemma (in steps_1_2_3_high_2) N_lowpt1_frond':\n  assumes \"frond' u v\"\n  shows \"N (lowpt1 u) \\<le> N v\"\n  using assms\n  by (force dest: tree_path_snoc_frond'_if_frond' N_lowpt1_least)\n\nlemma (in steps_1_2_3_high) mem_fukakyo_geq_1:\n  assumes \"sorted_wrt (\\<lambda>u v. N (lowpt1 u) \\<le> N (lowpt1 v)) (children b)\"\n  assumes \"b \\<rightarrow> b'\"\n  assumes \"b' \\<rightarrow>\\<^sup>* v\"\n  shows \"v \\<in> fukakyo_geq b (i\\<^sub>0 a b) \\<longleftrightarrow> N a \\<le> N (lowpt1 b')\"\nproof (standard, goal_cases)\n  case 1\n  then obtain b'' where\n    b'': \"b \\<rightarrow> b''\"\n    \"b'' \\<rightarrow>\\<^sup>* v\"\n    \"N a \\<le> N (lowpt1 b'')\"\n    using assms(1)\n    by (elim mem_fukakyo_geqE)\n  hence \"b'' = b'\"\n    using assms(2, 3)\n    by (fastforce simp add: mem_D_iff_tree_path dest: disjoint_siblings)\n  thus ?case\n    using b''(3)\n    by simp\nnext\n  case 2\n  thus ?case\n    using assms(2, 3)\n    by (intro mem_fukakyo_geqI)\nqed\n\ndefinition (in steps_1_2_3_high) is_type_1_pair where\n  \"is_type_1_pair a b s t \\<equiv>\n   b \\<noteq> a \\<and>\n   s \\<noteq> a \\<and>\n   b \\<rightarrow> s \\<and>\n   lowpt1 s = a \\<and>\n   N b \\<le> N (lowpt2 s) \\<and>\n   t \\<in> Directed_Multigraph.V (edges_from_fun I) \\<and>\n   t \\<noteq> a \\<and>\n   t \\<noteq> b \\<and>\n   t \\<notin> D s\"\n\nlemma (in steps_1_2_3_high_2) is_type_1_pairD:\n  assumes \"is_type_1_pair a b s t\"\n  shows\n    \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"b \\<noteq> a\"\n    \"s \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"s \\<noteq> a\"\n    \"s \\<noteq> b\"\n    \"b \\<rightarrow> s\"\n    \"lowpt1 s = a\"\n    \"N b \\<le> N (lowpt2 s)\"\n    \"t \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"t \\<noteq> a\"\n    \"t \\<noteq> b\"\n    \"t \\<notin> D s\"\nproof -\n  show\n    \"b \\<noteq> a\"\n    \"s \\<noteq> a\"\n    \"b \\<rightarrow> s\"\n    \"lowpt1 s = a\"\n    \"N b \\<le> N (lowpt2 s)\"\n    \"t \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"t \\<noteq> a\"\n    \"t \\<noteq> b\"\n    \"t \\<notin> D s\"\n    using assms\n    by (simp_all add: is_type_1_pair_def)\n  thus\n    \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"s \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"s \\<noteq> b\"\n    by (auto dest: N_less_if_tree_arc' intro: lowpt1_mem_V tail_tree_arc'_mem_V head_tree_arc'_mem_V)\nqed\n\nlemma (in steps_1_2_3_high) is_type_1_pairI:\n  assumes\n    \"b \\<noteq> a\"\n    \"s \\<noteq> a\"\n    \"b \\<rightarrow> s\"\n    \"lowpt1 s = a\"\n    \"N b \\<le> N (lowpt2 s)\"\n    \"t \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"t \\<noteq> a\"\n    \"t \\<noteq> b\"\n    \"t \\<notin> D s\"\n  shows \"is_type_1_pair a b s t\"\n  using assms\n  by (simp add: is_type_1_pair_def)\n\ndefinition (in steps_1_2_3_high) is_type_1_pair' where\n  \"is_type_1_pair' a b \\<equiv> \\<exists>s t. is_type_1_pair a b s t\"\n\nlemma (in steps_1_2_3_high_2) is_type_1_pair'D:\n  assumes \"is_type_1_pair' a b\"\n  shows\n    \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"b \\<noteq> a\"\n  using assms\n  by (auto simp add: is_type_1_pair'_def dest: is_type_1_pairD(1-3))\n\nlemma (in steps_1_2_3_high_2) is_type_1_pair'E:\n  assumes \"is_type_1_pair' a b\"\n  obtains s t where\n    \"s \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"s \\<noteq> a\"\n    \"s \\<noteq> b\"\n    \"b \\<rightarrow> s\"\n    \"lowpt1 s = a\"\n    \"N b \\<le> N (lowpt2 s)\"\n    \"t \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"t \\<noteq> a\"\n    \"t \\<noteq> b\"\n    \"t \\<notin> D s\"\n  using assms\n  by (auto simp add: is_type_1_pair'_def dest: is_type_1_pairD)\n\nlemma (in steps_1_2_3_high) is_type_1_pair'I:\n  assumes \"b \\<noteq> a\"\n  assumes \"s \\<noteq> a\"\n  assumes \"b \\<rightarrow> s\"\n  assumes \"lowpt1 s = a\"\n  assumes \"N b \\<le> N (lowpt2 s)\"\n  assumes \"t \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"t \\<noteq> a\"\n  assumes \"t \\<noteq> b\"\n  assumes \"t \\<notin> D s\"\n  shows \"is_type_1_pair' a b\"\n  using assms\n  by (auto simp add: is_type_1_pair'_def intro: is_type_1_pairI)\n\ndefinition (in steps_1_2_3_high) first_child :: \"'b \\<Rightarrow> 'b option\" where\n  \"first_child u \\<equiv> case (children u) of Nil \\<Rightarrow> None | (v # vs) \\<Rightarrow> Some v\"\n\nlemma (in steps_1_2_3_high) first_child_cong:\n  shows \"first_child v = (if children v = [] then None else Some (hd (children v)))\"\n  by (cases \"children v\") (simp_all add: first_child_def)+\n\nlemma (in steps_1_2_3_high) first_child_eq_SomeD:\n  assumes \"first_child u = Some v\"\n  shows\n    \"children u \\<noteq> []\"\n    \"children u ! 0 = v\"\n  using assms\n  by (fastforce simp add: first_child_cong hd_conv_nth split: if_splits(2))+\n\n(* QUESTION: Should we use trancl instead of rtrancl? *)\ndefinition (in steps_1_2_3_high) first_descendant :: \"'b \\<Rightarrow> 'b \\<Rightarrow> bool\" where\n  \"first_descendant u v \\<equiv> (u, v) \\<in> {(u, v). first_child u = Some v}\\<^sup>*\"\n\nlemma (in steps_1_2_3_high) first_descendant_refl:\n  shows \"first_descendant v v\"\n  by (simp add: first_descendant_def)\n\nlemma (in steps_1_2_3_high) first_child_imp_tree_arc':\n  assumes \"first_child u = Some v\"\n  shows \"u \\<rightarrow> v\"\n  using assms\n  by (auto simp add: first_child_cong dest: hd_in_set mem_childrenD split: if_splits(2))\n\nlemma (in steps_1_2_3_high) first_descendant_imp_tree_path:\n  assumes \"first_descendant u v\"\n  shows \"u \\<rightarrow>\\<^sup>* v\"\nproof -\n  have \"{(u, v). first_child u = Some v}\\<^sup>* \\<subseteq> {(u, v). u \\<rightarrow> v}\\<^sup>*\"\n    using first_child_imp_tree_arc'\n    by (intro rtrancl_mono) blast\n  thus ?thesis\n    using assms\n    by (auto simp add: first_descendant_def tree_path_def)\nqed\n\nlemma (in steps_1_2_3_high) first_descendant_transitive:\n  assumes \"first_descendant u v\"\n  assumes \"first_descendant v w\"\n  shows \"first_descendant u w\"\n  using assms\n  by (simp add: first_descendant_def)\n\nlemma (in steps_1_2_3_high) first_descendant_imp_walk_aux:\nassumes \"u \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"first_descendant u v\"\n  shows \"\\<exists>p. walk (edges_from_map T) p u v \\<and> (\\<forall>e\\<in>set p. first_child (tail e) = Some (head e))\"\n  using assms(2)\n  unfolding first_descendant_def\n  using assms(1)\nproof (induct rule: rtrancl.induct)\n  case (rtrancl_refl a)\n  thus ?case\n    by (auto simp add: V_eq dest: walk_Nil)\nnext\n  case (rtrancl_into_rtrancl u v w)\n  then obtain p where\n    \"walk (edges_from_map T) p u v\"\n    \"\\<forall>e\\<in>set p. first_child (tail e) = Some (head e)\"\n    by blast\n  moreover obtain e where\n    \"e \\<in> (edges_from_map T)\"\n    \"Directed_Multigraph.endpoints e = (v, w)\"\n    using rtrancl_into_rtrancl.hyps(3)\n    by (fastforce simp add: tree_arc'_iff_mem_endpoints dest: first_child_imp_tree_arc')\n  ultimately have\n    \"walk (edges_from_map T) (p @ [e]) u w\"\n    \"\\<forall>e\\<in>set (p @ [e]). first_child (tail e) = Some (head e)\"\n    using rtrancl_into_rtrancl.hyps(3)\n    by (auto simp add: walk_snoc_iff head_def tail_def)\n  thus ?case\n    by fast\nqed\n\nlemma (in steps_1_2_3_high) first_descendant_imp_walk:\n  assumes \"u \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"first_descendant u v\"\n  obtains p where\n    \"walk (edges_from_map T) p u v\"\n    \"\\<forall>e\\<in>set p. first_child (tail e) = Some (head e)\"\n  using assms\n  by (blast dest: first_descendant_imp_walk_aux)\n\nlemma (in steps_1_2_3_high) first_descendant_if_walk:\n  assumes \"walk (edges_from_map T) p u v\"\n  assumes \"\\<forall>e\\<in>set p. first_child (tail e) = Some (head e)\"\n  shows \"first_descendant u v\"\n  using assms\nproof (induct p arbitrary: u)\n  case Nil\n  thus ?case\n    using first_descendant_refl\n    by (simp add: walk_Nil_iff)\nnext\n  case (Cons e es)\n  let ?x = \"head e\"\n  show ?case\n  proof (rule first_descendant_transitive[where ?v = ?x], goal_cases)\n    case 1\n    then show ?case\n      using Cons.prems\n      by (auto simp add: walk_Cons_iff first_descendant_def)\n  next\n    case 2\n    show ?case\n      using Cons.prems\n      by (auto simp add: walk_Cons_iff intro: Cons.hyps)\n  qed\nqed\n\nlemma (in steps_1_2_3_high) first_descendant_pref:\n  assumes \"first_descendant u w\"\n  assumes \"u \\<rightarrow>\\<^sup>* v\"\n  assumes \"v \\<rightarrow>\\<^sup>* w\"\n  shows \"first_descendant u v\"\n  using assms\nproof (cases \"u \\<in> Directed_Multigraph.V (edges_from_fun I)\")\n  case True\n  then obtain p where\n    p: \"walk (edges_from_map T) p u w\"\n    \"\\<forall>e\\<in>set p. first_child (tail e) = Some (head e)\"\n    using assms(1)\n    by (elim first_descendant_imp_walk)\n  obtain p1 where\n    p1: \"walk (edges_from_map T) p1 u v\"\n    using True assms(2)\n    by (auto simp add: V_eq elim: tree_path_imp_walk)\n  then obtain p2 where\n    p2: \"walk (edges_from_map T) p2 v w\"\n    using assms(3)\n    by (blast dest: last_vertex_mem_V elim: tree_path_imp_walk)\n  have \"p1 @ p2 = p\"\n    using p1 p2 p(1)\n    by (intro unique_walk_3)\n  thus ?thesis\n    using p1 p(2)\n    by (force dest: first_descendant_if_walk)\nnext\n  case False\n  hence \"u = v\"\n    using assms(2)\n    by (auto simp add: tree_path_non_empty_tree_path_cong dest: hd_non_empty_tree_path_mem_V)\n  thus ?thesis\n    using first_descendant_refl\n    by auto\nqed\n\nlemma (in steps_1_2_3_high) first_descendant_suf:\n  assumes \"first_descendant u w\"\n  assumes \"u \\<rightarrow>\\<^sup>* v\"\n  assumes \"v \\<rightarrow>\\<^sup>* w\"\n  shows \"first_descendant v w\"\n  using assms\nproof (cases \"u \\<in> Directed_Multigraph.V (edges_from_fun I)\")\n  case True\n  then obtain p where\n    p: \"walk (edges_from_map T) p u w\"\n    \"\\<forall>e\\<in>set p. first_child (tail e) = Some (head e)\"\n    using assms(1)\n    by (elim first_descendant_imp_walk)\n  obtain p1 where\n    p1: \"walk (edges_from_map T) p1 u v\"\n    using True assms(2)\n    by (auto simp add: V_eq elim: tree_path_imp_walk)\n  then obtain p2 where\n    p2: \"walk (edges_from_map T) p2 v w\"\n    using assms(3)\n    by (blast dest: last_vertex_mem_V elim: tree_path_imp_walk)\n  have \"p1 @ p2 = p\"\n    using p1 p2 p(1)\n    by (intro unique_walk_3)\n  thus ?thesis\n    using p2 p(2)\n    by (force dest: first_descendant_if_walk)\nnext\n  case False\n  hence \"v = w\"\n    using assms(2, 3)\n    by (auto simp add: tree_path_non_empty_tree_path_cong dest: hd_non_empty_tree_path_mem_V)\n  thus ?thesis\n    using first_descendant_refl\n    by auto\nqed\n\ndefinition (in steps_1_2_3_high) is_type_2_pair where\n  \"is_type_2_pair a b s \\<equiv>\n   N a \\<noteq> 1 \\<and>\n   (\\<forall>b' x y. frond' x y \\<and> N a < N y \\<and> N y < N b \\<and> b \\<rightarrow> b' \\<and> b' \\<rightarrow>\\<^sup>* x \\<longrightarrow> N a \\<le> N (lowpt1 b')) \\<and>\n   s \\<noteq> b \\<and>\n   a \\<rightarrow> s \\<and>\n   first_descendant s b \\<and>\n   (\\<forall>x y. frond' x y \\<and> N s \\<le> N x \\<and> N x < N b \\<longrightarrow> N a \\<le> N y)\"\n\nlemma (in steps_1_2_3_high_2) is_type_2_pairD:\n  assumes \"is_type_2_pair a b s\"\n  shows\n    \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"N a \\<noteq> 1\"\n    \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"\\<forall>b' x y. frond' x y \\<and> N a < N y \\<and> N y < N b \\<and> b \\<rightarrow> b' \\<and> b' \\<rightarrow>\\<^sup>* x \\<longrightarrow> N a \\<le> N (lowpt1 b')\"\n    \"s \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"s \\<noteq> a\"\n    \"s \\<noteq> b\"\n    \"a \\<rightarrow> s\"\n    \"s \\<rightarrow>\\<^sup>* b\"\n    \"first_descendant s b\"\n    \"\\<forall>x y. frond' x y \\<and> N s \\<le> N x \\<and> N x < N b \\<longrightarrow> N a \\<le> N y\"\nproof -\n  show\n    \"N a \\<noteq> 1\"\n    \"\\<forall>b' x y. frond' x y \\<and> N a < N y \\<and> N y < N b \\<and> b \\<rightarrow> b' \\<and> b' \\<rightarrow>\\<^sup>* x \\<longrightarrow> N a \\<le> N (lowpt1 b')\"\n    \"s \\<noteq> b\"\n    \"a \\<rightarrow> s\"\n    \"first_descendant s b\"\n    \"\\<forall>x y. frond' x y \\<and> N s \\<le> N x \\<and> N x < N b \\<longrightarrow> N a \\<le> N y\"\n    using assms\n    by (simp_all add: is_type_2_pair_def)\n  thus\n    \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"s \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"s \\<noteq> a\"\n    \"s \\<rightarrow>\\<^sup>* b\"\n    by\n      (force\n        simp add: tree_path_non_empty_tree_path_cong\n        dest: tail_tree_arc'_mem_V first_descendant_imp_tree_path last_non_empty_tree_path_mem_V head_tree_arc'_mem_V N_less_if_tree_arc')+\nqed\n\nlemma (in steps_1_2_3_high) is_type_2_pairI:\n  assumes \"N a \\<noteq> 1\"\n  assumes \"\\<forall>b' x y. frond' x y \\<and> N a < N y \\<and> N y < N b \\<and> b \\<rightarrow> b' \\<and> b' \\<rightarrow>\\<^sup>* x \\<longrightarrow> N a \\<le> N (lowpt1 b')\"\n  assumes \"s \\<noteq> b\"\n  assumes \"a \\<rightarrow> s\"\n  assumes \"first_descendant s b\"\n  assumes \"\\<forall>x y. frond' x y \\<and> N s \\<le> N x \\<and> N x < N b \\<longrightarrow> N a \\<le> N y\"\n  shows \"is_type_2_pair a b s\"\n  using assms\n  by (simp add: is_type_2_pair_def)\n\ndefinition (in steps_1_2_3_high) is_type_2_pair' where\n  \"is_type_2_pair' a b \\<equiv> \\<exists>s. is_type_2_pair a b s\"\n\nlemma (in steps_1_2_3_high_2) is_type_2_pair'D:\n  assumes \"is_type_2_pair' a b\"\n  shows\n    \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"N a \\<noteq> 1\"\n    \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"\\<forall>b' x y. frond' x y \\<and> N a < N y \\<and> N y < N b \\<and> b \\<rightarrow> b' \\<and> b' \\<rightarrow>\\<^sup>* x \\<longrightarrow> N a \\<le> N (lowpt1 b')\"\n  using assms\n  by (auto simp add: is_type_2_pair'_def dest: is_type_2_pairD(1-4))\n\nlemma (in steps_1_2_3_high_2) is_type_2_pair'E:\n  assumes \"is_type_2_pair' a b\"\n  obtains s where\n    \"s \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"s \\<noteq> a\"\n    \"s \\<noteq> b\"\n    \"a \\<rightarrow> s\"\n    \"s \\<rightarrow>\\<^sup>* b\"\n    \"first_descendant s b\"\n    \"\\<forall>x y. frond' x y \\<and> N s \\<le> N x \\<and> N x < N b \\<longrightarrow> N a \\<le> N y\"\n  using assms\n  by (auto simp add: is_type_2_pair'_def dest: is_type_2_pairD(5-))\n\nlemma (in steps_1_2_3_high) is_type_2_pair'I:\n  assumes \"N a \\<noteq> 1\"\n  assumes \"\\<forall>b' x y. frond' x y \\<and> N a < N y \\<and> N y < N b \\<and> b \\<rightarrow> b' \\<and> b' \\<rightarrow>\\<^sup>* x \\<longrightarrow> N a \\<le> N (lowpt1 b')\"\n  assumes \"s \\<noteq> b\"\n  assumes \"a \\<rightarrow> s\"\n  assumes \"first_descendant s b\"\n  assumes \"\\<forall>x y. frond' x y \\<and> N s \\<le> N x \\<and> N x < N b \\<longrightarrow> N a \\<le> N y\"\n  shows \"is_type_2_pair' a b\"\n  using assms\n  unfolding is_type_2_pair'_def\n  by (blast intro: is_type_2_pairI)\n\nlemma (in steps_1_2_3_high) lemma_5_1:\n  shows \"length (children r) \\<le> 1\"\n  sorry\n\nlemma (in steps_1_2_3_high) lemma_5_2:\n  assumes \"u \\<noteq> r\"\n  assumes \"u \\<rightarrow> v\"\n  shows \"N (lowpt1 v) < N u\"\n  sorry\n\nlemma (in steps_1_2_3_high) lemma_5_3:\n  assumes \"r \\<rightarrow> v\"\n  shows \"lowpt1 v = r\"\n  sorry\n\nlemma idk_10:\n  fixes xs :: \"nat list\"\n  assumes \"n < sum_list xs\"\n  obtains i where\n    \"i < length xs\"\n    \"sum_list (drop (Suc i) xs) \\<le> n\"\n    \"n < sum_list (drop i xs)\"\n  using assms\nproof (induct xs arbitrary: i)\n  case Nil\n  thus ?case\n    by force\nnext\n  case (Cons x xs)\n  thus ?case\n    (* TODO: Beautify. *)\n    by (metis drop0 drop_Suc_Cons length_Cons linorder_le_less_linear not_less_eq zero_less_Suc)\nqed\n\nlemma (in steps_1_2_3_high_2) lemma_6_i_1:\n  assumes \"u \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  shows \"D u = {x \\<in> Directed_Multigraph.V (edges_from_fun I). N u \\<le> N x \\<and> N x < N u + ND u}\"\n  using assms\nproof (induct \"ND u\" arbitrary: u rule: less_induct)\n  case less\n  { fix v\n    assume assm: \"v \\<in> set (children u)\"\n    have\n      \"ND v < ND u\"\n      \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    proof -\n      show \"ND v < ND u\"\n        using finite_D assm\n        by\n          (fastforce\n            simp add: ND_def\n            dest: mem_childrenD non_empty_tree_path_if_tree_arc' D_subsetI_2\n            intro: psubset_card_mono)\n      show \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n        using assm\n        by (blast dest: mem_childrenD head_tree_arc'_mem_V)\n    qed }\n  hence\n    \"D u =\n     {u} \\<union>\n     (\\<Union>i<length (children u).\n         {x \\<in> Directed_Multigraph.V (edges_from_fun I).\n          N (children u ! i) \\<le> N x \\<and> N x < N (children u ! i) + ND (children u ! i)})\"\n    by (auto simp add: D_children_cong[of u, symmetric] less.hyps set_conv_nth)\n  also have\n    \"... =\n     {u} \\<union>\n     (\\<Union>i<length (children u).\n         {x \\<in> Directed_Multigraph.V (edges_from_fun I).\n          N u + sum_list (map ND (agublagu_geq u (i + 1))) + 1 \\<le> N x \\<and>\n          N x < N u + sum_list (map ND (agublagu_geq u (i + 1))) + 1 + ND (children u ! i)})\"\n    using less.prems\n    by (simp add: P2)\n  also have\n    \"... =\n     {u} \\<union>\n     (\\<Union>i<length (children u).\n         {x \\<in> Directed_Multigraph.V (edges_from_fun I).\n          N u + sum_list (map ND (agublagu_geq u (i + 1))) + 1 \\<le> N x \\<and>\n          N x < N u + sum_list (map ND (agublagu_geq u i)) + 1})\"\n  proof -\n    { fix i\n      assume \"i < length (children u)\"\n      hence\n        \"sum_list (map ND (agublagu_geq u i)) =\n         sum_list (map ND (children u ! i # agublagu_geq u (i + 1)))\"\n        by (simp add: agublagu_geq_def Cons_nth_drop_Suc)\n      hence\n        \"sum_list (map ND (agublagu_geq u (i + 1))) + ND (children u ! i) =\n         sum_list (map ND (agublagu_geq u i))\"\n        by fastforce }\n    thus ?thesis\n      by fastforce\n  qed\n  also have\n    \"... =\n     {u} \\<union>\n     {x \\<in> Directed_Multigraph.V (edges_from_fun I). N u + 1 \\<le> N x \\<and> N x < N u + ND u}\"\n    (is \"{u} \\<union> ?A = {u} \\<union> ?B\")\n  proof -\n    { fix x\n      assume assm: \"x \\<in> ?A\"\n      then obtain i where\n        \"N x < N u + sum_list (map ND (agublagu_geq u i)) + 1\"\n        by blast\n      hence \"N x < N u + ND u\"\n        by (simp add: idk_5[of u i, symmetric])\n      hence \"x \\<in> ?B\"\n        using assm\n        by force }\n    moreover { fix x\n      assume assm: \"x \\<in> ?B\"\n      hence \"N x < N u + sum_list (map ND (children u)) + 1\"\n        by (simp add: ND_children_cong[symmetric])\n      hence \"N x - N u - 1 < sum_list (map ND (children u))\"\n        using assm\n        by fastforce\n      then obtain i where\n        \"i < length (children u)\"\n        \"N u + sum_list (map ND (agublagu_geq u (i + 1))) + 1 \\<le> N x\"\n        \"N x < N u + sum_list (map ND (agublagu_geq u i)) + 1\"\n        using assm\n        by\n          (fastforce\n            simp add: agublagu_geq_def\n            elim: idk_10[of \"N x - N u - 1\" \"map ND (children u)\", unfolded drop_map])\n      hence \"x \\<in> ?A\"\n        using assm\n        by blast }\n    ultimately show ?thesis\n      by blast\n  qed\n  also have\n    \"... =\n     {x \\<in> Directed_Multigraph.V (edges_from_fun I). N u \\<le> N x \\<and> N x < N u + ND u}\"\n    using less.prems ND_greater_0\n    by (fastforce simp add: N_eq_iff[symmetric])\n  finally show ?case\n    .\nqed\n\nlemma (in steps_1_2_3_high_2) lemma_6_i_2_aux:\n  assumes \"u \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"first_descendant u v\"\n  shows\n    \"D v =\n     {x \\<in> Directed_Multigraph.V (edges_from_fun I). N v \\<le> N x \\<and> N x < N u + ND u}\"\nproof -\n  obtain p where\n    \"walk (edges_from_map T) p u v\"\n    \"\\<forall>e\\<in>set p. first_child (tail e) = Some (head e)\"\n    using assms\n    by (elim first_descendant_imp_walk)\n  thus ?thesis\n    using assms\n  proof (induct p arbitrary: u)\n    case Nil\n    thus ?case\n      using walk_Nil_iff\n      by (simp add: walk_Nil_iff lemma_6_i_1)\n  next\n    case (Cons e es)\n    let ?x = \"head e\"\n    have\n      \"D v =\n       {x \\<in> Directed_Multigraph.V (edges_from_fun I).\n        N v \\<le> N x \\<and> N x < N (head e) + ND ?x}\"\n    proof (intro Cons.hyps)\n      show\n        \"walk (edges_from_map T) es ?x v\"\n        \"\\<forall>e\\<in>set es. first_child (tail e) = Some (head e)\"\n        \"?x \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n        using Cons.prems(1, 2)\n        by (auto simp add: walk_Cons_iff V_eq dest: head_mem_V)\n      thus \"first_descendant ?x v\"\n        by (intro first_descendant_if_walk)\n    qed\n    thm P2\n    also have\n      \"... =\n       {x \\<in> Directed_Multigraph.V (edges_from_fun I).\n        N v \\<le> N x \\<and> N x < N u + sum_list (map ND (agublagu_geq u 1)) + 1 + ND ?x}\"\n    proof -\n      have \"?x = children u ! 0\"\n        using Cons.prems(1, 2)\n        by (auto simp add: walk_Cons_iff dest: first_child_eq_SomeD(2))\n      thus ?thesis\n        using Cons.prems(3)\n        by (simp add: P2)\n    qed\n    also have\n      \"... =\n       {x \\<in> Directed_Multigraph.V (edges_from_fun I).\n        N v \\<le> N x \\<and> N x < N u + sum_list (map ND (agublagu_geq u 1)) + 1 + sum_list (map ND (agublagu_less u 1))}\"\n    proof -\n      have\n        \"children u \\<noteq> []\"\n        \"children u ! 0 = ?x\"\n        using Cons.prems(1, 2)\n        by (auto simp add: walk_Cons_iff dest: first_child_eq_SomeD)\n      hence \"sum_list (map ND (agublagu_less u 1)) = ND ?x\"\n        by (simp add: agublagu_less_def take_Suc hd_conv_nth)\n      thus ?thesis\n        by presburger\n    qed\n    also have\n      \"... =\n       {x \\<in> Directed_Multigraph.V (edges_from_fun I). N v \\<le> N x \\<and> N x < N u + ND u}\"\n      unfolding idk_5[of u 1, symmetric]\n      by fastforce\n    finally show ?case\n      .\n  qed\nqed\n\nlemma (in steps_1_2_3_high_2) lemma_6_i_2:\n  assumes \"u \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"first_descendant u v\"\n  shows\n    \"D u - D v =\n     {x \\<in> Directed_Multigraph.V (edges_from_fun I). N u \\<le> N x \\<and> N x < N v}\"\nproof -\n  have\n    \"D u - D v =\n     {x \\<in> Directed_Multigraph.V (edges_from_fun I). N u \\<le> N x \\<and> N x < N u + ND u} -\n     {x \\<in> Directed_Multigraph.V (edges_from_fun I). N v \\<le> N x \\<and> N x < N u + ND u}\"\n    using assms first_descendant_refl\n    by (simp add: lemma_6_i_2_aux)\n  also have\n    \"... =\n     {x \\<in> Directed_Multigraph.V (edges_from_fun I). N u \\<le> N x \\<and> N x < N v}\"\n  proof -\n    have \"v \\<in> D u\"\n      using assms(2)\n      by (auto simp add: mem_D_iff_tree_path dest: first_descendant_imp_tree_path)\n    hence \"N v < N u + ND u\"\n      using assms(1) first_descendant_refl\n      by (simp add: lemma_6_i_2_aux)\n    thus ?thesis\n      by force\n  qed\n  finally show ?thesis\n    .\nqed\n\n(**)\n\n(* TODO: Move. *)\nlemma (in steps_1_2_3_high_2) neq_rI:\n  assumes \"u \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"N u < N v\"\n  shows \"v \\<noteq> r\"\n  using assms P1\n  by (fastforce dest: N_geq_1)\n\nlemma (in steps_1_2_3_high_3) idk_52:\n  assumes \"u \\<rightarrow> v\"\n  shows \"Multigraph.V (Multigraph.E G (D v)) \\<subseteq> D v \\<union> {u} \\<union> {x. tree_path_snoc_frond' v x}\"\nproof -\n  { fix x\n    assume\n      assm: \"x \\<in> Multigraph.V (Multigraph.E G (D v))\"\n      \"\\<not> v \\<rightarrow>\\<^sup>* x\"\n      \"x \\<noteq> u\"\n      \"\\<not> tree_path_snoc_frond' v x\"\n    obtain y where\n      y: \"{x, y} \\<in> Multigraph.endpoints ` G\"\n      \"v \\<rightarrow>\\<^sup>* y\"\n    proof -\n      obtain y where\n        \"{x, y} \\<in> Multigraph.endpoints ` Multigraph.E G (D v)\"\n        \"y \\<in> D v\"\n        using assm(1-2)\n        by\n          (auto\n            simp add: undirect_P_eq_G[symmetric] mem_D_iff_tree_path[symmetric]\n            intro: mem_V_EE)\n      thus ?thesis\n        using E_subset\n        by (fastforce simp add: mem_D_iff_tree_path intro: that)\n    qed\n    hence False\n    proof (cases rule: cases_edge)\n      case tree_arc_1\n      hence \"v = y\"\n        using y(2) assm(2)\n        by (blast dest: unique_tree_path_3)\n      thus ?thesis\n        using tree_arc_1 assms assm(3)\n        by (blast dest: unique_tree_path_4)\n    next\n      case tree_arc_2\n      thus ?thesis\n        using y(2) assm(2)\n        by (blast dest: tree_path_if_tree_arc' tree_path_trans)\n    next\n      case frond_1\n      hence \"y \\<rightarrow>\\<^sup>* x\"\n        by (blast dest: frond'_imp_tree_path)\n      thus ?thesis\n        using y(2) assm(2)\n        by (blast dest: tree_path_trans)\n    next\n      case frond_2\n      thus ?thesis\n        using y(2) assm(4)\n        by (blast dest: tree_path_snoc_frond'I)\n    qed }\n  thus ?thesis\n    by (fastforce simp add: mem_D_iff_tree_path)\n  thm P3\nqed\n\nlemma (in steps_1_2_3_high_2) P3_2:\n  shows \"linorder_class.sorted (map (\\<lambda>e. \\<phi> (tail e) (head e)) (incidence I v))\"\n  using P3\n  by (simp add: sorted_map)\n\n(* TODO: Beautify. *)\nlemma idk_99:\n  assumes \"linorder_class.sorted l\"\n  assumes \"x \\<in> set l\"\n  shows \"hd l \\<le> x\"\n  using assms\n  by (metis list.exhaust list.sel(1) nle_le set_ConsD sorted_simps(2) sorted_wrt1)\n\n(* TODO: Beautify. *)\nlemma idk_100:\n  assumes \"linorder_class.sorted (map f l)\"\n  assumes \"x \\<in> set l\"\n  shows \"f (hd l) \\<le> f x\"\n  using assms\n  by (metis empty_iff idk_99 image_eqI list.map_sel(1) list.set(1) list.set_map)\n\nlemma (in steps_1_2_3_high_2) lowpt1_cong:\n  assumes \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  shows\n    \"lowpt1 v =\n     (case incidence I v of\n      [] \\<Rightarrow> v |\n      e # es \\<Rightarrow> if tree_arc e then lowpt1 (head e) else head e)\"\nproof -\n  show ?thesis\n  proof (cases \"incidence I v\")\n    case Nil\n    { assume \"lowpt1 v \\<noteq> v\"\n      then consider\n        (frond') \"frond' v (lowpt1 v)\" |\n        (tree_arc') \"\\<exists>x. v \\<rightarrow> x \\<and> tree_path_snoc_frond' x (lowpt1 v)\"\n        using lowpt1\n        by (blast dest: tree_path_snoc_frond'_10)\n      hence False\n        (* TODO: Beautify. *)\n        using Nil\n        by (cases) (metis Directed_Multigraph.endpoints_def edge_iff empty_iff fst_conv list.set(1) mem_edges_from_funE snd_conv tail_def tail_eq)+ }\n    thus ?thesis\n      using Nil\n      by auto\n  next\n    case (Cons e es)\n    show ?thesis\n    proof (cases \"tree_arc e\")\n      case True\n      hence tree_arc': \"v \\<rightarrow> head e\"\n        unfolding tail_eq[OF list.set_intros(1)[of e es, unfolded Cons[symmetric]], symmetric]\n        by (intro tree_arc'I)\n      consider\n        (eq) \"lowpt1 v = v\" |\n        (frond') \"frond' v (lowpt1 v)\" |\n        (tree_arc'_2) \"\\<exists>x. v \\<rightarrow> x \\<and> tree_path_snoc_frond' x (lowpt1 v)\"\n        using lowpt1\n        by (blast dest: tree_path_snoc_frond'_10)\n      hence \"lowpt1 v = lowpt1 (head e)\"\n      proof (cases)\n        case eq\n        have \"v = r\"\n          using tree_arc' lemma_5_2\n          by (fastforce simp add: eq dest: N_lowpt1_tree_arc')\n        thus ?thesis\n          using tree_arc' eq\n          by (blast dest: lemma_5_3)\n      next\n        case frond'\n        then obtain e' where\n          e': \"Directed_Multigraph.endpoints e' = (v, lowpt1 v)\"\n          \"e' \\<in> set (incidence I v)\"\n          by\n            (fastforce\n              simp add: Directed_Multigraph.endpoints_def tail_def\n              dest: mem_edges_from_funD\n              elim: frond'E)\n        have \"3 * N (lowpt1 (head e)) \\<le> 3 * N (lowpt1 v) + 1\"\n        proof -\n          have \"3 * N (lowpt1 (head e)) \\<le> \\<phi> (tail e) (head e)\"\n            using True\n            by (auto simp add: \\<phi>_def intro: tree_arc'I)\n          also have \"... \\<le> \\<phi> (tail e') (head e')\"\n            using P3_2 e'(2)\n            by (fastforce simp add: Cons dest: idk_100)\n          also have \"... = \\<phi> v (lowpt1 v)\"\n            using e'(1)\n            by (simp add: tail_def head_def Directed_Multigraph.endpoints_def)\n          also have \"... = 3 * N (lowpt1 v) + 1\"\n            using frond'\n            by (auto simp add: \\<phi>_def dest: frond'_imp_tree_path no_closed_tree_path_3)\n          finally show ?thesis\n            .\n        qed\n        hence \"N (lowpt1 (head e)) = N (lowpt1 v)\"\n          using tree_arc'\n          by (force dest: N_lowpt1_tree_arc')\n        thus ?thesis\n          using True assms\n          by (force simp add: N_eq_iff dest: head_tree_arc'_mem_V lowpt1_mem_V tree_arc'I)\n      next\n        case tree_arc'_2\n        then obtain x where\n          x: \"v \\<rightarrow> x\"\n          \"tree_path_snoc_frond' x (lowpt1 v)\"\n          by fast\n        then obtain e' where\n          e': \"Directed_Multigraph.endpoints e' = (v, x)\"\n          \"e' \\<in> set (incidence I v)\"\n          by\n            (fastforce\n              simp add: Directed_Multigraph.endpoints_def tail_def\n              dest: tree_arc_imp_edge mem_edges_from_funD\n              elim: tree_arc'E)\n        have \"3 * N (lowpt1 (head e)) \\<le> 3 * N (lowpt1 v) + 2\"\n        proof -\n          have \"3 * N (lowpt1 (head e)) \\<le> \\<phi> (tail e) (head e)\"\n            using True\n            by (auto simp add: \\<phi>_def intro: tree_arc'I)\n          also have \"... \\<le> \\<phi> (tail e') (head e')\"\n            using P3_2 e'(2)\n            by (fastforce simp add: Cons dest: idk_100)\n          also have \"... = \\<phi> v x\"\n            using e'(1)\n            by (simp add: tail_def head_def Directed_Multigraph.endpoints_def)\n          also have \"... \\<le> 3 * N (lowpt1 x) + 2\"\n            using x(1)\n            by (simp add: \\<phi>_def)\n          also have \"... \\<le> 3 * N (lowpt1 v) + 2\"\n            using x(2)\n            by (force dest: N_lowpt1_least)\n          finally show ?thesis\n            .\n        qed\n        hence \"N (lowpt1 (head e)) = N (lowpt1 v)\"\n          using tree_arc'\n          by (force dest: N_lowpt1_tree_arc')\n        thus ?thesis\n          using True assms\n          by (force simp add: N_eq_iff dest: head_tree_arc'_mem_V lowpt1_mem_V tree_arc'I)\n      qed\n      thus ?thesis  \n        using Cons True\n        by auto\n    next\n      case False\n      have \"e \\<in> edges_from_fun I\"\n        using list.set_intros(1)[of e es]\n        by (auto simp add: Cons[symmetric] intro: mem_edges_from_funI)\n      hence frond': \"frond' v (head e)\"\n        unfolding tail_eq[OF list.set_intros(1)[of e es, unfolded Cons[symmetric]], symmetric]\n        using False\n        by (auto simp add: frond_def intro: frond'I)\n      consider\n        (eq) \"lowpt1 v = v\" |\n        (frond'_2) \"frond' v (lowpt1 v)\" |\n        (tree_arc') \"\\<exists>x. v \\<rightarrow> x \\<and> tree_path_snoc_frond' x (lowpt1 v)\"\n        using lowpt1\n        by (blast dest: tree_path_snoc_frond'_10)\n      hence \"lowpt1 v = head e\"\n      proof (cases)\n        case eq\n        have \"N (lowpt1 v) \\<le> N (head e)\"\n          using frond'\n          by (intro N_lowpt1_frond')\n        moreover have \"N (head e) \\<le> N (lowpt1 v)\"\n          using frond'\n          by (auto simp add: eq dest: frond'_imp_tree_path N_leq_if_tree_path)\n        ultimately show ?thesis\n          using assms frond'\n          by (auto simp add: eq N_eq_iff dest: head_frond'_mem_V)\n      next\n        case frond'_2\n        then obtain e' where\n          e': \"Directed_Multigraph.endpoints e' = (v, lowpt1 v)\"\n          \"e' \\<in> set (incidence I v)\"\n          by\n            (fastforce\n              simp add: Directed_Multigraph.endpoints_def tail_def\n              dest: mem_edges_from_funD\n              elim: frond'E)\n        have \"3 * N (head e) \\<le> 3 * N (lowpt1 v) + 1\"\n        proof -\n          have \"3 * N (head e) \\<le> \\<phi> (tail e) (head e)\"\n            unfolding tail_eq[OF list.set_intros(1)[of e es, unfolded Cons[symmetric]]]\n            using frond'\n            by (auto simp add: \\<phi>_def dest: frond'_imp_tree_path no_closed_tree_path_3)\n          also have \"... \\<le> \\<phi> (tail e') (head e')\"\n            using P3_2 e'(2)\n            by (fastforce simp add: Cons dest: idk_100)\n          also have \"... = \\<phi> v (lowpt1 v)\"\n            using e'(1)\n            by (simp add: tail_def head_def Directed_Multigraph.endpoints_def)\n          also have \"... = 3 * N (lowpt1 v) + 1\"\n            using frond'_2\n            by (auto simp add: \\<phi>_def dest: frond'_imp_tree_path no_closed_tree_path_3)\n          finally show ?thesis\n            .\n        qed\n        hence \"N (head e) = N (lowpt1 v)\"\n          using frond'\n          by (force dest: N_lowpt1_frond')\n        thus ?thesis\n          using frond' frond'_2\n          by (force simp add: N_eq_iff dest: head_frond'_mem_V)\n      next\n        case tree_arc'\n        then obtain x where\n          x: \"v \\<rightarrow> x\"\n          \"tree_path_snoc_frond' x (lowpt1 v)\"\n          by fast\n        then obtain e' where\n          e': \"Directed_Multigraph.endpoints e' = (v, x)\"\n          \"e' \\<in> set (incidence I v)\"\n          by\n            (fastforce\n              simp add: Directed_Multigraph.endpoints_def tail_def\n              dest: tree_arc_imp_edge mem_edges_from_funD\n              elim: tree_arc'E)\n        have \"3 * N (head e) \\<le> 3 * N (lowpt1 v) + 2\"\n        proof -\n          have \"3 * N (head e) \\<le> \\<phi> (tail e) (head e)\"\n            unfolding tail_eq[OF list.set_intros(1)[of e es, unfolded Cons[symmetric]]]\n            using frond'\n            by (auto simp add: \\<phi>_def dest: frond'_imp_tree_path no_closed_tree_path_3)\n          also have \"... \\<le> \\<phi> (tail e') (head e')\"\n            using P3_2 e'(2)\n            by (fastforce simp add: Cons dest: idk_100)\n          also have \"... = \\<phi> v x\"\n            using e'(1)\n            by (simp add: tail_def head_def Directed_Multigraph.endpoints_def)\n          also have \"... \\<le> 3 * N (lowpt1 x) + 2\"\n            using x(1)\n            by (simp add: \\<phi>_def)\n          also have \"... \\<le> 3 * N (lowpt1 v) + 2\"\n            using x(2)\n            by (force dest: N_lowpt1_least)\n          finally show ?thesis\n            .\n        qed\n        hence \"N (head e) = N (lowpt1 v)\"\n          using frond'\n          by (force dest: N_lowpt1_frond')\n        thus ?thesis\n          using frond' assms\n          by (force simp add: N_eq_iff dest: head_frond'_mem_V lowpt1_mem_V)\n      qed\n      thus ?thesis\n        using Cons False\n        by fastforce\n    qed\n  qed\nqed\n\nfunction (in steps_1_2_3_high) (domintros) bla where\n  \"bla v =\n   (case incidence I v of \n    [] \\<Rightarrow> [] |\n    e # es \\<Rightarrow> e # (if tree_arc e then bla (head e) else []))\"\n  by simp+\n\n(* TODO: Rename. *)\nlemma (in steps_1_2_3_high) xoxoxo:\n  assumes \"incidence I v = e # es\"\n  assumes \"tree_arc e\"\n  shows \"v \\<rightarrow> head e\"\n  using assms\n  unfolding tail_eq[OF list.set_intros(1)[of e es, unfolded assms(1)[symmetric]], symmetric]\n  by (intro tree_arc'I)\n\n(* TODO: Rename. *)\nlemma (in steps_1_2_3_high) xixixi:\n  assumes \"(v, u) \\<in> {(v, u). \\<exists>e es. v = head e \\<and> incidence I u = e # es \\<and> tree_arc e}\"\n  shows \"u \\<rightarrow> v\"\n  using assms\n  by (blast intro: xoxoxo)\n\n(* TODO: Rename. *)\nlemma (in steps_1_2_3_high) xexexe:\n  assumes \"(v, u) \\<in> {(v, u). \\<exists>e es. v = head e \\<and> incidence I u = e # es \\<and> tree_arc e}\\<^sup>+\"\n  shows \"u \\<rightarrow>\\<^sup>+ v\"\n  using assms\nproof (induct rule: trancl.induct)\n  case (r_into_trancl)\n  thus ?case\n    by (intro xixixi non_empty_tree_path_if_tree_arc')\nnext\n  case (trancl_into_trancl)\n  thus ?case\n    by (blast intro: xixixi non_empty_tree_path_imp_tree_path non_empty_tree_pathI_2)\nqed\n\ndefinition swap where\n  \"swap p = (snd p, fst p)\"\n\n(* TODO: Rename. *)\nlemma (in steps_1_2_3_high) xaxaxa:\n  shows \"wf {(v, u). \\<exists>e es. v = head e \\<and> incidence I u = e # es \\<and> tree_arc e}\" (is \"wf ?r\")\nproof (rule finite_acyclic_wf, goal_cases)\n  case 1\n  let ?r' = \"{(u, v). \\<exists>e es. v = head e \\<and> incidence I u = e # es \\<and> tree_arc e}\"\n  have \"finite ?r'\"\n    using finite_edges_from_map\n    by (fastforce simp add: tree_arc'_iff_mem_endpoints dest: xoxoxo intro: finite_surj)\n  moreover have \"?r = swap ` ?r'\"\n    by (force simp add: swap_def)\n  ultimately show ?case\n    by fastforce\nnext\n  case 2\n  { fix x\n    assume \"(x, x) \\<in> ?r\\<^sup>+\"\n    hence False\n      by (blast dest: xexexe non_empty_tree_path_imp_neq) }\n  thus ?case\n    by (auto simp add: acyclic_def)\nqed\n\nlemma (in steps_1_2_3_high) bla_dom:\n  shows \"bla_dom v\"\n  using xaxaxa\n  by (auto simp add: wfP_def bla_rel.simps intro: accp_wfPD)\n\nlemma (in steps_1_2_3_high) bla_simps:\n  shows\n    \"bla v =\n     (case incidence I v of \n      [] \\<Rightarrow> [] |\n      e # es \\<Rightarrow> e # (if tree_arc e then bla (head e) else []))\"\n  using bla_dom\n  by (intro bla.psimps)\n\nlemma (in steps_1_2_3_high) bla_induct:\n  assumes\n    \"\\<And>v. (\\<And>e es. incidence I v = e # es \\<Longrightarrow> tree_arc e \\<Longrightarrow> P (head e)) \\<Longrightarrow> P v\"\n  shows \"P v\"\n  using bla_dom\nproof (rule bla.pinduct, goal_cases)\n  case 1\n  thus ?case\n    by (blast intro: assms)\nqed\n\nlemma (in steps_1_2_3_high) bla_empty_iff:\n  shows \"bla v = [] \\<longleftrightarrow> incidence I v = []\"\n  by (simp add: bla_simps split: list.split)\n\nlemma (in steps_1_2_3_high_2) walk_butlast_bla:\n  assumes \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"lowpt1 v \\<noteq> v\"\n  shows \"Directed_Walk.walk (edges_from_map T) (butlast (bla v)) v (tail (last (bla v)))\"\n  using assms\nproof (induct rule: bla_induct[where ?v = v])\n  case (1 v)\n  show ?case\n  proof (cases \"incidence I v\")\n    case Nil\n    thus ?thesis\n      using \"1.prems\"\n      by (simp add: lowpt1_cong)\n  next\n    case (Cons e es)\n    show ?thesis\n    proof (cases \"tree_arc e\")\n      case True\n      hence head_e_mem_V: \"head e \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n        by (intro tree_arc_imp_edge head_mem_V)\n      have lowpt1_head_e_neq: \"lowpt1 (head e) \\<noteq> head e\"\n      proof (standard, goal_cases)\n        case 1\n        have tree_arc': \"tail e \\<rightarrow> head e\"\n          using True\n          by (intro tree_arc'I)\n        have \"N (lowpt1 (head e)) \\<le> N (tail e)\"\n        proof (cases \"tail e = r\")\n          case True\n          thus ?thesis\n            using tree_arc'\n            by (simp add: lemma_5_3)\n        next\n          case False\n          thus ?thesis\n            using tree_arc'\n            by (fastforce dest: lemma_5_2)\n        qed\n        thus ?case\n          using tree_arc'\n          by (auto simp add: 1 dest: N_less_if_tree_arc')\n      qed\n      hence \"Directed_Walk.walk (edges_from_map T) (butlast (bla (head e))) (head e) (tail (last (bla (head e))))\"\n        using Cons True head_e_mem_V\n        by (intro \"1.hyps\")\n      moreover have \"bla (head e) \\<noteq> []\"\n        using head_e_mem_V lowpt1_head_e_neq\n        by (auto simp add: bla_empty_iff lowpt1_cong)\n      ultimately show ?thesis\n        using True Cons \"1.prems\"(1)\n        by (simp add: bla_simps Directed_Walk.walk_Cons_iff tree_arc_iff_edge tail_eq[symmetric])\n    next\n      case False\n      hence \"bla v = [e]\"\n        using \"1.prems\"(1) Cons\n        by (simp add: bla_simps)\n      thus ?thesis\n        using Cons \"1.prems\"(1)\n        by (simp add: tail_eq V_eq Directed_Walk.walk_Nil_iff)\n    qed\n  qed\nqed\n\nlemma (in steps_1_2_3_high_2) bla_10:\n  assumes \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"lowpt1 v \\<noteq> v\"\n  shows \"\\<forall>e\\<in>set (butlast (bla v)). first_child (tail e) = Some (head e)\"\n  using assms\nproof (induct rule: bla_induct)\n  case (1 v)\n  show ?case\n  proof (cases \"incidence I v\")\n    case Nil\n    thus ?thesis\n      using \"1.prems\"\n      by (simp add: lowpt1_cong)\n  next\n    case (Cons e es)\n    show ?thesis\n    proof (cases \"tree_arc e\")\n      case True\n      have \"lowpt1 (head e) \\<noteq> head e\"\n      proof (standard, goal_cases)\n        case 1\n        have tree_arc': \"tail e \\<rightarrow> head e\"\n          using True\n          by (intro tree_arc'I)\n        have \"N (lowpt1 (head e)) \\<le> N (tail e)\"\n        proof (cases \"tail e = r\")\n          case True\n          thus ?thesis\n            using tree_arc'\n            by (simp add: lemma_5_3)\n        next\n          case False\n          thus ?thesis\n            using tree_arc'\n            by (fastforce dest: lemma_5_2)\n        qed\n        thus ?case\n          using tree_arc'\n          by (auto simp add: 1 dest: N_less_if_tree_arc')\n      qed\n      hence \"\\<forall>e\\<in>set (butlast (bla (head e))). first_child (tail e) = Some (head e)\"\n        using Cons True\n        by (intro tree_arc_imp_edge head_mem_V \"1.hyps\")\n      moreover have \"first_child (tail e) = Some (head e)\"\n        unfolding tail_eq[OF list.set_intros(1)[of e es, unfolded Cons[symmetric]]]\n        using Cons True\n        by (simp add: first_child_def children_def)\n      ultimately show ?thesis\n        using Cons \"1.prems\"(1)\n        by (simp add: bla_simps)\n    next\n      case False\n      thus ?thesis\n        using \"1.prems\"(1) Cons\n        by (simp add: bla_simps)\n    qed\n  qed\nqed\n\nlemma (in steps_1_2_3_high_2) frond_last_bla:\n  assumes \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"lowpt1 v \\<noteq> v\"\n  shows \"frond (last (bla v))\"\n  using assms\nproof (induct rule: bla_induct)\n  case (1 v)\n  show ?case\n  proof (cases \"incidence I v\")\n    case Nil\n    thus ?thesis\n      using \"1.prems\"\n      by (simp add: lowpt1_cong)\n  next\n    case (Cons e es)\n    show ?thesis\n    proof (cases \"tree_arc e\")\n      case True\n      hence head_e_mem_V: \"head e \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n        by (intro tree_arc_imp_edge head_mem_V)\n      have lowpt1_head_e_neq: \"lowpt1 (head e) \\<noteq> head e\"\n      proof (standard, goal_cases)\n        case 1\n        have tree_arc': \"tail e \\<rightarrow> head e\"\n          using True\n          by (intro tree_arc'I)\n        have \"N (lowpt1 (head e)) \\<le> N (tail e)\"\n        proof (cases \"tail e = r\")\n          case True\n          thus ?thesis\n            using tree_arc'\n            by (simp add: lemma_5_3)\n        next\n          case False\n          thus ?thesis\n            using tree_arc'\n            by (fastforce dest: lemma_5_2)\n        qed\n        thus ?case\n          using tree_arc'\n          by (auto simp add: 1 dest: N_less_if_tree_arc')\n      qed\n      hence \"frond (last (bla (head e)))\"\n        using Cons True head_e_mem_V\n        thm \"1.hyps\"\n        by (intro \"1.hyps\")\n      moreover have \"bla (head e) \\<noteq> []\"\n        using head_e_mem_V lowpt1_head_e_neq\n        by (auto simp add: bla_empty_iff lowpt1_cong)\n      ultimately show ?thesis\n        using True Cons \"1.prems\"(1)\n        by (simp add: bla_simps)\n    next\n      case False\n      have \"e \\<in> edges_from_fun I\"\n        using list.set_intros(1)[of e es, unfolded Cons[symmetric]]\n        by (auto simp add: edges_from_fun_def)\n      thus ?thesis\n        using \"1.prems\"(1) Cons False\n        by (simp add: bla_simps frond_iff_not_tree_arc)\n    qed\n  qed\nqed\n\nlemma (in steps_1_2_3_high_2) head_last_bla_eq_lowpt1:\n  assumes \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"lowpt1 v \\<noteq> v\"\n  shows \"head (last (bla v)) = lowpt1 v\"\n  using assms\nproof (induct rule: bla_induct[where ?v = v])\n  case (1 v)\n  show ?case\n  proof (cases \"incidence I v\")\n    case Nil\n    thus ?thesis\n      using \"1.prems\"\n      by (simp add: lowpt1_cong)\n  next\n    case (Cons e es)\n    show ?thesis\n    proof (cases \"tree_arc e\")\n      case True\n      hence head_e_mem_V: \"head e \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n        by (intro tree_arc_imp_edge head_mem_V)\n      have lowpt1_head_e_neq: \"lowpt1 (head e) \\<noteq> head e\"\n      proof (standard, goal_cases)\n        case 1\n        have tree_arc': \"tail e \\<rightarrow> head e\"\n          using True\n          by (intro tree_arc'I)\n        have \"N (lowpt1 (head e)) \\<le> N (tail e)\"\n        proof (cases \"tail e = r\")\n          case True\n          thus ?thesis\n            using tree_arc'\n            by (simp add: lemma_5_3)\n        next\n          case False\n          thus ?thesis\n            using tree_arc'\n            by (fastforce dest: lemma_5_2)\n        qed\n        thus ?case\n          using tree_arc'\n          by (auto simp add: 1 dest: N_less_if_tree_arc')\n      qed\n      hence \"head (last (bla (head e))) = lowpt1 (head e)\"\n        using Cons True head_e_mem_V\n        by (intro \"1.hyps\")\n      moreover have \"bla (head e) \\<noteq> []\"\n        using head_e_mem_V lowpt1_head_e_neq\n        by (auto simp add: bla_empty_iff lowpt1_cong)\n      ultimately show ?thesis\n        using Cons \"1.prems\"(1)\n        by (simp add: bla_simps lowpt1_cong)\n    next\n      case False\n      have \"e \\<in> edges_from_fun I\"\n        using list.set_intros(1)[of e es, unfolded Cons[symmetric]]\n        by (auto simp add: edges_from_fun_def)\n      thus ?thesis\n        using \"1.prems\"(1) Cons False\n        by (simp add: bla_simps lowpt1_cong)\n    qed\n  qed\nqed\n\nlemma (in steps_1_2_3_high_2) first_descendant_1:\n  assumes \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n  assumes \"lowpt1 v \\<noteq> v\"\n  obtains x where\n    \"first_descendant v x\"\n    \"frond' x (lowpt1 v)\"\nproof\n  let ?x = \"tail (last (bla v))\"\n  show \"first_descendant v ?x\"\n    using assms\n    by (blast dest: walk_butlast_bla bla_10 first_descendant_if_walk)\n  show \"frond' ?x (lowpt1 v)\"\n  proof -\n    have \"frond' ?x (head (last (bla v)))\"\n      using assms\n      by (intro frond_last_bla frond'I)\n    thus ?thesis\n      using assms\n      by (simp add: head_last_bla_eq_lowpt1)\n  qed\nqed\n\n(* TODO: Move. *)\nlemma\n  assumes \"length l \\<le> 1\"\n  assumes \"x \\<in> set l\"\n  shows \"l = [x]\"\n  using assms\n  by (cases l) simp+\n\nlemma (in steps_1_2_3_high_3) idk_101:\n  assumes \"a \\<rightarrow>\\<^sup>* b\"\n  assumes \"b \\<rightarrow> b'\"\n  assumes \"D b' \\<notin> connected_components (idk_4 G {a, b})\"\n  obtains v where\n    \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"v \\<noteq> a\"\n    \"v \\<noteq> b\"\n    \"v \\<notin> D b'\"\n    \"tree_path_snoc_frond' b' v\"\nproof -\n  let ?G = \"idk_4 G {a, b}\"\n  have \"connected' ?G (D b')\"\n  proof (rule connected'_1, goal_cases)\n    case 1\n    show ?case\n      using assms(2)\n      by (fastforce simp add: undirect_P_eq_G[symmetric] dest: head_tree_arc'_mem_V connected'_D)\n  next\n    case 2\n    have \"b \\<notin> D b'\"\n      using assms(2)\n      by (auto simp add: mem_D_iff_tree_path dest: no_closed_tree_path_3)\n    moreover have \"a \\<notin> D b'\"\n      using assms(1, 2)\n      by (auto simp add: mem_D_iff_tree_path dest: tree_path_trans no_closed_tree_path_3)\n    ultimately show ?case\n      by fast\n  qed\n  then obtain u v where\n    \"u \\<in> D b'\"\n    \"{u, v} \\<in> Multigraph.endpoints ` G\"\n    \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"v \\<noteq> a\"\n    \"v \\<noteq> b\"\n    \"v \\<notin> D b'\"\n    using assms(3) idk_4_subset\n    by (blast elim: connected'_not_connected_componentE_2[of ?G, unfolded V_idk_4_eq V_E_I_eq_V_G[symmetric]])\n  thus ?thesis\n    using assms(2)\n    by (blast dest: idk_52 intro: mem_V_EI that)\nqed\n\nlemma (in steps_1_2_3_high_2) lemma_7_aux:\n  assumes \"u \\<rightarrow> v\"\n  assumes \"x \\<noteq> u\"\n  assumes \"tree_path_snoc_frond' v x\"\n  assumes \"N u \\<le> N x\"\n  shows \"v \\<rightarrow>\\<^sup>* x\"\nproof (rule ccontr, goal_cases)\n  case 1\n  hence \"x \\<rightarrow>\\<^sup>* v\"\n    using assms(3)\n    by (auto dest: tree_path_snoc_frond'_imp_tree_path)\n  hence \"x \\<rightarrow>\\<^sup>* u\"\n    using assms(1) D_refl 1\n    by (auto dest: unique_tree_path_3)\n  hence \"N x \\<le> N u\"\n    by (intro N_leq_if_tree_path)\n  moreover have \"N x \\<noteq> N u\"\n    using assms\n    by\n      (fastforce\n        simp add: N_eq_iff[symmetric]\n        dest: last_tree_path_snoc_frond'_mem_V tail_tree_arc'_mem_V)\n  ultimately show ?case\n    using assms(4)\n    by fastforce\nqed\n\nlemma (in steps_1_2_3_high_3) lemma_7_aux_2:\n  assumes \"a \\<rightarrow> v\"\n  assumes \"v \\<rightarrow>\\<^sup>* b\"\n  assumes \"b' \\<in> set (agublagu_geq b (i\\<^sub>0 a b))\"\n  assumes \"D b' \\<notin> connected_components (idk_4 G {a, b})\"\n  obtains x where\n    \"x \\<in> D v - D b\"\n    \"tree_path_snoc_frond' b' x\"\nproof -\n  have \"a \\<rightarrow>\\<^sup>* b\"\n    using assms(1-2)\n    by (blast dest: tree_path_if_tree_arc' tree_path_trans)\n  then obtain x where\n    x: \"x \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"x \\<noteq> a\"\n    \"x \\<noteq> b\"\n    \"x \\<notin> D b'\"\n    \"tree_path_snoc_frond' b' x\"\n    using assms(3-4)\n    by (blast dest: mem_agublagu_geq_imp_mem_children mem_childrenD elim: idk_101)\n  have \"v \\<rightarrow>\\<^sup>* x\"\n    using assms(1) x(2)\n  proof (rule lemma_7_aux, goal_cases)\n    case 1\n    show ?case\n      using assms(2-3) x(5)\n      by (auto dest: mem_agublagu_geq_imp_mem_children mem_childrenD tree_path_if_tree_arc' tree_path_trans tree_path_snoc_frond'I_2)\n  next\n    case 2\n    have \"N a \\<le> N (lowpt1 b')\"\n      using P3 assms(3)\n      by (intro sorted_wrt_lowpt1_children mem_agublagu_geqD)\n    thus ?case\n      using x(5)\n      by (fastforce dest: N_lowpt1_least)\n  qed\n  moreover have \"\\<not> b \\<rightarrow>\\<^sup>* x\"\n  proof -\n    have \"x \\<rightarrow>\\<^sup>* b'\"\n      using x(4-5)\n      by (auto simp add: mem_D_iff_tree_path dest: tree_path_snoc_frond'_imp_tree_path)\n    then consider\n      \"x \\<rightarrow>\\<^sup>* b\" |\n      \"x = b'\"\n      using assms(3)\n      by (blast dest: mem_agublagu_geq_imp_mem_children mem_childrenD unique_tree_path_3)\n    thus ?thesis\n    proof (cases)\n      case 1\n      thus ?thesis\n        using x(3)\n        by (intro no_closed_tree_path_2)\n    next\n      case 2\n      thus ?thesis\n        using D_refl x(4)\n        by simp\n    qed\n  qed\n  ultimately show ?thesis\n    using x(5)\n    by (auto simp add: mem_D_iff_tree_path intro: that)\nqed\n\n(* TODO: Generalize graph. *)\nlemma (in steps_1_2_3_high_3) lemma_7_aux_5:\n  assumes \"connected' (idk_4 G {a, b}) X\"\n  assumes \"\\<forall>y\\<in>Y. connected' (idk_4 G {a, b}) (D y)\"\n  assumes \"\\<forall>y\\<in>Y. \\<exists>x\\<in>X. tree_path_snoc_frond' y x\"\n  shows \"connected' (idk_4 G {a, b}) (X \\<union> \\<Union> (D ` Y))\"\n  using assms(1)\nproof (rule connected'_100, goal_cases)\n  case 1\n  show ?case\n    sorry\nnext\n  case 2\n  show ?case\n    using assms(2)\n    by fastforce\nnext\n  case 3\n  { fix y\n    assume assm: \"y \\<in> Y\"\n    then obtain x where\n      \"x \\<in> X\"\n      \"x \\<notin> {a, b}\"\n      \"tree_path_snoc_frond' y x\"\n      using assms(1, 3) V_idk_4_subset\n      by (fast dest: connected'_subset)\n    moreover then obtain z where\n      \"z \\<in> D y\"\n      \"z \\<notin> {a, b}\"\n      \"frond' z x\"\n      using assms(2) assm V_idk_4_subset\n      by\n        (fastforce\n          simp add: mem_D_iff_tree_path\n          dest: connected'_subset\n          elim: tree_path_snoc_frond'E)\n    ultimately have \"\\<exists>x\\<in>X. \\<exists>z\\<in>D y. {z, x} \\<in> Multigraph.endpoints ` idk_4 G {a, b}\"\n      by (fastforce simp add: edge_iff_3 intro: mem_endpoints_idk_4I) }\n  thus ?case\n    by fast\nqed\n\nlemma (in steps_1_2_3_high_3) lemma_6_ii:\n  assumes a_less_b: \"N a < N b\"\n  assumes is_separation_pair: \"is_separation_pair G a b\"\n\\<comment> \\<open>\nWe don't need this assumption because if there is even a single edge, then the lemma follows\nimmediately.\n\\<close>\n  assumes not_is_multiple_edge: \"\\<not> is_multiple_edge G {a, b}\"\n  shows \"a \\<rightarrow>\\<^sup>+ b\"\nproof (rule ccontr, goal_cases)\n  case assm: 1\n  let ?G = \"idk_4 G {a, b}\"\n  let ?A = \"D r - D a - D b\"\n  let ?B = \"?A \\<union> \\<Union> (D ` set (children a))\"\n  let ?C = \"?B \\<union> \\<Union> (D ` set (children b))\"\n  have\n    a_mem_V: \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\" and\n    b_mem_V: \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    using is_separation_pair\n    by (auto simp add: V_E_I_eq_V_G dest: separation_pair_mem_V)\n  have V_cong: \"Multigraph.V G = ?C \\<union> {a, b}\"\n  proof -\n    have \"D r = D r - D a \\<union> \\<Union> (D ` set (children a)) \\<union> {a}\"\n      using a_mem_V D_children_cong\n      by (blast dest: tree_path_if_mem_V D_subsetI)\n    moreover have \"D r = D r - D b \\<union> \\<Union> (D ` set (children b)) \\<union> {b}\"\n      using b_mem_V D_children_cong\n      by (blast dest: tree_path_if_mem_V D_subsetI)\n    ultimately show ?thesis\n      using D_children_cong\n      by (auto simp add: V_E_I_eq_V_G D_r_eq_V)\n  qed\n  have C_mem_connected_components: \"?C \\<in> connected_components ?G\"\n  proof -\n    obtain C1 where\n      C1: \"C1 \\<in> connected_components ?G\"\n      \"?C \\<subseteq> C1\"\n    proof -\n      have \"connected' ?G ?C\"\n      proof (rule lemma_7_aux_5, goal_cases)\n        case 1\n        show ?case\n        proof (rule lemma_7_aux_5, goal_cases)\n          case 1\n          show ?case\n          proof (rule connected'_1, goal_cases)\n            case 1\n            then show ?case sorry\n          next\n            case 2\n            show ?case\n              using D_refl\n              by force\n          qed\n        next\n          case 2\n          show ?case\n          proof (standard, goal_cases)\n            case (1 y)\n            thus ?case\n            proof (intro connected'_1, goal_cases)\n              case 1\n              hence \"y \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n                by (fast dest: mem_childrenD head_tree_arc'_mem_V)\n              thus ?case\n                by (auto simp add: undirect_P_eq_G dest: connected'_D)\n            next\n              case 2\n              hence \"a \\<notin> D y\"\n                by (fastforce simp add: mem_D_iff_tree_path dest: mem_childrenD no_closed_tree_path_3)\n              moreover have \"b \\<notin> D y\"\n                using 2 assm\n                by (auto simp add: mem_D_iff_tree_path dest: mem_childrenD intro: non_empty_tree_pathI_2)\n              ultimately show ?case\n                by blast\n            qed\n          qed\n        next\n          case 3\n          show ?case\n          proof (standard, goal_cases)\n            case (1 y)\n            have \"lowpt1 y \\<in> ?A\"\n            proof (standard, standard)\n              show \"lowpt1 y \\<in> D r\"\n                using 1\n                by\n                  (auto\n                    simp add: mem_D_iff_tree_path\n                    dest: mem_childrenD head_tree_arc'_mem_V lowpt1_mem_V tree_path_if_mem_V)\n              have \"a \\<noteq> r\"\n                using b_mem_V a_less_b assm\n                by (fastforce simp add: tree_path_non_empty_tree_path_cong dest: tree_path_if_mem_V)\n              hence \"N (lowpt1 y) < N a\"\n                using 1\n                by (blast dest: mem_childrenD lemma_5_2)\n              thus\n                \"lowpt1 y \\<notin> D a\"\n                \"lowpt1 y \\<notin> D b\"\n                using a_less_b\n                by (auto simp add: mem_D_iff_tree_path dest: N_leq_if_tree_path)\n            qed\n            moreover hence \"tree_path_snoc_frond' y (lowpt1 y)\"\n              using lowpt1 1\n              by (force simp add: mem_D_iff_tree_path dest: mem_childrenD tree_path_if_tree_arc')\n            ultimately show ?case\n              by blast\n          qed\n        qed\n      next\n        case 2\n        show ?case\n        proof (standard, goal_cases)\n          case (1 y)\n          thus ?case\n          proof (intro connected'_1, goal_cases)\n            case 1\n            hence \"y \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n              by (fast dest: mem_childrenD head_tree_arc'_mem_V)\n            thus ?case\n              by (auto simp add: undirect_P_eq_G dest: connected'_D)\n          next\n            case 2\n            hence \"b \\<notin> D y\"\n              by (fastforce simp add: mem_D_iff_tree_path dest: mem_childrenD no_closed_tree_path_3)\n            moreover have \"a \\<notin> D y\"\n              using 2 a_less_b\n              by\n                (fastforce\n                  simp add: mem_D_iff_tree_path\n                  dest: mem_childrenD tree_path_if_tree_arc' tree_path_trans N_leq_if_tree_path)\n            ultimately show ?case\n              by blast\n          qed\n        qed\n      next\n        case 3\n        show ?case\n        proof (standard, goal_cases)\n          case (1 y)\n          have \"b \\<noteq> r\"\n            using a_mem_V a_less_b\n            by (fastforce dest: neq_rI)\n          hence lowpt1_y_less_b: \"N (lowpt1 y) < N b\"\n            using 1\n            by (blast dest: mem_childrenD lemma_5_2)\n          have tree_path_snoc_frond'_y_lowpt1_y: \"tree_path_snoc_frond' y (lowpt1 y)\"\n          proof (rule ccontr)\n            assume \"\\<not> tree_path_snoc_frond' y (lowpt1 y)\"\n            hence \"lowpt1 y = y\"\n              using lowpt1\n              by blast\n            thus False\n              using 1 lowpt1_y_less_b\n              by (fastforce dest: mem_childrenD N_less_if_tree_arc')\n          qed\n          moreover have \"lowpt1 y \\<in> ?A\"\n          proof (standard, standard)\n            show \"lowpt1 y \\<in> D r\"\n              using 1\n              by\n                (auto\n                  simp add: mem_D_iff_tree_path\n                  dest: mem_childrenD head_tree_arc'_mem_V lowpt1_mem_V tree_path_if_mem_V)\n            show \"lowpt1 y \\<notin> D b\"\n              using lowpt1_y_less_b a_less_b\n              by (auto simp add: mem_D_iff_tree_path dest: N_leq_if_tree_path)\n            show \"lowpt1 y \\<notin> D a\"\n            proof\n              assume \"lowpt1 y \\<in> D a\"\n              moreover have\n                \"lowpt1 y \\<rightarrow>\\<^sup>* y\"\n                using tree_path_snoc_frond'_y_lowpt1_y 1 lowpt1_y_less_b\n                by (fastforce dest: tree_path_snoc_frond'_imp_tree_path mem_childrenD tree_path_if_tree_arc' tree_path_trans N_leq_if_tree_path)\n              ultimately have \"a \\<rightarrow>\\<^sup>* y\"\n                by (auto simp add: mem_D_iff_tree_path dest: tree_path_trans)\n              thus False\n                using 1 a_less_b N_less_if_tree_arc' assm\n                by (fastforce simp add: tree_path_non_empty_tree_path_cong dest: mem_childrenD unique_tree_path_3)\n            qed\n          qed\n          ultimately show ?case\n            by blast\n        qed\n      qed\n      thus ?thesis\n        by (blast intro: connected'_subset_connected_component that)\n    qed\n    have \"C1 = ?C\"\n    proof -\n      { fix x\n        assume\n          assm: \"x \\<in> C1\"\n          \"x \\<notin> ?C\"\n        have \"x \\<in> Multigraph.V G - {a, b}\"\n          using V_idk_4_subset C1(1) assm(1)\n          by (fast dest: connected_component_subset_2)\n        hence False\n          using assm(2)\n          by (simp add: V_cong) }\n      thus ?thesis\n        using C1(2)\n        by blast\n    qed\n    thus ?thesis\n      using C1(1)\n      by blast\n  qed\n  then obtain C2 where\n    C2: \"C2 \\<in> connected_components ?G\"\n    \"C2 \\<noteq> ?C\"\n    using is_separation_pair not_is_multiple_edge\n    by (elim separation_class_99)\n  then obtain x where\n    x: \"x \\<in> C2\"\n    \"x \\<notin> ?C\"\n    using C_mem_connected_components connected_component_non_empty_2[of C2 ?G] connected_components_disjoint[of ?C ?G C2]\n    by auto\n  have \"x \\<in> Multigraph.V G - {a, b}\"\n    using V_idk_4_subset C2(1) x(1)\n    by (fast dest: connected_component_subset_2)\n  thus ?case\n    using x(2)\n    by (simp add: V_cong)\nqed\n\nlemma (in steps_1_2_3_high_3) is_type_1_pair_if:\n  assumes non_empty_tree_path_a_b: \"a \\<rightarrow>\\<^sup>+ b\"\n  assumes tree_arc'_b_s: \"b \\<rightarrow> s\"\n  assumes D_s_mem_connected_components: \"D s \\<in> connected_components (idk_4 G {a, b})\"\n  assumes t_mem_V: \"t \\<in> Multigraph.V (idk_4 G {a, b})\"\n  assumes t_not_mem_D_s: \"t \\<notin> D s\"\n  shows \"is_type_1_pair a b s t\"\nproof (rule is_type_1_pairI)\n  have\n    a_mem_V: \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\" and\n    b_mem_V: \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\" and\n    a_less_b: \"N a < N b\"\n    using non_empty_tree_path_a_b\n    by (blast dest: hd_non_empty_tree_path_mem_V last_non_empty_tree_path_mem_V N_less_if_non_empty_tree_path)+\n  have\n    s_mem_V: \"s \\<in> Directed_Multigraph.V (edges_from_fun I)\" and\n    b_less_s: \"N b < N s\"\n    using tree_arc'_b_s\n    by (blast intro: tail_tree_arc'_mem_V head_tree_arc'_mem_V N_less_if_tree_arc')+\n  \n  show \"b \\<noteq> a\"\n    using a_less_b\n    by fast\n  show \"b \\<rightarrow> s\"\n    using tree_arc'_b_s\n    .\n  show \"s \\<noteq> a\"\n    using a_less_b b_less_s\n    by fastforce\n  show lowpt1_s_eq_a: \"lowpt1 s = a\"\n  proof -\n    have \"lowpt1 s \\<in> D s \\<union> {a, b}\"\n    proof (cases \"lowpt1 s = s\")\n      case True\n      thus ?thesis\n        using D_refl\n        by auto\n    next\n      case False\n      then obtain x where\n        \"s \\<rightarrow>\\<^sup>* x\"\n        \"frond' x (lowpt1 s)\"\n        using lowpt1\n        by (blast elim: tree_path_snoc_frond'E)\n      hence \"lowpt1 s \\<in> Multigraph.V (Multigraph.E G (D s))\"\n        by (auto simp add: mem_D_iff_tree_path edge_iff_3 intro: mem_V_EI)\n      thus ?thesis\n        using D_s_mem_connected_components\n        by (blast dest: connected_component_10)\n    qed\n    moreover have\n      \"lowpt1 s \\<noteq> b\"\n      \"lowpt1 s \\<notin> D s\"\n    proof -\n      have\n        \"b \\<noteq> r\"\n        \"s \\<noteq> r\"\n        using a_mem_V a_less_b b_mem_V b_less_s\n        by (blast dest: neq_rI)+\n      hence\n        \"N (lowpt1 s) < N b\"\n        \"N (lowpt1 s) < N s\"\n        using tree_arc'_b_s b_less_s\n        by (fastforce dest: lemma_5_2)+\n      thus\n        \"lowpt1 s \\<noteq> b\"\n        \"lowpt1 s \\<notin> D s\"\n        by (auto simp add: mem_D_iff_tree_path dest: N_leq_if_tree_path)\n    qed\n    ultimately show ?thesis\n      by blast\n  qed\n  show \"N b \\<le> N (lowpt2 s)\"\n  proof -\n    have \"lowpt2 s \\<in> D s \\<union> {a, b}\"\n    proof (cases \"lowpt2 s = s\")\n      case True\n      thus ?thesis\n        using D_refl\n        by simp\n    next\n      case False\n      then obtain x where\n        \"s \\<rightarrow>\\<^sup>* x\"\n        \"frond' x (lowpt2 s)\"\n        using lowpt2\n        by (blast elim: tree_path_snoc_frond'E)\n      hence \"lowpt2 s \\<in> Multigraph.V (Multigraph.E G (D s))\"\n        by (auto simp add: mem_D_iff_tree_path edge_iff_3 intro: mem_V_EI)\n      thus ?thesis\n        using D_s_mem_connected_components\n        by (blast dest: connected_component_10)\n    qed\n    hence \"lowpt2 s \\<in> D s \\<union> {b}\"\n      using D_refl lowpt1_s_eq_a\n      by (fastforce simp add: lowpt2_eq_lowpt1_iff)\n    hence \"lowpt2 s \\<in> D b\"\n      using tree_arc'_b_s D_refl\n      by (fastforce dest: tree_path_if_tree_arc' D_subsetI)\n    thus ?thesis\n      by (force simp add: mem_D_iff_tree_path dest: N_leq_if_tree_path)\n  qed\n  show\n    \"t \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"t \\<noteq> a\"\n    \"t \\<noteq> b\"\n    \"t \\<notin> D s\"\n    using t_mem_V t_not_mem_D_s\n    by (simp_all add: V_idk_4_eq V_E_I_eq_V_G)\nqed\n\nlemma (in steps_1_2_3_high_3) is_type_1_pair_imp:\n  assumes \"is_type_1_pair a b s t\"\n  shows\n    \"a \\<rightarrow>\\<^sup>+ b\"\n    \"b \\<rightarrow> s\"\n    \"D s \\<in> connected_components (idk_4 G {a, b})\"\n    \"t \\<in> Multigraph.V (idk_4 G {a, b})\"\n    \"t \\<notin> D s\"\nproof -\n  have\n    \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\" and\n    b_neq_a: \"b \\<noteq> a\" and\n    s: \"s \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"s \\<noteq> a\"\n    \"s \\<noteq> b\"\n    \"b \\<rightarrow> s\"\n    \"lowpt1 s = a\"\n    \"N b \\<le> N (lowpt2 s)\" and\n    \"t \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"t \\<noteq> a\"\n    \"t \\<noteq> b\"\n    \"t \\<notin> D s\"\n    using assms\n    by (blast dest: is_type_1_pairD)+\n  thus\n    \"b \\<rightarrow> s\"\n    \"t \\<in> Multigraph.V (idk_4 G {a, b})\"\n    \"t \\<notin> D s\"\n    by (simp_all add: V_E_I_eq_V_G V_idk_4_eq)\n  show non_empty_tree_path_a_b: \"a \\<rightarrow>\\<^sup>+ b\"\n  proof -\n    have \"a \\<rightarrow>\\<^sup>* s\"\n    proof (rule ccontr, goal_cases)\n      case 1\n      have \"tree_path_snoc_frond' s a\"\n        using s(2, 5) lowpt1\n        by force\n      hence \"s \\<rightarrow>\\<^sup>* a\"\n        using 1\n        by (fast dest: tree_path_snoc_frond'_imp_tree_path)\n      hence \"s \\<rightarrow>\\<^sup>+ a\"\n        using s(2)\n        by (simp add: tree_path_non_empty_tree_path_cong)\n      hence \"N s < N (lowpt1 s)\"\n        using s(2, 5)\n        by (blast dest: N_less_if_non_empty_tree_path)\n      thus ?case\n        using N_lowpt1_leq[of s]\n        by force\n    qed\n    hence \"a \\<rightarrow>\\<^sup>* b\"\n      using s(2, 4)\n      by (blast dest: unique_tree_path_3)\n    thus ?thesis\n      using b_neq_a\n      by (simp add: tree_path_non_empty_tree_path_cong)\n  qed\n  show \"D s \\<in> connected_components (idk_4 G {a, b})\"\n  proof (rule ccontr, goal_cases)\n    let ?G = \"idk_4 G {a, b}\"\n    case 1\n    then obtain y where\n      y: \"y \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n      \"y \\<noteq> a\"\n      \"y \\<noteq> b\"\n      \"y \\<notin> D s\"\n      \"tree_path_snoc_frond' s y\"\n      using non_empty_tree_path_a_b s(4)\n      by (blast dest: non_empty_tree_path_imp_tree_path elim: idk_101)\n    have \"y \\<in> D s\"\n      using s(4-6) y(2, 3, 5)\n      by (fastforce simp add: mem_D_iff_tree_path dest: N_lowpt2_leq lemma_7_aux)\n    thus ?case\n      using y(4)\n      by blast\n  qed\nqed\n\nlemma (in steps_1_2_3_high_3) is_type_1_pair_iff:\n  shows\n    \"is_type_1_pair a b s t \\<longleftrightarrow>\n     a \\<rightarrow>\\<^sup>+ b \\<and>\n     b \\<rightarrow> s \\<and>\n     D s \\<in> connected_components (idk_4 G {a, b}) \\<and>\n     t \\<in> Multigraph.V (idk_4 G {a, b}) \\<and>\n     t \\<notin> D s\"\n  by (blast dest: is_type_1_pair_imp is_type_1_pair_if)\n\nlemma (in steps_1_2_3_high_3) is_type_2_pair_if:\n  assumes a_neq_r: \"a \\<noteq> r\"\n  assumes tree_arc'_a_s: \"a \\<rightarrow> s\"\n  assumes s_neq_b: \"s \\<noteq> b\"\n  assumes first_descendant_s_b: \"first_descendant s b\"\n  assumes C_subset_Y: \"connected_component (idk_4 G {a, b}) s \\<subseteq> D s - D b \\<union> fukakyo_geq b (i\\<^sub>0 a b)\"\n  shows \"is_type_2_pair a b s\"\nproof (rule is_type_2_pairI)\n  let ?G = \"idk_4 G {a, b}\"\n  let ?C = \"connected_component ?G s\"\n  let ?X = \"D s - D b\"\n  let ?Y = \"?X \\<union> fukakyo_geq b (i\\<^sub>0 a b)\"\n  have\n    a_mem_V: \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\" and\n    s_mem_V: \"s \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    using tree_arc'_a_s\n    by (fast dest: tail_tree_arc'_mem_V head_tree_arc'_mem_V)+\n  thus \"N a \\<noteq> 1\"\n    using r_mem_V a_neq_r\n    by (simp add: N_eq_iff[symmetric] P1)\n  have X_subset_C: \"?X \\<subseteq> ?C\"\n  proof -\n    have \"connected' ?G ?X\"\n    proof (rule connected'_1, goal_cases)\n      case 1\n      have \"s \\<notin> D b\"\n        using s_neq_b first_descendant_s_b\n        by\n          (auto\n            simp add: mem_D_iff_tree_path\n            dest: first_descendant_imp_tree_path no_closed_tree_path_2)\n      thus ?case\n        using s_mem_V\n        by (auto simp add: undirect_P_eq_G[symmetric] dest: connected'_Diff_D)\n    next\n      case 2\n      show ?case\n        using tree_arc'_a_s D_refl\n        by (auto simp add: mem_D_iff_tree_path dest: no_closed_tree_path_3)\n    qed\n    moreover have \"s \\<in> ?X\"\n      using D_refl s_neq_b first_descendant_s_b\n      by\n        (auto\n          simp add: mem_D_iff_tree_path\n          dest: first_descendant_imp_tree_path no_closed_tree_path_2)\n    ultimately show ?thesis\n      by (blast dest: connected_component_71 elim: connected'_subset_connected_component)\n  qed\n  show \"\\<forall>b' x y. frond' x y \\<and> N a < N y \\<and> N y < N b \\<and> b \\<rightarrow> b' \\<and> b' \\<rightarrow>\\<^sup>* x \\<longrightarrow> N a \\<le> N (lowpt1 b')\"\n  proof -\n    { fix b' x y\n      assume\n        assm: \"frond' x y\"\n        \"N a < N y\"\n        \"N y < N b\"\n        \"b \\<rightarrow> b'\"\n        \"b' \\<rightarrow>\\<^sup>* x\"\n      have \"x \\<in> fukakyo_geq b (i\\<^sub>0 a b)\"\n      proof -\n        have \"x \\<in> ?Y \\<union> {a, b}\"\n        proof -\n          have \"x \\<in> ?C \\<union> {a, b}\"\n          proof (rule connected_component_1[of ?C G \"{a, b}\" y x], goal_cases)\n            case 1\n            have \"s \\<in> Multigraph.V ?G\"\n            proof -\n              have \"s \\<in> Multigraph.V G\"\n                using tree_arc'_a_s\n                by (auto simp add: V_E_I_eq_V_G dest: head_tree_arc'_mem_V)\n              moreover have \"s \\<noteq> a\"\n                using tree_arc'_a_s\n                by (blast dest: no_loop)\n              ultimately show ?thesis\n                using s_neq_b\n                by (simp add: V_idk_4_eq)\n            qed\n            thus ?case\n              by (simp add: connected_components_image_cong)\n          next\n            case 2\n            have \"y \\<in> ?X\"\n            proof (standard, goal_cases)\n              case 1\n              show ?case\n                unfolding mem_D_iff_tree_path\n                using tree_arc'_a_s\n              proof (rule lemma_7_aux, goal_cases)\n                case 1\n                show ?case\n                  using assm(2)\n                  by fast\n              next\n                case 2\n                have \"tree_path_snoc_frond' b y\"\n                  using assm(1, 4, 5)\n                  by (auto dest: tree_path_if_tree_arc' tree_path_trans tree_path_snoc_frond'I)\n                thus ?case\n                  using first_descendant_s_b\n                  by (blast dest: first_descendant_imp_tree_path tree_path_snoc_frond'I_2)\n              next\n                case 3\n                show ?case\n                  using assm(2)\n                  by force\n              qed\n            next\n              case 2\n              show ?case\n                using assm(3)\n                by (auto simp add: mem_D_iff_tree_path dest: N_leq_if_tree_path)\n            qed\n            thus ?case\n              using X_subset_C\n              by blast\n          next\n            case 3\n            show ?case\n              using assm(1)\n              by (simp add: edge_iff_3)\n          qed\n          thus ?thesis\n            using C_subset_Y\n            by fast\n        qed\n        moreover have \"x \\<notin> ?X\"\n          using assm(4-5)\n          by (auto simp add: mem_D_iff_tree_path dest: tree_path_if_tree_arc' tree_path_trans)\n        moreover have \"x \\<noteq> a\"\n          using assm(1-2)\n          by (fastforce dest: frond'_imp_tree_path N_leq_if_tree_path)\n        moreover have \"x \\<noteq> b\"\n          using assm(4-5)\n          by (blast dest: no_closed_tree_path_3)\n        ultimately show ?thesis\n          by fast\n      qed\n      hence \"N a \\<le> N (lowpt1 b')\"\n        using P3 sorted_wrt_lowpt1_children assm(4-5)\n        by (simp add: mem_fukakyo_geq_1) }\n    thus ?thesis\n      by fast\n  qed\n  show \"s \\<noteq> b\"\n    using s_neq_b\n    .\n  show \"a \\<rightarrow> s\"\n    using tree_arc'_a_s\n    .\n  show \"first_descendant s b\"\n    using first_descendant_s_b\n    .\n  show \"\\<forall>x y. frond' x y \\<and> N s \\<le> N x \\<and> N x < N b \\<longrightarrow> N a \\<le> N y\"\n  proof -\n    { fix x y\n      assume\n        assm: \"frond' x y\"\n        \"N s \\<le> N x\"\n        \"N x < N b\"\n      have \"y \\<in> D a\"\n      proof -\n        have \"y \\<in> ?Y \\<union> {a, b}\"\n        proof -\n          have \"y \\<in> ?C \\<union> {a, b}\"\n          proof (rule connected_component_1[of ?C G \"{a, b}\" x y], goal_cases)\n            case 1\n            have \"s \\<in> Multigraph.V ?G\"\n            proof -\n              have \"s \\<in> Multigraph.V G\"\n                using tree_arc'_a_s\n                by (auto simp add: V_E_I_eq_V_G dest: head_tree_arc'_mem_V)\n              moreover have \"s \\<noteq> a\"\n                using tree_arc'_a_s\n                by (blast dest: no_loop)\n              ultimately show ?thesis\n                using s_neq_b\n                by (simp add: V_idk_4_eq)\n            qed\n            thus ?case\n              by (simp add: connected_components_image_cong)\n          next\n            case 2\n            have \"x \\<in> ?X\"\n              using s_mem_V first_descendant_s_b assm\n              by (auto simp add: lemma_6_i_2 dest: tail_frond'_mem_V)\n            thus ?case\n              using X_subset_C\n              by fast\n          next\n            case 3\n            show ?case\n              using assm(1)\n              by (simp add: edge_iff_3)\n          qed\n          thus ?thesis\n            using C_subset_Y\n            by fast\n        qed\n        also have \"... \\<subseteq> D s \\<union> {a}\"\n          using D_fukakyo_cong first_descendant_s_b\n          by (fastforce dest: first_descendant_imp_tree_path D_subsetI)\n        also have \"... \\<subseteq> D a\"\n          using tree_arc'_a_s D_refl\n          by (fastforce dest: tree_path_if_tree_arc' D_subsetI)\n        finally show ?thesis\n          .\n      qed\n      hence \"N a \\<le> N y\"\n        by (auto simp add: mem_D_iff_tree_path dest: N_leq_if_tree_path) }            \n    thus ?thesis\n      by blast\n  qed\nqed\n\nlemma (in steps_1_2_3_high_3) is_type_2_pair_imp:\n  assumes \"is_type_2_pair a b s\"\n  shows\n    \"a \\<noteq> r\"\n    \"a \\<rightarrow> s\"\n    \"s \\<noteq> b\"\n    \"first_descendant s b\"\n    \"connected_component (idk_4 G {a, b}) s \\<subseteq> D s - D b \\<union> fukakyo_geq b (i\\<^sub>0 a b)\"\nproof -\n  let ?G = \"idk_4 G {a, b}\"\n  let ?C = \"connected_component ?G s\"\n  let ?X = \"D s - D b\"\n  let ?Y = \"?X \\<union> fukakyo_geq b (i\\<^sub>0 a b)\"\n  have\n    \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"N a \\<noteq> 1\"\n    \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"\\<forall>b' x y. frond' x y \\<and> N a < N y \\<and> N y < N b \\<and> b \\<rightarrow> b' \\<and> b' \\<rightarrow>\\<^sup>* x \\<longrightarrow> N a \\<le> N (lowpt1 b')\" and\n    s: \"s \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    \"s \\<noteq> a\"\n    \"s \\<noteq> b\"\n    \"a \\<rightarrow> s\"\n    \"s \\<rightarrow>\\<^sup>* b\"\n    \"first_descendant s b\"\n    \"\\<forall>x y. frond' x y \\<and> N s \\<le> N x \\<and> N x < N b \\<longrightarrow> N a \\<le> N y\"\n    using assms\n    by (blast dest: is_type_2_pairD)+\n  thus\n    \"a \\<noteq> r\"\n    \"a \\<rightarrow> s\"\n    \"s \\<noteq> b\"\n    \"first_descendant s b\"\n    by (auto simp add: P1)\n  show \"?C \\<subseteq> ?Y\"\n  proof -\n    { fix v\n      assume\n        assm: \"v \\<in> ?C\"\n        \"v \\<notin> ?Y\"\n      obtain p where\n        \"walk (idk_2 ?G ?C) p v s\"\n      proof -\n        have \"s \\<in> Multigraph.V ?G\"\n          using s(1-3)\n          by (simp add: V_idk_4_eq V_E_I_eq_V_G)\n        hence\n          \"?C \\<in> connected_components ?G\"\n          \"s \\<in> ?C\"\n          by (auto simp add: connected_components_image_cong dest: connected_component_refl)\n        thus ?thesis\n          using assm(1)\n          by (blast elim: connected_component_72 intro: that)\n      qed\n      hence False\n        using assm\n      proof (induct p arbitrary: v)\n        case Nil\n        have \"s \\<in> ?Y\"\n          using D_refl s(3, 5)\n          by (auto simp add: mem_D_iff_tree_path dest: no_closed_tree_path_2)\n        thus ?case\n          using Nil(1, 3)\n          by (simp add: walk_Nil_iff)\n      next\n        case (Cons e es)\n        hence\n          v: \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n          \"v \\<noteq> a\"\n          \"v \\<noteq> b\"\n          using connected_component_subset\n          by (fastforce simp add: V_idk_4_eq V_E_I_eq_V_G)+\n        let ?x = \"other e v\"\n        show ?case\n        proof (cases \"?x \\<in> ?Y\")\n          case True\n          then consider\n            (x_mem_X) \"?x \\<in> ?X\" |\n            (x_mem_fukakyo_geq) \"?x \\<in> fukakyo_geq b (i\\<^sub>0 a b)\"\n            by fast\n          thus ?thesis\n          proof (cases)\n            case x_mem_X\n            have \"{v, ?x} \\<in> Multigraph.endpoints ` G\"\n              using Cons.prems(1) idk_2_subset idk_4_subset\n              by (fastforce simp add: walk_Cons_iff other[symmetric])\n            thus ?thesis\n            proof (cases rule: cases_edge)\n              case tree_arc_1\n              have \"v \\<in> ?X\"\n              proof (standard, goal_cases)\n                case 1\n                show ?case\n                proof (rule ccontr, goal_cases)\n                  case 1\n                  hence \"\\<not> s \\<rightarrow>\\<^sup>* v\"\n                    by (simp add: mem_D_iff_tree_path)\n                  hence \"s = ?x\"\n                    using tree_arc_1 x_mem_X\n                    by (auto simp add: mem_D_iff_tree_path dest: unique_tree_path_3)\n                  thus ?case\n                    using tree_arc_1 s(4) v(2)\n                    by (force dest: unique_tree_path_4)\n                qed\n              next\n                case 2\n                show ?case\n                  using tree_arc_1 x_mem_X\n                  by (auto simp add: mem_D_iff_tree_path dest: tree_path_if_tree_arc' tree_path_trans)\n              qed\n              thus ?thesis\n                using Cons.prems(3)\n                by fastforce\n            next\n              case tree_arc_2\n              have \"v \\<in> ?X\"\n              proof (standard, goal_cases)\n                case 1\n                show ?case\n                  using x_mem_X tree_arc_2\n                  by (auto simp add: mem_D_iff_tree_path dest: tree_path_if_tree_arc' tree_path_trans)\n              next\n                case 2\n                show ?case\n                proof (rule ccontr, goal_cases)\n                  case 1\n                  hence \"b \\<rightarrow>\\<^sup>* v\"\n                    by (simp add: mem_D_iff_tree_path)\n                  thus ?case\n                    using tree_arc_2 x_mem_X v(3)\n                    by (auto simp add: mem_D_iff_tree_path dest: unique_tree_path_3)\n                qed\n              qed\n              thus ?thesis\n                using Cons.prems(3)\n                by blast\n            next\n              case frond_1\n              hence \"v \\<in> D s\"\n                using x_mem_X\n                by (auto simp add: mem_D_iff_tree_path dest: frond'_imp_tree_path tree_path_trans)\n              hence \"v \\<in> fukakyo_less b (i\\<^sub>0 a b)\"\n                using Cons.prems(3) D_fukakyo_cong v(3)\n                by blast\n              then obtain b' where\n                b': \"b \\<rightarrow> b'\"\n                \"b' \\<rightarrow>\\<^sup>* v\"\n                \"N (lowpt1 b') < N a\"\n                by (auto elim: mem_fukakyo_lessE)\n              moreover have \"N a \\<le> N (lowpt1 b')\"\n              proof -\n                have\n                  \"N a < N ?x\"\n                  \"N ?x < N b\"\n                  using s(1, 4, 6) x_mem_X\n                  by (auto simp add: lemma_6_i_2 dest: N_less_if_tree_arc')\n                thus ?thesis\n                  using assms frond_1 b'(1, 2)\n                  by (blast dest: is_type_2_pairD(4))\n              qed\n              ultimately show ?thesis\n                by force\n            next\n              case frond_2\n              have \"v \\<in> ?X\"\n              proof (standard, goal_cases)\n                case 1\n                show ?case\n                proof (rule ccontr, goal_cases)\n                  case 1\n                  hence assm: \"\\<not> s \\<rightarrow>\\<^sup>* v\"\n                    by (simp add: mem_D_iff_tree_path)\n                  have \"N v < N a\"\n                  proof -\n                    have \"tree_path_snoc_frond' s v\"\n                      using x_mem_X frond_2\n                      by (auto simp add: mem_D_iff_tree_path intro: tree_path_snoc_frond'I)\n                    hence \"v \\<rightarrow>\\<^sup>* s\"\n                      using assm\n                      by (blast dest: tree_path_snoc_frond'_imp_tree_path)\n                    hence \"v \\<rightarrow>\\<^sup>* a\"\n                      using s(4) assm\n                      by (blast dest: unique_tree_path_3)\n                    thus ?thesis\n                      using v(2)\n                      by (auto simp add: tree_path_non_empty_tree_path_cong dest: N_less_if_non_empty_tree_path)\n                  qed\n                  moreover have \"N a \\<le> N v\"\n                    using x_mem_X s(1, 6, 7) frond_2\n                    by (fastforce dest: lemma_6_i_2)\n                  ultimately show ?case\n                    by simp\n                qed\n              next\n                case 2\n                show ?case\n                  using frond_2 x_mem_X\n                  by (auto simp add: mem_D_iff_tree_path dest: frond'_imp_tree_path tree_path_trans)\n              qed\n              thus ?thesis\n                using Cons.prems(3)\n                by blast\n            qed\n          next\n            case x_mem_fukakyo_geq\n            then obtain b' where\n              b': \"b \\<rightarrow> b'\"\n              \"b' \\<rightarrow>\\<^sup>* ?x\"\n              \"N a \\<le> N (lowpt1 b')\"\n              using P3\n              by (blast dest: sorted_wrt_lowpt1_children elim: mem_fukakyo_geqE)\n            have tree_path_snoc_frond'_b'_v: \"tree_path_snoc_frond' b' v\"\n            proof -\n              have \"v \\<in> Multigraph.V (Multigraph.E G (D b'))\"\n              proof (rule mem_V_EI[of ?x], goal_cases)\n                case 1\n                show ?case\n                  using b'(2)\n                  by (simp add: mem_D_iff_tree_path)\n              next\n                case 2\n                have \"e \\<in> G\"\n                  using Cons.prems(1) idk_2_subset idk_4_subset\n                  by (fastforce simp add: walk_Cons_iff)\n                thus ?case\n                  using Cons.prems(1)\n                  by (auto simp add: walk_Cons_iff dest: other)\n              qed\n              hence \"v \\<in> D b' \\<union> {b} \\<union> {v. tree_path_snoc_frond' b' v}\"\n                using b'(1)\n                by (auto simp add: dest: idk_52)\n              thus ?thesis\n                using b'(1, 3) Cons.prems(3) v(3)\n                by (auto simp add: mem_D_iff_tree_path intro: mem_fukakyo_geqI)\n            qed\n            hence tree_path_snoc_frond'_s_v: \"tree_path_snoc_frond' s v\"\n              using s(5) b'(1)\n              by (auto dest: tree_path_if_tree_arc' tree_path_snoc_frond'I_2)\n            hence tree_path_snoc_frond'_a_v: \"tree_path_snoc_frond' a v\"\n              using s(4)\n              by (auto dest: tree_path_if_tree_arc' tree_path_snoc_frond'I_2)\n\n            have \"v \\<in> ?Y\"\n            proof -\n              have \"v \\<in> D s\"\n                unfolding mem_D_iff_tree_path\n                using s(4) v(2) tree_path_snoc_frond'_s_v\n              proof (rule lemma_7_aux, goal_cases)\n                case 1\n                show ?case\n                  using tree_path_snoc_frond'_b'_v b'(3)\n                  by (fastforce dest: N_lowpt1_least)\n              qed\n              moreover\n              { assume assm: \"v \\<in> D b\"\n                have \"v \\<in> D b'\"\n                  unfolding mem_D_iff_tree_path\n                  using b'(1) v(3) tree_path_snoc_frond'_b'_v\n                proof (rule lemma_7_aux, goal_cases)\n                  case 1\n                  then show ?case\n                    using assm\n                    by (auto simp add: mem_D_iff_tree_path dest: N_leq_if_tree_path)\n                qed }\n              ultimately show ?thesis\n                using b'(1, 3)\n                by (auto simp add: mem_D_iff_tree_path intro: mem_fukakyo_geqI)\n            qed\n            thus ?thesis\n              using Cons.prems(3)\n              by blast\n          qed\n        next\n          case False\n          thus ?thesis\n            using Cons.prems(1)\n            by (auto simp add: walk_Cons_iff dest: other mem_idk_2D Cons.hyps)\n        qed\n      qed }\n    thus ?thesis\n      by blast\n  qed\nqed\n\nlemma (in steps_1_2_3_high_3) is_type_2_pair_iff:\n  shows\n    \"is_type_2_pair a b s \\<longleftrightarrow>\n     a \\<noteq> r \\<and>\n     a \\<rightarrow> s \\<and>\n     s \\<noteq> b \\<and>\n     first_descendant s b \\<and>\n     connected_component (idk_4 G {a, b}) s \\<subseteq> D s - D b \\<union> fukakyo_geq b (i\\<^sub>0 a b)\"\n  by (blast dest: is_type_2_pair_imp is_type_2_pair_if)\n\nlemma (in steps_1_2_3_high_2) lemma_7_aux_3:\n  assumes a_eq_r: \"a = r\"\n  assumes tree_arc'_a_v: \"a \\<rightarrow> v\"\n  shows \"D r - D a \\<union> \\<Union> (D ` (set (children a) - {v})) \\<union> fukakyo_less b (i\\<^sub>0 a b) = {}\"\nproof -\n  let ?A = \"D r - D a\"\n  let ?B = \"?A \\<union> \\<Union> (D ` (set (children a) - {v}))\"\n  have \"?B = {}\"\n    using tree_arc'_a_v lemma_5_1\n    unfolding a_eq_r\n    by (cases \"children r\") (auto dest: mem_childrenI)\n  moreover have \"fukakyo_less b (i\\<^sub>0 a b) = {}\"\n  proof (rule ccontr, goal_cases)\n    case 1\n    then obtain b' where\n      \"b \\<rightarrow> b'\"\n      \"N (lowpt1 b') < N a\"\n      by (blast elim: mem_fukakyo_lessE)\n    moreover hence\n      \"lowpt1 b' \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n      by (intro head_tree_arc'_mem_V lowpt1_mem_V)\n    ultimately show ?case\n      by (fastforce simp add: a_eq_r dest: neq_rI)\n  qed\n  ultimately show ?thesis\n    by blast\nqed\n\nlemma (in steps_1_2_3_high_3) lemma_7_aux_4:\n  assumes no_D_mem_connected_components: \"\\<not> (\\<exists>b'\\<in>set (children b). D b' \\<in> connected_components (idk_4 G {a, b}))\"\n  assumes tree_arc'_a_v: \"a \\<rightarrow> v\"\n  assumes v_eq_b: \"v = b\"\n  shows \"D v - D b \\<union> fukakyo_geq b (i\\<^sub>0 a b) = {}\"\nproof -\n  let ?X = \"D v - D b\"\n  have X_empty: \"?X = {}\"\n    using v_eq_b\n    by simp\n  show ?thesis\n  proof (cases \"fukakyo_geq b (i\\<^sub>0 a b) = {}\")\n    case True\n    thus ?thesis\n      using X_empty\n      by blast\n  next\n    case False\n    then obtain b' where\n      \"b' \\<in> set (agublagu_geq b (i\\<^sub>0 a b))\"\n      by (fastforce simp add: fukakyo_geq_def)\n    then obtain x where\n      \"x \\<in> ?X\"\n      using tree_arc'_a_v v_eq_b tree_path_refl no_D_mem_connected_components\n      by (blast elim: lemma_7_aux_2 intro: mem_agublagu_geq_imp_mem_children)\n    thus ?thesis\n      using X_empty\n      by blast\n  qed\nqed\n\nlemma (in steps_1_2_3_high_3) lemma_7:\n  assumes \"N a < N b\"\n  shows\n    \"is_separation_pair G a b \\<longleftrightarrow>\n     is_type_1_pair' a b \\<or>\n     is_type_2_pair' a b \\<or>\n     is_multiple_edge G {a, b} \\<and> 4 \\<le> card G\"\nproof (standard, goal_cases)\n  let ?G = \"idk_4 G {a, b}\"\n  case 1\n  hence\n    a_mem_V: \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\" and\n    b_mem_V: \"b \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n    by (auto simp add: V_E_I_eq_V_G dest: separation_pair_mem_V)\n  show ?case\n  proof (cases \"is_multiple_edge G {a, b}\")\n    case True\n    thus ?thesis\n      using 1\n      by (auto intro: card_geq_4I)\n  next\n    case False\n    show ?thesis\n    proof (cases \"\\<exists>b'\\<in>set (children b). D b' \\<in> connected_components ?G\")\n      case True\n      then obtain b' where\n        \"b \\<rightarrow> b'\"\n        \"D b' \\<in> connected_components ?G\"\n        by (blast dest: mem_childrenD)\n      moreover then obtain t where\n        \"t \\<in> Multigraph.V ?G\"\n        \"t \\<notin> D b'\"\n        using 1 False\n        by (auto simp add: V_idk_4_eq elim: separation_class_12)\n      ultimately show ?thesis\n        using assms 1 False\n        by (auto simp add: is_type_1_pair'_def dest: lemma_6_ii intro: is_type_1_pair_if)\n    next\n      case no_D_mem_connected_components: False\n      obtain v where\n        v: \"v \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n        \"a \\<rightarrow> v\"\n        \"v \\<rightarrow>\\<^sup>* b\"\n        using assms 1 False\n        by (fastforce dest: lemma_6_ii head_tree_arc'_mem_V elim: non_empty_tree_pathE)\n      let ?A = \"D r - D a\"\n      let ?B = \"?A \\<union> \\<Union> (D ` (set (children a) - {v}))\"\n      let ?C = \"?B \\<union> fukakyo_less b (i\\<^sub>0 a b)\"\n      let ?X = \"D v - D b\"\n      let ?Y = \"?X \\<union> fukakyo_geq b (i\\<^sub>0 a b)\"\n      have V_cong: \"Multigraph.V G = ?C \\<union> ?Y \\<union> {a, b}\"\n      proof -\n        have \"Multigraph.V G = D r\"\n          by (simp add: V_E_I_eq_V_G D_r_eq_V)\n        also have \"... = ?A \\<union> D a\"\n          using a_mem_V\n          by (blast dest: tree_path_if_mem_V D_subsetI)\n        also have \"... = ?B \\<union> D v \\<union> {a}\"\n          using D_children_cong v(2)\n          by (blast intro: mem_childrenI)\n        also have \"... = ?B \\<union> ?X \\<union> D b \\<union> {a}\"\n          using v(3)\n          by (blast dest: D_subsetI)\n        also have \"... = ?C \\<union> ?Y \\<union> {a, b}\"\n          using D_fukakyo_cong\n          by auto\n        finally show ?thesis\n          .\n      qed\n      have\n        C_mem_connected_components: \"?C \\<in> connected_components ?G\" and\n        Y_mem_connected_components: \"?Y \\<in> connected_components ?G\" and\n        Y_neq_C: \"?Y \\<noteq> ?C\"\n      proof -\n        obtain C1 where\n          C1: \"C1 \\<in> connected_components ?G\"\n          \"?C \\<subseteq> C1\"\n        proof (cases \"a = r\")\n          case True\n          hence \"?C = {}\"\n            using v(2)\n            by (intro lemma_7_aux_3)\n          thus ?thesis\n            using 1 False\n            by (fast elim: separation_class_13 dest: that)\n        next\n          case False\n          have \"connected' ?G ?C\"\n            unfolding fukakyo_less_def\n          proof (rule lemma_7_aux_5, goal_cases)\n            case 1\n            show ?case\n            proof (rule lemma_7_aux_5, goal_cases)\n              case 1\n              show ?case\n              proof (rule connected'_1, goal_cases)\n                case 1\n                have \"r \\<notin> D a\"\n                  using a_mem_V False\n                  by (auto simp add: mem_D_iff_tree_path dest: tree_path_if_mem_V no_closed_tree_path_2)\n                thus ?case\n                  using r_mem_V\n                  by (auto simp add: undirect_P_eq_G[symmetric] dest: connected'_Diff_D)\n              next\n                case 2\n                show ?case\n                  using D_refl v\n                  by (fastforce simp add: mem_D_iff_tree_path dest: tree_path_if_tree_arc' tree_path_trans)\n              qed\n            next\n              case 2\n              show ?case\n              proof (standard, goal_cases)\n                case (1 y)\n                thus ?case\n                proof (intro connected'_1, goal_cases)\n                  case 1\n                  hence \"y \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n                    by (fast dest: mem_childrenD head_tree_arc'_mem_V)\n                  thus ?case\n                    by (auto simp add: undirect_P_eq_G dest: connected'_D)\n                next\n                  case 2\n                  hence \"a \\<notin> D y\"\n                    by (fastforce simp add: mem_D_iff_tree_path dest: mem_childrenD no_closed_tree_path_3)\n                  moreover have \"b \\<notin> D y\"\n                    using v(2-3) 2\n                    by (fastforce simp add: mem_D_iff_tree_path dest: mem_childrenD disjoint_siblings)\n                  ultimately show ?case\n                    by blast\n                qed\n              qed\n            next\n              case 3\n              show ?case\n              proof (standard, goal_cases)\n                case (1 y)\n                have \"lowpt1 y \\<in> ?A\"\n                proof\n                  show \"lowpt1 y \\<in> D r\"\n                    using 1\n                    by\n                      (auto\n                        simp add: mem_D_iff_tree_path\n                        dest: mem_childrenD head_tree_arc'_mem_V lowpt1_mem_V tree_path_if_mem_V)\n                  show \"lowpt1 y \\<notin> D a\"\n                  proof -\n                    have \"N (lowpt1 y) < N a\"\n                      using False 1\n                      by (blast dest: mem_childrenD lemma_5_2)\n                    thus ?thesis\n                      by (auto simp add: mem_D_iff_tree_path dest: N_leq_if_tree_path)\n                  qed\n                qed\n                moreover hence \"tree_path_snoc_frond' y (lowpt1 y)\"\n                  using lowpt1 1\n                  by (force simp add: mem_D_iff_tree_path dest: mem_childrenD tree_path_if_tree_arc')\n                ultimately show ?case\n                  by blast\n              qed\n            qed\n          next\n            case 2\n            show ?case\n            proof (standard, goal_cases)\n              case (1 y)\n              thus ?case\n              proof (intro connected'_1, goal_cases)\n                case 1\n                hence \"y \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n                  by (fast dest: mem_agublagu_less_imp_mem_children mem_childrenD head_tree_arc'_mem_V)\n                thus ?case\n                  by (auto simp add: undirect_P_eq_G dest: connected'_D)\n              next\n                case 2\n                hence \"b \\<notin> D y\"\n                  by\n                    (fastforce\n                      simp add: mem_D_iff_tree_path\n                      dest: mem_agublagu_less_imp_mem_children mem_childrenD no_closed_tree_path_3)\n                moreover hence \"a \\<notin> D y\"\n                  using v(2, 3)\n                  by (auto simp add: mem_D_iff_tree_path dest: tree_path_if_tree_arc' tree_path_trans)\n                ultimately show ?case\n                  by blast\n              qed\n            qed\n          next\n            case 3\n            show ?case\n            proof (standard, goal_cases)\n              case (1 y)\n              have lowpt1_y_mem_A: \"lowpt1 y \\<in> ?A\"\n              proof\n                show \"lowpt1 y \\<in> D r\"\n                  using 1\n                  by\n                    (fastforce\n                      simp add: mem_D_iff_tree_path\n                      dest: mem_agublagu_less_imp_mem_children mem_childrenD head_tree_arc'_mem_V lowpt1_mem_V tree_path_if_mem_V)\n                show \"lowpt1 y \\<notin> D a\"\n                proof -\n                  have \"N (lowpt1 y) < N a\"\n                    using 1\n                    by (fast dest: mem_agublagu_lessD)\n                  thus ?thesis\n                    by (auto simp add: mem_D_iff_tree_path dest: N_leq_if_tree_path)\n                qed\n              qed\n              moreover have \"tree_path_snoc_frond' y (lowpt1 y)\"\n              proof -\n                have \"y \\<in> D a\"\n                  using v(2, 3) 1\n                  by\n                    (force\n                      simp add: mem_D_iff_tree_path\n                      dest: tree_path_if_tree_arc' mem_agublagu_less_imp_mem_children mem_childrenD tree_path_trans)\n                thus ?thesis\n                  using lowpt1 lowpt1_y_mem_A\n                  by force\n              qed\n              ultimately show ?case\n                by blast\n            qed\n          qed\n          thus ?thesis\n            by (blast intro: connected'_subset_connected_component that)\n        qed\n        obtain C2 where\n          C2: \"C2 \\<in> connected_components ?G\"\n          \"?Y \\<subseteq> C2\"\n        proof (cases \"v = b\")\n          case True\n          hence \"?Y = {}\"\n            using no_D_mem_connected_components v(2)\n            by (intro lemma_7_aux_4)\n          thus ?thesis\n            using 1 False\n            by (blast elim: separation_class_13 intro: that)\n        next\n          case False\n          have \"connected' ?G ?Y\"\n            unfolding fukakyo_geq_def\n          proof (rule lemma_7_aux_5, goal_cases)\n            case 1\n            show ?case\n            proof (rule connected'_1, goal_cases)\n              case 1\n              have \"v \\<notin> D b\"\n                using v(3) False\n                by (auto simp add: mem_D_iff_tree_path dest: no_closed_tree_path_2)\n              thus ?case\n                using v(1)\n                by (auto simp add: undirect_P_eq_G[symmetric] dest: connected'_Diff_D)\n            next\n              case 2\n              show ?case\n                using v(2) D_refl\n                by (fastforce simp add: mem_D_iff_tree_path dest: no_closed_tree_path_3)\n            qed\n          next\n            case 2\n            show ?case\n            proof (standard, goal_cases)\n              case (1 y)\n              thus ?case\n              proof (intro connected'_1, goal_cases)\n                case 1\n                hence \"y \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n                  by (fast dest: mem_agublagu_geq_imp_mem_children mem_childrenD head_tree_arc'_mem_V)\n                thus ?case\n                  by (auto simp add: undirect_P_eq_G dest: connected'_D)\n              next\n                case 2\n                hence \"b \\<notin> D y\"\n                  by\n                    (fastforce\n                      simp add: mem_D_iff_tree_path\n                      dest: mem_agublagu_geq_imp_mem_children mem_childrenD no_closed_tree_path_3)\n                moreover hence \"a \\<notin> D y\"\n                  using v(2, 3)\n                  by (auto simp add: mem_D_iff_tree_path dest: tree_path_if_tree_arc' tree_path_trans)\n                ultimately show ?case\n                  by blast\n              qed\n            qed\n          next\n            case 3\n            show ?case\n              using v(2, 3) no_D_mem_connected_components\n              by (blast elim: lemma_7_aux_2 intro: mem_agublagu_geq_imp_mem_children)\n          qed\n          thus ?thesis\n            by (blast intro: connected'_subset_connected_component that)\n        qed\n        have C2_neq_C1: \"C2 \\<noteq> C1\"\n        proof\n          assume assm: \"C2 = C1\"\n          obtain C3 where\n            C3: \"C3 \\<in> connected_components ?G\"\n            \"C3 \\<noteq> C1\"\n            using 1 False C1(1)\n            by (elim separation_class_99)\n          then obtain x where\n            x: \"x \\<in> C3\"\n            \"x \\<notin> C1\"\n            using C1(1)\n            by (blast dest: connected_component_non_empty_2 connected_components_disjoint)\n          have \"x \\<in> Multigraph.V G - {a, b}\"\n            using V_idk_4_subset C3(1) x(1)\n            by (fast dest: connected_component_subset_2)\n          moreover have \"x \\<notin> ?C \\<union> ?Y\"\n            using C1(2) C2(2) assm x(2)\n            by blast\n          ultimately show False\n            by (auto simp add: V_cong)\n        qed\n        moreover have \"C1 = ?C\"\n        proof -\n          { fix x\n            assume\n              assm: \"x \\<in> C1\"\n              \"x \\<notin> ?C\"\n            have \"x \\<in> Multigraph.V G - {a, b}\"\n              using V_idk_4_subset C1(1) assm(1)\n              by (fast dest: connected_component_subset_2)\n            moreover have \"x \\<notin> ?Y\"\n              using C1(1) C2 C2_neq_C1 assm(1)\n              by (fast dest: connected_components_disjoint)\n            ultimately have False\n              using assm(2)\n              by (auto simp add: V_cong) }\n          thus ?thesis\n            using C1(2)\n            by blast\n        qed\n        moreover have \"C2 = ?Y\"\n        proof -\n          { fix x\n            assume\n              assm: \"x \\<in> C2\"\n              \"x \\<notin> ?Y\"\n            have \"x \\<in> Multigraph.V G - {a, b}\"\n              using V_idk_4_subset C2(1) assm(1)\n              by (fast dest: connected_component_subset_2)\n            moreover have \"x \\<notin> ?C\"\n              using C1 C2(1) C2_neq_C1 assm(1)\n              by (blast dest: connected_components_disjoint)\n            ultimately have False\n              using assm(2)\n              by (auto simp add: V_cong) }\n          thus ?thesis\n            using C2(2)\n            by blast\n        qed\n        ultimately show\n          \"?C \\<in> connected_components ?G\"\n          \"?Y \\<in> connected_components ?G\"\n          \"?Y \\<noteq> ?C\"\n          using C1(1) C2(1)\n          by fastforce+\n      qed\n      have \"is_type_2_pair a b v\"\n      proof (rule is_type_2_pair_if)\n        show a_neq_r: \"a \\<noteq> r\"\n        proof\n          assume assm: \"a = r\"\n          hence \"?C = {}\"\n            using v(2)\n            by (intro lemma_7_aux_3)\n          thus False\n            using C_mem_connected_components\n            by (auto dest: connected_component_non_empty_2)\n        qed\n        show \"a \\<rightarrow> v\"\n          using v(2)\n          .\n        show v_neq_b: \"v \\<noteq> b\"\n        proof\n          assume \"v = b\"\n          hence \"?Y = {}\"\n            using no_D_mem_connected_components v(2)\n            by (intro lemma_7_aux_4)\n          thus False\n            using Y_mem_connected_components\n            by (auto dest: connected_component_non_empty_2)\n        qed\n        let ?y = \"lowpt1 v\"\n        have y_less_a: \"N ?y < N a\"\n          using a_neq_r v(2)\n          by (intro lemma_5_2)\n        obtain x where\n          x: \"first_descendant v x\"\n          \"frond' x ?y\"\n        proof -\n          have \"?y \\<noteq> v\"\n            using v(2) y_less_a\n            by (auto dest: N_less_if_tree_arc')\n          thus ?thesis\n            using v(1)\n            by (auto elim: first_descendant_1 intro: that)\n        qed\n        show \"first_descendant v b\"\n          using x(1) v(3)\n        proof (rule first_descendant_pref)\n          have \"x \\<in> fukakyo_less b (i\\<^sub>0 a b) \\<union> {b}\"\n          proof -\n            have \"x \\<in> ?C \\<union> {a, b}\"\n            proof -\n              have \"?y \\<in> ?B\"\n              proof -\n                have \"?y \\<in> ?A\"\n                proof (standard, goal_cases)\n                  case 1\n                  show ?case\n                    using v(1)\n                    by (auto simp add: D_r_eq_V intro: lowpt1_mem_V)\n                next\n                  case 2\n                  show ?case\n                    using y_less_a\n                    by (auto simp add: mem_D_iff_tree_path dest: N_leq_if_tree_path)\n                qed\n                thus ?thesis\n                  using v(2)\n                  by (auto dest: tree_path_if_tree_arc' D_subsetI)\n              qed\n              thus ?thesis\n                using C_mem_connected_components x(2)\n                by (intro connected_component_1[of ?C G \"{a, b}\" ?y x]) (auto simp add: edge_iff_3)\n            qed\n            moreover have \"x \\<notin> ?B\"\n            proof (standard, goal_cases)\n              case 1\n              hence \"x \\<in> \\<Union> (D ` (set (children a) - {v}))\"\n                using v(2) x(1)\n                by (auto simp add: mem_D_iff_tree_path dest: tree_path_if_tree_arc' first_descendant_imp_tree_path tree_path_trans)\n              then obtain a' where\n                \"a \\<rightarrow> a'\"\n                \"a' \\<noteq> v\"\n                \"x \\<in> D a'\"\n                by (blast dest: mem_childrenD)\n              moreover have \"x \\<in> D v\"\n                using x(1)\n                by (auto simp add: mem_D_iff_tree_path dest: first_descendant_imp_tree_path)\n              ultimately show ?case\n                using v(2)\n                by (blast dest: disjoint_siblings)\n            qed\n            moreover have \"x \\<noteq> a\"\n              using v(2) x(1)\n              by (fastforce dest: first_descendant_imp_tree_path no_closed_tree_path_3)\n            ultimately show ?thesis\n              by blast\n          qed\n          thus \"b \\<rightarrow>\\<^sup>* x\"\n            using D_fukakyo_cong\n            by (fastforce simp add: mem_D_iff_tree_path)\n        qed\n        show \"connected_component ?G v \\<subseteq> ?Y\"\n        proof -\n          have \"v \\<in> ?Y\"\n            using D_refl v(3) v_neq_b\n            by (auto simp add: mem_D_iff_tree_path dest: no_closed_tree_path_2)\n          thus ?thesis\n            using Y_mem_connected_components\n            by (blast dest: connected_component_71)\n        qed\n      qed\n      thus ?thesis\n        by (auto simp add: is_type_2_pair'_def)\n    qed\n  qed\nnext\n  let ?G = \"idk_4 G {a, b}\"\n  case 2\n  thus ?case\n  proof (elim disjE, goal_cases)\n    case 1\n    then obtain s t where\n      \"b \\<rightarrow> s\"\n      \"D s \\<in> connected_components ?G\"\n      \"t \\<in> Multigraph.V ?G\"\n      \"t \\<notin> D s\"\n      using assms\n      by (auto simp add: is_type_1_pair'_def dest: is_type_1_pair_imp)\n    thus ?case\n      by\n        (intro is_separation_pairI_10[where ?C1.0 = \"D s\" and ?C2.0 = \"connected_component ?G t\"])\n        (auto simp add: connected_components_image_cong dest: connected_component_refl)\n  next\n    let ?C1 = \"connected_component ?G r\"\n    case 2\n    then obtain s where\n      a_neq_r: \"a \\<noteq> r\" and\n      tree_arc'_a_s: \"a \\<rightarrow> s\" and\n      s_neq_b: \"s \\<noteq> b\" and\n      first_descendant_s_b: \"first_descendant s b\" and\n      C2_subset_X: \"connected_component ?G s \\<subseteq> D s - D b \\<union> fukakyo_geq b (i\\<^sub>0 a b)\" (is \"?C2 \\<subseteq> ?X\")\n      using assms\n      by (auto simp add: is_type_2_pair'_def dest: is_type_2_pair_imp)\n    hence a_mem_V: \"a \\<in> Directed_Multigraph.V (edges_from_fun I)\"\n      by (intro tail_tree_arc'_mem_V)\n    show ?case\n    proof (rule is_separation_pairI_10[where ?C1.0 = ?C1 and ?C2.0 = ?C2])\n      show\n        \"?C1 \\<in> connected_components ?G\"\n        \"?C2 \\<noteq> ?C1\"\n      proof -\n        have \"r \\<in> Multigraph.V ?G\"\n        proof -\n          have \"r \\<in> Multigraph.V G\"\n            using r_mem_V\n            by (simp add: undirect_P_eq_G[symmetric]_V_image_undirect_eq)\n          moreover have \"r \\<noteq> a\"\n            using a_neq_r\n            ..\n          moreover have \"r \\<noteq> b\"\n            using a_mem_V assms\n            by (fast dest: neq_rI)\n          ultimately show ?thesis\n            by (simp add: V_idk_4_eq)\n        qed\n        moreover have \"r \\<notin> ?X\"\n        proof (standard, goal_cases)\n          case 1\n          have \"?X \\<subseteq> D s\"\n            using D_fukakyo_cong first_descendant_s_b\n            by (blast dest: D_subsetI first_descendant_imp_tree_path)\n          hence \"a \\<rightarrow>\\<^sup>+ r\"\n            using tree_arc'_a_s 1\n            by (fastforce simp add: mem_D_iff_tree_path intro: non_empty_tree_pathI_2)\n          thus ?case\n            using a_mem_V\n            by (blast dest: N_less_if_non_empty_tree_path neq_rI)\n        qed\n        ultimately show\n          \"?C1 \\<in> connected_components ?G\"\n          \"?C2 \\<noteq> ?C1\"\n          using C2_subset_X\n          by (auto simp add: connected_components_image_cong dest: connected_component_refl)\n      qed\n      show \"?C2 \\<in> connected_components ?G\"\n      proof -\n        have \"s \\<in> Multigraph.V ?G\"\n        proof -\n          have \"s \\<in> Multigraph.V G\"\n            using tree_arc'_a_s\n            by (auto simp add: V_E_I_eq_V_G dest: head_tree_arc'_mem_V)\n          moreover have \"s \\<noteq> a\"\n            using tree_arc'_a_s\n            by (blast dest: no_loop)\n          ultimately show ?thesis\n            using s_neq_b\n            by (simp add: V_idk_4_eq)\n        qed\n        thus ?thesis\n          by (simp add: connected_components_image_cong)\n      qed\n    qed\n  next\n    case 3\n    thus ?case\n      by (intro is_separation_pairI_3) simp+\n  qed\nqed\n\nend", "meta": {"author": "mitjakrebs", "repo": "master-s-thesis", "sha": "103462c6116a90004f6c0654748bccaf4bfd67be", "save_path": "github-repos/isabelle/mitjakrebs-master-s-thesis", "path": "github-repos/isabelle/mitjakrebs-master-s-thesis/master-s-thesis-103462c6116a90004f6c0654748bccaf4bfd67be/Hopcroft_Tarjan/Hopcroft_Tarjan.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.30736334118347786}}
{"text": "(*<*)\ntheory WellformedL\n  imports Wellformed \"SyntaxL\"\nbegin                                                                                                                                                                                   \n(*>*)\n\nchapter \\<open>Wellformedness Lemmas\\<close>\n\nsection \\<open>Prelude\\<close>\n\nlemma b_of_subst_bb_commute:\n   \"(b_of (\\<tau>[bv::=b]\\<^sub>\\<tau>\\<^sub>b)) =  (b_of \\<tau>)[bv::=b]\\<^sub>b\\<^sub>b\"\nproof -\n  obtain z' and b' and c' where \"\\<tau> = \\<lbrace> z' : b' | c' \\<rbrace> \" using obtain_fresh_z by metis\n  moreover hence \"(b_of (\\<tau>[bv::=b]\\<^sub>\\<tau>\\<^sub>b)) = b_of \\<lbrace> z' : b'[bv::=b]\\<^sub>b\\<^sub>b | c' \\<rbrace>\" using subst_tb.simps by simp\n  ultimately show ?thesis using subst_tv.simps subst_tb.simps by simp\nqed\n\nlemmas wf_intros = wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.intros wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.intros\n\nlemmas freshers = fresh_prodN b.fresh c.fresh v.fresh ce.fresh fresh_GCons fresh_GNil fresh_at_base \n\nsection \\<open>Strong Elimination\\<close>\n\ntext \\<open>Inversion/elimination for well-formed polymorphic constructors \\<close>\nlemma wf_strong_elim:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" \n           and \\<Delta>::\\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and s::s and tm::\"'a::fs\" \n          and cs::branch_s and css::branch_list and \\<Theta>::\\<Theta>\n   shows  \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f (V_consp tyid dc b v) : b'' \\<Longrightarrow> (\\<exists> bv dclist x b' c. b'' = B_app tyid b \\<and>\n             AF_typedef_poly tyid bv dclist \\<in> set \\<Theta> \\<and>\n            (dc, \\<lbrace> x : b'  | c \\<rbrace>) \\<in> set dclist \\<and>\n               \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b  \\<and> atom bv \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>, b, v) \\<and>  \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b'[bv::=b]\\<^sub>b\\<^sub>b \\<and> atom bv \\<sharp> tm)\" and           \n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f  c           \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>                \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>            \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts \\<Longrightarrow> True\" and \n         \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<Longrightarrow>True\" and       \n         \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \\<Longrightarrow> True \" and      \n         \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b'    \\<Longrightarrow> True\" and\n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow>   True\"\nproof(nominal_induct\n      \"V_consp tyid dc b v\" b'' and c and \\<Gamma> and \\<tau> and ts and \\<Theta> and b and b' and td \n     avoiding: tm\n  \nrule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)\n  case (wfV_conspI bv dclist \\<Theta> x b' c \\<B> \\<Gamma>)\n  then show ?case by force\nqed(auto+)\n\nsection \\<open>Context Extension\\<close>\n\ndefinition wfExt :: \"\\<Theta> \\<Rightarrow> \\<B> \\<Rightarrow> \\<Gamma> \\<Rightarrow> \\<Gamma> \\<Rightarrow> bool\" (\" _ ; _  \\<turnstile>\\<^sub>w\\<^sub>f _ < _ \" [50,50,50] 50)   where\n  \"wfExt T B G1 G2 = (wfG T B G2 \\<and> wfG T B G1 \\<and> toSet G1 \\<subseteq> toSet G2)\" \n\nsection \\<open>Context\\<close>\n\nlemma wfG_cons[ms_wb]:\n  fixes \\<Gamma>::\\<Gamma>\n  assumes \"P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (z,b,c)  #\\<^sub>\\<Gamma>\\<Gamma>\"\n  shows \"P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and> atom z \\<sharp> \\<Gamma> \\<and> wfB P \\<B> b\" \n  using wfG_elims(2)[OF assms] by metis\n\nlemma wfG_cons2[ms_wb]:\n  fixes \\<Gamma>::\\<Gamma>\n  assumes \"P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f zbc  #\\<^sub>\\<Gamma>\\<Gamma>\"\n  shows \"P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" \nproof -\n  obtain z and b and c where zbc: \"zbc=(z,b,c)\" using prod_cases3 by blast\n  hence  \"P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (z,b,c)  #\\<^sub>\\<Gamma>\\<Gamma>\" using assms by auto\n  thus ?thesis using zbc wfG_cons assms by simp\nqed\n\nlemma wf_g_unique: \n  fixes \\<Gamma>::\\<Gamma>\n  assumes \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f  \\<Gamma>\" and \"(x,b,c) \\<in> toSet \\<Gamma>\" and \"(x,b',c') \\<in> toSet \\<Gamma>\"\n  shows \"b=b' \\<and> c=c'\"\nusing assms proof(induct \\<Gamma> rule: \\<Gamma>.induct)\n  case GNil\n  then show ?case by simp\nnext\n  case (GCons a \\<Gamma>)\n  consider \"(x,b,c)=a \\<and> (x,b',c')=a\" | \"(x,b,c)=a \\<and> (x,b',c')\\<noteq>a\" | \"(x,b,c)\\<noteq>a \\<and> (x,b',c')=a\" | \"(x,b,c)\\<noteq> a \\<and> (x,b',c')\\<noteq>a\" by blast\n  then show ?case proof(cases)\n    case 1\n    then show ?thesis  by auto\n  next\n    case 2\n    hence \"atom x \\<sharp> \\<Gamma>\"  using wfG_elims(2) GCons by blast\n    moreover have \"(x,b',c') \\<in> toSet \\<Gamma>\" using GCons 2 by force\n    ultimately show ?thesis    using forget_subst_gv fresh_GCons fresh_GNil fresh_gamma_elem \\<Gamma>.distinct subst_gv.simps 2 GCons by metis\n  next\n    case 3\n    hence \"atom x \\<sharp> \\<Gamma>\"  using wfG_elims(2) GCons by blast\n    moreover have \"(x,b,c) \\<in> toSet \\<Gamma>\" using GCons 3 by force\n    ultimately show ?thesis\n           using forget_subst_gv fresh_GCons fresh_GNil fresh_gamma_elem \\<Gamma>.distinct subst_gv.simps 3 GCons by metis\n  next\n    case 4\n    then obtain x'' and b'' and c''::c where xbc: \"a=(x'',b'',c'')\" \n      using prod_cases3 by blast\n    hence \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ((x'',b'',c'')  #\\<^sub>\\<Gamma>\\<Gamma>)\" using GCons wfG_elims by blast\n    hence \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and> (x, b, c) \\<in> toSet \\<Gamma> \\<and> (x, b', c') \\<in> toSet \\<Gamma>\"  using  GCons wfG_elims 4 xbc\n          prod_cases3 set_GConsD   using forget_subst_gv fresh_GCons fresh_GNil fresh_gamma_elem \\<Gamma>.distinct subst_gv.simps 4 GCons by meson\n    thus ?thesis using GCons by auto    \n  qed\nqed\n\nlemma lookup_if1:\n  fixes \\<Gamma>::\\<Gamma>\n  assumes \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" and  \"Some (b,c) = lookup \\<Gamma> x\"\n  shows \"(x,b,c) \\<in> toSet \\<Gamma> \\<and> (\\<forall>b' c'. (x,b',c') \\<in> toSet \\<Gamma> \\<longrightarrow> b'=b \\<and> c'=c)\"\nusing assms proof(induct \\<Gamma> rule: \\<Gamma>.induct)\n  case GNil\n  then show ?case by auto\nnext\n  case (GCons xbc \\<Gamma>)\n  then obtain x' and b' and c'::c where xbc: \"xbc=(x',b',c')\" \n    using prod_cases3 by blast\n  then show ?case using wf_g_unique GCons lookup_in_g xbc\n     lookup.simps set_GConsD wfG.cases \n     insertE insert_is_Un toSet.simps wfG_elims by metis\nqed\n\nlemma lookup_if2:\n  assumes \"wfG P \\<B> \\<Gamma>\" and   \"(x,b,c) \\<in> toSet \\<Gamma> \\<and> (\\<forall>b' c'. (x,b',c') \\<in> toSet \\<Gamma> \\<longrightarrow> b'=b \\<and> c'=c)\"\n  shows \"Some (b,c) = lookup \\<Gamma> x\" \nusing assms proof(induct \\<Gamma> rule: \\<Gamma>.induct)\n  case GNil\n  then show ?case by auto\nnext\n  case (GCons xbc \\<Gamma>)\n  then obtain x' and b' and c'::c where xbc: \"xbc=(x',b',c')\" \n    using prod_cases3 by blast\n  then show ?case proof(cases \"x=x'\")\n    case True\n    then show ?thesis using lookup.simps GCons xbc by simp\n  next\n    case False\n    then show ?thesis using lookup.simps GCons xbc toSet.simps Un_iff set_GConsD wfG_cons2 \n      by (metis (full_types) Un_iff set_GConsD toSet.simps(2) wfG_cons2)\n  qed\nqed\n    \nlemma lookup_iff:\n  fixes \\<Theta>::\\<Theta> and \\<Gamma>::\\<Gamma>\n  assumes \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\"\n  shows \"Some (b,c) = lookup \\<Gamma> x \\<longleftrightarrow> (x,b,c) \\<in> toSet \\<Gamma> \\<and> (\\<forall>b' c'. (x,b',c') \\<in> toSet \\<Gamma> \\<longrightarrow> b'=b \\<and> c'=c)\"\n  using assms lookup_if1 lookup_if2 by meson\n\nlemma wfG_lookup_wf:\n  fixes \\<Theta>::\\<Theta> and \\<Gamma>::\\<Gamma> and b::b and \\<B>::\\<B>\n  assumes \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" and \"Some (b,c) = lookup \\<Gamma> x\"\n  shows \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b\"\nusing assms proof(induct \\<Gamma> rule: \\<Gamma>_induct)\n  case GNil\n  then show ?case by auto\nnext\n  case (GCons x' b' c' \\<Gamma>')\n  then show ?case proof(cases \"x=x'\")\n    case True\n    then show ?thesis using lookup.simps wfG_elims(2) GCons by fastforce \n  next\n    case False\n    then show ?thesis using lookup.simps wfG_elims(2) GCons by fastforce \n  qed\nqed    \n\nlemma wfG_unique:\n  fixes \\<Gamma>::\\<Gamma>\n  assumes \"wfG B \\<Theta> ((x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\" and \"(x1,b1,c1) \\<in> toSet ((x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\" and \"x1=x\"\n  shows \"b1 = b \\<and> c1 = c\"\nproof - \n  have \"(x, b, c) \\<in> toSet ((x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\" by simp\n  thus ?thesis using wf_g_unique assms by blast\nqed\n\nlemma wfG_unique_full:\n  fixes \\<Gamma>::\\<Gamma>\n  assumes \"wfG \\<Theta> B (\\<Gamma>'@(x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\" and \"(x1,b1,c1) \\<in> toSet (\\<Gamma>'@(x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\" and \"x1=x\"\n  shows \"b1 = b \\<and> c1 = c\"\nproof - \n  have \"(x, b, c) \\<in> toSet (\\<Gamma>'@(x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\" by simp\n  thus ?thesis using wf_g_unique assms by blast\nqed\n\nsection \\<open>Converting between wb forms\\<close>\n\ntext \\<open> We cannot prove wfB properties here for expressions and statements as need some more facts about @{term \\<Phi>}\n   context which we can prove without this lemma. Trying to cram everything into a single large\n   mutually recursive lemma is not a good idea \\<close>\n\nlemma wfX_wfY1:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s\n           and css::branch_list\n  shows  wfV_wf: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b \\<Longrightarrow>  \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>  \" and              \n         wfC_wf: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \" and\n         wfG_wf :\"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<Longrightarrow>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\"  and\n         wfT_wf: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<Longrightarrow>  \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<and> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b_of \\<tau>\" and\n         wfTs_wf:\"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ts \\<Longrightarrow>  \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\" and \n         \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<Longrightarrow> True\" and       \n         wfB_wf: \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \\<Longrightarrow>   \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\" and      \n         wfCE_wf: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \"  and\n         wfTD_wf: \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\"\nproof(induct    rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)\n\n  case (wfV_varI \\<Theta> \\<B> \\<Gamma> b c x)\n  hence \"(x,b,c) \\<in> toSet \\<Gamma>\" using lookup_iff lookup_in_g by presburger\n  hence \"b \\<in> fst`snd`toSet \\<Gamma>\" by force\n  hence \"wfB \\<Theta> \\<B> b\" using wfV_varI using wfG_lookup_wf by auto\n  then show ?case using wfV_varI wfV_elims wf_intros by metis\nnext\n  case (wfV_litI \\<Theta> \\<B> \\<Gamma> l)\n  moreover have \"wfTh \\<Theta>\" using wfV_litI by metis\n  ultimately  show ?case using   wf_intros base_for_lit.simps l.exhaust by metis\nnext\n  case (wfV_pairI \\<Theta> \\<B> \\<Gamma> v1 b1 v2 b2)\n  then show ?case using wfB_pairI by simp\nnext\n  case (wfV_consI s dclist \\<Theta> dc x b c \\<B> \\<Gamma> v)\n  then show ?case using   wf_intros  by metis\nnext\n  case (wfTI z \\<Gamma> \\<Theta> \\<B> b c)\n  then show ?case using wf_intros b_of.simps wfG_cons2 by metis\nqed(auto)\n\nlemma wfX_wfY2:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s\n           and css::branch_list\n  shows \n         wfE_wf: \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<and>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<and> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>  \" and\n         wfS_wf: \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<and>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<and> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>   \" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow>  \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<and>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<and> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow>  \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<and>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<and> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \" and       \n         wfPhi_wf: \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>) \\<Longrightarrow>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\" and\n         wfD_wf:   \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<and>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \" and       \n         wfFTQ_wf: \"\\<Theta> ; \\<Phi>   \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>  \\<and> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\" and\n         wfFT_wf:  \"\\<Theta> ; \\<Phi>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<and>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\"           \nproof(induct    rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts)\n  case (wfS_varI \\<Theta> \\<B> \\<Gamma> \\<tau> v u \\<Delta> \\<Phi> s b)\n  then show ?case using wfD_elims by auto\nnext\n  case (wfS_assignI u \\<tau> \\<Delta> \\<Theta> \\<B> \\<Gamma> \\<Phi> v)\n  then show ?case using wf_intros by metis\nnext\n  case (wfD_emptyI \\<Theta> \\<B> \\<Gamma>)\n  then show ?case using wfX_wfY1 by auto\nnext\n  case (wfS_assertI \\<Theta> \\<Phi> \\<B> x c \\<Gamma> \\<Delta> s b)\n  then have \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" using wfX_wfY1 by auto\n  moreover have \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>\" using wfS_assertI by auto\n  moreover have \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>  \\<and>  \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \" using wfS_assertI by auto\n  ultimately  show ?case by auto\nqed(auto)\n\nlemmas wfX_wfY=wfX_wfY1 wfX_wfY2\n\nlemma setD_ConsD:\n  \"ut \\<in> setD (ut' #\\<^sub>\\<Delta> D) = (ut = ut' \\<or> ut \\<in> setD D)\"\nproof(induct D rule: \\<Delta>_induct)\n  case DNil\n  then show ?case by auto\nnext\n  case (DCons u' t' x2)\n  then show ?case using setD.simps by auto\nqed\n\nlemma wfD_wfT:\n  fixes \\<Delta>::\\<Delta> and \\<tau>::\\<tau>\n  assumes \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>\"\n  shows \"\\<forall>(u,\\<tau>) \\<in> setD \\<Delta>. \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"\nusing assms proof(induct \\<Delta> rule: \\<Delta>_induct)\n  case DNil\n  then show ?case by auto\nnext\n  case (DCons u' t' x2)\n  then show ?case using wfD_elims DCons setD_ConsD\n    by (metis case_prodI2 set_ConsD)\nqed\n\nlemma subst_b_lookup_d:\n  assumes \"u \\<notin> fst ` setD \\<Delta>\"\n  shows  \"u \\<notin> fst ` setD \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b\" \nusing assms proof(induct \\<Delta> rule: \\<Delta>_induct)\n  case DNil\n  then show ?case by auto\nnext\n  case (DCons u' t'  x2) \n  hence \"u\\<noteq>u'\" using DCons by simp\n  show ?case using DCons subst_db.simps by simp\nqed\n\nlemma wfG_cons_splitI:\n  fixes  \\<Phi>::\\<Phi> and \\<Gamma>::\\<Gamma>\n  assumes \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" and \"atom x \\<sharp> \\<Gamma>\" and \"wfB \\<Theta> \\<B> b\" and\n      \"c \\<in> { TRUE, FALSE } \\<longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \" and\n      \"c \\<notin> { TRUE, FALSE } \\<longrightarrow> \\<Theta>  ;\\<B> ;  (x,b,C_true)  #\\<^sub>\\<Gamma>\\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f c\"\n    shows \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ((x,b,c)  #\\<^sub>\\<Gamma>\\<Gamma>)\"\n  using wfG_cons1I wfG_cons2I assms by metis\n\nlemma wfG_consI:\n  fixes  \\<Phi>::\\<Phi> and \\<Gamma>::\\<Gamma> and c::c\n  assumes \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" and \"atom x \\<sharp> \\<Gamma>\" and \"wfB \\<Theta> \\<B> b\" and\n   \"\\<Theta>  ; \\<B> ; (x,b,C_true)  #\\<^sub>\\<Gamma>\\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f c\"\n  shows \"\\<Theta>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ((x,b,c)  #\\<^sub>\\<Gamma>\\<Gamma>)\"\n  using wfG_cons1I wfG_cons2I wfG_cons_splitI wfC_trueI assms by metis\n\nlemma wfG_elim2:\n  fixes c::c\n  assumes  \"wfG P \\<B>  ((x,b,c)  #\\<^sub>\\<Gamma>\\<Gamma>)\" \n  shows \"P; \\<B> ; (x, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c \\<and> wfB P \\<B> b\" \nproof(cases \"c \\<in> {TRUE,FALSE}\")\n  case True\n  have \"P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>  \\<and> atom x \\<sharp> \\<Gamma> \\<and> wfB P \\<B> b\"  using wfG_elims(2)[OF assms] by auto\n  hence \"P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ((x,b,TRUE)  #\\<^sub>\\<Gamma>\\<Gamma>) \\<and> wfB P \\<B> b\" using wfG_cons2I by auto\n  thus ?thesis using wfC_trueI wfC_falseI True by auto\nnext\n  case False\n  then show ?thesis using wfG_elims(2)[OF assms] by auto\nqed\n\nlemma wfG_cons_wfC:\n  fixes \\<Gamma>::\\<Gamma> and c::c\n  assumes \"\\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>\"\n  shows \"\\<Theta> ; B ; ((x, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c\"\n  using assms wfG_elim2 by auto\n\nlemma wfG_wfB:\n  assumes \"wfG P \\<B> \\<Gamma>\" and \"b \\<in> fst`snd`toSet \\<Gamma>\"\n  shows \"wfB P \\<B> b\"\nusing assms proof(induct \\<Gamma> rule:\\<Gamma>_induct)\ncase GNil\n  then show ?case by auto\nnext\n  case (GCons x' b' c' \\<Gamma>')\n  show ?case proof(cases \"b=b'\")\n    case True\n    then show ?thesis using wfG_elim2  GCons by auto\n  next\n    case False\n    hence \"b \\<in> fst`snd`toSet \\<Gamma>'\" using GCons by auto\n    moreover have \"wfG P \\<B> \\<Gamma>'\" using wfG_cons GCons by auto\n    ultimately show ?thesis using GCons by auto\n  qed\nqed\n\nlemma wfG_cons_TRUE:\n  fixes \\<Gamma>::\\<Gamma> and b::b\n  assumes \"P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" and \"atom z \\<sharp> \\<Gamma>\" and \"P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b\"\n  shows \"P  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (z, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>\" \n  using wfG_cons2I wfG_wfB assms by simp\n\nlemma wfG_cons_TRUE2:\n  assumes \"P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (z,b,c)  #\\<^sub>\\<Gamma>\\<Gamma>\" and \"atom z \\<sharp> \\<Gamma>\"\n  shows \"P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (z, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>\" \n  using  wfG_cons wfG_cons2I assms by simp\n\nlemma wfG_suffix:\n  fixes \\<Gamma>::\\<Gamma>\n  assumes \"wfG P \\<B> (\\<Gamma>'@\\<Gamma>)\"\n  shows \"wfG P \\<B> \\<Gamma>\"\nusing assms proof(induct \\<Gamma>' rule: \\<Gamma>_induct)\n  case GNil\n  then show ?case by auto\nnext\n  case (GCons x b c \\<Gamma>')\n  hence \" P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' @ \\<Gamma>\" using wfG_elims by auto\n  then show ?case using GCons  wfG_elims by auto\nqed\n\nlemma wfV_wfCE:\n  fixes v::v\n  assumes \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b\" \n  shows \" \\<Theta> ;  \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f CE_val v : b\"\nproof -\n  have  \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f ([]::\\<Phi>) \"  using wfPhi_emptyI wfV_wf wfG_wf assms by metis\n  moreover have \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f []\\<^sub>\\<Delta>\" using wfD_emptyI wfV_wf wfG_wf assms by metis\n  ultimately show ?thesis using wfCE_valI assms by auto\nqed\n  \nsection \\<open>Support\\<close>\n\nlemma wf_supp1:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css ::branch_list\n\n  shows  wfV_supp: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b \\<Longrightarrow>  supp v \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\" and       \n         wfC_supp: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow> supp c \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\" and\n         wfG_supp: \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<Longrightarrow>  atom_dom \\<Gamma> \\<subseteq> supp \\<Gamma>\" and\n         wfT_supp: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<Longrightarrow>  supp \\<tau> \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B> \" and\n         wfTs_supp: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ts \\<Longrightarrow>  supp ts \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\" and \n         wfTh_supp: \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<Longrightarrow> supp \\<Theta> = {}\" and       \n         wfB_supp: \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \\<Longrightarrow> supp b \\<subseteq> supp \\<B>\" and      \n         wfCE_supp: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b \\<Longrightarrow> supp ce \\<subseteq>  atom_dom \\<Gamma> \\<union> supp \\<B>\" and\n         wfTD_supp: \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow> supp td \\<subseteq>  {}\" \nproof(induct    rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)\n  case (wfB_consI \\<Theta> s dclist \\<B>)\n  then show ?case by(auto simp add: b.supp pure_supp)\nnext\n  case (wfB_appI \\<Theta> \\<B> b s bv dclist)\n  then show ?case by(auto simp add: b.supp pure_supp)\nnext\n  case (wfV_varI \\<Theta> \\<B> \\<Gamma> b c x)\n  then show ?case using v.supp wfV_elims  \n     empty_subsetI insert_subset supp_at_base \n     fresh_dom_free2 lookup_if1 \n    by (metis sup.coboundedI1)\nnext\n  case (wfV_litI \\<Theta> \\<B> \\<Gamma> l)\n  then show ?case using supp_l_empty v.supp by simp\nnext\n  case (wfV_pairI \\<Theta> \\<B> \\<Gamma> v1 b1 v2 b2)\n   then show ?case using v.supp wfV_elims  by (metis Un_subset_iff)\nnext\n  case (wfV_consI s dclist \\<Theta> dc x b c \\<B> \\<Gamma> v)\n  then show ?case using v.supp wfV_elims  \n    Un_commute b.supp sup_bot.right_neutral supp_b_empty pure_supp by metis\nnext\n  case (wfV_conspI typid bv dclist \\<Theta> dc x b' c \\<B> \\<Gamma> v b)\n  then show ?case  unfolding v.supp \n    using wfV_elims  \n    Un_commute b.supp sup_bot.right_neutral supp_b_empty pure_supp \n    by (simp add: Un_commute pure_supp sup.coboundedI1)\nnext\n  case (wfC_eqI \\<Theta> \\<B> \\<Gamma> e1 b e2)\n  hence \"supp e1 \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using   c.supp wfC_elims \n    image_empty list.set(1) sup_bot.right_neutral  by (metis IntI UnE empty_iff subsetCE subsetI)\n  moreover have \"supp e2 \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using   c.supp wfC_elims \n    image_empty list.set(1) sup_bot.right_neutral IntI UnE empty_iff subsetCE subsetI\n    by (metis wfC_eqI.hyps(4))\n  ultimately show ?case using c.supp by auto\nnext\n  case (wfG_cons1I c \\<Theta> \\<B> \\<Gamma> x b)\n  then show ?case using atom_dom.simps  dom_supp_g supp_GCons by metis\nnext\n  case (wfG_cons2I c \\<Theta> \\<B> \\<Gamma> x b)\n  then show ?case using atom_dom.simps  dom_supp_g supp_GCons by metis\nnext\n  case wfTh_emptyI\n  then show ?case  by (simp add: supp_Nil)\nnext\n  case (wfTh_consI \\<Theta> lst)\n  then show ?case using supp_Cons by fast\nnext\n  case (wfTD_simpleI \\<Theta> lst s)\n  then have \"supp (AF_typedef s lst ) = supp lst \\<union> supp s\" using type_def.supp  by auto\n  then show ?case using wfTD_simpleI pure_supp \n    by (simp add: pure_supp supp_Cons supp_at_base)\nnext\n  case (wfTD_poly \\<Theta> bv lst s)\n  then have \"supp (AF_typedef_poly s bv lst ) = supp lst - { atom bv } \\<union> supp s\" using type_def.supp  by auto\n  then show ?case using wfTD_poly pure_supp \n    by (simp add: pure_supp supp_Cons supp_at_base)\nnext\n  case (wfTs_nil \\<Theta> \\<B> \\<Gamma>)\n  then show ?case using supp_Nil by auto\nnext\n  case (wfTs_cons \\<Theta> \\<B> \\<Gamma> \\<tau> dc ts)\n  then show ?case using supp_Cons supp_Pair pure_supp[of dc] by blast\nnext\n  case (wfCE_valI \\<Theta> \\<B> \\<Gamma> v b)\n  thus ?case using ce.supp wfCE_elims by simp\nnext\n  case (wfCE_plusI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  hence \"supp (CE_op Plus v1 v2) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using ce.supp pure_supp \n    by (simp add: wfCE_plusI opp.supp)  \n  then show ?case using  ce.supp wfCE_elims UnCI subsetCE subsetI x_not_in_b_set by auto\nnext\n  case (wfCE_leqI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  hence \"supp (CE_op LEq v1 v2) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using ce.supp pure_supp \n    by (simp add: wfCE_plusI opp.supp)  \n  then show ?case using  ce.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by auto\nnext\n  case (wfCE_eqI \\<Theta> \\<B> \\<Gamma> v1 b v2 )\n  hence \"supp (CE_op Eq v1 v2) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using ce.supp pure_supp \n    by (simp add: wfCE_eqI opp.supp)  \n  then show ?case using  ce.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by auto\nnext\n  case (wfCE_fstI \\<Theta> \\<B> \\<Gamma> v1 b1 b2)\n  thus ?case using ce.supp wfCE_elims by simp\nnext\n  case (wfCE_sndI \\<Theta> \\<B> \\<Gamma> v1 b1 b2)\n thus ?case using ce.supp wfCE_elims by simp\nnext\n  case (wfCE_concatI \\<Theta>  \\<B> \\<Gamma> v1 v2)\n  thus ?case using ce.supp wfCE_elims by simp\nnext\n  case (wfCE_lenI \\<Theta>  \\<B> \\<Gamma>  v1)\n  thus ?case using ce.supp wfCE_elims by simp\nnext\n   case (wfTI z \\<Theta> \\<B> \\<Gamma> b c)\n  hence \"supp c \\<subseteq> supp z \\<union> atom_dom \\<Gamma> \\<union> supp \\<B>\" using  supp_at_base dom_cons  by metis\n  moreover have \"supp b \\<subseteq> supp \\<B>\"  using wfTI by auto\n  ultimately have \" supp  \\<lbrace> z : b  | c \\<rbrace> \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using \\<tau>.supp supp_at_base by force\n  thus ?case by auto\nqed(auto)\n\nlemma wf_supp2:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and \n        ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and b::b and ftq::fun_typ_q and \n        ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css ::branch_list\n  shows\n         wfE_supp: \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b \\<Longrightarrow> (supp e \\<subseteq>  atom_dom \\<Gamma> \\<union> supp \\<B> \\<union> atom ` fst ` setD \\<Delta>)\" and (* \\<and> ( \\<Phi> = [] \\<longrightarrow> supp e \\<inter> supp \\<B> = {})\" and*)\n         wfS_supp: \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<Longrightarrow> supp s \\<subseteq> atom_dom \\<Gamma> \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow>  supp cs \\<subseteq> atom_dom \\<Gamma> \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow>  supp css \\<subseteq> atom_dom \\<Gamma> \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\" and      \n         wfPhi_supp: \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>) \\<Longrightarrow>  supp \\<Phi> = {}\" and\n         wfD_supp: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<Longrightarrow> supp \\<Delta> \\<subseteq> atom`fst`(setD \\<Delta>) \\<union> atom_dom \\<Gamma> \\<union> supp \\<B> \" and      \n         \"\\<Theta> ; \\<Phi>   \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> supp ftq = {}\" and\n         \"\\<Theta> ; \\<Phi>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow> supp ft \\<subseteq> supp \\<B>\"      \nproof(induct    rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts)\n  case (wfE_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v b)\n  hence \"supp (AE_val v) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using e.supp wf_supp1 by simp\n  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis\nnext\n  case (wfE_plusI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  hence \"supp (AE_op Plus v1 v2) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  \n    using  wfE_plusI opp.supp wf_supp1 e.supp pure_supp Un_least \n    by (metis sup_bot.left_neutral)\n\n  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis\nnext\n  case (wfE_leqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  hence \"supp (AE_op LEq v1 v2) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using e.supp pure_supp Un_least \n    sup_bot.left_neutral  using opp.supp wf_supp1 by auto\n  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis\nnext\n  case (wfE_eqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b v2)\n  hence \"supp (AE_op Eq v1 v2) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using e.supp pure_supp Un_least \n    sup_bot.left_neutral  using opp.supp wf_supp1 by auto\n  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis\nnext\n  case (wfE_fstI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n hence \"supp (AE_fst  v1 ) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using e.supp pure_supp   sup_bot.left_neutral  using opp.supp wf_supp1 by auto\n  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis\nnext\n  case (wfE_sndI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n hence \"supp (AE_snd  v1 ) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using e.supp pure_supp     wfE_plusI opp.supp wf_supp1  by (metis Un_least)\n  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis\nnext\n  case (wfE_concatI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  hence \"supp (AE_concat v1 v2) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using e.supp pure_supp \n    wfE_plusI opp.supp wf_supp1  by (metis Un_least)\n  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis\nnext\n  case (wfE_splitI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  hence \"supp (AE_split v1 v2) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using e.supp pure_supp \n    wfE_plusI opp.supp wf_supp1  by (metis Un_least)\n  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis\nnext\n  case (wfE_lenI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1)\n  hence \"supp (AE_len v1 ) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using e.supp pure_supp \n    using e.supp pure_supp   sup_bot.left_neutral  using opp.supp wf_supp1 by auto\n  then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis\nnext\n  case (wfE_appI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> f x b c \\<tau> s v)\n  then obtain b where \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b\" using wfE_elims by metis          \n  hence  \"supp v \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"  using wfE_appI wf_supp1 by metis\n  hence \"supp (AE_app f v) \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\" using e.supp pure_supp by fast\n  then show ?case using  e.supp(2)  UnCI subsetCE subsetI wfE_appI  using b.supp(3) pure_supp x_not_in_b_set by metis\nnext\n  case (wfE_appPI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> b' bv v \\<tau> f xa ba ca s)\n  then obtain b where \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : ( b[bv::=b']\\<^sub>b)\" using wfE_elims by metis          \n  hence  \"supp v \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B> \"  using wfE_appPI wf_supp1 by auto\n  moreover have \"supp b' \\<subseteq> supp  \\<B>\" using wf_supp1(7) wfE_appPI by simp\n  ultimately show ?case unfolding  e.supp using  wfE_appPI pure_supp by fast\nnext\n  case (wfE_mvarI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> u \\<tau>)\n     then  obtain \\<tau> where \"(u,\\<tau>) \\<in> setD \\<Delta>\" using wfE_elims(10) by metis\n  hence \"atom u \\<in> atom`fst`setD \\<Delta>\" by force\n  hence \"supp (AE_mvar u ) \\<subseteq> atom`fst`setD \\<Delta>\" using e.supp\n    by (simp add: supp_at_base)\n  thus ?case using UnCI subsetCE subsetI e.supp wfE_mvarI supp_at_base subsetCE supp_at_base u_not_in_b_set \n    by (simp add: supp_at_base)\nnext\n  case (wfS_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> v b \\<Delta>)\n  then show ?case using wf_supp1 \n    by (metis s_branch_s_branch_list.supp(1) sup.coboundedI2 sup_assoc sup_commute) \nnext\n  case (wfS_letI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> e b' x s b)\n  then show ?case  by auto\nnext\n  case (wfS_let2I \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 \\<tau> x s2 b)\n  then show ?case unfolding  s_branch_s_branch_list.supp (3) using wf_supp1(4)[OF wfS_let2I(3)] by auto\nnext\n  case (wfS_ifI \\<Theta> \\<B> \\<Gamma> v \\<Phi> \\<Delta> s1 b s2)\n  then show ?case  using wf_supp1(1)[OF wfS_ifI(1)]  by auto\nnext\n  case (wfS_varI \\<Theta> \\<B> \\<Gamma> \\<tau> v u \\<Delta> \\<Phi> s b)\n  then show ?case  using  wf_supp1(1)[OF wfS_varI(2)]  wf_supp1(4)[OF wfS_varI(1)]  by auto\nnext\nnext\n  case (wfS_assignI u \\<tau> \\<Delta> \\<Theta> \\<B> \\<Gamma> \\<Phi> v)\n  hence \"supp u \\<subseteq> atom ` fst ` setD \\<Delta>\" proof(induct \\<Delta> rule:\\<Delta>_induct)\n    case DNil\n    then show ?case by auto\n  next\n    case (DCons u' t' \\<Delta>')\n    show ?case proof(cases \"u=u'\")\n      case True\n      then show ?thesis using toSet.simps DCons supp_at_base by fastforce\n    next\n      case False\n      then show ?thesis  using toSet.simps DCons supp_at_base wfS_assignI \n        by (metis empty_subsetI fstI image_eqI insert_subset)\n    qed\n  qed\n  then show ?case using s_branch_s_branch_list.supp(8) wfS_assignI wf_supp1(1)[OF wfS_assignI(6)] by auto\nnext\n  case (wfS_matchI \\<Theta> \\<B> \\<Gamma> v tid dclist \\<Delta> \\<Phi> cs b)\n  then show ?case using wf_supp1(1)[OF wfS_matchI(1)] by auto\nnext\n case (wfS_branchI \\<Theta> \\<Phi> \\<B> x \\<tau> \\<Gamma> \\<Delta> s b tid dc)\n  moreover have \"supp s \\<subseteq> supp x \\<union> atom_dom \\<Gamma> \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\" \n    using dom_cons supp_at_base wfS_branchI by auto\n  moreover hence \"supp s - set [atom x] \\<subseteq> atom_dom \\<Gamma> \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\" using supp_at_base by force\n  ultimately have\n     \"(supp s - set [atom x]) \\<union> (supp dc ) \\<subseteq> atom_dom \\<Gamma> \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\"\n     by (simp add: pure_supp)\n  thus ?case using s_branch_s_branch_list.supp(2) by auto\nnext\n  case (wfD_emptyI \\<Theta> \\<B> \\<Gamma>)\n  then show ?case using supp_DNil by auto\nnext\n  case (wfD_cons \\<Theta> \\<B> \\<Gamma> \\<Delta> \\<tau> u)\n  have \"supp ((u, \\<tau>)  #\\<^sub>\\<Delta> \\<Delta>) = supp u \\<union> supp \\<tau> \\<union> supp \\<Delta>\" using supp_DCons supp_Pair by metis\n  also have \"... \\<subseteq>  supp u \\<union> atom ` fst ` setD \\<Delta> \\<union> atom_dom \\<Gamma> \\<union> supp \\<B>\" \n    using wfD_cons wf_supp1(4)[OF wfD_cons(3)] by auto\n  also have \"... \\<subseteq> atom ` fst ` setD ((u, \\<tau>)  #\\<^sub>\\<Delta> \\<Delta>) \\<union> atom_dom \\<Gamma> \\<union> supp \\<B>\" using supp_at_base by auto\n  finally show ?case by auto\nnext\n  case (wfPhi_emptyI \\<Theta>)\n  then show ?case using supp_Nil by auto\nnext\n  case (wfPhi_consI f \\<Theta> \\<Phi> ft)\n  then show ?case using fun_def.supp\n    by (simp add: pure_supp supp_Cons)\nnext\n  case (wfFTI \\<Theta> B' b s x c \\<tau> \\<Phi>)\n  have \" supp (AF_fun_typ x b c \\<tau> s) = supp c \\<union> (supp \\<tau> \\<union> supp s) - set [atom x] \\<union> supp b\" using fun_typ.supp by auto\n  thus ?case using wfFTI wf_supp1 \n  proof -\n    have f1: \"supp \\<tau> \\<subseteq> {atom x} \\<union> atom_dom GNil \\<union> supp B'\"\n      using dom_cons wfFTI.hyps wf_supp1(4) by blast (* 0.0 ms *)\n    have \"supp b \\<subseteq> supp B'\"\n      using wfFTI.hyps(1) wf_supp1(7) by blast (* 0.0 ms *)\n    then show ?thesis\n      using f1 \\<open>supp (AF_fun_typ x b c \\<tau> s) = supp c \\<union> (supp \\<tau> \\<union> supp s) - set [atom x] \\<union> supp b\\<close> \n             wfFTI.hyps(4) wfFTI.hyps by auto (* 234 ms *)\n  qed \nnext\n  case (wfFTNone \\<Theta> \\<Phi> ft)\n  then show ?case by (simp add: fun_typ_q.supp(2))\nnext\n  case (wfFTSome \\<Theta> \\<Phi> bv ft)\n  then show ?case using fun_typ_q.supp\n    by (simp add: supp_at_base)\nnext\n  case (wfS_assertI \\<Theta> \\<Phi> \\<B> x c \\<Gamma> \\<Delta> s b)\n  then have \"supp c \\<subseteq> atom_dom \\<Gamma> \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\" using wf_supp1 \n    by (metis Un_assoc Un_commute le_supI2)\n  moreover have \"supp s  \\<subseteq> atom_dom \\<Gamma> \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\" proof \n    fix z\n    assume *:\"z \\<in> supp s\"\n    have **:\"atom x \\<notin> supp s\" using wfS_assertI fresh_prodN fresh_def by metis\n    have \"z \\<in> atom_dom ((x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma>) \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\" using wfS_assertI * by blast\n    have \"z \\<in>  atom_dom ((x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma>) \\<Longrightarrow> z \\<in> atom_dom \\<Gamma>\" using * ** by auto \n    thus  \"z \\<in> atom_dom \\<Gamma> \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\" using * ** \n      using \\<open>z \\<in> atom_dom ((x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma>) \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\\<close> by blast\n  qed \n  ultimately show ?case by auto\nqed(auto)\n\nlemmas wf_supp = wf_supp1 wf_supp2\n\nlemma wfV_supp_nil:\n  fixes v::v\n  assumes \"P ; {||} ; GNil \\<turnstile>\\<^sub>w\\<^sub>f v : b\" \n  shows \"supp v = {}\"\n  using wfV_supp[of P \" {||}\"  GNil v b] dom.simps toSet.simps\n  using assms by auto\n\nlemma wfT_TRUE_aux:\n  assumes \"wfG P \\<B> \\<Gamma>\" and \"atom z \\<sharp> (P, \\<B>, \\<Gamma>)\" and \"wfB P \\<B> b\"\n  shows \"wfT P \\<B> \\<Gamma> (\\<lbrace> z : b  | TRUE \\<rbrace>)\"  \nproof (rule)\n  show \\<open> atom z \\<sharp> (P, \\<B>, \\<Gamma>)\\<close> using assms by auto\n  show \\<open> P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \\<close> using assms by auto\n  show \\<open> P ;\\<B> ;  (z, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f TRUE \\<close> using wfG_cons2I wfC_trueI assms by auto\nqed\n\nlemma wfT_TRUE:\n  assumes \"wfG P \\<B> \\<Gamma>\" and \"wfB P \\<B> b\"\n  shows \"wfT P \\<B> \\<Gamma> (\\<lbrace> z : b  | TRUE \\<rbrace>)\" \nproof -\n  obtain z'::x where *:\"atom z' \\<sharp> (P, \\<B>, \\<Gamma>)\" using obtain_fresh by metis\n  hence \"\\<lbrace> z : b  | TRUE \\<rbrace> = \\<lbrace> z' : b  | TRUE \\<rbrace>\" by auto\n  thus ?thesis using wfT_TRUE_aux assms * by metis\nqed\n\nlemma phi_flip_eq:\n  assumes \"wfPhi T P\"\n  shows  \"(x \\<leftrightarrow> xa) \\<bullet> P = P\"\n  using wfPhi_supp[OF assms] flip_fresh_fresh fresh_def by blast\n\nlemma wfC_supp_cons:\n  fixes c'::c and G::\\<Gamma>\n  assumes \"P; \\<B> ; (x', b' , TRUE)  #\\<^sub>\\<Gamma>G \\<turnstile>\\<^sub>w\\<^sub>f c'\" \n  shows \"supp c' \\<subseteq> atom_dom G \\<union> supp x' \\<union> supp \\<B>\" and \"supp c' \\<subseteq> supp G \\<union> supp x' \\<union> supp \\<B>\"\nproof -\n  show \"supp c' \\<subseteq> atom_dom G \\<union> supp x' \\<union> supp \\<B>\"\n    using  wfC_supp[OF assms] dom_cons supp_at_base by blast\n  moreover have \"atom_dom G \\<subseteq> supp G\"\n    by (meson assms wfC_wf wfG_cons wfG_supp)\n  ultimately show \"supp c' \\<subseteq> supp G \\<union> supp x' \\<union> supp \\<B>\" using wfG_supp assms wfG_cons wfC_wf by fast\nqed\n\nlemma wfG_dom_supp:\n  fixes x::x\n  assumes \"wfG P \\<B> G\"\n  shows \"atom x \\<in> atom_dom G \\<longleftrightarrow> atom x \\<in> supp G\"\nusing assms proof(induct G rule: \\<Gamma>_induct)\n  case GNil\n  then show ?case using dom.simps  supp_of_atom_list\n    using supp_GNil by auto\nnext\n  case (GCons x' b' c' G)\n\n  show ?case proof(cases \"x' = x\")\n    case True\n    then show ?thesis using dom.simps supp_of_atom_list supp_at_base \n      using supp_GCons by auto\n  next\n    case False\n    have \"(atom x \\<in> atom_dom ((x', b', c')   #\\<^sub>\\<Gamma> G)) = (atom x \\<in> atom_dom G)\" using atom_dom.simps False by simp\n    also have \"... = (atom x \\<in> supp  G)\" using GCons wfG_elims by metis\n    also have \"... = (atom x \\<in> (supp (x', b', c') \\<union> supp G))\" proof\n      show \"atom x \\<in> supp G \\<Longrightarrow> atom x \\<in> supp (x', b', c') \\<union> supp G\" by auto\n      assume \"atom x \\<in> supp (x', b', c') \\<union> supp G\"\n      then consider \"atom x \\<in> supp (x', b', c')\" | \"atom x \\<in> supp G\" by auto\n      then show \"atom x \\<in> supp G\" proof(cases)\n        case 1\n        assume \" atom x \\<in> supp (x', b', c') \"\n        hence \"atom x \\<in>  supp c'\" using supp_triple False supp_b_empty supp_at_base by force\n\n        moreover have \"P; \\<B> ; (x', b' , TRUE)  #\\<^sub>\\<Gamma>G \\<turnstile>\\<^sub>w\\<^sub>f c'\" using wfG_elim2 GCons by simp\n        moreover hence \"supp c' \\<subseteq> supp G \\<union> supp x' \\<union> supp \\<B>\" using wfC_supp_cons by auto\n        ultimately have  \"atom x \\<in> supp G \\<union> supp x' \"   using x_not_in_b_set by auto\n        then show ?thesis using False supp_at_base  by (simp add: supp_at_base)\n      next\n        case 2\n        then show ?thesis by simp\n      qed\n    qed\n    also have \"... = (atom x \\<in> supp ((x', b', c')   #\\<^sub>\\<Gamma> G))\"  using supp_at_base False supp_GCons by simp\n    finally show ?thesis by simp\n  qed\nqed\n\nlemma wfG_atoms_supp_eq : \n  fixes x::x\n  assumes \"wfG P \\<B> G\"\n  shows \"atom x \\<in> atom_dom G \\<longleftrightarrow> atom x \\<in> supp G\"\n  using wfG_dom_supp assms by auto\n\nlemma beta_flip_eq:\n  fixes x::x and xa::x and \\<B>::\\<B>\n  shows  \"(x \\<leftrightarrow> xa) \\<bullet> \\<B> = \\<B>\"\nproof - \n  have \"atom x \\<sharp> \\<B> \\<and> atom xa \\<sharp> \\<B>\" using x_not_in_b_set fresh_def supp_set by metis\n  thus ?thesis  by (simp add: flip_fresh_fresh fresh_def)\nqed\n\nlemma theta_flip_eq2:\n  assumes \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\"\n  shows  \" (z \\<leftrightarrow> za ) \\<bullet> \\<Theta> = \\<Theta>\"\nproof -\n  have \"supp \\<Theta> = {}\" using wfTh_supp assms by simp\n  thus ?thesis \n      by (simp add: flip_fresh_fresh fresh_def)\n  qed\n\nlemma theta_flip_eq:\n  assumes \"wfTh \\<Theta>\"\n  shows  \"(x \\<leftrightarrow> xa) \\<bullet> \\<Theta> = \\<Theta>\"\n  using wfTh_supp flip_fresh_fresh fresh_def \n  by (simp add: assms theta_flip_eq2)\n\nlemma wfT_wfC:\n  fixes c::c \n  assumes \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<lbrace> z : b | c \\<rbrace>\" and \"atom z \\<sharp> \\<Gamma>\"\n  shows \"\\<Theta>; \\<B>; (z,b,TRUE)  #\\<^sub>\\<Gamma>\\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f c\"\nproof -\n  obtain za ba ca where *:\"\\<lbrace> z : b  | c \\<rbrace> = \\<lbrace> za : ba  | ca \\<rbrace> \\<and> atom za \\<sharp> (\\<Theta>,\\<B>,\\<Gamma>) \\<and>  \\<Theta>; \\<B>; (za, ba, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ca\"\n    using wfT_elims[OF assms(1)] by metis\n  hence c1: \"[[atom z]]lst. c = [[atom za]]lst. ca\" using \\<tau>.eq_iff by meson\n  show ?thesis proof(cases \"z=za\")\n    case True\n    hence \"ca = c\" using  c1  by (simp add: Abs1_eq_iff(3))\n    then show ?thesis using * True by simp\n  next\n    case False\n    have \" \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\" using wfT_wf wfG_wf assms by metis\n    moreover have \"atom za \\<sharp> \\<Gamma>\" using * fresh_prodN by auto\n    ultimately have  \"\\<Theta>; \\<B>; (z \\<leftrightarrow> za ) \\<bullet> (za, ba, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f (z \\<leftrightarrow> za ) \\<bullet> ca\" \n      using wfC.eqvt theta_flip_eq2  beta_flip_eq * GCons_eqvt assms flip_fresh_fresh  by metis\n    moreover have \"atom z \\<sharp> ca\"     \n    proof -\n      have \"supp ca \\<subseteq> atom_dom \\<Gamma> \\<union> { atom za } \\<union> supp \\<B>\" using  * wfC_supp atom_dom.simps toSet.simps by fastforce\n      moreover have \"atom z \\<notin> atom_dom \\<Gamma> \" using assms fresh_def wfT_wf  wfG_dom_supp wfC_supp by metis\n      moreover hence  \"atom z \\<notin> atom_dom \\<Gamma> \\<union> { atom za }\" using False by simp\n      moreover have \"atom z \\<notin> supp \\<B>\" using x_not_in_b_set by simp\n      ultimately show ?thesis using fresh_def False by fast\n    qed\n    moreover hence  \"(z \\<leftrightarrow> za ) \\<bullet> ca = c\" using type_eq_subst_eq1(3)  * by metis \n    ultimately show  ?thesis using assms G_cons_flip_fresh * by auto\n  qed\nqed\n\nlemma u_not_in_dom_g:\n  fixes u::u\n  shows  \"atom u \\<notin> atom_dom  G\"\n  using toSet.simps atom_dom.simps u_not_in_x_atoms by auto\n\nlemma bv_not_in_dom_g:\n  fixes bv::bv\n  shows  \"atom bv \\<notin> atom_dom  G\"\n  using toSet.simps atom_dom.simps u_not_in_x_atoms by auto\n  \ntext \\<open>An important lemma that confirms that @{term \\<Gamma>} does not rely on mutable variables\\<close>\nlemma u_not_in_g:\n  fixes u::u\n  assumes \"wfG \\<Theta> B G\"\n  shows  \"atom u \\<notin> supp G\"\nusing assms proof(induct G rule: \\<Gamma>_induct)\ncase GNil\n  then show ?case using supp_GNil fresh_def \n    using fresh_set_empty by fastforce\nnext\n  case (GCons x b c \\<Gamma>')\n   moreover hence \"atom u \\<notin> supp b\"  using \n    wfB_supp wfC_supp u_not_in_x_atoms wfG_elims wfX_wfY by auto\n   moreover hence \"atom u \\<notin> supp x\"  using u_not_in_x_atoms supp_at_base by blast\n   moreover hence \"atom u \\<notin> supp c\" proof -\n     have \"\\<Theta> ; B ; (x, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>'   \\<turnstile>\\<^sub>w\\<^sub>f c\" using wfG_cons_wfC GCons by simp\n     hence \"supp c \\<subseteq> atom_dom ((x, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>') \\<union> supp B\" using wfC_supp by blast\n     thus ?thesis using u_not_in_dom_g u_not_in_b_atoms \n       using u_not_in_b_set by auto\n   qed\n   ultimately have \"atom u \\<notin> supp (x,b,c)\" using supp_Pair by simp\n   thus  ?case using supp_GCons GCons wfG_elims by blast\nqed\n\ntext \\<open>An important lemma that confirms that types only depend on immutable variables\\<close>\nlemma u_not_in_t:\n  fixes u::u\n  assumes \"wfT \\<Theta> B G \\<tau>\"\n  shows  \"atom u \\<notin> supp \\<tau>\"\nproof -\n  have \"supp \\<tau> \\<subseteq> atom_dom G \\<union> supp B\" using  wfT_supp assms by auto\n  thus ?thesis using u_not_in_dom_g u_not_in_b_set  by blast \nqed  \n\nlemma wfT_supp_c:\n  fixes \\<B>::\\<B> and z::x\n  assumes \"wfT P \\<B> \\<Gamma> (\\<lbrace> z : b  | c \\<rbrace>)\" \n  shows \"supp c - { atom z } \\<subseteq> atom_dom \\<Gamma> \\<union> supp  \\<B>\"\n  using wf_supp \\<tau>.supp assms \n  by (metis Un_subset_iff empty_set list.simps(15)) \n\nlemma wfG_wfC[ms_wb]:\n  assumes \"wfG P \\<B> ((x,b,c)  #\\<^sub>\\<Gamma>\\<Gamma>)\"\n  shows \"wfC P \\<B> ((x,b,TRUE)  #\\<^sub>\\<Gamma>\\<Gamma>) c\"\nusing assms proof(cases \"c \\<in> {TRUE,FALSE}\")\n  case True\n  have \"atom x \\<sharp> \\<Gamma> \\<and> wfG P \\<B> \\<Gamma> \\<and> wfB P \\<B> b\" using wfG_cons assms by auto\n  hence \"wfG P \\<B>  ((x,b,TRUE)  #\\<^sub>\\<Gamma>\\<Gamma>)\" using wfG_cons2I by auto\n  then show ?thesis using wfC_trueI wfC_falseI True by auto\nnext\n  case False\n  then show ?thesis using wfG_elims assms by blast\nqed\n\nlemma wfT_wf_cons: \n  assumes \"wfT P \\<B> \\<Gamma> \\<lbrace> z : b  | c \\<rbrace>\" and \"atom z \\<sharp> \\<Gamma>\"\n  shows \"wfG P \\<B> ((z,b,c)  #\\<^sub>\\<Gamma>\\<Gamma>)\"\nusing assms proof(cases \"c \\<in> { TRUE,FALSE }\")\n  case True\n  then show ?thesis using wfT_wfC wfC_wf wfG_wfB  wfG_cons2I assms wfT_wf by fastforce\nnext\n  case False\n  then show ?thesis using wfT_wfC wfC_wf wfG_wfB  wfG_cons1I wfT_wf wfT_wfC assms by fastforce\nqed\n\nlemma wfV_b_fresh:\n  fixes b::b and v::v and bv::bv \n  assumes  \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v: b\" and \"bv |\\<notin>| \\<B>\"\n  shows \"atom bv \\<sharp> v\"\nusing wfV_supp  bv_not_in_dom_g fresh_def assms bv_not_in_bset_supp by blast\n\nlemma wfCE_b_fresh:\n  fixes b::b and ce::ce and bv::bv \n  assumes  \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce: b\" and \"bv |\\<notin>| \\<B>\"\n  shows \"atom bv \\<sharp> ce\"\nusing bv_not_in_dom_g fresh_def assms bv_not_in_bset_supp wf_supp1(8) by fast\n \nsection \\<open>Freshness\\<close>\n\nlemma wfG_fresh_x:\n  fixes \\<Gamma>::\\<Gamma> and z::x\n  assumes \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" and \"atom z \\<sharp> \\<Gamma>\" \n  shows \"atom z \\<sharp> (\\<Theta>,\\<B>, \\<Gamma>)\"\nunfolding fresh_prodN apply(intro conjI)\n  using wf_supp1 wfX_wfY assms fresh_def x_not_in_b_set by(metis empty_iff)+\n\nlemma wfG_wfT:\n  assumes \"wfG P \\<B> ((x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v)   #\\<^sub>\\<Gamma> G)\" and \"atom x \\<sharp> c\"\n  shows \"P; \\<B> ; G \\<turnstile>\\<^sub>w\\<^sub>f \\<lbrace> z : b | c \\<rbrace>\" \nproof - \n  have \" P; \\<B> ; (x, b, TRUE)   #\\<^sub>\\<Gamma> G  \\<turnstile>\\<^sub>w\\<^sub>f c[z::=V_var x]\\<^sub>c\\<^sub>v \\<and> wfB P \\<B> b\" using  assms \n    using wfG_elim2 by auto\n  moreover have \"atom x \\<sharp>  (P ,\\<B>,G)\" using wfG_elims assms wfG_fresh_x by metis\n  ultimately have  \"wfT P \\<B> G \\<lbrace> x : b | c[z::=V_var x]\\<^sub>c\\<^sub>v \\<rbrace>\" using wfTI assms by metis\n  moreover have \"\\<lbrace> x : b | c[z::=V_var x]\\<^sub>c\\<^sub>v \\<rbrace> = \\<lbrace> z : b | c \\<rbrace>\" using type_eq_subst \\<open>atom x \\<sharp> c\\<close> by auto\n  ultimately show  ?thesis by auto\nqed\n\nlemma wfT_wfT_if:\n  assumes \"wfT \\<Theta> \\<B> \\<Gamma> (\\<lbrace> z2 : b  | CE_val v  ==  CE_val (V_lit L_false) IMP  c[z::=V_var z2]\\<^sub>c\\<^sub>v  \\<rbrace>)\" and \"atom z2 \\<sharp> (c,\\<Gamma>)\"\n  shows \"wfT \\<Theta> \\<B> \\<Gamma> \\<lbrace> z : b |  c \\<rbrace>\" \nproof -\n  have *: \"atom z2 \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>)\" using wfG_fresh_x wfX_wfY assms fresh_Pair by metis\n  have \"wfB \\<Theta> \\<B>  b\" using assms wfT_elims by metis\n  have \"\\<Theta>; \\<B>; (GCons (z2,b,TRUE) \\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f  (CE_val v  ==  CE_val (V_lit L_false) IMP  c[z::=V_var z2]\\<^sub>c\\<^sub>v)\"  using wfT_wfC assms fresh_Pair by auto\n  hence \"\\<Theta>; \\<B>; ((z2,b,TRUE)  #\\<^sub>\\<Gamma>\\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c[z::=V_var z2]\\<^sub>c\\<^sub>v\"  using wfC_elims by metis\n  hence \"wfT \\<Theta> \\<B> \\<Gamma>  (\\<lbrace> z2 : b  | c[z::=V_var z2]\\<^sub>c\\<^sub>v\\<rbrace>)\" using assms fresh_Pair wfTI \\<open>wfB \\<Theta> \\<B> b\\<close> * by auto\n  moreover have \"\\<lbrace> z : b |  c \\<rbrace> = \\<lbrace> z2 : b | c[z::=V_var z2]\\<^sub>c\\<^sub>v \\<rbrace>\"  using type_eq_subst assms fresh_Pair by auto\n  ultimately show ?thesis using wfTI assms by argo\nqed\n\nlemma wfT_fresh_c:\n  fixes x::x\n  assumes \"wfT P \\<B> \\<Gamma> \\<lbrace> z : b | c \\<rbrace>\" and \"atom x \\<sharp> \\<Gamma>\" and \"x \\<noteq> z\"\n  shows \"atom x \\<sharp> c\"\nproof(rule ccontr)\n  assume \"\\<not> atom x \\<sharp> c\"\n  hence *:\"atom x \\<in> supp c\" using fresh_def by auto\n  moreover have \"supp c - set [atom z] \\<union> supp b \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\"\n    using assms  wfT_supp \\<tau>.supp by blast\n  moreover hence \"atom x \\<in> supp c - set [atom z]\" using assms  * by auto\n  ultimately have \"atom x \\<in> atom_dom \\<Gamma>\" using x_not_in_b_set by auto\n  thus False using assms wfG_atoms_supp_eq wfT_wf fresh_def by metis\nqed\n\nlemma wfG_x_fresh [simp]: \n  fixes x::x\n  assumes \"wfG P \\<B> G\"\n  shows \"atom x \\<notin> atom_dom G \\<longleftrightarrow> atom x \\<sharp> G\"\n  using wfG_atoms_supp_eq assms fresh_def  by metis\n\nlemma wfD_x_fresh:\n  fixes x::x\n  assumes \"atom x \\<sharp> \\<Gamma>\" and \"wfD P B \\<Gamma> \\<Delta>\"\n  shows \"atom x \\<sharp> \\<Delta>\"\nusing assms proof(induct \\<Delta> rule: \\<Delta>_induct)\n  case DNil\n  then show ?case using supp_DNil fresh_def by auto\nnext\n  case (DCons u' t'  \\<Delta>')\n  have wfg: \"wfG P B \\<Gamma>\" using wfD_wf DCons by blast\n  hence wfd: \"wfD P B \\<Gamma> \\<Delta>'\" using wfD_elims DCons by blast\n  have \"supp t' \\<subseteq> atom_dom \\<Gamma> \\<union> supp B\" using wfT_supp DCons wfD_elims  by metis\n  moreover have \"atom x \\<notin> atom_dom \\<Gamma>\" using DCons(2) fresh_def wfG_supp wfg by blast\n  ultimately have  \"atom x \\<sharp> t'\" using fresh_def DCons wfG_supp wfg x_not_in_b_set by blast\n  moreover have \"atom x \\<sharp> u'\" using supp_at_base fresh_def by fastforce\n  ultimately have \"atom x \\<sharp> (u',t')\" using supp_Pair by fastforce\n  thus ?case using DCons fresh_DCons wfd by fast\nqed\n\nlemma wfG_fresh_x2:\n  fixes \\<Gamma>::\\<Gamma> and z::x and \\<Delta>::\\<Delta> and \\<Phi>::\\<Phi>\n  assumes \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>\" and \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\" and \"atom z \\<sharp> \\<Gamma>\" \n  shows \"atom z \\<sharp> (\\<Theta>,\\<Phi>,\\<B>, \\<Gamma>,\\<Delta>)\"\n  unfolding fresh_prodN apply(intro conjI)\n  using wfG_fresh_x assms fresh_prod3 wfX_wfY apply metis\n  using wf_supp2(5)  assms fresh_def apply blast\n  using assms wfG_fresh_x wfX_wfY fresh_prod3 apply metis\n  using assms wfG_fresh_x wfX_wfY fresh_prod3 apply metis\n  using wf_supp2(6)  assms fresh_def wfD_x_fresh by metis\n\nlemma wfV_x_fresh:\n  fixes v::v and b::b and \\<Gamma>::\\<Gamma> and x::x\n  assumes \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b\" and \"atom x \\<sharp> \\<Gamma>\"\n  shows \"atom x \\<sharp> v\"\nproof -\n  have \"supp v \\<subseteq> atom_dom \\<Gamma> \\<union> supp  \\<B> \" using assms wfV_supp by auto\n  moreover have \"atom x \\<notin> atom_dom \\<Gamma>\" using fresh_def assms\n     dom.simps subsetCE  wfG_elims wfG_supp  by (metis dom_supp_g)\n  moreover have \"atom x \\<notin> supp \\<B>\" using x_not_in_b_set by auto\n  ultimately show ?thesis using fresh_def by fast\nqed\n\nlemma wfE_x_fresh:\n  fixes e::e and b::b and \\<Gamma>::\\<Gamma> and \\<Delta>::\\<Delta> and \\<Phi>::\\<Phi>  and x::x\n  assumes \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b\" and \"atom x \\<sharp> \\<Gamma>\"\n  shows \"atom x \\<sharp> e\"\nproof -\n  have \"wfG \\<Theta> \\<B> \\<Gamma>\" using assms wfE_wf by auto\n  hence \"supp e \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B> \\<union> atom`fst`setD \\<Delta>\" using wfE_supp dom.simps assms by auto\n  moreover have \"atom x \\<notin> atom_dom \\<Gamma>\" using fresh_def assms\n     dom.simps subsetCE  \\<open>wfG \\<Theta> \\<B> \\<Gamma>\\<close>  wfG_supp  by (metis dom_supp_g)\n  moreover have \"atom x \\<notin> atom`fst`setD \\<Delta>\" by auto\n  ultimately show ?thesis using fresh_def x_not_in_b_set by fast \nqed\n\nlemma wfT_x_fresh:\n  fixes \\<tau>::\\<tau> and \\<Gamma>::\\<Gamma> and  x::x\n  assumes \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\" and \"atom x \\<sharp> \\<Gamma>\"\n  shows \"atom x \\<sharp> \\<tau>\"\nproof -\n  have \"wfG \\<Theta> \\<B> \\<Gamma>\" using assms wfX_wfY by auto\n  hence \"supp \\<tau> \\<subseteq> atom_dom \\<Gamma> \\<union> supp \\<B>\" using wfT_supp dom.simps assms by auto\n  moreover have \"atom x \\<notin> atom_dom \\<Gamma>\" using fresh_def assms\n     dom.simps subsetCE  \\<open>wfG \\<Theta> \\<B> \\<Gamma>\\<close>  wfG_supp  by (metis dom_supp_g)\n  moreover have \"atom x \\<notin> supp \\<B>\" using x_not_in_b_set by simp\n  ultimately show ?thesis using fresh_def by fast \nqed\n\nlemma wfS_x_fresh:\n  fixes s::s  and \\<Delta>::\\<Delta> and x::x\n  assumes \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta>  \\<turnstile>\\<^sub>w\\<^sub>f s : b\" and \"atom x \\<sharp> \\<Gamma>\"\n  shows \"atom x \\<sharp> s\"\nproof - \n  have \"supp s \\<subseteq> atom_dom \\<Gamma> \\<union> atom ` fst ` setD \\<Delta> \\<union> supp \\<B>\"  using  wf_supp assms by metis\n  moreover have \"atom x \\<notin> atom ` fst ` setD \\<Delta>\" by auto\n  moreover have \"atom x \\<notin> atom_dom \\<Gamma>\" using assms fresh_def wfG_dom_supp wfX_wfY by metis\n  moreover have \"atom x \\<notin> supp \\<B>\" using supp_b_empty supp_fset \n    by (simp add: x_not_in_b_set)\n  ultimately show ?thesis using fresh_def by fast \nqed\n\nlemma wfTh_fresh:\n  fixes x\n  assumes \"wfTh T\"\n  shows \"atom x \\<sharp> T\"\n  using wf_supp1 assms fresh_def by fastforce\n\nlemmas wfTh_x_fresh = wfTh_fresh\n\nlemma wfPhi_fresh:\n  fixes x\n  assumes \"wfPhi T P\"\n  shows \"atom x \\<sharp> P\"\n  using wf_supp assms fresh_def by fastforce\n\nlemmas wfPhi_x_fresh = wfPhi_fresh\nlemmas wb_x_fresh = wfTh_x_fresh wfPhi_x_fresh wfD_x_fresh wfT_x_fresh wfV_x_fresh\n\nlemma wfG_inside_fresh[ms_fresh]:\n  fixes \\<Gamma>::\\<Gamma> and x::x\n  assumes \"wfG P \\<B> (\\<Gamma>'@((x,b,c)  #\\<^sub>\\<Gamma>\\<Gamma>))\"\n  shows \"atom x \\<notin> atom_dom \\<Gamma>'\"\nusing assms proof(induct \\<Gamma>' rule: \\<Gamma>_induct)\n  case GNil\n  then show ?case by auto\nnext\n  case (GCons x1 b1 c1 \\<Gamma>1)\n  moreover hence \"atom x \\<notin> atom ` fst `({(x1,b1,c1)})\" proof -\n    have *: \"P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (\\<Gamma>1 @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\" using wfG_elims append_g.simps GCons by metis\n    have \"atom x1 \\<sharp>  (\\<Gamma>1 @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\" using GCons wfG_elims append_g.simps by metis\n    hence \"atom x1 \\<notin> atom_dom  (\\<Gamma>1 @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\" using wfG_dom_supp fresh_def * by metis\n    thus ?thesis by auto\n  qed\n  ultimately show ?case using append_g.simps atom_dom.simps toSet.simps wfG_elims dom.simps\n    by (metis image_insert insert_iff insert_is_Un)\nqed\n\nlemma wfG_inside_x_in_atom_dom:\n  fixes c::c and x::x  and \\<Gamma>::\\<Gamma> \n  shows \"atom x \\<in> atom_dom ( \\<Gamma>'@ (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v)   #\\<^sub>\\<Gamma> \\<Gamma>)\"\n  by(induct \\<Gamma>'  rule: \\<Gamma>_induct, (simp add: toSet.simps atom_dom.simps)+)\n\nlemma wfG_inside_x_neq:\n  fixes c::c and x::x  and \\<Gamma>::\\<Gamma> and G::\\<Gamma> and xa::x\n  assumes \"G=( \\<Gamma>'@ (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v)   #\\<^sub>\\<Gamma> \\<Gamma>)\" and \"atom xa \\<sharp> G\" and \" \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f G\"\n  shows \"xa \\<noteq> x\"\nproof - \n  have \"atom xa \\<notin> atom_dom G\"  using fresh_def wfG_atoms_supp_eq assms by metis\n  moreover have \"atom x \\<in> atom_dom G\" using wfG_inside_x_in_atom_dom assms by simp\n  ultimately show ?thesis by auto\nqed\n\nlemma wfG_inside_x_fresh:\n  fixes c::c and x::x  and \\<Gamma>::\\<Gamma> and G::\\<Gamma> and xa::x\n  assumes \"G=( \\<Gamma>'@ (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v)   #\\<^sub>\\<Gamma> \\<Gamma>)\" and \"atom xa \\<sharp> G\" and \" \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f G\"\n  shows \"atom xa \\<sharp> x\"\n  using fresh_def supp_at_base wfG_inside_x_neq assms by auto\n\nlemma wfT_nil_supp:\n  fixes t::\\<tau>\n  assumes \"\\<Theta> ; {||} ; GNil \\<turnstile>\\<^sub>w\\<^sub>f t\" \n  shows \"supp t = {}\"\n  using wfT_supp atom_dom.simps assms toSet.simps by force\n\nsection \\<open>Misc\\<close>\n\nlemma wfG_cons_append:\n  fixes b'::b\n  assumes \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ((x', b', c')   #\\<^sub>\\<Gamma> \\<Gamma>') @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>\"\n  shows \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (\\<Gamma>' @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)  \\<and> atom x' \\<sharp> (\\<Gamma>' @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>) \\<and> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b' \\<and> x' \\<noteq> x\"\nproof - \n  have \"((x', b', c')   #\\<^sub>\\<Gamma> \\<Gamma>') @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma> = (x', b', c')   #\\<^sub>\\<Gamma> (\\<Gamma>' @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\" using append_g.simps by auto\n  hence *:\"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f  (\\<Gamma>' @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)  \\<and> atom x' \\<sharp> (\\<Gamma>' @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>) \\<and> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b'\" using assms wfG_cons by metis\n  moreover have \"atom x' \\<sharp> x\" proof(rule wfG_inside_x_fresh[of \"(\\<Gamma>' @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\"])\n    show \"\\<Gamma>' @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma> = \\<Gamma>' @ (x, b, c[x::=V_var x]\\<^sub>c\\<^sub>v)   #\\<^sub>\\<Gamma> \\<Gamma>\" by simp\n      show \"  atom x' \\<sharp> \\<Gamma>' @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>\" using * by auto\n      show \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>  \" using * by auto\n    qed\n  ultimately show  ?thesis by auto\nqed\n\nlemma flip_u_eq:\n  fixes  u::u and u'::u and \\<Theta>::\\<Theta> and \\<tau>::\\<tau>\n  assumes \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\" \n  shows \"(u \\<leftrightarrow> u') \\<bullet> \\<tau> = \\<tau>\" and  \"(u \\<leftrightarrow> u') \\<bullet> \\<Gamma> = \\<Gamma>\"  and \"(u \\<leftrightarrow> u') \\<bullet> \\<Theta> = \\<Theta>\" and \"(u \\<leftrightarrow> u') \\<bullet> \\<B> = \\<B>\"\nproof -\n  show \"(u \\<leftrightarrow> u') \\<bullet> \\<tau> = \\<tau>\" using wfT_supp flip_fresh_fresh\n    by (metis assms(1) fresh_def u_not_in_t)\n  show \"(u \\<leftrightarrow> u') \\<bullet> \\<Gamma> = \\<Gamma>\" using u_not_in_g wfX_wfY assms flip_fresh_fresh fresh_def by metis\n  show  \"(u \\<leftrightarrow> u') \\<bullet> \\<Theta> = \\<Theta>\" using theta_flip_eq assms wfX_wfY by metis\n  show  \"(u \\<leftrightarrow> u') \\<bullet> \\<B> = \\<B>\" using u_not_in_b_set flip_fresh_fresh fresh_def by metis\nqed\n\nlemma wfT_wf_cons_flip: \n  fixes c::c and x::x\n  assumes \"wfT P \\<B> \\<Gamma> \\<lbrace> z : b  | c \\<rbrace>\" and \"atom x \\<sharp> (c,\\<Gamma>)\"\n  shows \"wfG P \\<B> ((x,b,c[z::=V_var x]\\<^sub>c\\<^sub>v)  #\\<^sub>\\<Gamma>\\<Gamma>)\"\nproof -\n  have \"\\<lbrace> x : b | c[z::=V_var x]\\<^sub>c\\<^sub>v \\<rbrace> = \\<lbrace> z : b  | c \\<rbrace>\" using assms freshers type_eq_subst by metis\n  hence *:\"wfT P \\<B> \\<Gamma>  \\<lbrace> x : b | c[z::=V_var x]\\<^sub>c\\<^sub>v \\<rbrace>\" using assms by metis\n  show ?thesis proof(rule wfG_consI)\n    show \\<open> P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<close> using assms wfT_wf by auto\n    show \\<open>atom x \\<sharp> \\<Gamma>\\<close> using assms   by auto\n    show \\<open> P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b \\<close> using assms wfX_wfY b_of.simps  by metis\n    show \\<open> P; \\<B> ; (x, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c[z::=V_var x]\\<^sub>c\\<^sub>v \\<close> using wfT_wfC * assms fresh_Pair by metis\n  qed\nqed\n\nsection \\<open>Context Strengthening\\<close>\n\ntext \\<open>We can remove an entry for a variable from the context if the variable doesn't appear in the \nterm and the variable is not used later in the context or any other context\\<close>\n\nlemma fresh_restrict:\n  fixes y::\"'a::at_base\" and \\<Gamma>::\\<Gamma>\n  assumes  \"atom y \\<sharp>  (\\<Gamma>' @ (x, b, c)   #\\<^sub>\\<Gamma> \\<Gamma>)\"\n  shows \"atom y \\<sharp> (\\<Gamma>'@\\<Gamma>)\"\nusing assms proof(induct \\<Gamma>' rule: \\<Gamma>_induct)\n  case GNil\n  then show ?case using fresh_GCons fresh_GNil by auto\nnext\n  case (GCons x' b' c' \\<Gamma>'')\n  then show ?case using fresh_GCons fresh_GNil by auto\nqed\n\nlemma wf_restrict1:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n        and cs::branch_s and css::branch_list\n  shows  \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b        \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c')  #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> atom x \\<sharp> v \\<Longrightarrow> atom x \\<sharp> \\<Gamma>\\<^sub>1  \\<Longrightarrow> \\<Theta>; \\<B>;  \\<Gamma>\\<^sub>1@\\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f  v : b\" and\n       \n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f  c           \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c')  #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> atom x \\<sharp> c\\<Longrightarrow> atom x \\<sharp> \\<Gamma>\\<^sub>1 \\<Longrightarrow> \\<Theta> ;  \\<B> ; \\<Gamma>\\<^sub>1@\\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f  c\" and\n         \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>                \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c')  #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow>  atom x \\<sharp> \\<Gamma>\\<^sub>1 \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\\<^sub>1@\\<Gamma>\\<^sub>2\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>            \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c')  #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> atom x \\<sharp> \\<tau>\\<Longrightarrow> atom x \\<sharp> \\<Gamma>\\<^sub>1 \\<Longrightarrow>  \\<Theta>; \\<B>;  \\<Gamma>\\<^sub>1@\\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f  \\<tau>\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts \\<Longrightarrow> True\" and \n         \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<Longrightarrow>True\" and\n       \n         \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \\<Longrightarrow> True\" and\n        \n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ce : b    \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c')  #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> atom x \\<sharp> ce  \\<Longrightarrow> atom x \\<sharp> \\<Gamma>\\<^sub>1 \\<Longrightarrow> \\<Theta>; \\<B>;  \\<Gamma>\\<^sub>1@\\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f  ce : b\"  and \n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow> True\"\nproof(induct   arbitrary: \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1  and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1  and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 \n               rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)\n  case (wfV_varI \\<Theta> \\<B> \\<Gamma> b c y)\n  hence \"y\\<noteq>x\" using v.fresh by auto\n  hence \"Some (b, c) = lookup (\\<Gamma>\\<^sub>1@\\<Gamma>\\<^sub>2) y\" using lookup_restrict wfV_varI by metis\n  then show ?case using wfV_varI wf_intros by metis\nnext\n  case (wfV_litI \\<Theta> \\<Gamma> l)\n  then show ?case using e.fresh wf_intros by metis\nnext\n  case (wfV_pairI \\<Theta> \\<B> \\<Gamma> v1 b1 v2 b2)\n  show ?case proof\n    show \"\\<Theta>; \\<B>; \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v1 : b1\" using wfV_pairI by auto\n    show \"\\<Theta>; \\<B>; \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v2 : b2\" using wfV_pairI by auto\n  qed\nnext\n  case (wfV_consI s dclist \\<Theta> dc x b c \\<B> \\<Gamma> v)\n  show ?case proof\n    show \"AF_typedef s dclist \\<in> set \\<Theta>\" using wfV_consI by auto\n    show \"(dc, \\<lbrace> x : b  | c \\<rbrace>) \\<in> set dclist\" using wfV_consI by auto\n    show \"\\<Theta>; \\<B>; \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v : b\" using wfV_consI by auto\n  qed\nnext\n   case (wfV_conspI s bv dclist \\<Theta> dc x b' c \\<B> b \\<Gamma> v)\n    show ?case proof\n    show \"AF_typedef_poly s bv dclist \\<in> set \\<Theta>\" using wfV_conspI by auto\n    show \"(dc, \\<lbrace> x : b'  | c \\<rbrace>) \\<in> set dclist\" using wfV_conspI by auto\n    show \"\\<Theta>; \\<B>    \\<turnstile>\\<^sub>w\\<^sub>f  b\" using wfV_conspI by auto\n    show \" \\<Theta>; \\<B>; \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v : b'[bv::=b]\\<^sub>b\\<^sub>b\" using wfV_conspI by auto\n    show \"atom bv \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2, b, v)\" unfolding fresh_prodN fresh_append_g  using wfV_conspI fresh_prodN fresh_GCons fresh_append_g by metis\n  qed\nnext \n  case (wfCE_valI \\<Theta> \\<B> \\<Gamma> v b)\n  then show ?case using ce.fresh wf_intros by metis\nnext\n  case (wfCE_plusI \\<Theta> \\<B> \\<Gamma> v1 v2)\n   then show ?case using ce.fresh wf_intros by metis\nnext\n  case (wfCE_leqI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  then show ?case using ce.fresh wf_intros by metis\nnext\n  case (wfCE_eqI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  then show ?case using ce.fresh wf_intros by metis\nnext\n  case (wfCE_fstI \\<Theta> \\<B> \\<Gamma> v1 b1 b2)\n   then show ?case using ce.fresh wf_intros by metis\nnext\n  case (wfCE_sndI \\<Theta> \\<B> \\<Gamma> v1 b1 b2)\n then show ?case using ce.fresh wf_intros by metis\nnext\n  case (wfCE_concatI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  then show ?case using ce.fresh wf_intros by metis\nnext\n  case (wfCE_lenI \\<Theta> \\<B> \\<Gamma> v1)\n  then show ?case using ce.fresh wf_intros by metis\nnext\n  case (wfTI z \\<Theta> \\<B> \\<Gamma> b c)\n  hence \"x \\<noteq> z\" using wfTI\n   fresh_GCons fresh_prodN fresh_PairD(1) fresh_gamma_append not_self_fresh by metis\n  show ?case proof\n    show \\<open>atom z \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2)\\<close> using wfTI fresh_restrict[of z] using wfG_fresh_x wfX_wfY wfTI fresh_prodN by metis\n    show \\<open> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \\<close> using wfTI by auto\n    have \"\\<Theta>; \\<B>; ((z, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>1) @ \\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f c \" proof(rule  wfTI(5)[of \"(z, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>1\" ])\n      show \\<open>(z, b, TRUE)   #\\<^sub>\\<Gamma> \\<Gamma> = ((z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>1) @ (x, b', c')  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>2\\<close> using wfTI by auto\n      show \\<open>atom x \\<sharp> c\\<close> using wfTI \\<tau>.fresh \\<open>x \\<noteq> z\\<close> by auto\n      show \\<open>atom x \\<sharp> (z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>1\\<close> using wfTI \\<open>x \\<noteq> z\\<close> fresh_GCons by simp\n    qed\n    thus  \\<open> \\<Theta>; \\<B>; (z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f c \\<close>  by auto\n  qed\nnext\n  case (wfC_eqI \\<Theta> \\<B> \\<Gamma> e1 b e2)\n  show ?case proof\n    show \"\\<Theta>; \\<B>; \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f e1 : b \" using wfC_eqI c.fresh fresh_Nil by auto\n    show \"\\<Theta>; \\<B>; \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f e2 : b \" using wfC_eqI c.fresh fresh_Nil by auto\n  qed\nnext\n  case (wfC_trueI \\<Theta> \\<Gamma>)\n  then show ?case using c.fresh wf_intros by metis\nnext\n  case (wfC_falseI \\<Theta> \\<Gamma>)\n  then show ?case using c.fresh wf_intros by metis\nnext\n  case (wfC_conjI \\<Theta> \\<Gamma> c1 c2)\n  then show ?case using c.fresh wf_intros by metis\nnext\n  case (wfC_disjI \\<Theta> \\<Gamma> c1 c2)\n  then show ?case using c.fresh wf_intros by metis\nnext\ncase (wfC_notI \\<Theta> \\<Gamma> c1)\n  then show ?case using c.fresh wf_intros by metis\nnext\n  case (wfC_impI \\<Theta> \\<Gamma> c1 c2)\n  then show ?case using c.fresh wf_intros by metis\nnext\n  case (wfG_nilI \\<Theta>)\n  then show ?case using wfV_varI wf_intros \n    by (meson GNil_append \\<Gamma>.simps(3))\nnext\n  case (wfG_cons1I c1 \\<Theta> \\<B> G x1 b1)\n  show  ?case proof(cases \"\\<Gamma>\\<^sub>1=GNil\")\n    case True\n    then show ?thesis using wfG_cons1I wfG_consI by auto\n  next\n    case False\n    then obtain G'::\\<Gamma> where *:\"(x1, b1, c1)  #\\<^sub>\\<Gamma> G' = \\<Gamma>\\<^sub>1\" using  GCons_eq_append_conv wfG_cons1I by auto\n    hence **:\"G=G' @ (x, b', c')  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>2\" using wfG_cons1I by auto\n\n    have \" \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (x1, b1, c1)  #\\<^sub>\\<Gamma> (G' @ \\<Gamma>\\<^sub>2)\" proof(rule Wellformed.wfG_cons1I)\n      show \\<open>c1 \\<notin> {TRUE, FALSE}\\<close> using wfG_cons1I by auto\n      show \\<open>atom x1 \\<sharp> G' @ \\<Gamma>\\<^sub>2\\<close> using wfG_cons1I(4) ** fresh_restrict by metis\n      have \" atom x \\<sharp> G'\" using wfG_cons1I *  using fresh_GCons by blast\n      thus  \\<open> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f G' @ \\<Gamma>\\<^sub>2 \\<close> using wfG_cons1I(3)[of G'] **  by auto\n      have \"atom x \\<sharp> c1 \\<and> atom x \\<sharp> (x1, b1, TRUE)  #\\<^sub>\\<Gamma> G'\" using fresh_GCons \\<open>atom x \\<sharp> \\<Gamma>\\<^sub>1\\<close> * by auto\n      thus  \\<open> \\<Theta>; \\<B>; (x1, b1, TRUE)  #\\<^sub>\\<Gamma> G' @ \\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f c1 \\<close> using wfG_cons1I(6)[of \"(x1, b1, TRUE)  #\\<^sub>\\<Gamma> G'\"]  ** * wfG_cons1I by auto\n      show \\<open> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b1 \\<close> using wfG_cons1I by auto\n    qed\n    thus ?thesis using * by auto\n  qed\nnext\n  case (wfG_cons2I c1 \\<Theta> \\<B> G x1 b1)\n  show  ?case proof(cases \"\\<Gamma>\\<^sub>1=GNil\")\n    case True\n    then show ?thesis using wfG_cons2I wfG_consI by auto\n  next\n    case False\n    then obtain G'::\\<Gamma> where *:\"(x1, b1, c1)  #\\<^sub>\\<Gamma> G' = \\<Gamma>\\<^sub>1\" using  GCons_eq_append_conv wfG_cons2I by auto\n    hence **:\"G=G' @ (x, b', c')  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>2\" using wfG_cons2I by auto\n\n    have \" \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (x1, b1, c1)  #\\<^sub>\\<Gamma> (G' @ \\<Gamma>\\<^sub>2)\" proof(rule Wellformed.wfG_cons2I)\n      show \\<open>c1 \\<in> {TRUE, FALSE}\\<close> using wfG_cons2I by auto\n      show \\<open>atom x1 \\<sharp> G' @ \\<Gamma>\\<^sub>2\\<close> using wfG_cons2I ** fresh_restrict by metis\n      have \" atom x \\<sharp> G'\" using wfG_cons2I *  using fresh_GCons by blast\n      thus  \\<open> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f G' @ \\<Gamma>\\<^sub>2 \\<close> using wfG_cons2I **  by auto     \n      show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b1 \\<close> using wfG_cons2I by auto\n    qed\n    thus ?thesis using * by auto\n  qed\nqed(auto)+\n\nlemma wf_restrict2:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n        and cs::branch_s and css::branch_list\n  shows          \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b    \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> atom x \\<sharp> e  \\<Longrightarrow> atom x \\<sharp> \\<Gamma>\\<^sub>1 \\<Longrightarrow> atom x \\<sharp> \\<Delta> \\<Longrightarrow> \\<Theta>; \\<Phi>; \\<B>;  \\<Gamma>\\<^sub>1@\\<Gamma>\\<^sub>2 ;  \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f  e : b\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b   \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow> True\" and     \n         \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>) \\<Longrightarrow> True \" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>  \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> atom x \\<sharp> \\<Gamma>\\<^sub>1 \\<Longrightarrow> atom x \\<sharp> \\<Delta> \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma>\\<^sub>1@\\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f  \\<Delta>\" and       \n         \"\\<Theta> ; \\<Phi>   \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> True\" and\n         \"\\<Theta> ; \\<Phi>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow> True\" \n    \nproof(induct   arbitrary: \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1  and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1  and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 \n               rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts)\n  case (wfE_valI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v b)\n  then show ?case using e.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfE_plusI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using e.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfE_leqI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using e.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfE_eqI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 b v2)\n  then show ?case using e.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfE_fstI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using e.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfE_sndI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using e.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfE_concatI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using e.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfE_splitI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using e.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfE_lenI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1)\n  then show ?case using e.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfE_appI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> f x b c \\<tau> s' v)\n  then show ?case using e.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfE_appPI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> b' bv v \\<tau> f x b c s)\n  show ?case proof\n    show \\<open> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close>  using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b' \\<close>  using wfE_appPI by auto\n\n    have \"atom bv \\<sharp>  \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2\" using  wfE_appPI fresh_prodN fresh_restrict  by metis\n    thus  \\<open>atom bv \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2, \\<Delta>, b', v, (b_of \\<tau>)[bv::=b']\\<^sub>b)\\<close>  \n      using wfE_appPI fresh_prodN by auto\n\n    show \\<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\\<close>  using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v : b[bv::=b']\\<^sub>b \\<close>  using wfE_appPI wf_restrict1 by auto\n  qed\nnext\n  case (wfE_mvarI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> u \\<tau>)\n  then show ?case using e.fresh wf_intros by metis\nnext\n  case (wfD_emptyI \\<Theta> \\<Gamma>)\n  then show ?case using c.fresh wf_intros wf_restrict1 by metis\nnext\n  case (wfD_cons \\<Theta> \\<B> \\<Gamma> \\<Delta> \\<tau> u)\n  show ?case proof\n    show \"\\<Theta>; \\<B>; \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>\" using wfD_cons fresh_DCons by metis\n    show \"\\<Theta>; \\<B>; \\<Gamma>\\<^sub>1 @ \\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \" using wfD_cons fresh_DCons fresh_Pair wf_restrict1 by metis\n    show \"u \\<notin> fst ` setD \\<Delta>\" using wfD_cons by auto\n  qed\nnext\n  case (wfFTNone \\<Theta> ft)\n  then show ?case by auto\nnext\n  case (wfFTSome \\<Theta> bv ft)\n  then show ?case by auto\nnext\n  case (wfFTI \\<Theta> B b \\<Phi> x c s \\<tau>)\n  then show ?case by auto\nqed(auto)+\n\nlemmas wf_restrict=wf_restrict1 wf_restrict2\n\nlemma wfT_restrict2:\n  fixes \\<tau>::\\<tau>\n  assumes \"wfT \\<Theta> \\<B> ((x, b, c) #\\<^sub>\\<Gamma> \\<Gamma>) \\<tau>\" and \"atom x \\<sharp> \\<tau>\" \n  shows \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"\n  using wf_restrict1(4)[of \\<Theta> \\<B> \"((x, b, c) #\\<^sub>\\<Gamma> \\<Gamma>)\"  \\<tau> GNil x \"b\" \"c\" \\<Gamma>] assms fresh_GNil append_g.simps by auto\n\nlemma wfG_intros2:\n  assumes \"wfC P \\<B> ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) c\"\n  shows  \"wfG P \\<B>  ((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>)\"\nproof - \n  have \"wfG P \\<B>   ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>)\" using wfC_wf  assms by auto\n  hence *:\"wfG P \\<B> \\<Gamma> \\<and> atom x \\<sharp> \\<Gamma> \\<and> wfB P \\<B> b\" using wfG_elims by metis\n  show ?thesis using assms proof(cases \"c \\<in> {TRUE,FALSE}\")\n    case True \n    then show ?thesis using wfG_cons2I * by auto\n  next\n    case False\n    then show ?thesis using wfG_cons1I * assms by auto\n  qed\nqed\n\nsection \\<open>Type Definitions\\<close>\n\nlemma wf_theta_weakening1: \n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and b::b and \\<B> :: \\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n         and cs::branch_s and css::branch_list and t::\\<tau>\n\n  shows  \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b \\<Longrightarrow>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f  c\" and\n         \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>  \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<B>   \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow>  \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f  \\<tau>\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<B> ;  \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts\" and \n         \"\\<turnstile>\\<^sub>w\\<^sub>f P \\<Longrightarrow> True \" and\n         \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b  \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b\"  and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ce : b \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b\" and\n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>'  \\<turnstile>\\<^sub>w\\<^sub>f td\"\nproof(nominal_induct b and c and \\<Gamma> and \\<tau> and ts and P and b and b and td \n      avoiding: \\<Theta>'     \n      rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)\n  case (wfV_consI s dclist \\<Theta> dc x b c \\<B> \\<Gamma> v)\n  show ?case proof\n    show \\<open>AF_typedef s dclist \\<in> set \\<Theta>'\\<close> using wfV_consI by auto\n    show \\<open>(dc, \\<lbrace> x : b  | c \\<rbrace>) \\<in> set dclist\\<close> using wfV_consI by auto\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b \\<close> using wfV_consI by auto\n  qed\nnext\n  case (wfV_conspI s bv dclist \\<Theta> dc x b' c \\<B> b \\<Gamma> v)\n    show ?case proof\n    show \\<open>AF_typedef_poly s bv dclist \\<in> set \\<Theta>'\\<close> using wfV_conspI by auto\n    show \\<open>(dc, \\<lbrace> x : b'  | c \\<rbrace>) \\<in> set dclist\\<close> using wfV_conspI by auto\n    show \\<open>\\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b'[bv::=b]\\<^sub>b\\<^sub>b  \\<close> using wfV_conspI by auto\n    show \"\\<Theta>' ;  \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b \"  using wfV_conspI by auto\n    show \"atom bv \\<sharp> (\\<Theta>', \\<B>, \\<Gamma>, b, v)\" using wfV_conspI fresh_prodN by auto\n  qed\nnext\n  case (wfTI z \\<Theta> \\<B> \\<Gamma> b c)\n  thus ?case using Wellformed.wfTI by auto\nnext\n  case (wfB_consI \\<Theta> s dclist)\n  show ?case proof \n    show \\<open>   \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<close> using wfB_consI by auto\n    show \\<open>AF_typedef s dclist \\<in> set \\<Theta>'\\<close>  using wfB_consI by auto\n  qed\nnext   \n  case (wfB_appI \\<Theta> \\<B> b s bv dclist)\n  show ?case proof \n    show \\<open>   \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<close> using wfB_appI by auto\n    show \\<open>AF_typedef_poly s bv dclist \\<in> set \\<Theta>'\\<close>  using wfB_appI by auto\n    show \"\\<Theta>' ;   \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b\" using wfB_appI by simp\n  qed\nqed(metis wf_intros)+\n\nlemma wf_theta_weakening2: \n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and b::b and \\<B> :: \\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n         and cs::branch_s and css::branch_list and t::\\<tau>\n  shows \n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>  ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<Phi> ; \\<B> ; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<Phi> ; \\<B> ; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<Phi> ; \\<B> ; \\<Gamma> ; \\<Delta> ; tid ; dc ; t  \\<turnstile>\\<^sub>w\\<^sub>f cs : b\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<Phi> ; \\<B> ; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b\" and     \n         \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>) \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>)\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<Longrightarrow> \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f  \\<Delta>\" and\n         \"\\<Theta> ; \\<Phi>  \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<Phi>  \\<turnstile>\\<^sub>w\\<^sub>f ftq\" and\n         \"\\<Theta> ; \\<Phi> ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<Longrightarrow> set \\<Theta> \\<subseteq> set \\<Theta>' \\<Longrightarrow> \\<Theta>' ; \\<Phi> ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft\" \n \nproof(nominal_induct b and b and b and b and \\<Phi> and \\<Delta> and  ftq and ft \n      avoiding: \\<Theta>'     \nrule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)\n  case (wfE_appPI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> b' bv v \\<tau> f x b c s)\n  show ?case proof\n    show \\<open> \\<Theta>'  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>' ; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b' \\<close> using wfE_appPI wf_theta_weakening1 by auto\n    show \\<open>atom bv \\<sharp> (\\<Phi>, \\<Theta>', \\<B>, \\<Gamma>, \\<Delta>, b', v, (b_of \\<tau>)[bv::=b']\\<^sub>b)\\<close> using wfE_appPI by auto\n    show \\<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b[bv::=b']\\<^sub>b \\<close> using wfE_appPI wf_theta_weakening1 by auto\n  qed\nnext\n  case (wfS_matchI \\<Theta> \\<B> \\<Gamma> v tid  dclist \\<Delta> \\<Phi> cs b)\n  show ?case proof\n    show \\<open> \\<Theta>' ; \\<B> ;  \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : B_id tid \\<close> using wfS_matchI wf_theta_weakening1 by auto\n    show \\<open>AF_typedef tid dclist \\<in> set \\<Theta>'\\<close> using wfS_matchI by auto\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfS_matchI by auto\n    show \\<open> \\<Theta>'  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<close> using wfS_matchI by auto\n    show \\<open>\\<Theta>'; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta>; tid; dclist \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<close> using wfS_matchI by auto\n  qed\nnext\n   case (wfS_varI \\<Theta> \\<B> \\<Gamma> \\<tau> v u \\<Phi> \\<Delta> b s)\n  show ?case proof\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<close> using wfS_varI wf_theta_weakening1 by auto\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b_of \\<tau> \\<close> using wfS_varI wf_theta_weakening1 by auto\n    show \\<open>atom u \\<sharp> (\\<Phi>, \\<Theta>', \\<B>, \\<Gamma>, \\<Delta>, \\<tau>, v, b)\\<close> using wfS_varI by auto\n    show \\<open> \\<Theta>' ; \\<Phi> ; \\<B> ; \\<Gamma> ; (u, \\<tau>)  #\\<^sub>\\<Delta> \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_varI by auto\n  qed\nnext\n  case (wfS_letI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> e b' x s b)\n  show ?case proof\n    show \\<open> \\<Theta>' ; \\<Phi> ; \\<B> ; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b' \\<close> using wfS_letI by auto\n    show \\<open> \\<Theta>' ; \\<Phi> ; \\<B> ; (x, b', TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_letI by auto\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfS_letI by auto\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>', \\<B>, \\<Gamma>, \\<Delta>, e, b)\\<close> using wfS_letI by auto\n  qed\nnext\n  case (wfS_let2I \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 \\<tau> x s2 b)\n  show ?case proof\n    show \\<open> \\<Theta>' ; \\<Phi> ; \\<B> ; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s1 : b_of \\<tau> \\<close> using wfS_let2I by auto\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<close> using wfS_let2I wf_theta_weakening1 by auto\n    show \\<open> \\<Theta>' ; \\<Phi> ; \\<B> ; (x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s2 : b \\<close> using wfS_let2I by auto\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>', \\<B>, \\<Gamma>, \\<Delta>, s1, b, \\<tau>)\\<close> using wfS_let2I by auto\n  qed\nnext\n  case (wfS_branchI \\<Theta> \\<Phi> \\<B> x \\<tau> \\<Gamma> \\<Delta> s b tid dc)\n  show ?case proof\n    show \\<open> \\<Theta>' ; \\<Phi> ; \\<B> ; (x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_branchI by auto\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>', \\<B>, \\<Gamma>, \\<Delta>, \\<Gamma>, \\<tau>)\\<close> using wfS_branchI by auto\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfS_branchI by auto\n  qed\nnext\n   case (wfPhi_consI f \\<Phi> \\<Theta> ft)\n  show ?case proof\n    show \"f \\<notin> name_of_fun ` set \\<Phi>\" using wfPhi_consI by auto\n    show \"\\<Theta>' ; \\<Phi> \\<turnstile>\\<^sub>w\\<^sub>f ft\"  using wfPhi_consI by auto\n    show \"\\<Theta>' \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"  using wfPhi_consI by auto\n  qed\nnext\n  case (wfFTNone \\<Theta> ft)\n  then show ?case using  wf_intros by metis\nnext\n  case (wfFTSome \\<Theta> bv ft)\n  then show ?case using wf_intros by metis\nnext\n  case (wfFTI \\<Theta> B b \\<Phi> x c s \\<tau>)\n  thus ?case using Wellformed.wfFTI wf_theta_weakening1 by simp\nnext\n  case (wfS_assertI \\<Theta> \\<Phi> \\<B> x c \\<Gamma> \\<Delta> s b)\n  show ?case proof  \n    show \\<open> \\<Theta>' ; \\<Phi> ; \\<B> ; (x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_assertI wf_theta_weakening1 by auto\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f c \\<close> using wfS_assertI wf_theta_weakening1 by auto\n    show \\<open> \\<Theta>' ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfS_assertI wf_theta_weakening1 by auto\n    have \"atom x \\<sharp> \\<Theta>'\" using wf_supp(6)[OF \\<open>\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>' \\<close>] fresh_def by auto\n    thus  \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>', \\<B>, \\<Gamma>, \\<Delta>, c, b, s)\\<close> using wfS_assertI fresh_prodN fresh_def by simp\n  qed\nqed(metis wf_intros wf_theta_weakening1 )+\n\nlemmas wf_theta_weakening = wf_theta_weakening1 wf_theta_weakening2\n\nlemma lookup_wfTD:\n  fixes td::type_def\n  assumes  \"td \\<in> set \\<Theta>\" and \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\"\n  shows \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f td\"\n using assms  proof(induct \\<Theta> )\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons td'  \\<Theta>')\n  then consider \"td = td'\" | \"td \\<in> set \\<Theta>'\" by auto\n  then have \"\\<Theta>' \\<turnstile>\\<^sub>w\\<^sub>f td\" proof(cases)\n    case 1\n    then show ?thesis using Cons using wfTh_elims by auto\n  next\n    case 2\n    then show ?thesis using Cons using wfTh_elims by auto\n  qed\n  then show ?case using wf_theta_weakening Cons  by (meson set_subset_Cons)\nqed\n\nsubsection \\<open>Simple\\<close>\n\nlemma wfTh_dclist_unique:\n  assumes   \"wfTh \\<Theta>\" and \"AF_typedef tid dclist1 \\<in> set \\<Theta>\" and  \"AF_typedef tid dclist2 \\<in> set \\<Theta>\" \n  shows \"dclist1 = dclist2\"\nusing assms proof(induct \\<Theta> rule: \\<Theta>_induct)\n  case TNil\n  then show ?case by auto\nnext\n  case (AF_typedef tid' dclist' \\<Theta>')\n  then show ?case using wfTh_elims\n    by (metis image_eqI name_of_type.simps(1) set_ConsD type_def.eq_iff(1))\nnext\n  case (AF_typedef_poly tid bv dclist \\<Theta>')\n  then show ?case using wfTh_elims by auto\nqed\n\nlemma wfTs_ctor_unique:\n  fixes dclist::\"(string*\\<tau>) list\"\n  assumes  \"\\<Theta> ; {||}  ; GNil \\<turnstile>\\<^sub>w\\<^sub>f  dclist\" and \"(c, t1) \\<in> set dclist\"  and \"(c,t2) \\<in> set dclist\"  \n  shows \"t1 = t2\" \n  using assms proof(induct dclist rule: list.inducts)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons x1 x2)\n  consider \"x1 = (c,t1)\" | \"x1 = (c,t2)\" | \"x1 \\<noteq> (c,t1) \\<and> x1 \\<noteq> (c,t2)\" by auto\n  thus ?case proof(cases)\n    case 1\n    then show ?thesis using Cons wfTs_elims set_ConsD\n      by (metis fst_conv image_eqI prod.inject)\n  next\n    case 2\n      then show ?thesis using Cons wfTs_elims set_ConsD\n      by (metis fst_conv image_eqI prod.inject)\n  next\n    case 3\n    then show ?thesis using Cons wfTs_elims by (metis set_ConsD)\n  qed\nqed\n\nlemma wfTD_ctor_unique:\n  assumes  \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f (AF_typedef tid dclist)\" and \"(c, t1) \\<in> set dclist\"  and \"(c,t2) \\<in> set dclist\"  \n  shows \"t1 = t2\" \n  using wfTD_elims wfTs_elims assms  wfTs_ctor_unique by metis\n\nlemma wfTh_ctor_unique:\n  assumes   \"wfTh \\<Theta>\" and \"AF_typedef tid dclist \\<in> set \\<Theta>\" and \"(c, t1) \\<in> set dclist\"  and \"(c,t2) \\<in> set dclist\"  \n  shows \"t1 = t2\" \n  using lookup_wfTD wfTD_ctor_unique assms by metis\n\nlemma wfTs_supp_t:\n  fixes dclist::\"(string*\\<tau>) list\"\n  assumes \"(c,t) \\<in> set dclist\" and \"\\<Theta> ; B ; GNil \\<turnstile>\\<^sub>w\\<^sub>f dclist\" \n  shows \"supp t \\<subseteq> supp B\"\nusing assms proof(induct dclist arbitrary: c t rule:list.induct)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons ct dclist')\n  then consider \"ct = (c,t)\" | \"(c,t) \\<in> set dclist'\" by auto\n  then show ?case proof(cases)\n    case 1\n    then have \"\\<Theta> ; B ; GNil \\<turnstile>\\<^sub>w\\<^sub>f t\" using Cons wfTs_elims by blast\n    thus ?thesis using wfT_supp atom_dom.simps by force\n  next\n    case 2\n    then show ?thesis using Cons wfTs_elims by metis\n  qed\nqed\n\nlemma wfTh_lookup_supp_empty:\n  fixes t::\\<tau>\n  assumes  \"AF_typedef tid dclist \\<in> set \\<Theta>\" and \"(c,t) \\<in> set dclist\" and \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\"\n  shows \"supp t = {}\" \nproof - \n  have \"\\<Theta> ; {||} ; GNil \\<turnstile>\\<^sub>w\\<^sub>f dclist\" using assms lookup_wfTD  wfTD_elims by metis\n  thus ?thesis using wfTs_supp_t assms by force\nqed\n\nlemma wfTh_supp_b:\n  assumes  \"AF_typedef tid dclist \\<in> set \\<Theta>\" and \"(dc,\\<lbrace> z : b | c \\<rbrace> ) \\<in> set dclist\" and \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\"\n  shows \"supp b = {}\" \n  using assms wfTh_lookup_supp_empty \\<tau>.supp by blast\n\nlemma wfTh_b_eq_iff:\n  fixes bva1::bv and bva2::bv and dc::string \n  assumes \"(dc, \\<lbrace> x1 : b1  | c1 \\<rbrace>) \\<in> set dclist1\" and \"(dc, \\<lbrace> x2 : b2  | c2 \\<rbrace>) \\<in> set dclist2\" and\n   \"wfTs P {|bva1|} GNil dclist1\" and  \"wfTs P {|bva2|} GNil dclist2\" \n  \"[[atom bva1]]lst.dclist1 = [[atom bva2]]lst.dclist2\"\n shows  \"[[atom bva1]]lst. (dc,\\<lbrace> x1 : b1  | c1 \\<rbrace>) = [[atom bva2]]lst. (dc,\\<lbrace> x2 : b2  | c2 \\<rbrace>)\"\nusing assms proof(induct dclist1 arbitrary: dclist2)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons dct1' dclist1')\n  show ?case proof(cases \"dclist2 = []\")\n    case True\n    then show ?thesis using Cons by auto\n  next\n    case False\n    then obtain dct2' and dclist2' where cons:\"dct2' # dclist2' = dclist2\" using list.exhaust by metis\n    hence *:\"[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2' \\<and> [[atom bva1]]lst. dct1' = [[atom bva2]]lst. dct2'\" \n      using Cons lst_head_cons Cons cons by metis\n    hence **: \"fst dct1' = fst dct2'\" using lst_fst[THEN lst_pure] \n      by (metis (no_types) \\<open>[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2' \\<and> [[atom bva1]]lst. dct1' = [[atom bva2]]lst. dct2'\\<close> \n            \\<open>\\<And>x2 x1 t2' t2a t2 t1. [[atom x1]]lst. (t1, t2a) = [[atom x2]]lst. (t2, t2') \\<Longrightarrow> t1 = t2\\<close> fst_conv surj_pair)    \n    show ?thesis proof(cases \"fst dct1' = dc\")\n      case True\n      have \"dc \\<notin> fst ` set dclist1'\" using  wfTs_elims Cons by (metis True fstI)\n      hence 1:\"(dc, \\<lbrace> x1 : b1  | c1 \\<rbrace>) = dct1'\" using Cons by (metis fstI image_iff set_ConsD)\n      have \"dc \\<notin> fst ` set dclist2'\" using  wfTs_elims Cons cons \n        by (metis \"**\" True fstI)\n      hence 2:\"(dc, \\<lbrace> x2 : b2  | c2 \\<rbrace>) = dct2' \" using Cons cons  by (metis  fst_conv image_eqI set_ConsD)\n      then show ?thesis using Cons *  1 2   by blast\n    next\n      case False\n      hence \"fst dct2' \\<noteq> dc\" using **  by auto\n      hence \"(dc, \\<lbrace> x1 : b1  | c1 \\<rbrace>) \\<in> set dclist1' \\<and> (dc, \\<lbrace> x2 : b2  | c2 \\<rbrace>) \\<in> set dclist2' \" using Cons cons False \n        by (metis fstI set_ConsD)\n      moreover have \"[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2'\" using * False  by metis\n      ultimately  show ?thesis using Cons ** *  \n        using cons wfTs_elims(2) by blast\n    qed\n  qed\nqed\n\n\nsubsection \\<open>Polymorphic\\<close>\n\nlemma wfTh_wfTs_poly:\n  fixes dclist::\"(string * \\<tau>) list\"\n  assumes \"AF_typedef_poly tyid bva dclist \\<in> set P\" and \"\\<turnstile>\\<^sub>w\\<^sub>f P\"\n  shows  \"P ; {|bva|}  ; GNil \\<turnstile>\\<^sub>w\\<^sub>f  dclist\"\nproof -\n  have *:\"P \\<turnstile>\\<^sub>w\\<^sub>f AF_typedef_poly tyid bva dclist\" using lookup_wfTD assms by simp\n\n  obtain bv lst where *:\"P ; {|bv|}  ; GNil \\<turnstile>\\<^sub>w\\<^sub>f lst  \\<and> \n       (\\<forall>c. atom c \\<sharp> (dclist, lst) \\<longrightarrow> atom c \\<sharp> (bva, bv, dclist, lst) \\<longrightarrow> (bva \\<leftrightarrow> c) \\<bullet> dclist = (bv \\<leftrightarrow> c) \\<bullet> lst)\"  \n    using wfTD_elims(2)[OF *] by metis\n\n  obtain c::bv where  **:\"atom c \\<sharp> ((dclist, lst),(bva, bv, dclist, lst))\" using obtain_fresh by metis\n  have \"P ; {|bv|}  ; GNil \\<turnstile>\\<^sub>w\\<^sub>f lst\" using * by metis\n  hence \"wfTs ((bv \\<leftrightarrow> c) \\<bullet> P)  ((bv \\<leftrightarrow> c) \\<bullet> {|bv|})  ((bv \\<leftrightarrow> c) \\<bullet> GNil) ((bv \\<leftrightarrow> c) \\<bullet> lst)\" using ** wfTs.eqvt by metis\n  hence \"wfTs P  {|c|}  GNil ((bva \\<leftrightarrow> c) \\<bullet> dclist)\" using * theta_flip_eq fresh_GNil assms \n  proof -\n    have \"\\<forall>b ba. (ba::bv \\<leftrightarrow> b) \\<bullet> P = P\"  by (metis \\<open>\\<turnstile>\\<^sub>w\\<^sub>f P\\<close> theta_flip_eq)\n    then show ?thesis\n      using \"*\" \"**\" \\<open>(bv \\<leftrightarrow> c) \\<bullet> P ; (bv \\<leftrightarrow> c) \\<bullet> {|bv|} ; (bv \\<leftrightarrow> c) \\<bullet> GNil \\<turnstile>\\<^sub>w\\<^sub>f (bv \\<leftrightarrow> c) \\<bullet> lst\\<close> by fastforce\n  qed\n  hence \"wfTs ((bva \\<leftrightarrow> c) \\<bullet> P)  ((bva \\<leftrightarrow> c) \\<bullet> {|bva|})  ((bva \\<leftrightarrow> c) \\<bullet> GNil) ((bva \\<leftrightarrow> c) \\<bullet> dclist)\" \n         using wfTs.eqvt fresh_GNil \n         by (simp add: assms(2) theta_flip_eq2)\n\n  thus ?thesis using wfTs.eqvt permute_flip_cancel by metis\nqed\n\nlemma wfTh_dclist_poly_unique:\n  assumes   \"wfTh \\<Theta>\" and \"AF_typedef_poly tid bva dclist1 \\<in> set \\<Theta>\" and  \"AF_typedef_poly tid bva2 dclist2 \\<in> set \\<Theta>\" \n  shows \"[[atom bva]]lst. dclist1 = [[atom bva2]]lst.dclist2\"\nusing assms proof(induct \\<Theta> rule: \\<Theta>_induct)\n  case TNil\n  then show ?case by auto\nnext\n  case (AF_typedef tid' dclist' \\<Theta>')\n  then show ?case using wfTh_elims by auto\nnext\n  case (AF_typedef_poly tid bv dclist \\<Theta>')\n  then show ?case using wfTh_elims  image_eqI name_of_type.simps set_ConsD type_def.eq_iff \n    by (metis Abs1_eq(3))\nqed\n\nlemma wfTh_poly_lookup_supp:\n  fixes t::\\<tau>\n  assumes  \"AF_typedef_poly tid bv dclist \\<in> set \\<Theta>\" and \"(c,t) \\<in> set dclist\" and \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\"\n  shows \"supp t \\<subseteq> {atom bv}\" \nproof - \n  have \"supp dclist  \\<subseteq> {atom bv}\"   using assms lookup_wfTD  wf_supp1 type_def.supp \n    by (metis Diff_single_insert Un_subset_iff list.simps(15) supp_Nil supp_of_atom_list)\n  then show ?thesis using assms(2) proof(induct dclist)\n    case Nil\n    then show ?case by auto\n  next\n    case (Cons a dclist)\n    then show ?case using supp_Pair supp_Cons \n      by (metis (mono_tags, opaque_lifting) Un_empty_left Un_empty_right pure_supp subset_Un_eq subset_singletonD supp_list_member)\n  qed\nqed\n  \nlemma wfTh_poly_supp_b:\n  assumes  \"AF_typedef_poly tid  bv dclist \\<in> set \\<Theta>\" and \"(dc,\\<lbrace> z : b | c \\<rbrace> ) \\<in> set dclist\" and \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\"\n  shows \"supp b \\<subseteq> {atom bv}\" \n  using assms wfTh_poly_lookup_supp \\<tau>.supp by force\n\nlemma subst_g_inside:  \n  fixes x::x and c::c and \\<Gamma>::\\<Gamma>  and \\<Gamma>'::\\<Gamma>\n  assumes \"wfG P \\<B> (\\<Gamma>' @ (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v)  #\\<^sub>\\<Gamma> \\<Gamma>)\" \n  shows  \"(\\<Gamma>' @ (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v)  #\\<^sub>\\<Gamma> \\<Gamma>)[x::=v]\\<^sub>\\<Gamma>\\<^sub>v =  (\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v@\\<Gamma>)\"  \nusing assms proof(induct \\<Gamma>' rule: \\<Gamma>_induct)\n  case GNil\n  then show ?case using subst_gb.simps by simp\nnext\n  case (GCons x' b' c' G) \n  hence wfg:\"wfG P \\<B> (G @ (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<and> atom x' \\<sharp> (G @ (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v)  #\\<^sub>\\<Gamma> \\<Gamma>)\" using wfG_elims(2) \n    using GCons.prems append_g.simps by metis \n  hence \"atom x \\<notin> atom_dom ((x', b', c')  #\\<^sub>\\<Gamma> G)\"  using  GCons wfG_inside_fresh by fast\n  hence \"x\\<noteq>x'\" \n    using  GCons append_Cons  wfG_inside_fresh atom_dom.simps toSet.simps by simp\n  hence \"((GCons (x', b', c') G) @ (GCons (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v) \\<Gamma>))[x::=v]\\<^sub>\\<Gamma>\\<^sub>v  =  \n         (GCons (x', b', c') (G @ (GCons (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v) \\<Gamma>)))[x::=v]\\<^sub>\\<Gamma>\\<^sub>v\" by auto\n  also have \"... =  GCons (x', b', c'[x::=v]\\<^sub>c\\<^sub>v) ((G @ (GCons (x, b, c[z::=V_var x]\\<^sub>c\\<^sub>v) \\<Gamma>))[x::=v]\\<^sub>\\<Gamma>\\<^sub>v)\"  \n      using subst_gv.simps \\<open>x\\<noteq>x'\\<close> by simp\n  also have \"... = (x', b', c'[x::=v]\\<^sub>c\\<^sub>v)  #\\<^sub>\\<Gamma> (G[x::=v]\\<^sub>\\<Gamma>\\<^sub>v @ \\<Gamma>)\" using GCons  wfg by blast\n  also have \"... = ((x', b', c')  #\\<^sub>\\<Gamma> G)[x::=v]\\<^sub>\\<Gamma>\\<^sub>v @ \\<Gamma>\"  using subst_gv.simps \\<open>x\\<noteq>x'\\<close>  by simp\n  finally show ?case by auto\nqed\n\nlemma wfTh_td_eq: \n  assumes \"td1 \\<in> set (td2 # P)\" and \"wfTh (td2 # P)\" and \"name_of_type td1 = name_of_type td2\"\n  shows \"td1 = td2\"\nproof(rule ccontr)\n  assume as: \"td1 \\<noteq> td2\"\n  have \"name_of_type td2 \\<notin> name_of_type ` set P\" using wfTh_elims(2)[OF assms(2)] by metis\n  moreover have \"td1 \\<in> set P\" using assms as by simp\n  ultimately have \"name_of_type td1 \\<noteq> name_of_type td2\"\n    by (metis rev_image_eqI)\n  thus False using assms by auto\nqed\n\nlemma wfTh_td_unique:\n  assumes \"td1 \\<in> set P\" and \"td2  \\<in> set P\" and \"wfTh P\" and \"name_of_type td1 = name_of_type td2\"\n  shows \"td1 = td2\"\nusing assms proof(induct P rule: list.induct)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons td \\<Theta>')\n  consider \"td = td1\" | \"td = td2\" | \"td \\<noteq> td1 \\<and> td \\<noteq> td2\" by auto\n  then  show ?case proof(cases)\n    case 1\n    then show ?thesis using Cons wfTh_elims wfTh_td_eq by metis\n  next\n    case 2\n    then show ?thesis using Cons wfTh_elims wfTh_td_eq by metis\n  next\n    case 3\n    then show ?thesis using Cons wfTh_elims by auto\n  qed\nqed\n\nlemma wfTs_distinct:\n fixes dclist::\"(string * \\<tau>) list\"\n assumes \"\\<Theta> ; B  ; GNil \\<turnstile>\\<^sub>w\\<^sub>f  dclist\"\n shows \"distinct (map fst dclist)\"\nusing assms proof(induct dclist rule: list.induct)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons x1 x2)\n  then show ?case\n      by (metis Cons.hyps Cons.prems distinct.simps(2) fst_conv list.set_map list.simps(9) wfTs_elims(2)) \nqed \n\nlemma wfTh_dclist_distinct:\n  assumes \"AF_typedef s dclist \\<in> set P\" and \"wfTh P\"\n  shows \"distinct (map fst  dclist)\"\nproof - \n  have \"wfTD P (AF_typedef s dclist)\" using assms lookup_wfTD by auto\n  hence \"wfTs P {||} GNil dclist\" using wfTD_elims by metis\n  thus ?thesis using wfTs_distinct by metis\nqed\n\nlemma wfTh_dc_t_unique2:\n  assumes \"AF_typedef s dclist' \\<in> set P\" and \"(dc,tc' ) \\<in> set dclist'\" and \"AF_typedef s dclist \\<in> set P\" and \"wfTh P\" and\n        \"(dc,  tc) \\<in> set dclist\"\n      shows \"tc= tc'\"\nproof - \n  have \"dclist = dclist'\" using assms wfTh_td_unique name_of_type.simps by force\n  moreover have \"distinct (map fst  dclist)\"  using wfTh_dclist_distinct assms by auto\n  ultimately show ?thesis using assms \n    by (meson eq_key_imp_eq_value)\nqed\n\nlemma wfTh_dc_t_unique:\n  assumes \"AF_typedef s dclist' \\<in> set P\" and \"(dc, \\<lbrace> x' : b'  | c' \\<rbrace> ) \\<in> set dclist'\" and \"AF_typedef s dclist \\<in> set P\" and \"wfTh P\" and\n        \"(dc,  \\<lbrace> x : b  | c \\<rbrace>) \\<in> set dclist\"\n      shows \"\\<lbrace> x' : b'  | c' \\<rbrace>= \\<lbrace> x : b  | c \\<rbrace>\"\n  using assms wfTh_dc_t_unique2 by metis\n\nlemma wfTs_wfT:\n  fixes dclist::\"(string *\\<tau>) list\" and t::\\<tau>\n  assumes \"\\<Theta>; \\<B>; GNil  \\<turnstile>\\<^sub>w\\<^sub>f dclist\"  and \"(dc,t) \\<in> set dclist\" \n  shows \"\\<Theta>; \\<B>; GNil  \\<turnstile>\\<^sub>w\\<^sub>f t\"\nusing assms proof(induct dclist rule:list.induct)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons x1 x2)\n  thus ?case using  wfTs_elims(2)[OF Cons(2)] by auto\nqed\n\nlemma wfTh_wfT:\n  fixes t::\\<tau>\n  assumes \"wfTh P\"  and \"AF_typedef tid dclist \\<in> set P\" and \"(dc,t) \\<in> set dclist\" \n  shows \"P ; {||} ; GNil  \\<turnstile>\\<^sub>w\\<^sub>f t\"\nproof - \n  have \"P  \\<turnstile>\\<^sub>w\\<^sub>f AF_typedef tid dclist\" using lookup_wfTD assms by auto\n  hence \"P ; {||} ; GNil \\<turnstile>\\<^sub>w\\<^sub>f dclist\" using wfTD_elims by auto\n  thus ?thesis using wfTs_wfT assms by auto\nqed\n\nlemma td_lookup_eq_iff:\n  fixes dc :: string and bva1::bv and bva2::bv\n  assumes \"[[atom bva1]]lst. dclist1 = [[atom bva2]]lst. dclist2\" and \"(dc, \\<lbrace> x : b  | c \\<rbrace>) \\<in> set dclist1\" \n  shows \"\\<exists>x2 b2 c2. (dc, \\<lbrace> x2 : b2  | c2 \\<rbrace>) \\<in> set dclist2\" \nusing assms proof(induct dclist1 arbitrary: dclist2)\n  case Nil\n  then show ?case by auto\nnext\n  case (Cons dct1' dclist1')\n  then obtain dct2' and dclist2' where cons:\"dct2' # dclist2' = dclist2\"   using  lst_head_cons_neq_nil[OF Cons(2)] list.exhaust by metis\n  hence *:\"[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2' \\<and> [[atom bva1]]lst. dct1' = [[atom bva2]]lst. dct2'\" \n    using Cons lst_head_cons Cons cons by metis\n  show ?case proof(cases \"dc=fst dct1'\")\n    case True\n    hence \"dc = fst dct2'\" using * lst_fst[ THEN lst_pure ] \n    proof -\n      show ?thesis\n        by (metis (no_types) \"local.*\" True \\<open>\\<And>x2 x1 t2' t2a t2 t1. [[atom x1]]lst. (t1, t2a) = [[atom x2]]lst. (t2, t2') \\<Longrightarrow> t1 = t2\\<close> prod.exhaust_sel) (* 31 ms *)\n    qed    \n    obtain x2 b2 and c2 where \"snd dct2' = \\<lbrace> x2 : b2  | c2 \\<rbrace>\" using obtain_fresh_z by metis\n    hence \"(dc, \\<lbrace> x2 : b2  | c2 \\<rbrace>) = dct2'\" using  \\<open>dc = fst dct2'\\<close> \n      by (metis prod.exhaust_sel)\n    then show ?thesis using cons by force\n  next\n    case False\n    hence \"(dc, \\<lbrace> x : b  | c \\<rbrace>) \\<in> set dclist1'\" using Cons by auto\n    then show ?thesis using Cons \n      by (metis \"local.*\" cons list.set_intros(2))\n  qed\nqed\n\nlemma lst_t_b_eq_iff:\n  fixes bva1::bv and bva2::bv\n  assumes \"[[atom bva1]]lst. \\<lbrace> x1 : b1  | c1 \\<rbrace> = [[atom bva2]]lst. \\<lbrace> x2 : b2  | c2 \\<rbrace>\" \n  shows \"[[atom bva1]]lst. b1 = [[atom bva2]]lst.b2\" \nproof(subst  Abs1_eq_iff_all(3)[of bva1 b1  bva2 b2],rule,rule,rule)\n  fix c::bv\n  assume \"atom c \\<sharp> ( \\<lbrace> x1 : b1  | c1 \\<rbrace> ,  \\<lbrace> x2 : b2  | c2 \\<rbrace>)\" and \"atom c \\<sharp> (bva1, bva2, b1, b2)\"\n\n  show \"(bva1 \\<leftrightarrow> c) \\<bullet> b1 = (bva2 \\<leftrightarrow> c) \\<bullet> b2\" using assms Abs1_eq_iff(3) assms \n    by (metis Abs1_eq_iff_fresh(3) \\<open>atom c \\<sharp> (bva1, bva2, b1, b2)\\<close> \\<tau>.fresh \\<tau>.perm_simps type_eq_subst_eq2(2))\nqed\n\nlemma wfTh_typedef_poly_b_eq_iff:  \n  assumes \"AF_typedef_poly tyid bva1 dclist1 \\<in> set P\" and \"(dc, \\<lbrace> x1 : b1  | c1 \\<rbrace>) \\<in> set dclist1\"\n  and \"AF_typedef_poly tyid bva2 dclist2 \\<in> set P\" and \"(dc, \\<lbrace> x2 : b2  | c2 \\<rbrace>) \\<in> set dclist2\" and \"\\<turnstile>\\<^sub>w\\<^sub>f P\"\nshows \"b1[bva1::=b]\\<^sub>b\\<^sub>b = b2[bva2::=b]\\<^sub>b\\<^sub>b\"\nproof - \n  have \"[[atom bva1]]lst. dclist1 = [[atom bva2]]lst.dclist2\" using assms wfTh_dclist_poly_unique by metis\n  hence \"[[atom bva1]]lst. (dc,\\<lbrace> x1 : b1  | c1 \\<rbrace>) = [[atom bva2]]lst. (dc,\\<lbrace> x2 : b2  | c2 \\<rbrace>)\" using wfTh_b_eq_iff assms wfTh_wfTs_poly by metis\n  hence \"[[atom bva1]]lst. \\<lbrace> x1 : b1  | c1 \\<rbrace> = [[atom bva2]]lst. \\<lbrace> x2 : b2  | c2 \\<rbrace>\" using lst_snd by metis\n  hence \"[[atom bva1]]lst. b1 = [[atom bva2]]lst.b2\" using lst_t_b_eq_iff by metis\n  thus ?thesis using subst_b_flip_eq_two subst_b_b_def by metis\nqed\n\nsection \\<open>Equivariance Lemmas\\<close>\n\nlemma x_not_in_u_set[simp]:\n  fixes  x::x and us::\"u fset\"\n  shows \"atom x \\<notin> supp us\"\n  by(induct us,auto, simp add: supp_finsert supp_at_base)\n\nlemma wfS_flip_eq:\n  fixes s1::s and x1::x and s2::s and x2::x  and \\<Delta>::\\<Delta>\n  assumes \"[[atom x1]]lst. s1 = [[atom x2]]lst. s2\" and \"[[atom x1]]lst. t1 = [[atom x2]]lst. t2\"  and \"[[atom x1]]lst. c1 = [[atom x2]]lst. c2\" and \"atom x2 \\<sharp> \\<Gamma>\" and\n           \" \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>\"  and\n        \"\\<Theta> ; \\<Phi>  ; \\<B> ; (x1, b, c1)  #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s1 : b_of t1\"\n       shows  \"\\<Theta> ; \\<Phi>  ; \\<B> ; (x2, b, c2)  #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta>  \\<turnstile>\\<^sub>w\\<^sub>f s2 : b_of t2\"\nproof(cases \"x1=x2\")\n  case True\n  hence \"s1 = s2 \\<and> t1 = t2 \\<and> c1 = c2\" using assms Abs1_eq_iff by metis\n  then show ?thesis using assms True by simp\nnext\n  case False\n  have \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<and> \\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<and>  \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>\" using wfX_wfY assms by metis\n  moreover have \"atom x1 \\<sharp> \\<Gamma>\" using wfX_wfY wfG_elims assms by metis\n  moreover hence \"atom x1 \\<sharp> \\<Delta> \\<and> atom x2 \\<sharp> \\<Delta> \" using wfD_x_fresh assms by auto\n  ultimately have \" \\<Theta> ; \\<Phi>  ; \\<B> ; (x2 \\<leftrightarrow> x1) \\<bullet> ((x1, b, c1)  #\\<^sub>\\<Gamma>  \\<Gamma>) ; \\<Delta>  \\<turnstile>\\<^sub>w\\<^sub>f (x2 \\<leftrightarrow> x1) \\<bullet> s1 :  (x2 \\<leftrightarrow> x1) \\<bullet> b_of t1\"\n    using wfS.eqvt theta_flip_eq phi_flip_eq assms  flip_base_eq beta_flip_eq flip_fresh_fresh supp_b_empty by metis\n  hence   \" \\<Theta> ; \\<Phi>  ; \\<B> ;  ((x2, b, (x2 \\<leftrightarrow> x1) \\<bullet> c1)  #\\<^sub>\\<Gamma>  ((x2 \\<leftrightarrow> x1) \\<bullet> \\<Gamma>)) ; \\<Delta>  \\<turnstile>\\<^sub>w\\<^sub>f (x2 \\<leftrightarrow> x1) \\<bullet> s1 :   b_of ((x2 \\<leftrightarrow> x2) \\<bullet> t1)\"  by fastforce\n  thus ?thesis using assms Abs1_eq_iff \n  proof -\n   have f1: \"x2 = x1 \\<and> t2 = t1 \\<or> x2 \\<noteq> x1 \\<and> t2 = (x2 \\<leftrightarrow> x1) \\<bullet> t1 \\<and> atom x2 \\<sharp> t1\"\n     by (metis (full_types) Abs1_eq_iff(3) \\<open>[[atom x1]]lst. t1 = [[atom x2]]lst. t2\\<close>) (* 125 ms *)\n   then have \"x2 \\<noteq> x1 \\<and> s2 = (x2 \\<leftrightarrow> x1) \\<bullet> s1 \\<and> atom x2 \\<sharp> s1 \\<longrightarrow> b_of t2 = (x2 \\<leftrightarrow> x1) \\<bullet> b_of t1\"\n     by (metis b_of.eqvt) (* 0.0 ms *)\n   then show ?thesis\n    using f1 by (metis (no_types) Abs1_eq_iff(3) G_cons_flip_fresh3 \\<open>[[atom x1]]lst. c1 = [[atom x2]]lst. c2\\<close> \\<open>[[atom x1]]lst. s1 = [[atom x2]]lst. s2\\<close> \\<open>\\<Theta> ; \\<Phi>  ; \\<B> ; (x1, b, c1)  #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s1 : b_of t1\\<close> \\<open>\\<Theta> ; \\<Phi>  ; \\<B> ; (x2 \\<leftrightarrow> x1) \\<bullet> ((x1, b, c1)  #\\<^sub>\\<Gamma> \\<Gamma>) ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f (x2 \\<leftrightarrow> x1) \\<bullet> s1 : (x2 \\<leftrightarrow> x1) \\<bullet> b_of t1\\<close> \\<open>atom x1 \\<sharp> \\<Gamma>\\<close> \\<open>atom x2 \\<sharp> \\<Gamma>\\<close>) (* 593 ms *)\n  qed\nqed\n\nsection \\<open>Lookup\\<close>\n\nlemma wf_not_in_prefix:\n  assumes \"\\<Theta> ; B \\<turnstile>\\<^sub>w\\<^sub>f (\\<Gamma>'@(x,b1,c1) #\\<^sub>\\<Gamma>\\<Gamma>)\"\n  shows \"x \\<notin> fst ` toSet \\<Gamma>'\"\nusing assms proof(induct \\<Gamma>' rule: \\<Gamma>.induct)\n  case GNil\n  then show ?case by simp\nnext\n  case (GCons xbc \\<Gamma>')\n  then obtain x' and b' and c'::c where xbc: \"xbc=(x',b',c')\" \n    using prod_cases3 by blast\n  hence *:\"(xbc  #\\<^sub>\\<Gamma> \\<Gamma>') @ (x, b1, c1)  #\\<^sub>\\<Gamma> \\<Gamma> = ((x',b',c') #\\<^sub>\\<Gamma>(\\<Gamma>'@ ((x, b1, c1)  #\\<^sub>\\<Gamma> \\<Gamma>)))\" by simp\n  hence \"atom x' \\<sharp> (\\<Gamma>'@(x,b1,c1) #\\<^sub>\\<Gamma>\\<Gamma>)\" using wfG_elims(2) GCons by metis\n    \n  moreover have \"\\<Theta> ; B \\<turnstile>\\<^sub>w\\<^sub>f (\\<Gamma>' @ (x, b1, c1)  #\\<^sub>\\<Gamma> \\<Gamma>)\" using GCons wfG_elims * by metis\n  ultimately have  \"atom x' \\<notin> atom_dom (\\<Gamma>'@(x,b1,c1) #\\<^sub>\\<Gamma>\\<Gamma>)\" using wfG_dom_supp GCons append_g.simps xbc fresh_def by fast\n  hence \"x' \\<noteq> x\" using GCons fresh_GCons xbc by fastforce\n  then show ?case using GCons xbc toSet.simps\n    using Un_commute \\<open>\\<Theta> ; B \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' @ (x, b1, c1)  #\\<^sub>\\<Gamma> \\<Gamma>\\<close> atom_dom.simps by auto\nqed\n\nlemma lookup_inside_wf[simp]:\n  assumes \"\\<Theta> ; B \\<turnstile>\\<^sub>w\\<^sub>f (\\<Gamma>'@(x,b1,c1) #\\<^sub>\\<Gamma>\\<Gamma>)\"\n  shows \"Some (b1,c1) = lookup (\\<Gamma>'@(x,b1,c1) #\\<^sub>\\<Gamma>\\<Gamma>) x\"\n  using wf_not_in_prefix lookup_inside assms by fast\n\nlemma lookup_weakening:\n  fixes \\<Theta>::\\<Theta> and \\<Gamma>::\\<Gamma> and \\<Gamma>'::\\<Gamma>\n  assumes \"Some (b,c) = lookup \\<Gamma> x\" and \"toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>'\" and \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>'\" and \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\"\n  shows \"Some (b,c) = lookup \\<Gamma>' x\"\nproof -\n  have \"(x,b,c) \\<in> toSet \\<Gamma> \\<and> (\\<forall>b' c'. (x,b',c') \\<in> toSet \\<Gamma> \\<longrightarrow> b'=b \\<and> c'=c)\" using assms lookup_iff toSet.simps by force\n  hence \"(x,b,c) \\<in> toSet \\<Gamma>'\" using assms by auto\n  moreover have \"(\\<forall>b' c'. (x,b',c') \\<in> toSet \\<Gamma>' \\<longrightarrow> b'=b \\<and> c'=c)\" using assms wf_g_unique \n    using calculation by auto\n  ultimately show ?thesis using lookup_iff \n    using assms(3) by blast\nqed\n\nlemma wfPhi_lookup_fun_unique:\n  fixes \\<Phi>::\\<Phi>\n  assumes \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\" and \"AF_fundef f fd \\<in> set \\<Phi>\" \n  shows \"Some (AF_fundef f fd) = lookup_fun \\<Phi> f\"\nusing assms proof(induct \\<Phi> rule: list.induct )\n  case Nil\n  then show ?case using lookup_fun.simps by simp\nnext\n  case (Cons  a  \\<Phi>')\n  then obtain f' and fd' where a:\"a = AF_fundef f' fd'\" using fun_def.exhaust by auto  \n  have wf: \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>' \\<and> f' \\<notin> name_of_fun ` set \\<Phi>' \" using wfPhi_elims Cons a by metis\n  then show ?case  using Cons lookup_fun.simps using Cons  lookup_fun.simps wf a \n      by (metis image_eqI name_of_fun.simps set_ConsD)\nqed\n\nlemma lookup_fun_weakening:\n  fixes \\<Phi>'::\\<Phi>\n  assumes \"Some fd = lookup_fun \\<Phi> f\" and \"set \\<Phi> \\<subseteq> set \\<Phi>'\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>'\"\n  shows \"Some fd = lookup_fun \\<Phi>' f\"\nusing assms proof(induct \\<Phi> )\n  case Nil\n  then show ?case using lookup_fun.simps by simp\nnext\n  case (Cons  a  \\<Phi>'')\n  then obtain f' and fd' where a: \"a = AF_fundef f' fd'\" using fun_def.exhaust by auto\n  then show ?case proof(cases \"f=f'\")\n    case True\n    then show ?thesis using lookup_fun.simps Cons wfPhi_lookup_fun_unique a \n      by (metis lookup_fun_member subset_iff)\n  next\n    case False\n    then show ?thesis  using lookup_fun.simps Cons \n      using \\<open>a = AF_fundef f' fd'\\<close> by auto\n  qed\nqed\n\nlemma  fundef_poly_fresh_bv:\n  assumes \"atom bv2 \\<sharp> (bv1,b1,c1,\\<tau>1,s1)\"\n  shows  * : \"(AF_fun_typ_some bv2 (AF_fun_typ x1 ((bv1\\<leftrightarrow>bv2) \\<bullet> b1) ((bv1\\<leftrightarrow>bv2) \\<bullet>c1) ((bv1\\<leftrightarrow>bv2) \\<bullet> \\<tau>1) ((bv1\\<leftrightarrow>bv2) \\<bullet> s1)) = (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1 s1)))\" \n        (is \"(AF_fun_typ_some ?bv ?fun_typ = AF_fun_typ_some ?bva ?fun_typa)\")\nproof -\n  have 1:\"atom bv2 \\<notin> set [atom x1]\" using bv_not_in_x_atoms by simp\n  have 2:\"bv1 \\<noteq> bv2\" using assms by auto\n  have 3:\"(bv2 \\<leftrightarrow> bv1) \\<bullet> x1 = x1\" using pure_fresh flip_fresh_fresh \n    by (simp add: flip_fresh_fresh)\n  have \"  AF_fun_typ x1 ((bv1 \\<leftrightarrow> bv2) \\<bullet> b1) ((bv1 \\<leftrightarrow> bv2) \\<bullet> c1) ((bv1 \\<leftrightarrow> bv2) \\<bullet> \\<tau>1) ((bv1 \\<leftrightarrow> bv2) \\<bullet> s1) = (bv2 \\<leftrightarrow> bv1) \\<bullet> AF_fun_typ x1 b1 c1 \\<tau>1 s1\"\n    using 1 2 3 assms   by (simp add: flip_commute)\n  moreover have \"(atom bv2 \\<sharp> c1 \\<and> atom bv2 \\<sharp> \\<tau>1 \\<and> atom bv2 \\<sharp> s1 \\<or> atom bv2 \\<in> set [atom x1])  \\<and> atom bv2 \\<sharp> b1\" \n     using 1 2 3 assms  fresh_prod5 by metis\n  ultimately show ?thesis unfolding  fun_typ_q.eq_iff  Abs1_eq_iff(3) fun_typ.fresh 1 2 by fastforce\nqed\n\n\ntext \\<open>It is possible to collapse some of the easy to prove inductive cases into a single proof at the qed line\n   but this makes it fragile under change. For example, changing the lemma statement might make one of the previously\n   trivial cases non-trivial and so the collapsing needs to be unpacked. Is there a way to find which case\n   has failed in the qed line?\\<close>\n\nlemma wb_b_weakening1:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and \\<B>::\\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n          and cs::branch_s and css::branch_list\n\n  shows  \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b \\<Longrightarrow> \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow> \\<Theta>; \\<B>' ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow>\\<B> |\\<subseteq>| \\<B>'  \\<Longrightarrow> \\<Theta>; \\<B>' ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f  c\" and\n         \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>   \\<Longrightarrow>\\<B> |\\<subseteq>| \\<B>'  \\<Longrightarrow> \\<Theta>; \\<B>' \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<Longrightarrow> \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow>  \\<Theta>; \\<B>' ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f  \\<tau>\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts  \\<Longrightarrow>  \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow> \\<Theta>; \\<B>' ; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts\" and \n         \"\\<turnstile>\\<^sub>w\\<^sub>f P \\<Longrightarrow> True \" and     \n         \"wfB \\<Theta> \\<B> b \\<Longrightarrow>  \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow> wfB \\<Theta> \\<B>' b\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ce : b \\<Longrightarrow> \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow> \\<Theta>; \\<B>' ;  \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b\" and\n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow> True\"\nproof(nominal_induct b and c and \\<Gamma> and \\<tau> and ts and P and b and b and td \n     avoiding:  \\<B>'\nrule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)\n  case (wfV_conspI s bv dclist \\<Theta> dc x b' c \\<B> b \\<Gamma> v)\n  show ?case proof\n    show \\<open>AF_typedef_poly s bv dclist \\<in> set \\<Theta>\\<close> using wfV_conspI by metis\n    show \\<open>(dc, \\<lbrace> x : b'  | c \\<rbrace>) \\<in> set dclist\\<close> using wfV_conspI  by auto\n    show \\<open> \\<Theta> ;  \\<B>'  \\<turnstile>\\<^sub>w\\<^sub>f b \\<close> using wfV_conspI by auto\n    show \\<open>atom bv \\<sharp>  (\\<Theta>, \\<B>', \\<Gamma>, b, v)\\<close>  using fresh_prodN wfV_conspI by auto\n    thus \\<open> \\<Theta>; \\<B>' ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b'[bv::=b]\\<^sub>b\\<^sub>b \\<close> using wfV_conspI by simp\n  qed\nnext\n case (wfTI z \\<Theta> \\<B> \\<Gamma> b c)\n  show ?case proof \n    show \"atom z \\<sharp>  (\\<Theta>, \\<B>', \\<Gamma>)\" using wfTI by auto\n    show \"\\<Theta>; \\<B>'  \\<turnstile>\\<^sub>w\\<^sub>f b \" using wfTI by auto\n    show \"\\<Theta>; \\<B>' ; (z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f c \" using wfTI by auto\n  qed\nqed( (auto simp add: wf_intros | metis wf_intros)+ )\n\nlemma wb_b_weakening2:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and \\<B>::\\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n          and cs::branch_s and css::branch_list\n\n  shows \n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>  ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b \\<Longrightarrow> \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow> \\<Theta> ; \\<Phi> ; \\<B>' ;  \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<Longrightarrow> \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow> \\<Theta> ; \\<Phi> ; \\<B>' ;  \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b\" and\n         \"\\<Theta> ; \\<Phi> ; \\<B>  ; \\<Gamma> ; \\<Delta> ; tid ; dc ; t  \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow> \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow>  \\<Theta> ; \\<Phi> ; \\<B>' ; \\<Gamma> ; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b\" and\n         \"\\<Theta> ; \\<Phi> ; \\<B>  ; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow> \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow>  \\<Theta> ; \\<Phi> ; \\<B>' ; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b\" and       \n         \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>) \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<Longrightarrow> \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow>  \\<Theta>; \\<B>' ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f  \\<Delta>\" and\n         \"\\<Theta> ; \\<Phi>   \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> True\" and\n         \"\\<Theta> ; \\<Phi>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow> \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow> \\<Theta> ; \\<Phi>  ; \\<B>' \\<turnstile>\\<^sub>w\\<^sub>f ft\"\nproof(nominal_induct b and b and b and b and \\<Phi> and \\<Delta> and ftq and ft  \n   avoiding:  \\<B>'\n   rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)\n  case (wfE_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v b)\n  then show ?case using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfE_plusI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros  wb_b_weakening1 by metis\nnext\n  case (wfE_leqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros  wb_b_weakening1 by metis\nnext\n  case (wfE_eqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b v2)\n  then show ?case  using wf_intros  wb_b_weakening1 \n    by meson\nnext\n  case (wfE_fstI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using Wellformed.wfE_fstI  wb_b_weakening1 by metis\nnext\n  case (wfE_sndI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using wf_intros  wb_b_weakening1 by metis\nnext\n  case (wfE_concatI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfE_splitI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfE_lenI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1) \n  then show ?case using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfE_appI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> f ft v)\n  then show ?case using wf_intros using wb_b_weakening1  by meson\nnext\n  case (wfE_appPI \\<Theta> \\<Phi> \\<B>1 \\<Gamma> \\<Delta> b' bv1 v1 \\<tau>1 f1 x1 b1 c1 s1)\n\n  have \"\\<Theta> ; \\<Phi>  ; \\<B>' ; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f AE_appP f1 b' v1 : (b_of \\<tau>1)[bv1::=b']\\<^sub>b\" \n  proof\n    show \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\" using wfE_appPI by auto\n    show \"\\<Theta>; \\<B>' ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \"  using wfE_appPI by auto\n    show \"\\<Theta>; \\<B>'  \\<turnstile>\\<^sub>w\\<^sub>f b' \"  using wfE_appPI wb_b_weakening1 by auto\n    thus \" atom bv1 \\<sharp> (\\<Phi>, \\<Theta>, \\<B>', \\<Gamma>, \\<Delta>, b', v1, (b_of \\<tau>1)[bv1::=b']\\<^sub>b)\"  \n      using  wfE_appPI fresh_prodN by auto\n\n    show \"Some (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1 s1))) = lookup_fun \\<Phi> f1\"  using wfE_appPI by auto\n    show \"\\<Theta>; \\<B>' ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v1 : b1[bv1::=b']\\<^sub>b \"  using wfE_appPI wb_b_weakening1 by auto\n  qed\n  then show ?case by auto\nnext\n  case (wfE_mvarI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> u \\<tau>)\n  then show ?case using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfS_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> v b \\<Delta>)\n  then show ?case using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfS_letI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> e b' x s b)\n  show ?case proof\n    show \\<open> \\<Theta> ; \\<Phi>  ; \\<B>' ; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b' \\<close> using wfS_letI by auto\n    show \\<open> \\<Theta> ; \\<Phi>  ; \\<B>' ; (x, b', TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_letI by auto\n    show \\<open> \\<Theta>; \\<B>' ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfS_letI by auto\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>, \\<B>', \\<Gamma>, \\<Delta>, e, b)\\<close> using wfS_letI by auto\n  qed\nnext\n  case (wfS_let2I \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 \\<tau> x s2 b)\n  then show ?case using wb_b_weakening1 Wellformed.wfS_let2I by simp\nnext\n  case (wfS_ifI \\<Theta> \\<B> \\<Gamma> v \\<Phi> \\<Delta> s1 b s2)\n  then show ?case using  wb_b_weakening1 Wellformed.wfS_ifI by simp\nnext\n  case (wfS_varI \\<Theta> \\<B> \\<Gamma> \\<tau> v u \\<Delta> \\<Phi> s b)\n  then show ?case using wb_b_weakening1 Wellformed.wfS_varI by simp\nnext\n  case (wfS_assignI u \\<tau> \\<Delta> \\<Theta> \\<B> \\<Gamma> \\<Phi> v)\n  then show ?case using wb_b_weakening1 Wellformed.wfS_assignI by simp\nnext\ncase (wfS_whileI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 s2 b)\n  then show ?case using wb_b_weakening1 Wellformed.wfS_whileI by simp\nnext\n  case (wfS_seqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 s2 b)\n  then show ?case using Wellformed.wfS_seqI   by metis\nnext\n  case (wfS_matchI \\<Theta> \\<B> \\<Gamma> v tid dclist \\<Delta> \\<Phi> cs b)\n  then show ?case using  wb_b_weakening1 Wellformed.wfS_matchI by metis\nnext\n  case (wfS_branchI \\<Theta> \\<Phi> \\<B> x \\<tau> \\<Gamma> \\<Delta> s b tid dc)\n  then show ?case  using Wellformed.wfS_branchI by auto\nnext\n  case (wfS_finalI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> tid dclist' cs b dclist)\n  then show ?case  using wf_intros by metis\nnext\n  case (wfS_cons \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> tid dclist' cs b css dclist)\n  then show ?case  using wf_intros by metis\nnext\n  case (wfD_emptyI \\<Theta> \\<B> \\<Gamma>)\n  then show ?case using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfD_cons \\<Theta> \\<B> \\<Gamma> \\<Delta> \\<tau> u)\n  then show ?case using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfPhi_emptyI \\<Theta>)\n  then show ?case using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfPhi_consI f \\<Theta> \\<Phi> ft)\n  then show ?case using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfFTSome \\<Theta> bv ft)\n  then show ?case  using wf_intros wb_b_weakening1 by metis\nnext\n  case (wfFTI \\<Theta> B b s x c \\<tau> \\<Phi>)\n  show ?case proof\n    show \"\\<Theta>; \\<B>'  \\<turnstile>\\<^sub>w\\<^sub>f b\"   using wfFTI wb_b_weakening1 by auto\n    \n    show \"supp c \\<subseteq> {atom x}\" using wfFTI wb_b_weakening1 by auto\n    show \"\\<Theta>; \\<B>' ; (x, b, c) #\\<^sub>\\<Gamma> GNil   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \" using wfFTI wb_b_weakening1 by auto\n    show \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \" using wfFTI wb_b_weakening1 by auto\n    from \\<open> B |\\<subseteq>| \\<B>'\\<close> have \"supp B \\<subseteq> supp \\<B>'\" proof(induct B)\n      case empty\n      then show ?case by auto\n    next\n      case (insert x B)\n      then show ?case \n        by (metis fsubset_funion_eq subset_Un_eq supp_union_fset)\n    qed\n    thus  \"supp s \\<subseteq> {atom x} \\<union> supp \\<B>'\" using wfFTI by auto\n  qed  \nnext\n  case (wfS_assertI \\<Theta> \\<Phi> \\<B> x c \\<Gamma> \\<Delta> s b)\n  show ?case proof\n    show \\<open> \\<Theta> ; \\<Phi> ; \\<B>' ; (x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wb_b_weakening1 wfS_assertI by simp\n    show \\<open> \\<Theta>; \\<B>' ; \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f c \\<close>  using wb_b_weakening1 wfS_assertI by simp\n    show \\<open> \\<Theta>; \\<B>' ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wb_b_weakening1 wfS_assertI by simp\n    have \"atom x \\<sharp>  \\<B>'\" using x_not_in_b_set fresh_def by metis\n    thus  \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>, \\<B>', \\<Gamma>, \\<Delta>, c, b, s)\\<close> using wfS_assertI fresh_prodN by simp\n  qed   \nqed(auto)\n\nlemmas wb_b_weakening = wb_b_weakening1 wb_b_weakening2\n\nlemma wfG_b_weakening:\n  fixes \\<Gamma>::\\<Gamma>\n  assumes \"\\<B> |\\<subseteq>| \\<B>'\" and \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\"\n  shows \"\\<Theta>; \\<B>'  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \"\n  using wb_b_weakening assms by auto\n\nlemma wfT_b_weakening:\n  fixes \\<Gamma>::\\<Gamma> and \\<Theta>::\\<Theta> and \\<tau>::\\<tau>\n  assumes \"\\<B> |\\<subseteq>| \\<B>'\" and \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"\n  shows \"\\<Theta>; \\<B>' ; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \"\n  using wb_b_weakening assms by auto\n\nlemma wfB_subst_wfB:\n  fixes \\<tau>::\\<tau> and b'::b and b::b\n  assumes \"\\<Theta> ; {|bv|}  \\<turnstile>\\<^sub>w\\<^sub>f b\" and \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b'\"\n  shows \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b[bv::=b']\\<^sub>b\\<^sub>b \"\nusing assms proof(nominal_induct b rule:b.strong_induct)\n  case B_int\n  hence  \"\\<Theta> ; {||}  \\<turnstile>\\<^sub>w\\<^sub>f B_int\" using wfB_intI wfX_wfY by fast\n  then show ?case using subst_bb.simps wb_b_weakening by fastforce\nnext\n  case B_bool\n  hence  \"\\<Theta> ; {||}  \\<turnstile>\\<^sub>w\\<^sub>f B_bool\" using wfB_boolI wfX_wfY by fast\n  then show ?case using subst_bb.simps wb_b_weakening by fastforce\nnext\n  case (B_id x )\n  hence \" \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (B_id x)\" using wfB_consI wfB_elims wfX_wfY by metis\n  then show ?case using  subst_bb.simps(4) by auto\nnext\n  case (B_pair x1 x2)\n  then show ?case using subst_bb.simps \n    by (metis wfB_elims(1) wfB_pairI)\nnext\n  case B_unit\n  hence  \"\\<Theta> ; {||}  \\<turnstile>\\<^sub>w\\<^sub>f B_unit\" using wfB_unitI wfX_wfY by fast\n  then show ?case using subst_bb.simps wb_b_weakening by fastforce\nnext\n  case B_bitvec\n  hence  \"\\<Theta> ; {||}  \\<turnstile>\\<^sub>w\\<^sub>f B_bitvec\" using wfB_bitvecI wfX_wfY by fast\n  then show ?case using subst_bb.simps wb_b_weakening by fastforce\nnext\n  case (B_var x)\n  then show ?case \n  proof -\n    have False\n      using B_var.prems(1) wfB.cases by fastforce (* 781 ms *)\n    then show ?thesis  by metis \n  qed\nnext\n  case (B_app s b)\n  then obtain bv' dclist where *:\"AF_typedef_poly s bv' dclist \\<in> set \\<Theta> \\<and> \\<Theta> ; {|bv|}   \\<turnstile>\\<^sub>w\\<^sub>f b\" using wfB_elims by metis\n  show ?case unfolding subst_b_simps proof\n    show \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \" using B_app wfX_wfY by metis\n    show \"\\<Theta> ;   \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b[bv::=b']\\<^sub>b\\<^sub>b \" using * B_app forget_subst wfB_supp fresh_def \n      by (metis ex_in_conv subset_empty subst_b_b_def supp_empty_fset)\n    show \"AF_typedef_poly s bv' dclist \\<in> set \\<Theta>\" using * by auto\n  qed\nqed\n\nlemma wfT_subst_wfB:\n  fixes \\<tau>::\\<tau> and b'::b\n  assumes \"\\<Theta> ; {|bv|} ; (x, b, c)  #\\<^sub>\\<Gamma> GNil   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\" and \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b'\"\n  shows \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (b_of \\<tau>)[bv::=b']\\<^sub>b\\<^sub>b \"\nproof -\n  obtain b where  \"\\<Theta> ; {|bv|} \\<turnstile>\\<^sub>w\\<^sub>f b \\<and> b_of \\<tau> = b\" using wfT_elims b_of.simps assms by metis\n  thus ?thesis using wfB_subst_wfB assms by auto\nqed\n\nlemma wfG_cons_unique:\n  assumes \"(x1,b1,c1) \\<in> toSet (((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>))\" and \"wfG \\<Theta> \\<B> (((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>))\" and \"x = x1\"\n  shows \"b1 = b \\<and> c1 = c\" \nproof -\n  have \"x1 \\<notin> fst ` toSet \\<Gamma>\" \n  proof -\n    have \"atom x1 \\<sharp> \\<Gamma>\" using assms wfG_cons by metis\n    then show ?thesis\n      using fresh_gamma_elem \n      by (metis assms(2) atom_dom.simps dom.simps rev_image_eqI wfG_cons2 wfG_x_fresh)\n  qed\n  thus ?thesis using assms by force\nqed\n\nlemma wfG_member_unique:\n  assumes \"(x1,b1,c1) \\<in> toSet (\\<Gamma>'@((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>))\" and \"wfG \\<Theta> \\<B> (\\<Gamma>'@((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>))\" and \"x = x1\"\n  shows \"b1 = b \\<and> c1 = c\" \n  using assms proof(induct \\<Gamma>' rule: \\<Gamma>_induct)\n  case GNil\n  then show ?case using wfG_suffix wfG_cons_unique append_g.simps by metis\nnext\n  case (GCons x' b' c' \\<Gamma>')\n  moreover hence \"(x1, b1, c1) \\<in> toSet (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)\" using wf_not_in_prefix by fastforce\n  ultimately show ?case using wfG_cons by fastforce\nqed\n\nsection \\<open>Function Definitions\\<close>\n\nlemma wb_phi_weakening:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and \\<B>::\\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n         and cs::branch_s and css::branch_list and \\<Phi>::\\<Phi>\n  shows\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>  ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b \\<Longrightarrow> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>' \\<Longrightarrow> set \\<Phi>  \\<subseteq> set \\<Phi>' \\<Longrightarrow> \\<Theta> ; \\<Phi>' ; \\<B> ;  \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b  \\<Longrightarrow> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>' \\<Longrightarrow> set \\<Phi>  \\<subseteq> set \\<Phi>' \\<Longrightarrow> \\<Theta> ; \\<Phi>' ; \\<B> ;  \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b\" and\n         \"\\<Theta> ; \\<Phi> ; \\<B>  ; \\<Gamma> ; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>' \\<Longrightarrow> set \\<Phi>  \\<subseteq> set \\<Phi>' \\<Longrightarrow>   \\<Theta> ; \\<Phi>' ; \\<B> ; \\<Gamma> ; \\<Delta> ; tid ; dc ; t  \\<turnstile>\\<^sub>w\\<^sub>f cs : b\" and\n         \"\\<Theta> ; \\<Phi> ; \\<B>  ; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>' \\<Longrightarrow> set \\<Phi>  \\<subseteq> set \\<Phi>' \\<Longrightarrow>  \\<Theta> ; \\<Phi>' ; \\<B> ; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b\" and      \n         \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>) \\<Longrightarrow> True\" and\n          \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<Longrightarrow> True\" and       \n          \"\\<Theta> ; \\<Phi>  \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>' \\<Longrightarrow> set \\<Phi>  \\<subseteq> set \\<Phi>' \\<Longrightarrow> \\<Theta> ; \\<Phi>'  \\<turnstile>\\<^sub>w\\<^sub>f ftq\" and\n         \"\\<Theta> ; \\<Phi> ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow>  \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>' \\<Longrightarrow> set \\<Phi>  \\<subseteq> set \\<Phi>' \\<Longrightarrow> \\<Theta> ; \\<Phi>' ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft\"      \nproof(nominal_induct\n          b and b and b and b and \\<Phi> and \\<Delta> and  ftq and ft \n          avoiding:  \\<Phi>'         \n       rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)\n  case (wfE_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v b)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_plusI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_leqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_eqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b v2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_fstI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_sndI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_concatI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_splitI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_lenI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_appI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> f x b c \\<tau> s v)\n  then show ?case using wf_intros lookup_fun_weakening by metis\nnext\n  case (wfE_appPI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> b' bv v \\<tau> f x b c s)\n  show ?case proof\n    show \\<open> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>' \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b' \\<close> using wfE_appPI by auto\n    show \\<open>atom bv \\<sharp> (\\<Phi>', \\<Theta>, \\<B>, \\<Gamma>, \\<Delta>, b', v, (b_of \\<tau>)[bv::=b']\\<^sub>b)\\<close> using wfE_appPI by auto\n    show \\<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi>' f\\<close> \n      using wfE_appPI lookup_fun_weakening by metis\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b[bv::=b']\\<^sub>b \\<close> using wfE_appPI by auto\n  qed\nnext\n  case (wfE_mvarI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> u \\<tau>)\n  then show ?case using wf_intros by metis\nnext\n  case (wfS_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> v b \\<Delta>)\n  then show ?case using wf_intros by metis\nnext\n  case (wfS_letI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> e b' x s b)\n  then show ?case using Wellformed.wfS_letI by fastforce\nnext\n  case (wfS_let2I \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 b' x s2 b)\n  then show ?case   using Wellformed.wfS_let2I by fastforce\nnext\n  case (wfS_ifI \\<Theta> \\<B> \\<Gamma> v \\<Phi> \\<Delta> s1 b s2)\n  then show ?case  using wf_intros by metis\nnext\n  case (wfS_varI \\<Theta> \\<B> \\<Gamma> \\<tau> v u \\<Phi> \\<Delta> b s)\n  show ?case proof\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<close> using wfS_varI by simp\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b_of \\<tau> \\<close> using wfS_varI by simp\n    show \\<open>atom u \\<sharp> (\\<Phi>', \\<Theta>, \\<B>, \\<Gamma>, \\<Delta>, \\<tau>, v, b)\\<close> using wfS_varI by simp\n    show \\<open> \\<Theta> ; \\<Phi>' ; \\<B> ; \\<Gamma> ; (u, \\<tau>)  #\\<^sub>\\<Delta> \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_varI by simp\n  qed\nnext\n  case (wfS_assignI u \\<tau> \\<Delta> \\<Theta> \\<B> \\<Gamma> \\<Phi> v)\n  then show ?case  using wf_intros by metis\nnext\n  case (wfS_whileI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 s2 b)\n  then show ?case  using wf_intros by metis\nnext\n  case (wfS_seqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 s2 b)\n  then show ?case  using wf_intros by metis\nnext\n  case (wfS_matchI \\<Theta> \\<B> \\<Gamma> v tid dclist \\<Delta> \\<Phi> cs b)\n  then show ?case  using wf_intros by metis\nnext\n  case (wfS_branchI \\<Theta> \\<Phi> \\<B> x \\<tau> \\<Gamma> \\<Delta> s b tid dc)\n  then show ?case using Wellformed.wfS_branchI by fastforce\nnext\n  case (wfS_assertI \\<Theta> \\<Phi> \\<B> x c \\<Gamma> \\<Delta> s b)\n  show ?case proof\n    show \\<open> \\<Theta> ; \\<Phi>' ; \\<B> ; (x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close>  using wfS_assertI by auto\n  next\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f c \\<close> using wfS_assertI by auto\n  next\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close>  using wfS_assertI by auto\n    have \"atom x \\<sharp> \\<Phi>'\" using wfS_assertI wfPhi_supp fresh_def by blast\n    thus  \\<open>atom x \\<sharp> (\\<Phi>', \\<Theta>, \\<B>, \\<Gamma>, \\<Delta>, c, b, s)\\<close>  using fresh_prodN wfS_assertI wfPhi_supp fresh_def by auto\n  qed\nnext\n  case (wfFTI \\<Theta> B b s x c \\<tau> \\<Phi>)\n  show ?case proof\n    show \\<open> \\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f b \\<close>  using wfFTI by auto\n  next\n    show \\<open>supp c \\<subseteq> {atom x}\\<close> using wfFTI by auto\n  next\n    show \\<open> \\<Theta> ; B ; (x, b, c) #\\<^sub>\\<Gamma> GNil   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<close> using wfFTI by auto\n  next\n    show \\<open> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>' \\<close> using wfFTI by auto\n  next\n    show \\<open>supp s \\<subseteq> {atom x} \\<union> supp B\\<close> using wfFTI by auto\n  qed\nqed(auto|metis wf_intros)+\n\n\nlemma wfT_fun_return_t:\n  fixes \\<tau>a'::\\<tau> and \\<tau>'::\\<tau>\n  assumes \"\\<Theta>; \\<B>; (xa, b, ca)  #\\<^sub>\\<Gamma> GNil  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>a'\" and \"(AF_fun_typ x b c \\<tau>' s') = (AF_fun_typ xa b ca \\<tau>a' sa')\"\n  shows  \"\\<Theta>; \\<B>; (x, b, c)  #\\<^sub>\\<Gamma> GNil  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>'\"\nproof - \n  obtain cb::x where xf: \"atom cb  \\<sharp> (c, \\<tau>', s', sa', \\<tau>a', ca, x , xa)\" using obtain_fresh by blast\n  hence  \"atom cb \\<sharp> (c, \\<tau>', s', sa', \\<tau>a', ca) \\<and>  atom cb \\<sharp> (x, xa, ((c, \\<tau>'), s'), (ca, \\<tau>a'), sa')\" using  fresh_prod6 fresh_prod4 fresh_prod8 by auto\n  hence *:\"c[x::=V_var cb]\\<^sub>c\\<^sub>v = ca[xa::=V_var cb]\\<^sub>c\\<^sub>v \\<and> \\<tau>'[x::=V_var cb]\\<^sub>\\<tau>\\<^sub>v = \\<tau>a'[xa::=V_var cb]\\<^sub>\\<tau>\\<^sub>v\" using assms \\<tau>.eq_iff Abs1_eq_iff_all by auto\n\n  have **: \"\\<Theta>; \\<B>; (xa \\<leftrightarrow> cb ) \\<bullet> ((xa, b, ca)  #\\<^sub>\\<Gamma> GNil)  \\<turnstile>\\<^sub>w\\<^sub>f (xa \\<leftrightarrow> cb ) \\<bullet> \\<tau>a'\" using assms True_eqvt beta_flip_eq theta_flip_eq wfG_wf \n    by (metis GCons_eqvt GNil_eqvt wfT.eqvt wfT_wf)\n\n  have \"\\<Theta>; \\<B>; (x \\<leftrightarrow> cb ) \\<bullet> ((x, b, c)  #\\<^sub>\\<Gamma> GNil)  \\<turnstile>\\<^sub>w\\<^sub>f (x \\<leftrightarrow> cb ) \\<bullet> \\<tau>'\" proof -\n    have \"(xa \\<leftrightarrow> cb ) \\<bullet> xa = (x \\<leftrightarrow> cb ) \\<bullet> x\"  using xf by auto\n    hence \"(x \\<leftrightarrow> cb ) \\<bullet> ((x, b, c)  #\\<^sub>\\<Gamma> GNil) = (xa \\<leftrightarrow> cb ) \\<bullet> ((xa, b, ca)  #\\<^sub>\\<Gamma> GNil)\"  using * ** xf G_cons_flip fresh_GNil by simp\n    thus ?thesis using ** * xf by simp\n  qed\n  thus ?thesis  using  beta_flip_eq theta_flip_eq  wfT_wf wfG_wf  * ** True_eqvt wfT.eqvt permute_flip_cancel by metis\nqed\n\nlemma wfFT_wf_aux:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q and s::s and \\<Delta>::\\<Delta>\n  assumes \"\\<Theta> ; \\<Phi>  ; B \\<turnstile>\\<^sub>w\\<^sub>f (AF_fun_typ x b c \\<tau> s)\" \n  shows \"\\<Theta> ; B ; (x,b,c) #\\<^sub>\\<Gamma> GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<and> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f  \\<Phi> \\<and> supp s \\<subseteq> { atom x } \\<union> supp B\"\nproof -\n  obtain xa and ca and sa and \\<tau>' where *:\"\\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f b  \\<and>  (\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>  )  \\<and>\n    supp sa \\<subseteq> {atom xa} \\<union> supp B \\<and>  (\\<Theta> ; B ; (xa, b, ca)  #\\<^sub>\\<Gamma> GNil   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>')  \\<and>  \n  AF_fun_typ x b c \\<tau> s = AF_fun_typ xa b ca \\<tau>' sa \" \n    using wfFT.simps[of \\<Theta> \\<Phi> B \"AF_fun_typ x b c \\<tau> s\"] assms by auto\n \n  moreover hence **: \"(AF_fun_typ x b c \\<tau> s) = (AF_fun_typ xa b ca \\<tau>' sa)\" by simp\n  ultimately have \"\\<Theta> ; B ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"  using wfT_fun_return_t by metis\n  moreover have \" (\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>  ) \"  using * by auto\n  moreover have \"supp s \\<subseteq> { atom x } \\<union> supp B\" proof -\n    have \"[[atom x]]lst.s = [[atom xa]]lst.sa\" using ** fun_typ.eq_iff lst_fst lst_snd by metis\n    thus ?thesis using lst_supp_subset * by metis\n  qed\n  ultimately show ?thesis by auto\nqed\n\nlemma wfFT_simple_wf:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q and s::s and \\<Delta>::\\<Delta>\n  assumes \"\\<Theta> ; \\<Phi>  \\<turnstile>\\<^sub>w\\<^sub>f (AF_fun_typ_none (AF_fun_typ x b c \\<tau> s))\" \n  shows \"\\<Theta> ; {||} ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<and> \\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<and> supp s \\<subseteq> { atom x } \"\nproof -\n  have  *:\"\\<Theta> ; \\<Phi>  ; {||} \\<turnstile>\\<^sub>w\\<^sub>f (AF_fun_typ x b c \\<tau> s)\" using wfFTQ_elims assms by auto\n  thus ?thesis using wfFT_wf_aux by force\nqed\n\nlemma wfFT_poly_wf:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ftq :: fun_typ_q and s::s and \\<Delta>::\\<Delta>\n  assumes \"\\<Theta> ; \\<Phi>  \\<turnstile>\\<^sub>w\\<^sub>f (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))\" \n  shows \"\\<Theta> ; {|bv|} ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<and> \\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<and> \\<Theta> ; \\<Phi>  ; {|bv|}  \\<turnstile>\\<^sub>w\\<^sub>f (AF_fun_typ x b c \\<tau> s)\"\nproof -\n  obtain bv1 ft1 where  *:\"\\<Theta> ; \\<Phi>  ; {|bv1|} \\<turnstile>\\<^sub>w\\<^sub>f ft1 \\<and> [[atom bv1]]lst. ft1 = [[atom bv]]lst. AF_fun_typ x b c \\<tau> s\" \n    using wfFTQ_elims(3)[OF assms]  by metis\n\n  show ?thesis proof(cases \"bv1 = bv\")\n    case True\n    then show ?thesis using *  fun_typ_q.eq_iff  Abs1_eq_iff   by (metis (no_types, opaque_lifting) wfFT_wf_aux)\n  next\n    case False\n    obtain x1 b1 c1 t1 s1 where **: \"ft1 = AF_fun_typ x1 b1 c1 t1 s1\" using fun_typ.eq_iff \n      by (meson fun_typ.exhaust)\n\n    hence eqv: \"(bv \\<leftrightarrow> bv1) \\<bullet>  AF_fun_typ x1 b1 c1 t1 s1 = AF_fun_typ x b c \\<tau> s \\<and> atom bv1 \\<sharp> AF_fun_typ x b c \\<tau> s\" using \n         Abs1_eq_iff(3) * False by metis\n\n    have \"(bv \\<leftrightarrow> bv1) \\<bullet> \\<Theta> ; (bv \\<leftrightarrow> bv1) \\<bullet> \\<Phi> ; (bv \\<leftrightarrow> bv1) \\<bullet> {|bv1|} \\<turnstile>\\<^sub>w\\<^sub>f (bv \\<leftrightarrow> bv1) \\<bullet> ft1\" using wfFT.eqvt * by metis   \n    moreover have \"(bv \\<leftrightarrow> bv1) \\<bullet> \\<Phi> = \\<Phi>\" using phi_flip_eq wfX_wfY * by metis\n    moreover have \"(bv \\<leftrightarrow> bv1) \\<bullet> \\<Theta> =\\<Theta>\" using wfX_wfY *  theta_flip_eq2 by metis\n    moreover have \"(bv \\<leftrightarrow> bv1) \\<bullet> ft1 = AF_fun_typ x b c \\<tau> s\" using eqv ** by metis\n    ultimately have  \"\\<Theta> ; \\<Phi>  ; {|bv|} \\<turnstile>\\<^sub>w\\<^sub>f AF_fun_typ x b c \\<tau> s\"  by auto\n    thus ?thesis using wfFT_wf_aux by auto\n  qed\nqed\n\nlemma wfFT_poly_wfT:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"\\<Theta> ; \\<Phi>  \\<turnstile>\\<^sub>w\\<^sub>f (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))\"\n  shows \"\\<Theta> ; {| bv |} ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"\n  using wfFT_poly_wf assms by simp\n\nlemma b_of_supp:\n  \"supp (b_of t) \\<subseteq> supp t\"\nproof(nominal_induct t rule:\\<tau>.strong_induct)\n  case (T_refined_type x b c)\n  then show ?case by auto\nqed\n\nlemma wfPhi_f_simple_wf:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q and s::s and \\<Phi>'::\\<Phi>\n   assumes \"AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \\<tau> s)) \\<in> set \\<Phi> \" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\" and \"set \\<Phi> \\<subseteq> set \\<Phi>'\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>'\"\n  shows \"\\<Theta> ; {||} ; (x,b,c) #\\<^sub>\\<Gamma> GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<and> \\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<and> supp s \\<subseteq> { atom x }\"\nusing assms proof(induct \\<Phi> rule: \\<Phi>_induct)\n  case PNil\n  then show ?case by auto\nnext\n  case (PConsSome f1 bv x1 b1 c1 \\<tau>1 s' \\<Phi>'')\n  hence \"AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \\<tau> s)) \\<in> set \\<Phi>''\" by auto\n  moreover have \" \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>'' \\<and> set \\<Phi>'' \\<subseteq> set \\<Phi>'\" using wfPhi_elims(3) PConsSome by auto\n  ultimately show  ?case using PConsSome wfPhi_elims wfFT_simple_wf by auto\nnext\n  case (PConsNone f' x' b' c' \\<tau>' s' \\<Phi>'')\n  show ?case proof(cases \"f=f'\")\n    case True\n    have \"AF_fun_typ_none (AF_fun_typ x' b' c' \\<tau>' s') = AF_fun_typ_none (AF_fun_typ x b c \\<tau> s)\" \n      by (metis PConsNone.prems(1) PConsNone.prems(2) True fun_def.eq_iff image_eqI name_of_fun.simps set_ConsD wfPhi_elims(2))\n    hence *:\"\\<Theta> ; \\<Phi>'' \\<turnstile>\\<^sub>w\\<^sub>f AF_fun_typ_none (AF_fun_typ x b c \\<tau> s) \" using wfPhi_elims(2)[OF PConsNone(3)] by metis\n    hence \"\\<Theta> ; \\<Phi>'' ; {||} \\<turnstile>\\<^sub>w\\<^sub>f (AF_fun_typ x b c \\<tau> s)\" using wfFTQ_elims(1) by metis\n    thus ?thesis using wfFT_simple_wf[OF *] wb_phi_weakening PConsNone by force\n  next\n    case False\n    hence \"AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \\<tau> s)) \\<in> set \\<Phi>''\" using PConsNone by simp\n    moreover have \" \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>'' \\<and> set \\<Phi>'' \\<subseteq> set \\<Phi>'\" using wfPhi_elims(3) PConsNone by auto\n    ultimately show  ?thesis using PConsNone wfPhi_elims wfFT_simple_wf by auto\n  qed\nqed\n\nlemma wfPhi_f_simple_wfT:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"\\<Theta> ; {||} ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"\n  using wfPhi_f_simple_wf assms  using lookup_fun_member by blast\n\nlemma  wfPhi_f_simple_supp_b:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"supp b = {}\"\nproof -\n  have \"\\<Theta> ; {||} ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\" using wfPhi_f_simple_wfT assms by auto\n  thus ?thesis using wfT_wf wfG_cons wfB_supp by fastforce\nqed\n\nlemma wfPhi_f_simple_supp_t:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"supp \\<tau> \\<subseteq> { atom x }\"\n  using wfPhi_f_simple_wfT wfT_supp assms by fastforce\n\nlemma  wfPhi_f_simple_supp_c:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"supp c \\<subseteq> { atom x }\"\nproof -\n  have \"\\<Theta> ; {||} ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\" using wfPhi_f_simple_wfT assms by auto\n  thus ?thesis using wfG_wfC wfC_supp wfT_wf by fastforce\nqed\n\nlemma  wfPhi_f_simple_supp_s:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"supp s \\<subseteq> {atom x}\"\nproof -\n  have \"AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \\<tau> s)) \\<in> set \\<Phi>\" using lookup_fun_member assms by auto\n  hence \"supp s \\<subseteq> { atom x }\" using wfPhi_f_simple_wf assms by blast\n  thus ?thesis using wf_supp(3)  atom_dom.simps toSet.simps  x_not_in_u_set x_not_in_b_set setD.simps \n    using wf_supp2(2) by fastforce\nqed\n\nlemma wfPhi_f_poly_wf:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q and s::s and \\<Phi>'::\\<Phi>\n   assumes \"AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s)) \\<in> set \\<Phi> \" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\" and \"set \\<Phi> \\<subseteq> set \\<Phi>'\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>'\"\n  shows \"\\<Theta> ; {|bv|} ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<and> \\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>' \\<and> \\<Theta> ; \\<Phi>' ;  {|bv|} \\<turnstile>\\<^sub>w\\<^sub>f  (AF_fun_typ x b c \\<tau> s)\"\nusing assms proof(induct \\<Phi> rule: \\<Phi>_induct)\n  case PNil\n  then show ?case by auto\nnext\n  case (PConsNone f x b c \\<tau> s' \\<Phi>'')\n  moreover have \" \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>'' \\<and> set \\<Phi>'' \\<subseteq> set \\<Phi>'\" using wfPhi_elims(3) PConsNone by auto\n  ultimately show  ?case using PConsNone wfPhi_elims wfFT_poly_wf by auto\nnext\n  case (PConsSome f1 bv1 x1 b1 c1 \\<tau>1 s1 \\<Phi>'')\n  show ?case proof(cases \"f=f1\")\n  case True\n    have \"AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1 s1) = AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s)\"       \n      by (metis PConsSome.prems(1) PConsSome.prems(2) True fun_def.eq_iff list.set_intros(1) option.inject wfPhi_lookup_fun_unique)\n    hence *:\"\\<Theta> ; \\<Phi>''  \\<turnstile>\\<^sub>w\\<^sub>f AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s) \" using wfPhi_elims PConsSome by metis  \n    thus ?thesis using wfFT_poly_wf * wb_phi_weakening PConsSome \n      by (meson set_subset_Cons)\n  next\n    case False\n    hence \"AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s)) \\<in> set \\<Phi>''\" using PConsSome \n      by (meson fun_def.eq_iff set_ConsD)\n    moreover have \" \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>'' \\<and> set \\<Phi>'' \\<subseteq> set \\<Phi>'\" using wfPhi_elims(3) PConsSome \n      by (meson dual_order.trans set_subset_Cons)\n    ultimately show  ?thesis using PConsSome wfPhi_elims wfFT_poly_wf \n      by blast\n  qed\nqed\n\nlemma wfPhi_f_poly_wfT:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"\\<Theta> ; {| bv |} ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"\nusing assms proof(induct \\<Phi> rule: \\<Phi>_induct)\n  case PNil\n  then show ?case by auto\nnext\n  case (PConsSome f1 bv1 x1 b1 c1 \\<tau>1 s' \\<Phi>')\n  then show ?case proof(cases \"f1=f\")\n    case True\n    hence \"lookup_fun (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1 s'))  # \\<Phi>') f = Some (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1 s')))\" using \n       lookup_fun.simps  using PConsSome.prems by simp\n    then show ?thesis using PConsSome.prems wfPhi_elims wfFT_poly_wfT\n      by (metis option.inject)\n  next\n    case False\n    then show ?thesis using PConsSome using lookup_fun.simps \n      using wfPhi_elims(3) by auto\n  qed\nnext\n  case (PConsNone f' x' b' c' \\<tau>' s' \\<Phi>')\n  then show ?case proof(cases \"f'=f\")\n    case True\n    then have *:\"\\<Theta> ; \\<Phi>' \\<turnstile>\\<^sub>w\\<^sub>f AF_fun_typ_none (AF_fun_typ x' b' c' \\<tau>' s') \" using lookup_fun.simps PConsNone wfPhi_elims by metis\n    thus ?thesis using PConsNone wfFT_poly_wfT wfPhi_elims lookup_fun.simps \n      by (metis fun_def.eq_iff fun_typ_q.distinct(1) option.inject)\n  next\n    case False  \n    thus ?thesis using PConsNone wfPhi_elims \n      by (metis False lookup_fun.simps(2))\n  qed\nqed\n\nlemma  wfPhi_f_poly_supp_b:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"supp b \\<subseteq> supp bv\"\nproof -\n  have \"\\<Theta> ; {|bv|} ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\" using wfPhi_f_poly_wfT assms by auto\n  thus ?thesis using wfT_wf wfG_cons wfB_supp by fastforce\nqed\n\nlemma wfPhi_f_poly_supp_t:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"supp \\<tau> \\<subseteq> { atom x , atom bv }\"\n using wfPhi_f_poly_wfT[OF assms, THEN wfT_supp]  atom_dom.simps  supp_at_base by auto\n\n\nlemma wfPhi_f_poly_supp_b_of_t:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"supp (b_of \\<tau>) \\<subseteq> { atom bv }\"\nproof - \n  have \"atom x \\<notin> supp (b_of \\<tau>)\" using x_fresh_b  by auto\n  moreover have \"supp (b_of \\<tau>) \\<subseteq> { atom x , atom bv }\" using wfPhi_f_poly_supp_t  \n    using   supp_at_base b_of.simps wfPhi_f_poly_supp_t \\<tau>.supp b_of_supp assms by fast\n  ultimately show ?thesis by blast\nqed\n\nlemma wfPhi_f_poly_supp_c:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"supp c \\<subseteq> { atom x, atom bv }\"\nproof - \n  have \"\\<Theta> ; {|bv|} ; (x,b,c) #\\<^sub>\\<Gamma>GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\" using wfPhi_f_poly_wfT assms by auto\n  thus ?thesis using wfG_wfC wfC_supp wfT_wf \n    using supp_at_base by fastforce\nqed\n\nlemma  wfPhi_f_poly_supp_s:\n  fixes \\<tau>::\\<tau> and \\<Theta>::\\<Theta> and \\<Phi>::\\<Phi> and ft :: fun_typ_q\n  assumes \"Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\" and \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\"\n  shows \"supp s \\<subseteq> {atom x, atom bv}\"\nproof -\n\n  have \"AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s)) \\<in> set \\<Phi>\" using lookup_fun_member assms by auto\n  hence *:\"\\<Theta> ; \\<Phi>  ; {|bv|} \\<turnstile>\\<^sub>w\\<^sub>f (AF_fun_typ x b c \\<tau> s)\" using assms wfPhi_f_poly_wf by simp\n  \n  thus ?thesis using wfFT_wf_aux[OF *]  using supp_at_base by auto\nqed\n\nlemmas wfPhi_f_supp = wfPhi_f_poly_supp_b wfPhi_f_simple_supp_b wfPhi_f_poly_supp_c \n    wfPhi_f_simple_supp_t wfPhi_f_poly_supp_t wfPhi_f_simple_supp_t wfPhi_f_poly_wfT wfPhi_f_simple_wfT \n    wfPhi_f_poly_supp_s wfPhi_f_simple_supp_s\n\nlemma fun_typ_eq_ret_unique: \n  assumes \"(AF_fun_typ x1 b1 c1 \\<tau>1' s1') =  (AF_fun_typ x2 b2 c2 \\<tau>2' s2')\"\n  shows  \"\\<tau>1'[x1::=v]\\<^sub>\\<tau>\\<^sub>v = \\<tau>2'[x2::=v]\\<^sub>\\<tau>\\<^sub>v\"\nproof -\n  have \"[[atom x1]]lst. \\<tau>1' = [[atom x2]]lst. \\<tau>2'\" using assms lst_fst fun_typ.eq_iff lst_snd by metis\n  thus ?thesis using subst_v_flip_eq_two[of x1 \\<tau>1' x2 \\<tau>2' v] subst_v_\\<tau>_def by metis\nqed\n\nlemma fun_typ_eq_body_unique: \n  fixes v::v and x1::x and x2::x and s1'::s and s2'::s\n  assumes \"(AF_fun_typ x1 b1 c1 \\<tau>1' s1') =  (AF_fun_typ x2 b2 c2 \\<tau>2' s2')\"\n  shows  \"s1'[x1::=v]\\<^sub>s\\<^sub>v = s2'[x2::=v]\\<^sub>s\\<^sub>v\"\nproof -\n  have \"[[atom x1]]lst. s1' = [[atom x2]]lst. s2'\" using assms lst_fst fun_typ.eq_iff lst_snd by metis\n  thus ?thesis using subst_v_flip_eq_two[of x1 s1' x2 s2' v] subst_v_s_def by metis\nqed\n\nlemma fun_ret_unique:\n  assumes \"Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x1 b1 c1 \\<tau>1' s1'))) = lookup_fun \\<Phi> f\" and \"Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x2 b2 c2 \\<tau>2' s2'))) = lookup_fun \\<Phi> f\"\n  shows \"\\<tau>1'[x1::=v]\\<^sub>\\<tau>\\<^sub>v = \\<tau>2'[x2::=v]\\<^sub>\\<tau>\\<^sub>v\"\nproof -\n  have *: \" (AF_fundef f (AF_fun_typ_none (AF_fun_typ x1 b1 c1 \\<tau>1' s1'))) = (AF_fundef f (AF_fun_typ_none (AF_fun_typ x2 b2 c2 \\<tau>2' s2')))\" using option.inject assms by metis\n  thus ?thesis using fun_typ_eq_ret_unique fun_def.eq_iff fun_typ_q.eq_iff by metis\nqed\n\nlemma fun_poly_arg_unique:\n  fixes bv1::bv and bv2::bv and b::b and \\<tau>1::\\<tau> and \\<tau>2::\\<tau>\n  assumes \"[[atom bv1]]lst. (AF_fun_typ x1 b1 c1 \\<tau>1 s1) = [[atom bv2]]lst. (AF_fun_typ x2 b2 c2 \\<tau>2 s2)\" (is \"[[atom ?x]]lst. ?a = [[atom ?y]]lst. ?b\")\n  shows \"\\<lbrace> x1 : b1[bv1::=b]\\<^sub>b\\<^sub>b | c1[bv1::=b]\\<^sub>c\\<^sub>b \\<rbrace> = \\<lbrace> x2 : b2[bv2::=b]\\<^sub>b\\<^sub>b | c2[bv2::=b]\\<^sub>c\\<^sub>b \\<rbrace>\" \nproof -\n  obtain c::bv where *:\"atom c \\<sharp> (b,b1,b2,c1,c2) \\<and> atom c \\<sharp> (bv1, bv2, AF_fun_typ x1 b1 c1 \\<tau>1 s1, AF_fun_typ x2 b2 c2 \\<tau>2 s2)\" using obtain_fresh fresh_Pair by metis\n  hence \"(bv1 \\<leftrightarrow> c) \\<bullet> AF_fun_typ x1 b1 c1 \\<tau>1 s1 = (bv2 \\<leftrightarrow> c) \\<bullet> AF_fun_typ x2 b2 c2 \\<tau>2 s2\" using  Abs1_eq_iff_all(3)[of ?x ?a ?y ?b] assms by metis\n  hence \"AF_fun_typ x1 ((bv1 \\<leftrightarrow> c) \\<bullet> b1) ((bv1 \\<leftrightarrow> c) \\<bullet> c1) ((bv1 \\<leftrightarrow> c) \\<bullet> \\<tau>1) ((bv1 \\<leftrightarrow> c) \\<bullet> s1) = AF_fun_typ x2 ((bv2 \\<leftrightarrow> c) \\<bullet> b2) ((bv2 \\<leftrightarrow> c) \\<bullet> c2) ((bv2 \\<leftrightarrow> c) \\<bullet> \\<tau>2) ((bv2 \\<leftrightarrow> c) \\<bullet> s2)\" \n    using fun_typ_flip by metis    \n  hence **:\"\\<lbrace> x1 :((bv1 \\<leftrightarrow> c) \\<bullet> b1) | ((bv1 \\<leftrightarrow> c) \\<bullet> c1) \\<rbrace> = \\<lbrace> x2 : ((bv2 \\<leftrightarrow> c) \\<bullet> b2) | ((bv2 \\<leftrightarrow> c) \\<bullet> c2) \\<rbrace>\" (is \"\\<lbrace> x1 : ?b1 | ?c1 \\<rbrace> = \\<lbrace> x2 : ?b2 | ?c2 \\<rbrace>\") using fun_arg_unique_aux by metis\n  hence \"\\<lbrace> x1 :((bv1 \\<leftrightarrow> c) \\<bullet> b1) | ((bv1 \\<leftrightarrow> c) \\<bullet> c1) \\<rbrace>[c::=b]\\<^sub>\\<tau>\\<^sub>b = \\<lbrace> x2 : ((bv2 \\<leftrightarrow> c) \\<bullet> b2) | ((bv2 \\<leftrightarrow> c) \\<bullet> c2) \\<rbrace>[c::=b]\\<^sub>\\<tau>\\<^sub>b\" by metis\n  hence \"\\<lbrace> x1 :((bv1 \\<leftrightarrow> c) \\<bullet> b1)[c::=b]\\<^sub>b\\<^sub>b | ((bv1 \\<leftrightarrow> c) \\<bullet> c1)[c::=b]\\<^sub>c\\<^sub>b \\<rbrace> = \\<lbrace> x2 : ((bv2 \\<leftrightarrow> c) \\<bullet> b2)[c::=b]\\<^sub>b\\<^sub>b | ((bv2 \\<leftrightarrow> c) \\<bullet> c2)[c::=b]\\<^sub>c\\<^sub>b \\<rbrace>\" using subst_tb.simps by metis  \n  thus ?thesis using *  flip_subst_subst subst_b_c_def subst_b_b_def fresh_prodN flip_commute by metis\nqed\n\nlemma fun_poly_ret_unique:\n  assumes \"Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1' s1'))) = lookup_fun \\<Phi> f\" and \"Some (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \\<tau>2' s2'))) = lookup_fun \\<Phi> f\"\n  shows \"\\<tau>1'[bv1::=b]\\<^sub>\\<tau>\\<^sub>b[x1::=v]\\<^sub>\\<tau>\\<^sub>v = \\<tau>2'[bv2::=b]\\<^sub>\\<tau>\\<^sub>b[x2::=v]\\<^sub>\\<tau>\\<^sub>v\"\nproof -\n  have *: \" (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1' s1'))) = (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \\<tau>2' s2')))\" using option.inject assms by metis\n  hence \"AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1' s1') = AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \\<tau>2' s2')\" \n      (is \"AF_fun_typ_some bv1 ?ft1 = AF_fun_typ_some bv2 ?ft2\") using fun_def.eq_iff by metis\n  hence **:\"[[atom bv1]]lst. ?ft1 = [[atom bv2]]lst. ?ft2\" using fun_typ_q.eq_iff(1) by metis\n\n  hence *:\"subst_ft_b ?ft1 bv1 b = subst_ft_b ?ft2 bv2 b\" using subst_b_flip_eq_two subst_b_fun_typ_def by metis\n  have \"[[atom x1]]lst. \\<tau>1'[bv1::=b]\\<^sub>\\<tau>\\<^sub>b = [[atom x2]]lst. \\<tau>2'[bv2::=b]\\<^sub>\\<tau>\\<^sub>b\" \n    apply(rule lst_snd[of _ \"c1[bv1::=b]\\<^sub>c\\<^sub>b\" _ _ \"c2[bv2::=b]\\<^sub>c\\<^sub>b\"])\n    apply(rule lst_fst[of _ _ \"s1'[bv1::=b]\\<^sub>s\\<^sub>b\" _ _ \"s2'[bv2::=b]\\<^sub>s\\<^sub>b\"])\n    using *  subst_ft_b.simps fun_typ.eq_iff by metis\n  thus ?thesis using subst_v_flip_eq_two subst_v_\\<tau>_def by metis\nqed\n\nlemma fun_poly_body_unique:\n  assumes \"Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1' s1'))) = lookup_fun \\<Phi> f\" and \"Some (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \\<tau>2' s2'))) = lookup_fun \\<Phi> f\"\n  shows \"s1'[bv1::=b]\\<^sub>s\\<^sub>b[x1::=v]\\<^sub>s\\<^sub>v = s2'[bv2::=b]\\<^sub>s\\<^sub>b[x2::=v]\\<^sub>s\\<^sub>v\"\nproof - \n  have *: \" (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1' s1'))) = (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \\<tau>2' s2')))\" \n    using option.inject assms by metis\n  hence \"AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1' s1') = AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \\<tau>2' s2')\" \n      (is \"AF_fun_typ_some bv1 ?ft1 = AF_fun_typ_some bv2 ?ft2\") using fun_def.eq_iff by metis\n  hence **:\"[[atom bv1]]lst. ?ft1 = [[atom bv2]]lst. ?ft2\" using fun_typ_q.eq_iff(1) by metis\n\n  hence *:\"subst_ft_b ?ft1 bv1 b = subst_ft_b ?ft2 bv2 b\" using subst_b_flip_eq_two subst_b_fun_typ_def by metis\n  have \"[[atom x1]]lst. s1'[bv1::=b]\\<^sub>s\\<^sub>b = [[atom x2]]lst. s2'[bv2::=b]\\<^sub>s\\<^sub>b\" \n    using lst_snd lst_fst subst_ft_b.simps fun_typ.eq_iff \n    by (metis \"local.*\")\n\n  thus ?thesis using subst_v_flip_eq_two subst_v_s_def by metis\nqed\n\nlemma funtyp_eq_iff_equalities:\n  fixes s'::s and s::s\n  assumes \" [[atom x']]lst. ((c', \\<tau>'), s') = [[atom x]]lst. ((c, \\<tau>), s)\" \n  shows \"\\<lbrace> x' : b  | c' \\<rbrace> = \\<lbrace> x : b  | c \\<rbrace> \\<and>  s'[x'::=v]\\<^sub>s\\<^sub>v = s[x::=v]\\<^sub>s\\<^sub>v \\<and> \\<tau>'[x'::=v]\\<^sub>\\<tau>\\<^sub>v = \\<tau>[x::=v]\\<^sub>\\<tau>\\<^sub>v\"\nproof - \n  have  \"[[atom x']]lst. s' = [[atom x]]lst. s\" and \"[[atom x']]lst. \\<tau>' = [[atom x]]lst. \\<tau>\" and\n           \" [[atom x']]lst. c' = [[atom x]]lst. c\" using lst_snd lst_fst assms by metis+\n  thus ?thesis using   subst_v_flip_eq_two  \\<tau>.eq_iff \n    by (metis assms fun_typ.eq_iff fun_typ_eq_body_unique fun_typ_eq_ret_unique)\nqed\n\nsection \\<open>Weakening\\<close>\n\nlemma wfX_wfB1:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and b::b and \\<B>::\\<B> and \\<Phi>::\\<Phi> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n           and cs::branch_s and css::branch_list\n  shows  wfV_wfB: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b\" and     \n         \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma> \\<Longrightarrow>   True\" and\n         wfT_wfB: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<Longrightarrow>  \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b_of \\<tau> \" and\n         \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ts \\<Longrightarrow>  True\" and \n         \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<Longrightarrow> True\" and     \n         \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b \\<Longrightarrow>  True\" and       \n         wfCE_wfB: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b \\<Longrightarrow> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b\" and\n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow> True\"\nproof(induct   rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)\n case (wfV_varI \\<Theta> \\<B> \\<Gamma> b c x)\n  hence \"(x,b,c) \\<in> toSet \\<Gamma>\" using lookup_iff wfV_wf  using lookup_in_g by presburger\n  hence \"b \\<in> fst`snd`toSet \\<Gamma>\" by force\n  hence \"wfB \\<Theta> \\<B> b\" using wfG_wfB wfV_varI by metis\n  then show ?case using wfV_elims wfG_wf  wf_intros by metis\nnext\n  case (wfV_litI \\<Theta> \\<Gamma> l)\n  moreover have \"wfTh \\<Theta>\" using wfV_wf wfG_wf wfV_litI by metis\n  ultimately  show ?case using wfV_wf wfG_wf  wf_intros base_for_lit.simps l.exhaust by metis\nnext\n  case (wfV_pairI \\<Theta> \\<Gamma> v1 b1 v2 b2)\n   then show ?case using  wfG_wf  wf_intros by metis\nnext\n  case (wfV_consI s dclist \\<Theta> dc x b c B \\<Gamma> v)\n  then show ?case\n    using wfV_wf wfG_wf   wfB_consI by metis  \nnext\n  case (wfV_conspI s bv dclist \\<Theta> dc x b' c \\<B> b \\<Gamma> v)\n  then show ?case\n    using wfV_wf wfG_wf  using wfB_appI by metis\nnext\n  case (wfCE_valI \\<Theta> \\<B> \\<Gamma> v b)\n  then show ?case using wfB_elims by auto\nnext\n  case (wfCE_plusI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  then show ?case using wfB_elims by auto\nnext\n  case (wfCE_leqI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  then show ?case using  wfV_wf wfG_wf  wf_intros wfX_wfY by metis\nnext\n  case (wfCE_eqI \\<Theta> \\<B> \\<Gamma> v1 b v2)\n  then show ?case using  wfV_wf wfG_wf  wf_intros wfX_wfY by metis\nnext\n  case (wfCE_fstI \\<Theta> \\<B> \\<Gamma> v1 b1 b2)\n  then show ?case using  wfB_elims by metis\nnext\n  case (wfCE_sndI \\<Theta> \\<B> \\<Gamma> v1 b1 b2)\n  then show ?case using wfB_elims by metis\nnext\n  case (wfCE_concatI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  then show ?case using wfB_elims by auto\nnext\n  case (wfCE_lenI \\<Theta> \\<B> \\<Gamma> v1)\n  then show ?case using  wfV_wf wfG_wf  wf_intros wfX_wfY by metis\nqed(auto | metis wfV_wf wfG_wf  wf_intros )+\n\nlemma wfX_wfB2:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and b::b and \\<B>::\\<B> and \\<Phi>::\\<Phi> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n           and cs::branch_s and css::branch_list\n  shows\n         wfE_wfB: \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b \\<Longrightarrow> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b\"  and\n         wfS_wfB: \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<Longrightarrow> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b\" and\n         wfCS_wfB: \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow>  \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b\" and\n         wfCSS_wfB: \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow>  \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b\" and     \n         \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<Longrightarrow>  True\" and   \n         \"\\<Theta> ; \\<Phi>   \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> True\" and\n         \"\\<Theta> ; \\<Phi>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow> \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow> \\<Theta> ; \\<Phi>  ; \\<B>' \\<turnstile>\\<^sub>w\\<^sub>f ft\" \nproof(induct   rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts) \n  case (wfE_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v b)\n  then show ?case using wfB_elims wfX_wfB1 by metis\nnext\n  case (wfE_plusI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wfB_elims wfX_wfB1 by metis\nnext\n  case (wfE_eqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b v2)\n  then show ?case using wfB_boolI  wfX_wfY by metis\nnext\n  case (wfE_fstI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using wfB_elims wfX_wfB1 by metis\nnext\n  case (wfE_sndI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using wfB_elims wfX_wfB1 by metis\nnext\n  case (wfE_concatI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wfB_elims wfX_wfB1 by metis\nnext\n  case (wfE_splitI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wfB_elims wfX_wfB1 \n    using wfB_pairI by auto\nnext\n  case (wfE_lenI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1)\n  then show ?case using wfB_elims wfX_wfB1 \n    using wfB_intI wfX_wfY1(1) by auto\nnext\n  case (wfE_appI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> f x b c \\<tau> s v)\n  hence \"\\<Theta>; \\<B>;(x,b,c) #\\<^sub>\\<Gamma> GNil  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"  using wfPhi_f_simple_wfT wfT_b_weakening by fast\n  then show ?case using b_of.simps using wfT_b_weakening\n     by (metis b_of.cases bot.extremum wfT_elims(2))\nnext\n  case (wfE_appPI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> b' bv v \\<tau> f x b c s)\n  hence \"\\<Theta> ; {| bv |} ;(x,b,c) #\\<^sub>\\<Gamma> GNil  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"  using wfPhi_f_poly_wfT wfX_wfY by blast\n  then show ?case using wfE_appPI b_of.simps using wfT_b_weakening wfT_elims  wfT_subst_wfB subst_b_b_def  by metis\nnext\n  case (wfE_mvarI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> u \\<tau>)\n  hence \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\" using wfD_wfT by fast\n  then show ?case using wfT_elims b_of.simps by metis\nnext\n  case (wfFTNone \\<Theta> ft)\n  then show ?case by auto\nnext\n  case (wfFTSome \\<Theta> bv ft)\n  then show ?case by auto\nnext\n  case (wfS_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> v b \\<Delta>)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfS_letI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> e b' x s b)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfS_let2I \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 \\<tau> x s2 b)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfS_ifI \\<Theta> \\<B> \\<Gamma> v \\<Phi> \\<Delta> s1 b s2)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfS_varI \\<Theta> \\<B> \\<Gamma> \\<tau> v u \\<Phi> \\<Delta> b s)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfS_assignI u \\<tau> \\<Delta> \\<Theta> \\<B> \\<Gamma> \\<Phi> v)\n  then show ?case using wfX_wfB1 \n    using wfB_unitI wfX_wfY2(5) by auto\nnext\n  case (wfS_whileI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 s2 b)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfS_seqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 s2 b)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfS_matchI \\<Theta> \\<B> \\<Gamma> v tid dclist \\<Delta> \\<Phi> cs b)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfS_branchI \\<Theta> \\<Phi> \\<B> x \\<tau> \\<Gamma> \\<Delta> s b tid dc)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfS_finalI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> tid dc t cs b)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfS_cons \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> tid dc t cs b dclist css)\n  then show ?case using wfX_wfB1 by auto      \nnext\n  case (wfD_emptyI \\<Theta> \\<B> \\<Gamma>)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfD_cons \\<Theta> \\<B> \\<Gamma> \\<Delta> \\<tau> u)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfPhi_emptyI \\<Theta>)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfPhi_consI f \\<Theta> \\<Phi> ft)\n  then show ?case using wfX_wfB1 by auto\nnext\n  case (wfFTI \\<Theta> B b \\<Phi> x c s \\<tau>)\n  then show ?case using wfX_wfB1 \n    by (meson Wellformed.wfFTI wb_b_weakening2(8))\nqed(metis wfV_wf wfG_wf  wf_intros wfX_wfB1)\n\nlemmas wfX_wfB = wfX_wfB1 wfX_wfB2\n\nlemma wf_weakening1:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and \\<B>::\\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n         and cs::branch_s and css::branch_list\n\n  shows  wfV_weakening: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<Longrightarrow> toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>' \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f v : b\" and\n         wfC_weakening: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<Longrightarrow> toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>'  \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f  c\" and\n         \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>  \\<Longrightarrow>  True\" and\n         wfT_weakening: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<Longrightarrow> toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>' \\<Longrightarrow>  \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f  \\<tau>\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts  \\<Longrightarrow>  True\" and \n         \"\\<turnstile>\\<^sub>w\\<^sub>f P \\<Longrightarrow> True \" and\n         wfB_weakening: \"wfB \\<Theta> \\<B> b \\<Longrightarrow>  \\<B> |\\<subseteq>| \\<B>' \\<Longrightarrow> wfB \\<Theta> \\<B> b\" and \n         wfCE_weakening: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ce : b \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<Longrightarrow> toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>' \\<Longrightarrow> \\<Theta>; \\<B>;  \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f ce : b\"  and\n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow> True\"\nproof(nominal_induct\n          b and c and \\<Gamma> and \\<tau> and ts and P and b and b and td \n          avoiding:  \\<Gamma>'          \n          rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)\n case (wfV_varI \\<Theta> \\<B> \\<Gamma> b c x)\n  hence \"Some (b, c) = lookup \\<Gamma>' x\" using  lookup_weakening  by metis\n  then show ?case using Wellformed.wfV_varI wfV_varI by metis\nnext\n  case (wfTI z \\<Theta> \\<B>  \\<Gamma>  b c)  (* This proof pattern is used elsewhere when proving weakening for typing predicates *)\n  show ?case proof\n    show \\<open>atom z \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>')\\<close> using wfTI by auto\n    show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b \\<close> using wfTI by auto\n    have *:\"toSet ((z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<subseteq> toSet ((z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>')\" using toSet.simps wfTI by auto\n    thus  \\<open> \\<Theta>; \\<B>; (z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>'   \\<turnstile>\\<^sub>w\\<^sub>f c \\<close> using wfTI(8)[OF _ *] wfTI wfX_wfY\n      by (simp add: wfG_cons_TRUE)\n  qed\nnext\n  case (wfV_conspI s bv dclist \\<Theta> dc x b' c \\<B> b \\<Gamma> v)\n  show ?case proof\n    show \\<open>AF_typedef_poly s bv dclist \\<in> set \\<Theta>\\<close> using wfV_conspI by auto\n    show \\<open>(dc, \\<lbrace> x : b'  | c \\<rbrace>) \\<in> set dclist\\<close> using wfV_conspI by auto\n    show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b \\<close> using wfV_conspI by auto\n    show \\<open>atom bv \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>', b, v)\\<close> using wfV_conspI by simp\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f v : b'[bv::=b]\\<^sub>b\\<^sub>b \\<close> using wfV_conspI by auto\n  qed\nqed(metis wf_intros)+\n\nlemma wf_weakening2:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and \\<B>::\\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n         and cs::branch_s and css::branch_list\n  shows \n         wfE_weakening: \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>  ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<Longrightarrow> toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>' \\<Longrightarrow> \\<Theta>; \\<Phi>; \\<B>;  \\<Gamma>' ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b\" and\n         wfS_weakening: \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<Longrightarrow> toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>' \\<Longrightarrow> \\<Theta>; \\<Phi>; \\<B>;  \\<Gamma>' ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b\" and\n         \"\\<Theta> ; \\<Phi> ; \\<B>  ; \\<Gamma> ; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<Longrightarrow> toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>' \\<Longrightarrow>  \\<Theta>; \\<Phi>; \\<B>; \\<Gamma>' ; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b\" and\n         \"\\<Theta> ; \\<Phi> ; \\<B>  ; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<Longrightarrow> toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>' \\<Longrightarrow>  \\<Theta>; \\<Phi>; \\<B>; \\<Gamma>' ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b\" and       \n         \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>) \\<Longrightarrow> True\" and\n         wfD_weakning: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<Longrightarrow> toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>' \\<Longrightarrow>  \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f  \\<Delta>\" and       \n         \"\\<Theta> ; \\<Phi>   \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> True\" and\n         \"\\<Theta> ; \\<Phi>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow>   True\" \nproof(nominal_induct\n          b and b and b and b and \\<Phi> and \\<Delta> and ftq and ft\n          avoiding:  \\<Gamma>'          \n          rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)\n  case (wfE_appPI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> b' bv v \\<tau> f x b c s)\n  show ?case proof\n    show \\<open> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b' \\<close> using wfE_appPI by auto\n    show \\<open>atom bv \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>', \\<Delta>, b', v, (b_of \\<tau>)[bv::=b']\\<^sub>b)\\<close> using wfE_appPI by auto\n    show \\<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f v : b[bv::=b']\\<^sub>b \\<close> using wfE_appPI wf_weakening1 by auto\n  qed\nnext                          \n  case (wfS_letI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> e b' x s b)\n  show ?case proof(rule)\n    show \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>' ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b' \\<close> using wfS_letI by auto\n    have \"toSet ((x, b', TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<subseteq> toSet  ((x, b', TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>')\"  using wfS_letI by auto\n    thus \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; (x, b', TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>' ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close>  using wfS_letI by (meson wfG_cons wfG_cons_TRUE wfS_wf)\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close>  using wfS_letI by auto\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>', \\<Delta>, e, b)\\<close>  using wfS_letI by auto\n  qed\nnext\n  case (wfS_let2I \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 \\<tau> x s2 b)\n  show ?case proof\n    show \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>' ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s1 : b_of \\<tau> \\<close> using wfS_let2I by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>'   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<close>  using wfS_let2I wf_weakening1 by auto\n    have \"toSet ((x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<subseteq> toSet  ((x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>')\"  using wfS_let2I by auto\n    thus \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; (x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>' ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s2 : b \\<close>  using wfS_let2I    by (meson wfG_cons wfG_cons_TRUE wfS_wf)\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>', \\<Delta>, s1, b, \\<tau>)\\<close>  using wfS_let2I by auto\n  qed\nnext\n  case (wfS_varI \\<Theta> \\<B> \\<Gamma> \\<tau> v u \\<Phi> \\<Delta> b s)\n  show ?case proof\n    show \"\\<Theta>; \\<B>; \\<Gamma>'  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \" using wfS_varI wf_weakening1 by auto\n    show \"\\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f v : b_of \\<tau> \"  using wfS_varI wf_weakening1 by auto\n    show \"atom u \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>', \\<Delta>, \\<tau>, v, b)\"  using wfS_varI by auto\n    show \"\\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>' ; (u, \\<tau>)  #\\<^sub>\\<Delta> \\<Delta>  \\<turnstile>\\<^sub>w\\<^sub>f s : b \"  using wfS_varI by auto\n  qed\nnext\n  case (wfS_branchI \\<Theta> \\<Phi> \\<B> x \\<tau>  \\<Gamma> \\<Delta> s b tid dc)\n  show ?case proof\n    have \"toSet ((x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<subseteq> toSet  ((x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>')\"  using wfS_branchI by auto\n    thus \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; (x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>' ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_branchI  by (meson wfG_cons wfG_cons_TRUE wfS_wf)\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>', \\<Delta>, \\<Gamma>', \\<tau>)\\<close> using wfS_branchI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfS_branchI by auto\n  qed\nnext\n  case (wfS_finalI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> tid dclist' cs b dclist)\n  then show ?case using wf_intros by metis\nnext\n  case (wfS_cons \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> tid dclist' cs b css dclist)\n  then show ?case using wf_intros by metis\nnext\n  case (wfS_assertI \\<Theta> \\<Phi> \\<B> x c \\<Gamma> \\<Delta> s b)\n  show ?case proof(rule)\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>'   \\<turnstile>\\<^sub>w\\<^sub>f c \\<close> using wfS_assertI wf_weakening1 by auto\n    have \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma>'\" proof(rule wfG_consI)\n      show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<close> using wfS_assertI by auto\n      show \\<open>atom x \\<sharp> \\<Gamma>'\\<close> using wfS_assertI by auto\n      show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f B_bool \\<close> using wfS_assertI wfB_boolI wfX_wfY by metis\n      have \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (x, B_bool, TRUE) #\\<^sub>\\<Gamma> \\<Gamma>'\" proof\n        show \"(TRUE) \\<in> {TRUE, FALSE}\" by auto\n        show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' \\<close> using wfS_assertI by auto\n        show \\<open>atom x \\<sharp> \\<Gamma>'\\<close> using wfS_assertI by auto\n        show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f B_bool \\<close> using wfS_assertI wfB_boolI wfX_wfY by metis\n      qed\n      thus  \\<open> \\<Theta>; \\<B>; (x, B_bool, TRUE) #\\<^sub>\\<Gamma> \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f c \\<close> \n       using  wf_weakening1(2)[OF \\<open> \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f c \\<close>  \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (x, B_bool, TRUE) #\\<^sub>\\<Gamma> \\<Gamma>' \\<close>] by force\n    qed  \n    thus  \\<open> \\<Theta>; \\<Phi>; \\<B>; (x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma>' ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_assertI by fastforce   \n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>' \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfS_assertI by auto\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>', \\<Delta>, c, b, s)\\<close> using wfS_assertI by auto\n  qed\nqed(metis wf_intros wf_weakening1)+\n\nlemmas wf_weakening = wf_weakening1 wf_weakening2\n\nlemma wfV_weakening_cons:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and c::c\n  assumes \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b\"  and \"atom y \\<sharp> \\<Gamma>\" and \"\\<Theta>; \\<B>; ((y,b',TRUE) #\\<^sub>\\<Gamma> \\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c\" \n  shows \"\\<Theta>; \\<B>; (y,b',c) #\\<^sub>\\<Gamma>\\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f  v : b\"\nproof -\n  have \"wfG \\<Theta> \\<B> ((y,b',c) #\\<^sub>\\<Gamma>\\<Gamma>)\" using wfG_intros2 assms by auto\n  moreover have \"toSet \\<Gamma> \\<subseteq> toSet ((y,b',c) #\\<^sub>\\<Gamma>\\<Gamma>)\" using toSet.simps by auto\n  ultimately show ?thesis using wf_weakening  using assms(1) by blast\nqed\n\nlemma wfG_cons_weakening:\n  fixes \\<Gamma>'::\\<Gamma>\n  assumes \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ((x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)\" and  \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>'\" and \"toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>'\" and \"atom x \\<sharp> \\<Gamma>'\"\n  shows  \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ((x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>')\"\nproof(cases \"c \\<in> {TRUE,FALSE}\")\n  case True\n  then show ?thesis using wfG_wfB  wfG_cons2I assms by auto\nnext\n  case False\n  hence *:\"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>  \\<and> atom x \\<sharp> \\<Gamma> \\<and>  \\<Theta>; \\<B>; (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c\" \n    using  wfG_elims(2)[OF assms(1)] by auto\n  have a1:\"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f  (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>'\" using wfG_wfB wfG_cons2I assms by simp\n  moreover have a2:\"toSet ((x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> ) \\<subseteq> toSet ((x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>')\" using toSet.simps assms by blast\n  moreover have \" \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>'\" proof\n    show \"(TRUE) \\<in> {TRUE, FALSE}\" by auto\n    show \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>'\" using assms by auto\n    show \"atom x \\<sharp> \\<Gamma>'\" using assms by auto\n    show \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b\" using assms wfG_elims by metis\n  qed  \n  hence \" \\<Theta>; \\<B>;  (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>'  \\<turnstile>\\<^sub>w\\<^sub>f c\" using wf_weakening  a1 a2 * by auto\n  then show ?thesis using wfG_cons1I[of c \\<Theta> \\<B> \\<Gamma>' x b, OF False ] wfG_wfB assms by simp\nqed\n\nlemma wfT_weakening_aux:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and c::c\n  assumes \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<lbrace> z : b | c \\<rbrace>\"  and \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f  \\<Gamma>'\" and \"toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>'\" and \"atom z \\<sharp> \\<Gamma>'\"\n  shows \"\\<Theta>; \\<B>; \\<Gamma>'  \\<turnstile>\\<^sub>w\\<^sub>f  \\<lbrace> z : b | c \\<rbrace>\" \nproof \n  show \\<open>atom z \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>')\\<close> \n    using wf_supp wfX_wfY assms fresh_prodN fresh_def x_not_in_b_set wfG_fresh_x by metis\n  show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b \\<close> using assms wfT_elims by metis\n  show \\<open> \\<Theta>; \\<B>; (z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>'   \\<turnstile>\\<^sub>w\\<^sub>f c \\<close> proof - \n    have *:\"\\<Theta>; \\<B>; (z,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f c\" using wfT_wfC fresh_weakening assms by auto\n    moreover have a1:\"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f  (z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>'\" using wfG_cons2I assms \\<open>\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f  b\\<close> by simp\n    moreover have a2:\"toSet ((z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> ) \\<subseteq> toSet ((z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>')\" using toSet.simps assms by blast\n    moreover have \" \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>' \" proof\n      show \"(TRUE) \\<in> {TRUE, FALSE}\" by auto\n      show \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>'\" using assms by auto\n      show \"atom z \\<sharp> \\<Gamma>'\" using assms by auto\n      show \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b\" using assms wfT_elims by metis\n    qed  \n    thus ?thesis  using wf_weakening a1 a2 * by auto\n  qed    \nqed\n\nlemma wfT_weakening_all:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and \\<tau>::\\<tau>\n  assumes \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"  and \"\\<Theta>; \\<B>' \\<turnstile>\\<^sub>w\\<^sub>f  \\<Gamma>'\" and \"toSet \\<Gamma> \\<subseteq> toSet \\<Gamma>'\" and \"\\<B> |\\<subseteq>| \\<B>'\" \n  shows \"\\<Theta>; \\<B>' ; \\<Gamma>'  \\<turnstile>\\<^sub>w\\<^sub>f  \\<tau>\" \n  using wb_b_weakening assms wfT_weakening by metis\n\nlemma wfT_weakening_nil:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and \\<tau>::\\<tau>\n  assumes \"\\<Theta> ; {||} ; GNil  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\"  and \"\\<Theta>; \\<B>' \\<turnstile>\\<^sub>w\\<^sub>f  \\<Gamma>'\" \n  shows \"\\<Theta>; \\<B>' ; \\<Gamma>'  \\<turnstile>\\<^sub>w\\<^sub>f  \\<tau>\" \n  using wfT_weakening_all\n  using assms(1) assms(2) toSet.simps(1) by blast\n\nlemma wfTh_wfT2: \n  fixes x::x and v::v and \\<tau>::\\<tau> and G::\\<Gamma>\n  assumes \"wfTh \\<Theta>\" and \"AF_typedef s dclist \\<in> set \\<Theta>\" and \n      \"(dc, \\<tau>) \\<in> set dclist\"  and \"\\<Theta> ; B \\<turnstile>\\<^sub>w\\<^sub>f G\"\n  shows \"supp \\<tau> = {}\" and \"\\<tau>[x::=v]\\<^sub>\\<tau>\\<^sub>v = \\<tau>\" and \"wfT \\<Theta> B G \\<tau>\"\nproof -\n  show  \"supp \\<tau> = {}\" proof(rule ccontr)\n    assume a1: \"supp \\<tau> \\<noteq> {}\"\n    have  \"supp \\<Theta> \\<noteq> {}\" proof -\n      obtain dclist where dc: \"AF_typedef s dclist \\<in> set \\<Theta> \\<and> (dc, \\<tau>) \\<in> set dclist\" \n        using assms  by auto\n      hence \"supp (dc,\\<tau>)  \\<noteq> {}\" \n        using a1  by (simp add: supp_Pair)\n      hence \"supp dclist  \\<noteq> {}\" using dc supp_list_member by auto\n      hence \"supp (AF_typedef s dclist) \\<noteq> {}\"  using type_def.supp by auto\n      thus ?thesis using supp_list_member dc by auto\n    qed\n    thus False using assms wfTh_supp by simp\n  qed\n  thus \"\\<tau>[x::=v]\\<^sub>\\<tau>\\<^sub>v = \\<tau>\"  by (simp add: fresh_def)\n  have \"wfT \\<Theta> {||} GNil \\<tau>\" using assms wfTh_wfT by auto\n  thus \"wfT \\<Theta> B G \\<tau>\" using assms wfT_weakening_nil by simp\nqed\n\nlemma wf_d_weakening:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and s::s and \\<B>::\\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n         and cs::branch_s and css::branch_list\n  shows \n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma>  ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>' \\<Longrightarrow> setD \\<Delta> \\<subseteq> setD \\<Delta>' \\<Longrightarrow> \\<Theta>; \\<Phi>; \\<B>;  \\<Gamma> ; \\<Delta>' \\<turnstile>\\<^sub>w\\<^sub>f e : b\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>' \\<Longrightarrow> setD \\<Delta> \\<subseteq> setD \\<Delta>' \\<Longrightarrow> \\<Theta>; \\<Phi>; \\<B>;  \\<Gamma> ; \\<Delta>' \\<turnstile>\\<^sub>w\\<^sub>f s : b\" and\n         \"\\<Theta> ; \\<Phi> ; \\<B>  ; \\<Gamma> ; \\<Delta> ; tid ; dc ; t  \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>' \\<Longrightarrow> setD \\<Delta> \\<subseteq> setD \\<Delta>' \\<Longrightarrow>  \\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta>' ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b\" and\n         \"\\<Theta> ; \\<Phi> ; \\<B>  ; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>' \\<Longrightarrow> setD \\<Delta> \\<subseteq> setD \\<Delta>' \\<Longrightarrow>   \\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta>' ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b\" and       \n         \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>) \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<Longrightarrow> True\" and        \n         \"\\<Theta> ; \\<Phi>   \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> True\" and\n         \"\\<Theta> ; \\<Phi>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow>   True\"\nproof(nominal_induct\n          b and b and b and b and \\<Phi> and \\<Delta> and  ftq and ft \n          avoiding:  \\<Delta>'         \n       rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)\n  case (wfE_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v b)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_plusI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_leqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_eqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b v2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_fstI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_sndI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_concatI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_splitI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_lenI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1)\n  then show ?case using wf_intros by metis\nnext\n  case (wfE_appI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> f x b c \\<tau> s v)\n  then show ?case using wf_intros by metis\nnext\n   case (wfE_appPI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> b' bv v \\<tau> f x b c s)\n   show ?case proof(rule, (rule wfE_appPI)+)\n    show \\<open>atom bv \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>, \\<Delta>', b', v, (b_of \\<tau>)[bv::=b']\\<^sub>b)\\<close>  using wfE_appPI by auto\n    show \\<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \\<tau> s))) = lookup_fun \\<Phi> f\\<close>  using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b[bv::=b']\\<^sub>b \\<close>  using wfE_appPI by auto\n  qed\nnext\n  case (wfE_mvarI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> u \\<tau>)\n  show ?case proof\n    show \\<open> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<close> using wfE_mvarI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>' \\<close> using wfE_mvarI by auto\n    show \\<open>(u, \\<tau>) \\<in> setD \\<Delta>'\\<close> using wfE_mvarI by auto\n  qed\nnext\n  case (wfS_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> v b \\<Delta>)\n  then show ?case using wf_intros by metis\nnext\n  case (wfS_letI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> e b' x s b)\n  show ?case proof(rule)\n    show \\<open> \\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta>' \\<turnstile>\\<^sub>w\\<^sub>f e : b' \\<close> using wfS_letI by auto\n    have \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f  (x, b', TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>\"  using wfG_cons2I wfX_wfY wfS_letI by metis\n    hence \"\\<Theta>; \\<B>; (x, b', TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>'\" using wf_weakening2(6) wfS_letI by force\n    thus \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; (x, b', TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta>' \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_letI by metis\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>' \\<close> using wfS_letI by auto\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>, \\<Delta>', e, b)\\<close> using wfS_letI by auto\n  qed\nnext\n  case (wfS_assertI \\<Theta> \\<Phi> \\<B> x c \\<Gamma> \\<Delta> s b)\n  show ?case proof\n    have \"\\<Theta>; \\<B>; (x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>'\" proof(rule  wf_weakening2(6))\n      show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>' \\<close> using wfS_assertI by auto\n    next\n      show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma> \\<close> using wfS_assertI wfX_wfY by metis\n    next\n      show \\<open>toSet \\<Gamma> \\<subseteq> toSet ((x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma>)\\<close> using wfS_assertI by auto\n    qed\n    thus  \\<open> \\<Theta>; \\<Phi>; \\<B>; (x, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta>' \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_assertI wfX_wfY by metis\n  next\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f c \\<close> using wfS_assertI by auto\n  next\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>' \\<close> using wfS_assertI by auto\n  next\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>, \\<Delta>', c, b, s)\\<close> using wfS_assertI by auto\n  qed\nnext\n  case (wfS_let2I \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 \\<tau> x s2 b)\n  show ?case proof\n    show \\<open> \\<Theta>; \\<Phi>; \\<B>; \\<Gamma>; \\<Delta>' \\<turnstile>\\<^sub>w\\<^sub>f s1 : b_of \\<tau> \\<close> using wfS_let2I by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<close> using wfS_let2I by auto\n    have \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f  (x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>\"  using wfG_cons2I wfX_wfY wfS_let2I by metis\n    hence \"\\<Theta>; \\<B>; (x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>'\" using wf_weakening2(6) wfS_let2I by force\n    thus  \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; (x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta>' \\<turnstile>\\<^sub>w\\<^sub>f s2 : b \\<close> using  wfS_let2I by metis\n    show \\<open>atom x \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>, \\<Delta>', s1, b,\\<tau>)\\<close> using wfS_let2I by auto\n  qed\nnext\n  case (wfS_ifI \\<Theta> \\<B> \\<Gamma> v \\<Phi> \\<Delta> s1 b s2)\n  then show ?case using wf_intros by metis\nnext\n  case (wfS_varI \\<Theta> \\<B> \\<Gamma> \\<tau> v u \\<Phi> \\<Delta> b s)\n  show ?case proof\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<close> using wfS_varI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b_of \\<tau> \\<close>  using wfS_varI by auto\n    show \\<open>atom u \\<sharp>  (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>, \\<Delta>', \\<tau>, v, b)\\<close>  using wfS_varI setD.simps by auto\n    have \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f (u, \\<tau>)  #\\<^sub>\\<Delta> \\<Delta>'\" using wfS_varI wfD_cons setD.simps u_fresh_d by metis \n    thus  \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma> ; (u, \\<tau>)  #\\<^sub>\\<Delta> \\<Delta>' \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close>  using wfS_varI setD.simps by blast\n  qed\nnext\n  case (wfS_assignI u \\<tau> \\<Delta> \\<Theta> \\<B> \\<Gamma> \\<Phi> v)\n  show ?case proof\n    show \\<open>(u, \\<tau>) \\<in> setD \\<Delta>'\\<close> using wfS_assignI setD.simps by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>' \\<close> using wfS_assignI by auto\n    show \\<open> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<close> using wfS_assignI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b_of \\<tau> \\<close> using wfS_assignI by auto\n  qed\nnext\n  case (wfS_whileI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 s2 b)\n  then show ?case using wf_intros by metis\nnext\n  case (wfS_seqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 s2 b)\n  then show ?case using wf_intros by metis\nnext\n  case (wfS_matchI \\<Theta> \\<B> \\<Gamma> v tid dclist \\<Delta> \\<Phi> cs b)\n  then show ?case using wf_intros by metis\nnext\n  case (wfS_branchI \\<Theta> \\<Phi> \\<B> x \\<tau> \\<Gamma> \\<Delta> s b tid dc)\n  show ?case proof\n    have \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f  (x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>\"  using wfG_cons2I wfX_wfY wfS_branchI by metis\n    hence \"\\<Theta>; \\<B>; (x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>'\" using wf_weakening2(6) wfS_branchI by force\n    thus  \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; (x, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> ; \\<Delta>' \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<close> using wfS_branchI by simp\n    show \\<open> atom x \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>, \\<Delta>', \\<Gamma>, \\<tau>)\\<close> using wfS_branchI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>' \\<close> using wfS_branchI by auto\n  qed\nnext\n  case (wfS_finalI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> tid dclist' cs b dclist)\n  then show ?case using wf_intros by metis\nnext\n  case (wfS_cons \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> tid dclist' cs b css dclist)\n  then show ?case using wf_intros by metis\nqed(auto+)\n\nsection \\<open>Useful well-formedness instances\\<close>\n\ntext \\<open>Well-formedness for particular constructs that we will need later\\<close>\n\nlemma wfC_e_eq:\n  fixes ce::ce and \\<Gamma>::\\<Gamma>\n  assumes \"\\<Theta> ;  \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b\" and \"atom x \\<sharp> \\<Gamma> \"\n  shows \"\\<Theta> ;  \\<B> ; ((x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>)  \\<turnstile>\\<^sub>w\\<^sub>f (CE_val (V_var x)  ==  ce )\"\nproof - \n  have \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b\" using assms wfX_wfB by auto\n  hence wbg: \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" using wfX_wfY assms by auto\n  show ?thesis proof\n    show *:\"\\<Theta> ;  \\<B> ; (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f CE_val (V_var x) : b\"\n    proof(rule)     \n      show \"\\<Theta> ;  \\<B> ; (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f V_var x : b \" proof\n        show \"\\<Theta>  ;  \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> \" using wfG_cons2I wfX_wfY assms \\<open>\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b\\<close> by auto\n        show \"Some (b, TRUE) = lookup ((x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>) x\" using lookup.simps by auto\n      qed\n    qed\n    show \"\\<Theta> ;  \\<B> ; (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f ce : b\"\n      using assms wf_weakening1(8)[OF assms(1), of \"(x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> \"] * toSet.simps wfX_wfY\n      by (metis Un_subset_iff equalityE)\n  qed\nqed\n\nlemma wfC_e_eq2:\n  fixes e1::ce and e2::ce\n  assumes  \"\\<Theta>  ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f e1 : b\"  and  \"\\<Theta>  ; \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f e2 : b\"  and \" \\<turnstile>\\<^sub>w\\<^sub>f \\<Theta>\" and \"atom x \\<sharp> \\<Gamma>\"\n  shows \"\\<Theta>; \\<B>; (x, b, (CE_val (V_var x)) == e1)   #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f  (CE_val (V_var x)) == e2 \"\nproof(rule wfC_eqI)\n  have *: \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (x, b, CE_val (V_var x)  ==  e1 )  #\\<^sub>\\<Gamma> \\<Gamma>\" proof(rule wfG_cons1I )\n    show \"(CE_val (V_var x)  ==  e1 ) \\<notin> {TRUE, FALSE}\" by auto\n    show \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\" using assms wfX_wfY by metis\n    show *:\"atom x \\<sharp> \\<Gamma>\" using assms by auto\n    show \"\\<Theta>; \\<B>; (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f CE_val (V_var x)  ==  e1\" using wfC_e_eq assms * by auto\n    show \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b\" using assms wfX_wfB by auto\n  qed\n  show \"\\<Theta>; \\<B>; (x, b, CE_val (V_var x)  ==  e1 )  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f CE_val (V_var x) : b\" using assms * wfCE_valI wfV_varI by auto\n  show \"\\<Theta>; \\<B>; (x, b, CE_val (V_var x)  ==  e1 )  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f e2 : b\" proof(rule wf_weakening1(8))\n    show \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f e2 : b \" using assms by auto\n    show \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (x, b, CE_val (V_var x)  ==  e1 )  #\\<^sub>\\<Gamma> \\<Gamma>\" using * by auto\n    show \"toSet \\<Gamma> \\<subseteq> toSet ((x, b, CE_val (V_var x)  ==  e1 )  #\\<^sub>\\<Gamma> \\<Gamma>)\" by auto\n  qed\nqed\n\nlemma wfT_wfT_if_rev:\n  assumes \"wfV P \\<B> \\<Gamma> v  (base_for_lit l)\" and \"wfT P \\<B> \\<Gamma> t\" and \\<open>atom z1 \\<sharp> \\<Gamma>\\<close>\n  shows \"wfT P \\<B> \\<Gamma> (\\<lbrace> z1 : b_of t  | CE_val v  ==  CE_val (V_lit l) IMP  (c_of t z1)  \\<rbrace>)\"\nproof\n  show \\<open> P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b_of t \\<close> using wfX_wfY assms by meson\n  have wfg: \" P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f  (z1, b_of t, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>\" using assms wfV_wf  wfG_cons2I wfX_wfY \n    by (meson wfG_cons_TRUE)\n  show \\<open> P; \\<B> ; (z1, b_of t, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f [ v ]\\<^sup>c\\<^sup>e  ==  [ [ l ]\\<^sup>v ]\\<^sup>c\\<^sup>e   IMP  c_of t z1  \\<close> proof\n    show *: \\<open> P; \\<B> ; (z1, b_of t, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f [ v ]\\<^sup>c\\<^sup>e  ==  [ [ l ]\\<^sup>v ]\\<^sup>c\\<^sup>e  \\<close> \n    proof(rule wfC_eqI[where b=\"base_for_lit l\"])\n      show \"P; \\<B> ; (z1, b_of t, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f [ v ]\\<^sup>c\\<^sup>e : base_for_lit l\" \n        using assms wf_intros wf_weakening wfg   by (meson wfV_weakening_cons)\n      show \"P; \\<B> ; (z1, b_of t, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f [ [ l ]\\<^sup>v ]\\<^sup>c\\<^sup>e : base_for_lit l\" using wfg assms wf_intros wf_weakening wfV_weakening_cons by meson\n    qed    \n    have \" t = \\<lbrace> z1 : b_of t | c_of t z1 \\<rbrace>\" using c_of_eq \n      using assms(2) assms(3) b_of_c_of_eq wfT_x_fresh by auto\n    thus  \\<open> P; \\<B> ; (z1, b_of t, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f c_of t z1 \\<close> using wfT_wfC assms wfG_elims * by simp\n  qed\n  show \\<open>atom z1 \\<sharp>  (P, \\<B>, \\<Gamma>)\\<close> using assms wfG_fresh_x wfX_wfY by metis\nqed\n\nlemma wfT_eq_imp:\n  fixes zz::x and ll::l and \\<tau>'::\\<tau>\n  assumes \"base_for_lit ll = B_bool\" and \"\\<Theta> ; {||} ; GNil \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>'\" and\n          \"\\<Theta> ; {||} \\<turnstile>\\<^sub>w\\<^sub>f (x, b_of \\<lbrace> z' : B_bool  | TRUE \\<rbrace>, c_of \\<lbrace> z' : B_bool  | TRUE \\<rbrace> x)  #\\<^sub>\\<Gamma> GNil\" and \"atom zz \\<sharp> x\"\n  shows \"\\<Theta> ; {||} ; (x, b_of \\<lbrace> z' : B_bool  | TRUE \\<rbrace>, c_of \\<lbrace> z' : B_bool  | TRUE \\<rbrace> x)  #\\<^sub>\\<Gamma>\n                 GNil   \\<turnstile>\\<^sub>w\\<^sub>f \\<lbrace> zz : b_of \\<tau>'  | [ [ x ]\\<^sup>v ]\\<^sup>c\\<^sup>e  ==  [ [ ll ]\\<^sup>v ]\\<^sup>c\\<^sup>e   IMP  c_of \\<tau>' zz  \\<rbrace>\"\nproof(rule wfT_wfT_if_rev)\n  show \\<open> \\<Theta> ; {||} ; (x, b_of \\<lbrace> z' : B_bool  | TRUE \\<rbrace>, c_of \\<lbrace> z' : B_bool  | TRUE \\<rbrace> x)  #\\<^sub>\\<Gamma> GNil \\<turnstile>\\<^sub>w\\<^sub>f [ x ]\\<^sup>v : base_for_lit ll \\<close> \n    using wfV_varI lookup.simps base_for_lit.simps assms by simp\n  show \\<open> \\<Theta> ; {||} ; (x, b_of \\<lbrace> z' : B_bool  | TRUE \\<rbrace>, c_of \\<lbrace> z' : B_bool  | TRUE \\<rbrace> x)  #\\<^sub>\\<Gamma> GNil   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>' \\<close> \n    using wf_weakening assms toSet.simps by auto\n  show \\<open>atom zz \\<sharp> (x, b_of \\<lbrace> z' : B_bool  | TRUE \\<rbrace>, c_of \\<lbrace> z' : B_bool  | TRUE \\<rbrace> x)  #\\<^sub>\\<Gamma> GNil\\<close> \n    unfolding fresh_GCons fresh_prod3 b_of.simps c_of_true \n    using x_fresh_b fresh_GNil   c_of_true c.fresh assms by metis\nqed\n\nlemma wfC_v_eq:\n  fixes ce::ce and \\<Gamma>::\\<Gamma> and v::v\n  assumes \"\\<Theta> ;  \\<B> ; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b\" and \"atom x \\<sharp> \\<Gamma> \"\n  shows \"\\<Theta> ;  \\<B> ; ((x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>)  \\<turnstile>\\<^sub>w\\<^sub>f (CE_val (V_var x)  ==  CE_val v )\"\n  using wfC_e_eq wfCE_valI assms wfX_wfY  by auto\n\nlemma wfT_e_eq:\n  fixes ce::ce\n  assumes \"\\<Theta> ;  \\<B> ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b\" and \"atom z \\<sharp> \\<Gamma>\"\n  shows \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<lbrace> z : b | CE_val (V_var z) == ce \\<rbrace>\"\nproof\n  show \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b\" using wfX_wfB assms by auto\n  show \" atom z \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>)\" using assms wfG_fresh_x wfX_wfY by metis\n  show \"\\<Theta> ;  \\<B> ; (z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f CE_val (V_var z)  ==  ce \"\n    using wfTI wfC_e_eq assms wfTI by auto\nqed\n\nlemma wfT_v_eq:\n  assumes \" wfB \\<Theta> \\<B> b\" and \"wfV  \\<Theta> \\<B> \\<Gamma> v b\" and \"atom z \\<sharp> \\<Gamma>\"\n  shows \"wfT \\<Theta> \\<B> \\<Gamma> \\<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val v)\\<rbrace>\"\n  using wfT_e_eq wfE_valI assms wfX_wfY \n  by (simp add: wfCE_valI)\n\nlemma wfC_wfG:\n  fixes \\<Gamma>::\\<Gamma> and c::c and b::b\n  assumes \"\\<Theta> ; B ; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f c\" and \"\\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f b\" and \"atom x \\<sharp> \\<Gamma>\" \n  shows \"\\<Theta> ; B \\<turnstile>\\<^sub>w\\<^sub>f (x,b,c)#\\<^sub>\\<Gamma> \\<Gamma>\" \nproof - \n  have \" \\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f (x, b, TRUE) #\\<^sub>\\<Gamma> \\<Gamma>\" using wfG_cons2I assms wfX_wfY by fast\n  hence \" \\<Theta> ; B ; (x, b, TRUE) #\\<^sub>\\<Gamma> \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f c \" using wfC_weakening assms by force\n  thus ?thesis using wfG_consI assms wfX_wfY by metis\nqed\n\nsection \\<open>Replacing the constraint on a variable in a context\\<close>\n\nlemma wfG_cons_fresh2:\n  fixes \\<Gamma>'::\\<Gamma>\n  assumes \"wfG P \\<B> (( (x',b',c')  #\\<^sub>\\<Gamma> \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>))\"\n  shows \"x'\\<noteq>x\" \nproof - \n  have \"atom x' \\<sharp> (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)\" \n    using assms wfG_elims(2) by blast\n  thus ?thesis \n    using  fresh_gamma_append[of \"atom x'\" \\<Gamma>' \"(x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\"] fresh_GCons fresh_prod3[of \"atom x'\" x b c] by auto\nqed\n\nlemma replace_in_g_inside:\n  fixes \\<Gamma>::\\<Gamma>\n  assumes \"wfG P \\<B> (\\<Gamma>'@((x,b0,c0') #\\<^sub>\\<Gamma>\\<Gamma>))\" \n  shows \"replace_in_g (\\<Gamma>'@((x,b0,c0') #\\<^sub>\\<Gamma>\\<Gamma>)) x c0 = (\\<Gamma>'@((x,b0,c0) #\\<^sub>\\<Gamma>\\<Gamma>))\"\nusing assms proof(induct \\<Gamma>' rule: \\<Gamma>_induct)\n  case GNil\n  then show ?case using replace_in_g.simps by auto\nnext\n  case (GCons x' b' c' \\<Gamma>'')\n  hence \"P; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ((x', b', c')  #\\<^sub>\\<Gamma> (\\<Gamma>''@ (x, b0, c0')  #\\<^sub>\\<Gamma> \\<Gamma> ))\" by simp\n  hence \"x \\<noteq> x'\" using  wfG_cons_fresh2 by metis\n  then show ?case using replace_in_g.simps GCons  by (simp add: wfG_cons)\nqed\n\nlemma wfG_supp_rig_eq:\n  fixes \\<Gamma>::\\<Gamma>\n  assumes  \"wfG P \\<B> (\\<Gamma>'' @ (x, b0, c0)  #\\<^sub>\\<Gamma> \\<Gamma>)\" and \"wfG P \\<B> (\\<Gamma>'' @ (x, b0, c0')  #\\<^sub>\\<Gamma> \\<Gamma>)\"\n  shows \"supp (\\<Gamma>'' @ (x, b0, c0')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<union> supp \\<B> = supp (\\<Gamma>'' @ (x, b0, c0)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<union> supp \\<B>\"\nusing assms proof(induct \\<Gamma>'')\n  case GNil\n  have \"supp (GNil @ (x, b0, c0')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<union> supp \\<B>  = supp ((x, b0, c0')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<union> supp \\<B>\" using supp_Cons supp_GNil by auto\n  also have \"... = supp x \\<union> supp b0 \\<union> supp c0' \\<union> supp \\<Gamma> \\<union> supp \\<B> \" using supp_GCons by auto\n  also have \"... = supp x \\<union> supp b0 \\<union> supp c0 \\<union> supp \\<Gamma> \\<union> supp \\<B> \" using GNil wfG_wfC[THEN wfC_supp_cons(2) ] by fastforce\n  also have \"... =  (supp ((x, b0, c0)  #\\<^sub>\\<Gamma> \\<Gamma>)) \\<union> supp \\<B> \" using supp_GCons by auto\n  finally have \"supp (GNil @ (x, b0, c0')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<union> supp \\<B> = supp (GNil @ (x, b0, c0)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<union> supp \\<B>\" using supp_Cons supp_GNil by auto\n  then show ?case using supp_GCons wfG_cons2 by auto\nnext\n  case (GCons xbc \\<Gamma>1)\n  moreover have \" (xbc  #\\<^sub>\\<Gamma> \\<Gamma>1) @ (x, b0, c0)  #\\<^sub>\\<Gamma> \\<Gamma>  =  (xbc  #\\<^sub>\\<Gamma> (\\<Gamma>1 @ (x, b0, c0)  #\\<^sub>\\<Gamma> \\<Gamma>))\"  by simp\n  moreover have \" (xbc  #\\<^sub>\\<Gamma> \\<Gamma>1) @ (x, b0, c0')  #\\<^sub>\\<Gamma> \\<Gamma>  =  (xbc  #\\<^sub>\\<Gamma> (\\<Gamma>1 @ (x, b0, c0')  #\\<^sub>\\<Gamma> \\<Gamma>))\"  by simp\n  ultimately have  \"(P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>1 @ ((x, b0, c0)  #\\<^sub>\\<Gamma> \\<Gamma>))  \\<and>  P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>1 @ ((x, b0, c0')  #\\<^sub>\\<Gamma> \\<Gamma>)\" using wfG_cons2 by metis\n  thus ?case using GCons supp_GCons by auto\nqed\n\nlemma fresh_replace_inside[ms_fresh]:\n  fixes y::x and \\<Gamma>::\\<Gamma>\n  assumes  \"wfG P \\<B> (\\<Gamma>'' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)\" and \"wfG P \\<B> (\\<Gamma>'' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>)\"\n  shows \"atom y \\<sharp> (\\<Gamma>'' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>) = atom y \\<sharp> (\\<Gamma>'' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>)\"\n  unfolding fresh_def  using wfG_supp_rig_eq assms x_not_in_b_set by fast\n\nlemma wf_replace_inside1:\n  fixes \\<Gamma>::\\<Gamma> and \\<Phi>::\\<Phi> and \\<Theta>::\\<Theta> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and c''::c and c'::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and b'::b and b::b and s::s  \n           and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css::branch_list\n\nshows  wfV_replace_inside: \"\\<Theta>; \\<B>; G \\<turnstile>\\<^sub>w\\<^sub>f v : b' \\<Longrightarrow> G =  (\\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<Longrightarrow> \\<Theta>; \\<B>; ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow> \\<Theta> ;  \\<B> ; (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f v : b'\" and\n       wfC_replace_inside: \"\\<Theta>; \\<B>; G  \\<turnstile>\\<^sub>w\\<^sub>f c'' \\<Longrightarrow> G =  (\\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<Longrightarrow> \\<Theta>; \\<B>; ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow> \\<Theta> ;  \\<B> ; (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f  c''\" and\n       wfG_replace_inside: \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f G \\<Longrightarrow> G =  (\\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<Longrightarrow> \\<Theta>; \\<B>; ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow>   \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f  (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>) \" and\n       wfT_replace_inside: \"\\<Theta>; \\<B>; G \\<turnstile>\\<^sub>w\\<^sub>f \\<tau> \\<Longrightarrow> G =  (\\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<Longrightarrow> \\<Theta>; \\<B>; ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow>  \\<Theta> ;  \\<B> ; (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f  \\<tau>\" and\n       \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts \\<Longrightarrow>  True\" and \n       \"\\<turnstile>\\<^sub>w\\<^sub>f P \\<Longrightarrow> True\" and\n        \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \\<Longrightarrow> True\" and  \n       wfCE_replace_inside: \"\\<Theta> ;  \\<B> ; G  \\<turnstile>\\<^sub>w\\<^sub>f ce : b' \\<Longrightarrow> G =  (\\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<Longrightarrow> \\<Theta>; \\<B>; ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow> \\<Theta> ;  \\<B> ; (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f ce : b'\" and\n       \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow>   True\"\nproof(nominal_induct   \n          b' and  c'' and G and \\<tau> and ts and P and b and b' and td \n      avoiding: \\<Gamma>' c'\nrule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)\n  case (wfV_varI \\<Theta> \\<B> \\<Gamma>2 b2 c2 x2)\n  then show ?case using wf_intros by (metis lookup_in_rig_eq lookup_in_rig_neq replace_in_g_inside)\nnext\n  case (wfV_conspI s bv dclist \\<Theta> dc x1 b' c1 \\<B> b1 \\<Gamma>1 v)\n  show ?case proof\n    show \\<open>AF_typedef_poly s bv dclist \\<in> set \\<Theta>\\<close> using wfV_conspI by auto\n    show \\<open>(dc, \\<lbrace> x1 : b'  | c1 \\<rbrace>) \\<in> set dclist\\<close> using wfV_conspI by auto\n    show \\<open> \\<Theta> ;  \\<B>   \\<turnstile>\\<^sub>w\\<^sub>f b1 \\<close> using wfV_conspI by auto\n    show *: \\<open> \\<Theta>; \\<B>; \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b'[bv::=b1]\\<^sub>b\\<^sub>b \\<close> using wfV_conspI by auto\n    moreover have \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>\" using wfV_wf wfV_conspI by simp\n    ultimately have \"atom bv \\<sharp> \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\" unfolding fresh_def using wfV_wf  wfG_supp_rig_eq  wfV_conspI \n      by (metis Un_iff fresh_def)\n    thus \\<open>atom bv \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>, b1, v)\\<close>  \n      unfolding fresh_prodN using fresh_prodN wfV_conspI by metis    \n  qed\nnext\n  case (wfTI z \\<Theta> \\<B> G  b1 c1)\n  show ?case proof\n    show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b1 \\<close> using wfTI by auto\n\n    have \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\" using wfG_consI  wfTI  wfG_cons  wfX_wfY by metis\n    moreover hence *:\"wfG \\<Theta> \\<B> (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)\"  using wfX_wfY \n       by (metis append_g.simps(2) wfG_cons2 wfTI.hyps wfTI.prems(1) wfTI.prems(2))\n    hence \\<open>atom z \\<sharp> \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\\<close> \n      using fresh_replace_inside[of \\<Theta> \\<B> \\<Gamma>' x b c \\<Gamma> c' z,OF *] wfTI wfX_wfY wfG_elims by metis\n    thus \\<open>atom z \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)\\<close> using wfG_fresh_x[OF *] by auto \n\n    have \"(z, b1, TRUE)  #\\<^sub>\\<Gamma> G = ((z, b1, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>') @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>\" \n      using wfTI append_g.simps by metis\n    thus \\<open> \\<Theta>; \\<B>; (z, b1, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f c1 \\<close> \n      using wfTI(9)[OF _ wfTI(11)] by fastforce\n  qed\nnext\n  case (wfG_nilI \\<Theta>)\n  hence \"GNil = (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>\" using append_g.simps \\<Gamma>.distinct GNil_append by auto\n  hence \"False\" using \\<Gamma>.distinct by auto\n  then show ?case by auto\nnext\n  case (wfG_cons1I c1 \\<Theta> \\<B> G x1 b1)\n  show  ?case proof(cases \"\\<Gamma>'=GNil\")\n    case True\n    then show ?thesis using wfG_cons1I wfG_consI by auto\n  next\n    case False\n    then  obtain G'::\\<Gamma> where *:\"(x1, b1, c1)  #\\<^sub>\\<Gamma> G' = \\<Gamma>'\" using wfG_cons1I wfG_cons1I(7) GCons_eq_append_conv by auto\n    hence **:\" G = G' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>\" using wfG_cons1I by auto\n    hence \" \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f G' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\" using  wfG_cons1I by auto\n    have \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (x1, b1, c1)  #\\<^sub>\\<Gamma> G' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\" proof(rule Wellformed.wfG_cons1I)\n      show \"c1 \\<notin> {TRUE, FALSE}\" using wfG_cons1I by auto\n      show \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f G' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma> \" using wfG_cons1I(3)[of G',OF **] wfG_cons1I by auto\n      show \"atom x1 \\<sharp> G' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\"  using wfG_cons1I * ** fresh_replace_inside  by metis\n      show \"\\<Theta>; \\<B>; (x1, b1, TRUE)  #\\<^sub>\\<Gamma> G' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c1\" using wfG_cons1I(6)[of \" (x1, b1, TRUE)  #\\<^sub>\\<Gamma> G'\"] wfG_cons1I ** by auto\n      show \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b1\" using wfG_cons1I by auto\n    qed\n    thus ?thesis using * by auto\n  qed\nnext\n  case (wfG_cons2I c1 \\<Theta> \\<B> G x1 b1)\n   show  ?case proof(cases \"\\<Gamma>'=GNil\")\n    case True\n    then show ?thesis using wfG_cons2I wfG_consI by auto\n  next\n    case False\n    then  obtain G'::\\<Gamma> where *:\"(x1, b1, c1)  #\\<^sub>\\<Gamma> G' = \\<Gamma>'\" using wfG_cons2I GCons_eq_append_conv by auto\n    hence **:\" G = G' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>\" using wfG_cons2I by auto\n    moreover have \" \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f G' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\" using wfG_cons2I * ** by auto\n    moreover hence \"atom x1 \\<sharp> G' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\" using wfG_cons2I * ** fresh_replace_inside  by metis\n    ultimately show  ?thesis using Wellformed.wfG_cons2I[OF wfG_cons2I(1), of \\<Theta> \\<B> \"G'@ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\"  x1 b1] wfG_cons2I * ** by auto\n  qed\nqed(metis  wf_intros )+\n\nlemma wf_replace_inside2:\n  fixes \\<Gamma>::\\<Gamma> and \\<Phi>::\\<Phi> and \\<Theta>::\\<Theta> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and c''::c and c'::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and b'::b and b::b and s::s  \n           and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css::branch_list\nshows \n       \"\\<Theta> ; \\<Phi> ;  \\<B> ; G ; D  \\<turnstile>\\<^sub>w\\<^sub>f e : b' \\<Longrightarrow> G =  (\\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<Longrightarrow> \\<Theta>; \\<B>; ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow> \\<Theta> ; \\<Phi> ;  \\<B> ; (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>); D \\<turnstile>\\<^sub>w\\<^sub>f e : b'\" and\n       \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b \\<Longrightarrow> True\" and\n       \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow> True\" and\n       \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow> True\" and\n       \"\\<Theta> \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<Longrightarrow> True\" and\n       \"\\<Theta>; \\<B>; G  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<Longrightarrow>  G =  (\\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>) \\<Longrightarrow> \\<Theta>; \\<B>; ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c \\<Longrightarrow> \\<Theta> ;  \\<B> ; (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>\" and     \n       \"\\<Theta> ; \\<Phi>   \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> True\" and\n       \"\\<Theta> ; \\<Phi>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow>   True\"\nproof(nominal_induct   \n          b' and b and b and b and  \\<Phi> and \\<Delta> and  ftq and ft \n      avoiding: \\<Gamma>' c'\n      rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)\ncase (wfE_valI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v b)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_valI by auto\nnext\n  case (wfE_plusI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_plusI by auto\nnext\n  case (wfE_leqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_leqI by auto\nnext\n  case (wfE_eqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b v2)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_eqI by metis\nnext\n  case (wfE_fstI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_fstI by metis\nnext\n  case (wfE_sndI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_sndI by metis\nnext\n  case (wfE_concatI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_concatI by auto\nnext\n  case (wfE_splitI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_splitI by auto\nnext\n  case (wfE_lenI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_lenI by metis\nnext\n  case (wfE_appI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> f x b c \\<tau> s v)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_appI by metis\nnext\n  case (wfE_appPI \\<Theta> \\<Phi> \\<B> \\<Gamma>'' \\<Delta> b' bv v \\<tau> f x1 b1 c1 s)\n  show ?case proof\n    show \\<open> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta> \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b' \\<close> using wfE_appPI by auto\n    show *:\\<open> \\<Theta>; \\<B>; \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b1[bv::=b']\\<^sub>b \\<close> using wfE_appPI wf_replace_inside1 by auto\n\n    moreover have \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>\" using wfV_wf wfE_appPI by metis\n    ultimately have \"atom bv \\<sharp>  \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\"  \n      unfolding fresh_def using wfV_wf wfG_supp_rig_eq wfE_appPI Un_iff fresh_def  by metis \n\n    thus  \\<open>atom bv \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>, \\<Delta>, b', v, (b_of \\<tau>)[bv::=b']\\<^sub>b)\\<close>\n      using wfE_appPI  fresh_prodN by metis\n    show \\<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x1 b1 c1 \\<tau> s))) = lookup_fun \\<Phi> f\\<close> using wfE_appPI by auto\n  qed\nnext\n  case (wfE_mvarI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> u \\<tau>)\n  then show ?case using wf_replace_inside1 Wellformed.wfE_mvarI by metis\nnext\n  case (wfD_emptyI \\<Theta> \\<B> \\<Gamma>)\n  then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI by metis\nnext\n  case (wfD_cons \\<Theta> \\<B> \\<Gamma> \\<Delta> \\<tau> u)\n  then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI \n    by (simp add: wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfD_cons)\nnext\n  case (wfFTNone \\<Theta> \\<Phi> ft)\n  then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI by metis\nnext\n  case (wfFTSome \\<Theta> \\<Phi> bv ft)\n  then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI by metis\nqed(auto)\n\nlemmas wf_replace_inside = wf_replace_inside1 wf_replace_inside2\n\nlemma wfC_replace_cons:\n  assumes \"wfG P \\<B> ((x,b,c1) #\\<^sub>\\<Gamma>\\<Gamma>)\" and \"wfC P \\<B> ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) c2\" \n  shows \"wfC P \\<B> ((x,b,c1) #\\<^sub>\\<Gamma>\\<Gamma>) c2\" \nproof -\n  have \"wfC P \\<B> (GNil@((x,b,c1) #\\<^sub>\\<Gamma>\\<Gamma>)) c2\" proof(rule wf_replace_inside1(2))\n    show \" P; \\<B> ; (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c2 \" using wfG_elim2 assms by auto\n    show \\<open>(x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> = GNil @ (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>\\<close> using append_g.simps by auto\n    show \\<open>P; \\<B> ; (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f c1  \\<close>  using wfG_elim2 assms by auto\n  qed\n  thus ?thesis using append_g.simps by auto\nqed\n\nlemma wfC_refl:\n  assumes \"wfG \\<Theta> \\<B> ((x, b', c') #\\<^sub>\\<Gamma>\\<Gamma>)\" \n  shows   \"wfC \\<Theta> \\<B> ((x, b', c') #\\<^sub>\\<Gamma>\\<Gamma>) c'\"\n  using wfG_wfC assms wfC_replace_cons by auto\n\nlemma wfG_wfC_inside:\n  assumes \" (x, b, c)  \\<in> toSet G\" and \"wfG \\<Theta> B G\" \n  shows  \"wfC \\<Theta> B G c\"\n  using assms proof(induct G rule: \\<Gamma>_induct)\n  case GNil\n  then show ?case by auto\nnext\n  case (GCons x' b' c' \\<Gamma>')\n  then consider (hd) \"(x, b, c) = (x',b',c')\" | (tail) \"(x, b, c) \\<in> toSet \\<Gamma>'\" using toSet.simps by auto\n  then show ?case proof(cases)\n    case hd\n    then show ?thesis using GCons wf_weakening\n      by (metis wfC_replace_cons wfG_cons_wfC)\n  next\n    case tail\n    then show ?thesis using GCons wf_weakening \n      by (metis insert_iff insert_is_Un subsetI toSet.simps(2) wfG_cons2)\n  qed\nqed\n\nlemma wfT_wf_cons3:\n  assumes \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<lbrace> z : b | c \\<rbrace>\" and \"atom y \\<sharp> (c,\\<Gamma>)\"\n  shows  \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (y, b, c[z::=V_var y]\\<^sub>c\\<^sub>v)  #\\<^sub>\\<Gamma>  \\<Gamma>\"\nproof -\n  have \"\\<lbrace> z : b | c \\<rbrace> = \\<lbrace> y : b |  (y \\<leftrightarrow> z) \\<bullet> c \\<rbrace>\" using type_eq_flip assms by auto\n  moreover hence \" (y \\<leftrightarrow> z) \\<bullet> c = c[z::=V_var y]\\<^sub>c\\<^sub>v\" using  assms subst_v_c_def by auto\n  ultimately have \"\\<lbrace> z : b | c \\<rbrace> = \\<lbrace> y : b |  c[z::=V_var y]\\<^sub>c\\<^sub>v \\<rbrace>\" by metis\n  thus  ?thesis using assms wfT_wf_cons[of \\<Theta> \\<B> \\<Gamma> y b] fresh_Pair by metis\nqed\n\nlemma wfT_wfC_cons:\n  assumes \"wfT P \\<B> \\<Gamma> \\<lbrace> z1 : b  | c1 \\<rbrace>\" and \"wfT P \\<B> \\<Gamma> \\<lbrace> z2 : b  | c2 \\<rbrace>\"  and \"atom x \\<sharp> (c1,c2,\\<Gamma>)\"\n  shows \"wfC P \\<B> ((x,b,c1[z1::=V_var x]\\<^sub>v) #\\<^sub>\\<Gamma>\\<Gamma>) (c2[z2::=V_var x]\\<^sub>v)\" (is \"wfC P \\<B> ?G ?c\")\nproof -\n  have eq: \"\\<lbrace> z2 : b  | c2 \\<rbrace> = \\<lbrace> x : b | c2[z2::=V_var x]\\<^sub>c\\<^sub>v \\<rbrace>\" using type_eq_subst assms fresh_prod3 by simp\n  have eq2: \"\\<lbrace> z1 : b  | c1 \\<rbrace> = \\<lbrace> x : b | c1[z1::=V_var x]\\<^sub>c\\<^sub>v \\<rbrace>\" using type_eq_subst assms fresh_prod3 by simp\n  moreover have \"wfT P \\<B> \\<Gamma> \\<lbrace> x : b  | c1[z1::=V_var x]\\<^sub>c\\<^sub>v \\<rbrace>\" using assms eq2 by auto\n  moreover hence \"wfG P \\<B> ((x,b,c1[z1::=V_var x]\\<^sub>c\\<^sub>v) #\\<^sub>\\<Gamma>\\<Gamma>)\" using wfT_wf_cons fresh_prod3 assms by auto\n  moreover have \"wfT P \\<B> \\<Gamma> \\<lbrace> x : b  | c2[z2::=V_var x]\\<^sub>c\\<^sub>v \\<rbrace>\" using assms eq by auto\n  moreover hence \"wfC P \\<B> ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>)  (c2[z2::=V_var x]\\<^sub>c\\<^sub>v)\" using wfT_wfC assms fresh_prod3 by simp\n  ultimately show ?thesis using wfC_replace_cons subst_v_c_def by simp\nqed\n\nlemma wfT_wfC2:\n  fixes c::c  and x::x\n  assumes \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<lbrace> z : b | c \\<rbrace>\" and \"atom x \\<sharp> \\<Gamma>\"\n  shows \"\\<Theta>; \\<B>; (x,b,TRUE)#\\<^sub>\\<Gamma>\\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f c[z::=[x]\\<^sup>v]\\<^sub>v\"\nproof(cases \"x=z\")\n  case True\n  then show ?thesis using wfT_wfC assms by auto\nnext\n  case False\n  hence \"atom x \\<sharp> c\" using wfT_fresh_c assms by metis\n  hence \"\\<lbrace> x : b  | c[z::=[ x ]\\<^sup>v]\\<^sub>v \\<rbrace> = \\<lbrace> z : b | c \\<rbrace>\" \n    using \\<tau>.eq_iff Abs1_eq_iff(3)[of x \"c[z::=[ x ]\\<^sup>v]\\<^sub>v\" z c] \n    by (metis flip_subst_v type_eq_flip)\n  hence \" \\<Theta>; \\<B>; \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f \\<lbrace> x : b  | c[z::=[ x ]\\<^sup>v]\\<^sub>v \\<rbrace>\" using assms by metis\n  thus ?thesis using wfT_wfC assms by auto\nqed\n\nlemma wfT_wfG: \n  fixes x::x and \\<Gamma>::\\<Gamma> and z::x and c::c and b::b\n  assumes \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f \\<lbrace> z : b | c \\<rbrace>\" and \"atom x \\<sharp> \\<Gamma>\" \n  shows \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (x,b, c[z::=[ x ]\\<^sup>v]\\<^sub>v) #\\<^sub>\\<Gamma> \\<Gamma>\"\nproof - \n  have \"\\<Theta>; \\<B>; (x, b, TRUE) #\\<^sub>\\<Gamma> \\<Gamma>   \\<turnstile>\\<^sub>w\\<^sub>f c[z::=[ x ]\\<^sup>v]\\<^sub>v\" using wfT_wfC2 assms by metis\n  thus ?thesis using wfG_consI assms wfT_wfB b_of.simps wfX_wfY by metis\nqed\n\nlemma wfG_replace_inside2:\n  fixes \\<Gamma>::\\<Gamma> \n  assumes \"wfG P \\<B> (\\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>)\" and \"wfG P \\<B> ((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>)\"\n  shows \"wfG P \\<B> (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)\"\nproof - \n  have \"wfC P \\<B> ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) c\" using wfG_wfC assms by auto\n  thus ?thesis using wf_replace_inside1(3)[OF assms(1)] by auto\nqed\n\nlemma wfG_replace_inside_full:\n  fixes \\<Gamma>::\\<Gamma> \n  assumes \"wfG P \\<B> (\\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>)\" and \"wfG P \\<B> (\\<Gamma>'@((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>))\"\n  shows \"wfG P \\<B> (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)\"\nproof - \n  have \"wfG P \\<B> ((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>)\" using wfG_suffix assms by auto\n  thus ?thesis using wfG_replace_inside assms by auto\nqed\n\nlemma wfT_replace_inside2:\n  assumes \"wfT \\<Theta> \\<B> (\\<Gamma>' @ (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>) t\" and \"wfG \\<Theta> \\<B> (\\<Gamma>'@((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>))\"\n  shows \"wfT \\<Theta> \\<B> (\\<Gamma>' @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>) t\"\nproof -\n  have \"wfG \\<Theta> \\<B> (((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>))\" using wfG_suffix assms by auto\n  hence \"wfC \\<Theta> \\<B> ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) c\" using wfG_wfC by auto\n  thus ?thesis   using wf_replace_inside assms by metis\nqed\n\nlemma wfD_unique:\n  assumes \"wfD P  \\<B> \\<Gamma> \\<Delta>\" and \" (u,\\<tau>') \\<in> setD \\<Delta>\" and \"(u,\\<tau>) \\<in> setD \\<Delta>\"\n  shows \"\\<tau>'=\\<tau>\"\nusing assms  proof(induct \\<Delta> rule: \\<Delta>_induct)\n  case DNil\n  then show ?case by auto\nnext\n  case (DCons u' t' D)\n  hence *: \"wfD P \\<B> \\<Gamma> ((u',t') #\\<^sub>\\<Delta> D)\" using Cons by auto\n  show ?case proof(cases \"u=u'\")\n    case True\n    then have \"u \\<notin> fst ` setD D\" using wfD_elims *  by blast\n    then show ?thesis using DCons by force\n  next\n    case False\n    then show ?thesis using DCons wfD_elims *  by (metis fst_conv setD_ConsD)\n  qed\nqed\n\nlemma replace_in_g_forget:\n  fixes x::x\n  assumes \"wfG P B G\"\n  shows \"atom x \\<notin> atom_dom G \\<Longrightarrow> (G[x\\<longmapsto>c]) = G\" and\n  \"atom x \\<sharp> G \\<Longrightarrow>  (G[x\\<longmapsto>c]) = G\"\nproof -\n  show \"atom x \\<notin> atom_dom G \\<Longrightarrow> G[x\\<longmapsto>c] = G\" by (induct G rule: \\<Gamma>_induct,auto)\n  thus  \"atom x \\<sharp> G \\<Longrightarrow>  (G[x\\<longmapsto>c]) = G\" using wfG_x_fresh assms by simp\nqed\n\nlemma replace_in_g_fresh_single:\n  fixes G::\\<Gamma> and x::x\n  assumes  \\<open>\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f G[x'\\<longmapsto>c'']\\<close> and \"atom x \\<sharp> G\" and \\<open>\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f G \\<close>\n  shows \"atom x \\<sharp> G[x'\\<longmapsto>c'']\" \n  using rig_dom_eq wfG_dom_supp assms fresh_def atom_dom.simps dom.simps by metis\n\nsection \\<open>Preservation of well-formedness under substitution\\<close>\n\nlemma wfC_cons_switch:\n  fixes c::c and c'::c\n  assumes \"\\<Theta>; \\<B>; (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c'\"\n  shows \"\\<Theta>; \\<B>; (x, b, c')  #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c\"\nproof -\n  have *:\"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f  (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\" using wfC_wf assms by auto\n  hence \"atom x \\<sharp> \\<Gamma> \\<and> wfG \\<Theta> \\<B> \\<Gamma> \\<and> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b\" using wfG_cons by auto\n  hence \" \\<Theta>; \\<B>; (x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f TRUE \" using wfC_trueI wfG_cons2I by simp\n  hence \"\\<Theta>; \\<B>;(x, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f c'\" \n    using wf_replace_inside1(2)[of \\<Theta> \\<B> \"(x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\" c' GNil x b c \\<Gamma> TRUE] assms by auto\n  hence \"wfG \\<Theta> \\<B> ((x,b,c') #\\<^sub>\\<Gamma>\\<Gamma>)\" using wf_replace_inside1(3)[OF *, of GNil x b c \\<Gamma> c'] by auto\n  moreover have \"wfC \\<Theta> \\<B> ((x,b,TRUE) #\\<^sub>\\<Gamma>\\<Gamma>) c\" proof(cases \"c \\<in> { TRUE, FALSE }\")\n    case True\n    have \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f  \\<Gamma> \\<and> atom x \\<sharp> \\<Gamma> \\<and> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b\" using wfG_elims(2)[OF *] by auto\n    hence \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f  (x,b,TRUE) #\\<^sub>\\<Gamma> \\<Gamma>\" using wfG_cons_TRUE by auto\n    then show ?thesis using wfC_trueI wfC_falseI True by auto\n  next\n    case False\n    then show ?thesis using wfG_elims(2)[OF *] by auto\n  qed\n  ultimately show  ?thesis using wfC_replace_cons by auto\nqed\n\nlemma subst_g_inside_simple:\n  fixes \\<Gamma>\\<^sub>1::\\<Gamma> and \\<Gamma>\\<^sub>2::\\<Gamma> \n  assumes \"wfG P \\<B> (\\<Gamma>\\<^sub>1@((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2))\"\n  shows \"(\\<Gamma>\\<^sub>1@((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2))[x::=v]\\<^sub>\\<Gamma>\\<^sub>v = \\<Gamma>\\<^sub>1[x::=v]\\<^sub>\\<Gamma>\\<^sub>v@\\<Gamma>\\<^sub>2\" \nusing assms proof(induct \\<Gamma>\\<^sub>1 rule: \\<Gamma>_induct)\n  case GNil\n  then show ?case using subst_gv.simps by simp\nnext\n  case (GCons x' b' c' G)\n  hence *:\"P; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (x', b', c')  #\\<^sub>\\<Gamma> (G @ (x, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>2)\" by auto\n  hence \"x\\<noteq>x'\" \n    using  GCons append_Cons  wfG_cons_fresh2[OF *] by auto\n  hence \"((GCons (x', b', c') G) @ (GCons (x, b, c)  \\<Gamma>\\<^sub>2))[x::=v]\\<^sub>\\<Gamma>\\<^sub>v  =  \n         (GCons (x', b', c') (G @ (GCons (x, b, c)  \\<Gamma>\\<^sub>2)))[x::=v]\\<^sub>\\<Gamma>\\<^sub>v\" by auto\n  also have \"... =  GCons (x', b', c'[x::=v]\\<^sub>c\\<^sub>v) ((G @ (GCons (x, b, c)  \\<Gamma>\\<^sub>2))[x::=v]\\<^sub>\\<Gamma>\\<^sub>v)\"  \n      using subst_gv.simps \\<open>x\\<noteq>x'\\<close> by simp\n  also have \"... = (x', b', c'[x::=v]\\<^sub>c\\<^sub>v)  #\\<^sub>\\<Gamma> (G[x::=v]\\<^sub>\\<Gamma>\\<^sub>v @  \\<Gamma>\\<^sub>2)\" using GCons * wfG_elims by metis\n  also have \"... = ((x', b', c')  #\\<^sub>\\<Gamma> G)[x::=v]\\<^sub>\\<Gamma>\\<^sub>v @  \\<Gamma>\\<^sub>2\"  using subst_gv.simps \\<open>x\\<noteq>x'\\<close>  by simp\n  finally show ?case by blast\nqed\n\nlemma subst_c_TRUE_FALSE:\n  fixes c::c\n  assumes \"c \\<notin> {TRUE,FALSE}\" \n  shows \"c[x::=v']\\<^sub>c\\<^sub>v \\<notin> {TRUE, FALSE}\"\nusing assms by(nominal_induct c rule:c.strong_induct,auto simp add: subst_cv.simps)\n\nlemma lookup_subst:\n  assumes \"Some (b, c) = lookup \\<Gamma> x\" and \"x \\<noteq> x'\" \n  shows \"\\<exists>c'. Some (b,c') = lookup \\<Gamma>[x'::=v']\\<^sub>\\<Gamma>\\<^sub>v x\"\nusing assms proof(induct \\<Gamma> rule: \\<Gamma>_induct)\ncase GNil\n  then show ?case by auto\nnext\n  case (GCons x1 b1 c1 \\<Gamma>1)\n  then show ?case proof(cases \"x1=x'\")\n    case True\n    then show ?thesis using subst_gv.simps GCons by auto\n  next\n    case False\n    hence  *:\"((x1, b1, c1)  #\\<^sub>\\<Gamma> \\<Gamma>1)[x'::=v']\\<^sub>\\<Gamma>\\<^sub>v =  ((x1, b1, c1[x'::=v']\\<^sub>c\\<^sub>v)  #\\<^sub>\\<Gamma> \\<Gamma>1[x'::=v']\\<^sub>\\<Gamma>\\<^sub>v)\" using subst_gv.simps by auto\n    then show ?thesis proof(cases \"x1=x\")\n      case True\n      then show ?thesis using lookup.simps *\n        using GCons.prems(1) by auto\n    next\n      case False\n      then show ?thesis using lookup.simps *\n        using GCons.prems(1)  by (simp add: GCons.hyps assms(2))\n    qed\n  qed\nqed\n\nlemma lookup_subst2:\n  assumes \"Some (b, c) = lookup (\\<Gamma>'@((x',b\\<^sub>1,c0[z0::=[x']\\<^sup>v]\\<^sub>c\\<^sub>v)#\\<^sub>\\<Gamma>\\<Gamma>)) x\" and \"x \\<noteq> x'\" and\n          \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (\\<Gamma>'@((x',b\\<^sub>1,c0[z0::=[x']\\<^sup>v]\\<^sub>c\\<^sub>v)#\\<^sub>\\<Gamma>\\<Gamma>))\" \n  shows \"\\<exists>c'. Some (b,c') = lookup (\\<Gamma>'[x'::=v']\\<^sub>\\<Gamma>\\<^sub>v@\\<Gamma>) x\"\n  using assms lookup_subst subst_g_inside by metis\n\nlemma wf_subst1:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n  shows  wfV_subst: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b        \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> \\<Theta>; \\<B>;\\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v' : b'  \\<Longrightarrow> \\<Theta> ;  \\<B>  ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f v[x::=v']\\<^sub>v\\<^sub>v : b\" and\n         wfC_subst: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f  c           \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v' : b' \\<Longrightarrow> \\<Theta>; \\<B>;  \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f c[x::=v']\\<^sub>c\\<^sub>v\" and\n          wfG_subst: \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>                \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> \\<Theta>; \\<B>  ; \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v' : b' \\<Longrightarrow> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" and\n          wfT_subst: \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>            \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> \\<Theta>; \\<B>  ; \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v' : b' \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts \\<Longrightarrow> True\" and \n         \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<Longrightarrow>True\" and\n         \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \\<Longrightarrow> True \" and\n          wfCE_subst: \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b    \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> \\<Theta>; \\<B>  ; \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v' : b'  \\<Longrightarrow> \\<Theta> ;  \\<B>  ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  \\<turnstile>\\<^sub>w\\<^sub>f  ce[x::=v']\\<^sub>c\\<^sub>e\\<^sub>v : b\" and\n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow>   True\"\nproof(nominal_induct \n      b and c and \\<Gamma> and \\<tau> and ts and \\<Theta> and b and  b and td \n      avoiding: x v' \n      arbitrary: \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1\n      rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)\n case (wfV_varI \\<Theta> \\<B> \\<Gamma> b1 c1 x1)\n  \n  show ?case proof(cases \"x1=x\")\n    case True\n    hence \"(V_var x1)[x::=v']\\<^sub>v\\<^sub>v = v' \" using subst_vv.simps by auto\n    moreover have \"b' = b1\" using wfV_varI True  lookup_inside_wf\n      by (metis option.inject prod.inject)\n    moreover have \" \\<Theta>; \\<B>  ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f v' : b'\" using  wfV_varI subst_g_inside_simple wf_weakening \n      append_g_toSetU sup_ge2  wfV_wf by metis\n    ultimately show ?thesis by auto\n  next\n    case False\n    hence \"(V_var x1)[x::=v']\\<^sub>v\\<^sub>v = (V_var x1) \" using subst_vv.simps by auto\n    moreover have \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" using wfV_varI by simp\n    moreover obtain c1' where \"Some (b1, c1') = lookup \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v x1\"  using    wfV_varI  False  lookup_subst by metis\n    ultimately show ?thesis using  Wellformed.wfV_varI[of \\<Theta>  \\<B> \"\\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" b1 c1' x1] by metis\n  qed  \nnext\n  case (wfV_litI \\<Theta> \\<Gamma> l)\n  then show ?case using  subst_vv.simps  wf_intros by auto\nnext\n  case (wfV_pairI \\<Theta> \\<Gamma> v1 b1 v2 b2)\n  then show ?case using subst_vv.simps  wf_intros by auto\nnext\n  case (wfV_consI s dclist \\<Theta> dc x b c \\<Gamma> v)\n  then show ?case using subst_vv.simps  wf_intros by auto\nnext\n  case (wfV_conspI s bv dclist \\<Theta> dc x' b' c \\<B> b \\<Gamma> va)\n  show ?case unfolding subst_vv.simps proof\n    show \\<open>AF_typedef_poly s bv dclist \\<in> set \\<Theta>\\<close> and \\<open>(dc, \\<lbrace> x' : b'  | c \\<rbrace>) \\<in> set dclist\\<close> using wfV_conspI by auto\n    show \\<open> \\<Theta> ;\\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b \\<close> using wfV_conspI by auto\n    have \"atom bv \\<sharp> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" using fresh_subst_gv_if wfV_conspI by metis\n    moreover have \"atom bv \\<sharp> va[x::=v']\\<^sub>v\\<^sub>v\" using wfV_conspI fresh_subst_if  by simp\n    ultimately show \\<open>atom bv \\<sharp> (\\<Theta>, \\<B>, \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v, b, va[x::=v']\\<^sub>v\\<^sub>v)\\<close> unfolding fresh_prodN  using wfV_conspI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f va[x::=v']\\<^sub>v\\<^sub>v : b'[bv::=b]\\<^sub>b\\<^sub>b \\<close> using wfV_conspI by auto\n  qed\nnext\n  case (wfTI z \\<Theta> \\<B> \\<Gamma>  b c)\n  have \"  \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v   \\<turnstile>\\<^sub>w\\<^sub>f \\<lbrace> z : b  | c[x::=v']\\<^sub>c\\<^sub>v  \\<rbrace>\" proof\n    have  \\<open>\\<Theta>; \\<B>; ((z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>)[x::=v']\\<^sub>\\<Gamma>\\<^sub>v   \\<turnstile>\\<^sub>w\\<^sub>f c[x::=v']\\<^sub>c\\<^sub>v  \\<close> \n    proof(rule  wfTI(9))\n      show \\<open>(z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma> = ((z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>1) @ (x, b', c')  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>2\\<close> using wfTI append_g.simps by simp\n      show \\<open> \\<Theta>; \\<B>; \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v' : b' \\<close> using wfTI by auto\n    qed\n    thus *:\\<open>\\<Theta>; \\<B>; (z, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v   \\<turnstile>\\<^sub>w\\<^sub>f c[x::=v']\\<^sub>c\\<^sub>v  \\<close> \n      using subst_gv.simps subst_cv.simps wfTI fresh_x_neq by auto\n\n    have \"atom z \\<sharp> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" using fresh_subst_gv_if wfTI by metis\n    moreover have \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f  \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" using wfTI wfX_wfY wfG_elims subst_gv.simps * by metis\n    ultimately show  \\<open>atom z \\<sharp>  (\\<Theta>, \\<B>, \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v)\\<close> using wfG_fresh_x  by metis\n    show \\<open>  \\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b  \\<close> using wfTI by auto   \n  qed\n  thus ?case using subst_tv.simps wfTI by auto\nnext\n  case (wfC_trueI \\<Theta> \\<Gamma>)\n  then show ?case using subst_cv.simps  wf_intros by auto\nnext\n  case (wfC_falseI \\<Theta> \\<Gamma>)\n  then show ?case using subst_cv.simps  wf_intros by auto\nnext\n  case (wfC_eqI \\<Theta> \\<B> \\<Gamma> e1 b e2)\n  show ?case proof(subst subst_cv.simps,rule)\n    show \"\\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  \\<turnstile>\\<^sub>w\\<^sub>f e1[x::=v']\\<^sub>c\\<^sub>e\\<^sub>v : b \" using wfC_eqI subst_dv.simps by auto\n    show \"\\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  \\<turnstile>\\<^sub>w\\<^sub>f e2[x::=v']\\<^sub>c\\<^sub>e\\<^sub>v : b \" using wfC_eqI by auto\n  qed\nnext\n  case (wfC_conjI \\<Theta> \\<Gamma> c1 c2)\n  then show ?case using subst_cv.simps  wf_intros by auto\nnext\n  case (wfC_disjI \\<Theta> \\<Gamma> c1 c2)\n  then show ?case using subst_cv.simps  wf_intros by auto\nnext\n  case (wfC_notI \\<Theta> \\<Gamma> c1)\n  then show ?case using subst_cv.simps  wf_intros by auto\nnext\n  case (wfC_impI \\<Theta> \\<Gamma> c1 c2)\n  then show ?case using subst_cv.simps  wf_intros by auto\nnext\n  case (wfG_nilI \\<Theta>)\n  then show ?case using subst_cv.simps  wf_intros by auto\nnext\n  case (wfG_cons1I c \\<Theta> \\<B> \\<Gamma> y b)\n\n  show ?case proof(cases \"x=y\")\n    case True\n    hence \"((y, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  = \\<Gamma>\" using subst_gv.simps by auto\n    moreover have  \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\"  using  wfG_cons1I by auto\n    ultimately show ?thesis by auto\n  next\n    case False\n    have \"\\<Gamma>\\<^sub>1 \\<noteq> GNil\" using wfG_cons1I False by auto\n    then obtain G where \"\\<Gamma>\\<^sub>1 = (y, b, c)  #\\<^sub>\\<Gamma> G\" using GCons_eq_append_conv wfG_cons1I by auto\n    hence *:\"\\<Gamma> = G @ (x, b', c')  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>2\" using wfG_cons1I by auto\n    hence  \"((y, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  =(y, b, c[x::=v']\\<^sub>c\\<^sub>v) #\\<^sub>\\<Gamma>\\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" using subst_gv.simps False by auto\n    moreover have \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (y, b, c[x::=v']\\<^sub>c\\<^sub>v) #\\<^sub>\\<Gamma>\\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" proof(rule  Wellformed.wfG_cons1I)\n      show \\<open>c[x::=v']\\<^sub>c\\<^sub>v \\<notin> {TRUE, FALSE}\\<close> using wfG_cons1I subst_c_TRUE_FALSE by auto\n      show \\<open> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<close> using wfG_cons1I * by auto\n      have \"\\<Gamma> = (G @ ((x, b', c') #\\<^sub>\\<Gamma>GNil)) @ \\<Gamma>\\<^sub>2\" using * append_g_assoc by auto\n      hence \"atom y \\<sharp> \\<Gamma>\\<^sub>2\" using fresh_suffix  \\<open>atom y \\<sharp> \\<Gamma>\\<close>  by auto\n      hence \"atom y \\<sharp> v'\" using wfG_cons1I wfV_x_fresh by metis\n      thus \\<open>atom y \\<sharp> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\\<close> using fresh_subst_gv wfG_cons1I by auto\n      have \"((y, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>)[x::=v']\\<^sub>\\<Gamma>\\<^sub>v = (y, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" using subst_gv.simps subst_cv.simps False by auto\n      thus  \\<open> \\<Theta>; \\<B>; (y, b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  \\<turnstile>\\<^sub>w\\<^sub>f c[x::=v']\\<^sub>c\\<^sub>v \\<close> using wfG_cons1I(6)[of \"(y,b,TRUE) #\\<^sub>\\<Gamma>G\"] * subst_gv.simps \n        wfG_cons1I by fastforce\n      show \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \" using wfG_cons1I by auto\n    qed\n    ultimately show ?thesis by auto   \n  qed\nnext\n  case (wfG_cons2I c \\<Theta> \\<B> \\<Gamma> y b)\n  show ?case proof(cases \"x=y\")\n    case True\n    hence \"((y, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  = \\<Gamma>\" using subst_gv.simps by auto\n    moreover have  \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>\"  using  wfG_cons2I by auto\n    ultimately show ?thesis by auto\n  next\n    case False\n    have \"\\<Gamma>\\<^sub>1 \\<noteq> GNil\" using wfG_cons2I False by auto\n    then obtain G where \"\\<Gamma>\\<^sub>1 = (y, b, c)  #\\<^sub>\\<Gamma> G\"  using GCons_eq_append_conv wfG_cons2I by auto\n    hence *:\"\\<Gamma> = G @ (x, b', c')  #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>2\" using wfG_cons2I by auto\n    hence  \"((y, b, c)  #\\<^sub>\\<Gamma> \\<Gamma>)[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  =(y, b, c[x::=v']\\<^sub>c\\<^sub>v) #\\<^sub>\\<Gamma>\\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" using subst_gv.simps False by auto\n    moreover have \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f (y, b, c[x::=v']\\<^sub>c\\<^sub>v) #\\<^sub>\\<Gamma>\\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" proof(rule  Wellformed.wfG_cons2I)\n      show \\<open>c[x::=v']\\<^sub>c\\<^sub>v \\<in> {TRUE, FALSE}\\<close> using subst_cv.simps wfG_cons2I by auto\n      show \\<open> \\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<close> using wfG_cons2I * by auto\n      have \"\\<Gamma> = (G @ ((x, b', c') #\\<^sub>\\<Gamma>GNil)) @ \\<Gamma>\\<^sub>2\" using * append_g_assoc by auto\n      hence \"atom y \\<sharp> \\<Gamma>\\<^sub>2\" using fresh_suffix wfG_cons2I by metis\n      hence \"atom y \\<sharp> v'\" using wfG_cons2I  wfV_x_fresh by metis\n      thus \\<open>atom y \\<sharp> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\\<close> using fresh_subst_gv wfG_cons2I by auto\n      show \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \" using wfG_cons2I by auto\n    qed\n    ultimately show ?thesis by auto  \n  qed\nnext\n  case (wfCE_valI \\<Theta> \\<B> \\<Gamma> v b)\n   then show ?case using subst_vv.simps  wf_intros by auto\nnext\n  case (wfCE_plusI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  then show ?case using subst_vv.simps  wf_intros by auto\nnext\n  case (wfCE_leqI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  then show ?case using subst_vv.simps  wf_intros by auto\nnext\n  case (wfCE_eqI \\<Theta> \\<B> \\<Gamma> v1 b v2)\n  then show ?case unfolding subst_cev.simps\n    using  Wellformed.wfCE_eqI by metis\nnext\n  case (wfCE_fstI \\<Theta> \\<B> \\<Gamma> v1 b1 b2)\n  then show ?case using Wellformed.wfCE_fstI subst_cev.simps by metis\nnext\n  case (wfCE_sndI \\<Theta> \\<B> \\<Gamma> v1 b1 b2)\n then show ?case using subst_cev.simps  wf_intros by metis\nnext\n  case (wfCE_concatI \\<Theta> \\<B> \\<Gamma> v1 v2)\n then show ?case using subst_vv.simps  wf_intros by auto\nnext\n  case (wfCE_lenI \\<Theta> \\<B> \\<Gamma> v1)\n  then show ?case using subst_vv.simps  wf_intros by auto\nqed(metis subst_sv.simps wf_intros)+\n\nlemma wf_subst2:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def\n  shows    \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b    \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> \\<Theta>; \\<B>  ; \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v' : b'  \\<Longrightarrow> \\<Theta> ; \\<Phi> ;  \\<B>  ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ;  \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f  e[x::=v']\\<^sub>e\\<^sub>v : b\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b   \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> \\<Theta> ;\\<B>  ; \\<Gamma>\\<^sub>2 \\<turnstile>\\<^sub>w\\<^sub>f v' : b'  \\<Longrightarrow> \\<Theta> ; \\<Phi> ;  \\<B>  ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f  s[x::=v']\\<^sub>s\\<^sub>v : b\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f v' : b'  \\<Longrightarrow> \\<Theta>; \\<Phi>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v ; tid ; dc ; t \\<turnstile>\\<^sub>w\\<^sub>f  subst_branchv cs x v' : b\" and\n         \"\\<Theta>; \\<Phi>; \\<B>; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> \\<Theta>; \\<B>; \\<Gamma>\\<^sub>2  \\<turnstile>\\<^sub>w\\<^sub>f v' : b'  \\<Longrightarrow> \\<Theta>; \\<Phi>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f  subst_branchlv css x v' : b\" and        \n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>) \\<Longrightarrow> True \" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>  \\<Longrightarrow> \\<Gamma>=\\<Gamma>\\<^sub>1@((x,b',c') #\\<^sub>\\<Gamma>\\<Gamma>\\<^sub>2) \\<Longrightarrow> \\<Theta>; \\<B>  ; \\<Gamma>\\<^sub>2   \\<turnstile>\\<^sub>w\\<^sub>f v' : b' \\<Longrightarrow> \\<Theta> ;  \\<B> ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f  \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v\" and    \n         \"\\<Theta> ; \\<Phi>   \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> True\" and\n         \"\\<Theta> ; \\<Phi>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow>   True\"\nproof(nominal_induct \n      b and b and b and b and  \\<Phi> and \\<Delta> and ftq and ft \n      avoiding: x v' \n      arbitrary: \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1\n      rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct) \n  case (wfE_valI \\<Theta> \\<Gamma> v b)\n  then show ?case using subst_vv.simps  wf_intros wf_subst1 \n    by (metis subst_ev.simps(1))\nnext\n  case (wfE_plusI \\<Theta> \\<Gamma> v1 v2)\n  then show ?case using subst_vv.simps  wf_intros wf_subst1 by auto\nnext\n  case (wfE_leqI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case \n    using subst_vv.simps  subst_ev.simps subst_ev.simps wf_subst1 Wellformed.wfE_leqI \n    by auto\nnext\n  case (wfE_eqI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 b v2)\n  then show ?case \n    using subst_vv.simps  subst_ev.simps subst_ev.simps wf_subst1 Wellformed.wfE_eqI     \n  proof -\n    show ?thesis\n      by (metis (no_types) subst_ev.simps(4) wfE_eqI.hyps(1) wfE_eqI.hyps(4) wfE_eqI.hyps(5) wfE_eqI.hyps(6) wfE_eqI.hyps(7) wfE_eqI.prems(1) wfE_eqI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_eqI wfV_subst) (* 31 ms *)\n  qed\nnext\n  case (wfE_fstI \\<Theta> \\<Gamma> v1 b1 b2)\n  then show ?case using subst_vv.simps subst_ev.simps wf_subst1 Wellformed.wfE_fstI \n  proof -\n    show ?thesis\n      by (metis (full_types) subst_ev.simps(5) wfE_fstI.hyps(1) wfE_fstI.hyps(4) wfE_fstI.hyps(5) wfE_fstI.prems(1) wfE_fstI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_fstI wf_subst1(1)) (* 78 ms *)\n  qed\nnext\n  case (wfE_sndI \\<Theta> \\<Gamma> v1 b1 b2)\n  then show ?case \n      by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_sndI wf_subst1(1)) \nnext\n  case (wfE_concatI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case \n    by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_concatI wf_subst1(1)) \nnext\n  case (wfE_splitI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case \n      by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_splitI wf_subst1(1)) \nnext\n  case (wfE_lenI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> v1)\nthen show ?case \n      by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_lenI wf_subst1(1))\nnext\n  case (wfE_appI \\<Theta> \\<Phi> \\<Gamma> \\<Delta> f x b c \\<tau> s' v)\nthen show ?case \n      by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_appI wf_subst1(1))\nnext\n   case (wfE_appPI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> b' bv1 v1 \\<tau>1 f1 x1 b1 c1 s1)\n  show ?case proof(subst subst_ev.simps, rule)\n    show \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\" using wfE_appPI wfX_wfY by metis\n    show \"\\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \" using wfE_appPI by auto\n    show \"Some (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1 s1))) = lookup_fun \\<Phi> f1\" using wfE_appPI by auto\n    show \"\\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f v1[x::=v']\\<^sub>v\\<^sub>v : b1[bv1::=b']\\<^sub>b \" using wfE_appPI wf_subst1 by auto\n    show \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b' \" using wfE_appPI by auto\n    have \"atom bv1 \\<sharp> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v\" using fresh_subst_gv_if wfE_appPI by metis\n    moreover have \"atom bv1 \\<sharp> v1[x::=v']\\<^sub>v\\<^sub>v\" using wfE_appPI fresh_subst_if  by simp\n    moreover have \"atom bv1 \\<sharp> \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v\" using wfE_appPI fresh_subst_dv_if by simp\n    ultimately show \"atom bv1 \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v, \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v, b', v1[x::=v']\\<^sub>v\\<^sub>v, (b_of \\<tau>1)[bv1::=b']\\<^sub>b)\" \n      using wfE_appPI fresh_prodN by metis\n  qed\nnext\n  case (wfE_mvarI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> u \\<tau>)\n  have \" \\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f (AE_mvar u) : b_of \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v\" proof\n    show \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \" using wfE_mvarI by auto\n    show \"\\<Theta>; \\<B>  ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \" using wfE_mvarI by auto\n    show \"(u, \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v) \\<in> setD \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v\" using wfE_mvarI subst_dv_member by auto\n  qed\n  thus ?case using subst_ev.simps b_of_subst by auto\nnext\n  case (wfD_emptyI \\<Theta> \\<Gamma>)\n  then show ?case using subst_dv.simps  wf_intros wf_subst1 by auto\nnext\n   case (wfD_cons \\<Theta> \\<B> \\<Gamma> \\<Delta> \\<tau> u)\n  moreover hence \"u \\<notin> fst ` setD \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v\" using subst_dv.simps subst_dv_iff  using subst_dv_fst_eq by presburger\n  ultimately show ?case using subst_dv.simps Wellformed.wfD_cons wf_subst1 by auto\nnext\n  case (wfPhi_emptyI \\<Theta>)\n  then show ?case by auto\nnext\n  case (wfPhi_consI f \\<Theta> \\<Phi> ft)\n  then show ?case by auto\nnext\n   case (wfS_assertI \\<Theta> \\<Phi> \\<B> x2 c \\<Gamma> \\<Delta> s b)\n   show ?case unfolding subst_sv.simps proof\n     show \\<open> \\<Theta>; \\<Phi>; \\<B>; (x2, B_bool, c[x::=v']\\<^sub>c\\<^sub>v) #\\<^sub>\\<Gamma> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f s[x::=v']\\<^sub>s\\<^sub>v : b \\<close> \n       using wfS_assertI(4)[of \"(x2, B_bool, c) #\\<^sub>\\<Gamma> \\<Gamma>\\<^sub>1\" x ]  wfS_assertI by auto\n\n     show \\<open> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v   \\<turnstile>\\<^sub>w\\<^sub>f c[x::=v']\\<^sub>c\\<^sub>v \\<close> using wfS_assertI wf_subst1 by auto\n     show \\<open> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<close>  using wfS_assertI wf_subst1 by auto\n     show \\<open>atom x2 \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v, \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v, c[x::=v']\\<^sub>c\\<^sub>v, b, s[x::=v']\\<^sub>s\\<^sub>v)\\<close>  \n      apply(unfold fresh_prodN,intro conjI) \n      apply(simp add: wfS_assertI )+\n      apply(metis fresh_subst_gv_if wfS_assertI)\n      apply(simp add: fresh_prodN fresh_subst_dv_if wfS_assertI)\n      apply(simp add: fresh_prodN fresh_subst_v_if subst_v_e_def wfS_assertI)        \n      apply(simp add: fresh_prodN fresh_subst_v_if subst_v_\\<tau>_def wfS_assertI)  \n      by(simp add: fresh_prodN fresh_subst_v_if subst_v_s_def wfS_assertI)  \n  qed\nnext\n  case (wfS_letI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> e b1 y s b2)\n  have \"\\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f LET y = (e[x::=v']\\<^sub>e\\<^sub>v) IN (s[x::=v']\\<^sub>s\\<^sub>v) : b2\"  \n  proof\n    show \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f e[x::=v']\\<^sub>e\\<^sub>v : b1 \\<close> using wfS_letI by auto\n    have  \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; ((y, b1, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>)[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f s[x::=v']\\<^sub>s\\<^sub>v : b2 \\<close> \n      using wfS_letI(6) wfS_letI append_g.simps by metis \n    thus \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; (y, b1, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f s[x::=v']\\<^sub>s\\<^sub>v : b2 \\<close> \n      using wfS_letI subst_gv.simps by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<close> using wfS_letI by auto\n    show \\<open>atom y \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v, \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v, e[x::=v']\\<^sub>e\\<^sub>v, b2)\\<close> \n      apply(unfold fresh_prodN,intro conjI) \n       apply(simp add: wfS_letI )+\n       apply(metis fresh_subst_gv_if wfS_letI)\n       apply(simp add: fresh_prodN fresh_subst_dv_if wfS_letI)\n       apply(simp add: fresh_prodN fresh_subst_v_if subst_v_e_def wfS_letI)\n       apply(simp add: fresh_prodN fresh_subst_v_if subst_v_\\<tau>_def wfS_letI)      \n   done\n  qed\n  thus ?case using subst_sv.simps wfS_letI by auto\nnext\n  case (wfS_let2I \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 \\<tau> y s2 b)\n  have \"\\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f LET y : \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v = (s1[x::=v']\\<^sub>s\\<^sub>v) IN (s2[x::=v']\\<^sub>s\\<^sub>v) : b\"  \n  proof\n    show \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f s1[x::=v']\\<^sub>s\\<^sub>v :  b_of (\\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v) \\<close> using wfS_let2I b_of_subst by simp\n    have \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; ((y, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>)[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f s2[x::=v']\\<^sub>s\\<^sub>v : b \\<close>  \n      using wfS_let2I append_g.simps by metis\n    thus \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; (y, b_of \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f s2[x::=v']\\<^sub>s\\<^sub>v : b \\<close> \n      using wfS_let2I subst_gv.simps append_g.simps using b_of_subst by simp\n    show \\<open>   \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v  \\<close> using wfS_let2I wf_subst1 by metis\n    show \\<open>atom y \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v, \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v, s1[x::=v']\\<^sub>s\\<^sub>v, b, \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v)\\<close> \n      apply(unfold fresh_prodN,intro conjI) \n       apply(simp add: wfS_let2I )+\n       apply(metis fresh_subst_gv_if wfS_let2I)\n       apply(simp add: fresh_prodN fresh_subst_dv_if wfS_let2I)\n       apply(simp add: fresh_prodN fresh_subst_v_if subst_v_e_def wfS_let2I)\n       apply(simp add: fresh_prodN fresh_subst_v_if subst_v_\\<tau>_def wfS_let2I)+\n      done\n  qed\n  thus ?case using subst_sv.simps(3) subst_tv.simps wfS_let2I by auto\nnext\n  case (wfS_varI \\<Theta> \\<B> \\<Gamma> \\<tau> v u \\<Phi> \\<Delta> b s)\n  show ?case proof(subst subst_sv.simps, auto simp add: u_fresh_xv,rule) \n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v \\<close> using wfS_varI wf_subst1 by auto\n    have \"b_of (\\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v) = b_of \\<tau>\" using b_of_subst by auto\n    thus \\<open> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f v[x::=v']\\<^sub>v\\<^sub>v : b_of \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v \\<close> using wfS_varI wf_subst1 by auto\n    have *:\"atom u \\<sharp> v'\" using wfV_supp wfS_varI fresh_def by metis\n    show   \\<open>atom u \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v, \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v, \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v, v[x::=v']\\<^sub>v\\<^sub>v,  b)\\<close> \n      unfolding fresh_prodN apply(auto simp add: wfS_varI)\n      using wfS_varI fresh_subst_gv * fresh_subst_dv by metis+\n    show \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; (u, \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v)  #\\<^sub>\\<Delta> \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f s[x::=v']\\<^sub>s\\<^sub>v : b \\<close> using wfS_varI by auto\n  qed\nnext\n  case (wfS_assignI u \\<tau> \\<Delta> \\<Theta> \\<B> \\<Gamma> \\<Phi> v)\n  show ?case proof(subst subst_sv.simps, rule wf_intros)\n    show \\<open>(u, \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v) \\<in> setD \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v\\<close> using subst_dv_iff wfS_assignI  using subst_dv_fst_eq \n      using subst_dv_member by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<close> using wfS_assignI by auto\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f v[x::=v']\\<^sub>v\\<^sub>v : b_of \\<tau>[x::=v']\\<^sub>\\<tau>\\<^sub>v \\<close> using wfS_assignI b_of_subst wf_subst1 by auto\n    show \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \"  using wfS_assignI by auto\n  qed\nnext\n  case (wfS_matchI \\<Theta> \\<B> \\<Gamma> v tid dclist \\<Delta> \\<Phi> cs b)\n  show ?case  proof(subst subst_sv.simps, rule wf_intros)\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f v[x::=v']\\<^sub>v\\<^sub>v : B_id tid \\<close> using wfS_matchI wf_subst1  by auto\n    show \\<open>AF_typedef tid dclist \\<in> set \\<Theta>\\<close> using wfS_matchI by auto\n    show \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v ; tid ; dclist  \\<turnstile>\\<^sub>w\\<^sub>f subst_branchlv cs x v'  : b \\<close> using wfS_matchI by simp\n    show \"\\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \" using wfS_matchI by auto\n    show \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \" using wfS_matchI by auto\n  qed\nnext\n  case (wfS_branchI \\<Theta> \\<Phi> \\<B> y \\<tau> \\<Gamma> \\<Delta> s b tid dc)\n  have \" \\<Theta> ; \\<Phi>  ; \\<B> ; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v ; tid ; dc ; \\<tau> \\<turnstile>\\<^sub>w\\<^sub>f  dc y \\<Rightarrow> (s[x::=v']\\<^sub>s\\<^sub>v) : b\" \n  proof \n    have \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; ((y, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>)[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f s[x::=v']\\<^sub>s\\<^sub>v : b \\<close> \n      using wfS_branchI append_g.simps by metis\n    thus \\<open> \\<Theta> ; \\<Phi>  ; \\<B> ; (y, b_of \\<tau>, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v ; \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f s[x::=v']\\<^sub>s\\<^sub>v : b \\<close> \n      using subst_gv.simps b_of_subst wfS_branchI by simp\n    show \\<open>atom y \\<sharp> (\\<Phi>, \\<Theta>, \\<B>, \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v, \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v, \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v, \\<tau>)\\<close> \n       apply(unfold fresh_prodN,intro conjI) \n       apply(simp add: wfS_branchI )+\n       apply(metis fresh_subst_gv_if wfS_branchI)\n       apply(simp add: fresh_prodN fresh_subst_dv_if wfS_branchI)\n       apply(metis fresh_subst_gv_if wfS_branchI)+      \n      done\n    show \\<open> \\<Theta>; \\<B>; \\<Gamma>[x::=v']\\<^sub>\\<Gamma>\\<^sub>v \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[x::=v']\\<^sub>\\<Delta>\\<^sub>v \\<close> using wfS_branchI by auto\n  qed\n  thus ?case using subst_branchv.simps wfS_branchI by auto\nnext\n  case (wfS_finalI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> tid dclist' cs b dclist)\n  then show ?case using subst_branchlv.simps wf_intros by metis\nnext\n  case (wfS_cons \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> tid dclist' cs b css dclist)\n  then show ?case using subst_branchlv.simps wf_intros by metis\n\nqed(metis subst_sv.simps wf_subst1 wf_intros)+\n\nlemmas wf_subst = wf_subst1 wf_subst2\n\nlemma wfG_subst_wfV:\n  assumes \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>' @ (x, b, c0[z0::=V_var x]\\<^sub>c\\<^sub>v)  #\\<^sub>\\<Gamma> \\<Gamma>\" and \"wfV \\<Theta> \\<B> \\<Gamma> v b\"\n  shows \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v @ \\<Gamma> \"\n  using assms wf_subst subst_g_inside_simple by auto\n\nlemma wfG_member_subst:\n  assumes \"(x1,b1,c1) \\<in> toSet (\\<Gamma>'@\\<Gamma>)\" and \"wfG \\<Theta> \\<B> (\\<Gamma>'@((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>))\" and \"x \\<noteq> x1\"\n  shows \"\\<exists>c1'. (x1,b1,c1') \\<in> toSet ((\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v)@\\<Gamma>)\" \nproof -\n  consider (lhs) \"(x1,b1,c1) \\<in> toSet \\<Gamma>'\"  |  (rhs) \"(x1,b1,c1) \\<in> toSet \\<Gamma>\" using  append_g_toSetU assms by auto\n  thus ?thesis  proof(cases)\n    case lhs\n    hence \"(x1,b1,c1[x::=v]\\<^sub>c\\<^sub>v) \\<in> toSet (\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v)\" using   wfG_inside_fresh[THEN subst_gv_member_iff[OF lhs]] assms by metis\n    hence \"(x1,b1,c1[x::=v]\\<^sub>c\\<^sub>v) \\<in> toSet (\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v@\\<Gamma>)\"  using append_g_toSetU  by auto\n    then show ?thesis by auto\n  next\n    case rhs\n    hence \"(x1,b1,c1) \\<in> toSet (\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v@\\<Gamma>)\"  using append_g_toSetU  by auto\n    then show ?thesis by auto\n  qed \nqed\n\nlemma wfG_member_subst2:\n  assumes \"(x1,b1,c1) \\<in> toSet (\\<Gamma>'@((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>))\" and \"wfG \\<Theta> \\<B> (\\<Gamma>'@((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>))\" and \"x \\<noteq> x1\"\n  shows \"\\<exists>c1'. (x1,b1,c1') \\<in> toSet ((\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v)@\\<Gamma>)\" \nproof -\n  consider (lhs) \"(x1,b1,c1) \\<in> toSet \\<Gamma>'\"  |  (rhs) \"(x1,b1,c1) \\<in> toSet \\<Gamma>\" using  append_g_toSetU assms by auto\n  thus ?thesis  proof(cases)\n    case lhs\n    hence \"(x1,b1,c1[x::=v]\\<^sub>c\\<^sub>v) \\<in> toSet (\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v)\" using   wfG_inside_fresh[THEN subst_gv_member_iff[OF lhs]] assms by metis\n    hence \"(x1,b1,c1[x::=v]\\<^sub>c\\<^sub>v) \\<in> toSet (\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v@\\<Gamma>)\"  using append_g_toSetU  by auto\n    then show ?thesis by auto\n  next\n    case rhs\n    hence \"(x1,b1,c1) \\<in> toSet (\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v@\\<Gamma>)\"  using append_g_toSetU  by auto\n    then show ?thesis by auto\n  qed \nqed\n\nlemma wbc_subst:\n  fixes \\<Gamma>::\\<Gamma> and \\<Gamma>'::\\<Gamma> and v::v\n  assumes \"wfC \\<Theta> \\<B> (\\<Gamma>'@((x,b,c') #\\<^sub>\\<Gamma>\\<Gamma>)) c\"  and  \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f v : b\"\n  shows \"\\<Theta>; \\<B>; ((\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v)@\\<Gamma>) \\<turnstile>\\<^sub>w\\<^sub>f c[x::=v]\\<^sub>c\\<^sub>v\" \nproof - \n  have \"(\\<Gamma>'@((x,b,c') #\\<^sub>\\<Gamma>\\<Gamma>))[x::=v]\\<^sub>\\<Gamma>\\<^sub>v = ((\\<Gamma>'[x::=v]\\<^sub>\\<Gamma>\\<^sub>v)@\\<Gamma>)\" using assms subst_g_inside_simple wfC_wf by metis\n  thus ?thesis  using wf_subst1(2)[OF assms(1) _ assms(2)] by metis\nqed\n\nlemma wfG_inside_fresh_suffix:\n  assumes \"wfG P B (\\<Gamma>'@(x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>)\"\n  shows \"atom x \\<sharp> \\<Gamma>\"\nproof -\n  have \"wfG P B ((x,b,c) #\\<^sub>\\<Gamma>\\<Gamma>)\"  using wfG_suffix assms by auto\n  thus ?thesis  using wfG_elims by metis\nqed\n\nlemmas wf_b_subst_lemmas = subst_eb.simps wf_intros \n    forget_subst subst_b_b_def subst_b_v_def subst_b_ce_def fresh_e_opp_all subst_bb.simps wfV_b_fresh ms_fresh_all(6)\n\nlemma wf_b_subst1:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and s::s and b'::b and ce::ce and td::type_def\n            and cs::branch_s and css::branch_list\n  shows  \"\\<Theta> ; B'  ; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b'  \\<Longrightarrow> {|bv|} = B'   \\<Longrightarrow> \\<Theta> ;  B  \\<turnstile>\\<^sub>w\\<^sub>f b  \\<Longrightarrow> \\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b  \\<turnstile>\\<^sub>w\\<^sub>f  v[bv::=b]\\<^sub>v\\<^sub>b : b'[bv::=b]\\<^sub>b\\<^sub>b\" and\n         \"\\<Theta> ; B' ;  \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f  c           \\<Longrightarrow>  {|bv|} = B' \\<Longrightarrow> \\<Theta> ;  B \\<turnstile>\\<^sub>w\\<^sub>f  b \\<Longrightarrow> \\<Theta> ; B ;  \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f  c[bv::=b]\\<^sub>c\\<^sub>b\" and\n         \"\\<Theta> ;  B' \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>           \\<Longrightarrow> {|bv|} = B'      \\<Longrightarrow>  \\<Theta> ; B \\<turnstile>\\<^sub>w\\<^sub>f b \\<Longrightarrow> \\<Theta> ; B \\<turnstile>\\<^sub>w\\<^sub>f  \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b\" and\n         \"\\<Theta> ;  B' ; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>        \\<Longrightarrow> {|bv|} = B'  \\<Longrightarrow> \\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f  b \\<Longrightarrow> \\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f  \\<tau>[bv::=b]\\<^sub>\\<tau>\\<^sub>b\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts \\<Longrightarrow> True\" and \n         \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<Longrightarrow>True\" and        \n         \"\\<Theta> ;  B'  \\<turnstile>\\<^sub>w\\<^sub>f b' \\<Longrightarrow>  {|bv|} = B' \\<Longrightarrow>  \\<Theta> ;  B  \\<turnstile>\\<^sub>w\\<^sub>f  b \\<Longrightarrow>  \\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f b'[bv::=b]\\<^sub>b\\<^sub>b \" and        \n         \"\\<Theta> ;  B' ;  \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b'    \\<Longrightarrow> {|bv|} = B' \\<Longrightarrow> \\<Theta> ;  B  \\<turnstile>\\<^sub>w\\<^sub>f  b  \\<Longrightarrow> \\<Theta> ;  B  ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b  \\<turnstile>\\<^sub>w\\<^sub>f  ce[bv::=b]\\<^sub>c\\<^sub>e\\<^sub>b : b'[bv::=b]\\<^sub>b\\<^sub>b\"  and\n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow>   True\"\nproof(nominal_induct \n      b' and c and \\<Gamma> and \\<tau> and ts and \\<Theta> and b' and  b' and td \n      avoiding: bv b B\n     rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)\n  case (wfB_intI \\<Theta> \\<B>)\n  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis\nnext\n  case (wfB_boolI \\<Theta> \\<B>)\n then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis\nnext\n  case (wfB_unitI \\<Theta> \\<B>)\n  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis\nnext\n  case (wfB_bitvecI \\<Theta> \\<B>)\n  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis\nnext\n  case (wfB_pairI \\<Theta> \\<B> b1 b2)\n  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis\nnext\n  case (wfB_consI \\<Theta> s dclist \\<B>)\n  then show ?case using subst_bb.simps Wellformed.wfB_consI by simp\nnext\n  case (wfB_appI \\<Theta> ba s bva dclist \\<B>)\n  then show ?case using subst_bb.simps Wellformed.wfB_appI forget_subst wfB_supp \n    by (metis bot.extremum_uniqueI ex_in_conv fresh_def subst_b_b_def supp_empty_fset)\nnext\n  case (wfV_varI \\<Theta> \\<B>1 \\<Gamma> b1 c x)\n  show ?case unfolding subst_vb.simps proof\n    show \"\\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \" using wfV_varI by auto\n    show \"Some (b1[bv::=b]\\<^sub>b\\<^sub>b, c[bv::=b]\\<^sub>c\\<^sub>b) = lookup \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b x\" using subst_b_lookup wfV_varI by simp\n  qed\nnext\n  case (wfV_litI \\<Theta> \\<B> \\<Gamma> l)\n  then show ?case using Wellformed.wfV_litI subst_b_base_for_lit by simp\nnext\n  case (wfV_pairI \\<Theta> \\<B>1 \\<Gamma> v1 b1 v2 b2)\n  show ?case unfolding subst_vb.simps proof(subst subst_bb.simps,rule)\n    show \"\\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v1[bv::=b]\\<^sub>v\\<^sub>b : b1[bv::=b]\\<^sub>b\\<^sub>b\" using wfV_pairI by simp\n    show \"\\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v2[bv::=b]\\<^sub>v\\<^sub>b : b2[bv::=b]\\<^sub>b\\<^sub>b \" using wfV_pairI by simp\n  qed\nnext\n  case (wfV_consI s dclist \\<Theta> dc x b' c \\<B>' \\<Gamma> v) \n  show ?case unfolding subst_vb.simps proof(subst subst_bb.simps, rule  Wellformed.wfV_consI) \n    show 1:\"AF_typedef s dclist \\<in> set \\<Theta>\" using wfV_consI by auto\n    show 2:\"(dc, \\<lbrace> x : b'  | c \\<rbrace>) \\<in> set dclist\"  using wfV_consI by auto\n    have \"\\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v[bv::=b]\\<^sub>v\\<^sub>b : b'[bv::=b]\\<^sub>b\\<^sub>b\"  using wfV_consI by auto\n    moreover hence \"supp b' = {}\" using 1 2 wfTh_lookup_supp_empty \\<tau>.supp wfX_wfY by blast\n    moreover hence  \"b'[bv::=b]\\<^sub>b\\<^sub>b = b'\" using  forget_subst subst_bb_def fresh_def       by (metis empty_iff subst_b_b_def)\n    ultimately show  \"\\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v[bv::=b]\\<^sub>v\\<^sub>b : b'\" using wfV_consI by simp\n  qed\nnext\n  case (wfV_conspI s bva dclist \\<Theta> dc x b' c \\<B>' ba \\<Gamma> v)\n  have *:\"atom bv \\<sharp> b'\" using  wfTh_poly_supp_b[of s bva dclist \\<Theta> dc x b' c] fresh_def wfX_wfY \\<open>atom bva \\<sharp> bv\\<close> \n    by (metis insert_iff not_self_fresh singleton_insert_inj_eq' subsetI subset_antisym wfV_conspI wfV_conspI.hyps(4) wfV_conspI.prems(2))\n  show ?case unfolding subst_vb.simps subst_bb.simps proof\n    show \\<open>AF_typedef_poly s bva dclist \\<in> set \\<Theta>\\<close> using wfV_conspI by auto\n    show \\<open>(dc, \\<lbrace> x : b'  | c \\<rbrace>) \\<in> set dclist\\<close> using wfV_conspI by auto\n    thus \\<open> \\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f ba[bv::=b]\\<^sub>b\\<^sub>b \\<close> using wfV_conspI by metis\n    have \"atom bva \\<sharp> \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b\" using fresh_subst_if subst_b_\\<Gamma>_def wfV_conspI by metis\n    moreover have \"atom bva \\<sharp> ba[bv::=b]\\<^sub>b\\<^sub>b\"  using fresh_subst_if subst_b_b_def wfV_conspI by metis\n    moreover have \"atom bva \\<sharp> v[bv::=b]\\<^sub>v\\<^sub>b\"  using fresh_subst_if subst_b_v_def wfV_conspI by metis \n    ultimately show \\<open>atom bva \\<sharp> (\\<Theta>, B, \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b, ba[bv::=b]\\<^sub>b\\<^sub>b, v[bv::=b]\\<^sub>v\\<^sub>b)\\<close> \n      unfolding fresh_prodN using wfV_conspI fresh_def supp_fset by auto \n    show \\<open> \\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v[bv::=b]\\<^sub>v\\<^sub>b : b'[bva::=ba[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>b\\<^sub>b \\<close> \n      using wfV_conspI  subst_bb_commute[of bv b' bva ba b] * wfV_conspI by metis\n  qed\nnext\n  case (wfTI z \\<Theta> \\<B>' \\<Gamma>'  b' c)\n  show ?case proof(subst subst_tb.simps, rule Wellformed.wfTI)\n    show \"atom z \\<sharp>  (\\<Theta>, B, \\<Gamma>'[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b)\" using wfTI   subst_g_b_x_fresh by simp\n    show \"\\<Theta> ;  B  \\<turnstile>\\<^sub>w\\<^sub>f b'[bv::=b]\\<^sub>b\\<^sub>b \" using wfTI by auto\n    show \"\\<Theta> ;  B ; (z, b'[bv::=b]\\<^sub>b\\<^sub>b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>'[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b   \\<turnstile>\\<^sub>w\\<^sub>f c[bv::=b]\\<^sub>c\\<^sub>b \" using wfTI by simp\n  qed\nnext\n  case (wfC_eqI \\<Theta> \\<B>' \\<Gamma> e1 b' e2)\n  thus ?case using Wellformed.wfC_eqI subst_db.simps  subst_cb.simps wfC_eqI by metis\nnext\n  case (wfG_nilI \\<Theta> \\<B>')\n  then show ?case using Wellformed.wfG_nilI subst_gb.simps by simp\nnext\n  case (wfG_cons1I c' \\<Theta> \\<B>' \\<Gamma>' x b')\n  show ?case proof(subst subst_gb.simps, rule Wellformed.wfG_cons1I)\n    show \"c'[bv::=b]\\<^sub>c\\<^sub>b \\<notin> {TRUE, FALSE}\" using wfG_cons1I(1)\n      by(nominal_induct c' rule: c.strong_induct,auto+) \n    show \"\\<Theta> ;  B  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>'[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \"  using wfG_cons1I by auto\n    show \"atom x \\<sharp> \\<Gamma>'[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b\"  using wfG_cons1I subst_g_b_x_fresh by auto\n    show \"\\<Theta> ;  B ; (x, b'[bv::=b]\\<^sub>b\\<^sub>b, TRUE)  #\\<^sub>\\<Gamma> \\<Gamma>'[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b   \\<turnstile>\\<^sub>w\\<^sub>f c'[bv::=b]\\<^sub>c\\<^sub>b\"  using wfG_cons1I by auto\n    show \"\\<Theta> ;  B  \\<turnstile>\\<^sub>w\\<^sub>f b'[bv::=b]\\<^sub>b\\<^sub>b \"  using wfG_cons1I by auto\n  qed   \nnext\n  case (wfG_cons2I c' \\<Theta> \\<B>' \\<Gamma>' x b')\n  show ?case proof(subst subst_gb.simps, rule Wellformed.wfG_cons2I)\n    show \"c'[bv::=b]\\<^sub>c\\<^sub>b \\<in> {TRUE, FALSE}\" using wfG_cons2I by auto\n    show \"\\<Theta> ;  B  \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>'[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \"  using wfG_cons2I by auto\n    show \"atom x \\<sharp> \\<Gamma>'[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b\"  using wfG_cons2I subst_g_b_x_fresh by auto\n    show \"\\<Theta> ;  B  \\<turnstile>\\<^sub>w\\<^sub>f b'[bv::=b]\\<^sub>b\\<^sub>b \"  using wfG_cons2I by auto\n  qed\nnext\n  case (wfCE_valI \\<Theta> \\<B> \\<Gamma> v b)\n  then show ?case using subst_ceb.simps wf_intros wfX_wfY   \n    by (metis wf_b_subst_lemmas wfCE_b_fresh)\nnext\n  case (wfCE_plusI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY   \n    by metis\nnext\n  case (wfCE_leqI \\<Theta> \\<B> \\<Gamma> v1 v2)\n  then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY   \n    by metis\nnext\n  case (wfCE_eqI \\<Theta> \\<B> \\<Gamma> v1 b v2)\n  then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY   \n    by metis\nnext\n  case (wfCE_fstI \\<Theta> \\<B> \\<Gamma> v1 b1 b2)\n   then show ?case \n     by (metis (no_types) subst_bb.simps(5) subst_ceb.simps(3) wfCE_fstI.hyps(2) \n        wfCE_fstI.prems(1) wfCE_fstI.prems(2) Wellformed.wfCE_fstI) \nnext\n  case (wfCE_sndI \\<Theta> \\<B> \\<Gamma> v1 b1 b2)\n  then show ?case \n     by (metis (no_types) subst_bb.simps(5) subst_ceb.simps wfCE_sndI.hyps(2) \n        wfCE_sndI wfCE_sndI.prems(2) Wellformed.wfCE_sndI) \nnext\n  case (wfCE_concatI \\<Theta> \\<B> \\<Gamma> v1 v2)\n   then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY wf_b_subst_lemmas wfCE_b_fresh  \n   proof -\n     show ?thesis\n       using wfCE_concatI.hyps(2) wfCE_concatI.hyps(4) wfCE_concatI.prems(1) wfCE_concatI.prems(2) \n           Wellformed.wfCE_concatI by auto (* 46 ms *)\n   qed\nnext\n  case (wfCE_lenI \\<Theta> \\<B> \\<Gamma> v1)\n   then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY wf_b_subst_lemmas wfCE_b_fresh  by metis\nqed(auto simp add: wf_intros)\n\nlemma wf_b_subst2:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and s::s and b'::b and ce::ce and td::type_def\n            and cs::branch_s and css::branch_list\n  shows  \"\\<Theta> ; \\<Phi> ;  B' ;  \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f e : b'    \\<Longrightarrow> {|bv|} = B' \\<Longrightarrow> \\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f  b  \\<Longrightarrow> \\<Theta> ; \\<Phi> ;  B  ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b ;  \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f  e[bv::=b]\\<^sub>e\\<^sub>b : b'[bv::=b]\\<^sub>b\\<^sub>b\" and\n         \"\\<Theta> ; \\<Phi> ;  \\<B> ; \\<Gamma> ; \\<Delta> \\<turnstile>\\<^sub>w\\<^sub>f s : b   \\<Longrightarrow> True\" and\n         \"\\<Theta> ; \\<Phi> ;  \\<B> ; \\<Gamma> ; \\<Delta> ; tid ; dc ; t  \\<turnstile>\\<^sub>w\\<^sub>f cs : b \\<Longrightarrow> True\" and\n         \"\\<Theta> ; \\<Phi> ;  \\<B> ; \\<Gamma> ; \\<Delta> ; tid ; dclist \\<turnstile>\\<^sub>w\\<^sub>f css : b \\<Longrightarrow> True\" and      \n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f (\\<Phi>::\\<Phi>) \\<Longrightarrow> True \" and\n         \"\\<Theta> ;  B' ; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>   \\<Longrightarrow> {|bv|} = B' \\<Longrightarrow> \\<Theta> ; B   \\<turnstile>\\<^sub>w\\<^sub>f b \\<Longrightarrow> \\<Theta> ;  B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f  \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b\" and      \n         \"\\<Theta> ; \\<Phi>   \\<turnstile>\\<^sub>w\\<^sub>f ftq \\<Longrightarrow> True\" and\n         \"\\<Theta> ; \\<Phi>  ; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f ft \\<Longrightarrow>   True\"\nproof(nominal_induct \n      b' and b and b and b and \\<Phi> and \\<Delta> and  ftq and ft \n      avoiding: bv b B\nrule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)\n  case (wfE_valI \\<Theta>' \\<Phi>' \\<B>' \\<Gamma>' \\<Delta>' v' b')\n  then show ?case unfolding subst_vb.simps subst_eb.simps using wf_b_subst1(1) Wellformed.wfE_valI  by auto    \nnext\n  case (wfE_plusI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case unfolding subst_eb.simps  \n      using wf_b_subst_lemmas wf_b_subst1(1)  Wellformed.wfE_plusI \n    proof -\n      have \"\\<forall>b ba v g f ts. (( ts ; f ; g[bv::=ba]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v[bv::=ba]\\<^sub>v\\<^sub>b : b[bv::=ba]\\<^sub>b\\<^sub>b) \\<or> \\<not> ts ; \\<B> ; g \\<turnstile>\\<^sub>w\\<^sub>f v : b ) \\<or> \\<not> ts ; f \\<turnstile>\\<^sub>w\\<^sub>f ba\"\n        using wfE_plusI.prems(1) wf_b_subst1(1) by force (* 0.0 ms *)\n      then show \"\\<Theta> ; \\<Phi> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b ; \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f [ plus v1[bv::=b]\\<^sub>v\\<^sub>b v2[bv::=b]\\<^sub>v\\<^sub>b ]\\<^sup>e : B_int[bv::=b]\\<^sub>b\\<^sub>b\"\n   \n        by (metis wfE_plusI.hyps(1) wfE_plusI.hyps(4) wfE_plusI.hyps(5) wfE_plusI.hyps(6) wfE_plusI.prems(1) wfE_plusI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_plusI wf_b_subst_lemmas(86))\n    qed\nnext\n  case (wfE_leqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n   then show ?case unfolding subst_eb.simps  \n     using wf_b_subst_lemmas wf_b_subst1  Wellformed.wfE_leqI       \n   proof -\n     have \"\\<And>ts f b ba g v. \\<not> (ts ; f \\<turnstile>\\<^sub>w\\<^sub>f b) \\<or> \\<not> (ts ; {|ba|} ; g \\<turnstile>\\<^sub>w\\<^sub>f v : B_int) \\<or> (ts ; f ; g[ba::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v[ba::=b]\\<^sub>v\\<^sub>b : B_int)\"\n       by (metis wf_b_subst1(1) wf_b_subst_lemmas(86)) (* 46 ms *)\n     then show \"\\<Theta> ; \\<Phi> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b ; \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f [ leq v1[bv::=b]\\<^sub>v\\<^sub>b v2[bv::=b]\\<^sub>v\\<^sub>b ]\\<^sup>e : B_bool[bv::=b]\\<^sub>b\\<^sub>b\"\n       by (metis (no_types) wfE_leqI.hyps(1) wfE_leqI.hyps(4) wfE_leqI.hyps(5) wfE_leqI.hyps(6) wfE_leqI.prems(1) wfE_leqI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_leqI wf_b_subst_lemmas(87)) (* 46 ms *)\n   qed   \nnext\n  case (wfE_eqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 bb v2)\n  show ?case unfolding subst_eb.simps subst_bb.simps proof\n    show \\<open> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<close> using wfX_wfY wfE_eqI by metis\n    show \\<open> \\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b \\<close> using wfX_wfY wfE_eqI by metis\n    show \\<open> \\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v1[bv::=b]\\<^sub>v\\<^sub>b : bb \\<close> using subst_bb.simps wfE_eqI \n      by (metis (no_types, opaque_lifting) empty_iff insert_iff wf_b_subst1(1))\n    show \\<open> \\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v2[bv::=b]\\<^sub>v\\<^sub>b : bb \\<close> using wfX_wfY wfE_eqI       \n      by (metis insert_iff singleton_iff wf_b_subst1(1) wf_b_subst_lemmas(86) wf_b_subst_lemmas(87) wf_b_subst_lemmas(90))\n    show \\<open>bb \\<in> {B_bool, B_int, B_unit}\\<close> using wfE_eqI by auto\n  qed     \nnext\n  case (wfE_fstI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(84) wf_b_subst1(1)  Wellformed.wfE_fstI         \n    by (metis wf_b_subst_lemmas(89))\nnext\n  case (wfE_sndI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 b1 b2)\n  then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_sndI \n  by (metis wf_b_subst_lemmas(89))\nnext\n  case (wfE_concatI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\nthen show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_concatI  \n  by (metis wf_b_subst_lemmas(91))\nnext\n  case (wfE_splitI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1 v2)\n  then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_splitI    \n    by (metis wf_b_subst_lemmas(89) wf_b_subst_lemmas(91))\nnext\n  case (wfE_lenI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> v1)\n  then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_lenI  \n    by (metis wf_b_subst_lemmas(91) wf_b_subst_lemmas(89))\nnext\n  case (wfE_appI \\<Theta> \\<Phi> \\<B>' \\<Gamma> \\<Delta> f x b' c \\<tau> s v)\n  hence bf: \"atom bv \\<sharp> b'\" using wfPhi_f_simple_wfT wfT_supp bv_not_in_dom_g  wfPhi_f_simple_supp_b fresh_def by fast\n  hence bseq: \"b'[bv::=b]\\<^sub>b\\<^sub>b = b'\" using subst_bb.simps wf_b_subst_lemmas by metis\n  have \"\\<Theta> ; \\<Phi>  ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b ; \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f (AE_app f (v[bv::=b]\\<^sub>v\\<^sub>b)) : (b_of (\\<tau>[bv::=b]\\<^sub>\\<tau>\\<^sub>b))\" \n  proof\n    show \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi>\" using wfE_appI by auto\n    show \"\\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b \" using wfE_appI by simp \n    have \"atom bv \\<sharp> \\<tau>\" using wfPhi_f_simple_wfT[OF wfE_appI(5) wfE_appI(1),THEN wfT_supp]  bv_not_in_dom_g fresh_def by force\n    hence \" \\<tau>[bv::=b]\\<^sub>\\<tau>\\<^sub>b = \\<tau>\"  using forget_subst subst_b_\\<tau>_def by metis\n    thus  \"Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b' c \\<tau>[bv::=b]\\<^sub>\\<tau>\\<^sub>b s))) = lookup_fun \\<Phi> f\" using wfE_appI by simp\n    show \"\\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v[bv::=b]\\<^sub>v\\<^sub>b : b'\" using wfE_appI bseq wf_b_subst1 by metis\n  qed\n  then show ?case using subst_eb.simps b_of_subst_bb_commute by simp\nnext\n  case (wfE_appPI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> b' bv1 v1 \\<tau>1 f x1 b1 c1 s1)\n  then have *: \"atom bv \\<sharp> b1\" using wfPhi_f_supp(1)  wfE_appPI(7,11) \n      by (metis fresh_def fresh_finsert singleton_iff subsetD fresh_def supp_at_base wfE_appPI.hyps(1))\n  have \"\\<Theta> ; \\<Phi>  ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b ; \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f AE_appP f b'[bv::=b]\\<^sub>b\\<^sub>b (v1[bv::=b]\\<^sub>v\\<^sub>b) : (b_of \\<tau>1)[bv1::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>b\"\n  proof\n    show \\<open> \\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b \\<close> using wfE_appPI by auto\n    show \\<open> \\<Theta> ; B  \\<turnstile>\\<^sub>w\\<^sub>f b'[bv::=b]\\<^sub>b\\<^sub>b \\<close> using wfE_appPI wf_b_subst1 by auto\n    have \"atom bv1 \\<sharp> \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b\" using fresh_subst_if subst_b_\\<Gamma>_def wfE_appPI by metis\n    moreover have \"atom bv1 \\<sharp> b'[bv::=b]\\<^sub>b\\<^sub>b\"  using fresh_subst_if subst_b_b_def wfE_appPI by metis\n    moreover have \"atom bv1 \\<sharp> v1[bv::=b]\\<^sub>v\\<^sub>b\"  using fresh_subst_if subst_b_v_def wfE_appPI by metis \n    moreover have \"atom bv1 \\<sharp> \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b\" using fresh_subst_if subst_b_\\<Delta>_def wfE_appPI by metis \n    moreover have \"atom bv1 \\<sharp> (b_of \\<tau>1)[bv1::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>b\\<^sub>b\" using fresh_subst_if subst_b_b_def wfE_appPI by metis \n    ultimately show \"atom bv1 \\<sharp> (\\<Phi>, \\<Theta>, B, \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b, \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b, b'[bv::=b]\\<^sub>b\\<^sub>b, v1[bv::=b]\\<^sub>v\\<^sub>b, (b_of \\<tau>1)[bv1::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>b)\"\n      using wfE_appPI using fresh_def fresh_prodN subst_b_b_def by metis\n    show \\<open>Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \\<tau>1 s1))) = lookup_fun \\<Phi> f\\<close> using wfE_appPI by auto\n\n    have  \\<open> \\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v1[bv::=b]\\<^sub>v\\<^sub>b : b1[bv1::=b']\\<^sub>b[bv::=b]\\<^sub>b\\<^sub>b \\<close>  \n      using wfE_appPI  subst_b_b_def * wf_b_subst1 by metis\n    thus  \\<open> \\<Theta> ; B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f v1[bv::=b]\\<^sub>v\\<^sub>b : b1[bv1::=b'[bv::=b]\\<^sub>b\\<^sub>b]\\<^sub>b \\<close> \n       using  subst_bb_commute subst_b_b_def *  by auto\n  qed\n  moreover have \"atom bv \\<sharp> b_of \\<tau>1\" proof -\n    have \"supp  (b_of \\<tau>1) \\<subseteq> { atom bv1 }\" using wfPhi_f_poly_supp_b_of_t\n      using b_of.simps  wfE_appPI  wfPhi_f_supp(5) by simp\n    thus ?thesis using  wfE_appPI \n      fresh_def fresh_finsert singleton_iff subsetD fresh_def supp_at_base wfE_appPI.hyps by metis\n  qed\n  ultimately show ?case using subst_eb.simps(3) subst_bb_commute subst_b_b_def * by simp\nnext\n  case (wfE_mvarI \\<Theta> \\<Phi> \\<B>' \\<Gamma> \\<Delta> u \\<tau>)\n\n  have \"\\<Theta> ; \\<Phi>  ;  B ; subst_gb  \\<Gamma> bv b ; subst_db  \\<Delta> bv b \\<turnstile>\\<^sub>w\\<^sub>f (AE_mvar u)[bv::=b]\\<^sub>e\\<^sub>b : (b_of (\\<tau>[bv::=b]\\<^sub>\\<tau>\\<^sub>b))\" \n  proof(subst subst_eb.simps,rule Wellformed.wfE_mvarI)\n    show \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f \\<Phi> \"  using wfE_mvarI by simp\n    show \"\\<Theta> ;  B ; \\<Gamma>[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b\"  using wfE_mvarI by metis\n    show \"(u, \\<tau>[bv::=b]\\<^sub>\\<tau>\\<^sub>b) \\<in> setD \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b\" \n      using wfE_mvarI subst_db.simps set_insert subst_d_b_member by simp\n  qed\n  thus  ?case using  b_of_subst_bb_commute by auto\n\nnext\n  case (wfS_seqI \\<Theta> \\<Phi> \\<B> \\<Gamma> \\<Delta> s1 s2 b)\n  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis\nnext\n  case (wfD_emptyI \\<Theta> \\<B>' \\<Gamma>)\n  then show ?case using subst_db.simps Wellformed.wfD_emptyI wf_b_subst1 by simp\nnext\n  case (wfD_cons \\<Theta> \\<B>' \\<Gamma>' \\<Delta> \\<tau> u)\n  show ?case proof(subst subst_db.simps, rule Wellformed.wfD_cons )\n    show \"\\<Theta> ;  B ; \\<Gamma>'[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b \\<turnstile>\\<^sub>w\\<^sub>f \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b \" using wfD_cons by auto\n    show \"\\<Theta> ;  B ; \\<Gamma>'[bv::=b]\\<^sub>\\<Gamma>\\<^sub>b   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>[bv::=b]\\<^sub>\\<tau>\\<^sub>b  \"  using wfD_cons wf_b_subst1 by auto\n    show \"u \\<notin> fst ` setD \\<Delta>[bv::=b]\\<^sub>\\<Delta>\\<^sub>b\" using wfD_cons subst_b_lookup_d by metis\n  qed    \nnext\n  case (wfS_assertI \\<Theta> \\<Phi> \\<B> x c \\<Gamma> \\<Delta> s b)\n  show ?case by auto\nqed(auto)\n\nlemmas wf_b_subst = wf_b_subst1 wf_b_subst2\n\nlemma wfT_subst_wfT:\n  fixes \\<tau>::\\<tau> and b'::b and bv::bv \n  assumes \"\\<Theta> ; {|bv|} ; (x,b,c) #\\<^sub>\\<Gamma>GNil   \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>\" and \"\\<Theta> ; B \\<turnstile>\\<^sub>w\\<^sub>f b'\"\n  shows \"\\<Theta> ;  B ; (x,b[bv::=b']\\<^sub>b\\<^sub>b,c[bv::=b']\\<^sub>c\\<^sub>b) #\\<^sub>\\<Gamma>GNil  \\<turnstile>\\<^sub>w\\<^sub>f  (\\<tau>[bv::=b']\\<^sub>\\<tau>\\<^sub>b)\"\nproof - \n  have  \"\\<Theta> ;  B ; ((x,b,c) #\\<^sub>\\<Gamma>GNil)[bv::=b']\\<^sub>\\<Gamma>\\<^sub>b  \\<turnstile>\\<^sub>w\\<^sub>f  (\\<tau>[bv::=b']\\<^sub>\\<tau>\\<^sub>b)\"\n    using wf_b_subst assms by metis\n  thus ?thesis using subst_gb.simps wf_b_subst_lemmas wfCE_b_fresh  by metis\nqed\n\nlemma wf_trans:\n  fixes \\<Gamma>::\\<Gamma> and  \\<Gamma>'::\\<Gamma> and v::v and e::e and c::c and \\<tau>::\\<tau> and ts::\"(string*\\<tau>) list\" and \\<Delta>::\\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and s::s\n          and cs::branch_s and css::branch_list and \\<Theta>::\\<Theta>\n  shows  \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f v : b'        \\<Longrightarrow> \\<Gamma> = (x, b, c2)  #\\<^sub>\\<Gamma> G  \\<Longrightarrow> \\<Theta>; \\<B>; (x, b, c1)  #\\<^sub>\\<Gamma> G   \\<turnstile>\\<^sub>w\\<^sub>f c2  \\<Longrightarrow>  \\<Theta>; \\<B>; (x, b, c1)  #\\<^sub>\\<Gamma> G   \\<turnstile>\\<^sub>w\\<^sub>f v : b'\" and\n          \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f  c           \\<Longrightarrow> \\<Gamma> = (x, b, c2)  #\\<^sub>\\<Gamma> G \\<Longrightarrow> \\<Theta>; \\<B>; (x, b, c1)  #\\<^sub>\\<Gamma> G   \\<turnstile>\\<^sub>w\\<^sub>f c2 \\<Longrightarrow> \\<Theta>; \\<B>; (x, b, c1)  #\\<^sub>\\<Gamma> G   \\<turnstile>\\<^sub>w\\<^sub>f c\" and\n         \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f \\<Gamma>                \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f \\<tau>            \\<Longrightarrow> True\" and\n         \"\\<Theta>; \\<B>; \\<Gamma>  \\<turnstile>\\<^sub>w\\<^sub>f ts \\<Longrightarrow> True\" and \n         \"\\<turnstile>\\<^sub>w\\<^sub>f \\<Theta> \\<Longrightarrow>True\" and      \n         \"\\<Theta>; \\<B> \\<turnstile>\\<^sub>w\\<^sub>f b \\<Longrightarrow> True \" and       \n         \"\\<Theta>; \\<B>; \\<Gamma> \\<turnstile>\\<^sub>w\\<^sub>f ce : b'    \\<Longrightarrow> \\<Gamma> = (x, b, c2)  #\\<^sub>\\<Gamma> G \\<Longrightarrow> \\<Theta>; \\<B>; (x, b, c1)  #\\<^sub>\\<Gamma> G   \\<turnstile>\\<^sub>w\\<^sub>f c2  \\<Longrightarrow> \\<Theta>; \\<B>; (x, b, c1)  #\\<^sub>\\<Gamma> G   \\<turnstile>\\<^sub>w\\<^sub>f ce : b' \" and\n         \"\\<Theta>  \\<turnstile>\\<^sub>w\\<^sub>f td \\<Longrightarrow>   True\"\nproof(nominal_induct\n     b' and c and \\<Gamma> and \\<tau> and ts and \\<Theta> and  b and  b' and td \n     avoiding: c1\n   arbitrary: \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 and  \\<Gamma>\\<^sub>1 and \\<Gamma>\\<^sub>1 \n   rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)\n  case (wfV_varI \\<Theta> \\<B> \\<Gamma> b' c' x')\n  have wbg: \"\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f (x, b, c1)  #\\<^sub>\\<Gamma> G \" using wfC_wf wfV_varI by simp\n  show ?case proof(cases \"x=x'\")\n    case True\n    have \"Some (b', c1) = lookup ((x, b, c1)  #\\<^sub>\\<Gamma> G) x'\" using lookup.simps wfV_varI  using True by auto\n    then show ?thesis using Wellformed.wfV_varI wbg by simp\n  next\n    case False\n    then have \"Some (b', c') = lookup ((x, b, c1)  #\\<^sub>\\<Gamma> G) x'\" using lookup.simps wfV_varI \n      by simp\n    then show ?thesis using Wellformed.wfV_varI wbg by simp\n  qed \nnext\n case (wfV_conspI s bv dclist \\<Theta> dc x1 b' c \\<B> b1 \\<Gamma> v)\n  show ?case proof\n    show \\<open>AF_typedef_poly s bv dclist \\<in> set \\<Theta>\\<close> using wfV_conspI by auto\n    show \\<open>(dc, \\<lbrace> x1 : b'  | c \\<rbrace>) \\<in> set dclist\\<close> using wfV_conspI by auto\n    show \\<open>\\<Theta>; \\<B>  \\<turnstile>\\<^sub>w\\<^sub>f b1 \\<close> using wfV_conspI by auto\n    show \\<open>atom bv \\<sharp> (\\<Theta>, \\<B>, (x, b, c1)  #\\<^sub>\\<Gamma> G, b1, v)\\<close> unfolding fresh_prodN fresh_GCons using wfV_conspI  fresh_prodN fresh_GCons by simp\n    show \\<open>\\<Theta>; \\<B>; (x, b, c1)  #\\<^sub>\\<Gamma> G \\<turnstile>\\<^sub>w\\<^sub>f v : b'[bv::=b1]\\<^sub>b\\<^sub>b\\<close> using wfV_conspI by auto\n  qed\nqed( (auto | metis wfC_wf wf_intros) +)\n\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/MiniSail/WellformedL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.30736334118347786}}
{"text": "theory NP4_Header_Stack_Action_Semantics\n  imports\n  NP4_Header_Stack_Action_Values\n(*  This file is an extension of a more simplistic semantics of P4 applications. Its purpose is\n    to highlight the triviality of verifying/ensuring safety properties in an application. Here,\n    as an example, it is shown that ruling out out-of-bounds accesses are trivial to ensure.\n    \n    P4 has no notion of typical C-like lists. P4 does have a stack of headers. These are commonly\n    used in parsing, like with MLPS labels existing in a stack. A header stack has to be defined\n    in size at compile-time. As such the size is known at verification-time, and these files show\n    the triviality of ensuring that a read action can't be performed out-of-bounds. This is\n    achieved by tailoring the semantics to not be defined for out-of-bounds cases. *)\nbegin\n(* ============================================================================================================== *)\n(*                                      SMALL STEP SEMANTICS RULES                                                *)\n(* ============================================================================================================== *)\n\n(* The way P4 statements update the state and progress. The natural number included is to prove\n   that computation always progresses. With every step of the computation this number always\n   decreases, indicating progression and ultimately termination.*)\ninductive small_step :: \"(statOrDecl * state * nat) \\<Rightarrow> (statOrDecl * state * nat) \\<Rightarrow> bool\"\n (infix \"\\<leadsto>\" 55) where\n    Exit:       \"(ExitStat, s, n) \\<leadsto> (EmptyStat, s, n-1)\"\n  | CondTrue:   \"eval e s (BOOL True) \\<Longrightarrow> ((ConditionalStat e stmt1 stmt2), s, n) \\<leadsto> (stmt1, s, n-1)\"\n  | CondFalse:  \"eval e s (BOOL False) \\<Longrightarrow> ((ConditionalStat e stmt1 stmt2), s, n) \\<leadsto> (stmt2, s, n-1)\"\n  | EmptyBlock: \"(BlockStat [], s, n) \\<leadsto> (EmptyStat, s, n-1)\" \n  | EmptyFirst: \"(BlockStat (EmptyStat # rest), s, n) \\<leadsto> (BlockStat rest, s, n-1)\"\n  | FullBlock:  \"(stmt, s, n) \\<leadsto> (stmt', s', n') \\<Longrightarrow> n' \\<le> n \\<Longrightarrow> (BlockStat (stmt # rest), s, n) \\<leadsto> (BlockStat (stmt' # rest), s', n')\"\n  | Assign:     \"eval e s v \\<Longrightarrow> (AssignmentStat (NameLVal vName) e, s, n) \\<leadsto> (EmptyStat, s (vName := v), n-1)\"\n  | VarDecl:    \"(VariableDecl (NameLVal vName) (None), s, n) \\<leadsto> (EmptyStat, s, n-1)\"\n  | VarInit:    \"eval e s v \\<Longrightarrow> (VariableDecl (NameLVal vName) (Some e), s, n) \\<leadsto> (EmptyStat, s (vName := v), n-1)\"\n  | ConstInit:  \"eval e s v \\<Longrightarrow> (ConstantDecl (NameLVal vName) e, s, n) \\<leadsto> (EmptyStat, s (vName := v), n-1)\"\n\ndeclare small_step.intros[simp, intro]\n\ninductive_cases [elim!]: \"(EmptyStat, s, n) \\<leadsto> ct\" \"(ExitStat, s, n) \\<leadsto> ct\" \"(ConditionalStat e stmt1 stmt2, s, n) \\<leadsto> ct\"\n  \"(BlockStat stmts, s, n) \\<leadsto> ct\" \"(AssignmentStat l e, s, n) \\<leadsto> ct\" \"(VariableDecl l e, s, n) \\<leadsto> ct\" \"(ConstantDecl l e, s, n) \\<leadsto> ct\"\n\nlemmas small_step_induct = small_step.induct[split_format(complete)]\n\nlemma small_step_deterministic: \"cs \\<leadsto> cs' \\<Longrightarrow> cs \\<leadsto> cs'' \\<Longrightarrow> cs' = cs''\"\nproof (induction arbitrary: cs'' rule: small_step.induct)\nnext case (CondTrue e s stmt1 stmt2 n) thus ?case using eval_deterministic by auto\nnext case (CondFalse e s stmt1 stm2 n stmt2) thus ?case using eval_deterministic by auto\nnext case (Assign e s v vName n) thus ?case using eval_deterministic by auto\nnext case (VarDecl vName s n) thus ?case using eval_deterministic by auto\nnext case (VarInit e s v vName n) thus ?case using eval_deterministic by auto\nnext case (ConstInit e s v vName n) thus ?case using eval_deterministic by auto\nqed auto\n\n(* Show that the progress number will always decrease or stay the same. *)\nlemma step_equal_or_smaller: \"(c, s, n) \\<leadsto> (c', s', n') \\<Longrightarrow> n' \\<le> n\"\n  apply (induction c rule: statOrDecl.induct)\n  apply (auto)\n  done\n\n(* ============================================================================================================== *)\n(*                                        STATEMENT EQUIVALENCE PROOFS                                            *)\n(* ============================================================================================================== *)\n\nabbreviation equiv_stmt :: \"statOrDecl \\<Rightarrow> statOrDecl \\<Rightarrow> bool\" (infix \"~\" 50) where\n  \"c ~ c' \\<equiv> (\\<forall>s n t. ((c, s, n) \\<leadsto> t) = ((c', s, n) \\<leadsto> t))\"\n\nlemma equiv_refl:  \"c ~ c\" by simp\nlemma equiv_sym:   \"(c ~ c') = (c' ~ c)\" by auto\nlemma equiv_trans: \"(c ~ c') \\<Longrightarrow> (c' ~ c'') \\<Longrightarrow> (c ~ c'')\" by simp\n\n(* ============================================================================================================== *)\n(*                                        REFLEXIVE TRANSITIVE CLOSURE                                            *)\n(* ============================================================================================================== *)\n\n(* Define the reflexive transitive closure on the signature of the small-step semantics. *)\ninductive star :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  for r :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool)\" where\nrefl:   \"star r x x\" |\nstep:   \"r x y \\<Longrightarrow> star r y z \\<Longrightarrow> star r x z\"\n\nhide_fact (open) refl step\n\nlemma star_trans: \"star r x y \\<Longrightarrow> star r y z \\<Longrightarrow> star r x z\"\n  apply (induction rule: star.induct)\n   apply (assumption)\n  apply (metis star.step)\n  done\n\nlemmas star_induct = star.induct[of \"r:: 'a*'b*'c \\<Rightarrow> 'a*'b*'c \\<Rightarrow> bool\", split_format(complete)]\n\ndeclare star.refl[simp, intro]\n\nlemma star_step1[simp, intro]: \"r x y \\<Longrightarrow> star r x y\"\n  by (metis star.refl star.step)\n\ncode_pred star .\n\n(* The reflexive transitive closure of the small step function yields whether a state is reachable in any number of\n   steps from the starting state and thereby models complete execution. *)\nabbreviation small_steps :: \"(statOrDecl * state * nat) \\<Rightarrow> (statOrDecl * state * nat) \\<Rightarrow> bool\" (infix \"\\<leadsto>*\" 55)\n  where \"x \\<leadsto>* y \\<equiv> star small_step x y\"\n\n(* ============================================================================================================== *)\n(*                                       REDUCING NUMBER PROGRESS PROOFS                                          *)\n(* ============================================================================================================== *)\n\nlemma star_equal_or_smaller: \"(c, s, n) \\<leadsto>* (c', s', n') \\<Longrightarrow> n' \\<le> n\"\nproof (induction rule: star_induct)\n     case (refl a a b) thus ?case by simp\nnext case (step a a b a a b a a b) thus ?case by (meson dual_order.trans step_equal_or_smaller)\nqed\n\nfun small_steps_n :: \"(statOrDecl * state * nat) \\<Rightarrow> nat \\<Rightarrow> (statOrDecl * state * nat) \\<Rightarrow> bool\" (\"_ \\<leadsto>'(_') _\" [55,0,55] 55)\n  where\n    \"(cs \\<leadsto>(0) cs') = (cs' = cs)\"\n  | \"(cs \\<leadsto>(Suc n) cs'') = (\\<exists>cs'. cs \\<leadsto> cs' \\<and> cs' \\<leadsto>(n) cs'')\"\n\nlemma steps_n_if_star: \"cs \\<leadsto>* cs' \\<Longrightarrow> \\<exists>n. cs \\<leadsto>(n) cs'\"\nproof (induction rule: star.induct)\n  case (refl x) thus ?case using small_steps_n.simps(1) by blast\nnext\n  case (step x y z) thus ?case using small_steps_n.simps(2) by blast\nqed\n\nlemma star_if_steps_n: \"cs \\<leadsto>(n) cs' \\<Longrightarrow> cs \\<leadsto>* cs'\"\n  apply (induction n arbitrary: cs)\n  apply (simp)\n  apply (meson small_steps_n.simps(2) star.simps)\n  done\n\nlemma steps_n_decreases: \"(c, s, n) \\<leadsto>(x) (c', s', n') \\<Longrightarrow> n' \\<le> n\"\n  using star_equal_or_smaller star_if_steps_n by blast\n\n(* ============================================================================================================== *)\n(*                                          TYPING SYSTEM DEFINITION                                              *)\n(* ============================================================================================================== *)\n\ndatatype ty = SBITty | UINTty | SINTty | IINTty | VINTty | BOOLty | STRINGty | ERRORty | MATCHty | HEADERty | HSTACKty nat\n\n(* Helper function to yield type from val object *)\nfun getValType :: \"val \\<Rightarrow> ty\" where\n    \"getValType (SBIT s)   = SBITty\"\n  | \"getValType (UINT n)   = UINTty\"\n  | \"getValType (SINT n)   = SINTty\"\n  | \"getValType (IINT n)   = IINTty\"\n  | \"getValType (VINT n)   = VINTty\"\n  | \"getValType (BOOL b)   = BOOLty\"\n  | \"getValType (STRING s) = STRINGty\"\n  | \"getValType (ERROR e)  = ERRORty\"\n  | \"getValType (MATCH m)  = MATCHty\"\n  | \"getValType (HEADER l) = HEADERty\"\n  | \"getValType (HSTACK l) = HSTACKty (length l)\" (* Store the length of the header stack in the type *)\n\nfun getBaseType :: \"baseType \\<Rightarrow> ty\"\n  where\n    \"getBaseType (BUINT n)   = UINTty\"\n  | \"getBaseType (BSINT n)   = SINTty\"\n  | \"getBaseType (BIINT n)   = IINTty\"\n  | \"getBaseType (BVINT n)   = VINTty\"\n  | \"getBaseType (BBOOL b)   = BOOLty\"\n  | \"getBaseType (BSBIT b)   = SBITty\"\n  | \"getBaseType (BSTRING s) = STRINGty\"\n  | \"getBaseType (BERROR e)  = ERRORty\"\n  | \"getBaseType (BMATCH m)  = MATCHty\"\n  | \"getBaseType (BHEADER l) = HEADERty\"\n  | \"getBaseType (BHSTACK l) = HSTACKty (length l)\" (* Store the length of the header stack in the type *)\n\nlemma length_equiv: \"getBaseType (BHSTACK l) = getValType (baseToVal (BHSTACK l))\"\n  by simp\n\n(* Mapping from a variable name to a type symbol *)\ntype_synonym typeEnv = \"vname \\<Rightarrow> ty\"\n\n(* The typing environment for expressions. If a case is defined it implies the expression is well-typed\n   given the context of the typing environment. *)\ninductive exprTyping :: \"typeEnv \\<Rightarrow> expression \\<Rightarrow> ty \\<Rightarrow> bool\" (\"(1_/ \\<turnstile>/ (_ ::/ _))\" [50,0,50] 50) where\n(* =============== Base types =============== *)\n    BASE_ty: \"\\<Gamma> \\<turnstile> (BASE b) :: (getBaseType b)\"\n(* =============== Miscellaneous expressions =============== *)\n  | TERNEXPR_ty: \"\\<Gamma> \\<turnstile> e1 :: BOOLty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: \\<tau> \\<Longrightarrow> \\<Gamma> \\<turnstile> e3 :: \\<tau> \\<Longrightarrow> \\<Gamma> \\<turnstile> TernExpr e1 e2 e3 :: \\<tau>\"\n  | STCKIDX_ty: \"\\<Gamma> \\<turnstile> e1 :: HSTACKty l \\<Longrightarrow> n < l \\<Longrightarrow> \\<Gamma> \\<turnstile> StckIdx e1 n :: HEADERty\" (* Header access iff n < l *)\n(* =============== Variable mapping  =============== *)\n  | VAR_ty: \"\\<Gamma> \\<turnstile> NamedVar vName :: \\<Gamma> vName\"\n(* =============== Operations that yield a single bit (SBIT)  =============== *)\n          (* Empty for now *)\n(* =============== Operations that yield a boolean (BOOL)  =============== *)\n    (* Boolean operations *)\n  | ULNEB_ty: \"\\<Gamma> \\<turnstile> e1 :: BOOLty \\<Longrightarrow> \\<Gamma> \\<turnstile> UNA_LNE e1 :: BOOLty\"\n  | BEQUB_ty: \"\\<Gamma> \\<turnstile> e1 :: BOOLty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: BOOLty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_EQU e1 e2 :: BOOLty\"\n  | BNEQB_ty: \"\\<Gamma> \\<turnstile> e1 :: BOOLty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: BOOLty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_NEQ e1 e2 :: BOOLty\"\n  | BFANB_ty: \"\\<Gamma> \\<turnstile> e1 :: BOOLty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: BOOLty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_FAN e1 e2 :: BOOLty\"\n  | BFORB_ty: \"\\<Gamma> \\<turnstile> e1 :: BOOLty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: BOOLty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_FOR e1 e2 :: BOOLty\"\n    (* Signed integer operations *)\n  | BEQUS_ty: \"\\<Gamma> \\<turnstile> e1 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_EQU e1 e2 :: BOOLty\"\n  | BNEQS_ty: \"\\<Gamma> \\<turnstile> e1 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_NEQ e1 e2 :: BOOLty\"\n  | BLEQS_ty: \"\\<Gamma> \\<turnstile> e1 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_LEQ e1 e2 :: BOOLty\"\n  | BGEQS_ty: \"\\<Gamma> \\<turnstile> e1 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_GEQ e1 e2 :: BOOLty\"\n  | BLESS_ty: \"\\<Gamma> \\<turnstile> e1 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_LES e1 e2 :: BOOLty\"\n  | BGRES_ty: \"\\<Gamma> \\<turnstile> e1 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_GRE e1 e2 :: BOOLty\"\n    (* Unsigned integer operations *)\n  | BEQUU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_EQU e1 e2 :: BOOLty\"\n  | BNEQU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_NEQ e1 e2 :: BOOLty\"\n  | BLEQU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_LEQ e1 e2 :: BOOLty\"\n  | BGEQU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_GEQ e1 e2 :: BOOLty\"\n  | BLESU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_LES e1 e2 :: BOOLty\"\n  | BGREU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_GRE e1 e2 :: BOOLty\"\n    (* Infinite precision integer operations *)\n  | BEQUI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_EQU e1 e2 :: BOOLty\"\n  | BNEQI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_NEQ e1 e2 :: BOOLty\"\n  | BLEQI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_LEQ e1 e2 :: BOOLty\"\n  | BGEQI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_GEQ e1 e2 :: BOOLty\"\n  | BLESI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_LES e1 e2 :: BOOLty\"\n  | BGREI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_GRE e1 e2 :: BOOLty\"\n    (* Variable size bitstring operations *)\n  | BEQUV_ty: \"\\<Gamma> \\<turnstile> e1 :: VINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: VINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_EQU e1 e2 :: BOOLty\"\n  | BNEQV_ty: \"\\<Gamma> \\<turnstile> e1 :: VINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: VINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_NEQ e1 e2 :: BOOLty\"\n(* =============== Operations that yield an unsigned integer (UINT)  =============== *)\n  | UNEGU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> UNA_NEG e1 :: UINTty\"\n  | UPOSU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> UNA_POS e1 :: UINTty\"\n  | UCOMU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> UNA_COM e1 :: UINTty\"\n  | BADDU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_ADD e1 e2 :: UINTty\"\n  | BMINU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_MIN e1 e2 :: UINTty\"\n  | BANDU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_AND e1 e2 :: UINTty\"\n  | BXORU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_XOR e1 e2 :: UINTty\"\n  | BLORU_ty: \"\\<Gamma> \\<turnstile> e1 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: UINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_LOR e1 e2 :: UINTty\"\n(* =============== Operations that yield a signed integer (SINT)  =============== *)\n  | UNEGS_ty: \"\\<Gamma> \\<turnstile> e1 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> UNA_NEG e1 :: SINTty\"\n  | UPOSS_ty: \"\\<Gamma> \\<turnstile> e1 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> UNA_POS e1 :: SINTty\"\n  | BADDS_ty: \"\\<Gamma> \\<turnstile> e1 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_ADD e1 e2 :: SINTty\"\n  | BMINS_ty: \"\\<Gamma> \\<turnstile> e1 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: SINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_MIN e1 e2 :: SINTty\"\n(* =============== Operations that yield an infinite-precision integer (IINT)  =============== *)\n  | UNEGI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> UNA_NEG e1 :: IINTty\"\n  | UPOSI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> UNA_POS e1 :: IINTty\"\n  | BADDI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_ADD e1 e2 :: IINTty\"\n  | BMINI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_MIN e1 e2 :: IINTty\"\n  | BMULI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_MUL e1 e2 :: IINTty\"\n  | BDIVI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_DIV e1 e2 :: IINTty\"\n  | BMODI_ty: \"\\<Gamma> \\<turnstile> e1 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> e2 :: IINTty \\<Longrightarrow> \\<Gamma> \\<turnstile> BIN_MOD e1 e2 :: IINTty\"\n(* =============== Operations that yield a variable-width integer (VINT)  =============== *)\n          (* Empty for now *)\n\ndeclare exprTyping.intros [intro!]\ninductive_cases [elim!]:\n  \"\\<Gamma> \\<turnstile> BASE b :: \\<tau>\" \"\\<Gamma> \\<turnstile> UNA_LNE e1 :: \\<tau>\" \"\\<Gamma> \\<turnstile> UNA_COM e1 :: \\<tau>\" \"\\<Gamma> \\<turnstile> UNA_NEG e1 :: \\<tau>\" \"\\<Gamma> \\<turnstile> UNA_POS e1 :: \\<tau>\" \"\\<Gamma> \\<turnstile> StckIdx e1 e2 :: \\<tau>\"\n  \"\\<Gamma> \\<turnstile> BIN_DIV e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_MOD e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_ADD e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_MIN e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_AND e1 e2 :: \\<tau>\"\n  \"\\<Gamma> \\<turnstile> BIN_XOR e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_LOR e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_LEQ e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_GEQ e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_LES e1 e2 :: \\<tau>\"\n  \"\\<Gamma> \\<turnstile> BIN_GRE e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_NEQ e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_EQU e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_FAN e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> BIN_FOR e1 e2 :: \\<tau>\"\n  \"\\<Gamma> \\<turnstile> BIN_MUL e1 e2 :: \\<tau>\" \"\\<Gamma> \\<turnstile> TernExpr e1 e2 e3 :: \\<tau>\" \"\\<Gamma> \\<turnstile> NamedVar v :: \\<tau>\" \"\\<Gamma> \\<turnstile> StckIdx expr n :: \\<tau>\"\n\nlemma expr_typing_deterministic: \"\\<Gamma> \\<turnstile> e :: t \\<Longrightarrow> \\<Gamma> \\<turnstile> e :: t' \\<Longrightarrow> t' = t\"\n  apply (induction arbitrary: t' rule: exprTyping.induct)\n    apply (blast+)\n  done\n\n(* The typing environment for statements. If a case is defined it implies the statement is well-typed\n   given the context of the typing environment. *)\ninductive stmtTyping :: \"typeEnv \\<Rightarrow> statOrDecl \\<Rightarrow> bool\" (infix \"\\<Turnstile>\" 50) where\n    Empty_ty: \"\\<Gamma> \\<Turnstile> EmptyStat\"\n  | Exit_ty: \"\\<Gamma> \\<Turnstile> ExitStat\"\n  | Conditional_ty: \"\\<Gamma> \\<turnstile> e :: (BOOLty) \\<Longrightarrow> \\<Gamma> \\<Turnstile> stmt1 \\<Longrightarrow> \\<Gamma> \\<Turnstile> stmt2 \\<Longrightarrow> \\<Gamma> \\<Turnstile> (ConditionalStat e stmt1 stmt2)\"\n  | Block_Empty_ty: \"\\<Gamma> \\<Turnstile> (BlockStat [])\"\n  | BlockFull_ty: \"\\<Gamma> \\<Turnstile> stmt \\<Longrightarrow> \\<Gamma> \\<Turnstile> (BlockStat rest) \\<Longrightarrow> \\<Gamma> \\<Turnstile> (BlockStat (stmt # rest))\"\n  | Assign_ty: \"\\<Gamma> \\<turnstile> e :: \\<Gamma> (vName) \\<Longrightarrow> \\<Gamma> \\<Turnstile> (AssignmentStat (NameLVal vName) e)\"\n  | VarDecl_ty: \"\\<Gamma> \\<Turnstile> (VariableDecl (NameLVal vName) (None))\"\n  | VarInit_ty: \"\\<Gamma> \\<turnstile> e :: \\<Gamma> (vName) \\<Longrightarrow> \\<Gamma> \\<Turnstile> (VariableDecl (NameLVal vName) (Some e))\"\n  | ConstInit_ty: \"\\<Gamma> \\<turnstile> e :: \\<Gamma> (vName) \\<Longrightarrow> \\<Gamma> \\<Turnstile> (ConstantDecl (NameLVal vName) (e))\"\n\ndeclare stmtTyping.intros [intro!]\ninductive_cases [elim!]:\n  \"\\<Gamma> \\<Turnstile> ExitStat\" \"\\<Gamma> \\<Turnstile> ConditionalStat e stmt1 stmt2\" \"\\<Gamma> \\<Turnstile> BlockStat l\" \"\\<Gamma> \\<Turnstile> AssignmentStat n e\" \"\\<Gamma> \\<Turnstile> VariableDecl n e\"\n  \"\\<Gamma> \\<Turnstile> ConstantDecl n e\"\n\n(* The typing environment for the state. It states that a state is correctly typed if and only if the type\n   of all variables in the state correspond with the typing environment. *)\ndefinition stateTyping :: \"typeEnv \\<Rightarrow> state \\<Rightarrow> bool\" (infix \"\\<TTurnstile>\" 50)\n  where \"\\<Gamma> \\<TTurnstile> s \\<longleftrightarrow> (\\<forall>x. getValType (s x) = \\<Gamma> x)\"\n\n(* ============================================================================================================== *)\n(*                                            TYPING SYSTEM PROOF                                                 *)\n(* ============================================================================================================== *)\n\n(* Prove that if the type of a particular variable is a given type, there always exists a concrete value with the\n   matching type to satisfy the constraint. *)\nlemma type_eq_SBIT[simp]:   \"getValType v = SBITty           \\<longleftrightarrow> (\\<exists>b. v = SBIT b)\"   by (cases v) simp_all\nlemma type_eq_UINT[simp]:   \"getValType v = UINTty           \\<longleftrightarrow> (\\<exists>i. v = UINT i)\"   by (cases v) simp_all\nlemma type_eq_SINT[simp]:   \"getValType v = SINTty           \\<longleftrightarrow> (\\<exists>i. v = SINT i)\"   by (cases v) simp_all\nlemma type_eq_IINT[simp]:   \"getValType v = IINTty           \\<longleftrightarrow> (\\<exists>i. v = IINT i)\"   by (cases v) simp_all\nlemma type_eq_VINT[simp]:   \"getValType v = VINTty           \\<longleftrightarrow> (\\<exists>i. v = VINT i)\"   by (cases v) simp_all\nlemma type_eq_BOOL[simp]:   \"getValType v = BOOLty           \\<longleftrightarrow> (\\<exists>i. v = BOOL i)\"   by (cases v) simp_all\nlemma type_eq_STRING[simp]: \"getValType v = STRINGty         \\<longleftrightarrow> (\\<exists>i. v = STRING i)\" by (cases v) simp_all\nlemma type_eq_ERROR[simp]:  \"getValType v = ERRORty          \\<longleftrightarrow> (\\<exists>i. v = ERROR i)\"  by (cases v) simp_all\nlemma type_eq_MATCH[simp]:  \"getValType v = MATCHty          \\<longleftrightarrow> (\\<exists>i. v = MATCH i)\"  by (cases v) simp_all\nlemma type_eq_HEADER[simp]: \"getValType v = HEADERty         \\<longleftrightarrow> (\\<exists>i. v = HEADER i)\" by (cases v) simp_all\nlemma type_eq_HSTACK[simp]: \"(\\<exists>n. getValType v = HSTACKty n) \\<longleftrightarrow> (\\<exists>i. v = HSTACK i)\" by (cases v) simp_all\n\n(* Theorem to state that if expression are well-typed, the result is necessarily also well-typed. *)\ntheorem expr_preservation: \"\\<Gamma> \\<turnstile> expr :: \\<tau> \\<Longrightarrow> eval expr s v \\<Longrightarrow> \\<Gamma> \\<TTurnstile> s \\<Longrightarrow> getValType v = \\<tau>\"\nproof (induction arbitrary: v rule: exprTyping.induct)\n  case (BASE_ty \\<Gamma> b)\n  then show ?case\n  proof (induction b)\n    case (BSBIT x)\n    then show ?case\n      by (metis RBASE baseToVal.simps(2) baseToVal.simps(3) eval_deterministic getBaseType.simps(6) getValType.simps(1) not0_implies_Suc)\n  qed auto\nqed (fastforce simp: stateTyping_def)+\n\n(* If an expression and state are well-typed there is necessarily an evaluation for the expression *)\nlemma expr_progress: \"\\<Gamma> \\<turnstile> e :: \\<tau> \\<Longrightarrow> \\<Gamma> \\<TTurnstile> s \\<Longrightarrow> \\<exists>v. eval e s v\"\nproof (induction rule: exprTyping.induct)\n     case (BASE_ty \\<Gamma> b) thus ?case using RBASE by blast\nnext case (TERNEXPR_ty \\<Gamma> e1 e2 \\<tau> e3) thus ?case by (metis TERNFALSE TERNTRUE expr_preservation type_eq_BOOL)\nnext case (STCKIDX_ty \\<Gamma> e1 e2) thus ?case by (metis STCKIDX expr_preservation getValType.simps(11) ty.inject type_eq_HSTACK)\nnext case (VAR_ty \\<Gamma> vName) thus ?case using NAMEDVAR by blast \nnext case (ULNEB_ty \\<Gamma> e1) thus ?case by (metis ULNEB expr_preservation type_eq_BOOL)\nnext case (BEQUB_ty \\<Gamma> e1 e2) thus ?case by (metis BEQUB expr_preservation type_eq_BOOL)\nnext case (BNEQB_ty \\<Gamma> e1 e2) thus ?case by (metis BNEQB expr_preservation type_eq_BOOL)\nnext case (BFANB_ty \\<Gamma> e1 e2) thus ?case by (metis BFANB expr_preservation type_eq_BOOL)\nnext case (BFORB_ty \\<Gamma> e1 e2) thus ?case by (metis BFORB expr_preservation type_eq_BOOL)\nnext case (BEQUS_ty \\<Gamma> e1 e2) thus ?case by (metis BEQUS expr_preservation type_eq_SINT)\nnext case (BNEQS_ty \\<Gamma> e1 e2) thus ?case by (metis BNEQS expr_preservation type_eq_SINT)\nnext case (BLEQS_ty \\<Gamma> e1 e2) thus ?case by (metis BLEQS expr_preservation type_eq_SINT)\nnext case (BGEQS_ty \\<Gamma> e1 e2) thus ?case by (metis BGEQS expr_preservation type_eq_SINT)\nnext case (BLESS_ty \\<Gamma> e1 e2) thus ?case by (metis BLESS expr_preservation type_eq_SINT)\nnext case (BGRES_ty \\<Gamma> e1 e2) thus ?case by (metis BGRES expr_preservation type_eq_SINT)\nnext case (BEQUU_ty \\<Gamma> e1 e2) thus ?case by (metis BEQUU expr_preservation type_eq_UINT)\nnext case (BNEQU_ty \\<Gamma> e1 e2) thus ?case by (metis BNEQU expr_preservation type_eq_UINT)\nnext case (BLEQU_ty \\<Gamma> e1 e2) thus ?case by (metis BLEQU expr_preservation type_eq_UINT)\nnext case (BGEQU_ty \\<Gamma> e1 e2) thus ?case by (metis BGEQU expr_preservation type_eq_UINT)\nnext case (BLESU_ty \\<Gamma> e1 e2) thus ?case by (metis BLESU expr_preservation type_eq_UINT)\nnext case (BGREU_ty \\<Gamma> e1 e2) thus ?case by (metis BGREU expr_preservation type_eq_UINT)\nnext case (BEQUI_ty \\<Gamma> e1 e2) thus ?case by (metis BEQUI expr_preservation type_eq_IINT)\nnext case (BNEQI_ty \\<Gamma> e1 e2) thus ?case by (metis BNEQI expr_preservation type_eq_IINT)\nnext case (BLEQI_ty \\<Gamma> e1 e2) thus ?case by (metis BLEQI expr_preservation type_eq_IINT)\nnext case (BGEQI_ty \\<Gamma> e1 e2) thus ?case by (metis BGEQI expr_preservation type_eq_IINT)\nnext case (BLESI_ty \\<Gamma> e1 e2) thus ?case by (metis BLESI expr_preservation type_eq_IINT)\nnext case (BGREI_ty \\<Gamma> e1 e2) thus ?case by (metis BGREI expr_preservation type_eq_IINT)\nnext case (BEQUV_ty \\<Gamma> e1 e2) thus ?case by (metis BEQUV expr_preservation type_eq_VINT)\nnext case (BNEQV_ty \\<Gamma> e1 e2) thus ?case by (metis BNEQV expr_preservation type_eq_VINT)\nnext case (UNEGS_ty \\<Gamma> e1) thus ?case by (metis UNEGS expr_preservation type_eq_SINT)\nnext case (UPOSS_ty \\<Gamma> e1) thus ?case by (metis UPOSS expr_preservation type_eq_SINT)\nnext case (BADDS_ty \\<Gamma> e1 e2) thus ?case by (metis BADDS expr_preservation type_eq_SINT)\nnext case (BMINS_ty \\<Gamma> e1 e2) thus ?case by (metis BMINS expr_preservation type_eq_SINT)\nnext case (UNEGU_ty \\<Gamma> e1) thus ?case by (metis UNEGU expr_preservation type_eq_UINT)\nnext case (UPOSU_ty \\<Gamma> e1) thus ?case by (metis UPOSU expr_preservation type_eq_UINT)\nnext case (UCOMU_ty \\<Gamma> e1) thus ?case by (metis UCOMU expr_preservation type_eq_UINT)\nnext case (BADDU_ty \\<Gamma> e1 e2) thus ?case by (metis BADDU expr_preservation type_eq_UINT)\nnext case (BMINU_ty \\<Gamma> e1 e2) thus ?case by (metis BMINU expr_preservation type_eq_UINT)\nnext case (BANDU_ty \\<Gamma> e1 e2) thus ?case by (metis BANDU expr_preservation type_eq_UINT)\nnext case (BXORU_ty \\<Gamma> e1 e2) thus ?case by (metis BXORU expr_preservation type_eq_UINT)\nnext case (BLORU_ty \\<Gamma> e1 e2) thus ?case by (metis BLORU expr_preservation type_eq_UINT)\nnext case (UNEGI_ty \\<Gamma> e1) thus ?case by (metis UNEGI expr_preservation type_eq_IINT)\nnext case (UPOSI_ty \\<Gamma> e1) thus ?case by (metis UPOSI expr_preservation type_eq_IINT)\nnext case (BADDI_ty \\<Gamma> e1 e2) thus ?case by (metis BADDI expr_preservation type_eq_IINT)\nnext case (BMINI_ty \\<Gamma> e1 e2) thus ?case by (metis BMINI expr_preservation type_eq_IINT)\nnext case (BMULI_ty \\<Gamma> e1 e2) thus ?case by (metis BMULI expr_preservation type_eq_IINT)\nnext case (BDIVI_ty \\<Gamma> e1 e2) thus ?case by (metis BDIVI expr_preservation type_eq_IINT)\nnext case (BMODI_ty \\<Gamma> e1 e2) thus ?case by (metis BMODI expr_preservation type_eq_IINT)\nqed\n\n(* Given the type system is well-defined there is necessarily progress to be made (in statements) *)\ntheorem progress: \"\\<Gamma> \\<Turnstile> c \\<Longrightarrow> \\<Gamma> \\<TTurnstile> s \\<Longrightarrow> c \\<noteq> EmptyStat \\<Longrightarrow> \\<exists>cs'. (c, s, n) \\<leadsto> cs'\"\nproof (induction rule: stmtTyping.induct)\n     case (Conditional_ty \\<Gamma> e stmnt1 stmnt2) thus ?case by (smt CondFalse CondTrue expr_preservation expr_progress type_eq_BOOL)\nnext case (BlockFull_ty \\<Gamma> firstStat remainder) thus ?case by (metis (full_types) EmptyFirst FullBlock old.prod.exhaust step_equal_or_smaller)\nnext case (Block_Empty_ty \\<Gamma>) thus ?case using expr_progress by blast\nnext case (Assign_ty \\<Gamma> e vName) thus ?case using expr_progress by blast\nnext case (VarInit_ty \\<Gamma> e vName) thus ?case using expr_progress by blast\nnext case (ConstInit_ty \\<Gamma> e vName) thus ?case using expr_progress by blast\nqed blast+\n\n(* If a state is well-typed, well-typed statements will always yield a well-typed state *)\ntheorem state_preservation: \"(c, s, n) \\<leadsto> (c', s', n') \\<Longrightarrow> \\<Gamma> \\<Turnstile> c \\<Longrightarrow> \\<Gamma> \\<TTurnstile> s \\<Longrightarrow> \\<Gamma> \\<TTurnstile> s'\"\nproof (induct rule: small_step_induct)\n     case (Assign e s v vName n) thus ?case using expr_preservation stateTyping_def by fastforce\nnext case (VarDecl vName s n) thus ?case using expr_preservation stateTyping_def by fastforce\nnext case (VarInit e s v vName n) thus ?case using expr_preservation stateTyping_def by fastforce\nnext case (ConstInit e s v vName n) thus ?case using expr_preservation stateTyping_def by fastforce\nqed blast+\n\n(* If a statement is well-typed, the resulting state is necessarily also well-typed *)\ntheorem stmt_preservation: \"(c, s, n) \\<leadsto> (c', s', n') \\<Longrightarrow> \\<Gamma> \\<Turnstile> c \\<Longrightarrow> \\<Gamma> \\<Turnstile> c'\"\nproof (induction rule: small_step_induct)\n  case (FullBlock stmt s n stmt' s' n' rest) thus ?case\n  proof -\n    have \"\\<Gamma> \\<Turnstile> stmt\" using FullBlock.prems by blast\n    then have \"\\<Gamma> \\<Turnstile> stmt'\" by (simp add: FullBlock.IH \\<open>\\<Gamma> \\<Turnstile> stmt\\<close>)\n    then have \"\\<Gamma> \\<Turnstile> (BlockStat (stmt # rest))\" by (simp add: FullBlock.prems)\n    then have \"\\<Gamma> \\<Turnstile> (BlockStat (stmt' # rest))\" using \\<open>\\<Gamma> \\<Turnstile> stmt'\\<close> by blast\n    thus ?case by auto\n  qed\nqed auto\n\n(* Final proof *)\ntheorem type_sound: \"(c, s, n) \\<leadsto>* (c', s', n') \\<Longrightarrow> \\<Gamma> \\<Turnstile> c \\<Longrightarrow> \\<Gamma> \\<TTurnstile> s \\<Longrightarrow> c' \\<noteq> EmptyStat \\<Longrightarrow> \\<exists>cs''. (c', s', n') \\<leadsto> cs''\"\nproof (induction rule: star_induct)\n     case (refl a a b) thus ?case using progress by auto\nnext case (step a a b a a b a a b) thus ?case using state_preservation stmt_preservation by auto\nqed\n\n(* ============================================================================================================== *)\n(*                                           FINAL STATE PROPERTIES                                               *)\n(* ============================================================================================================== *)\n\n(* Final state is defined as the state from which there is nowhere to go anymore *)\ndefinition \"final cs \\<longleftrightarrow> (\\<nexists>cs'. cs \\<leadsto> cs')\"\n\nlemma EmptyFinal: \"c = EmptyStat \\<Longrightarrow> final (c, s, n)\" using final_def by blast\nlemma FinalEmpty: \"final (c, s, n) \\<Longrightarrow> \\<Gamma> \\<Turnstile> c \\<Longrightarrow> \\<Gamma> \\<TTurnstile> s \\<Longrightarrow> c = EmptyStat\" using final_def progress by blast\n\n(* ============================================================================================================== *)\n(*                                          REACHABILITY PROPERTIES                                               *)\n(* ============================================================================================================== *)\n\ndefinition reachable :: \"statOrDecl \\<Rightarrow> statOrDecl set\" where\n  \"reachable c = {c'. \\<exists>s s' n n'. (c, s, n) \\<leadsto>* (c', s', n')}\"\n\nend", "meta": {"author": "Johanmyst", "repo": "Nano-P4", "sha": "fc3720d7115d0bac5d719cfe6c73a024aae7f9c4", "save_path": "github-repos/isabelle/Johanmyst-Nano-P4", "path": "github-repos/isabelle/Johanmyst-Nano-P4/Nano-P4-fc3720d7115d0bac5d719cfe6c73a024aae7f9c4/Theory_Files/Header_Stack_Verification/NP4_Header_Stack_Action_Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.30736334118347786}}
{"text": "theory flash104Bra  imports flash104Rev\n \n  begin\nlemma onInv104:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv104  iInv1  iInv2 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX1VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_GetXVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ShWbVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX7VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak2VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX5VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_WbVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_GetVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_ReplaceShrVldVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_2VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak2VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_ReplaceVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_HomeVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put2VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX11VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX6VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put2VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvAck_1_HomeVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Nak1VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak1VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak2VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak3VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX10VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX2VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_Get_Put1VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_PutXVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis StoreVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_FAckVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX3VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutXVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put1VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis StoreHomeVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_NakVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_InvVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_PutXVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX4VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_NakVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Local_PutVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_Nak1VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_Nak_ClearVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_PutXVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Nak3VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_GetX_PutX9VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis PI_Remote_GetXVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv104  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3 )\n            by (metis NI_Local_Get_Put3VsInv104 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash104Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723316991792861, "lm_q2_score": 0.45713671682749485, "lm_q1q2_score": 0.3073475055818698}}
{"text": "(*File: Cachera.thy\n  Author: L Beringer & M Hofmann, LMU Munich\n  Date: 05/12/2008\n  Purpose: Strong interpretation of, and derived proof system for,\n           heap analysis a la Cachera/Jensen/Pichardie/Schneider,\n           using invariants.\n*)\n(*<*)\ntheory Cachera imports Logic begin\n(*>*)\n\nsection\\<open>A derived logic for a strong type system\\<close>\n\ntext\\<open>In this section we consider a system of derived assertions, for\na type system for bounded heap consumption. The type system arises by\nreformulating the analysis of Cachera, Jensen, Pichardie, and\nSchneider \\<^cite>\\<open>\"CaJePiSc05MemoryUsage\"\\<close> for a high-level functional\nlanguage. The original approach of Cachera et al.~consists of\nformalising the correctness proof of a certain analysis technique in\nCoq. Consequently, the verification of a program requires the\nexecution of the analysis algorithm inside the theorem prover, which\ninvolves the computation of the (method) call graph and fixed point\niterations.  In contrast, our approach follows the proof-carrying code\nparadigm more closely: the analysis amounts to a type inference which\nis left unformalised and can thus be carried out outside the trusted\ncode base. Only the result of the analysis is communicated to the code\nrecipient.  The recipient verifies the validity of the certificate by\na largely syntax-directed single-pass traversal of the (low-level)\ncode using a domain-specific program logic. This approach to\nproof-carrying code was already explored in the MRG project, with\nrespect to program logics of partial correctness\n\\<^cite>\\<open>\"BeringerHofmannMomiglianoShkaravska:LPAR2004\"\\<close> and a type system\nfor memory consumption by Hofmann and\nJost~\\<^cite>\\<open>\"HofmannJost:POPL2003\"\\<close>. In order to obtain\nsyntax-directedness of the proof rules, these had to be formulated at\nthe granularity of typing judgements. In contrast, the present proof\nsystem admits proof rules for individual JVM instructions.\n\nHaving derived proof rules for individual JVM instructions, we\nintroduce a type system for a small functional language, and a\ncompilation into bytecode.  The type system associates a natural\nnumber $n$ to an expression $e$, in a typing context\n$\\Sigma$. Informally, the interpretation of a typing judgement\n$\\Sigma \\rhd e:n$ is that the evaluation of $e$ (which may include\nthe invocation of functions whose resource behaviour is specified in\n$\\Sigma$) does not perform more than $n$ allocations. The type system\nis then formally proven sound, using the derived logic for bytecode.\nBy virtue of the invariants, the guarantee given by the present system\nis stronger than the one given by our encoding of the Hofmann-Jost\nsystem, as even non-terminating programs can be verified in a\nmeaningful way.\\<close>\n\nsubsection\\<open>Syntax and semantics of judgements\\<close>\n\ntext\\<open>The formal interpretation at JVM level of a type \\<open>n\\<close> is\ngiven by a triple $$\\mathit{Cachera}(n) = (A, B, I)$$ consisting of a\n(trivial) precondition, a post-condition, and a strong invariant.\\<close>\n\ndefinition Cachera::\"nat \\<Rightarrow> (Assn \\<times> Post \\<times> Inv)\" where\n\"Cachera n = (\\<lambda> s0 s . True,\n              \\<lambda> s0 (ops,s,h) (k,v) . |k| \\<le> |h| + n,\n              \\<lambda> s0 (ops,s,h) k.  |k| \\<le> |h| + n)\"\n\ntext\\<open>This definition is motivated by the expectation that $\\rhd\n\\lbrace A \\rbrace\\; \\ulcorner\\, e \\urcorner\\, \\lbrace B \\rbrace\\, I$\nshould be derivable whenever the type judgement $\\Sigma \\rhd e:n$\nholds, where $ \\ulcorner e \\urcorner$ is the translation of compiling\nthe expression $e$ into JVML, and the specification table \\<open>MST\\<close>\ncontains the interpretations of the entries in $\\Sigma$.\\<close>\n\ntext\\<open>We abbreviate the above construction of judgements by a\npredicate \\<open>deriv\\<close>.\\<close>\n\ndefinition deriv::\"CTXT \\<Rightarrow> Class \\<Rightarrow> Method \\<Rightarrow> Label \\<Rightarrow> \n                    (Assn \\<times> Post \\<times> Inv) \\<Rightarrow> bool\" where\n\"deriv G C m l (ABI) = (let (A,B,I) = ABI in (G \\<rhd> \\<lbrace> A \\<rbrace> C,m,l \\<lbrace> B \\<rbrace> I))\"\n\ntext\\<open>Thus, the intended interpretation of a typing judgement $\\Sigma\n\\rhd e: n$ is $$\\mathit{deriv}\\; C\\; m\\; l\\; (\\mathit{Cachera}\\; n)$$\nif $e$ translates to a code block whose first instruction is at\n$C.m.l$.\\<close>\n\ntext\\<open>We also define a judgement of the auxiliary form of\nsequents.\\<close>\n\ndefinition derivAssum::\"CTXT \\<Rightarrow> Class \\<Rightarrow> Method \\<Rightarrow> Label \\<Rightarrow> \n                         (Assn \\<times> Post \\<times> Inv) \\<Rightarrow> bool\" where\n\"derivAssum G C m l (ABI) = (let (A,B,I) = ABI in G \\<rhd>  \\<langle> A \\<rangle> C,m,l \\<langle> B \\<rangle> I)\"\n\ntext\\<open>The following operation converts a derived judgement into the\nsyntactical form of method specifications.\\<close>\n\ndefinition mkSPEC::\"(Assn \\<times> Post \\<times> Inv) \\<Rightarrow> ANNO \\<Rightarrow>\n                   (MethSpec \\<times> MethInv \\<times> ANNO)\" where\n\"mkSPEC (ABI) Anno = (let (A,B,I) = ABI in\n       (\\<lambda> s0 t . B s0 (mkState s0) t, \\<lambda> s0 h . I s0 (mkState s0) h, Anno))\"\n\ntext\\<open>This enables the interpretation of typing contexts $\\Sigma$ as a\nset of constraints on the specification table \\<open>MST\\<close>.\\<close>\n\nsubsection\\<open>Derived proof rules\\<close>\n(*<*)\ndeclare Let_def[simp]\n(*>*)\ntext\\<open>We are now ready to prove derived rules, i.e.~proof rules where\nassumptions as well as conclusions are of the restricted assertion\nform. While their justification unfolds the definition of the\npredicate \\<open>deriv\\<close>, their application will not. We first give\nsyntax-directed proof rules for all JVM instructions:\\<close>\n\nlemma CACH_NEW:\n \"\\<lbrakk> ins_is C m l (new c); MST\\<down>(C,m)=Some(Mspec,Minv,Anno);\n    Anno\\<down>(l) = None; n = k + 1; derivAssum G C m (l+1) (Cachera k) \\<rbrakk>\n \\<Longrightarrow> deriv G C m l (Cachera n)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\napply (rule INSTR) apply assumption+ apply simp apply (simp add: heap_def)\napply fast\napply (erule CONSEQ)\napply (simp add: SP_pre_def) \napply clarsimp apply (simp add: SP_post_def) apply clarsimp\n  apply (drule NewElim1, fastforce) apply clarsimp\n  apply (subgoal_tac \"ba\\<down>(nextLoc ba) = None\")\n    apply (simp add: AL_Size_UpdateSuc) \n  apply (rule nextLoc_fresh)\napply clarsimp\n  apply (simp add: SP_inv_def)\n  apply clarsimp\n  apply (drule NewElim1, fastforce) apply clarsimp\n  apply (subgoal_tac \"ba\\<down>(nextLoc ba) = None\")\n    apply (simp add: AL_Size_UpdateSuc) \n  apply (rule nextLoc_fresh)\ndone\n(*>*)\n\nlemma CACH_INSTR:\n \"\\<lbrakk> ins_is C m l I; \n    I \\<in> { const c, dup, pop, swap, load x, store x, binop f, \n          unop g, getfield d F, putfield d F, checkcast d}; \n    MST\\<down>(C,m)=Some(Mspec,Minv,Anno); Anno\\<down>(l) = None; \n    derivAssum G C m (l+1) (Cachera n) \\<rbrakk>\n \\<Longrightarrow> deriv G C m l (Cachera n)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\napply (rule INSTR) apply assumption+ apply simp apply (simp add: heap_def)\napply fast\napply (erule CONSEQ)\napply (simp add: SP_pre_def) \napply (simp add: SP_post_def) apply clarsimp \napply safe\napply (drule ConstElim1, fastforce) apply clarsimp\napply (drule DupElim1, fastforce) apply clarsimp\napply (drule PopElim1, fastforce) apply clarsimp\napply (drule SwapElim1, fastforce) apply clarsimp\napply (drule LoadElim1, fastforce) apply clarsimp\napply (drule StoreElim1, fastforce) apply clarsimp\napply (drule BinopElim1, fastforce) apply clarsimp\napply (drule UnopElim1, fastforce) apply clarsimp\napply (drule GetElim1, fastforce) apply clarsimp\napply (drule PutElim1, fastforce) apply clarsimp\n  apply (simp add: updSize) \napply (drule CastElim1, fastforce) apply clarsimp\n\napply (simp_all add: SP_inv_def)\napply safe\napply (drule ConstElim1, fastforce) apply clarsimp\napply (drule DupElim1, fastforce) apply clarsimp\napply (drule PopElim1, fastforce) apply clarsimp\napply (drule SwapElim1, fastforce) apply clarsimp\napply (drule LoadElim1, fastforce) apply clarsimp\napply (drule StoreElim1, fastforce) apply clarsimp\napply (drule BinopElim1, fastforce) apply clarsimp\napply (drule UnopElim1, fastforce) apply clarsimp\napply (drule GetElim1, fastforce) apply clarsimp\napply (drule PutElim1, fastforce) apply clarsimp\n  apply (simp add: updSize) \napply (drule CastElim1, fastforce) apply clarsimp\ndone\n(*>*)\n\nlemma CACH_RET: \n \"\\<lbrakk> ins_is C m l vreturn; MST\\<down>(C,m)=Some(Mspec,Minv,Anno); \n    Anno\\<down>(l) = None \\<rbrakk>\n  \\<Longrightarrow> deriv G C m l (Cachera 0)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\napply (rule VRET) apply assumption+  apply simp apply (simp add: heap_def)\napply clarsimp\ndone\n(*>*)\n\nlemma CACH_GOTO:\n \"\\<lbrakk> ins_is C m l (goto pc); MST\\<down>(C,m)=Some(Mspec,Minv,Anno);\n    Anno\\<down>(l) = None; derivAssum G C m pc (Cachera n) \\<rbrakk>\n \\<Longrightarrow> deriv G C m l (Cachera n)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\napply (rule GOTO) apply assumption+ apply simp apply (simp add: heap_def)\napply (erule CONSEQ)\napply (simp add: SP_pre_def) \napply (simp add: SP_post_def) apply clarsimp apply (drule GotoElim1, fastforce)\napply clarsimp\napply (simp add: SP_inv_def) apply clarsimp apply (drule GotoElim1, fastforce)\napply clarsimp\ndone\n(*>*)\n\nlemma CACH_IF:\n  \"\\<lbrakk> ins_is C m l (iftrue pc); MST\\<down>(C,m)=Some(Mspec,Minv,Anno); \n     Anno\\<down>(l) = None; derivAssum G C m pc (Cachera n);\n     derivAssum G C m (l+1) (Cachera n) \\<rbrakk>\n  \\<Longrightarrow> deriv G C m l (Cachera n)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\napply (rule IF) apply assumption+ apply (simp, simp add: heap_def)\napply (erule CONSEQ)\napply (simp add: SP_pre_def)\napply (simp add: SP_post_def) apply clarsimp apply (drule IfElim1, fastforce) apply clarsimp\napply (simp add: SP_inv_def) apply clarsimp  apply (drule IfElim1, fastforce) apply clarsimp\napply clarsimp\napply (erule CONSEQ)\napply (simp add: SP_pre_def)\napply (simp add: SP_post_def) apply clarsimp apply (drule IfElim1, fastforce) apply clarsimp\napply (simp add: SP_inv_def) apply clarsimp  apply (drule IfElim1, fastforce) apply clarsimp\ndone\n(*>*)\n\nlemma CACH_INVS: \n  \"\\<lbrakk> ins_is C m l (invokeS D m'); mbody_is D m' (par,code,l0);\n     MST\\<down>(C,m)=Some(Mspec,Minv,Anno); Anno\\<down>(l) = None; \n     MST\\<down>(D, m') = Some(mkSPEC (Cachera k) Anno2);\n     nk = n+k; derivAssum G C m (l+1) (Cachera n)\\<rbrakk>\n   \\<Longrightarrow> deriv G C m l (Cachera nk)\"\n(*<*)\napply (simp add: ins_is_def Cachera_def deriv_def derivAssum_def, clarsimp)\n\napply (rule INVS) apply assumption+ \napply (simp add: mkSPEC_def) apply fastforce apply simp apply (simp add: heap_def)\napply (simp add: mkState_def)\napply (erule CONSEQ)\napply clarsimp\napply clarsimp apply (simp add: SINV_post_def mkState_def) \napply clarsimp apply (simp add: SINV_inv_def mkState_def) \ndone\n(*>*)\n\ntext\\<open>In addition, we have two rules for subtyping\\<close>\n\nlemma CACH_SUB:\n \"\\<lbrakk> deriv G C m l (Cachera n); n \\<le> k\\<rbrakk> \\<Longrightarrow> deriv G C m l (Cachera k)\"\n(*<*)\napply (simp add: deriv_def derivAssum_def Cachera_def)\napply (rule CONSEQ, assumption+) \napply simp\napply simp\napply simp\ndone\n(*>*)\n\nlemma CACHAssum_SUB:\n \"\\<lbrakk> derivAssum G C m l (Cachera n); n \\<le> k\\<rbrakk>\n  \\<Longrightarrow> derivAssum G C m l (Cachera k)\"\n(*<*)\napply (simp add: derivAssum_def Cachera_def)\napply (rule CONSEQ, assumption+) \napply simp\napply simp\napply simp\ndone\n(*>*)\n\ntext\\<open>and specialised forms of the axiom rule and the injection rule.\\<close>\n\nlemma CACH_AX:\n \"\\<lbrakk> G\\<down>(C,m,l) = Some (Cachera n); MST\\<down>(C,m)=Some(Mspec,Minv,Anno); \n    Anno\\<down>(l) = None\\<rbrakk> \n \\<Longrightarrow> derivAssum G C m l (Cachera n)\"\n(*<*)\napply (simp add: derivAssum_def Cachera_def)\napply (drule AX) apply assumption apply simp apply (simp add: heap_def)\napply (rule CONSEQ) apply assumption+ apply simp apply simp apply simp\ndone\n(*>*)\n\nlemma CACH_INJECT:\n  \"deriv G C m l (Cachera n) \\<Longrightarrow> derivAssum G C m l (Cachera n)\"\n(*<*)\napply (simp add: deriv_def derivAssum_def Cachera_def)\napply (erule INJECT)\ndone\n(*>*)\n\ntext\\<open>Finally, a verified-program rule relates specifications to\njudgements for the method bodies. Thus, even the method specifications\nmay be given as derived assertions (modulo the \\<open>mkSPEC\\<close>-conversion).\\<close>\n\nlemma CACH_VP:\n \"\\<lbrakk> \\<forall> c m par code l0. mbody_is c m (par, code, l0) \\<longrightarrow>\n          (\\<exists> n Anno . MST\\<down>(c,m) = Some(mkSPEC(Cachera n) Anno) \\<and> \n                 deriv G c m l0 (Cachera n));\n    \\<forall> c m l A B I. G\\<down>(c,m,l) = Some(A,B,I) \\<longrightarrow>\n                   (\\<exists> n . (A,B,I) = Cachera n \\<and> deriv G c m l (Cachera n))\\<rbrakk> \n  \\<Longrightarrow> VP\"\n(*<*)\napply (simp add: VP_def) apply (rule_tac x=G in exI, simp add: VP_G_def)\napply safe\n(*G*)\n  apply (erule thin_rl)\n  apply (erule_tac x=C in allE, erule_tac x=m in allE, erule_tac x=l in allE, clarsimp)\n  apply (simp add: deriv_def)\n(*MST*)\napply (rotate_tac 1, erule thin_rl)\napply (erule_tac x=C in allE, erule_tac x=m in allE) \napply(erule_tac x=par in allE, erule_tac x=code in allE, erule_tac x=l0 in allE, clarsimp)\napply (simp add: Cachera_def mkSPEC_def deriv_def, clarsimp)\napply (rule CONSEQ) apply assumption+ \napply simp\napply (simp add: mkPost_def mkState_def)\napply (simp add: mkState_def mkInv_def)\ndone\n(*>*)\n\nsubsection\\<open>Soundness of high-level type system\\<close>\n\ntext\\<open>We define a first-order functional language where expressions\nare stratified into primitive expressions and general expressions. The\nlanguage supports the construction of lists using constructors\n$\\mathit{NilPrim}$ and $\\mathit{ConsPrim}\\; h\\; t$, and includes a\ncorresponding pattern match operation. In order to simplify the\ncompilation, function identifiers are taken to be pairs of class names\nand method names.\\<close>\n\ntype_synonym Fun = \"Class \\<times> Method\"\n\ndatatype Prim =\n  IntPrim int\n| UnPrim \"Val \\<Rightarrow> Val\" Var \n| BinPrim \"Val \\<Rightarrow> Val \\<Rightarrow> Val\" Var Var\n| NilPrim\n| ConsPrim Var Var\n| CallPrim Fun \"Var list\"\n\ndatatype Expr = \n  PrimE Prim\n| LetE Var Prim Expr\n| CondE Var Expr Expr\n| MatchE Var Expr Var Var Expr\n\ntype_synonym FunProg = \"(Fun,Var list \\<times> Expr) AssList\"\n\ntext\\<open>The type system uses contexts that associate a type (natural\nnumber) to function identifiers.\\<close>\n\ntype_synonym TP_Sig = \"(Fun, nat) AssList\"\n\ntext\\<open>We first give the rules for primitive expressions.\\<close>\n\ninductive_set TP_prim::\"(TP_Sig \\<times> Prim \\<times> nat)set\"\nwhere\nTP_int: \"(\\<Sigma>,IntPrim i,0) : TP_prim\"\n|\nTP_un: \"(\\<Sigma>,UnPrim f x,0) : TP_prim\"\n|\nTP_bin: \"(\\<Sigma>,BinPrim f x y,0) : TP_prim\"\n|\nTP_nil: \"(\\<Sigma>,NilPrim,0) : TP_prim\"\n|\nTP_cons: \"(\\<Sigma>,ConsPrim x y,1) : TP_prim\"\n|\nTP_Call: \"\\<lbrakk>\\<Sigma>\\<down>f = Some n\\<rbrakk> \\<Longrightarrow> (\\<Sigma>,CallPrim f args,n) : TP_prim\"\n\ntext\\<open>Next, the rules for general expressions.\\<close>\n\ninductive_set TP_expr::\"(TP_Sig \\<times> Expr \\<times> nat) set\"\nwhere\nTP_sub: \"\\<lbrakk>(\\<Sigma>,e,m):TP_expr; m \\<le> n\\<rbrakk> \\<Longrightarrow> (\\<Sigma>,e,n):TP_expr\"\n|\nTP_prim:\"\\<lbrakk>(\\<Sigma>,p,n):TP_prim\\<rbrakk> \\<Longrightarrow> (\\<Sigma>,PrimE p,n) : TP_expr\"\n|\nTP_let: \"\\<lbrakk>(\\<Sigma>,p,k):TP_prim; (\\<Sigma>,e,m):TP_expr; n = k+m\\<rbrakk> \n        \\<Longrightarrow> (\\<Sigma>,LetE x p e,n) : TP_expr\"\n|\nTP_Cond:\"\\<lbrakk>(\\<Sigma>,e1,n):TP_expr; (\\<Sigma>,e2,n):TP_expr\\<rbrakk> \n        \\<Longrightarrow>(\\<Sigma>,CondE x e1 e2,n) : TP_expr\"\n|\nTP_Match:\"\\<lbrakk>(\\<Sigma>,e1,n):TP_expr; (\\<Sigma>,e2,n):TP_expr \\<rbrakk>\n          \\<Longrightarrow> (\\<Sigma>,MatchE x e1 h t e2,n):TP_expr\"\n\ntext\\<open>A functional program is well-typed if its domain agrees with\nthat of some context such that each function body validates the\ncontext entry.\\<close>\n\ndefinition TP::\"TP_Sig \\<Rightarrow> FunProg \\<Rightarrow> bool\" where\n\"TP \\<Sigma> F = ((\\<forall> f . (\\<Sigma>\\<down>f = None) = (F\\<down>f = None)) \\<and> \n          (\\<forall> f n par e . \\<Sigma>\\<down>f = Some n \\<longrightarrow> F\\<down>f = Some (par,e) \\<longrightarrow> (\\<Sigma>,e,n):TP_expr))\"\n\ntext\\<open>For the translation into bytecode, we introduce identifiers for\na class of lists, the expected field names, and a temporary (reserved)\nvariable name.\\<close> \n\naxiomatization\n  LIST::Class and\n  HD::Field and\n  TL::Field and\n  tmp::Var\n\ntext\\<open>The compilation of primitive expressions extends a code block by\na sequence of JVM instructions that leave a value on the top of the\noperand stack.\\<close>\n\ninductive_set compilePrim::\n  \"(Label \\<times>  (Label,Instr) AssList \\<times> Prim \\<times> ((Label,Instr) AssList \\<times> Label)) set\" \nwhere\ncompileInt: \"(l, code, IntPrim i, (code[l\\<mapsto>(const (IVal i))],l+1)) : compilePrim\"\n|\ncompileUn:\n  \"(l, code, UnPrim f x, (code[l\\<mapsto>(load x)][(l+1)\\<mapsto>(unop f)],l+2)) : compilePrim\"\n|\ncompileBin: \n \"(l, code, BinPrim f x y,\n     (code[l\\<mapsto>(load x)][(l+1)\\<mapsto>(load y)][(l+2)\\<mapsto>(binop f)],l+3)) : compilePrim\"\n|\ncompileNil:\n  \"(l, code, NilPrim, (code[l\\<mapsto>(const (RVal Nullref))],l+1)) : compilePrim\"\n|\ncompileCons:\n  \"(l, code, ConsPrim x y, \n      (code[l\\<mapsto>(load y)][(l+1)\\<mapsto>(load x)]\n           [(l+2)\\<mapsto>(new LIST)][(l+3)\\<mapsto>store tmp]\n           [(l+4)\\<mapsto>load tmp][(l+5)\\<mapsto>(putfield LIST HD)]\n           [(l+6)\\<mapsto>load tmp][(l+7)\\<mapsto>(putfield LIST TL)]\n           [(l+8)\\<mapsto>(load tmp)], l+9)) : compilePrim\"\n|\ncompileCall_Nil:\n  \"(l, code, CallPrim f [],(code[l\\<mapsto>invokeS (fst f) (snd f)],l+1)): compilePrim\"  \n|\ncompileCall_Cons:\n  \"\\<lbrakk> (l+1,code[l\\<mapsto>load x], CallPrim f args, OUT) : compilePrim\\<rbrakk>\n   \\<Longrightarrow> (l, code, CallPrim f (x#args), OUT): compilePrim\"            \n\ntext\\<open>The following lemma shows that the resulting code is an\nextension of the code submitted as an argument, and that the\nnew instructions define a contiguous block.\\<close>\n\nlemma compilePrim_Prop1[rule_format]:\n\"(l, code, p, OUT) : compilePrim \\<Longrightarrow>\n (\\<forall> code1l1 . OUT = (code1, l1) \\<longrightarrow>\n     (l < l1 \\<and> (\\<forall> ll . ll < l \\<longrightarrow> code1\\<down>ll = code\\<down>ll) \\<and> \n       (\\<forall> ll . l \\<le> ll \\<longrightarrow> ll < l1 \\<longrightarrow> (\\<exists> ins . code1\\<down>ll = Some ins))))\"\n(*<*)\napply (erule compilePrim.induct)\napply clarsimp \n  apply rule\n  apply clarsimp apply (rule AL_update2) apply simp \n  apply (rule, rule AL_update1)\napply clarsimp\n  apply rule\n    apply clarsimp\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (simp, simp, simp)\n  apply clarsimp\n    apply (case_tac \"ll=l\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply simp\n    apply (case_tac \"ll=l+1\", clarsimp, rule)\n      apply (simp add: AL_update1)\n    apply simp\n(*BIN*)\n apply clarsimp\n  apply rule\n    apply clarsimp\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (simp, simp, simp, simp)\n  apply clarsimp\n    apply (case_tac \"ll=l\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply (simp, simp)\n    apply (case_tac \"ll=l+1\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply simp\n    apply (case_tac \"ll=l+2\", clarsimp, rule)\n      apply (simp add: AL_update1)\n    apply simp\napply clarsimp \n  apply rule\n    apply clarsimp apply (rule AL_update2) apply simp\n    apply (rule, rule AL_update1) apply simp\napply clarsimp\n  apply rule apply clarsimp\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (simp, simp, simp, simp)\n    apply (simp, simp, simp, simp)\n    apply (simp, simp)\n  apply clarsimp\n    apply (case_tac \"ll=l\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply (simp, simp, simp,simp)\n      apply (simp, simp, simp,simp)\n    apply (case_tac \"ll=l+1\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply (simp, simp, simp,simp)\n      apply (simp, simp, simp)\n    apply (case_tac \"ll=l+2\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (simp add: AL_update1)\n      apply (simp, simp, simp,simp)\n      apply (simp, simp)\n    apply (case_tac \"ll=l+3\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update1) \n      apply (simp, simp, simp,simp)\n      apply simp\n    apply (case_tac \"ll=l+4\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update1) \n      apply (simp, simp, simp,simp)\n    apply (case_tac \"ll=l+5\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update1) \n      apply (simp, simp, simp)\n    apply (case_tac \"ll=l+6\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update1) \n      apply (simp, simp)\n    apply (case_tac \"ll=l+7\", clarsimp, rule)\n      apply (rule AL_update5)\n      apply (rule AL_update1) \n      apply (simp)\n    apply (case_tac \"ll=l+8\", clarsimp, rule)\n      apply (rule AL_update1)\n      apply simp\n(*CALL-NIL*)\napply clarsimp \n  apply (rule, clarsimp)\n    apply (rule AL_update5) apply (simp ,simp)\n  apply (rule, rule AL_update1)\n(*CALL-CONS*)\napply clarsimp\n  apply (rule, clarsimp)\n    apply (rule AL_update5) apply simp apply simp\n  apply clarsimp\n    apply (erule_tac x=ll in allE)+ apply clarsimp \n    apply (case_tac \"l=ll\", clarsimp) apply (rule, rule AL_update1) \n    apply clarsimp\ndone\n(*>*)\n\ntext\\<open>A signature corresponds to a method specification table if all\ncontext entries are represented as \\<open>MST\\<close> entries and method\nnames that are defined in the global program \\<open>P\\<close>.\\<close>\n\ndefinition Sig_good::\"TP_Sig \\<Rightarrow> bool\" where\n\"Sig_good \\<Sigma> =\n (\\<forall> C m n. \\<Sigma>\\<down>(C,m) = Some n \\<longrightarrow> \n    (MST\\<down>(C, m) = Some (mkSPEC (Cachera n) emp) \\<and>\n    (\\<exists> par code l0 . mbody_is C m (par,code,l0))))\"\n\ntext\\<open>This definition requires \\<open>MST\\<close> to associate the\nspecification $$\\mathit{mkSPEC}\\; (\\mathit{Cachera}\\; n)\\;\n\\mathit{emp}$$ to each method to which the type signature associates\nthe type $n$. In particular, this requires the annotation table of\nsuch a method to be empty. Additionally, the global program $P$ is\nrequired to contain a method definition for each method\n(i.e.~function) name occurring in the domain of the signature.\\<close>\n\ntext\\<open>An auxiliary abbreviation that captures when a block of code has\ntrivial annotations and only comprises defined program labels.\\<close>\n\ndefinition Segment::\n  \"Class \\<Rightarrow> Method \\<Rightarrow> Label \\<Rightarrow> Label \\<Rightarrow> (Label,Instr)AssList \\<Rightarrow> bool\"\nwhere\n\"Segment C m l l1 code =\n    (\\<exists> Mspec Minv Anno . MST\\<down>(C,m) = Some(Mspec,Minv,Anno) \\<and> \n      (\\<forall>ll. l \\<le> ll \\<longrightarrow> ll < l1 \\<longrightarrow>\n          Anno\\<down>(ll) = None \\<and> (\\<exists>ins. ins_is C m ll ins \\<and> code\\<down>ll = Some ins)))\"\n\n(*<*)\nlemma Segment_triv:\n  \"\\<lbrakk>Segment C m l l1 code; MST\\<down>(C,m) = Some(Mspec,Minv,Anno); l \\<le> ll; ll < l1\\<rbrakk> \n  \\<Longrightarrow> (Anno\\<down>(ll) = None \\<and> (\\<exists>ins. ins_is C m ll ins \\<and> code\\<down>ll = Some ins))\"\nby (simp add: Segment_def)\n\nlemma Segment_triv1:\n  \"\\<lbrakk>Segment C m l l1 code; MST\\<down>(C,m) = Some(Mspec,Minv,Anno); l \\<le> ll; ll < l1\\<rbrakk> \\<Longrightarrow> Anno\\<down>(ll) = None\"\nby (simp add: Segment_def)\n\nlemma Segment_triv2:\n  \"\\<lbrakk>Segment C m l l1 code; l \\<le> ll; ll < l1\\<rbrakk> \\<Longrightarrow> (\\<exists>ins. ins_is C m ll ins \\<and> code\\<down>ll = Some ins)\"\napply (simp add: Segment_def) apply clarsimp done\n\nlemma Segment_A:\n  \"\\<lbrakk>Segment C m l l1 code; l \\<le> ll; ll < l1\\<rbrakk> \\<Longrightarrow> Segment C m ll l1 code\" by (simp add: Segment_def, clarsimp)\n(*>*)\n\ntext\\<open>The soundness of (the translation of) a function call is proven\nby induction on the list of arguments.\\<close>\n\nlemma Call_SoundAux[rule_format]:\n \"\\<Sigma>\\<down>f = Some n \\<longrightarrow> \n    MST\\<down>(fst f,snd f) = Some(mkSPEC (Cachera n) Anno2) \\<longrightarrow>\n    (\\<exists> par body l0 . mbody_is (fst f) (snd f) (par,body,l0)) \\<longrightarrow>\n       (\\<forall>l code code1 l1 G C m T MI k.\n          (l, code, CallPrim f args, code1, l1) \\<in> compilePrim \\<longrightarrow>\n          MST\\<down>(C, m) = Some (T, MI,Anno) \\<longrightarrow> Segment C m l l1 code1 \\<longrightarrow>\n          derivAssum G C m l1 (Cachera k) \\<longrightarrow> \n          deriv G C m l (Cachera (n+k)))\"\n(*<*)\nsupply [[simproc del: defined_all]]\napply (induct args)\napply clarsimp\n  apply (erule compilePrim.cases) apply (simp,simp,simp, simp, simp, clarsimp)  \n    apply (drule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la\", assumption, simp) apply clarsimp \n  apply (erule conjE)+ apply (erule exE)+ apply (erule conjE)+\n  apply (rule CACH_INVS) \n    apply (simp add: AL_update1) apply clarsimp apply fast\n    apply assumption\n    apply assumption\n    apply assumption\n    apply assumption\n    apply simp\n    apply simp\n  apply simp\n(*CONS*)\n  apply clarsimp\n  apply (erule compilePrim.cases) apply (simp, simp, simp, simp, simp, simp) apply clarsimp\n  apply (erule impE) apply fast\n  apply (erule_tac x=\"la+1\" in allE, rotate_tac -1)\n  apply (erule_tac x=\"codea[la\\<mapsto>load x]\" in allE, rotate_tac -1)\n  apply (erule_tac x=ab in allE, rotate_tac -1)\n  apply (erule_tac x=ba in allE, clarsimp)\n  apply (erule_tac x=G in allE, rotate_tac -1)\n  apply (erule_tac x=C in allE, rotate_tac -1)\n  apply (erule_tac x=m in allE, clarsimp)\n  apply (frule compilePrim_Prop1) apply fastforce apply clarsimp \n  apply (erule impE, erule Segment_A) apply simp apply simp \n    apply (drule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la\", assumption, simp) apply clarsimp \n  apply (erule conjE)+ apply (erule exE)+ apply (erule conjE)+\n  apply (rule CACH_INSTR) apply assumption \n    apply (rotate_tac -5, erule_tac x=la in allE, clarsimp)   apply (simp add: AL_update1) \n      apply clarsimp apply fast\n    apply assumption\n    apply assumption\n  apply (rule CACH_INJECT)\n  apply simp\ndone\n(*>*)\n\nlemma Call_Sound:\n \"\\<lbrakk> Sig_good \\<Sigma>; \\<Sigma>\\<down>f = Some n; \n   (l, code, CallPrim f args, code1, l1) \\<in> compilePrim;\n   MST\\<down>(C,m) = Some (T, MI,Anno); Segment C m l l1 code1;\n   derivAssum G C m l1 (Cachera nn); k = n+nn\\<rbrakk> \n \\<Longrightarrow> deriv G C m l (Cachera k)\"\n(*<*)\napply (case_tac f, clarsimp)\napply (rule Call_SoundAux)\napply assumption apply (simp add: Sig_good_def) apply (simp add: Sig_good_def) \napply assumption apply assumption apply assumption apply assumption \ndone\n(*>*)\n \ntext\\<open>The definition of basic instructions.\\<close>\n\ndefinition basic::\"Instr \\<Rightarrow> bool\" where\n\"basic ins = ((\\<exists> c . ins = const c) \\<or> ins = dup \\<or> \n              ins= pop \\<or> ins= swap \\<or> (\\<exists> x. ins= load x) \\<or>\n              (\\<exists> y. ins= store y) \\<or> (\\<exists> f. ins= binop f) \\<or>\n              (\\<exists> g. ins= unop g) \\<or> (\\<exists> c1 F1. ins= getfield c1 F1) \\<or>\n              (\\<exists> c2 F2. ins=  putfield c2 F2) \\<or>\n              (\\<exists> c3. ins=  checkcast c3))\"\n\ntext\\<open>Next, we prove the soundness of basic instructions. The\nhypothesis refers to instructions located at the program\ncontinuation.\\<close>\n\nlemma Basic_Sound: \n  \"\\<lbrakk> Segment C m l ll code; MST\\<down>(C,m) = Some (T, MI,Anno); l\\<le>l1; l1 < ll;\n     l2=l1+1; code\\<down>l1 = Some ins; basic ins; derivAssum G C m l2 (Cachera n)\\<rbrakk>\n   \\<Longrightarrow> deriv G C m l1 (Cachera n)\"\n(*<*)\napply (drule Segment_triv) apply assumption+ apply clarsimp  apply (simp add: basic_def)\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp \napply (erule disjE, clarsimp) apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp\napply clarsimp apply (erule CACH_INSTR) apply fast apply assumption apply assumption apply simp \ndone\n(*>*)\n\ntext\\<open>Following this, the soundness of the type system for primitive\nexpressions. The proof proceeds by induction on the typing\njudgement.\\<close>\n\nlemma TP_prim_Sound[rule_format]:\n  \"(\\<Sigma>,p,n):TP_prim \\<Longrightarrow> \n   Sig_good \\<Sigma> \\<longrightarrow>\n   (\\<forall> l code code1 l1 G C m T MI Anno nn k.\n         (l, code, p, (code1,l1)) : compilePrim \\<longrightarrow> \n         MST\\<down>(C,m) = Some (T,MI,Anno) \\<longrightarrow>\n         Segment C m l l1 code1 \\<longrightarrow> derivAssum G C m l1 (Cachera nn) \\<longrightarrow> \n         k = n+nn \\<longrightarrow> deriv G C m l (Cachera k))\"\n(*<*)\napply (erule TP_prim.induct)\n(*INT*)\napply clarsimp apply (erule thin_rl)\n  apply (erule compilePrim.cases, simp_all, clarsimp)\n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp,simp) apply simp\n  apply (simp add: AL_update1)\n  apply (simp add: basic_def)\n  apply assumption\n(*UN*) \napply clarsimp apply (erule thin_rl)\n  apply (erule compilePrim.cases, simp_all, clarsimp)\n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) \n  apply simp \n  apply (rule AL_update5) apply (simp add: AL_update1) apply simp\n  apply (simp add: basic_def)\n  apply (rule CACH_INJECT) \n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) \n  apply simp \n  apply (simp add: AL_update1) \n  apply (simp add: basic_def)\n   apply (subgoal_tac \"la+2=2+la\", clarsimp,simp)\n(*BIN*)\napply clarsimp apply (erule thin_rl)\n  apply (erule compilePrim.cases, simp_all, clarsimp)\n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp \n  apply (rule AL_update5) apply (rule AL_update5) apply (simp add: AL_update1) apply (simp, simp)\n  apply (simp add: basic_def)\n  apply (rule CACH_INJECT) \n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) \n  apply simp \n  apply (rule AL_update5) apply (simp add: AL_update1) apply simp\n  apply (simp add: basic_def)\n  apply (rule CACH_INJECT) \n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) \n  apply simp \n  apply (rule AL_update1a) apply simp\n  apply (simp add: basic_def)\n   apply (subgoal_tac \"la+3=3+la\", clarsimp, simp)\n(*Nil*)\napply clarsimp apply (erule thin_rl)\n  apply (erule compilePrim.cases, simp_all, clarsimp)\n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp,simp) apply simp \n  apply (simp add: AL_update1)\n  apply (simp add: basic_def)\n  apply assumption\n(*CONS*)\napply clarsimp apply (erule thin_rl)\n  apply (erule compilePrim.cases, simp_all, clarsimp)\n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n  apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n    apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n    apply (simp add: AL_update1) apply (simp,simp,simp,simp) apply (simp,simp,simp,simp)\n  apply (simp add: basic_def)\n  apply (rule CACH_INJECT) \n  apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n  apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n    apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n    apply (simp add: AL_update1) apply (simp,simp,simp,simp) apply (simp,simp,simp)\n  apply (simp add: basic_def)\n  apply (rule CACH_INJECT) \n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la+2\", assumption, simp) \n    apply simp \n  apply (subgoal_tac \"la+2=2+la\", clarsimp)\n    apply (drule AL_update3, simp) \n    apply (drule AL_update3, simp) \n    apply (drule AL_update3, simp) \n    apply (drule AL_update3, simp) \n    apply (drule AL_update3, simp) \n    apply (drule AL_update3, simp) apply (simp add: AL_update1) apply clarsimp\n    apply (rule CACH_NEW) apply assumption+\n      apply (simp, simp)\n    apply (rule CACH_INJECT) \n    apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n      apply (rule AL_update5)\n      apply (rule AL_update1a) apply simp apply (simp,simp,simp,simp) apply simp\n      apply (simp add: basic_def)\n    apply (rule CACH_INJECT) \n    apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n        apply (rule AL_update1a) apply simp apply (simp,simp,simp,simp) \n    apply (simp add: basic_def)\n    apply (rule CACH_INJECT) \n      apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n        apply (rule AL_update1a) apply simp apply (simp,simp,simp) \n        apply (simp add: basic_def)\n    apply (rule CACH_INJECT) \n    apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update5) apply (rule AL_update5) \n        apply (rule AL_update1a) apply simp apply (simp,simp) \n        apply (simp add: basic_def)\n    apply (rule CACH_INJECT) \n    apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update5) \n        apply (rule AL_update1a) apply simp apply simp\n        apply (simp add: basic_def)\n    apply (rule CACH_INJECT) \n    apply (rule Basic_Sound) apply assumption apply assumption apply (simp, simp) apply simp\n      apply (rule AL_update1a) apply simp \n      apply (simp add: basic_def)\n      apply (subgoal_tac \"la+9=9+la\", clarsimp, simp)\n  apply simp\n(*Call*)\napply clarsimp\n  apply (rule Call_Sound) apply assumption+ apply simp\ndone\n(*>*)\n\ntext\\<open>The translation of general expressions is defined similarly, but\nno code continuation is required.\\<close>\n\ninductive_set compileExpr::\n  \"(Label \\<times> (Label,Instr) AssList \\<times> Expr \\<times> ((Label,Instr) AssList \\<times> Label)) set\"\nwhere\ncompilePrimE: \n \"\\<lbrakk>(l, code, p, (code1,l1)) : compilePrim; OUT = (code1[l1\\<mapsto>vreturn],l1+1)\\<rbrakk>\n   \\<Longrightarrow> (l, code, PrimE p, OUT):compileExpr\"\n|\ncompileLetE:\n  \"\\<lbrakk>(l, code, p, (code1,l1)) : compilePrim; (code2,l2) = (code1[l1\\<mapsto>(store x)],l1+1);\n     (l2, code2, e, OUT) : compileExpr\\<rbrakk>\n   \\<Longrightarrow> (l, code, LetE x p e, OUT) : compileExpr\"\n|\ncompileCondE:\n  \"\\<lbrakk>(l+2, code, e2, (codeElse,XXX)) : compileExpr;\n     (XXX, codeElse, e1, (codeThen,YYY) ) : compileExpr ;\n     OUT = (codeThen[l\\<mapsto>load x][(l+1)\\<mapsto>(iftrue XXX)], YYY)\\<rbrakk>\n   \\<Longrightarrow> (l, code, CondE x e1 e2, OUT): compileExpr\" \n|                                                                        \ncompileMatchE:\n  \"\\<lbrakk>(l+9, code, e2, (codeCons,lNil)) : compileExpr;\n     (lNil, codeCons, e1, (codeNil,lRes) ) : compileExpr ;\n     OUT = (codeNil[l\\<mapsto>(load x)]\n                   [(l+1)\\<mapsto>(unop (\\<lambda> v . if v = RVal Nullref\n                                 then TRUE else FALSE))]\n                   [(l+2)\\<mapsto>(iftrue lNil)]\n                   [(l+3)\\<mapsto>(load x)]\n                   [(l+4)\\<mapsto>(getfield LIST HD)]\n                   [(l+5)\\<mapsto>(store h)]\n                   [(l+6)\\<mapsto>(load x)]\n                   [(l+7)\\<mapsto>(getfield LIST TL)]\n                   [(l+8)\\<mapsto>(store t)], lRes) \\<rbrakk>\n   \\<Longrightarrow> (l, code, MatchE x e1 h t e2, OUT): compileExpr\"\n\ntext\\<open>Again, we prove an auxiliary result on the emitted code, by\ninduction on the compilation judgement.\\<close>\n\nlemma compileExpr_Prop1[rule_format]:\n\"(l,code,e,OUT) : compileExpr \\<Longrightarrow> \n  (\\<forall> code1 l1 . OUT = (code1, l1) \\<longrightarrow> \n      (l < l1 \\<and> \n       (\\<forall> ll . ll < l \\<longrightarrow> code1\\<down>ll = code\\<down>ll) \\<and> \n       (\\<forall> ll . l \\<le> ll \\<longrightarrow> ll < l1 \\<longrightarrow> (\\<exists> ins . code1\\<down>ll = Some ins))))\"\n(*<*)\napply (erule compileExpr.induct)\n(*PRIM*)\napply clarsimp apply (drule compilePrim_Prop1) apply fastforce  apply clarsimp\n  apply rule apply clarsimp apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule AL_update5) apply simp \n  apply clarsimp apply (case_tac \"ll < l1\", clarsimp) \n      apply (rotate_tac 1, erule_tac x=ll in allE, clarsimp) \n        apply (rule, erule AL_update5) apply simp \n  apply (subgoal_tac \"ll= l1\", clarsimp) apply (rule, simp add: AL_update1) apply simp\n(*LET*)\napply clarsimp\n  apply (drule compilePrim_Prop1) apply fastforce apply clarsimp\n  apply rule apply clarsimp\n    apply (rule AL_update5) apply simp apply simp\n  apply clarsimp apply (erule_tac x=ll in allE)+ apply clarsimp \n    apply (case_tac \"ll <l1\", clarsimp) apply (rule, erule AL_update5) apply simp\n     apply (subgoal_tac \"ll=l1\", clarsimp)\n     apply (simp add: AL_update1) apply simp\n(*COND*)\napply clarsimp \n  apply (rule, clarsimp)\n    apply (rule AL_update5)\n    apply (rule AL_update5) apply (simp ,simp)\n    apply simp\n  apply clarsimp\n    apply (case_tac \"ll=l+1\", clarsimp, rule) apply(rule AL_update1)\n    apply (case_tac \"ll=l\", clarsimp, rule) \n      apply (rule AL_update5) apply(simp add: AL_update1) apply simp\n    apply (case_tac \"XXX \\<le> ll\", clarsimp)\n      apply (rotate_tac -3, erule_tac x=ll in allE, clarsimp)\n        apply rule apply (rule AL_update5) apply (erule AL_update5) apply (simp, simp)\n    apply clarsimp \n      apply (rotate_tac -6, erule_tac x=ll in allE, clarsimp)\n      apply (rotate_tac -2, erule_tac x=ll in allE, clarsimp)\n        apply rule apply (rule AL_update5) apply (erule AL_update5) apply (simp, simp)\n(*Match*)\napply clarsimp \n  apply (rule, clarsimp)\n    apply (rule AL_update5)\n    apply (rule AL_update5) \n    apply (rule AL_update5)\n    apply (rule AL_update5)\n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5)\n    apply (rule AL_update5) \n    apply (rule AL_update5) apply (simp ,simp, simp) apply (simp ,simp, simp) apply (simp ,simp, simp)\n    apply simp\n  apply clarsimp\n    apply (case_tac \"ll=l+8\", clarsimp, rule) apply(simp add: AL_update1)\n    apply (case_tac \"ll=l+7\", clarsimp, rule) apply (rule AL_update5) apply(simp add: AL_update1) apply simp\n    apply (case_tac \"ll=l+6\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply(simp add: AL_update1) apply simp apply simp\n    apply (case_tac \"ll=l+5\", clarsimp, rule) apply (rule AL_update5)  apply (rule AL_update5) \n      apply (rule AL_update5)  apply(simp add: AL_update1) apply (simp,simp,simp)\n    apply (case_tac \"ll=l+4\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply(simp add: AL_update1) apply (simp,simp,simp,simp)\n    apply (case_tac \"ll=l+3\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply(simp add: AL_update1)\n      apply (simp,simp,simp,simp,simp)\n    apply (case_tac \"ll=l+2\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n      apply(simp add: AL_update1)\n      apply (simp,simp,simp,simp,simp, simp)\n    apply (case_tac \"ll=l+1\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply(simp add: AL_update1) \n      apply (simp,simp,simp,simp,simp, simp, simp) \n    apply (case_tac \"ll=l\", clarsimp, rule) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n      apply (rule AL_update5) apply (rule AL_update5) apply(simp add: AL_update1) apply (simp, simp)\n      apply (simp,simp,simp,simp,simp, simp)\n    apply (case_tac \"lNil \\<le> ll\", clarsimp)\n      apply (rotate_tac -3, erule_tac x=ll in allE, clarsimp)\n        apply rule apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n            apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n            apply (rule AL_update5) apply (rule AL_update5) apply (erule AL_update5)\n          apply (simp, simp, simp)\n          apply (simp, simp, simp)\n          apply (simp, simp, simp)\n(*   apply simp*)\n      apply (rotate_tac 5) apply( erule_tac x=ll in allE, erule impE) apply (erule thin_rl) \n         apply (erule thin_rl) apply (rotate_tac -1, erule thin_rl)\n         apply (rotate_tac -1, erule thin_rl) \n         apply (rotate_tac -1, erule thin_rl) \n         apply (rotate_tac -1, erule thin_rl) \n         apply (rotate_tac -1, erule thin_rl) apply simp \n         apply (subgoal_tac \"ll < lNil\")\n         prefer 2 apply(  erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, rotate_tac 1, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) apply simp\n         apply (erule impE, assumption) \n      apply (erule_tac x=ll in allE, erule impE, assumption)\n      apply (erule exE)\n        apply rule apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n         apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5) \n         apply (rule AL_update5) apply (rule AL_update5) apply (rule AL_update5)\n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl)  \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) \n           apply (erule thin_rl, erule thin_rl) apply simp\n          apply fast+ \ndone\n(*>*)\n\ntext\\<open>Then, soundness of the epxression type system is proven by\ninduction on the typing judgement.\\<close>\n\nlemma TP_epxr_Sound[rule_format]:\n\"(\\<Sigma>,e,n):TP_expr \\<Longrightarrow> Sig_good \\<Sigma> \\<longrightarrow>\n (\\<forall> l code code1 l1 G C m T MI Anno.\n    (l, code, e, (code1,l1)):compileExpr \\<longrightarrow>\n    MST\\<down>(C,m) = Some (T,MI,Anno) \\<longrightarrow>\n    Segment C m l l1 code1 \\<longrightarrow> deriv G C m l (Cachera n))\"\n(*<*)\nsupply [[simproc del: defined_all]]\napply (erule TP_expr.induct)\n(*SUB*)\napply clarsimp\n   apply (rotate_tac 2, erule thin_rl, rotate_tac -2)\n   apply (erule_tac x=l in allE, erule_tac x=code in allE)\n   apply (erule_tac x=code1 in allE, rotate_tac -1, erule_tac x=l1 in allE, clarsimp)\n   apply (erule_tac x=G in allE, erule_tac x=C in allE)\n   apply (erule_tac x=ma in allE, clarsimp)\n   apply (erule CACH_SUB) apply assumption\n(*PRIM*)\napply clarsimp \n  apply (erule compileExpr.cases) \n  prefer 2 apply simp\n  prefer 2 apply simp\n  prefer 2 apply simp\n  apply clarsimp \n  apply (erule TP_prim_Sound) apply fast  apply assumption+\n     apply (simp add: Segment_def, clarsimp)\n     apply (erule_tac x=ll in allE, clarsimp) \n       apply (drule AL_update3) apply simp \n       apply (rule, rule, assumption, assumption)\n     prefer 2 apply simp\n  apply (simp add: Segment_def)\n     apply (erule_tac x=l1a in allE, simp) apply (erule impE)\n       apply (drule compilePrim_Prop1) apply fastforce   apply simp\n     apply clarsimp  \n     apply (simp add: AL_update1, clarsimp)\n     apply (rule CACH_INJECT)\n     apply (erule CACH_RET)  apply assumption apply assumption\n(*LET*)\napply clarsimp \n  apply (erule compileExpr.cases) \n  apply simp\n  prefer 2 apply simp\n  prefer 2 apply simp\n  apply clarsimp\n  apply (frule compilePrim_Prop1) apply fastforce\n  apply (frule compileExpr_Prop1) apply fastforce apply clarsimp \n  apply (erule_tac x=\"l1a+1\" in allE, erule_tac x=\"code1a[l1a\\<mapsto>store xa]\" in allE, \n         erule_tac x=a in allE, rotate_tac -1)\n  apply (erule_tac x=b in allE, clarsimp)\n  apply (erule_tac x=G in allE, erule_tac x=C in allE, erule_tac x=ma in allE, clarsimp)\n  apply (erule impE) apply (erule Segment_A) apply (simp,simp)\n  apply (rule TP_prim_Sound) apply assumption apply assumption\n       apply assumption apply assumption \n         apply (simp add: Segment_def) apply clarsimp apply (erule_tac x=ll in allE, clarsimp) apply (rule, rule, assumption)\n          apply(drule AL_update3) apply simp apply assumption\n    prefer 2 apply simp\n  apply (rule CACH_INJECT)\n    apply (rule Basic_Sound) prefer 2 apply assumption prefer 4 apply simp prefer 2 apply (subgoal_tac \"l1a \\<le> l1a\", assumption, simp)\n    prefer 3 apply (subgoal_tac \"a\\<down>l1a = Some(store xa)\", assumption)\n         apply (rotate_tac -3, erule_tac x=l1a in allE, clarsimp) apply (simp add: AL_update1)\n    apply (subgoal_tac \"Segment C ma l1a b a\", assumption) apply (erule Segment_A) apply (simp,simp) \n    apply simp\n    apply (simp add: basic_def)\n    apply (erule CACH_INJECT)\n(*Cond*)\napply clarsimp\n  apply (erule compileExpr.cases) \n  apply simp apply simp prefer 2 apply simp\n  apply clarsimp\n  apply (erule_tac x=XXX in allE, erule_tac x= codeElse in allE, \n         erule_tac x=codeThen in allE, rotate_tac -1) \n  apply (erule_tac x= YYY in allE, clarsimp)\n  apply (erule_tac x=G in allE, rotate_tac -1, erule_tac x=C in allE,\n         erule_tac x=m in allE, clarsimp)\n  apply (erule_tac x=\"la+2\" in allE, erule_tac x= codea in allE, \n         erule_tac x=codeElse in allE, rotate_tac -1) \n  apply (erule_tac x= XXX in allE, clarsimp)\n  apply (erule_tac x=G in allE, rotate_tac -1, erule_tac x=C in allE,\n         erule_tac x=m in allE, clarsimp)\n  apply (drule compileExpr_Prop1) apply fastforce apply clarsimp \n  apply (drule compileExpr_Prop1) apply fastforce apply clarsimp \n  apply (erule impE) apply (rotate_tac 5, erule thin_rl, simp add: Segment_def,clarsimp)\n    apply (rotate_tac -3, erule_tac x=ll in allE, clarsimp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp) apply (rule, rule, assumption, assumption)\n  apply (erule impE) apply (simp add: Segment_def,clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp) apply clarsimp\n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la\", assumption, simp) apply simp\n  apply clarsimp\n  apply (drule AL_update3) apply simp apply (simp add: AL_update1) apply clarsimp\n  apply (rule CACH_INSTR) \n    apply assumption    \n    apply fast\n    apply assumption\n    apply assumption\n  apply (rule CACH_INJECT)\n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la+1\", assumption, simp) apply simp\n  apply clarsimp\n  apply (simp add: AL_update1) apply clarsimp\n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> XXX\", assumption, simp) apply simp\n  apply clarsimp\n  apply (drule AL_update3, simp)\n  apply (drule AL_update3, simp)\n  apply (rule CACH_IF) \n    apply assumption \n    apply assumption\n    apply assumption\n    apply (erule CACH_INJECT) \n    apply (subgoal_tac \"la+2=2+la\", clarsimp) apply (erule CACH_INJECT) apply simp\n(*Match*)\napply clarsimp\n  apply (erule compileExpr.cases) \n  apply simp apply simp apply simp\n  apply clarsimp\n  apply (erule_tac x=lNil in allE, erule_tac x= codeCons in allE, \n         erule_tac x=codeNil in allE, rotate_tac -1) \n  apply (erule_tac x=lRes in allE, clarsimp)\n  apply (erule_tac x=G in allE, rotate_tac -1, erule_tac x=C in allE,\n         erule_tac x=m in allE, clarsimp)\n  apply (erule_tac x=\"la+9\" in allE, erule_tac x=codea in allE, \n         erule_tac x=codeCons in allE, rotate_tac -1) \n  apply (erule_tac x=lNil in allE, clarsimp)\n  apply (erule_tac x=G in allE, rotate_tac -1, erule_tac x=C in allE,\n         erule_tac x=m in allE, clarsimp)\n  apply (drule compileExpr_Prop1) apply fastforce apply clarsimp \n  apply (drule compileExpr_Prop1) apply fastforce apply clarsimp \n  apply (erule impE) apply (rotate_tac 5, erule thin_rl)\n    apply (simp add: Segment_def, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp) apply clarsimp\n  apply (erule impE) \n    apply (simp add: Segment_def, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (erule_tac x=ll in allE, clarsimp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp) apply clarsimp\n  apply (rule Basic_Sound) prefer 2 apply assumption prefer 4 apply simp prefer 2 apply (subgoal_tac \"la \\<le> la\", assumption, simp)\n    apply (erule Segment_A) apply simp apply simp apply simp\n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (simp add: AL_update1)  apply (simp, simp, simp) apply (simp, simp, simp)  apply (simp, simp)\n    apply (simp add: basic_def)\n    apply (rule CACH_INJECT)\n  apply (rule Basic_Sound) prefer 2 apply assumption prefer 4 apply simp prefer 2 apply (subgoal_tac \"la +1 \\<le> la+1\", assumption, simp)\n    apply (erule Segment_A) apply simp apply simp apply simp\n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5) \n    apply (rule AL_update5)\n    apply (simp add: AL_update1)  apply (simp, simp, simp) apply (simp, simp, simp)  apply simp\n    apply (simp add: basic_def)\n    apply (rule CACH_INJECT)\n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> lNil\", assumption, simp, simp)\n  apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> la+3\", assumption, simp, simp)\n  apply clarsimp\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (subgoal_tac \"la+3=3+la\", clarsimp) prefer 2 apply simp\n    apply (simp add: AL_update1) apply clarsimp\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (frule Segment_triv) apply assumption apply (subgoal_tac \"la \\<le> 2+la\", assumption, simp, simp,clarsimp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (drule AL_update3, simp)\n    apply (simp add: AL_update1a, clarsimp)    \n    apply (rule CACH_IF)\n      apply assumption\n      apply assumption\n      apply assumption\n      apply (erule CACH_INJECT)\n    apply simp\n    apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption\n      prefer 2 apply (subgoal_tac \"3+la \\<le> 3+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (simp add: AL_update1) \n      apply (simp,simp,simp)\n      apply (simp,simp)\n      apply (simp add: basic_def)\n    apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption \n      prefer 2 apply (subgoal_tac \"4+la \\<le> 4+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update1a) apply simp\n      apply (simp,simp,simp)\n      apply simp\n      apply (simp add: basic_def)\n      apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption\n      prefer 2 apply (subgoal_tac \"5+la \\<le> 5+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update1a) apply simp\n      apply (simp,simp,simp)\n      apply (simp add: basic_def)\n      apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption\n      prefer 2 apply (subgoal_tac \"6+la \\<le> 6+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update5) \n      apply (rule AL_update5) \n      apply (rule AL_update1a) apply simp\n      apply (simp,simp)\n      apply (simp add: basic_def)\n      apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption\n      prefer 2 apply (subgoal_tac \"7+la \\<le> 7+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update5)\n      apply (rule AL_update1a) apply simp\n      apply simp\n      apply (simp add: basic_def)\n      apply (rule CACH_INJECT)\n    apply (rule Basic_Sound)\n      prefer 2 apply assumption\n      prefer 2 apply (subgoal_tac \"8+la \\<le> 8+la\", assumption, simp)\n      apply (erule Segment_A) apply (simp,simp)\n      apply simp\n      apply simp \n      apply (rule AL_update1a) apply simp\n      apply (simp add: basic_def)\n    apply (rule CACH_INJECT) apply (subgoal_tac \"la+9=9+la\", clarsimp)\n    apply simp\ndone\n(*>*)\n\ntext\\<open>The full translation of a functional program into a bytecode\nprogram is defined as follows.\\<close>\n\ndefinition compileProg::\"FunProg \\<Rightarrow> bool\" where\n\"compileProg F =\n  ((\\<forall> C m par e. F\\<down>(C,m) = Some(par,e) \\<longrightarrow> \n          (\\<exists> code l0 l. mbody_is C m (rev par,code,l0) \\<and>\n                       (l0,[],e,(code,l)):compileExpr)) \\<and>\n   (\\<forall> C m. (\\<exists> M. mbody_is C m M) = (\\<exists> fdecl . F\\<down>(C,m) = Some fdecl)))\"\n\ntext\\<open>The final condition relating a typing context to a method\nspecification table.\\<close>\n\ndefinition TP_MST::\"TP_Sig \\<Rightarrow> bool\" where\n\"TP_MST \\<Sigma> =\n   (\\<forall> C m . case (MST\\<down>(C,m)) of\n            None \\<Rightarrow> \\<Sigma>\\<down>(C,m) = None\n          | Some(T,MI,Anno) \\<Rightarrow> Anno = emp \\<and> \n                                (\\<exists> n . \\<Sigma>\\<down>(C,m)=Some n \\<and> \n                                (T,MI,Anno) = mkSPEC (Cachera n) emp))\"\n\ntext\\<open>For well-typed programs, this property implies the earlier\ncondition on signatures.\\<close>\n\nlemma translation_good: \"\\<lbrakk>compileProg F; TP_MST \\<Sigma>; TP \\<Sigma> F\\<rbrakk> \\<Longrightarrow> Sig_good \\<Sigma>\"\n(*<*)\napply (simp add: compileProg_def TP_MST_def Sig_good_def TP_def, clarsimp)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (case_tac \"MST\\<down>(C,m)\", clarsimp,clarsimp)\ndone\n(*>*)\n\ntext\\<open>We can thus prove that well-typed function bodies satisfy the\nspecifications asserted by the typing context.\\<close>\n\nlemma CACH_BodiesDerivable[rule_format]:\n  \"\\<lbrakk> mbody_is C m (par, code, l); compileProg F; TP_MST \\<Sigma>; TP \\<Sigma> F\\<rbrakk> \n  \\<Longrightarrow> \\<exists> n . MST\\<down>(C,m) = Some(mkSPEC(Cachera n) emp) \\<and> \n            deriv [] C m l (Cachera n)\"\n(*<*)\napply (subgoal_tac \"(\\<forall> C m par e. F\\<down>(C,m) = Some(par,e) \\<longrightarrow> \n                     (\\<exists> code l0 l. mbody_is C m (rev par,code,l0) \\<and>\n                                   (l0,[],e,(code,l)):compileExpr)) \\<and>\n                 (\\<forall> C m . (\\<exists> M. mbody_is C m M) = (\\<exists> fdecl . F\\<down>(C,m) = Some fdecl))\")\nprefer 2 apply (simp add: compileProg_def, clarsimp)\napply (erule_tac x=C in allE, erule_tac x=m in allE)\napply (erule_tac x=C in allE, erule_tac x=m in allE, auto)\napply (simp add: mbody_is_def, clarsimp)\napply (subgoal_tac \"((\\<Sigma>\\<down>(C,m) = None) = (F\\<down>(C,m) = None)) \\<and> \n                       (\\<forall> n par e . \\<Sigma>\\<down>(C,m) = Some n \\<longrightarrow> F\\<down>(C,m) = Some (par,e) \\<longrightarrow> (\\<Sigma>,e,n):TP_expr)\")\nprefer 2 apply (simp add: TP_def, clarsimp)\napply (subgoal_tac \"MST\\<down>(C, m) = Some (mkSPEC (Cachera y) emp)\", clarsimp)\nprefer 2 apply (simp add: TP_MST_def) \n  apply (erule_tac x=C in allE, erule_tac x=m in allE)\n  apply (case_tac \"MST\\<down>(C, m)\", clarsimp, clarsimp)\napply (rule_tac x=y in exI, simp)\napply (rule TP_epxr_Sound) apply assumption \n  apply (erule translation_good) apply assumption+\n  apply (simp add: mkSPEC_def Cachera_def)\n\napply (drule compileExpr_Prop1) apply fastforce apply clarsimp\napply (simp add: Segment_def) \napply (rule, rule, rule, rule, simp add: mkSPEC_def Cachera_def)\napply clarsimp apply (rule, rule AL_emp1) \napply (erule_tac x=ll in allE)+ \napply clarsimp \napply (simp add: mbody_is_def get_ins_def ins_is_def) \ndone\n(*>*)\n\ntext\\<open>From this, the overall soundness result follows easily.\\<close>\n\ntheorem CACH_VERIFIED: \"\\<lbrakk>TP \\<Sigma> F; TP_MST \\<Sigma>; compileProg F\\<rbrakk> \\<Longrightarrow> VP\"\n(*<*)\napply (rule CACH_VP)\napply clarsimp apply (drule CACH_BodiesDerivable) apply assumption+ apply fast\napply clarsimp\ndone\n(*>*)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/BytecodeLogicJmlTypes/Cachera.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6723316991792861, "lm_q2_score": 0.45713671682749474, "lm_q1q2_score": 0.3073475055818697}}
{"text": "theory \"Lowe_modified_Denning_Sacco_shared_key_cert_auto\"\nimports\n  \"ESPLogic\"\nbegin\n\n(* section:  Denning-Sacco Shared Key Protocol  *)\n\n(* text: \n  Modeled after the description in the SPORE library:\n\n    http://www.lsv.ens-cachan.fr/Software/spore/denningSacco.html\n\n  Notable differences:\n\n    1. We do not support reasoning about timestamps yet. Therefore, we use a\n       single global constant 'Time' instead of timestamps; i.e., we assume\n       that everything happens at the same timepoint.\n\n    2. We are using explicit global constants instead of implicit typing to\n       discern the different encryptions.\n\n    3. We model 'dec(x)' as an invertible function using tupling with a fixed\n       global constant; i.e., we only exploit its tagging properties.\n\n *)\n\nrole A\nwhere \"A =\n  [ Send ''1'' <| sAV ''A'', sAV ''B'' |>\n  , Recv ''2'' <| sMV ''S'',\n                  PEnc <| sC ''2'', sAV ''B'', sMV ''Kab'', sC ''Time'', sMV ''Ticket'' |>\n                       ( PSymK ( sAV ''A'' ) ( sMV ''S'' ) )\n               |>\n  , Send ''3'' <| sMV ''S'', sMV ''Ticket'' |>\n  , Recv ''4'' ( PEnc <| sC ''4'', sMV ''Nb'' |> ( sMV ''Kab'' ) )\n  , Send ''5'' ( PEnc <| sC ''5'', sC ''dec'', sMV ''Nb'' |>\n                      ( sMV ''Kab'' )\n               )\n  ]\"\n\nrole B\nwhere \"B =\n  [ Recv ''3'' <| sMV ''S'',\n                  PEnc <| sC ''3'', sMV ''Kab'', sMV ''A'', sC ''Time'' |>\n                       ( PSymK ( sAV ''B'' ) ( sMV ''S'' ) )\n               |>\n  , Send ''4'' ( PEnc <| sC ''4'', sN ''Nb'' |> ( sMV ''Kab'' ) )\n  , Recv ''5'' ( PEnc <| sC ''5'', sC ''dec'', sN ''Nb'' |> ( sMV ''Kab'' )\n               )\n  ]\"\n\nrole S\nwhere \"S =\n  [ Recv ''1'' <| sMV ''A'', sMV ''B'' |>\n  , Send ''2'' <| sAV ''S'',\n                  PEnc <| sC ''2'', sMV ''B'', sN ''Kab'', sC ''Time'',\n                          PEnc <| sC ''3'', sN ''Kab'', sMV ''A'', sC ''Time'' |>\n                               ( PSymK ( sMV ''B'' ) ( sAV ''S'' ) )\n                       |>\n                       ( PSymK ( sMV ''A'' ) ( sAV ''S'' ) )\n               |>\n  ]\"\n\nprotocol DenningSacco\nwhere \"DenningSacco = { A, B, S }\"\n\nlocale restricted_DenningSacco_state = DenningSacco_state\n\ntype_invariant DenningSacco_msc_typing for DenningSacco\nwhere \"DenningSacco_msc_typing = mk_typing\n  [ ((B, ''A''), (SumT (KnownT B_3) AgentT))\n  , ((S, ''A''), (KnownT S_1))\n  , ((S, ''B''), (KnownT S_1))\n  , ((A, ''Kab''), (SumT (KnownT A_2) (NonceT S ''Kab'')))\n  , ((B, ''Kab''), (SumT (KnownT B_3) (NonceT S ''Kab'')))\n  , ((A, ''Nb''), (SumT (KnownT A_4) (NonceT B ''Nb'')))\n  , ((A, ''S''), (KnownT A_2))\n  , ((B, ''S''), (KnownT B_3))\n  , ((A, ''Ticket''),\n     (SumT (KnownT A_2) (EncT (TupT (ConstT ''3'') (TupT (NonceT S ''Kab'') (TupT AgentT (ConstT ''Time'')))) (KT AgentT AgentT))))\n  ]\"\n\nsublocale DenningSacco_state < DenningSacco_msc_typing_state\nproof -\n  have \"(t,r,s) : approx DenningSacco_msc_typing\"\n  proof(cases rule: reachable_in_approxI_ext\n        [OF DenningSacco_msc_typing.monoTyp, completeness_cases_rule])\n    case (A_2_Kab t r s tid0)\n    then interpret state: DenningSacco_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_2_Kab\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''2'', s(AV ''B'' tid0), s(MV ''Kab'' tid0), LC ''Time'',\n               s(MV ''Ticket'' tid0)\n            |}\n            ( K ( s(AV ''A'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (A_2_S t r s tid0)\n    then interpret state: DenningSacco_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_2_S\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (A_2_Ticket t r s tid0)\n    then interpret state: DenningSacco_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_2_Ticket\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''2'', s(AV ''B'' tid0), s(MV ''Kab'' tid0), LC ''Time'',\n               s(MV ''Ticket'' tid0)\n            |}\n            ( K ( s(AV ''A'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (A_4_Nb t r s tid0)\n    then interpret state: DenningSacco_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_4_Nb\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''4'', s(MV ''Nb'' tid0) |} ( s(MV ''Kab'' tid0) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (B_3_A t r s tid0)\n    then interpret state: DenningSacco_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = B_3_A\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''3'', s(MV ''Kab'' tid0), s(MV ''A'' tid0), LC ''Time'' |}\n            ( K ( s(AV ''B'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (B_3_Kab t r s tid0)\n    then interpret state: DenningSacco_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = B_3_Kab\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''3'', s(MV ''Kab'' tid0), s(MV ''A'' tid0), LC ''Time'' |}\n            ( K ( s(AV ''B'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (B_3_S t r s tid0)\n    then interpret state: DenningSacco_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = B_3_S\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (S_1_A t r s tid0)\n    then interpret state: DenningSacco_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = S_1_A\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (S_1_B t r s tid0)\n    then interpret state: DenningSacco_msc_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = S_1_B\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  qed\n  thus \"DenningSacco_msc_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext DenningSacco_state begin\n\n  (* This rule is unsafe in general, but OK here, \n     as we are only reasoning about static compromise. \n  *)\n  lemma static_longterm_key_reveal[dest!]:\n    \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n    by (auto intro: compr_predOrdI)\n\n  lemma longterm_private_key_secrecy:\n    assumes facts:\n      \"SK m : knows t\"\n      \"RLKR m ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"SK m\")\n\n  lemma longterm_sym_ud_key_secrecy:\n    assumes facts:\n      \"K m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"K m1 m2\")\n\n  lemma longterm_sym_bd_key_secrecy:\n    assumes facts:\n      \"Kbd m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n      \"m1 : Agent\"\n      \"m2 : Agent\"\n    shows \"False\"\n  proof -\n    from facts \n    have \"KShr (agents {m1, m2}) : knows t\"\n      by (auto simp: Kbd_def)\n    thus ?thesis using facts\n    proof (sources \"KShr (agents {m1, m2})\")\n    qed (auto simp: agents_def Agent_def)\n  qed\n\n  lemmas ltk_secrecy =\n    longterm_sym_ud_key_secrecy\n    longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n    longterm_sym_bd_key_secrecy\n    longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n    longterm_private_key_secrecy\n    longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection:  Security Properties  *)\n\nlemma (in restricted_DenningSacco_state) B_Kab_secrecy:\n  assumes facts:\n    \"roleMap r tid0 = Some B\"\n    \"RLKR(s(AV ''B'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''S'' tid0)) ~: reveals t\"\n    \"( tid0, B_3 ) : steps t\"\n    \"s(MV ''Kab'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''3'', s(MV ''Kab'' tid0), s(MV ''A'' tid0), LC ''Time'' |}\n                       ( K ( s(AV ''B'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (A_3_Ticket_enc tid1 tid2 a0 a1 a2) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''2'', s(AV ''B'' tid1), s(MV ''Kab'' tid1), LC ''Time'',\n                            Enc {| LC ''3'', LN ''Kab'' tid2, a0, LC ''Time'' |}\n                                ( K ( s(AV ''B'' tid0) ) ( a2 ) )\n                         |}\n                         ( K ( s(AV ''A'' tid1) ) ( s(MV ''S'' tid1) ) ) \")\n      case (S_2_enc tid3) note_unified facts = this facts\n      thus ?thesis proof(sources! \" LN ''Kab'' tid2 \")\n        case (A_3_Ticket_Kab tid3 a0 a1 a2) note_unified facts = this facts\n        thus ?thesis proof(sources! \"\n                         Enc {| LC ''2'', s(AV ''B'' tid3), s(MV ''Kab'' tid3), LC ''Time'',\n                                Enc {| LC ''3'', LN ''Kab'' tid2, a0, LC ''Time'' |} ( K ( a1 ) ( a2 ) )\n                             |}\n                             ( K ( s(AV ''A'' tid3) ) ( s(MV ''S'' tid3) ) ) \")\n          case (S_2_enc tid4) note_unified facts = this facts\n          thus ?thesis by (auto dest!: ltk_secrecy)\n        qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n      next\n        case S_2_Kab note_unified facts = this facts\n        thus ?thesis by (auto dest!: ltk_secrecy)\n      next\n        case S_2_Kab_1 note_unified facts = this facts\n        thus ?thesis by (auto dest!: ltk_secrecy)\n      qed (safe?, simp_all?, insert facts, (fastforce+)?)\n    qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n  next\n    case (S_2_enc_1 tid1) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_DenningSacco_state) A_Kab_secrecy:\n  assumes facts:\n    \"roleMap r tid0 = Some A\"\n    \"RLKR(s(AV ''A'' tid0)) ~: reveals t\"\n    \"RLKR(s(AV ''B'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''S'' tid0)) ~: reveals t\"\n    \"( tid0, A_2 ) : steps t\"\n    \"s(MV ''Kab'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''2'', s(AV ''B'' tid0), s(MV ''Kab'' tid0), LC ''Time'',\n                          s(MV ''Ticket'' tid0)\n                       |}\n                       ( K ( s(AV ''A'' tid0) ) ( s(MV ''S'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (S_2_enc tid1) note_unified facts = this facts\n    thus ?thesis proof(sources! \" LN ''Kab'' tid1 \")\n      case (A_3_Ticket_Kab tid2 a0 a1 a2) note_unified facts = this facts\n      thus ?thesis proof(sources! \"\n                       Enc {| LC ''2'', s(AV ''B'' tid2), s(MV ''Kab'' tid2), LC ''Time'',\n                              Enc {| LC ''3'', LN ''Kab'' tid1, a0, LC ''Time'' |} ( K ( a1 ) ( a2 ) )\n                           |}\n                           ( K ( s(AV ''A'' tid2) ) ( s(MV ''S'' tid2) ) ) \")\n        case (S_2_enc tid3) note_unified facts = this facts\n        thus ?thesis by (auto dest!: ltk_secrecy)\n      qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n    next\n      case S_2_Kab note_unified facts = this facts\n      thus ?thesis by (auto dest!: ltk_secrecy)\n    next\n      case S_2_Kab_1 note_unified facts = this facts\n      thus ?thesis by (auto dest!: ltk_secrecy)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\n(* text: \n  Note that the following authentication properties only specify the existence\n  of partner threads of a certain structure and not the uniqueness. However,\n  these partner threads agree on the nonces of each other, which implies that\n  we can prove injective authentication. We can do this using Isabelle/HOL\n  and exploiting the automatically proven properties below.\n *)\n\nlemma (in restricted_DenningSacco_state) A_noninjective_agree:\n  assumes facts:\n    \"roleMap r tid1 = Some A\"\n    \"RLKR(s(AV ''A'' tid1)) ~: reveals t\"\n    \"RLKR(s(AV ''B'' tid1)) ~: reveals t\"\n    \"RLKR(s(MV ''S'' tid1)) ~: reveals t\"\n    \"( tid1, A_4 ) : steps t\"\n  shows\n    \"(?  tid2.\n        (?  tid3.\n           roleMap r tid2 = Some B &\n           roleMap r tid3 = Some S &\n           s(AV ''A'' tid1) = s(MV ''A'' tid2) &\n           s(MV ''A'' tid2) = s(MV ''A'' tid3) &\n           s(AV ''B'' tid1) = s(AV ''B'' tid2) &\n           s(AV ''B'' tid2) = s(MV ''B'' tid3) &\n           s(MV ''S'' tid1) = s(MV ''S'' tid2) &\n           s(MV ''S'' tid2) = s(AV ''S'' tid3) &\n           s(MV ''Kab'' tid1) = s(MV ''Kab'' tid2) &\n           s(MV ''Kab'' tid2) = LN ''Kab'' tid3 &\n           s(MV ''Nb'' tid1) = LN ''Nb'' tid2))\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''2'', s(AV ''B'' tid1), s(MV ''Kab'' tid1), LC ''Time'',\n                          s(MV ''Ticket'' tid1)\n                       |}\n                       ( K ( s(AV ''A'' tid1) ) ( s(MV ''S'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (S_2_enc tid2) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''4'', s(MV ''Nb'' tid1) |} ( LN ''Kab'' tid2 ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (fastforce dest: A_Kab_secrecy intro: event_predOrdI)\n    next\n      case (B_4_enc tid3) note_unified facts = this facts\n      thus ?thesis proof(sources! \"\n                       Enc {| LC ''3'', LN ''Kab'' tid2, s(MV ''A'' tid3), LC ''Time'' |}\n                           ( K ( s(AV ''B'' tid3) ) ( s(MV ''S'' tid3) ) ) \")\n        case fake note_unified facts = this facts\n        thus ?thesis by (fastforce dest: A_Kab_secrecy intro: event_predOrdI)\n      next\n        case (A_3_Ticket_enc tid4 tid5 a0 a1 a2) note_unified facts = this facts\n        thus ?thesis proof(sources! \"\n                         Enc {| LC ''2'', s(AV ''B'' tid4), s(MV ''Kab'' tid4), LC ''Time'',\n                                Enc {| LC ''3'', LN ''Kab'' tid2, a0, LC ''Time'' |}\n                                    ( K ( s(AV ''B'' tid3) ) ( a2 ) )\n                             |}\n                             ( K ( s(AV ''A'' tid4) ) ( s(MV ''S'' tid4) ) ) \")\n          case (S_2_enc tid5) note_unified facts = this facts\n          thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n        qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n      next\n        case (S_2_enc_1 tid4) note_unified facts = this facts\n        thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n      qed (safe?, simp_all?, insert facts, (fastforce+)?)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_DenningSacco_state) B_noninjective_agree:\n  assumes facts:\n    \"roleMap r tid2 = Some B\"\n    \"RLKR(s(AV ''B'' tid2)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid2)) ~: reveals t\"\n    \"RLKR(s(MV ''S'' tid2)) ~: reveals t\"\n    \"( tid2, B_5 ) : steps t\"\n  shows\n    \"(?  tid1.\n        (?  tid3.\n           roleMap r tid1 = Some A &\n           roleMap r tid3 = Some S &\n           s(AV ''A'' tid1) = s(MV ''A'' tid2) &\n           s(MV ''A'' tid2) = s(MV ''A'' tid3) &\n           s(AV ''B'' tid1) = s(AV ''B'' tid2) &\n           s(AV ''B'' tid2) = s(MV ''B'' tid3) &\n           s(MV ''S'' tid1) = s(MV ''S'' tid2) &\n           s(MV ''S'' tid2) = s(AV ''S'' tid3) &\n           s(MV ''Kab'' tid1) = s(MV ''Kab'' tid2) &\n           s(MV ''Kab'' tid2) = LN ''Kab'' tid3 &\n           s(MV ''Nb'' tid1) = LN ''Nb'' tid2))\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''3'', s(MV ''Kab'' tid2), s(MV ''A'' tid2), LC ''Time'' |}\n                       ( K ( s(AV ''B'' tid2) ) ( s(MV ''S'' tid2) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (A_3_Ticket_enc tid3 tid4 a0 a1 a2) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''2'', s(AV ''B'' tid3), s(MV ''Kab'' tid3), LC ''Time'',\n                            Enc {| LC ''3'', LN ''Kab'' tid4, a0, LC ''Time'' |}\n                                ( K ( s(AV ''B'' tid2) ) ( a2 ) )\n                         |}\n                         ( K ( s(AV ''A'' tid3) ) ( s(MV ''S'' tid3) ) ) \")\n      case (S_2_enc tid5) note_unified facts = this facts\n      thus ?thesis proof(sources! \"\n                       Enc {| LC ''5'', LC ''dec'', LN ''Nb'' tid2 |} ( LN ''Kab'' tid4 ) \")\n        case fake note_unified facts = this facts\n        thus ?thesis by (fastforce dest: B_Kab_secrecy intro: event_predOrdI)\n      next\n        case (A_5_enc tid5) note_unified facts = this facts\n        thus ?thesis proof(sources! \"\n                         Enc {| LC ''2'', s(AV ''B'' tid5), LN ''Kab'' tid4, LC ''Time'',\n                                s(MV ''Ticket'' tid5)\n                             |}\n                             ( K ( s(AV ''A'' tid5) ) ( s(MV ''S'' tid5) ) ) \")\n          case fake note_unified facts = this facts\n          thus ?thesis by (fastforce dest: B_Kab_secrecy intro: event_predOrdI)\n        next\n          case (S_2_enc tid6) note_unified facts = this facts\n          thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n        qed (safe?, simp_all?, insert facts, (fastforce+)?)\n      qed (safe?, simp_all?, insert facts, (fastforce+)?)\n    qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n  next\n    case (S_2_enc_1 tid3) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/spore/isabelle-proofs/Lowe_modified_Denning_Sacco_shared_key_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.566018549837479, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3072706883013141}}
{"text": "section \\<open>ICF-setup for Automatic Refinement\\<close>\ntheory ICF_Autoref\nimports \n  ICF_Refine_Monadic \n  \"../GenCF/Intf/Intf_Set\"\n  \"../GenCF/Intf/Intf_Map\"\nbegin\n\nsubsection \\<open>Unique Priority Queue\\<close>\nconsts i_prio :: \"interface \\<Rightarrow> interface \\<Rightarrow> interface\"\ndefinition [simp]: \"op_uprio_empty \\<equiv> Map.empty\"\ndefinition [simp]: \"op_uprio_is_empty x \\<equiv> x = Map.empty\"\ndefinition [simp]: \"op_uprio_insert s e a \\<equiv> s(e \\<mapsto> a)\"\ndefinition op_uprio_prio :: \"('e\\<rightharpoonup>'a)\\<Rightarrow>'e\\<rightharpoonup>'a\"\n  where [simp]: \"op_uprio_prio s e \\<equiv> s e\"\n\n(* FIXME: Tune id-(phase) such that it can distinguish those patterns!\n  For now: Only include this patterns on demand!\n*)\ncontext begin interpretation autoref_syn .\n\nlemma uprio_pats:\n  fixes s :: \"'e\\<rightharpoonup>'a\"\n  shows\n  \"Map.empty::'e\\<rightharpoonup>'a \\<equiv> op_uprio_empty\"\n  \"s e \\<equiv> op_uprio_prio$s$e\"\n  \"s(e\\<mapsto>a) \\<equiv> op_uprio_insert$s$e$a\"\n\n  \"dom s = {} \\<equiv> op_uprio_is_empty$s\"\n  \"{} = dom s \\<equiv> op_uprio_is_empty$s\"\n  \"s=Map.empty \\<equiv> op_uprio_is_empty$s\"\n  \"Map.empty=s \\<equiv> op_uprio_is_empty$s\"\n  by (auto intro!: eq_reflection)\n\nend\n\nterm prio_pop_min\n\nlemma [autoref_itype]:\n  \"op_uprio_empty ::\\<^sub>i \\<langle>Ie,Ia\\<rangle>\\<^sub>ii_prio\"\n  \"op_uprio_prio ::\\<^sub>i \\<langle>Ie,Ia\\<rangle>\\<^sub>ii_prio \\<rightarrow>\\<^sub>i Ie \\<rightarrow>\\<^sub>i \\<langle>Ia\\<rangle>\\<^sub>ii_option\"\n  \"op_uprio_is_empty ::\\<^sub>i \\<langle>Ie,Ia\\<rangle>\\<^sub>ii_prio \\<rightarrow>\\<^sub>i i_bool\"\n  \"op_uprio_insert ::\\<^sub>i \\<langle>Ie,Ia\\<rangle>\\<^sub>ii_prio \\<rightarrow>\\<^sub>i Ie \\<rightarrow>\\<^sub>i Ia \\<rightarrow>\\<^sub>i \\<langle>Ie,Ia\\<rangle>\\<^sub>ii_prio\"\n  \"prio_pop_min ::\\<^sub>i \\<langle>Ie,Ia\\<rangle>\\<^sub>ii_prio \\<rightarrow>\\<^sub>i \\<langle>\\<langle>Ie,\\<langle>Ia,\\<langle>Ie,Ia\\<rangle>\\<^sub>ii_prio\\<rangle>\\<^sub>ii_prod\\<rangle>\\<^sub>ii_prod\\<rangle>\\<^sub>ii_nres\"\n  by simp_all\n\ncontext uprio begin\n  definition rel_def_internal: \n    \"\\<And>Re Ra. rel Re Ra \\<equiv> br \\<alpha> invar O (Re \\<rightarrow> \\<langle>Ra\\<rangle> option_rel)\"\n  lemma rel_def:\n    \"\\<And>Re Ra. \\<langle>Re,Ra\\<rangle>rel \\<equiv> br \\<alpha> invar O (Re \\<rightarrow> \\<langle>Ra\\<rangle> option_rel)\" \n    by (simp add: rel_def_internal relAPP_def)\n    \n  \n\n  lemma rel_sv[relator_props]: \n    \"\\<And>Re Ra. \\<lbrakk>Range Re = UNIV; single_valued Ra\\<rbrakk> \\<Longrightarrow> single_valued (\\<langle>Re,Ra\\<rangle>rel)\"\n    unfolding rel_def by tagged_solver\n\n  lemmas [autoref_rel_intf] = REL_INTFI[of rel i_prio]\nend\n\n\nlemma (in uprio) rel_alt: \"\\<langle>Id,Rv\\<rangle>rel = \n  { (c,a). \\<forall>x. (\\<alpha> c x,a x)\\<in>\\<langle>Rv\\<rangle>option_rel \\<and> invar c }\"\n  by (auto simp: rel_def br_def dest: fun_relD)\n\nlemma (in uprio_empty) autoref_empty[autoref_rules]:\n  \"\\<And>Re Ra. PREFER_id Re \\<Longrightarrow> (empty (),op_uprio_empty)\\<in>\\<langle>Re,Ra\\<rangle>rel\"\n  by (auto simp: empty_correct rel_alt)\n\nlemma (in uprio_isEmpty) autoref_is_empty[autoref_rules]:\n  \"\\<And>Re Ra. PREFER_id Re \\<Longrightarrow> (isEmpty,op_uprio_is_empty)\\<in>\\<langle>Re,Ra\\<rangle>rel\\<rightarrow>bool_rel\"\n  by (auto simp: isEmpty_correct rel_alt intro!: ext)\n\nlemma (in uprio_prio) autoref_prio[autoref_rules]:\n  \"\\<And>Re Ra. PREFER_id Re \\<Longrightarrow> (prio,op_uprio_prio)\\<in>\\<langle>Re,Ra\\<rangle>rel\\<rightarrow>Re\\<rightarrow>\\<langle>Ra\\<rangle>option_rel\"\n  by (auto simp: prio_correct rel_alt intro!: ext)\n\nlemma (in uprio_insert) autoref_insert[autoref_rules]:\n  \"\\<And>Re Ra. PREFER_id Re \\<Longrightarrow> (insert,op_uprio_insert)\\<in>\\<langle>Re,Ra\\<rangle>rel\\<rightarrow>Re\\<rightarrow>Ra\\<rightarrow>\\<langle>Re,Ra\\<rangle>rel\"\n  by (auto simp: insert_correct rel_alt intro!: ext)\n\nlemma (in uprio_pop) autoref_prio_pop_min[autoref_rules]:\n  \"\\<And>Re Ra. \\<lbrakk>PREFER_id Re; PREFER_id Ra \\<rbrakk> \n  \\<Longrightarrow> (\\<lambda>s. RETURN (pop s),prio_pop_min)\\<in>\\<langle>Re,Ra\\<rangle>rel\\<rightarrow>\\<langle>\\<langle>Re,\\<langle>Ra,\\<langle>Re,Ra\\<rangle>rel\\<rangle>prod_rel\\<rangle>prod_rel\\<rangle>nres_rel\"\n  apply simp\n  apply (intro fun_relI nres_relI)\n  by (rule prio_pop_min_refine)\n\n\n\n\ncontext set begin\n  definition rel_def_internal: \"rel R \\<equiv> br \\<alpha> invar O \\<langle>R\\<rangle>set_rel\"\n  lemma rel_def: \"\\<langle>R\\<rangle>rel \\<equiv> br \\<alpha> invar O \\<langle>R\\<rangle>set_rel\" \n    by (simp add: rel_def_internal relAPP_def)\n    \n  lemma rel_id[simp]: \"\\<langle>Id\\<rangle>rel = br \\<alpha> invar\" by (simp add: rel_def)\n\n  lemma rel_sv[relator_props]: \"single_valued R \\<Longrightarrow> single_valued (\\<langle>R\\<rangle>rel)\"\n    unfolding rel_def by tagged_solver\n\n  lemmas [autoref_rel_intf] = REL_INTFI[of rel i_set]\n\nend\n\ncontext map begin\n  definition rel_def_internal: \n    \"rel Rk Rv \\<equiv> br \\<alpha> invar O (Rk \\<rightarrow> \\<langle>Rv\\<rangle> option_rel)\"\n  lemma rel_def: \n    \"\\<langle>Rk,Rv\\<rangle>rel \\<equiv> br \\<alpha> invar O (Rk \\<rightarrow> \\<langle>Rv\\<rangle> option_rel)\" \n    by (simp add: rel_def_internal relAPP_def)\n    \n  lemma rel_id[simp]: \"\\<langle>Id,Id\\<rangle>rel = br \\<alpha> invar\" \n    by (simp add: rel_def)\n\n  lemma rel_sv[relator_props]: \n    \"\\<lbrakk>Range Rk = UNIV; single_valued Rv\\<rbrakk> \\<Longrightarrow> single_valued (\\<langle>Rk,Rv\\<rangle>rel)\"\n    unfolding rel_def \n    by (tagged_solver (trace))\n\n  lemmas [autoref_rel_intf] = REL_INTFI[of rel i_map]\n\nend\n\n\n(*\ncontext list begin\n  definition rel_def_internal: \n    \"rel R \\<equiv> br \\<alpha> invar O R\"\n  lemma rel_def: \"\\<langle>R\\<rangle>rel \\<equiv> br \\<alpha> invar O R\" \n    by (simp add: rel_def_internal relAPP_def)\n    \n  lemma rel_id[simp]: \"\\<langle>Id\\<rangle>rel = br \\<alpha> invar\" \n    by (simp add: rel_def)\n\n  lemma rel_sv[relator_props]: \"single_valued R \\<Longrightarrow> single_valued (\\<langle>R\\<rangle>rel)\"\n    unfolding rel_def by refine_post\nend\n\ncontext al begin\n  definition rel_def_internal: \n    \"rel Re Ra \\<equiv> br \\<alpha> invar O \\<langle>\\<langle>Re,Ra\\<rangle> prod_rel\\<rangle>list_rel\"\n  lemma rel_def: \n    \"\\<langle>Re,Ra\\<rangle>rel \\<equiv> br \\<alpha> invar O \\<langle>\\<langle>Re,Ra\\<rangle> prod_rel\\<rangle>list_rel\" \n    by (simp add: rel_def_internal relAPP_def)\n    \n  lemma rel_id[simp]: \"\\<langle>Id,Id\\<rangle>rel = br \\<alpha> invar\" \n    by (simp add: rel_def)\n\n  lemma rel_sv[relator_props]: \n    \"\\<lbrakk>single_valued Re; single_valued Ra\\<rbrakk> \\<Longrightarrow> single_valued (\\<langle>Re,Ra\\<rangle>rel)\"\n    unfolding rel_def by refine_post\n\nend\n\ncontext prio begin\n  (* TODO: Fix that to use multiset_rel! *)\n  definition rel_def[simp]: \"rel \\<equiv> br \\<alpha> invar\"\n  lemma rel_sv: \"single_valued rel\" unfolding rel_def by refine_post\nend\n\ncontext uprio begin\n  definition rel_def_internal: \n    \"rel Re Ra \\<equiv> br \\<alpha> invar O (Re \\<rightarrow> \\<langle>Ra\\<rangle> option_rel)\"\n  lemma rel_def:\n    \"\\<langle>Re,Ra\\<rangle>rel \\<equiv> br \\<alpha> invar O (Re \\<rightarrow> \\<langle>Ra\\<rangle> option_rel)\" \n    by (simp add: rel_def_internal relAPP_def)\n    \n  lemma rel_id[simp]: \"\\<langle>Id,Id\\<rangle>rel = br \\<alpha> invar\" \n    by (simp add: rel_def)\n\n  lemma rel_sv[relator_props]: \n    \"\\<lbrakk>Range Re = UNIV; single_valued Ra\\<rbrakk> \\<Longrightarrow> single_valued (\\<langle>Re,Ra\\<rangle>rel)\"\n    unfolding rel_def by refine_post\n\nend\n*)\n\n\nsetup \\<open>Revert_Abbrev.revert_abbrev \"Autoref_Binding_ICF.*.rel\"\\<close>\n\n\n\n\n(* TODO: Move *)\nlemma Collect_x_x_pairs_rel_image[simp]: \"{p. \\<exists>x. p = (x, x)}``x = x\" \n    by auto\n\n\nsubsection \"Set\"\n\nlemma (in set_empty) empty_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (empty (), {}) \\<in> \\<langle>Rk\\<rangle>rel\"\n  by (simp add: br_def empty_correct)\n\nlemma (in set_memb) memb_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (memb,(\\<in>))\\<in>Rk\\<rightarrow>\\<langle>Rk\\<rangle>rel\\<rightarrow>Id\"\n  apply simp\n  by (auto simp add: memb_correct br_def)\n\nlemma (in set_ins) ins_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (ins,Set.insert)\\<in>Rk\\<rightarrow>\\<langle>Rk\\<rangle>rel\\<rightarrow>\\<langle>Rk\\<rangle>rel\"\n  by simp (auto simp add: ins_correct br_def)\n\ncontext set_ins_dj begin\ncontext begin interpretation autoref_syn .\nlemma ins_dj_autoref[autoref_rules]: \n  assumes \"SIDE_PRECOND_OPT (x'\\<notin>s')\"\n  assumes \"PREFER_id Rk\"\n  assumes \"(x,x')\\<in>Rk\"\n  assumes \"(s,s')\\<in>\\<langle>Rk\\<rangle>rel\"\n  shows \"(ins_dj x s,(OP Set.insert ::: Rk \\<rightarrow> \\<langle>Rk\\<rangle>rel \\<rightarrow> \\<langle>Rk\\<rangle>rel)$x'$s')\\<in>\\<langle>Rk\\<rangle>rel\"\n  using assms \n  apply simp\n  apply (auto simp add: ins_dj_correct br_def)\n  done\nend\nend\n\nlemma (in set_delete) delete_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (delete,op_set_delete)\\<in>Rk\\<rightarrow>\\<langle>Rk\\<rangle>rel\\<rightarrow>\\<langle>Rk\\<rangle>rel\"\n  by simp (auto simp add: delete_correct op_set_delete_def br_def)\n \nlemma (in set_isEmpty) isEmpty_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (isEmpty,op_set_isEmpty) \\<in> \\<langle>Rk\\<rangle>rel\\<rightarrow>Id\"\n  apply (simp add: br_def)\n  apply (fastforce simp: isEmpty_correct)\n  done\n\nlemma (in set_isSng) isSng_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (isSng,op_set_isSng) \\<in> \\<langle>Rk\\<rangle>rel\\<rightarrow>Id\"\n  by simp\n    (auto simp add: isSng_correct op_set_isSng_def br_def card_Suc_eq)\n\nlemma (in set_ball) ball_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (ball,Set.Ball) \\<in> \\<langle>Rk\\<rangle>rel\\<rightarrow>(Rk\\<rightarrow>Id)\\<rightarrow>Id\"\n  by simp (auto simp add: ball_correct fun_rel_def br_def)\n\nlemma (in set_bex) bex_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (bex,Set.Bex) \\<in> \\<langle>Rk\\<rangle>rel\\<rightarrow>(Rk\\<rightarrow>Id)\\<rightarrow>Id\"\n  apply simp\n  apply (auto simp: bex_correct fun_rel_def br_def intro!: ext)\n  done\n\nlemma (in set_size) size_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (size,card) \\<in> \\<langle>Rk\\<rangle>rel \\<rightarrow> Id\"\n  by simp (auto simp add: size_correct br_def)\n\nlemma (in set_size_abort) size_abort_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (size_abort,op_set_size_abort) \\<in> Id \\<rightarrow> \\<langle>Rk\\<rangle>rel \\<rightarrow> Id\"\n  by simp\n    (auto simp add: size_abort_correct op_set_size_abort_def br_def)\n\nlemma (in set_union) union_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (union,(\\<union>))\\<in>\\<langle>Rk\\<rangle>s1.rel\\<rightarrow>\\<langle>Rk\\<rangle>s2.rel\\<rightarrow>\\<langle>Rk\\<rangle>s3.rel\"\n  by simp (auto simp add: union_correct br_def)\n\ncontext set_union_dj begin\ncontext begin interpretation autoref_syn .\n\nlemma union_dj_autoref[autoref_rules]:\n  assumes \"PREFER_id Rk\"\n  assumes \"SIDE_PRECOND_OPT (a'\\<inter>b'={})\"\n  assumes \"(a,a')\\<in>\\<langle>Rk\\<rangle>s1.rel\"\n  assumes \"(b,b')\\<in>\\<langle>Rk\\<rangle>s2.rel\"\n  shows \"(union_dj a b,(OP (\\<union>) ::: \\<langle>Rk\\<rangle>s1.rel \\<rightarrow> \\<langle>Rk\\<rangle>s2.rel \\<rightarrow> \\<langle>Rk\\<rangle>s3.rel)$a'$b')\n    \\<in>\\<langle>Rk\\<rangle>s3.rel\"\n  using assms \n  by simp (auto simp: union_dj_correct br_def)\nend \nend\n\nlemma (in set_diff) diff_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (diff,(-))\\<in>\\<langle>Rk\\<rangle>s1.rel\\<rightarrow>\\<langle>Rk\\<rangle>s2.rel\\<rightarrow>\\<langle>Rk\\<rangle>s1.rel\"\n  by simp (auto simp add: diff_correct br_def)\n\nlemma (in set_filter) filter_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (filter,op_set_filter)\\<in>(Rk \\<rightarrow> Id) \\<rightarrow> \\<langle>Rk\\<rangle>s1.rel\\<rightarrow>\\<langle>Rk\\<rangle>s2.rel\"\n  by simp (auto simp add: filter_correct op_set_filter_def fun_rel_def \n    br_def)\n\nlemma (in set_inter) inter_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (inter,(\\<inter>))\\<in>\\<langle>Rk\\<rangle>s1.rel\\<rightarrow>\\<langle>Rk\\<rangle>s2.rel\\<rightarrow>\\<langle>Rk\\<rangle>s3.rel\"\n  by simp (auto simp add: inter_correct br_def)\n\nlemma (in set_subset) subset_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (subset,(\\<subseteq>))\\<in>\\<langle>Rk\\<rangle>s1.rel\\<rightarrow>\\<langle>Rk\\<rangle>s2.rel\\<rightarrow>Id\"\n  by simp (auto simp add: subset_correct br_def)\n\nlemma (in set_equal) equal_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (equal,(=))\\<in>\\<langle>Rk\\<rangle>s1.rel\\<rightarrow>\\<langle>Rk\\<rangle>s2.rel\\<rightarrow>Id\"\n  by simp (auto simp add: equal_correct br_def)\n\nlemma (in set_disjoint) disjoint_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (disjoint,op_set_disjoint)\\<in>\\<langle>Rk\\<rangle>s1.rel\\<rightarrow>\\<langle>Rk\\<rangle>s2.rel\\<rightarrow>Id\"\n  by simp (auto simp add: disjoint_correct op_set_disjoint_def br_def)\n\nlemma (in list_to_set) to_set_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (to_set,set)\\<in>\\<langle>Rk\\<rangle>list_rel \\<rightarrow> \\<langle>Rk\\<rangle>rel\"\n  apply simp\n  apply (auto simp add: to_set_correct br_def)\n  done\n\ncontext set_sel' begin\ncontext begin interpretation autoref_syn .\n\nlemma autoref_op_set_pick[autoref_rules]: \n  assumes \"SIDE_PRECOND (s'\\<noteq>{})\"\n  assumes \"PREFER_id Rk\"\n  assumes \"(s,s')\\<in>\\<langle>Rk\\<rangle>rel\"\n  shows \"(RETURN (the (sel' s (\\<lambda>_. True))), \n          (OP op_set_pick ::: \\<langle>Rk\\<rangle>rel \\<rightarrow> \\<langle>Rk\\<rangle>nres_rel) $ s')\n    \\<in> \\<langle>Rk\\<rangle>nres_rel\"\n  using assms\n  apply (clarsimp simp add: br_def nres_rel_def ex_in_conv[symmetric])\n  apply (erule (1) sel'E[OF _ _ TrueI])\n  apply (auto intro: RES_refine)\n  done\nend\nend\n\nlemma (in poly_set_iteratei) proper[proper_it]:\n  \"proper_it' iteratei iteratei\"\n  apply (rule proper_it'I)\n  by (rule pi_iteratei)\n\nlemma (in poly_set_iteratei) autoref_iteratei[autoref_ga_rules]: \n  \"REL_IS_ID Rk \\<Longrightarrow> is_set_to_list Rk rel (it_to_list iteratei)\"\n  unfolding is_set_to_list_def is_set_to_sorted_list_def it_to_list_def \n    it_to_sorted_list_def\n  apply (simp add: br_def, intro allI impI)\n  apply (drule iteratei_correct)\n  unfolding set_iterator_def set_iterator_genord_foldli_conv\n  apply (elim exE)\n  apply clarsimp\n  apply (drule fun_cong[where x=\"\\<lambda>_::'x list. True\"])\n  apply simp\n  done\n\nlemma (in poly_set_iterateoi) proper_o[proper_it]:\n  \"proper_it' iterateoi iterateoi\"\n  apply (rule proper_it'I)\n  by (rule pi_iterateoi)\n\n\n\nlemma (in poly_set_rev_iterateoi) autoref_rev_iterateoi[autoref_ga_rules]: \n  \"REL_IS_ID Rk \\<Longrightarrow> \n    is_set_to_sorted_list (\\<ge>) Rk rel (it_to_list rev_iterateoi)\"\n  unfolding is_set_to_sorted_list_def it_to_list_def it_to_sorted_list_def\n  apply (simp add: br_def, intro allI impI)\n  apply (drule rev_iterateoi_correct)\n  unfolding set_iterator_rev_linord_def set_iterator_genord_foldli_conv\n  apply (elim exE)\n  apply clarsimp\n  apply (drule fun_cong[where x=\"\\<lambda>_::'x list. True\"])\n  apply simp\n  done\n\nlemma (in poly_set_rev_iterateoi) proper_ro[proper_it]:\n  \"proper_it' rev_iterateoi rev_iterateoi\"\n  apply (rule proper_it'I)\n  by (rule pi_rev_iterateoi)\n\nsubsection \"Map\"\n\nlemma (in map) rel_alt: \"\\<langle>Id,Rv\\<rangle>rel = \n  { (c,a). \\<forall>x. (\\<alpha> c x,a x)\\<in>\\<langle>Rv\\<rangle>option_rel \\<and> invar c }\"\n  by (auto simp: rel_def br_def dest: fun_relD)\n\nlemma (in map_empty) empty_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (empty (),op_map_empty)\\<in>\\<langle>Rk,Rv\\<rangle>rel\"\n  by (auto simp: empty_correct rel_alt)\n  \nlemma (in map_lookup) lookup_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (lookup,op_map_lookup)\\<in>Rk\\<rightarrow>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>\\<langle>Rv\\<rangle>option_rel\"\n  apply (intro fun_relI option_relI)\n  apply (auto simp: lookup_correct rel_alt\n    dest: fun_relD2)\n  done\n\nlemma (in map_update) update_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (update,op_map_update)\\<in>Rk\\<rightarrow>Rv\\<rightarrow>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>\\<langle>Rk,Rv\\<rangle>rel\"\n  apply (intro fun_relI)\n  apply (simp add: update_correct rel_alt)\n  done\n\ncontext map_update_dj begin\ncontext begin interpretation autoref_syn .\n\nlemma update_dj_autoref[autoref_rules]: \n  assumes \"SIDE_PRECOND_OPT (k'\\<notin>dom m')\"\n  assumes \"PREFER_id Rk\"\n  assumes \"(k,k')\\<in>Rk\"\n  assumes \"(v,v')\\<in>Rv\"\n  assumes \"(m,m')\\<in>\\<langle>Rk,Rv\\<rangle>rel\"\n  shows \"(update_dj k v m,\n    (OP op_map_update ::: Rk \\<rightarrow> Rv \\<rightarrow> \\<langle>Rk,Rv\\<rangle>rel \\<rightarrow> \\<langle>Rk,Rv\\<rangle>rel)$k'$v'$m'\n  )\\<in>\\<langle>Rk,Rv\\<rangle>rel\"\n  using assms\n  apply (subgoal_tac \"k\\<notin>dom (\\<alpha> m)\")\n  apply (simp add: update_dj_correct rel_alt)\n  apply (auto simp add: rel_alt option_rel_def)\n  apply (metis option.simps(3))\n  done\nend\nend\n\nlemma (in map_delete) delete_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (delete,op_map_delete)\\<in>Rk\\<rightarrow>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>\\<langle>Rk,Rv\\<rangle>rel\"\n  apply (intro fun_relI)\n  apply (simp add: delete_correct restrict_map_def rel_alt)\n  done\n\nlemma (in map_restrict) restrict_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> \n    (restrict,op_map_restrict) \n    \\<in> (\\<langle>Rk,Rv\\<rangle>prod_rel \\<rightarrow> Id) \\<rightarrow> \\<langle>Rk,Rv\\<rangle>m1.rel \\<rightarrow> \\<langle>Rk,Rv\\<rangle>m2.rel\"\n  apply (intro fun_relI)\n  apply (simp add: restrict_correct br_comp_alt m1.rel_def m2.rel_def )\n  apply (intro fun_relI)\n  apply (auto simp: restrict_map_def split: if_split_asm)\n  apply (drule (1) fun_relD1)\n  apply (auto simp: option_rel_def) []\n  apply (drule (1) fun_relD1)\n  apply (auto simp: option_rel_def) []\n  apply (drule (1) fun_relD1)\n  apply (auto simp: option_rel_def prod_rel_def fun_rel_def) []\n  apply (drule (1) fun_relD2)\n  apply (auto simp: option_rel_def prod_rel_def fun_rel_def) []\n  done\n\nlemma (in map_add) add_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (add,(++))\\<in>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>\\<langle>Rk,Rv\\<rangle>rel\"\n  apply (auto simp add: add_correct rel_alt Map.map_add_def\n    split: option.split)\n  apply (drule_tac x=x in spec)+\n  apply simp\n  apply (metis option.simps(3) option_rel_simp(2))\n  by (metis (lifting) option_rel_simp(3))\n\n\ncontext map_add_dj begin\ncontext begin interpretation autoref_syn .\n\nlemma add_dj_autoref[autoref_rules]: \n  assumes \"PREFER_id Rk\"\n  assumes \"SIDE_PRECOND_OPT (dom a' \\<inter> dom b' = {})\"\n  assumes \"(a,a')\\<in>\\<langle>Rk,Rv\\<rangle>rel\"\n  assumes \"(b,b')\\<in>\\<langle>Rk,Rv\\<rangle>rel\"\n  shows \"(add_dj a b, (OP (++) ::: \\<langle>Rk,Rv\\<rangle>rel \\<rightarrow> \\<langle>Rk,Rv\\<rangle>rel \\<rightarrow> \\<langle>Rk,Rv\\<rangle>rel) $ a' $ b')\\<in>\\<langle>Rk,Rv\\<rangle>rel\"\n  using assms\n  apply simp\n  apply (subgoal_tac \"dom (\\<alpha> a) \\<inter> dom (\\<alpha> b) = {}\")\n  apply (clarsimp simp add: add_dj_correct rel_def br_comp_alt)\n  apply (auto \n    simp add: rel_def br_comp_alt Map.map_add_def\n    split: option.split\n    elim: fun_relE1 dest: fun_relD1 intro: option_relI\n  ) []\n\n  apply (clarsimp simp add: rel_def br_comp_alt)\n\n  apply (auto simp: dom_def)\n  apply (drule (1) fun_relD1)\n  apply (drule (1) fun_relD1)\n  apply (auto simp: option_rel_def)\n  done\nend\nend\n\nlemma (in map_isEmpty) isEmpty_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (isEmpty,op_map_isEmpty)\\<in>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>Id\"\n  by (auto simp: isEmpty_correct rel_alt\n    intro!: ext)\n\nlemma sngI: \n  assumes \"m k = Some v\"\n  assumes \"\\<forall>k'. k'\\<noteq>k \\<longrightarrow> m k' = None\"\n  shows \"m = [k\\<mapsto>v]\"\n  using assms\n  by (auto intro!: ext)\n\nlemma (in map_isSng) isSng_autoref[autoref_rules]: \n  \"PREFER_id Rk \\<Longrightarrow> (isSng,op_map_isSng)\\<in>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>Id\"\n  (* TODO: Clean up this mess *)\n  apply (auto simp add: isSng_correct rel_alt)\n  apply (rule_tac x=k in exI)\n  apply (rule_tac x=\"the (a' k)\" in exI)\n  apply (rule sngI)\n  apply (drule_tac x=k in spec)\n  apply (auto elim: option_relE) []\n  apply (force elim: option_relE) []\n\n  apply (rule_tac x=k in exI)\n  apply (rule_tac x=\"the (\\<alpha> a k)\" in exI)\n  apply (rule sngI)\n  apply (drule_tac x=k in spec)\n  apply (auto elim: option_relE) []\n  apply (force elim: option_relE) []\n  done\n\nlemma (in map_ball) ball_autoref[autoref_rules]:\n  \"PREFER_id Rk \\<Longrightarrow> (ball,op_map_ball)\\<in>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>(\\<langle>Rk,Rv\\<rangle>prod_rel\\<rightarrow>Id)\\<rightarrow>Id\"\n  apply (auto simp: ball_correct rel_alt map_to_set_def\n    option_rel_def prod_rel_def fun_rel_def)\n  apply (metis option.inject option.simps(3))+\n  done\n\nlemma (in map_bex) bex_autoref[autoref_rules]:\n  \"PREFER_id Rk \\<Longrightarrow> (bex,op_map_bex)\\<in>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>(\\<langle>Rk,Rv\\<rangle>prod_rel\\<rightarrow>Id)\\<rightarrow>Id\"\n  apply (auto simp: bex_correct map_to_set_def rel_alt \n    option_rel_def prod_rel_def fun_rel_def)\n  apply (metis option.inject option.simps(3))+\n  done\n\nlemma (in map_size) size_autoref[autoref_rules]:\n  \"PREFER_id Rk \\<Longrightarrow> (size,op_map_size)\\<in>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>Id\"\n  apply (auto simp: size_correct rel_alt option_rel_def dom_def \n    intro!: arg_cong[where f=card])\n  apply (metis option.simps(3))+\n  done\n\nlemma (in map_size_abort) size_abort_autoref[autoref_rules]:\n  \"PREFER_id Rk \\<Longrightarrow> (size_abort,op_map_size_abort)\\<in>Id\\<rightarrow>\\<langle>Rk,Rv\\<rangle>rel\\<rightarrow>Id\"\n  apply (auto simp: size_abort_correct  \n    rel_alt option_rel_def\n    dom_def intro!: arg_cong[where f=card] cong[OF arg_cong[where f=min]])\n  apply (metis option.simps(3))+\n  done\n\nlemma (in list_to_map) to_map_autoref[autoref_rules]:\n  \"PREFER_id Rk \\<Longrightarrow> (to_map,map_of)\\<in> \\<langle>\\<langle>Rk,Rv\\<rangle>prod_rel\\<rangle>list_rel \\<rightarrow> \\<langle>Rk,Rv\\<rangle>rel\"\nproof (intro fun_relI)\n  fix l :: \"('u\\<times>'v) list\" and l' :: \"('u\\<times>'a) list\"\n  assume \"PREFER_id Rk\" hence [simp]: \"Rk=Id\" by simp\n  assume \"(l,l')\\<in>\\<langle>\\<langle>Rk,Rv\\<rangle>prod_rel\\<rangle>list_rel\"\n  thus \"(to_map l, map_of l') \\<in> \\<langle>Rk,Rv\\<rangle>rel\"\n    apply (simp add: list_rel_def)\n  proof (induct rule: list_all2_induct)\n    case Nil thus ?case \n      by (auto simp add: to_map_correct rel_alt)\n  next\n    case (Cons x x' l l') thus ?case\n      by (auto simp add: to_map_correct \n        rel_alt prod_rel_def)\n  qed\nqed\n\n(* TODO: Move *)\nlemma key_rel_true[simp]: \"key_rel (\\<lambda>_ _. True) = (\\<lambda>_ _. True)\"\n  by (auto intro!: ext simp: key_rel_def)\n\n\nlemma (in poly_map_iteratei) proper[proper_it]:\n  \"proper_it' iteratei iteratei\"\n  apply (rule proper_it'I)\n  by (rule pi_iteratei)\n\nlemma (in poly_map_iteratei) autoref_iteratei[autoref_ga_rules]: \n  assumes ID: \"REL_IS_ID Rk\"\n    \"REL_IS_ID Rv\" (* TODO: Unnecessary*)\n  shows \"is_map_to_list Rk Rv rel (it_to_list iteratei)\"\nproof -\n  from ID have [simp]: \"Rk=Id\" \"Rv = Id\" by simp_all\n\n  show ?thesis\n    unfolding is_map_to_sorted_list_def is_map_to_list_def\n      it_to_sorted_list_def\n    apply simp\n    apply (intro allI impI conjI)\n  proof -\n    fix m m'\n    assume \"(m, m') \\<in> br \\<alpha> invar\"\n    hence I: \"invar m\" and M': \"m' = \\<alpha> m\" by (simp_all add: br_def)\n\n    have [simp]: \"\\<And>c. (\\<lambda>(_,_). c) = (\\<lambda>_. c)\" by auto\n\n    from map_it_to_list_genord_correct[where it = iteratei, \n      where R=\"\\<lambda>_ _. True\", simplified, OF \n      iteratei_correct[OF I, unfolded set_iterator_def]\n    ] have \n        M: \"Map.map_of (it_to_list iteratei m) = \\<alpha> m\"\n        and D: \"distinct (List.map fst (it_to_list iteratei m))\"\n      by (simp_all)\n\n    from D show \"distinct (it_to_list iteratei m)\"\n      by (rule distinct_mapI)\n\n    from M show \"map_to_set m' = set (it_to_list iteratei m)\"\n      by (simp add: M' map_of_map_to_set[OF D])\n  qed\nqed\n\nlemma (in poly_map_iterateoi) proper_o[proper_it]:\n  \"proper_it' iterateoi iterateoi\"\n  apply (rule proper_it'I)\n  by (rule pi_iterateoi)\n\nlemma (in poly_map_iterateoi) autoref_iterateoi[autoref_ga_rules]: \n  assumes ID: \"REL_IS_ID Rk\"\n    \"REL_IS_ID Rv\" (* TODO: Unnecessary*)\n  shows \"is_map_to_sorted_list (\\<le>) Rk Rv rel (it_to_list iterateoi)\"\nproof -\n  from ID have [simp]: \"Rk=Id\" \"Rv = Id\" by simp_all\n\n  show ?thesis\n    unfolding is_map_to_sorted_list_def\n      it_to_sorted_list_def\n    apply simp\n    apply (intro allI impI conjI)\n  proof -\n    fix m m'\n    assume \"(m, m') \\<in> br \\<alpha> invar\"\n    hence I: \"invar m\" and M': \"m' = \\<alpha> m\" by (simp_all add: br_def)\n\n    have [simp]: \"\\<And>c. (\\<lambda>(_,_). c) = (\\<lambda>_. c)\" by auto\n\n    from map_it_to_list_linord_correct[where it = iterateoi, \n      OF iterateoi_correct[OF I]\n    ] have \n        M: \"map_of (it_to_list iterateoi m) = \\<alpha> m\"\n        and D: \"distinct (map fst (it_to_list iterateoi m))\"\n        and S: \"sorted (map fst (it_to_list iterateoi m))\"\n      by (simp_all)\n\n    from D show \"distinct (it_to_list iterateoi m)\"\n      by (rule distinct_mapI)\n\n    from M show \"map_to_set m' = set (it_to_list iterateoi m)\"\n      by (simp add: M' map_of_map_to_set[OF D])\n\n    from S show \"sorted_wrt (key_rel (\\<le>)) (it_to_list iterateoi m)\"\n      by (simp add: key_rel_def[abs_def])\n\n  qed\nqed\n\nlemma (in poly_map_rev_iterateoi) proper_ro[proper_it]:\n  \"proper_it' rev_iterateoi rev_iterateoi\"\n  apply (rule proper_it'I)\n  by (rule pi_rev_iterateoi)\n\nlemma (in poly_map_rev_iterateoi) autoref_rev_iterateoi[autoref_ga_rules]: \n  assumes ID: \"REL_IS_ID Rk\"\n    \"REL_IS_ID Rv\" (* TODO: Unnecessary*)\n  shows \"is_map_to_sorted_list (\\<ge>) Rk Rv rel (it_to_list rev_iterateoi)\"\nproof -\n  from ID have [simp]: \"Rk=Id\" \"Rv = Id\" by simp_all\n\n  show ?thesis\n    unfolding is_map_to_sorted_list_def\n      it_to_sorted_list_def\n    apply simp\n    apply (intro allI impI conjI)\n  proof -\n    fix m m'\n    assume \"(m, m') \\<in> br \\<alpha> invar\"\n    hence I: \"invar m\" and M': \"m' = \\<alpha> m\" by (simp_all add: br_def)\n\n    have [simp]: \"\\<And>c. (\\<lambda>(_,_). c) = (\\<lambda>_. c)\" by auto\n\n    from map_it_to_list_rev_linord_correct[where it = rev_iterateoi, \n      OF rev_iterateoi_correct[OF I]\n    ] have \n        M: \"map_of (it_to_list rev_iterateoi m) = \\<alpha> m\"\n        and D: \"distinct (map fst (it_to_list rev_iterateoi m))\"\n        and S: \"sorted (rev (map fst (it_to_list rev_iterateoi m)))\"\n      by (simp_all)\n\n    from D show \"distinct (it_to_list rev_iterateoi m)\"\n      by (rule distinct_mapI)\n\n    from M show \"map_to_set m' = set (it_to_list rev_iterateoi m)\"\n      by (simp add: M' map_of_map_to_set[OF D])\n\n    from S show \"sorted_wrt (key_rel (\\<ge>)) (it_to_list rev_iterateoi m)\"\n      by (simp add: key_rel_def[abs_def])\n\n  qed\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Collections/ICF/ICF_Autoref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961015, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.30727068035304783}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n* Zhe Hou: I modified this file to model a deterministic monad instead of\n* a non-deterministic monad. Features that are irrelevant to deterministic \n* moands are removed. I also removed the section for loops, which are not\n* used in the modelling of the SPARC architecture.\n*)\n\n(* \n   Deterministic state and error monads with failure in Isabelle.\n*)\n\n(*chapter \"Deterministic State Monad with Failure\"*)\n\ntheory DetMonad\nimports \"../Lib\"\nbegin\n\ntext {*\n  \\label{c:monads}\n\n  State monads are used extensively in the seL4 specification. They are\n  defined below.\n*}\n\nsection \"The Monad\"\n\ntext {*\n  The basic type of the deterministic state monad with failure is\n  very similar to the normal state monad. Instead of a pair consisting\n  of result and new state, we return a pair coupled with\n  a failure flag. The flag is @{const True} if the computation have failed. \n  Conversely, if the flag is @{const False}, the computation resulting in \n  the returned result have succeeded.  *} \ntype_synonym ('s,'a) det_monad = \"'s \\<Rightarrow> ('a \\<times> 's) \\<times> bool\"\n\n\ntext {*\n  The definition of fundamental monad functions @{text return} and\n  @{text bind}. The monad function @{text \"return x\"} does not change \n  the  state, does not fail, and returns @{text \"x\"}.\n*} \ndefinition\n  return :: \"'a \\<Rightarrow> ('s,'a) det_monad\" where\n  \"return a \\<equiv> \\<lambda>s. ((a,s),False)\"\n\ntext {*\n  The monad function @{text \"bind f g\"}, also written @{text \"f >>= g\"},\n  is the execution of @{term f} followed by the execution of @{text g}.\n  The function @{text g} takes the result value \\emph{and} the result\n  state of @{text f} as parameter. The definition says that the result of\n  the combined operation is the result which is created\n  by @{text g} applied to the result of @{text f}. The combined\n  operation may have failed, if @{text f} may have failed or @{text g} may\n  have failed on the result of @{text f}.\n*}\n\ntext {*\n David Sanan and Zhe Hou: The original definition of bind is very inefficient \n when converted to executable code. Here we change it to a more efficient\n version for execution. The idea remains the same.\n*}\n\ndefinition \"h1 f s = f s\"\ndefinition \"h2 g fs = (let (a,b) = fst (fs) in g a b)\"\ndefinition bind:: \"('s, 'a) det_monad \\<Rightarrow> ('a \\<Rightarrow> ('s, 'b) det_monad) \\<Rightarrow> \n           ('s, 'b) det_monad\" (infixl \">>=\" 60)\nwhere\n\"bind f g \\<equiv> \\<lambda>s. (\n  let fs = h1 f s;\n      v = h2 g fs\n  in\n  (fst v, (snd v \\<or> snd fs)))\"\n\ntext {*\n  Sometimes it is convenient to write @{text bind} in reverse order.\n*}\nabbreviation(input)\n  bind_rev :: \"('c \\<Rightarrow> ('a, 'b) det_monad) \\<Rightarrow> ('a, 'c) det_monad \\<Rightarrow> \n               ('a, 'b) det_monad\" (infixl \"=<<\" 60) where \n  \"g =<< f \\<equiv> f >>= g\"\n\ntext {* \n  The basic accessor functions of the state monad. @{text get} returns\n  the current state as result, does not fail, and does not change the state.\n  @{text \"put s\"} returns nothing (@{typ unit}), changes the current state\n  to @{text s} and does not fail.\n*}\ndefinition\n  get :: \"('s,'s) det_monad\" where\n  \"get \\<equiv> \\<lambda>s. ((s,s), False)\"\n\ndefinition\n  put :: \"'s \\<Rightarrow> ('s, unit) det_monad\" where\n  \"put s \\<equiv> \\<lambda>_. (((),s), False)\"\n\nsubsection \"Failure\"\n\ntext {* The monad function that always fails. Returns the current \n  state and sets the failure flag. *}\ndefinition\n  fail :: \"'a \\<Rightarrow> ('s, 'a) det_monad\" where\n \"fail a \\<equiv> \\<lambda>s. ((a,s), True)\"\n\ntext {* Assertions: fail if the property @{text P} is not true *}\ndefinition\n  assert :: \"bool \\<Rightarrow> ('a, unit) det_monad\" where\n \"assert P \\<equiv> if P then return () else fail ()\"\n\ntext {* An assertion that also can introspect the current state. *}\n\ndefinition\n  state_assert :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, unit) det_monad\"\nwhere\n  \"state_assert P \\<equiv> get >>= (\\<lambda>s. assert (P s))\"\n\nsubsection \"Generic functions on top of the state monad\"\n\ntext {* Apply a function to the current state and return the result\nwithout changing the state. *}\ndefinition\n  gets :: \"('s \\<Rightarrow> 'a) \\<Rightarrow> ('s, 'a) det_monad\" where\n \"gets f \\<equiv> get >>= (\\<lambda>s. return (f s))\"\n\ntext {* Modify the current state using the function passed in. *}\ndefinition\n  modify :: \"('s \\<Rightarrow> 's) \\<Rightarrow> ('s, unit) det_monad\" where\n \"modify f \\<equiv> get >>= (\\<lambda>s. put (f s))\"\n\nlemma simpler_gets_def: \"gets f = (\\<lambda>s. ((f s, s), False))\"\n  apply (simp add: gets_def return_def bind_def h1_def h2_def get_def)\n  done\n\nlemma simpler_modify_def:\n  \"modify f = (\\<lambda>s. (((), f s), False))\"\n  by (simp add: modify_def bind_def h1_def h2_def get_def put_def)\n\ntext {* Execute the given monad when the condition is true, \n  return @{text \"()\"} otherwise. *}\ndefinition\n  when1 :: \"bool \\<Rightarrow> ('s, unit) det_monad \\<Rightarrow> \n           ('s, unit) det_monad\" where \n  \"when1 P m \\<equiv> if P then m else return ()\"\n\ntext {* Execute the given monad unless the condition is true, \n  return @{text \"()\"} otherwise. *}\ndefinition \n  unless :: \"bool \\<Rightarrow> ('s, unit) det_monad \\<Rightarrow> \n            ('s, unit) det_monad\" where\n  \"unless P m \\<equiv> when1 (\\<not>P) m\"\n\ntext {*\n  Perform a test on the current state, performing the left monad if\n  the result is true or the right monad if the result is false.\n*}\ndefinition\n  condition :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'r) det_monad \\<Rightarrow> ('s, 'r) det_monad \\<Rightarrow> ('s, 'r) det_monad\"\nwhere\n  \"condition P L R \\<equiv> \\<lambda>s. if (P s) then (L s) else (R s)\"\n\nnotation (output)\n  condition  (\"(condition (_)//  (_)//  (_))\" [1000,1000,1000] 1000)\n\nsubsection {* The Monad Laws *}\n\ntext {* Each monad satisfies at least the following three laws. *}\n\ntext {* @{term return} is absorbed at the left of a @{term bind}, \n  applying the return value directly: *} \nlemma return_bind [simp]: \"(return x >>= f) = f x\"\n  by (simp add: return_def bind_def h1_def h2_def)\n\ntext {* @{term return} is absorbed on the right of a @{term bind} *} \nlemma bind_return [simp]: \"(m >>= return) = m\"\n  apply (rule ext)\n  apply (simp add: bind_def h1_def h2_def return_def split_def)\n  done\n \ntext {* @{term bind} is associative *}\nlemma bind_assoc: \n  fixes m :: \"('a,'b) det_monad\"\n  fixes f :: \"'b \\<Rightarrow> ('a,'c) det_monad\"\n  fixes g :: \"'c \\<Rightarrow> ('a,'d) det_monad\"\n  shows \"(m >>= f) >>= g  =  m >>= (\\<lambda>x. f x >>= g)\"\n  apply (unfold bind_def h1_def h2_def Let_def split_def)\n  apply (rule ext)\n  apply clarsimp\n  done\n\n\nsection {* Adding Exceptions *}\n\ntext {* \n  The type @{typ \"('s,'a) det_monad\"} gives us determinism and\n  failure. We now extend this monad with exceptional return values\n  that abort normal execution, but can be handled explicitly.\n  We use the sum type to indicate exceptions. \n\n  In @{typ \"('s, 'e + 'a) det_monad\"}, @{typ \"'s\"} is the state,\n  @{typ 'e} is an exception, and @{typ 'a} is a normal return value.\n\n  This new type itself forms a monad again. Since type classes in \n  Isabelle are not powerful enough to express the class of monads,\n  we provide new names for the @{term return} and @{term bind} functions\n  in this monad. We call them @{text returnOk} (for normal return values)\n  and @{text bindE} (for composition). We also define @{text throwError}\n  to return an exceptional value.\n*}\ndefinition\n  returnOk :: \"'a \\<Rightarrow> ('s, 'e + 'a) det_monad\" where\n  \"returnOk \\<equiv> return o Inr\"\n\ndefinition\n  throwError :: \"'e \\<Rightarrow> ('s, 'e + 'a) det_monad\" where\n  \"throwError \\<equiv> return o Inl\"\n\ntext {*\n  Lifting a function over the exception type: if the input is an\n  exception, return that exception; otherwise continue execution.\n*}\ndefinition\n  lift :: \"('a \\<Rightarrow> ('s, 'e + 'b) det_monad) \\<Rightarrow> \n           'e +'a \\<Rightarrow> ('s, 'e + 'b) det_monad\"\nwhere\n  \"lift f v \\<equiv> case v of Inl e \\<Rightarrow> throwError e\n                      | Inr v' \\<Rightarrow> f v'\"\n\ntext {*\n  The definition of @{term bind} in the exception monad (new\n  name @{text bindE}): the same as normal @{term bind}, but \n  the right-hand side is skipped if the left-hand side\n  produced an exception.\n*}\ndefinition\n  bindE :: \"('s, 'e + 'a) det_monad \\<Rightarrow> \n            ('a \\<Rightarrow> ('s, 'e + 'b) det_monad) \\<Rightarrow> \n            ('s, 'e + 'b) det_monad\"  (infixl \">>=E\" 60)\nwhere\n  \"bindE f g \\<equiv> bind f (lift g)\"\n\n\ntext {* \n  Lifting a normal deterministic monad into the \n  exception monad is achieved by always returning its\n  result as normal result and never throwing an exception.\n*}\ndefinition\n  liftE :: \"('s,'a) det_monad \\<Rightarrow> ('s, 'e+'a) det_monad\"\nwhere\n  \"liftE f \\<equiv> f >>= (\\<lambda>r. return (Inr r))\"\n\n\ntext {*\n  Since the underlying type and @{text return} function changed, \n  we need new definitions for when and unless:\n*}\ndefinition\n  whenE :: \"bool \\<Rightarrow> ('s, 'e + unit) det_monad \\<Rightarrow> \n            ('s, 'e + unit) det_monad\" \n  where\n  \"whenE P f \\<equiv> if P then f else returnOk ()\"\n\ndefinition\n  unlessE :: \"bool \\<Rightarrow> ('s, 'e + unit) det_monad \\<Rightarrow> \n            ('s, 'e + unit) det_monad\" \n  where\n  \"unlessE P f \\<equiv> if P then returnOk () else f\"\n\n\ntext {*\n  Throwing an exception when the parameter is @{term None}, otherwise\n  returning @{term \"v\"} for @{term \"Some v\"}.\n*}\ndefinition\n  throw_opt :: \"'e \\<Rightarrow> 'a option \\<Rightarrow> ('s, 'e + 'a) det_monad\" where\n  \"throw_opt ex x \\<equiv> \n  case x of None \\<Rightarrow> throwError ex | Some v \\<Rightarrow> returnOk v\"\n\nsubsection \"Monad Laws for the Exception Monad\"\n\ntext {* More direct definition of @{const liftE}: *}\nlemma liftE_def2:\n  \"liftE f = (\\<lambda>s. ((\\<lambda>(v,s'). (Inr v, s'))  (fst (f s)), snd (f s)))\"\n  by (auto simp: Let_def liftE_def return_def split_def bind_def h1_def h2_def)\n  \ntext {* Left @{const returnOk} absorbtion over @{term bindE}: *}\n(*lemma returnOk_bindE [simp]: \"(returnOk x >>=E f) = f x\"\n  apply (unfold bindE_def return_def returnOk_def)\n  apply (clarsimp simp: lift_def)\n  done*)\n\nlemma lift_return [simp]:\n  \"lift (return \\<circ> Inr) = return\"\n  by (rule ext)\n     (simp add: lift_def throwError_def split: sum.splits)\n\ntext {* Right @{const returnOk} absorbtion over @{term bindE}: *}\nlemma bindE_returnOk [simp]: \"(m >>=E returnOk) = m\"\n  by (simp add: bindE_def returnOk_def)\n\ntext {* Associativity of @{const bindE}: *}\nlemma bindE_assoc:\n  \"(m >>=E f) >>=E g = m >>=E (\\<lambda>x. f x >>=E g)\"\n  apply (simp add: bindE_def bind_assoc)\n  apply (rule arg_cong [where f=\"\\<lambda>x. m >>= x\"])\n  apply (rule ext)\n  apply (case_tac x, simp_all add: lift_def throwError_def)\n  done\n\ntext {* @{const returnOk} could also be defined via @{const liftE}: *}\nlemma returnOk_liftE:\n  \"returnOk x = liftE (return x)\"\n  by (simp add: liftE_def returnOk_def)\n\ntext {* Execution after throwing an exception is skipped: *}\nlemma throwError_bindE [simp]:\n  \"(throwError E >>=E f) = throwError E\"\n  by (simp add: bindE_def bind_def h1_def h2_def throwError_def lift_def return_def)\n\n\nsection \"Syntax\"\n\ntext {* This section defines traditional Haskell-like do-syntax \n  for the state monad in Isabelle. *}\n\nsubsection \"Syntax for the Nondeterministic State Monad\"\n\ntext {* We use @{text K_bind} to syntactically indicate the \n  case where the return argument of the left side of a @{term bind}\n  is ignored *}\ndefinition\n  K_bind_def [iff]: \"K_bind \\<equiv> \\<lambda>x y. x\"\n\nnonterminal\n  dobinds and dobind and nobind\n\nsyntax\n  \"_dobind\"    :: \"[pttrn, 'a] => dobind\"             (\"(_ <-/ _)\" 10)\n  \"\"           :: \"dobind => dobinds\"                 (\"_\")\n  \"_nobind\"    :: \"'a => dobind\"                      (\"_\")\n  \"_dobinds\"   :: \"[dobind, dobinds] => dobinds\"      (\"(_);//(_)\")\n\n  \"_do\"        :: \"[dobinds, 'a] => 'a\"               (\"(do ((_);//(_))//od)\" 100)\nsyntax (xsymbols)\n  \"_dobind\"    :: \"[pttrn, 'a] => dobind\"             (\"(_ \\<leftarrow>/ _)\" 10)\n\ntranslations\n  \"_do (_dobinds b bs) e\"  == \"_do b (_do bs e)\"\n  \"_do (_nobind b) e\"      == \"b >>= (CONST K_bind e)\"\n  \"do x <- a; e od\"        == \"a >>= (\\<lambda>x. e)\"  \n\ntext {* Syntax examples: *}\nlemma \"do x \\<leftarrow> return 1; \n          return (2::nat); \n          return x \n       od = \n       return 1 >>= \n       (\\<lambda>x. return (2::nat) >>= \n            K_bind (return x))\" \n  by (rule refl)\n\nlemma \"do x \\<leftarrow> return 1; \n          return 2; \n          return x \n       od = return 1\" \n  by simp\n\nsubsection \"Syntax for the Exception Monad\"\n\ntext {*\n  Since the exception monad is a different type, we\n  need to syntactically distinguish it in the syntax.\n  We use @{text doE}/@{text odE} for this, but can re-use\n  most of the productions from @{text do}/@{text od}\n  above.\n*}\n\nsyntax\n  \"_doE\" :: \"[dobinds, 'a] => 'a\"  (\"(doE ((_);//(_))//odE)\" 100)\n\ntranslations\n  \"_doE (_dobinds b bs) e\"  == \"_doE b (_doE bs e)\"\n  \"_doE (_nobind b) e\"      == \"b >>=E (CONST K_bind e)\"\n  \"doE x <- a; e odE\"       == \"a >>=E (\\<lambda>x. e)\"\n\ntext {* Syntax examples: *}\nlemma \"doE x \\<leftarrow> returnOk 1; \n           returnOk (2::nat); \n           returnOk x \n       odE =\n       returnOk 1 >>=E \n       (\\<lambda>x. returnOk (2::nat) >>=E \n            K_bind (returnOk x))\"\n  by (rule refl)\n\n(*lemma \"doE x \\<leftarrow> returnOk 1; \n           returnOk 2; \n           returnOk x \n       odE = returnOk 1\" \n  by simp*)\n\n\n\nsection \"Library of Monadic Functions and Combinators\"\n\n\ntext {* Lifting a normal function into the monad type: *}\ndefinition\n  liftM :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('s,'a) det_monad \\<Rightarrow> ('s, 'b) det_monad\"\nwhere\n  \"liftM f m \\<equiv> do x \\<leftarrow> m; return (f x) od\"\n\ntext {* The same for the exception monad: *}\ndefinition\n  liftME :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('s,'e+'a) det_monad \\<Rightarrow> ('s,'e+'b) det_monad\"\nwhere\n  \"liftME f m \\<equiv> doE x \\<leftarrow> m; returnOk (f x) odE\"\n\ntext {* \n  Run a sequence of monads from left to right, ignoring return values. *}\ndefinition\n  sequence_x :: \"('s, 'a) det_monad list \\<Rightarrow> ('s, unit) det_monad\" \nwhere\n  \"sequence_x xs \\<equiv> foldr (\\<lambda>x y. x >>= (\\<lambda>_. y)) xs (return ())\"\n\ntext {*\n  Map a monadic function over a list by applying it to each element\n  of the list from left to right, ignoring return values.\n*}\ndefinition\n  mapM_x :: \"('a \\<Rightarrow> ('s,'b) det_monad) \\<Rightarrow> 'a list \\<Rightarrow> ('s, unit) det_monad\"\nwhere\n  \"mapM_x f xs \\<equiv> sequence_x (map f xs)\"\n\ntext {*\n  Map a monadic function with two parameters over two lists,\n  going through both lists simultaneously, left to right, ignoring\n  return values.\n*}\ndefinition\n  zipWithM_x :: \"('a \\<Rightarrow> 'b \\<Rightarrow> ('s,'c) det_monad) \\<Rightarrow> \n                 'a list \\<Rightarrow> 'b list \\<Rightarrow> ('s, unit) det_monad\"\nwhere\n  \"zipWithM_x f xs ys \\<equiv> sequence_x (zipWith f xs ys)\"\n\n\ntext {* The same three functions as above, but returning a list of\nreturn values instead of @{text unit} *}\ndefinition\n  sequence :: \"('s, 'a) det_monad list \\<Rightarrow> ('s, 'a list) det_monad\" \nwhere\n  \"sequence xs \\<equiv> let mcons = (\\<lambda>p q. p >>= (\\<lambda>x. q >>= (\\<lambda>y. return (x#y))))\n                 in foldr mcons xs (return [])\"\n\ndefinition\n  mapM :: \"('a \\<Rightarrow> ('s,'b) det_monad) \\<Rightarrow> 'a list \\<Rightarrow> ('s, 'b list) det_monad\"\nwhere\n  \"mapM f xs \\<equiv> sequence (map f xs)\"\n\ndefinition\n  zipWithM :: \"('a \\<Rightarrow> 'b \\<Rightarrow> ('s,'c) det_monad) \\<Rightarrow> \n                 'a list \\<Rightarrow> 'b list \\<Rightarrow> ('s, 'c list) det_monad\"\nwhere\n  \"zipWithM f xs ys \\<equiv> sequence (zipWith f xs ys)\"\n\ndefinition\n  foldM :: \"('b \\<Rightarrow> 'a \\<Rightarrow> ('s, 'a) det_monad) \\<Rightarrow> 'b list \\<Rightarrow> 'a \\<Rightarrow> ('s, 'a) det_monad\" \nwhere\n  \"foldM m xs a \\<equiv> foldr (\\<lambda>p q. q >>= m p) xs (return a) \"\n\ntext {* The sequence and map functions above for the exception monad,\nwith and without lists of return value *}\ndefinition\n  sequenceE_x :: \"('s, 'e+'a) det_monad list \\<Rightarrow> ('s, 'e+unit) det_monad\" \nwhere\n  \"sequenceE_x xs \\<equiv> foldr (\\<lambda>x y. doE _ <- x; y odE) xs (returnOk ())\"\n\ndefinition\n  mapME_x :: \"('a \\<Rightarrow> ('s,'e+'b) det_monad) \\<Rightarrow> 'a list \\<Rightarrow> \n              ('s,'e+unit) det_monad\"\nwhere\n  \"mapME_x f xs \\<equiv> sequenceE_x (map f xs)\"\n\ndefinition\n  sequenceE :: \"('s, 'e+'a) det_monad list \\<Rightarrow> ('s, 'e+'a list) det_monad\" \nwhere\n  \"sequenceE xs \\<equiv> let mcons = (\\<lambda>p q. p >>=E (\\<lambda>x. q >>=E (\\<lambda>y. returnOk (x#y))))\n                 in foldr mcons xs (returnOk [])\"\n\ndefinition\n  mapME :: \"('a \\<Rightarrow> ('s,'e+'b) det_monad) \\<Rightarrow> 'a list \\<Rightarrow> \n              ('s,'e+'b list) det_monad\"\nwhere\n  \"mapME f xs \\<equiv> sequenceE (map f xs)\"\n\n\ntext {* Filtering a list using a monadic function as predicate: *}\nprimrec\n  filterM :: \"('a \\<Rightarrow> ('s, bool) det_monad) \\<Rightarrow> 'a list \\<Rightarrow> ('s, 'a list) det_monad\"\nwhere\n  \"filterM P []       = return []\"\n| \"filterM P (x # xs) = do\n     b  <- P x;\n     ys <- filterM P xs; \n     return (if b then (x # ys) else ys)\n   od\"\n\n\nsection \"Catching and Handling Exceptions\"\n\ntext {*\n  Turning an exception monad into a normal state monad\n  by catching and handling any potential exceptions:\n*}\ndefinition\n  catch :: \"('s, 'e + 'a) det_monad \\<Rightarrow>\n            ('e \\<Rightarrow> ('s, 'a) det_monad) \\<Rightarrow>\n            ('s, 'a) det_monad\" (infix \"<catch>\" 10)\nwhere\n  \"f <catch> handler \\<equiv>\n     do x \\<leftarrow> f;\n        case x of\n          Inr b \\<Rightarrow> return b\n        | Inl e \\<Rightarrow> handler e\n     od\"\n\ntext {*\n  Handling exceptions, but staying in the exception monad.\n  The handler may throw a type of exceptions different from\n  the left side.\n*}\ndefinition\n  handleE' :: \"('s, 'e1 + 'a) det_monad \\<Rightarrow>\n               ('e1 \\<Rightarrow> ('s, 'e2 + 'a) det_monad) \\<Rightarrow>\n               ('s, 'e2 + 'a) det_monad\" (infix \"<handle2>\" 10)\nwhere\n  \"f <handle2> handler \\<equiv>\n   do\n      v \\<leftarrow> f;\n      case v of\n        Inl e \\<Rightarrow> handler e\n      | Inr v' \\<Rightarrow> return (Inr v')\n   od\"\n\ntext {*\n  A type restriction of the above that is used more commonly in\n  practice: the exception handle (potentially) throws exception\n  of the same type as the left-hand side.\n*}\ndefinition\n  handleE :: \"('s, 'x + 'a) det_monad \\<Rightarrow> \n              ('x \\<Rightarrow> ('s, 'x + 'a) det_monad) \\<Rightarrow> \n              ('s, 'x + 'a) det_monad\" (infix \"<handle>\" 10)\nwhere\n  \"handleE \\<equiv> handleE'\"\n\n\ntext {*\n  Handling exceptions, and additionally providing a continuation\n  if the left-hand side throws no exception:\n*}\ndefinition\n  handle_elseE :: \"('s, 'e + 'a) det_monad \\<Rightarrow>\n                   ('e \\<Rightarrow> ('s, 'ee + 'b) det_monad) \\<Rightarrow>\n                   ('a \\<Rightarrow> ('s, 'ee + 'b) det_monad) \\<Rightarrow>\n                   ('s, 'ee + 'b) det_monad\"\n  (\"_ <handle> _ <else> _\" 10)\nwhere\n  \"f <handle> handler <else> continue \\<equiv>\n   do v \\<leftarrow> f;\n   case v of Inl e  \\<Rightarrow> handler e\n           | Inr v' \\<Rightarrow> continue v'\n   od\"\n\nsection \"Hoare Logic\"\n\nsubsection \"Validity\"\n\ntext {* This section defines a Hoare logic for partial correctness for\n  the deterministic state monad as well as the exception monad.\n  The logic talks only about the behaviour part of the monad and ignores\n  the failure flag.\n\n  The logic is defined semantically. Rules work directly on the\n  validity predicate.\n\n  In the deterministic state monad, validity is a triple of precondition,\n  monad, and postcondition. The precondition is a function from state to \n  bool (a state predicate), the postcondition is a function from return value\n  to state to bool. A triple is valid if for all states that satisfy the\n  precondition, all result values and result states that are returned by\n  the monad satisfy the postcondition. Note that if the computation returns\n  the empty set, the triple is trivially valid. This means @{term \"assert P\"} \n  does not require us to prove that @{term P} holds, but rather allows us\n  to assume @{term P}! Proving non-failure is done via separate predicate and\n  calculus (see below).\n*}\ndefinition\n  valid :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) det_monad \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\" \n  (\"\\<lbrace>_\\<rbrace>/ _ /\\<lbrace>_\\<rbrace>\")\nwhere\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<equiv> \\<forall>s. P s \\<longrightarrow> (\\<forall>r s'. ((r,s') = fst (f s) \\<longrightarrow> Q r s'))\"\n\ntext {* \n  Validity for the exception monad is similar and build on the standard \n  validity above. Instead of one postcondition, we have two: one for\n  normal and one for exceptional results.\n*}\ndefinition\n  validE :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'a + 'b) det_monad \\<Rightarrow> \n             ('b \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> \n             ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\" \n(\"\\<lbrace>_\\<rbrace>/ _ /(\\<lbrace>_\\<rbrace>,/ \\<lbrace>_\\<rbrace>)\")\nwhere\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace> \\<equiv> \\<lbrace>P\\<rbrace> f \\<lbrace> \\<lambda>v s. case v of Inr r \\<Rightarrow> Q r s | Inl e \\<Rightarrow> E e s \\<rbrace>\"\n\n\ntext {*\n  The following two instantiations are convenient to separate reasoning\n  for exceptional and normal case.\n*}\ndefinition\n  validE_R :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'e + 'a) det_monad \\<Rightarrow> \n               ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n   (\"\\<lbrace>_\\<rbrace>/ _ /\\<lbrace>_\\<rbrace>, -\")\nwhere\n \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,- \\<equiv> validE P f Q (\\<lambda>x y. True)\"\n\ndefinition\n  validE_E :: \"('s \\<Rightarrow> bool) \\<Rightarrow>  ('s, 'e + 'a) det_monad \\<Rightarrow> \n               ('e \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n   (\"\\<lbrace>_\\<rbrace>/ _ /-, \\<lbrace>_\\<rbrace>\")\nwhere\n \"\\<lbrace>P\\<rbrace> f -,\\<lbrace>Q\\<rbrace> \\<equiv> validE P f (\\<lambda>x y. True) Q\"\n\n\ntext {* Abbreviations for trivial preconditions: *}\nabbreviation(input)\n  top :: \"'a \\<Rightarrow> bool\" (\"\\<top>\")\nwhere\n  \"\\<top> \\<equiv> \\<lambda>_. True\"\n\nabbreviation(input)\n  bottom :: \"'a \\<Rightarrow> bool\" (\"\\<bottom>\")\nwhere\n  \"\\<bottom> \\<equiv> \\<lambda>_. False\"\n\ntext {* Abbreviations for trivial postconditions (taking two arguments): *}\nabbreviation(input)\n  toptop :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (\"\\<top>\\<top>\")\nwhere\n \"\\<top>\\<top> \\<equiv> \\<lambda>_ _. True\"\n\nabbreviation(input)\n  botbot :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (\"\\<bottom>\\<bottom>\")\nwhere\n \"\\<bottom>\\<bottom> \\<equiv> \\<lambda>_ _. False\"\n\ntext {* \n  Lifting @{text \"\\<and>\"} and @{text \"\\<or>\"} over two arguments. \n  Lifting @{text \"\\<and>\"} and @{text \"\\<or>\"} over one argument is already\n  defined (written @{text \"and\"} and @{text \"or\"}).\n*}\ndefinition\n  bipred_conj :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\" \n  (infixl \"And\" 96)\nwhere\n  \"bipred_conj P Q \\<equiv> \\<lambda>x y. P x y \\<and> Q x y\"\n\ndefinition\n  bipred_disj :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\" \n  (infixl \"Or\" 91)\nwhere\n  \"bipred_disj P Q \\<equiv> \\<lambda>x y. P x y \\<or> Q x y\"\n\n\nsubsection \"Determinism\"\n\ntext {* A monad of type @{text det_monad} is deterministic iff it\nreturns exactly one state and result and does not fail *} \ndefinition\n  det :: \"('a,'s) det_monad \\<Rightarrow> bool\"\nwhere\n  \"det f \\<equiv> \\<forall>s. \\<exists>r. f s = (r,False)\" \n\ntext {* A deterministic @{text det_monad} can be turned\n  into a normal state monad: *}\ndefinition\n  the_run_state :: \"('s,'a) det_monad \\<Rightarrow> 's \\<Rightarrow> 'a \\<times> 's\"\nwhere\n  \"the_run_state M \\<equiv> \\<lambda>s. THE s'. fst (M s) = s'\"\n\n\nsubsection \"Non-Failure\"\n\ntext {* \n  With the failure flag, we can formulate non-failure separately\n  from validity. A monad @{text m} does not fail under precondition\n  @{text P}, if for no start state in that precondition it sets\n  the failure flag.\n*}\ndefinition\n  no_fail :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) det_monad \\<Rightarrow> bool\"\nwhere\n  \"no_fail P m \\<equiv> \\<forall>s. P s \\<longrightarrow> \\<not> (snd (m s))\"\n\n\ntext {*\n  It is often desired to prove non-failure and a Hoare triple\n  simultaneously, as the reasoning is often similar. The following\n  definitions allow such reasoning to take place.\n*}\n\ndefinition\n  validNF ::\"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) det_monad \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n      (\"\\<lbrace>_\\<rbrace>/ _ /\\<lbrace>_\\<rbrace>!\")\nwhere\n  \"validNF P f Q \\<equiv> valid P f Q \\<and> no_fail P f\"\n\ndefinition\n  validE_NF :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'a + 'b) det_monad \\<Rightarrow>\n             ('b \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow>\n             ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  (\"\\<lbrace>_\\<rbrace>/ _ /(\\<lbrace>_\\<rbrace>,/ \\<lbrace>_\\<rbrace>!)\")\nwhere\n  \"validE_NF P f Q E \\<equiv> validE P f Q E \\<and> no_fail P f\"\n\nlemma validE_NF_alt_def:\n  \"\\<lbrace> P \\<rbrace> B \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>! = \\<lbrace> P \\<rbrace> B \\<lbrace> \\<lambda>v s. case v of Inl e \\<Rightarrow> E e s | Inr r \\<Rightarrow> Q r s \\<rbrace>!\"\n  by (clarsimp simp: validE_NF_def validE_def validNF_def)\n\nsection \"Basic exception reasoning\"\n\ntext {*\n  The following predicates @{text no_throw} and @{text no_return} allow\n  reasoning that functions in the exception monad either do\n  no throw an exception or never return normally.\n*}\n\ndefinition \"no_throw P A \\<equiv> \\<lbrace> P \\<rbrace> A \\<lbrace> \\<lambda>_ _. True \\<rbrace>,\\<lbrace> \\<lambda>_ _. False \\<rbrace>\"\n\ndefinition \"no_return P A \\<equiv> \\<lbrace> P \\<rbrace> A \\<lbrace>\\<lambda>_ _. False\\<rbrace>,\\<lbrace>\\<lambda>_ _. True \\<rbrace>\"\n\nend\n", "meta": {"author": "CompSoftVer", "repo": "SPARCv8-Models", "sha": "1abb204edb45e4839d3bfc0bc8b3e8ab4148c1a5", "save_path": "github-repos/isabelle/CompSoftVer-SPARCv8-Models", "path": "github-repos/isabelle/CompSoftVer-SPARCv8-Models/SPARCv8-Models-1abb204edb45e4839d3bfc0bc8b3e8ab4148c1a5/SparcWeakMemory/lib/wp/DetMonad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632683808532, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.30727067198069863}}
{"text": "section \\<open> Stateful-Failure Healthiness Conditions \\<close>\n\ntheory utp_sfrd_healths\n  imports utp_sfrd_rel\nbegin\n\nsection \\<open> Definitions \\<close>\n\ntext \\<open> We here define extra healthiness conditions for stateful-failure reactive designs. \\<close>\n\nabbreviation CSP1 :: \"(('\\<sigma>, '\\<phi>) sfrd \\<times> ('\\<sigma>, '\\<phi>) sfrd) health\"\nwhere \"CSP1(P) \\<equiv> RD1(P)\"\n\nabbreviation CSP2 :: \"(('\\<sigma>, '\\<phi>) sfrd \\<times> ('\\<sigma>, '\\<phi>) sfrd) health\"\nwhere \"CSP2(P) \\<equiv> RD2(P)\"\n\nabbreviation CSP :: \"(('\\<sigma>, '\\<phi>) sfrd \\<times> ('\\<sigma>, '\\<phi>) sfrd) health\"\nwhere \"CSP(P) \\<equiv> SRD(P)\"\n\ndefinition STOP :: \"'\\<phi> process\" where\n[upred_defs]: \"STOP = CSP1($ok\\<acute> \\<and> R3c($tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute>))\"\n\ndefinition SKIP :: \"'\\<phi> process\" where\n[upred_defs]: \"SKIP = \\<^bold>R\\<^sub>s(\\<exists> $ref \\<bullet> CSP1(II))\"\n\ndefinition Stop :: \"('\\<sigma>, '\\<phi>) action\" where\n[upred_defs]: \"Stop = \\<^bold>R\\<^sub>s(true \\<turnstile> ($tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute>))\"\n\ndefinition Skip :: \"('\\<sigma>, '\\<phi>) action\" where\n[upred_defs]: \"Skip = \\<^bold>R\\<^sub>s(true \\<turnstile> ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<not> $wait\\<acute> \\<and> $st\\<acute> =\\<^sub>u $st))\"\n\ndefinition CSP3 :: \"(('\\<sigma>, '\\<phi>) sfrd \\<times> ('\\<sigma>, '\\<phi>) sfrd) health\" where\n[upred_defs]: \"CSP3(P) = (Skip ;; P)\"\n\ndefinition CSP4 :: \"(('\\<sigma>, '\\<phi>) sfrd \\<times> ('\\<sigma>, '\\<phi>) sfrd) health\" where\n[upred_defs]: \"CSP4(P) = (P ;; Skip)\"\n\ndefinition NCSP :: \"(('\\<sigma>, '\\<phi>) sfrd \\<times> ('\\<sigma>, '\\<phi>) sfrd) health\" where\n[upred_defs]: \"NCSP = CSP3 \\<circ> CSP4 \\<circ> CSP\"\n\ntext \\<open> Productive and normal processes \\<close>\n\nabbreviation \"PCSP \\<equiv> Productive \\<circ> NCSP\"\n\ntext \\<open> Instantaneous and normal processes \\<close>\n\nabbreviation \"ICSP \\<equiv> ISRD1 \\<circ> NCSP\"\n\nsubsection \\<open> Healthiness condition properties \\<close>\n\ntext \\<open> @{term SKIP} is the same as @{term Skip}, and @{term STOP} is the same as @{term Stop},\n  when we consider stateless CSP processes. This is because any reference to the @{term st}\n  variable degenerates when the alphabet type coerces its type to be empty. We therefore\n  need not consider @{term SKIP} and @{term STOP} actions. \\<close>\n\ntheorem SKIP_is_Skip [simp]: \"SKIP = Skip\"\n  by (rel_auto)\n\ntheorem STOP_is_Stop [simp]: \"STOP = Stop\"\n  by (rel_auto)\n\ntheorem Skip_UTP_form: \"Skip = \\<^bold>R\\<^sub>s(\\<exists> $ref \\<bullet> CSP1(II))\"\n  by (rel_auto)\n\nlemma Skip_is_CSP [closure]:\n  \"Skip is CSP\"\n  by (simp add: Skip_def RHS_design_is_SRD unrest)\n\nlemma Skip_RHS_tri_design: \n  \"Skip = \\<^bold>R\\<^sub>s(true \\<turnstile> (false \\<diamondop> ($tr\\<acute> =\\<^sub>u $tr \\<and> $st\\<acute> =\\<^sub>u $st)))\"\n  by (rel_auto)\n\nlemma Skip_RHS_tri_design' [rdes_def]: \n  \"Skip = \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> (false \\<diamondop> \\<Phi>(true,id\\<^sub>s,\\<guillemotleft>[]\\<guillemotright>)))\"\n  by (rel_auto)\n\nlemma Skip_frame [frame]: \"vwb_lens a \\<Longrightarrow> a:[Skip]\\<^sub>R\\<^sup>+ = Skip\"\n  by (rdes_eq)\n\nlemma Stop_is_CSP [closure]:\n  \"Stop is CSP\"\n  by (simp add: Stop_def RHS_design_is_SRD unrest)\n\nlemma Stop_RHS_tri_design: \"Stop = \\<^bold>R\\<^sub>s(true \\<turnstile> ($tr\\<acute> =\\<^sub>u $tr) \\<diamondop> false)\"\n  by (rel_auto)\n\nlemma Stop_RHS_rdes_def [rdes_def]: \"Stop = \\<^bold>R\\<^sub>s(true\\<^sub>r \\<turnstile> \\<E>(true,\\<guillemotleft>[]\\<guillemotright>,{}\\<^sub>u) \\<diamondop> false)\"\n  by (rel_auto)\n\nlemma preR_Skip [rdes]: \"pre\\<^sub>R(Skip) = true\\<^sub>r\"\n  by (rel_auto)\n\nlemma periR_Skip [rdes]: \"peri\\<^sub>R(Skip) = false\"\n  by (rel_auto)\n\nlemma postR_Skip [rdes]: \"post\\<^sub>R(Skip) = \\<Phi>(true,id\\<^sub>s,\\<guillemotleft>[]\\<guillemotright>)\"\n  by (rel_auto)\n\nlemma Productive_Stop [closure]:\n  \"Stop is Productive\"\n  by (simp add: Stop_RHS_tri_design Healthy_def Productive_RHS_design_form unrest closure)\n\nlemma Skip_left_lemma:\n  assumes \"P is CSP\"\n  shows \"Skip ;; P = \\<^bold>R\\<^sub>s ((\\<forall> $ref \\<bullet> pre\\<^sub>R P) \\<turnstile> (\\<exists> $ref \\<bullet> cmt\\<^sub>R P))\"\nproof -\n  have \"Skip ;; P = \n        \\<^bold>R\\<^sub>s (($tr\\<acute> =\\<^sub>u $tr \\<and> $st\\<acute> =\\<^sub>u $st) wp\\<^sub>r pre\\<^sub>R P \\<turnstile> \n            ($tr\\<acute> =\\<^sub>u $tr \\<and> $st\\<acute> =\\<^sub>u $st) ;; peri\\<^sub>R P \\<diamondop> \n            ($tr\\<acute> =\\<^sub>u $tr \\<and> $st\\<acute> =\\<^sub>u $st) ;; post\\<^sub>R P)\"\n    by (simp add: SRD_composition_wp alpha rdes closure wp assms rpred C1, rel_auto)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<forall> $ref \\<bullet> pre\\<^sub>R P) \\<turnstile>\n                      ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<not> $wait\\<acute> \\<and> $st\\<acute> =\\<^sub>u $st) ;; ((\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D) \\<triangleleft> $wait \\<triangleright> cmt\\<^sub>R P))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)      \n  also have \"... = \\<^bold>R\\<^sub>s ((\\<forall> $ref \\<bullet> pre\\<^sub>R P) \\<turnstile> (\\<exists> $ref \\<bullet> cmt\\<^sub>R P))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma Skip_left_unit_ref_unrest:\n  assumes \"P is CSP\" \"$ref \\<sharp> P\\<lbrakk>false/$wait\\<rbrakk>\"\n  shows \"Skip ;; P = P\"\n  using assms\n  by (simp add: Skip_left_lemma)\n     (metis SRD_reactive_design_alt all_unrest cmt_unrest_ref cmt_wait_false ex_unrest pre_unrest_ref pre_wait_false)\n\nlemma CSP3_intro:\n  \"\\<lbrakk> P is CSP; $ref \\<sharp> P\\<lbrakk>false/$wait\\<rbrakk> \\<rbrakk> \\<Longrightarrow> P is CSP3\"\n  by (simp add: CSP3_def Healthy_def' Skip_left_unit_ref_unrest)\n\nlemma ref_unrest_RHS_design:\n  assumes \"$ref \\<sharp> P\" \"$ref \\<sharp> Q\\<^sub>1\" \"$ref \\<sharp> Q\\<^sub>2\"\n  shows \"$ref \\<sharp> (\\<^bold>R\\<^sub>s(P \\<turnstile> Q\\<^sub>1 \\<diamondop> Q\\<^sub>2)) \\<^sub>f\"\n  by (simp add: RHS_def R1_def R2c_def R2s_def R3h_def design_def unrest usubst assms)\n\nlemma CSP3_SRD_intro:\n  assumes \"P is CSP\" \"$ref \\<sharp> pre\\<^sub>R(P)\" \"$ref \\<sharp> peri\\<^sub>R(P)\" \"$ref \\<sharp> post\\<^sub>R(P)\"\n  shows \"P is CSP3\"\nproof -\n  have P: \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) = P\"\n    by (simp add: SRD_reactive_design_alt assms(1) wait'_cond_peri_post_cmt[THEN sym])\n  have \"\\<^bold>R\\<^sub>s(pre\\<^sub>R(P) \\<turnstile> peri\\<^sub>R(P) \\<diamondop> post\\<^sub>R(P)) is CSP3\"\n    by (rule CSP3_intro, simp add: assms P, simp add: ref_unrest_RHS_design assms)\n  thus ?thesis\n    by (simp add: P)\nqed\n\nlemma Skip_unrest_ref [unrest]: \"$ref \\<sharp> Skip\\<lbrakk>false/$wait\\<rbrakk>\"\n  by (simp add: Skip_def RHS_def R1_def R2c_def R2s_def R3h_def design_def usubst unrest)\n\nlemma Skip_unrest_ref' [unrest]: \"$ref\\<acute> \\<sharp> Skip\\<lbrakk>false/$wait\\<rbrakk>\"\n  by (simp add: Skip_def RHS_def R1_def R2c_def R2s_def R3h_def design_def usubst unrest)\n\nlemma CSP3_iff:\n  assumes \"P is CSP\"\n  shows \"P is CSP3 \\<longleftrightarrow> ($ref \\<sharp> P\\<lbrakk>false/$wait\\<rbrakk>)\"\nproof\n  assume 1: \"P is CSP3\"\n  have \"$ref \\<sharp> (Skip ;; P)\\<lbrakk>false/$wait\\<rbrakk>\"\n    by (simp add: usubst unrest)\n  with 1 show \"$ref \\<sharp> P\\<lbrakk>false/$wait\\<rbrakk>\"\n    by (metis CSP3_def Healthy_def)\nnext\n  assume 1:\"$ref \\<sharp> P\\<lbrakk>false/$wait\\<rbrakk>\"\n  show \"P is CSP3\"\n    by (simp add: 1 CSP3_intro assms)\nqed\n\nlemma CSP3_unrest_ref [unrest]:\n  assumes \"P is CSP\" \"P is CSP3\"\n  shows \"$ref \\<sharp> pre\\<^sub>R(P)\" \"$ref \\<sharp> peri\\<^sub>R(P)\" \"$ref \\<sharp> post\\<^sub>R(P)\"\nproof -\n  have a:\"($ref \\<sharp> P\\<lbrakk>false/$wait\\<rbrakk>)\"\n    using CSP3_iff assms by blast\n  from a show \"$ref \\<sharp> pre\\<^sub>R(P)\"\n    by (rel_blast)\n  from a show \"$ref \\<sharp> peri\\<^sub>R(P)\"\n    by (rel_blast)\n  from a show \"$ref \\<sharp> post\\<^sub>R(P)\"\n    by (rel_blast)\nqed\n\nlemma CSP3_rdes:\n  assumes \"P is RR\" \"Q is RR\" \"R is RR\"\n  shows \"CSP3(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = \\<^bold>R\\<^sub>s((\\<forall> $ref \\<bullet> P) \\<turnstile> (\\<exists> $ref \\<bullet> Q) \\<diamondop> (\\<exists> $ref \\<bullet> R))\"\n  by (simp add: CSP3_def Skip_left_lemma closure assms rdes, rel_auto)\n\nlemma CSP3_form:\n  assumes \"P is CSP\"\n  shows \"CSP3(P) = \\<^bold>R\\<^sub>s((\\<forall> $ref \\<bullet> pre\\<^sub>R(P)) \\<turnstile> (\\<exists> $ref \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<exists> $ref \\<bullet> post\\<^sub>R(P)))\"\n  by (simp add: CSP3_def Skip_left_lemma assms, rel_auto)\n\nlemma CSP3_Skip [closure]:\n  \"Skip is CSP3\"\n  by (rule CSP3_intro, simp add: Skip_is_CSP, simp add: Skip_def unrest)\n\nlemma CSP3_Stop [closure]:\n  \"Stop is CSP3\"\n  by (rule CSP3_intro, simp add: Stop_is_CSP, simp add: Stop_def unrest)\n\nlemma CSP3_Idempotent [closure]: \"Idempotent CSP3\"\n  by (metis (no_types, lifting) CSP3_Skip CSP3_def Healthy_if Idempotent_def seqr_assoc)\n\nlemma CSP3_Continuous: \"Continuous CSP3\"\n  by (simp add: Continuous_def CSP3_def seq_Sup_distl)\n\nlemma Skip_right_lemma:\n  assumes \"P is CSP\"\n  shows \"P ;; Skip = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> cmt\\<^sub>R P) \\<triangleleft> $wait\\<acute> \\<triangleright> (\\<exists> $ref\\<acute> \\<bullet> cmt\\<^sub>R P)))\"\nproof -\n  have \"P ;; Skip = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> (\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> post\\<^sub>R P ;; ($tr\\<acute> =\\<^sub>u $tr \\<and> $st\\<acute> =\\<^sub>u $st))\"\n    by (simp add: SRD_composition_wp closure assms wp rdes rpred, rel_auto)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile>\n                       ((cmt\\<^sub>R P ;; (\\<exists> $st \\<bullet> \\<lceil>II\\<rceil>\\<^sub>D)) \\<triangleleft> $wait\\<acute> \\<triangleright> (cmt\\<^sub>R P ;; ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<not> $wait \\<and> $st\\<acute> =\\<^sub>u $st))))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile>\n                       ((\\<exists> $st\\<acute> \\<bullet> cmt\\<^sub>R P) \\<triangleleft> $wait\\<acute> \\<triangleright> (cmt\\<^sub>R P ;; ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<not> $wait \\<and> $st\\<acute> =\\<^sub>u $st))))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> cmt\\<^sub>R P) \\<triangleleft> $wait\\<acute> \\<triangleright> (\\<exists> $ref\\<acute> \\<bullet> cmt\\<^sub>R P)))\"\n    by (rule cong[of \"\\<^bold>R\\<^sub>s\" \"\\<^bold>R\\<^sub>s\"], simp, rel_auto)\n  finally show ?thesis .\nqed\n\nlemma Skip_right_tri_lemma:\n  assumes \"P is CSP\"\n  shows \"P ;; Skip = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> (\\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R P)))\"\nproof -\n  have \"((\\<exists> $st\\<acute> \\<bullet> cmt\\<^sub>R P) \\<triangleleft> $wait\\<acute> \\<triangleright> (\\<exists> $ref\\<acute> \\<bullet> cmt\\<^sub>R P)) = ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> (\\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R P))\"\n    by (rel_auto)\n  thus ?thesis by (simp add: Skip_right_lemma[OF assms])\nqed\n\nlemma CSP4_intro:\n  assumes \"P is CSP\" \"(\\<not>\\<^sub>r pre\\<^sub>R(P)) ;; R1(true) = (\\<not>\\<^sub>r pre\\<^sub>R(P))\"\n          \"$st\\<acute> \\<sharp> (cmt\\<^sub>R P)\\<lbrakk>true/$wait\\<acute>\\<rbrakk>\" \"$ref\\<acute> \\<sharp> (cmt\\<^sub>R P)\\<lbrakk>false/$wait\\<acute>\\<rbrakk>\"\n  shows \"P is CSP4\"\nproof -\n  have \"CSP4(P) = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> cmt\\<^sub>R P) \\<triangleleft> $wait\\<acute> \\<triangleright> (\\<exists> $ref\\<acute> \\<bullet> cmt\\<^sub>R P)))\"\n    by (simp add: CSP4_def Skip_right_lemma assms(1))\n  also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R(P) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> cmt\\<^sub>R P)\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<triangleleft> $wait\\<acute> \\<triangleright> (\\<exists> $ref\\<acute> \\<bullet> cmt\\<^sub>R P)\\<lbrakk>false/$wait\\<acute>\\<rbrakk>))\"\n    by (simp add: wp_rea_def assms(2) rpred closure cond_var_subst_left cond_var_subst_right)\n  also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R(P) \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> (cmt\\<^sub>R P)\\<lbrakk>true/$wait\\<acute>\\<rbrakk>) \\<triangleleft> $wait\\<acute> \\<triangleright> (\\<exists> $ref\\<acute> \\<bullet> (cmt\\<^sub>R P)\\<lbrakk>false/$wait\\<acute>\\<rbrakk>)))\"\n    by (simp add: usubst unrest)\n  also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R P \\<turnstile> ((cmt\\<^sub>R P)\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<triangleleft> $wait\\<acute> \\<triangleright> (cmt\\<^sub>R P)\\<lbrakk>false/$wait\\<acute>\\<rbrakk>))\"\n    by (simp add: ex_unrest assms)\n  also have \"... = \\<^bold>R\\<^sub>s (pre\\<^sub>R P \\<turnstile> cmt\\<^sub>R P)\"\n    by (simp add: cond_var_split)\n  also have \"... = P\"\n    by (simp add: SRD_reactive_design_alt assms(1))\n  finally show ?thesis\n    by (simp add: Healthy_def')\nqed\n\nlemma CSP4_RC_intro:\n  assumes \"P is CSP\" \"pre\\<^sub>R(P) is RC\"\n          \"$st\\<acute> \\<sharp> (cmt\\<^sub>R P)\\<lbrakk>true/$wait\\<acute>\\<rbrakk>\" \"$ref\\<acute> \\<sharp> (cmt\\<^sub>R P)\\<lbrakk>false/$wait\\<acute>\\<rbrakk>\"\n  shows \"P is CSP4\"\nproof -\n  have \"(\\<not>\\<^sub>r pre\\<^sub>R(P)) ;; R1(true) = (\\<not>\\<^sub>r pre\\<^sub>R(P))\"\n    by (metis (no_types, lifting) R1_seqr_closure assms(2) rea_not_R1 rea_not_false rea_not_not wp_rea_RC_false wp_rea_def)\n  thus ?thesis\n    by (simp add: CSP4_intro assms)\nqed\n\nlemma CSP4_rdes:\n  assumes \"P is RR\" \"Q is RR\" \"R is RR\"\n  shows \"CSP4(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R)) = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> Q) \\<diamondop> (\\<exists> $ref\\<acute> \\<bullet> R)))\"\n  by (simp add: CSP4_def Skip_right_lemma closure assms rdes, rel_auto, blast+)\n\nlemma CSP4_form:\n  assumes \"P is CSP\"\n  shows \"CSP4(P) =   \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R P) \\<diamondop> (\\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R P)))\"\n  by (simp add: CSP4_def Skip_right_tri_lemma assms)\n\nlemma Skip_srdes_right_unit:\n  \"(Skip :: ('\\<sigma>,'\\<phi>) action) ;; II\\<^sub>R = Skip\"\n  by (rdes_simp)\n\nlemma Skip_srdes_left_unit:\n  \"II\\<^sub>R ;; (Skip :: ('\\<sigma>,'\\<phi>) action) = Skip\"\n  by (rdes_eq)\n\nlemma CSP4_right_subsumes_RD3: \"RD3(CSP4(P)) = CSP4(P)\"\n  by (metis (no_types, opaque_lifting) CSP4_def RD3_def Skip_srdes_right_unit seqr_assoc)\n\nlemma CSP4_implies_RD3: \"P is CSP4 \\<Longrightarrow> P is RD3\"\n  by (metis CSP4_right_subsumes_RD3 Healthy_def)\n\nlemma CSP4_tri_intro:\n  assumes \"P is CSP\" \"(\\<not>\\<^sub>r pre\\<^sub>R(P)) ;; R1(true) = (\\<not>\\<^sub>r pre\\<^sub>R(P))\" \"$st\\<acute> \\<sharp> peri\\<^sub>R(P)\" \"$ref\\<acute> \\<sharp> post\\<^sub>R(P)\"\n  shows \"P is CSP4\"\n  using assms\n  by (rule_tac CSP4_intro, simp_all add: pre\\<^sub>R_def peri\\<^sub>R_def post\\<^sub>R_def usubst cmt\\<^sub>R_def)\n\nlemma CSP4_NSRD_intro:\n  assumes \"P is NSRD\" \"$ref\\<acute> \\<sharp> post\\<^sub>R(P)\"\n  shows \"P is CSP4\"\n  by (simp add: CSP4_tri_intro NSRD_is_SRD NSRD_neg_pre_unit NSRD_st'_unrest_peri assms)\n\nlemma CSP3_commutes_CSP4: \"CSP3(CSP4(P)) = CSP4(CSP3(P))\"\n  by (simp add: CSP3_def CSP4_def seqr_assoc)\n\nlemma NCSP_implies_CSP [closure]: \"P is NCSP \\<Longrightarrow> P is CSP\"\n  by (metis (no_types, opaque_lifting) CSP3_def CSP4_def Healthy_def NCSP_def SRD_idem SRD_seqr_closure Skip_is_CSP comp_apply)\n\nlemma NCSP_elim [RD_elim]: \n  \"\\<lbrakk> X is NCSP; P(\\<^bold>R\\<^sub>s(pre\\<^sub>R(X) \\<turnstile> peri\\<^sub>R(X) \\<diamondop> post\\<^sub>R(X))) \\<rbrakk> \\<Longrightarrow> P(X)\"\n  by (simp add: SRD_reactive_tri_design closure)\n    \nlemma NCSP_implies_CSP3 [closure]:\n  \"P is NCSP \\<Longrightarrow> P is CSP3\"\n  by (metis (no_types, lifting) CSP3_def Healthy_def' NCSP_def Skip_is_CSP Skip_left_unit_ref_unrest Skip_unrest_ref comp_apply seqr_assoc)\n\nlemma NCSP_implies_CSP4 [closure]:\n  \"P is NCSP \\<Longrightarrow> P is CSP4\"\n  by (metis (no_types, opaque_lifting) CSP3_commutes_CSP4 Healthy_def NCSP_def NCSP_implies_CSP NCSP_implies_CSP3 comp_apply)\n\nlemma NCSP_implies_RD3 [closure]: \"P is NCSP \\<Longrightarrow> P is RD3\"\n  by (metis CSP3_commutes_CSP4 CSP4_right_subsumes_RD3 Healthy_def NCSP_def comp_apply)\n\nlemma NCSP_implies_NSRD [closure]: \"P is NCSP \\<Longrightarrow> P is NSRD\"\n  by (simp add: NCSP_implies_CSP NCSP_implies_RD3 SRD_RD3_implies_NSRD)\n\nlemma NCSP_subset_implies_CSP [closure]:\n  \"A \\<subseteq> \\<lbrakk>NCSP\\<rbrakk>\\<^sub>H \\<Longrightarrow> A \\<subseteq> \\<lbrakk>CSP\\<rbrakk>\\<^sub>H\"\n  using NCSP_implies_CSP by blast\n\nlemma NCSP_subset_implies_NSRD [closure]:\n  \"A \\<subseteq> \\<lbrakk>NCSP\\<rbrakk>\\<^sub>H \\<Longrightarrow> A \\<subseteq> \\<lbrakk>NSRD\\<rbrakk>\\<^sub>H\"\n  using NCSP_implies_NSRD by blast\n\nlemma CSP_Healthy_subset_member: \"\\<lbrakk> P \\<in> A; A \\<subseteq> \\<lbrakk>CSP\\<rbrakk>\\<^sub>H \\<rbrakk> \\<Longrightarrow> P is CSP\"\n  by (simp add: is_Healthy_subset_member)\n\nlemma CSP3_Healthy_subset_member: \"\\<lbrakk> P \\<in> A; A \\<subseteq> \\<lbrakk>CSP3\\<rbrakk>\\<^sub>H \\<rbrakk> \\<Longrightarrow> P is CSP3\"\n  by (simp add: is_Healthy_subset_member)\n\nlemma CSP4_Healthy_subset_member: \"\\<lbrakk> P \\<in> A; A \\<subseteq> \\<lbrakk>CSP4\\<rbrakk>\\<^sub>H \\<rbrakk> \\<Longrightarrow> P is CSP4\"\n  by (simp add: is_Healthy_subset_member)\n\nlemma NCSP_Healthy_subset_member: \"\\<lbrakk> P \\<in> A; A \\<subseteq> \\<lbrakk>NCSP\\<rbrakk>\\<^sub>H \\<rbrakk> \\<Longrightarrow> P is NCSP\"\n  by (simp add: is_Healthy_subset_member)\n\nlemma NCSP_intro:\n  assumes \"P is CSP\" \"P is CSP3\" \"P is CSP4\"\n  shows \"P is NCSP\"\n  by (metis Healthy_def NCSP_def assms comp_eq_dest_lhs)\n\nlemma Skip_left_unit: \"P is NCSP \\<Longrightarrow> Skip ;; P = P\"\n  by (metis (full_types) CSP3_def Healthy_if NCSP_implies_CSP3)\n\nlemma Skip_right_unit: \"P is NCSP \\<Longrightarrow> P ;; Skip = P\"\n  by (metis (full_types) CSP4_def Healthy_if NCSP_implies_CSP4)\n\nlemma NCSP_NSRD_intro:\n  assumes \"P is NSRD\" \"$ref \\<sharp> pre\\<^sub>R(P)\" \"$ref \\<sharp> peri\\<^sub>R(P)\" \"$ref \\<sharp> post\\<^sub>R(P)\" \"$ref\\<acute> \\<sharp> post\\<^sub>R(P)\"\n  shows \"P is NCSP\"\n  by (simp add: CSP3_SRD_intro CSP4_NSRD_intro NCSP_intro NSRD_is_SRD assms)\n\nlemma CSP4_neg_pre_unit:\n  assumes \"P is CSP\" \"P is CSP4\"\n  shows \"(\\<not>\\<^sub>r pre\\<^sub>R(P)) ;; R1(true) = (\\<not>\\<^sub>r pre\\<^sub>R(P))\"\n  by (simp add: CSP4_implies_RD3 NSRD_neg_pre_unit SRD_RD3_implies_NSRD assms(1) assms(2))\n\nlemma NSRD_CSP4_intro:\n  assumes \"P is CSP\" \"P is CSP4\"\n  shows \"P is NSRD\"\n  by (simp add: CSP4_implies_RD3 SRD_RD3_implies_NSRD assms(1) assms(2))\n\nlemma NCSP_form: \n  \"NCSP P = \\<^bold>R\\<^sub>s ((\\<forall> $ref \\<bullet> (\\<not>\\<^sub>r pre\\<^sub>R(P)) wp\\<^sub>r false) \\<turnstile> ((\\<exists> $ref \\<bullet> \\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<exists> $ref \\<bullet> \\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R(P))))\"\nproof -\n  have \"NCSP P = CSP3 (CSP4 (NSRD P))\"\n    by (metis (no_types, opaque_lifting) CSP4_def NCSP_def NSRD_alt_def RA1 RD3_def Skip_srdes_left_unit o_apply)\n  also \n  have \"... =  \\<^bold>R\\<^sub>s ((\\<forall> $ref \\<bullet> (\\<not>\\<^sub>r pre\\<^sub>R (NSRD P)) wp\\<^sub>r false) \\<turnstile>\n                   (\\<exists> $ref \\<bullet> \\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R (NSRD P)) \\<diamondop>\n                   (\\<exists> $ref \\<bullet> \\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R (NSRD P)))\"\n    by (simp add: CSP3_form CSP4_form closure unrest rdes, rel_auto)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<forall> $ref \\<bullet> (\\<not>\\<^sub>r pre\\<^sub>R(P)) wp\\<^sub>r false) \\<turnstile> ((\\<exists> $ref \\<bullet> \\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<exists> $ref \\<bullet> \\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R(P))))\"\n    by (simp add: NSRD_form rdes closure, rel_blast)\n  finally show ?thesis .\nqed\n\nlemma CSP4_st'_unrest_peri [unrest]:\n  assumes \"P is CSP\" \"P is CSP4\"\n  shows \"$st\\<acute> \\<sharp> peri\\<^sub>R(P)\"\n  by (simp add: NSRD_CSP4_intro NSRD_st'_unrest_peri assms)\n\nlemma CSP4_healthy_form:\n  assumes \"P is CSP\" \"P is CSP4\"\n  shows \"P = \\<^bold>R\\<^sub>s((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R(P))))\"\nproof -\n  have \"P = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> cmt\\<^sub>R P) \\<triangleleft> $wait\\<acute> \\<triangleright> (\\<exists> $ref\\<acute> \\<bullet> cmt\\<^sub>R P)))\"\n    by (metis CSP4_def Healthy_def Skip_right_lemma assms(1) assms(2))\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> cmt\\<^sub>R P)\\<lbrakk>true/$wait\\<acute>\\<rbrakk> \\<triangleleft> $wait\\<acute> \\<triangleright> (\\<exists> $ref\\<acute> \\<bullet> cmt\\<^sub>R P)\\<lbrakk>false/$wait\\<acute>\\<rbrakk>))\"\n    by (metis (no_types, opaque_lifting) subst_wait'_left_subst subst_wait'_right_subst wait'_cond_def)\n  also have \"... = \\<^bold>R\\<^sub>s((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R(P))))\"\n    by (simp add: wait'_cond_def usubst peri\\<^sub>R_def post\\<^sub>R_def cmt\\<^sub>R_def unrest)\n  finally show ?thesis .\nqed\n\nlemma CSP4_ref'_unrest_pre [unrest]:\n  assumes \"P is CSP\" \"P is CSP4\"\n  shows \"$ref\\<acute> \\<sharp> pre\\<^sub>R(P)\"\nproof -\n  have \"pre\\<^sub>R(P) = pre\\<^sub>R(\\<^bold>R\\<^sub>s((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R(P)))))\"\n    using CSP4_healthy_form assms(1) assms(2) by fastforce\n  also have \"... = (\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false\"\n    by (simp add: rea_pre_RHS_design wp_rea_def usubst unrest\n        CSP4_neg_pre_unit R1_rea_not R2c_preR R2c_rea_not assms)\n  also have \"$ref\\<acute> \\<sharp> ...\"\n    by (simp add: wp_rea_def unrest)\n  finally show ?thesis .\nqed\n\nlemma NCSP_set_unrest_pre_wait':\n  assumes \"A \\<subseteq> \\<lbrakk>NCSP\\<rbrakk>\\<^sub>H\"\n  shows \"\\<And> P. P \\<in> A \\<Longrightarrow> $wait\\<acute> \\<sharp> pre\\<^sub>R(P)\"\nproof -\n  fix P\n  assume \"P \\<in> A\"\n  hence \"P is NSRD\"\n    using NCSP_implies_NSRD assms by auto\n  thus \"$wait\\<acute> \\<sharp> pre\\<^sub>R(P)\"\n    using NSRD_wait'_unrest_pre by blast\nqed\n\nlemma CSP4_set_unrest_pre_st':\n  assumes \"A \\<subseteq> \\<lbrakk>CSP\\<rbrakk>\\<^sub>H\" \"A \\<subseteq> \\<lbrakk>CSP4\\<rbrakk>\\<^sub>H\"\n  shows \"\\<And> P. P \\<in> A \\<Longrightarrow> $st\\<acute> \\<sharp> pre\\<^sub>R(P)\"\nproof -\n  fix P\n  assume \"P \\<in> A\"\n  hence \"P is NSRD\"\n    using NSRD_CSP4_intro assms(1) assms(2) by blast\n  thus \"$st\\<acute> \\<sharp> pre\\<^sub>R(P)\"\n    using NSRD_st'_unrest_pre by blast\nqed\n\nlemma CSP4_ref'_unrest_post [unrest]:\n  assumes \"P is CSP\" \"P is CSP4\"\n  shows \"$ref\\<acute> \\<sharp> post\\<^sub>R(P)\"\nproof -\n  have \"post\\<^sub>R(P) = post\\<^sub>R(\\<^bold>R\\<^sub>s((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<turnstile> ((\\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R(P)) \\<diamondop> (\\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R(P)))))\"\n    using CSP4_healthy_form assms(1) assms(2) by fastforce\n  also have \"... = R1 (R2c ((\\<not>\\<^sub>r pre\\<^sub>R P) wp\\<^sub>r false \\<Rightarrow>\\<^sub>r (\\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R P)))\"\n    by (simp add: rea_post_RHS_design usubst unrest wp_rea_def)\n  also have \"$ref\\<acute> \\<sharp> ...\"\n    by (simp add: R1_def R2c_def wp_rea_def unrest)\n  finally show ?thesis .\nqed\n\nlemma CSP3_Chaos [closure]: \"Chaos is CSP3\"\n  by (simp add: Chaos_def, rule CSP3_intro, simp_all add: RHS_design_is_SRD unrest)\n\nlemma CSP4_Chaos [closure]: \"Chaos is CSP4\"\n  by (rule CSP4_tri_intro, simp_all add: closure rdes unrest)\n\nlemma NCSP_Chaos [closure]: \"Chaos is NCSP\"\n  by (simp add: NCSP_intro closure) \n    \nlemma CSP3_Miracle [closure]: \"Miracle is CSP3\"\n  by (simp add: Miracle_def, rule CSP3_intro, simp_all add: RHS_design_is_SRD unrest)\n\nlemma CSP4_Miracle [closure]: \"Miracle is CSP4\"\n  by (rule CSP4_tri_intro, simp_all add: closure rdes unrest)\n\nlemma NCSP_Miracle [closure]: \"Miracle is NCSP\"\n  by (simp add: NCSP_intro closure) \n    \nlemma NCSP_seqr_closure [closure]:\n  assumes \"P is NCSP\" \"Q is NCSP\"\n  shows \"P ;; Q is NCSP\"\n  by (metis (no_types, lifting) CSP3_def CSP4_def Healthy_def' NCSP_implies_CSP NCSP_implies_CSP3\n      NCSP_implies_CSP4 NCSP_intro SRD_seqr_closure assms(1) assms(2) seqr_assoc)\n\nlemma CSP4_Skip [closure]: \"Skip is CSP4\"\n  apply (rule CSP4_intro, simp_all add: Skip_is_CSP)\n  apply (simp_all add: Skip_def rea_pre_RHS_design rea_cmt_RHS_design usubst unrest R2c_true)\ndone\n\nlemma NCSP_Skip [closure]: \"Skip is NCSP\"\n  by (metis CSP3_Skip CSP4_Skip Healthy_def NCSP_def Skip_is_CSP comp_apply)\n\nlemma CSP4_Stop [closure]: \"Stop is CSP4\"\n  apply (rule CSP4_intro, simp_all add: Stop_is_CSP)\n  apply (simp_all add: Stop_def rea_pre_RHS_design rea_cmt_RHS_design usubst unrest R2c_true)\ndone\n\nlemma NCSP_Stop [closure]: \"Stop is NCSP\"\n  by (metis CSP3_Stop CSP4_Stop Healthy_def NCSP_def Stop_is_CSP comp_apply)\n\nlemma CSP4_Idempotent: \"Idempotent CSP4\"\n  by (metis (no_types, lifting) CSP3_Skip CSP3_def CSP4_def Healthy_if Idempotent_def seqr_assoc)\n\nlemma CSP4_Continuous: \"Continuous CSP4\"\n  by (simp add: Continuous_def CSP4_def seq_Sup_distr)\n\nlemma rdes_frame_ext_NCSP_closed [closure]:\n  assumes \"vwb_lens a\" \"P is NCSP\"\n  shows \"a:[P]\\<^sub>R\\<^sup>+ is NCSP\"\n  by (metis (no_types, lifting) CSP3_def CSP4_def Healthy_intro NCSP_Skip NCSP_implies_NSRD NCSP_intro NSRD_is_SRD Skip_frame Skip_left_unit Skip_right_unit assms(1) assms(2) rdes_frame_ext_NSRD_closed seq_srea_frame)\n\nlemma preR_Stop [rdes]: \"pre\\<^sub>R(Stop) = true\\<^sub>r\"\n  by (simp add: Stop_def Stop_is_CSP rea_pre_RHS_design unrest usubst R2c_true)\n\nlemma periR_Stop [rdes]: \"peri\\<^sub>R(Stop) = \\<E>(true,\\<guillemotleft>[]\\<guillemotright>,{}\\<^sub>u)\"\n  by (rel_auto)\n\nlemma postR_Stop [rdes]: \"post\\<^sub>R(Stop) = false\"\n  by (rel_auto)\n\nlemma cmtR_Stop [rdes]: \"cmt\\<^sub>R(Stop) = ($tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute>)\"\n  by (rel_auto)\n\nlemma NCSP_Idempotent [closure]: \"Idempotent NCSP\"\n  by (clarsimp simp add: NCSP_def Idempotent_def)\n     (metis (no_types, opaque_lifting) CSP3_Idempotent CSP3_def CSP4_Idempotent CSP4_def Healthy_def Idempotent_def SRD_idem SRD_seqr_closure Skip_is_CSP seqr_assoc)\n\nlemma NCSP_Continuous [closure]: \"Continuous NCSP\"\n  by (simp add: CSP3_Continuous CSP4_Continuous Continuous_comp NCSP_def SRD_Continuous)\n\nlemma preR_CRR [closure]: \"P is NCSP \\<Longrightarrow> pre\\<^sub>R(P) is CRR\"\n  by (rule CRR_intro, simp_all add: closure unrest)\n  \nlemma periR_CRR [closure]: \"P is NCSP \\<Longrightarrow> peri\\<^sub>R(P) is CRR\"\n  by (rule CRR_intro, simp_all add: closure unrest)\n\nlemma postR_CRR [closure]: \"P is NCSP \\<Longrightarrow> post\\<^sub>R(P) is CRR\"\n  by (rule CRR_intro, simp_all add: closure unrest)\n    \nlemma NCSP_rdes_intro [closure]:\n  assumes \"P is CRC\" \"Q is CRR\" \"R is CRR\"\n          \"$st\\<acute> \\<sharp> Q\" \"$ref\\<acute> \\<sharp> R\"\n  shows \"\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R) is NCSP\"\n  apply (rule NCSP_intro)\n    apply (simp_all add: closure assms)\n   apply (rule CSP3_SRD_intro)\n      apply (simp_all add: rdes closure assms unrest)\n  apply (rule CSP4_tri_intro)\n     apply (simp_all add: rdes closure assms unrest)\n  apply (metis (no_types, lifting) CRC_implies_RC R1_seqr_closure assms(1) rea_not_R1 rea_not_false rea_not_not wp_rea_RC_false wp_rea_def)\n  done\n    \nlemma NCSP_preR_CRC [closure]:\n  assumes \"P is NCSP\"\n  shows \"pre\\<^sub>R(P) is CRC\"\n  by (rule CRC_intro, simp_all add: closure assms unrest)\n\nlemma NCSP_postR_CRF [closure]: \"P is NCSP \\<Longrightarrow> post\\<^sub>R P is CRF\"\n  by (rule CRF_intro, simp_all add: unrest closure)\n\nlemma CSP3_Sup_closure [closure]:\n  \"A \\<subseteq> \\<lbrakk>CSP3\\<rbrakk>\\<^sub>H \\<Longrightarrow> (\\<Sqinter> A) is CSP3\"\n  apply (auto simp add: CSP3_def Healthy_def seq_Sup_distl)\n  apply (rule cong[of Sup])\n   apply (simp)\n  using image_iff apply force\n  done\n\nlemma CSP4_Sup_closure [closure]:\n  \"A \\<subseteq> \\<lbrakk>CSP4\\<rbrakk>\\<^sub>H \\<Longrightarrow> (\\<Sqinter> A) is CSP4\"\n  apply (auto simp add: CSP4_def Healthy_def seq_Sup_distr)\n  apply (rule cong[of Sup])\n   apply (simp)\n  using image_iff apply force\n  done\n  \nlemma NCSP_Sup_closure [closure]: \"\\<lbrakk> A \\<subseteq> \\<lbrakk>NCSP\\<rbrakk>\\<^sub>H; A \\<noteq> {} \\<rbrakk> \\<Longrightarrow> (\\<Sqinter> A) is NCSP\"\n  apply (rule NCSP_intro, simp_all add: closure)\n   apply (metis (no_types, lifting) Ball_Collect CSP3_Sup_closure NCSP_implies_CSP3)\n  apply (metis (no_types, lifting) Ball_Collect CSP4_Sup_closure NCSP_implies_CSP4)\n  done\n\nlemma NCSP_SUP_closure [closure]: \"\\<lbrakk> \\<And> i. P(i) is NCSP; A \\<noteq> {} \\<rbrakk> \\<Longrightarrow> (\\<Sqinter> i\\<in>A. P(i)) is NCSP\"\n  by (metis (mono_tags, lifting) Ball_Collect NCSP_Sup_closure image_iff image_is_empty)\n\nlemma PCSP_implies_NCSP [closure]:\n  assumes \"P is PCSP\"\n  shows \"P is NCSP\"\nproof -\n  have \"P = Productive(NCSP(NCSP P))\"\n    by (metis (no_types, opaque_lifting) Healthy_def' Idempotent_def NCSP_Idempotent assms comp_apply)\n    \n  also have \"... = \\<^bold>R\\<^sub>s ((\\<forall> $ref \\<bullet> (\\<not>\\<^sub>r pre\\<^sub>R(NCSP P)) wp\\<^sub>r false) \\<turnstile> \n                       (\\<exists> $ref \\<bullet> \\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R(NCSP P)) \\<diamondop> \n                       ((\\<exists> $ref \\<bullet> \\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R (NCSP P)) \\<and> $tr <\\<^sub>u $tr\\<acute>))\"\n    by (simp add: NCSP_form Productive_RHS_design_form unrest closure)\n  also have \"... is NCSP\"\n    apply (rule NCSP_rdes_intro)\n        apply (rule CRC_intro)\n         apply (simp_all add: unrest ex_unrest all_unrest closure)\n    done\n  finally show ?thesis .\nqed\n\nlemma PCSP_elim [RD_elim]: \n  assumes \"X is PCSP\" \"P (\\<^bold>R\\<^sub>s ((pre\\<^sub>R X) \\<turnstile> peri\\<^sub>R X \\<diamondop> (R4(post\\<^sub>R X))))\"\n  shows \"P X\"\n  by (metis R4_def Healthy_if NCSP_implies_CSP PCSP_implies_NCSP Productive_form assms comp_apply)\n\nlemma R5_alt_def: \"R5(P) = (P \\<and> $tr\\<acute> =\\<^sub>u $tr)\"\n  by rel_auto\n\nlemma ICSP_implies_NCSP [closure]:\n  assumes \"P is ICSP\"\n  shows \"P is NCSP\"\nproof -\n  have \"P = ISRD1(NCSP(NCSP P))\"\n    by (metis (no_types, opaque_lifting) Healthy_def' Idempotent_def NCSP_Idempotent assms comp_apply)\n  also have \"... = ISRD1 (\\<^bold>R\\<^sub>s ((\\<forall> $ref \\<bullet> (\\<not>\\<^sub>r pre\\<^sub>R (NCSP P)) wp\\<^sub>r false) \\<turnstile>\n                              (\\<exists> $ref \\<bullet> \\<exists> $st\\<acute> \\<bullet> peri\\<^sub>R (NCSP P)) \\<diamondop> \n                              (\\<exists> $ref \\<bullet> \\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R (NCSP P))))\"\n    by (simp add: NCSP_form)\n  also have \"... = \\<^bold>R\\<^sub>s ((\\<forall> $ref \\<bullet> (\\<not>\\<^sub>r pre\\<^sub>R(NCSP P)) wp\\<^sub>r false) \\<turnstile> \n                       false \\<diamondop> \n                       ((\\<exists> $ref \\<bullet> \\<exists> $ref\\<acute> \\<bullet> post\\<^sub>R (NCSP P)) \\<and> $tr\\<acute> =\\<^sub>u $tr))\"\n    by (simp_all add: ISRD1_RHS_design_form R5_alt_def closure rdes unrest)\n  also have \"... is NCSP\"\n    apply (rule NCSP_rdes_intro)\n        apply (rule CRC_intro)\n         apply (simp_all add: unrest ex_unrest all_unrest closure)\n    done\n  finally show ?thesis .\nqed\n\nlemma ICSP_implies_ISRD [closure]:\n  assumes \"P is ICSP\"\n  shows \"P is ISRD\"\n  by (metis (no_types, opaque_lifting) Healthy_def ICSP_implies_NCSP ISRD_def NCSP_implies_NSRD assms comp_apply)\n\nlemma ICSP_elim [RD_elim]: \n  assumes \"X is ICSP\" \"P (\\<^bold>R\\<^sub>s ((pre\\<^sub>R X) \\<turnstile> false \\<diamondop> R5(post\\<^sub>R X)))\"\n  shows \"P X\"\n  by (metis Healthy_if NCSP_implies_CSP ICSP_implies_NCSP ISRD1_form assms comp_apply)\n\nlemma ICSP_Stop_right_zero_lemma:\n  \"(P \\<and> ($tr\\<acute> =\\<^sub>u $tr)) ;; true\\<^sub>r = true\\<^sub>r \\<Longrightarrow> (P \\<and> ($tr\\<acute> =\\<^sub>u $tr)) ;; ($tr\\<acute> =\\<^sub>u $tr) = ($tr\\<acute> =\\<^sub>u $tr)\"\n  by (rel_blast)\n\nlemma ICSP_Stop_right_zero:\n  assumes \"P is ICSP\" \"pre\\<^sub>R(P) = true\\<^sub>r\" \"post\\<^sub>R(P) ;; true\\<^sub>r = true\\<^sub>r\"\n  shows \"P ;; Stop = Stop\"\nproof -\n  from assms(3) have 1:\"(post\\<^sub>R P \\<and> $tr\\<acute> =\\<^sub>u $tr) ;; true\\<^sub>r = true\\<^sub>r\"\n    by (rel_auto, metis (full_types, opaque_lifting) dual_order.antisym order_refl)\n  show ?thesis\n    by (rdes_simp cls: assms(1), simp add: R5_alt_def csp_enable_nothing assms(2) ICSP_Stop_right_zero_lemma[OF 1])\nqed\n\nlemma ICSP_intro: \"\\<lbrakk> P is NCSP; P is ISRD1 \\<rbrakk> \\<Longrightarrow> P is ICSP\"\n  using Healthy_comp by blast\n\nlemma seq_ICSP_closed [closure]:\n  assumes \"P is ICSP\" \"Q is ICSP\"\n  shows \"P ;; Q is ICSP\"\n  by (meson ICSP_implies_ISRD ICSP_implies_NCSP ICSP_intro ISRD_implies_ISRD1 NCSP_seqr_closure assms seq_ISRD_closed)\n\nlemma Miracle_ICSP [closure]: \"Miracle is ICSP\"\n  by (rule ICSP_intro, simp add: closure, simp add: ISRD1_rdes_intro rdes_def closure)\n\nsubsection \\<open> CSP theories \\<close>\n\nlemma NCSP_false: \"NCSP false = Miracle\"\n  by (simp add: NCSP_def srdes_theory.healthy_top[THEN sym], simp add: closure Healthy_if)\n\nlemma NCSP_true: \"NCSP true = Chaos\"\n  by (simp add: NCSP_def srdes_theory.healthy_bottom[THEN sym], simp add: closure Healthy_if)\n \ninterpretation csp_theory: utp_theory_kleene NCSP Skip\n  rewrites \"P \\<in> carrier csp_theory.thy_order \\<longleftrightarrow> P is NCSP\"\n  and \"carrier csp_theory.thy_order \\<rightarrow> carrier csp_theory.thy_order \\<equiv> \\<lbrakk>NCSP\\<rbrakk>\\<^sub>H \\<rightarrow> \\<lbrakk>NCSP\\<rbrakk>\\<^sub>H\"\n  and \"le csp_theory.thy_order = (\\<sqsubseteq>)\"\n  and \"eq csp_theory.thy_order = (=)\"\n  and csp_top: \"csp_theory.utp_top = Miracle\" \n  and csp_bottom: \"csp_theory.utp_bottom = Chaos\"\nproof -\n  have \"utp_theory_continuous NCSP\"\n    by (unfold_locales, simp_all add: Healthy_Idempotent Healthy_if NCSP_Idempotent NCSP_Continuous)\n  then interpret utp_theory_continuous NCSP\n    by simp\n  show t: \"utp_top = Miracle\" and b:\"utp_bottom = Chaos\"\n    by (simp_all add: healthy_top healthy_bottom NCSP_false NCSP_true)\n  show \"utp_theory_kleene NCSP Skip\"\n    by (unfold_locales, simp_all add: closure Skip_left_unit Skip_right_unit Miracle_left_zero t)\nqed (simp_all)\n\nabbreviation TestC (\"test\\<^sub>C\") where\n\"test\\<^sub>C P \\<equiv> csp_theory.utp_test P\"\n\ndefinition StarC :: \"('\\<sigma>, '\\<phi>) action \\<Rightarrow> ('\\<sigma>, '\\<phi>) action\" (\"_\\<^sup>\\<star>\\<^sup>C\" [999] 999) where\n\"StarC P \\<equiv> csp_theory.utp_star P\"\n\nlemma StarC_unfold: \"P is NCSP \\<Longrightarrow> P\\<^sup>\\<star>\\<^sup>C = Skip \\<sqinter> (P ;; P\\<^sup>\\<star>\\<^sup>C)\"\n  by (simp add: StarC_def csp_theory.Star_unfoldl_eq)\n\nlemma sfrd_star_as_rdes_star:\n  \"P is NCSP \\<Longrightarrow> P\\<^sup>\\<star>\\<^sup>R ;; Skip = P\\<^sup>\\<star>\\<^sup>C\"\n  by (simp add: csp_theory.Star_alt_def nsrdes_theory.Star_alt_def StarC_def StarR_def closure unrest Skip_srdes_left_unit csp_theory.Unit_Right)\n\nlemma sfrd_star_as_rdes_star':\n  \"P is NCSP \\<Longrightarrow> Skip ;; P\\<^sup>\\<star>\\<^sup>R = P\\<^sup>\\<star>\\<^sup>C\"\n  by (simp add: csp_theory.Star_alt_def nsrdes_theory.Star_alt_def StarC_def StarR_def closure unrest Skip_srdes_right_unit csp_theory.Unit_Left upred_semiring.distrib_left)\n\ntheorem csp_star_rdes_def [rdes_def]:\n  assumes \"P is CRC\" \"Q is CRR\" \"R is CRF\" \"$st\\<acute> \\<sharp> Q\"\n  shows \"(\\<^bold>R\\<^sub>s(P \\<turnstile> Q \\<diamondop> R))\\<^sup>\\<star>\\<^sup>C = \\<^bold>R\\<^sub>s(R\\<^sup>\\<star>\\<^sup>c wp\\<^sub>r P \\<turnstile> (R\\<^sup>\\<star>\\<^sup>c ;; Q) \\<diamondop> R\\<^sup>\\<star>\\<^sup>c)\"\n  apply (simp add: wp_rea_def sfrd_star_as_rdes_star[THEN sym] crf_star_as_rea_star assms seqr_assoc rpred closure unrest StarR_rdes_def)\n  apply (simp add: rdes_def assms closure unrest wp_rea_def[THEN sym])\n  apply (simp add: wp rpred assms closure)\n  apply (simp add: csp_do_nothing) \n  done\n\nsubsection \\<open> Algebraic laws \\<close>\n\nlemma Stop_left_zero:\n  assumes \"P is CSP\"\n  shows \"Stop ;; P = Stop\"\n  by (simp add: NSRD_seq_post_false assms NCSP_implies_NSRD NCSP_Stop postR_Stop)\n\nend", "meta": {"author": "isabelle-utp", "repo": "utp-main", "sha": "27bdf3aee6d4fc00c8fe4d53283d0101857e0d41", "save_path": "github-repos/isabelle/isabelle-utp-utp-main", "path": "github-repos/isabelle/isabelle-utp-utp-main/utp-main-27bdf3aee6d4fc00c8fe4d53283d0101857e0d41/theories/sf_rdes/utp_sfrd_healths.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.30714101737661853}}
{"text": "header {* Compasitionality of the during-execution security notions *} \n\ntheory Compositionality imports During_Execution begin\n\n\n(*******************************************)\ncontext PL_Indis \nbegin \n\n(* The end-product compositionality results are listed as theorems \n(as opposed to lemmas). *)\n\nsubsection {* Discreetness versus language constructs: *}\n\ntheorem discr_Atm[simp]:\n\"discr (Atm atm) = presAtm atm\"  \nproof-    \n  {fix c\n   have \n   \"(\\<exists> atm. c = Atm atm \\<and> presAtm atm) \n    \\<Longrightarrow> discr c\"\n   apply(erule discr_coind) \n   apply (metis Atm_transC_invert)\n   by (metis PL.Atm_transT_invert presAtm_def)\n  }\n  moreover have \"discr (Atm atm) \\<Longrightarrow> presAtm atm\"\n  by (metis Atm assms presAtm_def discr_transT)\n  ultimately show ?thesis using assms by blast\nqed\n\ntheorem discr_If[simp]:\nassumes \"discr c1\" and \"discr c2\"\nshows \"discr (If tst c1 c2)\"\nproof-    \n  {fix c\n   have \n   \"(\\<exists> tst c1 c2. c = If tst c1 c2 \\<and> discr c1 \\<and> discr c2) \\<Longrightarrow> discr c\"\n   apply(erule discr_coind) \n   apply (metis PL.If_transC_invert indis_refl)\n   by (metis If_transT_invert)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr_Seq[simp]:\nassumes *: \"discr c1\" and **: \"discr c2\"\nshows \"discr (c1 ;; c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = c1 ;; c2 \\<and> discr c1 \\<and> discr c2) \n    \\<Longrightarrow> discr c\"\n   apply(erule discr_coind) \n   proof(tactic{* clarify_all_tac @{context} *})\n     fix c s c' s' c1 c2\n     assume c1: \"discr c1\" and c2: \"discr c2\" \n     assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n     thus \"s \\<approx> s' \\<and> ((\\<exists>c1 c2. c' = c1 ;; c2 \\<and> discr c1 \\<and> discr c2) \\<or> discr c')\"\n     apply - apply(erule Seq_transC_invert)\n     apply (metis c1 c2 discr_transC discr_transC_indis)\n     by (metis c1 c2 discr.cases)\n   qed (insert Seq_transT_invert, blast)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr_While[simp]:\nassumes \"discr c\"\nshows \"discr (While tst c)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> tst d. c = While tst d \\<and> discr d) \\<or> \n    (\\<exists> tst d1 d. c = d1 ;; (While tst d) \\<and> discr d1 \\<and> discr d)\n    \\<Longrightarrow> discr c\"\n   apply(erule discr_coind)\n   apply(tactic {* mauto_no_simp_tac *})\n   apply (metis While_transC_invert indis_refl)\n   apply (metis Seq_transC_invert discr.cases)\n   apply (metis While_transC_invert)\n   apply (metis Seq_transC_invert discr.cases)\n   apply (metis PL.While_transT_invert indis_refl)\n   by (metis Seq_transT_invert)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr_Par[simp]:\nassumes *: \"discr c1\" and **: \"discr c2\"\nshows \"discr (Par c1 c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = Par c1 c2 \\<and> discr c1 \\<and> discr c2) \n    \\<Longrightarrow> discr c\"\n   apply(erule discr_coind) \n   proof(tactic{* clarify_all_tac @{context} *})\n     fix c s c' s' c1 c2\n     assume c1: \"discr c1\" and c2: \"discr c2\" \n     assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n     thus \"s \\<approx> s' \\<and> ((\\<exists>c1 c2. c' = Par c1 c2 \\<and> discr c1 \\<and> discr c2) \\<or> discr c')\"\n     apply - apply(erule Par_transC_invert)\n     by(metis c1 c2 discr.cases)+\n   qed\n  }\n  thus ?thesis using assms by blast\nqed\n\n\nsubsection {* Discreetness versus language constructs: *}\n\ntheorem discr0_Atm[simp]:\n\"discr0 (Atm atm) = presAtm atm\"  \nproof-    \n  {fix c\n   have \n   \"(\\<exists> atm. c = Atm atm \\<and> presAtm atm) \n    \\<Longrightarrow> discr0 c\"\n   apply(erule discr0_coind) \n   apply (metis Atm_transC_invert)\n   by (metis discr_Atm discr_transT)\n  }\n  moreover have \"discr0 (Atm atm) \\<Longrightarrow> presAtm atm\"\n  by (metis Atm discr0_MtransT presAtm_def mustT_Atm transT_MtransT)\n  ultimately show ?thesis using assms by blast\nqed\n\ntheorem discr0_If[simp]:\nassumes \"discr0 c1\" and \"discr0 c2\"\nshows \"discr0 (If tst c1 c2)\"\nproof-    \n  {fix c\n   have \n   \"(\\<exists> tst c1 c2. c = If tst c1 c2 \\<and> discr0 c1 \\<and> discr0 c2) \\<Longrightarrow> discr0 c\"\n   apply(erule discr0_coind) \n   apply (metis If_transC_invert indis_refl)\n   by (metis If_transT_invert)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr0_Seq[simp]:\nassumes *: \"discr0 c1\" and **: \"discr0 c2\"\nshows \"discr0 (c1 ;; c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = c1 ;; c2 \\<and> discr0 c1 \\<and> discr0 c2) \n    \\<Longrightarrow> discr0 c\"\n   apply(erule discr0_coind) \n   proof(tactic{* clarify_all_tac @{context} *})\n     fix c s c' s' c1 c2\n     assume mt: \"mustT (c1 ;; c2) s\" \n     and c1: \"discr0 c1\" and c2: \"discr0 c2\" \n     assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n     thus \"s \\<approx> s' \\<and> ((\\<exists>c1 c2. c' = c1 ;; c2 \\<and> discr0 c1 \\<and> discr0 c2) \\<or> discr0 c')\"\n     apply - apply(erule Seq_transC_invert)\n     apply (metis mustT_Seq_L c1 c2 discr0_MtransC discr0_MtransC_indis mt \n                  transC_MtransC)\n     by (metis c1 c2 discr0_transT mt mustT_Seq_L)\n   qed (insert Seq_transT_invert, blast)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr0_While[simp]:\nassumes \"discr0 c\"\nshows \"discr0 (While tst c)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> tst d. c = While tst d \\<and> discr0 d) \\<or> \n    (\\<exists> tst d1 d. c = d1 ;; (While tst d) \\<and> discr0 d1 \\<and> discr0 d)\n    \\<Longrightarrow> discr0 c\"\n   proof (induct rule: discr0_coind)\n     case (Term c s s')\n     thus \"s \\<approx> s'\" \n     apply (elim exE disjE conjE)\n     apply (metis While_transT_invert indis_refl)\n     by (metis Seq_transT_invert)\n   next\n     case (Cont c s c' s')\n     thus ?case\n     apply(intro conjI)\n     apply (elim exE disjE conjE)\n     apply (metis While_transC_invert indis_refl)\n     apply (metis Seq_transC_invert discr0_MtransC_indis discr0_transT \n                  mustT_Seq_L transC_MtransC)\n     (*  *)\n     apply (elim exE disjE conjE)\n     apply (metis While_transC_invert)\n     by (metis Cont(3) Seq_transC_invert discr0_transC mustT_Seq_L)\n   qed   \n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem discr0_Par[simp]:\nassumes *: \"discr0 c1\" and **: \"discr0 c2\"\nshows \"discr0 (Par c1 c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = Par c1 c2 \\<and> discr0 c1 \\<and> discr0 c2) \n    \\<Longrightarrow> discr0 c\"\n   apply(induct rule: discr0_coind) \n   proof(tactic{* clarify_all_tac @{context} *})\n     fix c s c' s' c1 c2\n     assume mt: \"mustT (Par c1 c2) s\" and c1: \"discr0 c1\" and c2: \"discr0 c2\" \n     assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n     thus \"s \\<approx> s' \\<and> ((\\<exists>c1 c2. c' = Par c1 c2 \\<and> discr0 c1 \\<and> discr0 c2) \\<or> discr0 c')\"\n     apply(elim Par_transC_invert)\n     apply (metis c1 c2 discr0.simps mt mustT_Par_L)\n     apply (metis c1 c2 discr0_transT mt mustT_Par_L)\n     apply (metis c1 c2 discr0.simps indis_sym mt mustT_Par_R)\n     by (metis PL.mustT_Par_R c1 c2 discr0_transT mt)\n   qed\n  }\n  thus ?thesis using assms by blast\nqed\n\n\nsubsection {* Self-Isomorphism versus language constructs: *}\n\ntheorem siso_Atm[simp]:\n\"siso (Atm atm) = compatAtm atm\"  \nproof-    \n  {fix c\n   have \n   \"(\\<exists> atm. c = Atm atm \\<and> compatAtm atm) \n    \\<Longrightarrow> siso c\"\n   apply(erule siso_coind) \n   apply (metis Atm_transC_invert)\n   apply (metis PL.Atm_transC_invert)\n   by (metis Atm_transT_invert PL.Atm compatAtm_def)\n  }\n  moreover have \"siso (Atm atm) \\<Longrightarrow> compatAtm atm\" unfolding compatAtm_def\n  by (metis Atm Atm_transT_invert siso_transT)\n  ultimately show ?thesis by blast\nqed \n\ntheorem siso_If[simp]:\nassumes  \"compatTst tst\" and \"siso c1\" and \"siso c2\"\nshows \"siso (If tst c1 c2)\"\nproof-    \n  {fix c\n   have \n   \"(\\<exists> tst c1 c2. c = If tst c1 c2 \\<and> compatTst tst \\<and> siso c1 \\<and> siso c2) \\<Longrightarrow> siso c\"\n   apply(erule siso_coind) \n   apply (metis PL.If_transC_invert indis_refl)\n   apply (metis IfTrue PL.IfFalse PL.If_transC_invert compatTst_def)\n   by (metis If_transT_invert)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso_Seq[simp]:\nassumes *: \"siso c1\" and **: \"siso c2\"\nshows \"siso (c1 ;; c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = c1 ;; c2 \\<and> siso c1 \\<and> siso c2) \n    \\<Longrightarrow> siso c\"\n   apply(erule siso_coind) \n   proof(tactic{* clarify_all_tac @{context} *})\n     fix c s t c' s' c1 c2\n     assume \"s \\<approx> t\" and \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\" and \"siso c1\" and \"siso c2\"\n     thus \"\\<exists>t'. s' \\<approx> t' \\<and> (c1 ;; c2, t) \\<rightarrow>c (c', t')\"\n     apply - apply(erule Seq_transC_invert)\n     apply (metis SeqC siso_transC_indis)\n     by (metis PL.SeqT siso_transT)\n   qed (insert Seq_transT_invert siso_transC, blast+)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso_While[simp]:\nassumes \"compatTst tst\" and \"siso c\"\nshows \"siso (While tst c)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> tst d. compatTst tst \\<and> c = While tst d \\<and> siso d) \\<or> \n    (\\<exists> tst d1 d. compatTst tst \\<and> c = d1 ;; (While tst d) \\<and> siso d1 \\<and> siso d)\n    \\<Longrightarrow> siso c\"\n   apply(erule siso_coind)\n   apply auto\n   apply (metis PL.Seq_transC_invert siso_transC)\n   apply (metis WhileTrue While_transC_invert compatTst_def)\n   apply (metis PL.SeqC siso_transC_indis)\n   apply (metis PL.SeqT siso_transT)\n   by (metis WhileFalse compatTst_def) \n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso_Par[simp]:\nassumes *: \"siso c1\" and **: \"siso c2\"\nshows \"siso (Par c1 c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = Par c1 c2 \\<and> siso c1 \\<and> siso c2) \n    \\<Longrightarrow> siso c\"\n   apply(erule siso_coind)\n   proof(tactic{* clarify_all_tac @{context} *})\n     fix c s t c' s' c1 c2\n     assume \"s \\<approx> t\" and \"(Par c1 c2, s) \\<rightarrow>c (c', s')\" and c1: \"siso c1\" and c2: \"siso c2\"\n     thus \"\\<exists>t'. s' \\<approx> t' \\<and> (Par c1 c2, t) \\<rightarrow>c (c', t')\"\n     apply - apply(erule Par_transC_invert)\n     by(metis ParCL ParTL ParCR ParTR c1 c2 siso_transT siso_transC_indis)+   \n   qed (insert Par_transC_invert siso_transC Par_transT_invert, blast+)\n  }\n  thus ?thesis using assms by blast\nqed\n\n\nsubsection {* Self-Isomorphism versus language constructs: *}\n\ntheorem siso0_Atm[simp]:\n\"siso0 (Atm atm) = compatAtm atm\"  \nproof-    \n  {fix c\n   have \n   \"(\\<exists> atm. c = Atm atm \\<and> compatAtm atm) \n    \\<Longrightarrow> siso0 c\"\n   apply(erule siso0_coind) \n   apply (metis Atm_transC_invert)\n   apply (metis PL.Atm_transC_invert)\n   by (metis Atm_transT_invert PL.Atm compatAtm_def)\n  }\n  moreover have \"siso0 (Atm atm) \\<Longrightarrow> compatAtm atm\" unfolding compatAtm_def\n  by (metis Atm Atm_transT_invert siso0_transT mustT_Atm)\n  ultimately show ?thesis by blast\nqed \n\ntheorem siso0_If[simp]:\nassumes  \"compatTst tst\" and \"siso0 c1\" and \"siso0 c2\"\nshows \"siso0 (If tst c1 c2)\"\nproof-    \n  {fix c\n   have \n   \"(\\<exists> tst c1 c2. c = If tst c1 c2 \\<and> compatTst tst \\<and> siso0 c1 \\<and> siso0 c2) \\<Longrightarrow> siso0 c\"\n   apply(erule siso0_coind) \n   apply (metis PL.If_transC_invert indis_refl)\n   apply (metis IfTrue PL.IfFalse PL.If_transC_invert compatTst_def)\n   by (metis If_transT_invert)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso0_Seq[simp]:\nassumes *: \"siso0 c1\" and **: \"siso0 c2\"\nshows \"siso0 (c1 ;; c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = c1 ;; c2 \\<and> siso0 c1 \\<and> siso0 c2) \n    \\<Longrightarrow> siso0 c\"\n   proof (induct rule: siso0_coind)\n     case (Indef c s c' s')\n     thus ?case\n     by (metis Seq_transC_invert mustT_Seq_L siso0_transC) \n   next\n     case (Cont c s t c' s')\n     then obtain c1 c2\n     where c: \"c = c1 ;; c2\" and mt: \"mustT (c1 ;; c2) s\" \"mustT (c1 ;; c2) t\" \n     and st: \"s \\<approx> t\" and siso1: \"siso0 c1\" and siso2: \"siso0 c2\" by auto\n     hence mt1: \"mustT c1 s\" \"mustT c1 t\"\n     by (metis mustT_Seq_L)+\n     have \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\" using c Cont by auto\n     thus ?case\n     proof (elim Seq_transC_invert)\n       fix c1' assume c1: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n       obtain t' where \"(c1, t) \\<rightarrow>c (c1', t')\" and \"s' \\<approx> t'\"\n       using siso1 c1 st mt1 by (metis siso0_transC_indis) \n       thus ?thesis by (metis SeqC c c') \n     next\n       assume \"(c1, s) \\<rightarrow>t s'\" and \"c' = c2\"\n       thus ?thesis by (metis c SeqT mt1 siso0_transT siso1 st)\n     qed\n   qed auto\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso0_While[simp]:\nassumes \"compatTst tst\" and \"siso0 c\"\nshows \"siso0 (While tst c)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> tst d. compatTst tst \\<and> c = While tst d \\<and> siso0 d) \\<or> \n    (\\<exists> tst d1 d. compatTst tst \\<and> c = d1 ;; (While tst d) \\<and> siso0 d1 \\<and> siso0 d)\n    \\<Longrightarrow> siso0 c\"\n   apply(erule siso0_coind)\n   apply auto\n   apply (metis mustT_Seq_L siso0_transC)\n   apply (metis WhileTrue While_transC_invert compatTst_def)\n   apply (metis SeqC mustT_Seq_L siso0_transC_indis)\n   apply (metis SeqT mustT_Seq_L siso0_transT)\n   by (metis WhileFalse compatTst_def)\n  }\n  thus ?thesis using assms by blast\nqed\n\ntheorem siso0_Par[simp]:\nassumes *: \"siso0 c1\" and **: \"siso0 c2\"\nshows \"siso0 (Par c1 c2)\"\nproof-\n  {fix c\n   have \n   \"(\\<exists> c1 c2. c = Par c1 c2 \\<and> siso0 c1 \\<and> siso0 c2) \n    \\<Longrightarrow> siso0 c\"\n   proof (induct rule: siso0_coind)\n     case (Indef c s c' s')\n     then obtain c1 c2 where c: \"c = Par c1 c2\" \n     and c1: \"siso0 c1\" and c2: \"siso0 c2\" by auto\n     hence \"(Par c1 c2, s) \\<rightarrow>c (c', s')\" using c Indef by auto\n     thus ?case\n     apply(elim Par_transC_invert)\n     by (metis Indef c c1 c2 mustT_Par_L mustT_Par_R siso0_transC)+ \n   next\n     case (Cont c s t c' s')\n     then obtain c1 c2 where c: \"c = Par c1 c2\" \n     and c1: \"siso0 c1\" and c2: \"siso0 c2\" by auto\n     hence mt: \"mustT c1 s\" \"mustT c1 t\" \"mustT c2 s\" \"mustT c2 t\"\n     by (metis Cont mustT_Par_L mustT_Par_R)+\n     have \"(Par c1 c2, s) \\<rightarrow>c (c', s')\" using c Cont by auto\n     thus ?case\n     apply(elim Par_transC_invert)\n     apply (metis Cont ParCL c c1 mt siso0_transC_indis)\n     apply (metis Cont ParTL c c1 mt siso0_transT)\n     apply (metis Cont ParCR c c2 mt siso0_transC_indis)\n     by (metis Cont ParTR c c2 mt siso0_transT)\n   qed auto \n  }\n  thus ?thesis using assms by blast\nqed\n\n\nsubsection{* Strong bisimilarity versus language constructs *}\n\ntext {* Atomic commands: *}\n\ndefinition thetaAtm where \n\"thetaAtm atm \\<equiv> {(Atm atm, Atm atm)}\"\n\nlemma thetaAtm_sym:\n\"sym (thetaAtm atm)\"\nunfolding thetaAtm_def sym_def by blast\n\nlemma thetaAtm_Sretr:\nassumes \"compatAtm atm\"\nshows \"thetaAtm atm \\<subseteq> Sretr (thetaAtm atm)\"\nusing assms \nunfolding compatAtm_def Sretr_def matchC_C_def matchT_T_def thetaAtm_def\napply simp by (metis Atm_transT_invert Atm) \n\nlemma thetaAtm_Sbis:\nassumes \"compatAtm atm\"\nshows \"thetaAtm atm \\<subseteq> Sbis\"\napply(rule Sbis_raw_coind)\nusing assms thetaAtm_sym thetaAtm_Sretr by auto\n\ntheorem Atm_Sbis[simp]:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>s Atm atm\"\nusing assms thetaAtm_Sbis unfolding thetaAtm_def by auto\n\ntext{* Sequential composition:  *} \n\ndefinition thetaSeq where \n\"thetaSeq \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>s d1 \\<and> c2 \\<approx>s d2}\"\n\nlemma thetaSeq_sym:\n\"sym thetaSeq\"\nunfolding thetaSeq_def sym_def using Sbis_Sym by blast\n\nlemma thetaSeq_Sretr:\n\"thetaSeq \\<subseteq> Sretr (thetaSeq Un Sbis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>s d1\" and c2d2: \"c2 \\<approx>s d2\"\n   hence matchC_C1: \"matchC_C Sbis c1 d1\" and matchC_C2: \"matchC_C Sbis c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using Sbis_matchC_C Sbis_matchT_T by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> Sretr (thetaSeq Un Sbis)\"\n   unfolding Sretr_def proof (clarify, intro conjI)\n     show \"matchC_C (thetaSeq Un Sbis) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_C_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeq Un Sbis\"\n       apply - proof(erule Seq_transC_invert) \n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence \"\\<exists>d1' t'. (d1, t) \\<rightarrow>c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>s d1'\"\n         using st matchC_C1 unfolding matchC_C_def by blast\n         thus ?thesis unfolding c' thetaSeq_def\n         apply simp by (metis SeqC c2d2 ) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaSeq_def\n         apply simp by (metis PL.SeqT c2d2) \n       qed\n     qed \n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaSeq_def by auto\nqed\n\nlemma thetaSeq_Sbis:\n\"thetaSeq \\<subseteq> Sbis\"\napply(rule Sbis_coind)\nusing thetaSeq_sym thetaSeq_Sretr by auto\n\ntheorem Seq_Sbis[simp]:\nassumes \"c1 \\<approx>s d1\" and \"c2 \\<approx>s d2\"\nshows \"c1 ;; c2 \\<approx>s d1 ;; d2\"\nusing assms thetaSeq_Sbis unfolding thetaSeq_def by blast \n\ntext{* Conditional: *}\n\ndefinition thetaIf where \n\"thetaIf \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>s d1 \\<and> c2 \\<approx>s d2}\"\n\nlemma thetaIf_sym:\n\"sym thetaIf\"\nunfolding thetaIf_def sym_def using Sbis_Sym by blast\n\nlemma thetaIf_Sretr:\n\"thetaIf \\<subseteq> Sretr (thetaIf Un Sbis)\"\nproof-\n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>s d1\" and c2d2: \"c2 \\<approx>s d2\"\n   hence matchC_C1: \"matchC_C Sbis c1 d1\" and matchC_C2: \"matchC_C Sbis c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using Sbis_matchC_C Sbis_matchT_T by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> Sretr (thetaIf Un Sbis)\"\n   unfolding Sretr_def proof (clarify, intro conjI)\n     show \"matchC_C (thetaIf Un Sbis) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_C_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaIf Un Sbis\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIf_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st tst)\n       apply simp by (metis IfFalse c2d2 compatTst_def st tst)\n     qed\n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaIf_def by auto\nqed\n\nlemma thetaIf_Sbis:\n\"thetaIf \\<subseteq> Sbis\"\napply(rule Sbis_coind)\nusing thetaIf_sym thetaIf_Sretr by auto\n\ntheorem If_Sbis[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>s d1\" and \"c2 \\<approx>s d2\"\nshows \"If tst c1 c2 \\<approx>s If tst d1 d2\"\nusing assms thetaIf_Sbis unfolding thetaIf_def by blast\n\ntext{* While loop:  *}\n\ndefinition thetaWhile where \n\"thetaWhile \\<equiv> \n {(While tst c, While tst d) | tst c d. compatTst tst \\<and> c \\<approx>s d} Un \n {(c1 ;; (While tst c), d1 ;; (While tst d)) | tst c1 d1 c d. compatTst tst \\<and> c1 \\<approx>s d1 \\<and> c \\<approx>s d}\"\n\nlemma thetaWhile_sym:\n\"sym thetaWhile\"\nunfolding thetaWhile_def sym_def using Sbis_Sym by blast\n\nlemma thetaWhile_Sretr:\n\"thetaWhile \\<subseteq> Sretr (thetaWhile Un Sbis)\"\nproof-\n  {fix tst c d \n   assume tst: \"compatTst tst\" and c_d: \"c \\<approx>s d\"\n   hence matchC_C: \"matchC_C Sbis c d\" \n     and matchT_T: \"matchT_T c d\" \n   using Sbis_matchC_C Sbis_matchT_T by auto\n   have \"(While tst c, While tst d) \\<in> Sretr (thetaWhile Un Sbis)\"\n   unfolding Sretr_def proof (clarify, intro conjI)\n     show \"matchC_C (thetaWhile \\<union> Sbis) (While tst c) (While tst d)\"\n     unfolding matchC_C_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (While tst d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhile \\<union> Sbis\"\n       apply - apply(erule While_transC_invert)\n       unfolding thetaWhile_def apply simp\n       by (metis WhileTrue c_d compatTst_def st tst)\n     qed\n   next\n     show \"matchT_T (While tst c) (While tst d)\"\n     unfolding matchT_T_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t s' assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>t s'\"\n       thus \"\\<exists>t'. (While tst d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \"\n       apply - apply(erule While_transT_invert)\n       unfolding thetaWhile_def apply simp\n       by (metis PL.WhileFalse compatTst_def st tst)    \n     qed\n   qed\n  }\n  moreover \n  {fix tst c1 d1  c d\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>s d1\" and c_d: \"c \\<approx>s d\"\n   hence matchC_C1: \"matchC_C Sbis c1 d1\" and matchC_C: \"matchC_C Sbis c d\" \n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T: \"matchT_T c d\"\n   using Sbis_matchC_C Sbis_matchT_T by auto\n   have \"(c1 ;; (While tst c), d1 ;; (While tst d)) \\<in> Sretr (thetaWhile Un Sbis)\"\n   unfolding Sretr_def proof (clarify, intro conjI)\n     show \"matchC_C (thetaWhile \\<union> Sbis) (c1 ;; (While tst c)) (d1 ;; (While tst d))\"\n     unfolding matchC_C_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; (While tst c), s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (d1 ;; (While tst d), t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhile \\<union> Sbis\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; (While tst c)\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>s d'\" \n         using st matchC_C1 unfolding matchC_C_def by blast\n         thus ?thesis\n         unfolding c' thetaWhile_def\n         apply simp by (metis SeqC c_d tst) \n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = While tst c\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis\n         unfolding c' thetaWhile_def \n         apply simp by (metis PL.SeqT c_d tst) \n       qed\n     qed\n   qed (unfold matchT_T_def, auto)\n  }\n  ultimately show ?thesis unfolding thetaWhile_def by auto\nqed\n\nlemma thetaWhile_Sbis:\n\"thetaWhile \\<subseteq> Sbis\"\napply(rule Sbis_coind)\nusing thetaWhile_sym thetaWhile_Sretr by auto\n\n\n\ntext{* Parallel composition: *}\n\ndefinition thetaPar where \n\"thetaPar \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>s d1 \\<and> c2 \\<approx>s d2}\"\n\nlemma thetaPar_sym:\n\"sym thetaPar\"\nunfolding thetaPar_def sym_def using Sbis_Sym by blast\n\nlemma thetaPar_Sretr:\n\"thetaPar \\<subseteq> Sretr (thetaPar Un Sbis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>s d1\" and c2d2: \"c2 \\<approx>s d2\"\n   hence matchC_C1: \"matchC_C Sbis c1 d1\" and matchC_C2: \"matchC_C Sbis c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using Sbis_matchC_C Sbis_matchT_T by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> Sretr (thetaPar Un Sbis)\"\n   unfolding Sretr_def proof (clarify, intro conjI)\n     show \"matchC_C (thetaPar \\<union> Sbis) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_C_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaPar \\<union> Sbis\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>s d'\"\n         using st matchC_C1 unfolding matchC_C_def by blast\n         thus ?thesis unfolding c' thetaPar_def\n         apply simp by(metis ParCL c2d2)\n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaPar_def\n         apply simp by (metis PL.ParTL c2d2) \n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \"\\<exists>d' t'. (d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>s d'\"\n         using st matchC_C2 unfolding matchC_C_def by blast\n         thus ?thesis \n         unfolding c' thetaPar_def\n         apply simp by (metis ParCR c1d1)\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"\\<exists>t'. (d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T2 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaPar_def\n         apply simp by (metis PL.ParTR c1d1) \n       qed\n     qed \n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaPar_def by auto\nqed\n\nlemma thetaPar_Sbis:\n\"thetaPar \\<subseteq> Sbis\"\napply(rule Sbis_coind)\nusing thetaPar_sym thetaPar_Sretr by auto\n\ntheorem Par_Sbis[simp]:\nassumes \"c1 \\<approx>s d1\" and \"c2 \\<approx>s d2\"\nshows \"Par c1 c2 \\<approx>s Par d1 d2\"\nusing assms thetaPar_Sbis unfolding thetaPar_def by blast\n\n\nsubsubsection{* 01T-bisimilarity versus language constructs *}\n\ntext {* Atomic commands: *}\n\ntheorem Atm_ZObisT:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>01T Atm atm\"\nby (metis Atm_Sbis assms bis_imp)\n\ntext{* Sequential composition:  *} \n\ndefinition thetaSeqZOT where \n\"thetaSeqZOT \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>01T d1 \\<and> c2 \\<approx>01T d2}\"\n\nlemma thetaSeqZOT_sym:\n\"sym thetaSeqZOT\"\nunfolding thetaSeqZOT_def sym_def using ZObisT_Sym by blast\n\nlemma thetaSeqZOT_ZOretrT:\n\"thetaSeqZOT \\<subseteq> ZOretrT (thetaSeqZOT Un ZObisT)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>01T d1\" and c2d2: \"c2 \\<approx>01T d2\"\n   hence matchC_ZOC1: \"matchC_ZOC ZObisT c1 d1\" and matchC_ZOC2: \"matchC_ZOC ZObisT c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using ZObisT_matchC_ZOC ZObisT_matchT_T by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> ZOretrT (thetaSeqZOT Un ZObisT)\"\n   unfolding ZOretrT_def proof (clarify, intro conjI)\n     show \"matchC_ZOC (thetaSeqZOT Un ZObisT) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_ZOC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', d1 ;; d2) \\<in> thetaSeqZOT Un ZObisT) \\<or>\n        (\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqZOT Un ZObisT)\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence\n         \"(s' \\<approx> t \\<and> c1' \\<approx>01T d1) \\<or> \n          (\\<exists>d1' t'. (d1, t) \\<rightarrow>c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01T d1')\"\n         using st matchC_ZOC1 unfolding matchC_ZOC_def by auto\n         thus ?thesis unfolding c' thetaSeqZOT_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis c2d2)\n         apply simp by (metis SeqC c2d2 ) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaSeqZOT_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp by (metis PL.SeqT c2d2) \n       qed\n     qed \n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqZOT_def by auto\nqed\n\nlemma thetaSeqZOT_ZObisT:\n\"thetaSeqZOT \\<subseteq> ZObisT\"\napply(rule ZObisT_coind)\nusing thetaSeqZOT_sym thetaSeqZOT_ZOretrT by auto\n\ntheorem Seq_ZObisT[simp]:\nassumes \"c1 \\<approx>01T d1\" and \"c2 \\<approx>01T d2\"\nshows \"c1 ;; c2 \\<approx>01T d1 ;; d2\"\nusing assms thetaSeqZOT_ZObisT unfolding thetaSeqZOT_def by blast \n\ntext{* Conditional: *}\n\ndefinition thetaIfZOT where \n\"thetaIfZOT \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>01T d1 \\<and> c2 \\<approx>01T d2}\"\n\nlemma thetaIfZOT_sym:\n\"sym thetaIfZOT\"\nunfolding thetaIfZOT_def sym_def using ZObisT_Sym by blast\n\nlemma thetaIfZOT_ZOretrT:\n\"thetaIfZOT \\<subseteq> ZOretrT (thetaIfZOT Un ZObisT)\"\nproof-\n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>01T d1\" and c2d2: \"c2 \\<approx>01T d2\"\n   hence matchC_ZOC1: \"matchC_ZOC ZObisT c1 d1\" and matchC_ZOC2: \"matchC_ZOC ZObisT c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using ZObisT_matchC_ZOC ZObisT_matchT_T by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> ZOretrT (thetaIfZOT Un ZObisT)\"\n   unfolding ZOretrT_def proof (clarify, intro conjI)\n     show \"matchC_ZOC (thetaIfZOT Un ZObisT) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_ZOC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', If tst d1 d2) \\<in> thetaIfZOT Un ZObisT) \\<or>\n        (\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaIfZOT Un ZObisT)\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIfZOT_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st tst)\n       apply simp by (metis IfFalse c2d2 compatTst_def st tst)\n     qed\n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaIfZOT_def by auto\nqed\n\nlemma thetaIfZOT_ZObisT:\n\"thetaIfZOT \\<subseteq> ZObisT\"\napply(rule ZObisT_coind)\nusing thetaIfZOT_sym thetaIfZOT_ZOretrT by auto\n\ntheorem If_ZObisT[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>01T d1\" and \"c2 \\<approx>01T d2\"\nshows \"If tst c1 c2 \\<approx>01T If tst d1 d2\"\nusing assms thetaIfZOT_ZObisT unfolding thetaIfZOT_def by blast\n\ntext{* While loop:  *}\n\ndefinition thetaWhileZOT where \n\"thetaWhileZOT \\<equiv> \n {(While tst c, While tst d) | tst c d. compatTst tst \\<and> c \\<approx>01T d} Un \n {(c1 ;; (While tst c), d1 ;; (While tst d)) | tst c1 d1 c d. compatTst tst \\<and> c1 \\<approx>01T d1 \\<and> c \\<approx>01T d}\"\n\nlemma thetaWhileZOT_sym:\n\"sym thetaWhileZOT\"\nunfolding thetaWhileZOT_def sym_def using ZObisT_Sym by blast\n\nlemma thetaWhileZOT_ZOretrT:\n\"thetaWhileZOT \\<subseteq> ZOretrT (thetaWhileZOT Un ZObisT)\"\nproof-\n  {fix tst c d \n   assume tst: \"compatTst tst\" and c_d: \"c \\<approx>01T d\"\n   hence matchC_ZOC: \"matchC_ZOC ZObisT c d\" \n     and matchT_T: \"matchT_T c d\" \n   using ZObisT_matchC_ZOC ZObisT_matchT_T by auto\n   have \"(While tst c, While tst d) \\<in> ZOretrT (thetaWhileZOT Un ZObisT)\"\n   unfolding ZOretrT_def proof (clarify, intro conjI)\n     show \"matchC_ZOC (thetaWhileZOT \\<union> ZObisT) (While tst c) (While tst d)\"\n     unfolding matchC_ZOC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', While tst d) \\<in> thetaWhileZOT \\<union> ZObisT) \\<or> \n        (\\<exists>d' t'. (While tst d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhileZOT \\<union> ZObisT)\"\n       apply - apply(erule While_transC_invert)\n       unfolding thetaWhileZOT_def apply simp\n       by (metis WhileTrue c_d compatTst_def st tst)\n     qed\n   next\n     show \"matchT_T (While tst c) (While tst d)\"\n     unfolding matchT_T_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t s' assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>t s'\"\n       thus \"\\<exists>t'. (While tst d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \"\n       apply - apply(erule While_transT_invert)\n       unfolding thetaWhileZOT_def apply simp\n       by (metis PL.WhileFalse compatTst_def st tst)    \n     qed\n   qed\n  }\n  moreover \n  {fix tst c1 d1  c d\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>01T d1\" and c_d: \"c \\<approx>01T d\"\n   hence matchC_ZOC1: \"matchC_ZOC ZObisT c1 d1\" and matchC_ZOC: \"matchC_ZOC ZObisT c d\" \n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T: \"matchT_T c d\"\n   using ZObisT_matchC_ZOC ZObisT_matchT_T by auto\n   have \"(c1 ;; (While tst c), d1 ;; (While tst d)) \\<in> ZOretrT (thetaWhileZOT Un ZObisT)\"\n   unfolding ZOretrT_def proof (clarify, intro conjI)\n     show \"matchC_ZOC (thetaWhileZOT \\<union> ZObisT) (c1 ;; (While tst c)) (d1 ;; (While tst d))\"\n     unfolding matchC_ZOC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; (While tst c), s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', d1 ;; (While tst d)) \\<in> thetaWhileZOT \\<union> ZObisT) \\<or> \n        (\\<exists>d' t'. (d1 ;; (While tst d), t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhileZOT \\<union> ZObisT)\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; (While tst c)\"\n         hence \n         \"(s' \\<approx> t \\<and> c1' \\<approx>01T d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01T d')\" \n         using st matchC_ZOC1 unfolding matchC_ZOC_def by auto\n         thus ?thesis\n         unfolding c' thetaWhileZOT_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis c_d tst)\n         apply simp by (metis SeqC c_d tst) \n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = While tst c\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis\n         unfolding c' thetaWhileZOT_def \n         apply simp by (metis PL.SeqT c_d tst) \n       qed\n     qed\n   qed (unfold matchT_T_def, auto)\n  }\n  ultimately show ?thesis unfolding thetaWhileZOT_def by auto\nqed\n\nlemma thetaWhileZOT_ZObisT:\n\"thetaWhileZOT \\<subseteq> ZObisT\"\napply(rule ZObisT_coind)\nusing thetaWhileZOT_sym thetaWhileZOT_ZOretrT by auto\n\ntheorem While_ZObisT[simp]:\nassumes \"compatTst tst\" and \"c \\<approx>01T d\"\nshows \"While tst c \\<approx>01T While tst d\"\nusing assms thetaWhileZOT_ZObisT unfolding thetaWhileZOT_def by auto\n\ntext{* Parallel composition: *}\n\ndefinition thetaParZOT where \n\"thetaParZOT \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>01T d1 \\<and> c2 \\<approx>01T d2}\"\n\nlemma thetaParZOT_sym:\n\"sym thetaParZOT\"\nunfolding thetaParZOT_def sym_def using ZObisT_Sym by blast\n\nlemma thetaParZOT_ZOretrT:\n\"thetaParZOT \\<subseteq> ZOretrT (thetaParZOT Un ZObisT)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>01T d1\" and c2d2: \"c2 \\<approx>01T d2\"\n   hence matchC_ZOC1: \"matchC_ZOC ZObisT c1 d1\" and matchC_ZOC2: \"matchC_ZOC ZObisT c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_T2: \"matchT_T c2 d2\"\n   using ZObisT_matchC_ZOC ZObisT_matchT_T by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> ZOretrT (thetaParZOT Un ZObisT)\"\n   unfolding ZOretrT_def proof (clarify, intro conjI)\n     show \"matchC_ZOC (thetaParZOT \\<union> ZObisT) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_ZOC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', Par d1 d2) \\<in> thetaParZOT \\<union> ZObisT) \\<or>\n        (\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZOT \\<union> ZObisT)\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence\n         \"(s' \\<approx> t \\<and> c1' \\<approx>01T d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01T d')\"\n         using st matchC_ZOC1 unfolding matchC_ZOC_def by auto\n         thus ?thesis unfolding c' thetaParZOT_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis c2d2)\n         apply simp by(metis ParCL c2d2)\n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaParZOT_def\n         apply simp by (metis PL.ParTL c2d2) \n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \n         \"(s' \\<approx> t \\<and> c2' \\<approx>01T d2) \\<or> \n          (\\<exists>d' t'. (d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>01T d')\"\n         using st matchC_ZOC2 unfolding matchC_ZOC_def by auto\n         thus ?thesis \n         unfolding c' thetaParZOT_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis c1d1)\n         apply simp by (metis ParCR c1d1)\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"\\<exists>t'. (d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T2 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaParZOT_def\n         apply simp by (metis PL.ParTR c1d1) \n       qed\n     qed \n   qed (unfold matchT_T_def, auto)\n  }\n  thus ?thesis unfolding thetaParZOT_def by auto\nqed\n\nlemma thetaParZOT_ZObisT:\n\"thetaParZOT \\<subseteq> ZObisT\"\napply(rule ZObisT_coind)\nusing thetaParZOT_sym thetaParZOT_ZOretrT by auto\n\ntheorem Par_ZObisT[simp]:\nassumes \"c1 \\<approx>01T d1\" and \"c2 \\<approx>01T d2\"\nshows \"Par c1 c2 \\<approx>01T Par d1 d2\"\nusing assms thetaParZOT_ZObisT unfolding thetaParZOT_def by blast\n\n\nsubsubsection{* 01-bisimilarity versus language constructs *}\n\ntext{* Discreetness: *}\n\ntheorem discr_ZObis[simp]:\nassumes *: \"discr c\" and **: \"discr d\"\nshows \"c \\<approx>01 d\"\nproof-\n  let ?theta = \"{(c,d) | c d. discr c \\<and> discr d}\"\n  have \"?theta \\<subseteq> ZObis\"\n  proof(rule ZObis_raw_coind)\n    show \"sym ?theta\" unfolding sym_def by blast\n  next\n    show \"?theta \\<subseteq> ZOretr ?theta\"\n    proof clarify\n      fix c d assume c: \"discr c\" and d: \"discr d\"\n      show \"(c, d) \\<in> ZOretr ?theta\"\n      unfolding ZOretr_def proof (clarify, intro conjI)\n        show \"matchC_ZO ?theta c d\"\n        unfolding matchC_ZO_def proof (tactic {*mauto_no_simp_tac *})\n          fix s t c' s'\n          assume st: \"s \\<approx> t\" and cs: \"(c, s) \\<rightarrow>c (c', s')\"\n          show \n          \"(s' \\<approx> t \\<and> (c', d) \\<in> ?theta) \\<or>\n           (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> ?theta) \\<or>\n           (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n          proof-\n            have \"s \\<approx> s'\" using c cs discr_transC_indis by blast\n            hence s't: \"s' \\<approx> t\" using st indis_trans indis_sym by blast\n            have \"discr c'\" using c cs discr_transC by blast\n            hence \"(c',d) \\<in> ?theta\" using d by blast\n            thus ?thesis using s't by blast\n          qed\n        qed\n      next\n        show \"matchT_ZO c d\"\n        unfolding matchT_ZO_def proof (tactic {*mauto_no_simp_tac *})\n          fix s t s'\n          assume st: \"s \\<approx> t\" and cs: \"(c, s) \\<rightarrow>t s'\"\n          show \n          \"(s' \\<approx> t \\<and> discr d) \\<or>\n           (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or>\n           (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n          proof-\n            have \"s \\<approx> s'\" using c cs discr_transT by blast\n            hence s't: \"s' \\<approx> t\" using st indis_trans indis_sym by blast\n            thus ?thesis using d by blast\n          qed\n        qed\n      qed\n    qed\n  qed\n  thus ?thesis using assms by blast\nqed\n\ntext {* Atomic commands: *}\n\ntheorem Atm_ZObis[simp]:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>01 Atm atm\"\nby (metis Atm_Sbis assms bis_imp) \n\ntext{* Sequential composition:  *}\n\ndefinition thetaSeqZO where \n\"thetaSeqZO \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>01T d1 \\<and> c2 \\<approx>01 d2}\"\n\nlemma thetaSeqZO_sym:\n\"sym thetaSeqZO\"\nunfolding thetaSeqZO_def sym_def using ZObisT_Sym ZObis_Sym by blast\n\nlemma thetaSeqZO_ZOretr:\n\"thetaSeqZO \\<subseteq> ZOretr (thetaSeqZO Un ZObis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>01T d1\" and c2d2: \"c2 \\<approx>01 d2\"\n   hence matchC_ZOC1: \"matchC_ZOC ZObisT c1 d1\" and matchC_ZO2: \"matchC_ZO ZObis c2 d2\"\n     and matchT_T1: \"matchT_T c1 d1\" and matchT_ZO2: \"matchT_ZO c2 d2\"\n   using ZObisT_matchC_ZOC ZObisT_matchT_T ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> ZOretr (thetaSeqZO Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaSeqZO Un ZObis) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_ZO_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', d1 ;; d2) \\<in> thetaSeqZO Un ZObis) \\<or>\n        (\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqZO Un ZObis) \\<or> \n        (\\<exists>t'. (d1 ;; d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence\n         \"(s' \\<approx> t \\<and> c1' \\<approx>01T d1) \\<or> \n          (\\<exists>d1' t'. (d1, t) \\<rightarrow>c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01T d1')\"\n         using st matchC_ZOC1 unfolding matchC_ZOC_def by auto\n         thus ?thesis unfolding c' thetaSeqZO_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis c2d2)\n         apply simp by (metis SeqC c2d2 ) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t'\"\n         using st matchT_T1 unfolding matchT_T_def by auto\n         thus ?thesis \n         unfolding c' thetaSeqZO_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp by (metis PL.SeqT c2d2) \n       qed\n     qed \n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqZO_def by auto\nqed\n\nlemma thetaSeqZO_ZObis:\n\"thetaSeqZO \\<subseteq> ZObis\"\napply(rule ZObis_coind)\nusing thetaSeqZO_sym thetaSeqZO_ZOretr by auto\n\ntheorem Seq_ZObisT_ZObis[simp]:\nassumes \"c1 \\<approx>01T d1\" and \"c2 \\<approx>01 d2\"\nshows \"c1 ;; c2 \\<approx>01 d1 ;; d2\"\nusing assms thetaSeqZO_ZObis unfolding thetaSeqZO_def by blast\n\ntheorem Seq_siso_ZObis[simp]:\nassumes \"siso e\" and \"c2 \\<approx>01 d2\"\nshows \"e ;; c2 \\<approx>01 e ;; d2\"\nusing assms by auto\n\n(*  *)\n\ndefinition thetaSeqZOD where \n\"thetaSeqZOD \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>01 d1 \\<and> discr c2 \\<and> discr d2}\"\n\nlemma thetaSeqZOD_sym:\n\"sym thetaSeqZOD\"\nunfolding thetaSeqZOD_def sym_def using ZObis_Sym by blast\n\nlemma thetaSeqZOD_ZOretr:\n\"thetaSeqZOD \\<subseteq> ZOretr (thetaSeqZOD Un ZObis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>01 d1\" and c2: \"discr c2\" and d2: \"discr d2\"\n   hence matchC_ZO: \"matchC_ZO ZObis c1 d1\" \n     and matchT_ZO: \"matchT_ZO c1 d1\"\n   using ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> ZOretr (thetaSeqZOD Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaSeqZOD Un ZObis) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_ZO_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', d1 ;; d2) \\<in> thetaSeqZOD Un ZObis) \\<or>\n        (\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqZOD Un ZObis) \\<or> \n        (\\<exists>t'. (d1 ;; d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence\n         \"(s' \\<approx> t \\<and> c1' \\<approx>01 d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01 d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_ZO unfolding matchC_ZO_def by auto\n         thus ?thesis unfolding c' thetaSeqZOD_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis c2 d2)\n         apply simp apply (metis SeqC c2 d2)\n         apply simp by (metis SeqT c2 d2 discr_Seq discr_ZObis) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(s' \\<approx> t \\<and> discr d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n         using st matchT_ZO unfolding matchT_ZO_def by auto\n         thus ?thesis \n         unfolding c' thetaSeqZOD_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis c2 d2 discr_Seq discr_ZObis)\n         apply simp apply (metis SeqC c2 d2 discr_Seq discr_ZObis)\n         apply simp by (metis SeqT c2 d2 discr_ZObis) \n       qed\n     qed \n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqZOD_def by auto\nqed\n\nlemma thetaSeqZOD_ZObis:\n\"thetaSeqZOD \\<subseteq> ZObis\"\napply(rule ZObis_coind)\nusing thetaSeqZOD_sym thetaSeqZOD_ZOretr by auto\n\ntheorem Seq_ZObis_discr[simp]:\nassumes \"c1 \\<approx>01 d1\" and \"discr c2\" and \"discr d2\"\nshows \"c1 ;; c2 \\<approx>01 d1 ;; d2\"\nusing assms thetaSeqZOD_ZObis unfolding thetaSeqZOD_def by blast\n\ntext{* Conditional: *}\n\ndefinition thetaIfZO where \n\"thetaIfZO \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>01 d1 \\<and> c2 \\<approx>01 d2}\"\n\nlemma thetaIfZO_sym:\n\"sym thetaIfZO\"\nunfolding thetaIfZO_def sym_def using ZObis_Sym by blast\n\nlemma thetaIfZO_ZOretr:\n\"thetaIfZO \\<subseteq> ZOretr (thetaIfZO Un ZObis)\"\nproof-\n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>01 d1\" and c2d2: \"c2 \\<approx>01 d2\"\n   hence matchC_ZO1: \"matchC_ZO ZObis c1 d1\" and matchC_ZO2: \"matchC_ZO ZObis c2 d2\"\n     and matchT_ZO1: \"matchT_ZO c1 d1\" and matchT_ZO2: \"matchT_ZO c2 d2\"\n   using ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> ZOretr (thetaIfZO Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaIfZO Un ZObis) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_ZO_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', If tst d1 d2) \\<in> thetaIfZO Un ZObis) \\<or>\n        (\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaIfZO Un ZObis) \\<or> \n        (\\<exists>t'. (If tst d1 d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIfZO_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st tst)\n       apply simp by (metis IfFalse c2d2 compatTst_def st tst)\n     qed\n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaIfZO_def by auto\nqed\n\nlemma thetaIfZO_ZObis:\n\"thetaIfZO \\<subseteq> ZObis\"\napply(rule ZObis_coind)\nusing thetaIfZO_sym thetaIfZO_ZOretr by auto\n\ntheorem If_ZObis[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>01 d1\" and \"c2 \\<approx>01 d2\"\nshows \"If tst c1 c2 \\<approx>01 If tst d1 d2\"\nusing assms thetaIfZO_ZObis unfolding thetaIfZO_def by blast\n\ntext{* While loop:  *}\n\ntext{* 01-bisimilarity does not interact with / preserve the While construct in \nany interesting way.*}\n\n(* Indeed, assume c \\<approx>01 d and try to prove while tst c \\<approx>01 while tst d.  \nIf tst is True in some state, we obtain the task of proving c ;; (while tst c) \\<approx>01 d ;; (while tst d).  \nNow, assume c takes a step to c' and d terminates, possibility allowed by ~01-bisimilarity, \nprovided c' is discr.  So now we need to have, for discr c', the following: \nc' ;; (while tst c) \\<approx>01 while tst d.  This is not true in general. *)\n\ntext{* Parallel composition:  *}\n\ndefinition thetaParZOL1 where \n\"thetaParZOL1 \\<equiv> \n {(Par c1 c2, d) | c1 c2 d. c1 \\<approx>01 d \\<and> discr c2}\"\n\nlemma thetaParZOL1_ZOretr:\n\"thetaParZOL1 \\<subseteq> ZOretr (thetaParZOL1 Un ZObis)\"\nproof-\n  {fix c1 c2 d\n   assume c1d: \"c1 \\<approx>01 d\" and c2: \"discr c2\"\n   hence matchC_ZO: \"matchC_ZO ZObis c1 d\" \n     and matchT_ZO: \"matchT_ZO c1 d\" \n   using ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(Par c1 c2, d) \\<in> ZOretr (thetaParZOL1 Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaParZOL1 \\<union> ZObis) (Par c1 c2) d\"\n     unfolding matchC_ZO_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus\n       \"(s' \\<approx> t \\<and> (c', d) \\<in> thetaParZOL1 \\<union> ZObis) \\<or>\n        (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZOL1 \\<union> ZObis) \\<or>\n        (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \n         \"(s' \\<approx> t \\<and> c1' \\<approx>01 d) \\<or> \n          (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01 d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_ZO unfolding matchC_ZO_def by blast\n         thus ?thesis unfolding thetaParZOL1_def\n         apply - apply(elim disjE exE conjE) \n         apply simp apply (metis c2 c')\n         apply simp apply (metis c2 c')\n         apply simp by (metis c' c2 discr_Par) \n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(s' \\<approx> t \\<and> discr d) \\<or> \n          (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n         using st matchT_ZO unfolding matchT_ZO_def by blast\n         thus ?thesis unfolding thetaParZOL1_def\n         apply - apply(elim disjE exE conjE)\n         apply simp apply (metis c' c2 discr_ZObis)\n         apply simp apply (metis c' c2 discr_ZObis)\n         apply simp by (metis c' c2)  \n       next\n         fix c2' assume c2s: \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \"s \\<approx> s'\" using c2 discr_transC_indis by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         have \"discr c2'\" using c2 c2s discr_transC by blast\n         thus ?thesis using s't c1d unfolding thetaParZOL1_def c' by simp\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"s \\<approx> s'\" using c2 discr_transT by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         thus ?thesis using c1d unfolding thetaParZOL1_def c' by simp\n       qed\n     qed\n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaParZOL1_def by blast\nqed\n\nlemma thetaParZOL1_converse_ZOretr:\n\"thetaParZOL1 ^-1 \\<subseteq> ZOretr (thetaParZOL1 ^-1 Un ZObis)\"\nproof-\n  {fix c1 c2 d\n   assume c1d: \"c1 \\<approx>01 d\" and c2: \"discr c2\"\n   hence matchC_ZO: \"matchC_ZO ZObis d c1\" \n     and matchT_ZO: \"matchT_ZO d c1\" \n   using ZObis_matchC_ZO_rev ZObis_matchT_ZO_rev by auto\n   have \"(d, Par c1 c2) \\<in> ZOretr (thetaParZOL1\\<inverse> \\<union> ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaParZOL1\\<inverse> \\<union> ZObis) d (Par c1 c2)\"\n     unfolding matchC_ZO_def2 ZObis_converse proof (tactic {* mauto_no_simp_tac *}) \n       fix s t d' t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>c (d', t')\"\n       hence \n       \"(s \\<approx> t' \\<and> d' \\<approx>01 c1) \\<or> \n        (\\<exists>c' s'. (c1, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> d' \\<approx>01 c') \\<or> \n        (\\<exists>s'. (c1, s) \\<rightarrow>t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       using matchC_ZO unfolding matchC_ZO_def2 by auto\n       thus\n       \"(s \\<approx> t' \\<and> (Par c1 c2, d') \\<in> thetaParZOL1 \\<union> ZObis) \\<or>\n        (\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZOL1 \\<union> ZObis) \\<or>\n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       unfolding thetaParZOL1_def \n       apply - apply(tactic {* mauto_no_simp_tac *})\n       apply simp apply (metis ZObis_Sym c2)\n       apply simp apply (metis ParCL ZObis_sym c2 sym_def)\n       apply simp by (metis ParTL c2 discr_ZObis) \n     qed\n   next\n     show \"matchT_ZO d (Par c1 c2)\"\n     unfolding matchT_ZO_def2 ZObis_converse proof (tactic {* mauto_no_simp_tac *}) \n       fix s t t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>t t'\"\n       hence \n       \"(s \\<approx> t' \\<and> discr c1) \\<or> \n        (\\<exists>c' s'. (c1, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (c1, s) \\<rightarrow>t s' \\<and> s' \\<approx> t')\"\n       using matchT_ZO unfolding matchT_ZO_def2 by auto\n       thus\n       \"(s \\<approx> t' \\<and> discr (Par c1 c2)) \\<or> \n        (\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t')\"\n       apply - apply(tactic {* mauto_no_simp_tac *})\n       apply simp apply (metis c2 discr_Par)\n       apply simp apply (metis ParCL c2 discr_Par)\n       apply simp by (metis ParTL c2)\n     qed\n   qed\n  }\n  thus ?thesis unfolding thetaParZOL1_def by blast\nqed\n\nlemma thetaParZOL1_ZObis:\n\"thetaParZOL1 \\<subseteq> ZObis\"\napply(rule ZObis_coind2)\nusing thetaParZOL1_ZOretr thetaParZOL1_converse_ZOretr by auto\n\ntheorem Par_ZObis_discrL1[simp]:\nassumes \"c1 \\<approx>01 d\" and \"discr c2\"\nshows \"Par c1 c2 \\<approx>01 d\"\nusing assms thetaParZOL1_ZObis unfolding thetaParZOL1_def by blast\n\ntheorem Par_ZObis_discrR1[simp]:\nassumes \"c \\<approx>01 d1\" and \"discr d2\"\nshows \"c \\<approx>01 Par d1 d2\"\nusing assms Par_ZObis_discrL1 ZObis_Sym by blast\n\n(*  *)\n\ndefinition thetaParZOL2 where \n\"thetaParZOL2 \\<equiv> \n {(Par c1 c2, d) | c1 c2 d. discr c1 \\<and> c2 \\<approx>01 d}\"\n\nlemma thetaParZOL2_ZOretr:\n\"thetaParZOL2 \\<subseteq> ZOretr (thetaParZOL2 Un ZObis)\"\nproof-\n  {fix c1 c2 d\n   assume c2d: \"c2 \\<approx>01 d\" and c1: \"discr c1\" \n   hence matchC_ZO: \"matchC_ZO ZObis c2 d\" \n     and matchT_ZO: \"matchT_ZO c2 d\" \n   using ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(Par c1 c2, d) \\<in> ZOretr (thetaParZOL2 Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaParZOL2 \\<union> ZObis) (Par c1 c2) d\"\n     unfolding matchC_ZO_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus\n       \"(s' \\<approx> t \\<and> (c', d) \\<in> thetaParZOL2 \\<union> ZObis) \\<or>\n        (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZOL2 \\<union> ZObis) \\<or>\n        (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \"s \\<approx> s'\" using c1 discr_transC_indis by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         have \"discr c1'\" using c1 c1s discr_transC by blast\n         thus ?thesis using s't c2d unfolding thetaParZOL2_def c' by simp\n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"s \\<approx> s'\" using c1 discr_transT by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         thus ?thesis using c2d unfolding thetaParZOL2_def c' by simp\n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \n         \"(s' \\<approx> t \\<and> c2' \\<approx>01 d) \\<or> \n          (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>01 d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c2')\"\n         using st matchC_ZO unfolding matchC_ZO_def by blast\n         thus ?thesis unfolding thetaParZOL2_def\n         apply - apply(elim disjE exE conjE) \n         apply simp apply (metis c1 c')\n         apply simp apply (metis c1 c')\n         apply simp by (metis c' c1 discr_Par) \n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \n         \"(s' \\<approx> t \\<and> discr d) \\<or> \n          (\\<exists>d' t'. (d, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n         using st matchT_ZO unfolding matchT_ZO_def by blast\n         thus ?thesis unfolding thetaParZOL2_def\n         apply - apply(elim disjE exE conjE)\n         apply simp apply (metis c' c1 discr_ZObis)\n         apply simp apply (metis c' c1 discr_ZObis)\n         apply simp by (metis c' c1)          \n       qed\n     qed\n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaParZOL2_def by blast\nqed\n\nlemma thetaParZOL2_converse_ZOretr:\n\"thetaParZOL2 ^-1 \\<subseteq> ZOretr (thetaParZOL2 ^-1 Un ZObis)\"\nproof-\n  {fix c1 c2 d\n   assume c2d: \"c2 \\<approx>01 d\" and c1: \"discr c1\"\n   hence matchC_ZO: \"matchC_ZO ZObis d c2\" \n     and matchT_ZO: \"matchT_ZO d c2\" \n   using ZObis_matchC_ZO_rev ZObis_matchT_ZO_rev by auto\n   have \"(d, Par c1 c2) \\<in> ZOretr (thetaParZOL2\\<inverse> \\<union> ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaParZOL2\\<inverse> \\<union> ZObis) d (Par c1 c2)\"\n     unfolding matchC_ZO_def2 ZObis_converse proof (tactic {* mauto_no_simp_tac *}) \n       fix s t d' t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>c (d', t')\"\n       hence \n       \"(s \\<approx> t' \\<and> d' \\<approx>01 c2) \\<or> \n        (\\<exists>c' s'. (c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> d' \\<approx>01 c') \\<or> \n        (\\<exists>s'. (c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       using matchC_ZO unfolding matchC_ZO_def2 by auto\n       thus\n       \"(s \\<approx> t' \\<and> (Par c1 c2, d') \\<in> thetaParZOL2 \\<union> ZObis) \\<or>\n        (\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZOL2 \\<union> ZObis) \\<or>\n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       unfolding thetaParZOL2_def \n       apply - apply(tactic {* mauto_no_simp_tac *})\n       apply simp apply (metis ZObis_Sym c1)\n       apply simp apply (metis ParCR ZObis_sym c1 sym_def)\n       apply simp by (metis ParTR c1 discr_ZObis) \n     qed\n   next\n     show \"matchT_ZO d (Par c1 c2)\"\n     unfolding matchT_ZO_def2 ZObis_converse proof (tactic {* mauto_no_simp_tac *}) \n       fix s t t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>t t'\"\n       hence \n       \"(s \\<approx> t' \\<and> discr c2) \\<or> \n        (\\<exists>c' s'. (c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t')\"\n       using matchT_ZO unfolding matchT_ZO_def2 by auto\n       thus\n       \"(s \\<approx> t' \\<and> discr (Par c1 c2)) \\<or> \n        (\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>t s' \\<and> s' \\<approx> t')\"\n       apply - apply(tactic {* mauto_no_simp_tac *})\n       apply simp apply (metis c1 discr_Par)\n       apply simp apply (metis ParCR c1 discr_Par)\n       apply simp by (metis ParTR c1)\n     qed\n   qed\n  }\n  thus ?thesis unfolding thetaParZOL2_def by blast\nqed\n\nlemma thetaParZOL2_ZObis:\n\"thetaParZOL2 \\<subseteq> ZObis\"\napply(rule ZObis_coind2)\nusing thetaParZOL2_ZOretr thetaParZOL2_converse_ZOretr by auto\n\ntheorem Par_ZObis_discrL2[simp]:\nassumes \"c2 \\<approx>01 d\" and \"discr c1\"\nshows \"Par c1 c2 \\<approx>01 d\"\nusing assms thetaParZOL2_ZObis unfolding thetaParZOL2_def by blast\n\ntheorem Par_ZObis_discrR2[simp]:\nassumes \"c \\<approx>01 d2\" and \"discr d1\"\nshows \"c \\<approx>01 Par d1 d2\"\nusing assms Par_ZObis_discrL2 ZObis_Sym by blast\n\n(*  *)\n\ndefinition thetaParZO where \n\"thetaParZO \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>01 d1 \\<and> c2 \\<approx>01 d2}\"\n\nlemma thetaParZO_sym:\n\"sym thetaParZO\"\nunfolding thetaParZO_def sym_def using ZObis_Sym by blast\n\nlemma thetaParZO_ZOretr:\n\"thetaParZO \\<subseteq> ZOretr (thetaParZO Un ZObis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>01 d1\" and c2d2: \"c2 \\<approx>01 d2\"\n   hence matchC_ZO1: \"matchC_ZO ZObis c1 d1\" and matchC_ZO2: \"matchC_ZO ZObis c2 d2\"\n     and matchT_ZO1: \"matchT_ZO c1 d1\" and matchT_ZO2: \"matchT_ZO c2 d2\"\n   using ZObis_matchC_ZO ZObis_matchT_ZO by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> ZOretr (thetaParZO Un ZObis)\"\n   unfolding ZOretr_def proof (clarify, intro conjI)\n     show \"matchC_ZO (thetaParZO \\<union> ZObis) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_ZO_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(s' \\<approx> t \\<and> (c', Par d1 d2) \\<in> thetaParZO \\<union> ZObis) \\<or>\n        (\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParZO \\<union> ZObis) \\<or> \n        (\\<exists>t'. (Par d1 d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence\n         \"(s' \\<approx> t \\<and> c1' \\<approx>01 d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>01 d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_ZO1 unfolding matchC_ZO_def by auto\n         thus ?thesis unfolding c' thetaParZO_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis c2d2)\n         apply simp apply (metis ParCL c2d2)\n         apply simp by (metis ParTL Par_ZObis_discrL2 c2d2)   \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(s' \\<approx> t \\<and> discr d1) \\<or> \n          (\\<exists>d' t'. (d1, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n         using st matchT_ZO1 unfolding matchT_ZO_def by auto\n         thus ?thesis \n         unfolding c' thetaParZO_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis Par_ZObis_discrR2 c2d2)\n         apply simp apply (metis PL.ParCL Par_ZObis_discrR2 c2d2)\n         apply simp by (metis PL.ParTL c2d2) \n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \n         \"(s' \\<approx> t \\<and> c2' \\<approx>01 d2) \\<or> \n          (\\<exists>d' t'. (d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>01 d') \\<or> \n          (\\<exists>t'. (d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t' \\<and> discr c2')\"\n         using st matchC_ZO2 unfolding matchC_ZO_def by auto\n         thus ?thesis \n         unfolding c' thetaParZO_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis c1d1)\n         apply simp apply (metis PL.ParCR c1d1)\n         apply simp by (metis PL.ParTR Par_ZObis_discrL1 c1d1)\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \n         \"(s' \\<approx> t \\<and> discr d2) \\<or> \n          (\\<exists>d' t'. (d2, t) \\<rightarrow>c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d2, t) \\<rightarrow>t t' \\<and> s' \\<approx> t')\"\n         using st matchT_ZO2 unfolding matchT_ZO_def by auto\n         thus ?thesis \n         unfolding c' thetaParZO_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis Par_ZObis_discrR1 c1d1)\n         apply simp apply (metis PL.ParCR Par_ZObis_discrR1 c1d1)\n         apply simp by (metis PL.ParTR c1d1) \n       qed\n     qed \n   qed (unfold matchT_ZO_def, auto)\n  }\n  thus ?thesis unfolding thetaParZO_def by auto\nqed\n\nlemma thetaParZO_ZObis:\n\"thetaParZO \\<subseteq> ZObis\"\napply(rule ZObis_coind)\nusing thetaParZO_sym thetaParZO_ZOretr by auto\n\ntheorem Par_ZObis[simp]:\nassumes \"c1 \\<approx>01 d1\" and \"c2 \\<approx>01 d2\"\nshows \"Par c1 c2 \\<approx>01 Par d1 d2\"\nusing assms thetaParZO_ZObis unfolding thetaParZO_def by blast\n\n\nsubsubsection{* WT-bisimilarity versus language constructs *}\n\ntext{* Discreetness: *}\n\ntheorem noWhile_discr_WbisT[simp]:\n  assumes \"noWhile c1\" and \"noWhile c2\" \n  and \"discr c1\" and \"discr c2\"\n  shows \"c1 \\<approx>wT c2\"\nproof -\n  from assms have \"noWhile c1 \\<and> noWhile c2 \\<and> discr c1 \\<and> discr c2\" by auto\n  then show ?thesis\n  proof (induct rule: WbisT_coinduct)\n    case cont then show ?case\n      by (metis MtransC_Refl noWhile_transC discr_transC discr_transC_indis indis_sym indis_trans) \n  next\n    case termi then show ?case\n      by (metis discr_MtransT indis_sym indis_trans noWhile_MtransT transT_MtransT)\n  qed simp\nqed\n\ntext {* Atomic commands: *}\n\ntheorem Atm_WbisT:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>wT Atm atm\"\nby (metis Atm_Sbis assms bis_imp)\n\ntext{* Sequential composition:  *} \n\ndefinition thetaSeqWT where \n\"thetaSeqWT \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>wT d1 \\<and> c2 \\<approx>wT d2}\"\n\nlemma thetaSeqWT_sym:\n\"sym thetaSeqWT\"\nunfolding thetaSeqWT_def sym_def using WbisT_Sym by blast\n\nlemma thetaSeqWT_WretrT:\n\"thetaSeqWT \\<subseteq> WretrT (thetaSeqWT Un WbisT)\"\nproof- \n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>wT d1\" and c2d2: \"c2 \\<approx>wT d2\"\n   hence matchC_MC1: \"matchC_MC WbisT c1 d1\" and matchC_MC2: \"matchC_MC WbisT c2 d2\"\n     and matchT_MT1: \"matchT_MT c1 d1\" and matchT_T2: \"matchT_MT c2 d2\"\n   using WbisT_matchC_MC WbisT_matchT_MT by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> WretrT (thetaSeqWT Un WbisT)\"\n   unfolding WretrT_def proof (clarify, intro conjI)\n     show \"matchC_MC (thetaSeqWT Un WbisT) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_MC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \"(\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqWT Un WbisT)\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence \"\\<exists>d1' t'. (d1, t) \\<rightarrow>*c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>wT d1'\"\n         using st matchC_MC1 unfolding matchC_MC_def by blast\n         thus ?thesis unfolding c' thetaSeqWT_def\n         apply simp by (metis PL.Seq_MtransC c2d2) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using st matchT_MT1 unfolding matchT_MT_def by auto\n         thus ?thesis \n         unfolding c' thetaSeqWT_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp by (metis Seq_MtransT_MtransC c2d2) \n       qed\n     qed \n   qed (unfold matchT_MT_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqWT_def by auto\nqed\n\nlemma thetaSeqWT_WbisT:\n\"thetaSeqWT \\<subseteq> WbisT\"\napply(rule WbisT_coind)\nusing thetaSeqWT_sym thetaSeqWT_WretrT by auto\n\ntheorem Seq_WbisT[simp]:\nassumes \"c1 \\<approx>wT d1\" and \"c2 \\<approx>wT d2\"\nshows \"c1 ;; c2 \\<approx>wT d1 ;; d2\"\nusing assms thetaSeqWT_WbisT unfolding thetaSeqWT_def by blast \n\ntext{* Conditional: *}\n\ndefinition thetaIfWT where \n\"thetaIfWT \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>wT d1 \\<and> c2 \\<approx>wT d2}\"\n\nlemma thetaIfWT_sym:\n\"sym thetaIfWT\"\nunfolding thetaIfWT_def sym_def using WbisT_Sym by blast\n\nlemma thetaIfWT_WretrT:\n\"thetaIfWT \\<subseteq> WretrT (thetaIfWT Un WbisT)\"\nproof- \n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>wT d1\" and c2d2: \"c2 \\<approx>wT d2\"\n   hence matchC_MC1: \"matchC_MC WbisT c1 d1\" and matchC_MC2: \"matchC_MC WbisT c2 d2\"\n     and matchT_MT1: \"matchT_MT c1 d1\" and matchT_MT2: \"matchT_MT c2 d2\"\n   using WbisT_matchC_MC WbisT_matchT_MT by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> WretrT (thetaIfWT Un WbisT)\"\n   unfolding WretrT_def proof (clarify, intro conjI)\n     show \"matchC_MC (thetaIfWT Un WbisT) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_MC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaIfWT Un WbisT\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIfWT_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st transC_MtransC tst) \n       apply simp by (metis IfFalse c2d2 compatTst_def st transC_MtransC tst) \n     qed\n   qed (unfold matchT_MT_def, auto)\n  }\n  thus ?thesis unfolding thetaIfWT_def by auto\nqed\n\nlemma thetaIfWT_WbisT:\n\"thetaIfWT \\<subseteq> WbisT\"\napply(rule WbisT_coind)\nusing thetaIfWT_sym thetaIfWT_WretrT by auto\n\ntheorem If_WbisT[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>wT d1\" and \"c2 \\<approx>wT d2\"\nshows \"If tst c1 c2 \\<approx>wT If tst d1 d2\"\nusing assms thetaIfWT_WbisT unfolding thetaIfWT_def by blast\n\ntext{* While loop:  *}\n\ndefinition thetaWhileW where \n\"thetaWhileW \\<equiv> \n {(While tst c, While tst d) | tst c d. compatTst tst \\<and> c \\<approx>wT d} Un \n {(c1 ;; (While tst c), d1 ;; (While tst d)) | tst c1 d1 c d. \n               compatTst tst \\<and> c1 \\<approx>wT d1 \\<and> c \\<approx>wT d}\"\n\nlemma thetaWhileW_sym:\n\"sym thetaWhileW\"\nunfolding thetaWhileW_def sym_def using WbisT_Sym by blast\n\nlemma thetaWhileW_WretrT:\n\"thetaWhileW \\<subseteq> WretrT (thetaWhileW Un WbisT)\"\nproof-\n  {fix tst c d \n   assume tst: \"compatTst tst\" and c_d: \"c \\<approx>wT d\"\n   hence matchC_MC: \"matchC_MC WbisT c d\" \n     and matchT_MT: \"matchT_MT c d\" \n   using WbisT_matchC_MC WbisT_matchT_MT by auto\n   have \"(While tst c, While tst d) \\<in> WretrT (thetaWhileW Un WbisT)\"\n   unfolding WretrT_def proof (clarify, intro conjI)\n     show \"matchC_MC (thetaWhileW \\<union> WbisT) (While tst c) (While tst d)\"\n     unfolding matchC_MC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (While tst d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                     (c', d') \\<in> thetaWhileW \\<union> WbisT\"\n       apply - apply(erule While_transC_invert)\n       unfolding thetaWhileW_def apply simp\n       by (metis PL.WhileTrue PL.transC_MtransC c_d compatTst_def st tst)\n     qed\n   next\n     show \"matchT_MT (While tst c) (While tst d)\"\n     unfolding matchT_MT_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t s' assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>t s'\"\n       thus \"\\<exists>t'. (While tst d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \"\n       apply - apply(erule While_transT_invert)\n       unfolding thetaWhileW_def apply simp\n       by (metis WhileFalse compatTst_def st transT_MtransT tst)       \n     qed\n   qed\n  }\n  moreover \n  {fix tst c1 d1  c d\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>wT d1\" and c_d: \"c \\<approx>wT d\"\n   hence matchC_MC1: \"matchC_MC WbisT c1 d1\" and matchC_MC: \"matchC_MC WbisT c d\" \n     and matchT_MT1: \"matchT_MT c1 d1\" and matchT_MT: \"matchT_MT c d\"\n   using WbisT_matchC_MC WbisT_matchT_MT by auto\n   have \"(c1 ;; (While tst c), d1 ;; (While tst d)) \\<in> WretrT (thetaWhileW Un WbisT)\"\n   unfolding WretrT_def proof (clarify, intro conjI)\n     show \"matchC_MC (thetaWhileW \\<union> WbisT) (c1 ;; (While tst c)) (d1 ;; (While tst d))\"\n     unfolding matchC_MC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; (While tst c), s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (d1 ;; (While tst d), t) \\<rightarrow>*c (d', t') \\<and> \n                     s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhileW \\<union> WbisT\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; (While tst c)\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>wT d'\" \n         using st matchC_MC1 unfolding matchC_MC_def by blast\n         thus ?thesis\n         unfolding c' thetaWhileW_def\n         apply simp by (metis PL.Seq_MtransC c_d tst)\n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = While tst c\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using st matchT_MT1 unfolding matchT_MT_def by auto\n         thus ?thesis\n         unfolding c' thetaWhileW_def \n         apply simp by (metis PL.Seq_MtransT_MtransC c_d tst)\n       qed\n     qed\n   qed (unfold matchT_MT_def, auto)\n  }\n  ultimately show ?thesis unfolding thetaWhileW_def by auto\nqed\n\nlemma thetaWhileW_WbisT:\n\"thetaWhileW \\<subseteq> WbisT\"\napply(rule WbisT_coind)\nusing thetaWhileW_sym thetaWhileW_WretrT by auto\n\ntheorem While_WbisT[simp]:\nassumes \"compatTst tst\" and \"c \\<approx>wT d\"\nshows \"While tst c \\<approx>wT While tst d\"\nusing assms thetaWhileW_WbisT unfolding thetaWhileW_def by auto\n\ntext{* Parallel composition: *}\n\ndefinition thetaParWT where \n\"thetaParWT \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>wT d1 \\<and> c2 \\<approx>wT d2}\"\n\nlemma thetaParWT_sym:\n\"sym thetaParWT\"\nunfolding thetaParWT_def sym_def using WbisT_Sym by blast\n\nlemma thetaParWT_WretrT:\n\"thetaParWT \\<subseteq> WretrT (thetaParWT Un WbisT)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>wT d1\" and c2d2: \"c2 \\<approx>wT d2\"\n   hence matchC_MC1: \"matchC_MC WbisT c1 d1\" and matchC_MC2: \"matchC_MC WbisT c2 d2\"\n     and matchT_MT1: \"matchT_MT c1 d1\" and matchT_MT2: \"matchT_MT c2 d2\"\n   using WbisT_matchC_MC WbisT_matchT_MT by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> WretrT (thetaParWT Un WbisT)\"\n   unfolding WretrT_def proof (clarify, intro conjI)\n     show \"matchC_MC (thetaParWT \\<union> WbisT) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_MC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                     (c', d') \\<in> thetaParWT \\<union> WbisT\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>wT d'\"\n         using st matchC_MC1 unfolding matchC_MC_def by blast\n         thus ?thesis unfolding c' thetaParWT_def\n         apply simp by (metis PL.ParCL_MtransC c2d2) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using st matchT_MT1 unfolding matchT_MT_def by blast\n         thus ?thesis \n         unfolding c' thetaParWT_def\n         apply simp by (metis PL.ParTL_MtransC c2d2)\n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \"\\<exists>d' t'. (d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>wT d'\"\n         using st matchC_MC2 unfolding matchC_MC_def by blast\n         thus ?thesis \n         unfolding c' thetaParWT_def\n         apply simp by (metis PL.ParCR_MtransC c1d1)\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"\\<exists>t'. (d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using st matchT_MT2 unfolding matchT_MT_def by blast\n         thus ?thesis \n         unfolding c' thetaParWT_def\n         apply simp by (metis PL.ParTR_MtransC c1d1)\n       qed\n     qed \n   qed (unfold matchT_MT_def, auto)\n  }\n  thus ?thesis unfolding thetaParWT_def by auto\nqed\n\nlemma thetaParWT_WbisT:\n\"thetaParWT \\<subseteq> WbisT\"\napply(rule WbisT_coind)\nusing thetaParWT_sym thetaParWT_WretrT by auto\n\ntheorem Par_WbisT[simp]:\nassumes \"c1 \\<approx>wT d1\" and \"c2 \\<approx>wT d2\"\nshows \"Par c1 c2 \\<approx>wT Par d1 d2\"\nusing assms thetaParWT_WbisT unfolding thetaParWT_def by blast\n\n\nsubsubsection{* T-bisimilarity versus language constructs *}\n\ntext{* T-Discreetness: *}\n\ndefinition thetaFDW0 where \n\"thetaFDW0 \\<equiv> \n {(c1,c2). discr0 c1 \\<and> discr0 c2}\"\n\nlemma thetaFDW0_sym:\n\"sym thetaFDW0\"\nunfolding thetaFDW0_def sym_def using Sbis_Sym by blast\n\nlemma thetaFDW0_RetrT:\n\"thetaFDW0 \\<subseteq> RetrT thetaFDW0\"\nproof-\n  {fix c d \n   assume c: \"discr0 c\" and d: \"discr0 d\"\n   have \"(c,d) \\<in> RetrT thetaFDW0\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC thetaFDW0 c d\"\n     unfolding matchC_TMC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s' assume \"mustT c s\" \"mustT d t\" \n       \"s \\<approx> t\" and \"(c, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaFDW0\"\n       unfolding thetaFDW0_def apply simp\n       by (metis MtransC_Refl noWhile_transC c d discr0_transC discr0_transC_indis \n                 indis_sym indis_trans) \n     qed\n   next\n     show \"matchT_TMT c d\"\n     unfolding matchT_TMT_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t s' assume mt: \"mustT c s\" \"mustT d t\"  \n       and st: \"s \\<approx> t\" and cs: \"(c, s) \\<rightarrow>t s'\"\n       obtain t' where dt: \"(d, t) \\<rightarrow>*t t'\" by (metis mt mustT_MtransT)\n       hence \"t \\<approx> t'\" and \"s \\<approx> s'\" using mt cs c d discr0_transT discr0_MtransT by blast+\n       hence \"s' \\<approx> t'\" using st indis_trans indis_sym by blast\n       thus \"\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\" using dt by blast     \n     qed\n   qed\n  }\n  thus ?thesis unfolding thetaFDW0_def by blast\nqed\n\nlemma thetaFDW0_BisT:\n\"thetaFDW0 \\<subseteq> BisT\"\napply(rule BisT_raw_coind)\nusing thetaFDW0_sym thetaFDW0_RetrT by auto\n\ntheorem discr0_BisT[simp]:\nassumes \"discr0 c1\" and \"discr0 c2\"\nshows \"c1 \\<approx>T c2\"\nusing assms thetaFDW0_BisT unfolding thetaFDW0_def by blast   \n\ntext {* Atomic commands: *}\n\ntheorem Atm_BisT:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>T Atm atm\"\nby (metis assms siso0_Atm siso0_Sbis)\n\ntext{* Sequential composition:  *} \n\ndefinition thetaSeqTT where \n\"thetaSeqTT \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>T d1 \\<and> c2 \\<approx>T d2}\"\n\nlemma thetaSeqTT_sym:\n\"sym thetaSeqTT\"\nunfolding thetaSeqTT_def sym_def using BisT_Sym by blast\n\nlemma thetaSeqTT_RetrT:\n\"thetaSeqTT \\<subseteq> RetrT (thetaSeqTT \\<union> BisT)\"\nproof- \n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>T d1\" and c2d2: \"c2 \\<approx>T d2\"\n   hence matchC_TMC1: \"matchC_TMC BisT c1 d1\" and matchC_TMC2: \"matchC_TMC BisT c2 d2\"\n     and matchT_TMT1: \"matchT_TMT c1 d1\" and matchT_T2: \"matchT_TMT c2 d2\"\n   using BisT_matchC_TMC BisT_matchT_TMT by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> RetrT (thetaSeqTT \\<union> BisT)\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC (thetaSeqTT \\<union> BisT) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_TMC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume mt: \"mustT (c1 ;; c2) s\" \"mustT (d1 ;; d2) t\"\n       and st: \"s \\<approx> t\" \n       hence mt1: \"mustT c1 s\" \"mustT d1 t\"\n       by (metis mustT_Seq_L mustT_Seq_R)+\n       assume 0: \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \"(\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                      (c', d') \\<in> thetaSeqTT \\<union> BisT)\"\n       proof(elim Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence \"\\<exists>d1' t'. (d1, t) \\<rightarrow>*c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>T d1'\"\n         using mt1 st matchC_TMC1 unfolding matchC_TMC_def by blast\n         thus ?thesis unfolding c' thetaSeqTT_def\n         apply simp by (metis Seq_MtransC c2d2) \n       next      \n         assume c1: \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         then obtain t' where d1: \"(d1, t) \\<rightarrow>*t t'\" and s't': \"s' \\<approx> t'\"\n         using mt1 st matchT_TMT1 unfolding matchT_TMT_def by blast\n         hence mt1: \"mustT c2 s'\" \"mustT d2 t'\"\n         apply (metis 0 c' mt mustT_transC)\n         by (metis mustT_Seq_R d1 mt(2))\n         thus ?thesis \n         unfolding c' thetaSeqTT_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp by (metis Seq_MtransT_MtransC c2d2 d1 s't') \n       qed\n     qed \n   qed (unfold matchT_TMT_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqTT_def by auto\nqed\n\nlemma thetaSeqTT_BisT:\n\"thetaSeqTT \\<subseteq> BisT\"\napply(rule BisT_coind)\nusing thetaSeqTT_sym thetaSeqTT_RetrT by auto\n\ntheorem Seq_BisT[simp]:\nassumes \"c1 \\<approx>T d1\" and \"c2 \\<approx>T d2\"\nshows \"c1 ;; c2 \\<approx>T d1 ;; d2\"\nusing assms thetaSeqTT_BisT unfolding thetaSeqTT_def by blast \n\ntext{* Conditional: *}\n\ndefinition thetaIfTT where \n\"thetaIfTT \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>T d1 \\<and> c2 \\<approx>T d2}\"\n\nlemma thetaIfTT_sym:\n\"sym thetaIfTT\"\nunfolding thetaIfTT_def sym_def using BisT_Sym by blast\n\nlemma thetaIfTT_RetrT:\n\"thetaIfTT \\<subseteq> RetrT (thetaIfTT \\<union> BisT)\"\nproof- \n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>T d1\" and c2d2: \"c2 \\<approx>T d2\"\n   hence matchC_TMC1: \"matchC_TMC BisT c1 d1\" and matchC_TMC2: \"matchC_TMC BisT c2 d2\"\n     and matchT_TMT1: \"matchT_TMT c1 d1\" and matchT_TMT2: \"matchT_TMT c2 d2\"\n   using BisT_matchC_TMC BisT_matchT_TMT by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> RetrT (thetaIfTT \\<union> BisT)\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC (thetaIfTT \\<union> BisT) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_TMC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                     (c', d') \\<in> thetaIfTT \\<union> BisT\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIfTT_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st transC_MtransC tst) \n       apply simp by (metis IfFalse c2d2 compatTst_def st transC_MtransC tst) \n     qed\n   qed (unfold matchT_TMT_def, auto)\n  }\n  thus ?thesis unfolding thetaIfTT_def by auto\nqed\n\nlemma thetaIfTT_BisT:\n\"thetaIfTT \\<subseteq> BisT\"\napply(rule BisT_coind)\nusing thetaIfTT_sym thetaIfTT_RetrT by auto\n\ntheorem If_BisT[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>T d1\" and \"c2 \\<approx>T d2\"\nshows \"If tst c1 c2 \\<approx>T If tst d1 d2\"\nusing assms thetaIfTT_BisT unfolding thetaIfTT_def by blast\n\ntext{* While loop:  *}\n\ndefinition thetaWhileW0 where \n\"thetaWhileW0 \\<equiv> \n {(While tst c, While tst d) | tst c d. compatTst tst \\<and> c \\<approx>T d} \\<union> \n {(c1 ;; (While tst c), d1 ;; (While tst d)) | tst c1 d1 c d. \n               compatTst tst \\<and> c1 \\<approx>T d1 \\<and> c \\<approx>T d}\"\n\nlemma thetaWhileW0_sym:\n\"sym thetaWhileW0\"\nunfolding thetaWhileW0_def sym_def using BisT_Sym by blast\n\nlemma thetaWhileW0_RetrT:\n\"thetaWhileW0 \\<subseteq> RetrT (thetaWhileW0 \\<union> BisT)\"\nproof-\n  {fix tst c d \n   assume tst: \"compatTst tst\" and c_d: \"c \\<approx>T d\"\n   hence matchC_TMC: \"matchC_TMC BisT c d\" \n     and matchT_TMT: \"matchT_TMT c d\" \n   using BisT_matchC_TMC BisT_matchT_TMT by auto\n   have \"(While tst c, While tst d) \\<in> RetrT (thetaWhileW0 \\<union> BisT)\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC (thetaWhileW0 \\<union> BisT) (While tst c) (While tst d)\"\n     unfolding matchC_TMC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (While tst d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                     (c', d') \\<in> thetaWhileW0 \\<union> BisT\"\n       apply - apply(erule While_transC_invert)\n       unfolding thetaWhileW0_def apply simp\n       by (metis WhileTrue transC_MtransC c_d compatTst_def st tst)\n     qed\n   next\n     show \"matchT_TMT (While tst c) (While tst d)\"\n     unfolding matchT_TMT_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t s' assume st: \"s \\<approx> t\" assume \"(While tst c, s) \\<rightarrow>t s'\"\n       thus \"\\<exists>t'. (While tst d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \"\n       apply - apply(erule While_transT_invert)\n       unfolding thetaWhileW0_def apply simp\n       by (metis WhileFalse compatTst_def st transT_MtransT tst)       \n     qed\n   qed\n  }\n  moreover \n  {fix tst c1 d1  c d\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>T d1\" and c_d: \"c \\<approx>T d\"\n   hence matchC_TMC1: \"matchC_TMC BisT c1 d1\" and matchC_TMC: \"matchC_TMC BisT c d\" \n     and matchT_TMT1: \"matchT_TMT c1 d1\" and matchT_TMT: \"matchT_TMT c d\"\n   using BisT_matchC_TMC BisT_matchT_TMT by auto\n   have \"(c1 ;; (While tst c), d1 ;; (While tst d)) \\<in> RetrT (thetaWhileW0 \\<union> BisT)\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC (thetaWhileW0 \\<union> BisT) (c1 ;; (While tst c)) (d1 ;; (While tst d))\"\n     unfolding matchC_TMC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume mt: \"mustT (c1 ;; While tst c) s\" \"mustT (d1 ;; While tst d) t\"\n       and st: \"s \\<approx> t\" \n       hence mt1: \"mustT c1 s\" \"mustT d1 t\"\n       by (metis mustT_Seq_L mustT_Seq_R)+     \n       assume 0: \"(c1 ;; (While tst c), s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (d1 ;; (While tst d), t) \\<rightarrow>*c (d', t') \\<and> \n                     s' \\<approx> t' \\<and> (c', d') \\<in> thetaWhileW0 \\<union> BisT\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; (While tst c)\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>T d'\" \n         using mt1 st matchC_TMC1 unfolding matchC_TMC_def by blast\n         thus ?thesis\n         unfolding c' thetaWhileW0_def\n         apply simp by (metis Seq_MtransC c_d tst)\n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = While tst c\"\n         then obtain t' where \"(d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using mt1 st matchT_TMT1 unfolding matchT_TMT_def by metis\n         thus ?thesis\n         unfolding c' thetaWhileW0_def \n         apply simp by (metis Seq_MtransT_MtransC c_d tst)\n       qed\n     qed\n   qed (unfold matchT_TMT_def, auto)\n  }\n  ultimately show ?thesis unfolding thetaWhileW0_def by auto\nqed\n\nlemma thetaWhileW0_BisT:\n\"thetaWhileW0 \\<subseteq> BisT\"\napply(rule BisT_coind)\nusing thetaWhileW0_sym thetaWhileW0_RetrT by auto\n\ntheorem While_BisT[simp]:\nassumes \"compatTst tst\" and \"c \\<approx>T d\"\nshows \"While tst c \\<approx>T While tst d\"\nusing assms thetaWhileW0_BisT unfolding thetaWhileW0_def by auto\n\ntext{* Parallel composition: *}\n\ndefinition thetaParTT where \n\"thetaParTT \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>T d1 \\<and> c2 \\<approx>T d2}\"\n\nlemma thetaParTT_sym:\n\"sym thetaParTT\"\nunfolding thetaParTT_def sym_def using BisT_Sym by blast\n\nlemma thetaParTT_RetrT:\n\"thetaParTT \\<subseteq> RetrT (thetaParTT \\<union> BisT)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>T d1\" and c2d2: \"c2 \\<approx>T d2\"\n   hence matchC_TMC1: \"matchC_TMC BisT c1 d1\" and matchC_TMC2: \"matchC_TMC BisT c2 d2\"\n     and matchT_TMT1: \"matchT_TMT c1 d1\" and matchT_TMT2: \"matchT_TMT c2 d2\"\n   using BisT_matchC_TMC BisT_matchT_TMT by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> RetrT (thetaParTT \\<union> BisT)\"\n   unfolding RetrT_def proof (clarify, intro conjI)\n     show \"matchC_TMC (thetaParTT \\<union> BisT) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_TMC_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume \"mustT (Par c1 c2) s\" and \"mustT (Par d1 d2) t\"\n       and st: \"s \\<approx> t\" \n       hence mt: \"mustT c1 s\" \"mustT c2 s\"\n                 \"mustT d1 t\" \"mustT d2 t\"\n       by (metis mustT_Par_L mustT_Par_R)+        \n       assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \"\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> \n                     (c', d') \\<in> thetaParTT \\<union> BisT\"\n       proof(elim Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \"\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>T d'\"\n         using mt st matchC_TMC1 unfolding matchC_TMC_def by blast\n         thus ?thesis unfolding c' thetaParTT_def\n         apply simp by (metis ParCL_MtransC c2d2) \n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using mt st matchT_TMT1 unfolding matchT_TMT_def by blast\n         thus ?thesis \n         unfolding c' thetaParTT_def\n         apply simp by (metis PL.ParTL_MtransC c2d2)\n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \"\\<exists>d' t'. (d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>T d'\"\n         using mt st matchC_TMC2 unfolding matchC_TMC_def by blast\n         thus ?thesis \n         unfolding c' thetaParTT_def\n         apply simp by (metis PL.ParCR_MtransC c1d1)\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"\\<exists>t'. (d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using mt st matchT_TMT2 unfolding matchT_TMT_def by blast\n         thus ?thesis \n         unfolding c' thetaParTT_def\n         apply simp by (metis PL.ParTR_MtransC c1d1)\n       qed\n     qed \n   qed (unfold matchT_TMT_def, auto)\n  }\n  thus ?thesis unfolding thetaParTT_def by auto\nqed\n\nlemma thetaParTT_BisT:\n\"thetaParTT \\<subseteq> BisT\"\napply(rule BisT_coind)\nusing thetaParTT_sym thetaParTT_RetrT by auto\n\ntheorem Par_BisT[simp]:\nassumes \"c1 \\<approx>T d1\" and \"c2 \\<approx>T d2\"\nshows \"Par c1 c2 \\<approx>T Par d1 d2\"\nusing assms thetaParTT_BisT unfolding thetaParTT_def by blast\n\n\nsubsubsection{* W-bisimilarity versus language constructs *}\n\ntext {* Atomic commands: *}\n\ntheorem Atm_Wbis[simp]:\nassumes \"compatAtm atm\" \nshows \"Atm atm \\<approx>w Atm atm\"\nby (metis Atm_Sbis assms bis_imp)\n\ntext{* Discreetness: *}\n\ntheorem discr_Wbis[simp]:\nassumes *: \"discr c\" and **: \"discr d\"\nshows \"c \\<approx>w d\"\nby (metis * ** bis_imp(4) discr_ZObis)\n\ntext{* Sequential composition:  *}\n\ndefinition thetaSeqW where \n\"thetaSeqW \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>wT d1 \\<and> c2 \\<approx>w d2}\"\n\nlemma thetaSeqW_sym:\n\"sym thetaSeqW\"\nunfolding thetaSeqW_def sym_def using WbisT_Sym Wbis_Sym by blast\n\nlemma thetaSeqW_Wretr:\n\"thetaSeqW \\<subseteq> Wretr (thetaSeqW \\<union> Wbis)\"\nproof- \n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>wT d1\" and c2d2: \"c2 \\<approx>w d2\"\n   hence matchC_MC1: \"matchC_MC WbisT c1 d1\" and matchC_W2: \"matchC_M Wbis c2 d2\"\n     and matchT_MT1: \"matchT_MT c1 d1\" and matchT_M2: \"matchT_M c2 d2\" \n   using WbisT_matchC_MC WbisT_matchT_MT Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> Wretr (thetaSeqW \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaSeqW \\<union> Wbis) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_M_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqW \\<union> Wbis) \\<or> \n        (\\<exists>t'. (d1 ;; d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence \"\\<exists>d1' t'. (d1, t) \\<rightarrow>*c (d1', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>wT d1'\"\n         using st matchC_MC1 unfolding matchC_MC_def by blast\n         thus ?thesis unfolding c' thetaSeqW_def\n         apply simp by (metis PL.Seq_MtransC c2d2)\n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t'\"\n         using st matchT_MT1 unfolding matchT_MT_def by auto\n         thus ?thesis \n         unfolding c' thetaSeqW_def\n         apply simp by (metis PL.Seq_MtransT_MtransC c2d2) \n       qed\n     qed \n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqW_def by auto\nqed\n\nlemma thetaSeqW_Wbis:\n\"thetaSeqW \\<subseteq> Wbis\"\napply(rule Wbis_coind)\nusing thetaSeqW_sym thetaSeqW_Wretr by auto\n\ntheorem Seq_WbisT_Wbis[simp]:\nassumes \"c1 \\<approx>wT d1\" and \"c2 \\<approx>w d2\"\nshows \"c1 ;; c2 \\<approx>w d1 ;; d2\"\nusing assms thetaSeqW_Wbis unfolding thetaSeqW_def by blast\n\ntheorem Seq_siso_Wbis[simp]:\nassumes \"siso e\" and \"c2 \\<approx>w d2\"\nshows \"e ;; c2 \\<approx>w e ;; d2\"\nusing assms by auto\n\n(*  *)\n\ndefinition thetaSeqWD where \n\"thetaSeqWD \\<equiv> \n {(c1 ;; c2, d1 ;; d2) | c1 c2 d1 d2. c1 \\<approx>w d1 \\<and> discr c2 \\<and> discr d2}\"\n\nlemma thetaSeqWD_sym:\n\"sym thetaSeqWD\"\nunfolding thetaSeqWD_def sym_def using Wbis_Sym by blast\n\nlemma thetaSeqWD_Wretr:\n\"thetaSeqWD \\<subseteq> Wretr (thetaSeqWD \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>w d1\" and c2: \"discr c2\" and d2: \"discr d2\"\n   hence matchC_M: \"matchC_M Wbis c1 d1\" \n     and matchT_M: \"matchT_M c1 d1\"\n   using Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(c1 ;; c2, d1 ;; d2) \\<in> Wretr (thetaSeqWD \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaSeqWD \\<union> Wbis) (c1 ;; c2) (d1 ;; d2)\"\n     unfolding matchC_M_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(c1 ;; c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(\\<exists>d' t'. (d1 ;; d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaSeqWD \\<union> Wbis) \\<or> \n        (\\<exists>t'. (d1 ;; d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Seq_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = c1' ;; c2\"\n         hence\n         \"(\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>w d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_M unfolding matchC_M_def by blast\n         thus ?thesis unfolding c' thetaSeqWD_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis PL.Seq_MtransC c2 d2)\n         apply simp by (metis PL.Seq_MtransT_MtransC c2 d2 discr_Seq discr_Wbis)\n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n         using st matchT_M unfolding matchT_M_def by blast\n         thus ?thesis \n         unfolding c' thetaSeqWD_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis PL.Seq_MtransC c2 d2 discr_Seq discr_Wbis)\n         apply simp by (metis PL.Seq_MtransT_MtransC c2 d2 discr_Wbis)\n       qed\n     qed \n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaSeqWD_def by auto\nqed\n\nlemma thetaSeqWD_Wbis:\n\"thetaSeqWD \\<subseteq> Wbis\"\napply(rule Wbis_coind)\nusing thetaSeqWD_sym thetaSeqWD_Wretr by auto\n\ntheorem Seq_Wbis_discr[simp]:\nassumes \"c1 \\<approx>w d1\" and \"discr c2\" and \"discr d2\"\nshows \"c1 ;; c2 \\<approx>w d1 ;; d2\"\nusing assms thetaSeqWD_Wbis unfolding thetaSeqWD_def by blast\n\ntext{* Conditional: *}\n\ndefinition thetaIfW where \n\"thetaIfW \\<equiv> \n {(If tst c1 c2, If tst d1 d2) | tst c1 c2 d1 d2. compatTst tst \\<and> c1 \\<approx>w d1 \\<and> c2 \\<approx>w d2}\"\n\nlemma thetaIfW_sym:\n\"sym thetaIfW\"\nunfolding thetaIfW_def sym_def using Wbis_Sym by blast\n\nlemma thetaIfW_Wretr:\n\"thetaIfW \\<subseteq> Wretr (thetaIfW \\<union> Wbis)\"\nproof-\n  {fix tst c1 c2 d1 d2\n   assume tst: \"compatTst tst\" and c1d1: \"c1 \\<approx>w d1\" and c2d2: \"c2 \\<approx>w d2\"\n   hence matchC_M1: \"matchC_M Wbis c1 d1\" and matchC_M2: \"matchC_M Wbis c2 d2\"\n     and matchT_M1: \"matchT_M c1 d1\" and matchT_M2: \"matchT_M c2 d2\"\n   using Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(If tst c1 c2, If tst d1 d2) \\<in> Wretr (thetaIfW \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaIfW \\<union> Wbis) (If tst c1 c2) (If tst d1 d2)\"\n     unfolding matchC_M_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(If tst c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(\\<exists>d' t'. (If tst d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaIfW \\<union> Wbis) \\<or> \n        (\\<exists>t'. (If tst d1 d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - apply(erule If_transC_invert)\n       unfolding thetaIfW_def \n       apply simp apply (metis IfTrue c1d1 compatTst_def st transC_MtransC tst)\n       apply simp by (metis IfFalse c2d2 compatTst_def st transC_MtransC tst)\n     qed\n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaIfW_def by auto\nqed\n\nlemma thetaIfW_Wbis:\n\"thetaIfW \\<subseteq> Wbis\"\napply(rule Wbis_coind)\nusing thetaIfW_sym thetaIfW_Wretr by auto\n\ntheorem If_Wbis[simp]:\nassumes \"compatTst tst\" and \"c1 \\<approx>w d1\" and \"c2 \\<approx>w d2\"\nshows \"If tst c1 c2 \\<approx>w If tst d1 d2\"\nusing assms thetaIfW_Wbis unfolding thetaIfW_def by blast\n\ntext{* While loop:  *}\n\ntext{* Again, w-bisimilarity does not interact with / preserve the While construct in \nany interesting way.*}\n\ntext{* Parallel composition:  *}\n\ndefinition thetaParWL1 where \n\"thetaParWL1 \\<equiv> \n {(Par c1 c2, d) | c1 c2 d. c1 \\<approx>w d \\<and> discr c2}\"\n\nlemma thetaParWL1_Wretr:\n\"thetaParWL1 \\<subseteq> Wretr (thetaParWL1 \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d\n   assume c1d: \"c1 \\<approx>w d\" and c2: \"discr c2\"\n   hence matchC_M: \"matchC_M Wbis c1 d\" \n     and matchT_M: \"matchT_M c1 d\" \n   using Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(Par c1 c2, d) \\<in> Wretr (thetaParWL1 \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaParWL1 \\<union> Wbis) (Par c1 c2) d\"\n     unfolding matchC_M_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus\n       \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParWL1 \\<union> Wbis) \\<or>\n        (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \n         \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>w d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_M unfolding matchC_M_def by blast\n         thus ?thesis unfolding thetaParWL1_def\n         apply - apply(elim disjE exE conjE) \n         apply simp apply (metis c2 c')\n         apply simp by (metis c' c2 discr_Par) \n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n         using st matchT_M unfolding matchT_M_def by blast\n         thus ?thesis unfolding thetaParWL1_def\n         apply - apply(elim disjE exE conjE)\n         apply simp apply (metis c' c2 discr_Wbis)\n         apply simp by (metis c' c2)  \n       next\n         fix c2' assume c2s: \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \"s \\<approx> s'\" using c2 discr_transC_indis by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         have \"discr c2'\" using c2 c2s discr_transC by blast\n         thus ?thesis using s't c1d unfolding thetaParWL1_def c' by auto\n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \"s \\<approx> s'\" using c2 discr_transT by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         thus ?thesis using c1d unfolding thetaParWL1_def c' by auto\n       qed\n     qed\n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaParWL1_def by blast\nqed\n\nlemma thetaParWL1_converse_Wretr:\n\"thetaParWL1 ^-1 \\<subseteq> Wretr (thetaParWL1 ^-1 \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d\n   assume c1d: \"c1 \\<approx>w d\" and c2: \"discr c2\"\n   hence matchC_M: \"matchC_M Wbis d c1\" \n     and matchT_M: \"matchT_M d c1\" \n   using Wbis_matchC_M_rev Wbis_matchT_M_rev by auto\n   have \"(d, Par c1 c2) \\<in> Wretr (thetaParWL1\\<inverse> \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaParWL1\\<inverse> \\<union> Wbis) d (Par c1 c2)\"\n     unfolding matchC_M_def2 Wbis_converse proof (tactic {* mauto_no_simp_tac *}) \n       fix s t d' t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>c (d', t')\"\n       hence \n       \"(\\<exists>c' s'. (c1, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> d' \\<approx>w c') \\<or> \n        (\\<exists>s'. (c1, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       using matchC_M unfolding matchC_M_def2 by blast\n       thus\n       \"(\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParWL1 \\<union> Wbis) \\<or>\n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       unfolding thetaParWL1_def \n       apply - apply(tactic {* mauto_no_simp_tac *})\n       apply simp apply (metis PL.ParCL_MtransC Wbis_Sym c2)\n       apply simp by (metis PL.ParTL_MtransC c2 discr_Wbis)\n     qed\n   next\n     show \"matchT_M d (Par c1 c2)\"\n     unfolding matchT_M_def2 Wbis_converse proof (tactic {* mauto_no_simp_tac *}) \n       fix s t t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>t t'\"\n       hence \n       \"(\\<exists>c' s'. (c1, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (c1, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t')\"\n       using matchT_M unfolding matchT_M_def2 by blast\n       thus\n       \"(\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t')\"\n       apply - apply(tactic {* mauto_no_simp_tac *})\n       apply (metis PL.ParCL_MtransC c2 discr_Par)\n       by (metis PL.ParTL_MtransC c2)  \n     qed\n   qed\n  }\n  thus ?thesis unfolding thetaParWL1_def by blast\nqed\n\nlemma thetaParWL1_Wbis:\n\"thetaParWL1 \\<subseteq> Wbis\"\napply(rule Wbis_coind2)\nusing thetaParWL1_Wretr thetaParWL1_converse_Wretr by auto\n\ntheorem Par_Wbis_discrL1[simp]:\nassumes \"c1 \\<approx>w d\" and \"discr c2\"\nshows \"Par c1 c2 \\<approx>w d\"\nusing assms thetaParWL1_Wbis unfolding thetaParWL1_def by blast\n\ntheorem Par_Wbis_discrR1[simp]:\nassumes \"c \\<approx>w d1\" and \"discr d2\"\nshows \"c \\<approx>w Par d1 d2\"\nusing assms Par_Wbis_discrL1 Wbis_Sym by blast\n\n(*  *)\n\ndefinition thetaParWL2 where \n\"thetaParWL2 \\<equiv> \n {(Par c1 c2, d) | c1 c2 d. discr c1 \\<and> c2 \\<approx>w d}\"\n\nlemma thetaParWL2_Wretr:\n\"thetaParWL2 \\<subseteq> Wretr (thetaParWL2 \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d\n   assume c2d: \"c2 \\<approx>w d\" and c1: \"discr c1\" \n   hence matchC_M: \"matchC_M Wbis c2 d\" \n     and matchT_M: \"matchT_M c2 d\" \n   using Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(Par c1 c2, d) \\<in> Wretr (thetaParWL2 \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaParWL2 \\<union> Wbis) (Par c1 c2) d\"\n     unfolding matchC_M_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus\n       \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParWL2 \\<union> Wbis) \\<or>\n        (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence \"s \\<approx> s'\" using c1 discr_transC_indis by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         have \"discr c1'\" using c1 c1s discr_transC by blast\n         thus ?thesis using s't c2d unfolding thetaParWL2_def c' by auto\n       next\n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \"s \\<approx> s'\" using c1 discr_transT by blast\n         hence s't: \"s' \\<approx> t\" using st indis_sym indis_trans by blast\n         thus ?thesis using c2d unfolding thetaParWL2_def c' by auto\n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \n         \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>w d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c2')\"\n         using st matchC_M unfolding matchC_M_def by blast\n         thus ?thesis unfolding thetaParWL2_def\n         apply - apply(elim disjE exE conjE) \n         apply simp apply (metis c1 c')\n         apply simp by (metis c' c1 discr_Par) \n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \n         \"(\\<exists>d' t'. (d, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n         using st matchT_M unfolding matchT_M_def by blast\n         thus ?thesis unfolding thetaParWL2_def\n         apply - apply(elim disjE exE conjE)\n         apply simp apply (metis c' c1 discr_Wbis)\n         apply simp by (metis c' c1)          \n       qed\n     qed\n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaParWL2_def by blast\nqed\n\nlemma thetaParWL2_converse_Wretr:\n\"thetaParWL2 ^-1 \\<subseteq> Wretr (thetaParWL2 ^-1 \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d\n   assume c2d: \"c2 \\<approx>w d\" and c1: \"discr c1\"\n   hence matchC_M: \"matchC_M Wbis d c2\" \n     and matchT_M: \"matchT_M d c2\" \n   using Wbis_matchC_M_rev Wbis_matchT_M_rev by auto\n   have \"(d, Par c1 c2) \\<in> Wretr (thetaParWL2\\<inverse> \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaParWL2\\<inverse> \\<union> Wbis) d (Par c1 c2)\"\n     unfolding matchC_M_def2 Wbis_converse proof (tactic {* mauto_no_simp_tac *}) \n       fix s t d' t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>c (d', t')\"\n       hence \n       \"(\\<exists>c' s'. (c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> d' \\<approx>w c') \\<or> \n        (\\<exists>s'. (c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       using matchC_M unfolding matchC_M_def2 by blast\n       thus\n       \"(\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParWL2 \\<union> Wbis) \\<or>\n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t' \\<and> discr d')\"\n       unfolding thetaParWL2_def \n       apply - apply(tactic {* mauto_no_simp_tac *})\n       apply simp apply (metis PL.ParCR_MtransC Wbis_Sym c1)\n       apply simp by (metis PL.ParTR_MtransC c1 discr_Wbis) \n     qed\n   next\n     show \"matchT_M d (Par c1 c2)\"\n     unfolding matchT_M_def2 Wbis_converse proof (tactic {* mauto_no_simp_tac *}) \n       fix s t t'\n       assume \"s \\<approx> t\" and \"(d, t) \\<rightarrow>t t'\"\n       hence \n       \"(\\<exists>c' s'. (c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t')\"\n       using matchT_M unfolding matchT_M_def2 by blast\n       thus\n       \"(\\<exists>c' s'. (Par c1 c2, s) \\<rightarrow>*c (c', s') \\<and> s' \\<approx> t' \\<and> discr c') \\<or> \n        (\\<exists>s'. (Par c1 c2, s) \\<rightarrow>*t s' \\<and> s' \\<approx> t')\"\n       apply - apply(tactic {* mauto_no_simp_tac *})\n       apply (metis PL.ParCR_MtransC c1 discr_Par)\n       by (metis PL.ParTR_MtransC c1)\n     qed\n   qed\n  }\n  thus ?thesis unfolding thetaParWL2_def by blast\nqed\n\nlemma thetaParWL2_Wbis:\n\"thetaParWL2 \\<subseteq> Wbis\"\napply(rule Wbis_coind2)\nusing thetaParWL2_Wretr thetaParWL2_converse_Wretr by auto\n\ntheorem Par_Wbis_discrL2[simp]:\nassumes \"c2 \\<approx>w d\" and \"discr c1\"\nshows \"Par c1 c2 \\<approx>w d\"\nusing assms thetaParWL2_Wbis unfolding thetaParWL2_def by blast\n\ntheorem Par_Wbis_discrR2[simp]:\nassumes \"c \\<approx>w d2\" and \"discr d1\"\nshows \"c \\<approx>w Par d1 d2\"\nusing assms Par_Wbis_discrL2 Wbis_Sym by blast\n\n(*  *)\n\ndefinition thetaParW where \n\"thetaParW \\<equiv> \n {(Par c1 c2, Par d1 d2) | c1 c2 d1 d2. c1 \\<approx>w d1 \\<and> c2 \\<approx>w d2}\"\n\nlemma thetaParW_sym:\n\"sym thetaParW\"\nunfolding thetaParW_def sym_def using Wbis_Sym by blast\n\nlemma thetaParW_Wretr:\n\"thetaParW \\<subseteq> Wretr (thetaParW \\<union> Wbis)\"\nproof-\n  {fix c1 c2 d1 d2\n   assume c1d1: \"c1 \\<approx>w d1\" and c2d2: \"c2 \\<approx>w d2\"\n   hence matchC_M1: \"matchC_M Wbis c1 d1\" and matchC_M2: \"matchC_M Wbis c2 d2\"\n     and matchT_M1: \"matchT_M c1 d1\" and matchT_M2: \"matchT_M c2 d2\"\n   using Wbis_matchC_M Wbis_matchT_M by auto\n   have \"(Par c1 c2, Par d1 d2) \\<in> Wretr (thetaParW \\<union> Wbis)\"\n   unfolding Wretr_def proof (clarify, intro conjI)\n     show \"matchC_M (thetaParW \\<union> Wbis) (Par c1 c2) (Par d1 d2)\"\n     unfolding matchC_M_def proof (tactic {* mauto_no_simp_tac *})\n       fix s t c' s'\n       assume st: \"s \\<approx> t\" assume \"(Par c1 c2, s) \\<rightarrow>c (c', s')\"\n       thus \n       \"(\\<exists>d' t'. (Par d1 d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> (c', d') \\<in> thetaParW \\<union> Wbis) \\<or> \n        (\\<exists>t'. (Par d1 d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c')\"\n       apply - proof(erule Par_transC_invert)\n         fix c1' assume c1s: \"(c1, s) \\<rightarrow>c (c1', s')\" and c': \"c' = Par c1' c2\"\n         hence\n         \"(\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c1' \\<approx>w d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c1')\"\n         using st matchC_M1 unfolding matchC_M_def by blast\n         thus ?thesis unfolding c' thetaParW_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis PL.ParCL_MtransC c2d2) \n         apply simp by (metis PL.ParTL_MtransC Par_Wbis_discrL2 c2d2)\n       next      \n         assume \"(c1, s) \\<rightarrow>t s'\" and c': \"c' = c2\"\n         hence \n         \"(\\<exists>d' t'. (d1, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d1, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n         using st matchT_M1 unfolding matchT_M_def by blast\n         thus ?thesis \n         unfolding c' thetaParW_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis PL.ParCL_MtransC Par_Wbis_discrR2 c2d2)\n         apply simp by (metis PL.ParTL_MtransC c2d2) \n       next\n         fix c2' assume \"(c2, s) \\<rightarrow>c (c2', s')\" and c': \"c' = Par c1 c2'\"\n         hence \n         \"(\\<exists>d' t'. (d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> c2' \\<approx>w d') \\<or> \n          (\\<exists>t'. (d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t' \\<and> discr c2')\"\n         using st matchC_M2 unfolding matchC_M_def by blast\n         thus ?thesis \n         unfolding c' thetaParW_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis PL.ParCR_MtransC c1d1)\n         apply simp by (metis PL.ParTR_MtransC Par_Wbis_discrL1 c1d1) \n       next\n         assume \"(c2, s) \\<rightarrow>t s'\" and c': \"c' = c1\"\n         hence \n         \"(\\<exists>d' t'. (d2, t) \\<rightarrow>*c (d', t') \\<and> s' \\<approx> t' \\<and> discr d') \\<or> \n          (\\<exists>t'. (d2, t) \\<rightarrow>*t t' \\<and> s' \\<approx> t')\"\n         using st matchT_M2 unfolding matchT_M_def by blast\n         thus ?thesis \n         unfolding c' thetaParW_def\n         apply - apply(tactic {* mauto_no_simp_tac *})\n         apply simp apply (metis PL.ParCR_MtransC Par_Wbis_discrR1 c1d1) \n         apply simp by (metis PL.ParTR_MtransC c1d1)\n       qed\n     qed \n   qed (unfold matchT_M_def, auto)\n  }\n  thus ?thesis unfolding thetaParW_def by auto\nqed\n\nlemma thetaParW_Wbis:\n\"thetaParW \\<subseteq> Wbis\"\napply(rule Wbis_coind)\nusing thetaParW_sym thetaParW_Wretr by auto\n\ntheorem Par_Wbis[simp]:\nassumes \"c1 \\<approx>w d1\" and \"c2 \\<approx>w d2\"\nshows \"Par c1 c2 \\<approx>w Par d1 d2\"\nusing assms thetaParW_Wbis unfolding thetaParW_def by blast\n\nend (* context PL_Indis *)\n(*******************************************)\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Possibilistic_Noninterference/Compositionality.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.30714101737661853}}
{"text": "header {* \\isaheader{Instantiate CFG locale with While CFG} *}\n\ntheory Interpretation imports \n  WCFG \n  \"../Basic/CFGExit\" \nbegin\n\nsubsection {* Instatiation of the @{text CFG} locale *}\n\nabbreviation sourcenode :: \"w_edge \\<Rightarrow> w_node\"\n  where \"sourcenode e \\<equiv> fst e\"\n\nabbreviation targetnode :: \"w_edge \\<Rightarrow> w_node\"\n  where \"targetnode e \\<equiv> snd(snd e)\"\n\nabbreviation kind :: \"w_edge \\<Rightarrow> state edge_kind\"\n  where \"kind e \\<equiv> fst(snd e)\"\n\n\ndefinition valid_edge :: \"cmd \\<Rightarrow> w_edge \\<Rightarrow> bool\"\n  where \"valid_edge prog a \\<equiv> prog \\<turnstile> sourcenode a -kind a\\<rightarrow> targetnode a\"\n\ndefinition valid_node ::\"cmd \\<Rightarrow> w_node \\<Rightarrow> bool\"\n  where \"valid_node prog n \\<equiv> \n    (\\<exists>a. valid_edge prog a \\<and> (n = sourcenode a \\<or> n = targetnode a))\"\n\n\nlemma While_CFG_aux:\n  \"CFG sourcenode targetnode (valid_edge prog) Entry\"\nproof(unfold_locales)\n  fix a assume \"valid_edge prog a\" and \"targetnode a = (_Entry_)\"\n  obtain nx et nx' where \"a = (nx,et,nx')\" by (cases a) auto\n  with `valid_edge prog a` `targetnode a = (_Entry_)` \n  have \"prog \\<turnstile> nx -et\\<rightarrow> (_Entry_)\" by(simp add:valid_edge_def)\n  thus False by fastforce\nnext\n  fix a a'\n  assume assms:\"valid_edge prog a\" \"valid_edge prog a'\"\n    \"sourcenode a = sourcenode a'\" \"targetnode a = targetnode a'\"\n  obtain x et y where [simp]:\"a = (x,et,y)\" by (cases a) auto\n  obtain x' et' y' where [simp]:\"a' = (x',et',y')\" by (cases a') auto\n  from assms have \"et = et'\"\n    by(fastforce intro:WCFG_edge_det simp:valid_edge_def)\n  with `sourcenode a = sourcenode a'` `targetnode a = targetnode a'`\n  show \"a = a'\" by simp\nqed\n\ninterpretation While_CFG:\n  CFG sourcenode targetnode kind \"valid_edge prog\" Entry\n  for prog\n  by(rule While_CFG_aux)\n\n\nlemma While_CFGExit_aux:\n  \"CFGExit sourcenode targetnode kind (valid_edge prog) Entry Exit\"\nproof(unfold_locales)\n  fix a assume \"valid_edge prog a\" and \"sourcenode a = (_Exit_)\"\n  obtain nx et nx' where \"a = (nx,et,nx')\" by (cases a) auto\n  with `valid_edge prog a` `sourcenode a = (_Exit_)` \n  have \"prog \\<turnstile> (_Exit_) -et\\<rightarrow> nx'\" by(simp add:valid_edge_def)\n  thus False by fastforce\nnext\n  have \"prog \\<turnstile> (_Entry_) -(\\<lambda>s. False)\\<^sub>\\<surd>\\<rightarrow> (_Exit_)\" by(rule WCFG_Entry_Exit)\n  thus \"\\<exists>a. valid_edge prog a \\<and> sourcenode a = (_Entry_) \\<and>\n            targetnode a = (_Exit_) \\<and> kind a = (\\<lambda>s. False)\\<^sub>\\<surd>\"\n    by(fastforce simp:valid_edge_def)\nqed\n\ninterpretation While_CFGExit:\n  CFGExit sourcenode targetnode kind \"valid_edge prog\" Entry Exit\n  for prog\nby(rule While_CFGExit_aux)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Slicing/While/Interpretation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6001883735630721, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.3071263567026105}}
{"text": "(* Copyright 2021 (C) Mihails Milehins *)\n\nsection\\<open>Equalizers and coequalizers as limits and colimits\\<close>\ntheory CZH_UCAT_Limit_Equalizer\n  imports \n    CZH_UCAT_Limit\n    CZH_Elementary_Categories.CZH_ECAT_Parallel\nbegin\n\n\n\nsubsection\\<open>Equalizer and coequalizer\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\n\ntext\\<open>\nSee \\<^cite>\\<open>\"noauthor_wikipedia_2001\"\\<close>\\footnote{\n\\url{https://en.wikipedia.org/wiki/Equaliser_(mathematics)}\n}.\n\\<close>\n\nlocale is_cat_equalizer =\n  is_cat_limit \\<alpha> \\<open>\\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F\\<close> \\<CC> \\<open>\\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<aa> \\<bb> F'\\<close> E \\<epsilon> +\n  F': vsv F'\n  for \\<alpha> \\<aa> \\<bb> F F' \\<CC> E \\<epsilon> +\n  assumes cat_eq_F_in_Vset[cat_lim_cs_intros]: \"F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and cat_eq_F_ne[cat_lim_cs_intros]: \"F \\<noteq> 0\"\n    and cat_eq_F'_vdomain[cat_lim_cs_simps]: \"\\<D>\\<^sub>\\<circ> F' = F\"\n    and cat_eq_F'_app_is_arr[cat_lim_cs_intros]: \"\\<ff> \\<in>\\<^sub>\\<circ> F \\<Longrightarrow> F'\\<lparr>\\<ff>\\<rparr> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n\nsyntax \"_is_cat_equalizer\" :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> bool\"\n  (\\<open>(_ :/ _ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q '(_,_,_,_') :/ \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<index> _)\\<close> [51, 51, 51, 51, 51, 51] 51)\ntranslations \"\\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,F,F') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \\<rightleftharpoons> \n  \"CONST is_cat_equalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E \\<epsilon>\"\n\nlocale is_cat_coequalizer =\n  is_cat_colimit \\<alpha> \\<open>\\<Up>\\<^sub>C (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F\\<close> \\<CC> \\<open>\\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<bb> \\<aa> F'\\<close> E \\<epsilon> +\n  F': vsv F'\n  for \\<alpha> \\<aa> \\<bb> F F' \\<CC> E \\<epsilon> +\n  assumes cat_coeq_F_in_Vset[cat_lim_cs_intros]: \"F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    and cat_coeq_F_ne[cat_lim_cs_intros]: \"F \\<noteq> 0\"\n    and cat_coeq_F'_vdomain[cat_lim_cs_simps]: \"\\<D>\\<^sub>\\<circ> F' = F\"\n    and cat_coeq_F'_app_is_arr[cat_lim_cs_intros]: \"\\<ff> \\<in>\\<^sub>\\<circ> F \\<Longrightarrow> F'\\<lparr>\\<ff>\\<rparr> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n\nsyntax \"_is_cat_coequalizer\" :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> bool\"\n  (\\<open>(_ :/ '(_,_,_,_') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q _ :/ \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<index> _)\\<close> [51, 51, 51, 51, 51, 51] 51)\ntranslations \"\\<epsilon> : (\\<aa>,\\<bb>,F,F') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \\<rightleftharpoons> \n  \"CONST is_cat_coequalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E \\<epsilon>\"\n\n\ntext\\<open>Rules.\\<close>\n\nlemma (in is_cat_equalizer) is_cat_equalizer_axioms'[cat_lim_cs_intros]:\n  assumes \"\\<alpha>' = \\<alpha>\"\n    and \"E' = E\"\n    and \"\\<aa>' = \\<aa>\"\n    and \"\\<bb>' = \\<bb>\"\n    and \"F'' = F\"\n    and \"F''' = F'\"\n    and \"\\<CC>' = \\<CC>\"\n  shows \"\\<epsilon> : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>',\\<bb>',F'',F''') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>'\\<^esub> \\<CC>'\"\n  unfolding assms by (rule is_cat_equalizer_axioms)\n\nmk_ide rf is_cat_equalizer_def[unfolded is_cat_equalizer_axioms_def]\n  |intro is_cat_equalizerI|\n  |dest is_cat_equalizerD[dest]|\n  |elim is_cat_equalizerE[elim]|\n\nlemmas [cat_lim_cs_intros] = is_cat_equalizerD(1)\n\nlemma (in is_cat_coequalizer) is_cat_coequalizer_axioms'[cat_lim_cs_intros]:\n  assumes \"\\<alpha>' = \\<alpha>\"\n    and \"E' = E\"\n    and \"\\<aa>' = \\<aa>\"\n    and \"\\<bb>' = \\<bb>\"\n    and \"F'' = F\"\n    and \"F''' = F'\"\n    and \"\\<CC>' = \\<CC>\"\n  shows \"\\<epsilon> : (\\<aa>',\\<bb>',F'',F''') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E' : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>'\\<^esub> \\<CC>'\"\n  unfolding assms by (rule is_cat_coequalizer_axioms)\n\nmk_ide rf is_cat_coequalizer_def[unfolded is_cat_coequalizer_axioms_def]\n  |intro is_cat_coequalizerI|\n  |dest is_cat_coequalizerD[dest]|\n  |elim is_cat_coequalizerE[elim]|\n\nlemmas [cat_lim_cs_intros] = is_cat_coequalizerD(1)\n\n\ntext\\<open>Elementary properties.\\<close>\n\nlemma (in is_cat_equalizer) \n  cat_eq_\\<aa>[cat_lim_cs_intros]: \"\\<aa> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n  and cat_eq_\\<bb>[cat_lim_cs_intros]: \"\\<bb> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\nproof-\n  from cat_eq_F_ne obtain \\<ff> where \\<ff>: \"\\<ff> \\<in>\\<^sub>\\<circ> F\" by force\n  have \"F'\\<lparr>\\<ff>\\<rparr> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\" by (rule cat_eq_F'_app_is_arr[OF \\<ff>])\n  then show \"\\<aa> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" \"\\<bb> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\nqed\n\nlemma (in is_cat_coequalizer) \n  cat_coeq_\\<aa>[cat_lim_cs_intros]: \"\\<aa> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n  and cat_coeq_\\<bb>[cat_lim_cs_intros]: \"\\<bb> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\nproof-\n  from cat_coeq_F_ne obtain \\<ff> where \\<ff>: \"\\<ff> \\<in>\\<^sub>\\<circ> F\" by force\n  have \"F'\\<lparr>\\<ff>\\<rparr> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\" by (rule cat_coeq_F'_app_is_arr[OF \\<ff>])\n  then show \"\\<aa> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" \"\\<bb> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\nqed\n\nsublocale is_cat_equalizer \\<subseteq> cf_parallel \\<alpha> \\<open>\\<aa>\\<^sub>P\\<^sub>L F\\<close> \\<open>\\<bb>\\<^sub>P\\<^sub>L F\\<close> F \\<aa> \\<bb> F' \\<CC>\n  by (intro cf_parallelI cat_parallelI)\n    (\n      auto simp:\n        cat_lim_cs_simps cat_parallel_cs_intros cat_lim_cs_intros cat_cs_intros\n    )\n\nsublocale is_cat_coequalizer \\<subseteq> cf_parallel \\<alpha> \\<open>\\<bb>\\<^sub>P\\<^sub>L F\\<close> \\<open>\\<aa>\\<^sub>P\\<^sub>L F\\<close> F \\<bb> \\<aa> F' \\<CC>\n  by (intro cf_parallelI cat_parallelI)\n    (\n      auto simp:\n        cat_lim_cs_simps cat_parallel_cs_intros cat_lim_cs_intros cat_cs_intros\n    )\n\n\ntext\\<open>Duality.\\<close>\n\nlemma (in is_cat_equalizer) is_cat_coequalizer_op:\n  \"op_ntcf \\<epsilon> : (\\<aa>,\\<bb>,F,F') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<CC>\"\n  by (intro is_cat_coequalizerI)\n    (\n      cs_concl \n        cs_simp: cat_lim_cs_simps cat_op_simps \n        cs_intro: V_cs_intros cat_op_intros cat_lim_cs_intros\n    )+\n\nlemma (in is_cat_equalizer) is_cat_coequalizer_op'[cat_op_intros]:\n  assumes \"\\<CC>' = op_cat \\<CC>\"\n  shows \"op_ntcf \\<epsilon> : (\\<aa>,\\<bb>,F,F') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>'\"\n  unfolding assms by (rule is_cat_coequalizer_op)\n\nlemmas [cat_op_intros] = is_cat_equalizer.is_cat_coequalizer_op'\n\nlemma (in is_cat_coequalizer) is_cat_equalizer_op:\n  \"op_ntcf \\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,F,F') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<CC>\"\n  by (intro is_cat_equalizerI)\n    (\n      cs_concl \n        cs_simp: cat_lim_cs_simps cat_op_simps\n        cs_intro: V_cs_intros cat_op_intros cat_lim_cs_intros\n    )+\n\nlemma (in is_cat_coequalizer) is_cat_equalizer_op'[cat_op_intros]:\n  assumes \"\\<CC>' = op_cat \\<CC>\"\n  shows \"op_ntcf \\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,F,F') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>'\"\n  unfolding assms by (rule is_cat_equalizer_op)\n\nlemmas [cat_op_intros] = is_cat_coequalizer.is_cat_equalizer_op'\n\n\ntext\\<open>Further properties.\\<close>\n\nlemma (in category) cat_cf_parallel_\\<aa>\\<bb>:\n  assumes \"vsv F'\"\n    and \"F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    and \"\\<D>\\<^sub>\\<circ> F' = F\"\n    and \"\\<And>\\<ff>. \\<ff> \\<in>\\<^sub>\\<circ> F \\<Longrightarrow> F'\\<lparr>\\<ff>\\<rparr> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n    and \"\\<aa> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    and \"\\<bb> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n  shows \"cf_parallel \\<alpha> (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<aa> \\<bb> F' \\<CC>\"\nproof-\n  have \"\\<aa>\\<^sub>P\\<^sub>L F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \"\\<bb>\\<^sub>P\\<^sub>L F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    by (simp_all add: Axiom_of_Pairing \\<bb>\\<^sub>P\\<^sub>L_def \\<aa>\\<^sub>P\\<^sub>L_def assms(2))\n  then show ?thesis\n    by (intro cf_parallelI cat_parallelI)\n      (simp_all add: assms cat_parallel_cs_intros cat_cs_intros)\nqed\n\nlemma (in category) cat_cf_parallel_\\<bb>\\<aa>:\n  assumes \"vsv F'\"\n    and \"F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    and \"\\<D>\\<^sub>\\<circ> F' = F\"\n    and \"\\<And>\\<ff>. \\<ff> \\<in>\\<^sub>\\<circ> F \\<Longrightarrow> F'\\<lparr>\\<ff>\\<rparr> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n    and \"\\<aa> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n    and \"\\<bb> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\"\n  shows \"cf_parallel \\<alpha> (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<bb> \\<aa> F' \\<CC>\"\nproof-\n  have \"\\<aa>\\<^sub>P\\<^sub>L F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \"\\<bb>\\<^sub>P\\<^sub>L F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    by (simp_all add: Axiom_of_Pairing \\<bb>\\<^sub>P\\<^sub>L_def \\<aa>\\<^sub>P\\<^sub>L_def assms(2))\n  then show ?thesis\n    by (intro cf_parallelI cat_parallelI)\n      (simp_all add: assms cat_parallel_cs_intros cat_cs_intros)\nqed\n\nlemma cat_cone_cf_par_eps_NTMap_app:\n  assumes \"\\<epsilon> :\n    E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<aa> \\<bb> F' :\n    \\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"vsv F'\"\n    and \"F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    and \"\\<D>\\<^sub>\\<circ> F' = F\"\n    and \"\\<And>\\<ff>. \\<ff> \\<in>\\<^sub>\\<circ> F \\<Longrightarrow> F'\\<lparr>\\<ff>\\<rparr> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n    and \"\\<ff> \\<in>\\<^sub>\\<circ> F\"\n  shows \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr> = F'\\<lparr>\\<ff>\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\" \nproof-\n  let ?II = \\<open>\\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F\\<close> \n    and ?II_II = \\<open>\\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<aa> \\<bb> F'\\<close>\n  interpret \\<epsilon>: is_cat_cone \\<alpha> E ?II \\<CC> ?II_II \\<epsilon> by (rule assms(1))\n  from assms(5,6) have \\<aa>: \"\\<aa> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" and \\<bb>: \"\\<bb> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\n  interpret par: cf_parallel \\<alpha> \\<open>\\<aa>\\<^sub>P\\<^sub>L F\\<close> \\<open>\\<bb>\\<^sub>P\\<^sub>L F\\<close> F \\<aa> \\<bb> F' \\<CC> \n    by (intro \\<epsilon>.NTDom.HomCod.cat_cf_parallel_\\<aa>\\<bb> assms \\<aa> \\<bb>)\n  from assms(6) have \\<ff>: \"\\<ff> : \\<aa>\\<^sub>P\\<^sub>L F \\<mapsto>\\<^bsub>\\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F\\<^esub> \\<bb>\\<^sub>P\\<^sub>L F\" \n    by (simp_all add: par.the_cat_parallel_is_arr_\\<aa>\\<bb>F)\n  note \\<epsilon>.cat_cone_Comp_commute[cat_cs_simps del]\n  from \\<epsilon>.ntcf_Comp_commute[OF \\<ff>] assms(6) show ?thesis\n    by\n      (\n        cs_prems \n          cs_simp: cat_parallel_cs_simps cat_cs_simps\n          cs_intro: cat_cs_intros cat_parallel_cs_intros\n      )\nqed\n\nlemma cat_cocone_cf_par_eps_NTMap_app:\n  assumes \"\\<epsilon> :\n    \\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<bb> \\<aa> F' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e E :\n    \\<Up>\\<^sub>C (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"vsv F'\"\n    and \"F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    and \"\\<D>\\<^sub>\\<circ> F' = F\"\n    and \"\\<And>\\<ff>. \\<ff> \\<in>\\<^sub>\\<circ> F \\<Longrightarrow> F'\\<lparr>\\<ff>\\<rparr> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n    and \"\\<ff> \\<in>\\<^sub>\\<circ> F\"\n  shows \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> F'\\<lparr>\\<ff>\\<rparr>\"\nproof-\n  let ?II = \\<open>\\<Up>\\<^sub>C (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F\\<close> \n    and ?II_II = \\<open>\\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<bb> \\<aa> F'\\<close>\n  interpret \\<epsilon>: is_cat_cocone \\<alpha> E ?II \\<CC> ?II_II \\<epsilon> by (rule assms(1))\n  from assms(5,6) \n  have \\<aa>: \"\\<aa> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" and \\<bb>: \"\\<bb> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" and F'\\<ff>: \"F'\\<lparr>\\<ff>\\<rparr> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\" \n    by auto\n  interpret par: cf_parallel \\<alpha> \\<open>\\<bb>\\<^sub>P\\<^sub>L F\\<close> \\<open>\\<aa>\\<^sub>P\\<^sub>L F\\<close> F \\<bb> \\<aa> F' \\<CC>\n    by (intro \\<epsilon>.NTDom.HomCod.cat_cf_parallel_\\<bb>\\<aa> assms \\<aa> \\<bb>)\n  note \\<epsilon>_NTMap_app = \n    cat_cone_cf_par_eps_NTMap_app[\n      OF \\<epsilon>.is_cat_cone_op[unfolded cat_op_simps],\n      unfolded cat_op_simps,  \n      OF assms(2-6),\n      simplified\n      ]\n  from \\<epsilon>_NTMap_app F'\\<ff> show ?thesis\n    by\n      (\n        cs_concl cs_shallow\n          cs_simp: cat_parallel_cs_simps category.op_cat_Comp[symmetric] \n          cs_intro: cat_cs_intros cat_parallel_cs_intros\n      )\nqed\n\nlemma (in is_cat_equalizer) cat_eq_eps_NTMap_app:\n  assumes \"\\<ff> \\<in>\\<^sub>\\<circ> F\"\n  shows \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr> = F'\\<lparr>\\<ff>\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\" \n  by \n    (\n      intro cat_cone_cf_par_eps_NTMap_app[\n        OF \n          is_cat_cone_axioms \n          F'.vsv_axioms \n          cat_eq_F_in_Vset \n          cat_eq_F'_vdomain\n          cat_eq_F'_app_is_arr\n          assms\n        ]\n    )+\n\nlemma (in is_cat_coequalizer) cat_coeq_eps_NTMap_app:\n  assumes \"\\<ff> \\<in>\\<^sub>\\<circ> F\"\n  shows \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> F'\\<lparr>\\<ff>\\<rparr>\" \n  by \n    (\n      intro cat_cocone_cf_par_eps_NTMap_app[\n        OF is_cat_cocone_axioms\n          F'.vsv_axioms \n          cat_coeq_F_in_Vset \n          cat_coeq_F'_vdomain\n          cat_coeq_F'_app_is_arr\n          assms\n        ]\n    )+\n\nlemma (in is_cat_equalizer) cat_eq_Comp_eq: \n  assumes \"\\<gg> \\<in>\\<^sub>\\<circ> F\" and \"\\<ff> \\<in>\\<^sub>\\<circ> F\"\n  shows \"F'\\<lparr>\\<gg>\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = F'\\<lparr>\\<ff>\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\"\n  using cat_eq_eps_NTMap_app[OF assms(1)] cat_eq_eps_NTMap_app[OF assms(2)]\n  by auto\n\nlemma (in is_cat_coequalizer) cat_coeq_Comp_eq: \n  assumes \"\\<gg> \\<in>\\<^sub>\\<circ> F\" and \"\\<ff> \\<in>\\<^sub>\\<circ> F\"\n  shows \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> F'\\<lparr>\\<gg>\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> F'\\<lparr>\\<ff>\\<rparr>\"\n  using cat_coeq_eps_NTMap_app[OF assms(1)] cat_coeq_eps_NTMap_app[OF assms(2)]\n  by auto\n\n\nsubsubsection\\<open>Universal property\\<close>\n\nlemma is_cat_equalizerI':\n  assumes \"\\<epsilon> :\n    E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<aa> \\<bb> F' :\n    \\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"vsv F'\"\n    and \"F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    and \"\\<D>\\<^sub>\\<circ> F' = F\"\n    and \"\\<And>\\<ff>. \\<ff> \\<in>\\<^sub>\\<circ> F \\<Longrightarrow> F'\\<lparr>\\<ff>\\<rparr> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n    and \"\\<ff> \\<in>\\<^sub>\\<circ> F\" \n    and \"\\<And>\\<epsilon>' E'. \\<epsilon>' :\n      E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<aa> \\<bb> F' :\n      \\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC> \\<Longrightarrow>\n      \\<exists>!f'. f' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'\"\n  shows \"\\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,F,F') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof-\n\n  let ?II = \\<open>\\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F\\<close> \n    and ?II_II = \\<open>\\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<aa> \\<bb> F'\\<close>\n  interpret \\<epsilon>: is_cat_cone \\<alpha> E ?II \\<CC> ?II_II \\<epsilon> by (rule assms(1))\n  from assms(5,6) have \\<aa>: \"\\<aa> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" and \\<bb>: \"\\<bb> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\n  interpret par: cf_parallel \\<alpha> \\<open>\\<aa>\\<^sub>P\\<^sub>L F\\<close> \\<open>\\<bb>\\<^sub>P\\<^sub>L F\\<close> F \\<aa> \\<bb> F' \\<CC>\n    by (intro \\<epsilon>.NTDom.HomCod.cat_cf_parallel_\\<aa>\\<bb> assms \\<aa> \\<bb>) simp\n  \n  show ?thesis\n  proof(intro is_cat_equalizerI is_cat_limitI assms(1-3))\n    fix u' r' assume prems: \"u' : r' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e ?II_II : ?II \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    interpret u': is_cat_cone \\<alpha> r' ?II \\<CC> ?II_II u' by (rule prems)\n    from assms(7)[OF prems] obtain f'\n      where f': \"f' : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E\"\n        and u'_NTMap_app_\\<aa>: \"u'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'\"\n        and unique_f': \n          \"\\<And>f''.\n            \\<lbrakk>\n              f'' : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E; \n              u'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f''\n            \\<rbrakk> \\<Longrightarrow> f'' = f'\"\n      by metis\n    show \"\\<exists>!f'. f' : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E \\<and> u' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f'\"\n    proof(intro ex1I conjI; (elim conjE)?)\n      show \"u' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f'\"\n      proof(rule ntcf_eqI)\n        show \"u' : cf_const ?II \\<CC> r' \\<mapsto>\\<^sub>C\\<^sub>F ?II_II : ?II \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n          by (rule u'.is_ntcf_axioms)\n        from f' show \"\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f' :\n          cf_const ?II \\<CC> r' \\<mapsto>\\<^sub>C\\<^sub>F ?II_II : ?II \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n          by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros )\n        have dom_lhs: \"\\<D>\\<^sub>\\<circ> (u'\\<lparr>NTMap\\<rparr>) = ?II\\<lparr>Obj\\<rparr>\"\n          unfolding cat_cs_simps by simp\n        from f' have dom_rhs:\n          \"\\<D>\\<^sub>\\<circ> ((\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f')\\<lparr>NTMap\\<rparr>) = ?II\\<lparr>Obj\\<rparr>\"\n          by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n        show \"u'\\<lparr>NTMap\\<rparr> = (\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f')\\<lparr>NTMap\\<rparr>\"\n        proof(rule vsv_eqI, unfold dom_lhs dom_rhs)\n          fix a assume prems': \"a \\<in>\\<^sub>\\<circ> ?II\\<lparr>Obj\\<rparr>\"\n          note [cat_parallel_cs_simps] = \n            cat_cone_cf_par_eps_NTMap_app[\n              OF u'.is_cat_cone_axioms assms(2-5), simplified\n              ]\n            cat_cone_cf_par_eps_NTMap_app[OF assms(1-5), simplified]\n            u'_NTMap_app_\\<aa>\n          from prems' f' assms(6) show \n            \"u'\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr> = (\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f')\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr>\"\n            by (elim the_cat_parallel_ObjE; simp only:)\n              (\n                cs_concl \n                  cs_simp: cat_parallel_cs_simps cat_cs_simps\n                  cs_intro: cat_cs_intros cat_parallel_cs_intros\n              )\n        qed (cs_concl cs_intro: V_cs_intros cat_cs_intros)+\n      qed simp_all\n      fix f'' assume prems'': \n        \"f'' : r' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E\" \"u' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f''\"\n      from prems''(2) have u'_NTMap_a:\n        \"u'\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr> = (\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f'')\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr>\"\n        for a \n        by simp\n      have \"u'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f''\"  \n        using u'_NTMap_a[of \\<open>\\<aa>\\<^sub>P\\<^sub>L F\\<close>] prems''(1) \n        by \n          (\n            cs_prems \n              cs_simp: cat_parallel_cs_simps cat_cs_simps \n              cs_intro: cat_parallel_cs_intros cat_cs_intros\n          )\n      from unique_f'[OF prems''(1) this] show \"f'' = f'\".\n    qed (rule f')\n  qed (use assms in fastforce)+\n\nqed\n\nlemma is_cat_coequalizerI':\n  assumes \"\\<epsilon> :\n    \\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<bb> \\<aa> F' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e E : \n    \\<Up>\\<^sub>C (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"vsv F'\"\n    and \"F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\" \n    and \"\\<D>\\<^sub>\\<circ> F' = F\"\n    and \"\\<And>\\<ff>. \\<ff> \\<in>\\<^sub>\\<circ> F \\<Longrightarrow> F'\\<lparr>\\<ff>\\<rparr> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n    and \"\\<ff> \\<in>\\<^sub>\\<circ> F\" \n    and \"\\<And>\\<epsilon>' E'. \\<epsilon>' :\n      \\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<bb> \\<aa> F' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e E' : \n      \\<Up>\\<^sub>C (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC> \\<Longrightarrow>\n      \\<exists>!f'. f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\"\n  shows \"\\<epsilon> : (\\<aa>,\\<bb>,F,F') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof-\n\n  let ?op_II = \\<open>\\<Up>\\<^sub>C (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F\\<close> \n    and ?op_II_II = \\<open>\\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<bb> \\<aa> F'\\<close>\n    and ?II = \\<open>\\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F\\<close>\n    and ?II_II = \\<open>\\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F (op_cat \\<CC>) (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<aa> \\<bb> F'\\<close>\n  interpret \\<epsilon>: is_cat_cocone \\<alpha> E ?op_II \\<CC> ?op_II_II \\<epsilon> by (rule assms(1))\n  from assms(5,6) have \\<aa>: \"\\<aa> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" and \\<bb>: \"\\<bb> \\<in>\\<^sub>\\<circ> \\<CC>\\<lparr>Obj\\<rparr>\" by auto\n  interpret par: cf_parallel \\<alpha> \\<open>\\<bb>\\<^sub>P\\<^sub>L F\\<close> \\<open>\\<aa>\\<^sub>P\\<^sub>L F\\<close> F \\<bb> \\<aa> F' \\<CC>\n    by (intro \\<epsilon>.NTDom.HomCod.cat_cf_parallel_\\<bb>\\<aa> assms \\<aa> \\<bb>) simp\n\n  interpret op_par: cf_parallel \\<alpha> \\<open>\\<aa>\\<^sub>P\\<^sub>L F\\<close> \\<open>\\<bb>\\<^sub>P\\<^sub>L F\\<close> F \\<aa> \\<bb> F' \\<open>op_cat \\<CC>\\<close>\n    by (rule par.cf_parallel_op)\n  have assms_4':\n    \"\\<exists>!f'. f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>op_cat \\<CC>\\<^esub> f'\"\n    if \"\\<epsilon>' : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e ?II_II : ?II \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<CC>\" for \\<epsilon>' E'\n  proof-\n    have [cat_op_simps]:\n      \"f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>op_cat \\<CC>\\<^esub> f' \\<longleftrightarrow>\n        f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\"\n      for f'\n      by (intro iffI conjI; (elim conjE)?)\n        (\n          cs_concl cs_shallow\n            cs_simp: category.op_cat_Comp[symmetric] cat_op_simps cat_cs_simps \n            cs_intro: cat_cs_intros cat_parallel_cs_intros\n        )+\n    interpret \\<epsilon>': is_cat_cone \\<alpha> E' ?II \\<open>op_cat \\<CC>\\<close> ?II_II \\<epsilon>' by (rule that)\n    show ?thesis\n      unfolding cat_op_simps\n      by \n        (\n          rule assms(7)[\n            OF \\<epsilon>'.is_cat_cocone_op[unfolded cat_op_simps], \n            unfolded cat_op_simps\n            ]\n        )\n  qed\n  interpret op_\\<epsilon>: is_cat_equalizer \\<alpha> \\<aa> \\<bb> F F' \\<open>op_cat \\<CC>\\<close> E \\<open>op_ntcf \\<epsilon>\\<close> \n    by \n      (\n        rule \n          is_cat_equalizerI'\n            [\n              OF \\<epsilon>.is_cat_cone_op[unfolded cat_op_simps], \n              unfolded cat_op_simps, \n              OF assms(2-6) assms_4',\n              simplified\n            ]\n      )\n  show ?thesis by (rule op_\\<epsilon>.is_cat_coequalizer_op[unfolded cat_op_simps])\n\nqed\n\nlemma (in is_cat_equalizer) cat_eq_unique_cone:\n  assumes \"\\<epsilon>' :\n    E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<aa> \\<bb> F' : \\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    (is \\<open>\\<epsilon>' : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e ?II_II : ?II \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\\<close>)\n  shows \"\\<exists>!f'. f' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'\"\nproof-\n\n  interpret \\<epsilon>': is_cat_cone \\<alpha> E' ?II \\<CC> ?II_II \\<epsilon>' by (rule assms(1))\n  from cat_lim_ua_fo[OF assms(1)] obtain f' where f': \"f' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E\"\n    and \\<epsilon>'_def: \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f'\"\n    and unique: \n      \"\\<lbrakk> f'' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E; \\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f'' \\<rbrakk> \\<Longrightarrow> f'' = f'\" \n    for f''\n    by auto\n  from cat_eq_F_ne obtain \\<ff> where \\<ff>: \"\\<ff> \\<in>\\<^sub>\\<circ> F\" by force\n\n  show ?thesis\n  proof(intro ex1I conjI; (elim conjE)?)\n    show f': \"f' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E\" by (rule f')\n    from \\<epsilon>'_def have \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = (\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f')\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\"\n      by simp\n    from this f' show \\<epsilon>'_NTMap_app_I: \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'\"\n      by \n        (\n          cs_prems \n            cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_parallel_cs_intros\n        )\n    fix f'' assume prems: \n      \"f'' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E\" \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f''\"\n    have \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f''\"\n    proof(rule ntcf_eqI[OF ])\n      show \"\\<epsilon>' : cf_const ?II \\<CC> E' \\<mapsto>\\<^sub>C\\<^sub>F ?II_II : ?II \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n        by (rule \\<epsilon>'.is_ntcf_axioms)\n      from f' prems(1) show \"\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f'' :\n        cf_const ?II \\<CC> E' \\<mapsto>\\<^sub>C\\<^sub>F ?II_II : ?II \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n        by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      show \"\\<epsilon>'\\<lparr>NTMap\\<rparr> = (\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f'')\\<lparr>NTMap\\<rparr>\"\n      proof(rule vsv_eqI, unfold cat_cs_simps)\n        show \"vsv ((\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f'')\\<lparr>NTMap\\<rparr>)\"\n          by (cs_concl cs_intro: cat_cs_intros)\n        from prems(1) show \"?II\\<lparr>Obj\\<rparr> = \\<D>\\<^sub>\\<circ> ((\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f'')\\<lparr>NTMap\\<rparr>)\"\n          by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n        fix a assume prems': \"a \\<in>\\<^sub>\\<circ> ?II\\<lparr>Obj\\<rparr>\"\n        note [cat_cs_simps] = \n          cat_eq_eps_NTMap_app[OF \\<ff>]\n          cat_cone_cf_par_eps_NTMap_app\n            [\n              OF \n                \\<epsilon>'.is_cat_cone_axioms \n                F'.vsv_axioms \n                cat_eq_F_in_Vset \n                cat_eq_F'_vdomain \n                cat_eq_F'_app_is_arr \\<ff>, \n              simplified\n            ]\n        from prems' prems(1) \\<ff> have [cat_cs_simps]: \n          \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f''\"\n          by (elim the_cat_parallel_ObjE; simp only:)\n            (\n                cs_concl \n                  cs_simp: cat_cs_simps cat_parallel_cs_simps prems(2)\n                  cs_intro: cat_cs_intros cat_parallel_cs_intros\n            )+\n        from prems' prems show \n          \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr> = (\\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const ?II \\<CC> f'')\\<lparr>NTMap\\<rparr>\\<lparr>a\\<rparr>\"\n          by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)\n      qed auto\n    qed simp_all\n    from unique[OF prems(1) this] show \"f'' = f'\" .\n  qed\n\nqed\n\nlemma (in is_cat_equalizer) cat_eq_unique:\n  assumes \"\\<epsilon>' : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,F,F') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \n    \"\\<exists>!f'. f' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E \\<and> \\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (\\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F) \\<CC> f'\"\n  by (rule cat_lim_unique[OF is_cat_equalizerD(1)[OF assms]])\n\nlemma (in is_cat_equalizer) cat_eq_unique':\n  assumes \"\\<epsilon>' : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,F,F') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"\\<exists>!f'. f' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'\"\nproof-\n  interpret \\<epsilon>': is_cat_equalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E' \\<epsilon>' by (rule assms(1))\n  show ?thesis by (rule cat_eq_unique_cone[OF \\<epsilon>'.is_cat_cone_axioms])\nqed\n\nlemma (in is_cat_coequalizer) cat_coeq_unique_cocone:\n  assumes \"\\<epsilon>' :\n    \\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<bb> \\<aa> F' >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e E' : \n    \\<Up>\\<^sub>C (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    (is \\<open>\\<epsilon>' : ?II_II >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e E' : ?II \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\\<close>)\n  shows \"\\<exists>!f'. f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\"\nproof-\n  interpret \\<epsilon>': is_cat_cocone \\<alpha> E' ?II \\<CC> ?II_II \\<epsilon>' by (rule assms(1))\n  have [cat_op_simps]:\n    \"f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>op_cat \\<CC>\\<^esub> f' \\<longleftrightarrow>\n      f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\" \n    for f'\n    by (intro iffI conjI; (elim conjE)?)\n      (\n        cs_concl cs_shallow\n          cs_simp: category.op_cat_Comp[symmetric] cat_op_simps cat_cs_simps \n          cs_intro: cat_cs_intros cat_parallel_cs_intros\n      )+\n  show ?thesis\n    by \n      (\n        rule is_cat_equalizer.cat_eq_unique_cone[\n          OF is_cat_equalizer_op \\<epsilon>'.is_cat_cone_op[unfolded cat_op_simps],\n          unfolded cat_op_simps\n          ]\n     )\nqed\n\nlemma (in is_cat_coequalizer) cat_coeq_unique:\n  assumes \"\\<epsilon>' : (\\<aa>,\\<bb>,F,F') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E' : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"\\<exists>!f'.\n    f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>' = ntcf_const (\\<Up>\\<^sub>C (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F) \\<CC> f' \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<epsilon>\"\n  by (rule cat_colim_unique[OF is_cat_coequalizerD(1)[OF assms]])\n\nlemma (in is_cat_coequalizer) cat_coeq_unique':\n  assumes \"\\<epsilon>' : (\\<aa>,\\<bb>,F,F') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E' : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"\\<exists>!f'. f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\"\nproof-\n  interpret \\<epsilon>': is_cat_coequalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E' \\<epsilon>' by (rule assms(1))\n  show ?thesis by (rule cat_coeq_unique_cocone[OF \\<epsilon>'.is_cat_cocone_axioms])\nqed\n\nlemma cat_equalizer_ex_is_iso_arr:\n  assumes \"\\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,F,F') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \n    and \"\\<epsilon>' : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,F,F') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  obtains f where \"f : E' \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>\\<^esub> E\"\n    and \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (\\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F) \\<CC> f\"\nproof-\n  interpret \\<epsilon>: is_cat_equalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E \\<epsilon> by (rule assms(1))\n  interpret \\<epsilon>': is_cat_equalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E' \\<epsilon>' by (rule assms(2))\n  from that show ?thesis\n    by \n      (\n        elim cat_lim_ex_is_iso_arr[\n          OF \\<epsilon>.is_cat_limit_axioms \\<epsilon>'.is_cat_limit_axioms\n          ]\n      )\nqed\n\nlemma cat_equalizer_ex_is_iso_arr':\n  assumes \"\\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,F,F') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \n    and \"\\<epsilon>' : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,F,F') : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  obtains f where \"f : E' \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>\\<^esub> E\"\n    and \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\"\n    and \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\"\nproof-\n  interpret \\<epsilon>: is_cat_equalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E \\<epsilon> by (rule assms(1))\n  interpret \\<epsilon>': is_cat_equalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E' \\<epsilon>' by (rule assms(2))\n  obtain f where f: \"f : E' \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>\\<^esub> E\"\n    and \"j \\<in>\\<^sub>\\<circ> \\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F\\<lparr>Obj\\<rparr> \\<Longrightarrow> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>j\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>j\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\" for j\n    by \n      (\n        elim cat_lim_ex_is_iso_arr'[\n          OF \\<epsilon>.is_cat_limit_axioms \\<epsilon>'.is_cat_limit_axioms\n          ]\n      )\n  then have \n    \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\"\n    \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\"\n    unfolding the_cat_parallel_components by auto\n  with f show ?thesis using that by simp\nqed\n\nlemma cat_coequalizer_ex_is_iso_arr:\n  assumes \"\\<epsilon> : (\\<aa>,\\<bb>,F,F') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<epsilon>' : (\\<aa>,\\<bb>,F,F') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E' : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  obtains f where \"f : E \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>\\<^esub> E'\" \n    and \"\\<epsilon>' = ntcf_const (\\<Up>\\<^sub>C (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F)  \\<CC> f \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<epsilon>\"\nproof-\n  interpret \\<epsilon>: is_cat_coequalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E \\<epsilon> by (rule assms(1))\n  interpret \\<epsilon>': is_cat_coequalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E' \\<epsilon>' by (rule assms(2))\n  from that show ?thesis\n    by \n      (\n        elim cat_colim_ex_is_iso_arr[\n          OF \\<epsilon>.is_cat_colimit_axioms \\<epsilon>'.is_cat_colimit_axioms\n          ]\n      )\nqed\n\nlemma cat_coequalizer_ex_is_iso_arr':\n  assumes \"\\<epsilon> : (\\<aa>,\\<bb>,F,F') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<epsilon>' : (\\<aa>,\\<bb>,F,F') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E' : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  obtains f where \"f : E \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>\\<^esub> E'\" \n    and \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = f \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\"\n    and \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr> = f \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr>\"\nproof-\n  interpret \\<epsilon>: is_cat_coequalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E \\<epsilon> by (rule assms(1))\n  interpret \\<epsilon>': is_cat_coequalizer \\<alpha> \\<aa> \\<bb> F F' \\<CC> E' \\<epsilon>' by (rule assms(2))\n  obtain f where f: \"f : E \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>\\<^esub> E'\"\n    and \"j \\<in>\\<^sub>\\<circ> \\<Up>\\<^sub>C (\\<bb>\\<^sub>P\\<^sub>L F) (\\<aa>\\<^sub>P\\<^sub>L F) F\\<lparr>Obj\\<rparr> \\<Longrightarrow> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>j\\<rparr> = f \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>j\\<rparr>\" for j\n    by\n      (\n        elim cat_colim_ex_is_iso_arr'[\n          OF \\<epsilon>.is_cat_colimit_axioms \\<epsilon>'.is_cat_colimit_axioms\n          ]\n      )\n  then have \n    \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = f \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr>\"\n    \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr> = f \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L F\\<rparr>\"\n    unfolding the_cat_parallel_components by auto\n  with f show ?thesis using that by simp\nqed\n\n\nsubsubsection\\<open>Further properties\\<close>\n\nlemma (in is_cat_equalizer) cat_eq_is_monic_arr: \n  \\<comment>\\<open>See subsection 3.3 in \\cite{awodey_category_2010}.\\<close>\n  \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> : E \\<mapsto>\\<^sub>m\\<^sub>o\\<^sub>n\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\nproof(intro is_monic_arrI)\n  show \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n    by\n      (\n        cs_concl\n          cs_simp: cat_cs_simps cat_parallel_cs_simps \n          cs_intro: cat_cs_intros cat_parallel_cs_intros\n      )\n  fix f g a\n  assume prems:\n    \"f : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E\"\n    \"g : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E\"\n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> g\"\n  define \\<epsilon>' where \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (\\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F) \\<CC> f\"\n  from prems(1) have \"\\<epsilon>' :\n    a <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<Up>\\<rightarrow>\\<Up>\\<^sub>C\\<^sub>F \\<CC> (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<aa> \\<bb> F' :\n    \\<Up>\\<^sub>C (\\<aa>\\<^sub>P\\<^sub>L F) (\\<bb>\\<^sub>P\\<^sub>L F) F \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    unfolding \\<epsilon>'_def \n    by (cs_concl cs_shallow cs_intro: is_cat_coneI cat_cs_intros)    \n  from cat_eq_unique_cone[OF this] obtain f' \n    where f': \"f' : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E\"\n      and \\<epsilon>'_\\<aa>: \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'\"\n      and unique_f': \"\\<And>f''.\n        \\<lbrakk> f'' : a \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E; \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'' \\<rbrakk> \\<Longrightarrow>\n          f'' = f'\"\n    by meson\n  from prems(1) have unique_f: \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\"\n    unfolding \\<epsilon>'_def\n    by\n      (\n        cs_concl \n          cs_simp: cat_cs_simps cs_intro: cat_cs_intros cat_parallel_cs_intros\n      )\n  from prems(1) have unique_g: \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> g\"\n    unfolding \\<epsilon>'_def\n    by\n      (\n        cs_concl\n          cs_simp: prems(3) cat_cs_simps\n          cs_intro: cat_cs_intros cat_parallel_cs_intros\n      )\n  show \"f = g\"\n    by \n      (\n        rule unique_f'\n          [\n            OF prems(1) unique_f,\n            unfolded unique_f'[OF prems(2) unique_g, symmetric]\n          ]\n      )\nqed\n\nlemma (in is_cat_coequalizer) cat_coeq_is_epic_arr: \n  \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L F\\<rparr> : \\<aa> \\<mapsto>\\<^sub>e\\<^sub>p\\<^sub>i\\<^bsub>\\<CC>\\<^esub> E\"\n  by\n    (\n      rule is_cat_equalizer.cat_eq_is_monic_arr[\n        OF is_cat_equalizer_op, unfolded cat_op_simps\n        ]\n    )\n\n\n\nsubsection\\<open>Equalizer and coequalizer for two arrows\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\n\ntext\\<open>\nSee \\<^cite>\\<open>\"noauthor_wikipedia_2001\"\\<close>\\footnote{\n\\url{https://en.wikipedia.org/wiki/Equaliser_(mathematics)}\n}.\n\\<close>\n\nlocale is_cat_equalizer_2 =\n  is_cat_limit \\<alpha> \\<open>\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L\\<close> \\<CC> \\<open>\\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff>\\<close> E \\<epsilon> \n  for \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E \\<epsilon> +\n  assumes cat_eq_\\<gg>[cat_lim_cs_intros]: \"\\<gg> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n    and cat_eq_\\<ff>[cat_lim_cs_intros]: \"\\<ff> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n\nsyntax \"_is_cat_equalizer_2\" :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> bool\"\n  (\\<open>(_ :/ _ <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q '(_,_,_,_') :/ \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<index> _)\\<close> [51, 51, 51, 51, 51, 51] 51)\ntranslations \"\\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \\<rightleftharpoons> \n  \"CONST is_cat_equalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E \\<epsilon>\"\n\nlocale is_cat_coequalizer_2 =\n  is_cat_colimit \n    \\<alpha> \\<open>\\<up>\\<up>\\<^sub>C \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L\\<close> \\<CC> \\<open>\\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<ff> \\<gg>\\<close> E \\<epsilon> \n  for \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E \\<epsilon> +\n  assumes cat_coeq_\\<gg>[cat_lim_cs_intros]: \"\\<gg> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n    and cat_coeq_\\<ff>[cat_lim_cs_intros]: \"\\<ff> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n\nsyntax \"_is_cat_coequalizer_2\" :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> bool\"\n  (\\<open>(_ :/ '(_,_,_,_') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q _ :/ \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<index> _)\\<close> [51, 51, 51, 51, 51, 51] 51)\ntranslations \"\\<epsilon> : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \\<rightleftharpoons> \n  \"CONST is_cat_coequalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E \\<epsilon>\"\n\n\ntext\\<open>Rules.\\<close>\n\nlemma (in is_cat_equalizer_2) is_cat_equalizer_2_axioms'[cat_lim_cs_intros]:\n  assumes \"\\<alpha>' = \\<alpha>\"\n    and \"E' = E\"\n    and \"\\<aa>' = \\<aa>\"\n    and \"\\<bb>' = \\<bb>\"\n    and \"\\<gg>' = \\<gg>\"\n    and \"\\<ff>' = \\<ff>\"\n    and \"\\<CC>' = \\<CC>\"\n  shows \"\\<epsilon> : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>',\\<bb>',\\<gg>',\\<ff>') : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>'\\<^esub> \\<CC>'\"\n  unfolding assms by (rule is_cat_equalizer_2_axioms)\n\nmk_ide rf is_cat_equalizer_2_def[unfolded is_cat_equalizer_2_axioms_def]\n  |intro is_cat_equalizer_2I|\n  |dest is_cat_equalizer_2D[dest]|\n  |elim is_cat_equalizer_2E[elim]|\n\nlemmas [cat_lim_cs_intros] = is_cat_equalizer_2D(1)\n\nlemma (in is_cat_coequalizer_2) is_cat_coequalizer_2_axioms'[cat_lim_cs_intros]:\n  assumes \"\\<alpha>' = \\<alpha>\"\n    and \"E' = E\"\n    and \"\\<aa>' = \\<aa>\"\n    and \"\\<bb>' = \\<bb>\"\n    and \"\\<gg>' = \\<gg>\"\n    and \"\\<ff>' = \\<ff>\"\n    and \"\\<CC>' = \\<CC>\"\n  shows \"\\<epsilon> : (\\<aa>',\\<bb>',\\<gg>',\\<ff>') >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E' : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>'\\<^esub> \\<CC>'\"\n  unfolding assms by (rule is_cat_coequalizer_2_axioms)\n\nmk_ide rf is_cat_coequalizer_2_def[unfolded is_cat_coequalizer_2_axioms_def]\n  |intro is_cat_coequalizer_2I|\n  |dest is_cat_coequalizer_2D[dest]|\n  |elim is_cat_coequalizer_2E[elim]|\n\nlemmas [cat_lim_cs_intros] = is_cat_coequalizer_2D(1)\n\n\ntext\\<open>Helper lemmas.\\<close>\n\n(*FIXME*)\nlemma cat_eq_F'_helper:\n  \"(\\<lambda>f\\<in>\\<^sub>\\<circ>set {\\<ff>\\<^sub>P\\<^sub>L, \\<gg>\\<^sub>P\\<^sub>L}. (f = \\<gg>\\<^sub>P\\<^sub>L ? \\<gg> : \\<ff>)) =\n    (\\<lambda>f\\<in>\\<^sub>\\<circ>set {\\<ff>\\<^sub>P\\<^sub>L, \\<gg>\\<^sub>P\\<^sub>L}. (f = \\<ff>\\<^sub>P\\<^sub>L ? \\<ff> : \\<gg>))\"\n  using cat_PL2_\\<gg>\\<ff> by (simp add: VLambda_vdoubleton)\n\n\ntext\\<open>Elementary properties.\\<close>\n\nsublocale is_cat_equalizer_2 \\<subseteq> cf_parallel_2 \\<alpha> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> \n  by (intro cf_parallel_2I cat_parallel_2I)\n    (simp_all add: cat_parallel_cs_intros cat_lim_cs_intros cat_cs_intros)\n\nsublocale is_cat_coequalizer_2 \\<subseteq> cf_parallel_2 \\<alpha> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<ff> \\<gg> \\<CC>\n  by (intro cf_parallel_2I cat_parallel_2I)\n    (\n      auto simp: \n        cat_parallel_cs_intros cat_lim_cs_intros cat_cs_intros \n        cat_PL2_ineq[symmetric]\n    )\n\nlemma (in is_cat_equalizer_2) cat_equalizer_2_is_cat_equalizer:\n  \"\\<epsilon> :\n    E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L},(\\<lambda>f\\<in>\\<^sub>\\<circ>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}. (f = \\<ff>\\<^sub>P\\<^sub>L ? \\<ff> : \\<gg>))) : \n    \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  by \n    (\n      intro is_cat_equalizerI, \n      rule is_cat_limit_axioms[\n        unfolded the_cf_parallel_2_def the_cat_parallel_2_def \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def\n        ]\n    ) \n    (auto simp: Limit_vdoubleton_in_VsetI cat_parallel_cs_intros)\n\nlemma (in is_cat_coequalizer_2) cat_coequalizer_2_is_cat_coequalizer:\n  \"\\<epsilon> :\n    (\\<aa>,\\<bb>,set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L},(\\<lambda>f\\<in>\\<^sub>\\<circ>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}. (f = \\<ff>\\<^sub>P\\<^sub>L ? \\<ff> : \\<gg>))) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E :\n    \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof\n  (\n    intro is_cat_coequalizerI, \n    fold the_cf_parallel_2_def the_cat_parallel_2_def \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def\n  )\n  show \"\\<epsilon> :\n    \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<gg> \\<ff> >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>l\\<^sub>i\\<^sub>m E :\n    \\<up>\\<up>\\<^sub>C \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    by \n      (\n        subst the_cat_parallel_2_commute, \n        subst cf_parallel_2_the_cf_parallel_2_commute[symmetric]\n      )\n      (intro is_cat_colimit_axioms)\nqed (auto simp: Limit_vdoubleton_in_VsetI cat_parallel_cs_intros)\n\nlemma cat_equalizer_is_cat_equalizer_2:\n  assumes \"\\<epsilon> :\n    E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L},(\\<lambda>f\\<in>\\<^sub>\\<circ>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}. (f = \\<ff>\\<^sub>P\\<^sub>L ? \\<ff> : \\<gg>))) :\n    \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"\\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof-\n  interpret \\<epsilon>: is_cat_equalizer \n    \\<alpha> \\<aa> \\<bb> \\<open>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\\<close> \\<open>(\\<lambda>f\\<in>\\<^sub>\\<circ>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}. (f = \\<ff>\\<^sub>P\\<^sub>L ? \\<ff> : \\<gg>))\\<close> \\<CC> E \\<epsilon>\n    by (rule assms)\n  have \\<ff>\\<^sub>P\\<^sub>L: \"\\<ff>\\<^sub>P\\<^sub>L \\<in>\\<^sub>\\<circ> set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\" and \\<gg>\\<^sub>P\\<^sub>L: \"\\<gg>\\<^sub>P\\<^sub>L \\<in>\\<^sub>\\<circ> set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\" by auto\n  show ?thesis\n    using \\<epsilon>.cat_eq_F'_app_is_arr[OF \\<gg>\\<^sub>P\\<^sub>L] \\<epsilon>.cat_eq_F'_app_is_arr[OF \\<ff>\\<^sub>P\\<^sub>L] \n    by \n      (\n        intro \n          is_cat_equalizer_2I \n          \\<epsilon>.is_cat_limit_axioms\n            [\n              folded \n                the_cf_parallel_2_def the_cat_parallel_2_def \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def\n            ]\n      )\n      (auto simp: cat_PL2_\\<gg>\\<ff>)\nqed\n\nlemma cat_coequalizer_is_cat_coequalizer_2:\n  assumes \"\\<epsilon> :\n    (\\<aa>,\\<bb>,set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L},(\\<lambda>f\\<in>\\<^sub>\\<circ>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}. (f = \\<ff>\\<^sub>P\\<^sub>L ? \\<ff> : \\<gg>))) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E :\n    \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"\\<epsilon> : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof-\n  interpret is_cat_coequalizer \n    \\<alpha> \\<aa> \\<bb> \\<open>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\\<close> \\<open>(\\<lambda>f\\<in>\\<^sub>\\<circ>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}. (f = \\<ff>\\<^sub>P\\<^sub>L ? \\<ff> : \\<gg>))\\<close> \\<CC> E \\<epsilon>\n    by (rule assms)\n  interpret cf_parallel_2 \\<alpha> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<gg> \\<ff> \\<CC>\n    by \n      (\n        rule cf_parallel_is_cf_parallel_2[\n          OF cf_parallel_axioms cat_PL2_\\<gg>\\<ff>, folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def\n          ]\n      )\n  show \"\\<epsilon> : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    by\n      (\n        intro is_cat_coequalizer_2I, \n        subst the_cat_parallel_2_commute, \n        subst cf_parallel_2_the_cf_parallel_2_commute[symmetric], \n        rule is_cat_colimit_axioms[\n          folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def the_cat_parallel_2_def the_cf_parallel_2_def\n          ]\n      )\n      (simp_all add: cf_parallel_\\<ff>' cf_parallel_\\<gg>')\nqed\n\n\ntext\\<open>Duality.\\<close>\n\nlemma (in is_cat_equalizer_2) is_cat_coequalizer_2_op:\n  \"op_ntcf \\<epsilon> : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<CC>\"\n  unfolding is_cat_equalizer_def\n  by \n    (\n      rule cat_coequalizer_is_cat_coequalizer_2\n        [\n          OF is_cat_equalizer.is_cat_coequalizer_op[\n            OF cat_equalizer_2_is_cat_equalizer\n          ]\n        ]\n    )\n\nlemma (in is_cat_equalizer_2) is_cat_coequalizer_2_op'[cat_op_intros]:\n  assumes \"\\<CC>' = op_cat \\<CC>\"\n  shows \"op_ntcf \\<epsilon> : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>'\"\n  unfolding assms by (rule is_cat_coequalizer_2_op)\n\nlemmas [cat_op_intros] = is_cat_equalizer_2.is_cat_coequalizer_2_op'\n\nlemma (in is_cat_coequalizer_2) is_cat_equalizer_2_op:\n  \"op_ntcf \\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> op_cat \\<CC>\"\n  unfolding is_cat_coequalizer_def\n  by \n    (\n      rule cat_equalizer_is_cat_equalizer_2\n        [\n          OF is_cat_coequalizer.is_cat_equalizer_op[\n            OF cat_coequalizer_2_is_cat_coequalizer\n          ]\n        ]\n    )\n\nlemma (in is_cat_coequalizer_2) is_cat_equalizer_2_op'[cat_op_intros]:\n  assumes \"\\<CC>' = op_cat \\<CC>\"\n  shows \"op_ntcf \\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>'\"\n  unfolding assms by (rule is_cat_equalizer_2_op)\n\nlemmas [cat_op_intros] = is_cat_coequalizer_2.is_cat_equalizer_2_op'\n\n\ntext\\<open>Further properties.\\<close>\n\nlemma (in category) cat_cf_parallel_2_cat_equalizer: \n  assumes \"\\<gg> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\" and \"\\<ff> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n  shows \"cf_parallel_2 \\<alpha> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff> \\<CC>\"\n  using assms \n  by (intro cf_parallel_2I cat_parallel_2I)\n    (auto simp: cat_parallel_cs_intros cat_cs_intros)\n\nlemma (in category) cat_cf_parallel_2_cat_coequalizer: \n  assumes \"\\<gg> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\" and \"\\<ff> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n  shows \"cf_parallel_2 \\<alpha> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<ff> \\<gg> \\<CC>\"\n  using assms \n  by (intro cf_parallel_2I cat_parallel_2I)\n    (simp_all add: cat_parallel_cs_intros cat_cs_intros cat_PL2_ineq[symmetric])\n\nlemma cat_cone_cf_par_2_eps_NTMap_app:\n  assumes \"\\<epsilon> :\n    E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff> : \\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<gg> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\" \n    and \"\\<ff> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n  shows \n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<gg> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\" \n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<ff> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\nproof-\n  let ?II = \\<open>\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L\\<close> \n    and ?II_II = \\<open>\\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff>\\<close>\n    and ?F = \\<open>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\\<close>\n  interpret \\<epsilon>: is_cat_cone \\<alpha> E ?II \\<CC> ?II_II \\<epsilon> by (rule assms(1))\n  from \\<epsilon>.cat_PL2_\\<ff> \\<epsilon>.cat_PL2_\\<gg> have \\<gg>\\<ff>: \"?F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    by (intro Limit_vdoubleton_in_VsetI)  auto\n  from assms(2,3) have\n    \"(\\<And>\\<ff>'. \\<ff>' \\<in>\\<^sub>\\<circ> ?F \\<Longrightarrow> (\\<lambda>f\\<in>\\<^sub>\\<circ>?F. (f = \\<ff>\\<^sub>P\\<^sub>L ? \\<ff> : \\<gg>))\\<lparr>\\<ff>'\\<rparr> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>)\"\n    by auto\n  note cat_cone_cf_par_eps_NTMap_app = cat_cone_cf_par_eps_NTMap_app\n      [\n        OF \n          assms(1)[\n            unfolded \n              the_cat_parallel_2_def the_cf_parallel_2_def \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def\n            ], \n        folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def, OF _ \\<gg>\\<ff> _ this,\n        simplified\n      ]\n  from\n    cat_cone_cf_par_eps_NTMap_app[of \\<gg>\\<^sub>P\\<^sub>L, simplified]\n    cat_cone_cf_par_eps_NTMap_app[of \\<ff>\\<^sub>P\\<^sub>L, simplified]\n    cat_PL2_\\<gg>\\<ff>\n  show \n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<gg> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\" \n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<ff> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\n    by fastforce+\nqed\n\nlemma cat_cocone_cf_par_2_eps_NTMap_app:\n  assumes \"\\<epsilon> :\n    \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<ff> \\<gg> >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e E :\n    \\<up>\\<up>\\<^sub>C \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<gg> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\" \n    and \"\\<ff> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n  shows \n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<gg>\" \n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<ff>\"    \nproof-\n  let ?II = \\<open>\\<up>\\<up>\\<^sub>C \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L\\<close> \n    and ?II_II = \\<open>\\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<ff> \\<gg>\\<close>\n    and ?F = \\<open>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\\<close>\n  have \\<ff>\\<gg>_\\<gg>\\<ff>: \"{\\<ff>\\<^sub>P\\<^sub>L, \\<gg>\\<^sub>P\\<^sub>L} = {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\" by auto\n  interpret \\<epsilon>: is_cat_cocone \\<alpha> E ?II \\<CC> ?II_II \\<epsilon> by (rule assms(1))\n  from \\<epsilon>.cat_PL2_\\<ff> \\<epsilon>.cat_PL2_\\<gg> have \\<gg>\\<ff>: \"?F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    by (intro Limit_vdoubleton_in_VsetI) auto\n  from assms(2,3) have\n    \"(\\<And>\\<ff>'. \\<ff>' \\<in>\\<^sub>\\<circ> ?F \\<Longrightarrow> (\\<lambda>f\\<in>\\<^sub>\\<circ>?F. (f = \\<gg>\\<^sub>P\\<^sub>L ? \\<gg> : \\<ff>))\\<lparr>\\<ff>'\\<rparr> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>)\"\n    by auto\n  note cat_cocone_cf_par_eps_NTMap_app = cat_cocone_cf_par_eps_NTMap_app\n    [\n      OF assms(1)\n        [\n          unfolded \n            the_cat_parallel_2_def \n            the_cf_parallel_2_def \n            \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def \n            insert_commute,\n          unfolded \\<ff>\\<gg>_\\<gg>\\<ff>\n        ],\n      folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def,\n      OF _ \\<gg>\\<ff> _ this,\n      simplified\n    ]\n  from\n    cat_cocone_cf_par_eps_NTMap_app[of \\<gg>\\<^sub>P\\<^sub>L, simplified]\n    cat_cocone_cf_par_eps_NTMap_app[of \\<ff>\\<^sub>P\\<^sub>L, simplified]\n    cat_PL2_\\<gg>\\<ff>\n  show\n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<gg>\" \n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<ff>\"\n    by fastforce+\nqed\n\nlemma (in is_cat_equalizer_2) cat_eq_2_eps_NTMap_app:\n  \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<gg> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\n  \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<ff> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\nproof-\n  have \\<gg>\\<^sub>P\\<^sub>L: \"\\<gg>\\<^sub>P\\<^sub>L \\<in>\\<^sub>\\<circ> set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\" and \\<ff>\\<^sub>P\\<^sub>L: \"\\<ff>\\<^sub>P\\<^sub>L \\<in>\\<^sub>\\<circ> set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\" by auto\n  note cat_eq_eps_NTMap_app = is_cat_equalizer.cat_eq_eps_NTMap_app\n    [\n      OF cat_equalizer_2_is_cat_equalizer,\n      folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def\n    ]\n  from cat_eq_eps_NTMap_app[OF \\<gg>\\<^sub>P\\<^sub>L] cat_eq_eps_NTMap_app[OF \\<ff>\\<^sub>P\\<^sub>L] cat_PL2_\\<gg>\\<ff> show \n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<gg> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<ff> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\n    by auto\nqed\n\nlemma (in is_cat_coequalizer_2) cat_coeq_2_eps_NTMap_app:\n  \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<gg>\"\n  \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<ff>\"\nproof-\n  have \\<gg>\\<^sub>P\\<^sub>L: \"\\<gg>\\<^sub>P\\<^sub>L \\<in>\\<^sub>\\<circ> set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\" and \\<ff>\\<^sub>P\\<^sub>L: \"\\<ff>\\<^sub>P\\<^sub>L \\<in>\\<^sub>\\<circ> set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\" by auto\n  note cat_eq_eps_NTMap_app = is_cat_coequalizer.cat_coeq_eps_NTMap_app\n    [\n      OF cat_coequalizer_2_is_cat_coequalizer,\n      folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def\n    ]\n  from cat_eq_eps_NTMap_app[OF \\<gg>\\<^sub>P\\<^sub>L] cat_eq_eps_NTMap_app[OF \\<ff>\\<^sub>P\\<^sub>L] cat_PL2_\\<gg>\\<ff> show \n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<gg>\"\n    \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<ff>\"\n    by auto\nqed\n\nlemma (in is_cat_equalizer_2) cat_eq_2_Comp_eq: \n  \"\\<gg> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<ff> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\n  \"\\<ff> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<gg> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\n  unfolding cat_eq_2_eps_NTMap_app[symmetric] by simp_all\n\nlemma (in is_cat_coequalizer_2) cat_coeq_2_Comp_eq: \n  \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<gg> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<ff>\"\n  \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<ff> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<gg>\"\n  unfolding cat_coeq_2_eps_NTMap_app[symmetric] by simp_all\n\n\nsubsubsection\\<open>Universal property\\<close>\n\nlemma is_cat_equalizer_2I':\n  assumes \"\\<epsilon> :\n    E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff> : \\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<gg> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n    and \"\\<ff> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n    and \"\\<And>\\<epsilon>' E'. \\<epsilon>' :\n      E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff> :\n      \\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC> \\<Longrightarrow>\n      \\<exists>!f'. f' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'\"\n  shows \"\\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof-\n  let ?II = \\<open>\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L\\<close> \n    and ?II_II = \\<open>\\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff>\\<close>\n    and ?F = \\<open>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\\<close>\n  interpret \\<epsilon>: is_cat_cone \\<alpha> E ?II \\<CC> ?II_II \\<epsilon> by (rule assms(1))\n  from \\<epsilon>.cat_PL2_\\<ff> \\<epsilon>.cat_PL2_\\<gg> have \\<gg>\\<ff>: \"?F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    by (intro Limit_vdoubleton_in_VsetI) auto\n  from assms(2,3) have \"(\\<lambda>f\\<in>\\<^sub>\\<circ>?F. (f = \\<ff>\\<^sub>P\\<^sub>L ? \\<ff> : \\<gg>))\\<lparr>\\<ff>'\\<rparr> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\" \n    if \"\\<ff>' \\<in>\\<^sub>\\<circ> ?F\" for \\<ff>'\n    using that by simp\n  note is_cat_equalizerI' = is_cat_equalizerI'\n      [\n        OF \n          assms(1)[\n            unfolded \n              the_cat_parallel_2_def the_cf_parallel_2_def \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def\n            ], \n        folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def, \n        OF \n          _ \n          \\<gg>\\<ff> \n          _ \n          this \n          _ \n          assms(4)[unfolded the_cf_parallel_2_def the_cat_parallel_2_def], \n        of \\<gg>\\<^sub>P\\<^sub>L,\n        simplified\n      ]\n  show ?thesis by (rule cat_equalizer_is_cat_equalizer_2[OF is_cat_equalizerI'])\nqed\n\nlemma is_cat_coequalizer_2I':\n  assumes \"\\<epsilon> :\n    \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<ff> \\<gg> >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e E :\n    \\<up>\\<up>\\<^sub>C \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<gg> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n    and \"\\<ff> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n    and \"\\<And>\\<epsilon>' E'. \\<epsilon>' :\n      \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<ff> \\<gg> >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e E' :\n      \\<up>\\<up>\\<^sub>C \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC> \\<Longrightarrow>\n      \\<exists>!f'. f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\n  shows \"\\<epsilon> : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof-\n  let ?II = \\<open>\\<up>\\<up>\\<^sub>C \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L\\<close> \n    and ?II_II = \\<open>\\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<ff> \\<gg>\\<close>\n    and ?F = \\<open>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\\<close>\n  have \\<ff>\\<gg>_\\<gg>\\<ff>: \"{\\<ff>\\<^sub>P\\<^sub>L, \\<gg>\\<^sub>P\\<^sub>L} = {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\" by auto\n  interpret \\<epsilon>: is_cat_cocone \\<alpha> E ?II \\<CC> ?II_II \\<epsilon> by (rule assms(1))\n  from \\<epsilon>.cat_PL2_\\<ff> \\<epsilon>.cat_PL2_\\<gg> have \\<gg>\\<ff>: \"?F \\<in>\\<^sub>\\<circ> Vset \\<alpha>\"\n    by (intro Limit_vdoubleton_in_VsetI) auto\n  from assms(2,3) have \"(\\<lambda>f\\<in>\\<^sub>\\<circ>set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}. (f = \\<gg>\\<^sub>P\\<^sub>L ? \\<gg> : \\<ff>))\\<lparr>\\<ff>'\\<rparr> : \\<bb> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n    if \"\\<ff>' \\<in>\\<^sub>\\<circ> set {\\<gg>\\<^sub>P\\<^sub>L, \\<ff>\\<^sub>P\\<^sub>L}\" for \\<ff>'\n    using that by simp\n  note is_cat_coequalizerI'\n    [\n      OF assms(1)[\n        unfolded \n          the_cat_parallel_2_def the_cf_parallel_2_def \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<ff>\\<gg>_\\<gg>\\<ff>\n          ],\n      folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def,\n      OF \n        _ \n        \\<gg>\\<ff>\n        _ \n        this\n        _\n        assms(4)[unfolded the_cf_parallel_2_def the_cat_parallel_2_def \\<ff>\\<gg>_\\<gg>\\<ff>],\n      of \\<gg>\\<^sub>P\\<^sub>L,\n      simplified\n    ]\n  with cat_PL2_\\<gg>\\<ff> have\n    \"\\<epsilon> : (\\<aa>,\\<bb>,?F,(\\<lambda>f\\<in>\\<^sub>\\<circ>?F. (f = \\<ff>\\<^sub>P\\<^sub>L ? \\<ff> : \\<gg>))) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<Up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    by (auto simp: VLambda_vdoubleton)\n  from cat_coequalizer_is_cat_coequalizer_2[OF this] show ?thesis by simp\nqed\n\nlemma (in is_cat_equalizer_2) cat_eq_2_unique_cone:\n  assumes \"\\<epsilon>' :\n    E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff> : \n    \\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"\\<exists>!f'. f' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'\"\n  by \n    (\n      rule is_cat_equalizer.cat_eq_unique_cone\n        [\n          OF cat_equalizer_2_is_cat_equalizer, \n          folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def,\n          OF assms[unfolded the_cf_parallel_2_def the_cat_parallel_2_def]\n        ]\n    )\n\nlemma (in is_cat_equalizer_2) cat_eq_2_unique:\n  assumes \"\\<epsilon>' : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows\n    \"\\<exists>!f'. f' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E \\<and> \\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L) \\<CC> f'\"\nproof-  \n  interpret \\<epsilon>': is_cat_equalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E' \\<epsilon>' by (rule assms)\n  show ?thesis\n    by \n      (\n        rule is_cat_equalizer.cat_eq_unique\n          [\n            OF cat_equalizer_2_is_cat_equalizer,\n            folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def,\n            OF \\<epsilon>'.cat_equalizer_2_is_cat_equalizer,\n            folded the_cat_parallel_2_def\n          ]\n      )\nqed\n\nlemma (in is_cat_equalizer_2) cat_eq_2_unique':\n  assumes \"\\<epsilon>' : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"\\<exists>!f'. f' : E' \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f'\"\nproof-\n  interpret \\<epsilon>': is_cat_equalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E' \\<epsilon>' by (rule assms)\n  show ?thesis\n    by \n      (\n        rule is_cat_equalizer.cat_eq_unique'\n          [\n            OF cat_equalizer_2_is_cat_equalizer,\n            folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def,\n            OF \\<epsilon>'.cat_equalizer_2_is_cat_equalizer,\n            folded the_cat_parallel_2_def\n          ]\n      )\nqed\n\nlemma (in is_cat_coequalizer_2) cat_coeq_2_unique_cocone:\n  assumes \"\\<epsilon>' :\n    \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<bb> \\<aa> \\<ff> \\<gg> >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e E' :\n    \\<up>\\<up>\\<^sub>C \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"\\<exists>!f'. f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\n  by \n    (\n      rule is_cat_coequalizer.cat_coeq_unique_cocone\n        [\n          OF cat_coequalizer_2_is_cat_coequalizer,\n          folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def insert_commute,\n          OF assms[\n            unfolded \n              the_cf_parallel_2_def the_cat_parallel_2_def cat_eq_F'_helper\n            ]\n        ]\n    )\n\nlemma (in is_cat_coequalizer_2) cat_coeq_2_unique:\n  assumes \"\\<epsilon>' : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E' : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"\\<exists>!f'.\n    f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and>\n    \\<epsilon>' = ntcf_const (\\<up>\\<up>\\<^sub>C \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L) \\<CC> f' \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<epsilon>\"\nproof-\n  interpret \\<epsilon>': is_cat_coequalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E' \\<epsilon>' by (rule assms)\n  show ?thesis  \n    by \n      (\n        rule is_cat_coequalizer.cat_coeq_unique\n          [\n            OF cat_coequalizer_2_is_cat_coequalizer,\n            folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def,\n            OF \\<epsilon>'.cat_coequalizer_2_is_cat_coequalizer,\n            folded the_cat_parallel_2_def the_cat_parallel_2_commute\n          ]\n      )\nqed\n\nlemma (in is_cat_coequalizer_2) cat_coeq_2_unique':\n  assumes \"\\<epsilon>' : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E' : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  shows \"\\<exists>!f'. f' : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> E' \\<and> \\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = f' \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\nproof-\n  interpret \\<epsilon>': is_cat_coequalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E' \\<epsilon>' by (rule assms)\n  show ?thesis\n    by \n      (\n        rule is_cat_coequalizer.cat_coeq_unique'\n          [\n            OF cat_coequalizer_2_is_cat_coequalizer,\n            folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def,\n            OF \\<epsilon>'.cat_coequalizer_2_is_cat_coequalizer,\n            folded the_cat_parallel_2_def\n          ]\n      )\nqed\n\nlemma cat_equalizer_2_ex_is_iso_arr:\n  assumes \"\\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \n    and \"\\<epsilon>' : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  obtains f where \"f : E' \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>\\<^esub> E\"\n    and \"\\<epsilon>' = \\<epsilon> \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F ntcf_const (\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L) \\<CC> f\"\nproof-\n  interpret \\<epsilon>: is_cat_equalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E \\<epsilon> by (rule assms(1))\n  interpret \\<epsilon>': is_cat_equalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E' \\<epsilon>' by (rule assms(2))\n  show ?thesis\n    using that \n    by \n      (\n        rule cat_equalizer_ex_is_iso_arr\n          [\n            OF \n              \\<epsilon>.cat_equalizer_2_is_cat_equalizer \n              \\<epsilon>'.cat_equalizer_2_is_cat_equalizer,\n            folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def the_cat_parallel_2_def\n          ]\n      )  \nqed\n\nlemma cat_equalizer_2_ex_is_iso_arr':\n  assumes \"\\<epsilon> : E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\" \n    and \"\\<epsilon>' : E' <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>e\\<^sub>q (\\<aa>,\\<bb>,\\<gg>,\\<ff>) : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  obtains f where \"f : E' \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>\\<^esub> E\"\n    and \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\"\n    and \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> f\"\nproof-\n  interpret \\<epsilon>: is_cat_equalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E \\<epsilon> by (rule assms(1))\n  interpret \\<epsilon>': is_cat_equalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E' \\<epsilon>' by (rule assms(2))\n  show ?thesis\n    using that \n    by \n      (\n        rule cat_equalizer_ex_is_iso_arr'\n          [\n            OF \n              \\<epsilon>.cat_equalizer_2_is_cat_equalizer \n              \\<epsilon>'.cat_equalizer_2_is_cat_equalizer,\n            folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def the_cat_parallel_2_def\n          ]\n      )\nqed\n\nlemma cat_coequalizer_2_ex_is_iso_arr:\n  assumes \"\\<epsilon> : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<epsilon>' : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E' : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  obtains f where \"f : E \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>\\<^esub> E'\" \n    and \"\\<epsilon>' = ntcf_const (\\<up>\\<up>\\<^sub>C \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<ff>\\<^sub>P\\<^sub>L \\<gg>\\<^sub>P\\<^sub>L) \\<CC> f \\<bullet>\\<^sub>N\\<^sub>T\\<^sub>C\\<^sub>F \\<epsilon>\"\nproof-\n  interpret \\<epsilon>: is_cat_coequalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E \\<epsilon> by (rule assms(1))\n  interpret \\<epsilon>': is_cat_coequalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E' \\<epsilon>' by (rule assms(2))\n  show ?thesis\n    using that \n    by \n      (\n        rule cat_coequalizer_ex_is_iso_arr\n          [\n            OF \n              \\<epsilon>.cat_coequalizer_2_is_cat_coequalizer \n              \\<epsilon>'.cat_coequalizer_2_is_cat_coequalizer,\n            folded \n              \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def the_cat_parallel_2_def the_cat_parallel_2_commute\n          ]\n      )\nqed\n\nlemma cat_coequalizer_2_ex_is_iso_arr':\n  assumes \"\\<epsilon> : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n    and \"\\<epsilon>' : (\\<aa>,\\<bb>,\\<gg>,\\<ff>) >\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>e\\<^sub>q E' : \\<up>\\<up>\\<^sub>C \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n  obtains f where \"f : E \\<mapsto>\\<^sub>i\\<^sub>s\\<^sub>o\\<^bsub>\\<CC>\\<^esub> E'\" \n    and \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = f \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\n    and \"\\<epsilon>'\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> = f \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> \\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<bb>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr>\"\nproof-\n  interpret \\<epsilon>: is_cat_coequalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E \\<epsilon> by (rule assms(1))\n  interpret \\<epsilon>': is_cat_coequalizer_2 \\<alpha> \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> E' \\<epsilon>' by (rule assms(2))\n  show ?thesis\n    using that \n    by \n      (\n        rule cat_coequalizer_ex_is_iso_arr'\n          [\n            OF\n              \\<epsilon>.cat_coequalizer_2_is_cat_coequalizer\n              \\<epsilon>'.cat_coequalizer_2_is_cat_coequalizer,\n            folded \n              \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2_def the_cat_parallel_2_def the_cat_parallel_2_commute\n          ]\n      )\nqed\n\n\nsubsubsection\\<open>Further properties\\<close>\n\nlemma (in is_cat_equalizer_2) cat_eq_2_is_monic_arr: \n  \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> : E \\<mapsto>\\<^sub>m\\<^sub>o\\<^sub>n\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n  by\n    (\n      rule is_cat_equalizer.cat_eq_is_monic_arr[\n        OF cat_equalizer_2_is_cat_equalizer, folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def\n        ]\n    )\n\nlemma (in is_cat_coequalizer_2) cat_coeq_2_is_epic_arr:\n  \"\\<epsilon>\\<lparr>NTMap\\<rparr>\\<lparr>\\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\\<rparr> : \\<aa> \\<mapsto>\\<^sub>e\\<^sub>p\\<^sub>i\\<^bsub>\\<CC>\\<^esub> E\"\n  by\n    (\n      rule is_cat_coequalizer.cat_coeq_is_epic_arr[\n        OF cat_coequalizer_2_is_cat_coequalizer, folded \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2_def\n        ]\n    )\n\n\n\nsubsection\\<open>Equalizer cone\\<close>\n\n\nsubsubsection\\<open>Definition and elementary properties\\<close>\n\ndefinition ntcf_equalizer_base :: \"V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> V \\<Rightarrow> (V \\<Rightarrow> V) \\<Rightarrow> V\"\n  where \"ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e =\n    [\n      (\\<lambda>x\\<in>\\<^sub>\\<circ>\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L\\<lparr>Obj\\<rparr>. e x),\n      cf_const (\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L) \\<CC> E,\n      \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff>,\n      \\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L,\n      \\<CC>\n    ]\\<^sub>\\<circ>\"\n\n\ntext\\<open>Components.\\<close>\n\nlemma ntcf_equalizer_base_components:\n  shows \"ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e\\<lparr>NTMap\\<rparr> =\n    (\\<lambda>x\\<in>\\<^sub>\\<circ>\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L\\<lparr>Obj\\<rparr>. e x)\"\n    and [cat_lim_cs_simps]: \"ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e\\<lparr>NTDom\\<rparr> =\n      cf_const (\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L) \\<CC> E\"\n    and [cat_lim_cs_simps]: \"ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e\\<lparr>NTCod\\<rparr> =\n      \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff>\"\n    and [cat_lim_cs_simps]: \n      \"ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e\\<lparr>NTDGDom\\<rparr> = \\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L\"\n    and [cat_lim_cs_simps]: \n      \"ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e\\<lparr>NTDGCod\\<rparr> = \\<CC>\"\n  unfolding ntcf_equalizer_base_def nt_field_simps \n  by (simp_all add: nat_omega_simps)\n\n\nsubsubsection\\<open>Natural transformation map\\<close>\n\nmk_VLambda ntcf_equalizer_base_components(1)\n  |vsv ntcf_equalizer_base_NTMap_vsv[cat_lim_cs_intros]|\n  |vdomain ntcf_equalizer_base_NTMap_vdomain[cat_lim_cs_simps]|\n  |app ntcf_equalizer_base_NTMap_app[cat_lim_cs_simps]|\n\n\nsubsubsection\\<open>Equalizer cone is a cone\\<close>\n\nlemma (in category) cat_ntcf_equalizer_base_is_cat_cone:\n  assumes \"e \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<aa>\"\n    and \"e \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 : E \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n    and \"e \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 = \\<gg> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> e \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\"\n    and \"e \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 = \\<ff> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub> e \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2\"\n    and \"\\<gg> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n    and \"\\<ff> : \\<aa> \\<mapsto>\\<^bsub>\\<CC>\\<^esub> \\<bb>\"\n  shows \"ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e :\n    E <\\<^sub>C\\<^sub>F\\<^sub>.\\<^sub>c\\<^sub>o\\<^sub>n\\<^sub>e \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff> :\n    \\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\nproof-\n  interpret par: cf_parallel_2 \\<alpha> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff> \\<CC> \n    by (intro cf_parallel_2I cat_parallel_2I assms(5,6))\n      (simp_all add: cat_parallel_cs_intros cat_cs_intros)\n  show ?thesis\n  proof(intro is_cat_coneI is_tm_ntcfI' is_ntcfI')\n    show \"vfsequence (ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e)\"\n      unfolding ntcf_equalizer_base_def by auto\n    show \"vcard (ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e) = 5\\<^sub>\\<nat>\"\n      unfolding ntcf_equalizer_base_def by (simp add: nat_omega_simps)\n    from assms(2) show \n      \"cf_const (\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L) \\<CC> E : \\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n      by \n        (\n          cs_concl \n            cs_simp: cat_cs_simps \n            cs_intro: cat_small_cs_intros cat_parallel_cs_intros cat_cs_intros\n        )\n    from assms show \n      \"\\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff> : \\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<mapsto>\\<mapsto>\\<^sub>C\\<^bsub>\\<alpha>\\<^esub> \\<CC>\"\n      by (cs_concl cs_intro: cat_parallel_cs_intros cat_small_cs_intros)\n    show \n      \"ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e\\<lparr>NTMap\\<rparr>\\<lparr>i\\<rparr> :\n        cf_const (\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L) \\<CC> E\\<lparr>ObjMap\\<rparr>\\<lparr>i\\<rparr> \\<mapsto>\\<^bsub>\\<CC>\\<^esub>\n        \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff>\\<lparr>ObjMap\\<rparr>\\<lparr>i\\<rparr>\"\n      if \"i \\<in>\\<^sub>\\<circ> \\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L\\<lparr>Obj\\<rparr>\" for i \n    proof-\n      from that assms(1,2,5,6) show ?thesis\n        by (elim the_cat_parallel_2_ObjE; simp only:)\n          ( \n            cs_concl \n              cs_simp: cat_lim_cs_simps cat_cs_simps cat_parallel_cs_simps \n              cs_intro: cat_cs_intros cat_parallel_cs_intros\n          )\n    qed\n    show \n      \"ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e\\<lparr>NTMap\\<rparr>\\<lparr>b'\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub>\n        cf_const (\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L) \\<CC> E\\<lparr>ArrMap\\<rparr>\\<lparr>f'\\<rparr> =\n          \\<up>\\<up>\\<rightarrow>\\<up>\\<up>\\<^sub>C\\<^sub>F \\<CC> \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L \\<aa> \\<bb> \\<gg> \\<ff>\\<lparr>ArrMap\\<rparr>\\<lparr>f'\\<rparr> \\<circ>\\<^sub>A\\<^bsub>\\<CC>\\<^esub>\n          ntcf_equalizer_base \\<CC> \\<aa> \\<bb> \\<gg> \\<ff> E e\\<lparr>NTMap\\<rparr>\\<lparr>a'\\<rparr>\"\n      if \"f' : a' \\<mapsto>\\<^bsub>\\<up>\\<up>\\<^sub>C \\<aa>\\<^sub>P\\<^sub>L\\<^sub>2 \\<bb>\\<^sub>P\\<^sub>L\\<^sub>2 \\<gg>\\<^sub>P\\<^sub>L \\<ff>\\<^sub>P\\<^sub>L\\<^esub> b'\" for a' b' f'\n      using that assms(1,2,5,6)\n      by (elim par.the_cat_parallel_2_is_arrE; simp only:)\n        (\n          cs_concl \n            cs_simp: \n              cat_cs_simps \n              cat_lim_cs_simps \n              cat_parallel_cs_simps \n              assms(3,4)[symmetric]\n            cs_intro: cat_parallel_cs_intros\n        )+\n  qed \n    (\n      use assms(2) in \n        \\<open>\n          cs_concl \n            cs_intro: cat_lim_cs_intros cat_cs_intros \n            cs_simp: cat_lim_cs_simps\n        \\<close>\n    )+\nqed\n\ntext\\<open>\\newpage\\<close>\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CZH_Universal_Constructions/czh_ucategories/CZH_UCAT_Limit_Equalizer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883592602051, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.30712634938359595}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |                    May 2005               |\n            |                   June 2005  (modified)   |\n            |              September 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |               November 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_law_alpha_par\nimports CSP_F_op_alpha_par CSP_F_law_decompo CSP_T_law_alpha_par\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n\n\n(*****************************************************************\n\n         1. associativity of |[X,Y]|\n         2. commutativity of |[X,Y]|\n         3. monotonicity of |[X,Y]|\n         4. \n\n *****************************************************************)\n\n(*********************************************************\n                        P |[X,Y]| Q\n *********************************************************)\n\n(************************************\n |         SKIP and SKIP            |\n ************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_SKIP_Alpha_parallel:\n  \"(SKIP |[{}, {}]| SKIP) =F[M1,M2] SKIP\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_SKIP_Alpha_parallel)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (elim conjE exE)\n\n apply (simp add: in_failures)\n apply (elim disjE)\n apply (simp_all)\n apply (simp add: Evset_def)\n apply (subgoal_tac \"(s = <> | s = <Tick>)\")\n apply (erule disjE)\n apply (simp)\n apply (fast)\n apply (simp)\n apply (simp add: sett_subset_Tick)\n\n apply (subgoal_tac \"(s = <> | s = <Tick>)\")\n apply (erule disjE)\n apply (simp)\n apply (simp)\n apply (simp add: sett_subset_Tick)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (rule_tac x=\"X\" in exI)\n apply (rule_tac x=\"X\" in exI)\n apply (simp)\n\n apply (simp add: in_failures)\n apply (auto)\ndone\n\n(************************************\n |          associativity           |\n ************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Alpha_parallel_ass_lm1:\n          \"Ya Int insert Tick (Ev ` X1) Un\n          (Za Int insert Tick (Ev ` X2) Un Z Int insert Tick (Ev ` X3)) =\n           Ya Int insert Tick (Ev ` X1) Un\n           (Za Int insert Tick (Ev ` X2) Un Z Int insert Tick (Ev ` X3)) Int\n           insert Tick (Ev ` (X2 Un X3))\"\nby (auto)\n\nlemma cspF_Alpha_parallel_assoc:\n  \"(P1 |[X1, X2]| P2) |[X1 Un X2, X3]| P3 =F[M,M]\n   P1 |[X1, X2 Un X3]| (P2 |[X2, X3]| P3)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Alpha_parallel_assoc)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (elim conjE exE)\n apply (simp add: Un_upper1 Un_upper2 rest_tr_of_rest_tr_subset)\n apply (rule_tac x=\"Ya\" in exI, simp)\n apply (rule_tac x=\"(Za Int insert Tick (Ev ` X2)) Un \n                     (Z Int insert Tick (Ev ` X3))\" in exI)\n apply (simp add: Un_assoc)\n apply (simp add: cspF_Alpha_parallel_ass_lm1)\n\n apply (rule_tac x=\"Za\" in exI, simp)\n apply (rule_tac x=\"Z\" in exI, simp)\n apply (force)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (elim conjE exE)\n apply (simp add: Un_upper1 Un_upper2 rest_tr_of_rest_tr_subset)\n apply (rule_tac x=\"Y Int insert Tick (Ev ` X1) Un\n                  (Ya Int insert Tick (Ev ` X2))\" in exI)\n apply (rule_tac x=\"Za\" in exI)\n apply (simp add: Un_assoc)\n apply (rule conjI)\n apply (fast)\n\n apply (rule_tac x=\"Y\" in exI, simp)\n apply (rule_tac x=\"Ya\" in exI, simp)\n apply (force)\ndone\n\nlemma cspF_Alpha_parallel_assoc_sym:\n  \"P1 |[X1, X2 Un X3]| (P2 |[X2, X3]| P3) =F[M,M]\n   (P1 |[X1, X2]| P2) |[X1 Un X2, X3]| P3\"\napply (rule cspF_sym)\nby (simp add: cspF_Alpha_parallel_assoc)\n\n(************************************\n |          commutativity           |\n ************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Alpha_parallel_commut:\n  \"(P1 |[X1, X2]| P2) =F[M,M] (P2 |[X2, X1]| P1)\"\napply (simp add: cspF_cspT_semantics)\napply (simp add: cspT_Alpha_parallel_commut)\napply (rule order_antisym)\n\n(* => *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (elim conjE exE)\n apply (rule_tac x=\"Z\" in exI)\n apply (rule_tac x=\"Y\" in exI)\n apply (simp add: Un_sym)\n\n(* <= *)\n apply (rule)\n apply (simp add: in_failures_Alpha_parallel)\n apply (elim conjE exE)\n apply (rule_tac x=\"Z\" in exI)\n apply (rule_tac x=\"Y\" in exI)\n apply (simp add: Un_sym)\ndone\n\n(************************************\n |          monotonicity            |\n ************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\nlemma cspF_Alpha_parallel_mono:\n  \"[| X1 = X2 ; Y1 = Y2 ;\n      P1 <=F[M1,M2] Q1 ; \n      P2 <=F[M1,M2] Q2 |]\n           ==> P1 |[X1,Y1]| P2 <=F[M1,M2] Q1 |[X2,Y2]| Q2\"\napply (simp add: Alpha_parallel_def)\napply (simp add: cspF_Parallel_mono)\ndone\n\nlemma cspF_Alpha_parallel_cong:\n  \"[| X1 = X2 ; Y1 = Y2 ;\n      P1 =F[M1,M2] Q1 ; \n      P2 =F[M1,M2] Q2 |]\n           ==> P1 |[X1,Y1]| P2 =F[M1,M2] Q1 |[X2,Y2]| Q2\"\nby (simp add: cspF_eq_ref_iff cspF_Alpha_parallel_mono)\n\nlemmas cspF_decompo_Alpha_parallel = cspF_Alpha_parallel_mono\n                                     cspF_Alpha_parallel_cong\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\nend\n\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_F/CSP_F_law_alpha_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6442251201477016, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.30702458296644636}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Strong_Early_Bisim_Subst_SC\n  imports Strong_Early_Bisim Strong_Late_Bisim_Subst_SC Strong_Early_Late_Comp\nbegin\n\n(******** Structural Congruence **********)\n\n(******** The \\<nu>-operator *****************)\n\nlemma resComm:\n  fixes P :: pi\n  \n  shows \"<\\<nu>a><\\<nu>b>P \\<sim>\\<^sup>s\\<^sub>e <\\<nu>b><\\<nu>a>P\"\nproof -\n  have \"<\\<nu>a><\\<nu>b>P \\<sim>\\<^sup>s\\<^sub>l <\\<nu>b><\\<nu>a>P\"\n    by(rule Strong_Late_Bisim_Subst_SC.resComm)\n  thus ?thesis by(rule lateEarlyCong) \nqed\n\n(******** The Match *********)\n\nlemma matchId:\n  fixes a :: name\n  and   P :: pi\n\n  shows \"[a\\<frown>a]P \\<sim>\\<^sup>s\\<^sub>e P\"\nproof -\n  have \"[a\\<frown>a]P \\<sim>\\<^sup>s\\<^sub>l P\" by(rule Strong_Late_Bisim_Subst_SC.matchId)\n  thus ?thesis by(rule lateEarlyCong)\nqed\n\n(******** Mismatch *********)\n\n\n\n(******** The +-operator *********)\n\nlemma sumSym:\n  fixes P :: pi\n  and   Q :: pi\n  \n  shows \"P \\<oplus> Q \\<sim>\\<^sup>s\\<^sub>e Q \\<oplus> P\"\nproof -\n  have \"P \\<oplus> Q \\<sim>\\<^sup>s\\<^sub>l Q \\<oplus> P\" by(rule Strong_Late_Bisim_Subst_SC.sumSym)\n  thus ?thesis by(rule lateEarlyCong)\nqed\n\n\n\n\n\n(******** The |-operator *********)\n\nlemma parZero:\n  fixes P :: pi\n\n  shows \"P \\<parallel> \\<zero> \\<sim>\\<^sup>s\\<^sub>e P\"\nproof -\n  have \"P \\<parallel> \\<zero> \\<sim>\\<^sup>s\\<^sub>l P\" by(rule Strong_Late_Bisim_Subst_SC.parZero)\n  thus ?thesis by(rule lateEarlyCong)\nqed\n\nlemma parSym:\n  fixes P :: pi\n  and   Q :: pi\n\n  shows \"P \\<parallel> Q \\<sim>\\<^sup>s\\<^sub>e Q \\<parallel> P\"\nproof -\n  have \"P \\<parallel> Q \\<sim>\\<^sup>s\\<^sub>l Q \\<parallel> P\" by(rule Strong_Late_Bisim_Subst_SC.parSym)\n  thus ?thesis by(rule lateEarlyCong)\nqed\n\n\n\n  assumes \"x \\<sharp> P\"\n\n  shows \"<\\<nu>x>(P \\<parallel> Q) \\<sim>\\<^sup>s\\<^sub>e P \\<parallel> <\\<nu>x>Q\"\nproof -\n  from \\<open>x \\<sharp> P\\<close> have \"<\\<nu>x>(P \\<parallel> Q) \\<sim>\\<^sup>s\\<^sub>l P \\<parallel> <\\<nu>x>Q\" by(rule Strong_Late_Bisim_Subst_SC.scopeExtPar)\n  thus ?thesis by(rule lateEarlyCong)\nqed\n\nlemma scopeExtPar':\n  fixes P :: pi\n  and   Q :: pi\n  and   x :: name\n\n  assumes xFreshQ: \"x \\<sharp> Q\"\n\n  shows \"<\\<nu>x>(P \\<parallel> Q) \\<sim>\\<^sup>s\\<^sub>e (<\\<nu>x>P) \\<parallel> Q\"\nproof -\n  from \\<open>x \\<sharp> Q\\<close> have \"<\\<nu>x>(P \\<parallel> Q) \\<sim>\\<^sup>s\\<^sub>l (<\\<nu>x>P) \\<parallel> Q\" by(rule Strong_Late_Bisim_Subst_SC.scopeExtPar')\n  thus ?thesis by(rule lateEarlyCong)\nqed\n\n\n\n  shows \"(P \\<parallel> Q) \\<parallel> R \\<sim>\\<^sup>s\\<^sub>e P \\<parallel> (Q \\<parallel> R)\"\nproof -\n  have \"(P \\<parallel> Q) \\<parallel> R \\<sim>\\<^sup>s\\<^sub>l P \\<parallel> (Q \\<parallel> R)\" by(rule Strong_Late_Bisim_Subst_SC.parAssoc)\n  thus ?thesis by(rule lateEarlyCong)\nqed\n\nlemma freshRes:\n  fixes P :: pi\n  and   a :: name\n\n  assumes a \\<sharp> P\"\n\n  shows \"<\\<nu>a>P \\<sim>\\<^sup>s\\<^sub>e P\"\nproof -\n  from a \\<sharp> P` have \"<\\<nu>a>P \\<sim>\\<^sup>s\\<^sub>l P\" by(rule Strong_Late_Bisim_Subst_SC.freshRes)\n  thus ?thesis by(rule lateEarlyCong)\nqed\n\nlemma scopeExtSum:\n  fixes P :: pi\n  and   Q :: pi\n  and   x :: name\n  \n  assumes \"x \\<sharp> P\"\n\n  shows \"<\\<nu>x>(P \\<oplus> Q) \\<sim>\\<^sup>s\\<^sub>e P \\<oplus> <\\<nu>x>Q\"\nproof -\n  from `x \\<sharp> P` have \"<\\<nu>x>(P \\<oplus> Q) \\<sim>\\<^sup>s\\<^sub>l P \\<oplus> <\\<nu>x>Q\" by(rule Strong_Late_Bisim_Subst_SC.scopeExtSum)\n  thus ?thesis by(rule lateEarlyCong)\nqed\n\nlemma bangSC:\n  fixes P\n\n  shows \"!P \\<sim>\\<^sup>s\\<^sub>e P \\<parallel> !P\"\nproof -\n  have \"!P \\<sim>\\<^sup>s\\<^sub>l P \\<parallel> !P\" by(rule Strong_Late_Bisim_Subst_SC.bangSC)\n  thus ?thesis by(rule lateEarlyCong)\nqed\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Strong_Early_Bisim_Subst_SC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442250928250375, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.3070245699450206}}
{"text": "theory flash22Bra  imports flash22Rev\n \n  begin\nlemma onInv22:\n\n   assumes  a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv3 \\<le> N\" and  a4:\"iInv1~=iInv2  \" and  a5:\"iInv1~=iInv3  \" and  a6:\"iInv2~=iInv3  \" and \n\n     b1:\"r \\<in> rules N\" and b2:\"invf=inv22  iInv1  iInv2  iInv3 \"\n   shows  \"invHoldForRule' s invf r (invariants   N)\" \n   proof - \nhave c1:\"ex1P N (% iRule1 .  r=NI_Local_GetX_PutX1 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_GetX  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Replace  iRule1 )\\<or>ex0P N (  r=NI_ShWb N )\\<or>ex0P N (  r=PI_Local_GetX_GetX2 )\\<or>ex0P N (  r=NI_Local_PutXAcksDone )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX7 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak2  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHomeShrVld )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Put  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX5 N  iRule1 )\\<or>ex0P N (  r=NI_Wb )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Get  iRule1 )\\<or>ex0P N (  r=PI_Local_Replace )\\<or>ex1P N (% iRule1 .  r=NI_ReplaceShrVld  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX8 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_2 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Nak2  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Replace  iRule1 )\\<or>ex0P N (  r=NI_Nak_Home )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put2  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_InvAck_1  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX11 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX6 N  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_Get_Put2  iRule1  iRule2 )\\<or>ex0P N (  r=PI_Local_Get_Put )\\<or>ex0P N (  r=PI_Local_GetX_PutX1 N )\\<or>ex1P N (% iRule1 .  r=NI_InvAck_1_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak2  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX10_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_Get  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak3  iRule1 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Local_GetX_PutX10 N  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX2 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_Get_Put1  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_PutX  iRule1 )\\<or>ex1P N (% iRule1 .  r=Store  iRule1 )\\<or>ex0P N (  r=NI_FAck )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX3 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX3 )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_PutX  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX8_home N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put1 N  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_GetX1 )\\<or>ex0P N (  r=StoreHome )\\<or>ex2P N (% iRule1  iRule2 .  r=NI_Remote_GetX_Nak  iRule1  iRule2 )\\<or>ex1P N (% iRule1 .  r=NI_Inv  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_PutX  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX4 )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX4 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Nak  iRule1 )\\<or>ex0P N (  r=PI_Local_GetX_PutX2 N )\\<or>ex0P N (  r=NI_Local_Put )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_Nak1  iRule1 )\\<or>ex0P N (  r=NI_Nak_Clear )\\<or>ex0P N (  r=PI_Local_PutX )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Nak3  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_Nak_Home  iRule1 )\\<or>ex0P N (  r=PI_Local_Get_Get )\\<or>ex1P N (% iRule1 .  r=NI_Local_GetX_PutX9 N  iRule1 )\\<or>ex1P N (% iRule1 .  r=PI_Remote_GetX  iRule1 )\\<or>ex0P N (  r=NI_ReplaceHome )\\<or>ex1P N (% iRule1 .  r=NI_Remote_GetX_PutX_Home  iRule1 )\\<or>ex1P N (% iRule1 .  r=NI_Local_Get_Put3  iRule1 )\" \n\n        apply(cut_tac  b1)\n        apply auto\n        done      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX1VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_GetXVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ShWb N )\n\"\n         \n         from c1 have c2:\" r= NI_ShWb N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_ShWb N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ShWbVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX2 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX2 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX2 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX2VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_PutXAcksDone )\n\"\n         \n         from c1 have c2:\" r= NI_Local_PutXAcksDone \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_PutXAcksDone ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutXAcksDoneVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX7 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX7 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX7VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak2VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHomeShrVld )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHomeShrVld \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_ReplaceHomeShrVld ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeShrVldVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Put  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Put  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Remote_Put  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX5 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX5 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX5VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Wb )\n\"\n         \n         from c1 have c2:\" r= NI_Wb \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Wb ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_WbVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_Get_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_GetVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Replace )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Replace \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Local_Replace ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_ReplaceVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_ReplaceShrVld  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_ReplaceShrVld  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_ReplaceShrVld  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_ReplaceShrVldVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX8 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_InvAck_2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_2VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Nak2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Nak2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak2VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Replace  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Replace  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Remote_Replace  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_ReplaceVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Home )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Home \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Nak_Home ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_HomeVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put2VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_InvAck_1  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_InvAck_1  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX11 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX11 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX11VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX6 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX6 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX6VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_Get_Put2  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_Get_Put2  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put2VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Put )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Local_Get_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_PutVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX1 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX1 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX1 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX1VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_InvAck_1_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_InvAck_1_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_InvAck_1_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvAck_1_HomeVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Nak1VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak1VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak2  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak2  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak2VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX10_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX10_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10_homeVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_Get  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_Get  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Remote_Get  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak3VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Local_GetX_PutX10 N  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX10VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX2 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX2 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX2VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_Get_Put1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_Get_Put1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Remote_Get_Put1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_Get_Put1VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_PutXVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= Store  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= Store  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (Store  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis StoreVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_FAck )\n\"\n         \n         from c1 have c2:\" r= NI_FAck \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_FAck ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_FAckVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX3 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX3 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX3VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX3 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX3 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX3 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX3VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_PutX  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_PutX  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutXVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX8_home N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX8_home N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX8_homeVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put1 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put1 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put1VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_GetX1 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_GetX1 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Local_GetX_GetX1 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_GetX1VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= StoreHome )\n\"\n         \n         from c1 have c2:\" r= StoreHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (StoreHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis StoreHomeVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex2P N (% iRule1  iRule2 .  r= NI_Remote_GetX_Nak  iRule1  iRule2 )\n\"\n         \n         from c1 obtain  iRule1  iRule2  where c2:\"  iRule1~=iRule2    \\<and>   iRule1 \\<le> N \\<and>   iRule2 \\<le> N \\<and>  r= NI_Remote_GetX_Nak  iRule1  iRule2 \" \n         by (auto simp add: ex2P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_NakVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Inv  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Inv  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Inv  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_InvVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_PutX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_PutX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Remote_PutX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_PutXVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX4 )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX4 \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX4 ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX4VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX4 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX4 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX4VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Nak  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Nak  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Nak  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_NakVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_GetX_PutX2 N )\n\"\n         \n         from c1 have c2:\" r= PI_Local_GetX_PutX2 N \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Local_GetX_PutX2 N ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_GetX_PutX2VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= NI_Local_Put )\n\"\n         \n         from c1 have c2:\" r= NI_Local_Put \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_Put ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Local_PutVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_Nak1  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_Nak1  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_Nak1VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_Nak_Clear )\n\"\n         \n         from c1 have c2:\" r= NI_Nak_Clear \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Nak_Clear ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_Nak_ClearVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_PutX )\n\"\n         \n         from c1 have c2:\" r= PI_Local_PutX \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Local_PutX ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_PutXVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Nak3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Nak3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_Get_Nak3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Nak3VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_Nak_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_Nak_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_Nak_HomeVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= PI_Local_Get_Get )\n\"\n         \n         from c1 have c2:\" r= PI_Local_Get_Get \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Local_Get_Get ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis PI_Local_Get_GetVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_GetX_PutX9 N  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_GetX_PutX9 N  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_GetX_PutX9VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= PI_Remote_GetX  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= PI_Remote_GetX  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (PI_Remote_GetX  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis PI_Remote_GetXVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex0P N (  r= NI_ReplaceHome )\n\"\n         \n         from c1 have c2:\" r= NI_ReplaceHome \" \n         by (auto simp add: ex0P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_ReplaceHome ) (invariants N) \"\n            apply(cut_tac   a1  a2  a3  a4  a5  a6   b2 c2 )\n            by (metis NI_ReplaceHomeVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n\t}      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Remote_GetX_PutX_Home  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Remote_GetX_PutX_Home  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Remote_GetX_PutX_HomeVsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }      moreover\n        {assume c1: \"ex1P N (% iRule1 .  r= NI_Local_Get_Put3  iRule1 )\n\"\n         \n         from c1 obtain  iRule1  where c2:\"  iRule1 \\<le> N \\<and>  r= NI_Local_Get_Put3  iRule1 \" \n         by (auto simp add: ex1P_def)\n         \n         have \"invHoldForRule' s (inv22  iInv1  iInv2  iInv3 ) (NI_Local_Get_Put3  iRule1 ) (invariants N) \"\n            apply(cut_tac  c2   a1  a2  a3  a4  a5  a6 )\n            by (metis NI_Local_Get_Put3VsInv22 ) \n          then have \"invHoldForRule' s invf r (invariants N) \"\n            by(cut_tac c2 b2, metis) \n        }ultimately show \"invHoldForRule' s invf r (invariants N) \"\n          by blast \n     qed\nend", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash22Bra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947425132314, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.30700851671701035}}
{"text": "(*  Title:      JinjaDCI/BV/LBVJVM.thy\n\n    Author:     Tobias Nipkow, Gerwin Klein, Susannah Mansky\n    Copyright   2000 TUM, 2020 UIUC\n\n    Based on the Jinja theory BV/LBVJVM.thy by Tobias Nipkow and Gerwin Klein\n*)\n\nsection \\<open> LBV for the JVM \\label{sec:JVM} \\<close>\n\ntheory LBVJVM\nimports \"../DFA/Abstract_BV\" TF_JVM\nbegin\n\ntype_synonym prog_cert = \"cname \\<Rightarrow> mname \\<Rightarrow> ty\\<^sub>i' err list\"\n\ndefinition check_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> bool\"\nwhere\n  \"check_cert P mxs mxl n cert \\<equiv> check_types P mxs mxl cert \\<and> size cert = n+1 \\<and>\n                                 (\\<forall>i<n. cert!i \\<noteq> Err) \\<and> cert!n = OK None\"\n\ndefinition lbvjvm :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> \n             ty\\<^sub>i' err list \\<Rightarrow> instr list \\<Rightarrow> ty\\<^sub>i' err \\<Rightarrow> ty\\<^sub>i' err\"\nwhere\n  \"lbvjvm P mxs maxr T\\<^sub>r et cert bs \\<equiv>\n  wtl_inst_list bs cert (JVM_SemiType.sup P mxs maxr) (JVM_SemiType.le P mxs maxr) Err (OK None) (exec P mxs T\\<^sub>r et bs) 0\"\n\ndefinition wt_lbv :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> staticb \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n             ex_table \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> instr list \\<Rightarrow> bool\"\nwhere\n  \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 et cert ins \\<equiv>\n   check_cert P mxs ((case b of Static \\<Rightarrow> 0 | NonStatic \\<Rightarrow> 1)+size Ts+mxl\\<^sub>0) (size ins) cert \\<and>\n   0 < size ins \\<and> \n   (let start  = Some ([],(case b of Static \\<Rightarrow> [] | NonStatic \\<Rightarrow> [OK (Class C)])\n                            @((map OK Ts))@(replicate mxl\\<^sub>0 Err));\n        result = lbvjvm P mxs ((case b of Static \\<Rightarrow> 0 | NonStatic \\<Rightarrow> 1)+size Ts+mxl\\<^sub>0) T\\<^sub>r et cert ins (OK start)\n    in result \\<noteq> Err)\"\n\ndefinition wt_jvm_prog_lbv :: \"jvm_prog \\<Rightarrow> prog_cert \\<Rightarrow> bool\"\nwhere\n  \"wt_jvm_prog_lbv P cert \\<equiv>\n  wf_prog (\\<lambda>P C (mn,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)). wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 et (cert C mn) ins) P\"\n\ndefinition mk_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> ex_table \\<Rightarrow> instr list \n              \\<Rightarrow> ty\\<^sub>m \\<Rightarrow> ty\\<^sub>i' err list\"\nwhere\n  \"mk_cert P mxs T\\<^sub>r et bs phi \\<equiv> make_cert (exec P mxs T\\<^sub>r et bs) (map OK phi) (OK None)\"\n\ndefinition prg_cert :: \"jvm_prog \\<Rightarrow> ty\\<^sub>P \\<Rightarrow> prog_cert\"\nwhere\n  \"prg_cert P phi C mn \\<equiv> let (C,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,ins,et)) = method P C mn\n                         in  mk_cert P mxs T\\<^sub>r et ins (phi C mn)\"\n   \nlemma check_certD [intro?]:\n  \"check_cert P mxs mxl n cert \\<Longrightarrow> cert_ok cert n Err (OK None) (states P mxs mxl)\"\n  by (unfold cert_ok_def check_cert_def check_types_def) auto\n\n\nlemma (in start_context) wt_lbv_wt_step:\n  assumes lbv: \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"\n  shows \"\\<exists>\\<tau>s \\<in> list (size is) A. wt_step r Err step \\<tau>s \\<and> OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\"\n(*<*)\nproof -\n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover note bounded_step\n  moreover from lbv have \"cert_ok cert (size is) Err (OK None) A\"\n    by (unfold wt_lbv_def) (auto dest: check_certD)\n  moreover note exec_pres_type\n  moreover\n  from lbv \n  have \"wtl_inst_list is cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (cases b; simp add: wt_lbv_def lbvjvm_def step_def_exec [symmetric])\n  moreover note first_in_A\n  moreover from lbv have \"0 < size is\" by (simp add: wt_lbv_def)\n  ultimately show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])\nqed\n(*>*)\n\n\nlemma (in start_context) wt_lbv_wt_method:\n  assumes lbv: \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\"  \n  shows \"\\<exists>\\<tau>s. wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n(*<*)\nproof -\n  from lbv have l: \"is \\<noteq> []\" by (simp add: wt_lbv_def)\n  moreover\n  from wf lbv C Ts obtain \\<tau>s where \n    list:  \"\\<tau>s \\<in> list (size is) A\" and\n    step:  \"wt_step r Err step \\<tau>s\" and    \n    start: \"OK first \\<sqsubseteq>\\<^sub>r \\<tau>s!0\" \n    by (blast dest: wt_lbv_wt_step)\n  from list have [simp]: \"size \\<tau>s = size is\" by simp\n  have \"size (map ok_val \\<tau>s) = size is\" by simp  \n  moreover from l have 0: \"0 < size \\<tau>s\" by simp\n  with step obtain \\<tau>s0 where \"\\<tau>s!0 = OK \\<tau>s0\"\n    by (unfold wt_step_def) blast\n  with start 0 have \"wt_start P C b Ts mxl\\<^sub>0 (map ok_val \\<tau>s)\"\n    by (cases b; simp add: wt_start_def JVM_le_Err_conv lesub_def Err.le_def)    \n  moreover {\n    from list have \"check_types P mxs mxl \\<tau>s\" by (simp add: check_types_def)\n    also from step  have \"\\<forall>x \\<in> set \\<tau>s. x \\<noteq> Err\" \n      by (auto simp add: all_set_conv_all_nth wt_step_def)    \n    hence [symmetric]: \"map OK (map ok_val \\<tau>s) = \\<tau>s\"\n      by (auto intro!: map_idI)\n    finally have \"check_types P mxs mxl (map OK (map ok_val \\<tau>s))\" .\n  }\n  moreover {  \n    note bounded_step\n    moreover from list have \"set \\<tau>s \\<subseteq> A\" by simp\n    moreover from step have \"wt_err_step (sup_state_opt P) step \\<tau>s\"\n      by (simp add: wt_err_step_def JVM_le_Err_conv)\n    ultimately have \"wt_app_eff (sup_state_opt P) app eff (map ok_val \\<tau>s)\"\n      by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def states_def)\n  }    \n  ultimately have \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (map ok_val \\<tau>s)\"\n    by (simp add: wt_method_def2 check_types_def del: map_map)\n  thus ?thesis ..\nqed\n(*>*)\n\n  \nlemma (in start_context) wt_method_wt_lbv:\n  assumes wt: \"wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\" \n  defines [simp]: \"cert \\<equiv> mk_cert P mxs T\\<^sub>r xt is \\<tau>s\"\n  \n  shows \"wt_lbv P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 xt cert is\" \n(*<*)\nproof -\n  let ?\\<tau>s  = \"map OK \\<tau>s\"\n  let ?cert = \"make_cert step ?\\<tau>s (OK None)\"\n\n  from wt obtain \n    0:        \"0 < size is\" and\n    size:     \"size is = size ?\\<tau>s\" and\n    ck_types: \"check_types P mxs mxl ?\\<tau>s\" and\n    wt_start: \"wt_start P C b Ts mxl\\<^sub>0 \\<tau>s\" and\n    app_eff:  \"wt_app_eff (sup_state_opt P) app eff \\<tau>s\"\n    by (force simp add: wt_method_def2 check_types_def) \n  \n  from wf have \"semilat (JVM_SemiType.sl P mxs mxl)\" ..\n  hence \"semilat (A, r, f)\" by (simp add: sl_def2)\n  moreover have \"top r Err\" by (simp add: JVM_le_Err_conv)\n  moreover have \"Err \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover have \"bottom r (OK None)\" \n    by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)\n  moreover have \"OK None \\<in> A\" by (simp add: JVM_states_unfold)\n  moreover from wf have \"mono r step (size is) A\" by (rule step_mono)\n  hence \"mono r step (size ?\\<tau>s) A\" by (simp add: size)\n  moreover from exec_pres_type \n  have \"pres_type step (size ?\\<tau>s) A\" by (simp add: size) \n  moreover\n  from ck_types have \\<tau>s_in_A: \"set ?\\<tau>s \\<subseteq> A\" by (simp add: check_types_def)\n  hence \"\\<forall>pc. pc < size ?\\<tau>s \\<longrightarrow> ?\\<tau>s!pc \\<in> A \\<and> ?\\<tau>s!pc \\<noteq> Err\" by auto\n  moreover from bounded_step \n  have \"bounded step (size ?\\<tau>s)\" by (simp add: size)\n  moreover have \"OK None \\<noteq> Err\" by simp\n  moreover from bounded_step size \\<tau>s_in_A app_eff\n  have \"wt_err_step (sup_state_opt P) step ?\\<tau>s\"\n    by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def states_def)    \n  hence \"wt_step r Err step ?\\<tau>s\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  moreover\n  from 0 size have \"0 < size \\<tau>s\" by auto\n  hence \"?\\<tau>s!0 = OK (\\<tau>s!0)\" by simp\n  with wt_start have \"OK first \\<sqsubseteq>\\<^sub>r ?\\<tau>s!0\"\n    by (cases b; clarsimp simp add: wt_start_def lesub_def Err.le_def JVM_le_Err_conv)\n  moreover note first_in_A\n  moreover have \"OK first \\<noteq> Err\" by simp\n  moreover note size \n  ultimately\n  have \"wtl_inst_list is ?cert f r Err (OK None) step 0 (OK first) \\<noteq> Err\"\n    by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])\n  moreover from 0 size have \"\\<tau>s \\<noteq> []\" by auto\n  moreover from ck_types have \"check_types P mxs mxl ?cert\"\n    apply (auto simp add: make_cert_def check_types_def JVM_states_unfold)\n    apply (subst Ok_in_err [symmetric])\n    apply (drule nth_mem)\n    apply auto\n    done\n  moreover note 0 size\n  ultimately show ?thesis \n    by (simp add: wt_lbv_def lbvjvm_def mk_cert_def step_def_exec [symmetric]\n                  check_cert_def make_cert_def nth_append)\nqed  \n(*>*)\n\n\ntheorem jvm_lbv_correct:\n  \"wt_jvm_prog_lbv P Cert \\<Longrightarrow> wf_jvm_prog P\"\n(*<*)\nproof -  \n  let ?\\<Phi> = \"\\<lambda>C mn. let (C,b,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)) = method P C mn in \n              SOME \\<tau>s. wt_method P C b Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s\"\n    \n  assume wt: \"wt_jvm_prog_lbv P Cert\"\n  hence \"wf_jvm_prog\\<^bsub>?\\<Phi>\\<^esub> P\"\n    apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def) \n    apply (erule wf_prog_lift)\n    apply (auto dest!: start_context.wt_lbv_wt_method [OF start_context.intro] \n                intro: someI)\n    apply (erule sees_method_is_class)\n    done\n  thus ?thesis by (unfold wf_jvm_prog_def) blast\nqed\n(*>*)\n\ntheorem jvm_lbv_complete:\n  assumes wt: \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\" \n  shows \"wt_jvm_prog_lbv P (prg_cert P \\<Phi>)\"\n(*<*)\n  using wt\n  apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def)\n  apply (erule wf_prog_lift)\n  apply (auto simp add: prg_cert_def \n              intro!: start_context.wt_method_wt_lbv start_context.intro)\n  apply (erule sees_method_is_class)                                     \n  done\n(*>*)\n\nend  \n", "meta": {"author": "susannahej", "repo": "jinja-dci", "sha": "0969fa2c5966204b326395763d7a375e7dc6badf", "save_path": "github-repos/isabelle/susannahej-jinja-dci", "path": "github-repos/isabelle/susannahej-jinja-dci/jinja-dci-0969fa2c5966204b326395763d7a375e7dc6badf/BV/LBVJVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.3070085104018831}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2005         |\n            |               January 2006                |\n            |                 March 2007  (modified)    |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory FNF_F_sf_ext\nimports FNF_F_sf_induct\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*  The following simplification rules are deleted in this theory file *)\n(*       P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y))        *)\n\ndeclare split_if  [split del]\n\n(*****************************************************************\n\n         1. full sequentialization for Ext_choice\n         2. full sequentialization for Timeout\n         2. \n         3. \n\n *****************************************************************)\n\n(*============================================================*\n |                                                            |\n |                        Ext_choice                          |\n |                                                            |\n *============================================================*)\n\ndefinition\n  Pfun_Ext_choice :: \"('p,'a) proc => ('p,'a) proc => ('p,'a) proc\"\n  where\n  Pfun_Ext_choice_def :\n    \"Pfun_Ext_choice == (%P1 P2. P1 [+] P2)\"\n\ndefinition\n  SP_step_Ext_choice :: \n   \"('a set => ('a => ('p,'a) proc) => ('p,'a) proc =>\n     'a set => ('a => ('p,'a) proc) => ('p,'a) proc => \n    ('a => ('p,'a) proc) => ('a => ('p,'a) proc) => ('a => ('p,'a) proc)\n        => ('p,'a) proc)\"\n  where\n  SP_step_Ext_choice_def :\n    \"SP_step_Ext_choice == (%A1 Pf1 Q1 A2 Pf2 Q2 SPf SPf1 SPf2. \n\n           (? a:(A1 Un A2)\n               -> (if (a : A1 & a : A2)\n                   then (Pf1 a) |~|seq (Pf2 a)\n                   else if (a : A1)\n                        then (Pf1 a) else (Pf2 a)))\n           [+] (if (Q1 = STOP) then Q2\n                else if (Q2 = STOP) then Q1\n                else (if (Q1 = SKIP | Q2 = SKIP) then SKIP else DIV)))\"\n\ndefinition\n  fsfF_Ext_choice  :: \"('p,'a) proc => ('p,'a) proc => ('p,'a) proc\"\n                                    (\"(1_ /[+]seq _)\" [72,73] 72)\n  where\n  fsfF_Ext_choice_def :\n    \"P1 [+]seq P2 == \n       (fsfF_induct2 Pfun_Ext_choice SP_step_Ext_choice P1 P2)\"\n\n(*------------------------------------------------------------*\n |                        in fsfF_proc                        |\n *------------------------------------------------------------*)\n\nlemma fsfF_Ext_choice_in:\n    \"[| P1 : fsfF_proc ; P2 : fsfF_proc |]\n     ==> P1 [+]seq P2 : fsfF_proc\"\napply (simp add: fsfF_Ext_choice_def)\napply (rule fsfF_induct2_in)\napply (simp_all)\n\napply (simp_all add: SP_step_Ext_choice_def)\napply (rule fsfF_proc_ext)\napply (intro ballI)\napply (simp split: split_if)\napply (intro impI conjI)\napply (rule fsfF_Int_choice_in)\napply (simp_all)\napply (simp split: split_if)\napply (auto)\ndone\n\n(*------------------------------------------------------------*\n |             syntactical transformation to fsfF             |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Ext_choice_eqF:\n    \"P1 [+] P2 =F P1 [+]seq P2\"\napply (simp add: fsfF_Ext_choice_def)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_induct2_eqF[THEN cspF_sym])\napply (simp_all add: Pfun_Ext_choice_def)\napply (rule cspF_Dist_nonempty, simp)\napply (rule cspF_Dist_nonempty, simp)\napply (simp add: SP_step_Ext_choice_def)\n\n(* commut and assoc *)\napply (rule cspF_rw_left)\napply (subgoal_tac \n  \"? :A1 -> Pf1 [+] Q1 [+] (? :A2 -> Pf2 [+] Q2)\n  =F (? :A1 -> Pf1 [+] ? :A2 -> Pf2) [+] (Q1 [+] Q2)\")  (* sub1 *)\napply (simp)\n\n (* sub1 *)\n apply (rule cspF_rw_left)\n apply (rule cspF_assoc)\n apply (rule cspF_rw_left)\n apply (rule cspF_decompo)\n apply (rule cspF_assoc_sym)\n apply (rule cspF_reflex)\n apply (rule cspF_rw_left)\n apply (rule cspF_decompo)\n apply (rule cspF_decompo)\n apply (rule cspF_reflex)\n apply (rule cspF_commut)\n apply (rule cspF_reflex)\n apply (rule cspF_rw_left)\n apply (rule cspF_decompo)\n apply (rule cspF_assoc)\n apply (rule cspF_reflex)\n apply (rule cspF_rw_left)\n apply (rule cspF_assoc_sym)\n apply (rule cspF_reflex)\n\napply (rule cspF_decompo)\n\n(* expand *)\napply (rule cspF_rw_left)\napply (rule cspF_step)\napply (rule cspF_decompo)\napply (simp)\n\n(* if *)\napply (rule cspF_rw_right)\napply (rule cspF_IF_split[THEN cspF_sym])\napply (rule cspF_decompo)\napply (simp)\napply (simp add: cspF_fsfF_Int_choice_eqF)\napply (rule cspF_rw_right)\napply (rule cspF_IF_split[THEN cspF_sym])\napply (rule cspF_decompo)\napply (simp_all)\n\n(* SKIP [+] DIV *)\napply (simp split: split_if)\napply (intro conjI impI)\napply (simp_all)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_or_DIV)\napply (simp_all)\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_or_DIV)\napply (simp_all)\n\n(* congruence *)\napply (simp add: SP_step_Ext_choice_def)\ndone\n\n(*--------------------------------------------------*\n |                                                  |\n |  The equality \"cspF_fsfF_Ext_choice_eqF\" can be  |\n |  proven by using tactics as follows:             |\n |                                                  |\n *--------------------------------------------------*)\n\n(*\nlemma \"P1 [+] P2 =F P1 [+]seq P2\"\napply (simp add: fsfF_Ext_choice_def)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_induct2_eqF[THEN cspF_sym])\napply (simp_all add: Pfun_Ext_choice_def)\napply (tactic {* cspF_dist_tac 1 *})\napply (tactic {* cspF_dist_tac 1 *})\napply (simp add: SP_step_Ext_choice_def)\napply (elim disjE)\napply (simp_all)\n\napply ((tactic {* cspF_hsf_tac 1 *})+,\n       (rule cspF_decompo), (rule), (simp),\n       (simp split: split_if),\n       (intro conjI allI impI),\n       (tactic {* cspF_simp_tac 1 *})+,\n       (rule cspF_fsfF_Int_choice_eqF),\n       (tactic {* cspF_simp_tac 1 *}),\n       (tactic {* cspF_simp_tac 1 *}))+\n\napply (simp add: SP_step_Ext_choice_def)\ndone\n*)\n\n(*============================================================*\n |                                                            |\n |                         Timeout                            |\n |                                                            |\n *============================================================*)\n\ndefinition\n  fsfF_Timeout ::\n  \"('p,'a) proc => ('p,'a) proc => ('p,'a) proc\"  (\"(1_ /[>seq _)\" [73,74] 73)\n  where\n  fsfF_Timeout_def :\n    \"P1 [>seq P2 == (P1 |~|seq SSTOP) [+]seq P2\"\n\n(*------------------------------------*\n |                 in                 |\n *------------------------------------*)\n\nlemma fsfF_Timeout_in:\n  \"[| P1 : fsfF_proc ; P2 : fsfF_proc |] ==> P1 [>seq P2 : fsfF_proc\"\napply (simp add: fsfF_Timeout_def)\napply (rule fsfF_Ext_choice_in)\napply (rule fsfF_Int_choice_in)\napply (simp_all)\ndone\n\n(*------------------------------------*\n |                 eqF                |\n *------------------------------------*)\n\nlemma cspF_fsfF_Timeout_eqF:\n  \"(P1 [> P2) =F (P1 [>seq P2)\"\napply (simp add: fsfF_Timeout_def)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Ext_choice_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (rule cspF_reflex)\napply (rule cspF_SSTOP_eqF)\napply (rule cspF_reflex)\ndone\n\n(****************** to add them again ******************)\n\ndeclare split_if    [split]\ndeclare disj_not1   [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/FNF_F/FNF_F_sf_ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.3070085104018831}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n(*<*)\ntheory EgTop2\nimports GenFilter2System\nbegin\n\n(* A component may receive on a given channel *)\nfun\n  receives_on :: \"channel \\<Rightarrow> component \\<Rightarrow> bool\"\nwhere\n   \"receives_on c (Response f) = (\\<exists>q s. \\<exists>a \\<in> f q s. a_channel (snd a) = c)\"\n | \"receives_on c (a ;; b) = (receives_on c a \\<or> receives_on c b)\"\n | \"receives_on c (IF cond THEN a ELSE b) = (\\<forall>s. cond s \\<and> receives_on c a \\<or> \\<not> cond s \\<and> receives_on c b)\"\n | \"receives_on c (WHILE cond DO a) = (\\<forall>s. cond s \\<and> receives_on c a \\<or> \\<not> cond s)\"\n | \"receives_on c (a \\<squnion> b) = (receives_on c a \\<or> receives_on c b)\"\n | \"receives_on _ _ = False\"\n\n(* Whether a component ever sends a question in a given set. *)\nfun\n  sends :: \"component \\<Rightarrow> channel question set \\<Rightarrow> bool\"\nwhere\n   \"sends (Request f _) qs = (\\<exists>s. \\<exists>q \\<in> f s. q \\<in> qs)\"\n | \"sends (a ;; b) qs = (sends a qs \\<or> sends b qs)\"\n | \"sends (IF cond THEN a ELSE b) qs = (\\<forall>s. cond s \\<and> sends a qs \\<or> \\<not> cond s \\<and> sends b qs)\"\n | \"sends (WHILE cond DO a) qs = (\\<forall>s. cond s \\<and> sends a qs \\<or> \\<not> cond s)\"\n | \"sends (a \\<squnion> b) qs = (sends a qs \\<or> sends b qs)\"\n | \"sends _ _ = False\"\n(*>*)\n\ntext {*\n  Now it's possible to state and prove the desired property of the system; that\n  @{term client} never receives the secret ``baz''.\n*}\n\nlemma \"\\<forall>p. \\<exists>e s. gs\\<^sub>0 p = Some (e, s) \\<and>\n  (e = client_untrusted \\<or>\n  \\<not>(\\<exists>c. sends e {x. q_channel x = c \\<and> q_data x = Return [String ''baz'']} \\<and>\n  receives_on c client_untrusted))\"\n  unfolding gs\\<^sub>0_def trusted_def apply clarsimp\n  apply (case_tac p, clarsimp)\n    unfolding store_untrusted_def Store_untrusted_def apply clarsimp\n    unfolding UserStep_def ArbitraryRequest_def ArbitraryResponse_def\n    apply clarsimp\n    unfolding client_untrusted_def Client_untrusted_def apply clarsimp\n    unfolding UserStep_def ArbitraryRequest_def ArbitraryResponse_def\n    apply clarsimp\n   apply clarsimp\n  apply clarsimp\n  unfolding filter_trusted_def UserStep_def ArbitraryRequest_def\n            ArbitraryResponse_def apply clarsimp\n  unfolding filter_responses_def apply clarsimp\n  done\n\n(*<*)\nend\n(* > *)\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/camkes/glue-spec/example-trusted/EgTop2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947155710233, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.3070085040867557}}
{"text": "(*:maxLineLen=78:*)\n\ntheory HOL_Specific\n  imports\n    Main\n    \"~~/src/HOL/Library/Old_Datatype\"\n    \"~~/src/HOL/Library/Old_Recdef\"\n    \"~~/src/Tools/Adhoc_Overloading\"\n    \"~~/src/HOL/Library/Dlist\"\n    \"~~/src/HOL/Library/FSet\"\n    Base\nbegin\n\n\nchapter \\<open>Higher-Order Logic\\<close>\n\ntext \\<open>\n  Isabelle/HOL is based on Higher-Order Logic, a polymorphic version of\n  Church's Simple Theory of Types. HOL can be best understood as a\n  simply-typed version of classical set theory. The logic was first\n  implemented in Gordon's HOL system @{cite \"mgordon-hol\"}. It extends\n  Church's original logic @{cite \"church40\"} by explicit type variables (naive\n  polymorphism) and a sound axiomatization scheme for new types based on\n  subsets of existing types.\n\n  Andrews's book @{cite andrews86} is a full description of the original\n  Church-style higher-order logic, with proofs of correctness and completeness\n  wrt.\\ certain set-theoretic interpretations. The particular extensions of\n  Gordon-style HOL are explained semantically in two chapters of the 1993 HOL\n  book @{cite pitts93}.\n\n  Experience with HOL over decades has demonstrated that higher-order logic is\n  widely applicable in many areas of mathematics and computer science. In a\n  sense, Higher-Order Logic is simpler than First-Order Logic, because there\n  are fewer restrictions and special cases. Note that HOL is \\<^emph>\\<open>weaker\\<close> than\n  FOL with axioms for ZF set theory, which is traditionally considered the\n  standard foundation of regular mathematics, but for most applications this\n  does not matter. If you prefer ML to Lisp, you will probably prefer HOL to\n  ZF.\n\n  \\<^medskip> The syntax of HOL follows \\<open>\\<lambda>\\<close>-calculus and functional programming.\n  Function application is curried. To apply the function \\<open>f\\<close> of type \\<open>\\<tau>\\<^sub>1 \\<Rightarrow>\n  \\<tau>\\<^sub>2 \\<Rightarrow> \\<tau>\\<^sub>3\\<close> to the arguments \\<open>a\\<close> and \\<open>b\\<close> in HOL, you simply write \\<open>f a b\\<close> (as\n  in ML or Haskell). There is no ``apply'' operator; the existing application\n  of the Pure \\<open>\\<lambda>\\<close>-calculus is re-used. Note that in HOL \\<open>f (a, b)\\<close> means ``\\<open>f\\<close>\n  applied to the pair \\<open>(a, b)\\<close> (which is notation for \\<open>Pair a b\\<close>). The latter\n  typically introduces extra formal efforts that can be avoided by currying\n  functions by default. Explicit tuples are as infrequent in HOL\n  formalizations as in good ML or Haskell programs.\n\n  \\<^medskip> Isabelle/HOL has a distinct feel, compared to other object-logics like\n  Isabelle/ZF. It identifies object-level types with meta-level types, taking\n  advantage of the default type-inference mechanism of Isabelle/Pure. HOL\n  fully identifies object-level functions with meta-level functions, with\n  native abstraction and application.\n\n  These identifications allow Isabelle to support HOL particularly nicely, but\n  they also mean that HOL requires some sophistication from the user. In\n  particular, an understanding of Hindley-Milner type-inference with\n  type-classes, which are both used extensively in the standard libraries and\n  applications.\n\\<close>\n\n\nchapter \\<open>Derived specification elements\\<close>\n\nsection \\<open>Inductive and coinductive definitions \\label{sec:hol-inductive}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"inductive\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"inductive_set\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"coinductive\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"coinductive_set\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def \"print_inductives\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{attribute_def (HOL) mono} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  An \\<^emph>\\<open>inductive definition\\<close> specifies the least predicate or set \\<open>R\\<close> closed\n  under given rules: applying a rule to elements of \\<open>R\\<close> yields a result within\n  \\<open>R\\<close>. For example, a structural operational semantics is an inductive\n  definition of an evaluation relation.\n\n  Dually, a \\<^emph>\\<open>coinductive definition\\<close> specifies the greatest predicate or set\n  \\<open>R\\<close> that is consistent with given rules: every element of \\<open>R\\<close> can be seen as\n  arising by applying a rule to elements of \\<open>R\\<close>. An important example is using\n  bisimulation relations to formalise equivalence of processes and infinite\n  data structures.\n\n  Both inductive and coinductive definitions are based on the Knaster-Tarski\n  fixed-point theorem for complete lattices. The collection of introduction\n  rules given by the user determines a functor on subsets of set-theoretic\n  relations. The required monotonicity of the recursion scheme is proven as a\n  prerequisite to the fixed-point definition and the resulting consequences.\n  This works by pushing inclusion through logical connectives and any other\n  operator that might be wrapped around recursive occurrences of the defined\n  relation: there must be a monotonicity theorem of the form \\<open>A \\<le> B \\<Longrightarrow> \\<M> A \\<le> \\<M>\n  B\\<close>, for each premise \\<open>\\<M> R t\\<close> in an introduction rule. The default rule\n  declarations of Isabelle/HOL already take care of most common situations.\n\n  @{rail \\<open>\n    (@@{command (HOL) inductive} | @@{command (HOL) inductive_set} |\n      @@{command (HOL) coinductive} | @@{command (HOL) coinductive_set})\n      @{syntax vars} @{syntax for_fixes} \\<newline>\n      (@'where' @{syntax multi_specs})? (@'monos' @{syntax thms})?\n    ;\n    @@{command print_inductives} ('!'?)\n    ;\n    @@{attribute (HOL) mono} (() | 'add' | 'del')\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"inductive\"} and @{command (HOL) \"coinductive\"} define\n  (co)inductive predicates from the introduction rules.\n\n  The propositions given as \\<open>clauses\\<close> in the @{keyword \"where\"} part are\n  either rules of the usual \\<open>\\<And>/\\<Longrightarrow>\\<close> format (with arbitrary nesting), or\n  equalities using \\<open>\\<equiv>\\<close>. The latter specifies extra-logical abbreviations in\n  the sense of @{command_ref abbreviation}. Introducing abstract syntax\n  simultaneously with the actual introduction rules is occasionally useful for\n  complex specifications.\n\n  The optional @{keyword \"for\"} part contains a list of parameters of the\n  (co)inductive predicates that remain fixed throughout the definition, in\n  contrast to arguments of the relation that may vary in each occurrence\n  within the given \\<open>clauses\\<close>.\n\n  The optional @{keyword \"monos\"} declaration contains additional\n  \\<^emph>\\<open>monotonicity theorems\\<close>, which are required for each operator applied to a\n  recursive set in the introduction rules.\n\n  \\<^descr> @{command (HOL) \"inductive_set\"} and @{command (HOL) \"coinductive_set\"}\n  are wrappers for to the previous commands for native HOL predicates. This\n  allows to define (co)inductive sets, where multiple arguments are simulated\n  via tuples.\n\n  \\<^descr> @{command \"print_inductives\"} prints (co)inductive definitions and\n  monotonicity rules; the ``\\<open>!\\<close>'' option indicates extra verbosity.\n\n  \\<^descr> @{attribute (HOL) mono} declares monotonicity rules in the context. These\n  rule are involved in the automated monotonicity proof of the above inductive\n  and coinductive definitions.\n\\<close>\n\n\nsubsection \\<open>Derived rules\\<close>\n\ntext \\<open>\n  A (co)inductive definition of \\<open>R\\<close> provides the following main theorems:\n\n  \\<^descr> \\<open>R.intros\\<close> is the list of introduction rules as proven theorems, for the\n  recursive predicates (or sets). The rules are also available individually,\n  using the names given them in the theory file;\n\n  \\<^descr> \\<open>R.cases\\<close> is the case analysis (or elimination) rule;\n\n  \\<^descr> \\<open>R.induct\\<close> or \\<open>R.coinduct\\<close> is the (co)induction rule;\n\n  \\<^descr> \\<open>R.simps\\<close> is the equation unrolling the fixpoint of the predicate one\n  step.\n\n\n  When several predicates \\<open>R\\<^sub>1, \\<dots>, R\\<^sub>n\\<close> are defined simultaneously, the list\n  of introduction rules is called \\<open>R\\<^sub>1_\\<dots>_R\\<^sub>n.intros\\<close>, the case analysis rules\n  are called \\<open>R\\<^sub>1.cases, \\<dots>, R\\<^sub>n.cases\\<close>, and the list of mutual induction rules\n  is called \\<open>R\\<^sub>1_\\<dots>_R\\<^sub>n.inducts\\<close>.\n\\<close>\n\n\nsubsection \\<open>Monotonicity theorems\\<close>\n\ntext \\<open>\n  The context maintains a default set of theorems that are used in\n  monotonicity proofs. New rules can be declared via the @{attribute (HOL)\n  mono} attribute. See the main Isabelle/HOL sources for some examples. The\n  general format of such monotonicity theorems is as follows:\n\n  \\<^item> Theorems of the form \\<open>A \\<le> B \\<Longrightarrow> \\<M> A \\<le> \\<M> B\\<close>, for proving monotonicity of\n  inductive definitions whose introduction rules have premises involving terms\n  such as \\<open>\\<M> R t\\<close>.\n\n  \\<^item> Monotonicity theorems for logical operators, which are of the general form\n  \\<open>(\\<dots> \\<longrightarrow> \\<dots>) \\<Longrightarrow> \\<dots> (\\<dots> \\<longrightarrow> \\<dots>) \\<Longrightarrow> \\<dots> \\<longrightarrow> \\<dots>\\<close>. For example, in the case of the operator \\<open>\\<or>\\<close>,\n  the corresponding theorem is\n  \\[\n  \\infer{\\<open>P\\<^sub>1 \\<or> P\\<^sub>2 \\<longrightarrow> Q\\<^sub>1 \\<or> Q\\<^sub>2\\<close>}{\\<open>P\\<^sub>1 \\<longrightarrow> Q\\<^sub>1\\<close> & \\<open>P\\<^sub>2 \\<longrightarrow> Q\\<^sub>2\\<close>}\n  \\]\n\n  \\<^item> De Morgan style equations for reasoning about the ``polarity'' of\n  expressions, e.g.\n  \\[\n  @{prop \"\\<not> \\<not> P \\<longleftrightarrow> P\"} \\qquad\\qquad\n  @{prop \"\\<not> (P \\<and> Q) \\<longleftrightarrow> \\<not> P \\<or> \\<not> Q\"}\n  \\]\n\n  \\<^item> Equations for reducing complex operators to more primitive ones whose\n  monotonicity can easily be proved, e.g.\n  \\[\n  @{prop \"(P \\<longrightarrow> Q) \\<longleftrightarrow> \\<not> P \\<or> Q\"} \\qquad\\qquad\n  @{prop \"Ball A P \\<equiv> \\<forall>x. x \\<in> A \\<longrightarrow> P x\"}\n  \\]\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>The finite powerset operator can be defined inductively like this:\\<close>\n\n(*<*)experiment begin(*>*)\ninductive_set Fin :: \"'a set \\<Rightarrow> 'a set set\" for A :: \"'a set\"\nwhere\n  empty: \"{} \\<in> Fin A\"\n| insert: \"a \\<in> A \\<Longrightarrow> B \\<in> Fin A \\<Longrightarrow> insert a B \\<in> Fin A\"\n\ntext \\<open>The accessible part of a relation is defined as follows:\\<close>\n\ninductive acc :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  for r :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\"  (infix \"\\<prec>\" 50)\nwhere acc: \"(\\<And>y. y \\<prec> x \\<Longrightarrow> acc r y) \\<Longrightarrow> acc r x\"\n(*<*)end(*>*)\n\ntext \\<open>\n  Common logical connectives can be easily characterized as non-recursive\n  inductive definitions with parameters, but without arguments.\n\\<close>\n\n(*<*)experiment begin(*>*)\ninductive AND for A B :: bool\nwhere \"A \\<Longrightarrow> B \\<Longrightarrow> AND A B\"\n\ninductive OR for A B :: bool\nwhere \"A \\<Longrightarrow> OR A B\"\n  | \"B \\<Longrightarrow> OR A B\"\n\ninductive EXISTS for B :: \"'a \\<Rightarrow> bool\"\nwhere \"B a \\<Longrightarrow> EXISTS B\"\n(*<*)end(*>*)\n\ntext \\<open>\n  Here the \\<open>cases\\<close> or \\<open>induct\\<close> rules produced by the @{command inductive}\n  package coincide with the expected elimination rules for Natural Deduction.\n  Already in the original article by Gerhard Gentzen @{cite \"Gentzen:1935\"}\n  there is a hint that each connective can be characterized by its\n  introductions, and the elimination can be constructed systematically.\n\\<close>\n\n\nsection \\<open>Recursive functions \\label{sec:recursion}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"primrec\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"fun\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{command_def (HOL) \"function\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close> \\\\\n    @{command_def (HOL) \"termination\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close> \\\\\n    @{command_def (HOL) \"fun_cases\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) primrec} @{syntax specification}\n    ;\n    (@@{command (HOL) fun} | @@{command (HOL) function}) opts? @{syntax specification}\n    ;\n    opts: '(' (('sequential' | 'domintros') + ',') ')'\n    ;\n    @@{command (HOL) termination} @{syntax term}?\n    ;\n    @@{command (HOL) fun_cases} (@{syntax thmdecl}? @{syntax prop} + @'and')\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"primrec\"} defines primitive recursive functions over\n  datatypes (see also @{command_ref (HOL) datatype}). The given \\<open>equations\\<close>\n  specify reduction rules that are produced by instantiating the generic\n  combinator for primitive recursion that is available for each datatype.\n\n  Each equation needs to be of the form:\n\n  @{text [display] \"f x\\<^sub>1 \\<dots> x\\<^sub>m (C y\\<^sub>1 \\<dots> y\\<^sub>k) z\\<^sub>1 \\<dots> z\\<^sub>n = rhs\"}\n\n  such that \\<open>C\\<close> is a datatype constructor, \\<open>rhs\\<close> contains only the free\n  variables on the left-hand side (or from the context), and all recursive\n  occurrences of \\<open>f\\<close> in \\<open>rhs\\<close> are of the form \\<open>f \\<dots> y\\<^sub>i \\<dots>\\<close> for some \\<open>i\\<close>. At\n  most one reduction rule for each constructor can be given. The order does\n  not matter. For missing constructors, the function is defined to return a\n  default value, but this equation is made difficult to access for users.\n\n  The reduction rules are declared as @{attribute simp} by default, which\n  enables standard proof methods like @{method simp} and @{method auto} to\n  normalize expressions of \\<open>f\\<close> applied to datatype constructions, by\n  simulating symbolic computation via rewriting.\n\n  \\<^descr> @{command (HOL) \"function\"} defines functions by general wellfounded\n  recursion. A detailed description with examples can be found in @{cite\n  \"isabelle-function\"}. The function is specified by a set of (possibly\n  conditional) recursive equations with arbitrary pattern matching. The\n  command generates proof obligations for the completeness and the\n  compatibility of patterns.\n\n  The defined function is considered partial, and the resulting simplification\n  rules (named \\<open>f.psimps\\<close>) and induction rule (named \\<open>f.pinduct\\<close>) are guarded\n  by a generated domain predicate \\<open>f_dom\\<close>. The @{command (HOL) \"termination\"}\n  command can then be used to establish that the function is total.\n\n  \\<^descr> @{command (HOL) \"fun\"} is a shorthand notation for ``@{command (HOL)\n  \"function\"}~\\<open>(sequential)\\<close>'', followed by automated proof attempts regarding\n  pattern matching and termination. See @{cite \"isabelle-function\"} for\n  further details.\n\n  \\<^descr> @{command (HOL) \"termination\"}~\\<open>f\\<close> commences a termination proof for the\n  previously defined function \\<open>f\\<close>. If this is omitted, the command refers to\n  the most recent function definition. After the proof is closed, the\n  recursive equations and the induction principle is established.\n\n  \\<^descr> @{command (HOL) \"fun_cases\"} generates specialized elimination rules for\n  function equations. It expects one or more function equations and produces\n  rules that eliminate the given equalities, following the cases given in the\n  function definition.\n\n\n  Recursive definitions introduced by the @{command (HOL) \"function\"} command\n  accommodate reasoning by induction (cf.\\ @{method induct}): rule \\<open>f.induct\\<close>\n  refers to a specific induction rule, with parameters named according to the\n  user-specified equations. Cases are numbered starting from 1. For @{command\n  (HOL) \"primrec\"}, the induction principle coincides with structural\n  recursion on the datatype where the recursion is carried out.\n\n  The equations provided by these packages may be referred later as theorem\n  list \\<open>f.simps\\<close>, where \\<open>f\\<close> is the (collective) name of the functions defined.\n  Individual equations may be named explicitly as well.\n\n  The @{command (HOL) \"function\"} command accepts the following options.\n\n  \\<^descr> \\<open>sequential\\<close> enables a preprocessor which disambiguates overlapping\n  patterns by making them mutually disjoint. Earlier equations take precedence\n  over later ones. This allows to give the specification in a format very\n  similar to functional programming. Note that the resulting simplification\n  and induction rules correspond to the transformed specification, not the one\n  given originally. This usually means that each equation given by the user\n  may result in several theorems. Also note that this automatic transformation\n  only works for ML-style datatype patterns.\n\n  \\<^descr> \\<open>domintros\\<close> enables the automated generation of introduction rules for the\n  domain predicate. While mostly not needed, they can be helpful in some\n  proofs about partial functions.\n\\<close>\n\n\nsubsubsection \\<open>Example: evaluation of expressions\\<close>\n\ntext \\<open>\n  Subsequently, we define mutual datatypes for arithmetic and boolean\n  expressions, and use @{command primrec} for evaluation functions that follow\n  the same recursive structure.\n\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype 'a aexp =\n    IF \"'a bexp\"  \"'a aexp\"  \"'a aexp\"\n  | Sum \"'a aexp\"  \"'a aexp\"\n  | Diff \"'a aexp\"  \"'a aexp\"\n  | Var 'a\n  | Num nat\nand 'a bexp =\n    Less \"'a aexp\"  \"'a aexp\"\n  | And \"'a bexp\"  \"'a bexp\"\n  | Neg \"'a bexp\"\n\ntext \\<open>\\<^medskip> Evaluation of arithmetic and boolean expressions\\<close>\n\nprimrec evala :: \"('a \\<Rightarrow> nat) \\<Rightarrow> 'a aexp \\<Rightarrow> nat\"\n  and evalb :: \"('a \\<Rightarrow> nat) \\<Rightarrow> 'a bexp \\<Rightarrow> bool\"\nwhere\n  \"evala env (IF b a1 a2) = (if evalb env b then evala env a1 else evala env a2)\"\n| \"evala env (Sum a1 a2) = evala env a1 + evala env a2\"\n| \"evala env (Diff a1 a2) = evala env a1 - evala env a2\"\n| \"evala env (Var v) = env v\"\n| \"evala env (Num n) = n\"\n| \"evalb env (Less a1 a2) = (evala env a1 < evala env a2)\"\n| \"evalb env (And b1 b2) = (evalb env b1 \\<and> evalb env b2)\"\n| \"evalb env (Neg b) = (\\<not> evalb env b)\"\n\ntext \\<open>\n  Since the value of an expression depends on the value of its variables, the\n  functions @{const evala} and @{const evalb} take an additional parameter, an\n  \\<^emph>\\<open>environment\\<close> that maps variables to their values.\n\n  \\<^medskip>\n  Substitution on expressions can be defined similarly. The mapping \\<open>f\\<close> of\n  type @{typ \"'a \\<Rightarrow> 'a aexp\"} given as a parameter is lifted canonically on the\n  types @{typ \"'a aexp\"} and @{typ \"'a bexp\"}, respectively.\n\\<close>\n\nprimrec substa :: \"('a \\<Rightarrow> 'b aexp) \\<Rightarrow> 'a aexp \\<Rightarrow> 'b aexp\"\n  and substb :: \"('a \\<Rightarrow> 'b aexp) \\<Rightarrow> 'a bexp \\<Rightarrow> 'b bexp\"\nwhere\n  \"substa f (IF b a1 a2) = IF (substb f b) (substa f a1) (substa f a2)\"\n| \"substa f (Sum a1 a2) = Sum (substa f a1) (substa f a2)\"\n| \"substa f (Diff a1 a2) = Diff (substa f a1) (substa f a2)\"\n| \"substa f (Var v) = f v\"\n| \"substa f (Num n) = Num n\"\n| \"substb f (Less a1 a2) = Less (substa f a1) (substa f a2)\"\n| \"substb f (And b1 b2) = And (substb f b1) (substb f b2)\"\n| \"substb f (Neg b) = Neg (substb f b)\"\n\ntext \\<open>\n  In textbooks about semantics one often finds substitution theorems, which\n  express the relationship between substitution and evaluation. For @{typ \"'a\n  aexp\"} and @{typ \"'a bexp\"}, we can prove such a theorem by mutual\n  induction, followed by simplification.\n\\<close>\n\nlemma subst_one:\n  \"evala env (substa (Var (v := a')) a) = evala (env (v := evala env a')) a\"\n  \"evalb env (substb (Var (v := a')) b) = evalb (env (v := evala env a')) b\"\n  by (induct a and b) simp_all\n\nlemma subst_all:\n  \"evala env (substa s a) = evala (\\<lambda>x. evala env (s x)) a\"\n  \"evalb env (substb s b) = evalb (\\<lambda>x. evala env (s x)) b\"\n  by (induct a and b) simp_all\n(*<*)end(*>*)\n\n\nsubsubsection \\<open>Example: a substitution function for terms\\<close>\n\ntext \\<open>Functions on datatypes with nested recursion are also defined\n  by mutual primitive recursion.\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype ('a, 'b) \"term\" = Var 'a | App 'b \"('a, 'b) term list\"\n\ntext \\<open>\n  A substitution function on type @{typ \"('a, 'b) term\"} can be defined as\n  follows, by working simultaneously on @{typ \"('a, 'b) term list\"}:\n\\<close>\n\nprimrec subst_term :: \"('a \\<Rightarrow> ('a, 'b) term) \\<Rightarrow> ('a, 'b) term \\<Rightarrow> ('a, 'b) term\" and\n  subst_term_list :: \"('a \\<Rightarrow> ('a, 'b) term) \\<Rightarrow> ('a, 'b) term list \\<Rightarrow> ('a, 'b) term list\"\nwhere\n  \"subst_term f (Var a) = f a\"\n| \"subst_term f (App b ts) = App b (subst_term_list f ts)\"\n| \"subst_term_list f [] = []\"\n| \"subst_term_list f (t # ts) = subst_term f t # subst_term_list f ts\"\n\ntext \\<open>\n  The recursion scheme follows the structure of the unfolded definition of\n  type @{typ \"('a, 'b) term\"}. To prove properties of this substitution\n  function, mutual induction is needed:\n\\<close>\n\nlemma \"subst_term (subst_term f1 \\<circ> f2) t =\n    subst_term f1 (subst_term f2 t)\" and\n  \"subst_term_list (subst_term f1 \\<circ> f2) ts =\n    subst_term_list f1 (subst_term_list f2 ts)\"\n  by (induct t and ts rule: subst_term.induct subst_term_list.induct) simp_all\n(*<*)end(*>*)\n\n\nsubsubsection \\<open>Example: a map function for infinitely branching trees\\<close>\n\ntext \\<open>Defining functions on infinitely branching datatypes by primitive\n  recursion is just as easy.\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype 'a tree = Atom 'a | Branch \"nat \\<Rightarrow> 'a tree\"\n\nprimrec map_tree :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a tree \\<Rightarrow> 'b tree\"\nwhere\n  \"map_tree f (Atom a) = Atom (f a)\"\n| \"map_tree f (Branch ts) = Branch (\\<lambda>x. map_tree f (ts x))\"\n\ntext \\<open>\n  Note that all occurrences of functions such as \\<open>ts\\<close> above must be applied to\n  an argument. In particular, @{term \"map_tree f \\<circ> ts\"} is not allowed here.\n\n  \\<^medskip>\n  Here is a simple composition lemma for @{term map_tree}:\n\\<close>\n\nlemma \"map_tree g (map_tree f t) = map_tree (g \\<circ> f) t\"\n  by (induct t) simp_all\n(*<*)end(*>*)\n\n\nsubsection \\<open>Proof methods related to recursive definitions\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) pat_completeness} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) relation} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) lexicographic_order} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) size_change} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) induction_schema} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) relation} @{syntax term}\n    ;\n    @@{method (HOL) lexicographic_order} (@{syntax clasimpmod} * )\n    ;\n    @@{method (HOL) size_change} ( orders (@{syntax clasimpmod} * ) )\n    ;\n    @@{method (HOL) induction_schema}\n    ;\n    orders: ( 'max' | 'min' | 'ms' ) *\n  \\<close>}\n\n  \\<^descr> @{method (HOL) pat_completeness} is a specialized method to solve goals\n  regarding the completeness of pattern matching, as required by the @{command\n  (HOL) \"function\"} package (cf.\\ @{cite \"isabelle-function\"}).\n\n  \\<^descr> @{method (HOL) relation}~\\<open>R\\<close> introduces a termination proof using the\n  relation \\<open>R\\<close>. The resulting proof state will contain goals expressing that\n  \\<open>R\\<close> is wellfounded, and that the arguments of recursive calls decrease with\n  respect to \\<open>R\\<close>. Usually, this method is used as the initial proof step of\n  manual termination proofs.\n\n  \\<^descr> @{method (HOL) \"lexicographic_order\"} attempts a fully automated\n  termination proof by searching for a lexicographic combination of size\n  measures on the arguments of the function. The method accepts the same\n  arguments as the @{method auto} method, which it uses internally to prove\n  local descents. The @{syntax clasimpmod} modifiers are accepted (as for\n  @{method auto}).\n\n  In case of failure, extensive information is printed, which can help to\n  analyse the situation (cf.\\ @{cite \"isabelle-function\"}).\n\n  \\<^descr> @{method (HOL) \"size_change\"} also works on termination goals, using a\n  variation of the size-change principle, together with a graph decomposition\n  technique (see @{cite krauss_phd} for details). Three kinds of orders are\n  used internally: \\<open>max\\<close>, \\<open>min\\<close>, and \\<open>ms\\<close> (multiset), which is only available\n  when the theory \\<open>Multiset\\<close> is loaded. When no order kinds are given, they\n  are tried in order. The search for a termination proof uses SAT solving\n  internally.\n\n  For local descent proofs, the @{syntax clasimpmod} modifiers are accepted\n  (as for @{method auto}).\n\n  \\<^descr> @{method (HOL) induction_schema} derives user-specified induction rules\n  from well-founded induction and completeness of patterns. This factors out\n  some operations that are done internally by the function package and makes\n  them available separately. See \\<^file>\\<open>~~/src/HOL/ex/Induction_Schema.thy\\<close> for\n  examples.\n\\<close>\n\n\nsubsection \\<open>Functions with explicit partiality\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"partial_function\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n    @{attribute_def (HOL) \"partial_function_mono\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) partial_function} '(' @{syntax name} ')'\n      @{syntax specification}\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"partial_function\"}~\\<open>(mode)\\<close> defines recursive functions\n  based on fixpoints in complete partial orders. No termination proof is\n  required from the user or constructed internally. Instead, the possibility\n  of non-termination is modelled explicitly in the result type, which contains\n  an explicit bottom element.\n\n  Pattern matching and mutual recursion are currently not supported. Thus, the\n  specification consists of a single function described by a single recursive\n  equation.\n\n  There are no fixed syntactic restrictions on the body of the function, but\n  the induced functional must be provably monotonic wrt.\\ the underlying\n  order. The monotonicity proof is performed internally, and the definition is\n  rejected when it fails. The proof can be influenced by declaring hints using\n  the @{attribute (HOL) partial_function_mono} attribute.\n\n  The mandatory \\<open>mode\\<close> argument specifies the mode of operation of the\n  command, which directly corresponds to a complete partial order on the\n  result type. By default, the following modes are defined:\n\n    \\<^descr> \\<open>option\\<close> defines functions that map into the @{type option} type. Here,\n    the value @{term None} is used to model a non-terminating computation.\n    Monotonicity requires that if @{term None} is returned by a recursive\n    call, then the overall result must also be @{term None}. This is best\n    achieved through the use of the monadic operator @{const \"Option.bind\"}.\n\n    \\<^descr> \\<open>tailrec\\<close> defines functions with an arbitrary result type and uses the\n    slightly degenerated partial order where @{term \"undefined\"} is the bottom\n    element. Now, monotonicity requires that if @{term undefined} is returned\n    by a recursive call, then the overall result must also be @{term\n    undefined}. In practice, this is only satisfied when each recursive call\n    is a tail call, whose result is directly returned. Thus, this mode of\n    operation allows the definition of arbitrary tail-recursive functions.\n\n  Experienced users may define new modes by instantiating the locale @{const\n  \"partial_function_definitions\"} appropriately.\n\n  \\<^descr> @{attribute (HOL) partial_function_mono} declares rules for use in the\n  internal monotonicity proofs of partial function definitions.\n\\<close>\n\n\nsubsection \\<open>Old-style recursive function definitions (TFL)\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"recdef\"} & : & \\<open>theory \\<rightarrow> theory)\\<close> \\\\\n  \\end{matharray}\n\n  The old TFL command @{command (HOL) \"recdef\"} for defining recursive is\n  mostly obsolete; @{command (HOL) \"function\"} or @{command (HOL) \"fun\"}\n  should be used instead.\n\n  @{rail \\<open>\n    @@{command (HOL) recdef} ('(' @'permissive' ')')? \\<newline>\n      @{syntax name} @{syntax term} (@{syntax prop} +) hints?\n    ;\n    hints: '(' @'hints' ( recdefmod * ) ')'\n    ;\n    recdefmod: (('recdef_simp' | 'recdef_cong' | 'recdef_wf')\n      (() | 'add' | 'del') ':' @{syntax thms}) | @{syntax clasimpmod}\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"recdef\"} defines general well-founded recursive functions\n  (using the TFL package). The ``\\<open>(permissive)\\<close>'' option tells TFL to recover\n  from failed proof attempts, returning unfinished results. The \\<open>recdef_simp\\<close>,\n  \\<open>recdef_cong\\<close>, and \\<open>recdef_wf\\<close> hints refer to auxiliary rules to be used in\n  the internal automated proof process of TFL. Additional @{syntax clasimpmod}\n  declarations may be given to tune the context of the Simplifier (cf.\\\n  \\secref{sec:simplifier}) and Classical reasoner (cf.\\\n  \\secref{sec:classical}).\n\n\n  \\<^medskip>\n  Hints for @{command (HOL) \"recdef\"} may be also declared globally, using the\n  following attributes.\n\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) recdef_simp} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) recdef_cong} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) recdef_wf} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    (@@{attribute (HOL) recdef_simp} | @@{attribute (HOL) recdef_cong} |\n      @@{attribute (HOL) recdef_wf}) (() | 'add' | 'del')\n  \\<close>}\n\\<close>\n\n\nsection \\<open>Adhoc overloading of constants\\<close>\n\ntext \\<open>\n  \\begin{tabular}{rcll}\n  @{command_def \"adhoc_overloading\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  @{command_def \"no_adhoc_overloading\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  @{attribute_def \"show_variants\"} & : & \\<open>attribute\\<close> & default \\<open>false\\<close> \\\\\n  \\end{tabular}\n\n  \\<^medskip>\n  Adhoc overloading allows to overload a constant depending on its type.\n  Typically this involves the introduction of an uninterpreted constant (used\n  for input and output) and the addition of some variants (used internally).\n  For examples see \\<^file>\\<open>~~/src/HOL/ex/Adhoc_Overloading_Examples.thy\\<close> and\n  \\<^file>\\<open>~~/src/HOL/Library/Monad_Syntax.thy\\<close>.\n\n  @{rail \\<open>\n    (@@{command adhoc_overloading} | @@{command no_adhoc_overloading})\n      (@{syntax name} (@{syntax term} + ) + @'and')\n  \\<close>}\n\n  \\<^descr> @{command \"adhoc_overloading\"}~\\<open>c v\\<^sub>1 ... v\\<^sub>n\\<close> associates variants with an\n  existing constant.\n\n  \\<^descr> @{command \"no_adhoc_overloading\"} is similar to @{command\n  \"adhoc_overloading\"}, but removes the specified variants from the present\n  context.\n\n  \\<^descr> @{attribute \"show_variants\"} controls printing of variants of overloaded\n  constants. If enabled, the internally used variants are printed instead of\n  their respective overloaded constants. This is occasionally useful to check\n  whether the system agrees with a user's expectations about derived variants.\n\\<close>\n\n\nsection \\<open>Definition by specification \\label{sec:hol-specification}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"specification\"} & : & \\<open>theory \\<rightarrow> proof(prove)\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) specification} '(' (decl +) ')' \\<newline>\n      (@{syntax thmdecl}? @{syntax prop} +)\n    ;\n    decl: (@{syntax name} ':')? @{syntax term} ('(' @'overloaded' ')')?\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"specification\"}~\\<open>decls \\<phi>\\<close> sets up a goal stating the\n  existence of terms with the properties specified to hold for the constants\n  given in \\<open>decls\\<close>. After finishing the proof, the theory will be augmented\n  with definitions for the given constants, as well as with theorems stating\n  the properties for these constants.\n\n  \\<open>decl\\<close> declares a constant to be defined by the specification given. The\n  definition for the constant \\<open>c\\<close> is bound to the name \\<open>c_def\\<close> unless a\n  theorem name is given in the declaration. Overloaded constants should be\n  declared as such.\n\\<close>\n\n\nsection \\<open>Old-style datatypes \\label{sec:hol-datatype}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"old_datatype\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"old_rep_datatype\"} & : & \\<open>theory \\<rightarrow> proof(prove)\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) old_datatype} (spec + @'and')\n    ;\n    @@{command (HOL) old_rep_datatype} ('(' (@{syntax name} +) ')')? (@{syntax term} +)\n    ;\n\n    spec: @{syntax typespec_sorts} @{syntax mixfix}? '=' (cons + '|')\n    ;\n    cons: @{syntax name} (@{syntax type} * ) @{syntax mixfix}?\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"old_datatype\"} defines old-style inductive\n  datatypes in HOL.\n\n  \\<^descr> @{command (HOL) \"old_rep_datatype\"} represents existing types as\n  old-style datatypes.\n\n\n  These commands are mostly obsolete; @{command (HOL) \"datatype\"} should be\n  used instead.\n\n  See @{cite \"isabelle-datatypes\"} for more details on datatypes. Apart from\n  proper proof methods for case analysis and induction, there are also\n  emulations of ML tactics @{method (HOL) case_tac} and @{method (HOL)\n  induct_tac} available, see \\secref{sec:hol-induct-tac}; these admit to refer\n  directly to the internal structure of subgoals (including internally bound\n  parameters).\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>\n  We define a type of finite sequences, with slightly different names than the\n  existing @{typ \"'a list\"} that is already in @{theory Main}:\n\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype 'a seq = Empty | Seq 'a \"'a seq\"\n\ntext \\<open>We can now prove some simple lemma by structural induction:\\<close>\n\nlemma \"Seq x xs \\<noteq> xs\"\nproof (induct xs arbitrary: x)\n  case Empty\n  txt \\<open>This case can be proved using the simplifier: the freeness\n    properties of the datatype are already declared as @{attribute\n    simp} rules.\\<close>\n  show \"Seq x Empty \\<noteq> Empty\"\n    by simp\nnext\n  case (Seq y ys)\n  txt \\<open>The step case is proved similarly.\\<close>\n  show \"Seq x (Seq y ys) \\<noteq> Seq y ys\"\n    using \\<open>Seq y ys \\<noteq> ys\\<close> by simp\nqed\n\ntext \\<open>Here is a more succinct version of the same proof:\\<close>\n\nlemma \"Seq x xs \\<noteq> xs\"\n  by (induct xs arbitrary: x) simp_all\n(*<*)end(*>*)\n\n\nsection \\<open>Records \\label{sec:hol-record}\\<close>\n\ntext \\<open>\n  In principle, records merely generalize the concept of tuples, where\n  components may be addressed by labels instead of just position. The logical\n  infrastructure of records in Isabelle/HOL is slightly more advanced, though,\n  supporting truly extensible record schemes. This admits operations that are\n  polymorphic with respect to record extension, yielding ``object-oriented''\n  effects like (single) inheritance. See also @{cite \"NaraschewskiW-TPHOLs98\"}\n  for more details on object-oriented verification and record subtyping in\n  HOL.\n\\<close>\n\n\nsubsection \\<open>Basic concepts\\<close>\n\ntext \\<open>\n  Isabelle/HOL supports both \\<^emph>\\<open>fixed\\<close> and \\<^emph>\\<open>schematic\\<close> records at the level of\n  terms and types. The notation is as follows:\n\n  \\begin{center}\n  \\begin{tabular}{l|l|l}\n    & record terms & record types \\\\ \\hline\n    fixed & \\<open>\\<lparr>x = a, y = b\\<rparr>\\<close> & \\<open>\\<lparr>x :: A, y :: B\\<rparr>\\<close> \\\\\n    schematic & \\<open>\\<lparr>x = a, y = b, \\<dots> = m\\<rparr>\\<close> &\n      \\<open>\\<lparr>x :: A, y :: B, \\<dots> :: M\\<rparr>\\<close> \\\\\n  \\end{tabular}\n  \\end{center}\n\n  The ASCII representation of \\<open>\\<lparr>x = a\\<rparr>\\<close> is \\<open>(| x = a |)\\<close>.\n\n  A fixed record \\<open>\\<lparr>x = a, y = b\\<rparr>\\<close> has field \\<open>x\\<close> of value \\<open>a\\<close> and field \\<open>y\\<close> of\n  value \\<open>b\\<close>. The corresponding type is \\<open>\\<lparr>x :: A, y :: B\\<rparr>\\<close>, assuming that \\<open>a ::\n  A\\<close> and \\<open>b :: B\\<close>.\n\n  A record scheme like \\<open>\\<lparr>x = a, y = b, \\<dots> = m\\<rparr>\\<close> contains fields \\<open>x\\<close> and \\<open>y\\<close> as\n  before, but also possibly further fields as indicated by the ``\\<open>\\<dots>\\<close>''\n  notation (which is actually part of the syntax). The improper field ``\\<open>\\<dots>\\<close>''\n  of a record scheme is called the \\<^emph>\\<open>more part\\<close>. Logically it is just a free\n  variable, which is occasionally referred to as ``row variable'' in the\n  literature. The more part of a record scheme may be instantiated by zero or\n  more further components. For example, the previous scheme may get\n  instantiated to \\<open>\\<lparr>x = a, y = b, z = c, \\<dots> = m'\\<rparr>\\<close>, where \\<open>m'\\<close> refers to a\n  different more part. Fixed records are special instances of record schemes,\n  where ``\\<open>\\<dots>\\<close>'' is properly terminated by the \\<open>() :: unit\\<close> element. In fact,\n  \\<open>\\<lparr>x = a, y = b\\<rparr>\\<close> is just an abbreviation for \\<open>\\<lparr>x = a, y = b, \\<dots> = ()\\<rparr>\\<close>.\n\n  \\<^medskip>\n  Two key observations make extensible records in a simply typed language like\n  HOL work out:\n\n  \\<^enum> the more part is internalized, as a free term or type variable,\n\n  \\<^enum> field names are externalized, they cannot be accessed within the logic as\n  first-class values.\n\n\n  \\<^medskip>\n  In Isabelle/HOL record types have to be defined explicitly, fixing their\n  field names and types, and their (optional) parent record. Afterwards,\n  records may be formed using above syntax, while obeying the canonical order\n  of fields as given by their declaration. The record package provides several\n  standard operations like selectors and updates. The common setup for various\n  generic proof tools enable succinct reasoning patterns. See also the\n  Isabelle/HOL tutorial @{cite \"isabelle-hol-book\"} for further instructions\n  on using records in practice.\n\\<close>\n\n\nsubsection \\<open>Record specifications\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"record\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"print_record\"} & : & \\<open>context \\<rightarrow>\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) record} @{syntax \"overloaded\"}? @{syntax typespec_sorts} '=' \\<newline>\n      (@{syntax type} '+')? (constdecl +)\n    ;\n    constdecl: @{syntax name} '::' @{syntax type} @{syntax mixfix}?\n    ;\n    @@{command (HOL) print_record} modes? @{syntax typespec_sorts}\n    ;\n    modes: '(' (@{syntax name} +) ')'\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"record\"}~\\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t = \\<tau> + c\\<^sub>1 :: \\<sigma>\\<^sub>1 \\<dots> c\\<^sub>n :: \\<sigma>\\<^sub>n\\<close>\n  defines extensible record type \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close>, derived from the optional\n  parent record \\<open>\\<tau>\\<close> by adding new field components \\<open>c\\<^sub>i :: \\<sigma>\\<^sub>i\\<close> etc.\n\n  The type variables of \\<open>\\<tau>\\<close> and \\<open>\\<sigma>\\<^sub>i\\<close> need to be covered by the (distinct)\n  parameters \\<open>\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m\\<close>. Type constructor \\<open>t\\<close> has to be new, while \\<open>\\<tau>\\<close>\n  needs to specify an instance of an existing record type. At least one new\n  field \\<open>c\\<^sub>i\\<close> has to be specified. Basically, field names need to belong to a\n  unique record. This is not a real restriction in practice, since fields are\n  qualified by the record name internally.\n\n  The parent record specification \\<open>\\<tau>\\<close> is optional; if omitted \\<open>t\\<close> becomes a\n  root record. The hierarchy of all records declared within a theory context\n  forms a forest structure, i.e.\\ a set of trees starting with a root record\n  each. There is no way to merge multiple parent records!\n\n  For convenience, \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close> is made a type abbreviation for the fixed\n  record type \\<open>\\<lparr>c\\<^sub>1 :: \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n\\<rparr>\\<close>, likewise is \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m, \\<zeta>)\n  t_scheme\\<close> made an abbreviation for \\<open>\\<lparr>c\\<^sub>1 :: \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n, \\<dots> :: \\<zeta>\\<rparr>\\<close>.\n\n  \\<^descr> @{command (HOL) \"print_record\"}~\\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close> prints the definition of\n  record \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close>. Optionally \\<open>modes\\<close> can be specified, which are\n  appended to the current print mode; see \\secref{sec:print-modes}.\n\\<close>\n\n\nsubsection \\<open>Record operations\\<close>\n\ntext \\<open>\n  Any record definition of the form presented above produces certain standard\n  operations. Selectors and updates are provided for any field, including the\n  improper one ``\\<open>more\\<close>''. There are also cumulative record constructor\n  functions. To simplify the presentation below, we assume for now that \\<open>(\\<alpha>\\<^sub>1,\n  \\<dots>, \\<alpha>\\<^sub>m) t\\<close> is a root record with fields \\<open>c\\<^sub>1 :: \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n\\<close>.\n\n  \\<^medskip>\n  \\<^bold>\\<open>Selectors\\<close> and \\<^bold>\\<open>updates\\<close> are available for any\n  field (including ``\\<open>more\\<close>''):\n\n  \\begin{matharray}{lll}\n    \\<open>c\\<^sub>i\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<sigma>\\<^sub>i\\<close> \\\\\n    \\<open>c\\<^sub>i_update\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>i \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\\<close> \\\\\n  \\end{matharray}\n\n  There is special syntax for application of updates: \\<open>r\\<lparr>x := a\\<rparr>\\<close> abbreviates\n  term \\<open>x_update a r\\<close>. Further notation for repeated updates is also\n  available: \\<open>r\\<lparr>x := a\\<rparr>\\<lparr>y := b\\<rparr>\\<lparr>z := c\\<rparr>\\<close> may be written \\<open>r\\<lparr>x := a, y := b, z\n  := c\\<rparr>\\<close>. Note that because of postfix notation the order of fields shown here\n  is reverse than in the actual term. Since repeated updates are just function\n  applications, fields may be freely permuted in \\<open>\\<lparr>x := a, y := b, z := c\\<rparr>\\<close>,\n  as far as logical equality is concerned. Thus commutativity of independent\n  updates can be proven within the logic for any two fields, but not as a\n  general theorem.\n\n  \\<^medskip>\n  The \\<^bold>\\<open>make\\<close> operation provides a cumulative record constructor function:\n\n  \\begin{matharray}{lll}\n    \\<open>t.make\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n  \\end{matharray}\n\n  \\<^medskip>\n  We now reconsider the case of non-root records, which are derived of some\n  parent. In general, the latter may depend on another parent as well,\n  resulting in a list of \\<^emph>\\<open>ancestor records\\<close>. Appending the lists of fields of\n  all ancestors results in a certain field prefix. The record package\n  automatically takes care of this by lifting operations over this context of\n  ancestor fields. Assuming that \\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\\<close> has ancestor fields \\<open>b\\<^sub>1 ::\n  \\<rho>\\<^sub>1, \\<dots>, b\\<^sub>k :: \\<rho>\\<^sub>k\\<close>, the above record operations will get the following\n  types:\n\n  \\<^medskip>\n  \\begin{tabular}{lll}\n    \\<open>c\\<^sub>i\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<sigma>\\<^sub>i\\<close> \\\\\n    \\<open>c\\<^sub>i_update\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>i \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\\<close> \\\\\n    \\<open>t.make\\<close> & \\<open>::\\<close> & \\<open>\\<rho>\\<^sub>1 \\<Rightarrow> \\<dots> \\<rho>\\<^sub>k \\<Rightarrow> \\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n  \\end{tabular}\n  \\<^medskip>\n\n  Some further operations address the extension aspect of a derived record\n  scheme specifically: \\<open>t.fields\\<close> produces a record fragment consisting of\n  exactly the new fields introduced here (the result may serve as a more part\n  elsewhere); \\<open>t.extend\\<close> takes a fixed record and adds a given more part;\n  \\<open>t.truncate\\<close> restricts a record scheme to a fixed record.\n\n  \\<^medskip>\n  \\begin{tabular}{lll}\n    \\<open>t.fields\\<close> & \\<open>::\\<close> & \\<open>\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n    \\<open>t.extend\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr> \\<Rightarrow>\n      \\<zeta> \\<Rightarrow> \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\\<close> \\\\\n    \\<open>t.truncate\\<close> & \\<open>::\\<close> & \\<open>\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\\<close> \\\\\n  \\end{tabular}\n  \\<^medskip>\n\n  Note that \\<open>t.make\\<close> and \\<open>t.fields\\<close> coincide for root records.\n\\<close>\n\n\nsubsection \\<open>Derived rules and proof tools\\<close>\n\ntext \\<open>\n  The record package proves several results internally, declaring these facts\n  to appropriate proof tools. This enables users to reason about record\n  structures quite conveniently. Assume that \\<open>t\\<close> is a record type as specified\n  above.\n\n  \\<^enum> Standard conversions for selectors or updates applied to record\n  constructor terms are made part of the default Simplifier context; thus\n  proofs by reduction of basic operations merely require the @{method simp}\n  method without further arguments. These rules are available as \\<open>t.simps\\<close>,\n  too.\n\n  \\<^enum> Selectors applied to updated records are automatically reduced by an\n  internal simplification procedure, which is also part of the standard\n  Simplifier setup.\n\n  \\<^enum> Inject equations of a form analogous to @{prop \"(x, y) = (x', y') \\<equiv> x = x'\n  \\<and> y = y'\"} are declared to the Simplifier and Classical Reasoner as\n  @{attribute iff} rules. These rules are available as \\<open>t.iffs\\<close>.\n\n  \\<^enum> The introduction rule for record equality analogous to \\<open>x r = x r' \\<Longrightarrow> y r =\n  y r' \\<dots> \\<Longrightarrow> r = r'\\<close> is declared to the Simplifier, and as the basic rule\n  context as ``@{attribute intro}\\<open>?\\<close>''. The rule is called \\<open>t.equality\\<close>.\n\n  \\<^enum> Representations of arbitrary record expressions as canonical constructor\n  terms are provided both in @{method cases} and @{method induct} format (cf.\\\n  the generic proof methods of the same name, \\secref{sec:cases-induct}).\n  Several variations are available, for fixed records, record schemes, more\n  parts etc.\n\n  The generic proof methods are sufficiently smart to pick the most sensible\n  rule according to the type of the indicated record expression: users just\n  need to apply something like ``\\<open>(cases r)\\<close>'' to a certain proof problem.\n\n  \\<^enum> The derived record operations \\<open>t.make\\<close>, \\<open>t.fields\\<close>, \\<open>t.extend\\<close>,\n  \\<open>t.truncate\\<close> are \\<^emph>\\<open>not\\<close> treated automatically, but usually need to be\n  expanded by hand, using the collective fact \\<open>t.defs\\<close>.\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>See \\<^file>\\<open>~~/src/HOL/ex/Records.thy\\<close>, for example.\\<close>\n\n\nsection \\<open>Semantic subtype definitions \\label{sec:hol-typedef}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"typedef\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close> \\\\\n  \\end{matharray}\n\n  A type definition identifies a new type with a non-empty subset of an\n  existing type. More precisely, the new type is defined by exhibiting an\n  existing type \\<open>\\<tau>\\<close>, a set \\<open>A :: \\<tau> set\\<close>, and proving @{prop \"\\<exists>x. x \\<in> A\"}. Thus\n  \\<open>A\\<close> is a non-empty subset of \\<open>\\<tau>\\<close>, and the new type denotes this subset. New\n  functions are postulated that establish an isomorphism between the new type\n  and the subset. In general, the type \\<open>\\<tau>\\<close> may involve type variables \\<open>\\<alpha>\\<^sub>1, \\<dots>,\n  \\<alpha>\\<^sub>n\\<close> which means that the type definition produces a type constructor \\<open>(\\<alpha>\\<^sub>1,\n  \\<dots>, \\<alpha>\\<^sub>n) t\\<close> depending on those type arguments.\n\n  @{rail \\<open>\n    @@{command (HOL) typedef} @{syntax \"overloaded\"}? abs_type '=' rep_set\n    ;\n    @{syntax_def \"overloaded\"}: ('(' @'overloaded' ')')\n    ;\n    abs_type: @{syntax typespec_sorts} @{syntax mixfix}?\n    ;\n    rep_set: @{syntax term} (@'morphisms' @{syntax name} @{syntax name})?\n  \\<close>}\n\n  To understand the concept of type definition better, we need to recount its\n  somewhat complex history. The HOL logic goes back to the ``Simple Theory of\n  Types'' (STT) of A. Church @{cite \"church40\"}, which is further explained in\n  the book by P. Andrews @{cite \"andrews86\"}. The overview article by W.\n  Farmer @{cite \"Farmer:2008\"} points out the ``seven virtues'' of this\n  relatively simple family of logics. STT has only ground types, without\n  polymorphism and without type definitions.\n\n  \\<^medskip>\n  M. Gordon @{cite \"Gordon:1985:HOL\"} augmented Church's STT by adding\n  schematic polymorphism (type variables and type constructors) and a facility\n  to introduce new types as semantic subtypes from existing types. This\n  genuine extension of the logic was explained semantically by A. Pitts in the\n  book of the original Cambridge HOL88 system @{cite \"pitts93\"}. Type\n  definitions work in this setting, because the general model-theory of STT is\n  restricted to models that ensure that the universe of type interpretations\n  is closed by forming subsets (via predicates taken from the logic).\n\n  \\<^medskip>\n  Isabelle/HOL goes beyond Gordon-style HOL by admitting overloaded constant\n  definitions @{cite \"Wenzel:1997:TPHOL\" and \"Haftmann-Wenzel:2006:classes\"},\n  which are actually a concept of Isabelle/Pure and do not depend on\n  particular set-theoretic semantics of HOL. Over many years, there was no\n  formal checking of semantic type definitions in Isabelle/HOL versus\n  syntactic constant definitions in Isabelle/Pure. So the @{command typedef}\n  command was described as ``axiomatic'' in the sense of\n  \\secref{sec:axiomatizations}, only with some local checks of the given type\n  and its representing set.\n\n  Recent clarification of overloading in the HOL logic proper @{cite\n  \"Kuncar-Popescu:2015\"} demonstrates how the dissimilar concepts of constant\n  definitions versus type definitions may be understood uniformly. This\n  requires an interpretation of Isabelle/HOL that substantially reforms the\n  set-theoretic model of A. Pitts @{cite \"pitts93\"}, by taking a schematic\n  view on polymorphism and interpreting only ground types in the set-theoretic\n  sense of HOL88. Moreover, type-constructors may be explicitly overloaded,\n  e.g.\\ by making the subset depend on type-class parameters (cf.\\\n  \\secref{sec:class}). This is semantically like a dependent type: the meaning\n  relies on the operations provided by different type-class instances.\n\n  \\<^descr> @{command (HOL) \"typedef\"}~\\<open>(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n) t = A\\<close> defines a new type \\<open>(\\<alpha>\\<^sub>1,\n  \\<dots>, \\<alpha>\\<^sub>n) t\\<close> from the set \\<open>A\\<close> over an existing type. The set \\<open>A\\<close> may contain\n  type variables \\<open>\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n\\<close> as specified on the LHS, but no term variables.\n  Non-emptiness of \\<open>A\\<close> needs to be proven on the spot, in order to turn the\n  internal conditional characterization into usable theorems.\n\n  The ``\\<open>(overloaded)\\<close>'' option allows the @{command \"typedef\"} specification\n  to depend on constants that are not (yet) specified and thus left open as\n  parameters, e.g.\\ type-class parameters.\n\n  Within a local theory specification, the newly introduced type constructor\n  cannot depend on parameters or assumptions of the context: this is\n  syntactically impossible in HOL. The non-emptiness proof may formally depend\n  on local assumptions, but this has little practical relevance.\n\n  For @{command (HOL) \"typedef\"}~\\<open>t = A\\<close> the newly introduced type \\<open>t\\<close> is\n  accompanied by a pair of morphisms to relate it to the representing set over\n  the old type. By default, the injection from type to set is called \\<open>Rep_t\\<close>\n  and its inverse \\<open>Abs_t\\<close>: An explicit @{keyword (HOL) \"morphisms\"}\n  specification allows to provide alternative names.\n\n  The logical characterization of @{command typedef} uses the predicate of\n  locale @{const type_definition} that is defined in Isabelle/HOL. Various\n  basic consequences of that are instantiated accordingly, re-using the locale\n  facts with names derived from the new type constructor. Thus the generic\n  theorem @{thm type_definition.Rep} is turned into the specific \\<open>Rep_t\\<close>, for\n  example.\n\n  Theorems @{thm type_definition.Rep}, @{thm type_definition.Rep_inverse}, and\n  @{thm type_definition.Abs_inverse} provide the most basic characterization\n  as a corresponding injection/surjection pair (in both directions). The\n  derived rules @{thm type_definition.Rep_inject} and @{thm\n  type_definition.Abs_inject} provide a more convenient version of\n  injectivity, suitable for automated proof tools (e.g.\\ in declarations\n  involving @{attribute simp} or @{attribute iff}). Furthermore, the rules\n  @{thm type_definition.Rep_cases}~/ @{thm type_definition.Rep_induct}, and\n  @{thm type_definition.Abs_cases}~/ @{thm type_definition.Abs_induct} provide\n  alternative views on surjectivity. These rules are already declared as set\n  or type rules for the generic @{method cases} and @{method induct} methods,\n  respectively.\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>\n  The following trivial example pulls a three-element type into existence\n  within the formal logical environment of Isabelle/HOL.\\<close>\n\n(*<*)experiment begin(*>*)\ntypedef three = \"{(True, True), (True, False), (False, True)}\"\n  by blast\n\ndefinition \"One = Abs_three (True, True)\"\ndefinition \"Two = Abs_three (True, False)\"\ndefinition \"Three = Abs_three (False, True)\"\n\nlemma three_distinct: \"One \\<noteq> Two\"  \"One \\<noteq> Three\"  \"Two \\<noteq> Three\"\n  by (simp_all add: One_def Two_def Three_def Abs_three_inject)\n\nlemma three_cases:\n  fixes x :: three obtains \"x = One\" | \"x = Two\" | \"x = Three\"\n  by (cases x) (auto simp: One_def Two_def Three_def Abs_three_inject)\n(*<*)end(*>*)\n\ntext \\<open>Note that such trivial constructions are better done with\n  derived specification mechanisms such as @{command datatype}:\\<close>\n\n(*<*)experiment begin(*>*)\ndatatype three = One | Two | Three\n(*<*)end(*>*)\n\ntext \\<open>This avoids re-doing basic definitions and proofs from the\n  primitive @{command typedef} above.\\<close>\n\n\n\nsection \\<open>Functorial structure of types\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"functor\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) functor} (@{syntax name} ':')? @{syntax term}\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"functor\"}~\\<open>prefix: m\\<close> allows to prove and register\n  properties about the functorial structure of type constructors. These\n  properties then can be used by other packages to deal with those type\n  constructors in certain type constructions. Characteristic theorems are\n  noted in the current local theory. By default, they are prefixed with the\n  base name of the type constructor, an explicit prefix can be given\n  alternatively.\n\n  The given term \\<open>m\\<close> is considered as \\<^emph>\\<open>mapper\\<close> for the corresponding type\n  constructor and must conform to the following type pattern:\n\n  \\begin{matharray}{lll}\n    \\<open>m\\<close> & \\<open>::\\<close> &\n      \\<open>\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>k \\<Rightarrow> (\\<^vec>\\<alpha>\\<^sub>n) t \\<Rightarrow> (\\<^vec>\\<beta>\\<^sub>n) t\\<close> \\\\\n  \\end{matharray}\n\n  where \\<open>t\\<close> is the type constructor, \\<open>\\<^vec>\\<alpha>\\<^sub>n\\<close> and \\<open>\\<^vec>\\<beta>\\<^sub>n\\<close> are\n  distinct type variables free in the local theory and \\<open>\\<sigma>\\<^sub>1\\<close>, \\ldots, \\<open>\\<sigma>\\<^sub>k\\<close> is\n  a subsequence of \\<open>\\<alpha>\\<^sub>1 \\<Rightarrow> \\<beta>\\<^sub>1\\<close>, \\<open>\\<beta>\\<^sub>1 \\<Rightarrow> \\<alpha>\\<^sub>1\\<close>, \\ldots, \\<open>\\<alpha>\\<^sub>n \\<Rightarrow> \\<beta>\\<^sub>n\\<close>, \\<open>\\<beta>\\<^sub>n \\<Rightarrow> \\<alpha>\\<^sub>n\\<close>.\n\\<close>\n\n\nsection \\<open>Quotient types with lifting and transfer\\<close>\n\ntext \\<open>\n  The quotient package defines a new quotient type given a raw type and a\n  partial equivalence relation (\\secref{sec:quotient-type}). The package also\n  historically includes automation for transporting definitions and theorems\n  (\\secref{sec:old-quotient}), but most of this automation was superseded by\n  the Lifting (\\secref{sec:lifting}) and Transfer (\\secref{sec:transfer})\n  packages.\n\\<close>\n\n\nsubsection \\<open>Quotient type definition \\label{sec:quotient-type}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"quotient_type\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) quotient_type} @{syntax \"overloaded\"}? \\<newline>\n      @{syntax typespec} @{syntax mixfix}? '=' quot_type \\<newline>\n      quot_morphisms? quot_parametric?\n    ;\n    quot_type: @{syntax type} '/' ('partial' ':')? @{syntax term}\n    ;\n    quot_morphisms: @'morphisms' @{syntax name} @{syntax name}\n    ;\n    quot_parametric: @'parametric' @{syntax thm}\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"quotient_type\"} defines a new quotient type \\<open>\\<tau>\\<close>. The\n  injection from a quotient type to a raw type is called \\<open>rep_\\<tau>\\<close>, its inverse\n  \\<open>abs_\\<tau>\\<close> unless explicit @{keyword (HOL) \"morphisms\"} specification provides\n  alternative names. @{command (HOL) \"quotient_type\"} requires the user to\n  prove that the relation is an equivalence relation (predicate \\<open>equivp\\<close>),\n  unless the user specifies explicitly \\<open>partial\\<close> in which case the obligation\n  is \\<open>part_equivp\\<close>. A quotient defined with \\<open>partial\\<close> is weaker in the sense\n  that less things can be proved automatically.\n\n  The command internally proves a Quotient theorem and sets up the Lifting\n  package by the command @{command (HOL) setup_lifting}. Thus the Lifting and\n  Transfer packages can be used also with quotient types defined by @{command\n  (HOL) \"quotient_type\"} without any extra set-up. The parametricity theorem\n  for the equivalence relation R can be provided as an extra argument of the\n  command and is passed to the corresponding internal call of @{command (HOL)\n  setup_lifting}. This theorem allows the Lifting package to generate a\n  stronger transfer rule for equality.\n\\<close>\n\n\nsubsection \\<open>Lifting package \\label{sec:lifting}\\<close>\n\ntext \\<open>\n  The Lifting package allows users to lift terms of the raw type to the\n  abstract type, which is a necessary step in building a library for an\n  abstract type. Lifting defines a new constant by combining coercion\n  functions (@{term Abs} and @{term Rep}) with the raw term. It also proves an\n  appropriate transfer rule for the Transfer (\\secref{sec:transfer}) package\n  and, if possible, an equation for the code generator.\n\n  The Lifting package provides two main commands: @{command (HOL)\n  \"setup_lifting\"} for initializing the package to work with a new type, and\n  @{command (HOL) \"lift_definition\"} for lifting constants. The Lifting\n  package works with all four kinds of type abstraction: type copies,\n  subtypes, total quotients and partial quotients.\n\n  Theoretical background can be found in @{cite\n  \"Huffman-Kuncar:2013:lifting_transfer\"}.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"setup_lifting\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close>\\\\\n    @{command_def (HOL) \"lift_definition\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\\\\\n    @{command_def (HOL) \"lifting_forget\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close>\\\\\n    @{command_def (HOL) \"lifting_update\"} & : & \\<open>local_theory \\<rightarrow> local_theory\\<close>\\\\\n    @{command_def (HOL) \"print_quot_maps\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{command_def (HOL) \"print_quotients\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{attribute_def (HOL) \"quot_map\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_eq_onp\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_mono\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_distr\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_del\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"lifting_restore\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) setup_lifting} @{syntax thm} @{syntax thm}? \\<newline>\n      (@'parametric' @{syntax thm})?\n    ;\n    @@{command (HOL) lift_definition} ('(' 'code_dt' ')')? \\<newline>\n      @{syntax name} '::' @{syntax type} @{syntax mixfix}? 'is' @{syntax term} \\<newline>\n      (@'parametric' (@{syntax thm}+))?\n    ;\n    @@{command (HOL) lifting_forget} @{syntax name}\n    ;\n    @@{command (HOL) lifting_update} @{syntax name}\n    ;\n    @@{attribute (HOL) lifting_restore}\n      @{syntax thm} (@{syntax thm} @{syntax thm})?\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"setup_lifting\"} Sets up the Lifting package to work with\n  a user-defined type. The command supports two modes.\n\n    \\<^enum> The first one is a low-level mode when the user must provide as a first\n    argument of @{command (HOL) \"setup_lifting\"} a quotient theorem @{term\n    \"Quotient R Abs Rep T\"}. The package configures a transfer rule for\n    equality, a domain transfer rules and sets up the @{command_def (HOL)\n    \"lift_definition\"} command to work with the abstract type. An optional\n    theorem @{term \"reflp R\"}, which certifies that the equivalence relation R\n    is total, can be provided as a second argument. This allows the package to\n    generate stronger transfer rules. And finally, the parametricity theorem\n    for @{term R} can be provided as a third argument. This allows the package\n    to generate a stronger transfer rule for equality.\n\n    Users generally will not prove the \\<open>Quotient\\<close> theorem manually for new\n    types, as special commands exist to automate the process.\n\n    \\<^enum> When a new subtype is defined by @{command (HOL) typedef}, @{command\n    (HOL) \"lift_definition\"} can be used in its second mode, where only the\n    @{term type_definition} theorem @{term \"type_definition Rep Abs A\"} is\n    used as an argument of the command. The command internally proves the\n    corresponding @{term Quotient} theorem and registers it with @{command\n    (HOL) setup_lifting} using its first mode.\n\n  For quotients, the command @{command (HOL) quotient_type} can be used. The\n  command defines a new quotient type and similarly to the previous case, the\n  corresponding Quotient theorem is proved and registered by @{command (HOL)\n  setup_lifting}.\n\n  \\<^medskip>\n  The command @{command (HOL) \"setup_lifting\"} also sets up the code generator\n  for the new type. Later on, when a new constant is defined by @{command\n  (HOL) \"lift_definition\"}, the Lifting package proves and registers a code\n  equation (if there is one) for the new constant.\n\n  \\<^descr> @{command (HOL) \"lift_definition\"} \\<open>f :: \\<tau>\\<close> @{keyword (HOL) \"is\"} \\<open>t\\<close>\n  Defines a new function \\<open>f\\<close> with an abstract type \\<open>\\<tau>\\<close> in terms of a\n  corresponding operation \\<open>t\\<close> on a representation type. More formally, if \\<open>t\n  :: \\<sigma>\\<close>, then the command builds a term \\<open>F\\<close> as a corresponding combination of\n  abstraction and representation functions such that \\<open>F :: \\<sigma> \\<Rightarrow> \\<tau>\\<close> and defines\n  \\<open>f \\<equiv> F t\\<close>. The term \\<open>t\\<close> does not have to be necessarily a constant but it\n  can be any term.\n\n  The command opens a proof and the user must discharge a respectfulness proof\n  obligation. For a type copy, i.e.\\ a typedef with \\<open>UNIV\\<close>, the obligation is\n  discharged automatically. The proof goal is presented in a user-friendly,\n  readable form. A respectfulness theorem in the standard format \\<open>f.rsp\\<close> and a\n  transfer rule \\<open>f.transfer\\<close> for the Transfer package are generated by the\n  package.\n\n  The user can specify a parametricity theorems for \\<open>t\\<close> after the keyword\n  @{keyword \"parametric\"}, which allows the command to generate parametric\n  transfer rules for \\<open>f\\<close>.\n\n  For each constant defined through trivial quotients (type copies or\n  subtypes) \\<open>f.rep_eq\\<close> is generated. The equation is a code certificate that\n  defines \\<open>f\\<close> using the representation function.\n\n  For each constant \\<open>f.abs_eq\\<close> is generated. The equation is unconditional for\n  total quotients. The equation defines \\<open>f\\<close> using the abstraction function.\n\n  \\<^medskip>\n  Integration with [@{attribute code} abstract]: For subtypes (e.g.\\\n  corresponding to a datatype invariant, such as @{typ \"'a dlist\"}), @{command\n  (HOL) \"lift_definition\"} uses a code certificate theorem \\<open>f.rep_eq\\<close> as a\n  code equation. Because of the limitation of the code generator, \\<open>f.rep_eq\\<close>\n  cannot be used as a code equation if the subtype occurs inside the result\n  type rather than at the top level (e.g.\\ function returning @{typ \"'a dlist\n  option\"} vs. @{typ \"'a dlist\"}).\n\n  In this case, an extension of @{command (HOL) \"lift_definition\"} can be\n  invoked by specifying the flag \\<open>code_dt\\<close>. This extension enables code\n  execution through series of internal type and lifting definitions if the\n  return type \\<open>\\<tau>\\<close> meets the following inductive conditions:\n\n    \\<^descr> \\<open>\\<tau>\\<close> is a type variable\n\n    \\<^descr> \\<open>\\<tau> = \\<tau>\\<^sub>1 \\<dots> \\<tau>\\<^sub>n \\<kappa>\\<close>, where \\<open>\\<kappa>\\<close> is an abstract type constructor and \\<open>\\<tau>\\<^sub>1 \\<dots>\n    \\<tau>\\<^sub>n\\<close> do not contain abstract types (i.e.\\ @{typ \"int dlist\"} is allowed\n    whereas @{typ \"int dlist dlist\"} not)\n\n    \\<^descr> \\<open>\\<tau> = \\<tau>\\<^sub>1 \\<dots> \\<tau>\\<^sub>n \\<kappa>\\<close>, \\<open>\\<kappa>\\<close> is a type constructor that was defined as a\n    (co)datatype whose constructor argument types do not contain either\n    non-free datatypes or the function type.\n\n  Integration with [@{attribute code} equation]: For total quotients,\n  @{command (HOL) \"lift_definition\"} uses \\<open>f.abs_eq\\<close> as a code equation.\n\n  \\<^descr> @{command (HOL) lifting_forget} and @{command (HOL) lifting_update} These\n  two commands serve for storing and deleting the set-up of the Lifting\n  package and corresponding transfer rules defined by this package. This is\n  useful for hiding of type construction details of an abstract type when the\n  construction is finished but it still allows additions to this construction\n  when this is later necessary.\n\n  Whenever the Lifting package is set up with a new abstract type \\<open>\\<tau>\\<close> by\n  @{command_def (HOL) \"lift_definition\"}, the package defines a new bundle\n  that is called \\<open>\\<tau>.lifting\\<close>. This bundle already includes set-up for the\n  Lifting package. The new transfer rules introduced by @{command (HOL)\n  \"lift_definition\"} can be stored in the bundle by the command @{command\n  (HOL) \"lifting_update\"} \\<open>\\<tau>.lifting\\<close>.\n\n  The command @{command (HOL) \"lifting_forget\"} \\<open>\\<tau>.lifting\\<close> deletes set-up of\n  the Lifting package for \\<open>\\<tau>\\<close> and deletes all the transfer rules that were\n  introduced by @{command (HOL) \"lift_definition\"} using \\<open>\\<tau>\\<close> as an abstract\n  type.\n\n  The stored set-up in a bundle can be reintroduced by the Isar commands for\n  including a bundle (@{command \"include\"}, @{keyword \"includes\"} and\n  @{command \"including\"}).\n\n  \\<^descr> @{command (HOL) \"print_quot_maps\"} prints stored quotient map theorems.\n\n  \\<^descr> @{command (HOL) \"print_quotients\"} prints stored quotient theorems.\n\n  \\<^descr> @{attribute (HOL) quot_map} registers a quotient map theorem, a theorem\n  showing how to ``lift'' quotients over type constructors. E.g.\\ @{term\n  \"Quotient R Abs Rep T \\<Longrightarrow> Quotient (rel_set R) (image Abs) (image Rep)\n  (rel_set T)\"}. For examples see \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or\n  \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property is proved automatically if the\n  involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) relator_eq_onp} registers a theorem that shows that a\n  relator applied to an equality restricted by a predicate @{term P} (i.e.\\\n  @{term \"eq_onp P\"}) is equal to a predicator applied to the @{term P}. The\n  combinator @{const eq_onp} is used for internal encoding of proper subtypes.\n  Such theorems allows the package to hide \\<open>eq_onp\\<close> from a user in a\n  user-readable form of a respectfulness theorem. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) \"relator_mono\"} registers a property describing a\n  monotonicity of a relator. E.g.\\ @{prop \"A \\<le> B \\<Longrightarrow> rel_set A \\<le> rel_set B\"}.\n  This property is needed for proving a stronger transfer rule in\n  @{command_def (HOL) \"lift_definition\"} when a parametricity theorem for the\n  raw term is specified and also for the reflexivity prover. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) \"relator_distr\"} registers a property describing a\n  distributivity of the relation composition and a relator. E.g.\\ \\<open>rel_set R\n  \\<circ>\\<circ> rel_set S = rel_set (R \\<circ>\\<circ> S)\\<close>. This property is needed for proving a\n  stronger transfer rule in @{command_def (HOL) \"lift_definition\"} when a\n  parametricity theorem for the raw term is specified. When this equality does\n  not hold unconditionally (e.g.\\ for the function type), the user can\n  specified each direction separately and also register multiple theorems with\n  different set of assumptions. This attribute can be used only after the\n  monotonicity property was already registered by @{attribute (HOL)\n  \"relator_mono\"}. For examples see \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or\n  \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property is proved automatically if the\n  involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute (HOL) quot_del} deletes a corresponding Quotient theorem from\n  the Lifting infrastructure and thus de-register the corresponding quotient.\n  This effectively causes that @{command (HOL) lift_definition} will not do\n  any lifting for the corresponding type. This attribute is rather used for\n  low-level manipulation with set-up of the Lifting package because @{command\n  (HOL) lifting_forget} is preferred for normal usage.\n\n  \\<^descr> @{attribute (HOL) lifting_restore} \\<open>Quotient_thm pcr_def pcr_cr_eq_thm\\<close>\n  registers the Quotient theorem \\<open>Quotient_thm\\<close> in the Lifting infrastructure\n  and thus sets up lifting for an abstract type \\<open>\\<tau>\\<close> (that is defined by\n  \\<open>Quotient_thm\\<close>). Optional theorems \\<open>pcr_def\\<close> and \\<open>pcr_cr_eq_thm\\<close> can be\n  specified to register the parametrized correspondence relation for \\<open>\\<tau>\\<close>.\n  E.g.\\ for @{typ \"'a dlist\"}, \\<open>pcr_def\\<close> is \\<open>pcr_dlist A \\<equiv> list_all2 A \\<circ>\\<circ>\n  cr_dlist\\<close> and \\<open>pcr_cr_eq_thm\\<close> is \\<open>pcr_dlist (op =) = (op =)\\<close>. This attribute\n  is rather used for low-level manipulation with set-up of the Lifting package\n  because using of the bundle \\<open>\\<tau>.lifting\\<close> together with the commands @{command\n  (HOL) lifting_forget} and @{command (HOL) lifting_update} is preferred for\n  normal usage.\n\n  \\<^descr> Integration with the BNF package @{cite \"isabelle-datatypes\"}: As already\n  mentioned, the theorems that are registered by the following attributes are\n  proved and registered automatically if the involved type is BNF without dead\n  variables: @{attribute (HOL) quot_map}, @{attribute (HOL) relator_eq_onp},\n  @{attribute (HOL) \"relator_mono\"}, @{attribute (HOL) \"relator_distr\"}. Also\n  the definition of a relator and predicator is provided automatically.\n  Moreover, if the BNF represents a datatype, simplification rules for a\n  predicator are again proved automatically.\n\\<close>\n\n\nsubsection \\<open>Transfer package \\label{sec:transfer}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"transfer\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer'\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_prover\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) \"Transfer.transferred\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"untransferred\"} & : & \\<open>attribute\\<close> \\\\\n    @{method_def (HOL) \"transfer_start\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_prover_start\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_step\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_end\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"transfer_prover_end\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) \"transfer_rule\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"transfer_domain_rule\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_eq\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"relator_domain\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^descr> @{method (HOL) \"transfer\"} method replaces the current subgoal with a\n  logically equivalent one that uses different types and constants. The\n  replacement of types and constants is guided by the database of transfer\n  rules. Goals are generalized over all free variables by default; this is\n  necessary for variables whose types change, but can be overridden for\n  specific variables with e.g. \\<open>transfer fixing: x y z\\<close>.\n\n  \\<^descr> @{method (HOL) \"transfer'\"} is a variant of @{method (HOL) transfer} that\n  allows replacing a subgoal with one that is logically stronger (rather than\n  equivalent). For example, a subgoal involving equality on a quotient type\n  could be replaced with a subgoal involving equality (instead of the\n  corresponding equivalence relation) on the underlying raw type.\n\n  \\<^descr> @{method (HOL) \"transfer_prover\"} method assists with proving a transfer\n  rule for a new constant, provided the constant is defined in terms of other\n  constants that already have transfer rules. It should be applied after\n  unfolding the constant definitions.\n\n  \\<^descr> @{method (HOL) \"transfer_start\"}, @{method (HOL) \"transfer_step\"},\n  @{method (HOL) \"transfer_end\"}, @{method (HOL) \"transfer_prover_start\"} and\n  @{method (HOL) \"transfer_prover_end\"} methods are meant to be used for\n  debugging of @{method (HOL) \"transfer\"} and @{method (HOL)\n  \"transfer_prover\"}, which we can decompose as follows: @{method (HOL)\n  \"transfer\"} = (@{method (HOL) \"transfer_start\"}, @{method (HOL)\n  \"transfer_step\"}+, @{method (HOL) \"transfer_end\"}) and @{method (HOL)\n  \"transfer_prover\"} = (@{method (HOL) \"transfer_prover_start\"}, @{method\n  (HOL) \"transfer_step\"}+, @{method (HOL) \"transfer_prover_end\"}). For usage\n  examples see \\<^file>\\<open>~~/src/HOL/ex/Transfer_Debug.thy\\<close>.\n\n  \\<^descr> @{attribute (HOL) \"untransferred\"} proves the same equivalent theorem as\n  @{method (HOL) \"transfer\"} internally does.\n\n  \\<^descr> @{attribute (HOL) Transfer.transferred} works in the opposite direction\n  than @{method (HOL) \"transfer'\"}. E.g.\\ given the transfer relation \\<open>ZN x n\n  \\<equiv> (x = int n)\\<close>, corresponding transfer rules and the theorem \\<open>\\<forall>x::int \\<in>\n  {0..}. x < x + 1\\<close>, the attribute would prove \\<open>\\<forall>n::nat. n < n + 1\\<close>. The\n  attribute is still in experimental phase of development.\n\n  \\<^descr> @{attribute (HOL) \"transfer_rule\"} attribute maintains a collection of\n  transfer rules, which relate constants at two different types. Typical\n  transfer rules may relate different type instances of the same polymorphic\n  constant, or they may relate an operation on a raw type to a corresponding\n  operation on an abstract type (quotient or subtype). For example:\n\n    \\<open>((A ===> B) ===> list_all2 A ===> list_all2 B) map map\\<close> \\\\\n    \\<open>(cr_int ===> cr_int ===> cr_int) (\\<lambda>(x,y) (u,v). (x+u, y+v)) plus\\<close>\n\n  Lemmas involving predicates on relations can also be registered using the\n  same attribute. For example:\n\n    \\<open>bi_unique A \\<Longrightarrow> (list_all2 A ===> op =) distinct distinct\\<close> \\\\\n    \\<open>\\<lbrakk>bi_unique A; bi_unique B\\<rbrakk> \\<Longrightarrow> bi_unique (rel_prod A B)\\<close>\n\n  Preservation of predicates on relations (\\<open>bi_unique, bi_total, right_unique,\n  right_total, left_unique, left_total\\<close>) with the respect to a relator is\n  proved automatically if the involved type is BNF @{cite\n  \"isabelle-datatypes\"} without dead variables.\n\n  \\<^descr> @{attribute (HOL) \"transfer_domain_rule\"} attribute maintains a collection\n  of rules, which specify a domain of a transfer relation by a predicate.\n  E.g.\\ given the transfer relation \\<open>ZN x n \\<equiv> (x = int n)\\<close>, one can register\n  the following transfer domain rule: \\<open>Domainp ZN = (\\<lambda>x. x \\<ge> 0)\\<close>. The rules\n  allow the package to produce more readable transferred goals, e.g.\\ when\n  quantifiers are transferred.\n\n  \\<^descr> @{attribute (HOL) relator_eq} attribute collects identity laws for\n  relators of various type constructors, e.g. @{term \"rel_set (op =) = (op\n  =)\"}. The @{method (HOL) transfer} method uses these lemmas to infer\n  transfer rules for non-polymorphic constants on the fly. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n  \\<^descr> @{attribute_def (HOL) \"relator_domain\"} attribute collects rules\n  describing domains of relators by predicators. E.g.\\ @{term \"Domainp\n  (rel_set T) = (\\<lambda>A. Ball A (Domainp T))\"}. This allows the package to lift\n  transfer domain rules through type constructors. For examples see\n  \\<^file>\\<open>~~/src/HOL/Lifting_Set.thy\\<close> or \\<^file>\\<open>~~/src/HOL/Lifting.thy\\<close>. This property\n  is proved automatically if the involved type is BNF without dead variables.\n\n\n  Theoretical background can be found in @{cite\n  \"Huffman-Kuncar:2013:lifting_transfer\"}.\n\\<close>\n\n\nsubsection \\<open>Old-style definitions for quotient types \\label{sec:old-quotient}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"quotient_definition\"} & : & \\<open>local_theory \\<rightarrow> proof(prove)\\<close>\\\\\n    @{command_def (HOL) \"print_quotmapsQ3\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{command_def (HOL) \"print_quotientsQ3\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{command_def (HOL) \"print_quotconsts\"} & : & \\<open>context \\<rightarrow>\\<close>\\\\\n    @{method_def (HOL) \"lifting\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"lifting_setup\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"descending\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"descending_setup\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"partiality_descending\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"partiality_descending_setup\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"regularize\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"injection\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"cleaning\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) \"quot_thm\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_lifted\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_respect\"} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) \"quot_preserve\"} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) quotient_definition} constdecl? @{syntax thmdecl}? \\<newline>\n    @{syntax term} 'is' @{syntax term}\n    ;\n    constdecl: @{syntax name} ('::' @{syntax type})? @{syntax mixfix}?\n    ;\n    @@{method (HOL) lifting} @{syntax thms}?\n    ;\n    @@{method (HOL) lifting_setup} @{syntax thms}?\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"quotient_definition\"} defines a constant on the quotient\n  type.\n\n  \\<^descr> @{command (HOL) \"print_quotmapsQ3\"} prints quotient map functions.\n\n  \\<^descr> @{command (HOL) \"print_quotientsQ3\"} prints quotients.\n\n  \\<^descr> @{command (HOL) \"print_quotconsts\"} prints quotient constants.\n\n  \\<^descr> @{method (HOL) \"lifting\"} and @{method (HOL) \"lifting_setup\"} methods\n  match the current goal with the given raw theorem to be lifted producing\n  three new subgoals: regularization, injection and cleaning subgoals.\n  @{method (HOL) \"lifting\"} tries to apply the heuristics for automatically\n  solving these three subgoals and leaves only the subgoals unsolved by the\n  heuristics to the user as opposed to @{method (HOL) \"lifting_setup\"} which\n  leaves the three subgoals unsolved.\n\n  \\<^descr> @{method (HOL) \"descending\"} and @{method (HOL) \"descending_setup\"} try to\n  guess a raw statement that would lift to the current subgoal. Such statement\n  is assumed as a new subgoal and @{method (HOL) \"descending\"} continues in\n  the same way as @{method (HOL) \"lifting\"} does. @{method (HOL) \"descending\"}\n  tries to solve the arising regularization, injection and cleaning subgoals\n  with the analogous method @{method (HOL) \"descending_setup\"} which leaves\n  the four unsolved subgoals.\n\n  \\<^descr> @{method (HOL) \"partiality_descending\"} finds the regularized theorem that\n  would lift to the current subgoal, lifts it and leaves as a subgoal. This\n  method can be used with partial equivalence quotients where the non\n  regularized statements would not be true. @{method (HOL)\n  \"partiality_descending_setup\"} leaves the injection and cleaning subgoals\n  unchanged.\n\n  \\<^descr> @{method (HOL) \"regularize\"} applies the regularization heuristics to the\n  current subgoal.\n\n  \\<^descr> @{method (HOL) \"injection\"} applies the injection heuristics to the\n  current goal using the stored quotient respectfulness theorems.\n\n  \\<^descr> @{method (HOL) \"cleaning\"} applies the injection cleaning heuristics to\n  the current subgoal using the stored quotient preservation theorems.\n\n  \\<^descr> @{attribute (HOL) quot_lifted} attribute tries to automatically transport\n  the theorem to the quotient type. The attribute uses all the defined\n  quotients types and quotient constants often producing undesired results or\n  theorems that cannot be lifted.\n\n  \\<^descr> @{attribute (HOL) quot_respect} and @{attribute (HOL) quot_preserve}\n  attributes declare a theorem as a respectfulness and preservation theorem\n  respectively. These are stored in the local theory store and used by the\n  @{method (HOL) \"injection\"} and @{method (HOL) \"cleaning\"} methods\n  respectively.\n\n  \\<^descr> @{attribute (HOL) quot_thm} declares that a certain theorem is a quotient\n  extension theorem. Quotient extension theorems allow for quotienting inside\n  container types. Given a polymorphic type that serves as a container, a map\n  function defined for this container using @{command (HOL) \"functor\"} and a\n  relation map defined for for the container type, the quotient extension\n  theorem should be @{term \"Quotient3 R Abs Rep \\<Longrightarrow> Quotient3 (rel_map R) (map\n  Abs) (map Rep)\"}. Quotient extension theorems are stored in a database and\n  are used all the steps of lifting theorems.\n\\<close>\n\n\nchapter \\<open>Proof tools\\<close>\n\nsection \\<open>Proving propositions\\<close>\n\ntext \\<open>\n  In addition to the standard proof methods, a number of diagnosis tools\n  search for proofs and provide an Isar proof snippet on success. These tools\n  are available via the following commands.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"solve_direct\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"try\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"try0\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"sledgehammer\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"sledgehammer_params\"} & : & \\<open>theory \\<rightarrow> theory\\<close>\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) try}\n    ;\n\n    @@{command (HOL) try0} ( ( ( 'simp' | 'intro' | 'elim' | 'dest' ) ':' @{syntax thms} ) + ) ?\n      @{syntax nat}?\n    ;\n\n    @@{command (HOL) sledgehammer} ( '[' args ']' )? facts? @{syntax nat}?\n    ;\n\n    @@{command (HOL) sledgehammer_params} ( ( '[' args ']' ) ? )\n    ;\n    args: ( @{syntax name} '=' value + ',' )\n    ;\n    facts: '(' ( ( ( ( 'add' | 'del' ) ':' ) ? @{syntax thms} ) + ) ? ')'\n  \\<close>} % FIXME check args \"value\"\n\n  \\<^descr> @{command (HOL) \"solve_direct\"} checks whether the current subgoals can be\n  solved directly by an existing theorem. Duplicate lemmas can be detected in\n  this way.\n\n  \\<^descr> @{command (HOL) \"try0\"} attempts to prove a subgoal using a combination of\n  standard proof methods (@{method auto}, @{method simp}, @{method blast},\n  etc.). Additional facts supplied via \\<open>simp:\\<close>, \\<open>intro:\\<close>, \\<open>elim:\\<close>, and \\<open>dest:\\<close>\n  are passed to the appropriate proof methods.\n\n  \\<^descr> @{command (HOL) \"try\"} attempts to prove or disprove a subgoal using a\n  combination of provers and disprovers (@{command (HOL) \"solve_direct\"},\n  @{command (HOL) \"quickcheck\"}, @{command (HOL) \"try0\"}, @{command (HOL)\n  \"sledgehammer\"}, @{command (HOL) \"nitpick\"}).\n\n  \\<^descr> @{command (HOL) \"sledgehammer\"} attempts to prove a subgoal using external\n  automatic provers (resolution provers and SMT solvers). See the Sledgehammer\n  manual @{cite \"isabelle-sledgehammer\"} for details.\n\n  \\<^descr> @{command (HOL) \"sledgehammer_params\"} changes @{command (HOL)\n  \"sledgehammer\"} configuration options persistently.\n\\<close>\n\n\nsection \\<open>Checking and refuting propositions\\<close>\n\ntext \\<open>\n  Identifying incorrect propositions usually involves evaluation of particular\n  assignments and systematic counterexample search. This is supported by the\n  following commands.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"value\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"values\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"quickcheck\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"nitpick\"}\\<open>\\<^sup>*\\<close> & : & \\<open>proof \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"quickcheck_params\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"nitpick_params\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"quickcheck_generator\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"find_unused_assms\"} & : & \\<open>context \\<rightarrow>\\<close>\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) value} ( '[' @{syntax name} ']' )? modes? @{syntax term}\n    ;\n\n    @@{command (HOL) values} modes? @{syntax nat}? @{syntax term}\n    ;\n\n    (@@{command (HOL) quickcheck} | @@{command (HOL) nitpick})\n      ( '[' args ']' )? @{syntax nat}?\n    ;\n\n    (@@{command (HOL) quickcheck_params} |\n      @@{command (HOL) nitpick_params}) ( '[' args ']' )?\n    ;\n\n    @@{command (HOL) quickcheck_generator} @{syntax name} \\<newline>\n      'operations:' ( @{syntax term} +)\n    ;\n\n    @@{command (HOL) find_unused_assms} @{syntax name}?\n    ;\n    modes: '(' (@{syntax name} +) ')'\n    ;\n    args: ( @{syntax name} '=' value + ',' )\n  \\<close>} % FIXME check \"value\"\n\n  \\<^descr> @{command (HOL) \"value\"}~\\<open>t\\<close> evaluates and prints a term; optionally\n  \\<open>modes\\<close> can be specified, which are appended to the current print mode; see\n  \\secref{sec:print-modes}. Evaluation is tried first using ML, falling back\n  to normalization by evaluation if this fails. Alternatively a specific\n  evaluator can be selected using square brackets; typical evaluators use the\n  current set of code equations to normalize and include \\<open>simp\\<close> for fully\n  symbolic evaluation using the simplifier, \\<open>nbe\\<close> for \\<^emph>\\<open>normalization by\n  evaluation\\<close> and \\<^emph>\\<open>code\\<close> for code generation in SML.\n\n  \\<^descr> @{command (HOL) \"values\"}~\\<open>t\\<close> enumerates a set comprehension by evaluation\n  and prints its values up to the given number of solutions; optionally\n  \\<open>modes\\<close> can be specified, which are appended to the current print mode; see\n  \\secref{sec:print-modes}.\n\n  \\<^descr> @{command (HOL) \"quickcheck\"} tests the current goal for counterexamples\n  using a series of assignments for its free variables; by default the first\n  subgoal is tested, an other can be selected explicitly using an optional\n  goal index. Assignments can be chosen exhausting the search space up to a\n  given size, or using a fixed number of random assignments in the search\n  space, or exploring the search space symbolically using narrowing. By\n  default, quickcheck uses exhaustive testing. A number of configuration\n  options are supported for @{command (HOL) \"quickcheck\"}, notably:\n\n    \\<^descr>[\\<open>tester\\<close>] specifies which testing approach to apply. There are three\n    testers, \\<open>exhaustive\\<close>, \\<open>random\\<close>, and \\<open>narrowing\\<close>. An unknown configuration\n    option is treated as an argument to tester, making \\<open>tester =\\<close> optional.\n    When multiple testers are given, these are applied in parallel. If no\n    tester is specified, quickcheck uses the testers that are set active,\n    i.e.\\ configurations @{attribute quickcheck_exhaustive_active},\n    @{attribute quickcheck_random_active}, @{attribute\n    quickcheck_narrowing_active} are set to true.\n\n    \\<^descr>[\\<open>size\\<close>] specifies the maximum size of the search space for assignment\n    values.\n\n    \\<^descr>[\\<open>genuine_only\\<close>] sets quickcheck only to return genuine counterexample,\n    but not potentially spurious counterexamples due to underspecified\n    functions.\n\n    \\<^descr>[\\<open>abort_potential\\<close>] sets quickcheck to abort once it found a potentially\n    spurious counterexample and to not continue to search for a further\n    genuine counterexample. For this option to be effective, the\n    \\<open>genuine_only\\<close> option must be set to false.\n\n    \\<^descr>[\\<open>eval\\<close>] takes a term or a list of terms and evaluates these terms under\n    the variable assignment found by quickcheck. This option is currently only\n    supported by the default (exhaustive) tester.\n\n    \\<^descr>[\\<open>iterations\\<close>] sets how many sets of assignments are generated for each\n    particular size.\n\n    \\<^descr>[\\<open>no_assms\\<close>] specifies whether assumptions in structured proofs should be\n    ignored.\n\n    \\<^descr>[\\<open>locale\\<close>] specifies how to process conjectures in a locale context,\n    i.e.\\ they can be interpreted or expanded. The option is a\n    whitespace-separated list of the two words \\<open>interpret\\<close> and \\<open>expand\\<close>. The\n    list determines the order they are employed. The default setting is to\n    first use interpretations and then test the expanded conjecture. The\n    option is only provided as attribute declaration, but not as parameter to\n    the command.\n\n    \\<^descr>[\\<open>timeout\\<close>] sets the time limit in seconds.\n\n    \\<^descr>[\\<open>default_type\\<close>] sets the type(s) generally used to instantiate type\n    variables.\n\n    \\<^descr>[\\<open>report\\<close>] if set quickcheck reports how many tests fulfilled the\n    preconditions.\n\n    \\<^descr>[\\<open>use_subtype\\<close>] if set quickcheck automatically lifts conjectures to\n    registered subtypes if possible, and tests the lifted conjecture.\n\n    \\<^descr>[\\<open>quiet\\<close>] if set quickcheck does not output anything while testing.\n\n    \\<^descr>[\\<open>verbose\\<close>] if set quickcheck informs about the current size and\n    cardinality while testing.\n\n    \\<^descr>[\\<open>expect\\<close>] can be used to check if the user's expectation was met\n    (\\<open>no_expectation\\<close>, \\<open>no_counterexample\\<close>, or \\<open>counterexample\\<close>).\n\n  These option can be given within square brackets.\n\n  Using the following type classes, the testers generate values and convert\n  them back into Isabelle terms for displaying counterexamples.\n\n    \\<^descr>[\\<open>exhaustive\\<close>] The parameters of the type classes @{class exhaustive} and\n    @{class full_exhaustive} implement the testing. They take a testing\n    function as a parameter, which takes a value of type @{typ \"'a\"} and\n    optionally produces a counterexample, and a size parameter for the test\n    values. In @{class full_exhaustive}, the testing function parameter\n    additionally expects a lazy term reconstruction in the type @{typ\n    Code_Evaluation.term} of the tested value.\n\n    The canonical implementation for \\<open>exhaustive\\<close> testers calls the given\n    testing function on all values up to the given size and stops as soon as a\n    counterexample is found.\n\n    \\<^descr>[\\<open>random\\<close>] The operation @{const Quickcheck_Random.random} of the type\n    class @{class random} generates a pseudo-random value of the given size\n    and a lazy term reconstruction of the value in the type @{typ\n    Code_Evaluation.term}. A pseudo-randomness generator is defined in theory\n    @{theory Random}.\n\n    \\<^descr>[\\<open>narrowing\\<close>] implements Haskell's Lazy Smallcheck @{cite\n    \"runciman-naylor-lindblad\"} using the type classes @{class narrowing} and\n    @{class partial_term_of}. Variables in the current goal are initially\n    represented as symbolic variables. If the execution of the goal tries to\n    evaluate one of them, the test engine replaces it with refinements\n    provided by @{const narrowing}. Narrowing views every value as a\n    sum-of-products which is expressed using the operations @{const\n    Quickcheck_Narrowing.cons} (embedding a value), @{const\n    Quickcheck_Narrowing.apply} (product) and @{const\n    Quickcheck_Narrowing.sum} (sum). The refinement should enable further\n    evaluation of the goal.\n\n    For example, @{const narrowing} for the list type @{typ \"'a :: narrowing list\"}\n    can be recursively defined as\n    @{term \"Quickcheck_Narrowing.sum (Quickcheck_Narrowing.cons [])\n              (Quickcheck_Narrowing.apply\n                (Quickcheck_Narrowing.apply\n                  (Quickcheck_Narrowing.cons (op #))\n                  narrowing)\n                narrowing)\"}.\n    If a symbolic variable of type @{typ \"_ list\"} is evaluated, it is\n    replaced by (i)~the empty list @{term \"[]\"} and (ii)~by a non-empty list\n    whose head and tail can then be recursively refined if needed.\n\n    To reconstruct counterexamples, the operation @{const partial_term_of}\n    transforms \\<open>narrowing\\<close>'s deep representation of terms to the type @{typ\n    Code_Evaluation.term}. The deep representation models symbolic variables\n    as @{const Quickcheck_Narrowing.Narrowing_variable}, which are normally\n    converted to @{const Code_Evaluation.Free}, and refined values as @{term\n    \"Quickcheck_Narrowing.Narrowing_constructor i args\"}, where @{term \"i ::\n    integer\"} denotes the index in the sum of refinements. In the above\n    example for lists, @{term \"0\"} corresponds to @{term \"[]\"} and @{term \"1\"}\n    to @{term \"op #\"}.\n\n    The command @{command (HOL) \"code_datatype\"} sets up @{const\n    partial_term_of} such that the @{term \"i\"}-th refinement is interpreted as\n    the @{term \"i\"}-th constructor, but it does not ensures consistency with\n    @{const narrowing}.\n\n  \\<^descr> @{command (HOL) \"quickcheck_params\"} changes @{command (HOL) \"quickcheck\"}\n  configuration options persistently.\n\n  \\<^descr> @{command (HOL) \"quickcheck_generator\"} creates random and exhaustive\n  value generators for a given type and operations. It generates values by\n  using the operations as if they were constructors of that type.\n\n  \\<^descr> @{command (HOL) \"nitpick\"} tests the current goal for counterexamples\n  using a reduction to first-order relational logic. See the Nitpick manual\n  @{cite \"isabelle-nitpick\"} for details.\n\n  \\<^descr> @{command (HOL) \"nitpick_params\"} changes @{command (HOL) \"nitpick\"}\n  configuration options persistently.\n\n  \\<^descr> @{command (HOL) \"find_unused_assms\"} finds potentially superfluous\n  assumptions in theorems using quickcheck. It takes the theory name to be\n  checked for superfluous assumptions as optional argument. If not provided,\n  it checks the current theory. Options to the internal quickcheck invocations\n  can be changed with common configuration declarations.\n\\<close>\n\n\nsection \\<open>Coercive subtyping\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) coercion} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_delete} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_enabled} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_map} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) coercion_args} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  Coercive subtyping allows the user to omit explicit type conversions, also\n  called \\<^emph>\\<open>coercions\\<close>. Type inference will add them as necessary when parsing\n  a term. See @{cite \"traytel-berghofer-nipkow-2011\"} for details.\n\n  @{rail \\<open>\n    @@{attribute (HOL) coercion} (@{syntax term})\n    ;\n    @@{attribute (HOL) coercion_delete} (@{syntax term})\n    ;\n    @@{attribute (HOL) coercion_map} (@{syntax term})\n    ;\n    @@{attribute (HOL) coercion_args} (@{syntax const}) (('+' | '0' | '-')+)\n  \\<close>}\n\n  \\<^descr> @{attribute (HOL) \"coercion\"}~\\<open>f\\<close> registers a new coercion function \\<open>f ::\n  \\<sigma>\\<^sub>1 \\<Rightarrow> \\<sigma>\\<^sub>2\\<close> where \\<open>\\<sigma>\\<^sub>1\\<close> and \\<open>\\<sigma>\\<^sub>2\\<close> are type constructors without arguments.\n  Coercions are composed by the inference algorithm if needed. Note that the\n  type inference algorithm is complete only if the registered coercions form a\n  lattice.\n\n  \\<^descr> @{attribute (HOL) \"coercion_delete\"}~\\<open>f\\<close> deletes a preceding declaration\n  (using @{attribute (HOL) \"coercion\"}) of the function \\<open>f :: \\<sigma>\\<^sub>1 \\<Rightarrow> \\<sigma>\\<^sub>2\\<close> as a\n  coercion.\n\n  \\<^descr> @{attribute (HOL) \"coercion_map\"}~\\<open>map\\<close> registers a new map function to\n  lift coercions through type constructors. The function \\<open>map\\<close> must conform to\n  the following type pattern\n\n  \\begin{matharray}{lll}\n    \\<open>map\\<close> & \\<open>::\\<close> &\n      \\<open>f\\<^sub>1 \\<Rightarrow> \\<dots> \\<Rightarrow> f\\<^sub>n \\<Rightarrow> (\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n) t \\<Rightarrow> (\\<beta>\\<^sub>1, \\<dots>, \\<beta>\\<^sub>n) t\\<close> \\\\\n  \\end{matharray}\n\n  where \\<open>t\\<close> is a type constructor and \\<open>f\\<^sub>i\\<close> is of type \\<open>\\<alpha>\\<^sub>i \\<Rightarrow> \\<beta>\\<^sub>i\\<close> or \\<open>\\<beta>\\<^sub>i \\<Rightarrow>\n  \\<alpha>\\<^sub>i\\<close>. Registering a map function overwrites any existing map function for\n  this particular type constructor.\n\n  \\<^descr> @{attribute (HOL) \"coercion_args\"} can be used to disallow coercions to be\n  inserted in certain positions in a term. For example, given the constant \\<open>c\n  :: \\<sigma>\\<^sub>1 \\<Rightarrow> \\<sigma>\\<^sub>2 \\<Rightarrow> \\<sigma>\\<^sub>3 \\<Rightarrow> \\<sigma>\\<^sub>4\\<close> and the list of policies \\<open>- + 0\\<close> as arguments,\n  coercions will not be inserted in the first argument of \\<open>c\\<close> (policy \\<open>-\\<close>);\n  they may be inserted in the second argument (policy \\<open>+\\<close>) even if the\n  constant \\<open>c\\<close> itself is in a position where coercions are disallowed; the\n  third argument inherits the allowance of coercsion insertion from the\n  position of the constant \\<open>c\\<close> (policy \\<open>0\\<close>). The standard usage of policies is\n  the definition of syntatic constructs (usually extralogical, i.e., processed\n  and stripped during type inference), that should not be destroyed by the\n  insertion of coercions (see, for example, the setup for the case syntax in\n  @{theory Ctr_Sugar}).\n\n  \\<^descr> @{attribute (HOL) \"coercion_enabled\"} enables the coercion inference\n  algorithm.\n\\<close>\n\n\nsection \\<open>Arithmetic proof support\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) arith} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) arith} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) arith_split} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  \\<^descr> @{method (HOL) arith} decides linear arithmetic problems (on types \\<open>nat\\<close>,\n  \\<open>int\\<close>, \\<open>real\\<close>). Any current facts are inserted into the goal before running\n  the procedure.\n\n  \\<^descr> @{attribute (HOL) arith} declares facts that are supplied to the\n  arithmetic provers implicitly.\n\n  \\<^descr> @{attribute (HOL) arith_split} attribute declares case split rules to be\n  expanded before @{method (HOL) arith} is invoked.\n\n\n  Note that a simpler (but faster) arithmetic prover is already invoked by the\n  Simplifier.\n\\<close>\n\n\nsection \\<open>Intuitionistic proof search\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) iprover} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) iprover} (@{syntax rulemod} *)\n  \\<close>}\n\n  \\<^descr> @{method (HOL) iprover} performs intuitionistic proof search, depending on\n  specifically declared rules from the context, or given as explicit\n  arguments. Chained facts are inserted into the goal before commencing proof\n  search.\n\n  Rules need to be classified as @{attribute (Pure) intro}, @{attribute (Pure)\n  elim}, or @{attribute (Pure) dest}; here the ``\\<open>!\\<close>'' indicator refers to\n  ``safe'' rules, which may be applied aggressively (without considering\n  back-tracking later). Rules declared with ``\\<open>?\\<close>'' are ignored in proof\n  search (the single-step @{method (Pure) rule} method still observes these).\n  An explicit weight annotation may be given as well; otherwise the number of\n  rule premises will be taken into account here.\n\\<close>\n\n\nsection \\<open>Model Elimination and Resolution\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"meson\"} & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) \"metis\"} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) meson} @{syntax thms}?\n    ;\n    @@{method (HOL) metis}\n      ('(' ('partial_types' | 'full_types' | 'no_types' | @{syntax name}) ')')?\n      @{syntax thms}?\n  \\<close>}\n\n  \\<^descr> @{method (HOL) meson} implements Loveland's model elimination procedure\n  @{cite \"loveland-78\"}. See \\<^file>\\<open>~~/src/HOL/ex/Meson_Test.thy\\<close> for examples.\n\n  \\<^descr> @{method (HOL) metis} combines ordered resolution and ordered\n  paramodulation to find first-order (or mildly higher-order) proofs. The\n  first optional argument specifies a type encoding; see the Sledgehammer\n  manual @{cite \"isabelle-sledgehammer\"} for details. The directory\n  \\<^dir>\\<open>~~/src/HOL/Metis_Examples\\<close> contains several small theories developed to a\n  large extent using @{method (HOL) metis}.\n\\<close>\n\n\nsection \\<open>Algebraic reasoning via Gr\\\"obner bases\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"algebra\"} & : & \\<open>method\\<close> \\\\\n    @{attribute_def (HOL) algebra} & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) algebra}\n      ('add' ':' @{syntax thms})?\n      ('del' ':' @{syntax thms})?\n    ;\n    @@{attribute (HOL) algebra} (() | 'add' | 'del')\n  \\<close>}\n\n  \\<^descr> @{method (HOL) algebra} performs algebraic reasoning via Gr\\\"obner bases,\n  see also @{cite \"Chaieb-Wenzel:2007\"} and @{cite \\<open>\\S3.2\\<close> \"Chaieb-thesis\"}.\n  The method handles deals with two main classes of problems:\n\n    \\<^enum> Universal problems over multivariate polynomials in a\n    (semi)-ring/field/idom; the capabilities of the method are augmented\n    according to properties of these structures. For this problem class the\n    method is only complete for algebraically closed fields, since the\n    underlying method is based on Hilbert's Nullstellensatz, where the\n    equivalence only holds for algebraically closed fields.\n\n    The problems can contain equations \\<open>p = 0\\<close> or inequations \\<open>q \\<noteq> 0\\<close> anywhere\n    within a universal problem statement.\n\n    \\<^enum> All-exists problems of the following restricted (but useful) form:\n\n    @{text [display] \"\\<forall>x\\<^sub>1 \\<dots> x\\<^sub>n.\n      e\\<^sub>1(x\\<^sub>1, \\<dots>, x\\<^sub>n) = 0 \\<and> \\<dots> \\<and> e\\<^sub>m(x\\<^sub>1, \\<dots>, x\\<^sub>n) = 0 \\<longrightarrow>\n      (\\<exists>y\\<^sub>1 \\<dots> y\\<^sub>k.\n        p\\<^sub>1\\<^sub>1(x\\<^sub>1, \\<dots> ,x\\<^sub>n) * y\\<^sub>1 + \\<dots> + p\\<^sub>1\\<^sub>k(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>k = 0 \\<and>\n        \\<dots> \\<and>\n        p\\<^sub>t\\<^sub>1(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>1 + \\<dots> + p\\<^sub>t\\<^sub>k(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>k = 0)\"}\n\n    Here \\<open>e\\<^sub>1, \\<dots>, e\\<^sub>n\\<close> and the \\<open>p\\<^sub>i\\<^sub>j\\<close> are multivariate polynomials only in\n    the variables mentioned as arguments.\n\n  The proof method is preceded by a simplification step, which may be modified\n  by using the form \\<open>(algebra add: ths\\<^sub>1 del: ths\\<^sub>2)\\<close>. This acts like\n  declarations for the Simplifier (\\secref{sec:simplifier}) on a private\n  simpset for this tool.\n\n  \\<^descr> @{attribute algebra} (as attribute) manages the default collection of\n  pre-simplification rules of the above proof method.\n\\<close>\n\n\nsubsubsection \\<open>Example\\<close>\n\ntext \\<open>\n  The subsequent example is from geometry: collinearity is invariant by\n  rotation.\n\\<close>\n\n(*<*)experiment begin(*>*)\ntype_synonym point = \"int \\<times> int\"\n\nfun collinear :: \"point \\<Rightarrow> point \\<Rightarrow> point \\<Rightarrow> bool\" where\n  \"collinear (Ax, Ay) (Bx, By) (Cx, Cy) \\<longleftrightarrow>\n    (Ax - Bx) * (By - Cy) = (Ay - By) * (Bx - Cx)\"\n\nlemma collinear_inv_rotation:\n  assumes \"collinear (Ax, Ay) (Bx, By) (Cx, Cy)\" and \"c\\<^sup>2 + s\\<^sup>2 = 1\"\n  shows \"collinear (Ax * c - Ay * s, Ay * c + Ax * s)\n    (Bx * c - By * s, By * c + Bx * s) (Cx * c - Cy * s, Cy * c + Cx * s)\"\n  using assms by (algebra add: collinear.simps)\n(*<*)end(*>*)\n\ntext \\<open>\n  See also \\<^file>\\<open>~~/src/HOL/ex/Groebner_Examples.thy\\<close>.\n\\<close>\n\n\nsection \\<open>Coherent Logic\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"coherent\"} & : & \\<open>method\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) coherent} @{syntax thms}?\n  \\<close>}\n\n  \\<^descr> @{method (HOL) coherent} solves problems of \\<^emph>\\<open>Coherent Logic\\<close> @{cite\n  \"Bezem-Coquand:2005\"}, which covers applications in confluence theory,\n  lattice theory and projective geometry. See \\<^file>\\<open>~~/src/HOL/ex/Coherent.thy\\<close>\n  for some examples.\n\\<close>\n\n\nsection \\<open>Unstructured case analysis and induction \\label{sec:hol-induct-tac}\\<close>\n\ntext \\<open>\n  The following tools of Isabelle/HOL support cases analysis and induction in\n  unstructured tactic scripts; see also \\secref{sec:cases-induct} for proper\n  Isar versions of similar ideas.\n\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) case_tac}\\<open>\\<^sup>*\\<close> & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) induct_tac}\\<open>\\<^sup>*\\<close> & : & \\<open>method\\<close> \\\\\n    @{method_def (HOL) ind_cases}\\<open>\\<^sup>*\\<close> & : & \\<open>method\\<close> \\\\\n    @{command_def (HOL) \"inductive_cases\"}\\<open>\\<^sup>*\\<close> & : & \\<open>local_theory \\<rightarrow> local_theory\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) case_tac} @{syntax goal_spec}? @{syntax term} rule?\n    ;\n    @@{method (HOL) induct_tac} @{syntax goal_spec}? (@{syntax insts} * @'and') rule?\n    ;\n    @@{method (HOL) ind_cases} (@{syntax prop}+) @{syntax for_fixes}\n    ;\n    @@{command (HOL) inductive_cases} (@{syntax thmdecl}? (@{syntax prop}+) + @'and')\n    ;\n    rule: 'rule' ':' @{syntax thm}\n  \\<close>}\n\n  \\<^descr> @{method (HOL) case_tac} and @{method (HOL) induct_tac} admit to reason\n  about inductive types. Rules are selected according to the declarations by\n  the @{attribute cases} and @{attribute induct} attributes, cf.\\\n  \\secref{sec:cases-induct}. The @{command (HOL) datatype} package already\n  takes care of this.\n\n  These unstructured tactics feature both goal addressing and dynamic\n  instantiation. Note that named rule cases are \\<^emph>\\<open>not\\<close> provided as would be by\n  the proper @{method cases} and @{method induct} proof methods (see\n  \\secref{sec:cases-induct}). Unlike the @{method induct} method, @{method\n  induct_tac} does not handle structured rule statements, only the compact\n  object-logic conclusion of the subgoal being addressed.\n\n  \\<^descr> @{method (HOL) ind_cases} and @{command (HOL) \"inductive_cases\"} provide\n  an interface to the internal @{ML_text mk_cases} operation. Rules are\n  simplified in an unrestricted forward manner.\n\n  While @{method (HOL) ind_cases} is a proof method to apply the result\n  immediately as elimination rules, @{command (HOL) \"inductive_cases\"}\n  provides case split theorems at the theory level for later use. The\n  @{keyword \"for\"} argument of the @{method (HOL) ind_cases} method allows to\n  specify a list of variables that should be generalized before applying the\n  resulting rule.\n\\<close>\n\n\nsection \\<open>Adhoc tuples\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) split_format}\\<open>\\<^sup>*\\<close> & : & \\<open>attribute\\<close> \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{attribute (HOL) split_format} ('(' 'complete' ')')?\n  \\<close>}\n\n  \\<^descr> @{attribute (HOL) split_format}\\ \\<open>(complete)\\<close> causes arguments in function\n  applications to be represented canonically according to their tuple type\n  structure.\n\n  Note that this operation tends to invent funny names for new local\n  parameters introduced.\n\\<close>\n\n\nchapter \\<open>Executable code\\<close>\n\ntext \\<open>\n  For validation purposes, it is often useful to \\<^emph>\\<open>execute\\<close> specifications. In\n  principle, execution could be simulated by Isabelle's inference kernel, i.e.\n  by a combination of resolution and simplification. Unfortunately, this\n  approach is rather inefficient. A more efficient way of executing\n  specifications is to translate them into a functional programming language\n  such as ML.\n\n  Isabelle provides a generic framework to support code generation from\n  executable specifications. Isabelle/HOL instantiates these mechanisms in a\n  way that is amenable to end-user applications. Code can be generated for\n  functional programs (including overloading using type classes) targeting SML\n  @{cite SML}, OCaml @{cite OCaml}, Haskell @{cite \"haskell-revised-report\"}\n  and Scala @{cite \"scala-overview-tech-report\"}. Conceptually, code\n  generation is split up in three steps: \\<^emph>\\<open>selection\\<close> of code theorems,\n  \\<^emph>\\<open>translation\\<close> into an abstract executable view and \\<^emph>\\<open>serialization\\<close> to a\n  specific \\<^emph>\\<open>target language\\<close>. Inductive specifications can be executed using\n  the predicate compiler which operates within HOL. See @{cite\n  \"isabelle-codegen\"} for an introduction.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"export_code\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{attribute_def (HOL) code} & : & \\<open>attribute\\<close> \\\\\n    @{command_def (HOL) \"code_datatype\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"print_codesetup\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{attribute_def (HOL) code_unfold} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) code_post} & : & \\<open>attribute\\<close> \\\\\n    @{attribute_def (HOL) code_abbrev} & : & \\<open>attribute\\<close> \\\\\n    @{command_def (HOL) \"print_codeproc\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"code_thms\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"code_deps\"}\\<open>\\<^sup>*\\<close> & : & \\<open>context \\<rightarrow>\\<close> \\\\\n    @{command_def (HOL) \"code_reserved\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_printing\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_identifier\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_monad\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_reflect\"} & : & \\<open>theory \\<rightarrow> theory\\<close> \\\\\n    @{command_def (HOL) \"code_pred\"} & : & \\<open>theory \\<rightarrow> proof(prove)\\<close>\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) export_code} ( @'open' ) ? ( constexpr + ) \\<newline>\n       ( ( @'in' target ( @'module_name' @{syntax string} ) ? \\<newline>\n        ( @'file' @{syntax string} ) ? ( '(' args ')' ) ?) + ) ?\n    ;\n    const: @{syntax term}\n    ;\n    constexpr: ( const | 'name._' | '_' )\n    ;\n    typeconstructor: @{syntax name}\n    ;\n    class: @{syntax name}\n    ;\n    target: 'SML' | 'OCaml' | 'Haskell' | 'Scala' | 'Eval'\n    ;\n    @@{attribute (HOL) code} ( 'del' | 'equation' | 'abstype' | 'abstract'\n      | 'drop:' ( const + ) | 'abort:' ( const + ) )?\n    ;\n    @@{command (HOL) code_datatype} ( const + )\n    ;\n    @@{attribute (HOL) code_unfold} ( 'del' ) ?\n    ;\n    @@{attribute (HOL) code_post} ( 'del' ) ?\n    ;\n    @@{attribute (HOL) code_abbrev}\n    ;\n    @@{command (HOL) code_thms} ( constexpr + ) ?\n    ;\n    @@{command (HOL) code_deps} ( constexpr + ) ?\n    ;\n    @@{command (HOL) code_reserved} target ( @{syntax string} + )\n    ;\n    symbol_const: ( @'constant' const )\n    ;\n    symbol_typeconstructor: ( @'type_constructor' typeconstructor )\n    ;\n    symbol_class: ( @'type_class' class )\n    ;\n    symbol_class_relation: ( @'class_relation' class ( '<' | '\\<subseteq>' ) class )\n    ;\n    symbol_class_instance: ( @'class_instance' typeconstructor @'::' class )\n    ;\n    symbol_module: ( @'code_module' name )\n    ;\n    syntax: @{syntax string} | ( @'infix' | @'infixl' | @'infixr' ) @{syntax nat} @{syntax string}\n    ;\n    printing_const: symbol_const ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' syntax ? + @'and' )\n    ;\n    printing_typeconstructor: symbol_typeconstructor ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' syntax ? + @'and' )\n    ;\n    printing_class: symbol_class ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' @{syntax string} ? + @'and' )\n    ;\n    printing_class_relation: symbol_class_relation ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' @{syntax string} ? + @'and' )\n    ;\n    printing_class_instance: symbol_class_instance ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' '-' ? + @'and' )\n    ;\n    printing_module: symbol_module ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' ( @{syntax string} ( @'attach' ( const + ) ) ? ) ? + @'and' )\n    ;\n    @@{command (HOL) code_printing} ( ( printing_const | printing_typeconstructor\n      | printing_class | printing_class_relation | printing_class_instance\n      | printing_module ) + '|' )\n    ;\n    @@{command (HOL) code_identifier} ( ( symbol_const | symbol_typeconstructor\n      | symbol_class | symbol_class_relation | symbol_class_instance\n      | symbol_module ) ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' @{syntax string} ? + @'and' ) + '|' )\n    ;\n    @@{command (HOL) code_monad} const const target\n    ;\n    @@{command (HOL) code_reflect} @{syntax string} \\<newline>\n      ( @'datatypes' ( @{syntax string} '=' ( '_' | ( @{syntax string} + '|' ) + @'and' ) ) ) ? \\<newline>\n      ( @'functions' ( @{syntax string} + ) ) ? ( @'file' @{syntax string} ) ?\n    ;\n    @@{command (HOL) code_pred} \\<newline> ('(' @'modes' ':' modedecl ')')? \\<newline> const\n    ;\n    modedecl: (modes | ((const ':' modes) \\<newline>\n        (@'and' ((const ':' modes @'and') +))?))\n    ;\n    modes: mode @'as' const\n  \\<close>}\n\n  \\<^descr> @{command (HOL) \"export_code\"} generates code for a given list of\n  constants in the specified target language(s). If no serialization\n  instruction is given, only abstract code is generated internally.\n\n  Constants may be specified by giving them literally, referring to all\n  executable constants within a certain theory by giving \\<open>name._\\<close>, or\n  referring to \\<^emph>\\<open>all\\<close> executable constants currently available by giving \\<open>_\\<close>.\n\n  By default, exported identifiers are minimized per module. This can be\n  suppressed by prepending @{keyword \"open\"} before the list of constants.\n\n  By default, for each involved theory one corresponding name space module is\n  generated. Alternatively, a module name may be specified after the @{keyword\n  \"module_name\"} keyword; then \\<^emph>\\<open>all\\<close> code is placed in this module.\n\n  For \\<^emph>\\<open>SML\\<close>, \\<^emph>\\<open>OCaml\\<close> and \\<^emph>\\<open>Scala\\<close> the file specification refers to a single\n  file; for \\<^emph>\\<open>Haskell\\<close>, it refers to a whole directory, where code is\n  generated in multiple files reflecting the module hierarchy. Omitting the\n  file specification denotes standard output.\n\n  Serializers take an optional list of arguments in parentheses. For\n  \\<^emph>\\<open>Haskell\\<close> a module name prefix may be given using the ``\\<open>root:\\<close>'' argument;\n  ``\\<open>string_classes\\<close>'' adds a ``\\<^verbatim>\\<open>deriving (Read, Show)\\<close>'' clause to each\n  appropriate datatype declaration.\n\n  \\<^descr> @{attribute (HOL) code} declare code equations for code generation.\n  Variant \\<open>code equation\\<close> declares a conventional equation as code equation.\n  Variants \\<open>code abstype\\<close> and \\<open>code abstract\\<close> declare abstract datatype\n  certificates or code equations on abstract datatype representations\n  respectively. Vanilla \\<open>code\\<close> falls back to \\<open>code equation\\<close> or \\<open>code abstype\\<close>\n  depending on the syntactic shape of the underlying equation. Variant \\<open>code\n  del\\<close> deselects a code equation for code generation.\n\n  Variants \\<open>code drop:\\<close> and \\<open>code abort:\\<close> take a list of constant as arguments\n  and drop all code equations declared for them. In the case of {text abort},\n  these constants then are are not required to have a definition by means of\n  code equations; if needed these are implemented by program abort (exception)\n  instead.\n\n  Usually packages introducing code equations provide a reasonable default\n  setup for selection.\n\n  \\<^descr> @{command (HOL) \"code_datatype\"} specifies a constructor set for a logical\n  type.\n\n  \\<^descr> @{command (HOL) \"print_codesetup\"} gives an overview on selected code\n  equations and code generator datatypes.\n\n  \\<^descr> @{attribute (HOL) code_unfold} declares (or with option ``\\<open>del\\<close>'' removes)\n  theorems which during preprocessing are applied as rewrite rules to any code\n  equation or evaluation input.\n\n  \\<^descr> @{attribute (HOL) code_post} declares (or with option ``\\<open>del\\<close>'' removes)\n  theorems which are applied as rewrite rules to any result of an evaluation.\n\n  \\<^descr> @{attribute (HOL) code_abbrev} declares (or with option ``\\<open>del\\<close>'' removes)\n  equations which are applied as rewrite rules to any result of an evaluation\n  and symmetrically during preprocessing to any code equation or evaluation\n  input.\n\n  \\<^descr> @{command (HOL) \"print_codeproc\"} prints the setup of the code generator\n  preprocessor.\n\n  \\<^descr> @{command (HOL) \"code_thms\"} prints a list of theorems representing the\n  corresponding program containing all given constants after preprocessing.\n\n  \\<^descr> @{command (HOL) \"code_deps\"} visualizes dependencies of theorems\n  representing the corresponding program containing all given constants after\n  preprocessing.\n\n  \\<^descr> @{command (HOL) \"code_reserved\"} declares a list of names as reserved for\n  a given target, preventing it to be shadowed by any generated code.\n\n  \\<^descr> @{command (HOL) \"code_printing\"} associates a series of symbols\n  (constants, type constructors, classes, class relations, instances, module\n  names) with target-specific serializations; omitting a serialization deletes\n  an existing serialization.\n\n  \\<^descr> @{command (HOL) \"code_monad\"} provides an auxiliary mechanism to generate\n  monadic code for Haskell.\n\n  \\<^descr> @{command (HOL) \"code_identifier\"} associates a a series of symbols\n  (constants, type constructors, classes, class relations, instances, module\n  names) with target-specific hints how these symbols shall be named. These\n  hints gain precedence over names for symbols with no hints at all.\n  Conflicting hints are subject to name disambiguation. \\<^emph>\\<open>Warning:\\<close> It is at\n  the discretion of the user to ensure that name prefixes of identifiers in\n  compound statements like type classes or datatypes are still the same.\n\n  \\<^descr> @{command (HOL) \"code_reflect\"} without a ``\\<open>file\\<close>'' argument compiles\n  code into the system runtime environment and modifies the code generator\n  setup that future invocations of system runtime code generation referring to\n  one of the ``\\<open>datatypes\\<close>'' or ``\\<open>functions\\<close>'' entities use these precompiled\n  entities. With a ``\\<open>file\\<close>'' argument, the corresponding code is generated\n  into that specified file without modifying the code generator setup.\n\n  \\<^descr> @{command (HOL) \"code_pred\"} creates code equations for a predicate given\n  a set of introduction rules. Optional mode annotations determine which\n  arguments are supposed to be input or output. If alternative introduction\n  rules are declared, one must prove a corresponding elimination rule.\n\\<close>\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/Doc/Isar_Ref/HOL_Specific.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.3069744143648549}}
{"text": "section {*FUNCTION\\_\\_EPDA\\_TC\\_\\_EPDA\\_TYPE\\_CONVERSION*}\ntheory\n  FUNCTION__EPDA_TC__EPDA_TYPE_CONVERSION\n\nimports\n  PRJ_12_03_01__ENTRY\n\nbegin\n\ndefinition F_EPDA_TC__edge1__RL :: \"\n  ('stateB DT_symbol \\<Rightarrow> 'stateA)\n  \\<Rightarrow> ('stackB DT_symbol \\<Rightarrow> 'stackA)\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda_step_label\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda_step_label\"\n  where\n    \"F_EPDA_TC__edge1__RL fq fg e \\<equiv>\n  \\<lparr>edge_src = fq (edge_src e),\n  edge_event = edge_event e,\n  edge_pop = map fg (edge_pop e),\n  edge_push = map fg (edge_push e),\n  edge_trg = fq (edge_trg e)\\<rparr>\"\n\ndefinition F_EPDA_TC__edge__RL :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda_step_label\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda_step_label\"\n  where\n    \"F_EPDA_TC__edge__RL G e \\<equiv>\n  F_EPDA_TC__edge1__RL\n    (inv_into (epda_states G) (SOME f. inj_on f (epda_states G)))\n    (inv_into (epda_gamma G) (SOME f. inj_on f (epda_gamma G)))\n    e\"\n\nlemma F_EPDA_TC__edge_reversal: \"\n  valid_epda G\n  \\<Longrightarrow> x \\<in> epda_delta G\n  \\<Longrightarrow> F_EPDA_TC__edge__RL G (F_EPDA_TC__edge (SOME f. inj_on f (epda_states G)) (SOME f. inj_on f (epda_gamma G)) x) = x\"\n  apply(simp add: F_EPDA_TC__edge__RL_def F_EPDA_TC__edge1__RL_def)\n  apply(subgoal_tac \"valid_epda_step_label G x\")\n   prefer 2\n   apply(simp add: valid_epda_def)\n  apply(simp add: valid_epda_step_label_def)\n  apply(case_tac x)\n  apply(rename_tac edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n  apply(rename_tac src read pop push trg)\n  apply(rename_tac src read pop push trg)(*strict*)\n  apply(simp add: F_EPDA_TC__edge_def)\n  apply(rule conjI)\n   apply(rename_tac src read pop push trg)(*strict*)\n   apply (metis valid_epda_def SOME_injective_is_injective inv_into_f_eq)\n  apply(rename_tac src read pop push trg)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac src read pop push trg)(*strict*)\n   apply(rule inv_into_f_eq_map2)\n    apply(rename_tac src read pop push trg)(*strict*)\n    apply (metis valid_epda_def SOME_injective_is_injective)\n   apply(rename_tac src read pop push trg)(*strict*)\n   apply (metis epda_step_label.simps(3) valid_epda_pop_in_gamma)\n  apply(rename_tac src read pop push trg)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac src read pop push trg)(*strict*)\n   apply(rule inv_into_f_eq_map2)\n    apply(rename_tac src read pop push trg)(*strict*)\n    apply (metis valid_epda_def SOME_injective_is_injective)\n   apply(rename_tac src read pop push trg)(*strict*)\n   apply (metis epda_step_label.simps(4) valid_epda_push_in_gamma)\n  apply(rename_tac src read pop push trg)(*strict*)\n  apply (metis valid_epda_def SOME_injective_is_injective inv_into_f_eq)\n  done\n\nlemma F_EPDA_TC__edge__RL__preserves__epda_delta: \"\n  valid_epda G\n  \\<Longrightarrow> e \\<in> epda_delta (F_EPDA_TC G)\n  \\<Longrightarrow> F_EPDA_TC__edge__RL G e \\<in> epda_delta G\"\n  apply(simp add: F_EPDA_TC_def F_EPDA_TC__epda_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(rule_tac\n      t=\"F_EPDA_TC__edge__RL G (F_EPDA_TC__edge (SOME f. inj_on f (epda_states G)) (SOME f. inj_on f (epda_gamma G)) x)\"\n      and s=\"x\"\n      in ssubst)\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(rule F_EPDA_TC__edge_reversal)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(force)\n  done\n\ndefinition F_EPDA_TC__epdaS_conf1__LR :: \"\n  ('stateA \\<Rightarrow> 'stateB DT_symbol)\n  \\<Rightarrow> ('stackA \\<Rightarrow> 'stackB DT_symbol)\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\"\n  where\n    \"F_EPDA_TC__epdaS_conf1__LR fq fg c \\<equiv>\n  \\<lparr>epdaS_conf_state = fq (epdaS_conf_state c),\n  epdaS_conf_scheduler = epdaS_conf_scheduler c,\n  epdaS_conf_stack = map fg (epdaS_conf_stack c)\\<rparr>\"\n\ndefinition F_EPDA_TC__epdaS_conf__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\"\n  where\n    \"F_EPDA_TC__epdaS_conf__LR G c \\<equiv>\n  F_EPDA_TC__epdaS_conf1__LR\n    (SOME f. inj_on f (epda_states G))\n    (SOME f. inj_on f (epda_gamma G))\n    c\"\n\ndefinition F_EPDA_TC__epdaS_conf1__LRRev :: \"\n  ('stateB DT_symbol \\<Rightarrow> 'stateA)\n  \\<Rightarrow> ('stackB DT_symbol \\<Rightarrow> 'stackA)\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\"\n  where\n    \"F_EPDA_TC__epdaS_conf1__LRRev fq fg c \\<equiv>\n  \\<lparr>epdaS_conf_state = fq (epdaS_conf_state c),\n  epdaS_conf_scheduler = epdaS_conf_scheduler c,\n  epdaS_conf_stack = map fg (epdaS_conf_stack c)\\<rparr>\"\n\ndefinition F_EPDA_TC__epdaS_conf__LRRev :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\"\n  where\n    \"F_EPDA_TC__epdaS_conf__LRRev G c \\<equiv>\n  F_EPDA_TC__epdaS_conf1__LRRev\n    (inv_into (epda_states G) (SOME f. inj_on f (epda_states G)))\n    (inv_into (epda_gamma G) (SOME f. inj_on f (epda_gamma G)))\n    c\"\n\nlemma F_EPDA_TC__edge__preserves__valid_epda_step_labels: \"\n  valid_epda G\n  \\<Longrightarrow> e \\<in> epda_delta G\n  \\<Longrightarrow> valid_epda_step_label G e\n  \\<Longrightarrow> G' = F_EPDA_TC__epda G fq fg\n  \\<Longrightarrow> inj_on fq (epda_states G)\n  \\<Longrightarrow> inj_on fg (epda_gamma G)\n  \\<Longrightarrow> e' = F_EPDA_TC__edge fq fg e\n  \\<Longrightarrow> valid_epda_step_label G' e'\"\n  apply(simp add: F_EPDA_TC__epda_def Let_def)\n  apply(subgoal_tac \"\\<exists>f. inj_on f (epda_states G) \\<and> f = (SOME f::'a\\<Rightarrow>'d DT_symbol. inj_on f (epda_states G))\")\n   prefer 2\n   apply(rule exists_SOME_injective_is_injective)\n   apply(simp add: valid_epda_def)\n  apply(erule exE)+\n  apply(rename_tac f)(*strict*)\n  apply(rule_tac\n      t=\"(SOME f::'a \\<Rightarrow> 'd DT_symbol. inj_on f (epda_states G))\"\n      and s=\"f\"\n      in ssubst)\n   apply(rename_tac f)(*strict*)\n   apply(force)\n  apply(rename_tac f)(*strict*)\n  apply(erule conjE)\n  apply(thin_tac \"f = (SOME f. inj_on f (epda_states G))\")\n  apply(subgoal_tac \"\\<exists>f. inj_on f (epda_gamma G) \\<and> f = (SOME f::'c\\<Rightarrow>'e DT_symbol. inj_on f (epda_gamma G))\")\n   apply(rename_tac f)(*strict*)\n   prefer 2\n   apply(rule exists_SOME_injective_is_injective)\n   apply(simp add: valid_epda_def)\n  apply(rename_tac f)(*strict*)\n  apply(erule exE)+\n  apply(rename_tac f fa)(*strict*)\n  apply(rule_tac\n      t=\"(SOME f::'c \\<Rightarrow> 'e DT_symbol. inj_on f (epda_gamma G))\"\n      and s=\"fa\"\n      in ssubst)\n   apply(rename_tac f fa)(*strict*)\n   apply(force)\n  apply(rename_tac f fa)(*strict*)\n  apply(erule conjE)\n  apply(thin_tac \"fa = (SOME f. inj_on f (epda_gamma G))\")\n  apply(simp add: valid_epda_def valid_epda_step_label_def F_EPDA_TC__edge_def)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"e\"\n      in ballE)\n   apply(rename_tac f fa)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac f fa)(*strict*)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rename_tac f fa)(*strict*)\n   apply(simp add: may_terminated_by_def append_language_def kleene_star_def)\n   apply(clarsimp)\n   apply(rename_tac f fa a aa)(*strict*)\n   apply(erule_tac\n      P=\"edge_pop e = a @ [epda_box G]\"\n      in disjE)\n    apply(rename_tac f fa a aa)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"map fg a\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac f fa a aa)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac f fa a aa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac f fa a aa xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac f fa a aa xa)(*strict*)\n     apply(force)\n    apply(rename_tac f fa a aa xa)(*strict*)\n    apply(case_tac \"xa=epda_box G\")\n     apply(rename_tac f fa a aa xa)(*strict*)\n     apply(force)\n    apply(rename_tac f fa a aa xa)(*strict*)\n    apply(simp add: inj_on_def)\n    apply(erule_tac\n      x=\"xa\"\n      and A=\"epda_gamma G\"\n      and P=\"\\<lambda>x. \\<forall>y\\<in> epda_gamma G. fg x = fg y \\<longrightarrow> x = y\"\n      in ballE)\n     apply(rename_tac f fa a aa xa)(*strict*)\n     apply(erule_tac\n      x=\"epda_box G\"\n      and P=\"\\<lambda>x. \\<forall>y\\<in> epda_gamma G. fa x = fa y \\<longrightarrow> x = y\"\n      in ballE)\n      apply(rename_tac f fa a aa xa)(*strict*)\n      apply(force)\n     apply(rename_tac f fa a aa xa)(*strict*)\n     apply(force)\n    apply(rename_tac f fa a aa xa)(*strict*)\n    apply (metis DiffE List.set_simps(1) subsetD)\n   apply(rename_tac f fa a aa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f fa aa)(*strict*)\n   apply(rule_tac\n      x=\"map fg (edge_pop e)\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac f fa aa)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac f fa aa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f fa aa xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac f fa aa xa)(*strict*)\n    apply(force)\n   apply(rename_tac f fa aa xa)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"xa=epda_box G\")\n    apply(rename_tac f fa aa xa)(*strict*)\n    apply(force)\n   apply(rename_tac f fa aa xa)(*strict*)\n   apply(rule_tac\n      f=\"fg\"\n      in inj_onD)\n      apply(rename_tac f fa aa xa)(*strict*)\n      apply(force)\n     apply(rename_tac f fa aa xa)(*strict*)\n     apply(force)\n    apply(rename_tac f fa aa xa)(*strict*)\n    apply(force)\n   apply(rename_tac f fa aa xa)(*strict*)\n   apply(force)\n  apply(rename_tac f fa)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac f fa)(*strict*)\n   apply(simp add: may_terminated_by_def append_language_def kleene_star_def)\n   apply(clarsimp)\n   apply(rename_tac f fa a aa)(*strict*)\n   apply(erule_tac\n      P=\"edge_push e = aa @ [epda_box G]\"\n      in disjE)\n    apply(rename_tac f fa a aa)(*strict*)\n    apply(clarsimp)\n    apply(rule_tac\n      x=\"map fg aa\"\n      in exI)\n    apply(rule conjI)\n     apply(rename_tac f fa a aa)(*strict*)\n     prefer 2\n     apply(force)\n    apply(rename_tac f fa a aa)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac f fa a aa xa)(*strict*)\n    apply(rule conjI)\n     apply(rename_tac f fa a aa xa)(*strict*)\n     apply(force)\n    apply(rename_tac f fa a aa xa)(*strict*)\n    apply(case_tac \"xa=epda_box G\")\n     apply(rename_tac f fa a aa xa)(*strict*)\n     apply(force)\n    apply(rename_tac f fa a aa xa)(*strict*)\n    apply(simp add: inj_on_def)\n    apply(erule_tac\n      x=\"xa\"\n      and P=\"\\<lambda>x. \\<forall>y\\<in> epda_gamma G. fg x = fg y \\<longrightarrow> x = y\"\n      in ballE)\n     apply(rename_tac f fa a aa xa)(*strict*)\n     apply(erule_tac\n      x=\"epda_box G\"\n      and P=\"\\<lambda>x. \\<forall>y\\<in> epda_gamma G. fa x = fa y \\<longrightarrow> x = y\"\n      in ballE)\n      apply(rename_tac f fa a aa xa)(*strict*)\n      apply(force)\n     apply(rename_tac f fa a aa xa)(*strict*)\n     apply(force)\n    apply(rename_tac f fa a aa xa)(*strict*)\n    apply (metis DiffE List.set_simps(1) subsetD)\n   apply(rename_tac f fa a aa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f fa a)(*strict*)\n   apply(rule_tac\n      x=\"map fg (edge_push e)\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac f fa a)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac f fa a)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f fa a xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac f fa a xa)(*strict*)\n    apply(force)\n   apply(rename_tac f fa a xa)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"xa=epda_box G\")\n    apply(rename_tac f fa a xa)(*strict*)\n    apply(force)\n   apply(rename_tac f fa a xa)(*strict*)\n   apply(rule_tac\n      f=\"fg\"\n      in inj_onD)\n      apply(rename_tac f fa a xa)(*strict*)\n      apply(force)\n     apply(rename_tac f fa a xa)(*strict*)\n     apply(force)\n    apply(rename_tac f fa a xa)(*strict*)\n    apply(force)\n   apply(rename_tac f fa a xa)(*strict*)\n   apply(force)\n  apply(rename_tac f fa)(*strict*)\n  apply(simp add: may_terminated_by_def must_terminated_by_def append_language_def kleene_star_def)\n  apply(rule order_antisym)\n   apply(rename_tac f fa)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f fa a aa ab)(*strict*)\n   apply(case_tac \"edge_pop e\")\n    apply(rename_tac f fa a aa ab)(*strict*)\n    apply(force)\n   apply(rename_tac f fa a aa ab ac list)(*strict*)\n   apply(subgoal_tac \"\\<exists>w' x'. edge_pop e = w' @ [x']\")\n    apply(rename_tac f fa a aa ab ac list)(*strict*)\n    prefer 2\n    apply(rule NonEmptyListHasTailElem)\n    apply(force)\n   apply(rename_tac f fa a aa ab ac list)(*strict*)\n   apply(thin_tac \"edge_pop e = ac # list\")\n   apply(clarsimp)\n   apply(rename_tac f fa a aa w' x')(*strict*)\n   apply(subgoal_tac \"(set w' \\<subseteq> epda_gamma G - {epda_box G} \\<and> x' = epda_box G)\")\n    apply(rename_tac f fa a aa w' x')(*strict*)\n    prefer 2\n    apply(rule conjI)\n     apply(rename_tac f fa a aa w' x')(*strict*)\n     apply(force)\n    apply(rename_tac f fa a aa w' x')(*strict*)\n    apply(simp add: inj_on_def)\n    apply(force)\n   apply(rename_tac f fa a aa w' x')(*strict*)\n   apply(clarsimp)\n   apply(rename_tac f fa a aa w' ab xa)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac f fa a aa w' ab xa)(*strict*)\n    apply(force)\n   apply(rename_tac f fa a aa w' ab xa)(*strict*)\n   apply(case_tac \"xa=epda_box G\")\n    apply(rename_tac f fa a aa w' ab xa)(*strict*)\n    apply(force)\n   apply(rename_tac f fa a aa w' ab xa)(*strict*)\n   apply(simp add: inj_on_def)\n   apply(erule_tac\n      x=\"xa\"\n      and P=\"\\<lambda>x. \\<forall>y\\<in> epda_gamma G. fg x = fg y \\<longrightarrow> x = y\"\n      in ballE)\n    apply(rename_tac f fa a aa w' ab xa)(*strict*)\n    apply(erule_tac\n      x=\"epda_box G\"\n      and P=\"\\<lambda>x. \\<forall>y\\<in> epda_gamma G. fa x = fa y \\<longrightarrow> x = y\"\n      in ballE)\n     apply(rename_tac f fa a aa w' ab xa)(*strict*)\n     apply(force)\n    apply(rename_tac f fa a aa w' ab xa)(*strict*)\n    apply(force)\n   apply(rename_tac f fa a aa w' ab xa)(*strict*)\n   apply (metis DiffE List.set_simps(1) subsetD)\n  apply(rename_tac f fa)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f fa a aa ab)(*strict*)\n  apply(case_tac \"edge_push e\")\n   apply(rename_tac f fa a aa ab)(*strict*)\n   apply(force)\n  apply(rename_tac f fa a aa ab ac list)(*strict*)\n  apply(subgoal_tac \"\\<exists>w' x'. edge_push e = w' @ [x']\")\n   apply(rename_tac f fa a aa ab ac list)(*strict*)\n   prefer 2\n   apply(rule NonEmptyListHasTailElem)\n   apply(force)\n  apply(rename_tac f fa a aa ab ac list)(*strict*)\n  apply(thin_tac \"edge_push e = ac # list\")\n  apply(clarsimp)\n  apply(rename_tac f fa a aa w' x')(*strict*)\n  apply(subgoal_tac \"(set w' \\<subseteq> epda_gamma G - {epda_box G} \\<and> x' = epda_box G)\")\n   apply(rename_tac f fa a aa w' x')(*strict*)\n   prefer 2\n   apply(rule conjI)\n    apply(rename_tac f fa a aa w' x')(*strict*)\n    apply(force)\n   apply(rename_tac f fa a aa w' x')(*strict*)\n   apply(simp add: inj_on_def)\n   apply(force)\n  apply(rename_tac f fa a aa w' x')(*strict*)\n  apply(clarsimp)\n  apply(rename_tac f fa a aa w' ab xa)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac f fa a aa w' ab xa)(*strict*)\n   apply(force)\n  apply(rename_tac f fa a aa w' ab xa)(*strict*)\n  apply(case_tac \"xa=epda_box G\")\n   apply(rename_tac f fa a aa w' ab xa)(*strict*)\n   apply(force)\n  apply(rename_tac f fa a aa w' ab xa)(*strict*)\n  apply(simp add: inj_on_def)\n  apply(erule_tac\n      x=\"xa\"\n      and P=\"\\<lambda>x. \\<forall>y\\<in> epda_gamma G. fg x = fg y \\<longrightarrow> x = y\"\n      in ballE)\n   apply(rename_tac f fa a aa w' ab xa)(*strict*)\n   apply(erule_tac\n      x=\"epda_box G\"\n      and P=\"\\<lambda>x. \\<forall>y\\<in> epda_gamma G. fa x = fa y \\<longrightarrow> x = y\"\n      in ballE)\n    apply(rename_tac f fa a aa w' ab xa)(*strict*)\n    apply(force)\n   apply(rename_tac f fa a aa w' ab xa)(*strict*)\n   apply(force)\n  apply(rename_tac f fa a aa w' ab xa)(*strict*)\n  apply (metis DiffE List.set_simps(1) subsetD)\n  done\n\nlemma F_EPDA_TC__preserves__valid_pda_hlp: \"\n  valid_pda G\n  \\<Longrightarrow> inj_on fq (epda_states G)\n  \\<Longrightarrow> inj_on fg (epda_gamma G)\n  \\<Longrightarrow> valid_pda (F_EPDA_TC__epda G fq fg)\"\n  apply(simp add: valid_pda_def F_EPDA_TC__epda_def)\n  apply(clarsimp)\n  apply(simp add: valid_epda_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(force)\n  apply(rule conjI)\n   prefer 2\n   apply(clarsimp)\n   apply(rename_tac e)(*strict*)\n   apply(simp add: F_EPDA_TC__edge_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(rule_tac\n      G=\"G\"\n      in F_EPDA_TC__edge__preserves__valid_epda_step_labels)\n        apply(rename_tac x)(*strict*)\n        apply(simp add: valid_epda_def)\n       apply(rename_tac x)(*strict*)\n       apply(force)\n      apply(rename_tac x)(*strict*)\n      apply(force)\n     apply(rename_tac x)(*strict*)\n     apply(simp add: F_EPDA_TC__epda_def)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(force)\n  done\n\ntheorem F_EPDA_TC__preserves__valid_pda: \"\n  valid_pda G\n  \\<Longrightarrow> valid_pda (F_EPDA_TC G)\"\n  apply(simp add: F_EPDA_TC_def)\n  apply(rule F_EPDA_TC__preserves__valid_pda_hlp)\n    apply(force)\n   apply(rule SOME_injective_is_injective)\n   apply(simp add: valid_pda_def valid_epda_def)\n  apply(rule SOME_injective_is_injective)\n  apply(simp add: valid_pda_def valid_epda_def)\n  done\n\nlemma F_EPDA_TC__epdaS_conf1__LR__preserves__epdaS_configurations: \"\n  valid_pda G\n  \\<Longrightarrow> c \\<in> epdaS_configurations G\n  \\<Longrightarrow> inj_on fq (epda_states G)\n  \\<Longrightarrow> inj_on fg (epda_gamma G)\n  \\<Longrightarrow> F_EPDA_TC__epdaS_conf1__LR fq fg c \\<in> epdaS_configurations (F_EPDA_TC__epda G fq fg)\"\n  apply(simp add: epdaS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac q i s)(*strict*)\n  apply(simp add: F_EPDA_TC__epdaS_conf1__LR_def)\n  apply(rule conjI)\n   apply(rename_tac q i s)(*strict*)\n   apply(simp add: F_EPDA_TC__epda_def Let_def)\n  apply(rename_tac q i s)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac q i s)(*strict*)\n   apply(simp add: F_EPDA_TC__epda_def Let_def)\n  apply(rename_tac q i s)(*strict*)\n  apply(simp add: F_EPDA_TC__epda_def Let_def)\n  apply(force)\n  done\n\nlemma F_EPDA_TC__epdaS_conf1__LR__preserves__epdaS_initial_configurations: \"\n  valid_pda G\n  \\<Longrightarrow> c \\<in> epdaS_initial_configurations G\n  \\<Longrightarrow> inj_on fq (epda_states G)\n  \\<Longrightarrow> inj_on fg (epda_gamma G)\n  \\<Longrightarrow> F_EPDA_TC__epdaS_conf1__LR fq fg c \\<in> epdaS_initial_configurations (F_EPDA_TC__epda G fq fg)\"\n  apply(simp add: epdaS_initial_configurations_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(simp add: F_EPDA_TC__epdaS_conf1__LR_def)\n   apply(simp add: F_EPDA_TC__epda_def Let_def)\n  apply(rule conjI)\n   apply(simp add: F_EPDA_TC__epda_def Let_def)\n   apply(simp add: F_EPDA_TC__epdaS_conf1__LR_def)\n  apply(rule F_EPDA_TC__epdaS_conf1__LR__preserves__epdaS_configurations)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\nlemma F_EPDA_TC__epdaS_conf1__LR__preserves__epdaS_marking_configurations: \"\n  valid_pda G\n  \\<Longrightarrow> c \\<in> epdaS_marking_configurations G\n  \\<Longrightarrow> inj_on fq (epda_states G)\n  \\<Longrightarrow> inj_on fg (epda_gamma G)\n  \\<Longrightarrow> F_EPDA_TC__epdaS_conf1__LR fq fg c \\<in> epdaS_marking_configurations (F_EPDA_TC__epda G fq fg)\"\n  apply(simp add: epdaS_marking_configurations_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(simp add: F_EPDA_TC__epdaS_conf1__LR_def)\n  apply(rule conjI)\n   apply(simp add: F_EPDA_TC__epda_def Let_def)\n   apply(simp add: F_EPDA_TC__epdaS_conf1__LR_def)\n  apply(rule F_EPDA_TC__epdaS_conf1__LR__preserves__epdaS_configurations)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(force)\n  done\n\ndefinition F_EPDA_TC__relation_epda__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_epda__LR G1 G2 \\<equiv>\n  valid_pda G1\n  \\<and> G2 = F_EPDA_TC G1\"\n\ndefinition F_EPDA_TC__relation_epdaS_conf__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_epdaS_conf__LR G1 G2 c1 c2 \\<equiv>\n  F_EPDA_TC__relation_epda__LR G1 G2\n  \\<and> c1 \\<in> epdaS_configurations G1\n  \\<and> c2 = F_EPDA_TC__epdaS_conf__LR G1 c1\"\n\ndefinition F_EPDA_TC__relation_epdaS_initial_conf__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_epdaS_initial_conf__LR G1 G2 c1 c2 \\<equiv>\n  F_EPDA_TC__relation_epda__LR G1 G2\n  \\<and> c1 \\<in> epdaS_initial_configurations G1\n  \\<and> c2 = F_EPDA_TC__epdaS_conf__LR G1 c1\"\n\ndefinition F_EPDA_TC__relation_effect__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_effect__LR G1 G2 w1 w2 \\<equiv>\n  F_EPDA_TC__relation_epda__LR G1 G2\n  \\<and> w1 = w2\"\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n  (\\<forall>G1. Ex (F_EPDA_TC__relation_epda__LR G1) \\<longrightarrow> valid_epda G1)\"\n  apply(clarsimp)\n  apply(rename_tac G1 x)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1)(*strict*)\n  apply(simp add: valid_dpda_def valid_pda_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> valid_epda G2)\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1)(*strict*)\n  apply(subgoal_tac \"valid_pda (F_EPDA_TC G1)\")\n   apply(rename_tac G1)(*strict*)\n   apply(simp add: valid_pda_def)\n   apply(force)\n  apply(rename_tac G1)(*strict*)\n  apply(rule F_EPDA_TC__preserves__valid_pda)\n  apply(force)\n  done\n\ndefinition F_EPDA_TC__edge__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda_step_label\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda_step_label\"\n  where\n    \"F_EPDA_TC__edge__LR G e \\<equiv>\n  F_EPDA_TC__edge\n    (SOME f. inj_on f (epda_states G))\n    (SOME f. inj_on f (epda_gamma G))\n    e\"\n\ndefinition F_EPDA_TC__relation_epdaS_step__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda_step_label\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> (('stateB DT_symbol, 'event, 'stackB DT_symbol) epda_step_label, ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf) derivation\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_epdaS_step__LR G1 G2 c1 e c1' c2 d \\<equiv>\n  d = der2 (F_EPDA_TC__epdaS_conf__LR G1 c1) (F_EPDA_TC__edge__LR G1 e) (F_EPDA_TC__epdaS_conf__LR G1 c1')\"\n\ndefinition F_EPDA_TC__relation_epdaS_initial__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> (('stateB DT_symbol, 'event, 'stackB DT_symbol) epda_step_label, ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf) derivation\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_epdaS_initial__LR G1 G2 c1 d \\<equiv>\n  d = der1 (F_EPDA_TC__epdaS_conf__LR G1 c1)\"\n\nlemma F_EPDA_TC__preserves__epdaS_configurations: \"\n  F_EPDA_TC__relation_epda__LR G1 G2\n  \\<Longrightarrow> c1 \\<in> epdaS_configurations G1\n  \\<Longrightarrow> F_EPDA_TC__epdaS_conf__LR G1 c1 \\<in> epdaS_configurations G2\"\n  apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(simp add: F_EPDA_TC_def)\n  apply(rule F_EPDA_TC__epdaS_conf1__LR__preserves__epdaS_configurations)\n     apply(force)\n    apply(force)\n   apply(rule SOME_injective_is_injective)\n   apply(simp add: valid_pda_def valid_epda_def)\n  apply(rule SOME_injective_is_injective)\n  apply(simp add: valid_pda_def valid_epda_def)\n  done\n\nlemma F_EPDA_TC__preserves__epdaS_initial_configurations: \"\n  F_EPDA_TC__relation_epda__LR G1 G2\n  \\<Longrightarrow> c1 \\<in> epdaS_initial_configurations G1\n  \\<Longrightarrow> F_EPDA_TC__epdaS_conf__LR G1 c1 \\<in> epdaS_initial_configurations G2\"\n  apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(simp add: F_EPDA_TC_def)\n  apply(rule F_EPDA_TC__epdaS_conf1__LR__preserves__epdaS_initial_configurations)\n     apply(force)\n    apply(force)\n   apply(rule SOME_injective_is_injective)\n   apply(simp add: valid_pda_def valid_epda_def)\n  apply(rule SOME_injective_is_injective)\n  apply(simp add: valid_pda_def valid_epda_def)\n  done\n\nlemma F_EPDA_TC__preserves__epdaS_marking_configurations: \"\n  F_EPDA_TC__relation_epda__LR G1 G2\n  \\<Longrightarrow> c1 \\<in> epdaS_marking_configurations G1\n  \\<Longrightarrow> F_EPDA_TC__epdaS_conf__LR G1 c1 \\<in> epdaS_marking_configurations G2\"\n  apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(simp add: F_EPDA_TC_def)\n  apply(rule F_EPDA_TC__epdaS_conf1__LR__preserves__epdaS_marking_configurations)\n     apply(force)\n    apply(force)\n   apply(rule SOME_injective_is_injective)\n   apply(simp add: valid_pda_def valid_epda_def)\n  apply(rule SOME_injective_is_injective)\n  apply(simp add: valid_pda_def valid_epda_def)\n  done\n\nlemma F_EPDA_TC__preserves__simulation_initial: \"\n  F_EPDA_TC__relation_epda__LR G1 G2\n  \\<Longrightarrow> c1 \\<in> epdaS_initial_configurations G1\n  \\<Longrightarrow> epdaS.derivation_initial G2 (der1 (F_EPDA_TC__epdaS_conf__LR G1 c1))\"\n  apply(rule epdaS.derivation_initialI)\n   apply(rule epdaS.der1_is_derivation)\n  apply(clarsimp)\n  apply(rename_tac c)(*strict*)\n  apply(simp add: get_configuration_def der1_def)\n  apply(clarsimp)\n  apply(rule F_EPDA_TC__preserves__epdaS_initial_configurations)\n   apply(force)\n  apply(force)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_initial_simulation: \"\n  \\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> epdaS_initial_configurations G1 \\<longrightarrow> (\\<exists>d2. epdaS.derivation_initial G2 d2 \\<and> F_EPDA_TC__relation_epdaS_initial_conf__LR G1 G2 c1 (the (get_configuration (d2 0))) \\<and> F_EPDA_TC__relation_epdaS_initial__LR G1 G2 c1 d2 \\<and> (\\<exists>n. maximum_of_domain d2 n \\<and> F_EPDA_TC__relation_epdaS_conf__LR G1 G2 c1 (the (get_configuration (d2 n))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epdaS_initial__LR_def)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(rule F_EPDA_TC__preserves__simulation_initial)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_initial_conf__LR_def)\n   apply(simp add: get_configuration_def der1_def)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(rule_tac\n      x=\"0\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(rule der1_maximum_of_domain)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(simp add: get_configuration_def der1_def)\n  apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def)\n  apply(simp add: F_EPDA_TC__relation_epda__LR_def valid_pda_def valid_dpda_def)\n  apply(clarsimp)\n  apply(rename_tac G1 c1)(*strict*)\n  apply(metis epdaS_inst_AX_initial_configuration_belongs subsetD)\n  done\n\nlemma F_EPDA_TC__preserves__simulation_step: \"\n  epdaS_step_relation G1 c1 e1 c1'\n  \\<Longrightarrow> epdaS_step_relation (F_EPDA_TC G1) (F_EPDA_TC__epdaS_conf__LR G1 c1) (F_EPDA_TC__edge__LR G1 e1) (F_EPDA_TC__epdaS_conf__LR G1 c1')\"\n  apply(simp add: epdaS_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac w)(*strict*)\n   apply(simp add: F_EPDA_TC_def F_EPDA_TC__epda_def F_EPDA_TC__edge__LR_def)\n  apply(rename_tac w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac w)(*strict*)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__edge__LR_def F_EPDA_TC__epdaS_conf1__LR_def F_EPDA_TC__edge_def)\n  apply(rename_tac w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac w)(*strict*)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__edge__LR_def F_EPDA_TC__epdaS_conf1__LR_def F_EPDA_TC__edge_def)\n  apply(rename_tac w)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac w)(*strict*)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__edge__LR_def F_EPDA_TC__epdaS_conf1__LR_def F_EPDA_TC__edge_def)\n  apply(rename_tac w)(*strict*)\n  apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__edge__LR_def F_EPDA_TC__epdaS_conf1__LR_def F_EPDA_TC__edge_def)\n  done\n\nlemma F_EPDA_TC__relation_epdaS_step__LR_maps_to_derivation: \"\n  F_EPDA_TC__relation_epdaS_step__LR G1 G2 c1 e1 c1' c2 d2\n  \\<Longrightarrow> F_EPDA_TC__relation_epdaS_conf__LR G1 G2 c1 c2\n  \\<Longrightarrow> epdaS_step_relation G1 c1 e1 c1'\n  \\<Longrightarrow> epdaS.derivation G2 d2\"\n  apply(simp add: F_EPDA_TC__relation_epdaS_step__LR_def)\n  apply(subgoal_tac \"c1 \\<in> epdaS_configurations G1\")\n   prefer 2\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def)\n  apply(clarsimp)\n  apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def)\n  apply(clarsimp)\n  apply(rule epdaS.der2_is_derivation)\n  apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(rule F_EPDA_TC__preserves__simulation_step)\n  apply(force)\n  done\n\nlemma F_EPDA_TC__relation_epdaS_step__LR_maps_to_derivation_belongs: \"\n  F_EPDA_TC__relation_epdaS_step__LR G1 G2 c1 e1 c1' c2 d2\n  \\<Longrightarrow> F_EPDA_TC__relation_epdaS_conf__LR G1 G2 c1 c2\n  \\<Longrightarrow> epdaS_step_relation G1 c1 e1 c1'\n  \\<Longrightarrow> epdaS.belongs G2 d2\"\n  apply(simp add: F_EPDA_TC__relation_epdaS_step__LR_def)\n  apply(rule epdaS.der2_belongs_prime)\n    prefer 3\n    apply(rule F_EPDA_TC__relation_epdaS_step__LR_maps_to_derivation)\n      apply(simp add: F_EPDA_TC__relation_epdaS_step__LR_def)\n     apply(force)\n    apply(force)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def F_EPDA_TC__relation_epda__LR_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"valid_pda (F_EPDA_TC G1)\")\n    apply(simp add: valid_pda_def)\n    apply(force)\n   apply(rule F_EPDA_TC__preserves__valid_pda)\n   apply(force)\n  apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def)\n  apply(clarsimp)\n  apply(rule F_EPDA_TC__preserves__epdaS_configurations)\n   apply(force)\n  apply (metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS.get_accessible_configurations_are_configurations subsetD)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_step_simulation: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__relation_epdaS_conf__LR G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> epda_step_labels G1 \\<longrightarrow> (\\<forall>c1'. epdaS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<exists>d2. epdaS.derivation G2 d2 \\<and> epdaS.belongs G2 d2 \\<and> the (get_configuration (d2 0)) = c2 \\<and> F_EPDA_TC__relation_epdaS_step__LR G1 G2 c1 e1 c1' c2 d2 \\<and> (\\<exists>n. maximum_of_domain d2 n \\<and> F_EPDA_TC__relation_epdaS_conf__LR G1 G2 c1' (the (get_configuration (d2 n)))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epdaS_step__LR_def)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(rule F_EPDA_TC__relation_epdaS_step__LR_maps_to_derivation)\n     apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n     apply(simp add: F_EPDA_TC__relation_epdaS_step__LR_def)\n    apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(rule F_EPDA_TC__relation_epdaS_step__LR_maps_to_derivation_belongs)\n     apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n     apply(simp add: F_EPDA_TC__relation_epdaS_step__LR_def)\n    apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(simp add: der2_def get_configuration_def F_EPDA_TC__relation_epdaS_conf__LR_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule_tac\n      x=\"Suc 0\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(rule der2_maximum_of_domain)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(simp add: der2_def get_configuration_def F_EPDA_TC__relation_epdaS_conf__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 e1 c1')(*strict*)\n  apply (metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS.AX_step_relation_preserves_belongsC)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n  ATS_Simulation_Configuration_Weak_axioms valid_epda epdaS_initial_configurations epda_step_labels epdaS_step_relation valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation F_EPDA_TC__relation_epdaS_conf__LR F_EPDA_TC__relation_epdaS_initial_conf__LR F_EPDA_TC__relation_epda__LR F_EPDA_TC__relation_epdaS_initial__LR F_EPDA_TC__relation_epdaS_step__LR\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def)\n  apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_initial_simulation epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_step_simulation epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs)\n  done\n\ninterpretation \"epdaS_epdaS_F_EPDA_TC__StateSimLR\" : ATS_Simulation_Configuration_Weak\n  (* TSstructure1 *)\n  \"valid_epda\"\n  (* configurations1 *)\n  \"epdaS_configurations\"\n  (* initial_configurations1 *)\n  \"epdaS_initial_configurations\"\n  (* step_labels1 *)\n  \"epda_step_labels\"\n  (* step_relation1 *)\n  \"epdaS_step_relation\"\n  (* effects1 *)\n  \"epda_effects\"\n  (* marking_condition1 *)\n  \"epdaS_marking_condition\"\n  (* marked_effect1 *)\n  \"epdaS_marked_effect\"\n  (* unmarked_effect1 *)\n  \"epdaS_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_epda\"\n  (* configurations2 *)\n  \"epdaS_configurations\"\n  (* initial_configurations2 *)\n  \"epdaS_initial_configurations\"\n  (* step_labels2 *)\n  \"epda_step_labels\"\n  (* step_relation2 *)\n  \"epdaS_step_relation\"\n  (* effects2 *)\n  \"epda_effects\"\n  (* marking_condition2 *)\n  \"epdaS_marking_condition\"\n  (* marked_effect2 *)\n  \"epdaS_marked_effect\"\n  (* unmarked_effect2 *)\n  \"epdaS_unmarked_effect\"\n  (* relation_configuration *)\n  \"F_EPDA_TC__relation_epdaS_conf__LR\"\n  (* relation_initial_configuration *)\n  \"F_EPDA_TC__relation_epdaS_initial_conf__LR\"\n  (* relation_effect *)\n  \"F_EPDA_TC__relation_effect__LR\"\n  (* relation_TSstructure *)\n  \"F_EPDA_TC__relation_epda__LR\"\n  (* relation_initial_simulation *)\n  \"F_EPDA_TC__relation_epdaS_initial__LR\"\n  (* relation_step_simulation *)\n  \"F_EPDA_TC__relation_epdaS_step__LR\"\n  apply(simp add: LOCALE_DEFS epda_interpretations)\n  apply(simp add:  epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_step_simulation_preserves_marking_condition: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__relation_epdaS_conf__LR G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> epda_step_labels G1 \\<longrightarrow> (\\<forall>c1'. epdaS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_step__LR G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> epdaS_marking_condition G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n) \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__LR F_EPDA_TC__relation_epdaS_initial__LR F_EPDA_TC__relation_epdaS_step__LR G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n)))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: epdaS_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(thin_tac \"derivation_append deri1 (der2 c1 e1 c1') deri1n i = Some (pair e c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e)(*strict*)\n   apply(rule F_EPDA_TC__preserves__epdaS_marking_configurations)\n    apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n   apply(subgoal_tac \"c=c1'\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e)(*strict*)\n    apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_def)\n    apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_DEF_def)\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"Suc deri1n\"\n      in allE)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y)(*strict*)\n    apply(rule_tac\n      x=\"deri2n+n\"\n      in exI)\n    apply(case_tac y)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e option b)(*strict*)\n    apply(rename_tac e c)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n    apply(rule_tac\n      t=\"c\"\n      and s=\"F_EPDA_TC__epdaS_conf__LR G1 c1'\"\n      in ssubst)\n     apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n     apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def derivation_append_def get_configuration_def)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n    apply(rule F_EPDA_TC__preserves__epdaS_marking_configurations)\n     apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i>Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der2_def)\n  apply(case_tac \"i-deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n  apply(clarsimp)\n  apply(case_tac nat)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat nata)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_initial_simulation_preserves_marking_condition: \"\n  \\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> epdaS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_initial__LR G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> epdaS_marking_condition G1 (derivation_append deri1 (der1 c1) deri1n) \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__LR F_EPDA_TC__relation_epdaS_initial__LR F_EPDA_TC__relation_epdaS_step__LR G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: epdaS_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def)\n   apply(clarsimp)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"c\"\n      and s=\"F_EPDA_TC__epdaS_conf__LR G1 ca\"\n      in ssubst)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(simp add: derivation_append_def get_configuration_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule F_EPDA_TC__preserves__epdaS_marking_configurations)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"i=deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der1_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms: \"\n  ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marking_condition epdaS_initial_configurations epdaS_step_relation epdaS_marking_condition F_EPDA_TC__relation_epdaS_conf__LR F_EPDA_TC__relation_epdaS_initial_conf__LR F_EPDA_TC__relation_epda__LR F_EPDA_TC__relation_epdaS_initial__LR F_EPDA_TC__relation_epdaS_step__LR\"\n  apply(simp add: ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_step_simulation_preserves_marking_condition)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_initial_simulation_preserves_marking_condition)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_step_simulation_preserves_marked_effect: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__relation_epdaS_conf__LR G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> epda_step_labels G1 \\<longrightarrow> (\\<forall>c1'. epdaS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_step__LR G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__LR F_EPDA_TC__relation_epdaS_initial__LR F_EPDA_TC__relation_epdaS_step__LR G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_EPDA_TC__relation_effect__LR G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(rule_tac\n      x=\"a\"\n      in bexI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_effect__LR_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: epdaS_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n   apply(simp add: derivation_append_def F_EPDA_TC__relation_epdaS_initial_conf__LR_def)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(rule_tac\n      M=\"G2\"\n      in epdaS.some_position_has_details_at_0)\n  apply (metis epdaS.derivation_initial_is_derivation)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_initial_simulation_preserves_marked_effect: \"\n  \\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> epdaS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_initial__LR G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__LR F_EPDA_TC__relation_epdaS_initial__LR F_EPDA_TC__relation_epdaS_step__LR G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_EPDA_TC__relation_effect__LR G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n)))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(rule_tac\n      x=\"a\"\n      in bexI)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_effect__LR_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: epdaS_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n   apply(simp add: derivation_append_def F_EPDA_TC__relation_epdaS_initial_conf__LR_def)\n   apply(clarsimp)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def get_configuration_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n  apply(rule_tac\n      M=\"G2\"\n      in epdaS.some_position_has_details_at_0)\n  apply (metis epdaS.derivation_initial_is_derivation)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_Marked_Effect_axioms: \"\n  ATS_Simulation_Configuration_Weak_Marked_Effect_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marked_effect epdaS_initial_configurations epdaS_step_relation epdaS_marked_effect F_EPDA_TC__relation_epdaS_conf__LR F_EPDA_TC__relation_epdaS_initial_conf__LR F_EPDA_TC__relation_effect__LR F_EPDA_TC__relation_epda__LR F_EPDA_TC__relation_epdaS_initial__LR F_EPDA_TC__relation_epdaS_step__LR\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_Marked_Effect_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_step_simulation_preserves_marked_effect)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_initial_simulation_preserves_marked_effect)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_step_simulation_preserves_unmarked_effect: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__relation_epdaS_conf__LR G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> epda_step_labels G1 \\<longrightarrow> (\\<forall>c1'. epdaS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_step__LR G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__LR F_EPDA_TC__relation_epdaS_initial__LR F_EPDA_TC__relation_epdaS_step__LR G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_EPDA_TC__relation_effect__LR G1 G2) (epdaS_unmarked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (epdaS_unmarked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: epdaS_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_effect__LR_def)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in epdaS.some_position_has_details_at_0)\n   apply (metis epdaS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(rule_tac\n      x=\"ca\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c')\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca c' i ea caa e c)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca c' i ea caa e)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_initial_conf__LR_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e)(*strict*)\n   apply(subgoal_tac \"\\<exists>c. deri1 0 = Some (pair None c)\")\n    apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"G1\"\n      in epdaS.some_position_has_details_at_0)\n    apply (metis epdaS.derivation_initial_is_derivation)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e c)(*strict*)\n   apply(rule_tac\n      x=\"F_EPDA_TC__epdaS_conf__LR G1 c'\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e c)(*strict*)\n    apply(rule_tac\n      x=\"f i\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e c)(*strict*)\n   apply(simp add: derivation_append_def)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   prefer 2\n   apply(case_tac \"i>Suc deri1n\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def der2_def)\n   apply(case_tac \"i-deri1n\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca nat)(*strict*)\n   apply(clarsimp)\n   apply(case_tac nat)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i ca)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca nat nata)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' e ca)(*strict*)\n  apply(subgoal_tac \"c'=c1'\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' e ca)(*strict*)\n   prefer 2\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' e ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c e ca)(*strict*)\n  apply(rule_tac\n      x=\"F_EPDA_TC__epdaS_conf__LR G1 c1'\"\n      in exI)\n  apply(subgoal_tac \"F_EPDA_TC__epdaS_conf__LR G1 c=ca\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c e ca)(*strict*)\n   prefer 2\n   apply(simp add: derivation_append_def)\n   apply(simp add: F_EPDA_TC__relation_epdaS_initial_conf__LR_def)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c e ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c e)(*strict*)\n  apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_def)\n  apply(clarsimp)\n  apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_DEF_def)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"Suc deri1n\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c e y)(*strict*)\n  apply(case_tac y)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c e y option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c e option b)(*strict*)\n  apply(rename_tac e c)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca ea e c)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca ea e c)(*strict*)\n  apply(simp add: get_configuration_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca ea e)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca ea e)(*strict*)\n   apply(rule_tac\n      x=\"deri2n+n\"\n      in exI)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac G1 G2 c1 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca ea e)(*strict*)\n  apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def get_configuration_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_initial_simulation_preserves_unmarked_effect: \"\n  \\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> epdaS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_initial__LR G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__LR G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__LR F_EPDA_TC__relation_epdaS_initial__LR F_EPDA_TC__relation_epdaS_step__LR G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_EPDA_TC__relation_effect__LR G1 G2) (epdaS_unmarked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (epdaS_unmarked_effect G2 (derivation_append deri2 d2 deri2n)))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: epdaS_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_effect__LR_def)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in epdaS.some_position_has_details_at_0)\n   apply (metis epdaS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(rule_tac\n      x=\"ca\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c')\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__LR_def)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca c' i ea caa e c)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca c' i ea caa e)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_initial_conf__LR_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e)(*strict*)\n   apply(subgoal_tac \"\\<exists>c. deri1 0 = Some (pair None c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"G1\"\n      in epdaS.some_position_has_details_at_0)\n    apply (metis epdaS.derivation_initial_is_derivation)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e c)(*strict*)\n   apply(rule_tac\n      x=\"F_EPDA_TC__epdaS_conf__LR G1 c'\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e c)(*strict*)\n    apply(rule_tac\n      x=\"f i\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca c' i ea e c)(*strict*)\n   apply(simp add: derivation_append_def F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(simp add: derivation_append_def der1_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms: \"\n  ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_unmarked_effect epdaS_initial_configurations epdaS_step_relation epdaS_unmarked_effect F_EPDA_TC__relation_epdaS_conf__LR F_EPDA_TC__relation_epdaS_initial_conf__LR F_EPDA_TC__relation_effect__LR F_EPDA_TC__relation_epda__LR F_EPDA_TC__relation_epdaS_initial__LR F_EPDA_TC__relation_epdaS_step__LR\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_step_simulation_preserves_unmarked_effect)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimLR.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_relation_initial_simulation_preserves_unmarked_effect)\n  done\n\ninterpretation \"epdaS_epdaS_F_EPDA_TC__StateSimLR\" : ATS_Simulation_Configuration_WeakLR_FULL\n  (* TSstructure1 *)\n  \"valid_epda\"\n  (* configurations1 *)\n  \"epdaS_configurations\"\n  (* initial_configurations1 *)\n  \"epdaS_initial_configurations\"\n  (* step_labels1 *)\n  \"epda_step_labels\"\n  (* step_relation1 *)\n  \"epdaS_step_relation\"\n  (* effects1 *)\n  \"epda_effects\"\n  (* marking_condition1 *)\n  \"epdaS_marking_condition\"\n  (* marked_effect1 *)\n  \"epdaS_marked_effect\"\n  (* unmarked_effect1 *)\n  \"epdaS_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_epda\"\n  (* configurations2 *)\n  \"epdaS_configurations\"\n  (* initial_configurations2 *)\n  \"epdaS_initial_configurations\"\n  (* step_labels2 *)\n  \"epda_step_labels\"\n  (* step_relation2 *)\n  \"epdaS_step_relation\"\n  (* effects2 *)\n  \"epda_effects\"\n  (* marking_condition2 *)\n  \"epdaS_marking_condition\"\n  (* marked_effect2 *)\n  \"epdaS_marked_effect\"\n  (* unmarked_effect2 *)\n  \"epdaS_unmarked_effect\"\n  (* relation_configuration *)\n  \"F_EPDA_TC__relation_epdaS_conf__LR\"\n  (* relation_initial_configuration *)\n  \"F_EPDA_TC__relation_epdaS_initial_conf__LR\"\n  (* relation_effect *)\n  \"F_EPDA_TC__relation_effect__LR\"\n  (* relation_TSstructure *)\n  \"F_EPDA_TC__relation_epda__LR\"\n  (* relation_initial_simulation *)\n  \"F_EPDA_TC__relation_epdaS_initial__LR\"\n  (* relation_step_simulation *)\n  \"F_EPDA_TC__relation_epdaS_step__LR\"\n  apply(simp add: LOCALE_DEFS epda_interpretations)\n  apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_Marked_Effect_axioms epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms )\n  done\n\nlemma F_EPDA_TC__preserves_lang1: \"\n  valid_pda G\n  \\<Longrightarrow> epdaS.marked_language G \\<subseteq> epdaS.marked_language (F_EPDA_TC G)\"\n  apply(rule_tac\n      t=\"epdaS.marked_language G\"\n      and s=\"epdaS.finite_marked_language G\"\n      in ssubst)\n   apply (metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_EPDA_TC__relation_epda__LR_def Suc_n_not_n epdaS.AX_marked_language_finite)\n  apply(rule_tac\n      t=\"epdaS.marked_language (F_EPDA_TC G)\"\n      and s=\"epdaS.finite_marked_language (F_EPDA_TC G)\"\n      in ssubst)\n   apply(rule sym)\n   apply(rule epdaS.AX_marked_language_finite)\n   apply(subgoal_tac \"valid_pda (F_EPDA_TC G)\")\n    prefer 2\n    apply(rule F_EPDA_TC__preserves__valid_pda)\n    apply(force)\n   apply(simp add: valid_pda_def)\n   apply(force)\n  apply(subgoal_tac \"left_total_on (F_EPDA_TC__relation_effect__LR SSG1 SSG2) (epdaS.finite_marked_language SSG1) (epdaS.finite_marked_language SSG2)\" for SSG1 SSG2)\n   prefer 2\n   apply(rule_tac\n      ?G1.0=\"G\"\n      in epdaS_epdaS_F_EPDA_TC__StateSimLR.ATS_Simulation_Configuration_Weak_Marked_Effect_sound)\n   apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in ballE)\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x b)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_effect__LR_def)\n  apply(clarsimp)\n  apply(rename_tac b)(*strict*)\n  apply(force)\n  done\n\nlemma F_EPDA_TC__preserves_unmarked_language1: \"\n  valid_pda G\n  \\<Longrightarrow> epdaS.unmarked_language G \\<subseteq> epdaS.unmarked_language (F_EPDA_TC G)\"\n  apply(rule_tac\n      t=\"epdaS.unmarked_language G\"\n      and s=\"epdaS.finite_unmarked_language G\"\n      in ssubst)\n   apply (metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_EPDA_TC__relation_epda__LR_def Suc_n_not_n epdaS.AX_unmarked_language_finite)\n  apply(rule_tac\n      t=\"epdaS.unmarked_language (F_EPDA_TC G)\"\n      and s=\"epdaS.finite_unmarked_language (F_EPDA_TC G)\"\n      in ssubst)\n   apply(rule sym)\n   apply(rule epdaS.AX_unmarked_language_finite)\n   apply(subgoal_tac \"valid_pda (F_EPDA_TC G)\")\n    prefer 2\n    apply(rule F_EPDA_TC__preserves__valid_pda)\n    apply(force)\n   apply(simp add: valid_pda_def)\n   apply(force)\n  apply(subgoal_tac \"left_total_on (F_EPDA_TC__relation_effect__LR SSG1 SSG2) (epdaS.finite_unmarked_language SSG1) (epdaS.finite_unmarked_language SSG2)\" for SSG1 SSG2)\n   prefer 2\n   apply(rule_tac\n      ?G1.0=\"G\"\n      in epdaS_epdaS_F_EPDA_TC__StateSimLR.ATS_Simulation_Configuration_Weak_Unmarked_Effect_sound)\n   apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in ballE)\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x b)(*strict*)\n   prefer 2\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x b)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_effect__LR_def)\n  apply(force)\n  done\n\ndefinition F_EPDA_TC__relation_epda__RL :: \"\n  ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_epda__RL G2 G1 \\<equiv>\n  valid_pda G1\n  \\<and> G2 = F_EPDA_TC G1\"\n\ndefinition F_EPDA_TC__relation_epdaS_conf__RL :: \"\n  ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_epdaS_conf__RL G2 G1 c2 c1 \\<equiv>\n  F_EPDA_TC__relation_epda__RL G2 G1\n  \\<and> c1 \\<in> epdaS_configurations G1\n  \\<and> c2 = F_EPDA_TC__epdaS_conf__LR G1 c1\"\n\ndefinition F_EPDA_TC__relation_epdaS_initial_conf__RL :: \"\n  ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_epdaS_initial_conf__RL G2 G1 c2 c1 \\<equiv>\n  F_EPDA_TC__relation_epda__RL G2 G1\n  \\<and> c1 \\<in> epdaS_initial_configurations G1\n  \\<and> c2 = F_EPDA_TC__epdaS_conf__LR G1 c1\"\n\ndefinition F_EPDA_TC__relation_effect__RL :: \"\n  ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> 'event list\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_effect__RL G1 G2 w1 w2 \\<equiv>\n  F_EPDA_TC__relation_epda__RL G1 G2\n  \\<and> w1 = w2\"\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs: \"\n  (\\<forall>G1. Ex (F_EPDA_TC__relation_epda__RL G1) \\<longrightarrow> valid_epda G1)\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n  apply(clarsimp)\n  apply(rename_tac G2)(*strict*)\n  apply(subgoal_tac \"valid_pda (F_EPDA_TC G2)\")\n   apply(rename_tac G2)(*strict*)\n   apply(simp add: valid_pda_def)\n   apply(force)\n  apply(rename_tac G2)(*strict*)\n  apply(rule F_EPDA_TC__preserves__valid_pda)\n  apply(force)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__RL G1 G2 \\<longrightarrow> valid_epda G2)\"\n  apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n  apply(clarsimp)\n  apply(rename_tac G2)(*strict*)\n  apply (metis valid_dpda_def valid_pda_def)\n  done\n\ndefinition F_EPDA_TC__relation_epdaS_step__LRRL :: \"\n  ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda_step_label\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> (('stateA, 'event, 'stackA) epda_step_label, ('stateA, 'event, 'stackA) epdaS_conf) derivation\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_epdaS_step__LRRL G2 G1 c1 e c1' c2 d \\<equiv>\n  d = der2 (F_EPDA_TC__epdaS_conf__LRRev G1 c1) (F_EPDA_TC__edge__RL G1 e) (F_EPDA_TC__epdaS_conf__LRRev G1 c1')\"\n\ndefinition F_EPDA_TC__relation_epdaS_initial__LRRL :: \"\n  ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> (('stateA, 'event, 'stackA) epda_step_label, ('stateA, 'event, 'stackA) epdaS_conf) derivation\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__relation_epdaS_initial__LRRL G1 G2 c1 d \\<equiv>\n  d = der1 (F_EPDA_TC__epdaS_conf__LRRev G2 c1)\"\n\nlemma F_EPDA_TC__C_rev_preserves_configurations: \"\n  F_EPDA_TC__relation_epda__RL G1 G2\n  \\<Longrightarrow> c1 \\<in> epdaS_configurations G1\n  \\<Longrightarrow> F_EPDA_TC__epdaS_conf__LRRev G2 c1 \\<in> epdaS_configurations G2\"\n  apply(simp add: epdaS_configurations_def)\n  apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n  apply(clarsimp)\n  apply(rename_tac q i s)(*strict*)\n  apply(simp add: F_EPDA_TC_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def F_EPDA_TC__epda_def)\n  apply(clarsimp)\n  apply(rename_tac i s x)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac i s x)(*strict*)\n   apply(rule_tac\n      t=\"inv_into (epda_states G2) (SOME f. inj_on f (epda_states G2)) ((SOME f. inj_on f (epda_states G2)) x)\"\n      and s=\"x\"\n      in ssubst)\n    apply(rename_tac i s x)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac i s x)(*strict*)\n   apply(rule inv_into_f_eq)\n     apply(rename_tac i s x)(*strict*)\n     apply(rule SOME_injective_is_injective)\n     apply(simp add: valid_pda_def valid_epda_def)\n    apply(rename_tac i s x)(*strict*)\n    apply(force)\n   apply(rename_tac i s x)(*strict*)\n   apply(force)\n  apply(rename_tac i s x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac i s x xb)(*strict*)\n  apply(subgoal_tac \"\\<exists>w1 w2. s=w1@[xb]@w2\")\n   apply(rename_tac i s x xb)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i x w1 w2 xa)(*strict*)\n   apply(rule_tac\n      t=\"inv_into (epda_gamma G2) (SOME f. inj_on f (epda_gamma G2)) ((SOME f. inj_on f (epda_gamma G2)) xa)\"\n      and s=\"xa\"\n      in ssubst)\n    apply(rename_tac i x w1 w2 xa)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac i x w1 w2 xa)(*strict*)\n   apply(rule inv_into_f_eq)\n     apply(rename_tac i x w1 w2 xa)(*strict*)\n     apply(rule SOME_injective_is_injective)\n     apply(simp add: valid_pda_def valid_epda_def)\n    apply(rename_tac i x w1 w2 xa)(*strict*)\n    apply(force)\n   apply(rename_tac i x w1 w2 xa)(*strict*)\n   apply(force)\n  apply(rename_tac i s x xb)(*strict*)\n  apply (metis ConsApp in_set_conv_decomp_first insert_Nil)\n  done\n\n\n\nlemma F_EPDA_TC__C_rev_preserves_initial_configurations: \"\n  F_EPDA_TC__relation_epda__RL G1 G2\n  \\<Longrightarrow> c1 \\<in> epdaS_initial_configurations G1\n  \\<Longrightarrow> F_EPDA_TC__epdaS_conf__LRRev G2 c1 \\<in> epdaS_initial_configurations G2\"\n  apply(subgoal_tac \"valid_pda (F_EPDA_TC G1)\")\n   prefer 2\n   apply(rule F_EPDA_TC__preserves__valid_pda)\n   apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n   apply(rule F_EPDA_TC__preserves__valid_pda)\n   apply(force)\n  apply(subgoal_tac \"c1 \\<in> epdaS.get_accessible_configurations G1\")\n   prefer 2\n   apply (simp add: F_EPDA_TC__preserves__valid_pda F_EPDA_TC__relation_epda__RL_def epdaS.initial_configurations_are_get_accessible_configurations valid_pda_to_valid_epda)\n  apply(simp add: epdaS_initial_configurations_def)\n  apply(clarsimp)\n  apply(rule propSym)\n  apply(rule conjI)\n   apply(rule propSym)\n   apply(rule conjI)\n    apply(rule F_EPDA_TC__C_rev_preserves_configurations)\n     apply(force)\n    apply(force)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def inv_into_def)\n   apply(simp add: valid_pda_def valid_epda_def F_EPDA_TC__relation_epda__RL_def F_EPDA_TC_def epdaS_configurations_def F_EPDA_TC__epda_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def)\n   apply(clarsimp)\n   apply(rule some_equality)\n    apply(rule context_conjI)\n     apply(force)\n    apply(force)\n   apply(rule_tac f=\"(SOME f. inj_on f (epda_states G2))\" in inj_onD)\n      apply(rule SOME_injective_is_injective)\n      apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_EPDA_TC__relation_epda__LR_def valid_epda_def SOME_injective_is_injective)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(simp add: epdaS.get_accessible_configurations_def F_EPDA_TC__relation_epda__RL_def F_EPDA_TC_def epdaS_configurations_def F_EPDA_TC__epda_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def)\n  apply(clarsimp)\n  apply(subgoal_tac \"(epda_box G2) = xa\")\n   prefer 2\n   apply(rule_tac f=\"(SOME f. inj_on f (epda_gamma G2))\" in inj_onD)\n      apply(rule SOME_injective_is_injective)\n      apply(simp add: valid_pda_def valid_epda_def epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_EPDA_TC__relation_epda__LR_def valid_epda_def SOME_injective_is_injective)\n     apply(force)\n    apply(simp add: valid_pda_def valid_epda_def epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_EPDA_TC__relation_epda__LR_def valid_epda_def SOME_injective_is_injective)\n   apply(force)\n  apply(simp add: epdaS.get_accessible_configurations_def F_EPDA_TC__relation_epda__RL_def F_EPDA_TC_def epdaS_configurations_def F_EPDA_TC__epda_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def)\n  apply(clarsimp)\n  apply(rule inv_into_f_f)\n   apply(rule SOME_injective_is_injective)\n   apply(simp add: valid_pda_def valid_epda_def epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_EPDA_TC__relation_epda__LR_def valid_epda_def SOME_injective_is_injective)\n  apply(simp add: valid_pda_def valid_epda_def epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_EPDA_TC__relation_epda__LR_def valid_epda_def SOME_injective_is_injective)\n  done\n\nlemma F_EPDA_TC__epdaS_conf__LR_reverse: \"\n  valid_pda G2\n  \\<Longrightarrow> c1 \\<in> epdaS_configurations (F_EPDA_TC G2)\n  \\<Longrightarrow> c1 = F_EPDA_TC__epdaS_conf__LR G2 (F_EPDA_TC__epdaS_conf__LRRev G2 c1)\"\n  apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LR_def F_EPDA_TC__epdaS_conf1__LRRev_def F_EPDA_TC_def F_EPDA_TC__epda_def epdaS_initial_configurations_def epdaS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac i s x)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac i s x)(*strict*)\n   apply (metis f_inv_into_f inMap2)\n  apply(rename_tac i s x)(*strict*)\n  apply(rule listEqI)\n   apply(rename_tac i s x)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac i s x ia)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>w1 w2. s=w1@[s!ia]@w2\")\n   apply(rename_tac i s x ia)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac i s x ia w1 w2)(*strict*)\n   apply(subgoal_tac \"s!ia \\<in> (SOME f. inj_on f (epda_gamma G2)) ` epda_gamma G2\")\n    apply(rename_tac i s x ia w1 w2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac i x ia w1 w2 xa)(*strict*)\n    apply (metis f_inv_into_f imageI)\n   apply(rename_tac i s x ia w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac i s x ia)(*strict*)\n  apply (metis ConsApp nth_take_drop_split)\n  done\n\nlemma F_EPDA_TC__epdaS_conf__LR_reverse2: \"\n  valid_pda G2\n  \\<Longrightarrow> c1 \\<in> epdaS_configurations G2\n  \\<Longrightarrow> c1 = F_EPDA_TC__epdaS_conf__LRRev G2 (F_EPDA_TC__epdaS_conf__LR G2 c1)\"\n  apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LR_def F_EPDA_TC__epdaS_conf1__LRRev_def F_EPDA_TC_def F_EPDA_TC__epda_def epdaS_initial_configurations_def epdaS_configurations_def)\n  apply(clarsimp)\n  apply(rename_tac q i s)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac q i s)(*strict*)\n   apply(rule sym)\n   apply(rule inv_into_f_eq)\n     apply(rename_tac q i s)(*strict*)\n     apply(rule SOME_injective_is_injective)\n     apply(simp add: valid_pda_def valid_epda_def)\n    apply(rename_tac q i s)(*strict*)\n    apply(force)\n   apply(rename_tac q i s)(*strict*)\n   apply(force)\n  apply(rename_tac q i s)(*strict*)\n  apply(rule listEqI)\n   apply(rename_tac q i s)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac q i s ia)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>w1 w2. s=w1@[s!ia]@w2\")\n   apply(rename_tac q i s ia)(*strict*)\n   prefer 2\n   apply (metis ConsApp nth_take_drop_split)\n  apply(rename_tac q i s ia)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac q i s ia w1 w2)(*strict*)\n  apply(subgoal_tac \"s!ia \\<in> epda_gamma G2\")\n   apply(rename_tac q i s ia w1 w2)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac q i s ia w1 w2)(*strict*)\n  apply(rule sym)\n  apply(rule inv_into_f_eq)\n    apply(rename_tac q i s ia w1 w2)(*strict*)\n    apply(rule SOME_injective_is_injective)\n    apply(simp add: valid_pda_def valid_epda_def)\n   apply(rename_tac q i s ia w1 w2)(*strict*)\n   apply(force)\n  apply(rename_tac q i s ia w1 w2)(*strict*)\n  apply(force)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_initial_simulation: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__RL G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> epdaS_initial_configurations G1 \\<longrightarrow> (\\<exists>d2. epdaS.derivation_initial G2 d2 \\<and> F_EPDA_TC__relation_epdaS_initial_conf__RL G1 G2 c1 (the (get_configuration (d2 0))) \\<and> F_EPDA_TC__relation_epdaS_initial__LRRL G1 G2 c1 d2 \\<and> (\\<exists>n. maximum_of_domain d2 n \\<and> F_EPDA_TC__relation_epdaS_conf__RL G1 G2 c1 (the (get_configuration (d2 n)))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epdaS_initial__LRRL_def)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(rule epdaS.derivation_initialI)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(rule epdaS.der1_is_derivation)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(simp add: get_configuration_def der1_def)\n   apply(rule F_EPDA_TC__C_rev_preserves_initial_configurations)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(simp add: get_configuration_def der1_def)\n   apply(simp add: F_EPDA_TC__relation_epdaS_initial_conf__RL_def)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(rule F_EPDA_TC__C_rev_preserves_initial_configurations)\n     apply(rename_tac G1 G2 c1)(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n   apply(clarsimp)\n   apply(rename_tac G2 c1)(*strict*)\n   apply(rule F_EPDA_TC__epdaS_conf__LR_reverse)\n    apply(rename_tac G2 c1)(*strict*)\n    apply(force)\n   apply(rename_tac G2 c1)(*strict*)\n   apply (metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs F_EPDA_TC__relation_epda__LR_def epdaS_inst_AX_initial_configuration_belongs subsetD)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(rule_tac\n      x=\"0\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(rule der1_maximum_of_domain)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(simp add: get_configuration_def der1_def)\n  apply(simp add: F_EPDA_TC__relation_epdaS_conf__RL_def)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(rule F_EPDA_TC__C_rev_preserves_configurations)\n    apply(rename_tac G1 G2 c1)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply (metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs F_EPDA_TC__relation_epda__LR_def F_EPDA_TC__relation_epda__RL_def epdaS.AX_initial_configuration_belongs nset_mp)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(rule F_EPDA_TC__epdaS_conf__LR_reverse)\n   apply(rename_tac G1 G2 c1)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n  apply (metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure2_belongs F_EPDA_TC__relation_epda__LR_def F_EPDA_TC__relation_epda__RL_def epdaS.AX_initial_configuration_belongs nset_mp)\n  done\n\nlemma F_EPDA_TCRev_preserves_step_relation: \"\n  F_EPDA_TC__relation_epda__RL G1 G2\n  \\<Longrightarrow> epdaS_step_relation G1 c1 e1 c1'\n  \\<Longrightarrow> epdaS_step_relation G2 (F_EPDA_TC__epdaS_conf__LRRev G2 c1) (F_EPDA_TC__edge__RL G2 e1) (F_EPDA_TC__epdaS_conf__LRRev G2 c1')\"\n  apply(simp add: epdaS_step_relation_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__relation_epda__RL_def F_EPDA_TC__epdaS_conf1__LRRev_def)\n  apply(subgoal_tac \"F_EPDA_TC__edge__RL G2 e1 \\<in> epda_delta G2\")\n   prefer 2\n   apply(rule F_EPDA_TC__edge__RL__preserves__epda_delta)\n    apply(simp add: valid_pda_def)\n   apply(force)\n  apply(subgoal_tac \"valid_pda (F_EPDA_TC G2)\")\n   prefer 2\n   apply(rule F_EPDA_TC__preserves__valid_pda)\n   apply(simp add: valid_pda_def)\n  apply(subgoal_tac \"valid_epda_step_label (F_EPDA_TC G2) e1\")\n   prefer 2\n   apply(simp add: valid_pda_def valid_epda_def)\n   apply(force)\n  apply(simp add: valid_epda_step_label_def F_EPDA_TC_def F_EPDA_TC__epda_def)\n  apply(clarsimp)\n  apply(rename_tac x xa xb w)(*strict*)\n  apply(simp add: F_EPDA_TC__edge__RL_def F_EPDA_TC__edge1__RL_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_step_relation_step_simulation: \"\n  \\<forall>G1 G2. F_EPDA_TC__relation_epda__RL G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__relation_epdaS_conf__RL G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> epda_step_labels G1 \\<longrightarrow> (\\<forall>c1'. epdaS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<exists>d2. epdaS.derivation G2 d2 \\<and> epdaS.belongs G2 d2 \\<and> the (get_configuration (d2 0)) = c2 \\<and> F_EPDA_TC__relation_epdaS_step__LRRL G1 G2 c1 e1 c1' c2 d2 \\<and> (\\<exists>n. maximum_of_domain d2 n \\<and> F_EPDA_TC__relation_epdaS_conf__RL G1 G2 c1' (the (get_configuration (d2 n))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epdaS_step__LRRL_def)\n  apply(rule context_conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(rule epdaS.der2_is_derivation)\n   apply(rule F_EPDA_TCRev_preserves_step_relation)\n    apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(rule epdaS.derivation_belongs)\n      apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n      apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n      apply(simp add: valid_pda_def)\n     apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n     apply(simp add: der2_def)\n    apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n    apply(rule F_EPDA_TC__C_rev_preserves_configurations)\n     apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n    apply(simp add: F_EPDA_TC__relation_epdaS_conf__RL_def)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c2 e1 c1')(*strict*)\n    apply(rule F_EPDA_TC__preserves__epdaS_configurations)\n     apply(rename_tac G1 G2 c2 e1 c1')(*strict*)\n     apply(simp add: F_EPDA_TC__relation_epda__LR_def F_EPDA_TC__relation_epda__RL_def)\n    apply(rename_tac G1 G2 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n   apply(simp add: get_configuration_def der2_def F_EPDA_TC__relation_epdaS_conf__RL_def F_EPDA_TC__relation_epda__RL_def)\n   apply(clarsimp)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(rule sym)\n   apply(rule F_EPDA_TC__epdaS_conf__LR_reverse2)\n    apply(rename_tac G2 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1')(*strict*)\n  apply(rule_tac\n      x=\"Suc 0\"\n      in exI)\n  apply(simp add: maximum_of_domain_def der2_def)\n  apply(simp add: get_configuration_def F_EPDA_TC__relation_epdaS_conf__RL_def F_EPDA_TC__relation_epda__RL_def)\n  apply(clarsimp)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(subgoal_tac \"valid_pda (F_EPDA_TC G2)\")\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   prefer 2\n   apply(rule F_EPDA_TC__preserves__valid_pda)\n   apply(force)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(rule context_conjI)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(rule F_EPDA_TC__C_rev_preserves_configurations)\n    apply(rename_tac G2 c2 e1 c1')(*strict*)\n    apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(rule epdaS.AX_step_relation_preserves_belongsC)\n     apply(rename_tac G2 c2 e1 c1')(*strict*)\n     apply(simp add: valid_pda_def)\n     apply(force)\n    apply(rename_tac G2 c2 e1 c1')(*strict*)\n    apply(force)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(rule F_EPDA_TC__preserves__epdaS_configurations)\n    apply(rename_tac G2 c2 e1 c1')(*strict*)\n    apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(rule F_EPDA_TC__epdaS_conf__LR_reverse)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(rule epdaS.AX_step_relation_preserves_belongsC)\n    apply(rename_tac G2 c2 e1 c1')(*strict*)\n    apply(simp add: valid_pda_def)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(rule F_EPDA_TC__preserves__epdaS_configurations)\n   apply(rename_tac G2 c2 e1 c1')(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n  apply(rename_tac G2 c2 e1 c1')(*strict*)\n  apply(force)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms: \"\n  ATS_Simulation_Configuration_Weak_axioms valid_epda epdaS_initial_configurations epda_step_labels epdaS_step_relation valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation F_EPDA_TC__relation_epdaS_conf__RL F_EPDA_TC__relation_epdaS_initial_conf__RL F_EPDA_TC__relation_epda__RL F_EPDA_TC__relation_epdaS_initial__LRRL F_EPDA_TC__relation_epdaS_step__LRRL\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_axioms_def epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_initial_simulation epdaS_epdaS_F_EPDA_TC__StateSimRL_step_relation_step_simulation epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_AX_TSstructure_relation_TSstructure2_belongs epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_AX_TSstructure_relation_TSstructure1_belongs)\n  done\n\ninterpretation \"epdaS_epdaS_F_EPDA_TC__StateSimRL\" : ATS_Simulation_Configuration_Weak\n  (* TSstructure1 *)\n  \"valid_epda\"\n  (* configurations1 *)\n  \"epdaS_configurations\"\n  (* initial_configurations1 *)\n  \"epdaS_initial_configurations\"\n  (* step_labels1 *)\n  \"epda_step_labels\"\n  (* step_relation1 *)\n  \"epdaS_step_relation\"\n  (* effects1 *)\n  \"epda_effects\"\n  (* marking_condition1 *)\n  \"epdaS_marking_condition\"\n  (* marked_effect1 *)\n  \"epdaS_marked_effect\"\n  (* unmarked_effect1 *)\n  \"epdaS_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_epda\"\n  (* configurations2 *)\n  \"epdaS_configurations\"\n  (* initial_configurations2 *)\n  \"epdaS_initial_configurations\"\n  (* step_labels2 *)\n  \"epda_step_labels\"\n  (* step_relation2 *)\n  \"epdaS_step_relation\"\n  (* effects2 *)\n  \"epda_effects\"\n  (* marking_condition2 *)\n  \"epdaS_marking_condition\"\n  (* marked_effect2 *)\n  \"epdaS_marked_effect\"\n  (* unmarked_effect2 *)\n  \"epdaS_unmarked_effect\"\n  (* relation_configuration *)\n  \"F_EPDA_TC__relation_epdaS_conf__RL\"\n  (* relation_initial_configuration *)\n  \"F_EPDA_TC__relation_epdaS_initial_conf__RL\"\n  (* relation_effect *)\n  \"F_EPDA_TC__relation_effect__RL\"\n  (* relation_TSstructure *)\n  \"F_EPDA_TC__relation_epda__RL\"\n  (* relation_initial_simulation *)\n  \"F_EPDA_TC__relation_epdaS_initial__LRRL\"\n  (* relation_step_simulation *)\n  \"F_EPDA_TC__relation_epdaS_step__LRRL\"\n  apply(simp add: LOCALE_DEFS epda_interpretations)\n  apply(simp add:  epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms)\n  done\n\nlemma F_EPDA_TC__C_rev_preserves_marking_configurations: \"\n  F_EPDA_TC__relation_epda__RL G1 G2\n  \\<Longrightarrow> c1 \\<in> epdaS_marking_configurations G1\n  \\<Longrightarrow> F_EPDA_TC__epdaS_conf__LRRev G2 c1 \\<in> epdaS_marking_configurations G2\"\n  apply(simp add: epdaS_marking_configurations_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(simp add: F_EPDA_TC__relation_epda__RL_def F_EPDA_TC_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def)\n  apply(rule conjI)\n   apply(simp add: F_EPDA_TC__relation_epda__RL_def F_EPDA_TC_def F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def F_EPDA_TC__epda_def epdaS_configurations_def)\n   apply(clarsimp)\n   apply(rename_tac x s xa)(*strict*)\n   apply(rule_tac\n      t=\"inv_into (epda_states G2) (SOME f. inj_on f (epda_states G2)) ((SOME f. inj_on f (epda_states G2)) x)\"\n      and s=\"x\"\n      in ssubst)\n    apply(rename_tac x s xa)(*strict*)\n    apply(rule inv_into_f_eq)\n      apply(rename_tac x s xa)(*strict*)\n      apply(rule SOME_injective_is_injective)\n      apply(simp add: valid_pda_def valid_epda_def)\n     apply(rename_tac x s xa)(*strict*)\n     apply(simp add: valid_pda_def valid_epda_def)\n     apply(force)\n    apply(rename_tac x s xa)(*strict*)\n    apply(force)\n   apply(rename_tac x s xa)(*strict*)\n   apply(force)\n  apply(rule F_EPDA_TC__C_rev_preserves_configurations)\n   apply(force)\n  apply(force)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_step_simulation_preserves_marking_condition: \"\n  \\<forall>G1 G2. F_EPDA_TC__relation_epda__RL G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__relation_epdaS_conf__RL G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> epda_step_labels G1 \\<longrightarrow> (\\<forall>c1'. epdaS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_step__LRRL G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> epdaS_marking_condition G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n) \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__RL F_EPDA_TC__relation_epdaS_initial__LRRL F_EPDA_TC__relation_epdaS_step__LRRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: epdaS_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(thin_tac \"derivation_append deri1 (der2 c1 e1 c1') deri1n i = Some (pair e c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__RL_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"c\"\n      and s=\"F_EPDA_TC__epdaS_conf__LRRev G2 ca\"\n      in ssubst)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(simp add: derivation_append_def get_configuration_def)\n    apply(rule F_EPDA_TC__epdaS_conf__LR_reverse2)\n     apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n     apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule F_EPDA_TC__C_rev_preserves_marking_configurations)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n   apply(subgoal_tac \"c=c1'\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e)(*strict*)\n    apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_def)\n    apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_DEF_def)\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"Suc deri1n\"\n      in allE)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y)(*strict*)\n    apply(rule_tac\n      x=\"deri2n+n\"\n      in exI)\n    apply(case_tac y)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e y option b)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e option b)(*strict*)\n    apply(rename_tac e c)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n    apply(rule_tac\n      t=\"c\"\n      and s=\"F_EPDA_TC__epdaS_conf__LRRev G2 c1'\"\n      in ssubst)\n     apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n     apply(simp add: F_EPDA_TC__relation_epdaS_conf__RL_def derivation_append_def get_configuration_def)\n     apply(rule F_EPDA_TC__epdaS_conf__LR_reverse2)\n      apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n      apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n     apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n    apply(rule F_EPDA_TC__C_rev_preserves_marking_configurations)\n     apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n     apply(force)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f ea e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f e c)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__RL_def derivation_append_def get_configuration_def F_EPDA_TC__relation_epdaS_initial_conf__RL_def der2_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i>Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der2_def)\n  apply(case_tac \"i-deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n  apply(clarsimp)\n  apply(case_tac nat)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f i e c nat nata)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_initial_simulation_preserves_marking_condition: \"\n  \\<forall>G1 G2. F_EPDA_TC__relation_epda__RL G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> epdaS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_initial__LRRL G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> epdaS_marking_condition G1 (derivation_append deri1 (der1 c1) deri1n) \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__RL F_EPDA_TC__relation_epdaS_initial__LRRL F_EPDA_TC__relation_epdaS_step__LRRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> epdaS_marking_condition G2 (derivation_append deri2 d2 deri2n))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: epdaS_marking_condition_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__RL_def)\n   apply(clarsimp)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule_tac\n      x=\"f i\"\n      in exI)\n   apply(rule_tac\n      x=\"e\"\n      in exI)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(clarsimp)\n   apply(rule_tac\n      t=\"c\"\n      and s=\"F_EPDA_TC__epdaS_conf__LRRev G2 ca\"\n      in ssubst)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(simp add: derivation_append_def get_configuration_def)\n    apply(rule F_EPDA_TC__epdaS_conf__LR_reverse2)\n     apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n     apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(rule F_EPDA_TC__C_rev_preserves_marking_configurations)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i ea ca e c)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(subgoal_tac \"i=deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(case_tac \"i>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f i e c)(*strict*)\n  apply(clarsimp)\n  apply(simp add: derivation_append_def der1_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_COND_axioms: \"\n  ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marking_condition epdaS_initial_configurations epdaS_step_relation epdaS_marking_condition F_EPDA_TC__relation_epdaS_conf__RL F_EPDA_TC__relation_epdaS_initial_conf__RL F_EPDA_TC__relation_epda__RL F_EPDA_TC__relation_epdaS_initial__LRRL F_EPDA_TC__relation_epdaS_step__LRRL\"\n  apply(simp add: ATS_Simulation_Configuration_WeakLR_Marking_Condition_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_step_simulation_preserves_marking_condition)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_initial_simulation_preserves_marking_condition)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_step_simulation_preserves_marked_effect: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__RL G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__relation_epdaS_conf__RL G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> epda_step_labels G1 \\<longrightarrow> (\\<forall>c1'. epdaS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_step__LRRL G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__RL F_EPDA_TC__relation_epdaS_initial__LRRL F_EPDA_TC__relation_epdaS_step__LRRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_EPDA_TC__relation_effect__RL G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(rule_tac\n      x=\"a\"\n      in bexI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_effect__RL_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: epdaS_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n   apply(simp add: derivation_append_def F_EPDA_TC__relation_epdaS_initial_conf__RL_def)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n  apply(rule_tac\n      M=\"G2\"\n      in epdaS.some_position_has_details_at_0)\n  apply (metis epdaS.derivation_initial_is_derivation)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_initial_simulation_preserves_marked_effect: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__RL G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> epdaS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_initial__LRRL G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__RL F_EPDA_TC__relation_epdaS_initial__LRRL F_EPDA_TC__relation_epdaS_step__LRRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_EPDA_TC__relation_effect__RL G1 G2) (epdaS_marked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (epdaS_marked_effect G2 (derivation_append deri2 d2 deri2n))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(rule_tac\n      x=\"a\"\n      in bexI)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_effect__RL_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: epdaS_marked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c ca)(*strict*)\n   apply(simp add: derivation_append_def F_EPDA_TC__relation_epdaS_initial_conf__RL_def)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f c)(*strict*)\n  apply(rule_tac\n      M=\"G2\"\n      in epdaS.some_position_has_details_at_0)\n  apply (metis epdaS.derivation_initial_is_derivation)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ACCEPT_axioms: \"\n  ATS_Simulation_Configuration_Weak_Marked_Effect_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marked_effect epdaS_initial_configurations epdaS_step_relation epdaS_marked_effect F_EPDA_TC__relation_epdaS_conf__RL F_EPDA_TC__relation_epdaS_initial_conf__RL F_EPDA_TC__relation_effect__RL F_EPDA_TC__relation_epda__RL F_EPDA_TC__relation_epdaS_initial__LRRL F_EPDA_TC__relation_epdaS_step__LRRL\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_Marked_Effect_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_step_simulation_preserves_marked_effect)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_initial_simulation_preserves_marked_effect)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_step_simulation_preserves_unmarked_effect: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__RL G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__relation_epdaS_conf__RL G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1. e1 \\<in> epda_step_labels G1 \\<longrightarrow> (\\<forall>c1'. epdaS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_step__LRRL G1 G2 c1 e1 c1' c2 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der2 c1 e1 c1') deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__RL F_EPDA_TC__relation_epdaS_initial__LRRL F_EPDA_TC__relation_epdaS_step__LRRL G1 G2 (derivation_append deri1 (der2 c1 e1 c1') deri1n) (Suc deri1n) (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_EPDA_TC__relation_effect__RL G1 G2) (epdaS_unmarked_effect G1 (derivation_append deri1 (der2 c1 e1 c1') deri1n)) (epdaS_unmarked_effect G2 (derivation_append deri2 d2 deri2n))))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: epdaS_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_effect__RL_def)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in epdaS.some_position_has_details_at_0)\n   apply (metis epdaS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(rule_tac\n      x=\"ca\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c')\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__RL_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca c' i ea caa e c)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca i ea caa e c)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_initial_conf__RL_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>c. deri1 0 = Some (pair None c)\")\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca i ea caa e c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"G1\"\n      in epdaS.some_position_has_details_at_0)\n    apply (metis epdaS.derivation_initial_is_derivation)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca i ea caa e c)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca i ea caa e c)(*strict*)\n    apply(rule_tac\n      x=\"f i\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ca i ea caa e c)(*strict*)\n   apply(simp add: derivation_append_def)\n   apply(simp add: derivation_append_fit_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a i ea caa e c)(*strict*)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(subgoal_tac \"i=Suc deri1n\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   prefer 2\n   apply(case_tac \"i>Suc deri1n\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n    prefer 2\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(clarsimp)\n   apply(simp add: derivation_append_def der2_def)\n   apply(case_tac \"i-deri1n\")\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca nat)(*strict*)\n   apply(clarsimp)\n   apply(case_tac nat)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca nat)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i ca)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca nat nata)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' e ca)(*strict*)\n  apply(subgoal_tac \"c'=c1'\")\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' e ca)(*strict*)\n   prefer 2\n   apply(simp add: derivation_append_def der2_def)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c c' e ca)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a c e ca)(*strict*)\n  apply(rule_tac\n      x=\"F_EPDA_TC__epdaS_conf__LRRev G2 c1'\"\n      in exI)\n  apply(simp add: derivation_append_def)\n  apply(simp add: F_EPDA_TC__relation_epdaS_initial_conf__RL_def)\n  apply(clarsimp)\n  apply(simp add: get_configuration_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a e ca)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a e ca)(*strict*)\n   apply(rule_tac\n      x=\"deri2n+n\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"Suc deri1n\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a e ca y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a e ca y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a e ca option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ea ca e c)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__RL_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a ea ca e c)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 d2 n deri1 deri1n deri2 deri2n f a ea ca e c)(*strict*)\n   apply(case_tac n)\n    apply(rename_tac G1 G2 c2 e1 d2 n deri1 deri1n deri2 deri2n f a ea ca e c)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 c2 e1 d2 deri1 deri1n deri2 f a ea ca e c)(*strict*)\n    apply(rule F_EPDA_TC__epdaS_conf__LR_reverse2)\n     apply(rename_tac G1 G2 c2 e1 d2 deri1 deri1n deri2 f a ea ca e c)(*strict*)\n     apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n    apply(rename_tac G1 G2 c2 e1 d2 deri1 deri1n deri2 f a ea ca e c)(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 c2 e1 d2 n deri1 deri1n deri2 deri2n f a ea ca e c nat)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c2 e1 d2 deri1 deri1n deri2 deri2n f a ea ca e c nat)(*strict*)\n   apply(rule F_EPDA_TC__epdaS_conf__LR_reverse2)\n    apply(rename_tac G1 G2 c2 e1 d2 deri1 deri1n deri2 deri2n f a ea ca e c nat)(*strict*)\n    apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n   apply(rename_tac G1 G2 c2 e1 d2 deri1 deri1n deri2 deri2n f a ea ca e c nat)(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f a e ca)(*strict*)\n  apply(simp add: F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_initial_simulation_preserves_unmarked_effect: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__RL G1 G2 \\<longrightarrow> (\\<forall>c1. c1 \\<in> epdaS_initial_configurations G1 \\<longrightarrow> (\\<forall>d2. F_EPDA_TC__relation_epdaS_initial__LRRL G1 G2 c1 d2 \\<longrightarrow> (\\<forall>n. maximum_of_domain d2 n \\<longrightarrow> (\\<forall>deri1. epdaS.derivation_initial G1 deri1 \\<longrightarrow> (\\<forall>deri1n. maximum_of_domain deri1 deri1n \\<longrightarrow> (\\<forall>deri2. epdaS.derivation_initial G2 deri2 \\<longrightarrow> (\\<forall>deri2n. maximum_of_domain deri2 deri2n \\<longrightarrow> F_EPDA_TC__relation_epdaS_initial_conf__RL G1 G2 (the (get_configuration (deri1 0))) (the (get_configuration (deri2 0))) \\<longrightarrow> derivation_append_fit deri1 (der1 c1) deri1n \\<longrightarrow> derivation_append_fit deri2 d2 deri2n \\<longrightarrow> Ex (ATS_Simulation_Configuration_Weak.simulating_derivation F_EPDA_TC__relation_epdaS_conf__RL F_EPDA_TC__relation_epdaS_initial__LRRL F_EPDA_TC__relation_epdaS_step__LRRL G1 G2 (derivation_append deri1 (der1 c1) deri1n) deri1n (derivation_append deri2 d2 deri2n) (deri2n + n)) \\<longrightarrow> left_total_on (F_EPDA_TC__relation_effect__RL G1 G2) (epdaS_unmarked_effect G1 (derivation_append deri1 (der1 c1) deri1n)) (epdaS_unmarked_effect G2 (derivation_append deri2 d2 deri2n))))))))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n x)(*strict*)\n  apply(rename_tac f)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a)(*strict*)\n  apply(simp add: epdaS_unmarked_effect_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_effect__RL_def)\n  apply(subgoal_tac \"\\<exists>c. deri2 0 = Some (pair None c)\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n   prefer 2\n   apply(rule_tac\n      M=\"G2\"\n      in epdaS.some_position_has_details_at_0)\n   apply (metis epdaS.derivation_initial_is_derivation)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(rule_tac\n      x=\"ca\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(simp add: derivation_append_def)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(case_tac \"i\\<le>deri1n\")\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(subgoal_tac \"deri1 i = Some (pair e c')\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n    prefer 2\n    apply(simp add: derivation_append_def)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_def)\n   apply(clarsimp)\n   apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL.simulating_derivation_DEF_def)\n   apply(clarsimp)\n   apply(simp add: F_EPDA_TC__relation_epdaS_conf__RL_def)\n   apply(erule_tac\n      x=\"i\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca y)(*strict*)\n   apply(case_tac y)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca y option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca option b)(*strict*)\n   apply(rename_tac e c)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca c' i ea caa e c)(*strict*)\n   apply(simp add: get_configuration_def)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca i ea caa e c)(*strict*)\n   apply(simp add: F_EPDA_TC__relation_epdaS_initial_conf__RL_def)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>c. deri1 0 = Some (pair None c)\")\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca i ea caa e c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      M=\"G1\"\n      in epdaS.some_position_has_details_at_0)\n    apply (metis epdaS.derivation_initial_is_derivation)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca i ea caa e c)(*strict*)\n   apply(clarsimp)\n   apply(rule_tac\n      x=\"c\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca i ea caa e c)(*strict*)\n    apply(rule_tac\n      x=\"f i\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a ca i ea caa e c)(*strict*)\n   apply(simp add: derivation_append_def)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LRRev_def F_EPDA_TC__epdaS_conf1__LRRev_def F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def)\n   apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f a c c' i e ca)(*strict*)\n  apply(simp add: derivation_append_def der1_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ANY_axioms: \"\n  ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_unmarked_effect epdaS_initial_configurations epdaS_step_relation epdaS_unmarked_effect F_EPDA_TC__relation_epdaS_conf__RL F_EPDA_TC__relation_epdaS_initial_conf__RL F_EPDA_TC__relation_effect__RL F_EPDA_TC__relation_epda__RL F_EPDA_TC__relation_epdaS_initial__LRRL F_EPDA_TC__relation_epdaS_step__LRRL\"\n  apply(simp add: ATS_Simulation_Configuration_Weak_Unmarked_Effect_axioms_def)\n  apply(rule conjI)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(rule epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_step_simulation_preservation_PROVE2)\n    apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n    prefer 2\n    apply(rename_tac G1 G2 d1' d2')(*strict*)\n    apply(force)\n   apply(rename_tac G1 G2 d1' d2' c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_step_simulation_preservation G1 G2 d1' d2'\")\n   apply(clarsimp)\n   apply(rename_tac G1 G2 c1 c2 e1 c1' d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   apply(metis epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_step_simulation_preserves_unmarked_effect)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 d1' d2')(*strict*)\n  apply(rule epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_initial_simulation_preservation_PROVE2)\n   apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n   prefer 2\n   apply(rename_tac G1 G2 d1' d2')(*strict*)\n   apply(force)\n  apply(rename_tac G1 G2 d1' d2' c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(thin_tac \"epdaS_epdaS_F_EPDA_TC__StateSimRL.relation_initial_simulation_preservation G1 G2 d1' d2'\")\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 d2 n deri1 deri1n deri2 deri2n f)(*strict*)\n  apply(metis epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_relation_initial_simulation_preserves_unmarked_effect)\n  done\n\ninterpretation \"epdaS_epdaS_F_EPDA_TC__StateSimRL\" : ATS_Simulation_Configuration_WeakLR_FULL\n  (* TSstructure1 *)\n  \"valid_epda\"\n  (* configurations1 *)\n  \"epdaS_configurations\"\n  (* initial_configurations1 *)\n  \"epdaS_initial_configurations\"\n  (* step_labels1 *)\n  \"epda_step_labels\"\n  (* step_relation1 *)\n  \"epdaS_step_relation\"\n  (* effects1 *)\n  \"epda_effects\"\n  (* marking_condition1 *)\n  \"epdaS_marking_condition\"\n  (* marked_effect1 *)\n  \"epdaS_marked_effect\"\n  (* unmarked_effect1 *)\n  \"epdaS_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_epda\"\n  (* configurations2 *)\n  \"epdaS_configurations\"\n  (* initial_configurations2 *)\n  \"epdaS_initial_configurations\"\n  (* step_labels2 *)\n  \"epda_step_labels\"\n  (* step_relation2 *)\n  \"epdaS_step_relation\"\n  (* effects2 *)\n  \"epda_effects\"\n  (* marking_condition2 *)\n  \"epdaS_marking_condition\"\n  (* marked_effect2 *)\n  \"epdaS_marked_effect\"\n  (* unmarked_effect2 *)\n  \"epdaS_unmarked_effect\"\n  (* relation_configuration *)\n  \"F_EPDA_TC__relation_epdaS_conf__RL\"\n  (* relation_initial_configuration *)\n  \"F_EPDA_TC__relation_epdaS_initial_conf__RL\"\n  (* relation_effect *)\n  \"F_EPDA_TC__relation_effect__RL\"\n  (* relation_TSstructure *)\n  \"F_EPDA_TC__relation_epda__RL\"\n  (* relation_initial_simulation *)\n  \"F_EPDA_TC__relation_epdaS_initial__LRRL\"\n  (* relation_step_simulation *)\n  \"F_EPDA_TC__relation_epdaS_step__LRRL\"\n  apply(simp add: LOCALE_DEFS epda_interpretations)\n  apply(simp add: epdaS_epdaS_F_EPDA_TC__StateSimRL_inst_ATS_Simulation_Configuration_Weak_axioms epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ANY_axioms epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_COND_axioms epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_ATS_Simulation_Configuration_WeakRL_ACCEPT_axioms )\n  done\n\nlemma F_EPDA_TC__preserves_lang2: \"\n  valid_pda G\n  \\<Longrightarrow> epdaS.marked_language G \\<supseteq> epdaS.marked_language (F_EPDA_TC G)\"\n  apply(rule_tac\n      t=\"epdaS.marked_language G\"\n      and s=\"epdaS.finite_marked_language G\"\n      in ssubst)\n   apply (metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_EPDA_TC__relation_epda__LR_def epdaS_inst_lang_finite)\n  apply(rule_tac\n      t=\"epdaS.marked_language (F_EPDA_TC G)\"\n      and s=\"epdaS.finite_marked_language (F_EPDA_TC G)\"\n      in ssubst)\n   apply(rule sym)\n   apply(rule epdaS.AX_marked_language_finite)\n   apply(subgoal_tac \"valid_pda (F_EPDA_TC G)\")\n    prefer 2\n    apply(rule F_EPDA_TC__preserves__valid_pda)\n    apply(force)\n   apply(simp add: valid_pda_def)\n   apply(force)\n  apply(subgoal_tac \"left_total_on (F_EPDA_TC__relation_effect__RL SSG1 SSG2) (epdaS.finite_marked_language SSG1) (epdaS.finite_marked_language SSG2)\" for SSG1 SSG2)\n   prefer 2\n   apply(rule_tac\n      ?G2.0=\"G\"\n      in epdaS_epdaS_F_EPDA_TC__StateSimRL.ATS_Simulation_Configuration_Weak_Marked_Effect_sound)\n   apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in ballE)\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x b)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_effect__RL_def)\n  done\n\nlemma F_EPDA_TC__preserves_unmarked_language2: \"\n  valid_pda G\n  \\<Longrightarrow> epdaS.unmarked_language G \\<supseteq> epdaS.unmarked_language (F_EPDA_TC G)\"\n  apply(rule_tac\n      t=\"epdaS.unmarked_language G\"\n      and s=\"epdaS.finite_unmarked_language G\"\n      in ssubst)\n   apply (metis epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs F_EPDA_TC__relation_epda__LR_def epdaS_inst_AX_unmarked_language_finite n_not_Suc_n)\n  apply(rule_tac\n      t=\"epdaS.unmarked_language (F_EPDA_TC G)\"\n      and s=\"epdaS.finite_unmarked_language (F_EPDA_TC G)\"\n      in ssubst)\n   apply(rule sym)\n   apply(rule epdaS.AX_unmarked_language_finite)\n   apply(subgoal_tac \"valid_pda (F_EPDA_TC G)\")\n    prefer 2\n    apply(rule F_EPDA_TC__preserves__valid_pda)\n    apply(force)\n   apply(simp add: valid_pda_def)\n   apply(force)\n  apply(subgoal_tac \"left_total_on (F_EPDA_TC__relation_effect__RL SSG1 SSG2) (epdaS.finite_unmarked_language SSG1) (epdaS.finite_unmarked_language SSG2)\" for SSG1 SSG2)\n   prefer 2\n   apply(rule_tac\n      ?G2.0=\"G\"\n      in epdaS_epdaS_F_EPDA_TC__StateSimRL.ATS_Simulation_Configuration_Weak_Unmarked_Effect_sound)\n   apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n  apply(simp add: left_total_on_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(erule_tac\n      x=\"x\"\n      in ballE)\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x b)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_effect__RL_def)\n  done\n\ntheorem F_EPDA_TC__preserves_lang: \"\n  valid_pda G\n  \\<Longrightarrow> epdaS.marked_language G = epdaS.marked_language (F_EPDA_TC G)\"\n  apply(rule order_antisym)\n   apply (metis F_EPDA_TC__preserves_lang1)\n  apply (metis F_EPDA_TC__preserves_lang2)\n  done\n\ntheorem F_EPDA_TC__preserves_unmarked_language: \"\n  valid_pda G\n  \\<Longrightarrow> epdaS.unmarked_language G = epdaS.unmarked_language (F_EPDA_TC G)\"\n  apply(rule order_antisym)\n   apply (metis F_EPDA_TC__preserves_unmarked_language1)\n  apply (metis F_EPDA_TC__preserves_unmarked_language2)\n  done\n\nlemma F_EPDA_TC__preserves_derivation: \"\n  valid_dpda G\n  \\<Longrightarrow> epdaS.derivation_initial G d\n  \\<Longrightarrow> d i = Some (pair e c)\n  \\<Longrightarrow> epdaS.derivation_initial (F_EPDA_TC G) (\\<lambda>n. case d n of None \\<Rightarrow> None | Some (pair e c) \\<Rightarrow> Some (pair (case e of None \\<Rightarrow> None | Some e' \\<Rightarrow> Some (F_EPDA_TC__edge__LR G e')) (F_EPDA_TC__epdaS_conf__LR G c)))\"\n  apply(simp add: epdaS.derivation_initial_def)\n  apply(rule conjI)\n   prefer 2\n   apply(case_tac \"d 0\")\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac b)(*strict*)\n   apply(rule F_EPDA_TC__preserves__epdaS_initial_configurations)\n    apply(rename_tac b)(*strict*)\n    apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n    apply(simp add: valid_dpda_def)\n   apply(rename_tac b)(*strict*)\n   apply(force)\n  apply(clarsimp)\n  apply(simp (no_asm) add: epdaS.derivation_def)\n  apply(clarsimp)\n  apply(rename_tac ia)(*strict*)\n  apply(case_tac ia)\n   apply(rename_tac ia)(*strict*)\n   apply(clarsimp)\n   apply(case_tac \"d 0\")\n    apply(clarsimp)\n   apply(rename_tac a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac a option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac ia nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac nat a)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. d nat = Some (pair e1 c1) \\<and> d (Suc nat) = Some (pair (Some e2) c2) \\<and> epdaS_step_relation G c1 e2 c2\")\n   apply(rename_tac nat a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in epdaS.step_detail_before_some_position)\n     apply(rename_tac nat a)(*strict*)\n     apply(force)\n    apply(rename_tac nat a)(*strict*)\n    apply(force)\n   apply(rename_tac nat a)(*strict*)\n   apply(force)\n  apply(rename_tac nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac nat e1 e2 c1 c2)(*strict*)\n  apply(rule F_EPDA_TC__preserves__simulation_step)\n  apply(force)\n  done\n\ntheorem F_EPDA_TC__preserves_coblockbreeness: \"\n  valid_dpda G\n  \\<Longrightarrow> epdaS.accessible G\n  \\<Longrightarrow> epdaS.accessible (F_EPDA_TC G)\"\n  apply(simp add: epdaS.accessible_def)\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(simp add: epdaS.get_accessible_destinations_def epda_destinations_def)\n  apply(clarsimp)\n  apply(erule disjE)\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac xa)(*strict*)\n   apply(thin_tac \"edge ` epda_delta G \\<subseteq> {x. ((x \\<in> epda_destinations.state ` epda_states G \\<or> x \\<in> edge ` epda_delta G) \\<and> (\\<exists>d. epdaS.derivation_initial G d \\<and> (\\<exists>i e c. d i = Some (pair e c) \\<and> x \\<in> epdaS_get_destinations G (pair e c))))}\")\n   apply(rename_tac xa)(*strict*)\n   apply(simp add: epdaS_get_destinations_def)\n   apply(subgoal_tac \"xa \\<in> (SOME f. inj_on f (epda_states G)) ` epda_states G\")\n    apply(rename_tac xa)(*strict*)\n    prefer 2\n    apply(simp add: F_EPDA_TC_def F_EPDA_TC__epda_def)\n   apply(rename_tac xa)(*strict*)\n   apply(thin_tac \"xa \\<in> epda_states (F_EPDA_TC G)\")\n   apply(clarsimp)\n   apply(rename_tac x)(*strict*)\n   apply(subgoal_tac \"epda_destinations.state x \\<in> {x. ((x \\<in> epda_destinations.state ` epda_states G \\<or> x \\<in> edge ` epda_delta G) \\<and> (\\<exists>d. epdaS.derivation_initial G d \\<and> (\\<exists>i e c. d i = Some (pair e c) \\<and> (x = epda_destinations.state (epdaS_conf_state c) \\<or> x \\<in> (case e of None \\<Rightarrow> {} | Some e' \\<Rightarrow> {edge e'})))))}\")\n    apply(rename_tac x)(*strict*)\n    prefer 2\n    apply(rule_tac\n      A=\"epda_destinations.state ` epda_states G\"\n      in set_mp)\n     apply(rename_tac x)(*strict*)\n     apply(force)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(thin_tac \"epda_destinations.state ` epda_states G \\<subseteq> {x. ((x \\<in> epda_destinations.state ` epda_states G \\<or> x \\<in> edge ` epda_delta G) \\<and> (\\<exists>d. epdaS.derivation_initial G d \\<and> (\\<exists>i e c. d i = Some (pair e c) \\<and> (x = epda_destinations.state (epdaS_conf_state c) \\<or> x \\<in> (case e of None \\<Rightarrow> {} | Some e' \\<Rightarrow> {edge e'})))))}\")\n   apply(rename_tac x)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac x d i e c)(*strict*)\n   apply(erule disjE)\n    apply(rename_tac x d i e c)(*strict*)\n    prefer 2\n    apply(case_tac e)\n     apply(rename_tac x d i e c)(*strict*)\n     apply(clarsimp)\n    apply(rename_tac x d i e c a)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac x d i e c)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d i e c)(*strict*)\n   apply(rule_tac\n      x=\" \\<lambda>n. case d n of None \\<Rightarrow> None| Some (pair e c) \\<Rightarrow> Some (pair (case e of None \\<Rightarrow> None | Some e' \\<Rightarrow> Some (F_EPDA_TC__edge__LR G e')) (F_EPDA_TC__epdaS_conf__LR G c)) \"\n      in exI)\n   apply(rename_tac d i e c)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d i e c)(*strict*)\n    prefer 2\n    apply(rule_tac\n      x=\"i\"\n      in exI)\n    apply(rule_tac\n      x=\"(case e of None \\<Rightarrow> None | Some e' \\<Rightarrow> Some (F_EPDA_TC__edge__LR G e'))\"\n      in exI)\n    apply(rule_tac\n      x=\"(F_EPDA_TC__epdaS_conf__LR G c)\"\n      in exI)\n    apply(clarsimp)\n    apply(simp add: F_EPDA_TC__epdaS_conf__LR_def F_EPDA_TC__epdaS_conf1__LR_def)\n   apply(rename_tac d i e c)(*strict*)\n   apply(rule F_EPDA_TC__preserves_derivation)\n     apply(rename_tac d i e c)(*strict*)\n     apply(force)\n    apply(rename_tac d i e c)(*strict*)\n    apply(force)\n   apply(rename_tac d i e c)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac xa)(*strict*)\n  apply(thin_tac \"epda_destinations.state ` epda_states G \\<subseteq> {x. ((x \\<in> epda_destinations.state ` epda_states G \\<or> x \\<in> edge ` epda_delta G) \\<and> (\\<exists>d. epdaS.derivation_initial G d \\<and> (\\<exists>i e c. d i = Some (pair e c) \\<and> x \\<in> epdaS_get_destinations G (pair e c))))}\")\n  apply(rename_tac xa)(*strict*)\n  apply(simp add: epdaS_get_destinations_def)\n  apply(subgoal_tac \"xa \\<in> F_EPDA_TC__edge (SOME f. inj_on f (epda_states G)) (SOME f. inj_on f (epda_gamma G)) ` epda_delta G\")\n   apply(rename_tac xa)(*strict*)\n   prefer 2\n   apply(simp add: F_EPDA_TC_def F_EPDA_TC__epda_def)\n  apply(rename_tac xa)(*strict*)\n  apply(thin_tac \"xa \\<in> epda_delta (F_EPDA_TC G)\")\n  apply(clarsimp)\n  apply(rename_tac x)(*strict*)\n  apply(subgoal_tac \"edge x \\<in> {x. ((x \\<in> epda_destinations.state ` epda_states G \\<or> x \\<in> edge ` epda_delta G) \\<and> (\\<exists>d. epdaS.derivation_initial G d \\<and> (\\<exists>i e c. d i = Some (pair e c) \\<and> (x = epda_destinations.state (epdaS_conf_state c) \\<or> x \\<in> (case e of None \\<Rightarrow> {} | Some e' \\<Rightarrow> {edge e'})))))}\")\n   apply(rename_tac x)(*strict*)\n   prefer 2\n   apply(rule_tac\n      A=\"edge ` epda_delta G\"\n      in set_mp)\n    apply(rename_tac x)(*strict*)\n    apply(force)\n   apply(rename_tac x)(*strict*)\n   apply(force)\n  apply(rename_tac x)(*strict*)\n  apply(thin_tac \"edge ` epda_delta G \\<subseteq> {x. ((x \\<in> epda_destinations.state ` epda_states G \\<or> x \\<in> edge ` epda_delta G) \\<and> (\\<exists>d. epdaS.derivation_initial G d \\<and> (\\<exists>i e c. d i = Some (pair e c) \\<and> (x = epda_destinations.state (epdaS_conf_state c) \\<or> x \\<in> (case e of None \\<Rightarrow> {} | Some e' \\<Rightarrow> {edge e'})))))}\")\n  apply(rename_tac x)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac x d i e c)(*strict*)\n  apply(case_tac e)\n   apply(rename_tac x d i e c)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac x d i e c a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d i c a)(*strict*)\n  apply(rule_tac\n      x=\" \\<lambda>n. case d n of None \\<Rightarrow> None| Some (pair e c) \\<Rightarrow> Some (pair (case e of None \\<Rightarrow> None | Some e' \\<Rightarrow> Some (F_EPDA_TC__edge__LR G e')) (F_EPDA_TC__epdaS_conf__LR G c)) \"\n      in exI)\n  apply(rename_tac d i c a)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac d i c a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(rule_tac\n      x=\"(case (Some a) of None \\<Rightarrow> None | Some e' \\<Rightarrow> Some (F_EPDA_TC__edge__LR G e'))\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d i c a)(*strict*)\n    apply(rule_tac\n      x=\"(F_EPDA_TC__epdaS_conf__LR G c)\"\n      in exI)\n    apply(clarsimp)\n   apply(rename_tac d i c a)(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_EPDA_TC__edge__LR_def)\n  apply(rename_tac d i c a)(*strict*)\n  apply(rule F_EPDA_TC__preserves_derivation)\n    apply(rename_tac d i c a)(*strict*)\n    apply(force)\n   apply(rename_tac d i c a)(*strict*)\n   apply(force)\n  apply(rename_tac d i c a)(*strict*)\n  apply(force)\n  done\n\ninterpretation \"epdaH_epdaH_Derivation_Map\" : ATS_Derivation_Map\n  (* TSstructure1 *)\n  \"valid_epda\"\n  (* configurations1 *)\n  \"epdaH_configurations\"\n  (* initial_configurations1 *)\n  \"epdaH_initial_configurations\"\n  (* step_labels1 *)\n  \"epda_step_labels\"\n  (* step_relation1 *)\n  \"epdaH_step_relation\"\n  (* TSstructure2 *)\n  \"valid_epda\"\n  (* configurations2 *)\n  \"epdaH_configurations\"\n  (* initial_configurations2 *)\n  \"epdaH_initial_configurations\"\n  (* step_labels2 *)\n  \"epda_step_labels\"\n  (* step_relation2 *)\n  \"epdaH_step_relation\"\n  (* gen_rel *)\n  \"(\\<lambda>G1 G2. G1=F_EPDA_TC G2)\"\n  apply(simp add: LOCALE_DEFS epda_interpretations)\n  done\n\ndefinition F_EPDA_TC__epdaS_conf1__LRRevH :: \"\n  ('stateB DT_symbol \\<Rightarrow> 'stateA)\n  \\<Rightarrow> ('stackB DT_symbol \\<Rightarrow> 'stackA)\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaH_conf\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaH_conf\"\n  where\n    \"F_EPDA_TC__epdaS_conf1__LRRevH fq fg c \\<equiv>\n  \\<lparr>epdaH_conf_state = fq (epdaH_conf_state c),\n  epdaH_conf_history = epdaH_conf_history c,\n  epdaH_conf_stack = map fg (epdaH_conf_stack c)\\<rparr>\"\n\ndefinition F_EPDA_TC__epdaS_conf__LRRevH :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaH_conf\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaH_conf\"\n  where\n    \"F_EPDA_TC__epdaS_conf__LRRevH G c \\<equiv>\n  F_EPDA_TC__epdaS_conf1__LRRevH\n    (inv_into (epda_states G) (SOME f. inj_on f (epda_states G)))\n    (inv_into (epda_gamma G) (SOME f. inj_on f (epda_gamma G)))\n    c\"\n\ntheorem F_EPDA_TC__preserves_epdaH_no_livelocks_from_marking_states: \"\n  valid_dpda G\n  \\<Longrightarrow> epdaH_no_livelocks_from_marking_states G\n  \\<Longrightarrow> epdaH_no_livelocks_from_marking_states (F_EPDA_TC G)\"\n  apply(simp add: epdaH_no_livelocks_from_marking_states_def)\n  apply(clarsimp)\n  apply(rename_tac d n e c)(*strict*)\n  apply(subgoal_tac \"\\<exists>f. inj_on f (epda_states G) \\<and> f = (SOME f::'a\\<Rightarrow>'d DT_symbol. inj_on f (epda_states G))\")\n   apply(rename_tac d n e c)(*strict*)\n   prefer 2\n   apply(rule exists_SOME_injective_is_injective)\n   apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n  apply(rename_tac d n e c)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac d n e c)(*strict*)\n   prefer 2\n   apply(rule F_EPDA_TC__preserves__valid_pda)\n   apply(simp add: valid_dpda_def)\n   apply(force)\n  apply(rename_tac d n e c)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac d n e c)(*strict*)\n   prefer 2\n   apply(rule_tac\n      fe=\"\\<lambda>G1 G2 e. F_EPDA_TC__edge__RL G2 e\"\n      and fc=\"\\<lambda>G1 G2 c. F_EPDA_TC__epdaS_conf__LRRevH G2 c\"\n      and ?G2.0=\"G\"\n      in epdaH_epdaH_Derivation_Map.der_map_preserves_derivation_initial)\n        apply(rename_tac d n e c)(*strict*)\n        prefer 2\n        apply(force)\n       apply(rename_tac d n e c)(*strict*)\n       apply(simp add: valid_dpda_def valid_pda_def)\n       apply(force)\n      apply(rename_tac d n e c)(*strict*)\n      apply(simp add: valid_dpda_def valid_pda_def)\n     apply(rename_tac d n e c)(*strict*)\n     apply(force)\n    apply(rename_tac d n e c)(*strict*)\n    apply(simp add: epdaH_epdaH_Derivation_Map.der_map_preserves_steps_def)\n    apply(clarsimp)\n    apply(rename_tac d n e c G2 c1 ea c2)(*strict*)\n    apply(simp add: epdaH_step_relation_def)\n    apply(rule conjI)\n     apply(rename_tac d n e c G2 c1 ea c2)(*strict*)\n     prefer 2\n     apply(case_tac c1)\n     apply(rename_tac d n e c G2 c1 ea c2 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n     apply(case_tac c2)\n     apply(rename_tac d n e c G2 c1 ea c2 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa)(*strict*)\n     apply(case_tac ea)\n     apply(rename_tac d n e c G2 c1 ea c2 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac d n e c G2 epdaH_conf_historya edge_srca edge_eventa edge_popa edge_pusha edge_trga w)(*strict*)\n     apply(rename_tac h qs r po pus qt w)\n     apply(rename_tac d n e c G2 h qs r po pus qt w)(*strict*)\n     apply(simp add: F_EPDA_TC__epdaS_conf__LRRevH_def F_EPDA_TC__epdaS_conf1__LRRevH_def F_EPDA_TC__edge__RL_def F_EPDA_TC__edge1__RL_def)\n    apply(rename_tac d n e c G2 c1 ea c2)(*strict*)\n    apply(subgoal_tac \"X\" for X)\n     apply(rename_tac d n e c G2 c1 ea c2)(*strict*)\n     prefer 2\n     apply(rule_tac\n      e=\"ea\"\n      and G=\"G2\"\n      in F_EPDA_TC__edge__RL__preserves__epda_delta)\n      apply(rename_tac d n e c G2 c1 ea c2)(*strict*)\n      apply(simp add: valid_dpda_def valid_pda_def)\n     apply(rename_tac d n e c G2 c1 ea c2)(*strict*)\n     apply(force)\n    apply(rename_tac d n e c G2 c1 ea c2)(*strict*)\n    apply(force)\n   apply(rename_tac d n e c)(*strict*)\n   apply(simp add: epdaH_epdaH_Derivation_Map.der_map_preserves_configurations_initial_def)\n   apply(clarsimp)\n   apply(rename_tac d n e c G2 ca)(*strict*)\n   apply(subgoal_tac \"\\<exists>f. inj_on f (epda_gamma G2) \\<and> f = (SOME f::'c\\<Rightarrow>'e DT_symbol. inj_on f (epda_gamma G2))\")\n    apply(rename_tac d n e c G2 ca)(*strict*)\n    prefer 2\n    apply(rule exists_SOME_injective_is_injective)\n    apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n   apply(rename_tac d n e c G2 ca)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>f. inj_on f (epda_states G2) \\<and> f = (SOME f::'a\\<Rightarrow>'d DT_symbol. inj_on f (epda_states G2))\")\n    apply(rename_tac d n e c G2 ca)(*strict*)\n    prefer 2\n    apply(rule exists_SOME_injective_is_injective)\n    apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n   apply(rename_tac d n e c G2 ca)(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LRRevH_def F_EPDA_TC__epdaS_conf1__LRRevH_def F_EPDA_TC__edge__RL_def F_EPDA_TC__edge1__RL_def epdaH_initial_configurations_def epdaH_configurations_def F_EPDA_TC_def F_EPDA_TC__epda_def)\n   apply(rule_tac\n      t=\"inv_into (epda_gamma G2) (SOME f. inj_on f (epda_gamma G2)) ((SOME f. inj_on f (epda_gamma G2)) (epda_box G2))\"\n      and s=\"epda_box G2\"\n      in ssubst)\n    apply(rename_tac d n e c G2 ca)(*strict*)\n    apply(rule Hilbert_Choice.inv_into_f_f)\n     apply(rename_tac d n e c G2 ca)(*strict*)\n     apply(force)\n    apply(rename_tac d n e c G2 ca)(*strict*)\n    apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n   apply(rename_tac d n e c G2 ca)(*strict*)\n   apply(rule_tac\n      t=\"inv_into (epda_states G2) (SOME f. inj_on f (epda_states G2)) ((SOME f. inj_on f (epda_states G2)) (epda_initial G2))\"\n      in ssubst)\n    apply(rename_tac d n e c G2 ca)(*strict*)\n    apply(rule Hilbert_Choice.inv_into_f_f)\n     apply(rename_tac d n e c G2 ca)(*strict*)\n     apply(force)\n    apply(rename_tac d n e c G2 ca)(*strict*)\n    apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n   apply(rename_tac d n e c G2 ca)(*strict*)\n   apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n  apply(rename_tac d n e c)(*strict*)\n  apply(erule_tac\n      x=\"epdaH_epdaH_Derivation_Map.der_map (F_EPDA_TC G) G (\\<lambda>G1. F_EPDA_TC__edge__RL) (\\<lambda>G1. F_EPDA_TC__epdaS_conf__LRRevH) d\"\n      in allE)\n  apply(rename_tac d n e c)(*strict*)\n  apply(erule_tac\n      x=\"n\"\n      in allE)\n  apply(erule impE)\n   apply(rename_tac d n e c)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d n e c)(*strict*)\n    apply(force)\n   apply(rename_tac d n e c)(*strict*)\n   apply(simp add: epdaH_epdaH_Derivation_Map.der_map_def)\n   apply(simp add: F_EPDA_TC__edge__RL_def F_EPDA_TC__edge1__RL_def)\n   apply(simp add: F_EPDA_TC_def F_EPDA_TC__epda_def)\n   apply(clarsimp)\n   apply(rename_tac d n e c x)(*strict*)\n   apply(rule_tac\n      t=\"inv_into (epda_states G) (SOME f. inj_on f (epda_states G)) ((SOME f. inj_on f (epda_states G)) x)\"\n      and s=\"x\"\n      in ssubst)\n    apply(rename_tac d n e c x)(*strict*)\n    apply(rule Hilbert_Choice.inv_into_f_f)\n     apply(rename_tac d n e c x)(*strict*)\n     apply(force)\n    apply(rename_tac d n e c x)(*strict*)\n    apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n    apply(force)\n   apply(rename_tac d n e c x)(*strict*)\n   apply(force)\n  apply(rename_tac d n e c)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d n e c m)(*strict*)\n  apply(erule disjE)\n   apply(rename_tac d n e c m)(*strict*)\n   apply(rule_tac\n      x=\"m\"\n      in exI)\n   apply(rule conjI)\n    apply(rename_tac d n e c m)(*strict*)\n    apply(force)\n   apply(rename_tac d n e c m)(*strict*)\n   apply(rule disjI1)\n   apply(simp add: epdaH_epdaH_Derivation_Map.der_map_def)\n   apply(case_tac \"d m\")\n    apply(rename_tac d n e c m)(*strict*)\n    apply(clarsimp)\n   apply(rename_tac d n e c m a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac d n e c m a option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d n e c m)(*strict*)\n  apply(rule_tac\n      x=\"m\"\n      in exI)\n  apply(rule conjI)\n   apply(rename_tac d n e c m)(*strict*)\n   apply(force)\n  apply(rename_tac d n e c m)(*strict*)\n  apply(rule disjI2)\n  apply(simp add: epdaH_epdaH_Derivation_Map.der_map_def)\n  apply(clarsimp)\n  apply(rename_tac d n e c m e' c' y)(*strict*)\n  apply(case_tac \"d m\")\n   apply(rename_tac d n e c m e' c' y)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d n e c m e' c' y a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac d n e c m e' c' y a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d n e c m e' y option b)(*strict*)\n  apply(case_tac option)\n   apply(rename_tac d n e c m e' y option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d n e c m e' y option b a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d n e c m y b a)(*strict*)\n  apply(simp add: F_EPDA_TC__edge__RL_def F_EPDA_TC__edge1__RL_def)\n  done\n\ntheorem F_EPDA_TC__preserves_no_livelock: \"\n  valid_pda G\n  \\<Longrightarrow> \\<not> epdaH_livelock G\n  \\<Longrightarrow> \\<not> epdaH_livelock (F_EPDA_TC G)\"\n  apply(simp add: epdaH_livelock_def)\n  apply(clarsimp)\n  apply(rename_tac d N)(*strict*)\n  apply(subgoal_tac \"\\<exists>f. inj_on f (epda_states G) \\<and> f = (SOME f::'a\\<Rightarrow>'d DT_symbol. inj_on f (epda_states G))\")\n   apply(rename_tac d N)(*strict*)\n   prefer 2\n   apply(rule exists_SOME_injective_is_injective)\n   apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n  apply(rename_tac d N)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac d N)(*strict*)\n   prefer 2\n   apply(rule F_EPDA_TC__preserves__valid_pda)\n   apply(simp add: valid_dpda_def)\n  apply(rename_tac d N)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac d N)(*strict*)\n   prefer 2\n   apply(rule_tac\n      fe=\"\\<lambda>G1 G2 e. F_EPDA_TC__edge__RL G2 e\"\n      and fc=\"\\<lambda>G1 G2 c. F_EPDA_TC__epdaS_conf__LRRevH G2 c\"\n      and ?G2.0=\"G\"\n      in epdaH_epdaH_Derivation_Map.der_map_preserves_derivation_initial)\n        apply(rename_tac d N)(*strict*)\n        prefer 2\n        apply(force)\n       apply(rename_tac d N)(*strict*)\n       apply(simp add: valid_dpda_def valid_pda_def)\n       apply(rename_tac d)(*strict*)\n       apply(force)\n      apply(rename_tac d N)(*strict*)\n      apply(simp add: valid_dpda_def valid_pda_def)\n     apply(rename_tac d N)(*strict*)\n     apply(force)\n    apply(rename_tac d N)(*strict*)\n    apply(simp add: epdaH_epdaH_Derivation_Map.der_map_preserves_steps_def)\n    apply(rename_tac d)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac d G2 c1 e c2)(*strict*)\n    apply(simp add: epdaH_step_relation_def)\n    apply(rule conjI)\n     apply(rename_tac d G2 c1 e c2)(*strict*)\n     prefer 2\n     apply(case_tac c1)\n     apply(rename_tac d G2 c1 e c2 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka)(*strict*)\n     apply(case_tac c2)\n     apply(rename_tac d G2 c1 e c2 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa)(*strict*)\n     apply(case_tac e)\n     apply(rename_tac d G2 c1 e c2 epdaH_conf_statea epdaH_conf_historya epdaH_conf_stacka epdaH_conf_stateaa epdaH_conf_historyaa epdaH_conf_stackaa edge_srca edge_eventa edge_popa edge_pusha edge_trga)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac d G2 epdaH_conf_historya edge_srca edge_eventa edge_popa edge_pusha edge_trga w)(*strict*)\n     apply(rename_tac h qs r po pus qt w)\n     apply(rename_tac d G2 h qs r po pus qt w)(*strict*)\n     apply(simp add: F_EPDA_TC__epdaS_conf__LRRevH_def F_EPDA_TC__epdaS_conf1__LRRevH_def F_EPDA_TC__edge__RL_def F_EPDA_TC__edge1__RL_def)\n    apply(rename_tac d G2 c1 e c2)(*strict*)\n    apply(subgoal_tac \"X\" for X)\n     apply(rename_tac d G2 c1 e c2)(*strict*)\n     prefer 2\n     apply(rule_tac\n      e=\"e\"\n      and G=\"G2\"\n      in F_EPDA_TC__edge__RL__preserves__epda_delta)\n      apply(rename_tac d G2 c1 e c2)(*strict*)\n      apply(simp add: valid_dpda_def valid_pda_def)\n     apply(rename_tac d G2 c1 e c2)(*strict*)\n     apply(force)\n    apply(rename_tac d G2 c1 e c2)(*strict*)\n    apply(force)\n   apply(rename_tac d N)(*strict*)\n   apply(simp add: epdaH_epdaH_Derivation_Map.der_map_preserves_configurations_initial_def)\n   apply(rename_tac d)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d G2 c)(*strict*)\n   apply(subgoal_tac \"\\<exists>f. inj_on f (epda_gamma G2) \\<and> f = (SOME f::'c\\<Rightarrow>'e DT_symbol. inj_on f (epda_gamma G2))\")\n    apply(rename_tac d G2 c)(*strict*)\n    prefer 2\n    apply(rule exists_SOME_injective_is_injective)\n    apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n   apply(rename_tac d G2 c)(*strict*)\n   apply(clarsimp)\n   apply(subgoal_tac \"\\<exists>f. inj_on f (epda_states G2) \\<and> f = (SOME f::'a\\<Rightarrow>'d DT_symbol. inj_on f (epda_states G2))\")\n    apply(rename_tac d G2 c)(*strict*)\n    prefer 2\n    apply(rule exists_SOME_injective_is_injective)\n    apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n   apply(rename_tac d G2 c)(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_EPDA_TC__epdaS_conf__LRRevH_def F_EPDA_TC__epdaS_conf1__LRRevH_def F_EPDA_TC__edge__RL_def F_EPDA_TC__edge1__RL_def epdaH_initial_configurations_def epdaH_configurations_def F_EPDA_TC_def F_EPDA_TC__epda_def)\n   apply(rule_tac\n      t=\"inv_into (epda_gamma G2) (SOME f. inj_on f (epda_gamma G2)) ((SOME f. inj_on f (epda_gamma G2)) (epda_box G2))\"\n      and s=\"epda_box G2\"\n      in ssubst)\n    apply(rename_tac d G2 c)(*strict*)\n    apply(rule Hilbert_Choice.inv_into_f_f)\n     apply(rename_tac d G2 c)(*strict*)\n     apply(force)\n    apply(rename_tac d G2 c)(*strict*)\n    apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n   apply(rename_tac d G2 c)(*strict*)\n   apply(rule_tac\n      t=\"inv_into (epda_states G2) (SOME f. inj_on f (epda_states G2)) ((SOME f. inj_on f (epda_states G2)) (epda_initial G2))\"\n      in ssubst)\n    apply(rename_tac d G2 c)(*strict*)\n    apply(rule Hilbert_Choice.inv_into_f_f)\n     apply(rename_tac d G2 c)(*strict*)\n     apply(force)\n    apply(rename_tac d G2 c)(*strict*)\n    apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n   apply(rename_tac d G2 c)(*strict*)\n   apply(simp add: valid_dpda_def valid_pda_def valid_epda_def)\n  apply(rename_tac d N)(*strict*)\n  apply(erule_tac\n      x=\"epdaH_epdaH_Derivation_Map.der_map (F_EPDA_TC G) G (\\<lambda>G1. F_EPDA_TC__edge__RL) (\\<lambda>G1. F_EPDA_TC__epdaS_conf__LRRevH) d\"\n      in allE)\n  apply(rename_tac d N)(*strict*)\n  apply(clarsimp)\n  apply(erule disjE)\n   apply(rename_tac d N)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d N n)(*strict*)\n   apply(simp add: epdaH_epdaH_Derivation_Map.der_map_def)\n   apply(case_tac \"d n\")\n    apply(rename_tac d N n)(*strict*)\n    apply(clarsimp)\n    apply(erule_tac\n      x=\"n\"\n      in allE)\n    apply(force)\n   apply(rename_tac d N n a)(*strict*)\n   apply(clarsimp)\n   apply(case_tac a)\n   apply(rename_tac d N n a option b)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d N)(*strict*)\n  apply(erule_tac\n      x=\"N\"\n      and P=\"\\<lambda>N. \\<exists>n\\<ge>N. epdaH_conf_history (the (get_configuration (epdaH_epdaH_Derivation_Map.der_map (F_EPDA_TC G) G (\\<lambda>G1. F_EPDA_TC__edge__RL) (\\<lambda>G1. F_EPDA_TC__epdaS_conf__LRRevH) d n))) \\<noteq> epdaH_conf_history (the (get_configuration (epdaH_epdaH_Derivation_Map.der_map (F_EPDA_TC G) G (\\<lambda>G1. F_EPDA_TC__edge__RL) (\\<lambda>G1. F_EPDA_TC__epdaS_conf__LRRevH) d N)))\"\n      in allE)\n  apply(rename_tac d N)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d N n)(*strict*)\n  apply(rule_tac\n      x=\"n\"\n      in exI)\n  apply(clarsimp)\n  apply(simp add: epdaH_epdaH_Derivation_Map.der_map_def get_configuration_def)\n  apply(erule_tac x=\"n\" in allE')\n  apply(erule_tac\n      x=\"N\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac d N n y ya)(*strict*)\n  apply(case_tac y)\n  apply(rename_tac d N n y ya option b)(*strict*)\n  apply(case_tac ya)\n  apply(rename_tac d N n y ya option b optiona ba)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d N n option b optiona ba)(*strict*)\n  apply(simp add: F_EPDA_TC__epdaS_conf__LRRevH_def F_EPDA_TC__epdaS_conf1__LRRevH_def)\n  done\n\ndefinition F_EPDA_TC__isom_relation_step_label__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epda_step_label\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda_step_label\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__isom_relation_step_label__LR G1 G2 p1 p2 \\<equiv>\n  p1 \\<in> epda_delta G1\n  \\<and> p2 \\<in> epda_delta G2\n  \\<and> F_EPDA_TC__edge__LR G1 p1 = p2\"\n\ndefinition F_EPDA_TC__isom_relation_conf__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__isom_relation_conf__LR G1 G2 c1 c2 \\<equiv>\n  c1 \\<in> epdaS_configurations G1\n  \\<and> c2 \\<in> epdaS_configurations G2\n  \\<and> c2 = F_EPDA_TC__epdaS_conf__LR G1 c1\"\n\ndefinition F_EPDA_TC__isom_relation_initial_conf__LR :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epda\n  \\<Rightarrow> ('stateA, 'event, 'stackA) epdaS_conf\n  \\<Rightarrow> ('stateB DT_symbol, 'event, 'stackB DT_symbol) epdaS_conf\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__isom_relation_initial_conf__LR G1 G2 c1 c2 \\<equiv>\n  c1 \\<in> epdaS_initial_configurations G1\n  \\<and> c2 \\<in> epdaS_initial_configurations G2\n  \\<and> c2 = F_EPDA_TC__epdaS_conf__LR G1 c1\"\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_TSstructure_closed1: \"\n  (\\<forall>G1. Ex (F_EPDA_TC__relation_epda__LR G1) \\<longrightarrow> valid_epda G1)\"\n  apply(clarsimp)\n  apply(rename_tac G1 x)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1)(*strict*)\n  apply(simp add: valid_pda_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_TSstructure_closed2: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> valid_epda G2)\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1)(*strict*)\n  apply(simp add: valid_pda_def)\n  apply (metis F_EPDA_TC__preserves__valid_pda valid_pda_def One_nat_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_closed1: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1. Ex (F_EPDA_TC__isom_relation_conf__LR G1 G2 c1) \\<longrightarrow> c1 \\<in> epdaS_configurations G1))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 x)(*strict*)\n  apply(simp add: F_EPDA_TC__isom_relation_conf__LR_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_closed2: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__isom_relation_conf__LR G1 G2 c1 c2 \\<longrightarrow> c2 \\<in> epdaS_configurations G2))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2)(*strict*)\n  apply(simp add: F_EPDA_TC__isom_relation_conf__LR_def)\n  apply(clarsimp)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_for_initial_closed1: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__isom_relation_conf__LR G1 G2 c1 c2 \\<longrightarrow> c1 \\<in> epdaS_initial_configurations G1 \\<longrightarrow> c2 \\<in> epdaS_initial_configurations G2))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2)(*strict*)\n  apply(simp add: F_EPDA_TC__isom_relation_conf__LR_def F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 c1)(*strict*)\n  apply(metis F_EPDA_TC__preserves__epdaS_initial_configurations F_EPDA_TC__relation_epda__LR_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_for_initial_closed2: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__isom_relation_conf__LR G1 G2 c1 c2 \\<longrightarrow> c2 \\<in> epdaS_initial_configurations G2 \\<longrightarrow> c1 \\<in> epdaS_initial_configurations G1))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2)(*strict*)\n  apply(simp add: F_EPDA_TC__isom_relation_conf__LR_def F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 c1)(*strict*)\n  apply (metis (poly_guards_query) F_EPDA_TC__epdaS_conf__LR_reverse2 F_EPDA_TC__C_rev_preserves_initial_configurations F_EPDA_TC__relation_epda__RL_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_label_closed1: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>e1. Ex (F_EPDA_TC__isom_relation_step_label__LR G1 G2 e1) \\<longrightarrow> e1 \\<in> epda_step_labels G1))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 e1 x)(*strict*)\n  apply(simp add: F_EPDA_TC__isom_relation_step_label__LR_def epda_step_labels_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_label_closed2: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>e1 e2. F_EPDA_TC__isom_relation_step_label__LR G1 G2 e1 e2 \\<longrightarrow> e2 \\<in> epda_step_labels G2))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 e1 e2)(*strict*)\n  apply(simp add: F_EPDA_TC__isom_relation_step_label__LR_def epda_step_labels_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_bijection_on: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> bijection_on (F_EPDA_TC__isom_relation_conf__LR G1 G2) (epdaS_configurations G1) (epdaS_configurations G2))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(rule bijection_on_intro)\n     apply(rename_tac G1 G2)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac G1 G2 a)(*strict*)\n     apply(simp add: F_EPDA_TC__isom_relation_conf__LR_def F_EPDA_TC__relation_epda__LR_def)\n     apply(clarsimp)\n     apply(rename_tac G1 a)(*strict*)\n     apply (metis (mono_tags, hide_lams) F_EPDA_TC__preserves__epdaS_configurations F_EPDA_TC__relation_epda__LR_def)\n    apply(rename_tac G1 G2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 b)(*strict*)\n    apply(simp add: F_EPDA_TC__relation_epda__LR_def F_EPDA_TC__isom_relation_conf__LR_def)\n    apply(clarsimp)\n    apply(rename_tac G1 b)(*strict*)\n    apply(rule_tac\n      x=\"F_EPDA_TC__epdaS_conf__LRRev G1 b\"\n      in bexI)\n     apply(rename_tac G1 b)(*strict*)\n     apply (metis F_EPDA_TC__epdaS_conf__LR_reverse)\n    apply(rename_tac G1 b)(*strict*)\n    apply (metis F_EPDA_TC__C_rev_preserves_configurations F_EPDA_TC__relation_epda__RL_def)\n   apply(rename_tac G1 G2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 a b1 b2)(*strict*)\n   apply(simp add: F_EPDA_TC__isom_relation_conf__LR_def)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 b a1 a2)(*strict*)\n  apply(simp add: F_EPDA_TC__isom_relation_conf__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 a1 a2)(*strict*)\n  apply (metis F_EPDA_TC__epdaS_conf__LR_reverse2 F_EPDA_TC__relation_epda__LR_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_label_bijection_on: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> bijection_on (F_EPDA_TC__isom_relation_step_label__LR G1 G2) (epda_step_labels G1) (epda_step_labels G2))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(rule bijection_on_intro)\n     apply(rename_tac G1 G2)(*strict*)\n     apply(clarsimp)\n     apply(rename_tac G1 G2 a)(*strict*)\n     apply(simp add: F_EPDA_TC__isom_relation_step_label__LR_def F_EPDA_TC__relation_epda__LR_def epda_step_labels_def F_EPDA_TC_def F_EPDA_TC__epda_def F_EPDA_TC__edge__LR_def)\n    apply(rename_tac G1 G2)(*strict*)\n    apply(clarsimp)\n    apply(rename_tac G1 G2 b)(*strict*)\n    apply(simp add: F_EPDA_TC__isom_relation_step_label__LR_def F_EPDA_TC__relation_epda__LR_def epda_step_labels_def)\n    apply(clarsimp)\n    apply(rename_tac G1 b)(*strict*)\n    apply(rule_tac\n      x=\"F_EPDA_TC__edge__RL G1 b\"\n      in bexI)\n     apply(rename_tac G1 b)(*strict*)\n     prefer 2\n     apply (metis F_EPDA_TC__edge__RL__preserves__epda_delta valid_pda_def)\n    apply(rename_tac G1 b)(*strict*)\n    apply(simp add: F_EPDA_TC_def F_EPDA_TC__epda_def)\n    apply(clarsimp)\n    apply(rename_tac G1 x)(*strict*)\n    apply(rule_tac\n      t=\"F_EPDA_TC__edge__RL G1 (F_EPDA_TC__edge (SOME f. inj_on f (epda_states G1)) (SOME f. inj_on f (epda_gamma G1)) x)\"\n      and s=\"x\"\n      in ssubst)\n     apply(rename_tac G1 x)(*strict*)\n     apply(rule F_EPDA_TC__edge_reversal)\n      apply(rename_tac G1 x)(*strict*)\n      apply(simp add: valid_pda_def)\n     apply(rename_tac G1 x)(*strict*)\n     apply(force)\n    apply(rename_tac G1 x)(*strict*)\n    apply(simp add: F_EPDA_TC__edge__LR_def)\n   apply(rename_tac G1 G2)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 G2 a b1 b2)(*strict*)\n   apply(simp add: F_EPDA_TC__isom_relation_step_label__LR_def)\n  apply(rename_tac G1 G2)(*strict*)\n  apply(simp add: F_EPDA_TC__isom_relation_step_label__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 a1 a2)(*strict*)\n  apply (metis F_EPDA_TC__edge__LR_def F_EPDA_TC__edge_reversal epdaS_epdaS_F_EPDA_TC__StateSimLR_inst_AX_TSstructure_relation_TSstructure1_belongs)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_marking_configuration1_equivalent: \"\n  (\\<forall>G1. valid_epda G1 \\<longrightarrow> (\\<forall>d1. epdaS.derivation_initial G1 d1 \\<longrightarrow> epdaS_marking_condition G1 d1 = (\\<exists>i c1. get_configuration (d1 i) = Some c1 \\<and> c1 \\<in> epdaS_marking_configurations G1)))\"\n  apply(clarsimp)\n  apply(rename_tac G1 d1)(*strict*)\n  apply(simp add: epdaS_marking_condition_def)\n  apply(rule antisym)\n   apply(rename_tac G1 d1)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac G1 d1 i e c)(*strict*)\n   apply(rule_tac\n      x=\"i\"\n      in exI)\n   apply(clarsimp)\n   apply(simp add: get_configuration_def)\n  apply(rename_tac G1 d1)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac G1 d1 i c1)(*strict*)\n  apply(rule_tac\n      x=\"i\"\n      in exI)\n  apply(simp add: get_configuration_def)\n  apply(case_tac \"d1 i\")\n   apply(rename_tac G1 d1 i c1)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac G1 d1 i c1 a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac G1 d1 i c1 a option conf)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_preserves_marking_configuration: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__isom_relation_conf__LR G1 G2 c1 c2 \\<longrightarrow> (c1 \\<in> epdaS_marking_configurations G1) = (c2 \\<in> epdaS_marking_configurations G2)))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2)(*strict*)\n  apply(rule antisym)\n   apply(rename_tac G1 G2 c1 c2)(*strict*)\n   apply(clarsimp)\n   apply(simp add: F_EPDA_TC__isom_relation_conf__LR_def)\n   apply (metis F_EPDA_TC__preserves__epdaS_marking_configurations)\n  apply(rename_tac G1 G2 c1 c2)(*strict*)\n  apply(clarsimp)\n  apply(simp add: F_EPDA_TC__isom_relation_conf__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1)(*strict*)\n  apply (metis F_EPDA_TC__epdaS_conf__LR_reverse2 F_EPDA_TC__C_rev_preserves_marking_configurations F_EPDA_TC__relation_epda__LR_def F_EPDA_TC__relation_epda__RL_def)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_step_preservation1: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__isom_relation_conf__LR G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e1 c1'. epdaS_step_relation G1 c1 e1 c1' \\<longrightarrow> (\\<forall>e2. F_EPDA_TC__isom_relation_step_label__LR G1 G2 e1 e2 \\<longrightarrow> (\\<forall>c2'. F_EPDA_TC__isom_relation_conf__LR G1 G2 c1' c2' \\<longrightarrow> epdaS_step_relation G2 c2 e2 c2')))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e1 c1' e2 c2')(*strict*)\n  apply(simp add: F_EPDA_TC__isom_relation_step_label__LR_def F_EPDA_TC__isom_relation_conf__LR_def F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(rule F_EPDA_TC__preserves__simulation_step)\n  apply(force)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_step_preservation2: \"\n  (\\<forall>G1 G2. F_EPDA_TC__relation_epda__LR G1 G2 \\<longrightarrow> (\\<forall>c1 c2. F_EPDA_TC__isom_relation_conf__LR G1 G2 c1 c2 \\<longrightarrow> (\\<forall>e2 c2'. epdaS_step_relation G2 c2 e2 c2' \\<longrightarrow> (\\<forall>e1. F_EPDA_TC__isom_relation_step_label__LR G1 G2 e1 e2 \\<longrightarrow> (\\<forall>c1'. F_EPDA_TC__isom_relation_conf__LR G1 G2 c1' c2' \\<longrightarrow> epdaS_step_relation G1 c1 e1 c1')))))\"\n  apply(clarsimp)\n  apply(rename_tac G1 G2 c1 c2 e2 c2' e1 c1')(*strict*)\n  apply(simp add: F_EPDA_TC__isom_relation_step_label__LR_def F_EPDA_TC__isom_relation_conf__LR_def F_EPDA_TC__relation_epda__LR_def)\n  apply(clarsimp)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   prefer 2\n   apply(rule F_EPDA_TCRev_preserves_step_relation)\n    apply(rename_tac G1 c1 e1 c1')(*strict*)\n    apply(simp add: F_EPDA_TC__relation_epda__RL_def)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(rule_tac\n      t=\"c1\"\n      and s=\"(F_EPDA_TC__epdaS_conf__LRRev G1 (F_EPDA_TC__epdaS_conf__LR G1 c1))\"\n      in ssubst)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   apply (rule F_EPDA_TC__epdaS_conf__LR_reverse2)\n    apply(force)\n   apply(force)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(rule_tac\n      t=\"c1'\"\n      and s=\"(F_EPDA_TC__epdaS_conf__LRRev G1 (F_EPDA_TC__epdaS_conf__LR G1 c1'))\"\n      in ssubst)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   apply (rule F_EPDA_TC__epdaS_conf__LR_reverse2)  \n    apply(force)\n   apply(force)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(rule_tac\n      t=\"e1\"\n      and s=\"(F_EPDA_TC__edge__RL G1 (F_EPDA_TC__edge__LR G1 e1))\"\n      in ssubst)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   apply(simp add: F_EPDA_TC__edge1__RL_def F_EPDA_TC__isom_relation_step_label__LR_def F_EPDA_TC__relation_epda__LR_def epda_step_labels_def F_EPDA_TC_def F_EPDA_TC__epda_def F_EPDA_TC__edge__LR_def)\n   apply(rule sym)\n   apply(rule F_EPDA_TC__edge_reversal)\n    apply(rename_tac G1 c1 e1 c1')(*strict*)\n    apply(simp add: valid_pda_def)\n   apply(rename_tac G1 c1 e1 c1')(*strict*)\n   apply(force)\n  apply(rename_tac G1 c1 e1 c1')(*strict*)\n  apply(force)\n  done\n\nlemma epdaS_epdaS_F_EPDA_TC__ISOM_inst_ATS_Isomorphism_axioms: \"\n  ATS_Isomorphism_axioms valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marking_condition valid_epda epdaS_configurations epdaS_initial_configurations epda_step_labels epdaS_step_relation epdaS_marking_condition (\\<lambda>G c. c \\<in> epdaS_marking_configurations G) (\\<lambda>G c. c \\<in> epdaS_marking_configurations G) F_EPDA_TC__relation_epda__LR F_EPDA_TC__isom_relation_conf__LR F_EPDA_TC__isom_relation_step_label__LR\"\n  apply(simp add: ATS_Isomorphism_axioms_def)\n  apply(simp add: epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_TSstructure_closed1 epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_TSstructure_closed2 epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_closed1 epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_closed2 epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_for_initial_closed1 epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_for_initial_closed2 epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_label_closed1 epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_label_closed2 epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_bijection_on epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_label_bijection_on epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_marking_configuration1_equivalent epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_relation_configuration_preserves_marking_configuration epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_step_preservation1 epdaS_epdaS_F_EPDA_TC__ISOM_inst_AX_step_preservation2 )\n  done\n\ninterpretation \"epdaS_epdaS_F_EPDA_TC__ISOM\" : ATS_Isomorphism\n  (* TSstructure1 *)\n  \"valid_epda\"\n  (* configurations1 *)\n  \"epdaS_configurations\"\n  (* initial_configurations1 *)\n  \"epdaS_initial_configurations\"\n  (* step_labels1 *)\n  \"epda_step_labels\"\n  (* step_relation1 *)\n  \"epdaS_step_relation\"\n  (* effects1 *)\n  \"epda_effects\"\n  (* marking_condition1 *)\n  \"epdaS_marking_condition\"\n  (* marked_effect1 *)\n  \"epdaS_marked_effect\"\n  (* unmarked_effect1 *)\n  \"epdaS_unmarked_effect\"\n  (* TSstructure2 *)\n  \"valid_epda\"\n  (* configurations2 *)\n  \"epdaS_configurations\"\n  (* initial_configurations2 *)\n  \"epdaS_initial_configurations\"\n  (* step_labels2 *)\n  \"epda_step_labels\"\n  (* step_relation2 *)\n  \"epdaS_step_relation\"\n  (* effects2 *)\n  \"epda_effects\"\n  (* marking_condition2 *)\n  \"epdaS_marking_condition\"\n  (* marked_effect2 *)\n  \"epdaS_marked_effect\"\n  (* unmarked_effect2 *)\n  \"epdaS_unmarked_effect\"\n  (* marking_configuration1 *)\n  \"(\\<lambda>G c. c \\<in> epdaS_marking_configurations G)\"\n  (* marking_configuration2 *)\n  \"(\\<lambda>G c. c \\<in> epdaS_marking_configurations G)\"\n  (* relation_TSstructure *)\n  \"F_EPDA_TC__relation_epda__LR\"\n  (* relation_configuration *)\n  \"F_EPDA_TC__isom_relation_conf__LR\"\n  (* relation_label *)\n  \"F_EPDA_TC__isom_relation_step_label__LR\"\n  apply(simp add: LOCALE_DEFS epda_interpretations)\n  apply(simp add: epdaS_epdaS_F_EPDA_TC__ISOM_inst_ATS_Isomorphism_axioms)\n  done\n\ntheorem F_EPDA_TC__preserves_DPDA: \"\n  valid_dpda G\n  \\<Longrightarrow> valid_dpda (F_EPDA_TC G)\"\n  apply(simp add: valid_dpda_def)\n  apply(clarsimp)\n  apply(rule conjI)\n   apply(rule F_EPDA_TC__preserves__valid_pda)\n   apply(force)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac\n      ?G1.0=\"G\"\n      and ?G2.0=\"F_EPDA_TC G\"\n      in epdaS_epdaS_F_EPDA_TC__ISOM.is_forward_edge_deterministic_accessible_preservation)\n    apply(simp add: F_EPDA_TC__relation_epda__LR_def)\n   apply(force)\n  apply(force)\n  done\n\ndefinition F_EPDA_TC__SpecInput :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__SpecInput G \\<equiv>\n  valid_dpda G\"\n\ndefinition F_EPDA_TC__SpecOutput :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__SpecOutput Gi Go \\<equiv>\n  valid_dpda Go\n  \\<and> (\\<not> epdaH_livelock Gi \\<longrightarrow> \\<not> epdaH_livelock Go)\n  \\<and> epdaS.unmarked_language Gi = epdaS.unmarked_language Go\n  \\<and> epdaS.marked_language Gi = epdaS.marked_language Go\n  \\<and> (epdaH_no_livelocks_from_marking_states Gi \\<longrightarrow> epdaH_no_livelocks_from_marking_states Go)\n  \\<and> (epdaS.accessible Gi \\<longrightarrow> epdaS.accessible Go)\"\n\ntheorem F_EPDA_TC__SOUND: \"\n  F_EPDA_TC__SpecInput G\n  \\<Longrightarrow> F_EPDA_TC__SpecOutput G (F_EPDA_TC G)\"\n  apply(simp add: F_EPDA_TC__SpecOutput_def F_EPDA_TC__SpecInput_def)\n  apply(rule conjI)\n   apply(simp add:\n      F_EPDA_TC__preserves_DPDA)\n  apply(rule conjI)\n   apply(rule impI)\n   apply(rule F_EPDA_TC__preserves_no_livelock)\n    apply(simp add: valid_dpda_def)\n   apply(force)\n  apply(rule conjI)\n   apply(rule F_EPDA_TC__preserves_unmarked_language)\n   apply(simp add: valid_dpda_def)\n  apply(rule conjI)\n   apply(rule F_EPDA_TC__preserves_lang)\n   apply(simp add: valid_dpda_def)\n  apply(rule conjI)\n   apply(simp add: F_EPDA_TC__preserves_epdaH_no_livelocks_from_marking_states)\n  apply(rule impI)\n  apply(rule\n      F_EPDA_TC__preserves_coblockbreeness)\n   apply(force)\n  apply(force)\n  done\n\ndefinition F_EPDA_TC__SpecInput2 :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__SpecInput2 G \\<equiv>\n  valid_dpda G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epdaS.accessible G\n  \\<and> epdaH_no_livelocks_from_marking_states G\"\n\ndefinition F_EPDA_TC__SpecOutput2 :: \"\n  ('stateA, 'event, 'stackA) epda\n  \\<Rightarrow> ('stateB, 'event, 'stackB) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_EPDA_TC__SpecOutput2 Gi Go \\<equiv>\n  valid_dpda Go\n  \\<and> epdaS.marked_language Gi = epdaS.marked_language Go\n  \\<and> nonblockingness_language (epdaS.unmarked_language Go) (epdaS.marked_language Go)\n  \\<and> epdaS.accessible Go\n  \\<and> epdaH_no_livelocks_from_marking_states Go\"\n\ntheorem F_EPDA_TC__SOUND2: \"\n  F_EPDA_TC__SpecInput2 G\n  \\<Longrightarrow> F_EPDA_TC__SpecOutput2 G (F_EPDA_TC G)\"\n  apply(simp add: F_EPDA_TC__SpecInput2_def F_EPDA_TC__SpecOutput2_def)\n  apply(clarsimp)\n  apply(rule context_conjI)\n   apply(rule F_EPDA_TC__preserves_DPDA)\n   apply(force)\n  apply(rule context_conjI)\n   apply(rule F_EPDA_TC__preserves_lang)\n   apply(simp add: valid_dpda_def)\n  apply(rule context_conjI)\n   apply(rule_tac\n      t=\"epdaS.unmarked_language (F_EPDA_TC G)\"\n      and s=\"epdaS.unmarked_language G\"\n      in subst)\n    apply(rule F_EPDA_TC__preserves_unmarked_language)\n    apply(simp add: valid_dpda_def)\n   apply(force)\n  apply(rule conjI)\n   apply(rule F_EPDA_TC__preserves_coblockbreeness)\n    apply(force)\n   apply(force)\n  apply(rule F_EPDA_TC__preserves_epdaH_no_livelocks_from_marking_states)\n   apply(force)\n  apply(force)\n  done\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_03_01/FUNCTION__EPDA_TC__EPDA_TYPE_CONVERSION.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804478040616, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3069731619528473}}
{"text": "(*  Title:      Jinja/J/WellType.thy\n\n    Author:     Tobias Nipkow\n    Copyright   2003 Technische Universitaet Muenchen\n*)\n\nsection \\<open>Well-typedness of Jinja expressions\\<close>\n\ntheory WellType\nimports \"../Common/Objects\" Expr\nbegin\n\ntype_synonym\n  env  = \"vname \\<rightharpoonup> ty\"\n\ninductive\n  WT :: \"[J_prog,env, expr     , ty     ] \\<Rightarrow> bool\"\n         (\"_,_ \\<turnstile> _ :: _\"   [51,51,51]50)\n  and WTs :: \"[J_prog,env, expr list, ty list] \\<Rightarrow> bool\"\n         (\"_,_ \\<turnstile> _ [::] _\" [51,51,51]50)\n  for P :: J_prog\nwhere\n  \n  WTNew:\n  \"is_class P C  \\<Longrightarrow>\n  P,E \\<turnstile> new C :: Class C\"\n\n| WTCast:\n  \"\\<lbrakk> P,E \\<turnstile> e :: Class D;  is_class P C;  P \\<turnstile> C \\<preceq>\\<^sup>* D \\<or> P \\<turnstile> D \\<preceq>\\<^sup>* C \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> Cast C e :: Class C\"\n\n| WTVal:\n  \"typeof v = Some T \\<Longrightarrow>\n  P,E \\<turnstile> Val v :: T\"\n\n| WTVar:\n  \"E V = Some T \\<Longrightarrow>\n  P,E \\<turnstile> Var V :: T\"\n(*\nWTBinOp:\n  \"\\<lbrakk> P,E \\<turnstile> e\\<^sub>1 :: T\\<^sub>1;  P,E \\<turnstile> e\\<^sub>2 :: T\\<^sub>2;\n     case bop of Eq \\<Rightarrow> (P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1) \\<and> T = Boolean\n               | Add \\<Rightarrow> T\\<^sub>1 = Integer \\<and> T\\<^sub>2 = Integer \\<and> T = Integer \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2 :: T\"\n*)\n| WTBinOpEq:\n  \"\\<lbrakk> P,E \\<turnstile> e\\<^sub>1 :: T\\<^sub>1;  P,E \\<turnstile> e\\<^sub>2 :: T\\<^sub>2; P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> e\\<^sub>1 \\<guillemotleft>Eq\\<guillemotright> e\\<^sub>2 :: Boolean\"\n\n| WTBinOpAdd:\n  \"\\<lbrakk> P,E \\<turnstile> e\\<^sub>1 :: Integer;  P,E \\<turnstile> e\\<^sub>2 :: Integer \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> e\\<^sub>1 \\<guillemotleft>Add\\<guillemotright> e\\<^sub>2 :: Integer\"\n\n| WTLAss:\n  \"\\<lbrakk> E V = Some T;  P,E \\<turnstile> e :: T';  P \\<turnstile> T' \\<le> T;  V \\<noteq> this \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> V:=e :: Void\"\n\n| WTFAcc:\n  \"\\<lbrakk> P,E \\<turnstile> e :: Class C;  P \\<turnstile> C sees F:T in D \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> e\\<bullet>F{D} :: T\"\n\n| WTFAss:\n  \"\\<lbrakk> P,E \\<turnstile> e\\<^sub>1 :: Class C;  P \\<turnstile> C sees F:T in D;  P,E \\<turnstile> e\\<^sub>2 :: T';  P \\<turnstile> T' \\<le> T \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> e\\<^sub>1\\<bullet>F{D}:=e\\<^sub>2 :: Void\"\n\n| WTCall:\n  \"\\<lbrakk> P,E \\<turnstile> e :: Class C;  P \\<turnstile> C sees M:Ts \\<rightarrow> T = (pns,body) in D;\n     P,E \\<turnstile> es [::] Ts';  P \\<turnstile> Ts' [\\<le>] Ts \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> e\\<bullet>M(es) :: T\"\n\n| WTBlock:\n  \"\\<lbrakk> is_type P T;  P,E(V \\<mapsto> T) \\<turnstile> e :: T' \\<rbrakk>\n  \\<Longrightarrow>  P,E \\<turnstile> {V:T; e} :: T'\"\n\n| WTSeq:\n  \"\\<lbrakk> P,E \\<turnstile> e\\<^sub>1::T\\<^sub>1;  P,E \\<turnstile> e\\<^sub>2::T\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow>  P,E \\<turnstile> e\\<^sub>1;;e\\<^sub>2 :: T\\<^sub>2\"\n| WTCond:\n  \"\\<lbrakk> P,E \\<turnstile> e :: Boolean;  P,E \\<turnstile> e\\<^sub>1::T\\<^sub>1;  P,E \\<turnstile> e\\<^sub>2::T\\<^sub>2;\n     P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1;  P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<longrightarrow> T = T\\<^sub>2;  P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1 \\<longrightarrow> T = T\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n\n| WTWhile:\n  \"\\<lbrakk> P,E \\<turnstile> e :: Boolean;  P,E \\<turnstile> c::T \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> while (e) c :: Void\"\n\n| WTThrow:\n  \"P,E \\<turnstile> e :: Class C  \\<Longrightarrow> \n  P,E \\<turnstile> throw e :: Void\"\n\n| WTTry:\n  \"\\<lbrakk> P,E \\<turnstile> e\\<^sub>1 :: T;  P,E(V \\<mapsto> Class C) \\<turnstile> e\\<^sub>2 :: T; is_class P C \\<rbrakk>\n  \\<Longrightarrow> P,E \\<turnstile> try e\\<^sub>1 catch(C V) e\\<^sub>2 :: T\"\n\n\\<comment> \\<open>well-typed expression lists\\<close>\n\n| WTNil:\n  \"P,E \\<turnstile> [] [::] []\"\n\n| WTCons:\n  \"\\<lbrakk> P,E \\<turnstile> e :: T;  P,E \\<turnstile> es [::] Ts \\<rbrakk>\n  \\<Longrightarrow>  P,E \\<turnstile> e#es [::] T#Ts\"\n\n(*<*)\n(*\nlemmas [intro!] = WTNew WTCast WTVal WTVar WTBinOp WTLAss WTFAcc WTFAss WTCall WTBlock WTSeq\n                  WTWhile WTThrow WTTry WTNil WTCons\nlemmas [intro]  = WTCond1 WTCond2\n*)\ndeclare WT_WTs.intros[intro!] (* WTNil[iff] *)\n\nlemmas WT_WTs_induct = WT_WTs.induct [split_format (complete)]\n  and WT_WTs_inducts = WT_WTs.inducts [split_format (complete)]\n(*>*)\n\n\n\nlemma [iff]: \"(P,E \\<turnstile> e#es [::] T#Ts) = (P,E \\<turnstile> e :: T \\<and> P,E \\<turnstile> es [::] Ts)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTs.cases)\ndone\n(*>*)\n\nlemma [iff]: \"(P,E \\<turnstile> (e#es) [::] Ts) =\n  (\\<exists>U Us. Ts = U#Us \\<and> P,E \\<turnstile> e :: U \\<and> P,E \\<turnstile> es [::] Us)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTs.cases)\ndone\n(*>*)\n\nlemma [iff]: \"\\<And>Ts. (P,E \\<turnstile> es\\<^sub>1 @ es\\<^sub>2 [::] Ts) =\n  (\\<exists>Ts\\<^sub>1 Ts\\<^sub>2. Ts = Ts\\<^sub>1 @ Ts\\<^sub>2 \\<and> P,E \\<turnstile> es\\<^sub>1 [::] Ts\\<^sub>1 \\<and> P,E \\<turnstile> es\\<^sub>2[::]Ts\\<^sub>2)\"\n(*<*)\napply(induct es\\<^sub>1 type:list)\n apply simp\napply clarsimp\napply(erule thin_rl)\napply (rule iffI)\n apply clarsimp\n apply(rule exI)+\n apply(rule conjI)\n  prefer 2 apply blast\n apply simp\napply fastforce\ndone\n(*>*)\n\nlemma [iff]: \"P,E \\<turnstile> Val v :: T = (typeof v = Some T)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WT.cases)\ndone\n(*>*)\n\nlemma [iff]: \"P,E \\<turnstile> Var V :: T = (E V = Some T)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WT.cases)\ndone\n(*>*)\n\nlemma [iff]: \"P,E \\<turnstile> e\\<^sub>1;;e\\<^sub>2 :: T\\<^sub>2 = (\\<exists>T\\<^sub>1. P,E \\<turnstile> e\\<^sub>1::T\\<^sub>1 \\<and> P,E \\<turnstile> e\\<^sub>2::T\\<^sub>2)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WT.cases)\ndone\n(*>*)\n\nlemma [iff]: \"(P,E \\<turnstile> {V:T; e} :: T') = (is_type P T \\<and> P,E(V\\<mapsto>T) \\<turnstile> e :: T')\"\n(*<*)\napply(rule iffI)\napply (auto elim: WT.cases)\ndone\n(*>*)\n\n(*<*)\ninductive_cases WT_elim_cases[elim!]:\n  \"P,E \\<turnstile> V :=e :: T\"\n  \"P,E \\<turnstile> if (e) e\\<^sub>1 else e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile> while (e) c :: T\"\n  \"P,E \\<turnstile> throw e :: T\"\n  \"P,E \\<turnstile> try e\\<^sub>1 catch(C V) e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile> Cast D e :: T\"\n  \"P,E \\<turnstile> a\\<bullet>F{D} :: T\"\n  \"P,E \\<turnstile> a\\<bullet>F{D} := v :: T\"\n  \"P,E \\<turnstile> e\\<^sub>1 \\<guillemotleft>bop\\<guillemotright> e\\<^sub>2 :: T\"\n  \"P,E \\<turnstile> new C :: T\"\n  \"P,E \\<turnstile> e\\<bullet>M(ps) :: T\"\n(*>*)\n\n\nlemma wt_env_mono:\n  \"P,E \\<turnstile> e :: T \\<Longrightarrow> (\\<And>E'. E \\<subseteq>\\<^sub>m E' \\<Longrightarrow> P,E' \\<turnstile> e :: T)\" and \n  \"P,E \\<turnstile> es [::] Ts \\<Longrightarrow> (\\<And>E'. E \\<subseteq>\\<^sub>m E' \\<Longrightarrow> P,E' \\<turnstile> es [::] Ts)\"\n(*<*)\napply(induct rule: WT_WTs_inducts)\napply(simp add: WTNew)\napply(fastforce simp: WTCast)\napply(fastforce simp: WTVal)\napply(simp add: WTVar map_le_def dom_def)\napply(fastforce simp: WTBinOpEq)\napply(fastforce simp: WTBinOpAdd)\napply(force simp:map_le_def)\napply(fastforce simp: WTFAcc)\napply(fastforce simp: WTFAss del:WT_WTs.intros WT_elim_cases)\napply(fastforce simp: WTCall)\napply(fastforce simp: map_le_def WTBlock)\napply(fastforce simp: WTSeq)\napply(fastforce simp: WTCond)\napply(fastforce simp: WTWhile)\napply(fastforce simp: WTThrow)\napply(fastforce simp: WTTry map_le_def dom_def)\napply(simp add: WTNil)\napply(simp add: WTCons)\ndone\n(*>*)\n\n\nlemma WT_fv: \"P,E \\<turnstile> e :: T \\<Longrightarrow> fv e \\<subseteq> dom E\"\nand \"P,E \\<turnstile> es [::] Ts \\<Longrightarrow> fvs es \\<subseteq> dom E\"\n(*<*)\napply(induct rule:WT_WTs.inducts)\napply(simp_all del: fun_upd_apply)\napply fast+\ndone\n\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/J/WellType.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6654105587468141, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.30676543271386486}}
{"text": "section \\<open>Time Monad\\<close>\n\ntheory Time_Monad\nimports\n  Main\n  \"HOL-Library.Monad_Syntax\"\nbegin\n\ndatatype 'a tm = TM (val: 'a) nat\n\nfun val :: \"'a tm \\<Rightarrow> 'a\" where\n\"val (TM v n) = v\"\n\nfun time :: \"'a tm \\<Rightarrow> nat\" where\n\"time (TM v n) = n\"\n\ndefinition bind_tm :: \"'a tm \\<Rightarrow> ('a \\<Rightarrow> 'b tm) \\<Rightarrow> 'b tm\" where\n\"bind_tm s f = (case s of TM u m \\<Rightarrow> case f u of TM v n \\<Rightarrow> TM v (m+n))\"\n\nadhoc_overloading Monad_Syntax.bind bind_tm\n\ndefinition \"tick v = TM v 1\"\n\ndefinition \"return v = TM v 0\"\n\nabbreviation eqtick :: \"'a tm \\<Rightarrow> 'a tm \\<Rightarrow> bool\" (infix \"=1\" 50) where\n \"eqtick l r \\<equiv> (l = (r \\<bind> tick))\"\n\n(* warning: bind_tm is not a constant on purpose, does not work if it is: *)\ntranslations \"CONST eqtick l r\" <= \"(l = (bind_tm r CONST tick))\"\n\nlemmas tm_simps = bind_tm_def return_def tick_def\n\nlemma time_return[simp]: \"time (return x) = 0\"\nby(simp add: return_def)\n\nlemma surj_TM: \"v = val tm \\<Longrightarrow> t = time tm \\<Longrightarrow> tm = TM v t\"\nby (metis time.simps tm.exhaust val.simps)\n\ntext\\<open>The following lemmas push @{const val} into a monadic term:\\<close>\n\nlemma val_return[simp]: \"val (return x) = x\"\nby(simp add: return_def)\n\nlemma val_bind_tm[simp]: \"val (bind_tm m f) = (let x = val m in val(f x))\"\nby(simp add: bind_tm_def split: tm.split)\n\nlemma val_tick[simp]: \"val (tick x) = x\"\nby(simp add: tick_def)\n\nlemma val_let: \"val (let x = t in f(x)) = (let x = t in val(f x))\"\nby simp\n\nlemma let_id: \"(let x = t in x) = t\"\n  by simp\n\nlemma time_distrib_bind:\n  \"time (bind_tm tm f) = time tm + time (f (val tm))\"\n  unfolding bind_tm_def by (simp split: tm.split)\n\nlemmas time_simps = time_distrib_bind tick_def\n\nlemmas val_simps =\n  val_return\n  val_bind_tm\n  val_tick\n  val_let\n  let_id\n  if_distrib[of val]\n  prod.case_distrib[of val]\n\nlemmas val_cong = arg_cong[where f=val]\n\nlemma bind_tm_cong[fundef_cong]:\n  assumes \"\\<And>v. v = val n \\<Longrightarrow> f v = g v\" \"m = n\"\n  shows \"bind_tm m f = bind_tm n g\"\n  using assms unfolding bind_tm_def by (auto split: tm.split)\n\nhide_const TM\n\nend\n", "meta": {"author": "pacellie", "repo": "closest_pair_of_points", "sha": "1ad042bab001988892c16661236a6780330d9cc9", "save_path": "github-repos/isabelle/pacellie-closest_pair_of_points", "path": "github-repos/isabelle/pacellie-closest_pair_of_points/closest_pair_of_points-1ad042bab001988892c16661236a6780330d9cc9/Time_Monad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318479832805, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.30668375762197475}}
{"text": "theory ProcHoleVars\n  imports SafeRedLemma\nbegin\n\nfun hole_free_vars where\n  \"hole_free_vars ExpHole = {}\"\n| \"hole_free_vars (AppHole1 h e) = (hole_free_vars h \\<union> free_vars e)\"    \n| \"hole_free_vars (AppHole2 v h) = (free_vars v \\<union> hole_free_vars h)\"    \n| \"hole_free_vars (IfHole h e1 e2) = (hole_free_vars h \\<union> free_vars e1 \\<union> free_vars e2)\"\n| \"hole_free_vars (PairHole1 h e) = (hole_free_vars h \\<union> free_vars e)\"  \n| \"hole_free_vars (PairHole2 e h) = (free_vars e \\<union> hole_free_vars h)\"  \n(*| \"hole_free_vars (UnpackHole e h) = (free_vars e \\<union> hole_free_vars h)\"    *)\n\nlemma app_hole_free_vars: \"\\<lbrakk> x \\<in> free_vars e \\<rbrakk> \\<Longrightarrow> x \\<in> free_vars (app_hole h e)\"    \n  apply (induct h)\n    apply (auto)\n  done  \n    \nlemma app_hole_free_vars2: \"\\<lbrakk> x \\<in> hole_free_vars h \\<rbrakk> \\<Longrightarrow> x \\<in> free_vars (app_hole h e)\"    \n  apply (induct h)\n    apply (auto)\n  done    \n    \nlemma app_hole_free_vars_rev: \"\\<lbrakk> x \\<in> free_vars (app_hole h e) \\<rbrakk> \\<Longrightarrow> x \\<in> hole_free_vars h \\<or> x \\<in> free_vars e\"    \n  apply (induct h)\n    apply (auto)\n  done \n    \n    (* ##### states that if x is a non-prim var in 'e', it will not be a free var in 'h' if 'h (fork e)' is well-typed.  ##### *)\n  \nfun strong_fun_ty where\n  \"strong_fun_ty (FunTy t1 t2 r a) = (r = OwnPerm)\"\n| \"strong_fun_ty tau = False\"\n  \nfun strong_fun_ty2 where\n  \"strong_fun_ty2 (FunTy t1 (FunTy t2 t3 r a) rx ax) = (r = OwnPerm)\"  \n| \"strong_fun_ty2 tau = False\"  \n  \nfun strong_fun where\n  \"strong_fun (ConstExp c) = (\\<forall> tau. tau \\<in> const_type c \\<longrightarrow> strong_fun_ty tau)\"\n| \"strong_fun (AppExp (ConstExp c) v) = (\\<forall> tau. tau \\<in> const_type c \\<longrightarrow> strong_fun_ty2 tau)\"  \n| \"strong_fun e = False\"    \n  \nlemma strong_fun_own: \"\\<lbrakk>  well_typed env r_s1 f (FunTy t1 t2 r a) r_s2 rx; strong_fun f \\<rbrakk> \\<Longrightarrow> is_own r\"  \n  apply (case_tac f)\n        apply (auto)\n   apply (simp add: is_own_def)\n   apply (auto)\n  apply (simp add: is_own_def)\n  apply (case_tac x71)\n        apply (auto)\n  done\n  \nlemma safe_hole_npv_use_ih: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp f e)) tau r_s2 rx;\n  is_value f; strong_fun f; is_value e; x \\<in> non_prim_vars env e \\<rbrakk> \\<Longrightarrow> r_s2 x = NoPerm\"\n  apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n       apply (auto)\n    (* base case. x is subtracted out in the lifting of the inflected rx2 *)\n       apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"e\" and tau=\"t1\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n         apply (auto)\n        apply (rule_tac value_is_sexp)\n        apply (simp)\n    (* - r_s3 x has a value since otherwise it would be trivial *)\n       apply (case_tac \"r_s3 x = NoPerm\")\n        apply (rule_tac r_s=\"r_s3\" in leq_use_none)\n         apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n          apply (rule_tac self_diff_leq_use_env)\n         apply (auto)\n    (* - we know that rx2 has a value, because otherwise rx2 + [r_s2a - r_s3] would not have a value, altho it is the start perms of e *)\n       apply (case_tac \"rx2 x = NoPerm\")\n        apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n          apply (simp)\n         apply (simp add: infl_use_env_def)\n        apply (cut_tac env=\"env\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" and x=\"x\" in well_typed_no_npv_use)\n          apply (auto)\n    (* - by construction of strong functions, we also know that r = OwnPerm *)\n       apply (cut_tac f=\"f\" and r=\"r\" in strong_fun_own)\n         apply (auto)\n    (* - from here we can deduce EX x = Own *)\n        apply (rule_tac r_s=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in leq_use_none)\n         apply (auto)\n        apply (rule_tac diff_use_none_ex)\n        apply (rule_tac r_x=\"lift_use_env rx2 r\" in leq_use_own)\n         apply (simp add: is_own_def)\n        apply (rule_tac comp_leq_use_env1)\n        apply (rule_tac self_comp_leq_use_env2)\n    (* lhs induct. *)\n      apply (rule_tac r_s=\"r_s2a\" in leq_use_none)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n        apply (rule_tac diff_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n    (* rhs induct. *)\n     apply (rule_tac r_s=\"r_s3\" in leq_use_none)\n      apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (auto)\n    (* if case. *)\n    apply (rule_tac r_s=\"r_s2a\" in leq_use_none)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* pair case 1. *)\n   apply (rule_tac r_s=\"r_s2a\" in leq_use_none)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n     apply (rule_tac diff_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* pair case 2. *)\n  apply (rule_tac r_s=\"r_s3\" in leq_use_none)\n   apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (auto)\n  done        \n    \nlemma safe_hole_npv_use_st: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp f e)) tau r_s2 rx; is_value f; strong_fun f;\n wf_hole h; is_value e \\<rbrakk> \\<Longrightarrow> x \\<notin> non_prim_vars env e \\<or> x \\<notin> hole_free_vars h\"\n  apply (induct h arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* lhs induct. since r_s2a x = None, it cannot be in e2 *)\n        apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_hole_npv_use_ih)\n           apply (auto)\n        apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x2\" and x=\"x\" in well_typed_no_npv_use)\n          apply (auto)\n        apply (simp add: non_prim_vars_def)\n    (* rhs induct. r_s2a x has a value. since x is in e2. *)\n       apply (case_tac \"r_s2a x = NoPerm\")\n        apply (cut_tac ?r_s1.0=\"r_s2a\" and x=\"x\" and e=\"app_hole h (AppExp f e)\" in well_typed_no_npv_use)\n          apply (auto)\n        apply (cut_tac h=\"h\" and e=\"AppExp f e\" and x=\"x\" in app_hole_free_vars)\n         apply (auto)\n         apply (simp add: non_prim_vars_def)\n        apply (simp add: non_prim_vars_def)\n    (* - by lemma, rx1 x has a value as well. *)\n       apply (cut_tac env=\"env\" and e=\"x1\" and tau=\"FunTy t1 tau r a\" and ?r_s2.0=\"r_s2a\" and rx=\"rx1\" in wt_sexp_req_use)\n           apply (auto)\n         apply (rule_tac value_is_sexp)\n         apply (auto)\n        apply (simp add: non_prim_vars_def)\n    (* - this is a contradiction, since r_s3 x = None, and rx1 is contained by it *)\n       apply (cut_tac r_x=\"rx1\" and r_s=\"r_s3\" and x=\"x\" in leq_use_none)\n         apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n          apply (simp)\n         apply (rule_tac self_comp_leq_use_env1)\n        apply (rule_tac safe_hole_npv_use_ih)\n          apply (auto)\n    (* lhs if case. since r_s2a x = None, it cannot be in e2 *)\n      apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_hole_npv_use_ih)\n         apply (auto)\n      apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x2\" and x=\"x\" in well_typed_no_npv_use)\n        apply (auto)\n      apply (simp add: non_prim_vars_def)\n    (* rhs if case. since r_s2a x = None, it cannot be in e2 *)\n     apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_hole_npv_use_ih)\n        apply (auto)\n     apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x3\" and x=\"x\" in well_typed_no_npv_use)\n       apply (auto)\n     apply (simp add: non_prim_vars_def)\n    (* lhs pair case. same for lhs induct *)\n    apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_hole_npv_use_ih)\n       apply (auto)\n    apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x2\" and x=\"x\" in well_typed_no_npv_use)\n      apply (auto)\n    apply (simp add: non_prim_vars_def)\n    (* rhs pair case. same for rhs induct *)\n    (* - r_s2a x has a value. since x is in e2 *)\n   apply (case_tac \"r_s2a x = NoPerm\")\n    apply (cut_tac ?r_s1.0=\"r_s2a\" and x=\"x\" and e=\"app_hole h (AppExp f e)\" in well_typed_no_npv_use)\n      apply (auto)\n    apply (cut_tac h=\"h\" and e=\"AppExp f e\" and x=\"x\" in app_hole_free_vars)\n     apply (auto)\n     apply (simp add: non_prim_vars_def)\n    apply (simp add: non_prim_vars_def)\n    (* - then rx1 x has a value *)\n   apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"x1\" and tau=\"t1\" and ?r_s2.0=\"r_s2a\" and rx=\"rx1\" in wt_sexp_req_use)\n       apply (auto)\n     apply (rule_tac value_is_sexp)\n     apply (auto)\n    apply (simp add: non_prim_vars_def)\n    (* - this is a contradiction, since r_s3 x = None, and rx1 is contained by it *)\n   apply (cut_tac r_x=\"rx1\" and r_s=\"r_s3\" and x=\"x\" in leq_use_none)\n     apply (rule_tac r_sb=\"lift_use_env rx1 r\" in trans_leq_use_env)\n      apply (simp)\n     apply (rule_tac self_lift_leq_use_env)\n    apply (rule_tac safe_hole_npv_use_ih)\n      apply (auto)\n  done    \n    \nlemma safe_fork_hole_npv_use: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n wf_hole h; is_value e; x \\<in> non_prim_vars env e \\<rbrakk> \\<Longrightarrow> x \\<notin> hole_free_vars h\"\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and h=\"h\" and e=\"e\" and f=\"ConstExp ForkConst\" and x=\"x\" in safe_hole_npv_use_st)\n       apply (auto)\n  apply (simp add: is_own_def)\n  done        \n   \nlemma safe_send_hole_npv_use: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (AppExp (ConstExp SendConst) v) e)) tau r_s2 rx;\n wf_hole h; is_value v; is_value e; x \\<in> non_prim_vars env e \\<rbrakk> \\<Longrightarrow> x \\<notin> hole_free_vars h\"\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and h=\"h\" and e=\"e\" and f=\"AppExp (ConstExp SendConst) v\" and x=\"x\" in safe_hole_npv_use_st)\n       apply (auto)\n  apply (simp add: pure_fun_def)\n  apply (simp add: is_own_def)\n  done     \n    (*\nlemma safe_fork_hole_npv_use_ih: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n is_value e; x \\<in> non_prim_vars env e \\<rbrakk> \\<Longrightarrow> r_s2 x = NoPerm\"\n  apply (induct h arbitrary: env r_s1 r_s2 tau rx)\n        apply (auto)\n    (* base case. x is subtracted out in the lifting of the inflected rx2 *)\n        apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s2a\" and e=\"e\" and tau=\"FunTy UnitTy UnitTy UsePerm a\" and ?r_s2.0=\"r_s3\" and rx=\"rx2\" in infl_sexp_wp)\n          apply (auto)\n         apply (rule_tac value_is_sexp)\n         apply (simp)\n    (* - r_s3 x has a value since otherwise it would be trivial *)\n        apply (case_tac \"r_s3 x = NoPerm\")\n         apply (rule_tac r_s=\"r_s3\" in leq_use_none)\n          apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n           apply (rule_tac self_diff_leq_use_env)\n          apply (auto)\n    (* - we know that rx2 has a value, because otherwise rx2 + [r_s2a - r_s3] would not have a value, altho it is the start perms of e *)\n        apply (case_tac \"rx2 x = NoPerm\")\n         apply (cut_tac r_sa=\"rx2\" and r_sb=\"infl_use_env r_s2a r_s3\" and x=\"x\" in comp_use_none)\n           apply (simp)\n          apply (simp add: infl_use_env_def)\n         apply (cut_tac env=\"env\" and ?r_s1.0=\"comp_use_env rx2 (infl_use_env r_s2a r_s3)\" and x=\"x\" in well_typed_no_npv_use)\n           apply (auto)\n    (* - from here we can deduce EX x = Own *)\n        apply (rule_tac r_s=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in leq_use_none)\n         apply (auto)\n        apply (rule_tac diff_use_none_ex)\n        apply (rule_tac r_x=\"lift_use_env rx2 r\" in leq_use_own)\n         apply (simp add: is_own_def)\n        apply (rule_tac comp_leq_use_env1)\n        apply (rule_tac self_comp_leq_use_env2)\n    (* lhs induct. *)\n       apply (rule_tac r_s=\"r_s2a\" in leq_use_none)\n        apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n         apply (rule_tac diff_leq_use_env)\n         apply (rule_tac well_typed_perm_leq)\n         apply (auto)\n    (* rhs induct. *)\n      apply (rule_tac r_s=\"r_s3\" in leq_use_none)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (auto)\n    (* if case. *)\n     apply (rule_tac r_s=\"r_s2a\" in leq_use_none)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    (* pair case 1. *)\n    apply (rule_tac r_s=\"r_s2a\" in leq_use_none)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac diff_leq_use_env)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    (* pair case 2. *)\n    apply (rule_tac r_s=\"r_s3\" in leq_use_none)\n    apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n     apply (rule_tac self_diff_leq_use_env)\n    apply (auto)\n    (* unpack case *)(*\n  apply (rule_tac r_s=\"r_s3\" in leq_use_none)\n   apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n    apply (rule_tac self_diff_leq_use_env)\n   apply (auto)*)\n  done    \n    \n    (* the point of this lemma is basically that any non-primitive variable from e will be completely absent from h. *)    \n\nlemma safe_fork_hole_npv_use_st: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n wf_hole h; is_value e \\<rbrakk> \\<Longrightarrow> x \\<notin> non_prim_vars env e \\<or> x \\<notin> hole_free_vars h\"\n  apply (induct h arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* lhs induct. since r_s2a x = None, it cannot be in e2 *)\n        apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_fork_hole_npv_use_ih)\n           apply (auto)\n        apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x2\" and x=\"x\" in well_typed_no_npv_use)\n          apply (auto)\n        apply (simp add: non_prim_vars_def)\n    (* rhs induct. r_s2a x has a value. since x is in e2. *)\n       apply (case_tac \"r_s2a x = NoPerm\")\n        apply (cut_tac ?r_s1.0=\"r_s2a\" and x=\"x\" and e=\"app_hole h (AppExp (ConstExp ForkConst) e)\" in well_typed_no_npv_use)\n          apply (auto)\n        apply (cut_tac h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" and x=\"x\" in app_hole_free_vars)\n         apply (auto)\n         apply (simp add: non_prim_vars_def)\n        apply (simp add: non_prim_vars_def)\n    (* - by lemma, rx1 x has a value as well. *)\n       apply (cut_tac env=\"env\" and e=\"x1\" and tau=\"FunTy t1 tau r a\" and ?r_s2.0=\"r_s2a\" and rx=\"rx1\" in wt_sexp_req_use)\n           apply (auto)\n         apply (rule_tac value_is_sexp)\n         apply (auto)\n        apply (simp add: non_prim_vars_def)\n    (* - this is a contradiction, since r_s3 x = None, and rx1 is contained by it *)\n       apply (cut_tac r_x=\"rx1\" and r_s=\"r_s3\" and x=\"x\" in leq_use_none)\n         apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n          apply (simp)\n         apply (rule_tac self_comp_leq_use_env1)\n        apply (rule_tac safe_fork_hole_npv_use_ih)\n          apply (auto)\n    (* lhs if case. since r_s2a x = None, it cannot be in e2 *)\n      apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_fork_hole_npv_use_ih)\n         apply (auto)\n      apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x2\" and x=\"x\" in well_typed_no_npv_use)\n        apply (auto)\n      apply (simp add: non_prim_vars_def)\n    (* rhs if case. since r_s2a x = None, it cannot be in e2 *)\n     apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_fork_hole_npv_use_ih)\n        apply (auto)\n     apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x3\" and x=\"x\" in well_typed_no_npv_use)\n       apply (auto)\n     apply (simp add: non_prim_vars_def)\n    (* lhs pair case. same for lhs induct *)\n    apply (cut_tac h=\"h\" and e=\"e\" and ?r_s2.0=\"r_s2a\" and x=\"x\" in safe_fork_hole_npv_use_ih)\n       apply (auto)\n    apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"x2\" and x=\"x\" in well_typed_no_npv_use)\n      apply (auto)\n    apply (simp add: non_prim_vars_def)\n    (* rhs pair case. same for rhs induct *)\n    (* - r_s2a x has a value. since x is in e2 *)\n   apply (case_tac \"r_s2a x = NoPerm\")\n    apply (cut_tac ?r_s1.0=\"r_s2a\" and x=\"x\" and e=\"app_hole h (AppExp (ConstExp ForkConst) e)\" in well_typed_no_npv_use)\n      apply (auto)\n    apply (cut_tac h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" and x=\"x\" in app_hole_free_vars)\n     apply (auto)\n     apply (simp add: non_prim_vars_def)\n    apply (simp add: non_prim_vars_def)\n    (* - then rx1 x has a value *)\n   apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and e=\"x1\" and tau=\"t1\" and ?r_s2.0=\"r_s2a\" and rx=\"rx1\" in wt_sexp_req_use)\n       apply (auto)\n     apply (rule_tac value_is_sexp)\n     apply (auto)\n    apply (simp add: non_prim_vars_def)\n    (* - this is a contradiction, since r_s3 x = None, and rx1 is contained by it *)\n   apply (cut_tac r_x=\"rx1\" and r_s=\"r_s3\" and x=\"x\" in leq_use_none)\n     apply (rule_tac r_sb=\"lift_use_env rx1 r\" in trans_leq_use_env)\n      apply (simp)\n     apply (rule_tac self_lift_leq_use_env)\n    apply (rule_tac safe_fork_hole_npv_use_ih)\n      apply (auto)\n    (* unpack case. like the other rhs cases, we want to show that x cannot be in e1, because doing so would mean that rx1 x has a value.\n        - now, we can easily show that r_s3a x \\<noteq> None, so rx2a x \\<noteq> None follows \n     *)(*\n  apply (case_tac \"r_s3a x = NoPerm\")\n   apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s3a\" and x=\"x\" in leq_use_none)\n     apply (rule_tac r_sb=\"diff_use_env r_s3a (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa)\" in trans_leq_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n     apply (simp_all)\n   apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"app_hole h (AppExp (ConstExp ForkConst) e)\" and x=\"x\" in well_typed_no_npv_use)\n     apply (auto)\n   apply (cut_tac h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" and x=\"x\" in app_hole_free_vars)\n    apply (auto)\n    apply (simp add: non_prim_vars_def)\n   apply (simp add: non_prim_vars_def)\n  apply (cut_tac env=\"env\" and ?r_s2.0=\"r_s3a\" and e=\"x1\" and rx=\"rx2a\" in wt_sexp_req_use)\n      apply (auto)\n    apply (rule_tac e=\"x1\" in value_is_sexp)\n    apply (auto)\n   apply (simp add: non_prim_vars_def)\n    (* - we know the lhs is not primitive, therefore rx1 is not necessarily empty. *)\n  apply (simp add: app_req_def)\n  apply (case_tac \"a = Prim\")\n   apply (simp add: pure_fun_def)\n  apply (auto)\n    (* - then rx1 x \\<noteq> None, since it would have had to be subtracted from r_s2a. *)\n  apply (case_tac \"rx1 x = NoPerm\")\n   apply (cut_tac r_x=\"r_s2a\" and r_s=\"diff_use_env r_s3a (comp_use_env (comp_use_env rx1a (lift_use_env rx2a ra)) r_exa)\" and x=\"x\" in leq_use_none)\n     apply (simp)\n    apply (rule_tac r_x=\"comp_use_env rx1a rx2a\" in diff_use_none)\n     apply (case_tac \"comp_use_env rx1a rx2a x = NoPerm\")\n      apply (cut_tac r_sa=\"rx1a\" and r_sb=\"rx2a\" and x=\"x\" in comp_use_none_both)\n       apply (auto)\n    apply (rule_tac r_s=\"rx1\" in leq_use_none)\n     apply (auto)\n   apply (cut_tac ?r_s1.0=\"r_s2a\" and e=\"app_hole h (AppExp (ConstExp ForkConst) e)\" and x=\"x\" in well_typed_no_npv_use)\n     apply (auto)\n   apply (cut_tac h=\"h\" and e=\"AppExp (ConstExp ForkConst) e\" and x=\"x\" in app_hole_free_vars)\n    apply (auto)\n    apply (simp add: non_prim_vars_def)\n   apply (simp add: non_prim_vars_def)\n    (* this is a contradiction, since r_s3 x = None *)\n  apply (cut_tac r_x=\"rx1\" and r_s=\"r_s3\" and x=\"x\" in leq_use_none)\n    apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n     apply (simp)\n    apply (rule_tac self_comp_leq_use_env1)\n   apply (rule_tac safe_fork_hole_npv_use_ih)\n     apply (auto)*)\n  done\n    \nlemma safe_fork_hole_npv_use: \"\\<lbrakk> well_typed env r_s1 (app_hole h (AppExp (ConstExp ForkConst) e)) tau r_s2 rx;\n wf_hole h; is_value e; x \\<in> non_prim_vars env e \\<rbrakk> \\<Longrightarrow> x \\<notin> hole_free_vars h\"\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"r_s1\" and h=\"h\" and e=\"e\" and x=\"x\" in safe_fork_hole_npv_use_st)\n     apply (auto)\n  done    *)\n    \nend", "meta": {"author": "dcco", "repo": "perm_lang_ax1", "sha": "5742edc2c5db417002ed6b8acd159c522b3e6e38", "save_path": "github-repos/isabelle/dcco-perm_lang_ax1", "path": "github-repos/isabelle/dcco-perm_lang_ax1/perm_lang_ax1-5742edc2c5db417002ed6b8acd159c522b3e6e38/perm_unsafe_lift/ProcHoleVars.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3066837503819374}}
{"text": "theory Exp\n  imports Definitions\nbegin\n\nsection \\<open>Semantics of Expressions\\<close>\n\ntext \\<open>This section presents the big-step semantics of expressions.\\<close>\n\ntext \\<open>Introducing a locale here looks a good idea as it helps us formulate\naxioms among the heap access modifier. Expected axioms:\n\\<^item> Modifier must be idempotent: \\<^term>\\<open>m p (m p H) = m p H\\<close>.\n\\<^item> Modifier must not allocate/deallocate a memory cell: \\<^term>\\<open>length (m p H) = length H\\<close>.\n\\<^item> The content is left intact: \\<^term>\\<open>fst ((m p H) ! a) = fst (H ! a)\\<close>\n\\<close>\n\ntype_synonym modifier = \"(address * tag) \\<Rightarrow> heap \\<Rightarrow> heap option\"\nfun write_access :: modifier where\n  \"write_access (a, t) H =\n    (if writable H (a, t) then\n      let (v, ts) = H ! a in\n      Some (H[a := (v, kill t ts)])\n     else None)\"\nfun read_access :: modifier where\n  \"read_access (a, t) H =\n    (if readable H (a, t) then\n      let (v, ts) = H ! a in\n      Some (H[a := (v, kill t ts)])\n     else None)\"\n\ninductive place_sem ::\n  \"gamma \\<Rightarrow> modifier \\<Rightarrow> heap * place \\<Rightarrow> heap * val \\<Rightarrow> bool\"\n  (\"(_; _ \\<turnstile> _ \\<Down>\\<^sub>p _)\") for \\<Gamma> m\nwhere\n  Var: \"\\<Gamma> x = (a, t) \\<Longrightarrow> \\<Gamma>; m \\<turnstile> (H, Var x) \\<Down>\\<^sub>p (H, Reference a t)\" |\n  Deref: \"\\<lbrakk>\\<Gamma>; m \\<turnstile> (H, p) \\<Down>\\<^sub>p (H', Reference a t); m (a, t) H' = Some H''\\<rbrakk> \\<Longrightarrow>\n          \\<Gamma>; m \\<turnstile> (H, Deref p) \\<Down>\\<^sub>p (H'', fst (H'' ! a))\"\n\ntext \\<open>The relation @{const place_sem} describes the semantics of places\nwith respect to a heap access modifier \\<^term>\\<open>m\\<close>.\n\\<^term>\\<open>\\<Gamma>; m \\<turnstile> (H, p) \\<Down>\\<^sub>p (H', v)\\<close> means that a place expression \\<^term>\\<open>p\\<close> evaluates to\na value \\<^term>\\<open>v\\<close> under the environment \\<^term>\\<open>\\<Gamma>\\<close> and \\<^term>\\<open>H\\<close>, while the access\nhas changed the state of the heap to \\<^term>\\<open>H'\\<close>.\\<close>\n\ntext \\<open>We give a shorthand for read and write access to the place.\\<close>\n\nabbreviation read_place_sem :: \"gamma \\<Rightarrow> heap * place \\<Rightarrow> heap * val \\<Rightarrow> bool\"\n  (\"(_ \\<turnstile>\\<^sub>r _ \\<Down>\\<^sub>p _)\")\n  where\n  \"\\<Gamma> \\<turnstile>\\<^sub>r p \\<Down>\\<^sub>p v == \\<Gamma>; read_access \\<turnstile> p \\<Down>\\<^sub>p v\"\nabbreviation write_place_sem :: \"gamma \\<Rightarrow> heap * place \\<Rightarrow> heap * val \\<Rightarrow> bool\"\n  (\"(_ \\<turnstile>\\<^sub>w _ \\<Down>\\<^sub>p _)\")\n  where\n  \"\\<Gamma> \\<turnstile>\\<^sub>w p \\<Down>\\<^sub>p v == \\<Gamma>; write_access \\<turnstile> p \\<Down>\\<^sub>p v\"\n\n(*<*)\nlemmas place_sem_cases = place_sem.cases[split_format(complete)]\nlemmas place_sem_induct = place_sem.induct[split_format(complete)]\ndeclare place_sem.intros[simp, intro]\ninductive_cases place_sem_inv[elim!]:\n  \"\\<Gamma>; m \\<turnstile> (H, Var x) \\<Down>\\<^sub>p (H', v)\"\n  \"\\<Gamma>; m \\<turnstile> (H, Deref p) \\<Down>\\<^sub>p (H', v)\"\n(*>*)\n\ntext \\<open>Note that every operand is considered as a read access to the place.\\<close>\n\ninductive operand_sem ::\n  \"gamma \\<Rightarrow> heap * operand \\<Rightarrow> heap * val \\<Rightarrow> bool\"\n  (\"(_ \\<turnstile> _ \\<Down>\\<^sub>o\\<^sub>p _)\") for \\<Gamma>\nwhere\n  Place: \"\\<Gamma> \\<turnstile>\\<^sub>r (H, p) \\<Down>\\<^sub>p v \\<Longrightarrow> \\<Gamma> \\<turnstile> (H, Place p) \\<Down>\\<^sub>o\\<^sub>p v\" |\n  Constant: \"\\<Gamma> \\<turnstile> (H, Constant v) \\<Down>\\<^sub>o\\<^sub>p (H, v)\"\n\n(*<*)\nlemmas operand_sem_cases = operand_sem.cases[split_format(complete)]\nlemmas operand_sem_induct = operand_sem.induct[split_format(complete)]\ndeclare operand_sem.simps[simp, intro]\ninductive_cases operand_sem_inv[elim!]:\n  \"\\<Gamma> \\<turnstile> (H, Place p) \\<Down>\\<^sub>o\\<^sub>p v\"\n  \"\\<Gamma> \\<turnstile> (H, Constant v) \\<Down>\\<^sub>o\\<^sub>p v'\"\n(*>*)\n\ninductive rvalue_sem ::\n  \"gamma \\<Rightarrow> tags * heap * rvalue \\<Rightarrow> tags * heap * val \\<Rightarrow> bool\"\n  (\"(_ \\<turnstile> _ \\<Down> _)\") for \\<Gamma>\nwhere\n  Use: \"\\<Gamma> \\<turnstile> (H, op) \\<Down>\\<^sub>o\\<^sub>p (H', v) \\<Longrightarrow> \\<Gamma> \\<turnstile> (T, H, Use op) \\<Down> (T, H', v)\" |\n  Box: \"\\<lbrakk>\\<Gamma> \\<turnstile> (H, op) \\<Down>\\<^sub>o\\<^sub>p (H', v); p = length H'; t = length T\\<rbrakk>\n        \\<Longrightarrow> \\<Gamma> \\<turnstile> (T, H, Box op) \\<Down> (T @ [Unique], H' @ [(v, [t])], Reference p t)\" |\n  Ref: \"\\<Gamma> \\<turnstile>\\<^sub>w (H, p) \\<Down>\\<^sub>p (H', Reference a t) \\<Longrightarrow> \\<Gamma> \\<turnstile> (T, H, Ref p) \\<Down> (T, H', Reference a t)\" |\n  Reborrow: \"\\<lbrakk>\\<Gamma> \\<turnstile>\\<^sub>w (H, p) \\<Down>\\<^sub>p (H', Reference a t); writable H (a, t);\n              t' = length T; H' ! a = (v, ts)\\<rbrakk>\n             \\<Longrightarrow> \\<Gamma> \\<turnstile> (T, H, Reborrow p) \\<Down> (T @ [Unique], H'[a := (v, ts @ [t'])], Reference a t')\" |\n  Plus: \"\\<lbrakk>\\<Gamma> \\<turnstile> (H, lhs) \\<Down>\\<^sub>o\\<^sub>p (H', VInt lhs'); \\<Gamma> \\<turnstile> (H', rhs) \\<Down>\\<^sub>o\\<^sub>p (H'', VInt rhs')\\<rbrakk>\n         \\<Longrightarrow> \\<Gamma> \\<turnstile> (T, H, Plus lhs rhs) \\<Down> (T, H'', VInt (lhs' + rhs'))\" |\n  Less: \"\\<lbrakk>\\<Gamma> \\<turnstile> (H, lhs) \\<Down>\\<^sub>o\\<^sub>p (H', VInt lhs'); \\<Gamma> \\<turnstile> (H', rhs) \\<Down>\\<^sub>o\\<^sub>p (H'', VInt rhs')\\<rbrakk>\n         \\<Longrightarrow> \\<Gamma> \\<turnstile> (T, H, Less lhs rhs) \\<Down> (T, H'', VBool (lhs' < rhs'))\" |\n  Not: \"\\<Gamma> \\<turnstile> (H, op) \\<Down>\\<^sub>o\\<^sub>p (H', VBool v) \\<Longrightarrow> \\<Gamma> \\<turnstile> (T, H, Not op) \\<Down> (T, H', VBool (\\<not>v))\" |\n  And: \"\\<lbrakk>\\<Gamma> \\<turnstile> (H, lhs) \\<Down>\\<^sub>o\\<^sub>p (H', VBool lhs'); \\<Gamma> \\<turnstile> (H', rhs) \\<Down>\\<^sub>o\\<^sub>p (H'', VBool rhs')\\<rbrakk>\n         \\<Longrightarrow> \\<Gamma> \\<turnstile> (T, H, And lhs rhs) \\<Down> (T, H'', VBool (lhs' \\<and> rhs'))\"\n\n(*<*)\nlemmas rvalue_sem_cases = rvalue_sem.cases[split_format(complete)]\nlemmas rvalue_sem_induct = rvalue_sem.induct[split_format(complete)]\ndeclare rvalue_sem.intros[simp, intro]\ninductive_cases rvalue_sem_inv[elim!]:\n  \"\\<Gamma> \\<turnstile> (T, H, Use op) \\<Down> (T', H', v)\"\n  \"\\<Gamma> \\<turnstile> (T, H, Box op) \\<Down> (T', H', v)\"\n  \"\\<Gamma> \\<turnstile> (T, H, Ref p) \\<Down> (T', H', v)\"\n  \"\\<Gamma> \\<turnstile> (T, H, Reborrow p) \\<Down> (T', H', v)\"\n  \"\\<Gamma> \\<turnstile> (T, H, Plus lhs rhs) \\<Down> (T', H', v)\"\n  \"\\<Gamma> \\<turnstile> (T, H, Less lhs rhs) \\<Down> (T', H', v)\"\n  \"\\<Gamma> \\<turnstile> (T, H, Not op) \\<Down> (T', H', v)\"\n  \"\\<Gamma> \\<turnstile> (T, H, And lhs rhs) \\<Down> (T', H', v)\"\n(*>*)\n\ntext \\<open>\nSome TODO notes on the semantics of expressions:\n\\<^item> I don't get the semantics of @{const Ref} in MIR and how it should behave under the auto-boxing of variables.\n\\<^item> I'm not sure readable/writable checking is correct.\n\\<close>\n\ntext \\<open>\nWe present the intuition behind the selected rules.\nFirst, {\\sc{Box}} rule allocates a new slot at the end of heap,\nreturning a reference pointing to the slot with a fresh tag.\n\n\\begin{framed}\n\\centering\n@{thm[mode=Rule] Box} \\sc{Box}\n\\end{framed}\n\nNext, {\\sc{Use}} and {\\sc{Ref}} rules allow us to read the content through a place (or give a constant).\n\n\\begin{framed}\n\\centering\n@{thm[mode=Rule] Use} \\sc{Use}\\\\\n@{thm[mode=Rule] Ref} \\sc{Ref}\n\\end{framed}\n\nLast but not least, {\\sc{Reborrow}} rule creates a new reference pointing to the same object but with a fresh tag.\nThe newly created reference is writable. Thus the original reference must be valid for writes.\nReborrow is considered as the use of the original reference and hence it invalidates former children\nof the reference. As a result, the reborrow tree will have the original reference and the reborrowing\nreference as the last two element.\n\n\\begin{framed}\n\\sc{Reborrow} rule:\n\\centering\n@{thm[mode=Rule] Reborrow}\n\\end{framed}\n\\<close>\n\ntext \\<open>We can prove that the semantics of expressions is deterministic.\\<close>\n\nlemma place_sem_det: \"\\<Gamma>; m \\<turnstile> p \\<Down>\\<^sub>p v \\<Longrightarrow> \\<Gamma>; m \\<turnstile> p \\<Down>\\<^sub>p v' \\<Longrightarrow> v' = v\"\nproof (induction arbitrary: v' rule: place_sem.induct)\n  case (Var x a t H)\n  then show ?case\n    by (metis Pair_inject place_sem_inv(1) surj_pair)\nnext\n  case (Deref m H p H' a t H'')\n  then show ?case\n  sorry\n  (*\n    by (smt Pair_inject option.inject place_sem_inv(2) surj_pair val.inject(3))\n  *)\nqed\nlemma place_sem_det': \"\\<Gamma>; m \\<turnstile> (H, p) \\<Down>\\<^sub>p (H', v') \\<Longrightarrow> \\<Gamma>; m \\<turnstile> (H, p) \\<Down>\\<^sub>p (H'', v'')\n  \\<Longrightarrow> (H'', v'') = (H', v')\"\n  using place_sem_det by auto\n\nlemma operand_sem_det: \"\\<Gamma> \\<turnstile> op \\<Down>\\<^sub>o\\<^sub>p v \\<Longrightarrow> \\<Gamma> \\<turnstile> op \\<Down>\\<^sub>o\\<^sub>p v' \\<Longrightarrow> v' = v\"\nproof (induction arbitrary: v' rule: operand_sem.induct)\n  case (Place \\<Gamma> H p v)\n  then show ?case\n    by (metis operand_sem_inv(1) place_sem_det' surj_pair)\nnext\n  case (Constant \\<Gamma> H v)\n  then show ?case by blast\nqed\nlemma operand_sem_det': \"\\<Gamma> \\<turnstile> (H, op) \\<Down>\\<^sub>o\\<^sub>p (H', v') \\<Longrightarrow> \\<Gamma> \\<turnstile> (H, op) \\<Down>\\<^sub>o\\<^sub>p (H'', v'')\n  \\<Longrightarrow> (H'', v'') = (H', v')\"\n  using operand_sem_det by blast\n\nlemma rvalue_sem_det: \"\\<Gamma> \\<turnstile> (T, H, rv) \\<Down> (T', H', v') \\<Longrightarrow> \\<Gamma> \\<turnstile> (T, H, rv) \\<Down> (T'', H'', v'')\n  \\<Longrightarrow> (T'', H'', v'') = (T', H', v')\"\nproof (induction arbitrary: T'' H'' v'' rule: rvalue_sem_induct)\n  case (Use H op H' v T)\n  then show ?case using operand_sem_det' by fastforce\nnext\n  case (Box H op H' v p t T)\n  then show ?case using place_sem_det' by blast\nnext\n  case (Ref H p H' a t T)\n  then show ?case using place_sem_det' by blast\nnext\n  case (Reborrow H p H' a t t' T v ts)\n  show ?case\n  proof (rule rvalue_sem_inv(4))\n    show \"\\<Gamma> \\<turnstile> (T, H, Reborrow p) \\<Down> (T'', H'', v'')\" using Reborrow.prems by simp\n  next\n    fix H'a aa ta va tsa\n    assume \"\\<Gamma> \\<turnstile>\\<^sub>w (H, p) \\<Down>\\<^sub>p (H'a, Reference aa ta)\"\n    then have \"H'a = H' \\<and> aa = a \\<and> ta = t\" using Reborrow.hyps place_sem_det by fastforce\n    moreover assume \"H'a ! aa = (va, tsa)\"\n    then have \"va = v \\<and> tsa = ts\" using Reborrow.hyps calculation by auto\n    moreover assume \"H'' = H'a[aa := (va, tsa @ [length T])]\"\n    then have \"H'' = H'a[a := (v, ts @ [t'])]\" using Reborrow.hyps calculation by simp\n    moreover assume \"v'' = Reference aa (length T)\"\n    then have \"v'' = Reference a t'\" using Reborrow.hyps calculation by simp\n    moreover assume \"T'' = T @ [Unique]\"\n    thus ?thesis using calculation by simp\n  qed\nnext\n  case (Plus H lhs H' lhs' rhs He rhs' T)\n  show ?case\n  proof (rule rvalue_sem_inv(5))\n    show \"\\<Gamma> \\<turnstile> (T, H, Plus lhs rhs) \\<Down> (T'', H'', v'')\" using Plus.prems by simp\n  next\n    fix H'a lhs'a rhs'a\n    assume \"(\\<exists>p. lhs = Place p \\<and> (\\<Gamma> \\<turnstile>\\<^sub>r (H, p) \\<Down>\\<^sub>p (H'a, VInt lhs'a)))\n            \\<or> lhs = Constant (VInt lhs'a) \\<and> H'a = H\"\n    then have \"lhs'a = lhs' \\<and> H'a = H'\" using Plus.hyps operand_sem_det' by fastforce\n    moreover\n    assume \"(\\<exists>p. rhs = Place p \\<and> (\\<Gamma> \\<turnstile>\\<^sub>r (H'a, p) \\<Down>\\<^sub>p (H'', VInt rhs'a)))\n            \\<or> rhs = Constant (VInt rhs'a) \\<and> H'' = H'a\"\n    then have \"rhs'a = rhs' \\<and> He = H''\"\n      using Plus.hyps calculation operand_sem_det' by fastforce\n    moreover assume \"v'' = VInt (lhs'a + rhs'a)\"\n    thus ?thesis using calculation Plus.prems by auto\n  qed\nnext\n  case (Less H lhs H' lhs' rhs He rhs' T)\n  show ?case\n  proof (rule rvalue_sem_inv(6))\n    show \"\\<Gamma> \\<turnstile> (T, H, Less lhs rhs) \\<Down> (T'', H'', v'')\" using Less.prems by simp\n  next\n    fix H'a lhs'a rhs'a\n    assume \"(\\<exists>p. lhs = Place p \\<and> (\\<Gamma> \\<turnstile>\\<^sub>r (H, p) \\<Down>\\<^sub>p (H'a, VInt lhs'a)))\n            \\<or> lhs = Constant (VInt lhs'a) \\<and> H'a = H\"\n    then have \"lhs'a = lhs' \\<and> H'a = H'\" using Less.hyps operand_sem_det' by fastforce\n    moreover\n    assume \"(\\<exists>p. rhs = Place p \\<and> (\\<Gamma> \\<turnstile>\\<^sub>r (H'a, p) \\<Down>\\<^sub>p (H'', VInt rhs'a)))\n            \\<or> rhs = Constant (VInt rhs'a) \\<and> H'' = H'a\"\n    then have \"rhs'a = rhs' \\<and> He = H''\"\n      using Less.hyps calculation operand_sem_det' by fastforce\n    moreover assume \"v'' = VBool (lhs'a < rhs'a)\"\n    thus ?thesis using calculation Less.prems by auto\n  qed\nnext\n  case (Not H op H' v T)\n  show ?case\n  proof (rule rvalue_sem_inv(7))\n    show \"\\<Gamma> \\<turnstile> (T, H, Not op) \\<Down> (T'', H'', v'')\" using Not.prems by simp\n  next\n    fix va\n    assume \"(\\<exists>p. op = Place p \\<and> (\\<Gamma> \\<turnstile>\\<^sub>r (H, p) \\<Down>\\<^sub>p (H'', VBool va)))\n            \\<or> op = Constant (VBool va) \\<and> H'' = H\"\n    then have \"H'' = H' \\<and> va = v\" using Not.hyps operand_sem_det' by fastforce\n    moreover assume \"T'' = T\" and \"v'' = VBool (\\<not>va)\"\n    thus ?thesis by (simp add: calculation)\n  qed\nnext\n  case (And H lhs H' lhs' rhs He rhs' T)\n  show ?case\n  proof (rule rvalue_sem_inv(8))\n    show \"\\<Gamma> \\<turnstile> (T, H, And lhs rhs) \\<Down> (T'', H'', v'')\" using And.prems by simp\n  next\n    fix H'a lhs'a rhs'a\n    assume \"(\\<exists>p. lhs = Place p \\<and> (\\<Gamma> \\<turnstile>\\<^sub>r (H, p) \\<Down>\\<^sub>p (H'a, VBool lhs'a)))\n            \\<or> lhs = Constant (VBool lhs'a) \\<and> H'a = H\"\n    then have \"lhs'a = lhs' \\<and> H'a = H'\" using And.hyps operand_sem_det' by fastforce\n    moreover\n    assume \"(\\<exists>p. rhs = Place p \\<and> (\\<Gamma> \\<turnstile>\\<^sub>r (H'a, p) \\<Down>\\<^sub>p (H'', VBool rhs'a)))\n            \\<or> rhs = Constant (VBool rhs'a) \\<and> H'' = H'a\"\n    then have \"rhs'a = rhs' \\<and> He = H''\"\n      using And.hyps calculation operand_sem_det' by fastforce\n    moreover assume \"v'' = VBool (lhs'a \\<and> rhs'a)\"\n    thus ?thesis using calculation And.prems by auto\n  qed\nqed\n\ntext \\<open>The following lemmas are sanity checks of the semantics.\nWe must be able to write through the references retrieved by {\\sc{Box}} and {\\sc{Reborrow}} rules.\\<close>\n\nlemma box_writable: \"\\<Gamma> \\<turnstile> (T, H, Box e) \\<Down> (T', H', Reference a t) \\<Longrightarrow> writable H' (a, t)\"\n  by auto\n\nlemma wa_preserve_length: \"write_access at H = Some H' \\<Longrightarrow> length H' = length H\"\n  sorry\n  (*\n  by (smt kill_heap.simps kill_preserve_length option.distinct(1)\n          option.sel prod.case_eq_if write_access.elims)\n*)\n\nlemma write_preserve_length: \"\\<Gamma> \\<turnstile>\\<^sub>w p \\<Down>\\<^sub>p v \\<Longrightarrow> length (fst p) = length (fst v)\"\nproof (induction rule: place_sem.induct)\n  case (Var x a t H)\n  then show ?case by simp\nnext\n  case (Deref H p H' a t H'')\n  assume \"write_access (a, t) H' = Some H''\"\n  then have \"length H'' = length H'\" using wa_preserve_length by blast\n  moreover\n  assume \"length (fst (H, p)) = length (fst (H', Reference a t))\"\n  then have \"length H = length H'\" by simp\n  ultimately have \"length H'' = length H\" by simp\n  thus ?case by simp\nqed\n\nlemma reborrow_writable: \"\\<Gamma> \\<turnstile> (T, H, Reborrow p) \\<Down> (T', H', Reference a t) \\<Longrightarrow> writable H' (a, t)\"\nproof (rule rvalue_sem_inv(4))\n  assume \"\\<Gamma> \\<turnstile> (T, H, Reborrow p) \\<Down> (T', H', Reference a t)\"\n  then show \"\\<Gamma> \\<turnstile> (T, H, Reborrow p) \\<Down> (T', H', Reference a t)\" by auto\nnext\n  fix H'a aa ta va tsa\n  assume \"Reference a t = Reference aa (length T)\"\n  then have \"aa = a\" and \"length T = t\" by auto\n\n  assume \"\\<Gamma> \\<turnstile>\\<^sub>w (H, p) \\<Down>\\<^sub>p (H'a, Reference aa ta)\"\n  then have \"length H'a = length H\" using write_preserve_length by auto\n  moreover assume \"aa < length H\" then have \"aa < length H'a\" using calculation by simp\n  moreover assume \"H' = H'a[aa := (va, tsa @ [length T])]\"\n  then have \"H' ! a = (va, tsa @ [t])\" and \"length H' = length H'a\"\n    using \\<open>aa < length H\\<close> \\<open>aa = a\\<close> \\<open>length T = t\\<close> calculation by auto\n  thus ?thesis using \\<open>aa = a\\<close> \\<open>aa < length H'a\\<close> by auto\nqed\n\nend\n", "meta": {"author": "pandaman64", "repo": "sabi", "sha": "a5de6b33cb0e5b9e6f0e610de0a3536236d1a694", "save_path": "github-repos/isabelle/pandaman64-sabi", "path": "github-repos/isabelle/pandaman64-sabi/sabi-a5de6b33cb0e5b9e6f0e610de0a3536236d1a694/Unique/Exp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.603931819468636, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3066837431419}}
{"text": "(*\n   Copyright 2017 Myriam Begel\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n*)\n\ntheory \"SoundnessForBasicBlocks\"\n\nimports \"HoareTripleForBasicBlocks\"\n\"../Word_Lib/Word_Lemmas\"\nbegin\n\nlemmas instruction_simps =\ninstruction_sem_simps gas_value_simps\ninst_size_simps inst_numbers_simps\nmeter_gas_def new_memory_consumption.simps\nvctx_stack_default_def check_resources_def\nC_def thirdComponentOfC_def\ninstruction_sem_def\n\n(* Soundness proof for instruction rules *)\n\nlemma inst_strengthen_pre_sem:\n  assumes  \"triple_inst_sem n P c Q\"\n  and      \"(\\<forall> s. R s \\<longrightarrow> P s)\"\n  shows    \" triple_inst_sem n R c Q\"\n  using assms(1)\n  apply (simp add: triple_inst_sem_def)\n  apply(clarify)\n  apply(drule_tac x = co_ctx in spec)\n  apply(drule_tac x = presult in spec)\n  apply(drule_tac x = rest in spec)\n  apply (erule impE)\n   apply (sep_drule assms(2)[rule_format])\n   apply assumption\n  apply simp\ndone\n\nlemma inst_false_pre_sem:\n  \"triple_inst_sem n \\<langle>False\\<rangle> i q\"\nby(simp add: triple_inst_sem_def sep_basic_simps pure_def)\n\nmethod inst_sound_set_eq uses simp =\n simp add: triple_inst_sem_def program_sem.simps as_set_simps,\n clarify,\n sep_simp simp: evm_sep; simp,\n simp split: instruction_result.splits,\n simp add: stateelm_means_simps stateelm_equiv_simps,\n simp add: vctx_next_instruction_def,\n clarsimp simp add: instruction_simps simp,\n (sep_simp simp: evm_sep)+,\n simp add: stateelm_means_simps stateelm_equiv_simps,\n erule_tac P=\"(_ \\<and>* _)\" in back_subst\n\nmethod inst_sound_basic uses simp =\n inst_sound_set_eq,\n auto simp add: as_set_simps\n(*\napply(simp add: triple_inst_sem_def program_sem.simps as_set_simps)\napply(clarify)\napply(sep_simp simp: evm_sep; simp)\napply(simp split: instruction_result.splits)\napply(simp add: stateelm_means_simps stateelm_equiv_simps)\napply(simp add: vctx_next_instruction_def)\napply(clarsimp simp add: instruction_simps)\napply((sep_simp simp: evm_sep)+)\napply(simp add: stateelm_means_simps stateelm_equiv_simps)\napply(erule_tac P=\"(_ \\<and>* _)\" in back_subst)\napply(auto simp add: as_set_simps)\n*)\n\nlemma inst_stop_sem:\n\"triple_inst_sem net\n  (\\<langle> h \\<le> 1024 \\<and> 0 \\<le> g\\<rangle> \\<and>* continuing \\<and>* program_counter n \\<and>* stack_height h \\<and>* gas_pred g \\<and>* rest)\n  (n, Misc STOP)\n  (stack_height h \\<and>* not_continuing \\<and>* program_counter n \\<and>* action (ContractReturn []) \\<and>* gas_pred g \\<and>* rest )\"\napply(simp add:swap_inst_code_def triple_inst_sem_def program_sem.simps as_set_simps)\n apply(clarify)\n apply(simp split: instruction_result.splits)\n   defer\n  apply(sep_simp simp: continuing_sep; simp)\n apply(simp add: vctx_next_instruction_def)\n apply(split option.splits)\n apply(simp add: sep_conj_commute[where P=\"rest\"])\n apply(clarify)\n apply(rule conjI)\n  apply(clarsimp split:option.splits)\n apply(subgoal_tac \"(case program_content (cctx_program co_ctx) (vctx_pc x1) of\n               None \\<Rightarrow> Some (Misc STOP) | Some i \\<Rightarrow> Some i) =\n              Some (Misc STOP)\")\n  apply(clarsimp)\n  apply(sep_simp simp: program_counter_sep stack_height_sep pure_sep memory_usage_sep; simp)\n  apply(rule conjI; rule impI; rule conjI; clarsimp;\n  simp add: instruction_simps stop_def)\n   apply(simp add: sep_fun_simps)\n   apply(erule conjE)+\n   apply(erule_tac P=\"(resta \\<and>* rest)\" in back_subst)\n   apply(rule equalityI; rule subsetI; clarsimp)\n  apply(simp add: memory_usage_elm_c_means stackHeightElmEquiv)\n apply(simp add: memory_usage_elm_c_means stackHeightElmEquiv)\n apply(sep_simp simp: gas_pred_sep; simp add: gasElmEquiv)\n apply(sep_simp simp: code_sep program_counter_sep)\n apply(simp add: codeElmEquiv pcElmEquiv)\n apply(simp split: option.splits)\n apply(rule allI; rule impI; simp)\ndone\n\nmethod set_solve_arith_2_low=\n  (erule_tac P=\"(_ \\<and>* _)\" in back_subst),\n  (rule equalityI; rule subsetI; clarsimp simp add: as_set_simps;\n   case_tac x; simp;\n   clarify;\n   case_tac \"idx = length ta\"; simp)\n\n(*  apply(erule_tac P=\"(_ \\<and>* _)\" in back_subst)\n  apply(rule equalityI; rule subsetI; clarsimp simp add: as_set_simps)\n   apply(case_tac x; simp)\n   apply(clarify)\n   apply(case_tac \"idx = length ta\"; simp)\n  apply(case_tac x; simp)\n  apply(clarify)\n  apply(case_tac \"idx = length ta\"; simp)*)\n\nmethod set_solve =\n(rule  Set.equalityI; rule subsetI; simp add: as_set_simps;\n   (rename_tac elm);\n   (case_tac elm; simp);\n   (rename_tac pair);\n   (case_tac pair; clarsimp));\n(simp add: nth_append)?\n(*apply(rule  Set.equalityI; rule subsetI; simp add: as_set_simps)\n   apply(rename_tac elm)\n   apply(case_tac elm; simp)\n   apply(rename_tac pair)\n   apply(case_tac pair; clarsimp)*)\n\n(* From HoareTripleForInstructions2 *)\nlemma tmp001:\n\"length lst = h \\<Longrightarrow>\nSuc (unat n) < h \\<Longrightarrow>\nunat n \\<le> length (drop 1 lst)\"\napply auto\ndone\n\nlemma tmp000: \"\na \\<noteq> h - Suc 0 \\<Longrightarrow> \\<not> a < h - Suc (Suc (unat n)) \\<Longrightarrow> a \\<noteq> h - Suc (Suc (unat n)) \\<Longrightarrow> \na < h \\<Longrightarrow> (Suc (a + unat n) - h) < unat n\n\"\napply auto\ndone\n\nlemma tmp002:\n \"a \\<noteq> h - Suc 0 \\<Longrightarrow> a < h\n   \\<Longrightarrow> Suc (h - Suc (Suc a)) = h - Suc a\"\napply auto\ndone\n\n\nlemma take_drop_nth :\n  \"length (vctx_stack x1) = h \\<Longrightarrow>\n   Suc (unat n) < h \\<Longrightarrow>\n   a \\<noteq> h - Suc 0 \\<Longrightarrow> \\<not> a < h - Suc (Suc (unat n)) \\<Longrightarrow> a \\<noteq> h - Suc (Suc (unat n)) \\<Longrightarrow>\n   a < h \\<Longrightarrow>\n   rev (take (unat n) (drop (Suc 0) (vctx_stack x1))) ! (Suc (a + unat n) - h) = rev (vctx_stack x1) ! a\"\n  apply(simp add: tmp000 tmp001 tmp002 List.rev_nth min_absorb2)\ndone\n\nlemma rev_lookup :\n  \"k < length lst \\<Longrightarrow>\n   rev lst ! (length lst - Suc k) = lst ! k\"\napply(simp add: List.rev_nth)\ndone\n\nlemma list_swap_usage :\n  \"n < length lst \\<Longrightarrow>\n   rev lst ! (length lst - Suc 0) = w \\<Longrightarrow>\n   rev lst ! (length lst - Suc n) = v \\<Longrightarrow>\n   list_swap n lst = Some ([v] @ take (n - 1) (drop 1 lst) @ [w] @ (drop (n + 1) lst))\"\napply(subgoal_tac \"0 < length lst\")\n apply(simp add: rev_lookup list_swap_def)\napply auto\ndone\n\nlemma inst_swap_sound:\nnotes\n  if_split[split del]\nshows\n\"triple_inst_sem net\n        (\\<langle> h \\<le> 1023 \\<and>\n           Suc (unat n) \\<le> h \\<and> Gverylow \\<le> g\\<rangle> \\<and>*\n         stack_height (Suc h) \\<and>*\n         stack h w \\<and>*\n         stack (h - unat n - 1) v \\<and>*\n         program_counter k \\<and>*\n         gas_pred g \\<and>* continuing \\<and>* rest)\n        (k, Swap n)\n        (program_counter (k + 1) \\<and>*\n         gas_pred (g - Gverylow) \\<and>*\n         stack_height (Suc h) \\<and>*\n         stack h v \\<and>*\n         stack (h - unat n - 1) w \\<and>*\n         continuing \\<and>* rest)\"\napply(simp add: triple_inst_sem_def program_sem.simps as_set_simps)\napply(clarify)\napply(sep_simp simp: evm_sep; simp)\napply(simp split: instruction_result.splits)\napply(simp add: stateelm_means_simps stateelm_equiv_simps)\napply(simp add: vctx_next_instruction_def set_diff_eq)\napply(clarsimp simp add: instruction_simps list_swap_usage)\napply((sep_simp simp: evm_sep; simp add: set_diff_eq)+)\napply(simp add: stateelm_means_simps stateelm_equiv_simps)\napply(rule conjI)\n apply(erule_tac P=\"(_ \\<and>* _)\" in back_subst)\n apply(rule equalityI; rule subsetI)\n \t\tapply(clarsimp)\n apply(rename_tac elm; simp add: as_set_simps)\n apply(case_tac elm; clarsimp simp add: instruction_result_as_set_def stateelm_equiv_simps)\n \t\tapply(rename_tac pair)\n \t\tapply(case_tac \"pair = length t - Suc (unat n)\")\n \t\t apply(simp)\n \t\tapply(clarsimp)\n \t\tapply(case_tac \"Suc (unat n) = length t\")\n \t\t apply(clarsimp simp add: min_def short_rev_append)\n \t\t apply(simp add: rev_take rev_append_eq)\n \t\tapply(simp add: rev_take rev_append_eq min_def)\n \t\tapply(subgoal_tac \"length t > 0\"; clarsimp)\n \t\tapply(split if_splits; clarsimp)\n \t\t apply(simp add: rev_nth)\n \t\t apply(subst (asm) Suc_diff_Suc)\n \t\t\tapply(arith)\n \t\t apply(simp)\n \t\tapply(simp add: rev_nth not_less nth_append split: if_splits)\n \t apply(clarsimp simp add: as_set_simps)\n \t apply(rename_tac elm, case_tac elm; simp)\n \t  apply(clarsimp)\n \tapply(rename_tac pair)\n \t\t \t\tapply(case_tac \"pair = length t - Suc (unat n)\")\n \t\t apply(simp)\n \t\tapply(clarsimp)\n \t\tapply(case_tac \"Suc (unat n) = length t\")\n \t\t apply(clarsimp simp add: min_def short_rev_append)\n \t\t apply(simp add: rev_take rev_append_eq)\n \t\tapply(simp add: rev_take rev_append_eq min_def)\n \t\tapply(subgoal_tac \"length t > 0\"; clarsimp)\n \t\tapply(split if_splits; clarsimp)\n \t\t apply(simp add: rev_nth)\n \t\t apply(subst (asm) Suc_diff_Suc)\n \t\t\tapply(arith)\n \t\t apply(simp)\n \t\tapply(simp add: rev_nth not_less nth_append split: if_splits)\napply(arith)\n  done\n\n\t\tlemma variable_context_pc_change:\n\"variable_ctx_as_set (x1\\<lparr>vctx_pc := vctx_pc x1 + 1\\<rparr>) = insert (PcElm (vctx_pc x1 + 1)) (variable_ctx_as_set x1) - {PcElm (vctx_pc x1)}\"\nby (auto simp add: as_set_simps)\n\n\tlemma memory_elm_in_memory_range_elms:\n\t\"x \\<in> memory_range_elms memaddr v \\<Longrightarrow> \\<exists>a b. x = MemoryElm (a, b)\"\n\tapply(induction v arbitrary: memaddr; simp)\n\tapply(erule disjE; simp)\n\tdone\n\nlemma memory_elm_in_memory_range_elms':\n\t\"\\<forall>a b. x \\<noteq> MemoryElm (a,b) \\<Longrightarrow> x \\<notin> memory_range_elms m v\"\n\tapply(rule notI)\n\tapply(drule memory_elm_in_memory_range_elms)\n\tapply(simp)\n\tdone\n\t\t\n\t\tlemma memory_range_pc_update :\n  \"x \\<in> memory_range_elms in_begin input \\<Longrightarrow>\n   x \\<in> variable_ctx_as_set\n               (x1\n                \\<lparr>vctx_pc := p \\<rparr>) =\n   (x \\<in> variable_ctx_as_set x1)\"\n   by (auto simp: as_set_simps dest: memory_range_elms_all)\n\nlemmas memory_range_elms_set_simps=\n\tmemory_range_elms_in_c\n\tmemory_range_in_minus_balance_as\n\tmemory_range_in_union_balance\n\tmemory_range_constant_union\n\tmemory_range_in_caller\n\tmemory_range_in_coinbase\n\tmemory_range_insert_cont\n\tmemory_range_elms_in_insert_continuing\n\tmemory_range_elms_in_insert_contract_action\n\tmemory_range_elms_in_insert_gas\n\tmemory_range_elms_in_mu\n\tmemory_range_in_origin\n\tmemory_range_in_pc\n\tmemory_range_in_sent_value\n\tnot_memory_range_elms_all\n\tmemory_range_elms_i\n\tmemory_range_advance\n\tmemory_range_elms_in_minus_statck_topmost\n\tmemory_range_elms_logs_update\n\tmemory_range_elms_update_balance\n\tmemory_range_elms_update_memory_usage\n\tmemory_gane_elms_in_stack_update\n\tmemory_range_in_minus_balance\n\tmemory_range_elms_in_x_minus_lognum\n\tmemory_range_elms_in_minus_continuing\n\tmemory_range_elms_in_minus_gas\n\tmemory_range_elms_in_minus_mu\n\tmemory_range_elms_in_minus_stack\n\tmemory_range_elms_in_minus_stackheight\n\tmemory_range_elms_in_minus_this\n\tmemory_range_elms_not_account_existence\n\tmemory_range_elms_not_code\n\tmemory_range_elms_not_pc\n\tmemory_range_elms_not_continuing\n\tmemory_range_continue\n\tmemory_range_advance_pc\n\tmemory_range_balance\n\tmemory_range_gas_update\n\tmemory_range_memory_usage\n\tmemory_range_stack\n\tmemory_range_elms_cut_memory\n\tmemory_elm_in_memory_range_elms\n\tmemory_elm_in_memory_range_elms'\n\tmemory_range_elms_all\n\tmemory_range_pc_update\n\nlemma inst_mload_sound :\nnotes\n  unat_bintrunc[simp del]\nshows\n\"triple_inst_sem net\n  (\\<langle> h \\<le> 1023  \\<and> g \\<ge> Gverylow - Cmem memu + Cmem (M memu memaddr 32) \\<and> memu \\<ge> 0 \\<and>\n    length (word_rsplit v::byte list) = unat (32::w256)\\<rangle> \\<and>*\n   stack h memaddr \\<and>* stack_height (Suc h) \\<and>* program_counter n \\<and>*   \n   memory_usage memu \\<and>* memory memaddr v \\<and>* gas_pred g \\<and>* continuing \\<and>* rest)\n  (n, Memory MLOAD)\n  (program_counter (n + 1) \\<and>* stack_height (Suc h) \\<and>* stack h v \\<and>*\n   memory memaddr v \\<and>* memory_usage (M memu memaddr 32) \\<and>*\n   gas_pred (g - Gverylow + Cmem memu - Cmem (M memu memaddr 32)) \\<and>*\n   continuing \\<and>* rest)\"\n  apply(simp add: triple_inst_sem_def program_sem.simps as_set_simps instruction_sem_def)\n  apply(clarify)\n  apply(simp add: memory_def)\n  apply(sep_simp simp: pure_sep)\n  apply(sep_simp simp: evm_sep; simp)\n  apply(simp add: memory_range_sep)\n\tapply(simp split: instruction_result.splits)\n\tapply(simp add: stateelm_means_simps stateelm_equiv_simps)\n \tapply(simp add: memory_range_elms_set_simps)\n\tapply(cut_tac memory_range_elms_cut_memory[where lst=\"word_rsplit v\"])\n\tapply(drule spec2[where x=memaddr and y=32]; simp)\n  apply(drule mp, assumption)\n  apply(simp add: vctx_next_instruction_def)\n  apply(clarsimp)\n  apply(simp add: instruction_simps)\n  apply (unfold Let_def)\n  apply (simp add: max_absorb2)\n\tapply((sep_simp simp: evm_sep)+)\n  apply(simp add: variable_context_pc_change)\n  apply(simp add: read_word_from_bytes_def unat_bintrunc byte_list_fill_right_def word_rcat_rsplit)\n\tapply(simp add: stateelm_means_simps stateelm_equiv_simps)\n  apply(simp add: memory_range_elms_set_simps)\n\tapply(rule conjI)\n   apply(erule_tac P=\"(_ \\<and>* _)\" in back_subst)\n  apply(set_solve)\n \tapply(clarsimp)\n\tapply(simp add: memory_range_elms_set_simps)\n\tapply(fastforce)\n done\n\n\t(*MSTORE*)\nlemma store_list_mem_gt:\n\"unat (p - pos) \\<ge> length lst \\<Longrightarrow>\n store_byte_list_memory pos lst orig p = orig p\"\napply(induction lst arbitrary: pos)\n apply(simp add: store_byte_list_memory_def)\napply(subst store_byte_list_memory_def)\napply(simp split: option.splits)\ndone\n\nlemma store_list_mem_ls:\n\"unat (p - pos) < length lst \\<Longrightarrow>\n store_byte_list_memory pos lst orig p = lst ! unat (p-pos)\"\napply(induction lst arbitrary: pos)\n apply(simp add: store_byte_list_memory_def)\napply(subst store_byte_list_memory_def)\napply(simp split: option.splits)\ndone\n\nlemma tmp003:\n\"n < 35 \\<Longrightarrow> unat (x - p::w256) < n \\<Longrightarrow> unat (x - p + 2) < Suc (Suc n)\"\napply(subgoal_tac \"unat (x-p+2)-2 < n\")\n apply(auto)[1]\n using unat_add_lem\napply(insert unat_add_lem[where x=\"x-p\" and y=2])[1]\napply(drule iffD1)\n apply(auto)\ndone\n\nlemma  unat_minus_Suc:\n\" 0 < unat (x - pos::w256) \\<Longrightarrow> unat (x - pos) = Suc (unat (x - (pos + 1)))\"\napply(subgoal_tac \"unat (1+ (x - (pos + 1))) = Suc (unat (x - (pos + 1)))\")\n apply(auto)[1]\napply(rule unatSuc)\napply(simp add: unat_gt_0)\ndone\n\nlemma store_blst_mem_append:\nnotes\n  if_split[split del]\nshows\n\"length lst < 32 \\<Longrightarrow>\nstore_byte_list_memory pos (a # lst) orig =\n((store_byte_list_memory (pos+1) lst orig)(pos:=a))\"\napply(rule ext)\napply(induction lst arbitrary: pos a)\n apply(case_tac \"unat (x - pos) < length [a]\")\n  apply(clarsimp simp add: store_list_mem_ls unat_eq_0)\n apply(clarsimp split: if_split)\n apply(rule conjI)\n  apply(simp add: unat_gt_0)\n apply(simp add: store_list_mem_gt)\napply(case_tac \"x=pos\")\n apply(simp add: store_list_mem_ls)\napply(drule_tac x=x in meta_spec)\napply(drule_tac x=\"pos + 1\" and y=\"a\" in meta_spec2)\napply(drule meta_mp)\n apply(simp)\napply(clarsimp)\napply(case_tac \"x=pos+1\")\n apply(simp add: store_list_mem_ls)\napply(clarsimp)\napply(case_tac \"unat (x-pos) < length (aa#a#lst)\")\n apply(simp add: store_list_mem_ls)\n apply(drule sym)\n apply(simp)\n apply(subst store_list_mem_ls)\n  apply(simp)\n  apply(cut_tac pos=pos and x=x in unat_minus_Suc)\n   apply(simp add: unat_gt_0)\n  apply(simp)\n apply(insert unatSuc)[1]\n apply(drule_tac x=\"x - (pos + 1)\" in meta_spec)\n apply(simp)\napply(simp add: store_list_mem_gt)\napply(drule sym, simp)\napply(subst store_list_mem_gt; simp)\napply(simp add: not_less_eq)\napply(cut_tac pos=pos and x=x in unat_minus_Suc)\n apply(simp add: unat_gt_0)\napply(simp)\ndone\n\nlemma memory_as_set_append:\n\"memory_as_set\n (z(memaddr:=a)) =\ninsert (MemoryElm (memaddr, a))\n(memory_as_set z - {MemoryElm (memaddr, z memaddr)})\"\napply(simp add: memory_as_set_def)\napply(rule subset_antisym)\n apply(rule subsetI)\n apply(case_tac \"x = (MemoryElm (memaddr, a))\")\n  apply(clarsimp)\n apply(clarsimp)\napply(rule subsetI)\napply(clarsimp)\napply(erule disjE)\n apply(simp)\napply(erule conjE)\napply(erule exE)\napply(rule_tac x=aa in exI)\napply(clarsimp)\ndone\n\nlemma memory_elm_in_vctx:\n\"(MemoryElm (a,b)\n   \\<in> variable_ctx_as_set v) =\n(MemoryElm (a,b)\n   \\<in> memory_as_set (vctx_memory v))\"\nby (auto simp add: as_set_simps)\n\nlemma memory_range_elms_in_vctx:\n\"(memory_range_elms memaddr lst\n   \\<subseteq> variable_ctx_as_set v) =\n(memory_range_elms memaddr lst\n  \\<subseteq> memory_as_set (vctx_memory v))\"\nby (auto simp add: as_set_simps memory_range_elms_set_simps)\n\nlemma word_of_int_n0:\n\"0 < k \\<Longrightarrow> k < 2^256\\<Longrightarrow> (word_of_int k::w256) \\<noteq> 0\"\napply(subst zero_word_def)\napply(subst word_of_int_inj; simp)\ndone\n\nlemma ind_memory_rg_elms:\n\"k > 0 \\<Longrightarrow> k < 2^256 - int (length lst) \\<Longrightarrow>\nMemoryElm (m, b) \\<notin> memory_range_elms (m + word_of_int k) lst\"\napply(induction lst arbitrary:  k)\n apply(simp)\napply(rule notI)\napply(simp)\napply(simp add:word_of_int_n0)\napply(drule_tac x=\"k+1\" in meta_spec)\napply(simp add: wi_hom_syms(5))\napply(simp add: word_succ_p1)\napply(subgoal_tac \"m + word_of_int k + 1=m + (word_of_int k + 1)\"; simp)\ndone\n\nlemma memory_range_elms_in_store:\n\"length lst \\<le> unat (32::w256) \\<Longrightarrow>\nmemory_range_elms memaddr lst\n   \\<subseteq> memory_as_set\n       (store_byte_list_memory memaddr lst mem)\"\napply(induction lst arbitrary: memaddr; simp)\napply(rule context_conjI)\n apply(simp add: store_byte_list_memory_def memory_as_set_def)\napply(clarsimp)\napply(case_tac x; clarsimp simp add: stateelm_means_simps stateelm_equiv_simps memory_range_elms_set_simps)\napply(subst store_blst_mem_append, simp)\napply(simp add:  memory_as_set_append)\napply(case_tac \"aa=memaddr\")\n apply(simp)\n apply(cut_tac m=memaddr and k=1 and lst=lst and b=b in ind_memory_rg_elms; simp)\napply(simp)\napply(drule_tac x=\"memaddr + 1\" in meta_spec)\napply(drule rev_subsetD; simp)\ndone\n\nlemma diff_set_commute_sing:\n\"A - {b} - {c} = A - {c} - {b}\"\nby(auto)\n\nlemma diff_memory_elms_commute_fst:\n\"A - {b} - memory_range_elms x y = A - memory_range_elms x y - {b}\"\napply(induction y arbitrary: x; simp)\napply(rule subset_antisym; rule subsetI)\n apply(simp add: diff_set_commute_sing[where b=\"MemoryElm _\"])+\ndone\n\nlemma diff_memory_elms_commute_end:\n\"A - memory_range_elms x y - {b} = A - {b} - memory_range_elms x y\"\napply(induction y arbitrary: x; simp)\napply(rule subset_antisym; rule subsetI)\n apply(simp add: diff_set_commute_sing[where b=\"MemoryElm _\"])+\ndone\n\nlemma memory_elms_out_of_range:\n\"length v \\<le> unat (a - m) \\<Longrightarrow>\n MemoryElm (a, b) \\<notin> memory_range_elms m v\"\napply(induction v arbitrary: m; simp)\napply(case_tac \"a=m\"; simp)\napply(drule_tac x=\"m+1\" in meta_spec)\napply(drule meta_mp)\n apply(cut_tac pos=m in unat_minus_Suc[where x=a]; simp)\napply(simp)\ndone\n\nlemma memory_elms_in_range:\n\"length lst < 2^256 \\<Longrightarrow>\n(unat (a - m) < length lst \\<and>\n lst ! unat (a - m) = x ) =\n (MemoryElm (a, x) \\<in> memory_range_elms m lst)\"\napply(rule iffI)\napply(induction lst arbitrary: m; simp)\napply(case_tac \"a=m\"; simp)\napply(drule_tac x=\"m+1\" in meta_spec)\napply(drule meta_mp)\n  apply(cut_tac pos=m in unat_minus_Suc[where x=a];simp add: unat_gt_0)\n apply(cut_tac pos=m in unat_minus_Suc[where x=a];simp add: unat_gt_0)\napply(induction lst arbitrary: m; simp)\napply(case_tac \"a=m\"; simp)\n apply(erule disjE, simp)\n apply(cut_tac m=m and k=1 and lst=lst and b=x in ind_memory_rg_elms; simp)\napply(drule_tac x=\"m+1\" in meta_spec)\napply(drule meta_mp)\n  apply(cut_tac pos=m in unat_minus_Suc[where x=a];simp add: unat_gt_0)\n apply(cut_tac pos=m in unat_minus_Suc[where x=a];simp add: unat_gt_0)\n  done\n  \t\n  \tlemma memory_elms_not_in_range:\n\"length lst < 2^256 \\<Longrightarrow>\n(MemoryElm (a, x) \\<notin> memory_range_elms m lst) =\n(\\<not>(unat (a - m) < length lst \\<and>\n lst ! unat (a - m) = x ))\"\n \t\t\tby(simp add: memory_elms_in_range)\n \t\t\t\t\nlemma elm_in_range_in_lst:\n\t\"unat n < length lst \\<Longrightarrow>\n MemoryElm (m+ n, lst ! unat n) \\<in> memory_range_elms m lst\"\n\tapply(induction lst arbitrary:n m; simp)\n\tapply(subst disj_commute)\n\tapply(rule disjCI)\n\tapply(clarsimp)\n\tapply(case_tac \"n=0\"; simp)\n\t\tapply(drule_tac x=\"n - 1\" and y=\"m+1\" in meta_spec2)\n\tapply(drule meta_mp)\n\t apply(simp add: unat_minus_one )\n\t apply(subst less_diff_conv2)\n\t  apply(subst (asm) word_neq_0_conv)\n\t  apply(subst (asm) word_less_nat_alt)\n\t  apply(arith)\n\t apply(arith)\n\tapply(simp add: unat_minus_one)\n\t\tapply(subgoal_tac \"unat n > 0\"; simp)\n\t\t\t  apply(simp add:  word_neq_0_conv word_less_nat_alt)\n\tdone\n\t\t\nlemma in_mem_not_in_range:\n\t\"length lst < 2^256 \\<Longrightarrow>\n\tmemory_range_elms m lst \\<subseteq> memory_as_set (vctx_memory x) \\<Longrightarrow>\n\tMemoryElm (a, b) \\<in> memory_as_set (vctx_memory x) \\<Longrightarrow>\n\tMemoryElm (a, b) \\<notin> memory_range_elms m lst \\<Longrightarrow>\n\tunat (a - m) \\<ge> length lst\"\n\tapply(simp add: memory_as_set_def)\n\tapply(simp add: memory_elms_not_in_range)\n\tapply(case_tac \"length lst \\<le> unat (a - m)\"; simp)\n\tapply(simp add: not_le)\n\tapply(simp add: subset_eq Ball_def)\n\tapply(insert elm_in_range_in_lst[where n=\"a-m\" and m=m and lst=lst], simp)\n\tapply(drule spec[where x=\"MemoryElm (a, lst ! unat (a - m))\"])\n\tapply(simp)\n\tdone\n\t\t\nlemma vctx_memory_store_memory_set_eq:\n\"length (word_rsplit v::byte list) < 2^256 \\<Longrightarrow>\nmemory_range_elms memaddr (word_rsplit old_v)\n    \\<subseteq> memory_as_set (vctx_memory x1) \\<Longrightarrow>\n    length (word_rsplit old_v::byte list) =  length (word_rsplit v::byte list) \\<Longrightarrow>\n    memory_range_elms memaddr (word_rsplit v)\n    \\<subseteq> memory_as_set (store_word_memory memaddr v (vctx_memory x1)) \\<Longrightarrow>\n    contexts_as_set\n     (x1\\<lparr>vctx_memory := store_word_memory memaddr v (vctx_memory x1)\\<rparr>)\n     co_ctx -\n    memory_range_elms memaddr (word_rsplit v) =\n    contexts_as_set x1 co_ctx -\n    memory_range_elms memaddr (word_rsplit old_v)\"\napply(simp add: contexts_as_set_def)\napply(rule subset_antisym; rule subsetI)\n\t apply(case_tac \"\\<exists>a b. x = MemoryElm (a,b)\")\n\t  apply(clarsimp simp add: memory_elm_not_constant memory_range_elms_set_simps)\n\t  apply(simp add: memory_elms_not_in_range)\n\t  apply(rule conjI)\n\t  \t\tapply(thin_tac \" _ \\<subseteq> _\", thin_tac \"_=_\", thin_tac \"_\\<subseteq>_\")\n\t\t apply(simp add: stateelm_means_simps stateelm_equiv_simps)\n\t\t apply(simp add: store_word_memory_def store_byte_list_memory_def)\n\tapply(split option.splits; clarsimp)\n\t\tapply(clarsimp)\n\t\tapply(simp add: stateelm_means_simps stateelm_equiv_simps)\n apply(simp add: store_word_memory_def store_byte_list_memory_def)\n apply(rename_tac elm, case_tac elm; simp add: stateelm_means_simps memory_range_elms_set_simps stateelm_equiv_simps)\n apply(simp add: as_set_simps)\n \t apply(simp add: as_set_simps)\n \t  \n \tapply(case_tac \"\\<exists>a b. x = MemoryElm (a,b)\")\n \t prefer 2\n \t  apply(rename_tac elm, case_tac elm; simp add: stateelm_means_simps memory_range_elms_set_simps stateelm_equiv_simps)\n apply(simp add: as_set_simps)\n apply(simp add: as_set_simps)\n\n\t  apply(clarsimp simp add: memory_elm_not_constant memory_range_elms_set_simps)\n\tapply(simp add: memory_elm_in_vctx)\n\tapply(insert in_mem_not_in_range[where m=memaddr])\n\t\tapply(drule_tac x=\"word_rsplit old_v::byte list\" and y=\"x1\"in meta_spec2)\n\tapply(drule_tac x=a and y=b in meta_spec2)\n\t\tapply(clarsimp)\n\tapply(subst memory_elms_not_in_range, simp)\n\t  \t\tapply(thin_tac \" _ \\<subseteq> _\", thin_tac \"_=_\", thin_tac \"_\\<subseteq>_\")\n\t\t apply(simp add: memory_as_set_def)\n\t\t apply(simp add: store_word_memory_def store_byte_list_memory_def)\ndone\n\nlemma memory_in_mem_as_set:\n\"x \\<in> memory_as_set m \\<Longrightarrow> \\<exists>a b. x= MemoryElm (a,b)\"\nby(auto simp add: as_set_simps)\n\n\nlemma inst_mstore_sound :\nnotes\n  unat_bintrunc[simp del]\nshows\n\"triple_inst_sem net\n  (\\<langle> h \\<le> 1022 \\<and> g \\<ge> Gverylow - Cmem memu + Cmem (M memu memaddr 32) \\<and> memu \\<ge> 0 \\<and>\n    length (word_rsplit old_v::byte list) = unat (32::w256) \\<and>\n    length (word_rsplit v::byte list) = unat (32::w256) \\<and> memaddr \\<le> -32\\<rangle> \\<and>*\n   stack (h+1) memaddr \\<and>* stack h v \\<and>* stack_height (h+2) \\<and>*\n   program_counter n \\<and>* memory_usage memu \\<and>*\n   memory memaddr old_v \\<and>* gas_pred g \\<and>* continuing \\<and>* rest)\n  (n, Memory MSTORE)\n  (program_counter (n + 1) \\<and>* stack_height h \\<and>* memory memaddr v \\<and>* \n   gas_pred (g - Gverylow + Cmem memu - Cmem (M memu memaddr 32)) \\<and>*\n   memory_usage (M memu memaddr 32) \\<and>* continuing \\<and>* rest)\"\napply(simp add: triple_inst_sem_def program_sem.simps as_set_simps instruction_sem_def)\napply(clarify)\napply(simp add: memory_def)\napply(sep_simp simp: pure_sep)\n\tapply(sep_simp simp: evm_sep; simp, (erule conjE)?)+\n\tapply(simp split: instruction_result.splits add: memory_range_sep)\n\tapply(simp add: stateelm_means_simps stateelm_equiv_simps)\napply(simp add: vctx_next_instruction_def)\napply(clarsimp simp add: rev_nth)\napply(simp add: instruction_simps Let_def max_absorb2)\napply(subst conj_commute, rule context_conjI)\n\tapply(simp add: memory_range_elms_set_simps)\n\tapply(simp add: store_word_memory_def memory_range_elms_in_vctx)\n  apply(simp only: memory_range_elms_in_store)\napply(erule_tac P=\"(_ \\<and>* _)\" in back_subst)\napply(simp add: diff_set_commute_sing[where c=\"ContinuingElm True\"])\n\tapply(simp add: diff_memory_elms_commute_fst  memory_range_elms_in_vctx)\n\tapply(simp add: memory_range_elms_set_simps)\n\tapply(rule subst[OF vctx_memory_store_memory_set_eq[where old_v=old_v and v=v]]; simp?)\n\t\tapply(simp add:  memory_range_elms_in_vctx)\n\t\tapply(simp add: store_word_memory_def memory_range_elms_in_store)\n\t\t apply(subgoal_tac \"unat (32::w256) = 32\"; simp add: unat_def)\n\t\tapply(simp add: memory_range_elms_in_vctx)\n\t\tapply(simp add: memory_range_elms_in_vctx)\n\t\t apply(simp add: diff_memory_elms_commute_end)\napply(rule arg_cong[where f=\"\\<lambda>u. u - memory_range_elms _ _\"])\napply(rule subset_antisym; rule subsetI)\napply(simp add: memory_range_elms_set_simps)\n\t apply(case_tac \"\\<exists>a b. x= MemoryElm (a,b)\"; clarsimp)\n\t  \tapply(simp add: stateelm_means_simps stateelm_equiv_simps)\n\t apply(case_tac x; clarsimp simp add: stateelm_means_simps stateelm_equiv_simps)\n\t apply(case_tac \"a=length ta\"; clarsimp)\n\t apply(case_tac \"a<length ta\"; clarsimp)\n\t apply(erule notE, simp add: short_rev_append)\n\tapply(clarsimp)\n\tapply(case_tac x; clarsimp simp add: stateelm_means_simps stateelm_equiv_simps)\n\tapply(simp add: short_rev_append)\n\tdone\n\nlemma inst_return_sem :\nnotes\n  if_split[split del]\nshows\n  \"triple_inst_sem net\n    (\\<langle> h \\<le> 1022 \\<and> m \\<ge> 0 \\<and> length lst = unat v \\<and> (Cmem (M m u v) - Cmem m) \\<le> g \\<rangle> \\<and>*\n     continuing \\<and>* memory_usage m \\<and>* memory_range u lst \\<and>*\n     program_counter n \\<and>* stack_height (Suc (Suc h)) \\<and>* gas_pred g \\<and>*\n     stack (Suc h) u \\<and>* stack h v \\<and>* rest)\n    (n, Misc RETURN)\n    (stack_height (Suc (Suc h)) \\<and>* not_continuing \\<and>* memory_usage (M m u v) \\<and>*\n     action (ContractReturn lst) \\<and>* gas_pred (g - (Cmem (M m u v) - Cmem m)) \\<and>*\n     stack (Suc h) u \\<and>* stack h v \\<and>* memory_range u lst \\<and>*\n     program_counter n \\<and>* rest)\"\n apply(simp add: triple_inst_sem_def)\n apply(simp add: program_sem.simps  as_set_simps instruction_sem_def)\n apply(clarify)\n apply(case_tac presult; clarsimp)\n   defer\n   apply(simp add: as_set_simps)\n   apply(sep_simp simp: continuing_sep; clarsimp)\n apply(sep_simp simp: pure_sep)\n \t\t\tapply(sep_simp simp: evm_sep, simp?, (erule conjE)?)+\n \t\t\t\t apply(simp add: instruction_simps vctx_returned_bytes_def)\n \t\t\tapply(simp add: stateelm_means_simps stateelm_equiv_simps)\n \t\t\t\tapply(simp add: memory_range_sep memory_range_elms_set_simps)\n apply(clarify)\n apply(clarsimp)\n \t\t\tapply(simp add: instruction_simps Let_def max_absorb2)\n \t\t\t\tapply(simp add: stateelm_means_simps stateelm_equiv_simps)\n \t\t\t\tapply(simp add: vctx_returned_bytes_def memory_range_elms_cut_memory)\n apply(rule conjI)\n \t\t\t apply(erule_tac P=\"(_ \\<and>* _)\" in back_subst)\n \t\t\t  \n \t\t\t apply(auto simp add: as_set_simps )[1]\n \t\t\tapply(thin_tac \"(_ \\<and>* _) _\")\n  \t\tapply(subst (asm) subset_eq)\n  \t\tapply(simp add: Ball_def)\n  \t\tapply(clarsimp simp add: memory_range_elms_set_simps)\n  \t\t\tapply(drule_tac x=x in spec, simp)\n  \t\tapply(drule memory_elm_in_memory_range_elms)\n  \t\t\tapply(clarsimp)\n  \t\tapply(simp add: stateelm_means_simps stateelm_equiv_simps)\n  done\n\n  \tlemma inst_dup_sound:\n\"triple_inst_sem net\n  (\\<langle> h \\<le> 1023 \\<and> unat n < h \\<and> Gverylow \\<le> g\\<rangle> \\<and>*\n   stack_height h \\<and>* stack (h - unat n - 1) w \\<and>*\n   program_counter k \\<and>* gas_pred g \\<and>* continuing \\<and>* rest)\n  (k, Dup n)\n  (program_counter (k + 1) \\<and>* gas_pred (g - Gverylow) \\<and>*\n   stack_height (Suc h) \\<and>* stack (h - unat n - 1) w \\<and>*\n   stack h w \\<and>* continuing \\<and>* rest)\"\napply(simp add: triple_inst_sem_def program_sem.simps as_set_simps)\napply(clarify)\napply(sep_simp simp: evm_sep; simp)\napply(simp split: instruction_result.splits)\napply(simp add: stateelm_means_simps stateelm_equiv_simps)\napply(simp add: vctx_next_instruction_def)\napply(clarsimp simp add: instruction_simps Let_def max_absorb2)\napply((sep_simp simp: evm_sep)+)\napply(simp add: stateelm_means_simps stateelm_equiv_simps)\n\t\t\tapply(simp add: rev_lookup)\n\t\t\tapply(subst conj_commute)\n\t\t\tapply(rule context_conjI)\n\t\t\t apply(rule conjI)\n\t\t\t  apply(arith)\n\t\t\t apply(rule conjI)\n\t\t\t  apply(simp add: short_rev_append rev_nth)\n\t\t\t  apply(arith)\n\t\t\tapply(erule_tac P=\"(_ \\<and>* _)\" in back_subst)\napply(set_solve)\n      done\n\n\nlemma inst_suicide_sem:\n \"triple_inst_sem net\n  (\\<langle> h \\<le> 1024 \\<and> Csuicide (\\<not> existence) net \\<le> g \\<and> at_least_eip150 net\\<rangle> \\<and>*\n   continuing \\<and>* account_existence addr existence \\<and>*\n   program_counter n \\<and>* stack_height (Suc h) \\<and>* gas_pred g \\<and>* stack h (ucast addr) \\<and>* rest)\n  (n, Misc SUICIDE)\n  (stack_height (Suc h) \\<and>* stack h (ucast addr) \\<and>*\n   not_continuing \\<and>*  account_existence addr existence \\<and>*\n   program_counter n \\<and>* action (ContractSuicide addr) \\<and>* gas_pred (g - Csuicide (\\<not> existence) net) \\<and>* rest)\"\n  apply(simp add: triple_inst_sem_def program_sem.simps as_set_simps)\n  apply(clarify)\n  apply(sep_simp simp: evm_sep; simp)\n  apply(simp split: instruction_result.splits)\n  apply(simp add: stateelm_means_simps stateelm_equiv_simps)\n  apply(simp add: vctx_next_instruction_def)\n  apply(clarsimp simp add: instruction_simps)\n  apply(simp add:  vctx_recipient_def vctx_next_instruction_default_def vctx_next_instruction_def)\n  apply(subgoal_tac \"ucast (ucast addr::w256) = addr\")\n   apply(simp)\n   apply((sep_simp simp: evm_sep)+)\n   apply(simp add: stateelm_means_simps stateelm_equiv_simps)\n   apply(erule_tac P=\"(_ \\<and>* _)\" in back_subst)\n   apply(set_solve)\n  apply(subst ucast_ucast_mask)\n  apply(simp add: mask_def)\n done\n\nlemma triple_inst_soundness:\nnotes\n  if_split[split del]\nshows\n  \"triple_inst net p i q \\<Longrightarrow> triple_inst_sem net p i q\"\n  apply(induction rule:triple_inst.induct)\n              apply(erule triple_inst_arith.cases; clarsimp)\n                       apply(inst_sound_set_eq, set_solve)\n                      apply(split if_split, rule conjI, rule impI)\n                      apply(inst_sound_set_eq, set_solve)+\n                     apply(split if_split, rule conjI, rule impI)\n                      apply(inst_sound_set_eq, set_solve)\n                     apply(inst_sound_set_eq, set_solve)\n                    apply(inst_sound_set_eq, set_solve)\n                   apply(inst_sound_set_eq, set_solve)\n                  apply(inst_sound_set_eq, set_solve)\n                 apply(inst_sound_set_eq, set_solve)\n                apply(inst_sound_set_eq, set_solve)\n               apply(split if_split, rule conjI, rule impI)\n                apply(inst_sound_set_eq, set_solve)\n               apply(inst_sound_set_eq, set_solve)\n              apply(split if_split, rule conjI, rule impI)\n               apply(inst_sound_set_eq, set_solve)\n              apply(inst_sound_set_eq, set_solve)\n             apply(inst_sound_set_eq simp: iszero_stack_def, set_solve)\n            apply(erule triple_inst_bits.cases; clarsimp)\n                apply(inst_sound_set_eq, set_solve)\n               apply(inst_sound_set_eq, set_solve)\n              apply(inst_sound_set_eq, set_solve)\n             apply(inst_sound_set_eq, set_solve)\n            apply(inst_sound_set_eq, set_solve)\n           apply(erule triple_inst_info.cases; clarsimp)\n              apply(inst_sound_set_eq, set_solve)\n             apply(inst_sound_set_eq simp: datasize_def, set_solve)\n            apply(inst_sound_set_eq, set_solve)\n           apply(erule triple_inst_memory.cases; clarsimp)\n  \t\t\t\t\t  apply(rule inst_mload_sound[simplified])\n  \t\t\t\t apply(rule inst_mstore_sound[simplified])\n        apply(erule triple_inst_storage.cases; clarsimp)\n         apply(inst_sound_set_eq, set_solve)\n          apply(inst_sound_set_eq, set_solve)\n  \t\t\t\t\tapply(erule triple_inst_misc.cases; clarsimp)\n  \t\t\t\t\t apply(rule inst_stop_sem)\n  \t\t\t\t  apply(rule inst_return_sem)\n           apply(rule inst_suicide_sem)\n    apply(erule triple_inst_pc.cases; clarsimp)\n     apply(inst_sound_set_eq, set_solve)\n    apply(inst_sound_set_eq, set_solve)\n   apply(erule triple_inst_stack.cases; clarsimp)\n    apply(inst_sound_set_eq simp: constant_mark_def, set_solve)\n    \t\tapply(inst_sound_set_eq, set_solve)\n    apply(inst_sound_set_eq simp: cut_data_def, set_solve)\n    \tapply(rule inst_swap_sound)\n  \t apply(rule inst_dup_sound)\n  \tapply(inst_sound_set_eq, set_solve)\n apply(simp add: inst_strengthen_pre_sem)\napply(simp add: inst_false_pre_sem)\ndone\n\n(* Soundness proof for triple_seq rules *)\n\nlemma inst_seq_eq:\n\"triple_inst net P i Q \\<Longrightarrow> triple_seq_sem net P [i] Q\"\n apply(drule triple_inst_soundness)\n apply(simp add: triple_inst_sem_def triple_seq_sem_def)\ndone\n\nlemma seq_compose_soundness:\n\"triple_seq_sem net P xs R \\<Longrightarrow> triple_seq_sem net R ys Q \\<Longrightarrow> triple_seq_sem net P (xs@ys) Q \"\n apply(simp (no_asm) add: triple_seq_sem_def)\n apply clarsimp\n apply(subst (asm) triple_seq_sem_def[where pre=P])\n apply clarsimp\n apply(rename_tac co_ctx presult rest stopper)\n apply(drule_tac x = \"co_ctx\" in spec)\n apply(drule_tac x = \"presult\" in spec)\n apply(drule_tac x = \"code ((set ys) - (set xs)) ** rest\" in spec)\n apply(simp add: code_more sep_conj_commute sep_conj_left_commute)\n apply(drule_tac x = stopper in spec)\n apply(clarsimp simp add: triple_seq_sem_def)\n apply(drule_tac x = \"co_ctx\" in spec)\n apply(drule_tac x = \"program_sem stopper co_ctx (length xs) net presult\" in spec)\n apply(drule_tac x = \"code ((set xs) - (set ys)) ** rest\" in spec)\n apply(simp add: code_more sep_conj_commute sep_conj_left_commute code_union_comm)\n apply(drule_tac x = stopper in spec)\n apply(simp add: execution_continue)\ndone\n\nlemma triple_seq_empty:\n\"(\\<And>s. pre s \\<longrightarrow> post s) \\<Longrightarrow> triple_seq_sem net pre [] post\"\n apply (simp add: triple_seq_sem_def program_sem.simps imp_sepL)\n apply(clarify)\n apply(drule allI)\n apply(simp add: imp_sepL)\ndone\n\nlemma seq_strengthen_pre_sem:\n  assumes  \"triple_seq_sem net P c Q\"\n  and      \"(\\<forall> s. R s \\<longrightarrow> P s)\"\n  shows    \" triple_seq_sem net R c Q\"\n  using assms(1)\n  apply (simp add: triple_seq_sem_def)\n  apply(clarify)\n  apply(drule_tac x = co_ctx in spec)\n  apply(drule_tac x = presult in spec)\n  apply(drule_tac x = rest in spec)\n   apply(erule impE)\n   apply(sep_drule assms(2)[rule_format])\n   apply assumption\n  apply simp\ndone\n\nlemma triple_seq_soundness:\n\"triple_seq net P xs Q \\<Longrightarrow> triple_seq_sem net P xs Q\"\n apply(induction rule: triple_seq.induct)\n    apply(drule inst_seq_eq)\n    apply(rename_tac pre x q xs post)\n    apply(subgoal_tac \"x#xs = [x]@xs\")\n     apply(simp only: seq_compose_soundness)\n    apply(simp)\n   apply(simp add: triple_seq_empty)\n  apply(simp add: seq_strengthen_pre_sem)\n apply(simp add: triple_seq_sem_def pure_sep)\ndone\n\n(* How to compose program_sem and program_sem_t_alt *)\n\nlemma program_sem_t_exec_continue_1:\n\" program_sem_t co_ctx net\n   (program_sem stopper co_ctx (Suc 0) net presult) =\n  program_sem_t co_ctx net presult\"\n apply(case_tac presult)\n   apply(simp add: program_sem.simps next_state_def)\n   apply(insert program_sem_t_no_gas_not_continuing)[1]\n   apply(drule_tac x=x1 and y=co_ctx in meta_spec2)\n   apply(drule_tac x=net in meta_spec)\n   apply(simp split: option.splits)\n   apply (rule conjI)\n    apply (simp add: program_sem_t.simps)\n   apply clarsimp\n   apply (simp add: program_sem_t.simps)\n   apply(clarsimp)\n   apply(simp add: check_resources_def)\n   apply(case_tac \"inst_stack_numbers x2\"; clarsimp)\n   apply(case_tac \"instruction_sem x1 co_ctx x2 net\")\n     apply(drule_tac x=x1a in spec; simp)\n    apply (simp)+\n  apply (simp add: program_sem.simps next_state_def)\ndone\n\nlemma program_sem_t_exec_continue:\n\"program_sem_t co_ctx net (program_sem stopper co_ctx k net presult) =\n       program_sem_t co_ctx net presult\"\n apply(induction k arbitrary: presult)\n  apply(simp add: program_sem.simps next_state_def)\n apply(drule_tac x=\"program_sem stopper co_ctx 1 net presult\" in meta_spec)\n apply(simp add:program_sem_t_exec_continue_1 execution_continue)\ndone\n\n(* Define the semantic of triple_blocks using program_sem_t and prove it sound *)\n\ndefinition triple_blocks_sem_t :: \"network \\<Rightarrow> basic_blocks \\<Rightarrow> pred \\<Rightarrow> vertex \\<Rightarrow> pred \\<Rightarrow> bool\" where\n\"triple_blocks_sem_t net c pre v post ==\n    \\<forall> co_ctx presult rest (stopper::instruction_result \\<Rightarrow> unit).\n        wf_blocks c \\<longrightarrow>\n        block_lookup c (v_ind v) = Some (snd v) \\<longrightarrow>\n       (pre ** code (blocks_insts c) ** rest) (instruction_result_as_set co_ctx presult) \\<longrightarrow>\n       ((post ** code (blocks_insts c) ** rest) (instruction_result_as_set co_ctx\n            (program_sem_t co_ctx net presult))) \"\n\n(* Lemmas to group code elements *)\nlemma block_in_insts_:\n\"(n, b, t) \\<in> set c \\<Longrightarrow>\n    set b \\<subseteq> set (rebuild_with_add c)\"\napply(induction c)\n apply(simp)\napply(simp)\napply(erule disjE)\n apply(clarsimp)\n apply(case_tac t; simp)\napply(case_tac a)\napply(case_tac ca; simp)\napply(auto)\ndone\n\nlemma block_in_insts:\n\"block_lookup c n = Some (b, t) \\<Longrightarrow>\nset b \\<subseteq> blocks_insts c\"\napply(simp add: blocks_insts_def)\napply(drule map_of_SomeD)\napply(simp add: block_in_insts_)\ndone\n\nlemma block_in_insts_wf:\n\"wf_blocks c \\<Longrightarrow>\nblock_lookup c n = Some (b, t) \\<Longrightarrow>\nset b \\<subseteq> blocks_insts c\"\nby(simp add: block_in_insts wf_blocks_def)\n\nlemma decomp_set:\n\"P \\<subseteq> Q =\n(Q = (Q - P) \\<union> P)\"\nby auto\n\nlemma code_decomp:\n\" P \\<subseteq> Q \\<Longrightarrow>\n{CodeElm (pos, i) |pos i.\n         (pos, i) \\<in> Q} =\n({CodeElm (pos, i) |pos i.\n         (pos, i) \\<in> Q \\<and> (pos, i) \\<notin> P} \\<union>\n        {CodeElm (pos, i) |pos i.\n         (pos, i) \\<in> P})\n\"\nby auto\n\nlemma subset_minus:\n\"Q \\<inter> P = {} \\<Longrightarrow> P \\<subseteq> R - Q \\<Longrightarrow> P \\<subseteq> R\"\nby auto\n\nlemma code_code_sep_:\n\"P \\<subseteq> Q \\<Longrightarrow>\n(code P \\<and>* code (Q - P) \\<and>* r) s =\n(code Q \\<and>* r) s\"\n apply(simp add: code_sep)\n apply(rule iffI; rule conjI; (erule conjE)+)\n\t\tapply(simp add: code_decomp)\n\t\tapply(subgoal_tac \"{CodeElm (pos, i) |pos i. (pos, i) \\<in> P} \\<inter> {CodeElm (pos, i) |pos i.\n         (pos, i) \\<in> Q \\<and> (pos, i) \\<notin> P} = {}\")\n\t\t apply(simp add: subset_minus)[1]\n\t\tapply(auto)[1]\n\t apply(auto simp add: subset_minus set_diff_eq  code_decomp Un_commute)[1]\n\tapply(subgoal_tac \"{CodeElm (pos, i) |pos i.\n     (pos, i) \\<in> Q \\<and> (pos, i) \\<notin> P} \\<subseteq> {CodeElm (pos, i) |pos i.\n     (pos, i) \\<in> Q}\")\n\t apply(auto)[1]\n\tapply(auto)[1]\n apply(auto simp add: subset_minus set_diff_eq code_decomp Un_commute)\ndone\n\nlemma code_code_sep:\n\"block_lookup blocks = map_of (all_blocks blocks) \\<Longrightarrow>\nblock_lookup blocks n = Some (insts, ty) \\<Longrightarrow>\n(code (set insts) \\<and>* code (blocks_insts blocks - set insts) \\<and>* r) s =\n(code (blocks_insts blocks) \\<and>* r) s\"\n apply(subgoal_tac \"set insts \\<subseteq> blocks_insts blocks\")\n\tapply(simp only: code_code_sep_)\n apply(simp add: block_in_insts)\ndone\n\n\nlemma code_code_sep_wf:\n\"wf_blocks blocks \\<Longrightarrow>\nblock_lookup blocks n = Some (insts, ty) \\<Longrightarrow>\n(code (set insts) \\<and>* code (blocks_insts blocks - set insts) \\<and>* r) s =\n(code (blocks_insts blocks) \\<and>* r) s\"\nby(simp add: wf_blocks_def code_code_sep)\n\n\nlemma sep_code_code_sep:\n\"block_lookup blocks = map_of (all_blocks blocks) \\<Longrightarrow>\nblock_lookup blocks n = Some (insts, ty) \\<Longrightarrow>\n(p \\<and>* code (set insts) \\<and>* code (blocks_insts blocks - set insts) \\<and>* r) s =\n(p \\<and>* code (blocks_insts blocks) \\<and>* r) s\"\n apply(rule iffI)\n  apply(sep_select_asm 3)\n\tapply(sep_select_asm 3)\n  apply(sep_select 2)\n\tapply(simp only: code_code_sep)\n apply(sep_select 3)\n apply(sep_select 3)\n apply(sep_select_asm 2)\n apply(simp only: code_code_sep)\ndone\n\nlemma sep_code_code_sep_wf:\n\"wf_blocks blocks \\<Longrightarrow>\nblock_lookup blocks n = Some (insts, ty) \\<Longrightarrow>\n(p \\<and>* code (set insts) \\<and>* code (blocks_insts blocks - set insts) \\<and>* r) s =\n(p \\<and>* code (blocks_insts blocks) \\<and>* r) s\"\nby(simp add: wf_blocks_def sep_code_code_sep)\n\nlemma sep_sep_sep_code_code:\n\"block_lookup blocks = map_of (all_blocks blocks) \\<Longrightarrow>\nblock_lookup blocks n = Some (insts, ty) \\<Longrightarrow>\n(p \\<and>* q \\<and>* r \\<and>* code (set insts) \\<and>* code (blocks_insts blocks - set insts)) s =\n(p \\<and>* q \\<and>* r \\<and>* code (blocks_insts blocks)) s\"\n apply(rule iffI)\n  apply(sep_select_asm 5)\n\tapply(sep_select_asm 5)\n  apply(sep_select 4)\n\tapply(simp only: code_code_sep)\n apply(sep_select 5)\n apply(sep_select 5)\n apply(sep_select_asm 4)\n apply(simp only: code_code_sep)\ndone\n\n(*NEXT case *)\n\nlemma blocks_next_sem_t:\n\" wf_blocks blocks \\<Longrightarrow>\n block_lookup blocks n = Some (insts, Next) \\<Longrightarrow>\n block_lookup blocks (n + inst_size_list insts) = Some (bi, ti) \\<Longrightarrow>\n triple_seq net pre insts\t(program_counter (n + inst_size_list insts) \\<and>* q) \\<Longrightarrow>\n triple_sem_t net\n\t(program_counter (n + inst_size_list insts) \\<and>* q)\n\t(blocks_insts blocks) post \\<Longrightarrow>\n triple_sem_t net pre (blocks_insts blocks) post\"\n apply(drule triple_seq_soundness)\n apply(simp only: triple_seq_sem_def triple_sem_t_def)\n apply(rule allI)+\n apply(clarify)\n apply(rename_tac co_ctx presult rest stopper)\n apply(drule_tac x = \"co_ctx\" in spec)+\n apply(drule_tac x = \"(program_sem stopper co_ctx (length insts) net presult)\" in spec)\n apply(drule_tac x = \"rest\" in spec)\n apply(drule_tac x = presult in spec)\n apply(drule_tac x = \"code (blocks_insts blocks - set insts) \\<and>* rest\" in spec)\n apply(simp add: sep_code_code_sep_wf)\n apply(drule_tac x = \"stopper\" in spec)\n apply(sep_select_asm 4, sep_select_asm 4)\n apply(simp add: code_code_sep_wf)\n apply(sep_select_asm 3, sep_select_asm 3, simp)\n apply (erule_tac P=\"(post \\<and>* code (blocks_insts blocks) \\<and>* rest)\" in back_subst)\n apply(subst program_sem_t_exec_continue )\n apply(simp)\ndone\n\n(* Definition of uniq_stateelm to say that a set have a most one element for some state elements *)\n\ndefinition\n uniq_stateelm :: \"state_element set \\<Rightarrow> bool\"\nwhere\n \"uniq_stateelm s ==\n(\\<forall>v. PcElm v \\<in> s \\<longrightarrow> (\\<forall>x. PcElm x \\<in> s \\<longrightarrow> x = v)) \\<and>\n(\\<forall>v. GasElm v \\<in> s \\<longrightarrow> (\\<forall>x. GasElm x \\<in> s \\<longrightarrow> x = v)) \\<and>\n(\\<forall>v. StackHeightElm v \\<in> s \\<longrightarrow> (\\<forall>v'. StackHeightElm v' \\<in> s \\<longrightarrow> v' = v)) \\<and>\n(\\<forall>h v. StackElm (h, v) \\<in> s \\<longrightarrow> (\\<forall>v'. StackElm (h, v') \\<in> s \\<longrightarrow> v' = v)) \\<and>\n(\\<forall>v. StackHeightElm v \\<in> s \\<longrightarrow> (\\<forall>h u. h \\<ge> v \\<longrightarrow> StackElm (h,u) \\<notin> s)) \\<and>\n(\\<forall>h v. MemoryElm (h, v) \\<in> s \\<longrightarrow> (\\<forall>v'. MemoryElm (h, v') \\<in> s \\<longrightarrow> v' = v)) \\<and>\n(\\<forall>h v. StorageElm (h, v) \\<in> s \\<longrightarrow> (\\<forall>v'. StorageElm (h, v') \\<in> s \\<longrightarrow> v' = v)) \\<and>\n(\\<forall>v. MemoryUsageElm v \\<in> s \\<longrightarrow> (\\<forall>x. MemoryUsageElm x \\<in> s \\<longrightarrow> x = v))\"\n\nlemma uniq_gaselm:\n\"s = instruction_result_as_set co_ctx presult \\<Longrightarrow>\n(\\<forall>v. GasElm v \\<in> s \\<longrightarrow> (\\<forall>x. GasElm x \\<in> s \\<longrightarrow> x = v))\"\nby(simp add:instruction_result_as_set_def gasElmEquiv split:instruction_result.splits)\n\nlemma uniq_gaselm_plus[rule_format]:\n\"instruction_result_as_set co_ctx presult = s + y \\<Longrightarrow>\n(\\<forall>v. GasElm v \\<in> s \\<longrightarrow> (\\<forall>x. GasElm x \\<in> s \\<longrightarrow> x = v))\"\nby (drule sym, drule uniq_gaselm, simp add: plus_set_def)\n\nlemma uniq_pcelm:\n\"s = instruction_result_as_set co_ctx presult \\<Longrightarrow>\n(\\<forall>v. PcElm v \\<in> s \\<longrightarrow> (\\<forall>x. PcElm x \\<in> s \\<longrightarrow> x = v))\"\nby(simp add:instruction_result_as_set_def pcElmEquiv split:instruction_result.splits)\n\nlemma uniq_pcelm_plus[rule_format]:\n\"instruction_result_as_set co_ctx presult = s + y \\<Longrightarrow>\n(\\<forall>v. PcElm v \\<in> s \\<longrightarrow> (\\<forall>x. PcElm x \\<in> s \\<longrightarrow> x = v))\"\nby (drule sym, drule uniq_pcelm, simp add: plus_set_def)\n\nlemma uniq_stackheightelm:\n\"x = instruction_result_as_set co_ctx presult \\<Longrightarrow>\n(\\<forall>v. StackHeightElm v \\<in> x \\<longrightarrow> (\\<forall>v'. StackHeightElm v' \\<in> x \\<longrightarrow> v' = v))\"\nby (simp add:instruction_result_as_set_def stackHeightElmEquiv split:instruction_result.splits)\n\nlemma uniq_stackheightelm_plus[rule_format]:\n\"instruction_result_as_set co_ctx presult = x + y \\<Longrightarrow>\n(\\<forall>v. StackHeightElm v \\<in> x \\<longrightarrow> (\\<forall>v'. StackHeightElm v' \\<in> x \\<longrightarrow> v' = v))\"\nby (drule sym, drule uniq_stackheightelm, simp add: plus_set_def)\n\nlemma uniq_stackelm:\n\"x = instruction_result_as_set co_ctx presult \\<Longrightarrow>\n(\\<forall>h v. StackElm (h, v) \\<in> x \\<longrightarrow> (\\<forall>v'. StackElm (h, v') \\<in> x \\<longrightarrow> v' = v))\"\nby (simp add:instruction_result_as_set_def stackElmEquiv split:instruction_result.splits)\n\nlemma uniq_stackelm_plus[rule_format]:\n\"instruction_result_as_set co_ctx presult = x + y \\<Longrightarrow>\n(\\<forall>h v. StackElm (h, v) \\<in> x \\<longrightarrow> (\\<forall>v'. StackElm (h, v') \\<in> x \\<longrightarrow> v' = v))\"\nby (drule sym, drule uniq_stackelm, simp add: plus_set_def)\n\nlemma stack_max_elm:\n\"s = instruction_result_as_set co_ctx presult \\<Longrightarrow>\n(\\<forall>v. StackHeightElm v \\<in> s \\<longrightarrow> (\\<forall>h u. h \\<ge> v \\<longrightarrow> StackElm (h,u) \\<notin> s))\"\nby(simp add:instruction_result_as_set_def stackHeightElmEquiv stackElmEquiv split:instruction_result.splits)\n\nlemma stack_max_elm_plus[rule_format]:\n\"instruction_result_as_set co_ctx presult = s + y \\<Longrightarrow>\n(\\<forall>v. StackHeightElm v \\<in> s \\<longrightarrow> (\\<forall>h u. h \\<ge> v \\<longrightarrow> StackElm (h,u) \\<notin> s))\"\n\tby (drule sym, drule stack_max_elm, simp add: plus_set_def)\n\t\t\nlemma uniq_memuelm:\n\"x = instruction_result_as_set co_ctx presult \\<Longrightarrow>\n(\\<forall>v. MemoryUsageElm v \\<in> x \\<longrightarrow> (\\<forall>v'. MemoryUsageElm v' \\<in> x \\<longrightarrow> v' = v))\"\nby (simp add:instruction_result_as_set_def memory_usage_elm_c_means split:instruction_result.splits)\n\nlemma uniq_memuelm_plus[rule_format]:\n\"instruction_result_as_set co_ctx presult = x + y \\<Longrightarrow>\n(\\<forall>v. MemoryUsageElm v \\<in> x \\<longrightarrow> (\\<forall>v'. MemoryUsageElm v' \\<in> x \\<longrightarrow> v' = v))\"\nby (drule sym, drule uniq_memuelm, simp add: plus_set_def)\n\t\t\nlemma uniq_memelm:\n\"x = instruction_result_as_set co_ctx presult \\<Longrightarrow>\n(\\<forall>h v. MemoryElm (h, v) \\<in> x \\<longrightarrow> (\\<forall>v'. MemoryElm (h, v') \\<in> x \\<longrightarrow> v' = v))\"\nby (simp add:instruction_result_as_set_def memory_elm_means split:instruction_result.splits)\n\nlemma uniq_memelm_plus[rule_format]:\n\"instruction_result_as_set co_ctx presult = x + y \\<Longrightarrow>\n(\\<forall>h v. MemoryElm (h, v) \\<in> x \\<longrightarrow> (\\<forall>v'. MemoryElm (h, v') \\<in> x \\<longrightarrow> v' = v))\"\nby (drule sym, drule uniq_memelm, simp add: plus_set_def)\n\nlemma uniq_storageelm:\n\"x = instruction_result_as_set co_ctx presult \\<Longrightarrow>\n(\\<forall>h v. StorageElm (h, v) \\<in> x \\<longrightarrow> (\\<forall>v'. StorageElm (h, v') \\<in> x \\<longrightarrow> v' = v))\"\n  by(simp add: as_set_simps split:instruction_result.splits)\n\nlemma uniq_storageelm_plus[rule_format]:\n\"instruction_result_as_set co_ctx presult = x + y \\<Longrightarrow>\n(\\<forall>h v. StorageElm (h, v) \\<in> x \\<longrightarrow> (\\<forall>v'. StorageElm (h, v') \\<in> x \\<longrightarrow> v' = v))\"\nby (drule sym, drule uniq_storageelm, simp add: plus_set_def)\n\nlemmas uniq_stateelm_simps=\nuniq_stateelm_def\nuniq_gaselm_plus uniq_pcelm_plus uniq_stackheightelm_plus\nstack_max_elm_plus uniq_stackelm_plus uniq_memuelm_plus\nuniq_memelm_plus uniq_storageelm_plus\n\nlemma inst_res_as_set_uniq_stateelm:\n\"(pre \\<and>* code (blocks_insts blocks) \\<and>* resta)\n        (instruction_result_as_set co_ctx\n          presult) \\<Longrightarrow>\n       \\<exists>s. pre s \\<and> uniq_stateelm s\"\napply(clarsimp simp add: sep_conj_def)\napply(rule_tac x=x in exI)\napply(simp add: uniq_stateelm_simps)\ndone\n\nlemma uniq_stateelm_subset:\n\"Q = P + R \\<Longrightarrow> uniq_stateelm Q \\<Longrightarrow> uniq_stateelm P\"\nby(simp add: uniq_stateelm_simps plus_set_def)\n\nlemma uniq_stateelm_inst_res:\n\"uniq_stateelm (instruction_result_as_set co_ctx presult)\"\napply(case_tac presult)\napply(simp add: as_set_simps uniq_stateelm_simps)+\ndone\n\n(*Lemmas for Jump and Jumpi *)\nlemmas uint_word_reverse = word_of_int_inverse[OF refl]\n\nlemma sep_conj_imp:\n\"(P \\<and>* R) s \\<Longrightarrow> \\<forall>t. P t \\<longrightarrow> Q t \\<Longrightarrow> (Q \\<and>* R) s\"\napply(simp add: sep_conj_def)\napply(fastforce)\ndone\n\nmethod find_q_pc_after_inst =\n(rule exI; rule conjI),\nrule ext,\nrule iffI,\nsep_simp simp: program_counter_sep,\nassumption\n\n(*apply(rule exI; rule conjI)\n apply(rule ext)\n apply(rule iffI)\n  apply(sep_simp simp: program_counter_sep)\n apply(assumption)*)\n\nlemma only_one_pc:\n\"uniq_stateelm s \\<Longrightarrow>\nPcElm n \\<in> s \\<Longrightarrow>\nPcElm (n+1) \\<in> s \\<Longrightarrow>\nFalse\"\napply(simp add: uniq_stateelm_def)\napply(drule conjunct1)\napply(drule spec[where x=n], erule impE, assumption)\napply(drule spec[where x=\"n+1\"], erule impE, assumption)\napply simp\ndone\n\nlemma only_one_gas:\n\"uniq_stateelm s \\<Longrightarrow>\ni > 0 \\<Longrightarrow>\nGasElm g \\<in> s \\<Longrightarrow>\nGasElm (g-i) \\<in> s \\<Longrightarrow>\nFalse\"\napply(simp add: uniq_stateelm_def)\napply(drule conjunct2, drule conjunct1)\napply(drule spec[where x=g], erule impE, assumption)\napply(drule spec[where x=\"g-i\"], erule impE, assumption)\napply simp\n\tdone\n\t\t\n\t\tlemma only_one_stack_elm:\n\"uniq_stateelm s \\<Longrightarrow>\nStackElm (h,v) \\<in> s \\<Longrightarrow>\nStackElm (h,u) \\<in> s \\<Longrightarrow>\nu = v\"\napply(simp add: uniq_stateelm_def)\n\t\t\tdone\n\t\t\t\t\nmethod uniq_state_elm_quasi=\n (simp add: uniq_stateelm_def),\n (rule conjI, fastforce),\n (rule conjI, fastforce),\n (rule conjI, fastforce),\n (rule conjI; clarsimp),\n  (rule conjI; clarsimp),\n (rule conjI; clarsimp)\n\n(*apply (simp add: uniq_stateelm_def)\n           apply(rule conjI, fastforce)\n           apply(rule conjI, fastforce)\n           apply(rule conjI, fastforce)\n           apply(rule conjI; clarsimp)\n            apply(rule conjI; clarsimp)\n           apply(rule conjI; clarsimp)*)\n\nmethod easy_case_pc_after_inst=\n(clarsimp simp add: gas_value_simps evm_sep),\n(rule conjI),\n(erule_tac P=rest in back_subst),\n(auto simp add: uniq_stateelm_def)[1],\n(auto simp add: uniq_stateelm_def)[1]\n\n(*        apply(clarsimp simp add: gas_value_simps sep_fun_simps)\n        apply(rule conjI)\n         apply(erule_tac P=rest in back_subst)\n         apply(auto simp add: uniq_stateelm_def)[1]\n        apply (auto simp add: uniq_stateelm_def)[1]\n*)\n\n\nmethod after_arith_if =\n(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+,\n(clarsimp simp add: gas_value_simps),\n(rule conjI),\n(erule_tac P=\"_ \\<and>* _\" in back_subst),\n(rule  Set.equalityI),\n(simp add: Set.subset_iff, clarify),\n(rule conjI),\n(rule notI; drule only_one_pc; simp),\n(rule conjI, rule notI,simp add: uniq_stateelm_def),\n(rule conjI, rule notI),\n(split if_splits; simp)\n  (*          apply(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps)\n          apply(rule conjI)\n          \t\t\t\t apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n    apply(rule  Set.equalityI)\n             prefer 2\n            apply(auto)[1]\n           apply(simp add: Set.subset_iff, clarify)\n           apply(rule conjI)\n            apply(rule notI; drule only_one_pc; simp)\n            \t\t\t apply(rule conjI, rule notI,simp add: uniq_stateelm_def)\n            \t\t apply(rule conjI, rule notI)\n            \t\t  apply(split if_splits; simp)*)\n\nmethod after_byte =\n(clarsimp simp add: gas_value_simps evm_sep),\n(rule conjI),\n(erule_tac P=rest in back_subst),\n(auto simp add: uniq_stateelm_def)[1],\n(uniq_state_elm_quasi),\n(case_tac \"ha=Suc h\"; simp)\n  (*       apply(clarsimp simp add: gas_value_simps evm_sep)\n       apply(rule conjI)\n        apply(erule_tac P=rest in back_subst)\n        apply(auto simp add: uniq_stateelm_def)[1]\n       apply (uniq_state_elm_quasi)\n       \t\t\t apply(case_tac \"ha=Suc h\"; simp)*)\n\nlemma memaddr_no_overflow:\n \"unat (memaddr::w256) + v \\<le> unat (- 1::w256) \\<Longrightarrow> 0 < v  \\<Longrightarrow> memaddr \\<le> memaddr + 1\"    \n  by unat_arith\n    \nlemma memory_range_elms_le:\n\"MemoryElm (h, v) \\<in> memory_range_elms memaddr xs \\<Longrightarrow> unat memaddr + length xs - 1 \\<le> unat (-1::w256) \\<Longrightarrow>  \nmemaddr \\<le> h\"\n  apply(induct xs arbitrary:v h memaddr, simp)\n  apply clarsimp\n  apply(erule disjE, clarsimp)\n  apply(case_tac \"xs = []\", clarsimp)\n  apply (drule meta_spec)+\n  apply(drule meta_mp, assumption)\n  apply simp\n  apply (drule meta_mp)\n  apply(subst unat_plus_simple[THEN iffD1])\n  apply (erule memaddr_no_overflow, simp)\n  apply simp+\n  apply (drule memaddr_no_overflow, simp)    \n  apply simp\ndone    \n\nlemma memory_range_elms_uniq_stateelm:\n\"unat memaddr + length xs - 1 \\<le> unat (-1::w256) \\<Longrightarrow>  \n MemoryElm (h, v) \\<in> memory_range_elms memaddr xs  \\<longrightarrow> \n    (\\<forall>v'. MemoryElm (h, v') \\<in> memory_range_elms memaddr xs \\<longrightarrow> v' = v)\"\n  apply (induct xs arbitrary: memaddr)\n  apply clarsimp\n  apply clarsimp\n  apply(case_tac \"xs = []\")\n  apply clarsimp\n  apply (rule conjI; clarsimp)\n  apply(drule memory_range_elms_le)\n  apply(subst unat_plus_simple[THEN iffD1])   \n  apply (erule memaddr_no_overflow, simp)\n  apply simp+\n  apply (drule memaddr_no_overflow, simp)    \n  apply simp\n  apply(rule conjI, clarsimp)\n apply(drule memory_range_elms_le)\n  apply(subst unat_plus_simple[THEN iffD1])   \n  apply (erule memaddr_no_overflow, simp)\n  apply simp+\n  apply (drule memaddr_no_overflow, simp)    \n  apply simp\n  apply clarsimp\n  apply(drule_tac x=\"memaddr + 1\" in meta_spec, simp)\n    apply (drule meta_mp)\n  apply(subst unat_plus_simple[THEN iffD1])   \n  apply (erule memaddr_no_overflow, simp)\n  apply simp+\n  done\n    \nlemma memory_range_elms_same_addr:\n \"MemoryElm (a, v) \\<in> memory_range_elms memaddr xs \\<Longrightarrow> length xs \\<le> length zs \\<Longrightarrow>\n       \\<exists>v'. MemoryElm (a, v') \\<in> memory_range_elms memaddr zs\"\n  apply (induct xs arbitrary:memaddr zs ; clarsimp)\n  apply (erule disjE; clarsimp)\n  apply(case_tac zs, simp)\n  apply fastforce\n  apply(case_tac zs, simp)\n  apply fastforce\n  done\n    \nlemma pc_after_inst:\nnotes\n  if_split[split del]\nshows\n\"triple_inst net pre x post \\<Longrightarrow> x = (n, i) \\<Longrightarrow> reg_inst i \\<Longrightarrow>\n\\<exists>s. pre s \\<and> uniq_stateelm s \\<Longrightarrow>\n\\<exists>q. post = (program_counter (n + inst_size i) ** q) \\<and>\n    (\\<exists>s0. (program_counter (n + inst_size i) ** q) s0 \\<and> uniq_stateelm s0)\"\n\n  apply(induct rule: triple_inst.induct; clarsimp)\n \t\t\t\t\t apply(erule triple_inst_arith.cases; clarsimp)\n \t\t(*MUL*)\n           apply(find_q_pc_after_inst)\n           apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, v * w)} \\<union>\n             {GasElm (g-Glow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)} \" in exI)\n           apply(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n           apply(clarsimp simp add: gas_value_simps)\n           apply(rule conjI)\n            apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n            apply(auto simp add: uniq_stateelm_def)[1]\n           apply (uniq_state_elm_quasi)\n  apply(case_tac \"ha=Suc h\"; simp)\n  \t(*DIV*)\n          apply(find_q_pc_after_inst)\n          apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, arith_2_1_low DIV v w)} \\<union>\n             {GasElm (g-Glow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)} \" in exI)\n          apply(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps)\n          apply(rule conjI)\n          \t\t\t\t\t apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n          \t\t\t\t\t apply(auto simp add: uniq_stateelm_def)[1]\n          \t\t\t\t\tapply (uniq_state_elm_quasi)\n  apply(case_tac \"ha=Suc h\"; simp)\n  \t(*MOD*)\n              apply(find_q_pc_after_inst)\n          apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, arith_2_1_low MOD v w)} \\<union>\n             {GasElm (g-Glow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)} \" in exI)\n          apply(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps)\n          apply(rule conjI)\n          \t\t\t\t\t apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n          \t\t\t\t\tapply(auto simp add: uniq_stateelm_def)[1]\n    apply (uniq_state_elm_quasi)\n  apply(case_tac \"ha=Suc h\"; simp)\n  \t(*ADD*)\n  \t              apply(find_q_pc_after_inst)\n          apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, v + w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)} \" in exI)\n          apply(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps)\n          apply(rule conjI)\n          \t\t\t\t apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n    apply(rule  Set.equalityI)\n             prefer 2\n            apply(auto)[1]\n           apply(simp add: Set.subset_iff, clarify)\n           apply(rule conjI)\n            apply(rule notI; drule only_one_pc; simp)\n            \t\t\t apply(rule conjI, rule notI,simp add: uniq_stateelm_def)\n            \t\t\t apply(rule conjI, rule notI)\n    \t\t\t\t\t\t\t apply(drule_tac h=h and v=w and u=\"v+w\" in only_one_stack_elm; simp)\n           apply(rule notI; drule only_one_gas; simp)\n          apply (uniq_state_elm_quasi)\n          \t\t\t\tapply(case_tac \"ha=Suc h\"; simp)\n    (*SUB*)\n      \t              apply(find_q_pc_after_inst)\n          apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, v - w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)} \" in exI)\n          apply(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps)\n          apply(rule conjI)\n          \t\t\t\t apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n    apply(rule  Set.equalityI)\n             prefer 2\n            apply(auto)[1]\n           apply(simp add: Set.subset_iff, clarify)\n           apply(rule conjI)\n            apply(rule notI; drule only_one_pc; simp)\n            \t\t\t apply(rule conjI, rule notI,simp add: uniq_stateelm_def)\n            \t\t\t apply(rule conjI, rule notI)\n    \t\t\t\t\t\t\t apply(drule_tac h=h and v=w and u=\"v-w\" in only_one_stack_elm; simp)\n           apply(rule notI; drule only_one_gas; simp)\n          apply (uniq_state_elm_quasi)\n          apply(case_tac \"ha=Suc h\"; simp)\n    (*inst_GT*)\n      \t              apply(find_q_pc_after_inst)\n          apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, arith_2_1_verylow inst_GT v w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)} \" in exI)\n      apply(after_arith_if)\n    \t\t\t\t\t\t\t apply(drule_tac h=h and v=w and u=\"1\" in only_one_stack_elm; simp)\n    \t\t\t\t\t\t\tapply(drule_tac h=h and v=w and u=\"0\" in only_one_stack_elm; simp)\n    \t\t\t\t\t\t\tapply(rule notI; drule only_one_gas; simp)\n    apply(auto)[1]\n          apply (uniq_state_elm_quasi)\n          \t\t\tapply(case_tac \"ha=Suc h\"; simp)\n    (*inst_EQ*)\n          \t              apply(find_q_pc_after_inst)\n          apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, arith_2_1_verylow inst_EQ v w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)} \" in exI)\n      apply(after_arith_if)\n    \t\t\t\t\t\t\t apply(drule_tac h=h and v=w and u=\"1\" in only_one_stack_elm; simp)\n    \t\t\t\t\t\t\tapply(drule_tac h=h and v=w and u=\"0\" in only_one_stack_elm; simp)\n    \t\t\t\t\t\t apply(rule notI; drule only_one_gas; simp)\n    apply(auto)[1]\n          apply (uniq_state_elm_quasi)\n          \t\t apply(case_tac \"ha=Suc h\"; simp)\n    (*inst_LT*)\n          \t              apply(find_q_pc_after_inst)\n          apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, arith_2_1_verylow inst_LT v w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)} \" in exI)\n              apply(after_arith_if)\n    \t\t\t\t\t\t\t apply(drule_tac h=h and v=w and u=\"1\" in only_one_stack_elm; simp)\n    \t\t\t\t\t\t\tapply(drule_tac h=h and v=w and u=\"0\" in only_one_stack_elm; simp)\n    \t\t\t\t\t\tapply(rule notI; drule only_one_gas; simp)\n    \t\tapply(auto)[1]\n          apply (uniq_state_elm_quasi)\n          \t\tapply(case_tac \"ha=Suc h\"; simp)\n    (*ADDMOD*)\n          \t              apply(find_q_pc_after_inst)\n          apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc (Suc h)))} -\n             {StackElm (Suc (Suc h), u)} - {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, arith_3_1 ADDMOD u v w)} \\<union>\n             {GasElm (g-Gmid)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)} \" in exI)\napply(after_arith_if)\n    \t\t\t\t\t\t\t apply(drule_tac h=h and v=w and u=\"word_of_int\n          ((uint u + uint v) mod uint w)\" in only_one_stack_elm; simp)\n  apply(rule notI; drule only_one_gas; simp)\n  \tapply(auto)[1]\n          apply (uniq_state_elm_quasi)\n          \t apply(case_tac \"ha=Suc (Suc h)\"; simp)\n    apply(case_tac \"ha=Suc h\"; simp)\n  \t(*MULMOD*)\n  \t          \t              apply(find_q_pc_after_inst)\n          apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc (Suc h)))} -\n             {StackElm (Suc (Suc h), u)} - {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, arith_3_1 MULMOD u v w)} \\<union>\n             {GasElm (g-Gmid)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)} \" in exI)\napply(after_arith_if)\n    \t\t\t\t\t\t\t apply(drule_tac h=h and v=w and u=\"word_of_int\n          ((uint u * uint v) mod uint w)\" in only_one_stack_elm; simp)\n  apply(rule notI; drule only_one_gas; simp)\n  \tapply(auto)[1]\n          apply (uniq_state_elm_quasi)\n          \t apply(case_tac \"ha=Suc (Suc h)\"; simp)\n          \tapply(case_tac \"ha=Suc h\"; simp)\n    (*ISZERO*)\n    \t        apply(find_q_pc_after_inst)\n          apply(rule_tac x=\"(s - {PcElm n} -\n             {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, iszero_stack w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {PcElm (n+1)} \" in exI)\n           apply(easy_case_pc_after_inst)\n    (**BITS**)\n    \t\t\tapply(erule triple_inst_bits.cases; clarsimp)\n    (*NOT*)\n        apply(find_q_pc_after_inst)\n        apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} - {StackElm (h, w)}) \\<union> \n           {PcElm (n + 1)} \\<union>\n           {StackElm (h, NOT w)} \\<union> {GasElm (g - Gverylow)} \" in exI)\n           \t\tapply(easy_case_pc_after_inst)\n    (*AND*)\n       apply(find_q_pc_after_inst)\n       apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, bits_2_1_verylow inst_AND v w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)}\" in exI)\n      apply(after_byte)\n    (*OR*)\n       apply(find_q_pc_after_inst)\n       apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, bits_2_1_verylow inst_OR v w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)}\" in exI)\n      apply(after_byte)\n    (*XOR*)\n           apply(find_q_pc_after_inst)\n       apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, bits_2_1_verylow inst_XOR v w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)}\" in exI)\n      apply(after_byte)\n    (*BYTE*)\n           apply(find_q_pc_after_inst)\n       apply(rule_tac x=\"(s - {PcElm n} - {StackHeightElm (Suc (Suc h))} -\n             {StackElm (Suc h, v)} - {StackElm (h, w)} - {GasElm g}) \\<union> {StackElm (h, get_byte v w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {StackHeightElm (Suc h)} \\<union> {PcElm (n+1)}\" in exI)\n      apply(after_byte)\n    (**INFO**)\n    \t\t  apply(erule triple_inst_info.cases; clarsimp)\n    (*CALLVALUE*)\n            apply(find_q_pc_after_inst)\n            apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} - {StackHeightElm h}) \\<union>\n          {StackHeightElm (Suc h)} \\<union> {GasElm (g - Gbase)} \\<union> {StackElm (h, w)} \\<union>\n          {PcElm (n + 1)}\" in exI)\n            apply(easy_case_pc_after_inst)\n    (*CALLDATASIZE*)\n           apply(find_q_pc_after_inst)\n           apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} - {StackHeightElm h}) \\<union>\n        {StackHeightElm (Suc h)} \\<union> {GasElm (g - Gbase)} \\<union> {StackElm (h, word256FromNat (length data))} \\<union>\n          {PcElm (n + 1)}\" in exI)\n           apply(easy_case_pc_after_inst)\n    (*CALLDATASIZE*)\n           apply(find_q_pc_after_inst)\n           apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} - {StackHeightElm h}) \\<union>\n        {StackHeightElm (Suc h)} \\<union> {GasElm (g - Gbase)} \\<union> {StackElm (h, ucast c)} \\<union>\n          {PcElm (n + 1)}\" in exI)\n           apply(easy_case_pc_after_inst)\n    (**Memory**)\n    \t\tapply(erule triple_inst_memory.cases; clarsimp)\n    (*MLOAD*)\n    \t\t apply(find_q_pc_after_inst)\n         apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} - {StackElm (h,memaddr)} - {MemoryUsageElm memu}) \\<union>\n          {GasElm (g - Gverylow + Cmem memu - Cmem (M memu memaddr 32))} \\<union>\n\t\t\t\t\t{StackElm (h, v)} \\<union> {MemoryUsageElm (M memu memaddr 32)} \\<union>\n          {PcElm (n + 1)}\" in exI)\n          apply(sep_simp simp: program_counter_sep memory_usage_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps)\n          apply(rule conjI)\n          apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n      \t\t apply(rule  Set.equalityI)\n           apply(simp add: Set.subset_iff, clarify)\n          apply(rule conjI)\n            apply(rule notI; drule only_one_pc; simp)\n            \t\t\t apply(rule conjI, rule notI,simp add: uniq_stateelm_def)\n            \t\t apply(rule conjI, rule notI; simp add: uniq_stateelm_def)\n           apply(auto simp add: uniq_stateelm_def)[1]\n          apply(auto simp add: uniq_stateelm_def)[1]\n         apply(auto simp add: uniq_stateelm_def)[1]\n        (*MSTORE*)\n        apply(find_q_pc_after_inst)\n        apply(simp add: memory_def)\n    \t\tapply(rule_tac x=\"(s - {GasElm g} - {PcElm n} - {StackElm (Suc h,memaddr)} - {StackElm (h,v)} -\n\t\t\t\t\t{MemoryUsageElm memu} - {StackHeightElm (Suc (Suc h))} -\n\t\t\t\t\t(memory_range_elms memaddr (word_rsplit old_v))) \\<union>\n          {GasElm (g - Gverylow + Cmem memu - Cmem (M memu memaddr 32))} \\<union>\n\t\t\t\t\t{MemoryUsageElm (M memu memaddr 32)} \\<union> {StackHeightElm h} \\<union>\n          {PcElm (n + 1)} \\<union> (memory_range_elms memaddr (word_rsplit v))\" in exI)\n                apply(sep_simp simp: program_counter_sep memory_usage_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps memory_range_sep[where len_word=32, simplified])\n    \t\t\tapply(simp add: memory_range_elms_set_simps)\n    \t\tapply(rule conjI)\n    \t\t apply(subst subset_iff)\n    \t\t apply(rule allI, rule impI)\n    \t\t apply(simp)\n    \t\tapply(rule conjI)\n    \t\t apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n         apply(rule  Set.equalityI, subst subset_iff)\n          apply(clarsimp)\n          apply(rule conjI)\n           apply(rule notI; drule only_one_pc; simp)\n          apply(rule conjI, rule notI,simp add: uniq_stateelm_def)\n          apply(rule conjI, rule notI, simp add: uniq_stateelm_def)\n          apply(rule conjI, rule notI, simp add: uniq_stateelm_def)\n          apply(rule notI)\n          apply(case_tac t; simp add: memory_range_elms_set_simps)\n          apply(clarsimp)\n    \t\t\tapply(subst (asm) memory_elms_not_in_range, simp)\n    \t\t\tapply(subst (asm) de_Morgan_conj)\n    \t\t\tapply(case_tac \"unat (a - memaddr) < 32\"; simp)\n    \t\t\t prefer 2\n    \t\t\t apply(subst (asm) not_less)\n    \t\t\t apply(insert memory_elms_out_of_range)[1]\n    \t\t\t apply(drule_tac x=\"word_rsplit v\" and y=a in meta_spec2)\n    \t\t\t apply(drule_tac x=memaddr and y=b in meta_spec2)\n    \t\t\t apply(simp)\n    \t\t\tapply(subst (asm) subset_iff)\n    \t\t\tapply(drule_tac x=\"MemoryElm (a, word_rsplit old_v ! unat (a - memaddr))\" in spec)\n    \t\t\tapply(drule mp)\n    \t\t\t apply(insert elm_in_range_in_lst)[1]\n    \t\t\t apply(drule_tac x=\"a - memaddr\" and y=\"word_rsplit old_v\" in meta_spec2)\n    \t\t\t apply(drule_tac x=memaddr in meta_spec)\n    \t\t\t apply(simp)\n  apply(simp add: uniq_stateelm_simps)    \n  apply clarsimp\n  apply(simp add: uniq_stateelm_simps memory_range_elms_set_simps)        \n  apply (rule conjI[rotated])+\n    prefer 2\n  apply clarsimp\n  apply (rule conjI) apply clarsimp\n    \n  apply (drule_tac zs=\"word_rsplit old_v\" in  memory_range_elms_same_addr, simp)\n  apply clarify\n  apply (drule (1) subsetD)\n  apply (drule_tac x=ha and y=v'a in spec2, fastforce)\n  apply clarsimp\n  apply (rule conjI, clarsimp)\n\n  apply (drule_tac zs=\"word_rsplit old_v\" in  memory_range_elms_same_addr, simp)\n  apply clarify\n  apply (drule (1) subsetD)\n  apply (drule_tac x=ha and y=v'a in spec2, fastforce)\n  apply clarsimp\n  apply (erule (1) memory_range_elms_uniq_stateelm[rule_format,rotated])\n  apply simp\n               apply (subst (asm) word_le_nat_alt)\n               apply(thin_tac \"\\<forall>v. _v\")+\n  apply(thin_tac \"(_ \\<and>*_) _\")\n  apply (drule add_le_mono[where i=\"31\" and j=\"31\" and l=\"unat _\", OF le_refl]) \n               apply(erule le_trans)\n               apply(subgoal_tac \"unat (0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE0::w256) = unat (-32::w256)\"; simp)\n               apply(subgoal_tac \"unat (0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF::w256) = unat (-1::w256)\")\n                apply(simp)\n               apply(subst unat_arith_simps(3)[symmetric], simp)\n              apply(rule allI, rule conjI; clarsimp)\n             apply(rule allI, rule conjI; clarsimp)\n             apply(case_tac \"ha = Suc h\"; clarsimp)\n             apply(case_tac \"ha = h\"; clarsimp)\n            apply(rule allI, rule allI, clarsimp)\n           apply(rule allI, rule conjI; clarsimp)\n          apply(rule allI, rule conjI; clarsimp)\n         apply(rule allI, rule conjI; clarsimp)\n    (**Storage**)\n      (*SLOAD*)\n        apply(erule triple_inst_storage.cases; clarsimp)\n         apply(find_q_pc_after_inst)\n         apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} - {StackElm (h,idx)}) \\<union> {GasElm (g - Gsload neta)} \\<union>\n          {PcElm (n + 1)} \\<union> {StackElm (h,w)}\" in exI)\n         apply(easy_case_pc_after_inst)\n        (*SSTORE*)\n        apply(find_q_pc_after_inst)\n        apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} - {StackElm (h,new)} - {StackElm (Suc h, idx)} -\n        {StackHeightElm (Suc (Suc h))} - {StorageElm (idx, old)}) \\<union> {StorageElm (idx, new)} \\<union>\n        {GasElm (g - Csstore old new)} \\<union> {StackHeightElm h} \\<union> {PcElm (n + 1)}\" in exI)\n            apply(after_byte)\n             apply(case_tac \"ha=h\"; clarsimp)\n            apply(rule conjI; clarsimp)\n    (**Pc**)\n  \t    apply(erule triple_inst_pc.cases; clarsimp)\n      apply(find_q_pc_after_inst)\n      apply(rule_tac x=\"(s - {GasElm g} - {PcElm n}) \\<union> {GasElm (g - Gjumpdest)} \\<union>\n          {PcElm (n + 1)}\" in exI)\n      apply(easy_case_pc_after_inst)\n     apply(find_q_pc_after_inst)\n     apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} - {StackHeightElm h}) \\<union>\n          {StackHeightElm (Suc h)} \\<union> {GasElm (g - Gbase)} \\<union> {StackElm (h, word_of_int n)} \\<union>\n          {PcElm (n + 1)}\" in exI)\n     apply(easy_case_pc_after_inst)\n    apply(erule triple_inst_stack.cases; clarsimp)\n     apply(clarsimp simp add: inst_size_simps pure_sep)\n     apply(find_q_pc_after_inst)\n     apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} -\n          {StackHeightElm h}) \\<union> {GasElm (g - Gverylow)} \\<union> {StackElm (h, word_rcat lst)} \\<union>\n          { StackHeightElm (Suc h)} \\<union> {PcElm (n + (1 + int (length lst)))}\" in exI)\n         apply(easy_case_pc_after_inst)\n        apply(find_q_pc_after_inst)\n    apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} -\n          {StackHeightElm (Suc h)} - {StackElm (h, w)}) \\<union> {GasElm (g - Gbase)} \\<union>\n          { StackHeightElm h} \\<union> {PcElm (n + 1)}\" in exI)\n          apply(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps)\n          apply(rule conjI)\n          \t\t\t\t\t apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n         apply(auto simp add: uniq_stateelm_def)[1]\n    apply(simp add: uniq_stateelm_def)\n        apply(rule conjI, fastforce)+\n    apply(rule allI, rule conjI; clarsimp)\n    apply(case_tac \"ha=h\"; clarsimp)\n        apply(find_q_pc_after_inst)\n     apply(rule_tac x=\"(s - {GasElm g} - {PcElm n} -\n          {StackElm (h, u)}) \\<union> {GasElm (g - Gverylow)} \\<union>\n          {StackElm (h,read_word_from_bytes (unat u)\n                lst)} \\<union> {PcElm (n + 1)}\" in exI)\n          apply(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps)\n       apply(rule conjI)\n          \t\t\t\t\t apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n       apply(auto simp add: uniq_stateelm_def)[1]\n       apply(simp add: uniq_stateelm_def)\n       apply(rule conjI, fastforce)+\n       apply(fastforce)\n    (*Swap*)\n    \tapply(find_q_pc_after_inst)\napply(rule_tac x=\"(s - {PcElm n} - {GasElm g} -\n             {StackElm (h, w)} - {StackElm (h - (Suc (unat na)), v)}) \\<union> \n             {StackElm (h, v)} \\<union> {StackElm (h - (Suc (unat na)), w)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {PcElm (n+1)}\" in exI)\n          apply(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps)\n   apply(rule conjI)\n   \t\t apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n   \t\t apply(rule  Set.equalityI)\n           apply(simp add: Set.subset_iff, clarify)\n        apply(rule conjI)\n            apply(rule notI; drule only_one_pc; simp)\n            \t\t\t apply(rule conjI, rule notI,simp add: uniq_stateelm_def)\n            \t\t apply(rule conjI, rule notI; simp add: uniq_stateelm_def)\n            \t\t  apply(auto simp add: uniq_stateelm_def)[1]\n       apply(auto simp add: uniq_stateelm_def)[1]\n   apply (simp add: uniq_stateelm_def)\n   apply(rule conjI, fastforce)\n   apply(rule conjI, fastforce)\n   apply(rule conjI)\n    apply(clarsimp)\n    apply(rule conjI, fastforce)\n    apply(rule conjI; clarsimp)\n    apply(rule conjI; clarsimp)\n    \tapply(fastforce)\n    (*Dup*)\n      \tapply(find_q_pc_after_inst)\napply(rule_tac x=\"(s - {PcElm n} - {GasElm g} -\n             {StackHeightElm h}) \\<union> \n             {StackElm (h, w)} \\<union> {StackHeightElm (Suc h)} \\<union>\n             {GasElm (g-Gverylow)} \\<union> {PcElm (n+1)}\" in exI)\n          apply(sep_simp simp: program_counter_sep gas_pred_sep stack_sep stack_height_sep pure_sep, (erule conjE)?)+\n          apply(clarsimp simp add: gas_value_simps)\n   apply(rule conjI)\n   \t\t apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n   \t\t apply(rule  Set.equalityI)\n           apply(simp add: Set.subset_iff, clarify)\n        apply(rule conjI)\n            apply(rule notI; drule only_one_pc; simp)\n            \t\t\t apply(rule conjI, rule notI,simp add: uniq_stateelm_def)\n            \t\t apply(rule conjI, rule notI; simp add: uniq_stateelm_def)\n            \t\t  apply(auto simp add: uniq_stateelm_def)[1]\n       apply(auto simp add: uniq_stateelm_def)[1]\n   apply (simp add: uniq_stateelm_def)\n   apply(rule conjI, fastforce)+\n   \t apply(fastforce)\n   \t  apply(drule meta_mp)\n  apply(rule_tac x=s in exI; rule conjI; simp)\n  apply(assumption)\n  apply(simp add: pure_def)\n  done\n\nlemma triple_seq_empty_case[OF _ refl] :\n\"triple_seq net q xs r \\<Longrightarrow> xs = [] \\<Longrightarrow>\n \\<exists>q'. (\\<forall>s. q s \\<longrightarrow> q' s) \\<and> (\\<forall>s. q' s \\<longrightarrow> r s)\"\n  apply(induct rule: triple_seq.induct, simp_all)\napply(rule_tac x=post in exI, simp)\n  apply force\napply(rule_tac x=post in exI, simp)\napply(simp add: pure_def)\ndone\n\nlemma triple_seq_empty_case' :\n\"triple_seq net q [] r \\<Longrightarrow>\n (\\<forall>s. q s \\<longrightarrow> r s)\"\nby(drule triple_seq_empty_case, fastforce)\n\nlemma pc_after_seq:\n\" triple_seq net pre insts post' \\<Longrightarrow>\n\\<exists>s. pre s \\<and> uniq_stateelm s \\<Longrightarrow>\n\\<forall>s. post' s = (program_counter m \\<and>* post) s \\<Longrightarrow>\nfst (hd insts) = n \\<Longrightarrow>\ninsts \\<noteq> [] \\<Longrightarrow>\nseq_block insts \\<Longrightarrow>\nreg_block insts \\<Longrightarrow>\n m = n + inst_size_list insts\"\n  apply(induction arbitrary:n post rule:triple_seq.induct)\n    apply(clarsimp)\n    apply(case_tac xs; clarsimp)\n     apply(drule triple_seq_empty_case'; clarsimp)\n     apply(simp add: reg_block_def seq_block.simps)\n     apply(drule_tac n=a and i=b and pre=pre and post=q in pc_after_inst; clarsimp)\n      apply(fastforce)\n     apply(thin_tac \"uniq_stateelm s\")\n\t\t apply(thin_tac \"\\<forall>s. _ s = _ s\")\n     apply(simp add: program_counter_sep uniq_stateelm_def)\n    apply(drule_tac x=\"a + inst_size b\" and y=posta in meta_spec2)\n    apply(clarsimp)\n    apply(simp add:reg_block_def)\n    apply(erule conjE)+\n    apply(drule_tac n=a and i=b in pc_after_inst)\n       apply(simp add: seq_block.simps)+\n     apply(fastforce)\n    apply(drule meta_mp; clarsimp)\n    apply(simp add: seq_block.simps; clarsimp)\n   apply(clarsimp)\n  apply(drule_tac x=n and y=post in meta_spec2)\n  apply(drule meta_mp)\n  apply(clarsimp)\n   apply(rule_tac x=s in exI)\n   apply(fastforce)\n  apply(simp)\n apply (fastforce simp: pure_def)\ndone\n\nlemma jump_i_ends_block:\n\"seq_block (ys@xs) \\<Longrightarrow>\n (t=Jump \\<and> i=JUMP) \\<or> (t=Jumpi \\<and> i=JUMPI) \\<Longrightarrow>\n (n, insts, t) \\<in> set (aux_basic_block xs ys) \\<Longrightarrow>\n (n + inst_size_list insts, Pc i) \\<in> set xs\"\n apply(induction xs arbitrary: ys)\n  apply(case_tac ys; simp add: aux_basic_block.simps)\n apply(clarsimp simp add: aux_basic_block.simps Let_def)\n apply(case_tac \"reg_inst b \\<and> b \\<noteq> Pc JUMPDEST\")\n  apply(drule_tac x=\"ys @ [(a, b)]\" in meta_spec)\n  apply(simp split: reg_inst_splits)\n apply(case_tac \"b=Pc JUMPDEST\")\n  apply(case_tac ys)\n\t apply(simp; drule_tac x=\"[(a, b)]\" in meta_spec; simp)\n  apply(simp; drule_tac x=\"[(a, b)]\" in meta_spec; simp add: seq_block_tl'[where xs=\"_#_\"])\n  apply(erule disjE; simp)\n apply(drule_tac x=\"[]\" in meta_spec)\n apply(drule meta_mp)\n  apply(subgoal_tac \"seq_block ((a, b) # xs)\")\n\t apply(simp add: seq_block_tl)\n  apply(simp add: seq_block_tl')\n apply(simp split: reg_inst_splits; erule disjE; simp)\n  apply(erule disjE; simp)\n  apply(case_tac ys; simp add: block_pt_def seq_block_sumC)\n apply(erule disjE; simp)\n apply(case_tac ys; simp add: block_pt_def seq_block_sumC)\ndone\n\nlemma jump_i_in_blocks_insts:\n\"wf_blocks blocks \\<Longrightarrow>\nblocks = build_blocks bytecode \\<Longrightarrow>\n (t=Jump \\<and> i=JUMP) \\<or> (t=Jumpi \\<and> i=JUMPI) \\<Longrightarrow>\nblock_lookup blocks n = Some (xs, t) \\<Longrightarrow>\n(n+inst_size_list xs, Pc i) \\<in> blocks_insts blocks\"\napply(simp add: blocks_insts_def)\napply(simp add: rev_rebuild_with_add)\napply(simp add: build_blocks_def Let_def)\napply(simp add: build_basic_blocks_def)\napply(rule jump_i_ends_block[where ys=\"[]\" and i=i and t=t])\n  apply(simp add: seq_block_add_address add_address_def)\n apply(simp)\napply(rule map_of_SomeD, assumption)\ndone\n\n\n(* JUMP case *)\nlemma extract_info_jump:\n\"block_lookup blocks dest = Some (bi, ti) \\<Longrightarrow>\n wf_blocks blocks \\<Longrightarrow>\n block_lookup blocks n = Some (insts, Jump) \\<Longrightarrow>\nuint (word_of_int dest::w256) = dest\"\napply(subst (asm) wf_blocks_def)\napply(simp add: uint_word_reverse)\ndone\n\nlemma program_content_some_fst:\n\"wf_blocks blocks \\<Longrightarrow>\n block_lookup blocks dest = Some ((dest, i) # bbi, ti) \\<Longrightarrow>\n i \\<noteq> Misc STOP \\<Longrightarrow>\n {CodeElm (pos, i) |pos i. (pos, i) \\<in> blocks_insts blocks}\n       \\<subseteq> instruction_result_as_set co_ctx\n           (InstructionContinue x1) \\<Longrightarrow>\n program_content (cctx_program co_ctx) dest = Some i\"\napply(drule block_in_insts_wf, assumption)\napply(clarsimp)\n apply(subgoal_tac \"CodeElm (dest,i) \\<in> instruction_result_as_set co_ctx (InstructionContinue x1)\")\n  apply(simp add: code_elm_means)\n apply(fastforce)\ndone\n\nlemma jump_sem:\n\"block_lookup blocks dest = Some (bi, ti) \\<Longrightarrow>\n bi = (dest, Pc JUMPDEST) # bbi \\<Longrightarrow>\n wf_blocks blocks \\<Longrightarrow>\n blocks = build_blocks bytecode \\<Longrightarrow>\n block_lookup blocks n = Some (insts, Jump) \\<Longrightarrow>\n       (code (blocks_insts blocks) \\<and>*\n        (continuing \\<and>*\n         gas_pred g \\<and>*\n         program_counter (n + inst_size_list insts) \\<and>*\n         stack_height (Suc h) \\<and>*\n         stack h (word_of_int dest::w256) \\<and>*\n         memory_usage m \\<and>*\n         \\<langle> h \\<le> 1023 \\<and> Gmid \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>*\n         restb) \\<and>*\n        rest)\n        (instruction_result_as_set co_ctx presult) \\<Longrightarrow>\n       (code (blocks_insts blocks) \\<and>*\n        (continuing \\<and>*\n         program_counter dest \\<and>*\n         stack_height h \\<and>*\n         gas_pred (g - Gmid) \\<and>*\n         memory_usage m \\<and>* restb) \\<and>*\n        rest)\n        (instruction_result_as_set co_ctx\n          (program_sem stopper co_ctx (Suc 0) net\n            presult))\"\napply (sep_simp_asm simp: continuing_sep memory_usage_sep pure_sep gas_pred_sep stack_sep stack_height_sep program_counter_sep )\napply(clarsimp)\napply(insert extract_info_jump[where blocks=blocks and n=n and dest=dest and bi=bi and ti=ti and insts=insts]; clarsimp)\napply(case_tac presult)\n apply(simp add: stateelm_means_simps)\n apply(simp add: program_sem.simps instruction_simps next_state_def)\n apply(insert jump_i_in_blocks_insts[where blocks=blocks and t=Jump and i=JUMP and n=n and xs=insts and bytecode=bytecode], simp)\n apply(insert code_elm_means[where xy=\"(n+ inst_size_list insts,Pc JUMP)\" and c=co_ctx])\n apply(drule_tac x=x1 in meta_spec)\n apply(drule iffD1)\n  apply (sep_simp_asm simp: code_sep)\n  apply(auto)[1]\n apply(simp add: instruction_simps Let_def rev_nth)\n apply(case_tac \"vctx_stack x1\"; clarsimp)\n apply(simp add: instruction_simps Let_def rev_nth)\n apply (sep_simp simp: continuing_sep memory_usage_sep pure_sep gas_pred_sep stack_sep stack_height_sep program_counter_sep)+\n apply(simp add: stateelm_means_simps)\n apply(insert program_content_some_fst[where blocks=blocks and dest=dest and co_ctx=co_ctx])[1]\n apply(drule meta_spec)+\n apply(drule meta_mp, simp)+\n  apply (sep_simp_asm simp: code_sep)\n  apply(auto)[1]\n apply(simp)\n apply(clarsimp simp add: instruction_simps stateelm_means_simps)\n apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n  apply(rule equalityI, rule subsetI; clarsimp simp add: as_set_simps)\n   apply(erule disjE, clarsimp)+\n    apply(case_tac \"idx < length list\"; simp add: short_rev_append)\n   apply(erule disjE, clarsimp)+\n   apply(clarsimp)\n  apply(erule disjE, clarsimp)+\n   apply(case_tac \"idx < length list\"; simp add: short_rev_append)\n  apply(clarsimp)\n  apply(erule disjE, clarsimp)+\n  apply(clarsimp)\napply(simp add: as_set_simps)\ndone\n\nlemma blocks_jump_sem_t:\n\"block_lookup blocks dest = Some (bi, ti) \\<Longrightarrow>\n bi = (dest, Pc JUMPDEST) # bbi \\<Longrightarrow>\n triple_seq net pre insts\n\t(program_counter (n + inst_size_list insts) \\<and>*\n\t gas_pred g \\<and>*\n\t memory_usage m \\<and>*\n\t stack_height (Suc h) \\<and>*\n\t stack h (word_of_int dest) \\<and>*\n\t \\<langle> h \\<le> 1023 \\<and> Gmid \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>* continuing \\<and>* rest) \\<Longrightarrow>\n\ttriple_sem_t net\n\t (program_counter dest \\<and>*\n\t\tgas_pred (g - Gmid) \\<and>*\n\t\tmemory_usage m \\<and>* stack_height h \\<and>* continuing \\<and>* rest)\n\t (blocks_insts blocks) post \\<Longrightarrow>\n wf_blocks blocks \\<Longrightarrow>\n build_blocks bytecode = blocks \\<Longrightarrow>\n block_lookup blocks (v_ind (n, insts, Jump)) = Some (snd (n, insts, Jump)) \\<Longrightarrow>\n triple_sem_t net pre (blocks_insts blocks) post\"\n apply(simp only: triple_sem_t_def; clarify)\n apply(drule_tac x=co_ctx and y=\"(program_sem stopper co_ctx (Suc (length insts)) net presult)\" in spec2)\n apply(drule_tac x=resta and y=stopper in spec2)\n apply(case_tac \"insts\")\n  apply(cut_tac q=pre and r=\"(program_counter (n + inst_size_list insts) \\<and>*\n         gas_pred g \\<and>*\n         memory_usage m \\<and>*\n         stack_height (Suc h) \\<and>*\n         stack h (word_of_int dest) \\<and>*\n         \\<langle> h \\<le> 1023 \\<and> Gmid \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>* continuing \\<and>* rest)\" and net=net\n        in triple_seq_empty_case')\n   apply(clarsimp)\n  apply(drule mp)\n   apply(clarsimp)\n   apply(drule_tac P=pre in sep_conj_imp, assumption)\n   apply(drule_tac bi=\"(dest, Pc JUMPDEST) # bbi\" and ti=ti and g=g and h=h and presult=presult and\n         m=m and restb=rest and rest=resta and bytecode=bytecode and co_ctx=co_ctx\n         in jump_sem; simp add: sep_lc)\n   apply(simp add: sep_lc)\n  apply(simp add: program_sem_t_exec_continue)\n apply(cut_tac m=\"n + inst_size_list insts\" and n=n\n\t\t\t and post=\" (gas_pred g \\<and>* memory_usage m \\<and>* stack_height (Suc h) \\<and>*\n         stack h (word_of_int dest) \\<and>* \\<langle> h \\<le> 1023 \\<and> Gmid \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>* continuing \\<and>* rest)\"\n\t\t\t in pc_after_seq)\n        apply(assumption)\n\t\t\t apply(simp add: inst_res_as_set_uniq_stateelm)\n\t\t  apply(simp add: wf_blocks_def)\n     apply(simp add: wf_blocks_def)\n     apply(drule_tac x=n and y=insts in spec2; drule conjunct1)\n\t   apply(drule_tac x=Jump in spec; simp)\n    apply(fastforce)\n   apply(simp add: wf_blocks_def)\n  apply(simp add: wf_blocks_def)\n\tapply(simp add: reg_vertex_def)\n\tapply(drule_tac x=n and y=insts in spec2, drule conjunct1, drule_tac x=Jump in spec, simp)\n apply(thin_tac \"_ = _ # _\")\n apply(drule triple_seq_soundness)\n apply(simp only: triple_seq_sem_def)\n apply(rename_tac co_ctx presult resta stopper a list)\n apply(drule_tac x = \"co_ctx\" in spec)\n apply(drule_tac x = \"presult\" and y = \"code (blocks_insts blocks - set insts) \\<and>* resta\" in spec2)\n apply(erule impE)\n  apply(simp)\n\tapply(erule impE)\n\t apply(cut_tac p=pre and n=n and insts=\"insts\" and ty=Jump and r=resta and s=\"instruction_result_as_set co_ctx presult\"\n        in sep_code_code_sep_wf[where blocks=blocks]; simp)\n\tapply(drule_tac x = \"stopper\" in spec)\n\tapply(insert code_code_sep_wf[where blocks=blocks and n=n and insts=\"insts\" and ty=Jump]; simp)\n\tapply(thin_tac \"\\<And>r s. _ r s = _ r s\")\n   apply(cut_tac co_ctx=co_ctx and stopper=stopper and insts=insts and net=net and\n    presult=\"(program_sem stopper co_ctx (length insts) net presult)\" and h=h\n    and g=g and m=m and rest=resta and restb=rest and co_ctx=co_ctx\n   in jump_sem; simp add: sep_lc)\n  apply(sep_select_asm 8, sep_select_asm 8)\n  apply(insert code_code_sep[where insts=insts and blocks=blocks and n=n and ty=Jump])[1]\n\tapply(simp, sep_select 6, simp)\n apply(simp add: execution_continue)\n apply(sep_cancel)+\napply(simp add: program_sem_t_exec_continue) \ndone\n\n(* JUMPI case *)\n\nlemma diff_set_commute:\n\"A - {b} - {c} = A - {c} - {b}\"\nby(auto)\n\nlemma diff_set_commute_code:\n\"A - {CodeElm (pos, i) |pos i.\n        (pos, i) \\<in> blocks_insts blocks} - {c} = A - {c} - {CodeElm (pos, i) |pos i.\n        (pos, i) \\<in> blocks_insts blocks}\"\nby(auto)\n\nlemma extract_info_jumpi:\n\"      block_lookup blocks dest = Some (bi, ti) \\<Longrightarrow>\n       block_lookup blocks j = Some (bj, tj) \\<Longrightarrow>\n       wf_blocks blocks \\<Longrightarrow>\n       block_lookup blocks n = Some (insts, Jumpi) \\<Longrightarrow>\ndest = uint (word_of_int dest::256 word)\"\n apply(simp add: wf_blocks_def)\n apply(drule spec2[where x=dest and y=bi])\n apply(drule conjunct1)+\n apply(drule spec[where x=ti])\n apply(simp add: uint_word_reverse)\ndone\n\nlemma set_change_stack:\n\"instruction_result_as_set co_ctx\n        (InstructionContinue\n          (x1\\<lparr>vctx_stack := ta, vctx_pc := k,\n                vctx_gas := g\\<rparr>)) -\n       {StackHeightElm (length ta)} =\ninstruction_result_as_set co_ctx\n        (InstructionContinue\n          (x1\\<lparr>vctx_stack := cond # ta, vctx_pc := k,\n                vctx_gas := g\\<rparr>)) -\n       {StackElm (length ta, cond)} -\n       {StackHeightElm (Suc (length ta))}\"\napply(simp add: as_set_simps)\napply(rule equalityI; rule subsetI; clarsimp)\n apply(erule disjE, clarsimp)+\n  apply(simp add: short_rev_append)\n apply(erule disjE, clarsimp)+\n apply(clarsimp)\napply(erule disjE, clarsimp)+\n apply(case_tac \"idx = length ta\"; simp add: short_rev_append)\napply(erule disjE, clarsimp)+\napply(clarsimp)\ndone\n\nlemma set_change_stack_2:\n\"vctx_stack x1 = word_of_int dest # cond # ta \\<Longrightarrow>\ninstruction_result_as_set co_ctx\n        (InstructionContinue\n          (x1\\<lparr>vctx_stack := cond # ta,\n                vctx_pc := p,\n                vctx_gas := g\\<rparr>)) -\n       {StackHeightElm (Suc (length ta))}=\ninstruction_result_as_set co_ctx\n        (InstructionContinue\n          (x1\\<lparr>vctx_pc := p,\n                vctx_gas := g\\<rparr>)) -\n       {StackElm (Suc (length ta), word_of_int dest)} -\n       {StackHeightElm (Suc (Suc (length ta)))}\"\napply(simp add: as_set_simps)\napply(rule equalityI; rule subsetI; clarsimp)\n apply(erule disjE, clarsimp)+\n  apply(case_tac \"idx = length ta\"; simp add: short_rev_append)\n apply(erule disjE, clarsimp)+\n apply(clarsimp)\napply(erule disjE, clarsimp)+\n apply(case_tac \"idx < Suc (length ta)\"; simp add: short_rev_append)\n apply(case_tac \"idx = length ta\"; simp add: short_rev_append)\napply(erule disjE, clarsimp)+\napply(clarsimp)\ndone\n\nlemma jumpi_sem_zero:\n\"      block_lookup blocks i = Some (bi, ti) \\<Longrightarrow>\n       block_lookup blocks j = Some (bj, tj) \\<Longrightarrow>\n\t\t\t j = n + 1 + inst_size_list insts \\<Longrightarrow>\n       blocks = build_blocks bytecode \\<Longrightarrow>\n       wf_blocks blocks \\<Longrightarrow>\n       block_lookup blocks n = Some (insts, Jumpi) \\<Longrightarrow>\n       (code (blocks_insts blocks) \\<and>*\n        (continuing \\<and>*\n         gas_pred g \\<and>*\n         memory_usage m \\<and>*\n         stack h 0 \\<and>*\n         stack_height (Suc (Suc h)) \\<and>*\n         program_counter (n + inst_size_list insts) \\<and>*\n         stack (Suc h) (word_of_int i) \\<and>*\n         \\<langle> h \\<le> 1022 \\<and> Ghigh \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>* restb) \\<and>*\n        rest)\n        (instruction_result_as_set co_ctx presult) \\<Longrightarrow>\n       (code (blocks_insts blocks) \\<and>*\n        ((continuing \\<and>*\n          stack_height h \\<and>*\n          gas_pred (g - Ghigh) \\<and>*\n          memory_usage m \\<and>* restb) \\<and>*\n         program_counter j) \\<and>*\n        rest)\n        (instruction_result_as_set co_ctx\n          (program_sem stopper co_ctx (Suc 0) net\n            presult))\"\n apply (sep_simp_asm simp: stack_sep stack_height_sep memory_usage_sep pure_sep gas_pred_sep program_counter_sep )\n apply(clarsimp)\n apply(insert extract_info_jumpi[where blocks=blocks and n=n and dest=i and j=j and bi=bi and ti=ti and insts=insts and bj=bj and tj=tj])\n apply(clarsimp)\n apply(simp add: program_sem.simps instruction_sem_simps next_state_def)\n apply(split instruction_result.splits)\n apply(rule conjI;clarsimp)\n\tapply(simp add: stateelm_means_simps)\n\tapply(insert jump_i_in_blocks_insts[where blocks=blocks and t=Jumpi and i=JUMPI and n=n and xs=insts and bytecode=bytecode], simp)[1]\n  apply(insert code_elm_means[where xy=\"(n+ inst_size_list insts,Pc JUMPI)\" and c=co_ctx])[1]\n  apply(drule_tac x=x1 in meta_spec)\n  apply(drule iffD1)\n\t apply(sep_simp simp: code_sep)\n   apply(auto)[1]\n apply(simp add: instruction_simps Let_def rev_nth)\n apply(case_tac \"vctx_stack x1\"; clarsimp)\n apply(simp add: instruction_simps Let_def rev_nth)\n apply (sep_simp simp: continuing_sep memory_usage_sep pure_sep gas_pred_sep stack_sep stack_height_sep program_counter_sep)+\n apply(simp add: stateelm_means_simps)\n apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n  apply(rule equalityI, rule subsetI; clarsimp simp add: as_set_simps)\n   apply(erule disjE, clarsimp)+\n    apply(case_tac \"idx < length t\"; simp add: short_rev_append)\n   apply(erule disjE, clarsimp)+\n   apply(clarsimp)\n  apply(erule disjE, clarsimp)+\n   apply(case_tac \"idx < length t\"; simp add: short_rev_append)\n  apply(clarsimp)\n  apply(erule disjE, clarsimp)+\n  apply(clarsimp)\napply(sep_simp simp:continuing_sep)\napply(simp add: as_set_simps)\ndone\n\nlemma jumpi_sem_non_zero:\n\"      block_lookup blocks dest = Some (bi, ti) \\<Longrightarrow>\n       block_lookup blocks j = Some (bj, tj) \\<Longrightarrow>\n\t\t\t bi = (dest, Pc JUMPDEST) # bbi \\<Longrightarrow>\n       blocks = build_blocks bytecode \\<Longrightarrow>\n       wf_blocks blocks \\<Longrightarrow>\n       block_lookup blocks n = Some (insts, Jumpi) \\<Longrightarrow>\n       (code (blocks_insts blocks) \\<and>*\n        (continuing \\<and>*\n         gas_pred g \\<and>*\n         memory_usage m \\<and>*\n         stack h cond \\<and>*\n         stack_height (Suc (Suc h)) \\<and>*\n         program_counter (n + inst_size_list insts) \\<and>*\n         stack (Suc h) (word_of_int dest) \\<and>*\n         \\<langle> h \\<le> 1022 \\<and> Ghigh \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>* restb) \\<and>*\n        rest)\n        (instruction_result_as_set co_ctx presult) \\<Longrightarrow>\n       cond \\<noteq> 0 \\<Longrightarrow>\n       (code (blocks_insts blocks) \\<and>*\n        ((continuing \\<and>*\n          memory_usage m \\<and>*\n          stack_height h \\<and>* gas_pred (g - Ghigh) \\<and>* restb) \\<and>*\n         program_counter dest) \\<and>*\n        rest)\n        (instruction_result_as_set co_ctx\n          (program_sem stopper co_ctx (Suc 0) net presult))\"\n apply (sep_simp_asm simp: memory_usage_sep pure_sep gas_pred_sep stack_sep stack_height_sep program_counter_sep )\n apply(clarsimp)\n apply(insert extract_info_jumpi[where blocks=blocks and n=n and dest=dest and j=j and bi=bi and ti=ti and insts=insts and bj=bj and tj=tj])\n apply(clarsimp)\n apply(simp add: program_sem.simps instruction_sem_simps next_state_def)\n apply(split instruction_result.splits)\n apply(rule conjI;clarsimp)\n\tapply(simp add: stateelm_means_simps)\n\tapply(insert jump_i_in_blocks_insts[where blocks=blocks and t=Jumpi and i=JUMPI and n=n and xs=insts and bytecode=bytecode], simp)\n  apply(insert code_elm_means[where xy=\"(n+ inst_size_list insts,Pc JUMPI)\" and c=co_ctx])\n  apply(drule_tac x=x1 in meta_spec)\n  apply(drule iffD1)\n\t apply(sep_simp simp: code_sep)\n   apply(auto)[1]\n apply(simp add: instruction_simps Let_def rev_nth)\n apply(case_tac \"vctx_stack x1\"; clarsimp)\n apply(simp add: instruction_simps Let_def rev_nth)\n apply (sep_simp simp: continuing_sep memory_usage_sep pure_sep gas_pred_sep stack_sep stack_height_sep program_counter_sep)+\n apply(simp add: stateelm_means_simps)\n apply(insert program_content_some_fst[where blocks=blocks and dest=dest and co_ctx=co_ctx])[1]\n apply(drule meta_spec)+\n apply(drule meta_mp, simp)+\n  apply (sep_simp_asm simp: code_sep)\n  apply(auto)[1]\n apply(simp)\n apply(clarsimp simp add: instruction_simps stateelm_means_simps)\n apply(erule_tac P=\"_ \\<and>* _\" in back_subst)\n  apply(rule equalityI, rule subsetI; clarsimp simp add: as_set_simps)\n   apply(erule disjE, clarsimp)+\n    apply(case_tac \"idx < length t\"; simp add: short_rev_append)\n   apply(erule disjE, clarsimp)+\n   apply(clarsimp)\n  apply(erule disjE, clarsimp)+\n   apply(case_tac \"idx < length t\"; simp add: short_rev_append)\n  apply(clarsimp)\n  apply(erule disjE, clarsimp)+\n  apply(clarsimp)\napply(sep_simp simp: continuing_sep)\napply(simp add: as_set_simps)\ndone\n\nlemma blocks_jumpi_sem_t:\n\"block_lookup blocks dest = Some ((dest, Pc JUMPDEST) # bbi, ti) \\<Longrightarrow>\n bi = (dest, Pc JUMPDEST) # bbi \\<Longrightarrow>\n block_lookup blocks (n + 1 + inst_size_list insts) = Some (bj, tj) \\<Longrightarrow>\n triple_seq net pre insts\n\t(continuing \\<and>* gas_pred g \\<and>* memory_usage m \\<and>*\n\t stack h cond \\<and>* stack_height (Suc (Suc h)) \\<and>*\n\t program_counter (n + inst_size_list insts) \\<and>*\n\t stack (Suc h) (word_of_int dest) \\<and>*\n\t \\<langle> h \\<le> 1022 \\<and> Ghigh \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>* rest) \\<Longrightarrow>\n r = (continuing \\<and>* memory_usage m \\<and>*\n\t\t\tstack_height h \\<and>* gas_pred (g - Ghigh) \\<and>* rest) \\<Longrightarrow>\n (cond \\<noteq> 0 \\<Longrightarrow>\n\ttriple_sem_t net\n\t ((continuing \\<and>* memory_usage m \\<and>*\n\t\t stack_height h \\<and>* gas_pred (g - Ghigh) \\<and>* rest) \\<and>*\n\t\tprogram_counter dest)\n\t (blocks_insts blocks) post) \\<Longrightarrow>\n (cond = 0 \\<Longrightarrow>\n\ttriple_sem_t net\n\t ((continuing \\<and>* memory_usage m \\<and>*\n\t\t stack_height h \\<and>* gas_pred (g - Ghigh) \\<and>* rest) \\<and>*\n\t\tprogram_counter (n + 1 + inst_size_list insts))\n\t (blocks_insts blocks) post) \\<Longrightarrow>\n wf_blocks blocks \\<Longrightarrow>\n build_blocks bytecode = blocks \\<Longrightarrow>\n block_lookup blocks n = Some (insts, Jumpi) \\<Longrightarrow>\n triple_sem_t net pre (blocks_insts blocks) post\"\n apply(simp only: triple_sem_t_def; clarify)\n apply(case_tac \"insts\")\n  apply(case_tac \"cond = 0\"; clarify)\n   apply(thin_tac \"0 \\<noteq> 0 \\<Longrightarrow> _\")+\n   apply(simp)\n   apply(drule_tac x=co_ctx in spec; drule_tac x=\"(program_sem (\\<lambda>x. ()) co_ctx (Suc 0) net presult)\" in spec)\n   apply(drule_tac x=resta in spec)\n   apply(drule mp)\n    apply(cut_tac q=pre and r=\"(continuing \\<and>*\n         gas_pred g \\<and>*\n         memory_usage m \\<and>*\n         stack h 0 \\<and>*\n         stack_height (Suc (Suc h)) \\<and>*\n         program_counter n \\<and>*\n         stack (Suc h) (word_of_int dest) \\<and>*\n         \\<langle> h \\<le> 1022 \\<and> Ghigh \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>*\n         rest)\" and net=net\n        in triple_seq_empty_case')\n     apply(clarsimp)\n    apply(drule_tac P=pre in sep_conj_imp, assumption)\n    apply(drule_tac bi=\"(dest, Pc JUMPDEST) # bbi\" and ti=ti and g=g and h=h and presult=presult and\n         m=m and restb=rest and rest=resta and bytecode=bytecode and co_ctx=co_ctx\n         in jumpi_sem_zero; simp add: sep_lc)\n    apply(simp add: sep_lc)\n   apply(simp add: program_sem_t_exec_continue)\n  apply(clarsimp)\n  apply(drule_tac x=co_ctx in spec; drule_tac x=\"(program_sem (\\<lambda>x. ()) co_ctx (Suc 0) net presult)\" in spec)\n  apply(drule_tac x=resta in spec)\n  apply(drule mp)\n   apply(cut_tac q=pre and r=\"(continuing \\<and>*\n         gas_pred g \\<and>*\n         memory_usage m \\<and>*\n         stack h cond \\<and>*\n         stack_height (Suc (Suc h)) \\<and>*\n         program_counter n \\<and>*\n         stack (Suc h) (word_of_int dest) \\<and>*\n         \\<langle> h \\<le> 1022 \\<and> Ghigh \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>*\n         rest)\" and net=net\n        in triple_seq_empty_case')\n    apply(clarsimp)\n   apply(drule_tac P=pre in sep_conj_imp, assumption)\n   apply(drule_tac bi=\"(dest, Pc JUMPDEST) # bbi\" and ti=ti and g=g and h=h and presult=presult and\n         m=m and restb=rest and rest=resta\n         in jumpi_sem_non_zero; simp add: sep_lc)\n   apply(simp add: sep_lc)\n  apply(simp add: program_sem_t_exec_continue)\n apply(cut_tac m=\"n + inst_size_list insts\" and n=n\n\t\t\t and post=\" (continuing \\<and>*\n         gas_pred g \\<and>*\n         memory_usage m \\<and>*\n         stack h cond \\<and>*\n         stack_height (Suc (Suc h)) \\<and>*\n         stack (Suc h) (word_of_int dest) \\<and>*\n         \\<langle> h \\<le> 1022 \\<and> Ghigh \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>*\n         rest)\"\n\t\t\t in pc_after_seq)\n        apply(assumption)\n\t\t\t apply(simp add: inst_res_as_set_uniq_stateelm)\n\t\t\tapply(clarsimp, rule iffI; (sep_cancel)+)\n\t\t  apply(clarsimp simp add: wf_blocks_def)\n\t\t\tapply(drule_tac x=n and y=insts in spec2, simp)\n\t\t apply(clarsimp)\n   apply(simp add: wf_blocks_def)\n  apply(simp add: wf_blocks_def)\n\tapply(simp add: reg_vertex_def)\n\tapply(drule_tac x=n and y=insts in spec2, drule conjunct1, drule_tac x=Jumpi in spec; simp)\n apply(thin_tac \"_ = _ # _\")\n apply(drule triple_seq_soundness)\n apply(simp only: triple_seq_sem_def; clarify)\n apply(rename_tac co_ctx presult resta stopper a b list)\n apply(drule_tac x = \"co_ctx\" and y=presult in spec2)\n apply(drule_tac x = \"code (blocks_insts blocks - set insts) \\<and>* resta\" in spec)\n apply(drule_tac x = \"stopper\" in spec)\n apply(clarsimp)\n apply(erule impE)\n  apply(cut_tac iffD2[OF sep_code_code_sep_wf[where insts=insts]]; simp)\n apply(insert iffD1[OF code_code_sep_wf[where insts=insts and blocks=blocks and n=n and ty=Jumpi]])\n apply(sep_select_asm 11, sep_select_asm 11)\n apply(drule_tac x=\"(continuing \\<and>* gas_pred g \\<and>* memory_usage m \\<and>* stack h cond \\<and>*\n         stack_height (Suc (Suc h)) \\<and>* stack (Suc h) (word_of_int dest) \\<and>*\n         program_counter (n + (inst_size b + inst_size_list list)) \\<and>*\n         \\<langle> h \\<le> 1022 \\<and> Ghigh \\<le> g \\<and> 0 \\<le> m \\<rangle> \\<and>* rest) \\<and>* resta\" in meta_spec)\n apply(drule_tac x=\"instruction_result_as_set co_ctx\n          (program_sem stopper co_ctx\n            (Suc (length list)) net presult)\" in meta_spec)\n apply(clarsimp simp add: sep_lc)\n apply(thin_tac \"(continuing \\<and>* _) (_)\")\n apply(case_tac \"cond=0\"; clarsimp)\n  apply(drule_tac x = \"co_ctx\" in spec)\n  apply(drule_tac x = \"(program_sem stopper co_ctx (Suc (length insts)) net presult)\" in spec)\n  apply(drule_tac x = \"resta\" in spec)\n  apply (erule impE)\n\t apply(cut_tac presult=\"(program_sem stopper co_ctx (length insts) net presult)\" and\n\t\tblocks=blocks and j=\"n + 1 + inst_size_list insts\" and bi=\"(dest, Pc JUMPDEST) # bbi\" and ti=ti\n\t\tand bj=bj and tj=tj and h=h and g=g and net=net and\n\t  i=dest and restb=rest and co_ctx=co_ctx and rest=resta and stopper=stopper and m=m\n  in jumpi_sem_zero; simp add: sep_lc)\n\t\tapply(simp add: sep_lc)\n\t apply(simp add: execution_continue)\n   apply(simp add: program_sem_t_exec_continue)\n  apply(sep_simp simp:program_counter_sep)\n apply(drule_tac x = \"co_ctx\" in spec)\n apply(drule_tac x = \"(program_sem stopper co_ctx (Suc (length insts)) net presult)\" in spec)\n apply(drule_tac x = \"resta\" in spec)\n apply (erule impE)\n\tapply(cut_tac co_ctx=co_ctx and stopper=stopper and insts=insts and\n\t\tg=g and restb=rest and n=n and bi=\"(dest, Pc JUMPDEST) # bbi\" and ti=ti and tj=tj and g=g and\n\t\tdest=dest and net=net and m=m and blocks=blocks and bytecode=bytecode and rest=resta and\n    presult=\"(program_sem stopper co_ctx (length insts) net presult)\" and h=h\n  in jumpi_sem_non_zero; simp add: sep_conj_commute sep_conj_left_commute)\n   apply(sep_simp simp: program_counter_sep; simp)\n\tapply(simp add: execution_continue)\n apply (erule_tac P=\"post \\<and>* code (blocks_insts (build_blocks bytecode)) \\<and>* resta\" in back_subst)\n apply(subst program_sem_t_exec_continue; simp)\ndone\n\n(* NO case *)\nlemma program_sem_to_environment:\n\"program_sem st c k n (InstructionToEnvironment x y z) = InstructionToEnvironment x y z\"\n by(induction k; simp add: program_sem.simps next_state_def)\n\nlemma pc_before_inst:\n\"triple_inst net pre x post \\<Longrightarrow>\nx = (n, i) \\<Longrightarrow>\npre s \\<and> uniq_stateelm s \\<Longrightarrow>\nPcElm n \\<in> s\"\n apply(induct rule: triple_inst.induct; clarsimp)\n            apply(erule triple_inst_arith.cases; clarsimp; sep_simp simp: pure_sep sep_fun_simps; simp)\n           apply(erule triple_inst_bits.cases; clarsimp; sep_simp simp: pure_sep sep_fun_simps; simp)\n          apply(erule triple_inst_info.cases; clarsimp; sep_simp simp: pure_sep sep_fun_simps; simp)\n         apply(erule triple_inst_memory.cases; clarsimp; sep_simp simp: pure_sep sep_fun_simps; simp)\n        apply(erule triple_inst_storage.cases; clarsimp; sep_simp simp: pure_sep sep_fun_simps; simp)\n       apply(erule triple_inst_misc.cases; clarsimp; sep_simp simp: pure_sep sep_fun_simps; simp)\n      apply(erule triple_inst_pc.cases; clarsimp; sep_simp simp: pure_sep sep_fun_simps; simp)\n     apply(erule triple_inst_stack.cases; clarsimp; sep_simp simp: pure_sep sep_fun_simps; simp)\n    apply(sep_simp simp: pure_sep sep_fun_simps; simp)+\n apply(simp add: pure_def)\ndone\n\nlemma pc_before_seq:\n\"triple_seq net pre insts post \\<Longrightarrow>\nfst (hd insts) = n \\<Longrightarrow>\ninsts \\<noteq> [] \\<Longrightarrow>\npre s \\<and> uniq_stateelm s \\<Longrightarrow>\nPcElm n \\<in> s\"\n apply(induction rule:triple_seq.induct; clarsimp)\n   apply(simp add: pc_before_inst)\n apply(simp add: pure_def)\ndone\n\nlemma execution_stop:\n\"\\<forall>v. program_sem stopper co_ctx k net presult \\<noteq>\n\t\tInstructionContinue v \\<Longrightarrow>\nprogram_sem_t co_ctx net presult = program_sem stopper co_ctx k net presult\"\n apply(case_tac \"program_sem stopper co_ctx k net presult\")\n   apply(fastforce)\n  apply(insert program_sem_t_exec_continue[where stopper=stopper and co_ctx=co_ctx and k=k and net=net and presult=presult])\n  apply(drule sym[where t=\"program_sem_t co_ctx net presult\"])\n  apply(clarsimp simp add: program_sem_t.simps)\n apply(insert program_sem_t_exec_continue[where stopper=stopper and co_ctx=co_ctx and k=k and net=net and presult=presult])\ndone\n\nlemma pc_advance_continue:\n\"reg_inst i \\<Longrightarrow>\n        program_content (cctx_program co_ctx)\n         (vctx_pc x) = Some i \\<Longrightarrow>\n       vctx_next_instruction x co_ctx = Some x2 \\<Longrightarrow>\n       check_resources x co_ctx (vctx_stack x) x2 net \\<Longrightarrow>\n       instruction_sem x co_ctx x2 net =\n       InstructionContinue x1 \\<Longrightarrow>\n       vctx_pc x + int (length (inst_code i)) = vctx_pc x1\"\napply(case_tac x2; simp add: instruction_simps)\n\t\t\t\t\t\tapply(rename_tac y; case_tac y; clarsimp; simp add: instruction_simps split:list.splits; clarsimp)\n\t\t\t\t\t apply(rename_tac y; case_tac y; clarsimp; simp add: instruction_simps split:list.splits; clarsimp)\n\t\t\t\t\tapply(rename_tac y; case_tac y; clarsimp; simp add: instruction_simps Let_def split:list.splits if_splits; clarsimp)\n\t\t\t\t apply(rename_tac y; case_tac y; clarsimp; simp add: instruction_simps split:list.splits; clarsimp)\n\t\t\t\tapply(split option.splits; clarsimp; simp add: instruction_simps split:list.splits; clarsimp)\n\t\t\t apply(rename_tac y; case_tac y; clarsimp)\n\t\t\t\t\t\t apply(simp add: instruction_simps split:list.splits; clarsimp)+\n\t\t\tapply(rename_tac y; case_tac y; clarsimp; simp add: instruction_simps split:list.splits; clarsimp)\n\t\t apply(rename_tac y; case_tac y; clarsimp; simp add: instruction_simps split:list.splits; clarsimp)\n\t\tapply(rename_tac y; case_tac y; clarsimp; simp add: instruction_simps split:list.splits; clarsimp)\n\t apply(simp add: instruction_simps split:list.splits option.splits; clarsimp)\n\tapply(rename_tac y; case_tac y; simp add: instruction_simps split:list.splits; clarsimp)\ndone\n\nlemma stop_after_no_continue:\n\"insts = (vctx_pc x,i)#xs \\<Longrightarrow>\nlast_no insts \\<Longrightarrow>\nseq_block insts \\<Longrightarrow>\nreg_vertex (m, insts, Terminal) \\<Longrightarrow>\n\\<forall>a b. (a,b)\\<in> (set insts) \\<longrightarrow>\n   (program_content (cctx_program co_ctx) a = Some b \\<or>\n   program_content (cctx_program co_ctx) a = None \\<and> b = Misc STOP) \\<Longrightarrow>\n\\<forall>v. program_sem stopper co_ctx (length insts) net (InstructionContinue x) \\<noteq>\n\t\tInstructionContinue v\"\n apply(induction insts arbitrary: i x xs)\n  apply(simp)\n apply(clarsimp)\n apply(case_tac xs)\n\tapply(simp)\n\tapply(thin_tac \"(\\<And>i x xs. False \\<Longrightarrow> _ x i xs \\<Longrightarrow> _ x i xs \\<Longrightarrow> _ x i xs \\<Longrightarrow> \\<forall>v. _ x i xs v)\")\n  apply(simp add: last_no_def)\n\tapply(case_tac i; simp)\n   apply(simp add: program_sem.simps instruction_simps next_state_def split: if_splits)\n  apply(erule disjE)\n   apply(case_tac x13; simp add: program_sem.simps instruction_simps stop_def next_state_def split: if_splits option.splits list.splits)\n  apply(simp add: program_sem.simps instruction_simps stop_def next_state_def split: if_splits option.splits list.splits)\n apply(drule subst[OF program_sem.simps(2), where P=\"\\<lambda>u. u = _\"])\n apply(simp add: instruction_simps next_state_def)\n apply(drule_tac x=\"vctx_pc x\" and y=i in spec2, simp, drule conjunct1)\n apply(simp split: option.splits; clarsimp)\n\tapply(simp add: program_sem_to_environment split: if_splits)\n\tapply(simp add: instruction_sem_def stop_def subtract_gas.simps)\n\tapply(simp add: program_sem_to_environment)\n apply(simp add: program_sem_to_environment split: if_splits)\n apply(drule_tac x=\"b\" in meta_spec; simp)\n apply(case_tac \"(instruction_sem x co_ctx i net)\")\n\t apply(simp)\n\t apply(drule_tac x=x1 and y=list in meta_spec2)\n\t apply(subgoal_tac \"vctx_pc x + int (length (inst_code i)) = vctx_pc x1\")\n    apply(simp add: seq_block.simps inst_size_def; clarsimp)\n\t\tapply(simp add: last_no_def reg_block_def reg_vertex_def; fastforce)\n\t apply(insert pc_advance_continue[where co_ctx=co_ctx])\n   apply(drule_tac x=i and y=x in meta_spec2;\n          drule_tac x=i and y=net in meta_spec2; drule_tac x=x1 in meta_spec)\n   apply(simp add: reg_block_def reg_vertex_def instruction_simps)\n apply(simp add: program_sem_to_environment)\ndone\n\nlemma blocks_no_sem_t:\n\" triple_seq net pre insts post \\<Longrightarrow>\n\t wf_blocks blocks \\<Longrightarrow>\n\t block_lookup blocks (v_ind (n, insts, Terminal)) =\n\t Some (snd (n, insts, Terminal)) \\<Longrightarrow>\n\t triple_sem_t net pre (blocks_insts blocks) post\"\n apply(simp add: triple_sem_t_def; clarsimp)\n apply(insert pc_before_seq[where n=n and pre=pre and insts=insts and post=post and net=net]; simp)\n apply(drule triple_seq_soundness)\n apply(simp add: triple_seq_sem_def)\n apply(rename_tac co_ctx presult rest)\n apply(drule_tac x = co_ctx in spec)\n apply(drule_tac x = presult and y = \"code (blocks_insts blocks - set insts) \\<and>* rest\" in spec2)\n apply(drule mp)\n apply(simp add: sep_code_code_sep_wf)\n apply(drule_tac x=\"\\<lambda>x. ()\" in spec)\n apply(subgoal_tac \"wf_blocks blocks\")\n  prefer 2 apply(assumption)\n apply(subst (asm) wf_blocks_def)\n apply(clarsimp)\n apply(drule spec2[where x=n and y=insts])\n apply(erule conjE)\n apply(drule spec[where x=Terminal])\n apply(drule mp, assumption)\n apply(drule conjunct2, drule conjunct2, drule conjunct2, drule conjunct1, simp, erule conjE)\n apply(simp add: sep_code_code_sep_wf)\n apply(subst execution_stop[where k=\"length insts\" and stopper=\"\\<lambda>x. ()\"])\n  apply(case_tac presult)\n    apply(case_tac insts)\n     apply(clarsimp)\n    apply(subgoal_tac \"a = (vctx_pc x1, snd a)\")\n     apply(cut_tac x=x1 and i=\"snd a\" and xs=list and m=n and co_ctx=co_ctx and net=net\n      in stop_after_no_continue[where insts=insts and stopper=\"\\<lambda>x. ()\"]; simp)\n       apply(simp add: wf_blocks_def)\n\t\t\tapply(simp add: wf_blocks_def)\n     apply(drule_tac r=rest and s=\"instruction_result_as_set co_ctx (InstructionContinue x1)\"\n        in sep_code_code_sep_wf[where p=pre]; simp)\n     apply(sep_simp simp: code_sep[where rest=\"pre \\<and>* _\" and pairs=\"set _\"])\n     apply(simp add: instruction_result_as_set_def)\n     apply(clarsimp simp add: code_elms code_elm_c)\n\t\t apply(rule conjI)\n\t\t  apply(simp add:  code_element_means)\n\t\t apply(clarsimp)\n     apply(subgoal_tac \"CodeElm (aa, ba) \\<in> insert (ContinuingElm True) (contexts_as_set x1 co_ctx)\")\n      apply(clarsimp simp add: stateelm_means_simps)\n     apply(subgoal_tac \"CodeElm (aa, ba) \\<in> {CodeElm (pos, i) |pos i. (pos, i) \\<in> set list}\")\n      apply(rule_tac A=\"{CodeElm (pos, i) |pos i. (pos, i) \\<in> set list}\" in set_rev_mp; simp)\n\t\t apply(clarsimp)\n    apply(simp add: sep_conj_def[where P=pre])\n    apply(clarsimp)\n    apply(drule_tac x=x in meta_spec)\n    apply(drule meta_mp)\n     apply(simp)\n     apply(rule_tac Q=\"instruction_result_as_set co_ctx (InstructionContinue x1)\"\n           and R=y in uniq_stateelm_subset)\n      apply(simp)\n     apply(rule uniq_stateelm_inst_res)\n    apply(subgoal_tac \"PcElm n \\<in> instruction_result_as_set co_ctx (InstructionContinue x1)\")\n     apply(thin_tac \"instruction_result_as_set _ _ = _\")\n     apply(drule subst[OF instruction_result_as_set_def, where P=\"\\<lambda>u. PcElm n \\<in> u\"], simp)\n\t\t apply(simp add: wf_blocks_def)\n\t\t apply(drule_tac x=n and y=\"(n, b) # list\" in spec2, simp)\n\t\tapply(simp add: pcElmEquiv)\n   apply(simp add: plus_set_def)\n  apply(simp add: program_sem_to_environment)\n apply(simp)\ndone\n\nlemma triple_soundness_aux:\n\"triple_blocks net blocks pre v post \\<Longrightarrow>\n wf_blocks blocks \\<Longrightarrow>\n build_blocks bytecode = blocks \\<Longrightarrow>\n block_lookup blocks (v_ind v) = Some (snd v) \\<Longrightarrow>\n triple_sem_t net pre (blocks_insts blocks) post\"\n apply(induction rule: triple_blocks.induct)\n\t\t apply(simp add: blocks_no_sem_t)\n\t\tapply(simp add: blocks_next_sem_t)\n\t apply(simp add: blocks_jump_sem_t sep_lc)\n  apply(simp add: blocks_jumpi_sem_t sep_lc)\n  apply(simp add: triple_sem_t_def pure_sep)\n  apply (clarsimp simp add: triple_sem_t_def sep_lc pure_sep)\n  apply (drule spec)\n  apply (drule spec)\n  apply (drule_tac x=rest in spec)\n  apply (drule mp)\n   apply (sep_cancel)+\n   apply simp+\n done\n\nlemma blocks_insts_eq_add_address:\n\"set (add_address bytecode) = blocks_insts (build_blocks bytecode)\"\napply(simp add: blocks_insts_def)\napply(subst arg_cong[where f=set and y=\"rebuild_with_add (build_blocks bytecode)\"])\n apply(subst rev_rebuild_with_add)\n apply(rule refl)+\ndone\n\nlemma aux_bb_not_Nil:\n\"aux_basic_block (x#xs) ys \\<noteq> []\"\napply(induction xs arbitrary: ys x; clarsimp)\n apply(simp add: aux_basic_block.simps Let_def)\n apply(case_tac \"reg_inst b \\<and> b \\<noteq> Pc JUMPDEST\")\n    apply(simp split: reg_inst_splits; case_tac \"(ys @ [(a,b)])\"; simp add: aux_basic_block.simps)\n   apply(split reg_inst_splits if_splits; simp add: aux_basic_block.simps)\n  apply(case_tac x9; simp split:if_splits add: aux_basic_block.simps)\napply(drule subst[OF aux_basic_block.simps(3), where P=\"\\<lambda>u. u = []\"])\napply(simp add: Let_def split: list.splits reg_inst_splits)\napply(simp split: if_splits)\ndone\n\ntheorem triple_soundness:\n\"bytecode \\<noteq> [] \\<Longrightarrow>\nfst (last (add_address bytecode)) < 2 ^ 256 \\<Longrightarrow>\ntriple net pre (build_blocks bytecode) post \\<Longrightarrow>\ntriple_sem_t net pre (set (add_address bytecode)) post\"\n apply(simp add: triple_def blocks_insts_eq_add_address)\n apply(subst triple_soundness_aux)\n\t\t apply(simp)\n\t\tapply(simp add: wf_build_blocks)\n\t apply(simp)\n  apply(simp add: build_blocks_def Let_def)\n  apply(case_tac \"build_basic_blocks bytecode\")\n   apply(simp add: build_basic_blocks_def add_address_def)\n   apply(induction bytecode; simp add: aux_bb_not_Nil)\n  apply(clarsimp)\n apply(simp)\ndone\n\nend\n", "meta": {"author": "pirapira", "repo": "eth-isabelle", "sha": "d0bb02b3e64a2046a7c9670545d21f10bccd7b27", "save_path": "github-repos/isabelle/pirapira-eth-isabelle", "path": "github-repos/isabelle/pirapira-eth-isabelle/eth-isabelle-d0bb02b3e64a2046a7c9670545d21f10bccd7b27/Hoare/SoundnessForBasicBlocks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3065307247883567}}
{"text": "header {* The type-erasure translation from many-typed to untyped FOL *}\ntheory E imports Mono CU\nbegin\n\n(* This is the only development that uses UFOL *)\n\n\nsubsection{* Preliminaries *}\n\n\n(* Problem:\nsublocale M.Signature < U.Signature\nwhere arOf = \"length o arOf\" and parOf = \"length o parOf\"\nyields error:\n*** Duplicate constant declaration \"local.wt_graph\" vs. \"local.wt_graph\"\n*)\n\n\n(* Temporary solution: Isomorphic copy of the MFOL hierarchy: *)\nlocale M_Signature = M : Sig.Signature\nlocale M_Problem = M : M.Problem\nlocale M_MonotModel = M : MonotModel wtFsym wtPsym arOf resOf parOf \\<Phi> intT intF intP\nfor wtFsym :: \"'fsym \\<Rightarrow> bool\" and wtPsym :: \"'psym \\<Rightarrow> bool\"\nand arOf :: \"'fsym \\<Rightarrow> 'tp list\"\nand resOf and parOf and intT and intF and intP and \\<Phi>\nlocale M_FullStruct = M : FullStruct\nlocale M_FullModel = M : FullModel\n\nsublocale M_FullStruct < M_Signature by default\nsublocale M_Problem < M_Signature by default\nsublocale M_FullModel < M_FullStruct by default\nsublocale M_MonotModel < M_FullStruct where\nintT = intTF and intF = intFF and intP = intPF by default\nsublocale M_MonotModel < M_FullModel where\nintT = intTF and intF = intFF and intP = intPF by default\n\n\ncontext Sig.Signature begin\n\nend (* context Signature.Signature *)\n\n\nsubsection{* The translation *}\n\nsublocale M_Signature < U.Signature\nwhere arOf = \"length o arOf\" and parOf = \"length o parOf\"\nby default(auto simp: countable_wtFsym countable_wtPsym)\n\n\n(* In our implicitly-typed setting, ``e\" is just the identity. *)\n\ncontext M_Signature begin\n\n(* Well-typedness of the translation: *)\nlemma wt[simp]: \"M.wt T \\<Longrightarrow> wt T\"\nby (induct T, auto simp add: list_all_iff)\n\nlemma wtA[simp]: \"M.wtA at \\<Longrightarrow> wtA at\"\napply(cases at) by (auto simp add: list_all_iff)\n\nlemma wtL[simp]: \"M.wtL l \\<Longrightarrow> wtL l\"\napply(cases l) by auto\n\nlemma wtC[simp]: \"M.wtC c \\<Longrightarrow> wtC c\"\nunfolding M.wtC_def wtC_def by (induct c, auto)\n\nlemma wtPB[simp]: \"M.wtPB \\<Phi> \\<Longrightarrow> wtPB \\<Phi>\"\nunfolding M.wtPB_def wtPB_def by auto\n\nend (* context M_Signature *)\n\n\nsubsection{* Completeness *}\n\n(* In our implicitly-typed setting, ``e\" is just the identity. *)\n\ntext{* The next puts together an M$\\_$signature with a structure for its U.flattened signature: *}\n\nlocale UM_Struct =\nM : M_Signature wtFsym wtPsym arOf resOf parOf +\nU : CU.Struct wtFsym wtPsym \"length o arOf\" \"length o parOf\" D intF intP\nfor wtFsym :: \"'fsym \\<Rightarrow> bool\" and wtPsym :: \"'psym \\<Rightarrow> bool\"\nand arOf :: \"'fsym \\<Rightarrow> 'tp list\"\nand resOf and parOf and D and intF and intP\n\nsublocale UM_Struct < M : M.Struct where intT = \"\\<lambda> \\<sigma>. D\"\napply default\n  apply(rule NE_D)\n  unfolding list_all2_list_all apply(rule intF) by auto\n\ncontext UM_Struct begin\n\nlemma wtE[simp]: \"M.wtE \\<xi> \\<Longrightarrow> U.wtE \\<xi>\"\nunfolding U.wtE_def M.wtE_def by auto\n\n\n\nlemma int_o_e[simp]: \"U.int \\<xi> = M.int \\<xi>\"\nunfolding int_e fun_eq_iff by simp\n\n\n\nlemma satL_e[simp]: \"U.satL \\<xi> l \\<longleftrightarrow> M.satL \\<xi> l\"\napply(cases l) by auto\n\nlemma satC_e[simp]: \"U.satC \\<xi> c \\<longleftrightarrow> M.satC \\<xi> c\"\nunfolding M.satC_def U.satC_def by (induct c, simp_all)\n\nlemma satPB_e[simp]: \"U.satPB \\<xi> \\<Phi> \\<longleftrightarrow> M.satPB \\<xi> \\<Phi>\"\nunfolding M.satPB_def U.satPB_def by auto\n\ntheorem completeness:\nassumes \"U.SAT \\<Phi>\"  shows \"M.SAT \\<Phi>\"\nusing assms unfolding M.SAT_def satPB_e U.SAT_def by auto\n\nend (* context UM_Struct *)\n\nlocale UM_Model =\n  M_Problem wtFsym wtPsym arOf resOf parOf \\<Phi> +\n  UM_Struct wtFsym wtPsym arOf resOf parOf D intF intP +\n  CU.Model wtFsym wtPsym  \"length o arOf\" \"length o parOf\" \\<Phi>\n          D intF intP\nfor wtFsym :: \"'fsym \\<Rightarrow> bool\" and wtPsym :: \"'psym \\<Rightarrow> bool\"\nand arOf :: \"'fsym \\<Rightarrow> 'tp list\"\nand resOf and parOf and \\<Phi> and D and intF and intP\nbegin\n\ntheorem M_U_completeness: \"MModel (\\<lambda>\\<sigma>::'tp. D) intF intP\"\napply default apply(rule completeness[OF SAT]) .\n\nend (* context UM_Model *)\n\ntext{* Global statement of completeness : UM$\\_$Model consists\nof an M.problem and an U.model satisfying the U.translation of this problem.\nIt is stated that it yields a model for the M.problem. *}\nsublocale UM_Model < CM.Model where intT = \"\\<lambda> \\<sigma>. D\"\nusing M_U_completeness .\n\n\nsubsection{* Soundness for monotonic problems *}\n\nsublocale M_FullStruct < U : CU.Struct\nwhere arOf = \"length o arOf\" and parOf = \"length o parOf\" and D = \"intT any\"\napply default\n  apply(rule NE_intT)\n  apply (rule full2)\n  unfolding full_True list_all2_list_all by auto\n\n\ncontext M_FullModel begin\n\nlemma wtE[simp]: \"U.wtE \\<xi> \\<Longrightarrow> F.wtE \\<xi>\"\nunfolding U.wtE_def F.wtE_def by auto\n\nlemma int_e[simp]: \"U.int \\<xi> T = F.int \\<xi> T\"\nby (induct T, simp_all add: list_all_iff) (metis map_eq_conv)\n\nlemma int_o_e[simp]: \"U.int \\<xi> = F.int \\<xi>\"\nunfolding fun_eq_iff by auto\n\nlemma satA_e[simp]: \"U.satA \\<xi> at \\<longleftrightarrow> F.satA \\<xi> at\"\nby (cases at) auto\n\nlemma satL_e[simp]: \"U.satL \\<xi> l \\<longleftrightarrow> F.satL \\<xi> l\"\nby (cases l) auto\n\nlemma satC_e[simp]: \"U.satC \\<xi> c \\<longleftrightarrow> F.satC \\<xi> c\"\nunfolding F.satC_def U.satC_def by (induct c, simp_all)\n\nlemma satPB_e[simp]: \"U.satPB \\<xi> \\<Phi> \\<longleftrightarrow> F.satPB \\<xi> \\<Phi>\"\nunfolding F.satPB_def U.satPB_def by auto\n\ntheorem soundness: \"U.SAT \\<Phi>\"\nunfolding U.SAT_def using sat_\\<Phi> satPB_e by auto\n\nlemma U_Model:\n\"CU.Model wtFsym wtPsym (length \\<circ> arOf) (length \\<circ> parOf) \\<Phi> (intT any) intF intP\"\nby (default, rule wtPB[OF wt_\\<Phi>], rule soundness)\n\nend (* context M_FullModel *)\n\n\nsublocale M_FullModel < CU.Model\nwhere arOf = \"length o arOf\" and parOf = \"length o parOf\" and D = \"intT any\"\nusing U_Model .\n\ncontext M_MonotModel begin\n\ntheorem M_U_soundness:\n\"CU.Model wtFsym wtPsym (length \\<circ> arOf) (length \\<circ> parOf) \\<Phi>\n  (InfModel.intTF (any::'tp))\n  (InfModel.intFF arOf resOf intTI intFI) (InfModel.intPF parOf intTI intPI)\"\napply(rule M_FullModel.U_Model)\nunfolding M_FullModel_def apply(rule InfModel.FullModel)\napply(rule MonotModel.InfModelI) by default\n\nend (* context M_MonotModel *)\n\n\ntext{* Global statement of the soundness theorem: M$\\_$MonotModel consists\nof a monotonic F.problem satisfied by an F.model.\nIt is stated that this yields an U.Model for the translated problem. *}\n\nsublocale M_MonotModel < CU.Model\nwhere arOf = \"length o arOf\" and parOf = \"length o parOf\"\nand \\<Phi> = \\<Phi> and D = \"intTF (any::'tp)\" and intF = intFF and intP = intPF\nusing M_U_soundness .\n\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Sort_Encodings/E.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3065307247883567}}
{"text": "section \"Packed Traces without Failures and Invariant Checks\"\ntheory packed_nofails_noinvchecks\n  imports no_failing_invchecks packed_no_fails consistency single_invocation_reduction_helper\n    \"fuzzyrule.fuzzyrule\"\n    state_monotonicGrowth_invariants\nbegin\n\n\ntext \\<open>\n To show that a program is correct, we only have to consider packed transactions \n with no crashes and no invariant checks.\n\\<close>\n\ndefinition isNotTrueInvcheck :: \"(invocId \\<times> ('proc, 'op, 'any) action) \\<Rightarrow> bool\"\n      where \"isNotTrueInvcheck \\<equiv> (\\<lambda>a. case a of (s, AInvcheck True) \\<Rightarrow> False | _\\<Rightarrow> True)\"\n\nlemma packed_trace_filter:\n  assumes packed: \"packed_trace trace\"\n    and keepAllowedContextSwitch: \"\\<And>i a. allowed_context_switch a \\<Longrightarrow> P (i, a)\"\n  shows \"packed_trace (filter P trace)\"\nproof -\n  from packed \n  have \"packed_trace (filter P trace) \n       \\<and> (filter P trace \\<noteq> [] \\<longrightarrow> get_invoc (last (filter P trace)) = get_invoc (last trace))\"\n  proof (induct trace rule: rev_induct)\n    case Nil\n    then show ?case by simp\n  next\n    case (snoc x xs)\n    then have IH1: \"packed_trace (filter P xs)\"\n      and IH2: \"(filter P xs \\<noteq> [] \\<Longrightarrow> get_invoc (last (filter P xs)) = get_invoc (last xs))\"\n      using isPrefix_appendI prefixes_are_packed by blast+\n\n    \n\n    show ?case \n    proof (cases \"filter P xs = []\")\n      case True\n      then show ?thesis \n        by (auto simp add:  packed_trace_def nth_append)\n    next\n      case False\n      \n      from `packed_trace (xs @ [x])`\n      have \"get_invoc (last xs) = get_invoc x\" if \"\\<not>allowed_context_switch (get_action x)\"\n        using that\n        by (smt False append.assoc append_Cons append_butlast_last_id diff_Suc_1 filter.simps(1) length_append_singleton length_greater_0_conv lessI nth_append_length use_packed_trace) \n      \n      from False have \"get_invoc (last (filter P xs)) = get_invoc (last xs)\"\n        using IH2 by blast\n      then show ?thesis \n      proof (auto simp add: packed_trace_def nth_append)\n\n        show \"get_invoc (last xs) = get_invoc x\"\n          if c0: \"get_invoc (last (filter P xs)) = get_invoc (last xs)\"\n            and c1: \"\\<not> P x\"\n            and c2: \"filter P xs \\<noteq> []\"\n          using that\n          by (metis \\<open>\\<not> allowed_context_switch (get_action x) \\<Longrightarrow> get_invoc (last xs) = get_invoc x\\<close> keepAllowedContextSwitch surjective_pairing) \n\n      next\n        fix i\n        assume a0: \"get_invoc (last (filter P xs)) = get_invoc (last xs)\"\n          and a1: \"P x\"\n          and a2: \"i - Suc 0 < length (filter P xs)\"\n\n        show \"allowed_context_switch (get_action (filter P xs ! i))\"\n          if a3: \"i < length (filter P xs)\"\n            and a4: \"0 < i\"\n            and a5: \"get_invoc (filter P xs ! (i - Suc 0)) \\<noteq> get_invoc (filter P xs ! i)\"\n          by (simp add: IH1 a3 a4 a5 use_packed_trace)\n\n\n\n        show \"allowed_context_switch (get_action x)\"\n          if a3: \"\\<not> i < length (filter P xs)\"\n            and a4: \"i < Suc (length (filter P xs))\"\n            and a5: \"get_invoc (filter P xs ! (i - Suc 0)) \\<noteq> get_invoc x\"\n          using IH1 use_packed_trace[OF IH1]\n          by (metis (no_types, lifting) False One_nat_def a0 a3 a4 a5 butlast_snoc diff_less filter.simps(1) last_conv_nth length_append_singleton length_greater_0_conv lessI less_antisym nth_append_length nth_butlast snoc.prems use_packed_trace)\n\n      next\n        fix i\n        assume a0: \"get_invoc (last (filter P xs)) = get_invoc (last xs)\"\n          and a1: \"\\<not> P x\"\n          and a2: \"i - Suc 0 < length (filter P xs)\"\n          and a3: \"0 < i\"\n          and a4: \"i < length (filter P xs)\"\n          and a5: \"get_invoc (filter P xs ! (i - Suc 0)) \\<noteq> get_invoc (filter P xs ! i)\"\n\n        show \"allowed_context_switch (get_action (filter P xs ! i))\"\n          by (simp add: IH1 a3 a4 a5 use_packed_trace)\n\n\n      qed\n    qed\n  qed\n  thus \"packed_trace (filter P trace)\"\n    by auto\nqed\n\n\ntext_raw \\<open>\\DefineSnippet{show_programCorrect_noTransactionInterleaving_no_passing_invchecks}{\\<close>\ntheorem show_programCorrect_noTransactionInterleaving_no_passing_invchecks:\n  assumes packedTracesCorrect: \n    \"\\<And>trace s. \\<lbrakk>\n        initialState program ~~ trace \\<leadsto>* s; \n        packed_trace trace; \n        \\<And>s. (s, ACrash) \\<notin> set trace; \n        \\<And>s. (s, AInvcheck True) \\<notin> set trace\n      \\<rbrakk> \\<Longrightarrow> traceCorrect trace\"\nshows \"programCorrect program\"\ntext_raw \\<open>}%EndSnippet\\<close>\nproof (rule show_programCorrect_noTransactionInterleaving)\n  fix trace\n  fix S\n  assume steps: \"initialState program ~~ trace \\<leadsto>* S\"\n    and packed: \"packed_trace trace\" \n    and nofail: \"\\<And>s. (s, ACrash) \\<notin> set trace\"\n\n  show \"traceCorrect trace\"\n  proof (rule ccontr)\n    assume a: \"\\<not> traceCorrect trace\"\n\n    \n    define trace' where \"trace' \\<equiv> filter isNotTrueInvcheck trace\"\n\n    have isNotTrueInvcheck_simps: \"isNotTrueInvcheck a \\<longleftrightarrow> \\<not>(\\<exists>s. a = (s, AInvcheck True))\" for a\n      by (auto simp add: isNotTrueInvcheck_def split: prod.splits action.splits)\n\n    have \"traceCorrect trace'\"\n    proof (rule packedTracesCorrect)\n      from steps\n      show \"initialState program ~~ trace' \\<leadsto>* S\"\n      proof (auto simp add: trace'_def, induct rule: steps_induct)\n        case initial\n        then show ?case   by (auto simp add: steps_empty )\n      next\n        case (step S' tr a S'')\n        show ?case \n        proof auto\n          assume  \"isNotTrueInvcheck a\"\n          then show \"initialState program ~~ filter isNotTrueInvcheck tr @ [a] \\<leadsto>* S''\"\n            using step.IH step.step steps_step step.steps by blast \n        next \n          assume \"\\<not> isNotTrueInvcheck a\"\n          then have \"S' = S''\"\n            using \\<open>S' ~~ a \\<leadsto> S''\\<close>\n            by (auto simp add: isNotTrueInvcheck_def step.simps split: bool.splits)\n          then show \"initialState program ~~ filter isNotTrueInvcheck tr  \\<leadsto>* S''\"\n            using step.IH step.steps  by blast\n        qed\n      qed\n\n      from packed \n      have \"packed_trace (filter isNotTrueInvcheck trace)\"\n      proof (rule packed_trace_filter)\n        show \" \\<And>i a. allowed_context_switch a \\<Longrightarrow> isNotTrueInvcheck (i, a)\"\n          by (auto simp add: allowed_context_switch_simps isNotTrueInvcheck_simps)\n      qed\n\n      then show \"packed_trace trace'\"\n        unfolding trace'_def by simp\n        \n      show \" \\<And>s. (s, ACrash) \\<notin> set trace'\"\n        by (auto simp add: trace'_def nofail)\n\n      show \"\\<And>s. (s, AInvcheck True) \\<notin> set trace'\"\n        by  (auto simp add: trace'_def isNotTrueInvcheck_def)\n    qed\n    then have \"traceCorrect trace\"\n      by  (auto simp add: trace'_def traceCorrect_def isNotTrueInvcheck_def actionCorrect_def, force+)\n\n    then show \"False\"\n      using a by blast\n  qed\nqed\n\ntext_raw \\<open>\\DefineSnippet{move_invariant_checks_out_of_transactions}{\\<close>\nlemma move_invariant_checks_out_of_transactions:\n  assumes \"initialState program ~~ trace \\<leadsto>* S\"\n    and \"packed_trace trace\"\n    and \"\\<And>s. (s, ACrash) \\<notin> set trace\"\n    and \"\\<And>s. (s, AInvcheck True) \\<notin> set trace\"\n    and \"length trace > 0\"\n    and \"last trace = (s, AInvcheck False)\"\n    and \"\\<And>i s'. i<length trace - 1 \\<Longrightarrow> trace!i \\<noteq> (s', AInvcheck False)\"\n  shows \"\\<exists>trace' s'. \n          (\\<exists>S'. initialState program ~~ trace' \\<leadsto>* S')\n        \\<and> packed_trace trace'\n        \\<and> (\\<forall>s. (s, ACrash) \\<notin> set trace')\n        \\<and> (\\<forall>s. (s, AInvcheck True) \\<notin> set trace')\n        \\<and> (last trace' = (s', AInvcheck False))\n        \\<and> length trace' > 0\n        \\<and> (no_invariant_checks_in_transaction trace')\"\ntext_raw \\<open>}%EndSnippet\\<close>\n  using assms proof (induct \"length trace\" arbitrary: trace s S rule: less_induct)\n  case (less trace s S)\n  show ?case \n  proof (cases \"no_invariant_checks_in_transaction trace\")\n    case True\n    then show ?thesis \n      using less.prems by auto\n  next\n    case False\n\n    from this obtain ib i s' tx ib_txns c \n      where ib1: \"trace ! ib = (s', ABeginAtomic tx ib_txns)\"\n        and ib2: \"ib < i\"\n        and \"i < length trace\"\n        and noEndAtomic1: \"\\<forall>j. ib < j \\<and> j < i \\<longrightarrow> trace ! j \\<noteq> (s', AEndAtomic)\"\n        and \"trace ! i = (s', AInvcheck c)\"\n      by (auto simp add: no_invariant_checks_in_transaction_def)\n    then have i_def: \"i = length trace - 1\" \n      by (smt One_nat_def Suc_pred less.prems(4) less.prems(5) less.prems(7) less_Suc_eq nth_mem)\n\n    have [simp]: \"s' = s\" \n      using \\<open>trace ! i = (s', AInvcheck c)\\<close> i_def last_conv_nth less.prems by (auto simp add: last_conv_nth)\n\n\n\n    have ib2: \"ib < length trace - 1\"\n      using i_def ib2 by blast\n    from noEndAtomic1\n    have noEndAtomic: \"trace ! j \\<noteq> (s, AEndAtomic)\" if \"ib\\<le>j\" and \"j<length trace\" for j\n      using that\n      by (metis One_nat_def Pair_inject Suc_pred \\<open>s' = s\\<close> \\<open>trace ! i = (s', AInvcheck c)\\<close> action.distinct(31) action.distinct(51) i_def ib1 le_eq_less_or_eq less.prems(5) less_antisym)\n\n\n    (* Let action a be the action before the invariant check.\n     Get the state before and show that we can execute the invariant before that as well\n     Then use IH.  *)\n\n    have \"xs = ys\" if \"\\<And>i. i<length xs \\<Longrightarrow> xs!i = ys!i\" and \"length xs = length ys\" for xs ys\n      using nth_equalityI that(1) that(2) by blast\n\n\n    have \"length trace \\<ge> 2\"\n      using ib2 by linarith\n\n    from this\n    obtain trace_len_minus2 \n        where trace_len_minus2_def: \"length trace = Suc (Suc trace_len_minus2)\"\n      by (metis One_nat_def Suc_pred ib2 `0 < length trace` less_imp_Suc_add)\n\n    have trace_nonempty: \"trace \\<noteq> []\"\n      using `0 < length trace` by blast\n\n\n    have trace_split: \"trace = take (length trace - 2) trace @ [trace!(length trace -2), last trace]\"\n    proof (rule nth_equalityI)\n      show \"length trace = length (take (length trace - 2) trace @ [trace ! (length trace - 2), last trace])\"\n        using \\<open>length trace \\<ge> 2\\<close> by (auto simp add: min_def nth_append nth_Cons')\n      show \"\\<And>i. i < length trace \\<Longrightarrow>\n         trace ! i = (take (length trace - 2) trace @ [trace ! (length trace - 2), last trace]) ! i\"\n        using trace_len_minus2_def trace_nonempty  by (auto simp add: le_less_Suc_eq last_conv_nth min_def nth_append nth_Cons' not_less)\n    qed\n\n\n    from \\<open>initialState program ~~ trace \\<leadsto>* S\\<close>\n    obtain S1 S2\n      where steps_S1: \"initialState program ~~ take (length trace - 2) trace \\<leadsto>* S1\"\n        and step_S2: \"S1 ~~ trace!(length trace -2) \\<leadsto> S2\"\n        and step_inv: \"S2 ~~ last trace \\<leadsto> S\"\n      by (metis (no_types, lifting) butlast.simps(2) butlast_append butlast_snoc last_snoc `0 < length trace` less_numeral_extra(3) list.simps(3) list.size(3) steps.cases steps_appendBack trace_split)\n\n    from step_inv \n    have step_inv': \"S2 ~~ (s, AInvcheck False) \\<leadsto> S\"\n      by (auto simp add: \\<open>last trace = (s, AInvcheck False)\\<close>)\n\n    have invariant_fail_S2[simp]: \"\\<not> invariant (prog S2) (invContext S2)\"\n      using step_elim_AInvcheck step_inv' by blast\n\n    have \"get_invoc (trace!(length trace -1)) = s\"\n      using \\<open>trace ! i = (s', AInvcheck  c)\\<close> i_def by auto\n\n    with \\<open>packed_trace trace\\<close>\n    have \"get_invoc (trace!(length trace -2)) = s\" \n      by (auto simp add: packed_trace_def allowed_context_switch_def,\n          metis One_nat_def Suc_le_lessD \\<open>2 \\<le> length trace\\<close> \\<open>i < length trace\\<close> \\<open>trace ! i = (s', AInvcheck c)\\<close> allowed_context_switch_simps(9) diff_Suc_eq_diff_pred i_def less.prems(2) numeral_2_eq_2 snd_conv use_packed_trace zero_less_diff)\n\n    from this obtain action \n      where action_def: \"trace!(length trace -2) = (s, action)\"\n      by (meson eq_fst_iff)\n    with \\<open>S1 ~~ trace!(length trace -2) \\<leadsto> S2\\<close>\n    have \"S1 ~~ (s, action) \\<leadsto> S2\"\n      by simp\n\n\n    have wf: \"state_wellFormed S1\"\n      using state_wellFormed_combine state_wellFormed_init steps_S1\n      by (metis contra_subsetD less.prems(3) set_take_subset) \n\n\n\n    show ?thesis\n    proof (cases \"ib < length trace - 2\")\n      case True\n      then have [simp]: \"ib < length trace - 2\"\n        by simp\n\n      have currentTx: \"currentTx S1 s \\<triangleq> tx\" \n      proof (rule currentTx2[OF steps_S1])\n\n        show \"take (length trace - 2) trace ! ib = (s, ABeginAtomic tx ib_txns)\"\n          using ib1 ib2  by auto\n\n        show \"ib < length (take (length trace - 2) trace)\"\n          using ib2 by auto\n        show \"\\<And>j. \\<lbrakk>ib < j; j < length (take (length trace - 2) trace)\\<rbrakk> \\<Longrightarrow> take (length trace - 2) trace ! j \\<noteq> (s, ACrash)\"\n          using less.prems(3) nth_mem by fastforce \n        show \"\\<And>j. \\<lbrakk>ib < j; j < length (take (length trace - 2) trace)\\<rbrakk> \\<Longrightarrow> take (length trace - 2) trace ! j \\<noteq> (s, AEndAtomic)\"\n          using noEndAtomic by auto\n      qed\n\n      with wf\n      have ls_none: \"localState S1 s \\<noteq> None\"\n        using inTransaction_localState by blast \n\n      have \"S1 ~~ (s, AInvcheck False) \\<leadsto> S1\"\n      proof (cases action)\n        case ALocal\n        then show ?thesis\n          using invariant_fail_S2 \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close> step_elim_AInvcheck step_inv' by (auto simp add: step_simps, fastforce)\n      next\n        case (ANewId x2)\n        then show ?thesis\n          using invariant_fail_S2 \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close>  by (auto simp add: step_simps, auto)\n      next\n        case (ABeginAtomic x31 x32)\n        then show ?thesis\n          using \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close> currentTx step_simps(3) by force\n      next\n        case AEndAtomic\n        then show ?thesis\n          using action_def ib2 noEndAtomic by auto \n      next\n        case (ADbOp cId proc res)\n\n        obtain tx where currentTx: \"currentTx S1 s \\<triangleq> tx\"\n          using \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close> ADbOp\n          by (auto simp add:  step_simps)\n        then have uncommitted: \"txStatus S1 tx \\<triangleq> Uncommitted\"\n          using local.wf wellFormed_currentTx_unique_h(2) by blast\n\n        have \"calls S1 cId = None\"\n          using \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close> ADbOp\n          by (auto simp add:  step_simps)\n        then have \"callOrigin S1 cId = None\"\n          using local.wf wellFormed_callOrigin_dom2 by blast\n\n\n        have \"committedCalls S2 = committedCalls S1\" \n          using \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close> ADbOp\n          by (auto simp add:  step_simps ls_none committedCallsH_def isCommittedH_def currentTx uncommitted \\<open>callOrigin S1 cId = None\\<close> split: if_splits)\n\n        have \"invContext S2 = invContext S1 \"\n          using \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close> ADbOp \\<open>callOrigin S1 cId = None\\<close> noOrigin_notCommitted\n          by (auto simp add: invContextH_def \\<open>committedCalls S2 = committedCalls S1\\<close> invContextH_def step_simps ls_none restrict_map_def restrict_relation_def intro!: ext, blast+)\n\n\n         with invariant_fail_S2\n         have \"\\<not> invariant (prog S1) (invContext S1)\"\n           using \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close> prog_inv by force\n\n         then show ?thesis \n          using invariant_fail_S2 ADbOp \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close> by (auto simp add: step_simps ls_none)\n      next\n        case (AInvoc )\n        then show ?thesis \n          using invariant_fail_S2 \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close>  by (auto simp add: step_simps ls_none)\n      next\n        case (AReturn x7)\n        then show ?thesis \n          using invariant_fail_S2 \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close>  by (auto simp add: step_simps ls_none currentTx)\n      next\n        case ACrash\n        then show ?thesis\n          by (metis action_def diff_less less.prems(3) `0 < length trace` nth_mem zero_less_numeral)\n      next\n        case (AInvcheck r)\n        then show ?thesis \n          by (metis (full_types) Suc_1 Suc_diff_Suc Suc_le_lessD \\<open>2 \\<le> length trace\\<close> action_def diff_less less.prems(4) `0 < length trace` less.prems(7) lessI nth_mem zero_less_numeral)\n      qed\n      show ?thesis\n      proof (rule less.hyps) \\<comment> \\<open>USE induction hypothesis\\<close>\n        from \\<open>S1 ~~ (s, AInvcheck False) \\<leadsto> S1\\<close>\n        show \" initialState program ~~ take (length trace - 2) trace @ [(s, AInvcheck False)] \\<leadsto>* S1\"\n          using steps_S1 steps_step by blast\n\n        have no_ctxt_switch: \"\\<not>allowed_context_switch (get_action (trace!(length trace -2)))\"\n          using \\<open>S1 ~~ trace ! (length trace - 2) \\<leadsto> S2\\<close>\n          using action_def currentTx ls_none by (auto simp add: step.simps allowed_context_switch_simps)\n\n\n\n        show \"packed_trace (take (length trace - 2) trace @ [(s, AInvcheck False)])\"\n        proof (auto simp add: packed_trace_def nth_append min_def not_less)\n\n\n          show \"allowed_context_switch (get_action (trace ! i))\"\n            if c1: \"i - Suc 0 < length trace - 2\"\n              and c3: \"0 < i\"\n              and c4: \"get_invoc (trace ! (i - Suc 0)) \\<noteq> get_invoc (trace ! i)\"\n            for  i\n            using c1 c3 c4 by (simp add: less.prems(2) use_packed_trace)\n\n          show \"allowed_context_switch (AInvcheck False)\"\n            if c0: \"\\<not> length trace \\<le> length trace - 2\"\n              and c1: \"i - Suc 0 < length trace - 2\"\n              and c2: \"length trace - 2 \\<le> i\"\n              and c3: \"i < Suc (length trace - 2)\"\n              and c4: \"get_invoc (trace ! (i - Suc 0)) \\<noteq> s\"\n            for  i\n          proof -\n            have \"i = length trace - 2\"\n              using c2 c3 le_less_Suc_eq by blast \n\n            show \"allowed_context_switch (AInvcheck False)\"\n              using \\<open>get_invoc (trace!(length trace -2)) = s\\<close> \n               use_packed_trace[OF \\<open>packed_trace trace\\<close>, where i=\"length trace - 2\"]\n               \\<open>i = length trace - 2\\<close> c4 no_ctxt_switch\n              by force\n          qed\n        qed\n\n        show \"0 < length (take (length trace - 2) trace @ [(s, AInvcheck False)])\"\n          by simp\n\n\n\n        show \"\\<And>s'. (s', AInvcheck True) \\<notin> set (take (length trace - 2) trace @ [(s, AInvcheck False)])\"\n          by (auto, meson in_set_takeD less.prems(4))\n\n        show \"\\<And>s'. (s', ACrash) \\<notin> set (take (length trace - 2) trace @ [(s, AInvcheck False)])\"\n          by (auto, meson in_set_takeD less.prems(3))\n\n        show \"last (take (length trace - 2) trace @ [(s, AInvcheck False)]) = (s, AInvcheck False)\"\n          by simp\n\n        show \"length (take (length trace - 2) trace @ [(s, AInvcheck False)]) < length trace\"\n          by (metis add_Suc_right length_Cons length_append lessI trace_split)\n        show \"\\<And>i s'.\n       i < length (take (length trace - 2) trace @ [(s, AInvcheck False)]) - 1 \\<Longrightarrow>\n       (take (length trace - 2) trace @ [(s, AInvcheck False)]) ! i \\<noteq> (s', AInvcheck False)\"\n          by (auto simp add: nth_append less.prems)\n      qed\n\n\n    next\n      case False\n      then have \"ib = length trace - 2\"\n        using ib2 by linarith\n      then have \"action = ABeginAtomic tx ib_txns\"\n        using action_def ib1 by auto\n      with  \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close>\n      have \"invContext S1 = invContext S2\"\n        using invariant_fail_S2 by (auto simp add: step_simps invContextH_def restrict_map_def committedCallsH_update_uncommitted )\n\n      with \\<open>S1 ~~ (s, action) \\<leadsto> S2\\<close> and \\<open>action = ABeginAtomic tx ib_txns\\<close>\n      have \"S1 ~~ (s', AInvcheck False) \\<leadsto> S1\" for s'\n        using invariant_fail_S2 by (auto simp add: step_simps, auto)\n\n      define new_s where \"new_s = get_invoc(trace ! (length trace - 3))\" \n\n      show ?thesis\n      proof (rule less.hyps) \\<comment> \\<open>USE induction hypothesis\\<close>\n        from \\<open>S1 ~~ (new_s, AInvcheck False) \\<leadsto> S1\\<close>\n        show \" initialState program ~~ take (length trace - 2) trace @ [(new_s, AInvcheck False)] \\<leadsto>* S1\"\n          using steps_S1 steps_step by blast\n\n\n        show \"packed_trace (take (length trace - 2) trace @ [(new_s, AInvcheck False)])\"\n          by (auto simp add: packed_trace_def nth_append min_def not_less new_s_def  less.prems(2),\n              simp add: less.prems(2) use_packed_trace,\n              metis One_nat_def diff_Suc_eq_diff_pred le_less_Suc_eq numeral_2_eq_2 numeral_3_eq_3)\n\n        show \"0 < length (take (length trace - 2) trace @ [(new_s, AInvcheck False)])\"\n          by simp\n\n        show \"\\<And>s'. (s', AInvcheck True) \\<notin> set (take (length trace - 2) trace @ [(new_s, AInvcheck False)])\"\n          by (auto, meson in_set_takeD less.prems(4))\n\n        show \"\\<And>s'. (s', ACrash) \\<notin> set (take (length trace - 2) trace @ [(new_s, AInvcheck False)])\"\n          by (auto, meson in_set_takeD less.prems(3))\n\n        show \"last (take (length trace - 2) trace @ [(new_s, AInvcheck False)]) = (new_s, AInvcheck False)\"\n          by simp\n\n        show \"length (take (length trace - 2) trace @ [(new_s, AInvcheck False)]) < length trace\"\n          by (metis add_Suc_right length_Cons length_append lessI trace_split)\n        show \"\\<And>i s'.\n       i < length (take (length trace - 2) trace @ [(new_s, AInvcheck False)]) - 1 \\<Longrightarrow>\n       (take (length trace - 2) trace @ [(new_s, AInvcheck False)]) ! i \\<noteq> (s', AInvcheck False)\"\n          by (auto simp add: nth_append less.prems)\n      qed\n    qed\n  qed\nqed\n\n\ntext \\<open>\n To show that a program is correct, we only have to consider packed transactions \n with no invariant checks \n\\<close>\ntext_raw \\<open>\\DefineSnippet{show_programCorrect_noTransactionInterleaving1}{\\<close>\ntheorem show_programCorrect_noTransactionInterleaving':\n  assumes packedTracesCorrect: \n    \"\\<And>trace s. \\<lbrakk>\n        initialState program ~~ trace \\<leadsto>* s; \n        packed_trace trace; \n        \\<And>s. (s, ACrash) \\<notin> set trace; \n        \\<And>s. (s, AInvcheck True) \\<notin> set trace; \n        no_invariant_checks_in_transaction trace\\<rbrakk> \n    \\<Longrightarrow> traceCorrect trace\"\nshows \"programCorrect program\"\ntext_raw \\<open>}%EndSnippet\\<close>\nproof (rule show_programCorrect_noTransactionInterleaving_no_passing_invchecks)\n  fix trace\n  fix S\n  assume steps: \"initialState program ~~ trace \\<leadsto>* S\"\n    and packed: \"packed_trace trace\" \n    and nofail: \"\\<And>s. (s, ACrash) \\<notin> set trace\"\n    and noTrueInvs: \"\\<And>s. (s, AInvcheck True) \\<notin> set trace\"\n\n\n\n  show \"traceCorrect trace\"\n  proof (cases \"\\<exists>a\\<in>set trace. get_action a = AInvcheck False\")\n    case True\n    from this\n    obtain i1 where exists_inv_fail: \"(\\<exists>s. trace!i1 = (s, AInvcheck False)) \\<and> i1 < length trace\" \n      by (metis eq_snd_iff in_set_conv_nth)\n\n\n    show \"traceCorrect trace\"\n    proof (rule ccontr)\n      assume a: \"\\<not> traceCorrect trace\"\n\n\\<comment> \\<open>get the first failing invariant check\\<close>\n      obtain i \n        where i1: \"\\<exists>s. trace ! i = (s, AInvcheck False)\"\n          and i2: \"i < length trace\"\n          and i_min: \"\\<forall>i'. (\\<exists> s'. trace ! i' = (s', AInvcheck False)) \\<and> i' < length trace \\<longrightarrow> i\\<le>i'\"\n        by (atomize_elim,\n            rule exI[where x=\"LEAST i'. (\\<exists>s'. trace ! i' = (s', AInvcheck False)) \\<and> i' < length trace\"],\n            rule LeastI2_wellorder_ex,\n            insert exists_inv_fail, auto)\n\n\n\n\n      from i1\n      obtain s where i1': \"trace ! i = (s, AInvcheck False)\"\n        by blast\n\n      have trace_split3: \"trace = take (Suc i) trace  @ drop (Suc i) trace\"\n        by auto\n\n      with steps\n      have \"initialState program ~~ take (Suc i) trace  @ drop (Suc i) trace \\<leadsto>* S\" \n        by simp\n      from this\n      obtain Si \n        where steps_Si: \"initialState program ~~ take (Suc i) trace \\<leadsto>* Si\"\n        using steps_append by blast\n\n      have \"\\<exists>trace' s'. (\\<exists>S'. initialState program ~~ trace' \\<leadsto>* S') \\<and>\n                  packed_trace trace' \\<and>\n                  (\\<forall>s. (s, ACrash) \\<notin> set trace') \\<and>\n                  (\\<forall>s. (s, AInvcheck True) \\<notin> set trace') \\<and> last trace' = (s', AInvcheck False) \\<and> 0 < length trace' \\<and> no_invariant_checks_in_transaction trace'\"\n      proof (rule  move_invariant_checks_out_of_transactions[OF steps_Si])\n        show \"packed_trace (take (Suc i) trace)\"\n          by (metis isPrefix_appendI packed prefixes_are_packed trace_split3)\n        show \"\\<And>s. (s, ACrash) \\<notin> set (take (Suc i) trace)\"\n          by (meson in_set_takeD nofail)\n        show \"\\<And>s. (s, AInvcheck True) \\<notin> set (take (Suc i) trace)\"\n          by (meson in_set_takeD noTrueInvs)\n        show \"last (take (Suc i) trace) = (s, AInvcheck False)\"\n          by (simp add: i1' i2 take_Suc_conv_app_nth)\n        show \"0 < length (take (Suc i) trace)\"\n          using gr_implies_not_zero i2 by auto\n        show \"\\<And>ia s' . ia < length (take (Suc i) trace) - 1 \\<Longrightarrow> take (Suc i) trace ! ia \\<noteq> (s', AInvcheck False)\"\n          using i_min by fastforce\n      qed\n\n      then show False\n        using actionCorrect_def last_in_set packedTracesCorrect traceCorrect_def by fastforce\n    qed\n  next \n    case False\n    show ?thesis\n      using steps\n    proof (rule packedTracesCorrect)\n      show \"packed_trace trace\"\n        by (simp add: packed)\n\n      show \"\\<And>s. (s, ACrash) \\<notin> set trace\"\n        by (simp add: nofail)\n\n      show \"\\<And>s. (s, AInvcheck True) \\<notin> set trace\"\n        by (simp add: noTrueInvs)\n\n\n      show \"no_invariant_checks_in_transaction trace\"\n        using False noTrueInvs \n        by (auto simp add: no_invariant_checks_in_transaction_def all_set_conv_all_nth in_set_conv_nth)\n    qed\n  qed\nqed\n\n(* TODO utils *)\nlemma show_list_split:\n  assumes \"ys = take (length ys) xs\"\n    and \"zs = drop (length ys) xs\"\n  shows \"xs = ys @ zs\"\n  by (metis append_take_drop_id assms(1) assms(2))\n\nlemma append_eq_conv_conj':\n  shows \"(xs = ys @ zs) \\<longleftrightarrow> (ys = take (length ys) xs \\<and> zs = drop (length ys) xs)\"\n  by (metis append_eq_conv_conj)\n\nlemma cons_eq_conv_conj': \n  \"(y # ys = xs) \\<longleftrightarrow> (xs \\<noteq> [] \\<and> y = hd xs \\<and> ys = tl xs)\"  for xs ys zs\n  by force\n\nlemmas list_split_utils = \n  append_eq_conv_conj \n  append_eq_conv_conj'\n  cons_eq_conv_conj \n  cons_eq_conv_conj'\n\nlemma min_simps:\n  fixes x :: nat\n  shows\n \"x < y \\<Longrightarrow> min x y = x\"\n\"x < y \\<Longrightarrow> min y x = x\"\n \"x \\<le> y \\<Longrightarrow> min x y = x\"\n\"x \\<le> y \\<Longrightarrow> min y x = x\"\n  by auto\n\n\nlemma no_more_actions_on_packed_trace_if_context_switch_in_transaction:\n  assumes \"S ~~ tr \\<leadsto>* S'\"\n    and \"packed_trace tr\"\n    and \"currentTx S i \\<triangleq> tx\"\n    and \"get_invoc (hd tr) \\<noteq> i\"\n    and \"tr \\<noteq> []\"\n    and \"state_wellFormed S\"\n    and \"\\<And>i. (i, ACrash) \\<notin> set tr\"\n  shows \"currentTx S' i \\<triangleq> tx \\<and> (\\<forall>a\\<in>set tr. get_invoc a \\<noteq> i)\"\n  using assms proof (induct rule: steps_induct)\n  case initial\n  then show ?case\n    by simp\nnext\n  case (step S' tr a S'')\n\n  show ?case\n  proof (cases tr)\n    case Nil\n    then show ?thesis\n      using step by (auto simp add: steps_empty,\n          metis prod.collapse unchangedInTransaction(3))\n  next\n    case (Cons x xs)\n\n\n\n\n    have IH: \"currentTx S' i \\<triangleq> tx \\<and> (\\<forall>a\\<in>set tr. get_invoc a \\<noteq> i)\"\n    proof (rule step.IH)\n      show \"packed_trace tr\"\n        using packed_trace_prefix step.prems(1) by blast\n      show \"currentTx S i \\<triangleq> tx\"\n        by (simp add: step.prems(2))\n      show \"tr \\<noteq> []\"\n        using local.Cons by blast\n      show \" get_invoc (hd tr) \\<noteq> i\"\n        using \\<open>tr \\<noteq> []\\<close> step.prems(3) by auto\n      show \"state_wellFormed S\"\n        by (simp add: step.prems(5))\n      show \"\\<And>i. (i, ACrash) \\<notin> set tr\"\n        using step.prems(6) by auto\n\n    qed\n\n    have \"state_wellFormed S'\"\n      using state_wellFormed_combine\n        `S ~~ tr \\<leadsto>* S'` `state_wellFormed S`\n        step.prems(6) by fastforce \n\n\n\n    from use_packed_trace[OF `packed_trace (tr @ [a])`, where i=\"length tr\"]\n    have no_context_switch: \"allowed_context_switch (get_action a)\" if \"get_invoc a = i\"\n      by (auto, metis IH diff_Suc_less length_greater_0_conv list.distinct(1) local.Cons nth_append nth_mem that)\n\n    find_theorems allowed_context_switch packed_trace\n\n\n    from `S' ~~ a \\<leadsto> S''` IH no_context_switch\n    show ?thesis\n      using  state_wellFormed_ls_to_visibleCalls[OF \\<open>state_wellFormed S'\\<close>]\n      by (auto simp add: step.simps allowed_context_switch_def, blast)\n\n\n\n  qed\nqed\n\nlemma no_invariant_checks_in_transaction_prefix:\n  assumes a: \"no_invariant_checks_in_transaction tr\"\nand p: \"isPrefix tr' tr\"\nshows \"no_invariant_checks_in_transaction tr'\"\n  using a isPrefix_len[OF p] isPrefix_same[OF p] order.strict_trans2\n  by (auto simp add: no_invariant_checks_in_transaction_def, blast)\n\nlemma no_context_switch_transaction:\n  assumes \"S ~~ tr \\<leadsto>* S'\"\n    and \"(hd tr) = (invoc, ABeginAtomic tx txns)\"\n    and \"(invoc, AEndAtomic) \\<notin> set tr\"\n    and \"packed_trace tr\"\n    and \"\\<forall>a\\<in>set (tl tr). \\<not>allowed_context_switch (get_action a)\"\n  shows \"\\<forall>a\\<in>set tr. get_invoc a = invoc\"\n  using assms proof (induct rule: steps_induct)\n  case initial\n  then show ?case\n    by simp\nnext\n  case (step S' tr a S'')\n\n  show ?case\n  proof (cases \"tr=[]\")\n    case True\n    then show ?thesis \n      using step.prems(1) by auto\n  next\n    case False\n\n\n    have \"packed_trace tr\"\n      using packed_trace_prefix step.prems(3) by blast\n\n    have \"hd tr = (invoc, ABeginAtomic tx txns)\" \n      using step.prems(1) `tr \\<noteq> []` by auto\n\n\n    have \"(invoc, AEndAtomic) \\<notin> set tr\"\n      using step.prems(2) by auto\n\n    from step.IH\n    have \"\\<forall>a\\<in>set tr. get_invoc a = invoc\"\n      using False \\<open>(invoc, AEndAtomic) \\<notin> set tr\\<close> \\<open>hd tr = (invoc, ABeginAtomic tx txns)\\<close> \\<open>packed_trace tr\\<close> step.prems(4) by auto\n\n\n    from `\\<forall>a\\<in>set (tl (tr @ [a])). \\<not> allowed_context_switch (get_action a)`\n    have \"\\<not>allowed_context_switch (get_action a)\" if \"tr \\<noteq> []\"\n      using that by auto\n\n\n\n    have \"get_invoc a = invoc\"\n    proof (rule ccontr)\n      assume \"get_invoc a \\<noteq> invoc\"\n      hence \"allowed_context_switch (get_action a)\"\n        using use_packed_trace[OF `packed_trace (tr @ [a])`, where i=\"length tr\"]\n        by (simp add: False \\<open>\\<forall>a\\<in>set tr. get_invoc a = invoc\\<close> nth_append)\n\n      thus False\n        using False \\<open>tr \\<noteq> [] \\<Longrightarrow> \\<not> allowed_context_switch (get_action a)\\<close> by blast\n    qed\n\n\n    show ?thesis\n      using \\<open>\\<forall>a\\<in>set tr. get_invoc a = invoc\\<close> \\<open>get_invoc a = invoc\\<close> by auto\n  qed\nqed\n\nlemma no_context_switch_transaction2:\n  assumes \"S ~~ tr \\<leadsto>* S'\"\n    and \"tr!i = (invoc, ABeginAtomic tx txns)\"\n    and \"\\<And>j. i < j \\<Longrightarrow> j \\<le> k \\<Longrightarrow> tr ! j \\<noteq> (invoc, AEndAtomic)\"\n    and \"packed_trace tr\"\n    and \"\\<And>j. i < j \\<Longrightarrow> j \\<le> k \\<Longrightarrow> \\<not>allowed_context_switch (get_action (tr!j))\"\n    and \"i \\<le> k\"\n    and \"k < length tr\"\n  shows \"get_invoc (tr!k) = invoc\"\nproof -\n\n  obtain tr1 tr2 tr3 \n    where tr_split: \"tr = tr1 @ tr2 @ tr3\"\n      and \"i = length tr1\"\n      and \"length tr1 + length tr2 = Suc k\"\n    by (metis Suc_leI append.assoc append_take_drop_id assms(6) assms(7) le_imp_less_Suc length_append length_take less_imp_le min.absorb2)\n\n\n  with `S ~~ tr \\<leadsto>* S'`\n  obtain Sa Sb \n    where \"S ~~ tr1 \\<leadsto>* Sa\"\n      and \"Sa ~~ tr2 \\<leadsto>* Sb\"\n    using steps_append by blast\n\n\n  have [simp]: \"tr2 \\<noteq> []\"\n    using \\<open>i = length tr1\\<close> \\<open>length tr1 + length tr2 = Suc k\\<close> assms(6) by auto\n\n  have [simp]: \"tr2 ! 0 = (invoc, ABeginAtomic tx txns)\"\n    by (metis \\<open>i = length tr1\\<close> \\<open>tr2 \\<noteq> []\\<close> add.right_neutral assms(2) length_greater_0_conv nth_append_first nth_append_length_plus tr_split)\n  hence [simp]: \"hd tr2 = (invoc, ABeginAtomic tx txns)\"\n    by (simp add: hd_conv_nth)\n    \n\n  have \"\\<forall>a\\<in>set tr2. get_invoc a = invoc\"\n    using `Sa ~~ tr2 \\<leadsto>* Sb`\n  proof (rule no_context_switch_transaction)\n    show \"hd tr2 = (invoc, ABeginAtomic tx txns)\"\n      using `tr!i = (invoc, ABeginAtomic tx txns)`\n      by (auto simp add: tr_split nth_append `i = length tr1` split: if_splits)\n    show \"(invoc, AEndAtomic) \\<notin> set tr2\"\n      using `\\<And>j. i < j \\<Longrightarrow> j \\<le> k \\<Longrightarrow> tr ! j \\<noteq> (invoc, AEndAtomic)`\n      using \\<open>i = length tr1\\<close> \\<open>length tr1 + length tr2 = Suc k\\<close> \n      apply (auto simp add: tr_split nth_append in_set_conv_nth split: if_splits)\n\n      apply (drule_tac x=\"length tr1 + ia\" in meta_spec)\n      apply (auto simp add: tr_split nth_append in_set_conv_nth split: if_splits)\n      apply (case_tac ia)\n       apply auto\n      done\n    show \"packed_trace tr2\"\n      using assms(4) packed_trace_postfix packed_trace_prefix tr_split by auto \n    show \"\\<forall>a\\<in>set (tl tr2). \\<not> allowed_context_switch (get_action a)\"\n      using `\\<And>j. i < j \\<Longrightarrow> j \\<le> k \\<Longrightarrow> \\<not>allowed_context_switch (get_action (tr!j))`\n      apply (auto simp add: tr_split nth_append in_set_conv_nth split: if_splits)\n      apply (drule_tac x=\"length tr1 + ia\" in meta_spec)\n      apply (auto simp add: tr_split nth_append in_set_conv_nth nth_tl split: if_splits)\n      by (metis One_nat_def Suc_leI \\<open>i = length tr1\\<close> \\<open>length tr1 + length tr2 = Suc k\\<close> add.commute add_Suc_right add_diff_cancel_left' assms(5) less_add_Suc1 less_diff_conv nth_append_first nth_append_length_plus plus_1_eq_Suc snd_conv tr_split)\n  qed\n\n  thus \"get_invoc (tr ! k) = invoc\"\n    by (metis (no_types, lifting) Suc_diff_le \\<open>i = length tr1\\<close> \\<open>length tr1 + length tr2 = Suc k\\<close> add_diff_cancel_left' assms(6) in_set_conv_nth leD lessI nth_append tr_split)\nqed\n\nlemma transfer_execution:\n  assumes steps: \"S1 ~~ tr \\<leadsto>* S2\"\n    and p: \"P S1 S1'\"\n    and wf: \"state_wellFormed S1\"\n    and no_crash: \"\\<And>i. (i, ACrash) \\<notin> set tr\"\n    and induct: \"\\<And>a tr' Sa Sb Sa' . \\<lbrakk>\n      a\\<in>set tr; \n      P Sa Sa'; \n      Sa ~~ a \\<leadsto> Sb; \n      state_wellFormed Sa;\n      S1 ~~ tr' \\<leadsto>* Sa;\n      isPrefix tr' tr\n    \\<rbrakk> \\<Longrightarrow> \\<exists>Sb'. (Sa' ~~ a \\<leadsto> Sb') \\<and> P Sb Sb'\"\n  shows \"\\<exists>S2'. (S1' ~~ tr \\<leadsto>* S2') \\<and> P S2 S2'\"\nproof -\n\n  define tr_alt where \"tr_alt = tr\"\n\n  have \"isPrefix tr tr_alt\"\n    by (simp add: isPrefix_refl tr_alt_def)\n\n  have induct_alt: \"\\<And>a tr' Sa Sb Sa' . \\<lbrakk>\n      a\\<in>set tr_alt; \n      P Sa Sa'; \n      Sa ~~ a \\<leadsto> Sb; \n      state_wellFormed Sa;\n      S1 ~~ tr' \\<leadsto>* Sa;\n      isPrefix tr' tr_alt\n    \\<rbrakk> \\<Longrightarrow> \\<exists>Sb'. (Sa' ~~ a \\<leadsto> Sb') \\<and> P Sb Sb'\"\n    by (simp add: induct tr_alt_def)\n\n\n  have \"\\<exists>S2'. (S1' ~~ tr \\<leadsto>* S2') \\<and> P S2 S2' \\<and> isPrefix tr tr_alt \"\n    using steps induct_alt no_crash `isPrefix tr tr_alt` proof (induct rule: steps_induct)\n    case initial\n    then show ?case\n      using p by (simp add: steps_empty isPrefix_empty_first)\n\n  next\n    case (step S2 tr a S3)\n\n    have \"\\<exists>S2'. (S1' ~~ tr \\<leadsto>* S2') \\<and> P S2 S2' \\<and> isPrefix tr tr_alt\"\n    proof (rule step.IH)\n      from `isPrefix (tr @ [a]) tr_alt`\n      show \"isPrefix tr tr_alt\"\n        by (metis append_take_drop_id isPrefix_append isPrefix_appendI isPrefix_def )\n\n      show \"\\<exists>Sb'. (Sa' ~~ a \\<leadsto> Sb') \\<and> P Sb Sb'\"\n        if c0: \"a \\<in> set tr_alt\"\n          and c1: \"P Sa Sa'\"\n          and c2: \"Sa ~~ a \\<leadsto> Sb\"\n          and c3: \"state_wellFormed Sa\"\n          and c4: \"S1 ~~ tr' \\<leadsto>* Sa\"\n          and c5: \"isPrefix tr' tr_alt\"\n        for  a Sa Sa' Sb tr'\n        using c0 c1 c2 c3 c4 c5 induct_alt by blast\n\n\n\n\n      show \" \\<And>i. (i, ACrash) \\<notin> set tr\"\n        using step.prems by auto\n    qed\n\n    from this\n    obtain S2' where \"(S1' ~~ tr \\<leadsto>* S2')\" and \"P S2 S2'\" and \"isPrefix tr tr_alt\"\n      by blast\n\n    have \"\\<exists>S3'. (S2' ~~ a \\<leadsto> S3') \\<and> P S3 S3'\"\n    proof (rule step)\n      from `isPrefix (tr @ [a]) tr_alt`\n      show \"a \\<in> set tr_alt\"\n        by (metis in_set_takeD isPrefix_def list.set_intros(1) rotate1.simps(2) set_rotate1 step.prems(3))\n\n      show \"P S2 S2'\"\n        using `P S2 S2'` .\n      show \"S2 ~~ a \\<leadsto> S3\"\n        using `S2 ~~ a \\<leadsto> S3` .\n      show \"state_wellFormed S2\"\n        using local.wf state_wellFormed_combine step.prems(2) step.steps by fastforce\n      show \"S1 ~~ tr \\<leadsto>* S2\"\n        by (simp add: step.steps)\n      show \"isPrefix tr tr_alt\"\n        by (simp add: \\<open>isPrefix tr tr_alt\\<close>)\n\n    qed\n\n\n    then show ?case\n      using \\<open>S1' ~~ tr \\<leadsto>* S2'\\<close> step.prems(3) steps_step by blast\n  qed\n  thus ?thesis\n    by blast\nqed    \n\nlemma show_state_transfer2:\n  assumes steps: \"S1 ~~ tr \\<leadsto>* S2\"\n    and wf: \"state_wellFormed S1\"\n    and no_crash: \"\\<And>i. (i, ACrash) \\<notin> set tr\"\n    and p: \"S1' = f S1\"\n    and indu: \"\\<And>i a Sa Sb tr' . \\<lbrakk>\n      (i,a)\\<in>set tr; \n      Sa ~~ (i, a) \\<leadsto> Sb; \n      state_wellFormed Sa;\n      isPrefix tr' tr;\n      S1 ~~ tr' \\<leadsto>* Sa\n    \\<rbrakk> \\<Longrightarrow> f Sa ~~ (i, a) \\<leadsto> f Sb\"\n  shows \"S1' ~~ tr \\<leadsto>* f S2\"\nproof  -\n\n  from steps p wf no_crash\n  have \"\\<exists>S2'. (S1' ~~ tr \\<leadsto>* S2') \\<and> S2' = f S2\"\n  proof (rule transfer_execution)\n\n    show \"\\<exists>Sb'. (Sa' ~~ a \\<leadsto> Sb') \\<and> Sb' = f Sb\"\n      if c0: \"a \\<in> set tr\"\n        and c1: \"Sa' = f Sa\"\n        and c2: \"Sa ~~ a \\<leadsto> Sb\"\n        and c3: \"state_wellFormed Sa\"\n        and c4: \"S1 ~~ tr' \\<leadsto>* Sa\"\n        and c5: \"isPrefix tr' tr\"\n      for  a tr' Sa Sb Sa'\n      by (metis c0 c1 c2 c3 c4 c5 indu prod.collapse)\n  qed\n  thus ?thesis\n    by blast\nqed\n\n\nlemma drop_single_action:\n  assumes step1: \"S1 ~~ ia \\<leadsto> S2\" \n    and steps: \"S2 ~~ tr \\<leadsto>* S3\"\n    and no_i: \"\\<forall>a\\<in>set tr. get_invoc a \\<noteq> get_invoc ia\"\n    and wf: \"state_wellFormed S1\"\n    and no_crash: \"\\<And>i. (i, ACrash) \\<notin> set tr\"\n    and no_endAtomic: \"get_action ia \\<noteq> AEndAtomic\"\n    and no_endInvoc: \"\\<And>p. get_action ia \\<noteq> AInvoc p\"\n    and no_endReturn: \"\\<And>r. get_action ia \\<noteq> AReturn r\"\n    and a_no_crash: \"get_action ia \\<noteq> ACrash\"\n  shows \"\\<exists>S3'. (S1 ~~ tr \\<leadsto>* S3')\" \nproof -\n\n  obtain i a where ia_def[simp]: \"ia = (i,a)\"\n    by force\n  hence \"i = get_invoc ia\" and \"a = get_action ia\"\n    by auto\n\n  from step1 \n  have step: \"S1 ~~ (i,a) \\<leadsto> S2\"\n    by simp\n\n  have wf2: \"state_wellFormed S2\"\n    using a_no_crash local.step local.wf state_wellFormed_combine_step  by fastforce\n\n  have no_i'[simp]: \"i' \\<noteq> i\" if \"(i', a) \\<in> set tr\" for i' a\n    using no_i that by auto\n  hence no_i''[simp]: \"i \\<noteq> i'\" if \"(i', a) \\<in> set tr\" for i' a\n    using that by blast\n\n  show ?thesis\n    using step\n  proof (cases rule: step.cases)\n    case (local ls f ok ls')\n\n    from steps \n    have \"S1 ~~ tr \\<leadsto>* (S3\\<lparr>localState := localState S3(i \\<mapsto> ls)\\<rparr>)\"\n      using wf2 no_crash\n    proof (rule show_state_transfer2, fuzzy_goal_cases init step)\n      case init\n      thus ?case \n        using local by (auto simp add: state_ext)\n    next\n      case (step i a Sa Sb)\n      thus ?case \n        apply (cases a)\n        by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n\n    qed\n    thus ?thesis\n      by blast\n\n\n  next\n    case (newId ls f ls' uid uidv ls'')\n    from steps \n    have \"S1 ~~ tr \\<leadsto>* (S3\\<lparr>localState := localState S3(i \\<mapsto> ls), \n                          generatedIds := (generatedIds S3)(uid := None)\\<rparr>)\"\n      using wf2 no_crash\n    proof (rule show_state_transfer2, fuzzy_goal_cases init step)\n      case init\n      thus ?case \n        using newId by (auto simp add: state_ext)\n\n    next\n      case (step i' a Sa Sb)\n\n      have [simp]: \"i' \\<noteq> i\" \"i' \\<noteq> i\"\n        using ` (i', a) \\<in> set tr` by auto\n\n      from newId\n      have \"generatedIds S2 uid \\<triangleq> i\"\n        by auto\n\n      have [simp]: \"uid \\<noteq> to_nat x\" if \"a =  ANewId x\" for x\n        using \\<open>generatedIds S2 uid \\<triangleq> i\\<close>steps that uid_used_only_once step.member by blast\n\n      from step\n      show ?case \n        apply (cases a)\n        by (auto simp add: state_updates_normalize elim!: step_elims   intro!: stateEqI step_intros show_state_calls_eq ext)\n    qed\n    thus ?thesis by blast\n  next\n    case (beginAtomic ls f ls' t vis snapshot)\n\n    from steps \n    have \"S1 ~~ tr \\<leadsto>* (S3\\<lparr>\n                   localState := (localState S3)(i := localState S1 i),\n                   currentTx := (currentTx S3)(i := None),\n                   txStatus := (txStatus S3)(t := None),\n                   txOrigin := (txOrigin S3)(t := None),\n                   visibleCalls := (visibleCalls S3)(i := visibleCalls S1 i)\\<rparr>)\"\n      using wf2 no_crash\n    proof (rule show_state_transfer2, fuzzy_goal_cases init step)\n      case init\n      thus ?case \n        using beginAtomic wf_txOrigin_and_status[OF wf] \n        by (auto simp add: state_ext intro!: ext)\n    next\n      case (step i' a Sa Sb tr')\n\n      from no_i'\n      have tr'_no_i: \"(i, a)\\<notin>set tr'\" for a\n        using `isPrefix tr' tr`\n        by (metis isPrefix_subset2)\n      have tr'_no_crash: \"\\<And>i. (i, ACrash) \\<notin> set tr'\"\n        by (meson isPrefix_subset2 no_crash step.isPrefix)\n\n      \n\n      have monoGrowth: \"state_monotonicGrowth i S2 Sa\"\n      proof (auto simp add: state_monotonicGrowth_def `state_wellFormed S2` step intro!: exI[where x=tr'])\n        show \"\\<And>b. (i, b) \\<in> set tr' \\<Longrightarrow> False\"\n          using \\<open>\\<And>a. (i, a) \\<notin> set tr'\\<close> by auto\n        show \"\\<And>i. (i, ACrash) \\<in> set tr' \\<Longrightarrow> False\"\n          using \\<open>\\<And>i. (i, ACrash) \\<notin> set tr'\\<close> by blast\n      qed\n\n      have \"state_wellFormed Sb\"\n        using local.step(1) local.step(2) local.step(3) no_crash state_wellFormed_combine_step by fastforce\n\n      have \"txStatus S2 t \\<triangleq> Uncommitted\"\n        using beginAtomic by simp\n\n      have \"txStatus Sa t \\<triangleq> Uncommitted\"\n        by (smt \\<open>txStatus S2 t \\<triangleq> Uncommitted\\<close> ia_def local.beginAtomic(7) local.step(3) local.wf monoGrowth option.distinct(1) state_monotonicGrowth_currentTx step1 unchangedInTransaction(3) wellFormed_currentTx_back4 wellFormed_currentTx_unique_h(2) wf2)\n\n\n\n      have [simp]: \"tx' \\<noteq> t\" if \"a = ABeginAtomic tx' txns'\" for tx' txns'\n        using \\<open>txStatus Sa t \\<triangleq> Uncommitted\\<close> local.step(2) step_elim_ABeginAtomic that by fastforce\n\n\n      have noCallsInTx_S2: \"callOrigin S2 c \\<noteq> Some t\" for c\n        using beginAtomic wf_no_txStatus_origin_for_nothing[OF wf] by auto\n\n      have \"currentTx S2 i \\<triangleq> t\"\n        by (smt currentTx_unchangedInternalSteps3 empty_iff ia_def list.set(1) local.beginAtomic(1) local.wf state_wellFormed_def step1 steps_append steps_step traceDeterministic)\n\n      have \"currentTx Sa i \\<triangleq> t\"\n        using \\<open>currentTx S2 i \\<triangleq> t\\<close> monoGrowth state_monotonicGrowth_currentTx by fastforce\n\n\n      have noCallsInTx: \"callOrigin Sa c \\<noteq> Some t\" for c\n        using \\<open>currentTx Sa i \\<triangleq> t\\<close> monoGrowth noCallsInTx_S2 state_monotonicGrowth_current_transactions_fixed by blast\n\n\n      show ?case \n      proof (cases a)\n        case (ALocal x1)\n        with step show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case (ANewId x2)\n        with step  show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case (ABeginAtomic tx txns)\n        with step show ?thesis \n          using \\<open>txStatus Sa t \\<triangleq> Uncommitted\\<close> \n          by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext elim!: chooseSnapshot_unchanged_precise)\n      next\n        case AEndAtomic\n        with step show ?thesis \n          apply (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n          using \\<open>currentTx Sa i \\<triangleq> t\\<close> no_i'' wellFormed_currentTx_unique by blast\n      next\n        case (ADbOp x51 x52 x53)\n        with step show ?thesis \n          by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n\n      next\n        case (AInvoc x6)\n        with step show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case (AReturn x7)\n        with step show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case ACrash\n        with step show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case (AInvcheck ok)\n\n        have invContextSame: \"(invContextH (callOrigin Sa) (\\<lambda>a. if a = t then None else txOrigin Sa a)\n           (\\<lambda>a. if a = t then None else txStatus Sa a) (happensBefore Sa) (calls Sa) (knownIds Sa) (invocOp Sa)\n           (invocRes Sa))\n          = invContext Sa\"\n          using  step noCallsInTx\n          by (auto simp add: \\<open>txStatus Sa t \\<triangleq> Uncommitted\\<close> AInvcheck step.simps  isCommittedH_def invContextH_def restrict_map_def restrict_relation_def committedCallsH_def intro!: ext, fastforce+)\n        from `a = AInvcheck ok` step show ?thesis \n          by (auto simp add: invContextSame step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      qed\n    qed\n    thus ?thesis\n      by blast\n  next\n    case (endAtomic ls f ls' t)\n    show ?thesis\n      using `a = AEndAtomic` no_endAtomic by auto \n  next\n    case (dbop ls f Op ls' t c res vis)\n    from steps \n    have \"S1 ~~ tr \\<leadsto>* (S3\\<lparr>\n                          localState := localState S3(i \\<mapsto> ls), \n                          calls := (calls S3)(c := None), \n                          callOrigin := (callOrigin S3)(c := None),\n                          visibleCalls := visibleCalls S3(i \\<mapsto> vis), \n                          happensBefore := happensBefore S3 - vis \\<times> {c}\\<rparr>)\"\n      using wf2 no_crash\n    proof (rule show_state_transfer2, fuzzy_goal_cases init step)\n      case init\n      thus ?case \n        using dbop wellFormed_happensBefore_calls_r[OF wf] wellFormed_callOrigin_dom3[OF wf]\n        by (auto simp add:  intro!: ext stateEqI, blast)\n\n    next\n      case (step i' a Sa Sb  tr')\n\n      from no_i'\n      have tr'_no_i: \"(i, a)\\<notin>set tr'\" for a\n        using `isPrefix tr' tr`\n        by (metis isPrefix_subset2)\n      have tr'_no_crash: \"\\<And>i. (i, ACrash) \\<notin> set tr'\"\n        by (meson isPrefix_subset2 local.step(4) no_crash)\n\n      \n\n      from `S2 ~~ tr' \\<leadsto>* Sa` `state_wellFormed S2` `\\<And>a. (i, a) \\<notin> set tr'` `\\<And>i. (i, ACrash) \\<notin> set tr'`\n      have \"state_monotonicGrowth i S2 Sa\"\n        by (rule show_state_monotonicGrowth)\n\n      have \"calls S2 c \\<triangleq> Call Op res\"\n        using dbop by auto\n\n      have \"callOrigin S2 c \\<triangleq> t\"\n        using dbop by auto\n      have [simp]: \"callOrigin Sa c \\<triangleq> t\"\n        using \\<open>callOrigin S2 c \\<triangleq> t\\<close> \\<open>state_monotonicGrowth i S2 Sa\\<close> state_monotonicGrowth_callOrigin by blast \n\n      have \"currentTx S2 i \\<triangleq> t\"\n        using dbop by auto\n      hence \"currentTx Sa i \\<triangleq> t\"\n        using \\<open>state_monotonicGrowth i S2 Sa\\<close> state_monotonicGrowth_currentTx by force\n\n\n      have \"txStatus S2 t \\<triangleq> Uncommitted\"\n        using \\<open>currentTx S2 i \\<triangleq> t\\<close> wellFormed_currentTxUncommitted wf2 by blast\n      have \"txStatus Sa t \\<triangleq> Uncommitted\"\n        using \\<open>currentTx Sa i \\<triangleq> t\\<close> local.step(3) wellFormed_currentTxUncommitted by blast\n\n\n\n      have [simp]: \"calls Sa c \\<triangleq> Call Op res\"\n        using \\<open>calls S2 c \\<triangleq> Call Op res\\<close> \\<open>state_monotonicGrowth i S2 Sa\\<close> state_monotonicGrowth_calls by blast\n\n      show ?case \n      proof (cases a)\n        case (ALocal x1)\n        with step show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case (ANewId x2)\n        with step show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case (ABeginAtomic tx txns)\n\n        have h1: \"callsInTransactionH (\\<lambda>a. if a = c then None else callOrigin Sa a) newTxns \\<down> (happensBefore Sa - vis \\<times> {c})\n         =  callsInTransaction Sa newTxns \\<down> happensBefore Sa\" \n          if \" \\<forall>txn\\<in>newTxns. txStatus Sa txn \\<triangleq> Committed\"\n          for newTxns\n          using \\<open>txStatus Sa t \\<triangleq> Uncommitted\\<close> not_uncommitted_cases that\n          apply (auto simp add: callsInTransactionH_def downwardsClosure_def)\n          using local.step(3) wellFormed_state_transaction_consistent(4) apply fastforce\n          by (metis (no_types, lifting) \\<open>callOrigin Sa c \\<triangleq> t\\<close> option.inject)\n\n        from ABeginAtomic step \n        show ?thesis apply (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n          apply (auto simp add: chooseSnapshot_h_def  )\n          subgoal for ls f ls' visa newTxns\n            apply (rule_tac x=newTxns in exI, auto)\n            apply (auto simp add: h1)\n            done\n          done\n\n      next\n        case AEndAtomic\n        with step show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case (ADbOp c' op res)\n        with step show ?thesis \n        proof (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext, fuzzy_goal_cases)\n          case (1 ls f ls' t' vis')\n\n          have \"getContextH (\\<lambda>a. if a = c then None else calls Sa a) (happensBefore Sa - vis \\<times> {c}) (Some vis')\n              = getContextH (calls Sa)                               (happensBefore Sa)             (Some vis')\"\n            apply (auto simp add: getContextH_def restrict_map_def restrict_relation_def intro!: ext)\n            using \"1\"(13) \\<open>currentTx Sa i \\<triangleq> t\\<close> \\<open>txStatus Sa t \\<triangleq> Uncommitted\\<close> local.step(1) local.step(3) wellFormed_currentTx_unique wf_transactionConsistent1 apply fastforce\n            using \"1\"(13) \\<open>currentTx Sa i \\<triangleq> t\\<close> \\<open>txStatus Sa t \\<triangleq> Uncommitted\\<close> local.step(1) local.step(3) wellFormed_currentTx_unique wf_transactionConsistent1 by fastforce\n\n          with `querySpec (prog Sa) op (getContextH (calls Sa) (happensBefore Sa) (Some vis')) res`\n          show ?case by auto\n        qed\n\n      next\n        case (AInvoc x6)\n        with step show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case (AReturn x7)\n        with step show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case ACrash\n        with step show ?thesis by (auto simp add: step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      next\n        case (AInvcheck ok)\n        have invSame: \"(invContextH (\\<lambda>a. if a = c then None else callOrigin Sa a) (txOrigin Sa) (txStatus Sa)\n           (happensBefore Sa - vis \\<times> {c}) (\\<lambda>a. if a = c then None else calls Sa a) (knownIds Sa) (invocOp Sa)\n           (invocRes Sa))\n          = invContext Sa\"\n          using   step \n          using \\<open>txStatus Sa t \\<triangleq> Uncommitted\\<close> \n          by (auto simp add: wellFormed_callOrigin_dom2 AInvcheck step.simps  isCommittedH_def invContextH_def restrict_map_def restrict_relation_def committedCallsH_def intro!: ext)\n\n        with step show ?thesis \n          by (auto simp add: AInvcheck invSame step.simps fun_upd_twist state_updates_normalize intro!: show_state_calls_eq ext)\n      qed\n\n\n    qed\n    thus ?thesis\n      by blast\n\n  next\n    case (invocation proc initialState impl)\n    then show ?thesis\n      using no_endInvoc \\<open>a = get_action ia\\<close> by metis\n  next\n    case (return ls f res)\n    then show ?thesis\n      using no_endReturn \\<open>a = get_action ia\\<close> by metis\n  next\n    case (crash ls)\n    then show ?thesis\n      using a_no_crash \\<open>a = get_action ia\\<close> by metis\n  next\n    case (invCheck res)\n    then show ?thesis\n      using steps by blast\n  qed\nqed\n\n(* \ndefinition \n\"drop_no_action_coupling S1 S2 i \\<equiv> \n  calls S1 = calls S2\n\\<and> happensBefore S1 = happensBefore S2\n\\<and> callOrigin S1 = callOrigin S2\n\\<and> (\\<forall>t i'. i' \\<noteq> i \\<longrightarrow>  (txOrigin S1 t \\<triangleq> i' \\<longleftrightarrow> txOrigin S2 t \\<triangleq> i'))\n\\<and> (dom (txOrigin S2) \\<subseteq> dom (txOrigin S1))\n\\<and> knownIds S1 = knownIds S2\n\\<and> invocOp S1 = invocOp S2\n\\<and> invocRes S1 = invocRes S2\n\\<and> prog S1 = prog S2\n\\<and> (\\<forall>t. currentTx S2 i \\<noteq> Some t \\<longrightarrow>  txStatus S1 t = txStatus S2 t)\n\\<and> (\\<forall>id i'. i' \\<noteq> i \\<longrightarrow> (generatedIds S1 id \\<triangleq> i' \\<longleftrightarrow> generatedIds S2 id \\<triangleq> i'))\n\\<and> (dom (generatedIds S2) \\<subseteq> dom (generatedIds S1))\n\\<and> (\\<forall>i'. i' \\<noteq> i \\<longrightarrow> localState S1 i' = localState S2 i')\n\\<and> currentProc S1 = currentProc S2\n\\<and> (\\<forall>i'. i' \\<noteq> i \\<longrightarrow> visibleCalls S1 i = visibleCalls S2 i)\n\\<and> (\\<forall>i'. i' \\<noteq> i \\<longrightarrow> currentTx S1 i = currentTx S2 i)\n\"\n\nlemma drop_no_action:\n  assumes \"S1 ~~ tr \\<leadsto>* S1'\"\n    and \"\\<forall>a\\<in>set tr. get_invoc a \\<noteq> i\"\n    and \"drop_no_action_coupling S1 S2 i\"\n    and \"state_wellFormed S1\"\n    and \"\\<And>i. (i, ACrash) \\<notin> set tr\"\n  shows \"\\<exists>S2'. (S2 ~~ tr \\<leadsto>* S2') \\<and> drop_no_action_coupling S1' S2' i\" \n  using assms\nproof (induct rule: steps_induct)\n  case initial\n  then show ?case\n    using steps_empty by blast \n\nnext\n  case (step S' tr a S'')\n  obtain S2' where \"S2 ~~ tr \\<leadsto>* S2'\" and coup: \"drop_no_action_coupling S' S2' i\"\n    using step.IH step.prems by auto\n\n  have not_i: \"get_invoc a \\<noteq> i\"\n    by (simp add: step.prems(1))\n\n  have \"state_wellFormed S'\"\n    using state_wellFormed_combine step.prems step.steps by fastforce\n\n\n  from ` S' ~~ a \\<leadsto> S''`\n  have \"\\<exists>S2''. (S2' ~~ a \\<leadsto> S2'') \\<and> drop_no_action_coupling S'' S2'' i\"\n  proof (cases rule: step.cases)\n    case (local i ls f ok ls')\n    then show ?thesis \n      using coup not_i by (auto simp add: step.simps  drop_no_action_coupling_def)\n  next\n    case (newId i ls f ls' uid uidv ls'')\n    then show ?thesis using coup not_i by (auto simp add: step.simps  drop_no_action_coupling_def)\n  next\n    case (beginAtomic i ls f ls' t vis snapshot)\n    then show ?thesis using coup not_i \n      apply (auto simp add: step.simps  drop_no_action_coupling_def chooseSnapshot_unchanged)\n      \n      by (auto simp add: step.simps  drop_no_action_coupling_def chooseSnapshot_unchanged)\n  next\n    case (endAtomic i ls f ls' t)\n    then show ?thesis using coup not_i by (auto simp add: step.simps  drop_no_action_coupling_def)\n  next\n    case (dbop i ls f Op ls' t c res vis)\n    then show ?thesis using coup not_i by (auto simp add: step.simps  drop_no_action_coupling_def)\n  next\n    case (invocation i proc initialState impl)\n    then show ?thesis using coup not_i by (auto simp add: step.simps  drop_no_action_coupling_def)\n  next\n    case (return i ls f res)\n    then show ?thesis using coup not_i by (auto simp add: step.simps  drop_no_action_coupling_def)\n  next\n    case (fail i ls)\n    then show ?thesis using coup not_i by (auto simp add: step.simps  drop_no_action_coupling_def)\n  next\n    case (invCheck res i)\n    then show ?thesis using coup not_i by (auto simp add: step.simps  drop_no_action_coupling_def)\n  qed\n\n  then show ?case\n    using \\<open>S2 ~~ tr \\<leadsto>* S2'\\<close> steps_step by blast \nqed\n\n*)\n\nlemma steps_dropLast_tx:\n  assumes \"S ~~ tr \\<leadsto>* S'\"\n    and \"i < length tr\"\n    and forbidden_actions: \"get_action (tr!i) \\<notin> {AEndAtomic} \\<union> AReturn ` UNIV \\<union> AInvoc ` UNIV\"\n    and no_more_actions: \"\\<And>j. j>i \\<Longrightarrow> j < length tr \\<Longrightarrow> get_invoc (tr!j) \\<noteq> get_invoc (tr!i)\"\n    and wf: \"state_wellFormed S\"\n    and noCrash: \"\\<And>i. (i, ACrash) \\<notin> set tr\"\n  shows \"\\<exists>S''. S ~~ take i tr @ drop (Suc i) tr \\<leadsto>* S''\"\nproof -\n(*\n  have [simp]: \"min (length tr) (i - Suc 0) = i - 1\"\n    by (simp add: assms(3) less_imp_diff_less min_simps(2))\n\n  have [simp]: \"i - Suc 0 + (length tr - i) = length tr - 1\"\n    by (simp add: Suc_leI assms(2) assms(3) less_or_eq_imp_le)\n\n  have [simp]: \"Suc (length tr - i) = Suc (length tr) - i\"\n    by (simp add: Suc_diff_le assms(3) less_imp_le)\n\n\n  have [simp]: \"length tr - (i - Suc 0) = Suc (length tr) - i\"\n    using assms(2) assms(3) by auto\n\n  have [simp]: \"Suc (length tr - Suc i) = length tr - i\"\n    using Suc_diff_Suc assms(3) by blast\n*)\n\n  have \"tr = take i tr @ drop i tr \"\n    by (auto simp add: list_eq_iff_nth_eq nth_append nth_Cons')\n\n  moreover have \"drop i tr = [tr!i] @ drop (Suc i) tr\"\n    by (simp add: Cons_nth_drop_Suc assms(2))\n\n\n\n  ultimately have tr_split: \"tr = take i tr @[tr!i] @ drop (Suc i) tr \"\n    by simp\n\n  from this\n  obtain S1 S2 S3\n    where \"S ~~ take i tr \\<leadsto>* S1\" and \"S1 ~~ tr ! i \\<leadsto> S2\" and \"S2 ~~ drop (Suc i) tr \\<leadsto>* S3\"\n    by (smt Cons_nth_drop_Suc \\<open>drop i tr = [tr ! i] @ drop (Suc i) tr\\<close> assms(1) assms(2) steps_append steps_appendFront)\n\n\n  thm drop_single_action\n  from `S1 ~~ tr ! i \\<leadsto> S2` `S2 ~~ drop (Suc i) tr \\<leadsto>* S3` \n  have \"\\<exists>S3'. S1 ~~ drop (Suc i) tr \\<leadsto>* S3'\"\n  proof (rule drop_single_action)\n    from no_more_actions\n    show \"\\<forall>a\\<in>set (drop (Suc i) tr). get_invoc a \\<noteq> get_invoc (tr ! i)\"\n      by (auto simp add: in_set_conv_nth, \n          metis add.commute add_Suc_right fst_conv less_add_Suc1 less_diff_conv)\n    show \"state_wellFormed S1\"\n      by (meson \\<open>S ~~ take i tr \\<leadsto>* S1\\<close> local.wf noCrash set_take_subset state_wellFormed_combine subsetD)\n    show \"\\<And>ia. (ia, ACrash) \\<notin> set (drop (Suc i) tr)\"\n      by (meson in_set_dropD noCrash)\n    show \"get_action (tr ! i) \\<noteq> AEndAtomic\"\n      using forbidden_actions by blast\n    show \"\\<And>p. get_action (tr ! i) \\<noteq> AInvoc p\"\n      using assms(3) by blast\n    show \"\\<And>r. get_action (tr ! i) \\<noteq> AReturn r\"\n      using forbidden_actions by blast\n    show \"get_action (tr ! i) \\<noteq> ACrash\"\n      by (metis assms(2) noCrash nth_mem prod.collapse)\n  qed\n  from this obtain S3' where \"S1 ~~ drop (Suc i) tr \\<leadsto>* S3'\"\n    by blast\n\n\n  from `S ~~ take i tr \\<leadsto>* S1` and `S1 ~~ drop (Suc i) tr \\<leadsto>* S3'`\n  show ?thesis\n    using steps_append2 by blast\nqed\n\nlemma no_return_in_transaction:\n  assumes \"S ~~ tr \\<leadsto>* S_end\"\n    and \"tr ! i_start = (invoc, ABeginAtomic tx txns)\"\n    and no_end_atomic: \"\\<And>j. \\<lbrakk>i_start < j \\<and> j \\<le> i_r\\<rbrakk> \\<Longrightarrow> tr ! j \\<noteq> (invoc, AEndAtomic)\"\n    and \"i_start \\<le> i_r\"\n    and \"i_r < length tr\"\n    and \"state_wellFormed S\"\n    and noCrash: \"\\<And>i. (i, ACrash) \\<notin> set tr\"\n  shows \"tr ! i_r \\<noteq> (invoc, AReturn r)\" and \"\\<And>S'. (S ~~ take (Suc i_r) tr \\<leadsto>* S') \\<Longrightarrow> currentTx S' invoc \\<triangleq> tx\"\nproof -\n\n  from `i_start \\<le> i_r` and `i_r < length tr` and no_end_atomic\n  have \" tr ! i_r \\<noteq> (invoc, AReturn r) \\<and> (\\<forall>S'. (S ~~ take (Suc i_r) tr \\<leadsto>* S') \\<longrightarrow> currentTx S' invoc \\<triangleq> tx)\"\n  proof (induct \"i_r - i_start\" arbitrary: i_r)\n    case (0 i_r)\n    hence \"i_r = i_start\"\n      by linarith\n\n\n    show ?case \n    proof (intro allI impI conjI)\n\n\n      show \"currentTx S' invoc \\<triangleq> tx\"\n        if c0: \"S ~~ take (Suc i_r) tr \\<leadsto>* S'\"\n        for  S'\n      proof -\n\n\n        from `S ~~ take (Suc i_r) tr \\<leadsto>* S'`\n        obtain S_pre where \"S ~~ take i_start tr \\<leadsto>* S_pre\" and \"S_pre ~~ tr ! i_start \\<leadsto> S'\"\n          by (metis \"0.prems\"(2)  \\<open>i_r = i_start\\<close>  steps_appendBack take_Suc_conv_app_nth)\n\n        from `S_pre ~~ tr ! i_start \\<leadsto> S'` \n          and `tr ! i_start = (invoc, ABeginAtomic tx txns)`\n        show \"currentTx S' invoc \\<triangleq> tx\" \n          by (auto simp add: step.simps)\n      qed\n\n      show \"tr ! i_r \\<noteq> (invoc, AReturn r)\"\n        by (simp add: \\<open>i_r = i_start\\<close> assms(2))\n    qed\n  next\n    case (Suc x)\n\n    have IH: \"tr ! (i_r - 1) \\<noteq> (invoc, AReturn r) \\<and> (\\<forall>S'. (S ~~ take (Suc (i_r - 1)) tr \\<leadsto>* S') \\<longrightarrow> currentTx S' invoc \\<triangleq> tx)\"\n    proof (rule Suc.hyps)\n      show \"x = i_r - 1 - i_start\"\n        using Suc.hyps(2) by auto\n      show \"i_start \\<le> i_r - 1\"\n        using Suc.hyps(2) by auto\n      show \"i_r - 1 < length tr\"\n        using Suc.prems(2) less_imp_diff_less by blast\n      show \"\\<And>j. i_start < j \\<and> j \\<le> i_r - 1 \\<Longrightarrow> tr ! j \\<noteq> (invoc, AEndAtomic)\"\n        using Suc.prems(3) by force\n    qed\n    hence ctx: \"currentTx S' invoc \\<triangleq> tx\" if \"S ~~ take i_r tr \\<leadsto>* S'\" for S'\n      using that `Suc x = i_r - i_start` by force \n\n    have noEndAtomic: \"tr ! i_r \\<noteq> (invoc, AEndAtomic)\"\n      using Suc.hyps(2) Suc.prems(3) by auto\n\n\n    obtain  S' S'' where \"S ~~ take i_r tr \\<leadsto>* S'\" and \"S' ~~ tr ! i_r \\<leadsto> S''\"\n      by (metis Suc.prems(2) assms(1) id_take_nth_drop steps_append steps_appendFront)\n\n\n    moreover {\n      fix  S' S'' \n      assume \"S ~~ take i_r tr \\<leadsto>* S'\" and \"S' ~~ tr ! i_r \\<leadsto> S''\"\n\n      have \"currentTx S' invoc \\<triangleq> tx\"\n        using \\<open>S ~~ take i_r tr \\<leadsto>* S'\\<close> ctx by blast\n\n      with `S' ~~ tr ! i_r \\<leadsto> S''` noEndAtomic\n      have \"currentTx S'' invoc \\<triangleq> tx\" and \"tr ! i_r \\<noteq> (invoc, AReturn r)\"\n         apply (auto simp add: step.simps)\n        using Suc.prems(2) noCrash nth_mem by fastforce\n    }\n    ultimately show ?case\n      by (metis Suc.prems(2) steps_step take_Suc_conv_app_nth traceDeterministic)\n  qed\n  thus \"tr ! i_r \\<noteq> (invoc, AReturn r)\"\n    and \"\\<And>S'. S ~~ take (Suc i_r) tr \\<leadsto>* S' \\<Longrightarrow> currentTx S' invoc \\<triangleq> tx\"\n    by auto\nqed\n\n\n\n\n\ndefinition \"induct_measure\" where \"induct_measure  \\<equiv> \\<lambda>trace. \\<lambda>pos'.\n    case pos' of\n        0 \\<Rightarrow> True\n      | Suc pos \\<Rightarrow>  pos<length trace \\<and> (\\<exists>i j tx txns. get_invoc(trace!pos) = i \\<and>  j\\<le>pos \\<and> trace!j = (i, ABeginAtomic tx txns) \\<and> (\\<nexists>k. k>j \\<and> k<length trace \\<and> trace!k = (i, AEndAtomic)))\" \n\ntext \\<open>\n To show that a program is correct, we only have to consider packed traces\nwith no context switches in transactions.\n\\<close>\ntext_raw \\<open>\\DefineSnippet{remove_context_switches_in_transactions}{\\<close>\nlemma remove_context_switches_in_transactions:\n  assumes a1: \"initialState program ~~ trace \\<leadsto>* S\"\n    and a2: \"packed_trace trace\"\n    and a3: \"\\<And>s. (s, ACrash) \\<notin> set trace\"\n    and a4: \"\\<And>s. (s, AInvcheck True) \\<notin> set trace\"\n    and a5: \"no_invariant_checks_in_transaction trace\"\n    and a6: \"\\<not>traceCorrect trace\"\n  obtains trace' S'\n  where \"initialState program ~~ trace' \\<leadsto>* S'\"\n    and \"packed_trace trace'\"\n    and \"\\<And>s. (s, ACrash) \\<notin> set trace'\"\n    and \"\\<And>s. (s, AInvcheck True) \\<notin> set trace'\"\n    and \"no_invariant_checks_in_transaction trace'\"\n    and \"\\<not>traceCorrect trace'\"\n    and \"\\<not>contextSwitchesInTransaction trace'\"\n  text_raw \\<open>}%EndSnippet\\<close>\n  using a1 a2 a3 a4 a5 a6 proof (atomize_elim, induct \"length trace\" arbitrary: S trace rule: less_induct)\n  case (less trace S)\n\n  show ?case\n  proof (rule classical, fuzzy_goal_cases trivial)\n    case trivial\n\n    hence trivial1: \"(\\<not>P \\<Longrightarrow> ?case) \\<Longrightarrow> P\" for P\n      by blast\n\n    hence trivial2: \"(P \\<Longrightarrow> ?case) \\<Longrightarrow> \\<not>P\" for P\n      by blast\n\n    have \"trace \\<noteq> []\"\n        using less.prems(6) traceCorrect_empty by blast\n\n    have all_actions_correct_but_last: \"actionCorrect (get_action a)\" if \"trace ! i = a\" and \"i < length trace - 1\" for i a\n    proof (rule trivial1)\n      assume \"\\<not> actionCorrect (get_action a)\"\n\n      have len: \"length (take (Suc i) trace) < length trace\"\n        using that(2) by auto\n\n\n      obtain S' where steps': \"initialState program ~~ take (Suc i) trace \\<leadsto>* S'\"\n        by (metis append_take_drop_id less.prems(1) steps_append)\n\n\n\n      show ?case \n        using len steps'\n      proof (rule less)\n        show \"packed_trace (take (Suc i) trace)\"\n          using less.prems(2) packed_trace_take by blast\n        show \"\\<And>s. (s, ACrash) \\<notin> set (take (Suc i) trace)\"\n          by (meson in_set_takeD less.prems(3))\n        show \"\\<And>s. (s, AInvcheck True) \\<notin> set (take (Suc i) trace)\"\n          by (meson in_set_takeD less.prems(4))\n        show \"no_invariant_checks_in_transaction (take (Suc i) trace)\"\n          by (metis append_take_drop_id isPrefix_appendI less.prems(5) no_invariant_checks_in_transaction_prefix)\n        show \"\\<not> traceCorrect (take (Suc i) trace)\"\n          by (metis (no_types, lifting) \\<open>\\<not> actionCorrect (get_action a)\\<close> len length_take lessI min_less_iff_conj min_simps(2) nat_neq_iff nth_append_length nth_mem take_Suc_conv_app_nth that(1) traceCorrect_def')\n        show \"initialState program ~~ take (Suc i) trace \\<leadsto>* S'\"\n          using steps' by blast\n        show \"packed_trace (take (Suc i) trace)\"\n          by (simp add: \\<open>packed_trace (take (Suc i) trace)\\<close>)\n        show \"\\<And>s. (s, ACrash) \\<notin> set (take (Suc i) trace)\"\n          using \\<open>\\<And>s. (s, ACrash) \\<notin> set (take (Suc i) trace)\\<close> by blast\n        show \"\\<And>s. (s, AInvcheck True) \\<notin> set (take (Suc i) trace)\"\n          by (simp add: \\<open>\\<And>s. (s, AInvcheck True) \\<notin> set (take (Suc i) trace)\\<close>)\n        show \"no_invariant_checks_in_transaction (take (Suc i) trace)\"\n          by (simp add: \\<open>no_invariant_checks_in_transaction (take (Suc i) trace)\\<close>)\n        show \"\\<not> traceCorrect (take (Suc i) trace)\"\n          by (simp add: \\<open>\\<not> traceCorrect (take (Suc i) trace)\\<close>)\n      qed\n    qed\n\n    hence last_action_incorrect: \"\\<not>actionCorrect (get_action (last trace))\"\n      by (metis (no_types, lifting) append_butlast_last_id in_set_conv_nth last_conv_nth length_append_singleton length_butlast length_pos_if_in_set less.prems(6) less_antisym less_numeral_extra(3) list.size(3) traceCorrect_def')\n\n\n    have \"contextSwitchesInTransaction trace\"\n    proof (rule trivial1)\n      assume \"\\<not>contextSwitchesInTransaction trace\"\n      thus ?case\n        using less by blast\n    qed\n\n    from this obtain i_begin1 i_switch1\n      where \"contextSwitchInTransaction trace i_begin1 i_switch1\"\n      by (auto simp add: contextSwitchesInTransaction_def)\n\n    from this obtain i_begin i_switch\n      where i_switch: \"contextSwitchInTransaction trace i_begin i_switch\"\n        and i_switch_min: \"\\<And>i_begin' i_switch'. contextSwitchInTransaction trace i_begin' i_switch' \\<Longrightarrow> i_switch \\<le> i_switch'\"\n      using exists_min_wellorder[where P=\"\\<lambda>i_switch. \\<exists>i_begin. contextSwitchInTransaction trace i_begin i_switch\"]\n      by meson\n\n    from i_switch_min\n    have no_earlier_context_switches:\n      \"\\<And>j. \\<lbrakk>i_begin < j; j < i_switch\\<rbrakk> \\<Longrightarrow> \\<not> allowed_context_switch (get_action (trace ! j))\"\n      using i_switch_min      by (smt contextSwitchInTransaction_def dual_order.strict_trans i_switch leD)\n\n\n    from i_switch\n    obtain invoc tx txns\n      where a0: \"i_begin < i_switch\"\n        and a1: \"i_switch < length trace\"\n        and a2: \"trace ! i_begin = (invoc, ABeginAtomic tx txns)\"\n        and a3: \"\\<forall>j. i_begin < j \\<and> j < i_switch \\<longrightarrow> trace ! j \\<noteq> (invoc, AEndAtomic)\"\n        and a4: \"allowed_context_switch (get_action (trace ! i_switch))\"\n      by (auto simp add: contextSwitchInTransaction_def)\n\n    have same_invoc:\n      \"get_invoc (trace ! j) = invoc\" if \"i_begin \\<le> j\" and \"j < i_switch\" for j\n      using `initialState program ~~ trace \\<leadsto>* S`\n        `trace ! i_begin = (invoc, ABeginAtomic tx txns)`\n    proof (rule no_context_switch_transaction2)\n      show \"\\<And>ja. \\<lbrakk>i_begin < ja; ja \\<le> j\\<rbrakk> \\<Longrightarrow> trace ! ja \\<noteq> (invoc, AEndAtomic)\"\n        using a3 order.strict_trans1 that(2) by blast\n      from `packed_trace trace`\n      show \"packed_trace trace\" .\n\n      show \"\\<And>ja. \\<lbrakk>i_begin < ja; ja \\<le> j\\<rbrakk> \\<Longrightarrow> \\<not> allowed_context_switch (get_action (trace ! ja))\"\n        by (simp add: le_less_trans no_earlier_context_switches that(2))\n      show \"i_begin \\<le> j\"\n        by (simp add: that(1))\n      show \"j < length trace\"\n        using a1 dual_order.strict_trans that(2) by blast\n    qed\n\n\n    text \"We are in a transaction, so execution up to j gives \n  us a state with a current transaction:\"\n    obtain S_j_pre\n      where \"initialState program ~~ take i_switch trace \\<leadsto>* S_j_pre\"\n      by (metis a1 id_take_nth_drop less.prems(1) steps_append)\n\n\n    from this\n    have \"currentTx S_j_pre invoc \\<triangleq> tx\"\n    proof (rule currentTx2)\n      show \"i_begin < length (take i_switch trace)\"\n        by (simp add: a0 a1 min_simps(2))\n      show \" take i_switch trace ! i_begin = (invoc, ABeginAtomic tx txns)\"\n        by (simp add: a0 a2) \n      fix ja\n      assume a0: \"i_begin < ja\"\n        and a1: \"ja < length (take i_switch trace)\"\n\n      show \"take i_switch trace ! ja \\<noteq> (invoc, ACrash)\"\n        using a1 less.prems(3) nth_mem by fastforce\n\n      show \"take i_switch trace ! ja \\<noteq> (invoc, AEndAtomic)\"\n        using a0 a1 a3 by auto\n    qed\n\n    have \"state_wellFormed S_j_pre\"\n      by (meson \\<open>initialState program ~~ take i_switch trace \\<leadsto>* S_j_pre\\<close> less.prems(3) set_take_subset state_wellFormed_combine state_wellFormed_init subsetD)\n\n    have \"i_switch < length trace\"\n      by (simp add: a1)\n\n\n\n    obtain S_j_post\n      where \"S_j_pre ~~ trace ! i_switch \\<leadsto> S_j_post\"\n      by (metis (no_types, lifting) \\<open>initialState program ~~ take i_switch trace \\<leadsto>* S_j_pre\\<close> a1 id_take_nth_drop less.prems(1) steps_append2 steps_appendFront)\n\n\n\n    text \"Since we are in a transaction, the action at position j cannot be a\n  context switch on the same invocation\"\n\n    with `allowed_context_switch (get_action (trace ! i_switch))`\n      and `currentTx S_j_pre invoc \\<triangleq> tx`\n    have \"get_invoc (trace ! i_switch) \\<noteq> invoc\"\n      using  inTransaction_localState[OF \\<open>state_wellFormed S_j_pre\\<close>] \n      by (auto simp add: step.simps, blast)\n\n    have \"i_switch < length trace\"\n      by (simp add: a1)\n\n    have \"i_switch > 0\"\n      using a0 by linarith\n\n\n    have \"S_j_pre ~~ drop i_switch trace \\<leadsto>* S\"\n      using \\<open>initialState program ~~ take i_switch trace \\<leadsto>* S_j_pre\\<close> less.prems(1) steps_append2 by fastforce\n\n    from this\n    have \"currentTx S invoc \\<triangleq> tx \\<and> (\\<forall>a\\<in>set (drop i_switch trace). get_invoc a \\<noteq> invoc)\"\n    proof (rule no_more_actions_on_packed_trace_if_context_switch_in_transaction)\n      show \"packed_trace (drop i_switch trace)\"\n        by (simp add: less.prems(2) packed_trace_drop)\n      show \"currentTx S_j_pre invoc \\<triangleq> tx\"\n        by (simp add: \\<open>currentTx S_j_pre invoc \\<triangleq> tx\\<close>)\n      show \"get_invoc (hd (drop i_switch trace)) \\<noteq> invoc\"\n        by (simp add: \\<open>get_invoc (trace ! i_switch) \\<noteq> invoc\\<close> \\<open>i_switch < length trace\\<close> hd_drop_conv_nth)\n      show \"drop i_switch trace \\<noteq> []\"\n        using \\<open>i_switch < length trace\\<close> drop_eq_Nil leD by blast\n      show \"state_wellFormed S_j_pre\"\n        by (simp add: \\<open>state_wellFormed S_j_pre\\<close>)\n      show \"\\<And>i. (i, ACrash) \\<notin> set (drop i_switch trace)\"\n        by (meson in_set_dropD less.prems(3))\n    qed\n\n\n    hence \"get_invoc (trace ! j') \\<noteq> invoc\" if \"j' > i_switch\" and \"j' < length trace\" for j'\n      using that apply (auto simp add: all_set_conv_all_nth)\n      by (metis diff_less_mono less_or_eq_imp_le ordered_cancel_comm_monoid_diff_class.add_diff_inverse)\n\n    text \"Remove the previous action:\"\n\n    define trace' where \"trace' = take (i_switch - 1) trace @ drop i_switch trace\"\n\n\n\n    have \"length trace = Suc (length trace')\"\n      using \\<open>0 < i_switch\\<close> \\<open>i_switch < length trace\\<close> trace'_def by auto\n\n\n    obtain S' where \n      \" initialState program ~~ trace' \\<leadsto>* S'\"\n      unfolding trace'_def\n    proof (atomize_elim, fuzzy_rule steps_dropLast_tx)\n      show \"initialState program ~~ trace \\<leadsto>* S\"\n        by (simp add: less.prems(1))\n      show \" get_action (trace ! (i_switch - 1)) \\<notin> {AEndAtomic} \\<union> range AReturn \\<union> range AInvoc\" (is ?goal)\n      proof auto\n        text \"It cannot be any of these cases, because we are in an unfinished transaction ...\"\n\n\n        have \"i_switch - Suc 0 < i_switch\"\n          using \\<open>0 < i_switch\\<close> diff_Suc_less by blast\n\n        have \"i_begin \\<le> i_switch - Suc 0\"\n          using a0 by linarith\n\n\n        have \"trace ! (i_switch - Suc 0) \\<noteq> (invoc, AEndAtomic)\"\n          by (metis \\<open>i_begin \\<le> i_switch - Suc 0\\<close> \\<open>i_switch - Suc 0 < i_switch\\<close> a2 a3 action.distinct(31) le_neq_implies_less old.prod.inject)\n\n\n        have \"get_invoc (trace ! (i_switch - Suc 0)) = invoc\"\n          using a0 same_invoc by auto\n\n\n        show \"get_action (trace ! (i_switch - Suc 0)) = AEndAtomic \\<Longrightarrow> False\"\n          by (metis \\<open>get_invoc (trace ! (i_switch - Suc 0)) = invoc\\<close> \\<open>trace ! (i_switch - Suc 0) \\<noteq> (invoc, AEndAtomic)\\<close> surjective_pairing)\n\n        show \"\\<And>x. get_action (trace ! (i_switch - Suc 0)) = AReturn x \\<Longrightarrow> False\"\n          using no_return_in_transaction(1)[OF `initialState program ~~ trace \\<leadsto>* S` `trace ! i_begin = (invoc, ABeginAtomic tx txns)`, where i_r=\"i_switch - Suc 0\"]\n          by (metis (no_types, lifting) \\<open>get_invoc (trace ! (i_switch - Suc 0)) = invoc\\<close> \\<open>i_begin \\<le> i_switch - Suc 0\\<close> \\<open>i_switch - Suc 0 < i_switch\\<close> a1 a3 dual_order.strict_trans le_less_trans less.prems(3) prod.collapse state_wellFormed_init)\n\n        show \"\\<And>x. get_action (trace ! (i_switch - Suc 0)) = AInvoc x \\<Longrightarrow> False\"\n          using \\<open>i_begin \\<le> i_switch - Suc 0\\<close> a2 allowed_context_switch_simps(6) le_eq_less_or_eq no_earlier_context_switches by fastforce\n      qed\n\n\n      have [simp]: \"(Suc (i_switch - Suc 0)) = i_switch\"\n        by (simp add: \\<open>0 < i_switch\\<close>)\n\n      show \"(~~ initialState program \\<leadsto>*) (take (i_switch - 1) trace @ drop (Suc (i_switch - 1)) trace) =\n              (~~ initialState program \\<leadsto>*) (take (i_switch - 1) trace @ drop i_switch trace)\"\n        by simp\n\n      show \"i_switch - 1 < length trace\"\n        by (simp add: a1 less_imp_diff_less)\n\n      show \"state_wellFormed (initialState program)\"\n        by (simp add: state_wellFormed_init)\n\n      show \"\\<And>i. (i, ACrash) \\<notin> set trace\"\n        by (simp add: less.prems(3))\n\n      text \"As we are in the middle of a transaction, we cannot execute BeginAtomic or Invoc (packed)\"\n      from `packed_trace trace`\n      show \"\\<And>j. \\<lbrakk>i_switch - 1 < j; j < length trace\\<rbrakk> \\<Longrightarrow> get_invoc (trace ! j) \\<noteq> get_invoc (trace ! (i_switch - 1))\"\n        by (metis One_nat_def Suc_lessI \\<open>0 < i_switch\\<close> \\<open>Suc (i_switch - Suc 0) = i_switch\\<close> \\<open>\\<And>j'. \\<lbrakk>i_switch < j'; j' < length trace\\<rbrakk> \\<Longrightarrow> get_invoc (trace ! j') \\<noteq> invoc\\<close> \\<open>get_invoc (trace ! i_switch) \\<noteq> invoc\\<close> a0 diff_less less_Suc_eq_le same_invoc zero_less_one)\n\n    qed\n\n\n    show ?thesis\n    proof (rule less.hyps)\n      show \"length trace' < length trace\"\n        by (simp add: \\<open>length trace = Suc (length trace')\\<close>)\n      show \"initialState program ~~ trace' \\<leadsto>* S'\"\n        by (simp add: \\<open>initialState program ~~ trace' \\<leadsto>* S'\\<close>)\n      have [simp]: \"min (length trace) i_switch = i_switch\"\n        by (simp add: \\<open>i_switch < length trace\\<close> min_simps(2))\n      have [simp]: \" i_switch + (length trace - Suc i_switch) = length trace - 1\"\n        by (simp add: Suc_leI \\<open>i_switch < length trace\\<close>)\n      have [simp]: \"min (length trace) (i_switch - Suc 0) = i_switch - Suc 0\"\n        using \\<open>i_switch < length trace\\<close> by auto\n      have [simp]: \"i_switch + (length trace - i_switch) = length trace\"\n        by (simp add: \\<open>i_switch < length trace\\<close> less_imp_le)\n      have [simp]: \"Suc (i_switch - Suc 0) = i_switch\"\n        using Suc_pred \\<open>0 < i_switch\\<close> by blast\n\n\n      have h: \"i = i_switch\" if \"i - Suc 0 < i_switch\" and \"\\<not> i < i_switch\" for i\n        using that(1) that(2) by linarith\n\n      show \"packed_trace trace'\"\n        using `packed_trace trace`\n        by (auto simp add: packed_trace_def trace'_def  nth_append split: if_splits)\n          (metis \\<open>Suc (i_switch - Suc 0) = i_switch\\<close> a4 h less_SucI linorder_neqE_nat not_less_eq)\n      show \"\\<And>s. (s, ACrash) \\<notin> set trace'\"\n        by (metis Un_iff append_take_drop_id less.prems(3) set_append trace'_def)\n\n\n      thm no_context_switch_transaction2\n\n      from `initialState program ~~ trace \\<leadsto>* S`\n      have is_invoc: \"get_invoc (trace ! (i_switch - 1)) = invoc\"\n        using `trace ! i_begin = (invoc, ABeginAtomic tx txns)`\n      proof (rule no_context_switch_transaction2)\n        show \"\\<And>j. \\<lbrakk>i_begin < j; j \\<le> i_switch - 1\\<rbrakk> \\<Longrightarrow> trace ! j \\<noteq> (invoc, AEndAtomic)\"\n          by (simp add: a3)\n        show \"packed_trace trace\"\n          by (simp add: less.prems(2))\n        show \"\\<not> allowed_context_switch (get_action (trace ! j))\" if \"i_begin < j\" \"j \\<le> i_switch - 1\" for j\n        proof \n          assume \"allowed_context_switch (get_action (trace ! j))\"\n          have \"i_switch \\<le> j\"\n          proof (rule i_switch_min[where i_begin'=i_begin and i_switch'=j])\n            show \"contextSwitchInTransaction trace i_begin j\"\n            proof (auto simp add: contextSwitchInTransaction_def)\n              show \"i_begin < j\"\n                by (simp add: that(1))\n              show \"j < length trace\"\n                using a1 that(2) by auto\n              show \"\\<exists>invoc.\n                   (\\<exists>tx txns. trace ! i_begin = (invoc, ABeginAtomic tx txns)) \\<and>\n                   (\\<forall>ja. i_begin < ja \\<and> ja < j \\<longrightarrow> trace ! ja \\<noteq> (invoc, AEndAtomic)) \\<and> allowed_context_switch (get_action (trace ! j))\"\n              proof (intro exI conjI allI impI)\n                show \"trace ! i_begin = (invoc, ABeginAtomic tx txns)\"\n                  by (simp add: a2)\n                show \"allowed_context_switch (get_action (trace ! j))\"\n                  by (simp add: \\<open>allowed_context_switch (get_action (trace ! j))\\<close>)\n                show \"\\<And>ja. i_begin < ja \\<and> ja < j \\<Longrightarrow> trace ! ja \\<noteq> (invoc, AEndAtomic)\"\n                  using a3 that(2) by auto\n              qed\n            qed\n          qed\n          thus False\n            using \\<open>Suc (i_switch - Suc 0) = i_switch\\<close> that(2) by auto\n        qed\n\n        show \"i_begin \\<le> i_switch - 1\"\n          using a0 by auto\n        show \"i_switch - 1 < length trace\"\n          using a1 less_imp_diff_less by blast\n      qed\n\n      from `no_invariant_checks_in_transaction trace`\n      have \"no_invariant_checks_in_transaction (take (i_switch - 1) trace @ drop (Suc (i_switch - 1)) trace)\"\n      proof (rule maintain_no_invariant_checks_in_transaction2)\n        show \"i_switch - 1 < length trace\"\n          by (simp add: \\<open>i_switch < length trace\\<close> less_imp_diff_less)\n        show \"\n           \\<lbrakk>i < i_switch - 1; trace ! i = (invoc, ABeginAtomic tx txns); \\<And>ja. \\<lbrakk>i < ja; ja < i_switch - 1\\<rbrakk> \\<Longrightarrow> trace ! ja \\<noteq> (invoc, AEndAtomic)\\<rbrakk>\n             \\<Longrightarrow> trace ! (i_switch - 1) \\<noteq> (invoc, AEndAtomic)\" for i invoc tx txns\n          by (metis One_nat_def \\<open>Suc (i_switch - Suc 0) = i_switch\\<close> is_invoc a0 a2 a3 action.distinct(31) fst_conv le_eq_less_or_eq less_Suc_eq_le snd_conv)\n      qed\n\n      show \" no_invariant_checks_in_transaction trace'\"\n        using maintain_no_invariant_checks_in_transaction[OF `no_invariant_checks_in_transaction trace`, where pos=\"i_switch - 1\", simplified]\n        using One_nat_def \\<open>Suc (i_switch - Suc 0) = i_switch\\<close> \\<open>no_invariant_checks_in_transaction (take (i_switch - 1) trace @ drop (Suc (i_switch - 1)) trace)\\<close> trace'_def by presburger\n      show \"\\<not> traceCorrect trace'\"\n        using `\\<not>traceCorrect trace` trace'_def\n        by (auto simp add: traceCorrect_def')\n          (metis (no_types, lifting) Suc_diff_Suc UnI2 \\<open>i_switch + (length trace - Suc i_switch) = length trace - 1\\<close> \\<open>i_switch + (length trace - i_switch) = length trace\\<close> \\<open>length trace = Suc (length trace')\\<close> \\<open>length trace' < length trace\\<close> a1 add_less_cancel_left diff_Suc_1 diff_is_0_eq last_action_incorrect last_conv_nth last_drop leD length_drop list.size(3) nth_mem)\n      show \"initialState program ~~ trace' \\<leadsto>* S'\"\n        by (simp add: \\<open>initialState program ~~ trace' \\<leadsto>* S'\\<close>)\n      show \"packed_trace trace'\"\n        by (simp add: \\<open>packed_trace trace'\\<close>)\n      show \"\\<And>s. (s, ACrash) \\<notin> set trace'\"\n        by (simp add: \\<open>\\<And>s. (s, ACrash) \\<notin> set trace'\\<close>)\n      show \"no_invariant_checks_in_transaction trace'\"\n        by (simp add: \\<open>no_invariant_checks_in_transaction trace'\\<close>)\n      show \" \\<not> traceCorrect trace'\"\n        by (simp add: \\<open>\\<not> traceCorrect trace'\\<close>)\n      show \"\\<And>s. (s, AInvcheck True) \\<notin> set trace'\"\n        by (metis Un_iff append_take_drop_id less.prems(4) set_append trace'_def)\n      thus \"\\<And>s. (s, AInvcheck True) \\<notin> set trace'\" .\n    qed\n  qed\nqed\n\ntext_raw \\<open>\\DefineSnippet{show_programCorrect_noTransactionInterleaving2}{\\<close>\ntheorem show_programCorrect_noTransactionInterleaving'':\n  assumes packedTracesCorrect: \n    \"\\<And>trace s. \\<lbrakk>\n      initialState program ~~ trace \\<leadsto>* s; \n      packed_trace trace; \n      \\<not>contextSwitchesInTransaction trace;  \n      \\<And>s. (s, ACrash) \\<notin> set trace; \n      no_invariant_checks_in_transaction trace\n    \\<rbrakk> \\<Longrightarrow> traceCorrect trace\"\nshows \"programCorrect program\"\ntext_raw \\<open>}%EndSnippet\\<close>\nproof (rule show_programCorrect_noTransactionInterleaving', rule ccontr, fuzzy_goal_cases g)\n  case (g trace s)\n  obtain trace s\n    where \"initialState program ~~ trace \\<leadsto>* s\"\n      \"packed_trace trace\"\n      \"\\<not>contextSwitchesInTransaction trace\"\n      \"\\<And>s. (s, ACrash) \\<notin> set trace\"\n      \"no_invariant_checks_in_transaction trace\"\n      \"\\<not>traceCorrect trace\"\n    using remove_context_switches_in_transactions[OF g]\n    by metis                              \n\n\n  then show ?case\n    using packedTracesCorrect by blast \nqed\n\n\n\nend\n", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/packed_nofails_noinvchecks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.3063670977862541}}
{"text": "(*  Title:      HOL/MicroJava/BV/BVSpec.thy\n\n    Author:     Cornelia Pusch, Gerwin Klein\n    Copyright   1999 Technische Universitaet Muenchen\n\n*)\n\nsection \\<open>The Bytecode Verifier \\label{sec:BVSpec}\\<close>\n\ntheory BVSpec\nimports Effect\nbegin\n\ntext \\<open>\n  This theory contains a specification of the BV. The specification\n  describes correct typings of method bodies; it corresponds \n  to type \\emph{checking}.\n\\<close>\n\n\ndefinition\n  \\<comment> \\<open>The method type only contains declared classes:\\<close>\n  check_types :: \"'m prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty\\<^sub>i' err list \\<Rightarrow> bool\"\nwhere \n  \"check_types P mxs mxl \\<tau>s \\<equiv> set \\<tau>s \\<subseteq> states P mxs mxl\"\n\n  \\<comment> \\<open>An instruction is welltyped if it is applicable and its effect\\<close>\n  \\<comment> \\<open>is compatible with the type at all successor instructions:\\<close>\ndefinition\n  wt_instr :: \"['m prog,ty,nat,pc,ex_table,instr,pc,ty\\<^sub>m] \\<Rightarrow> bool\"\n  (\"_,_,_,_,_ \\<turnstile> _,_ :: _\" [60,0,0,0,0,0,0,61] 60)\nwhere\n  \"P,T,mxs,mpc,xt \\<turnstile> i,pc :: \\<tau>s \\<equiv>\n  app i P mxs T pc mpc xt (\\<tau>s!pc) \\<and> \n  (\\<forall>(pc',\\<tau>') \\<in> set (eff i P pc xt (\\<tau>s!pc)). P \\<turnstile> \\<tau>' \\<le>' \\<tau>s!pc')\"\n\n  \\<comment> \\<open>The type at @{text \"pc=0\"} conforms to the method calling convention:\\<close>\ndefinition wt_start :: \"['m prog,cname,ty list,nat,ty\\<^sub>m] \\<Rightarrow> bool\"\nwhere\n  \"wt_start P C Ts mxl\\<^sub>0 \\<tau>s \\<equiv>\n  P \\<turnstile> Some ([],OK (Class C)#map OK Ts@replicate mxl\\<^sub>0 Err) \\<le>' \\<tau>s!0\"\n\n  \\<comment> \\<open>A method is welltyped if the body is not empty,\\<close>\n  \\<comment> \\<open>if the method type covers all instructions and mentions\\<close>\n  \\<comment> \\<open>declared classes only, if the method calling convention is respected, and\\<close>\n  \\<comment> \\<open>if all instructions are welltyped.\\<close>\ndefinition wt_method :: \"['m prog,cname,ty list,ty,nat,nat,instr list,\n                 ex_table,ty\\<^sub>m] \\<Rightarrow> bool\"\nwhere\n  \"wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt \\<tau>s \\<equiv>\n  0 < size is \\<and> size \\<tau>s = size is \\<and>\n  check_types P mxs (1+size Ts+mxl\\<^sub>0) (map OK \\<tau>s) \\<and>\n  wt_start P C Ts mxl\\<^sub>0 \\<tau>s \\<and>\n  (\\<forall>pc < size is. P,T\\<^sub>r,mxs,size is,xt \\<turnstile> is!pc,pc :: \\<tau>s)\"\n\n  \\<comment> \\<open>A program is welltyped if it is wellformed and all methods are welltyped\\<close>\ndefinition  wf_jvm_prog_phi :: \"ty\\<^sub>P \\<Rightarrow> jvm_prog \\<Rightarrow> bool\" (\"wf'_jvm'_prog\\<^bsub>_\\<^esub>\")\nwhere\n  \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> \\<equiv>\n    wf_prog (\\<lambda>P C (M,Ts,T\\<^sub>r,(mxs,mxl\\<^sub>0,is,xt)). \n      wt_method P C Ts T\\<^sub>r mxs mxl\\<^sub>0 is xt (\\<Phi> C M))\"\n\ndefinition wf_jvm_prog :: \"jvm_prog \\<Rightarrow> bool\"\nwhere\n  \"wf_jvm_prog P \\<equiv> \\<exists>\\<Phi>. wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P\"\n\nlemma wt_jvm_progD:\n  \"wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P \\<Longrightarrow> \\<exists>wt. wf_prog wt P\"\n(*<*) by (unfold wf_jvm_prog_phi_def, blast) (*>*)\n\nlemma wt_jvm_prog_impl_wt_instr:\n  \"\\<lbrakk> wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P; \n      P \\<turnstile> C sees M:Ts \\<rightarrow> T = (mxs,mxl\\<^sub>0,ins,xt) in C; pc < size ins \\<rbrakk> \n  \\<Longrightarrow> P,T,mxs,size ins,xt \\<turnstile> ins!pc,pc :: \\<Phi> C M\"\n(*<*)\n  apply (unfold wf_jvm_prog_phi_def)\n  apply (drule (1) sees_wf_mdecl)\n  apply (simp add: wf_mdecl_def wt_method_def)\n  done\n(*>*)\n\nlemma wt_jvm_prog_impl_wt_start:\n  \"\\<lbrakk> wf_jvm_prog\\<^bsub>\\<Phi>\\<^esub> P; \n     P \\<turnstile> C sees M:Ts \\<rightarrow> T = (mxs,mxl\\<^sub>0,ins,xt) in C \\<rbrakk> \\<Longrightarrow> \n  0 < size ins \\<and> wt_start P C Ts mxl\\<^sub>0 (\\<Phi> C M)\"\n(*<*)\n  apply (unfold wf_jvm_prog_phi_def)\n  apply (drule (1) sees_wf_mdecl)\n  apply (simp add: wf_mdecl_def wt_method_def)\n  done\n(*>*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/BV/BVSpec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6757646010190476, "lm_q2_score": 0.4532618480153861, "lm_q1q2_score": 0.30629831188127354}}
{"text": "theory InfrastructureThree\n  imports CoronaAppTwo\nbegin\n\ntext \\<open>This is the new element for refining the Ephemeral Id -- simply a list\n     of ephemeral ids. The cryptographic details can be added here if needed\n     but at the current stage of abstraction we are satisfied with t a list.\n   The idea is that the current pointer is the first element and that\n   the Efids are popped off once used.\\<close>\n(* datatype efidlist = Efids \"efid\" \"nat\" \"efid list\" *)\n\nprimrec efids_root :: \"efidlist \\<Rightarrow> efid\"\n  where \"efids_root (Efids e n el) = e\"\nprimrec efids_index :: \"efidlist \\<Rightarrow> nat\"\n  where \"efids_index (Efids e n el) = n\"\nprimrec efids_inc_ind :: \"efidlist \\<Rightarrow> efidlist\"\n  where \"efids_inc_ind (Efids e n el) = (Efids e (Suc n) el) \"\nprimrec efids_cur:: \"efidlist \\<Rightarrow> efid\"\n  where \"efids_cur (Efids e n ef) = ef n\"\nprimrec efids_list :: \"efidlist \\<Rightarrow> nat \\<Rightarrow> efid\"\n  where \"efids_list (Efids e n ef) = ef\"\ndefinition repl_efr :: \"efidlist \\<Rightarrow> efid\"\n  where \"repl_efr el \\<equiv> efids_root el\" \n\ndatatype igraph = Lgraph \"(location * location)set\" \"location \\<Rightarrow> identity set\"\n                           \"identity \\<Rightarrow> efidlist\"  \n                           \"location \\<Rightarrow> string * (dlm * data) set\"\n                           \"location \\<Rightarrow> efid set\"\n                           \"identity \\<Rightarrow> location \\<Rightarrow> (identity * efid)set\"\n\ndatatype infrastructure = \n         Infrastructure \"igraph\" \n                        \"[igraph, location] \\<Rightarrow> policy set\" \n                       \nprimrec loc :: \"location \\<Rightarrow> nat\"\nwhere  \"loc(Location n) = n\"\nprimrec gra :: \"igraph \\<Rightarrow> (location * location)set\"\nwhere  \"gra(Lgraph g a c l e k) = g\"\nprimrec agra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> identity set)\"\nwhere  \"agra(Lgraph g a c l e k) = a\"\nprimrec cgra :: \"igraph \\<Rightarrow> identity \\<Rightarrow> efidlist\"\nwhere  \"cgra(Lgraph g a c l e k) = c\"\nprimrec lgra :: \"igraph \\<Rightarrow> (location \\<Rightarrow> string * (dlm * data) set)\"\n  where  \"lgra(Lgraph g a c l e k) = l\"\nprimrec egra :: \"igraph \\<Rightarrow> location \\<Rightarrow> efid set\"\n  where  \"egra(Lgraph g a c l e k) = e\"\nprimrec kgra:: \"[igraph, identity, location] \\<Rightarrow> (identity * efid)set\"\n  where \"kgra(Lgraph g a c l e k) = k\"\n\ndefinition nodes :: \"igraph \\<Rightarrow> location set\" \nwhere \"nodes g == { x. (? y. ((x,y): gra g) | ((y,x): gra g))}\"\n\ndefinition actors_graph :: \"igraph \\<Rightarrow> identity set\"  \nwhere  \"actors_graph g == {x. ? y. y : nodes g \\<and> x \\<in> (agra g y)}\"\n\nprimrec graphI :: \"infrastructure \\<Rightarrow> igraph\"\nwhere \"graphI (Infrastructure g d) = g\"\nprimrec delta :: \"[infrastructure, igraph, location] \\<Rightarrow> policy set\"\nwhere \"delta (Infrastructure g d) = d\"\nprimrec tspace :: \"[infrastructure, identity ] \\<Rightarrow> efidlist\"\n  where \"tspace (Infrastructure g d) = cgra g\"\nprimrec lspace :: \"[infrastructure, location ] \\<Rightarrow> string * (dlm * data)set\"\n  where \"lspace (Infrastructure g d) = lgra g\"\n\n\ntext \\<open>Predicates and projections for the labels to encode their meaning.\\<close>\ndefinition owner :: \"dlm * data \\<Rightarrow> actor\" where \"owner d \\<equiv> fst(fst d)\"\ndefinition owns :: \"[igraph, location, actor, dlm * data] \\<Rightarrow> bool\"\n  where \"owns G l a d \\<equiv> owner d = a\"\ndefinition readers :: \"dlm * data \\<Rightarrow> actor set\"\n  where \"readers d \\<equiv> snd (fst d)\"\n\ntext \\<open>The predicate @{text \\<open>has_access\\<close>} is true for owners or readers.\\<close> \ndefinition has_access :: \"[igraph, location, actor, dlm * data] \\<Rightarrow> bool\"    \nwhere \"has_access G l a d \\<equiv> owns G l a d \\<or> a \\<in> readers d\"\n\ntypedef label_fun = \"{f :: dlm * data \\<Rightarrow> dlm * data. \n                        \\<forall> x:: dlm * data. fst x = fst (f x)}\"  \n  by (fastforce)\n\ndefinition secure_process :: \"label_fun \\<Rightarrow> dlm * data \\<Rightarrow> dlm * data\" (infixr \"\\<Updown>\" 50)\n  where \"f  \\<Updown> d \\<equiv> (Rep_label_fun f) d\" \n\ndefinition atI :: \"[identity, igraph, location] \\<Rightarrow> bool\" (\"_ @\\<^bsub>(_)\\<^esub> _\" 50)\nwhere \"a @\\<^bsub>G\\<^esub> l \\<equiv> a \\<in> (agra G l)\"\n\ndefinition enables :: \"[infrastructure, location, actor, action] \\<Rightarrow> bool\"\nwhere\n\"enables I l a a' \\<equiv>  (\\<exists> (p,e) \\<in> delta I (graphI I) l. a' \\<in> e \\<and> p a)\"\n\ndefinition behaviour :: \"infrastructure \\<Rightarrow> (location * actor * action)set\"\nwhere \"behaviour I \\<equiv> {(t,a,a'). enables I t a a'}\"\n\ndefinition misbehaviour :: \"infrastructure \\<Rightarrow> (location * actor * action)set\"\nwhere \"misbehaviour I \\<equiv> -(behaviour I)\"\n\nprimrec jonce :: \"['a, 'a list] \\<Rightarrow> bool\"\nwhere\njonce_nil: \"jonce a [] = False\" |\njonce_cons: \"jonce a (x#ls) = (if x = a then (a \\<notin> (set ls)) else jonce a ls)\"\n\ndefinition move_graph_a :: \"[identity, location, location, igraph] \\<Rightarrow> igraph\"\nwhere \"move_graph_a n l l' g \\<equiv> Lgraph (gra g) \n                    (if n \\<in> ((agra g) l) \\<and>  n \\<notin> ((agra g) l') \n                        \\<and> card (agra g l') \\<ge> 3 \\<and> card (agra g l) \\<ge> 4 then \n                     ((agra g)(l := (agra g l) - {n}))(l' := (insert n (agra g l')))\n                     else (agra g))\n                    (if n \\<in> ((agra g) l) &  n \\<notin> ((agra g) l')  \n                        \\<and> card (agra g l') \\<ge> 3 \\<and> card (agra g l) \\<ge> 4 then \n                            (cgra g)(n := (efids_inc_ind(cgra g n)))\n                      else (cgra g))\n                                 (lgra g)\n                    (if n \\<in> ((agra g) l) \\<and>  n \\<notin> ((agra g) l') \n                        \\<and> card (agra g l') \\<ge> 3 \\<and> card (agra g l) \\<ge> 4 then\n                       ((egra g)(l := (egra g l) - {efids_cur(cgra g n)}))\n                                (l' := insert (efids_cur(efids_inc_ind(cgra g n)))(egra g l'))\n                      else egra g)(kgra g)\"\n\ndefinition put_graph_efid :: \"[identity, location, igraph] \\<Rightarrow> igraph\"\n  where \\<open>put_graph_efid n l g  \\<equiv> Lgraph (gra g)(agra g)\n                            ((cgra g)(n := efids_inc_ind(cgra g n)))\n                               (lgra g)\n                             ((egra g)(l := insert (efids_cur(efids_inc_ind(cgra g n)))\n                                           ((egra g l) - {efids_cur(cgra g n)})))\n                              (kgra g)\\<close>\n\ninductive state_transition_in :: \"[infrastructure, infrastructure] \\<Rightarrow> bool\" (\"(_ \\<rightarrow>\\<^sub>n _)\" 50)\nwhere\n  move: \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; l \\<in> nodes G; l' \\<in> nodes G;\n          (a) \\<in> actors_graph G; enables I l' (Actor a) move;\n         I' = Infrastructure (move_graph_a a l l' (graphI I))(delta I) \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\" \n| get : \"\\<lbrakk> G = graphI I; a @\\<^bsub>G\\<^esub> l; l \\<in> nodes G;\n        enables I l (Actor a) get;\n        I' = Infrastructure \n                   (Lgraph (gra G)(agra G)(cgra G)(lgra G)(egra G)\n                       ((kgra G)(a := ((kgra G a)(l:= {(x,y). x \\<in> agra G l \\<and> y \\<in> egra G l})))))\n                   (delta I)\n         \\<rbrakk> \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n| put : \"G = graphI I \\<Longrightarrow> a @\\<^bsub>G\\<^esub> l \\<Longrightarrow> enables I l (Actor a) put \\<Longrightarrow>\n        I' = Infrastructure (put_graph_efid a l (graphI I))(delta I)\n          \\<Longrightarrow> I \\<rightarrow>\\<^sub>n I'\"\n\n\ntext \\<open>Note that the type infrastructure can now be instantiated to the axiomatic type class \n      @{text\\<open>state\\<close>} which enables the use of the underlying Kripke structures and CTL.\\<close>\ninstantiation \"infrastructure\" :: state\nbegin\ndefinition \n   state_transition_infra_def: \"(i \\<rightarrow>\\<^sub>i i') =  (i \\<rightarrow>\\<^sub>n (i' :: infrastructure))\"\n\ninstance\n  by (rule MC.class.MC.state.of_class.intro)\n\ndefinition state_transition_in_refl (\"(_ \\<rightarrow>\\<^sub>n* _)\" 50)\nwhere \"s \\<rightarrow>\\<^sub>n* s' \\<equiv> ((s,s') \\<in> {(x,y). state_transition_in x y}\\<^sup>*)\"\n\nend\n\n\nlemma move_graph_eq: \"move_graph_a a l l g = g\"  \n  by (simp add: move_graph_a_def, case_tac g, force)\n\n\n\n\ndefinition ref_map :: \"[InfrastructureThree.infrastructure, \n                        [InfrastructureTwo.igraph, location] \\<Rightarrow> policy set]\n                        \\<Rightarrow> InfrastructureTwo.infrastructure\"\n  where \"ref_map I lp = InfrastructureTwo.Infrastructure \n                                 (InfrastructureTwo.Lgraph\n                                        (InfrastructureThree.gra (graphI I))\n                                        (InfrastructureThree.agra (graphI I))\n                                        (InfrastructureThree.cgra (graphI I))\n                                        (InfrastructureThree.lgra (graphI I))\n                                        (InfrastructureThree.egra (graphI I))\n                                        (InfrastructureThree.kgra (graphI I)))   \n                                                         lp\"\n\nlemma delta_invariant[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  delta(z) = delta(z')\"\n  apply clarify\n  apply (erule state_transition_in.cases)\n  by simp+\n\n\nlemma same_actors0[rule_format]: \"\\<forall> z z'.  z \\<rightarrow>\\<^sub>n z' \\<longrightarrow> actors_graph (graphI z) = actors_graph (graphI z')\"\nproof (clarify, erule state_transition_in.cases)\n  show \" \\<And>z z' G I a l l' I'.\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a a l l' (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z')\"\n    apply (simp add: InfrastructureThree.actors_graph_def)\n    apply (rule equalityI)\n     apply (rule subsetI)\n     apply (rule CollectI)\n     apply (drule CollectD)\n     apply (erule exE, erule conjE)+\n    apply (simp add: move_graph_a_def)\n     apply (smt (z3) Collect_cong InfrastructureThree.gra.simps InfrastructureThree.nodes_def)\n    apply (simp add: InfrastructureThree.enables_def move_graph_a_def)\n    apply (rule conjI)\n     apply (rule impI)+\n     apply (rule subsetI)\n     apply (rule CollectI)\n     apply (drule CollectD)\n     apply (erule exE)+\n     apply (erule conjE)+\n (*    apply (smt (z3) InfrastructureThree.gra.simps InfrastructureThree.nodes_def mem_Collect_eq) *)\n    using InfrastructureThree.nodes_def by auto\nnext show \" \\<And>z z' G I a l I' g.\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureThree.enables I l (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G) (InfrastructureThree.cgra G)\n          (InfrastructureThree.lgra G) (InfrastructureThree.egra g)\n          ((InfrastructureThree.kgra g)\n           (a := (InfrastructureThree.kgra g a)\n              (l := {(x, y). x \\<in> InfrastructureThree.agra G l \\<and> y \\<in> InfrastructureThree.egra G l}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z')\"\n    by (simp add: InfrastructureThree.actors_graph_def InfrastructureThree.nodes_def)\nnext show \"\\<And>z z' G I a l I'.\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureThree.enables I l (Actor a) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid a l (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z')\"\n    by (simp add: InfrastructureThree.actors_graph_def InfrastructureThree.nodes_def InfrastructureThree.put_graph_efid_def)\nqed\n\nlemma same_actors: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \n              \\<Longrightarrow> actors_graph(graphI I) = actors_graph(graphI y)\"\nproof (erule rtrancl_induct)\n  show \"actors_graph (graphI I) = actors_graph (graphI I)\"\n    by (rule refl)\nnext show \"\\<And>(y::infrastructure) z::infrastructure.\n       (I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n       (y, z) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n       actors_graph (graphI I) = actors_graph (graphI y) \\<Longrightarrow>\n       actors_graph (graphI I) = actors_graph (graphI z)\"\n    by (drule CollectD, simp, drule same_actors0, simp)  \nqed\n\n(* locations invariants *)\n lemma same_nodes0[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow> nodes(graphI z) = nodes(graphI z')\"   \n    apply clarify\n  apply (erule InfrastructureThree.state_transition_in.cases)\n  by (simp add: move_graph_a_def atI_def actors_graph_def nodes_def put_graph_efid_def)+\n\nlemma same_nodes: \"(c, s) \\<in> {(x::InfrastructureThree.infrastructure, y::InfrastructureThree.infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\n\\<Longrightarrow> InfrastructureThree.nodes (graphI c) = InfrastructureThree.nodes (graphI s)\"\n  apply (erule rtrancl_induct)\n   apply (rule refl)\n  apply (drule CollectD)\n    apply simp\n    apply (drule same_nodes0)\n  by simp  \n\n(* delta invariants *)\nlemma init_state_policy0: \"\\<lbrakk> \\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  delta(z) = delta(z'); \n                          (x,y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<rbrakk> \\<Longrightarrow> \n                          delta(x) = delta(y)\"  \n  apply (rule mp)\n  prefer 2\n   apply (rotate_tac 1)\n    apply assumption\n  thm rtrancl_induct\n  apply (erule rtrancl_induct)  \n    apply (rule impI)\n   apply (rule refl)\n    apply (subgoal_tac \"delta y = delta z\")\n   apply (erule impE)\n    apply assumption\n    apply (rule impI)\n   apply (rule trans)\n    apply assumption+\n  apply (drule_tac x = y in spec)\n  apply (drule_tac x = z in spec)\n    apply (rotate_tac -1)\n  apply (erule impE)\n    apply simp\nby assumption\n \nlemma init_state_policy: \"\\<lbrakk> (x,y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<rbrakk> \\<Longrightarrow> \n                          delta(x) = delta(y)\"  \n  apply (rule init_state_policy0)\n  apply clarify\n    apply (rule delta_invariant)\n  by assumption\n\nlemma efids_list_eqO: \" InfrastructureThree.efids_list (ef) =\n       InfrastructureThree.efids_list  (InfrastructureThree.efids_inc_ind ef)\"\n  by (metis InfrastructureThree.efids_inc_ind.simps InfrastructureThree.efids_list.simps efidlist.exhaust)\n \n\nlemma efids_list_eq[rule_format]: \"(\\<forall> z z'. (z \\<rightarrow>\\<^sub>n z') \\<longrightarrow> \nefids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) =\nefids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a))\"\nproof (clarify, frule same_actors0, frule same_nodes0, erule state_transition_in.cases)\n  show \"\\<And>z z' G I aa l l' I'.\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       aa \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l' (Actor aa) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a aa l l' (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) =\n       InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\"\n    using InfrastructureThree.efids_list_eqO InfrastructureThree.move_graph_a_def by fastforce\nnext show \"\\<And>z z' G I aa l I'.\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       InfrastructureThree.enables I l (Actor aa) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n          (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n          ((InfrastructureThree.kgra G)\n           (aa := (InfrastructureThree.kgra G aa)\n              (l := {(x, y). x \\<in> InfrastructureThree.agra G l \\<and> y \\<in> InfrastructureThree.egra G l}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) =\n       InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\"\n    using InfrastructureThree.move_graph_a_def efids_list_eqO by fastforce\nnext show\n \"\\<And>z z' G I aa l I'.\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureThree.enables I l (Actor aa) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid aa l (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) =\n       InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a) \"\n    apply (simp add: move_graph_a_def)\n    using InfrastructureThree.put_graph_efid_def efids_list_eqO by fastforce\nqed\n\nlemma efids_list_eq0: \"\\<And> z z'. (z \\<rightarrow>\\<^sub>n z') \\<Longrightarrow>\n\\<forall> a. efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) =\nefids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\"\n  by (simp add: efids_list_eq)\n\nlemma efids_list_eq_refl[rule_format]: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n\\<forall> a. efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a) =\nefids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)\"\nproof (erule rtrancl_induct, simp)\n  show \"\\<And>y z. (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           \\<forall>a. InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a) =\n               InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a) \\<Longrightarrow>\n           \\<forall>a. InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a) =\n               InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)\"\n    by (simp add: InfrastructureThree.efids_list_eq)\nqed\n\n(* *)\nlemma efids_list_disjoint: \"(\\<forall> (z :: InfrastructureThree.infrastructure). (\\<forall> z'. (z \\<rightarrow>\\<^sub>n z') \\<longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z). a \\<noteq> a' \\<longrightarrow> \n(range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter> \n range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a'))) = {}))\n\\<longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z'). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z'). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a')))) = {})))\n))\"\n    apply clarify\n  apply (erule InfrastructureThree.state_transition_in.cases)\n  apply (smt (z3) InfrastructureThree.efids_list_eq0 InfrastructureThree.same_actors0 InfrastructureThree.state_transition_in.move)\n   apply (simp add: InfrastructureThree.actors_graph_def InfrastructureThree.nodes_def)\n  apply (simp add: put_graph_efid_def)\n  by (metis InfrastructureThree.graphI.simps InfrastructureThree.put_graph_efid_def InfrastructureThree.same_actors0 InfrastructureThree.state_transition_in.put efidlist.exhaust efids_inc_ind.simps efids_list.simps)\n\nlemma ran_efidslist_disjoint:\n\"(\\<forall> z. (\\<forall> z'. (z \\<rightarrow>\\<^sub>n z') \\<longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')))) = {})))\n\\<longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z'). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z'). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a')))) = {})))\n))\"\n  by (rule efids_list_disjoint)\n\n\nlemma ran_efids_list_disjoint_refl: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow>\n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')))) = {}))) \\<Longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI y). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI y). a \\<noteq> a' \\<longrightarrow>\n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a')))) = {})))\"\nproof (erule rtrancl_induct, simp)\n  show \"\\<And>y z. \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n              \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n                 a \\<noteq> a' \\<longrightarrow>\n                 range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter>\n                 range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')) =\n                 {} \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI y).\n              \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI y).\n                 a \\<noteq> a' \\<longrightarrow>\n                 range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)) \\<inter>\n                 range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a')) =\n                 {} \\<Longrightarrow>\n           \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n              \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n                 a \\<noteq> a' \\<longrightarrow>\n                 range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter>\n                 range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')) =\n                 {}\"\n    by (simp add: ran_efidslist_disjoint)\nqed\n\n\n\n(* efids_cur inj_on*)\nlemma efids_cur_in_efids_listO: \"a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I) \\<Longrightarrow>\n           efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)\n         \\<in> range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))\"\n  apply (case_tac \"(InfrastructureThree.cgra (InfrastructureThree.graphI I) a)\")\n  by simp\n\nlemma efids_cur_in_efids_list: \"a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I) \\<Longrightarrow>\n           efids_cur (efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))\n         \\<in> range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))\"\n  apply (case_tac \"(InfrastructureThree.cgra (InfrastructureThree.graphI I) a)\")\n  by simp\n\nlemma efids_list_inj_imp_inc_ind_not_eq[rule_format]: \" (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). \n inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<longrightarrow>\n      efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<noteq>\n              efids_cur(efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)))\"\nproof (clarify, simp add: efids_inc_ind_def efids_cur_def efids_list_def, case_tac \"InfrastructureThree.graphI z\", simp)\n  show \"\\<And>a x1 x2 x3 x4 x5 x6.\n       a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.igraph.Lgraph x1 x2 x3 x4 x5 x6) \\<Longrightarrow>\n       inj (rec_efidlist (\\<lambda>e n ef. ef) (x3 a)) \\<Longrightarrow>\n       rec_efidlist (\\<lambda>e n ef. ef n) (x3 a) = rec_efidlist (\\<lambda>e n ef. ef n) (rec_efidlist (\\<lambda>e n. Efids e (Suc n)) (x3 a)) \\<Longrightarrow>\n       InfrastructureThree.graphI z = InfrastructureThree.igraph.Lgraph x1 x2 x3 x4 x5 x6 \\<Longrightarrow> False\"\n    by (smt (z3) efidlist.exhaust efidlist.rec n_not_Suc_n the_inv_f_f)\nqed\n\n(* New invariant in step 3: card (agra g l) \\<ge> 2 is preserved *)\nlemma card_minusO: \"3 \\<le> card (S) \\<Longrightarrow> 2 \\<le> card (S - {a})\"\n  by (metis (no_types, lifting) Diff_empty Diff_insert0 Suc_le_mono card.infinite card.insert_remove insert_Diff insert_Diff_single le_0_eq le_trans nat_le_linear numeral_2_eq_2 numeral_3_eq_3)\n\nlemma card_minus_gen: \"Suc n \\<le> k \\<Longrightarrow> n \\<le> k\"\n  by (erule Nat.Suc_leD)\n\nlemma card_minus_diff: \"card (S) \\<le> Suc(card ( S - {a}))\"\n  by (metis Suc_le_lessD card_Diff1_less_iff card_Suc_Diff1 nat_le_linear)\n\n\nlemma card_minus: \"4 \\<le> card (S) \\<Longrightarrow> 3 \\<le> card (S - {a})\"\n  apply (case_tac \"a \\<in> S\")\n  apply (smt (z3) Diff_idemp Suc_leI card.infinite card.insert_remove card_minusO dual_order.trans insert_Diff le_neq_implies_less nat.simps(3) nat_le_linear numeral_2_eq_2 numeral_3_eq_3 numeral_le_iff semiring_norm(69) semiring_norm(72))\n  by force\n\nlemma card_insertO:  \"2 \\<le> card S \\<Longrightarrow> 2 \\<le> card (insert a S)\"\n  by (metis card.infinite card_insert_le dual_order.trans le_zero_eq nat.simps(3) numeral_2_eq_2)\n\nlemma card_insert:  \"3 \\<le> card S \\<Longrightarrow> 3 \\<le> card (insert a S)\"\n  by (metis One_nat_def Suc_leI Suc_le_lessD card.infinite card_insert_le dual_order.trans le_zero_eq nat.simps(3) numeral_le_iff numerals(1) semiring_norm(68))\n\nlemma numbers_actors_inv: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  \n(\\<forall> l \\<in> nodes (graphI z). card (agra (graphI z) l) \\<ge> 3 \\<longrightarrow> \n card (agra (graphI z') l) \\<ge> 3)\"\nproof (clarify, frule same_nodes0, erule state_transition_in.cases)\n  show \"\\<And>z z' l G I a la l' I'.\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z) l) \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a a la l' (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z') l)\"\n    apply (simp add: InfrastructureThree.move_graph_a_def)\n    by (metis One_nat_def card_Diff_singleton card_insert card_minus)\n(*\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (rule conjI)\n      apply (rule impI)+\n    apply force\n     apply (rule impI)+\n     apply (erule conjE)+\n    apply (erule card_minus)\n     apply (rule impI)+\n    apply (erule conjE)+\n    by (erule card_insert)\n*)\nnext show \"\\<And>z z' l G I a la I' g.\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z) l) \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n          (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra g)\n          ((InfrastructureThree.kgra g)\n           (a := (InfrastructureThree.kgra g a)\n              (la := {(x, y). x \\<in> InfrastructureThree.agra G la \\<and> y \\<in> InfrastructureThree.egra G la}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z') l)\"\n    by force\nnext show \"\\<And>z z' l G I a la I'.\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z) l) \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor a) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid a la (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z') l)\"\n    using InfrastructureThree.put_graph_efid_def by force\nqed\n\nlemma numbers_actors_invO[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  \n(\\<forall> l \\<in> nodes (graphI z). card (agra (graphI z) l) \\<ge> 3 \\<longrightarrow> \n card (agra (graphI z') l) \\<ge> 3)\"\n  using numbers_actors_inv by blast\n\n\n(*\nlemma numbers_actors_inv_old: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  \n(\\<forall> l \\<in> nodes (graphI z). card (agra (graphI z) l) \\<ge> 2 \\<longrightarrow> \n card (agra (graphI z') l) \\<ge> 2)\"\nproof (clarify, frule same_nodes0, erule state_transition_in.cases)\n  show \"\\<And>z z' l G I a la l' I'.\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       2 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z) l) \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a a la l' (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       2 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z') l)\"\n    apply (simp add: InfrastructureThree.move_graph_a_def)\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (rule conjI)\n      apply (rule impI)+\n    apply force\n     apply (rule impI)+\n     apply (erule conjE)+\n    apply (erule card_minus)\n     apply (rule impI)+\n    apply (erule conjE)+\n    by (erule card_insert)\nnext show \"\\<And>z z' l G I a la I' g.\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       2 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z) l) \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n          (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra g)\n          ((InfrastructureThree.kgra g)\n           (a := (InfrastructureThree.kgra g a)\n              (la := {(x, y). x \\<in> InfrastructureThree.agra G la \\<and> y \\<in> InfrastructureThree.egra G la}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       2 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z') l)\"\n    by force\nnext show \"\\<And>z z' l G I a la I'.\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       2 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z) l) \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor a) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid a la (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       2 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z') l)\"\n    using InfrastructureThree.put_graph_efid_def by force\nqed\n*)\n\nlemma  numbers_actors_inv_refl: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n            l \\<in> nodes (graphI I) \\<Longrightarrow> card (agra (graphI I) l) \\<ge> 3 \\<Longrightarrow> card (agra (graphI y) l) \\<ge> 3\"\nproof (erule rtrancl_induct, simp)\n  show \"\\<And>y z. l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI I) \\<Longrightarrow>\n           3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI I) l) \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI y) l) \\<Longrightarrow>\n           3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI z) l)\"\n    by (simp add: InfrastructureThree.same_nodes numbers_actors_inv)\nqed\n\n\n(* Adopt the agra \\<longrightarrow> egra invariants from Level Two *) \nlemma actor_unique_loc_lem00[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  nodes (graphI z) = nodes (graphI z') \\<longrightarrow>\n         (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l')) \n        \\<longrightarrow> (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z') \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z') l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z') l' \\<longrightarrow> l = l'))\"\n  apply (rule allI)+\n  apply (rule impI)+\n  apply (erule InfrastructureThree.state_transition_in.cases)\n    apply (simp add: move_graph_a_def)\n  apply auto[1]\n  using InfrastructureThree.agra.simps InfrastructureThree.graphI.simps apply presburger\n  using InfrastructureThree.agra.simps InfrastructureThree.graphI.simps InfrastructureThree.put_graph_efid_def by presburger\n\n\nlemma actor_unique_loc_lem0[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  nodes (graphI z) = nodes (graphI z') \\<longrightarrow>\n         (\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI z) \\<longrightarrow>  (\\<forall> l'. l' \\<in> nodes (graphI z) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow> \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l'))) \n        \\<longrightarrow> (\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI z') \\<longrightarrow>  (\\<forall> l'. l' \\<in> nodes (graphI z') \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z') l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z') l' \\<longrightarrow> l = l')))\"\n  apply (rule allI)+\n  apply (rule impI)+\n  apply (erule InfrastructureThree.state_transition_in.cases)\n    apply (simp add: move_graph_a_def)\n  using InfrastructureThree.atI_def apply force\n  using InfrastructureThree.agra.simps InfrastructureThree.graphI.simps apply presburger\n  using InfrastructureThree.agra.simps InfrastructureThree.graphI.simps InfrastructureThree.put_graph_efid_def by presburger\nthm actor_unique_loc_lem0\n\nlemma actor_unique_loc_lem0a: \"z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>  nodes (graphI z) = nodes (graphI z') \\<Longrightarrow>\n         (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l'))\n        \\<Longrightarrow> l \\<in> nodes (graphI z') \\<Longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z') l \\<Longrightarrow> \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z') l' \\<Longrightarrow> l = l'\"\n  using actor_unique_loc_lem00 by presburger\n\nlemma actor_unique_loc_lem[rule_format]: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n         (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n         (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI y) \\<longrightarrow> \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI y) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI y) l' \\<longrightarrow> l = l'))\"\nproof (erule rtrancl_induct, simp)\n  show \"\\<And>y z. \\<forall>a l l'.\n              l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI I) \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           \\<forall>a l l'.\n              l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI y) \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI y) l \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI y) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n           \\<forall>a l l'.\n              l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l'\"\n    by (metis CollectD InfrastructureThree.same_nodes actor_unique_loc_lem0a case_prodD rtrancl.rtrancl_into_rtrancl)\nqed\n\n\nlemma efid_in_range_invariantO: \"(\\<forall> (z :: InfrastructureThree.infrastructure) z'. (z \\<rightarrow>\\<^sub>n z') \\<longrightarrow> \n         (\\<forall> l \\<in> InfrastructureThree.nodes (graphI z).\n         (\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z) l).\n         (\\<exists> a \\<in> InfrastructureThree.actors_graph (graphI z). e \\<in> range (efids_list (InfrastructureThree.cgra (graphI z) a)))))\n          \\<longrightarrow>  (\\<forall> l \\<in> nodes (graphI z').\n         (\\<forall> e \\<in> (egra (InfrastructureThree.graphI z') l). \n         (\\<exists> a \\<in> actors_graph (graphI z'). e \\<in> range (efids_list (InfrastructureThree.cgra (graphI z') a))))))\"\nproof (clarify, frule same_actors0, frule same_nodes0, frule efids_list_eq0, erule state_transition_in.cases)\nshow \"\\<And>z z' l e G I a la I'.\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n                e \\<in> range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       e \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z') l \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) = InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       \\<forall>a. InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) =\n           InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a) \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G) (InfrastructureThree.cgra G)\n          (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n          ((InfrastructureThree.kgra G)\n           (a := (InfrastructureThree.kgra G a)\n              (la := {(x, y). x \\<in> InfrastructureThree.agra G la \\<and> y \\<in> InfrastructureThree.egra G la}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z').\n          e \\<in> range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a))\"\n    by simp\nnext show \"\\<And>z z' l e G I a la l' I'.\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n                e \\<in> range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       e \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z') l \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       \\<forall>a. InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) =\n           InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a) \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a a la l' (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z').\n          e \\<in> range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a))\"\n    apply (unfold move_graph_a_def)\n    by (smt (z3) DiffD1 InfrastructureThree.cgra.simps InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.egra.simps InfrastructureThree.graphI.simps fun_upd_def insertE)\n  next show \" \\<And>z z' l e G I a la I'.\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n                e \\<in> range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       e \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z') l \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       \\<forall>a. InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) =\n           InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a) \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor a) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid a la (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z').\n          e \\<in> range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z') a))\"\n    apply (simp add: move_graph_a_def)\n      by (smt (verit, best) DiffD1 InfrastructureThree.actors_graph_def InfrastructureThree.atI_def InfrastructureThree.efids_cur_in_efids_list InfrastructureThree.egra.simps InfrastructureThree.put_graph_efid_def fun_upd_def insert_iff mem_Collect_eq)\nqed\n\n(* variation for applicability*)\nlemma efid_in_range_invariantOa: \"(z \\<rightarrow>\\<^sub>n z') \\<Longrightarrow> \n         (\\<forall> l \\<in> nodes (graphI z).\n         (\\<forall> e \\<in> (egra (InfrastructureThree.graphI z) l).\n         (\\<exists> a \\<in> actors_graph (graphI z). e \\<in> range (efids_list (InfrastructureThree.cgra (graphI z) a)))))\n          \\<Longrightarrow>  (\\<forall> l \\<in> nodes (graphI z').\n         (\\<forall> e \\<in> (egra (InfrastructureThree.graphI z') l). \n         (\\<exists> a \\<in> actors_graph (graphI z'). e \\<in> range (efids_list (InfrastructureThree.cgra (graphI z') a)))))\"\n  using efid_in_range_invariantO by presburger\n\nlemma efids_in_range_invariantOO[rule_format]: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \n        \\<Longrightarrow> (\\<forall> l \\<in> nodes (graphI I).\n            \\<forall> e \\<in> (egra (InfrastructureThree.graphI I) l).\n         \\<exists> a \\<in> actors_graph (graphI I). e \\<in> range (efids_list (InfrastructureThree.cgra (graphI I) a)))\n       \\<Longrightarrow> (\\<forall> l \\<in> nodes (graphI y).\n           \\<forall> e \\<in> (egra (InfrastructureThree.graphI y) l).\n         \\<exists> a \\<in> actors_graph (graphI y). e \\<in> range (efids_list (InfrastructureThree.cgra (graphI y) a)))\"\nproof (erule rtrancl_induct)\n  show \"\\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n       \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI I) l.\n          \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n             e \\<in> range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<Longrightarrow>\n    \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n       \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI I) l.\n          \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n             e \\<in> range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))\"\n    by blast\nnext show \"\\<And>y z. \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n              \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI I) l.\n                 \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n                    e \\<in> range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI y).\n              \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI y) l.\n                 \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI y).\n                    e \\<in> range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)) \\<Longrightarrow>\n           \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n              \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n                 \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n                    e \\<in> range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \"\n    using efid_in_range_invariantO by auto\nqed\n\n\n(* Adopt the efids_cur and egra lemmas from Level Two *)\nlemma efids_cur_eq_egra[rule_format]: \"(\\<forall> z. (\\<forall> z'. (z \\<rightarrow>\\<^sub>n z') \\<longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l')) \\<longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI z).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI z) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI z').\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z') l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI z') l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)))))\"\nproof (clarify, frule same_actors0, frule same_nodes0, rule state_transition_in.cases, assumption)\n  show \"\\<And>z z' l e G I a la l' I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>a l l'.\n          l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       e \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z') l \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) = InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l' (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a a la l' (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z') l.\n          e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\"\n    apply (simp add: move_graph_a_def)\n    by (smt (z3) DiffE Diff_empty Diff_insert0 fun_upd_other fun_upd_same insertE insert_Diff1 mk_disjoint_insert singleton_iff)\nnext show \"\\<And>z z' l e G I a la I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       e \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z') l \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) = InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G) (InfrastructureThree.cgra G)\n          (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n          ((InfrastructureThree.kgra G)\n           (a := (InfrastructureThree.kgra G a)\n              (la := {(x, y). x \\<in> InfrastructureThree.agra G la \\<and> y \\<in> InfrastructureThree.egra G la}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z') l.\n          e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\"\n    by simp\nnext show \"\\<And>z z' l e G I a la I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>a l l'.\n          l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       e \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z') l \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor a) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid a la (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z') l.\n          e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\"\n    apply (unfold put_graph_efid_def)\n    apply (case_tac \"l = la\")\n    apply (smt (z3) DiffE InfrastructureThree.agra.simps InfrastructureThree.atI_def InfrastructureThree.cgra.simps InfrastructureThree.egra.simps InfrastructureThree.graphI.simps fun_upd_apply insertCI insertE)\n    apply (drule_tac x = l in bspec)\n     apply metis\n    apply (subgoal_tac \"e \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z) l \")\n    prefer 2\n    apply fastforce\n    apply (drule_tac x = e in bspec, assumption)\n    apply (erule bexE)\n    apply (rule_tac x = aa in bexI)\n     apply (simp add: atI_def)\n     apply (subgoal_tac \"aa \\<noteq> a\")\n      apply simp\n    prefer 2\n    using InfrastructureThree.agra.simps InfrastructureThree.graphI.simps apply presburger\n    by meson\nqed\n\nlemma efids_cur_eq_egra_refl[rule_format]: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI I).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI I) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI I) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI y).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI y) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI y) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)))\"\nproof (erule rtrancl_induct, simp)\n  show \"\\<And>y z. \\<forall>a l l'.\n              l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI I) \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           (\\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n               \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI I) l.\n                  \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI I) l.\n                     e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<longrightarrow>\n           (\\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI y).\n               \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI y) l.\n                  \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI y) l.\n                     e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)) \\<Longrightarrow>\n           (\\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n               \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI I) l.\n                  \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI I) l.\n                     e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<longrightarrow>\n           (\\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n               \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n                  \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                     e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))\"\n    by (simp add: Pair_inject actor_unique_loc_lem case_prodE efids_cur_eq_egra)\n  qed\n\n(* efids_cur injective*)\nlemma efids_cur_inj_on_inv0[rule_format]: \"(\\<forall> z. (\\<forall> z'. (z \\<rightarrow>\\<^sub>n z') \\<longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')))) = {}))) \\<longrightarrow>\n (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). \n      efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<noteq>\n              efids_cur(efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<longrightarrow>\n(inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI z) x)) \n           (actors_graph (InfrastructureThree.graphI z)) \\<longrightarrow> \n     inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI z') x))\n           (actors_graph (InfrastructureThree.graphI z')))))\"\n  by (smt (verit, ccfv_SIG) InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.ran_efidslist_disjoint disjoint_iff inj_on_def)\n\n\nlemma efids_cur_inj_on_inv_refl: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')))) = {}))) \\<Longrightarrow>\n (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). \n      efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a) \\<noteq>\n              efids_cur(efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n(inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI I) x)) \n           (actors_graph (InfrastructureThree.graphI I))) \\<Longrightarrow>\n(inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI y) x)) \n           (actors_graph (InfrastructureThree.graphI y)))\"\nproof (erule rtrancl_induct, simp)\n  show \"\\<And>y z. \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n              \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n                 a \\<noteq> a' \\<longrightarrow>\n                 range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter>\n                 range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')) =\n                 {} \\<Longrightarrow>\n           \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n              InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a) \\<noteq>\n              InfrastructureThree.efids_cur\n               (InfrastructureThree.efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<Longrightarrow>\n           inj_on (\\<lambda>x. InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) x))\n            (InfrastructureThree.actors_graph (InfrastructureThree.graphI I)) \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           inj_on (\\<lambda>x. InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI y) x))\n            (InfrastructureThree.actors_graph (InfrastructureThree.graphI y)) \\<Longrightarrow>\n           inj_on (\\<lambda>x. InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) x))\n            (InfrastructureThree.actors_graph (InfrastructureThree.graphI z)) \"\n    by (smt (verit, del_insts) InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.efids_list_eq InfrastructureThree.ran_efids_list_disjoint_refl InfrastructureThree.same_actors0 Int_iff case_prod_conv empty_iff inj_on_def mem_Collect_eq)\nqed\n\n(* Invariant for refmapTwo_lem -- maybe also useful here ? *)\nlemma refmap_lem_egra_unique_prepO: \"(\\<forall> l \\<in> nodes(InfrastructureThree.graphI z).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI z) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)))\n\\<Longrightarrow> (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l')) \n\\<Longrightarrow> (inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI z) x)) \n           (actors_graph (InfrastructureThree.graphI z)))\n\\<Longrightarrow>  (\\<forall> a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI z). \n     (\\<forall> l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z). \n       (\\<forall> l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z). \n             (a @\\<^bsub>(InfrastructureThree.graphI z)\\<^esub> l) \\<longrightarrow>\n        (InfrastructureOne.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)\n       \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z) l') \n       \\<longrightarrow> l = l' )))\"\n  apply clarify\n  apply (drule_tac x = l' in bspec, assumption)\n  apply (rotate_tac -1)\n  apply (drule_tac x = \"InfrastructureOne.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)\" in bspec, assumption)\n  apply (erule bexE)\n  apply (simp add: atI_def)\n  apply (subgoal_tac \"a = aa\")\n   apply blast\n  apply (erule inj_onD)\n    apply (subgoal_tac \" InfrastructureOne.efids_cur =  InfrastructureThree.efids_cur\")\n     prefer 2\n    apply (simp add: InfrastructureOne.efids_cur_def  InfrastructureThree.efids_cur_def)\n    apply simp\n  apply blast\n  using InfrastructureThree.actors_graph_def by blast\n\n\nlemma refmap_lem_egra_unique_refl[rule_format]: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI I).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI I) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI I) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)))\n\\<Longrightarrow> (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')))) = {}))) \\<Longrightarrow>\n (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). \n      efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a) \\<noteq>\n              efids_cur(efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)))\n\\<Longrightarrow> (inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI I) x)) \n           (actors_graph (InfrastructureThree.graphI I)))\n\\<Longrightarrow>  (\\<forall> a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI y). \n     (\\<forall> l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI y). \n       (\\<forall> l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI y). \n             (a @\\<^bsub>(InfrastructureThree.graphI y)\\<^esub> l) \\<longrightarrow>\n        (InfrastructureOne.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)\n       \\<in> InfrastructureThree.egra (InfrastructureThree.graphI y) l') \n       \\<longrightarrow> l = l' )))\"\n  apply (rule refmap_lem_egra_unique_prepO)\n  apply (simp add: InfrastructureThree.efids_cur_eq_egra_refl)\n  using InfrastructureThree.actor_unique_loc_lem apply presburger\n  by (rule efids_cur_inj_on_inv_refl, assumption+)\n\n\n(* global policy lemmas:\n  (a) The disjointness of kgras can be shown from disjointness of egras and does imply (see CoronaAppTwo)\n   that non idenitifability holds for subsets L \\<subseteq> nodes (graphI I) bigger than 2.\n  (b) If there are always three at each location also singleton intersections cannot become identifiable. *)\n\n(* Disjointness of egras can be derived step by step and then with induction exrapolated to \n   all reachable sets. This is used to show kgra disjointness*)\nlemma no_elem_inter_disjoint: \"~(\\<exists> x. x \\<in> A \\<and> x \\<in> B) \\<Longrightarrow> A \\<inter> B = {}\"\n  by blast\n\n\nlemma all_egra_disjoint[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  \n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')))) = {}))) \\<longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l')) \\<longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI z).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI z) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<longrightarrow>\n  (\\<forall> a \\<in> actors_graph  (graphI z).  \n     (\\<forall> l \\<in> nodes (graphI z). \\<forall> l' \\<in> nodes (graphI z). \n         (l \\<noteq> l' \\<longrightarrow> (egra (graphI z) l) \\<inter> egra(graphI z) l' = {}))) \\<longrightarrow>\n  (\\<forall> a \\<in> actors_graph  (graphI z'). \n     (\\<forall> l \\<in> nodes (graphI z'). \\<forall> l' \\<in> nodes (graphI z'). \n         (l \\<noteq> l' \\<longrightarrow> (egra (graphI z') l) \\<inter> egra(graphI z') l' = {})))\"\nproof (clarify, frule same_actors0, frule same_nodes0, rule state_transition_in.cases, assumption)\n  show \"\\<And>z z' a l l' G I aa la l'a I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n             a \\<noteq> a' \\<longrightarrow>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')) =\n             {} \\<Longrightarrow>\n       \\<forall>a l l'.\n          l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n             \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                l \\<noteq> l' \\<longrightarrow>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l' =\n                {} \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l'a \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       aa \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l'a (Actor aa) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a aa la l'a (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l \\<inter>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l' =\n       {}\"\n    apply (rule no_elem_inter_disjoint)\n    apply (rule notI)\n    apply (erule exE, erule conjE)\n    apply (subgoal_tac \" \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z').\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z') l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z') l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a) \")\n     prefer 2\n     apply (metis InfrastructureThree.efids_cur_eq_egra)\n    apply (subgoal_tac \"\\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z') l.\n                x = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\")\n    apply (subgoal_tac \"\\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z') l'.\n                x = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\")\n    prefer 2\n      apply meson\n    prefer 2\n     apply meson\n    apply (erule bexE)+\n    apply (subgoal_tac \"ab \\<noteq> ac\")\n    prefer 2\n     apply (meson InfrastructureThree.actor_unique_loc_lem00)\n    by (metis (no_types, lifting) InfrastructureThree.actors_graph_def InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.efids_list_eq InfrastructureThree.ran_efids_list_disjoint_refl Int_iff empty_iff mem_Collect_eq rtrancl.simps)\nnext show \"\\<And>z z' a l l' G I aa la I'.\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n             a \\<noteq> a' \\<longrightarrow>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')) =\n             {} \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n             \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                l \\<noteq> l' \\<longrightarrow>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l' =\n                {} \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor aa) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n          (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n          ((InfrastructureThree.kgra G)\n           (aa := (InfrastructureThree.kgra G aa)\n              (la := {(x, y). x \\<in> InfrastructureThree.agra G la \\<and> y \\<in> InfrastructureThree.egra G la}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l \\<inter>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l' =\n       {}\"\n    by (smt (z3) Collect_cong InfrastructureThree.actors_graph_def InfrastructureThree.agra.simps InfrastructureThree.egra.simps InfrastructureThree.graphI.simps)\nnext show \"\\<And>z z' a l l' G I aa la I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n             a \\<noteq> a' \\<longrightarrow>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')) =\n             {} \\<Longrightarrow>\n       \\<forall>a l l'.\n          l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n             \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                l \\<noteq> l' \\<longrightarrow>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l' =\n                {} \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor aa) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid aa la (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l \\<inter>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l' =\n       {}\"\n    apply (rule no_elem_inter_disjoint)\n    apply (rule notI)\n    apply (erule exE, erule conjE)\n    apply (subgoal_tac \" \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z').\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z') l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z') l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a) \")\n     prefer 2\n     apply (metis InfrastructureThree.efids_cur_eq_egra)\n    apply (subgoal_tac \"\\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z') l.\n                x = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\")\n    apply (subgoal_tac \"\\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z') l'.\n                x = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\")\n    prefer 2\n      apply meson\n    prefer 2\n     apply meson\n    apply (erule bexE)+\n    apply (subgoal_tac \"ab \\<noteq> ac\")\n    prefer 2\n     apply (meson InfrastructureThree.actor_unique_loc_lem00)\n    by (metis (no_types, lifting) InfrastructureThree.actors_graph_def InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.efids_list_eq InfrastructureThree.ran_efids_list_disjoint_refl Int_iff empty_iff mem_Collect_eq rtrancl.simps)\nqed\n\nlemma all_egra_disjoint_refl: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')))) = {}))) \\<Longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI I).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI I) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI I) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n  (\\<forall> a \\<in> actors_graph  (graphI I).  \n     (\\<forall> l \\<in> nodes (graphI I). \\<forall> l' \\<in> nodes (graphI I). \n         (l \\<noteq> l' \\<longrightarrow> (egra (graphI I) l) \\<inter> egra(graphI I) l' = {}))) \\<longrightarrow>\n  (\\<forall> a \\<in> actors_graph  (graphI y). \n     (\\<forall> l \\<in> nodes (graphI y). \\<forall> l' \\<in> nodes (graphI y). \n         (l \\<noteq> l' \\<longrightarrow> (egra (graphI y) l) \\<inter> egra(graphI y) l' = {})))\"\nproof (erule rtrancl_induct, simp)\n  show \"\\<And>y z. \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n              \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n                 a \\<noteq> a' \\<longrightarrow>\n                 range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter>\n                 range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')) =\n                 {} \\<Longrightarrow>\n           \\<forall>a l l'.\n              l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI I) \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n           \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n              \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI I) l.\n                 \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI I) l.\n                    e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a) \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           (\\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n               \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n                  \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n                     l \\<noteq> l' \\<longrightarrow>\n                     InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<inter>\n                     InfrastructureThree.egra (InfrastructureThree.graphI I) l' =\n                     {}) \\<longrightarrow>\n           (\\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI y).\n               \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI y).\n                  \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI y).\n                     l \\<noteq> l' \\<longrightarrow>\n                     InfrastructureThree.egra (InfrastructureThree.graphI y) l \\<inter>\n                     InfrastructureThree.egra (InfrastructureThree.graphI y) l' =\n                     {}) \\<Longrightarrow>\n           (\\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n               \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n                  \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n                     l \\<noteq> l' \\<longrightarrow>\n                     InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<inter>\n                     InfrastructureThree.egra (InfrastructureThree.graphI I) l' =\n                     {}) \\<longrightarrow>\n           (\\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n               \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                  \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                     l \\<noteq> l' \\<longrightarrow>\n                     InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n                     InfrastructureThree.egra (InfrastructureThree.graphI z) l' =\n                     {})\"\n    thm all_egra_disjoint\n    apply clarify\n    apply (rule all_egra_disjoint, assumption)\n    apply (metis InfrastructureThree.ran_efids_list_disjoint_refl)\n    using InfrastructureThree.actor_unique_loc_lem apply presburger\n    apply (simp add: InfrastructureThree.efids_cur_eq_egra_refl)\n        apply meson\n   by assumption+\nqed\n\n(* For the proof of kgra intersections are empty, we prove the  \n   Lemma_star_star that generalizes all_egra_disjoint(_refl) to different z and z' with\n   z \\<rightarrow>* z' where I \\<rightarrow>* z.\n   To that end we can use the Lemma_star:\n   forall y. I \\<rightarrow>* y \\<longrightarrow> \\forall a \\in actors_graph I.\n    efids_cur(efids_inc_ind (egra y a)) \\<notin>\n   Union {egra z l |z l. I \\<rightarrow>* z \\<and> z \\<rightarrow>* y \\<and> l \\<in> nodes z}\n    *)\n(*use efids_list_inj_imp_inc_ind_not_eq, efids_cur_in_efids_list ... *)\nlemma lemma_starOOO:\n\"(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')))) = {}))) \\<Longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI z).\n \\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI z) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)))  \\<Longrightarrow>\n inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<Longrightarrow>\nl \\<in> nodes (graphI z) \\<Longrightarrow> \na \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<Longrightarrow>\nInfrastructureThree.efids_cur\n        (InfrastructureThree.efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))\n       \\<notin> InfrastructureThree.egra (InfrastructureThree.graphI z) l\"\n  by (metis (mono_tags, lifting) InfrastructureThree.actors_graph_def InfrastructureThree.efids_cur_in_efids_list InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.efids_list_inj_imp_inc_ind_not_eq Int_iff empty_iff mem_Collect_eq)\n\nlemma lemma_starOOO':\n\"(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')))) = {}))) \\<Longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI z).\n \\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI z) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)))  \\<Longrightarrow>\n inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<Longrightarrow>\nl \\<in> nodes (graphI z) \\<Longrightarrow> \na \\<in>  actors_graph (InfrastructureThree.graphI z) \\<Longrightarrow>\nInfrastructureThree.efids_cur\n        (InfrastructureThree.efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))\n       \\<notin> InfrastructureThree.egra (InfrastructureThree.graphI z) l\"\n  by (metis (mono_tags, lifting) InfrastructureThree.actors_graph_def InfrastructureThree.efids_cur_in_efids_list InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.efids_list_inj_imp_inc_ind_not_eq Int_iff empty_iff mem_Collect_eq)\n\n\nlemma lemma_star_starO[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow> \n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')))) = {}))) \\<longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l')) \\<longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI z).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI z) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<longrightarrow>\n  (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). \n     inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<longrightarrow>\n  (\\<forall> a \\<in> actors_graph  (graphI z).  \n     (\\<forall> l \\<in> nodes (graphI z). \\<forall> l' \\<in> nodes (graphI z). \n         (l \\<noteq> l' \\<longrightarrow> (egra (graphI z) l) \\<inter> egra(graphI z) l' = {}))) \\<longrightarrow>\n (\\<forall> a \\<in> actors_graph  (graphI z).  \n     (\\<forall> l \\<in> nodes (graphI z). \\<forall> l' \\<in> nodes (graphI z). \n         (l \\<noteq> l' \\<longrightarrow> (egra (graphI z) l) \\<inter> egra(graphI z') l' = {})))\"\nproof (clarify, frule same_actors0, frule same_nodes0, rule state_transition_in.cases, assumption)\n  show \"\\<And>z z' a l l' G I aa la l'a I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n             a \\<noteq> a' \\<longrightarrow>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')) =\n             {} \\<Longrightarrow>\n       \\<forall>a l l'.\n          l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          inj (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n             \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                l \\<noteq> l' \\<longrightarrow>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l' =\n                {} \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l'a \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       aa \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l'a (Actor aa) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a aa la l'a (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l' =\n       {}\"\n    apply (subgoal_tac \"       InfrastructureThree.efids_cur\n        (InfrastructureThree.efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI I) aa))\n       \\<notin> InfrastructureThree.egra (InfrastructureThree.graphI I) l\")\n    prefer 2\n       apply (rule lemma_starOOO', simp, simp, simp, simp, simp)\n\n    apply (simp add: actors_graph_def atI_def efids_list_eq efids_cur_in_efids_listO move_graph_a_def)\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (rule conjI)\n     apply (rule impI)+\n    apply force\n    apply meson\n    apply (metis (no_types, lifting) Diff_empty Diff_insert0 disjoint_insert(2) insert_Diff)\n     apply (rule impI)+\n    apply (rule conjI)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply meson\n    apply meson\n      apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply meson\n    by meson\nnext show \"\\<And>z z' a l l' G I aa la I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n             a \\<noteq> a' \\<longrightarrow>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')) =\n             {} \\<Longrightarrow>\n       \\<forall>a l l'.\n          l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n             \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                l \\<noteq> l' \\<longrightarrow>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l' =\n                {} \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor aa) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n          (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n          ((InfrastructureThree.kgra G)\n           (aa := (InfrastructureThree.kgra G aa)\n              (la := {(x, y). x \\<in> InfrastructureThree.agra G la \\<and> y \\<in> InfrastructureThree.egra G la}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l' =\n       {}\"\n    by (metis InfrastructureThree.egra.simps InfrastructureThree.graphI.simps)\nnext show \"\\<And>z z' a l l' G I aa la I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n             a \\<noteq> a' \\<longrightarrow>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')) =\n             {} \\<Longrightarrow>\n       \\<forall>a l l'.\n          l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n             \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                l \\<noteq> l' \\<longrightarrow>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l' =\n                {} \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor aa) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid aa la (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l' =\n       {}\"\n    by (smt (z3) DiffD1 InfrastructureThree.actors_graph_def InfrastructureThree.atI_def InfrastructureThree.cgra.simps InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.efids_list_eq InfrastructureThree.egra.simps InfrastructureThree.graphI.simps InfrastructureThree.put_graph_efid_def disjoint_iff fun_upd_def insert_iff mem_Collect_eq)\nqed\n\nlemma lemma_star_starO'[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow> \n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z). a \\<noteq> a' \\<longrightarrow> \n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')))) = {}))) \\<longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l')) \\<longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI z).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI z) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<longrightarrow>\n  (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). \n     inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<longrightarrow>\n  (\\<forall> a \\<in> actors_graph  (graphI z).  \n     (\\<forall> l \\<in> nodes (graphI z). \\<forall> l' \\<in> nodes (graphI z). \n         (l \\<noteq> l' \\<longrightarrow> (egra (graphI z) l) \\<inter> egra(graphI z) l' = {}))) \\<longrightarrow>\n (\\<forall> a \\<in> actors_graph  (graphI z).  \n     (\\<forall> l \\<in> nodes (graphI z). \\<forall> l' \\<in> nodes (graphI z'). \n         (l \\<noteq> l' \\<longrightarrow> (egra (graphI z) l) \\<inter> egra(graphI z') l' = {})))\"\nproof (clarify, frule same_actors0, frule same_nodes0, rule state_transition_in.cases, assumption)\n  show \" \\<And>z z' a l l' G I aa la l'a I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n             a \\<noteq> a' \\<longrightarrow>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')) =\n             {} \\<Longrightarrow>\n       \\<forall>a l l'.\n          l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          inj (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n             \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                l \\<noteq> l' \\<longrightarrow>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l' =\n                {} \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l'a \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       aa \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l'a (Actor aa) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a aa la l'a (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l' =\n       {}\"\n    apply (subgoal_tac \"       InfrastructureThree.efids_cur\n        (InfrastructureThree.efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI I) aa))\n       \\<notin> InfrastructureThree.egra (InfrastructureThree.graphI I) l\")\n    prefer 2\n       apply (rule lemma_starOOO', simp, simp, simp, simp, simp)\n\n    apply (simp add: actors_graph_def atI_def efids_list_eq efids_cur_in_efids_listO move_graph_a_def)\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (rule conjI)\n     apply (rule impI)+\n    apply (rule conjI)\n     apply (rule impI)+\n    apply force\n    apply meson\n    apply (metis (no_types, lifting) Diff_empty Diff_insert0 disjoint_insert(2) insert_Diff)\n     apply (rule impI)+\n    apply (rule conjI)\n     apply (rule impI)+\n     apply (rule conjI)\n      apply (rule impI)+\n    apply meson\n    apply meson\n      apply (rule impI)+\n     apply (rule conjI)\n     apply (rule impI)+\n    apply meson\n    by meson\nnext show \"\\<And>z z' a l l' G I aa la I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n             a \\<noteq> a' \\<longrightarrow>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')) =\n             {} \\<Longrightarrow>\n       \\<forall>a l l'.\n          l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          inj (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n             \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                l \\<noteq> l' \\<longrightarrow>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l' =\n                {} \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       la \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor aa) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n          (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n          ((InfrastructureThree.kgra G)\n           (aa := (InfrastructureThree.kgra G aa)\n              (la := {(x, y). x \\<in> InfrastructureThree.agra G la \\<and> y \\<in> InfrastructureThree.egra G la}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l' =\n       {}\"\n    by (metis InfrastructureThree.egra.simps InfrastructureThree.graphI.simps)\nnext show \"\\<And>z z' a l l' G I aa la I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n             a \\<noteq> a' \\<longrightarrow>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter>\n             range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a')) =\n             {} \\<Longrightarrow>\n       \\<forall>a l l'.\n          l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z) l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z) l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          inj (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<Longrightarrow>\n       \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI z).\n          \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n             \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n                l \\<noteq> l' \\<longrightarrow>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n                InfrastructureThree.egra (InfrastructureThree.graphI z) l' =\n                {} \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       l \\<noteq> l' \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z') \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z') \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> la \\<Longrightarrow>\n       InfrastructureThree.enables I la (Actor aa) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid aa la (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<inter>\n       InfrastructureThree.egra (InfrastructureThree.graphI z') l' =\n       {}\"\n    by (smt (z3) DiffD1 InfrastructureThree.actors_graph_def InfrastructureThree.atI_def InfrastructureThree.cgra.simps InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.efids_list_eq InfrastructureThree.egra.simps InfrastructureThree.graphI.simps InfrastructureThree.put_graph_efid_def disjoint_iff fun_upd_def insert_iff mem_Collect_eq)\nqed\n\nlemma efids_index_efids_cur: \"efids_list(cgra (graphI I) a)(efids_index (cgra (graphI I) a)) = \n                              efids_cur (cgra (graphI I) a)\"\n  by (metis InfrastructureThree.efids_cur.simps InfrastructureThree.efids_index.simps InfrastructureThree.efids_list.simps efidlist.exhaust)\n\nlemma efids_inc_ind_Suc: \"efids_index(efids_inc_ind(cgra (graphI I) a)) = Suc (efids_index(cgra(graphI I) a))\"\n  by (metis InfrastructureThree.efids_inc_ind.simps InfrastructureThree.efids_index.simps efidlist.exhaust)\n\n\nlemma efids_index_leqOO: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow> \n                    efids_index(cgra (graphI z) a) \\<le> efids_index(cgra (graphI z') a)\"\nproof (clarify, rule state_transition_in.cases, assumption)\n  show \"\\<And>z z' G I aa l l' I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       aa \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l' (Actor aa) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a aa l l' (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.efids_index (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)\n       \\<le> InfrastructureThree.efids_index (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\"\n    by (simp add: InfrastructureThree.move_graph_a_def efids_inc_ind_Suc)\nnext show \"\\<And>z z' G I aa l I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       InfrastructureThree.enables I l (Actor aa) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n          (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n          ((InfrastructureThree.kgra G)\n           (aa := (InfrastructureThree.kgra G aa)\n              (l := {(x, y). x \\<in> InfrastructureThree.agra G l \\<and> y \\<in> InfrastructureThree.egra G l}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.efids_index (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)\n       \\<le> InfrastructureThree.efids_index (InfrastructureThree.cgra (InfrastructureThree.graphI z') a)\"\n    by force\nnext show \"\\<And>z z' G I aa l I'.\n       z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n       z = I \\<Longrightarrow>\n       z' = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       aa @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureThree.enables I l (Actor aa) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid aa l (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       InfrastructureThree.efids_index (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)\n       \\<le> InfrastructureThree.efids_index (InfrastructureThree.cgra (InfrastructureThree.graphI z') a) \"\n    by (simp add: InfrastructureThree.put_graph_efid_def efids_inc_ind_Suc)\nqed\n\n\n\nlemma efids_index_leqO: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n                    efids_index(cgra (graphI I) a) \\<le> efids_index(cgra (graphI y) a)\"\nproof (erule rtrancl_induct, simp)\n  show \"\\<And>y z. (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           InfrastructureThree.efids_index (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)\n           \\<le> InfrastructureThree.efids_index (InfrastructureThree.cgra (InfrastructureThree.graphI y) a) \\<Longrightarrow>\n           InfrastructureThree.efids_index (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)\n           \\<le> InfrastructureThree.efids_index (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)\"\n    by (metis CollectD case_prodD efids_index_leqOO order_trans)\nqed\n\nlemma efids_index_leq: \"\\<forall> z'. (InfrastructureThree.state_transition_in_refl I z') \\<longrightarrow> \n                       (InfrastructureThree.state_transition_in_refl z' y) \\<longrightarrow> \n                        efids_index(cgra (graphI z') a) \\<le> efids_index(cgra (graphI y) a)\"\n  using InfrastructureThree.state_transition_in_refl_def efids_index_leqO by auto\n\nlemma lemmaD: \n  assumes a0:\"InfrastructureThree.state_transition_in_refl I y\"\n  and a0a : \" a \\<in> actors_graph (InfrastructureThree.graphI I)\"\n  and    a1: \"(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). \n               inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)))\"\n  and a1a: \"(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l'))\"\n  and a1b: \"(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow>\n            ((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n            (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')))) = {})))\"\n  and a2: \" (\\<forall> l \\<in> nodes(InfrastructureThree.graphI I).\n             \\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI I) l).\n             (\\<exists> a \\<in> agra (InfrastructureThree.graphI I) l. \n                  e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)))\"\n  shows \"efids_cur(efids_inc_ind(cgra (graphI y) a)) \\<notin> \n                  {x. (\\<exists> z l. x \\<in> egra (graphI z) l \\<and> (InfrastructureThree.state_transition_in_refl I z) \\<and> \n                       (InfrastructureThree.state_transition_in_refl z y) \\<and> l \\<in> nodes (graphI I))}\"\n  using assms\nproof -\n  have \"\\<forall> x \\<in> {x. (\\<exists> z l. x \\<in> egra (graphI z) l \\<and> (InfrastructureThree.state_transition_in_refl I z) \\<and> \n                       (InfrastructureThree.state_transition_in_refl z y) \\<and> l \\<in> nodes (graphI I))}.\n          x \\<noteq> efids_cur(efids_inc_ind(cgra (graphI y) a))\" \n    apply (rule ballI)\n    apply simp\n    apply (erule exE)+\n    apply (erule conjE)+\n    apply (subgoal_tac \"(\\<forall> l \\<in> nodes(InfrastructureThree.graphI z).\n             \\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z) l).\n             (\\<exists> a \\<in> agra (InfrastructureThree.graphI z) l. \n                  e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)))\")\n    apply (subgoal_tac \"(\\<exists> a' \\<in> agra (InfrastructureThree.graphI z) l. \n     x = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a'))\")\n     prefer 2\n    using InfrastructureThree.same_nodes InfrastructureThree.state_transition_in_refl_def apply blast\n     prefer 2\n    apply (simp add: InfrastructureThree.efids_cur_eq_egra_refl InfrastructureThree.state_transition_in_refl_def a1a a2)\n    apply (erule bexE)\n    apply (case_tac \"a = a'\")\n     prefer 2\n(* a \\<noteq> a'*)\n    apply (subgoal_tac \"InfrastructureThree.efids_cur\n        (InfrastructureThree.efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)) \n        \\<in> range(efids_list (cgra (graphI y) a))\")\n      apply (subgoal_tac \"x \\<in> (range(efids_list (cgra (graphI z) a')))\")\n       apply (subgoal_tac \"efids_list (cgra (graphI y) a') = efids_list (cgra (graphI z) a')\")\n        apply (subgoal_tac \"(\n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a')))) = {}))\")\n         apply (metis disjoint_insert(2) insert_Diff)\n        apply (subgoal_tac \"(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI y). \n      (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI y). a \\<noteq> a' \\<longrightarrow>\n((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)) \\<inter> \n (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI y) a')))) = {})))\")\n    apply (metis (mono_tags, lifting) InfrastructureThree.actors_graph_def InfrastructureThree.same_actors InfrastructureThree.same_nodes InfrastructureThree.state_transition_in_refl_def a0a mem_Collect_eq)\n    apply (simp add: InfrastructureThree.ran_efids_list_disjoint_refl InfrastructureThree.state_transition_in_refl_def a1b)\n    thm efids_list_eq_refl\n    apply (metis InfrastructureThree.state_transition_in_refl_def efids_list_eq_refl)\n    using InfrastructureThree.actors_graph_def InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.same_nodes InfrastructureThree.state_transition_in_refl_def apply blast\n    apply (metis InfrastructureThree.efids_cur_in_efids_list InfrastructureThree.same_actors InfrastructureThree.state_transition_in_refl_def a0a)\n(* a = a'*)\n    apply (subgoal_tac \"\\<forall> z'. (InfrastructureThree.state_transition_in_refl I z') \\<longrightarrow> \n                       (InfrastructureThree.state_transition_in_refl z' y) \\<longrightarrow> \n                        efids_index(cgra (graphI z') a) \\<le> efids_index(cgra (graphI y) a)\")\n     prefer 2\n    using efids_index_leq apply presburger\n    apply (subgoal_tac \"\\<forall> z'. (InfrastructureThree.state_transition_in_refl I z') \\<longrightarrow> \n                       (InfrastructureThree.state_transition_in_refl z' y) \\<longrightarrow> \n                   efids_index(efids_inc_ind(cgra (graphI y) a)) \\<noteq> efids_index(cgra (graphI z') a)\")\n    prefer 2\n     apply (metis Suc_n_not_le_n efids_inc_ind_Suc)\n    apply (subgoal_tac \"\\<forall> z'. (InfrastructureThree.state_transition_in_refl I z') \\<longrightarrow> \n                       (InfrastructureThree.state_transition_in_refl z' y) \\<longrightarrow> \n                   efids_list(cgra (graphI y) a)(efids_index(efids_inc_ind(cgra (graphI y) a)))\n                 \\<noteq> efids_list(cgra (graphI y) a)(efids_index(cgra (graphI z') a))\")\n    prefer 2\n    apply (metis InfrastructureThree.state_transition_in_refl_def a0a a1 efids_list_eq_refl the_inv_f_f)\n    by (metis InfrastructureThree.efids_cur.simps InfrastructureThree.efids_inc_ind.simps InfrastructureThree.efids_index.simps InfrastructureThree.efids_list.simps InfrastructureThree.state_transition_in_refl_def efidlist.exhaust efids_list_eq_refl)\n  from this show ?thesis by force\nqed\n\nlemma lemmaDO:  \n \"InfrastructureThree.state_transition_in_refl I y \\<Longrightarrow>\n  a \\<in> actors_graph (InfrastructureThree.graphI I) \\<Longrightarrow>\n  (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). \n               inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n  (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n  (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow>\n            ((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n            (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')))) = {}))) \\<Longrightarrow>\n  (\\<forall> l \\<in> nodes(InfrastructureThree.graphI I).\n             \\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI I) l).\n             (\\<exists> a \\<in> agra (InfrastructureThree.graphI I) l. \n                  e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n  efids_cur(efids_inc_ind(cgra (graphI y) a)) \\<notin> \n{x. \\<exists>z l. x \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z) l \\<and>\n                      I \\<rightarrow>\\<^sub>n* z \\<and> z \\<rightarrow>\\<^sub>n* y \\<and> l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI I)}\"\n  using lemmaD by presburger\n\n (*  *)\nlemma lemmaBO: \"y \\<rightarrow>\\<^sub>n z \\<Longrightarrow>  l' \\<in> nodes(graphI z) \\<Longrightarrow> \n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI z').\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI z') l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI z') l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a))) \\<Longrightarrow>\nx \\<in> egra (graphI z) l' \\<Longrightarrow>\n       x \\<notin> egra (graphI y) l' \\<Longrightarrow>\n   \\<exists> a \\<in> actors_graph (graphI y). x = efids_cur(efids_inc_ind(cgra (graphI y) a))\"\nproof (frule same_actors0, frule same_nodes0,rule state_transition_in.cases, assumption)\n  show \"\\<And>G I a l l'a I'.\n       y \\<rightarrow>\\<^sub>n z \\<Longrightarrow>\n       x \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z) l' \\<Longrightarrow>\n       x \\<notin> InfrastructureThree.egra (InfrastructureThree.graphI y) l' \\<Longrightarrow>\n       y = I \\<Longrightarrow>\n       z = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       l'a \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       a \\<in> InfrastructureThree.actors_graph G \\<Longrightarrow>\n       InfrastructureThree.enables I l'a (Actor a) move \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.move_graph_a a l l'a (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI y).\n          x =\n          InfrastructureThree.efids_cur\n           (InfrastructureThree.efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI y) a))\"\n    by (smt (verit, ccfv_threshold) DiffD1 InfrastructureThree.egra.simps InfrastructureThree.graphI.simps InfrastructureThree.move_graph_a_def fun_upd_other fun_upd_same insertE)\nnext show \"\\<And>G I a l I'.\n       y \\<rightarrow>\\<^sub>n z \\<Longrightarrow>\n       x \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z) l' \\<Longrightarrow>\n       x \\<notin> InfrastructureThree.egra (InfrastructureThree.graphI y) l' \\<Longrightarrow>\n       y = I \\<Longrightarrow>\n       z = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       l \\<in> InfrastructureThree.nodes G \\<Longrightarrow>\n       InfrastructureThree.enables I l (Actor a) get \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.igraph.Lgraph (InfrastructureThree.gra G) (InfrastructureThree.agra G)\n          (InfrastructureThree.cgra G) (InfrastructureThree.lgra G) (InfrastructureThree.egra G)\n          ((InfrastructureThree.kgra G)\n           (a := (InfrastructureThree.kgra G a)\n              (l := {(x, y). x \\<in> InfrastructureThree.agra G l \\<and> y \\<in> InfrastructureThree.egra G l}))))\n        (InfrastructureThree.delta I) \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI y).\n          x =\n          InfrastructureThree.efids_cur\n           (InfrastructureThree.efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI y) a))\"\n    by simp\nnext show \"\\<And>G I a l I'.\n       y \\<rightarrow>\\<^sub>n z \\<Longrightarrow>\n       l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z').\n          \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI z') l.\n             \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI z') l.\n                e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z') a) \\<Longrightarrow>\n       x \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z) l' \\<Longrightarrow>\n       x \\<notin> InfrastructureThree.egra (InfrastructureThree.graphI y) l' \\<Longrightarrow>\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI y) =\n       InfrastructureThree.actors_graph (InfrastructureThree.graphI z) \\<Longrightarrow>\n       InfrastructureThree.nodes (InfrastructureThree.graphI y) =\n       InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<Longrightarrow>\n       y = I \\<Longrightarrow>\n       z = I' \\<Longrightarrow>\n       G = InfrastructureThree.graphI I \\<Longrightarrow>\n       a @\\<^bsub>G\\<^esub> l \\<Longrightarrow>\n       InfrastructureThree.enables I l (Actor a) put \\<Longrightarrow>\n       I' =\n       InfrastructureThree.infrastructure.Infrastructure\n        (InfrastructureThree.put_graph_efid a l (InfrastructureThree.graphI I)) (InfrastructureThree.delta I) \\<Longrightarrow>\n       \\<exists>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI y).\n          x =\n          InfrastructureThree.efids_cur\n           (InfrastructureThree.efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI y) a))\"\n    by (smt (verit, best) DiffD1 InfrastructureThree.actors_graph_def InfrastructureThree.atI_def InfrastructureThree.egra.simps InfrastructureThree.graphI.simps InfrastructureThree.put_graph_efid_def fun_upd_other fun_upd_same insertE mem_Collect_eq)\nqed\n\nlemma lemmaB[rule_format]:  \n  \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n  a \\<in> actors_graph (InfrastructureThree.graphI I) \\<Longrightarrow>\n  (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). \n               inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n  (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n  (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow>\n            ((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n            (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')))) = {}))) \\<Longrightarrow>\n  (\\<forall> l \\<in> nodes(InfrastructureThree.graphI I).\n             \\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI I) l).\n             (\\<exists> a \\<in> agra (InfrastructureThree.graphI I) l. \n                  e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n  \\<forall> l \\<in> nodes(graphI I). \\<forall> l' \\<in> nodes(graphI I).\n              x \\<in> egra(graphI I) l \\<longrightarrow> x \\<in> egra(graphI y) l' \\<longrightarrow> l = l'\"\nproof (erule rtrancl_induct, simp)\n  show \"a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI I) \\<Longrightarrow>\n    \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n       inj (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<Longrightarrow>\n    \\<forall>a l. l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI I) \\<longrightarrow>\n          a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>\n          (\\<forall>l'. a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l') \\<Longrightarrow>\n    \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n       \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n          a \\<noteq> a' \\<longrightarrow>\n          range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter>\n          range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')) =\n          {} \\<Longrightarrow>\n    \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n       \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI I) l.\n          \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI I) l.\n             e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a) \\<Longrightarrow>\n    \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n       x \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<longrightarrow>\n       (\\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n           x \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l')\"\n    by (metis (no_types, lifting) InfrastructureThree.actors_graph_def InfrastructureThree.efids_cur_in_efids_listO disjoint_insert(2) insert_Diff mem_Collect_eq)\nnext show\n  \"\\<And>y z. a \\<in> InfrastructureThree.actors_graph (InfrastructureThree.graphI I) \\<Longrightarrow>\n           \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n              inj (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<Longrightarrow>\n           \\<forall>a l l'.\n              l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI I) \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n           \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n              \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n                 a \\<noteq> a' \\<longrightarrow>\n                 range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter>\n                 range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')) =\n                 {} \\<Longrightarrow>\n           \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n              \\<forall>e\\<in>InfrastructureThree.egra (InfrastructureThree.graphI I) l.\n                 \\<exists>a\\<in>InfrastructureThree.agra (InfrastructureThree.graphI I) l.\n                    e = InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a) \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n              \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n                 x \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<longrightarrow>\n                 x \\<in> InfrastructureThree.egra (InfrastructureThree.graphI y) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n           \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n              \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n                 x \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<longrightarrow>\n                 x \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z) l' \\<longrightarrow> l = l' \"\n    apply (rule ballI)+\n    apply (rule impI)+\n    apply (case_tac \"x \\<in> egra (graphI y) l'\")\n(* case x \\<in> egra (graphI y) l' *)\n    apply blast\n(* case x \\<notin> egra (graphI y) l' *)\n    thm lemmaBO\n    apply (subgoal_tac \"\\<exists>a \\<in> actors_graph(graphI y). x =\n    InfrastructureThree.efids_cur\n     (InfrastructureThree.efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI y) a))\")\n    prefer 2\n    apply (smt (verit, ccfv_threshold) CollectD InfrastructureThree.same_nodes case_prodD lemmaBO rtrancl.rtrancl_into_rtrancl)\n    apply (erule bexE)\n    apply (subgoal_tac \"x \\<notin> \n                  {x. (\\<exists> q l. x \\<in> egra (graphI q) l \\<and> (InfrastructureThree.state_transition_in_refl I q) \\<and> \n                       (InfrastructureThree.state_transition_in_refl q y) \\<and> l \\<in> nodes (graphI I))}\")\n     prefer 2\n     apply (rotate_tac -1)\n     apply (erule ssubst)\n    thm InfrastructureThree.state_transition_in_refl_def\n     apply (rule lemmaDO)\n    using InfrastructureThree.state_transition_in_refl_def apply presburger\n    using InfrastructureThree.same_actors apply presburger\n        apply assumption\n       apply assumption\n      apply assumption\n     apply assumption\n    using InfrastructureThree.state_transition_in_refl_def by auto\nqed\n\n(* If two properties hold in a reachable state y, they have been \"collected\"  \n   on previous states z z' which lie on _one_ path to y *)\n(* This lemma is trivial: that is not what we want!\nlemma lemmaAO: \"(I, y) \\<in> {(x::InfrastructureThree.infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n                 P y \\<and> Q y \\<Longrightarrow>\n                (\\<exists> z z'. (I \\<rightarrow>\\<^sub>n* z) \\<and> (I \\<rightarrow>\\<^sub>n* z') \\<and> ((z \\<rightarrow>\\<^sub>n* z') \\<or> (z' \\<rightarrow>\\<^sub>n* z))\n                       \\<and> (z \\<rightarrow>\\<^sub>n* y) \\<and> (z' \\<rightarrow>\\<^sub>n* y) \\<and> P z \\<and> Q z' )\"\n  using InfrastructureThree.state_transition_in_refl_def by blast\n*)\n\ninductive path :: \"[infrastructure, infrastructure, infrastructure list] \\<Rightarrow> bool\"\n  where\n  empty: \"path I I [I]\"\n| step: \"path z y p \\<Longrightarrow>  I \\<rightarrow>\\<^sub>n z \\<Longrightarrow> path I y (I # p)\"\n\n\nlemma fst_in_path: \"path I y p \\<Longrightarrow> I \\<noteq> y \\<Longrightarrow> I \\<in> set p\"\n  by (metis list.set_intros(1) path.cases)\n\nlemma fst_in_pathO: \"path I y p \\<Longrightarrow> I \\<noteq> y \\<Longrightarrow> I = hd p\"\n  by (metis list.sel(1) path.cases)\n\nlemma fst_in_pathOO: \"path I y p \\<Longrightarrow> I \\<in> set p\"\n  by (metis list.set_intros(1) path.cases)\n\n\n(* lemma path_singleton: \"path I y [a] \\<Longrightarrow> I = y\" \nletzte Element nicht im Pfad! *)\n\n\nlemma lst_in_path: \"\\<forall> I y. path I y p \\<longrightarrow> I \\<noteq> y \\<longrightarrow> y \\<in> set p\"\n  apply (rule list.induct)\n   apply (metis empty_iff empty_set fst_in_path)\n  by (metis list.inject list.set_intros(1) list.set_intros(2) path.cases)\n\nlemma lst_in_pathOO: \"path I y p \\<Longrightarrow> y \\<in> set p\"\n  using fst_in_pathOO lst_in_path by blast\n\n\n\nprimrec before :: \"['a, 'a, 'a list] \\<Rightarrow> bool\"\n  where\nbefore_empty: \"before x y [] = False\" |\nbefore_step: \"before x y (z # p) = (if x = y \\<or> y = z then False\n                                   else (if x = z then y \\<in> set p else before x y p))\"\n\nlemma before_eq: \"before x x (x # l) = False\"\n  by simp\n\nlemma before_neq : \"x \\<noteq> y \\<Longrightarrow> before x y (x # l) = (y \\<in> set l)\"\n  by simp\n\nlemma list_split: \"x \\<in> set l \\<Longrightarrow> \\<exists> lO lI. x \\<notin> set lO \\<and> hd(lI) = x \\<and> lO @ lI = l\"\n  using split_list_first by force\n\nlemma before_test: \"before (1:: nat) (2:: nat) [1,2] = (2 \\<in> set([2]))\"\n  by simp\n\nlemma before_snd_not[rule_format]: \"x \\<noteq> y \\<longrightarrow>  x \\<notin> set ys \\<longrightarrow> before x y (ys @ x # zs) \\<longrightarrow> y \\<notin> set ys\"\n  apply (rule_tac list = ys in list.induct)\n  apply fastforce\n  by simp\n\nlemma before_neg[rule_format]: \"z \\<noteq> z' \\<longrightarrow> z \\<in> set p \\<longrightarrow> z' \\<in> set p \\<longrightarrow> \\<not> before z z' p \\<longrightarrow> before z' z p\"\n  apply (rule_tac list = p in list.induct)\n  apply force\n  by simp\n\n\nlemma split_list_first_before: \"x \\<in> set xs \\<Longrightarrow> y \\<in> set xs \\<Longrightarrow> before x y xs \\<Longrightarrow>\n                        \\<exists> ys zs. xs = ys @ x # zs \\<and> x \\<notin> set ys \\<and> y \\<notin> set ys \\<and> y \\<in> set zs\"\n  apply (frule split_list_first)\n  by (metis Un_iff before_snd_not before_step insert_iff list.set_cases list.simps(15) set_append)\n\nlemma list_split_split: \"x \\<in> set xs \\<Longrightarrow> y \\<in> set xs \\<Longrightarrow> before x y xs \\<Longrightarrow> \n                        \\<exists> ys zs zs'. xs = ys @ (x # (zs @ (y # zs')))\"\n  apply (frule split_list_first_before)\n  prefer 2\n  apply assumption+\n  apply (erule exE)+\n  apply (erule conjE)+\n  apply (erule ssubst)\n  apply (rule_tac x = ys in exI)\n  apply simp\n  by (simp add: split_list)\n\nlemma path_imp_rtrancl: \"path I y p \\<Longrightarrow> (I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n  apply (erule path.induct,simp)\n  by (simp add: converse_rtrancl_into_rtrancl)\n\nlemma rtrancl_imp_ex_path: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n                           \\<exists> p. path I y p\"\nproof (erule converse_rtrancl_induct)\n  show \" \\<exists>p. path y y p\"\n    apply (rule_tac x = \"[y]\" in exI)\n    by (rule path.empty)\nnext show \"\\<And>ya z. (ya, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow> (z, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow> \\<exists>p. path z y p \\<Longrightarrow> \\<exists>p. path ya y p \"\n   by (metis CollectD case_prodD path.step) \nqed\n\nlemma rtrancl_imp_ex_pathO: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow> I \\<noteq> y \\<Longrightarrow>\n                           \\<exists> p. path I y p \\<and> 2 \\<le> length p\"\n  by (metis list.distinct(1) list.sel(3) path.cases rtrancl_imp_ex_path tl_nempty_lngth)\n\n\nlemma path_fstO:  \"\\<forall> I y. path I y p \\<longrightarrow> I \\<noteq> y \\<longrightarrow> (\\<exists> zs. p = I # zs)\"\n  using path.simps by blast\n\nlemma path_lstO: \"\\<forall> I y. path I y p \\<longrightarrow> p \\<noteq> [] \\<longrightarrow> (\\<exists> zs. p = zs @ [y])\"\n  apply (rule_tac list = p in list.induct)\n  apply (metis empty_iff empty_set lst_in_path)\n  by (metis append.simps(1) append.simps(2) list.inject list.sel(1) path.cases)\n\nlemma path_fst: \"\\<forall> I y. path I y p \\<longrightarrow> I \\<noteq> y \\<longrightarrow> (\\<exists> zs. p = (I # (zs @ [y])))\"\n  apply (rule_tac list = p in list.induct)\n  apply (metis empty_iff empty_set fst_in_path)\n  by (metis append_butlast_last_id fst_in_pathO last.simps list.discI list.sel(1) path_lstO snoc_eq_iff_butlast)\n\nlemma path_fst_lst[rule_format]: \"(\\<forall> y. path (hd p) y p \\<longrightarrow> hd p \\<noteq> y \\<longrightarrow> (\\<exists> xs. p = (hd p #(xs @ [y]))))\"\n  apply (rule_tac list = p in list.induct)\n   apply (metis empty_iff empty_set lst_in_path)\n  apply (rule allI)+\n  apply (rule impI)+\n  apply simp\n  apply (drule_tac x = y in spec)\n  by (meson list.inject path_fst)\n\nlemma path_splitO[rule_format]:  \"\\<forall> I y. path I y (ys @ (z # zs)) \\<longrightarrow> path I z (ys @ [z]) \\<and> path z y (z # zs)\"\n  apply (rule_tac list = ys in list.induct)\n  apply (metis append_Nil empty list.sel(1) path.cases)\n  by (smt (verit, best) append_Cons append_is_Nil_conv list.discI list.inject path.cases path.step)\n\nlemma path_split:  \"path I y p \\<Longrightarrow> p = ys @ (z # (zs @ (z' # zs'))) \\<Longrightarrow> \n                    path I z (ys @ [z]) \\<and> path z z' (z # zs @ [z']) \\<and> path z' y (z' # zs')\"\n  by (metis append_Cons path_splitO)\n\n\nlemma lemmaFO: \"path I y p \\<Longrightarrow> z \\<in> set p \\<Longrightarrow> z' \\<in> set p \\<Longrightarrow> before z z' p \\<Longrightarrow>\n               (I, z) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<and>\n               (z, z') \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<and>\n               (z', y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n  apply (subgoal_tac \"\\<exists> ys zs zs'. p = ys @ (z # (zs @ (z' # zs')))\")\n   prefer 2\n   apply (rule list_split_split, assumption+)\n  apply (erule exE)+\n  apply (frule path_split, assumption)\n  apply (erule conjE)+\n  apply (rule conjI, erule path_imp_rtrancl)+\n  by (erule path_imp_rtrancl)\n\nlemma lemmaFOa: \"path I y p \\<Longrightarrow> z \\<in> set p \\<Longrightarrow> \n               (I, z) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<and>\n               (z, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>*\"\n  by (metis path_imp_rtrancl path_splitO split_list_last)\n\nlemma lemmaFOOOO: \"path I y p \\<Longrightarrow>z \\<in> set p \\<Longrightarrow> z' \\<in> set p \\<Longrightarrow> (z \\<rightarrow>\\<^sub>n* z') \\<or> (z' \\<rightarrow>\\<^sub>n* z)\"\n  apply (case_tac \"z = z'\")\n   apply (simp add: InfrastructureThree.state_transition_in_refl_def)\n(* z \\<noteq> z' *)\n  apply (case_tac \"before z z' p\")\n   apply (simp add: InfrastructureThree.state_transition_in_refl_def lemmaFO)\n  by (meson InfrastructureThree.state_transition_in_refl_def before_neg lemmaFO)\n\n(* here *)\n\ndefinition first \n  where \\<open>first p z x a l \\<equiv> (x \\<in> kgra (graphI z) a l \\<and> (\\<exists> zO \\<in> set p.  zO  \\<rightarrow>\\<^sub>n z \\<and> x \\<notin> (kgra (graphI zO) a l)))\\<close>\n\nlemma \"\\<not>  path z I []\"\n  by (meson list.distinct(1) path.cases)\n\n(*\nfunction list_Suc \n  where \"list_Suc a l = (case l of [] \\<Rightarrow> None \n                                | [_] \\<Rightarrow> None \n                                | x # l \\<Rightarrow> if x = a then Some(hd l)\n                                           else list_Suc a (tl l))\"\n  apply force\n  by blast\n*)\n\nfun list_Suc \n  where \n  list_Suc_empty: \"list_Suc a [] = None\"\n| list_Suc_singleton:  \"list_Suc a [_] = None\"\n| list_Suc_step: \"list_Suc a (x # l) = (if x = a then Some(hd l) else list_Suc a (l))\"\n\ndefinition list_suc\n  where \n    \"list_suc l n = (if Suc n < (length l) then Some(nth l (Suc n)) else None)\" \n\n\nlemma \"length [1,2,3] = 3\"\n  by simp\n\nlemma \"nth [1 :: nat,2,3] 2 = 3\"\n  by simp\n\n\nlemma \"list_suc [1:: nat, 2, 3, 3] (0 :: nat) = Some 2\"\n  by (simp add: list_suc_def)\n\nlemma \"list_suc [1:: nat, 2, 3, 3] (1 :: nat) = Some 3\"\n  by (simp add: list_suc_def)\n\nlemma \"list_suc [1:: nat, 2, 3, 3] (2 :: nat) = Some 3\"\n  by (simp add: list_suc_def)\n\n\n(*\nfun list_Suc \n  where \n  list_Suc_empty: \"list_Suc a [] = None\"\n| list_Suc_singleton:  \"list_Suc a [_] = None\"\n| list_Suc_step: \"list_Suc a (x # l) = (if x = a \\<and> (hd l) \\<noteq> a then Some(hd l) else list_Suc a (l))\"\n*)\n(*\nfun list_SucP \n  where \n  list_SucP_empty: \"list_SucP P [] = None\"\n| list_SucP_singleton:  \"list_SucP P [_] = None\"\n| list_SucP_step: \"list_SucP P (x # l) = (if P x  then Some(hd l) else list_Suc a (l))\"\n*)\n\nlemma list_Suc_def: \"\\<forall> a l. list_Suc a l = (case l of [] \\<Rightarrow> None \n                                | [_] \\<Rightarrow> None \n                                | x # l \\<Rightarrow> if x = a then Some(hd l)\n                                           else list_Suc a (l))\"\n  by (smt (verit, best) list.simps(4) list.simps(5) list_Suc.elims)\n\nlemma list_Suc_test: \"list_Suc (1::nat) [1,1,2] = Some 1\"\n  by simp\n\nlemma list_Suc_testO: \"list_Suc (1::nat) [3,2,1,2] = Some 2\"\n  by simp\n\nlemma list_Suc_testOO: \"list_Suc (1::nat) [2,1,1] = Some 1\"\n  by simp\n\nlemma list_Suc_testO: \"p = xs @ (x # ys) \\<Longrightarrow> ys \\<noteq> [] \\<Longrightarrow> x \\<notin> set xs \\<Longrightarrow> list_Suc x p = Some(hd ys)\"\n  oops\n\n\ndefinition list_Pred   where \"list_Pred a l = list_Suc a (rev l)\"\n\n\nlemma list_Pred_test: \"list_Pred (2::nat) [1,1,2] = Some (1 :: nat)\"\n  by (simp add: list_Pred_def)\n\n\nfun list_Pre \n  where \n  list_Pre_empty: \"list_Pre a [] = None\"\n| list_Pre_singleton:  \"list_Pre a [_] = None\"\n| list_Pre_step: \"list_Pre a (x # l) = (if a = (hd l) then Some(x) else list_Pre a l)\"\n\n\nlemma path_list_Suc[rule_format]: \"path I y p \\<Longrightarrow> \\<forall> z \\<in> set p. z \\<noteq> y \\<longrightarrow> (\\<exists> zO. list_Suc z p = Some zO \\<longrightarrow> z \\<rightarrow>\\<^sub>n zO)\"\n  apply (erule path.induct)\n  apply simp\n  by (metis option.inject)\n\nlemma path_list_SucO[rule_format]: \"path I y p \\<Longrightarrow> \\<forall> z \\<in> set p. z \\<noteq> y \\<longrightarrow> \n                                 (\\<forall> zO. list_Suc z p = Some zO \\<longrightarrow> z \\<rightarrow>\\<^sub>n zO)\"\n  apply (erule path.induct)\n   apply simp\n  apply (rule ballI)+\n  apply (rule impI)\n  apply (rule allI)\n  apply (rule impI)\n  by (smt (verit, del_insts) list.discI list.sel(1) list.sel(3) list_Suc.elims option.inject path.cases set_ConsD)\n\n(* this is not always the case *)\nlemma path_list_Suc_sum_not_end: \"list_Suc z p = Some zO \\<Longrightarrow> z \\<noteq> last p\"\n  oops\n\nlemma path_list_SucOO[rule_format]: \"path I y p \\<Longrightarrow> \\<forall> z \\<in> set p.\n                                 (\\<forall> zO. list_Suc z p = Some zO \\<longrightarrow> z \\<rightarrow>\\<^sub>n zO)\"\n  apply (erule path.induct)\n   apply simp\n  apply (rule ballI)+\n  apply (rule allI)\n  apply (rule impI)\n  by (smt (verit, best) list.discI list.sel(1) list.sel(3) list_Suc.elims option.inject path.cases set_ConsD)\n\nlemma path_list_suc: \"path I y p \\<Longrightarrow> \\<forall> n < (length p) - 1. nth p n \\<rightarrow>\\<^sub>n the(list_suc p n)\"\n  apply (erule path.induct)\n   apply simp\n  apply (simp add: list_suc_def)\n  by (smt (verit, del_insts) One_nat_def diff_Suc_1 less_Suc_eq_0_disj less_imp_Suc_add nth_Cons' option.sel path.cases)\n\nlemma path_list_sucOO[rule_format]: \"path I y p \\<Longrightarrow> \\<forall> n < (length p) - 1. nth p n \\<rightarrow>\\<^sub>n nth p (Suc n)\"\n  apply (erule path.induct)\n   apply simp\n  by (smt (verit, best) Groups.add_ac(2) One_nat_def Suc_pred add_diff_cancel_left' less_Suc_eq_0_disj less_imp_Suc_add list.size(4) nth_Cons_0 nth_Cons_Suc path.cases zero_less_Suc)\n  \n\nlemma path_List_PreO: \"path I y p \\<Longrightarrow> \\<forall> z \\<in> set p.\n                                 (list_Pre z p \\<noteq>  None \\<longrightarrow> the(list_Pre z p) \\<rightarrow>\\<^sub>n z)\"\n  apply (erule path.induct)\n   apply simp\n  apply (rule ballI)+\n  apply simp\n  apply (clarify)\n  apply simp\n  oops\n\nlemma path_List_Pre: \"path I y p \\<Longrightarrow> \\<forall> z \\<in> (set p - {I}).\n                                 (\\<forall> zO. list_Pre z p = Some zO \\<longrightarrow> zO \\<rightarrow>\\<^sub>n z)\"\n  apply (erule path.induct)\n   apply simp\n  apply (rule ballI)+\n  apply (rule allI)\n  thm list_Pre_step\n(* list_Pre ?a (?x # ?v # ?va) = (if ?a = hd (?v # ?va) then Some ?x else list_Pre ?a (?v # ?va)) *)\n  apply (rule impI)\n  apply (case_tac p)\n   apply simp\n  apply simp\n  by (metis insert_Diff insert_iff list.inject option.inject path.cases)\n\n(* Not true: you may have a list that starts with two I's *)\nlemma path_List_PreI: \"path I y p \\<Longrightarrow> list_Pre I p = None\"\n  apply (erule path.induct)\n   apply simp\n  oops\n\n\n\n(* See conterexample: if there are repititions, then the reverse gets the wrong end *)\nlemma List_Pred_Suc: \"list_Pred z p = Some zO \\<Longrightarrow> list_Suc zO p = Some z\"\n  oops\n\nlemma pred_prestate: \"path I y p \\<Longrightarrow> \\<forall> z \\<in> set p.\n                      \\<forall> zO. list_Pred z p = Some zO \\<longrightarrow> zO \\<rightarrow>\\<^sub>n z\"\n  apply (unfold list_Pred_def)\n  apply (erule path.induct)\n   apply simp\n  apply (rule ballI)+\n  apply (rule allI)\n  apply (rule impI)\n\n  apply (simp add: list_Pred_def)\n  apply (frule path_list_Suc)\n  prefer 2\n  oops\n\n(* Not valid as we could have repetitions in paths: if we exclude\n  them, we lose that for server I \\<rightarrow>* y there is a path (see lemma rtrancl_imp_ex_path) *)\nlemma \"path I I p \\<Longrightarrow> p = [I]\"\n  apply (erule path.cases)\n   apply simp+\n  oops\n\n\n(* not valid because there could be repetitions in p \nlemma lemma_pathOOO: \"\\<forall> y . path y y p \\<longrightarrow> p = [y]\"\n  apply (rule_tac list = p in list.induct)\n   apply (meson list.distinct(1) path.cases)\n\n  apply (meson list.distinct(1) path.cases)\n   \n  apply (rule path.cases, assumption, simp)\n\n\n  oops\n*)\n\n  thm path.induct\n\nfun flt\n  where \n    flt_empty: \"flt P [] = None\"\n  | flt_step: \"flt P (a # l) = (if P a then Some a else flt P l)\"\n\nlemma P_notP_nthlist[rule_format]: \"2 \\<le> length p \\<longrightarrow> \\<not> P (nth p 0) \\<longrightarrow> P (nth p (length p - 1)) \\<longrightarrow>\n     (\\<exists> n < length p - 1. \\<not> P (nth p n) \\<and> P(nth p (Suc n)))\"\n  apply (rule list.induct)\n  apply simp\n  by (metis (no_types, hide_lams) One_nat_def Suc_1 Suc_diff_1 Suc_le_mono Suc_less_eq diff_Suc_1 le0 length_Cons nth_Cons' nth_non_equal_first_eq zero_less_Suc)\n\n\nlemma P_notP_list: \"(P y) \\<longrightarrow> \\<not> (P I) \\<longrightarrow> \n         (\\<exists> zO \\<in> set (I # (q @ [y])). \\<not> P zO \\<and> P(the(list_Suc zO (I # (q @ [y])))))\"\n\n(* new:\nAuto Quickcheck found a counterexample:\n  P = {a\\<^sub>1}\n  y = a\\<^sub>1\n  I = a\\<^sub>2\n  q = [a\\<^sub>3, a\\<^sub>2]\n\nold counterexample:\n P = {a\\<^sub>1}\n  y = a\\<^sub>1\n  I = a\\<^sub>2\n  q = [a\\<^sub>2]\np = [a2,a2,a1] \nthat is: \\<not> P I = I \\<notin> {a1} because I = a2 and \\<not> P z forall z \\<in> q, because q = [a2], and P y because y = a1 \\<in> {a1} = P\nso, why?\n*)\n  oops\n\nlemma P_notP_list: \"(P y) \\<longrightarrow> \\<not> (P I) \\<longrightarrow>\n         (\\<exists> zO \\<in> set (I # ([x]@ [y])). \\<not> P zO \\<and> P(the(list_Suc zO (I # ([x] @ [y])))))\"\n(* \nAuto Quickcheck found a counterexample:\n  P = {a\\<^sub>1}\n  y = a\\<^sub>1\n  I = a\\<^sub>2\n  x = a\\<^sub>2\n*)\n  apply (rule impI)+\n  apply (case_tac \"P x\")\n   apply simp\n  apply (case_tac \"I = x\")\n  apply (rule_tac x = x in bexI)\n   apply (rule conjI, assumption)\n   apply simp\n(*  1. P y \\<Longrightarrow> \\<not> P I \\<Longrightarrow> \\<not> P x \\<Longrightarrow> I \\<noteq> x\n Oh, we don't know whether the elements are different, so list_Suc cannot be decided \n- we probably need a list_Suc with a different property than = .\nAlso adding path to it doesn't change much\n path I y (I # ([x]@ [y])) \\<longrightarrow>\ncounterexample isn't found but still the same subgoal to show I \\<noteq> x\n*)\n   apply (subgoal_tac \"list_Suc x (I # [x] @ [y]) = Some y\")\n  prefer 2\n  apply (rule list.induct)\n  oops\n\nlemma nth_p_y: \"path I y p \\<Longrightarrow> y = nth p (length p - 1)\"\n  by (metis empty_iff empty_set fst_in_pathOO length_last path_lstO)\n\n\nlemma lemmaFOOb: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n                 (\\<forall> l a. kgra (graphI I) a l = {}) \\<Longrightarrow>\n                  a \\<in> actors_graph (InfrastructureThree.graphI I) \\<Longrightarrow>\n                 x \\<in> kgra (graphI y) a l \\<Longrightarrow>\n                 \\<forall> p. path I y p \\<longrightarrow> (\\<exists> z \\<in> set p. first p z x a l)\"\n  apply (rule allI)\n  apply (rule impI)\n  apply (unfold first_def)\n  apply (subgoal_tac \"x \\<notin> kgra (graphI I) a l\")\n   prefer 2\n   apply blast\n  apply (subgoal_tac \"I \\<noteq> y\")\n  prefer 2\n   apply blast\n  apply (subgoal_tac \"2 \\<le> length p\")\n  prefer 2\n   apply (metis list.discI list.sel(3) path.cases tl_nempty_lngth)\n  apply (subgoal_tac \"I = nth p 0\")\n  prefer 2\n   apply (metis nth_Cons_0 path.cases)\n  apply (subgoal_tac \"y = nth p (length p - 1)\")\n   prefer 2\n  using nth_p_y apply presburger\n  apply (subgoal_tac \n     \"(\\<exists> n < length p - 1. \\<not> (x \\<in> kgra (graphI (nth p n)) a l)  \\<and> x \\<in> kgra (graphI (nth p (Suc n))) a l)\")\n   prefer 2\n   apply (rule P_notP_nthlist, assumption+, simp, simp)\n  apply (erule exE)\n  apply (erule conjE)+\n  apply (rule_tac x = \"p ! Suc n\" in bexI)\n  apply (rule conjI, assumption)\n  apply (rule_tac x = \"p ! n\" in bexI)\n    apply (rule conjI)\n     apply (erule path_list_sucOO, assumption)\n    apply assumption\n   by simp+\n\n(* here - hurrah !*)\n\nlemma lemmaFOOO: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n                   a \\<in> actors_graph (InfrastructureThree.graphI I) \\<Longrightarrow>\n                   x \\<in> kgra (graphI y) a l \\<Longrightarrow>  path I y p \\<Longrightarrow>\n                   z \\<in> set p \\<Longrightarrow> first p z x a l \\<Longrightarrow> snd x \\<in> egra (graphI z) l\"\n  apply (simp add: first_def)\n  apply (erule conjE)\n  apply (erule bexE)\n  apply (erule conjE)\n  apply (rule state_transition_in.cases, assumption)\n  apply (metis InfrastructureThree.graphI.simps InfrastructureThree.kgra.simps InfrastructureThree.move_graph_a_def)\n  apply (metis (no_types, lifting) CollectD InfrastructureThree.egra.simps InfrastructureThree.graphI.simps InfrastructureThree.kgra.simps case_prodE fun_upd_other fun_upd_same snd_conv)\n  by (simp add: InfrastructureThree.put_graph_efid_def)\n\nlemma lemmaF[rule_format]:  \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n                 (\\<forall> l a. kgra (graphI I) a l = {}) \\<Longrightarrow>\n                  a \\<in> actors_graph (InfrastructureThree.graphI I) \\<Longrightarrow>\n                 x \\<in> kgra (graphI y) a l \\<Longrightarrow>\n                 \\<forall> p. path I y p \\<longrightarrow> (\\<exists> z \\<in> set p. snd x \\<in> egra (graphI z) l)\"\n  by (meson lemmaFOOb lemmaFOOO)\n\n(* Theorem A funktioniert, wenn FOO und FOOO gezeigt werden koennen -- was wir nun konnten! *)\ntheorem theoremA: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n         (\\<forall> l a. kgra (graphI I) a l = {}) \\<Longrightarrow>\n         a \\<in> actors_graph (graphI I) \\<Longrightarrow> \n  (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). \n               inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n  (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n  (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow>\n            ((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n            (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')))) = {}))) \\<Longrightarrow>\n  (\\<forall> l \\<in> nodes(InfrastructureThree.graphI I).\n             \\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI I) l).\n             (\\<exists> a \\<in> agra (InfrastructureThree.graphI I) l. \n                  e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n  \\<forall> l \\<in> nodes(graphI I). \\<forall> l' \\<in> nodes(graphI I).\n         x \\<in> kgra (graphI y) a l \\<inter> kgra (graphI y) a l' \\<longrightarrow> l = l'\" \n  apply (rule ballI)+\n  apply (rule impI)\n  apply simp\n  apply (erule conjE)+\n(* intervention to show that I \\<noteq> y might enable to show that there is a path p with at least two elements*)\n  apply (subgoal_tac \"I \\<noteq> y\")\n  prefer 2\n   apply blast\n  apply (subgoal_tac \"\\<exists> p. path I y p\")\n  prefer 2\n  apply (erule rtrancl_imp_ex_path)\n  apply (erule exE)\n  apply (subgoal_tac \"(\\<exists> z \\<in> set p. snd x \\<in> egra (graphI z) l)\")\n   apply (subgoal_tac \"(\\<exists> z \\<in> set p. snd x \\<in> egra (graphI z) l')\")\n    prefer 2\n  using lemmaF apply presburger \n   prefer 2\n  using lemmaF apply presburger\n  apply (erule bexE)+\n  apply (case_tac \"before z za p\")\n  apply (frule_tac z = z and z' = za in lemmaFO, assumption+)\n  apply (erule conjE)+\n   apply (rule_tac x = \"snd x\" and I = z and y = za and a = a in lemmaB)\n  apply assumption\n  apply (metis InfrastructureThree.same_actors)\n  apply (metis InfrastructureThree.same_actors efids_list_eq_refl)\n  using InfrastructureThree.actor_unique_loc_lem apply presburger\n  apply (metis InfrastructureThree.same_actors efids_list_eq_refl)\n  using InfrastructureThree.efids_cur_eq_egra_refl apply auto[1]\n  apply (metis InfrastructureThree.same_nodes)\n     apply (metis InfrastructureThree.same_nodes)\n    apply assumption+\n(* z = za *)\n  apply (case_tac \"z = za\")\n  apply (frule_tac z = z in lemmaFOa, assumption+)\n  apply (erule conjE)+\n   apply (rule_tac x = \"snd x\" and I = za and y = za and a = a in lemmaB)\n            apply simp\n  apply (metis InfrastructureThree.same_actors)\n  apply (metis InfrastructureThree.same_actors efids_list_eq_refl)\n  using InfrastructureThree.actor_unique_loc_lem apply presburger\n  apply (metis InfrastructureThree.same_actors efids_list_eq_refl)\n  using InfrastructureThree.efids_cur_eq_egra_refl apply auto[1]\n  apply (metis InfrastructureThree.same_nodes)\n     apply (metis InfrastructureThree.same_nodes)\n    apply simp\n  apply assumption\n(* z \\<noteq> za and \\<not> before z za p*)\n  apply (frule_tac z = za and z' = z in lemmaFO, assumption+)\n  apply (simp add: before_neg)\n  apply (erule conjE)+\n  apply (rule sym)\n   apply (rule_tac x = \"snd x\" and I = za and y = z and a = a in lemmaB)\n  apply assumption\n  apply (metis InfrastructureThree.same_actors)\n  apply (metis InfrastructureThree.same_actors efids_list_eq_refl)\n  using InfrastructureThree.actor_unique_loc_lem apply presburger\n  apply (metis InfrastructureThree.same_actors efids_list_eq_refl)\n  using InfrastructureThree.efids_cur_eq_egra_refl apply auto[1]\n  apply (metis InfrastructureThree.same_nodes)\n     apply (metis InfrastructureThree.same_nodes)\n  by assumption+\n\n(* here -- finally *)\nlemma theoremAOO: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n         (\\<forall> l a. kgra (graphI I) a l = {}) \\<Longrightarrow>\n  (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). \n               inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n  (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n  (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow>\n            ((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n            (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')))) = {}))) \\<Longrightarrow>\n  (\\<forall> l \\<in> nodes(InfrastructureThree.graphI I).\n             \\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI I) l).\n             (\\<exists> a \\<in> agra (InfrastructureThree.graphI I) l. \n                  e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n\\<forall> a \\<in> actors_graph (graphI y). \n  \\<forall> l \\<in> nodes(graphI y). \\<forall> l' \\<in> nodes(graphI y). l \\<noteq> l'\n       \\<longrightarrow>  kgra (graphI y) a l \\<inter> kgra (graphI y) a l' = {}\"\n  by (smt (verit) InfrastructureThree.same_actors InfrastructureThree.same_nodes empty_Collect_eq inf_set_def mem_Collect_eq theoremA)\n\n(* Single-set intersection lemma is given by invariant that there are more than 3 - ergo not identifiable *)\n(*\nlemma  \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n(\\<forall> l \\<in> nodes(InfrastructureThree.graphI I).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI I) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI I) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n\\<forall> l \\<in> nodes(InfrastructureThree.graphI y).\n \\<forall>x\\<in>InfrastructureThree.agra (InfrastructureThree.graphI y) l.\n       InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) x)\n       \\<in> InfrastructureThree.egra (InfrastructureThree.graphI y) l\"\n  apply (subgoal_tac \"(\\<forall> l \\<in> nodes(InfrastructureThree.graphI y).\n\\<forall> e \\<in> (InfrastructureThree.egra (InfrastructureThree.graphI y) l).\n (\\<exists> a \\<in> agra (InfrastructureThree.graphI y) l. \n     e = efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)))\")\n  apply (subgoal_tac \"(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI y) \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI y) l \\<longrightarrow>  \n                a \\<in>  InfrastructureThree.agra (InfrastructureThree.graphI y) l' \\<longrightarrow> l = l'))\")\n  prefer 2\n  using InfrastructureThree.actor_unique_loc_lem apply presburger\n  prefer 2\n   apply (simp add: InfrastructureThree.efids_cur_eq_egra_refl)\n  apply (rule ballI)+\n  apply (rotate_tac -4)\n  apply (drule_tac x = l in bspec)\n   apply assumption\n  apply (rotate_tac -1)\n  apply (drule_tac x = \"efids_cur (cgra (InfrastructureThree.graphI y) x)\" in bspec)\nproduces \"InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) x)\n           \\<in> InfrastructureThree.egra (InfrastructureThree.graphI y) l \" which is the goal as\n  subgoal \n*)\nlemma isthere_lem0: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  nodes (graphI z) = nodes (graphI z') \\<longrightarrow>\n           (inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI z) x)) \n                     (actors_graph (InfrastructureThree.graphI z))) \\<longrightarrow>\n (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). \n      efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<noteq>\n              efids_cur(efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>\n                a \\<in>  agra (graphI z) l \\<longrightarrow>  a \\<in>  agra (graphI z) l' \\<longrightarrow> l = l')) \\<longrightarrow>\n         (\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI z) \\<longrightarrow>  a \\<in>  agra (graphI z) l \\<longrightarrow>\n            efids_cur ((InfrastructureThree.cgra (graphI z) a)) \\<in> egra (graphI z) l)) \n        \\<longrightarrow> (\\<forall> a. \n           (\\<forall> l'. l' \\<in> nodes (graphI z') \\<longrightarrow>  a \\<in>  agra (graphI z') l' \\<longrightarrow>\n          efids_cur ((InfrastructureThree.cgra (graphI z') a)) \\<in> egra (graphI z') l'))\"\n  apply (rule allI)+\n  apply (rule impI)\n  apply (rule InfrastructureThree.state_transition_in.cases, assumption)\n    apply (simp add: move_graph_a_def)\n    apply (rule conjI)\n     apply (rule impI)+\n     apply (rule allI)\n     apply (rule conjI)\n     apply (rule impI)+\n     apply (rule allI)\n     apply (rule impI)+\n      apply (erule conjE)+\n  apply meson\n  apply (metis (no_types, lifting) InfrastructureThree.actors_graph_def inj_on_def mem_Collect_eq)\n  apply force\n(* get *)\n  using InfrastructureThree.agra.simps InfrastructureThree.cgra.simps InfrastructureThree.egra.simps InfrastructureThree.graphI.simps apply presburger\n(* put *)\n  by (smt (z3) InfrastructureThree.actors_graph_def InfrastructureThree.agra.simps InfrastructureThree.atI_def InfrastructureThree.cgra.simps InfrastructureThree.egra.simps InfrastructureThree.graphI.simps InfrastructureThree.put_graph_efid_def fun_upd_apply inj_on_def insert_Diff insert_iff mem_Collect_eq)\n\nlemma isthere_lem0a: \"z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>  nodes (graphI z) = nodes (graphI z') \\<Longrightarrow>\n           (inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI z) x)) \n                     (actors_graph (InfrastructureThree.graphI z))) \\<Longrightarrow>\n (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). \n      efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a) \\<noteq>\n              efids_cur(efids_inc_ind (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<Longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>\n                a \\<in>  agra (graphI z) l \\<longrightarrow>  a \\<in>  agra (graphI z) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n         (\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI z) \\<longrightarrow>  a \\<in>  agra (graphI z) l \\<longrightarrow>\n            efids_cur ((InfrastructureThree.cgra (graphI z) a)) \\<in> egra (graphI z) l)) \\<Longrightarrow>\n         (\\<forall> a. \n           (\\<forall> l'. l' \\<in> nodes (graphI z') \\<longrightarrow>  a \\<in>  agra (graphI z') l' \\<longrightarrow>\n          efids_cur ((InfrastructureThree.cgra (graphI z') a)) \\<in> egra (graphI z') l'))\"\n  using InfrastructureThree.isthere_lem0 by presburger\n\nlemma isthere_lem00: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>  nodes (graphI z) = nodes (graphI z') \\<longrightarrow>\n           (inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI z) x)) \n                     (actors_graph (InfrastructureThree.graphI z))) \\<longrightarrow>\n (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). \n      inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>\n                a \\<in>  agra (graphI z) l \\<longrightarrow>  a \\<in>  agra (graphI z) l' \\<longrightarrow> l = l')) \\<longrightarrow>\n         (\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI z) \\<longrightarrow>  a \\<in>  agra (graphI z) l \\<longrightarrow>\n            efids_cur ((InfrastructureThree.cgra (graphI z) a)) \\<in> egra (graphI z) l)) \n        \\<longrightarrow> (\\<forall> a. \n           (\\<forall> l'. l' \\<in> nodes (graphI z') \\<longrightarrow>  a \\<in>  agra (graphI z') l' \\<longrightarrow>\n          efids_cur ((InfrastructureThree.cgra (graphI z') a)) \\<in> egra (graphI z') l'))\"\n  by (simp add: InfrastructureThree.efids_list_inj_imp_inc_ind_not_eq InfrastructureThree.isthere_lem0)\n\nlemma isthere_lem00a: \"z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow> nodes (graphI z) = nodes (graphI z') \\<Longrightarrow>\n           (inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI z) x)) \n                     (actors_graph (InfrastructureThree.graphI z))) \\<Longrightarrow>\n (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). \n      inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<Longrightarrow>\n(\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>\n                a \\<in>  agra (graphI z) l \\<longrightarrow>  a \\<in>  agra (graphI z) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n         (\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI z) \\<longrightarrow>  a \\<in>  agra (graphI z) l \\<longrightarrow>\n            efids_cur ((InfrastructureThree.cgra (graphI z) a)) \\<in> egra (graphI z) l)) \\<Longrightarrow>\n         (\\<forall> a. \n           (\\<forall> l'. l' \\<in> nodes (graphI z') \\<longrightarrow>  a \\<in>  agra (graphI z') l' \\<longrightarrow>\n          efids_cur ((InfrastructureThree.cgra (graphI z') a)) \\<in> egra (graphI z') l'))\"\n  using InfrastructureThree.isthere_lem00 by presburger\n\nlemma is_there_lem[rule_format]: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n     (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow>\n     ((range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n      (range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')))) = {}))) \\<Longrightarrow>\n        (inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI I) x)) \n                     (actors_graph (InfrastructureThree.graphI I))) \\<Longrightarrow>\n        (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). \n               inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n           (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>\n                a \\<in>  agra (graphI I) l \\<longrightarrow>  a \\<in>  agra (graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n(\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI I) \\<longrightarrow>  a \\<in>  agra (graphI I) l \\<longrightarrow>\n            efids_cur ((InfrastructureThree.cgra (graphI I) a)) \\<in> egra (graphI I) l)) \\<longrightarrow>\n        (\\<forall> a. \n           (\\<forall> l'. l' \\<in> nodes (graphI y) \\<longrightarrow>  a \\<in>  agra (graphI y) l' \\<longrightarrow>\n                  efids_cur ((InfrastructureThree.cgra (graphI y) a)) \\<in> egra (graphI y) l'))\"\nproof (erule rtrancl_induct, simp)\n  show \"\\<And>y z. \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n              \\<forall>a'\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n                 a \\<noteq> a' \\<longrightarrow>\n                 range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter>\n                 range (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a')) =\n                 {} \\<Longrightarrow>\n           inj_on (\\<lambda>x. InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) x))\n            (InfrastructureThree.actors_graph (InfrastructureThree.graphI I)) \\<Longrightarrow>\n           \\<forall>a\\<in>InfrastructureThree.actors_graph (InfrastructureThree.graphI I).\n              inj (InfrastructureThree.efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<Longrightarrow>\n           \\<forall>a l l'.\n              l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI I) \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>\n              a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l' \\<longrightarrow> l = l' \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           (\\<forall>a l. l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI I) \\<longrightarrow>\n                  a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>\n                  InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)\n                  \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l) \\<longrightarrow>\n           (\\<forall>a l'.\n               l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI y) \\<longrightarrow>\n               a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI y) l' \\<longrightarrow>\n               InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI y) a)\n               \\<in> InfrastructureThree.egra (InfrastructureThree.graphI y) l') \\<Longrightarrow>\n           (\\<forall>a l. l \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI I) \\<longrightarrow>\n                  a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<longrightarrow>\n                  InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)\n                  \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l) \\<longrightarrow>\n           (\\<forall>a l'.\n               l' \\<in> InfrastructureThree.nodes (InfrastructureThree.graphI z) \\<longrightarrow>\n               a \\<in> InfrastructureThree.agra (InfrastructureThree.graphI z) l' \\<longrightarrow>\n               InfrastructureThree.efids_cur (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)\n               \\<in> InfrastructureThree.egra (InfrastructureThree.graphI z) l')\"\n    apply (rule impI)\n  apply (rule_tac z = y in isthere_lem00a)\n    apply force\n    apply (metis InfrastructureThree.same_nodes rtrancl.rtrancl_into_rtrancl)\n    apply (smt (verit, ccfv_threshold) InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.same_actors disjoint_insert(2) efids_list_eq_refl inj_onI insert_Diff)\n    apply (metis InfrastructureThree.same_actors efids_list_eq_refl)\n    using InfrastructureThree.actor_unique_loc_lem apply presburger\n    by meson\nqed\n\n\n\nlemma inj_on_leq: \"inj_on f A \\<Longrightarrow>\n    AO \\<subseteq> A \\<Longrightarrow> \\<forall> x \\<in> AO. f x \\<in> EO \\<Longrightarrow> finite EO \\<Longrightarrow>\n    3 \\<le> card AO \\<Longrightarrow>\n    3 \\<le> card EO\"\n  apply (subgoal_tac \"card AO \\<le> card EO\")\n   apply (meson dual_order.trans)\n  apply (rule_tac f = f in card_inj_on_le)\n  using inj_on_subset apply blast\n  apply fastforce\n  using card_ge_0_finite by blast\n\nlemma finite_egras_inv: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow> (\\<forall> l \\<in> nodes (graphI z). finite(egra (graphI z) l)) \n                         \\<longrightarrow> (\\<forall> l' \\<in> nodes (graphI z'). finite(egra (graphI z') l'))\"\n  apply (rule allI)+\n  apply (rule impI)\n  apply (rule InfrastructureThree.state_transition_in.cases, assumption)\n    apply (simp add: move_graph_a_def)\n  apply (simp add: InfrastructureThree.same_nodes0)\n  apply (simp add: InfrastructureThree.same_nodes0)\n  apply (simp add: put_graph_efid_def)\n  by (simp add: InfrastructureThree.same_nodes0)\n\nlemma finite_egras_inv_refl: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n                     (\\<forall> l \\<in> nodes (graphI I). finite(egra (graphI I) l)) \\<Longrightarrow>\n                     (\\<forall> l' \\<in> nodes (graphI y). finite(egra (graphI y) l'))\"\nproof (erule rtrancl_induct, simp)\n  show \"\\<And>y z. \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n              finite (InfrastructureThree.egra (InfrastructureThree.graphI I) l) \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI y).\n              finite (InfrastructureThree.egra (InfrastructureThree.graphI y) l') \\<Longrightarrow>\n           \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n              finite (InfrastructureThree.egra (InfrastructureThree.graphI z) l') \"\n    by (simp add: finite_egras_inv)\nqed\n\nlemma finite_agras_inv: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow> (\\<forall> l \\<in> nodes (graphI z). finite(agra (graphI z) l)) \n                         \\<longrightarrow> (\\<forall> l' \\<in> nodes (graphI z'). finite(agra (graphI z') l'))\"\n  apply (rule allI)+\n  apply (rule impI)\n  apply (rule InfrastructureThree.state_transition_in.cases, assumption)\n    apply (simp add: move_graph_a_def)\n  using InfrastructureThree.nodes_def apply force\n  apply (simp add: InfrastructureThree.same_nodes0)\n  apply (simp add: put_graph_efid_def)\n  by (simp add: InfrastructureThree.same_nodes0)\n\nlemma finite_agras_inv_refl: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n                     (\\<forall> l \\<in> nodes (graphI I). finite(agra (graphI I) l)) \\<Longrightarrow>\n                     (\\<forall> l' \\<in> nodes (graphI y). finite(agra (graphI y) l'))\"\nproof (erule rtrancl_induct, simp)\n  show \" \\<And>y z. \\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI I).\n              finite (InfrastructureThree.agra (InfrastructureThree.graphI I) l) \\<Longrightarrow>\n           (I, y) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n           (y, z) \\<in> {(x, y). x \\<rightarrow>\\<^sub>n y} \\<Longrightarrow>\n           \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI y).\n              finite (InfrastructureThree.agra (InfrastructureThree.graphI y) l') \\<Longrightarrow>\n           \\<forall>l'\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n              finite (InfrastructureThree.agra (InfrastructureThree.graphI z) l')\"\n    using finite_agras_inv by force\nqed\n\nlemma numbers_egras_inv: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow> \n(range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a'))) = {})) \n\\<Longrightarrow>\n(inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI I) x)) \n           (actors_graph (InfrastructureThree.graphI I))) \\<Longrightarrow>\n        (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). \n               inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n           (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>\n                a \\<in>  agra (graphI I) l \\<longrightarrow>  a \\<in>  agra (graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n(\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI I) \\<longrightarrow>  a \\<in>  agra (graphI I) l \\<longrightarrow>\n            efids_cur ((InfrastructureThree.cgra (graphI I) a)) \\<in> egra (graphI I) l)) \\<Longrightarrow>\n\\<forall> l \\<in> nodes (graphI I). finite(egra (graphI I) l) \\<Longrightarrow>\n l \\<in> nodes (graphI I) \\<Longrightarrow> \ncard (agra (graphI I) l) \\<ge> 3 \\<Longrightarrow>\ncard (egra (graphI y) l) \\<ge> 3\"\n  apply (subgoal_tac \"(inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI y) x)) \n           (actors_graph (InfrastructureThree.graphI y)))\")\n  prefer 2\n  apply (smt (verit, ccfv_SIG) InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.ran_efids_list_disjoint_refl disjoint_iff inj_on_def)\n  apply (subgoal_tac \" 3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI y) l)\")\n   prefer 2\n  using numbers_actors_inv_refl apply presburger\n  apply (rule_tac A = \"actors_graph (InfrastructureThree.graphI y)\" and \n                  AO = \"agra (InfrastructureThree.graphI y) l\" and \n                  EO = \"egra (InfrastructureThree.graphI y) l\" in inj_on_leq)\n apply assumption\n  apply (metis (mono_tags, lifting) InfrastructureThree.actors_graph_def InfrastructureThree.same_actors InfrastructureThree.same_nodes mem_Collect_eq subsetI)\n    prefer 3\n    apply assumption\n  using InfrastructureThree.is_there_lem InfrastructureThree.same_nodes apply auto[1]\n  by (metis InfrastructureThree.same_nodes finite_egras_inv_refl)\n\nlemma two_noteq_card_ge_two: \"finite A \\<Longrightarrow> x \\<in> A \\<Longrightarrow> y \\<in> A \\<Longrightarrow> x \\<noteq> y \\<Longrightarrow> 2 \\<le> card A\"\n  by (metis Suc_leI card_Diff1_less_iff card_gt_0_iff ex_in_conv finite_insert insert_Diff insert_iff less_not_le linorder_neqE_nat numeral_2_eq_2) \n\nlemma one_ge_card_imp_one_neq: \"finite S \\<Longrightarrow> 1 \\<le> card S \\<Longrightarrow>\n       \\<exists> A.  A \\<in> S\"\n  by (metis One_nat_def Suc_le_lessD all_not_in_conv card.empty less_not_refl3)\n\nlemma two_ge_card_imp_two_neq: \"finite S \\<Longrightarrow> 2 \\<le> card S \\<Longrightarrow>\n       \\<exists> A B. A \\<noteq> B  \\<and> A \\<in> S \\<and> B \\<in> S\"\n  by (meson card_2_iff' in_mono obtain_subset_with_card_n)\n\nlemma three_ge_card_imp_three_neqO: \"finite S \\<Longrightarrow> 3 \\<le> card S \\<Longrightarrow>\n       \\<exists> A B E. A \\<noteq> B \\<and> A \\<noteq> E \\<and> B \\<noteq> E \\<and> A \\<in> S \\<and> B \\<in> S \\<and> E \\<in> S\"\n  by (metis Suc_le_lessD card_2_iff' less_imp_le_nat less_not_le numeral_2_eq_2 numeral_3_eq_3 two_ge_card_imp_two_neq)\n\nlemma three_ge_card_imp_three_neq: \"finite S \\<Longrightarrow> 3 \\<le> card S \\<Longrightarrow>\n       \\<exists> A B E. A \\<noteq> B \\<and> A \\<noteq> E \\<and> B \\<noteq> E \\<and> A \\<in> S \\<and> B \\<in> S\"\n  using three_ge_card_imp_three_neqO by fastforce\n\nlemma three_ge_card_imp_two_neq_Eve: \"finite S \\<Longrightarrow> 3 \\<le> card S \\<Longrightarrow>\n       \\<exists>A B. A \\<noteq> B \\<and> A \\<noteq> ''Eve'' \\<and> B \\<noteq> ''Eve'' \\<and> A \\<in> S \\<and> B \\<in> S\"\n  by (smt (verit, ccfv_SIG) card_2_iff' dual_order.antisym numeral_eq_iff obtain_subset_with_card_n order_refl semiring_norm(89) three_ge_card_imp_three_neq two_noteq_card_ge_two)\n\nlemma last_lemOOO[rule_format]: \"\\<forall> z z'. z \\<rightarrow>\\<^sub>n z' \\<longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z). a \\<noteq> a' \\<longrightarrow> \n(range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter> \n range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a'))) = {})) \\<longrightarrow>\n(inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI z) x)) \n           (actors_graph (InfrastructureThree.graphI z))) \\<longrightarrow>\n        (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). \n               inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<longrightarrow>\n           (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>\n                a \\<in>  agra (graphI z) l \\<longrightarrow>  a \\<in>  agra (graphI z) l' \\<longrightarrow> l = l')) \\<longrightarrow>\n(\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI z) \\<longrightarrow>  a \\<in>  agra (graphI z) l \\<longrightarrow>\n            efids_cur ((InfrastructureThree.cgra (graphI z) a)) \\<in> egra (graphI z) l)) \\<longrightarrow>\n(\\<forall> l \\<in> nodes (graphI z). finite(egra (graphI z) l)) \\<longrightarrow>\n(\\<forall> l \\<in> nodes (graphI z). finite(agra (graphI z) l)) \\<longrightarrow>\n(\\<forall> l \\<in> nodes (graphI z). card (agra (graphI z) l) \\<ge> 3) \\<longrightarrow>\n(\\<forall> l \\<in> nodes (graphI z). card (egra (graphI z) l) \\<ge> 3) \\<longrightarrow>\n (\\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n  {(Id, Eid).\n     (Id, Eid) \\<in> InfrastructureThree.kgra (InfrastructureThree.graphI z) ''Eve'' l \\<and> Id \\<noteq> ''Eve'' \\<and> Eid = eid} \\<noteq> {}\n   \\<longrightarrow>  2 \\<le> card {(Id, Eid).\n       (Id, Eid) \\<in> InfrastructureThree.kgra (InfrastructureThree.graphI z) ''Eve'' l \\<and> Id \\<noteq> ''Eve'' \\<and> Eid = eid})\n\\<longrightarrow>  (\\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z').\n  {(Id, Eid).\n     (Id, Eid) \\<in> InfrastructureThree.kgra (InfrastructureThree.graphI z') ''Eve'' l \\<and> Id \\<noteq> ''Eve'' \\<and> Eid = eid} \\<noteq> {}\n   \\<longrightarrow>  2 \\<le> card {(Id, Eid).\n       (Id, Eid) \\<in> InfrastructureThree.kgra (InfrastructureThree.graphI z') ''Eve'' l \\<and> Id \\<noteq> ''Eve'' \\<and> Eid = eid})\"\n  apply (rule allI)+\n  apply (rule impI)\n  apply (rule InfrastructureThree.state_transition_in.cases, assumption)\n    apply (simp add: move_graph_a_def)\n  using InfrastructureThree.gra.simps InfrastructureThree.nodes_def apply presburger\n   prefer 2\n  apply (simp add: put_graph_efid_def)\n  using InfrastructureThree.graphI.simps InfrastructureThree.same_nodes0 apply presburger\n  apply (rule impI)+\n  apply (rule ballI)\n  apply (rule impI)\n(* *)\n  apply simp\n  apply (erule exE)\n  apply (erule conjE)\n(*\n  apply (subgoal_tac \"(\\<forall> l \\<in> nodes (graphI z'). card (agra (graphI z') l) \\<ge> 3)\n                   \\<and> (\\<forall> l \\<in> nodes (graphI z'). card (egra (graphI z') l) \\<ge> 3)\")\n   prefer 2\n   apply (rule conjI)\n  using InfrastructureThree.same_nodes0 apply force\n   apply (rule ballI)\n   apply (rule_tac I = z in numbers_egras_inv, force)\n          apply simp+\n  using InfrastructureThree.graphI.simps InfrastructureThree.same_nodes0 apply presburger\n   apply (metis InfrastructureThree.same_nodes0)\n*)\n  apply (rule conjI)\n   apply (rule impI)+\n   apply (rule conjI)\n    apply (rule impI)+\n    defer\n    apply fastforce\n   apply (rule impI)+\n  apply (rule conjI)\n  using InfrastructureThree.same_nodes0 apply force\n  using InfrastructureThree.same_nodes0 apply force\n  apply simp\n  apply (erule conjE)\n  (*   aa \\<noteq> a \\<Longrightarrow>\n       la = l \\<Longrightarrow>\n       ''Eve'' = a \\<Longrightarrow>\n       aa \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<Longrightarrow>\n       eid \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<Longrightarrow>\n       2 \\<le> card {(Id, Eid).\n                  Id \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<and>\n                  Eid \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<and> Id \\<noteq> a \\<and> Eid = eid} *)\n  apply (subgoal_tac \"3 \\<le> card (InfrastructureThree.agra (InfrastructureThree.graphI I) l)\")\n   prefer 2\n   apply fastforce\n(*\n  apply (subgoal_tac \"3 \\<le> card(InfrastructureThree.egra (InfrastructureThree.graphI I) l)\")\n  prefer 2\n  apply fastforce\n*)\n  apply (subgoal_tac \"? A B. A \\<noteq> B \\<and> A \\<noteq> ''Eve'' \\<and> B \\<noteq> ''Eve'' \\<and> A \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l\n                         \\<and> B \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l\")\n(*\n   apply (subgoal_tac \"? id od ad. id \\<noteq> od \\<and> od \\<noteq> ad \\<and> id \\<noteq> ad \\<and> {id, od, ad} \\<subseteq> InfrastructureThree.egra (InfrastructureThree.graphI I) l\")\n*)\n    apply (erule exE)+\n  apply (erule conjE)+\n  apply (subgoal_tac \"(A, eid) \\<in> {(Id, Eid).\n                  Id \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<and>\n                  Eid \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<and> Id \\<noteq> a \\<and> Eid = eid}\")\n  prefer 2\n  apply force\n  apply (subgoal_tac \"(B, eid) \\<in> {(Id, Eid).\n                  Id \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<and>\n                  Eid \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<and> Id \\<noteq> a \\<and> Eid = eid}\")\n    prefer 2\n    apply force\n   apply (subgoal_tac \"(A,eid) \\<noteq> (B, eid)\")\n  prefer 2\n    apply blast\n  apply (subgoal_tac \"finite({(Id, Eid).\n                  Id \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<and>\n                  Eid \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<and> Id \\<noteq> a \\<and> Eid = eid})\")\n    apply (rule two_noteq_card_ge_two, assumption)\n      prefer 3\n  apply assumption+\n      defer\n  apply (subgoal_tac \"finite(InfrastructureThree.agra (InfrastructureThree.graphI I) l)\")\n  using three_ge_card_imp_two_neq_Eve apply presburger\n   apply fastforce\n  apply (subgoal_tac \"{(Id, Eid).\n         Id \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<and>\n         Eid \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l \\<and> Id \\<noteq> a \\<and> Eid = eid} \\<subseteq>\n        {(Id, Eid).\n         Id \\<in> InfrastructureThree.agra (InfrastructureThree.graphI I) l \\<and>\n         Eid \\<in> InfrastructureThree.egra (InfrastructureThree.graphI I) l}\")\n   apply (erule finite_subset)\n   apply (simp add: finite_cartesian_product_iff)\n  by force\n\nlemma last_lemOOOa: \"z \\<rightarrow>\\<^sub>n z' \\<Longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI z). a \\<noteq> a' \\<longrightarrow> \n(range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a)) \\<inter> \n range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a'))) = {})) \\<Longrightarrow>\n(inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI z) x)) \n           (actors_graph (InfrastructureThree.graphI z))) \\<Longrightarrow>\n        (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI z). \n               inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI z) a))) \\<Longrightarrow>\n           (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI z) \\<longrightarrow>\n                a \\<in>  agra (graphI z) l \\<longrightarrow>  a \\<in>  agra (graphI z) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n(\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI z) \\<longrightarrow>  a \\<in>  agra (graphI z) l \\<longrightarrow>\n            efids_cur ((InfrastructureThree.cgra (graphI z) a)) \\<in> egra (graphI z) l)) \\<Longrightarrow>\n(\\<forall> l \\<in> nodes (graphI z). finite(egra (graphI z) l)) \\<Longrightarrow>\n(\\<forall> l \\<in> nodes (graphI z). finite(agra (graphI z) l)) \\<Longrightarrow>\n(\\<forall> l \\<in> nodes (graphI z). card (agra (graphI z) l) \\<ge> 3) \\<Longrightarrow>\n(\\<forall> l \\<in> nodes (graphI z). card (egra (graphI z) l) \\<ge> 3) \\<Longrightarrow>\n (\\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z).\n  {(Id, Eid).\n     (Id, Eid) \\<in> InfrastructureThree.kgra (InfrastructureThree.graphI z) ''Eve'' l \\<and> Id \\<noteq> ''Eve'' \\<and> Eid = eid} \\<noteq> {}\n   \\<longrightarrow>  2 \\<le> card {(Id, Eid).\n       (Id, Eid) \\<in> InfrastructureThree.kgra (InfrastructureThree.graphI z) ''Eve'' l \\<and> Id \\<noteq> ''Eve'' \\<and> Eid = eid})\n\\<Longrightarrow>  (\\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI z').\n  {(Id, Eid).\n     (Id, Eid) \\<in> InfrastructureThree.kgra (InfrastructureThree.graphI z') ''Eve'' l \\<and> Id \\<noteq> ''Eve'' \\<and> Eid = eid} \\<noteq> {}\n   \\<longrightarrow>  2 \\<le> card {(Id, Eid).\n       (Id, Eid) \\<in> InfrastructureThree.kgra (InfrastructureThree.graphI z') ''Eve'' l \\<and> Id \\<noteq> ''Eve'' \\<and> Eid = eid})\"\n  apply (rule ballI)\n  apply (rule impI)\n  apply (rule last_lemOOO)\n              apply assumption\n  by simp+\n\nlemma last_lemOO: \"(I, y) \\<in> {(x::infrastructure, y::infrastructure). x \\<rightarrow>\\<^sub>n y}\\<^sup>* \\<Longrightarrow>\n  (\\<forall> l a. kgra (graphI I) a l = {}) \\<Longrightarrow>\n(\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). (\\<forall> a' \\<in> actors_graph(InfrastructureThree.graphI I). a \\<noteq> a' \\<longrightarrow> \n(range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a)) \\<inter> \n range (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a'))) = {})) \n\\<Longrightarrow>\n(inj_on(\\<lambda> x. efids_cur(InfrastructureThree.cgra (InfrastructureThree.graphI I) x)) \n           (actors_graph (InfrastructureThree.graphI I))) \\<Longrightarrow>\n        (\\<forall> a \\<in> actors_graph (InfrastructureThree.graphI I). \n               inj (efids_list (InfrastructureThree.cgra (InfrastructureThree.graphI I) a))) \\<Longrightarrow>\n           (\\<forall> a.\n             (\\<forall> l l'. l \\<in> nodes (graphI I) \\<longrightarrow>\n                a \\<in>  agra (graphI I) l \\<longrightarrow>  a \\<in>  agra (graphI I) l' \\<longrightarrow> l = l')) \\<Longrightarrow>\n(\\<forall> a.\n             (\\<forall> l. l \\<in> nodes (graphI I) \\<longrightarrow>  a \\<in>  agra (graphI I) l \\<longrightarrow>\n            efids_cur ((InfrastructureThree.cgra (graphI I) a)) \\<in> egra (graphI I) l)) \\<Longrightarrow>\n\\<forall> l \\<in> nodes (graphI I). finite(egra (graphI I) l) \\<Longrightarrow>\n(\\<forall> l \\<in> nodes (graphI I). finite(agra (graphI I) l)) \\<Longrightarrow>\n\\<forall> l \\<in> nodes (graphI I). card (agra (graphI I) l) \\<ge> 3 \\<Longrightarrow>\n\\<forall>l\\<in>InfrastructureThree.nodes (InfrastructureThree.graphI y).\n       {(Id, Eid).\n        (Id, Eid) \\<in> InfrastructureThree.kgra (InfrastructureThree.graphI y) ''Eve'' l \\<and> Id \\<noteq> ''Eve'' \\<and> Eid = eid} \\<noteq>\n       {} \\<longrightarrow>\n       2 \\<le> card {(Id, Eid).\n                  (Id, Eid) \\<in> InfrastructureThree.kgra (InfrastructureThree.graphI y) ''Eve'' l \\<and>\n                  Id \\<noteq> ''Eve'' \\<and> Eid = eid}\"\n  apply (erule rtrancl_induct, simp)\n  apply (rule last_lemOOOa)\n  apply simp\n  using InfrastructureThree.ran_efids_list_disjoint_refl apply presburger\n  apply (smt (z3) InfrastructureThree.efids_cur_in_efids_listO InfrastructureThree.same_actors efids_list_eq_refl inj_onI insert_Diff insert_disjoint(2))\n  apply (metis InfrastructureThree.same_actors efids_list_eq_refl)\n  using InfrastructureThree.actor_unique_loc_lem apply presburger\n  using InfrastructureThree.is_there_lem apply auto[1]\n  using finite_egras_inv_refl apply presburger\n  using finite_agras_inv_refl apply presburger\n  apply (simp add: InfrastructureThree.same_nodes numbers_actors_inv_refl)\n  using InfrastructureThree.same_nodes inj_on_cong numbers_egras_inv apply auto[1]\n  by assumption\n\n\nend\n\n ", "meta": {"author": "flokam", "repo": "CoronaApp", "sha": "6258178b8f9d10f43e0825d99cbb0126ee51612c", "save_path": "github-repos/isabelle/flokam-CoronaApp", "path": "github-repos/isabelle/flokam-CoronaApp/CoronaApp-6258178b8f9d10f43e0825d99cbb0126ee51612c/IsabelleCorona/InfrastructureThree.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7057850154599563, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.306297614845954}}
{"text": "theory Outer_Friend_Issuer\n  imports\n    \"Outer_Friend_Issuer_Value_Setup\"\n    \"Bounded_Deducibility_Security.Compositional_Reasoning\"\nbegin\n\nsubsubsection \\<open>Declassification bound\\<close>\n\n(* We verify the following:\n   Given an arbitrary but fixed user UID at node AID (who is not an observer) and a set of\n   observers at each network node, the observers may learn about the *occurrence* of remote\n   friendship actions of UID (because network traffic is assumed to be observable), but they\n   learn nothing about the *content* of those actions (who was added or deleted as a friend)\n   beyond public knowledge (friendship addition and deletion occur alternatingly),\n   except if the action adds or deletes one of the observers themselves as friend.\n*)\n\ncontext OuterFriendIssuer\nbegin\n\nfun T :: \"(state,act,out) trans \\<Rightarrow> bool\"\nwhere \"T trn = False\"\n\ntext \\<open>For each user \\<open>uid\\<close> at a node \\<open>aid\\<close>, the remote friendship updates with\nthe fixed user \\<open>UID\\<close> at node \\<open>AID\\<close> form an alternating sequence of friending and unfriending.\n\nNote that actions involving remote users who are observers do not produce secret values;\ninstead, those actions are observable, and the property we verify does not protect their\nconfidentiality.\\<close>\n\nfun validValSeq :: \"value list \\<Rightarrow> (apiID \\<times> userID) list \\<Rightarrow> bool\" where\n  \"validValSeq [] _ = True\"\n| \"validValSeq (FrVal aid uid True # vl) auidl \\<longleftrightarrow> (aid, uid) \\<notin> set auidl \\<and> uid \\<notin> UIDs aid \\<and> validValSeq vl (auidl ## (aid, uid))\"\n| \"validValSeq (FrVal aid uid False # vl) auidl \\<longleftrightarrow> (aid, uid) \\<in>\\<in> auidl \\<and> uid \\<notin> UIDs aid \\<and> validValSeq vl (removeAll (aid, uid) auidl)\"\n| \"validValSeq (OVal _ # vl) auidl = validValSeq vl auidl\"\n\nabbreviation validValSeqFrom :: \"value list \\<Rightarrow> state \\<Rightarrow> bool\" where\n  \"validValSeqFrom vl s \\<equiv> validValSeq vl (removeUIDs (sentOuterFriendIDs s UID))\"\n\ntext \\<open>When the access window is closed, observers may learn about the occurrence of\nremote friendship actions (by observing network traffic), but not their content;\nthe actions can be replaced by different actions involving different users (who are not observers)\nwithout affecting the observations.\\<close>\n\ninductive BC :: \"value list \\<Rightarrow> value list \\<Rightarrow> bool\"\nwhere\n  BC_Nil[simp,intro]: \"BC [] []\"\n| BC_FrVal[intro]:\n    \"BC vl vl1 \\<Longrightarrow> uid' \\<notin> UIDs aid \\<Longrightarrow> BC (FrVal aid uid st # vl) (FrVal aid uid' st' # vl1)\"\n\ntext \\<open>When the access window is open, i.e.~the user \\<open>UID\\<close> is a local friend of an observer,\nall information about the remote friends of \\<open>UID\\<close> is declassified;\nwhen the access window closes again, the contents of future updates are kept confidential.\\<close>\n\ndefinition \"BO vl vl1 \\<equiv>\n (vl1 = vl) \\<or>\n (\\<exists>vl0 vl' vl1'. vl = vl0 @ OVal False # vl' \\<and> vl1 = vl0 @ OVal False # vl1' \\<and> BC vl' vl1')\"\n\ndefinition \"B vl vl1 \\<equiv> (BC vl vl1 \\<or> BO vl vl1) \\<and> validValSeqFrom vl1 istate\"\n\n\nlemma B_Nil_Nil: \"B vl vl1 \\<Longrightarrow> vl1 = [] \\<longleftrightarrow> vl = []\"\nunfolding B_def BO_def by (auto elim: BC.cases)\n\nsublocale BD_Security_IO where\nistate = istate and step = step and\n\\<phi> = \\<phi> and f = f and \\<gamma> = \\<gamma> and g = g and T = T and B = B\ndone\n\n\nsubsubsection \\<open>Unwinding proof\\<close>\n\ndefinition \\<Delta>0 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>0 s vl s1 vl1 \\<equiv>\n s1 = istate \\<and> s = istate \\<and> B vl vl1\"\n\n\ndefinition \\<Delta>1 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>1 s vl s1 vl1 \\<equiv>\n BO vl vl1 \\<and>\n s1 = s \\<and>\n validValSeqFrom vl1 s1\"\n\n\ndefinition \\<Delta>2 :: \"state \\<Rightarrow> value list \\<Rightarrow> state \\<Rightarrow> value list \\<Rightarrow> bool\" where\n\"\\<Delta>2 s vl s1 vl1 \\<equiv>\n BC vl vl1 \\<and>\n eqButUID s s1 \\<and> \\<not>open s1 \\<and>\n validValSeqFrom vl1 s1\"\n\n\nlemma validValSeq_prefix: \"validValSeq (vl @ vl') auidl \\<Longrightarrow> validValSeq vl auidl\"\nby (induction vl arbitrary: auidl) (auto elim: validValSeq.elims)\n\nlemma filter_removeAll: \"filter P (removeAll x xs) = removeAll x (filter P xs)\"\nunfolding removeAll_filter_not_eq by (auto intro: filter_cong)\n\nlemma step_validValSeqFrom:\nassumes step: \"step s a = (ou, s')\"\nand rs: \"reach s\"\nand c: \"consume (Trans s a ou s') vl vl'\" (is \"consume ?trn vl vl'\")\nand vVS: \"validValSeqFrom vl s\"\nshows \"validValSeqFrom vl' s'\"\nproof cases\n  assume \"\\<phi> ?trn\"\n  moreover then obtain v where \"vl = v # vl'\" using c by (cases vl, auto simp: consume_def)\n  moreover have \"distinct (sentOuterFriendIDs s UID)\" using rs by (intro reach_distinct_friends_reqs)\n  ultimately show ?thesis using assms\n    by (elim \\<phi>E)\n       (auto simp: com_defs c_defs d_defs consume_def distinct_remove1_removeAll filter_removeAll)\nnext\n  assume n\\<phi>: \"\\<not>\\<phi> ?trn\"\n  then have vl': \"vl' = vl\" using c by (auto simp: consume_def)\n  then show ?thesis using vVS step proof (cases a)\n    case (Sact sa) then show ?thesis using assms vl' by (cases sa) (auto simp: s_defs) next\n    case (Cact ca) then show ?thesis using assms vl' by (cases ca) (auto simp: c_defs) next\n    case (Dact da) then show ?thesis using assms vl' by (cases da) (auto simp: d_defs) next\n    case (Uact ua) then show ?thesis using assms vl' by (cases ua) (auto simp: u_defs) next\n    case (COMact ca) then show ?thesis using assms vl' n\\<phi> by (cases ca) (auto simp: com_defs filter_remove1)\n  qed auto\nqed\n\nlemma istate_\\<Delta>0:\nassumes B: \"B vl vl1\"\nshows \"\\<Delta>0 istate vl istate vl1\"\nusing assms unfolding \\<Delta>0_def\nby auto\n\nlemma unwind_cont_\\<Delta>0: \"unwind_cont \\<Delta>0 {\\<Delta>1,\\<Delta>2}\"\nproof(rule, simp)\n  let ?\\<Delta> = \"\\<lambda>s vl s1 vl1. \\<Delta>1 s vl s1 vl1 \\<or>\n                           \\<Delta>2 s vl s1 vl1\"\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\<Delta>0: \"\\<Delta>0 s vl s1 vl1\"\n  then have rs: \"reach s\" and s: \"s = istate\" and s1: \"s1 = istate\" and B: \"B vl vl1\"\n    using reachNT_reach unfolding \\<Delta>0_def by auto\n  show \"iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof-\n    have ?react proof\n      fix a :: act and ou :: out and s' :: state and vl'\n      let ?trn = \"Trans s a ou s'\"\n      assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n      show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n      proof (intro disjI1)\n        obtain uid p where a: \"a = Sact (sSys uid p) \\<or> s' = s\"\n          using step unfolding s by (elim istate_sSys) auto\n        have \"\\<not>open s'\" using step a s by (auto simp: istate_def s_defs open_def)\n        moreover then have \"\\<not>\\<phi> ?trn\" using step rs a by (auto elim!: \\<phi>E simp: s istate_def com_defs)\n        moreover have \"sentOuterFriendIDs s' UID = sentOuterFriendIDs s UID\"\n          using s a step by (auto simp: s_defs)\n        ultimately show \"?match\" using s s1 step B c unfolding \\<Delta>1_def \\<Delta>2_def B_def\n          by (intro matchI[of s1 a ou s' vl1 vl1]) (auto simp: consume_def)\n      qed\n    qed\n    with B_Nil_Nil[OF B] show ?thesis by auto\n  qed\nqed\n\n\nlemma unwind_cont_\\<Delta>1: \"unwind_cont \\<Delta>1 {\\<Delta>1,\\<Delta>2}\"\nproof(rule, simp)\n  let ?\\<Delta> = \"\\<lambda>s vl s1 vl1. \\<Delta>1 s vl s1 vl1 \\<or>\n                           \\<Delta>2 s vl s1 vl1\"\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\<Delta>0: \"\\<Delta>1 s vl s1 vl1\"\n  then have rs: \"reach s\" and s: \"s1 = s\" and BO: \"BO vl vl1\"\n        and vVS1: \"validValSeqFrom vl1 s1\"\n    using reachNT_reach unfolding \\<Delta>1_def by auto\n  show \"iaction ?\\<Delta> s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction ?\\<Delta> s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof-\n    have ?react proof\n      fix a :: act and ou :: out and s' :: state and vl'\n      let ?trn = \"Trans s a ou s'\"\n      assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n      show \"match ?\\<Delta> s s1 vl1 a ou s' vl' \\<or> ignore ?\\<Delta> s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n      proof cases\n        assume \\<phi>: \"\\<phi> ?trn\"\n        consider (Eq) \"vl1 = vl\"\n          | (BC) vl0 vl'' vl1'' where \"vl = vl0 @ OVal False # vl''\"\n                                and \"vl1 = vl0 @ OVal False # vl1''\"\n                                and \"BC vl'' vl1''\"\n          using BO\n          by (auto simp: BO_def)\n        then have \"?match\"\n        proof cases\n          case Eq\n          then show ?thesis\n            using step s c vVS1 step_validValSeqFrom[OF step rs c]\n            by (intro matchI[of s1 a ou s' vl1 vl']) (auto simp: \\<Delta>1_def BO_def)\n        next\n          case BC\n          show \"?match\" proof (cases vl0)\n            case Nil\n              then have \"consume ?trn vl1 vl1''\" and \"vl' = vl''\" and f: \"f ?trn = OVal False\"\n                using \\<phi> c BC by (auto simp: consume_def)\n              moreover then have \"validValSeqFrom vl1'' s'\"\n                using s rs vVS1 by (intro step_validValSeqFrom[OF step]) auto\n              moreover have \"\\<not>open s'\" using \\<phi> step rs f by (auto elim: \\<phi>E)\n              ultimately show ?thesis\n                using step s BC by (intro matchI[of s1 a ou s' vl1 vl1'']) (auto simp: \\<Delta>2_def)\n          next\n            case (Cons v vl0')\n              then have \"consume ?trn vl1 (vl0' @ OVal False # vl1'')\" and \"vl' = vl0' @ OVal False # vl''\"\n                using \\<phi> c BC by (auto simp: consume_def)\n              moreover then have \"validValSeqFrom (vl0' @ OVal False # vl1'') s'\"\n                using s rs vVS1 by (intro step_validValSeqFrom[OF step]) auto\n              ultimately show ?thesis\n                using step s BC\n                by (intro matchI[of s1 a ou s' vl1 \"(vl0' @ OVal False # vl1'')\"]) (auto simp: \\<Delta>1_def BO_def)\n          qed\n        qed\n        then show \"?match \\<or> ?ignore\" ..\n      next\n        assume n\\<phi>: \"\\<not>\\<phi> ?trn\"\n        then have \"consume ?trn vl1 vl1\" and \"vl' = vl\" using c by (auto simp: consume_def)\n        moreover then have \"validValSeqFrom vl1 s'\"\n          using s rs vVS1 by (intro step_validValSeqFrom[OF step]) auto\n        ultimately have \"?match\"\n          using step s BO by (intro matchI[of s1 a ou s' vl1 vl1]) (auto simp: \\<Delta>1_def)\n        then show \"?match \\<or> ?ignore\" ..\n      qed\n    qed\n    with BO show ?thesis by (auto simp: BO_def)\n  qed\nqed\n\nlemma unwind_cont_\\<Delta>2: \"unwind_cont \\<Delta>2 {\\<Delta>2}\"\nproof(rule, simp)\n  fix s s1 :: state and vl vl1 :: \"value list\"\n  assume rsT: \"reachNT s\" and rs1: \"reach s1\" and \\<Delta>2: \"\\<Delta>2 s vl s1 vl1\"\n  then have rs: \"reach s\" and ss1: \"eqButUID s s1\" and BC: \"BC vl vl1\"\n        and os: \"\\<not>open s1\" and vVS1: \"validValSeqFrom vl1 s1\"\n    using reachNT_reach unfolding \\<Delta>2_def by auto\n  show \"iaction \\<Delta>2 s vl s1 vl1 \\<or>\n        ((vl = [] \\<longrightarrow> vl1 = []) \\<and> reaction \\<Delta>2 s vl s1 vl1)\" (is \"?iact \\<or> (_ \\<and> ?react)\")\n  proof-\n    have ?react proof\n      fix a :: act and ou :: out and s' :: state and vl'\n      let ?trn = \"Trans s a ou s'\"\n      assume step: \"step s a = (ou, s')\" and T: \"\\<not> T ?trn\" and c: \"consume ?trn vl vl'\"\n      show \"match \\<Delta>2 s s1 vl1 a ou s' vl' \\<or> ignore \\<Delta>2 s s1 vl1 a ou s' vl'\" (is \"?match \\<or> ?ignore\")\n      proof cases\n        assume \\<phi>: \"\\<phi> ?trn\"\n        with BC c have \"?match\" proof (cases rule: BC.cases)\n          case (BC_FrVal vl'' vl1'' uid' aid uid st st')\n            then show ?thesis proof (cases st')\n              case True\n                let ?a1 = \"COMact (comSendCreateOFriend UID (pass s1 UID) aid uid')\"\n                let ?ou1 = \"O_sendCreateOFriend (aid, clientPass s aid, UID, uid')\"\n                let ?s1' = \"snd (sendCreateOFriend s1 UID (pass s1 UID) aid uid')\"\n                let ?trn1 = \"Trans s1 ?a1 ?ou1 ?s1'\"\n                have c1: \"consume ?trn1 vl1 vl1''\" and \"vl' = vl''\" and \"f ?trn = FrVal aid uid st\"\n                  using \\<phi> c BC_FrVal True by (auto simp: consume_def)\n                moreover then have a: \"(a = COMact (comSendCreateOFriend UID (pass s UID) aid uid)\n                                        \\<and> ou = O_sendCreateOFriend (aid, clientPass s aid, UID, uid))\n                                     \\<or> (a = COMact (comSendDeleteOFriend UID (pass s UID) aid uid)\n                                        \\<and> ou = O_sendDeleteOFriend (aid, clientPass s aid, UID, uid))\"\n                               and IDs: \"IDsOK s [UID] [] [] [aid]\"\n                               and uid: \"uid \\<notin> UIDs aid\"\n                  using \\<phi> step rs by (auto elim!: \\<phi>E split: prod.splits simp: com_defs)\n                moreover have step1: \"step s1 ?a1 = (?ou1, ?s1')\"\n                  using IDs vVS1 BC_FrVal True ss1 by (auto simp: com_defs eqButUID_def)\n                moreover then have \"validValSeqFrom vl1'' ?s1'\"\n                  using vVS1 rs1 c1 by (intro step_validValSeqFrom[OF step1]) auto\n                moreover have \"\\<not>open ?s1'\" using os by (auto simp: open_def com_defs)\n                moreover have \"eqButUID s' ?s1'\"\n                  using ss1 step a uid BC_FrVal(4) eqButUID_eqButUIDf[OF ss1] eqButUID_eqButUIDs[OF ss1]\n                  by (auto split: prod.splits simp: com_defs filter_remove1 intro!: eqButUID_cong eqButUIDf_cong)\n                moreover have \"\\<gamma> ?trn = \\<gamma> ?trn1\" and \"g ?trn = g ?trn1\"\n                  using BC_FrVal a uid by (auto simp: com_defs)\n                ultimately show \"?match\"\n                  using BC_FrVal by (intro matchI[of s1 ?a1 ?ou1 ?s1' vl1 vl1'']) (auto simp: \\<Delta>2_def)\n            next\n              case False\n                let ?a1 = \"COMact (comSendDeleteOFriend UID (pass s1 UID) aid uid')\"\n                let ?ou1 = \"O_sendDeleteOFriend (aid, clientPass s aid, UID, uid')\"\n                let ?s1' = \"snd (sendDeleteOFriend s1 UID (pass s1 UID) aid uid')\"\n                let ?trn1 = \"Trans s1 ?a1 ?ou1 ?s1'\"\n                have c1: \"consume ?trn1 vl1 vl1''\" and \"vl' = vl''\" and \"f ?trn = FrVal aid uid st\"\n                  using \\<phi> c BC_FrVal False by (auto simp: consume_def)\n                moreover then have a: \"(a = COMact (comSendCreateOFriend UID (pass s UID) aid uid)\n                                        \\<and> ou = O_sendCreateOFriend (aid, clientPass s aid, UID, uid))\n                                     \\<or> (a = COMact (comSendDeleteOFriend UID (pass s UID) aid uid)\n                                        \\<and> ou = O_sendDeleteOFriend (aid, clientPass s aid, UID, uid))\"\n                               and IDs: \"IDsOK s [UID] [] [] [aid]\"\n                               and uid: \"uid \\<notin> UIDs aid\"\n                  using \\<phi> step rs by (auto elim!: \\<phi>E split: prod.splits simp: com_defs)\n                moreover have step1: \"step s1 ?a1 = (?ou1, ?s1')\"\n                  using IDs vVS1 BC_FrVal False ss1 by (auto simp: com_defs eqButUID_def)\n                moreover then have \"validValSeqFrom vl1'' ?s1'\"\n                  using vVS1 rs1 c1 by (intro step_validValSeqFrom[OF step1]) auto\n                moreover have \"\\<not>open ?s1'\" using os by (auto simp: open_def com_defs)\n                moreover have \"eqButUID s' ?s1'\"\n                  using ss1 step a uid BC_FrVal(4) eqButUID_eqButUIDf[OF ss1] eqButUID_eqButUIDs[OF ss1]\n                  by (auto split: prod.splits simp: com_defs filter_remove1 intro!: eqButUID_cong eqButUIDf_cong)\n                moreover have \"\\<gamma> ?trn = \\<gamma> ?trn1\" and \"g ?trn = g ?trn1\"\n                  using BC_FrVal a uid by (auto simp: com_defs)\n                ultimately show \"?match\"\n                  using BC_FrVal by (intro matchI[of s1 ?a1 ?ou1 ?s1' vl1 vl1'']) (auto simp: \\<Delta>2_def)\n            qed\n        qed (auto simp: consume_def)\n        then show \"?match \\<or> ?ignore\" ..\n      next\n        assume n\\<phi>: \"\\<not>\\<phi> ?trn\"\n        then have vl': \"vl' = vl\" using c by (auto simp: consume_def)\n        obtain ou1 s1' where step1: \"step s1 a = (ou1, s1')\" by (cases \"step s1 a\")\n        let ?trn1 = \"Trans s1 a ou1 s1'\"\n        show \"?match \\<or> ?ignore\"\n        proof (cases \"\\<forall>aID uID'. uID' \\<notin> UIDs aID \\<longrightarrow>\n                                 a \\<noteq> COMact (comSendCreateOFriend UID (pass s UID) aID uID') \\<and>\n                                 a \\<noteq> COMact (comSendDeleteOFriend UID (pass s UID) aID uID')\")\n          case True\n            then have n\\<phi>1: \"\\<not>\\<phi> ?trn1\"\n              using n\\<phi> ss1 rs rs1 step step1 by (auto simp: eqButUID_step_\\<phi>)\n            have \"?match\" using step1 unfolding vl' proof (intro matchI[of s1 a ou1 s1' vl1 vl1])\n              show c1: \"consume ?trn1 vl1 vl1\" using n\\<phi>1 by (auto simp: consume_def)\n              show \"\\<Delta>2 s' vl s1' vl1\" using BC unfolding \\<Delta>2_def proof (intro conjI)\n                show \"eqButUID s' s1'\" using eqButUID_step[OF ss1 step step1 rs rs1] .\n                show \"\\<not>open s1'\" proof\n                  assume \"open s1'\"\n                  with os have \"open s1 \\<noteq> open s1'\" by auto\n                  then show \"False\" using step1 n\\<phi>1 by (elim open_step_cases[of s1 s1']) auto\n                qed\n                show \"validValSeqFrom vl1 s1'\"\n                  using c1 rs1 vVS1 by (intro step_validValSeqFrom[OF step1]) auto\n              qed auto\n              show \"\\<gamma> ?trn = \\<gamma> ?trn1\" using ss1 rs rs1 step step1 True by (intro eqButUID_step_\\<gamma>) auto\n            next\n              assume \"\\<gamma> ?trn\"\n              then have \"ou = ou1\" using os n\\<phi> n\\<phi>1 by (intro eqButUID_step_\\<gamma>_out[OF ss1 step step1]) auto\n              then show \"g ?trn = g ?trn1\" by (cases a) auto\n            qed auto\n            then show \"?match \\<or> ?ignore\" ..\n        next\n          case False\n            with n\\<phi> have \"?ignore\"\n              using UID_UIDs BC step ss1 os vVS1 unfolding vl'\n              by (intro ignoreI) (auto simp: \\<Delta>2_def split: prod.splits)\n            then show \"?match \\<or> ?ignore\" ..\n        qed\n      qed\n    qed\n    with BC show ?thesis by (cases rule: BC.cases) auto\n  qed\nqed\n\ndefinition Gr where\n\"Gr =\n {\n (\\<Delta>0, {\\<Delta>1,\\<Delta>2}),\n (\\<Delta>1, {\\<Delta>1,\\<Delta>2}),\n (\\<Delta>2, {\\<Delta>2})\n }\"\n\n\ntheorem secure: secure\napply (rule unwind_decomp_secure_graph[of Gr \\<Delta>0])\nunfolding Gr_def\napply (simp, smt insert_subset order_refl)\nusing\nistate_\\<Delta>0 unwind_cont_\\<Delta>0 unwind_cont_\\<Delta>1 unwind_cont_\\<Delta>2\nunfolding Gr_def by (auto intro: unwind_cont_mono)\n\nend\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/CoSMeDis/Outer_Friend_Confidentiality/Issuer/Outer_Friend_Issuer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702761768248, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.30626105132374914}}
{"text": "(*\n * Copyright 2017, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * Author: Zhe Hou.\n *)\n\ntheory Separata_Pointers\nimports Main Separata_Advanced\nbegin\n\nabbreviation (input)\npred_eq :: \"'a \\<Rightarrow> 'a \\<Rightarrow> 'c \\<Rightarrow> bool\" (infixr \"eq\" 50) where\n\"a eq b \\<equiv> \\<lambda>s. a = b\"  \n  \ntext {* In the heap model, 'b are the addresses, 'c are the values, 'a \nare the heaps. *}  \n  \nlocale pointsto_algebra = \n  fixes pointsto :: \"'a \\<Rightarrow> 'b \\<Rightarrow> ('c::heap_sep_algebra) \\<Rightarrow> bool\" (infix \"\\<mapsto>\" 40)\n    \n  assumes pointsto_inject: \"\\<lbrakk>(n \\<mapsto> l) h1; (n \\<mapsto> l) h2\\<rbrakk> \\<Longrightarrow> h1 = h2\"  \nbegin\n\nlemma lssl_l5: \n\"Gamma \\<and> h1 = h2 \\<and> (n \\<mapsto> l) h1 \\<longrightarrow> Delta \\<Longrightarrow>\n Gamma \\<and> (n \\<mapsto> l) h1 \\<and> (n \\<mapsto> l) h2 \\<longrightarrow> Delta\"\nusing local.pointsto_inject by blast\n\nlemma lssl_l5_inv: \n\"Gamma \\<and> (n \\<mapsto> l) h1 \\<and> (n \\<mapsto> l) h2 \\<longrightarrow> Delta \\<Longrightarrow> \n Gamma \\<and> h1 = h2 \\<and> (n \\<mapsto> l) h1 \\<longrightarrow> Delta\"\nby auto\n  \nlemma lssl_l5_der: \"(n \\<mapsto> l) h1 \\<Longrightarrow> (n \\<mapsto> l) h2 \\<Longrightarrow> h1 = h2\"\nby (simp add: local.pointsto_inject)  \n  \ntext {* Operations about pointers. *}  \n  \ndefinition substate:: \"'c \\<Rightarrow> 'c \\<Rightarrow> bool\" (infix \"\\<sqsubseteq>\" 40) where\n\"h1 \\<sqsubseteq> h2 \\<equiv> \\<exists>h3. (h1,h3\\<triangleright>h2)\"  \n  \ndefinition state_as_fun:: \"'c \\<Rightarrow> 'a \\<Rightarrow> 'b option\" (infix \"\\<restriction>\" 100) where\n\"h\\<restriction>a \\<equiv> \n  let P = (\\<lambda>v h a. \\<exists>h'. h' \\<sqsubseteq> h \\<and> (a \\<mapsto> v) h') in\n  if  \\<exists>v. P v h a then \n    Some (SOME v. P v h a) \n  else None\"\n\ndefinition set_val:: \"'c \\<Rightarrow> 'a \\<Rightarrow> 'b \\<Rightarrow> 'c\" where\n\"set_val h a v \\<equiv> SOME h'. (\\<forall>a'. (a'\\<noteq>a \\<longrightarrow> h'\\<restriction>a' = h\\<restriction>a') \\<and> (h'\\<restriction>a = Some v))\"  \n\ndefinition all_elements:: \"'a set\" where\n\"all_elements \\<equiv> {x. True}\"\n\ndefinition domain:: \"'c \\<Rightarrow> 'a set\" where\n\"domain h \\<equiv> {a. \\<exists>v. h\\<restriction>a = Some v}\"  \n\ndefinition all_domains:: \"'c set \\<Rightarrow> 'a set\" where\n\"all_domains hs \\<equiv> {a. \\<forall>h \\<in> hs. \\<exists>v. h\\<restriction>a = Some v}\"  \n\ndefinition heaps_of_domain:: \"'a set \\<Rightarrow> 'c set\" where\n\"heaps_of_domain d \\<equiv> {h. domain h = d}\" \n\ndefinition full_domain_heaps:: \"'c set\" where\n\"full_domain_heaps \\<equiv> {h. domain h = all_elements}\"\n\ndefinition disjoint_domain::\"'c \\<Rightarrow> 'a set\" where\n\"disjoint_domain h \\<equiv> all_elements - (domain h)\"\n\ndefinition vals:: \"'c \\<Rightarrow> 'b set\" where\n\"vals h \\<equiv> {v. \\<exists>a. h\\<restriction>a = Some v}\"  \n  \ndefinition is_empty:: \"'c \\<Rightarrow> bool\" where\n\"is_empty h \\<equiv> domain h = {}\"  \n\ndefinition get_state:: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'c\" where\n\"get_state a v \\<equiv> THE h. (a \\<mapsto> v) h\"\n\nlemma dom_not_empty: \"(a \\<in> domain h) = (\\<exists>v. (h\\<restriction>a = Some v \\<and> is_empty h = False))\"\nusing domain_def local.is_empty_def by auto\n\nlemma dom_not_none: \"(a \\<in> domain h) \\<Longrightarrow> (h\\<restriction>a \\<noteq> None)\"\nby (simp add: dom_not_empty)      \n  \nend                                            \n  \nlocale reynolds_algebra = pointsto_algebra +    \n  assumes pointsto_no_emp: \"\\<not>((n \\<mapsto> l) 0)\" \n  assumes pointsto_no_larger_than_one: \"\\<lbrakk>(n \\<mapsto> l) h; (h1,h2\\<triangleright>h)\\<rbrakk> \\<Longrightarrow> (h1 = 0) \\<or> (h2 = 0)\"  \n  assumes pointsto_addr_disj: \"\\<lbrakk>(n1 \\<mapsto> l1) h1; (n2 \\<mapsto> l2) h2; (h1,h2\\<triangleright>h)\\<rbrakk> \\<Longrightarrow> \\<not> (n1 = n2)\"  \n  assumes pointsto_unique: \"\\<lbrakk>(n1 \\<mapsto> l1) h; (n2 \\<mapsto> l2) h\\<rbrakk> \\<Longrightarrow> n1 = n2 \\<and> l1 = l2\"\n    \n  assumes pointsto_extend: \"\\<exists>n h1 h2. (h1,h\\<triangleright>h2) \\<and> (n \\<mapsto> l) h1\"  \nbegin  \n  \ntext {* The following are properties of definitions on pointers. *}  \n  \nlemma id_is_empty: \"is_empty 0\"\nby (metis (no_types, lifting) Collect_empty_eq dom_not_none domain_def local.is_empty_def lspasl_iu_eq mem_Collect_eq pointsto_no_emp state_as_fun_def substate_def)\n  \ntext {* The following are more inferences rules for pointers. *}  \n  \nlemma lssl_l1: \"Gamma \\<and> (n \\<mapsto> l) 0 \\<longrightarrow> Delta\"\nby (simp add: local.pointsto_no_emp)\n\nlemma lssl_l2: \n\"\\<lbrakk>Gamma \\<and> (0,h0\\<triangleright>h0) \\<and> (n \\<mapsto> l) h0 \\<and> h1 = 0 \\<and> h2 = h0 \\<longrightarrow> Delta;\n  Gamma \\<and> (h0,0\\<triangleright>h0) \\<and> (n \\<mapsto> l) h0 \\<and> h2 = 0 \\<and> h1 = h0 \\<longrightarrow> Delta\\<rbrakk> \\<Longrightarrow>\n  Gamma \\<and> (h1,h2\\<triangleright>h0) \\<and> (n \\<mapsto> l) h0 \\<longrightarrow> Delta\"\nby (metis heap_sep_algebra_class.lspasl_eq_der2 heap_sep_algebra_class.lspasl_eq_eq pointsto_no_larger_than_one)\n\nlemma lssl_l2_inv:\n\"Gamma \\<and> (h1,h2\\<triangleright>h0) \\<and> (n \\<mapsto> l) h0 \\<longrightarrow> Delta \\<Longrightarrow>\n(Gamma \\<and> (0,h0\\<triangleright>h0) \\<and> (n \\<mapsto> l) h0 \\<and> h1 = 0 \\<and> h0 = h2 \\<longrightarrow> Delta) \\<or> \n(Gamma \\<and> (h0,0\\<triangleright>h0) \\<and> (n \\<mapsto> l) h0 \\<and> h2 = 0 \\<and> h0 = h1 \\<longrightarrow> Delta)\"\nby blast\n\nlemma lssl_l2_der: \n\"(h1,h2\\<triangleright>h0) \\<Longrightarrow> (n \\<mapsto> l) h0 \\<Longrightarrow> (h1 = 0 \\<and> h0 = h2) \\<or> (h2 = 0 \\<and> h0 = h1)\"\nby (metis lssl_l2)  \n  \nlemma lssl_l3: \"Gamma \\<and> (h1,h2\\<triangleright>h0) \\<and> (n\\<mapsto>l1) h1 \\<and> (n\\<mapsto>l2) h2 \\<longrightarrow> Delta\"\nusing local.pointsto_addr_disj by blast\n\nlemma lssl_l3_der:\n\"(h1,h2\\<triangleright>h0) \\<Longrightarrow> (n\\<mapsto>l1) h1 \\<Longrightarrow> (n\\<mapsto>l2) h2 \\<Longrightarrow> False\"\nusing local.pointsto_addr_disj by blast\n  \nlemma lssl_l4: \n\"Gamma \\<and> (n1\\<mapsto>l1) h \\<and> n1 = n2 \\<and> l1 = l2 \\<longrightarrow> Delta \\<Longrightarrow>\n Gamma \\<and> (n1\\<mapsto>l1) h \\<and> (n2\\<mapsto>l2) h \\<longrightarrow> Delta\"\nusing local.pointsto_unique by blast  \n\nlemma lssl_l4_inv: \n\"Gamma \\<and> (n1\\<mapsto>l1) h \\<and> (n2\\<mapsto>l2) h \\<longrightarrow> Delta \\<Longrightarrow>\n Gamma \\<and> (n1\\<mapsto>l1) h \\<and> n1 = n2 \\<and> l1 = l2 \\<longrightarrow> Delta\"\nby auto  \n\nlemma lssl_l4_der:\n\"(n1\\<mapsto>l1) h \\<Longrightarrow> (n2\\<mapsto>l2) h \\<Longrightarrow> n1 = n2 \\<and> l1 = l2\"\nby (simp add: local.pointsto_unique)     \n  \nlemma lssl_l6: \n\"(\\<exists>h1 h2 n. (Gamma \\<and> (h1,h0\\<triangleright>h2) \\<and> (n\\<mapsto>l) h1)) \\<longrightarrow> Delta \\<Longrightarrow>\n Gamma \\<longrightarrow> Delta\"\nusing local.pointsto_extend by blast  \n\nlemma lssl_l6_inv: \n\"Gamma \\<longrightarrow> Delta \\<Longrightarrow>\n (\\<exists>h1 h2 n. (Gamma \\<and> (h1,h0\\<triangleright>h2) \\<and> (n\\<mapsto>l) h1)) \\<longrightarrow> Delta\"\nby simp  \n\nlemma lssl_l6_der: \"\\<exists>h1 h2 n. (h1,h0\\<triangleright>h2) \\<and> (n\\<mapsto>l) h1\"\nusing local.pointsto_extend by blast\n  \nend   \n  \ncontext reynolds_algebra  \nbegin  \n \ntext {* The following rule applications are for the |-> predicate. *}\n  \nmethod try_lssl_l1 = (\nmatch premises in P[thin]:\"(?n \\<mapsto> ?l) (0)\" \\<Rightarrow>\n  \\<open>insert P, auto simp add: pointsto_no_emp\\<close>  \n)  \n\nmethod try_lssl_l2 = (\nmatch premises in P:\"(n \\<mapsto> l) (h)\" for h n l \\<Rightarrow>\n  \\<open>match premises in P'[thin]: \"(?h1,?h2\\<triangleright>h)\" \\<Rightarrow>\n    \\<open>match P' in \"(0,h\\<triangleright>h)\" \\<Rightarrow> \\<open>fail\\<close>\n     \\<bar>\"(h,0\\<triangleright>h)\" \\<Rightarrow> \\<open>fail\\<close>\n     \\<bar>_ \\<Rightarrow> \\<open>insert lssl_l2_der[OF P' P],auto\\<close>\\<close>\\<close>,\nsimp_all?\n)  \n\nmethod try_lssl_l3 = (\nmatch premises in P:\"(h1,h2\\<triangleright>?h0)\" and P':\"(n \\<mapsto> ?l1) (h1)\"\n  and P'':\"(n \\<mapsto> ?l2) (h2)\" for h1 h2 n \\<Rightarrow>\n  \\<open>insert lssl_l3_der[OF P P' P'']\\<close>,\nauto?  \n)\n\nmethod try_lssl_l4 = (\nmatch premises in P[thin]:\"(n1\\<mapsto>l1) (h)\" for n1 l1 h \\<Rightarrow>\n  \\<open>match premises in \"(n1\\<mapsto>l1) h\" \\<Rightarrow> \\<open>fail\\<close>\n  \\<bar>P':\"(?n2\\<mapsto>?l2) h\" \\<Rightarrow> \\<open>insert lssl_l4_der[OF P P']\\<close>\\<close>,\nsimp?  \n)\n\nmethod try_lssl_l5 = (\nmatch premises in P[thin]: \"(n\\<mapsto>l) (h1)\" for n l h1 \\<Rightarrow>\n  \\<open>match premises in \"(n\\<mapsto>l) h1\" \\<Rightarrow> \\<open>fail\\<close>\n  \\<bar>P':\"(n\\<mapsto>l) ?h\" \\<Rightarrow> \\<open>insert lssl_l5_der[OF P P']\\<close>\\<close>,\nsimp?\n)\n\ntext {* We don't implement the application of HE because it's too expensive. *}  \n  \ntext {* The following is an alternative for reasoning about pointers. *}\n\nmethod invert_pointer = (\n(try_lssl_l1\n|try_lssl_l3\n|try_lssl_l4 \n|try_lssl_l5  \n|try_lspasl_empl \n|try_lspasl_iu\n|try_lspasl_d\n|try_lspasl_eq     \n|try_lspasl_p\n|try_lspasl_c\n|try_lssl_l2  \n|(magic_mp_tac,(drule magic_mp),auto?,prep?)    \n|try_lspasl_starl\n|try_lspasl_magicr  \n|try_lspasl_starr_guided\n|try_lspasl_magicl_guided)+,\nauto?)    \n  \nmethod sepointer = \n(prep\n |(invert_pointer\n  |try_lsfasl_boxl         \n  |struct  \n  |noninvert   \n )+\n |rare\n)+  \n\nmethod starpointer =\n(prep\n |(invert_pointer            \n  |(try_lspasl_starr_smart,(try_lspasl_starr,starr_solve_terns?)+) (* Tactics for solving *R formulae. *)   \n  |try_lsfasl_boxl\n  |struct\n  |noninvert          \n )+ \n |rare\n)+\n\nend\n  \nend  ", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/Separata/Separata_Pointers.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3062538502961012}}
{"text": "(* \n   Title: Psi-calculi   \n   Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Weak_Bisim_Pres\n  imports Weak_Bisimulation Weak_Sim_Pres Weak_Stat_Imp_Pres\nbegin\n\ncontext env begin\n\nlemma weakBisimInputPres:\n  fixes \\<Psi>    :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n\n  assumes \"\\<And>Tvec. length xvec = length Tvec \\<Longrightarrow> \\<Psi> \\<rhd> P[xvec::=Tvec] \\<approx> Q[xvec::=Tvec]\"\n\n  shows \"\\<Psi> \\<rhd> M\\<lparr>\\<lambda>*xvec N\\<rparr>.P \\<approx> M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q\"\nproof -\n  let ?X = \"{(\\<Psi>, M\\<lparr>\\<lambda>*xvec N\\<rparr>.P, M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q) | \\<Psi> M xvec N P Q. \\<forall>Tvec. length xvec = length Tvec \\<longrightarrow> \\<Psi> \\<rhd> P[xvec::=Tvec] \\<approx> Q[xvec::=Tvec]}\"\n\n  from assms have \"(\\<Psi>, M\\<lparr>\\<lambda>*xvec N\\<rparr>.P, M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cStatImp \\<Psi> P Q)\n    thus ?case by(fastforce intro: weakStatImpInputPres dest: weakBisimE(3))\n  next\n    case(cSim \\<Psi> P Q)\n    thus ?case\n      by auto (blast intro: weakInputPres dest: weakBisimE)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(blast dest: weakBisimE)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(blast dest: weakBisimE)\n  qed\nqed\n  \nlemma weakBisimOutputPres:\n  fixes \\<Psi>    :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n\n  assumes \"\\<Psi> \\<rhd> P \\<approx> Q\"\n\n  shows \"\\<Psi> \\<rhd> M\\<langle>N\\<rangle>.P \\<approx> M\\<langle>N\\<rangle>.Q\"\nproof -\n  let ?X = \"{(\\<Psi>, M\\<langle>N\\<rangle>.P, M\\<langle>N\\<rangle>.Q) | \\<Psi> M N P Q. \\<Psi> \\<rhd> P \\<approx> Q}\"\n\n  from assms have \"(\\<Psi>, M\\<langle>N\\<rangle>.P, M\\<langle>N\\<rangle>.Q) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cStatImp \\<Psi> P Q)\n    thus ?case by auto (blast intro: weakStatImpOutputPres dest: weakBisimE(3))\n  next\n    case(cSim \\<Psi> P Q)\n    thus ?case\n      by(auto intro: weakOutputPres dest: weakBisimE)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(blast dest: weakBisimE)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(blast dest: weakBisimE)\n  qed\nqed\n\n\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>P \\<approx> \\<lparr>\\<nu>x\\<rparr>Q\"\nproof -\n  let ?X = \"{(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) | \\<Psi> x P Q. \\<Psi> \\<rhd> P \\<approx> Q \\<and> x \\<sharp> \\<Psi>}\"\n  \n  from assms have \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cStatImp \\<Psi> xP xQ)\n    {\n      fix \\<Psi> P Q x\n      assume \"\\<Psi> \\<rhd> P \\<approx> Q\"\n      hence \"\\<Psi> \\<rhd> P \\<lessapprox><weakBisim> Q\" by(rule weakBisimE)\n      moreover have \"eqvt weakBisim\" by auto\n      moreover assume \"(x::name) \\<sharp> \\<Psi>\"\n      moreover have \"\\<And>\\<Psi> P Q x. \\<lbrakk>(\\<Psi>, P, Q) \\<in> weakBisim; x \\<sharp> \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n        by auto\n      ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>P \\<lessapprox><(?X \\<union> weakBisim)> \\<lparr>\\<nu>x\\<rparr>Q\"\n        by(rule weakStatImpResPres)\n    }\n    with \\<open>(\\<Psi>, xP, xQ) \\<in> ?X\\<close> show ?case by auto\n  next\n    case(cSim \\<Psi> xP xQ)\n    from \\<open>(\\<Psi>, xP, xQ) \\<in> ?X\\<close> obtain x P Q where \"\\<Psi> \\<rhd> P \\<approx> Q\" and \"x \\<sharp> \\<Psi>\" and \"xP = \\<lparr>\\<nu>x\\<rparr>P\" and \"xQ = \\<lparr>\\<nu>x\\<rparr>Q\"\n      by auto\n    from \\<open>\\<Psi> \\<rhd> P \\<approx> Q\\<close> have \"\\<Psi> \\<rhd> P \\<leadsto><weakBisim> Q\" by(rule weakBisimE)\n    moreover have \"eqvt ?X\"\n      by(force simp add: eqvt_def weakBisimClosed pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n    hence \"eqvt(?X \\<union> weakBisim)\" by auto\n    moreover note \\<open>x \\<sharp> \\<Psi>\\<close>\n    moreover have \"weakBisim \\<subseteq> ?X \\<union> weakBisim\" by auto\n    moreover have \"\\<And>\\<Psi> P Q x. \\<lbrakk>(\\<Psi>, P, Q) \\<in> weakBisim; x \\<sharp> \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n      by auto\n    ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>P \\<leadsto><(?X \\<union> weakBisim)> \\<lparr>\\<nu>x\\<rparr>Q\"\n      by(rule weakResPres)\n    with \\<open>xP = \\<lparr>\\<nu>x\\<rparr>P\\<close> \\<open>xQ = \\<lparr>\\<nu>x\\<rparr>Q\\<close> show ?case\n      by simp\n  next\n    case(cExt \\<Psi> xP xQ \\<Psi>')\n    from \\<open>(\\<Psi>, xP, xQ) \\<in> ?X\\<close> obtain x P Q where \"\\<Psi> \\<rhd> P \\<approx> Q\" and \"x \\<sharp> \\<Psi>\" and \"xP = \\<lparr>\\<nu>x\\<rparr>P\" and \"xQ = \\<lparr>\\<nu>x\\<rparr>Q\"\n      by auto\n    obtain y::name where \"y \\<sharp> P\" and \"y \\<sharp> Q\" and \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<Psi>'\"\n     by(generate_fresh \"name\", auto simp add: fresh_prod)\n   from \\<open>\\<Psi> \\<rhd> P \\<approx> Q\\<close> have \"\\<Psi> \\<otimes> ([(x, y)] \\<bullet> \\<Psi>') \\<rhd> P \\<approx> Q\"\n     by(rule weakBisimE)\n   hence \"([(x, y)] \\<bullet> (\\<Psi> \\<otimes> ([(x, y)] \\<bullet> \\<Psi>'))) \\<rhd> ([(x, y)] \\<bullet> P) \\<approx> ([(x, y)] \\<bullet> Q)\"\n     by(rule weakBisimClosed)\n   with \\<open>x \\<sharp> \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>\\<close> have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> ([(x, y)] \\<bullet> P) \\<approx> ([(x, y)] \\<bullet> Q)\"\n     by(simp add: eqvts)\n   with \\<open>y \\<sharp> \\<Psi>\\<close> \\<open>y \\<sharp> \\<Psi>'\\<close> have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P), \\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> Q)) \\<in> ?X\"\n     by auto\n   moreover from \\<open>y \\<sharp> P\\<close> \\<open>y \\<sharp> Q\\<close> have \"\\<lparr>\\<nu>x\\<rparr>P = \\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> P)\" and \"\\<lparr>\\<nu>x\\<rparr>Q = \\<lparr>\\<nu>y\\<rparr>([(x, y)] \\<bullet> Q)\"\n     by(simp add: alphaRes)+\n   ultimately show ?case using \\<open>xP = \\<lparr>\\<nu>x\\<rparr>P\\<close> \\<open>xQ = \\<lparr>\\<nu>x\\<rparr>Q\\<close> by simp\n next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(blast dest: weakBisimE)\n  qed\nqed\n\nlemma weakBisimResChainPres:\n  fixes \\<Psi>   :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   xvec :: \"name list\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<approx> Q\"\n  and     \"xvec \\<sharp>* \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>P \\<approx> \\<lparr>\\<nu>*xvec\\<rparr>Q\"\nusing assms\nby(induct xvec) (auto intro: weakBisimResPres)\n\nlemma weakBisimParPresAux:\n  fixes \\<Psi>  :: 'b\n  and   \\<Psi>\\<^sub>R :: 'b\n  and   P  :: \"('a, 'b, 'c) psi\"\n  and   Q  :: \"('a, 'b, 'c) psi\"\n  and   R  :: \"('a, 'b, 'c) psi\"\n  and   A\\<^sub>R :: \"name list\"\n  \n  assumes \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n  and     FrR: \"extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\"\n  and     \"A\\<^sub>R \\<sharp>* \\<Psi>\"\n  and     \"A\\<^sub>R \\<sharp>* P\"\n  and     \"A\\<^sub>R \\<sharp>* Q\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> R \\<approx> Q \\<parallel> R\"\nproof -\n  let ?X = \"{(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)) | xvec \\<Psi> P Q R. xvec \\<sharp>* \\<Psi> \\<and> (\\<forall>A\\<^sub>R \\<Psi>\\<^sub>R. (extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle> \\<and> A\\<^sub>R \\<sharp>* \\<Psi> \\<and> A\\<^sub>R \\<sharp>* P \\<and> A\\<^sub>R \\<sharp>* Q) \\<longrightarrow>\n                                                                                          \\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q)}\"\n  {\n    fix xvec :: \"name list\"\n    and \\<Psi>    :: 'b \n    and P    :: \"('a, 'b, 'c) psi\"\n    and Q    :: \"('a, 'b, 'c) psi\"\n    and R    :: \"('a, 'b, 'c) psi\"\n\n    assume \"xvec \\<sharp>* \\<Psi>\"\n    and    \"\\<And>A\\<^sub>R \\<Psi>\\<^sub>R. \\<lbrakk>extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>; A\\<^sub>R \\<sharp>* \\<Psi>; A\\<^sub>R \\<sharp>* P; A\\<^sub>R \\<sharp>* Q\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n\n    hence \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)) \\<in> ?X\"\n      by blast\n  }\n  note XI = this\n\n  {\n    fix xvec :: \"name list\"\n    and \\<Psi>    :: 'b \n    and P    :: \"('a, 'b, 'c) psi\"\n    and Q    :: \"('a, 'b, 'c) psi\"\n    and R    :: \"('a, 'b, 'c) psi\"\n    and C    :: \"'d::fs_name\"\n\n    assume \"xvec \\<sharp>* \\<Psi>\"\n    and    A: \"\\<And>A\\<^sub>R \\<Psi>\\<^sub>R. \\<lbrakk>extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>; A\\<^sub>R \\<sharp>* \\<Psi>; A\\<^sub>R \\<sharp>* P; A\\<^sub>R \\<sharp>* Q; A\\<^sub>R \\<sharp>* C\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n\n    from \\<open>xvec \\<sharp>* \\<Psi>\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)) \\<in> ?X\"\n    proof(rule XI)\n      fix A\\<^sub>R \\<Psi>\\<^sub>R\n      assume FrR: \"extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\"\n      obtain p::\"name prm\" where \"(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\" and \"(p \\<bullet> A\\<^sub>R) \\<sharp>* P\" and \"(p \\<bullet> A\\<^sub>R) \\<sharp>* Q\" and \"(p \\<bullet> A\\<^sub>R) \\<sharp>* R\" and \"(p \\<bullet> A\\<^sub>R) \\<sharp>* C\"\n                             and \"(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\\<^sub>R\" and S: \"(set p) \\<subseteq> (set A\\<^sub>R) \\<times> (set(p \\<bullet> A\\<^sub>R))\" and \"distinctPerm p\"\n        by(rule_tac c=\"(\\<Psi>, P, Q, R, \\<Psi>\\<^sub>R, C)\" in name_list_avoiding) auto\n      from FrR \\<open>(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\\<^sub>R\\<close> S have \"extractFrame R = \\<langle>(p \\<bullet> A\\<^sub>R), p \\<bullet> \\<Psi>\\<^sub>R\\<rangle>\" by(simp add: frameChainAlpha')\n\n      moreover assume \"A\\<^sub>R \\<sharp>* \\<Psi>\"\n      hence \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> \\<Psi>)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with \\<open>A\\<^sub>R \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\\<close> S have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\" by simp\n      moreover assume \"A\\<^sub>R \\<sharp>* P\"\n      hence \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> P)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with \\<open>A\\<^sub>R \\<sharp>* P\\<close> \\<open>(p \\<bullet> A\\<^sub>R) \\<sharp>* P\\<close> S have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* P\" by simp\n      moreover assume \"A\\<^sub>R \\<sharp>* Q\"\n      hence \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> Q)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with \\<open>A\\<^sub>R \\<sharp>* Q\\<close> \\<open>(p \\<bullet> A\\<^sub>R) \\<sharp>* Q\\<close> S have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* Q\" by simp\n      ultimately have \"\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R) \\<rhd> P \\<approx> Q\" using \\<open>(p \\<bullet> A\\<^sub>R) \\<sharp>* C\\<close> A by blast\n      hence \"(p \\<bullet> (\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R))) \\<rhd> (p \\<bullet> P) \\<approx> (p \\<bullet> Q)\" by(rule weakBisimClosed)\n      with \\<open>A\\<^sub>R \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\\<close> \\<open>A\\<^sub>R \\<sharp>* P\\<close> \\<open>(p \\<bullet> A\\<^sub>R) \\<sharp>* P\\<close> \\<open>A\\<^sub>R \\<sharp>* Q\\<close> \\<open>(p \\<bullet> A\\<^sub>R) \\<sharp>* Q\\<close> S \\<open>distinctPerm p\\<close>\n      show \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\" by(simp add: eqvts)\n    qed\n  }\n  note XI' = this\n\n  have \"eqvt ?X\"\n    apply(auto simp add: eqvt_def)\n    apply(rule_tac x=\"p \\<bullet> xvec\" in exI)\n    apply(rule_tac x=\"p \\<bullet> P\" in exI)\n    apply(rule_tac x=\"p \\<bullet> Q\" in exI)\n    apply(rule_tac x=\"p \\<bullet> R\" in exI)\n    apply(simp add: eqvts)\n    apply(simp add: fresh_star_bij)\n    apply(clarify)\n    apply(erule_tac x=\"(rev p) \\<bullet> A\\<^sub>R\" in allE)\n    apply(erule_tac x=\"(rev p) \\<bullet> \\<Psi>\\<^sub>R\" in allE)\n    apply(drule mp)\n    apply(rule conjI)\n    apply(rule_tac pi=p in pt_bij4[OF pt_name_inst, OF at_name_inst])\n    apply(simp add: eqvts)\n    defer\n    apply(drule_tac p=p in weakBisimClosed)\n    apply(simp add: eqvts)\n    apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n    apply simp\n    apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n    apply simp\n    apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of p, THEN sym])\n    by simp\n\n  moreover have Res: \"\\<And>\\<Psi> P Q x. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim; x \\<sharp> \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n  proof -\n    fix \\<Psi> P Q x\n    assume \"(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim\" and \"(x::name) \\<sharp> \\<Psi>\"\n    show \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n    proof(case_tac \"(\\<Psi>, P, Q) \\<in> ?X\")\n      assume \"(\\<Psi>, P, Q) \\<in> ?X\"\n      with \\<open>x \\<sharp> \\<Psi>\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>x\\<rparr>P, \\<lparr>\\<nu>x\\<rparr>Q) \\<in> ?X\"\n        apply auto\n        by(rule_tac x=\"x#xvec\" in exI) auto\n      thus ?thesis by simp\n    next\n      assume \"\\<not>(\\<Psi>, P, Q) \\<in> ?X\"\n      with \\<open>(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim\\<close> have \"\\<Psi> \\<rhd> P \\<approx> Q\"\n        by blast\n      hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>P \\<approx> \\<lparr>\\<nu>x\\<rparr>Q\" using \\<open>x \\<sharp> \\<Psi>\\<close>\n        by(rule weakBisimResPres)\n      thus ?thesis\n        by simp\n    qed\n  qed\n\n  {\n    fix \\<Psi>  :: 'b\n      and P  :: \"('a, 'b, 'c) psi\"\n      and Q  :: \"('a, 'b, 'c) psi\"\n      and \\<Psi>' :: 'b\n\n    assume \"\\<Psi> \\<rhd> P \\<approx> Q\"\n\n    hence \"\\<Psi> \\<rhd> Q \\<approx> P\" by(rule weakBisimE)\n    then obtain P' P'' where PChain: \"\\<Psi> \\<rhd> P \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> P'\"\n                         and QimpP': \"insertAssertion(extractFrame Q) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion(extractFrame P') \\<Psi>\"\n                         and P'Chain: \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P' \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> P''\"   \n                         and \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> Q \\<approx> P''\" using weakStatImp_def\n      by(blast dest: weakBisimE)\n    note PChain QimpP' P'Chain\n    moreover from \\<open>\\<Psi> \\<otimes> \\<Psi>' \\<rhd> Q \\<approx> P''\\<close> have \"\\<Psi> \\<otimes> \\<Psi>' \\<rhd> P'' \\<approx> Q\" by(rule weakBisimE)\n    ultimately have \"\\<exists>P' P''. \\<Psi> \\<rhd> P \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> P' \\<and> insertAssertion(extractFrame Q) \\<Psi> \\<hookrightarrow>\\<^sub>F insertAssertion(extractFrame P') \\<Psi> \\<and>\n                              \\<Psi> \\<otimes> \\<Psi>' \\<rhd> P' \\<Longrightarrow>\\<^sup>^\\<^sub>\\<tau> P'' \\<and> \\<Psi> \\<otimes> \\<Psi>' \\<rhd> P'' \\<approx> Q\"\n      by blast\n  }\n  moreover \n  {\n    fix \\<Psi> P Q A\\<^sub>R \\<Psi>\\<^sub>R R\n    assume PSimQ: \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n       and FrR: \"extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\"\n       and \"A\\<^sub>R \\<sharp>* \\<Psi>\"\n       and \"A\\<^sub>R \\<sharp>* P\"\n       and \"A\\<^sub>R \\<sharp>* Q\"\n    hence \"(\\<Psi>, P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\"\n    proof -\n      have \"P \\<parallel> R = \\<lparr>\\<nu>*[]\\<rparr>(P \\<parallel> R)\" by simp\n      moreover have \"Q \\<parallel> R = \\<lparr>\\<nu>*[]\\<rparr>(Q \\<parallel> R)\" by simp\n      moreover have \"([]::name list) \\<sharp>* \\<Psi>\" by simp\n      moreover \n      {\n        fix A\\<^sub>R' \\<Psi>\\<^sub>R'\n\n        assume FrR': \"extractFrame R = \\<langle>A\\<^sub>R', \\<Psi>\\<^sub>R'\\<rangle>\"\n            and \"A\\<^sub>R' \\<sharp>* \\<Psi>\"\n            and \"A\\<^sub>R' \\<sharp>* P\"\n            and \"A\\<^sub>R' \\<sharp>* Q\"\n        obtain p where \"(p \\<bullet> A\\<^sub>R') \\<sharp>* A\\<^sub>R\"\n                   and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\\<^sub>R'\"\n                   and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\"\n                   and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* P\"\n                   and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* Q\"\n                   and S: \"(set p) \\<subseteq> (set A\\<^sub>R') \\<times> (set(p \\<bullet> A\\<^sub>R'))\" and \"distinctPerm p\"\n          by(rule_tac c=\"(A\\<^sub>R, \\<Psi>, \\<Psi>\\<^sub>R', P, Q)\" in name_list_avoiding) auto\n\n        \n        from \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\\<^sub>R'\\<close> S have \"\\<langle>A\\<^sub>R', \\<Psi>\\<^sub>R'\\<rangle> = \\<langle>p \\<bullet> A\\<^sub>R', p \\<bullet> \\<Psi>\\<^sub>R'\\<rangle>\"\n          by(simp add: frameChainAlpha)\n        \n        with FrR' have FrR'': \"extractFrame R = \\<langle>p \\<bullet> A\\<^sub>R', p \\<bullet> \\<Psi>\\<^sub>R'\\<rangle>\" by simp\n        with FrR \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* A\\<^sub>R\\<close>\n        obtain q where \"p \\<bullet> \\<Psi>\\<^sub>R' = (q::name prm) \\<bullet> \\<Psi>\\<^sub>R\" and S': \"set q \\<subseteq> (set A\\<^sub>R) \\<times> set(p \\<bullet> A\\<^sub>R')\" and \"distinctPerm q\"\n          apply auto\n          apply(drule_tac sym) apply simp\n          by(drule_tac frameChainEq) auto\n        from PSimQ have \"(q \\<bullet> (\\<Psi> \\<otimes> \\<Psi>\\<^sub>R)) \\<rhd> (q \\<bullet> P) \\<approx> (q \\<bullet> Q)\"\n          by(rule weakBisimClosed)\n        with \\<open>A\\<^sub>R \\<sharp>* \\<Psi>\\<close> \\<open>A\\<^sub>R \\<sharp>* P\\<close> \\<open>A\\<^sub>R \\<sharp>* Q\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* P\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* Q\\<close> S'\n        have \"\\<Psi> \\<otimes> (q \\<bullet> \\<Psi>\\<^sub>R) \\<rhd> P \\<approx> Q\" by(simp add: eqvts)\n        hence \"(p \\<bullet> (\\<Psi> \\<otimes> (q \\<bullet> \\<Psi>\\<^sub>R))) \\<rhd> (p \\<bullet> P) \\<approx> (p \\<bullet> Q)\" by(rule weakBisimClosed)\n        with \\<open>A\\<^sub>R' \\<sharp>* \\<Psi>\\<close> \\<open>A\\<^sub>R' \\<sharp>* P\\<close> \\<open>A\\<^sub>R' \\<sharp>* Q\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* P\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* Q\\<close> S \\<open>distinctPerm p\\<close> \\<open>(p \\<bullet> \\<Psi>\\<^sub>R') = q \\<bullet> \\<Psi>\\<^sub>R\\<close> \n        have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R' \\<rhd> P \\<approx> Q\"\n          by(drule_tac sym) (simp add: eqvts)\n      }\n      ultimately show ?thesis\n        by blast\n    qed\n    hence \"(\\<Psi>, P \\<parallel> R, Q \\<parallel> R) \\<in> ?X \\<union> weakBisim\"\n      by simp\n  }\n  note C1 = this\n\n  have C2: \"\\<And>\\<Psi> P Q xvec. \\<lbrakk>(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim; (xvec::name list) \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> (\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>P, \\<lparr>\\<nu>*xvec\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n  proof -\n    fix \\<Psi> P Q xvec\n    assume \"(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim\"\n    assume \"(xvec::name list) \\<sharp>* \\<Psi>\"\n    thus \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>P, \\<lparr>\\<nu>*xvec\\<rparr>Q) \\<in> ?X \\<union> weakBisim\"\n    proof(induct xvec)\n      case Nil\n      thus ?case using \\<open>(\\<Psi>, P, Q) \\<in> ?X \\<union> weakBisim\\<close> by simp\n    next\n      case(Cons x xvec)\n      thus ?case by(simp only: resChain.simps) (rule_tac Res, auto)\n    qed\n  qed\n\n  {\n    fix \\<Psi> :: 'b\n    and P :: \"('a, 'b, 'c) psi\"\n    and Q :: \"('a, 'b, 'c) psi\"\n    and R :: \"('a, 'b, 'c) psi\"\n    and A\\<^sub>R :: \"name list\"\n    and \\<Psi>\\<^sub>R :: 'b\n\n    assume \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n    and     FrR: \"extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\"\n    and     \"A\\<^sub>R \\<sharp>* \\<Psi>\"\n    and     \"A\\<^sub>R \\<sharp>* P\"\n    and     \"A\\<^sub>R \\<sharp>* Q\"\n\n    \n    have \"(\\<Psi>, P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\" \n    proof -\n      {\n        fix A\\<^sub>R' :: \"name list\"\n        and \\<Psi>\\<^sub>R' :: 'b\n\n        assume FrR': \"extractFrame R = \\<langle>A\\<^sub>R', \\<Psi>\\<^sub>R'\\<rangle>\"\n        and    \"A\\<^sub>R' \\<sharp>* \\<Psi>\"\n        and    \"A\\<^sub>R' \\<sharp>* P\"\n        and    \"A\\<^sub>R' \\<sharp>* Q\"\n\n        obtain p where \"(p \\<bullet> A\\<^sub>R') \\<sharp>* A\\<^sub>R\" and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\\<^sub>R'\" and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\" and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* P\" and \"(p \\<bullet> A\\<^sub>R') \\<sharp>* Q\"\n                   and Sp: \"(set p) \\<subseteq> (set A\\<^sub>R') \\<times> (set(p \\<bullet> A\\<^sub>R'))\" and \"distinctPerm p\"\n          by(rule_tac c=\"(A\\<^sub>R, \\<Psi>, \\<Psi>\\<^sub>R', P, Q)\" in name_list_avoiding) auto\n            \n        from FrR' \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>*  \\<Psi>\\<^sub>R'\\<close> Sp have \"extractFrame R = \\<langle>(p \\<bullet> A\\<^sub>R'), p \\<bullet> \\<Psi>\\<^sub>R'\\<rangle>\"\n          by(simp add: frameChainAlpha eqvts)\n        with FrR \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* A\\<^sub>R\\<close> obtain q::\"name prm\" \n          where Sq: \"set q \\<subseteq> set(p \\<bullet> A\\<^sub>R') \\<times> set A\\<^sub>R\" and \"distinctPerm q\" and \"\\<Psi>\\<^sub>R = q \\<bullet> p \\<bullet> \\<Psi>\\<^sub>R'\"\n          by(force elim: frameChainEq)\n\n        from \\<open>\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\\<close> \\<open>\\<Psi>\\<^sub>R = q \\<bullet> p \\<bullet> \\<Psi>\\<^sub>R'\\<close> have \"\\<Psi> \\<otimes> (q \\<bullet> p \\<bullet> \\<Psi>\\<^sub>R') \\<rhd> P \\<approx> Q\" by simp\n        hence \"(q \\<bullet> (\\<Psi> \\<otimes> (q \\<bullet> p \\<bullet> \\<Psi>\\<^sub>R'))) \\<rhd> (q \\<bullet> P) \\<approx> (q \\<bullet> Q)\" by(rule weakBisimClosed)\n        with Sq \\<open>A\\<^sub>R \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\\<close> \\<open>A\\<^sub>R \\<sharp>* P\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* P\\<close> \\<open>A\\<^sub>R \\<sharp>* Q\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* Q\\<close> \\<open>distinctPerm q\\<close>\n        have \"\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R') \\<rhd> P \\<approx> Q\" by(simp add: eqvts)\n        hence \"(p \\<bullet> (\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R'))) \\<rhd> (p \\<bullet> P) \\<approx> (p \\<bullet> Q)\" by(rule weakBisimClosed)\n        with Sp \\<open>A\\<^sub>R' \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* \\<Psi>\\<close> \\<open>A\\<^sub>R' \\<sharp>* P\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* P\\<close> \\<open>A\\<^sub>R' \\<sharp>* Q\\<close> \\<open>(p \\<bullet> A\\<^sub>R') \\<sharp>* Q\\<close> \\<open>distinctPerm p\\<close>\n        have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R' \\<rhd> P \\<approx> Q\" by(simp add: eqvts)\n      }\n      thus ?thesis\n        apply auto\n        apply(rule_tac x=\"[]\" in exI)\n        by auto blast\n    qed\n  }\n  note Goal = this\n  with assms have \"(\\<Psi>, P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: weakBisimCoinduct)\n    case(cStatImp \\<Psi> PR QR)\n    {\n      fix xvec :: \"name list\"\n      fix P Q R \n      assume A: \"\\<forall>A\\<^sub>R \\<Psi>\\<^sub>R. extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle> \\<and> A\\<^sub>R \\<sharp>* \\<Psi> \\<and> A\\<^sub>R \\<sharp>* P \\<and> A\\<^sub>R \\<sharp>* Q \\<longrightarrow> \\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n      {\n        fix A\\<^sub>R \\<Psi>\\<^sub>R\n        assume \"extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\" and \"A\\<^sub>R \\<sharp>* \\<Psi>\" and \"A\\<^sub>R \\<sharp>* P\" and \"A\\<^sub>R \\<sharp>* Q\"\n        with A have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<lessapprox><weakBisim> Q\" by(auto dest: weakBisimE)\n      }\n      moreover assume \"xvec \\<sharp>* \\<Psi>\"\n      moreover have \"eqvt weakBisim\" by auto\n      moreover note C1 C2 statEqWeakBisim\n      ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R) \\<lessapprox><(?X \\<union> weakBisim)> \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)\" \n        by(rule weakStatImpParPres)\n    }\n    with \\<open>(\\<Psi>, PR, QR) \\<in> ?X\\<close> show ?case by auto\n  next\n    case(cSim \\<Psi> PR QR)\n    from \\<open>(\\<Psi>, PR, QR) \\<in> ?X\\<close>    \n    obtain xvec P Q R A\\<^sub>R \\<Psi>\\<^sub>R where PFrR: \"PR = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R)\" and QFrR: \"QR = \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)\"\n                               and \"xvec \\<sharp>* \\<Psi>\"\n      by auto\n    with \\<open>(\\<Psi>, PR, QR) \\<in> ?X\\<close> have \"(\\<Psi>, \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)) \\<in> ?X\" by simp\n    hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R) \\<leadsto><(?X \\<union> weakBisim)> \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)\" using \\<open>xvec \\<sharp>* \\<Psi>\\<close>\n    proof(induct xvec)\n      case Nil\n      from \\<open>(\\<Psi>, \\<lparr>\\<nu>*[]\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*[]\\<rparr>(Q \\<parallel> R)) \\<in> ?X\\<close> have PRQR: \"(\\<Psi>, P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\" by simp\n      from PRQR have \"\\<And>A\\<^sub>R \\<Psi>\\<^sub>R. \\<lbrakk>extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>; A\\<^sub>R \\<sharp>* \\<Psi>;  A\\<^sub>R \\<sharp>* P;  A\\<^sub>R \\<sharp>* Q\\<rbrakk> \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>\\<^sub>R, P, Q) \\<in> weakBisim\"\n        by auto\n      moreover note weakBisimEqvt\n      moreover from \\<open>eqvt ?X\\<close> have \"eqvt(?X \\<union> weakBisim)\" by auto\n      moreover note weakBisimE(2) weakBisimE(4) weakBisimE(3) weakBisimE(1)\n      moreover note C1 C2 \n      ultimately have \"\\<Psi> \\<rhd> P \\<parallel> R \\<leadsto><(?X \\<union> weakBisim)> Q \\<parallel> R\" using statEqWeakBisim\n        by(rule weakParPres)\n      thus ?case by simp\n    next\n      case(Cons x xvec')\n      from \\<open>(x#xvec') \\<sharp>* \\<Psi>\\<close> have \"x \\<sharp> \\<Psi>\" and \"xvec' \\<sharp>* \\<Psi>\" by simp+\n      with \\<open>(\\<Psi>, \\<lparr>\\<nu>*(x#xvec')\\<rparr>P \\<parallel> R, \\<lparr>\\<nu>*(x#xvec')\\<rparr>Q \\<parallel> R) \\<in> ?X\\<close>\n      have \"(\\<Psi>, \\<lparr>\\<nu>*(xvec')\\<rparr>P \\<parallel> R, \\<lparr>\\<nu>*(xvec')\\<rparr>Q \\<parallel> R) \\<in> ?X\"\n        apply auto\n        apply(subgoal_tac \"\\<exists>y yvec. xvec=y#yvec\")\n        apply(clarify)\n        apply simp\n        apply(simp add: psi.inject alpha)\n        apply(clarify)\n        apply(erule disjE)\n        apply(erule disjE)\n        apply(clarify)\n        apply blast\n        apply(clarify)\n        apply(clarify)\n        apply(simp add: eqvts)\n        apply(rule_tac x=\"[(x, y)] \\<bullet> yvec\" in exI)\n        apply(rule_tac x=\"[(x, y)] \\<bullet> P\" in exI)\n        apply(rule_tac x=\"[(x, y)] \\<bullet> Q\" in exI)\n        apply(rule_tac x=\"[(x, y)] \\<bullet> R\" in exI)\n        apply(clarsimp)\n        apply(rule conjI)\n        apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of \"[(x, y)]\", THEN sym])\n        apply simp\n        apply(clarify)\n        apply(erule_tac x=\"[(x, y)] \\<bullet> A\\<^sub>R\" in allE)\n        apply(erule_tac x=\"[(x, y)] \\<bullet> \\<Psi>\\<^sub>R\" in allE)\n        apply(drule mp)\n        apply(rule conjI)\n        apply(rule_tac pi=\"[(x, y)]\" in pt_bij4[OF pt_name_inst, OF at_name_inst])\n        apply(simp add: eqvts)\n        apply(rule conjI)\n        apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of \"[(x, y)]\", THEN sym])\n        apply simp\n        apply(rule conjI)\n        apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of \"[(x, y)]\", THEN sym])\n        apply simp\n        apply(subst pt_fresh_star_bij[OF pt_name_inst,OF at_name_inst, of \"[(x, y)]\", THEN sym])\n        apply simp\n        apply(drule_tac p=\"[(x, y)]\" in weakBisimClosed)\n        apply(simp add: eqvts)\n        by(case_tac xvec) auto\n      \n      with \\<open>\\<lbrakk>(\\<Psi>, \\<lparr>\\<nu>*xvec'\\<rparr>(P \\<parallel> R), \\<lparr>\\<nu>*xvec'\\<rparr>(Q \\<parallel> R)) \\<in> ?X; xvec' \\<sharp>* \\<Psi>\\<rbrakk> \\<Longrightarrow> \\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec'\\<rparr>(P \\<parallel> R) \\<leadsto><(?X \\<union> weakBisim)> \\<lparr>\\<nu>*xvec'\\<rparr>(Q \\<parallel> R)\\<close> \\<open>xvec' \\<sharp>* \\<Psi>\\<close>\n      have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>*xvec'\\<rparr>(P \\<parallel> R) \\<leadsto><(?X \\<union> weakBisim)> \\<lparr>\\<nu>*xvec'\\<rparr>(Q \\<parallel> R)\" by blast\n      moreover note \\<open>eqvt ?X\\<close> \n      moreover from \\<open>eqvt ?X\\<close> have \"eqvt(?X \\<union> weakBisim)\" by auto\n      moreover note \\<open>x \\<sharp> \\<Psi>\\<close>\n      moreover have \"?X \\<union> weakBisim \\<subseteq> ?X \\<union> weakBisim\" by simp\n      ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec'\\<rparr>(P \\<parallel> R)) \\<leadsto><(?X \\<union> weakBisim)> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>*xvec'\\<rparr>(Q \\<parallel> R))\" using Res\n        by(rule_tac weakResPres)\n      thus ?case\n        by simp\n    qed\n    with PFrR QFrR show ?case\n      by simp\n  next\n    case(cExt \\<Psi> PR QR \\<Psi>')\n\n    from \\<open>(\\<Psi>, PR, QR) \\<in> ?X\\<close>\n    obtain xvec P Q R A\\<^sub>R \\<Psi>\\<^sub>R where PFrR: \"PR = \\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R)\" and QFrR: \"QR = \\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R)\"\n                               and \"xvec \\<sharp>* \\<Psi>\" and A: \"\\<forall>A\\<^sub>R \\<Psi>\\<^sub>R. (extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle> \\<and> A\\<^sub>R \\<sharp>* \\<Psi> \\<and> A\\<^sub>R \\<sharp>* P \\<and> A\\<^sub>R \\<sharp>* Q) \\<longrightarrow> \\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\"\n      by auto\n    \n    obtain p where \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>\"\n               and \"(p \\<bullet> xvec) \\<sharp>* P\"\n               and \"(p \\<bullet> xvec) \\<sharp>* Q\"\n               and \"(p \\<bullet> xvec) \\<sharp>* R\"\n               and \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\"\n               and S: \"(set p) \\<subseteq> (set xvec) \\<times> (set(p \\<bullet> xvec))\" and \"distinctPerm p\"\n      by(rule_tac c=\"(\\<Psi>, P, Q, R, \\<Psi>')\" in name_list_avoiding) auto\n\n    from \\<open>(p \\<bullet> xvec) \\<sharp>* P\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* R\\<close> S have \"\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(p \\<bullet> (P \\<parallel> R))\"\n      by(subst resChainAlpha) auto\n    hence PRAlpha: \"\\<lparr>\\<nu>*xvec\\<rparr>(P \\<parallel> R) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> (p \\<bullet> R))\"\n      by(simp add: eqvts)\n\n    from \\<open>(p \\<bullet> xvec) \\<sharp>* Q\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* R\\<close> S have \"\\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>(p \\<bullet> (Q \\<parallel> R))\"\n      by(subst resChainAlpha) auto\n    hence QRAlpha: \"\\<lparr>\\<nu>*xvec\\<rparr>(Q \\<parallel> R) = \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> Q) \\<parallel> (p \\<bullet> R))\"\n      by(simp add: eqvts)\n\n    from \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>'\\<close> have \"(\\<Psi> \\<otimes> \\<Psi>', \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> P) \\<parallel> (p \\<bullet> R)), \\<lparr>\\<nu>*(p \\<bullet> xvec)\\<rparr>((p \\<bullet> Q) \\<parallel> (p \\<bullet> R))) \\<in> ?X\"\n   proof(rule_tac C2=\"(\\<Psi>, (p \\<bullet> P), (p \\<bullet> Q), R, \\<Psi>', xvec, p \\<bullet> xvec)\" in XI', auto)\n      fix A\\<^sub>R \\<Psi>\\<^sub>R\n      assume FrR: \"extractFrame (p \\<bullet> R) = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\" and \"A\\<^sub>R \\<sharp>* \\<Psi>\" and \"A\\<^sub>R \\<sharp>* \\<Psi>'\" and \"A\\<^sub>R \\<sharp>* (p \\<bullet> P)\" and \"A\\<^sub>R \\<sharp>* (p \\<bullet> Q)\"\n      from FrR have \"(p \\<bullet> (extractFrame (p \\<bullet> R))) = (p \\<bullet> \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>)\" by simp\n      with \\<open>distinctPerm p\\<close> have \"extractFrame R = \\<langle>p \\<bullet> A\\<^sub>R, p \\<bullet> \\<Psi>\\<^sub>R\\<rangle>\" by(simp add: eqvts)\n      moreover from \\<open>A\\<^sub>R \\<sharp>* \\<Psi>\\<close> have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> \\<Psi>)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>\\<close> S have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* \\<Psi>\" by simp\n      moreover from \\<open>A\\<^sub>R \\<sharp>* (p \\<bullet> P)\\<close> have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> p \\<bullet> P)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with \\<open>distinctPerm p\\<close> have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* P\" by simp\n      moreover from \\<open>A\\<^sub>R \\<sharp>* (p \\<bullet> Q)\\<close> have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* (p \\<bullet> p \\<bullet> Q)\" by(simp add: pt_fresh_star_bij[OF pt_name_inst, OF at_name_inst])\n      with \\<open>distinctPerm p\\<close> have \"(p \\<bullet> A\\<^sub>R) \\<sharp>* Q\" by simp\n      ultimately have \"\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R) \\<rhd> P \\<approx> Q\" using A by blast\n      hence \"(\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R)) \\<otimes> (p \\<bullet> \\<Psi>') \\<rhd> P \\<approx> Q\" by(rule weakBisimE)\n      moreover have \"(\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R)) \\<otimes> (p \\<bullet> \\<Psi>') \\<simeq> (\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>')) \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R)\"\n        by(metis Associativity Commutativity Composition AssertionStatEqTrans AssertionStatEqSym)\n      ultimately have \"(\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>')) \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R) \\<rhd> P \\<approx> Q\" \n        by(rule statEqWeakBisim)\n      hence \"(p \\<bullet> ((\\<Psi> \\<otimes> (p \\<bullet> \\<Psi>')) \\<otimes> (p \\<bullet> \\<Psi>\\<^sub>R))) \\<rhd> (p \\<bullet> P) \\<approx> (p \\<bullet> Q)\"\n        by(rule weakBisimClosed)\n      with \\<open>distinctPerm p\\<close> \\<open>xvec \\<sharp>* \\<Psi>\\<close> \\<open>(p \\<bullet> xvec) \\<sharp>* \\<Psi>\\<close> S show \"(\\<Psi> \\<otimes> \\<Psi>') \\<otimes> \\<Psi>\\<^sub>R \\<rhd> (p \\<bullet> P) \\<approx> (p \\<bullet> Q)\"\n        by(simp add: eqvts)\n    qed\n    with PFrR QFrR PRAlpha QRAlpha show ?case by simp\n  next\n    case(cSym \\<Psi> PR QR)\n    thus ?case by(blast dest: weakBisimE)\n  qed\nqed\n\nlemma weakBisimParPres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"\\<Psi> \\<rhd> P \\<approx> Q\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> R \\<approx> Q \\<parallel> R\"\nproof -\n  obtain A\\<^sub>R \\<Psi>\\<^sub>R where \"extractFrame R = \\<langle>A\\<^sub>R, \\<Psi>\\<^sub>R\\<rangle>\" and \"A\\<^sub>R \\<sharp>* \\<Psi>\" and \"A\\<^sub>R \\<sharp>* P\" and \"A\\<^sub>R \\<sharp>* Q\"\n    by(rule_tac C=\"(\\<Psi>, P, Q)\" in freshFrame) auto\n  moreover from \\<open>\\<Psi> \\<rhd> P \\<approx> Q\\<close> have \"\\<Psi> \\<otimes> \\<Psi>\\<^sub>R \\<rhd> P \\<approx> Q\" by(rule weakBisimE)\n  ultimately show ?thesis by(rule_tac weakBisimParPresAux)\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Weak_Bisim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5851011542032312, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3062538502961012}}
{"text": "(*  Title:      HOL/Imperative_HOL/Array.thy\n    Author:     John Matthews, Galois Connections; Alexander Krauss, Lukas Bulwahn & Florian Haftmann, TU Muenchen\n*)\n\nsection {* Monadic arrays *}\n\ntheory Array\nimports Heap_Monad\nbegin\n\nsubsection {* Primitives *}\n\ndefinition present :: \"heap \\<Rightarrow> 'a\\<Colon>heap array \\<Rightarrow> bool\" where\n  \"present h a \\<longleftrightarrow> addr_of_array a < lim h\"\n\ndefinition get :: \"heap \\<Rightarrow> 'a\\<Colon>heap array \\<Rightarrow> 'a list\" where\n  \"get h a = map from_nat (arrays h (TYPEREP('a)) (addr_of_array a))\"\n\ndefinition set :: \"'a\\<Colon>heap array \\<Rightarrow> 'a list \\<Rightarrow> heap \\<Rightarrow> heap\" where\n  \"set a x = arrays_update (\\<lambda>h. h(TYPEREP('a) := ((h(TYPEREP('a))) (addr_of_array a:=map to_nat x))))\"\n\ndefinition alloc :: \"'a list \\<Rightarrow> heap \\<Rightarrow> 'a\\<Colon>heap array \\<times> heap\" where\n  \"alloc xs h = (let\n     l = lim h;\n     r = Array l;\n     h'' = set r xs (h\\<lparr>lim := l + 1\\<rparr>)\n   in (r, h''))\"\n\ndefinition length :: \"heap \\<Rightarrow> 'a\\<Colon>heap array \\<Rightarrow> nat\" where\n  \"length h a = List.length (get h a)\"\n  \ndefinition update :: \"'a\\<Colon>heap array \\<Rightarrow> nat \\<Rightarrow> 'a \\<Rightarrow> heap \\<Rightarrow> heap\" where\n  \"update a i x h = set a ((get h a)[i:=x]) h\"\n\ndefinition noteq :: \"'a\\<Colon>heap array \\<Rightarrow> 'b\\<Colon>heap array \\<Rightarrow> bool\" (infix \"=!!=\" 70) where\n  \"r =!!= s \\<longleftrightarrow> TYPEREP('a) \\<noteq> TYPEREP('b) \\<or> addr_of_array r \\<noteq> addr_of_array s\"\n\n\nsubsection {* Monad operations *}\n\ndefinition new :: \"nat \\<Rightarrow> 'a\\<Colon>heap \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"new n x = Heap_Monad.heap (alloc (replicate n x))\"\n\ndefinition of_list :: \"'a\\<Colon>heap list \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"of_list xs = Heap_Monad.heap (alloc xs)\"\n\ndefinition make :: \"nat \\<Rightarrow> (nat \\<Rightarrow> 'a\\<Colon>heap) \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"make n f = Heap_Monad.heap (alloc (map f [0 ..< n]))\"\n\ndefinition len :: \"'a\\<Colon>heap array \\<Rightarrow> nat Heap\" where\n  [code del]: \"len a = Heap_Monad.tap (\\<lambda>h. length h a)\"\n\ndefinition nth :: \"'a\\<Colon>heap array \\<Rightarrow> nat \\<Rightarrow> 'a Heap\" where\n  [code del]: \"nth a i = Heap_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (get h a ! i, h))\"\n\ndefinition upd :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a\\<Colon>heap array \\<Rightarrow> 'a\\<Colon>heap array Heap\" where\n  [code del]: \"upd i x a = Heap_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (a, update a i x h))\"\n\ndefinition map_entry :: \"nat \\<Rightarrow> ('a\\<Colon>heap \\<Rightarrow> 'a) \\<Rightarrow> 'a array \\<Rightarrow> 'a array Heap\" where\n  [code del]: \"map_entry i f a = Heap_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (a, update a i (f (get h a ! i)) h))\"\n\ndefinition swap :: \"nat \\<Rightarrow> 'a \\<Rightarrow> 'a\\<Colon>heap array \\<Rightarrow> 'a Heap\" where\n  [code del]: \"swap i x a = Heap_Monad.guard (\\<lambda>h. i < length h a)\n    (\\<lambda>h. (get h a ! i, update a i x h))\"\n\ndefinition freeze :: \"'a\\<Colon>heap array \\<Rightarrow> 'a list Heap\" where\n  [code del]: \"freeze a = Heap_Monad.tap (\\<lambda>h. get h a)\"\n\n\nsubsection {* Properties *}\n\ntext {* FIXME: Does there exist a \"canonical\" array axiomatisation in\nthe literature?  *}\n\ntext {* Primitives *}\n\nlemma noteq_sym: \"a =!!= b \\<Longrightarrow> b =!!= a\"\n  and unequal [simp]: \"a \\<noteq> a' \\<longleftrightarrow> a =!!= a'\"\n  unfolding noteq_def by auto\n\nlemma noteq_irrefl: \"r =!!= r \\<Longrightarrow> False\"\n  unfolding noteq_def by auto\n\nlemma present_alloc_noteq: \"present h a \\<Longrightarrow> a =!!= fst (alloc xs h)\"\n  by (simp add: present_def noteq_def alloc_def Let_def)\n\nlemma get_set_eq [simp]: \"get (set r x h) r = x\"\n  by (simp add: get_def set_def o_def)\n\nlemma get_set_neq [simp]: \"r =!!= s \\<Longrightarrow> get (set s x h) r = get h r\"\n  by (simp add: noteq_def get_def set_def)\n\nlemma set_same [simp]:\n  \"set r x (set r y h) = set r x h\"\n  by (simp add: set_def)\n\nlemma set_set_swap:\n  \"r =!!= r' \\<Longrightarrow> set r x (set r' x' h) = set r' x' (set r x h)\"\n  by (simp add: Let_def fun_eq_iff noteq_def set_def)\n\nlemma get_update_eq [simp]:\n  \"get (update a i v h) a = (get h a) [i := v]\"\n  by (simp add: update_def)\n\nlemma nth_update_neq [simp]:\n  \"a =!!= b \\<Longrightarrow> get (update b j v h) a ! i = get h a ! i\"\n  by (simp add: update_def noteq_def)\n\nlemma get_update_elem_neqIndex [simp]:\n  \"i \\<noteq> j \\<Longrightarrow> get (update a j v h) a ! i = get h a ! i\"\n  by simp\n\nlemma length_update [simp]: \n  \"length (update b i v h) = length h\"\n  by (simp add: update_def length_def set_def get_def fun_eq_iff)\n\nlemma update_swap_neq:\n  \"a =!!= a' \\<Longrightarrow> \n  update a i v (update a' i' v' h) \n  = update a' i' v' (update a i v h)\"\napply (unfold update_def)\napply simp\napply (subst set_set_swap, assumption)\napply (subst get_set_neq)\napply (erule noteq_sym)\napply simp\ndone\n\nlemma update_swap_neqIndex:\n  \"\\<lbrakk> i \\<noteq> i' \\<rbrakk> \\<Longrightarrow> update a i v (update a i' v' h) = update a i' v' (update a i v h)\"\n  by (auto simp add: update_def set_set_swap list_update_swap)\n\nlemma get_alloc:\n  \"get (snd (alloc xs h)) (fst (alloc ys h)) = xs\"\n  by (simp add: Let_def split_def alloc_def)\n\nlemma length_alloc:\n  \"length (snd (alloc (xs :: 'a::heap list) h)) (fst (alloc (ys :: 'a list) h)) = List.length xs\"\n  by (simp add: Array.length_def get_alloc)\n\nlemma set:\n  \"set (fst (alloc ls h))\n     new_ls (snd (alloc ls h))\n       = snd (alloc new_ls h)\"\n  by (simp add: Let_def split_def alloc_def)\n\nlemma present_update [simp]: \n  \"present (update b i v h) = present h\"\n  by (simp add: update_def present_def set_def get_def fun_eq_iff)\n\nlemma present_alloc [simp]:\n  \"present (snd (alloc xs h)) (fst (alloc xs h))\"\n  by (simp add: present_def alloc_def set_def Let_def)\n\nlemma not_present_alloc [simp]:\n  \"\\<not> present h (fst (alloc xs h))\"\n  by (simp add: present_def alloc_def Let_def)\n\n\ntext {* Monad operations *}\n\nlemma execute_new [execute_simps]:\n  \"execute (new n x) h = Some (alloc (replicate n x) h)\"\n  by (simp add: new_def execute_simps)\n\nlemma success_newI [success_intros]:\n  \"success (new n x) h\"\n  by (auto intro: success_intros simp add: new_def)\n\nlemma effect_newI [effect_intros]:\n  assumes \"(a, h') = alloc (replicate n x) h\"\n  shows \"effect (new n x) h h' a\"\n  by (rule effectI) (simp add: assms execute_simps)\n\nlemma effect_newE [effect_elims]:\n  assumes \"effect (new n x) h h' r\"\n  obtains \"r = fst (alloc (replicate n x) h)\" \"h' = snd (alloc (replicate n x) h)\" \n    \"get h' r = replicate n x\" \"present h' r\" \"\\<not> present h r\"\n  using assms by (rule effectE) (simp add: get_alloc execute_simps)\n\nlemma execute_of_list [execute_simps]:\n  \"execute (of_list xs) h = Some (alloc xs h)\"\n  by (simp add: of_list_def execute_simps)\n\nlemma success_of_listI [success_intros]:\n  \"success (of_list xs) h\"\n  by (auto intro: success_intros simp add: of_list_def)\n\nlemma effect_of_listI [effect_intros]:\n  assumes \"(a, h') = alloc xs h\"\n  shows \"effect (of_list xs) h h' a\"\n  by (rule effectI) (simp add: assms execute_simps)\n\nlemma effect_of_listE [effect_elims]:\n  assumes \"effect (of_list xs) h h' r\"\n  obtains \"r = fst (alloc xs h)\" \"h' = snd (alloc xs h)\" \n    \"get h' r = xs\" \"present h' r\" \"\\<not> present h r\"\n  using assms by (rule effectE) (simp add: get_alloc execute_simps)\n\nlemma execute_make [execute_simps]:\n  \"execute (make n f) h = Some (alloc (map f [0 ..< n]) h)\"\n  by (simp add: make_def execute_simps)\n\nlemma success_makeI [success_intros]:\n  \"success (make n f) h\"\n  by (auto intro: success_intros simp add: make_def)\n\nlemma effect_makeI [effect_intros]:\n  assumes \"(a, h') = alloc (map f [0 ..< n]) h\"\n  shows \"effect (make n f) h h' a\"\n  by (rule effectI) (simp add: assms execute_simps)\n\nlemma effect_makeE [effect_elims]:\n  assumes \"effect (make n f) h h' r\"\n  obtains \"r = fst (alloc (map f [0 ..< n]) h)\" \"h' = snd (alloc (map f [0 ..< n]) h)\" \n    \"get h' r = map f [0 ..< n]\" \"present h' r\" \"\\<not> present h r\"\n  using assms by (rule effectE) (simp add: get_alloc execute_simps)\n\nlemma execute_len [execute_simps]:\n  \"execute (len a) h = Some (length h a, h)\"\n  by (simp add: len_def execute_simps)\n\nlemma success_lenI [success_intros]:\n  \"success (len a) h\"\n  by (auto intro: success_intros simp add: len_def)\n\nlemma effect_lengthI [effect_intros]:\n  assumes \"h' = h\" \"r = length h a\"\n  shows \"effect (len a) h h' r\"\n  by (rule effectI) (simp add: assms execute_simps)\n\nlemma effect_lengthE [effect_elims]:\n  assumes \"effect (len a) h h' r\"\n  obtains \"r = length h' a\" \"h' = h\" \n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_nth [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n    execute (nth a i) h = Some (get h a ! i, h)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (nth a i) h = None\"\n  by (simp_all add: nth_def execute_simps)\n\nlemma success_nthI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (nth a i) h\"\n  by (auto intro: success_intros simp add: nth_def)\n\nlemma effect_nthI [effect_intros]:\n  assumes \"i < length h a\" \"h' = h\" \"r = get h a ! i\"\n  shows \"effect (nth a i) h h' r\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_nthE [effect_elims]:\n  assumes \"effect (nth a i) h h' r\"\n  obtains \"i < length h a\" \"r = get h a ! i\" \"h' = h\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_upd [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n    execute (upd i x a) h = Some (a, update a i x h)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (upd i x a) h = None\"\n  by (simp_all add: upd_def execute_simps)\n\nlemma success_updI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (upd i x a) h\"\n  by (auto intro: success_intros simp add: upd_def)\n\nlemma effect_updI [effect_intros]:\n  assumes \"i < length h a\" \"h' = update a i v h\"\n  shows \"effect (upd i v a) h h' a\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_updE [effect_elims]:\n  assumes \"effect (upd i v a) h h' r\"\n  obtains \"r = a\" \"h' = update a i v h\" \"i < length h a\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_map_entry [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n   execute (map_entry i f a) h =\n      Some (a, update a i (f (get h a ! i)) h)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (map_entry i f a) h = None\"\n  by (simp_all add: map_entry_def execute_simps)\n\nlemma success_map_entryI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (map_entry i f a) h\"\n  by (auto intro: success_intros simp add: map_entry_def)\n\nlemma effect_map_entryI [effect_intros]:\n  assumes \"i < length h a\" \"h' = update a i (f (get h a ! i)) h\" \"r = a\"\n  shows \"effect (map_entry i f a) h h' r\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_map_entryE [effect_elims]:\n  assumes \"effect (map_entry i f a) h h' r\"\n  obtains \"r = a\" \"h' = update a i (f (get h a ! i)) h\" \"i < length h a\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_swap [execute_simps]:\n  \"i < length h a \\<Longrightarrow>\n   execute (swap i x a) h =\n      Some (get h a ! i, update a i x h)\"\n  \"i \\<ge> length h a \\<Longrightarrow> execute (swap i x a) h = None\"\n  by (simp_all add: swap_def execute_simps)\n\nlemma success_swapI [success_intros]:\n  \"i < length h a \\<Longrightarrow> success (swap i x a) h\"\n  by (auto intro: success_intros simp add: swap_def)\n\nlemma effect_swapI [effect_intros]:\n  assumes \"i < length h a\" \"h' = update a i x h\" \"r = get h a ! i\"\n  shows \"effect (swap i x a) h h' r\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_swapE [effect_elims]:\n  assumes \"effect (swap i x a) h h' r\"\n  obtains \"r = get h a ! i\" \"h' = update a i x h\" \"i < length h a\"\n  using assms by (rule effectE) (cases \"i < length h a\", auto simp: execute_simps elim: successE)\n\nlemma execute_freeze [execute_simps]:\n  \"execute (freeze a) h = Some (get h a, h)\"\n  by (simp add: freeze_def execute_simps)\n\nlemma success_freezeI [success_intros]:\n  \"success (freeze a) h\"\n  by (auto intro: success_intros simp add: freeze_def)\n\nlemma effect_freezeI [effect_intros]:\n  assumes \"h' = h\" \"r = get h a\"\n  shows \"effect (freeze a) h h' r\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_freezeE [effect_elims]:\n  assumes \"effect (freeze a) h h' r\"\n  obtains \"h' = h\" \"r = get h a\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma upd_return:\n  \"upd i x a \\<guillemotright> return a = upd i x a\"\n  by (rule Heap_eqI) (simp add: bind_def guard_def upd_def execute_simps)\n\nlemma array_make:\n  \"new n x = make n (\\<lambda>_. x)\"\n  by (rule Heap_eqI) (simp add: map_replicate_trivial execute_simps)\n\nlemma array_of_list_make [code]:\n  \"of_list xs = make (List.length xs) (\\<lambda>n. xs ! n)\"\n  by (rule Heap_eqI) (simp add: map_nth execute_simps)\n\nhide_const (open) present get set alloc length update noteq new of_list make len nth upd map_entry swap freeze\n\n\nsubsection {* Code generator setup *}\n\nsubsubsection {* Logical intermediate layer *}\n\ndefinition new' where\n  [code del]: \"new' = Array.new o nat_of_integer\"\n\n\n\ndefinition make' where\n  [code del]: \"make' i f = Array.make (nat_of_integer i) (f o of_nat)\"\n\nlemma [code]:\n  \"Array.make n f = make' (of_nat n) (f o nat_of_integer)\"\n  by (simp add: make'_def o_def)\n\ndefinition len' where\n  [code del]: \"len' a = Array.len a \\<guillemotright>= (\\<lambda>n. return (of_nat n))\"\n\nlemma [code]:\n  \"Array.len a = len' a \\<guillemotright>= (\\<lambda>i. return (nat_of_integer i))\"\n  by (simp add: len'_def)\n\ndefinition nth' where\n  [code del]: \"nth' a = Array.nth a o nat_of_integer\"\n\nlemma [code]:\n  \"Array.nth a n = nth' a (of_nat n)\"\n  by (simp add: nth'_def)\n\ndefinition upd' where\n  [code del]: \"upd' a i x = Array.upd (nat_of_integer i) x a \\<guillemotright> return ()\"\n\nlemma [code]:\n  \"Array.upd i x a = upd' a (of_nat i) x \\<guillemotright> return a\"\n  by (simp add: upd'_def upd_return)\n\nlemma [code]:\n  \"Array.map_entry i f a = do {\n     x \\<leftarrow> Array.nth a i;\n     Array.upd i (f x) a\n   }\"\n  by (rule Heap_eqI) (simp add: bind_def guard_def map_entry_def execute_simps)\n\nlemma [code]:\n  \"Array.swap i x a = do {\n     y \\<leftarrow> Array.nth a i;\n     Array.upd i x a;\n     return y\n   }\"\n  by (rule Heap_eqI) (simp add: bind_def guard_def swap_def execute_simps)\n\nlemma [code]:\n  \"Array.freeze a = do {\n     n \\<leftarrow> Array.len a;\n     Heap_Monad.fold_map (\\<lambda>i. Array.nth a i) [0..<n]\n   }\"\nproof (rule Heap_eqI)\n  fix h\n  have *: \"List.map\n     (\\<lambda>x. fst (the (if x < Array.length h a\n                    then Some (Array.get h a ! x, h) else None)))\n     [0..<Array.length h a] =\n       List.map (List.nth (Array.get h a)) [0..<Array.length h a]\"\n    by simp\n  have \"execute (Heap_Monad.fold_map (Array.nth a) [0..<Array.length h a]) h =\n    Some (Array.get h a, h)\"\n    apply (subst execute_fold_map_unchanged_heap)\n    apply (simp_all add: nth_def guard_def *)\n    apply (simp add: length_def map_nth)\n    done\n  then have \"execute (do {\n      n \\<leftarrow> Array.len a;\n      Heap_Monad.fold_map (Array.nth a) [0..<n]\n    }) h = Some (Array.get h a, h)\"\n    by (auto intro: execute_bind_eq_SomeI simp add: execute_simps)\n  then show \"execute (Array.freeze a) h = execute (do {\n      n \\<leftarrow> Array.len a;\n      Heap_Monad.fold_map (Array.nth a) [0..<n]\n    }) h\" by (simp add: execute_simps)\nqed\n\nhide_const (open) new' make' len' nth' upd'\n\n\ntext {* SML *}\n\ncode_printing type_constructor array \\<rightharpoonup> (SML) \"_/ array\"\ncode_printing constant Array \\<rightharpoonup> (SML) \"raise/ (Fail/ \\\"bare Array\\\")\"\ncode_printing constant Array.new' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.array/ ((_),/ (_)))\"\ncode_printing constant Array.of_list \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.fromList/ _)\"\ncode_printing constant Array.make' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.tabulate/ ((_),/ (_)))\"\ncode_printing constant Array.len' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.length/ _)\"\ncode_printing constant Array.nth' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.sub/ ((_),/ (_)))\"\ncode_printing constant Array.upd' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ Array.update/ ((_),/ (_),/ (_)))\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (SML) infixl 6 \"=\"\n\ncode_reserved SML Array\n\n\ntext {* OCaml *}\n\ncode_printing type_constructor array \\<rightharpoonup> (OCaml) \"_/ array\"\ncode_printing constant Array \\<rightharpoonup> (OCaml) \"failwith/ \\\"bare Array\\\"\"\ncode_printing constant Array.new' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.make/ (Big'_int.int'_of'_big'_int/ _)/ _)\"\ncode_printing constant Array.of_list \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.of'_list/ _)\"\ncode_printing constant Array.make' \\<rightharpoonup> (OCaml)\n  \"(fun/ ()/ ->/ Array.init/ (Big'_int.int'_of'_big'_int/ _)/ (fun k'_ ->/ _/ (Big'_int.big'_int'_of'_int/ k'_)))\"\ncode_printing constant Array.len' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Big'_int.big'_int'_of'_int/ (Array.length/ _))\"\ncode_printing constant Array.nth' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.get/ _/ (Big'_int.int'_of'_big'_int/ _))\"\ncode_printing constant Array.upd' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ Array.set/ _/ (Big'_int.int'_of'_big'_int/ _)/ _)\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (OCaml) infixl 4 \"=\"\n\ncode_reserved OCaml Array\n\n\ntext {* Haskell *}\n\ncode_printing type_constructor array \\<rightharpoonup> (Haskell) \"Heap.STArray/ Heap.RealWorld/ _\"\ncode_printing constant Array \\<rightharpoonup> (Haskell) \"error/ \\\"bare Array\\\"\"\ncode_printing constant Array.new' \\<rightharpoonup> (Haskell) \"Heap.newArray\"\ncode_printing constant Array.of_list \\<rightharpoonup> (Haskell) \"Heap.newListArray\"\ncode_printing constant Array.make' \\<rightharpoonup> (Haskell) \"Heap.newFunArray\"\ncode_printing constant Array.len' \\<rightharpoonup> (Haskell) \"Heap.lengthArray\"\ncode_printing constant Array.nth' \\<rightharpoonup> (Haskell) \"Heap.readArray\"\ncode_printing constant Array.upd' \\<rightharpoonup> (Haskell) \"Heap.writeArray\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (Haskell) infix 4 \"==\"\ncode_printing class_instance array :: HOL.equal \\<rightharpoonup> (Haskell) -\n\n\ntext {* Scala *}\n\ncode_printing type_constructor array \\<rightharpoonup> (Scala) \"!collection.mutable.ArraySeq[_]\"\ncode_printing constant Array \\<rightharpoonup> (Scala) \"!sys.error(\\\"bare Array\\\")\"\ncode_printing constant Array.new' \\<rightharpoonup> (Scala) \"('_: Unit)/ => / Array.alloc((_))((_))\"\ncode_printing constant Array.make' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.make((_))((_))\"\ncode_printing constant Array.len' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.len((_))\"\ncode_printing constant Array.nth' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.nth((_), (_))\"\ncode_printing constant Array.upd' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.upd((_), (_), (_))\"\ncode_printing constant Array.freeze \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Array.freeze((_))\"\ncode_printing constant \"HOL.equal :: 'a array \\<Rightarrow> 'a array \\<Rightarrow> bool\" \\<rightharpoonup> (Scala) infixl 5 \"==\"\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Imperative_HOL/Array.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.607663184043154, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.30620522804269357}}
{"text": "section \\<open>Helping Lemmas\\<close>\n\ntheory Helping_Lemmas\n  imports Assumptions Comm_Idem_Modulo\nbegin\n\ninstance predicate :: bounded_lattice\n  by (rule instance_predicate_lattice)\n\nlemma idx_inj[simp]: \"idx b x = idx c y \\<longleftrightarrow> b = c \\<and> x = y\"\n  apply (cases x; cases y) \n  using idxq_inj idxc_inj by auto\n\nlemma idx_inj'[simp]: \"inj (idx c)\"\n  apply (rule injI) by simp\n\nlemma idx12_union: \"idx12 (X \\<union> Y) = idx12 X \\<union> idx12 Y\"\n  unfolding idx12_def by auto\nlemma idx12_inter: \"idx12 (X \\<inter> Y) = idx12 X \\<inter> idx12 Y\"\n  unfolding idx12_def by auto\nlemma idx12_diff: \"idx12 (X - Y) = idx12 X - idx12 Y\"\n  unfolding idx12_def by auto\nlemma idx12_empty[simp]: \"idx12 {} = {}\"\n  unfolding idx12_def by auto\nlemma idx12_empty'[simp]: \"idx12 X = {} \\<longleftrightarrow> X = {}\"\n  unfolding idx12_def by auto\nlemma idx12_insert[simp]: \"idx12 (insert x X) = insert (idx True x) (insert (idx False x) (idx12 X))\"\n  unfolding idx12_def by auto\n\nlemma is_classical_QVar[simp]: \"\\<not> is_classical (QVar q)\"\n  using is_classical.cases by blast\nlemma is_classical_idx[simp]: \"is_classical (idx b x) = is_classical x\"\n  apply (cases x; cases b)\n  using is_classical.cases is_classical.intros by auto\n\nlemma fve_some_constant[simp]: \"fve some_constant = {}\"\n  unfolding some_constant_def apply (rule someI_ex) by (rule ex_constant)\n\nlemma substitute_program:\n  assumes \"program p\"\n  shows \"substitute p s = p\"\n  using assms apply induction by auto\n\nlemma program_substitute[intro]:\n  assumes \"\\<And>i. program (s i)\"\n  shows \"program (substitute C s)\"\n  apply (induction C)\n  by (auto intro!: assms program.intros)\n\n\nlemma finite_fv[simp]: \"finite (fv C)\"\n  apply (induction C) by auto\n\nlemma fv_subst: \"fv (substitute C s) \\<supseteq> fv C\"\n  apply (induction C) by auto\n\nlemma fv_subst': \"fv (substitute C s) \\<subseteq> fv C \\<union> ((\\<Union>i\\<in>holes C. fv (s i)) - covered C)\"\n  apply (induction C) by auto\n\nlemma program_inner: \n  assumes \"program p\"\n  shows \"inner p = {}\"\n  using assms apply induction by auto\n\nlemma program_covered: \n  assumes \"program p\"\n  shows \"covered p = UNIV\"\n  using assms apply (induction p) by auto\n\nlemma fv_subst_covered: \"fv (substitute C s) \\<inter> covered C = fv C \\<inter> covered C\"\n  apply (induction C) by auto\n\nlemma covered_subst: \"covered (substitute C s) \\<supseteq> covered C \\<union> (\\<Inter>i\\<in>holes C. covered (s i))\"\n  apply (induction C) by auto\n\nlemma finite_overwr[simp]: \"finite (overwr C)\"\n  apply (induction C) by auto\n\nlemma overwr_fv: \"overwr C \\<subseteq> fv C\"\n  apply (induction C) by auto\n\n\nlemma overwr_subst: \"overwr (substitute C s) \\<supseteq> overwr C\"\nproof (induction C)\n  case (Seq C1 C2)\n  then show ?case \n    using covered_subst fv_subst_covered by fastforce+\nqed auto\n\n\nlemma finite_written[simp]: \"finite (written C)\"\n  apply (induction C) by auto\n\nlemma \"quantum' (fv C) \\<subseteq> written C\"\n  apply (induction C) by (auto simp: quantum'_def)\n\nlemma denot_eq'_refl[simp]: \"C =d= C\"\n  by (simp add: denot_eq'_def program.intros(3) program_substitute)\n\nlemma denot_eq'_reflI[simp]: \"C = D \\<Longrightarrow> C =d= D\"\n  by simp\n\nlemma denot_eq'_sym: \"C =d= D \\<Longrightarrow> D =d= C\"\n  by (simp add: denot_eq'_def denot_eq_sym program.intros(3) program_substitute)\n\nlemma denot_eq'_cong_local: \"C =d= D \\<Longrightarrow> Local X C =d= Local X D\"\n  by (simp add: denot_eq'_def denot_eq_cong_local program.intros(3) program_substitute)\n\nlemma denot_eq'_trans[trans]: \"C =d= D \\<Longrightarrow> D =d= E \\<Longrightarrow> C =d= E\"\n  by (metis (no_types, lifting) denot_eq'_def denot_eq_trans program.intros(3) program_substitute)\n\nlemma equivp_denot_eq'[simp]: \"equivp (=d=)\"\n  apply (auto intro!: equivpI reflpI sympI transpI)\n  using denot_eq'_sym apply blast\n  using denot_eq'_trans by blast\n\nlemma written_subst_Skip[simp]: \"written (substitute c (\\<lambda>_. Skip)) = written c\"\n  apply (induction c) by auto\nlemma fv_subst_Skip[simp]: \"fv (substitute c (\\<lambda>_. Skip)) = fv c\"\n  apply (induction c) by auto\nlemma overwr_subst_Skip: \"overwr p \\<subseteq> overwr (substitute p (\\<lambda>_. Skip))\"\n  apply (induction p) apply (simp_all)\n    apply blast\n   apply blast\n  using program.intros(3) program_covered program_substitute by auto\n\nlemma written_subst': \"written (substitute C s)\n  \\<subseteq> written C \\<union> (\\<Union>i\\<in>holes C. written (s i))\"\n  apply (induction C) by auto\n\nlemma inner_subst': \"inner (substitute C s)\n  \\<subseteq> inner C \\<union> (\\<Union>i\\<in>holes C. inner (s i))\"\nproof (induction C)\n  case (Local v C)\n  show ?case\n  proof (cases \"program (substitute C s)\")\n    case True\n    then show ?thesis\n      by simp\n  next\n    case False\n    with Local show ?thesis\n      apply auto\n      apply (metis inner.simps(12) insert_iff substitute_program)\n      by (metis (no_types, lifting) UN_iff Un_iff inner.simps(12) insertCI subsetD substitute_program)\n  qed\nqed auto\n\nlemma seq:\n  assumes \"qRHL A p1 p2 B\"\n  assumes \"qRHL B p1' p2' C\"\n  shows \"qRHL A (p1; p1') (p2; p2') C\"\n  using assms(1) assms(2) program.intros(3) program_substitute qRHL_def seq0 by auto\n\nlemma conseq_post:\n  assumes \"qRHL A p1 p2 B\"\n  assumes \"B \\<le> C\"\n  shows \"qRHL A p1 p2 C\"\n  using assms(1) assms(2) conseq_post0 program.intros(3) program_substitute qRHL_def by auto\n\n\nlemma denot_eq_seq_assoc:\n  shows \"(c; d); e =d= c; (d; e)\"\n  by (simp add: denot_eq'_def denot_eq_seq_assoc0 program.intros(3) program_substitute)\n\nlemma denot_eq_seq_cong1:\n  assumes \"c =d= d\"\n  shows \"c; e =d= d; e\"\n  using assms denot_eq'_def denot_eq_seq_cong10 program.intros(3) program_substitute by auto\n\nlemma denot_eq_seq_cong2:\n  assumes \"c =d= d\"\n  shows \"e; c =d= e; d\"\n  using assms denot_eq'_def denot_eq_seq_cong20 program.intros(3) program_substitute by auto\n\nlemma denot_eq_while_cong:\n  assumes \"c =d= d\"\n  shows \"While e c =d= While e d\"\n  using assms denot_eq'_def denot_eq_while_cong0 program.intros program_substitute by auto\n\nlemma denot_eq_ifte_cong1:\n  assumes \"c =d= d\"\n  shows \"IfTE f c e =d= IfTE f d e\"\n  using assms denot_eq'_def denot_eq_ifte_cong10 program.intros program_substitute by auto\n\nlemma denot_eq_ifte_cong2:\n  assumes \"c =d= d\"\n  shows \"IfTE f e c =d= IfTE f e d\"\n  using assms denot_eq'_def denot_eq_ifte_cong20 program.intros program_substitute by auto\n\nlemma denot_eq_qrhl_left:\n  assumes \"p1 =d= p1'\"\n  shows \"qRHL A p1 p2 B \\<longleftrightarrow> qRHL A p1' p2 B\"\n  using assms denot_eq'_def denot_eq_qrhl_left0 program.intros(3) program_substitute qRHL_def by auto\n\nlemma denot_eq_qrhl_right:\n  assumes \"p2 =d= p2'\"\n  shows \"qRHL A p1 p2 B \\<longleftrightarrow> qRHL A p1 p2' B\"\n  using assms denot_eq'_def denot_eq_qrhl_right0 program.intros(3) program_substitute qRHL_def by auto\n\nlemma denot_eq_init:\n  assumes \"CVar ` set X \\<subseteq> overwr p\"\n  shows \"Assign X some_constant; p =d= p\"\n  by (smt assms denot_eq'_def denot_eq_init0 overwr_subst program.intros(3) program_substitute subset_trans substitute.simps(3) substitute.simps(7))\n\nlemma denot_eq_qinit:\n  assumes \"distinct Q\"\n  assumes \"QVar ` set Q \\<subseteq> overwr p\"\n  shows \"QInit Q some_constant; p =d= p\"\n  by (smt assms(1) assms(2) denot_eq'_def denot_eq_qinit0 overwr_subst program.intros(3) program.intros(4) program_substitute subset_trans substitute.simps(3) substitute_program)\n\n\nlemma assign_Eq: \"qRHL top (Assign X some_constant) (Assign X some_constant) (Eq (CVar ` set X))\"\n  by (simp add: assign_Eq0 qRHL_def)\n\nlemma qinit_Eq: \"distinct Q \\<Longrightarrow> qRHL top (QInit Q some_constant) (QInit Q some_constant) (Eq (QVar ` set Q))\"\n  by (simp add: qRHL_def qinit_Eq0)\n\nlemma frame_rule:\n  fixes c d R\n  assumes \"(idx True ` written c) \\<inter> fvp R = {}\"\n  assumes \"(idx False ` written d) \\<inter> fvp R = {}\"\n  assumes \"qRHL A c d B\"\n  shows \"qRHL (A \\<sqinter> R) c d (B \\<sqinter> R)\"\n  using assms frame_rule0 program.intros(3) program_substitute qRHL_def by auto\n\nlemma varchange:\n  assumes \"is_quantum' Q\" and \"is_quantum' Q'\"\n  assumes \"q \\<in> Q\" and \"infinite_var q\"\n  assumes \"(fvp A \\<union> fvp B) \\<inter> (idx12 Q \\<inter> idx12 Q') = {}\"\n  assumes \"(fv c \\<union> fv d) \\<inter> (Q \\<union> Q') = {}\"\n  assumes \"qRHL (A \\<sqinter> Eq (Vl \\<union> Q)) c d (B \\<sqinter> Eq (Vr \\<union> Q))\"\n  shows \"qRHL (A \\<sqinter> Eq (Vl \\<union> Q')) c d (B \\<sqinter> Eq (Vr \\<union> Q'))\"\n  unfolding qRHL_def\n  apply (rule varchange0)\n  using assms unfolding qRHL_def\n  by (auto intro!: program_substitute program.intros)\n\nlemma drop_Eq:\n  assumes \"is_classical' X\"\n  assumes \"fvp A \\<inter> idx12 X = {}\"\n  assumes \"fv c \\<inter> X = {}\"\n  assumes \"fv d \\<inter> X = {}\"\n  assumes \"qRHL (A \\<sqinter> Eq X) c d B\"\n  shows \"qRHL A c d B\"\n  using assms(1) assms(2) assms(3) assms(4) assms(5) drop_Eq0 program.intros(3) program_substitute qRHL_def by auto\n\nlemma equal_rule:\n  assumes \"fv p \\<subseteq> V\"\n  shows \"qRHL (Eq V) p p (Eq V)\"\n  by (simp add: assms equal_rule0 program.intros(3) program_substitute qRHL_def)\n\nlemma joint_while_rule:\n  assumes \"A \\<le> Eq (CVar ` fve e)\"\n  assumes \"qRHL A c d A\"\n  shows \"qRHL A (While e c) (While e d) A\"\n  using assms(1) assms(2) joint_while_rule0 program.intros(3) program_substitute qRHL_def by auto\n\nlemma joint_if_rule:\n  assumes \"A \\<le> Eq (CVar ` fve e)\"\n  assumes \"qRHL A c1 c2 B\"\n  assumes \"qRHL A d1 d2 B\"\n  shows \"qRHL A (IfTE e c1 d1) (IfTE e c2 d2) A\"\n  using assms(1) assms(2) assms(3) joint_if_rule0 program.intros(3) program_substitute qRHL_def by auto\n\nlemma joint_local0_rule:\n  assumes \"idx True v \\<notin> fvp A\"\n  assumes \"idx False v \\<notin> fvp A\"\n  assumes \"v \\<notin> S\"\n  assumes \"v \\<notin> R\"\n  assumes \"qRHL (A \\<sqinter> Eq (insert v S)) c d (A \\<sqinter> Eq (insert v R))\"\n  shows \"qRHL (A \\<sqinter> Eq S) (Local v c) (Local v d) (A \\<sqinter> Eq R)\"\n  using assms(1) assms(2) assms(3) assms(4) assms(5) joint_local0_rule0 program.intros(3) program_substitute qRHL_def by auto\n\nlemma joint_init_eq0:\n  assumes \"QVar ` set Q \\<subseteq> V\"\n  assumes \"is_quantum' V\"\n  shows \"qRHL (Eq V) \n        (QInit Q some_constant) (QInit Q some_constant)\n        (Eq (V - QVar ` set Q))\"\n  \n  by (simp add: assms(1) assms(2) joint_init_eq00 qRHL_def)\n\nlemma seq_c_skip[simp]: \"c; Skip =d= c\"\n  by (simp add: denot_eq'_def program.intros(3) program_substitute)\n\nlemma seq_skip_c[simp]: \"Skip; c =d= c\"  \n  by (simp add: denot_eq'_def program.intros(3) program_substitute)\n\nlemma local_idem[simp]: \"Local x (Local x C) =d= Local x C\"\n  by (simp add: denot_eq'_def program.intros(3) program_substitute) \n\nlemma local_swap: \"Local x (Local y C) =d= Local y (Local x C)\"\n  by (simp add: denot_eq'_def local_swap0 program.intros(3) program_substitute)\n\n\nlemmas seq_trans[trans] = seq[rotated 2]\n\nlemmas conseq_post_trans[trans] = conseq_post[rotated 2]\n\nlemmas denot_eq_qrhl_left_trans[trans] = denot_eq_qrhl_left[rotated 1, THEN iffD1, rotated -1]\n\nlemmas denot_eq_qrhl_right_trans[trans] = denot_eq_qrhl_right[rotated 1, THEN iffD1, rotated -1]\n\nlemma fvp_inter_empty:\n  assumes \"X \\<inter> fvp A = {}\"\n  assumes \"X \\<inter> fvp B = {}\"\n  shows \"X \\<inter> fvp (A \\<sqinter> B) = {}\"\n  using assms fvp_inter by blast \n\nlemma Eq_split': \n  assumes \"is_classical' Y\"\n  shows \"Eq (X \\<union> Y) = Eq X \\<sqinter> Eq Y\"\n  using Eq_split assms\n  by (metis Un_commute inf_commute)\n\nlemma X_inter_CVar: \"X \\<inter> range CVar = classical' X\"\n  unfolding classical'_def apply auto\n  using is_classical.cases by blast\n\nlemma X_inter_QVar: \"X \\<inter> range QVar = quantum' X\"\n  unfolding quantum'_def apply auto\n  by (metis (full_types) is_classical.intros rangeI var.exhaust)\n\n\nlemma fv_block[simp]: \"fv (block L) = (\\<Union>c\\<in>set L. fv c)\"\n  apply (induction L) by auto\n\nlemma program_blockI[intro]: \n  assumes \"\\<And>x. x\\<in>set b \\<Longrightarrow> program x\"\n  shows \"program (block b)\"\n  using assms apply (induction b)\n  by (auto simp: program.intros)\n\n\nglobal_interpretation locals: comm_idem_modulo Local denot_eq'\n  defines locals = locals.F\n  apply unfold_locales\n     apply simp\n    apply (simp add: denot_eq'_def denot_eq_cong_local program.intros(3) program_substitute)\n   apply simp\n  by (simp add: local_swap)\n\nlemma program_localsI[intro]:\n  assumes \"finite V\"\n  assumes \"program c\"\n  shows \"program (locals V c)\"\n  using assms(1)\n  apply (induction rule: locals.F_induct)\n  using assms program.intros by auto\n\nlemma fv_locals[simp]: \n  assumes \"finite V\"\n  shows \"fv (locals V c) = fv c - V\"\n  using assms apply (induction rule:locals.F_induct)\n  by auto\n\n\nlemma program_init[simp]:\n  \"program (init v)\"\n  by (cases v, auto simp: program.intros)\n\nlemma init_idem: \"init x; init x =d= init x\"\n  apply (cases x)\n  by (auto intro!: denot_eq_qinit denot_eq_init)\n\nlemma overwr_init[simp]: \"overwr (init v) = {v}\"\n  apply (cases v) by auto\nlemma fv_init[simp]: \"fv (init v) = {v}\"\n  apply (cases v) by auto\nlemma covered_init[simp]: \"covered (init v) = UNIV\"\n  apply (cases v) by auto\n\nlemma swap:\n  assumes \"fv c \\<inter> fv d = {}\"\n  shows \"c;d =d= d;c\"\n  by (simp add: assms denot_eq'_def program.intros(3) program_substitute swap0)\n\n\n\nglobal_interpretation inits: comm_idem_modulo \\<open>\\<lambda>v c. Seq (init v) c\\<close> \"(=d=)\"\nproof unfold_locales\n  show \"equivp (=d=)\"\n    by simp\n  fix a b x  \n  show \"a =d= b \\<Longrightarrow>\n       init x; a =d= init x; b\"\n    by (simp add: denot_eq_seq_cong2)\n  fix z\n  show \"init x; (init x; z) =d= init x; z\"\n  proof -\n    have \"init x; (init x; z) =d= (init x; init x); z\"\n      by (simp add: denot_eq_seq_assoc locals.R_sym)\n    also have \"\\<dots> =d= init x; z\"\n      by (simp add: denot_eq_seq_cong1 init_idem)\n    finally show ?thesis\n      by -\n  qed\n  fix y\n  show \"(init y; (init x; z)) =d=\n        (init x; (init y; z))\"\n  proof -\n    have \"(init y; (init x; z)) =d= (init y; init x); z\"\n      by (simp add: denot_eq_seq_assoc locals.R_sym)\n    also have \"\\<dots> =d= (init x; init y); z\"\n      apply (rule denot_eq_seq_cong1)\n      apply (cases \"x=y\", simp)\n      by (auto intro!: swap)\n    also have \"\\<dots> =d= (init x; (init y; z))\"\n      by (simp add: denot_eq_seq_assoc locals.R_sym)\n    finally show ?thesis\n      by -\n  qed\nqed\n\ndefinition \"inits V = inits.F V Skip\"\n\nlemma inits_empty[simp]: \"inits {} = Skip\"\n  unfolding inits_def by simp\n\nlemmas locals_foldr = locals.F_foldr\n\nlemma program_initsFI[intro]:\n  assumes \"finite V\"\n  assumes \"program c\"\n  shows \"program (inits.F V c)\"\n  using assms(1)\n  apply (induction rule: inits.F_induct)\n  using assms program.intros by auto\n\nlemma program_initsI[intro]:\n  assumes \"finite V\"\n  shows \"program (inits V)\"\n  using assms inits_def program.intros(3) by auto\n\n\nlemmas denot_eq_cong_locals = locals.R_cong_F\n\nlemmas locals_join = locals.F_join\n\nlemma fv_inits[simp]: \n  assumes \"finite V\"\n  shows \"fv (inits V) = V\"\n  using assms unfolding inits_def\n  apply (induction rule:inits.F_induct)\n  by auto\n\nlemma overwr_inits[simp]: \n  assumes \"finite V\"\n  shows \"overwr (inits V) = V\"\n  using assms unfolding inits_def\n  apply (induction rule:inits.F_induct)\n  by auto\n\nlemma covered_inits[simp]: \n  assumes \"finite V\"\n  shows \"covered (inits V) = UNIV\"\n  using assms unfolding inits_def\n  apply (induction rule:inits.F_induct)\n  by auto\n\nlemma overwr_locals[simp]: \n  assumes \"finite V\"\n  shows \"overwr (locals V c) = overwr c - V\"\n  using assms \n  apply (induction rule:locals.F_induct)\n  by auto\n\nlemma covered_locals[simp]: \n  assumes \"finite V\"\n  shows \"covered (locals V c) = covered c \\<union> V\"\n  using assms \n  apply (induction rule:locals.F_induct)\n  by auto\n\nlemma local_unused:\n  assumes \"x \\<notin> fv C\"\n  shows \"Local x C =d= C\"\n  using assms by (auto simp: denot_eq'_def intro!: local_unused0 program_substitute program.intros)\n\nlemma locals_unused:\n  assumes \"finite V\"\n  assumes \"V \\<inter> fv C = {}\"\n  shows \"locals V C =d= C\"\n  using assms\n  apply (induction rule:locals.F_induct)\n   apply simp\n  by (meson insert_disjoint(1) local_unused locals.R_trans locals.cong_R)\n\nlemma local_seq_merge:\n  shows \"Local x c1; Local x c2 =d= Local x (c1; init x; c2)\"\n  by (auto simp: substitute_program denot_eq'_def intro!: program_substitute program.intros local_seq_merge0)\n\nlemma local_seq2:\n  assumes \"x \\<notin> fv c1\"\n  shows \"c1; Local x c2 =d= Local x (c1; c2)\"\nproof -\n  have \"c1; Local x c2 =d= Local x c1; Local x c2\"\n    using assms denot_eq_seq_cong1 local_unused locals.R_sym by blast\n  also have \"\\<dots> =d= Local x (c1; init x; c2)\"\n    by (simp add: local_seq_merge)\n  also have \"\\<dots> =d= Local x (init x; c1; c2)\"\n    by (simp add: Helping_Lemmas.swap assms denot_eq_seq_cong1 locals.cong_R)\n  also have \"\\<dots> =d= Local x (init x; (c1; c2))\"\n    by (simp add: comm_idem_modulo.cong_R denot_eq_seq_assoc locals.comm_idem_modulo_axioms)\n  also have \"\\<dots> =d= Local x (c1; c2)\"\n    by (smt denot_eq'_def local_init_beginning0 locals.R_sym program.intros(3) program_init program_substitute substitute.simps(3) substitute.simps(6) substitute_program)\n  finally show ?thesis\n    by -\nqed\n\n\nlemma locals_seq2:\n  assumes \"finite V\"\n  assumes \"V \\<inter> fv c1 = {}\"\n  shows \"c1; locals V c2 =d= locals V (c1; c2)\"\n  using assms\nproof (induction V)\n  case empty\n  then show ?case \n    by simp\nnext\n  case (insert x F)\n  then have [simp]: \"finite F\" by -\n\n  have \"c1; locals (insert x F) c2 =d= c1; Local x (locals F c2)\"\n    by (simp add: denot_eq_seq_cong2 locals.F_insert)\n  also have \"\\<dots> =d= Local x (c1; (locals F c2))\"\n    using insert.prems local_seq2 by auto\n  also have \"\\<dots> =d= Local x (locals F (c1; c2))\"\n    using denot_eq'_cong_local insert.IH insert.prems by blast\n  also have \"\\<dots> =d= locals (insert x F) (c1 ; c2)\"\n    using denot_eq'_sym insert.hyps(1) locals.F_insert by blast\n  finally show ?case \n    by -\nqed\n\nlemma inits_singleton[simp]: \"inits {x} =d= init x\"\n  unfolding inits_def by auto\n\nlemma init_inits:\n  assumes \"finite V\"\n  shows \"init x; inits V =d= inits (insert x V)\"\n  by (simp add: assms equivp_symp inits.F_insert inits.equiv_R inits_def)\n\nlemma inits_init:\n  assumes \"finite V\"\n  shows \"inits V; init x =d= inits (insert x V)\"\n  using assms \nproof (induction V)\n  case empty\n  have \"inits {} ; init x =d= init x\"\n    by auto\n  also have \"init x =d= inits {x}\"\n    by (simp add: locals.R_sym)\n  finally show ?case \n    by -\nnext\n  case (insert y F)\n  have \"inits (insert y F); init x =d= init y; inits F; init x\"\n    using denot_eq_seq_cong1 inits.F_insert inits_def insert.hyps(1) program.intros(10) program_initsI by auto\n  also have \"\\<dots> =d= init y; (inits (insert x F))\"\n    by (meson denot_eq_seq_assoc inits.cong_R insert.IH insert.hyps(1) locals.R_trans program_init program_initsI)\n  also have \"\\<dots> =d= inits (insert y (insert x F))\"\n    by (simp add: init_inits insert.hyps(1))\n  finally show ?case\n    by (simp add: insert_commute)\nqed\n\nlemma locals_seq_merge:\n  assumes \"finite V\"\n  assumes [simp]: \"program c1\" and \"program c2\"\n  shows \"locals V c1; locals V c2 =d= locals V (c1; inits V; c2)\"\n  using assms\nproof (induction V arbitrary: c2)\n  case empty\n  then show ?case\n    by (simp add: denot_eq_seq_cong1 locals.R_sym program.intros(10) program.intros(3)) \nnext\n  case (insert x F)\n  then have [simp]: \"program c2\" and [simp]: \"finite F\"\n    by auto\n  have \"locals (insert x F) c1; locals (insert x F) c2\n    =d= Local x (locals F c1); locals (insert x F) c2\"\n    by (simp add: denot_eq_seq_cong1 locals.F_insert program.intros(9) program_localsI)\n  also have \"\\<dots> =d= Local x (locals F c1); Local x (locals F c2)\"\n    by (simp add: denot_eq_seq_cong2 locals.F_insert program.intros(9) program_localsI)\n  also have \"\\<dots> =d= Local x (locals F c1; (init x; locals F c2))\"\n    by (meson insert denot_eq'_cong_local denot_eq_seq_assoc insert.hyps(1) local_seq_merge locals.R_trans program_init program_localsI)\n  also have \"\\<dots> =d= Local x (locals F c1; locals F (init x; c2))\"\n    by (simp add: denot_eq'_cong_local denot_eq_seq_cong2 insert.hyps(2) locals_seq2 program.intros(10) program_localsI)\n  also have \"\\<dots> =d= Local x (locals F (c1; inits F; (init x; c2)))\"\n    by (simp add: denot_eq'_cong_local insert.IH program.intros(10))\n  also have \"\\<dots> =d= Local x (locals F (c1; (inits F; init x); c2))\"\n    apply (auto intro!: denot_eq'_cong_local denot_eq_cong_locals)\n    apply (rule denot_eq'_trans)\n     apply (rule denot_eq_seq_assoc[THEN denot_eq'_sym])\n    by (auto intro!: denot_eq_seq_cong1 program.intros denot_eq_seq_assoc)\n  also have \"\\<dots> =d= Local x (locals F (c1; inits (insert x F); c2))\"\n    using inits_init\n    by (simp add: denot_eq'_cong_local denot_eq_cong_locals denot_eq_seq_cong1 denot_eq_seq_cong2 inits_def program.intros(10) program.intros(3) program_initsFI)\n  also have \"\\<dots> =d= locals (insert x F) (c1; inits (insert x F); c2)\"\n    using denot_eq'_sym insert.hyps(1) locals.F_insert by blast\n  finally show ?case \n    by -\nqed\n\nlemma inits_inits:\n  assumes \"finite V\" and \"finite W\"\n  shows \"inits V; inits W =d= inits (V\\<union>W)\"\n  using assms(1) \nproof (induction V)\n  case empty\n  show ?case by simp\nnext\n  case (insert x F)\n  have \"inits (insert x F); inits W =d= (init x; inits F); inits W\"\n    by (simp add: denot_eq_seq_cong1 inits.F_insert inits_def insert.hyps(1))\n  also have \"\\<dots> =d= init x; inits (F \\<union> W)\"\n    using denot_eq_seq_assoc denot_eq_seq_cong2 insert.IH locals.R_trans by blast\n  also have \"\\<dots> =d= inits (insert x (F \\<union> W))\"\n    by (simp add: assms(2) init_inits insert.hyps(1))\n  finally show ?case\n    by simp\nqed\n\nlemma local_init_end:\n  shows \"Local x (c; init x) =d= Local x c\"\n  unfolding denot_eq'_def\n  by (simp add: local_init_end0 program.intros(3) program_substitute substitute_program)\n\nlemma locals_init_end:\n  assumes \"finite V\"\n  assumes \"x \\<in> V\"\n  shows \"locals V (c; init x) =d= locals V c\"\n  using assms\nproof (induction V)\n  case empty\n  then show ?case by auto\nnext\n  case (insert y F)\n  show ?case\n  proof (cases \"x = y\")\n    case True\n    have \"locals (insert x F) (c; init x) =d=\n          locals F (Local x (c; init x))\"\n      by (simp add: insert.hyps(1) locals.F_insert')\n    also have \"\\<dots> =d= locals F (Local x c)\"\n      by (simp add: denot_eq_cong_locals local_init_end)\n    also have \"\\<dots> =d= locals (insert x F) c\"\n      using denot_eq'_sym insert.hyps(1) locals.F_insert' by blast\n    finally show ?thesis\n      by (simp add: True)\n  next\n    case False\n    have \"locals (insert y F) (c; init x) =d= \n          Local y (locals F (c; init x))\"\n      by (simp add: insert.hyps(1) locals.F_insert)\n    also have \"\\<dots> =d= Local y (locals F c)\"\n      apply (rule denot_eq'_cong_local)\n      apply (rule insert.IH)\n      using False insert by auto\n    also have \"\\<dots> =d= locals (insert y F) c\"\n      using insert.hyps(1) locals.F_insert locals.R_sym by blast\n    finally show ?thesis\n      by -\n  qed\nqed\n\nlemma locals_inits_end:\n  assumes \"finite V\"\n  assumes \"W \\<subseteq> V\"\n  shows \"locals V (c; inits W) =d= locals V c\"\nproof -\n  from assms have \"finite W\"\n    using infinite_super by blast \n  then show ?thesis\n  proof (insert \\<open>W \\<subseteq> V\\<close>, induction W)\n    case empty\n    show ?case\n      by (simp add: denot_eq_cong_locals)\n  next\n    case (insert x F)\n    have \"locals V (c; inits (insert x F))\n      =d= locals V (c; inits F; init x)\"\n      by (metis denot_eq_cong_locals denot_eq_seq_assoc denot_eq_seq_cong2 equivp_def equivp_symp inits.equiv_R inits_init insert.hyps(1))\n    also have \"\\<dots> =d= locals V (c; inits F)\"\n      apply (rule locals_init_end)\n      using assms insert by auto\n    also have \"\\<dots> =d= locals V c\"\n      using insert.IH insert.prems by blast\n    finally show ?case\n      by -\n  qed\nqed\n\nlemma local_init_beginning:\n  shows \"Local x c =d= Local x (init x; c)\"\n  unfolding denot_eq'_def\n  by (simp add: local_init_beginning0 program.intros(3) program_substitute substitute_program)\n\nlemma locals_inits_beginning:\n  assumes \"finite V\"\n  shows \"locals V c =d= locals V (inits V; c)\"\n  using assms\nproof (induction V arbitrary: c)\n  case empty\n  show ?case\n    by (simp add: locals.R_sym) \nnext\n  case (insert x V)\n  have \"locals (insert x V) c =d= locals V (Local x c)\"\n    by (simp add: insert.hyps(1) locals.F_insert')\n  also have \"\\<dots> =d= locals V (Local x (init x; c))\"\n    using local_init_beginning\n    by (simp add: denot_eq_cong_locals)\n  also have \"\\<dots> =d= locals (insert x V) (init x; c)\"\n    using denot_eq'_sym insert.hyps(1) locals.F_insert' by blast\n  also have \"\\<dots> =d= Local x (locals V (init x; c))\"\n    by (simp add: insert.hyps(1) locals.F_insert)\n  also have \"\\<dots> =d= Local x (locals V (inits V; init x; c))\"\n    by (metis denot_eq_cong_locals denot_eq_seq_assoc equivp_def inits.equiv_R insert.IH locals.cong_R)\n  also have \"\\<dots> =d= Local x (locals V (inits (insert x V); c))\"\n    by (simp add: denot_eq_cong_locals denot_eq_seq_cong1 inits_init insert.hyps(1) locals.cong_R)\n  also have \"\\<dots> =d= locals (insert x V) (inits (insert x V); c)\"\n    using insert.hyps(1) locals.F_insert locals.R_sym by blast\n  finally show ?case\n    by -\nqed\n\nlemma locals_inits_change:\n  assumes \"finite X\" and \"finite V\"\n  assumes \"(X-Y) \\<union> (Y-X) \\<subseteq> V\"\n  shows \"locals V (inits X; c) =d= locals V (inits Y; c)\"\nproof -\n  have 1: \"V \\<union> X = V \\<union> Y \\<union> X\" and 2: \"V \\<union> Y = V \\<union> Y \\<union> X\"\n    using Diff_partition assms(3) by blast+\n  have \"locals V (inits X; c) =d= locals V (inits V; (inits X; c))\"\n    by (simp add: assms(2) locals_inits_beginning)\n  also have \"\\<dots> =d= locals V ((inits V; inits X); c)\"\n    using denot_eq'_sym denot_eq_cong_locals denot_eq_seq_assoc by blast\n  also have \"\\<dots> =d= locals V (inits (V\\<union>Y\\<union>X); c)\"\n    using 1\n    by (metis assms(1) assms(2) denot_eq_cong_locals denot_eq_seq_cong1 inits_inits)\n  also have \"\\<dots> =d= locals V ((inits V; inits Y); c)\"\n    using 2\n    by (metis \"1\" assms(1) assms(2) denot_eq_cong_locals denot_eq_seq_cong1 finite_Un inits_inits locals.R_sym)\n  also have \"\\<dots> =d= locals V (inits V; (inits Y; c))\"\n    using denot_eq_cong_locals denot_eq_seq_assoc by blast\n  also have \"\\<dots> =d= locals V (inits Y; c)\"\n    using assms(2) locals.R_sym locals_inits_beginning by blast\n  finally show ?thesis\n    by -\nqed\n\nlemma init_overwr:\n  assumes \"x \\<in> overwr c\"\n  shows \"init x; c =d= c\"\n  using assms apply (cases x; simp)\n   apply (rule denot_eq_qinit; simp)\n  by (rule denot_eq_init; simp)\n\nlemma inits_overwr:\n  assumes \"X \\<subseteq> overwr c\"\n  shows \"inits X; c =d= c\"\nproof -\n  have \"finite X\"\n    using assms finite_overwr infinite_super by blast\n  then show ?thesis\n    using assms\n  proof (induction X arbitrary: c)\n    case (insert x X)\n    have \"inits (insert x X); c =d= init x; inits X; c\"\n      by (simp add: denot_eq_seq_cong1 inits.F_insert inits_def insert.hyps(1))\n    also have \"\\<dots> =d= init x; c\"\n      by (metis denot_eq_seq_assoc denot_eq_seq_cong2 equivp_def inits.equiv_R insert.IH insert.prems insert_subset)\n    also have \"\\<dots> =d= c\"\n      using init_overwr insert.prems by blast\n    finally show ?case\n      by -\n  qed auto\nqed\n\n\nlemma change_Eq_precondition:\n  assumes VW_overwr: \"V - W \\<subseteq> overwr c \\<inter> overwr d\"\n  assumes WV_overwr: \"quantum' (W - V) \\<subseteq> overwr c \\<inter> overwr d\"\n  assumes \"finite V\" and \"finite W\"\n  assumes VW_R: \"idx12 (V-W) \\<sqinter> fvp R = {}\"\n  assumes WV_R: \"idx12 (quantum' (W-V)) \\<sqinter> fvp R = {}\"\n  assumes qrhl: \"qRHL (R \\<sqinter> Eq V) c d B\"\n  shows \"qRHL (R \\<sqinter> Eq W) c d B\"\nproof -\n\n  obtain VWC where VWC: \"set VWC = CVar -` (V - W)\"\n    by (meson assms finite_Diff finite_list finite_vimageI injI var.inject(2))\n\n  define V1 where \"V1 = V - CVar ` set VWC \\<union> classical' (W-V)\"\n\n  have VW_V1: \"idx12 (classical' (V - W)) \\<inter> fvp (Eq V1) = {}\"\n    unfolding V1_def VWC apply (simp add: classical'_def flip: idx12_inter idx12_union)\n    using is_classical.cases by blast\n\n  have \"R \\<sqinter> Eq V1 = top \\<sqinter> (R \\<sqinter> Eq V1)\"\n    by simp\n  also have \"qRHL (top \\<sqinter> (R \\<sqinter> Eq V1))\n            (Assign VWC some_constant) (Assign VWC some_constant)\n            (Eq (CVar ` set VWC) \\<sqinter> (R \\<sqinter> Eq V1))\"\n    apply (rule frame_rule[rotated -1])\n        apply (rule assign_Eq)\n    using VW_R VW_V1\n    by (auto intro!: program.intros fvp_inter_empty simp: X_inter_CVar VWC classical'_def idx12_def simp flip: idx.simps)\n  also have \"\\<dots> \\<le> Eq (CVar ` set VWC) \\<sqinter> (R \\<sqinter> (Eq (V - CVar ` set VWC)))\"\n    unfolding V1_def\n    apply (subst Eq_split')\n    apply (simp add: classical'_def is_classical'_def)\n    by (metis inf_assoc inf_le1)\n  also have \"\\<dots> = R \\<sqinter> Eq V\"\n    apply (subst (2) asm_rl[of \"V = (CVar ` set VWC) \\<union> (V - CVar ` set VWC)\"])\n    apply (auto simp: VWC)[1]\n    apply (subst Eq_split)\n    apply (simp add: is_classical'_def)\n    using inf_left_commute by blast\n  also note qrhl\n  also have \"Seq (Assign VWC some_constant) c =d= c\"\n    apply (rule denot_eq_init)\n    using VW_overwr by (auto simp add: classical'_def VWC)\n  also have \"Seq (Assign VWC some_constant) d =d= d\"\n    apply (rule denot_eq_init)\n    using VW_overwr by (auto simp add: classical'_def VWC)\n  finally have qrhl_V1: \"qRHL (R \\<sqinter> Eq V1) c d B\"\n    by (auto intro!: program.intros)\n\n  define V2 where \"V2 = V1 - quantum' (V-W)\"\n\n  obtain VWQ where VWQ: \"set VWQ = QVar -` (V - W)\" and \"distinct VWQ\"\n    by (meson assms finite_Diff finite_distinct_list finite_vimageI injI var.simps(1))\n\n  have VW_V2: \"idx12 (quantum' (V - W)) \\<inter> fvp (Eq V2) = {}\"\n    unfolding V2_def by (simp flip: idx12_inter)\n  have V1_V2: \"V1 = V2 \\<union> QVar ` set VWQ\"\n    unfolding V2_def V1_def quantum'_def classical'_def VWC VWQ apply auto\n    by (metis rangeI var.exhaust)\n\n  have \"R \\<sqinter> Eq V2 = top \\<sqinter> (R \\<sqinter> Eq V2)\"\n    by simp\n  also have \"qRHL (top \\<sqinter> (R \\<sqinter> Eq V2))\n            (QInit VWQ some_constant) (QInit VWQ some_constant)\n            (Eq (QVar ` set VWQ) \\<sqinter> (R \\<sqinter> Eq V2))\"\n    apply (rule frame_rule[rotated -1])\n    using \\<open>distinct VWQ\\<close> apply (rule qinit_Eq)\n    using VW_R VW_V2 \n    by (auto intro!: fvp_inter_empty program.intros simp: X_inter_QVar VWQ quantum'_def idx12_def simp flip: idx.simps)\n  also have \"\\<dots> \\<le> R \\<sqinter> Eq (V2 \\<union> QVar ` set VWQ)\"\n    apply (subst asm_rl[of \"Eq (QVar ` set VWQ) \\<sqinter> (R \\<sqinter> Eq V2) = R \\<sqinter> (Eq V2 \\<sqinter> Eq (QVar ` set VWQ))\"])\n     apply (simp add: boolean_algebra_cancel.inf2 inf_sup_aci(1))\n    apply (rule inf_mono, simp)\n    apply (rule Eq_split_leq)\n    using VW_V2 \n    apply (auto intro!: fvp_inter_empty simp: quantum'_def idx12_def VWQ simp flip: idx.simps)\n    by (metis (no_types, lifting) Diff_Diff_Int Diff_iff Un_iff empty_iff imageI is_classical.cases mem_Collect_eq var.distinct(1))\n  also have \"\\<dots> = R \\<sqinter> Eq V1\"\n    using V1_V2 by simp\n  also note qrhl_V1\n  also have \"QInit VWQ some_constant; c =d= c\"\n    using \\<open>distinct VWQ\\<close> apply (rule denot_eq_qinit)\n    unfolding VWQ using VW_overwr by auto\n  also have \"QInit VWQ some_constant; d =d= d\"\n    using \\<open>distinct VWQ\\<close> apply (rule denot_eq_qinit)\n    unfolding VWQ using VW_overwr by auto\n  finally have qrhl_V2: \"qRHL (R \\<sqinter> Eq V2) c d B\"\n    by (auto intro!: program.intros)\n\n  define V3 where \"V3 = V2 \\<union> quantum' (W-V)\"\n  obtain WVQ where WVQ: \"set WVQ = QVar -` (W - V)\" and \"distinct WVQ\"\n    by (meson assms finite_Diff finite_distinct_list finite_vimageI injI var.simps(1))\n\n  have V2_V3: \"V2 = quantum' V3 - QVar ` set WVQ \\<union> classical' V3\"\n    unfolding V2_def V3_def quantum'_def classical'_def WVQ V1_def\n    apply auto\n    by (metis (full_types) is_classical.simps rangeI var.exhaust)\n\n  have \"R \\<sqinter> Eq V3 = Eq (quantum' V3) \\<sqinter> (R \\<sqinter> Eq (classical' V3))\"\n    apply (subst asm_rl[of \"V3 = quantum' V3 \\<union> classical' V3\"])\n    apply (auto simp: quantum'_def classical'_def)[1]\n    apply (subst Eq_split')\n    apply (simp add: classical'_def is_classical'_def)\n    by (simp add: inf_left_commute)\n  also have \"qRHL (Eq (quantum' V3) \\<sqinter> (R \\<sqinter> Eq (classical' V3)))\n            (QInit WVQ some_constant) (QInit WVQ some_constant)\n            (Eq (quantum' V3 - QVar ` set WVQ) \\<sqinter> (R \\<sqinter> Eq (classical' V3)))\"\n    apply (rule frame_rule[rotated -1])\n      apply (rule joint_init_eq0)\n       apply (metis Un_upper2 V3_def WVQ X_inter_QVar image_vimage_eq inf.bounded_iff inf_le2)\n      apply (simp add: is_quantum'_def quantum'_def)\n     apply (auto simp: WVQ quantum'_def classical'_def simp flip: idx.simps intro!: fvp_inter_empty program.intros)\n    using WV_R unfolding quantum'_def idx12_def apply fastforce\n      apply (metis (no_types, lifting) UnE idx_inj imageE is_classical_QVar mem_Collect_eq)\n    using WV_R unfolding quantum'_def idx12_def apply fastforce\n    by (metis (no_types, lifting) UnE idx_inj imageE is_classical_QVar mem_Collect_eq)\n  also have \"\\<dots> = R \\<sqinter> Eq (quantum' V3 - QVar ` set WVQ \\<union> classical' V3)\"\n    apply (subst Eq_split')\n    apply (simp add: classical'_def is_classical'_def)\n    using inf_sup_aci(3) by blast\n  also have \"\\<dots> = R \\<sqinter> Eq V2\"\n    unfolding V2_V3 by simp\n  also note qrhl_V2\n  also have \"QInit WVQ some_constant; c =d= c\"\n    using \\<open>distinct WVQ\\<close> apply (rule denot_eq_qinit)\n    using WV_overwr by (auto simp add: WVQ quantum'_def)\n  also have \"QInit WVQ some_constant; d =d= d\"\n    using \\<open>distinct WVQ\\<close> apply (rule denot_eq_qinit)\n    using WV_overwr by (auto simp add: WVQ quantum'_def)\n  finally have qrhl_V3: \"qRHL (R \\<sqinter> Eq V3) c d B\"\n    by (auto intro!: program.intros)\n\n  have \"V3 = W\"\n    unfolding V3_def V2_def V1_def VWC classical'_def quantum'_def\n    using is_classical.simps by auto\n\n  with qrhl_V3 show ?thesis\n    by simp\nqed\n\nlemma fv_vars: \"fv C \\<subseteq> vars C\"\n  by (induction C, auto)\n\n\n\nlemma compatible_refl[simp]: \"compatible x x\"\n  using compatible_sym compatible_trans compatible_inexhaust\n  using not_finite_existsD by blast\n\nlemma compatible_idx[simp]: \\<open>compatible x y \\<Longrightarrow> compatible (idx b x) (idx c y)\\<close>\n  by (meson compatible_idx compatible_sym compatible_trans)\n\nlemma clean_CVar_case: \"is_classical x \\<Longrightarrow> CVar (case x of CVar x' \\<Rightarrow> x' | QVar q \\<Rightarrow> F q) = x\" for x F\n  using is_classical.simps by auto\nlemma clean_QVar_case: \"is_quantum x \\<Longrightarrow> QVar (case x of QVar x' \\<Rightarrow> x' | CVar q \\<Rightarrow> F q) = x\" for x F\n    by (metis (full_types) is_classical.simps var.exhaust var.simps(5))\n\nlemma finite_holes[simp]: \"finite (holes C)\"\n  apply (induction C) by auto\n\nlemma var_subst_dom_transpose[simp]: \\<open>var_subst_dom (transpose x y) = {x,y}\\<close> if \\<open>x \\<noteq> y\\<close>\n  using that by (auto simp: var_subst_dom_def transpose_def)\n\nlemma subst_vars_rm_valid[simp]: \n  assumes \"valid_var_subst \\<sigma>\"\n  shows \"valid_var_subst (\\<sigma>(v:=v))\"\n  using assms unfolding valid_var_subst_def by simp\n\nlemma valid_var_subst_transpose[simp]:\n  assumes \\<open>compatible x y\\<close>\n  shows \\<open>valid_var_subst (transpose x y)\\<close>\n  using assms unfolding valid_var_subst_def\n  by (metis compatible_refl compatible_sym transpose_def)\n\nlemma valid_var_subst_id[simp]: \\<open>valid_var_subst id\\<close>\n  by (simp add: valid_var_subst_def)\n\nlemma subst_vars_v_classical:\n  assumes \"valid_var_subst \\<sigma>\"\n  assumes \"is_classical v\"\n  shows \"is_classical (\\<sigma> v)\"\n  using assms(1) assms(2) compatible_is_classical valid_var_subst_def by blast\n\nlemma subst_vars_v_quantum:\n  assumes \"valid_var_subst \\<sigma>\"\n  assumes \"is_quantum v\"\n  shows \"is_quantum (\\<sigma> v)\"\n  using assms using compatible_is_classical valid_var_subst_def by blast\n\nlemma subst_vars_c_compose[simp]:\n  assumes \"valid_var_subst \\<tau>\"\n  shows \"subst_vars_c \\<sigma> (subst_vars_c \\<tau> p) = subst_vars_c (\\<sigma> o \\<tau>) p\"\n  unfolding subst_vars_c_def apply auto\n  apply (subst clean_CVar_case)\n  apply (simp add: assms subst_vars_v_classical)\n  by (rule refl)\n\n\nlemma subst_vars_q_compose[simp]:\n  assumes \"valid_var_subst \\<tau>\"\n  shows \"subst_vars_q \\<sigma> (subst_vars_q \\<tau> p) = subst_vars_q (\\<sigma> o \\<tau>) p\"\n  unfolding subst_vars_q_def apply auto\n  apply (subst clean_QVar_case)\n  apply (simp add: assms subst_vars_v_quantum)\n  by (rule refl)\n\n\nlemma full_subst_vars_compose[simp]:\n  assumes [simp]: \"valid_var_subst \\<tau>\"\n  shows \"full_subst_vars \\<sigma> (full_subst_vars \\<tau> p) = full_subst_vars (\\<sigma> o \\<tau>) p\"\n  apply (induction p)\n  by (auto simp: o_def)\n\nlemma full_subst_vars_cong:\n  assumes [simp]: \"valid_var_subst \\<sigma>\"\n  assumes \"\\<And>x. x\\<in>vars p \\<Longrightarrow> \\<sigma> x = \\<tau> x\"\n  shows \"full_subst_vars \\<sigma> p = full_subst_vars \\<tau> p\"\n  apply (insert assms, induction p)\n  by (auto simp: subst_vars_q_def subst_vars_c_def intro!: subst_vars_e_cong)\n\nlemma subst_vars_cong:\n  assumes [simp]: \"valid_var_subst \\<sigma>\"\n  assumes \"\\<And>x. x\\<in>fv p \\<Longrightarrow> \\<sigma> x = \\<tau> x\"\n  shows \"subst_vars \\<sigma> p = subst_vars \\<tau> p\"\nproof (insert assms, induction p arbitrary: \\<sigma> \\<tau>)\n  case (Local x p)\n  have *: \"y \\<in> fv p \\<Longrightarrow> (\\<sigma>(x:=x)) y = (\\<tau>(x:=x)) y\" for y\n    using Local.prems(2)[of y] by auto\n  show ?case\n    apply simp\n    apply (rule Local.IH)\n    using Local.prems(1) apply (rule subst_vars_rm_valid)\n    using * by simp\nqed (auto simp: subst_vars_q_def subst_vars_c_def intro!: subst_vars_e_cong)\n\nlemma substitute_full_subst_vars_Skip[simp]:\n  \"substitute (full_subst_vars \\<sigma> c) (\\<lambda>_. Skip) = full_subst_vars \\<sigma> (substitute c (\\<lambda>_. Skip))\"\n  apply (induction c) by auto\n\nlemma full_subst_vars_id:\n  assumes \"bij \\<sigma>\"\n  assumes \"valid_var_subst \\<sigma>\"\n  assumes \"var_subst_dom \\<sigma> \\<inter> fv c = {}\"\n  shows \"full_subst_vars \\<sigma> c =d= c\"\n  unfolding denot_eq'_def apply simp\n  apply (rule full_subst_vars_id0)\n  using assms by (auto simp: program.intros(3) program_substitute)\n\nlemma vars_full_subst_vars:\n  assumes \"valid_var_subst \\<sigma>\"\n  shows \"vars (full_subst_vars \\<sigma> p) = \\<sigma> ` vars p\"\n  apply (induction p)\n  by (simp_all add: image_image image_Un subst_vars_c_def\n                    fve_subst_vars_e[OF assms] subst_vars_q_def\n                    clean_CVar_case[OF subst_vars_v_classical[OF assms]]\n                    clean_QVar_case[OF subst_vars_v_quantum[OF assms]])\n\n\nlemma subst_vars_id[simp]:\n  shows \"subst_vars (\\<lambda>x. x) c = c\"\n  by (induction c, auto simp: subst_vars_c_def[abs_def] subst_vars_q_def[abs_def] fun_upd_def)\n\n\nlemma subst_vars_idI:\n  assumes \"valid_var_subst \\<sigma>\"\n  assumes \"fv c \\<inter> var_subst_dom \\<sigma> = {}\"\n  shows \"subst_vars \\<sigma> c = c\"\n  apply (subst (3) subst_vars_id[symmetric])\n  apply (rule subst_vars_cong)\n  using assms unfolding var_subst_dom_def by auto\n\n\ninductive_cases\n  ic_nc_Local: \"no_conflict \\<sigma> (Local v c)\"\n  and ic_nc_IfTE: \"no_conflict \\<sigma> (IfTE e c1 c2)\"\n  and ic_nc_Seq: \"no_conflict \\<sigma> (c1; c2)\"\n  and ic_nc_While: \"no_conflict \\<sigma> (While e c)\"\n\nlemma subst_vars_compose:\n  assumes \"valid_var_subst f\"\n  assumes \"valid_var_subst g\"\n  assumes \"no_conflict g c\"\n  shows \"subst_vars f (subst_vars g c) = subst_vars (f o g) c\"\n  using assms\nproof (induction c arbitrary: f g)\n  case (Local x c)\n  from Local.prems have no: \"no_conflict g (Local x c)\"\n    by simp\n  then have no': \"no_conflict (g(x := x)) c\"\n    by (rule ic_nc_Local)\n\n  from Local.prems\n  have validf: \"valid_var_subst (f(x := x))\" and validg: \"valid_var_subst (g(x := x))\"\n    unfolding valid_var_subst_def by auto\n  then have validfg: \"valid_var_subst (f(x := x) \\<circ> g(x := x))\"\n    by (metis comp_apply compatible_trans valid_var_subst_def)\n\n  have *: \"(f(x := x) \\<circ> g(x := x)) y = ((f o g)(x := x)) y\" if \"y \\<in> fv c\" for y\n    using no apply (rule ic_nc_Local)\n    using that var_subst_dom_def\n    by fastforce\n\n  show ?case \n    apply simp\n    apply (subst Local.IH[OF validf validg no'])\n    using validfg apply (rule subst_vars_cong)\n    using * by (auto simp: o_def)\nnext\n  case (IfTE e c1 c2)\n  show ?case\n    apply simp\n    apply (subst IfTE.IH)\n    using IfTE.prems apply (auto simp: o_def intro: ic_nc_IfTE)[3]\n    apply (subst IfTE.IH)\n    using IfTE.prems by (auto simp: o_def intro: ic_nc_IfTE)\nnext\n  case Seq\n  show ?case \n    apply simp\n    apply (subst Seq.IH)\n    using Seq.prems apply (auto simp: o_def intro: ic_nc_Seq)[3]\n    apply (subst Seq.IH)\n    using Seq.prems by (auto simp: o_def intro: ic_nc_Seq)\nqed (auto simp: o_def intro: ic_nc_While)\n\nlemma valid_var_subst_comp[intro]:\n  \"valid_var_subst f \\<Longrightarrow> valid_var_subst g \\<Longrightarrow> valid_var_subst (f \\<circ> g)\"\n  unfolding valid_var_subst_def apply auto\n  using compatible_trans by blast\n\nlemma fresh_compatible:\n  assumes \"finite {x. \\<not> P x}\"\n  shows \"\\<exists>y. compatible x y \\<and> P y\"\n  using Collect_mono_iff assms compatible_inexhaust infinite_super by fastforce\n\n\nlemma size_full_subst_vars[simp]:\n  \"size (full_subst_vars f c) = size c\"\n  by (induction c, auto)\n\nlemma finite_localvars[simp]: \"finite (localvars c)\"\n  by (induction c, auto)\n\n\nlemma localvars_vars: \"localvars c \\<subseteq> vars c\"\n  by (induction c, auto)\n\nlemma localvars_full_subst_vars[simp]: \"localvars (full_subst_vars f c) = f ` localvars c\"\n  by (induction c, auto)\n\n\nlemma avoiding_subst:\n  assumes \\<open>finite V\\<close> \\<open>finite avoid\\<close>\n  obtains \\<sigma>1 :: \"var \\<Rightarrow> var\" \n    where \"valid_var_subst \\<sigma>1\"\n    and \"inj_on \\<sigma>1 V\"\n    and \"var_subst_dom \\<sigma>1 \\<subseteq> V\"\n    and \"\\<sigma>1 ` V \\<inter> avoid = {}\"\n  apply atomize_elim using \\<open>finite V\\<close> \\<open>finite avoid\\<close>\nproof (induction V arbitrary: avoid)\n  case empty\n  show ?case \n    apply (rule exI[of _ id])\n    by (auto simp add: var_subst_dom_def valid_var_subst_def)\nnext\n  case (insert x F)\n\n  from \\<open>finite avoid\\<close>\n  obtain y where compat: \"compatible x y\" and avoid_y: \"y \\<notin> avoid\"\n    by (atomize_elim, rule_tac fresh_compatible, simp)\n\n  from \\<open>finite avoid\\<close>\n  have \"finite (insert y avoid)\"\n    by simp\n  from insert.IH[OF this]\n  obtain \\<sigma>' where valid: \"valid_var_subst \\<sigma>'\" and inj: \"inj_on \\<sigma>' F\" \n    and dom: \"var_subst_dom \\<sigma>' \\<subseteq> F\" and avoid: \"\\<sigma>' ` F \\<inter> insert y avoid = {}\"\n    by auto\n\n  define \\<sigma>1 where \"\\<sigma>1 = \\<sigma>' (x:=y)\"\n\n  from valid have \"valid_var_subst \\<sigma>1\"\n    unfolding \\<sigma>1_def\n    by (simp add: compat valid_var_subst_def)\n\n  moreover\n  have \"inj_on \\<sigma>1 (insert x F)\"\n    apply (rule_tac inj_on_insert[THEN iffD2])\n    unfolding \\<sigma>1_def apply auto\n     apply (metis fun_upd_other inj inj_on_cong insert.hyps(2))\n    using avoid by auto\n\n  moreover\n  from dom \n  have \"var_subst_dom \\<sigma>1 \\<subseteq> insert x F\"\n    unfolding \\<sigma>1_def var_subst_dom_def by auto\n\n  moreover  \n  have \"\\<sigma>1 ` insert x F \\<inter> avoid = {}\"\n    unfolding \\<sigma>1_def using avoid avoid_y by auto\n\n  ultimately show ?case\n    by auto\nqed\n\n\nlemma subst_bij_id'[simp]: \"substp_bij id A = A\"\n  by (rule substp_bij_id, auto)\n\nlemma extend_var_subst:\n  assumes \"inj_on \\<sigma> V\"\n  assumes \"valid_var_subst \\<sigma>\"\n  assumes \"finite V\"\n  obtains \\<tau> where \"bij \\<tau>\" and \"valid_var_subst \\<tau>\" and \"\\<forall>x\\<in>V. \\<tau> x = \\<sigma> x\"\nproof -\n  obtain V' where V': \"V = set V'\" and \"distinct V'\"\n    using \\<open>finite V\\<close> finite_distinct_list by blast\n  define W W' VW where \"W = \\<sigma> ` V\" and \"W' = map \\<sigma> V'\" and \"VW = V \\<union> W\"\n\n  have \\<open>finite VW\\<close>\n    by (simp add: VW_def W_def assms(3))\n  then obtain Z' where compatVZ: \"list_all2 compatible V' Z'\"\n    and \"distinct Z'\" and \"set Z' \\<inter> VW = {}\"\n    apply atomize_elim\n  proof (induction V' arbitrary: VW)\n    case Nil\n    show ?case by auto\n  next\n    case (Cons x V'')\n    obtain Z'' where compat: \"list_all2 compatible V'' Z''\" and \"distinct Z''\" \n      and disj: \"set Z'' \\<inter> insert x VW = {}\"\n      using Cons.IH Cons.prems by blast\n    obtain y where [simp]: \"compatible x y\" and \"y \\<notin> VW\" and \"y \\<notin> set Z''\"\n      apply atomize_elim apply (rule fresh_compatible) \n      using Cons.prems by auto \n    define Z' V' where \"Z' = y # Z''\" and \"V' = x # V''\"\n    have \"list_all2 compatible V' Z'\"\n      unfolding V'_def Z'_def using compat by auto\n    moreover have \"distinct Z'\"\n      unfolding Z'_def using \\<open>distinct Z''\\<close> \\<open>y \\<notin> set Z''\\<close> by auto\n    moreover have \"set Z' \\<inter> VW = {}\"\n      unfolding Z'_def using \\<open>y \\<notin> VW\\<close> disj by auto\n    ultimately show ?case\n      apply (rule_tac exI[of _ Z'])\n      by (auto simp: V'_def)\n  qed\n\n  define f ok where \"f X Y a = (if a \\<in> set X then Y ! (SOME i. X!i=a \\<and> i<length X) \n                          else if a \\<in> set Y then X ! (SOME i. Y!i=a \\<and> i<length Y)\n                          else a)\"\n    and \"ok X Y \\<longleftrightarrow> length X = length Y \\<and> distinct X \\<and> distinct Y \\<and> set X \\<inter> set Y = {}\"\n  for X Y and a :: var\n  have idx[simp]: \"(SOME i. X!i=X!j \\<and> i<length X) = j\" if \"distinct X\" and \"j<length X\" for X :: \"var list\" and j\n  proof -\n    have \"X!(SOME i. X!i=X!j \\<and> i<length X) = X!j \\<and> (SOME i. X!i=X!j \\<and> i<length X) < length X\"\n      apply (rule someI) using that by simp\n    then show ?thesis\n      apply (rule_tac nth_eq_iff_index_eq[THEN iffD1])\n      using that by auto\n  qed\n  have evalf1: \"f X Y (X!i) = Y!i\" if \"ok X Y\" and [simp]: \"i < length X\" for X Y i\n    unfolding f_def using that unfolding ok_def by (subst idx, auto)\n  have evalf2: \"f X Y (Y!i) = X!i\" if \"ok X Y\" and [simp]: \"i < length X\" for X Y i\n    unfolding f_def using that unfolding ok_def by (subst idx, auto)\n  have evalf3: \"f X Y a = a\" if \"a \\<notin> set X \\<union> set Y\" for X Y a\n    unfolding f_def using that by auto\n  have f_idem: \"f X Y \\<circ> f X Y = id\" if \"ok X Y\" for X Y\n  proof (rule ext, simp)\n    fix a\n    consider (X) i where \"a = X!i\" \"i < length X\" | (Y) i where \"a = Y!i\" \"i < length Y\" | (none) \"a \\<notin> set X \\<union> set Y\"\n      apply auto by (metis in_set_conv_nth)\n    then show \"f X Y (f X Y a) = a\"\n      apply cases\n      using that by (auto simp add: evalf1 evalf2 evalf3 ok_def)\n  qed\n  then have bij_f: \"bij (f X Y)\" if \"ok X Y\" for X Y\n    using o_bij that by auto\n  have all_f1: \"R a (f X Y a)\" if \"ok X Y\" and all2: \"list_all2 R X Y\" and \"a \\<in> set X\" for R X Y a\n  proof -\n     obtain i where i: \"i < length X\" and Xi: \"X!i = a\"\n      using \\<open>a \\<in> set X\\<close> by (meson in_set_conv_nth)\n    then have *: \"f X Y a = Y!i\"\n      using \\<open>ok X Y\\<close> evalf1 by blast\n    have \"R (X!i) (Y!i)\"\n      using all2 i by (simp add: list_all2_nthD)\n    with Xi * show ?thesis\n      by simp\n  qed\n  have all_f2: \"R a (f X Y a)\" if \"ok X Y\" and all2: \"list_all2 R X Y\" \n    and \"a \\<in> set Y\" and \"symp R\" for R X Y a\n  proof -\n     obtain i where i: \"i < length Y\" and Yi: \"Y!i = a\"\n      using \\<open>a \\<in> set Y\\<close> by (meson in_set_conv_nth)\n    then have *: \"f X Y a = X!i\"\n      using evalf2 ok_def that(1) by auto\n    have \"R (X!i) (Y!i)\"\n      using all2 i\n      by (simp add: list_all2_nthD2)\n    with Yi * \\<open>symp R\\<close> show ?thesis\n      using sympD by fastforce\n  qed\n  have all_f3: \"R a (f X Y a)\" if \"ok X Y\" and \\<open>reflp R\\<close> \n    and \"a \\<notin> set X \\<union> set Y\" for R X Y a\n    using that apply (simp add: evalf3)\n    by (simp add: reflpD)\n  have all_f: \"R a (f X Y a)\" if \"ok X Y\" and \\<open>list_all2 R X Y\\<close> and \\<open>reflp R\\<close> and \\<open>symp R\\<close> for X Y R a\n    using all_f1 all_f2 all_f3 that by fastforce\n\n  have [simp]: \"ok V' Z'\"\n    unfolding ok_def\n    by (metis Int_Un_distrib VW_def \\<open>V = set V'\\<close> \\<open>distinct V'\\<close> \\<open>distinct Z'\\<close> \\<open>set Z' \\<inter> VW = {}\\<close> bot_eq_sup_iff compatVZ inf.commute list_all2_lengthD)\n  have [simp]: \"ok Z' W'\"\n    by (metis Int_Un_distrib VW_def W'_def W_def \\<open>V = set V'\\<close> \\<open>distinct V'\\<close> \\<open>distinct Z'\\<close> \\<open>set Z' \\<inter> VW = {}\\<close> assms(1) bot_eq_sup_iff compatVZ distinct_map length_map list_all2_lengthD ok_def set_map)\n  have compatZW: \"list_all2 compatible Z' W'\"\n    using compatVZ unfolding W'_def\n    by (smt assms(2) compatible_sym compatible_trans length_map list_all2_conv_all_nth nth_map valid_var_subst_def)\n\n  define \\<tau> where \"\\<tau> = f Z' W' \\<circ> f V' Z'\"\n\n  have \"bij \\<tau>\"\n    unfolding \\<tau>_def apply (rule bij_comp)\n    by (rule bij_f, simp)+\n  moreover\n  have \"valid_var_subst \\<tau>\"\n  proof -\n    have \"valid_var_subst (f V' Z')\"\n      unfolding valid_var_subst_def apply auto\n      by (rule all_f, auto simp: compatVZ reflpI compatible_sym sympI)\n    moreover have \"valid_var_subst (f Z' W')\"\n      unfolding valid_var_subst_def apply auto\n      by (rule all_f, auto simp: compatZW reflpI compatible_sym sympI)\n    ultimately show ?thesis\n      unfolding \\<tau>_def by auto\n  qed\n  moreover have \"\\<tau> a = \\<sigma> a\" if a: \"a\\<in>V\" for a\n  proof -\n     obtain i where i: \"i < length V'\" and V'i: \"V'!i = a\"\n      using a unfolding V' by (meson in_set_conv_nth)\n    then have \"f V' Z' a = Z'!i\"\n      using \\<open>ok V' Z'\\<close> evalf1 by blast\n    then have \"f Z' W' (f V' Z' a) = W'!i\"\n      using \\<open>i < length V'\\<close> \\<open>ok V' Z'\\<close> \\<open>ok Z' W'\\<close> evalf1 ok_def by auto\n    also have \"W'!i = \\<sigma> a\"\n      unfolding W'_def V'i[symmetric] using i by auto\n    finally show ?thesis\n      unfolding \\<tau>_def by simp\n  qed\n\n  ultimately show ?thesis\n    using that by auto\nqed\n\nlemma substp_substp_bij:\n  assumes \"bij \\<tau>\" and \"valid_var_subst \\<tau>\" and \"\\<forall>x\\<in>fvp A. \\<tau> x = \\<sigma> x\"\n  shows \"substp \\<sigma> A = substp_bij \\<tau> A\"\nproof -\n  define \\<tau>' where \"\\<tau>' = (SOME \\<tau>. bij \\<tau> \\<and> valid_var_subst \\<tau> \\<and> (\\<forall>x\\<in>fvp A. \\<tau> x = \\<sigma> x))\"\n  have \"bij \\<tau>' \\<and> valid_var_subst \\<tau>' \\<and> (\\<forall>x\\<in>fvp A. \\<tau>' x = \\<sigma> x)\"\n    unfolding \\<tau>'_def apply (rule someI[where P=\\<open>\\<lambda>\\<tau>. bij \\<tau> \\<and> valid_var_subst \\<tau> \\<and> (\\<forall>x\\<in>fvp A. \\<tau> x = \\<sigma> x)\\<close>])\n    using assms by simp\n  then have \"bij \\<tau>'\" and \"valid_var_subst \\<tau>'\" and \\<tau>'_\\<sigma>: \"\\<forall>x\\<in>fvp A. \\<tau>' x = \\<sigma> x\"\n    by auto\n  define \\<gamma> where \"\\<gamma> = inv \\<tau> \\<circ> \\<tau>'\"\n  then have \\<tau>_alt_def: \"\\<tau>' = \\<tau> \\<circ> \\<gamma>\"\n    using \\<open>bij \\<tau>\\<close>\n    by (simp add: bij_betw_def fun.map_comp surj_iff)\n  have \"valid_var_subst \\<gamma>\"\n    using \\<open>valid_var_subst \\<tau>'\\<close> \\<open>valid_var_subst \\<tau>\\<close>\n    unfolding \\<gamma>_def valid_var_subst_def apply auto\n    by (metis assms(1) bijection.inv_right bijection_def compatible_sym compatible_trans)\n  have \\<gamma>_id: \"x \\<in> fvp A \\<Longrightarrow> \\<gamma> x = x\" for x\n    unfolding \\<gamma>_def\n    by (simp add: \\<tau>'_\\<sigma> assms(1) assms(3) bij_is_inj inv_f_eq)\n  have \"bij \\<gamma>\"\n    unfolding \\<gamma>_def using \\<open>bij \\<tau>\\<close> \\<open>bij \\<tau>'\\<close>\n    using bij_betw_trans bij_imp_bij_inv by blast\n\n  have sub\\<sigma>_sub\\<tau>': \"substp \\<sigma> A = substp_bij \\<tau>' A\"\n    unfolding substp_def \\<tau>'_def by simp\n  also have \"\\<dots> = substp_bij \\<tau> (substp_bij \\<gamma> A)\"\n    unfolding \\<tau>_alt_def\n    apply (subst substp_bij_comp)\n    using \\<open>valid_var_subst \\<gamma>\\<close> \\<open>valid_var_subst \\<tau>\\<close> \\<open>bij \\<gamma>\\<close> \\<open>bij \\<tau>\\<close>\n    by auto\n  also have \"\\<dots> = substp_bij \\<tau> A\"\n    apply (subst (2) substp_bij_id)\n    using \\<open>valid_var_subst \\<gamma>\\<close> \\<gamma>_id \\<open>bij \\<gamma>\\<close> by auto\n  finally show ?thesis\n    by -\nqed\n\nlemma substp_cong:\n  assumes eq: \"\\<And>x. x \\<in> fvp A \\<Longrightarrow> \\<sigma> x = \\<tau> x\"\n  assumes valid: \"valid_var_subst \\<sigma>\" \"valid_var_subst \\<tau>\"\n  assumes inj\\<sigma>: \"inj_on \\<sigma> (fvp A)\"\n  shows \"substp \\<sigma> A = substp \\<tau> A\" \nproof -\n  from inj\\<sigma> eq have inj\\<tau>: \"inj_on \\<tau> (fvp A)\"\n    using inj_on_cong by blast\n\n  from valid inj\\<sigma>\n  obtain \\<sigma>' where \"bij \\<sigma>'\" and \"valid_var_subst \\<sigma>'\" and eq\\<sigma>: \"\\<forall>x\\<in>fvp A. \\<sigma>' x = \\<sigma> x\"\n    using extend_var_subst by (metis finite_fvp)\n  from valid inj\\<tau>\n  obtain \\<tau>' where \"bij \\<tau>'\" and \"valid_var_subst \\<tau>'\" and eq\\<tau>: \"\\<forall>x\\<in>fvp A. \\<tau>' x = \\<tau> x\"\n    using extend_var_subst by (metis finite_fvp)\n  define \\<gamma> where \"\\<gamma> = inv \\<tau>' \\<circ> \\<sigma>'\"\n  with \\<open>bij \\<tau>'\\<close> have \\<sigma>': \"\\<sigma>' = \\<tau>' \\<circ> \\<gamma>\"\n    by (simp add: bijection.intro bijection.inv_comp_right o_assoc)\n  with \\<open>valid_var_subst \\<sigma>'\\<close> \\<open>valid_var_subst \\<tau>'\\<close> have \"valid_var_subst \\<gamma>\"\n    by (metis comp_apply compatible_sym compatible_trans valid_var_subst_def)\n  from \\<gamma>_def \\<open>bij \\<tau>'\\<close> eq eq\\<sigma> eq\\<tau>\n  have \\<gamma>_id: \"\\<gamma> x = x\" if \"x \\<in> fvp A\" for x\n    by (simp add: bij_is_inj inv_f_eq that)\n  have \"bij \\<gamma>\"\n    by (simp add: \\<gamma>_def \\<open>bij \\<sigma>'\\<close> \\<open>bij \\<tau>'\\<close> bij_comp bijection.bij_inv bijection.intro)\n\n  have \"substp \\<sigma> A = substp_bij \\<sigma>' A\"\n    apply (rule substp_substp_bij)\n    using \\<open>bij \\<sigma>'\\<close> \\<open>valid_var_subst \\<sigma>'\\<close> eq\\<sigma> by auto\n  also have \"\\<dots> = substp_bij \\<tau>' (substp_bij \\<gamma> A)\"\n    unfolding \\<sigma>' \n    using \\<open>bij \\<sigma>'\\<close> \\<open>bij \\<tau>'\\<close> \\<open>valid_var_subst \\<gamma>\\<close> \\<open>valid_var_subst \\<tau>'\\<close>\n    using \\<gamma>_def bij_comp bij_imp_bij_inv substp_bij_comp by force\n  also have \"\\<dots> = substp_bij \\<tau>' A\"\n    apply (subst (2) substp_bij_id)\n    using \\<open>bij \\<gamma>\\<close> \\<open>valid_var_subst \\<gamma>\\<close> \\<open>valid_var_subst \\<gamma>\\<close>\n    using \\<gamma>_id by auto\n  also have \"\\<dots> = substp \\<tau> A\"\n    apply (rule substp_substp_bij[symmetric])\n    using \\<open>bij \\<tau>'\\<close> \\<open>valid_var_subst \\<tau>'\\<close> eq\\<tau> by auto\n  finally show ?thesis\n    by -\nqed\n\n\nlemma rename_qrhl1:\n  assumes \\<open>compatible (QVar q) (QVar r)\\<close>\n  assumes \"QVar q \\<notin> fv c\"\n  assumes \"QVar r \\<notin> fv c\"\n  assumes \"qRHL A c d B\"\n  shows \"qRHL (substp (transpose (idx True (QVar q)) (idx True (QVar r))) A) c d (substp (transpose (idx True (QVar q)) (idx True (QVar r))) B)\"\n  using assms program.intros(3) substp_substp_bij[where \\<tau>=\\<open>transpose (idx True (QVar q)) (idx True (QVar r))\\<close>] program_substitute qRHL_def rename_qrhl10 \n  by (auto simp del: idx.simps)\n  \nlemma rename_qrhl2:\n  assumes \\<open>compatible (QVar q) (QVar r)\\<close>\n  assumes \"QVar q \\<notin> fv d\"\n  assumes \"QVar r \\<notin> fv d\"\n  assumes \"qRHL A c d B\"\n  shows \"qRHL (substp (transpose (idx False (QVar q)) (idx False (QVar r))) A) c d (substp (transpose (idx False (QVar q)) (idx False (QVar r))) B)\"\n  using assms program.intros(3) substp_substp_bij[where \\<tau>=\\<open>transpose (idx False (QVar q)) (idx False (QVar r))\\<close>] program_substitute qRHL_def rename_qrhl20 by (auto simp del: idx.simps)\n\nlemma CVar_subst_vars_c[simp]: \n  assumes \"valid_var_subst \\<sigma>\"\n  shows \"CVar (subst_vars_c \\<sigma> x) = \\<sigma> (CVar x)\"\n  using assms unfolding subst_vars_c_def valid_var_subst_def\n  by (simp add: assms clean_CVar_case subst_vars_v_classical)\n\nlemma QVar_subst_vars_q[simp]: \n  assumes \"valid_var_subst \\<sigma>\"\n  shows \"QVar (subst_vars_q \\<sigma> x) = \\<sigma> (QVar x)\"\n  using assms unfolding subst_vars_q_def valid_var_subst_def\n  by (simp add: assms clean_QVar_case subst_vars_v_quantum)\n\nlemma fv_subst_vars:\n  assumes \"valid_var_subst \\<sigma>\"\n  shows \"fv (subst_vars \\<sigma> c) \\<subseteq> \\<sigma> ` fv c\"\n  using assms\nproof (induction c arbitrary: \\<sigma>)\n  case (Local x c)\n  have IH: \"fv (subst_vars (\\<sigma>(x := x)) c) \\<subseteq> \\<sigma>(x := x) ` fv c\"\n    apply (rule Local.IH[where \\<sigma>=\"\\<sigma>(x := x)\"])\n    using Local.prems subst_vars_rm_valid by blast\n  then show ?case\n    by auto\nqed (auto simp add: image_Un image_image, blast+)\n\nlemma fv_subst_vars':\n  assumes \"valid_var_subst \\<sigma>\"\n  assumes \"no_conflict \\<sigma> c\"\n  shows \"fv (subst_vars \\<sigma> c) = \\<sigma> ` fv c\"\n  using assms\nproof (induction c arbitrary: \\<sigma>)\n  case (Local x c)\n  have IH: \"fv (subst_vars (\\<sigma>(x := x)) c) = \\<sigma>(x := x) ` fv c\"\n    apply (rule Local.IH[where \\<sigma>=\"\\<sigma>(x := x)\"])\n    using Local.prems(1) subst_vars_rm_valid apply blast\n    using Local.prems(2) ic_nc_Local by blast\n  then show ?case\n    apply auto\n    by (smt Int_Collect Local.prems(2) ic_nc_Local image_eqI var_subst_dom_def)\nnext\n  case IfTE\n  then show ?case\n    apply (auto simp add: image_Un image_image)\n    apply (meson fv_subst_vars subset_iff)\n    apply (meson fv_subst_vars subset_iff)\n    apply (metis ic_nc_IfTE imageI)\n    by (metis ic_nc_IfTE imageI)\nnext\n  case While\n  then show ?case\n    apply (auto simp add: image_Un image_image)\n    apply (meson fv_subst_vars subset_iff)\n    using ic_nc_While by blast\nnext\n  case Seq\n  then show ?case\n    apply (auto simp add: image_Un image_image)\n    apply (meson fv_subst_vars subset_iff)\n    apply (meson fv_subst_vars subset_iff)\n    apply (metis ic_nc_Seq imageI)\n    by (metis ic_nc_Seq imageI)\nqed (auto simp add: image_Un image_image)\n\n\ninductive_cases program_ind_cases:\n  \"program (IfTE e c d)\"\n  \"program (While c d)\"\n  \"program (Local x c)\"\n  \"program (c; d)\"\n\nlemma program_full_subst_vars[simp]: \"program (full_subst_vars \\<sigma> c) = program c\"\n  by (induction c, auto intro: program.intros elim: program_ind_cases)\n\nlemma subst_vars_c_id[simp]: \"subst_vars_c id = id\"\n  unfolding subst_vars_c_def by auto\n\nlemma subst_vars_q_id[simp]: \"subst_vars_q id = id\"\n  unfolding subst_vars_q_def by auto\n\nlemma full_subst_vars_id'[simp]: \"full_subst_vars id = id\"\n  apply (rule ext, rename_tac c, induct_tac c)\n  by (auto simp: subst_vars_c_id[unfolded id_def] subst_vars_q_id[unfolded id_def])\n\nlemma vars_fv_localvars: \"vars c = fv c \\<union> localvars c\"\n  by (induction c, auto)\n\nlemma fv_full_subst_vars: \n  assumes [simp]: \"valid_var_subst \\<sigma>\"\n  assumes \"inj_on \\<sigma> (vars c)\"\n  shows \"fv (full_subst_vars \\<sigma> c) = \\<sigma> ` fv c\"\n  using assms(2)\n  apply (induction c)\n  apply (simp_all add: inj_on_Un image_Un image_image)\n  by (smt Diff_subset Un_upper2 fv_vars image_empty image_insert inf_sup_aci(5) inj_on_image_set_diff inj_on_insert insert_def order_trans singleton_conv)\n\n\n\n\nlemma full_subst_vars_subst_vars_eq: \n  assumes \"var_subst_dom \\<sigma> \\<inter> localvars c = {}\"\n  shows \"full_subst_vars \\<sigma> c = subst_vars \\<sigma> c\"\n  using assms apply (induction c)\n  by (auto simp: var_subst_dom_def fun_upd_idem)\n\nlemma full_subst_vars_subst_vars_comm:\n  assumes [simp]: \"bij \\<tau>\"\n  assumes valid\\<sigma>[simp]: \"valid_var_subst \\<sigma>\"\n  assumes valid\\<tau>[simp]: \"valid_var_subst \\<tau>\"\n  shows \"full_subst_vars \\<tau> (subst_vars \\<sigma> c) = subst_vars (\\<tau> \\<circ> \\<sigma> \\<circ> inv \\<tau>) (full_subst_vars \\<tau> c)\"\n  using valid\\<sigma>\nproof (induction c arbitrary: \\<sigma>)\n  case (Local x c)\n  show ?case \n    apply simp\n    apply (subst Local.IH)\n    apply (simp add: Local.prems)\n    by (metis assms(1) bij_inv_eq_iff comp_apply fun_upd_apply)\nqed (auto simp: o_def inv_f_f bij_is_inj)\n\nlemma no_conflict_full_subst_vars:\n  assumes [simp]: \"bij \\<tau>\"\n  assumes [simp]: \"valid_var_subst \\<tau>\"\n  assumes \"no_conflict \\<sigma> c\"\n  shows \"no_conflict (\\<tau> \\<circ> \\<sigma> \\<circ> inv \\<tau>) (full_subst_vars \\<tau> c)\"\n  using assms(3)\nproof induction\n  case (nc_Local \\<sigma> v c)\n  have [simp]: \"inj_on \\<tau> A\" for A\n    using assms\n    using bij_is_inj inj_on_subset by blast\n  have [simp]: \"var_subst_dom (\\<tau> \\<circ> \\<sigma> \\<circ> inv \\<tau>) = \\<tau> ` var_subst_dom \\<sigma>\"\n    unfolding var_subst_dom_def apply auto\n    apply (smt assms(1) bij_inv_eq_iff mem_Collect_eq setcompr_eq_image)\n    by (simp add: inj_eq)\n  have *: \"(\\<tau> \\<circ> \\<sigma> \\<circ> inv \\<tau>)(\\<tau> v := \\<tau> v) = \\<tau> \\<circ> \\<sigma>(v := v) \\<circ> inv \\<tau>\"\n    apply rule apply auto\n    by (metis assms(1) bij_inv_eq_iff)\n  have 1: \"no_conflict ((\\<tau> \\<circ> \\<sigma> \\<circ> inv \\<tau>)(\\<tau> v := \\<tau> v)) (full_subst_vars \\<tau> c)\"\n    using nc_Local.IH unfolding * by -\n  have 2: \"\\<tau> v \\<notin> (\\<tau> \\<circ> \\<sigma> \\<circ> inv \\<tau>) `\n            (fv (full_subst_vars \\<tau> c) \\<inter> var_subst_dom (\\<tau> \\<circ> \\<sigma> \\<circ> inv \\<tau>))\"\n    apply (simp only: image_comp[symmetric])\n    apply (simp add: inj_image_mem_iff fv_full_subst_vars flip: image_Int)\n    by (fact nc_Local)\n  show ?case\n    apply (simp only: full_subst_vars.simps)\n    using 1 2 by (rule no_conflict.nc_Local)\nqed (auto intro!: no_conflict.intros)\n\nlemma no_conflict_full_subst_vars':\n  assumes [simp]: \"bij \\<tau>\"\n  assumes [simp]: \"valid_var_subst \\<tau>\"\n  assumes \"no_conflict (inv \\<tau> \\<circ> \\<sigma> \\<circ> \\<tau>) c\"\n  shows \"no_conflict \\<sigma> (full_subst_vars \\<tau> c)\"\n  apply (subst asm_rl[of \"\\<sigma> = \\<tau> \\<circ> (inv \\<tau> \\<circ> \\<sigma> \\<circ> \\<tau>) \\<circ> inv \\<tau>\"])\n  apply (metis assms(1) bijection.intro bijection.inv_comp_right comp_assoc comp_id fun.map_id)\n  using assms by (rule no_conflict_full_subst_vars)\n\nlemma no_conflict_cong:\n  assumes \"\\<And>x. x \\<in> fv c \\<Longrightarrow> \\<sigma> x = \\<tau> x\"\n  assumes \"no_conflict \\<sigma> c\"\n  shows \"no_conflict \\<tau> c\"\n  using assms(2,1)\nproof (induction arbitrary: \\<tau>)\n  case (nc_Local \\<sigma> v c)\n  then show ?case \n    apply auto\n    by (smt Int_iff fun_upd_other fun_upd_same image_iff mem_Collect_eq no_conflict.nc_Local var_subst_dom_def)\nqed (auto simp: no_conflict.intros)\n\nlemma localvars_subst_vars[simp]:\n  shows \"localvars (subst_vars \\<sigma> c) = localvars c\"\n  by (induction c arbitrary: \\<sigma>, auto)\n\n\nlemma no_conflict_remove: \n  assumes \"no_conflict \\<sigma> c\"\n  shows \"no_conflict (\\<sigma>(x:=x)) c\"\n  using assms\nproof (induction)\n  case (nc_Local \\<sigma> v c)\n  show ?case\n    apply (rule no_conflict.intros)\n     apply (metis nc_Local.IH fun_upd_twist) \n    using nc_Local by (simp add: image_iff var_subst_dom_def)\nqed (auto simp: no_conflict.intros)\n\nlemma localvars_dom_no_conflict:\n  assumes \"localvars c \\<inter> \\<sigma> ` (fv c \\<inter> var_subst_dom \\<sigma>) = {}\"\n  shows \"no_conflict \\<sigma> c\"\n  using assms\nproof (induction c arbitrary: \\<sigma>)\n  case (Local x c)\n  have \"no_conflict (\\<sigma>(x := x)) c\"\n    apply (rule Local.IH)\n    using Local.prems\n    by (auto simp add: var_subst_dom_def)\n  moreover have \"x \\<notin> \\<sigma> ` (fv c \\<inter> var_subst_dom \\<sigma>)\"\n    using Local.prems\n    by (auto simp add:  var_subst_dom_def)\n  ultimately show ?case\n    by (rule no_conflict.intros)\nqed (auto intro!: no_conflict.intros)\n\nlemma fv_foldr_Local[simp]: \"fv (foldr Local V c) = fv c - set V\"\n  by (induction V, auto)\n\nlemma valid_var_subst_idx[simp]: \n  assumes \"valid_var_subst \\<tau>\"\n  shows \"valid_var_subst (idx_var_subst side \\<tau>)\"\n  using assms unfolding valid_var_subst_def idx_var_subst_def\n  by auto\n\nlemma inj_idx_var_subst[simp]:\n  assumes \"inj \\<tau>\"\n  shows \"inj (idx_var_subst side \\<tau>)\"\n  using assms unfolding inj_def idx_var_subst_def\n  by (metis idx_inj inv_into_injective range_eqI)\n\n\nlemma inj_on_idx_var_subst1[simp]:\n  assumes \"NO_MATCH UNIV X\"\n  assumes \"inj_on \\<tau> (deidx side X)\"\n  shows \"inj_on (idx_var_subst side \\<tau>) X\"\nproof (rule inj_onI)\n  fix x y assume \"x \\<in> X\" and \"y \\<in> X\"\n  assume eq: \"idx_var_subst side \\<tau> x = idx_var_subst side \\<tau> y\"\n\n  consider (x) \"x \\<in> range (idx side)\" \"y \\<notin> range (idx side)\"\n    | (y) \"y \\<in> range (idx side)\" \"x \\<notin> range (idx side)\"\n    | (xy) \"y \\<in> range (idx side)\" \"x \\<in> range (idx side)\"\n    | (none) \"y \\<notin> range (idx side)\" \"x \\<notin> range (idx side)\"\n    by metis\n  then show \"x = y\"\n  proof cases\n    case x\n    with eq show ?thesis \n      unfolding idx_var_subst_def by auto\n  next\n    case y\n    with eq show ?thesis \n      unfolding idx_var_subst_def by auto\n  next\n    case xy\n    with eq show ?thesis \n      unfolding idx_var_subst_def using assms\n      unfolding deidx_def apply auto\n      using \\<open>x \\<in> X\\<close> \\<open>y \\<in> X\\<close> inv_into_f_f by fastforce\n  next\n    case none\n    with eq show ?thesis\n      unfolding idx_var_subst_def by auto\n  qed\nqed\n\nlemma surj_idx_var_subst[simp]:\n  assumes \"surj \\<tau>\"\n  shows \"surj (idx_var_subst side \\<tau>)\"\n  using assms unfolding surj_def idx_var_subst_def\n  by (metis (no_types, lifting) f_inv_into_f idx_inj' range_eqI range_ex1_eq)\n\nlemma bij_idx_var_subst[simp]:\n  assumes \"bij \\<tau>\"\n  shows \"bij (idx_var_subst side \\<tau>)\"\n  using assms unfolding bij_def \n  by auto\n\nlemma inv_idx_var_subst:\n  assumes [simp]: \"bij \\<tau>\"\n  shows \"inv (idx_var_subst side \\<tau>) = idx_var_subst side (inv \\<tau>)\"\nproof -\n  have \"idx_var_subst side \\<tau> (idx_var_subst side (inv \\<tau>) x) = x\" for x\n    apply (auto simp add: inj_def idx_var_subst_def)\n    by (meson assms bij_inv_eq_iff)\n  then show ?thesis\n    apply (rule_tac inj_imp_inv_eq)\n    by (auto simp add: bij_is_inj)\nqed\n\nlemma var_subst_dom_idx_var_subst[simp]:\n  \"var_subst_dom (idx_var_subst side \\<sigma>) = idx side ` var_subst_dom \\<sigma>\"\n  unfolding var_subst_dom_def idx_var_subst_def by auto\n\nlemma finite_deidx[simp]: \"finite X \\<Longrightarrow> finite (deidx side X)\"\n  unfolding deidx_def\n  by (metis (full_types) Un_infinite finite_fvp finite_imageD fvp_Eq idx12_def idx_inj' sup_top_right) \n\nlemma no_conflict_locals:\n  assumes \"finite X\"\n  assumes \"no_conflict (\\<lambda>x. if x \\<in> X then x else \\<sigma> x) c\"\n  assumes \"X \\<inter> \\<sigma> ` (fv c \\<inter> var_subst_dom \\<sigma>) = {}\"\n  shows \"no_conflict \\<sigma> (locals X c)\"\n  using \\<open>finite X\\<close>\nproof (rule locals.F_intro)\n  fix X' assume X': \"set X' = X\" assume \"distinct X'\"\n  show \"no_conflict \\<sigma> (foldr Local X' c)\"\n    using assms(2,3) unfolding X'[symmetric]\n  proof (induction X' arbitrary: \\<sigma>)\n    case Nil then show ?case by simp\n  next\n    case (Cons x X)\n    then have nc: \"no_conflict (\\<lambda>y. if y \\<in> set (x # X) then y else \\<sigma> y) c\"\n      and disj: \"set (x # X) \\<inter> \\<sigma> ` (fv c \\<inter> var_subst_dom \\<sigma>) = {}\"\n      by -\n\n    have disj': \"set X \\<inter> \\<sigma>(x := x) ` (fv c \\<inter> var_subst_dom (\\<sigma>(x := x))) = {}\"\n      using disj by (auto simp: var_subst_dom_def)\n\n    from nc have nc': \"no_conflict (\\<lambda>y. if y \\<in> set X then y else (\\<sigma>(x := x)) y) c\"\n      apply (rule no_conflict_cong[rotated]) by auto\n    from nc' disj' have ncx: \"no_conflict (\\<sigma>(x := x)) (foldr Local X c)\"\n      by (rule Cons.IH)\n\n    have notin: \"x \\<notin> \\<sigma> ` (fv (foldr Local X c) \\<inter> var_subst_dom \\<sigma>)\"\n      using disj image_iff by auto\n    show ?case\n      apply simp\n      using ncx notin by (rule nc_Local)\n  qed\nqed\n\nlemma no_conflict_fv:\n  assumes \"var_subst_dom \\<sigma> \\<inter> fv c = {}\"\n  shows \"no_conflict \\<sigma> c\"\n  by (metis Int_empty_right assms empty_is_image inf.commute localvars_dom_no_conflict)\n\nlemma qrhlelimeq_aux:\n  assumes \"Q \\<supseteq> fv c - overwr c\"\n  assumes \"Q \\<supseteq> fv d - overwr d\"\n  defines \"Qtilde \\<equiv> Q \\<union> quantum' (fv c) \\<union> quantum' (fv d)\"\n  defines \"Qstar \\<equiv> Qtilde - Q\"\n  shows \"(Qstar \\<inter> overwr c) \\<union> (Qstar - fv c) = Qstar\"\n  and \"(Qstar \\<inter> overwr d) \\<union> (Qstar - fv d) = Qstar\"\n  using assms by blast+\n\nend\n\n", "meta": {"author": "dominique-unruh", "repo": "qrhl-local-variables-isabelle", "sha": "372d8b88b62628a1088931392e71d82302178512", "save_path": "github-repos/isabelle/dominique-unruh-qrhl-local-variables-isabelle", "path": "github-repos/isabelle/dominique-unruh-qrhl-local-variables-isabelle/qrhl-local-variables-isabelle-372d8b88b62628a1088931392e71d82302178512/Helping_Lemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.30620522088205465}}
{"text": "theory Lib_GeneralProofRules\nimports Lib_ProofRules\nbegin \n\nlemma lib_writes_on_after_write:\n \"lib_wfs ls cs \\<Longrightarrow> w\\<in>lib_visible_writes ls t x \\<Longrightarrow> lib_valid_fresh_ts ls w ts' \\<Longrightarrow>\nls' = lib_write t b w v ls cs ts' \\<Longrightarrow> lib_writes_on ls' x = lib_writes_on ls x \\<union> {(x,ts')}\"\n  apply(simp add: lib_write_def all_updates_l)\n  apply(simp add: lib_wfs_def lib_lastWr_def lib_writes_on_def lib_value_def lib_visible_writes_def lib_valid_fresh_ts_def var_def tst_def)\n  by (simp add: writes_ts_rewrite)\n\n\nlemma lib_d_obs_ts'_gt_max:\n \"lib_wfs ls cs \\<Longrightarrow> [lib(x) =\\<^sub>t u] ls \\<Longrightarrow> w\\<in>lib_visible_writes ls t x \\<Longrightarrow> lib_valid_fresh_ts ls w ts'\n \\<Longrightarrow> ts' > Max  (snd`(lib_writes_on ls x))\"\n  apply(simp add: lib_write_def all_updates_l)\n   apply(simp add: lib_d_obs_t_def lib_d_obs_def )\n apply(simp add: lib_wfs_def lib_lastWr_def lib_writes_on_def lib_value_def lib_visible_writes_def lib_valid_fresh_ts_def var_def tst_def)\n  done\n\n\nlemma lib_covered_ts'_gt_max:\n \"lib_wfs ls cs \\<Longrightarrow> cvd[lib(x), u] ls\\<Longrightarrow> w\\<notin>lib_covered ls  \\<Longrightarrow> w\\<in>lib_visible_writes ls t x \\<Longrightarrow> lib_valid_fresh_ts ls w ts'\n \\<Longrightarrow> ts' > Max  (snd`(lib_writes_on ls x))\"\n   apply(simp add: lib_covered_v_def )\n  apply(simp add: lib_wfs_def lib_lastWr_def lib_writes_on_def lib_value_def lib_visible_writes_def lib_valid_fresh_ts_def var_def tst_def)\n  apply safe\n  apply(subgoal_tac \"finite(snd ` {wa. fst wa = fst w \\<and> wa \\<in> lib_writes ls})\")\n   apply (metis (no_types, lifting) prod.collapse)\n  by blast\n\n\nlemma d_obs_write: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"[lib(x) =\\<^sub>t u] ls\"\n      and \"ls cs [lib(x) := v]\\<^sub>t ls' cs'\"\n    shows \"[lib(x) =\\<^sub>t v] ls'\"\n  using assms\n  apply(simp add: lib_d_obs_t_def lib_d_obs_def )\n  apply(simp add: lib_write_step_def, elim exE conjE)\n  apply(subgoal_tac \" ts' > Max  (snd`(lib_writes_on ls x)) \\<and> lib_writes_on ls' x = lib_writes_on ls x \\<union> {(x,ts')}\") defer\n  using assms(3) lib_d_obs_ts'_gt_max lib_writes_on_after_write apply blast\n  apply(intro conjI)\n   apply(simp add: lib_write_def all_updates_l)\n  apply(simp add: lib_lastWr_def lib_writes_on_def lib_value_def lib_visible_writes_def lib_valid_fresh_ts_def var_def tst_def)\n   apply clarsimp\n  apply(subgoal_tac \"finite(snd ` {w. fst w = x \\<and> w \\<in> lib_writes ls})\")\n    apply simp\n  apply (smt Max.coboundedI Max_insert2 dual_order.strict_trans less_eq_rat_def)\n  apply(simp add:lib_wfs_def lib_lastWr_def lib_writes_on_def lib_value_def lib_visible_writes_def lib_valid_fresh_ts_def var_def tst_def)\n   apply(simp add: lib_write_def all_updates_l)\n  apply(simp add: lib_lastWr_def lib_writes_on_def lib_value_def lib_visible_writes_def lib_valid_fresh_ts_def var_def tst_def)\n  apply safe\n  apply(subgoal_tac \"Max (insert ts'\n                    (snd `\n                     {w. fst w = x \\<and> w \\<in> lib_writes ls})) = ts'\")\n  apply blast\n  apply(subgoal_tac \"finite(snd ` {w. fst w = x \\<and> w \\<in> lib_writes ls})\")\n    apply simp\n  apply (smt Max.coboundedI Max_insert2 dual_order.strict_trans less_eq_rat_def)\n  apply(simp add:lib_wfs_def lib_lastWr_def lib_writes_on_def lib_value_def lib_visible_writes_def lib_valid_fresh_ts_def var_def tst_def)\n  done\n\n\nlemma d_obs_write_diff_var: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"[lib(x) =\\<^sub>t u] ls\"\n      and \"ls cs [lib(y) := v]\\<^sub>t' ls' cs'\"\n      and \"x \\<noteq> y\"\n    shows \"[lib(x) =\\<^sub>t u] ls'\"\n  using assms\n  apply(simp add: lib_d_obs_t_def lib_d_obs_def )\n  apply(simp add: lib_write_step_def, elim exE conjE)\n   apply(simp add: lib_write_def all_updates_l)\n  apply(simp add: lib_lastWr_def lib_writes_on_def lib_value_def lib_visible_writes_def lib_valid_fresh_ts_def var_def tst_def)\n  apply safe\n  apply (smt Collect_cong fst_conv)\n    apply(subgoal_tac \"finite(snd ` {w. fst w = x \\<and> w \\<in> lib_writes ls})\")\n  apply (smt Collect_cong fst_conv)\n  apply(simp add:lib_wfs_def lib_lastWr_def lib_writes_on_def lib_value_def lib_visible_writes_def lib_valid_fresh_ts_def var_def tst_def)\n  apply (metis fst_conv)\n    apply(subgoal_tac \"finite(snd ` {w. fst w = x \\<and> w \\<in> lib_writes ls})\")\n  apply (smt Collect_cong fst_conv)\n  apply(simp add:lib_wfs_def lib_lastWr_def lib_writes_on_def lib_value_def lib_visible_writes_def lib_valid_fresh_ts_def var_def tst_def)  \n  done\n\n\nlemma d_obs_CAS_R_diff_var: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"[lib(x) =\\<^sub>t v] ls\"\n      and \"x \\<noteq> y\"\n      and \"ls cs CAS\\<^sup>R[lib(y), res, u, u']\\<^sub>t ls' cs'\"\n    shows \"[lib(x) =\\<^sub>t v] ls'\"\n  using assms\n  apply(simp add: lib_d_obs_t_def lib_d_obs_def )\n  apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n   defer\n   apply(simp add: lib_read_def all_updates_l)\n  apply safe\n           apply (simp_all add: lib_syncing_def)\n  using a_is_x apply blast\n  using a_is_x apply blast\n     apply(simp add: lib_lastWr_def lib_writes_on_def tst_def )\n    apply(simp add: lib_lastWr_def lib_writes_on_def tst_def lib_value_def)\n  apply(simp add: lib_update_r_def all_updates_l)\n  apply(simp add: lib_lastWr_def lib_writes_on_def tst_def lib_value_def)\n  apply safe\n  using a_is_x apply blast\n  apply (metis fst_conv var_def)\n  apply(simp add: lib_update_r_def all_updates_l)\n  apply(simp add: lib_lastWr_def lib_writes_on_def tst_def lib_value_def)\n  apply safe\n  using a_is_x apply blast\n  apply (metis fst_conv var_def)  \n  by (metis a_is_x fst_conv var_def)\n\n\nlemma cvd_CAS_R_cvd: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"\\<exists> u . cvd[lib(x), u] ls\"\n      and \"ls cs CAS\\<^sup>R[lib(x), res, v, v']\\<^sub>t ls' cs'\"\n    shows \"\\<exists> u . cvd[lib(x), u] ls'\"\n  using assms\n  apply(elim exE)\n  apply(case_tac \"res = True\", simp_all)\n   apply(rule_tac x = v' in exI)\n   apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply(subgoal_tac \" ts' > Max  (snd`(lib_writes_on ls x))\")\n    defer\n  using lib_covered_ts'_gt_max apply blast defer\n  apply(case_tac \"lib_value ls (a, b) = v\", simp_all)\n  apply(simp add: lib_update_r_def all_updates_l)\n   apply(simp add: lib_lastWr_def lib_writes_on_def  lib_value_def lib_covered_v_def var_def tst_def lib_visible_writes_def)\n   apply(intro allI impI conjI)\n     apply(subgoal_tac \"finite(snd ` {w. fst w = x \\<and> w \\<in> lib_writes ls})\")\n  apply(subgoal_tac \"{w. fst w = x \\<and> (w = (x, ts') \\<or> w \\<in> lib_writes ls)} = {w. fst w = x \\<and> ( w \\<in> lib_writes ls)} \\<union> {(x,ts')}\")\n      apply simp\n  apply (smt Max.coboundedI Max_insert2 dual_order.strict_trans less_eq_rat_def)\n      apply(simp add: lib_wfs_def lib_lastWr_def lib_writes_on_def  lib_value_def lib_covered_v_def var_def tst_def lib_visible_writes_def)\n      apply (simp add: writes_ts_rewrite)\n      apply(simp add: lib_wfs_def lib_lastWr_def lib_writes_on_def  lib_value_def lib_covered_v_def var_def tst_def lib_visible_writes_def)\n  apply blast\n   apply blast\n    apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply(case_tac \"lib_value ls (a, b) = v\", simp_all)\n  using lib_read_cvd_pres lib_read_step_def by blast\n\n\nlemma last_CAS_R_diff_var: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"x \\<noteq> y\"\n      and \"ls cs CAS\\<^sup>R[lib(y), res, u, u']\\<^sub>t ls' cs'\"\n    shows \"lib_lastWr ls' x = lib_lastWr ls x\"\n  using assms\n  apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n  apply(simp add: lib_update_r_def all_updates_l)\n   apply(simp add: lib_lastWr_def lib_writes_on_def  lib_value_def lib_covered_v_def var_def tst_def lib_visible_writes_def)\n   apply (metis fst_conv)\n  by (metis lib_read_last_diff_var_pres lib_read_step_def)\n\n\nlemma write_value_CAS_R_diff_var: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"x \\<noteq> y\"\n      and \"ls cs CAS\\<^sup>R[lib(y), res, u, u']\\<^sub>t ls' cs'\"\n      and \"w \\<in> lib_writes_on ls x\"\n    shows \"lib_value ls' w = lib_value ls w\"\n  using assms\n  apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n  apply(simp add: lib_update_r_def all_updates_l)\n   apply(simp add: lib_lastWr_def lib_writes_on_def  lib_value_def lib_covered_v_def var_def tst_def lib_visible_writes_def)\n   apply (metis fst_conv)\n  using lib_read_step_def lib_value_read_pres by blast\n\n\nlemma d_obs_post_CAS_R_diff_var_pre: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"[lib(x) =\\<^sub>t v] ls'\"\n      and \"x \\<noteq> y\"\n      and \"ls cs CAS\\<^sup>R[lib(y), res, u, u']\\<^sub>t' ls' cs'\"\n    shows \"[lib(x) =\\<^sub>t v] ls\"\n  using assms\n  apply(simp add: lib_d_obs_t_def lib_d_obs_def lib_CAS_Rel_step_def)\n  apply(elim exE conjE, intro conjI)\n   apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n  apply(simp_all add: lib_update_r_def all_updates_l lib_lastWr_def lib_value_def lib_read_def)\n  apply (smt a_is_x assms(5) fun_upd_other last_CAS_R_diff_var lib_lastWr_def)\n  apply (smt a_is_x assms(5) fun_upd_other last_CAS_R_diff_var lib_lastWr_def lib_syncing_def)\n  apply(simp add: lib_writes_on_def lib_visible_writes_def)\n   apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n  apply(simp_all add: lib_update_r_def all_updates_l lib_lastWr_def lib_value_def lib_read_def)\n  apply(case_tac \" x = a\", simp_all)\n  by (smt Collect_cong fst_conv var_def)\n\nlemma d_obs_post_CAS_R_diff_var_post: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"[lib(x) =\\<^sub>t v] ls\"\n      and \"x \\<noteq> y\"\n      and \"ls cs CAS\\<^sup>R[lib(y), res, u, u']\\<^sub>t' ls' cs'\"\n    shows \"[lib(x) =\\<^sub>t v] ls'\"\n  using assms\n  apply(simp add: lib_d_obs_t_def lib_d_obs_def lib_CAS_Rel_step_def)\n  apply(elim exE conjE, intro conjI)\n   apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n  apply(simp_all add: lib_update_r_def all_updates_l lib_lastWr_def lib_value_def lib_read_def)\n  apply (metis a_is_x assms(1) assms(2) assms(4) assms(5) last_CAS_R_diff_var lib_lastWr_def snd_conv tst_def)\n  apply (smt Collect_cong a_is_x lib_state.select_convs(1) lib_state.surjective lib_state.update_convs(2) lib_syncing_def lib_writes_on_def)\n   apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n  apply(simp_all add: lib_update_r_def all_updates_l lib_lastWr_def lib_value_def lib_read_def)\n  apply (smt a_is_x assms(5) fun_upd_other last_CAS_R_diff_var lib_lastWr_def)\n  by (simp add: lib_writes_on_def)\n\n\nlemma cvd_CAS_R_success_read_val: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"cvd[lib(x), v] ls\"\n      and \"ls cs CAS\\<^sup>R[lib(x), True, u, u']\\<^sub>t ls' cs'\"\n    shows \"u = v\"\n  using assms\n  apply(simp add: lib_d_obs_t_def lib_d_obs_def lib_CAS_Rel_step_def)\n  apply safe\n  apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n  using cvd_vw_val by blast\n\n\nlemma cvd_CAS_R_success_post: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"cvd[lib(x), u] ls\"\n      and \"ls cs CAS\\<^sup>R[lib(x), True, u, u']\\<^sub>t ls' cs'\"\n    shows \"cvd[lib(x), u'] ls'\"\n  using assms\n  apply(subgoal_tac \"\\<exists>u . cvd[lib(x), u] ls\")\n   apply(subgoal_tac \"\\<exists>u . cvd[lib(x), u] ls'\")\n    defer\n  apply (simp add: cvd_CAS_R_cvd)\n  apply auto[1]\n    apply(elim exE)\n  apply(simp add: lib_d_obs_t_def lib_d_obs_def lib_CAS_Rel_step_def lib_update_r_def, elim exE conjE)\n    apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n  apply(simp add:  lib_update_r_def all_updates_l lib_covered_v_def)\n   apply safe\n   apply(simp add: lib_writes_on_def)\n  using a_is_x apply blast\n    apply(simp add: lib_writes_on_def)\n  apply (smt lib_visible_writes_def lib_writes_on_def mem_Collect_eq)\n    apply(simp add: lib_writes_on_def)\n  using a_is_x apply blast\n  apply(simp add:lib_value_def lib_lastWr_def lib_writes_on_def)\n  apply(elim conjE disjE)\n  apply auto[1]\n  by (smt a_is_x lib_visible_writes_def lib_writes_on_def mem_Collect_eq)\n\n\nlemma cvd_CAS_R_success_d_obs_post: \n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"cvd[lib(x), v] ls\"\n      and \"ls cs CAS\\<^sup>R[lib(x), True, u, u']\\<^sub>t ls' cs'\"\n    shows \"[lib(x) =\\<^sub>t u'] ls'\"\n  using assms\n  apply(subgoal_tac \"v = u\")\n  defer\n  using cvd_CAS_R_success_read_val apply blast\n    apply(simp add: lib_covered_v_def lib_d_obs_def lib_d_obs_t_def)\n  apply(intro conjI)\n   apply(simp add: lib_CAS_Rel_step_def lib_update_r_def)\n   apply(elim exE conjE)\n   apply(subgoal_tac \"lib_lastWr ls' x = (x, ts') \")\n    apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n  apply(simp add: all_updates_l lib_update_r_def)\n  using a_is_x apply blast\n    apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n   apply(simp add: all_updates_l lib_update_r_def lib_lastWr_def lib_writes_on_def)\n   apply(elim conjE)\n   apply(subgoal_tac \"{w. var w = x \\<and> (w = (a, ts') \\<or> w \\<in> lib_writes ls)} = {w. var w = x \\<and> ( w \\<in> lib_writes ls)} \\<union> { (a, ts')}\")\n    defer\n    apply(simp add: var_def)\n  apply(subgoal_tac \"finite({w. fst w = x \\<and> w \\<in> lib_writes ls})\")\n  using a_is_x writes_ts_rewrite apply blast\n    apply(simp add: lib_wfs_def lib_writes_on_def var_def)\n   defer\n   apply (simp add: tst_def var_def)\n  apply(subgoal_tac \" b = Max (snd ` {w. fst w = x \\<and> w \\<in> lib_writes ls}) \", simp_all)\n    defer\n    apply(subgoal_tac \"a = x\", simp) \n  apply(simp add: lib_visible_writes_def lib_writes_on_def)\n  using a_is_x apply blast\n   defer\n   apply(subgoal_tac \"ts' > b\")\n    apply(subgoal_tac \"finite(snd ` {w. fst w = x \\<and> w \\<in> lib_writes ls})\")\n  apply(simp add: lib_valid_fresh_ts_def lib_visible_writes_def lib_writes_on_def tst_def var_def)\n  apply (metis (no_types, lifting) Max_ge Max_insert2 dual_order.strict_trans less_eq_rat_def)\n     apply(simp add: lib_wfs_def lib_writes_on_def var_def)\n  apply (simp add: lib_valid_fresh_ts_def)\n  apply(simp add: lib_CAS_Rel_step_def lib_update_r_def)\n  apply(elim exE conjE)\n   apply(subgoal_tac \"lib_lastWr ls' x = (x, ts') \")\n     apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n   apply(simp add: all_updates_l lib_update_r_def lib_lastWr_def lib_writes_on_def)\n   apply(simp add: lib_value_def)\n  using a_is_x apply blast\n     apply(case_tac \"lib_value ls (a, b) = u\", simp_all)\n    apply(simp add: all_updates_l lib_update_r_def lib_lastWr_def lib_writes_on_def)\n   apply(subgoal_tac \"{w. var w = x \\<and> (w = (a, ts') \\<or> w \\<in> lib_writes ls)} = {w. var w = x \\<and> ( w \\<in> lib_writes ls)} \\<union> { (a, ts')}\")\n    defer\n    apply(simp add: var_def)\n  apply(subgoal_tac \"finite({w. fst w = x \\<and> w \\<in> lib_writes ls})\")\n  using a_is_x writes_ts_rewrite apply blast\n      apply(simp add: lib_wfs_def lib_writes_on_def var_def)\n   apply (simp add: tst_def var_def)\n  apply(subgoal_tac \" b = Max (snd ` {w. fst w = x \\<and> w \\<in> lib_writes ls}) \", simp_all)\n    defer\n    apply(subgoal_tac \"a = x\", simp) \n  apply(simp add: lib_visible_writes_def lib_writes_on_def)\n  using a_is_x apply blast\n   apply(subgoal_tac \"ts' > b\")\n    apply(subgoal_tac \"finite(snd ` {w. fst w = x \\<and> w \\<in> lib_writes ls})\")\n  apply(simp add: lib_valid_fresh_ts_def lib_visible_writes_def lib_writes_on_def tst_def var_def)\n  apply (metis (no_types, lifting) Max_ge Max_insert2 dual_order.strict_trans less_eq_rat_def)\n     apply(simp add: lib_wfs_def lib_writes_on_def var_def)  \n  by (simp add: lib_valid_fresh_ts_def)\n\n\n\nlemma lib_read_pres_last:\n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"lib_read_step t x b ls cs ls' cs' v \"\n      shows \"lib_lastWr ls y = lib_lastWr ls' y\"\n  using assms\n  apply(simp add: lib_read_step_def lib_read_def lib_lastWr_def all_updates_l)\n  apply(elim exE conjE)\n  apply(simp add: lib_writes_on_def)\n  done\n\n\nlemma lib_read_transfer:\n  assumes \"lib_wfs ls cs\"\n      and \"wfs cs\"\n      and \"[lib(x) = a]\\<lparr>lib(y) =\\<^sub>t b\\<rparr> ls\"\n      and \"lib_read_step t x True ls cs ls' cs' a \"\n    shows \"[lib(y) =\\<^sub>t b] ls'\"\n  using assms\n  apply(simp add: lib_read_step_def lib_c_obs_lib_only_def lib_d_obs_t_def lib_d_obs_def)\n  apply(elim exE conjE, intro conjI)\n   apply(simp add: lib_read_def all_updates_l)\n   apply(intro conjI impI allI)\n      apply(simp add: ts_oride_def lib_lastWr_def lib_writes_on_def var_def tst_def lib_value_def lib_visible_writes_def)\n  apply safe\n  apply blast\n  apply (simp add: lib_wfs_def)\n  using lib_syncing_def apply blast\n       apply(simp add: ts_oride_def lib_lastWr_def lib_writes_on_def var_def tst_def lib_value_def lib_visible_writes_def)\n  apply safe\n  apply blast\n       apply(simp add:lib_wfs_def lib_syncing_def ts_oride_def lib_lastWr_def lib_writes_on_def var_def tst_def lib_value_def lib_visible_writes_def)\n  apply clarsimp\n  using lib_syncing_def apply blast\n   apply(simp add: lib_read_def all_updates_l)\n   apply(intro conjI impI allI)\n   apply(simp add: ts_oride_def lib_lastWr_def lib_writes_on_def var_def tst_def lib_value_def lib_visible_writes_def)\n   apply blast\n  using lib_syncing_def by blast\n\n\n\nlemma write_diff_var_last_val:\n  assumes \"cls ccs [lib(x) := v]\\<^sub>t cls' ccs'\"\n    and \"lib_wfs cls ccs\"\n    and \"x \\<noteq> y\"\n  shows \"lib_value cls' (lib_lastWr cls' y) = lib_value cls (lib_lastWr cls y)\"\n  using assms\n  apply(simp add: lib_write_def lib_write_step_def all_updates_l, elim exE conjE)\n  apply clarsimp\n  apply(simp add: lib_value_def lib_lastWr_def lib_writes_on_def var_def tst_def)\n  apply safe\n  using a_is_x apply blast  \n  apply (metis fst_conv)  \n  by (metis a_is_x fst_conv)\n\nlemma rd_preserves_last:\n\"cls ccs [r \\<leftarrow> lib a]\\<^sub>t cls' ccs' \n  \\<Longrightarrow> (lib_value cls (lib_lastWr cls b) = lib_value cls' (lib_lastWr cls' b))\"\n  apply (simp add: lib_read_step_def lib_read_def, safe)\n  apply (case_tac \"lib_syncing cls (aa, ba) False\", simp_all)\n  apply (simp add: lib_syncing_def)\n  by (simp add: lib_value_def lib_update_thrView_def lib_lastWr_def tst_def lib_writes_on_def)\n\n lemma rd_A_preserves_last:\n\"cls ccs [r \\<leftarrow>\\<^sup>A lib a]\\<^sub>t cls' ccs' \n  \\<Longrightarrow> (lib_value cls (lib_lastWr cls b) = lib_value cls' (lib_lastWr cls' b))\"\n  apply (simp add: lib_read_step_def lib_read_def, safe)\n  apply (case_tac \"lib_syncing cls (aa, ba) False\", simp_all)\n  apply (simp add: lib_syncing_def)\n  by (simp add: lib_value_def lib_update_thrView_def lib_lastWr_def tst_def lib_writes_on_def)\n\n\nlemma failed_CAS_preserves_last: \n\"cls ccs CAS\\<^sup>R[lib a, False, b, b']\\<^sub>t cls' ccs'\n  \\<Longrightarrow> (lib_value cls (lib_lastWr cls c) = lib_value cls' (lib_lastWr cls' c))\" \n  apply (simp add: lib_CAS_Rel_step_def, safe)\n  apply (case_tac \"lib_value cls (aa, ba) = b\", safe)\n  apply (simp add: lib_value_def lib_update_thrView_def lib_lastWr_def tst_def lib_writes_on_def)\n  using lib_read_step_def rd_preserves_last by fastforce\n\n\nlemma succ_CAS_preserves_last:\n\"cls ccs CAS\\<^sup>R[lib x, rv, y, y']\\<^sub>t cls' ccs'\\<Longrightarrow> x \\<noteq> b\n  \\<Longrightarrow> lib_value cls' (lib_lastWr cls' b) = lib_value cls (lib_lastWr cls b)\"\n  apply (simp add: lib_CAS_Rel_step_def, safe)\n  apply (case_tac \"lib_value cls (a, ba) = y\", safe)\n  apply (simp add: var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def)\n  apply (smt Collect_cong a_is_x fst_conv)\n  using lib_read_step_def rd_preserves_last by fastforce\n\n\nlemma ts'_gt_max_writes_on: \"cvd[lib(x), y] cls \\<Longrightarrow> w\\<in>lib_visible_writes cls t x \\<Longrightarrow> w\\<notin>lib_covered cls \\<Longrightarrow> lib_valid_fresh_ts cls w ts'\n\\<Longrightarrow> ts' > Max (snd `lib_writes_on cls x)\"\n  apply(simp add: lib_covered_v_def lib_visible_writes_def lib_valid_fresh_ts_def)\n  by (metis lib_lastWr_def sndI surj_pair tst_def)\n\nlemma succ_CAS_last_value:\n\"lib_wfs cls css \\<Longrightarrow> wfs ccs \\<Longrightarrow>  cls ccs CAS\\<^sup>R[lib x, True, y, y']\\<^sub>t cls' ccs'\\<Longrightarrow> cvd[lib(x), y] cls\n  \\<Longrightarrow> lib_value cls' (lib_lastWr cls' x) = y'\"\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply (case_tac \"lib_value cls (a, b) = y\", simp_all)\n  apply(subgoal_tac \"lib_lastWr cls' x = (x,ts')\")\n\n  apply (simp add: lib_covered_v_def var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def)\n  apply safe\n   apply (smt Collect_cong a_is_x fst_conv)\n  apply(simp add: lib_wfs_def lib_update_r_def all_updates_l lib_valid_fresh_ts_def lib_lastWr_def lib_writes_on_def tst_def var_def)\n   apply(simp add: lib_valid_fresh_ts_def lib_visible_writes_def lib_writes_on_def var_def tst_def)\n  apply(subgoal_tac \"a = x\", simp)\n   apply(subgoal_tac \"{w. fst w = x \\<and> (w = (x, ts') \\<or> w \\<in> lib_writes cls)} = {w. fst w = x \\<and> w \\<in> lib_writes cls} \\<union> {(x, ts')}\")\n    defer\n    apply fastforce\n   apply blast\n  apply (simp add: lib_covered_v_def)\n  apply(subgoal_tac \"ts' > Max (snd `(lib_writes_on cls x))\")\n   apply(unfold  lib_writes_on_def var_def tst_def)[1]\n  apply(subgoal_tac \"{w. fst w = x \\<and> w \\<in> lib_writes cls} \\<noteq> {} \\<and> finite({w. fst w = x \\<and> w \\<in> lib_writes cls})\")\n  apply (smt Max_in Max_less_iff finite_imageI finite_insert image_is_empty insertE insertI1 insert_not_empty not_max)\n  \n   apply blast+\n  using ts'_gt_max_writes_on lib_visible_writes_def lib_valid_fresh_ts_def\n  by (smt lib_lastWr_def lib_writes_on_def mem_Collect_eq snd_conv tst_def var_def)\n\n\n lemma wr_preserves_last:\n\"cls ccs [lib x := v]\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \n  \\<Longrightarrow> (lib_value cls (lib_lastWr cls b) = lib_value cls' (lib_lastWr cls' b))\"\n  apply (simp add: lib_write_step_def lib_write_def, safe)\n   apply (simp add: all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def)\n   by (smt Collect_cong a_is_x fst_conv)\n \n\n lemma wr_R_preserves_last:\n\"cls ccs [lib x :=\\<^sup>R v]\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \n  \\<Longrightarrow> (lib_value cls (lib_lastWr cls b) = lib_value cls' (lib_lastWr cls' b))\"\n  apply (simp add: lib_write_step_def lib_write_def, safe)\n   apply (simp add: all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def)\n   by (smt Collect_cong a_is_x fst_conv)\n\n\n lemma wr_R_preserves_writes_on_diff_var:\n\"cls ccs [lib x :=\\<^sup>R v]\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \n  \\<Longrightarrow> lib_writes_on cls' b = lib_writes_on cls b\"\n  apply (simp add: lib_write_step_def lib_write_def, safe)\n    apply (simp add: all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def)\n   using a_is_x apply blast\n   apply(simp add: lib_writes_on_def all_updates_l)\n   by blast\n\nlemma wr_preserves_writes_on_diff_var:\n\"cls ccs [lib x := v]\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \n  \\<Longrightarrow> lib_writes_on cls' b = lib_writes_on cls b\"\n  apply (simp add: lib_write_step_def lib_write_def, safe)\n    apply (simp add: all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def)\n   using a_is_x apply blast\n   apply(simp add: lib_writes_on_def all_updates_l)\n   by blast\n\nlemma wr_preserves_value_diff_var:\n\"cls ccs [lib x := v]\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \\<Longrightarrow> w\\<in>lib_writes_on cls b\n  \\<Longrightarrow> lib_value cls' w = lib_value cls w\"\n  apply (simp add: lib_write_step_def lib_write_def, safe)\n    apply (simp add: all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def)\n  using fresh_ts_not_in_writes by blast\n\n\nlemma wr_preserves_mView_diff_var:\n\"cls ccs [lib x := v]\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \\<Longrightarrow> w\\<in>lib_writes_on cls b\n  \\<Longrightarrow> lib_modView cls' w = lib_modView cls w\"\n  apply (simp add: lib_write_step_def lib_write_def, safe)\n    apply (simp add: all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def)\n  using fresh_ts_not_in_writes by blast\n\n\n\nlemma wr_R_preserves_value_diff_var:\n\"cls ccs [lib x :=\\<^sup>R v]\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \\<Longrightarrow> w\\<in>lib_writes_on cls b\n  \\<Longrightarrow> lib_value cls' w = lib_value cls w\"\n  apply (simp add: lib_write_step_def lib_write_def, safe)\n    apply (simp add: all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def)\n  using fresh_ts_not_in_writes by blast\n\nlemma wr_preserves_releasing_diff_var:\n\"cls ccs [lib x := v]\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \\<Longrightarrow> w\\<in>lib_writes_on cls b\n  \\<Longrightarrow> lib_releasing cls' w = lib_releasing cls w\"\n  apply (simp add: lib_write_step_def lib_write_def, safe)\n    apply (simp add:lib_releasing_def all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def)\n  using   fresh_ts_not_in_writes\n  apply (metis (full_types))\n    apply (simp add:lib_releasing_def all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def) \n  using a_is_x by fastforce\n\nlemma wr_R_preserves_releasing_diff_var:\n\"cls ccs [lib x :=\\<^sup>R v]\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \\<Longrightarrow> w\\<in>lib_writes_on cls b\n  \\<Longrightarrow> lib_releasing cls' w = lib_releasing cls w\"\n  apply (simp add: lib_write_step_def lib_write_def, safe)\n    apply (simp add:lib_releasing_def all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def)\n  using   fresh_ts_not_in_writes\n   apply (metis (full_types))\n  by (simp add:lib_releasing_def all_updates_l var_def lib_value_def  lib_lastWr_def tst_def lib_writes_on_def) \n\n\n lemma CAS_Rel_preserves_writes_on_diff_var:\n\"cls ccs CAS\\<^sup>R[lib x, rv, y, y']\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \n  \\<Longrightarrow> lib_writes_on cls' b = lib_writes_on cls b\"\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply (case_tac \"lib_value cls (a, ba) = y\", safe) \n  apply (simp add: var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def)\n     apply (smt Collect_cong a_is_x fst_conv)\n  apply (simp add: var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def)\n     apply (smt Collect_cong a_is_x fst_conv)\n  apply (simp add: var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def)\n    apply(simp add: lib_read_def all_updates_l)\n   apply blast\n     apply(simp add: lib_read_def all_updates_l lib_writes_on_def)\n   by blast\n\n\nlemma CAS_Rel_preserves_releasing_diff_var:\n\"cls ccs CAS\\<^sup>R[lib x, rv, y, y']\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \\<Longrightarrow> w\\<in>lib_writes_on cls b\n  \\<Longrightarrow> lib_releasing cls' w = lib_releasing cls w\"\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply (case_tac \"lib_value cls (a, ba) = y\", safe) \n  apply (simp add: var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def)\n     apply (smt Collect_cong a_is_x fst_conv)\n    apply (simp add: var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def)\n    apply (simp add: var_def lib_value_def lib_read_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def)\n    by (simp add: var_def lib_value_def lib_read_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def)\n\n\nlemma CAS_Rel_preserves_value_diff_var:\n\"cls ccs CAS\\<^sup>R[lib x, rv, y, y']\\<^sub>t cls' ccs' \\<Longrightarrow> x \\<noteq> b \\<Longrightarrow> w\\<in>lib_writes_on cls b\n  \\<Longrightarrow> lib_value cls' w = lib_value cls w\"\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply (case_tac \"lib_value cls (a, ba) = y\", safe) \n  apply (simp add: var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def)\n     apply (smt Collect_cong a_is_x fst_conv)\n    apply (simp add: var_def  lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_value_def)\n    apply (simp add: var_def lib_value_def lib_read_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def)\ndone\n\n\nlemma CAS_Rel_preserves_releasing_same_var:\n\"cls ccs CAS\\<^sup>R[lib x, rv, y, y']\\<^sub>t cls' ccs' \\<Longrightarrow>  w\\<in>lib_writes_on cls x\n  \\<Longrightarrow> lib_releasing cls' w = lib_releasing cls w\"\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply (case_tac \"lib_value cls (a, b) = y\", safe) \n  apply (simp add: var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def) \n  using   fresh_ts_not_in_writes\n     apply (metis (full_types))\n  apply (simp add: var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def) \n    apply (simp add: var_def lib_value_def lib_read_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def)\n    apply (simp add: var_def lib_value_def lib_read_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def)\n  done\n\nlemma CAS_Rel_preserves_releasing_new:\n\"cls ccs CAS\\<^sup>R[lib x, rv, y, y']\\<^sub>t cls' ccs' \\<Longrightarrow>  w\\<notin>lib_writes_on cls x \\<Longrightarrow> w \\<in> lib_writes_on cls' x\n  \\<Longrightarrow> lib_releasing cls' w\"\n apply(case_tac \"rv\", simp_all)\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply (case_tac \"lib_value cls (a, b) = y\", simp_all) \n  apply(subgoal_tac \"w = (x, ts')\")\n    defer\n  apply(simp add: lib_valid_fresh_ts_def lib_visible_writes_def)\n    apply(simp add: lib_update_r_def all_updates_l lib_writes_on_def lib_releasing_def)\n  defer\n   apply(simp add: lib_update_r_def all_updates_l lib_releasing_def)\n  using a_is_x apply blast\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply (case_tac \"lib_value cls (a, b) = y\", simp_all) \n    by (simp add: var_def lib_value_def lib_read_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def)\n\n\nlemma CAS_Rel_preserves_releasing_old:\n\"cls ccs CAS\\<^sup>R[lib x, rv, y, y']\\<^sub>t cls' ccs' \\<Longrightarrow>  w\\<in>lib_writes_on cls x \n  \\<Longrightarrow> lib_releasing cls' w = lib_releasing cls w\"\n  by (simp add: CAS_Rel_preserves_releasing_same_var)\n\nlemma CAS_Rel_preserves_value_old:\n\"cls ccs CAS\\<^sup>R[lib x, rv, y, y']\\<^sub>t cls' ccs' \\<Longrightarrow>  w\\<in>lib_writes_on cls x \n  \\<Longrightarrow> lib_value cls' w = lib_value cls w\"\n apply(case_tac \"rv\", simp_all)\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply (case_tac \"lib_value cls (a, b) = y\", simp_all) \n   apply(simp add: lib_update_r_def all_updates_l lib_writes_on_def lib_value_def)\n  using fresh_ts_not_in_writes apply blast\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply (case_tac \"lib_value cls (a, b) = y\", simp_all) \n by (simp add: var_def lib_value_def lib_read_def all_updates_l lib_lastWr_def tst_def lib_writes_on_def lib_releasing_def)\n\n\nlemma rd_A_preserves_values:\n\"cls ccs [r \\<leftarrow>\\<^sup>A lib a]\\<^sub>t cls' ccs' \n  \\<Longrightarrow> lib_value cls  = lib_value cls' \"\n  apply (simp add: lib_read_step_def lib_read_def all_updates_l, elim exE conjE)\n  apply (case_tac \"lib_syncing cls (aa, b) False\", simp_all)\n   apply (simp add: lib_syncing_def)\n  apply (unfold lib_value_def)\n by simp\n\n\n lemma rd_A_preserves_writes_on:\n\"cls ccs [r \\<leftarrow>\\<^sup>A lib a]\\<^sub>t cls' ccs' \n  \\<Longrightarrow> lib_writes_on cls' b = lib_writes_on cls b\"\n  apply (simp add: lib_read_step_def lib_read_def, safe)\n  apply (case_tac \"lib_syncing cls (aa, ba) False\", simp_all)\n  apply (simp add: lib_syncing_def)\n   apply (simp add: lib_value_def  all_updates_l  lib_lastWr_def tst_def lib_writes_on_def)\n   apply blast\n by (smt lib_state.select_convs(1) lib_state.surjective lib_state.update_convs(2) lib_update_thrView_def lib_writes_on_def mem_Collect_eq)\n\n\n\n\n lemma failed_CAS_Rel_preserves_writes_on_diff_var:\n\"cls ccs CAS\\<^sup>R[lib x, False, y, y']\\<^sub>t cls' ccs' \n  \\<Longrightarrow> lib_writes_on cls' b = lib_writes_on cls b\"\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply (case_tac \"lib_value cls (a, ba) = y\", simp_all) \n  apply (simp add:lib_read_def var_def lib_value_def lib_update_r_def all_updates_l lib_lastWr_def tst_def lib_writes_on_def)\n   done\n\n\n lemma CAS_Rel_new_write_value:\n\"cls ccs CAS\\<^sup>R[lib x, b, y, y']\\<^sub>t cls' ccs' \\<Longrightarrow> w\\<notin>lib_writes_on cls x \\<Longrightarrow> w\\<in>lib_writes_on cls' x\n  \\<Longrightarrow> lib_value cls' w = y'\"\n   apply(case_tac \"\\<not>b\", simp_all)\n   using failed_CAS_Rel_preserves_writes_on_diff_var apply metis\n  apply (simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply (case_tac \"lib_value cls (a, ba) = y\", simp_all) \n    apply (simp add: var_def lib_value_def lib_update_r_def all_updates_l  lib_lastWr_def tst_def lib_writes_on_def)\n   done\n\nlemma lib_c_obs_lib_only_pres_wr_diff_var:  \"lib_wfs \\<sigma> \\<sigma>\\<^sub>C \\<Longrightarrow> [lib(x) = u]\\<lparr>lib(y) =\\<^sub>t v\\<rparr> \\<sigma>  \\<Longrightarrow> lib_write_step t' z b \\<sigma> \\<sigma>\\<^sub>C  \\<sigma>' \\<sigma>\\<^sub>C' n \n\\<Longrightarrow> z \\<noteq> x \\<Longrightarrow> z \\<noteq> y \\<Longrightarrow> [lib(x) = u]\\<lparr>lib(y) =\\<^sub>t v\\<rparr> \\<sigma>'\"\n  apply(simp add: lib_c_obs_lib_only_def lib_write_step_def lib_visible_writes_def, elim exE conjE)\n  apply(simp add: lib_write_def all_updates_l)\n  apply(intro allI impI conjI)\n  apply(simp_all add: lib_d_obs_def lib_lastWr_def lib_writes_on_def lib_value_def var_def tst_def lib_releasing_def)\n     apply (smt Collect_cong fst_conv)\n    apply blast\n  apply (smt Collect_cong fst_conv)\n  by blast\n\n\nlemma lib_c_obs_lib_only_pres_read_var:  \"lib_wfs \\<sigma> \\<sigma>\\<^sub>C \\<Longrightarrow> [lib(x) = u]\\<lparr>lib(y) =\\<^sub>t v\\<rparr> \\<sigma>  \\<Longrightarrow>  lib_read_step t' m b \\<sigma> \\<sigma>\\<^sub>C \\<sigma>' \\<sigma>\\<^sub>C' n \n\\<Longrightarrow> [lib(x) = u]\\<lparr>lib(y) =\\<^sub>t v\\<rparr> \\<sigma>'\"\n  apply(simp add: lib_c_obs_lib_only_def lib_read_step_def lib_visible_writes_def, elim exE conjE)\n  apply(simp add: lib_read_def all_updates_l)\n  apply(intro conjI impI allI)\n         apply(simp_all add: ts_oride_def lib_syncing_def lib_d_obs_def lib_lastWr_def lib_writes_on_def lib_value_def var_def tst_def lib_releasing_def)\n  apply (smt dual_order.trans fun_upd_same snd_conv)\n  using dual_order.trans apply force  \n  using order_trans apply blast\n  using order.trans apply blast\n  apply (smt fun_upd_other order.trans)  \n    apply (smt fun_upd_other order.trans)\n           apply blast\n  apply blast\n  apply (smt fun_upd_other order.trans)\n  apply (smt fun_upd_other order.trans)\n  apply (smt fun_upd_other order.trans)\n  apply blast\n  apply blast\n  apply blast\n  apply blast\n  by blast\n\nlemma failed_CASR_pres_c_obs_lib_only : \"[lib(x) = m]\\<lparr>lib(y) =\\<^sub>t n \\<rparr> cls \\<Longrightarrow>\n   cls ccs CAS\\<^sup>R[lib z, False, l, k]\\<^sub>t' cls' ccs' \\<Longrightarrow>\n   [lib(x) = m]\\<lparr>lib(y) =\\<^sub>t n \\<rparr> cls'\"\n  apply(simp add: lib_c_obs_lib_only_def lib_CAS_Rel_step_def lib_visible_writes_def, elim exE conjE)\n  apply(case_tac \"lib_value cls (a, b) = l\", simp_all)\n  apply(simp add: lib_read_def all_updates_l lib_d_obs_def lib_writes_on_def lib_lastWr_def lib_syncing_def lib_value_def tst_def var_def)\n  apply(intro conjI impI allI)\n  using dual_order.trans apply blast  \n  using dual_order.trans apply blast  \n     apply (simp_all add: lib_releasing_def)\n  done\n\n\nlemma failed_CASR_pres_d_obs_lib : \"lib_wfs cls css \\<Longrightarrow>[lib(x) =\\<^sub>t m] cls \\<Longrightarrow>\n   cls ccs CAS\\<^sup>R[lib z, False, l, k]\\<^sub>t' cls' ccs' \\<Longrightarrow>\n   [lib(x) =\\<^sub>t m] cls'\"\n  apply(simp add:  lib_CAS_Rel_step_def lib_visible_writes_def, elim exE conjE)\n  apply(case_tac \"lib_value cls (a, b) = l\", simp_all)\n  apply(case_tac \"t=t'\")\n   apply(simp add: lib_read_def all_updates_l lib_d_obs_t_def lib_d_obs_def)\n  apply (intro allI impI conjI)\n          apply (simp_all add: lib_syncing_def)\n      apply(simp add: lib_lastWr_def lib_writes_on_def tst_def var_def)\n  apply(subgoal_tac \"finite(snd ` {w. fst w = z \\<and> w \\<in> lib_writes cls})\")\n  apply (metis (mono_tags, lifting) Max.coboundedI dual_order.antisym fst_conv mem_Collect_eq rev_image_eqI snd_conv)\n      apply(simp add: lib_wfs_def lib_writes_on_def lib_lastWr_def tst_def var_def)\n      apply(simp add: lib_lastWr_def lib_writes_on_def tst_def var_def lib_value_def)\n      apply(simp add: lib_lastWr_def lib_writes_on_def tst_def var_def lib_value_def)\n      apply(simp add: lib_lastWr_def lib_writes_on_def tst_def var_def lib_value_def)\n  apply(simp add: lib_read_def all_updates_l lib_d_obs_def lib_d_obs_t_def lib_writes_on_def lib_lastWr_def lib_syncing_def lib_value_def tst_def var_def)\n  done\n\n\n\nlemma successful_CAS_lib_c_obs_lib_only_intro:\n  assumes \"wfs cs\"\n  and \"lib_wfs ls cs\" \n  and \"\\<not>[lib(x) \\<approx>\\<^sub>t' u] ls\"\n  and \"[lib(y) =\\<^sub>t v] ls\"\n  and \"ls cs CAS\\<^sup>R[lib(x), True, l, u]\\<^sub>t ls' cs'\"\n  and \"t \\<noteq> t'\"\n  and \"x \\<noteq> y\"\nshows \"[lib(x) = u]\\<lparr>lib(y) =\\<^sub>t' v\\<rparr> ls'\"\n  using assms\n  apply(simp add: lib_c_obs_lib_only_def lib_visible_writes_def)\n  apply(simp add: lib_CAS_Rel_step_def, elim exE conjE, case_tac \"lib_value ls (a, b) = l\", simp_all)\n  apply(simp add: lib_update_r_def all_updates_l)\n  apply(intro allI impI conjI)\n  apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def)\n  apply safe\n        apply (metis fst_conv) \n       apply (metis fst_conv)\n  apply(simp add: lib_writes_on_def lib_value_def lib_releasing_def)\n  apply(simp add: lib_writes_on_def lib_value_def lib_releasing_def)\n    using a_is_x apply blast\n  apply(simp add: lib_writes_on_def lib_value_def lib_releasing_def lib_d_obs_def lib_lastWr_def tst_def var_def)\n      apply safe\n    using a_is_x apply blast\n    using a_is_x apply blast\n  apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def )\n    apply blast\n   apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def )\n   apply blast\n   apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def )\n   apply blast\n   apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def )\n   apply blast\n    apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def )\n    apply(simp add: lib_writes_on_def lib_value_def lib_releasing_def) \n    apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def )\n  by blast\n\n\n\nlemma successful_CAS_lib_c_obs_lib_diff_value_pres:\n  assumes \"wfs cs\"\n  and \"lib_wfs ls cs\" \n  and  \"[lib(x) = u]\\<lparr>lib(y) =\\<^sub>t' v\\<rparr> ls\"\n  and \"ls cs CAS\\<^sup>R[lib(x), True, l, k]\\<^sub>t ls' cs'\"\n  and \"k \\<noteq> u\"\n  and \"t \\<noteq> t'\"\n  and \"x \\<noteq> y\"\nshows \"[lib(x) = u]\\<lparr>lib(y) =\\<^sub>t' v\\<rparr> ls'\"\n  using assms\n  apply(simp add: lib_c_obs_lib_only_def lib_visible_writes_def)\n  apply(simp add: lib_CAS_Rel_step_def, elim exE conjE, case_tac \"lib_value ls (a, b) = l\", simp_all)\n  apply(simp add: lib_update_r_def all_updates_l)\n  apply(intro allI impI conjI)\n  apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def)\n    apply safe\n  apply(simp add: lib_writes_on_def lib_value_def lib_releasing_def)\n  apply(simp add: lib_writes_on_def lib_value_def lib_releasing_def)\n    using a_is_x apply blast\n  apply(simp add: lib_writes_on_def lib_value_def lib_releasing_def lib_d_obs_def lib_lastWr_def tst_def var_def)\n      apply safe\n    using a_is_x apply blast\n    using a_is_x apply blast\n  apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def)\n    apply (metis fst_conv)\n        apply (smt Collect_cong fst_conv)\n   apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def )\n    apply (metis fst_conv)\n    apply(simp add: lib_d_obs_def lib_d_obs_t_def lib_p_obs_def lib_writes_on_def lib_lastWr_def lib_value_def tst_def var_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def)\n    apply (smt Collect_cong fst_conv)\n    apply (metis CAS_Rel_preserves_releasing_new CAS_Rel_preserves_releasing_same_var CAS_Rel_preserves_value_old assms(4))\n    by (metis CAS_Rel_preserves_releasing_new CAS_Rel_preserves_releasing_same_var CAS_Rel_preserves_value_old assms(4))\n\n\n\nlemma successful_CAS_lib_c_obs_lib_pre_same_value_pres:\n  assumes \"wfs cs\"\n  and \"lib_wfs ls cs\" \n  and \"[lib(x) = u]\\<lparr>lib(y) =\\<^sub>t' v\\<rparr> ls\"\n  and \"[lib(y) =\\<^sub>t v] ls\"\n  and \"ls cs CAS\\<^sup>R[lib(x), True, l, u]\\<^sub>t ls' cs'\"\n  and \"t \\<noteq> t'\"\n  and \"x \\<noteq> y\"\nshows \"[lib(x) = u]\\<lparr>lib(y) =\\<^sub>t' v\\<rparr> ls'\"\n  using assms\n  apply(simp add: lib_c_obs_lib_only_def lib_d_obs_t_def lib_visible_writes_def)\n  apply(subgoal_tac \"tst (lib_thrView ls' t' x) = tst (lib_thrView ls t' x)\") defer\n   apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply(case_tac \"lib_value ls (a, b) = l\", simp_all)\n  apply(simp add: lib_wfs_def lib_releasing_def lib_visible_writes_def var_def tst_def lib_valid_fresh_ts_def lib_update_r_def all_updates_l lib_writes_on_def lib_d_obs_def lib_value_def lib_lastWr_def)\n   apply(intro  allI impI)\n   apply(case_tac \"(a, b) \\<in> lib_writes_on ls x\")\n   apply(subgoal_tac \"lib_value ls' (a, b) = lib_value ls (a, b) \\<and> lib_modView ls' (a, b) LVARS = lib_modView ls (a, b) LVARS\")\n  apply(intro conjI)\n  apply (smt last_CAS_R_diff_var lib_d_obs_def succ_CAS_preserves_last)\n  using CAS_Rel_preserves_releasing_same_var apply auto[1]\n  apply(intro conjI)\n  using CAS_Rel_preserves_value_old apply blast\n   apply(simp add: lib_CAS_Rel_step_def, elim exE conjE, case_tac \"lib_value ls (aa, ba) = l\", simp_all)\n  apply(simp add: lib_update_r_def all_updates_l)\n  using fresh_ts_not_in_writes lib_writes_on_def apply blast\n   apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n   apply(case_tac \"lib_value ls (aa, ba) = l\", simp_all)\n  apply(simp add:  lib_releasing_def lib_visible_writes_def var_def tst_def lib_valid_fresh_ts_def lib_update_r_def all_updates_l lib_writes_on_def lib_d_obs_def lib_value_def lib_lastWr_def)\n  apply clarsimp\n  apply(subgoal_tac \"{w. fst w = y \\<and>\n                       (w = (x, ts') \\<or>\n                        w \\<in> lib_writes ls)} = {w. fst w = y \\<and>\n                       (w \\<in> lib_writes ls)}\", simp)\n    by auto\n\n\nlemma \"(x, b) \\<in> lib_visible_writes cls t x \\<Longrightarrow> (x, c) \\<in> lib_visible_writes cls t x \\<Longrightarrow>\n     cvd[libx, m] cls \\<Longrightarrow> (x, b) \\<notin> lib_covered cls \\<Longrightarrow> (x, c) \\<notin> lib_covered cls \\<Longrightarrow> b = c\"\n  apply(simp add:lib_wfs_def lib_update_r_def all_updates_l lib_lastWr_def lib_value_def lib_visible_writes_def  lib_covered_v_def )\n  by blast\n\n\nlemma visible_writes_singleton:\n  assumes \"lib_wfs cls ccs \"\n          and \"cvd[libx, m] cls\"\n          and \"(a, b) \\<in> lib_visible_writes cls t x \"\n          and \"(a, b) \\<notin> lib_covered cls \"\n          and \"lib_valid_fresh_ts cls (a, b) ts' \"\n          and \"cls' =fst (lib_update_r t (a, b) u cls ccs ts')\"\n        shows \"lib_visible_writes cls' t x = {(x, ts')}\"\n  using assms\n  apply(subgoal_tac \"b = Max (snd`lib_writes_on cls x)\")\n  defer\n  apply(simp add:lib_wfs_def lib_update_r_def all_updates_l lib_lastWr_def lib_value_def   lib_covered_v_def )\n    apply(simp add: lib_writes_on_def tst_def var_def lib_valid_fresh_ts_def lib_visible_writes_def)\n  apply auto[1]\n  apply(subgoal_tac \"a = x\") defer\n  using a_is_x apply blast\n  apply simp\n\n  apply(simp add: lib_visible_writes_def)\n  apply(subgoal_tac \"tst (lib_thrView (fst (lib_update_r t (x, Max (snd ` lib_writes_on cls x)) u cls ccs ts')) t x) = ts'\")\n  defer\n  apply(simp add: lib_update_r_def all_updates_l lib_lastWr_def lib_value_def   lib_covered_v_def )\n  apply simp\n  apply(subgoal_tac \"lib_writes_on\n           (fst (lib_update_r t (x, Max (snd ` lib_writes_on cls x)) u cls ccs ts')) x = \nlib_writes_on cls x \\<union> {(x,ts')}\") defer\n  apply(simp add: lib_writes_on_def lib_update_r_def all_updates_l lib_lastWr_def lib_value_def   lib_covered_v_def )\n  using Collect_cong var_def apply auto[1]\n  apply simp\n  apply(subgoal_tac \"ts' > Max (snd`lib_writes_on cls x)\")\n  defer\n  using assms(3) ts'_gt_max_writes_on apply blast\n  apply(subgoal_tac \"  {w. (w \\<in> lib_writes_on cls x) \\<and> ts' \\<le> tst w} = {}\")\n   apply auto[1]\n  apply(subgoal_tac \"\\<forall> w . w\\<in>lib_writes_on cls x \\<longrightarrow> tst w < ts'\")\n   apply force\n  apply(intro allI impI)\n  apply(subgoal_tac \"tst w \\<le> Max (snd ` lib_writes_on cls x)\")\n  using dual_order.strict_trans2 apply blast\n  apply (simp add: tst_def lib_wfs_def)\n  done\n\n\n\nlemma lib_d_obs_same_t_c_obs:  \"lib_wfs cls ccs \\<Longrightarrow> x\\<noteq>y \\<Longrightarrow> [lib(y) =\\<^sub>t v] cls \\<Longrightarrow> cvd[libx, m] cls \\<Longrightarrow> cls ccs CAS\\<^sup>R[libx, True, m, u]\\<^sub>t cls' ccs' \\<Longrightarrow>[libx = u]\\<lparr>liby =\\<^sub>t v \\<rparr> cls'\"\n apply(simp add:  lib_d_obs_def lib_d_obs_t_def lib_c_obs_lib_only_def )\n  apply(simp add: lib_CAS_Rel_step_def, elim exE conjE)\n  apply(case_tac \"lib_value cls (a, b) = m\", simp_all)\n  apply(subgoal_tac \"a = x\",simp)\n  apply(subgoal_tac \"lib_visible_writes (fst (lib_update_r t (a, b) u cls ccs ts')) t x = {(x,ts')}\") defer\n  using visible_writes_singleton  \n  apply blast\n   apply (simp add: a_is_x)\n  apply simp\n  apply(intro conjI impI)\n  apply(simp add: lib_wfs_def lib_update_r_def all_updates_l lib_writes_on_def lib_value_def lib_lastWr_def\n        var_def tst_def lib_visible_writes_def lib_valid_fresh_ts_def )\n    apply (metis old.prod.inject prod.collapse)\n  apply(simp add: lib_wfs_def lib_update_r_def all_updates_l lib_writes_on_def lib_value_def lib_lastWr_def\n        var_def tst_def lib_visible_writes_def lib_valid_fresh_ts_def )\n  apply (smt Collect_cong fst_conv)\n  apply(simp add: lib_wfs_def lib_update_r_def all_updates_l lib_writes_on_def lib_value_def lib_lastWr_def\n        var_def tst_def lib_visible_writes_def lib_valid_fresh_ts_def lib_releasing_def)\n  done\n\n\n\nlemma successful_CAS_lib_c_obs_lib_diff_value_press:\n  assumes \"wfs cs\"\n  and \"lib_wfs ls cs\" \n  and  \"[lib(x) = u]\\<lparr>lib(y) =\\<^sub>t v\\<rparr> ls\"\n  and \"ls cs CAS\\<^sup>R[lib(x), True, l, k]\\<^sub>t ls' cs'\"\n  and \"k \\<noteq> u\"\n  and \"x \\<noteq> y\"\nshows \"[lib(x) = u]\\<lparr>lib(y) =\\<^sub>t v\\<rparr> ls'\"\n  using assms\n  apply(simp add: lib_CAS_Rel_step_def lib_c_obs_lib_only_def, elim exE conjE)\n  apply(case_tac \"lib_value ls (a, b) = l\", simp_all)\n  apply(simp add: lib_update_r_def all_updates_l lib_d_obs_def)\n  apply safe\n  using a_is_x apply blast\n  using a_is_x apply blast\n  using a_is_x apply blast\n  using a_is_x apply blast\n  using a_is_x apply blast\n  using a_is_x apply blast\n  using a_is_x apply blast\n  using a_is_x apply blast\n  using a_is_x apply blast\n  apply(simp_all add: lib_valid_fresh_ts_def lib_lastWr_def lib_writes_on_def lib_value_def tst_def var_def lib_visible_writes_def)\n  apply (smt Collect_cong dual_order.trans fst_conv leD linear)\n   apply (smt Collect_cong dual_order.trans fst_conv leD linear)\n  apply(simp add: lib_releasing_def)\n  by auto\n\nend", "meta": {"author": "MSemenyuk", "repo": "PhD_Isabelle", "sha": "179f5d346a721b15940a271323e3487f4ea51338", "save_path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle", "path": "github-repos/isabelle/MSemenyuk-PhD_Isabelle/PhD_Isabelle-179f5d346a721b15940a271323e3487f4ea51338/Treiber Stack C11/Lib_GeneralProofRules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.3062035138101244}}
{"text": "theory IO_Experiments imports IO_out2_STIT             (*Paul Meder, 2018*)\nbegin\n(* Xin Paper - Example proof theory *)\nconsts e::e f::e\n(* G = (a \\<or> b, [a1 cstit e]) *)     (* [a1 cstit (e \\<or> f)] \\<in> out1(G, {a2 cstit b } *)\nlemma \"out1 (\\<lambda>X. X=(a \\<^bold>\\<or> b, (a1 cstit e))) (a2 cstit b) (a1 cstit (e \\<^bold>\\<or> f))\" nitpick[user_axioms,show_all] oops\n\n(* [a1 cstit (e \\<or> f)] \\<in> out2(G, {a2 cstit b } *) (* [a1 cstit (e \\<or> f)] \\<in> Cn(G(L))  *)\n(* old version - times out *)\nlemma \" out2 (\\<lambda>X. X=(a \\<^bold>\\<or> b, (a1 cstit e))) (a1 cstit (e \\<^bold>\\<or> f)) \" oops\n(* new version - finds proof *)\nlemma \"\\<lfloor>(a1 cstit e)\\<^bold>\\<supset>(a1 cstit (e \\<^bold>\\<or> f)) \\<rfloor>\" \n  using kcstit_def kimp_def kor_def kvalid_def by auto\n\n(* Modal logic part *)\nlemma \"\\<lfloor> (((a \\<^bold>\\<or> b) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit e)) \\<^bold>\\<and> (a2 cstit b)) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit (e \\<^bold>\\<or> f)) \\<rfloor>\" \n  by (simp add: ax_refl_a2 k45box_def kand_def kcstit_def kimp_def kor_def kvalid_def)\n\n(* together *)\nlemma \"\\<lfloor> (((a \\<^bold>\\<or> b) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit e)) \\<^bold>\\<and> (a2 cstit b)) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit (e \\<^bold>\\<or> f)) \\<rfloor> \\<and>\n       \\<lfloor>(a1 cstit e)\\<^bold>\\<supset>(a1 cstit (e \\<^bold>\\<or> f)) \\<rfloor> \" unfolding Defs \n  using ax_refl_a2 by blast\n\n(* Xin Paper - Ross Paradox *)\n(* We have that [a1 dstit (e \\<or> f)] not in out2({(\\<top>, [a1 dstit e])}, {\\<top>}) *)\nlemma \"out1 (\\<lambda>X. X=(\\<^bold>\\<top>, (a1 dstit e))) \\<^bold>\\<top>  (a1 dstit (e \\<^bold>\\<or> f))\" nitpick[user_axioms,show_all] oops\n(* We have that [a1 dstit (e \\<or> f)] not in out2({(\\<top>, [a1 dstit e])}, {\\<top>}) *)\nlemma \"\\<lfloor> (\\<^bold>\\<top> \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 dstit e)) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 dstit (e \\<^bold>\\<or> f))  \\<rfloor>\"\n  nitpick[user_axioms,show_all] oops\n\n(* With Chellas's STIT, the paradax is not solved *)\nlemma \"out1 (\\<lambda>X. X=(\\<^bold>\\<top>, (a1 cstit e))) \\<^bold>\\<top>  (a1 cstit (e \\<^bold>\\<or> f))\" nitpick[user_axioms,show_all] oops\nlemma \"\\<lfloor> (\\<^bold>\\<top> \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit e)) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit (e \\<^bold>\\<or> f))  \\<rfloor> \"\n  by (simp add: k45box_def kcstit_def kimp_def kor_def ktrue_def kvalid_def)\n\n(* out2 *)\n(* G = {(a,[a1 cstit e]), (a,[a2 cstit f]),(b,e \\<and> f)} *)\n(* [a1 cstit e] \\<in> out2(G,a) *)\nlemma  \"\\<lfloor> ((a \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit e)) \\<^bold>\\<and> (a \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit f))\\<^bold>\\<and>(b \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(e\\<^bold>\\<and>f)) \\<^bold>\\<and> (a)) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit (e)) \\<rfloor> \\<and>\n       \\<lfloor>((a1 cstit e) \\<^bold>\\<and> (a1 cstit f) \\<^bold>\\<and> (e \\<^bold>\\<and> f))\\<^bold>\\<supset>(a1 cstit (e)) \\<rfloor> \"  unfolding Defs by simp\n(*  e \\<in> out2(G,a) *)\nlemma  \"\\<lfloor> ((a \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit e)) \\<^bold>\\<and> (a \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit f))\\<^bold>\\<and>(b \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(e\\<^bold>\\<and>f)) \\<^bold>\\<and> (a)) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(e) \\<rfloor> \\<and>\n       \\<lfloor>((a1 cstit e) \\<^bold>\\<and> (a1 cstit f) \\<^bold>\\<and> (e \\<^bold>\\<and> f))\\<^bold>\\<supset>e \\<rfloor> \"  unfolding Defs \n  by (simp add: ax_refl_a1)\n(*  (e\\<and>f) \\<in> out2(G,a) *)\nlemma \"\\<lfloor> ((a \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit e)) \\<^bold>\\<and> (a \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit f)) \\<^bold>\\<and>(b \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(e\\<^bold>\\<and>f)) \\<^bold>\\<and> (a)) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(e\\<^bold>\\<and>f)\\<rfloor> \\<and>\n       \\<lfloor>((a1 cstit e) \\<^bold>\\<and> (a1 cstit f) \\<^bold>\\<and> (e \\<^bold>\\<and> f))\\<^bold>\\<supset>(e\\<^bold>\\<and>f)\\<rfloor>\" unfolding Defs\n  by (simp add: ax_refl_a1) \n\nlemma \"\\<lfloor> ((a \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit e)) \\<^bold>\\<and> (a \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit f)) \\<^bold>\\<and>(b \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(e\\<^bold>\\<and>f)) \\<^bold>\\<and> (a1 cstit b)) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(e\\<^bold>\\<and>f)\\<rfloor> \\<and>\n       \\<lfloor>((a1 cstit e) \\<^bold>\\<and> (a1 cstit f) \\<^bold>\\<and> (e \\<^bold>\\<and> f))\\<^bold>\\<supset>(e\\<^bold>\\<and>f)\\<rfloor>\" \n  using ax_refl_a1 kand_def kcstit_def kimp_def kvalid_def by auto\n\n(* Moral Luck example *)\nconsts Drunk::e Drive::e DriveCarefully::e Jump::e Kill::e Hurt::e Stay::e\n(* \\<diamond>(a1 cstit DriveCarefully) \\<in> out2(N,A) *)\nlemma \"\\<lfloor> ((\\<^bold>\\<top> \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(\\<^bold>\\<not>Kill \\<^bold>\\<and> \\<^bold>\\<not>Hurt)) \\<^bold>\\<and> (\\<^bold>\\<top>  \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(\\<^bold>\\<box>DriveCarefully))\n           \\<^bold>\\<and> (\\<^bold>\\<not>\\<^bold>\\<diamond>(a1 cstit DriveCarefully) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit Stay)) \n           \\<^bold>\\<and> (Drunk \\<^bold>\\<and> (a1 cstit Drive) \\<^bold>\\<and> (Jump) \\<^bold>\\<and> (Drunk \\<^bold>\\<supset>\\<^bold>\\<not>\\<^bold>\\<diamond>(a1 cstit DriveCarefully)\n           \\<^bold>\\<and> (\\<^bold>\\<not>\\<^bold>\\<diamond>(a1 cstit DriveCarefully) \\<^bold>\\<and> Jump \\<^bold>\\<and> (a1 cstit Drive)\\<^bold>\\<supset>(Kill \\<^bold>\\<or> Hurt)))\n          )) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(\\<^bold>\\<diamond>(a1 cstit DriveCarefully))\\<rfloor>  \" \n  by (smt axC1_a1 ax_refl_rbox k45box_def kand_def kbox_def\n      kcstit_def kdia_def kimp_def knot_def ktrue_def kvalid_def)\n(*(a1 cstit Stay) \\<in> out2(N,A) *)\nlemma \"\\<lfloor> ((\\<^bold>\\<top> \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(\\<^bold>\\<not>Kill \\<^bold>\\<and> \\<^bold>\\<not>Hurt)) \\<^bold>\\<and> (\\<^bold>\\<top>  \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(\\<^bold>\\<box>DriveCarefully))\n           \\<^bold>\\<and> (\\<^bold>\\<not>\\<^bold>\\<diamond>(a1 cstit DriveCarefully) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit Stay)) \n           \\<^bold>\\<and> (Drunk \\<^bold>\\<and> (a1 cstit Drive) \\<^bold>\\<and> (Jump) \\<^bold>\\<and> (Drunk \\<^bold>\\<supset>\\<^bold>\\<not>\\<^bold>\\<diamond>(a1 cstit DriveCarefully)\n           \\<^bold>\\<and> (\\<^bold>\\<not>\\<^bold>\\<diamond>(a1 cstit DriveCarefully) \\<^bold>\\<and> Jump \\<^bold>\\<and> (a1 cstit Drive)\\<^bold>\\<supset>(Kill \\<^bold>\\<or> Hurt)))\n         )) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit Stay)\\<rfloor>\"\n  by (simp add: kand_def kimp_def kvalid_def)\n(*(\\<not>Kill \\<^bold>\\<and> \\<^bold>\\<not>Hurt) \\<in> out2(N,A) *)\nlemma \"\\<lfloor> ((\\<^bold>\\<top> \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(\\<^bold>\\<not>Kill \\<^bold>\\<and> \\<^bold>\\<not>Hurt)) \\<^bold>\\<and> (\\<^bold>\\<top>  \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(\\<^bold>\\<box>DriveCarefully))\n           \\<^bold>\\<and> (\\<^bold>\\<not>\\<^bold>\\<diamond>(a1 cstit DriveCarefully) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(a1 cstit Stay)) \n           \\<^bold>\\<and> (Drunk \\<^bold>\\<and> (a1 cstit Drive) \\<^bold>\\<and> (Jump) \\<^bold>\\<and> (Drunk \\<^bold>\\<supset>\\<^bold>\\<not>\\<^bold>\\<diamond>(a1 cstit DriveCarefully)\n           \\<^bold>\\<and> (\\<^bold>\\<not>\\<^bold>\\<diamond>(a1 cstit DriveCarefully) \\<^bold>\\<and> Jump \\<^bold>\\<and> (a1 cstit Drive)\\<^bold>\\<supset>(Kill \\<^bold>\\<or> Hurt)))\n         )) \\<^bold>\\<supset> \\<^bold>\\<box>\\<^sub>l(\\<^bold>\\<not>Kill \\<^bold>\\<and> \\<^bold>\\<not>Hurt)\\<rfloor>\" \n  by (simp add: kand_def kimp_def ktrue_def kvalid_def)\nend\n\n", "meta": {"author": "cbenzmueller", "repo": "LogiKEy", "sha": "5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf", "save_path": "github-repos/isabelle/cbenzmueller-LogiKEy", "path": "github-repos/isabelle/cbenzmueller-LogiKEy/LogiKEy-5c16bdeb68bf8131e24ba9c8d774d4af663cb2cf/2020-DataInBrief-Data/IO_Experiments.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6584175005616829, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.3060993306308653}}
{"text": "theory Linked_queue\nimports \"../l4v/tools/autocorres/AutoCorres\"\n        \"../l4v/tools/autocorres/DataStructures\"\nbegin\n\ninstall_C_file linked_queue.c\nautocorres[ts_rules = nondet, heap_abs_syntax] linked_queue.c\n\ncontext linked_queue begin\n\nsublocale linked_list next_C NULL\ndone\n\ndefinition\n  lkup :: \"lifted_globals \\<Rightarrow> node_C ptr \\<Rightarrow> node_C option\"\nwhere\n  \"lkup s p = (if is_valid_node_C s p then Some s[p] else None)\"\n\n(* Lifted version of DataStructures.linked_list.list_non_NULL *)\nlemma list_lkup_non_NULL:\n  \"p \\<noteq> NULL \\<Longrightarrow>\n    list (lkup s) xs p = (\\<exists>ys. xs = p#ys \\<and> is_valid_node_C s p \\<and> list (lkup s) ys s[p]\\<rightarrow>next)\"\nby (simp add: lkup_def list_non_NULL linked_queue.get_node_next_def)\n\ndefinition\n  queue :: \"lifted_globals \\<Rightarrow> node_C ptr list \\<Rightarrow> bool\"\nwhere\n  \"queue s xs \\<equiv> (front_'' s = NULL \\<and> back_'' s = NULL \\<and> xs = []) \\<or>\n                 (list (lkup s) xs (front_'' s) \\<and> back_'' s = last xs \\<and> xs \\<noteq> [])\"\n\nlemma front_ign_w8[simp]:\n  \"front_'' s[x := (v::8 word)] = front_'' s\"\nby (simp add: linked_queue.update_w8_def)\n\nlemma back_ign_w8[simp]:\n  \"back_'' s[x := (v::8 word)] = back_'' s\"\nby (simp add: linked_queue.update_w8_def)\n\nlemma front_ign_next[simp]:\n  \"front_'' s[x\\<rightarrow>next := v] = front_'' s\"\nby (simp add: linked_queue.update_node_next_def)\n\nlemma element_ign_front[simp]:\n  \"(s\\<lparr>front_'' := f\\<rparr>)[p]\\<rightarrow>element = s[p]\\<rightarrow>element\"\nby (simp add: linked_queue.get_node_element_def)\n\nlemma element_ign_back[simp]:\n  \"(s\\<lparr>back_'' := b\\<rparr>)[p]\\<rightarrow>element = s[p]\\<rightarrow>element\"\nby (simp add: linked_queue.get_node_element_def)\n\nlemma lkup_ign_front[simp]:\n  \"lkup (s\\<lparr>front_'' := f\\<rparr>) = lkup s\"\nby (auto simp: lkup_def)\n\nlemma lkup_ign_back[simp]:\n  \"lkup (s\\<lparr>back_'' := b\\<rparr>) = lkup s\"\nby (auto simp: lkup_def)\n\nlemma lkup_ignore_w8[simp]:\n  \"lkup s[x := (v::8 word)] = lkup s\"\nby (auto simp: lkup_def)\n\nlemma dequeue_correct:\n  \"(\\<And>s f. P (s\\<lparr>front_'' := f\\<rparr>) = P s) \\<Longrightarrow>\n   (\\<And>s b. P (s\\<lparr>back_'' := b\\<rparr>) = P s) \\<Longrightarrow>\n   (\\<And>s v. P (s[x := v]) = P s) \\<Longrightarrow>\n   \\<lbrace> \\<lambda>s. queue s xs \\<and> xs \\<noteq> [] \\<and> is_valid_w8 s x \\<and> P s \\<rbrace>\n   dequeue' x\n   \\<lbrace> \\<lambda>r s. r > 0 \\<and> queue s (tl xs) \\<and> s[x] = s[hd xs]\\<rightarrow>element \\<and> P s \\<rbrace>!\"\napply (unfold dequeue'_def)\napply wp\napply (fastforce simp: queue_def list_lkup_non_NULL)\ndone\n\nlemma dequeue_correct':\n  \"\\<lbrace> \\<lambda>s. queue s [] \\<and> P s \\<rbrace>\n   dequeue' x\n   \\<lbrace> \\<lambda>r s. r = 0 \\<and> P s \\<rbrace>!\"\napply (unfold dequeue'_def)\napply wp\napply (simp add: queue_def)\ndone\n\nlemma list_no_null[simp]:\n  \"\\<lbrakk> list s xs p \\<rbrakk> \\<Longrightarrow> NULL \\<notin> set xs\"\nby (induct xs arbitrary: p, auto)\n\nlemma list_lkup_in_valid:\n  \"\\<lbrakk> list (lkup s) xs p; x \\<in> set xs \\<rbrakk> \\<Longrightarrow> is_valid_node_C s x\"\nby (auto simp: lkup_def split: if_splits dest!: list_in_Some)\n\nlemma path_lkup_ign_next[simp]:\n  \"x \\<notin> set xs \\<Longrightarrow> path (lkup s[x\\<rightarrow>next := v]) p xs q = path (lkup s) p xs q\"\nby (induct xs arbitrary: p, auto simp: lkup_def linked_queue.update_node_next_def)\n\nlemma path_lkup_update_last:\n  \"\\<lbrakk> path (lkup s) p xs q; xs \\<noteq> []; distinct xs \\<rbrakk> \\<Longrightarrow>\n      path (lkup s[last xs\\<rightarrow>next := q']) p xs q'\"\napply (induct xs arbitrary: p)\napply (auto simp: lkup_def linked_queue.update_node_next_def split: if_splits)\ndone\n\nlemma list_lkup_extend:\n  \"\\<lbrakk> is_valid_node_C s x; x \\<noteq> NULL; x \\<notin> set xs; list (lkup s) xs p; xs \\<noteq> [] \\<rbrakk> \\<Longrightarrow>\n     list (lkup s[last xs\\<rightarrow>next := x][x\\<rightarrow>next := NULL]) (xs @ [x]) p\"\napply (frule list_distinct)\napply (simp add: path_null_list[symmetric] path_lkup_update_last)\napply (simp add: lkup_def linked_queue.update_node_next_def)\ndone\n\ndeclare list_split[simp del]\n\nlemma enqueue_correct:\n  \"(\\<And>s f. P (s\\<lparr>front_'' := f\\<rparr>) = P s) \\<Longrightarrow>\n   (\\<And>s b. P (s\\<lparr>back_'' := b\\<rparr>) = P s) \\<Longrightarrow>\n   (\\<And>s n. P (s[back_'' s\\<rightarrow>next := n]) = P s) \\<Longrightarrow>\n   (\\<And>s v. P (s[x\\<rightarrow>next := v]) = P s) \\<Longrightarrow>\n   \\<lbrace> \\<lambda>s. queue s xs \\<and> is_valid_node_C s x \\<and> x \\<noteq> NULL \\<and> x \\<notin> set xs \\<and> P s \\<rbrace>\n   enqueue' x\n   \\<lbrace> \\<lambda>r s. queue s (xs @ [x]) \\<and> P s \\<rbrace>!\"\napply (unfold enqueue'_def)\napply wp\napply (clarsimp simp: queue_def)\napply safe\n   apply (fastforce simp: lkup_def linked_queue.update_node_next_def)\n  apply (drule list_no_null, simp)\n apply (simp add: list_lkup_extend)\napply (simp add: list_lkup_in_valid)\ndone\n\nend\nend", "meta": {"author": "smaccm", "repo": "autocorres-experiments", "sha": "9d27f34ae62e50eb43fb1bceab866c2c5500e3bc", "save_path": "github-repos/isabelle/smaccm-autocorres-experiments", "path": "github-repos/isabelle/smaccm-autocorres-experiments/autocorres-experiments-9d27f34ae62e50eb43fb1bceab866c2c5500e3bc/linked_queue/Linked_queue.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370308082623217, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.30607972062967004}}
{"text": "theory flash36Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_FAck ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_InvVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Inv  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_InvAck_1VsInv36:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_InvAck_1_HomeVsInv36:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_InvAck_2VsInv36:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_GetXVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak1VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak2VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_Nak3VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX1VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv36:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX10VsInv36:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX10_homeVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX11VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_GetVsInv36:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak1VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak2VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Nak3VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put1VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put2VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_Put3VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_PutVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Local_PutXAcksDoneVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Local_PutXAcksDone ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_NakVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Nak  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Nak_ClearVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Nak_Clear ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Nak_HomeVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Nak_Home ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Remote_GetX_NakVsInv36:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_Nak_HomeVsInv36:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Remote_GetX_PutXVsInv36:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_GetX ))    ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv36:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Remote_Get_Nak2VsInv36:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put1VsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv36:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Remote_Put  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                     have allCases:\"formEval  ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true ))  s  \\<or>formEval   (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true )) )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true ))  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n\n    moreover\n                       {assume c1:\"formEval  (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true )) )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately have \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutXVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_ReplaceVsInv36:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_ReplaceHomeVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_ReplaceHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_ReplaceHomeShrVldVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_ReplaceHomeShrVld ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_ReplaceShrVldVsInv36:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_ShWbVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_ShWb N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_WbVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (NI_Wb ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_GetX1VsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Local_GetX_GetX1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_GetX2VsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Local_GetX_GetX2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX1VsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX2VsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX3VsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Local_GetX_PutX3 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX4VsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Local_GetX_PutX4 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_Get_GetVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Local_Get_Get ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_Get_PutVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Local_Get_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_PutXVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Local_PutX ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_ReplaceVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Local_Replace ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Remote_GetVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Remote_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_GetXVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Remote_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_PutXVsInv36:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_ReplaceVsInv36:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (PI_Remote_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma StoreVsInv36:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (Store  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma StoreHomeVsInv36:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv36  iInv1 ) (StoreHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash36Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.30607971400774253}}
{"text": "section \\<open> Deadlock Freedom Preconditions \\<close>\n\ntheory ITree_DFP\n  imports ITree_Hoare\nbegin\n\ndefinition dfp :: \"('e, 's, 'r) ktree \\<Rightarrow> ('s \\<Rightarrow> bool)\" \n  where \"dfp P = (\\<lambda> s. deadlock_free (P s))\"\n\nexpr_constructor dfp\n\nlemma dfp_Stop [wp]: \"dfp Stop = (False)\\<^sub>e\"\n  by (simp add: dfp_def deadlock_free_deadlock SEXP_def)\n\nlemma dfp_Skip [wp]: \"dfp Skip = (True)\\<^sub>e\"\n  by (simp add: dfp_def Skip_def deadlock_free_Ret SEXP_def)\n\nlemma dfp_assigns [wp]: \"dfp \\<langle>\\<sigma>\\<rangle>\\<^sub>a = (True)\\<^sub>e\"\n  by (simp add: dfp_def assigns_def deadlock_free_Ret SEXP_def)\n\nlemma dfp_seq [wp]: \"dfp (P ;; Q) = (dfp P \\<and> wlp P (dfp Q))\\<^sub>e\"\n  by (simp add: dfp_def seq_itree_def kleisli_comp_def deadlock_free_bind_iff wlp_itree_def \n                SEXP_def retvals_def itree_rel_def itree_pred_def)\n\nlemma dfp_event_choice [wp]: \"dfp (event_choice F) = (pdom(F) \\<noteq> {} \\<and> (\\<forall> e\\<in>pdom(F). dfp(F(\\<guillemotleft>e\\<guillemotright>)\\<^sub>p)\\<^sub>e))\\<^sub>e\"\n  by (simp add: dfp_def event_choice_def deadlock_free_Vis SEXP_def)\n\nlemma dfp_event_block [wp]: \"wb_prism c \\<Longrightarrow> dfp (event_block c A P\\<sigma>) = [\\<lambda> s. \\<exists> v\\<in>A s. fst (P\\<sigma> v) s]\\<^sub>e\"\n  by (simp add: dfp_def event_block_def deadlock_free_Vis_prism_fun SEXP_def) \n\nlemma deadlock_free_init_loop:\n  assumes \"\\<sigma> establishes P\" \"C preserves P\" \"`P \\<longrightarrow> dfp C`\"\n  shows \"deadlock_free ((\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; loop C) s)\"\n  using assms\n  apply (simp add: seq_itree_def kleisli_comp_def deadlock_free_bind_iff assigns_def dfp_def taut_def hoare_alt_def)\n  apply (rule deadlock_free_loop[of P])\n    apply (auto simp add: retvals_def)\n  done\n\nend", "meta": {"author": "isabelle-utp", "repo": "interaction-trees", "sha": "90510d119364f534d2ab61daf2f274060f0a040e", "save_path": "github-repos/isabelle/isabelle-utp-interaction-trees", "path": "github-repos/isabelle/isabelle-utp-interaction-trees/interaction-trees-90510d119364f534d2ab61daf2f274060f0a040e/UTP/ITree_DFP.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.30607971400774253}}
{"text": "theory Convert_Monoid_SST_Def\n  imports Main \"../Core/Update\" \"../Core/SST\" \"../Core/Monoid_SST\" \"../Single_Use/Single_Use\" \"../Decomposition/Decompose_Update\" \"../Decomposition/Shuffle\"\nbegin\n\n\nsubsection \\<open>Definition of another strange Transducer\\<close>\n\ndefinition update2homU ::\n  \"('x \\<Rightarrow> ('y, 'z + 'b) update) \\<Rightarrow> \n   ('x + ('y, 'b) update) \\<Rightarrow>\n   ('y, 'z + 'b) update\"where\n  \"update2homU \\<phi> = fold_sum \\<phi> (map_alpha inr_list)\"\n\ndefinition hat_homU ::\n  \"('x \\<Rightarrow> ('y, 'z + 'b) update) \\<Rightarrow> \n   ('x + ('y, 'b) update) list \\<Rightarrow>\n   ('y, 'z + 'b) update\" where\n  \"hat_homU \\<phi> = concatU o map (update2homU \\<phi>)\"\n\n\n\nlemma [simp]: \"hat_homU \\<phi> (Inl x # u) = \\<phi> x \\<bullet> hat_homU \\<phi> u\"\n  by (simp add: hat_homU_def update2homU_def)\n\nlemma [simp]: \"hat_homU \\<phi> (Inr m # u) = inr_list \\<star> m \\<bullet> hat_homU \\<phi> u\"\n  by (simp add: hat_homU_def update2homU_def)\n\nlemma hat_homU_append: \"hat_homU \\<phi> (u @ v) = hat_homU \\<phi> u \\<bullet> hat_homU \\<phi> v\"\n  by (simp add: hat_homU_def concatU_append)\n\n\nfun Rep_alpha :: \"'k::enum boundedness \\<Rightarrow> ('x \\<Rightarrow> ('k, 'y::enum) bc_shuffle) \\<Rightarrow> ('x \\<Rightarrow> 'y shuffle)\" where\n  \"Rep_alpha B \\<beta> x = Rep_bc_shuffle (\\<beta> x)\"\n\nfun Abs_alpha :: \"'k::enum boundedness \\<Rightarrow> ('x \\<Rightarrow> 'y shuffle ) \\<Rightarrow> ('x \\<Rightarrow> ('k, 'y::enum) bc_shuffle)\" where\n  \"Abs_alpha B \\<alpha> x = Abs_bc_shuffle (\\<alpha> x)\"\n\n\nlemma Abs_alpha_inverse:\n  assumes \"boundedness (B :: 'k::enum boundedness) k\"\n  assumes \"\\<forall>x. bounded_shuffle k (\\<alpha> x)\"\n  shows \"Rep_alpha B (Abs_alpha B \\<alpha>) = \\<alpha>\"\n  using assms by (auto simp add: Abs_bc_shuffle_inverse boundedness_def)  \n\nlemma Rep_alpha_inverse:\n  shows \"Abs_alpha B (Rep_alpha B \\<beta>) = \\<beta>\"\n  by (auto simp add: Rep_bc_shuffle_inverse)\n\nlemma Rep_alpha:\n  fixes B :: \"'k::enum boundedness\"\n  shows \"\\<And>x. bounded_shuffle (length (Enum.enum :: 'k list)) (Rep_alpha B \\<beta> x)\"\n  using Rep_bc_shuffle\n  by simp\n\nfun embed_single :: \"'x \\<Rightarrow> 'y \\<Rightarrow> ('x \\<times> 'y + 'b)\" where\n  \"embed_single x y = Inl (x, y)\"\n\nfun embed :: \"'x \\<Rightarrow> 'y \\<Rightarrow> ('x \\<times> 'y + 'b) list\" where\n  \"embed x y = [embed_single x y]\"\n\ndefinition \\<iota> :: \"'k::enum boundedness \\<Rightarrow> ('x \\<Rightarrow> 'y::enum shuffle) \\<Rightarrow> 'x \n              \\<Rightarrow> ('y, 'x \\<times> ('y, 'k) index + 'b) update\" where\n  \"\\<iota> B \\<alpha> x = \\<pi>\\<inverse> B (\\<alpha> x, embed x)\"\n\n\ndefinition \\<Delta>' :: \"'k::enum boundedness \\<Rightarrow> ('x \\<Rightarrow> ('k, 'y::enum) bc_shuffle, ('x, ('y, 'b) update) update) trans\" where\n  \"\\<Delta>' B = (\\<lambda>(\\<beta>, \\<theta>). Abs_alpha B (\\<lambda>x. \\<pi>\\<^sub>1 (hat_homU (\\<iota> B (Rep_alpha B \\<beta>)) (\\<theta> x))))\"\n\n\ndefinition H' :: \"'k::enum boundedness \\<Rightarrow> ('x \\<Rightarrow> ('k, 'y::enum) bc_shuffle) \\<times> ('x, ('y, 'b) update) update \\<Rightarrow> ('x \\<times> ('y, 'k) index, 'b) update\" where\n  \"H' B = (\\<lambda>(\\<beta>, \\<theta>). \\<lambda>(x, y'). \\<pi>\\<^sub>2 B (hat_homU (\\<iota> B (Rep_alpha B \\<beta>)) (\\<theta> x)) y')\"\n\nlemma H'_simp2: \"H' B (\\<beta>, \\<theta>) (x, y') = \\<pi>\\<^sub>2 B (hat_homU (\\<iota> B (Rep_alpha B \\<beta>)) (\\<theta> x)) y'\"\n  by (simp add: H'_def)\n\n\n\nsubsection \\<open>Construction\\<close>\n\ndefinition \\<alpha>0 :: \"'x \\<Rightarrow> 'y shuffle\" where\n  \"\\<alpha>0 x = idS\"\n\n\ndefinition convert_\\<delta> :: \"'i::enum boundedness \\<Rightarrow> ('q, 'x, 'y::enum, 'a, 'b) MSST \\<Rightarrow> ('q \\<times> ('x \\<Rightarrow> ('i, 'y) bc_shuffle), 'a) trans\" where\n  \"convert_\\<delta> B msst =\n     (\\<lambda>((q1, \\<beta>), a). (delta msst (q1, a), \\<Delta>' B (\\<beta>, eta msst (q1, a))))\"\n\ndefinition convert_\\<eta> :: \"'i::enum boundedness \\<Rightarrow> ('q, 'x, 'y::enum, 'a, 'b) MSST \\<Rightarrow>\n                         ('q \\<times> ('x \\<Rightarrow> ('i, 'y) bc_shuffle), 'x \\<times> ('y, 'i) index, 'a, 'b) updator\" where\n  \"convert_\\<eta> B msst = (\\<lambda>((q, \\<beta>), b). H' B (\\<beta>, eta msst (q, b)))\"\n\ndefinition convert_final :: \"'i::enum boundedness \\<Rightarrow> ('q, 'x, 'y::enum, 'a, 'b) MSST \\<Rightarrow>\n   ('q \\<times> ('x \\<Rightarrow> ('i, 'y) bc_shuffle) \\<Rightarrow> ('x \\<times> ('y, 'i) index + 'b) list option)\" where\n  \"convert_final B msst = (\\<lambda>(q, \\<beta>).\n     (case final msst q of\n        Some u \\<Rightarrow> (case final_string msst q of\n          Some v \\<Rightarrow> Some ((valuate o ((hat_homU (\\<iota> B (Rep_alpha B \\<beta>)) u \\<bullet> inr_list \\<star> (\\<lambda>x. v)))) ()) |\n          None \\<Rightarrow> None) |\n        None \\<Rightarrow> None))\"\n\nlemma convert_\\<delta>_simp: \"convert_\\<delta> B msst ((q1, \\<beta>), a) = (delta msst (q1, a), \\<Delta>' B (\\<beta>, eta msst (q1, a)))\"\n  by (simp add: convert_\\<delta>_def)\n\nlemma convert_\\<eta>_simp: \"convert_\\<eta> B msst ((q1, \\<beta>), a) = H' B (\\<beta>, eta msst (q1, a))\"\n  by (simp add: convert_\\<eta>_def)\n\ndefinition convert_MSST :: \"'i::enum boundedness \\<Rightarrow> ('q, 'x, 'y::enum, 'a, 'b) MSST \\<Rightarrow>\n                            ('q \\<times> ('x \\<Rightarrow> ('i, 'y) bc_shuffle), 'x \\<times> ('y, 'i) index, 'a, 'b) SST\" where\n  \"convert_MSST B msst = \\<lparr>\n    initial = (initial msst, Abs_alpha B \\<alpha>0),\n    delta       = convert_\\<delta> B msst,\n    eta         = convert_\\<eta> B msst,\n    final       = convert_final B msst\n  \\<rparr>\"\n\nlemma initial_convert_MSST_simp: \"initial (convert_MSST B msst) = (initial msst, Abs_alpha B \\<alpha>0)\"\n  unfolding convert_MSST_def by simp\n\nlemma delta_convert_MSST_simp: \"delta (convert_MSST B msst) = convert_\\<delta> B msst\"\n  unfolding convert_MSST_def by simp\n\nlemma eta_convert_MSST_simp: \"eta (convert_MSST B msst) = convert_\\<eta> B msst\"\n  unfolding convert_MSST_def by simp\n\nlemma final_convert_MSST_simp: \"final (convert_MSST B msst) = convert_final B msst\"\n  unfolding convert_MSST_def by simp\n\n\n\nlemma convert_\\<delta>_state:\n  assumes \"(q', \\<beta>') = delta_hat (convert_MSST B msst) ((q, \\<beta>), w)\"\n  shows \"q' = delta_hat msst (q, w)\"\nusing assms proof (induct w arbitrary: q \\<beta>)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a w)\n  then show ?case by (simp add: convert_MSST_def convert_\\<delta>_simp)\nqed\n\n\nlemma reachable_convert:\n  assumes \"reachable (convert_MSST B msst) (q, \\<beta>)\"\n  shows \"reachable msst q\"\nproof -\n  obtain w where w: \"(q, \\<beta>) = delta_hat (convert_MSST B msst) (initial (convert_MSST B msst), w)\"\n    using assms unfolding reachable_def by auto\n  have \"q = delta_hat msst (initial msst, w)\"\n    apply (rule convert_\\<delta>_state)\n    using w unfolding convert_MSST_def\n    by simp\n  then show ?thesis\n    unfolding reachable_def by auto\nqed\n\nlemma Abs_alpha_inverse_\\<alpha>0[simp]:\n  fixes B :: \"'k::enum boundedness\"\n  shows \"Rep_alpha B (Abs_alpha B \\<alpha>0 :: 'x \\<Rightarrow> ('k, 'y::enum) bc_shuffle) = \\<alpha>0\"\nproof (rule Abs_alpha_inverse)\n  show \"boundedness B (length (Enum.enum :: 'k list))\"\n    unfolding boundedness_def by simp\nnext\n  show \"\\<forall>x. bounded_shuffle (length (Enum.enum :: 'k list)) (\\<alpha>0 x :: 'y shuffle)\"\n    unfolding \\<alpha>0_def apply simp\n    by (rule idS_bounded_enum)\nqed\n\nend\n", "meta": {"author": "akamah", "repo": "sst-isabelle", "sha": "e1b84bb2a51b1723542f4f919b581cc39ab14bcc", "save_path": "github-repos/isabelle/akamah-sst-isabelle", "path": "github-repos/isabelle/akamah-sst-isabelle/sst-isabelle-e1b84bb2a51b1723542f4f919b581cc39ab14bcc/Composition/Convert_Monoid_SST_Def.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.3060797140077425}}
{"text": "(*  Title:      HOL/UNITY/Comp/Alloc.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1998  University of Cambridge\n\nSpecification of Chandy and Charpentier's Allocator\n*)\n\ntheory Alloc\nimports AllocBase \"../PPROD\"\nbegin\n\nsubsection\\<open>State definitions.  OUTPUT variables are locals\\<close>\n\nrecord clientState =\n  giv :: \"nat list\"   \\<comment> \\<open>client's INPUT history:  tokens GRANTED\\<close>\n  ask :: \"nat list\"   \\<comment> \\<open>client's OUTPUT history: tokens REQUESTED\\<close>\n  rel :: \"nat list\"   \\<comment> \\<open>client's OUTPUT history: tokens RELEASED\\<close>\n\nrecord 'a clientState_d =\n  clientState +\n  dummy :: 'a       \\<comment> \\<open>dummy field for new variables\\<close>\n\ndefinition\n  \\<comment> \\<open>DUPLICATED FROM Client.thy, but with \"tok\" removed\\<close>\n  \\<comment> \\<open>Maybe want a special theory section to declare such maps\\<close>\n  non_dummy :: \"'a clientState_d => clientState\"\n  where \"non_dummy s = (|giv = giv s, ask = ask s, rel = rel s|)\"\n\ndefinition\n  \\<comment> \\<open>Renaming map to put a Client into the standard form\\<close>\n  client_map :: \"'a clientState_d => clientState*'a\"\n  where \"client_map = funPair non_dummy dummy\"\n\n\nrecord allocState =\n  allocGiv :: \"nat => nat list\"   \\<comment> \\<open>OUTPUT history: source of \"giv\" for i\\<close>\n  allocAsk :: \"nat => nat list\"   \\<comment> \\<open>INPUT: allocator's copy of \"ask\" for i\\<close>\n  allocRel :: \"nat => nat list\"   \\<comment> \\<open>INPUT: allocator's copy of \"rel\" for i\\<close>\n\nrecord 'a allocState_d =\n  allocState +\n  dummy    :: 'a                \\<comment> \\<open>dummy field for new variables\\<close>\n\nrecord 'a systemState =\n  allocState +\n  client :: \"nat => clientState\"  \\<comment> \\<open>states of all clients\\<close>\n  dummy  :: 'a                    \\<comment> \\<open>dummy field for new variables\\<close>\n\n\nsubsubsection \\<open>Resource allocation system specification\\<close>\n\ndefinition\n  \\<comment> \\<open>spec (1)\\<close>\n  system_safety :: \"'a systemState program set\"\n  where \"system_safety =\n     Always {s. (\\<Sum>i \\<in> lessThan Nclients. (tokens o giv o sub i o client)s)\n     \\<le> NbT + (\\<Sum>i \\<in> lessThan Nclients. (tokens o rel o sub i o client)s)}\"\n\ndefinition\n  \\<comment> \\<open>spec (2)\\<close>\n  system_progress :: \"'a systemState program set\"\n  where \"system_progress = (INT i : lessThan Nclients.\n                        INT h.\n                          {s. h \\<le> (ask o sub i o client)s} LeadsTo\n                          {s. h pfixLe (giv o sub i o client) s})\"\n\ndefinition\n  system_spec :: \"'a systemState program set\"\n  where \"system_spec = system_safety Int system_progress\"\n\n\nsubsubsection \\<open>Client specification (required)\\<close>\n\ndefinition\n  \\<comment> \\<open>spec (3)\\<close>\n  client_increasing :: \"'a clientState_d program set\"\n  where \"client_increasing = UNIV guarantees  Increasing ask Int Increasing rel\"\n\ndefinition\n  \\<comment> \\<open>spec (4)\\<close>\n  client_bounded :: \"'a clientState_d program set\"\n  where \"client_bounded = UNIV guarantees  Always {s. \\<forall>elt \\<in> set (ask s). elt \\<le> NbT}\"\n\ndefinition\n  \\<comment> \\<open>spec (5)\\<close>\n  client_progress :: \"'a clientState_d program set\"\n  where \"client_progress =\n         Increasing giv  guarantees\n         (INT h. {s. h \\<le> giv s & h pfixGe ask s}\n                 LeadsTo {s. tokens h \\<le> (tokens o rel) s})\"\n\ndefinition\n  \\<comment> \\<open>spec: preserves part\\<close>\n  client_preserves :: \"'a clientState_d program set\"\n  where \"client_preserves = preserves giv Int preserves clientState_d.dummy\"\n\ndefinition\n  \\<comment> \\<open>environmental constraints\\<close>\n  client_allowed_acts :: \"'a clientState_d program set\"\n  where \"client_allowed_acts =\n       {F. AllowedActs F =\n            insert Id (\\<Union> (Acts ` preserves (funPair rel ask)))}\"\n\ndefinition\n  client_spec :: \"'a clientState_d program set\"\n  where \"client_spec = client_increasing Int client_bounded Int client_progress\n                    Int client_allowed_acts Int client_preserves\"\n\n\nsubsubsection \\<open>Allocator specification (required)\\<close>\n\ndefinition\n  \\<comment> \\<open>spec (6)\\<close>\n  alloc_increasing :: \"'a allocState_d program set\"\n  where \"alloc_increasing =\n         UNIV  guarantees\n         (INT i : lessThan Nclients. Increasing (sub i o allocGiv))\"\n\ndefinition\n  \\<comment> \\<open>spec (7)\\<close>\n  alloc_safety :: \"'a allocState_d program set\"\n  where \"alloc_safety =\n         (INT i : lessThan Nclients. Increasing (sub i o allocRel))\n         guarantees\n         Always {s. (\\<Sum>i \\<in> lessThan Nclients. (tokens o sub i o allocGiv)s)\n         \\<le> NbT + (\\<Sum>i \\<in> lessThan Nclients. (tokens o sub i o allocRel)s)}\"\n\ndefinition\n  \\<comment> \\<open>spec (8)\\<close>\n  alloc_progress :: \"'a allocState_d program set\"\n  where \"alloc_progress =\n         (INT i : lessThan Nclients. Increasing (sub i o allocAsk) Int\n                                     Increasing (sub i o allocRel))\n         Int\n         Always {s. \\<forall>i<Nclients.\n                     \\<forall>elt \\<in> set ((sub i o allocAsk) s). elt \\<le> NbT}\n         Int\n         (INT i : lessThan Nclients.\n          INT h. {s. h \\<le> (sub i o allocGiv)s & h pfixGe (sub i o allocAsk)s}\n                 LeadsTo\n                 {s. tokens h \\<le> (tokens o sub i o allocRel)s})\n         guarantees\n             (INT i : lessThan Nclients.\n              INT h. {s. h \\<le> (sub i o allocAsk) s}\n                     LeadsTo\n                     {s. h pfixLe (sub i o allocGiv) s})\"\n\n  (*NOTE: to follow the original paper, the formula above should have had\n        INT h. {s. h i \\<le> (sub i o allocGiv)s & h i pfixGe (sub i o allocAsk)s}\n               LeadsTo\n               {s. tokens h i \\<le> (tokens o sub i o allocRel)s})\n    thus h should have been a function variable.  However, only h i is ever\n    looked at.*)\n\ndefinition\n  \\<comment> \\<open>spec: preserves part\\<close>\n  alloc_preserves :: \"'a allocState_d program set\"\n  where \"alloc_preserves = preserves allocRel Int preserves allocAsk Int\n                        preserves allocState_d.dummy\"\n\ndefinition\n  \\<comment> \\<open>environmental constraints\\<close>\n  alloc_allowed_acts :: \"'a allocState_d program set\"\n  where \"alloc_allowed_acts =\n       {F. AllowedActs F =\n            insert Id (\\<Union>(Acts ` (preserves allocGiv)))}\"\n\ndefinition\n  alloc_spec :: \"'a allocState_d program set\"\n  where \"alloc_spec = alloc_increasing Int alloc_safety Int alloc_progress Int\n                   alloc_allowed_acts Int alloc_preserves\"\n\n\nsubsubsection \\<open>Network specification\\<close>\n\ndefinition\n  \\<comment> \\<open>spec (9.1)\\<close>\n  network_ask :: \"'a systemState program set\"\n  where \"network_ask = (INT i : lessThan Nclients.\n                        Increasing (ask o sub i o client)  guarantees\n                        ((sub i o allocAsk) Fols (ask o sub i o client)))\"\n\ndefinition\n  \\<comment> \\<open>spec (9.2)\\<close>\n  network_giv :: \"'a systemState program set\"\n  where \"network_giv = (INT i : lessThan Nclients.\n                        Increasing (sub i o allocGiv)\n                        guarantees\n                        ((giv o sub i o client) Fols (sub i o allocGiv)))\"\n\ndefinition\n  \\<comment> \\<open>spec (9.3)\\<close>\n  network_rel :: \"'a systemState program set\"\n  where \"network_rel = (INT i : lessThan Nclients.\n                        Increasing (rel o sub i o client)\n                        guarantees\n                        ((sub i o allocRel) Fols (rel o sub i o client)))\"\n\ndefinition\n  \\<comment> \\<open>spec: preserves part\\<close>\n  network_preserves :: \"'a systemState program set\"\n  where \"network_preserves =\n       preserves allocGiv  Int\n       (INT i : lessThan Nclients. preserves (rel o sub i o client)  Int\n                                   preserves (ask o sub i o client))\"\n\ndefinition\n  \\<comment> \\<open>environmental constraints\\<close>\n  network_allowed_acts :: \"'a systemState program set\"\n  where \"network_allowed_acts =\n       {F. AllowedActs F = insert Id\n         (\\<Union> (Acts ` (preserves allocRel \\<inter> (\\<Inter>i<Nclients.\n           preserves (giv \\<circ> sub i \\<circ> client)))))}\"\n\ndefinition\n  network_spec :: \"'a systemState program set\"\n  where \"network_spec = network_ask Int network_giv Int\n                     network_rel Int network_allowed_acts Int\n                     network_preserves\"\n\n\nsubsubsection \\<open>State mappings\\<close>\n\ndefinition\n  sysOfAlloc :: \"((nat => clientState) * 'a) allocState_d => 'a systemState\"\n  where \"sysOfAlloc = (%s. let (cl,xtr) = allocState_d.dummy s\n                       in (| allocGiv = allocGiv s,\n                             allocAsk = allocAsk s,\n                             allocRel = allocRel s,\n                             client   = cl,\n                             dummy    = xtr|))\"\n\n\ndefinition\n  sysOfClient :: \"(nat => clientState) * 'a allocState_d => 'a systemState\"\n  where \"sysOfClient = (%(cl,al). (| allocGiv = allocGiv al,\n                                 allocAsk = allocAsk al,\n                                 allocRel = allocRel al,\n                                 client   = cl,\n                                 systemState.dummy = allocState_d.dummy al|))\"\n\naxiomatization Alloc :: \"'a allocState_d program\"\n  where Alloc: \"Alloc \\<in> alloc_spec\"\n\naxiomatization Client :: \"'a clientState_d program\"\n  where Client: \"Client \\<in> client_spec\"\n\naxiomatization Network :: \"'a systemState program\"\n  where Network: \"Network \\<in> network_spec\"\n\ndefinition System  :: \"'a systemState program\"\n  where \"System = rename sysOfAlloc Alloc \\<squnion> Network \\<squnion>\n                 (rename sysOfClient\n                  (plam x: lessThan Nclients. rename client_map Client))\"\n\n\n(**\nlocale System =\n  fixes\n    Alloc   :: 'a allocState_d program\n    Client  :: 'a clientState_d program\n    Network :: 'a systemState program\n    System  :: 'a systemState program\n\n  assumes\n    Alloc   \"Alloc   : alloc_spec\"\n    Client  \"Client  : client_spec\"\n    Network \"Network : network_spec\"\n\n  defines\n    System_def\n      \"System == rename sysOfAlloc Alloc\n                 \\<squnion>\n                 Network\n                 \\<squnion>\n                 (rename sysOfClient\n                  (plam x: lessThan Nclients. rename client_map Client))\"\n**)\n\ndeclare subset_preserves_o [THEN [2] rev_subsetD, intro]\ndeclare subset_preserves_o [THEN [2] rev_subsetD, simp]\ndeclare funPair_o_distrib [simp]\ndeclare Always_INT_distrib [simp]\ndeclare o_apply [simp del]\n\n(*For rewriting of specifications related by \"guarantees\"*)\nlemmas [simp] =\n  rename_image_constrains\n  rename_image_stable\n  rename_image_increasing\n  rename_image_invariant\n  rename_image_Constrains\n  rename_image_Stable\n  rename_image_Increasing\n  rename_image_Always\n  rename_image_leadsTo\n  rename_image_LeadsTo\n  rename_preserves\n  rename_image_preserves\n  lift_image_preserves\n  bij_image_INT\n  bij_is_inj [THEN image_Int]\n  bij_image_Collect_eq\n\nML \\<open>\n(*Splits up conjunctions & intersections: like CONJUNCTS in the HOL system*)\nfun list_of_Int th =\n    (list_of_Int (th RS conjunct1) @ list_of_Int (th RS conjunct2))\n    handle THM _ => (list_of_Int (th RS IntD1) @ list_of_Int (th RS IntD2))\n    handle THM _ => (list_of_Int (th RS @{thm INT_D}))\n    handle THM _ => (list_of_Int (th RS bspec))\n    handle THM _ => [th];\n\\<close>\n\nlemmas lessThanBspec = lessThan_iff [THEN iffD2, THEN [2] bspec]\n\nattribute_setup normalized = \\<open>\nlet\n  fun normalized th =\n    normalized (th RS spec\n      handle THM _ => th RS @{thm lessThanBspec}\n      handle THM _ => th RS bspec\n      handle THM _ => th RS (@{thm guarantees_INT_right_iff} RS iffD1))\n    handle THM _ => th;\nin\n  Scan.succeed (Thm.rule_attribute [] (K normalized))\nend\n\\<close>\n\n(*** bijectivity of sysOfAlloc [MUST BE AUTOMATED] ***)\nML \\<open>\nfun record_auto_tac ctxt =\n  let val ctxt' =\n    ctxt addSWrapper Record.split_wrapper\n    addsimps\n       [@{thm sysOfAlloc_def}, @{thm sysOfClient_def},\n        @{thm client_map_def}, @{thm non_dummy_def}, @{thm funPair_def},\n        @{thm o_apply}, @{thm Let_def}]\n  in auto_tac ctxt' end;\n\n\\<close>\n\nmethod_setup record_auto = \\<open>Scan.succeed (SIMPLE_METHOD o record_auto_tac)\\<close>\n\nlemma inj_sysOfAlloc [iff]: \"inj sysOfAlloc\"\n  apply (unfold sysOfAlloc_def Let_def)\n  apply (rule inj_onI)\n  apply record_auto\n  done\n\ntext\\<open>We need the inverse; also having it simplifies the proof of surjectivity\\<close>\nlemma inv_sysOfAlloc_eq [simp]: \"!!s. inv sysOfAlloc s =\n             (| allocGiv = allocGiv s,\n                allocAsk = allocAsk s,\n                allocRel = allocRel s,\n                allocState_d.dummy = (client s, dummy s) |)\"\n  apply (rule inj_sysOfAlloc [THEN inv_f_eq])\n  apply record_auto\n  done\n\nlemma surj_sysOfAlloc [iff]: \"surj sysOfAlloc\"\n  apply (simp add: surj_iff_all)\n  apply record_auto\n  done\n\nlemma bij_sysOfAlloc [iff]: \"bij sysOfAlloc\"\n  apply (blast intro: bijI)\n  done\n\n\nsubsubsection\\<open>bijectivity of \\<^term>\\<open>sysOfClient\\<close>\\<close>\n\nlemma inj_sysOfClient [iff]: \"inj sysOfClient\"\n  apply (unfold sysOfClient_def)\n  apply (rule inj_onI)\n  apply record_auto\n  done\n\nlemma inv_sysOfClient_eq [simp]: \"!!s. inv sysOfClient s =\n             (client s,\n              (| allocGiv = allocGiv s,\n                 allocAsk = allocAsk s,\n                 allocRel = allocRel s,\n                 allocState_d.dummy = systemState.dummy s|) )\"\n  apply (rule inj_sysOfClient [THEN inv_f_eq])\n  apply record_auto\n  done\n\nlemma surj_sysOfClient [iff]: \"surj sysOfClient\"\n  apply (simp add: surj_iff_all)\n  apply record_auto\n  done\n\nlemma bij_sysOfClient [iff]: \"bij sysOfClient\"\n  apply (blast intro: bijI)\n  done\n\n\nsubsubsection\\<open>bijectivity of \\<^term>\\<open>client_map\\<close>\\<close>\n\nlemma inj_client_map [iff]: \"inj client_map\"\n  apply (unfold inj_on_def)\n  apply record_auto\n  done\n\nlemma inv_client_map_eq [simp]: \"!!s. inv client_map s =\n             (%(x,y).(|giv = giv x, ask = ask x, rel = rel x,\n                       clientState_d.dummy = y|)) s\"\n  apply (rule inj_client_map [THEN inv_f_eq])\n  apply record_auto\n  done\n\nlemma surj_client_map [iff]: \"surj client_map\"\n  apply (simp add: surj_iff_all)\n  apply record_auto\n  done\n\nlemma bij_client_map [iff]: \"bij client_map\"\n  apply (blast intro: bijI)\n  done\n\n\ntext\\<open>o-simprules for \\<^term>\\<open>client_map\\<close>\\<close>\n\nlemma fst_o_client_map: \"fst o client_map = non_dummy\"\n  apply (unfold client_map_def)\n  apply (rule fst_o_funPair)\n  done\n\nML \\<open>ML_Thms.bind_thms (\"fst_o_client_map'\", make_o_equivs \\<^context> @{thm fst_o_client_map})\\<close>\ndeclare fst_o_client_map' [simp]\n\nlemma snd_o_client_map: \"snd o client_map = clientState_d.dummy\"\n  apply (unfold client_map_def)\n  apply (rule snd_o_funPair)\n  done\n\nML \\<open>ML_Thms.bind_thms (\"snd_o_client_map'\", make_o_equivs \\<^context> @{thm snd_o_client_map})\\<close>\ndeclare snd_o_client_map' [simp]\n\n\nsubsection\\<open>o-simprules for \\<^term>\\<open>sysOfAlloc\\<close> [MUST BE AUTOMATED]\\<close>\n\nlemma client_o_sysOfAlloc: \"client o sysOfAlloc = fst o allocState_d.dummy \"\n  apply record_auto\n  done\n\nML \\<open>ML_Thms.bind_thms (\"client_o_sysOfAlloc'\", make_o_equivs \\<^context> @{thm client_o_sysOfAlloc})\\<close>\ndeclare client_o_sysOfAlloc' [simp]\n\nlemma allocGiv_o_sysOfAlloc_eq: \"allocGiv o sysOfAlloc = allocGiv\"\n  apply record_auto\n  done\n\nML \\<open>ML_Thms.bind_thms (\"allocGiv_o_sysOfAlloc_eq'\", make_o_equivs \\<^context> @{thm allocGiv_o_sysOfAlloc_eq})\\<close>\ndeclare allocGiv_o_sysOfAlloc_eq' [simp]\n\nlemma allocAsk_o_sysOfAlloc_eq: \"allocAsk o sysOfAlloc = allocAsk\"\n  apply record_auto\n  done\n\nML \\<open>ML_Thms.bind_thms (\"allocAsk_o_sysOfAlloc_eq'\", make_o_equivs \\<^context> @{thm allocAsk_o_sysOfAlloc_eq})\\<close>\ndeclare allocAsk_o_sysOfAlloc_eq' [simp]\n\nlemma allocRel_o_sysOfAlloc_eq: \"allocRel o sysOfAlloc = allocRel\"\n  apply record_auto\n  done\n\nML \\<open>ML_Thms.bind_thms (\"allocRel_o_sysOfAlloc_eq'\", make_o_equivs \\<^context> @{thm allocRel_o_sysOfAlloc_eq})\\<close>\ndeclare allocRel_o_sysOfAlloc_eq' [simp]\n\n\nsubsection\\<open>o-simprules for \\<^term>\\<open>sysOfClient\\<close> [MUST BE AUTOMATED]\\<close>\n\nlemma client_o_sysOfClient: \"client o sysOfClient = fst\"\n  apply record_auto\n  done\n\nML \\<open>ML_Thms.bind_thms (\"client_o_sysOfClient'\", make_o_equivs \\<^context> @{thm client_o_sysOfClient})\\<close>\ndeclare client_o_sysOfClient' [simp]\n\nlemma allocGiv_o_sysOfClient_eq: \"allocGiv o sysOfClient = allocGiv o snd \"\n  apply record_auto\n  done\n\nML \\<open>ML_Thms.bind_thms (\"allocGiv_o_sysOfClient_eq'\", make_o_equivs \\<^context> @{thm allocGiv_o_sysOfClient_eq})\\<close>\ndeclare allocGiv_o_sysOfClient_eq' [simp]\n\nlemma allocAsk_o_sysOfClient_eq: \"allocAsk o sysOfClient = allocAsk o snd \"\n  apply record_auto\n  done\n\nML \\<open>ML_Thms.bind_thms (\"allocAsk_o_sysOfClient_eq'\", make_o_equivs \\<^context> @{thm allocAsk_o_sysOfClient_eq})\\<close>\ndeclare allocAsk_o_sysOfClient_eq' [simp]\n\nlemma allocRel_o_sysOfClient_eq: \"allocRel o sysOfClient = allocRel o snd \"\n  apply record_auto\n  done\n\nML \\<open>ML_Thms.bind_thms (\"allocRel_o_sysOfClient_eq'\", make_o_equivs \\<^context> @{thm allocRel_o_sysOfClient_eq})\\<close>\ndeclare allocRel_o_sysOfClient_eq' [simp]\n\nlemma allocGiv_o_inv_sysOfAlloc_eq: \"allocGiv o inv sysOfAlloc = allocGiv\"\n  apply (simp add: o_def)\n  done\n\nML \\<open>ML_Thms.bind_thms (\"allocGiv_o_inv_sysOfAlloc_eq'\", make_o_equivs \\<^context> @{thm allocGiv_o_inv_sysOfAlloc_eq})\\<close>\ndeclare allocGiv_o_inv_sysOfAlloc_eq' [simp]\n\nlemma allocAsk_o_inv_sysOfAlloc_eq: \"allocAsk o inv sysOfAlloc = allocAsk\"\n  apply (simp add: o_def)\n  done\n\nML \\<open>ML_Thms.bind_thms (\"allocAsk_o_inv_sysOfAlloc_eq'\", make_o_equivs \\<^context> @{thm allocAsk_o_inv_sysOfAlloc_eq})\\<close>\ndeclare allocAsk_o_inv_sysOfAlloc_eq' [simp]\n\nlemma allocRel_o_inv_sysOfAlloc_eq: \"allocRel o inv sysOfAlloc = allocRel\"\n  apply (simp add: o_def)\n  done\n\nML \\<open>ML_Thms.bind_thms (\"allocRel_o_inv_sysOfAlloc_eq'\", make_o_equivs \\<^context> @{thm allocRel_o_inv_sysOfAlloc_eq})\\<close>\ndeclare allocRel_o_inv_sysOfAlloc_eq' [simp]\n\nlemma rel_inv_client_map_drop_map: \"(rel o inv client_map o drop_map i o inv sysOfClient) =\n      rel o sub i o client\"\n  apply (simp add: o_def drop_map_def)\n  done\n\nML \\<open>ML_Thms.bind_thms (\"rel_inv_client_map_drop_map'\", make_o_equivs \\<^context> @{thm rel_inv_client_map_drop_map})\\<close>\ndeclare rel_inv_client_map_drop_map [simp]\n\nlemma ask_inv_client_map_drop_map: \"(ask o inv client_map o drop_map i o inv sysOfClient) =\n      ask o sub i o client\"\n  apply (simp add: o_def drop_map_def)\n  done\n\nML \\<open>ML_Thms.bind_thms (\"ask_inv_client_map_drop_map'\", make_o_equivs \\<^context> @{thm ask_inv_client_map_drop_map})\\<close>\ndeclare ask_inv_client_map_drop_map [simp]\n\n\ntext\\<open>Client : <unfolded specification>\\<close>\nlemmas client_spec_simps =\n  client_spec_def client_increasing_def client_bounded_def\n  client_progress_def client_allowed_acts_def client_preserves_def\n  guarantees_Int_right\n\nML \\<open>\nval [Client_Increasing_ask, Client_Increasing_rel,\n     Client_Bounded, Client_Progress, Client_AllowedActs,\n     Client_preserves_giv, Client_preserves_dummy] =\n        @{thm Client} |> simplify (\\<^context> addsimps @{thms client_spec_simps})\n               |> list_of_Int;\n\nML_Thms.bind_thm (\"Client_Increasing_ask\", Client_Increasing_ask);\nML_Thms.bind_thm (\"Client_Increasing_rel\", Client_Increasing_rel);\nML_Thms.bind_thm (\"Client_Bounded\", Client_Bounded);\nML_Thms.bind_thm (\"Client_Progress\", Client_Progress);\nML_Thms.bind_thm (\"Client_AllowedActs\", Client_AllowedActs);\nML_Thms.bind_thm (\"Client_preserves_giv\", Client_preserves_giv);\nML_Thms.bind_thm (\"Client_preserves_dummy\", Client_preserves_dummy);\n\\<close>\n\ndeclare\n  Client_Increasing_ask [iff]\n  Client_Increasing_rel [iff]\n  Client_Bounded [iff]\n  Client_preserves_giv [iff]\n  Client_preserves_dummy [iff]\n\n\ntext\\<open>Network : <unfolded specification>\\<close>\nlemmas network_spec_simps =\n  network_spec_def network_ask_def network_giv_def\n  network_rel_def network_allowed_acts_def network_preserves_def\n  ball_conj_distrib\n\nML \\<open>\nval [Network_Ask, Network_Giv, Network_Rel, Network_AllowedActs,\n     Network_preserves_allocGiv, Network_preserves_rel,\n     Network_preserves_ask]  =\n        @{thm Network} |> simplify (\\<^context> addsimps @{thms network_spec_simps})\n                |> list_of_Int;\n\nML_Thms.bind_thm (\"Network_Ask\", Network_Ask);\nML_Thms.bind_thm (\"Network_Giv\", Network_Giv);\nML_Thms.bind_thm (\"Network_Rel\", Network_Rel);\nML_Thms.bind_thm (\"Network_AllowedActs\", Network_AllowedActs);\nML_Thms.bind_thm (\"Network_preserves_allocGiv\", Network_preserves_allocGiv);\nML_Thms.bind_thm (\"Network_preserves_rel\", Network_preserves_rel);\nML_Thms.bind_thm (\"Network_preserves_ask\", Network_preserves_ask);\n\\<close>\n\ndeclare Network_preserves_allocGiv [iff]\n\ndeclare\n  Network_preserves_rel [simp]\n  Network_preserves_ask [simp]\n\ndeclare\n  Network_preserves_rel [simplified o_def, simp]\n  Network_preserves_ask [simplified o_def, simp]\n\ntext\\<open>Alloc : <unfolded specification>\\<close>\nlemmas alloc_spec_simps =\n  alloc_spec_def alloc_increasing_def alloc_safety_def\n  alloc_progress_def alloc_allowed_acts_def alloc_preserves_def\n\nML \\<open>\nval [Alloc_Increasing_0, Alloc_Safety, Alloc_Progress, Alloc_AllowedActs,\n     Alloc_preserves_allocRel, Alloc_preserves_allocAsk,\n     Alloc_preserves_dummy] =\n        @{thm Alloc} |> simplify (\\<^context> addsimps @{thms alloc_spec_simps})\n              |> list_of_Int;\n\nML_Thms.bind_thm (\"Alloc_Increasing_0\", Alloc_Increasing_0);\nML_Thms.bind_thm (\"Alloc_Safety\", Alloc_Safety);\nML_Thms.bind_thm (\"Alloc_Progress\", Alloc_Progress);\nML_Thms.bind_thm (\"Alloc_AllowedActs\", Alloc_AllowedActs);\nML_Thms.bind_thm (\"Alloc_preserves_allocRel\", Alloc_preserves_allocRel);\nML_Thms.bind_thm (\"Alloc_preserves_allocAsk\", Alloc_preserves_allocAsk);\nML_Thms.bind_thm (\"Alloc_preserves_dummy\", Alloc_preserves_dummy);\n\\<close>\n\ntext\\<open>Strip off the INT in the guarantees postcondition\\<close>\n\nlemmas Alloc_Increasing = Alloc_Increasing_0 [normalized]\n\ndeclare\n  Alloc_preserves_allocRel [iff]\n  Alloc_preserves_allocAsk [iff]\n  Alloc_preserves_dummy [iff]\n\n\nsubsection\\<open>Components Lemmas [MUST BE AUTOMATED]\\<close>\n\nlemma Network_component_System: \"Network \\<squnion>\n      ((rename sysOfClient\n        (plam x: (lessThan Nclients). rename client_map Client)) \\<squnion>\n       rename sysOfAlloc Alloc)\n      = System\"\n  by (simp add: System_def Join_ac)\n\nlemma Client_component_System: \"(rename sysOfClient\n       (plam x: (lessThan Nclients). rename client_map Client)) \\<squnion>\n      (Network \\<squnion> rename sysOfAlloc Alloc)  =  System\"\n  by (simp add: System_def Join_ac)\n\nlemma Alloc_component_System: \"rename sysOfAlloc Alloc \\<squnion>\n       ((rename sysOfClient (plam x: (lessThan Nclients). rename client_map Client)) \\<squnion>\n        Network)  =  System\"\n  by (simp add: System_def Join_ac)\n\ndeclare\n  Client_component_System [iff]\n  Network_component_System [iff]\n  Alloc_component_System [iff]\n\n\ntext\\<open>* These preservation laws should be generated automatically *\\<close>\n\nlemma Client_Allowed [simp]: \"Allowed Client = preserves rel Int preserves ask\"\n  by (auto simp add: Allowed_def Client_AllowedActs safety_prop_Acts_iff)\n\nlemma Network_Allowed [simp]: \"Allowed Network =\n        preserves allocRel Int\n        (INT i: lessThan Nclients. preserves(giv o sub i o client))\"\n  by (auto simp add: Allowed_def Network_AllowedActs safety_prop_Acts_iff)\n\nlemma Alloc_Allowed [simp]: \"Allowed Alloc = preserves allocGiv\"\n  by (auto simp add: Allowed_def Alloc_AllowedActs safety_prop_Acts_iff)\n\ntext\\<open>needed in \\<open>rename_client_map_tac\\<close>\\<close>\nlemma OK_lift_rename_Client [simp]: \"OK I (%i. lift i (rename client_map Client))\"\n  apply (rule OK_lift_I)\n  apply auto\n  apply (drule_tac w1 = rel in subset_preserves_o [THEN [2] rev_subsetD])\n  apply (drule_tac [2] w1 = ask in subset_preserves_o [THEN [2] rev_subsetD])\n  apply (auto simp add: o_def split_def)\n  done\n\nlemma fst_lift_map_eq_fst [simp]: \"fst (lift_map i x) i = fst x\"\napply (insert fst_o_lift_map [of i])\napply (drule fun_cong [where x=x])\napply (simp add: o_def)\ndone\n\nlemma fst_o_lift_map' [simp]:\n     \"(f \\<circ> sub i \\<circ> fst \\<circ> lift_map i \\<circ> g) = f o fst o g\"\napply (subst fst_o_lift_map [symmetric])\napply (simp only: o_assoc)\ndone\n\n\n(*The proofs of rename_Client_Increasing, rename_Client_Bounded and\n  rename_Client_Progress are similar.  All require copying out the original\n  Client property.  A forward proof can be constructed as follows:\n\n  Client_Increasing_ask RS\n      (bij_client_map RS rename_rename_guarantees_eq RS iffD2)\n  RS (lift_lift_guarantees_eq RS iffD2)\n  RS guarantees_PLam_I\n  RS (bij_sysOfClient RS rename_rename_guarantees_eq RS iffD2)\n  |> simplify (simpset() addsimps [lift_image_eq_rename, o_def, split_def,\n                                   surj_rename])\n\nHowever, the \"preserves\" property remains to be discharged, and the unfolding\nof \"o\" and \"sub\" complicates subsequent reasoning.\n\nThe following tactic works for all three proofs, though it certainly looks\nad-hoc!\n*)\nML\n\\<open>\nfun rename_client_map_tac ctxt =\n  EVERY [\n    simp_tac (ctxt addsimps [@{thm rename_guarantees_eq_rename_inv}]) 1,\n    resolve_tac ctxt @{thms guarantees_PLam_I} 1,\n    assume_tac ctxt 2,\n         (*preserves: routine reasoning*)\n    asm_simp_tac (ctxt addsimps [@{thm lift_preserves_sub}]) 2,\n         (*the guarantee for  \"lift i (rename client_map Client)\" *)\n    asm_simp_tac\n        (ctxt addsimps [@{thm lift_guarantees_eq_lift_inv},\n                      @{thm rename_guarantees_eq_rename_inv},\n                      @{thm bij_imp_bij_inv}, @{thm surj_rename},\n                      @{thm inv_inv_eq}]) 1,\n    asm_simp_tac\n        (ctxt addsimps [@{thm o_def}, @{thm non_dummy_def}, @{thm guarantees_Int_right}]) 1]\n\\<close>\n\nmethod_setup rename_client_map = \\<open>\n  Scan.succeed (fn ctxt => SIMPLE_METHOD (rename_client_map_tac ctxt))\n\\<close>\n\ntext\\<open>Lifting \\<open>Client_Increasing\\<close> to \\<^term>\\<open>systemState\\<close>\\<close>\nlemma rename_Client_Increasing: \"i \\<in> I\n      ==> rename sysOfClient (plam x: I. rename client_map Client) \\<in>\n            UNIV  guarantees\n            Increasing (ask o sub i o client) Int\n            Increasing (rel o sub i o client)\"\n  by rename_client_map\n\nlemma preserves_sub_fst_lift_map: \"[| F \\<in> preserves w; i \\<noteq> j |]\n      ==> F \\<in> preserves (sub i o fst o lift_map j o funPair v w)\"\n  apply (auto simp add: lift_map_def split_def linorder_neq_iff o_def)\n  apply (drule_tac [!] subset_preserves_o [THEN [2] rev_subsetD])\n  apply (auto simp add: o_def)\n  done\n\nlemma client_preserves_giv_oo_client_map: \"[| i < Nclients; j < Nclients |]\n      ==> Client \\<in> preserves (giv o sub i o fst o lift_map j o client_map)\"\n  apply (cases \"i=j\")\n  apply (simp, simp add: o_def non_dummy_def)\n  apply (drule Client_preserves_dummy [THEN preserves_sub_fst_lift_map])\n  apply (drule_tac [!] subset_preserves_o [THEN [2] rev_subsetD])\n  apply (simp add: o_def client_map_def)\n  done\n\nlemma rename_sysOfClient_ok_Network:\n  \"rename sysOfClient (plam x: lessThan Nclients. rename client_map Client)\n    ok Network\"\n  by (auto simp add: ok_iff_Allowed client_preserves_giv_oo_client_map)\n\nlemma rename_sysOfClient_ok_Alloc:\n  \"rename sysOfClient (plam x: lessThan Nclients. rename client_map Client)\n    ok rename sysOfAlloc Alloc\"\n  by (simp add: ok_iff_Allowed)\n\nlemma rename_sysOfAlloc_ok_Network: \"rename sysOfAlloc Alloc ok Network\"\n  by (simp add: ok_iff_Allowed)\n\ndeclare\n  rename_sysOfClient_ok_Network [iff]\n  rename_sysOfClient_ok_Alloc [iff]\n  rename_sysOfAlloc_ok_Network [iff]\n\ntext\\<open>The \"ok\" laws, re-oriented.\n  But not sure this works: theorem \\<open>ok_commute\\<close> is needed below\\<close>\ndeclare\n  rename_sysOfClient_ok_Network [THEN ok_sym, iff]\n  rename_sysOfClient_ok_Alloc [THEN ok_sym, iff]\n  rename_sysOfAlloc_ok_Network [THEN ok_sym]\n\nlemma System_Increasing: \"i < Nclients\n      ==> System \\<in> Increasing (ask o sub i o client) Int\n                   Increasing (rel o sub i o client)\"\n  apply (rule component_guaranteesD [OF rename_Client_Increasing Client_component_System])\n  apply auto\n  done\n\nlemmas rename_guarantees_sysOfAlloc_I =\n  bij_sysOfAlloc [THEN rename_rename_guarantees_eq, THEN iffD2]\n\n\n(*Lifting Alloc_Increasing up to the level of systemState*)\nlemmas rename_Alloc_Increasing =\n  Alloc_Increasing\n    [THEN rename_guarantees_sysOfAlloc_I,\n     simplified surj_rename o_def sub_apply\n                rename_image_Increasing bij_sysOfAlloc\n                allocGiv_o_inv_sysOfAlloc_eq']\n\nlemma System_Increasing_allocGiv:\n     \"i < Nclients \\<Longrightarrow> System \\<in> Increasing (sub i o allocGiv)\"\n  apply (unfold System_def)\n  apply (simp add: o_def)\n  apply (rule rename_Alloc_Increasing [THEN guarantees_Join_I1, THEN guaranteesD])\n  apply auto\n  done\n\n\nML \\<open>\nML_Thms.bind_thms (\"System_Increasing'\", list_of_Int @{thm System_Increasing})\n\\<close>\n\ndeclare System_Increasing' [intro!]\n\ntext\\<open>Follows consequences.\n    The \"Always (INT ...) formulation expresses the general safety property\n    and allows it to be combined using \\<open>Always_Int_rule\\<close> below.\\<close>\n\nlemma System_Follows_rel:\n  \"i < Nclients ==> System \\<in> ((sub i o allocRel) Fols (rel o sub i o client))\"\n  apply (auto intro!: Network_Rel [THEN component_guaranteesD])\n  apply (simp add: ok_commute [of Network])\n  done\n\nlemma System_Follows_ask:\n  \"i < Nclients ==> System \\<in> ((sub i o allocAsk) Fols (ask o sub i o client))\"\n  apply (auto intro!: Network_Ask [THEN component_guaranteesD])\n  apply (simp add: ok_commute [of Network])\n  done\n\nlemma System_Follows_allocGiv:\n  \"i < Nclients ==> System \\<in> (giv o sub i o client) Fols (sub i o allocGiv)\"\n  apply (auto intro!: Network_Giv [THEN component_guaranteesD]\n    rename_Alloc_Increasing [THEN component_guaranteesD])\n  apply (simp_all add: o_def non_dummy_def ok_commute [of Network])\n  apply (auto intro!: rename_Alloc_Increasing [THEN component_guaranteesD])\n  done\n\n\nlemma Always_giv_le_allocGiv: \"System \\<in> Always (INT i: lessThan Nclients.\n                       {s. (giv o sub i o client) s \\<le> (sub i o allocGiv) s})\"\n  apply auto\n  apply (erule System_Follows_allocGiv [THEN Follows_Bounded])\n  done\n\n\nlemma Always_allocAsk_le_ask: \"System \\<in> Always (INT i: lessThan Nclients.\n                       {s. (sub i o allocAsk) s \\<le> (ask o sub i o client) s})\"\n  apply auto\n  apply (erule System_Follows_ask [THEN Follows_Bounded])\n  done\n\n\nlemma Always_allocRel_le_rel: \"System \\<in> Always (INT i: lessThan Nclients.\n                       {s. (sub i o allocRel) s \\<le> (rel o sub i o client) s})\"\n  by (auto intro!: Follows_Bounded System_Follows_rel)\n\n\nsubsection\\<open>Proof of the safety property (1)\\<close>\n\ntext\\<open>safety (1), step 1 is \\<open>System_Follows_rel\\<close>\\<close>\n\ntext\\<open>safety (1), step 2\\<close>\n(* i < Nclients ==> System : Increasing (sub i o allocRel) *)\nlemmas System_Increasing_allocRel = System_Follows_rel [THEN Follows_Increasing1]\n\n(*Lifting Alloc_safety up to the level of systemState.\n  Simplifying with o_def gets rid of the translations but it unfortunately\n  gets rid of the other \"o\"s too.*)\n\ntext\\<open>safety (1), step 3\\<close>\nlemma System_sum_bounded:\n    \"System \\<in> Always {s. (\\<Sum>i \\<in> lessThan Nclients. (tokens o sub i o allocGiv) s)\n            \\<le> NbT + (\\<Sum>i \\<in> lessThan Nclients. (tokens o sub i o allocRel) s)}\"\n  apply (simp add: o_apply)\n  apply (insert Alloc_Safety [THEN rename_guarantees_sysOfAlloc_I])\n  apply (simp add: o_def)\n  apply (erule component_guaranteesD)\n  apply (auto simp add: System_Increasing_allocRel [simplified sub_apply o_def])\n  done\n\ntext\\<open>Follows reasoning\\<close>\n\nlemma Always_tokens_giv_le_allocGiv: \"System \\<in> Always (INT i: lessThan Nclients.\n                          {s. (tokens o giv o sub i o client) s\n                           \\<le> (tokens o sub i o allocGiv) s})\"\n  apply (rule Always_giv_le_allocGiv [THEN Always_weaken])\n  apply (auto intro: tokens_mono_prefix simp add: o_apply)\n  done\n\nlemma Always_tokens_allocRel_le_rel: \"System \\<in> Always (INT i: lessThan Nclients.\n                          {s. (tokens o sub i o allocRel) s\n                           \\<le> (tokens o rel o sub i o client) s})\"\n  apply (rule Always_allocRel_le_rel [THEN Always_weaken])\n  apply (auto intro: tokens_mono_prefix simp add: o_apply)\n  done\n\ntext\\<open>safety (1), step 4 (final result!)\\<close>\ntheorem System_safety: \"System \\<in> system_safety\"\n  apply (unfold system_safety_def)\n  apply (tactic \\<open>resolve_tac \\<^context> [Always_Int_rule [@{thm System_sum_bounded},\n    @{thm Always_tokens_giv_le_allocGiv}, @{thm Always_tokens_allocRel_le_rel}] RS\n    @{thm Always_weaken}] 1\\<close>)\n  apply auto\n  apply (rule sum_fun_mono [THEN order_trans])\n  apply (drule_tac [2] order_trans)\n  apply (rule_tac [2] add_le_mono [OF order_refl sum_fun_mono])\n  prefer 3 apply assumption\n  apply auto\n  done\n\nsubsection \\<open>Proof of the progress property (2)\\<close>\n\ntext\\<open>progress (2), step 1 is \\<open>System_Follows_ask\\<close> and\n      \\<open>System_Follows_rel\\<close>\\<close>\n\ntext\\<open>progress (2), step 2; see also \\<open>System_Increasing_allocRel\\<close>\\<close>\n(* i < Nclients ==> System : Increasing (sub i o allocAsk) *)\nlemmas System_Increasing_allocAsk =  System_Follows_ask [THEN Follows_Increasing1]\n\ntext\\<open>progress (2), step 3: lifting \\<open>Client_Bounded\\<close> to systemState\\<close>\nlemma rename_Client_Bounded: \"i \\<in> I\n    ==> rename sysOfClient (plam x: I. rename client_map Client) \\<in>\n          UNIV  guarantees\n          Always {s. \\<forall>elt \\<in> set ((ask o sub i o client) s). elt \\<le> NbT}\"\n  using image_cong_simp [cong del] by rename_client_map\n\nlemma System_Bounded_ask: \"i < Nclients\n      ==> System \\<in> Always\n                    {s. \\<forall>elt \\<in> set ((ask o sub i o client) s). elt \\<le> NbT}\"\n  apply (rule component_guaranteesD [OF rename_Client_Bounded Client_component_System])\n  apply auto\n  done\n\nlemma Collect_all_imp_eq: \"{x. \\<forall>y. P y \\<longrightarrow> Q x y} = (INT y: {y. P y}. {x. Q x y})\"\n  apply blast\n  done\n\ntext\\<open>progress (2), step 4\\<close>\nlemma System_Bounded_allocAsk: \"System \\<in> Always {s. \\<forall>i<Nclients.\n                          \\<forall>elt \\<in> set ((sub i o allocAsk) s). elt \\<le> NbT}\"\n  apply (auto simp add: Collect_all_imp_eq)\n  apply (tactic \\<open>resolve_tac \\<^context> [Always_Int_rule [@{thm Always_allocAsk_le_ask},\n    @{thm System_Bounded_ask}] RS @{thm Always_weaken}] 1\\<close>)\n  apply (auto dest: set_mono)\n  done\n\ntext\\<open>progress (2), step 5 is \\<open>System_Increasing_allocGiv\\<close>\\<close>\n\ntext\\<open>progress (2), step 6\\<close>\n(* i < Nclients ==> System : Increasing (giv o sub i o client) *)\nlemmas System_Increasing_giv =  System_Follows_allocGiv [THEN Follows_Increasing1]\n\n\nlemma rename_Client_Progress: \"i \\<in> I\n   ==> rename sysOfClient (plam x: I. rename client_map Client)\n        \\<in> Increasing (giv o sub i o client)\n          guarantees\n          (INT h. {s. h \\<le> (giv o sub i o client) s &\n                            h pfixGe (ask o sub i o client) s}\n                  LeadsTo {s. tokens h \\<le> (tokens o rel o sub i o client) s})\"\n  supply image_cong_simp [cong del]\n  apply rename_client_map\n  apply (simp add: Client_Progress [simplified o_def])\n  done\n\n\ntext\\<open>progress (2), step 7\\<close>\nlemma System_Client_Progress:\n  \"System \\<in> (INT i : (lessThan Nclients).\n            INT h. {s. h \\<le> (giv o sub i o client) s &\n                       h pfixGe (ask o sub i o client) s}\n                LeadsTo {s. tokens h \\<le> (tokens o rel o sub i o client) s})\"\n  apply (rule INT_I)\n(*Couldn't have just used Auto_tac since the \"INT h\" must be kept*)\n  apply (rule component_guaranteesD [OF rename_Client_Progress Client_component_System])\n  apply (auto simp add: System_Increasing_giv)\n  done\n\n(*Concludes\n System : {s. k \\<le> (sub i o allocGiv) s}\n          LeadsTo\n          {s. (sub i o allocAsk) s \\<le> (ask o sub i o client) s} Int\n          {s. k \\<le> (giv o sub i o client) s} *)\n\nlemmas System_lemma1 =\n  Always_LeadsToD [OF System_Follows_ask [THEN Follows_Bounded]\n                      System_Follows_allocGiv [THEN Follows_LeadsTo]]\n\nlemmas System_lemma2 =\n  PSP_Stable [OF System_lemma1\n              System_Follows_ask [THEN Follows_Increasing1, THEN IncreasingD]]\n\n\nlemma System_lemma3: \"i < Nclients\n      ==> System \\<in> {s. h \\<le> (sub i o allocGiv) s &\n                       h pfixGe (sub i o allocAsk) s}\n                   LeadsTo\n                   {s. h \\<le> (giv o sub i o client) s &\n                       h pfixGe (ask o sub i o client) s}\"\n  apply (rule single_LeadsTo_I)\n  apply (rule_tac k1 = h and x1 = \"(sub i o allocAsk) s\"\n         in System_lemma2 [THEN LeadsTo_weaken])\n  apply auto\n  apply (blast intro: trans_Ge [THEN trans_genPrefix, THEN transD] prefix_imp_pfixGe)\n  done\n\n\ntext\\<open>progress (2), step 8: Client i's \"release\" action is visible system-wide\\<close>\nlemma System_Alloc_Client_Progress: \"i < Nclients\n      ==> System \\<in> {s. h \\<le> (sub i o allocGiv) s &\n                       h pfixGe (sub i o allocAsk) s}\n                   LeadsTo {s. tokens h \\<le> (tokens o sub i o allocRel) s}\"\n  apply (rule LeadsTo_Trans)\n   prefer 2\n   apply (drule System_Follows_rel [THEN\n     mono_tokens [THEN mono_Follows_o, THEN [2] rev_subsetD],\n     THEN Follows_LeadsTo])\n   apply (simp add: o_assoc)\n  apply (rule LeadsTo_Trans)\n   apply (cut_tac [2] System_Client_Progress)\n   prefer 2\n   apply (blast intro: LeadsTo_Basis)\n  apply (erule System_lemma3)\n  done\n\ntext\\<open>Lifting \\<open>Alloc_Progress\\<close> up to the level of systemState\\<close>\n\ntext\\<open>progress (2), step 9\\<close>\nlemma System_Alloc_Progress:\n \"System \\<in> (INT i : (lessThan Nclients).\n            INT h. {s. h \\<le> (sub i o allocAsk) s}\n                   LeadsTo {s. h pfixLe (sub i o allocGiv) s})\"\n  apply (simp only: o_apply sub_def)\n  apply (insert Alloc_Progress [THEN rename_guarantees_sysOfAlloc_I])\n  apply (simp add: o_def del: INT_iff)\n  apply (drule component_guaranteesD)\n  apply (auto simp add:\n    System_Increasing_allocRel [simplified sub_apply o_def]\n    System_Increasing_allocAsk [simplified sub_apply o_def]\n    System_Bounded_allocAsk [simplified sub_apply o_def]\n    System_Alloc_Client_Progress [simplified sub_apply o_def])\n  done\n\ntext\\<open>progress (2), step 10 (final result!)\\<close>\nlemma System_Progress: \"System \\<in> system_progress\"\n  apply (unfold system_progress_def)\n  apply (cut_tac System_Alloc_Progress)\n  apply auto\n  apply (blast intro: LeadsTo_Trans\n    System_Follows_allocGiv [THEN Follows_LeadsTo_pfixLe]\n    System_Follows_ask [THEN Follows_LeadsTo])\n  done\n\n\ntheorem System_correct: \"System \\<in> system_spec\"\n  apply (unfold system_spec_def)\n  apply (blast intro: System_safety System_Progress)\n  done\n\n\ntext\\<open>Some obsolete lemmas\\<close>\n\nlemma non_dummy_eq_o_funPair: \"non_dummy = (% (g,a,r). (| giv = g, ask = a, rel = r |)) o\n                              (funPair giv (funPair ask rel))\"\n  apply (rule ext)\n  apply (auto simp add: o_def non_dummy_def)\n  done\n\nlemma preserves_non_dummy_eq: \"(preserves non_dummy) =\n      (preserves rel Int preserves ask Int preserves giv)\"\n  apply (simp add: non_dummy_eq_o_funPair)\n  apply auto\n    apply (drule_tac w1 = rel in subset_preserves_o [THEN [2] rev_subsetD])\n    apply (drule_tac [2] w1 = ask in subset_preserves_o [THEN [2] rev_subsetD])\n    apply (drule_tac [3] w1 = giv in subset_preserves_o [THEN [2] rev_subsetD])\n    apply (auto simp add: o_def)\n  done\n\ntext\\<open>Could go to Extend.ML\\<close>\nlemma bij_fst_inv_inv_eq: \"bij f \\<Longrightarrow> fst (inv (%(x, u). inv f x) z) = f z\"\n  apply (rule fst_inv_equalityI)\n   apply (rule_tac f = \"%z. (f z, h z)\" for h in surjI)\n   apply (simp add: bij_is_inj inv_f_f)\n  apply (simp add: bij_is_surj surj_f_inv_f)\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/UNITY/Comp/Alloc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307944803832, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.3060797140077425}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\nsection \"Additional Syntax for Word Bit Operations\"\n\ntheory Word_Syntax\nimports\n  \"HOL-Word.More_Word\"\n  WordBitwise_Signed\n  Hex_Words\n  Norm_Words\n  Word_Type_Syntax\nbegin\n\ntext \\<open>Additional bit and type syntax that forces word types.\\<close>\n\ntype_synonym word8 = \"8 word\"\ntype_synonym word16 = \"16 word\"\ntype_synonym word32 = \"32 word\"\ntype_synonym word64 = \"64 word\"\n\nlemma len8: \"len_of (x :: 8 itself) = 8\" by simp\nlemma len16: \"len_of (x :: 16 itself) = 16\" by simp\nlemma len32: \"len_of (x :: 32 itself) = 32\" by simp\nlemma len64: \"len_of (x :: 64 itself) = 64\" by simp\n\n\nabbreviation\n  wordNOT  :: \"'a::len0 word \\<Rightarrow> 'a word\"      (\"~~ _\" [70] 71)\nwhere\n  \"~~ x == NOT x\"\n\nabbreviation\n  wordAND  :: \"'a::len0 word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixr \"&&\" 64)\nwhere\n  \"a && b == a AND b\"\n\nabbreviation\n  wordOR   :: \"'a::len0 word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixr \"||\"  59)\nwhere\n  \"a || b == a OR b\"\n\nabbreviation\n  wordXOR  :: \"'a::len0 word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixr \"xor\" 59)\nwhere\n  \"a xor b == a XOR b\"\n\n(* testing for presence of word_bitwise *)\nlemma \"((x :: word32) >> 3) AND 7 = (x AND 56) >> 3\"\n  by word_bitwise\n\n(* FIXME: move to Word distribution *)\nlemma bin_nth_minus_Bit0[simp]:\n  \"0 < n \\<Longrightarrow> bin_nth (numeral (num.Bit0 w)) n = bin_nth (numeral w) (n - 1)\"\n  by (cases n; simp)\n\nlemma bin_nth_minus_Bit1[simp]:\n  \"0 < n \\<Longrightarrow> bin_nth (numeral (num.Bit1 w)) n = bin_nth (numeral w) (n - 1)\"\n  by (cases n; simp)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Word_Lib/Word_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3059404671965239}}
{"text": "(*\n * Copyright 2014, General Dynamics C4 Systems\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchVSpaceEntries_AI\nimports \"../VSpaceEntries_AI\"\nbegin\n\ncontext Arch begin global_naming ARM_HYP (*FIXME: arch_split*)\n\nlemma a_type_pdD:\n  \"a_type ko = AArch APageDirectory \\<Longrightarrow> \\<exists>pd. ko = ArchObj (PageDirectory pd)\"\n  by (clarsimp)\n\nprimrec\n  pde_range_sz :: \"pde \\<Rightarrow> nat\"\nwhere\n    \"pde_range_sz (InvalidPDE) = 0\"\n  | \"pde_range_sz (SectionPDE ptr x y) = 0\"\n  | \"pde_range_sz (SuperSectionPDE ptr x z) = 4\"\n  | \"pde_range_sz (PageTablePDE ptr) = 0\"\n\nprimrec\n  pte_range_sz :: \"pte \\<Rightarrow> nat\"\nwhere\n    \"pte_range_sz (InvalidPTE) = 0\"\n  | \"pte_range_sz (LargePagePTE ptr x y) = 4\"\n  | \"pte_range_sz (SmallPagePTE ptr x y) = 0\"\n\nprimrec\n  pde_range :: \"pde \\<Rightarrow> 11 word \\<Rightarrow> 11 word set\"\nwhere\n    \"pde_range (InvalidPDE) p = {}\"\n  | \"pde_range (SectionPDE ptr x y) p = {p}\"\n  | \"pde_range (SuperSectionPDE ptr x z) p =\n     (if is_aligned p 4 then {x. x && ~~ mask 4 = p && ~~ mask 4} else {p})\"\n  | \"pde_range (PageTablePDE ptr) p = {p}\"\n\nprimrec\n  pte_range :: \"pte \\<Rightarrow> 9 word \\<Rightarrow> 9 word set\"\nwhere\n    \"pte_range (InvalidPTE) p = {}\"\n  | \"pte_range (LargePagePTE ptr x y) p =\n       (if is_aligned p 4 then {x. x && ~~ mask 4 = p && ~~ mask 4} else {p})\"\n  | \"pte_range (SmallPagePTE ptr x y) p = {p}\"\n\nabbreviation \"valid_pt_entries \\<equiv> \\<lambda>pt. valid_entries pte_range pt\"\n\nabbreviation \"valid_pd_entries \\<equiv> \\<lambda>pd. valid_entries pde_range pd\"\n\ndefinition\n  obj_valid_pdpt :: \"kernel_object \\<Rightarrow> bool\"\nwhere\n \"obj_valid_pdpt obj \\<equiv> case obj of\n    ArchObj (PageTable pt) \\<Rightarrow> valid_pt_entries pt \\<and> entries_align pte_range_sz pt\n  | ArchObj (PageDirectory pd) \\<Rightarrow> valid_pd_entries pd \\<and> entries_align pde_range_sz pd\n  | _ \\<Rightarrow> True\"\n\nlemmas obj_valid_pdpt_simps[simp]\n    = obj_valid_pdpt_def\n        [split_simps Structures_A.kernel_object.split\n                     arch_kernel_obj.split]\n\nabbreviation\n  valid_pdpt_objs :: \"'z state \\<Rightarrow> bool\"\nwhere\n \"valid_pdpt_objs s \\<equiv> \\<forall>x \\<in> ran (kheap s). obj_valid_pdpt x\"\n\nlemma valid_pdpt_init[iff]:\n  \"valid_pdpt_objs init_A_st\"\n  by (auto simp: init_A_st_def init_kheap_def valid_entries_def entries_align_def\n          elim!: ranE split: if_split_asm)\n\nlemma set_object_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and K (obj_valid_pdpt obj)\\<rbrace>\n      set_object ptr obj\n   \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: set_object_def get_object_def, wp)\n  apply (auto simp: fun_upd_def[symmetric] del: ballI elim: ball_ran_updI)\n  done\n\ncrunch valid_pdpt_objs[wp]: cap_insert, cap_swap_for_delete,empty_slot \"valid_pdpt_objs\"\n  (wp: crunch_wps simp: crunch_simps ignore:set_object)\n\ncrunches\n  vcpu_save,vcpu_restore,vcpu_enable,get_vcpu,set_vcpu,vcpu_disable,vcpu_read_reg,\n  read_vcpu_register,write_vcpu_register\n  for valid_pdpt_objs[wp]: \"valid_pdpt_objs\"\n  (wp: crunch_wps simp: crunch_simps ignore: set_object do_machine_op)\n\nlemma vcpu_switch_valid_pdpt_objs[wp]:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace>\n     vcpu_switch v\n   \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: vcpu_switch_def)\n  apply (rule hoare_pre)\n  apply (wp | wpc | clarsimp)+\n  done\n\ncrunch valid_pdpt_objs[wp]: flush_page \"valid_pdpt_objs\"\n  (wp: crunch_wps simp: crunch_simps ignore: set_object)\n\nlemma add_3_eq_Suc'[simp]: \"n + 3 = Suc (Suc (Suc n))\" by simp\n\nlemma shift_0x3C_set:\n  \"\\<lbrakk> is_aligned p 7; 8 \\<le> bits; bits < 32; len_of TYPE('a) = bits - 3 \\<rbrakk> \\<Longrightarrow>\n   (\\<lambda>x. ucast (x + p && mask bits >> 3) :: ('a :: len) word) ` set [0 :: word32 , 8 .e. 0x78]\n        = {x. x && ~~ mask 4 = ucast (p && mask bits >> 3)}\"\n  apply (clarsimp simp: upto_enum_step_def word_shift_by_3 image_image)\n  apply (subst image_cong[where N=\"{x. x < 2 ^ 4}\"])\n    apply (safe, simp_all)[1]\n     apply (drule plus_one_helper2, simp_all)[1]\n    apply (drule word_le_minus_one_leq, simp_all)[1]\n   apply (rule_tac f=\"\\<lambda>x. ucast (x && mask bits >> 3)\" in arg_cong)\n   apply (rule trans[OF add.commute is_aligned_add_or], assumption)\n   apply (rule shiftl_less_t2n, simp_all)[1]\n  apply safe\n   apply (frule upper_bits_unset_is_l2p_32[THEN iffD2, rotated])\n    apply (simp add: word_bits_conv)\n   apply (rule word_eqI)\n   apply (simp add: word_ops_nth_size word_size nth_ucast nth_shiftr\n                    nth_shiftl neg_mask_test_bit\n                    word_bits_conv)\n   apply (safe, simp_all add: is_aligned_nth)[1]\n   apply (drule_tac x=\"Suc (Suc (Suc n))\" in spec)\n   apply simp\n  apply (rule_tac x=\"ucast x && mask 4\" in image_eqI)\n   apply (rule word_eqI[rule_format])\n   apply (drule_tac x=n in word_eqD)\n   apply (simp add: word_ops_nth_size word_size nth_ucast nth_shiftr\n                    nth_shiftl)\n   apply (safe, simp_all)\n  apply (rule order_less_le_trans, rule and_mask_less_size)\n   apply (simp_all add: word_size)\n  done\n\nlemma mapM_x_store_pte_updates:\n  \"\\<forall>x \\<in> set xs. f x && ~~ mask pt_bits = p \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. (\\<not> page_table_at p s \\<longrightarrow> Q s) \\<and>\n        (\\<forall>pt. ko_at (ArchObj (PageTable pt)) p s\n           \\<longrightarrow> Q (s \\<lparr> kheap := (kheap s) (p := Some (ArchObj (PageTable (\\<lambda>y. if y \\<in> (\\<lambda>x.\n         ucast (f x && mask pt_bits >> 3)) ` set xs then pte else pt y)))) \\<rparr>))\\<rbrace>\n     mapM_x (\\<lambda>x. store_pte (f x) pte) xs\n   \\<lbrace>\\<lambda>_. Q\\<rbrace>\"\n  apply (induct xs)\n   apply (simp add: mapM_x_Nil)\n   apply wp\n   apply (clarsimp simp: obj_at_def fun_upd_idem)\n  apply (simp add: mapM_x_Cons)\n  apply (rule hoare_seq_ext, assumption)\n  apply (thin_tac \"valid P f Q\" for P f Q)\n  apply (simp add: store_pte_def set_pt_def set_object_def)\n  apply (wp get_pt_wp get_object_wp)\n  apply (clarsimp simp: obj_at_def a_type_simps)\n  apply (erule rsubst[where P=Q])\n  apply (rule abstract_state.fold_congs[OF refl refl])\n  apply (rule ext, clarsimp simp add: vspace_bits_defs)\n  apply (rule ext, clarsimp simp add: vspace_bits_defs)\n  done\n\nlemma valid_pt_entries_invalid[simp]:\n  \"valid_pt_entries (\\<lambda>x. InvalidPTE)\"\n   by (simp add:valid_entries_def)\n\nlemma valid_pd_entries_invalid[simp]:\n  \"valid_pd_entries (\\<lambda>x. InvalidPDE)\"\n  by (simp add:valid_entries_def)\n\nlemma entries_align_pte_update:\n \"\\<lbrakk>entries_align pte_range_sz pt;\n  (\\<forall>y. (P y) \\<longrightarrow> is_aligned y (pte_range_sz pte))\\<rbrakk>\n  \\<Longrightarrow> entries_align pte_range_sz (\\<lambda>y. if (P y) then pte else pt y)\"\n  by (simp add:entries_align_def)\n\nlemma entries_align_pde_update:\n \"\\<lbrakk>entries_align pde_range_sz pd;\n  (\\<forall>y. (P y) \\<longrightarrow> is_aligned y (pde_range_sz pde))\\<rbrakk>\n  \\<Longrightarrow> entries_align pde_range_sz (\\<lambda>y. if (P y) then pde else pd y)\"\n  by (simp add:entries_align_def)\n\n\nlemma valid_pdpt_objs_pdD:\n  \"\\<lbrakk>valid_pdpt_objs s;\n    kheap s ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pd))\\<rbrakk>\n   \\<Longrightarrow> valid_pd_entries pd \\<and> entries_align pde_range_sz pd\"\n  by (fastforce simp:ran_def)\n\nlemma valid_pdpt_objs_ptD:\n  \"\\<lbrakk>valid_pdpt_objs s;\n    kheap s ptr = Some (ArchObj (arch_kernel_obj.PageTable pt))\\<rbrakk>\n   \\<Longrightarrow> valid_pt_entries pt \\<and> entries_align pte_range_sz pt\"\n  by (fastforce simp:ran_def)\n\nlemma mapM_x_store_invalid_pte_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and K (is_aligned p 7) \\<rbrace>\n     mapM_x (\\<lambda>x. store_pte (x + p) InvalidPTE) [0, 8 .e. 0x78]\n   \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)+\n  apply (rule hoare_pre, rule_tac p=\"p && ~~ mask pt_bits\" in mapM_x_store_pte_updates)\n   apply clarsimp\n   apply (rule mask_out_first_mask_some[where n=7])\n    apply (drule_tac d=x in is_aligned_add_helper)\n     apply (drule subsetD[OF upto_enum_step_subset])\n     apply simp\n     apply (erule order_le_less_trans, simp)\n    apply (simp add: field_simps)\n   apply (simp add: vspace_bits_defs)\n  apply (clarsimp simp: ranI elim!: ranE split: if_split_asm)\n  apply (intro conjI)\n   apply (simp add: shift_0x3C_set vspace_bits_defs)\n   apply (rule valid_entries_overwrite_groups\n    [where S = \"{x. x && ~~ mask 4 = ucast (p && mask 12 >> 3)}\"])\n      apply (fastforce simp add: obj_at_def ran_def)\n     apply simp\n    apply clarsimp\n    apply (case_tac v)\n      apply (simp split:if_splits)+\n   apply (clarsimp)\n   apply (case_tac v, simp_all split:if_splits)\n    apply (intro conjI impI)\n     apply (rule disjointI)\n     apply (clarsimp)+\n  apply (rule entries_align_pte_update)\n   apply (clarsimp simp:obj_at_def)\n   apply (drule(1) valid_pdpt_objs_ptD)\n   apply simp\n  apply (simp)\n  done\n\nlemma mapM_x_store_pde_updates:\n  \"\\<forall>x \\<in> set xs. f x && ~~ mask pd_bits = p \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. (\\<not> page_directory_at p s \\<longrightarrow> Q s) \\<and>\n        (\\<forall>pd. ko_at (ArchObj (PageDirectory pd)) p s\n           \\<longrightarrow> Q (s \\<lparr> kheap := (kheap s) (p := Some (ArchObj (PageDirectory (\\<lambda>y. if y \\<in> (\\<lambda>x.\n         ucast (f x && mask pd_bits >> 3)) ` set xs then pde else pd y)))) \\<rparr>))\\<rbrace>\n     mapM_x (\\<lambda>x. store_pde (f x) pde) xs\n   \\<lbrace>\\<lambda>_. Q\\<rbrace>\"\n  apply (induct xs)\n   apply (simp add: mapM_x_Nil)\n   apply wp\n   apply (clarsimp simp: obj_at_def fun_upd_idem)\n  apply (simp add: mapM_x_Cons)\n  apply (rule hoare_seq_ext, assumption)\n  apply (thin_tac \"valid P f Q\" for P f Q)\n  apply (simp add: store_pde_def set_pd_def set_object_def)\n  apply (wp get_pd_wp get_object_wp)\n  apply (clarsimp simp: obj_at_def a_type_simps)\n  apply (erule rsubst[where P=Q])\n  apply (rule abstract_state.fold_congs[OF refl refl])\n  apply (rule ext, clarsimp simp add: vspace_bits_defs)\n  apply (rule ext, clarsimp simp add: vspace_bits_defs)\n  done\n\nlemma mapM_x_store_pde_valid_pdpt_objs:\n  \"\\<lbrace>valid_pdpt_objs and K (is_aligned p 7)\\<rbrace>\n     mapM_x (\\<lambda>x. store_pde (x + p) InvalidPDE) [0, 8 .e. 0x78]\n   \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)+\n  apply (rule hoare_pre, rule_tac p=\"p && ~~ mask pd_bits\" in mapM_x_store_pde_updates)\n   apply clarsimp\n   apply (rule mask_out_first_mask_some[where n=7])\n    apply (drule_tac d=x in is_aligned_add_helper)\n     apply (drule subsetD[OF upto_enum_step_subset])\n     apply simp\n     apply (erule order_le_less_trans, simp)\n    apply (simp add: field_simps)\n   apply (simp add: vspace_bits_defs)\n  apply (clarsimp simp: ranI elim!: ranE split: if_split_asm)\n  apply (simp add: shift_0x3C_set vspace_bits_defs)\n  apply (rule conjI)\n   apply (rule_tac valid_entries_overwrite_groups\n    [where S = \"{x. x && ~~ mask 4 = ucast (p && mask 14 >> 3)}\"])\n      apply (fastforce simp add: obj_at_def ran_def)\n     apply fastforce\n    apply clarsimp\n    apply (case_tac v, simp_all split:if_splits)\n    apply clarsimp\n    apply (case_tac v, simp_all split:if_splits)\n   apply (intro conjI impI allI)\n   apply (rule disjointI)\n   apply clarsimp\n  apply (rule entries_align_pde_update)\n   apply (clarsimp simp:obj_at_def)\n   apply (drule valid_pdpt_objs_pdD)\n    apply (simp add:pd_bits_def pageBits_def)\n   apply simp\n  apply simp\n  done\n\nlemma store_invalid_pde_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and\n    (\\<lambda>s. \\<forall>pd. ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits) s\n      \\<longrightarrow> pde = InvalidPDE)\\<rbrace>\n       store_pde p pde \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: store_pde_def set_pd_def, wp get_object_wp)\n  apply (clarsimp simp: obj_at_def)\n   apply (intro conjI)\n   apply (rule valid_entries_overwrite_0, simp_all)\n   apply (fastforce simp: ran_def)\n  apply (simp add:fun_upd_def)\n  apply (rule entries_align_pde_update)\n   apply (drule(1) valid_pdpt_objs_pdD)\n   apply simp\n  apply simp\n  done\n\nlemma store_pde_non_master_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and\n        (\\<lambda>s. \\<forall>pd. ko_at (ArchObj (PageDirectory pd)) (p && ~~ mask pd_bits) s\n        \\<longrightarrow> (pde_range_sz (pd (ucast (p && mask pd_bits >> 3) && ~~ mask 4)) = 0\n        \\<and> pde_range_sz pde = 0))\\<rbrace>\n       store_pde p pde \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: store_pde_def set_pd_def, wp get_object_wp)\n  apply (clarsimp simp: obj_at_def)\n  apply (intro conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply (fastforce simp:ran_def)\n   apply (drule bspec)\n    apply fastforce\n   apply (case_tac \"pd pa\")\n    apply (simp_all add: vspace_bits_defs)\n     apply (case_tac pde,simp_all)\n    apply (case_tac pde,simp_all)\n   apply (case_tac pde,simp_all)\n    apply (clarsimp simp: is_aligned_neg_mask_eq)+\n  apply (simp add:fun_upd_def)\n  apply (rule entries_align_pde_update)\n   apply (drule(1) valid_pdpt_objs_pdD,simp)\n  apply simp\n  done\n\nlemma store_invalid_pte_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and\n        (\\<lambda>s. \\<forall>pt. ko_at (ArchObj (PageTable pt)) (p && ~~ mask pt_bits) s\n        \\<longrightarrow> pte = InvalidPTE)\\<rbrace>\n       store_pte p pte \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: store_pte_def set_pt_def, wp get_object_wp)\n  apply (clarsimp simp: obj_at_def)\n   apply (intro conjI)\n   apply (rule valid_entries_overwrite_0, simp_all)\n   apply (fastforce simp: ran_def)\n  apply (simp add:fun_upd_def)\n  apply (rule entries_align_pte_update)\n   apply (drule (1) valid_pdpt_objs_ptD,simp)\n  apply simp\n  done\n\nlemma store_pte_non_master_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and\n        (\\<lambda>s. \\<forall>pt. ko_at (ArchObj (PageTable pt)) (p && ~~ mask pt_bits) s\n        \\<longrightarrow> (pte_range_sz (pt (ucast (p && mask pt_bits >> 3) && ~~ mask 4)) = 0\n        \\<and> pte_range_sz pte = 0))\\<rbrace>\n       store_pte p pte \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: store_pte_def set_pt_def, wp get_object_wp)\n  apply (clarsimp simp: obj_at_def)\n  apply (intro conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply (fastforce simp:ran_def)\n   apply (drule bspec)\n    apply fastforce\n   apply (case_tac \"pt pa\")\n     apply simp\n    apply (case_tac pte,simp_all)\n    apply (clarsimp simp: is_aligned_neg_mask_eq vspace_bits_defs)\n   apply (case_tac pte,simp_all)\n  apply (simp add:fun_upd_def)\n  apply (rule entries_align_pte_update)\n   apply (drule (1) valid_pdpt_objs_ptD,simp)\n  apply simp\n  done\n\nlemma unmap_page_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> unmap_page sz asid vptr pptr \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: unmap_page_def mapM_discarded\n             cong: vmpage_size.case_cong)\n  including no_pre apply wp\n    prefer 2\n    apply (rule valid_validE[OF find_pd_for_asid_inv])\n  apply (rule hoare_pre)\n   apply (wp get_object_wp get_pte_wp get_pde_wp lookup_pt_slot_inv_any\n             store_invalid_pte_valid_pdpt\n             store_invalid_pde_valid_pdpt\n             mapM_x_store_invalid_pte_valid_pdpt mapM_x_store_pde_valid_pdpt_objs\n                | simp add: mapM_x_map vspace_bits_defs largePagePTE_offsets_def superSectionPDE_offsets_def\n                | wpc | simp add: check_mapping_pptr_def)+\n  apply (simp add: fun_upd_def[symmetric] is_aligned_mask[symmetric])\n  done\n\ncrunch valid_pdpt_objs[wp]: flush_table \"valid_pdpt_objs\"\n  (wp: crunch_wps simp: crunch_simps)\n\n(*\n\nNOTE: This isn't true, but is the main reason flush_table_kheap does not work now,\n      I guess it is possible to prove this for a P that does not care about VCPU\n      but let's wait and see where and how this lemma is used.\n\nlemma vcpu_switch_kheap[wp]:\"\\<lbrace>\\<lambda>s. P (kheap s)\\<rbrace> vcpu_switch v \\<lbrace>\\<lambda>_ s. P (kheap s)\\<rbrace>\"\n\n\ncrunch kheap[wp]: flush_table \"\\<lambda>s. P (kheap s)\"\n  (wp: crunch_wps simp: crunch_simps)\n\nFIXME: Delete\n*)\n\ncrunch kheap[wp]: get_cap \"\\<lambda>s. P (kheap s)\"\n  (wp: crunch_wps simp: crunch_simps)\n\nlemma unmap_page_table_valid_pdpt_objs[wp]:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> unmap_page_table asid vptr pt \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: unmap_page_table_def)\n  including no_pre apply (wp get_object_wp store_invalid_pde_valid_pdpt | wpc)+\n  apply (simp add: obj_at_def)\n  apply (simp add: page_table_mapped_def)\n  apply (wp get_pde_wp | wpc)+\n  apply simp\n  apply (rule hoare_post_impErr, rule valid_validE,\n         rule find_pd_for_asid_inv, simp_all)\n  done\n\nlemma set_simple_ko_valid_pdpt_objs[wp]:\n   \"\\<lbrace>\\<lambda>s. \\<forall>x\\<in>ran (kheap s). obj_valid_pdpt x\\<rbrace>\n       set_simple_ko param_a param_b param_c \\<lbrace>\\<lambda>_ s. \\<forall>x\\<in>ran (kheap s). obj_valid_pdpt x\\<rbrace>\"\n  unfolding set_simple_ko_def\n  apply (subst option.disc_eq_case(2))\n  apply (wpsimp wp: set_object_valid_pdpt[THEN hoare_set_object_weaken_pre]\n                    get_object_wp\n              simp: a_type_simps obj_at_def)\n  apply (clarsimp simp: a_type_def\n                 split: kernel_object.splits)\n  done\n\ncrunch valid_pdpt_objs[wp]: finalise_cap, cap_swap_for_delete, empty_slot \"valid_pdpt_objs\"\n  (wp: crunch_wps select_wp preemption_point_inv simp: crunch_simps unless_def ignore:set_object)\n\nlemma preemption_point_valid_pdpt_objs[wp]:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> preemption_point \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  by (wp preemption_point_inv | simp)+\n\nlemmas cap_revoke_preservation_valid_pdpt_objs = cap_revoke_preservation[OF _,\n                                                          where E=valid_pdpt_objs,\n                                                          simplified, THEN validE_valid]\n\nlemmas rec_del_preservation_valid_pdpt_objs = rec_del_preservation[OF _ _ _ _,\n                                                    where P=valid_pdpt_objs, simplified]\n\ncrunch valid_pdpt_objs[wp]: cap_delete, cap_revoke \"valid_pdpt_objs\"\n  (rule: cap_revoke_preservation_valid_pdpt_objs)\n\ncrunch valid_pdpt_objs[wp]: invalidate_tlb_by_asid, page_table_mapped\n   \"valid_pdpt_objs\"\n\nlemma mapM_x_copy_pde_updates:\n  \"\\<lbrakk> \\<forall>x \\<in> set xs. f x && ~~ mask pd_bits = 0; is_aligned p pd_bits;\n               is_aligned p' pd_bits \\<rbrakk> \\<Longrightarrow>\n   \\<lbrace>\\<lambda>s. (\\<not> page_directory_at p s \\<longrightarrow> Q s) \\<and> (\\<not> page_directory_at p' s \\<longrightarrow> Q s) \\<and>\n        (\\<forall>pd pd'. ko_at (ArchObj (PageDirectory pd)) p s\n                \\<and> ko_at (ArchObj (PageDirectory pd')) p' s\n           \\<longrightarrow> Q (s \\<lparr> kheap := (kheap s) (p' := Some (ArchObj (PageDirectory (\\<lambda>y. if y \\<in> (\\<lambda>x.\n         ucast (f x && mask pd_bits >> 3)) ` set xs then pd y else pd' y)))) \\<rparr>))\\<rbrace>\n     mapM_x (\\<lambda>x. get_pde (p + f x) >>= store_pde (p' + f x)) xs\n   \\<lbrace>\\<lambda>_. Q\\<rbrace>\"\n  including no_pre\n  apply (induct xs)\n   apply (simp add: mapM_x_Nil)\n   apply wp\n   apply (clarsimp simp: obj_at_def fun_upd_idem dest!: a_type_pdD)\n  apply (simp add: mapM_x_Cons)\n  apply wp\n  apply (thin_tac \"valid P f Q\" for P f Q)\n  apply (simp add: store_pde_def set_pd_def set_object_def\n             cong: bind_cong split del: if_split)\n  apply (wp get_object_wp get_pde_wp)\n  apply (clarsimp simp: obj_at_def a_type_simps mask_out_add_aligned[symmetric]\n             split del: if_split)\n  apply (simp add: a_type_simps, safe)\n   apply (erule rsubst[where P=Q])\n   apply (rule abstract_state.fold_congs[OF refl refl])\n   apply (rule ext, clarsimp)\n   apply (rule ext, simp)\n  apply (erule rsubst[where P=Q])\n  apply (rule abstract_state.fold_congs[OF refl refl])\n  apply (rule ext, clarsimp simp add: vspace_bits_defs)\n  apply (rule ext, simp add: mask_add_aligned vspace_bits_defs)\n  done\n\nlemma copy_global_mappings_valid_pdpt_objs[wp]:\n  \"\\<lbrace>valid_pdpt_objs and valid_arch_state and pspace_aligned\n            and K (is_aligned p pd_bits)\\<rbrace>\n       copy_global_mappings p \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)\n  apply (simp add: copy_global_mappings_def)\n  apply wp\n  apply auto\n  done\n\nlemma in_pte_rangeD:\n  \"x \\<in> pte_range v y \\<Longrightarrow> x && ~~ mask 4 = y && ~~ mask 4\"\n  by (case_tac v,simp_all split:if_splits)\n\nlemma in_pde_rangeD:\n  \"x \\<in> pde_range v y \\<Longrightarrow> x && ~~ mask 4 = y && ~~ mask 4\"\n  by (case_tac v,simp_all split:if_splits)\n\nlemma mapM_x_store_pte_valid_pdpt2:\n  \"\\<lbrace>valid_pdpt_objs and K (is_aligned ptr pt_bits)\\<rbrace>\n     mapM_x (\\<lambda>x. store_pte x InvalidPTE) [ptr, ptr + 8 .e. ptr + 2 ^ pt_bits - 1]\n   \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)+\n  apply (rule mapM_x_wp')\n  apply (simp add:store_pte_def set_pt_def)\n  apply (wp get_pt_wp get_object_wp)\n  apply (clarsimp simp: mask_in_range\n    split:Structures_A.kernel_object.splits\n    arch_kernel_obj.splits)\n  apply (rule conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply (fastforce simp:ran_def obj_at_def)\n   apply simp\n  apply (simp add:fun_upd_def obj_at_def)\n  apply (rule entries_align_pte_update)\n   apply (drule (1) valid_pdpt_objs_ptD,simp)\n  apply simp\n  done\n\nlemma mapM_x_store_pde_valid_pdpt2:\n  \"\\<lbrace>valid_pdpt_objs and K (is_aligned pd pd_bits)\\<rbrace>\n       mapM_x (\\<lambda>x. store_pde ((x << 3) + pd) pde.InvalidPDE)\n        [0.e.(kernel_base >> 20) - 1]\n       \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)\n  apply (rule mapM_x_wp')\n  apply (simp add:store_pde_def set_pd_def)\n  apply (wp get_pd_wp get_object_wp)\n  apply (clarsimp simp: mask_in_range\n    split:Structures_A.kernel_object.splits\n    arch_kernel_obj.splits)\n  apply (rule conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply (fastforce simp:ran_def obj_at_def)\n   apply simp\n  apply (simp add:fun_upd_def obj_at_def)\n  apply (rule entries_align_pde_update)\n   apply (drule (1) valid_pdpt_objs_pdD,simp)\n  apply simp\n  done\n\nlemma non_invalid_in_pde_range:\n  \"pde \\<noteq> InvalidPDE\n  \\<Longrightarrow> x \\<in> pde_range pde x\"\n  by (case_tac pde,simp_all)\n\nlemma non_invalid_in_pte_range:\n  \"pte \\<noteq> InvalidPTE\n  \\<Longrightarrow> x \\<in> pte_range pte x\"\n  by (case_tac pte,simp_all)\n\ncrunch valid_pdpt_objs[wp]: cancel_badged_sends \"valid_pdpt_objs\"\n  (simp: crunch_simps filterM_mapM wp: crunch_wps ignore: filterM)\n\ncrunch valid_pdpt_objs[wp]: cap_move, cap_insert \"valid_pdpt_objs\"\n\nlemma invoke_cnode_valid_pdpt_objs[wp]:\n  \"\\<lbrace>valid_pdpt_objs and invs and valid_cnode_inv i\\<rbrace> invoke_cnode i \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: invoke_cnode_def)\n  apply (rule hoare_pre)\n   apply (wp get_cap_wp | wpc | simp split del: if_split)+\n  done\n\ncrunch valid_pdpt_objs[wp]: invoke_tcb \"valid_pdpt_objs\"\n  (wp: check_cap_inv crunch_wps simp: crunch_simps\n       ignore: check_cap_at)\n\nlemma invoke_domain_valid_pdpt_objs[wp]:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> invoke_domain t d \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  by (simp add: invoke_domain_def | wp)+\n\ncrunch valid_pdpt_objs[wp]: set_extra_badge, transfer_caps_loop \"valid_pdpt_objs\"\n  (rule: transfer_caps_loop_pres)\n\ncrunch valid_pdpt_objs[wp]: send_ipc, send_signal,\n    do_reply_transfer, invoke_irq_control, invoke_irq_handler \"valid_pdpt_objs\"\n  (wp: crunch_wps simp: crunch_simps\n         ignore: clearMemory const_on_failure set_object)\n\nlemma valid_pdpt_objs_trans_state[simp]: \"valid_pdpt_objs (trans_state f s) = valid_pdpt_objs s\"\n  apply (simp add: obj_valid_pdpt_def)\n  done\n\nlemma retype_region_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> retype_region ptr bits o_bits type dev \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: retype_region_def split del: if_split)\n  apply (wp | simp only: valid_pdpt_objs_trans_state trans_state_update[symmetric])+\n  apply (clarsimp simp: retype_addrs_fold foldr_upd_app_if ranI\n                 elim!: ranE split: if_split_asm simp del:fun_upd_apply)\n  apply (simp add: default_object_def default_arch_object_def\n            split: Structures_A.kernel_object.splits\n    Structures_A.apiobject_type.split aobject_type.split)+\n  apply (simp add:entries_align_def)\n  done\n\nlemma detype_valid_pdpt[elim!]:\n  \"valid_pdpt_objs s \\<Longrightarrow> valid_pdpt_objs (detype S s)\"\n  by (auto simp add: detype_def ran_def)\n\ncrunch valid_pdpt_objs[wp]: create_cap \"valid_pdpt_objs\"\n  (ignore: clearMemory simp: crunch_simps unless_def)\n\nlemma init_arch_objects_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and pspace_aligned and valid_arch_state\n           and K (\\<exists>us sz. orefs = retype_addrs ptr type n us\n               \\<and> range_cover ptr sz (obj_bits_api type us) n)\\<rbrace>\n     init_arch_objects type ptr n obj_sz orefs\n   \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_gen_asm)+\n  apply (clarsimp simp: init_arch_objects_def\n             split del: if_split)\n  apply (rule hoare_pre)\n   apply (wp | wpc)+\n     apply (rule_tac Q=\"\\<lambda>rv. valid_pdpt_objs and pspace_aligned and valid_arch_state\"\n                  in hoare_post_imp, simp)\n     apply (rule mapM_x_wp')\n     apply (rule hoare_pre, wp copy_global_mappings_valid_pdpt_objs)\n     apply clarsimp\n     apply (drule_tac sz=sz in retype_addrs_aligned)\n        apply (simp add:range_cover_def)\n       apply (drule range_cover.sz,simp add:word_bits_def)\n      apply (simp add:range_cover_def)\n     apply (clarsimp simp:obj_bits_api_def pd_bits_def pageBits_def\n       arch_kobj_size_def default_arch_object_def range_cover_def)+\n   apply wp\n  apply simp\n  done\n\nlemma delete_objects_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs\\<rbrace> delete_objects ptr bits \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  by (rule delete_objects_reduct) (wp detype_valid_pdpt)\n\ncrunch valid_pdpt[wp]: reset_untyped_cap \"valid_pdpt_objs\"\n  (wp: mapME_x_inv_wp crunch_wps simp: crunch_simps unless_def)\n\nlemma invoke_untyped_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and invs and ct_active\n          and valid_untyped_inv ui\\<rbrace>\n       invoke_untyped ui\n   \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_pre, rule invoke_untyped_Q)\n      apply (wp init_arch_objects_valid_pdpt | simp)+\n     apply (auto simp: post_retype_invs_def split: if_split_asm)[1]\n    apply (wp | simp)+\n  done\n\ncrunch valid_pdpt_objs[wp]: perform_asid_pool_invocation,\n     perform_asid_control_invocation \"valid_pdpt_objs\"\n  (ignore: delete_objects wp: delete_objects_valid_pdpt static_imp_wp)\n\nabbreviation (input)\n  \"safe_pt_range \\<equiv> \\<lambda>slots s. obj_at (\\<lambda>ko. \\<exists>pt. ko = ArchObj (PageTable pt)\n                                    \\<and> (\\<forall>x\\<in>set (tl slots). pt (ucast (x && mask pt_bits >> 3))\n                                      = pte.InvalidPTE))\n                              (hd slots && ~~ mask pt_bits) s\"\n\nabbreviation (input)\n  \"safe_pd_range \\<equiv> \\<lambda>slots s. obj_at (\\<lambda>ko. \\<exists>pd. ko = ArchObj (PageDirectory pd)\n                                    \\<and> (\\<forall>x\\<in>set (tl slots). pd (ucast (x && mask pd_bits >> 3))\n                                      = pde.InvalidPDE))\n                              (hd slots && ~~ mask pd_bits) s\"\n\ndefinition\n  \"page_inv_entries_pre entries \\<equiv>\n   let slots = (case entries of Inl (pte, slots) \\<Rightarrow> slots | Inr (pde, slots) \\<Rightarrow> slots)\n   in (if \\<exists>sl. slots = [sl]\n    then case entries of\n        Inl (pte, _) \\<Rightarrow> obj_at (\\<lambda>ko. \\<exists>pt pte. ko = ArchObj (PageTable pt)\n                     \\<and> pt (ucast (hd slots && mask pt_bits >> 3) && ~~ mask 4) = pte\n                     \\<and> pte_range_sz pte = 0)\n                 (hd slots && ~~ mask pt_bits)\n            and K (pte_range_sz pte = 0)\n      | Inr (pde, _) \\<Rightarrow> obj_at (\\<lambda>ko. \\<exists>pd pde. ko = ArchObj (PageDirectory pd)\n                     \\<and> pd (ucast (head slots && mask pd_bits >> 3) && ~~ mask 4)\n                            = pde \\<and> pde_range_sz pde = 0)\n                 (hd slots && ~~ mask pd_bits)\n           and K (pde_range_sz pde = 0)\n    else  (\\<lambda>s. (\\<exists>p. is_aligned p 7 \\<and> slots = map (\\<lambda>x. x + p) [0, 8 .e. 0x78])))\n   and K (case entries of Inl (pte,slots) \\<Rightarrow> pte \\<noteq> InvalidPTE\n     | Inr (pde,slots) \\<Rightarrow> pde \\<noteq> InvalidPDE)\"\n\ndefinition\n  \"page_inv_entries_safe entries \\<equiv>\n   let slots = (case entries of Inl (pte, slots) \\<Rightarrow> slots | Inr (pde, slots) \\<Rightarrow> slots)\n   in if \\<exists>sl. slots = [sl]\n    then case entries of\n        Inl (pte, _) \\<Rightarrow> obj_at (\\<lambda>ko. \\<exists>pt pte. ko = ArchObj (PageTable pt)\n                     \\<and> pt (ucast (hd slots && mask pt_bits >> 3) && ~~ mask 4) = pte\n                     \\<and> pte_range_sz pte = 0)\n                 (hd slots && ~~ mask pt_bits)\n            and K (pte_range_sz pte = 0)\n      | Inr (pde, _) \\<Rightarrow> obj_at (\\<lambda>ko. \\<exists>pd pde. ko = ArchObj (PageDirectory pd)\n                     \\<and> pd (ucast (head slots && mask pd_bits >> 3) && ~~ mask 4)\n                            = pde \\<and> pde_range_sz pde = 0)\n                 (hd slots && ~~ mask pd_bits)\n           and K (pde_range_sz pde = 0)\n    else  (\\<lambda>s. (\\<exists>p. is_aligned p 7 \\<and> slots = map (\\<lambda>x. x + p) [0, 8 .e. 0x78]\n                  \\<and> (case entries of\n                     Inl (pte, _) \\<Rightarrow> safe_pt_range slots s\n                   | Inr (pde, _) \\<Rightarrow> safe_pd_range slots s\n                     )))\"\n\ndefinition\n  \"page_inv_duplicates_valid iv \\<equiv> case iv of\n         PageMap asid cap ct_slot entries \\<Rightarrow>\n            page_inv_entries_safe entries\n       | _ \\<Rightarrow> \\<top>\"\n\nlemma pte_range_interD:\n \"pte_range pte p \\<inter> pte_range pte' p' \\<noteq> {}\n  \\<Longrightarrow> pte \\<noteq> InvalidPTE \\<and> pte' \\<noteq> InvalidPTE\n      \\<and> p && ~~ mask 4 = p' && ~~ mask 4\"\n  apply (drule int_not_emptyD)\n  apply (case_tac pte,simp_all split:if_splits)\n   apply (case_tac pte',simp_all split:if_splits)\n   apply clarsimp\n   apply (case_tac pte',simp_all split:if_splits)\n  apply (case_tac pte', simp_all split:if_splits)\n  done\n\nlemma pde_range_interD:\n \"pde_range pde p \\<inter> pde_range pde' p' \\<noteq> {}\n  \\<Longrightarrow> pde \\<noteq> InvalidPDE \\<and> pde' \\<noteq> InvalidPDE\n      \\<and> p && ~~ mask 4 = p' && ~~ mask 4\"\n  apply (drule int_not_emptyD)\n  apply (case_tac pde,simp_all split:if_splits)\n     apply (case_tac pde',simp_all split:if_splits)\n    apply (case_tac pde',simp_all split:if_splits)\n   apply clarsimp\n   apply (case_tac pde', simp_all split:if_splits)\n  apply (case_tac pde', simp_all split:if_splits)\n  done\n\nlemma pte_range_sz_le:\n  \"(pte_range_sz pte) \\<le> 4\"\n  by (case_tac pte,simp_all)\n\nlemma pde_range_sz_le:\n  \"(pde_range_sz pde) \\<le> 4\"\n  by (case_tac pde,simp_all)\n\n(* BUG , revisit the following lemmas , moved from ArchAcc_R.thy *)\nlemma mask_pd_bits_shift_ucast_align[simp]:\n  \"is_aligned (ucast (p && mask pd_bits >> 3)::11 word) 4 =\n   is_aligned ((p::word32) >> 3) 4\"\n  by (clarsimp simp: is_aligned_mask mask_def vspace_bits_defs) word_bitwise\n\nlemma mask_pt_bits_shift_ucast_align[simp]:\n  \"is_aligned (ucast (p && mask pt_bits >> 3)::9 word) 4 =\n   is_aligned ((p::word32) >> 3) 4\"\n  by (clarsimp simp: is_aligned_mask mask_def vspace_bits_defs)\n     word_bitwise\n\nlemma ucast_pt_index:\n  \"\\<lbrakk>is_aligned (p::word32) (4 + pte_bits)\\<rbrakk>\n   \\<Longrightarrow> ucast ((pa && mask 4) + (ucast (p && mask pt_bits >> pte_bits)::9 word))\n   =  ucast (pa && mask 4) + (p && mask pt_bits >> pte_bits)\"\n  apply (simp add:is_aligned_mask mask_def vspace_bits_defs)\n  apply word_bitwise\n  apply (auto simp: carry_def)\n  done\n\nlemma unat_ucast_9_32:\n  fixes x :: \"9 word\"\n  shows \"unat (ucast x :: word32) = unat x\"\n  unfolding ucast_def unat_def\n  apply (subst int_word_uint)\n  apply (subst mod_pos_pos_trivial)\n    apply simp\n   apply (rule lt2p_lem)\n   apply simp\n  apply simp\n  done\n\nlemma store_pte_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and page_inv_entries_safe (Inl (pte, slots))\\<rbrace>\n       store_pte (hd slots) pte \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_name_pre_state)\n  apply (clarsimp simp:page_inv_entries_safe_def split:if_splits)\n   apply (clarsimp simp:store_pte_def set_pt_def)\n   apply (wp get_pt_wp get_object_wp)\n   apply (clarsimp simp:obj_at_def pte_bits_def\n     split:pte.splits arch_kernel_obj.splits)\n  apply (rule conjI)\n    apply (drule(1) valid_pdpt_objs_ptD)\n    apply (rule valid_entries_overwrite_0)\n     apply simp\n    apply (case_tac pte)\n     apply simp+\n    apply (case_tac \"pta p\",simp_all)\n    apply (clarsimp simp: is_aligned_neg_mask_eq)\n   apply (simp add:fun_upd_def)\n   apply (rule entries_align_pte_update)\n    apply (drule (1) valid_pdpt_objs_ptD,simp)\n   apply simp\n  apply (simp add:hd_map_simp upto_enum_def upto_enum_step_def)\n  apply (clarsimp simp:store_pte_def set_pt_def)\n  apply (wp get_pt_wp get_object_wp)\n  apply (clarsimp simp:obj_at_def pte_bits_def\n     split:pte.splits arch_kernel_obj.splits)\n  apply (drule(1) valid_pdpt_objs_ptD)\n  apply (rule conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply simp\n   apply (rule ccontr)\n   apply (drule pte_range_interD)\n   apply clarsimp\n   apply (simp add:ucast_neg_mask)\n   apply (subst (asm) is_aligned_neg_mask_eq[where n = 4])\n    apply (rule is_aligned_shiftr[OF is_aligned_andI1])\n    apply simp\n   apply (drule_tac x = \"((p && ~~ mask pt_bits)  + ((ucast pa) << 3))\" in bspec)\n    apply (clarsimp simp: tl_map_simp upto_0_to_n2 image_def)\n    apply (rule_tac x = \"unat (((ucast pa)::word32) - (p && mask pt_bits >> 3))\" in bexI)\n     apply (simp add:ucast_nat_def shiftl_t2n mask_out_sub_mask)\n     apply (subst shiftl_t2n[where n = 3,simplified field_simps,simplified,symmetric])\n     apply (subst shiftr_shiftl1)\n      apply simp+\n     apply (subst is_aligned_neg_mask_eq)\n      apply (erule is_aligned_andI1[OF is_aligned_weaken])\n      apply simp\n     apply simp\n    apply simp\n    apply (drule_tac s = \"ucast (p && mask pt_bits >> 3)\" in sym)\n    apply (simp add:mask_out_sub_mask field_simps)\n    apply (drule_tac f = \"ucast::(9 word\\<Rightarrow>word32)\" in arg_cong)\n    apply (simp add: ucast_pt_index[simplified pte_bits_def])\n    apply (simp add:unat_ucast_9_32)\n    apply (rule conjI)\n     apply (subgoal_tac \"unat (pa && mask 4)\\<noteq> 0\")\n      apply simp\n     apply (simp add:unat_gt_0)\n    apply (rule unat_less_helper)\n    apply (rule le_less_trans[OF word_and_le1])\n    apply (simp add:mask_def)\n   apply (simp add:field_simps neg_mask_add_mask)\n   apply (thin_tac \"ucast y = x\" for y x)\n   apply (subst (asm) less_mask_eq[where n = pt_bits])\n    apply (rule shiftl_less_t2n)\n     apply (simp add:vspace_bits_defs)\n     apply word_bitwise\n    apply (simp add:vspace_bits_defs)\n   apply (subst (asm) shiftl_shiftr_id)\n    apply simp\n   apply (simp,word_bitwise)\n   apply (simp add:ucast_ucast_id)\n  apply (simp add:fun_upd_def entries_align_def)\n  apply (rule is_aligned_weaken[OF _ pte_range_sz_le])\n  apply (simp add:is_aligned_shiftr)\n  done\n\n\nlemma ucast_pd_index:\n  \"\\<lbrakk>is_aligned (p::word32) (4 + pde_bits)\\<rbrakk>\n   \\<Longrightarrow> ucast ((pa && mask 4) + (ucast (p && mask pd_bits >> pde_bits)::11 word))\n   =  ucast (pa && mask 4) + (p && mask pd_bits >> pde_bits)\"\n  apply (simp add:is_aligned_mask mask_def vspace_bits_defs)\n  apply word_bitwise\n  apply (auto simp:carry_def)\n  done\n\nlemma unat_ucast_11_32:\n  \"unat (ucast (x::(11 word))::word32) = unat x\"\n  apply (subst unat_ucast)\n  apply (rule mod_less)\n  apply (rule less_le_trans[OF unat_lt2p])\n  apply simp\n  done\n\nlemma ucast_pd_index11:\n  \"\\<lbrakk>is_aligned (p::word32) 7\\<rbrakk>\n   \\<Longrightarrow> ucast ((pa && mask 4) + (ucast (p && mask 14 >> 3)::11 word))\n   =  ucast (pa && mask 4) + (p && mask 14 >> 3)\"\n  apply (simp add:is_aligned_mask mask_def)\n  apply word_bitwise\n  apply (auto simp:carry_def)\n  done\n\n\nlemma store_pde_valid_pdpt:\n  \"\\<lbrace>valid_pdpt_objs and page_inv_entries_safe (Inr (pde, slots))\\<rbrace>\n       store_pde (hd slots) pde \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (rule hoare_name_pre_state)\n  apply (clarsimp simp:page_inv_entries_safe_def split:if_splits)\n   apply (clarsimp simp:store_pde_def set_pd_def)\n   apply (wp get_pd_wp get_object_wp)\n   apply (clarsimp simp:obj_at_def pde_bits_def\n     split:pde.splits arch_kernel_obj.splits)\n   apply (drule(1) valid_pdpt_objs_pdD)\n   apply (rule conjI)\n    apply (rule valid_entries_overwrite_0)\n     apply simp\n    apply (case_tac pde,simp_all)\n     apply (case_tac \"pda p\",simp_all)\n     apply (clarsimp simp: is_aligned_neg_mask_eq)\n    apply (case_tac \"pda p\",simp_all)\n    apply (clarsimp simp: is_aligned_neg_mask_eq)\n   apply (simp add:fun_upd_def)\n   apply (rule entries_align_pde_update)\n    apply simp+\n  apply (simp add:hd_map_simp upto_enum_def upto_enum_step_def)\n  apply (clarsimp simp:store_pde_def set_pd_def)\n  apply (wp get_pd_wp get_object_wp)\n  apply (clarsimp simp:obj_at_def pde_bits_def\n     split:pde.splits arch_kernel_obj.splits)\n  apply (drule(1) valid_pdpt_objs_pdD)\n  apply (rule conjI)\n   apply (rule valid_entries_overwrite_0)\n    apply simp\n   apply (rule ccontr)\n   apply (drule pde_range_interD)\n   apply clarsimp\n   apply (simp add:ucast_neg_mask)\n   apply (subst (asm) is_aligned_neg_mask_eq[where n = 4])\n    apply (rule is_aligned_shiftr[OF is_aligned_andI1])\n    apply simp\n   apply (drule_tac x = \"((p && ~~ mask pd_bits)  + ((ucast pa) << 3))\" in bspec)\n    apply (clarsimp simp: tl_map_simp upto_0_to_n2 image_def)\n    apply (rule_tac x = \"unat (((ucast pa)::word32) - (p && mask pd_bits >> 3))\" in bexI)\n     apply (simp add:ucast_nat_def shiftl_t2n mask_out_sub_mask)\n     apply (subst shiftl_t2n[where n = 3,simplified field_simps,simplified,symmetric])\n     apply (subst shiftr_shiftl1)\n      apply simp+\n     apply (subst is_aligned_neg_mask_eq)\n      apply (erule is_aligned_andI1[OF is_aligned_weaken])\n      apply simp\n     apply simp\n    apply simp\n    apply (drule_tac s = \"ucast (p && mask pd_bits >> 3)\" in sym)\n    apply (simp add:mask_out_sub_mask field_simps)\n    apply (drule_tac f = \"ucast::(11 word\\<Rightarrow>word32)\" in arg_cong)\n    apply (simp add:ucast_pd_index[simplified pde_bits_def])\n    apply (simp add:unat_ucast_11_32)\n    apply (rule conjI)\n     apply (subgoal_tac \"unat (pa && mask 4)\\<noteq> 0\")\n      apply simp\n     apply (simp add:unat_gt_0)\n    apply (rule unat_less_helper)\n    apply (rule le_less_trans[OF word_and_le1])\n    apply (simp add:mask_def)\n   apply (simp add:field_simps neg_mask_add_mask)\n   apply (thin_tac \"ucast y = x\" for y x)\n   apply (subst (asm) less_mask_eq[where n = pd_bits])\n    apply (rule shiftl_less_t2n)\n     apply (simp add:vspace_bits_defs)\n     apply word_bitwise\n    apply (simp add:vspace_bits_defs)\n   apply (subst (asm) shiftl_shiftr_id)\n     apply simp\n    apply (simp,word_bitwise)\n   apply (simp add:ucast_ucast_id)\n  apply (simp add:entries_align_def)\n  apply (rule is_aligned_weaken[OF _ pde_range_sz_le])\n  apply (simp add:is_aligned_shiftr)\n  done\n\n\nlemma set_cap_page_inv_entries_safe:\n  \"\\<lbrace>page_inv_entries_safe x\\<rbrace> set_cap y z \\<lbrace>\\<lambda>_. page_inv_entries_safe x\\<rbrace>\"\n  apply (simp add:page_inv_entries_safe_def set_cap_def split_def\n    get_object_def set_object_def)\n  apply (wp | wpc)+\n  apply (case_tac x)\n  apply (auto simp:obj_at_def\n    Let_def split:if_splits option.splits)\n  done\n\ncrunch inv[wp]: pte_check_if_mapped, pde_check_if_mapped \"\\<lambda>s. P s\"\n\nlemma perform_page_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and valid_page_inv pinv and page_inv_duplicates_valid pinv\\<rbrace>\n        perform_page_invocation pinv \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: perform_page_invocation_def page_inv_duplicates_valid_def)\n  apply (cases pinv,\n         simp_all add: mapM_discarded page_inv_entries_safe_def\n            split: sum.split arch_cap.split option.split,\n         safe intro!: hoare_gen_asm hoare_gen_asm[unfolded K_def],\n         simp_all add: mapM_x_Nil mapM_x_Cons mapM_x_map)\n            apply (wp store_pte_valid_pdpt store_pde_valid_pdpt get_master_pte_wp get_master_pde_wp\n                      store_pte_non_master_valid_pdpt store_pde_non_master_valid_pdpt\n                      mapM_x_wp'[OF store_invalid_pte_valid_pdpt\n                        [where pte=pte.InvalidPTE, simplified]]\n                      mapM_x_wp'[OF store_invalid_pde_valid_pdpt\n                        [where pde=pde.InvalidPDE, simplified]]\n                      set_cap_page_inv_entries_safe\n                      hoare_vcg_imp_lift[OF set_cap_arch_obj_neg] hoare_vcg_all_lift\n                 | clarsimp simp: cte_wp_at_weakenE[OF _ TrueI] obj_at_def\n                                  pte_range_sz_def pde_range_sz_def swp_def valid_page_inv_def\n                                  valid_slots_def page_inv_entries_safe_def pte_check_if_mapped_def\n                                  pde_check_if_mapped_def\n                           split: pte.splits pde.splits\n                 | wp (once) hoare_drop_imps)+\n  done\n\ndefinition\n  \"pti_duplicates_valid iv \\<equiv>\n   case iv of PageTableMap cap ct_slot pde pd_slot\n     \\<Rightarrow> obj_at (\\<lambda>ko. \\<exists>pd pde. ko = ArchObj (PageDirectory pd)\n                     \\<and> pd (ucast (pd_slot && mask pd_bits >> 3) && ~~ mask 4)\n                            = pde \\<and> pde_range_sz pde = 0)\n                 (pd_slot && ~~ mask pd_bits)\n\n           and K (pde_range_sz pde = 0)\n  | _ \\<Rightarrow> \\<top>\"\n\n\ndefinition\n  \"invocation_duplicates_valid i \\<equiv>\n   case i of\n     InvokeArchObject (InvokePage pinv) \\<Rightarrow> page_inv_duplicates_valid pinv\n   | InvokeArchObject (InvokePageTable pti) \\<Rightarrow> pti_duplicates_valid pti\n   | _ \\<Rightarrow> \\<top>\"\n\nlemma perform_page_table_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and valid_pti pinv and pti_duplicates_valid pinv\\<rbrace>\n      perform_page_table_invocation pinv \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: perform_page_table_invocation_def split_def vspace_bits_defs\n             cong: page_table_invocation.case_cong\n                   option.case_cong cap.case_cong arch_cap.case_cong)\n  apply (rule hoare_pre)\n   apply (wp store_pde_non_master_valid_pdpt hoare_vcg_ex_lift\n             set_cap_arch_obj mapM_x_store_pte_valid_pdpt2[simplified vspace_bits_defs, simplified]\n              | wpc\n              | simp add: swp_def\n              | strengthen all_imp_ko_at_from_ex_strg)+\n  apply (clarsimp simp: pti_duplicates_valid_def valid_pti_def)\n  apply (auto simp: obj_at_def cte_wp_at_caps_of_state valid_cap_simps\n                    cap_aligned_def vspace_bits_defs\n            intro!: inj_onI)\n  done\n\nlemma perform_page_directory_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and valid_pdi pinv\\<rbrace>\n      perform_page_directory_invocation pinv \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: perform_page_directory_invocation_def split_def)\n  apply (rule hoare_pre)\n   apply (wp | wpc | simp)+\n  done\n\ncrunch valid_pdpt_objs[wp]: perform_vcpu_invocation \"valid_pdpt_objs\"\n  (ignore: delete_objects wp: delete_objects_valid_pdpt static_imp_wp)\n\n\nlemma perform_invocation_valid_pdpt[wp]:\n  \"\\<lbrace>invs and ct_active and valid_invocation i and valid_pdpt_objs\n           and invocation_duplicates_valid i\\<rbrace>\n      perform_invocation blocking call i\n         \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (cases i, simp_all)\n  apply (wp send_signal_interrupt_states | simp)+\n  apply (clarsimp simp: invocation_duplicates_valid_def)\n  apply (wp | wpc | simp)+\n  apply (simp add: arch_perform_invocation_def)\n  apply (rule hoare_pre)\n  apply (wp | wpc | simp)+\n  apply (auto simp: valid_arch_inv_def invocation_duplicates_valid_def)\n  done\n\nlemma neg_mask_pt_7_4:\n  \"(ptr && mask pt_bits >> 3) && ~~ mask 4 =\n   (ptr::word32) && ~~ mask 7 && mask pt_bits >> 3\"\n  apply (simp add:vspace_bits_defs)\n  apply word_bitwise\n  apply (simp add:word_size)\n  done\n\nlemma neg_mask_pd_7_4:\n  \"(ptr && mask pd_bits >> 3) && ~~ mask 4 =\n   (ptr::word32) && ~~ mask 7 && mask pd_bits >> 3\"\n  apply (simp add:pd_bits_def pageBits_def)\n  apply word_bitwise\n  apply (simp add:word_size)\n  done\n\nlemma mask_out_same_pt:\n  \"\\<lbrakk>is_aligned p 7; x < 2 ^ 7 \\<rbrakk> \\<Longrightarrow> p + x && ~~ mask pt_bits = p && ~~ mask pt_bits\"\n  apply (subst mask_lower_twice[symmetric,where n = 7])\n   apply (simp add:vspace_bits_defs)\n  apply (simp add:is_aligned_add_helper)\n  done\n\nlemma mask_out_same_pd:\n  \"\\<lbrakk>is_aligned p 7; x < 2 ^ 7 \\<rbrakk> \\<Longrightarrow> p + x && ~~ mask pd_bits = p && ~~ mask pd_bits\"\n  apply (subst mask_lower_twice[symmetric,where n = 7])\n   apply (simp add:pd_bits_def pageBits_def)\n  apply (simp add:is_aligned_add_helper)\n  done\n\nlemma ensure_safe_mapping_ensures[wp]:\n  \"\\<lbrace>valid_pdpt_objs and (case entries of (Inl (SmallPagePTE _ _ _, [_])) \\<Rightarrow> \\<top>\n                  | (Inl (SmallPagePTE _ _ _, _)) \\<Rightarrow> \\<bottom>\n                  | (Inl (LargePagePTE _ _ _, [])) \\<Rightarrow> \\<bottom>\n                  | (Inr (SectionPDE _ _ _, [_])) \\<Rightarrow> \\<top>\n                  | (Inr (SuperSectionPDE _ _ _, [])) \\<Rightarrow> \\<bottom>\n                  | (Inr (SectionPDE _ _ _, _)) \\<Rightarrow> \\<bottom>\n                  | _ \\<Rightarrow> page_inv_entries_pre entries)\\<rbrace>\n     ensure_safe_mapping entries\n   \\<lbrace>\\<lambda>rv. page_inv_entries_safe entries\\<rbrace>,-\"\n  proof -\n    have [simp]:\n      \"\\<And>s a. page_inv_entries_pre (Inl (pte.InvalidPTE, a)) s \\<Longrightarrow>\n      page_inv_entries_safe (Inl (pte.InvalidPTE, a)) s\"\n      apply (clarsimp simp:page_inv_entries_pre_def page_inv_entries_safe_def\n        split:if_splits)\n      done\n    have name_pre:\n      \"\\<And>F P Q. (\\<And>s. P s \\<Longrightarrow> \\<lbrace>(=) s \\<rbrace> F \\<lbrace>Q\\<rbrace>, -) \\<Longrightarrow> \\<lbrace>P\\<rbrace> F \\<lbrace>Q\\<rbrace>,-\"\n      apply (simp add:validE_R_def validE_def)\n      apply (rule hoare_name_pre_state)\n      apply assumption\n      done\n    have mask_neg_mask_order[simp]:\n      \"\\<And>a m n. a && ~~ mask m && mask n = a && mask n && ~~ mask m\"\n       by (simp add:word_bw_comms word_bw_lcs)\n    have align_entry_ptD:\n      \"\\<And>pt m x xb xc. \\<lbrakk>pt m = pte.LargePagePTE x xb xc; entries_align pte_range_sz pt\\<rbrakk>\n       \\<Longrightarrow> is_aligned m 4\"\n      apply (simp add:entries_align_def)\n      apply (drule_tac x = m in spec,simp)\n      done\n    have align_entry_pdD:\n      \"\\<And>pd m x xb xc. \\<lbrakk>pd m = pde.SuperSectionPDE x xb xc; entries_align pde_range_sz pd\\<rbrakk>\n       \\<Longrightarrow> is_aligned m 4\"\n      apply (simp add:entries_align_def)\n      apply (drule_tac x = m in spec,simp)\n      done\n    have pt_offset_bitwise[simp]:\"\\<And>a. (ucast ((a::word32) && mask pt_bits && ~~ mask 7  >> 3)::9 word)\n      = (ucast (a  && mask pt_bits >> 3)::9 word) && ~~ mask 4\"\n    apply (simp add: vspace_bits_defs mask_def)\n    apply word_bitwise\n    done\n    have pt_offset_bitwise_pt_bits[simp]:\"\\<And>a. (ucast ((a::word32) && mask pt_bits && ~~ mask 7  >> pte_bits)::9 word)\n      = (ucast (a  && mask pt_bits >> 3)::9 word) && ~~ mask 4\"\n    by (simp add: pte_bits_def)\n    have pd_offset_bitwise[simp]:\"\\<And>a. (ucast ((a::word32) && mask pd_bits && ~~ mask 7  >> 3)::11 word)\n      = (ucast (a  && mask pd_bits >> 3)::11 word) && ~~ mask 4\"\n    apply (simp add: vspace_bits_defs mask_def)\n    apply word_bitwise\n    done\n    have pd_offset_bitwise_pt_bits[simp]:\"\\<And>a. (ucast ((a::word32) && mask pd_bits && ~~ mask 7  >> pde_bits)::11 word)\n      = (ucast (a  && mask pd_bits >> 3)::11 word) && ~~ mask 4\"\n    by (simp add: pde_bits_def)\n    have mask_neq_0:\n      \"\\<And>z zs xa p g. \\<lbrakk>[0 :: word32, 8 .e. 0x78] = z # zs; xa \\<in> set zs; is_aligned p 7; 7 \\<le> g\\<rbrakk>\n         \\<Longrightarrow> (p + xa && mask g >> 3) && mask 4 \\<noteq> 0\"\n     apply (rule ccontr)\n      apply (simp add:is_aligned_mask[symmetric])\n       apply (drule is_aligned_shiftl[where n = 7 and m = 3,simplified])\n      apply (subst (asm) shiftr_shiftl1)\n       apply simp+\n      apply (subst (asm) is_aligned_neg_mask_eq)\n       apply (rule is_aligned_andI1)\n       apply (erule aligned_add_aligned)\n        apply (clarsimp simp :upto_enum_def upto_enum_step_def\n         Fun.comp_def upto_0_to_n2 is_aligned_mult_triv2[where n = 3,simplified])\n       apply simp\n      apply (simp add:is_aligned_mask mask_twice\n        pt_bits_def pageBits_def min_def)\n      apply (subst (asm) is_aligned_mask[symmetric])\n      apply (subst (asm) is_aligned_add_helper)\n       apply simp\n      apply (clarsimp simp :upto_enum_def upto_enum_step_def\n         Fun.comp_def upto_0_to_n2)\n      apply (subst shiftl_t2n\n        [where n = 3,simplified field_simps,simplified,symmetric])+\n      apply (rule shiftl_less_t2n[where m = 7,simplified])\n       apply (rule word_of_nat_less)\n       apply simp\n      apply simp\n     apply (clarsimp simp :upto_enum_def upto_enum_step_def\n         Fun.comp_def upto_0_to_n2)\n     apply (cut_tac x = \"of_nat x\" and n = 3 in word_power_nonzero_32)\n        apply (simp add:word_of_nat_less word_bits_def)+\n      apply (simp add: of_nat_neq_0)\n     apply simp\n     done\n    have neq_pt_offset: \"\\<And>z zs xa (p::word32). \\<lbrakk>[0 , 8 .e. 0x78] = z # zs;\n        xa \\<in> set zs;is_aligned p 7 \\<rbrakk> \\<Longrightarrow>\n        ucast (p + xa && mask pt_bits >> 3) && ~~ mask 4 \\<noteq> ((ucast (p + xa && mask pt_bits >> 3))::9 word)\"\n      apply (rule ccontr)\n      apply (simp add:mask_out_sub_mask ucast_and_mask[symmetric])\n      apply (drule arg_cong[where f = unat])\n      apply (simp add:unat_ucast)\n      apply (subst (asm) mod_less)\n       apply (rule unat_less_helper)\n       apply (rule le_less_trans[OF word_and_le1])\n       apply (simp add:mask_def)\n      apply (simp add:unat_eq_0)\n      apply (drule(2) mask_neq_0[of _ _ _ _ pt_bits])\n       apply (simp add:pt_bits_def pageBits_def)+\n      done\n    have neq_pd_offset: \"\\<And>z zs xa (p::word32). \\<lbrakk>[0 , 8 .e. 0x78] = z # zs;\n        xa \\<in> set zs;is_aligned p 7 \\<rbrakk> \\<Longrightarrow>\n        ucast (p + xa && mask pd_bits >> 3) && ~~ mask 4 \\<noteq> ((ucast (p + xa && mask pd_bits >> 3)) :: 11 word)\"\n      apply (simp add:mask_out_sub_mask)\n      apply (rule ccontr)\n      apply (simp add:mask_out_sub_mask ucast_and_mask[symmetric])\n      apply (drule arg_cong[where f = unat])\n      apply (simp add:unat_ucast)\n      apply (subst (asm) mod_less)\n       apply (rule unat_less_helper)\n       apply (rule le_less_trans[OF word_and_le1])\n       apply (simp add:mask_def)\n      apply (simp add:unat_eq_0)\n      apply (drule(2) mask_neq_0[of _ _ _ _ pd_bits])\n       apply (simp add:pd_bits_def pageBits_def)+\n      done\n    have invalid_pteI:\n      \"\\<And>a pt x y z. \\<lbrakk>valid_pt_entries pt; (a && ~~ mask 4) \\<noteq> a;\n       pt (a && ~~ mask 4) = pte.LargePagePTE x y z \\<rbrakk>\n       \\<Longrightarrow> pt a = pte.InvalidPTE\"\n      apply (drule(1) valid_entriesD[rotated])\n      apply (case_tac \"pt a\"; simp add:mask_lower_twice is_aligned_neg_mask split:if_splits)\n      done\n    have invalid_pdeI:\n      \"\\<And>a pd x y z. \\<lbrakk>valid_pd_entries pd; (a && ~~ mask 4) \\<noteq> a;\n       pd (a && ~~ mask 4) = pde.SuperSectionPDE x y z \\<rbrakk>\n       \\<Longrightarrow> pd a = pde.InvalidPDE\"\n      apply (drule(1) valid_entriesD[rotated])\n      apply (case_tac \"pd a\",\n        simp_all add:mask_lower_twice is_aligned_neg_mask\n        split:if_splits)\n      done\n    have inj[simp]:\n      \"\\<And>p. is_aligned (p::word32) 7 \\<Longrightarrow> inj_on (\\<lambda>x. toEnum x * 8 + p) {Suc 0..<16}\"\n      apply (clarsimp simp:inj_on_def)\n      apply (subst (asm) shiftl_t2n[where n = 3,simplified field_simps,simplified,symmetric])+\n      apply (drule arg_cong[where f = \"\\<lambda>x. x >> 3\"])\n      apply (simp add:shiftl_shiftr_id word_of_nat_less)\n      apply (simp add:of_nat_inj)\n      done\n\n  show ?thesis\n  apply (rule name_pre)\n  apply (case_tac entries)\n   apply (case_tac a, case_tac aa)\n     apply (simp add:page_inv_entries_pre_def page_inv_entries_safe_def\n       | wp | intro conjI impI)+\n     apply (simp split:list.splits add:page_inv_entries_pre_def)+\n    apply (rename_tac obj_ref vm_attributes cap_rights slot slots)\n    apply (elim conjE exE)\n    apply (subst mapME_x_Cons)\n    apply simp\n    apply wp\n     apply (rule_tac Q' = \"\\<lambda>r s. \\<forall>x \\<in> set slots. obj_at\n                (\\<lambda>ko. \\<exists>pt. ko = ArchObj (PageTable pt) \\<and>\n                 pt (ucast (x && mask pt_bits >> 3)) = pte.InvalidPTE)\n                (hd (slot # slots) && ~~ mask pt_bits) s\" in hoare_post_imp_R)\n      apply (wp mapME_x_accumulate_checks[where Q = \"\\<lambda>s. valid_pdpt_objs s\"] )\n          apply (wp get_master_pte_wp| wpc | simp)+\n         apply clarsimp\n         apply (frule_tac x = xa in mask_out_same_pt)\n          apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n          apply (erule notE)\n          apply (subst shiftl_t2n[where n = 3,simplified field_simps,simplified,symmetric])\n          apply (rule shiftl_less_t2n[where m = 7,simplified])\n           apply (simp add:word_of_nat_less)\n          apply simp\n         apply (frule_tac x = z in mask_out_same_pt)\n          apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n         apply (clarsimp simp:field_simps obj_at_def\n           split:pte.splits)\n         apply (intro conjI impI)\n             apply (clarsimp simp: pte_bits_def)\n            apply (drule(1) valid_pdpt_objs_ptD)\n            apply (clarsimp simp:  word_bool_alg.conj_assoc)\n            apply (frule align_entry_ptD,simp)\n            apply (clarsimp simp: is_aligned_neg_mask_eq[of _ 4] pte_bits_def)\n           apply clarsimp\n           apply (drule(1) valid_pdpt_objs_ptD,clarify)\n           apply (erule(4) invalid_pteI[OF _ neq_pt_offset])\n          apply (clarsimp simp: pte_bits_def)\n         apply (clarsimp simp:  pte_bits_def)\n         apply (drule(1) valid_pdpt_objs_ptD)\n         apply (frule align_entry_ptD,simp)\n         apply (simp add: is_aligned_neg_mask_eq)\n        apply (wp hoare_drop_imps |wpc|simp)+\n      apply (clarsimp simp:upto_enum_def upto_enum_step_def\n        upto_0_to_n2 Fun.comp_def distinct_map)\n     apply (intro exI conjI,fastforce+)\n     apply (simp add:obj_at_def hd_map_simp\n         upto_0_to_n2 upto_enum_def upto_enum_step_def)\n     apply (frule_tac x = 1 in bspec,fastforce+)\n    apply ((wp hoare_drop_imps |wpc|simp)+)[1]\n   apply (simp add:page_inv_entries_pre_def page_inv_entries_safe_def\n       | wp | intro conjI impI)+\n    apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton)\n    apply (wp get_master_pte_wp |wpc | simp)+\n    apply (clarsimp simp:obj_at_def split:pte.splits)\n   apply (clarsimp simp:page_inv_entries_safe_def split:list.splits)\n  apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton)\n  apply (case_tac b,case_tac a)\n     apply ((simp add:page_inv_entries_pre_def page_inv_entries_safe_def\n       | wp | intro conjI impI)+)[1]\n    apply simp\n    apply wp[1]\n   apply (simp split:list.splits add:page_inv_entries_pre_def mapME_singleton)\n   apply (wp get_master_pde_wp | wpc | simp)+\n   apply (clarsimp simp:obj_at_def page_inv_entries_safe_def pde_bits_def\n     split:pde.splits)\n  apply (simp split:list.splits if_splits\n    add:page_inv_entries_pre_def Let_def page_inv_entries_safe_def)\n  apply (elim conjE exE)\n  apply (subst mapME_x_Cons)\n  apply simp\n  apply wp\n   apply (rule_tac Q' = \"\\<lambda>r s. \\<forall>x \\<in> set x22. obj_at\n       (\\<lambda>ko. \\<exists>pd. ko = ArchObj (PageDirectory pd) \\<and>\n       pd (ucast (x && mask pd_bits >> 3)) = pde.InvalidPDE)\n       (hd (x21 # x22) && ~~ mask pd_bits) s\" in hoare_post_imp_R)\n    apply (wp mapME_x_accumulate_checks[where Q = \"\\<lambda>s. valid_pdpt_objs s\"] )\n        apply (wp get_master_pde_wp| wpc | simp)+\n       apply clarsimp\n       apply (frule_tac x = xa in mask_out_same_pd)\n        apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n        apply (erule notE)\n        apply (subst shiftl_t2n[where n = 3,simplified field_simps,simplified,symmetric])\n        apply (rule shiftl_less_t2n[where m = 7,simplified])\n         apply (simp add:word_of_nat_less)\n        apply simp\n       apply (frule_tac x = z in mask_out_same_pd)\n        apply (clarsimp simp:upto_enum_def upto_enum_step_def upto_0_to_n2)\n       apply (clarsimp simp:field_simps obj_at_def\n           split:pde.splits)\n       apply (drule(1) valid_pdpt_objs_pdD)\n       apply (intro conjI impI; clarsimp simp: pde_bits_def)\n          apply (frule align_entry_pdD,simp)\n          apply (clarsimp simp: is_aligned_neg_mask_eq pde_bits_def)\n         apply (frule(1) align_entry_pdD)\n         apply (simp add:is_aligned_neg_mask_eq)\n        apply (frule(1) align_entry_pdD)\n        apply (simp add:is_aligned_neg_mask_eq)\n       apply (frule(1) align_entry_pdD)\n       apply (erule(4) invalid_pdeI[OF _ neq_pd_offset])\n      apply (wp hoare_drop_imps |wpc|simp)+\n    apply (clarsimp simp:upto_enum_def upto_enum_step_def\n        upto_0_to_n2 Fun.comp_def distinct_map)\n   apply (intro exI conjI,fastforce+)\n   apply (simp add:obj_at_def hd_map_simp\n     upto_0_to_n2 upto_enum_def upto_enum_step_def)\n   apply (frule_tac x = 1 in bspec,fastforce+)\n  apply (wp get_master_pde_wp | simp | wpc)+\n  done\nqed\n\nlemma create_mapping_entries_safe[wp]:\n  \"\\<lbrace>\\<exists>\\<rhd>pd and K (vmsz_aligned vptr sz) and K (is_aligned pd pd_bits)\n          and K (vptr < kernel_base)\n          and valid_vspace_objs and pspace_aligned and\n          (\\<exists>\\<rhd> (lookup_pd_slot pd vptr && ~~ mask pd_bits))\\<rbrace>\n      create_mapping_entries ptr vptr sz rights attrib pd\n   \\<lbrace>\\<lambda>entries. case entries of (Inl (SmallPagePTE _ _ _, [_])) \\<Rightarrow> \\<top>\n                  | (Inl (SmallPagePTE _ _ _, _)) \\<Rightarrow> \\<bottom>\n                  | (Inl (LargePagePTE _ _ _, [])) \\<Rightarrow> \\<bottom>\n                  | (Inr (SectionPDE _ _ _, [_])) \\<Rightarrow> \\<top>\n                  | (Inr (SectionPDE _ _ _, _)) \\<Rightarrow> \\<bottom>\n                  | (Inr (SuperSectionPDE _ _ _, [])) \\<Rightarrow> \\<bottom>\n                  | _ \\<Rightarrow> page_inv_entries_pre entries\\<rbrace>,-\"\n  apply (cases sz, simp_all add: largePagePTE_offsets_def superSectionPDE_offsets_def)\n     defer 2\n     apply (wp | simp)+\n   apply (simp split:list.split)\n   apply (subgoal_tac \"lookup_pd_slot pd vptr \\<le> lookup_pd_slot pd vptr + 0x78\")\n    apply (clarsimp simp:upto_enum_def not_less upto_enum_step_def vspace_bits_defs\n      page_inv_entries_pre_def Let_def)\n    apply (clarsimp simp:upto_enum_step_def upto_enum_def\n                     map_eq_Cons_conv upt_eq_Cons_conv)\n    apply (drule_tac x = \"lookup_pd_slot pd vptr\" in spec)\n    apply (subst (asm) upto_0_to_n2)\n     apply simp\n    apply clarsimp\n    apply (drule lookup_pd_slot_aligned_6)\n     apply (simp add: vspace_bits_defs)\n    apply simp\n   apply clarsimp\n   apply (erule is_aligned_no_wrap'[OF lookup_pd_slot_aligned_6])\n    apply (simp add: vspace_bits_defs)\n   apply simp\n  apply (wp get_pde_wp | simp add:lookup_pt_slot_def | wpc)+\n  apply (clarsimp simp:upto_enum_def upto_enum_step_def\n    page_inv_entries_pre_def Let_def )\n  apply (drule_tac ref = refa in valid_vspace_objsD)\n    apply (simp add:obj_at_def)\n   apply simp\n  apply (simp add: vspace_bits_defs)\n  apply (drule_tac x = \"ucast (lookup_pd_slot pd vptr && mask pd_bits >> 3)\"\n    in spec)\n  apply (simp add: vspace_bits_defs)\n  apply (clarsimp simp:not_less[symmetric] split:list.splits)\n  apply (clarsimp simp:page_inv_entries_pre_def\n    Let_def upto_enum_step_def upto_enum_def)\n  apply (subst (asm) upto_0_to_n2)\n   apply simp\n  apply (clarsimp simp:not_less[symmetric])\n  apply (subgoal_tac\n    \"(\\<exists>xa xb. pda (ucast (lookup_pd_slot pd vptr && mask pd_bits >> 3))\n     = pde.PageTablePDE x)\n     \\<longrightarrow> is_aligned (ptrFromPAddr x + ((vptr >> 12) && 0x1FF << 3)) 7\")\n   apply (clarsimp simp: vspace_bits_defs)\n   apply (rule_tac x=\"ptrFromPAddr x + ((vptr >> 12) && 0x1FF << 3)\" in exI)\n   apply (subst map_upt_append[where x=15 and y=16]; simp add: mask_def)\n  apply clarsimp\n  apply (rule aligned_add_aligned)\n    apply (erule(1) pt_aligned)\n   apply (rule is_aligned_shiftl[OF is_aligned_andI1])\n   apply (rule is_aligned_shiftr)\n   apply (simp add:vmsz_aligned_def)\n  apply simp\n  done\n\nlemma decode_mmu_invocation_valid_pdpt[wp]:\n  \"\\<lbrace>invs and valid_cap (cap.ArchObjectCap cap) and valid_pdpt_objs \\<rbrace>\n     decode_mmu_invocation label args cap_index slot cap excaps\n   \\<lbrace>invocation_duplicates_valid o Invocations_A.InvokeArchObject\\<rbrace>, -\"\n  proof -\n    have bitwise:\"\\<And>a. (ucast (((a::word32) && ~~ mask 7) && mask 14 >> 3)::11 word)\n      = (ucast (a  && mask 14 >> 3)::11 word) && ~~ mask 4\"\n      apply (simp add:mask_def)\n      apply word_bitwise\n      done\n    have sz:\n      \"\\<And>vmpage_size. \\<lbrakk>args ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 < kernel_base;\n        vmsz_aligned (args ! 0) vmpage_size\\<rbrakk>\n       \\<Longrightarrow> args ! 0 < kernel_base\"\n      apply (rule le_less_trans[OF is_aligned_no_overflow])\n       apply (simp add:vmsz_aligned_def)\n      apply simp\n      done\n  show ?thesis\n    supply if_split[split del]\n    apply (simp add: decode_mmu_invocation_def)\n    \\<comment> \\<open>Handle the easy cases first (trivial because of the post-condition invocation_duplicates_valid)\\<close>\n    apply (cases \"invocation_type label \\<notin> {ArchInvocationLabel ARMPageTableMap,\n                                           ArchInvocationLabel ARMPageMap}\")\n     apply (wpsimp simp: invocation_duplicates_valid_def page_inv_duplicates_valid_def\n                         pti_duplicates_valid_def Let_def\n                   cong: if_cong)\n    \\<comment> \\<open>Handle the two interesting cases now\\<close>\n    apply (clarsimp; erule disjE; cases cap;\n           simp add: isPDFlushLabel_def isPageFlushLabel_def throwError_R')\n       \\<comment> \\<open>PageTableMap\\<close>\n       apply (wpsimp simp: Let_def get_master_pde_def\n                       wp: get_pde_wp hoare_drop_imps hoare_vcg_if_lift_ER)\n       apply (clarsimp simp: invocation_duplicates_valid_def pti_duplicates_valid_def\n                             mask_lower_twice bitwise obj_at_def vspace_bits_defs if_apply_def2\n                      split: if_splits)\n      apply wp\n     \\<comment> \\<open>PageMap\\<close>\n     apply (rename_tac dev pg_ptr rights sz pg_map)\n     apply (wpsimp simp: Let_def invocation_duplicates_valid_def page_inv_duplicates_valid_def\n                     wp: ensure_safe_mapping_ensures[THEN hoare_post_imp_R]\n                         check_vp_wpR hoare_vcg_if_lift_ER find_pd_for_asid_lookup_pd_wp)\n     apply (fastforce simp: invs_psp_aligned page_directory_at_aligned_pd_bits word_not_le sz\n                            valid_cap_def valid_arch_cap_def lookup_pd_slot_eq\n                     split: if_splits)\n    apply wp\n    done\nqed\n\nlemma returnOk_lift :\n  assumes P': \"\\<forall>s. P rv s\"\n  shows \"\\<lbrace>Q\\<rbrace> (doE y \\<leftarrow> f ; returnOk rv odE) \\<lbrace>P\\<rbrace>, -\"\n  by (wp,auto simp: returnOk_def return_def validE_R_def validE_def valid_def P')\n\nlemma decode_vcpu_invocation_valid_pdpt[wp]:\n  \"\\<lbrace>Q\\<rbrace>\n     decode_vcpu_invocation label args vcap excaps\n   \\<lbrace>invocation_duplicates_valid o Invocations_A.InvokeArchObject\\<rbrace>, -\"\n  apply (simp add: decode_vcpu_invocation_def)\n  apply (wpsimp simp: decode_vcpu_set_tcb_def\n                      decode_vcpu_inject_irq_def decode_vcpu_read_register_def\n                      decode_vcpu_write_register_def decode_vcpu_ack_vppi_def\n                      if_apply_def2\n    | simp add: invocation_duplicates_valid_def)+\n  done\n\nlemma arch_decode_invocation_valid_pdpt[wp]:\n  notes find_pd_for_asid_inv[wp del]\n  shows\n  \"\\<lbrace>invs and valid_cap (cap.ArchObjectCap cap) and valid_pdpt_objs \\<rbrace>\n   arch_decode_invocation label args cap_index slot cap excaps\n   \\<lbrace>invocation_duplicates_valid o Invocations_A.InvokeArchObject\\<rbrace>,-\"\n  proof -\n  show ?thesis\n    apply (simp add: arch_decode_invocation_def)\n    apply (rule hoare_pre)\n     apply (wp | wpc)+\n    apply auto\n    done\nqed\n\nlemma decode_invocation_valid_pdpt[wp]:\n  \"\\<lbrace>invs and valid_cap cap and valid_pdpt_objs\\<rbrace>\n     decode_invocation label args cap_index slot cap excaps\n   \\<lbrace>invocation_duplicates_valid\\<rbrace>,-\"\n  apply (simp add: decode_invocation_def split del: if_split)\n  apply (rule hoare_pre)\n   apply (wp | wpc\n            | simp only: invocation_duplicates_valid_def o_def uncurry_def split_def\n                         Invocations_A.invocation.simps)+\n  apply clarsimp\n  done\n\ncrunch valid_pdpt_objs[wp]: handle_fault, reply_from_kernel \"valid_pdpt_objs\"\n  (simp: crunch_simps wp: crunch_wps)\n\n\nlemma invocation_duplicates_valid_exst_update[simp]:\n  \"invocation_duplicates_valid i (trans_state f s) = invocation_duplicates_valid i s\"\n  apply (clarsimp simp add: invocation_duplicates_valid_def pti_duplicates_valid_def page_inv_duplicates_valid_def page_inv_entries_safe_def split: sum.splits invocation.splits arch_invocation.splits kernel_object.splits page_table_invocation.splits page_invocation.splits)+\n  done\n\n\nlemma set_thread_state_duplicates_valid[wp]:\n  \"\\<lbrace>invocation_duplicates_valid i\\<rbrace> set_thread_state t st \\<lbrace>\\<lambda>rv. invocation_duplicates_valid i\\<rbrace>\"\n  apply (simp add: set_thread_state_def set_object_def get_object_def)\n  apply (wp|simp)+\n  apply (clarsimp simp: invocation_duplicates_valid_def pti_duplicates_valid_def\n                        page_inv_duplicates_valid_def page_inv_entries_safe_def\n                        Let_def\n                 dest!: get_tcb_SomeD\n                 split: Invocations_A.invocation.split arch_invocation.split_asm\n                        page_table_invocation.split\n                        page_invocation.split sum.split\n                        )\n  apply (auto simp add: obj_at_def page_inv_entries_safe_def)\n  done\n\nlemma handle_invocation_valid_pdpt[wp]:\n  \"\\<lbrace>valid_pdpt_objs and invs and ct_active\\<rbrace>\n        handle_invocation calling blocking \\<lbrace>\\<lambda>rv. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: handle_invocation_def)\n  apply (wp syscall_valid set_thread_state_ct_st\n               | simp add: split_def | wpc\n               | wp (once) hoare_drop_imps)+\n  apply (auto simp: ct_in_state_def elim: st_tcb_ex_cap)\n  done\n\n\ncrunch valid_pdpt[wp]: handle_event, activate_thread,switch_to_thread,\n       switch_to_idle_thread \"valid_pdpt_objs\"\n  (simp: crunch_simps wp: crunch_wps alternative_valid select_wp OR_choice_weak_wp select_ext_weak_wp\n      ignore: without_preemption getActiveIRQ resetTimer ackInterrupt\n              getFAR getDFSR getIFSR OR_choice set_scheduler_action\n              clearExMonitor)\n\nlemma schedule_valid_pdpt[wp]: \"\\<lbrace>valid_pdpt_objs\\<rbrace> schedule :: (unit,unit) s_monad \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (simp add: schedule_def allActiveTCBs_def)\n  apply (wp alternative_wp select_wp)\n  apply simp\n  done\n\nlemma call_kernel_valid_pdpt[wp]:\n  \"\\<lbrace>invs and (\\<lambda>s. e \\<noteq> Interrupt \\<longrightarrow> ct_running s) and valid_pdpt_objs\\<rbrace>\n      (call_kernel e) :: (unit,unit) s_monad\n   \\<lbrace>\\<lambda>_. valid_pdpt_objs\\<rbrace>\"\n  apply (cases e, simp_all add: call_kernel_def)\n      apply (rule hoare_pre)\n       apply (wp | simp | wpc\n                 | rule conjI | clarsimp simp: ct_in_state_def\n                 | erule pred_tcb_weakenE\n                 | wp (once) hoare_drop_imps)+\n  done\n\nend\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/invariant-abstract/ARM_HYP/ArchVSpaceEntries_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241911813151, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.30572604594687086}}
{"text": "section \\<open>Overloaded monad operations\\<close>\n\ntheory Monad_Overloading imports Monomorphic_Monad begin\n\nconsts return :: \"('a, 'm) return\"\nconsts bind :: \"('a, 'm) bind\"\nconsts get :: \"('s, 'm) get\"\nconsts put :: \"('s, 'm) put\"\nconsts fail :: \"'m fail\"\nconsts catch :: \"'m catch\"\nconsts ask :: \"('r, 'm) ask\"\nconsts sample :: \"('p, 'm) sample\"\nconsts pause :: \"('o, 'i, 'm) pause\"\nconsts tell :: \"('w, 'm) tell\"\nconsts alt :: \"'m alt\"\nconsts altc :: \"('c, 'm) altc\"\n\nsubsection \\<open>Identity monad\\<close>\n\noverloading \n  bind_id' \\<equiv> \"bind :: ('a, 'a id) bind\"\n  return_id \\<equiv> \"return :: ('a, 'a id) return\"\nbegin\n\ndefinition bind_id' :: \"('a, 'a id) bind\"\nwhere [code_unfold, monad_unfold]: \"bind_id' = bind_id\"\n\ndefinition return_id :: \"('a, 'a id) return\"\nwhere [code_unfold, monad_unfold]: \"return_id = id.return_id\"\n\nend\n\nlemma extract_bind' [simp]: \"extract (bind x f) = extract (f (extract x))\"\nby(simp add: bind_id'_def)\n\nlemma extract_return [simp]: \"extract (return x) = x\"\nby(simp add: return_id_def)\n\nlemma monad_id' [locale_witness]: \"monad return (bind :: ('a, 'a id) bind)\"\nunfolding bind_id'_def return_id_def by(rule monad_id)\n\nlemma monad_commute_id' [locale_witness]: \"monad_commute return (bind :: ('a, 'a id) bind)\"\nunfolding bind_id'_def return_id_def by(rule monad_commute_id)\n\n\nsubsection \\<open>Probability monad\\<close>\n\noverloading\n  return_prob \\<equiv> \"return :: ('a, 'a prob) return\"\n  bind_prob \\<equiv> \"bind :: ('a, 'a prob) bind\"\n  sample_prob \\<equiv> \"sample :: ('p, 'a prob) sample\"\nbegin\n\ndefinition return_prob :: \"('a, 'a pmf) return\"\nwhere [code_unfold, monad_unfold]: \"return_prob = return_pmf\"\n\ndefinition bind_prob :: \"('a, 'a prob) bind\"\nwhere [code_unfold, monad_unfold]: \"bind_prob = bind_pmf\"\n\ndefinition sample_prob :: \"('p, 'a pmf) sample\"\nwhere [code_unfold, monad_unfold]: \"sample_prob = bind_pmf\"\n\nend\n\nlemma monad_prob' [locale_witness]: \"monad return (bind :: ('a, 'a prob) bind)\"\nunfolding return_prob_def bind_prob_def by(rule monad_prob)\n\nlemma monad_commute_prob' [locale_witness]: \"monad_commute return (bind :: ('a, 'a prob) bind)\"\nunfolding return_prob_def bind_prob_def by(rule monad_commute_prob)\n\nlemma monad_prob_prob' [locale_witness]: \"monad_prob return (bind :: ('a, 'a prob) bind) (sample :: ('p, 'a prob) sample)\"\nunfolding return_prob_def bind_prob_def sample_prob_def by(rule monad_prob_prob)\n\nsubsection \\<open>Nondeterminism monad transformer\\<close>\n\ntext \\<open>As the collection type is not determined from the type of the return operation, we can\n  only provide definitions for one collection type implementation. We choose multisets.\n  Accordingly, @{const altc} is not available.\\<close>\n\nconsts\n  munionMT :: \"'a itself \\<Rightarrow> 'm \\<Rightarrow> 'm \\<Rightarrow> 'm\"\n  mUnionMT :: \"'a itself \\<Rightarrow> 'm multiset \\<Rightarrow> 'm\"\n\noverloading \n  return_nondetT \\<equiv> \"return :: ('a, ('a, 'm) nondetT) return\" (unchecked)\n  bind_nondetT \\<equiv> \"bind :: ('a, ('a, 'm) nondetT) bind\" (unchecked)\n  fail_nondetT \\<equiv> \"fail :: ('a, 'm) nondetT fail\" (unchecked)\n  ask_nondetT \\<equiv> \"ask :: ('r, ('a, 'm) nondetT) ask\"\n  get_nondetT \\<equiv> \"get :: ('s, ('a, 'm) nondetT) get\"\n  put_nondetT \\<equiv> \"put :: ('s, ('a, 'm) nondetT) put\"\n  alt_nondetT \\<equiv> \"alt :: ('a, 'm) nondetT alt\" (unchecked)\n  munionMT \\<equiv> \"munionMT :: 'a itself \\<Rightarrow> 'm \\<Rightarrow> 'm \\<Rightarrow> 'm\" (unchecked)\n  mUnionMT \\<equiv> \"mUnionMT :: 'a itself \\<Rightarrow> 'm multiset \\<Rightarrow> 'm\" (unchecked)\nbegin\n\ninterpretation nondetM_base return bind \"mmerge return bind\" \"{#}\" \"\\<lambda>x. {#x#}\" \"(+)\" .\n\ndefinition return_nondetT :: \"('a, ('a, 'm) nondetT) return\"\nwhere [code_unfold, monad_unfold]: \"return_nondetT = return_nondet\"\n\ndefinition bind_nondetT :: \"('a, ('a, 'm) nondetT) bind\"\nwhere [code_unfold, monad_unfold]: \"bind_nondetT = bind_nondet\" \n\ndefinition fail_nondetT :: \"('a, 'm) nondetT fail\"\nwhere [code_unfold, monad_unfold]: \"fail_nondetT = fail_nondet\"\n\ndefinition ask_nondetT :: \"('r, ('a, 'm) nondetT) ask\"\nwhere [code_unfold, monad_unfold]: \"ask_nondetT = ask_nondet ask\"\n\ndefinition get_nondetT :: \"('s, ('a, 'm) nondetT) get\"\nwhere [code_unfold, monad_unfold]: \"get_nondetT = get_nondet get\"\n\ndefinition put_nondetT :: \"('s, ('a, 'm) nondetT) put\"\nwhere [code_unfold, monad_unfold]: \"put_nondetT = put_nondet put\"\n\ndefinition alt_nondetT :: \"('a, 'm) nondetT alt\"\nwhere [code_unfold, monad_unfold]: \"alt_nondetT = alt_nondet\"\n\ndefinition munionMT :: \"'a itself \\<Rightarrow> 'm \\<Rightarrow> 'm \\<Rightarrow> 'm\"\nwhere \"munionMT _ m1 m2 = bind m1 (\\<lambda>A. bind m2 (\\<lambda>B. return (A + B :: 'a multiset)))\"\n\ndefinition mUnionMT :: \"'a itself \\<Rightarrow> 'm multiset \\<Rightarrow> 'm\"\nwhere \"mUnionMT _ = fold_mset (munionMT TYPE('a)) (return ({#} :: 'a multiset))\"\n\nend\n\ncontext begin\ninterpretation nondetM_base return bind \"mmerge return bind\" \"{#}\" \"\\<lambda>x. {#x#}\" \"(+)\" .\n\nlemma run_bind_nondetT:\n  fixes f :: \"'a \\<Rightarrow> ('a, 'm) nondetT\" shows\n  \"run_nondet (bind m f) = bind (run_nondet m) (\\<lambda>A. mUnionMT TYPE('a) (image_mset (run_nondet \\<circ> f) A))\"\nby(simp add: bind_nondetT_def mUnionMT_def munionMT_def[abs_def] mmerge_def)\n\nlemma run_return_nondetT [simp]: \"run_nondet (return x :: ('a, 'm) nondetT) = return {#x#}\" for x :: 'a\nby(simp add: return_nondetT_def)\n\nlemma run_fail_nondetT [simp]: \"run_nondet (fail :: ('a, 'm) nondetT) = return ({#} :: 'a multiset)\"\nby(simp add: fail_nondetT_def)\n\nlemma run_ask_nondetT [simp]: \"run_nondet (ask f) = ask (\\<lambda>r. run_nondet (f r))\"\nby(simp add: ask_nondetT_def)\n\nlemma run_get_nondetT [simp]: \"run_nondet (get f) = get (\\<lambda>s. run_nondet (f s))\"\nby(simp add: get_nondetT_def)\n\nlemma run_put_nondetT [simp]: \"run_nondet (put s m) = put s (run_nondet m)\"\nby(simp add: put_nondetT_def)\n\nlemma run_alt_nondetT [simp]:\n  \"run_nondet (alt m m' :: ('a, 'm) nondetT) = \n   bind (run_nondet m) (\\<lambda>A :: 'a multiset. bind (run_nondet m') (\\<lambda>B. return (A + B)))\"\nby(simp add: alt_nondetT_def)\n\nend\n\nlemma monad_nondetT' [locale_witness]: \n  \"monad_commute return (bind :: ('a multiset, 'm) bind)\n  \\<Longrightarrow> monad return (bind :: ('a, ('a, 'm) nondetT) bind)\"\nunfolding return_nondetT_def bind_nondetT_def by(rule mset_nondetMs)\n\nlemma monad_fail_nondetT' [locale_witness]:\n  \"monad_commute return (bind :: ('a multiset, 'm) bind)\n  \\<Longrightarrow> monad_fail return (bind :: ('a, ('a, 'm) nondetT) bind) fail\"\nunfolding return_nondetT_def bind_nondetT_def fail_nondetT_def by(rule mset_nondetMs)\n\nlemma monad_alt_nondetT' [locale_witness]: \n  \"monad_commute return (bind :: ('a multiset, 'm) bind)\n  \\<Longrightarrow> monad_alt return (bind :: ('a, ('a, 'm) nondetT) bind) alt\"\nunfolding return_nondetT_def bind_nondetT_def alt_nondetT_def by(rule mset_nondetMs)\n\nlemma monad_fail_alt_nondetT' [locale_witness]:\n  \"monad_commute return (bind :: ('a multiset, 'm) bind)\n  \\<Longrightarrow> monad_fail_alt return (bind :: ('a, ('a, 'm) nondetT) bind) fail alt\"\nunfolding return_nondetT_def bind_nondetT_def fail_nondetT_def alt_nondetT_def by(rule mset_nondetMs)\n\nlemma monad_reader_nondetT' [locale_witness]:\n  \"\\<lbrakk> monad_commute return (bind :: ('a multiset, 'm) bind);\n     monad_reader return (bind :: ('a multiset, 'm) bind) (ask :: ('r, 'm) ask) \\<rbrakk>\n  \\<Longrightarrow> monad_reader return (bind :: ('a, ('a, 'm) nondetT) bind) (ask :: ('r, ('a, 'm) nondetT) ask)\"\nunfolding return_nondetT_def bind_nondetT_def ask_nondetT_def by(rule mset_nondetMs)\n\nsubsection \\<open>State monad transformer\\<close>\n\noverloading\n  get_stateT \\<equiv> \"get :: ('s, ('s, 'm) stateT) get\"\n  put_stateT \\<equiv> \"put :: ('s, ('s, 'm) stateT) put\"\n  bind_stateT \\<equiv> \"bind :: ('a, ('s, 'm) stateT) bind\" (unchecked)\n  return_stateT \\<equiv> \"return :: ('a, ('s, 'm) stateT) return\" (unchecked)\n  fail_stateT \\<equiv> \"fail :: ('s, 'm) stateT fail\"\n  ask_stateT \\<equiv> \"ask :: ('r, ('s, 'm) stateT) ask\"\n  sample_stateT \\<equiv> \"sample :: ('p, ('s, 'm) stateT) sample\"\n  tell_stateT \\<equiv> \"tell :: ('w, ('s, 'm) stateT) tell\"\n  alt_stateT \\<equiv> \"alt :: ('s, 'm) stateT alt\"\n  altc_stateT \\<equiv> \"altc :: ('c, ('s, 'm) stateT) altc\"\n  pause_stateT \\<equiv> \"pause :: ('o, 'i, ('s, 'm) stateT) pause\"\nbegin\n\ndefinition get_stateT :: \"('s, ('s, 'm) stateT) get\"\nwhere [code_unfold, monad_unfold]: \"get_stateT = get_state\"\n\ndefinition put_stateT :: \"('s, ('s, 'm) stateT) put\"\nwhere [code_unfold, monad_unfold]: \"put_stateT = put_state\"\n\ndefinition bind_stateT :: \"('a, ('s, 'm) stateT) bind\"\nwhere [code_unfold, monad_unfold]: \"bind_stateT = bind_state bind\"\n\ndefinition return_stateT :: \"('a, ('s, 'm) stateT) return\"\nwhere [code_unfold, monad_unfold]: \"return_stateT = return_state return\"\n\ndefinition fail_stateT :: \"('s, 'm) stateT fail\"\nwhere [code_unfold, monad_unfold]: \"fail_stateT = fail_state fail\"\n\ndefinition ask_stateT :: \"('r, ('s, 'm) stateT) ask\"\nwhere [code_unfold, monad_unfold]: \"ask_stateT = ask_state ask\"\n\ndefinition sample_stateT :: \"('p, ('s, 'm) stateT) sample\"\nwhere [code_unfold, monad_unfold]: \"sample_stateT = sample_state sample\"\n\ndefinition tell_stateT :: \"('w, ('s, 'm) stateT) tell\"\nwhere [code_unfold, monad_unfold]: \"tell_stateT = tell_state tell\"\n\ndefinition alt_stateT :: \"('s, 'm) stateT alt\"\nwhere [code_unfold, monad_unfold]: \"alt_stateT = alt_state alt\"\n\ndefinition altc_stateT :: \"('c, ('s, 'm) stateT) altc\"\nwhere [code_unfold, monad_unfold]: \"altc_stateT = altc_state altc\"\n\ndefinition pause_stateT :: \"('o, 'i, ('s, 'm) stateT) pause\"\nwhere [code_unfold, monad_unfold]: \"pause_stateT = pause_state pause\"\n\nend\n\nlemma run_bind_stateT [simp]:\n  \"run_state (bind x f) s = bind (run_state x s) (\\<lambda>(a, s'). run_state (f a) s')\"\nby(simp add: bind_stateT_def)\n\nlemma run_return_stateT [simp]: \"run_state (return x) s = return (x, s)\"\nby(simp add: return_stateT_def)\n\nlemma run_put_stateT [simp]: \"run_state (put s m) s' = run_state m s\"\nby(simp add: put_stateT_def)\n\nlemma run_get_state [simp]: \"run_state (get f) s = run_state (f s) s\"\nby(simp add: get_stateT_def)\n\nlemma run_fail_stateT [simp]: \"run_state fail s = fail\"\nby(simp add: fail_stateT_def)\n\nlemma run_ask_stateT [simp]: \"run_state (ask f) s = ask (\\<lambda>r. run_state (f r) s)\"\nby(simp add: ask_stateT_def)\n\nlemma run_sample_stateT [simp]: \"run_state (sample p f) s = sample p (\\<lambda>x. run_state (f x) s)\"\nby(simp add: sample_stateT_def)\n\nlemma run_tell_stateT [simp]: \"run_state (tell w m) s = tell w (run_state m s)\"\nby(simp add: tell_stateT_def)\n\nlemma run_alt_stateT [simp]: \"run_state (alt m m') s = alt (run_state m s) (run_state m' s)\"\nby(simp add: alt_stateT_def)\n\nlemma run_altc_stateT [simp]: \"run_state (altc C f) s = altc C (\\<lambda>x. run_state (f x) s)\"\nby(simp add: altc_stateT_def)\n\nlemma run_pause_stateT [simp]: \"run_state (pause out c) s = pause out (\\<lambda>input. run_state (c input) s)\"\nby(simp add: pause_stateT_def)\n\nlemma monad_stateT' [locale_witness]:\n  \"monad return (bind :: ('a \\<times> 's, 'm) bind) \\<Longrightarrow> monad return (bind :: ('a, ('s, 'm) stateT) bind)\"\nunfolding return_stateT_def bind_stateT_def by(rule monad_stateT) \n\nlemma monad_state_stateT' [locale_witness]:\n  \"monad return (bind :: ('a \\<times> 's, 'm) bind) \n  \\<Longrightarrow> monad_state return (bind :: ('a, ('s, 'm) stateT) bind) get (put :: ('s, ('s, 'm) stateT) put)\"\nunfolding return_stateT_def bind_stateT_def get_stateT_def put_stateT_def by(rule monad_state_stateT) \n\nlemma monad_fail_stateT' [locale_witness]:\n  \"monad_fail return (bind :: ('a \\<times> 's, 'm) bind) fail\n  \\<Longrightarrow> monad_fail return (bind :: ('a, ('s, 'm) stateT) bind) fail\"\nunfolding return_stateT_def bind_stateT_def fail_stateT_def by(rule monad_fail_stateT)\n\nlemma monad_reader_stateT' [locale_witness]:\n  \"monad_reader return (bind :: ('a \\<times> 's, 'm) bind) (ask :: ('r, 'm) ask)\n  \\<Longrightarrow> monad_reader return (bind :: ('a, ('s, 'm) stateT) bind) (ask :: ('r, ('s, 'm) stateT) ask)\"\nunfolding return_stateT_def bind_stateT_def ask_stateT_def by(rule monad_reader_stateT)\n\nlemma monad_reader_state_stateT' [locale_witness]:\n  \"monad_reader return (bind :: ('a \\<times> 's, 'm) bind) (ask :: ('r, 'm) ask)\n  \\<Longrightarrow> monad_reader_state return (bind :: ('a, ('s, 'm) stateT) bind) (ask :: ('r, ('s, 'm) stateT) ask) get_state put_state\"\nunfolding return_stateT_def bind_stateT_def ask_stateT_def by(rule monad_reader_state_stateT)\n\nlemma monad_prob_stateT' [locale_witness]:\n  \"monad_prob return (bind :: ('a \\<times> 's, 'm) bind) (sample :: ('p, 'm) sample)\n  \\<Longrightarrow> monad_prob return (bind :: ('a, ('s, 'm) stateT) bind) (sample :: ('p, ('s, 'm) stateT) sample)\"\nunfolding return_stateT_def bind_stateT_def sample_stateT_def by(rule monad_prob_stateT)\n\nlemma monad_state_prob_stateT' [locale_witness]:\n  \"monad_prob return (bind :: ('a \\<times> 's, 'm) bind) (sample :: ('p, 'm) sample)\n  \\<Longrightarrow> monad_state_prob return (bind :: ('a, ('s, 'm) stateT) bind) get (put :: ('s, ('s, 'm) stateT) put) (sample :: ('p, ('s, 'm) stateT) sample)\"\nunfolding return_stateT_def bind_stateT_def sample_stateT_def get_stateT_def put_stateT_def by(rule monad_state_prob_stateT)\n\nlemma monad_writer_stateT' [locale_witness]:\n  \"monad_writer return (bind :: ('a \\<times> 's, 'm) bind) (tell :: ('w, 'm) tell)\n  \\<Longrightarrow> monad_writer return (bind :: ('a, ('s, 'm) stateT) bind) (tell :: ('w, ('s, 'm) stateT) tell)\"\nunfolding return_stateT_def bind_stateT_def tell_stateT_def by(rule monad_writer_stateT)\n\nlemma monad_alt_stateT' [locale_witness]:\n  \"monad_alt return (bind :: ('a \\<times> 's, 'm) bind) alt\n   \\<Longrightarrow> monad_alt return (bind :: ('a, ('s, 'm) stateT) bind) alt\"\nunfolding return_stateT_def bind_stateT_def alt_stateT_def by(rule monad_alt_stateT)\n\nlemma monad_state_alt_stateT' [locale_witness]:\n  \"monad_alt return (bind :: ('a \\<times> 's, 'm) bind) alt\n   \\<Longrightarrow> monad_state_alt return (bind :: ('a, ('s, 'm) stateT) bind) (get :: ('s, ('s, 'm) stateT) get) put alt\"\nunfolding return_stateT_def bind_stateT_def get_stateT_def put_stateT_def alt_stateT_def by(rule monad_state_alt_stateT)\n\nlemma monad_fail_alt_stateT' [locale_witness]:\n  \"monad_fail_alt return (bind :: ('a \\<times> 's, 'm) bind) fail alt\n   \\<Longrightarrow> monad_fail_alt return (bind :: ('a, ('s, 'm) stateT) bind) fail alt\"\nunfolding return_stateT_def bind_stateT_def fail_stateT_def alt_stateT_def by(rule monad_fail_alt_stateT)\n\nlemma monad_altc_stateT' [locale_witness]:\n  \"monad_altc return (bind :: ('a \\<times> 's, 'm) bind) (altc :: ('c, 'm) altc)\n   \\<Longrightarrow> monad_altc return (bind :: ('a, ('s, 'm) stateT) bind) (altc :: ('c, ('s, 'm) stateT) altc)\"\nunfolding return_stateT_def bind_stateT_def altc_stateT_def by(rule monad_altc_stateT)\n\nlemma monad_state_altc_stateT' [locale_witness]:\n  \"monad_altc return (bind :: ('a \\<times> 's, 'm) bind) (altc :: ('c, 'm) altc)\n   \\<Longrightarrow> monad_state_altc return (bind :: ('a, ('s, 'm) stateT) bind) (get :: ('s, ('s, 'm) stateT) get) put (altc :: ('c, ('s, 'm) stateT) altc)\"\nunfolding return_stateT_def bind_stateT_def get_stateT_def put_stateT_def altc_stateT_def by(rule monad_state_altc_stateT)\n\nlemma monad_resumption_stateT' [locale_witness]:\n  \"monad_resumption return (bind :: ('a \\<times> 's, 'm) bind) (pause :: ('o, 'i, 'm) pause)\n   \\<Longrightarrow> monad_resumption return (bind :: ('a, ('s, 'm) stateT) bind) (pause :: ('o, 'i, ('s, 'm) stateT) pause)\"\nunfolding return_stateT_def bind_stateT_def fail_stateT_def pause_stateT_def by(rule monad_resumption_stateT)\n\nsubsection \\<open>Failure and Exception monad transformer\\<close>\n\noverloading \n  return_optionT \\<equiv> \"return :: ('a, ('a, 'm) optionT) return\" (unchecked)\n  bind_optionT \\<equiv> \"bind :: ('a, ('a, 'm) optionT) bind\" (unchecked)\n  fail_optionT \\<equiv> \"fail :: ('a, 'm) optionT fail\" (unchecked)\n  catch_optionT \\<equiv> \"catch :: ('a, 'm) optionT catch\" (unchecked)\n  ask_optionT \\<equiv> \"ask :: ('r, ('a, 'm) optionT) ask\"\n  get_optionT \\<equiv> \"get :: ('s, ('a, 'm) optionT) get\"\n  put_optionT \\<equiv> \"put :: ('s, ('a, 'm) optionT) put\"\n  sample_optionT \\<equiv> \"sample :: ('p, ('a, 'm) optionT) sample\"\n  tell_optionT \\<equiv> \"tell :: ('w, ('a, 'm) optionT) tell\"\n  alt_optionT \\<equiv> \"alt :: ('a, 'm) optionT alt\"\n  altc_optionT \\<equiv> \"altc :: ('c, ('a, 'm) optionT) altc\"\n  pause_optionT \\<equiv> \"pause :: ('o, 'i, ('a, 'm) optionT) pause\"\nbegin\n\ndefinition return_optionT :: \"('a, ('a, 'm) optionT) return\"\nwhere [code_unfold, monad_unfold]: \"return_optionT = return_option return\"\n\ndefinition bind_optionT :: \"('a, ('a, 'm) optionT) bind\"\nwhere [code_unfold, monad_unfold]: \"bind_optionT = bind_option return bind\" \n\ndefinition fail_optionT :: \"('a, 'm) optionT fail\"\nwhere [code_unfold, monad_unfold]: \"fail_optionT = fail_option return\"\n\ndefinition catch_optionT :: \"('a, 'm) optionT catch\"\nwhere [code_unfold, monad_unfold]: \"catch_optionT = catch_option return bind\"\n\ndefinition ask_optionT :: \"('r, ('a, 'm) optionT) ask\"\nwhere [code_unfold, monad_unfold]: \"ask_optionT = ask_option ask\"\n\ndefinition get_optionT :: \"('s, ('a, 'm) optionT) get\"\nwhere [code_unfold, monad_unfold]: \"get_optionT = get_option get\"\n\ndefinition put_optionT :: \"('s, ('a, 'm) optionT) put\"\nwhere [code_unfold, monad_unfold]: \"put_optionT = put_option put\"\n\ndefinition sample_optionT :: \"('p, ('a, 'm) optionT) sample\"\nwhere [code_unfold, monad_unfold]: \"sample_optionT = sample_option sample\"\n\ndefinition tell_optionT :: \"('w, ('a, 'm) optionT) tell\"\nwhere [code_unfold, monad_unfold]: \"tell_optionT = tell_option tell\"\n\ndefinition alt_optionT :: \"('a, 'm) optionT alt\"\nwhere [code_unfold, monad_unfold]: \"alt_optionT = alt_option alt\"\n\ndefinition altc_optionT :: \"('c, ('a, 'm) optionT) altc\"\nwhere [code_unfold, monad_unfold]: \"altc_optionT = altc_option altc\"\n\ndefinition pause_optionT :: \"('o, 'i, ('a, 'm) optionT) pause\"\nwhere [code_unfold, monad_unfold]: \"pause_optionT = pause_option pause\"\n\nend\n\nlemma run_bind_optionT:\n  fixes f :: \"'a \\<Rightarrow> ('a, 'm) optionT\" shows\n  \"run_option (bind x f) = bind (run_option x) (\\<lambda>x. case x of None \\<Rightarrow> return (None :: 'a option) | Some y \\<Rightarrow> run_option (f y))\"\nby(simp add: bind_optionT_def run_bind_option)\n\n\n\nlemma run_fail_optionT [simp]: \"run_option (fail :: ('a, 'm) optionT fail) = return (None :: 'a option)\"\nby(simp add: fail_optionT_def)\n\nlemma run_catch_optionT [simp]: \n  \"run_option (catch m h :: ('a, 'm) optionT) = \n   bind (run_option m) (\\<lambda>x :: 'a option. if x = None then run_option h else return x)\"\nby(simp add: catch_optionT_def)\n\nlemma run_ask_optionT [simp]: \"run_option (ask f) = ask (\\<lambda>r. run_option (f r))\"\nby(simp add: ask_optionT_def)\n\nlemma run_get_optionT [simp]: \"run_option (get f) = get (\\<lambda>s. run_option (f s))\"\nby(simp add: get_optionT_def)\n\nlemma run_put_optionT [simp]: \"run_option (put s m) = put s (run_option m)\"\nby(simp add: put_optionT_def)\n\nlemma run_sample_optionT [simp]: \"run_option (sample p f) = sample p (\\<lambda>x. run_option (f x))\"\nby(simp add: sample_optionT_def)\n\nlemma run_tell_optionT [simp]: \"run_option (tell w m) = tell w (run_option m)\"\nby(simp add: tell_optionT_def)\n\nlemma run_alt_optionT [simp]: \"run_option (alt m m') = alt (run_option m) (run_option m')\"\nby(simp add: alt_optionT_def)\n\nlemma run_altc_optionT [simp]: \"run_option (altc C f) = altc C (run_option \\<circ> f)\"\nby(simp add: altc_optionT_def o_def)\n\nlemma run_pause_optionT [simp]: \"run_option (pause out c) = pause out (\\<lambda>input. run_option (c input))\"\nby(simp add: pause_optionT_def)\n\nlemma monad_optionT' [locale_witness]:\n  \"monad return (bind :: ('a option, 'm) bind)\n  \\<Longrightarrow> monad return (bind :: ('a, ('a, 'm) optionT) bind)\"\nunfolding return_optionT_def bind_optionT_def by(rule monad_optionT)\n\nlemma monad_fail_optionT' [locale_witness]:\n  \"monad return (bind :: ('a option, 'm) bind)\n  \\<Longrightarrow> monad_fail return (bind :: ('a, ('a, 'm) optionT) bind) fail\"\nunfolding return_optionT_def bind_optionT_def fail_optionT_def by(rule monad_fail_optionT)\n\nlemma monad_catch_optionT' [locale_witness]:\n  \"monad return (bind :: ('a option, 'm) bind)\n  \\<Longrightarrow> monad_catch return (bind :: ('a, ('a, 'm) optionT) bind) fail catch\"\nunfolding return_optionT_def bind_optionT_def fail_optionT_def catch_optionT_def by(rule monad_catch_optionT)\n\nlemma monad_reader_optionT' [locale_witness]:\n  \"monad_reader return (bind :: ('a option, 'm) bind) (ask :: ('r, 'm) ask)\n  \\<Longrightarrow> monad_reader return (bind :: ('a, ('a, 'm) optionT) bind) (ask :: ('r, ('a, 'm) optionT) ask)\"\nunfolding return_optionT_def bind_optionT_def ask_optionT_def\nby(rule monad_reader_optionT)\n\nlemma monad_state_optionT' [locale_witness]:\n  \"monad_state return (bind :: ('a option, 'm) bind) (get :: ('s, 'm) get) put\n  \\<Longrightarrow> monad_state return (bind :: ('a, ('a, 'm) optionT) bind) (get :: ('s, ('a, 'm) optionT) get) put\"\nunfolding return_optionT_def bind_optionT_def get_optionT_def put_optionT_def\nby(rule monad_state_optionT)\n\nlemma monad_catch_state_optionT' [locale_witness]:\n  \"monad_state return (bind :: ('a option, 'm) bind) (get :: ('s, 'm) get) put\n  \\<Longrightarrow> monad_catch_state return (bind :: ('a, ('a, 'm) optionT) bind) fail catch (get :: ('s, ('a, 'm) optionT) get) put\"\nunfolding return_optionT_def bind_optionT_def fail_optionT_def catch_optionT_def get_optionT_def put_optionT_def\nby(rule monad_catch_state_optionT)\n\nlemma monad_prob_optionT' [locale_witness]:\n  \"monad_prob return (bind :: ('a option, 'm) bind) (sample :: ('p, 'm) sample)\n  \\<Longrightarrow> monad_prob return (bind :: ('a, ('a, 'm) optionT) bind) (sample :: ('p, ('a, 'm) optionT) sample)\"\nunfolding return_optionT_def bind_optionT_def sample_optionT_def\nby(rule monad_prob_optionT)\n\nlemma monad_state_prob_optionT' [locale_witness]:\n  \"monad_state_prob return (bind :: ('a option, 'm) bind) (get :: ('s, 'm) get) put (sample :: ('p, 'm) sample)\n  \\<Longrightarrow> monad_state_prob return (bind :: ('a, ('a, 'm) optionT) bind) (get :: ('s, ('a, 'm) optionT) get) put(sample :: ('p, ('a, 'm) optionT) sample)\"\nunfolding return_optionT_def bind_optionT_def get_optionT_def put_optionT_def sample_optionT_def\nby(rule monad_state_prob_optionT)\n\nlemma monad_writer_optionT' [locale_witness]:\n  \"monad_writer return (bind :: ('a option, 'm) bind) (tell :: ('w, 'm) tell)\n  \\<Longrightarrow> monad_writer return (bind :: ('a, ('a, 'm) optionT) bind) (tell :: ('w, ('a, 'm) optionT) tell)\"\nunfolding return_optionT_def bind_optionT_def tell_optionT_def by(rule monad_writer_optionT)\n\nlemma monad_alt_optionT' [locale_witness]:\n  \"monad_alt return (bind :: ('a option, 'm) bind) alt\n  \\<Longrightarrow> monad_alt return (bind :: ('a, ('a, 'm) optionT) bind) alt\"\nunfolding return_optionT_def bind_optionT_def alt_optionT_def by(rule monad_alt_optionT)\n\nlemma monad_state_alt_optionT' [locale_witness]:\n  \"monad_state_alt return (bind :: ('a option, 'm) bind) (get :: ('s, 'm) get) put alt\n  \\<Longrightarrow> monad_state_alt return (bind :: ('a, ('a, 'm) optionT) bind) (get :: ('s, ('a, 'm) optionT) get) put alt\"\nunfolding return_optionT_def bind_optionT_def alt_optionT_def get_optionT_def put_optionT_def by(rule monad_state_alt_optionT)\n\nlemma monad_altc_optionT' [locale_witness]:\n  \"monad_altc return (bind :: ('a option, 'm) bind) (altc :: ('c, 'm) altc)\n  \\<Longrightarrow> monad_altc return (bind :: ('a, ('a, 'm) optionT) bind) (altc :: ('c, ('a, 'm) optionT) altc)\"\nunfolding return_optionT_def bind_optionT_def altc_optionT_def by(rule monad_altc_optionT)\n\nlemma monad_state_altc_optionT' [locale_witness]:\n  \"monad_state_altc return (bind :: ('a option, 'm) bind) (get :: ('s, 'm) get) put (altc :: ('c, 'm) altc)\n  \\<Longrightarrow> monad_state_altc return (bind :: ('a, ('a, 'm) optionT) bind) (get :: ('s, ('a, 'm) optionT) get) put (altc :: ('c, ('a, 'm) optionT) altc)\"\nunfolding return_optionT_def bind_optionT_def altc_optionT_def get_optionT_def put_optionT_def by(rule monad_state_altc_optionT)\n\nlemma monad_resumption_optionT' [locale_witness]:\n  \"monad_resumption return (bind :: ('a option, 'm) bind) (pause :: ('o, 'i, 'm) pause)\n  \\<Longrightarrow> monad_resumption return (bind :: ('a, ('a, 'm) optionT) bind) (pause :: ('o, 'i, ('a, 'm) optionT) pause)\"\nunfolding return_optionT_def bind_optionT_def pause_optionT_def by(rule monad_resumption_optionT)\n\nlemma monad_commute_optionT' [locale_witness]:\n  \"\\<lbrakk> monad_commute return (bind :: ('a option, 'm) bind); monad_discard return (bind :: ('a option, 'm) bind) \\<rbrakk>\n  \\<Longrightarrow> monad_commute return (bind :: ('a, ('a, 'm) optionT) bind)\"\nunfolding return_optionT_def bind_optionT_def by(rule monad_commute_optionT)\n\n\nsubsection \\<open>Reader monad transformer\\<close>\n\noverloading\n  return_envT \\<equiv> \"return :: ('a, ('r, 'm) envT) return\"\n  bind_envT \\<equiv> \"bind :: ('a, ('r, 'm) envT) bind\"\n  fail_envT \\<equiv> \"fail :: ('r, 'm) envT fail\"\n  get_envT \\<equiv> \"get :: ('s, ('r, 'm) envT) get\"\n  put_envT \\<equiv> \"put :: ('s, ('r, 'm) envT) put\"\n  sample_envT \\<equiv> \"sample :: ('p, ('r, 'm) envT) sample\"\n  ask_envT \\<equiv> \"ask :: ('r, ('r, 'm) envT) ask\"\n  catch_envT \\<equiv> \"catch :: ('r, 'm) envT catch\"\n  alt_envT \\<equiv> \"alt :: ('r, 'm) envT alt\"\n  altc_envT \\<equiv> \"altc :: ('c, ('r, 'm) envT) altc\"\n  pause_envT \\<equiv> \"pause :: ('o, 'i, ('r, 'm) envT) pause\"\n  tell_envT \\<equiv> \"tell :: ('w, ('r, 'm) envT) tell\"\nbegin\n\ndefinition return_envT :: \"('a, ('r, 'm) envT) return\"\nwhere [code_unfold, monad_unfold]: \"return_envT = return_env return\"\n\ndefinition bind_envT :: \"('a, ('r, 'm) envT) bind\"\nwhere [code_unfold, monad_unfold]: \"bind_envT = bind_env bind\"\n\ndefinition ask_envT :: \"('r, ('r, 'm) envT) ask\"\nwhere [code_unfold, monad_unfold]: \"ask_envT = ask_env\"\n\ndefinition fail_envT :: \"('r, 'm) envT fail\"\nwhere [code_unfold, monad_unfold]: \"fail_envT = fail_env fail\"\n\ndefinition get_envT :: \"('s, ('r, 'm) envT) get\"\nwhere [code_unfold, monad_unfold]: \"get_envT = get_env get\"\n\ndefinition put_envT :: \"('s, ('r, 'm) envT) put\"\nwhere [code_unfold, monad_unfold]: \"put_envT = put_env put\"\n\ndefinition sample_envT :: \"('p, ('r, 'm) envT) sample\"\nwhere [code_unfold, monad_unfold]: \"sample_envT = sample_env sample\"\n\ndefinition catch_envT :: \"('r, 'm) envT catch\"\nwhere [code_unfold, monad_unfold]: \"catch_envT = catch_env catch\"\n\ndefinition alt_envT :: \"('r, 'm) envT alt\"\nwhere [code_unfold, monad_unfold]: \"alt_envT = alt_env alt\"\n\ndefinition altc_envT :: \"('c, ('r, 'm) envT) altc\"\nwhere [code_unfold, monad_unfold]: \"altc_envT = altc_env altc\"\n\ndefinition pause_envT :: \"('o, 'i, ('r, 'm) envT) pause\"\nwhere [code_unfold, monad_unfold]: \"pause_envT = pause_env pause\"\n\ndefinition tell_envT :: \"('w, ('r, 'm) envT) tell\"\nwhere [code_unfold, monad_unfold]: \"tell_envT = tell_env tell\"\n\nend\n\nlemma run_bind_envT [simp]: \"run_env (bind x f) r = bind (run_env x r) (\\<lambda>y. run_env (f y) r)\"\nby(simp add: bind_envT_def)\n\nlemma run_return_envT [simp]: \"run_env (return x) r = return x\"\nby(simp add: return_envT_def)\n\nlemma run_ask_envT [simp]: \"run_env (ask f) r = run_env (f r) r\"\nby(simp add: ask_envT_def)\n\nlemma run_fail_envT [simp]: \"run_env fail r = fail\"\nby(simp add: fail_envT_def)\n\nlemma run_get_envT [simp]: \"run_env (get f) r = get (\\<lambda>s. run_env (f s) r)\"\nby(simp add: get_envT_def)\n\nlemma run_put_envT [simp]: \"run_env (put s m) r = put s (run_env m r)\"\nby(simp add: put_envT_def)\n\nlemma run_sample_envT [simp]: \"run_env (sample p f) r = sample p (\\<lambda>x. run_env (f x) r)\"\nby(simp add: sample_envT_def)\n\nlemma run_catch_envT [simp]: \"run_env (catch m h) r = catch (run_env m r) (run_env h r)\"\nby(simp add: catch_envT_def)\n\nlemma run_alt_envT [simp]: \"run_env (alt m m') r = alt (run_env m r) (run_env m' r)\"\nby(simp add: alt_envT_def)\n\nlemma run_altc_envT [simp]: \"run_env (altc C f) r = altc C (\\<lambda>x. run_env (f x) r)\"\nby(simp add: altc_envT_def)\n\nlemma run_pause_envT [simp]: \"run_env (pause out c) r = pause out (\\<lambda>input. run_env (c input) r)\"\nby(simp add: pause_envT_def)\n\nlemma run_tell_envT [simp]: \"run_env (tell s m) r = tell s (run_env m r)\"\nby(simp add: tell_envT_def)\n\nlemma monad_envT' [locale_witness]: \n  \"monad return (bind :: ('a, 'm) bind)\n  \\<Longrightarrow> monad return (bind :: ('a, ('r, 'm) envT) bind)\"\nunfolding return_envT_def bind_envT_def by(rule monad_envT)\n\nlemma monad_reader_envT' [locale_witness]: \n  \"monad return (bind :: ('a, 'm) bind)\n  \\<Longrightarrow> monad_reader return (bind :: ('a, ('r, 'm) envT) bind) (ask :: ('r, ('r, 'm) envT) ask)\"\nunfolding return_envT_def bind_envT_def ask_envT_def by(rule monad_reader_envT)\n\nlemma monad_fail_envT' [locale_witness]:\n  \"monad_fail return (bind :: ('a, 'm) bind) fail\n  \\<Longrightarrow> monad_fail return (bind :: ('a, ('r, 'm) envT) bind) fail\"\nunfolding return_envT_def bind_envT_def fail_envT_def by(rule monad_fail_envT)\n\nlemma monad_catch_envT' [locale_witness]:\n  \"monad_catch return (bind :: ('a, 'm) bind) fail catch\n  \\<Longrightarrow> monad_catch return (bind :: ('a, ('r, 'm) envT) bind) fail catch\"\nunfolding return_envT_def bind_envT_def fail_envT_def catch_envT_def by(rule monad_catch_envT)\n\nlemma monad_state_envT' [locale_witness]:\n  \"monad_state return (bind :: ('a, 'm) bind) (get :: ('s, 'm) get) put\n  \\<Longrightarrow> monad_state return (bind :: ('a, ('r, 'm) envT) bind) (get :: ('s, ('r, 'm) envT) get) put\"\nunfolding return_envT_def bind_envT_def get_envT_def put_envT_def by(rule monad_state_envT)\n\nlemma monad_prob_envT' [locale_witness]:\n  \"monad_prob return (bind :: ('a, 'm) bind) (sample :: ('p, 'm) sample)\n  \\<Longrightarrow> monad_prob return (bind :: ('a, ('r, 'm) envT) bind) (sample :: ('p, ('r, 'm) envT) sample)\"\nunfolding return_envT_def bind_envT_def sample_envT_def by(rule monad_prob_envT)\n\nlemma monad_state_prob_envT' [locale_witness]:\n  \"monad_state_prob return (bind :: ('a, 'm) bind) (get :: ('s, 'm) get) put (sample :: ('p, 'm) sample)\n  \\<Longrightarrow> monad_state_prob return (bind :: ('a, ('r, 'm) envT) bind) (get :: ('s, ('r, 'm) envT) get) put (sample :: ('p, ('r, 'm) envT) sample)\"\nunfolding return_envT_def bind_envT_def sample_envT_def get_envT_def put_envT_def  by(rule monad_state_prob_envT)\n\nlemma monad_alt_envT' [locale_witness]:\n  \"monad_alt return (bind :: ('a, 'm) bind) alt\n  \\<Longrightarrow> monad_alt return (bind :: ('a, ('r, 'm) envT) bind) alt\"\nunfolding return_envT_def bind_envT_def alt_envT_def by(rule monad_alt_envT)\n\nlemma monad_fail_alt_envT' [locale_witness]:\n  \"monad_fail_alt return (bind :: ('a, 'm) bind) fail alt\n  \\<Longrightarrow> monad_fail_alt return (bind :: ('a, ('r, 'm) envT) bind) fail alt\"\nunfolding return_envT_def bind_envT_def fail_envT_def alt_envT_def by(rule monad_fail_alt_envT)\n\nlemma monad_state_alt_envT' [locale_witness]:\n  \"monad_state_alt return (bind :: ('a, 'm) bind) (get :: ('s, 'm) get) put alt\n  \\<Longrightarrow> monad_state_alt return (bind :: ('a, ('r, 'm) envT) bind) (get :: ('s, ('r, 'm) envT) get) put alt\"\nunfolding return_envT_def bind_envT_def fail_envT_def get_envT_def put_envT_def alt_envT_def by(rule monad_state_alt_envT)\n\nlemma monad_altc_envT' [locale_witness]:\n  \"monad_altc return (bind :: ('a, 'm) bind) (altc :: ('c, 'm) altc)\n  \\<Longrightarrow> monad_altc return (bind :: ('a, ('r, 'm) envT) bind) (altc :: ('c, ('r, 'm) envT) altc)\"\nunfolding return_envT_def bind_envT_def altc_envT_def by(rule monad_altc_envT)\n\nlemma monad_state_altc_envT' [locale_witness]:\n  \"monad_state_altc return (bind :: ('a, 'm) bind) (get :: ('s, 'm) get) put (altc :: ('c, 'm) altc)\n  \\<Longrightarrow> monad_state_altc return (bind :: ('a, ('r, 'm) envT) bind) (get :: ('s, ('r, 'm) envT) get) put (altc :: ('c, ('r, 'm) envT) altc)\"\nunfolding return_envT_def bind_envT_def fail_envT_def get_envT_def put_envT_def altc_envT_def by(rule monad_state_altc_envT)\n\nlemma monad_resumption_envT' [locale_witness]:\n  \"monad_resumption return (bind :: ('a, 'm) bind) (pause :: ('o, 'i, 'm) pause)\n  \\<Longrightarrow> monad_resumption return (bind :: ('a, ('r, 'm) envT) bind) (pause :: ('o, 'i, ('r, 'm) envT) pause)\"\nunfolding return_envT_def bind_envT_def pause_envT_def by(rule monad_resumption_envT)\n\nlemma monad_writer_readerT' [locale_witness]:\n  \"monad_writer return (bind :: ('a, 'm) bind) (tell :: ('w, 'm) tell)\n  \\<Longrightarrow> monad_writer return (bind :: ('a, ('r, 'm) envT) bind) (tell :: ('w, ('r, 'm) envT) tell)\"\nunfolding return_envT_def bind_envT_def tell_envT_def by(rule monad_writer_envT)\n\nlemma monad_commute_envT' [locale_witness]:\n  \"monad_commute return (bind :: ('a, 'm) bind)\n  \\<Longrightarrow> monad_commute return (bind :: ('a, ('r, 'm) envT) bind)\"\nunfolding return_envT_def bind_envT_def by(rule monad_commute_envT)\n\nlemma monad_discard_envT' [locale_witness]:\n  \"monad_discard return (bind :: ('a, 'm) bind)\n  \\<Longrightarrow> monad_discard return (bind :: ('a, ('r, 'm) envT) bind)\"\nunfolding return_envT_def bind_envT_def by(rule monad_discard_envT)\n\nsubsection \\<open>Writer monad transformer\\<close>\n\noverloading\n  return_writerT \\<equiv> \"return :: ('a, ('w, 'a, 'm) writerT) return\" (unchecked)\n  bind_writerT \\<equiv> \"bind :: ('a, ('w, 'a, 'm) writerT) bind\" (unchecked)\n  fail_writerT \\<equiv> \"fail :: ('w, 'a, 'm) writerT fail\"\n  get_writerT \\<equiv> \"get :: ('s, ('w, 'a, 'm) writerT) get\"\n  put_writerT \\<equiv> \"put :: ('s, ('w, 'a, 'm) writerT) put\"\n  sample_writerT \\<equiv> \"sample :: ('p, ('w, 'a, 'm) writerT) sample\"\n  ask_writerT \\<equiv> \"ask :: ('r, ('w, 'a, 'm) writerT) ask\"\n  alt_writerT \\<equiv> \"alt :: ('w, 'a, 'm) writerT alt\"\n  altc_writerT \\<equiv> \"altc :: ('c, ('w, 'a, 'm) writerT) altc\"\n  pause_writerT \\<equiv> \"pause :: ('o, 'i, ('w, 'a, 'm) writerT) pause\"\n  tell_writerT \\<equiv> \"tell :: ('w, ('w, 'a, 'm) writerT) tell\" (unchecked)\nbegin\n\ndefinition return_writerT :: \"('a, ('w, 'a, 'm) writerT) return\"\nwhere [code_unfold, monad_unfold]: \"return_writerT = return_writer return\"\n\ndefinition bind_writerT :: \"('a, ('w, 'a, 'm) writerT) bind\"\nwhere [code_unfold, monad_unfold]: \"bind_writerT = bind_writer return bind\"\n                                                     \ndefinition ask_writerT :: \"('r, ('w, 'a, 'm) writerT) ask\"\nwhere [code_unfold, monad_unfold]: \"ask_writerT = ask_writer ask\"\n                                                   \ndefinition fail_writerT :: \"('w, 'a, 'm) writerT fail\"\nwhere [code_unfold, monad_unfold]: \"fail_writerT = fail_writer fail\"\n\ndefinition get_writerT :: \"('s, ('w, 'a, 'm) writerT) get\"\nwhere [code_unfold, monad_unfold]: \"get_writerT = get_writer get\"\n\ndefinition put_writerT :: \"('s, ('w, 'a, 'm) writerT) put\"\nwhere [code_unfold, monad_unfold]: \"put_writerT = put_writer put\"\n\ndefinition sample_writerT :: \"('p, ('w, 'a, 'm) writerT) sample\"\nwhere [code_unfold, monad_unfold]: \"sample_writerT = sample_writer sample\"\n\ndefinition alt_writerT :: \"('w, 'a, 'm) writerT alt\"\nwhere [code_unfold, monad_unfold]: \"alt_writerT = alt_writer alt\"\n\ndefinition altc_writerT :: \"('c, ('w, 'a, 'm) writerT) altc\"\nwhere [code_unfold, monad_unfold]: \"altc_writerT = altc_writer altc\"\n\ndefinition pause_writerT :: \"('o, 'i, ('w, 'a, 'm) writerT) pause\"\nwhere [code_unfold, monad_unfold]: \"pause_writerT = pause_writer pause\"\n\ndefinition tell_writerT :: \"('w, ('w, 'a, 'm) writerT) tell\"\nwhere [code_unfold, monad_unfold]: \"tell_writerT = tell_writer return bind\"\n\nend\n\nlemma run_bind_writerT [simp]: \n  \"run_writer (bind m f :: ('w, 'a, 'm) writerT) = bind (run_writer m) (\\<lambda>(a :: 'a, ws :: 'w list). bind (run_writer (f a)) (\\<lambda>(b :: 'a, ws' :: 'w list). return (b, ws @ ws')))\"\nby(simp add: bind_writerT_def)\n\nlemma run_return_writerT [simp]: \"run_writer (return x :: ('w, 'a, 'm) writerT) = return (x :: 'a, [] :: 'w list)\"\nby(simp add: return_writerT_def)\n\nlemma run_ask_writerT [simp]: \"run_writer (ask f) = ask (\\<lambda>r. run_writer (f r))\"\nby(simp add: ask_writerT_def)\n\nlemma run_fail_writerT [simp]: \"run_writer fail = fail\"\nby(simp add: fail_writerT_def)\n\nlemma run_get_writerT [simp]: \"run_writer (get f) = get (\\<lambda>s. run_writer (f s))\"\nby(simp add: get_writerT_def)\n\nlemma run_put_writerT [simp]: \"run_writer (put s m) = put s (run_writer m)\"\nby(simp add: put_writerT_def)\n\nlemma run_sample_writerT [simp]: \"run_writer (sample p f) = sample p (\\<lambda>x. run_writer (f x))\"\nby(simp add: sample_writerT_def)\n\n\n\nlemma run_altc_writerT [simp]: \"run_writer (altc C f) = altc C (run_writer \\<circ> f)\"\nby(simp add: altc_writerT_def o_def)\n\nlemma run_pause_writerT [simp]: \"run_writer (pause out c) = pause out (\\<lambda>input. run_writer (c input))\"\nby(simp add: pause_writerT_def)\n\nlemma run_tell_writerT [simp]: \n  \"run_writer (tell (w :: 'w) m :: ('w, 'a, 'm) writerT) = \n  bind (run_writer m) (\\<lambda>(a :: 'a, ws :: 'w list). return (a, w # ws))\"\nby(simp add: tell_writerT_def)\n\nlemma monad_writerT' [locale_witness]: \n  \"monad return (bind :: ('a \\<times> 'w list, 'm) bind)\n  \\<Longrightarrow> monad return (bind :: ('a, ('w, 'a, 'm) writerT) bind)\"\nunfolding return_writerT_def bind_writerT_def by(rule monad_writerT)\n\nlemma monad_writer_writerT' [locale_witness]: \n  \"monad return (bind :: ('a \\<times> 'w list, 'm) bind)\n  \\<Longrightarrow> monad_writer return (bind :: ('a, ('w, 'a, 'm) writerT) bind) (tell :: ('w, ('w, 'a, 'm) writerT) tell)\"\nunfolding return_writerT_def bind_writerT_def tell_writerT_def by(rule monad_writer_writerT)\n\nlemma monad_fail_writerT' [locale_witness]:\n  \"monad_fail return (bind :: ('a \\<times> 'w list, 'm) bind) fail\n  \\<Longrightarrow> monad_fail return (bind :: ('a, ('w, 'a, 'm) writerT) bind) fail\"\nunfolding return_writerT_def bind_writerT_def fail_writerT_def by(rule monad_fail_writerT)\n\nlemma monad_state_writerT' [locale_witness]:\n  \"monad_state return (bind :: ('a \\<times> 'w list, 'm) bind) (get :: ('s, 'm) get) put\n  \\<Longrightarrow> monad_state return (bind :: ('a, ('w, 'a, 'm) writerT) bind) (get :: ('s, ('w, 'a, 'm) writerT) get) put\"\nunfolding return_writerT_def bind_writerT_def get_writerT_def put_writerT_def by(rule monad_state_writerT)\n\nlemma monad_prob_writerT' [locale_witness]:\n  \"monad_prob return (bind :: ('a \\<times> 'w list, 'm) bind) (sample :: ('p, 'm) sample)\n  \\<Longrightarrow> monad_prob return (bind :: ('a, ('w, 'a, 'm) writerT) bind) (sample :: ('p, ('w, 'a, 'm) writerT) sample)\"\nunfolding return_writerT_def bind_writerT_def sample_writerT_def by(rule monad_prob_writerT)\n\nlemma monad_state_prob_writerT' [locale_witness]:\n  \"monad_state_prob return (bind :: ('a \\<times> 'w list, 'm) bind) (get :: ('s, 'm) get) put (sample :: ('p, 'm) sample)\n  \\<Longrightarrow> monad_state_prob return (bind :: ('a, ('w, 'a, 'm) writerT) bind) (get :: ('s, ('w, 'a, 'm) writerT) get) put (sample :: ('p, ('w, 'a, 'm) writerT) sample)\"\nunfolding return_writerT_def bind_writerT_def sample_writerT_def get_writerT_def put_writerT_def by(rule monad_state_prob_writerT)\n\nlemma monad_reader_writerT' [locale_witness]: \n  \"monad_reader return (bind :: ('a \\<times> 'w list, 'm) bind) (ask :: ('r, 'm) ask)\n  \\<Longrightarrow> monad_reader return (bind :: ('a, ('w, 'a, 'm) writerT) bind) (ask :: ('r, ('w, 'a, 'm) writerT) ask)\"\nunfolding return_writerT_def bind_writerT_def ask_writerT_def by(rule monad_reader_writerT)\n\nlemma monad_reader_state_writerT' [locale_witness]: \n  \"monad_reader_state return (bind :: ('a \\<times> 'w list, 'm) bind) (ask :: ('r, 'm) ask) (get :: ('s, 'm) get) put\n  \\<Longrightarrow> monad_reader_state return (bind :: ('a, ('w, 'a, 'm) writerT) bind) (ask :: ('r, ('w, 'a, 'm) writerT) ask) (get :: ('s, ('w, 'a, 'm) writerT) get) put\"\nunfolding return_writerT_def bind_writerT_def ask_writerT_def get_writerT_def put_writerT_def by(rule monad_reader_state_writerT)\n\nlemma monad_resumption_writerT' [locale_witness]:\n  \"monad_resumption return (bind :: ('a \\<times> 'w list, 'm) bind) (pause :: ('o, 'i, 'm) pause)\n  \\<Longrightarrow> monad_resumption return (bind :: ('a, ('w, 'a, 'm) writerT) bind) (pause :: ('o, 'i, ('w, 'a, 'm) writerT) pause)\"\nunfolding return_writerT_def bind_writerT_def pause_writerT_def by(rule monad_resumption_writerT)\n\nlemma monad_alt_writerT' [locale_witness]:\n  \"monad_alt return (bind :: ('a \\<times> 'w list, 'm) bind) alt\n  \\<Longrightarrow> monad_alt return (bind :: ('a, ('w, 'a, 'm) writerT) bind) alt\"\nunfolding return_writerT_def bind_writerT_def alt_writerT_def by(rule monad_alt_writerT)\n\nlemma monad_fail_alt_writerT' [locale_witness]:\n  \"monad_fail_alt return (bind :: ('a \\<times> 'w list, 'm) bind) fail alt\n  \\<Longrightarrow> monad_fail_alt return (bind :: ('a, ('w, 'a, 'm) writerT) bind) fail alt\"\nunfolding return_writerT_def bind_writerT_def fail_writerT_def alt_writerT_def by(rule monad_fail_alt_writerT)\n\nlemma monad_state_alt_writerT' [locale_witness]:\n  \"monad_state_alt return (bind :: ('a \\<times> 'w list, 'm) bind) (get :: ('s, 'm) get) put alt\n  \\<Longrightarrow> monad_state_alt return (bind :: ('a, ('w, 'a, 'm) writerT) bind) (get :: ('s, ('w, 'a, 'm) writerT) get) put alt\"\nunfolding return_writerT_def bind_writerT_def get_writerT_def put_writerT_def alt_writerT_def by(rule monad_state_alt_writerT)\n\nlemma monad_altc_writerT' [locale_witness]:\n  \"monad_altc return (bind :: ('a \\<times> 'w list, 'm) bind) (altc :: ('c, 'm) altc)\n  \\<Longrightarrow> monad_altc return (bind :: ('a, ('w, 'a, 'm) writerT) bind) (altc :: ('c, ('w, 'a, 'm) writerT) altc)\"\nunfolding return_writerT_def bind_writerT_def altc_writerT_def by(rule monad_altc_writerT)\n\nlemma monad_state_altc_writerT' [locale_witness]:\n  \"monad_state_altc return (bind :: ('a \\<times> 'w list, 'm) bind) (get :: ('s, 'm) get) put (altc :: ('c, 'm) altc)\n  \\<Longrightarrow> monad_state_altc return (bind :: ('a, ('w, 'a, 'm) writerT) bind) (get :: ('s, ('w, 'a, 'm) writerT) get) put (altc :: ('c, ('w, 'a, 'm) writerT) altc)\"\nunfolding return_writerT_def bind_writerT_def get_writerT_def put_writerT_def altc_writerT_def by(rule monad_state_altc_writerT)\n\nsubsection \\<open>Continuation monad transformer\\<close>\n\noverloading\n  return_contT \\<equiv> \"return :: ('a, ('a, 'm) contT) return\"\n  bind_contT \\<equiv> \"bind :: ('a, ('a, 'm) contT) bind\"\n  fail_contT \\<equiv> \"fail :: ('a, 'm) contT fail\"\n  get_contT \\<equiv> \"get :: ('s, ('a, 'm) contT) get\"\n  put_contT \\<equiv> \"put :: ('s, ('a, 'm) contT) put\"\nbegin\n\ndefinition return_contT :: \"('a, ('a, 'm) contT) return\"\nwhere [code_unfold, monad_unfold]: \"return_contT = return_cont\"\n\ndefinition bind_contT :: \"('a, ('a, 'm) contT) bind\"\nwhere [code_unfold, monad_unfold]: \"bind_contT = bind_cont\"\n\ndefinition fail_contT :: \"('a, 'm) contT fail\"\nwhere [code_unfold, monad_unfold]: \"fail_contT = fail_cont fail\"\n\ndefinition get_contT :: \"('s, ('a, 'm) contT) get\"\nwhere [code_unfold, monad_unfold]: \"get_contT = get_cont get\"\n\ndefinition put_contT :: \"('s, ('a, 'm) contT) put\"\nwhere [code_unfold, monad_unfold]: \"put_contT = put_cont put\"\n\nend\n\nlemma monad_contT' [locale_witness]: \"monad return (bind :: ('a, ('a, 'm) contT) bind)\"\nunfolding return_contT_def bind_contT_def by(rule monad_contT)\n\nlemma monad_fail_contT' [locale_witness]: \"monad_fail return (bind :: ('a, ('a, 'm) contT) bind) fail\"\nunfolding return_contT_def bind_contT_def fail_contT_def by(rule monad_fail_contT)\n\nlemma monad_state_contT' [locale_witness]:\n  \"monad_state return (bind :: ('a, 'm) bind) (get :: ('s, 'm) get) put\n  \\<Longrightarrow> monad_state return (bind :: ('a, ('a, 'm) contT) bind) (get :: ('s, ('a, 'm) contT) get) put\"\nunfolding return_contT_def bind_contT_def get_contT_def put_contT_def by(rule monad_state_contT)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Monomorphic_Monad/Monad_Overloading.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.5, "lm_q1q2_score": 0.30569098664707556}}
{"text": "(*Authors: Mohammad Abdulaziz*)\n\ntheory Call_By_Prefixes\n  imports IMP_Minus.Com Big_StepT\nbegin\n\nabbreviation add_prefix :: \"string \\<Rightarrow> vname \\<Rightarrow> vname\" where\n\"add_prefix p s \\<equiv> p @ s\"\n\n(*type_synonym pcom = \"string \\<Rightarrow> com\"*)\n\nfun atomExp_add_prefix where\n\"atomExp_add_prefix p (N a) = N a\" |\n\"atomExp_add_prefix p (V v) = V (add_prefix p v)\"\n\nfun aexp_add_prefix where\n\"aexp_add_prefix p (A a) = A (atomExp_add_prefix p a)\" |\n\"aexp_add_prefix p (Plus a b) = Plus (atomExp_add_prefix p a) (atomExp_add_prefix p b)\" |\n\"aexp_add_prefix p (Sub a b) = Sub (atomExp_add_prefix p a) (atomExp_add_prefix p b)\"  | \n\"aexp_add_prefix p (Parity a) = Parity (atomExp_add_prefix p a)\" |\n\"aexp_add_prefix p (RightShift a) = RightShift (atomExp_add_prefix p a)\"\n\nfun com_add_prefix where\n\"com_add_prefix p SKIP = SKIP\"\n|\"com_add_prefix p (Assign v aexp) = (Assign (add_prefix p v) (aexp_add_prefix p aexp))\"\n|\"com_add_prefix p (Seq c1 c2) = (Seq (com_add_prefix p c1) (com_add_prefix p c2))\"\n|\"com_add_prefix p (If v c1 c2) = (If (add_prefix p v) (com_add_prefix p c1) (com_add_prefix p c2))\"\n|\"com_add_prefix p (While v c) = (While (add_prefix p v) (com_add_prefix p c))\"\n\n\n(*\nabbreviation pcom_SKIP where \"pcom_SKIP p \\<equiv> SKIP\"\n\nabbreviation pcom_Assign where \"pcom_Assign v aexp p \\<equiv>\n  Assign (add_prefix p v) (aexp_add_prefix p aexp)\"\n\nabbreviation pcom_Seq where \"pcom_Seq a b p \\<equiv> (a  p) ;; (b p)\"\n\nabbreviation pcom_If where \"pcom_If v a b p \\<equiv> \n  If (add_prefix p v) (a p) (b p)\"\n\nabbreviation pcom_While where \"pcom_While v a p \\<equiv> While (add_prefix p v) (a p)\"\n\nabbreviation write_subprogram_param where \"write_subprogram_param p' a  b \\<equiv>\n  (\\<lambda>p. Assign (add_prefix (p' @ p) a) (aexp_add_prefix p b))\"\n\nabbreviation read_subprogram_param where \"read_subprogram_param a p' b \\<equiv> \n  (\\<lambda>p. Assign (add_prefix p a) (aexp_add_prefix (p' @ p) b))\"\n\nabbreviation read_write_subprogram_param where \"read_write_subprogram_param p' a p'' b \\<equiv>\n  (\\<lambda>p. Assign (add_prefix (p' @ p) a) (aexp_add_prefix (p'' @ p) b))\"\n\nunbundle no_com_syntax\n\nbundle pcom_syntax\nbegin\nnotation pcom_SKIP (\"SKIP\" [] 61) and\n         pcom_Assign (\"_ ::= _\" [1000, 61] 61) and\n         write_subprogram_param (\"[_] _ ::= _\" [1000, 61, 61] 61) and\n         read_subprogram_param (\"_ ::= [_] _\" [1000, 61, 61] 61) and\n         read_write_subprogram_param (\"[_] _ ::= [_] _\" [1000, 61, 61, 61] 61) and\n         pcom_Seq (\"_;;/ _\"  [60, 61] 60) and\n         pcom_If (\"(IF _/\\<noteq>0 THEN _/ ELSE _)\"  [0, 0, 61] 61) and\n         pcom_While (\"(WHILE _/\\<noteq>0 DO _)\"  [0, 61] 61)\nend\n\nbundle no_pcom_syntax\nbegin\nno_notation pcom_SKIP (\"SKIP\" [] 61) and\n            pcom_Assign (\"_ ::= _\" [1000, 61] 61) and\n            write_subprogram_param (\"[_] _ ::= _\" [1000, 61, 61] 61) and\n            read_subprogram_param (\"_ ::= [_] _\" [1000, 61, 61] 61) and\n            read_write_subprogram_param (\"[_] _ ::= [_] _\" [1000, 61, 61, 61] 61) and\n            pcom_Seq (\"_;;/ _\"  [60, 61] 60) and\n            pcom_If (\"(IF _/\\<noteq>0 THEN _/ ELSE _)\"  [0, 0, 61] 61) and\n            pcom_While (\"(WHILE _/\\<noteq>0 DO _)\"  [0, 61] 61)\nend\n\nunbundle pcom_syntax*)\n\nlemma atomExp_add_prefix_valid: \"(\\<And>v. v \\<in> set (atomExp_var x1) \\<Longrightarrow> s1 v = s1' (add_prefix p v)) \\<Longrightarrow>\n          atomVal x1 s1 = atomVal (atomExp_add_prefix p x1) s1'\"\n  by (cases x1) auto\n\nlemma aexp_add_prefix_valid: \"(\\<And>v. v \\<in> set (aexp_vars aexp) \\<Longrightarrow> s1 v = s1' (add_prefix p v)) \\<Longrightarrow>\n       aval aexp s1 = aval (aexp_add_prefix p aexp) s1'\"\n  by (cases aexp) (auto simp: atomExp_add_prefix_valid)\n\nlemma atomExp_add_prefix_valid': \"v \\<in> set (atomExp_var (atomExp_add_prefix p x1)) \\<Longrightarrow> \\<exists>v'. v = p @ v'\"\n  by (cases x1) (auto simp:)\n\nlemma aexp_add_prefix_valid':\"v \\<in> set (aexp_vars (aexp_add_prefix p aexp)) \\<Longrightarrow> \\<exists>v'. v = p @ v'\"\n  by (cases aexp) (auto simp: atomExp_add_prefix_valid')\n\nlemma com_add_prefix_valid': \"v \\<in> set (all_variables (com_add_prefix p c)) \\<Longrightarrow> \\<exists>v'. v = p @ v'\"\n  by (induction p c rule: com_add_prefix.induct) (auto simp: aexp_add_prefix_valid')\n\nlemma atomExp_add_prefix_valid'': \"add_prefix p1 v \\<in> set (atomExp_var (atomExp_add_prefix (p1 @ p2) x1)) \\<Longrightarrow> \\<exists>v'. v = p2 @ v'\"\n  by (cases x1) (auto simp:)\n\nlemma aexp_add_prefix_valid'':\"add_prefix p1 v \\<in> set (aexp_vars (aexp_add_prefix (p1 @ p2) aexp)) \\<Longrightarrow> \\<exists>v'. v = p2 @ v'\"\n  by (cases aexp) (auto simp: atomExp_add_prefix_valid'')\n\n\nlemma com_add_prefix_valid'': \"add_prefix p1 v \\<in> set (all_variables (com_add_prefix (p1 @ p2) c)) \\<Longrightarrow> \\<exists>v'. v = p2 @ v'\"\n  by (induction \"p1 @ p2\" c arbitrary: p1 p2 rule: com_add_prefix.induct) (auto simp: aexp_add_prefix_valid'')\n\nlemma com_add_prefix_valid_subset: \"add_prefix p1 v \\<in> set (all_variables (com_add_prefix (p1 @ p2) c)) \\<Longrightarrow> set p2 \\<subseteq> set v\"\n  using com_add_prefix_valid''\n  by (metis set_append sup_ge1)\n\nabbreviation invoke_subprogram\n  where \"invoke_subprogram \\<equiv> com_add_prefix\"\n\nlemma atomExp_add_prefix_append: \"atomExp_add_prefix p1 (atomExp_add_prefix p2 x1) = atomExp_add_prefix (add_prefix p1 p2) x1\"\n  by (cases x1) auto\n\nlemma aexp_add_prefix_append: \"aexp_add_prefix p1 (aexp_add_prefix p2 aexp) = (aexp_add_prefix (add_prefix p1 p2) aexp)\"\n  by (cases aexp) (auto simp: atomExp_add_prefix_append) \n\nlemma invoke_subprogram_append: \"invoke_subprogram p1 (invoke_subprogram p2 c) = (invoke_subprogram (p1 @ p2) c)\"\n  by (induction \"(p1 @ p2)\" c arbitrary: p1 p2 rule: com_add_prefix.induct) (auto simp: aexp_add_prefix_append)\n\nlemmas prefix_simps = com_add_prefix.simps aexp_add_prefix.simps atomExp_add_prefix.simps\n                      invoke_subprogram_append\n\nend", "meta": {"author": "AlexiosFan", "repo": "BA_NP_Reduction", "sha": "0e37ddc58cb822b0a09b2ce7c15e7b88652e154c", "save_path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction", "path": "github-repos/isabelle/AlexiosFan-BA_NP_Reduction/BA_NP_Reduction-0e37ddc58cb822b0a09b2ce7c15e7b88652e154c/poly-reductions/IMP-/Call_By_Prefixes.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.30559070232016367}}
{"text": "theory Lang_Typed\nimports Lang_Untyped TermX_Antiquot \nbegin\n\nsubsection {* Types *}\n  \ndefinition \"Type (_::('a::prog_type) itself) \n    = Abs_type \\<lparr> tr_domain=range (embedding::'a\\<Rightarrow>val),\n                 tr_default=embedding (default::'a) \\<rparr>\"\nlemma Rep_type_Type: \"Rep_type (Type (T::'a::prog_type itself)) = \n               \\<lparr> tr_domain=range (embedding::'a\\<Rightarrow>val),\n                 tr_default=embedding (default::'a) \\<rparr>\"\n  unfolding Type_def by (subst Abs_type_inverse, auto)\n\nlemma embedding_Type: \"embedding (x::'a::prog_type) \\<in> t_domain (Type TYPE('a))\"\n  unfolding Type_def t_domain_def\n  by (subst Abs_type_inverse, auto)\n(* lemma embedding_Type_range: \"range (embedding::'a\\<Rightarrow>val) = t_domain (Type TYPE('a::prog_type))\" *) (* t_domain_Type[symmetric] *)\nlemma t_domain_Type [simp]: \"t_domain (Type TYPE('a::prog_type)) = range (embedding::'a\\<Rightarrow>val)\"\n  unfolding Type_def t_domain_def\n  by (subst Abs_type_inverse, auto)\n\nlemma t_default_Type [simp]: \"t_default (Type TYPE('a::prog_type)) = embedding (default::'a)\"\n  by (simp add: Abs_type_inverse t_default_def Type_def)\n\nlemma embedding_inv_embedding:\n  assumes \"x \\<in> t_domain (Type TYPE('a::prog_type))\"\n  shows \"embedding (inv embedding x :: 'a) = x\"\nunfolding inv_def apply (rule exE_some[where P=\"\\<lambda>y. embedding y = x\"])\nusing assms by auto\n\nlemma bool_type: \"bool_type = Type TYPE(bool)\"\n  unfolding bool_type_def Type_def ..\n\nlemma prod_type: \"prod_type (Type TYPE('a::prog_type)) (Type TYPE('b::prog_type)) = Type TYPE('a\\<times>'b)\"\n  apply (subst Rep_type_inject[symmetric])\n  unfolding Rep_prod_type Rep_type_Type apply auto\n  unfolding embedding_def embedding'_prod_def default_prod_def image_def by auto  \n\nsubsection {* Variables *}\n\ndatatype ('a::prog_type) variable = Variable variable_name | LVariable variable_name\ndefinition mk_variable_untyped :: \"('a::prog_type) variable \\<Rightarrow> variable_untyped\" where\n  \"mk_variable_untyped (v::('a::prog_type)variable) = \n    (case v of Variable n \\<Rightarrow> \\<lparr> vu_name=n, vu_type=Type TYPE('a), vu_global=True \\<rparr>\n            | LVariable n \\<Rightarrow> \\<lparr> vu_name=n, vu_type=Type TYPE('a), vu_global=False \\<rparr>)\"\nlemma mk_variable_untyped_type [simp]: \"vu_type (mk_variable_untyped (v::'a variable)) = Type TYPE('a::prog_type)\"\n  unfolding mk_variable_untyped_def apply (cases v) by auto\ndefinition var_eq :: \"'a::prog_type variable \\<Rightarrow> 'b::prog_type variable \\<Rightarrow> bool\" where\n  \"var_eq v1 v2 = (mk_variable_untyped v1 = mk_variable_untyped v2)\" \nlemma var_eq_same [simp]: \"var_eq v v\"\n  unfolding var_eq_def by simp\nlemma var_eq_notsame_gg [simp]: \"v\\<noteq>w \\<Longrightarrow> \\<not> var_eq (Variable v) (Variable w)\"\n  unfolding var_eq_def mk_variable_untyped_def by simp\nlemma var_eq_notsame_ll [simp]: \"v\\<noteq>w \\<Longrightarrow> \\<not> var_eq (LVariable v) (LVariable w)\"\n  unfolding var_eq_def mk_variable_untyped_def by simp\nlemma var_eq_notsame_gl [simp]: \"\\<not> var_eq (Variable v) (LVariable w)\"\n  unfolding var_eq_def mk_variable_untyped_def by simp\nlemma var_eq_notsame_lg [simp]: \"\\<not> var_eq (LVariable v) (Variable w)\"\n  unfolding var_eq_def mk_variable_untyped_def by simp\n\nlemma vu_name_make_variable_untyped1 [simp]: \"vu_name (mk_variable_untyped (Variable n)) = n\"\n  unfolding mk_variable_untyped_def by simp\nlemma vu_name_make_variable_untyped2 [simp]: \"vu_name (mk_variable_untyped (LVariable n)) = n\"\n  unfolding mk_variable_untyped_def by simp\n\ndefinition mk_variable_typed :: \"variable_untyped \\<Rightarrow> 'a::prog_type variable\" where\n  \"mk_variable_typed v = (if vu_global v then Variable (vu_name v) else LVariable (vu_name v))\"\nlemma mk_variable_untyped_inverse [simp]: \"mk_variable_typed (mk_variable_untyped v) = v\"\n  by (cases v, simp_all add: mk_variable_typed_def mk_variable_untyped_def)\nlemma mk_variable_untyped_inject: \"(mk_variable_untyped x = mk_variable_untyped y) = (x = y)\"\n  by (metis mk_variable_untyped_inverse)\nlemma mk_variable_typed_inverse: \n  assumes \"vu_type x = Type TYPE('a::prog_type)\"\n  shows \"mk_variable_untyped (mk_variable_typed x :: 'a variable) = x\"\nusing assms by (cases x, simp_all add: mk_variable_typed_def mk_variable_untyped_def)\n\n\nsubsection {* Memories *}\n\ndefinition \"memory_lookup m (v::'a variable) :: ('a::prog_type) == inv embedding (memory_lookup_untyped m (mk_variable_untyped v))\"\ndefinition \"memory_update m (v::'a variable) (a::'a::prog_type) =\n  memory_update_untyped m (mk_variable_untyped v) (embedding a)\"\n\nlemma Rep_memory_update [simp]:\n  shows \"Rep_memory (memory_update m x v) = (Rep_memory m)(mk_variable_untyped x := embedding v)\"\n  unfolding memory_update_def by (subst Rep_memory_update_untyped', auto simp: embedding_Type)\n\nlemma memory_lookup_update_same [simp]: \"memory_lookup (memory_update m v a) v = a\"\n  unfolding memory_lookup_def memory_update_def\n  apply (subst memory_lookup_update_same_untyped)\n  close (metis embedding_Type mk_variable_untyped_type)\n  by (metis embedding_inv f_inv_into_f rangeI)\nlemma memory_lookup_update_same': \"var_eq v w \\<Longrightarrow> (memory_lookup (memory_update m v a) w == a)\"\n  unfolding var_eq_def memory_update_def memory_lookup_def \n  apply simp apply (subst memory_lookup_update_same_untyped)\n  by (simp_all add: embedding_Type)\nlemma memory_lookup_update_notsame [simp]: \n  \"\\<not>var_eq v w \\<Longrightarrow> memory_lookup (memory_update m v a) w == memory_lookup m w\"\n  unfolding var_eq_def memory_lookup_def memory_update_def\n  by (simp add: memory_lookup_update_notsame_untyped)  \n  \nlemma memory_lookup_untyped_mk_variable_untyped [simp]:\n  \"memory_lookup_untyped m (mk_variable_untyped x) = embedding (memory_lookup m x)\"\nproof -\n  define v where \"v == memory_lookup_untyped m (mk_variable_untyped x)\"\n  have v_type: \"v \\<in> t_domain (Type TYPE('a))\"\n    by (metis v_def memory_lookup_untyped_type mk_variable_untyped_type)\n  have v_range: \"v \\<in> range (embedding::'a\\<Rightarrow>val)\"\n    by (simp del: t_domain_Type add: t_domain_Type[symmetric] v_type)\n  have \"v = embedding (inv embedding v :: 'a)\"\n    by (simp add: v_range f_inv_into_f)\n  thus ?thesis unfolding v_def memory_lookup_def .\nqed\n\nlemma memory_update_lookup: \"memory_update m x (memory_lookup m x) = m\"\n  unfolding memory_update_def memory_lookup_def\n  apply (rule Rep_memory_inject[THEN iffD1], simp)\n  unfolding  memory_lookup_def\n  apply (subst embedding_inv_embedding)\n   close (simp add: embedding_Type)\n  apply (subst memory_update_lookup_untyped)\n  by rule\n\nsubsection {* Expressions *}\n\nrecord 'a expression_rep =\n  er_fun :: \"memory \\<Rightarrow> 'a\"\n  er_vars :: \"variable_untyped list\"\ntypedef 'a expression = \"{(e::'a expression_rep).\n  (\\<forall>m1 m2. (\\<forall>v\\<in>set (er_vars e). memory_lookup_untyped m1 v = memory_lookup_untyped m2 v) \\<longrightarrow> er_fun e m1 = er_fun e m2)}\"\n  by (rule exI[of _ \"\\<lparr> er_fun=(\\<lambda>m. undefined),\n                       er_vars=[] \\<rparr>\"], simp)\ndefinition \"e_fun e == er_fun (Rep_expression e)\"\ndefinition \"e_vars e == er_vars (Rep_expression e)\"\ndefinition \"mk_expression_untyped (e::('a::prog_type)expression) =\n  Abs_expression_untyped \\<lparr> eur_fun=\\<lambda>m. embedding (e_fun e m),\n                           eur_type=Type TYPE('a),\n                           eur_vars=e_vars e \\<rparr>\"\nlemma Rep_mk_expression_untyped [simp]: \n  \"Rep_expression_untyped (mk_expression_untyped (e::('a::prog_type)expression)) =\n  \\<lparr> eur_fun=\\<lambda>m. embedding (e_fun e m), eur_type=Type TYPE('a), eur_vars=e_vars e \\<rparr>\"\nunfolding mk_expression_untyped_def\napply (subst Abs_expression_untyped_inverse) \nusing Rep_expression by (auto simp: embedding_Type e_fun_def e_vars_def)\n\ndefinition \"mk_expression_typed (e::expression_untyped) = \n  Abs_expression \\<lparr> er_fun=\\<lambda>m. inv embedding (eu_fun e m),\n                   er_vars=eu_vars e \\<rparr>\"\nlemma Rep_mk_expression_typed [simp]: \"Rep_expression (mk_expression_typed e) =\n  \\<lparr> er_fun=\\<lambda>m. inv embedding (eu_fun e m), er_vars=eu_vars e \\<rparr>\"\n      unfolding mk_expression_typed_def\n      apply (subst Abs_expression_inverse, auto)\n      using eu_fun_footprint by fastforce\n\nlemma e_fun_eu_fun: \"e_fun e = inv embedding o eu_fun (mk_expression_untyped e)\"\n  unfolding eu_fun_def Rep_mk_expression_untyped o_def by simp\nlemma e_vars_eu_vars: \"e_vars e = eu_vars (mk_expression_untyped e)\"\n  unfolding eu_vars_def Rep_mk_expression_untyped o_def by simp\n\nlemma e_fun_footprint: \n  assumes \"\\<And>v. v\\<in>set (e_vars e) \\<Longrightarrow> memory_lookup_untyped m1 v = memory_lookup_untyped m2 v\"\n  shows \"e_fun (e::'a::prog_type expression) m1 = e_fun e m2\"\nunfolding e_fun_eu_fun o_def\napply (tactic \\<open>cong_tac @{context} 1\\<close>, simp)\napply (subst eu_fun_footprint)\nusing assms unfolding e_vars_eu_vars by auto\n\nlemma mk_expression_typed_inverse:\n  assumes \"eu_type e=Type TYPE('a)\"\n  shows \"mk_expression_untyped (mk_expression_typed e :: 'a::prog_type expression) = e\"\nproof (rule trans[OF _ Rep_expression_untyped_inverse], cases \"Rep_expression_untyped e\")\n  fix f t v assume e_parts: \"Rep_expression_untyped e = \\<lparr>eur_fun=f, eur_type=t, eur_vars=v\\<rparr>\"\n  have f_t: \"\\<And>m. f m \\<in> t_domain t\"\n    by (metis (erased, lifting) Rep_expression_untyped e_parts expression_untyped_rep.select_convs(1) expression_untyped_rep.select_convs(2) mem_Collect_eq)\n  have t: \"t=Type TYPE('a)\"\n    by (metis assms e_parts eu_type_def expression_untyped_rep.select_convs(2)) \n  have f_touches: \"\\<And>m1 m2. (\\<forall>v\\<in>set v. \n    memory_lookup_untyped m1 v = memory_lookup_untyped m2 v) \\<longrightarrow> f m1 = f m2\"\n    using Rep_expression_untyped[of e] unfolding e_parts by auto\n  have rep_abs: \"Rep_expression (Abs_expression \\<lparr>er_fun = \\<lambda>m. inv embedding (f m), er_vars = v\\<rparr>)\n              = \\<lparr>er_fun = \\<lambda>m. inv embedding (f m), er_vars = v\\<rparr>\"\n    by (subst Abs_expression_inverse, auto, metis f_touches)\n  have inv: \"\\<And>m. embedding (inv embedding (f m)::'a) = f m\"\n    apply (subst f_inv_into_f[where f=embedding], auto)\n    using f_t unfolding t by simp\n  have h1: \"mk_expression_untyped (Abs_expression \\<lparr>er_fun = \\<lambda>m. inv embedding (f m), er_vars = v\\<rparr> :: 'a expression) =\n    Abs_expression_untyped \\<lparr>eur_fun = f, eur_type = t, eur_vars = v\\<rparr>\"\n    unfolding mk_expression_untyped_def \n    apply (subst Abs_expression_untyped_inject)\n    unfolding e_fun_def e_vars_def\n    apply (auto simp: embedding_Type)\n    close (metis expression_rep.select_convs(1) expression_rep.select_convs(2) f_touches rep_abs)\n    close (fact f_t)\n    close (metis f_touches)\n    unfolding rep_abs apply (auto simp: t)\n    by (simp add: inv)\n\n  show \"mk_expression_untyped (mk_expression_typed e::'a expression) =\n       Abs_expression_untyped (Rep_expression_untyped e)\"\n       unfolding e_parts\n       apply (subst mk_expression_typed_def)\n       unfolding eu_fun_def eu_vars_def e_parts apply simp\n       using h1 .\nqed\n\nlemma mk_expression_untyped_fun [simp]: \"eu_fun (mk_expression_untyped (e::'a::prog_type expression)) m = embedding (e_fun e m)\"\n  unfolding mk_expression_untyped_def eu_fun_def\n  apply (subst Abs_expression_untyped_inverse, auto simp: embedding_Type)\n  unfolding e_fun_def e_vars_def using Rep_expression by auto\nlemma mk_expression_untyped_type [simp]: \"eu_type (mk_expression_untyped (e::'a::prog_type expression)) = Type TYPE('a)\"\n  unfolding mk_expression_untyped_def eu_type_def\n  apply (subst Abs_expression_untyped_inverse, auto simp: embedding_Type)\n  unfolding e_fun_def e_vars_def using Rep_expression by blast\nlemma mk_expression_untyped_vars [simp]: \"eu_vars (mk_expression_untyped (e::'a::prog_type expression)) = e_vars e\"\n  unfolding mk_expression_untyped_def eu_vars_def\n  apply (subst Abs_expression_untyped_inverse, auto simp: embedding_Type)\n  unfolding e_fun_def e_vars_def using Rep_expression by blast\nlemma e_fun_bool_untyped: \"e_fun (e::bool expression) m = (eu_fun (mk_expression_untyped e) m = embedding True)\"\n  by (metis (poly_guards_query) embedding_inv mk_expression_untyped_fun)\n\nlemma mk_expression_untyped_inverse: \"mk_expression_typed (mk_expression_untyped e) = e\"\n  unfolding mk_expression_typed_def apply simp\n  by (metis (full_types) Rep_expression_inverse e_fun_def e_vars_def expression_rep.surjective unit.exhaust)\n\nlemma mk_expression_untyped_inject: \"(mk_expression_untyped a = mk_expression_untyped b) = (a=b)\"\n  by (metis mk_expression_untyped_inverse)\n\ndefinition \"mk_expression_distr (e::('a::prog_type)distr expression) =\n  Abs_expression_distr \\<lparr> edr_fun=\\<lambda>m. apply_to_distr embedding (e_fun e m),\n                         edr_type=Type TYPE('a),\n                         edr_vars=e_vars e \\<rparr>\"\nlemma Rep_mk_expression_distr: \"Rep_expression_distr (mk_expression_distr (e::('a::prog_type)distr expression)) =\n  \\<lparr> edr_fun=\\<lambda>m. apply_to_distr embedding (e_fun e m),\n    edr_type=Type TYPE('a),\n    edr_vars=e_vars e \\<rparr>\"\n      unfolding mk_expression_distr_def\n      apply (subst Abs_expression_distr_inverse, auto)\n      by (metis embedding_inv' eu_fun_footprint mk_expression_untyped_fun mk_expression_untyped_vars)\n\ndefinition mk_expression_distr_typed :: \"expression_distr \\<Rightarrow> 'a::prog_type distr expression\" where\n  \"mk_expression_distr_typed e = \n      Abs_expression \\<lparr> er_fun=\\<lambda>m. apply_to_distr (inv embedding) (ed_fun e m),\n                     er_vars=ed_vars e \\<rparr>\"\nlemma Rep_mk_expression_distr_typed: \"Rep_expression (mk_expression_distr_typed e) =\n  \\<lparr> er_fun=\\<lambda>m. apply_to_distr (inv embedding) (ed_fun e m), er_vars=ed_vars e \\<rparr>\"\n      unfolding mk_expression_distr_typed_def\n      apply (subst Abs_expression_inverse, auto)\n      using ed_fun_footprint by fastforce\n\nlemma mk_expression_distr_mk_expression_typed:\n  fixes e :: expression_untyped\n  assumes \"eu_type e = Type TYPE('a distr)\"\n  shows \"Rep_expression_distr (mk_expression_distr (mk_expression_typed e :: 'a::prog_type distr expression)) = \n    \\<lparr> edr_fun = (\\<lambda>x. apply_to_distr embedding (inv embedding x :: 'a distr)) o (eu_fun e), \n      edr_type=Type TYPE('a), edr_vars=eu_vars e \\<rparr>\"\napply (subst Rep_mk_expression_distr, auto simp: e_vars_def)\nunfolding e_fun_def o_def\nby (subst Rep_mk_expression_typed, simp)\n\n\nlemma mk_expression_distr_typed_inverse:\n  assumes \"ed_type e=Type TYPE('a::prog_type)\"\n  shows \"mk_expression_distr (mk_expression_distr_typed e :: 'a distr expression) = e\"\nproof -\n  obtain f t v where e_parts: \"Rep_expression_distr e = \\<lparr>edr_fun=f, edr_type=t, edr_vars=v\\<rparr>\" \n      and f_supp: \"\\<And>m. support_distr (f m) \\<subseteq> t_domain t\"\n        by (metis (mono_tags, lifting) Rep_expression_distr expression_distr_rep.surjective mem_Collect_eq old.unit.exhaust) \n  hence t: \"t = Type TYPE('a)\" using assms by (simp add: ed_type_def) \n  have F: \"\\<And>F \\<mu>. (\\<forall>x\\<in>support_distr \\<mu>. F x = x) \\<Longrightarrow> apply_to_distr F \\<mu> = \\<mu>\"\n    using apply_to_distr_cong by fastforce\n  have f: \"\\<And>m. apply_to_distr (\\<lambda>x::val. embedding (inv embedding x :: 'a)) (f m) = f m\"\n    apply (rule F) using f_supp t embedding_inv_embedding by blast\n  show ?thesis\n    apply (rule Rep_expression_distr_inject[THEN iffD1])\n    apply (subst Rep_mk_expression_distr)\n    unfolding e_fun_def e_vars_def\n    apply (subst Rep_mk_expression_distr_typed)+\n    unfolding ed_vars_def ed_fun_def e_parts t\n    using f by auto\nqed\n\nlemma mk_expression_distr_fun [simp]: \"ed_fun (mk_expression_distr (e::'a::prog_type distr expression)) m = apply_to_distr embedding (e_fun e m)\"\n  unfolding mk_expression_distr_def ed_fun_def\n  apply (subst Abs_expression_distr_inverse, auto simp: embedding_Type)\n  unfolding e_fun_def e_vars_def \n  using Rep_expression[of e] by force\n\nlemma mk_expression_distr_vars [simp]: \"ed_vars (mk_expression_distr (e::'a::prog_type distr expression)) = e_vars e\"\n  unfolding mk_expression_distr_def ed_vars_def\n  apply (subst Abs_expression_distr_inverse, auto simp: embedding_Type)\n  unfolding e_fun_def e_vars_def \n  using Rep_expression[of e] by force\n\nlemma mk_expression_distr_type [simp]: \"ed_type (mk_expression_distr (e::'a::prog_type distr expression)) = Type TYPE('a)\"\n  unfolding mk_expression_distr_def ed_type_def\n  apply (subst Abs_expression_distr_inverse, auto simp: embedding_Type)\n  unfolding e_fun_def e_vars_def \n  using Rep_expression[of e] by force\n\n\ndefinition const_expression :: \"'a \\<Rightarrow> 'a expression\" where\n  \"const_expression x = Abs_expression \\<lparr> er_fun=\\<lambda>m. x, er_vars=[] \\<rparr>\"\nlemma e_fun_const_expression [simp]: \"e_fun (const_expression a) = (\\<lambda>m. a)\"\n  unfolding const_expression_def e_fun_def\n  by (subst Abs_expression_inverse, auto)\nlemma e_vars_const_expression [simp]: \"e_vars (const_expression x) = []\"\n  by (simp add: e_vars_def const_expression_def Abs_expression_inverse) \nlemma mk_expression_untyped_const_expression:\n  \"mk_expression_untyped (const_expression (x::'a::prog_type)) = const_expression_untyped (Type TYPE('a)) (embedding x)\"\n  unfolding const_expression_def const_expression_untyped_def mk_expression_untyped_def e_fun_def e_vars_def\n  by (subst Abs_expression_inverse, auto?)+\n\n\ndefinition apply_expression :: \"('a\\<Rightarrow>'b)expression \\<Rightarrow> ('a::prog_type) variable \\<Rightarrow> 'b expression\" where\n\"apply_expression e v = Abs_expression\n  \\<lparr> er_fun=\\<lambda>m. (e_fun e m) (memory_lookup m v),\n    er_vars=mk_variable_untyped v#e_vars e \\<rparr>\"\nlemma Rep_apply_expression: \"Rep_expression_untyped (mk_expression_untyped (apply_expression e v :: 'a expression)) =\n  \\<lparr> eur_fun=(\\<lambda>m::memory. embedding (e_fun e m (memory_lookup m v))),\n    eur_type=Type TYPE('a::prog_type),\n    eur_vars=mk_variable_untyped v # e_vars e \\<rparr>\"\n  unfolding apply_expression_def \n  apply (auto simp: e_fun_def e_vars_def)\n  apply (subst Abs_expression_inverse, auto) \n   close (smt Rep_expression e_vars_def mem_Collect_eq)\n  apply (subst Abs_expression_inverse, auto)\n  using Rep_expression by fastforce\n  \nlemma e_fun_apply_expression [simp]: \"e_fun (apply_expression e v) = (\\<lambda>m. (e_fun e m) (memory_lookup m v))\"\n  unfolding apply_expression_def e_fun_def e_vars_def memory_lookup_def\n  apply (subst Abs_expression_inverse, auto)\n  using Rep_expression by fastforce\nlemma e_vars_apply_expression [simp]: \"e_vars (apply_expression e v) = mk_variable_untyped v # e_vars e\"\n  unfolding apply_expression_def e_vars_def e_fun_def memory_lookup_def apply (subst Abs_expression_inverse, auto)\n  using Rep_expression by fastforce\n\ndefinition var_expression :: \"('a::prog_type) variable \\<Rightarrow> 'a expression\" where\n\"var_expression v = Abs_expression\n  \\<lparr> er_fun=\\<lambda>m. memory_lookup m v,\n    er_vars=[mk_variable_untyped v] \\<rparr>\"\nlemma e_fun_var_expression [simp]: \"e_fun (var_expression v) = (\\<lambda>m. memory_lookup m v)\"\n  unfolding e_fun_def var_expression_def memory_lookup_def\n  by (subst Abs_expression_inverse, auto)\nlemma e_vars_var_expression [simp]: \"e_vars (var_expression v) = [mk_variable_untyped v]\"\n  unfolding e_vars_def var_expression_def\n  by (subst Abs_expression_inverse, auto)\n\nsubsection {* Patterns *}\n\ntypedef (overloaded) ('a::prog_type) pattern = \"{pat. pu_type pat = Type TYPE('a)}\"\n  by (rule exI[of _ \"pattern_ignore (Type TYPE('a))\"], simp)\n(* abbreviation \"mk_pattern_untyped == Rep_pattern\" *)\ndefinition \"p_vars p = pu_vars (Rep_pattern p)\"\nlemma Rep_pu_type [simp]: \"pu_type (Rep_pattern (p::'a pattern)) = Type TYPE('a::prog_type)\"\n  using Rep_pattern by simp\ndefinition \"p_var_getters p = pu_var_getters (Rep_pattern p)\"\n\ndefinition \"ignore_pattern = (Abs_pattern (pattern_ignore (Type TYPE('a))) :: 'a::prog_type pattern)\"\nlemma Rep_ignore_pattern: \"Rep_pattern (ignore_pattern :: 'a pattern) = pattern_ignore (Type TYPE('a::prog_type))\"\n  by (simp add: Abs_pattern_inverse ignore_pattern_def)\n(*lemma Rep_ignore_pattern: \"Rep_pattern_untyped (Rep_pattern (ignore_pattern :: 'a::prog_type pattern)) = \n    \\<lparr> pur_var_getters=[], pur_type=Type TYPE('a) \\<rparr>\"\n  unfolding ignore_pattern_def apply (subst Abs_pattern_inverse)\n   close (simp add: Type_def unit_type_def)\n  unfolding pattern_ignore_def apply (subst Abs_pattern_untyped_inverse)\n   by (simp_all add: Type_def unit_type_def)*)\n\nlemma vars_ignore_pattern [simp]: \"p_vars ignore_pattern = []\"\n  unfolding p_vars_def ignore_pattern_def apply (subst Abs_pattern_inverse) by (auto simp: Type_def unit_type_def)\n\n\n\n\nlemma no_vars_ignore_pattern: \"p_vars p = [] \\<Longrightarrow> p = ignore_pattern\"\nproof -\n  define p' where \"p' == Rep_pattern p\"\n  assume \"p_vars p = []\"\n  hence \"pu_vars p' = []\"\n    by (simp add: p'_def p_vars_def) \n  hence \"p' = pattern_ignore (pu_type p')\"\n    by (rule no_vars_ignore_pattern_untyped)\n  hence \"p' = pattern_ignore (Type TYPE('a))\"\n    by (simp add: p'_def)\n  thus \"p = ignore_pattern\"\n    by (metis Rep_pattern_inverse ignore_pattern_def p'_def)\nqed\n\n\ndefinition \"pair_pattern (p1::'a::prog_type pattern) (p2::'b::prog_type pattern) = (Abs_pattern (pair_pattern_untyped (Rep_pattern p1) (Rep_pattern p2)) :: ('a\\<times>'b) pattern)\"\n\nlemma Rep_pair_pattern: \"Rep_pattern (pair_pattern (p1::'a::prog_type pattern) (p2::'b::prog_type pattern))\n                      = pair_pattern_untyped (Rep_pattern p1) (Rep_pattern p2)\"\nunfolding pair_pattern_def apply (subst Abs_pattern_inverse) using prod_type by auto\n\n\nlemma var_getters_pair_pattern: \"p_var_getters (pair_pattern (p1::'a::prog_type pattern) (p2::'b::prog_type pattern)) = \n(let T = Type TYPE('a\\<times>'b)\n in map (\\<lambda>(v, g). (v, \\<lambda>x. if x \\<in> t_domain T then (g \\<circ> fst \\<circ> inv val_prod_embedding) x else t_default (vu_type v))) (p_var_getters p1) @\n    map (\\<lambda>(v, g). (v, \\<lambda>x. if x \\<in> t_domain T then (g \\<circ> snd \\<circ> inv val_prod_embedding) x else t_default (vu_type v))) (p_var_getters p2))\"\nunfolding p_var_getters_def Rep_pair_pattern pu_var_getters_pair_pattern\nunfolding pu_type_pair_pattern prod_type Rep_pu_type\nby simp\n(*proof -\n  find_theorems \"inv (_ o _)\"\n  have t1: \"g o fst \\<circ> inv val_prod_embedding = g o embedding \\<circ> fst \\<circ> inv (embedding::'a\\<times>'b\\<Rightarrow>_)\" for g::\"val\\<Rightarrow>val\"\n    unfolding embedding_def embedding'_prod_def o_def[symmetric] apply simp\nby later\n  have t2: \"\\<And>g::val\\<Rightarrow>val. g o snd \\<circ> inv val_prod_embedding = g o embedding \\<circ> snd \\<circ> inv (embedding::'a\\<times>'b\\<Rightarrow>_)\" by later\n  show ?thesis\n    unfolding p_var_getters_def pu_var_getters_def Rep_pair_pattern Rep_pair_pattern_untyped t1 t2 by simp\nqed*)\nlemma vars_pair_pattern [simp]: \"p_vars (pair_pattern p1 p2) = p_vars p1 @ p_vars p2\"\n    unfolding p_vars_def pu_vars_def unfolding Rep_pair_pattern by auto\n\n\n\ndefinition \"variable_pattern (v::'a::prog_type variable) = (Abs_pattern (pattern_1var (mk_variable_untyped v)) :: 'a pattern)\"\nlemma Rep_variable_pattern: \"Rep_pattern (variable_pattern v) = pattern_1var (mk_variable_untyped v)\"\n  unfolding variable_pattern_def apply (subst Abs_pattern_inverse) by auto\nlemma vars_variable_pattern [simp]: \"p_vars (variable_pattern v) = [mk_variable_untyped v]\" \n  unfolding p_vars_def Rep_variable_pattern by simp\n\ndefinition \"memory_update_pattern m (v::'a pattern) (a::'a::prog_type) =\n  memory_update_untyped_pattern m (Rep_pattern v) (embedding a)\"\n\n(* lemma memory_update_unit_pattern [simp]: \"memory_update_pattern m unit_pattern x = m\"\n  unfolding memory_update_pattern_def memory_update_untyped_pattern_def pu_var_getters_def Rep_unit_pattern\n  by simp *)\nlemma memory_update_ignore_pattern [simp]: \"memory_update_pattern m ignore_pattern x = m\"\n  unfolding memory_update_pattern_def memory_update_untyped_pattern_def pu_var_getters_def Rep_ignore_pattern Rep_pattern_ignore\n  by simp\nlemma memory_update_variable_pattern [simp]: \"memory_update_pattern m (variable_pattern v) x = memory_update m v x\"\n  unfolding memory_update_pattern_def memory_update_untyped_pattern_def variable_pattern_def\n  apply (subst Abs_pattern_inverse)\n   close simp\n  by (simp add: embedding_Type memory_update_def)\n\n\nlemma memory_update_pair_pattern [simp]:\n  \"memory_update_pattern m (pair_pattern p1 p2) (x1,x2) = memory_update_pattern (memory_update_pattern m p1 x1) p2 x2\"\nunfolding memory_update_pattern_def Rep_pair_pattern embedding_def embedding'_prod_def apply simp\napply (rule memory_update_pair_pattern_untyped)\nby (simp_all add: embedding_def)\n\n\nlemma memory_update_pair_pattern':\n  \"memory_update_pattern m (pair_pattern p1 p2) x = memory_update_pattern (memory_update_pattern m p1 (fst x)) p2 (snd x)\"\n  by (cases x, simp)\n\n\ndefinition kill_vars_pattern :: \"'a::prog_type pattern \\<Rightarrow> variable_untyped set \\<Rightarrow> 'a pattern\" where\n  \"kill_vars_pattern p X = Abs_pattern (kill_vars_pattern_untyped (Rep_pattern p) X)\"\nlemma Rep_kill_vars_pattern: \"Rep_pattern (kill_vars_pattern p X) = kill_vars_pattern_untyped (Rep_pattern p) X\"\n  unfolding kill_vars_pattern_def apply (subst Abs_pattern_inverse) by auto\nlemma p_var_getters_kill_vars_pattern: \"p_var_getters (kill_vars_pattern p X) = filter (\\<lambda>(v,g). v \\<notin> X) (p_var_getters p)\"\n  unfolding p_var_getters_def Rep_kill_vars_pattern pu_var_getters_kill_vars_pattern_untyped by simp\nlemma p_vars_kill_vars_pattern: \"p_vars (kill_vars_pattern p X) = filter (\\<lambda>v. v \\<notin> X) (p_vars p)\"\n  unfolding p_vars_def Rep_kill_vars_pattern pu_vars_kill_vars_pattern_untyped by simp\n\n\nlemma memory_update_pattern_twice_kill: \n  \"memory_update_pattern (memory_update_pattern m p x) q y = \n   memory_update_pattern (memory_update_pattern m (kill_vars_pattern p (set (p_vars q))) x) q y\"\nby (metis (no_types, lifting) Rep_kill_vars_pattern memory_update_pattern_def memory_update_pattern_twice_kill_untyped p_vars_def)\n\nlemma memory_update_pattern_twice [simp]: \"memory_update_pattern (memory_update_pattern m p x) p y = memory_update_pattern m p y\"\nproof -\n  define kp where \"kp == kill_vars_pattern p (set (p_vars p))\"\n  have \"set (p_vars kp) = {}\"\n    unfolding kp_def p_vars_kill_vars_pattern by auto\n  hence \"p_vars kp = []\" by auto\n  hence ignore: \"kp = ignore_pattern\"\n    by (rule no_vars_ignore_pattern)\n  show ?thesis\n    apply (subst memory_update_pattern_twice_kill)\n    unfolding kp_def[symmetric] ignore by auto\nqed\n\n\ndefinition \"memory_pattern_related p1 p2 m1 m2 = (\\<exists>v. m1 = memory_update_pattern m1 p1 v \\<and> m2 = memory_update_pattern m2 p2 v)\"\n\nlemma memory_pattern_related_variable_pattern [simp]: \n  \"memory_pattern_related (variable_pattern x) (variable_pattern y) m1 m2 = (memory_lookup m1 x = memory_lookup m2 y)\"\n  unfolding memory_pattern_related_def memory_update_variable_pattern\n  by (metis memory_update_lookup memory_lookup_update_same)\n\n\nlemma memory_pattern_relatedI: \"m1 = memory_update_pattern m1' p1 v \\<Longrightarrow> m2 = memory_update_pattern m2' p2 v \\<Longrightarrow> memory_pattern_related p1 p2 m1 m2\"\n  unfolding memory_pattern_related_def apply (rule exI[of _ v]) by auto\n\n\nsubsection {* Procedures *}\n\n\n\nrecord (overloaded) ('a,'b) procedure = \n  p_body :: program\n  p_arg :: \"'a pattern\"\n  p_return :: \"'b expression\"\n\ndefinition \"mk_procedure_untyped proc = \n  Proc (Rep_program (p_body proc)) (Rep_pattern (p_arg proc)) (mk_expression_untyped (p_return proc))\"\n\nfun mk_procedure_typed :: \"procedure_rep \\<Rightarrow> ('a::prog_type, 'b::prog_type, 'c) procedure_ext\"  where\n \"mk_procedure_typed (Proc body args return) = \n    \\<lparr> p_body=Abs_program body, p_arg=Abs_pattern args, p_return=mk_expression_typed return, \\<dots> = undefined\\<rparr>\"\n| \"mk_procedure_typed _ = undefined\"\n\n(*definition \"mk_procedure args body return = \\<lparr> p_body=body, p_arg=pattern_of args, p_return=return \\<rparr>\"*)\n\nclass singleton = \n  fixes the_singleton::'a (* Why do we need this? *)\n  assumes singleton_eq [simp]: \"a=b\"\nhide_const the_singleton\n\ninstantiation unit :: singleton begin\n  instance apply intro_classes by auto\nend\n\nlemma mk_procedure_untyped_inverse:\n  shows \"mk_procedure_typed (mk_procedure_untyped p) = (p::('a::prog_type,'b::prog_type,'c::singleton)procedure_ext)\"\nunfolding mk_procedure_untyped_def \napply (cases p)\nby (auto simp: Rep_program_inverse mk_expression_untyped_inverse Rep_pattern_inverse)\n\n\nlemma mk_procedure_typed_inverse:\n  fixes body args return\n  assumes \"well_typed body\"\n  assumes \"pu_type args = Type TYPE('a)\"\n  assumes \"eu_type return = Type TYPE('b)\"\n  defines \"p == Proc body args return\"\n  shows \"mk_procedure_untyped (mk_procedure_typed p :: ('a::prog_type,'b::prog_type,'c)procedure_ext) = p\"\n  unfolding mk_procedure_untyped_def p_def apply auto\n  apply (subst Abs_program_inverse, auto simp: assms)\n  apply (simp add: Abs_pattern_inverse assms)\n  by (subst mk_expression_typed_inverse, auto simp: assms)\n\n\ndefinition \"procedure_type (_::('a::prog_type,'b::prog_type,'c) procedure_ext itself) = \n  \\<lparr> pt_argtype=Type TYPE('a), pt_returntype=Type TYPE('b) \\<rparr>\"\n\nlemma mk_procedure_untyped:\n  fixes p0::\"('a::prog_type,'b::prog_type,'c)procedure_ext\"\n  defines \"p == mk_procedure_untyped p0\"\n  shows \"well_typed_proc p\" and \"proctype_of p = procedure_type TYPE(('a,'b,'c)procedure_ext)\"\nby (simp_all add: mk_procedure_untyped_def p_def procedure_type_def)\n\n(*\ndefinition procargs_empty :: \"unit procargs\" where\n  \"procargs_empty = Abs_procargs []\"\ndefinition procargs_add :: \"('a::prog_type) expression \\<Rightarrow> ('b::procargs) procargs \\<Rightarrow> ('a*'b) procargs\" where\n  \"procargs_add e es = Abs_procargs (mk_expression_untyped e#Rep_procargs es)\"\ndefinition procargvars_empty :: \"unit procargvars\" where\n  \"procargvars_empty = Abs_procargvars []\"\ndefinition procargvars_add :: \"('a::prog_type) variable \\<Rightarrow> ('b::procargs) procargvars \\<Rightarrow> ('a*'b) procargvars\" where\n  \"procargvars_add v vs = Abs_procargvars (mk_variable_untyped v#Rep_procargvars vs)\"\n*)\n\n(*\nlemma procedure_type_procargvars:\n  assumes procT: \"proctype_of (Proc body args ret) = procedure_type TYPE(('a::procargs,'b::prog_type,'c)procedure_ext)\"\n  and wt: \"well_typed_proc (Proc body args ret)\"\n  shows \"args \\<in> procargvars TYPE('a)\"\nproof -\n  from procT have t: \"procargtypes TYPE('a) = map vu_type args\"\n    by (simp add: procedure_type_def)\n  from wt have dist_glob: \"distinct args \\<and> (\\<forall>v\\<in>set args. \\<not> vu_global v)\"\n    by simp\n  show \"args \\<in> procargvars TYPE('a)\"\n    unfolding procargvars_def apply (simp add: dist_glob)\n    unfolding t list_all2_map2 by simp\nqed\n*)\n\n(*\nlemma procargvars_add_untyped [simp]: \"mk_procargvars_untyped (procargvars_add x a) = mk_variable_untyped x # mk_procargvars_untyped a\" \nlemma procargvars_empty_untyped [simp]: \"mk_procargvars_untyped procargvars_empty = []\" \nlemma procargs_add_untyped [simp]: \"mk_procargs_untyped (procargs_add x a) = mk_expression_untyped x # mk_procargs_untyped a\" \nlemma procargs_empty_untyped [simp]: \"mk_procargs_untyped procargs_empty = []\" \nlemma vars_procargs_add [simp]: \"vars_procargs (procargs_add e a) = e_vars e @ vars_procargs a\" \nlemma vars_procargs_empty [simp]: \"vars_procargs procargs_empty = []\" \n*)\n\n\n\n\n\nsubsection {* Typed programs *}\n\ndefinition \"label (l::string) (p::program) = p\"\n\ndefinition \"seq p q = Abs_program (Seq (Rep_program p) (Rep_program q))\"\n\nlemma Rep_seq [simp]: \"Rep_program (seq p q) = Seq (Rep_program p) (Rep_program q)\"\n  unfolding seq_def denotation_def apply (subst Abs_program_inverse) by auto\n\ndefinition \"skip = Abs_program Skip\"\n\nlemma Rep_skip [simp]: \"Rep_program skip = Skip\"\n  unfolding skip_def denotation_def apply (subst Abs_program_inverse) by auto\n\ndefinition \"assign (v::('a::prog_type) pattern) (e::'a expression) =\n  Abs_program (Assign (Rep_pattern v) (mk_expression_untyped e))\"\n\nlemma Rep_assign [simp]: \"Rep_program (assign v e) = \n  Assign (Rep_pattern v) (mk_expression_untyped e)\"\n  unfolding assign_def denotation_def apply (subst Abs_program_inverse) by (simp_all)\n  \ndefinition \"sample (v::('a::prog_type) pattern) (e::'a distr expression) =\n  Abs_program (Sample (Rep_pattern v) (mk_expression_distr e))\"\n\nlemma Rep_sample [simp]: \"Rep_program (sample v e)\n   = Sample (Rep_pattern v) (mk_expression_distr e)\"\n  unfolding sample_def denotation_def apply (subst Abs_program_inverse) by simp_all \n\ndefinition ifte :: \"bool expression \\<Rightarrow> program \\<Rightarrow> program \\<Rightarrow> program\" where\n  \"ifte e thn els = Abs_program (IfTE (mk_expression_untyped e) (Rep_program thn) (Rep_program els))\"\n\nlemma Rep_ifte [simp]: \"Rep_program (ifte e thn els) =\n  IfTE (mk_expression_untyped e) (Rep_program thn) (Rep_program els)\"\n  unfolding ifte_def denotation_def apply (subst Abs_program_inverse) using bool_type by auto\n\ndefinition while :: \"bool expression \\<Rightarrow> program \\<Rightarrow> program\" where\n  \"while e p = Abs_program (While (mk_expression_untyped e) (Rep_program p))\"\n\nlemma Rep_while [simp]: \"Rep_program (while e p) =\n  While (mk_expression_untyped e) (Rep_program p)\"\n  unfolding while_def denotation_def apply (subst Abs_program_inverse) using bool_type by auto\n\ndefinition callproc :: \"'a::prog_type pattern \\<Rightarrow> ('b::prog_type,'a) procedure \\<Rightarrow> 'b expression \\<Rightarrow> program\" where\n  \"callproc v proc args = Abs_program (CallProc (Rep_pattern v) (mk_procedure_untyped proc) (mk_expression_untyped args))\"\nlemma Rep_callproc [simp]: \"Rep_program (callproc v p a) = CallProc (Rep_pattern v) (mk_procedure_untyped p) (mk_expression_untyped a)\"\n  unfolding callproc_def apply (subst Abs_program_inverse)\n  by (auto simp: mk_procedure_untyped_def)\n  \n(* lemma Rep_callproc [simp]: \"Rep_program (callproc v proc args) =\n  CallProc (Rep_pattern v) (mk_procedure_untyped proc) (mk_expression_untyped args)\"\nproof -\n  have swap: \"\\<And>x y. list_all2 (\\<lambda>(x::variable_untyped) y. vu_type x = eu_type y) x y = list_all2 (\\<lambda>y x. eu_type y = vu_type x) y x\"\n   unfolding list_all2_conv_all_nth by auto\n  show ?thesis\n  unfolding callproc_def denotation_def mk_procedure_untyped_def \n  by (subst Abs_program_inverse, auto)\nqed *)\n\n(*lemma denotation_seq: \"denotation (seq p q) m = \n  compose_distr (denotation_untyped (mk_program_untyped q)) (denotation_untyped (mk_program_untyped p) m)\" *)\nlemma denotation_seq: \"denotation (seq p q) m = \n  compose_distr (denotation q) (denotation p m)\"\nunfolding denotation_def memory_update_def by simp\n\nlemma denotation_skip: \"denotation skip m = point_distr m\"\nunfolding denotation_def memory_update_def by simp\n\nlemma denotation_assign: \"denotation (assign v e) m = point_distr (memory_update_pattern m v (e_fun e m))\"\n  unfolding denotation_def memory_update_pattern_def by simp\nlemma denotation_sample: \"denotation (sample v e) m = apply_to_distr (memory_update_pattern m v) (e_fun e m)\"\n  unfolding denotation_def memory_update_pattern_def[THEN ext] by simp\n\nlemma denotation_ifte: \"denotation (ifte e thn els) m = (if e_fun e m then denotation thn m else denotation els m)\"\n  unfolding denotation_def by simp\n(* TODO: define and use a typed version of While_n in the following lemma *)\nlemma denotation_while: \"denotation (while e p) m = \n  (SUP n. denotation_untyped (While_n n (mk_expression_untyped e) (Rep_program p)) m)\"\n(* Abs_distr (\\<lambda>m'. \\<Sum>n. Rep_distr (compose_distr (\\<lambda>m. if e_fun e m then 0 else point_distr m)\n                                                  (while_iter n (e_fun e) (denotation p) m)) m')\" *)\n  unfolding denotation_def by simp \n\nlemma denotation_callproc: \"denotation (callproc v proc args) m =\n  (let argval = e_fun args m in\n  let m' = init_locals m in\n  let m' = memory_update_pattern m' (p_arg proc) argval in\n  apply_to_distr (\\<lambda>m'.\n    let res = e_fun (p_return proc) m' in\n    let m' = restore_locals m m' in\n    memory_update_pattern m' v res)\n  (denotation (p_body proc) m'))\"\n  unfolding denotation_def  memory_update_pattern_def\n  by (simp add: mk_procedure_untyped_def)\n\nlemma denotation_seq_skip [simp]: \"denotation (seq Lang_Typed.skip c) = denotation c\"\n  unfolding denotation_seq[THEN ext] denotation_def by simp \nlemma denotation_skip_seq [simp]: \"denotation (seq c Lang_Typed.skip) = denotation c\"\n  unfolding denotation_seq[THEN ext] Rep_skip denotation_def denotation_untyped_Skip[THEN ext]\n  by simp \n\nlemmas denotation_simp = denotation_seq denotation_skip denotation_assign denotation_sample denotation_ifte denotation_while denotation_callproc\n\nlemma denotation_seq_assoc: \"denotation (seq (seq x y) z) = denotation (seq x (seq y z))\"\n  unfolding denotation_seq[THEN ext] \n  unfolding compose_distr_assoc ..\n\n\n\nlemma denotation_eq_seq_snd:\n  assumes \"denotation b = denotation b'\"\n  shows \"denotation (seq a b) = denotation (seq a b')\"\nunfolding denotation_seq[THEN ext] using assms by simp\n    \nlemma denotation_eq_seq_fst:\n  assumes \"denotation a = denotation a'\"\n  shows \"denotation (seq a b) = denotation (seq a' b)\"\nunfolding denotation_seq[THEN ext] using assms by simp\n\n(*\nsubsection {* Concrete syntax for programs *}\n\nsubsubsection {* Grammar *}\n\nnonterminal procedure_call_args_syntax\nsyntax \"Product_Type.Unity\" :: procedure_call_args_syntax (\"'(')\")\nsyntax \"\" :: \"'a \\<Rightarrow> procedure_call_args_syntax\" (\"'(_')\")\nsyntax \"_tuple\" :: \"'a \\<Rightarrow> tuple_args \\<Rightarrow> procedure_call_args_syntax\" (\"'(_,_')\")\n\nnonterminal program_syntax\n\nsyntax \"_program\" :: \"program_syntax \\<Rightarrow> term\" (\"PROGRAM [ _; ]\")\nsyntax \"_program\" :: \"program_syntax \\<Rightarrow> term\" (\"PROGRAM [ _ ]\")\nsyntax \"_label\" :: \"idt \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax\" (\"_: _\" [10,11] 10)\nsyntax \"_seq\" :: \"program_syntax \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax\" (\"_;/ _\" [10,11] 10)\nsyntax \"_skip\" :: \"program_syntax\" (\"skip\")\nsyntax \"_quote\" :: \"program \\<Rightarrow> program_syntax\" (\"\\<guillemotleft>_\\<guillemotright>\" [31] 30)\nsyntax \"_assign\" :: \"'a \\<Rightarrow> 'b \\<Rightarrow> program_syntax\" (infix \":=\" 30)\nsyntax \"_sample\" :: \"'a \\<Rightarrow> 'b \\<Rightarrow> program_syntax\" (infix \"<-\" 30)\nsyntax \"_ifte\" :: \"bool \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax\" (\"if '(_') (2_) else (2_)\" [0,20] 20)\nsyntax \"_ifthen\" :: \"bool \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax\" (\"if '(_') (2_)\" [0,20] 20)\nsyntax \"_while\" :: \"bool \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax\" (\"while '(_') (2_)\" [0,20] 20)\nsyntax \"_assign_quote\" :: \"'a variable \\<Rightarrow> 'a expression \\<Rightarrow> program_syntax\" (\"_ := \\<guillemotleft>_\\<guillemotright>\" [31,31] 30)\nsyntax \"_sample_quote\" :: \"'a variable \\<Rightarrow> 'a expression \\<Rightarrow> program_syntax\" (\"_ <- \\<guillemotleft>_\\<guillemotright>\" [31,31] 30)\nsyntax \"_while_quote\" :: \"bool expression \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax\" (\"while '(\\<guillemotleft>_\\<guillemotright>') (2_)\" [0,20] 20)\nsyntax \"_ifte_quote\" :: \"bool expression \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax\" (\"if '(\\<guillemotleft>_\\<guillemotright>') (2_) else _\" [0,20] 20)\nsyntax \"_ifthen_quote\" :: \"bool expression \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax\" (\"if '(\\<guillemotleft>_\\<guillemotright>') (2_)\" [0,20] 20)\nsyntax \"_callproc\" :: \"'a \\<Rightarrow> ('a,'b) procedure \\<Rightarrow> procedure_call_args_syntax \\<Rightarrow> program_syntax\" (\"_ := call _ _\" 30)\nsyntax \"\" :: \"program_syntax \\<Rightarrow> program_syntax\" (\"{ _ }\")\nsyntax \"\" :: \"program_syntax \\<Rightarrow> program_syntax\" (\"'(_')\")\nsyntax \"\" :: \"program_syntax \\<Rightarrow> program_syntax\" (\"'(_;')\")\nsyntax \"\" :: \"program_syntax \\<Rightarrow> program_syntax\" (\"{ _; }\")\nsyntax \"_var_access\" :: \"'a variable \\<Rightarrow> 'a\" (\"$_\" [1000] 999)\ndefinition program :: \"program \\<Rightarrow> program\" where \"program p = p\"\n\n(*syntax \"_local_vars\" :: \"idts \\<Rightarrow> program_syntax \\<Rightarrow> program_syntax\" (\"local _;/ _\" [0,9] 9) *)\nsyntax \"_local_vars_global\" :: \"idts \\<Rightarrow> 'b \\<Rightarrow> 'b\" (\"(3LOCAL _./ _)\" 100)\n\n\n\nsubsubsection {* Translation functions *}\n\n\nML \"HOLogic.mk_string\"\n\nML_file \"lang_syntax.ML\"\n\nparse_translation {* [(\"_program\", fn ctx => fn p => \n    Const(@{const_syntax program},dummyT) $ \n      Lang_Syntax.translate_program ctx (Unsynchronized.ref[]) (hd p))] *}\n\n(* print_translation {* [(@{const_syntax program}, fn ctx => fn p => Const(\"_program\",dummyT) $ Lang_Syntax.translate_program_back ctx (hd p))] *} *)\n\nparse_translation {* [(\"_local_vars_global\", fn ctx => fn p =>\n  case p of [vs,body] =>\n  Lang_Syntax.translate_local_vars_global ctx vs body)] *}\n\n(* term \"LOCAL x y. PROGRAM[ x := x+$z ]\"  *)\n(* term \"PROGRAM[ x := x ]\" *)\n\n\nsubsection {* Concrete grammar for procedures *}\n\n(*\nnonterminal procedure_decl_args_syntax\nnonterminal procedure_decl_args_syntax'\nsyntax \"_procedure_decl_args_none\" :: procedure_decl_args_syntax (\"'(')\")\nsyntax \"_procedure_decl_args_single\" :: \"idt \\<Rightarrow> procedure_decl_args_syntax'\" (\"_\")\nsyntax \"_procedure_decl_args_cons\" :: \"idt \\<Rightarrow> procedure_decl_args_syntax' \\<Rightarrow> procedure_decl_args_syntax'\" (\"_,_\")\nsyntax \"\" :: \"procedure_decl_args_syntax' \\<Rightarrow> procedure_decl_args_syntax\" (\"'(_')\")\n*)\nsyntax \"_procedure_decl\" :: \"procedure_call_args_syntax \\<Rightarrow> program_syntax \\<Rightarrow> 'b \\<Rightarrow> ('a,'b) procedure\" (\"proc _ {_; return _}\")\nsyntax \"_procedure_decl\" :: \"procedure_call_args_syntax \\<Rightarrow> program_syntax \\<Rightarrow> 'b \\<Rightarrow> ('a,'b) procedure\" (\"proc _ {_; return _;}\")\n\nparse_translation {* [(\"_procedure_decl\", fn ctx => fn [args,body,return] => \nlet val known = Unsynchronized.ref[] (* TODO: add local vars *)\n(*    fun trargs (Const(@{const_name Unity},_)) = @{term \"unit_pattern\"}\n      | trargs (Const(@{const_syntax Pair},_)$a$b) =\n          Const(@{const_name pair_pattern},dummyT) $ trargs a $ trargs b\n(*          let val apat = trargs a val bpat = trargs b in\n          @{termx \"pair_pattern (?apat::?'apat.1) (?bpat::?'bpat.1)\" \n                  where \"?'apat.1\\<Rightarrow>?'a pattern\"   \"?'bpat.1\\<Rightarrow>?'b pattern\"} end *)\n      | trargs t = Const(@{const_name variable_pattern},dummyT) $ t*)\n(* @{termx \"variable_pattern (?t::?'t.1)\" where \"?'t.1\\<Rightarrow>(?'x::prog_type variable)\"} *)\n(*    fun trargs (Const(\"_procedure_decl_args_none\",_)) = Const(@{const_name TODO_REMOVE_ME},dummyT)\n      | trargs (Const(\"_procedure_decl_args_single\",_)$x) = \n          (Lang_Syntax.add_var known x; Const(@{const_name TODO_REMOVE_ME},dummyT) $ x $ Const(@{const_name TODO_REMOVE_ME},dummyT))\n      | trargs (Const(\"_procedure_decl_args_cons\",_)$x$xs) = \n          (Lang_Syntax.add_var known x; Const(@{const_name TODO_REMOVE_ME},dummyT) $ x $ trargs xs)\n      | trargs t = raise (TERM (\"trargs\",[t])) *)\n    val args = Lang_Syntax.translate_pattern known args\nin\nConst(@{const_name procedure_ext},dummyT) $ \n   Lang_Syntax.translate_program ctx known body $ (* p_body *)\n   args $ (* p_arg *)\n   Lang_Syntax.translate_expression ctx known return $ (* p_return *)\n   @{term \"()\"}\nend)] *}\n*)\n  \nlemma vars_seq [simp]: \"vars (seq a b) = vars a @ vars b\" by (simp add: vars_def)\nlemma vars_assign [simp]: \"vars (assign x e) = p_vars x @ e_vars e\" by (simp add: p_vars_def vars_def)\nlemma vars_sample [simp]: \"vars (sample x e) = p_vars x @ e_vars e\" by (simp add: p_vars_def vars_def)\nlemma vars_while [simp]: \"vars (Lang_Typed.while e p) = e_vars e @ vars p\" by (simp add: vars_def)\nlemma vars_ifte [simp]: \"vars (Lang_Typed.ifte e p1 p2) = e_vars e @ vars p1 @ vars p2\" by (simp add: vars_def)\ndefinition \"vars_proc_global p == [v. v<-p_vars (p_arg p), vu_global v] @ [v. v<-vars (p_body p), vu_global v] @ [v. v<-e_vars (p_return p), vu_global v]\"\nlemma vars_callproc [simp]: \"vars (callproc x p a) = p_vars x @ e_vars a @ vars_proc_global p\"\n  unfolding vars_def vars_proc_global_def p_vars_def by (auto simp: mk_procedure_untyped_def)\nlemma vars_skip [simp]: \"vars Lang_Typed.skip = []\" by (simp add: vars_def)\n\nlemma write_vars_seq [simp]: \"write_vars (seq a b) = write_vars a @ write_vars b\" by (simp add: write_vars_def)\nlemma write_vars_assign [simp]: \"write_vars (assign x e) = p_vars x\" by (simp add: p_vars_def write_vars_def)\nlemma write_vars_sample [simp]: \"write_vars (sample x e) = p_vars x\" by (simp add: p_vars_def write_vars_def)\nlemma write_vars_while [simp]: \"write_vars (Lang_Typed.while e p) = write_vars p\" by (simp add: write_vars_def)\nlemma write_vars_ifte [simp]: \"write_vars (Lang_Typed.ifte e p1 p2) = write_vars p1 @ write_vars p2\" by (simp add: write_vars_def)\ndefinition \"write_vars_proc_global p == [v. v<-p_vars (p_arg p), vu_global v] @ [v. v<-write_vars (p_body p), vu_global v]\"\nlemma write_vars_callproc [simp]: \"write_vars (callproc x p a) = p_vars x @ write_vars_proc_global p\"\n  unfolding write_vars_def write_vars_proc_global_def p_vars_def by (auto simp: mk_procedure_untyped_def)\nlemma write_vars_skip [simp]: \"write_vars Lang_Typed.skip = []\" by (simp add: write_vars_def)\n\nlemma write_vars_subset_vars: \"set (write_vars p) \\<subseteq> set (vars p)\"\n  by (simp add: vars_def write_vars_def write_vars_subset_vars_untyped(1))\n  \nlemma write_vars_proc_global_subset_vars_proc_global: \"set (write_vars_proc_global p) \\<subseteq> set (vars_proc_global p)\"\n  unfolding write_vars_proc_global_def vars_proc_global_def using write_vars_subset_vars by auto\n\nlemma LVariable_local [simp]: \"\\<not> vu_global (mk_variable_untyped (LVariable x))\"\n  by (simp add: mk_variable_untyped_def)\nlemma Variable_global [simp]: \"vu_global (mk_variable_untyped (Variable x))\"\n  by (simp add: mk_variable_untyped_def)\nlemma mk_variable_untyped_distinct1 [simp]: \"a \\<noteq> b \\<Longrightarrow> mk_variable_untyped (LVariable a) \\<noteq> mk_variable_untyped (LVariable b)\"\n  by (simp add: mk_variable_untyped_def)\nlemma mk_variable_untyped_distinct2 [simp]: \"mk_variable_untyped (LVariable a) \\<noteq> mk_variable_untyped (Variable b)\"\n  by (simp add: mk_variable_untyped_def)\nlemma mk_variable_untyped_distinct3 [simp]: \"mk_variable_untyped (Variable a) \\<noteq> mk_variable_untyped (LVariable b)\"\n  by (simp add: mk_variable_untyped_def)\n\nsubsection {* Variable renaming *}\n\ntype_synonym variable_name_renaming = \"(string * string) list\"\n(*definition local_variable_name_renaming :: \"variable_name_renaming \\<Rightarrow> variable_untyped \\<Rightarrow> variable_untyped\" where\n  \"local_variable_name_renaming ren x = \n  (if vu_global x then x\n  else x \\<lparr> vu_name := (fold (\\<lambda>(a,b) f. Fun.swap a b f) ren id) (vu_name x) \\<rparr>)\"*)\ndefinition local_variable_name_renaming1 :: \"(string * string) \\<Rightarrow> variable_untyped \\<Rightarrow> variable_untyped\" where\n  \"local_variable_name_renaming1 = (\\<lambda>(a,b) x.\n  (if vu_global x then x\n  else x \\<lparr> vu_name := if vu_name x = a then b else if vu_name x = b then a else vu_name x \\<rparr>))\"\n  \nlemma local_variable_name_renaming1_type: \"vu_type (local_variable_name_renaming1 ren x) = vu_type x\"\n  by (cases ren, simp add: local_variable_name_renaming1_def)\nlemma local_variable_name_renaming1_global: \"vu_global (local_variable_name_renaming1 ren x) = vu_global x\"\n  by (cases ren, simp add: local_variable_name_renaming1_def)\nlemma local_variable_name_renaming1_fix_globals: \"vu_global x \\<Longrightarrow> local_variable_name_renaming1 ren x = x\"\n  by (cases ren, simp add: local_variable_name_renaming1_def)\nlemma local_variable_name_renaming1_bij: \"bij (local_variable_name_renaming1 ren)\"\nproof -\n  obtain a b where ren:\"ren = (a,b)\" by (cases ren, simp)\n  have \"local_variable_name_renaming1 ren o local_variable_name_renaming1 ren = id\"\n    unfolding ren id_def o_def local_variable_name_renaming1_def by auto\n  thus \"bij (local_variable_name_renaming1 ren)\"\n    using o_bij by blast\nqed\n\ndefinition local_variable_name_renaming :: \"variable_name_renaming \\<Rightarrow> variable_untyped \\<Rightarrow> variable_untyped\" where\n  \"local_variable_name_renaming ren = fold local_variable_name_renaming1 ren\"\n(*lemma local_variable_name_renaming1:\n  \"local_variable_name_renaming ren x = fold local_variable_name_renaming1 ren x\"\nproof (induct ren)\n  show \"local_variable_name_renaming [] x = fold local_variable_name_renaming1 [] x\"\n    unfolding local_variable_name_renaming_def local_variable_name_renaming1_def by simp\nnext\n  fix ab::\"string * string\" and ren obtain a b where ab: \"ab=(a,b)\" by (cases ab, simp)\n  assume ih: \"local_variable_name_renaming ren x = fold local_variable_name_renaming1 ren x\"\n  show \"local_variable_name_renaming (ab # ren) x = fold local_variable_name_renaming1 (ab # ren) x\"\n  proof (cases \"vu_global x\")\n    assume \"vu_global x\"\n    have \"local_variable_name_renaming (ab # ren) x = x\"\n      by (simp add: `vu_global x` local_variable_name_renaming_def)\n    also have \"local_variable_name_renaming ren x = x\"\n      by (simp add: `vu_global x` local_variable_name_renaming_def)\n    hence \"fold local_variable_name_renaming1 (ab # ren) x = x\"\n      apply simp apply (subst (2) local_variable_name_renaming1_def) unfolding ab using `vu_global x` ih by auto\n    ultimately show \"local_variable_name_renaming (ab # ren) x = fold local_variable_name_renaming1 (ab # ren) x\"\n      by simp\n  next\n    assume \"\\<not> vu_global x\"\n    have swap: \"(Fun.swap a b id) (vu_name x) = (if vu_name x = a then b else if vu_name x = b then a else vu_name x)\"\n      by auto\n    have \"local_variable_name_renaming (ab # ren) x = undefined\"\n      unfolding local_variable_name_renaming_def apply (simp add: `\\<not> vu_global x` ab swap)\n    show \"local_variable_name_renaming (ab # ren) x = fold local_variable_name_renaming1 (ab # ren) x\"\n      by later\n  qed\nqed*)\n\n\nlemma local_variable_name_renaming_type [simp]: \"vu_type (local_variable_name_renaming ren x) = vu_type x\"\n  unfolding local_variable_name_renaming_def apply (induct ren rule:rev_induct)\n  using local_variable_name_renaming1_type by auto\nlemma local_variable_name_renaming_global [simp]: \"vu_global (local_variable_name_renaming ren x) = vu_global x\"\n  unfolding local_variable_name_renaming_def apply (induct ren rule:rev_induct)\n  using local_variable_name_renaming1_global by auto\nlemma local_variable_name_renaming_fix_globals: \"vu_global x \\<Longrightarrow> local_variable_name_renaming ren x = x\"\n  unfolding local_variable_name_renaming_def apply (induct ren rule:rev_induct)\n  using local_variable_name_renaming1_fix_globals by auto\n\nlemma local_variable_name_renaming_bij: \"bij (local_variable_name_renaming ren)\"\n  unfolding local_variable_name_renaming_def\n  apply (induct ren rule:rev_induct)\n  using o_bij close force\n  apply simp unfolding o_def[symmetric]\n  by (simp add: bij_comp local_variable_name_renaming1_bij)\n\n\ndefinition rename_local_variables :: \"variable_name_renaming \\<Rightarrow> program \\<Rightarrow> program\" where\n  \"rename_local_variables ren p = Abs_program (rename_variables \n      (local_variable_name_renaming ren) (Rep_program p))\"\nlemma Rep_rename_local_variables [simp]: \"Rep_program (rename_local_variables ren p) =\n  rename_variables (local_variable_name_renaming ren) (Rep_program p)\"\n      unfolding rename_local_variables_def\n      apply (subst Abs_program_inverse, auto)\n      by (simp add: well_typed_rename_variables) \n\ndefinition rename_local_variables_expression :: \"variable_name_renaming \\<Rightarrow> 'a::prog_type expression \\<Rightarrow> 'a expression\" where\n  \"rename_local_variables_expression ren e = mk_expression_typed (rename_variables_expression \n      (local_variable_name_renaming ren) (mk_expression_untyped e))\"\nlemma Rep_rename_local_variables_expression [simp]: \"mk_expression_untyped (rename_local_variables_expression ren e) =\n  rename_variables_expression (local_variable_name_renaming ren) (mk_expression_untyped e)\"\n      unfolding rename_local_variables_expression_def\n      apply (subst mk_expression_typed_inverse)\n      by (simp_all add: eu_type_rename_variables)\nlemma e_fun_rename_local_variables_expression [simp]: \"e_fun (rename_local_variables_expression ren e) = \n    (e_fun e) o (rename_variables_memory (local_variable_name_renaming ren))\"\n  unfolding e_fun_eu_fun eu_fun_def o_def by simp\n\nlemma rename_local_variables_expression_id [simp]: \"rename_local_variables_expression [] e = e\"\nproof -\n  have upd: \"\\<And>x. x \\<lparr> vu_name := vu_name x \\<rparr> = x\" by (case_tac x, auto)\n  show ?thesis\n    unfolding rename_local_variables_expression_def local_variable_name_renaming_def[THEN ext] fold_Nil id_def upd\n    using rename_variables_expression_id[unfolded id_def]\n    apply auto by (rule mk_expression_untyped_inverse)\nqed\n\n\n\n\n\nlemma Rep_rename_local_variables_expression_distr [simp]: \"mk_expression_distr (rename_local_variables_expression ren e) =\n  rename_variables_expression_distr (local_variable_name_renaming ren) (mk_expression_distr e)\"\nproof -\n  have vars: \"eu_vars (rename_variables_expression (local_variable_name_renaming ren) (mk_expression_untyped e)) =\n    map (local_variable_name_renaming ren) (e_vars e)\"\n    apply (subst eu_vars_rename_variables_expression) by simp_all\n  have fn: \"(\\<lambda>x::val. apply_to_distr embedding (inv embedding x :: 'a distr)) \\<circ>\n    eu_fun (rename_variables_expression (local_variable_name_renaming ren) (mk_expression_untyped e)) =\n    (\\<lambda>m::memory. apply_to_distr (embedding::'a\\<Rightarrow>_) (e_fun e (rename_variables_memory (local_variable_name_renaming ren) m)))\"\n    apply (subst eu_fun_rename_variables_expression)\n    unfolding mk_expression_untyped_fun[THEN ext] o_def by simp_all\n  show ?thesis\n    unfolding rename_local_variables_expression_def \n    apply (rule Rep_expression_distr_inject[THEN iffD1])\n    apply (subst mk_expression_distr_mk_expression_typed)\n     close (metis Rep_rename_local_variables_expression mk_expression_untyped_type)\n    apply (subst Rep_rename_variables_expression_distr)\n      close simp close simp\n      using fn vars by auto\nqed\n\ndefinition rename_local_variables_pattern :: \"variable_name_renaming \\<Rightarrow> 'a::prog_type pattern \\<Rightarrow> 'a pattern\" where\n  \"rename_local_variables_pattern ren p = Abs_pattern (rename_variables_pattern\n      (local_variable_name_renaming ren) (Rep_pattern p))\"\nlemma Rep_rename_local_variables_pattern [simp]: \"Rep_pattern (rename_local_variables_pattern ren p) =\n        rename_variables_pattern (local_variable_name_renaming ren) (Rep_pattern p)\"\n  unfolding rename_local_variables_pattern_def\n  apply (subst Abs_pattern_inverse)\n  by (simp_all add: pu_type_rename_variables)\n\n\nlemma rename_variables_pattern_id: \"rename_variables_pattern id p = p\" \n  apply (induct p)\n  by (auto simp: id_def rename_variables_pattern_id[unfolded id_def])\n\nlemma p_vars_rename_local_variables_pattern: \"p_vars (rename_local_variables_pattern ren p) = \n  map (local_variable_name_renaming ren) (p_vars p)\"\nunfolding p_vars_def Rep_rename_local_variables_pattern\nby (subst pu_vars_rename_variables_pattern, simp_all)\n\nlemma rename_local_variables_pair_pattern [simp]: \n  \"rename_local_variables_pattern R (pair_pattern p1 p2)\n  = pair_pattern (rename_local_variables_pattern R p1) (rename_local_variables_pattern R p2)\"\n  apply (rule Rep_pattern_inject[THEN iffD1])\n  apply (subst Rep_pair_pattern)\n  apply (subst Rep_rename_local_variables_pattern)+\n  apply (subst Rep_pair_pattern)\n  apply (subst rename_variables_pair_pattern) close auto\n  by (rule refl)\n\nlemma e_vars_rename_local_variables_expression [simp]: \"e_vars (rename_local_variables_expression ren e) = \n  map (local_variable_name_renaming ren) (e_vars e)\"\nunfolding mk_expression_untyped_vars[symmetric] Rep_rename_local_variables_expression\nby (subst eu_vars_rename_variables_expression, simp_all)\n\ndefinition rename_local_variables_var :: \"variable_name_renaming \\<Rightarrow> 'a::prog_type variable \\<Rightarrow> 'a::prog_type variable\" where\n  \"rename_local_variables_var ren v = mk_variable_typed (local_variable_name_renaming ren (mk_variable_untyped v))\"\nlemma Rep_rename_local_variables_var [simp]: \"mk_variable_untyped (rename_local_variables_var ren v) \n        = local_variable_name_renaming ren (mk_variable_untyped v)\"\n  unfolding rename_local_variables_var_def\n  apply (subst mk_variable_typed_inverse)\n  by simp_all\n\nlemma rename_local_variables_var_id [simp]: \"rename_local_variables_var [] x = x\"\nproof -\n  show ?thesis\n    unfolding rename_local_variables_var_def local_variable_name_renaming_def[THEN ext] \n    by auto\nqed\n\nabbreviation rename_local_variables_memory :: \"variable_name_renaming \\<Rightarrow> memory \\<Rightarrow> memory\" where\n  \"rename_local_variables_memory ren == rename_variables_memory (local_variable_name_renaming ren)\"\n\n\nlemma lookup_rename_local_variables_memory [simp]: \n  shows \"memory_lookup (rename_local_variables_memory ren m) v = memory_lookup m (rename_local_variables_var ren v)\"\nby (simp add: Rep_rename_variables_memory memory_lookup_def)\n  \n\ndefinition rename_local_variables_proc :: \"variable_name_renaming \\<Rightarrow> ('a::prog_type,'b::prog_type)procedure \\<Rightarrow> ('a,'b)procedure\" where\n  \"rename_local_variables_proc ren p = mk_procedure_typed (rename_variables_proc \n      (local_variable_name_renaming ren) (mk_procedure_untyped p))\"\nlemma Rep_rename_local_variables_proc: \"mk_procedure_untyped (rename_local_variables_proc ren p) = \n  rename_variables_proc (local_variable_name_renaming ren) (mk_procedure_untyped p)\"\nproof -\n  obtain body pargs ret where p: \"mk_procedure_untyped p = Proc body pargs ret\" \n      and pu_type_pargs: \"pu_type pargs = Type TYPE('a)\" and eu_type_ret: \"eu_type ret = Type TYPE('b)\" \n      and wt_body: \"well_typed body\"\n    by (simp add: mk_procedure_untyped_def) \n  define f body' pargs' ret'\n    where \"f == (local_variable_name_renaming ren)\"\n      and \"body' == rename_variables f body\"\n      and \"pargs' == rename_variables_pattern f pargs\"\n      and \"ret' == rename_variables_expression f ret\"\n  have type: \"\\<And>x. vu_type (f x) = vu_type x\" unfolding f_def by simp\n  have global: \"\\<And>x. vu_global (f x) = vu_global x\" unfolding f_def by simp\n  have wt_body': \"well_typed body'\"\n    unfolding body'_def apply (rule well_typed_rename_variables)\n    close (fact type) close (fact global) by (fact wt_body)\n  have pu_type_pargs': \"pu_type pargs' = Type TYPE('a)\"\n    unfolding pu_type_def pargs'_def Rep_rename_variables_pattern[OF type]\n    apply simp unfolding pu_type_def[symmetric] pu_type_pargs ..\n  have eu_type_ret': \"eu_type ret' = Type TYPE('b)\"\n    unfolding ret'_def eu_type_def Rep_rename_variables_expression[OF type global]\n    apply simp unfolding eu_type_def[symmetric] eu_type_ret ..\n  have p': \"rename_variables_proc (local_variable_name_renaming ren) (mk_procedure_untyped p) = Proc body' pargs' ret'\"\n    unfolding p f_def body'_def pargs'_def ret'_def by simp\n  show ?thesis\n    unfolding rename_local_variables_proc_def p' \n    apply (subst mk_procedure_typed_inverse[OF wt_body' pu_type_pargs' eu_type_ret'])..\nqed\n\nlemma p_body_rename_local_variables_proc: \n  shows \"p_body (rename_local_variables_proc ren p) = rename_local_variables ren (p_body p)\"\nproof -\n  obtain body' pargs' ret' where as_Proc: \"mk_procedure_untyped (rename_local_variables_proc ren p) = Proc body' pargs' ret'\"\n      and rename: \"Proc body' pargs' ret' = rename_variables_proc (local_variable_name_renaming ren) (mk_procedure_untyped p)\"\n    by (metis Rep_rename_local_variables_proc mk_procedure_untyped_def)\n  have p_body: \"p_body (rename_local_variables_proc ren p) = Abs_program body'\"\n    by (metis as_Proc mk_procedure_typed.simps(1) mk_procedure_untyped_inverse procedure.ext_inject procedure.surjective)\n  have \"body' = rename_variables (local_variable_name_renaming ren) (Rep_program (p_body p))\"\n    using rename unfolding mk_procedure_untyped_def by auto\n  hence \"Abs_program body' = rename_local_variables ren (p_body p)\"\n    by (simp add: rename_local_variables_def)\n  with p_body show ?thesis by simp\nqed\n\nlemma p_arg_rename_local_variables_proc: \n  shows \"p_arg (rename_local_variables_proc ren p) = rename_local_variables_pattern ren (p_arg p)\"\nproof -\n  obtain body' pargs' ret' where as_Proc: \"mk_procedure_untyped (rename_local_variables_proc ren p) = Proc body' pargs' ret'\"\n      and rename: \"Proc body' pargs' ret' = rename_variables_proc (local_variable_name_renaming ren) (mk_procedure_untyped p)\"\n    by (metis Rep_rename_local_variables_proc mk_procedure_untyped_def)\n  have p_arg: \"p_arg (rename_local_variables_proc ren p) = Abs_pattern pargs'\"\n    by (metis as_Proc mk_procedure_typed.simps(1) mk_procedure_untyped_inverse procedure.select_convs(2))\n  have \"pargs' = rename_variables_pattern (local_variable_name_renaming ren) (Rep_pattern (p_arg p))\"\n    using rename unfolding mk_procedure_untyped_def by auto\n  hence \"Abs_pattern pargs' = rename_local_variables_pattern ren (p_arg p)\"\n    by (simp add: rename_local_variables_pattern_def)\n  with p_arg show ?thesis by simp\nqed\n\nlemma p_ret_rename_local_variables_proc: \n  shows \"p_return (rename_local_variables_proc ren p) = rename_local_variables_expression ren (p_return p)\"\nproof -\n  obtain body' pargs' ret' where as_Proc: \"mk_procedure_untyped (rename_local_variables_proc ren p) = Proc body' pargs' ret'\"\n      and rename: \"Proc body' pargs' ret' = rename_variables_proc (local_variable_name_renaming ren) (mk_procedure_untyped p)\"\n    by (metis Rep_rename_local_variables_proc mk_procedure_untyped_def)\n  have p_ret: \"p_return (rename_local_variables_proc ren p) = mk_expression_typed ret'\"\n    by (metis mk_procedure_typed.simps(1) procedure.select_convs(3) rename rename_local_variables_proc_def)\n  have \"ret' = rename_variables_expression (local_variable_name_renaming ren) (mk_expression_untyped (p_return p))\"\n    using rename unfolding mk_procedure_untyped_def by auto\n  hence \"mk_expression_typed ret' = rename_local_variables_expression ren (p_return p)\"\n    by (simp add: rename_local_variables_expression_def)\n  with p_ret show ?thesis by simp\nqed\n\n\nlemma denotation_callproc_rename_local_variables_proc: \"denotation (callproc x (rename_local_variables_proc ren p) a) = denotation (callproc x p a)\"\nproof -\n  define f where \"f == local_variable_name_renaming ren\"\n  (* def x' == \"mk_pattern_untyped x\" *)\n  (* def a' == \"mk_expression_untyped a\" *)\n  have type: \"\\<And>x. vu_type (f x) = vu_type x\" unfolding f_def by simp\n  have global: \"\\<And>x. vu_global (f x) = vu_global x\" unfolding f_def by simp\n  have fix_global: \"\\<And>x. vu_global x \\<Longrightarrow> f x = x\" unfolding f_def by (rule local_variable_name_renaming_fix_globals)\n  have \"bij f\" unfolding f_def by (fact local_variable_name_renaming_bij)\n  show ?thesis\n    unfolding denotation_def Rep_callproc (* x'_def[symmetric] a'_def[symmetric] *)\n    unfolding Rep_rename_local_variables_proc f_def[symmetric]\n    by (subst denotation_rename_variables_proc[OF type global fix_global `bij f`], simp_all)\nqed\n\nlemma rename_local_variables_proc_id [simp]: \"rename_local_variables_proc [] p = p\"\nproof -\n  have upd: \"\\<And>x. x \\<lparr> vu_name := vu_name x \\<rparr> = x\" by (case_tac x, auto)\n  show ?thesis\n    unfolding rename_local_variables_proc_def local_variable_name_renaming_def[THEN ext] fold_Nil id_def upd\n    using rename_variables_proc_id[unfolded id_def]\n    apply auto by (rule mk_procedure_untyped_inverse)\nqed\n\nlemma vars_rename_local_variables: \"vars (rename_local_variables ren p)\n                           = map (local_variable_name_renaming ren) (vars p)\"\nproof -\n  define p' where \"p' == Rep_program p\"\n  have pu_vars: \"\\<And>x. pu_vars (rename_variables_pattern (local_variable_name_renaming ren) x) =\n                map (local_variable_name_renaming ren) (pu_vars x)\"\n    unfolding Rep_rename_local_variables_pattern\n    by (subst pu_vars_rename_variables_pattern, simp_all)\n  have eu_vars: \"\\<And>x. eu_vars (rename_variables_expression (local_variable_name_renaming ren) x) =\n       map (local_variable_name_renaming ren) (eu_vars x)\"\n    unfolding Rep_rename_local_variables_expression\n    by (subst eu_vars_rename_variables_expression, simp_all)\n  have ed_vars: \"\\<And>x. ed_vars (rename_variables_expression_distr (local_variable_name_renaming ren) x) =\n       map (local_variable_name_renaming ren) (ed_vars x)\"\n    unfolding Rep_rename_local_variables_expression_distr\n    by (subst ed_vars_rename_variables_expression_distr, simp_all)\n  have proc_vars: \"\\<And>q. map (local_variable_name_renaming ren) (vars_proc_untyped q) = vars_proc_untyped q\"\n    by (simp add: vars_proc_untyped_global local_variable_name_renaming_fix_globals map_idI)\n  define q where \"q == undefined :: procedure_rep\"\n  have \"vars_untyped (rename_variables (local_variable_name_renaming ren) p') \n      = map (local_variable_name_renaming ren) (vars_untyped p')\"\n    and True\n    apply (induct p' and q)\n    by (auto simp: eu_vars pu_vars ed_vars proc_vars)\n  thus ?thesis\n    unfolding vars_def Rep_rename_local_variables p'_def by simp\nqed\n  \nlemma local_vars_rename_local_variables: \"local_vars (rename_local_variables ren p)\n                            = map (local_variable_name_renaming ren) (local_vars p)\"\n  unfolding local_vars_def vars_rename_local_variables\n  by (metis (mono_tags, lifting) comp_apply filter_cong filter_map local_variable_name_renaming_global)\n\n\nlemma rename_local_variables_pattern_id [simp]: \"rename_local_variables_pattern [] p = p\"\nproof -\n  have upd: \"\\<And>x. x \\<lparr> vu_name := vu_name x \\<rparr> = x\" by (case_tac x, auto)\n  show ?thesis\n    unfolding rename_local_variables_pattern_def local_variable_name_renaming_def[THEN ext] fold_Nil id_def upd\n    using rename_variables_pattern_id[unfolded id_def]\n    apply auto by (rule Rep_pattern_inverse)\nqed\n\nlemma rename_local_variables_id [simp]: \"rename_local_variables [] p = p\"\nproof -\n  have upd: \"\\<And>x. x \\<lparr> vu_name := vu_name x \\<rparr> = x\" by (case_tac x, auto)\n  show ?thesis\n    unfolding rename_local_variables_def local_variable_name_renaming_def[THEN ext] fold_Nil id_def upd\n    using rename_variables_id[unfolded id_def]\n    apply auto by (rule Rep_program_inverse)\nqed\n\n\n\nlemma rename_local_variables_ignore_pattern [simp]: \"rename_local_variables_pattern ren ignore_pattern = ignore_pattern\"\n  apply (rule Rep_pattern_inject[THEN iffD1])\n  apply (subst Rep_rename_local_variables_pattern)\n  apply (rule Rep_pattern_untyped_inject[THEN iffD1])\n  apply (subst Rep_rename_variables_pattern[OF local_variable_name_renaming_type])\n  unfolding pu_var_getters_def Rep_pattern_ignore Rep_ignore_pattern\n  by simp\n\nlemma rename_local_variables_variable_pattern [simp]: \"rename_local_variables_pattern ren (variable_pattern v) = variable_pattern (rename_local_variables_var ren v)\"\n  apply (rule Rep_pattern_inject[THEN iffD1])\n  apply (subst Rep_rename_local_variables_pattern)\n  apply (rule Rep_pattern_untyped_inject[THEN iffD1])\n  apply (subst Rep_rename_variables_pattern[OF local_variable_name_renaming_type])\n  unfolding pu_var_getters_def\n  apply (subst Rep_variable_pattern)+\n  apply (subst Rep_pattern_1var)+\n  by auto\n\nlemma rename_local_variables_sample [simp]: \"rename_local_variables ren (sample x e) = sample (rename_local_variables_pattern ren x) (rename_local_variables_expression ren e)\"\n  apply (rule Rep_program_inject[THEN iffD1]) by auto\n\nlemma rename_local_variables_skip [simp]: \"rename_local_variables ren Lang_Typed.skip = Lang_Typed.skip\"\n  apply (rule Rep_program_inject[THEN iffD1]) by auto\n\nlemma rename_local_variables_callproc [simp]: \"rename_local_variables ren (callproc x p e) = \n  callproc (rename_local_variables_pattern ren x) p (rename_local_variables_expression ren e)\"\n  apply (rule Rep_program_inject[THEN iffD1]) by auto\n\nlemma rename_local_variables_assign [simp]: \"rename_local_variables ren (assign x e) = assign (rename_local_variables_pattern ren x) (rename_local_variables_expression ren e)\"\n  apply (rule Rep_program_inject[THEN iffD1]) by auto\n\nlemma rename_local_variables_seq [simp]: \"rename_local_variables ren (seq p1 p2) = seq (rename_local_variables ren p1) (rename_local_variables ren p2)\"\n  apply (rule Rep_program_inject[THEN iffD1]) by auto\n\nlemma rename_local_variables_ifte [simp]: \"rename_local_variables ren (ifte e p1 p2) = ifte (rename_local_variables_expression ren e) (rename_local_variables ren p1) (rename_local_variables ren p2)\"\n  apply (rule Rep_program_inject[THEN iffD1]) by auto\n\nlemma rename_local_variables_while [simp]: \"rename_local_variables ren (Lang_Typed.while e p1) = Lang_Typed.while (rename_local_variables_expression ren e) (rename_local_variables ren p1)\"\n  apply (rule Rep_program_inject[THEN iffD1]) by auto\n\nlemma rename_local_variables_apply_expression [simp]: \"rename_local_variables_expression ren (apply_expression e v)\n     = apply_expression (rename_local_variables_expression ren e) (rename_local_variables_var ren v)\"\n  apply (rule mk_expression_untyped_inject[THEN iffD1]) \n  apply (rule Rep_expression_untyped_inject[THEN iffD1])\n  by auto\n\nlemma rename_local_variables_var_same [simp]: \"rename_local_variables_var ((n,m)#X) (LVariable n) = rename_local_variables_var X (LVariable m)\"\n  apply (rule mk_variable_untyped_inject[THEN iffD1], simp)\n  unfolding local_variable_name_renaming_def apply simp\n  unfolding local_variable_name_renaming1_def \n  by (simp add: mk_variable_untyped_def)\n\nlemma rename_local_variables_var_notsame [simp]: \"n\\<noteq>x \\<Longrightarrow> m\\<noteq>x \\<Longrightarrow> rename_local_variables_var ((n,m)#X) (LVariable x) = rename_local_variables_var X (LVariable x)\"\n  apply (rule mk_variable_untyped_inject[THEN iffD1], simp)\n  unfolding local_variable_name_renaming_def apply simp\n  unfolding local_variable_name_renaming1_def \n  by (simp add: mk_variable_untyped_def)\n\nlemma rename_local_variables_var_global [simp]: \"rename_local_variables_var X (Variable x) = Variable x\"\n  apply (rule mk_variable_untyped_inject[THEN iffD1], simp)\n  unfolding local_variable_name_renaming_def\n  apply (induct X, simp)\n  unfolding local_variable_name_renaming1_def by auto\n\n\nlemma rename_local_variables_const_expression [simp]:\n  \"rename_local_variables_expression X (const_expression e) = const_expression e\"\n  apply (rule mk_expression_untyped_inject[THEN iffD1]) \n  apply (rule Rep_expression_untyped_inject[THEN iffD1])\n  by auto\n\nsubsection {* Misc *}\n\nlemma while_unfold: \"denotation (Lang_Typed.while e p) = denotation (ifte e (seq p (Lang_Typed.while e p)) Lang_Typed.skip)\"\n  unfolding denotation_def using while_unfold_untyped by simp \n\n\n\nend\n", "meta": {"author": "dominique-unruh", "repo": "IsaCrypt", "sha": "1abc2041871af7b758adcc914b83f0d9135ec129", "save_path": "github-repos/isabelle/dominique-unruh-IsaCrypt", "path": "github-repos/isabelle/dominique-unruh-IsaCrypt/IsaCrypt-1abc2041871af7b758adcc914b83f0d9135ec129/Lang_Typed.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635868562172, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.30531401869823493}}
{"text": "(*******************************************************************************\n\n  Project: Development of Security Protocols by Refinement\n\n  Module:  Key_establish/m3_kerberos_par.thy (Isabelle/HOL 2016-1)\n  ID:      $Id: m3_kerberos_par.thy 132890 2016-12-24 10:25:57Z csprenge $\n  Authors: Ivano Somaini, ETH Zurich <somainii@student.ethz.ch>\n           Christoph Sprenger, ETH Zurich <sprenger@inf.ethz.ch>\n\n  Key distribution protocols\n  Third refinement: parallel version of core Kerberos protocol\n\n  Copyright (c) 2009-2016 Christoph Sprenger\n  Licence: LGPL\n\n*******************************************************************************)\n\nsection \\<open>Core Kerberos, \"parallel\" variant (L3)\\<close>\n\ntheory m3_kerberos_par imports m2_kerberos \"../Refinement/Message\"\nbegin\n\ntext \\<open>\nWe model a direct implementation of the channel-based core Kerberos protocol\nat Level 2 without ticket forwarding:\n\\[\n\\begin{array}{lll}\n  \\mathrm{M1.} & A \\rightarrow S: & A, B, Na \\\\ \n  \\mathrm{M2a.} & S \\rightarrow A: & \\{Kab, B, Ts, Na\\}_{Kas} \\\\\n  \\mathrm{M2b.} & S \\rightarrow B: & \\{Kab, A, Ts\\}_{Kbs} \\\\\n  \\mathrm{M3.} & A \\rightarrow B: & \\{A, Ta\\}_{Kab} \\\\\n  \\mathrm{M4.} & B \\rightarrow A: & \\{Ta\\}_{Kab} \\\\\n\\end{array}\n\\]\n\\<close>\n\ntext \\<open>Proof tool configuration. Avoid annoying automatic unfolding of\n\\<open>dom\\<close>.\\<close>\n\ndeclare domIff [simp, iff del]\n\n\n(******************************************************************************)\nsubsection \\<open>Setup\\<close>\n(******************************************************************************)\n\ntext \\<open>Now we can define the initial key knowledge.\\<close>\n\noverloading ltkeySetup' \\<equiv> ltkeySetup begin\ndefinition ltkeySetup_def: \"ltkeySetup' \\<equiv> {(sharK C, A) | C A. A = C \\<or> A = Sv}\"\nend\n\nlemma corrKey_shrK_bad [simp]: \"corrKey = shrK`bad\"\nby (auto simp add: keySetup_def ltkeySetup_def corrKey_def)\n\n\n(******************************************************************************)\nsubsection \\<open>State\\<close>\n(******************************************************************************)\n\ntext \\<open>The secure channels are star-shaped to/from the server.  Therefore,\nwe have only one agent in the relation.\\<close>\n\nrecord m3_state = \"m1_state\" +\n  IK :: \"msg set\"                                \\<comment> \\<open>intruder knowledge\\<close>\n\n\ntext \\<open>Observable state:\n@{term \"runs\"}, @{term \"leak\"}, @{term \"clk\"}, and @{term \"cache\"}.\\<close>\n\ntype_synonym\n  m3_obs = \"m2_obs\"\n\ndefinition\n  m3_obs :: \"m3_state \\<Rightarrow> m3_obs\" where\n  \"m3_obs s \\<equiv> \\<lparr> runs = runs s, leak = leak s, clk = clk s, cache = cache s \\<rparr>\"\n\ntype_synonym\n  m3_pred = \"m3_state set\"\n\ntype_synonym\n  m3_trans = \"(m3_state \\<times> m3_state) set\"\n\n\n(******************************************************************************)\nsubsection \\<open>Events\\<close>\n(******************************************************************************)\n\ntext \\<open>Protocol events.\\<close>\n\ndefinition     \\<comment> \\<open>by @{term \"A\"}, refines @{term \"m2_step1\"}\\<close>\n  m3_step1 :: \"[rid_t, agent, agent, nonce] \\<Rightarrow> m3_trans\"\nwhere\n  \"m3_step1 Ra A B Na \\<equiv> {(s, s1).\n    \\<comment> \\<open>guards:\\<close>\n    Ra \\<notin> dom (runs s) \\<and>                  \\<comment> \\<open>\\<open>Ra\\<close> is fresh\\<close>\n    Na = Ra$na \\<and>                         \\<comment> \\<open>generated nonce\\<close>\n\n    \\<comment> \\<open>actions:\\<close>\n    s1 = s\\<lparr>\n      runs := (runs s)(Ra \\<mapsto> (Init, [A, B], [])),\n      IK := insert \\<lbrace>Agent A, Agent B, Nonce Na\\<rbrace> (IK s)   \\<comment> \\<open>send \\<open>M1\\<close>\\<close>\n    \\<rparr>\n  }\"\n\ndefinition     \\<comment> \\<open>by @{term \"B\"}, refines @{term \"m2_step2\"}\\<close>\n  m3_step2 :: \"[rid_t, agent, agent] \\<Rightarrow> m3_trans\"\nwhere\n  \"m3_step2 \\<equiv> m1_step2\"\n\ndefinition     \\<comment> \\<open>by @{text \"Server\"}, refines @{term m2_step3}\\<close>\n  m3_step3 :: \"[rid_t, agent, agent, key, nonce, time] \\<Rightarrow> m3_trans\"\nwhere\n  \"m3_step3 Rs A B Kab Na Ts \\<equiv> {(s, s1).\n     \\<comment> \\<open>guards:\\<close>\n     Rs \\<notin> dom (runs s) \\<and>                          \\<comment> \\<open>fresh server run\\<close>\n     Kab = sesK (Rs$sk) \\<and>                          \\<comment> \\<open>fresh session key\\<close>\n\n     \\<lbrace>Agent A, Agent B, Nonce Na\\<rbrace> \\<in> IK s \\<and>         \\<comment> \\<open>recv \\<open>M1\\<close>\\<close>\n     Ts = clk s \\<and>                                  \\<comment> \\<open>fresh timestamp\\<close>\n\n     \\<comment> \\<open>actions:\\<close>\n     \\<comment> \\<open>record session key and send \\<open>M2\\<close>\\<close>\n     s1 = s\\<lparr>\n       runs := (runs s)(Rs \\<mapsto> (Serv, [A, B], [aNon Na, aNum Ts])),\n       IK := insert (Crypt (shrK A) \\<lbrace>Key Kab, Agent B, Number Ts, Nonce Na\\<rbrace>)\n             (insert (Crypt (shrK B) \\<lbrace>Key Kab,  Agent A, Number Ts\\<rbrace>)  (IK s))\n     \\<rparr>\n  }\"\n\ndefinition     \\<comment> \\<open>by @{term \"A\"}, refines @{term m2_step4}\\<close>\n  m3_step4 :: \"[rid_t, agent, agent, nonce, key, time, time] \\<Rightarrow> m3_trans\"\nwhere\n  \"m3_step4 Ra A B Na Kab Ts Ta \\<equiv> {(s, s1).\n     \\<comment> \\<open>guards:\\<close>\n     runs s Ra = Some (Init, [A, B], []) \\<and>           \\<comment> \\<open>key not yet recv'd\\<close>\n     Na = Ra$na \\<and>                                     \\<comment> \\<open>generated nonce\\<close>\n\n     Crypt (shrK A)                                  \\<comment> \\<open>recv \\<open>M2a\\<close>\\<close>\n       \\<lbrace>Key Kab, Agent B, Number Ts, Nonce Na\\<rbrace> \\<in> IK s \\<and>\n\n     \\<comment> \\<open>read current time\\<close>\n     Ta = clk s \\<and>\n\n     \\<comment> \\<open>check freshness of session key\\<close>\n     clk s < Ts + Ls \\<and>\n\n     \\<comment> \\<open>actions:\\<close>\n     \\<comment> \\<open>record session key and send \\<open>M3\\<close>\\<close>\n     s1 = s\\<lparr>\n       runs := (runs s)(Ra \\<mapsto> (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta])),\n       IK := insert (Crypt Kab \\<lbrace>Agent A, Number Ta\\<rbrace>) (IK s)  \\<comment> \\<open>\\<open>M3\\<close>\\<close>\n     \\<rparr>\n  }\"\n\ndefinition     \\<comment> \\<open>by @{term \"B\"}, refines @{term m2_step5}\\<close>\n  m3_step5 :: \"[rid_t, agent, agent, key, time, time] \\<Rightarrow> m3_trans\"\nwhere\n  \"m3_step5 Rb A B Kab Ts Ta \\<equiv> {(s, s1).\n     \\<comment> \\<open>guards:\\<close>\n     runs s Rb = Some (Resp, [A, B], []) \\<and>             \\<comment> \\<open>key not yet recv'd\\<close>\n\n     Crypt (shrK B) \\<lbrace>Key Kab, Agent A, Number Ts\\<rbrace> \\<in> IK s \\<and>   \\<comment> \\<open>recv \\<open>M2b\\<close>\\<close>\n     Crypt Kab \\<lbrace>Agent A, Number Ta\\<rbrace> \\<in> IK s \\<and>                 \\<comment> \\<open>recv \\<open>M3\\<close>\\<close>\n\n     \\<comment> \\<open>ensure freshness of session key\\<close>\n     clk s < Ts + Ls \\<and>\n\n     \\<comment> \\<open>check authenticator's validity and replay; 'replays' with fresh authenticator ok!\\<close>\n     clk s < Ta + La \\<and>\n     (B, Kab, Ta) \\<notin> cache s \\<and>\n\n     \\<comment> \\<open>actions:\\<close>\n     \\<comment> \\<open>record session key\\<close>\n     s1 = s\\<lparr>\n       runs := (runs s)(Rb \\<mapsto> (Resp, [A, B], [aKey Kab, aNum Ts, aNum Ta])),\n       cache := insert (B, Kab, Ta) (cache s),\n       IK := insert (Crypt Kab (Number Ta)) (IK s)              \\<comment> \\<open>send \\<open>M4\\<close>\\<close>\n     \\<rparr>\n  }\"\n\ndefinition     \\<comment> \\<open>by @{term \"A\"}, refines @{term m2_step6}\\<close>\n  m3_step6 :: \"[rid_t, agent, agent, nonce, key, time, time] \\<Rightarrow> m3_trans\"\nwhere\n  \"m3_step6 Ra A B Na Kab Ts Ta \\<equiv> {(s, s').\n     \\<comment> \\<open>guards:\\<close>\n     runs s Ra = Some (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta]) \\<and>  \\<comment> \\<open>knows key\\<close>\n     Na = Ra$na \\<and>                                    \\<comment> \\<open>generated nonce\\<close>\n     clk s < Ts + Ls \\<and>                               \\<comment> \\<open>check session key's recentness\\<close>\n\n     Crypt Kab (Number Ta) \\<in> IK s \\<and>                  \\<comment> \\<open>recv \\<open>M4\\<close>\\<close>\n\n     \\<comment> \\<open>actions:\\<close>\n     s' = s\\<lparr>\n        runs := (runs s)(Ra \\<mapsto> (Init, [A, B], [aKey Kab, aNum Ts, aNum Ta, END]))\n     \\<rparr>\n  }\"\n\ntext \\<open>Clock tick event\\<close>\n\ndefinition   \\<comment> \\<open>refines @{term \"m2_tick\"}\\<close>\n  m3_tick :: \"time \\<Rightarrow> m3_trans\"\nwhere\n  \"m3_tick \\<equiv> m1_tick\"\n\n\ntext \\<open>Purge event: purge cache of expired timestamps\\<close>\n\ndefinition     \\<comment> \\<open>refines @{term \"m2_purge\"}\\<close>\n  m3_purge :: \"agent \\<Rightarrow> m3_trans\"\nwhere\n  \"m3_purge \\<equiv> m1_purge\"\n\n\ntext \\<open>Session key compromise.\\<close>\n\ndefinition     \\<comment> \\<open>refines @{term m2_leak}\\<close>\n  m3_leak :: \"[rid_t, agent, agent, nonce, time] \\<Rightarrow> m3_trans\"\nwhere\n  \"m3_leak Rs A B Na Ts \\<equiv> {(s, s1).\n    \\<comment> \\<open>guards:\\<close>\n    runs s Rs = Some (Serv, [A, B], [aNon Na, aNum Ts]) \\<and>\n    (clk s \\<ge> Ts + Ls) \\<and>             \\<comment> \\<open>only compromise 'old' session keys!\\<close>\n\n    \\<comment> \\<open>actions:\\<close>\n    \\<comment> \\<open>record session key as leaked and add it to intruder knowledge\\<close>\n    s1 = s\\<lparr> leak := insert (sesK (Rs$sk), A, B, Na, Ts) (leak s),\n            IK := insert (Key (sesK (Rs$sk))) (IK s) \\<rparr>\n  }\"\n\ntext \\<open>Intruder fake event. The following \"Dolev-Yao\" event generates all\nintruder-derivable messages.\\<close>\n\ndefinition     \\<comment> \\<open>refines @{term \"m2_fake\"}\\<close>\n  m3_DY_fake :: \"m3_trans\"\nwhere\n  \"m3_DY_fake \\<equiv> {(s, s1).\n\n     \\<comment> \\<open>actions:\\<close>\n     s1 = s(| IK := synth (analz (IK s)) |)       \\<comment> \\<open>take DY closure\\<close>\n  }\"\n\n\n(******************************************************************************)\nsubsection \\<open>Transition system\\<close>\n(******************************************************************************)\n\ndefinition\n  m3_init :: \"m3_pred\"\nwhere\n  \"m3_init \\<equiv> { \\<lparr>\n     runs = Map.empty,\n     leak = shrK`bad \\<times> {undefined},\n     clk = 0,\n     cache = {},\n     IK = Key`shrK`bad\n  \\<rparr> }\"\n\ndefinition\n  m3_trans :: \"m3_trans\" where\n  \"m3_trans \\<equiv> (\\<Union>A B Ra Rb Rs Na Kab Ts Ta T.\n     m3_step1 Ra A B Na \\<union>\n     m3_step2 Rb A B \\<union>\n     m3_step3 Rs A B Kab Na Ts \\<union>\n     m3_step4 Ra A B Na Kab Ts Ta \\<union>\n     m3_step5 Rb A B Kab Ts Ta \\<union>\n     m3_step6 Ra A B Na Kab Ts Ta \\<union>\n     m3_tick T \\<union>\n     m3_purge A \\<union>\n     m3_leak Rs A B Na Ts \\<union>\n     m3_DY_fake \\<union>\n     Id\n  )\"\n\ndefinition\n  m3 :: \"(m3_state, m3_obs) spec\" where\n  \"m3 \\<equiv> \\<lparr>\n    init = m3_init,\n    trans = m3_trans,\n    obs = m3_obs\n  \\<rparr>\"\n\nlemmas m3_loc_defs =\n  m3_def m3_init_def m3_trans_def m3_obs_def\n  m3_step1_def m3_step2_def m3_step3_def m3_step4_def m3_step5_def\n  m3_step6_def m3_tick_def m3_purge_def m3_leak_def m3_DY_fake_def\n\nlemmas m3_defs = m3_loc_defs m2_defs\n\n\n(******************************************************************************)\nsubsection \\<open>Invariants\\<close>\n(******************************************************************************)\n\ntext \\<open>Specialized injection that we can apply more aggressively.\\<close>\n\nlemmas analz_Inj_IK = analz.Inj [where H=\"IK s\" for s]\nlemmas parts_Inj_IK = parts.Inj [where H=\"IK s\" for s]\n\ndeclare parts_Inj_IK [dest!]\n\ndeclare analz_into_parts [dest]\n\n\nsubsubsection \\<open>inv1: Secrecy of pre-distributed shared keys\\<close>\n(******************************************************************************)\n\ntext \\<open>inv1: Secrecy of long-term keys\\<close>\n\ndefinition\n  m3_inv1_lkeysec :: \"m3_pred\"\nwhere\n  \"m3_inv1_lkeysec \\<equiv> {s. \\<forall>C.\n     (Key (shrK C) \\<in> parts (IK s) \\<longrightarrow> C \\<in> bad) \\<and>\n     (C \\<in> bad \\<longrightarrow> Key (shrK C) \\<in> IK s)\n  }\"\n\nlemmas m3_inv1_lkeysecI = m3_inv1_lkeysec_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv1_lkeysecE [elim] = m3_inv1_lkeysec_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv1_lkeysec_dest = m3_inv1_lkeysec_def [THEN setc_def_to_dest, rule_format]\n\n\ntext \\<open>Invariance proof.\\<close>\n\nlemma PO_m3_inv1_lkeysec_init [iff]:\n  \"init m3 \\<subseteq> m3_inv1_lkeysec\"\nby (auto simp add: m3_defs intro!: m3_inv1_lkeysecI)\n\nlemma PO_m3_inv1_lkeysec_trans [iff]:\n  \"{m3_inv1_lkeysec} trans m3 {> m3_inv1_lkeysec}\"\nby (fastforce simp add: PO_hoare_defs m3_defs intro!: m3_inv1_lkeysecI)\n\nlemma PO_m3_inv1_lkeysec [iff]: \"reach m3 \\<subseteq> m3_inv1_lkeysec\"\nby (rule inv_rule_basic) (fast+)\n\n\ntext \\<open>Useful simplifier lemmas\\<close>\n\nlemma m3_inv1_lkeysec_for_parts [simp]:\n  \"\\<lbrakk> s \\<in> m3_inv1_lkeysec \\<rbrakk> \\<Longrightarrow> Key (shrK C) \\<in> parts (IK s) \\<longleftrightarrow> C \\<in> bad\"\nby auto\n\nlemma m3_inv1_lkeysec_for_analz [simp]:\n  \"\\<lbrakk> s \\<in> m3_inv1_lkeysec \\<rbrakk> \\<Longrightarrow> Key (shrK C) \\<in> analz (IK s) \\<longleftrightarrow> C \\<in> bad\"\nby auto\n\n\nsubsubsection \\<open>inv7a: Session keys not used to encrypt other session keys\\<close>\n(******************************************************************************)\n\ntext \\<open>Session keys are not used to encrypt other keys. Proof requires\ngeneralization to sets of session keys.\n\nNOTE: This invariant will be derived from the corresponding L2 invariant\nusing the simulation relation.\n\\<close>\n\ndefinition\n  m3_inv7a_sesK_compr :: \"m3_pred\"\nwhere\n  \"m3_inv7a_sesK_compr \\<equiv> {s. \\<forall>K KK.\n     KK \\<subseteq> range sesK \\<longrightarrow>\n     (Key K \\<in> analz (Key`KK \\<union> (IK s))) = (K \\<in> KK \\<or> Key K \\<in> analz (IK s))\n  }\"\n\nlemmas m3_inv7a_sesK_comprI = m3_inv7a_sesK_compr_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv7a_sesK_comprE = m3_inv7a_sesK_compr_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv7a_sesK_comprD = m3_inv7a_sesK_compr_def [THEN setc_def_to_dest, rule_format]\n\ntext \\<open>Additional lemma\\<close>\nlemmas insert_commute_Key = insert_commute [where x=\"Key K\" for K]\n\nlemmas m3_inv7a_sesK_compr_simps =\n  m3_inv7a_sesK_comprD\n  m3_inv7a_sesK_comprD [where KK=\"{Kab}\" for Kab, simplified]\n  m3_inv7a_sesK_comprD [where KK=\"insert Kab KK\" for Kab KK, simplified]\n  insert_commute_Key\n\n\n(******************************************************************************)\nsubsection \\<open>Refinement\\<close>\n(******************************************************************************)\n\nsubsubsection \\<open>Message abstraction and simulation relation\\<close>\n(******************************************************************************)\n\ntext \\<open>Abstraction function on sets of messages.\\<close>\n\ninductive_set\n  abs_msg :: \"msg set \\<Rightarrow> chmsg set\"\n  for H :: \"msg set\"\nwhere\n  am_M1:\n    \"\\<lbrace>Agent A, Agent B, Nonce N\\<rbrace> \\<in> H\n  \\<Longrightarrow> Insec A B (Msg [aNon N]) \\<in> abs_msg H\"\n| am_M2a:\n    \"Crypt (shrK C) \\<lbrace>Key K, Agent B, Number T, Nonce N\\<rbrace> \\<in> H\n  \\<Longrightarrow> Secure Sv C (Msg [aKey K, aAgt B, aNum T, aNon N]) \\<in> abs_msg H\"\n| am_M2b:\n    \"Crypt (shrK C) \\<lbrace>Key K,  Agent A, Number T\\<rbrace> \\<in> H\n  \\<Longrightarrow> Secure Sv C (Msg [aKey K, aAgt A, aNum T]) \\<in> abs_msg H\"\n| am_M3:\n    \"Crypt K \\<lbrace>Agent A, Number T\\<rbrace> \\<in> H\n  \\<Longrightarrow> dAuth K (Msg [aAgt A, aNum T]) \\<in> abs_msg H\"\n| am_M4:\n    \"Crypt K (Number T) \\<in> H\n  \\<Longrightarrow> dAuth K (Msg [aNum T]) \\<in> abs_msg H\"\n\n\ntext \\<open>R23: The simulation relation. This is a data refinement of\nthe insecure and secure channels of refinement 2.\\<close>\n\ndefinition\n  R23_msgs :: \"(m2_state \\<times> m3_state) set\" where\n  \"R23_msgs \\<equiv> {(s, t). abs_msg (parts (IK t)) \\<subseteq> chan s }\"\n\ndefinition\n  R23_keys :: \"(m2_state \\<times> m3_state) set\" where\n  \"R23_keys \\<equiv> {(s, t). \\<forall>KK K. KK \\<subseteq> range sesK \\<longrightarrow>\n     Key K \\<in> analz (Key`KK \\<union> (IK t)) \\<longleftrightarrow> aKey K \\<in> extr (aKey`KK \\<union> ik0) (chan s)\n  }\"\n\ndefinition\n  R23_non :: \"(m2_state \\<times> m3_state) set\" where\n  \"R23_non \\<equiv> {(s, t). \\<forall>KK N. KK \\<subseteq> range sesK \\<longrightarrow>\n     Nonce N \\<in> analz (Key`KK \\<union> (IK t)) \\<longleftrightarrow> aNon N \\<in> extr (aKey`KK \\<union> ik0) (chan s)\n  }\"\n\ndefinition\n  R23_pres :: \"(m2_state \\<times> m3_state) set\" where\n  \"R23_pres \\<equiv> {(s, t). runs s = runs t \\<and> leak s = leak t \\<and> clk s = clk t \\<and> cache s = cache t}\"\n\ndefinition\n  R23 :: \"(m2_state \\<times> m3_state) set\" where\n  \"R23 \\<equiv> R23_msgs \\<inter> R23_keys \\<inter> R23_non \\<inter> R23_pres\"\n\nlemmas R23_defs =\n  R23_def R23_msgs_def R23_keys_def R23_non_def R23_pres_def\n\n\ntext \\<open>The mediator function is the identity here.\\<close>\n\ndefinition\n  med32 :: \"m3_obs \\<Rightarrow> m2_obs\" where\n  \"med32 \\<equiv> id\"\n\n\nlemmas R23_msgsI = R23_msgs_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_msgsE [elim] = R23_msgs_def [THEN rel_def_to_elim, simplified, rule_format]\nlemmas R23_msgsE' [elim] = R23_msgs_def [THEN rel_def_to_dest, simplified, rule_format, THEN subsetD]\n\nlemmas R23_keysI = R23_keys_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_keysE [elim] = R23_keys_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_nonI = R23_non_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_nonE [elim] = R23_non_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_presI = R23_pres_def [THEN rel_def_to_intro, simplified, rule_format]\nlemmas R23_presE [elim] = R23_pres_def [THEN rel_def_to_elim, simplified, rule_format]\n\nlemmas R23_intros = R23_msgsI R23_keysI R23_nonI R23_presI\n\n\ntext \\<open>Simplifier lemmas for various instantiations (keys and nonces).\\<close>\n\nlemmas R23_keys_simp = R23_keys_def [THEN rel_def_to_dest, simplified, rule_format]\nlemmas R23_keys_simps =\n  R23_keys_simp\n  R23_keys_simp [where KK=\"{}\", simplified]\n  R23_keys_simp [where KK=\"{K'}\" for K', simplified]\n  R23_keys_simp [where KK=\"insert K' KK\" for K' KK, simplified, OF _ conjI]\n\nlemmas R23_non_simp = R23_non_def [THEN rel_def_to_dest, simplified, rule_format]\nlemmas R23_non_simps =\n  R23_non_simp\n  R23_non_simp [where KK=\"{}\", simplified]\n  R23_non_simp [where KK=\"{K}\" for K, simplified]\n  R23_non_simp [where KK=\"insert K KK\" for K KK, simplified, OF _ conjI]\n\nlemmas R23_simps = R23_keys_simps R23_non_simps\n\n(*\nlemmas R23_keys_emptyD =\n  R23_keys_simp [where KK=\"{}\", simplified, THEN iffD1, rotated 1]\n  R23_keys_simp [where KK=\"{}\", simplified, THEN iffD2, rotated 1]\n\nlemmas R23_non_emptyD =\n  R23_non_simp [where KK=\"{}\", simplified, THEN iffD1, rotated 1]\n  R23_non_simp [where KK=\"{}\", simplified, THEN iffD2, rotated 1]\n\nlemmas R23_emptyD = R23_keys_emptyD R23_non_emptyD\n*)\n\nsubsubsection \\<open>General lemmas\\<close>\n(******************************************************************************)\n\ntext \\<open>General facts about @{term \"abs_msg\"}\\<close>\n\ndeclare abs_msg.intros [intro!]\ndeclare abs_msg.cases [elim!]\n\nlemma abs_msg_empty: \"abs_msg {} = {}\"\nby (auto)\n\nlemma abs_msg_Un [simp]:\n  \"abs_msg (G \\<union> H) = abs_msg G \\<union> abs_msg H\"\nby (auto)\n\nlemma abs_msg_mono [elim]:\n  \"\\<lbrakk> m \\<in> abs_msg G; G \\<subseteq> H \\<rbrakk> \\<Longrightarrow> m \\<in> abs_msg H\"\nby (auto)\n\nlemma abs_msg_insert_mono [intro]:\n  \"\\<lbrakk> m \\<in> abs_msg H \\<rbrakk> \\<Longrightarrow> m \\<in> abs_msg (insert m' H)\"\nby (auto)\n\n\ntext \\<open>Facts about @{term \"abs_msg\"} concerning abstraction of fakeable\nmessages. This is crucial for proving the refinement of the intruder event.\\<close>\n\nlemma abs_msg_DY_subset_fakeable:\n  \"\\<lbrakk> (s, t) \\<in> R23_msgs; (s, t) \\<in> R23_keys; (s, t) \\<in> R23_non; t \\<in> m3_inv1_lkeysec \\<rbrakk>\n  \\<Longrightarrow> abs_msg (synth (analz (IK t))) \\<subseteq> fake ik0 (dom (runs s)) (chan s)\"\napply (auto)\n\\<comment> \\<open>9 subgoals, deal with replays first\\<close>\nprefer 2 apply (blast)\nprefer 3 apply (blast)\nprefer 4 apply (blast)\nprefer 5 apply (blast)\n\\<comment> \\<open>remaining 5 subgoals are real fakes\\<close>\napply (intro fake_StatCh fake_DynCh, auto simp add: R23_simps)+\ndone\n\n\nsubsubsection \\<open>Refinement proof\\<close>\n(******************************************************************************)\n\ntext \\<open>Pair decomposition. These were set to \\texttt{elim!}, which is too\nagressive here.\\<close>\n\ndeclare MPair_analz [rule del, elim]\ndeclare MPair_parts [rule del, elim]\n\n\ntext \\<open>Protocol events.\\<close>\n\nlemma PO_m3_step1_refines_m2_step1:\n  \"{R23}\n     (m2_step1 Ra A B Na), (m3_step1 Ra A B Na)\n   {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros) (auto)\n\nlemma PO_m3_step2_refines_m2_step2:\n  \"{R23}\n     (m2_step2 Rb A B), (m3_step2 Rb A B)\n   {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_step3_refines_m2_step3:\n  \"{R23 \\<inter> (m2_inv3a_sesK_compr) \\<times> (m3_inv7a_sesK_compr \\<inter> m3_inv1_lkeysec)}\n     (m2_step3 Rs A B Kab Na Ts), (m3_step3 Rs A B Kab Na Ts)\n   {> R23}\"\nproof -\n  { fix s t\n    assume H:\n      \"(s, t) \\<in> R23_msgs\" \"(s, t) \\<in> R23_keys\" \"(s, t) \\<in> R23_non\" \"(s, t) \\<in> R23_pres\"\n      \"s \\<in> m2_inv3a_sesK_compr\"\n      \"t \\<in> m3_inv7a_sesK_compr\" \"t \\<in> m3_inv1_lkeysec\"\n      \"Kab = sesK (Rs$sk)\" \"Rs \\<notin> dom (runs t)\"\n      \"\\<lbrace> Agent A, Agent B, Nonce Na \\<rbrace> \\<in> parts (IK t)\"\n    let ?s'=\n      \"s\\<lparr> runs := runs s(Rs \\<mapsto> (Serv, [A, B], [aNon Na, aNum (clk t)])),\n          chan := insert (Secure Sv A (Msg [aKey Kab, aAgt B, aNum (clk t), aNon Na]))\n                 (insert (Secure Sv B (Msg [aKey Kab, aAgt A, aNum (clk t)])) (chan s)) \\<rparr>\"\n    let ?t'=\n      \"t\\<lparr> runs := runs t(Rs \\<mapsto> (Serv, [A, B], [aNon Na, aNum (clk t)])),\n          IK := insert (Crypt (shrK A) \\<lbrace> Key Kab, Agent B, Number (clk t), Nonce Na \\<rbrace>)\n                (insert (Crypt (shrK B) \\<lbrace> Key Kab, Agent A, Number (clk t) \\<rbrace>) (IK t)) \\<rparr>\"\n  \\<comment> \\<open>here we go\\<close>\n    have \"(?s', ?t') \\<in> R23_msgs\" using H\n    by (-) (rule R23_intros, auto)\n  moreover\n    have \"(?s', ?t') \\<in> R23_keys\" using H\n    by (-)\n       (rule R23_intros,\n        auto simp add: m2_inv3a_sesK_compr_simps m3_inv7a_sesK_compr_simps,\n        auto simp add: R23_keys_simps)\n  moreover\n    have \"(?s', ?t') \\<in> R23_non\" using H\n    by (-)\n       (rule R23_intros,\n        auto simp add: m2_inv3a_sesK_compr_simps m3_inv7a_sesK_compr_simps R23_non_simps)\n  moreover\n    have \"(?s', ?t') \\<in> R23_pres\" using H\n    by (-) (rule R23_intros, auto)\n  moreover\n    note calculation\n  }\n  thus ?thesis\n  by (auto simp add: PO_rhoare_defs R23_def m3_defs)\nqed\n\nlemma PO_m3_step4_refines_m2_step4:\n  \"{R23 \\<inter> UNIV \\<times> (m3_inv1_lkeysec) }\n     (m2_step4 Ra A B Na Kab Ts Ta), (m3_step4 Ra A B Na Kab Ts Ta)\n   {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n   (auto)\n\nlemma PO_m3_step5_refines_m2_step5:\n  \"{R23}\n     (m2_step5 Rb A B Kab Ts Ta), (m3_step5 Rb A B Kab Ts Ta)\n   {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n   (auto)\n\nlemma PO_m3_step6_refines_m2_step6:\n  \"{R23}\n     (m2_step6 Ra A B Na Kab Ts Ta), (m3_step6 Ra A B Na Kab Ts Ta)\n   {> R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_tick_refines_m2_tick:\n  \"{R23}\n     (m2_tick T), (m3_tick T)\n   {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_purge_refines_m2_purge:\n  \"{R23}\n     (m2_purge A), (m3_purge A)\n   {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros)\n\n\ntext \\<open>Intruder events.\\<close>\n\nlemma PO_m3_leak_refines_m2_leak:\n  \"{R23}\n     (m2_leak Rs A B Na Ts), (m3_leak Rs A B Na Ts)\n   {>R23}\"\nby (auto simp add: PO_rhoare_defs R23_def m3_defs R23_simps intro!: R23_intros)\n\n(* also works, but requires invariants:\napply (auto simp add: m2_inv3a_sesK_compr_simps m2_inv3b_sesK_compr_non_simps\n                      m3_inv7a_sesK_compr_simps m3_inv7b_sesK_compr_non_simps\n            dest: R23_emptyD)\n*)\n\nlemma PO_m3_DY_fake_refines_m2_fake:\n  \"{R23 \\<inter> UNIV \\<times> m3_inv1_lkeysec}\n     m2_fake, m3_DY_fake\n   {> R23}\"\napply (auto simp add: PO_rhoare_defs R23_def m3_defs intro!: R23_intros\n            del: abs_msg.cases)\napply (auto intro: abs_msg_DY_subset_fakeable [THEN subsetD]\n            del: abs_msg.cases)\napply (auto simp add: R23_simps)\ndone\n\n\ntext \\<open>All together now...\\<close>\n\nlemmas PO_m3_trans_refines_m2_trans =\n  PO_m3_step1_refines_m2_step1 PO_m3_step2_refines_m2_step2\n  PO_m3_step3_refines_m2_step3 PO_m3_step4_refines_m2_step4\n  PO_m3_step5_refines_m2_step5 PO_m3_step6_refines_m2_step6\n  PO_m3_tick_refines_m2_tick PO_m3_purge_refines_m2_purge\n  PO_m3_leak_refines_m2_leak PO_m3_DY_fake_refines_m2_fake\n\n\nlemma PO_m3_refines_init_m2 [iff]:\n  \"init m3 \\<subseteq> R23``(init m2)\"\nby (auto simp add: R23_def m3_defs intro!: R23_intros)\n\nlemma PO_m3_refines_trans_m2 [iff]:\n  \"{R23 \\<inter> (m2_inv3a_sesK_compr) \\<times> (m3_inv7a_sesK_compr \\<inter> m3_inv1_lkeysec)}\n     (trans m2), (trans m3)\n   {> R23}\"\napply (auto simp add: m3_def m3_trans_def m2_def m2_trans_def)\napply (blast intro!: PO_m3_trans_refines_m2_trans)+\ndone\n\nlemma PO_m3_observation_consistent [iff]:\n  \"obs_consistent R23 med32 m2 m3\"\nby (auto simp add: obs_consistent_def R23_def med32_def m3_defs)\n\n\ntext \\<open>Refinement result.\\<close>\n\nlemma m3_refines_m2 [iff]:\n  \"refines\n     (R23 \\<inter> (m2_inv3a_sesK_compr) \\<times> (m3_inv1_lkeysec))\n     med32 m2 m3\"\nproof -\n  have \"R23 \\<inter> m2_inv3a_sesK_compr \\<times> UNIV \\<subseteq> UNIV \\<times> m3_inv7a_sesK_compr\"\n    by (auto simp add: R23_def R23_keys_simps intro!: m3_inv7a_sesK_comprI)\n  thus ?thesis\n    by (-) (rule Refinement_using_invariants, auto)\nqed\n\nlemma m3_implements_m2 [iff]:\n  \"implements med32 m2 m3\"\nby (rule refinement_soundness) (auto)\n\n\nsubsection \\<open>Inherited invariants\\<close>\n(******************************************************************************)\n\nsubsubsection \\<open>inv3 (derived): Key secrecy for initiator\\<close>\n(*invh*************************************************************************)\n\ndefinition\n  m3_inv3_ikk_init :: \"m3_state set\"\nwhere\n  \"m3_inv3_ikk_init \\<equiv> {s. \\<forall>A B Ra K Ts nl.\n     runs s Ra = Some (Init, [A, B], aKey K # aNum Ts # nl) \\<longrightarrow> A \\<in> good \\<longrightarrow> B \\<in> good \\<longrightarrow>\n     Key K \\<in> analz (IK s) \\<longrightarrow>\n       (K, A, B, Ra$na, Ts) \\<in> leak s\n  }\"\n\nlemmas m3_inv3_ikk_initI = m3_inv3_ikk_init_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv3_ikk_initE [elim] = m3_inv3_ikk_init_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv3_ikk_initD = m3_inv3_ikk_init_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\nlemma PO_m3_inv3_ikk_init: \"reach m3 \\<subseteq> m3_inv3_ikk_init\"\nproof (rule INV_from_Refinement_using_invariants [OF m3_refines_m2])\n  show \"Range (R23 \\<inter> m2_inv3a_sesK_compr \\<times> m3_inv1_lkeysec \\<inter> m2_inv6_ikk_init \\<times> UNIV)\n      \\<subseteq> m3_inv3_ikk_init\"\n    by (fastforce simp add: R23_def R23_keys_simps intro!: m3_inv3_ikk_initI)\nqed auto\n\n\nsubsubsection \\<open>inv4 (derived): Key secrecy for responder\\<close>\n(*invh*************************************************************************)\n\ndefinition\n  m3_inv4_ikk_resp :: \"m3_state set\"\nwhere\n  \"m3_inv4_ikk_resp \\<equiv> {s. \\<forall>A B Rb K Ts nl.\n     runs s Rb = Some (Resp, [A, B], aKey K # aNum Ts # nl) \\<longrightarrow> A \\<in> good \\<longrightarrow> B \\<in> good \\<longrightarrow>\n     Key K \\<in> analz (IK s) \\<longrightarrow>\n       (\\<exists>Na. (K, A, B, Na, Ts) \\<in> leak s)\n  }\"\n\nlemmas m3_inv4_ikk_respI = m3_inv4_ikk_resp_def [THEN setc_def_to_intro, rule_format]\nlemmas m3_inv4_ikk_respE [elim] = m3_inv4_ikk_resp_def [THEN setc_def_to_elim, rule_format]\nlemmas m3_inv4_ikk_respD = m3_inv4_ikk_resp_def [THEN setc_def_to_dest, rule_format, rotated 1]\n\nlemma PO_m3_inv4_ikk_resp: \"reach m3 \\<subseteq> m3_inv4_ikk_resp\"\nproof (rule INV_from_Refinement_using_invariants [OF m3_refines_m2])\n  show \"Range (R23 \\<inter> m2_inv3a_sesK_compr \\<times> m3_inv1_lkeysec \\<inter> m2_inv7_ikk_resp \\<times> UNIV)\n      \\<subseteq> m3_inv4_ikk_resp\"\n    by (auto simp add: R23_def R23_keys_simps intro!: m3_inv4_ikk_respI)\n       (elim m2_inv7_ikk_respE, auto)\nqed auto\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Security_Protocol_Refinement/Key_establish/m3_kerberos_par.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.30531401215847837}}
{"text": "theory Sepref_Constraints\nimports Main Automatic_Refinement.Refine_Lib Sepref_Basic\nbegin\n\ndefinition \"CONSTRAINT_SLOT (x::prop) \\<equiv> x\"\n\n(* TODO: Find something better than True to put in empty slot! Perhaps \"A\\<Longrightarrow>A\" *)\nlemma insert_slot_rl1:\n  assumes \"PROP P \\<Longrightarrow> PROP (CONSTRAINT_SLOT (Trueprop True)) \\<Longrightarrow> PROP Q\"\n  shows \"PROP (CONSTRAINT_SLOT (PROP P)) \\<Longrightarrow> PROP Q\"\n  using assms unfolding CONSTRAINT_SLOT_def by simp\n\nlemma insert_slot_rl2:\n  assumes \"PROP P \\<Longrightarrow> PROP (CONSTRAINT_SLOT S) \\<Longrightarrow> PROP Q\"\n  shows \"PROP (CONSTRAINT_SLOT (PROP S &&& PROP P)) \\<Longrightarrow> PROP Q\"\n  using assms unfolding CONSTRAINT_SLOT_def conjunction_def .\n\nlemma remove_slot: \"PROP (CONSTRAINT_SLOT (Trueprop True))\"\n  unfolding CONSTRAINT_SLOT_def by (rule TrueI)\n\ndefinition CONSTRAINT where [simp]: \"CONSTRAINT P x \\<equiv> P x\"\n\nlemma CONSTRAINT_D:\n  assumes \"CONSTRAINT (P::'a => bool) x\"\n  shows \"P x\"\n  using assms unfolding CONSTRAINT_def by simp\n\nlemma CONSTRAINT_I:\n  assumes \"P x\"\n  shows \"CONSTRAINT (P::'a => bool) x\"\n  using assms unfolding CONSTRAINT_def by simp\n\ntext \\<open>Special predicate to indicate unsolvable constraint.\n  The constraint solver refuses to put those into slot.\n  Thus, adding safe rules introducing this can be used to indicate \n  unsolvable constraints early.\n\\<close>\ndefinition CN_FALSE :: \"('a\\<Rightarrow>bool) \\<Rightarrow> 'a \\<Rightarrow> bool\" where [simp]: \"CN_FALSE P x \\<equiv> False\"  \nlemma CN_FALSEI: \"CN_FALSE P x \\<Longrightarrow> P x\" by simp\n\n\nnamed_theorems constraint_simps \\<open>Simplification of constraints\\<close>\n\nnamed_theorems constraint_abbrevs \\<open>Constraint Solver: Abbreviations\\<close>\nlemmas split_constraint_rls \n    = atomize_conj[symmetric] imp_conjunction all_conjunction conjunction_imp\n\nML \\<open>\n  signature SEPREF_CONSTRAINTS = sig\n    (******** Constraint Slot *)\n    (* Tactic with slot subgoal *)\n    val WITH_SLOT: tactic' -> tactic\n    (* Process all goals in slot *)\n    val ON_SLOT: tactic -> tactic\n    (* Create slot as last subgoal. Fail if slot already present. *)\n    val create_slot_tac: tactic\n    (* Create slot if there isn't one already *)\n    val ensure_slot_tac: tactic\n    (* Remove empty slot *)\n    val remove_slot_tac: tactic\n    (* Move slot to first subgoal *)\n    val prefer_slot_tac: tactic\n    (* Destruct slot *)\n    val dest_slot_tac: tactic'\n    (* Check if goal state has slot *)\n    val has_slot: thm -> bool\n    (* Defer subgoal to slot *)\n    val to_slot_tac: tactic'\n    (* Print slot constraints *)\n    val print_slot_tac: Proof.context -> tactic\n\n    (* Focus on goals in slot *)\n    val focus: tactic\n    (* Unfocus goals in slot *)\n    val unfocus: tactic\n    (* Unfocus goals, and insert them as first subgoals *)\n    val unfocus_ins:tactic\n\n    (* Focus on some goals in slot *)\n    val cond_focus: (term -> bool) -> tactic\n    (* Move some goals to slot *)\n    val some_to_slot_tac: (term -> bool) -> tactic\n\n\n    (******** Constraints *)\n    (* Check if subgoal is a constraint. To be used with COND' *)\n    val is_constraint_goal: term -> bool\n    (* Identity on constraint subgoal, no_tac otherwise *)\n    val is_constraint_tac: tactic'\n    (* Defer constraint to slot *)\n    val slot_constraint_tac: int -> tactic\n\n    (******** Constraint solving *)\n\n    val add_constraint_rule: thm -> Context.generic -> Context.generic\n    val del_constraint_rule: thm -> Context.generic -> Context.generic\n    val get_constraint_rules: Proof.context -> thm list\n\n    val add_safe_constraint_rule: thm -> Context.generic -> Context.generic\n    val del_safe_constraint_rule: thm -> Context.generic -> Context.generic\n    val get_safe_constraint_rules: Proof.context -> thm list\n\n    (* Solve constraint subgoal *)\n    val solve_constraint_tac: Proof.context -> tactic'\n    (* Solve constraint subgoal if solvable, fail if definitely unsolvable, \n      apply simplification and unique rules otherwise. *)\n    val safe_constraint_tac: Proof.context -> tactic'\n\n    (* CONSTRAINT tag on goal is optional *)\n    val solve_constraint'_tac: Proof.context -> tactic'\n    (* CONSTRAINT tag on goal is optional *)\n    val safe_constraint'_tac: Proof.context -> tactic'\n    \n    (* Solve, or apply safe-rules and defer to constraint slot *)\n    val constraint_tac: Proof.context -> tactic'\n\n    (* Apply safe rules to all constraint goals in slot *)\n    val process_constraint_slot: Proof.context -> tactic\n\n    (* Solve all constraint goals in slot, insert unsolved ones as first subgoals *)\n    val solve_constraint_slot: Proof.context -> tactic\n\n\n    val setup: theory -> theory\n\n  end\n\n\n  structure Sepref_Constraints: SEPREF_CONSTRAINTS  = struct\n    fun is_slot_goal @{mpat \"CONSTRAINT_SLOT _\"} = true | is_slot_goal _ = false\n\n    fun slot_goal_num st = let\n      val i = find_index is_slot_goal (Thm.prems_of st) + 1\n    in\n      i\n    end\n\n    fun has_slot st = slot_goal_num st > 0\n\n    fun WITH_SLOT tac st = let\n      val si = slot_goal_num st\n    in\n      if si>0 then tac si st else (warning \"Constraints: No slot\"; Seq.empty)\n    end\n\n    val to_slot_tac = IF_EXGOAL (fn i => WITH_SLOT (fn si => \n      if i<si then\n        prefer_tac si THEN prefer_tac (i+1)\n        THEN (\n          PRIMITIVE (fn st => Drule.comp_no_flatten (st, 0) 1 @{thm insert_slot_rl1}) \n          ORELSE PRIMITIVE (fn st => Drule.comp_no_flatten (st, 0) 1 @{thm insert_slot_rl2})\n        )\n        THEN defer_tac 1\n      else no_tac))\n\n    val create_slot_tac = \n      COND (has_slot) no_tac\n        (PRIMITIVE (Thm.implies_intr @{cterm \"CONSTRAINT_SLOT (Trueprop True)\"}) \n        THEN defer_tac 1)\n        \n    val ensure_slot_tac = TRY create_slot_tac\n          \n      \n    val prefer_slot_tac = WITH_SLOT prefer_tac\n\n    val dest_slot_tac = SELECT_GOAL (\n      ALLGOALS (\n        CONVERSION (Conv.rewr_conv @{thm CONSTRAINT_SLOT_def}) \n        THEN' Goal.conjunction_tac\n        THEN' TRY o resolve0_tac @{thms TrueI})\n      THEN distinct_subgoals_tac\n    )\n\n    val remove_slot_tac = WITH_SLOT (resolve0_tac @{thms remove_slot})\n\n    val focus = WITH_SLOT (fn i => \n      PRIMITIVE (Goal.restrict i 1) \n      THEN ALLGOALS dest_slot_tac\n      THEN create_slot_tac)\n\n    val unfocus_ins = \n      PRIMITIVE (Goal.unrestrict 1)\n      THEN WITH_SLOT defer_tac\n\n    fun some_to_slot_tac cond = (ALLGOALS (COND' (fn t => is_slot_goal t orelse not (cond t)) ORELSE' to_slot_tac))\n\n    val unfocus = \n      some_to_slot_tac (K true)\n      THEN unfocus_ins\n\n    fun cond_focus cond =\n      focus \n      THEN some_to_slot_tac (not o cond)\n\n\n    fun ON_SLOT tac = focus THEN tac THEN unfocus\n\n    fun print_slot_tac ctxt = ON_SLOT (print_tac ctxt \"SLOT:\")\n\n    local\n      (*fun prepare_constraint_conv ctxt = let\n        open Conv \n        fun CONSTRAINT_conv ct = case Thm.term_of ct of\n          @{mpat \"Trueprop (_ _)\"} => \n            HOLogic.Trueprop_conv \n              (rewr_conv @{thm CONSTRAINT_def[symmetric]}) ct\n          | _ => raise CTERM (\"CONSTRAINT_conv\", [ct])\n\n        fun rec_conv ctxt ct = (\n          CONSTRAINT_conv\n          else_conv \n          implies_conv (rec_conv ctxt) (rec_conv ctxt)\n          else_conv\n          forall_conv (rec_conv o #2) ctxt\n        ) ct\n      in\n        rec_conv ctxt\n      end*)\n\n      fun unfold_abbrevs ctxt = \n        Local_Defs.unfold0 ctxt (\n          @{thms split_constraint_rls CONSTRAINT_def} \n          @ Named_Theorems.get ctxt @{named_theorems constraint_abbrevs}\n          @ Named_Theorems.get ctxt @{named_theorems constraint_simps})\n        #> Conjunction.elim_conjunctions\n  \n      fun check_constraint_rl thm = let\n        fun ck (t as @{mpat \"Trueprop (?C _)\"}) = \n              if is_Var (Term.head_of C) then\n                raise TERM (\"Schematic head in constraint rule\",[t,Thm.prop_of thm])\n              else ()\n          | ck @{mpat \"\\<And>_. PROP ?t\"} = ck t\n          | ck @{mpat \"PROP ?s \\<Longrightarrow> PROP ?t\"} = (ck s; ck t)\n          | ck t = raise TERM (\"Invalid part of constraint rule\",[t,Thm.prop_of thm])\n  \n      in\n        ck (Thm.prop_of thm); thm\n      end\n\n      fun check_unsafe_constraint_rl thm = let\n        val _ = Thm.nprems_of thm = 0 \n          andalso raise TERM(\"Unconditional constraint rule must be safe (register this as safe rule)\",[Thm.prop_of thm])\n      in\n        thm\n      end\n\n    in\n      structure constraint_rules = Named_Sorted_Thms (\n        val name = @{binding constraint_rules}\n        val description = \"Constraint rules\"\n        val sort = K I\n        fun transform context = let\n          open Conv\n          val ctxt = Context.proof_of context\n        in\n          unfold_abbrevs ctxt #> map (check_constraint_rl o check_unsafe_constraint_rl)\n        end\n      )\n\n      structure safe_constraint_rules = Named_Sorted_Thms (\n        val name = @{binding safe_constraint_rules}\n        val description = \"Safe Constraint rules\"\n        val sort = K I\n        fun transform context = let\n          open Conv\n          val ctxt = Context.proof_of context\n        in\n          unfold_abbrevs ctxt #> map check_constraint_rl\n        end\n      )\n\n    end  \n\n    val add_constraint_rule = constraint_rules.add_thm\n    val del_constraint_rule = constraint_rules.del_thm\n    val get_constraint_rules = constraint_rules.get\n\n    val add_safe_constraint_rule = safe_constraint_rules.add_thm\n    val del_safe_constraint_rule = safe_constraint_rules.del_thm\n    val get_safe_constraint_rules = safe_constraint_rules.get\n\n    fun is_constraint_goal t = case Logic.strip_assums_concl t of\n      @{mpat \"Trueprop (CONSTRAINT _ _)\"} => true\n    | _ => false\n\n    val is_constraint_tac = COND' is_constraint_goal\n\n    fun is_slottable_constraint_goal t = case Logic.strip_assums_concl t of\n      @{mpat \"Trueprop (CONSTRAINT (CN_FALSE _) _)\"} => false\n    | @{mpat \"Trueprop (CONSTRAINT _ _)\"} => true\n    | _ => false\n\n    val slot_constraint_tac = COND' is_slottable_constraint_goal THEN' to_slot_tac\n\n    datatype 'a seq_cases = SC_NONE | SC_SINGLE of 'a Seq.seq | SC_MULTIPLE of 'a Seq.seq\n\n    fun seq_cases seq = \n      case Seq.pull seq of\n        NONE => SC_NONE\n      | SOME (st1,seq) => case Seq.pull seq of\n          NONE => SC_SINGLE (Seq.single st1)\n        | SOME (st2,seq) => SC_MULTIPLE (Seq.cons st1 (Seq.cons st2 seq))  \n\n    fun SEQ_CASES tac (single_tac, multiple_tac) st = let\n      val res = tac st\n    in\n      case seq_cases res of\n        SC_NONE => Seq.empty\n      | SC_SINGLE res => Seq.maps single_tac res\n      | SC_MULTIPLE res => Seq.maps multiple_tac res\n    end\n\n    fun SAFE tac = SEQ_CASES tac (all_tac, no_tac)\n    fun SAFE' tac = SAFE o tac\n\n    local\n      fun simp_constraints_tac ctxt = let\n        val ctxt = put_simpset HOL_basic_ss ctxt \n          addsimps (Named_Theorems.get ctxt @{named_theorems constraint_simps})\n      in\n        simp_tac ctxt\n      end\n\n      fun unfold_abbrevs_tac ctxt =  let\n        val ctxt = put_simpset HOL_basic_ss ctxt \n          addsimps (Named_Theorems.get ctxt @{named_theorems constraint_abbrevs})\n        val ethms = @{thms conjE}  \n        val ithms = @{thms conjI}  \n      in\n        full_simp_tac ctxt \n        THEN_ALL_NEW TRY o REPEAT_ALL_NEW (ematch_tac ctxt ethms)\n        THEN_ALL_NEW TRY o REPEAT_ALL_NEW (match_tac ctxt ithms)\n      end\n  \n      fun WITH_RULE_NETS tac ctxt = let\n        val scn_net = safe_constraint_rules.get ctxt |> Tactic.build_net\n        val cn_net = constraint_rules.get ctxt |> Tactic.build_net\n      in\n        tac (scn_net,cn_net) ctxt\n      end\n\n      fun wrap_tac step_tac ctxt = REPEAT_ALL_NEW (\n        simp_constraints_tac ctxt \n        THEN_ALL_NEW unfold_abbrevs_tac ctxt\n        THEN_ALL_NEW step_tac ctxt\n      )\n\n      fun solve_step_tac (scn_net,cn_net) ctxt = REPEAT_ALL_NEW (\n        DETERM o resolve_from_net_tac ctxt scn_net\n        ORELSE' resolve_from_net_tac ctxt cn_net\n      )\n\n      fun safe_step_tac (scn_net,cn_net) ctxt = REPEAT_ALL_NEW (\n        DETERM o resolve_from_net_tac ctxt scn_net\n        ORELSE' SAFE' (resolve_from_net_tac ctxt cn_net)\n      )\n\n      fun solve_tac cn_nets ctxt = SOLVED' (wrap_tac (solve_step_tac cn_nets) ctxt)\n      fun safe_tac cn_nets ctxt =  \n        simp_constraints_tac ctxt\n        THEN_ALL_NEW unfold_abbrevs_tac ctxt\n        THEN_ALL_NEW (solve_tac cn_nets ctxt ORELSE' TRY o wrap_tac (safe_step_tac cn_nets) ctxt)\n\n    in\n      val solve_constraint_tac = TRADE (fn ctxt =>\n        is_constraint_tac\n        THEN' resolve_tac ctxt @{thms CONSTRAINT_I}\n        THEN' WITH_RULE_NETS solve_tac ctxt)\n\n      val safe_constraint_tac = TRADE (fn ctxt =>\n        is_constraint_tac\n        THEN' resolve_tac ctxt @{thms CONSTRAINT_I}\n        THEN' WITH_RULE_NETS safe_tac ctxt\n        THEN_ALL_NEW fo_resolve_tac @{thms CONSTRAINT_D} ctxt) (* TODO/FIXME: fo_resolve_tac has non-canonical parameter order *)\n\n      val solve_constraint'_tac = TRADE (fn ctxt =>\n        TRY o resolve_tac ctxt @{thms CONSTRAINT_I}\n        THEN' WITH_RULE_NETS solve_tac ctxt)\n\n      val safe_constraint'_tac = TRADE (fn ctxt =>\n        TRY o resolve_tac ctxt @{thms CONSTRAINT_I}\n        THEN' WITH_RULE_NETS safe_tac ctxt)\n\n\n    end  \n\n    fun constraint_tac ctxt = \n      safe_constraint_tac ctxt THEN_ALL_NEW slot_constraint_tac\n\n    fun process_constraint_slot ctxt = ON_SLOT (ALLGOALS (TRY o safe_constraint_tac ctxt))\n\n    fun solve_constraint_slot ctxt = \n      cond_focus is_constraint_goal \n        THEN ALLGOALS (\n          COND' is_slot_goal\n          ORELSE' (\n            solve_constraint_tac ctxt\n            ORELSE' TRY o safe_constraint_tac ctxt\n          )\n        )\n      THEN unfocus_ins\n\n\n    val setup = I\n      #> constraint_rules.setup\n      #> safe_constraint_rules.setup\n\n  end\n\\<close>\n\nsetup Sepref_Constraints.setup\n\nmethod_setup print_slot = \\<open>Scan.succeed (fn ctxt => SIMPLE_METHOD (Sepref_Constraints.print_slot_tac ctxt))\\<close>\n\nmethod_setup solve_constraint = \\<open>Scan.succeed (fn ctxt => SIMPLE_METHOD' (Sepref_Constraints.solve_constraint'_tac ctxt))\\<close>\nmethod_setup safe_constraint = \\<open>Scan.succeed (fn ctxt => SIMPLE_METHOD' (Sepref_Constraints.safe_constraint'_tac ctxt))\\<close>\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Refine_Imperative_HOL/Sepref_Constraints.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5544704796847395, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3052955300862754}}
{"text": "(*  Title:      HOL/Auth/Guard/Analz.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2001  University of Cambridge\n*)\n\nsection\\<open>Decomposition of Analz into two parts\\<close>\n\ntheory Analz imports Extensions begin\n\ntext\\<open>decomposition of \\<^term>\\<open>analz\\<close> into two parts: \n      \\<^term>\\<open>pparts\\<close> (for pairs) and analz of \\<^term>\\<open>kparts\\<close>\\<close>\n\nsubsection\\<open>messages that do not contribute to analz\\<close>\n\ninductive_set\n  pparts :: \"msg set => msg set\"\n  for H :: \"msg set\"\nwhere\n  Inj [intro]: \"\\<lbrakk>X \\<in> H; is_MPair X\\<rbrakk> \\<Longrightarrow> X \\<in> pparts H\"\n| Fst [dest]: \"\\<lbrakk>\\<lbrace>X,Y\\<rbrace> \\<in> pparts H; is_MPair X\\<rbrakk> \\<Longrightarrow> X \\<in> pparts H\"\n| Snd [dest]: \"\\<lbrakk>\\<lbrace>X,Y\\<rbrace> \\<in> pparts H; is_MPair Y\\<rbrakk> \\<Longrightarrow> Y \\<in> pparts H\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>pparts\\<close>\\<close>\n\nlemma pparts_is_MPair [dest]: \"X \\<in> pparts H \\<Longrightarrow> is_MPair X\"\nby (erule pparts.induct, auto)\n\nlemma Crypt_notin_pparts [iff]: \"Crypt K X \\<notin> pparts H\"\nby auto\n\nlemma Key_notin_pparts [iff]: \"Key K \\<notin> pparts H\"\nby auto\n\nlemma Nonce_notin_pparts [iff]: \"Nonce n \\<notin> pparts H\"\nby auto\n\nlemma Number_notin_pparts [iff]: \"Number n \\<notin> pparts H\"\nby auto\n\nlemma Agent_notin_pparts [iff]: \"Agent A \\<notin> pparts H\"\nby auto\n\nlemma pparts_empty [iff]: \"pparts {} = {}\"\nby (auto, erule pparts.induct, auto)\n\nlemma pparts_insertI [intro]: \"X \\<in> pparts H \\<Longrightarrow> X \\<in> pparts (insert Y H)\"\nby (erule pparts.induct, auto)\n\nlemma pparts_sub: \"\\<lbrakk>X \\<in> pparts G; G \\<subseteq> H\\<rbrakk> \\<Longrightarrow> X \\<in> pparts H\"\nby (erule pparts.induct, auto)\n\nlemma pparts_insert2 [iff]: \"pparts (insert X (insert Y H))\n= pparts {X} Un pparts {Y} Un pparts H\"\nby (rule eq, (erule pparts.induct, auto)+)\n\nlemma pparts_insert_MPair [iff]: \"pparts (insert \\<lbrace>X,Y\\<rbrace> H)\n= insert \\<lbrace>X,Y\\<rbrace> (pparts ({X,Y} \\<union> H))\"\napply (rule eq, (erule pparts.induct, auto)+)\napply (rule_tac Y=Y in pparts.Fst, auto)\napply (erule pparts.induct, auto)\nby (rule_tac X=X in pparts.Snd, auto)\n\nlemma pparts_insert_Nonce [iff]: \"pparts (insert (Nonce n) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_Crypt [iff]: \"pparts (insert (Crypt K X) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_Key [iff]: \"pparts (insert (Key K) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_Agent [iff]: \"pparts (insert (Agent A) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_Number [iff]: \"pparts (insert (Number n) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_Hash [iff]: \"pparts (insert (Hash X) H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert: \"X \\<in> pparts (insert Y H) \\<Longrightarrow> X \\<in> pparts {Y} \\<union> pparts H\"\nby (erule pparts.induct, blast+)\n\nlemma insert_pparts: \"X \\<in> pparts {Y} \\<union> pparts H \\<Longrightarrow> X \\<in> pparts (insert Y H)\"\nby (safe, erule pparts.induct, auto)\n\nlemma pparts_Un [iff]: \"pparts (G \\<union> H) = pparts G \\<union> pparts H\"\nby (rule eq, erule pparts.induct, auto dest: pparts_sub)\n\nlemma pparts_pparts [iff]: \"pparts (pparts H) = pparts H\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma pparts_insert_eq: \"pparts (insert X H) = pparts {X} Un pparts H\"\nby (rule_tac A=H in insert_Un, rule pparts_Un)\n\nlemmas pparts_insert_substI = pparts_insert_eq [THEN ssubst]\n\nlemma in_pparts: \"Y \\<in> pparts H \\<Longrightarrow> \\<exists>X. X \\<in> H \\<and> Y \\<in> pparts {X}\"\nby (erule pparts.induct, auto)\n\nsubsection\\<open>facts about \\<^term>\\<open>pparts\\<close> and \\<^term>\\<open>parts\\<close>\\<close>\n\nlemma pparts_no_Nonce [dest]: \"\\<lbrakk>X \\<in> pparts {Y}; Nonce n \\<notin> parts {Y}\\<rbrakk>\n\\<Longrightarrow> Nonce n \\<notin> parts {X}\"\nby (erule pparts.induct, simp_all)\n\nsubsection\\<open>facts about \\<^term>\\<open>pparts\\<close> and \\<^term>\\<open>analz\\<close>\\<close>\n\nlemma pparts_analz: \"X \\<in> pparts H \\<Longrightarrow> X \\<in> analz H\"\nby (erule pparts.induct, auto)\n\nlemma pparts_analz_sub: \"\\<lbrakk>X \\<in> pparts G; G \\<subseteq> H\\<rbrakk> \\<Longrightarrow> X \\<in> analz H\"\nby (auto dest: pparts_sub pparts_analz)\n\nsubsection\\<open>messages that contribute to analz\\<close>\n\ninductive_set\n  kparts :: \"msg set => msg set\"\n  for H :: \"msg set\"\nwhere\n  Inj [intro]: \"\\<lbrakk>X \\<in> H; not_MPair X\\<rbrakk> \\<Longrightarrow> X \\<in> kparts H\"\n| Fst [intro]: \"\\<lbrakk>\\<lbrace>X,Y\\<rbrace> \\<in> pparts H; not_MPair X\\<rbrakk> \\<Longrightarrow> X \\<in> kparts H\"\n| Snd [intro]: \"\\<lbrakk>\\<lbrace>X,Y\\<rbrace> \\<in> pparts H; not_MPair Y\\<rbrakk> \\<Longrightarrow> Y \\<in> kparts H\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>kparts\\<close>\\<close>\n\nlemma kparts_not_MPair [dest]: \"X \\<in> kparts H \\<Longrightarrow> not_MPair X\"\nby (erule kparts.induct, auto)\n\nlemma kparts_empty [iff]: \"kparts {} = {}\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insertI [intro]: \"X \\<in> kparts H \\<Longrightarrow> X \\<in> kparts (insert Y H)\"\nby (erule kparts.induct, auto dest: pparts_insertI)\n\nlemma kparts_insert2 [iff]: \"kparts (insert X (insert Y H))\n= kparts {X} \\<union> kparts {Y} \\<union> kparts H\"\nby (rule eq, (erule kparts.induct, auto)+)\n\nlemma kparts_insert_MPair [iff]: \"kparts (insert \\<lbrace>X,Y\\<rbrace> H)\n= kparts ({X,Y} \\<union> H)\"\nby (rule eq, (erule kparts.induct, auto)+)\n\nlemma kparts_insert_Nonce [iff]: \"kparts (insert (Nonce n) H)\n= insert (Nonce n) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_Crypt [iff]: \"kparts (insert (Crypt K X) H)\n= insert (Crypt K X) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_Key [iff]: \"kparts (insert (Key K) H)\n= insert (Key K) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_Agent [iff]: \"kparts (insert (Agent A) H)\n= insert (Agent A) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_Number [iff]: \"kparts (insert (Number n) H)\n= insert (Number n) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_Hash [iff]: \"kparts (insert (Hash X) H)\n= insert (Hash X) (kparts H)\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert: \"X \\<in> kparts (insert X H) \\<Longrightarrow> X \\<in> kparts {X} \\<union> kparts H\"\nby (erule kparts.induct, (blast dest: pparts_insert)+)\n\nlemma kparts_insert_fst [rule_format,dest]: \"X \\<in> kparts (insert Z H) \\<Longrightarrow>\nX \\<notin> kparts H \\<longrightarrow> X \\<in> kparts {Z}\"\nby (erule kparts.induct, (blast dest: pparts_insert)+)\n\nlemma kparts_sub: \"\\<lbrakk>X \\<in> kparts G; G \\<subseteq> H\\<rbrakk> \\<Longrightarrow> X \\<in> kparts H\"\nby (erule kparts.induct, auto dest: pparts_sub)\n\nlemma kparts_Un [iff]: \"kparts (G \\<union> H) = kparts G \\<union> kparts H\"\nby (rule eq, erule kparts.induct, auto dest: kparts_sub)\n\nlemma pparts_kparts [iff]: \"pparts (kparts H) = {}\"\nby (rule eq, erule pparts.induct, auto)\n\nlemma kparts_kparts [iff]: \"kparts (kparts H) = kparts H\"\nby (rule eq, erule kparts.induct, auto)\n\nlemma kparts_insert_eq: \"kparts (insert X H) = kparts {X} \\<union> kparts H\"\nby (rule_tac A=H in insert_Un, rule kparts_Un)\n\nlemmas kparts_insert_substI = kparts_insert_eq [THEN ssubst]\n\nlemma in_kparts: \"Y \\<in> kparts H \\<Longrightarrow> \\<exists>X. X \\<in> H \\<and> Y \\<in> kparts {X}\"\nby (erule kparts.induct, auto dest: in_pparts)\n\nlemma kparts_has_no_pair [iff]: \"has_no_pair (kparts H)\"\nby auto\n\nsubsection\\<open>facts about \\<^term>\\<open>kparts\\<close> and \\<^term>\\<open>parts\\<close>\\<close>\n\nlemma kparts_no_Nonce [dest]: \"\\<lbrakk>X \\<in> kparts {Y}; Nonce n \\<notin> parts {Y}\\<rbrakk>\n\\<Longrightarrow> Nonce n \\<notin> parts {X}\"\nby (erule kparts.induct, auto)\n\nlemma kparts_parts: \"X \\<in> kparts H \\<Longrightarrow> X \\<in> parts H\"\nby (erule kparts.induct, auto dest: pparts_analz)\n\nlemma parts_kparts: \"X \\<in> parts (kparts H) \\<Longrightarrow> X \\<in> parts H\"\nby (erule parts.induct, auto dest: kparts_parts\nintro: parts.Fst parts.Snd parts.Body)\n\nlemma Crypt_kparts_Nonce_parts [dest]: \"\\<lbrakk>Crypt K Y \\<in> kparts {Z};\nNonce n \\<in> parts {Y}\\<rbrakk> \\<Longrightarrow> Nonce n \\<in> parts {Z}\"\nby auto\n\nsubsection\\<open>facts about \\<^term>\\<open>kparts\\<close> and \\<^term>\\<open>analz\\<close>\\<close>\n\nlemma kparts_analz: \"X \\<in> kparts H \\<Longrightarrow> X \\<in> analz H\"\nby (erule kparts.induct, auto dest: pparts_analz)\n\nlemma kparts_analz_sub: \"\\<lbrakk>X \\<in> kparts G; G \\<subseteq> H\\<rbrakk> \\<Longrightarrow> X \\<in> analz H\"\nby (erule kparts.induct, auto dest: pparts_analz_sub)\n\nlemma analz_kparts [rule_format,dest]: \"X \\<in> analz H \\<Longrightarrow>\nY \\<in> kparts {X} \\<longrightarrow> Y \\<in> analz H\"\nby (erule analz.induct, auto dest: kparts_analz_sub)\n\nlemma analz_kparts_analz: \"X \\<in> analz (kparts H) \\<Longrightarrow> X \\<in> analz H\"\nby (erule analz.induct, auto dest: kparts_analz)\n\nlemma analz_kparts_insert: \"X \\<in> analz (kparts (insert Z H)) \\<Longrightarrow> X \\<in> analz (kparts {Z} \\<union> kparts H)\"\nby (rule analz_sub, auto)\n\nlemma Nonce_kparts_synth [rule_format]: \"Y \\<in> synth (analz G)\n\\<Longrightarrow> Nonce n \\<in> kparts {Y} \\<longrightarrow> Nonce n \\<in> analz G\"\nby (erule synth.induct, auto)\n\nlemma kparts_insert_synth: \"\\<lbrakk>Y \\<in> parts (insert X G); X \\<in> synth (analz G);\nNonce n \\<in> kparts {Y}; Nonce n \\<notin> analz G\\<rbrakk> \\<Longrightarrow> Y \\<in> parts G\"\napply (drule parts_insert_substD, clarify)\napply (drule in_sub, drule_tac X=Y in parts_sub, simp)\napply (auto dest: Nonce_kparts_synth)\ndone\n\nlemma Crypt_insert_synth:\n  \"\\<lbrakk>Crypt K Y \\<in> parts (insert X G); X \\<in> synth (analz G); Nonce n \\<in> kparts {Y}; Nonce n \\<notin> analz G\\<rbrakk> \n   \\<Longrightarrow> Crypt K Y \\<in> parts G\"\nby (metis Fake_parts_insert_in_Un Nonce_kparts_synth UnE analz_conj_parts synth_simps(5))\n\n\nsubsection\\<open>analz is pparts + analz of kparts\\<close>\n\nlemma analz_pparts_kparts: \"X \\<in> analz H \\<Longrightarrow> X \\<in> pparts H \\<or> X \\<in> analz (kparts H)\"\nby (erule analz.induct, auto) \n\nlemma analz_pparts_kparts_eq: \"analz H = pparts H Un analz (kparts H)\"\nby (rule eq, auto dest: analz_pparts_kparts pparts_analz analz_kparts_analz)\n\nlemmas analz_pparts_kparts_substI = analz_pparts_kparts_eq [THEN ssubst]\nlemmas analz_pparts_kparts_substD = analz_pparts_kparts_eq [THEN sym, THEN ssubst]\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/Guard/Analz.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704502361149, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3052955138716458}}
{"text": " ;;; -*- syntax: common-lisp; package: KEIM; base: 10; mode: LISP -*-\n;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;\n;;                                                                          ;;\n;;   Copyright (C) 1993 by AG Siekmann, Fachbereich Informatik,             ;;\n;;   Universitaet des Saarlandes, Saarbruecken, Germany.                    ;;\n;;   All rights reserved.                                                   ;;\n;;   For information about this program, write to:                          ;;\n;;     KEIM Project                                                         ;;\n;;     AG Siekmann/FB Informatik                                            ;;\n;;     Universitaet des Saarlandes                                          ;;\n;;     Postfach 1150                                                        ;;\n;;     D-66041 Saarbruecken                                                 ;;\n;;     Germany                                                              ;;\n;;   electronic mail: keim@cs.uni-sb.de                                     ;;\n;;                                                                          ;;\n;;   The author makes no representations about the suitability of this      ;;\n;;   software for any purpose.  It is provided \"AS IS\" without express or   ;;\n;;   implied warranty.  In particular, it must be understood that this      ;;\n;;   software is an experimental version, and is not suitable for use in    ;;\n;;   any safety-critical application, and the author denies a license for   ;;\n;;   such use.                                                              ;;\n;;                                                                          ;;\n;;   You may use, copy, modify and distribute this software for any         ;;\n;;   noncommercial and non-safety-critical purpose.  Use of this software   ;;\n;;   in a commercial product is not included under this license.  You must  ;;\n;;   maintain this copyright statement in all copies of this software that  ;;\n;;   you modify or distribute.                                              ;;\n;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;\n(in-package :omega)\n\n(th~defproblem boolos-curious-inference\n  (in boolos)\n  (assumption a1 (forall (lam (n i) (= (f n one) (s one)))))\n  (assumption a2 \n    (forall (lam (x i) (= (f one (s x)) (s (s (f one x)))))))\n  (assumption a3 \n    (forall (lam (n i) \n      (forall (lam (x i) (= (f (s n) (s x)) (f n (f (s n) x))))))))\n  (assumption a4 (D one))\n  (assumption a5 (forall (lam (x i) (implies (D x) (D (s x))))))\n  (conclusion conc (D (f (s (s (s (s one)))) (s (s (s (s one))))))))\n\n\n;;;; The following Lemmata are prposed by Boolos\n\n;; lemma conc (N one)\n;; lemma conc (forall (lam (y i) (implies (N y) (N (s y)))))\n;; lemma conc (N (s (s (s (s one)))))\n;; lemma conc (E one)\n;; lemma conc (forall (lam (y i) (implies (E y) (E (s y)))))\n;; lemma conc (E (s one))\n\n\n;; lemma conc (forall (lam (nn i) (implies (N nn) (forall (lam (x i) (implies (N x) (E (f nn x))))))))\n;; -> lemma ?? (M one)\n;; -> -> lemma ?? (forall (lam (x i) (implies (N x) (Q x)))) \n;; -> -> -> lemma ?? (Q one)\n;; -> -> -> lemma ?? (forall (lam (x i) (implies (Q x) (Q (s x)))))\n;; -> lemma ?? (forall (lam (y i) (implies (M y) (M (s y)))))\n;; -> -> lemma ?? (forall (lam (x i) (implies (N x) (P x)))) \n;; -> -> -> lemma ?? (P one)\n;; -> -> -> lemma ?? (forall (lam (x i) (implies (P x) (P (s x)))))\n", "meta": {"author": "theoremprover-museum", "repo": "OMEGA", "sha": "b95b25f8bb16847a2e18d106510446a175f7145a", "save_path": "github-repos/isabelle/theoremprover-museum-OMEGA", "path": "github-repos/isabelle/theoremprover-museum-OMEGA/OMEGA-b95b25f8bb16847a2e18d106510446a175f7145a/theories/boolos/boolos-problems.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381667555713, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.3052586773330708}}
{"text": "(*  Title:      HOL/TLA/Memory/MemoryImplementation.thy\n    Author:     Stephan Merz, University of Munich\n*)\n\nsection \\<open>RPC-Memory example: Memory implementation\\<close>\n\ntheory MemoryImplementation\nimports Memory RPC MemClerk\nbegin\n\ndatatype histState = histA | histB\n\ntype_synonym histType = \"(PrIds \\<Rightarrow> histState) stfun\"  (* the type of the history variable *)\n\nconsts\n  (* the specification *)\n     (* channel (external) *)\n  memCh         :: \"memChType\"\n     (* internal variables *)\n  mm            :: \"memType\"\n\n  (* the state variables of the implementation *)\n     (* channels *)\n  (* same interface channel memCh *)\n  crCh          :: \"rpcSndChType\"\n  rmCh          :: \"rpcRcvChType\"\n     (* internal variables *)\n  (* identity refinement mapping for mm -- simply reused *)\n  rst           :: \"rpcStType\"\n  cst           :: \"mClkStType\"\n  ires          :: \"resType\"\n\ndefinition\n  (* auxiliary predicates *)\n  MVOKBARF      :: \"Vals \\<Rightarrow> bool\"\n  where \"MVOKBARF v \\<longleftrightarrow> (v : MemVal) | (v = OK) | (v = BadArg) | (v = RPCFailure)\"\n\ndefinition\n  MVOKBA        :: \"Vals \\<Rightarrow> bool\"\n  where \"MVOKBA v \\<longleftrightarrow> (v : MemVal) | (v = OK) | (v = BadArg)\"\n\ndefinition\n  MVNROKBA      :: \"Vals \\<Rightarrow> bool\"\n  where \"MVNROKBA v \\<longleftrightarrow> (v : MemVal) | (v = NotAResult) | (v = OK) | (v = BadArg)\"\n\ndefinition\n  (* tuples of state functions changed by the various components *)\n  e             :: \"PrIds => (bit * memOp) stfun\"\n  where \"e p = PRED (caller memCh!p)\"\n\ndefinition\n  c             :: \"PrIds \\<Rightarrow> (mClkState * (bit * Vals) * (bit * rpcOp)) stfun\"\n  where \"c p = PRED (cst!p, rtrner memCh!p, caller crCh!p)\"\n\ndefinition\n  r             :: \"PrIds \\<Rightarrow> (rpcState * (bit * Vals) * (bit * memOp)) stfun\"\n  where \"r p = PRED (rst!p, rtrner crCh!p, caller rmCh!p)\"\n\ndefinition\n  m             :: \"PrIds \\<Rightarrow> ((bit * Vals) * Vals) stfun\"\n  where \"m p = PRED (rtrner rmCh!p, ires!p)\"\n\ndefinition\n  (* the environment action *)\n  ENext         :: \"PrIds \\<Rightarrow> action\"\n  where \"ENext p = ACT (\\<exists>l. #l \\<in> #MemLoc \\<and> Call memCh p #(read l))\"\n\n\ndefinition\n  (* specification of the history variable *)\n  HInit         :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"HInit rmhist p = PRED rmhist!p = #histA\"\n\ndefinition\n  HNext         :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> action\"\n  where \"HNext rmhist p = ACT (rmhist!p)$ =\n                     (if (MemReturn rmCh ires p \\<or> RPCFail crCh rmCh rst p)\n                      then #histB\n                      else if (MClkReply memCh crCh cst p)\n                           then #histA\n                           else $(rmhist!p))\"\n\ndefinition\n  HistP         :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> temporal\"\n  where \"HistP rmhist p = (TEMP Init HInit rmhist p\n                           \\<and> \\<box>[HNext rmhist p]_(c p,r p,m p, rmhist!p))\"\n\ndefinition\n  Hist          :: \"histType \\<Rightarrow> temporal\"\n  where \"Hist rmhist = TEMP (\\<forall>p. HistP rmhist p)\"\n\ndefinition\n  (* the implementation *)\n  IPImp          :: \"PrIds \\<Rightarrow> temporal\"\n  where \"IPImp p = (TEMP (  Init \\<not>Calling memCh p \\<and> \\<box>[ENext p]_(e p)\n                       \\<and> MClkIPSpec memCh crCh cst p\n                       \\<and> RPCIPSpec crCh rmCh rst p\n                       \\<and> RPSpec rmCh mm ires p\n                       \\<and> (\\<forall>l. #l \\<in> #MemLoc \\<longrightarrow> MSpec rmCh mm ires l)))\"\n\ndefinition\n  ImpInit        :: \"PrIds \\<Rightarrow> stpred\"\n  where \"ImpInit p = PRED (  \\<not>Calling memCh p\n                          \\<and> MClkInit crCh cst p\n                          \\<and> RPCInit rmCh rst p\n                          \\<and> PInit ires p)\"\n\ndefinition\n  ImpNext        :: \"PrIds \\<Rightarrow> action\"\n  where \"ImpNext p = (ACT  [ENext p]_(e p)\n                       \\<and> [MClkNext memCh crCh cst p]_(c p)\n                       \\<and> [RPCNext crCh rmCh rst p]_(r p)\n                       \\<and> [RNext rmCh mm ires p]_(m p))\"\n\ndefinition\n  ImpLive        :: \"PrIds \\<Rightarrow> temporal\"\n  where \"ImpLive p = (TEMP  WF(MClkFwd memCh crCh cst p)_(c p)\n                        \\<and> SF(MClkReply memCh crCh cst p)_(c p)\n                        \\<and> WF(RPCNext crCh rmCh rst p)_(r p)\n                        \\<and> WF(RNext rmCh mm ires p)_(m p)\n                        \\<and> WF(MemReturn rmCh ires p)_(m p))\"\n\ndefinition\n  Implementation :: \"temporal\"\n  where \"Implementation = (TEMP ( (\\<forall>p. Init (\\<not>Calling memCh p) \\<and> \\<box>[ENext p]_(e p))\n                               \\<and> MClkISpec memCh crCh cst\n                               \\<and> RPCISpec crCh rmCh rst\n                               \\<and> IRSpec rmCh mm ires))\"\n\ndefinition\n  (* the predicate S describes the states of the implementation.\n     slight simplification: two \"histState\" parameters instead of a\n     (one- or two-element) set.\n     NB: The second conjunct of the definition in the paper is taken care of by\n     the type definitions. The last conjunct is asserted separately as the memory\n     invariant MemInv, proved in Memory.thy. *)\n  S :: \"histType \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> bool \\<Rightarrow> mClkState \\<Rightarrow> rpcState \\<Rightarrow> histState \\<Rightarrow> histState \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S rmhist ecalling ccalling rcalling cs rs hs1 hs2 p = (PRED\n                Calling memCh p = #ecalling\n              \\<and> Calling crCh p  = #ccalling\n              \\<and> (#ccalling \\<longrightarrow> arg<crCh!p> = MClkRelayArg<arg<memCh!p>>)\n              \\<and> (\\<not> #ccalling \\<and> cst!p = #clkB \\<longrightarrow> MVOKBARF<res<crCh!p>>)\n              \\<and> Calling rmCh p  = #rcalling\n              \\<and> (#rcalling \\<longrightarrow> arg<rmCh!p> = RPCRelayArg<arg<crCh!p>>)\n              \\<and> (\\<not> #rcalling \\<longrightarrow> ires!p = #NotAResult)\n              \\<and> (\\<not> #rcalling \\<and> rst!p = #rpcB \\<longrightarrow> MVOKBA<res<rmCh!p>>)\n              \\<and> cst!p = #cs\n              \\<and> rst!p = #rs\n              \\<and> (rmhist!p = #hs1 \\<or> rmhist!p = #hs2)\n              \\<and> MVNROKBA<ires!p>)\"\n\ndefinition\n  (* predicates S1 -- S6 define special instances of S *)\n  S1            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S1 rmhist p = S rmhist False False False clkA rpcA histA histA p\"\n\ndefinition\n  S2            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S2 rmhist p = S rmhist True False False clkA rpcA histA histA p\"\n\ndefinition\n  S3            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S3 rmhist p = S rmhist True True False clkB rpcA histA histB p\"\n\ndefinition\n  S4            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S4 rmhist p = S rmhist True True True clkB rpcB histA histB p\"\n\ndefinition\n  S5            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S5 rmhist p = S rmhist True True False clkB rpcB histB histB p\"\n\ndefinition\n  S6            :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"S6 rmhist p = S rmhist True False False clkB rpcA histB histB p\"\n\ndefinition\n  (* The invariant asserts that the system is always in one of S1 - S6, for every p *)\n  ImpInv         :: \"histType \\<Rightarrow> PrIds \\<Rightarrow> stpred\"\n  where \"ImpInv rmhist p = (PRED (S1 rmhist p \\<or> S2 rmhist p \\<or> S3 rmhist p\n                                \\<or> S4 rmhist p \\<or> S5 rmhist p \\<or> S6 rmhist p))\"\n\ndefinition\n  resbar        :: \"histType \\<Rightarrow> resType\"        (* refinement mapping *)\n  where\"resbar rmhist s p =\n                  (if (S1 rmhist p s | S2 rmhist p s)\n                   then ires s p\n                   else if S3 rmhist p s\n                   then if rmhist s p = histA\n                        then ires s p else MemFailure\n                   else if S4 rmhist p s\n                   then if (rmhist s p = histB & ires s p = NotAResult)\n                        then MemFailure else ires s p\n                   else if S5 rmhist p s\n                   then res (rmCh s p)\n                   else if S6 rmhist p s\n                   then if res (crCh s p) = RPCFailure\n                        then MemFailure else res (crCh s p)\n                   else NotAResult)\" (* dummy value *)\n\naxiomatization where\n  (* the \"base\" variables: everything except resbar and hist (for any index) *)\n  MI_base:       \"basevars (caller memCh!p,\n                           (rtrner memCh!p, caller crCh!p, cst!p),\n                           (rtrner crCh!p, caller rmCh!p, rst!p),\n                           (mm!l, rtrner rmCh!p, ires!p))\"\n\n(*\n    The main theorem is theorem \"Implementation\" at the end of this file,\n    which shows that the composition of a reliable memory, an RPC component, and\n    a memory clerk implements an unreliable memory. The files \"MIsafe.thy\" and\n    \"MIlive.thy\" contain lower-level lemmas for the safety and liveness parts.\n\n    Steps are (roughly) numbered as in the hand proof.\n*)\n\n(* --------------------------- automatic prover --------------------------- *)\n\ndeclare if_weak_cong [cong del]\n\n(* A more aggressive variant that tries to solve subgoals by assumption\n   or contradiction during the simplification.\n   THIS IS UNSAFE, BECAUSE IT DOESN'T RECORD THE CHOICES!!\n   (but it can be a lot faster than the default setup)\n*)\nML \\<open>\n  val config_fast_solver = Attrib.setup_config_bool @{binding fast_solver} (K false);\n  val fast_solver = mk_solver \"fast_solver\" (fn ctxt =>\n    if Config.get ctxt config_fast_solver\n    then assume_tac ctxt ORELSE' (eresolve_tac ctxt [notE])\n    else K no_tac);\n\\<close>\n\nsetup \\<open>map_theory_simpset (fn ctxt => ctxt addSSolver fast_solver)\\<close>\n\nML \\<open>val temp_elim = make_elim oo temp_use\\<close>\n\n\n\n(****************************** The history variable ******************************)\n\nsection \"History variable\"\n\nlemma HistoryLemma: \"\\<turnstile> Init(\\<forall>p. ImpInit p) \\<and> \\<box>(\\<forall>p. ImpNext p)\n         \\<longrightarrow> (\\<exists>\\<exists>rmhist. Init(\\<forall>p. HInit rmhist p)\n                          \\<and> \\<box>(\\<forall>p. [HNext rmhist p]_(c p, r p, m p, rmhist!p)))\"\n  apply clarsimp\n  apply (rule historyI)\n      apply assumption+\n  apply (rule MI_base)\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm HInit_def}]) [] [] 1\\<close>)\n   apply (erule fun_cong)\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm HNext_def}])\n    [@{thm busy_squareI}] [] 1\\<close>)\n  apply (erule fun_cong)\n  done\n\nlemma History: \"\\<turnstile> Implementation \\<longrightarrow> (\\<exists>\\<exists>rmhist. Hist rmhist)\"\n  apply clarsimp\n  apply (rule HistoryLemma [temp_use, THEN eex_mono])\n    prefer 3\n    apply (force simp: Hist_def HistP_def Init_def all_box [try_rewrite]\n      split_box_conj [try_rewrite])\n   apply (auto simp: Implementation_def MClkISpec_def RPCISpec_def\n     IRSpec_def MClkIPSpec_def RPCIPSpec_def RPSpec_def ImpInit_def\n     Init_def ImpNext_def c_def r_def m_def all_box [temp_use] split_box_conj [temp_use])\n  done\n\n(******************************** The safety part *********************************)\n\nsection \"The safety part\"\n\n(* ------------------------- Include lower-level lemmas ------------------------- *)\n\n(* RPCFailure notin MemVals U {OK,BadArg} *)\n\nlemma MVOKBAnotRF: \"MVOKBA x \\<Longrightarrow> x \\<noteq> RPCFailure\"\n  apply (unfold MVOKBA_def)\n  apply auto\n  done\n\n(* NotAResult notin MemVals U {OK,BadArg,RPCFailure} *)\n\nlemma MVOKBARFnotNR: \"MVOKBARF x \\<Longrightarrow> x \\<noteq> NotAResult\"\n  apply (unfold MVOKBARF_def)\n  apply auto\n  done\n\n(* ================ Si's are mutually exclusive ================================ *)\n(* Si and Sj are mutually exclusive for i # j. This helps to simplify the big\n   conditional in the definition of resbar when doing the step-simulation proof.\n   We prove a weaker result, which suffices for our purposes:\n   Si implies (not Sj), for j<i.\n*)\n\n(* --- not used ---\nlemma S1_excl: \"\\<turnstile> S1 rmhist p \\<longrightarrow> S1 rmhist p & \\<not>S2 rmhist p & \\<not>S3 rmhist p &\n    \\<not>S4 rmhist p & \\<not>S5 rmhist p & \\<not>S6 rmhist p\"\n  by (auto simp: S_def S1_def S2_def S3_def S4_def S5_def S6_def)\n*)\n\nlemma S2_excl: \"\\<turnstile> S2 rmhist p \\<longrightarrow> S2 rmhist p \\<and> \\<not>S1 rmhist p\"\n  by (auto simp: S_def S1_def S2_def)\n\nlemma S3_excl: \"\\<turnstile> S3 rmhist p \\<longrightarrow> S3 rmhist p \\<and> \\<not>S1 rmhist p \\<and> \\<not>S2 rmhist p\"\n  by (auto simp: S_def S1_def S2_def S3_def)\n\nlemma S4_excl: \"\\<turnstile> S4 rmhist p \\<longrightarrow> S4 rmhist p \\<and> \\<not>S1 rmhist p \\<and> \\<not>S2 rmhist p \\<and> \\<not>S3 rmhist p\"\n  by (auto simp: S_def S1_def S2_def S3_def S4_def)\n\nlemma S5_excl: \"\\<turnstile> S5 rmhist p \\<longrightarrow> S5 rmhist p \\<and> \\<not>S1 rmhist p \\<and> \\<not>S2 rmhist p\n                         \\<and> \\<not>S3 rmhist p \\<and> \\<not>S4 rmhist p\"\n  by (auto simp: S_def S1_def S2_def S3_def S4_def S5_def)\n\nlemma S6_excl: \"\\<turnstile> S6 rmhist p \\<longrightarrow> S6 rmhist p \\<and> \\<not>S1 rmhist p \\<and> \\<not>S2 rmhist p\n                         \\<and> \\<not>S3 rmhist p \\<and> \\<not>S4 rmhist p \\<and> \\<not>S5 rmhist p\"\n  by (auto simp: S_def S1_def S2_def S3_def S4_def S5_def S6_def)\n\n\n(* ==================== Lemmas about the environment ============================== *)\n\nlemma Envbusy: \"\\<turnstile> $(Calling memCh p) \\<longrightarrow> \\<not>ENext p\"\n  by (auto simp: ENext_def ACall_def)\n\n(* ==================== Lemmas about the implementation's states ==================== *)\n\n(* The following series of lemmas are used in establishing the implementation's\n   next-state relation (Step 1.2 of the proof in the paper). For each state Si, we\n   determine which component actions are possible and what state they result in.\n*)\n\n(* ------------------------------ State S1 ---------------------------------------- *)\n\nlemma S1Env: \"\\<turnstile> ENext p \\<and> $(S1 rmhist p) \\<and> unchanged (c p, r p, m p, rmhist!p)\n         \\<longrightarrow> (S2 rmhist p)$\"\n  by (force simp: ENext_def ACall_def c_def r_def m_def\n    caller_def rtrner_def MVNROKBA_def S_def S1_def S2_def Calling_def)\n\nlemma S1ClerkUnch: \"\\<turnstile> [MClkNext memCh crCh cst p]_(c p) \\<and> $(S1 rmhist p) \\<longrightarrow> unchanged (c p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] dest!: MClkidle [temp_use] simp: S_def S1_def)\n\nlemma S1RPCUnch: \"\\<turnstile> [RPCNext crCh rmCh rst p]_(r p) \\<and> $(S1 rmhist p) \\<longrightarrow> unchanged (r p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] dest!: RPCidle [temp_use] simp: S_def S1_def)\n\nlemma S1MemUnch: \"\\<turnstile> [RNext rmCh mm ires p]_(m p) \\<and> $(S1 rmhist p) \\<longrightarrow> unchanged (m p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] dest!: Memoryidle [temp_use] simp: S_def S1_def)\n\nlemma S1Hist: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p,rmhist!p) \\<and> $(S1 rmhist p)\n         \\<longrightarrow> unchanged (rmhist!p)\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm HNext_def}, @{thm S_def},\n    @{thm S1_def}, @{thm MemReturn_def}, @{thm RPCFail_def}, @{thm MClkReply_def},\n    @{thm AReturn_def}]) [] [temp_use @{context} @{thm squareE}] 1\\<close>)\n\n\n(* ------------------------------ State S2 ---------------------------------------- *)\n\nlemma S2EnvUnch: \"\\<turnstile> [ENext p]_(e p) \\<and> $(S2 rmhist p) \\<longrightarrow> unchanged (e p)\"\n  by (auto dest!: Envbusy [temp_use] simp: S_def S2_def)\n\nlemma S2Clerk: \"\\<turnstile> MClkNext memCh crCh cst p \\<and> $(S2 rmhist p) \\<longrightarrow> MClkFwd memCh crCh cst p\"\n  by (auto simp: MClkNext_def MClkRetry_def MClkReply_def S_def S2_def)\n\nlemma S2Forward: \"\\<turnstile> $(S2 rmhist p) \\<and> MClkFwd memCh crCh cst p\n         \\<and> unchanged (e p, r p, m p, rmhist!p)\n         \\<longrightarrow> (S3 rmhist p)$\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm MClkFwd_def},\n    @{thm ACall_def}, @{thm e_def}, @{thm r_def}, @{thm m_def}, @{thm caller_def},\n    @{thm rtrner_def}, @{thm S_def}, @{thm S2_def}, @{thm S3_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S2RPCUnch: \"\\<turnstile> [RPCNext crCh rmCh rst p]_(r p) \\<and> $(S2 rmhist p) \\<longrightarrow> unchanged (r p)\"\n  by (auto simp: S_def S2_def dest!: RPCidle [temp_use])\n\nlemma S2MemUnch: \"\\<turnstile> [RNext rmCh mm ires p]_(m p) \\<and> $(S2 rmhist p) \\<longrightarrow> unchanged (m p)\"\n  by (auto simp: S_def S2_def dest!: Memoryidle [temp_use])\n\nlemma S2Hist: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p,rmhist!p) \\<and> $(S2 rmhist p)\n         \\<longrightarrow> unchanged (rmhist!p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] simp: HNext_def MemReturn_def RPCFail_def\n    MClkReply_def AReturn_def S_def S2_def)\n\n(* ------------------------------ State S3 ---------------------------------------- *)\n\nlemma S3EnvUnch: \"\\<turnstile> [ENext p]_(e p) \\<and> $(S3 rmhist p) \\<longrightarrow> unchanged (e p)\"\n  by (auto dest!: Envbusy [temp_use] simp: S_def S3_def)\n\nlemma S3ClerkUnch: \"\\<turnstile> [MClkNext memCh crCh cst p]_(c p) \\<and> $(S3 rmhist p) \\<longrightarrow> unchanged (c p)\"\n  by (auto dest!: MClkbusy [temp_use] simp: square_def S_def S3_def)\n\nlemma S3LegalRcvArg: \"\\<turnstile> S3 rmhist p \\<longrightarrow> IsLegalRcvArg<arg<crCh!p>>\"\n  by (auto simp: IsLegalRcvArg_def MClkRelayArg_def S_def S3_def)\n\nlemma S3RPC: \"\\<turnstile> RPCNext crCh rmCh rst p \\<and> $(S3 rmhist p)\n         \\<longrightarrow> RPCFwd crCh rmCh rst p \\<or> RPCFail crCh rmCh rst p\"\n  apply clarsimp\n  apply (frule S3LegalRcvArg [action_use])\n  apply (auto simp: RPCNext_def RPCReject_def RPCReply_def S_def S3_def)\n  done\n\nlemma S3Forward: \"\\<turnstile> RPCFwd crCh rmCh rst p \\<and> HNext rmhist p \\<and> $(S3 rmhist p)\n         \\<and> unchanged (e p, c p, m p)\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm RPCFwd_def},\n    @{thm HNext_def}, @{thm MemReturn_def}, @{thm RPCFail_def},\n    @{thm MClkReply_def}, @{thm AReturn_def}, @{thm ACall_def}, @{thm e_def},\n    @{thm c_def}, @{thm m_def}, @{thm caller_def}, @{thm rtrner_def}, @{thm S_def},\n    @{thm S3_def}, @{thm S4_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S3Fail: \"\\<turnstile> RPCFail crCh rmCh rst p \\<and> $(S3 rmhist p) \\<and> HNext rmhist p\n         \\<and> unchanged (e p, c p, m p)\n         \\<longrightarrow> (S6 rmhist p)$\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm HNext_def},\n    @{thm RPCFail_def}, @{thm AReturn_def}, @{thm e_def}, @{thm c_def},\n    @{thm m_def}, @{thm caller_def}, @{thm rtrner_def}, @{thm MVOKBARF_def},\n    @{thm S_def}, @{thm S3_def}, @{thm S6_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S3MemUnch: \"\\<turnstile> [RNext rmCh mm ires p]_(m p) \\<and> $(S3 rmhist p) \\<longrightarrow> unchanged (m p)\"\n  by (auto simp: S_def S3_def dest!: Memoryidle [temp_use])\n\nlemma S3Hist: \"\\<turnstile> HNext rmhist p \\<and> $(S3 rmhist p) \\<and> unchanged (r p) \\<longrightarrow> unchanged (rmhist!p)\"\n  by (auto simp: HNext_def MemReturn_def RPCFail_def MClkReply_def\n    AReturn_def r_def rtrner_def S_def S3_def Calling_def)\n\n(* ------------------------------ State S4 ---------------------------------------- *)\n\nlemma S4EnvUnch: \"\\<turnstile> [ENext p]_(e p) \\<and> $(S4 rmhist p) \\<longrightarrow> unchanged (e p)\"\n  by (auto simp: S_def S4_def dest!: Envbusy [temp_use])\n\nlemma S4ClerkUnch: \"\\<turnstile> [MClkNext memCh crCh cst p]_(c p) \\<and> $(S4 rmhist p) \\<longrightarrow> unchanged (c p)\"\n  by (auto simp: S_def S4_def dest!: MClkbusy [temp_use])\n\nlemma S4RPCUnch: \"\\<turnstile> [RPCNext crCh rmCh rst p]_(r p) \\<and> $(S4 rmhist p) \\<longrightarrow> unchanged (r p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] dest!: RPCbusy [temp_use] simp: S_def S4_def)\n\nlemma S4ReadInner: \"\\<turnstile> ReadInner rmCh mm ires p l \\<and> $(S4 rmhist p) \\<and> unchanged (e p, c p, r p)\n         \\<and> HNext rmhist p \\<and> $(MemInv mm l)\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm ReadInner_def},\n    @{thm GoodRead_def}, @{thm BadRead_def}, @{thm HNext_def}, @{thm MemReturn_def},\n    @{thm RPCFail_def}, @{thm MClkReply_def}, @{thm AReturn_def}, @{thm e_def},\n    @{thm c_def}, @{thm r_def}, @{thm rtrner_def}, @{thm caller_def},\n    @{thm MVNROKBA_def}, @{thm S_def}, @{thm S4_def}, @{thm RdRequest_def},\n    @{thm Calling_def}, @{thm MemInv_def}]) [] [] 1\\<close>)\n\nlemma S4Read: \"\\<turnstile> Read rmCh mm ires p \\<and> $(S4 rmhist p) \\<and> unchanged (e p, c p, r p)\n         \\<and> HNext rmhist p \\<and> (\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (auto simp: Read_def dest!: S4ReadInner [temp_use])\n\nlemma S4WriteInner: \"\\<turnstile> WriteInner rmCh mm ires p l v \\<and> $(S4 rmhist p) \\<and> unchanged (e p, c p, r p) \\<and> HNext rmhist p\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm WriteInner_def},\n    @{thm GoodWrite_def}, @{thm BadWrite_def}, @{thm HNext_def}, @{thm MemReturn_def},\n    @{thm RPCFail_def}, @{thm MClkReply_def}, @{thm AReturn_def}, @{thm e_def},\n    @{thm c_def}, @{thm r_def}, @{thm rtrner_def}, @{thm caller_def}, @{thm MVNROKBA_def},\n    @{thm S_def}, @{thm S4_def}, @{thm WrRequest_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S4Write: \"\\<turnstile> Write rmCh mm ires p l \\<and> $(S4 rmhist p) \\<and> unchanged (e p, c p, r p)\n         \\<and> (HNext rmhist p)\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (auto simp: Write_def dest!: S4WriteInner [temp_use])\n\nlemma WriteS4: \"\\<turnstile> $ImpInv rmhist p \\<and> Write rmCh mm ires p l \\<longrightarrow> $S4 rmhist p\"\n  by (auto simp: Write_def WriteInner_def ImpInv_def\n    WrRequest_def S_def S1_def S2_def S3_def S4_def S5_def S6_def)\n\nlemma S4Return: \"\\<turnstile> MemReturn rmCh ires p \\<and> $S4 rmhist p \\<and> unchanged (e p, c p, r p)\n         \\<and> HNext rmhist p\n         \\<longrightarrow> (S5 rmhist p)$\"\n  by (auto simp: HNext_def MemReturn_def AReturn_def e_def c_def r_def\n    rtrner_def caller_def MVNROKBA_def MVOKBA_def S_def S4_def S5_def Calling_def)\n\nlemma S4Hist: \"\\<turnstile> HNext rmhist p \\<and> $S4 rmhist p \\<and> (m p)$ = $(m p) \\<longrightarrow> (rmhist!p)$ = $(rmhist!p)\"\n  by (auto simp: HNext_def MemReturn_def RPCFail_def MClkReply_def\n    AReturn_def m_def rtrner_def S_def S4_def Calling_def)\n\n(* ------------------------------ State S5 ---------------------------------------- *)\n\nlemma S5EnvUnch: \"\\<turnstile> [ENext p]_(e p) \\<and> $(S5 rmhist p) \\<longrightarrow> unchanged (e p)\"\n  by (auto simp: S_def S5_def dest!: Envbusy [temp_use])\n\nlemma S5ClerkUnch: \"\\<turnstile> [MClkNext memCh crCh cst p]_(c p) \\<and> $(S5 rmhist p) \\<longrightarrow> unchanged (c p)\"\n  by (auto simp: S_def S5_def dest!: MClkbusy [temp_use])\n\nlemma S5RPC: \"\\<turnstile> RPCNext crCh rmCh rst p \\<and> $(S5 rmhist p)\n         \\<longrightarrow> RPCReply crCh rmCh rst p \\<or> RPCFail crCh rmCh rst p\"\n  by (auto simp: RPCNext_def RPCReject_def RPCFwd_def S_def S5_def)\n\nlemma S5Reply: \"\\<turnstile> RPCReply crCh rmCh rst p \\<and> $(S5 rmhist p) \\<and> unchanged (e p, c p, m p,rmhist!p)\n       \\<longrightarrow> (S6 rmhist p)$\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm RPCReply_def},\n    @{thm AReturn_def}, @{thm e_def}, @{thm c_def}, @{thm m_def}, @{thm MVOKBA_def},\n    @{thm MVOKBARF_def}, @{thm caller_def}, @{thm rtrner_def}, @{thm S_def},\n    @{thm S5_def}, @{thm S6_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S5Fail: \"\\<turnstile> RPCFail crCh rmCh rst p \\<and> $(S5 rmhist p) \\<and> unchanged (e p, c p, m p,rmhist!p)\n         \\<longrightarrow> (S6 rmhist p)$\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm RPCFail_def},\n    @{thm AReturn_def}, @{thm e_def}, @{thm c_def}, @{thm m_def},\n    @{thm MVOKBARF_def}, @{thm caller_def}, @{thm rtrner_def},\n    @{thm S_def}, @{thm S5_def}, @{thm S6_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S5MemUnch: \"\\<turnstile> [RNext rmCh mm ires p]_(m p) \\<and> $(S5 rmhist p) \\<longrightarrow> unchanged (m p)\"\n  by (auto simp: S_def S5_def dest!: Memoryidle [temp_use])\n\nlemma S5Hist: \"\\<turnstile> [HNext rmhist p]_(c p, r p, m p, rmhist!p) \\<and> $(S5 rmhist p)\n         \\<longrightarrow> (rmhist!p)$ = $(rmhist!p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] simp: HNext_def MemReturn_def RPCFail_def\n    MClkReply_def AReturn_def S_def S5_def)\n\n(* ------------------------------ State S6 ---------------------------------------- *)\n\nlemma S6EnvUnch: \"\\<turnstile> [ENext p]_(e p) \\<and> $(S6 rmhist p) \\<longrightarrow> unchanged (e p)\"\n  by (auto simp: S_def S6_def dest!: Envbusy [temp_use])\n\nlemma S6Clerk: \"\\<turnstile> MClkNext memCh crCh cst p \\<and> $(S6 rmhist p)\n         \\<longrightarrow> MClkRetry memCh crCh cst p \\<or> MClkReply memCh crCh cst p\"\n  by (auto simp: MClkNext_def MClkFwd_def S_def S6_def)\n\nlemma S6Retry: \"\\<turnstile> MClkRetry memCh crCh cst p \\<and> HNext rmhist p \\<and> $S6 rmhist p\n         \\<and> unchanged (e p,r p,m p)\n         \\<longrightarrow> (S3 rmhist p)$ \\<and> unchanged (rmhist!p)\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm HNext_def},\n    @{thm MClkReply_def}, @{thm MClkRetry_def}, @{thm ACall_def}, @{thm AReturn_def},\n    @{thm e_def}, @{thm r_def}, @{thm m_def}, @{thm caller_def}, @{thm rtrner_def},\n    @{thm S_def}, @{thm S6_def}, @{thm S3_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S6Reply: \"\\<turnstile> MClkReply memCh crCh cst p \\<and> HNext rmhist p \\<and> $S6 rmhist p\n         \\<and> unchanged (e p,r p,m p)\n         \\<longrightarrow> (S1 rmhist p)$\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm HNext_def},\n    @{thm MemReturn_def}, @{thm RPCFail_def}, @{thm AReturn_def}, @{thm MClkReply_def},\n    @{thm e_def}, @{thm r_def}, @{thm m_def}, @{thm caller_def}, @{thm rtrner_def},\n    @{thm S_def}, @{thm S6_def}, @{thm S1_def}, @{thm Calling_def}]) [] [] 1\\<close>)\n\nlemma S6RPCUnch: \"\\<turnstile> [RPCNext crCh rmCh rst p]_(r p) \\<and> $S6 rmhist p \\<longrightarrow> unchanged (r p)\"\n  by (auto simp: S_def S6_def dest!: RPCidle [temp_use])\n\nlemma S6MemUnch: \"\\<turnstile> [RNext rmCh mm ires p]_(m p) \\<and> $(S6 rmhist p) \\<longrightarrow> unchanged (m p)\"\n  by (auto simp: S_def S6_def dest!: Memoryidle [temp_use])\n\nlemma S6Hist: \"\\<turnstile> HNext rmhist p \\<and> $S6 rmhist p \\<and> (c p)$ = $(c p) \\<longrightarrow> (rmhist!p)$ = $(rmhist!p)\"\n  by (auto simp: HNext_def MClkReply_def AReturn_def c_def rtrner_def S_def S6_def Calling_def)\n\n\nsection \"Correctness of predicate-action diagram\"\n\n\n(* ========== Step 1.1 ================================================= *)\n(* The implementation's initial condition implies the state predicate S1 *)\n\nlemma Step1_1: \"\\<turnstile> ImpInit p \\<and> HInit rmhist p \\<longrightarrow> S1 rmhist p\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] simp: MVNROKBA_def\n    MClkInit_def RPCInit_def PInit_def HInit_def ImpInit_def S_def S1_def)\n\n(* ========== Step 1.2 ================================================== *)\n(* Figure 16 is a predicate-action diagram for the implementation. *)\n\nlemma Step1_2_1: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n         \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p)  \\<and> $S1 rmhist p\n         \\<longrightarrow> (S2 rmhist p)$ \\<and> ENext p \\<and> unchanged (c p, r p, m p)\"\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n      (map (temp_elim @{context})\n        [@{thm S1ClerkUnch}, @{thm S1RPCUnch}, @{thm S1MemUnch}, @{thm S1Hist}]) 1\\<close>)\n   using [[fast_solver]]\n   apply (auto elim!: squareE [temp_use] intro!: S1Env [temp_use])\n  done\n\nlemma Step1_2_2: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n         \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p) \\<and> $S2 rmhist p\n         \\<longrightarrow> (S3 rmhist p)$ \\<and> MClkFwd memCh crCh cst p\n             \\<and> unchanged (e p, r p, m p, rmhist!p)\"\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n    (map (temp_elim @{context})\n      [@{thm S2EnvUnch}, @{thm S2RPCUnch}, @{thm S2MemUnch}, @{thm S2Hist}]) 1\\<close>)\n   using [[fast_solver]]\n   apply (auto elim!: squareE [temp_use] intro!: S2Clerk [temp_use] S2Forward [temp_use])\n  done\n\nlemma Step1_2_3: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n         \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p) \\<and> $S3 rmhist p\n         \\<longrightarrow> ((S4 rmhist p)$ \\<and> RPCFwd crCh rmCh rst p \\<and> unchanged (e p, c p, m p, rmhist!p))\n             \\<or> ((S6 rmhist p)$ \\<and> RPCFail crCh rmCh rst p \\<and> unchanged (e p, c p, m p))\"\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n    (map (temp_elim @{context}) [@{thm S3EnvUnch}, @{thm S3ClerkUnch}, @{thm S3MemUnch}]) 1\\<close>)\n  apply (tactic \\<open>action_simp_tac @{context} []\n    (@{thm squareE} ::\n      map (temp_elim @{context}) [@{thm S3RPC}, @{thm S3Forward}, @{thm S3Fail}]) 1\\<close>)\n   apply (auto dest!: S3Hist [temp_use])\n  done\n\nlemma Step1_2_4: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n              \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p)\n              \\<and> $S4 rmhist p \\<and> (\\<forall>l. $(MemInv mm l))\n         \\<longrightarrow> ((S4 rmhist p)$ \\<and> Read rmCh mm ires p \\<and> unchanged (e p, c p, r p, rmhist!p))\n             \\<or> ((S4 rmhist p)$ \\<and> (\\<exists>l. Write rmCh mm ires p l) \\<and> unchanged (e p, c p, r p, rmhist!p))\n             \\<or> ((S5 rmhist p)$ \\<and> MemReturn rmCh ires p \\<and> unchanged (e p, c p, r p))\"\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n    (map (temp_elim @{context}) [@{thm S4EnvUnch}, @{thm S4ClerkUnch}, @{thm S4RPCUnch}]) 1\\<close>)\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm RNext_def}]) []\n    (@{thm squareE} ::\n      map (temp_elim @{context}) [@{thm S4Read}, @{thm S4Write}, @{thm S4Return}]) 1\\<close>)\n  apply (auto dest!: S4Hist [temp_use])\n  done\n\nlemma Step1_2_5: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n              \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p) \\<and> $S5 rmhist p\n         \\<longrightarrow> ((S6 rmhist p)$ \\<and> RPCReply crCh rmCh rst p \\<and> unchanged (e p, c p, m p))\n             \\<or> ((S6 rmhist p)$ \\<and> RPCFail crCh rmCh rst p \\<and> unchanged (e p, c p, m p))\"\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n    (map (temp_elim @{context}) [@{thm S5EnvUnch}, @{thm S5ClerkUnch}, @{thm S5MemUnch}, @{thm S5Hist}]) 1\\<close>)\n  apply (tactic \\<open>action_simp_tac @{context} [] [@{thm squareE}, temp_elim @{context} @{thm S5RPC}] 1\\<close>)\n   using [[fast_solver]]\n   apply (auto elim!: squareE [temp_use] dest!: S5Reply [temp_use] S5Fail [temp_use])\n  done\n\nlemma Step1_2_6: \"\\<turnstile> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> ImpNext p\n              \\<and> \\<not>unchanged (e p, c p, r p, m p, rmhist!p) \\<and> $S6 rmhist p\n         \\<longrightarrow> ((S1 rmhist p)$ \\<and> MClkReply memCh crCh cst p \\<and> unchanged (e p, r p, m p))\n             \\<or> ((S3 rmhist p)$ \\<and> MClkRetry memCh crCh cst p \\<and> unchanged (e p,r p,m p,rmhist!p))\"\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm ImpNext_def}]) []\n    (map (temp_elim @{context}) [@{thm S6EnvUnch}, @{thm S6RPCUnch}, @{thm S6MemUnch}]) 1\\<close>)\n  apply (tactic \\<open>action_simp_tac @{context} []\n    (@{thm squareE} :: map (temp_elim @{context}) [@{thm S6Clerk}, @{thm S6Retry}, @{thm S6Reply}]) 1\\<close>)\n     apply (auto dest: S6Hist [temp_use])\n  done\n\n(* --------------------------------------------------------------------------\n   Step 1.3: S1 implies the barred initial condition.\n*)\n\nsection \"Initialization (Step 1.3)\"\n\nlemma Step1_3: \"\\<turnstile> S1 rmhist p \\<longrightarrow> PInit (resbar rmhist) p\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm resbar_def},\n    @{thm PInit_def}, @{thm S_def}, @{thm S1_def}]) [] [] 1\\<close>)\n\n(* ----------------------------------------------------------------------\n   Step 1.4: Implementation's next-state relation simulates specification's\n             next-state relation (with appropriate substitutions)\n*)\n\nsection \"Step simulation (Step 1.4)\"\n\nlemma Step1_4_1: \"\\<turnstile> ENext p \\<and> $S1 rmhist p \\<and> (S2 rmhist p)$ \\<and> unchanged (c p, r p, m p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n  using [[fast_solver]]\n  by (auto elim!: squareE [temp_use] simp: c_def r_def m_def resbar_def)\n\nlemma Step1_4_2: \"\\<turnstile> MClkFwd memCh crCh cst p \\<and> $S2 rmhist p \\<and> (S3 rmhist p)$\n         \\<and> unchanged (e p, r p, m p, rmhist!p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n  by (tactic \\<open>action_simp_tac\n    (@{context} addsimps [@{thm MClkFwd_def}, @{thm e_def}, @{thm r_def}, @{thm m_def},\n    @{thm resbar_def}, @{thm S_def}, @{thm S2_def}, @{thm S3_def}]) [] [] 1\\<close>)\n\nlemma Step1_4_3a: \"\\<turnstile> RPCFwd crCh rmCh rst p \\<and> $S3 rmhist p \\<and> (S4 rmhist p)$\n         \\<and> unchanged (e p, c p, m p, rmhist!p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (drule S3_excl [temp_use] S4_excl [temp_use])+\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm e_def},\n    @{thm c_def}, @{thm m_def}, @{thm resbar_def}, @{thm S_def}, @{thm S3_def}]) [] [] 1\\<close>)\n  done\n\nlemma Step1_4_3b: \"\\<turnstile> RPCFail crCh rmCh rst p \\<and> $S3 rmhist p \\<and> (S6 rmhist p)$\n         \\<and> unchanged (e p, c p, m p)\n         \\<longrightarrow> MemFail memCh (resbar rmhist) p\"\n  apply clarsimp\n  apply (drule S6_excl [temp_use])\n  apply (auto simp: RPCFail_def MemFail_def e_def c_def m_def resbar_def)\n    apply (force simp: S3_def S_def)\n   apply (auto simp: AReturn_def)\n  done\n\nlemma Step1_4_4a1: \"\\<turnstile> $S4 rmhist p \\<and> (S4 rmhist p)$ \\<and> ReadInner rmCh mm ires p l\n         \\<and> unchanged (e p, c p, r p, rmhist!p) \\<and> $MemInv mm l\n         \\<longrightarrow> ReadInner memCh mm (resbar rmhist) p l\"\n  apply clarsimp\n  apply (drule S4_excl [temp_use])+\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm ReadInner_def},\n    @{thm GoodRead_def}, @{thm BadRead_def}, @{thm e_def}, @{thm c_def}, @{thm m_def}]) [] [] 1\\<close>)\n     apply (auto simp: resbar_def)\n       apply (tactic \\<open>ALLGOALS (action_simp_tac\n                (@{context} addsimps [@{thm RPCRelayArg_def}, @{thm MClkRelayArg_def},\n                  @{thm S_def}, @{thm S4_def}, @{thm RdRequest_def}, @{thm MemInv_def}])\n                [] [@{thm impE}, @{thm MemValNotAResultE}])\\<close>)\n  done\n\nlemma Step1_4_4a: \"\\<turnstile> Read rmCh mm ires p \\<and> $S4 rmhist p \\<and> (S4 rmhist p)$\n         \\<and> unchanged (e p, c p, r p, rmhist!p) \\<and> (\\<forall>l. $(MemInv mm l))\n         \\<longrightarrow> Read memCh mm (resbar rmhist) p\"\n  by (force simp: Read_def elim!: Step1_4_4a1 [temp_use])\n\nlemma Step1_4_4b1: \"\\<turnstile> $S4 rmhist p \\<and> (S4 rmhist p)$ \\<and> WriteInner rmCh mm ires p l v\n         \\<and> unchanged (e p, c p, r p, rmhist!p)\n         \\<longrightarrow> WriteInner memCh mm (resbar rmhist) p l v\"\n  apply clarsimp\n  apply (drule S4_excl [temp_use])+\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps\n    [@{thm WriteInner_def}, @{thm GoodWrite_def}, @{thm BadWrite_def}, @{thm e_def},\n    @{thm c_def}, @{thm m_def}]) [] [] 1\\<close>)\n     apply (auto simp: resbar_def)\n    apply (tactic \\<open>ALLGOALS (action_simp_tac (@{context} addsimps\n      [@{thm RPCRelayArg_def}, @{thm MClkRelayArg_def}, @{thm S_def},\n      @{thm S4_def}, @{thm WrRequest_def}]) [] [])\\<close>)\n  done\n\nlemma Step1_4_4b: \"\\<turnstile> Write rmCh mm ires p l \\<and> $S4 rmhist p \\<and> (S4 rmhist p)$\n         \\<and> unchanged (e p, c p, r p, rmhist!p)\n         \\<longrightarrow> Write memCh mm (resbar rmhist) p l\"\n  by (force simp: Write_def elim!: Step1_4_4b1 [temp_use])\n\nlemma Step1_4_4c: \"\\<turnstile> MemReturn rmCh ires p \\<and> $S4 rmhist p \\<and> (S5 rmhist p)$\n         \\<and> unchanged (e p, c p, r p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm e_def},\n    @{thm c_def}, @{thm r_def}, @{thm resbar_def}]) [] [] 1\\<close>)\n  apply (drule S4_excl [temp_use] S5_excl [temp_use])+\n  using [[fast_solver]]\n  apply (auto elim!: squareE [temp_use] simp: MemReturn_def AReturn_def)\n  done\n\nlemma Step1_4_5a: \"\\<turnstile> RPCReply crCh rmCh rst p \\<and> $S5 rmhist p \\<and> (S6 rmhist p)$\n         \\<and> unchanged (e p, c p, m p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (drule S5_excl [temp_use] S6_excl [temp_use])+\n  apply (auto simp: e_def c_def m_def resbar_def)\n   apply (auto simp: RPCReply_def AReturn_def S5_def S_def dest!: MVOKBAnotRF [temp_use])\n  done\n\nlemma Step1_4_5b: \"\\<turnstile> RPCFail crCh rmCh rst p \\<and> $S5 rmhist p \\<and> (S6 rmhist p)$\n         \\<and> unchanged (e p, c p, m p)\n         \\<longrightarrow> MemFail memCh (resbar rmhist) p\"\n  apply clarsimp\n  apply (drule S6_excl [temp_use])\n  apply (auto simp: e_def c_def m_def RPCFail_def AReturn_def MemFail_def resbar_def)\n   apply (auto simp: S5_def S_def)\n  done\n\nlemma Step1_4_6a: \"\\<turnstile> MClkReply memCh crCh cst p \\<and> $S6 rmhist p \\<and> (S1 rmhist p)$\n         \\<and> unchanged (e p, r p, m p)\n         \\<longrightarrow> MemReturn memCh (resbar rmhist) p\"\n  apply clarsimp\n  apply (drule S6_excl [temp_use])+\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm e_def},\n    @{thm r_def}, @{thm m_def}, @{thm MClkReply_def}, @{thm MemReturn_def},\n    @{thm AReturn_def}, @{thm resbar_def}]) [] [] 1\\<close>)\n    apply simp_all (* simplify if-then-else *)\n    apply (tactic \\<open>ALLGOALS (action_simp_tac (@{context} addsimps\n      [@{thm MClkReplyVal_def}, @{thm S6_def}, @{thm S_def}]) [] [@{thm MVOKBARFnotNR}])\\<close>)\n  done\n\nlemma Step1_4_6b: \"\\<turnstile> MClkRetry memCh crCh cst p \\<and> $S6 rmhist p \\<and> (S3 rmhist p)$\n         \\<and> unchanged (e p, r p, m p, rmhist!p)\n         \\<longrightarrow> MemFail memCh (resbar rmhist) p\"\n  apply clarsimp\n  apply (drule S3_excl [temp_use])+\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm e_def}, @{thm r_def},\n    @{thm m_def}, @{thm MClkRetry_def}, @{thm MemFail_def}, @{thm resbar_def}]) [] [] 1\\<close>)\n   apply (auto simp: S6_def S_def)\n  done\n\nlemma S_lemma: \"\\<turnstile> unchanged (e p, c p, r p, m p, rmhist!p)\n         \\<longrightarrow> unchanged (S rmhist ec cc rc cs rs hs1 hs2 p)\"\n  by (auto simp: e_def c_def r_def m_def caller_def rtrner_def S_def Calling_def)\n\nlemma Step1_4_7H: \"\\<turnstile> unchanged (e p, c p, r p, m p, rmhist!p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, S1 rmhist p, S2 rmhist p, S3 rmhist p,\n                        S4 rmhist p, S5 rmhist p, S6 rmhist p)\"\n  apply clarsimp\n  apply (rule conjI)\n   apply (force simp: c_def)\n  apply (force simp: S1_def S2_def S3_def S4_def S5_def S6_def intro!: S_lemma [temp_use])\n  done\n\nlemma Step1_4_7: \"\\<turnstile> unchanged (e p, c p, r p, m p, rmhist!p)\n         \\<longrightarrow> unchanged (rtrner memCh!p, resbar rmhist!p, S1 rmhist p, S2 rmhist p,\n                        S3 rmhist p, S4 rmhist p, S5 rmhist p, S6 rmhist p)\"\n  apply (rule actionI)\n  apply (unfold action_rews)\n  apply (rule impI)\n  apply (frule Step1_4_7H [temp_use])\n  apply (auto simp: e_def c_def r_def m_def rtrner_def resbar_def)\n  done\n\n(* Frequently needed abbreviation: distinguish between idling and non-idling\n   steps of the implementation, and try to solve the idling case by simplification\n*)\nML \\<open>\nfun split_idle_tac ctxt =\n  SELECT_GOAL\n   (TRY (resolve_tac ctxt @{thms actionI} 1) THEN\n    Induct_Tacs.case_tac ctxt \"(s,t) \\<Turnstile> unchanged (e p, c p, r p, m p, rmhist!p)\" [] NONE 1 THEN\n    rewrite_goals_tac ctxt @{thms action_rews} THEN\n    forward_tac ctxt [temp_use ctxt @{thm Step1_4_7}] 1 THEN\n    asm_full_simp_tac ctxt 1);\n\\<close>\n\nmethod_setup split_idle = \\<open>\n  Method.sections (Simplifier.simp_modifiers @ Splitter.split_modifiers)\n    >> (K (SIMPLE_METHOD' o split_idle_tac))\n\\<close>\n\n(* ----------------------------------------------------------------------\n   Combine steps 1.2 and 1.4 to prove that the implementation satisfies\n   the specification's next-state relation.\n*)\n\n(* Steps that leave all variables unchanged are safe, so I may assume\n   that some variable changes in the proof that a step is safe. *)\nlemma unchanged_safe: \"\\<turnstile> (\\<not>unchanged (e p, c p, r p, m p, rmhist!p)\n             \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p))\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply (split_idle simp: square_def)\n  apply force\n  done\n(* turn into (unsafe, looping!) introduction rule *)\nlemmas unchanged_safeI = impI [THEN unchanged_safe [action_use]]\n\nlemma S1safe: \"\\<turnstile> $S1 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (rule idle_squareI)\n  apply (auto dest!: Step1_2_1 [temp_use] Step1_4_1 [temp_use])\n  done\n\nlemma S2safe: \"\\<turnstile> $S2 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (rule idle_squareI)\n  apply (auto dest!: Step1_2_2 [temp_use] Step1_4_2 [temp_use])\n  done\n\nlemma S3safe: \"\\<turnstile> $S3 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (auto dest!: Step1_2_3 [temp_use])\n  apply (auto simp: square_def UNext_def dest!: Step1_4_3a [temp_use] Step1_4_3b [temp_use])\n  done\n\nlemma S4safe: \"\\<turnstile> $S4 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<and> (\\<forall>l. $(MemInv mm l))\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (auto dest!: Step1_2_4 [temp_use])\n     apply (auto simp: square_def UNext_def RNext_def\n       dest!: Step1_4_4a [temp_use] Step1_4_4b [temp_use] Step1_4_4c [temp_use])\n  done\n\nlemma S5safe: \"\\<turnstile> $S5 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (auto dest!: Step1_2_5 [temp_use])\n  apply (auto simp: square_def UNext_def dest!: Step1_4_5a [temp_use] Step1_4_5b [temp_use])\n  done\n\nlemma S6safe: \"\\<turnstile> $S6 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> [UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  apply clarsimp\n  apply (rule unchanged_safeI)\n  apply (auto dest!: Step1_2_6 [temp_use])\n    apply (auto simp: square_def UNext_def RNext_def\n      dest!: Step1_4_6a [temp_use] Step1_4_6b [temp_use])\n  done\n\n(* ----------------------------------------------------------------------\n   Step 1.5: Temporal refinement proof, based on previous steps.\n*)\n\nsection \"The liveness part\"\n\n(* Liveness assertions for the different implementation states, based on the\n   fairness conditions. Prove subgoals of WF1 / SF1 rules as separate lemmas\n   for readability. Reuse action proofs from safety part.\n*)\n\n(* ------------------------------ State S1 ------------------------------ *)\n\nlemma S1_successors: \"\\<turnstile> $S1 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> (S1 rmhist p)$ \\<or> (S2 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_1 [temp_use])\n  done\n\n(* Show that the implementation can satisfy the high-level fairness requirements\n   by entering the state S1 infinitely often.\n*)\n\nlemma S1_RNextdisabled: \"\\<turnstile> S1 rmhist p \\<longrightarrow>\n         \\<not>Enabled (<RNext memCh mm (resbar rmhist) p>_(rtrner memCh!p, resbar rmhist!p))\"\n  apply (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm angle_def},\n    @{thm S_def}, @{thm S1_def}]) [notI] [@{thm enabledE}, temp_elim @{context} @{thm Memoryidle}] 1\\<close>)\n  apply force\n  done\n\nlemma S1_Returndisabled: \"\\<turnstile> S1 rmhist p \\<longrightarrow>\n         \\<not>Enabled (<MemReturn memCh (resbar rmhist) p>_(rtrner memCh!p, resbar rmhist!p))\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm angle_def}, @{thm MemReturn_def},\n    @{thm AReturn_def}, @{thm S_def}, @{thm S1_def}]) [notI] [@{thm enabledE}] 1\\<close>)\n\nlemma RNext_fair: \"\\<turnstile> \\<box>\\<diamond>S1 rmhist p\n         \\<longrightarrow> WF(RNext memCh mm (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n  by (auto simp: WF_alt [try_rewrite] intro!: S1_RNextdisabled [temp_use]\n    elim!: STL4E [temp_use] DmdImplE [temp_use])\n\nlemma Return_fair: \"\\<turnstile> \\<box>\\<diamond>S1 rmhist p\n         \\<longrightarrow> WF(MemReturn memCh (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n  by (auto simp: WF_alt [try_rewrite]\n    intro!: S1_Returndisabled [temp_use] elim!: STL4E [temp_use] DmdImplE [temp_use])\n\n(* ------------------------------ State S2 ------------------------------ *)\n\nlemma S2_successors: \"\\<turnstile> $S2 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> (S2 rmhist p)$ \\<or> (S3 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_2 [temp_use])\n  done\n\nlemma S2MClkFwd_successors: \"\\<turnstile> ($S2 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> <MClkFwd memCh crCh cst p>_(c p)\n         \\<longrightarrow> (S3 rmhist p)$\"\n  by (auto simp: angle_def dest!: Step1_2_2 [temp_use])\n\nlemma S2MClkFwd_enabled: \"\\<turnstile> $S2 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> $Enabled (<MClkFwd memCh crCh cst p>_(c p))\"\n  apply (auto simp: c_def intro!: MClkFwd_ch_enabled [temp_use] MClkFwd_enabled [temp_use])\n     apply (cut_tac MI_base)\n     apply (blast dest: base_pair)\n    apply (simp_all add: S_def S2_def)\n  done\n\nlemma S2_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> WF(MClkFwd memCh crCh cst p)_(c p)\n         \\<longrightarrow> (S2 rmhist p \\<leadsto> S3 rmhist p)\"\n  by (rule WF1 S2_successors S2MClkFwd_successors S2MClkFwd_enabled)+\n\n(* ------------------------------ State S3 ------------------------------ *)\n\nlemma S3_successors: \"\\<turnstile> $S3 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> (S3 rmhist p)$ \\<or> (S4 rmhist p \\<or> S6 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_3 [temp_use])\n  done\n\nlemma S3RPC_successors: \"\\<turnstile> ($S3 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> <RPCNext crCh rmCh rst p>_(r p)\n         \\<longrightarrow> (S4 rmhist p \\<or> S6 rmhist p)$\"\n  apply (auto simp: angle_def dest!: Step1_2_3 [temp_use])\n  done\n\nlemma S3RPC_enabled: \"\\<turnstile> $S3 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> $Enabled (<RPCNext crCh rmCh rst p>_(r p))\"\n  apply (auto simp: r_def intro!: RPCFail_Next_enabled [temp_use] RPCFail_enabled [temp_use])\n    apply (cut_tac MI_base)\n    apply (blast dest: base_pair)\n   apply (simp_all add: S_def S3_def)\n  done\n\nlemma S3_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> WF(RPCNext crCh rmCh rst p)_(r p)\n         \\<longrightarrow> (S3 rmhist p \\<leadsto> S4 rmhist p \\<or> S6 rmhist p)\"\n  by (rule WF1 S3_successors S3RPC_successors S3RPC_enabled)+\n\n(* ------------- State S4 -------------------------------------------------- *)\n\nlemma S4_successors: \"\\<turnstile> $S4 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n        \\<and> (\\<forall>l. $MemInv mm l)\n        \\<longrightarrow> (S4 rmhist p)$ \\<or> (S5 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_4 [temp_use])\n  done\n\n(* --------- State S4a: S4 /\\ (ires p = NotAResult) ------------------------ *)\n\nlemma S4a_successors: \"\\<turnstile> $(S4 rmhist p \\<and> ires!p = #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p,rmhist!p) \\<and> (\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> (S4 rmhist p \\<and> ires!p = #NotAResult)$\n             \\<or> ((S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_4 [temp_use])\n  done\n\nlemma S4aRNext_successors: \"\\<turnstile> ($(S4 rmhist p \\<and> ires!p = #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p,rmhist!p) \\<and> (\\<forall>l. $MemInv mm l))\n         \\<and> <RNext rmCh mm ires p>_(m p)\n         \\<longrightarrow> ((S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p)$\"\n  by (auto simp: angle_def\n    dest!: Step1_2_4 [temp_use] ReadResult [temp_use] WriteResult [temp_use])\n\nlemma S4aRNext_enabled: \"\\<turnstile> $(S4 rmhist p \\<and> ires!p = #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> (\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> $Enabled (<RNext rmCh mm ires p>_(m p))\"\n  apply (auto simp: m_def intro!: RNext_enabled [temp_use])\n   apply (cut_tac MI_base)\n   apply (blast dest: base_pair)\n  apply (simp add: S_def S4_def)\n  done\n\nlemma S4a_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<and> (\\<forall>l. $MemInv mm l)) \\<and> WF(RNext rmCh mm ires p)_(m p)\n         \\<longrightarrow> (S4 rmhist p \\<and> ires!p = #NotAResult\n              \\<leadsto> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p)\"\n  by (rule WF1 S4a_successors S4aRNext_successors S4aRNext_enabled)+\n\n(* ---------- State S4b: S4 /\\ (ires p # NotAResult) --------------------------- *)\n\nlemma S4b_successors: \"\\<turnstile> $(S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> (\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult)$ \\<or> (S5 rmhist p)$\"\n  apply (split_idle simp: m_def)\n  apply (auto dest!: WriteResult [temp_use] Step1_2_4 [temp_use] ReadResult [temp_use])\n  done\n\nlemma S4bReturn_successors: \"\\<turnstile> ($(S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<and> (\\<forall>l. $MemInv mm l)) \\<and> <MemReturn rmCh ires p>_(m p)\n         \\<longrightarrow> (S5 rmhist p)$\"\n  by (force simp: angle_def dest!: Step1_2_4 [temp_use] dest: ReturnNotReadWrite [temp_use])\n\nlemma S4bReturn_enabled: \"\\<turnstile> $(S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult)\n         \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<and> (\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> $Enabled (<MemReturn rmCh ires p>_(m p))\"\n  apply (auto simp: m_def intro!: MemReturn_enabled [temp_use])\n   apply (cut_tac MI_base)\n   apply (blast dest: base_pair)\n  apply (simp add: S_def S4_def)\n  done\n\nlemma S4b_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> (\\<forall>l. $MemInv mm l))\n         \\<and> WF(MemReturn rmCh ires p)_(m p)\n         \\<longrightarrow> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p)\"\n  by (rule WF1 S4b_successors S4bReturn_successors S4bReturn_enabled)+\n\n(* ------------------------------ State S5 ------------------------------ *)\n\nlemma S5_successors: \"\\<turnstile> $S5 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> (S5 rmhist p)$ \\<or> (S6 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_5 [temp_use])\n  done\n\nlemma S5RPC_successors: \"\\<turnstile> ($S5 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> <RPCNext crCh rmCh rst p>_(r p)\n         \\<longrightarrow> (S6 rmhist p)$\"\n  by (auto simp: angle_def dest!: Step1_2_5 [temp_use])\n\nlemma S5RPC_enabled: \"\\<turnstile> $S5 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> $Enabled (<RPCNext crCh rmCh rst p>_(r p))\"\n  apply (auto simp: r_def intro!: RPCFail_Next_enabled [temp_use] RPCFail_enabled [temp_use])\n    apply (cut_tac MI_base)\n    apply (blast dest: base_pair)\n   apply (simp_all add: S_def S5_def)\n  done\n\nlemma S5_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> WF(RPCNext crCh rmCh rst p)_(r p)\n         \\<longrightarrow> (S5 rmhist p \\<leadsto> S6 rmhist p)\"\n  by (rule WF1 S5_successors S5RPC_successors S5RPC_enabled)+\n\n(* ------------------------------ State S6 ------------------------------ *)\n\nlemma S6_successors: \"\\<turnstile> $S6 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p)\n         \\<longrightarrow> (S1 rmhist p)$ \\<or> (S3 rmhist p)$ \\<or> (S6 rmhist p)$\"\n  apply split_idle\n  apply (auto dest!: Step1_2_6 [temp_use])\n  done\n\nlemma S6MClkReply_successors:\n  \"\\<turnstile> ($S6 rmhist p \\<and> ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p))\n         \\<and> <MClkReply memCh crCh cst p>_(c p)\n         \\<longrightarrow> (S1 rmhist p)$\"\n  by (auto simp: angle_def dest!: Step1_2_6 [temp_use] MClkReplyNotRetry [temp_use])\n\nlemma MClkReplyS6:\n  \"\\<turnstile> $ImpInv rmhist p \\<and> <MClkReply memCh crCh cst p>_(c p) \\<longrightarrow> $S6 rmhist p\"\n  by (tactic \\<open>action_simp_tac (@{context} addsimps [@{thm angle_def},\n    @{thm MClkReply_def}, @{thm AReturn_def}, @{thm ImpInv_def}, @{thm S_def},\n    @{thm S1_def}, @{thm S2_def}, @{thm S3_def}, @{thm S4_def}, @{thm S5_def}]) [] [] 1\\<close>)\n\nlemma S6MClkReply_enabled: \"\\<turnstile> S6 rmhist p \\<longrightarrow> Enabled (<MClkReply memCh crCh cst p>_(c p))\"\n  apply (auto simp: c_def intro!: MClkReply_enabled [temp_use])\n     apply (cut_tac MI_base)\n     apply (blast dest: base_pair)\n    apply (tactic \\<open>ALLGOALS (action_simp_tac (@{context}\n      addsimps [@{thm S_def}, @{thm S6_def}]) [] [])\\<close>)\n  done\n\nlemma S6_live: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p,r p,m p, rmhist!p) \\<and> $(ImpInv rmhist p))\n         \\<and> SF(MClkReply memCh crCh cst p)_(c p) \\<and> \\<box>\\<diamond>(S6 rmhist p)\n         \\<longrightarrow> \\<box>\\<diamond>(S1 rmhist p)\"\n  apply clarsimp\n  apply (subgoal_tac \"sigma \\<Turnstile> \\<box>\\<diamond> (<MClkReply memCh crCh cst p>_ (c p))\")\n   apply (erule InfiniteEnsures)\n    apply assumption\n   apply (tactic \\<open>action_simp_tac @{context} []\n     (map (temp_elim @{context}) [@{thm MClkReplyS6}, @{thm S6MClkReply_successors}]) 1\\<close>)\n  apply (auto simp: SF_def)\n  apply (erule contrapos_np)\n  apply (auto intro!: S6MClkReply_enabled [temp_use] elim!: STL4E [temp_use] DmdImplE [temp_use])\n  done\n\n(* --------------- aggregate leadsto properties----------------------------- *)\n\nlemma S5S6LeadstoS6: \"sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p\n      \\<Longrightarrow> sigma \\<Turnstile> (S5 rmhist p \\<or> S6 rmhist p) \\<leadsto> S6 rmhist p\"\n  by (auto intro!: LatticeDisjunctionIntro [temp_use] LatticeReflexivity [temp_use])\n\nlemma S4bS5S6LeadstoS6: \"\\<lbrakk> sigma \\<Turnstile> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p;\n         sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p \\<or> S6 rmhist p\n                    \\<leadsto> S6 rmhist p\"\n  by (auto intro!: LatticeDisjunctionIntro [temp_use]\n    S5S6LeadstoS6 [temp_use] intro: LatticeTransitivity [temp_use])\n\nlemma S4S5S6LeadstoS6: \"\\<lbrakk> sigma \\<Turnstile> S4 rmhist p \\<and> ires!p = #NotAResult\n                  \\<leadsto> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p;\n         sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> S4 rmhist p \\<or> S5 rmhist p \\<or> S6 rmhist p \\<leadsto> S6 rmhist p\"\n  apply (subgoal_tac \"sigma \\<Turnstile> (S4 rmhist p \\<and> ires!p = #NotAResult) \\<or>\n    (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p \\<or> S6 rmhist p \\<leadsto> S6 rmhist p\")\n   apply (erule_tac G = \"PRED ((S4 rmhist p \\<and> ires!p = #NotAResult) \\<or>\n     (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p \\<or> S6 rmhist p)\" in\n     LatticeTransitivity [temp_use])\n   apply (force simp: Init_defs intro!: ImplLeadsto_gen [temp_use] necT [temp_use])\n  apply (rule LatticeDisjunctionIntro [temp_use])\n   apply (erule LatticeTransitivity [temp_use])\n   apply (erule LatticeTriangle2 [temp_use])\n   apply assumption\n  apply (auto intro!: S4bS5S6LeadstoS6 [temp_use])\n  done\n\nlemma S3S4S5S6LeadstoS6: \"\\<lbrakk> sigma \\<Turnstile> S3 rmhist p \\<leadsto> S4 rmhist p \\<or> S6 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p = #NotAResult\n                  \\<leadsto> (S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult) \\<or> S5 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p;\n         sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> S3 rmhist p \\<or> S4 rmhist p \\<or> S5 rmhist p \\<or> S6 rmhist p \\<leadsto> S6 rmhist p\"\n  apply (rule LatticeDisjunctionIntro [temp_use])\n   apply (erule LatticeTriangle2 [temp_use])\n   apply (rule S4S5S6LeadstoS6 [THEN LatticeTransitivity [temp_use]])\n      apply (auto intro!: S4S5S6LeadstoS6 [temp_use] necT [temp_use]\n        intro: ImplLeadsto_gen [temp_use] simp: Init_defs)\n  done\n\nlemma S2S3S4S5S6LeadstoS6: \"\\<lbrakk> sigma \\<Turnstile> S2 rmhist p \\<leadsto> S3 rmhist p;\n         sigma \\<Turnstile> S3 rmhist p \\<leadsto> S4 rmhist p \\<or> S6 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p = #NotAResult\n                  \\<leadsto> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<or> S5 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p;\n         sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> S2 rmhist p \\<or> S3 rmhist p \\<or> S4 rmhist p \\<or> S5 rmhist p \\<or> S6 rmhist p\n                   \\<leadsto> S6 rmhist p\"\n  apply (rule LatticeDisjunctionIntro [temp_use])\n   apply (rule LatticeTransitivity [temp_use])\n    prefer 2 apply assumption\n   apply (rule S3S4S5S6LeadstoS6 [THEN LatticeTransitivity [temp_use]])\n       apply (auto intro!: S3S4S5S6LeadstoS6 [temp_use] necT [temp_use]\n         intro: ImplLeadsto_gen [temp_use] simp: Init_defs)\n  done\n\nlemma NotS1LeadstoS6: \"\\<lbrakk> sigma \\<Turnstile> \\<box>ImpInv rmhist p;\n         sigma \\<Turnstile> S2 rmhist p \\<leadsto> S3 rmhist p;\n         sigma \\<Turnstile> S3 rmhist p \\<leadsto> S4 rmhist p \\<or> S6 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p = #NotAResult\n                  \\<leadsto> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<or> S5 rmhist p;\n         sigma \\<Turnstile> S4 rmhist p \\<and> ires!p \\<noteq> #NotAResult \\<leadsto> S5 rmhist p;\n         sigma \\<Turnstile> S5 rmhist p \\<leadsto> S6 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> \\<not>S1 rmhist p \\<leadsto> S6 rmhist p\"\n  apply (rule S2S3S4S5S6LeadstoS6 [THEN LatticeTransitivity [temp_use]])\n       apply assumption+\n  apply (erule INV_leadsto [temp_use])\n  apply (rule ImplLeadsto_gen [temp_use])\n  apply (rule necT [temp_use])\n  apply (auto simp: ImpInv_def Init_defs intro!: necT [temp_use])\n  done\n\nlemma S1Infinite: \"\\<lbrakk> sigma \\<Turnstile> \\<not>S1 rmhist p \\<leadsto> S6 rmhist p;\n         sigma \\<Turnstile> \\<box>\\<diamond>S6 rmhist p \\<longrightarrow> \\<box>\\<diamond>S1 rmhist p \\<rbrakk>\n      \\<Longrightarrow> sigma \\<Turnstile> \\<box>\\<diamond>S1 rmhist p\"\n  apply (rule classical)\n  apply (tactic \\<open>asm_lr_simp_tac (@{context} addsimps\n    [temp_use @{context} @{thm NotBox}, temp_rewrite @{context} @{thm NotDmd}]) 1\\<close>)\n  apply (auto elim!: leadsto_infinite [temp_use] mp dest!: DBImplBD [temp_use])\n  done\n\nsection \"Refinement proof (step 1.5)\"\n\n(* Prove invariants of the implementation:\n   a. memory invariant\n   b. \"implementation invariant\": always in states S1,...,S6\n*)\nlemma Step1_5_1a: \"\\<turnstile> IPImp p \\<longrightarrow> (\\<forall>l. \\<box>$MemInv mm l)\"\n  by (auto simp: IPImp_def box_stp_act [temp_use] intro!: MemoryInvariantAll [temp_use])\n\nlemma Step1_5_1b: \"\\<turnstile> Init(ImpInit p \\<and> HInit rmhist p) \\<and> \\<box>(ImpNext p)\n         \\<and> \\<box>[HNext rmhist p]_(c p, r p, m p, rmhist!p) \\<and> \\<box>(\\<forall>l. $MemInv mm l)\n         \\<longrightarrow> \\<box>ImpInv rmhist p\"\n  apply invariant\n   apply (auto simp: Init_def ImpInv_def box_stp_act [temp_use]\n     dest!: Step1_1 [temp_use] dest: S1_successors [temp_use] S2_successors [temp_use]\n     S3_successors [temp_use] S4_successors [temp_use] S5_successors [temp_use]\n     S6_successors [temp_use])\n  done\n\n(*** Initialization ***)\nlemma Step1_5_2a: \"\\<turnstile> Init(ImpInit p \\<and> HInit rmhist p) \\<longrightarrow> Init(PInit (resbar rmhist) p)\"\n  by (auto simp: Init_def intro!: Step1_1 [temp_use] Step1_3  [temp_use])\n\n(*** step simulation ***)\nlemma Step1_5_2b: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p)\n         \\<and> $ImpInv rmhist p \\<and> (\\<forall>l. $MemInv mm l))\n         \\<longrightarrow> \\<box>[UNext memCh mm (resbar rmhist) p]_(rtrner memCh!p, resbar rmhist!p)\"\n  by (auto simp: ImpInv_def elim!: STL4E [temp_use]\n    dest!: S1safe [temp_use] S2safe [temp_use] S3safe [temp_use] S4safe [temp_use]\n    S5safe [temp_use] S6safe [temp_use])\n\n(*** Liveness ***)\nlemma GoodImpl: \"\\<turnstile> IPImp p \\<and> HistP rmhist p\n         \\<longrightarrow>   Init(ImpInit p \\<and> HInit rmhist p)\n             \\<and> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n             \\<and> \\<box>(\\<forall>l. $MemInv mm l) \\<and> \\<box>($ImpInv rmhist p)\n             \\<and> ImpLive p\"\n  apply clarsimp\n    apply (subgoal_tac \"sigma \\<Turnstile> Init (ImpInit p \\<and> HInit rmhist p) \\<and> \\<box> (ImpNext p) \\<and>\n      \\<box>[HNext rmhist p]_ (c p, r p, m p, rmhist!p) \\<and> \\<box> (\\<forall>l. $MemInv mm l)\")\n   apply (auto simp: split_box_conj [try_rewrite] box_stp_act [try_rewrite]\n       dest!: Step1_5_1b [temp_use])\n      apply (force simp: IPImp_def MClkIPSpec_def RPCIPSpec_def RPSpec_def\n        ImpLive_def c_def r_def m_def)\n      apply (force simp: IPImp_def MClkIPSpec_def RPCIPSpec_def RPSpec_def\n        HistP_def Init_def ImpInit_def)\n    apply (force simp: IPImp_def MClkIPSpec_def RPCIPSpec_def RPSpec_def\n      ImpNext_def c_def r_def m_def split_box_conj [temp_use])\n   apply (force simp: HistP_def)\n  apply (force simp: allT [temp_use] dest!: Step1_5_1a [temp_use])\n  done\n\n(* The implementation is infinitely often in state S1... *)\nlemma Step1_5_3a: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n         \\<and> \\<box>(\\<forall>l. $MemInv mm l)\n         \\<and> \\<box>($ImpInv rmhist p) \\<and> ImpLive p\n         \\<longrightarrow> \\<box>\\<diamond>S1 rmhist p\"\n  apply (clarsimp simp: ImpLive_def)\n  apply (rule S1Infinite)\n   apply (force simp: split_box_conj [try_rewrite] box_stp_act [try_rewrite]\n     intro!: NotS1LeadstoS6 [temp_use] S2_live [temp_use] S3_live [temp_use]\n     S4a_live [temp_use] S4b_live [temp_use] S5_live [temp_use])\n  apply (auto simp: split_box_conj [temp_use] intro!: S6_live [temp_use])\n  done\n\n(* ... and therefore satisfies the fairness requirements of the specification *)\nlemma Step1_5_3b: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n         \\<and> \\<box>(\\<forall>l. $MemInv mm l) \\<and> \\<box>($ImpInv rmhist p) \\<and> ImpLive p\n         \\<longrightarrow> WF(RNext memCh mm (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n  by (auto intro!: RNext_fair [temp_use] Step1_5_3a [temp_use])\n\nlemma Step1_5_3c: \"\\<turnstile> \\<box>(ImpNext p \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n         \\<and> \\<box>(\\<forall>l. $MemInv mm l) \\<and> \\<box>($ImpInv rmhist p) \\<and> ImpLive p\n         \\<longrightarrow> WF(MemReturn memCh (resbar rmhist) p)_(rtrner memCh!p, resbar rmhist!p)\"\n  by (auto intro!: Return_fair [temp_use] Step1_5_3a [temp_use])\n\n(* QED step of step 1 *)\nlemma Step1: \"\\<turnstile> IPImp p \\<and> HistP rmhist p \\<longrightarrow> UPSpec memCh mm (resbar rmhist) p\"\n  by (auto simp: UPSpec_def split_box_conj [temp_use]\n    dest!: GoodImpl [temp_use] intro!: Step1_5_2a [temp_use] Step1_5_2b [temp_use]\n    Step1_5_3b [temp_use] Step1_5_3c [temp_use])\n\n(* ------------------------------ Step 2 ------------------------------ *)\nsection \"Step 2\"\n\nlemma Step2_2a: \"\\<turnstile> Write rmCh mm ires p l \\<and> ImpNext p\n         \\<and> [HNext rmhist p]_(c p, r p, m p, rmhist!p)\n         \\<and> $ImpInv rmhist p\n         \\<longrightarrow> (S4 rmhist p)$ \\<and> unchanged (e p, c p, r p, rmhist!p)\"\n  apply clarsimp\n  apply (drule WriteS4 [action_use])\n   apply assumption\n  apply split_idle\n  apply (auto simp: ImpNext_def dest!: S4EnvUnch [temp_use] S4ClerkUnch [temp_use]\n    S4RPCUnch [temp_use])\n     apply (auto simp: square_def dest: S4Write [temp_use])\n  done\n\nlemma Step2_2: \"\\<turnstile>   (\\<forall>p. ImpNext p)\n         \\<and> (\\<forall>p. [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n         \\<and> (\\<forall>p. $ImpInv rmhist p)\n         \\<and> [\\<exists>q. Write rmCh mm ires q l]_(mm!l)\n         \\<longrightarrow> [\\<exists>q. Write memCh mm (resbar rmhist) q l]_(mm!l)\"\n  apply (auto intro!: squareCI elim!: squareE)\n  apply (assumption | rule exI Step1_4_4b [action_use])+\n    apply (force intro!: WriteS4 [temp_use])\n   apply (auto dest!: Step2_2a [temp_use])\n  done\n\nlemma Step2_lemma: \"\\<turnstile> \\<box>(  (\\<forall>p. ImpNext p)\n            \\<and> (\\<forall>p. [HNext rmhist p]_(c p, r p, m p, rmhist!p))\n            \\<and> (\\<forall>p. $ImpInv rmhist p)\n            \\<and> [\\<exists>q. Write rmCh mm ires q l]_(mm!l))\n         \\<longrightarrow> \\<box>[\\<exists>q. Write memCh mm (resbar rmhist) q l]_(mm!l)\"\n  by (force elim!: STL4E [temp_use] dest!: Step2_2 [temp_use])\n\nlemma Step2: \"\\<turnstile> #l \\<in> #MemLoc \\<and> (\\<forall>p. IPImp p \\<and> HistP rmhist p)\n         \\<longrightarrow> MSpec memCh mm (resbar rmhist) l\"\n  apply (auto simp: MSpec_def)\n   apply (force simp: IPImp_def MSpec_def)\n  apply (auto intro!: Step2_lemma [temp_use] simp: split_box_conj [temp_use] all_box [temp_use])\n     prefer 4\n     apply (force simp: IPImp_def MSpec_def)\n    apply (auto simp: split_box_conj [temp_use] elim!: allE dest!: GoodImpl [temp_use])\n  done\n\n(* ----------------------------- Main theorem --------------------------------- *)\nsection \"Memory implementation\"\n\n(* The combination of a legal caller, the memory clerk, the RPC component,\n   and a reliable memory implement the unreliable memory.\n*)\n\n(* Implementation of internal specification by combination of implementation\n   and history variable with explicit refinement mapping\n*)\nlemma Impl_IUSpec: \"\\<turnstile> Implementation \\<and> Hist rmhist \\<longrightarrow> IUSpec memCh mm (resbar rmhist)\"\n  by (auto simp: IUSpec_def Implementation_def IPImp_def MClkISpec_def\n    RPCISpec_def IRSpec_def Hist_def intro!: Step1 [temp_use] Step2 [temp_use])\n\n(* The main theorem: introduce hiding and eliminate history variable. *)\nlemma Implementation: \"\\<turnstile> Implementation \\<longrightarrow> USpec memCh\"\n  apply clarsimp\n  apply (frule History [temp_use])\n  apply (auto simp: USpec_def intro: eexI [temp_use] Impl_IUSpec [temp_use]\n    MI_base [temp_use] elim!: eexE)\n  done\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/TLA/Memory/MemoryImplementation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.679178699175393, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.30521790489477835}}
{"text": "(* Title:  Containers/Equal.thy\n   Author: Andreas Lochbihler, KIT *)\n\ntheory Equal imports Main begin\n\nsection \\<open>Locales to abstract over HOL equality\\<close>\n\nlocale equal_base = fixes equal :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\"\n\nlocale equal = equal_base +\n  assumes equal_eq: \"equal = (=)\"\nbegin\n\nlemma equal_conv_eq: \"equal x y \\<longleftrightarrow> x = y\"\nby(simp add: equal_eq)\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Containers/Equal.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3051849809932951}}
{"text": "(*\nTitle: WHATandWHERE-Security\nAuthors: Sylvia Grewe, Alexander Lux, Heiko Mantel, Jens Sauer\n*)\ntheory MWLs\nimports Strong_Security.Types\nbegin\n\n\\<comment> \\<open>type parameters not instantiated:\\<close>\n\\<comment> \\<open>'exp: expressions (arithmetic, boolean...)\\<close>\n\\<comment> \\<open>'val: numbers, boolean constants....\\<close>\n\\<comment> \\<open>'id: identifier names\\<close>\n\n\\<comment> \\<open>SYNTAX\\<close>\n\ndatatype ('exp, 'id) MWLsCom\n  = Skip \"nat\" (\"skip\\<^bsub>_\\<^esub>\" [50] 70)\n  | Assign \"'id\" \"nat\" \"'exp\"\n       (\"_:=\\<^bsub>_\\<^esub> _\" [70,50,70] 70)\n\n  | Seq \"('exp, 'id) MWLsCom\"\n         \"('exp, 'id) MWLsCom\"\n       (\"_;_\" [61,60] 60)\n\n  | If_Else \"nat\" \"'exp\" \"('exp, 'id) MWLsCom\"\n         \"('exp, 'id) MWLsCom\"\n       (\"if\\<^bsub>_\\<^esub> _ then _ else _ fi\" [50,80,79,79] 70)\n\n  | While_Do \"nat\" \"'exp\" \"('exp, 'id) MWLsCom\"\n       (\"while\\<^bsub>_\\<^esub> _ do _ od\" [50,80,79] 70)\n\n  | Spawn \"nat\" \"(('exp, 'id) MWLsCom) list\"\n       (\"spawn\\<^bsub>_\\<^esub> _\" [50,70] 70)\n\n\\<comment> \\<open>function for obtaining the program point of some MWLsloc command\\<close>\nprimrec pp ::\"('exp, 'id) MWLsCom \\<Rightarrow> nat\"\nwhere\n\"pp (skip\\<^bsub>\\<iota>\\<^esub>) = \\<iota>\" |\n\"pp (x :=\\<^bsub>\\<iota>\\<^esub> e) = \\<iota>\" |\n\"pp (c1;c2) = pp c1\" |\n\"pp (if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi) = \\<iota>\" |\n\"pp (while\\<^bsub>\\<iota>\\<^esub> b do c od) = \\<iota>\" |\n\"pp (spawn\\<^bsub>\\<iota>\\<^esub> V) = \\<iota>\"\n\n\\<comment> \\<open>mutually recursive functions to collect program points of commands and thread pools\\<close>\nprimrec PPc :: \"('exp,'id) MWLsCom \\<Rightarrow> nat list\"\nand PPV :: \"('exp,'id) MWLsCom list \\<Rightarrow> nat list\"\nwhere\n\"PPc (skip\\<^bsub>\\<iota>\\<^esub>) = [\\<iota>]\" |\n\"PPc (x :=\\<^bsub>\\<iota>\\<^esub> e) = [\\<iota>]\" |\n\"PPc (c1;c2) = (PPc c1) @ (PPc c2)\" |\n\"PPc (if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi) =  [\\<iota>] @ (PPc c1) @ (PPc c2)\" |\n\"PPc (while\\<^bsub>\\<iota>\\<^esub> b do c od) = [\\<iota>] @ (PPc c)\" |\n\"PPc (spawn\\<^bsub>\\<iota>\\<^esub> V) = [\\<iota>] @ (PPV V)\" |\n\n\"PPV [] = []\" |\n\"PPV (c#V) = (PPc c) @ (PPV V)\"\n\n\\<comment> \\<open>predicate indicating that a command only contains unique program points\\<close>\ndefinition unique_PPc :: \"('exp, 'id) MWLsCom \\<Rightarrow> bool\"\nwhere\n\"unique_PPc c = distinct (PPc c)\"\n\n\\<comment> \\<open>predicate indicating that a thread pool only contains unique program points\\<close>\ndefinition unique_PPV :: \"('exp, 'id) MWLsCom list \\<Rightarrow> bool\"\nwhere\n\"unique_PPV V = distinct (PPV V)\"\n\nlemma PPc_nonempt: \"PPc c \\<noteq> []\"\n  by (induct c) auto\n\nlemma unique_c_uneq: \"set (PPc c) \\<inter> set (PPc c') = {} \\<Longrightarrow> c \\<noteq> c'\"\n  by (insert PPc_nonempt, force)\n\nlemma V_nonempt_PPV_nonempt: \"V \\<noteq> [] \\<Longrightarrow> PPV V \\<noteq> []\"\n  by (auto, induct V, simp_all, insert PPc_nonempt, force)\n\nlemma unique_V_uneq:\n\"\\<lbrakk>V \\<noteq> []; V' \\<noteq> []; set (PPV V) \\<inter> set (PPV V') = {}\\<rbrakk> \\<Longrightarrow> V \\<noteq> V'\"\n  by (auto, induct V, simp_all, insert V_nonempt_PPV_nonempt, auto)\n\nlemma PPc_in_PPV: \"c \\<in> set V \\<Longrightarrow> set (PPc c) \\<subseteq> set (PPV V)\"\n  by (induct V, auto)\n\nlemma listindices_aux: \"i < length V \\<Longrightarrow> (V!i) \\<in> set V\"\n  by (metis nth_mem)\n\nlemma PPc_in_PPV_version:\n  \"i < length V \\<Longrightarrow> set (PPc (V!i)) \\<subseteq> set (PPV V)\"\n  by (rule PPc_in_PPV, erule listindices_aux)\n\nlemma uniPPV_uniPPc: \"unique_PPV V \\<Longrightarrow> (\\<forall>i < length V. unique_PPc (V!i))\"\n  by (auto, simp add: unique_PPV_def, induct V,\n    auto simp add: unique_PPc_def,\n    metis in_set_conv_nth length_Suc_conv set_ConsD)\n\n\\<comment> \\<open>SEMANTICS\\<close>\n\nlocale MWLs_semantics =\nfixes E :: \"('exp, 'id, 'val) Evalfunction\"\nand BMap :: \"'val \\<Rightarrow> bool\"\nbegin\n\n\\<comment> \\<open>steps semantics, set of deterministic steps from commands to program states\\<close>\ninductive_set\nMWLsSteps_det ::\n  \"('exp, 'id, 'val, ('exp, 'id) MWLsCom) TLSteps\"\nand MWLslocSteps_det' ::\n  \"('exp, 'id, 'val, ('exp, 'id) MWLsCom) TLSteps_curry\"\n(\"(1\\<langle>_,/_\\<rangle>) \\<rightarrow>\\<lhd>_\\<rhd>/ (1\\<langle>_,/_\\<rangle>)\" [0,0,0,0,0] 81)\nwhere\n\"\\<langle>c1,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>c2,m2\\<rangle> \\<equiv> ((c1,m1),\\<alpha>,(c2,m2)) \\<in> MWLsSteps_det\" |\nskip: \"\\<langle>skip\\<^bsub>\\<iota>\\<^esub>,m\\<rangle> \\<rightarrow>\\<lhd>[]\\<rhd> \\<langle>None,m\\<rangle>\" |\nassign: \"(E e m) = v \\<Longrightarrow>\n  \\<langle>x :=\\<^bsub>\\<iota>\\<^esub> e,m\\<rangle> \\<rightarrow>\\<lhd>[]\\<rhd> \\<langle>None,m(x := v)\\<rangle>\" |\nseq1: \"\\<langle>c1,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>None,m'\\<rangle> \\<Longrightarrow>\n  \\<langle>c1;c2,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>Some c2,m'\\<rangle>\" |\nseq2: \"\\<langle>c1,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>Some c1',m'\\<rangle> \\<Longrightarrow>\n  \\<langle>c1;c2,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>Some (c1';c2),m'\\<rangle>\" |\niftrue: \"BMap (E b m) = True \\<Longrightarrow>\n  \\<langle>if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi,m\\<rangle> \\<rightarrow>\\<lhd>[]\\<rhd> \\<langle>Some c1,m\\<rangle>\" |\niffalse: \"BMap (E b m) = False \\<Longrightarrow>\n  \\<langle>if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi,m\\<rangle> \\<rightarrow>\\<lhd>[]\\<rhd> \\<langle>Some c2,m\\<rangle>\" |\nwhiletrue: \"BMap (E b m) = True \\<Longrightarrow>\n  \\<langle>while\\<^bsub>\\<iota>\\<^esub> b do c od,m\\<rangle> \\<rightarrow>\\<lhd>[]\\<rhd> \\<langle>Some (c;(while\\<^bsub>\\<iota>\\<^esub> b do c od)),m\\<rangle>\" |\nwhilefalse: \"BMap (E b m) = False \\<Longrightarrow>\n  \\<langle>while\\<^bsub>\\<iota>\\<^esub> b do c od,m\\<rangle> \\<rightarrow>\\<lhd>[]\\<rhd> \\<langle>None,m\\<rangle>\" |\nspawn: \"\\<langle>spawn\\<^bsub>\\<iota>\\<^esub> V,m\\<rangle> \\<rightarrow>\\<lhd>V\\<rhd> \\<langle>None,m\\<rangle>\"\n\ninductive_cases MWLsSteps_det_cases:\n\"\\<langle>skip\\<^bsub>\\<iota>\\<^esub>,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle>\"\n\"\\<langle>x :=\\<^bsub>\\<iota>\\<^esub> e,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle>\"\n\"\\<langle>c1;c2,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle>\"\n\"\\<langle>if\\<^bsub>\\<iota>\\<^esub> b then c1 else c2 fi,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle>\"\n\"\\<langle>while\\<^bsub>\\<iota>\\<^esub> b do c od,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle>\"\n\"\\<langle>spawn\\<^bsub>\\<iota>\\<^esub> V,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle>\"\n\n\\<comment> \\<open>non-deterministic, possibilistic system step (added for intuition, not used in the proofs)\\<close>\ninductive_set\nMWLsSteps_ndet ::\n  \"('exp, 'id, 'val, ('exp, 'id) MWLsCom) TPSteps\"\nand MWLsSteps_ndet' ::\n  \"('exp, 'id, 'val, ('exp, 'id) MWLsCom) TPSteps_curry\"\n(\"(1\\<langle>_,/_\\<rangle>) \\<Rightarrow>/ (1\\<langle>_,/_\\<rangle>)\" [0,0,0,0] 81)\nwhere\n\"\\<langle>V,m\\<rangle> \\<Rightarrow> \\<langle>V',m'\\<rangle> \\<equiv> ((V,m),(V',m')) \\<in> MWLsSteps_ndet\" |\nstepthreadi1: \"\\<langle>ci,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>None,m'\\<rangle> \\<Longrightarrow>\n  \\<langle>cf @ [ci] @ ca,m\\<rangle> \\<Rightarrow> \\<langle>cf @ \\<alpha> @ ca,m'\\<rangle>\" |\nstepthreadi2: \"\\<langle>ci,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>Some c',m'\\<rangle> \\<Longrightarrow>\n  \\<langle>cf @ [ci] @ ca,m\\<rangle> \\<Rightarrow> \\<langle>cf @ [c'] @ \\<alpha> @ ca,m\\<rangle>\"\n\n\n\\<comment> \\<open>lemma about existence and uniqueness of next memory of a step\\<close>\nlemma nextmem_exists_and_unique:\n\"\\<exists>m' p \\<alpha>. \\<langle>c,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle>\n  \\<and> (\\<forall>m''. (\\<exists>p \\<alpha>. \\<langle>c,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m''\\<rangle>) \\<longrightarrow> m'' = m')\"\n  by (induct c, auto, metis MWLsSteps_det.skip MWLsSteps_det_cases(1),\n    metis MWLsSteps_det_cases(2) MWLsSteps_det.assign,\n    metis (no_types) MWLsSteps_det.seq1 MWLsSteps_det.seq2\n    MWLsSteps_det_cases(3) not_Some_eq,\n    metis MWLsSteps_det.iffalse MWLsSteps_det.iftrue\n    MWLsSteps_det_cases(4),\n    metis MWLsSteps_det.whilefalse MWLsSteps_det.whiletrue\n    MWLsSteps_det_cases(5),\n    metis MWLsSteps_det.spawn MWLsSteps_det_cases(6))\n\nlemma PPsc_of_step:\n\"\\<lbrakk> \\<langle>c,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle>; \\<exists>c'. p = Some c' \\<rbrakk>\n  \\<Longrightarrow> set (PPc (the p)) \\<subseteq> set (PPc c)\"\n  by (induct rule: MWLsSteps_det.induct, auto)\n\nlemma PPs\\<alpha>_of_step:\n\"\\<langle>c,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle>\n  \\<Longrightarrow> set (PPV \\<alpha>) \\<subseteq> set (PPc c)\"\n  by (induct rule: MWLsSteps_det.induct, auto)\n\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/WHATandWHERE_Security/MWLs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3051849809932951}}
{"text": "(*  Title:       Jive Data and Store Model\n    Author:      Norbert Schirmer <schirmer at informatik.tu-muenchen.de>  and  \n                 Nicole Rauch <rauch at informatik.uni-kl.de>, 2005\n    Maintainer:  Nicole Rauch <rauch at informatik.uni-kl.de>\n    License:     LGPL\n*)\n\nheader {* Program-Independent Lemmas on Attributes *}\n\ntheory AttributesIndep\nimports \"../Isa_Counter_Store/Attributes\"\nbegin\n\ntext {* The following lemmas validate the functions defined in the Attributes theory.\nThey also aid in subsequent proving tasks. Since they are\nprogram-independent, it is of no use to add them to the generation process of\nAttributes.thy. Therefore, they have been extracted to this theory.\n*}\n\nlemma cls_catt [simp]: \n  \"CClassT c \\<le> dtype f \\<Longrightarrow> cls (catt c f) = c\"\n  apply (case_tac c)\n  apply (case_tac [!] f)\n  apply simp_all\n   --{* solves all goals where @{text \"CClassT c \\<le> dtype f\"} *}\n  apply (fastforce elim: subtype_wrong_elims simp add: subtype_defs)+\n   --{* solves all the rest where @{text \"\\<not> CClassT c \\<le> dtype f\"} can be derived\n     *}\n  done\n\nlemma att_catt [simp]: \n  \"CClassT c \\<le> dtype f \\<Longrightarrow> att (catt c f) = f\"\n  apply (case_tac c)\n  apply (case_tac [!] f)\n  apply simp_all\n   --{* solves all goals where @{text \"CClassT c \\<le> dtype f\"} *}\n  apply (fastforce elim: subtype_wrong_elims simp add: subtype_defs)+\n   --{* solves all the rest where @{text \"\\<not> CClassT c \\<le> dtype f\"} can be \n        derived *}\n  done\n\ntext {* The following lemmas are just a demonstration of simplification. *}\n\nlemma rtype_att_catt: \n  \"CClassT c \\<le> dtype f \\<Longrightarrow> rtype (att (catt c f)) = rtype f\"\n  by simp\n\nlemma widen_cls_dtype_att [simp,intro]: \n  \"(CClassT (cls cf) \\<le> dtype (att cf)) \"\n  by (cases cf, simp_all)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JiveDataStoreModel/Isabelle_Store/AttributesIndep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621764862150634, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.305184973029092}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory longlong\nimports \"../CTranslation\"\nbegin\n\ninstall_C_file \"longlong.c\"\n\nML {* NameGeneration.return_var_name (Absyn.Signed Absyn.LongLong) *}\n\n\ncontext longlong\nbegin\n\nthm f_body_def\nthm shifts1_body_def\nthm shifts2_body_def\n\nlemma \"(ucast :: 16 word \\<Rightarrow> 8 word) 32768 = 0\"\napply simp\ndone\n\nlemma \"(scast :: 16 word \\<Rightarrow> 8 word) 32768 = 0\"\nby simp\n\nlemma \"(scast :: 16 word \\<Rightarrow> 8 word) 65535 = 255\"\nby simp\n\nlemma \"(ucast :: 16 word \\<Rightarrow> 8 word) 65535 = 255\"\nby simp\n\nlemma \"(ucast :: 16 word \\<Rightarrow> 8 word) 32767 = 255\" by simp\nlemma \"(scast :: 16 word \\<Rightarrow> 8 word) 32767 = 255\" by simp\n\nlemma \"(scast :: 8 word \\<Rightarrow> 16 word) 255 = 65535\" by simp\nlemma \"(ucast :: 8 word \\<Rightarrow> 16 word) 255 = 255\" by simp\n\nlemma g_result:\n  \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== CALL callg() \\<lbrace> \\<acute>ret__int = 0 \\<rbrace>\"\napply vcg\napply (simp add: max_word_def)\ndone\n\nthm literals_body_def\n\nlemma literals_result:\n  \"\\<Gamma> \\<turnstile> \\<lbrace> True \\<rbrace> \\<acute>ret__int :== CALL literals() \\<lbrace> \\<acute>ret__int = 31 \\<rbrace>\"\napply vcg\napply simp\ndone\n\nend (* context *)\n\nend (* theory *)\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/c-parser/testfiles/longlong.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5428632683808533, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.305184972677776}}
{"text": "           (*-------------------------------------------*\n            |                DFP package                |\n            |                    May 2005               |\n            |               December 2005  (modified)   |\n            |                                           |\n            |   DFP on CSP-Prover ver.3.0               |\n            |              September 2006  (modified)   |\n            |                  April 2007  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2016         |\n            |                    May 2016  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory DFP_Block\nimports DFP_Deadlock\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite (notick | t = []t)                 *)\n(*                                                                     *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*****************************************************************\n\n         1. \n         2. \n         3. \n         4. \n\n *****************************************************************)\n\n(*********************************************************\n                    definitions\n *********************************************************)\n\ndefinition\n  triple_disjoint :: \"('i,'a) NetworkF => bool\"\n  where\n  triple_disjoint_def :\n    \"triple_disjoint VF == \n       (ALL i: fst VF. ALL j: fst VF. ALL k: fst VF. i ~= j & j ~= k & k ~= i\n          --> (snd ((snd VF) i) Int snd ((snd VF) j) Int snd ((snd VF) k) = {}))\"\n\ndefinition\n  VocabularyOf :: \"('i,'a) NetworkF => 'a set\"\n  where\n  VocabularyOf_def : \n    \"VocabularyOf VF == \n     Union {X. EX i: fst VF. EX j: fst VF. i ~= j &\n               X = snd((snd VF) i) Int snd((snd VF) j)}\"\n    (* internal communication *)\n\ndefinition  \n  BusyNetworkP :: \"('i,'p,'a) Network => bool\"\n  where\n  BusyNetworkP_def : \n    \"BusyNetworkP V == \n     ALL i: fst V. DeadlockFreeNetwork ({i}, snd V)\"\n  \ndefinition  \n  BusyNetwork  :: \"('i,'a) NetworkF => bool\"\n  where\n  BusyNetwork_def : \n    \"BusyNetwork VF == \n     ALL i: fst VF. (ALL sigma. ~(sigma isDeadlockStateOf ({i}, snd VF)))\"\n\ndefinition\n  isRequestOf :: \"('i,'a) NetworkF => 'i => ('i,'a) net_state => 'i => bool\"\n     (\"(1_ >> /(0_ (1/--[_]-->) /_))\" [800, 800,100,800] 900)\n  where\n  isRequestOf_def :\n    \"VF >> i --[sigma]--> j == \n        sigma isStateOf VF & \n        i ~= j & i : fst VF & j : fst VF &\n        (Ev ` (snd (snd VF i)) - (snd sigma) i) Int \n         Ev ` (snd (snd VF j)) ~= {}\"\n\ndefinition\n  isStrongRequestOf :: \"('i,'a) NetworkF => 'i => ('i,'a) net_state => 'i => bool\"\n     (\"(1_ >> /(0_ (1/==[_]==>) /_))\" [800, 800,100,800] 900)\n  where\n  isStrongRequestOf_def :\n    \"VF >> i ==[sigma]==> j == \n        sigma isStateOf VF & \n        i ~= j & i : fst VF & j : fst VF &\n        Ev ` (snd (snd VF i)) - (snd sigma) i ~= {} &\n        Ev ` (snd (snd VF i)) - (snd sigma) i <= Ev ` (snd (snd VF j))\"\n\ndefinition\n  isUngrantedRequestOf ::\n      \"('i,'a) NetworkF => 'i => ('i,'a) net_state => 'i => bool\"\n      (\"(1_ >> /(0_ (1/--[_]-->o) /_))\" [800, 800,0,800] 900)\n  where\n  isUngrantedRequestOf_def :\n    \"VF >> i --[sigma]-->o j == VF >> i --[sigma]--> j &\n        Ev ` (snd (snd VF i)) Int Ev ` (snd (snd VF j))\n        <= (snd sigma) i Un (snd sigma) j\"\n  \ndefinition\n  isUngrantedStrongRequestOf ::\n      \"('i,'a) NetworkF => 'i => ('i,'a) net_state => 'i => bool\"\n      (\"(1_ >> /(0_ (1/==[_]==>o) /_))\" [800, 800,0,800] 900)\n  where\n  isUngrantedStrongRequestOf_def :\n    \"VF >> i ==[sigma]==>o j == VF >> i ==[sigma]==> j &\n        Ev ` (snd (snd VF i)) Int Ev ` (snd (snd VF j))\n        <= (snd sigma) i Un (snd sigma) j\"\n\ndefinition\n  isUngrantedRequestOfwrt ::\n      \"('i,'a) NetworkF => 'i => ('i,'a) net_state => 'a set => 'i => bool\"\n      (\"(1_ >> /(0_ (1/--[(0_,/_)]-->o) /_))\" [800, 800,0,0,800] 900)\n  where\n  isUngrantedRequestOfwrt_def :\n    \"VF >> i --[sigma,Lambda]-->o j == VF >> i --[sigma]-->o j &\n        ((Ev ` (snd (snd VF i))) - (snd sigma) i) Un\n        ((Ev ` (snd (snd VF j))) - (snd sigma) j) <= Ev ` Lambda\"\n\n(*** Block ***)\n\ndefinition\n  isBlockedIn ::\n      \"('i,'a) NetworkF => 'i => ('i,'a) net_state => bool\"\n      (\"(_ >> _ isBlockedIn _)\" [800, 800, 800] 900)\n  where\n  isBlockedIn_def :\n    \"VF >> i isBlockedIn sigma == \n          triple_disjoint VF &\n          (EX j. VF >> i --[sigma]--> j) &\n          (ALL j. VF >> i --[sigma]--> j\n          --> (VF >> i --[sigma, (VocabularyOf VF)]-->o j))\"\n\n(*********************************************************\n                  BusyNetwork lemmas\n *********************************************************)\n\nlemma BusyNetwork_BusyNetworkP :\n    \"[| I ~= {} ; finite I ; (I,FXf) isFailureOf (I,PXf) |]\n     ==> BusyNetwork (I,FXf) = BusyNetworkP (I,PXf)\"\napply (simp add: BusyNetwork_def)\napply (simp add: BusyNetworkP_def)\napply (rule)\n\n apply (rule ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"({i}, FXf) isFailureOf ({i}, PXf)\")\n apply (simp add: DeadlockFree_notDeadlockState)\n apply (rule isFailureOf_subset_index)\n apply (simp)\n apply (simp)\n\n apply (rule ballI)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (subgoal_tac \"({i}, FXf) isFailureOf ({i}, PXf)\")\n apply (simp add: DeadlockFree_notDeadlockState)\n apply (rule isFailureOf_subset_index)\n apply (simp)\n apply (simp)\ndone\n\n(*-----------------------------------*\n |     How to check BusyNetworkF     |\n *-----------------------------------*)\n\nlemma check_BusyNetwork:\n   \"[| ALL i:I. ALL s Y. (s, Y) : fst (FXf i) --> Y ~= Ev ` (snd (FXf i)) |]\n    ==> BusyNetwork (I,FXf)\"\napply (simp add: BusyNetwork_def)\napply (intro allI ballI)\napply (rename_tac s Yf)\napply (drule_tac x=\"i\" in bspec, simp)\n\napply (simp add: isDeadlockStateOf_def)\napply (simp add: disj_not1)\napply (intro impI)\napply (simp add: isStateOf_def)\napply (drule_tac x=\"s rest-tr (snd (FXf i))\" in spec)\napply (drule_tac x=\"Yf i\" in spec)\napply (simp)\napply (simp add: ALP_def)\ndone\n\n(*********************************************************\n                     in index I\n *********************************************************)\n\nlemma in_index_I1:\n  \"(I, FXf) >> i --[sigma]--> j ==> i : I & j : I & i ~= j\"\nby (simp add: isRequestOf_def)\n\nlemma in_index_I2:\n  \"(I, FXf) >> i ==[sigma]==> j ==> i : I & j : I & i ~= j\"\nby (simp add: isStrongRequestOf_def)\n\nlemma in_index_I3:\n  \"(I, FXf) >> i --[sigma]-->o j ==> i : I & j : I & i ~= j\"\napply (simp add: isUngrantedRequestOf_def)\napply (elim conjE)\nby (simp add: in_index_I1)\n\nlemma in_index_I4:\n  \"(I, FXf) >> i ==[sigma]==>o j ==> i : I & j : I & i ~= j\"\napply (simp add: isUngrantedStrongRequestOf_def)\napply (elim conjE)\nby (simp add: in_index_I2)\n\nlemma in_index_I5:\n  \"(I, FXf) >> i --[sigma,Lambda]-->o j ==> i : I & j : I & i ~= j\"\napply (simp add: isUngrantedRequestOfwrt_def)\napply (elim conjE)\nby (simp add: in_index_I3)\n\nlemmas in_index_I = in_index_I1 in_index_I2 in_index_I3 in_index_I4 in_index_I5\n\n(*********************************************************\n                       note (P.7)\n *********************************************************)\n\nlemma isUngrantedRequestOfwrt_note1:\n  \"[| Lambda1 <= Lambda2 ; VF >> i --[sigma,Lambda1]-->o j |]\n   ==> VF >> i --[sigma,Lambda2]-->o j\"\napply (simp add: isUngrantedRequestOfwrt_def)\nby (blast)\n\nlemma isUngrantedRequestOfwrt_note2:\n  \"(snd (snd VF i)) Un (snd (snd VF j)) <= Lambda\n   ==> (VF >> i --[sigma,Lambda]-->o j) = (VF >> i --[sigma]-->o j)\"\nby (auto simp add: isUngrantedRequestOfwrt_def)\n\n(*********************************************************\n                     sub request\n *********************************************************)\n\nlemma isRequestOf_subsetI:\n  \"[| (I, FXf) >> i --[(t,Yf)]--> j; J <= I; i:J ; j:J ; \n      X = Union {snd (FXf i)|i. i:J} |]\n   ==> (J, FXf) >> i --[(t rest-tr X,Yf)]--> j\"\napply (simp add: isRequestOf_def)\napply (rule isStateOf_subsetI)\napply (simp_all)\ndone\n\nlemma isStrongRequestOf_subsetI:\n  \"[| (I, FXf) >> i ==[(t,Yf)]==> j; J <= I; i:J ; j:J ; \n      X = Union {snd (FXf i)|i. i:J} |]\n   ==> (J, FXf) >> i ==[(t rest-tr X,Yf)]==> j\"\napply (simp add: isStrongRequestOf_def)\napply (rule isStateOf_subsetI)\napply (simp_all)\ndone\n\nlemma isUngrantedRequestOf_subsetI:\n  \"[| (I, FXf) >> i --[(t,Yf)]-->o j; J <= I; i:J ; j:J ; \n      X = Union {snd (FXf i)|i. i:J} |]\n   ==> (J, FXf) >> i --[(t rest-tr X,Yf)]-->o j\"\napply (simp add: isUngrantedRequestOf_def)\napply (rule isRequestOf_subsetI)\napply (simp_all)\ndone\n\nlemma isUngrantedStrongRequestOf_subsetI:\n  \"[| (I, FXf) >> i ==[(t,Yf)]==>o j; J <= I; i:J ; j:J ; \n      X = Union {snd (FXf i)|i. i:J} |]\n   ==> (J, FXf) >> i ==[(t rest-tr X,Yf)]==>o j\"\napply (simp add: isUngrantedStrongRequestOf_def)\napply (rule isStrongRequestOf_subsetI)\napply (simp_all)\ndone\n\nlemma isUngrantedRequestOfwrt_subsetI:\n  \"[| (I, FXf) >> i --[(t,Yf), Lambda1]-->o j; J <= I; i:J ; j:J ; \n      Lambda1 <= Lambda2 ; X = Union {snd (FXf i)|i. i:J} |]\n   ==> (J, FXf) >> i --[(t rest-tr X,Yf), Lambda2]-->o j\"\napply (simp add: isUngrantedRequestOfwrt_def)\napply (rule conjI)\napply (rule isUngrantedRequestOf_subsetI)\napply (simp_all)\napply (blast)\ndone\n\n(*********************************************************\n                      blocked\n *********************************************************)\n\n(*---------------------------------*\n | lemma 1 [Roscoe_Dathi_1987 P.7] |\n *---------------------------------*)\n\n(*** only if ***)\n\nlemma Lemma1_Roscoe_Dathi_1987_only_if:\n  \"[| triple_disjoint (I,FXf) ; BusyNetwork (I,FXf) ; \n      (t,Yf) isDeadlockStateOf (I,FXf) |]\n   ==> ALL i:I. (I,FXf) >> i isBlockedIn (t,Yf)\"\napply (intro ballI)\napply (subgoal_tac \"ALL i:I. Yf i <= (Ev ` (snd (FXf i)))\")\n apply (simp only: isBlockedIn_def)\n  apply (rule conjI)\n  apply (simp)\n  apply (rule conjI)\n\n (* 1 *)\n\n (* busy --> i is deadlock-free *)\n  apply (simp add: isRequestOf_def)\n  apply (simp add: BusyNetwork_def)\n  apply (drule_tac x=\"i\" in bspec, simp)\n\n  (* i is deadlock-free --> EX j *)\n  apply (rule conjI)\n  apply (simp add: isDeadlockStateOf_def)\n\n  apply (simp add: isDeadlockStateOf_def)\n  apply (simp add: disj_not1)\n  apply (elim conjE)\n  apply (drule_tac x=\"t rest-tr (snd (FXf i))\" in spec)\n  apply (drule_tac x=\"Yf\" in spec)\n  apply (simp add: isStateOf_each_element)\n  apply (simp add: ALP_def)\n\n  apply (subgoal_tac \"EX a: Ev ` snd (FXf i). a ~: Yf i\")\n                                                  (* ... sub 1 *)\n   apply (elim bexE)\n   apply (subgoal_tac \"a : Ev ` {a. EX i:I. a : snd (FXf i)}\")\n                                                  (* ... sub 2 *)\n    apply (rotate_tac 4)\n    apply (drule sym)\n    apply (simp)\n    apply (elim conjE exE)\n    apply (simp)\n    apply (rule_tac x=\"ia\" in exI)\n    apply (case_tac \"i = ia\", simp)\n    apply (simp)\n    apply (drule_tac x=\"ia\" in bspec, simp)\n    apply (blast)\n   (* sub 2 *)\n   apply (blast)\n  (* sub 1 *)\n  apply (blast)\n\n(* 2 *) \n apply (intro allI impI)\n apply (unfold isUngrantedRequestOfwrt_def)\n apply (rule conjI)\n\n (* 2-1 *)\n  apply (simp add: isUngrantedRequestOf_def)\n  apply (rule)\n\n  apply (subgoal_tac \"x : Union {Yf i |i. i : I}\")\n   apply (simp)\n   apply (elim conjE bexE exE)\n   apply (case_tac \"ia = i\", simp)\n   apply (case_tac \"ia = j\", simp)\n   (* ia ~= i & ia ~= j ==> contradict with triple_dijoint *)\n   apply (drule_tac x=\"ia\" in bspec, simp)\n   apply (simp add: isDeadlockStateOf_def isStateOf_def)\n   apply (simp add: triple_disjoint_def)\n   apply (drule_tac x=\"i\" in bspec, simp)\n   apply (drule_tac x=\"j\" in bspec, simp add: isRequestOf_def)\n   apply (drule_tac x=\"ia\" in bspec, simp)\n    apply (drule mp)\n    apply (simp add: isRequestOf_def)\n   apply (rotate_tac -1)\n   apply (erule contrapos_pp)\n   apply (blast)\n\n  apply (simp add: isDeadlockStateOf_def)\n  apply (simp add: ALP_def)\n  apply (simp add: image_iff)\n  apply (elim conjE bexE, simp)\n  apply (rule_tac x=\"i\" in bexI)\n  apply (simp)\n  apply (simp)\n\n (* 2-2 *)\n  apply (rule)\n  apply (simp add: VocabularyOf_def)\n  apply (subgoal_tac \"x : Union {Yf i |i. i : I}\")\n\n   apply (simp)\n   apply (elim conjE bexE exE)\n   apply (simp add: image_iff)\n   apply (elim disjE conjE bexE)\n\n    apply (case_tac \"i = ia\", simp)\n    apply (drule_tac x=\"ia\" in bspec, simp)\n    apply (simp add: isDeadlockStateOf_def isStateOf_def)\n    apply (rule_tac x=\"snd (FXf i) Int snd (FXf ia)\" in exI)\n    apply (rule conjI)\n     apply (rule_tac x=\"i\" in bexI)\n     apply (rule_tac x=\"ia\" in bexI)\n     apply (simp)\n     apply (simp)\n     apply (simp)\n     apply (blast)\n\n    apply (case_tac \"j = ia\", simp)\n    apply (drule_tac x=\"ia\" in bspec, simp)\n    apply (simp add: isDeadlockStateOf_def isStateOf_def)\n    apply (rule_tac x=\"snd (FXf j) Int snd (FXf ia)\" in exI)\n    apply (rule conjI)\n     apply (rule_tac x=\"j\" in bexI)\n     apply (rule_tac x=\"ia\" in bexI)\n     apply (simp)\n     apply (simp)\n     apply (simp add: isRequestOf_def)\n     apply (blast)\n\n  apply (simp add: isDeadlockStateOf_def)\n  apply (simp add: ALP_def)\n  apply (simp add: image_iff)\n  apply (elim disjE conjE bexE)\n\n   apply (rule_tac x=\"xa\" in exI)\n   apply (simp)\n   apply (fast)\n\n   apply (rule_tac x=\"xa\" in exI)\n   apply (simp)\n   apply (rule_tac x=\"j\" in bexI)\n   apply (simp)\n   apply (simp add: isRequestOf_def)\n\napply (simp add: isDeadlockStateOf_def)\napply (simp add: isStateOf_def)\ndone\n\n(*** if ***)\n\nlemma Lemma1_Roscoe_Dathi_1987_if:\n  \"[| triple_disjoint (I,FXf) ; BusyNetwork (I,FXf) ; \n      (t,Yf) isStateOf (I,FXf) ;\n      ALL i:I. (I,FXf) >> i isBlockedIn (t,Yf) |]\n   ==> (t,Yf) isDeadlockStateOf (I,FXf)\"\napply (simp add: isDeadlockStateOf_def)\napply (simp add: ALP_def)\napply (rule)\n\n (* <= *)\n apply (rule)\n apply (simp)\n apply (elim exE conjE)\n apply (simp)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (simp add: isStateOf_def)\n apply (elim conjE)\n apply (drule_tac x=\"i\" in bspec, simp)\n apply (simp add: ALP_def)\n apply (force)\n\n (* => *)\n apply (rule)\n apply (simp)\n apply (simp only: isBlockedIn_def)\n apply (simp add: image_iff)\n apply (elim conjE exE bexE)\n apply (simp)\n\n apply (case_tac \"Ev xa : Yf i\")\n  apply (rule_tac x=\"Yf i\" in exI)\n  apply (fast)\n\n (* Ev xa ~: Yf i *)\n  apply (subgoal_tac \"xa : VocabularyOf (I,FXf)\")\n   apply (simp add: VocabularyOf_def)\n   apply (elim conjE exE bexE)\n   apply (simp)\n\n   apply (case_tac \"ia = i\")\n    apply (simp)\n    apply (drule_tac x=\"i\" in bspec, simp)\n    apply (elim conjE exE)\n\n    apply (drule_tac x=\"j\" in spec)\n    apply (drule mp)\n    apply (simp add: isRequestOf_def)\n    apply (blast)\n\n    apply (simp add: isUngrantedRequestOfwrt_def)\n    apply (simp add: isUngrantedRequestOf_def)\n    apply (rule_tac x=\"Yf j\" in exI)\n    apply (fast)\n\n   apply (case_tac \"j = i\")\n    apply (simp)\n    apply (drule_tac x=\"i\" in bspec, simp)\n    apply (elim conjE exE)\n     apply (drule_tac x=\"ia\" in spec)\n     apply (drule mp)\n     apply (simp add: isRequestOf_def)\n     apply (blast)\n\n     apply (simp add: isUngrantedRequestOfwrt_def)\n     apply (simp add: isUngrantedRequestOf_def)\n     apply (rule_tac x=\"Yf ia\" in exI)\n     apply (fast)\n\n   (* ia ~= i; j ~= i; ia ~= j, but xa : snd (PXf i), ... *)\n   apply (simp add: triple_disjoint_def)\n   apply (drule_tac x=\"i\" in bspec, simp)\n   apply (rotate_tac -1)\n   apply (drule_tac x=\"ia\" in bspec, simp)\n   apply (rotate_tac -1)\n   apply (drule_tac x=\"j\" in bspec, simp)\n   apply (fast)\n\n  (* xa : VocabularyOf VF *)\n   apply (drule_tac x=\"i\" in bspec, simp)\n   apply (elim exE conjE)\n   apply (drule_tac x=\"xb\" in spec)\n   apply (simp add: isUngrantedRequestOfwrt_def)\n   apply (fast)\ndone\n\nlemma Lemma1_Roscoe_Dathi_1987:\n  \"[| triple_disjoint (I,FXf) ; BusyNetwork (I,FXf) ; \n      (t,Yf) isStateOf (I,FXf) |]\n   ==> (t,Yf) isDeadlockStateOf (I,FXf)\n       = (ALL i:I. (I,FXf) >> i isBlockedIn (t,Yf))\"\napply (rule)\napply (simp add: Lemma1_Roscoe_Dathi_1987_only_if)\napply (simp add: Lemma1_Roscoe_Dathi_1987_if)\ndone\n\n(****************** to add it again ******************)\n\ndeclare disj_not1   [simp]\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/DFP/DFP_Block.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.66192288918838, "lm_q2_score": 0.46101677931231594, "lm_q1q2_score": 0.30515755852673}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Auto_Separation_Algebra\nimports \"AutoCorres\" \"../../lib/sep_algebra/Separation_Algebra\"\nkeywords \"sep_instance\" :: thy_goal\nbegin\n\n\nlemmas sep_conj_def = Separation_Algebra.sep_algebra_class.sep_conj_def\n\ninstantiation \"unit\" ::  stronger_sep_algebra\n   begin\n       definition \"zero_unit \\<equiv> ()\"\n       definition \"plus_unit  \\<equiv> (\\<lambda>h2 h2.  ()) :: unit \\<Rightarrow> unit \\<Rightarrow> unit\"\n       definition \"sep_disj_unit \\<equiv>(\\<lambda>h1 h2. True) :: unit \\<Rightarrow> unit \\<Rightarrow> bool\"\n     instance\n apply (default)\n   apply (clarsimp simp: zero_unit_def plus_unit_def sep_disj_unit_def)+\n done\nend\n\ninstantiation \"bool\" ::  stronger_sep_algebra\n   begin\n       definition \"zero_bool \\<equiv> False\"\n       definition \"plus_bool  \\<equiv> (op \\<or>)\"\n       definition \"sep_disj_bool \\<equiv> \\<lambda>p q. p \\<longrightarrow> \\<not>q\"\n     instance\n apply (default)\n   apply (auto simp: zero_bool_def plus_bool_def sep_disj_bool_def)+\n done\nend\n\n instantiation \"fun\" :: (type,stronger_sep_algebra) stronger_sep_algebra\n begin\n  definition \"zero_fun   \\<equiv> (\\<lambda>x. 0)\"\n  definition \"plus_fun f f'  \\<equiv> (\\<lambda>x. if f x = 0 then f' x else f x)\"\n  definition \"sep_disj_fun   \\<equiv> (\\<lambda>f f'.  \\<forall>x. (f x = 0 \\<or> f' x = 0)) :: ('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> bool \"\n instance\n  apply default\n       apply (fastforce simp: zero_fun_def sep_disj_fun_def plus_fun_def)+\n  apply (clarsimp simp: zero_fun_def sep_disj_fun_def plus_fun_def, safe)\n     apply (fastforce)+\n  done   \nend\n\n\nML {* \ntype sep_info =\n{\n  plus_thm : thm option,\n  disj_thm : thm option,\n  zero_thm : thm option,\n  sep_thms : thm list,\n  sep_heap_arrows : (term * thm) Typtab.table,\n  sep_heap_getters : (term * thm) Typtab.table,\n  sep_heap_setters : (term * thm) Typtab.table\n}\n\nfun mk_sep_info (plus_thm : thm option) (disj_thm : thm option) (zero_thm : thm option) \n  (sep_heap_arrows : (term * thm) Typtab.table) (sep_heap_getters :  (term * thm) Typtab.table)\n  ( sep_heap_setters : (term * thm) Typtab.table) (sep_thms : thm list) =\n  {plus_thm = plus_thm, \n   disj_thm = disj_thm,\n   zero_thm = zero_thm,\n   sep_thms = sep_thms,\n   sep_heap_arrows = sep_heap_arrows,\n   sep_heap_getters = sep_heap_getters, \n   sep_heap_setters = sep_heap_setters}\n*}\n\nML {*\n\nfun upd_plus_thm (sep_info : sep_info) plus = \n  {plus_thm = plus, \n   disj_thm = #disj_thm sep_info,\n   zero_thm = #zero_thm sep_info,\n   sep_thms = #sep_thms sep_info,\n   sep_heap_arrows = #sep_heap_arrows sep_info,\n   sep_heap_getters = #sep_heap_getters sep_info, \n   sep_heap_setters = #sep_heap_setters sep_info}\n\nfun upd_disj_thm (sep_info : sep_info) disj = \n  {plus_thm = #plus_thm sep_info, \n   disj_thm = disj,\n   zero_thm = #zero_thm sep_info,\n   sep_thms = #sep_thms sep_info,\n   sep_heap_arrows = #sep_heap_arrows sep_info,\n   sep_heap_getters = #sep_heap_getters sep_info, \n   sep_heap_setters = #sep_heap_setters sep_info}\n\nfun upd_zero_thm (sep_info : sep_info) zero = \n  {plus_thm = #plus_thm sep_info, \n   disj_thm = #disj_thm sep_info,\n   zero_thm = zero,\n   sep_thms = #sep_thms sep_info,\n   sep_heap_arrows = #sep_heap_arrows sep_info,\n   sep_heap_getters = #sep_heap_getters sep_info, \n   sep_heap_setters = #sep_heap_setters sep_info}\n\nfun upd_heap_arrows (sep_info : sep_info) arr = \n  {plus_thm = #plus_thm sep_info, \n   disj_thm = #disj_thm sep_info,\n   zero_thm = #zero_thm sep_info,\n   sep_heap_arrows = arr,\n   sep_thms = #sep_thms sep_info,\n   sep_heap_getters = #sep_heap_getters sep_info, \n   sep_heap_setters = #sep_heap_setters sep_info}\n\nfun upd_heap_getters (sep_info : sep_info) getters = \n  {plus_thm = #plus_thm sep_info, \n   disj_thm = #disj_thm sep_info,\n   zero_thm = #zero_thm sep_info,\n   sep_heap_arrows = #sep_heap_arrows sep_info,\n   sep_heap_getters = getters, \n   sep_thms = #sep_thms sep_info,\n   sep_heap_setters = #sep_heap_setters sep_info}\n\nfun upd_heap_setters (sep_info : sep_info) setters = \n  {plus_thm = #plus_thm sep_info, \n   disj_thm = #disj_thm sep_info,\n   zero_thm = #zero_thm sep_info,\n   sep_thms = #sep_thms sep_info,\n   sep_heap_arrows = #sep_heap_arrows sep_info,\n   sep_heap_getters = #sep_heap_getters sep_info, \n   sep_heap_setters = setters}\n\nfun upd_thms (sep_info : sep_info) thms = \n  {plus_thm = #plus_thm sep_info, \n   disj_thm = #disj_thm sep_info,\n   zero_thm = #zero_thm sep_info,\n   sep_thms = thms,\n   sep_heap_arrows = #sep_heap_arrows sep_info,\n   sep_heap_getters = #sep_heap_getters sep_info, \n   sep_heap_setters = #sep_heap_setters sep_info\n  }\n\n*}\n\nML {* val print_type = dest_Type #> fst *}\n\nML {* fun mk_lifted_globals_record stateT rvals ctxt =\n  let \n      val xs =  rvals \n      val state_t = \"lifted_globals_ext\" |> Syntax.read_term ctxt \n  in\n  betapplys (state_t, xs)\n  |> Syntax.check_term ctxt\nend;\n *}\n                                  \nML {* \nval get_data = HeapInfo.get #> Symtab.lookup;\n\n*}\n\n\nML{*\nfun zero_lifted_globals subT global_types heap_types  =\n  let fun make_zero_heap heap_type = (@{mk_term \"(\\<lambda>(_ :: ?'T ptr). arbitrary_zero :: (?'T))\" ('T)} heap_type)\n      fun make_zero_valid_heap heap_type = (@{mk_term \"(\\<lambda>_. False) ::  ?'T ptr \\<Rightarrow> bool\" ('T)} heap_type)\n      fun make_zero global_type = @{mk_term \"arbitrary_zero :: ?'T\" ('T)} global_type\n  in\n  map make_zero global_types @\n  map make_zero_heap heap_types @ \n  map make_zero_valid_heap heap_types @\n  [@{term \"0\\<^sub>? :: 'b\"}] |>\n  mk_lifted_globals_record subT\nend;\n\nval make_conj = @{mk_term \"?P \\<and> ?Q\" (P, Q)}\n\nval make_conj_list = foldr1 make_conj;\n\nfun get_more ctxt t = \"lifted_globals.more\" |> Syntax.read_term ctxt \n*}\n\n\ndeclare [[ML_print_depth=1000]]\n\nML {*\nfun promote subT (Const (str, typ))  =   Const (str, subT --> (typ |> range_type)); \n*}\n\nML {*\n\nfun sep_disj_lifted_globals ctxt subT heap_types heap_valid_getters h1 h2 =\nlet\n  fun make_valid_disjoint heap_type  =\n     let val heap_valid_getter = Typtab.lookup heap_valid_getters heap_type |> the |> Const |> promote subT\n         (* val heap_valid_getter' = Const (fst heap_valid_getter, subT  --> (heap_valid_getter |> snd |> range_type)) *)\n     in\n      @{mk_term \"(\\<lambda> l r. ?f l  ## (?f r)) \" (f)} (heap_valid_getter) $ h1 $ h2  \n     end; \n  val typ =  subT |> dest_Type |> snd |> hd;\n  val more = get_more ctxt subT \n  (* val more_disjoint = @{mk_term \"\\<lambda>(f :: ?'T => ?'M :: stronger_sep_algebra) (l:: ?'T) (r :: ?'T ).\n               (f l) ## (f r)\" ('T, 'M)} (subT, typ) $ more $ h1 $ h2 *)\n  val is_valid_disjoint = map make_valid_disjoint heap_types\nin\n  make_conj_list is_valid_disjoint\nend;\n*}\n\n\nML {* fun setup_heap_zero stateT heap_type global_types sep_info ctxt  =\nlet\n  val (_, thm, ctxt) = Utils.define_const_args \"zero_lifted_globals_ext\" false (zero_lifted_globals stateT global_types heap_type ctxt) [] ctxt\nin\n  (upd_zero_thm sep_info (SOME thm), ctxt)\nend *}\n\nML {* fun setup_heap_disj stateT heap_types heap_valid_getters sep_info ctxt  =\nlet\n  val term = sep_disj_lifted_globals ctxt stateT heap_types heap_valid_getters (Free (\"s0\", stateT)) (Free (\"s1\", stateT))\n  val (_, thm, ctxt') = Utils.define_const_args \"sep_disj_lifted_globals_ext\" false (term) [(\"s0\", stateT), (\"s1\", stateT)] ctxt\nin\n  (upd_disj_thm sep_info (SOME thm), ctxt')\nend *}\n\n\n\nML{*\nfun plus_lifted_globals ctxt subT global_names global_getters heap_types heap_getters heap_valid_getters h1 h2 =\nlet\n\n fun make_global_plus global_name = \n  let val global_getter = global_name |> Symtab.lookup global_getters |> the |> snd |> promote subT\n      \n       in @{mk_term \"\\<lambda>l r. arbitrary_add (?f l) (?f r)\"(f)} global_getter $ h1 $ h2 end;\n\n fun make_heap_plus heap_type  =\n  let val heap_getter = heap_type |> Typtab.lookup heap_getters |> the |> Const |> promote subT\n      val heap_valid_getter = heap_type |> Typtab.lookup heap_valid_getters |> the |> Const |> promote subT\n   in\n   (@{mk_term\n       \"\\<lambda>l r.\n        \\<lambda>x.  if ?valid l x then ?heap l x else if ?valid r x then ?heap r x else\n             arbitrary_add ( ?heap l x) ( ?heap r x) \" (heap, valid)} \n              (heap_getter, heap_valid_getter) $ h1 $ h2)\n  end;\n\n fun make_heap_valid_plus heap_type =  \n    let val heap_valid_getter = heap_type |> Typtab.lookup heap_valid_getters |> the |> Const |> promote subT\n    in   \n    (@{mk_term \"\\<lambda>l r.\n      (?valid l) + (?valid r)\" (valid)} heap_valid_getter $ h1 $ h2)\n    end;\n val typ =  subT |> dest_Type |> snd |> hd;\n val more = get_more ctxt subT\n\nin\n   map make_global_plus global_names @\n   map make_heap_plus heap_types @\n   map make_heap_valid_plus heap_types  @ \n  [(@{mk_term \"\\<lambda>l r.\n               arbitrary_add (?f l) (?f r)\" (f)} (more) $ h1 $ h2)]  |>\n   mk_lifted_globals_record subT      \nend;\n\n*}\n\nML {* \nfun setup_heap_plus stateT global_names global_getters heap_types heap_getters heap_valid_getters sep_info ctxt =\nlet\n  val term = (plus_lifted_globals ctxt stateT global_names global_getters heap_types \n              heap_getters heap_valid_getters (Free (\"s0\", stateT)) (Free (\"s1\", stateT)) ctxt)\n  val (_, thm, ctxt') = Utils.define_const_args \"plus_lifted_globals_ext\" false term\n                          [(\"s0\", stateT), (\"s1\", stateT)] ctxt\nin\n  (upd_plus_thm sep_info (SOME thm), ctxt')\nend; \n\n\n*}\n\nML {* \n   \n   fun make_arrow stateT heap_type heap_getters heap_valid_getters p v=\n      let \n          val heap_getter = heap_type |> Typtab.lookup heap_getters |> the |> Const \n          val heap_valid  = heap_type |> Typtab.lookup heap_valid_getters |> the |> Const\n        in\n           @{mk_term \"\\<lambda>p v s. ?h s p = v \\<and> ?v' s p\" (h, v')} \n             (heap_getter, heap_valid) $ p $ v\n    end;\n   \n    fun split_on _ [] = [] |\n        split_on f (x::xs) = if f x then xs else split_on f xs ;\n    \n    filter;\n\n  fun hds s = String.substring (s,0,1)\n    \n   fun setup_arrows stateT heap_types heap_getters heap_valid_getters sep_info ctxt =\n    let \n         val (arrowt, _, ctxt') =  Utils.define_const_args \"sep_generic_arrow\" true\n                               (@{mk_term \"undefined :: (?'h ptr => ?'h => ?'T \\<Rightarrow> bool)\" ('T, 'h) } (stateT, @{typ 'h})) [] ctxt\n         val ctxt'' = Local_Theory.notation true Syntax.mode_default [(arrowt, Infixl (\"\\<mapsto>s\", 50))] ctxt'\n        fun setup_arrow (heap_type,(sep_info,ctxt)) =\n         let \n          val pointer = (Free (\"p\", Utils.gen_typ @{typ \"'a ptr\"} [heap_type]))  \n          val value = (Free (\"v\", heap_type))\n          val term = (make_arrow stateT heap_type heap_getters heap_valid_getters pointer value)\n          val arr_name = \"sep_map_\" ^  HeapLiftBase.name_from_type heap_type\n          val arrow = \"\\<mapsto>\"  ^ (HeapLiftBase.name_from_type heap_type |> hds)   \n          val fix = Infixl (arrow, 50)\n          val (t , thm, ctxt') = Utils.define_const_args arr_name false term \n               [(\"p\", Utils.gen_typ @{typ \"'a ptr\"} [heap_type]) ,  (\"v\", heap_type) ] ctxt\n          val ctxt'' = Local_Theory.notation true Syntax.mode_default [(t , fix)] ctxt'\n          val genarrowstr = arrowt |> dest_Const |> fst\n          val sep_info = sep_info |> #sep_heap_arrows |> Typtab.update (heap_type, (t,thm)) |> upd_heap_arrows sep_info \n          in                \n           (sep_info, ctxt'' |>\n           Local_Theory.declaration {syntax = true, pervasive = false} (K (Adhoc_Overloading.generic_add_overloaded genarrowstr )) |>\n           Local_Theory.declaration {syntax = true, pervasive = false} (K (Adhoc_Overloading.generic_add_variant genarrowstr t))) \n         end;                    \n      in foldr setup_arrow (sep_info,ctxt'') heap_types\n   end;\n                          \n*}\n\nML {* Utils.expand_type_abbrevs; @{theory}; Proof_Context.theory_of;*}\n\nML {* fun liberalise_type _ (Type (s,[])) = (s,[]) |> Type |\n          liberalise_type t (Type (s,(xs))) = if (Long_Name.base_name s) = \"lifted_globals_ext\" then\n                                               (Type (s, t :: (tl xs))) else \n                                               (Type (s, map (liberalise_type t) (xs)));\n*}\n                                                          \nML {*                                                                                        \n\nfun make_rewrite heap_getters heap_setters heap_type sep_info ctxt = \n     let \n         val heap_getter  = heap_type |> Typtab.lookup heap_getters |> the |> Const  \n         val heap_setter  = heap_type |> Typtab.lookup heap_setters |> the |> Const\n         val get_heap_term = @{mk_term \"gets (\\<lambda>s. ?f s p) \" (f)} (heap_getter) \n         val set_heap_term = @{mk_term \"modify (?f (\\<lambda>a. a(p := v)))\" (f)} heap_setter \n         val (t, thy, ctxt) = Utils.define_const_args (\"get_\" ^ (HeapLiftBase.name_from_type heap_type)) false get_heap_term [(\"p\", Utils.gen_typ @{typ \"'a ptr\"} [heap_type])] ctxt\n         val (t', thy', ctxt) = Utils.define_const_args (\"set_\" ^ (HeapLiftBase.name_from_type heap_type)) false set_heap_term [(\"p\", Utils.gen_typ @{typ \"'a ptr\"} [heap_type]), (\"v\", heap_type)] ctxt\n         val localise_term =  @{mk_term \"modify (\\<lambda>s. ?f (\\<lambda>a. a(p:= f s)) (s)) \\<equiv> do v <- gets f; ?g p v od\" (f,g)} (heap_setter, t')   \n         val localise_simps = @{thms modify_def gets_def put_def fun_upd_def get_def return_def bind_def }                                \n         val localise_term' = @{mk_term \"Trueprop (modify (\\<lambda>s. ?f (\\<lambda>a. a(p:= f a s)) s) = do a <- gets (\\<lambda>s. f (?h s) s); ?g p a od)\" (f,h,g)} (heap_setter, heap_getter, t')       \n         val prove_localise = force_tac                             \n                          (ctxt addsimps localise_simps addsimps [thy'])          \n         val localise_thm = Goal.prove ctxt [\"f\", \"p\"] [] localise_term (fn _ => prove_localise 1)      \n         val localise'_thm = Goal.prove ctxt [\"f\", \"p\"] [] localise_term' (fn _ => prove_localise 1)\n         val sep_info =  sep_info |> #sep_thms |> (fn x => x @ [localise_thm, localise'_thm, Thm.symmetric thy,Thm.symmetric thy']) |> upd_thms sep_info\n         val sep_info =  sep_info |> #sep_heap_getters |> Typtab.update (heap_type, (t,thy)) |> upd_heap_getters sep_info\n         val sep_info =  sep_info |> #sep_heap_setters |> Typtab.update (heap_type, (t',thy')) |> upd_heap_setters sep_info                                             \n    in                                                                                              \n        (sep_info, ctxt)                \nend;                                                                                         \n\n\n*}\n\nML {*\nUtils.named_cterm_instantiate;     \n\nfun make_struct_rewrite (structs : HeapLiftBase.struct_info list) sep_info ctxt =  \n   let \n       val structs = structs |> map #field_info |> List.concat     \n       fun make_struct_rewrite_inner strct =    \n       let val getter = strct |> #getter \n           val setter = strct |> #setter           \n           val getter_rewrite_term = @{mk_term \"Trueprop (gets (\\<lambda>s. ?P (f s) ) = \n                                                          do c <- gets f; \n                                                             return (?P c )         \n                                                          od )\" (P)} getter             \n           val getter_rewrite_term' = @{mk_term \"Trueprop (gets (\\<lambda>s a. ?P (f s) ) = \n                                                           do c <- gets f; \n                                                           return (\\<lambda>a. ?P c ) od )\" (P)} getter             \n           val setter_rewrite_term = @{mk_term \"Trueprop (gets (\\<lambda>s . ?P (f s) (g s)) =\n                                                          do c <- gets f;\n                                                             d <- gets g;      \n                                                             return ( ?P c d )              \n                                                          od )\" (P)} setter            \n          val setter_rewrite_term' = @{mk_term \"Trueprop (gets (\\<lambda>s a . ?P (f s) (g s)) =\n                                               do c <- gets f;\n                                                  d <- gets g;      \n                                                  return (\\<lambda>a. ?P c d )         \n                                               od )\" (P)} setter       \n           val getter_rewrite = Goal.prove ctxt [\"f\"] [] getter_rewrite_term (fn _ => Skip_Proof.cheat_tac ctxt 1)      \n           val getter_rewrite' = Goal.prove ctxt [\"f\"] [] getter_rewrite_term' (fn _ => Skip_Proof.cheat_tac ctxt 1)            \n           val setter_rewrite = Goal.prove ctxt [\"f\", \"g\"] [] setter_rewrite_term (fn _ => Skip_Proof.cheat_tac ctxt 1)\n           val setter_rewrite' = Goal.prove ctxt [\"f\", \"g\"] [] setter_rewrite_term' (fn _ => Skip_Proof.cheat_tac ctxt 1)                                                                                              \n       in [setter_rewrite,setter_rewrite', getter_rewrite, getter_rewrite'] end; \n     fun upd_sep_info_list info xs = info |> #sep_thms |> (fn x => x @ xs) |> upd_thms info              \n   in map make_struct_rewrite_inner structs |> List.concat |> upd_sep_info_list sep_info\nend;                                                                         \n                                                                                \nfun make_rewrites heap_types heap_getters heap_setters structs sep_info ctxt =          \n  let \n    val (sep_info, ctxt) = foldr (fn (htype, (info, ctxt)) => (make_rewrite heap_getters heap_setters htype info ctxt) ) (sep_info,ctxt) heap_types \n    val sep_info = (make_struct_rewrite structs sep_info ctxt)\n    val thms= sep_info |> #sep_thms        \n  in                                                    \n     (sep_info, Utils.define_lemmas \"sep_thms\" thms ctxt |> snd )          \nend;                                         \n*}                                                            \n             \nML {* val myss = ref HOL_basic_ss *}\nML {* val mythm = ref @{thms iffI} *}\n\nML {* fun prove_get_leaf_lemma heap_type ((sep_info : sep_info),  ctxt) =\n          let\n              val (heap_getter, heap_getter_def) = heap_type |> Typtab.lookup (#sep_heap_getters sep_info) |> the\n              val (heap_arrow, heap_arrow_def) = heap_type |> Typtab.lookup (#sep_heap_arrows sep_info) |> the\n              val plus_thm = sep_info |> #plus_thm |> the \n              val proof_term = @{mk_term  \n                                 \" Trueprop (\n                                 \\<lbrace>\\<lambda>s. (?arr p x \\<and>* R) s\\<rbrace>\n                                              ?getter p \n                                 \\<lbrace>\\<lambda>rv. pred_conj (?arr p x \\<and>* R) ( K (rv = x))\\<rbrace> )\" (arr,getter)} \n                                (heap_arrow, heap_getter)\n               val thms =  [@{thm sep_conj_def},\n                            @{thm pred_conj_def},\n                            heap_getter_def, heap_arrow_def, plus_thm]\n               val name = heap_getter |> dest_Const |> fst |> Long_Name.base_name\n               fun proof_tac ctxt = fast_force_tac (ctxt addsimps thms)\n               val get_wp = Goal.prove ctxt [\"x\", \"p\",\"R\"] [] proof_term (fn _ => proof_tac ctxt 1)                \n       in (sep_info, Utils.define_lemma (name ^ \"_wp\") get_wp ctxt |> snd) end;  *}\n\n\nML {* \n      fun prove_update_heap_lemma (heap_arrow, heap_arrow_def) heap_update  ctxt =\n         let val proof_term = @{mk_term \"((?arr p x) s \\<Longrightarrow> (?arr p v) (?heap_update (\\<lambda>s. fun_upd s p v) s))\" (arr,heap_update)} (heap_arrow, heap_update)\n             val proof = clarsimp_tac (ctxt addsimps [heap_arrow_def])\n             in   Goal.prove ctxt [\"x\", \"p\", \"v\",\"s\"] [] proof_term (fn x => proof 1)\n      end;\n\n      fun prove_set_leaf_lemma (heap_type, heap_updater) ((sep_info : sep_info),  ctxt) =\n          let\n              val (heap_setter, heap_setter_def) = heap_type |> Typtab.lookup (#sep_heap_setters sep_info) |> the\n              val (heap_arrow, heap_arrow_def) = heap_type |> Typtab.lookup (#sep_heap_arrows sep_info) |> the\n              val disj_thm = sep_info |> #disj_thm |> the \n              val plus_thm = sep_info |> #plus_thm |> the\n              val proof_term = @{mk_term  \n                                 \" Trueprop (\n                                 \\<lbrace>\\<lambda>s. (?arr p x \\<and>* R) s\\<rbrace>\n                                              ?setter p v\n                                 \\<lbrace>\\<lambda>rv. (?arr p v \\<and>* R)\\<rbrace> )\" (arr,setter)} \n                                (heap_arrow, heap_setter)\n               val thms = @{thms fun_upd_def} @ [ heap_arrow_def, disj_thm, plus_thm]\n               val name = heap_setter |> dest_Const |> fst |> Long_Name.base_name\n               val heap_update_lemma = prove_update_heap_lemma (heap_arrow, heap_arrow_def) (heap_updater) ctxt\n               fun proof_tac ctxt = clarsimp_tac (ctxt addsimps [heap_setter_def]) THEN'\n                                    etac @{thm sep_conjE} THEN'\n                                    rtac @{thm sep_conjI} THEN' \n                                    etac heap_update_lemma THEN'\n                                    fast_force_tac (ctxt) THEN_ALL_NEW \n                                    fast_force_tac (ctxt addsimps thms)                  \n               val set_wp = Goal.prove ctxt [\"x\", \"p\",\"R\", \"v\"] [] proof_term (fn x =>  proof_tac (#context x) 1 )                \n       in (sep_info, Utils.define_lemma (name ^ \"_wp\") set_wp ctxt |> snd) end;  *}\n\nML {* \n\nfun prove_get_leaf_lemmas heap_types sep_info ctxt =\n    foldr (uncurry prove_get_leaf_lemma) (sep_info, ctxt) heap_types \n\n\nfun prove_set_leaf_lemmas heap_types sep_info ctxt = \n   foldr (uncurry prove_set_leaf_lemma) (sep_info, ctxt) heap_types \n\n*}\n                                   \nML {*                        \n   fun force_tac ctxt =\n      SELECT_GOAL\n     (Classical.clarify_tac ctxt 1 THEN\n      IF_UNSOLVED (Simplifier.asm_full_simp_tac ctxt 1) THEN\n      ALLGOALS (Classical.first_best_tac ctxt))\n   fun zipWith (x::xs) (y::ys) f = f x y :: zipWith xs ys f |\n       zipWith _ _ _ = []\n     \n    fun tester str thy =\n         let val data = get_data thy str |> the\n             val typ = data  |> #globals_type |> print_type\n             val stateT = data |> #globals_type |> dest_Type ||> (K [@{typ 'b}]) |> Type\n             val heap_types = data  |> #heap_getters |> Typtab.dest |> map fst\n             val heap_valid_getters = data  |> #heap_valid_getters\n             val heap_getters = data |> #heap_getters\n             val heap_setters = data |> #heap_setters\n             val global_types =  data |> #global_fields |> map (fn (_,_,z) => z)\n             val global_names =  data |> #global_fields |> map (fn (x,_,_) => x)\n             val global_getters = data |> #global_field_getters  \n             val structs = data |> #structs |> Symtab.dest |> map snd \n             val sep_info = mk_sep_info NONE NONE NONE Typtab.empty Typtab.empty Typtab.empty []    \n             fun tup_list (x : sep_info)\n                            = [x |> #plus_thm |> the,\n                               x |> #zero_thm |> the,\n                               x |> #disj_thm |> the]    \n             fun proof_tac thms ctxt = \n                 let \n                     val equality =  Proof_Context.get_thm ctxt \"lifted_globals.equality\" ;\n                     val simpset = ctxt addsimps @{thms sep_add_left_commute sep_disj_commute sep_add_assoc sep_add_commute \n                                                       left_commute zero_fun_def plus_fun_def sep_disj_fun_def zero_bool_def \n                                                       commute} addsimps thms\n                     val intros = [equality, @{thm ext}]\n                  in\n                         Class.default_intro_tac ctxt [] THEN \n                         ((resolve_tac ctxt intros  ORELSE' \n                           force_tac simpset ) |> REPEAT_ALL_NEW |> TRYALL)\n                end; \n      in thy\n      |>  Class.instantiation ([typ], [(\"'a\", @{sort type})], @{sort stronger_sep_algebra})\n      |>  setup_heap_zero stateT heap_types global_types sep_info\n      |-> setup_heap_disj stateT heap_types heap_valid_getters \n      |-> setup_heap_plus stateT global_names global_getters heap_types heap_getters heap_valid_getters\n      |-> setup_arrows stateT heap_types heap_getters heap_valid_getters\n      |-> make_rewrites heap_types heap_getters heap_setters structs \n      |> (fn (info, ctxt) => (info, (info,ctxt) |> (apfst (tup_list #> proof_tac) #-> Class.prove_instantiation_instance)))\n      |-> prove_get_leaf_lemmas heap_types  \n      |-> prove_set_leaf_lemmas (heap_setters |> Typtab.dest |> map (fn x => x ||> Const)) |> snd\n      end;                                              \n\nAdhoc_Overloading.is_overloaded @{context} \"\\<mapsto>\"\n*}                                                             \n\nML {*\nval _ =\n  Outer_Syntax.command @{command_keyword \"sep_instance\"} \"instantiate and prove type arity\" \n  (Parse.path >>\n   (fn str =>  tester str |> Toplevel.begin_local_theory true #> Toplevel.end_local_theory));\n\n(* get_data @{theory} \"swap.c\" |> the |> #structs *)\n*}\n\n\n\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/autocorres/Auto_Separation_Algebra.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6619228758499942, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.30515755237751024}}
{"text": "theory ArityTransformSafe\nimports ArityTransform ArityConsistent ArityAnalysisSpec ArityEtaExpansionSafe AbstractTransform ConstOn\nbegin\n\nlocale CardinalityArityTransformation = ArityAnalysisLetSafeNoCard\nbegin\n  sublocale AbstractTransformBoundSubst\n    \"\\<lambda> a . inc\\<cdot>a\"\n    \"\\<lambda> a . pred\\<cdot>a\"\n    \"\\<lambda> \\<Delta> e a . (a, Aheap \\<Delta> e\\<cdot>a)\"\n    \"fst\"\n    \"snd\"\n    \"\\<lambda> _. 0\"\n    \"Aeta_expand\"\n    \"snd\"\n  apply standard\n  apply (simp add: Aheap_subst)\n  apply (rule subst_Aeta_expand)\n  done\n\n  abbreviation ccTransform where \"ccTransform \\<equiv> transform\"\n\n  lemma supp_transform: \"supp (transform a e) \\<subseteq> supp e\"\n    by (induction rule: transform.induct)\n       (auto simp add: exp_assn.supp Let_supp dest!: set_mp[OF supp_map_transform] set_mp[OF supp_map_transform_step] )\n  interpretation supp_bounded_transform transform\n    by standard (auto simp add: fresh_def supp_transform) \n\n  fun transform_alts :: \"Arity list \\<Rightarrow> stack \\<Rightarrow> stack\"\n    where \n      \"transform_alts _ [] = []\"\n    | \"transform_alts (a#as) (Alts e1 e2 # S) = (Alts (ccTransform a e1) (ccTransform a e2)) # transform_alts as S\"\n    | \"transform_alts as (x # S) = x # transform_alts as S\"\n\n  lemma transform_alts_Nil[simp]: \"transform_alts [] S = S\"\n    by (induction  S) auto\n\n  lemma Astack_transform_alts[simp]:\n    \"Astack (transform_alts as S) = Astack S\"\n   by (induction rule: transform_alts.induct) auto\n\n  lemma fresh_star_transform_alts[intro]: \"a \\<sharp>* S \\<Longrightarrow> a \\<sharp>* transform_alts as S\"\n   by (induction as S  rule: transform_alts.induct) (auto simp add: fresh_star_Cons)\n\n  fun a_transform :: \"astate \\<Rightarrow> conf \\<Rightarrow> conf\"\n  where \"a_transform (ae, a, as) (\\<Gamma>, e, S) =\n    (map_transform Aeta_expand ae (map_transform ccTransform ae \\<Gamma>), \n     ccTransform a e,\n     transform_alts as  S)\"\n\n  fun restr_conf :: \"var set \\<Rightarrow> conf \\<Rightarrow> conf\"\n    where \"restr_conf V (\\<Gamma>, e, S) = (restrictA V \\<Gamma>, e, restr_stack V S)\"\n\n  inductive consistent :: \"astate \\<Rightarrow> conf \\<Rightarrow> bool\" where\n    consistentI[intro!]: \n    \"a_consistent (ae, a, as) (\\<Gamma>, e, S)\n    \\<Longrightarrow> (\\<And> x. x \\<in> thunks \\<Gamma> \\<Longrightarrow>  ae x = up\\<cdot>0)\n    \\<Longrightarrow> consistent (ae, a, as) (\\<Gamma>, e, S)\"  \n  inductive_cases consistentE[elim!]: \"consistent (ae, a, as) (\\<Gamma>, e, S)\"\n\n  lemma closed_consistent:\n    assumes \"fv e = ({}::var set)\"\n    shows \"consistent (\\<bottom>, 0, []) ([], e, [])\"\n  by (auto simp add: edom_empty_iff_bot closed_a_consistent[OF assms])\n\n  lemma arity_tranform_safe:\n    fixes c c'\n    assumes \"c \\<Rightarrow>\\<^sup>* c'\" and \"\\<not> boring_step c'\" and \"heap_upds_ok_conf c\" and \"consistent (ae,a,as) c\"\n    shows \"\\<exists>ae' a' as'. consistent (ae',a',as') c' \\<and> a_transform (ae,a,as) c \\<Rightarrow>\\<^sup>* a_transform (ae',a',as') c'\"\n  using assms(1,2) heap_upds_ok_invariant assms(3-)\n  proof(induction c c' arbitrary: ae a as rule:step_invariant_induction)\n  case (app\\<^sub>1 \\<Gamma> e x S)\n    from app\\<^sub>1 have \"consistent (ae, inc\\<cdot>a, as) (\\<Gamma>, e, Arg x # S)\"\n      by (auto intro: a_consistent_app\\<^sub>1)\n    moreover\n    have \"a_transform (ae, a, as) (\\<Gamma>, App e x, S) \\<Rightarrow> a_transform (ae, inc\\<cdot>a, as) (\\<Gamma>, e, Arg x # S)\"\n      by simp rule\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n  case (app\\<^sub>2 \\<Gamma> y e x S)\n    have \"consistent (ae, pred\\<cdot>a, as) (\\<Gamma>, e[y::=x], S)\" using app\\<^sub>2\n      by (auto 4 3 intro: a_consistent_app\\<^sub>2)\n    moreover\n    have \"a_transform (ae, a, as) (\\<Gamma>, Lam [y]. e, Arg x # S) \\<Rightarrow> a_transform (ae, pred \\<cdot> a, as) (\\<Gamma>, e[y::=x], S)\" by (simp add: subst_transform[symmetric]) rule\n    ultimately\n    show ?case by (blast  del: consistentI consistentE)\n  next\n  case (thunk \\<Gamma> x e S)\n    hence \"x \\<in> thunks \\<Gamma>\" by auto\n    hence [simp]: \"x \\<in> domA \\<Gamma>\" by (rule set_mp[OF thunks_domA])\n\n    from `heap_upds_ok_conf (\\<Gamma>, Var x, S)`\n    have \"x \\<notin> upds S\"  by (auto dest!: heap_upds_okE)\n    \n    have \"x \\<in> edom ae\" using thunk by auto\n    have \"ae x = up\\<cdot>0\" using thunk `x \\<in> thunks \\<Gamma>` by (auto)\n\n    have \"a_consistent (ae, 0, as) (delete x \\<Gamma>, e, Upd x # S)\" using thunk `ae x = up\\<cdot>0`\n      by (auto intro!: a_consistent_thunk_0 simp del: restr_delete)\n    hence \"consistent (ae, 0, as) (delete x \\<Gamma>, e, Upd x # S)\" using thunk `ae x = up\\<cdot>0` \n      by (auto simp add:  restr_delete_twist)\n    moreover\n  \n    from  `map_of \\<Gamma> x = Some e` `ae x = up\\<cdot>0`\n    have \"map_of (map_transform Aeta_expand ae (map_transform ccTransform ae \\<Gamma>)) x = Some (transform 0 e)\"\n      by (simp add: map_of_map_transform)\n    with `\\<not> isVal e`\n    have \"a_transform (ae, a, as) (\\<Gamma>, Var x, S) \\<Rightarrow> a_transform (ae, 0, as) (delete x \\<Gamma>, e, Upd x # S)\"\n      by (auto simp add: map_transform_delete restr_delete_twist intro!: step.intros  simp del: restr_delete)\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n  case (lamvar \\<Gamma> x e S)\n    from lamvar(1) have [simp]: \"x \\<in> domA \\<Gamma>\" by (metis domI dom_map_of_conv_domA)\n\n    have \"up\\<cdot>a \\<sqsubseteq> (Aexp (Var x)\\<cdot>a f|` (domA \\<Gamma> \\<union> upds S)) x\"\n      by (simp) (rule Aexp_Var)\n    also from lamvar have \"Aexp (Var x)\\<cdot>a f|` (domA \\<Gamma> \\<union> upds S) \\<sqsubseteq> ae\" by (auto simp add: join_below_iff env_restr_join a_consistent.simps)\n    finally\n    obtain u where \"ae x = up\\<cdot>u\" by (cases \"ae x\") (auto simp add: edom_def)\n    hence \"x \\<in> edom ae\" by (auto simp add: edomIff)\n\n    have \"a_consistent (ae, u, as) ((x,e) # delete x \\<Gamma>, e, S)\" using lamvar `ae x = up\\<cdot>u`\n      by (auto intro!: a_consistent_lamvar simp del: restr_delete)\n    hence \"consistent (ae, u, as) ((x, e) # delete x \\<Gamma>, e, S)\"\n      using lamvar by (auto simp add:  thunks_Cons restr_delete_twist elim: below_trans)\n    moreover\n\n    from `a_consistent _ _`\n    have \"Astack (transform_alts as S) \\<sqsubseteq> u\" by (auto elim: a_consistent_stackD)\n  \n    {\n    from `isVal e`\n    have \"isVal (transform u e)\" by simp\n    hence \"isVal (Aeta_expand u (transform u e))\" by (rule isVal_Aeta_expand)\n    moreover\n    from  `map_of \\<Gamma> x = Some e`  `ae x = up \\<cdot> u`  `isVal (transform u e)`\n    have \"map_of (map_transform Aeta_expand ae (map_transform transform ae \\<Gamma>)) x = Some (Aeta_expand u (transform u e))\"\n      by (simp add: map_of_map_transform)\n    ultimately\n    have \"a_transform (ae, a, as) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sup>*\n          ((x, Aeta_expand u (transform u e)) # delete x (map_transform Aeta_expand ae (map_transform transform ae \\<Gamma>)), Aeta_expand u (transform u e), transform_alts as S)\"\n       by (auto intro: lambda_var simp del: restr_delete)\n    also have \"\\<dots> = ((map_transform Aeta_expand ae (map_transform transform ae ((x,e) # delete x \\<Gamma>))), Aeta_expand u (transform u e), transform_alts as S)\"\n      using `ae x = up \\<cdot> u` `isVal (transform u e)`\n      by (simp add: map_transform_Cons map_transform_delete  del: restr_delete)\n    also(subst[rotated]) have \"\\<dots> \\<Rightarrow>\\<^sup>* a_transform (ae, u, as) ((x, e) # delete x \\<Gamma>, e, S)\"\n      by (simp add: restr_delete_twist) (rule Aeta_expand_safe[OF `Astack _ \\<sqsubseteq> u`])\n    finally(rtranclp_trans)\n    have \"a_transform (ae, a, as) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sup>* a_transform (ae, u, as) ((x, e) # delete x \\<Gamma>, e, S)\".\n    }\n    ultimately show ?case by (blast del: consistentI consistentE)\n  next\n  case (var\\<^sub>2 \\<Gamma> x e S)\n    from var\\<^sub>2\n    have \"a_consistent (ae, a, as) (\\<Gamma>, e, Upd x # S)\" by auto\n    from a_consistent_UpdD[OF this]\n    have \"ae x = up\\<cdot>0\" and \"a = 0\".\n\n    have \"a_consistent (ae, a, as) ((x, e) # \\<Gamma>, e, S)\"\n      using var\\<^sub>2 by (auto intro!: a_consistent_var\\<^sub>2)\n    hence \"consistent (ae, 0, as) ((x, e) # \\<Gamma>, e, S)\"\n      using var\\<^sub>2 `a = 0`\n      by (auto simp add: thunks_Cons elim: below_trans)\n    moreover\n    have \"a_transform (ae, a, as) (\\<Gamma>, e, Upd x # S) \\<Rightarrow> a_transform (ae, 0, as) ((x, e) # \\<Gamma>, e, S)\"\n      using `ae x = up\\<cdot>0` `a = 0` var\\<^sub>2\n      by (auto intro!: step.intros simp add: map_transform_Cons)\n    ultimately show ?case by (blast del: consistentI consistentE)\n  next\n    case (let\\<^sub>1 \\<Delta> \\<Gamma> e S)\n    let ?ae = \"Aheap \\<Delta> e\\<cdot>a\"\n  \n    have \"domA \\<Delta> \\<inter> upds S = {}\" using fresh_distinct_fv[OF let\\<^sub>1(2)] by (auto dest: set_mp[OF ups_fv_subset])\n    hence *: \"\\<And> x. x \\<in> upds S \\<Longrightarrow> x \\<notin> edom ?ae\" by (auto simp add:  dest!: set_mp[OF edom_Aheap])\n    have restr_stack_simp2: \"restr_stack (edom (?ae \\<squnion> ae)) S = restr_stack (edom ae) S\"\n      by (auto intro: restr_stack_cong dest!: *)\n\n    have \"edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S\" using let\\<^sub>1 by (auto dest!: a_consistent_edom_subsetD)\n    from set_mp[OF this] fresh_distinct[OF let\\<^sub>1(1)] fresh_distinct_fv[OF let\\<^sub>1(2)]\n    have \"edom ae \\<inter> domA \\<Delta> = {}\" by (auto dest: set_mp[OF ups_fv_subset])\n\n    {\n    { fix x e'\n      assume \"x \\<in> thunks \\<Gamma>\"\n      with let\\<^sub>1\n      have \"(?ae \\<squnion> ae) x = up\\<cdot>0\" by auto\n    }\n    moreover\n    { fix x e'\n      assume \"x \\<in> thunks \\<Delta>\" \n      hence \"(?ae \\<squnion> ae) x = up\\<cdot>0\" by (auto simp add: Aheap_heap3)\n    }\n    moreover\n    \n    have \"a_consistent (ae, a, as) (\\<Gamma>, Let \\<Delta> e, S)\"\n      using let\\<^sub>1 by auto\n    hence \"a_consistent (?ae \\<squnion> ae, a, as) (\\<Delta> @ \\<Gamma>, e, S)\"\n      using let\\<^sub>1(1,2) `edom ae \\<inter> domA \\<Delta> = {}` \n      by (auto intro!:  a_consistent_let simp del: join_comm)\n    ultimately\n    have \"consistent (?ae \\<squnion> ae, a, as) (\\<Delta> @ \\<Gamma>, e, S)\"\n      by auto\n    }\n    moreover\n    {\n      have \"\\<And> x. x \\<in> domA \\<Gamma> \\<Longrightarrow> x \\<notin> edom ?ae\"\n        using fresh_distinct[OF let\\<^sub>1(1)]\n        by (auto dest!: set_mp[OF edom_Aheap])\n      hence \"map_transform Aeta_expand (?ae \\<squnion> ae) (map_transform transform (?ae \\<squnion> ae) \\<Gamma>)\n         = map_transform Aeta_expand ae (map_transform transform ae \\<Gamma>)\"\n         by (auto intro!: map_transform_cong restrictA_cong simp add: edomIff)\n      moreover\n  \n      from `edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S`\n      have  \"\\<And> x. x \\<in> domA \\<Delta> \\<Longrightarrow> x \\<notin> edom ae\"\n         using fresh_distinct[OF let\\<^sub>1(1)] fresh_distinct_fv[OF let\\<^sub>1(2)] \n         by (auto dest!:  set_mp[OF ups_fv_subset])\n      hence \"map_transform Aeta_expand (?ae \\<squnion> ae) (map_transform transform (?ae \\<squnion> ae) \\<Delta>)\n         = map_transform Aeta_expand ?ae (map_transform transform ?ae \\<Delta>)\"\n         by (auto intro!: map_transform_cong restrictA_cong simp add: edomIff)\n      ultimately\n      \n      \n      have \"a_transform (ae, a, as) (\\<Gamma>, Let \\<Delta> e, S) \\<Rightarrow> a_transform (?ae \\<squnion> ae,  a, as) (\\<Delta> @ \\<Gamma>, e, S)\"\n        using restr_stack_simp2 let\\<^sub>1(1,2)\n        apply (auto simp add: map_transform_append restrictA_append  restr_stack_simp2[simplified] map_transform_restrA)\n        apply (rule step.let\\<^sub>1)\n        apply (auto dest: set_mp[OF edom_Aheap])\n        done\n    }\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case (if\\<^sub>1 \\<Gamma> scrut e1 e2 S)\n    have \"consistent (ae, 0, a#as) (\\<Gamma>, scrut, Alts e1 e2 # S)\"\n      using if\\<^sub>1  by (auto dest: a_consistent_if\\<^sub>1)\n    moreover\n    have \"a_transform (ae,  a, as) (\\<Gamma>, scrut ? e1 : e2, S) \\<Rightarrow> a_transform (ae, 0, a#as) (\\<Gamma>, scrut, Alts e1 e2 # S)\"\n      by (auto intro: step.intros)\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case (if\\<^sub>2 \\<Gamma> b e1 e2 S)\n    hence \"a_consistent (ae, a, as) (\\<Gamma>, Bool b, Alts e1 e2 # S)\" by auto\n    then  obtain a' as' where [simp]: \"as = a' # as'\" \"a = 0\"\n      by (rule a_consistent_alts_on_stack)\n\n    have \"consistent (ae, a', as') (\\<Gamma>, if b then e1 else e2, S)\" \n      using if\\<^sub>2 by (auto dest!: a_consistent_if\\<^sub>2)\n    moreover\n    have \"a_transform (ae, a, as) (\\<Gamma>, Bool b, Alts e1 e2 # S) \\<Rightarrow> a_transform (ae,  a', as') (\\<Gamma>, if b then e1 else e2, S)\"\n      by (auto intro: step.if\\<^sub>2[where b = True, simplified] step.if\\<^sub>2[where b = False, simplified])\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case refl thus ?case by auto\n  next\n    case (trans c c' c'')\n      from trans(3)[OF trans(5)]\n      obtain ae' a' as' where \"consistent (ae', a', as') c'\" and *: \"a_transform (ae, a, as) c \\<Rightarrow>\\<^sup>* a_transform (ae', a', as') c'\" by blast\n      from trans(4)[OF this(1)]\n      obtain ae'' a'' as'' where \"consistent (ae'', a'', as'') c''\" and **: \"a_transform (ae', a', as') c' \\<Rightarrow>\\<^sup>* a_transform (ae'', a'', as'') c''\" by blast\n      from this(1) rtranclp_trans[OF * **]\n      show ?case by blast\n  qed\nend\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Call_Arity/ArityTransformSafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160666, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3051412897040211}}
{"text": "section {* Soundness Theorems *}\n\ntheory Wasm_Soundness imports Main Wasm_Properties begin\n\ntheorem preservation:\n  assumes \"\\<turnstile>_i s;vs;es : (tr,ts)\"\n          \"\\<lparr>s;vs;es\\<rparr> a\\<leadsto>_i \\<lparr>s';vs';es'\\<rparr>\"\n  shows \"\\<turnstile>_i s';vs';es' : (tr,ts)\"\nproof -\n  obtain \\<S> where \"store_typing s \\<S>\" \"\\<S>\\<bullet>tr\\<bullet>None \\<tturnstile>_i vs;es : ts\"\n    using assms(1) config_typing.simps\n    by blast\n  hence \"store_typing s' \\<S>\" \"\\<S>\\<bullet>tr\\<bullet>None \\<tturnstile>_i vs';es' : ts\"\n    using assms(2) store_preserved types_preserved_e\n    by simp_all\n  thus ?thesis\n    using config_typing.intros\n    by blast\nqed\n\ntheorem progress:\n  assumes \"\\<turnstile>_i s;vs;es : (tr,ts)\"\n  shows \"const_list es \\<or> es = [Trap] \\<or> (\\<exists>a s' vs' es'. \\<lparr>s;vs;es\\<rparr> a\\<leadsto>_i \\<lparr>s';vs';es'\\<rparr>)\"\nproof -\n  obtain \\<S> where \"store_typing s \\<S>\" \"\\<S>\\<bullet>tr\\<bullet>None \\<tturnstile>_i vs;es : ts\"\n    using assms config_typing.simps\n    by blast\n  thus ?thesis\n    using progress_e3\n    by blast\nqed\n\nend", "meta": {"author": "PLSysSec", "repo": "ct-wasm-proofs", "sha": "3fa5c38ecda3d05c351096ba5e6d7ba1df793c21", "save_path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs", "path": "github-repos/isabelle/PLSysSec-ct-wasm-proofs/ct-wasm-proofs-3fa5c38ecda3d05c351096ba5e6d7ba1df793c21/CT-WASM_model/Wasm_Soundness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.30514128970402105}}
{"text": "theory flash68Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv68:  \n  (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_FAck ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n  fix s \n \n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma NI_InvVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Inv  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_InvAck_1VsInv68:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6,auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_InvAck_1_HomeVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_InvAck_2VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_GetXVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_Nak1VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_Nak2VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_Nak3VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX1VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX2VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX3VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX4VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX5VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX6VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX7VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX8VsInv68:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6,auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Local_GetX_PutX8_homeVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX9VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX10VsInv68:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6,auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Local_GetX_PutX10_homeVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_GetX_PutX11VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_Get_GetVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_Get_Nak1VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_Get_Nak2VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_Get_Nak3VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_Get_Put1VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_Get_Put2VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_Get_Put3VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Local_PutVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Local_PutXAcksDoneVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Local_PutXAcksDone ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_NakVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Nak  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Nak_ClearVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Nak_Clear ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Nak_HomeVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Nak_Home ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_GetX_NakVsInv68:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6,auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_GetX_Nak_HomeVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Remote_GetX_PutXVsInv68:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  a5  a6  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iRule2) )  ( Const CACHE_E ))    ( eqn ( IVar ( Para ''CacheState'' iInv2) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_Remote_Get_Nak2VsInv68:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3 a4 a5 a6,auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_Remote_Get_Put1VsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv68:  \n    (*Rule2VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iInv2 \\<le> N\" and  a5:\"iInv1~=iInv2  \" and  a6:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>iRule2=iInv2)   \\<or>(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>(iRule1=iInv2\\<and>iRule2=iInv1)   \\<or>(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  a5  a6  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>iRule2=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 )\\<and>(iRule2~=iInv1 \\<and>iRule2~=iInv2 ))\"\n\n                  have \"?P1 s \\<or> ?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  a5  a6  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_Put  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                     have allCases:\"formEval  ( eqn ( IVar ( Para ''InvMarked'' iInv2) )  ( Const true ))  s  \\<or>formEval   (neg ( eqn ( IVar ( Para ''InvMarked'' iInv2) )  ( Const true )) )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv2) )  ( Const true ))  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n\n    moreover\n                       {assume c1:\"formEval  (neg ( eqn ( IVar ( Para ''InvMarked'' iInv2) )  ( Const true )) )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately have \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutXVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  a3  a4  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( andForm ( eqn ( IVar ( Global ''ShWbMsg_proc'') )   (Const iInv1))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv2) )  ( Const UNI_PutX ))  )    ( eqn ( IVar ( Global ''ShWbMsg_Cmd'') )  ( Const SHWB_FAck ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_ReplaceVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_ReplaceHomeVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_ReplaceHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ReplaceHomeShrVldVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_ReplaceHomeShrVld ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma NI_ReplaceShrVldVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma NI_ShWbVsInv68:  \n  (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_ShWb N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof -\n  fix s \n \n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma NI_WbVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (NI_Wb ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_GetX1VsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_GetX1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_GetX2VsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_GetX2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX1VsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_PutX1 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX2VsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_PutX2 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX3VsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_PutX3 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_GetX_PutX4VsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_GetX_PutX4 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_Get_GetVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_Get_Get ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_Get_PutVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_Get_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_PutXVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_PutX ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Local_ReplaceVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Local_Replace ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  lemma PI_Remote_GetVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Remote_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma PI_Remote_GetXVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Remote_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma PI_Remote_PutXVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>(iRule1=iInv2)   \\<or>((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"(iRule1=iInv2)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 \\<and>iRule1~=iInv2 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_ReplaceVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (PI_Remote_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma StoreVsInv68:  \n    (*Rule1VsPInv2*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" and  a3:\"iInv2 \\<le> N\" and  a4:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (Store  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1  a2  a3  a4 , auto)\n lemma StoreHomeVsInv68:  \n    (*Rule0VsPInv2*)\n  assumes   a1:\"iInv1 \\<le> N\" and  a2:\"iInv2 \\<le> N\" and  a3:\"iInv1~=iInv2  \" \n\n  shows  \"invHoldForRule' s (inv68  iInv1  iInv2 ) (StoreHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by (cut_tac a1 a2 a3, auto  )\n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto\n qed\n  end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash68Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6150878414043816, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.30514128270330126}}
{"text": "theory UPPAAL_State_Networks\n  imports Networks.State_Networks TA.Normalized_Zone_Semantics UPPAAL_Asm_Clocks\nbegin\n\nchapter \\<open>Networks of Timed Automata -- UPPAAL Style\\<close>\n\nno_notation Ref.update (\"_ := _\" 62)\nno_notation fun_rel_syn (infixr \"\\<rightarrow>\" 60)\n\n (* XXX Move *)\nlemma finite_lists_boundedI:\n  assumes \"\\<forall> i < r. finite (S i)\"\n    shows \"finite {s. length s = r \\<and> (\\<forall>i<r. s ! i \\<in> S i)}\" (is \"finite ?R\")\nproof -\n  let ?S = \"\\<Union> {S i | i. i < r}\"\n  have \"?R \\<subseteq> {s. set s \\<subseteq> ?S \\<and> length s = r}\"\n    by (auto dest!: aux)\n  moreover have \"finite \\<dots>\" by (rule finite_lists_length_eq) (use assms in auto)\n  ultimately show ?thesis by (rule finite_subset)\nqed\n\nsection \\<open>Networks of Timed Automata with Shared State and UPPAAL-style Assembler guards and updates\\<close>\n\nsubsection \\<open>Syntax and Operational Semantics\\<close>\n\ntext \\<open>\n  We formalize Networks of Timed Automata with integer variable state using UPPAAL-style\n  guards and updates. The specification language for guards and updates is our formalization of\n  the UPPAAL like Assembler language.\n  We extend Networks of Timed Automata with arbitrary shared (global) state.\n  Syntactically, this extension is very simple.\n  We can just use the free action label slot to annotate edges with a guard\n  and an update function on discrete states.\n  The slightly more clumsy part is adding invariants for discrete states\n  by directly specifying an invariant annotating function.\n\\<close>\n\ntype_synonym\n  ('c, 'time, 's) invassn = \"'s \\<Rightarrow> ('c, 'time) cconstraint\"\n\ntype_synonym\n  ('a, 's) transition = \"'s * addr * 'a * addr * 's\"\n\ntype_synonym\n  ('a, 'c, 'time, 's) uta = \"('a, 's) transition set * ('c, 'time, 's) invassn\"\n\ntype_synonym\n  ('a, 'time, 's) unta =\n  \"'time programc \\<times> ('a act, nat, 'time, 's) uta list \\<times> ('s \\<Rightarrow> addr) list \\<times> (int * int) list\"\n\ndefinition\n  \"bounded bounds s \\<equiv>\n   length s = length bounds \\<and> (\\<forall> i < length s. fst (bounds ! i) < s ! i \\<and> s ! i < snd (bounds ! i))\"\n\ninductive step_u ::\n  \"('a, 't :: time, 's) unta \\<Rightarrow> nat \\<Rightarrow> 's list \\<Rightarrow> int list \\<Rightarrow> (nat, 't) cval \\<Rightarrow> 'a label\n  \\<Rightarrow> 's list \\<Rightarrow> int list \\<Rightarrow> (nat, 't) cval \\<Rightarrow> bool\"\n(\"_ \\<turnstile>\\<^sub>_ \\<langle>_, _, _\\<rangle> \\<rightarrow>\\<^bsub>_\\<^esub> \\<langle>_, _, _\\<rangle>\" [61,61,61,61,61,61] 61)\nwhere\n  step_u_t:\n    \"\\<lbrakk>\n      \\<forall> p < length N. \\<exists> pc st s' rs.\n        stepst P n (u \\<oplus> d) ((I ! p) (L ! p), [], s, True, []) (pc, st, s', True, rs);\n      \\<forall> p < length N. u \\<oplus> d \\<turnstile> snd (N ! p) (L ! p);\n      d \\<ge> 0;\n      bounded B s\n     \\<rbrakk>\n    \\<Longrightarrow> (P, N, I, B) \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Del\\<^esub> \\<langle>L, s, u \\<oplus> d\\<rangle>\" |\n  step_u_i:\n    \"\\<lbrakk>\n      stepst P n u (pc_g, [], s, True, []) (_, _, _, True, _);\n      stepst P n u (pc_u, [], s, True, []) (_, _, s', _, r);\n      \\<forall> p < length N. \\<exists> pc st s rs.\n        stepst P n u' ((I ! p) (L' ! p), [], s', True, []) (pc, st, s, True, rs);\n      (l, pc_g, Sil a, pc_u, l') \\<in> fst (N ! p);\n      \\<forall> p < length N. u' \\<turnstile> snd (N ! p) (L' ! p);\n      L!p = l; p < length L; L' = L[p := l']; u' = [r\\<rightarrow>0]u;\n      bounded B s'\n     \\<rbrakk>\n    \\<Longrightarrow> (P, N, I, B) \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Act a\\<^esub> \\<langle>L', s', u'\\<rangle>\" |\n  step_u_s:\n    \"\\<lbrakk>\n      stepst P n u (pc_g1, [], s, True, []) (_, _, _, True, _);\n      stepst P n u (pc_g2, [], s, True, []) (_, _, _, True, _);\n      stepst P n u (pc_u2, [], s, True, []) (_, _, s1, _, r2);\n      \\<comment>\\<open>XXX UPPAAL semantics quirk\\<close>\n      ((\\<exists> pc st s' f. stepst P n u (pc_u1, [], s, True, []) (pc, st, s', f, r1))\n        \\<or> (\\<not> (\\<exists> pc st s' f r'. stepst P n u (pc_u1, [], s, True, []) (pc, st, s', f, r')) \\<and> r1 = []));\n      stepst P n u (pc_u1, [], s1, True, []) ( _, _, s', _, _);\n      \\<^cancel>\\<open>stepst P n u (pc_u2, [], s1, True, []) ( _, _, s2, _, r2);\\<close>\n      \\<forall> p < length N. \\<exists> pc st s rs.\n        stepst P n u' ((I ! p) (L' ! p), [], s', True, []) (pc, st, s, True, rs);\n      (l1, pc_g1, In a, pc_u1, l1') \\<in> fst (N ! p);\n      (l2, pc_g2, Out a, pc_u2, l2') \\<in> fst (N ! q);\n      \\<forall> p < length N. u' \\<turnstile> snd (N ! p) (L' ! p);\n      L!p = l1; L!q = l2; p < length L; q < length L; p \\<noteq> q;\n      L' = L[p := l1', q := l2']; u' = [(r1 @ r2)\\<rightarrow>0]u;\n      bounded B s'\n     \\<rbrakk> \\<Longrightarrow> (P, N, I, B) \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>Syn a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n\ninductive_cases[elim!]: \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n\ninductive steps_un ::\n  \"('a, 't :: time, 's) unta \\<Rightarrow> nat \\<Rightarrow> 's list \\<Rightarrow> int list \\<Rightarrow> (nat, 't) cval\n  \\<Rightarrow> 's list \\<Rightarrow> int list \\<Rightarrow> (nat, 't) cval \\<Rightarrow> bool\"\n(\"_ \\<turnstile>\\<^sub>_ \\<langle>_, _, _\\<rangle> \\<rightarrow>* \\<langle>_, _, _\\<rangle>\" [61,61,61,61,61,61] 61)\nwhere\n  refl: \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L, s, u\\<rangle>\" |\n  step: \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle> \\<Longrightarrow> A \\<turnstile>\\<^sub>n  \\<langle>L', s', u'\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L'', s'', u''\\<rangle>\n        \\<Longrightarrow> A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L'', s'', u''\\<rangle>\"\n\ndeclare steps_un.intros[intro]\n\nlemma stepI2:\n  \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L'', s'', u''\\<rangle>\" if\n  \"A \\<turnstile>\\<^sub>n \\<langle>L', s', u'\\<rangle> \\<rightarrow>* \\<langle>L'', s'', u''\\<rangle>\" \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n  using that\n  apply induction\n   apply rule\n    apply (rule refl)\n   apply assumption\n  apply simp\n  by (rule; assumption)\n\nsubsection \\<open>Equivalent State Network Automaton\\<close>\n\n(*\nabbreviation state_set :: \"('a, 'c, 'time, 's) transition set \\<Rightarrow> 's set\" where\n  \"state_set T \\<equiv> fst ` T \\<union> (snd o snd o snd o snd) ` T\"\n*)\n\ndefinition \"stripp p \\<equiv> map_option strip o p\"\ndefinition \"stripfp p \\<equiv> map_option stripf o p\"\ndefinition \"striptp p \\<equiv> map_option stript o p\"\n\nlocale Equiv_TA_Defs =\n  fixes A :: \"('a, 't, 's) unta\"\n    and n :: nat \\<comment> \\<open>Fuel\\<close>\nbegin\n\nabbreviation \"N \\<equiv> fst (snd A)\"\nabbreviation \"P \\<equiv> fst A\"\nabbreviation \"I \\<equiv> fst (snd (snd A))\"\nabbreviation \"B \\<equiv> snd (snd (snd A))\"\nabbreviation \"P' \\<equiv> stripfp P\"\nabbreviation \"PF \\<equiv> stripfp P\"\nabbreviation \"PT \\<equiv> striptp P\"\ndefinition \"p \\<equiv> length N\"\n\ndefinition \"make_f pc_u \\<equiv> \\<lambda> s.\n  case (exec P' n (pc_u, [], s, True, []) []) of\n    None \\<Rightarrow> []\n  | Some ((_, _, _, _, r), _) \\<Rightarrow> r\"\n\ndefinition \"make_mt pc_u \\<equiv> \\<lambda> s.\n  case (exec PT n (pc_u, [], s, True, []) []) of\n    None \\<Rightarrow> None\n  | Some ((_, _, s', _, r), _) \\<Rightarrow> Some s'\"\n\ndefinition \"make_mf pc_u \\<equiv> \\<lambda> s.\n  case (exec PF n (pc_u, [], s, True, []) []) of\n    None \\<Rightarrow> None\n  | Some ((_, _, s', _, r), _) \\<Rightarrow> Some s'\"\n\ndefinition \"make_c pc_g \\<equiv> \\<lambda> s.\n  case (exec PT n (pc_g, [], s, True, []) []) of\n    None \\<Rightarrow> False\n  | Some ((_, _, _, f, _), _) \\<Rightarrow> f\"\n\ndefinition \"make_g pc_g \\<equiv> \\<lambda> s.\n  case (exec PT n (pc_g, [], s, True, []) []) of\n    None \\<Rightarrow> []\n  | Some ((_, _, _, _, _), pcs) \\<Rightarrow>\n      List.map_filter (\\<lambda> pc.\n        case P pc of\n          Some (CEXP ac) \\<Rightarrow> Some ac\n        | _ \\<Rightarrow> None\n          )\n        pcs\"\n\ndefinition \"\n  state_trans_t i \\<equiv>\n    {(l, make_g pc_g, (a, make_c pc_g, make_mf pc_u), make_f pc_u, l') | l a l' pc_g pc_u.\n      (l, pc_g, a, pc_u, l') \\<in> fst (N ! i)\n    }\n  \"\n\n  (*\ndefinition \"\n  state_trans_f i \\<equiv>\n    {(l, \\<lambda> i. [], (a, make_c pc_g, make_mf pc_u), make_f pc_u, l') | l a l' pc_g pc_u.\n      (l, pc_g, a, pc_u, l') \\<in> fst (N ! i)\n    }\n  \"\n*)\n\n(* definition \"state_trans i \\<equiv> state_trans_f i \\<union> state_trans_t i\" *)\n\nabbreviation \"state_trans \\<equiv> state_trans_t\"\n\ndefinition \"\n  state_pred i \\<equiv> \\<lambda> l s.\n    case (exec P' n ((I ! i) l, [], s, True, []) []) of\n      None \\<Rightarrow> False\n    | Some ((_, _, _, f, _), _) \\<Rightarrow> f \\<and> bounded B s\n  \"\n\ndefinition \"\n  state_inv i \\<equiv> snd (N ! i)\n\"\n\ndefinition \"\n  state_ta \\<equiv> (map (\\<lambda> p. (state_trans p, state_inv p)) [0..<p], map state_pred [0..<p])\n\"\n\nsublocale defs: Prod_TA_Defs state_ta .\n\nlemma bounded_finite:\n    \"finite {s. bounded B s}\" (is \"finite ?S\")\nproof -\n  have\n    \"?S \\<subseteq> {s. length s = length B \\<and> (\\<forall>i<length B. fst (B ! i) < s ! i \\<and> s ! i < snd (B ! i))}\"\n    unfolding bounded_def by auto\n  moreover have \"finite \\<dots>\" unfolding bounded_def using finite_lists_boundedI by force\n  ultimately show \"finite ?S\" by (rule finite_subset)\nqed\n\n(* XXX Unused *)\nlemma finite_state:\n    \"\\<forall> q < p. \\<forall> l. finite {s. (defs.P ! q) l s}\"\nproof safe\n  fix q l assume \\<open>q < p\\<close>\n  let ?S = \"{s. (defs.P ! q) l s}\"\n  from \\<open>q < p\\<close> have \"?S \\<subseteq> {s. bounded B s}\"\n    unfolding state_ta_def state_pred_def by (auto split: option.splits)\n  moreover have \"finite \\<dots>\" by (rule bounded_finite)\n  ultimately show \"finite ?S\" by (rule finite_subset)\nqed\n\nend (* End of definitions locale *)\n\nfun is_instr :: \"'t instrc \\<Rightarrow> bool\" where\n  \"is_instr (INSTR _) = True\" |\n  \"is_instr _ = False\"\n\nlemma step_stripf:\n  assumes\n    \"is_instr cmd\"\n  shows\n    \"stepc cmd u (pc, st, s, f, rs) = step (stripf cmd) (pc, st, s, f, rs)\"\nproof (cases cmd)\n  case (INSTR instr)\n  with assms(1) show ?thesis\n    by (cases instr) (auto split: option.split)\nnext\n  case (CEXP x2)\n  with assms show ?thesis by auto\nqed\n\nlemma step_stript:\n  assumes\n    \"is_instr cmd\"\n  shows\n    \"stepc cmd u (pc, st, s, f, rs) = step (stript cmd) (pc, st, s, f, rs)\"\nproof (cases cmd)\n  case (INSTR instr)\n  with assms(1) show ?thesis\n    by (cases instr) (auto split: option.split)\nnext\n  case (CEXP x2)\n  with assms show ?thesis by auto\nqed\n\n(* XXX Move? *)\nlemmas [intro] = stepsc.intros\n\nlemma stepsc_f_complete:\n  assumes\n    \"stepsc P n' u start end\"\n    \"\\<And> pc' st s' f' rs cmd.\n    stepsc P n' u start (pc', st, s', f', rs) \\<Longrightarrow> P pc' = Some cmd\n\\<Longrightarrow> is_instr cmd\"\n  shows\n    \"steps (stripfp P) n' start end\"\n  using assms proof (induction P \\<equiv> P n' u \\<equiv> u x4 \\<equiv> start \"end\" arbitrary: start rule: stepsc.induct)\n    case 1\n    then show ?case unfolding stripfp_def by auto\n  next\n    case (2 cmd pc st m f rs s n' s')\n    have \"is_instr cmd\" if\n      \"stepsc P n' u s (pc', st, s', f', rs)\" \"P pc' = Some cmd\" for pc' st s' f' rs cmd\n      using 2(1,2) that by (auto intro: 2(5))\n    with 2(4) have *: \"steps (stripfp P) n' s s'\" by auto\n    show ?case\n    proof (cases cmd)\n      case (INSTR instr)\n      with 2(1) step_stripf have\n        \"step (stripf cmd) (pc, st, m, f, rs) = Some s\"\n        by (auto split: option.split_asm)\n      with 2(1-3) 2(5-) * show ?thesis unfolding stripfp_def by auto\n    next\n      case (CEXP ac)\n      with 2 show ?thesis by fastforce\n    qed\n  qed\n\nlemma stepsc_f_sound:\n  assumes\n    \"steps (stripfp P) n' start end\"\n    \"\\<And> pc' st s' f' rs cmd.\n    stepsc P n' u start (pc', st, s', f', rs) \\<Longrightarrow> P pc' = Some cmd\n    \\<Longrightarrow> is_instr cmd\"\n  shows\n    \"stepsc P n' u start end\"\nusing assms proof (induction \"stripfp P\" n' start \"end\")\n  case (1 n start)\n  then show ?case by auto\nnext\n  case (2 instr pc st m f rs s n s')\n  from 2(2) obtain cmd where \"P pc = Some cmd\" unfolding stripfp_def by auto\n  show ?case\n  proof (cases cmd)\n    case prems: (INSTR instr)\n    with \\<open>P pc = _\\<close> 2(2) step_stripf[of cmd, symmetric] 2(1) have step:\n      \"stepc cmd u (pc, st, m, f, rs) = Some s\"\n      unfolding stripfp_def by auto\n    with \\<open>P pc = _\\<close> have \"is_instr cmd\" if\n      \"stepsc P n u s (pc', st, s', f', rs)\" \"P pc' = Some cmd\" for pc' st s' f' rs cmd\n      using that unfolding stripfp_def by (force intro: 2(5))\n    with 2(4) have \"stepsc P n u s s'\" by auto\n    with step \\<open>P pc = _\\<close> show ?thesis unfolding stripfp_def by auto\n  next\n    case prems: (CEXP ac)\n    from \\<open>P pc = _\\<close> 2(5) have \"is_instr cmd\" by blast\n    with prems show ?thesis by auto\n  qed\nqed\n\ndefinition\n  \"time_indep P n start \\<equiv>\n    \\<forall> pc' st s' f' rs cmd u.\n      stepsc P n u start (pc', st, s', f', rs) \\<and> P pc' = Some cmd\n  \\<longrightarrow> is_instr cmd\"\n\nlemma stepsc_t_complete:\n  assumes\n    \"stepsc P n' u start end\"\n    \"\\<And> pc' st s' f' rs ac.\n    stepsc P n' u start (pc', st, s', f', rs) \\<Longrightarrow> P pc' = Some (CEXP ac) \\<Longrightarrow> u \\<turnstile>\\<^sub>a ac\"\n  shows\n    \"steps (striptp P) n' start end\"\n  using assms proof (induction P \\<equiv> P n' u \\<equiv> u x4 \\<equiv> start \"end\" arbitrary: start rule: stepsc.induct)\n    case 1\n    then show ?case unfolding stripfp_def by auto\n  next\n    case (2 cmd pc st m f rs s n' s')\n    have \"u \\<turnstile>\\<^sub>a ac\" if\n      \"stepsc P n' u s (pc', st, s', f', rs)\" \"P pc' = Some (CEXP ac)\" for pc' st s' f' rs ac\n      using 2(1,2) that by (auto intro: 2(5))\n    with 2(4) have *: \"steps (striptp P) n' s s'\" by auto\n    show ?case\n    proof (cases cmd)\n      case (INSTR instr)\n      with 2(1) step_stript have\n        \"step (stript cmd) (pc, st, m, f, rs) = Some s\"\n        by (auto split: option.split_asm)\n      with 2(1-3) 2(5-) * show ?thesis unfolding striptp_def by auto\n    next\n      case (CEXP ac)\n      with 2(1-3) have \"u \\<turnstile>\\<^sub>a ac\" by (auto intro: 2(5))\n      with 2(1) have\n        \"step (stript cmd) (pc, st, m, f, rs) = Some s\"\n        using \\<open>cmd = _\\<close> by auto\n      with 2(1-3) 2(5-) * show ?thesis unfolding striptp_def by auto\n    qed\n  qed\n\nlemma stepsc_t_complete2:\n  assumes\n    \"stepsc P n' u start (pc', st', s', f', rs')\"\n    \"\\<And> pc' st s' f' rs ac.\n    stepsc P n' u start (pc', st, s', f', rs) \\<Longrightarrow> P pc' = Some (CEXP ac) \\<Longrightarrow> u \\<turnstile>\\<^sub>a ac\"\n  shows\n    \"steps (striptp P) n' start (pc', st', s', f', rs') \\<and> (\\<forall> ac. P pc' = Some (CEXP ac) \\<longrightarrow> u \\<turnstile>\\<^sub>a ac)\"\n  using assms\n  proof (induction P \\<equiv> P n' u \\<equiv> u x4 \\<equiv> start \"(pc', st', s', f', rs')\" arbitrary: start rule: stepsc.induct)\n    case 1\n    then show ?case unfolding stripfp_def by blast\n  next\n    case (2 cmd pc st m f rs s n')\n    have \"u \\<turnstile>\\<^sub>a ac\" if\n      \"stepsc P n' u s (pc', st, s', f', rs)\" \"P pc' = Some (CEXP ac)\" for pc' st s' f' rs ac\n      using 2(1,2) that by (auto intro: 2(5))\n    with 2(4) have *:\n      \"steps (striptp P) n' s (pc', st', s', f', rs')\" \"\\<forall>ac. P pc' = Some (CEXP ac) \\<longrightarrow> u \\<turnstile>\\<^sub>a ac\"\n      by auto\n    show ?case\n    proof (cases cmd)\n      case (INSTR instr)\n      with 2(1) step_stript have\n        \"step (stript cmd) (pc, st, m, f, rs) = Some s\"\n        by (auto split: option.split_asm)\n      with 2(1-3) 2(5-) * show ?thesis unfolding striptp_def by auto\n    next\n      case (CEXP ac)\n      with 2(1-3) have \"u \\<turnstile>\\<^sub>a ac\" by (auto intro: 2(5))\n      with 2(1) have\n        \"step (stript cmd) (pc, st, m, f, rs) = Some s\"\n        using \\<open>cmd = _\\<close> by auto\n      with 2(1-3) 2(5-) * show ?thesis unfolding striptp_def by auto\n    qed\n  qed\n\nlemma stepsc_t_visitedc:\n  assumes\n    \"stepsc P n' u start end\"\n    \"\\<And> pc' st s' f' rs.\n    stepsc P n' u start (pc', st, s', f', rs) \\<Longrightarrow> Q pc'\"\n  shows \"\\<exists> pcs. visitedc P n' u start end pcs\n  \\<and> (\\<forall> pc \\<in> set pcs. Q pc)\"\n  using assms by (induction) (fastforce intro!: visitedc.intros)+\n\nlemma visitedc_t_visited:\n  assumes\n    \"visitedc P n' u start end pcs\"\n    \"\\<And> pc' ac. pc' \\<in> set pcs \\<Longrightarrow> P pc' = Some (CEXP ac) \\<Longrightarrow> u \\<turnstile>\\<^sub>a ac\"\n  shows\n    \"visited (striptp P) n' start end pcs\n  \\<and> (\\<forall> pc ac. pc' \\<in> set pcs \\<and> P pc' = Some (CEXP ac) \\<longrightarrow> u \\<turnstile>\\<^sub>a ac)\"\n  using assms\n  proof (induction P \\<equiv> P n' u \\<equiv> u x4 \\<equiv> start \"end\" pcs arbitrary: start rule: visitedc.induct)\n    case 1\n    then show ?case by (auto intro: visited.intros)\n  next\n    case (2 cmd pc st m f rs s n' s' pcs)\n    have \"u \\<turnstile>\\<^sub>a ac\" if\n      \"pc' \\<in> set pcs\" \"P pc' = Some (CEXP ac)\" for pc' ac\n      using 2(1,2) that by (auto intro: 2(5))\n    with 2(4) have *:\n      \"visited (striptp P) n' s s' pcs\" \"\\<forall>pc ac. pc' \\<in> set pcs \\<and> P pc' = Some (CEXP ac) \\<longrightarrow> u \\<turnstile>\\<^sub>a ac\"\n      by auto\n    show ?case\n    proof (cases cmd)\n      case (INSTR instr)\n      with 2(1) step_stript have\n        \"step (stript cmd) (pc, st, m, f, rs) = Some s\"\n        by (auto split: option.split_asm)\n      with 2(1-3) 2(5-) * show ?thesis unfolding striptp_def by (auto intro: visited.intros)\n    next\n      case (CEXP ac)\n      with 2(1-3) have \"u \\<turnstile>\\<^sub>a ac\" by (auto intro: 2(5))\n      with 2(1) have\n        \"step (stript cmd) (pc, st, m, f, rs) = Some s\"\n        using \\<open>cmd = _\\<close> by auto\n      with 2(1-3) 2(5-) * show ?thesis unfolding striptp_def by (auto intro: visited.intros)\n    qed\n  qed\n\nlemma stepsc_t_sound:\n  assumes\n    \"steps (striptp P) n' start end\"\n    \"\\<And> pc' st s' f' rs ac.\n    stepsc P n' u start (pc', st, s', f', rs) \\<Longrightarrow> P pc' = Some (CEXP ac) \\<Longrightarrow> u \\<turnstile>\\<^sub>a ac\"\n  shows\n    \"stepsc P n' u start end\"\nusing assms proof (induction \"striptp P\" n' start \"end\")\n  case (1 n start)\n  then show ?case by auto\nnext\n  case (2 instr pc st m f rs s n s')\n  from 2(2) obtain cmd where \"P pc = Some cmd\" unfolding striptp_def by auto\n  show ?case\n  proof (cases cmd)\n    case prems: (INSTR instr)\n    with \\<open>P pc = _\\<close> 2(2) step_stript[of cmd, symmetric] 2(1) have step:\n      \"stepc cmd u (pc, st, m, f, rs) = Some s\"\n      unfolding striptp_def by auto\n    with \\<open>P pc = _\\<close> have \"u \\<turnstile>\\<^sub>a ac\" if\n      \"stepsc P n u s (pc', st, s', f', rs)\" \"P pc' = Some (CEXP ac)\" for pc' st s' f' rs ac\n      using that unfolding striptp_def by (force intro: 2(5))\n    with 2(4) have \"stepsc P n u s s'\" by auto\n    with step \\<open>P pc = _\\<close> show ?thesis unfolding striptp_def by auto\n  next\n    case prems: (CEXP ac)\n    with \\<open>P pc = _\\<close> 2(2) have [simp]: \"P pc = Some (CEXP ac)\" by auto\n    then have \"u \\<turnstile>\\<^sub>a ac\" by (auto intro: 2(5))\n    with 2(2,1) \\<open>cmd = _\\<close> have step:\n      \"stepc cmd u (pc, st, m, f, rs) = Some s\"\n      unfolding striptp_def by auto\n    with \\<open>P pc = Some cmd\\<close> have \"u \\<turnstile>\\<^sub>a ac\" if\n      \"stepsc P n u s (pc', st, s', f', rs)\" \"P pc' = Some (CEXP ac)\" for pc' st s' f' rs ac\n      using that unfolding striptp_def by (force intro: 2(5))\n    with 2(4) have \"stepsc P n u s s'\" by auto\n    with step \\<open>P pc = Some cmd\\<close> show ?thesis unfolding striptp_def by auto\n  qed\nqed\n\nlemma stepsc_visitedc:\n  \"\\<exists> cc. visitedc P n u start end cc\" if \"stepsc P n u start end\"\n  using that by induction (auto intro: visitedc.intros)\n\nlemma visitedc_stepsc:\n  \"stepsc P n u start end\" if \"visitedc P n u start end cc\"\n  using that by (induction; blast)\n\nlemma steps_visited:\n  \"\\<exists> cc. visited P n start end cc\" if \"steps P n start end\"\n  using that by induction (auto intro: visited.intros)\n\nlemma visited_steps:\n  \"steps P n start end\" if \"visited P n start end cc\"\n  using that by (induction; blast)\n\ncontext\n  fixes P n u start\n  assumes constraints_conj: \"\\<forall> pc' st s' f' rs ac.\n    stepsc P n u start (pc', st, s', f', rs) \\<and> P pc' = Some (CEXP ac) \\<longrightarrow> u \\<turnstile>\\<^sub>a ac\"\nbegin\n\n  lemma stepsc_t_sound':\n    assumes\n      \"steps (striptp P) n start end\"\n    shows\n      \"stepsc P n u start end\"\n    using assms constraints_conj by (auto intro: stepsc_t_sound)\n\n  lemma stepsc_t_complete':\n    assumes\n      \"stepsc P n u start end\"\n    shows\n      \"steps (striptp P) n start end\"\n    using assms constraints_conj by (auto intro: stepsc_t_complete)\n\n  lemma stepsc_t_complete'':\n    assumes\n      \"stepsc P n u start end\"\n    shows\n      \"\\<exists> pcs. visitedc P n u start end pcs \\<and> (\\<forall> pc \\<in> set pcs. \\<forall> ac. P pc = Some (CEXP ac) \\<longrightarrow> u \\<turnstile>\\<^sub>a ac)\"\n    using assms constraints_conj by (auto intro: stepsc_t_complete stepsc_t_visitedc)\n\n  lemma stepsc_t_visited:\n    assumes\n      \"stepsc P n u start end\"\n    shows\n      \"\\<exists> pcs. visited (striptp P) n start end pcs \\<and> (\\<forall> pc \\<in> set pcs. \\<forall> ac. P pc = Some (CEXP ac) \\<longrightarrow> u \\<turnstile>\\<^sub>a ac)\"\n    using stepsc_t_complete''[OF assms] visitedc_t_visited by blast\n\n  lemma stepst_t_complete:\n    assumes\n      \"stepst P n u start end\"\n    shows\n      \"\\<exists> pcs. exec (striptp P) n start [] = Some (end, pcs) \\<and> (\\<forall> pc \\<in> set pcs. \\<forall> ac. P pc = Some (CEXP ac) \\<longrightarrow> u \\<turnstile>\\<^sub>a ac)\"\n      using assms by (auto dest!: stepsc_t_visited visited_exec' simp: striptp_def stepst_def)\n\n  lemma stepst_t_equiv:\n    \"(\\<exists> pcs'. exec (striptp P) n start pcs = Some ((pc, st, m, f, rs), pcs'))\n    \\<longleftrightarrow> stepst P n u start (pc, st, m, f, rs)\"\n    apply rule+\n     apply safe\n     apply (drule exec_steps)\n    unfolding stepst_def\n     apply safe\n      apply (rule stepsc_t_sound'; assumption)\n     apply (simp add: striptp_def)\n     apply safe\n    subgoal for z\n      by (case_tac z) auto\n    by (auto dest!: stepsc_t_complete' steps_exec simp: striptp_def)\n\nend\n\ncontext\n  fixes P n start\n  assumes time_indep: \"time_indep P n start\"\nbegin\n\n  lemma time_indep':\n    \"\\<And> pc' st s' f' rs cmd.\n      stepsc P n u start (pc', st, s', f', rs) \\<Longrightarrow> P pc' = Some cmd\n  \\<Longrightarrow> is_instr cmd\"\n    using time_indep unfolding time_indep_def by blast\n\n  lemma stepsc_f_complete':\n    assumes\n      \"stepsc P n u start end\"\n    shows\n      \"steps (stripfp P) n start end\"\n    using assms time_indep' by (auto intro: stepsc_f_complete[where P = P])\n\n  lemma stepsc_f_sound':\n    assumes\n      \"steps (stripfp P) n start end\"\n    shows\n      \"stepsc P n u start end\"\n    using assms time_indep' by (auto intro: stepsc_f_sound[where P = P])\n\n  lemma stepsc_f_equiv:\n    \"steps (stripfp P) n start end \\<longleftrightarrow> stepsc P n u start end\"\n    using stepsc_f_sound' stepsc_f_complete' by fast\n\n  lemma stepst_f_equiv:\n    \"(\\<exists> pcs'. exec (stripfp P) n start pcs = Some ((pc, st, m, f, rs), pcs'))\n    \\<longleftrightarrow> stepst P n u start (pc, st, m, f, rs)\"\n    apply rule+\n     apply safe\n     apply (drule exec_steps)\n    unfolding stepst_def\n     apply safe\n      apply (rule stepsc_f_sound'; assumption)\n     apply (simp add: stripfp_def)\n     apply safe\n    subgoal for z\n      by (case_tac z) auto\n    by (auto dest!: stepsc_f_complete' steps_exec simp: stripfp_def)\n\nend (* End of context for equivalence *)\n\nlemma exec_acc:\n  assumes \"exec P n s pcs = Some (s', pcs')\"\n  shows \"\\<exists> pcs''. pcs' = pcs'' @ pcs\"\n  using assms by (induction P n s pcs rule: exec.induct; force split: option.split_asm if_split_asm)\n\nlemma exec_acc':\n  assumes \"Some (s', pcs') = exec P n s pcs\"\n  shows \"\\<exists> pcs''. pcs' = pcs'' @ pcs\"\n  using assms\n  using assms exec_acc by metis\n\nlemma exec_min_steps:\n  assumes \"exec P n s pcs = Some (s', pcs' @ pcs)\"\n  shows \"exec P (length pcs') s pcs = Some (s', pcs' @ pcs)\"\nusing assms proof (induction n arbitrary: s pcs s' pcs')\n  case 0\n  then show ?case by auto\nnext\n  case (Suc n)\n  obtain pc st m f rs pc' st' m' f' rs' where [simp]:\n    \"s = (pc, st, m, f, rs)\" \"s' = (pc', st', m', f', rs')\"\n    using prod.exhaust by metis\n  from Suc obtain instr where \"P pc = Some instr\" by (auto split: option.splits if_splits)\n  show ?case\n  proof (cases \"instr = HALT\")\n    case True\n    with \\<open>P pc = _\\<close> Suc show ?thesis by auto\n  next\n    case False\n    with Suc.prems \\<open>P pc = _\\<close> obtain s'' where s'':\n      \"step instr s = Some s''\" \"exec P n s'' (pc # pcs) = Some (s', pcs' @ pcs)\"\n      by (auto split: option.splits)\n    with exec_acc[OF this(2)] obtain pcs'' where \"pcs' = pcs'' @ [pc]\" by auto\n    with Suc.IH[of s'' \"pc # pcs\" s' \"pcs''\"] \\<open>P pc = _\\<close> False s'' show ?thesis by auto\n  qed\nqed\n\nlemma exec_steps_visited:\n  assumes\n    \"exec P (length pcs') s pcs = Some (s', pcs' @ pcs)\"\n    \"steps P (length pcs') s (pc, st, m, f, rs)\"\n  shows \"pc \\<in> set pcs'\"\n  using assms proof (induction P \\<equiv> P \"length pcs'\" s pcs arbitrary: pc st m f rs pcs' rule: exec.induct)\n  case 1\n  then show ?case by simp\nnext\n  case (2 n pc' st' m' f' rs' pcs pcs')\n  from this(2)[symmetric] this(3) obtain instr where \"P pc' = Some instr\" by (cases \"P pc'\") auto\n  show ?case\n  proof (cases \"instr = HALT\")\n    case True\n    with \"2.prems\" \\<open>P pc' = _\\<close> \\<open>Suc n = _\\<close>[symmetric] show ?thesis by (force elim: steps.cases)\n  next\n    case False\n    with 2 obtain pcs'' where \"pcs' = pcs'' @ [pc']\"\n      apply atomize_elim\n      by (erule exec.elims) (auto dest: exec_acc' split: option.split_asm if_split_asm)\n    with False 2 \\<open>P pc' = _\\<close> \\<open>Suc n = _\\<close>[symmetric] show ?thesis\n      by (auto split: option.split_asm elim: steps.cases)\n  qed\nqed\n\nlemma stepsc_mono:\n  assumes \"stepsc P n u start end\" \"n' \\<ge> n\"\n  shows \"stepsc P n' u start end\"\n  using assms proof (induction arbitrary: n')\n  case (1 prog n u start)\n  then show ?case by (cases n') auto\nnext\n  case (2 cmd u pc st m f rs s prog n s')\n  then show ?case by (cases n') auto\nqed\n\nlemma stepst_mono:\n  assumes \"stepst P n u start end\" \"n' \\<ge> n\"\n  shows \"stepst P n' u start end\"\n    using assms stepsc_mono unfolding stepst_def by blast\n\ndefinition\n  \"state_indep P n \\<equiv>\n    \\<forall> pc f pc' st f' rs u s1 s1' s2 s2' rs1 rs2.\n      stepsc P n u (pc, st, s1, f, rs) (pc', st, s1', f', rs1) \\<and>\n      stepsc P n u (pc, st, s2, f, rs) (pc', st, s2', f', rs2)\n  \\<longrightarrow> rs1 = rs2\"\n\nlemma exec_len:\n  \"n \\<ge> (length pcs' - length pcs)\" if \"exec P n s pcs = Some (s', pcs')\"\n  using that\n  by (induction P n s pcs arbitrary: rule: exec.induct)\n     (force split: option.split_asm if_split_asm)+\n\nlemma steps_striptp_stepsc:\n  assumes \"\n    \\<And> pc st m f rs ac.\n      steps (striptp P) n s' (pc, st, m, f, rs) \\<Longrightarrow> P pc = Some (CEXP ac)\n      \\<Longrightarrow> u' \\<turnstile>\\<^sub>a ac\n    \"\n    and \"steps (striptp P) n s' s''\"\n  shows \"stepsc P n u' s' s''\"\n  using assms(2,1)\nproof (induction \"striptp P\" n s' s'')\n  case (1 n start)\n  show ?case by rule\nnext\n  case (2 cmd pc st m f rs s n s')\n  have \"u' \\<turnstile>\\<^sub>a ac\"\n    if \"P pc = Some (CEXP ac)\" \"UPPAAL_Asm.steps (striptp P) n s (pc, st, m, f, rs)\"\n    for pc st m f rs ac\n    using that 2(1-3) by - (rule 2(5); force)\n  with 2(4) have \"stepsc P n u' s s'\" by auto\n  with 2(1-3) show ?case\n    apply (cases \"P pc\")\n     apply (simp add: striptp_def)\n    subgoal for cmd'\n      apply (cases cmd')\n      subgoal\n        by (force split: option.split simp: striptp_def)\n      subgoal\n        by (rule stepsc.intros) (auto intro!: 2(5) simp: striptp_def)\n      done\n    done\nqed\n\nlocale Equiv_TA =\n  Equiv_TA_Defs A n for A :: \"('a, 't :: time, 's) unta\" and n :: nat +\n  fixes L :: \"'s list\" and s :: \"int list\"\n  assumes states[intro]: \"L \\<in> defs.states' s\"\n      (*\n      and pred_time_indep:\n      \"\\<forall> L' s' u' s''. \\<forall> p' < p. \\<forall> L'' \\<in> defs.states' s''. A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\n    \\<longrightarrow> time_indep P n ((I ! p') (L'' ! p'), [], s'', True, [])\" *)\n    and pred_time_indep:\n      \"\\<forall> s. \\<forall> L \\<in> defs.states' s. \\<forall> q < p. time_indep P n ((I ! q) (L ! q), [], s, True, [])\"\n    and upd_time_indep:\n      \"\\<forall> l pc_g a l' pc_u s. \\<forall> q < p. (l, pc_g, a, pc_u, l') \\<in> fst (N ! q)\n    \\<longrightarrow> time_indep P n (pc_u, [], s, True, [])\"\n    and clock_conj:\n      \"\\<forall> l pc_g a l' pc_u s u. \\<forall> q < p. (l, pc_g, a, pc_u, l') \\<in> fst (N ! q) \\<and>\n        (\\<exists> pc' st s' rs. stepst P n u (pc_g, [], s, True, []) (pc', st, s', True, rs)) \\<longrightarrow>\n        (\\<forall> pc' st s' f' rs ac.\n        stepsc P n u (pc_g, [], s, True, []) (pc', st, s', f', rs) \\<and> P pc' = Some (CEXP ac) \\<longrightarrow>\n        u \\<turnstile>\\<^sub>a ac)\"\n    (* Reset clocks may not depend on state. XXX *)\n    (*\n    and \"\\<forall> l pc_g a pc_u l'. (l, pc_g, In a, pc_u, l') \\<in> fst (N ! q) \\<longrightarrow> state_indep P pc_u\"\n    and \"\\<forall> l pc_g a pc_u l'. (l, pc_g, Out a, pc_u, l') \\<in> fst (N ! q) \\<longrightarrow> state_indep P pc_u\"\n    *)\n  assumes Len: \"length N = length I\"\n      and inv: \"\\<forall> q < p. \\<exists> pc st s' rs pcs.\n        exec P' n ((I ! q) (L ! q), [], s, True, []) [] = Some ((pc, st, s', True, rs), pcs)\"\n      and bounded: \"bounded B s\"\nbegin\n\n\n\nlemma [simp]:\n  \"length defs.P = p\"\n  unfolding p_def state_ta_def by simp\n\nlemma inv':\n  \"\\<forall>p<length defs.P. (defs.P ! p) (L ! p) s\"\n  using inv bounded unfolding state_ta_def state_pred_def by (force simp: p_def)\n\nlemma inv'':\n  \"\\<exists> pc st s' rs. stepst P n u' ((I ! q) (L ! q), [], s, True, []) (pc, st, s', True, rs)\"\n  if \"q < p\" for u'\nproof -\n  from pred_time_indep that have \"time_indep P n ((I ! q) (L ! q), [], s, True, [])\" by blast\n  with inv that stepst_f_equiv[symmetric] show ?thesis by blast\nqed\n\nlemma A_simp[simp]:\n  \"PP = P\" \"N' = N\" \"I' = I\" \"B' = B\" if \"A = (PP, N', I', B')\"\nusing that by auto\n\nlemma A_unfold:\n  \"A = (P, N, I, B)\"\n  by simp\n\nsublocale prod: Prod_TA state_ta by standard (auto simp: inv')\n\nlemma inv_simp:\n  \"snd (defs.N ! q) (L' ! q) = snd (N ! q) (L' ! q)\" if \"q < p\" for L'\n  using that unfolding state_ta_def state_inv_def by simp\n\nlemma [simp]:\n  \"defs.p = p\"\n  by (simp add: defs.p_def p_def)\n\nlemma [simp]:\n  \"(\\<forall> x \\<in> {..<m}. Q x) \\<longleftrightarrow> (\\<forall> x < m. Q x)\"\n  by auto\n\nterm \"state_trans_f\"\n\n(*\nlemma trans_state_taD:\n  assumes \"(l, g, (Sil a, c, m), f, l') \\<in> fst (defs.N ! q)\" \"q < p\"\n  shows\n    \"(l, g, (Sil a, c, m), f, l') \\<in> state_trans_f q \\<or> (l, g, (Sil a, c, m), f, l') \\<in> state_trans_t q\"\n  using assms unfolding state_ta_def state_trans_def by simp\n*)\n\nlemma trans_state_taD:\n  assumes \"(l, g, (a, c, m), f, l') \\<in> fst (defs.N ! q)\" \"q < p\"\n  shows\n    \"(l, g, (a, c, m), f, l') \\<in> state_trans_t q\"\n  using assms unfolding state_ta_def by simp\n\nlemma N_transD:\n  assumes \"(l, pc_g, a, pc_u, l') \\<in> fst (N ! q)\" \"q < p\"\n  shows \"(l, make_g pc_g, (a, make_c pc_g, make_mf pc_u), make_f pc_u, l') \\<in> fst (defs.N ! q)\"\n    using assms unfolding state_ta_def state_trans_t_def by auto\n\nlemma pred_time_indep':\n  \"\\<forall> L' s' u'. \\<forall> p' < p. A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\n\\<longrightarrow> time_indep P n ((I ! p') (L' ! p'), [], s', True, [])\"\n  using pred_time_indep oops\n\nlemma P_steps_upd:\n  assumes\n    \"Some s'' = make_mf pc_u s'\"\n    \"q < p\" \"(l, pc_g, a, pc_u, l') \\<in> fst (N ! q)\"\n  shows\n    \"\\<exists> pc st f. stepst P n u' (pc_u, [], s', True, []) (pc, st, s'', f, make_f pc_u s')\"\nproof -\n  from assms upd_time_indep have *: \"time_indep P n (pc_u, [], s', True, [])\" by auto\n  from assms(1) \\<open>q < p\\<close> obtain pc st f rs pcs where\n    \"exec PF n (pc_u, [], s', True, []) [] = Some ((pc, st, s'', f, rs), pcs)\"\n    unfolding make_mf_def state_ta_def by (fastforce split: option.splits)\n  with stepst_f_equiv[OF *] show ?thesis unfolding make_f_def by fastforce\nqed\n\nlemma P_steps_reset:\n  assumes\n    \"q < p\" \"(l, pc_g, a, pc_u, l') \\<in> fst (N ! q)\"\n  shows\n    \"(\\<exists>pc st s'' f. stepst P n u (pc_u, [], s', True, []) (pc, st, s'', f, make_f pc_u s')) \\<or>\n       (\\<nexists>pc st s'' f r'. stepst P n u (pc_u, [], s', True, []) (pc, st, s'', f, r')) \\<and>\n       make_f pc_u s' = []\"\nproof (cases \"\\<exists>pc st s'' f r'. stepst P n u (pc_u, [], s', True, []) (pc, st, s'', f, r')\")\n  case True\n  then obtain pc st s'' f r' where *:\n    \"stepst P n u (pc_u, [], s', True, []) (pc, st, s'', f, r')\"\n    by blast\n  from assms upd_time_indep have \"time_indep P n (pc_u, [], s', True, [])\" by auto\n  from * stepst_f_equiv[OF this, symmetric, where pcs = \"[]\"] show ?thesis\n    unfolding make_f_def by (force split: option.split)\nnext\n  case False\n  from assms upd_time_indep have \"time_indep P n (pc_u, [], s', True, [])\" by auto\n  from False stepst_f_equiv[OF this, where pcs = \"[]\"] show ?thesis\n    unfolding make_f_def by (auto split: option.split)\nqed\n\nlemma steps_P_reset:\n  assumes\n    \"(\\<exists>pc st s'' f. stepst P n u (pc_u, [], s', True, []) (pc, st, s'', f, r)) \\<or>\n     (\\<nexists>pc st s'' f r'. stepst P n u (pc_u, [], s', True, []) (pc, st, s'', f, r')) \\<and> r = []\"\n    \"q < p\" \"(l, pc_g, a, pc_u, l') \\<in> fst (N ! q)\"\n  shows \"make_f pc_u s' = r\"\n  using assms(1)\nproof (safe, goal_cases)\n  case prems: (1 pc st s'' f)\n  from assms upd_time_indep have \"time_indep P n (pc_u, [], s', True, [])\" by auto\n  from stepst_f_equiv[OF this, symmetric] prems \\<open>q < p\\<close> obtain pc st f pcs where\n    \"exec PF n (pc_u, [], s', True, []) [] = Some ((pc, st, s'', f, r), pcs)\"\n    unfolding make_f_def state_ta_def by (fastforce split: option.splits)\n  then show ?case unfolding make_f_def by (auto split: option.split)\nnext\n  case prems: 2\n  have \"exec PF n (pc_u, [], s', True, []) [] = None\"\n  proof (cases \"exec PF n (pc_u, [], s', True, []) []\")\n    case None\n    then show ?thesis .\n  next\n    case (Some a)\n    obtain pc'' st'' s'' f'' rs'' pcs'' where \"a = ((pc'', st'', s'', f'', rs''), pcs'')\"\n      by (cases a, case_tac a) auto\n    from assms upd_time_indep have \"time_indep P n (pc_u, [], s', True, [])\" by auto\n    from stepst_f_equiv[OF this] \\<open>_ = Some a\\<close> prems \\<open>a = _\\<close> show ?thesis by auto metis\n  qed\n  then show ?case unfolding make_f_def by simp\nqed\n\n\nlemma steps_P_upd:\n  assumes\n    \"stepst P n u' (pc_u, [], s', True, []) (pc, st, s'', f, r)\"\n    \"q < p\" \"(l, pc_g, a, pc_u, l') \\<in> fst (N ! q)\"\n  shows\n    \"Some s'' = make_mf pc_u s'\" (is \"?A\") \"r = make_f pc_u s'\" (is \"?B\")\nproof -\n  from assms upd_time_indep have \"time_indep P n (pc_u, [], s', True, [])\" by auto\n  from stepst_f_equiv[OF this, symmetric] assms(1) \\<open>q < p\\<close> obtain pc st f pcs where\n    \"exec PF n (pc_u, [], s', True, []) [] = Some ((pc, st, s'', f, r), pcs)\"\n    unfolding make_mf_def state_ta_def by (fastforce split: option.splits)\n  then show ?A ?B unfolding make_f_def make_mf_def by (auto split: option.split)\nqed\n\nlemma steps_P_guard:\n  assumes\n    \"stepst P n u' (pc_g, [], s', True, []) (pc, st, s'', True, rs)\"\n    \"q < p\" \"(l, pc_g, a, pc_u, l') \\<in> fst (N ! q)\"\n  shows\n    \"make_c pc_g s'\" (is \"?A\") \"u' \\<turnstile> make_g pc_g s'\" (is \"?B\")\nproof -\n  from stepst_t_complete[OF _ assms(1)] clock_conj assms obtain pcs where\n    \"exec PT n (pc_g, [], s', True, []) [] = Some ((pc, st, s'', True, rs), pcs)\"\n    \"\\<forall> pc\\<in>set pcs. \\<forall>ac. P pc = Some (CEXP ac) \\<longrightarrow> u' \\<turnstile>\\<^sub>a ac\"\n    by fastforce\n  then show ?A ?B unfolding make_c_def make_g_def\n    by (auto split: option.split instrc.split_asm simp: list_all_iff set_map_filter clock_val_def)\nqed\n\nlemma P_steps_guard:\n  assumes\n    \"make_c pc_g s'\" \"u' \\<turnstile> make_g pc_g s'\"\n    \"q < p\" \"(l, pc_g, a, pc_u, l') \\<in> fst (N ! q)\"\n  shows\n    \"\\<exists> pc s'' st rs. stepst P n u' (pc_g, [], s', True, []) (pc, st, s'', True, rs)\"\nproof -\n  from assms(1) \\<open>q < p\\<close> obtain pc st s'' rs pcs where *:\n    \"exec PT n (pc_g, [], s', True, []) [] = Some ((pc, st, s'', True, rs), pcs)\"\n    unfolding make_c_def state_ta_def by (fastforce split: option.splits)\n  with exec_min_steps[of PT n _ \"[]\" _ pcs] have **:\n    \"exec PT (length pcs) (pc_g, [], s', True, []) [] = Some ((pc, st, s'', True, rs), pcs @ [])\"\n    by auto\n  from * assms(2) have\n    \"u' \\<turnstile> List.map_filter (\\<lambda>pc. case P pc of\n        None \\<Rightarrow> None\n      | Some (INSTR xa) \\<Rightarrow> Map.empty xa\n      | Some (CEXP xa) \\<Rightarrow> Some xa) pcs\" unfolding make_g_def\n    by auto\n  moreover from ** exec_steps_visited[of PT pcs _ \"[]\"] have \"pc \\<in> set pcs\"\n    if \"steps PT (length pcs) (pc_g, [], s', True, []) (pc, st, m, f, rs)\" for pc st m f rs\n    using that by fastforce\n  ultimately have \"u' \\<turnstile>\\<^sub>a ac\"\n    if \"steps PT (length pcs) (pc_g, [], s', True, []) (pc, st, m, f, rs)\" \"P pc = Some (CEXP ac)\"\n    for pc st m f rs ac\n    using that by (auto 4 3 split: option.splits simp: list_all_iff set_map_filter clock_val_def)\n  moreover from ** have\n    \"steps PT (length pcs) (pc_g, [], s', True, []) (pc, st, s'', True, rs)\" \"PT pc = Some HALT\"\n    by (auto dest: exec_steps)\n  ultimately have \"stepst P (length pcs) u' (pc_g, [], s', True, []) (pc, st, s'', True, rs)\"\n    by (auto intro: steps_striptp_stepsc simp: stepst_def striptp_def elim: stript.elims)\n  moreover from exec_len[OF *] have \"n \\<ge> length pcs\" by simp\n  ultimately show ?thesis by (blast intro: stepst_mono)\nqed\n\nlemma P_bounded:\n  assumes\n    \"(defs.P ! q) (L' ! q) s'\" \"q < p\"\n  shows \"bounded B s'\"\n  using assms unfolding state_pred_def state_ta_def by (auto split: option.splits)\n\nlemma P_steps:\n  assumes\n    \"(defs.P ! q) (L' ! q) s'\"\n    \"q < p\" \"L' \\<in> defs.states' s'\"\n  shows\n    \"\\<exists> pc st s'' rs. stepst P n u' ((I ! q) (L' ! q), [], s', True, []) (pc, st, s'', True, rs)\"\nproof -\n  from assms pred_time_indep have *: \"time_indep P n ((I ! q) (L' ! q), [], s', True, [])\" by auto\n  from assms(1) \\<open>q < p\\<close> obtain pc st s'' rs pcs where\n    \"exec PF n ((I ! q) (L' ! q), [], s', True, []) [] = Some ((pc, st, s'', True, rs), pcs)\"\n    unfolding state_pred_def state_ta_def by (auto split: option.splits)\n  with stepst_f_equiv[OF *] show ?thesis by blast\nqed\n\nlemma steps_P:\n  assumes\n    \"stepst P n u' ((I ! q) (L' ! q), [], s', True, []) (pc, st, s'', True, rs)\"\n    \"q < p\" \"L' \\<in> defs.states' s'\"\n    \"bounded B s'\"\n  shows\n    \"(defs.P ! q) (L' ! q) s'\"\nproof -\n  from assms pred_time_indep have \"time_indep P n ((I ! q) (L' ! q), [], s', True, [])\" by auto\n  from stepst_f_equiv[OF this] assms(1) obtain pcs' where\n    \"exec PF n ((I ! q) (L' ! q), [], s', True, []) [] = Some ((pc, st, s'', True, rs), pcs')\"\n    by blast\n  with \\<open>q < p\\<close> \\<open>bounded B s'\\<close> show ?thesis unfolding state_pred_def state_ta_def by simp\nqed\n\nlemma P_iff:\n  \"(\\<exists> pc st rs s''. stepst P n u' ((I ! q) (L' ! q), [], s', True, []) (pc, st, s'', True, rs)\n  \\<and> bounded B s')\n  \\<longleftrightarrow> (defs.P ! q) (L' ! q) s'\" if \"q < p\" \"L' \\<in> defs.states' s'\"\n  using that by (metis steps_P P_steps P_bounded)\n\nlemma states'_updI':\n  assumes \"(L' ! q, g, (a, c, m), f, l') \\<in> fst (defs.N ! q)\" \"L' \\<in> defs.states' s''\"\n  shows \"L'[q := l'] \\<in> defs.states' s'\"\n  using assms\n  unfolding prod.states'_simp[of s' s'']\n  unfolding Product_TA_Defs.states_def\n  apply clarsimp\n  subgoal for p\n    by (cases \"p = q\"; force simp: prod.trans_of_N_s_2[simplified] Prod_TA_Defs.N_s_length)\n  done\n\nlemma states'_updI:\n  assumes \"(L ! q, g, (a, c, m), f, l') \\<in> fst (defs.N ! q)\"\n  shows \"L[q := l'] \\<in> defs.states' s'\"\nusing assms by (auto intro: states'_updI')\n\nlemma states'_updI'':\n  assumes\n    \"(L' ! q, g, (a, c, m), f, l') \\<in> fst (defs.N ! q)\"\n    \"(L' ! q', g', (a', c', m'), f', l'') \\<in> fst (defs.N ! q')\"\n    \"L' \\<in> defs.states' s''\" \"q \\<noteq> q'\"\n  shows \"L'[q := l', q' := l''] \\<in> defs.states' s'\"\n  using assms by (auto intro: states'_updI')\n\nlemma equiv_sound:\n  assumes step: \"state_ta \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n    shows \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n  using step proof cases\n  case (step_sn_t N d I)\n  then show ?thesis\n    apply simp\n    apply (subst A_unfold)\n    apply (frule prod.A_simp(1))\n    apply (frule prod.A_simp(2))\n    apply (rule step_u_t)\n    using inv'' bounded by (auto simp: inv_simp p_def)\nnext\n  case (step_sn_i l g a c m f l' N p r I)\n  then show ?thesis\n    apply (simp)\n    apply (frule prod.A_simp(1))\n    apply (frule prod.A_simp(2))\n    apply (simp add: Prod_TA_Defs.N_s_length)\n    apply (subst A_unfold)\n    apply (drule trans_state_taD)\n     apply assumption\n    subgoal\n      unfolding state_trans_t_def\n      apply safe\n      apply (drule P_steps_upd)\n        prefer 2\n        apply assumption\n       apply assumption\n      apply (drule P_steps_guard)\n         apply blast\n        prefer 2\n        apply assumption\n       apply assumption\n      apply safe\n      apply (rule step_u_i)\n              prefer 3\n      subgoal\n        apply safe\n        apply (rule P_steps)\n          apply (fastforce simp: p_def)\n         apply (fastforce simp: p_def)\n        by (metis Prod_TA_Defs'.states'_simp Prod_TA_Defs'.states_step local.step states)\n      by (auto simp: inv_simp p_def Prod_TA_Defs.N_s_length intro!: P_bounded)\n    done\nnext\n  case (step_sn_s l1 g1 a ci mi f1 l1' N p l2 g2 co mo f2 l2' q r1 r2 I)\n  then show ?thesis\n    apply (simp)\n    apply (frule prod.A_simp(1))\n    apply (frule prod.A_simp(2))\n    apply (simp add: Prod_TA_Defs.N_s_length)\n    apply (subst A_unfold)\n    apply (drule trans_state_taD)\n     apply assumption\n    apply (drule trans_state_taD)\n     apply assumption\n    subgoal\n      unfolding state_trans_t_def\n      apply safe\n      apply (drule P_steps_upd)\n        prefer 2\n        apply assumption\n       apply assumption\n      apply (drule P_steps_upd)\n        prefer 2\n        apply assumption\n       apply assumption\n      apply (drule P_steps_guard)\n         apply blast\n        prefer 2\n        apply assumption\n       apply assumption\n      apply (drule P_steps_guard)\n         apply blast\n        prefer 2\n        apply assumption\n       apply assumption\n      apply safe\n      apply (rule step_u_s)\n      using [[goals_limit = 1]]\n                     prefer 4\n        apply (rule P_steps_reset; force)\n                       prefer 5\n          subgoal\n        apply safe\n        apply (rule P_steps)\n          apply (fastforce simp: p_def)\n         apply (fastforce simp: p_def)\n            by (metis Prod_TA_Defs'.states'_simp Prod_TA_Defs'.states_step local.step states)\n              by (auto simp: inv_simp p_def Prod_TA_Defs.N_s_length intro!: P_bounded) (* XXX Slow *)\n    done\nqed\n\nlemma state_ta_unfold:\n  \"state_ta = (defs.N, defs.P)\"\n  by simp\n\nlemma equiv_complete:\n  assumes step: \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n    shows \"state_ta \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n    using step proof cases\n    case (step_u_t N P d I)\n    note [simp] = A_simp[OF this(1)]\n    from step_u_t(2-) show ?thesis\n      by (auto simp: state_ta_def p_def state_inv_def intro: step_sn_t)\n  next\n    case (step_u_i P pc_g uu uv uw ux pc_u uy uz va r N I l a l' p)\n    note [simp] = A_simp[OF this(1)]\n    from step_u_i(2-) show ?thesis\n      apply -\n      apply (simp add: Prod_TA_Defs.N_s_length)\n      apply (subst state_ta_unfold)\n      apply (frule steps_P_guard(1))\n        apply assumption\n        apply (simp; fail)\n      apply (drule steps_P_guard(2))\n        apply assumption\n        apply (simp; fail)\n      apply (frule steps_P_upd(1))\n        apply assumption\n        apply (simp; fail)\n      apply (drule steps_P_upd(2))\n        apply assumption\n        apply (simp; fail)\n      apply (drule N_transD)\n       apply assumption\n      apply (rule step_sn_i)\n        apply assumption\n                apply auto\n        apply (simp add: state_ta_def p_def state_inv_def state_pred_def; fail)\n       apply (simp add: Prod_TA_Defs.N_s_length; fail)\n      by (fastforce simp: p_def intro: steps_P intro!: states'_updI)\n  next\n    case (step_u_s P pc_g1 vb vc vd ve pc_g2 vf vg vh vi pc_u2 vj vk s1 vl r2 pc_u1 r1 vm vn vo vp\n          N I l1 a l1' p' l2 l2' q\n         )\n    note [simp] = A_simp[OF this(1)]\n    from \\<open>q < length L\\<close> have \"q < p\" by (simp add: Prod_TA_Defs.N_s_length)\n    from step_u_s(2-) show ?thesis\n      apply -\n      apply (simp add: Prod_TA_Defs.N_s_length)\n      apply (subst state_ta_unfold)\n      apply (frule steps_P_guard(1))\n        apply assumption\n        apply (simp; fail)\n      apply (drule steps_P_guard(2))\n        apply assumption\n       apply (simp; fail)\n      apply (frule steps_P_guard(1))\n        apply (rule \\<open>q < p\\<close>)\n        apply (simp; fail)\n      apply (drule steps_P_guard(2))\n        apply (rule \\<open>q < p\\<close>)\n        apply (simp; fail)\n      apply (frule steps_P_upd(1))\n        apply (rule \\<open>q < p\\<close>)\n        apply (simp; fail)\n      apply (drule steps_P_upd(2))\n        apply (rule \\<open>q < p\\<close>)\n       apply (simp; fail)\n      apply (drule steps_P_reset[simplified])\n        apply assumption\n        apply (simp; fail)\n      apply (frule steps_P_upd(1))\n        apply assumption\n        apply (simp; fail)\n      apply (drule steps_P_upd(2))\n        apply assumption\n        apply (simp; fail)\n      apply (drule N_transD)\n       apply assumption\n      apply (drule N_transD)\n       apply assumption\n      apply (rule step_sn_s)\n                         apply assumption\n                        apply assumption\n                apply auto\n        apply (simp add: state_ta_def p_def state_inv_def state_pred_def; fail)\n         apply (simp add: Prod_TA_Defs.N_s_length; fail)\n        apply (simp add: Prod_TA_Defs.N_s_length; fail)\n       apply (simp add: p_def)\n       apply (erule allE)\n       apply (erule impE)\n        apply (rotate_tac 5)\n        apply assumption\n        apply safe\n       by (fastforce simp: p_def intro: steps_P intro!: states'_updI'')\n   qed\n\nlemma equiv_sound':\n  assumes step: \"state_ta \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n    shows \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle> \\<and> L' \\<in> defs.states' s' \\<and> (\\<forall>q<p. \\<exists>pc st s'' rs pcs.\n             exec PF n ((I ! q) (L' ! q), [], s', True, []) [] =\n             Some ((pc, st, s'', True, rs), pcs))\"\n  using step proof cases\n  case (step_sn_t N d I)\n  then show ?thesis\n    apply simp\n    apply (subst A_unfold)\n    apply (frule prod.A_simp(1))\n    apply (frule prod.A_simp(2))\n    apply (rule conjI)\n    apply (rule step_u_t)\n    using inv inv'' bounded by (auto simp: inv_simp p_def)\nnext\n  case (step_sn_i l g a c m f l' N p r I)\n  then show ?thesis\n    apply (simp)\n    apply (frule prod.A_simp(1))\n    apply (frule prod.A_simp(2))\n    apply (simp add: Prod_TA_Defs.N_s_length)\n    apply (subst A_unfold)\n    apply (drule trans_state_taD)\n     apply assumption\n    subgoal\n      unfolding state_trans_t_def\n      apply safe\n      apply (drule P_steps_upd)\n        prefer 2\n        apply assumption\n       apply assumption\n      apply (drule P_steps_guard)\n         apply blast\n        prefer 2\n        apply assumption\n       apply assumption\n      apply safe\n      apply (rule step_u_i)\n              prefer 3\n      subgoal\n        apply safe\n        apply (rule P_steps)\n          apply (fastforce simp: p_def)\n         apply (fastforce simp: p_def)\n        by (metis Prod_TA_Defs'.states'_simp Prod_TA_Defs'.states_step local.step states)\n                apply (auto simp: inv_simp p_def Prod_TA_Defs.N_s_length intro!: P_bounded)\n       apply (metis Prod_TA_Defs'.states'_simp Prod_TA_Defs'.states_step local.step states)\n      subgoal premises prems for pc_g pc_u q\n        using prems(9) \\<open>q < _\\<close> unfolding state_ta_def state_pred_def\n        by (auto 4 3 simp: p_def split: option.splits)\n      done\n    done\nnext\n  case (step_sn_s l1 g1 a ci mi f1 l1' N p l2 g2 co mo f2 l2' q r1 r2 I)\n  then show ?thesis\n    apply (simp)\n    apply (frule prod.A_simp(1))\n    apply (frule prod.A_simp(2))\n    apply (simp add: Prod_TA_Defs.N_s_length)\n    apply (subst A_unfold)\n    apply (drule trans_state_taD)\n     apply assumption\n    apply (drule trans_state_taD)\n     apply assumption\n    subgoal\n      unfolding state_trans_t_def\n      apply safe\n      apply (drule P_steps_upd)\n        prefer 2\n        apply assumption\n       apply assumption\n      apply (drule P_steps_upd)\n        prefer 2\n        apply assumption\n       apply assumption\n      apply (drule P_steps_guard)\n         apply blast\n        prefer 2\n        apply assumption\n       apply assumption\n      apply (drule P_steps_guard)\n         apply blast\n        prefer 2\n        apply assumption\n       apply assumption\n      apply safe\n      apply (rule step_u_s)\n      using [[goals_limit = 1]]\n                     prefer 4\n        apply (rule P_steps_reset; force)\n                       prefer 5\n          subgoal\n        apply safe\n        apply (rule P_steps)\n          apply (fastforce simp: p_def)\n         apply (fastforce simp: p_def)\n            by (metis Prod_TA_Defs'.states'_simp Prod_TA_Defs'.states_step local.step states)\n              (* XXX Metis-free proof? *)\n                          apply (auto simp: inv_simp p_def Prod_TA_Defs.N_s_length intro!: P_bounded)\n            (* XXX Slow *)\n          apply (metis Prod_TA_Defs'.states'_simp Prod_TA_Defs'.states_step local.step states)\n            subgoal premises prems for pc_g pc_ga pc_u pc_ua q'\n            using prems(14) \\<open>q' < _\\<close> unfolding state_ta_def state_pred_def\n            by (auto 4 3 simp: p_def split: option.splits)\n          done\n    done\nqed\n\nlemma equiv_complete':\n  assumes step: \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\"\n  shows \"state_ta \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle> \\<and> L' \\<in> defs.states' s'\n      \\<and> (\\<forall> q < p. (defs.P ! q) (L' ! q) s')\"\n    using step proof cases\n    case (step_u_t N P d I)\n    note [simp] = A_simp[OF this(1)]\n    from step_u_t(2-) show ?thesis\n      apply safe\n      subgoal\n        by (auto simp: state_ta_def p_def state_inv_def intro: step_sn_t)\n      by (fastforce simp: p_def intro: steps_P intro!: states'_updI)+\n  next\n    case (step_u_i P pc_g uu uv uw ux pc_u uy uz va r N I l a l' p)\n    note [simp] = A_simp[OF this(1)]\n    from step_u_i(2-) show ?thesis\n      apply -\n      apply (simp add: Prod_TA_Defs.N_s_length)\n      apply (subst state_ta_unfold)\n      apply (frule steps_P_guard(1))\n        apply assumption\n        apply (simp; fail)\n      apply (drule steps_P_guard(2))\n        apply assumption\n        apply (simp; fail)\n      apply (frule steps_P_upd(1))\n        apply assumption\n        apply (simp; fail)\n      apply (drule steps_P_upd(2))\n        apply assumption\n        apply (simp; fail)\n      apply (drule N_transD)\n       apply assumption\n        apply safe\n      apply (rule step_sn_i)\n        apply assumption\n                apply auto\n        apply (simp add: state_ta_def p_def state_inv_def state_pred_def; fail)\n       apply (simp add: Prod_TA_Defs.N_s_length; fail)\n        by (fastforce simp: p_def intro: steps_P intro!: states'_updI)+\n  next\n    case (step_u_s P pc_g1 vb vc vd ve pc_g2 vf vg vh vi pc_u2 vj vk s1 vl r2 pc_u1 r1 vm vn vo vp N\n            I l1 a l1' p' l2 l2' q\n         )\n    note [simp] = A_simp[OF this(1)]\n    from \\<open>q < length L\\<close> have \"q < p\" by (simp add: Prod_TA_Defs.N_s_length)\n    from step_u_s(2-) show ?thesis\n      apply -\n      apply (simp add: Prod_TA_Defs.N_s_length)\n      apply (subst state_ta_unfold)\n      apply (frule steps_P_guard(1))\n        apply assumption\n        apply (simp; fail)\n      apply (drule steps_P_guard(2))\n        apply assumption\n       apply (simp; fail)\n      apply (frule steps_P_guard(1))\n        apply (rule \\<open>q < p\\<close>)\n        apply (simp; fail)\n      apply (drule steps_P_guard(2))\n        apply (rule \\<open>q < p\\<close>)\n        apply (simp; fail)\n      apply (frule steps_P_upd(1))\n        apply (rule \\<open>q < p\\<close>)\n        apply (simp; fail)\n      apply (drule steps_P_upd(2))\n        apply (rule \\<open>q < p\\<close>)\n       apply (simp; fail)\n      apply (drule steps_P_reset[simplified])\n        apply assumption\n        apply (simp; fail)\n      apply (frule steps_P_upd(1))\n        apply assumption\n        apply (simp; fail)\n      apply (drule steps_P_upd(2))\n        apply assumption\n        apply (simp; fail)\n      apply (drule N_transD)\n       apply assumption\n      apply (drule N_transD)\n       apply assumption\n        apply safe\n      apply (rule step_sn_s)\n                         apply assumption\n                        apply assumption\n                apply auto\n        apply (simp add: state_ta_def p_def state_inv_def state_pred_def; fail)\n         apply (simp add: Prod_TA_Defs.N_s_length; fail)\n        apply (simp add: Prod_TA_Defs.N_s_length; fail)\n       apply (simp add: p_def)\n       apply (erule allE)\n       apply (erule impE)\n        apply (rotate_tac 5)\n        apply assumption\n        apply (fastforce simp: p_def intro: steps_P intro!: states'_updI'')\n       apply (fastforce simp: p_def intro: steps_P intro!: states'_updI'')\n        apply (simp add: p_def)\n       apply (erule allE)\n       apply (erule impE)\n        apply (rotate_tac 5)\n        apply assumption\n        by (fastforce simp: p_def intro: steps_P intro!: states'_updI'') (* XXX Cleanup *)\n   qed\n\n  lemma equiv_complete'':\n    assumes step: \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L', s', u'\\<rangle>\" \"p > 0\"\n      shows \"(\\<forall>q<p. \\<exists>pc st s'' rs pcs.\n               exec PF n ((I ! q) (L' ! q), [], s', True, []) [] =\n               Some ((pc, st, s'', True, rs), pcs))\" (is ?A)\n            \"bounded B s'\" (is ?B)\n  proof -\n    from assms equiv_complete' have *: \"\\<forall>q<p. (defs.P ! q) (L' ! q) s'\" by simp\n    then show ?A unfolding state_ta_def state_pred_def by (fastforce split: option.splits)\n    from \\<open>p > 0\\<close> * have \"(defs.P ! 0) (L' ! 0) s'\" by auto\n    with \\<open>p > 0\\<close> show ?B unfolding state_ta_def state_pred_def by (auto split: option.splits)\n  qed\n\n  lemma equiv_steps_sound':\n    assumes step: \"state_ta \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\"\n    shows \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle> \\<and> L' \\<in> defs.states' s' \\<and>\n        (\\<forall>q<p. \\<exists>pc st s'' rs pcs.\n             exec PF n ((I ! q) (L' ! q), [], s', True, []) [] =\n             Some ((pc, st, s'', True, rs), pcs)) \\<and> bounded B s'\"\n    using step states inv\n  proof (induction A \\<equiv> state_ta L \\<equiv> L s \\<equiv> s u \\<equiv> u L' s' u' arbitrary: rule: steps_sn.induct)\n    case (refl)\n    with bounded show ?case by blast\n  next\n    case prems: (step L' s' u' a L'' s'' u'')\n    from prems have *:\n      \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\" \"L' \\<in> defs.states' s'\"\n      \"(\\<forall>q<p. \\<exists>pc st s'' rs pcs.\n             exec PF n ((I ! q) (L' ! q), [], s', True, []) [] =\n             Some ((pc, st, s'', True, rs), pcs))\"\n      \"bounded B s'\"\n      by auto\n    interpret interp: Equiv_TA A n L' s'\n      using pred_time_indep upd_time_indep clock_conj * by unfold_locales (auto simp: Len intro!: *)\n    from prems(3) have\n      \"A \\<turnstile>\\<^sub>n \\<langle>L', s', u'\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L'', s'', u''\\<rangle>\" \"L'' \\<in> defs.states' s''\"\n      \"\\<forall>q<p. \\<exists>pc st s''' rs pcs.\n              exec PF n ((I ! q) (L'' ! q), [], s'', True, []) [] =\n              Some ((pc, st, s''', True, rs), pcs)\"\n      \"bounded B s''\"\n      by (force dest!: interp.equiv_sound')+\n    with * interp.states show ?case by - (assumption | rule)+\n  qed\n\nlemma equiv_steps_complete':\n    \"state_ta \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle> \\<and> L' \\<in> defs.states' s' \\<and>\n        (\\<forall>q<p. \\<exists>pc st s'' rs pcs.\n             exec PF n ((I ! q) (L' ! q), [], s', True, []) [] =\n             Some ((pc, st, s'', True, rs), pcs)) \\<and> bounded B s'\"\n    if \"A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\" \"p > 0\"\n    using that states inv proof (induction A \\<equiv> A n \\<equiv> n L \\<equiv> L s \\<equiv> s u \\<equiv> u _ _ _ rule: steps_un.induct)\n    case refl\n    with bounded show ?case by blast\n  next\n    case prems: (step L' s' u' a L'' s'' u'')\n    from prems have *:\n      \"state_ta \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\" \"L' \\<in> defs.states' s'\"\n      \"(\\<forall>q<p. \\<exists>pc st s'' rs pcs.\n             exec PF n ((I ! q) (L' ! q), [], s', True, []) [] =\n             Some ((pc, st, s'', True, rs), pcs))\"\n      \"bounded B s'\"\n      by auto\n    interpret interp: Equiv_TA A n L' s'\n      using pred_time_indep upd_time_indep clock_conj by unfold_locales (auto simp: Len intro!: *)\n    from interp.equiv_complete'[OF prems(3)] interp.equiv_complete''[OF prems(3) \\<open>p > 0\\<close>] have\n      \"state_ta \\<turnstile> \\<langle>L', s', u'\\<rangle> \\<rightarrow>\\<^bsub>a\\<^esub> \\<langle>L'', s'', u''\\<rangle>\" \"L'' \\<in> defs.states' s''\"\n      \"\\<forall>q<p. \\<exists>pc st s''' rs pcs.\n              exec PF n ((I ! q) (L'' ! q), [], s'', True, []) [] =\n              Some ((pc, st, s''', True, rs), pcs)\"\n      \"bounded B s''\"\n      by auto\n    with * interp.states show ?case by - (assumption | rule)+\n  qed\n\n  lemmas equiv_steps_sound = equiv_steps_sound'[THEN conjunct1]\n  lemmas equiv_steps_complete = equiv_steps_complete'[THEN conjunct1]\n\n  lemma equiv_correct:\n    \"state_ta \\<turnstile> \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle> \\<longleftrightarrow> A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\" if \"p > 0\"\n    using that equiv_steps_sound equiv_steps_complete by metis\n\n  lemma prod_correct:\n    \"defs.prod_ta \\<turnstile> \\<langle>(L, s), u\\<rangle> \\<rightarrow>* \\<langle>(L', s'), u'\\<rangle> \\<longleftrightarrow> A \\<turnstile>\\<^sub>n \\<langle>L, s, u\\<rangle> \\<rightarrow>* \\<langle>L', s', u'\\<rangle>\" if \"p > 0\"\n    by (metis prod.prod_correct equiv_correct that)\n\n  end (* End context: UPPAAL network + valid start state *)\n\nend (* End of theory *)\n", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Uppaal_Networks/UPPAAL_State_Networks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878414043816, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3051412827033012}}
{"text": "(*  Title:       CoreC++\n    Author:      Daniel Wasserrab\n    Maintainer:  Daniel Wasserrab <wasserra at fmi.uni-passau.de>\n\n   Based on extracts from the Jinja theories:\n      Common/Objects.thy by David von Oheimb\n      Common/Conform.thy by David von Oheimb and Tobias Nipkow\n      Common/Exceptions.thy by Gerwin Klein and Martin Strecker\n      J/BigStep.thy by Tobias Nipkow\n      J/SmallStep.thy by Tobias Nipkow\n      J/WellTypeRT.thy by Tobias Nipkow \n*)\n\nsection \\<open>Heap Extension\\<close>\n\ntheory HeapExtension\nimports Progress\nbegin\n\nsubsection \\<open>The Heap Extension\\<close>\n\ndefinition hext :: \"heap \\<Rightarrow> heap \\<Rightarrow> bool\" (\"_ \\<unlhd> _\" [51,51] 50) where\n  \"h \\<unlhd> h'  \\<equiv>  \\<forall>a C S. h a = Some(C,S) \\<longrightarrow> (\\<exists>S'. h' a = Some(C,S'))\"\n\nlemma hextI: \"\\<forall>a C S. h a = Some(C,S) \\<longrightarrow> (\\<exists>S'. h' a = Some(C,S')) \\<Longrightarrow> h \\<unlhd> h'\"\n\napply (unfold hext_def)\napply auto\ndone\n\n\nlemma hext_objD: \"\\<lbrakk> h \\<unlhd> h'; h a = Some(C,S) \\<rbrakk> \\<Longrightarrow> \\<exists>S'. h' a = Some(C,S')\"\n\napply (unfold hext_def)\napply (force)\ndone\n\n\nlemma hext_refl [iff]: \"h \\<unlhd> h\"\n\napply (rule hextI)\napply (fast)\ndone\n\n\nlemma hext_new [simp]: \"h a = None \\<Longrightarrow> h \\<unlhd> h(a\\<mapsto>x)\"\n\napply (rule hextI)\napply (auto simp:fun_upd_apply)\ndone\n\n\nlemma hext_trans: \"\\<lbrakk> h \\<unlhd> h'; h' \\<unlhd> h'' \\<rbrakk> \\<Longrightarrow> h \\<unlhd> h''\"\n\napply (rule hextI)\napply (fast dest: hext_objD)\ndone\n\n\nlemma hext_upd_obj: \"h a = Some (C,S) \\<Longrightarrow> h \\<unlhd> h(a\\<mapsto>(C,S'))\"\n\napply (rule hextI)\napply (auto simp:fun_upd_apply)\ndone\n\n\n\nsubsection \\<open>\\<open>\\<unlhd>\\<close> and preallocated\\<close>\n\nlemma preallocated_hext:\n  \"\\<lbrakk> preallocated h; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> preallocated h'\"\nby (simp add: preallocated_def hext_def)\n\n\nlemmas preallocated_upd_obj = preallocated_hext [OF _ hext_upd_obj]\nlemmas preallocated_new  = preallocated_hext [OF _ hext_new]\n\n\n\nsubsection \\<open>\\<open>\\<unlhd>\\<close> in Small- and BigStep\\<close>\n\nlemma red_hext_incr: \"P,E \\<turnstile> \\<langle>e,(h,l)\\<rangle> \\<rightarrow> \\<langle>e',(h',l')\\<rangle>  \\<Longrightarrow> h \\<unlhd> h'\"\n  and reds_hext_incr: \"P,E \\<turnstile> \\<langle>es,(h,l)\\<rangle> [\\<rightarrow>] \\<langle>es',(h',l')\\<rangle>  \\<Longrightarrow> h \\<unlhd> h'\"\n\nproof(induct rule:red_reds_inducts)\n  case RedNew thus ?case\n    by(fastforce dest:new_Addr_SomeD simp:hext_def split:if_splits)\nnext\n  case RedFAss thus ?case by(simp add:hext_def split:if_splits)\nqed simp_all\n\n\nlemma step_hext_incr: \"P,E \\<turnstile> \\<langle>e,s\\<rangle> \\<rightarrow>* \\<langle>e',s'\\<rangle>  \\<Longrightarrow> hp s \\<unlhd> hp s'\"\n\nproof(induct rule:converse_rtrancl_induct2)\n  case refl thus ?case by(rule hext_refl)\nnext\n  case (step e s e'' s'')\n  have Red:\"((e, s), e'', s'') \\<in> Red P E\"\n    and hext:\"hp s'' \\<unlhd> hp s'\" by fact+\n  from Red have \"P,E \\<turnstile> \\<langle>e,s\\<rangle> \\<rightarrow> \\<langle>e'',s''\\<rangle>\" by simp\n  hence \"hp s \\<unlhd> hp s''\"\n    by(cases s,cases s'')(auto dest:red_hext_incr)\n  with hext show ?case by-(rule hext_trans)\nqed\n\n\nlemma steps_hext_incr: \"P,E \\<turnstile> \\<langle>es,s\\<rangle> [\\<rightarrow>]* \\<langle>es',s'\\<rangle>  \\<Longrightarrow> hp s \\<unlhd> hp s'\"\n\nproof(induct rule:converse_rtrancl_induct2)\n  case refl thus ?case by(rule hext_refl)\nnext\n  case (step es s es'' s'')\n  have Reds:\"((es, s), es'', s'') \\<in> Reds P E\"\n    and hext:\"hp s'' \\<unlhd> hp s'\" by fact+\n  from Reds have \"P,E \\<turnstile> \\<langle>es,s\\<rangle> [\\<rightarrow>] \\<langle>es'',s''\\<rangle>\" by simp\n  hence \"hp s \\<unlhd> hp s''\"\n    by(cases s,cases s'',auto dest:reds_hext_incr)\n  with hext show ?case by-(rule hext_trans)\nqed\n\n\n\nlemma eval_hext: \"P,E \\<turnstile> \\<langle>e,(h,l)\\<rangle> \\<Rightarrow> \\<langle>e',(h',l')\\<rangle> \\<Longrightarrow> h \\<unlhd> h'\"\nand evals_hext:  \"P,E \\<turnstile> \\<langle>es,(h,l)\\<rangle> [\\<Rightarrow>] \\<langle>es',(h',l')\\<rangle> \\<Longrightarrow> h \\<unlhd> h'\"\n\nproof (induct rule:eval_evals_inducts)\n  case New thus ?case\n    by(fastforce intro!: hext_new intro:someI simp:new_Addr_def\n                split:if_split_asm simp del:fun_upd_apply)\nnext\n  case FAss thus ?case\n    by(auto simp:sym[THEN hext_upd_obj] simp del:fun_upd_apply\n            elim!: hext_trans)\nqed (auto elim!: hext_trans)\n\n\n\nsubsection \\<open>\\<open>\\<unlhd>\\<close> and conformance\\<close>\n\nlemma conf_hext: \"h \\<unlhd> h' \\<Longrightarrow> P,h \\<turnstile> v :\\<le> T \\<Longrightarrow> P,h' \\<turnstile> v :\\<le> T\"\nby(cases T)(induct v,auto dest: hext_objD split:if_split_asm)+\n\nlemma confs_hext: \"P,h \\<turnstile> vs [:\\<le>] Ts \\<Longrightarrow> h \\<unlhd> h' \\<Longrightarrow> P,h' \\<turnstile> vs [:\\<le>] Ts\"\nby (erule list_all2_mono, erule conf_hext, assumption)\n\nlemma fconf_hext: \"\\<lbrakk> P,h \\<turnstile> fs (:\\<le>) E; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> fs (:\\<le>) E\"\n\napply (unfold fconf_def)\napply  (fast elim: conf_hext)\ndone\n\n\n\nlemmas fconf_upd_obj = fconf_hext [OF _ hext_upd_obj]\nlemmas fconf_new = fconf_hext [OF _ hext_new]\n\n\n\nlemma oconf_hext: \"P,h \\<turnstile> obj \\<surd> \\<Longrightarrow> h \\<unlhd> h' \\<Longrightarrow> P,h' \\<turnstile> obj \\<surd>\"\n\napply (auto simp:oconf_def)\napply (erule allE)\napply (erule_tac x=\"Cs\" in allE)\napply (erule_tac x=\"fs'\" in allE)\napply (fastforce elim:fconf_hext)\ndone\n\n\nlemmas oconf_new = oconf_hext [OF _ hext_new]\nlemmas oconf_upd_obj = oconf_hext [OF _ hext_upd_obj]\n\n\nlemma hconf_new: \"\\<lbrakk> P \\<turnstile> h \\<surd>; h a = None; P,h \\<turnstile> obj \\<surd> \\<rbrakk> \\<Longrightarrow> P \\<turnstile> h(a\\<mapsto>obj) \\<surd>\"\nby (unfold hconf_def) (auto intro: oconf_new preallocated_new)\n\nlemma \"\\<lbrakk>P \\<turnstile> h \\<surd>; h' = h(a \\<mapsto> (C, Collect (init_obj P C))); h a = None; wf_prog wf_md P\\<rbrakk>\n  \\<Longrightarrow> P \\<turnstile> h' \\<surd>\"\napply (simp add:hconf_def oconf_def)\napply auto\n     apply (rule_tac x=\"init_class_fieldmap P (last Cs)\" in exI)\n     apply (rule init_obj.intros)\n     apply assumption\n    apply (erule init_obj.cases)\n    apply clarsimp\n    apply (erule init_obj.cases)\n    apply clarsimp\n   apply (erule_tac x=\"a\" in allE)\n   apply clarsimp\n   apply (erule init_obj.cases)\n   apply simp\n  apply (erule_tac x=\"a\" in allE)\n  apply clarsimp\n  apply (erule init_obj.cases)\n  apply clarsimp\n  apply (drule Subobj_last_isClass)\n   apply simp\n  apply (auto simp:is_class_def)\n  apply (rule fconf_init_fields)\n  apply auto\n apply (erule_tac x=\"aa\" in allE)\n apply (erule_tac x=\"aaa\" in allE)\n apply (erule_tac x=\"b\" in allE)\n apply clarsimp\n apply (rotate_tac -1)\n apply (erule_tac x=\"Cs\" in allE)\n apply (erule_tac x=\"fs'\" in allE)\n apply clarsimp thm fconf_new\n apply (erule fconf_new)\n apply simp\napply (rule preallocated_new)\napply simp_all\ndone\n\n\n\nlemma hconf_upd_obj: \n\"\\<lbrakk> P \\<turnstile> h\\<surd>; h a = Some(C,S); P,h \\<turnstile> (C,S')\\<surd> \\<rbrakk> \\<Longrightarrow> P \\<turnstile> h(a\\<mapsto>(C,S'))\\<surd>\"\nby (unfold hconf_def) (auto intro: oconf_upd_obj preallocated_upd_obj)\n\nlemma lconf_hext: \"\\<lbrakk> P,h \\<turnstile> l (:\\<le>)\\<^sub>w E; h \\<unlhd> h' \\<rbrakk> \\<Longrightarrow> P,h' \\<turnstile> l (:\\<le>)\\<^sub>w E\"\n\napply (unfold lconf_def)\napply  (fast elim: conf_hext)\ndone\n\n\n\nsubsection \\<open>\\<open>\\<unlhd>\\<close> in the runtime type system\\<close>\n\nlemma hext_typeof_mono: \"\\<lbrakk> h \\<unlhd> h'; P \\<turnstile> typeof\\<^bsub>h\\<^esub> v = Some T \\<rbrakk> \\<Longrightarrow> P \\<turnstile> typeof\\<^bsub>h'\\<^esub> v = Some T\"\n\napply(cases v)\n    apply simp\n   apply simp\n  apply simp\n apply simp\napply(fastforce simp:hext_def)\ndone\n\n\n\nlemma WTrt_hext_mono: \"P,E,h \\<turnstile> e : T \\<Longrightarrow> (\\<And>h'. h \\<unlhd> h' \\<Longrightarrow> P,E,h' \\<turnstile> e : T)\"\nand WTrts_hext_mono: \"P,E,h \\<turnstile> es [:] Ts \\<Longrightarrow> (\\<And>h'. h \\<unlhd> h' \\<Longrightarrow> P,E,h' \\<turnstile> es [:] Ts)\"\n\napply(induct rule: WTrt_inducts)\napply(simp add: WTrtNew)\napply(fastforce intro: WTrtDynCast)\napply(fastforce intro: WTrtStaticCast)\napply(fastforce simp: WTrtVal dest:hext_typeof_mono)\napply(simp add: WTrtVar)\napply(fastforce simp add: WTrtBinOp)\napply(fastforce simp add: WTrtLAss)\napply(fastforce simp: WTrtFAcc del:WTrt_WTrts.intros WTrt_elim_cases)\napply(simp add: WTrtFAccNT)\napply(fastforce simp: WTrtFAss del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce simp: WTrtFAssNT del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce simp: WTrtCall del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce simp: WTrtStaticCall del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce simp: WTrtCallNT del:WTrt_WTrts.intros WTrt_elim_cases)\napply(fastforce)\napply(fastforce simp add: WTrtSeq)\napply(fastforce simp add: WTrtCond)\napply(fastforce simp add: WTrtWhile)\napply(fastforce simp add: WTrtThrow)\napply(simp add: WTrtNil)\napply(simp add: WTrtCons)\ndone\n\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/CoreC++/HeapExtension.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5389832206876841, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.30507449306892004}}
{"text": "theory \"Network_Equivalences-Diamond-Foundations\"\n  imports \"Network_Equivalences-Communication\"\nbegin\n\nabbreviation diamond_sending where\n  \"diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<equiv>\n    \\<comment> \\<open>Node 0:\\<close> s\\<^sub>0 \\<Rightarrow> [l\\<^sub>0\\<^sub>1, l\\<^sub>0\\<^sub>2] \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> s\\<^sub>1 \\<Rightarrow> [l\\<^sub>1\\<^sub>3] \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> s\\<^sub>2 \\<Rightarrow> [l\\<^sub>2\\<^sub>3] \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> s\\<^sub>3 \\<Rightarrow> [l\\<^sub>3\\<^sub>0]\"\n\nabbreviation diamond_receiving where\n  \"diamond_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<equiv>\n    \\<comment> \\<open>Link 0--1:\\<close> l\\<^sub>0\\<^sub>1 \\<rightarrow> r\\<^sub>1 \\<parallel>\n    \\<comment> \\<open>Link 0--2:\\<close> l\\<^sub>0\\<^sub>2 \\<rightarrow> r\\<^sub>2 \\<parallel>\n    \\<comment> \\<open>Link 1--3:\\<close> l\\<^sub>1\\<^sub>3 \\<rightarrow> r\\<^sub>3 \\<parallel>\n    \\<comment> \\<open>Link 2--3:\\<close> l\\<^sub>2\\<^sub>3 \\<rightarrow> r\\<^sub>3 \\<parallel>\n    \\<comment> \\<open>Link 3--0:\\<close> l\\<^sub>3\\<^sub>0 \\<rightarrow> r\\<^sub>0\"\n\nabbreviation initial_core where\n  \"initial_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<equiv>\n    \\<comment> \\<open>From link 0--1:\\<close> l\\<^sub>0\\<^sub>1 \\<rightarrow> l\\<^sub>1\\<^sub>3 \\<parallel>\n    \\<comment> \\<open>From link 0--2:\\<close> l\\<^sub>0\\<^sub>2 \\<rightarrow> l\\<^sub>2\\<^sub>3 \\<parallel>\n    \\<comment> \\<open>From link 1--3:\\<close> l\\<^sub>1\\<^sub>3 \\<rightarrow> l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>From link 2--3:\\<close> l\\<^sub>2\\<^sub>3 \\<rightarrow> l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>From link 3--0:\\<close> l\\<^sub>3\\<^sub>0 \\<rightarrow> l\\<^sub>0\\<^sub>1 \\<parallel> l\\<^sub>3\\<^sub>0 \\<rightarrow> l\\<^sub>0\\<^sub>2\"\n\nabbreviation transformed_core where\n  \"transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<equiv>\n    \\<comment> \\<open>Link 0--1:\\<close> l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>0\\<^sub>1 \\<parallel>\n    \\<comment> \\<open>Link 0--2:\\<close> l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>0\\<^sub>2 \\<parallel>\n    \\<comment> \\<open>Link 1--3:\\<close> l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>1\\<^sub>3 \\<parallel>\n    \\<comment> \\<open>Link 2--3:\\<close> l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>2\\<^sub>3\"\n\nabbreviation cross_sending where\n  \"cross_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 m \\<equiv>\n    \\<comment> \\<open>Node 0:\\<close> s\\<^sub>0 \\<rightarrow> m \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> s\\<^sub>1 \\<rightarrow> m \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> s\\<^sub>2 \\<rightarrow> m \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> s\\<^sub>3 \\<rightarrow> m\"\n\nabbreviation cross_receiving where\n  \"cross_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 m \\<equiv>\n    \\<comment> \\<open>Node 0:\\<close> m \\<rightarrow> r\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> m \\<rightarrow> r\\<^sub>1 \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> m \\<rightarrow> r\\<^sub>2 \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> m \\<rightarrow> r\\<^sub>3\"\n\nlemma focussing:\n  shows \"a \\<rightarrow> b \\<parallel> b \\<rightarrow> c \\<parallel> c \\<rightarrow> a \\<approx>\\<^sub>s a \\<leftrightarrow> b \\<parallel> a \\<leftrightarrow> c\" (is \"?p \\<approx>\\<^sub>s ?q\")\nproof-\n  have \"?p \\<approx>\\<^sub>s\n    (a \\<rightarrow> b \\<parallel> b \\<rightarrow> c) \\<parallel>\n    (b \\<rightarrow> c \\<parallel> c \\<rightarrow> a)\"\n    using thorn_simps by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    (a \\<rightarrow> b \\<parallel> b \\<rightarrow> c \\<parallel> a \\<rightarrow> c) \\<parallel>\n    (b \\<rightarrow> c \\<parallel> c \\<rightarrow> a \\<parallel> b \\<rightarrow> a)\"\n    using unidirectional_bridge_shortcut_redundancy by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    a \\<rightarrow> b \\<parallel> c \\<rightarrow> a \\<parallel>\n    (b \\<rightarrow> a \\<parallel> a \\<rightarrow> c \\<parallel> b \\<rightarrow> c)\"\n    using thorn_simps by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    a \\<rightarrow> b \\<parallel> c \\<rightarrow> a \\<parallel>\n    (b \\<rightarrow> a \\<parallel> a \\<rightarrow> c)\"\n    using unidirectional_bridge_shortcut_redundancy by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s ?q\"\n    unfolding bidirectional_bridge_def using thorn_simps by equivalence\n  finally show ?thesis .\nqed\n\nlemma core_transformation:\n  shows \"initial_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<approx>\\<^sub>s transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0\"\nproof -\n  have \"initial_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<approx>\\<^sub>s\n    \\<comment> \\<open>Left triangle:\\<close> (l\\<^sub>3\\<^sub>0 \\<rightarrow> l\\<^sub>0\\<^sub>1 \\<parallel> l\\<^sub>0\\<^sub>1 \\<rightarrow> l\\<^sub>1\\<^sub>3 \\<parallel> l\\<^sub>1\\<^sub>3 \\<rightarrow> l\\<^sub>3\\<^sub>0) \\<parallel>\n    \\<comment> \\<open>Right triangle:\\<close> (l\\<^sub>3\\<^sub>0 \\<rightarrow> l\\<^sub>0\\<^sub>2 \\<parallel> l\\<^sub>0\\<^sub>2 \\<rightarrow> l\\<^sub>2\\<^sub>3 \\<parallel> l\\<^sub>2\\<^sub>3 \\<rightarrow> l\\<^sub>3\\<^sub>0)\"\n    using thorn_simps by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    \\<comment> \\<open>Left triangle:\\<close> (l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>0\\<^sub>1 \\<parallel> l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>1\\<^sub>3) \\<parallel>\n    \\<comment> \\<open>Right triangle:\\<close> (l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>0\\<^sub>2 \\<parallel> l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>2\\<^sub>3)\"\n    using focussing by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0\"\n    unfolding bidirectional_bridge_def using thorn_simps by equivalence\n  finally show ?thesis .\nqed\n\nlemma sending_collapse:\n  shows \"\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel>\n    transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<parallel>\n    diamond_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0\n    \\<approx>\\<^sub>s\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel>\n    transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<parallel>\n    cross_sending s\\<^sub>0 s\\<^sub>1 s\\<^sub>2 s\\<^sub>3 l\\<^sub>3\\<^sub>0\"\n    (is \"?p \\<approx>\\<^sub>s ?q\")\nproof -\n  have \"?p \\<approx>\\<^sub>s\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>Node 0:\\<close> (\\<Prod>x\\<leftarrow>[(l\\<^sub>3\\<^sub>0, l\\<^sub>0\\<^sub>1), (l\\<^sub>3\\<^sub>0, l\\<^sub>0\\<^sub>2)]. fst x \\<leftrightarrow> snd x \\<parallel> s\\<^sub>0 \\<Rightarrow> map snd [(l\\<^sub>3\\<^sub>0, l\\<^sub>0\\<^sub>1), (l\\<^sub>3\\<^sub>0, l\\<^sub>0\\<^sub>2)]) \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> (\\<Prod>x\\<leftarrow>[(l\\<^sub>3\\<^sub>0, l\\<^sub>1\\<^sub>3)]. fst x \\<leftrightarrow> snd x \\<parallel> s\\<^sub>1 \\<Rightarrow> map snd [(l\\<^sub>3\\<^sub>0, l\\<^sub>1\\<^sub>3)]) \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> (\\<Prod>x\\<leftarrow>[(l\\<^sub>3\\<^sub>0, l\\<^sub>2\\<^sub>3)]. fst x \\<leftrightarrow> snd x \\<parallel> s\\<^sub>2 \\<Rightarrow> map snd [(l\\<^sub>3\\<^sub>0, l\\<^sub>2\\<^sub>3)]) \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> s\\<^sub>3 \\<Rightarrow> [l\\<^sub>3\\<^sub>0]\"\n    unfolding general_parallel.simps\n    using thorn_simps\n    by (equivalence simplification: fst_conv snd_conv list.map)\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>Node 0:\\<close> (\\<Prod>x\\<leftarrow>[(l\\<^sub>3\\<^sub>0, l\\<^sub>0\\<^sub>1), (l\\<^sub>3\\<^sub>0, l\\<^sub>0\\<^sub>2)]. fst x \\<leftrightarrow> snd x \\<parallel> s\\<^sub>0 \\<Rightarrow> map fst [(l\\<^sub>3\\<^sub>0, l\\<^sub>0\\<^sub>1), (l\\<^sub>3\\<^sub>0, l\\<^sub>0\\<^sub>2)]) \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> (\\<Prod>x\\<leftarrow>[(l\\<^sub>3\\<^sub>0, l\\<^sub>1\\<^sub>3)]. fst x \\<leftrightarrow> snd x \\<parallel> s\\<^sub>1 \\<Rightarrow> map fst [(l\\<^sub>3\\<^sub>0, l\\<^sub>1\\<^sub>3)]) \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> (\\<Prod>x\\<leftarrow>[(l\\<^sub>3\\<^sub>0, l\\<^sub>2\\<^sub>3)]. fst x \\<leftrightarrow> snd x \\<parallel> s\\<^sub>2 \\<Rightarrow> map fst [(l\\<^sub>3\\<^sub>0, l\\<^sub>2\\<^sub>3)]) \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> s\\<^sub>3 \\<Rightarrow> [l\\<^sub>3\\<^sub>0]\"\n    by (intro\n      distributor_target_switch [THEN synchronous.weak.bisimilarity_symmetry_rule]\n      synchronous.weak.bisimilarity_reflexivity_rule\n      synchronous.weak.parallel_is_compatible_with_bisimilarity\n    )\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel>\n    transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>Node 0:\\<close> s\\<^sub>0 \\<Rightarrow> [l\\<^sub>3\\<^sub>0, l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> s\\<^sub>1 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> s\\<^sub>2 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> s\\<^sub>3 \\<Rightarrow> [l\\<^sub>3\\<^sub>0]\"\n    unfolding general_parallel.simps\n    using thorn_simps\n    by (equivalence simplification: fst_conv snd_conv list.map)\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>Node 0:\\<close> (\\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel> s\\<^sub>0 \\<triangleright>\\<^sup>\\<infinity> x. (l\\<^sub>3\\<^sub>0 \\<triangleleft> \\<box> x \\<parallel> l\\<^sub>3\\<^sub>0 \\<triangleleft> \\<box> x)) \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> s\\<^sub>1 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> s\\<^sub>2 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> s\\<^sub>3 \\<Rightarrow> [l\\<^sub>3\\<^sub>0]\"\n    unfolding distributor_def and general_parallel.simps using thorn_simps sorry\n    (* FIXME:\n      This should by solvable by \\<^theory_text>\\<open>equivalence\\<close> again once it is configured to reason under\n      \\<^theory_text>\\<open>repeated_receive\\<close>.\n    *)\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>Node 0:\\<close> (\\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel> s\\<^sub>0 \\<triangleright>\\<^sup>\\<infinity> x. (\\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel> l\\<^sub>3\\<^sub>0 \\<triangleleft> \\<box> x \\<parallel> l\\<^sub>3\\<^sub>0 \\<triangleleft> \\<box> x)) \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> s\\<^sub>1 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> s\\<^sub>2 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> s\\<^sub>3 \\<Rightarrow> [l\\<^sub>3\\<^sub>0]\"\n    using inner_duploss_redundancy by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>Node 0:\\<close> (\\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel> s\\<^sub>0 \\<triangleright>\\<^sup>\\<infinity> x. (\\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel> l\\<^sub>3\\<^sub>0 \\<triangleleft> \\<box> x)) \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> s\\<^sub>1 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> s\\<^sub>2 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> s\\<^sub>3 \\<Rightarrow> [l\\<^sub>3\\<^sub>0]\"\n    using send_idempotency_under_duploss sorry\n    (* FIXME:\n      This should by solvable by \\<^theory_text>\\<open>equivalence\\<close> again once it is configured to reason under\n      \\<^theory_text>\\<open>repeated_receive\\<close>.\n    *)\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>Node 0:\\<close> (\\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel> s\\<^sub>0 \\<triangleright>\\<^sup>\\<infinity> x. l\\<^sub>3\\<^sub>0 \\<triangleleft> \\<box> x) \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> s\\<^sub>1 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> s\\<^sub>2 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> s\\<^sub>3 \\<Rightarrow> [l\\<^sub>3\\<^sub>0]\"\n    using inner_duploss_redundancy by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel>\n    transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>Node 0:\\<close> s\\<^sub>0 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 1:\\<close> s\\<^sub>1 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 2:\\<close> s\\<^sub>2 \\<Rightarrow> [l\\<^sub>3\\<^sub>0] \\<parallel>\n    \\<comment> \\<open>Node 3:\\<close> s\\<^sub>3 \\<Rightarrow> [l\\<^sub>3\\<^sub>0]\"\n    unfolding distributor_def and general_parallel.simps using thorn_simps sorry\n    (* FIXME:\n      This should by solvable by \\<^theory_text>\\<open>equivalence\\<close> again once it is configured to reason under\n      \\<^theory_text>\\<open>repeated_receive\\<close>.\n    *)\n  also have \"\\<dots> \\<approx>\\<^sub>s ?q\"\n    unfolding unidirectional_bridge_def by equivalence\n  finally show ?thesis .\nqed\n\nlemma receiving_collapse:\n  shows \"\n    transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<parallel>\n    diamond_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0\n    \\<approx>\\<^sub>s\n    transformed_core l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3 l\\<^sub>3\\<^sub>0 \\<parallel>\n    cross_receiving r\\<^sub>0 r\\<^sub>1 r\\<^sub>2 r\\<^sub>3 l\\<^sub>3\\<^sub>0\"\n    (is \"?p \\<approx>\\<^sub>s ?q\")\nproof -\n  have \"?p \\<approx>\\<^sub>s\n    \\<comment> \\<open>Link 0--1:\\<close> (l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>0\\<^sub>1 \\<parallel> l\\<^sub>0\\<^sub>1 \\<rightarrow> r\\<^sub>1) \\<parallel>\n    \\<comment> \\<open>Link 0--2:\\<close> (l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>0\\<^sub>2 \\<parallel> l\\<^sub>0\\<^sub>2 \\<rightarrow> r\\<^sub>2) \\<parallel>\n    \\<comment> \\<open>Link 1--3:\\<close> (l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>1\\<^sub>3 \\<parallel> l\\<^sub>1\\<^sub>3 \\<rightarrow> r\\<^sub>3) \\<parallel>\n    \\<comment> \\<open>Link 2--3:\\<close> (l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>2\\<^sub>3 \\<parallel> l\\<^sub>2\\<^sub>3 \\<rightarrow> r\\<^sub>3) \\<parallel>\n    \\<comment> \\<open>Link 3--0:\\<close> l\\<^sub>3\\<^sub>0 \\<rightarrow> r\\<^sub>0\"\n    using thorn_simps by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s\n    \\<comment> \\<open>Link 0--1:\\<close> (l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>0\\<^sub>1 \\<parallel> l\\<^sub>3\\<^sub>0 \\<rightarrow> r\\<^sub>1) \\<parallel>\n    \\<comment> \\<open>Link 0--2:\\<close> (l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>0\\<^sub>2 \\<parallel> l\\<^sub>3\\<^sub>0 \\<rightarrow> r\\<^sub>2) \\<parallel>\n    \\<comment> \\<open>Link 1--3:\\<close> (l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>1\\<^sub>3 \\<parallel> l\\<^sub>3\\<^sub>0 \\<rightarrow> r\\<^sub>3) \\<parallel>\n    \\<comment> \\<open>Link 2--3:\\<close> (l\\<^sub>3\\<^sub>0 \\<leftrightarrow> l\\<^sub>2\\<^sub>3 \\<parallel> l\\<^sub>3\\<^sub>0 \\<rightarrow> r\\<^sub>3) \\<parallel>\n    \\<comment> \\<open>Link 3--0:\\<close> l\\<^sub>3\\<^sub>0 \\<rightarrow> r\\<^sub>0\"\n    using unidirectional_bridge_source_switch by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s ?q\"\n    using thorn_simps by equivalence\n  finally show ?thesis .\nqed\n\nlemma core_collapse:\n  shows \"\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<nu> l\\<^sub>0\\<^sub>1 l\\<^sub>0\\<^sub>2 l\\<^sub>1\\<^sub>3 l\\<^sub>2\\<^sub>3. (\n      \\<currency>\\<^sup>* (\\<box> l\\<^sub>0\\<^sub>1) \\<parallel> \\<currency>\\<^sup>* (\\<box> l\\<^sub>0\\<^sub>2) \\<parallel> \\<currency>\\<^sup>* (\\<box> l\\<^sub>1\\<^sub>3) \\<parallel> \\<currency>\\<^sup>* (\\<box> l\\<^sub>2\\<^sub>3) \\<parallel>\n      transformed_core (\\<box> l\\<^sub>0\\<^sub>1) (\\<box> l\\<^sub>0\\<^sub>2) (\\<box> l\\<^sub>1\\<^sub>3) (\\<box> l\\<^sub>2\\<^sub>3) l\\<^sub>3\\<^sub>0\n    )\n    \\<approx>\\<^sub>s\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0\"\nproof -\n  have \"\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<langle>0\\<rangle> \\<nu> l\\<^sub>0\\<^sub>1. \\<langle>1\\<rangle> \\<nu> l\\<^sub>0\\<^sub>2. \\<langle>2\\<rangle> \\<nu> l\\<^sub>1\\<^sub>3. \\<langle>3\\<rangle> \\<nu> l\\<^sub>2\\<^sub>3. (\n      \\<currency>\\<^sup>* (\\<box> l\\<^sub>0\\<^sub>1) \\<parallel> \\<currency>\\<^sup>* (\\<box> l\\<^sub>0\\<^sub>2) \\<parallel> \\<currency>\\<^sup>* (\\<box> l\\<^sub>1\\<^sub>3) \\<parallel> \\<currency>\\<^sup>* (\\<box> l\\<^sub>2\\<^sub>3) \\<parallel>\n      transformed_core (\\<box> l\\<^sub>0\\<^sub>1) (\\<box> l\\<^sub>0\\<^sub>2) (\\<box> l\\<^sub>1\\<^sub>3) (\\<box> l\\<^sub>2\\<^sub>3) l\\<^sub>3\\<^sub>0\n    )\n    \\<approx>\\<^sub>s\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel>\n    \\<comment> \\<open>Link 0--1:\\<close> \\<langle>0\\<rangle> \\<nu> l\\<^sub>0\\<^sub>1. (\\<currency>\\<^sup>* (\\<box> l\\<^sub>0\\<^sub>1) \\<parallel> l\\<^sub>3\\<^sub>0 \\<leftrightarrow> \\<box> l\\<^sub>0\\<^sub>1) \\<parallel>\n    \\<comment> \\<open>Link 0--2:\\<close> \\<langle>1\\<rangle> \\<nu> l\\<^sub>0\\<^sub>2. (\\<currency>\\<^sup>* (\\<box> l\\<^sub>0\\<^sub>2) \\<parallel> l\\<^sub>3\\<^sub>0 \\<leftrightarrow> \\<box> l\\<^sub>0\\<^sub>2) \\<parallel>\n    \\<comment> \\<open>Link 1--3:\\<close> \\<langle>2\\<rangle> \\<nu> l\\<^sub>1\\<^sub>3. (\\<currency>\\<^sup>* (\\<box> l\\<^sub>1\\<^sub>3) \\<parallel> l\\<^sub>3\\<^sub>0 \\<leftrightarrow> \\<box> l\\<^sub>1\\<^sub>3) \\<parallel>\n    \\<comment> \\<open>Link 2--3:\\<close> \\<langle>3\\<rangle> \\<nu> l\\<^sub>2\\<^sub>3. (\\<currency>\\<^sup>* (\\<box> l\\<^sub>2\\<^sub>3) \\<parallel> l\\<^sub>3\\<^sub>0 \\<leftrightarrow> \\<box> l\\<^sub>2\\<^sub>3)\"\n    using thorn_simps sorry\n    (* FIXME:\n      This goal started to cause problems with the switch to the Þ-calculus. We hope that the\n      \\<^theory_text>\\<open>iprover\\<close>-based equivalence reasoner will be able to solve it.\n    *)\n  also have\"\\<dots> \\<approx>\\<^sub>s\n    \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel> \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel> \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel> \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0 \\<parallel> \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0\"\n    unfolding tagged_new_channel_def using duploss_detour_collapse by equivalence\n  also have \"\\<dots> \\<approx>\\<^sub>s \\<currency>\\<^sup>*l\\<^sub>3\\<^sub>0\"\n    using thorn_simps by equivalence\n  finally show ?thesis unfolding tagged_new_channel_def .\nqed\n\nend\n", "meta": {"author": "input-output-hk", "repo": "network-equivalences", "sha": "dedffb052a31ded438928ca44a7ebb2475a792d7", "save_path": "github-repos/isabelle/input-output-hk-network-equivalences", "path": "github-repos/isabelle/input-output-hk-network-equivalences/network-equivalences-dedffb052a31ded438928ca44a7ebb2475a792d7/src/Network_Equivalences-Diamond-Foundations.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.538983220687684, "lm_q2_score": 0.5660185351961015, "lm_q1q2_score": 0.30507449306892}}
{"text": "theory \"Kerberos_V4_cert_auto\"\nimports\n  \"ESPLogic\"\nbegin\n\n(* section:  The Kerberos Protocol, Version 4  *)\n\n(* text: \n  Modeled after the description given by Bella [1] based on the original\n  technical report [2].\n\n  Notable differences:\n\n    1. We do not model the timestamps and the timing properties because our\n       model does not support reasoning about them yet. We model them as\n       freshly generated nonces that are leaked immediately after generation.\n\n    2. We do not model session key leakage, as our support for key compromise\n       properties is not ready yet.\n\n    3. We provide more general authentication and secrecy properties, as we do\n       not assume a priory the uncompromisedness of the ticket granting server.\n       Furthermore, the authentication propertis are more fine-grained due to\n       our more precise execution model.\n\n    4. We use explicit global constants instead of implicit typing to identify\n       the different encryptions.\n\n    5. We use the abbreviations: C for Client, A for authenticator, G for\n       ticket granting server, S for server.\n\n\n[1] Bella, Giampaolo and Paulson, Lawrence C., \"Kerberos Version 4: Inductive\n    Analysis of the Secrecy Goals\", in ESORICS, 1998, pp. 361-375.\n\n[2] Miller, S. P. and Neuman, B. C. and Schiller, J. I. and Saltzer, J. H.,\n    \"Kerberos Authentication and Authorization System\", in Project Athena Technical\n    Plan, 1987, pp. 1-36.\n *)\n\nrole A\nwhere \"A =\n  [ Recv ''1'' <| sMV ''C'', sMV ''G'', sMV ''Tc1'' |>\n  , Send ''2_leak'' ( sN ''Ta'' )\n  , Send ''2'' <| sAV ''A'',\n                  PEnc <| sC ''21'', sN ''AuthKey'', sMV ''G'', sN ''Ta'',\n                          PEnc <| sC ''22'', sMV ''C'', sMV ''G'', sN ''AuthKey'', sN ''Ta'' |>\n                               ( PSymK ( sAV ''A'' ) ( sMV ''G'' ) )\n                       |>\n                       ( PSymK ( sMV ''C'' ) ( sAV ''A'' ) )\n               |>\n  ]\"\n\nrole C\nwhere \"C =\n  [ Send ''1_leak'' ( sN ''Tc1'' )\n  , Send ''1'' <| sAV ''C'', sAV ''G'', sN ''Tc1'' |>\n  , Recv ''2'' <| sMV ''A'',\n                  PEnc <| sC ''21'', sMV ''AuthKey'', sAV ''G'', sMV ''Ta'',\n                          sMV ''AuthTicket''\n                       |>\n                       ( PSymK ( sAV ''C'' ) ( sMV ''A'' ) )\n               |>\n  , Send ''3_leak'' ( sN ''Tc2'' )\n  , Send ''3'' <| sMV ''A'', sMV ''AuthTicket'',\n                  PEnc <| sC ''3'', sAV ''C'', sN ''Tc2'' |> ( sMV ''AuthKey'' ), sAV ''S''\n               |>\n  , Recv ''4'' ( PEnc <| sC ''41'', sMV ''ServKey'', sAV ''S'', sMV ''Tg'',\n                         sMV ''ServTicket''\n                      |>\n                      ( sMV ''AuthKey'' )\n               )\n  , Send ''5_leak'' ( sN ''Tc3'' )\n  , Send ''5'' <| sAV ''G'', sMV ''ServTicket'',\n                  PEnc <| sC ''5'', sAV ''C'', sN ''Tc3'' |> ( sMV ''ServKey'' )\n               |>\n  , Recv ''6'' ( PEnc <| sC ''6'', sN ''Tc3'' |> ( sMV ''ServKey'' ) )\n  ]\"\n\nrole G\nwhere \"G =\n  [ Recv ''3'' <| sMV ''A'',\n                  PEnc <| sC ''22'', sMV ''C'', sAV ''G'', sMV ''AuthKey'', sMV ''Ta'' |>\n                       ( PSymK ( sMV ''A'' ) ( sAV ''G'' ) ),\n                  PEnc <| sC ''3'', sMV ''C'', sMV ''Tc2'' |> ( sMV ''AuthKey'' ),\n                  sMV ''S''\n               |>\n  , Send ''4_leak'' ( sN ''Tg'' )\n  , Send ''4'' ( PEnc <| sC ''41'', sN ''ServKey'', sMV ''S'', sN ''Tg'',\n                         PEnc <| sC ''42'', sMV ''C'', sMV ''S'', sN ''ServKey'', sN ''Tg'' |>\n                              ( PSymK ( sAV ''G'' ) ( sMV ''S'' ) )\n                      |>\n                      ( sMV ''AuthKey'' )\n               )\n  ]\"\n\nrole S\nwhere \"S =\n  [ Recv ''5'' <| sMV ''G'',\n                  PEnc <| sC ''42'', sMV ''C'', sAV ''S'', sMV ''ServKey'', sMV ''Tg'' |>\n                       ( PSymK ( sMV ''G'' ) ( sAV ''S'' ) ),\n                  PEnc <| sC ''5'', sMV ''C'', sMV ''Tc3'' |> ( sMV ''ServKey'' )\n               |>\n  , Send ''6'' ( PEnc <| sC ''6'', sMV ''Tc3'' |> ( sMV ''ServKey'' ) )\n  ]\"\n\nprotocol Kerberos\nwhere \"Kerberos = { A, C, G, S }\"\n\nlocale restricted_Kerberos_state = Kerberos_state\n\ntype_invariant Kerberos_typing for Kerberos\nwhere \"Kerberos_typing = mk_typing\n  [ ((C, ''A''), (KnownT C_2))\n  , ((G, ''A''), (KnownT G_3))\n  , ((C, ''AuthKey''), (SumT (KnownT C_2) (NonceT A ''AuthKey'')))\n  , ((G, ''AuthKey''), (SumT (KnownT G_3) (NonceT A ''AuthKey'')))\n  , ((C, ''AuthTicket''),\n     (SumT (KnownT C_2) (EncT (TupT (ConstT ''22'') (TupT (KnownT C_2) (TupT AgentT (TupT (NonceT A ''AuthKey'') (NonceT A ''Ta''))))) (KT AgentT AgentT))))\n  , ((A, ''C''), (KnownT A_1))\n  , ((G, ''C''), (SumT (KnownT G_3) AgentT))\n  , ((S, ''C''), (SumT (KnownT S_5) AgentT))\n  , ((A, ''G''), (KnownT A_1))\n  , ((S, ''G''), (KnownT S_5))\n  , ((G, ''S''), (KnownT G_3))\n  , ((C, ''ServKey''), (SumT (KnownT C_4) (NonceT G ''ServKey'')))\n  , ((S, ''ServKey''), (SumT (KnownT S_5) (NonceT G ''ServKey'')))\n  , ((C, ''ServTicket''),\n     (SumT (KnownT C_4) (EncT (TupT (ConstT ''42'') (TupT (KnownT C_4) (TupT AgentT (TupT (NonceT G ''ServKey'') (NonceT G ''Tg''))))) (KT AgentT AgentT))))\n  , ((C, ''Ta''), (SumT (KnownT C_2) (NonceT A ''Ta'')))\n  , ((G, ''Ta''), (SumT (KnownT G_3) (NonceT A ''Ta'')))\n  , ((A, ''Tc1''), (KnownT A_1))\n  , ((G, ''Tc2''), (SumT (KnownT G_3) (NonceT C ''Tc2'')))\n  , ((S, ''Tc3''), (SumT (KnownT S_5) (NonceT C ''Tc3'')))\n  , ((C, ''Tg''), (SumT (KnownT C_4) (NonceT G ''Tg'')))\n  , ((S, ''Tg''), (SumT (KnownT S_5) (NonceT G ''Tg'')))\n  ]\"\n\nsublocale Kerberos_state < Kerberos_typing_state\nproof -\n  have \"(t,r,s) : approx Kerberos_typing\"\n  proof(cases rule: reachable_in_approxI_ext\n        [OF Kerberos_typing.monoTyp, completeness_cases_rule])\n    case (A_1_C t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_1_C\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (A_1_G t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_1_G\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (A_1_Tc1 t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = A_1_Tc1\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (C_2_A t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = C_2_A\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (C_2_AuthKey t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = C_2_AuthKey\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''21'', s(MV ''AuthKey'' tid0), s(AV ''G'' tid0),\n               s(MV ''Ta'' tid0), s(MV ''AuthTicket'' tid0)\n            |}\n            ( K ( s(AV ''C'' tid0) ) ( s(MV ''A'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (C_2_AuthTicket t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = C_2_AuthTicket\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''21'', s(MV ''AuthKey'' tid0), s(AV ''G'' tid0),\n               s(MV ''Ta'' tid0), s(MV ''AuthTicket'' tid0)\n            |}\n            ( K ( s(AV ''C'' tid0) ) ( s(MV ''A'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (C_2_Ta t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = C_2_Ta\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''21'', s(MV ''AuthKey'' tid0), s(AV ''G'' tid0),\n               s(MV ''Ta'' tid0), s(MV ''AuthTicket'' tid0)\n            |}\n            ( K ( s(AV ''C'' tid0) ) ( s(MV ''A'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (C_4_ServKey t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = C_4_ServKey\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''41'', s(MV ''ServKey'' tid0), s(AV ''S'' tid0),\n               s(MV ''Tg'' tid0), s(MV ''ServTicket'' tid0)\n            |}\n            ( s(MV ''AuthKey'' tid0) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (C_4_ServTicket t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = C_4_ServTicket\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''41'', s(MV ''ServKey'' tid0), s(AV ''S'' tid0),\n               s(MV ''Tg'' tid0), s(MV ''ServTicket'' tid0)\n            |}\n            ( s(MV ''AuthKey'' tid0) ) \")\n      case (G_4_enc tid1) note_unified facts = this facts\n      thus ?thesis proof(sources! \"\n                       Enc {| LC ''3'', s(MV ''C'' tid1), s(MV ''Tc2'' tid1) |}\n                           ( s(MV ''AuthKey'' tid0) ) \")\n      qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (C_4_Tg t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = C_4_Tg\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''41'', s(MV ''ServKey'' tid0), s(AV ''S'' tid0),\n               s(MV ''Tg'' tid0), s(MV ''ServTicket'' tid0)\n            |}\n            ( s(MV ''AuthKey'' tid0) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (G_3_A t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = G_3_A\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (G_3_AuthKey t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = G_3_AuthKey\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''22'', s(MV ''C'' tid0), s(AV ''G'' tid0),\n               s(MV ''AuthKey'' tid0), s(MV ''Ta'' tid0)\n            |}\n            ( K ( s(MV ''A'' tid0) ) ( s(AV ''G'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (G_3_C t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = G_3_C\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''3'', s(MV ''C'' tid0), s(MV ''Tc2'' tid0) |}\n            ( s(MV ''AuthKey'' tid0) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (G_3_S t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = G_3_S\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (G_3_Ta t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = G_3_Ta\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''22'', s(MV ''C'' tid0), s(AV ''G'' tid0),\n               s(MV ''AuthKey'' tid0), s(MV ''Ta'' tid0)\n            |}\n            ( K ( s(MV ''A'' tid0) ) ( s(AV ''G'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (G_3_Tc2 t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = G_3_Tc2\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''3'', s(MV ''C'' tid0), s(MV ''Tc2'' tid0) |}\n            ( s(MV ''AuthKey'' tid0) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (S_5_C t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = S_5_C\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''5'', s(MV ''C'' tid0), s(MV ''Tc3'' tid0) |}\n            ( s(MV ''ServKey'' tid0) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (S_5_G t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = S_5_G\n    thus ?case\n    by (fastforce intro: event_predOrdI split: if_splits)\n  next\n    case (S_5_ServKey t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = S_5_ServKey\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''42'', s(MV ''C'' tid0), s(AV ''S'' tid0),\n               s(MV ''ServKey'' tid0), s(MV ''Tg'' tid0)\n            |}\n            ( K ( s(MV ''G'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (S_5_Tc3 t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = S_5_Tc3\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''5'', s(MV ''C'' tid0), s(MV ''Tc3'' tid0) |}\n            ( s(MV ''ServKey'' tid0) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  next\n    case (S_5_Tg t r s tid0)\n    then interpret state: Kerberos_typing_state t r s\n      by unfold_locales auto\n    note_prefix_closed (state) facts = S_5_Tg\n    thus ?case\n    proof(sources! \"\n        Enc {| LC ''42'', s(MV ''C'' tid0), s(AV ''S'' tid0),\n               s(MV ''ServKey'' tid0), s(MV ''Tg'' tid0)\n            |}\n            ( K ( s(MV ''G'' tid0) ) ( s(AV ''S'' tid0) ) ) \")\n    qed (safe?, simp_all?, insert facts, (((fastforce intro: event_predOrdI split: if_splits))+)?)\n  qed\n  thus \"Kerberos_typing_state t r s\" by unfold_locales auto\nqed\n\ntext{* Prove secrecy of long-term keys. *}\ncontext Kerberos_state begin\n\n  (* This rule is unsafe in general, but OK here, \n     as we are only reasoning about static compromise. \n  *)\n  lemma static_longterm_key_reveal[dest!]:\n    \"predOrd t (LKR a) e ==> RLKR a : reveals t\"\n    by (auto intro: compr_predOrdI)\n\n  lemma longterm_private_key_secrecy:\n    assumes facts:\n      \"SK m : knows t\"\n      \"RLKR m ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"SK m\")\n\n  lemma longterm_sym_ud_key_secrecy:\n    assumes facts:\n      \"K m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n    shows \"False\"\n  using facts by (sources \"K m1 m2\")\n\n  lemma longterm_sym_bd_key_secrecy:\n    assumes facts:\n      \"Kbd m1 m2 : knows t\"\n      \"RLKR m1 ~: reveals t\"\n      \"RLKR m2 ~: reveals t\"\n      \"m1 : Agent\"\n      \"m2 : Agent\"\n    shows \"False\"\n  proof -\n    from facts \n    have \"KShr (agents {m1, m2}) : knows t\"\n      by (auto simp: Kbd_def)\n    thus ?thesis using facts\n    proof (sources \"KShr (agents {m1, m2})\")\n    qed (auto simp: agents_def Agent_def)\n  qed\n\n  lemmas ltk_secrecy =\n    longterm_sym_ud_key_secrecy\n    longterm_sym_ud_key_secrecy[OF in_knows_predOrd1]\n    longterm_sym_bd_key_secrecy\n    longterm_sym_bd_key_secrecy[OF in_knows_predOrd1]\n    longterm_private_key_secrecy\n    longterm_private_key_secrecy[OF in_knows_predOrd1]\n\nend\n\n(* subsection:  Secrecy Properties  *)\n\nlemma (in restricted_Kerberos_state) A_AuthKey_secret:\n  assumes facts:\n    \"roleMap r tid0 = Some A\"\n    \"RLKR(s(AV ''A'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''C'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''G'' tid0)) ~: reveals t\"\n    \"LN ''AuthKey'' tid0 : knows t\"\n  shows \"False\"\nusing facts proof(sources! \" LN ''AuthKey'' tid0 \")\n  case A_2_AuthKey note_unified facts = this facts\n  thus ?thesis by (auto dest!: ltk_secrecy)\nnext\n  case A_2_AuthKey_1 note_unified facts = this facts\n  thus ?thesis by (auto dest!: ltk_secrecy)\nnext\n  case (C_3_AuthTicket_AuthKey tid1 a0 a1 tid3 a2 a3) note_unified facts = this facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''21'', s(MV ''AuthKey'' tid1), s(AV ''G'' tid1),\n                          s(MV ''Ta'' tid1),\n                          Enc {| LC ''22'', a0, a1, LN ''AuthKey'' tid0, LN ''Ta'' tid3 |}\n                              ( K ( a2 ) ( a3 ) )\n                       |}\n                       ( K ( s(AV ''C'' tid1) ) ( s(MV ''A'' tid1) ) ) \")\n    case (A_2_enc tid4) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_Kerberos_state) C_AuthKey_secret:\n  assumes facts:\n    \"roleMap r tid0 = Some C\"\n    \"RLKR(s(AV ''C'' tid0)) ~: reveals t\"\n    \"RLKR(s(AV ''G'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n    \"( tid0, C_2 ) : steps t\"\n    \"s(MV ''AuthKey'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''21'', s(MV ''AuthKey'' tid0), s(AV ''G'' tid0),\n                          s(MV ''Ta'' tid0), s(MV ''AuthTicket'' tid0)\n                       |}\n                       ( K ( s(AV ''C'' tid0) ) ( s(MV ''A'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (A_2_enc tid1) note_unified facts = this facts\n    thus ?thesis by (fastforce dest: A_AuthKey_secret intro: event_predOrdI)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_Kerberos_state) G_AuthKey_secret:\n  assumes facts:\n    \"roleMap r tid0 = Some G\"\n    \"RLKR(s(AV ''G'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''C'' tid0)) ~: reveals t\"\n    \"( tid0, G_3 ) : steps t\"\n    \"s(MV ''AuthKey'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''22'', s(MV ''C'' tid0), s(AV ''G'' tid0),\n                          s(MV ''AuthKey'' tid0), s(MV ''Ta'' tid0)\n                       |}\n                       ( K ( s(MV ''A'' tid0) ) ( s(AV ''G'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (A_2_enc_1 tid1) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (C_3_AuthTicket_enc tid1 a0 a1 tid2 tid3 a2 a3) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''21'', s(MV ''AuthKey'' tid1), s(AV ''G'' tid1),\n                            s(MV ''Ta'' tid1),\n                            Enc {| LC ''22'', a0, s(AV ''G'' tid0), LN ''AuthKey'' tid2,\n                                   LN ''Ta'' tid3\n                                |}\n                                ( K ( a2 ) ( s(AV ''G'' tid0) ) )\n                         |}\n                         ( K ( s(AV ''C'' tid1) ) ( s(MV ''A'' tid1) ) ) \")\n      case (A_2_enc tid4) note_unified facts = this facts\n      thus ?thesis by (fastforce dest: A_AuthKey_secret intro: event_predOrdI)\n    qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_Kerberos_state) G_ServKey_sec:\n  assumes facts:\n    \"roleMap r tid0 = Some G\"\n    \"RLKR(s(AV ''G'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''C'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''S'' tid0)) ~: reveals t\"\n    \"LN ''ServKey'' tid0 : knows t\"\n  shows \"False\"\nusing facts proof(sources! \" LN ''ServKey'' tid0 \")\n  case (C_5_ServTicket_ServKey tid1 a0 a1 tid3 a2 a3) note_unified facts = this facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''41'', s(MV ''ServKey'' tid1), s(AV ''S'' tid1),\n                          s(MV ''Tg'' tid1),\n                          Enc {| LC ''42'', a0, a1, LN ''ServKey'' tid0, LN ''Tg'' tid3 |}\n                              ( K ( a2 ) ( a3 ) )\n                       |}\n                       ( s(MV ''AuthKey'' tid1) ) \")\n    case (G_4_enc tid4) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\nnext\n  case G_4_ServKey note_unified facts = this facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''22'', s(MV ''C'' tid0), s(AV ''G'' tid0),\n                          s(MV ''AuthKey'' tid0), s(MV ''Ta'' tid0)\n                       |}\n                       ( K ( s(MV ''A'' tid0) ) ( s(AV ''G'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (A_2_enc_1 tid1) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (C_3_AuthTicket_enc tid1 a0 a1 tid2 tid3 a2 a3) note_unified facts = this facts\n    thus ?thesis by (fastforce dest: G_AuthKey_secret intro: event_predOrdI)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nnext\n  case G_4_ServKey_1 note_unified facts = this facts\n  thus ?thesis by (auto dest!: ltk_secrecy)\nqed (safe?, simp_all?, insert facts, (fastforce+)?)\n\nlemma (in restricted_Kerberos_state) C_ServKey_sec:\n  assumes facts:\n    \"roleMap r tid0 = Some C\"\n    \"RLKR(s(AV ''C'' tid0)) ~: reveals t\"\n    \"RLKR(s(AV ''G'' tid0)) ~: reveals t\"\n    \"RLKR(s(AV ''S'' tid0)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid0)) ~: reveals t\"\n    \"( tid0, C_4 ) : steps t\"\n    \"s(MV ''ServKey'' tid0) : knows t\"\n  shows \"False\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''21'', s(MV ''AuthKey'' tid0), s(AV ''G'' tid0),\n                          s(MV ''Ta'' tid0), s(MV ''AuthTicket'' tid0)\n                       |}\n                       ( K ( s(AV ''C'' tid0) ) ( s(MV ''A'' tid0) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (A_2_enc tid1) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''41'', s(MV ''ServKey'' tid0), s(AV ''S'' tid0),\n                            s(MV ''Tg'' tid0), s(MV ''ServTicket'' tid0)\n                         |}\n                         ( LN ''AuthKey'' tid1 ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (fastforce dest: A_AuthKey_secret intro: event_predOrdI)\n    next\n      case (G_4_enc tid2) note_unified facts = this facts\n      thus ?thesis proof(sources! \"\n                       Enc {| LC ''22'', s(MV ''C'' tid2), s(AV ''G'' tid2),\n                              LN ''AuthKey'' tid1, s(MV ''Ta'' tid2)\n                           |}\n                           ( K ( s(MV ''A'' tid2) ) ( s(AV ''G'' tid2) ) ) \")\n        case fake note_unified facts = this facts\n        thus ?thesis by (fastforce dest: A_AuthKey_secret intro: event_predOrdI)\n      next\n        case (A_2_enc_1 tid3) note_unified facts = this facts\n        thus ?thesis by (auto dest!: ltk_secrecy)\n      next\n        case (C_3_AuthTicket_enc tid3 a0 a1 tid4 tid5 a2 a3) note_unified facts = this facts\n        thus ?thesis proof(sources! \"\n                         Enc {| LC ''21'', s(MV ''AuthKey'' tid3), s(AV ''G'' tid3),\n                                s(MV ''Ta'' tid3),\n                                Enc {| LC ''22'', a0, s(AV ''G'' tid2), LN ''AuthKey'' tid1,\n                                       LN ''Ta'' tid5\n                                    |}\n                                    ( K ( a2 ) ( s(AV ''G'' tid2) ) )\n                             |}\n                             ( K ( s(AV ''C'' tid3) ) ( s(MV ''A'' tid3) ) ) \")\n          case (A_2_enc tid6) note_unified facts = this facts\n          thus ?thesis by (fastforce dest: G_ServKey_sec intro: event_predOrdI)\n        qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n      qed (safe?, simp_all?, insert facts, (fastforce+)?)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\n(* subsection:  Authentication Properties  *)\n\nlemma (in restricted_Kerberos_state) C_auth:\n  assumes facts:\n    \"roleMap r tid1 = Some C\"\n    \"RLKR(s(AV ''C'' tid1)) ~: reveals t\"\n    \"RLKR(s(AV ''G'' tid1)) ~: reveals t\"\n    \"RLKR(s(AV ''S'' tid1)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid1)) ~: reveals t\"\n    \"( tid1, C_6 ) : steps t\"\n  shows\n    \"(?  tid2.\n        (?  tid3.\n           (?  tid4.\n              roleMap r tid2 = Some A &\n              roleMap r tid3 = Some G &\n              roleMap r tid4 = Some S &\n              s(MV ''A'' tid1) = s(AV ''A'' tid2) &\n              s(AV ''C'' tid1) = s(MV ''C'' tid2) &\n              s(AV ''G'' tid1) = s(MV ''G'' tid2) &\n              s(MV ''Ta'' tid1) = LN ''Ta'' tid2 &\n              s(MV ''AuthKey'' tid1) = LN ''AuthKey'' tid2 &\n              s(MV ''A'' tid1) = s(MV ''A'' tid3) &\n              s(AV ''C'' tid1) = s(MV ''C'' tid3) &\n              s(AV ''G'' tid1) = s(AV ''G'' tid3) &\n              s(AV ''S'' tid1) = s(MV ''S'' tid3) &\n              s(MV ''Tg'' tid1) = LN ''Tg'' tid3 &\n              s(MV ''AuthKey'' tid1) = s(MV ''AuthKey'' tid3) &\n              s(MV ''ServKey'' tid1) = LN ''ServKey'' tid3 &\n              s(AV ''C'' tid1) = s(MV ''C'' tid4) &\n              s(AV ''G'' tid1) = s(MV ''G'' tid4) &\n              s(AV ''S'' tid1) = s(AV ''S'' tid4) &\n              LN ''Tc3'' tid1 = s(MV ''Tc3'' tid4) &\n              s(MV ''ServKey'' tid1) = s(MV ''ServKey'' tid4))))\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''21'', s(MV ''AuthKey'' tid1), s(AV ''G'' tid1),\n                          s(MV ''Ta'' tid1), s(MV ''AuthTicket'' tid1)\n                       |}\n                       ( K ( s(AV ''C'' tid1) ) ( s(MV ''A'' tid1) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (A_2_enc tid2) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''6'', LN ''Tc3'' tid1 |} ( s(MV ''ServKey'' tid1) ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (fastforce dest: C_ServKey_sec intro: event_predOrdI)\n    next\n      case (S_6_enc tid3) note_unified facts = this facts\n      thus ?thesis proof(sources! \"\n                       Enc {| LC ''41'', s(MV ''ServKey'' tid1), s(AV ''S'' tid1),\n                              s(MV ''Tg'' tid1), s(MV ''ServTicket'' tid1)\n                           |}\n                           ( LN ''AuthKey'' tid2 ) \")\n        case fake note_unified facts = this facts\n        thus ?thesis by (fastforce dest: A_AuthKey_secret intro: event_predOrdI)\n      next\n        case (G_4_enc tid4) note_unified facts = this facts\n        thus ?thesis proof(sources! \"\n                         Enc {| LC ''22'', s(MV ''C'' tid4), s(AV ''G'' tid4),\n                                LN ''AuthKey'' tid2, s(MV ''Ta'' tid4)\n                             |}\n                             ( K ( s(MV ''A'' tid4) ) ( s(AV ''G'' tid4) ) ) \")\n          case fake note_unified facts = this facts\n          thus ?thesis by (fastforce dest: A_AuthKey_secret intro: event_predOrdI)\n        next\n          case (A_2_enc_1 tid5) note_unified facts = this facts\n          thus ?thesis by (auto dest!: ltk_secrecy)\n        next\n          case (C_3_AuthTicket_enc tid5 a0 a1 tid6 tid7 a2 a3) note_unified facts = this facts\n          thus ?thesis proof(sources! \"\n                           Enc {| LC ''42'', s(MV ''C'' tid3), s(AV ''S'' tid3),\n                                  LN ''ServKey'' tid4, s(MV ''Tg'' tid3)\n                               |}\n                               ( K ( s(MV ''G'' tid3) ) ( s(AV ''S'' tid3) ) ) \")\n            case fake note_unified facts = this facts\n            thus ?thesis by (fastforce dest: C_ServKey_sec intro: event_predOrdI)\n          next\n            case (C_5_ServTicket_enc tid8 a3 a4 tid9 tid10 a5 a6) note_unified facts = this facts\n            thus ?thesis proof(sources! \"\n                             Enc {| LC ''21'', s(MV ''AuthKey'' tid5), s(AV ''G'' tid5),\n                                    s(MV ''Ta'' tid5),\n                                    Enc {| LC ''22'', a0, s(AV ''G'' tid4), LN ''AuthKey'' tid2,\n                                           LN ''Ta'' tid7\n                                        |}\n                                        ( K ( a2 ) ( s(AV ''G'' tid4) ) )\n                                 |}\n                                 ( K ( s(AV ''C'' tid5) ) ( s(MV ''A'' tid5) ) ) \")\n              case (A_2_enc tid11) note_unified facts = this facts\n              thus ?thesis proof(sources! \"\n                               Enc {| LC ''41'', s(MV ''ServKey'' tid8), s(AV ''S'' tid8),\n                                      s(MV ''Tg'' tid8),\n                                      Enc {| LC ''42'', a3, s(AV ''S'' tid3), LN ''ServKey'' tid4,\n                                             LN ''Tg'' tid10\n                                          |}\n                                          ( K ( a5 ) ( s(AV ''S'' tid3) ) )\n                                   |}\n                                   ( s(MV ''AuthKey'' tid8) ) \")\n                case (G_4_enc tid11) note_unified facts = this facts\n                thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n              qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n            qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n          next\n            case (G_4_enc_1 tid8) note_unified facts = this facts\n            thus ?thesis by (fastforce dest: A_AuthKey_secret intro: event_predOrdI)\n          qed (safe?, simp_all?, insert facts, (fastforce+)?)\n        qed (safe?, simp_all?, insert facts, (fastforce+)?)\n      qed (safe?, simp_all?, insert facts, (fastforce+)?)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nlemma (in restricted_Kerberos_state) G_auth:\n  assumes facts:\n    \"roleMap r tid3 = Some G\"\n    \"RLKR(s(AV ''G'' tid3)) ~: reveals t\"\n    \"RLKR(s(MV ''A'' tid3)) ~: reveals t\"\n    \"RLKR(s(MV ''C'' tid3)) ~: reveals t\"\n    \"( tid3, G_3 ) : steps t\"\n  shows\n    \"(?  tid1.\n        (?  tid2.\n           roleMap r tid1 = Some C &\n           roleMap r tid2 = Some A &\n           s(MV ''A'' tid1) = s(MV ''A'' tid3) &\n           s(AV ''C'' tid1) = s(MV ''C'' tid3) &\n           s(AV ''G'' tid1) = s(AV ''G'' tid3) &\n           LN ''Tc2'' tid1 = s(MV ''Tc2'' tid3) &\n           s(MV ''AuthKey'' tid1) = s(MV ''AuthKey'' tid3) &\n           s(MV ''A'' tid1) = s(AV ''A'' tid2) &\n           s(AV ''C'' tid1) = s(MV ''C'' tid2) &\n           s(AV ''G'' tid1) = s(MV ''G'' tid2) &\n           s(MV ''AuthKey'' tid1) = LN ''AuthKey'' tid2))\"\nproof -\n  note_prefix_closed facts = facts\n  thus ?thesis proof(sources! \"\n                   Enc {| LC ''22'', s(MV ''C'' tid3), s(AV ''G'' tid3),\n                          s(MV ''AuthKey'' tid3), s(MV ''Ta'' tid3)\n                       |}\n                       ( K ( s(MV ''A'' tid3) ) ( s(AV ''G'' tid3) ) ) \")\n    case fake note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (A_2_enc_1 tid4) note_unified facts = this facts\n    thus ?thesis by (auto dest!: ltk_secrecy)\n  next\n    case (C_3_AuthTicket_enc tid4 a0 a1 tid5 tid6 a2 a3) note_unified facts = this facts\n    thus ?thesis proof(sources! \"\n                     Enc {| LC ''3'', a0, s(MV ''Tc2'' tid3) |} ( LN ''AuthKey'' tid5 ) \")\n      case fake note_unified facts = this facts\n      thus ?thesis by (fastforce dest: G_AuthKey_secret intro: event_predOrdI)\n    next\n      case (C_3_enc tid7) note_unified facts = this facts\n      thus ?thesis proof(sources! \"\n                       Enc {| LC ''21'', s(MV ''AuthKey'' tid4), s(AV ''G'' tid4),\n                              s(MV ''Ta'' tid4),\n                              Enc {| LC ''22'', s(AV ''C'' tid7), s(AV ''G'' tid3),\n                                     LN ''AuthKey'' tid5, LN ''Ta'' tid6\n                                  |}\n                                  ( K ( a2 ) ( s(AV ''G'' tid3) ) )\n                           |}\n                           ( K ( s(AV ''C'' tid4) ) ( s(MV ''A'' tid4) ) ) \")\n        case (A_2_enc tid8) note_unified facts = this facts\n        thus ?thesis proof(sources! \"\n                         Enc {| LC ''21'', LN ''AuthKey'' tid5, s(AV ''G'' tid7),\n                                s(MV ''Ta'' tid7), s(MV ''AuthTicket'' tid7)\n                             |}\n                             ( K ( s(AV ''C'' tid4) ) ( s(MV ''A'' tid7) ) ) \")\n          case fake note_unified facts = this facts\n          thus ?thesis by (fastforce dest: A_AuthKey_secret intro: event_predOrdI)\n        next\n          case (A_2_enc tid8) note_unified facts = this facts\n          thus ?thesis by (fastforce intro: event_predOrdI split: if_splits)\n        qed (safe?, simp_all?, insert facts, (fastforce+)?)\n      qed (safe?, simp_all?, insert facts, ((((clarsimp, order?) | order | fast))+)?)\n    qed (safe?, simp_all?, insert facts, (fastforce+)?)\n  qed (safe?, simp_all?, insert facts, (fastforce+)?)\nqed\n\nend", "meta": {"author": "meiersi", "repo": "scyther-proof", "sha": "84e42366a46f66f1b090651be3bfaa3497696280", "save_path": "github-repos/isabelle/meiersi-scyther-proof", "path": "github-repos/isabelle/meiersi-scyther-proof/scyther-proof-84e42366a46f66f1b090651be3bfaa3497696280/examples/classic/isabelle-proofs/Kerberos_V4_cert_auto.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044135, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.3050502774100546}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2005         |\n            |                January 2006               |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory FNF_F_sf_def\nimports CSP_F_Main\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*  The following simplification rules are deleted in this theory file *)\n(*       P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y))        *)\n\n\n(* Isabelle 2017 *)\ndeclare if_split  [split del]\n\n(*****************************************************************\n\n         1. definition of full sequential-formed process\n         2. \n         3. \n\n *****************************************************************)\n\n(*==========================================================*\n |                                                          |\n |                    Definition of fsfF                    |\n |                                                          |\n *==========================================================*)\n\n(* \nIsabelle 2005\n\nconsts\n  fsfF_proc :: \"('p,'a) proc set\"\n\ninductive \"fsfF_proc\"\n\nintros\nfsfF_proc_int:\n  \"[| sumset C ~= {} ; ALL c: sumset C. Rf c : fsfF_proc |]\n   ==> (!! :C .. Rf) : fsfF_proc\"\n\nfsfF_proc_ext:\n  \"[| ALL a:A. Pf a : fsfF_proc ;\n      Q = SKIP | Q = DIV | Q = STOP |]\n   ==> ((? :A -> Pf) [+] Q) : fsfF_proc\"\n*)\n\ninductive_set\n  fsfF_proc :: \"('p,'a) proc set\"\nwhere\nfsfF_proc_int:\n  \"[| sumset C ~= {} ; ALL c: sumset C. Rf c : fsfF_proc |]\n   ==> (!! :C .. Rf) : fsfF_proc\" |\n\nfsfF_proc_ext:\n  \"[| ALL a:A. Pf a : fsfF_proc ;\n      Q = SKIP | Q = DIV | Q = STOP |]\n   ==> ((? :A -> Pf) [+] Q) : fsfF_proc\"\n\n(*-------------------------------------------*\n |   sequential-formed SSKIP, SDIV, SSTOP    |\n *-------------------------------------------*)\n\ndefinition\n  SSKIP     :: \"('p,'a) proc\"\n  where\n  SSKIP_def : \"SSKIP == (? y:{} -> DIV) [+] SKIP\"\n    \ndefinition\n  SDIV      :: \"('p,'a) proc\"\n  where\n  SDIV_def  : \"SDIV  == (? y:{} -> DIV) [+] DIV\"\n  \ndefinition\n  SSTOP     :: \"('p,'a) proc\"\n  where\n  SSTOP_def : \"SSTOP == (? y:{} -> DIV) [+] STOP\"\n\n(*** small lemmas ***)\n\n(* in *)\n\nlemma fsfF_SSKIP_in[simp]: \"SSKIP : fsfF_proc\"\napply (simp add: SSKIP_def)\napply (simp add: fsfF_proc.intros)\ndone\n\nlemma fsfF_SDIV_in[simp]: \"SDIV : fsfF_proc\"\napply (simp add: SDIV_def)\napply (simp add: fsfF_proc.intros)\ndone\n\nlemma fsfF_SSTOP_in[simp]: \"SSTOP : fsfF_proc\"\napply (simp add: SSTOP_def)\napply (simp add: fsfF_proc.intros)\ndone\n\n(* eqF *)\n\nlemma cspF_SSKIP_eqF: \"SKIP =F SSKIP\"\napply (simp add: SSKIP_def)\napply (rule cspF_rw_right)\napply (rule cspF_Ext_choice_rule)\napply (simp)\ndone\n\nlemma cspF_SDIV_eqF: \"DIV =F SDIV\"\napply (simp add: SDIV_def)\napply (rule cspF_rw_right)\napply (rule cspF_Ext_choice_rule)\napply (simp)\ndone\n\nlemma cspF_SSTOP_eqF: \"STOP =F SSTOP\"\napply (simp add: SSTOP_def)\napply (rule cspF_rw_right)\napply (rule cspF_Ext_choice_rule)\napply (simp)\ndone\n\n(*----------------------------------------------------------*\n |                          iff                             |\n *----------------------------------------------------------*)\n\n(* proc *)\n\nlemma fsfF_proc_iff:\n  \"(SP : fsfF_proc) = \n    ((EX C Rf.\n  sumset C ~= {} & SP = !! :C .. Rf & (ALL c: sumset C. Rf c : fsfF_proc)) |\n     (EX A Pf Q.\n        SP = (? :A -> Pf) [+] Q & (ALL a:A. Pf a : fsfF_proc) &\n        (Q = SKIP | Q = DIV | Q = STOP)))\"\n\napply (rule iffI)\n\n(* => *)\n apply (erule fsfF_proc.cases)\n apply (simp_all)\n\n(* <= *)\n apply (elim conjE exE disjE)\n apply (simp_all add: fsfF_proc.intros)\ndone\n\nlemma fsfF_procI:\n   \"((EX C Rf.\n  sumset C ~= {} & SP = !! :C .. Rf & (ALL c: sumset C. Rf c : fsfF_proc)) |\n     (EX A Pf Q.\n        SP = (? :A -> Pf) [+] Q & (ALL a:A. Pf a : fsfF_proc) &\n        (Q = SKIP | Q = DIV | Q = STOP)))\n    ==> SP : fsfF_proc\"\napply (simp add: fsfF_proc_iff[of SP])\ndone\n\nlemma fsfF_procE:\n  \"[| SP : fsfF_proc ;\n     ((EX C Rf.\n  sumset C ~= {} & SP = !! :C .. Rf & (ALL c: sumset C. Rf c : fsfF_proc)) |\n     (EX A Pf Q.\n        SP = (? :A -> Pf) [+] Q & (ALL a:A. Pf a : fsfF_proc) &\n        (Q = SKIP | Q = DIV | Q = STOP)))\n      ==> S |]\n    ==> S\"\napply (simp add: fsfF_proc_iff[of SP])\ndone\n\n(*----------------------------------------------------------*\n |                    subexpression                         |\n *----------------------------------------------------------*)\n\n(* proc *)\n\nlemma Rf_fsfF_proc:\n  \"[| !! :C .. Rf : fsfF_proc ; c: sumset C |]\n   ==> Rf c : fsfF_proc\"\napply (erule fsfF_procE)\napply (elim disjE conjE exE)\napply (simp_all)\ndone\n\nlemma Pf_fsfF_proc:\n  \"[| (? :A -> Pf) [+] Q : fsfF_proc ; a:A |]\n   ==> Pf a : fsfF_proc\"\napply (erule fsfF_procE)\napply (simp)\ndone\n\nlemma Qf_range:\n  \"(? :A -> Pf) [+] Q : fsfF_proc \n   ==> Q = SKIP | Q = DIV | Q = STOP\"\napply (erule fsfF_procE)\napply (simp)\ndone\n\n(*======================================================*\n |                                                      |\n |    function to decompose : fsfF_decompo_int, ext     |\n |                                                      |\n *======================================================*)\n\n(*\nisabelle 2011\n\nconsts\n  fsfF_C ::\n     \"('p,'a) proc => 'a sets_nats\"\n  fsfF_Rf ::\n     \"('p,'a) proc => ('a aset_anat => ('p,'a) proc)\"\n\n  fsfF_A ::\n     \"('p,'a) proc => 'a set\"\n  fsfF_Pf ::\n     \"('p,'a) proc => ('a => ('p,'a) proc)\"\n  fsfF_Q ::\n     \"('p,'a) proc => ('p,'a) proc\"\n\n(* they are partial functions *)\n\nrecdef fsfF_C \"{}\"\n  \"fsfF_C (!! :C .. Rf) = C\"\nrecdef fsfF_Rf \"{}\"\n  \"fsfF_Rf (!! :C .. Rf) = Rf\"\nrecdef fsfF_A \"{}\"\n  \"fsfF_A ((? :A -> Pf) [+] Q) = A\"\nrecdef fsfF_Pf \"{}\"\n  \"fsfF_Pf ((? :A -> Pf) [+] Q) = Pf\"\nrecdef fsfF_Q \"{}\"\n  \"fsfF_Q ((? :A -> Pf) [+] Q) = Q\"\n*)\n\nfun\n  fsfF_C ::\n     \"('p,'a) proc => 'a sets_nats\"\nwhere\n  \"fsfF_C (!! :C .. Rf) = C\"\n\nfun\n  fsfF_Rf ::\n     \"('p,'a) proc => ('a aset_anat => ('p,'a) proc)\"\nwhere\n  \"fsfF_Rf (!! :C .. Rf) = Rf\"\n\nfun\n  fsfF_A ::\n     \"('p,'a) proc => 'a set\"\nwhere\n  \"fsfF_A ((? :A -> Pf) [+] Q) = A\"\n\nfun\n  fsfF_Pf ::\n     \"('p,'a) proc => ('a => ('p,'a) proc)\"\nwhere\n  \"fsfF_Pf ((? :A -> Pf) [+] Q) = Pf\"\n\nfun\n  fsfF_Q ::\n     \"('p,'a) proc => ('p,'a) proc\"\nwhere\n  \"fsfF_Q ((? :A -> Pf) [+] Q) = Q\"\n\n(* they are partial functions *)\n\n\n(*------------------------*\n |     decomposition      |\n *------------------------*)\n\nlemma cspF_fsfF_proc_decompo:\n   \"P : fsfF_proc ==>\n     ((P = (!! : fsfF_C P .. fsfF_Rf P)) |\n      (P = (? : fsfF_A P -> fsfF_Pf P [+] fsfF_Q P)))\"\napply (erule fsfF_proc.cases)\napply (simp_all)\ndone\n\n(****************** to add them again ******************)\n\ndeclare if_split    [split]\ndeclare disj_not1   [simp]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/FNF_F/FNF_F_sf_def.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.3049272583204237}}
{"text": "(* Author: Florian Haftmann & Lukas Bulwahn, TU Muenchen *)\n\nsection {* A simple counterexample generator performing random testing *}\n\ntheory Quickcheck_Random\nimports Random Code_Evaluation Enum\nbegin\n\nnotation fcomp (infixl \"\\<circ>>\" 60)\nnotation scomp (infixl \"\\<circ>\\<rightarrow>\" 60)\n\nsetup {* Code_Target.add_derived_target (\"Quickcheck\", [(Code_Runtime.target, I)]) *}\n\nsubsection {* Catching Match exceptions *}\n\naxiomatization catch_match :: \"'a => 'a => 'a\"\n\ncode_printing\n  constant catch_match \\<rightharpoonup> (Quickcheck) \"((_) handle Match => _)\"\n\nsubsection {* The @{text random} class *}\n\nclass random = typerep +\n  fixes random :: \"natural \\<Rightarrow> Random.seed \\<Rightarrow> ('a \\<times> (unit \\<Rightarrow> term)) \\<times> Random.seed\"\n\n\nsubsection {* Fundamental and numeric types*}\n\ninstantiation bool :: random\nbegin\n\ndefinition\n  \"random i = Random.range 2 \\<circ>\\<rightarrow>\n    (\\<lambda>k. Pair (if k = 0 then Code_Evaluation.valtermify False else Code_Evaluation.valtermify True))\"\n\ninstance ..\n\nend\n\ninstantiation itself :: (typerep) random\nbegin\n\ndefinition\n  random_itself :: \"natural \\<Rightarrow> Random.seed \\<Rightarrow> ('a itself \\<times> (unit \\<Rightarrow> term)) \\<times> Random.seed\"\nwhere \"random_itself _ = Pair (Code_Evaluation.valtermify TYPE('a))\"\n\ninstance ..\n\nend\n\ninstantiation char :: random\nbegin\n\ndefinition\n  \"random _ = Random.select (Enum.enum :: char list) \\<circ>\\<rightarrow> (\\<lambda>c. Pair (c, \\<lambda>u. Code_Evaluation.term_of c))\"\n\ninstance ..\n\nend\n\ninstantiation String.literal :: random\nbegin\n\ndefinition \n  \"random _ = Pair (STR '''', \\<lambda>u. Code_Evaluation.term_of (STR ''''))\"\n\ninstance ..\n\nend\n\ninstantiation nat :: random\nbegin\n\ndefinition random_nat :: \"natural \\<Rightarrow> Random.seed\n  \\<Rightarrow> (nat \\<times> (unit \\<Rightarrow> Code_Evaluation.term)) \\<times> Random.seed\"\nwhere\n  \"random_nat i = Random.range (i + 1) \\<circ>\\<rightarrow> (\\<lambda>k. Pair (\n     let n = nat_of_natural k\n     in (n, \\<lambda>_. Code_Evaluation.term_of n)))\"\n\ninstance ..\n\nend\n\ninstantiation int :: random\nbegin\n\ndefinition\n  \"random i = Random.range (2 * i + 1) \\<circ>\\<rightarrow> (\\<lambda>k. Pair (\n     let j = (if k \\<ge> i then int (nat_of_natural (k - i)) else - (int (nat_of_natural (i - k))))\n     in (j, \\<lambda>_. Code_Evaluation.term_of j)))\"\n\ninstance ..\n\nend\n\ninstantiation natural :: random\nbegin\n\ndefinition random_natural :: \"natural \\<Rightarrow> Random.seed\n  \\<Rightarrow> (natural \\<times> (unit \\<Rightarrow> Code_Evaluation.term)) \\<times> Random.seed\"\nwhere\n  \"random_natural i = Random.range (i + 1) \\<circ>\\<rightarrow> (\\<lambda>n. Pair (n, \\<lambda>_. Code_Evaluation.term_of n))\"\n\ninstance ..\n\nend\n\ninstantiation integer :: random\nbegin\n\ndefinition random_integer :: \"natural \\<Rightarrow> Random.seed\n  \\<Rightarrow> (integer \\<times> (unit \\<Rightarrow> Code_Evaluation.term)) \\<times> Random.seed\"\nwhere\n  \"random_integer i = Random.range (2 * i + 1) \\<circ>\\<rightarrow> (\\<lambda>k. Pair (\n     let j = (if k \\<ge> i then integer_of_natural (k - i) else - (integer_of_natural (i - k)))\n      in (j, \\<lambda>_. Code_Evaluation.term_of j)))\"\n\ninstance ..\n\nend\n\n\nsubsection {* Complex generators *}\n\ntext {* Towards @{typ \"'a \\<Rightarrow> 'b\"} *}\n\naxiomatization random_fun_aux :: \"typerep \\<Rightarrow> typerep \\<Rightarrow> ('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> term)\n  \\<Rightarrow> (Random.seed \\<Rightarrow> ('b \\<times> (unit \\<Rightarrow> term)) \\<times> Random.seed)\n  \\<Rightarrow> (Random.seed \\<Rightarrow> Random.seed \\<times> Random.seed)\n  \\<Rightarrow> Random.seed \\<Rightarrow> (('a \\<Rightarrow> 'b) \\<times> (unit \\<Rightarrow> term)) \\<times> Random.seed\"\n\ndefinition random_fun_lift :: \"(Random.seed \\<Rightarrow> ('b \\<times> (unit \\<Rightarrow> term)) \\<times> Random.seed)\n  \\<Rightarrow> Random.seed \\<Rightarrow> (('a\\<Colon>term_of \\<Rightarrow> 'b\\<Colon>typerep) \\<times> (unit \\<Rightarrow> term)) \\<times> Random.seed\"\nwhere\n  \"random_fun_lift f =\n    random_fun_aux TYPEREP('a) TYPEREP('b) (op =) Code_Evaluation.term_of f Random.split_seed\"\n\ninstantiation \"fun\" :: (\"{equal, term_of}\", random) random\nbegin\n\ndefinition\n  random_fun :: \"natural \\<Rightarrow> Random.seed \\<Rightarrow> (('a \\<Rightarrow> 'b) \\<times> (unit \\<Rightarrow> term)) \\<times> Random.seed\"\n  where \"random i = random_fun_lift (random i)\"\n\ninstance ..\n\nend\n\ntext {* Towards type copies and datatypes *}\n\ndefinition collapse :: \"('a \\<Rightarrow> ('a \\<Rightarrow> 'b \\<times> 'a) \\<times> 'a) \\<Rightarrow> 'a \\<Rightarrow> 'b \\<times> 'a\"\n  where \"collapse f = (f \\<circ>\\<rightarrow> id)\"\n\ndefinition beyond :: \"natural \\<Rightarrow> natural \\<Rightarrow> natural\"\n  where \"beyond k l = (if l > k then l else 0)\"\n\nlemma beyond_zero: \"beyond k 0 = 0\"\n  by (simp add: beyond_def)\n\n\ndefinition (in term_syntax) [code_unfold]:\n  \"valterm_emptyset = Code_Evaluation.valtermify ({} :: ('a :: typerep) set)\"\n\ndefinition (in term_syntax) [code_unfold]:\n  \"valtermify_insert x s = Code_Evaluation.valtermify insert {\\<cdot>} (x :: ('a :: typerep * _)) {\\<cdot>} s\"\n\ninstantiation set :: (random) random\nbegin\n\nfun random_aux_set\nwhere\n  \"random_aux_set 0 j = collapse (Random.select_weight [(1, Pair valterm_emptyset)])\"\n| \"random_aux_set (Code_Numeral.Suc i) j =\n    collapse (Random.select_weight\n      [(1, Pair valterm_emptyset),\n       (Code_Numeral.Suc i,\n        random j \\<circ>\\<rightarrow> (%x. random_aux_set i j \\<circ>\\<rightarrow> (%s. Pair (valtermify_insert x s))))])\"\n\n\n\ndefinition \"random_set i = random_aux_set i i\"\n\ninstance ..\n\nend\n\nlemma random_aux_rec:\n  fixes random_aux :: \"natural \\<Rightarrow> 'a\"\n  assumes \"random_aux 0 = rhs 0\"\n    and \"\\<And>k. random_aux (Code_Numeral.Suc k) = rhs (Code_Numeral.Suc k)\"\n  shows \"random_aux k = rhs k\"\n  using assms by (rule natural.induct)\n\nsubsection {* Deriving random generators for datatypes *}\n\nML_file \"Tools/Quickcheck/quickcheck_common.ML\" \nML_file \"Tools/Quickcheck/random_generators.ML\"\n\n\nsubsection {* Code setup *}\n\ncode_printing\n  constant random_fun_aux \\<rightharpoonup> (Quickcheck) \"Random'_Generators.random'_fun\"\n  -- {* With enough criminal energy this can be abused to derive @{prop False};\n  for this reason we use a distinguished target @{text Quickcheck}\n  not spoiling the regular trusted code generation *}\n\ncode_reserved Quickcheck Random_Generators\n\nno_notation fcomp (infixl \"\\<circ>>\" 60)\nno_notation scomp (infixl \"\\<circ>\\<rightarrow>\" 60)\n    \nhide_const (open) catch_match random collapse beyond random_fun_aux random_fun_lift\n\nhide_fact (open) collapse_def beyond_def random_fun_lift_def\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/Quickcheck_Random.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6001883735630721, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3047827768977672}}
{"text": "theory Presimplified_Semantics_Manual\n  imports \"artifact_setup.Artifact_Setup\"\nbegin\n\n(*5 flags generation CF,SF,OF,ZF,PF *)\ninstruction_semantics_parser \"../InstructionSemantics/strata_rules_5flags\"\nlemmas strata_rules_5flags.semantics_def[code]\n\nlocale presimplified_semantics = execution_context + strata_rules_5flags\nbegin\n\nnamed_theorems presimplify\n\n(* MANUAL SEMANTICS *)\n\nschematic_goal unfold_semantics:\n  shows \\<open>instr_semantics semantics instr_sig = ?x\\<close>\n  by (simp add: semantics_def simp_rules)\n\n\n\n\n(* push and pop *)\nschematic_goal get_semantics_Push[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Push) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Pop[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Pop) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\n(* shifting *)\n\nschematic_goal get_semantics_Shl[presimplify]:\n  shows \"get_semantics assembly semantics (Binary (IS_8088 Shl) op1 op2) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Shr[presimplify]:\n  shows \"get_semantics assembly semantics (Binary (IS_8088 Shr) op1 op2) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\n(* Bsr *)\n\nschematic_goal get_semantics_Bsr[presimplify]:\n  shows \"get_semantics assembly semantics (Binary (IS_80386 Bsr) op1 op2) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\n(* nop *)\n\nlemma get_semantics_nop_unary[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Nop) op) s = id\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply rewrite_one_let'+\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nlemma get_semantics_nop_binary[presimplify]:\n  shows \"get_semantics assembly semantics (Binary (IS_8088 Nop) op\\<^sub>1 op\\<^sub>2) s = id\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (rewrite_one_let')+\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nlemma get_semantics_nop_ternary[presimplify]:\n  shows \"get_semantics assembly semantics (Ternary (IS_8088 Nop) op\\<^sub>1 op\\<^sub>2 op3) s = id\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (rewrite_one_let')+\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\n\n(* call / ret / leave *)\n\nschematic_goal get_semantics_Leave[presimplify]:\n  shows \"get_semantics assembly semantics (Nullary (IS_80188 Leave)) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Ret[presimplify]:\n  shows \"get_semantics assembly semantics (Nullary (IS_8088 Ret)) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Call[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Call) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\n(* lea *)\nschematic_goal get_semantics_Lea[presimplify]:\n  shows \"get_semantics assembly semantics (Binary (IS_8088 Lea) op1 op2) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\n(* imul *)\nschematic_goal get_semantics_imul_binary[presimplify]:\n  shows \"get_semantics assembly semantics (Binary (IS_8088 Imul) op1 op2) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_imul_unary[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Imul) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nschematic_goal get_semantics_imul_r64_r64_imm[presimplify]:\n  shows \"get_semantics assembly semantics (Ternary (IS_8088 Imul) op1 op2 op3) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\n(* jumps *)\n\nschematic_goal get_semantics_Jmp[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Jmp) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Ja[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Ja) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Jae[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Jae) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Jb[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Jb) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Jbe[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Jbe) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Je[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Je) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Jle[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Jle) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Jne[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Jne) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nschematic_goal get_semantics_Jg[presimplify]:\n  \"get_semantics assembly semantics (Unary (IS_8088 Jg) op) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nschematic_goal get_semantics_Jge[presimplify]:\n  \"get_semantics assembly semantics (Unary (IS_8088 Jge) op) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nschematic_goal get_semantics_Jl[presimplify]:\n  \"get_semantics assembly semantics (Unary (IS_8088 Jl) op) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nschematic_goal get_semantics_Jnb[presimplify]:\n  \"get_semantics assembly semantics (Unary (IS_8088 Jnb) op) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nschematic_goal get_semantics_Jno[presimplify]:\n  \"get_semantics assembly semantics (Unary (IS_8088 Jno) op) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nschematic_goal get_semantics_Jnp[presimplify]:\n  \"get_semantics assembly semantics (Unary (IS_8088 Jnp) op) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nschematic_goal get_semantics_Jns[presimplify]:\n  \"get_semantics assembly semantics (Unary (IS_8088 Jns) op) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nschematic_goal get_semantics_Jo[presimplify]:\n  \"get_semantics assembly semantics (Unary (IS_8088 Jo) op) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nschematic_goal get_semantics_Jp[presimplify]:\n  \"get_semantics assembly semantics (Unary (IS_8088 Jp) op) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\nschematic_goal get_semantics_Js[presimplify]:\n  \"get_semantics assembly semantics (Unary (IS_8088 Js) op) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\n\n(* sub *)\nschematic_goal get_semantics_sub_m64_imm64[presimplify]:\n  shows \"get_semantics assembly semantics (Binary (IS_8088 Sub) (Memory SixtyFour Mem) (Immediate ImmSize (ImmVal Immvalue))) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\n(* bswap *)\nschematic_goal get_semantics_bswap_unary[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_80486 Bswap) op) s = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\n(* sbb *)\nschematic_goal get_semantics_sbb[presimplify]:\n  shows \"get_semantics assembly semantics (Binary (IS_8088 Sbb) op1 op2) s = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules)\n  done\n\n(* sar *)\nschematic_goal get_semantics_Sar[presimplify]:\n  shows \"get_semantics \\<alpha> semantics (Binary (IS_8088 Sar) op\\<^sub>1 op\\<^sub>2) si = ?x\"\n   apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\n(* ucomisd *)\nschematic_goal get_semantics_ucomisd_xmm_m64[presimplify]:\n  shows \"get_semantics \\<alpha> semantics (Binary (IS_SSE2_SIMD Ucomisd) (Reg (SIMD OneHundredTwentyEight r0 r\\<^sub>1 r\\<^sub>2 r3)) (Storage (Memory SixtyFour Mem))) si = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\n(* div *)\nschematic_goal get_semantics_div[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Div) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\n(* idiv *)\nschematic_goal get_semantics_idiv[presimplify]:\n  shows \"get_semantics assembly semantics (Unary (IS_8088 Idiv) op1) = ?x\"\n  apply (rule ext)\n  apply (subst get_semantics_def)\n  apply (subst unfold_semantics)\n  apply (auto simp add: Let'_def simp_rules )\n  done\n\nend\nend\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/tacas2020_artifact/isabelle/Presimplified_Semantics_Manual.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3047827696346016}}
{"text": "           (*-------------------------------------------*\n            |  The Dining Mathematicians in CSP-Prover  |\n            |               August 2004                 |\n            |             December 2004 (modified)      |\n            |             November 2005 (modified)      |\n            |                March 2007  (modified)     |\n            |                April 2020  (modified)     |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory DM3_hide\nimports DM2_para\nbegin\n\n(*****************************************************************\n\n         1. expands hiding operators in Imp\n         2.\n         3. \n         4. \n\n *****************************************************************)\n\n(******************** Hiding ********************)\n\n(*** Back0 VAR Back1 HIDE ***)\n\nlemma Back0_VAR_Back1_HIDE: \n  \"(Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n                                        |[CH1]| Back1 -> ($TH1))\n                 -- (CH0 Un CH1)\n   =F\n   \n        Back0 -> ((($TH0) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n                     -- (CH0 Un CH1))\n        [+]\n        Back1 -> ((Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n                     -- (CH0 Un CH1))\"\napply (cspF_simp unfold_Imp_rules24)\napply (cspF_step)+\napply (auto)\napply (cspF_simp fold_Imp_rules24)+\ndone\n\nlemmas Back0_VAR_Back1_HIDE_simp = Back0_VAR_Back1_HIDE[simplified]\nlemmas unfold_Imp_rules25 = unfold_Imp_rules24 Back0_VAR_Back1_HIDE_simp\nlemmas fold_Imp_rules25 = fold_Imp_rules24 Back0_VAR_Back1_HIDE_simp[THEN cspF_sym]\n\n(*** Eat0 VAR Back1 HIDE ***)\n\nlemma Eat0_VAR_Back1_HIDE: \n  \"EVEN n ==>\n   (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n                 -- (CH0 Un CH1)\n   =F\n   \n        Eat0 -> ((($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n                 -- (CH0 Un CH1))\n        [+]\n        Back1 -> ((Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n                 -- (CH0 Un CH1))\"\napply (cspF_simp unfold_Imp_rules25)\napply (cspF_step)+\napply (auto)\napply (cspF_simp fold_Imp_rules25)+\ndone\n\nlemmas Eat0_VAR_Back1_HIDE_simp = Eat0_VAR_Back1_HIDE[simplified]\nlemmas unfold_Imp_rules26 = unfold_Imp_rules25 Eat0_VAR_Back1_HIDE_simp\nlemmas fold_Imp_rules26 = fold_Imp_rules25 Eat0_VAR_Back1_HIDE_simp[THEN cspF_sym]\n\n(*** Back0 VAR Eat1 HIDE ***)\n\nlemma Back0_VAR_Eat1_HIDE: \n  \"ODD n ==>\n   (Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| Eat1 -> ($(EAT1 n)))\n                 -- (CH0 Un CH1)\n   =F\n        Eat1 -> ((Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n                                        |[CH1]| ($(EAT1 n)))\n                 -- (CH0 Un CH1))\n        [+]\n        Back0 -> ((($TH0) |[CH0]| ($(VAR n)) \n                                |[CH1]| Eat1 -> ($(EAT1 n)))\n                 -- (CH0 Un CH1))\"\napply (cspF_simp unfold_Imp_rules26)\napply (cspF_step)+\napply (auto)\napply (cspF_simp fold_Imp_rules26)+\ndone\n\nlemmas Back0_VAR_Eat1_HIDE_simp = Back0_VAR_Eat1_HIDE[simplified]\nlemmas unfold_Imp_rules27 = unfold_Imp_rules26 Back0_VAR_Eat1_HIDE_simp\nlemmas fold_Imp_rules27 = fold_Imp_rules26 Back0_VAR_Eat1_HIDE_simp[THEN cspF_sym]\n\n(*** EAT0 VAR Back1 HIDE ***)\n\nlemma EAT0_VAR_Back1_HIDE: \n  \"EVEN n ==>\n   (($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n                 -- (CH0 Un CH1)\n   =F\n        End0 -> ((WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)) \n                                                |[CH1]| Back1 -> ($TH1))\n                 -- (CH0 Un CH1))\n        [+]\n        Back1 -> ((($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n                 -- (CH0 Un CH1))\"\napply (cspF_simp unfold_Imp_rules27)\napply (cspF_step)+\napply (auto)\napply (cspF_simp fold_Imp_rules27)+\ndone\n\nlemmas EAT0_VAR_Back1_HIDE_simp = EAT0_VAR_Back1_HIDE[simplified]\nlemmas unfold_Imp_rules28 = unfold_Imp_rules27 EAT0_VAR_Back1_HIDE_simp\nlemmas fold_Imp_rules28 = fold_Imp_rules27 EAT0_VAR_Back1_HIDE_simp[THEN cspF_sym]\n\n(*** Back0 VAR EAT1 HIDE ***)\n\nlemma Back0_VAR_EAT1_HIDE: \n  \"ODD n ==>\n   (Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($(EAT1 n)))\n                 -- (CH0 Un CH1)\n   =F\n        End1 -> ((Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n                                 |[CH1]| WR1 (3 * n + 1) -> ($TH1))\n                  -- (CH0 Un CH1))\n        [+]\n        Back0 -> ((($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($(EAT1 n)))\n                  -- (CH0 Un CH1))\"\napply (cspF_simp unfold_Imp_rules28)\napply (cspF_step)+\napply (auto)\napply (cspF_simp fold_Imp_rules28)+\ndone\n\nlemmas Back0_VAR_EAT1_HIDE_simp = Back0_VAR_EAT1_HIDE[simplified]\nlemmas unfold_Imp_rules29 = unfold_Imp_rules28 Back0_VAR_EAT1_HIDE_simp\nlemmas fold_Imp_rules29 = fold_Imp_rules28 Back0_VAR_EAT1_HIDE_simp[THEN cspF_sym]\n\n(**************************)\n(*** Back0 VAR TH1 HIDE ***)\n\nlemma Back0_VAR_TH1_HIDE: \n  \"(Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n                 -- (CH0 Un CH1)\n   =F\n        Back0 -> ((($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n                  -- (CH0 Un CH1))\n        [>\n        IF ODD n \n        THEN ((Back0 -> ($TH0) |[CH0]| ($(VAR n)) \n                                     |[CH1]| Eat1 -> ($(EAT1 n)))\n              -- (CH0 Un CH1))\n        ELSE ((Back0 -> ($TH0) |[CH0]| ($(VAR n))\n                                     |[CH1]| Back1 -> ($TH1))\n              -- (CH0 Un CH1))\"\napply (cspF_simp unfold_Imp_rules29)\napply (cspF_step_left)+\napply (cspF_step_right)+\napply (rule cspF_decompo)+\napply (auto)\n\napply (subgoal_tac \"{Back0, (RD1 n)} Int (CH0 Un CH1) = {(RD1 n)}\")\napply (case_tac \"ODD n\")\napply (cspF_simp fold_Imp_rules29)+\ndone\n\nlemmas Back0_VAR_TH1_HIDE_simp = Back0_VAR_TH1_HIDE[simplified]\nlemmas unfold_Imp_rules30 = unfold_Imp_rules29 Back0_VAR_TH1_HIDE_simp\nlemmas fold_Imp_rules30 = fold_Imp_rules29 Back0_VAR_TH1_HIDE_simp[THEN cspF_sym]\n\n(**************************)\n(*** TH0 VAR Back1 HIDE ***)\n\nlemma TH0_VAR_Back1_HIDE: \n  \"(($TH0) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n                 -- (CH0 Un CH1)\n   =F\n        Back1 -> ((($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n                  -- (CH0 Un CH1))\n        [>\n        IF EVEN n\n        THEN ((Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n))\n                                         |[CH1]| Back1 -> ($TH1))\n              -- (CH0 Un CH1))\n        ELSE ((Back0 -> ($TH0) |[CH0]| ($(VAR n))\n                                     |[CH1]| Back1 -> ($TH1))\n              -- (CH0 Un CH1))\"\napply (cspF_simp unfold_Imp_rules30)\napply (cspF_step_left)+\napply (cspF_step_right)+\napply (rule cspF_decompo)+\napply (auto)\napply (subgoal_tac \"{Back1, (RD0 n)} Int (CH0 Un CH1) = {(RD0 n)}\")\napply (case_tac \"ODD n\")\napply (cspF_simp fold_Imp_rules30)+\ndone\n\nlemmas TH0_VAR_Back1_HIDE_simp = TH0_VAR_Back1_HIDE[simplified]\nlemmas unfold_Imp_rules31 = unfold_Imp_rules30 TH0_VAR_Back1_HIDE_simp\nlemmas fold_Imp_rules31 = fold_Imp_rules30 TH0_VAR_Back1_HIDE_simp[THEN cspF_sym]\n\n(*** Eat0 VAR TH1 HIDE ***)\n\nlemma Eat0_VAR_TH1_HIDE: \n  \"EVEN n ==>\n   (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n                  -- (CH0 Un CH1)\n   =F\n        Eat0 -> ((($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n                  -- (CH0 Un CH1))\n        [>\n        (Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n         -- (CH0 Un CH1)\"\napply (cspF_simp_left unfold_Imp_rules31)\napply (cspF_step_left)+\napply (cspF_step_right)+\napply (rule cspF_decompo)+\napply (auto)\ndone\n\nlemmas Eat0_VAR_TH1_HIDE_simp = Eat0_VAR_TH1_HIDE[simplified]\nlemmas unfold_Imp_rules32 = unfold_Imp_rules31 Eat0_VAR_TH1_HIDE_simp\nlemmas fold_Imp_rules32 = fold_Imp_rules31 Eat0_VAR_TH1_HIDE_simp[THEN cspF_sym]\n\n(*** TH0 VAR Eat1 HIDE ***)\n\nlemma TH0_VAR_Eat1_HIDE: \n  \"ODD n ==>\n   (($TH0) |[CH0]| ($(VAR n)) |[CH1]| Eat1 -> ($(EAT1 n)))\n                 -- (CH0 Un CH1)\n   =F\n        Eat1 -> ((($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($(EAT1 n)))\n                 -- (CH0 Un CH1))\n        [>\n        (Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| Eat1 -> ($(EAT1 n)))\n                 -- (CH0 Un CH1)\"\napply (cspF_simp_left unfold_Imp_rules32)\napply (cspF_step_left)+\napply (cspF_step_right)+\napply (rule cspF_decompo)+\napply (auto)\ndone\n\nlemmas TH0_VAR_Eat1_HIDE_simp = TH0_VAR_Eat1_HIDE[simplified]\nlemmas unfold_Imp_rules33 = unfold_Imp_rules32 TH0_VAR_Eat1_HIDE_simp\nlemmas fold_Imp_rules33 = fold_Imp_rules32 TH0_VAR_Eat1_HIDE_simp[THEN cspF_sym]\n\n(*** EAT0 VAR TH1 HIDE ***)\n\nlemma EAT0_VAR_TH1_HIDE: \n  \"EVEN n ==>\n   (($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n                 -- (CH0 Un CH1)\n   =F\n        End0 -> ((WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)) \n                                                |[CH1]| ($TH1))\n                 -- (CH0 Un CH1))\n        [>\n        (($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n         -- (CH0 Un CH1)\"\napply (cspF_simp_left unfold_Imp_rules33)\napply (cspF_step_left)+\napply (cspF_step_right)+\napply (rule cspF_decompo)+\napply (auto)\ndone\n\nlemmas EAT0_VAR_TH1_HIDE_simp = EAT0_VAR_TH1_HIDE[simplified]\nlemmas unfold_Imp_rules34 = unfold_Imp_rules33 EAT0_VAR_TH1_HIDE_simp\nlemmas fold_Imp_rules34 = fold_Imp_rules33 EAT0_VAR_TH1_HIDE_simp[THEN cspF_sym]\n\n(*** TH0 VAR EAT1 HIDE ***)\n\nlemma TH0_VAR_EAT1_HIDE: \n  \"ODD n ==>\n   (($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($(EAT1 n)))\n                 -- (CH0 Un CH1)\n   =F\n        End1 -> ((($TH0) |[CH0]| ($(VAR n)) \n                               |[CH1]| WR1 (3 * n + 1) -> ($TH1))\n                 -- (CH0 Un CH1))\n        [>\n        (Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($(EAT1 n)))\n         -- (CH0 Un CH1)\"\napply (cspF_simp_left unfold_Imp_rules34)\napply (cspF_step_left)+\napply (cspF_step_right)+\napply (rule cspF_decompo)+\napply (auto)\ndone\n\nlemmas TH0_VAR_EAT1_HIDE_simp = TH0_VAR_EAT1_HIDE[simplified]\nlemmas unfold_Imp_rules35 = unfold_Imp_rules34 TH0_VAR_EAT1_HIDE_simp\nlemmas fold_Imp_rules35 = fold_Imp_rules34 TH0_VAR_EAT1_HIDE_simp[THEN cspF_sym]\n\n(*** TH0 VAR TH1 HIDE step 1 ***)\n\nlemma TH0_VAR_TH1_HIDE:\n  \"(($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n         -- (CH0 Un CH1)\n   =F \n       (IF EVEN n\n        THEN ((Eat0 -> ($(EAT0 n)) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n              -- (CH0 Un CH1))\n        ELSE ((Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n              -- (CH0 Un CH1)))\n        |~|\n       (IF ODD n \n        THEN ((($TH0) |[CH0]| ($(VAR n)) |[CH1]| Eat1 -> ($(EAT1 n)))\n              -- (CH0 Un CH1))\n        ELSE ((($TH0) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n              -- (CH0 Un CH1)))\"\napply (cspF_simp_left unfold_Imp_rules35)\napply (cspF_step_left)+\napply (rule cspF_ref_eq)\n\n (* <= *)\n apply (rule)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (rule_tac x=\"RD0 n\" in exI)\n  apply (case_tac \"ODD n\")\n  apply (simp)\n  apply (cspF_simp)+\n\n  apply (rule cspF_Rep_int_choice_left)\n  apply (rule_tac x=\"RD1 n\" in exI)\n  apply (case_tac \"ODD n\")\n  apply (simp)\n  apply (cspF_simp)+\n\n(* => *)\n apply (subgoal_tac \"{(RD0 n), (RD1 n)} Int (CH0 Un CH1) = {(RD0 n), (RD1 n)}\")\n apply (auto)\n\n  apply (rule cspF_Int_choice_left1)\n  apply (case_tac \"ODD n\")\n  apply (simp)\n  apply (cspF_simp)+\n\n  apply (rule cspF_Int_choice_left2)\n  apply (case_tac \"ODD n\")\n  apply (simp)\n  apply (cspF_simp)+\ndone\n\nlemmas TH0_VAR_TH1_HIDE_simp = TH0_VAR_TH1_HIDE[simplified]\nlemmas unfold_Imp_rules36 = unfold_Imp_rules35 TH0_VAR_TH1_HIDE_simp\nlemmas fold_Imp_rules36 = fold_Imp_rules35 TH0_VAR_TH1_HIDE_simp[THEN cspF_sym]\n\n(*** WR0 VAR Back1 HIDE ***)\n\nlemma WR0_VAR_Back1_HIDE: \n  \"EVEN n ==>\n   (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| Back1 -> ($TH1))\n                 -- (CH0 Un CH1)\n   =F\n        Back1 -> ((WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n))\n                                                 |[CH1]| ($TH1))\n                  -- (CH0 Un CH1))\n        [>\n        (($TH0) |[CH0]| ($(VAR (n div 2))) |[CH1]| Back1 -> ($TH1))\n        -- (CH0 Un CH1)\"\napply (cspF_simp_left unfold_Imp_rules36)\napply (cspF_step_left)+\napply (cspF_step_right)+\napply (rule cspF_decompo)+\napply (auto)\ndone\n\nlemmas WR0_VAR_Back1_HIDE_simp = WR0_VAR_Back1_HIDE[simplified]\nlemmas unfold_Imp_rules37 = unfold_Imp_rules36 WR0_VAR_Back1_HIDE_simp\nlemmas fold_Imp_rules37 = fold_Imp_rules36 WR0_VAR_Back1_HIDE_simp[THEN cspF_sym]\n\n(*** Back0 VAR WR1 HIDE ***)\n\nlemma Back0_VAR_WR1_HIDE: \n  \"ODD n ==>\n   (Back0 -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| WR1 (3 * n + 1) -> ($TH1))\n                 -- (CH0 Un CH1)\n   =F\n        Back0 -> ((($TH0) |[CH0]| ($(VAR n)) \n                                |[CH1]| WR1 (3 * n + 1) -> ($TH1))\n                 -- (CH0 Un CH1))\n        [>\n        (Back0 -> ($TH0) |[CH0]| ($(VAR (3 * n + 1))) |[CH1]| ($TH1))\n        -- (CH0 Un CH1)\"\napply (cspF_simp_left unfold_Imp_rules37)\napply (cspF_step_left)+\napply (cspF_step_right)+\napply (rule cspF_decompo)+\napply (auto)\ndone\n\nlemmas Back0_VAR_WR1_HIDE_simp = Back0_VAR_WR1_HIDE[simplified]\nlemmas unfold_Imp_rules38 = unfold_Imp_rules37 Back0_VAR_WR1_HIDE_simp\nlemmas fold_Imp_rules38 = fold_Imp_rules37 Back0_VAR_WR1_HIDE_simp[THEN cspF_sym]\n\n(*** WR0 VAR TH1 HIDE ***)\n\nlemma WR0_VAR_TH1_HIDE: \n  \"EVEN n ==>\n   (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n)) |[CH1]| ($TH1))\n                -- (CH0 Un CH1)\n   =F\n        (($TH0)  |[CH0]| ($(VAR (n div 2))) |[CH1]| ($TH1))\n         -- (CH0 Un CH1)\n        |~|\n        (WR0 (n div 2) -> ($TH0) |[CH0]| ($(VAR n))\n                                       |[CH1]| Back1 -> ($TH1))\n        -- (CH0 Un CH1)\"\napply (cspF_simp_left unfold_Imp_rules38)\napply (cspF_step_left)+\napply (rule cspF_ref_eq)\n\n (* <= *)\n apply (rule)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (rule_tac x=\"WR0 (n div 2)\" in exI)\n  apply (simp, cspF_simp)  (* modified for Isabelle2020 *)\n                           (* \"+\" is removed *)\n\n  apply (rule cspF_Rep_int_choice_left)\n  apply (rule_tac x=\"RD1 n\" in exI)\n  apply (simp, cspF_simp)\n\n(* => *)\n apply (subgoal_tac \"{(WR0 (n div 2)), (RD1 n)} Int (CH0 Un CH1) =\n                     {(WR0 (n div 2)), (RD1 n)}\")\n apply (auto)\n\n  apply (rule cspF_Int_choice_left1)\n  apply (cspF_simp)+\n  apply (rule cspF_Int_choice_left2)\n  apply (cspF_simp)+\ndone\n\nlemmas WR0_VAR_TH1_HIDE_simp = WR0_VAR_TH1_HIDE[simplified]\nlemmas unfold_Imp_rules39 = unfold_Imp_rules38 WR0_VAR_TH1_HIDE_simp\nlemmas fold_Imp_rules39 = fold_Imp_rules38 WR0_VAR_TH1_HIDE_simp[THEN cspF_sym]\n\n(*** TH0 VAR WR1 HIDE ***)\n\nlemma TH0_VAR_WR1_HIDE: \n  \"ODD n ==>\n   (($TH0) |[CH0]| ($(VAR n)) |[CH1]| WR1 (3 * n + 1) -> ($TH1))\n                  -- (CH0 Un CH1)\n   =F\n        (($TH0) |[CH0]| ($(VAR (3 * n + 1))) |[CH1]| ($TH1))\n        -- (CH0 Un CH1)\n        |~|\n        (Back0 -> ($TH0) |[CH0]| ($(VAR n))\n                               |[CH1]| WR1 (3 * n + 1) -> ($TH1))\n        -- (CH0 Un CH1)\"\napply (cspF_simp_left unfold_Imp_rules39)\napply (cspF_step_left)+\napply (rule cspF_ref_eq)\n\n (* <= *)\n apply (rule)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (rule_tac x=\"WR1 (3 * n + 1)\" in exI)\n  apply (simp, cspF_simp)\n  apply (rule cspF_Rep_int_choice_left)\n  apply (rule_tac x=\"RD0 n\" in exI)\n  apply (simp, cspF_simp)\n\n(* => *)\n apply (subgoal_tac \"{(WR1 (3 * n + 1)), (RD0 n)} Int (CH0 Un CH1) =\n                     {(WR1 (3 * n + 1)), (RD0 n)}\")\n apply (auto)\n\n  apply (rule cspF_Int_choice_left1)\n  apply (cspF_simp)+\n  apply (rule cspF_Int_choice_left2)\n  apply (cspF_simp)+\ndone\n\nlemmas TH0_VAR_WR1_HIDE_simp = TH0_VAR_WR1_HIDE[simplified]\nlemmas unfold_Imp_rules = unfold_Imp_rules39 TH0_VAR_WR1_HIDE_simp\nlemmas fold_Imp_rules = fold_Imp_rules39 TH0_VAR_WR1_HIDE_simp[THEN cspF_sym]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/DM/DM3_hide.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.30474230844932787}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory ML_Goal_Test\nimports\n  ML_Goal\n  \"ml-helpers/MLUtils\"\nbegin\nexperiment begin\n\n\\<comment>\\<open>\n  Basic usage.\n\\<close>\nML_goal test: \\<open>\n  [@{term \"(P \\<longrightarrow> Q) \\<and> P \\<longrightarrow> Q\"}]\n\\<close>\n  apply clarsimp\n  done\n\nthm test\n\n\\<comment>\\<open>\n  A goal that we definitely don't want to write out by hand.\n\n  In this case, we're going to show that if x is less than 10,\n  we \"only\" need to consider the cases when x = 0, or x = 1, or...\n\\<close>\nML_goal big_goal: \\<open>\n  let\n    val var_x = Free (\"x\", @{typ nat});\n    val var_P = Free (\"P\", @{typ bool});\n    val max = 10;\n\n    \\<comment>\\<open>\n      @{ML \"HOLogic.mk_nat\"} produces nested Suc's, which are pretty\n      ugly, so we use this instead.\n    \\<close>\n    val mk_nat = HOLogic.mk_number @{typ nat};\n\n    \\<comment>\\<open>\n      Turns (i: int) into @{term \"x = i \\<Longrightarrow> P\"}.\n    \\<close>\n    fun mk_case i =\n        let\n          val prem = HOLogic.mk_eq (var_x, mk_nat i) |> HOLogic.mk_Trueprop;\n          val conc = var_P |> HOLogic.mk_Trueprop;\n        in Logic.mk_implies (prem, conc) end\n\n    val x_cases =\n        ListExtras.range 0 max\n        |> map mk_case;\n\n    val assm =\n        HOLogic.mk_binrel @{const_name \"less\"}\n          (var_x,\n          (mk_nat max))\n        |> HOLogic.mk_Trueprop;\n\n    val goal =\n        Logic.list_implies (assm :: x_cases, var_P |> HOLogic.mk_Trueprop)\n\n  in [goal] end\n\\<close>\n  by force\n\n\\<comment>\\<open>\n  Names are optional.\n\\<close>\nML_goal \\<open>\n  [@{term \"True\"}]\n\\<close>\n  by (rule TrueI)\n\n\\<comment>\\<open>\n  Multiple goals are supported, and result in similar\n  \"list of fact\" lemmas\n\\<close>\nML_goal multiple_goals: \\<open>\n  [@{term \"(P \\<Longrightarrow> Q \\<Longrightarrow> P)\"}, @{term \"(P \\<Longrightarrow> Q \\<Longrightarrow> Q)\"}]\n\\<close>\n  by simp+\n\nthm multiple_goals[OF TrueI]\n\n\\<comment>\\<open>\n  Handles mixes of @{typ bool} and @{typ prop}.\n\\<close>\nML_goal \\<open>\n  [@{term \"PROP A \\<Longrightarrow> PROP A\"}, @{term \"B \\<longrightarrow> B\"}]\n\\<close>\n  by simp+\n\n\\<comment>\\<open>\n  Turns out a lemma name can refer to nothing as well!\n\\<close>\nML_goal nothing: \\<open>[]\\<close>\n  done\n\nthm nothing[OF TrueI]\n\n\\<comment>\\<open>\n  Attributes can be applied, just like normal lemmas.\n\\<close>\ndefinition magic where \"magic = (5 :: nat)\"\n\nML_goal declared_with_an_attribute[folded magic_def, simp]: \\<open>\n  [@{term \"(5 :: nat) = 2 + 3\"}]\n\\<close>\n  by simp\n\nlemma uses_our_new_magic_simp_rule:\n  \"magic = 1 + 4\"\n  by simp\n\nend\n\nend", "meta": {"author": "CompSoftVer", "repo": "CSim2", "sha": "b09a4d77ea089168b1805db5204ac151df2b9eff", "save_path": "github-repos/isabelle/CompSoftVer-CSim2", "path": "github-repos/isabelle/CompSoftVer-CSim2/CSim2-b09a4d77ea089168b1805db5204ac151df2b9eff/lib/ML_Goal_Test.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804478040617, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.3045563950251602}}
{"text": "theory SINVAR_SecGwExt\nimports \"../TopoS_Helper\"\nbegin\n\nsubsection \\<open>SecurityInvariant PolEnforcePointExtended\\<close>\ntext \\<open>A PolEnforcePoint is an application-level central policy enforcement point.\nLegacy note: The old verions called it a SecurityGateway.\n\nHosts may belong to a certain domain. \nSometimes, a pattern where intra-domain communication between domain members must be approved by a central instance is required. \n\nWe call such a central instance PolEnforcePoint and present a template for this architecture. \nFive host roles are distinguished:. \nA PolEnforcePoint, aPolEnforcePointIN which accessible from the outside, a DomainMember,\na less-restricted AccessibleMember which is accessible from the outside world, \nand a default value Unassigned that reflects none of these roles.\\<close>\n\ndatatype secgw_member = PolEnforcePoint | PolEnforcePointIN | DomainMember  | AccessibleMember | Unassigned\n\ndefinition default_node_properties :: \"secgw_member\"\n  where  \"default_node_properties \\<equiv> Unassigned\"\n\n\nfun allowed_secgw_flow :: \"secgw_member \\<Rightarrow> secgw_member \\<Rightarrow> bool\" where\n  \"allowed_secgw_flow PolEnforcePoint _ = True\" |\n  \"allowed_secgw_flow PolEnforcePointIN _ = True\" |\n  \"allowed_secgw_flow DomainMember DomainMember = False\" |\n  \"allowed_secgw_flow DomainMember _ = True\" |\n  \"allowed_secgw_flow AccessibleMember DomainMember = False\" |\n  \"allowed_secgw_flow AccessibleMember _ = True\" |\n  \"allowed_secgw_flow Unassigned Unassigned = True\" |\n  \"allowed_secgw_flow Unassigned PolEnforcePointIN = True\" |\n  \"allowed_secgw_flow Unassigned AccessibleMember = True\" |\n  \"allowed_secgw_flow Unassigned _ = False\" \n\n\nfun sinvar :: \"'v graph \\<Rightarrow> ('v \\<Rightarrow> secgw_member) \\<Rightarrow> bool\" where\n  \"sinvar G nP = (\\<forall> (e1,e2) \\<in> edges G. e1 \\<noteq> e2 \\<longrightarrow> allowed_secgw_flow (nP e1) (nP e2))\"\n\ndefinition receiver_violation :: \"bool\" where \"receiver_violation = False\"\n\nsubsubsection \\<open>Preliminaries\\<close>\n  \n\nsubsubsection\\<open>ENF\\<close>\n  lemma PolEnforcePoint_ENFnr: \"SecurityInvariant_withOffendingFlows.sinvar_all_edges_normal_form_not_refl sinvar allowed_secgw_flow\"\n    by(simp add: SecurityInvariant_withOffendingFlows.sinvar_all_edges_normal_form_not_refl_def)\n  lemma Unassigned_botdefault: \"\\<forall> e1 e2. e2 \\<noteq> Unassigned \\<longrightarrow> \\<not> allowed_secgw_flow e1 e2 \\<longrightarrow> \\<not> allowed_secgw_flow Unassigned e2\"\n    apply(rule allI)+\n    apply(case_tac e2)\n        apply(simp_all)\n     apply(case_tac e1)\n          apply(simp_all)\n    apply(case_tac e1)\n        apply(simp_all)\n    done\n  lemma Unassigned_not_to_Member: \"\\<not> allowed_secgw_flow Unassigned DomainMember\"\n    by(simp)\n  lemma All_to_Unassigned: \"\\<forall> e1. allowed_secgw_flow e1 Unassigned\"\n    by (rule allI, case_tac e1, simp_all)\n\n  definition PolEnforcePointExtended_offending_set:: \"'v graph \\<Rightarrow> ('v \\<Rightarrow> secgw_member) \\<Rightarrow> ('v \\<times> 'v) set set\" where\n  \"PolEnforcePointExtended_offending_set G nP = (if sinvar G nP then\n      {}\n     else \n      { {e \\<in> edges G. case e of (e1,e2) \\<Rightarrow> e1 \\<noteq> e2 \\<and> \\<not> allowed_secgw_flow (nP e1) (nP e2)} })\"\n  lemma PolEnforcePointExtended_offending_set: \"SecurityInvariant_withOffendingFlows.set_offending_flows sinvar = PolEnforcePointExtended_offending_set\"\n    apply(simp only: fun_eq_iff ENFnr_offending_set[OF PolEnforcePoint_ENFnr] PolEnforcePointExtended_offending_set_def)\n    apply(rule allI)+\n    apply(rename_tac G nP)\n    apply(auto)\n  done\n\ninterpretation PolEnforcePointExtended: SecurityInvariant_ACS\nwhere default_node_properties = default_node_properties\nand sinvar = sinvar\nrewrites \"SecurityInvariant_withOffendingFlows.set_offending_flows sinvar = PolEnforcePointExtended_offending_set\"\n  unfolding default_node_properties_def\n  apply unfold_locales\n    apply(rule ballI)\n    apply (rule SecurityInvariant_withOffendingFlows.ENFnr_fsts_weakrefl_instance[OF PolEnforcePoint_ENFnr Unassigned_botdefault All_to_Unassigned])[1]\n     apply(simp)\n    apply(simp)\n   apply(erule default_uniqueness_by_counterexample_ACS)\n   apply (simp add: SecurityInvariant_withOffendingFlows.set_offending_flows_def\n      SecurityInvariant_withOffendingFlows.is_offending_flows_min_set_def\n      SecurityInvariant_withOffendingFlows.is_offending_flows_def)\n   apply (simp add:graph_ops)\n   apply (simp split: prod.split_asm prod.split)\n   apply(rule_tac x=\"\\<lparr> nodes={vertex_1,vertex_2}, edges = {(vertex_1,vertex_2)} \\<rparr>\" in exI, simp)\n   apply(rule conjI)\n    apply(simp add: wf_graph_def)\n   apply(case_tac otherbot, simp_all)\n      apply(rename_tac secgwcase)\n      apply(rule_tac x=\"(\\<lambda> x. Unassigned)(vertex_1 := Unassigned, vertex_2 := DomainMember)\" in exI, simp)\n      apply(rule_tac x=\"{(vertex_1,vertex_2)}\" in exI, simp)\n     apply(rename_tac secgwINcase)\n     apply(rule_tac x=\"(\\<lambda> x. Unassigned)(vertex_1 := Unassigned, vertex_2 := DomainMember)\" in exI, simp)\n     apply(rule_tac x=\"vertex_1\" in exI, simp)\n     apply(rule_tac x=\"{(vertex_1,vertex_2)}\" in exI, simp)\n    apply(rename_tac membercase)\n    apply(rule_tac x=\"(\\<lambda> x. Unassigned)(vertex_1 := Unassigned, vertex_2 := PolEnforcePoint)\" in exI, simp)\n    apply(rule_tac x=\"vertex_1\" in exI, simp)\n    apply(rule_tac x=\"{(vertex_1,vertex_2)}\" in exI, simp)\n   apply(rule_tac x=\"(\\<lambda> x. Unassigned)(vertex_1 := Unassigned, vertex_2 := PolEnforcePoint)\" in exI, simp)\n   apply(rule_tac x=\"vertex_1\" in exI, simp)\n   apply(rule_tac x=\"{(vertex_1,vertex_2)}\" in exI, simp)\n\n  apply(fact PolEnforcePointExtended_offending_set)\n done\n\n\n\n  lemma TopoS_PolEnforcePointExtended: \"SecurityInvariant sinvar default_node_properties receiver_violation\"\n  unfolding receiver_violation_def by unfold_locales  \n\nhide_const (open) sinvar receiver_violation\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Security_Invariants/SINVAR_SecGwExt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804478040616, "lm_q2_score": 0.49218813572079556, "lm_q1q2_score": 0.30455639502516013}}
{"text": "theory Indirections\nimports Terms \"Nominal-Utils\" \"AList-Utils-Nominal\" \"FMap-Heap\" \"FMap-Nominal\"\nbegin\n\n\ntype_synonym indirections = \"(var \\<times> var) list \"\n\nclass resolvable =\n  fixes resolve :: \"'a \\<Rightarrow> indirections \\<Rightarrow> 'a\" (infixl \"\\<ominus>\" 60)\n  assumes resolve_append[simp]: \"x \\<ominus> (is'@is) = x \\<ominus> is' \\<ominus> is\"\n  assumes resolve_Nil[simp]: \"x \\<ominus> [] = x\"\n\nclass resolvable_eqvt = resolvable + pt + \n  assumes resolve_eqvt: \"p \\<bullet> (x \\<ominus> is) = (p \\<bullet> x) \\<ominus> (p \\<bullet> is)\"\n  assumes resolve_fresh_noop[simp]: \"atom a \\<sharp> x \\<Longrightarrow> x \\<ominus> ((a, b) # is) = x \\<ominus> is\"\n\ndeclare resolve_eqvt[eqvt]\n\ninstantiation list :: (resolvable) resolvable \nbegin\n  definition resolve_list :: \"'a list \\<Rightarrow> indirections \\<Rightarrow> 'a list\"\n  where \"m \\<ominus> is = map (\\<lambda>x. x \\<ominus> is) m\"\n\n  lemma resolve_list_Nil[simp]: \"[] \\<ominus> is = []\"\n    unfolding resolve_list_def by simp\n  \n  lemma resolve_list_Cons[simp]: \"(x # xs) \\<ominus> is = (x \\<ominus> is) # (xs \\<ominus> is)\"\n    unfolding resolve_list_def by simp\ninstance\n  apply default\n  apply (induct_tac \"x\", auto)\n  apply (simp add: resolve_list_def)\n  done\nend\n\ninstance list :: (resolvable_eqvt) resolvable_eqvt\n  apply default\n  apply (simp add: resolve_list_def)\n  apply (simp add: resolve_list_def fresh_list_elem)\n  done\n\ninstantiation var :: resolvable_eqvt\nbegin\n  fun resolve_var :: \"var \\<Rightarrow> indirections \\<Rightarrow> var\"  where\n    \"v \\<ominus> [] = (v::var)\"\n    | \"v \\<ominus> ((x,y)#is) = v[x ::v= y] \\<ominus> is\"\n\n  lemma resolve_var_append: \"(v::var) \\<ominus> (is'@is) = v \\<ominus> is' \\<ominus> is\"\n    by (induct \"is'\" arbitrary: v) auto\ninstance\n  apply default\n  apply (rule resolve_var_append)\n  apply (simp)\n  apply (induct_tac x \"is\" rule:resolve_var.induct, simp+)\n  done\nend\n\nlemma resove_var_noop[simp]: \"x \\<notin> heapVars is \\<Longrightarrow> x \\<ominus> is = x\"\n  by (induct x \"is\" rule: resolve_var.induct) auto\n\ninstantiation exp :: resolvable_eqvt\nbegin\n  fun resolve_exp :: \"exp \\<Rightarrow> indirections \\<Rightarrow> exp\" where\n    \"e \\<ominus> [] = (e::exp)\"\n    | \"e \\<ominus> ((x,y)#is) = (e[x ::= y]) \\<ominus> is\"\n\n  lemma resolve_exp_append: \"(e::exp) \\<ominus> (is'@is) = e \\<ominus> is' \\<ominus> is\"\n    by (induct \"is'\" arbitrary: e) auto\n\n  lemma resolve_exp_eqvt[eqvt]: \"p \\<bullet> ((e::exp) \\<ominus> is) = (p \\<bullet> e) \\<ominus> (p \\<bullet> is)\"\n    by (induction e \"is\" rule:resolve_exp.induct) simp+\n\ninstance \n  apply default\n  apply (rule resolve_exp_append)\n  apply simp\n  apply (rule resolve_exp_eqvt)\n  apply (simp add: subst_fresh_noop)\n  done\nend\n\ninstantiation assn :: resolvable_eqvt\nbegin\n  fun resolve_assn :: \"assn \\<Rightarrow> indirections \\<Rightarrow> assn\" where\n    \"as \\<ominus> [] = (as::assn)\"\n    | \"as \\<ominus> ((x,y)#is) = (as[x ::a= y]) \\<ominus> is\"\n\n  lemma resolve_assn_append: \"(as::assn) \\<ominus> (is'@is) = as\\<ominus> is' \\<ominus> is\"\n    by (induct \"is'\" arbitrary: as) auto\n\n  lemma resolve_assn_eqvt[eqvt]: \"p \\<bullet> ((as::assn) \\<ominus> is) = (p \\<bullet> as) \\<ominus> (p \\<bullet> is)\"\n    by (induction as \"is\" rule:resolve_assn.induct) simp+\n\ninstance\n  apply default\n  apply (rule resolve_assn_append)\n  apply simp\n  apply (rule resolve_assn_eqvt)\n  apply (simp add: subst_assn_fresh_noop)\n  done\nend\n\nlemma resolve_var_fresh: \"atom ` heapVars is \\<sharp>* v \\<Longrightarrow> (v::var) \\<ominus> is = v\"\n  by (induct \"is\" rule:resolve_var.induct)(auto simp add: fresh_star_def fresh_def )\n\nlemma resolve_var_fresh'[simp]: \"atom v \\<sharp> is \\<Longrightarrow> (v::var) \\<ominus> is = v\"\n  by (induct \"is\" rule:resolve_var.induct)(auto simp add: fresh_Cons fresh_Pair)\n\nlemma resolve_var_list_fresh: \"atom ` heapVars is \\<sharp>* L \\<Longrightarrow> (L::var list) \\<ominus> is = L\"\n  by (induct L) (auto simp add: fresh_star_list resolve_var_fresh)\n\n\nlemma resolveExp_Lam: \"atom x \\<sharp> is \\<Longrightarrow> (Lam [x]. e) \\<ominus> is = Lam [x]. (e \\<ominus> is)\"\n  apply (induction \"is\" arbitrary: e)\n  apply simp\n  apply (auto simp add: fresh_Cons)\n  done\n\nlemma resolveExp_App: \"App e x \\<ominus> is = App (e \\<ominus> is) (x \\<ominus> is)\"\n  by (induction \"is\" arbitrary: e x) auto\n\nlemma resolveExp_Var: \"Var x \\<ominus> is = Var (x \\<ominus> is)\"\n  by (induction \"is\" arbitrary: x) auto\n\nlemma resolveExp_Let: \"set (bn as) \\<sharp>* is \\<Longrightarrow> (Let as e) \\<ominus> is = Let (as \\<ominus> is) (e \\<ominus> is)\"\n  by (induction \"is\" arbitrary: as e) (auto simp add: fresh_star_list)\n\nlemma resolve_assn_ANil[simp]: \"ANil \\<ominus> is = ANil\"\n  by (induction \"is\") auto\n\nlemma resolve_assn_ACons[simp]: \"x \\<notin> heapVars is \\<Longrightarrow> (ACons x e as) \\<ominus> is = (ACons (x \\<ominus> is) (e \\<ominus> is) (as \\<ominus> is))\"\n  by (induction \"is\" arbitrary: x e as) auto\n\ndefinition resolveHeap' :: \"Heap \\<Rightarrow> indirections \\<Rightarrow> Heap\"  (infixl \"\\<ominus>\\<^sub>H\" 60) where\n  \"\\<Gamma> \\<ominus>\\<^sub>H is = fmap_map (\\<lambda>e. e \\<ominus> is) (\\<Gamma> f|` (- heapVars is))\"\n\nlemma resolveHeap'_empty[simp]: \"f\\<emptyset> \\<ominus>\\<^sub>H is = f\\<emptyset>\"\n  unfolding resolveHeap'_def by auto\n\nlemma resolveHeap'_Nil[simp]: \"\\<Gamma> \\<ominus>\\<^sub>H [] = \\<Gamma>\"\n  unfolding resolveHeap'_def by auto\n\nlemma resolveHeap'fdom[simp]:\n  \"fdom (\\<Gamma> \\<ominus>\\<^sub>H is) = fdom \\<Gamma> - heapVars is\"\n  unfolding resolveHeap'_def by auto\n\nlemma resolveHeap'_fmap_upd[simp]: \"x \\<in> heapVars is \\<Longrightarrow> (\\<Gamma>(x f\\<mapsto> e)) \\<ominus>\\<^sub>H is = \\<Gamma> \\<ominus>\\<^sub>H is\"\n  unfolding resolveHeap'_def by auto\n\nlemma resolveHeap'_fmap_upd_other[simp]: \"x \\<notin> heapVars is \\<Longrightarrow> (\\<Gamma>(x f\\<mapsto> e)) \\<ominus>\\<^sub>H is = (\\<Gamma> \\<ominus>\\<^sub>H is)(x f\\<mapsto> e \\<ominus> is)\"\n  unfolding resolveHeap'_def by simp\n\nlemma resolveHeap'_fun_merge[simp]: \"fdom \\<Delta> \\<inter> heapVars is = {} \\<Longrightarrow> (\\<Gamma> f++ \\<Delta>) \\<ominus>\\<^sub>H is = (\\<Gamma> \\<ominus>\\<^sub>H is) f++ (\\<Delta> \\<ominus>\\<^sub>H is)\"\n  by (induction \\<Delta> rule:fmap_induct) (auto simp add: fun_merge_upd)\n\nlemma resolveHeap'_fmap_copy[simp]: \"x \\<in> heapVars is \\<Longrightarrow> (fmap_copy \\<Gamma> y x) \\<ominus>\\<^sub>H is = \\<Gamma> \\<ominus>\\<^sub>H is\"\n  unfolding resolveHeap'_def by simp\n\nlemma resolveHeap'_fmap_copy_other[simp]: \"x \\<notin> heapVars is \\<Longrightarrow> y \\<notin> heapVars is \\<Longrightarrow> (fmap_copy \\<Gamma> y x) \\<ominus>\\<^sub>H is = fmap_copy (\\<Gamma> \\<ominus>\\<^sub>H is) y x\"\n  unfolding resolveHeap'_def by auto\n\nlemma resolveHeap'_fresh_Cons[simp]: \"atom y \\<sharp> \\<Gamma> \\<Longrightarrow> \\<Gamma> \\<ominus>\\<^sub>H (y,x)#is = \\<Gamma> \\<ominus>\\<^sub>H is\"\n  unfolding resolveHeap'_def\n  by (rule fmap_map_cong[OF resolve_fresh_noop])\n     (auto dest: set_mp[OF fran_fmap_restr_subset] intro: fmap_restr_cong simp add: fresh_def supp_fmap supp_set_elem_finite)\n\nlemma resolveHeap'_eqvt[eqvt]: \"p \\<bullet> resolveHeap' \\<Gamma> is = resolveHeap' (p \\<bullet> \\<Gamma>) (p \\<bullet> is)\"\n  unfolding resolveHeap'_def\n  by (simp add: fmap_restr_eqvt Compl_eqvt)\n\nfun resolveHeapOne :: \"heap \\<Rightarrow> var \\<Rightarrow> var \\<Rightarrow> heap\"  where\n  \"resolveHeapOne [] _ _ = []\"\n | \"resolveHeapOne ((x,e)#\\<Gamma>) a b = (if a = x then (resolveHeapOne \\<Gamma> a b) else (x, e[a ::= b]) # (resolveHeapOne \\<Gamma> a b))\"\n\nlemma resolveHeapOneFresh: \"atom y \\<sharp> x \\<Longrightarrow> atom y \\<sharp> resolveHeapOne \\<Gamma> y x\"\n  by (induction \\<Gamma> y x rule:resolveHeapOne.induct)\n     (auto simp add: fresh_Nil fresh_Cons fresh_Pair)\n\nlemma resolveHeapOne_eqvt[eqvt]: \"p \\<bullet> resolveHeapOne \\<Gamma> a b = resolveHeapOne (p \\<bullet> \\<Gamma>) (p \\<bullet> a) (p \\<bullet> b)\"\n  by (induction \\<Gamma> a b rule:resolveHeapOne.induct) simp_all\n\nlemma resolveHeapOneNoop[simp]: \"atom y \\<sharp> \\<Gamma> \\<Longrightarrow> resolveHeapOne \\<Gamma> y x = \\<Gamma>\"\n  by (induction \\<Gamma> y x rule:resolveHeapOne.induct)\n     (auto simp add: fresh_Nil fresh_Cons fresh_Pair subst_fresh_noop)\n\nfun resolveHeap :: \"heap \\<Rightarrow> indirections \\<Rightarrow> heap\" (infixl \"\\<ominus>\\<^sub>h\" 60) where\n  \"\\<Gamma> \\<ominus>\\<^sub>h [] = \\<Gamma>\"\n | \"\\<Gamma> \\<ominus>\\<^sub>h ((a,b)#is) = resolveHeapOne \\<Gamma> a b \\<ominus>\\<^sub>h is\"\n  \nlemma resolveHeapNil[simp]: \"[] \\<ominus>\\<^sub>h is = []\"\n  by (induct \"[]::heap\" \"is\" rule:resolveHeap.induct) simp_all\n\nlemma resolveHeapConsRemoved[simp]: \"x \\<in> heapVars is \\<Longrightarrow> (x,e)#\\<Gamma> \\<ominus>\\<^sub>h is = \\<Gamma> \\<ominus>\\<^sub>h is\"\n  apply (induct \"(x,e)#\\<Gamma>\" \"is\" arbitrary: x e \\<Gamma> rule:resolveHeap.induct)\n  apply simp_all\n  apply (erule disjE)\n  apply auto\n  done\n\nlemma resolveHeapCons[simp]: \"x \\<notin> heapVars is \\<Longrightarrow> (x,e)#\\<Gamma> \\<ominus>\\<^sub>h is = (x, e \\<ominus> is) # (\\<Gamma> \\<ominus>\\<^sub>h is)\"\n  apply (induct \"(x,e)#\\<Gamma>\" \"is\" arbitrary: x e \\<Gamma> rule:resolveHeap.induct)\n  apply simp_all\n  done\n\nlemma resolveHeapConsRemoved'[simp]: \"x \\<in> heapVars is \\<Longrightarrow> (y,z)#(x,e)#\\<Gamma> \\<ominus>\\<^sub>h is = ((y,z)#\\<Gamma>) \\<ominus>\\<^sub>h is\"\n  apply (cases \"y \\<in> heapVars is\")\n  apply simp_all\n  done\n\nlemma resolveHeapOneDelete[simp]: \"resolveHeapOne (delete x \\<Gamma>) a b = delete x (resolveHeapOne \\<Gamma> a b)\"\n  by (induct \\<Gamma> a b rule:resolveHeapOne.induct) auto\n\nlemma resolveHeapDelete[simp]: \"delete x \\<Gamma> \\<ominus>\\<^sub>h is = delete x (\\<Gamma> \\<ominus>\\<^sub>h is)\"\n  by (induct \\<Gamma> \"is\" arbitrary: x rule:resolveHeap.induct) simp_all\n\nlemma resolveHeapOneHeapVars[simp]:\n  \"heapVars (resolveHeapOne \\<Gamma> a b) = heapVars \\<Gamma> - {a}\"\n  by (induct \\<Gamma> a b rule:resolveHeapOne.induct) auto\n\nlemma resolveHeapHeapVars[simp]:\n  \"heapVars (\\<Gamma> \\<ominus>\\<^sub>h is) = heapVars \\<Gamma> - heapVars is\"\n  by (induct \\<Gamma> \"is\" rule:resolveHeap.induct) auto\n\nlemma resolveHeapOneDeleted[simp]:\n  \"delete a (resolveHeapOne \\<Gamma> a b \\<ominus>\\<^sub>h is) = resolveHeapOne \\<Gamma> a b \\<ominus>\\<^sub>h is\"\n  by (rule delete_no_there, simp)\n\nlemma resolveHeapDeleted[simp]: \"x \\<in> heapVars is \\<Longrightarrow> delete x (\\<Gamma> \\<ominus>\\<^sub>h is) = \\<Gamma> \\<ominus>\\<^sub>h is\"\n  by (rule delete_no_there, simp)\n\nlemma resolveHeap_eqvt[eqvt]: \"p \\<bullet> resolveHeap \\<Gamma> is = resolveHeap (p \\<bullet> \\<Gamma>) (p \\<bullet> is)\"\n  by(induction \\<Gamma> \"is\" rule:resolveHeap.induct) simp_all\n\nlemma resolveHeap_append[simp]: \"\\<Gamma> \\<ominus>\\<^sub>h (is'@is) = \\<Gamma> \\<ominus>\\<^sub>h is' \\<ominus>\\<^sub>h is\"\n  apply (induct \\<Gamma> \"is'\" rule:resolveHeap.induct)\n  apply (auto)\n  done\n\nlemma resolveHeapOne_set: \"(y, e) \\<in> set \\<Gamma> \\<Longrightarrow> y \\<noteq> a \\<Longrightarrow> (y, e[a ::= b]) \\<in> set (resolveHeapOne \\<Gamma> a b)\"\n  by (induct \\<Gamma> a b rule:resolveHeapOne.induct) auto\n\nlemma resolveHeap_set: \"(y, e) \\<in> set \\<Gamma> \\<Longrightarrow> y \\<notin> heapVars is \\<Longrightarrow> (y, e \\<ominus> is) \\<in> set (\\<Gamma> \\<ominus>\\<^sub>h is)\"\n  by (induct \\<Gamma> \"is\" arbitrary: e rule:resolveHeap.induct) (auto dest: resolveHeapOne_set)\n\ndefinition indirection_related :: \"heap \\<Rightarrow> exp \\<Rightarrow> indirections \\<Rightarrow> heap \\<Rightarrow> exp \\<Rightarrow> bool\" where\n  \"indirection_related \\<Gamma> e is \\<Gamma>' e' = (resolveHeap \\<Gamma> is = \\<Gamma>' \\<and>  e \\<ominus> is = e')\"\n\nlemma subst_subst: \"a \\<noteq> y \\<Longrightarrow> b \\<noteq> y \\<Longrightarrow> e[y ::= x][a ::= b] = (e[a ::= b])[y ::= x[a ::v= b]]\"\n    and  \"a \\<noteq> y \\<Longrightarrow> b \\<noteq> y \\<Longrightarrow> as[y ::a= x][a ::a= b] = (as[a ::a= b])[y ::a= x[a ::v= b]]\"\n  apply (nominal_induct e and as avoiding: x y a b  rule:exp_assn.strong_induct)\n  apply (auto simp add: fresh_star_Pair)\n  done\n\nlemma resolve_subst: \"atom y \\<sharp> is \\<Longrightarrow> e[y ::= x] \\<ominus> is = (e \\<ominus> is)[y ::= (x \\<ominus> is)]\"\nproof (induct e \"is\" arbitrary: x y rule: resolve_exp.induct)\ncase goal1 thus ?case by simp\nnext\ncase (goal2 e a b \"is\" x y)\n  from goal2(2)\n  have ab_ne_y: \"a \\<noteq> y\" \"b \\<noteq> y\" and  \"atom y \\<sharp> is\" \n   by (auto simp add: fresh_Pair fresh_Cons fresh_at_base)\n\n  have \"e[y::=x] \\<ominus> (a, b) # is = e[y::=x][a ::= b] \\<ominus> is\" by simp\n  also\n  have \"\\<dots> = e[a ::= b][y ::=x[a ::v= b]] \\<ominus> is\"\n    by (rule arg_cong[OF subst_subst[OF ab_ne_y]])\n  also\n  have \"\\<dots> = (e[a ::= b] \\<ominus> is)[y ::= (x[a ::v= b]  \\<ominus> is)]\"\n    by (rule goal2(1)[OF `atom y \\<sharp> is`])\n  also\n  have \"\\<dots> = (e \\<ominus> (a, b) # is)[y ::= (x \\<ominus> (a, b) # is)]\"\n    by simp\n  finally show ?case.\nqed\n\nlemma\n  flip_subst: \"atom y' \\<sharp> (e,x) \\<Longrightarrow> ((y \\<leftrightarrow> y') \\<bullet> e)[y' ::=x ] = e[y ::= x]\"\n    and  \"atom y \\<notin> set (bn as) \\<Longrightarrow> atom y' \\<sharp> (as,x) \\<Longrightarrow> ((y \\<leftrightarrow> y') \\<bullet> as)[y' ::a=x ] = as[y ::a= x]\"\nproof (nominal_induct e and as avoiding: y y' x rule:exp_assn.strong_induct)\ncase (Let as exp y y' x)\n  have \"atom y \\<notin> set (bn as)\"\n    using Let(1) by (auto simp add: fresh_star_def)\n  moreover\n  have \"(y \\<leftrightarrow> y') \\<bullet> bn as = bn as\"\n    apply -\n    apply (rule flip_fresh_fresh)\n    using calculation apply (simp add: fresh_def supp_of_atom_list)\n    using  Let.hyps(2) apply (metis fresh_def fresh_star_def not_self_fresh supp_of_atom_list)\n    done\n  moreover note Let\n  ultimately\n  show ?case\n    by (auto simp add: fresh_Pair fresh_star_Pair fresh_star_def simp del: exp_assn.eq_iff)\nnext\nqed (auto simp add: fresh_Pair fresh_star_Pair exp_assn.bn_defs  flip_fresh_fresh simp del: exp_assn.eq_iff)\n\nlemma supp_atom_set: \"supp L = atom ` set L\"\n  apply (induct L)\n  apply (simp add: supp_Nil)\n  apply (clarsimp simp add: supp_Nil supp_Cons supp_at_base)\n  done\n\ninductive valid_ind :: \"indirections \\<Rightarrow> bool\" where\n  ValidIndNil[simp]: \"valid_ind []\" |\n  ValidIndCons: \"valid_ind is \\<Longrightarrow> atom x \\<sharp> (is,y) \\<Longrightarrow> valid_ind ((x,y) # is)\"\n\nlemma heapVarFresh: \"x \\<in> heapVars is \\<Longrightarrow> atom x \\<sharp> ((v::var) \\<ominus> is)\" oops\n\nlemma resolveHeap_fresh:  \"valid_ind is \\<Longrightarrow> x \\<in> heapVars is \\<Longrightarrow> atom x \\<sharp> (\\<Gamma> \\<ominus>\\<^sub>h is)\"\n  by (induct arbitrary: \\<Gamma> rule:valid_ind.induct)\n     (auto simp add: fresh_Pair resolveHeapOneFresh eqvt_fresh_cong2[where f = resolveHeap, OF resolveHeap_eqvt])\n\nlemma resolve_expr_fresh:\n  assumes \"valid_ind is\"\n  assumes \"x \\<in> heapVars is\"\n  shows \"atom x \\<sharp> ((e :: exp) \\<ominus> is)\"\nusing assms\n  by (induct arbitrary: e rule:valid_ind.induct)\n     (auto simp add: fresh_Pair eqvt_fresh_cong2[where f = resolve, OF resolve_eqvt])\n\nlemma resolveHeap'_fresh:\n  assumes \"valid_ind is\"\n  assumes \"x \\<in> heapVars is\"\n  shows \"atom x \\<sharp> (\\<Gamma> \\<ominus>\\<^sub>H is)\"\nproof (induction \\<Gamma> rule:fmap_induct)\n  case empty show ?case by auto\nnext\n  case (update \\<Gamma> x' v)\n  show ?case\n  proof(cases \"x' \\<in> heapVars is\")\n    case True with update assms\n    show ?thesis by auto\n  next\n    case False\n    moreover\n    hence \"x \\<noteq> x'\" using assms(2) by auto\n    ultimately\n    show ?thesis\n    using update assms\n    by (auto simp add: resolve_expr_fresh eqvt_fresh_cong3[where f = fmap_upd, OF fmap_upd_eqvt])\n  qed\nqed\n\nlemma resolveHeapOne_distinctVars: \"distinctVars \\<Gamma> \\<Longrightarrow> distinctVars (resolveHeapOne \\<Gamma> a b)\"\n  by (induct \\<Gamma> a b rule:resolveHeapOne.induct) (auto simp add: distinctVars_Cons)\n\nlemma resolveHeap_distinctVars[simp]: \"distinctVars \\<Gamma> \\<Longrightarrow> distinctVars (\\<Gamma> \\<ominus>\\<^sub>h is)\"\n  by (induct \\<Gamma> \"is\" rule:resolveHeap.induct) (auto simp add: resolveHeapOne_distinctVars)\n\nlemma resolve_var_same_image[dest]: \"valid_ind is \\<Longrightarrow> (x,y) \\<in> set is \\<Longrightarrow> x \\<ominus> is = y \\<ominus> is\"\n  apply (induct  \"is\" rule: valid_ind.induct)\n  apply (auto simp add: fresh_Pair)\n  apply (metis fresh_Pair fresh_list_elem not_self_fresh)\n  by (metis fresh_Pair fresh_list_elem not_self_fresh)\n\n\nlemma valid_ind_smaller_index:\n  assumes \"valid_ind is\"\n  assumes \"i < length is\"\n  assumes \"j < length is\"\n  assumes \"is ! i = (x,y)\"\n  assumes \"is ! j = (y,y')\"\n  shows \"j > i\"\nusing assms\nproof (induct arbitrary: i j rule:valid_ind.induct)\ncase ValidIndNil thus ?case by simp\nnext\ncase (ValidIndCons \"is\" a b i j)\n  show ?case\n  proof(cases i)\n    case 0\n    with ValidIndCons\n    show ?thesis\n      by (cases j) (auto simp add: fresh_Pair fresh_at_base)\n  next\n    case (Suc i')\n    with ValidIndCons have \"i' < length is\" by auto\n\n    show ?thesis\n    proof (cases j)\n    case 0\n      with ValidIndCons  `i = Suc i'`\n      have \"atom y \\<sharp> is\" and \"is ! i' = (x, y)\" by (simp_all add: fresh_Pair)\n      hence \"(x,y) \\<in> set is\" using `i' < length is`\n      by (metis nth_mem)\n      with `atom y \\<sharp> is` have \"atom y \\<sharp> (x,y)\" by (metis fresh_list_elem)\n      hence False by (simp add: fresh_Pair fresh_at_base)\n      thus ?thesis by simp\n    next\n    case Suc with `i = Suc i'` ValidIndCons\n      show ?thesis by (auto simp add: fresh_Pair fresh_at_base)\n    qed\n  qed\nqed\n\nlemma valid_ind_induct[consumes 1, case_names NoInd Ind, induct pred: valid_ind]:\n  assumes \"valid_ind is\"\n  assumes NoInd: \"\\<And> x. valid_ind is \\<Longrightarrow> x \\<notin> heapVars is \\<Longrightarrow> P x\"\n  assumes Ind: \"\\<And> x y.  valid_ind is \\<Longrightarrow> P y \\<Longrightarrow> (x,y) \\<in> set is \\<Longrightarrow> P x\"\n  shows \"P x\"\nproof(cases \"x \\<in> heapVars is\")\ncase True\n  then obtain y i where \"i < length is\" and \"is ! i = (x,y)\" unfolding heapVars_def \n    by (auto simp add: in_set_conv_nth)\n  thus ?thesis\n  proof (induction i arbitrary: x y rule:measure_induct_rule[where f = \"\\<lambda>x . length is - x\"])\n  case (less i x y)\n    have \"P y\"\n    proof(cases \"y \\<in> heapVars is\")\n    case True\n      then obtain y' j where \"j < length is\" and \"is ! j = (y,y')\" unfolding heapVars_def \n        by (auto simp add: in_set_conv_nth)\n      from `valid_ind is` `i < length is` `j < length is` `is ! i = _` `is ! j = _`\n      have \"i < j\" by (rule valid_ind_smaller_index)\n      hence \"length is - j < length is - i\" by (metis diff_less_mono2 less.prems(1))\n      from less.IH[OF this `j < length is` `is ! j = (y,y')`]\n      show ?thesis.\n    next\n    case False\n      thus ?thesis by (rule NoInd[OF assms(1)])\n    qed\n    moreover\n    from less have \"(x,y) \\<in> set is\" by (metis nth_mem)\n    ultimately\n    show ?case by (rule Ind[OF assms(1)])\n  qed\nnext\ncase False\n  thus ?thesis by (rule NoInd[OF assms(1)])\nqed\n\n\nlemma valid_ind_different: \"valid_ind is \\<Longrightarrow> (x,y) \\<in> set is \\<Longrightarrow> x \\<noteq> y\"\n  by (induct  \"is\" rule: valid_ind.induct) (auto simp add: fresh_Pair)\n\nlemma valid_ind_in_is: \"valid_ind is \\<Longrightarrow> x \\<in> heapVars is \\<Longrightarrow> x \\<ominus> is \\<in> snd `set is\"\n  apply (induct x rule: valid_ind_induct)\n  apply auto\n  apply (case_tac \"y \\<in> heapVars is\")\n  apply (auto simp add: resolve_var_same_image intro: imageI)\n  by (metis image_iff snd_conv)\n\nlemma resolve_var_fresh_self: \"valid_ind is \\<Longrightarrow> atom (y \\<ominus> is) \\<sharp> is \\<Longrightarrow> y \\<notin> heapVars is\"\n  apply (auto dest!: valid_ind_in_is)\n  by (metis fresh_Pair fresh_list_elem not_self_fresh)\n\nlemma resolve_var_modifies: \"valid_ind is \\<Longrightarrow> x \\<in> heapVars is \\<Longrightarrow> x \\<noteq> x \\<ominus> is\" \n  by (induction \"is\" rule: valid_ind.induct)\n     (auto simp add: fresh_Pair dest: resolve_var_fresh_self)\n\nlemma resolve_resolved: \"valid_ind is \\<Longrightarrow> x \\<ominus> is \\<notin> heapVars is\"\n  by (induct x rule:valid_ind_induct) (simp_all add: resolve_var_same_image)\n\nlemma valid_ind_idemp[simp]: \"valid_ind is \\<Longrightarrow> (y::var) \\<ominus> is \\<ominus> is = y \\<ominus> is\"\n   by (intro resove_var_noop resolve_resolved)\n\n\nend\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/Indirections.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.3045228482375958}}
{"text": "theory Term5\nimports \"../Nominal2_Atoms\" \"../Nominal2_Eqvt\" \"../Nominal2_Supp\" \"../Abs\" \"../Perm\" \"../Fv\" \"../Rsp\"\nbegin\n\natom_decl name\n\ndatatype rtrm5 =\n  rVr5 \"name\"\n| rAp5 \"rtrm5\" \"rtrm5\"\n| rLt5 \"rlts\" \"rtrm5\" --\"bind (bv5 lts) in (rtrm5)\"\nand rlts =\n  rLnil\n| rLcons \"name\" \"rtrm5\" \"rlts\"\n\nprimrec\n  rbv5\nwhere\n  \"rbv5 rLnil = {}\"\n| \"rbv5 (rLcons n t ltl) = {atom n} \\<union> (rbv5 ltl)\"\n\n\nsetup {* snd o define_raw_perms (Datatype.the_info @{theory} \"Term5.rtrm5\") 2 *}\nprint_theorems\n\nlocal_setup {* snd o define_fv_alpha (Datatype.the_info @{theory} \"Term5.rtrm5\")\n  [[[], [], [(SOME (@{term rbv5}, false), 0, 1)]], [[], []]] [(@{term rbv5}, 1, [[], [(0,NONE), (2,SOME @{term rbv5})]])] *}\nprint_theorems\n\nnotation\n  alpha_rtrm5 (\"_ \\<approx>5 _\" [100, 100] 100) and\n  alpha_rlts (\"_ \\<approx>l _\" [100, 100] 100)\nthm alpha_rtrm5_alpha_rlts_alpha_rbv5.intros\n\nlocal_setup {* (fn ctxt => snd (Local_Theory.note ((@{binding alpha5_inj}, []), (build_rel_inj @{thms alpha_rtrm5_alpha_rlts_alpha_rbv5.intros} @{thms rtrm5.distinct rtrm5.inject rlts.distinct rlts.inject} @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} ctxt)) ctxt)) *}\nthm alpha5_inj\n\nlemma rbv5_eqvt[eqvt]:\n  \"pi \\<bullet> (rbv5 x) = rbv5 (pi \\<bullet> x)\"\n  apply (induct x)\n  apply (simp_all add: eqvts atom_eqvt)\n  done\n\nlemma fv_rtrm5_rlts_eqvt[eqvt]:\n  \"pi \\<bullet> (fv_rtrm5 x) = fv_rtrm5 (pi \\<bullet> x)\"\n  \"pi \\<bullet> (fv_rlts l) = fv_rlts (pi \\<bullet> l)\"\n  \"pi \\<bullet> (fv_rbv5 l) = fv_rbv5 (pi \\<bullet> l)\"\n  apply (induct x and l)\n  apply (simp_all add: eqvts atom_eqvt)\n  done\n\nlocal_setup {*\n(fn ctxt => snd (Local_Theory.note ((@{binding alpha5_eqvt}, []),\nbuild_alpha_eqvts [@{term alpha_rtrm5}, @{term alpha_rlts}, @{term alpha_rbv5}] (fn _ => alpha_eqvt_tac  @{thm alpha_rtrm5_alpha_rlts_alpha_rbv5.induct} @{thms alpha5_inj permute_rtrm5_permute_rlts.simps} ctxt 1) ctxt) ctxt)) *}\nprint_theorems\n\nlemma alpha5_reflp:\n\"y \\<approx>5 y \\<and> (x \\<approx>l x \\<and> alpha_rbv5 x x)\"\napply (rule rtrm5_rlts.induct)\napply (simp_all add: alpha5_inj)\napply (rule_tac x=\"0::perm\" in exI)\napply (simp add: eqvts alpha_gen fresh_star_def fresh_zero_perm)\ndone\n\nlemma alpha5_symp:\n\"(a \\<approx>5 b \\<longrightarrow> b \\<approx>5 a) \\<and>\n(x \\<approx>l y \\<longrightarrow> y \\<approx>l x) \\<and>\n(alpha_rbv5 x y \\<longrightarrow> alpha_rbv5 y x)\"\napply (rule alpha_rtrm5_alpha_rlts_alpha_rbv5.induct)\napply (simp_all add: alpha5_inj)\napply (erule conjE)+\napply (erule exE)\napply (rule_tac x=\"-pi\" in exI)\napply (rule alpha_gen_sym)\napply (simp add: alphas)\napply (simp add: alpha5_eqvt)\napply (simp add: alphas)\napply clarify\napply simp\ndone\n\nlemma alpha5_transp:\n\"(a \\<approx>5 b \\<longrightarrow> (\\<forall>c. b \\<approx>5 c \\<longrightarrow> a \\<approx>5 c)) \\<and>\n(x \\<approx>l y \\<longrightarrow> (\\<forall>z. y \\<approx>l z \\<longrightarrow> x \\<approx>l z)) \\<and>\n(alpha_rbv5 k l \\<longrightarrow> (\\<forall>m. alpha_rbv5 l m \\<longrightarrow> alpha_rbv5 k m))\"\napply (rule alpha_rtrm5_alpha_rlts_alpha_rbv5.induct)\napply (rule_tac [!] allI)\napply (simp_all add: alpha5_inj)\napply (tactic {* (imp_elim_tac @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} @{context}) 1 *})\napply (simp_all add: alpha5_inj)\ndefer\napply (tactic {* (imp_elim_tac @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} @{context}) 1 *})\napply (simp_all add: alpha5_inj)\napply (tactic {* (imp_elim_tac @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} @{context}) 1 *})\napply (simp_all add: alpha5_inj)\napply (tactic {* (imp_elim_tac @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases} @{context}) 1 *})\napply (simp_all add: alpha5_inj)\napply (erule conjE)+\napply (erule exE)+\napply (rule_tac x=\"pi + pia\" in exI)\napply (rule alpha_gen_trans)\nprefer 6\napply assumption\napply (simp_all add: alphas alpha5_eqvt)\napply (clarify)\napply simp\ndone\n\nlemma alpha5_equivp:\n  \"equivp alpha_rtrm5\"\n  \"equivp alpha_rlts\"\n  unfolding equivp_reflp_symp_transp reflp_def symp_def transp_def\n  apply (simp_all only: alpha5_reflp)\n  apply (meson alpha5_symp alpha5_transp)\n  apply (meson alpha5_symp alpha5_transp)\n  done\n\nquotient_type\n  trm5 = rtrm5 / alpha_rtrm5\nand\n  lts = rlts / alpha_rlts\n  by (auto intro: alpha5_equivp)\n\nlocal_setup {*\n(fn ctxt => ctxt\n |> snd o (Quotient_Def.quotient_lift_const (\"Vr5\", @{term rVr5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"Ap5\", @{term rAp5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"Lt5\", @{term rLt5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"Lnil\", @{term rLnil}))\n |> snd o (Quotient_Def.quotient_lift_const (\"Lcons\", @{term rLcons}))\n |> snd o (Quotient_Def.quotient_lift_const (\"fv_trm5\", @{term fv_rtrm5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"fv_lts\", @{term fv_rlts}))\n |> snd o (Quotient_Def.quotient_lift_const (\"fv_bv5\", @{term fv_rbv5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"bv5\", @{term rbv5}))\n |> snd o (Quotient_Def.quotient_lift_const (\"alpha_bv5\", @{term alpha_rbv5})))\n*}\nprint_theorems\n\nlemma alpha5_rfv:\n  \"(t \\<approx>5 s \\<Longrightarrow> fv_rtrm5 t = fv_rtrm5 s)\"\n  \"(l \\<approx>l m \\<Longrightarrow> (fv_rlts l = fv_rlts m \\<and> fv_rbv5 l = fv_rbv5 m))\"\n  \"(alpha_rbv5 b c \\<Longrightarrow> fv_rbv5 b = fv_rbv5 c)\"\n  apply(induct rule: alpha_rtrm5_alpha_rlts_alpha_rbv5.inducts)\n  apply(simp_all)\n  apply(simp add: alpha_gen)\n  done\n\nlemma bv_list_rsp:\n  shows \"x \\<approx>l y \\<Longrightarrow> rbv5 x = rbv5 y\"\n  apply(induct rule: alpha_rtrm5_alpha_rlts_alpha_rbv5.inducts(2))\n  apply(simp_all)\n  apply(clarify)\n  apply simp\n  done\n\nlocal_setup {* snd o Local_Theory.note ((@{binding alpha_dis}, []), (flat (map (distinct_rel @{context} @{thms alpha_rtrm5.cases alpha_rlts.cases alpha_rbv5.cases}) [(@{thms rtrm5.distinct}, @{term alpha_rtrm5}), (@{thms rlts.distinct}, @{term alpha_rlts}), (@{thms rlts.distinct}, @{term alpha_rbv5})]))) *}\nprint_theorems\n\nlocal_setup {* snd o Local_Theory.note ((@{binding alpha_bn_rsp}, []), prove_alpha_bn_rsp [@{term alpha_rtrm5}, @{term alpha_rlts}] @{thms alpha_rtrm5_alpha_rlts_alpha_rbv5.inducts} @{thms alpha5_inj alpha_dis} @{thms alpha5_equivp} @{context} (@{term alpha_rbv5}, 1)) *}\nthm alpha_bn_rsp\n\n\nlemma [quot_respect]:\n  \"(alpha_rlts ===> op =) fv_rlts fv_rlts\"\n  \"(alpha_rlts ===> op =) fv_rbv5 fv_rbv5\"\n  \"(alpha_rtrm5 ===> op =) fv_rtrm5 fv_rtrm5\"\n  \"(alpha_rlts ===> op =) rbv5 rbv5\"\n  \"(op = ===> alpha_rtrm5) rVr5 rVr5\"\n  \"(alpha_rtrm5 ===> alpha_rtrm5 ===> alpha_rtrm5) rAp5 rAp5\"\n  \"(alpha_rlts ===> alpha_rtrm5 ===> alpha_rtrm5) rLt5 rLt5\"\n  \"(op = ===> alpha_rtrm5 ===> alpha_rlts ===> alpha_rlts) rLcons rLcons\"\n  \"(op = ===> alpha_rtrm5 ===> alpha_rtrm5) permute permute\"\n  \"(op = ===> alpha_rlts ===> alpha_rlts) permute permute\"\n  \"(alpha_rlts ===> alpha_rlts ===> op =) alpha_rbv5 alpha_rbv5\"\n  apply (simp_all add: alpha5_inj alpha5_rfv alpha5_eqvt bv_list_rsp alpha5_reflp alpha_bn_rsp)\n  apply (clarify)\n  apply (rule_tac x=\"0\" in exI) apply (simp add: fresh_star_def fresh_zero_perm alpha_gen alpha5_rfv)\ndone\n\nlemma\n  shows \"(alpha_rlts ===> op =) rbv5 rbv5\"\n  by (simp add: bv_list_rsp)\n\nlemmas trm5_lts_inducts = rtrm5_rlts.inducts[quot_lifted]\n\ninstantiation trm5 and lts :: pt\nbegin\n\nquotient_definition\n  \"permute_trm5 :: perm \\<Rightarrow> trm5 \\<Rightarrow> trm5\"\nis\n  \"permute :: perm \\<Rightarrow> rtrm5 \\<Rightarrow> rtrm5\"\n\nquotient_definition\n  \"permute_lts :: perm \\<Rightarrow> lts \\<Rightarrow> lts\"\nis\n  \"permute :: perm \\<Rightarrow> rlts \\<Rightarrow> rlts\"\n\ninstance by default\n  (simp_all add: permute_rtrm5_permute_rlts_zero[quot_lifted] permute_rtrm5_permute_rlts_append[quot_lifted])\n\nend\n\nlemmas permute_trm5_lts = permute_rtrm5_permute_rlts.simps[quot_lifted]\nlemmas bv5[simp] = rbv5.simps[quot_lifted]\nlemmas fv_trm5_bv5[simp] = fv_rtrm5_fv_rbv5.simps[quot_lifted]\nlemmas fv_lts[simp] = fv_rlts.simps[quot_lifted]\nlemmas alpha5_INJ = alpha5_inj[unfolded alpha_gen, quot_lifted, folded alpha_gen]\n\nend\n", "meta": {"author": "goodlyrottenapple", "repo": "Nominal2-Isabelle", "sha": "214274ed6db74c19b8694fc5c8dd9cafa13b056a", "save_path": "github-repos/isabelle/goodlyrottenapple-Nominal2-Isabelle", "path": "github-repos/isabelle/goodlyrottenapple-Nominal2-Isabelle/Nominal2-Isabelle-214274ed6db74c19b8694fc5c8dd9cafa13b056a/Nominal/Manual/Term5n.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.30452284823759573}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory CustomWordAbs\nimports \"AutoCorres.AutoCorres\"\nbegin\n\nexternal_file \"custom_word_abs.c\"\ninstall_C_file \"custom_word_abs.c\"\n\nlemma [word_abs]:\n  \"\\<lbrakk> abstract_val P x sint x'; abstract_val Q y sint y' \\<rbrakk> \\<Longrightarrow>\n        abstract_val (P \\<and> Q) (max x y)\n          sint (x' xor (x' xor y') && - (if x' <s y' then (1 :: sword32) else 0))\"\n  apply (clarsimp simp: max_def word_sless_def word_sle_def)\n  done\n\nlemma [word_abs]:\n  \"\\<lbrakk> abstract_val P x unat x'; abstract_val Q y unat y' \\<rbrakk> \\<Longrightarrow>\n         abstract_val (P \\<and> Q \\<and> y < 32) (x mod (2 ^ y)) unat (x' && 2 ^ unat y' - (1 :: word32))\"\n  apply (clarsimp simp del: shiftl_1 simp: shiftl_1 [symmetric])\n  apply (fold mask_def)\n  apply (subst word_mod_2p_is_mask [symmetric])\n  apply (subst p2_gt_0)\n  by (auto simp: unat_mod)\n\nlemma [word_abs]:\n  \"\\<lbrakk> abstract_val P x unat (x' :: word32);\n     abstract_val Q y unat y' \\<rbrakk> \\<Longrightarrow>\n      abstract_val (P \\<and> Q) (x + y > UINT_MAX) id (x' + y' < x')\"\n  apply (subst not_le [symmetric], subst no_plus_overflow_unat_size)\n  apply (clarsimp simp: not_less UINT_MAX_def word_size)\n  apply arith\n  done\n\nautocorres [unsigned_word_abs = b c] \"custom_word_abs.c\"\n\ncontext custom_word_abs begin\n\nlemma \"a' x y = max x y\"\n  by (unfold a'_def, rule refl)\n\nlemma \"b' x 4 s = Some (x mod 16)\"\n  by (unfold b'_def, simp)\n\nlemma \"c' x y = (if UINT_MAX < x + y then 1 else 0)\"\n  by (unfold c'_def, simp)\n\nend\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/autocorres/tests/proof-tests/CustomWordAbs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.30451456306014574}}
{"text": "(*  Title:      HOL/MicroJava/BV/LBVJVM.thy\n    Author:     Tobias Nipkow, Gerwin Klein\n    Copyright   2000 TUM\n*)\n\nsection {* LBV for the JVM \\label{sec:JVM} *}\n\ntheory LBVJVM\nimports Typing_Framework_JVM\nbegin\n\ntype_synonym prog_cert = \"cname \\<Rightarrow> sig \\<Rightarrow> JVMType.state list\"\n\ndefinition check_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> JVMType.state list \\<Rightarrow> bool\" where\n  \"check_cert G mxs mxr n cert \\<equiv> check_types G mxs mxr cert \\<and> length cert = n+1 \\<and>\n                                 (\\<forall>i<n. cert!i \\<noteq> Err) \\<and> cert!n = OK None\"\n\ndefinition lbvjvm :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> exception_table \\<Rightarrow> \n             JVMType.state list \\<Rightarrow> instr list \\<Rightarrow> JVMType.state \\<Rightarrow> JVMType.state\" where\n  \"lbvjvm G maxs maxr rT et cert bs \\<equiv>\n  wtl_inst_list bs cert  (JVMType.sup G maxs maxr) (JVMType.le G maxs maxr) Err (OK None) (exec G maxs rT et bs) 0\"\n\ndefinition wt_lbv :: \"jvm_prog \\<Rightarrow> cname \\<Rightarrow> ty list \\<Rightarrow> ty \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> \n             exception_table \\<Rightarrow> JVMType.state list \\<Rightarrow> instr list \\<Rightarrow> bool\" where\n  \"wt_lbv G C pTs rT mxs mxl et cert ins \\<equiv>\n   check_bounded ins et \\<and> \n   check_cert G mxs (1+size pTs+mxl) (length ins) cert \\<and>\n   0 < size ins \\<and> \n   (let start  = Some ([],(OK (Class C))#((map OK pTs))@(replicate mxl Err));\n        result = lbvjvm G mxs (1+size pTs+mxl) rT et cert ins (OK start)\n    in result \\<noteq> Err)\"\n\ndefinition wt_jvm_prog_lbv :: \"jvm_prog \\<Rightarrow> prog_cert \\<Rightarrow> bool\" where\n  \"wt_jvm_prog_lbv G cert \\<equiv>\n  wf_prog (\\<lambda>G C (sig,rT,(maxs,maxl,b,et)). wt_lbv G C (snd sig) rT maxs maxl et (cert C sig) b) G\"\n\ndefinition mk_cert :: \"jvm_prog \\<Rightarrow> nat \\<Rightarrow> ty \\<Rightarrow> exception_table \\<Rightarrow> instr list \n              \\<Rightarrow> method_type \\<Rightarrow> JVMType.state list\" where\n  \"mk_cert G maxs rT et bs phi \\<equiv> make_cert (exec G maxs rT et bs) (map OK phi) (OK None)\"\n\ndefinition prg_cert :: \"jvm_prog \\<Rightarrow> prog_type \\<Rightarrow> prog_cert\" where\n  \"prg_cert G phi C sig \\<equiv> let (C,rT,(maxs,maxl,ins,et)) = the (method (G,C) sig) in \n                           mk_cert G maxs rT et ins (phi C sig)\"\n \n  \nlemma wt_method_def2:\n  fixes pTs and mxl and G and mxs and rT and et and bs and phi \n  defines [simp]: \"mxr   \\<equiv> 1 + length pTs + mxl\"\n  defines [simp]: \"r     \\<equiv> sup_state_opt G\"\n  defines [simp]: \"app0  \\<equiv> \\<lambda>pc. app (bs!pc) G mxs rT pc et\"\n  defines [simp]: \"step0 \\<equiv> \\<lambda>pc. eff (bs!pc) G pc et\"\n\n  shows\n  \"wt_method G C pTs rT mxs mxl bs et phi = \n  (bs \\<noteq> [] \\<and> \n   length phi = length bs \\<and>\n   check_bounded bs et \\<and> \n   check_types G mxs mxr (map OK phi) \\<and>   \n   wt_start G C pTs mxl phi \\<and> \n   wt_app_eff r app0 step0 phi)\"\n  by (auto simp add: wt_method_def wt_app_eff_def wt_instr_def lesub_def\n           dest: check_bounded_is_bounded boundedD)\n\n\nlemma check_certD:\n  \"check_cert G mxs mxr n cert \\<Longrightarrow> cert_ok cert n Err (OK None) (states G mxs mxr)\"\n  apply (unfold cert_ok_def check_cert_def check_types_def)\n  apply (auto simp add: list_all_iff)\n  done\n\n\nlemma wt_lbv_wt_step:\n  assumes wf:  \"wf_prog wf_mb G\"\n  assumes lbv: \"wt_lbv G C pTs rT mxs mxl et cert ins\"\n  assumes C:   \"is_class G C\" \n  assumes pTs: \"set pTs \\<subseteq> types G\"\n  \n  defines [simp]: \"mxr \\<equiv> 1+length pTs+mxl\"\n\n  shows \"\\<exists>ts \\<in> list (size ins) (states G mxs mxr). \n            wt_step (JVMType.le G mxs mxr) Err (exec G mxs rT et ins) ts\n          \\<and> OK (Some ([],(OK (Class C))#((map OK pTs))@(replicate mxl Err))) <=_(JVMType.le G mxs mxr) ts!0\"\nproof -\n  let ?step = \"exec G mxs rT et ins\"\n  let ?r    = \"JVMType.le G mxs mxr\"\n  let ?f    = \"JVMType.sup G mxs mxr\"\n  let ?A    = \"states G mxs mxr\"\n\n  have \"semilat (JVMType.sl G mxs mxr)\" \n    by (rule semilat_JVM_slI, rule wf_prog_ws_prog, rule wf)\n  hence \"semilat (?A, ?r, ?f)\" by (unfold sl_triple_conv)\n  moreover\n  have \"top ?r Err\"  by (simp add: JVM_le_unfold)\n  moreover\n  have \"Err \\<in> ?A\" by (simp add: JVM_states_unfold)\n  moreover\n  have \"bottom ?r (OK None)\" \n    by (simp add: JVM_le_unfold bottom_def)\n  moreover\n  have \"OK None \\<in> ?A\" by (simp add: JVM_states_unfold)\n  moreover\n  from lbv\n  have \"bounded ?step (length ins)\" \n    by (clarsimp simp add: wt_lbv_def exec_def) \n       (intro bounded_lift check_bounded_is_bounded) \n  moreover\n  from lbv\n  have \"cert_ok cert (length ins) Err (OK None) ?A\" \n    by (unfold wt_lbv_def) (auto dest: check_certD)\n  moreover\n  from wf have \"pres_type ?step (length ins) ?A\" by (rule exec_pres_type)\n  moreover\n  let ?start = \"OK (Some ([],(OK (Class C))#(map OK pTs)@(replicate mxl Err)))\"\n  from lbv\n  have \"wtl_inst_list ins cert ?f ?r Err (OK None) ?step 0 ?start \\<noteq> Err\"\n    by (simp add: wt_lbv_def lbvjvm_def)    \n  moreover\n  from C pTs have \"?start \\<in> ?A\"\n    by (unfold JVM_states_unfold) (auto intro: list_appendI, force)\n  moreover\n  from lbv have \"0 < length ins\" by (simp add: wt_lbv_def)\n  ultimately\n  show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])\nqed\n  \nlemma wt_lbv_wt_method:\n  assumes wf:  \"wf_prog wf_mb G\"\n  assumes lbv: \"wt_lbv G C pTs rT mxs mxl et cert ins\"\n  assumes C:   \"is_class G C\" \n  assumes pTs: \"set pTs \\<subseteq> types G\"\n  \n  shows \"\\<exists>phi. wt_method G C pTs rT mxs mxl ins et phi\"\nproof -\n  let ?mxr   = \"1 + length pTs + mxl\"\n  let ?step  = \"exec G mxs rT et ins\"\n  let ?r     = \"JVMType.le G mxs ?mxr\"\n  let ?f     = \"JVMType.sup G mxs ?mxr\"\n  let ?A     = \"states G mxs ?mxr\"\n  let ?start = \"OK (Some ([],(OK (Class C))#(map OK pTs)@(replicate mxl Err)))\"\n  \n  from lbv have l: \"ins \\<noteq> []\" by (simp add: wt_lbv_def)\n  moreover\n  from wf lbv C pTs\n  obtain phi where \n    list:  \"phi \\<in> list (length ins) ?A\" and\n    step:  \"wt_step ?r Err ?step phi\" and    \n    start: \"?start <=_?r phi!0\" \n    by (blast dest: wt_lbv_wt_step)\n  from list have [simp]: \"length phi = length ins\" by simp\n  have \"length (map ok_val phi) = length ins\" by simp  \n  moreover\n  from l have 0: \"0 < length phi\" by simp\n  with step obtain phi0 where \"phi!0 = OK phi0\"\n    by (unfold wt_step_def) blast\n  with start 0\n  have \"wt_start G C pTs mxl (map ok_val phi)\"\n    by (simp add: wt_start_def JVM_le_Err_conv lesub_def)\n  moreover\n  from lbv  have chk_bounded: \"check_bounded ins et\"\n    by (simp add: wt_lbv_def)\n  moreover {\n    from list\n    have \"check_types G mxs ?mxr phi\"\n      by (simp add: check_types_def)\n    also from step\n    have [symmetric]: \"map OK (map ok_val phi) = phi\" \n      by (auto intro!: nth_equalityI simp add: wt_step_def)\n    finally have \"check_types G mxs ?mxr (map OK (map ok_val phi))\" .\n  }\n  moreover {  \n    let ?app = \"\\<lambda>pc. app (ins!pc) G mxs rT pc et\"\n    let ?eff = \"\\<lambda>pc. eff (ins!pc) G pc et\"\n\n    from chk_bounded\n    have \"bounded (err_step (length ins) ?app ?eff) (length ins)\"\n      by (blast dest: check_bounded_is_bounded boundedD intro: bounded_err_stepI)\n    moreover\n    from step\n    have \"wt_err_step (sup_state_opt G) ?step phi\"\n      by (simp add: wt_err_step_def JVM_le_Err_conv)\n    ultimately\n    have \"wt_app_eff (sup_state_opt G) ?app ?eff (map ok_val phi)\"\n      by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def)\n  }    \n  ultimately\n  have \"wt_method G C pTs rT mxs mxl ins et (map ok_val phi)\"\n    by - (rule wt_method_def2 [THEN iffD2], simp)\n  thus ?thesis ..\nqed\n\n\nlemma wt_method_wt_lbv:\n  assumes wf:  \"wf_prog wf_mb G\"\n  assumes wt:  \"wt_method G C pTs rT mxs mxl ins et phi\"\n  assumes C:   \"is_class G C\" \n  assumes pTs: \"set pTs \\<subseteq> types G\"\n  \n  defines [simp]: \"cert \\<equiv> mk_cert G mxs rT et ins phi\"\n\n  shows \"wt_lbv G C pTs rT mxs mxl et cert ins\"\nproof -\n  let ?mxr  = \"1 + length pTs + mxl\"\n  let ?step = \"exec G mxs rT et ins\"\n  let ?app  = \"\\<lambda>pc. app (ins!pc) G mxs rT pc et\"\n  let ?eff  = \"\\<lambda>pc. eff (ins!pc) G pc et\"\n  let ?r    = \"JVMType.le G mxs ?mxr\"\n  let ?f    = \"JVMType.sup G mxs ?mxr\"\n  let ?A    = \"states G mxs ?mxr\"\n  let ?phi  = \"map OK phi\"\n  let ?cert = \"make_cert ?step ?phi (OK None)\"\n\n  from wt have\n    0:          \"0 < length ins\" and\n    length:     \"length ins = length ?phi\" and\n    ck_bounded: \"check_bounded ins et\" and\n    ck_types:   \"check_types G mxs ?mxr ?phi\" and\n    wt_start:   \"wt_start G C pTs mxl phi\" and\n    app_eff:    \"wt_app_eff (sup_state_opt G) ?app ?eff phi\"\n    by (simp_all add: wt_method_def2)\n  \n  have \"semilat (JVMType.sl G mxs ?mxr)\" \n    by (rule semilat_JVM_slI) (rule wf_prog_ws_prog [OF wf])\n  hence \"semilat (?A, ?r, ?f)\" by (unfold sl_triple_conv)\n  moreover\n  have \"top ?r Err\"  by (simp add: JVM_le_unfold)\n  moreover\n  have \"Err \\<in> ?A\" by (simp add: JVM_states_unfold)\n  moreover\n  have \"bottom ?r (OK None)\" \n    by (simp add: JVM_le_unfold bottom_def)\n  moreover\n  have \"OK None \\<in> ?A\" by (simp add: JVM_states_unfold)\n  moreover\n  from ck_bounded\n  have bounded: \"bounded ?step (length ins)\" \n    by (clarsimp simp add: exec_def) \n       (intro bounded_lift check_bounded_is_bounded)\n  with wf\n  have \"mono ?r ?step (length ins) ?A\"\n    by (rule wf_prog_ws_prog [THEN exec_mono])\n  hence \"mono ?r ?step (length ?phi) ?A\" by (simp add: length)\n  moreover\n  from wf have \"pres_type ?step (length ins) ?A\" by (rule exec_pres_type)\n  hence \"pres_type ?step (length ?phi) ?A\" by (simp add: length)\n  moreover\n  from ck_types\n  have \"set ?phi \\<subseteq> ?A\" by (simp add: check_types_def) \n  hence \"\\<forall>pc. pc < length ?phi \\<longrightarrow> ?phi!pc \\<in> ?A \\<and> ?phi!pc \\<noteq> Err\" by auto\n  moreover \n  from bounded \n  have \"bounded (exec G mxs rT et ins) (length ?phi)\" by (simp add: length)\n  moreover\n  have \"OK None \\<noteq> Err\" by simp\n  moreover\n  from bounded length app_eff\n  have \"wt_err_step (sup_state_opt G) ?step ?phi\"\n    by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def)\n  hence \"wt_step ?r Err ?step ?phi\"\n    by (simp add: wt_err_step_def JVM_le_Err_conv)\n  moreover \n  let ?start = \"OK (Some ([],(OK (Class C))#(map OK pTs)@(replicate mxl Err)))\"  \n  from 0 length have \"0 < length phi\" by auto\n  hence \"?phi!0 = OK (phi!0)\" by simp\n  with wt_start have \"?start <=_?r ?phi!0\"\n    by (clarsimp simp add: wt_start_def lesub_def JVM_le_Err_conv)\n  moreover\n  from C pTs have \"?start \\<in> ?A\"\n    by (unfold JVM_states_unfold) (auto intro: list_appendI, force)\n  moreover\n  have \"?start \\<noteq> Err\" by simp\n  moreover\n  note length \n  ultimately\n  have \"wtl_inst_list ins ?cert ?f ?r Err (OK None) ?step 0 ?start \\<noteq> Err\"\n    by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])\n  moreover\n  from 0 length have \"phi \\<noteq> []\" by auto\n  moreover\n  from ck_types\n  have \"check_types G mxs ?mxr ?cert\"\n    by (auto simp add: make_cert_def check_types_def JVM_states_unfold)\n  moreover\n  note ck_bounded 0 length\n  ultimately \n  show ?thesis \n    by (simp add: wt_lbv_def lbvjvm_def mk_cert_def \n      check_cert_def make_cert_def nth_append)\nqed  \n\n\n\ntheorem jvm_lbv_correct:\n  \"wt_jvm_prog_lbv G Cert \\<Longrightarrow> \\<exists>Phi. wt_jvm_prog G Phi\"\nproof -  \n  let ?Phi = \"\\<lambda>C sig. let (C,rT,(maxs,maxl,ins,et)) = the (method (G,C) sig) in \n              SOME phi. wt_method G C (snd sig) rT maxs maxl ins et phi\"\n    \n  assume \"wt_jvm_prog_lbv G Cert\"\n  hence \"wt_jvm_prog G ?Phi\"\n    apply (unfold wt_jvm_prog_def wt_jvm_prog_lbv_def)\n    apply (erule jvm_prog_lift)\n    apply (auto dest: wt_lbv_wt_method intro: someI)\n    done\n  thus ?thesis by blast\nqed\n\ntheorem jvm_lbv_complete:\n  \"wt_jvm_prog G Phi \\<Longrightarrow> wt_jvm_prog_lbv G (prg_cert G Phi)\"\n  apply (unfold wt_jvm_prog_def wt_jvm_prog_lbv_def)\n  apply (erule jvm_prog_lift)\n  apply (auto simp add: prg_cert_def intro: wt_method_wt_lbv)\n  done  \n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/MicroJava/BV/LBVJVM.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442250928250375, "lm_q2_score": 0.47268347662043286, "lm_q1q2_score": 0.3045145566026598}}
{"text": "theory Ex_CFG\nimports Monad\nbegin\n  term fold\n\n\n\n  datatype err = STATIC_ERROR\n\n\n\n\n\n\n\n\n  type_synonym state = \"string \\<Rightarrow> int\"\n  type_synonym label = string\n  type_synonym proc_name = string\n  type_synonym val = \"int\"\n\n  datatype nt_instr = I_BASIC \"state \\<Rightarrow> state\" | I_CALL proc_name\n\n  datatype t_instr = TI_RETURN | TI_BR label | TI_CBR \"state\\<Rightarrow>bool\" label label\n\n  datatype bblock = BBLOCK (nt_instrs: \"nt_instr list\") (t_instr: \"t_instr\")\n\n\n  type_synonym proc_body = \"label \\<rightharpoonup> bblock\"\n  type_synonym prog = \"proc_name \\<rightharpoonup> proc_body\"\n\n\n  context\n    fixes \\<pi> :: prog\n  begin\n\n    context\n      fixes execute :: \"proc_body \\<times> label \\<Rightarrow> (unit,unit,state,err) M\"\n    begin\n\n      definition \"exec_nt_instr ins \\<equiv> case ins of\n        I_BASIC f \\<Rightarrow> doM { s\\<leftarrow>get; set (f s)}\n      | I_CALL p \\<Rightarrow> doM {\n          \\<beta> \\<leftarrow> lookup STATIC_ERROR \\<pi> p;\n          handle (doM {execute (\\<beta>,''__start''); fail STATIC_ERROR}) (\\<lambda>_. return ());\n          return ()\n        }\"\n\n      fun exec_t_instr where\n        \"exec_t_instr (TI_RETURN) = doM {\n          raise ()\n        }\"\n      | \"exec_t_instr (TI_BR l) = return l\"\n      | \"exec_t_instr (TI_CBR c l1 l2) = doM {\n          s\\<leftarrow>get;\n          if c s then return l1 else return l2\n      }\"\n\n      definition \"execute_body \\<equiv> \\<lambda>(\\<beta>,l). doM {\n        bb \\<leftarrow> lookup STATIC_ERROR \\<beta> l;\n        mfold' exec_nt_instr (nt_instrs bb);\n        l \\<leftarrow> exec_t_instr (t_instr bb);\n        execute (\\<beta>,l)\n      }\"\n    end\n\n    definition \"execute \\<equiv> REC execute_body\"\n\n    lemma mono_mfold[partial_function_mono]:\n      \"\\<lbrakk>\\<And>x s. M.mono_body (\\<lambda>f. F f x s)\\<rbrakk> \\<Longrightarrow> M.mono_body (\\<lambda>f. mfold (F f) xs s)\"\n      apply (induction xs arbitrary: s)\n      apply simp_all\n      apply pf_mono_prover\n      apply pf_mono_prover\n      apply simp_all\n      done\n\n    lemma mono_exec_ntinstr[partial_function_mono]: \"M.mono_body (\\<lambda>f. local.exec_nt_instr f ins)\"\n      by (cases ins; simp add: exec_nt_instr_def; pf_mono_prover)\n\n    lemma mono_execute_body[partial_function_mono]: \"\\<And>x. M.mono_body (\\<lambda>fa. local.execute_body fa x)\"\n      unfolding execute_body_def\n      by pf_mono_prover\n\n  end\n\n  lemmas\n        execute_unfold[code] = REC_unfold[OF execute_def, discharge_monos]\n    and execute_partial = lrmwpe_REC_partial[OF execute_def, discharge_monos, consumes 1, case_names nonterm step]\n    and execute_total = lrmwpe_REC_total[OF execute_def, discharge_monos, consumes 1, case_names wf step]\n    and execute_sim[sim_rules] = sim_REC[OF execute_def execute_def, discharge_monos]\n\n  term execute\n\n  thm sim_rules\n\n  lemma execute_sm_sim[sim_rules]:\n    assumes \"\\<pi> \\<subseteq>\\<^sub>m \\<pi>'\"\n    shows \"sim (execute \\<pi> \\<beta>l) (execute \\<pi>' \\<beta>l)\"\n    using assms\n    by (auto intro!: sim_rules split!: nt_instr.split simp: execute_body_def exec_nt_instr_def)\n\n\n  fun wf_nt_instr where\n    \"wf_nt_instr \\<pi> (I_BASIC f) \\<longleftrightarrow> True\"\n  | \"wf_nt_instr \\<pi> (I_CALL p) \\<longleftrightarrow> p\\<in>dom \\<pi>\"\n\n  fun wf_t_instr where\n    \"wf_t_instr \\<pi> \\<beta> (TI_RETURN) \\<longleftrightarrow> True\"\n  | \"wf_t_instr \\<pi> \\<beta> (TI_BR l) \\<longleftrightarrow> l\\<in>dom \\<beta>\"\n  | \"wf_t_instr \\<pi> \\<beta> (TI_CBR c l1 l2) \\<longleftrightarrow> l1\\<in>dom \\<beta> \\<and> l2\\<in>dom \\<beta>\"\n\n  fun wf_basic_block where\n    \"wf_basic_block \\<pi> \\<beta> (BBLOCK ntis ti) \\<longleftrightarrow> (\\<forall>nti\\<in>List.set ntis. wf_nt_instr \\<pi> nti) \\<and> wf_t_instr \\<pi> \\<beta> ti\"\n\n  definition \"wf_proc_body \\<pi> b \\<equiv> ''__start''\\<in>dom b \\<and> (\\<forall>bb\\<in>ran b. wf_basic_block \\<pi> b bb)\"\n\n  definition \"wf_prog \\<pi> \\<equiv> \\<forall>b\\<in>ran \\<pi>. wf_proc_body \\<pi> b\"\n\n  definition \"wf_pos \\<pi> \\<equiv> \\<lambda>(\\<beta>,l). \\<beta> \\<in> ran \\<pi> \\<and> l\\<in>dom \\<beta>\"\n\n\n\n\n  lemma\n    assumes \"run (execute \\<pi> \\<beta>l) s = r\"\n    assumes \"wf_pos \\<pi> \\<beta>l\"\n    assumes \"wf_prog \\<pi>\"\n    shows \"mwp r True bot top bot\"\n    using assms(1,2)\n  proof (induction rule: execute_partial)\n    case (nonterm x s)\n    then show ?case by simp\n  next\n    case (step f x s r)\n\n    note step.IH[OF refl, THEN mwp_cons, intro!]\n\n    obtain \\<beta> l where [simp]: \"x = (\\<beta>,l)\" by (cases x)\n    with \\<open>wf_pos \\<pi> x\\<close> obtain ntis ti where [simp]: \"\\<beta> l = Some (BBLOCK ntis ti)\" and \"\\<beta>\\<in>ran \\<pi>\"\n      apply (auto simp: wf_pos_def)\n      using bblock.exhaust by blast\n\n    have [THEN mwp_cons, intro!]:\n      \"mwp (run (exec_nt_instr \\<pi> f i) s) top bot bot top\" if \"wf_nt_instr \\<pi> i\" for i s\n      using that\n      apply (auto simp: run_simps exec_nt_instr_def split: nt_instr.splits option.split)\n      by (metis (mono_tags, lifting) assms(3) old.prod.case ranI wf_pos_def wf_proc_body_def wf_prog_def)\n\n\n    from \\<open>wf_prog \\<pi>\\<close> \\<open>\\<beta>\\<in>ran \\<pi>\\<close> have \"wf_basic_block \\<pi> \\<beta> (BBLOCK ntis ti)\"\n      unfolding wf_prog_def wf_proc_body_def apply (auto)\n      apply (meson \\<open>\\<beta> l = Some (BBLOCK ntis ti)\\<close> ranI wf_basic_block.simps)\n      apply (meson \\<open>\\<beta> l = Some (BBLOCK ntis ti)\\<close> ranI wf_basic_block.simps)\n      done\n    hence WF_NTI: \"(\\<forall>nti\\<in>List.set ntis. wf_nt_instr \\<pi> nti)\"\n      and WF_TI: \"wf_t_instr \\<pi> \\<beta> ti\" by simp_all\n\n    from WF_NTI have [THEN mwp_cons, intro!]:\n      \"mwp (run (mfold' (exec_nt_instr \\<pi> f) ntis) s) top bot bot top\"\n      apply (induction ntis arbitrary: s)\n      by (auto simp: run_simps)\n\n    from WF_TI have [THEN mwp_cons, intro!]: \"mwp (run (exec_t_instr ti) s) top bot top (\\<lambda>l _. l\\<in>dom \\<beta>)\" for s\n      apply (cases ti)\n      apply (auto simp: run_simps)\n      done\n\n    from step.hyps step.prems show ?case\n      by (auto simp: execute_body_def run_simps wf_pos_def split: prod.splits option.splits)\n\n  qed\n\n\nend\n\n\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/others/simple/Ex_CFG.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947290421275, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.30446158861583456}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2005         |\n            |                  April 2006               |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_law_aux\nimports CSP_F_law\nbegin\n\n(*---------------------------------------------------------------*\n |                                                               |\n |           convenient laws, especially for tactics             |\n |                                                               |\n *---------------------------------------------------------------*)\n\n(*****************************************************************\n                            Internal                 \n *****************************************************************)\n\n(*------------------*\n |     singleton    |\n *------------------*)\n\n(*** ! :{a} ***)\n\nlemma cspF_Rep_int_choice_sum1_singleton:\n  \"!! : type1 {c} .. Pf =F[M,M] Pf (type1 c)\"\nby (rule cspF_Rep_int_choice_const, auto)\n\nlemma cspF_Rep_int_choice_sum2_singleton:\n  \"!! : type2 {c} .. Pf =F[M,M] Pf (type2 c)\"\nby (rule cspF_Rep_int_choice_const, auto)\n\nlemma cspF_Rep_int_choice_nat_singleton:\n  \"!nat :{n} .. Pf =F[M,M] Pf n\"\nby (rule cspF_Rep_int_choice_const, auto)\n\nlemma cspF_Rep_int_choice_set_singleton:\n  \"!set :{X} .. Pf =F[M,M] Pf X\"\nby (rule cspF_Rep_int_choice_const, auto)\n\nlemma cspF_Rep_int_choice_com_singleton:\n  \"! :{a} .. Pf =F[M,M] Pf a\"\nby (rule cspF_Rep_int_choice_const, auto)\n\nlemma cspF_Rep_int_choice_f_singleton:\n  \"inj f ==> !<f> :{x} .. Pf =F[M,M] Pf x\"\nby (rule cspF_Rep_int_choice_const, auto)\n\nlemmas cspF_Rep_int_choice_singleton =\n       cspF_Rep_int_choice_sum1_singleton\n       cspF_Rep_int_choice_sum2_singleton\n       cspF_Rep_int_choice_nat_singleton\n       cspF_Rep_int_choice_set_singleton\n       cspF_Rep_int_choice_com_singleton\n       cspF_Rep_int_choice_f_singleton\n\nlemma cspF_Rep_int_choice_const_sum_rule:\n  \"!! c:C .. P =F[M,M] IF (sumset C={}) THEN DIV ELSE P\"\napply (case_tac \"sumset C={}\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_Rep_int_choice_empty)\napply (simp)\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_IF)\napply (rule cspF_Rep_int_choice_const)\napply (simp_all)\ndone\n\nlemma cspF_Rep_int_choice_const_nat_rule:\n  \"!nat n:N .. P =F[M,M] IF (N={}) THEN DIV ELSE P\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspF_rw_left)\napply (rule cspF_Rep_int_choice_const_sum_rule)\nby (simp)\n\nlemma cspF_Rep_int_choice_const_set_rule:\n  \"!set X:Xs .. P =F[M,M] IF (Xs={}) THEN DIV ELSE P\"\napply (simp add: Rep_int_choice_ss_def)\napply (rule cspF_rw_left)\napply (rule cspF_Rep_int_choice_const_sum_rule)\nby (simp)\n\nlemma cspF_Rep_int_choice_const_com_rule:\n  \"! x:X .. P =F[M,M] IF (X={}) THEN DIV ELSE P\"\napply (simp add: Rep_int_choice_com_def)\napply (rule cspF_rw_left)\napply (rule cspF_Rep_int_choice_const_set_rule)\nby (simp)\n\nlemma cspF_Rep_int_choice_const_f_rule:\n  \"!<f> x:X .. P =F[M,M] IF (X={}) THEN DIV ELSE P\"\napply (simp add: Rep_int_choice_f_def)\napply (rule cspF_rw_left)\napply (rule cspF_Rep_int_choice_const_com_rule)\nby (simp)\n\nlemmas cspF_Rep_int_choice_const_rule =\n       cspF_Rep_int_choice_const_sum_rule\n       cspF_Rep_int_choice_const_nat_rule\n       cspF_Rep_int_choice_const_set_rule\n       cspF_Rep_int_choice_const_com_rule\n       cspF_Rep_int_choice_const_f_rule\n\nlemmas cspF_Int_choice_rule = cspF_Rep_int_choice_empty\n                              cspF_Rep_int_choice_singleton \n                              cspF_Int_choice_idem\n                              cspF_Rep_int_choice_const_rule\n\n(*****************************************************************\n                          External\n *****************************************************************)\n\n(* to make produced process be concrete *)\n\nlemma cspF_Ext_pre_choice_empty_DIV:\n   \"? :{} -> Pf =F[M1,M2] ? a:{} -> DIV\"\napply (rule cspF_rw_left)\napply (rule cspF_STOP_step[THEN cspF_sym])\napply (rule cspF_STOP_step)\ndone\n\nlemma cspF_Ext_choice_unit_l_hsf: \n  \"? :{} -> Qf [+] P =F[M,M] P\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_step[THEN cspF_sym])\napply (rule cspF_reflex)\napply (simp add: cspF_unit)\ndone\n\nlemma cspF_Ext_choice_unit_r_hsf: \n  \"P [+] ? :{} -> Qf =F[M,M] P\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (simp add: cspF_Ext_choice_unit_l_hsf)\ndone\n\nlemmas cspF_Ext_choice_rule = cspF_Ext_pre_choice_empty_DIV\n                              cspF_Ext_choice_unit_l\n                              cspF_Ext_choice_unit_l_hsf\n                              cspF_Ext_choice_unit_r\n                              cspF_Ext_choice_unit_r_hsf\n                              cspF_Ext_choice_idem\n\n(*-----------------------------*\n |      simp rule for cspF     |\n *-----------------------------*)\n\nlemmas cspF_choice_rule  = cspF_Int_choice_rule cspF_Ext_choice_rule\n\n(*****************************************************************\n                          Timeout\n *****************************************************************)\n\n(*------------------*\n |      csp law     |\n *------------------*)\n\n(*** <= Timeout ***)\n\nlemma cspF_Timeout_right:\n  \"[| P <=F[M1,M2] Q1 ; P <=F[M1,M2] Q2 |] ==> P <=F[M1,M2] Q1 [> Q2\"\napply (rule cspF_rw_right)\napply (rule cspF_dist)\napply (rule cspF_Int_choice_right)\napply (rule cspF_Ext_choice_right, simp_all)\napply (rule cspF_rw_right)\napply (rule cspF_Ext_choice_unit_l, simp_all)\ndone\n\n(*** STOP [> P  =  P ***)\n\nlemma cspF_STOP_Timeout:\n  \"STOP [> P =F[M,M] P\"\napply (rule cspF_rw_left)\napply (rule cspF_dist)\napply (rule cspF_rw_left)\napply (rule cspF_Int_choice_idem)\napply (rule cspF_unit)\ndone\n\n(*================================================*\n |                                                |\n |               auxiliary step laws              |\n |                                                |\n *================================================*)\n\n(* split + resolve *)\n\nlemma cspF_Parallel_Timeout_split_resolve_SKIP_or_DIV:\n  \"[| P = SKIP | P = DIV ; Q = SKIP | Q = DIV |] ==>\n    ((? :Y -> Pf) [+] P) |[X]| ((? :Z -> Qf) [+] Q) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [+] Q))\n                                        |~| (((? x:Y -> Pf x) [+] P) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [+] Q))\n               ELSE (((? x:Y -> Pf x) [+] P) |[X]| Qf x))\n     [> (((P |[X]| ((? :Z -> Qf) [+] Q)) |~|\n         (((? :Y -> Pf) [+] P) |[X]| Q)))\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve)\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_Parallel_Timeout_split)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve[THEN cspF_sym])\napply (simp)\n\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve[THEN cspF_sym])\napply (simp)\napply (simp)\n\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve[THEN cspF_sym])\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve[THEN cspF_sym])\napply (simp)\napply (simp)\napply (simp)\n\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve[THEN cspF_sym])\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve[THEN cspF_sym])\napply (simp)\napply (simp)\ndone\n\nlemma cspF_Parallel_Timeout_split_resolve_SKIP_SKIP:\n  \"((? :Y -> Pf) [+] SKIP) |[X]| ((? :Z -> Qf) [+] SKIP) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [+] SKIP))\n                                        |~| (((? x:Y -> Pf x) [+] SKIP) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [+] SKIP))\n               ELSE (((? x:Y -> Pf x) [+] SKIP) |[X]| Qf x))\n     [> (((SKIP |[X]| ((? :Z -> Qf) [+] SKIP)) |~|\n         (((? :Y -> Pf) [+] SKIP) |[X]| SKIP)))\"\nby (simp add: cspF_Parallel_Timeout_split_resolve_SKIP_or_DIV)\n\nlemma cspF_Parallel_Timeout_split_resolve_DIV_DIV:\n  \"((? :Y -> Pf) [+] DIV) |[X]| ((? :Z -> Qf) [+] DIV) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [+] DIV))\n                                        |~| (((? x:Y -> Pf x) [+] DIV) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [+] DIV))\n               ELSE (((? x:Y -> Pf x) [+] DIV) |[X]| Qf x))\n     [> (((DIV |[X]| ((? :Z -> Qf) [+] DIV)) |~|\n         (((? :Y -> Pf) [+] DIV) |[X]| DIV)))\"\nby (simp add: cspF_Parallel_Timeout_split_resolve_SKIP_or_DIV)\n\nlemma cspF_Parallel_Timeout_split_resolve_SKIP_DIV:\n  \"((? :Y -> Pf) [+] SKIP) |[X]| ((? :Z -> Qf) [+] DIV) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [+] DIV))\n                                        |~| (((? x:Y -> Pf x) [+] SKIP) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [+] DIV))\n               ELSE (((? x:Y -> Pf x) [+] SKIP) |[X]| Qf x))\n     [> (((SKIP |[X]| ((? :Z -> Qf) [+] DIV)) |~|\n         (((? :Y -> Pf) [+] SKIP) |[X]| DIV)))\"\nby (simp add: cspF_Parallel_Timeout_split_resolve_SKIP_or_DIV)\n\nlemma cspF_Parallel_Timeout_split_resolve_DIV_SKIP:\n  \"((? :Y -> Pf) [+] DIV) |[X]| ((? :Z -> Qf) [+] SKIP) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [+] SKIP))\n                                        |~| (((? x:Y -> Pf x) [+] DIV) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [+] SKIP))\n               ELSE (((? x:Y -> Pf x) [+] DIV) |[X]| Qf x))\n     [> (((DIV |[X]| ((? :Z -> Qf) [+] SKIP)) |~|\n         (((? :Y -> Pf) [+] DIV) |[X]| SKIP)))\"\nby (simp add: cspF_Parallel_Timeout_split_resolve_SKIP_or_DIV)\n\nlemmas cspF_Parallel_Timeout_split_resolve =\n       cspF_Parallel_Timeout_split_resolve_SKIP_SKIP\n       cspF_Parallel_Timeout_split_resolve_DIV_DIV\n       cspF_Parallel_Timeout_split_resolve_SKIP_DIV\n       cspF_Parallel_Timeout_split_resolve_DIV_SKIP\n\n(* input + resolve *)\n\nlemma cspF_Parallel_Timeout_input_resolve_SKIP_or_DIV_l:\n  \"P = SKIP | P = DIV ==>\n   ((? :Y -> Pf) [+] P) |[X]| (? :Z -> Qf) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| (? x:Z -> Qf x))\n                                        |~| (((? x:Y -> Pf x) [+] P) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| (? x:Z -> Qf x))\n               ELSE (((? x:Y -> Pf x) [+] P) |[X]| Qf x))\n     [> (((P |[X]| (? :Z -> Qf))))\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve)\napply (simp)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left)\napply (rule cspF_Parallel_Timeout_input)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\n\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve[THEN cspF_sym])\napply (simp)\napply (simp)\n\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve[THEN cspF_sym])\napply (simp)\napply (simp)\napply (simp)\n\napply (simp)\ndone\n\nlemma cspF_Parallel_Timeout_input_resolve_SKIP_or_DIV_r:\n  \"Q = SKIP | Q = DIV ==>\n   (? :Y -> Pf) |[X]| ((? :Z -> Qf) [+] Q) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [+] Q))\n                                        |~| ((? x:Y -> Pf x) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [+] Q))\n               ELSE ((? x:Y -> Pf x) |[X]| Qf x))\n     [> ((((? :Y -> Pf) |[X]| Q)))\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_reflex)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve)\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_Parallel_Timeout_input)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve[THEN cspF_sym])\napply (simp)\napply (simp)\n\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve[THEN cspF_sym])\napply (simp)\napply (simp)\napply (simp)\n\napply (simp)\ndone\n\nlemmas cspF_Parallel_Timeout_input_resolve_SKIP_or_DIV =\n       cspF_Parallel_Timeout_input_resolve_SKIP_or_DIV_l\n       cspF_Parallel_Timeout_input_resolve_SKIP_or_DIV_r\n\nlemma cspF_Parallel_Timeout_input_resolve_SKIP_l:\n  \"((? :Y -> Pf) [+] SKIP) |[X]| (? :Z -> Qf) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| (? x:Z -> Qf x))\n                                        |~| (((? x:Y -> Pf x) [+] SKIP) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| (? x:Z -> Qf x))\n               ELSE (((? x:Y -> Pf x) [+] SKIP) |[X]| Qf x))\n     [> (((SKIP |[X]| (? :Z -> Qf))))\"\nby (simp add: cspF_Parallel_Timeout_input_resolve_SKIP_or_DIV)\n\nlemma cspF_Parallel_Timeout_input_resolve_DIV_l:\n  \"((? :Y -> Pf) [+] DIV) |[X]| (? :Z -> Qf) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| (? x:Z -> Qf x))\n                                        |~| (((? x:Y -> Pf x) [+] DIV) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| (? x:Z -> Qf x))\n               ELSE (((? x:Y -> Pf x) [+] DIV) |[X]| Qf x))\n     [> (((DIV |[X]| (? :Z -> Qf))))\"\nby (simp add: cspF_Parallel_Timeout_input_resolve_SKIP_or_DIV)\n\nlemma cspF_Parallel_Timeout_input_resolve_SKIP_r:\n  \"(? :Y -> Pf) |[X]| ((? :Z -> Qf) [+] SKIP) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [+] SKIP))\n                                        |~| ((? x:Y -> Pf x) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [+] SKIP))\n               ELSE ((? x:Y -> Pf x) |[X]| Qf x))\n     [> ((((? :Y -> Pf) |[X]| SKIP)))\"\nby (simp add: cspF_Parallel_Timeout_input_resolve_SKIP_or_DIV)\n\nlemma cspF_Parallel_Timeout_input_resolve_DIV_r:\n  \"(? :Y -> Pf) |[X]| ((? :Z -> Qf) [+] DIV) =F[M,M]\n     (? x:((X Int Y Int Z) Un (Y - X) Un (Z - X))\n         -> IF (x : X) THEN (Pf x |[X]| Qf x)\n               ELSE IF (x : Y & x : Z) THEN ((Pf x |[X]| ((? x:Z -> Qf x) [+] DIV))\n                                        |~| ((? x:Y -> Pf x) |[X]| Qf x))\n               ELSE IF (x : Y) THEN (Pf x |[X]| ((? x:Z -> Qf x) [+] DIV))\n               ELSE ((? x:Y -> Pf x) |[X]| Qf x))\n     [> ((((? :Y -> Pf) |[X]| DIV)))\"\nby (simp add: cspF_Parallel_Timeout_input_resolve_SKIP_or_DIV)\n\nlemmas cspF_Parallel_Timeout_input_resolve =\n       cspF_Parallel_Timeout_input_resolve_SKIP_l\n       cspF_Parallel_Timeout_input_resolve_SKIP_r\n       cspF_Parallel_Timeout_input_resolve_DIV_l\n       cspF_Parallel_Timeout_input_resolve_DIV_r\n\n(**************** ;; + resolve ****************)\n\nlemma cspF_SKIP_Seq_compo_step_resolve:\n  \"((? :X -> Pf) [+] SKIP) ;; Q =F[M,M] (? x:X -> (Pf x ;; Q)) [> Q\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve)\napply (simp)\napply (rule cspF_reflex)\napply (rule cspF_SKIP_Seq_compo_step)\ndone\n\nlemma cspF_DIV_Seq_compo_step_resolve:\n  \"((? :X -> Pf) [+] DIV) ;; Q =F[M,M] (? x:X -> (Pf x ;; Q)) [+] DIV\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_Ext_choice_SKIP_or_DIV_resolve)\napply (simp)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left)\napply (rule cspF_DIV_Seq_compo_step)\napply (rule cspF_Ext_choice_SKIP_DIV_resolve[THEN cspF_sym])\ndone\n\nlemmas cspF_SKIP_DIV_Seq_compo_step_resolve =\n       cspF_SKIP_Seq_compo_step_resolve\n       cspF_DIV_Seq_compo_step_resolve\n\n(****** for sequentilising processes with SKIP or DIV ******)\n\nlemmas cspF_SKIP_DIV_resolve =\n       cspF_SKIP_DIV\n       cspF_Parallel_Timeout_split_resolve\n       cspF_Parallel_Timeout_input_resolve\n       cspF_SKIP_DIV_Seq_compo_step_resolve\n\nlemmas cspF_SKIP_or_DIV_resolve =\n       cspF_Parallel_Timeout_split_resolve_SKIP_or_DIV\n       cspF_Parallel_Timeout_input_resolve_SKIP_or_DIV\n\n(*=========================================================*\n |                                                         |\n |   for convenience, especially for fully sequntialising  |\n |                                                         |\n *=========================================================*)\n\nlemma cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_DIV_l:\n  \"Q = SKIP | Q = DIV | Q = STOP ==>\n   (P [+] Q) |[X]| DIV =F[M,M] (P |[X]| DIV)\"\napply (erule disjE)\napply (simp)\napply (rule cspF_SKIP_DIV)\napply (erule disjE)\napply (simp)\napply (rule cspF_SKIP_DIV)\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp_all)\napply (rule cspF_unit)\napply (rule cspF_reflex)\napply (rule cspF_reflex)\ndone\n\nlemma cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_DIV_r:\n  \"Q = SKIP | Q = DIV | Q = STOP ==>\n   DIV |[X]| (P [+] Q) =F[M,M] (DIV |[X]| P)\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_right)\napply (rule cspF_commut)\napply (simp add: cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_DIV_l)\ndone\n\nlemmas cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_DIV =\n       cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_DIV_l\n       cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_DIV_r\n\nlemma cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_SKIP_l:\n  \"Q = SKIP | Q = DIV | Q = STOP ==>\n   ((? :Y -> Pf) [+] Q) |[X]| SKIP =F[M,M] \n   (? x:(Y - X) -> (Pf x |[X]| SKIP)) [+] Q\"\napply (erule disjE)\napply (simp)\napply (rule cspF_SKIP_DIV)\napply (erule disjE)\napply (simp)\napply (rule cspF_SKIP_DIV)\n\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp_all)\napply (rule cspF_unit)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_SKIP_DIV)\ndone\n\nlemma cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_SKIP_r:\n  \"Q = SKIP | Q = DIV | Q = STOP ==>\n   SKIP |[X]| ((? :Y -> Pf) [+] Q) =F[M,M] \n   (? x:(Y - X) -> (SKIP |[X]| Pf x)) [+] Q\"\napply (rule cspF_rw_left)\napply (rule cspF_commut)\napply (rule cspF_rw_right)\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_commut)\napply (rule cspF_reflex)\napply (simp add: cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_SKIP_l)\ndone\n\nlemmas cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_SKIP =\n       cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_SKIP_l\n       cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_SKIP_r\n\nlemmas cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice =\n       cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_DIV\n       cspF_SKIP_or_DIV_or_STOP_Parallel_Ext_choice_SKIP\n\n(* renaming *)\n\nlemma cspF_SKIP_or_DIV_or_STOP_Renaming_Id: \n   \"P = SKIP | P = DIV | P = STOP ==> P [[r]] =F[M,M] P\"\napply (erule disjE)\napply (simp add: cspF_SKIP_DIV)\napply (erule disjE)\napply (simp add: cspF_SKIP_DIV)\n\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_step)\n\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_Ext_pre_choice_empty_DIV)\n\napply (rule cspF_rw_left)\napply (rule cspF_step)\n\napply (rule cspF_rw_right)\napply (rule cspF_step)\n\napply (rule cspF_decompo)\napply (auto)\ndone\n\n(* restg *)\n\nlemma cspF_STOP_Depth_rest:\n   \"STOP |. Suc n =F[M,M] STOP\"\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_step)\napply (rule cspF_rw_left)\napply (rule cspF_step)\napply (rule cspF_rw_right)\napply (rule cspF_step)\n\napply (rule cspF_decompo)\napply (auto)\ndone\n\n(* =================================================== *\n |             addition for CSP-Prover 5               |\n * =================================================== *)\n\n(*********************************************************\n                       P |[X,Y]| Q (aux)\n *********************************************************)\n\nlemma cspF_Alpha_Parallel_step: \n  \"(? :A -> Pf) |[X,Y]| (? :B -> Qf) =F[M,M]\n      ? x:((A Int (X - Y)) Un (B Int (Y - X)) Un (A Int B Int X Int Y))\n         -> IF (x : X & x : Y) THEN (Pf x |[X,Y]| Qf x)\n            ELSE IF (x : X) THEN (Pf x |[X,Y]| ? x:B -> Qf x)\n            ELSE (? x:A -> Pf x |[X,Y]| Qf x)\"\napply (simp add: Alpha_parallel_def)\n\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (rule cspF_SKIP)\napply (rule cspF_SKIP)\n\napply (rule cspF_rw_left)\napply (rule cspF_step)\napply (simp)\napply (rule cspF_decompo)\napply (force)\n\napply (simp)\napply (elim disjE)\n\n apply (simp)\n apply (rule cspF_rw_left, rule cspF_IF)+\n apply (rule cspF_rw_right, rule cspF_IF)+\n apply (rule cspF_decompo)\n apply (simp)+\n apply (rule cspF_rw_right)\n apply (rule cspF_SKIP)\n apply (simp)\n\n apply (simp)\n apply (rule cspF_rw_left, rule cspF_IF)+\n apply (rule cspF_rw_right, rule cspF_IF)+\n apply (rule cspF_decompo)\n apply (simp)\n apply (rule cspF_rw_right)\n apply (rule cspF_SKIP)\n apply (simp)\n apply (simp)\n\n apply (simp)\n apply (rule cspF_rw_left, rule cspF_IF)+\n apply (rule cspF_rw_right, rule cspF_IF)+\n apply (simp)\ndone\n\n(*==============================================================*\n |                                                              |\n |       Associativity and Commutativity for SKIP and DIV       |\n |                    (for sequentialising)                     |\n |                                                              |\n *==============================================================*)\n\nlemma cspF_Ext_pre_choice_SKIP_commut:\n  \"SKIP [+] (? :X -> Pf) =F[M,M] (? :X -> Pf) [+] SKIP\"\nby (rule cspF_commut)\n\nlemma cspF_Ext_pre_choice_DIV_commut:\n  \"DIV [+] (? :X -> Pf) =F[M,M] (? :X -> Pf) [+] DIV\"\nby (rule cspF_commut)\n\nlemma cspF_Ext_pre_choice_SKIP_assoc:\n  \"((? :X -> Pf) [+] SKIP) [+] (? :Y -> Qf)\n   =F[M,M] ((? :X -> Pf) [+] (? :Y -> Qf)) [+] SKIP\"\napply (rule cspF_rw_left)\napply (rule cspF_assoc[THEN cspF_sym])\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_reflex)\napply (rule cspF_commut)\napply (rule cspF_assoc)\ndone\n\nlemma cspF_Ext_pre_choice_DIV_assoc:\n  \"((? :X -> Pf) [+] DIV) [+] (? :Y -> Qf)\n   =F[M,M] ((? :X -> Pf) [+] (? :Y -> Qf)) [+] DIV\"\napply (rule cspF_rw_left)\napply (rule cspF_assoc[THEN cspF_sym])\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_reflex)\napply (rule cspF_commut)\napply (rule cspF_assoc)\ndone\n\nlemma cspF_Ext_choice_idem_assoc:\n  \"(P [+] Q) [+] Q =F[M,M] (P [+] Q)\"\napply (rule cspF_rw_left)\napply (rule cspF_assoc[THEN cspF_sym])\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_reflex)\napply (rule cspF_idem)\napply (rule cspF_reflex)\ndone\n\nlemma cspF_Ext_choice_SKIP_DIV_assoc:\n  \"(P [+] SKIP) [+] DIV =F[M,M] (P [+] SKIP)\"\napply (rule cspF_rw_left)\napply (rule cspF_assoc[THEN cspF_sym])\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_reflex)\napply (rule cspF_SKIP_DIV)\napply (rule cspF_reflex)\ndone\n\nlemma cspF_Ext_choice_DIV_SKIP_assoc:\n  \"(P [+] DIV) [+] SKIP =F[M,M] (P [+] SKIP)\"\napply (rule cspF_rw_left)\napply (rule cspF_assoc[THEN cspF_sym])\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (rule cspF_reflex)\napply (rule cspF_SKIP_DIV)\napply (rule cspF_reflex)\ndone\n\nlemmas cspF_SKIP_DIV_sort =\n       cspF_Ext_choice_assoc\n       cspF_Ext_pre_choice_SKIP_commut\n       cspF_Ext_pre_choice_DIV_commut\n       cspF_Ext_pre_choice_SKIP_assoc\n       cspF_Ext_pre_choice_DIV_assoc\n       cspF_Ext_choice_idem_assoc\n       cspF_Ext_choice_SKIP_DIV_assoc\n       cspF_Ext_choice_DIV_SKIP_assoc\n\n(*==============================================================*\n |                                                              |\n |    decompostion control by the flag \"Not_Decompo_Flag\"       |\n |                                                              |\n *==============================================================*)\n\n(*------------------------------------------------*\n |              trans with Flag                   |\n *------------------------------------------------*)\n\n(*** rewrite (eq) ***)\n\nlemma cspF_rw_flag_left_eq:\n  \"[| R1 =F[M1,M1] R2 ; Not_Decompo_Flag & R2 =F[M1,M3] R3 |] ==> R1 =F[M1,M3] R3\"\nby (simp add: eqF_def Not_Decompo_Flag_def)\n\nlemma cspF_rw_flag_left_ref:\n  \"[| R1 =F[M1,M1] R2 ; Not_Decompo_Flag & R2 <=F[M1,M3] R3 |] ==> R1 <=F[M1,M3] R3\"\nby (simp add: refF_def eqF_def Not_Decompo_Flag_def)\n\nlemmas cspF_rw_flag_left = cspF_rw_flag_left_eq cspF_rw_flag_left_ref\n\nlemma cspF_rw_flag_right_eq:\n  \"[| R3 =F[M3,M3] R2 ; Not_Decompo_Flag & R1 =F[M1,M3] R2 |] ==> R1 =F[M1,M3] R3\"\nby (simp add: eqF_def Not_Decompo_Flag_def)\n\nlemma cspF_rw_flag_right_ref:\n  \"[| R3 =F[M3,M3] R2 ; Not_Decompo_Flag & R1 <=F[M1,M3] R2 |] ==> R1 <=F[M1,M3] R3\"\nby (simp add: refF_def eqF_def Not_Decompo_Flag_def)\n\nlemmas cspF_rw_flag_right = cspF_rw_flag_right_eq cspF_rw_flag_right_ref\n\n(*------------------------------------------------*\n |              trans with Flag (ref)             |\n *------------------------------------------------*)\n\nlemma cspF_tr_flag_left_eq:\n   \"[| P1 =F[M1,M1] P2 ; Not_Decompo_Flag & P2 =F[M1,M3] P3 |] ==> P1 =F[M1,M3] P3\"\nby (simp add: eqF_def)\n\nlemma cspF_tr_flag_left_ref:\n   \"[| P1 <=F[M1,M1] P2 ; Not_Decompo_Flag & P2 <=F[M1,M3] P3 |] ==> P1 <=F[M1,M3] P3\"\nby (simp add: refF_def eqF_def Not_Decompo_Flag_def)\n\nlemmas cspF_tr_flag_left = cspF_tr_flag_left_eq cspF_tr_flag_left_ref\n\nlemma cspF_tr_flag_right_eq:\n   \"[| P2 =F[M3,M3] P3 ; Not_Decompo_Flag & P1 =F[M1,M3] P2 |] ==> P1 =F[M1,M3] P3\"\nby (simp add: eqF_def)\n\nlemma cspF_tr_flag_right_ref:\n  \"[| P2 <=F[M3,M3] P3 ; Not_Decompo_Flag & P1 <=F[M1,M3] P2 |] ==> P1 <=F[M1,M3] P3\"\nby (simp add: refF_def eqF_def Not_Decompo_Flag_def)\n\nlemmas cspF_tr_flag_right = cspF_tr_flag_right_eq cspF_tr_flag_right_ref\n\n(*------------------------------------------------*\n |           trans with Flag (erule)              |\n *------------------------------------------------*)\n\n(*** rewrite (eq) ***)\n\nlemma cspF_rw_flag_left_eqE:\n  \"[| P1 =F[M1,M3] P3 ; P1 =F[M1,M1] P2 ; \n      [| Not_Decompo_Flag & P2 =F[M1,M3] P3 |] ==> R |] ==> R\"\nby (simp add: eqF_def Not_Decompo_Flag_def)\n\nlemma cspF_rw_flag_left_refE:\n  \"[| P1 <=F[M1,M3] P3 ; P1 =F[M1,M1] P2 ; \n      [| Not_Decompo_Flag & P2 <=F[M1,M3] P3 |] ==> R |] ==> R\"\napply (simp add: Not_Decompo_Flag_def)\napply (subgoal_tac \"P2 <=F[M1,M3] P3\")\napply (simp)\napply (rule cspF_rw_left)\napply (rule cspF_sym)\napply (simp)\napply (simp)\ndone\n\nlemmas cspF_rw_flag_leftE = \n   cspF_rw_flag_left_eqE    cspF_rw_flag_left_refE\n\n(* right *)\n\nlemma cspF_rw_flag_right_eqE:\n  \"[| P1 =F[M1,M3] P3 ; P3 =F[M3,M3] P2 ;\n      [| Not_Decompo_Flag & P1 =F[M1,M3] P2 |] ==> R |] ==> R\"\nby (simp add: eqF_def Not_Decompo_Flag_def)\n\nlemma cspF_rw_flag_right_refE:\n  \"[| P1 <=F[M1,M3] P3 ; P3 =F[M3,M3] P2 ;\n      [| Not_Decompo_Flag & P1 <=F[M1,M3] P2 |] ==> R |] ==> R\"\napply (simp add: Not_Decompo_Flag_def)\napply (subgoal_tac \"P1 <=F[M1,M3] P2\")\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_sym)\napply (simp)\napply (simp)\ndone\n\nlemmas cspF_rw_flag_rightE = \n   cspF_rw_flag_right_eqE    cspF_rw_flag_right_refE\n\n(*==============================================================*\n |  decompostion of Sequential composition with a flag          |\n |  It is often useful that the second process is not expanded. |\n |                   (until CSP-Prover 4)                       |\n *==============================================================*)\n\n(*\nlemma cspF_Seq_compo_mono_flag:\n  \"[| P1 <=F[M1,M2] Q1 ; \n      Not_Decompo_Flag & P2 <=F[M1,M2] Q2 |]\n           ==> P1 ;; P2 <=F[M1,M2] Q1 ;; Q2\"\nby (simp add: cspF_Seq_compo_mono)\n\nlemma cspF_Seq_compo_cong_flag:\n  \"[| P1 =F[M1,M2] Q1 ; \n      Not_Decompo_Flag & P2 =F[M1,M2] Q2 |]\n           ==> P1 ;; P2 =F[M1,M2] Q1 ;; Q2\"\nby (simp add: cspF_Seq_compo_cong)\n\nlemmas cspF_free_mono_flag =\n       cspF_Ext_choice_mono cspF_Int_choice_mono cspF_Parallel_mono\n       cspF_Hiding_mono cspF_Renaming_mono cspF_Seq_compo_mono_flag\n       cspF_Depth_rest_mono\n\nlemmas cspF_free_cong_flag =\n       cspF_Ext_choice_cong cspF_Int_choice_cong cspF_Parallel_cong\n       cspF_Hiding_cong cspF_Renaming_cong cspF_Seq_compo_cong_flag\n       cspF_Depth_rest_cong\n\nlemmas cspF_free_decompo_flag = cspF_free_mono_flag cspF_free_cong_flag\n*)\n\n(*===============================================================*\n |  decompostion of Sequential composition with a flag           |\n |  It is often useful that the second process is not rewritten. |\n |                    (since CSP-Prover 5)                       |\n *===============================================================*)\n\nlemma cspF_Seq_compo_mono_flag:\n  \"[| P1 <=F[M1,M2] Q1 ; \n      Not_Rewrite_Flag & P2 <=F[M1,M2] Q2 |]\n           ==> P1 ;; P2 <=F[M1,M2] Q1 ;; Q2\"\nby (simp add: cspF_Seq_compo_mono)\n\nlemma cspF_Seq_compo_cong_flag:\n  \"[| P1 =F[M1,M2] Q1 ; \n      Not_Rewrite_Flag & P2 =F[M1,M2] Q2 |]\n           ==> P1 ;; P2 =F[M1,M2] Q1 ;; Q2\"\nby (simp add: cspF_Seq_compo_cong)\n\nlemmas cspF_free_mono_flag =\n       cspF_Ext_choice_mono cspF_Int_choice_mono cspF_Parallel_mono\n       cspF_Hiding_mono cspF_Renaming_mono cspF_Seq_compo_mono_flag\n       cspF_Depth_rest_mono\n       cspF_Rep_int_choice_mono_UNIV\n\n       cspF_Alpha_parallel_mono\n\n\nlemmas cspF_free_cong_flag =\n       cspF_Ext_choice_cong cspF_Int_choice_cong cspF_Parallel_cong\n       cspF_Hiding_cong cspF_Renaming_cong cspF_Seq_compo_cong_flag\n       cspF_Depth_rest_cong\n       cspF_Rep_int_choice_cong_UNIV\n\n       cspF_Alpha_parallel_cong\n\nlemmas cspF_free_decompo_flag = cspF_free_mono_flag cspF_free_cong_flag\n\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_law_aux.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6334102498375401, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.3043401195039358}}
{"text": "theory Impl_List_Playground_ChairNetwork\nimports \"../TopoS_Impl\"\nbegin\n\n\ntext{*An example of our chair network [simplified]*}\n\ntext{*Our access control view on the network*}\n  definition ChairNetwork_empty :: \"string list_graph\" where\n    \"ChairNetwork_empty \\<equiv> \\<lparr> nodesL = [''WebSrv'', ''FilesSrv'', ''PrinterBW'',\n                                ''PrinterColor'', ''Students'',\n                                ''Employees'', ''EReachable'',\n                                ''Internet''],\n                      edgesL = [] \\<rparr>\"\n  \n  lemma \"wf_list_graph ChairNetwork_empty\" by eval\n\n\nsubsection{*Our security requirements*}\n  subsubsection{*We have a server with confidential data*}\n    definition ConfidentialChairData::\"(string SecurityInvariant)\" where\n      \"ConfidentialChairData \\<equiv> new_configured_list_SecurityInvariant SINVAR_BLPtrusted_impl.SINVAR_LIB_BLPtrusted \\<lparr> \n          node_properties = [''FilesSrv'' \\<mapsto> \\<lparr> security_level = 1, trusted = False \\<rparr>,\n                             ''Employees'' \\<mapsto> \\<lparr> security_level = 0, trusted = True \\<rparr>,\n                             ''EReachable'' \\<mapsto> \\<lparr> security_level = 0, trusted = True \\<rparr>]\n          \\<rparr> ''confidential data''\"\n\n\n  (*\n  subsubsection{*We have a hierarchical printing policy*}\n    definition \"PrintingHierarchy_nodes=[''Employees''\\<mapsto> DN (''ColorPrinting''--Leaf, 0),\n                           ''PrinterColor''\\<mapsto> DN (''ColorPrinting''--''Printer''--Leaf, 0),\n                           ''Students''\\<mapsto> DN (''ColorPrinting''--''BwPrinting''--Leaf, 0),\n                           ''PrinterBW''\\<mapsto> DN (''ColorPrinting''--''BwPrinting''--''Printer''--Leaf, 0)]\"\n    definition \"PrintingHierarchy_tree=Department ''ColorPrinting'' [\n              Department ''Printer'' [], \n              Department ''BwPrinting'' [\n                  Department ''Printer'' []]]\"\n    definition PrintingHierarchy::\"string SecurityInvariant\" where\n      \"PrintingHierarchy \\<equiv> new_configured_list_SecurityInvariant SINVAR_DomainHierarchyNG_impl.SINVAR_LIB_DomainHierarchyNG \\<lparr> \n        node_properties = PrintingHierarchy_nodes\n        \\<rparr>\"  *)\n  subsubsection{* The color printer is only accessibly by employees, The black.white printer by employees and students*}\n    definition \"PrintingACL \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\<lparr> \n          node_properties = [''PrinterColor'' \\<mapsto> Master [''Employees'', ''EReachable''],\n                             ''PrinterBW'' \\<mapsto> Master [''Employees'', ''EReachable'', ''Students''],\n                             ''Employees'' \\<mapsto> Care,\n                             ''EReachable'' \\<mapsto> Care,\n                             ''Students'' \\<mapsto> Care]\n          \\<rparr> ''printing ACL''\"\n\n  subsubsection{* Printers are information sinks *}\n    definition \"PrintingSink \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_Sink \\<lparr> \n          node_properties = [''PrinterColor'' \\<mapsto> Sink,\n                             ''PrinterBW'' \\<mapsto> Sink]\n          \\<rparr> ''printing sink''\"\n\n\n\n  subsubsection{*Students may access each other but are not accessible from the outside*}\n    definition \"StudentSubnet \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_SubnetsInGW \\<lparr> \n          node_properties = [''Students'' \\<mapsto> Member, ''Employees'' \\<mapsto> Member, ''EReachable'' \\<mapsto> InboundGateway]\n          \\<rparr> ''student subnet''\"\n\n\n  subsubsection{* The files server is only accessibly by employees*}\n    definition \"FilesSrvACL \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\<lparr> \n          node_properties = [''FilesSrv'' \\<mapsto> Master [''Employees'', ''EReachable''],\n                             ''Employees'' \\<mapsto> Care,\n                             ''EReachable'' \\<mapsto> Care]\n          \\<rparr> ''file srv acl''\"\n\n\n  subsubsection{*emplyees are reachable from the Internet*}\n    (*nothing to do here*)\n\nlemma \"implc_sinvar ConfidentialChairData ChairNetwork_empty\" by eval\nlemma \"implc_sinvar PrintingACL ChairNetwork_empty\" by eval\nlemma \"implc_sinvar PrintingSink ChairNetwork_empty\" by eval\nlemma \"implc_sinvar StudentSubnet ChairNetwork_empty\" by eval\nlemma \"implc_sinvar FilesSrvACL ChairNetwork_empty\" by eval\n\ndefinition \"ChairSecurityRequirements = [ConfidentialChairData, PrintingACL, PrintingSink, StudentSubnet, FilesSrvACL]\"\n\nvalue \"implc_get_offending_flows ChairSecurityRequirements ChairNetwork_empty\"\nvalue \"generate_valid_topology ChairSecurityRequirements ChairNetwork_empty\"\n\nvalue \"List.product (nodesL ChairNetwork_empty) (nodesL ChairNetwork_empty)\"\n\ndefinition \"ChairNetwork = generate_valid_topology ChairSecurityRequirements \n      \\<lparr>nodesL = nodesL ChairNetwork_empty, edgesL = List.product (nodesL ChairNetwork_empty) (nodesL ChairNetwork_empty) \\<rparr>\"\n\nlemma \"all_security_requirements_fulfilled ChairSecurityRequirements ChairNetwork\" by eval\n\nvalue \"ChairNetwork\"\n\nML_val{*\nvisualize_graph @{context} @{term \"ChairSecurityRequirements\"} @{term \"ChairNetwork\"};\n*}\n\n\n\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/Examples/Impl_List_Playground_ChairNetwork.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.30432497759345306}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               November 2004               |\n            |                   July 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2009         |\n            |                   June 2009  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2016         |\n            |                    May 2016  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory Trace_hide\nimports Prefix\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite (notick | t = <>)                  *)\n(*                                                                     *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*****************************************************************\n\n         1. \n         2. \n         3. \n         4. \n\n *****************************************************************)\n\n\n(* Isablle 2005\n\nconsts\n  hidex :: \"'a set => ('a trace * 'a trace) set\"\n\ninductive \"hidex X\"\nintros\nhidex_nil:\n  \"(<>, <>) : hidex X\"\n\nhidex_Tick:\n  \"(<Tick>, <Tick>) : hidex X\"\n\nhidex_in: \n  \"[| (s, t) : hidex X ; a : X |]\n   ==> (<Ev a> ^^^ s, t) : hidex X\"\n\nhidex_notin: \n  \"[| (s, t) : hidex X ; a ~: X |]\n   ==> (<Ev a> ^^^ s, <Ev a> ^^^ t) : hidex X\"\n*)\n\ninductive_set\n  hidex :: \"'a set => ('a trace * 'a trace) set\"\n  for X :: \"'a set\"\n\nwhere\nhidex_nil:\n  \"(<>, <>) : hidex X\" |\n\nhidex_Tick:\n  \"(<Tick>, <Tick>) : hidex X\" |\n\nhidex_in: \n  \"[| (s, t) : hidex X ; a : X |]\n   ==> (<Ev a> ^^^ s, t) : hidex X\" |\n\nhidex_notin: \n  \"[| (s, t) : hidex X ; a ~: X |]\n   ==> (<Ev a> ^^^ s, <Ev a> ^^^ t) : hidex X\"\n\ndefinition\n  hide_tr :: \"'a trace => 'a set => 'a trace\"  (\"_ --tr _\" [84,85] 84)\n  where\n  hide_tr_def : \n    \"s --tr X == THE t. (s, t) : hidex X\"\n\ndefinition\n  rest_tr :: \"'a trace => 'a set => 'a trace\"  (\"_ rest-tr _\" [84,85] 84)\n  where\n  rest_tr_def : \n    \"s rest-tr X == s --tr (- X)\"\n\n(*************************************************************\n                       THE hidex \n *************************************************************)\n\n(*** exists ***)\n\nlemma hidex_exists_lm: \n  \"ALL X s. (EX t. (s, t) : hidex X)\"\napply (rule allI)\napply (rule allI)\napply (induct_tac s rule: induct_trace)\n\napply (simp_all)\napply (rule_tac x=\"<>\" in exI, simp add: hidex.intros)\napply (rule_tac x=\"<Tick>\" in exI, simp add: hidex.intros)\n\napply (elim exE)\napply (case_tac \"a : X\")\napply (rule_tac x=\"t\" in exI, simp add: hidex.intros)\napply (rule_tac x=\"<Ev a> ^^^ t\" in exI, simp add: hidex.intros)\ndone\n\n(*** exists !! ***)\n\nlemma hidex_exists: \n  \"EX t. (s, t) : hidex X\"\nby (simp add: hidex_exists_lm)\n\n(*** unique ***)\n\nlemma hidex_unique_lm: \n  \"ALL X s t u. ((s, t) : hidex X & (s, u) : hidex X)\n    --> t = u\"\napply (rule allI)\napply (rule allI)\napply (induct_tac s rule: induct_trace)\n\n(* <> *)\napply (intro allI impI)\napply (erule conjE)\napply (erule hidex.cases, simp_all)    (* hidex.elims --2007--> hidex.cases *)\napply (erule hidex.cases, simp_all)\n\n(* <Tick> *)\napply (intro allI impI)\napply (erule conjE)\napply (erule hidex.cases, simp_all)    (* hidex.elims --2007--> hidex.cases *)\napply (erule hidex.cases, simp_all)\n\n\n(* step *)\napply (intro allI impI)\napply (erule conjE)\napply (case_tac \"a : X\")\n apply (erule hidex.cases, simp_all)+    (* hidex.elims --2007--> hidex.cases *)\ndone\n\nlemma hidex_unique: \n  \"[| (s, t) : hidex X ; (s, u) : hidex X |]\n   ==> t = u\"\napply (insert hidex_unique_lm)\napply (drule_tac x=\"X\" in spec)\napply (drule_tac x=\"s\" in spec)\napply (drule_tac x=\"t\" in spec)\napply (drule_tac x=\"u\" in spec)\napply (simp)\ndone\n\n(*************************************************************\n                       THE hidex \n *************************************************************)\n\nlemma hidex_to_hide_tr : \n    \"(s, t) : hidex X = (t = s --tr X)\"\napply (simp add: hide_tr_def)\napply (rule iffI)\napply (rule sym)\napply (rule the_equality)\napply (simp)\napply (simp add: hidex_unique)\n\napply (simp)\napply (insert hidex_exists[of s X])\napply (erule exE)\napply (rule theI[of \"(%x. (s, x) : hidex X)\"])\napply (simp)\napply (simp add: hidex_unique)\ndone\n\nlemma hide_tr_to_hidex : \n    \"(s --tr X = t) = ((s, t) : hidex X)\"\napply (simp add: hidex_to_hide_tr)\nby (fast)\n\nlemma hide_tr_to_hidex_sym : \n    \"(t = s --tr X) = ((s, t) : hidex X)\"\nby (simp add: hidex_to_hide_tr)\n\nlemmas hide_tr_iff = hide_tr_to_hidex hide_tr_to_hidex_sym\n\n(*************************************************************\n                         hide_tr\n *************************************************************)\n\n(*------------------*\n |      intros      |\n *------------------*)\n\nlemma hide_tr_nil[simp] : \"<> --tr X = <>\"\napply (simp add: hide_tr_to_hidex)\nby (simp add: hidex.intros)\n\nlemma hide_tr_Tick[simp] : \"<Tick> --tr X = <Tick>\"\napply (simp add: hide_tr_to_hidex)\nby (simp add: hidex.intros)\n\nlemma hide_tr_in_lm : \n  \"[| a : X ;  t = s --tr X |]\n   ==> (<Ev a> ^^^ s) --tr X = t\"\napply (simp add: hide_tr_to_hidex_sym)\napply (simp add: hide_tr_to_hidex)\napply (simp add: hidex.intros)\ndone\n\nlemma hide_tr_in[simp] : \n  \"a : X ==> (<Ev a> ^^^ s) --tr X = s --tr X\"\nby (simp add: hide_tr_in_lm)\n\nlemma hide_tr_in_one[simp] : \n  \"a : X ==> <Ev a> --tr X = <>\"\napply (insert hide_tr_in[of a X \"<>\"])\nby (simp)\n\nlemma hide_tr_notin_lm : \n  \"[| a ~: X ;  t = s --tr X |]\n   ==> (<Ev a> ^^^ s) --tr X = <Ev a> ^^^ t\"\napply (simp add: hide_tr_to_hidex_sym)\napply (simp add: hide_tr_to_hidex)\napply (simp add: hidex.intros)\ndone\n\nlemma hide_tr_notin_appt[simp] : \n  \"a ~: X ==> (<Ev a> ^^^ s) --tr X = <Ev a> ^^^ (s --tr X)\"\nby (simp add: hide_tr_notin_lm)\n\nlemma hide_tr_notin[simp] : \n  \"a ~: X ==> <Ev a> --tr X = <Ev a>\"\napply (insert hide_tr_notin_appt[of a X \"<>\"])\nby (simp)\n\n(*------------------*\n |      elims       |\n *------------------*)\n\nlemma hide_tr_elims_lm:\n  \"[| s --tr X = t ;\n      (( s = <> & t = <> ) --> P) ;\n      (( s = <Tick> & t = <Tick> ) --> P) ;\n      ( ALL a s'.\n        ((s = <Ev a> ^^^ s' & s' --tr X = t & a : X )\n         --> P)) ;\n      ( ALL a s' t'.\n        ((s = <Ev a> ^^^ s' & t = <Ev a> ^^^ t' & s' --tr X = t' & a ~: X )\n         --> P)) |]\n   ==> P\"\napply (simp add: hide_tr_iff)\napply (erule hidex.cases)\nby (auto)\n\nlemma hide_tr_elims:\n  \"[| s --tr X = t; \n      [| s = <> ; t = <> |] ==> P; \n      [| s = <Tick> ; t = <Tick> |] ==> P; \n   !!a s'.\n      [| s = <Ev a> ^^^ s' ; s' --tr X = t; a : X |]\n      ==> P;\n   !!a s' t'.\n      [| s = <Ev a> ^^^ s' ; t = <Ev a> ^^^ t' ; s' --tr X = t' ; a ~: X |]\n      ==> P |]\n   ==> P\"\napply (rule hide_tr_elims_lm[of s X t])\napply (simp_all)\n(* for Isabelel 2013\nby (force)+\n*)\ndone\n\n(*************************************************************\n        a new event is not introduced by HIDE (trace)\n *************************************************************)\n\nlemma hide_tr_in_event[simp]:\n  \"e : sett (s --tr X) = (e ~: Ev ` X & e : sett s)\"\napply (induct_tac s rule: induct_trace)\napply (simp)\napply (simp)\napply (force)\n\napply (simp)\napply (case_tac \"a : X\")\napply (simp)\napply (rule iffI, simp, force)\napply (rule iffI, force, force)\ndone\n\n(*** notick ***)\n\nlemma hide_tr_noTick[simp]: \"noTick (s --tr X) = noTick s\"\napply (simp add: noTick_def)\nby (auto)\n\n(*************************************************************\n                  appended traces in hide\n *************************************************************)\n\nlemma hide_tr_appt_noTick_lm:\n  \"ALL X s e t. noTick s --> ((s ^^^ t) --tr X = (s --tr X) ^^^ (t --tr X))\"\napply (rule allI)\napply (rule allI)\napply (induct_tac s rule: induct_trace)\napply (simp_all)\n\napply (intro allI impI, simp)\napply (case_tac \"a : X\")\nby (simp_all add: appt_assoc)\n\n(*** simp ***)\n\nlemma hide_tr_appt[simp]:\n  \"noTick s | t = <> ==> (s ^^^ t) --tr X = (s --tr X) ^^^ (t --tr X)\"\napply (erule disjE)\napply (simp add: hide_tr_appt_noTick_lm)\nby (simp)\n\n(*************************************************************\n                 decompose traces in hide\n *************************************************************)\n\nlemma hide_tr_decompo_only_if_lm:\n  \"ALL X u s t.\n      ((noTick s | t = <>) & u --tr X = s ^^^ t)\n      --> (EX s' t'. (noTick s' | t' = <>) &\n                     u = s' ^^^ t' &\n                     s = s' --tr X & t = t' --tr X) \"\napply (rule allI)\napply (rule allI)\napply (induct_tac u rule: induct_trace)\napply (intro allI impI)\napply (rule_tac x=\"<>\" in exI)\napply (rule_tac x=\"<>\" in exI)\napply (force)\n\napply (intro allI impI)\napply (elim conjE disjE)\napply (simp)\napply (elim conjE disjE)\napply (rule_tac x=\"<Tick>\" in exI)\napply (rule_tac x=\"<>\" in exI)\napply (simp)\napply (rule_tac x=\"<>\" in exI)\napply (rule_tac x=\"<Tick>\" in exI)\napply (simp)\napply (rule_tac x=\"<Tick>\" in exI)\napply (rule_tac x=\"<>\" in exI)\napply (drule sym)\napply (simp)\n\napply (intro allI impI)\napply (erule conjE)\napply (erule hide_tr_elims)\napply (simp_all)\n\n (* a : X *)\n apply (drule_tac x=\"sa\" in spec)\n apply (drule_tac x=\"t\" in spec)\n apply (simp)\n apply (elim conjE exE)\n apply (simp)\n\n apply (rule_tac x=\"<Ev aa> ^^^ s'a\" in exI)\n apply (rule_tac x=\"t'\" in exI)\n apply (erule disjE)\n apply (simp add: appt_assoc)\n apply (erule disjE)\n apply (simp add: appt_assoc)\n apply (simp)\n\n (* a ~: X *)\n apply (insert trace_nil_or_Tick_or_Ev)\n apply (rotate_tac -1)\n apply (drule_tac x=\"sa\" in spec)\n apply (rotate_tac -1)\n\n  (* <> *)\n  apply (erule disjE)\n  apply (rule_tac x=\"<>\" in exI, simp)\n\n  (* <Tick> *)\n  apply (rotate_tac -1)\n  apply (erule disjE)\n  apply (simp)\n\n  (* <Ev a> ^^^ ... *)\n  apply (elim exE)\n  apply (simp add: appt_assoc)\n\n  apply (drule_tac x=\"sb\" in spec)\n  apply (drule_tac x=\"t\" in spec)\n  apply (simp)\n  apply (elim conjE exE)\n\n  apply (rule_tac x=\"<Ev aa> ^^^ s'a\" in exI)\n  apply (rule_tac x=\"t'a\" in exI)\n  apply (simp add: appt_assoc)\ndone\n\nlemma hide_tr_decompo_only_if:\n  \"[| noTick s | t = <> ; u --tr X = s ^^^ t |]\n   ==> (EX s' t'. (noTick s' | t' = <>) &\n                  u = s' ^^^ t' &\n                  s = s' --tr X & t = t' --tr X)\"\nby (simp add: hide_tr_decompo_only_if_lm)\n\n(* if *)\n\nlemma hide_tr_decompo_if:\n  \"[| noTick s | t = <> ; \n      (EX s' t'. (noTick s' | t' = <>) &\n                  u = s' ^^^ t' &\n                  s = s' --tr X & t = t' --tr X) |]\n   ==> u --tr X = s ^^^ t\"\napply (elim conjE exE)\nby (simp)\n\n(*** iff ***)\n\nlemma hide_tr_decompo:\n  \"noTick s | t = <>\n   ==> u --tr X = s ^^^ t\n    = (EX s' t'. (noTick s' | t' = <>) &\n                  u = s' ^^^ t' &\n                  s = s' --tr X & t = t' --tr X)\"\napply (rule iffI)\napply (simp add: hide_tr_decompo_only_if)\napply (rule hide_tr_decompo_if)\nby (simp_all)\n\n(*************************************************************\n                  hide trace prefix_closed\n *************************************************************)\n\nlemma hide_tr_prefix_only_if_lm:\n \"ALL X s u. (prefix u (s --tr X)) \n    --> (EX t. u = t --tr X & prefix t s)\"\napply (rule allI)\napply (rule allI)\napply (induct_tac s rule: induct_trace)\napply (simp_all)\n\n(* Tick *)\napply (force)\n\n(* <Ev a> ^^^ ... *)\napply (intro allI impI)\n\n apply (case_tac \"a : X\")\n apply (drule_tac x=\"u\" in spec, simp)\n apply (elim conjE exE)\n apply (rule_tac x=\"<Ev a> ^^^ t\" in exI, simp)\n\n (* a ~: X *)\n apply (simp)\n\n  (* u = <> *)\n  apply (erule disjE)\n  apply (drule_tac x=\"<>\" in spec)\n  apply (simp)\n  apply (elim conjE exE)\n  apply (rule_tac x=\"<>\" in exI)\n  apply (simp)\n\n  (* u = <Ev a> ^^^ ... *)\n  apply (elim conjE exE)\n  apply (drule_tac x=\"v'\" in spec, simp)\n  apply (elim conjE exE)\n  apply (rule_tac x=\"<Ev a> ^^^ t\" in exI, simp)\ndone\n\nlemma hide_tr_prefix_only_if:\n \"prefix u (s --tr X) ==> (EX t. u = t --tr X & prefix t s)\"\nby (simp add: hide_tr_prefix_only_if_lm)\n\n(*** if ***)\n\nlemma hide_tr_prefix_if:\n \"prefix t s ==> prefix (t --tr X) (s --tr X)\"\napply (simp add: prefix_def)\napply (erule exE)\napply (simp)\napply (rule_tac x=\"u --tr X\" in exI)\nby (auto)\n\nlemma hide_tr_prefix:\n \"prefix u (s --tr X) = (EX t. u = t --tr X & prefix t s)\"\napply (rule iffI)\napply (simp add: hide_tr_prefix_only_if)\napply (erule exE)\nby (simp add: hide_tr_prefix_if)\n\n(*************************************************************\n                  hide + alpha lemma\n *************************************************************)\n\n(* rev <> *)\n\n(* only if *)\n\nlemma hide_tr_nilt_sett_only_if_lm:\n  \"ALL s. s --tr X = <> --> (sett s <= Ev ` X)\"\napply (rule allI)\napply (induct_tac s rule: induct_trace)\napply (simp_all)\napply (intro allI impI)\napply (elim conjE exE)\napply (case_tac \"a : X\")\nby (simp_all)\n\nlemma hide_tr_nilt_sett_only_if:\n  \"s --tr X = <> ==> (sett s <= Ev ` X)\"\nby (simp add: hide_tr_nilt_sett_only_if_lm)\n\n(* if *)\n\nlemma hide_tr_nilt_sett_if_lm:\n  \"ALL s. sett s <= Ev ` X --> s --tr X = <>\"\napply (rule allI)\napply (induct_tac s rule: induct_trace)\napply (simp_all)\napply (force)\napply (intro allI impI)\napply (elim conjE)\napply (simp)\napply (case_tac \"a : X\")\nby (auto)\n\nlemma hide_tr_nilt_sett_if:\n  \"sett s <= Ev ` X ==> s --tr X = <>\"\nby (simp add: hide_tr_nilt_sett_if_lm)\n\n(* iff *)\n\nlemma hide_tr_nilt_sett:\n  \"(s --tr X = <>) = (sett s <= Ev ` X)\"\napply (rule iffI)\napply (simp add: hide_tr_nilt_sett_only_if)\napply (simp add: hide_tr_nilt_sett_if)\ndone\n\n(*** sett <= sett ***)\n\nlemma hide_tr_sett_subseteq_sett:\n  \"X <= Y ==> sett (u --tr Y) <= sett (u --tr X)\"\napply (induct_tac u rule: induct_trace)\napply (simp_all)\napply (case_tac \"a : X\")\napply (simp_all)\napply (case_tac \"a ~: Y\", fast)\napply (simp)\n\napply (case_tac \"a : Y\")\napply (auto)\ndone\n\n(* rev <Tick> *)\n\n(* only if *)\n\nlemma hide_tr_Tick_sett_only_if_lm:\n  \"ALL s. s --tr X = <Tick>\n    --> (EX s'. s = s' ^^^ <Tick> & sett s' <= Ev ` X & noTick s')\"\napply (rule allI)\napply (induct_tac s rule: rev_induct_trace)\napply (simp_all)\napply (rule conjI)\n\n apply (force)\n\n apply (intro allI impI)\n apply (elim conjE exE)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n apply (insert event_Tick_or_Ev)\n apply (drule_tac x=\"e\" in spec)\n apply (erule disjE)\n apply (simp add: hide_tr_nilt_sett)\n\n apply (erule exE)\n apply (case_tac \"a : X\")\n apply (simp_all)\ndone\n\nlemma hide_tr_Tick_sett_only_if:\n  \"s --tr X = <Tick>\n    ==> (EX s'. s = s' ^^^ <Tick> & sett s' <= Ev ` X & noTick s')\"\nby (simp add: hide_tr_Tick_sett_only_if_lm)\n\n(* if *)\n\nlemma hide_tr_Tick_sett_if:\n  \"sett s <= Ev ` X ==> s --tr X = <>\"\nby (simp add: hide_tr_nilt_sett)\n\n(* iff *)\n\nlemma hide_tr_Tick_sett:\n  \"(s --tr X = <Tick>)\n   = (EX s'. s = s' ^^^ <Tick> & sett s' <= Ev ` X & noTick s')\"\napply (rule iffI)\napply (simp add: hide_tr_Tick_sett_only_if)\napply (elim conjE exE)\napply (simp add: hide_tr_Tick_sett_if)\ndone\n\n(*--------------------------*\n |       commutativity      |\n *--------------------------*)\n\nlemma hide_tr_commute:\n  \"(u --tr X) --tr Y = (u --tr Y) --tr X\"\napply (induct_tac u rule: induct_trace)\napply (simp_all)\napply (case_tac \"a:X\")\n apply (case_tac \"a:Y\")\n  apply (simp)\n  apply (simp)\n apply (case_tac \"a:Y\")\n  apply (simp)\n  apply (simp)\ndone\n\n(*--------------------------------*\n |   used in Inductive_parallel   |\n *--------------------------------*)\n\nlemma hide_tr_of_hide_tr_subset1:\n  \"X <= Y ==> (u --tr X) --tr Y = u --tr Y\"\napply (induct_tac u rule: induct_trace)\napply (simp_all)\napply (case_tac \"a:X\")\nby (auto)\n\nlemma hide_tr_of_hide_tr_subset2:\n  \"X <= Y ==> (u --tr Y) --tr X = u --tr Y\"\napply (simp add: hide_tr_commute)\napply (simp add: hide_tr_of_hide_tr_subset1)\ndone\n\nlemmas hide_tr_of_hide_tr_subset = hide_tr_of_hide_tr_subset1\n                                   hide_tr_of_hide_tr_subset2\n\nlemma hide_tr_UNIV_lm:\n  \"((u --tr UNIV = <>) | (u --tr UNIV = <Tick>))\"\napply (induct_tac u rule: induct_trace)\nby (simp_all)\n\nlemma hide_tr_UNIV:\n  \"((u --tr UNIV = <>) | (u --tr UNIV = <Tick>))\"\nby (simp add: hide_tr_UNIV_lm)\n\n(*======================================================*\n |                                                      |\n |                        rest-tr                       |\n |                                                      |\n *======================================================*)\n\n(*------------------*\n |      intros      |\n *------------------*)\n\nlemma rest_tr_nil[simp] : \"<> rest-tr X = <>\"\nby (simp add: rest_tr_def)\n\nlemma rest_tr_Tick[simp] : \"<Tick> rest-tr X = <Tick>\"\nby (simp add: rest_tr_def)\n\nlemma rest_tr_notin[simp] : \n  \"a ~: X ==> (<Ev a> ^^^ s) rest-tr X = s rest-tr X\"\nby (simp add: rest_tr_def)\n\nlemma rest_tr_notin_one[simp] : \n  \"a ~: X ==> <Ev a> rest-tr X = <>\"\nby (simp add: rest_tr_def)\n\nlemma rest_tr_in_appt[simp] : \n  \"a : X ==> (<Ev a> ^^^ s) rest-tr X = <Ev a> ^^^ (s rest-tr X)\"\nby (simp add: rest_tr_def)\n\nlemma rest_tr_in[simp] : \n  \"a : X ==> <Ev a> rest-tr X = <Ev a>\"\nby (simp add: rest_tr_def)\n\n(*------------------*\n |      elims       |\n *------------------*)\n\nlemma rest_tr_elims:\n  \"[| s rest-tr X = t; \n      [| s = <> ; t = <> |] ==> P; \n      [| s = <Tick> ; t = <Tick> |] ==> P; \n   !!a s'.\n      [| s = <Ev a> ^^^ s' ; s' rest-tr X = t; a ~: X |]\n      ==> P;\n   !!a s' t'.\n      [| s = <Ev a> ^^^ s' ; t = <Ev a> ^^^ t' ; s' rest-tr X = t' ; a : X |]\n      ==> P |]\n   ==> P\"\napply (simp add: rest_tr_def)\napply (erule hide_tr_elims)\napply (simp)\napply (simp)\napply (blast)\napply (blast)\ndone\n\n(*************************************************************\n        a new event is not introduced by rest (trace)\n *************************************************************)\n\nlemma rest_tr_in_event[simp]:\n  \"e : sett (s rest-tr X) = ((e : Ev ` X | e = Tick) & e : sett s)\"\napply (simp add: rest_tr_def)\napply (insert event_Tick_or_Ev)\napply (drule_tac x=\"e\" in spec)\napply (auto)\ndone\n\nlemma rest_tr_subset_event[simp]:\n  \"sett (s rest-tr X) <= insert Tick (Ev ` X)\"\napply (auto)\ndone\n(*** notick ***)\n\nlemma rest_tr_noTick[simp]: \"noTick (s rest-tr X) = noTick s\"\nby (simp add: noTick_def)\n\n(*************************************************************\n                  appended traces in rest\n *************************************************************)\n\nlemma rest_tr_appt[simp]:\n  \"noTick s | t = <> ==> (s ^^^ t) rest-tr X = (s rest-tr X) ^^^ (t rest-tr X)\"\napply (simp add: rest_tr_def)\ndone\n\n(*************************************************************\n                 decompose traces in rest\n *************************************************************)\n\nlemma rest_tr_decompo:\n  \"noTick s | t = <>\n   ==> u rest-tr X = s ^^^ t\n    = (EX s' t'. (noTick s' | t' = <>) &\n                  u = s' ^^^ t' &\n                  s = s' rest-tr X & t = t' rest-tr X)\"\napply (simp add: rest_tr_def)\napply (simp add: hide_tr_decompo)\ndone\n\n(*************************************************************\n                  rest trace prefix_closed\n *************************************************************)\n\nlemma rest_tr_prefix:\n \"prefix u (s rest-tr X) = (EX t. u = t rest-tr X & prefix t s)\"\napply (simp add: rest_tr_def)\napply (simp add: hide_tr_prefix)\ndone\n\n(*************************************************************\n                  rest + alpha lemma\n *************************************************************)\n\n(* rev <> *)\n\nlemma rest_tr_nilt_sett:\n  \"(s rest-tr X = <>) = (sett s Int (insert Tick (Ev ` X)) = {})\"\napply (simp add: rest_tr_def)\napply (simp add: hide_tr_nilt_sett)\napply (auto)\napply (insert event_Tick_or_Ev)\napply (drule_tac x=\"x\" in spec)\napply (auto)\ndone\n\n(*** sett <= sett ***)\n\nlemma rest_tr_sett_subseteq_sett:\n  \"X <= Y ==> sett (u rest-tr X) <= sett (u rest-tr Y)\"\napply (simp add: rest_tr_def)\nby (simp add: hide_tr_sett_subseteq_sett)\n\n(* rev <Tick> *)\n\nlemma rest_tr_Tick_sett:\n  \"(s rest-tr X = <Tick>)\n   = (EX s'. s = s' ^^^ <Tick> & (sett s' Int (Ev ` X) = {})\n      & noTick s')\"\napply (simp add: rest_tr_def)\napply (simp add: hide_tr_Tick_sett)\napply (auto)\napply (rule_tac x=\"s'\" in exI)\napply (auto)\napply (insert event_Tick_or_Ev)\napply (drule_tac x=\"x\" in spec)\napply (auto simp add: noTick_def)\ndone\n\n(*--------------------------*\n |       commutativity      |\n *--------------------------*)\n\nlemma rest_tr_commute:\n  \"(u rest-tr X) rest-tr Y = (u rest-tr Y) rest-tr X\"\napply (simp add: rest_tr_def)\napply (simp add: hide_tr_commute)\ndone\n\n(*--------------------------------*\n |   used in Inductive_parallel   |\n *--------------------------------*)\n\nlemma rest_tr_of_rest_tr_subset1:\n  \"X <= Y ==> (u rest-tr X) rest-tr Y = u rest-tr X\"\napply (simp add: rest_tr_def)\napply (rule hide_tr_of_hide_tr_subset)\nby (auto)\n\nlemma rest_tr_of_rest_tr_subset2:\n  \"X <= Y ==> (u rest-tr Y) rest-tr X = u rest-tr X\"\napply (simp add: rest_tr_commute)\napply (simp add: rest_tr_of_rest_tr_subset1)\ndone\n\nlemmas rest_tr_of_rest_tr_subset = rest_tr_of_rest_tr_subset1\n                                   rest_tr_of_rest_tr_subset2\n\nlemma rest_tr_empty:\n  \"((u rest-tr {} = <>) | (u rest-tr {} = <Tick>))\"\napply (simp add: rest_tr_def)\napply (simp add: hide_tr_UNIV)\ndone\n\n(* =================================================== *\n |             addition for CSP-Prover 5               |\n * =================================================== *)\n\n(*  rest_tr decompo *)\n\nlemma Ev_rest_tr_decompo:\n  \"ALL s X a. (a : X &  s rest-tr X = <Ev a>) --> \n   (EX s1 s2. s = s1 ^^^ <Ev a> ^^^ s2 & noTick s1 & noTick s2 &\n    s1 rest-tr X = <> &\n    s2 rest-tr X = <> )\"\napply (rule)\napply (rule)\napply (induct_tac s rule: induct_trace)\napply (simp_all)\napply (intro allI impI)\napply (elim conjE disjE)\napply (simp)\napply (case_tac \"a:X\")\n apply (simp)\n apply (rule_tac x=\"<>\" in exI)\n apply (rule_tac x=\"sa\" in exI)\n apply (simp)\n apply (subgoal_tac \"noTick(sa rest-tr X)\")\n apply (simp (no_asm_use))\n apply (simp)\n apply (simp)\n\napply (simp)\napply (elim conjE exE)\napply (simp)\napply (rule_tac x=\"<Ev a> ^^^ s1\" in exI)\napply (rule_tac x=\"s2\" in exI)\napply (simp)\napply (simp add: appt_assoc)\ndone\n\n(* --- hide_tr --- *)\n\nlemma hide_tr_rest_tr_sett[rule_format]:\n  \"sett s <= insert Tick (Ev ` Y)\n   --> ((s --tr X) = (s rest-tr (Y-X)))\"\napply (induct_tac s rule: induct_trace)\napply (simp_all)\napply (intro impI)\napply (simp add: image_iff)\napply (case_tac \"a:X\")\napply (auto)\ndone\n\nlemma hide_tr_id[rule_format]:\n  \"(sett s <= insert Tick (Ev ` Y) & X Int Y = {})\n   --> ((s --tr X) = s)\"\napply (induct_tac s rule: induct_trace)\napply (simp_all)\napply (intro impI)\napply (simp add: image_iff)\napply (case_tac \"a:X\")\napply (auto)\ndone\n\n\n(* --------------------------------------------------- *\n                   semantics for pipe\n * --------------------------------------------------- *)\n\n(* hide & rest *)\n\nlemma hide_tr_of_rest_tr_empty1:\n  \"X Int Y = {} ==> s --tr X rest-tr Y = s rest-tr Y\"\napply (simp add: rest_tr_def)\napply (rule hide_tr_of_hide_tr_subset1)\napply (auto)\ndone\n\nlemma hide_tr_of_rest_tr_empty2:\n  \"X Int Y = {} ==> s rest-tr X --tr Y = s rest-tr X\"\napply (simp add: rest_tr_def)\napply (rule hide_tr_of_hide_tr_subset2)\napply (auto)\ndone\n\nlemma noTick_hide_tr_of_rest_tr_empty:\n  \"[| noTick s ; X <= Y |] ==> s rest-tr X --tr Y = <>\"\napply (rule hide_tr_Tick_sett_if)\napply (auto)\napply (simp add: image_iff)\napply (force)\napply (simp add: noTick_def)\ndone\n\nlemma hide_tr_nohiden[rule_format]: \n  \"sett s Int Ev ` X = {} --> s --tr X = s\"\napply (induct_tac s rule: induct_trace)\napply (simp)\napply (simp)\napply (intro allI impI)\napply (simp add: image_iff)\ndone\n\n(****************** to add it again ******************)\n\ndeclare disj_not1 [simp] \n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP/Trace_hide.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.30432497759345306}}
{"text": "theory PF_Fixed_Action\n  imports PF_Semantics_Ternary\n          Iptables_Semantics.List_Misc\nbegin\n(* adapted from Iptables_Semantics.Fixed_Action *)\n\nsection\\<open>Fixed Action\\<close>\n\ntext\\<open>If firewall rules have the same action, we can focus on the matching only.\\<close>\n\n\n\nsubsection\\<open>@{term match_list}\\<close>\n  text\\<open>Reducing the firewall semantics to short-circuit matching evaluation\\<close>\n\n  fun match_list :: \"('a, 'packet) match_tac \\<Rightarrow> 'a match_expr list \\<Rightarrow> action \\<Rightarrow> decision \\<Rightarrow> 'packet \\<Rightarrow> bool\" where\n   \"match_list \\<gamma> [] a d p = False\" |\n   \"match_list \\<gamma> (m#ms) a d p = (if matches \\<gamma> m a d p then True else match_list \\<gamma> ms a d p)\"\n\n\n  lemma match_list_matches: \"match_list \\<gamma> ms a d p \\<longleftrightarrow> (\\<exists>m \\<in> set ms. matches \\<gamma> m a d p)\"\n    by(induction ms, simp_all)\n\n\nlemma match_list_False: \"\\<not>match_list \\<gamma> ms a (unwrap_decision d) p \\<Longrightarrow> filter_approx' (map (\\<lambda>m. PfRule \\<lparr>get_action = a, get_quick = False, pf_rule.get_match = m\\<rparr>) ms) \\<gamma> p d =\n d\"\nproof(induction ms)\n  case Nil\n  then show ?case by (cases d;simp)\nnext\n  case (Cons a ms)\n  then show ?case by (cases d;auto)\nqed\n\nlemma match_list_True: \"match_list \\<gamma> ms a d p \\<Longrightarrow> filter_approx' (map (\\<lambda>m. PfRule \\<lparr>get_action = a, get_quick = False, pf_rule.get_match = m\\<rparr>) ms) \\<gamma> p (Preliminary d) =\n (case a of Pass \\<Rightarrow> (Preliminary decision.Accept) | Block \\<Rightarrow> (Preliminary decision.Reject) | ActionMatch \\<Rightarrow> (Preliminary d))\"\nproof(induction ms arbitrary:d)\ncase Nil\n  then show ?case by simp\nnext\n  case *:(Cons m ms)\n  then show ?case\n  proof(cases \"matches \\<gamma> m a d p\")\n    case True\n    then show ?thesis\n    proof(cases \"match_list \\<gamma> ms a (action_to_decision a d) p\")\n      case True\n      then show ?thesis using * apply(cases a) by auto\n    next\n      case False\n      then show ?thesis using * match_list_False[of \\<gamma> ms a \"(Preliminary (action_to_decision a d))\" p] apply(cases a) by auto\n    qed\n  next\n    case False\n    then show ?thesis using * by simp\n  qed\nqed\n\n\n  text\\<open>The key idea behind @{const match_list}: Reducing semantics to match list\\<close>\nlemma match_list_semantics:\n  assumes match_list:\"match_list \\<gamma> ms1 a (unwrap_decision d) p \\<longleftrightarrow> match_list \\<gamma> ms2 a (unwrap_decision d) p\"\n    shows \"filter_approx' (map (\\<lambda>m. (PfRule \\<lparr>get_action = a, get_quick = False, pf_rule.get_match = m\\<rparr>)) ms1) \\<gamma> p d = filter_approx' (map (\\<lambda>m. (PfRule \\<lparr>get_action = a, get_quick = False, pf_rule.get_match = m\\<rparr>)) ms2) \\<gamma> p d\"\nproof(cases \"match_list \\<gamma> ms1 a (unwrap_decision d) p\")\n    case m1T:True\n    then have m2T:\"match_list \\<gamma> ms2 a (unwrap_decision d) p\" using match_list by auto\n    show ?thesis using m1T m2T by (cases a;cases d;auto simp add: match_list_True unwrap_decision_cases)\n  next\n    case m1F:False\n    then have m2F:\"\\<not>match_list \\<gamma> ms2 a (unwrap_decision d) p\" using match_list by auto\n    show ?thesis using m1F m2F by (cases a;cases d;auto simp add: match_list_False unwrap_decision_cases)\n  qed\n\n\n  text\\<open>We can exploit de-morgan to get a disjunction in the match expression!\\<close>\n  (*but we need to normalize afterwards, which is quite slow*)\n  fun match_list_to_match_expr :: \"'a match_expr list \\<Rightarrow> 'a match_expr\" where\n    \"match_list_to_match_expr [] = MatchNot MatchAny\" |\n    \"match_list_to_match_expr (m#ms) = MatchOr m (match_list_to_match_expr ms)\"\n  text\\<open>@{const match_list_to_match_expr} constructs a unwieldy @{typ \"'a match_expr\"} from a list.\n        The semantics of the resulting match expression is the disjunction of the elements of the list.\n        This is handy because the normal match expressions do not directly support disjunction.\n        Use this function with care because the resulting match expression is very ugly!\\<close>\n  lemma match_list_to_match_expr_disjunction: \"match_list \\<gamma> ms a d p \\<longleftrightarrow> matches \\<gamma> (match_list_to_match_expr ms) a d p\"\n    apply(induction ms rule: match_list_to_match_expr.induct)\n     apply(simp add: bunch_of_lemmata_about_matches; fail)\n    apply(simp add: MatchOr)\n  done\n\n  lemma match_list_singleton: \"match_list \\<gamma> [m] a d p \\<longleftrightarrow> matches \\<gamma> m a d p\" by(simp)\n\n  lemma match_list_append: \"match_list \\<gamma> (m1@m2) a d p \\<longleftrightarrow> (\\<not> match_list \\<gamma> m1 a d p \\<longrightarrow> match_list \\<gamma> m2 a d p)\"\n      by(induction m1) simp+\n\n  lemma match_list_helper1: \"\\<not> matches \\<gamma> m2 a d p \\<Longrightarrow> match_list \\<gamma> (map (\\<lambda>x. MatchAnd x m2) m1') a d p \\<Longrightarrow> False\"\n    apply(induction m1')\n     apply(simp; fail)\n    apply(simp split:if_split_asm)\n    by(auto dest: matches_dest)\n  lemma match_list_helper2: \" \\<not> matches \\<gamma> m a d p \\<Longrightarrow> \\<not> match_list \\<gamma> (map (MatchAnd m) m2') a d p\"\n    apply(induction m2')\n     apply(simp; fail)\n    apply(simp split:if_split_asm)\n    by(auto dest: matches_dest)\n  lemma match_list_helper3: \"matches \\<gamma> m a d p \\<Longrightarrow> match_list \\<gamma> m2' a d p \\<Longrightarrow> match_list \\<gamma> (map (MatchAnd m) m2') a d p\"\n    apply(induction m2')\n     apply(simp; fail)\n    apply(simp split:if_split_asm)\n    by (simp add: matches_simps)\n  lemma match_list_helper4: \"\\<not> match_list \\<gamma> m2' a d p \\<Longrightarrow> \\<not> match_list \\<gamma> (map (MatchAnd aa) m2') a d p \"\n    apply(induction m2')\n     apply(simp; fail)\n    apply(simp split:if_split_asm)\n    by(auto dest: matches_dest)\n  lemma match_list_helper5: \" \\<not> match_list \\<gamma> m2' a d p \\<Longrightarrow> \\<not> match_list \\<gamma> (concat (map (\\<lambda>x. map (MatchAnd x) m2') m1')) a d p \"\n    apply(induction m2')\n     apply(simp add:empty_concat; fail)\n    apply(simp split:if_split_asm)\n    apply(induction m1')\n     apply(simp; fail)\n    apply(simp add: match_list_append)\n    by(auto dest: matches_dest)\n  lemma match_list_helper6: \"\\<not> match_list \\<gamma> m1' a d p \\<Longrightarrow> \\<not> match_list \\<gamma> (concat (map (\\<lambda>x. map (MatchAnd x) m2') m1')) a d p \"\n    apply(induction m2')\n     apply(simp add:empty_concat; fail)\n    apply(simp split:if_split_asm)\n    apply(induction m1')\n     apply(simp; fail)\n    apply(simp add: match_list_append split: if_split_asm)\n    by(auto dest: matches_dest)\n  \n  lemmas match_list_helper = match_list_helper1 match_list_helper2 match_list_helper3 match_list_helper4 match_list_helper5 match_list_helper6\n  hide_fact match_list_helper1 match_list_helper2 match_list_helper3 match_list_helper4 match_list_helper5 match_list_helper6\n\n  lemma match_list_map_And1: \"matches \\<gamma> m1 a d p = match_list \\<gamma> m1' a d p \\<Longrightarrow>\n           matches \\<gamma> (MatchAnd m1 m2) a d p \\<longleftrightarrow> match_list \\<gamma>  (map (\\<lambda>x. MatchAnd x m2) m1') a d p\"\n    apply(induction m1')\n     apply(auto dest: matches_dest; fail)[1]\n    apply(simp split: if_split_asm)\n     apply safe\n        apply(simp_all add: matches_simps)\n      apply(auto dest: match_list_helper(1))[1]\n     by(auto dest: matches_dest)\n\n  lemma matches_list_And_concat: \"matches \\<gamma> m1 a d p = match_list \\<gamma> m1' a d p \\<Longrightarrow> matches \\<gamma> m2 a d p = match_list \\<gamma> m2' a d p \\<Longrightarrow>\n           matches \\<gamma> (MatchAnd m1 m2) a d p \\<longleftrightarrow> match_list \\<gamma> [MatchAnd x y. x <- m1', y <- m2'] a d p\"\n    apply(induction m1')\n     apply(auto dest: matches_dest; fail)[1]\n    apply(simp split: if_split_asm)\n     prefer 2\n     apply(simp add: match_list_append)\n     apply(subgoal_tac \"\\<not> match_list \\<gamma> (map (MatchAnd aa) m2') a d p\")\n      apply(simp; fail)\n     apply safe\n               apply(simp_all add: matches_simps match_list_append match_list_helper)\n    done\n\n  lemma match_list_concat: \"match_list \\<gamma> (concat lss) a d p \\<longleftrightarrow> (\\<exists>ls \\<in> set lss. match_list \\<gamma> ls a d p)\"\n    apply(induction lss)\n     apply(simp; fail)\n    by(auto simp add: match_list_append)\n    \n\nend\n", "meta": {"author": "Sohalt", "repo": "pf-verification", "sha": "328f850913723dee6c9f6be069fbbc22a3762354", "save_path": "github-repos/isabelle/Sohalt-pf-verification", "path": "github-repos/isabelle/Sohalt-pf-verification/pf-verification-328f850913723dee6c9f6be069fbbc22a3762354/SemanticsTernary/PF_Fixed_Action.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.3041835981678674}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Late_Sim_Pres\n  imports Weak_Late_Sim\nbegin\n\nlemma tauPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"\\<tau>.(P) \\<leadsto>\\<^sup>^<Rel> \\<tau>.(Q)\"\nproof(induct rule: simCases)\n  case(Bound Q' a x)\n  have \"\\<tau>.(Q) \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Input Q' a x)\n  have \"\\<tau>.(Q) \\<longmapsto>a<x> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Free Q' \\<alpha>)\n  have \"\\<tau>.(Q) \\<longmapsto>(\\<alpha> \\<prec> Q')\" by fact\n  thus ?case using PRelQ\n  proof(induct rule: tauCases, auto simp add: pi.inject residual.inject)\n    have \"\\<tau>.(P) \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<tau> \\<prec> P\" by(rule Tau)\n    moreover assume \"(P, Q') \\<in> Rel\"\n    ultimately show \"\\<exists>P'. \\<tau>.(P) \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<tau> \\<prec> P' \\<and> (P', Q') \\<in> Rel\" by blast\n  qed\nqed\n\nlemma inputPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   x    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"\\<forall>y. (P[x::=y], Q[x::=y]) \\<in> Rel\"\n  and     Eqvt: \"eqvt Rel\"\n\n  shows \"a<x>.P \\<leadsto>\\<^sup>^<Rel> a<x>.Q\"\nproof -\n  show ?thesis using Eqvt\n  proof(induct rule: simCasesCont[of _ \"(P, a, x, Q)\"])\n    case(Bound Q' b y)\n    have \"a<x>.Q \\<longmapsto>b<\\<nu>y> \\<prec> Q'\" by fact\n    hence False by auto\n    thus ?case by simp\n  next\n    case(Input Q' b y)\n    have \"y \\<sharp> (P, a, x, Q)\" by fact\n    hence yFreshP: \"(y::name) \\<sharp> P\" and yineqx: \"y \\<noteq> x\" and \"y \\<noteq> a\" and \"y \\<sharp> Q\"\n      by(simp add: fresh_prod)+\n    have \"a<x>.Q \\<longmapsto>b<y> \\<prec> Q'\" by fact\n    thus ?case using \\<open>y \\<noteq> a\\<close> \\<open>y \\<noteq> x\\<close> \\<open>y \\<sharp> Q\\<close>\n    proof(induct rule: inputCases, auto simp add: subject.inject)\n      have \"\\<forall>u. \\<exists>P'. a<x>.P \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> P' \\<and> (P', ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\"\n      proof(rule allI)\n        fix u\n        have \"a<x>.P \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> ([(x, y)] \\<bullet> P)[y::=u]\" (is \"?goal\")\n        proof -\n          from yFreshP have \"a<x>.P = a<y>.([(x, y)] \\<bullet> P)\" by(rule Agent.alphaInput)\n          moreover have \"a<y>.([(x, y)] \\<bullet> P) \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> ([(x, y)] \\<bullet> P)[y::=u]\" \n            by(rule Weak_Late_Step_Semantics.Input)\n          ultimately show ?goal by(simp add: name_swap)\n        qed\n\n        moreover have \"(([(x, y)] \\<bullet> P)[y::=u], ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\"\n        proof -\n          from PRelQ have \"(P[x::=u], Q[x::=u]) \\<in> Rel\" by auto\n          with \\<open>y \\<sharp> P\\<close> \\<open>y \\<sharp> Q\\<close> show ?thesis by(simp add: renaming)\n        qed\n        \n        ultimately show \"\\<exists>P'. a<x>.P \\<Longrightarrow>\\<^sub>lu in ([(x, y)] \\<bullet> P)\\<rightarrow>a<y> \\<prec> P' \\<and> (P', ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\" \n          by blast\n      qed\n      \n      thus \"\\<exists>P''. \\<forall>u. \\<exists>P'. a<x>.P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<y> \\<prec> P' \\<and> (P', ([(x, y)] \\<bullet> Q)[y::=u]) \\<in> Rel\" by blast\n    qed\n  next\n    case(Free Q' \\<alpha>)\n    have \"a<x>.Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n    hence False by auto\n    thus ?case by simp\n  qed\nqed\n\nlemma outputPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"a{b}.P \\<leadsto>\\<^sup>^<Rel> a{b}.Q\"\nproof(induct rule: simCases)\n  case(Bound Q' c x)\n  have \"a{b}.Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Input Q' c x)\n  have \"a{b}.Q \\<longmapsto>c<x> \\<prec> Q'\" by fact\n  hence False by auto\n  thus ?case by simp\nnext\n  case(Free Q' \\<alpha>)\n  have \"a{b}.Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus \"\\<exists>P'. a{b}.P \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\" using PRelQ\n  proof(induct rule: outputCases, auto simp add: pi.inject residual.inject)\n    have \"a{b}.P \\<Longrightarrow>\\<^sub>l\\<^sup>^ a[b] \\<prec> P\" by(rule Output)\n    moreover assume \"(P, Q') \\<in> Rel\"\n    ultimately show \"\\<exists>P'. a{b}.P \\<Longrightarrow>\\<^sub>l\\<^sup>^ a[b] \\<prec> P' \\<and> (P', Q') \\<in> Rel\" by blast\n  qed\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto>\\<^sup>^<Rel> Q\"\n  and     RelStay: \"\\<And>P Q a. (P, Q) \\<in> Rel \\<Longrightarrow> ([a\\<frown>a]P, Q) \\<in> Rel\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"[a\\<frown>b]P \\<leadsto>\\<^sup>^<Rel'> [a\\<frown>b]Q\"\nproof(induct rule: simCases)\n  case(Bound Q' c x)\n  have \"x \\<sharp> [a\\<frown>b]P\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n  have \"[a\\<frown>b]Q \\<longmapsto> c<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case cMatch\n    have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^c<\\<nu>x> \\<prec> P'\"\n                                   and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>\\<^sub>l\\<^sup>^c<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Semantics.Match)\n    with P'RelQ' RelRel' show ?case by blast\n  qed\nnext\n  case(Input Q' c x)\n  have \"x \\<sharp> [a\\<frown>b]P\" by fact\n  hence xFreshP: \"x \\<sharp> P\" by simp\n  have \"[a\\<frown>b]Q \\<longmapsto>c<x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case cMatch\n    have \"Q \\<longmapsto> c<x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\"\n      by(force intro: simE)\n    have \"\\<forall>u. \\<exists>P'. [a\\<frown>a]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n    proof(rule allI)\n      fix u\n      from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\"\n        by blast\n      from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Match)\n      with P'RelQ' RelRel' show \"\\<exists>P'. [a\\<frown>a]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n        by blast\n    qed\n    thus ?case by blast\n  qed\nnext\n  case(Free Q' \\<alpha>)\n  have \"[a\\<frown>b]Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case cMatch\n    have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans show ?case\n    proof(induct rule: transitionCases)\n      case Step\n      have \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by fact\n      hence \"[a\\<frown>a]P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Match)\n      with PRel RelRel' show ?case by(force simp add: weakTransition_def)\n    next\n      case Stay\n      have \"\\<alpha> \\<prec> P' = \\<tau> \\<prec> P\" by fact\n      hence alphaEqTau: \"\\<alpha> = \\<tau>\" and PeqP': \"P = P'\" by(simp add: residual.inject)+\n      have \"[a\\<frown>a]P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> [a\\<frown>a]P\" by(simp add: weakTransition_def)\n      moreover from PeqP' PRel have \"([a\\<frown>a]P, Q') \\<in> Rel\" by(blast intro: RelStay)\n      ultimately show ?case using RelRel' alphaEqTau by blast\n    qed\n  qed\nqed\n\nlemma mismatchPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto>\\<^sup>^<Rel> Q\"\n  and     RelStay: \"\\<And>P Q a b. \\<lbrakk>(P, Q) \\<in> Rel; a \\<noteq> b\\<rbrakk> \\<Longrightarrow> ([a\\<noteq>b]P, Q) \\<in> Rel\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n\n  shows \"[a\\<noteq>b]P \\<leadsto>\\<^sup>^<Rel'> [a\\<noteq>b]Q\"\nproof(cases \"a = b\")\n  assume \"a = b\"\n  thus ?thesis by(auto simp add: weakSimulation_def)\nnext\n  assume aineqb: \"a \\<noteq> b\"\n  show ?thesis\n  proof(induct rule: simCases)\n    case(Bound Q' c x)\n    have \"x \\<sharp> [a\\<noteq>b]P\" by fact\n    hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n    have \"[a\\<noteq>b]Q \\<longmapsto> c<\\<nu>x> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case cMismatch\n      have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n      with PSimQ xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^c<\\<nu>x> \\<prec> P'\"\n        and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans aineqb have \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sub>l\\<^sup>^c<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Semantics.Mismatch)\n      with P'RelQ' RelRel' show ?case by blast\n    qed\n  next\n    case(Input Q' c x)\n    have \"x \\<sharp> [a\\<noteq>b]P\" by fact\n    hence xFreshP: \"x \\<sharp> P\" by simp\n    have \"[a\\<noteq>b]Q \\<longmapsto>c<x> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case cMismatch\n      have \"Q \\<longmapsto> c<x> \\<prec> Q'\" by fact\n      with PSimQ xFreshP obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\"\n        by(force intro: simE)\n      have \"\\<forall>u. \\<exists>P'. [a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n      proof(rule allI)\n        fix u\n        from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\"\n          by blast\n        from PTrans aineqb have \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Mismatch)\n        with P'RelQ' RelRel' show \"\\<exists>P'. [a\\<noteq>b]P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>c<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n          by blast\n      qed\n      thus ?case by blast\n    qed\n  next\n    case(Free Q' \\<alpha>)\n    have \"[a\\<noteq>b]Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: mismatchCases)\n      case cMismatch\n      have \"a \\<noteq> b\" by fact\n      have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans show ?case\n      proof(induct rule: transitionCases)\n        case Step\n        have \"P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by fact\n        hence \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" using \\<open>a \\<noteq> b\\<close> by(rule Weak_Late_Step_Semantics.Mismatch)\n        with PRel RelRel' show ?case by(force simp add: weakTransition_def)\n      next\n        case Stay\n        have \"\\<alpha> \\<prec> P' = \\<tau> \\<prec> P\" by fact\n        hence alphaEqTau: \"\\<alpha> = \\<tau>\" and PeqP': \"P = P'\" by(simp add: residual.inject)+\n        have \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> [a\\<noteq>b]P\" by(simp add: weakTransition_def)\n        moreover from PeqP' PRel aineqb have \"([a\\<noteq>b]P, Q') \\<in> Rel\" by(blast intro: RelStay)\n        ultimately show ?case using alphaEqTau RelRel' by blast\n      qed\n    qed\n  qed\nqed\n\nlemma parCompose:\n  fixes P     :: pi\n  and   Q     :: pi\n  and   R     :: pi\n  and   T     :: pi\n  and   Rel   :: \"(pi \\<times> pi) set\"\n  and   Rel'  :: \"(pi \\<times> pi) set\"\n  and   Rel'' :: \"(pi \\<times> pi) set\"\n  \n  assumes PSimQ:    \"P \\<leadsto>\\<^sup>^<Rel> Q\"\n  and     RSimT:    \"R \\<leadsto>\\<^sup>^<Rel'> T\"\n  and     PRelQ:    \"(P, Q) \\<in> Rel\"\n  and     RRel'T:   \"(R, T) \\<in> Rel'\"\n  and     Par:      \"\\<And>P Q R T. \\<lbrakk>(P, Q) \\<in> Rel; (R, T) \\<in> Rel'\\<rbrakk> \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> T) \\<in> Rel''\"\n  and     Res:      \"\\<And>P Q a. (P, Q) \\<in> Rel'' \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> Rel''\"\n  and     EqvtRel:  \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n  and     EqvtRel'': \"eqvt Rel''\"\n\n  shows \"P \\<parallel> R \\<leadsto>\\<^sup>^<Rel''> Q \\<parallel> T\"\nusing \\<open>eqvt Rel''\\<close>\nproof(induct rule: simCasesCont[where C=\"(P, Q, R, T)\"])\n  case(Bound Q' a x)\n  from \\<open>x \\<sharp> (P, Q, R, T)\\<close> have \"x \\<sharp> P\" and \"x \\<sharp> R\" and \"x \\<sharp> Q\" and \"x \\<sharp> T\" by simp+\n  from \\<open>Q \\<parallel> T \\<longmapsto> a<\\<nu>x> \\<prec> Q'\\<close> \\<open>x \\<sharp> Q\\<close> \\<open>x \\<sharp> T\\<close>\n  show ?case\n  proof(induct rule: parCasesB)\n    case(cPar1 Q')\n    from PSimQ \\<open>Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\\<close> \\<open>x \\<sharp> P\\<close> obtain P' where PTrans:\"P \\<Longrightarrow>\\<^sub>l\\<^sup>^ a<\\<nu>x> \\<prec> P'\"\n                                                      and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans \\<open>x \\<sharp> R\\<close> have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^ a<\\<nu>x> \\<prec> (P' \\<parallel> R)\" by(rule Weak_Late_Semantics.Par1B)\n    moreover from P'RelQ' RRel'T have \"(P' \\<parallel> R, Q' \\<parallel> T) \\<in> Rel''\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cPar2 T')\n    from RSimT \\<open>T \\<longmapsto> a<\\<nu>x> \\<prec> T'\\<close> \\<open>x \\<sharp> R\\<close> obtain R' where RTrans:\"R \\<Longrightarrow>\\<^sub>l\\<^sup>^ a<\\<nu>x> \\<prec> R'\"\n                                                      and R'Rel'T': \"(R', T') \\<in>  Rel'\"\n      by(blast dest: simE)\n    from RTrans \\<open>x \\<sharp> P\\<close> \\<open>x \\<sharp> R\\<close> have ParTrans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^ a<\\<nu>x> \\<prec> (P \\<parallel> R')\"\n      by(blast intro: Weak_Late_Semantics.Par2B)\n    moreover from PRelQ R'Rel'T' have \"(P \\<parallel> R', Q \\<parallel>  T') \\<in> Rel''\" by(rule Par)\n    ultimately show ?case by blast\n  qed\nnext\n  case(Input Q' a x)\n  from \\<open>x \\<sharp> (P, Q, R, T)\\<close> have \"x \\<sharp> P\" and \"x \\<sharp> R\" and \"x \\<sharp> Q\" and \"x \\<sharp> T\" by simp+\n  from \\<open>Q \\<parallel> T \\<longmapsto> a<x> \\<prec> Q'\\<close> \\<open>x \\<sharp> Q\\<close> \\<open>x \\<sharp> T\\<close>\n  show ?case\n  proof(induct rule: parCasesB)\n    case(cPar1 Q')\n    from PSimQ \\<open>Q \\<longmapsto>a<x> \\<prec> Q'\\<close> \\<open>x \\<sharp> P\\<close> obtain P''\n      where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\" \n      by(blast dest: simE)\n    have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u] \\<parallel> T[x::=u]) \\<in> Rel''\"\n    proof(rule allI)\n      fix u\n      from L1 obtain P' where PTrans:\"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                          and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\" by blast\n      from PTrans \\<open>x \\<sharp> R\\<close> have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> (P' \\<parallel> R)\"\n        by(rule Weak_Late_Step_Semantics.Par1B)\n      moreover from P'RelQ' RRel'T have \"(P' \\<parallel> R, Q'[x::=u] \\<parallel> T) \\<in> Rel''\" by(rule Par)\n      ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and>\n                            (P', Q'[x::=u] \\<parallel> (T[x::=u])) \\<in> Rel''\" using \\<open>x \\<sharp> T\\<close>\n        by(force simp add: forget)\n    qed\n    thus ?case by force\n  next\n    case(cPar2 T')\n    from RSimT \\<open>T \\<longmapsto>a<x> \\<prec> T'\\<close> \\<open>x \\<sharp> R\\<close> obtain R''\n      where L1: \"\\<forall>u. \\<exists>R'. R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R' \\<and> (R', T'[x::=u]) \\<in> Rel'\"\n      by(blast dest: simE)\n    have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q[x::=u] \\<parallel> T'[x::=u]) \\<in> Rel''\"\n    proof(rule allI)\n      fix u\n      from L1 obtain R' where RTrans:\"R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R'\"\n                          and R'Rel'T': \"(R', T'[x::=u]) \\<in>  Rel'\" by blast\n      from RTrans \\<open>x \\<sharp> P\\<close> have ParTrans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> (P \\<parallel> R')\"\n        by(rule Weak_Late_Step_Semantics.Par2B)\n      \n      moreover from PRelQ R'Rel'T' have \"(P \\<parallel> R', Q \\<parallel>  T'[x::=u]) \\<in> Rel''\" by(rule Par)\n      \n      ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P' \\<and>\n                            (P', Q[x::=u] \\<parallel> T'[x::=u]) \\<in> Rel''\" using \\<open>x \\<sharp> Q\\<close>\n        by(force simp add: forget)\n    qed\n    thus ?case by force\n  qed\nnext\n  case(Free QT' \\<alpha>)\n  have \"Q \\<parallel> T \\<longmapsto> \\<alpha> \\<prec> QT'\" by fact\n  thus ?case\n  proof(induct rule: parCasesF[of _ _ _ _ _ \"(P, R)\"])\n    case(cPar1 Q')\n    have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Late_Semantics.Par1F)\n    moreover from PRel RRel'T have \"(P' \\<parallel> R, Q' \\<parallel> T) \\<in> Rel''\" by(blast intro: Par)\n    ultimately show ?case by blast\n  next\n    case(cPar2 T')\n    have \"T \\<longmapsto> \\<alpha> \\<prec> T'\" by fact\n    with RSimT obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<alpha> \\<prec> R'\" and RRel: \"(R', T') \\<in> Rel'\"\n      by(blast dest: simE)\n    from RTrans have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<alpha> \\<prec> P \\<parallel> R'\" by(rule Weak_Late_Semantics.Par2F)\n    moreover from PRelQ RRel have \"(P \\<parallel> R', Q \\<parallel> T') \\<in> Rel''\" by(blast intro: Par)\n    ultimately show ?case by blast\n  next\n    case(cComm1 Q' T' a b x)\n    have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" and TTrans: \"T \\<longmapsto> a[b] \\<prec> T'\" by fact+\n    have \"x \\<sharp> (P, R)\" by fact\n    hence xFreshP: \"x \\<sharp> P\" by(simp add: fresh_prod)\n\n    from PSimQ QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>lb in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=b]) \\<in> Rel\"\n      by(blast dest: simE)\n      \n    from RSimT TTrans obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<^sup>^a[b] \\<prec> R'\"\n                                  and RRel: \"(R', T') \\<in> Rel'\"\n      by(blast dest: simE)\n      \n    from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<tau> \\<prec> P' \\<parallel> R'\" by(rule Weak_Late_Semantics.Comm1)\n    moreover from P'RelQ' RRel have \"(P' \\<parallel> R', Q'[x::=b] \\<parallel> T') \\<in> Rel''\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cComm2 Q' T' a b x)\n    have QTrans: \"Q \\<longmapsto>a[b] \\<prec> Q'\" and TTrans: \"T \\<longmapsto>a<x> \\<prec> T'\" by fact+\n    have \"x \\<sharp> (P, R)\" by fact\n    hence xFreshR: \"x \\<sharp> R\" by(simp add: fresh_prod)\n      \n    from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a[b] \\<prec> P'\"\n                                  and PRel: \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    \n    from RSimT TTrans xFreshR obtain R' R'' where RTrans: \"R \\<Longrightarrow>\\<^sub>lb in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                              and R'Rel'T': \"(R', T'[x::=b]) \\<in> Rel'\"\n      by(blast dest: simE)\n      \n    from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<tau> \\<prec> P' \\<parallel> R'\" by(rule Weak_Late_Semantics.Comm2)\n    moreover from PRel R'Rel'T' have \"(P' \\<parallel> R', Q' \\<parallel> T'[x::=b]) \\<in> Rel''\" by(rule Par)\n    ultimately show ?case by blast\n  next\n    case(cClose1 Q' T' a x y)\n    have QTrans: \"Q \\<longmapsto>a<x> \\<prec> Q'\" and TTrans: \"T \\<longmapsto>a<\\<nu>y> \\<prec> T'\" by fact+\n    have \"x \\<sharp> (P, R)\" and \"y \\<sharp> (P, R)\" by fact+\n    hence xFreshP: \"x \\<sharp> P\" and yFreshR: \"y \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" by(simp add: fresh_prod)+\n      \n    from PSimQ QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>ly in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=y]) \\<in> Rel\"\n      by(blast dest: simE)\n      \n    from RSimT TTrans yFreshR obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>y> \\<prec> R'\" \n                                          and R'Rel'T': \"(R', T') \\<in> Rel'\"\n      by(blast dest: simE)\n      \n    from PTrans RTrans yFreshP yFreshR have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R')\"\n      by(rule Weak_Late_Semantics.Close1)\n    moreover from P'RelQ' R'Rel'T' have \"(<\\<nu>y>(P' \\<parallel> R'), <\\<nu>y>(Q'[x::=y] \\<parallel> T')) \\<in> Rel''\"\n      by(blast intro: Par Res)\n    ultimately show ?case by blast\n  next\n    case(cClose2 Q' T' a x y)\n    have QTrans: \"Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" and TTrans: \"T \\<longmapsto>a<x> \\<prec> T'\" by fact+\n    have \"x \\<sharp> (P, R)\" and \"y \\<sharp> (P, R)\" by fact+\n    hence xFreshR: \"x \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" and yFreshR: \"y \\<sharp> R\" by(simp add: fresh_prod)+\n\n    from PSimQ QTrans yFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>y> \\<prec> P'\"\n                                          and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n      \n    from RSimT TTrans xFreshR obtain R' R'' where RTrans: \"R \\<Longrightarrow>\\<^sub>ly in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                              and R'Rel'T': \"(R', T'[x::=y]) \\<in> Rel'\"\n      by(blast dest: simE)\n      \n    from PTrans RTrans yFreshP yFreshR have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R')\"\n      by(rule Weak_Late_Semantics.Close2)\n    moreover from P'RelQ' R'Rel'T' have \"(<\\<nu>y>(P' \\<parallel> R'), <\\<nu>y>(Q' \\<parallel> T'[x::=y])) \\<in> Rel''\"\n      by(blast intro: Par Res)\n    ultimately show ?case by blast\n  qed\nqed\n\nlemma parPres:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   R   :: pi\n  and   a   :: name\n  and   b   :: name\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n  \n  assumes PSimQ:    \"P \\<leadsto>\\<^sup>^<Rel> Q\"\n  and     PRelQ:    \"(P, Q) \\<in> Rel\"\n  and     Par:      \"\\<And>P Q R. (P, Q) \\<in> Rel \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> R) \\<in> Rel'\"\n  and     Res:      \"\\<And>P Q a. (P, Q) \\<in> Rel' \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> Rel'\"\n  and     EqvtRel:  \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"P \\<parallel> R \\<leadsto>\\<^sup>^<Rel'> Q \\<parallel> R\"\nproof -\n  note PSimQ \n  moreover have RSimR: \"R \\<leadsto>\\<^sup>^<Id> R\" by(auto intro: reflexive)\n  moreover note PRelQ moreover have \"(R, R) \\<in> Id\" by auto\n  moreover from Par have \"\\<And>P Q R T. \\<lbrakk>(P, Q) \\<in> Rel; (R, T) \\<in> Id\\<rbrakk> \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> T) \\<in> Rel'\"\n    by auto\n  moreover note Res \\<open>eqvt Rel\\<close>\n  moreover have \"eqvt Id\" by(auto simp add: eqvt_def)\n  ultimately show ?thesis using EqvtRel' by(rule parCompose)\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto>\\<^sup>^<Rel> Q\"\n  and     ResRel: \"\\<And>(P::pi) (Q::pi) (x::name). (P, Q) \\<in> Rel \\<Longrightarrow> (<\\<nu>x>P, <\\<nu>x>Q) \\<in> Rel'\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     EqvtRel: \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"<\\<nu>x>P \\<leadsto>\\<^sup>^<Rel'> <\\<nu>x>Q\"\nproof -\n  from EqvtRel' show ?thesis\n  proof(induct rule: simCasesCont[of _ \"(P, Q, x)\"])\n    case(Bound Q' a y)\n    have Trans: \"<\\<nu>x>Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n    have \"y \\<sharp> (P, Q, x)\" by fact\n    hence yineqx: \"y \\<noteq> x\" and yFreshP: \"y \\<sharp> P\" and \"y \\<sharp> Q\" by(simp add: fresh_prod)+\n    from Trans \\<open>y \\<noteq> x\\<close> \\<open>y \\<sharp> Q\\<close> show ?case\n    proof(induct rule: resCasesB)\n      case(cOpen a Q')\n      have QTrans: \"Q \\<longmapsto>a[x] \\<prec> Q'\" and aineqx: \"a \\<noteq> x\" by fact+\n\n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a[x] \\<prec> P'\"\n                                    and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n\n      have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>y> \\<prec> ([(y, x)] \\<bullet> P')\"\n      proof -\n        from PTrans aineqx have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\" by(rule Weak_Late_Semantics.Open)\n        moreover from PTrans yFreshP have \"y \\<sharp> P'\" by(force intro: freshTransition)\n        ultimately show ?thesis by(simp add: alphaBoundResidual name_swap) \n      qed\n      moreover from EqvtRel P'RelQ' RelRel' have \"([(y, x)] \\<bullet> P', [(y, x)] \\<bullet> Q') \\<in> Rel'\"\n        by(blast intro: eqvtRelI)\n      ultimately show ?case by blast\n    next\n      case(cRes Q')\n      have QTrans: \"Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n      from \\<open>x \\<sharp> BoundOutputS a\\<close> have \"x \\<noteq> a\" by simp\n\n      from PSimQ yFreshP QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>y> \\<prec> P'\"\n                                            and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans \\<open>x \\<noteq> a\\<close> yineqx yFreshP have ResTrans: \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>y> \\<prec> (<\\<nu>x>P')\"\n        by(blast intro: Weak_Late_Semantics.ResB)\n      moreover from P'RelQ' have \"((<\\<nu>x>P'), (<\\<nu>x>Q')) \\<in> Rel'\"\n        by(rule ResRel)\n      ultimately show ?case by blast\n    qed\n  next\n    case(Input Q' a y)\n    have \"y \\<sharp> (P, Q, x)\" by fact\n    hence yineqx: \"y \\<noteq> x\" and yFreshP: \"y \\<sharp> P\" and \"y \\<sharp> Q\" by(simp add: fresh_prod)+   \n    have \"<\\<nu>x>Q \\<longmapsto>a<y> \\<prec> Q'\" by fact\n    thus ?case using yineqx \\<open>y \\<sharp> Q\\<close>\n    proof(induct rule: resCasesB)\n      case(cOpen a Q')\n      thus ?case by simp\n    next\n      case(cRes Q')\n      have QTrans: \"Q \\<longmapsto>a<y> \\<prec> Q'\" by fact\n      from \\<open>x \\<sharp> InputS a\\<close> have \"x \\<noteq> a\" by simp\n      \n      from PSimQ QTrans yFreshP obtain P''\n        where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<y> \\<prec> P' \\<and> (P', Q'[y::=u]) \\<in> Rel\"\n        by(blast dest: simE)\n      have \"\\<forall>u. \\<exists>P'. <\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> P' \\<and> (P', (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n      proof(rule allI)\n        fix u\n        show \"\\<exists>P'. <\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in <\\<nu>x>P''\\<rightarrow>a<y> \\<prec> P' \\<and> (P', (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n        proof(cases \"x=u\")\n          assume xequ: \"x=u\"\n\n          have \"\\<exists>c::name. c \\<sharp> (P, P'', Q', x, y, a)\" by(blast intro: name_exists_fresh)\n          then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshP'': \"c \\<sharp> P''\" and cFreshQ': \"c \\<sharp> Q'\"\n                                and cineqx: \"c \\<noteq> x\" and cineqy: \"c \\<noteq> y\" and cineqa: \"c \\<noteq> a\"\n            by(force simp add: fresh_prod)\n        \n          from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lc in P''\\<rightarrow>a<y> \\<prec> P'\"\n                              and P'RelQ': \"(P', Q'[y::=c]) \\<in> Rel\"\n            by blast\n          have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> <\\<nu>c>([(x, c)] \\<bullet> P')\"\n          proof -\n            from PTrans yineqx \\<open>x \\<noteq> a\\<close> cineqx have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>lc in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> <\\<nu>x>P'\"\n              by(blast intro: Weak_Late_Step_Semantics.ResB)\n            hence \"([(x, c)] \\<bullet> <\\<nu>x>P) \\<Longrightarrow>\\<^sub>l([(x, c)] \\<bullet> c) in ([(x, c)] \\<bullet> <\\<nu>x>P'')\\<rightarrow>([(x, c)] \\<bullet> a)<([(x, c)] \\<bullet> y)> \\<prec> [(x, c)] \\<bullet> <\\<nu>x>P'\"\n              by(rule Weak_Late_Step_Semantics.eqvtI)\n            moreover from cFreshP have \"<\\<nu>c>([(x, c)] \\<bullet> P) = <\\<nu>x>P\" by(simp add: alphaRes)\n            moreover from cFreshP'' have \"<\\<nu>c>([(x, c)] \\<bullet> P'') = <\\<nu>x>P''\" by(simp add: alphaRes)\n            ultimately show ?thesis using \\<open>x \\<noteq> a\\<close> cineqa yineqx cineqy cineqx xequ by(simp add: name_calc)\n          qed\n          moreover have \"(<\\<nu>c>([(x, c)] \\<bullet> P'), (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n          proof -\n            from P'RelQ' have \"(<\\<nu>x>P', <\\<nu>x>(Q'[y::=c])) \\<in> Rel'\" by(rule ResRel)\n            with EqvtRel' have \"([(x, c)] \\<bullet> <\\<nu>x>P', [(x, c)] \\<bullet> <\\<nu>x>(Q'[y::=c])) \\<in> Rel'\"  by(rule eqvtRelI)\n            with cineqy yineqx cineqx have \"(<\\<nu>c>([(x, c)] \\<bullet> P'), (<\\<nu>c>([(x, c)] \\<bullet> Q'))[y::=x]) \\<in> Rel'\"\n              by(simp add: name_calc eqvt_subs)\n            with cFreshQ' xequ show ?thesis by(simp add: alphaRes)\n          qed\n          ultimately show ?thesis by blast\n        next\n          assume xinequ: \"x \\<noteq> u\"\n          from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<y> \\<prec> P'\"\n                             and P'RelQ': \"(P', Q'[y::=u]) \\<in> Rel\" by blast\n          \n          from PTrans \\<open>x \\<noteq> a\\<close> yineqx xinequ have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>lu in (<\\<nu>x>P'')\\<rightarrow>a<y> \\<prec> <\\<nu>x>P'\"\n            by(blast intro: Weak_Late_Step_Semantics.ResB)\n          moreover from P'RelQ' xinequ yineqx have \"(<\\<nu>x>P', (<\\<nu>x>Q')[y::=u]) \\<in> Rel'\"\n            by(force intro: ResRel)\n          ultimately show ?thesis by blast\n        qed\n      qed\n      thus ?case by blast\n    qed\n  next\n    case(Free Q' \\<alpha>)\n    have \"<\\<nu>x>Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: resCasesF)\n      case(cRes Q')\n      have \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^ \\<alpha> \\<prec> P'\"\n                             and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      \n      have \"<\\<nu>x>P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> <\\<nu>x>P'\"\n      proof -\n        have xFreshAlpha: \"x \\<sharp> \\<alpha>\" by fact\n        with PTrans show ?thesis by(rule ResF)\n      qed\n      moreover from P'RelQ' have \"(<\\<nu>x>P', <\\<nu>x>Q') \\<in> Rel'\" by(rule ResRel)\n      ultimately show ?case by blast\n    qed\n  qed\nqed\n\nlemma resChainI:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   lst :: \"name list\"\n\n  assumes eqvtRel: \"eqvt Rel\"\n  and     Res:     \"\\<And>P Q a. (P, Q) \\<in> Rel \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> Rel\"\n  and     PRelQ:   \"P \\<leadsto>\\<^sup>^<Rel> Q\"\n\n  shows \"(resChain lst) P \\<leadsto>\\<^sup>^<Rel> (resChain lst) Q\"\nproof -\n  show ?thesis\n  proof(induct lst) (* Base case *)\n    from PRelQ show \"resChain [] P \\<leadsto>\\<^sup>^<Rel> resChain [] Q\" by simp\n  next (* Inductive step *)\n    fix a lst\n    assume IH: \"(resChain lst P) \\<leadsto>\\<^sup>^<Rel> (resChain lst Q)\"\n    moreover from Res have \"\\<And>P Q a. (P, Q) \\<in> Rel \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> Rel\"\n      by simp\n    moreover have \"Rel \\<subseteq> Rel\" by simp\n    ultimately have \"<\\<nu>a>(resChain lst P) \\<leadsto>\\<^sup>^<Rel> <\\<nu>a>(resChain lst Q)\" using eqvtRel\n      by(rule_tac resPres)\n    thus \"resChain (a # lst) P \\<leadsto>\\<^sup>^<Rel> resChain (a # lst) Q\"\n      by simp\n  qed\nqed\n\n\n\n  and     ParComp:     \"\\<And>P Q R T. \\<lbrakk>(P, Q) \\<in> Rel; (R, T) \\<in> Rel'\\<rbrakk> \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> T) \\<in> Rel'\"\n  and     Res:         \"\\<And>P Q x. (P, Q) \\<in> Rel' \\<Longrightarrow> (<\\<nu>x>P, <\\<nu>x>Q) \\<in> Rel'\"\n\n  and     RelStay:        \"\\<And>P Q. (P \\<parallel> !P, Q) \\<in> Rel' \\<Longrightarrow> (!P, Q) \\<in> Rel'\"\n  and     BangRelRel': \"(bangRel Rel) \\<subseteq> Rel'\"\n  and     eqvtRel':    \"eqvt Rel'\"\n\n  shows \"!P \\<leadsto>\\<^sup>^<Rel'> !Q\"\nproof -\n  have \"\\<And>Rs P. \\<lbrakk>!Q \\<longmapsto> Rs; (P, !Q) \\<in> bangRel Rel\\<rbrakk> \\<Longrightarrow> weakSimAct P Rs P Rel'\"\n  proof -\n    fix Rs P\n    assume \"!Q \\<longmapsto> Rs\" and \"(P, !Q) \\<in> bangRel Rel\"\n    thus \"weakSimAct P Rs P Rel'\"\n    proof(nominal_induct avoiding: P rule: bangInduct)\n      case(cPar1B aa x Q')\n      have QTrans: \"Q \\<longmapsto>aa\\<guillemotleft>x\\<guillemotright> \\<prec> Q'\" and xFreshQ: \"x \\<sharp> Q\" by fact+\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelT: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        from PRelQ have PSimQ: \"P \\<leadsto>\\<^sup>^<Rel> Q\" by(rule Sim)\n        from eqvtRel' show ?case\n        proof(induct rule: simActBoundCases)\n          case(Input a)\n          have \"aa = InputS a\" by fact\n          with PSimQ QTrans xFreshP obtain P''\n            where L1: \"\\<forall>u. \\<exists>P'. P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel\"\n            by(blast dest: simE)\n          have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and> (P', (Q' \\<parallel> !Q)[x::=u]) \\<in> Rel'\"\n          proof(rule allI)\n            fix u\n            from L1 obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel\"\n              by blast\n            \n            from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x>\\<prec> P' \\<parallel> R\"\n              by(rule Weak_Late_Step_Semantics.Par1B)\n            moreover have \"(P' \\<parallel> R, (Q' \\<parallel> !Q)[x::=u]) \\<in> Rel'\"\n            proof -\n              from P'RelQ' RBangRelT have \"(P' \\<parallel> R, Q'[x::=u] \\<parallel> !Q) \\<in> bangRel Rel\"\n                by(rule Rel.BRPar)\n              with xFreshQ BangRelRel' show ?thesis by(auto simp add: forget)\n            qed\n            ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P'' \\<parallel> R)\\<rightarrow>a<x> \\<prec> P' \\<and>\n                                  (P', (Q' \\<parallel> !Q)[x::=u]) \\<in> Rel'\" by blast\n          qed\n          thus ?case by blast\n        next\n          case(BoundOutput a)\n          have \"aa = BoundOutputS a\" by fact\n          with PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\"\n                                                and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: simE)\n          from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x>\\<prec> P' \\<parallel> R\"\n            by(rule Weak_Late_Semantics.Par1B)\n          moreover from P'RelQ' RBangRelT BangRelRel' have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> Rel'\"\n            by(blast intro: Rel.BRPar)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cPar1F \\<alpha> Q' P)\n      have QTrans: \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from PRelQ have \"P \\<leadsto>\\<^sup>^<Rel> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: simE)\n\n          from PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Late_Semantics.Par1F)\n          moreover from P'RelQ' RBangRelQ have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel\"\n            by(rule Rel.BRPar)\n          ultimately show ?case using BangRelRel' by blast\n        qed\n      qed\n    next\n      case(cPar2B aa x Q' P)\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimAct P (aa\\<guillemotleft>x\\<guillemotright> \\<prec> Q') P Rel'\" by fact\n      have xFreshQ: \"x \\<sharp> Q\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        from eqvtRel' show ?case\n        proof(induct rule: simActBoundCases)\n          case(Input a)\n          have \"aa = InputS a\" by fact\n          with RBangRelQ IH have \"weakSimAct R (a<x> \\<prec> Q') R Rel'\" by blast\n          with xFreshR obtain R'' where L1: \"\\<forall>u. \\<exists>R'. R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R' \\<and> (R', Q'[x::=u]) \\<in> Rel'\"\n            by(force simp add: weakSimAct_def)\n          have \"\\<forall>u. \\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P' \\<and> (P', (Q \\<parallel> Q')[x::=u]) \\<in> Rel'\"\n          proof(rule allI)\n            fix u\n            from L1 obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>lu in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                and R'Rel'Q': \"(R', Q'[x::=u]) \\<in> Rel'\"\n              by blast\n            \n            from RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P \\<parallel> R'\"\n              by(rule Weak_Late_Step_Semantics.Par2B)\n            moreover have \"(P \\<parallel> R', (Q \\<parallel> Q')[x::=u]) \\<in> Rel'\"\n            proof -\n              from PRelQ R'Rel'Q' have \"(P \\<parallel> R', Q \\<parallel> Q'[x::=u]) \\<in> Rel'\"\n                by(rule ParComp)\n              with xFreshQ show ?thesis by(simp add: forget)\n            qed\n            ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sub>lu in (P \\<parallel> R'')\\<rightarrow>a<x> \\<prec> P' \\<and> (P', (Q \\<parallel> Q')[x::=u]) \\<in> Rel'\"\n              by blast\n          qed\n          thus ?case by blast\n        next\n          case(BoundOutput a)\n          have \"aa = BoundOutputS a\" by fact\n          with IH RBangRelQ have \"weakSimAct R (a<\\<nu>x> \\<prec> Q') R Rel'\" by blast\n          with xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> R'\" and R'BangRelQ': \"(R', Q') \\<in> Rel'\"\n            by(simp add: weakSimAct_def, blast)\n          \n          from RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P \\<parallel> R'\"\n            by(auto intro: Weak_Late_Semantics.Par2B)\n          moreover from PRelQ R'BangRelQ' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> Rel'\"\n            by(rule ParComp)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cPar2F \\<alpha> Q' P)\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimAct P (\\<alpha> \\<prec> Q') P Rel'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from RBangRelQ have \"weakSimAct R (\\<alpha> \\<prec> Q') R Rel'\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> R'\" and R'RelQ': \"(R', Q') \\<in> Rel'\"\n            by(simp add: weakSimAct_def, blast)\n\n          from RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P \\<parallel> R'\" by(rule Weak_Late_Semantics.Par2F)\n          moreover from PRelQ R'RelQ' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> Rel'\" by(rule ParComp)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cComm1 a x Q' b Q'' P)\n      have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimAct P (a[b] \\<prec> Q'') P Rel'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" by simp\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from PRelQ have \"P \\<leadsto>\\<^sup>^<Rel> Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>lb in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=b]) \\<in> Rel\"\n            by(blast dest: simE)\n\n          from RBangRelQ have \"weakSimAct R (a[b] \\<prec> Q'') R Rel'\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<^sup>^a[b] \\<prec> R'\"\n                           and R'RelQ'': \"(R', Q'') \\<in> Rel'\"\n            by(simp add: weakSimAct_def, blast)\n        \n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> (P' \\<parallel> R')\"\n            by(rule Weak_Late_Semantics.Comm1)\n          moreover from P'RelQ' R'RelQ'' have \"(P' \\<parallel> R', Q'[x::=b] \\<parallel> Q'') \\<in> Rel'\"\n            by(rule ParComp)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cComm2 a b Q' x Q'' P)\n      have QTrans: \"Q \\<longmapsto>a[b] \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimAct P (a<x> \\<prec> Q'') P Rel'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshR: \"x \\<sharp> R\" by simp\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from PRelQ have \"P \\<leadsto>\\<^sup>^<Rel> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a[b] \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: simE)\n\n          from RBangRelQ have \"weakSimAct R (a<x> \\<prec> Q'') R Rel'\" by(rule IH)\n          with xFreshR obtain R' R'' where RTrans: \"R \\<Longrightarrow>\\<^sub>lb in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                       and R'BangRelQ'': \"(R', Q''[x::=b]) \\<in> Rel'\"\n            by(simp add: weakSimAct_def, blast)\n        \n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> (P' \\<parallel> R')\"\n            by(rule Weak_Late_Semantics.Comm2)\n          moreover from P'RelQ' R'BangRelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q''[x::=b]) \\<in> Rel'\"\n            by(rule ParComp)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cClose1 a x Q' y Q'' P)\n      have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimAct P (a<\\<nu>y> \\<prec> Q'') P Rel'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" and \"y \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" by simp\n        have \"y \\<sharp> P \\<parallel> R\" by fact\n        hence yFreshR: \"y \\<sharp> R\" and yFreshP: \"y \\<sharp> P\" by simp+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from PRelQ have \"P \\<leadsto>\\<^sup>^<Rel> Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' P'' where PTrans: \"P \\<Longrightarrow>\\<^sub>ly in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                              and P'RelQ': \"(P', Q'[x::=y]) \\<in> Rel\"\n            by(blast dest: simE)\n          \n          from RBangRelQ have \"weakSimAct R (a<\\<nu>y> \\<prec> Q'') R Rel'\" by(rule IH)\n          with yFreshR obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>y> \\<prec> R'\"\n                                   and R'RelQ'': \"(R', Q'') \\<in> Rel'\"\n            by(simp add: weakSimAct_def, blast)\n        \n          from PTrans RTrans yFreshP yFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R')\"\n            by(rule Weak_Late_Semantics.Close1)\n          moreover from P'RelQ' R'RelQ'' have \"(<\\<nu>y>(P' \\<parallel> R'), <\\<nu>y>(Q'[x::=y] \\<parallel> Q'')) \\<in> Rel'\"\n            by(force intro: ParComp Res)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cClose2 a y Q' x Q'' P)\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>y> \\<prec> Q'\" by fact\n      have IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimAct P (a<x> \\<prec> Q'') P Rel'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" and \"y \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshR: \"x \\<sharp> R\" by simp\n        have \"y \\<sharp> P \\<parallel> R\" by fact\n        hence yFreshP: \"y \\<sharp> P\" and yFreshR: \"y \\<sharp> R\" by simp+\n        show ?case\n        proof(induct rule: simActFreeCases)\n          case Der\n          from PRelQ have \"P \\<leadsto>\\<^sup>^<Rel> Q\" by(rule Sim)\n          with QTrans yFreshP obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>y> \\<prec> P'\"\n                                          and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: simE)\n\n          from RBangRelQ have \"weakSimAct R (a<x> \\<prec> Q'') R Rel'\" by(rule IH)\n          with xFreshR obtain R' R'' where RTrans: \"R \\<Longrightarrow>\\<^sub>ly in R''\\<rightarrow>a<x> \\<prec> R'\"\n                                       and R'RelQ'': \"(R', Q''[x::=y]) \\<in> Rel'\"\n            by(simp add: weakSimAct_def, blast)\n        \n          from PTrans RTrans yFreshP yFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> <\\<nu>y>(P' \\<parallel> R')\"\n            by(rule Weak_Late_Semantics.Close2)\n          moreover from P'RelQ' R'RelQ'' have \"(<\\<nu>y>(P' \\<parallel> R'), <\\<nu>y>(Q' \\<parallel> Q''[x::=y])) \\<in> Rel'\"\n            by(force intro: ParComp Res)\n          ultimately show ?case by blast\n        qed\n      qed\n    next\n      case(cBang Rs)\n      have IH: \"\\<And>P. (P, Q \\<parallel> !Q) \\<in> bangRel Rel \\<Longrightarrow> weakSimAct P Rs P Rel'\" by fact\n      have \"(P, !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRBangCases)\n        case(BRBang P)\n        have PRelQ: \"(P, Q) \\<in> Rel\" by fact\n        hence \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n        with PRelQ have \"(P \\<parallel> !P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by(rule Rel.BRPar)\n        hence \"weakSimAct (P \\<parallel> !P) Rs (P \\<parallel> !P) Rel'\" by(rule IH)\n        thus ?case\n        proof(simp (no_asm) add: weakSimAct_def, auto)\n          fix Q' a x\n          assume \"weakSimAct (P \\<parallel> !P) (a<\\<nu>x> \\<prec> Q') (P \\<parallel> !P) Rel'\" and \"x \\<sharp> P\"\n          then obtain P' where PTrans: \"(P \\<parallel> !P) \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\"\n                           and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(simp add: weakSimAct_def, blast)\n          from PTrans have \"!P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P'\"\n            by(force intro: Weak_Late_Step_Semantics.Bang simp add: weakTransition_def)\n          with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>\\<^sub>l\\<^sup>^a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel'\" by blast\n        next\n          fix Q' a x\n          assume \"weakSimAct (P \\<parallel> !P) (a<x> \\<prec> Q') (P \\<parallel> !P) Rel'\" and \"x \\<sharp> P\"\n          then obtain P'' where L1: \"\\<forall>u. \\<exists>P'. P \\<parallel> !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n            by(simp add: weakSimAct_def, blast)\n          have \"\\<forall>u. \\<exists>P'. !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\"\n          proof(rule allI)\n            fix u\n            from L1 obtain P' where PTrans: \"P \\<parallel> !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\"\n                                and P'RelQ': \"(P', Q'[x::=u]) \\<in> Rel'\"\n              by blast\n            from PTrans have \"!P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Bang)\n            with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\" by blast\n          qed\n          thus \"\\<exists>P''. \\<forall>u. \\<exists>P'. !P \\<Longrightarrow>\\<^sub>lu in P''\\<rightarrow>a<x> \\<prec> P' \\<and> (P', Q'[x::=u]) \\<in> Rel'\" by blast\n        next\n          fix Q' \\<alpha>\n          assume \"weakSimAct (P \\<parallel> !P) (\\<alpha> \\<prec> Q') (P \\<parallel> !P) Rel'\"\n          then obtain P' where PTrans: \"(P \\<parallel> !P) \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P'\"\n                           and P'RelQ': \"(P', Q') \\<in> Rel'\"\n            by(simp add: weakSimAct_def, blast)\n          from PTrans show \"\\<exists>P'. !P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel'\"\n          proof(induct rule: transitionCases)\n            case Step\n            have \"P \\<parallel> !P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by fact\n            hence \"!P \\<Longrightarrow>\\<^sub>l\\<alpha> \\<prec> P'\" by(rule Weak_Late_Step_Semantics.Bang)\n            with P'RelQ' show ?case by(force simp add: weakTransition_def)\n          next\n            case Stay\n            have \"\\<alpha> \\<prec> P' = \\<tau> \\<prec> P \\<parallel> !P\" by fact\n            hence \\<alpha>eq\\<tau>: \"\\<alpha> = \\<tau>\" and P'eqP: \"P' = P \\<parallel> !P\" by(simp add: residual.inject)+\n            have \"!P \\<Longrightarrow>\\<^sub>l\\<^sup>^\\<tau> \\<prec> !P\" by(simp add: weakTransition_def)\n            moreover from P'eqP P'RelQ' have \"(!P, Q') \\<in> Rel'\" by(blast intro: RelStay)\n            ultimately show ?case using \\<alpha>eq\\<tau> by blast\n          qed\n        qed\n      qed\n    qed\n  qed\n  moreover from PRelQ have \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n  ultimately show ?thesis by(simp add: simDef)\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Late_Sim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011686727232, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.3039725326245677}}
{"text": "(*\n * Copyright 2017, Data61, CSIRO\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(DATA61_BSD)\n *)\ntheory TraceMonad\nimports\n  \"../Lib\"\n  \"Strengthen\"\nbegin\n\ntext \\<open>\nThe ``Interference Trace Monad''. This nondeterministic monad\nrecords the state at every interference point, permitting\nnondeterministic interference by the environment at interference\npoints.\n\nThe trace set initially includes all possible environment behaviours.\nTrace steps are tagged as environment or self actions, and can then\nbe constrained to a smaller set where the environment acts according\nto a rely constraint (i.e. rely-guarantee reasoning), or to set the\nenvironment actions to be the self actions of another program (parallel\ncomposition).\n\\<close>\n\nsection \"The Trace Monad\"\n\ntext \\<open>Trace monad identifier. Me corresponds to the current thread running and Env to the environment.\\<close>\ndatatype tmid = Me | Env\n\ntext \\<open>Results associated with traces. Traces may correspond to incomplete, failed, or completed executions.\\<close>\ndatatype ('s, 'a) tmres = Failed | Incomplete | Result \"('a \\<times> 's)\"\n\nabbreviation\n  map_tmres_rv :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('s, 'a) tmres \\<Rightarrow> ('s, 'b) tmres\"\nwhere\n  \"map_tmres_rv f \\<equiv> map_tmres id f\"\n\nsection \"The Monad\"\n\ntext \\<open> tmonad returns a set of non-deterministic  computations, including\n  a trace as a list of \"thread identifier\" \\<times> state, and an optional\n  pair result, state when the computation did not fail. \\<close>\ntype_synonym ('s, 'a) tmonad = \"'s \\<Rightarrow> ((tmid \\<times> 's) list \\<times> ('s, 'a) tmres) set\"\n\ntext \\<open>Returns monad results, ignoring failures and traces.\\<close>\ndefinition\n  mres :: \"((tmid \\<times> 's) list \\<times> ('s, 'a) tmres) set \\<Rightarrow> ('a \\<times> 's) set\"\nwhere\n  \"mres r = Result -` (snd ` r)\"\n\ntext \\<open>\n  The definition of fundamental monad functions @{text return} and\n  @{text bind}. The monad function @{text \"return x\"} does not change\n  the  state, does not fail, and returns @{text \"x\"}.\n\\<close>\ndefinition\n  return :: \"'a \\<Rightarrow> ('s,'a) tmonad\"\nwhere\n  \"return a \\<equiv> \\<lambda>s. ({([], Result (a, s))})\"\n\ntext \\<open>\n  The monad function @{text \"bind f g\"}, also written @{text \"f >>= g\"},\n  is the execution of @{term f} followed by the execution of @{text g}.\n  The function @{text g} takes the result value \\emph{and} the result\n  state of @{text f} as parameter. The definition says that the result of\n  the combined operation is the union of the set of sets that is created\n  by @{text g} applied to the result sets of @{text f}. The combined\n  operation may have failed, if @{text f} may have failed or @{text g} may\n  have failed on any of the results of @{text f}.\n\\<close>\n\nabbreviation (input)\n  fst_upd :: \"('a \\<Rightarrow> 'c) \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 'c \\<times> 'b\"\nwhere\n  \"fst_upd f \\<equiv> \\<lambda>(a,b). (f a, b)\"\n\nabbreviation (input)\n  snd_upd :: \"('b \\<Rightarrow> 'c) \\<Rightarrow> 'a \\<times> 'b \\<Rightarrow> 'a \\<times> 'c\"\nwhere\n  \"snd_upd f \\<equiv> \\<lambda>(a,b). (a, f b)\"\n\ndefinition\n  bind :: \"('s, 'a) tmonad \\<Rightarrow> ('a \\<Rightarrow> ('s, 'b) tmonad) \\<Rightarrow>\n           ('s, 'b) tmonad\" (infixl \">>=\" 60)\nwhere\n  \"bind f g \\<equiv> \\<lambda>s. \\<Union>(xs, r) \\<in> (f s). case r of Failed \\<Rightarrow> {(xs, Failed)}\n    | Incomplete \\<Rightarrow> {(xs, Incomplete)}\n    | Result (rv, s) \\<Rightarrow> fst_upd (\\<lambda>ys. ys @ xs) ` g rv s\"\n\ntext \\<open>Sometimes it is convenient to write @{text bind} in reverse order.\\<close>\nabbreviation(input)\n  bind_rev :: \"('c \\<Rightarrow> ('a, 'b) tmonad) \\<Rightarrow> ('a, 'c) tmonad \\<Rightarrow>\n               ('a, 'b) tmonad\" (infixl \"=<<\" 60)\nwhere\n  \"g =<< f \\<equiv> f >>= g\"\n\ntext \\<open>\n  The basic accessor functions of the state monad. @{text get} returns\n  the current state as result, does not fail, and does not change the state.\n  @{text \"put s\"} returns nothing (@{typ unit}), changes the current state\n  to @{text s} and does not fail.\n\\<close>\ndefinition\n  get :: \"('s,'s) tmonad\"\nwhere\n  \"get \\<equiv> \\<lambda>s. {([], Result (s, s))}\"\n\ndefinition\n  put :: \"'s \\<Rightarrow> ('s, unit) tmonad\"\nwhere\n  \"put s \\<equiv> \\<lambda>st. {([], Result ((), s))}\"\n\ndefinition\n  put_trace_elem :: \"(tmid \\<times> 's) \\<Rightarrow> ('s, unit) tmonad\"\nwhere\n  \"put_trace_elem x = (\\<lambda>s. {([], Incomplete), ([x], Result ((), s))})\"\n\nprimrec\n  put_trace :: \"(tmid \\<times> 's) list \\<Rightarrow> ('s, unit) tmonad\"\nwhere\n    \"put_trace [] = return ()\"\n  | \"put_trace (x # xs) = (put_trace xs >>= (\\<lambda>_. put_trace_elem x))\"\n\nsubsection \"Nondeterminism\"\n\ntext \\<open>\n  Basic nondeterministic functions. @{text \"select A\"} chooses an element\n  of the set @{text A}, does not change the state, and does not fail\n  (even if the set is empty). @{text \"f OR g\"} executes @{text f} or\n  executes @{text g}. It retuns the union of results of @{text f} and\n  @{text g}, and may have failed if either may have failed.\n\\<close>\ndefinition\n  select :: \"'a set \\<Rightarrow> ('s, 'a) tmonad\"\nwhere\n  (* Should we have Failed when A = {} ? *)\n  \"select A \\<equiv> \\<lambda>s. (Pair [] ` Result ` (A \\<times> {s}))\"\n\ndefinition\n  alternative :: \"('s,'a) tmonad \\<Rightarrow> ('s,'a) tmonad \\<Rightarrow>\n                  ('s,'a) tmonad\"\n  (infixl \"OR\" 20)\nwhere\n  \"f OR g \\<equiv> \\<lambda>s. (f s \\<union> g s)\"\n\ntext \\<open> Alternative notation for @{text OR} \\<close>\nnotation (xsymbols)  alternative (infixl \"\\<sqinter>\" 20)\n\n\ntext \\<open> The @{text selet_f} function was left out here until we figure\n  out what variant we actually need.\n\\<close>\n\nsubsection \"Failure\"\n\ntext \\<open> The monad function that always fails. Returns an empty set of\nresults and sets the failure flag. \\<close>\ndefinition\n  fail :: \"('s, 'a) tmonad\"\nwhere\n \"fail \\<equiv> \\<lambda>s. {([], Failed)}\"\n\ntext \\<open> Assertions: fail if the property @{text P} is not true \\<close>\ndefinition\n  assert :: \"bool \\<Rightarrow> ('a, unit) tmonad\"\nwhere\n \"assert P \\<equiv> if P then return () else fail\"\n\ntext \\<open> Fail if the value is @{const None},\n  return result @{text v} for @{term \"Some v\"} \\<close>\ndefinition\n  assert_opt :: \"'a option \\<Rightarrow> ('b, 'a) tmonad\"\nwhere\n \"assert_opt v \\<equiv> case v of None \\<Rightarrow> fail | Some v \\<Rightarrow> return v\"\n\ntext \\<open> An assertion that also can introspect the current state. \\<close>\n\ndefinition\n  state_assert :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, unit) tmonad\"\nwhere\n  \"state_assert P \\<equiv> get >>= (\\<lambda>s. assert (P s))\"\n\nsubsection \"Generic functions on top of the state monad\"\n\ntext \\<open> Apply a function to the current state and return the result\nwithout changing the state. \\<close>\ndefinition\n  gets :: \"('s \\<Rightarrow> 'a) \\<Rightarrow> ('s, 'a) tmonad\"\nwhere\n \"gets f \\<equiv> get >>= (\\<lambda>s. return (f s))\"\n\ntext \\<open> Modify the current state using the function passed in. \\<close>\ndefinition\n  modify :: \"('s \\<Rightarrow> 's) \\<Rightarrow> ('s, unit) tmonad\"\nwhere\n  \"modify f \\<equiv> get >>= (\\<lambda>s. put (f s))\"\n\nlemma simpler_gets_def: \"gets f = (\\<lambda>s. {([], Result ((f s), s))})\"\n by (simp add: fun_eq_iff gets_def return_def bind_def get_def split_def)\n\nlemma simpler_modify_def:\n  \"modify f = (\\<lambda>s. {([], Result ((),(f s)))})\"\n  by (simp add: fun_eq_iff modify_def bind_def get_def put_def split_def)\n\ntext \\<open> Execute the given monad when the condition is true,\n  return @{text \"()\"} otherwise. \\<close>\ndefinition\n  \"when\" :: \"bool \\<Rightarrow> ('s, unit) tmonad \\<Rightarrow>\n           ('s, unit) tmonad\"\nwhere\n  \"when P m \\<equiv> if P then m else return ()\"\n\ntext \\<open> Execute the given monad unless the condition is true,\n  return @{text \"()\"} otherwise. \\<close>\ndefinition\n  unless :: \"bool \\<Rightarrow> ('s, unit) tmonad \\<Rightarrow>\n            ('s, unit) tmonad\"\nwhere\n  \"unless P m \\<equiv> when (\\<not>P) m\"\n\ntext \\<open>\n  Perform a test on the current state, performing the left monad if\n  the result is true or the right monad if the result is false.\n\\<close>\ndefinition\n  condition :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'r) tmonad \\<Rightarrow> ('s, 'r) tmonad \\<Rightarrow> ('s, 'r) tmonad\"\nwhere\n  \"condition P L R \\<equiv> \\<lambda>s. if (P s) then (L s) else (R s)\"\n\nnotation (output)\n  condition  (\"(condition (_)//  (_)//  (_))\" [1000,1000,1000] 1000)\n\ntext \\<open>\nApply an option valued function to the current state, fail\nif it returns @{const None}, return @{text v} if it returns\n@{term \"Some v\"}.\n\\<close>\ndefinition\n  gets_the :: \"('s \\<Rightarrow> 'a option) \\<Rightarrow> ('s, 'a) tmonad\"\nwhere\n  \"gets_the f \\<equiv> gets f >>= assert_opt\"\n\n\nsubsection \\<open> The Monad Laws \\<close>\n\ntext \\<open>An alternative definition of bind, sometimes more convenient.\\<close>\nlemma bind_def2:\n  \"bind f g \\<equiv> (\\<lambda>s. ((\\<lambda>xs. (xs, Failed)) ` {xs. (xs, Failed) \\<in> f s})\n    \\<union> ((\\<lambda>xs. (xs, Incomplete)) ` {xs. (xs, Incomplete) \\<in> f s})\n    \\<union> (\\<Union>(xs, rv, s) \\<in> {(xs, rv, s'). (xs, Result (rv, s')) \\<in> f s}. fst_upd (\\<lambda>ys. ys @ xs) ` g rv s))\"\n  apply (clarsimp simp add: bind_def fun_eq_iff\n                            Un_Union_image split_def\n                    intro!: eq_reflection)\n  apply (auto split: tmres.splits elim!:rev_bexI[where A=\"f x\" for x])\n  apply (fastforce intro: image_eqI[rotated])\n  done\n\nlemma elem_bindE:\n  \"(tr, res) \\<in> bind f (\\<lambda>x. g x) s\n    \\<Longrightarrow> ((res = Incomplete | res = Failed) \\<Longrightarrow> (tr, map_tmres undefined undefined res) \\<in> f s \\<Longrightarrow> P)\n    \\<Longrightarrow> (\\<And>tr' tr'' x s'. (tr', Result (x, s')) \\<in> f s \\<Longrightarrow> (tr'', res) \\<in> g x s'\n        \\<Longrightarrow> tr = tr'' @ tr' \\<Longrightarrow> P)\n    \\<Longrightarrow> P\"\n  by (auto simp: bind_def2)\n\ntext \\<open> Each monad satisfies at least the following three laws. \\<close>\n\ntext \\<open> @{term return} is absorbed at the left of a @{term bind},\n  applying the return value directly: \\<close>\n\ndeclare map_option.identity[simp]\n\nlemma return_bind [simp]: \"(return x >>= f) = f x\"\n  by (auto simp add: return_def bind_def split_def split:if_splits)\n\ntext \\<open> @{term return} is absorbed on the right of a @{term bind} \\<close>\nlemma bind_return [simp]: \"(m >>= return) = m\"\n  by (auto simp add: fun_eq_iff bind_def return_def\n           split: tmres.splits)\n\ntext \\<open> @{term bind} is associative \\<close>\nlemma bind_assoc:\n  fixes m :: \"('a,'b) tmonad\"\n  fixes f :: \"'b \\<Rightarrow> ('a,'c) tmonad\"\n  fixes g :: \"'c \\<Rightarrow> ('a,'d) tmonad\"\n  shows \"(m >>= f) >>= g  =  m >>= (\\<lambda>x. f x >>= g)\"\n  apply (unfold bind_def Let_def split_def)\n  apply (rule ext)\n  apply clarsimp\n  apply (rule SUP_cong[OF refl], clarsimp)\n  apply (split tmres.split; intro conjI impI; clarsimp)\n  apply (simp add: image_Union)\n  apply (rule SUP_cong[OF refl], clarsimp)\n  apply (split tmres.split; intro conjI impI; clarsimp)\n  apply (simp add: image_image)\n  done\n\nsection \\<open> Adding Exceptions \\<close>\n\ntext \\<open>\n  The type @{typ \"('s,'a) tmonad\"} gives us nondeterminism and\n  failure. We now extend this monad with exceptional return values\n  that abort normal execution, but can be handled explicitly.\n  We use the sum type to indicate exceptions.\n\n  In @{typ \"('s, 'e + 'a) tmonad\"}, @{typ \"'s\"} is the state,\n  @{typ 'e} is an exception, and @{typ 'a} is a normal return value.\n\n  This new type itself forms a monad again. Since type classes in\n  Isabelle are not powerful enough to express the class of monads,\n  we provide new names for the @{term return} and @{term bind} functions\n  in this monad. We call them @{text returnOk} (for normal return values)\n  and @{text bindE} (for composition). We also define @{text throwError}\n  to return an exceptional value.\n\\<close>\ndefinition\n  returnOk :: \"'a \\<Rightarrow> ('s, 'e + 'a) tmonad\"\nwhere\n  \"returnOk \\<equiv> return o Inr\"\n\ndefinition\n  throwError :: \"'e \\<Rightarrow> ('s, 'e + 'a) tmonad\"\nwhere\n  \"throwError \\<equiv> return o Inl\"\n\ntext \\<open>\n  Lifting a function over the exception type: if the input is an\n  exception, return that exception; otherwise continue execution.\n\\<close>\ndefinition\n  lift :: \"('a \\<Rightarrow> ('s, 'e + 'b) tmonad) \\<Rightarrow>\n           'e +'a \\<Rightarrow> ('s, 'e + 'b) tmonad\"\nwhere\n  \"lift f v \\<equiv> case v of Inl e \\<Rightarrow> throwError e\n                      | Inr v' \\<Rightarrow> f v'\"\n\ntext \\<open>\n  The definition of @{term bind} in the exception monad (new\n  name @{text bindE}): the same as normal @{term bind}, but\n  the right-hand side is skipped if the left-hand side\n  produced an exception.\n\\<close>\ndefinition\n  bindE :: \"('s, 'e + 'a) tmonad \\<Rightarrow>\n            ('a \\<Rightarrow> ('s, 'e + 'b) tmonad) \\<Rightarrow>\n            ('s, 'e + 'b) tmonad\"  (infixl \">>=E\" 60)\nwhere\n  \"bindE f g \\<equiv> bind f (lift g)\"\n\n\ntext \\<open>\n  Lifting a normal nondeterministic monad into the\n  exception monad is achieved by always returning its\n  result as normal result and never throwing an exception.\n\\<close>\ndefinition\n  liftE :: \"('s,'a) tmonad \\<Rightarrow> ('s, 'e+'a) tmonad\"\nwhere\n  \"liftE f \\<equiv> f >>= (\\<lambda>r. return (Inr r))\"\n\n\ntext \\<open>\n  Since the underlying type and @{text return} function changed,\n  we need new definitions for when and unless:\n\\<close>\ndefinition\n  whenE :: \"bool \\<Rightarrow> ('s, 'e + unit) tmonad \\<Rightarrow>\n            ('s, 'e + unit) tmonad\"\nwhere\n  \"whenE P f \\<equiv> if P then f else returnOk ()\"\n\ndefinition\n  unlessE :: \"bool \\<Rightarrow> ('s, 'e + unit) tmonad \\<Rightarrow>\n            ('s, 'e + unit) tmonad\"\nwhere\n  \"unlessE P f \\<equiv> if P then returnOk () else f\"\n\n\ntext \\<open>\n  Throwing an exception when the parameter is @{term None}, otherwise\n  returning @{term \"v\"} for @{term \"Some v\"}.\n\\<close>\ndefinition\n  throw_opt :: \"'e \\<Rightarrow> 'a option \\<Rightarrow> ('s, 'e + 'a) tmonad\"\nwhere\n  \"throw_opt ex x \\<equiv>\n    case x of None \\<Rightarrow> throwError ex | Some v \\<Rightarrow> returnOk v\"\n\n\ntext \\<open>\n  Failure in the exception monad is redefined in the same way\n  as @{const whenE} and @{const unlessE}, with @{term returnOk}\n  instead of @{term return}.\n\\<close>\ndefinition\n  assertE :: \"bool \\<Rightarrow> ('a, 'e + unit) tmonad\"\nwhere\n  \"assertE P \\<equiv> if P then returnOk () else fail\"\n\nsubsection \"Monad Laws for the Exception Monad\"\n\ntext \\<open> More direct definition of @{const liftE}: \\<close>\nlemma liftE_def2:\n  \"liftE f = (\\<lambda>s. snd_upd (map_tmres_rv Inr) ` (f s))\"\n  apply (clarsimp simp: fun_eq_iff liftE_def return_def split_def bind_def image_def)\n  apply (rule set_eqI)\n  apply (rule iffI)\n  apply clarsimp\n   apply (erule rev_bexI[where A=\"f s\" for s])\n   apply (clarsimp split: tmres.splits)\n  apply clarsimp\n  apply (rule exI)\n  apply (rule conjI)\n   apply (erule rev_bexI[where A=\"f s\" for s])\n   apply (rule refl)\n  apply (clarsimp split: tmres.splits)\n  done\n\ntext \\<open> Left @{const returnOk} absorbtion over @{term bindE}: \\<close>\nlemma returnOk_bindE [simp]: \"(returnOk x >>=E f) = f x\"\n  apply (unfold bindE_def returnOk_def)\n  apply (clarsimp simp: lift_def)\n  done\n\nlemma lift_return [simp]:\n  \"lift (return \\<circ> Inr) = return\"\n  by (simp add: fun_eq_iff lift_def throwError_def split: sum.splits)\n\ntext \\<open> Right @{const returnOk} absorbtion over @{term bindE}: \\<close>\nlemma bindE_returnOk [simp]: \"(m >>=E returnOk) = m\"\n  by (simp add: bindE_def returnOk_def)\n\ntext \\<open> Associativity of @{const bindE}: \\<close>\nlemma bindE_assoc:\n  \"(m >>=E f) >>=E g = m >>=E (\\<lambda>x. f x >>=E g)\"\n  apply (simp add: bindE_def bind_assoc)\n  apply (rule arg_cong [where f=\"\\<lambda>x. m >>= x\"])\n  apply (rule ext)\n  apply (case_tac x, simp_all add: lift_def throwError_def)\n  done\n\ntext \\<open> @{const returnOk} could also be defined via @{const liftE}: \\<close>\nlemma returnOk_liftE:\n  \"returnOk x = liftE (return x)\"\n  by (simp add: liftE_def returnOk_def)\n\ntext \\<open> Execution after throwing an exception is skipped: \\<close>\nlemma throwError_bindE [simp]:\n  \"(throwError E >>=E f) = throwError E\"\n  by (simp add: fun_eq_iff bindE_def bind_def throwError_def lift_def return_def split_def)\n\n\nsection \"Syntax\"\n\ntext \\<open> This section defines traditional Haskell-like do-syntax\n  for the state monad in Isabelle. \\<close>\n\nsubsection \"Syntax for the Nondeterministic State Monad\"\n\ntext \\<open> We use @{text K_bind} to syntactically indicate the\n  case where the return argument of the left side of a @{term bind}\n  is ignored \\<close>\ndefinition\n  K_bind_def [iff]: \"K_bind \\<equiv> \\<lambda>x y. x\"\n\nnonterminal\n  dobinds and dobind and nobind\n\nsyntax\n  \"_dobind\"    :: \"[pttrn, 'a] => dobind\"             (\"(_ <-/ _)\" 10)\n  \"\"           :: \"dobind => dobinds\"                 (\"_\")\n  \"_nobind\"    :: \"'a => dobind\"                      (\"_\")\n  \"_dobinds\"   :: \"[dobind, dobinds] => dobinds\"      (\"(_);//(_)\")\n\n  \"_do\"        :: \"[dobinds, 'a] => 'a\"               (\"(do ((_);//(_))//od)\" 100)\nsyntax (xsymbols)\n  \"_dobind\"    :: \"[pttrn, 'a] => dobind\"             (\"(_ \\<leftarrow>/ _)\" 10)\n\ntranslations\n  \"_do (_dobinds b bs) e\"  == \"_do b (_do bs e)\"\n  \"_do (_nobind b) e\"      == \"b >>= (CONST K_bind e)\"\n  \"do x <- a; e od\"        == \"a >>= (\\<lambda>x. e)\"\n\ntext \\<open> Syntax examples: \\<close>\nlemma \"do x \\<leftarrow> return 1;\n          return (2::nat);\n          return x\n       od =\n       return 1 >>=\n       (\\<lambda>x. return (2::nat) >>=\n            K_bind (return x))\"\n  by (rule refl)\n\nlemma \"do x \\<leftarrow> return 1;\n          return 2;\n          return x\n       od = return 1\"\n  by simp\n\nsubsection \"Interference command\"\n\ntext \\<open>Interference commands must be inserted in between actions that can be interfered with commands\nrunning in other threads. \\<close>\n\ndefinition\n  last_st_tr :: \"(tmid * 's) list \\<Rightarrow> 's \\<Rightarrow> 's\"\nwhere\n  \"last_st_tr tr s0 = (hd (map snd tr @ [s0]))\"\n\ndefinition\n  env_steps :: \"('s,unit) tmonad\"\nwhere\n  \"env_steps \\<equiv>\n  do\n    s \\<leftarrow> get;\n    \\<comment> \\<open>Add unfiltered environment events to the trace\\<close>\n    xs \\<leftarrow> select UNIV;\n    tr \\<leftarrow> return (map (Pair Env) xs);\n    put_trace tr;\n    \\<comment> \\<open>Pick the last event of the trace as the final state\\<close>\n    put (last_st_tr tr s)\n  od\"\n\ndefinition\n  commit_step :: \"('s, unit) tmonad\"\nwhere\n  \"commit_step \\<equiv>\n  do\n    s \\<leftarrow> get;\n    put_trace [(Me,s)]\n  od\"\n\ndefinition\n  interference :: \"('s,unit) tmonad\"\nwhere\n  \"interference \\<equiv>\n  do\n    commit_step;\n    env_steps\n  od\"\n\nsubsection \"Syntax for the Exception Monad\"\n\ntext \\<open>\n  Since the exception monad is a different type, we\n  need to syntactically distinguish it in the syntax.\n  We use @{text doE}/@{text odE} for this, but can re-use\n  most of the productions from @{text do}/@{text od}\n  above.\n\\<close>\n\nsyntax\n  \"_doE\" :: \"[dobinds, 'a] => 'a\"  (\"(doE ((_);//(_))//odE)\" 100)\n\ntranslations\n  \"_doE (_dobinds b bs) e\"  == \"_doE b (_doE bs e)\"\n  \"_doE (_nobind b) e\"      == \"b >>=E (CONST K_bind e)\"\n  \"doE x <- a; e odE\"       == \"a >>=E (\\<lambda>x. e)\"\n\ntext \\<open> Syntax examples: \\<close>\nlemma \"doE x \\<leftarrow> returnOk 1;\n           returnOk (2::nat);\n           returnOk x\n       odE =\n       returnOk 1 >>=E\n       (\\<lambda>x. returnOk (2::nat) >>=E\n            K_bind (returnOk x))\"\n  by (rule refl)\n\nlemma \"doE x \\<leftarrow> returnOk 1;\n           returnOk 2;\n           returnOk x\n       odE = returnOk 1\"\n  by simp\n\n\n\nsection \"Library of additional Monadic Functions and Combinators\"\n\n\ntext \\<open> Lifting a normal function into the monad type: \\<close>\ndefinition\n  liftM :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('s,'a) tmonad \\<Rightarrow> ('s, 'b) tmonad\"\nwhere\n  \"liftM f m \\<equiv> do x \\<leftarrow> m; return (f x) od\"\n\ntext \\<open> The same for the exception monad: \\<close>\ndefinition\n  liftME :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('s,'e+'a) tmonad \\<Rightarrow> ('s,'e+'b) tmonad\"\nwhere\n  \"liftME f m \\<equiv> doE x \\<leftarrow> m; returnOk (f x) odE\"\n\ntext \\<open> Run a sequence of monads from left to right, ignoring return values. \\<close>\ndefinition\n  sequence_x :: \"('s, 'a) tmonad list \\<Rightarrow> ('s, unit) tmonad\"\nwhere\n  \"sequence_x xs \\<equiv> foldr (\\<lambda>x y. x >>= (\\<lambda>_. y)) xs (return ())\"\n\ntext \\<open>\n  Map a monadic function over a list by applying it to each element\n  of the list from left to right, ignoring return values.\n\\<close>\ndefinition\n  mapM_x :: \"('a \\<Rightarrow> ('s,'b) tmonad) \\<Rightarrow> 'a list \\<Rightarrow> ('s, unit) tmonad\"\nwhere\n  \"mapM_x f xs \\<equiv> sequence_x (map f xs)\"\n\ntext \\<open>\n  Map a monadic function with two parameters over two lists,\n  going through both lists simultaneously, left to right, ignoring\n  return values.\n\\<close>\ndefinition\n  zipWithM_x :: \"('a \\<Rightarrow> 'b \\<Rightarrow> ('s,'c) tmonad) \\<Rightarrow>\n                 'a list \\<Rightarrow> 'b list \\<Rightarrow> ('s, unit) tmonad\"\nwhere\n  \"zipWithM_x f xs ys \\<equiv> sequence_x (zipWith f xs ys)\"\n\n\ntext \\<open> The same three functions as above, but returning a list of\nreturn values instead of @{text unit} \\<close>\ndefinition\n  sequence :: \"('s, 'a) tmonad list \\<Rightarrow> ('s, 'a list) tmonad\"\nwhere\n  \"sequence xs \\<equiv> let mcons = (\\<lambda>p q. p >>= (\\<lambda>x. q >>= (\\<lambda>y. return (x#y))))\n                 in foldr mcons xs (return [])\"\n\ndefinition\n  mapM :: \"('a \\<Rightarrow> ('s,'b) tmonad) \\<Rightarrow> 'a list \\<Rightarrow> ('s, 'b list) tmonad\"\nwhere\n  \"mapM f xs \\<equiv> sequence (map f xs)\"\n\ndefinition\n  zipWithM :: \"('a \\<Rightarrow> 'b \\<Rightarrow> ('s,'c) tmonad) \\<Rightarrow>\n                 'a list \\<Rightarrow> 'b list \\<Rightarrow> ('s, 'c list) tmonad\"\nwhere\n  \"zipWithM f xs ys \\<equiv> sequence (zipWith f xs ys)\"\n\ndefinition\n  foldM :: \"('b \\<Rightarrow> 'a \\<Rightarrow> ('s, 'a) tmonad) \\<Rightarrow> 'b list \\<Rightarrow> 'a \\<Rightarrow> ('s, 'a) tmonad\"\nwhere\n  \"foldM m xs a \\<equiv> foldr (\\<lambda>p q. q >>= m p) xs (return a) \"\n\ndefinition\n  foldME ::\"('b \\<Rightarrow> 'a \\<Rightarrow> ('s,('e + 'b)) tmonad) \\<Rightarrow> 'b \\<Rightarrow> 'a list \\<Rightarrow> ('s, ('e + 'b)) tmonad\"\nwhere \"foldME m a xs \\<equiv> foldr (\\<lambda>p q. q >>=E swp m p) xs (returnOk a)\"\n\ntext \\<open> The sequence and map functions above for the exception monad,\nwith and without lists of return value \\<close>\ndefinition\n  sequenceE_x :: \"('s, 'e+'a) tmonad list \\<Rightarrow> ('s, 'e+unit) tmonad\"\nwhere\n  \"sequenceE_x xs \\<equiv> foldr (\\<lambda>x y. doE _ <- x; y odE) xs (returnOk ())\"\n\ndefinition\n  mapME_x :: \"('a \\<Rightarrow> ('s,'e+'b) tmonad) \\<Rightarrow> 'a list \\<Rightarrow>\n              ('s,'e+unit) tmonad\"\nwhere\n  \"mapME_x f xs \\<equiv> sequenceE_x (map f xs)\"\n\ndefinition\n  sequenceE :: \"('s, 'e+'a) tmonad list \\<Rightarrow> ('s, 'e+'a list) tmonad\"\nwhere\n  \"sequenceE xs \\<equiv> let mcons = (\\<lambda>p q. p >>=E (\\<lambda>x. q >>=E (\\<lambda>y. returnOk (x#y))))\n                 in foldr mcons xs (returnOk [])\"\n\ndefinition\n  mapME :: \"('a \\<Rightarrow> ('s,'e+'b) tmonad) \\<Rightarrow> 'a list \\<Rightarrow>\n              ('s,'e+'b list) tmonad\"\nwhere\n  \"mapME f xs \\<equiv> sequenceE (map f xs)\"\n\n\ntext \\<open> Filtering a list using a monadic function as predicate: \\<close>\nprimrec\n  filterM :: \"('a \\<Rightarrow> ('s, bool) tmonad) \\<Rightarrow> 'a list \\<Rightarrow> ('s, 'a list) tmonad\"\nwhere\n  \"filterM P []       = return []\"\n| \"filterM P (x # xs) = do\n     b  <- P x;\n     ys <- filterM P xs;\n     return (if b then (x # ys) else ys)\n   od\"\n\ntext \\<open> @{text select_state} takes a relationship between\n  states, and outputs nondeterministically a state\n  related to the input state. \\<close>\n\ndefinition\n  state_select :: \"('s \\<times> 's) set \\<Rightarrow> ('s, unit) tmonad\"\nwhere\n  \"state_select r \\<equiv> (do\n    s \\<leftarrow> get;\n    S \\<leftarrow> return {s'. (s, s') \\<in> r};\n    assert (S \\<noteq> {});\n    s' \\<leftarrow> select S;\n    put s'\n  od)\"\nsection \"Catching and Handling Exceptions\"\n\ntext \\<open>\n  Turning an exception monad into a normal state monad\n  by catching and handling any potential exceptions:\n\\<close>\ndefinition\n  catch :: \"('s, 'e + 'a) tmonad \\<Rightarrow>\n            ('e \\<Rightarrow> ('s, 'a) tmonad) \\<Rightarrow>\n            ('s, 'a) tmonad\" (infix \"<catch>\" 10)\nwhere\n  \"f <catch> handler \\<equiv>\n     do x \\<leftarrow> f;\n        case x of\n          Inr b \\<Rightarrow> return b\n        | Inl e \\<Rightarrow> handler e\n     od\"\n\ntext \\<open>\n  Handling exceptions, but staying in the exception monad.\n  The handler may throw a type of exceptions different from\n  the left side.\n\\<close>\ndefinition\n  handleE' :: \"('s, 'e1 + 'a) tmonad \\<Rightarrow>\n               ('e1 \\<Rightarrow> ('s, 'e2 + 'a) tmonad) \\<Rightarrow>\n               ('s, 'e2 + 'a) tmonad\" (infix \"<handle2>\" 10)\nwhere\n  \"f <handle2> handler \\<equiv>\n   do\n      v \\<leftarrow> f;\n      case v of\n        Inl e \\<Rightarrow> handler e\n      | Inr v' \\<Rightarrow> return (Inr v')\n   od\"\n\ntext \\<open>\n  A type restriction of the above that is used more commonly in\n  practice: the exception handle (potentially) throws exception\n  of the same type as the left-hand side.\n\\<close>\ndefinition\n  handleE :: \"('s, 'x + 'a) tmonad \\<Rightarrow>\n              ('x \\<Rightarrow> ('s, 'x + 'a) tmonad) \\<Rightarrow>\n              ('s, 'x + 'a) tmonad\" (infix \"<handle>\" 10)\nwhere\n  \"handleE \\<equiv> handleE'\"\n\n\ntext \\<open>\n  Handling exceptions, and additionally providing a continuation\n  if the left-hand side throws no exception:\n\\<close>\ndefinition\n  handle_elseE :: \"('s, 'e + 'a) tmonad \\<Rightarrow>\n                   ('e \\<Rightarrow> ('s, 'ee + 'b) tmonad) \\<Rightarrow>\n                   ('a \\<Rightarrow> ('s, 'ee + 'b) tmonad) \\<Rightarrow>\n                   ('s, 'ee + 'b) tmonad\"\n  (\"_ <handle> _ <else> _\" 10)\nwhere\n  \"f <handle> handler <else> continue \\<equiv>\n   do v \\<leftarrow> f;\n   case v of Inl e  \\<Rightarrow> handler e\n           | Inr v' \\<Rightarrow> continue v'\n   od\"\n\nsubsection \"Loops\"\n\ntext \\<open>\n  Loops are handled using the following inductive predicate;\n  non-termination is represented using the failure flag of the\n  monad.\n\\<close>\ninductive_set\n  whileLoop_results :: \"('r \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('r \\<Rightarrow> ('s, 'r) tmonad) \\<Rightarrow> (('r \\<times> 's) \\<times> ((tmid \\<times> 's) list \\<times> ('s, 'r) tmres)) set\"\n  for C B\nwhere\n    \"\\<lbrakk> \\<not> C r s \\<rbrakk> \\<Longrightarrow> ((r, s), ([], Result (r, s))) \\<in> whileLoop_results C B\"\n  | \"\\<lbrakk> C r s; (ts, Failed) \\<in> B r s \\<rbrakk> \\<Longrightarrow> ((r, s), (ts, Failed)) \\<in> whileLoop_results C B\"\n  | \"\\<lbrakk> C r s; (ts, Incomplete) \\<in> B r s \\<rbrakk> \\<Longrightarrow> ((r, s), (ts, Incomplete)) \\<in> whileLoop_results C B\"\n  | \"\\<lbrakk> C r s; (ts, Result (r', s')) \\<in> B r s; ((r', s'), (ts',z)) \\<in> whileLoop_results C B  \\<rbrakk>\n       \\<Longrightarrow> ((r, s), (ts'@ts,z)) \\<in> whileLoop_results C B\"\n\ninductive_cases whileLoop_results_cases_result_end: \"((x,y), ([],Result r)) \\<in> whileLoop_results C B\"\ninductive_cases whileLoop_results_cases_fail: \"((x,y), (ts, Failed)) \\<in> whileLoop_results C B\"\ninductive_cases whileLoop_results_cases_incomplete: \"((x,y), (ts, Incomplete)) \\<in> whileLoop_results C B\"\n\ninductive_simps whileLoop_results_simps_valid: \"((x,y), ([], Result z)) \\<in> whileLoop_results C B\"\n\ninductive\n  whileLoop_terminates :: \"('r \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('r \\<Rightarrow> ('s, 'r) tmonad) \\<Rightarrow> 'r \\<Rightarrow> 's \\<Rightarrow> bool\"\n  for C B\nwhere\n    \"\\<not> C r s \\<Longrightarrow> whileLoop_terminates C B r s\"\n  | \"\\<lbrakk> C r s; \\<forall>(r', s') \\<in> Result -` snd ` (B r s). whileLoop_terminates C B r' s' \\<rbrakk>\n        \\<Longrightarrow> whileLoop_terminates C B r s\"\n\n\ninductive_cases whileLoop_terminates_cases: \"whileLoop_terminates C B r s\"\ninductive_simps whileLoop_terminates_simps: \"whileLoop_terminates C B r s\"\n\ndefinition\n  whileLoop :: \"('r \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('r \\<Rightarrow> ('s, 'r) tmonad) \\<Rightarrow> 'r \\<Rightarrow> ('s, 'r) tmonad\"\nwhere\n  \"whileLoop C B \\<equiv> (\\<lambda>r s. {(ts, res). ((r,s), ts,res) \\<in> whileLoop_results C B})\"\n\nnotation (output)\n  whileLoop  (\"(whileLoop (_)//  (_))\" [1000, 1000] 1000)\n\ndefinition\n  whileLoopT :: \"('r \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('r \\<Rightarrow> ('s, 'r) tmonad) \\<Rightarrow> 'r \\<Rightarrow> ('s, 'r) tmonad\"\nwhere\n  \"whileLoopT C B \\<equiv> (\\<lambda>r s. {(ts, res). ((r,s), ts,res) \\<in> whileLoop_results C B\n                                         \\<and> whileLoop_terminates C B r s})\"\n\nnotation (output)\n  whileLoopT  (\"(whileLoopT (_)//  (_))\" [1000, 1000] 1000)\n\ndefinition\n  whileLoopE :: \"('r \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('r \\<Rightarrow> ('s, 'e + 'r) tmonad)\n      \\<Rightarrow> 'r \\<Rightarrow> ('s, ('e + 'r)) tmonad\"\nwhere\n  \"whileLoopE C body \\<equiv>\n      \\<lambda>r. whileLoop (\\<lambda>r s. (case r of Inr v \\<Rightarrow> C v s | _ \\<Rightarrow> False)) (lift body) (Inr r)\"\n\nnotation (output)\n  whileLoopE  (\"(whileLoopE (_)//  (_))\" [1000, 1000] 1000)\n\nsubsection \"Await command\"\n\ntext \\<open> @{term \"Await c f\"} blocks the execution until the @{term \"c\"} is true,\n      and atomically executes @{term \"f\"}.\n\\<close>\n\ndefinition\n  Await :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,unit) tmonad\"\nwhere\n  \"Await c \\<equiv>\n  do\n    s \\<leftarrow> get;\n    \\<comment> \\<open>Add unfiltered environment events, with the last one\n       satisfying the `c' state predicate\\<close>\n    xs \\<leftarrow> select {xs. c (last_st_tr (map (Pair Env) xs) s)};\n    tr \\<leftarrow> return (map (Pair Env) xs);\n    put_trace tr;\n    \\<comment> \\<open>Pick the last event of the trace\\<close>\n    put (last_st_tr tr s)\n  od\"\n\nsection \"Hoare Logic\"\n\nsubsection \"Validity\"\n\ntext \\<open> This section defines a Hoare logic for partial correctness for\n  the nondeterministic state monad as well as the exception monad.\n  The logic talks only about the behaviour part of the monad and ignores\n  the failure flag.\n\n  The logic is defined semantically. Rules work directly on the\n  validity predicate.\n\n  In the nondeterministic state monad, validity is a triple of precondition,\n  monad, and postcondition. The precondition is a function from state to\n  bool (a state predicate), the postcondition is a function from return value\n  to state to bool. A triple is valid if for all states that satisfy the\n  precondition, all result values and result states that are returned by\n  the monad satisfy the postcondition. Note that if the computation returns\n  the empty set, the triple is trivially valid. This means @{term \"assert P\"}\n  does not require us to prove that @{term P} holds, but rather allows us\n  to assume @{term P}! Proving non-failure is done via separate predicate and\n  calculus (see below).\n\\<close>\n\n\ndefinition\n  valid :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) tmonad \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  (\"\\<lbrace>_\\<rbrace>/ _ /\\<lbrace>_\\<rbrace>\")\nwhere\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<equiv> \\<forall>s. P s \\<longrightarrow> (\\<forall>(r,s') \\<in> mres (f s). Q r s')\"\n\ntext \\<open>\n  We often reason about invariant predicates. The following provides shorthand syntax\n  that avoids repeating potentially long predicates.\n\\<close>\nabbreviation (input)\n  invariant :: \"('s,'a) tmonad \\<Rightarrow> ('s \\<Rightarrow> bool) \\<Rightarrow> bool\" (\"_ \\<lbrace>_\\<rbrace>\" [59,0] 60)\nwhere\n  \"invariant f P \\<equiv> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>_. P\\<rbrace>\"\n\ntext \\<open>rg_pred type: Rely-Guaranty predicates (state before => state after => bool)\\<close>\ntype_synonym 's rg_pred = \"'s \\<Rightarrow> 's \\<Rightarrow> bool\"\n\n\ntext \\<open>\n  Validity for the exception monad is similar and build on the standard\n  validity above. Instead of one postcondition, we have two: one for\n  normal and one for exceptional results.\n\\<close>\ndefinition\n  validE :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'a + 'b) tmonad \\<Rightarrow>\n             ('b \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow>\n             ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n(\"\\<lbrace>_\\<rbrace>/ _ /(\\<lbrace>_\\<rbrace>,/ \\<lbrace>_\\<rbrace>)\" )\nwhere\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace> \\<equiv> \\<lbrace>P\\<rbrace> f \\<lbrace> \\<lambda>v s. case v of Inr r \\<Rightarrow> Q r s | Inl e \\<Rightarrow> E e s \\<rbrace>\"\n(*\ntext \\<open> Validity for exception monad with interferences. Not as easy to phrase\n as we need to  \\<close>\ndefinition\n  validIE :: \"('s, 'a + 'b) tmonad \\<Rightarrow>\n             's rg_pred \\<Rightarrow>\n             's rg_pred \\<Rightarrow> 's rg_pred \\<Rightarrow>\n             ('b \\<Rightarrow> 's rg_pred) \\<Rightarrow>\n             ('a \\<Rightarrow> 's rg_pred) \\<Rightarrow> bool\"\n (\"_ //PRE _//RELY _//GUAR _//POST _//EXC _\" [59,0,0,0,0,0] 60)\nwhere\n  \"validIE f P R G Q E \\<equiv> f SAT [P,R,G,\\<lambda>v. case v of Inr r \\<Rightarrow> Q r | Inl e \\<Rightarrow> E e]\"\n\nabbreviation (input)\n  validIEsat :: \"('s, 'a + 'b) tmonad \\<Rightarrow>\n             's rg_pred \\<Rightarrow>\n             's rg_pred \\<Rightarrow> 's rg_pred \\<Rightarrow>\n             ('b \\<Rightarrow> 's rg_pred) \\<Rightarrow>\n             ('a \\<Rightarrow> 's rg_pred) \\<Rightarrow> bool\"\n  (\"_ //SAT [_, _, _, _, _]\" [59,0,0,0,0,0] 60)\n  where\n  \"validIEsat f P R G Q E \\<equiv> validIE f P R G Q E\"\n *)\ntext \\<open>\n  The following two instantiations are convenient to separate reasoning\n  for exceptional and normal case.\n\\<close>\ndefinition\n  validE_R :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'e + 'a) tmonad \\<Rightarrow>\n               ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n   (\"\\<lbrace>_\\<rbrace>/ _ /\\<lbrace>_\\<rbrace>, -\")\nwhere\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,- \\<equiv> validE P f Q (\\<lambda>x y. True)\"\n\ndefinition\n  validE_E :: \"('s \\<Rightarrow> bool) \\<Rightarrow>  ('s, 'e + 'a) tmonad \\<Rightarrow>\n               ('e \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n   (\"\\<lbrace>_\\<rbrace>/ _ /-, \\<lbrace>_\\<rbrace>\")\nwhere\n  \"\\<lbrace>P\\<rbrace> f -,\\<lbrace>Q\\<rbrace> \\<equiv> validE P f (\\<lambda>x y. True) Q\"\n\n\ntext \\<open> Abbreviations for trivial preconditions: \\<close>\nabbreviation(input)\n  top :: \"'a \\<Rightarrow> bool\" (\"\\<top>\")\nwhere\n  \"\\<top> \\<equiv> \\<lambda>_. True\"\n\nabbreviation(input)\n  bottom :: \"'a \\<Rightarrow> bool\" (\"\\<bottom>\")\nwhere\n  \"\\<bottom> \\<equiv> \\<lambda>_. False\"\n\ntext \\<open> Abbreviations for trivial postconditions (taking two arguments): \\<close>\nabbreviation(input)\n  toptop :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (\"\\<top>\\<top>\")\nwhere\n  \"\\<top>\\<top> \\<equiv> \\<lambda>_ _. True\"\n\nabbreviation(input)\n  toptoptop :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'b \\<Rightarrow> bool\" (\"\\<top>\\<top>\\<top>\")\nwhere\n  \"\\<top>\\<top>\\<top> \\<equiv> \\<lambda>_ _ _. True\"\n\nabbreviation(input)\n  botbot :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (\"\\<bottom>\\<bottom>\")\nwhere\n  \"\\<bottom>\\<bottom> \\<equiv> \\<lambda>_ _. False\"\n\nabbreviation(input)\n  botbotbot :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'b \\<Rightarrow> bool\" (\"\\<bottom>\\<bottom>\\<bottom>\")\nwhere\n  \"\\<bottom>\\<bottom>\\<bottom> \\<equiv> \\<lambda>_ _ _. False\"\n\ntext \\<open>\n  Lifting @{text \"\\<and>\"} and @{text \"\\<or>\"} over two arguments.\n  Lifting @{text \"\\<and>\"} and @{text \"\\<or>\"} over one argument is already\n  defined (written @{text \"and\"} and @{text \"or\"}).\n\\<close>\ndefinition\n  bipred_conj :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\"\n  (infixl \"And\" 96)\nwhere\n  \"bipred_conj P Q \\<equiv> \\<lambda>x y. P x y \\<and> Q x y\"\n\ndefinition\n  bipred_disj :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\"\n  (infixl \"Or\" 91)\nwhere\n  \"bipred_disj P Q \\<equiv> \\<lambda>x y. P x y \\<or> Q x y\"\n\nsubsection \"Determinism\"\n\ntext \\<open> A monad of type @{text tmonad} is deterministic iff it\nreturns an empty trace, exactly one state and result and does not fail \\<close>\ndefinition\n  det :: \"('a,'s) tmonad \\<Rightarrow> bool\"\nwhere\n  \"det f \\<equiv> \\<forall>s. \\<exists>r. f s = {([], Result r)}\"\n\ntext \\<open> A deterministic @{text tmonad} can be turned\n  into a normal state monad: \\<close>\ndefinition\n  the_run_state :: \"('s,'a) tmonad \\<Rightarrow> 's \\<Rightarrow> 'a \\<times> 's\"\nwhere\n  \"the_run_state M \\<equiv> \\<lambda>s. THE s'. mres (M s) = {s'}\"\n\n\nsubsection \"Non-Failure\"\n\ntext \\<open>\n  We can formulate non-failure separately from validity.\n\\<close>\ndefinition\n  no_fail :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) tmonad \\<Rightarrow> bool\"\nwhere\n  \"no_fail P m \\<equiv> \\<forall>s. P s \\<longrightarrow> Failed \\<notin> snd ` (m s)\"\n\ntext \\<open>\n  It is often desired to prove non-failure and a Hoare triple\n  simultaneously, as the reasoning is often similar. The following\n  definitions allow such reasoning to take place.\n\\<close>\n\ndefinition\n  validNF ::\"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) tmonad \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n      (\"\\<lbrace>_\\<rbrace>/ _ /\\<lbrace>_\\<rbrace>!\")\nwhere\n  \"validNF P f Q \\<equiv> valid P f Q \\<and> no_fail P f\"\n\ndefinition\n  validE_NF :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'a + 'b) tmonad \\<Rightarrow>\n             ('b \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow>\n             ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  (\"\\<lbrace>_\\<rbrace>/ _ /(\\<lbrace>_\\<rbrace>,/ \\<lbrace>_\\<rbrace>!)\")\nwhere\n  \"validE_NF P f Q E \\<equiv> validE P f Q E \\<and> no_fail P f\"\n\nlemma validE_NF_alt_def:\n  \"\\<lbrace> P \\<rbrace> B \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>! = \\<lbrace> P \\<rbrace> B \\<lbrace> \\<lambda>v s. case v of Inl e \\<Rightarrow> E e s | Inr r \\<Rightarrow> Q r s \\<rbrace>!\"\n  by (clarsimp simp: validE_NF_def validE_def validNF_def)\n\n(* text \\<open>\n  Usually, well-formed monads constructed from the primitives\n  above will have the following property: if they return an\n  empty set of results, they will have the failure flag set.\n\\<close>\ndefinition\n  empty_fail :: \"('s,'a) tmonad \\<Rightarrow> bool\"\nwhere\n  \"empty_fail m \\<equiv> \\<forall>s. fst (m s) = {} \\<longrightarrow> snd (m s)\"\n\ntext \\<open>\n  Useful in forcing otherwise unknown executions to have\n  the @{const empty_fail} property.\n\\<close>\ndefinition\n  mk_ef :: \"'a set \\<times> bool \\<Rightarrow> 'a set \\<times> bool\"\nwhere\n  \"mk_ef S \\<equiv> (fst S, fst S = {} \\<or> snd S)\"\n *)\nsection \"Basic exception reasoning\"\n\ntext \\<open>\n  The following predicates @{text no_throw} and @{text no_return} allow\n  reasoning that functions in the exception monad either do\n  no throw an exception or never return normally.\n\\<close>\n\ndefinition \"no_throw P A \\<equiv> \\<lbrace> P \\<rbrace> A \\<lbrace> \\<lambda>_ _. True \\<rbrace>,\\<lbrace> \\<lambda>_ _. False \\<rbrace>\"\n\ndefinition \"no_return P A \\<equiv> \\<lbrace> P \\<rbrace> A \\<lbrace>\\<lambda>_ _. False\\<rbrace>,\\<lbrace>\\<lambda>_ _. True \\<rbrace>\"\n\nsection \"Trace monad Parallel\"\n\ndefinition\n  parallel :: \"('s,'a) tmonad \\<Rightarrow> ('s,'a) tmonad \\<Rightarrow> ('s,'a) tmonad\"\nwhere\n  \"parallel f g = (\\<lambda>s. {(xs, rv). \\<exists>f_steps. length f_steps = length xs\n    \\<and> (map (\\<lambda>(f_step, (id, s)). (if f_step then id else Env, s)) (zip f_steps xs), rv) \\<in> f s\n    \\<and> (map (\\<lambda>(f_step, (id, s)). (if f_step then Env else id, s)) (zip f_steps xs), rv) \\<in> g s})\"\n\nabbreviation(input)\n  \"parallel_mrg \\<equiv> ((\\<lambda>((idn, s), (idn', _)). (if idn = Env then idn' else idn, s)))\"\n\nlemma parallel_def2:\n  \"parallel f g = (\\<lambda>s. {(xs, rv). \\<exists>ys zs. (ys, rv) \\<in> f s \\<and> (zs, rv) \\<in> g s\n    \\<and> list_all2 (\\<lambda>y z. (fst y = Env \\<or> fst z = Env) \\<and> snd y = snd z) ys zs\n    \\<and> xs = map parallel_mrg (zip ys zs)})\"\n  apply (simp add: parallel_def fun_eq_iff set_eq_iff)\n  apply safe\n   apply (rule exI, rule conjI, assumption)+\n   apply (simp add: list_all2_conv_all_nth list_eq_iff_nth_eq split_def prod_eq_iff)\n   apply clarsimp\n  apply (rule_tac x=\"map (((\\<noteq>) Env) o fst) ys\" in exI)\n  apply (simp add: zip_map1 o_def split_def)\n  apply (strengthen subst[where P=\"\\<lambda>xs. (xs, v) \\<in> S\" for v S, mk_strg I _ E])\n  apply (clarsimp simp: list_all2_conv_all_nth list_eq_iff_nth_eq\n                        split_def prod_eq_iff\n             split del: if_split cong: if_cong)\n  apply auto\n  done\n\nlemma parallel_def3:\n  \"parallel f g = (\\<lambda>s. (\\<lambda>(ys, zs, rv). (map parallel_mrg (zip ys zs), rv))\n    ` {(ys, zs, rv). (ys, rv) \\<in> f s \\<and> (zs, rv) \\<in> g s\n    \\<and> list_all2 (\\<lambda>y z. (fst y = Env \\<or> fst z = Env) \\<and> snd y = snd z) ys zs})\"\n  by (simp add: parallel_def2, rule ext, auto simp: image_def)\n\nprimrec\n  trace_steps :: \"(tmid \\<times> 's) list \\<Rightarrow> 's \\<Rightarrow> (tmid \\<times> 's \\<times> 's) set\"\nwhere\n  \"trace_steps (elem # trace) s0 = {(fst elem, s0, snd elem)} \\<union> trace_steps trace (snd elem)\"\n| \"trace_steps [] s0 = {}\"\n\nlemma trace_steps_nth:\n  \"trace_steps xs s0 = (\\<lambda>i. (fst (xs ! i), (if i = 0 then s0 else snd (xs ! (i - 1))), snd (xs ! i))) ` {..< length xs}\"\nproof (induct xs arbitrary: s0)\n  case Nil\n  show ?case by simp\nnext\n  case (Cons a xs)\n  show ?case\n    apply (simp add: lessThan_Suc_eq_insert_0 Cons image_image nth_Cons')\n    apply (intro arg_cong2[where f=insert] refl image_cong)\n    apply simp\n    done\nqed\n\ndefinition\n  rely_cond :: \"'s rg_pred \\<Rightarrow> 's \\<Rightarrow> (tmid \\<times> 's) list \\<Rightarrow> bool\"\nwhere\n  \"rely_cond R s0s tr = (\\<forall>(ident, s0, s) \\<in> trace_steps (rev tr) s0s. ident = Env \\<longrightarrow> R s0 s)\"\n\ndefinition\n  guar_cond :: \"'s rg_pred \\<Rightarrow> 's \\<Rightarrow> (tmid \\<times> 's) list \\<Rightarrow> bool\"\nwhere\n  \"guar_cond G s0s tr = (\\<forall>(ident, s0, s) \\<in> trace_steps (rev tr) s0s. ident = Me \\<longrightarrow> G s0 s)\"\n\nlemma rg_empty_conds[simp]:\n  \"rely_cond R s0s []\"\n  \"guar_cond G s0s []\"\n  by (simp_all add: rely_cond_def guar_cond_def)\n\ndefinition\n  rely :: \"('s, 'a) tmonad \\<Rightarrow> 's rg_pred \\<Rightarrow> 's \\<Rightarrow> ('s, 'a) tmonad\"\nwhere\n  \"rely f R s0s \\<equiv> (\\<lambda>s. f s \\<inter> ({tr. rely_cond R s0s tr} \\<times> UNIV))\"\n\ndefinition\n  prefix_closed :: \"('s, 'a) tmonad \\<Rightarrow> bool\"\nwhere\n  \"prefix_closed f = (\\<forall>s. \\<forall>x xs. (x # xs) \\<in> fst ` f s \\<longrightarrow> (xs, Incomplete) \\<in> f s)\"\n\ndefinition\n  validI :: \"('s \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> 's rg_pred \\<Rightarrow> ('s,'a) tmonad\n    \\<Rightarrow> 's rg_pred \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  (\"(\\<lbrace>_\\<rbrace>,/ \\<lbrace>_\\<rbrace>)/ _ /(\\<lbrace>_\\<rbrace>,/ \\<lbrace>_\\<rbrace>)\")\nwhere\n  \"\\<lbrace>P\\<rbrace>,\\<lbrace>R\\<rbrace> f \\<lbrace>G\\<rbrace>,\\<lbrace>Q\\<rbrace> \\<equiv> prefix_closed f \\<and> (\\<forall>s0 s. P s0 s\n    \\<longrightarrow> (\\<forall>tr res. (tr, res) \\<in> (rely f R s0 s) \\<longrightarrow> guar_cond G s0 tr\n        \\<and> (\\<forall>rv s'. res = Result (rv, s') \\<longrightarrow> Q rv (last_st_tr tr s0) s')))\"\n\nlemma in_rely:\n  \"\\<lbrakk> (tr, res) \\<in> f s; rely_cond R s0s tr \\<rbrakk> \\<Longrightarrow> (tr, res) \\<in> rely f R s0s s\"\n  by (simp add: rely_def)\n\nlemmas validI_D = validI_def[THEN meta_eq_to_obj_eq, THEN iffD1,\n    THEN conjunct2, rule_format, OF _ _ in_rely]\nlemmas validI_GD = validI_D[THEN conjunct1]\nlemmas validI_rvD = validI_D[THEN conjunct2, rule_format, rotated -1, OF refl]\nlemmas validI_prefix_closed = validI_def[THEN meta_eq_to_obj_eq, THEN iffD1, THEN conjunct1]\nlemmas validI_prefix_closed_T = validI_prefix_closed[where P=\"\\<lambda>_ _. False\" and R=\"\\<lambda>_ _. False\"\n    and G=\"\\<lambda>_ _. True\" and Q=\"\\<lambda>_ _ _. True\"]\n\nlemmas prefix_closedD1 = prefix_closed_def[THEN iffD1, rule_format]\n\nlemma in_fst_snd_image_eq:\n  \"x \\<in> fst ` S = (\\<exists>y. (x, y) \\<in> S)\"\n  \"y \\<in> snd ` S = (\\<exists>x. (x, y) \\<in> S)\"\n  by (auto elim: image_eqI[rotated])\n\nlemma in_fst_snd_image:\n  \"(x, y) \\<in> S \\<Longrightarrow> x \\<in> fst ` S\"\n  \"(x, y) \\<in> S \\<Longrightarrow> y \\<in> snd ` S\"\n  by (auto simp: in_fst_snd_image_eq)\n\nlemmas prefix_closedD = prefix_closedD1[OF _ in_fst_snd_image(1)]\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/Monad_WP/TraceMonad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.30397252510735806}}
{"text": "\\<^marker>\\<open>creator \"Peter Lammich\"\\<close>\n\\<^marker>\\<open>contributor \"Maximilian P. L. Haslbeck\"\\<close>\nsection \\<open>Heapsort\\<close>\ntheory Sorting_Heapsort\nimports Sorting_Setup \"../../nrest/NREST_Automation\"\n  \"../../lib/More_Asymptotics\"\nbegin                                       \n\nparagraph \\<open>Summary\\<close>\ntext \\<open>This theory verifies functional correctness and running time of an implementation of heapsort.\\<close>\n\n\nparagraph \\<open>Main Theorems/Definitions\\<close>\ntext \\<open>\n\\<^item> sift_down: abstract algorithm for sift down\n\\<^item> sift_down_btu_correct/sift_down_restore_correct: sift down is used for two purposes in heap sort.\n    There are two correctness theorems for that algorithm.\n\\<^item> heapify_btu: algorithm to build up a heap from n elements\n\\<^item> heapsort: the abstract algorithm for heapsort using an initial heapify_btu and repeatedly\n    calls sift_down.\n\\<^item> heapsort_correct: correctness theorem for high level heapsort algorithm \n\\<^item> heapsort_impl: the synthesized LLVM program for heapsort\n\\<^item> heapsort_final_hoare_triple:  the final Hoare triple showing correctness and running time of heapsort\n\\<^item> heapsort3_allcost_simplified: the projected costs, for inspecting the constants\n\\<^item> heapsort3_allcost_nlogn: heapsorts running time bound is in O(n log n)\n\\<close>\n\n\nparagraph \\<open>TODOs\\<close>\ntext \\<open>\n\\<^item> heapify_btu actually is O(n). we only prove O(n * log n), as that suffices to prove that\n   heapsort is in O(n*log n)\n\\<close>\n\nsubsection \"Preparations\"\nsubsubsection \"stuff to move\"\n\n\n\nmethod_setup all_par =\n \\<open>Method.text_closure >> (fn m => fn ctxt => fn facts =>\n   let\n     fun tac i st' =\n       Goal.restrict i 1 st'\n       |> method_evaluate m ctxt facts\n       |> Seq.map (Goal.unrestrict i)\n\n   in SIMPLE_METHOD (PARALLEL_ALLGOALS tac) facts end)\n\\<close>\n(* TODO: Move *)\n\n\n(*declare less_eq_option_Some_None[simp]*)\nlemma ifSome_iff: \"(if b then Some T else None) = Some T' \\<longleftrightarrow> T=T' \\<and> b\"\n  by (auto split: if_splits)\n\n\nlemma ifSome_None: \"(if P then Some x else None) = Some y \\<longleftrightarrow> P \\<and> x=y\"\n  by (auto split: if_splits)\n\nlemma prod3: \"m\\<le> f x y z \\<Longrightarrow> m \\<le> (case (x,y,z) of (a,b,c) \\<Rightarrow> f a b c)\"\n  by auto\n\n\n\nsubsubsection \"Heap range context\"\n\nlocale heap_range_context = \n  fixes l h :: nat\n  assumes ran_not_empty[arith,simp]: \"l\\<le>h\"\nbegin  \n\n  (*lemma l_le_h[arith,simp]: \"l\\<le>h\" by simp*)\n\n  definition \"in_heap i \\<equiv> i\\<in>{l..<h}\"\n\n  definition parent where \"parent i \\<equiv> (i-1-l) div 2 + l\"\n  definition lchild where \"lchild i \\<equiv> 2*(i-l) + 1 + l\"\n  definition rchild where \"rchild i \\<equiv> 2*(i-l) + 2+ l\"  \n  \n  definition has_parent where \"has_parent i \\<equiv> in_heap i \\<and> i>l\"\n  definition has_lchild where \"has_lchild i \\<equiv> in_heap i \\<and> in_heap (lchild i)\"\n  definition has_rchild where \"has_rchild i \\<equiv> in_heap i \\<and> in_heap (rchild i)\"\n  \n  context begin\n    private method prove = (\n      unfold in_heap_def parent_def has_parent_def lchild_def rchild_def has_lchild_def has_rchild_def, \n      auto)\n\n    text \\<open>Optimized checks, normalize to i-l, for index shift\\<close>\n    lemma has_rchild_ihs: \"in_heap i \\<Longrightarrow> has_rchild i \\<longleftrightarrow> i-l<(h-l-1) div 2\"\n      by prove\n\n    lemma has_lchild_ihs: \"in_heap i \\<Longrightarrow> has_lchild i \\<longleftrightarrow> (i-l) < (h-l) div 2\"  \n      by prove\n      \n    lemma has_parent_ihs: \"in_heap i \\<Longrightarrow> has_parent i \\<longleftrightarrow> i-l > 0\"\n      by prove\n      \n    lemma lchild_ihs: \"lchild i - l = 2*(i-l)+1\"  \n      by prove\n      \n    lemma rchild_ihs: \"rchild i - l = 2*(i-l)+2\"  \n      by prove\n      \n    lemma parent_ihs: \"parent i - l = (i-l-1) div 2\"\n      by prove\n      \n    lemma in_heapI: \"\\<lbrakk> l\\<le>i; i<h \\<rbrakk> \\<Longrightarrow> in_heap i\" by prove\n      \n    lemma in_heap_bounds[simp]: \n      assumes \"in_heap i\" \n      shows \"l\\<le>i\" and \"i<h\"\n      using assms by prove\n\n    lemma in_heap_triv[simp]: \n      \"has_parent i \\<Longrightarrow> in_heap i\"\n      \"has_lchild i \\<Longrightarrow> in_heap i\"\n      \"has_rchild i \\<Longrightarrow> in_heap i\"        \n      by prove\n            \n    lemma parent_in_heap[simp]: \n      \"has_parent i \\<Longrightarrow> in_heap (parent i)\"\n      \"has_parent i \\<Longrightarrow> has_lchild (parent i)\" \n      by prove\n    \n    lemma children_in_heap[simp]: \n      \"has_lchild i \\<Longrightarrow> in_heap (lchild i)\"\n      \"has_rchild i \\<Longrightarrow> in_heap (rchild i)\"\n      by prove\n\n    lemmas in_heap_simps = in_heap_triv parent_in_heap children_in_heap\n            \n\n    lemma parent_of_child[simp]:\n      \"has_lchild i \\<Longrightarrow> parent (lchild i) = i\"\n      \"has_rchild i \\<Longrightarrow> parent (rchild i) = i\"\n      by prove\n\n    lemma children_differ[simp]:\n      \"lchild i \\<noteq> rchild i\" \n      \"rchild i \\<noteq> lchild i\" \n      by prove\n\n    lemma parent_less[simp]: \"has_parent i \\<Longrightarrow> parent i < i\" by prove\n\n    lemma children_greater[simp]: \n      \"lchild i > i\" \n      \"rchild i > i\"\n      by prove\n\n      \n    lemma children_diff_add_simps[iff]:\n      \"lchild i \\<noteq> i\"  \n      \"i \\<noteq> lchild i\"  \n      \"rchild i \\<noteq> i\"  \n      \"i \\<noteq> rchild i\"  \n      by prove\n      \n    lemma parent_diff_add_simps[simp]: \n      assumes \"has_parent i\" shows \"i \\<noteq> parent i\" and \"parent i \\<noteq> i\"\n      using assms by prove\n      \n    lemma rchild_imp_lchild[simp, intro]: \"has_rchild i \\<Longrightarrow> has_lchild i\" by prove\n\n    lemma no_parent_is_root: \"in_heap i \\<Longrightarrow> \\<not>has_parent i \\<longleftrightarrow> i=l\" by prove\n    \n    lemma root_no_parent[iff]: \"\\<not>has_parent l\" by prove\n    \n    \n    lemma root_in_heap: \"in_heap l\\<longleftrightarrow>l<h\" using ran_not_empty by prove\n    \n                      \n    lemma child_of_parent: \"has_parent i \\<Longrightarrow> lchild (parent i) = i \\<or>\n                     has_rchild (parent i) \\<and> rchild (parent i) = i\" by prove\n                \n    lemma children_of_parent_cases[consumes 1]:\n      assumes \"has_parent i\"\n      obtains (left) \"has_parent i\" \"lchild (parent i) = i\" \n            | (right) \"has_parent i\" \"has_rchild (parent i)\" \"rchild (parent i) = i\"\n      using assms child_of_parent by blast            \n\n    lemma lchild_of_no_rchild_term: \"\\<lbrakk>\\<not>has_rchild i; has_lchild i\\<rbrakk> \\<Longrightarrow> \\<not>has_lchild (lchild i)\" by prove \n      \n      \n          \n  end\n\n  lemmas heap_context_defs[no_atp] = in_heap_def parent_def lchild_def rchild_def has_parent_def has_lchild_def has_rchild_def\nend  \n  \nlocale heap_context = weak_ordering + heap_range_context begin\n  \n  definition is_heap :: \"'a list \\<Rightarrow> bool\" \n    where \"is_heap xs \\<equiv> (h\\<le>length xs) \\<and> (\\<forall>i. has_parent i \\<longrightarrow> xs!parent i \\<^bold>\\<ge> xs!i)\"\n\n    \n  subsubsection \\<open>Heap Property implies Minimal Element at Top\\<close>\n  context\n    fixes xs\n    assumes H: \"is_heap xs\"\n  begin  \n\n    lemma parent_el_greater[simp]: \"has_parent i \\<Longrightarrow> xs!i \\<^bold>\\<le> xs!parent i\"\n      using H\n      unfolding is_heap_def \n      by simp\n    \n    lemma root_greatest:\n      assumes \"in_heap i\"\n      shows \"xs!i \\<^bold>\\<le> xs!l\"\n      using assms \n    proof (induction i rule: less_induct)\n      case (less i)\n      note [simp] = \\<open>in_heap i\\<close>\n      \n      show ?case proof cases\n        assume [simp]: \"has_parent i\"\n        have \"xs!i \\<^bold>\\<le> xs!parent i\" by simp\n        also from less.IH[of \"parent i\"] have \"xs!parent i \\<^bold>\\<le> xs!l\" by simp\n        finally show ?case .\n      next\n        assume \"\\<not>has_parent i\" \n        hence \"i=l\" by (simp add: no_parent_is_root)\n        thus ?case by simp\n      qed  \n    qed\n  \n  end  \n\n    \n  subsubsection \\<open>Sift-Up Lemmas\\<close>    \n  definition is_heap_except_up :: \"nat \\<Rightarrow> 'a list \\<Rightarrow> bool\" \n    where \"is_heap_except_up j xs \\<equiv> \n      (h\\<le>length xs) \n      \\<and> (\\<forall>i. has_parent i \\<and> i\\<noteq>j \\<longrightarrow> xs!parent i \\<^bold>\\<ge> xs!i)\n      \\<and> (has_parent j \\<and> has_lchild j \\<longrightarrow> xs!parent j \\<^bold>\\<ge> xs!lchild j)\n      \\<and> (has_parent j \\<and> has_rchild j \\<longrightarrow> xs!parent j \\<^bold>\\<ge> xs!rchild j)\"\n\n  lemma is_heap_except_up_len_bound[simp, intro]:\n    assumes \"is_heap_except_up i xs\"\n    shows \"h\\<le>length xs\"     \n    using assms unfolding is_heap_except_up_def\n    by auto\n        \n  lemma sift_up_lemma:\n    assumes HP: \"has_parent i\"\n    assumes IHE: \"is_heap_except_up i xs\"\n    assumes GE: \"xs!i \\<^bold>\\<ge> xs!parent i\"\n    shows \"is_heap_except_up (parent i) (swap xs i (parent i))\"\n  proof -\n    from assms(2) have [simp, arith]: \"h\\<le>length xs\" unfolding is_heap_except_up_def by auto\n  \n    have X[simp]: \"i<length xs\" if \"in_heap i\" for i\n      using in_heap_bounds(2)[OF that] by simp\n\n    have HPROP: \"xs!j \\<^bold>\\<le> xs!parent j\" if \"has_parent j\" \"j\\<noteq>i\" for j\n      using that IHE unfolding is_heap_except_up_def by simp\n      \n      \n    show ?thesis using HP\n      unfolding is_heap_except_up_def\n      apply (clarsimp; safe)\n      subgoal\n        apply (clarsimp simp: swap_nth HPROP GE; safe)\n        subgoal by (metis GE HPROP trans)\n        by (metis IHE child_of_parent is_heap_except_up_def parent_in_heap(2))\n\n      subgoal\n        by (smt HPROP X children_greater(1) has_lchild_def in_heap_bounds(1) parent_of_child(1)\n                trans nat_less_le no_parent_is_root parent_in_heap(2) parent_less less_le_trans   \n                swap_indep swap_nth)\n      subgoal \n        by (smt HPROP X children_greater(2) has_parent_def has_rchild_def parent_less \n                parent_of_child(2) less_le trans less_trans swap_nth)\n        \n      done\n      \n  qed\n\n  text \\<open>Terminate when reached root\\<close>\n  lemma sift_up_term1: \"is_heap_except_up l xs \\<Longrightarrow> is_heap xs\"\n    unfolding is_heap_def is_heap_except_up_def by auto\n  \n  text \\<open>Terminate when parent is greater or equal\\<close>  \n  lemma sift_up_term2: \"\\<lbrakk>is_heap_except_up i xs; xs!i\\<^bold>\\<le>xs!parent i\\<rbrakk> \\<Longrightarrow> is_heap xs\"\n    unfolding is_heap_def is_heap_except_up_def by auto\n  \n  lemma grow_heap_context: \"heap_range_context l (Suc h)\" \n    apply unfold_locales using ran_not_empty by linarith \n    \n  text \\<open>Initializes a sift-up cycle by extending the heap by one element to the right\\<close>  \n  lemma sift_up_init:\n    assumes \"is_heap xs\"\n    assumes \"h<length xs\"\n    shows \"heap_context.is_heap_except_up (\\<^bold>\\<le>) l (Suc h) h xs\"\n  proof -\n    interpret N: heap_range_context l \"Suc h\" using grow_heap_context .\n    interpret N: heap_context \"(\\<^bold>\\<le>)\" \"(\\<^bold><)\" l \"Suc h\" by unfold_locales\n  \n    show ?thesis\n      using assms\n      unfolding is_heap_def is_heap_except_up_def N.is_heap_except_up_def\n      unfolding N.heap_context_defs heap_context_defs\n      by auto\n      \n  qed\n  \n  subsubsection \\<open>Sift-Down Lemmas\\<close>    \n\n  definition is_heap_except_down :: \"nat \\<Rightarrow> 'a list \\<Rightarrow> bool\"\n    where \"is_heap_except_down j xs \\<equiv>\n        (h\\<le>length xs) \n      \\<and> (\\<forall>i. has_parent i \\<and> parent i \\<noteq> j \\<longrightarrow> xs!parent i \\<^bold>\\<ge> xs!i)\n      \\<and> (\\<forall>i. has_parent i \\<and> has_parent j \\<and> parent i = j \\<longrightarrow> xs!parent j \\<^bold>\\<ge> xs!i)\"\n\n  lemma is_heap_except_down_len_bound[simp, intro]: \n    assumes \"is_heap_except_down i xs\"\n    shows \"h\\<le>length xs\"     \n    using assms unfolding is_heap_except_down_def\n    by auto\n          \n  lemma sift_down_lemma_left:\n    assumes HRC: \"has_rchild i\"\n    assumes IHE: \"is_heap_except_down i xs\"\n    assumes GE: \"xs!lchild i \\<^bold>\\<ge> xs!i\" \"xs!lchild i \\<^bold>\\<ge> xs!rchild i\"\n    shows \"is_heap_except_down (lchild i) (swap xs i (lchild i))\"\n  proof -  \n    show ?thesis \n      using IHE HRC GE\n      unfolding is_heap_except_down_def\n      apply (clarsimp)\n      by (smt child_of_parent children_greater(1) children_in_heap(1) dual_order.trans \n            has_parent_def parent_diff_add_simps(1) in_heap_bounds(2) leD order_less_le\n            parent_of_child(1) rchild_imp_lchild swap_indep swap_nth1 swap_nth2)\n      \n  qed\n\n  lemma sift_down_lemma_right:\n    assumes HRC: \"has_rchild i\"\n    assumes IHE: \"is_heap_except_down i xs\"\n    assumes GE: \"xs!rchild i \\<^bold>\\<ge> xs!i\" \"xs!lchild i \\<^bold>\\<le> xs!rchild i\"\n    shows \"is_heap_except_down (rchild i) (swap xs i (rchild i))\"\n  proof -  \n    show ?thesis \n      using IHE HRC GE\n      unfolding is_heap_except_down_def\n      apply (clarsimp)\n      by (smt child_of_parent children_greater(2) children_in_heap(2) dual_order.trans eq_iff \n              heap_range_context.has_parent_def heap_range_context_axioms in_heap_bounds(2)\n              less_le parent_less parent_of_child(2) swap_nth)\n      \n  qed\n  \n    \n  lemma sift_down_lemma_left_no_right_child:\n    assumes HRC: \"has_lchild i\" \"\\<not>has_rchild i\"\n    assumes IHE: \"is_heap_except_down i xs\"\n    assumes GE: \"xs!lchild i \\<^bold>\\<ge> xs!i\"\n    shows \"is_heap_except_down (lchild i) (swap xs i (lchild i))\"\n  proof -  \n    from IHE have [simp, arith]: \"h\\<le>length xs\" unfolding is_heap_except_down_def by auto\n    \n    have X[simp]: \"i<length xs\" if \"in_heap i\" for i\n      using in_heap_bounds(2)[OF that] by simp\n      \n    show ?thesis \n      using IHE HRC GE\n      unfolding is_heap_except_down_def\n      apply clarsimp\n      by (smt X child_of_parent children_greater(1) children_in_heap(1)\n              heap_range_context.has_parent_def heap_range_context.parent_of_child(1)\n              heap_range_context_axioms le_less_trans less_imp_le_nat parent_in_heap(1) swap_nth)\n      \n  qed\n\n  \n  lemma sift_down_term1: \"\\<not>has_lchild j \\<Longrightarrow> is_heap_except_down j xs \\<longleftrightarrow> is_heap xs\"\n    unfolding is_heap_except_down_def is_heap_def\n    by auto\n  \n  lemma sift_down_term2: \n    assumes \"is_heap_except_down j xs\" \"has_rchild j\" \"xs!j\\<^bold>\\<ge>xs!lchild j\" \"xs!j\\<^bold>\\<ge>xs!rchild j\"\n    shows \"is_heap xs\"\n    using assms\n    unfolding is_heap_except_down_def is_heap_def\n    apply (clarsimp)\n    by (metis children_of_parent_cases)\n  \n  lemma sift_down_term3:\n    assumes \"is_heap_except_down j xs\" \"has_lchild j\" \"\\<not>has_rchild j\" \"xs!j\\<^bold>\\<ge>xs!lchild j\"\n    shows \"is_heap xs\"\n    using assms\n    unfolding is_heap_except_down_def is_heap_def\n    apply (clarsimp)\n    by (metis children_of_parent_cases)\n     \n  lemma shrink_heap_context: \"Suc l<h \\<Longrightarrow> heap_range_context l (h-Suc 0)\" \n    apply unfold_locales using ran_not_empty by linarith \n  \n  text \\<open>Initializes a sift-down cycle by swapping the first and last element, \n        and then shrinking the heap by one element\\<close>\n  lemma sift_down_init:  \n    assumes \"is_heap xs\"\n    assumes LT: \"Suc l < h\"\n    shows \"heap_context.is_heap_except_down (\\<^bold>\\<le>) l (h-Suc 0) l (swap xs l (h-Suc 0))\"\n  proof -\n    interpret N: heap_context \"(\\<^bold>\\<le>)\" \"(\\<^bold><)\" l \"h-Suc 0\"\n      apply intro_locales\n      using shrink_heap_context[OF LT] .\n    \n    show ?thesis\n      using assms\n      unfolding is_heap_def is_heap_except_down_def N.is_heap_except_down_def\n      unfolding N.heap_context_defs heap_context_defs\n      by (auto simp: swap_nth)\n      \n  qed    \n        \n    \n  subsubsection \\<open>Bottom-up Heapify\\<close>\n\n  text \\<open>The nodes from index \\<open>l'\\<close> upwards satisfy the heap criterion\\<close>\n  definition is_heap_btu :: \"nat \\<Rightarrow> 'a list \\<Rightarrow> bool\" where \"is_heap_btu l' xs \\<equiv> \n        (l'\\<le>h \\<and> h\\<le>length xs) \n      \\<and> (\\<forall>i. has_parent i \\<and> parent i \\<ge> l' \\<longrightarrow> xs!parent i \\<^bold>\\<ge> xs!i)\"\n\n  text \\<open>Bottom-up heapify starts with only the last element being a heap\\<close>\n  lemma btu_heapify_init: \"h\\<le>length xs \\<Longrightarrow> is_heap_btu (h-Suc 0) xs\"  \n    unfolding is_heap_btu_def\n    apply auto\n    by (meson dual_order.trans in_heap_bounds(2) in_heap_triv(1) nat_le_Suc_less_imp not_le\n              parent_less)\n        \n  text \\<open>When we have reached the lower index, we have a complete heap\\<close>    \n  lemma btu_heapify_term: \"is_heap_btu l xs \\<longleftrightarrow> is_heap xs\"\n    unfolding is_heap_btu_def is_heap_def\n    by (auto simp: less_imp_le_nat)\n      \n      \n  text \\<open>All nodes in between l' and h form a valid heap, with downwards-hole at j\\<close>\n  definition is_heap_except_down_btu :: \"nat \\<Rightarrow> nat \\<Rightarrow> 'a list \\<Rightarrow> bool\"\n    where \"is_heap_except_down_btu l' j xs \\<equiv>\n        (l'\\<le>j \\<and> j<h \\<and> h\\<le>length xs) \n      \\<and> (\\<forall>i. has_parent i \\<and> parent i \\<ge> l' \\<and> parent i \\<noteq> j \\<longrightarrow> xs!parent i \\<^bold>\\<ge> xs!i)\n      \\<and> (\\<forall>i. has_parent i \\<and> has_parent j \\<and> parent j \\<ge>l' \\<and> parent i = j \\<longrightarrow> xs!parent j \\<^bold>\\<ge> xs!i)\"\n\n  lemma is_heap_except_down_btu_lenD: \"is_heap_except_down_btu l' j xs \\<Longrightarrow> h\\<le>length xs\"    \n    unfolding is_heap_except_down_btu_def by auto\n      \n  text \\<open>A sift-down round starts by including one more left element, and marking it as a hole\\<close>\n  lemma btu_sift_down_init: \"\\<lbrakk>is_heap_btu l' xs; l'>l\\<rbrakk> \\<Longrightarrow> is_heap_except_down_btu (l'-1) (l'-1) xs\"  \n    unfolding is_heap_except_down_btu_def is_heap_btu_def \n    apply auto\n    using leD parent_less by blast\n  \n      \n  text \\<open>Sift-down completed, we have a complete heap from \\<open>l'\\<close> upwards\\<close>\n  lemma btu_sift_down_term1: \"\\<not>has_lchild j \\<Longrightarrow> is_heap_except_down_btu l' j xs \\<Longrightarrow> is_heap_btu l' xs\"\n    unfolding is_heap_except_down_btu_def is_heap_btu_def \n    by auto\n      \n  lemma btu_sift_down_term2: \n    assumes \"is_heap_except_down_btu l' j xs\" \"has_rchild j\" \"xs!j\\<^bold>\\<ge>xs!lchild j\" \"xs!j\\<^bold>\\<ge>xs!rchild j\"\n    shows \"is_heap_btu l' xs\"\n    using assms\n    unfolding is_heap_except_down_btu_def is_heap_btu_def\n    apply (clarsimp)\n    by (smt dual_order.trans child_of_parent in_heap_bounds(2) in_heap_triv(3) le_cases not_le)\n  \n  lemma btu_sift_down_term3:\n    assumes \"is_heap_except_down_btu l' j xs\" \"has_lchild j\" \"\\<not>has_rchild j\" \"xs!j\\<^bold>\\<ge>xs!lchild j\"\n    shows \"is_heap_btu l' xs\"\n    using assms\n    unfolding is_heap_except_down_btu_def is_heap_btu_def\n    apply (clarsimp)\n    by (metis child_of_parent dual_order.trans in_heap_bounds(2) in_heap_triv(2) less_imp_le)\n  \n\n  \n\n  lemma btu_heapify_down_left:\n    assumes HRC: \"has_rchild i\"\n    assumes IHE: \"is_heap_except_down_btu l' i xs\"\n    assumes GE: \"xs!lchild i \\<^bold>\\<ge> xs!i\" \"xs!lchild i \\<^bold>\\<ge> xs!rchild i\"\n    shows \"is_heap_except_down_btu l' (lchild i) (swap xs i (lchild i))\"\n  proof -\n    from IHE have [simp, arith]: \"h\\<le>length xs\" unfolding is_heap_except_down_btu_def by auto\n    \n    have X[simp]: \"i<length xs\" if \"in_heap i\" for i\n      using in_heap_bounds(2)[OF that] by simp\n    \n    show ?thesis\n      using HRC IHE GE\n      unfolding is_heap_except_down_btu_def\n      apply (clarsimp simp: swap_nth)\n      by (smt child_of_parent children_greater(1) children_in_heap(1) \n              heap_range_context.has_parent_def heap_range_context_axioms leD le_cases \n              less_le_trans parent_of_child(1) rchild_imp_lchild)\n      \n  qed  \n        \n  lemma btu_heapify_down_right:\n    assumes HRC: \"has_rchild i\"\n    assumes IHE: \"is_heap_except_down_btu l' i xs\"\n    assumes GE: \"xs!rchild i \\<^bold>\\<ge> xs!i\" \"xs!lchild i \\<^bold>\\<le> xs!rchild i\"\n    shows \"is_heap_except_down_btu l' (rchild i) (swap xs i (rchild i))\"\n  proof -\n    from IHE have [simp, arith]: \"h\\<le>length xs\" unfolding is_heap_except_down_btu_def by auto\n    \n    have X[simp]: \"i<length xs\" if \"in_heap i\" for i\n      using in_heap_bounds(2)[OF that] by simp\n    \n    show ?thesis\n      using HRC IHE GE\n      unfolding is_heap_except_down_btu_def\n      apply (clarsimp simp: swap_nth)\n      by (smt child_of_parent children_greater(2) children_in_heap(2) dual_order.strict_trans2 \n              heap_range_context.has_parent_def heap_range_context_axioms less_imp_le_nat\n              parent_of_child(2))\n      \n  qed  \n    \n  lemma btu_heapify_down_left_no_right_child:\n    assumes HRC: \"has_lchild i\" \"\\<not>has_rchild i\"\n    assumes IHE: \"is_heap_except_down_btu l' i xs\"\n    assumes GE: \"xs!lchild i \\<^bold>\\<ge> xs!i\"\n    shows \"is_heap_except_down_btu l' (lchild i) (swap xs i (lchild i))\"\n  proof -\n    from IHE have [simp, arith]: \"h\\<le>length xs\" unfolding is_heap_except_down_btu_def by auto\n    \n    have X[simp]: \"i<length xs\" if \"in_heap i\" for i\n      using in_heap_bounds(2)[OF that] by simp\n    \n    show ?thesis\n      using HRC IHE GE\n      unfolding is_heap_except_down_btu_def\n      apply (clarsimp simp: swap_nth)\n      by (smt child_of_parent children_greater(1) children_in_heap(1) \n              heap_range_context.has_parent_def heap_range_context_axioms leD le_cases \n              less_le_trans parent_of_child(1))\n      \n  qed  \n    \n  definition \"sift_up_invar xs\\<^sub>0 i xs \\<equiv>\n      slice_eq_mset l h xs xs\\<^sub>0      \n    \\<and> is_heap_except_up i xs\"  \n    \n  lemma sift_up_invar_init: \n    assumes \"is_heap xs\" \"slice_eq_mset l h xs xs\\<^sub>0\" \"h<length xs\" \n    shows \"heap_context.sift_up_invar (\\<^bold>\\<le>) l (Suc h) xs\\<^sub>0 h xs\"\n  proof -\n    interpret N: heap_context \"(\\<^bold>\\<le>)\" \"(\\<^bold><)\" l \"Suc h\" by intro_locales (simp add: grow_heap_context)\n    \n    show ?thesis \n      using assms\n      by (meson N.sift_up_invar_def le_eq_less_or_eq nat_in_between_eq(1) ran_not_empty\n                sift_up_init slice_eq_mset_subslice)\n      \n  qed    \n      \n  lemma sift_up_invar_step: \"\\<lbrakk>sift_up_invar xs\\<^sub>0 i xs; has_parent i; xs!i\\<^bold>\\<ge>xs!parent i \\<rbrakk> \n    \\<Longrightarrow> sift_up_invar xs\\<^sub>0 (parent i) (swap xs i (parent i))\"\n    unfolding sift_up_invar_def\n    by (auto simp: sift_up_lemma)\n    \n  lemma sift_up_invar_term1: \"\\<lbrakk>sift_up_invar xs\\<^sub>0 l xs\\<rbrakk> \\<Longrightarrow> is_heap xs \\<and> slice_eq_mset l h xs xs\\<^sub>0\"\n    unfolding sift_up_invar_def\n    using sift_up_term1 by blast\n    \n  lemma sift_up_invar_term2: \"\\<lbrakk>sift_up_invar xs\\<^sub>0 i xs; xs!i\\<^bold>\\<le>xs!parent i\\<rbrakk> \n    \\<Longrightarrow> is_heap xs \\<and> slice_eq_mset l h xs xs\\<^sub>0\"\n    unfolding sift_up_invar_def\n    using sift_up_term2 by blast\n\n  definition \"sift_down_invar xs\\<^sub>0 i xs \\<equiv>\n      slice_eq_mset l h xs xs\\<^sub>0      \n    \\<and> is_heap_except_down i xs\"  \n\n  lemma sift_down_invar_step:\n    assumes \"sift_down_invar xs\\<^sub>0 i xs\"\n    shows \"\\<lbrakk>has_rchild i; xs!i\\<^bold>\\<le>xs!lchild i; xs!lchild i \\<^bold>\\<ge> xs!rchild i\\<rbrakk>\n               \\<Longrightarrow> sift_down_invar xs\\<^sub>0 (lchild i) (swap xs i (lchild i))\" \n      and \"\\<lbrakk>has_rchild i; xs!i\\<^bold>\\<le>xs!rchild i; xs!lchild i \\<^bold>\\<le> xs!rchild i\\<rbrakk>\n               \\<Longrightarrow> sift_down_invar xs\\<^sub>0 (rchild i) (swap xs i (rchild i))\"\n      and \"\\<lbrakk>has_lchild i; \\<not>has_rchild i; xs!i\\<^bold>\\<le>xs!lchild i\\<rbrakk>\n               \\<Longrightarrow> sift_down_invar xs\\<^sub>0 (lchild i) (swap xs i (lchild i))\" \n    using assms unfolding sift_down_invar_def\n    by (auto simp: sift_down_lemma_left sift_down_lemma_right sift_down_lemma_left_no_right_child)\n\n  thm sift_down_init (*xxx, ctd here: we need to initialize from heapsort loop invariant*)\n  lemma sift_down_invar_init: \n    assumes \"is_heap xs\" \"Suc l < h\" \n    shows \"heap_context.sift_down_invar (\\<^bold>\\<le>) l (h-Suc 0) (swap xs l (h-Suc 0)) l (swap xs l (h-Suc 0))\"\n  proof -\n    interpret N: heap_context \"(\\<^bold>\\<le>)\" \"(\\<^bold><)\" l \"h-Suc 0\"\n      apply intro_locales using assms shrink_heap_context by auto\n    show ?thesis using sift_down_init assms unfolding N.sift_down_invar_def \n      by (auto simp: sift_down_init)\n      \n  qed  \n\n  \n  definition \"heapify_btu_invar xs\\<^sub>0 l' xs \\<equiv>\n      slice_eq_mset l h xs xs\\<^sub>0      \n    \\<and> is_heap_btu l' xs\"\n  \n  definition \"sift_down_btu_invar xs\\<^sub>0 l' i xs \\<equiv> \n      slice_eq_mset l h xs xs\\<^sub>0      \n    \\<and> is_heap_except_down_btu l' i xs\"\n    \n    \n          \nend  \n\ncontext weak_ordering begin\n\n  sublocale singleton_heap_context: heap_context \"(\\<^bold>\\<le>)\" \"(\\<^bold><)\" l \"(Suc l)\"\n    by unfold_locales auto\n\n  lemma singleton_no_relatives[simp, intro!]:\n    \"\\<not>singleton_heap_context.has_parent l i\"  \n    \"\\<not>singleton_heap_context.has_lchild l i\"  \n    \"\\<not>singleton_heap_context.has_rchild l i\"  \n    unfolding singleton_heap_context.heap_context_defs \n    by auto\n    \n  lemma singleton_heap: \"l<length xs \\<Longrightarrow> singleton_heap_context.is_heap l xs\"  \n    unfolding singleton_heap_context.is_heap_def\n    by auto\n\nend  \n\n    \ncontext heap_context begin  \n\ncontext\n  fixes  T :: \"(nat) \\<Rightarrow> (char list, enat) acost\"\nbegin\n  definition mop_has_lchild  :: \"nat \\<Rightarrow> (bool, _) nrest\"\n    where [simp]: \"mop_has_lchild i \\<equiv> do { consume (RETURNT (has_lchild i)) (T (i)) }\"\n  sepref_register \"mop_has_lchild\"\nend\n\nlemma mop_has_lchild:\n  \"(mop_has_lchild T, mop_has_lchild T) \\<in> nat_rel \\<rightarrow> \\<langle>bool_rel\\<rangle> nrest_rel\"\n  apply(intro nrest_relI fun_relI)\n  unfolding mop_has_lchild_def \n  by (auto simp: pw_acost_le_iff refine_pw_simps list_rel_imp_same_length)\n\ncontext\n  fixes  T :: \"(nat) \\<Rightarrow> (char list, enat) acost\"\nbegin\n  definition mop_has_rchild  :: \"nat \\<Rightarrow> (bool, _) nrest\"\n    where [simp]: \"mop_has_rchild i \\<equiv> do { consume (RETURNT (has_rchild i)) (T (i)) }\"\n  sepref_register \"mop_has_rchild\"\nend\n\nlemma mop_has_rchild:\n  \"(mop_has_rchild T, mop_has_rchild T) \\<in> nat_rel \\<rightarrow> \\<langle>bool_rel\\<rangle> nrest_rel\"\n  apply(intro nrest_relI fun_relI)\n  unfolding mop_has_rchild_def \n  by (auto simp: pw_acost_le_iff refine_pw_simps list_rel_imp_same_length)\n\ncontext\n  fixes  T :: \"(nat) \\<Rightarrow> (char list, enat) acost\"\nbegin\n  definition mop_lchild  :: \"nat \\<Rightarrow> (nat, _) nrest\"\n    where [simp]: \"mop_lchild i \\<equiv> do { consume (RETURNT (lchild i)) (T (i)) }\"\n  sepref_register \"mop_lchild\"\nend\n\nlemma mop_lchild:\n  \"(mop_lchild T, mop_lchild T) \\<in> nat_rel \\<rightarrow> \\<langle>nat_rel\\<rangle> nrest_rel\"\n  apply(intro nrest_relI fun_relI)\n  unfolding mop_lchild_def \n  by (auto simp: pw_acost_le_iff refine_pw_simps)\n\ncontext\n  fixes  T :: \"(nat) \\<Rightarrow> (char list, enat) acost\"\nbegin\n  definition mop_rchild  :: \"nat \\<Rightarrow> (nat, _) nrest\"\n    where [simp]: \"mop_rchild i \\<equiv> do { consume (RETURNT (rchild i)) (T (i)) }\"\n  sepref_register \"mop_rchild\"\nend\n\nlemma mop_rchild:\n  \"(mop_rchild T, mop_rchild T) \\<in> nat_rel \\<rightarrow> \\<langle>nat_rel\\<rangle> nrest_rel\"\n  apply(intro nrest_relI fun_relI) \n  by (auto simp: pw_acost_le_iff refine_pw_simps)\n \n\n\n\nabbreviation \"mop_has_lchildF \\<equiv> mop_has_lchild (\\<lambda>_. top)\"\nabbreviation \"mop_has_rchildF \\<equiv> mop_has_rchild (\\<lambda>_. top)\"\nabbreviation \"mop_lchildF \\<equiv> mop_lchild (\\<lambda>_. top)\"\nabbreviation \"mop_rchildF \\<equiv> mop_rchild (\\<lambda>_. top)\"\n\nabbreviation \"mop_has_lchildN \\<equiv> mop_has_lchild (\\<lambda>_. cost ''has_lchild'' 1)\"\nabbreviation \"mop_has_rchildN \\<equiv> mop_has_rchild (\\<lambda>_. cost ''has_rchild'' 1)\"\nabbreviation \"mop_lchildN \\<equiv> mop_lchild (\\<lambda>_. cost ''lchild'' 1)\"\nabbreviation \"mop_rchildN \\<equiv> mop_rchild (\\<lambda>_. cost ''rchild'' 1)\"\n\nsubsection \\<open>Verification of sift_down (infinite cost)\\<close>\n\n  definition sift_down :: \"nat \\<Rightarrow> 'a list \\<Rightarrow> ('a list,_) nrest\" where \"sift_down i\\<^sub>0 xs \\<equiv> doN {\n    ASSERT (in_heap i\\<^sub>0 \\<and> i\\<^sub>0<length xs);\n    _ \\<leftarrow> consumea top;\n    (xs,i,_) \\<leftarrow> monadic_WHILEIT (\\<lambda>(xs,i,ctd). in_heap i \\<and> i\\<ge>i\\<^sub>0) \n      (\\<lambda>(xs,i,ctd). doN {\n                          hrc \\<leftarrow> mop_has_rchildF i;\n                          SPECc2F  (\\<and>)  hrc ctd\n                        }) \n      (\\<lambda>(xs,i,ctd). doN {\n        lci \\<leftarrow> mop_lchildF i;\n        lc \\<leftarrow> mop_list_getF xs lci;\n        rci \\<leftarrow> mop_rchildF i;\n        rc \\<leftarrow> mop_list_getF xs rci;\n        v \\<leftarrow> mop_list_getF xs i;\n      \n        if\\<^sub>N  SPECc2F (\\<^bold><)  lc rc then\n          if\\<^sub>N SPECc2F  (\\<^bold><)  v rc then\n            doN {\n              xs \\<leftarrow> mop_list_swapF xs i rci;\n              RETURN (xs,rci,True)\n            }\n          else\n           RETURN (xs,i,False)\n        else if\\<^sub>N  SPECc2F  (\\<^bold><)  v lc then\n          doN {\n            xs \\<leftarrow> mop_list_swapF xs i lci;\n            RETURN (xs,lci,True)\n          }\n        else\n          RETURN (xs,i,False)\n       }) \n    (xs,i\\<^sub>0,True);\n  \n    ASSERT (in_heap i \\<and> i\\<ge>i\\<^sub>0);\n    ASSERT (has_lchild i \\<longrightarrow> lchild i < length xs);\n    \n    if\\<^sub>N mop_has_lchildF i then\n      doN {\n        lci \\<leftarrow> mop_lchildF i;\n        if\\<^sub>N mop_cmp_idxs top xs i lci then\n          mop_list_swapF xs i lci\n        else\n          (doN { _ \\<leftarrow> consumea top; RETURN xs })\n      }\n    else\n      ( doN {_ \\<leftarrow> consumea top; RETURN xs })      \n  }\"\n\n  lemma in_heap_len_bound: \"in_heap i \\<Longrightarrow> h\\<le>length xs \\<Longrightarrow> i<length xs\"\n    using in_heap_bounds(2) less_le_trans by blast\n\n \nsubsubsection \\<open>Bottom Up Correct\\<close>\n\n  lemma sift_down_btu_correct:\n    assumes \"heapify_btu_invar xs\\<^sub>0 l' xs\" \"l<l'\"\n    shows \"sift_down (l'-Suc 0) xs \\<le> SPEC (\\<lambda>xs'. heapify_btu_invar xs\\<^sub>0 (l'-Suc 0) xs') (\\<lambda>_. top)\" \n    unfolding sift_down_def\n    unfolding SPEC_def\n    apply(rule gwp_specifies_I)\n\n    supply wr = monadic_WHILE_rule_real[OF refl, where \n      I=\"\\<lambda>(xs,i,ctd). if (in_heap i \\<and> i\\<ge>(l'-Suc 0) \\<and>\n          sift_down_btu_invar xs\\<^sub>0 (l'-Suc 0) i xs \n          \\<and> h\\<le>length xs\n          \\<and> (\\<not>ctd \\<longrightarrow> has_rchild i \\<and> xs!i\\<^bold>\\<ge>xs!lchild i \\<and> xs!i\\<^bold>\\<ge>xs!rchild i)) then Some top else None\"\n      and\n      R = \"Wellfounded.measure (\\<lambda>(xs,i,ctd). (if ctd then 1 else 0) + h - i)\"    \n    ]\n    unfolding mop_has_rchild_def mop_has_lchild_def mop_lchild_def mop_rchild_def\n          mop_cmp_idxs_def SPECc2_def mop_list_get_def mop_list_swap_def consumea_def\n    apply (refine_vcg \\<open>-\\<close> rules: wr If_le_Some_rule2 If_le_rule prod3) \n    using assms    \n    unfolding heapify_btu_invar_def sift_down_btu_invar_def\n    apply (simp_all add: ifSome_iff del: in_heap_simps)\n    (* apply (all \\<open>(auto simp: in_heap_len_bound diff_less_mono2 wo_leI; fail)?\\<close>) (** Takes loooong *)*)\n    subgoal by (force simp:  asym wo_leI simp: btu_heapify_down_right)  \n\n    subgoal by (simp add: diff_less_mono2 less_Suc_eq)\n    subgoal by simp (metis wo_leI wo_less_trans)\n    subgoal by (simp add: diff_less_mono less_imp_le)\n    subgoal by (force simp add: btu_heapify_down_left asym wo_leI)\n    subgoal by (simp add: diff_less_mono2 less_Suc_eq)\n    subgoal apply simp using local.trans wo_leI by blast\n    subgoal by (simp add: diff_less_mono less_imp_le)\n    subgoal by (auto simp: in_heap_len_bound diff_less_mono2 wo_leI)\n    subgoal by (auto simp: in_heap_len_bound diff_less_mono2 wo_leI)\n    subgoal by (auto simp: in_heap_len_bound diff_less_mono2 wo_leI)\n    subgoal \n      apply clarsimp\n      using btu_heapify_down_left_no_right_child btu_sift_down_term1 connex lchild_of_no_rchild_term wo_leD by blast\n    subgoal \n      apply clarsimp\n      using btu_sift_down_term1 btu_sift_down_term2 btu_sift_down_term3 wo_leI by blast\n    subgoal by (auto simp: in_heap_len_bound diff_less_mono2 wo_leI)\n    subgoal \n      apply clarsimp\n      using btu_sift_down_term1 btu_sift_down_term2 btu_sift_down_term3 wo_leI by blast\n    subgoal by (auto simp: in_heap_len_bound diff_less_mono2 wo_leI)\n\n    subgoal using btu_sift_down_init apply (auto simp: top_acost_absorbs)  \n      using is_heap_btu_def by blast\n    subgoal by (auto split: prod.splits simp: ifSome_iff)\n    subgoal unfolding is_heap_btu_def by (auto intro!: in_heapI)\n    done\n\n\nsubsubsection \\<open>Restore Correct\\<close>\n\n  lemma sift_down_restore_correct: \n    assumes A: \"l<h\" \"sift_down_invar xs\\<^sub>0 l xs\"\n    shows \"sift_down l xs \\<le> SPEC (\\<lambda>xs'. slice_eq_mset l h xs' xs\\<^sub>0 \\<and> is_heap xs') (\\<lambda>_. top)\"\n    unfolding sift_down_def\n    unfolding SPEC_def\n    apply(rule gwp_specifies_I)\n    unfolding mop_has_rchild_def mop_has_lchild_def mop_lchild_def mop_rchild_def\n          mop_cmp_idxs_def SPECc2_def mop_list_get_def mop_list_swap_def consumea_def\n    apply (refine_vcg \\<open>-\\<close> rules: monadic_WHILE_rule_real[OF refl, where \n      I=\"\\<lambda>(xs,i,ctd). if (in_heap i \\<and> i\\<ge>l \\<and>\n          sift_down_invar xs\\<^sub>0 i xs \n          \\<and> h\\<le>length xs\n          \\<and> (\\<not>ctd \\<longrightarrow> has_rchild i \\<and> xs!i\\<^bold>\\<ge>xs!lchild i \\<and> xs!i\\<^bold>\\<ge>xs!rchild i)) then Some top else None\"\n      and\n      R = \"Wellfounded.measure (\\<lambda>(xs,i,ctd). (if ctd then 1 else 0) + h - i)\"    \n    ] If_le_Some_rule2 If_le_rule prod3)\n    apply (all_par \\<open>(clarsimp simp add: ifSome_iff)?\\<close>)\n    (*apply (all \\<open>(auto simp: in_heap_len_bound diff_less_mono2 A sift_down_invar_step wo_leI root_in_heap; fail)?\\<close>)*)\n    subgoal using asym sift_down_invar_step(2) wo_leI by blast\n    subgoal by (simp add: diff_less_mono2 less_SucI)\n    subgoal using wo_less_trans wo_not_le_imp_less by blast\n    subgoal by (simp add: Suc_diff_le less_imp_le)\n    subgoal using asym sift_down_invar_step(1) wo_leI by blast\n    subgoal by (simp add: diff_less_mono2 less_Suc_eq)\n    subgoal using itrans wo_leI by blast \n    subgoal by (simp add: Suc_diff_le less_imp_le)\n    subgoal by (auto simp: in_heap_len_bound diff_less_mono2 A sift_down_invar_step wo_leI root_in_heap)\n    subgoal by (auto simp: in_heap_len_bound diff_less_mono2 A sift_down_invar_step wo_leI root_in_heap)\n    subgoal by (auto simp: in_heap_len_bound diff_less_mono2 A sift_down_invar_step wo_leI root_in_heap)\n    subgoal apply rule\n      subgoal unfolding sift_down_invar_def by simp    \n      subgoal by (meson lchild_of_no_rchild_term sift_down_invar_def sift_down_invar_step(3) sift_down_term1 wo_leD wo_leI wo_less_not_sym)\n      done\n    subgoal apply rule   \n      subgoal unfolding sift_down_invar_def by simp     \n      subgoal unfolding sift_down_invar_def by (meson wo_leI sift_down_term1 sift_down_term2 sift_down_term3)\n      done\n    subgoal by (auto simp: in_heap_len_bound diff_less_mono2 A sift_down_invar_step wo_leI root_in_heap)\n    subgoal apply rule\n      subgoal unfolding sift_down_invar_def by simp    \n      subgoal by (meson lchild_of_no_rchild_term less_imp_le not_le sift_down_invar_def sift_down_lemma_left_no_right_child sift_down_term1)\n      done\n    subgoal by (auto simp: in_heap_len_bound diff_less_mono2 A sift_down_invar_step wo_leI root_in_heap)\n    subgoal using A unfolding sift_down_invar_def is_heap_except_down_def by (auto simp: top_acost_absorbs)\n    subgoal using A unfolding sift_down_invar_def is_heap_except_down_def root_in_heap by auto\n    done\n    \n    \n\nsubsection \\<open>verification of sift_down1 (infinite cost)\\<close>\n    \n  text \\<open>Deferred swap optimization\\<close>\n\n  definition sift_down1 :: \"nat \\<Rightarrow> 'a list \\<Rightarrow> ('a list,_) nrest\" where \"sift_down1 i\\<^sub>0 xs \\<equiv> doN {\n    ASSERT (in_heap i\\<^sub>0);\n    v \\<leftarrow> mop_list_getF xs i\\<^sub>0;\n    (xs,i,_) \\<leftarrow> monadic_WHILEIT (\\<lambda>(xs,i,ctd). in_heap i \\<and> i\\<ge>i\\<^sub>0) \n      (\\<lambda>(xs,i,ctd). doN {                \n                          hrc \\<leftarrow> mop_has_rchildF i;\n                          SPECc2F  (\\<and>)  hrc ctd\n                        })\n    (\\<lambda>(xs,i,ctd). doN {\n        lci \\<leftarrow> mop_lchildF i;\n        rci \\<leftarrow> mop_rchildF i;\n        lc \\<leftarrow> mop_list_getF xs lci;\n        rc \\<leftarrow> mop_list_getF xs rci;\n        _ \\<leftarrow> consumea 0;\n    \n      if\\<^sub>N SPECc2F  (\\<^bold><)  lc rc then\n        if\\<^sub>N SPECc2F  (\\<^bold><)  v rc then\n          doN {\n            t \\<leftarrow> mop_list_getF xs rci;\n            xs \\<leftarrow> mop_list_setF xs i t;\n            RETURN (xs,rci,True)\n          }\n        else\n           (RETURN (xs,i,False))\n      else if\\<^sub>N SPECc2F  (\\<^bold><)  v lc then\n        doN {\n          t \\<leftarrow> mop_list_getF xs lci;\n          xs \\<leftarrow> mop_list_setF xs i t;\n          RETURN (xs,lci,True)\n        }\n      else \n        (RETURN (xs,i,False))\n      } \n    ) (xs,i\\<^sub>0,True);\n\n    ASSERT (in_heap i \\<and> i\\<ge>i\\<^sub>0);\n    ASSERT (has_lchild i \\<longrightarrow> lchild i < length xs);\n    \n    if\\<^sub>N mop_has_lchildF i then\n      (doN {\n        lci \\<leftarrow> mop_lchildF i;\n        if\\<^sub>N mop_cmp_v_idx top xs v lci then\n          (doN {\n            t \\<leftarrow> mop_list_getF xs lci;\n            xs \\<leftarrow> mop_list_setF xs i t;\n            xs \\<leftarrow> mop_list_setF xs lci v;\n            RETURN xs })\n        else\n          (doN {\n            xs \\<leftarrow> mop_list_setF xs i v;\n            RETURN xs}\n          )\n        })\n    else\n      (doN {\n        xs \\<leftarrow> mop_list_setF xs i v;\n        RETURN xs})\n  }\" \n\n\n  definition \"swap_opt_rel v \\<equiv> {((xs,i,ctd),(xs',i',ctd')). xs' = xs[i:=v] \\<and> i<length xs \\<and> i'=i \\<and> ctd'=ctd }\"\n\n  subsubsection \\<open>Refinement Lemma\\<close>\n\n lemma sift_down1_refine_functional_aux: \"sift_down1 i\\<^sub>0 xs \\<le> \\<Down> Id (timerefine TId (sift_down i\\<^sub>0 xs))\" \n    unfolding sift_down1_def sift_down_def\n    unfolding mop_list_get_def mop_list_swap_def mop_list_set_def \n              mop_lchild_def mop_rchild_def mop_has_rchild_def mop_has_lchild_def\n              SPECc2_alt mop_cmp_idxs_def mop_cmp_v_idx_def\n    apply normalize_blocks\n    apply (refine_rcg consumea_Id_refine bindT_refine_easy\n            monadic_WHILEIT_refine_t[where R=\"swap_opt_rel (xs ! i\\<^sub>0)\"]\n            MIf_refine\n          )\n    supply [simp del] = conc_Id  \n    apply(auto simp: swap_opt_rel_def top_acost_absorbs swap_def)\n    done\n\n\n    \n  text \\<open>Index shift optimization\\<close>\n  \n  definition \"ihs_opt_rel \\<equiv> {((xs,i,ctd),(xs',i',ctd')). xs' = xs \\<and> i' = i+l \\<and> ctd'=ctd }\"\n  \n  lemma ihs_opt_rel_alt: \"((xs,i,ctd), (xs',i',ctd'))\\<in>ihs_opt_rel \\<longleftrightarrow> xs'=xs \\<and> (i',i)\\<in>idx_shift_rel l \\<and> ctd'=ctd\"\n    unfolding ihs_opt_rel_def idx_shift_rel_def by auto\n\n    \n  definition [simp]: \"mop_lchild2 i \\<equiv> doN { ASSERT (2*i+1<h); consume (RETURN (2*i+1))  ( cost ''lchild'' 1) }\"\n  definition [simp]: \"mop_rchild2 i \\<equiv> doN { ASSERT (2*i+2<h); consume (RETURN (2*i+2))  ( cost ''rchild'' 1) }\"\n  definition [simp]: \"has_rchild2 i \\<equiv> i<(h-l-1) div 2\"\n  definition [simp]: \"has_lchild2 i \\<equiv> i<(h-l) div 2\"\n  definition [simp]: \"mop_has_lchild2  i \\<equiv> do { consume (RETURNT (has_lchild2 i)) (cost ''has_lchild'' 1) }\"\n  definition [simp]: \"mop_has_rchild2  i \\<equiv> do { consume (RETURNT (has_rchild2 i)) (cost ''has_rchild'' 1) }\"\n\n  definition [simp]: \"mop_lchild2F i \\<equiv> doN { ASSERT (2*i+1<h); consume (RETURN (2*i+1))  top }\"\n  definition [simp]: \"mop_rchild2F i \\<equiv> doN { ASSERT (2*i+2<h); consume (RETURN (2*i+2))  top }\"\n  definition [simp]: \"mop_has_lchild2F  i \\<equiv> do { consume (RETURNT (has_lchild2 i)) top }\"\n  definition [simp]: \"mop_has_rchild2F  i \\<equiv> do { consume (RETURNT (has_rchild2 i)) top }\"\n\n\n  definition [simp]: \"mop_lchild_l' i \\<equiv> doN { ASSERT (2*i+1<h); i'\\<leftarrow>SPECc2 ''mul'' (*) i 2; SPECc2 ''add'' (+) i' 1 }\"\n  definition [simp]: \"mop_rchild_l' i \\<equiv> doN { ASSERT (2*i+2<h); i'\\<leftarrow>SPECc2 ''mul'' (*) i 2; SPECc2 ''add'' (+) i' 2 }\"\n  definition [simp]: \"mop_has_lchild_l'  i \\<equiv> do { hl \\<leftarrow> SPECc2 ''sub'' (-) h l; hld2 \\<leftarrow> SPECc2 ''udiv'' (div) hl 2; SPECc2 ''icmp_slt'' (<) i hld2 }\"\n  definition [simp]: \"mop_has_rchild_l'  i \\<equiv> do { hl \\<leftarrow> SPECc2 ''sub'' (-) h l; hl1 \\<leftarrow> SPECc2 ''sub'' (-) hl 1; hld2 \\<leftarrow> SPECc2 ''udiv'' (div) hl1 2; SPECc2 ''icmp_slt'' (<) i hld2 }\"\n\n      \nend  \n  \nconcrete_definition mop_lchild3 is heap_context.mop_lchild_l'_def\nconcrete_definition mop_rchild3 is heap_context.mop_rchild_l'_def\nconcrete_definition has_rchild3 is heap_context.has_rchild2_def\nconcrete_definition has_lchild3 is heap_context.has_lchild2_def\nconcrete_definition mop_has_lchild3 is heap_context.mop_has_lchild_l'_def\nconcrete_definition mop_has_rchild3 is heap_context.mop_has_rchild_l'_def\n\nconcrete_definition mop_lchild3F is heap_context.mop_lchild2F_def\nconcrete_definition mop_rchild3F is heap_context.mop_rchild2F_def\nconcrete_definition mop_has_lchild3F is heap_context.mop_has_lchild2F_def\nconcrete_definition mop_has_rchild3F is heap_context.mop_has_rchild2F_def\n  \nlemmas h_aux_refines = mop_lchild3.refine mop_rchild3.refine has_rchild3.refine \n  has_lchild3.refine  mop_has_lchild3.refine\n  mop_lchild3F.refine mop_rchild3F.refine mop_has_lchild3F.refine mop_has_rchild3F.refine\n\ncontext heap_context begin  \n\n\nsubsection \\<open>Verification of sift_down2 (infinite cost)\\<close>\n\n  definition sift_down2 :: \"nat \\<Rightarrow> 'a list \\<Rightarrow> ('a list,_) nrest\" where \"sift_down2 i\\<^sub>0 xs \\<equiv> doN {\n    ASSERT (l\\<le>i\\<^sub>0 \\<and> i\\<^sub>0<h);\n    let i\\<^sub>1 = i\\<^sub>0 - l;\n    \n    v \\<leftarrow> mop_list_getF xs (i\\<^sub>1+l);\n    \n    (xs,i,_) \\<leftarrow> monadic_WHILEIT (\\<lambda>(xs,i,ctd). i<h-l \\<and> i\\<ge>i\\<^sub>1)\n       (\\<lambda>(xs,i,ctd). do { hrc \\<leftarrow> mop_has_rchild3F l h i;\n                          SPECc2F (\\<and>) hrc ctd })\n       (\\<lambda>(xs,i,ctd). doN {\n      lci \\<leftarrow> mop_lchild3F h i;\n      rci \\<leftarrow> mop_rchild3F h i;\n      ASSERT (lci+l<h \\<and> rci+l<h);\n      ASSERT (lci\\<noteq>i \\<and> rci\\<noteq>i \\<and> lci\\<noteq>rci);\n      lc \\<leftarrow> mop_list_getF xs (lci+l);\n      rc \\<leftarrow> mop_list_getF xs (rci+l);\n    \n      ASSERT (i+l<h);\n      \n      if\\<^sub>N SPECc2F (\\<^bold><)  lc rc then\n        if\\<^sub>N SPECc2F  (\\<^bold><)  v rc then\n          (doN {\n            xs \\<leftarrow> mop_list_setF xs (i+l) rc;\n            RETURN (xs,rci,True)\n          })\n        else ( RETURN (xs,i,False) )\n      else if\\<^sub>N SPECc2F  (\\<^bold><)  v lc then\n        (doN {\n          xs \\<leftarrow> mop_list_setF xs (i+l) lc;\n          RETURN (xs,lci,True)\n        })\n      else\n       ( RETURN (xs,i,False) ) }\n    ) (xs,i\\<^sub>1,True);\n    \n    ASSERT (i\\<ge>i\\<^sub>1 \\<and> i+l<h);\n    \n    if\\<^sub>N mop_has_lchild3F l h i then\n      (doN {\n      lci \\<leftarrow> mop_lchild3F h i;\n      ASSERT (lci+l<h);\n      ASSERT (lci\\<noteq>i);\n      lc \\<leftarrow> mop_list_getF xs (lci+l);\n      if\\<^sub>N SPECc2F  (\\<^bold><)  v lc then\n        (doN {\n          xs \\<leftarrow> mop_list_setF xs (i+l) lc;\n          xs \\<leftarrow> mop_list_setF xs (lci+l) v;\n          RETURN xs\n        })\n      else \n        (doN {\n          xs \\<leftarrow> mop_list_setF xs (i+l) v;\n          RETURN xs\n        })\n      })\n    else\n      doN {\n        xs \\<leftarrow> mop_list_setF xs (i+l) v;\n        RETURN xs\n      }\n  }\"\n\n    \n  lemma idx_shift_adjust:\n    assumes \"(i',i)\\<in>idx_shift_rel l\"\n    shows \n      \"in_heap i' \\<longleftrightarrow> i<h-l\"\n      \"has_lchild i' \\<longleftrightarrow> i<(h-l) div 2\"\n      \"has_rchild i' \\<longleftrightarrow> i<(h-l-1) div 2\"\n      \"lchild i' = 2*i+1+l\"\n      \"rchild i' = 2*i+2+l\"\n      \"i+l = i'\"\n      \"i'<x \\<longleftrightarrow> i<x-l\"\n      \"i'\\<le>h \\<longleftrightarrow> i\\<le>h-l\"\n      \"x\\<le>i' \\<longleftrightarrow> x-l\\<le>i\"\n    using assms\n    thm lchild_ihs\n    unfolding idx_shift_rel_def \n      in_heap_def \n      has_rchild_def rchild_def\n      has_lchild_def lchild_def\n    by auto\n\n\nsubsubsection \\<open>Refinement Lemma\\<close>\n\n lemma sift_down2_refine: \"sift_down2 i xs \\<le> \\<Down>Id (timerefine TId (sift_down1 i xs))\"\n    unfolding sift_down1_def sift_down2_def \n    unfolding h_aux_refines[OF heap_context_axioms, symmetric]\n    supply [simp del] = conc_Id\n    apply (simp cong: if_cong)\n    apply (rewrite at \"let i=i-l in _\" Let_def) \n    unfolding SPECc2_alt\n    apply normalize_blocks\n\n    apply (intro refine0)\n      apply (all \\<open>unfold in_heap_def; simp_all; fail \\<close>) [2]\n    apply(rule bindT_refine_easy)\n    subgoal by simp\n     apply(rule consumea_Id_refine)\n    subgoal by simp\n    apply(rule bindT_refine_easy)\n    subgoal by simp\n    focus\n      apply (refine_rcg bindT_refine_easy monadic_WHILEIT_refine' MIf_refine consumea_Id_refine)\n      supply [refine_dref_RELATES] = RELATESI[of ihs_opt_rel]  \n      apply refine_dref_type\n      apply(simp_all only: wfR''_TId sp_TId top_acost_absorbs )\n      apply (simp_all add: ihs_opt_rel_alt ) (** Takes loooong *)\n      apply (all \\<open>(determ \\<open>elim conjE\\<close>)?; simp?\\<close>)\n      apply (clarsimp_all simp: idx_shift_adjust ihs_opt_rel_alt simp del: in_heap_simps) (** Takes loooong *)\n      unfolding in_heap_def idx_shift_rel_def ihs_opt_rel_alt\n      apply (auto simp: algebra_simps)  \n      solved\n    subgoal for _ _ s s'\n      supply [split del] = if_split\n      apply (cases s; simp)\n      apply (cases s'; simp)\n      apply (intro refine0 )\n      subgoal by (clarsimp simp: idx_shift_adjust ihs_opt_rel_alt)\n\n      apply(rule bindT_refine_easy)\n      subgoal by simp\n       apply(rule consumea_Id_refine)\n      subgoal by simp\n    \n      apply (refine_rcg bindT_refine_easy MIf_refine consumea_Id_refine)\n      apply(simp_all only: wfR''_TId sp_TId top_acost_absorbs)  \n        apply (simp_all add: ihs_opt_rel_alt)\n        apply (all \\<open>determ \\<open>elim conjE\\<close>; simp?\\<close>)\n        apply (auto simp: algebra_simps idx_shift_adjust)\n        done \n     done\n       \n  \n  \n  (* Auxiliary definitions to reduce proof complexity in sepref-step.\n    TODO: Without these, the sepref step gets really slow, which is another indication that we\n      should separate the bound-proofs from the actual transfer step!\n  *)\n  definition [simp]: \"mop_geth2 xs i \\<equiv> doN { ASSERT(l+i\\<le>h); lpi \\<leftarrow> SPECc2 ''add'' (+) l i;  mop_eo_extract (\\<lambda>_. lift_acost mop_array_nth_cost) xs lpi }\"\n  definition [simp]: \"mop_seth2 xs i x \\<equiv> doN { ASSERT(l+i\\<le>h); lpi \\<leftarrow> SPECc2 ''add'' (+) l i;  mop_eo_set (\\<lambda>_. lift_acost mop_array_upd_cost) xs lpi x }\"\n\n  thm mop_oarray_extract_def\n\nend  \n  \nconcrete_definition mop_geth3 is heap_context.mop_geth2_def\nconcrete_definition mop_seth3 is heap_context.mop_seth2_def\n  \nlemmas h_aux_refines2 = mop_geth3.refine mop_seth3.refine  \n\n\nsubsection \\<open>Verification of sift_down3 (add timing)\\<close>\n\ncontext heap_context begin  \n  \n  term mop_geth3\n  definition sift_down3 :: \"nat \\<Rightarrow> 'a list \\<Rightarrow> ('a list, _) nrest\" where \"sift_down3 i\\<^sub>0 xs \\<equiv> doN {\n    ASSERT (l\\<le>i\\<^sub>0 \\<and> i\\<^sub>0<h);\n    i\\<^sub>1 \\<leftarrow> SPECc2 ''sub'' (-) i\\<^sub>0 l;\n    xs \\<leftarrow> mop_to_eo_conv xs;\n    (v,xs) \\<leftarrow> mop_geth3 l h xs i\\<^sub>1;\n    \n    (xs,i,_) \\<leftarrow> monadic_WHILEIT (\\<lambda>(xs,i,ctd). i<h-l \\<and> i\\<ge>i\\<^sub>1)\n       (\\<lambda>(xs,i,ctd). do { hrc \\<leftarrow> mop_has_rchild3 l h i;\n                          SPECc2 ''and'' (\\<and>) hrc ctd }) (\\<lambda>(xs,i,ctd). doN {\n      lci \\<leftarrow> mop_lchild3 h i;\n      rci \\<leftarrow> mop_rchild3 h i;\n\n      ASSERT (l+lci<h \\<and> l+rci<h \\<and> l+lci \\<noteq> l+rci);\n      lplci \\<leftarrow> SPECc2 ''add'' (+) l lci;\n      lprci \\<leftarrow> SPECc2 ''add'' (+) l rci;\n      ASSERT(lplci\\<noteq>lprci);\n\n      if\\<^sub>N  mop_cmpo_idxs (cost ''cmpo_idxs'' 1) xs lplci lprci then\n        doN {\n        if\\<^sub>N mop_cmpo_v_idx (cost ''cmpo_v_idx'' 1) xs v lprci then \\<comment> \\<open>this is actually one more list_get then in sift_down2 !\\<close>\n          doN {\n            (rc,xs) \\<leftarrow> mop_geth3 l h xs rci;\n            xs \\<leftarrow> mop_seth3 l h xs i rc;\n            RETURN (xs,rci,True)\n          }\n        else\n          RETURN (xs,i,False)\n        }\n      else if\\<^sub>N mop_cmpo_v_idx (cost ''cmpo_v_idx'' 1) xs v lplci then\n        doN {\n          (lc,xs) \\<leftarrow> mop_geth3 l h xs lci;\n          xs \\<leftarrow> mop_seth3 l h xs i lc;\n          RETURN (xs,lci,True)\n        }\n      else\n        RETURN (xs,i,False)\n    }) (xs,i\\<^sub>1,True);\n    \n    ASSERT (i\\<ge>i\\<^sub>1);\n    \n    if\\<^sub>N mop_has_lchild3 l h i then\n      doN {\n      lci \\<leftarrow> mop_lchild3 h i;\n      ASSERT (l+lci<h);\n      lplci \\<leftarrow> SPECc2 ''add'' (+) l lci;\n      if\\<^sub>N mop_cmpo_v_idx (cost ''cmpo_v_idx'' 1) xs v lplci then\n        doN {\n          (lc,xs) \\<leftarrow> mop_geth3 l h xs lci;\n          xs \\<leftarrow> mop_seth3 l h xs i lc;\n          xs \\<leftarrow> mop_seth3 l h xs lci v;\n          xs \\<leftarrow> mop_to_wo_conv xs;\n          RETURN xs\n        }\n      else\n        doN {\n          xs \\<leftarrow> mop_seth3 l h xs i v;\n          xs \\<leftarrow> mop_to_wo_conv xs;\n          RETURN xs\n        }\n      }\n    else\n      doN {\n        xs \\<leftarrow> mop_seth3 l h xs i v;\n        xs \\<leftarrow> mop_to_wo_conv xs;\n        RETURN xs\n      }\n  }\" \n    \n  \n  (* TODO: Move. Use also in insort. Maybe generalize to index set? *)\n  definition \"woe_eq_except i xs' xs \\<equiv> length xs' = length xs \\<and> xs'!i=None \\<and> (\\<forall>j\\<in>{0..<length xs}-{i}. xs'!j = Some (xs!j))\"\n  \n  lemma woe_eq_except_init: \"i<length xs \\<Longrightarrow> woe_eq_except i ((map Some xs)[i := None]) xs\"\n    unfolding woe_eq_except_def by auto\n  \n  lemma woe_eq_except_length[simp]: \"woe_eq_except i xs' xs \\<Longrightarrow> length xs'=length xs\"\n    unfolding woe_eq_except_def by auto\n    \n  lemma woe_eq_except_nth_eq_Some: \"\\<lbrakk>woe_eq_except i xs' xs; j<length xs\\<rbrakk> \\<Longrightarrow> xs'!j = Some v \\<longleftrightarrow> (j\\<noteq>i \\<and> v = xs!j)\"  \n    unfolding woe_eq_except_def \n    by force\n    \n  lemma woe_eq_except_nth: \"\\<lbrakk>woe_eq_except i xs' xs; j<length xs; j\\<noteq>i\\<rbrakk> \\<Longrightarrow> xs'!j = Some (xs!j)\"  \n    unfolding woe_eq_except_def \n    by force\n    \n  lemma woe_eq_except_ith[simp]: \"\\<lbrakk>woe_eq_except i xs' xs\\<rbrakk> \\<Longrightarrow> xs'!i = None\"  \n    unfolding woe_eq_except_def \n    by force\n    \n  lemma woe_eq_except_upd:\n    assumes \"woe_eq_except i xs' xs\" \"i'<length xs\" \"i<length xs\" \"i\\<noteq>i'\"\n    shows \"woe_eq_except i' (xs'[i':=None,i:=Some v]) (xs[i:=v])\"\n    using assms unfolding woe_eq_except_def by (auto simp: nth_list_update)\n    \n    \n  \n  definition \"sd23_rel \\<equiv> {((xs',i',ctd'),(xs,i,ctd)). i'=i \\<and> ctd'=ctd \\<and> i+l<length xs \\<and> woe_eq_except (i+l) xs' xs }\"\n  \n  lemma in_sd23_rel_conv: \"((xs',i',ctd'),(xs,i,ctd))\\<in>sd23_rel \\<longleftrightarrow> i'=i \\<and> ctd'=ctd \\<and> i+l<length xs \\<and> woe_eq_except (i+l) xs' xs\"\n    by (auto simp: sd23_rel_def)\n\n(* TODO: Move *)\n  lemma introR: \"(a,a')\\<in>R \\<Longrightarrow> (a,a')\\<in>R\" .\n\n  lemma mop_has_lchild3_refine: \"(a,a')\\<in>Id \\<Longrightarrow> (mop_has_lchild3 l h a :: (_, (_, enat) acost) nrest) \\<le> \\<Down> bool_rel (timerefine TId (mop_has_lchild3F l h a'))\"\n    apply(auto simp: mop_has_lchild3_def SPECc2_alt mop_has_lchild3F_def simp del: conc_Id) \n    apply normalize_blocks\n    apply(intro refine0 bindT_refine_easy RETURNT_refine_t consumea_refine) by auto \n\n\n  lemma mop_has_rchild3_refine: \"(a,a')\\<in>Id \\<Longrightarrow> (mop_has_rchild3 l h a :: (_, (_, enat) acost) nrest) \\<le> \\<Down> bool_rel (timerefine TId (mop_has_rchild3F l h a'))\"\n    apply(auto simp: mop_has_rchild3_def SPECc2_alt mop_has_rchild3F_def simp del: conc_Id) \n    apply normalize_blocks\n    apply(intro refine0 bindT_refine_easy RETURNT_refine_t consumea_refine) by auto \n\n  \n  lemma mop_lchild3_refine: \"(a,a')\\<in>Id \\<Longrightarrow> (mop_lchild3 h a:: (_, (_, enat) acost) nrest) \\<le> \\<Down> Id (timerefine TId (mop_lchild3F h a'))\"\n    apply(auto simp: mop_lchild3_def SPECc2_alt mop_lchild3F_def simp del: conc_Id) \n    apply normalize_blocks\n    apply(intro refine0 bindT_refine_easy  RETURNT_refine_t consumea_refine) by auto \n\n\n\n\n  lemma inres_mop_has_lchild3F: \"inres (mop_has_lchild3F l h a) t \\<longleftrightarrow> (has_lchild2 a \\<longleftrightarrow> t)\"\n    unfolding mop_has_lchild3F_def by(simp add: inres_consume_conv)\n  \n  lemma inres_mop_lchild3F: \"inres (mop_lchild3F h a) a' \\<longleftrightarrow> Suc (2 * a) < h \\<and> Suc (2 * a) = a'\"\n    unfolding mop_lchild3F_def by (simp add: inres_consume_conv)\n\n\nsubsubsection \\<open>Functional Refinement Lemma\\<close>\n\n  lemma sift_down3_refine_funct: \"sift_down3 i xs \\<le>\\<Down>Id (timerefine TId (sift_down2 i xs))\"\n    unfolding sift_down3_def sift_down2_def\n    supply [simp del] = conc_Id\n    supply [simp] = mop_to_eo_conv_alt\n    apply (simp add: Let_def mop_geth3_def  cong: if_cong)\n    unfolding SPECc2_alt\n    apply normalize_blocks\n    \n    apply (intro refine0)\n    apply clarsimp_all [3]\n    apply (rule bindT_refine_easy)\n    subgoal by simp\n    focus\n      apply (auto intro!: consumea_refine timerefineA_TId RETURNT_refine_t)\n      solved\n    subgoal\n      for s s'\n      apply(cases s; simp)\n    apply (rule bindT_refine_easy)\n    subgoal by simp\n     apply (rule monadic_WHILEIT_refine')\n    subgoal by simp\n    subgoal by simp\n    apply (rule introR[where R=sd23_rel])\n    apply (auto simp: sd23_rel_def woe_eq_except_init) []\n    apply (auto simp: sd23_rel_def) []\n    subgoal \n      unfolding  SPECc2_alt\n      apply (refine_rcg bindT_refine_conc_time_my_inres consumea_refine mop_has_rchild3_refine)\n      apply refine_dref_type\n      by (auto simp: sd23_rel_def ) \n    subgoal\n      unfolding mop_has_rchild3F_def\n      apply clarsimp\n      unfolding mop_lchild3_def mop_rchild3_def mop_cmpo_idxs_def mop_lchild3F_def mop_rchild3F_def SPECc2_alt\n      apply normalize_blocks\n      apply (intro refine0 bindT_refine_easy)\n            apply refine_dref_type\n            apply (use [[put_named_ss Main_ss]] in \\<open>auto simp: conc_Id in_sd23_rel_conv woe_eq_except_length woe_eq_except_nth\\<close>) [6]\n        apply simp\n      subgoal apply(rule consumea_Id_refine) by (simp only: top_acost_absorbs timerefineA_TId_eq top_greatest)\n\n      unfolding mop_seth3_def SPECc2_alt\n      apply (simp (no_asm_use))\n      apply (simp (no_asm_simp))\n      apply normalize_blocks\n      apply(refine_rcg MIf_refine bindT_refine_easy)\n                         apply refine_dref_type\n      apply (auto simp only: sp_TId wfR''_TId timerefineA_TId_eq top_greatest intro!: consumea_refine)\n      apply (clarsimp_all simp only: in_sd23_rel_conv woe_eq_except_length woe_eq_except_nth\n                woe_eq_except_ith woe_eq_except_upd)\n      apply (simp_all (no_asm_use) add: algebra_simps)\n      apply (simp_all (no_asm_simp) add: algebra_simps woe_eq_except_upd)\n      done\n    subgoal\n      unfolding mop_to_wo_conv_def \n      apply (clarsimp split: prod.split split del: if_split cong: if_cong simp: mop_seth3_def SPECc2_alt ) \n      apply normalize_blocks\n      apply (clarsimp split: prod.split)\n      apply (refine_rcg MIf_refine bindT_refine_easy mop_has_lchild3_refine mop_lchild3_refine consume_refine)\n      apply refine_dref_type\n      apply (auto simp only: inres_mop_has_lchild3F inres_mop_lchild3F sp_TId wfR''_TId\n                        timerefineA_TId_eq top_acost_absorbs top_greatest intro!: consumea_refine)\n      unfolding has_lchild2_def\n      supply [[put_named_ss Main_ss]]\n      apply (auto simp: conc_Id in_sd23_rel_conv woe_eq_except_length woe_eq_except_nth algebra_simps woe_eq_except_ith woe_eq_except_upd in_set_conv_nth nth_list_update list_eq_iff_nth_eq)\n      subgoal by (smt length_list_update nth_list_update_eq nth_list_update_neq ifSome_iff woe_eq_except_length woe_eq_except_nth_eq_Some)\n      subgoal by (metis woe_eq_except_init woe_eq_except_ith woe_eq_except_nth_eq_Some)   \n      subgoal by (metis option.simps(3) woe_eq_except_nth) \n      done\n    done\n  done\n\nsubsubsection \\<open>Adding Timing Result\\<close>\n\nabbreviation \"cost_lchild p \\<equiv> cost ''mul'' p + cost ''add'' p\"\nabbreviation \"cost_rchild p \\<equiv> cost ''mul'' p + cost ''add'' p\"\nabbreviation \"cost_has_lchild p \\<equiv> cost ''sub'' p + cost ''udiv'' p + cost ''icmp_slt'' p\"\nabbreviation \"cost_has_rchild p \\<equiv> cost ''sub'' (2*p) + cost ''udiv'' p + cost ''icmp_slt'' p\"\n\ndefinition E_sd3_l :: \"_ \\<Rightarrow> _ \\<Rightarrow> (char list, nat) acost\" where\n  \"E_sd3_l i ctd \\<equiv> \n      (let p=(if ctd then 1+i else i) in\n            cost ''add'' (4*p) +\n            ( p *m mop_array_nth_cost) +\n           ( p *m mop_array_upd_cost ) +\n            (cost ''if'' p + (cost ''cmpo_idxs'' p + (cost ''if'' p + (cost ''cmpo_v_idx'' p\n           + (cost_rchild p + (cost_lchild (2*p) + (cost ''call'' p + (cost_has_rchild (2*p)\n             + cost ''and'' p + cost ''if'' p)))))))))\"\n\ndefinition sift_down3_cost :: \"_ \\<Rightarrow> ecost\" where\n  \"sift_down3_cost i =\n            cost ''sub'' 1\n      + cost ''add'' 5 \n      + lift_acost mop_array_upd_cost + lift_acost mop_array_nth_cost + lift_acost mop_array_upd_cost\n      + cost ''if'' 1 + cost ''cmpo_v_idx'' 1 + cost_lchild 1 + cost ''if'' 1 \n      + cost_has_lchild 2 +\n      lift_acost (E_sd3_l i True) \n      + cost_has_rchild 2 + cost ''and'' 1 + cost ''if'' 1 + lift_acost mop_array_nth_cost\n      + lift_acost mop_array_upd_cost + lift_acost mop_array_nth_cost\n      + cost ''call'' 1\"\n\nlemma E_sd3_l_True_mono: \"x\\<le>y \\<Longrightarrow> lift_acost (E_sd3_l x True) \\<le> lift_acost (E_sd3_l y True)\"\n  unfolding E_sd3_l_def\n  unfolding Let_def\n  apply (auto simp: norm_cost)\n  apply sc_solve apply safe apply auto\n  done\n    \nlemma E_sd3_l_dontknow_mono: \"x\\<le>y \\<Longrightarrow> lift_acost (E_sd3_l x t) \\<le> lift_acost (E_sd3_l y True)\"\n  unfolding E_sd3_l_def\n  apply(cases t) \n  unfolding Let_def\n   apply (auto simp: the_acost_propagate costmult_add_distrib costmult_cost)\n  subgoal apply sc_solve apply safe by auto\n  subgoal apply sc_solve apply safe by auto\n  done\n \nlemma lift_acost_leq_conv: \"lift_acost x \\<le> lift_acost y \\<longleftrightarrow> x \\<le> y\"\n  by(auto simp: less_eq_acost_def lift_acost_def)\n\n\n\nlemma log_aux: \"Discrete.log (Suc (2*(Suc x))) = Discrete.log (2*(Suc x))\" \n  by (metis dvd_triv_left even_Suc_div_two le_Suc_eq le_add1 log_rec mult_Suc_right)  \n\nlemma sift_down3_refine_time_aux1':\n  assumes \"Suc (Suc (i' * 2)) \\<le> s \"\n  shows \"Suc (Discrete.log (s) - Discrete.log (Suc (Suc ( (i' * 2)))))\n     = Discrete.log (s) - Discrete.log (Suc i')\"\nproof -\n  have ***: \"Discrete.log (Suc (Suc (i' * 2))) \n        = Suc (Discrete.log (Suc i'))\"\n    by (metis One_nat_def add_Suc log_twice mult.commute mult_Suc_right nat.simps(3) numeral_2_eq_2 plus_1_eq_Suc)\n\n  have **: \"Suc i' < s\" \n    using assms by auto\n  then have \"Suc i' \\<le> s\" by auto\n  then have **: \"Discrete.log (Suc i') \\<le> Discrete.log s\"\n    by(rule log_mono[THEN monoD]) \n\n  from log_mono[THEN monoD, OF assms]\n  have **: \"Suc (Discrete.log (Suc i')) \\<le> Discrete.log s\"\n    unfolding *** by simp\n\n  have \"Suc (Discrete.log (s) - Discrete.log (Suc (Suc ( (i' * 2)))))\n      = Suc (Discrete.log (s) - Suc (Discrete.log (Suc i')))\"\n    unfolding *** by simp\n  also have \"...   =  (Discrete.log (s) -  (Discrete.log (Suc i')))\"\n    using ** by auto \n  finally show ?thesis by simp\nqed\n\nlemma sift_down3_refine_time_aux1:\n  assumes \\<open>Suc (Suc (l + i' * 2)) < h\\<close>\n  shows \"Suc (Discrete.log (h-l) - Discrete.log (Suc (Suc ( (i' * 2)))))\n     = Discrete.log (h-l) - Discrete.log (Suc i')\"\n  apply(rule sift_down3_refine_time_aux1')\n  using assms by auto\n\nlemma sift_down3_refine_time_aux2':\n  assumes \"Suc (Suc (i' * 2)) \\<le> s \"\n  shows \"Suc (Discrete.log (s) - Discrete.log (Suc (Suc (Suc (i' * 2)))))\n     = Discrete.log (s) - Discrete.log (Suc i')\"\nproof -\n  have ***: \"Discrete.log (Suc (Suc (i' * 2))) \n        = Suc (Discrete.log (Suc i'))\"\n    by (metis One_nat_def add_Suc log_twice mult.commute mult_Suc_right nat.simps(3) numeral_2_eq_2 plus_1_eq_Suc)\n\n  have *: \"Discrete.log (Suc (Suc (Suc (i' * 2)))) \n        = Suc (Discrete.log (Suc i'))\"\n    apply(subst log_twice[symmetric]) apply simp\n    apply(subst log_aux[symmetric]) by (simp add: mult.commute)\n     \n     (* by (metis One_nat_def add_Suc log_twice mult.commute mult_Suc_right nat.simps(3) numeral_2_eq_2 plus_1_eq_Suc)\n *)\n  have **: \"Suc i' < s\" \n    using assms by auto\n  then have \"Suc i' \\<le> s\" by auto\n  then have **: \"Discrete.log (Suc i') \\<le> Discrete.log s\"\n    by(rule log_mono[THEN monoD]) \n\n  from log_mono[THEN monoD, OF assms]\n  have **: \"Suc (Discrete.log (Suc i')) \\<le> Discrete.log s\"\n    unfolding *** by simp\n\n  have \"Suc (Discrete.log (s) - Discrete.log (Suc (Suc (Suc (i' * 2)))))\n      = Suc (Discrete.log (s) - Suc (Discrete.log (Suc i')))\"\n    unfolding * by simp\n  also have \"...   =  (Discrete.log (s) -  (Discrete.log (Suc i')))\"\n    using ** by auto \n  finally show ?thesis by simp\nqed\n\nlemma sift_down3_refine_time_aux2:\n  assumes \\<open>l + (i' * 2 + 2) \\<le> h\\<close>\n  shows \"Suc (Discrete.log (h-l) - Discrete.log (Suc (Suc (Suc (i' * 2)))))\n     = Discrete.log (h-l) - Discrete.log (Suc i')\"\n  apply(rule sift_down3_refine_time_aux2')\n  using assms by auto\n\n\nlemma sift_down3_refine_time: \"sift_down3 i (xs:: 'a list) \\<le>\\<^sub>n (SPEC (\\<lambda>_. True) (%_. sift_down3_cost (Discrete.log (h-l))))\"\n  unfolding sift_down3_def SPEC_def\n    apply(rule gwpn_specifies_I)\n\n\n  apply(subst monadic_WHILEIET_def[symmetric, where E=\"\\<lambda>(_,i,ctd). E_sd3_l (Discrete.log (h-l) - Discrete.log (Suc i)) ctd\"])\n                         \n  unfolding Let_def mop_to_eo_conv_def mop_geth3_def mop_eo_extract_def\n  unfolding mop_has_rchild3_def mop_lchild3_def mop_rchild3_def \n            mop_cmpo_idxs_def mop_cmpo_v_idx_def mop_seth3_def mop_eo_set_def\n            SPECc2_def\n\n    apply(refine_vcg \\<open>-\\<close> rules:  gwpn_bindT_I gwpn_ASSERT_bind_I  gwpn_ASSERT_I gwpn_MIf_I\n                      gwpn_consume gwpn_RETURNT_I gwpn_SPECT_I \n                      prod3 If_le_Some_rule2 If_le_rule) \n  apply(rule gwpn_monadic_WHILEIET)\n  subgoal unfolding wfR2_def E_sd3_l_def zero_acost_def cost_def Let_def costmult_def by auto\n  subgoal for e xs s\n    apply(refine_vcg \\<open>-\\<close> rules: gwpn_bindT_I gwpn_consume gwpn_RETURNT_I gwpn_SPECT_I If_le_rule gwpn_ASSERT_I gwpn_MIf_I)\n        prefer 5\n    subgoal (* exiting loop because of wrong guard *)\n      apply(rule loop_exit_conditionI)\n      unfolding mop_has_lchild3_def mop_to_wo_conv_def SPECc2_alt\n      apply (refine_vcg \\<open>-\\<close> rules: gwpn_bindT_I gwpn_consume gwpn_RETURNT_I gwpn_SPECT_I If_le_rule gwpn_ASSERT_I gwpn_MIf_I)\n      subgoal\n        unfolding Let_def   sift_down3_cost_def\n        apply clarsimp\n        apply(simp add: add.assoc lift_acost_zero lift_acost_diff_to_the_front lift_acost_diff_to_the_right lift_acost_diff_to_the_right_Some)\n        apply(simp only: add.commute add.left_commute)\n        apply(rule add_mono) \n        subgoal premises prems apply (rule E_sd3_l_True_mono)  by simp\n        subgoal premises prems\n          apply sc_solve_debug apply safe   by (all \\<open>(auto simp: one_enat_def numeral_eq_enat sc_solve_debug_def;fail)?\\<close>)\n        done\n      subgoal by simp\n      subgoal premises p1\n        unfolding Let_def   sift_down3_cost_def\n        apply clarsimp\n        apply(simp add: add.assoc the_acost_costs_distrib lift_acost_zero lift_acost_diff_to_the_front lift_acost_diff_to_the_right lift_acost_diff_to_the_right_Some)\n        \n        apply(subst lift_acost_diff_to_the_right) \n        subgoal apply(rule E_sd3_l_dontknow_mono[unfolded lift_acost_leq_conv]) apply(rule diff_le_mono2)\n            apply(rule log_mono[THEN monoD]) using p1(5) by simp\n        subgoal premises prems\n          apply(simp only: add.commute add.left_commute)\n          apply(simp add: add.assoc)\n          apply(rule add_mono)\n          subgoal apply (rule E_sd3_l_True_mono) by simp  \n          apply sc_solve by auto\n        done\n      subgoal by simp\n      subgoal\n        unfolding Let_def   sift_down3_cost_def\n        apply(simp add: add.assoc lift_acost_zero lift_acost_diff_to_the_front lift_acost_diff_to_the_right lift_acost_diff_to_the_right_Some)\n        apply(simp only: add.commute add.left_commute)\n        apply(rule add_mono)\n        subgoal apply (rule E_sd3_l_True_mono) by simp\n        apply sc_solve by auto\n      subgoal by simp\n      done \n    subgoal for xs' i' ctd (* first if branch *)\n      apply(rule loop_body_conditionI) \n      subgoal (*  \\<le> *)\n        subgoal premises prems\n        unfolding E_sd3_l_def Let_def\n        apply (clarsimp simp add: the_acost_costs_distrib the_acost_cost_mult acostC_the_acost_cost)\n        apply(simp add: the_acost_propagate  acostC_the_acost_cost add.assoc costmult_add_distrib costmult_cost)\n          apply sc_solve\n        apply safe  \n                    apply (auto simp only: one_enat_def numeral_eq_enat plus_enat_simps zero_enat_def lift_ord)\n        apply auto\n         apply(all \\<open>intro log_mono[THEN monoD] diff_le_mono2 add_mono; auto\\<close>)\n        done\n      done\n      subgoal premises prems (* diff pays *)\n        apply simp\n        unfolding E_sd3_l_def Let_def\n        apply (clarsimp simp add: the_acost_costs_distrib the_acost_cost_mult acostC_the_acost_cost)\n        apply(simp add: the_acost_propagate costmult_add_distrib costmult_cost acostC_the_acost_cost add.assoc)\n        apply sc_solve_debug apply safe \n                    apply(auto simp: sc_solve_debug_def one_enat_def numeral_eq_enat )\n        by(auto simp: sift_down3_refine_time_aux2[OF \\<open>l + (i' * 2 + 2) \\<le> h\\<close>, symmetric])    \n         \n      subgoal \n        apply simp done\n      done\n    subgoal for xs' i' ctd (* second if branch *)\n      apply(rule loop_body_conditionI) \n      subgoal (*  \\<le> *)\n        subgoal premises prems\n        unfolding E_sd3_l_def Let_def\n        apply (clarsimp simp add: the_acost_costs_distrib the_acost_cost_mult acostC_the_acost_cost)\n        apply(simp add: the_acost_propagate  acostC_the_acost_cost add.assoc  costmult_add_distrib costmult_cost)\n        apply sc_solve\n        apply safe apply (auto simp: numeral_eq_enat one_enat_def) done  \n        done\n      subgoal (* diff pays *)\n        apply simp apply safe\n        subgoal premises prems\n        unfolding E_sd3_l_def Let_def \n        apply (clarsimp simp add: the_acost_costs_distrib the_acost_cost_mult acostC_the_acost_cost)\n        apply(simp add: the_acost_propagate  acostC_the_acost_cost add.assoc costmult_add_distrib costmult_cost)\n        apply sc_solve \n          apply safe by (auto simp: numeral_eq_enat one_enat_def) \n        done\n      subgoal \n        apply simp done\n      done\n    subgoal for xs' i' ctd (* third if branch *)\n      apply(rule loop_body_conditionI) \n      subgoal (*  \\<le> *)\n        unfolding E_sd3_l_def Let_def\n        subgoal premises prems\n        apply (clarsimp simp add: the_acost_costs_distrib the_acost_cost_mult acostC_the_acost_cost)\n        apply(simp add: the_acost_propagate  acostC_the_acost_cost add.assoc costmult_add_distrib costmult_cost)\n          apply sc_solve apply safe apply (auto simp: numeral_eq_enat one_enat_def)\n           \n         apply(all \\<open>intro log_mono[THEN monoD] diff_le_mono2 add_mono; auto\\<close>)\n          done\n        done\n      subgoal (* diff pays *)\n        apply simp apply safe\n        unfolding E_sd3_l_def Let_def\n        subgoal premises prems\n        apply (clarsimp simp add: the_acost_costs_distrib the_acost_cost_mult acostC_the_acost_cost)\n        apply(simp add: the_acost_propagate lift_acost_propagate lift_acost_cost acostC_the_acost_cost add.assoc costmult_add_distrib costmult_cost)        \n        apply sc_solve \n          apply safe  apply (auto simp: one_enat_def numeral_eq_enat) \n\n          by(auto simp: sift_down3_refine_time_aux1[OF \\<open>Suc (Suc (l + i' * 2)) < h\\<close>, symmetric])    \n        done\n      subgoal \n        by auto\n      done\n    subgoal for xs' i' ctd (* fourth if branch *)\n      apply(rule loop_body_conditionI) \n      subgoal (*  \\<le> *)\n        unfolding E_sd3_l_def Let_def\n        subgoal premises prems\n        apply (clarsimp simp add: the_acost_costs_distrib the_acost_cost_mult acostC_the_acost_cost)\n          apply(simp add: the_acost_propagate  acostC_the_acost_cost add.assoc costmult_add_distrib costmult_cost) \n          apply sc_solve apply safe apply (auto simp: one_enat_def) done \n        done\n      subgoal (* diff pays *)\n        apply simp apply safe\n        unfolding E_sd3_l_def Let_def\n        subgoal premises prems\n        apply (clarsimp simp add: the_acost_costs_distrib the_acost_cost_mult acostC_the_acost_cost)\n        apply(simp add: the_acost_propagate  acostC_the_acost_cost add.assoc costmult_add_distrib costmult_cost)\n        apply sc_solve \n          apply safe by (auto simp: one_enat_def) \n        done\n      subgoal \n        by auto\n      done\n    done\n  subgoal apply auto done\n  done\n\nsubsubsection \\<open>Bottom Up - Correctness and Timing\\<close>\n\nlemma sift_down_btu_correct':\n  assumes \"heapify_btu_invar xs\\<^sub>0 l' xs\" \"l<l'\"\n  shows \"sift_down3 (l'-Suc 0) xs \\<le> SPEC (\\<lambda>xs'. heapify_btu_invar xs\\<^sub>0 (l'-Suc 0) xs') (%_. sift_down3_cost (Discrete.log (h-l)))\"\n  apply(rule separate_correct_and_time)\n  subgoal \n    apply(rule order.trans) \n     apply(rule sift_down3_refine_funct) apply (simp add: timerefine_id)\n    apply(rule order.trans)\n     apply(rule sift_down2_refine)  apply (simp add: timerefine_id)\n    apply(rule order.trans)\n     apply(rule sift_down1_refine_functional_aux)  apply (simp add: timerefine_id)\n    apply(rule  sift_down_btu_correct) using assms by auto \n  by (rule sift_down3_refine_time)\n\ndefinition \"sift_down3_t1 i\\<^sub>0 xs = sup (sift_down3 i\\<^sub>0 xs) (SPEC (\\<lambda>_. True) (%_. cost ''sift_down'' 1))\"\n\n\ndefinition heapify_btu_step \n  where \"heapify_btu_step l' xs\\<^sub>0 xs  = do { ASSERT (heapify_btu_invar xs\\<^sub>0 (Suc l') xs \\<and> l<Suc l');\n                                SPEC (\\<lambda>xs'. heapify_btu_invar xs\\<^sub>0 l' xs') (%_. cost ''sift_down'' 1) }\"\n\n\ndefinition sift_down_restore \n  where \"sift_down_restore xs\\<^sub>0 xs  = do { ASSERT (l<h \\<and> sift_down_invar xs\\<^sub>0 l xs);\n                                SPEC (\\<lambda>xs'. slice_eq_mset l h xs' xs\\<^sub>0 \\<and> is_heap xs') (%_. cost ''sift_down'' 1) }\"\n\n\n\ndefinition Rsd where \"Rsd i = TId(''sift_down'':=sift_down3_cost (Discrete.log i))\"\n\nlemma sift_down3_refines_heapify_btu_step:\n    shows \"sift_down3  l' xs \\<le> \\<Down>Id( timerefine (Rsd (h-l)) (heapify_btu_step l' xs\\<^sub>0 xs))\"\n  unfolding heapify_btu_step_def\n  apply(rule ASSERT_D3_leI)\n  apply simp  \n  apply(rule order.trans[OF sift_down_btu_correct'[of xs\\<^sub>0 \"Suc l'\", simplified]])\n    apply simp\n   apply simp\n  apply(rule SPEC_timerefine)\n  subgoal by simp\n  subgoal by (auto simp: Rsd_def  timerefineA_upd)\n  done\n\n\nsubsubsection \\<open>Restore - Correctness and Timing\\<close>\n\n\nlemma sift_down_restore_correct':\n  assumes \"l < h\" \"sift_down_invar xs\\<^sub>0 l xs\"\n  shows \"sift_down3 l xs \\<le> SPEC (\\<lambda>xs'. slice_eq_mset l h xs' xs\\<^sub>0 \\<and> is_heap xs') (%_. sift_down3_cost (Discrete.log (h-l)))\"\n  apply(rule separate_correct_and_time)\n  subgoal \n    apply(rule order.trans) \n     apply(rule sift_down3_refine_funct) apply (simp add: timerefine_id)\n    apply(rule order.trans)\n     apply(rule sift_down2_refine)  apply (simp add: timerefine_id)\n    apply(rule order.trans)\n     apply(rule sift_down1_refine_functional_aux)  apply (simp add: timerefine_id)\n    apply(rule  sift_down_restore_correct) using assms by auto\n  by (rule sift_down3_refine_time) \n\nlemma sift_down3_refines_sift_down_restore:\n  shows \"sift_down3 l xs \\<le>  \\<Down>Id( timerefine (Rsd (h-l)) ( sift_down_restore xs\\<^sub>0 xs))\"\n  unfolding sift_down_restore_def\n  apply(rule ASSERT_D3_leI)\n  apply simp  \n  apply(rule order.trans[OF sift_down_restore_correct'[of xs\\<^sub>0]])\n    apply simp\n   apply simp\n  apply(rule SPEC_timerefine)\n  subgoal by simp\n  subgoal by(auto simp: Rsd_def  timerefineA_upd)\n  done\n\n\n\n\n\n\n\nend\n\n\nsubsection \\<open>Verification of Heapify Bottom up - heapify_btu\\<close>\n\nconcrete_definition sift_down4 is heap_context.sift_down3_def\nconcrete_definition sift_down_ab is heap_context.heapify_btu_step_def\nconcrete_definition sift_down_restore_a for less_eq l h xs\\<^sub>0 xs is heap_context.sift_down_restore_def\n                                                                              \ncontext heap_context begin  \n\n  (*\n  lemma sift_down4_full_refine: \"sift_down4 (\\<^bold><) l h i xs \\<le> sift_down i xs\"\n  proof -\n    note sift_down4.refine[OF heap_context_axioms, symmetric, THEN meta_eq_to_obj_eq]\n    also note sift_down3_refine \n    also note sift_down2_refine \n    also note sift_down1_refine \n    finally show ?thesis by simp\n  qed *)\n\n  lemmas sift_down_ab_refine = sift_down_ab.refine[OF heap_context_axioms, symmetric, unfolded heapify_btu_step_def]\n  lemma sift_down4_refine: \"sift_down4 (\\<^bold><) l h l' xs \\<le> \\<Down>Id( timerefine (Rsd (h-l)) (sift_down_ab (\\<^bold>\\<le>) l h l' xs\\<^sub>0 xs))\"\n  proof -\n    note sift_down4.refine[OF heap_context_axioms, symmetric, THEN meta_eq_to_obj_eq]\n    also note sift_down3_refines_heapify_btu_step\n    finally show ?thesis unfolding sift_down_ab.refine[OF heap_context_axioms] .\n  qed\n\n  lemma sift_down4_refine_restore: \"sift_down4 (\\<^bold><) l h l xs \\<le> \\<Down>Id( timerefine (Rsd (h-l)) (sift_down_restore_a (\\<^bold>\\<le>) l h xs\\<^sub>0 xs))\"\n  proof -\n    note sift_down4.refine[OF heap_context_axioms, symmetric, THEN meta_eq_to_obj_eq]\n    also note sift_down3_refines_sift_down_restore\n    finally show ?thesis unfolding sift_down_restore_a.refine[OF heap_context_axioms] .\n  qed\n\n\n  lemma sift_down3_cost_mono:\n    \"x\\<le>y \\<Longrightarrow> sift_down3_cost x \\<le> sift_down3_cost y\"\n    unfolding sift_down3_cost_def E_sd3_l_def Let_def\n    apply(simp add: lift_acost_propagate lift_acost_cost)\n        apply (clarsimp simp add: costmult_add_distrib costmult_cost the_acost_costs_distrib the_acost_cost_mult acostC_the_acost_cost)\n        apply(simp add: the_acost_propagate  acostC_the_acost_cost add.assoc)\n    apply sc_solve by auto\n\n\n  lemma sift_down4_refine_u: \"(la,la')\\<in>nat_rel \\<Longrightarrow> (xs,xs')\\<in> (\\<langle>Id\\<rangle>list_rel) \\<Longrightarrow> sift_down4 (\\<^bold><) l h la xs \\<le> \\<Down>(\\<langle>Id\\<rangle>list_rel) ( timerefine (Rsd (h-l)) (sift_down_ab (\\<^bold>\\<le>) l h la' xs\\<^sub>0 xs'))\"\n    apply (simp del: conc_Id)\n    apply(rule order.trans[OF sift_down4_refine, of _  xs\\<^sub>0])\n    unfolding sift_down_ab_def\n    apply(rule ASSERT_D5_leI)\n    apply simp done (*\n    apply(rule timerefine_R_mono_wfR'')\n    subgoal by(auto simp: Rsd_def wfR''_TId intro: wfR''_upd)\n    unfolding Rsd_def\n    apply(simp add: le_fun_def) \n    apply(rule sift_down3_cost_mono)\n    by auto *)\n\n  definition \"heapify_btu xs\\<^sub>0 \\<equiv> doN {\n    ASSERT(h>0);\n    h' \\<leftarrow> SPECc2 ''sub'' (-) h 1;\n    (xs,l') \\<leftarrow> monadic_WHILEIT (\\<lambda>(xs,l'). heapify_btu_invar xs\\<^sub>0 l' xs \\<and> l'\\<ge>l)\n      (\\<lambda>(xs,l'). SPECc2 ''icmp_slt'' (<) l l') \n      (\\<lambda>(xs,l'). doN {\n        ASSERT (l'>0);\n        l' \\<leftarrow> SPECc2 ''sub'' (-) l' 1;\n        xs \\<leftarrow> sift_down_ab (\\<^bold>\\<le>) l h l' xs\\<^sub>0 xs ;\n        RETURN (xs,l')\n      })\n      (xs\\<^sub>0,h');\n    RETURN xs\n  }\"    \n\ndefinition heapify_btu_cost :: \"_ \\<Rightarrow> ecost\" \n  where \"heapify_btu_cost xs\\<^sub>0 = cost ''call'' (enat (h - Suc l) + 1) + cost ''icmp_slt'' (enat (h - Suc l) + 1)\n       + cost ''if'' (enat (h - Suc l) + 1) + cost ''sub'' (enat (h - Suc l) +1) \n      + cost ''sift_down'' (enat (h - Suc l))\"\n\n\\<comment> \\<open>TODO: heapify_btu actually is O(n), not O(n * log n) ! but we don't need it for heapsort in O(n*log n)\\<close> \n\ndefinition heapify_btu_lbc :: \"_ \\<Rightarrow> (char list, nat) acost\" where\n  \"heapify_btu_lbc = (\\<lambda>(xs,l'). (cost ''call'' (l'-l) + (cost ''icmp_slt'' (l'-l) + cost ''if'' (l'-l)) + cost ''sub'' (l'-l) + cost ''sift_down'' (l'-l)))\"\n\n\nsubsubsection \\<open>Correctness Lemma\\<close>\n\n  lemma heapify_btu_correct: \"\\<lbrakk> l<h; h\\<le>length xs\\<^sub>0 \\<rbrakk> \\<Longrightarrow> heapify_btu xs\\<^sub>0 \\<le> SPEC (\\<lambda>xs. slice_eq_mset l h xs xs\\<^sub>0 \\<and> is_heap xs) (\\<lambda>_. heapify_btu_cost xs\\<^sub>0)\"\n    unfolding heapify_btu_def\n    apply simp\n    apply(subst monadic_WHILEIET_def[symmetric, where E=heapify_btu_lbc]) \n    unfolding SPEC_def SPECc2_def \n    unfolding sift_down_ab_refine SPEC_REST_emb'_conv\n    apply(rule gwp_specifies_I)\n    apply (refine_vcg \\<open>-\\<close> rules: gwp_monadic_WHILEIET)\n    apply(rule gwp_monadic_WHILEIET)\n    subgoal unfolding wfR2_def heapify_btu_lbc_def zero_acost_def cost_def by auto\n    subgoal for s\n      apply clarsimp\n      apply (refine_vcg \\<open>-\\<close>)\n      apply simp_all\n      apply safe\n      subgoal\n        apply (refine_vcg \\<open>-\\<close>) (* loop body *)\n        subgoal apply(rule loop_body_conditionI) \n          subgoal unfolding heapify_btu_lbc_def apply sc_solve by auto\n          subgoal unfolding heapify_btu_lbc_def apply sc_solve_debug apply(all \\<open>(auto simp: one_enat_def sc_solve_debug_def; fail)?\\<close>) done \n          subgoal by auto \n          done\n        subgoal by simp\n        done\n    subgoal (* exiting loop because of wrong guard *)\n      apply(rule loop_exit_conditionI)\n      apply (refine_vcg \\<open>-\\<close>)\n      unfolding heapify_btu_invar_def\n      unfolding heapify_btu_lbc_def heapify_btu_cost_def\n      apply auto\n      subgoal using btu_heapify_term by blast\n      subgoal \n        apply(simp add: lift_acost_diff_to_the_front lift_acost_diff_to_the_right lift_acost_diff_to_the_right_Some)\n       apply(sc_solve)\n        by auto    \n      done\n    done      \n    subgoal by (simp add: heapify_btu_invar_def btu_heapify_init) \n    done\n\n\n  \nsubsection \\<open>Verification of heapify_btu2\\<close>\n\n  definition \"heapify_btu2 xs\\<^sub>0 \\<equiv> doN {\n    ASSERT(h>0);\n    h' \\<leftarrow> SPECc2 ''sub'' (-) h 1;\n    (xs,l') \\<leftarrow> monadic_WHILEIT (\\<lambda>_. True) \n      (\\<lambda>(xs,l'). SPECc2 ''icmp_slt'' (<) l l') \n      (\\<lambda>(xs,l'). doN {\n        ASSERT (l'>0);\n        l'' \\<leftarrow> SPECc2 ''sub'' (-) l' 1;\n        xs \\<leftarrow> sift_down4 (\\<^bold><) l h l'' xs;\n        RETURN (xs,l'')\n      })\n      (xs\\<^sub>0,h');\n    RETURN xs\n  }\"   \n\n\nsubsubsection \\<open>Refinement Lemma\\<close>\n\n  lemma heapify_btu2_refine: \"heapify_btu2 xs\\<^sub>0 \\<le> \\<Down> (\\<langle>Id\\<rangle>list_rel) (timerefine (Rsd (h-l)) (heapify_btu xs\\<^sub>0))\"\n    unfolding heapify_btu2_def heapify_btu_def\n    supply monadic_WHILEIT_refine'[refine]\n    supply bindT_refine_easy[refine]\n    supply sift_down4_refine_u[refine]                           \n    apply(refine_rcg SPECc2_refine)\n    apply refine_dref_type   \n    by  (auto simp: cost_n_leq_TId_n Rsd_def SPECc2_def inres_SPECT)\n  \n  lemma heapify_btu2_correct:\n    \"\\<lbrakk>l < h; h \\<le> length xs\\<^sub>0\\<rbrakk>\n    \\<Longrightarrow> heapify_btu2 xs\\<^sub>0 \\<le> \\<Down> (\\<langle>Id\\<rangle>list_rel) (timerefine (Rsd (h-l)) (SPEC (\\<lambda>xs. slice_eq_mset l h xs xs\\<^sub>0 \\<and> is_heap xs) (\\<lambda>_. heapify_btu_cost xs\\<^sub>0)))\"\n    apply(rule order.trans)\n     apply(rule heapify_btu2_refine)\n    apply simp\n    apply(rule timerefine_mono2)\n    by(auto simp: Rsd_def intro: heapify_btu_correct)\n    \n  \n  thm heap_context.heapify_btu2_def\n     \nend\n\nconcrete_definition heapify_btu1 for less_eq  l h xs\\<^sub>0 is heap_context.heapify_btu_def\nconcrete_definition heapify_btu2 for less l h xs\\<^sub>0 is heap_context.heapify_btu2_def\nconcrete_definition Rsd_a for i is heap_context.Rsd_def\n\n\nsubsection \\<open>Verification of Heapsort\\<close>\n\ncontext heap_context begin  \n\n    lemmas heapify_btu1_correct = heapify_btu_correct[unfolded heapify_btu1.refine[OF heap_context_axioms]]\nend\n\ncontext weak_ordering begin\n\n  (* TODO: We keep \\<le> out of the definition (although it occurs in invariants). \n    Otherwise, getting rid of the \\<le> ghost parameter is difficult!\n  *)\n\n\n  (* abstraction level with currency sift_down *)\n  definition heapsort :: \"'a list \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ('a list,_) nrest\" where \"heapsort xs\\<^sub>0 l h\\<^sub>0 \\<equiv> doN {\n    ASSERT (l\\<le>h\\<^sub>0);\n    hl \\<leftarrow> SPECc2 ''sub'' (-) h\\<^sub>0 l;\n    if\\<^sub>N SPECc2 ''icmp_slt'' (<) 1 hl then\n      doN {\n        xs \\<leftarrow> heapify_btu1 (\\<^bold>\\<le>) l h\\<^sub>0 xs\\<^sub>0;\n        \n        (xs,h)\\<leftarrow> monadic_WHILEIT (\\<lambda>(xs,h). \n            l<h \\<and> h\\<le>h\\<^sub>0 \n          \\<and> heap_context.is_heap (le_by_lt (\\<^bold><)) l h xs\n          \\<and> slice_eq_mset l h\\<^sub>0 xs xs\\<^sub>0\n          \\<and> sorted_wrt_lt (\\<^bold><) (slice h h\\<^sub>0 xs)\n          \\<and> (\\<forall>a\\<in>set (slice l h xs). \\<forall>b\\<in>set (slice h h\\<^sub>0 xs). (le_by_lt (\\<^bold><)) a b)\n        )\n          (\\<lambda>(xs,h). doN { l' \\<leftarrow> SPECc2 ''add'' (+) l 1;\n                          SPECc2 ''icmp_slt'' (<) l' h }) \n          (\\<lambda>(xs,h). doN {\n            ASSERT (h>0 \\<and> l\\<noteq>h-1);\n            h' \\<leftarrow> SPECc2 ''sub'' (-) h 1;\n            xs \\<leftarrow> mop_list_swapN xs l h';\n            xs \\<leftarrow> sift_down_restore_a (\\<^bold>\\<le>) l h' xs xs;\n            RETURN (xs,h')\n          })\n          (xs,h\\<^sub>0);\n        \n        RETURN xs\n      }\n    else\n      RETURN xs\\<^sub>0\n  }\"\n\n\ntext \\<open>heapsort loop body cost\\<close> \ndefinition heapsort_lbc :: \"nat \\<Rightarrow> (char list, nat) acost\" where\n  \"heapsort_lbc = (\\<lambda>p.  \n                 cost ''list_swap'' p + cost ''call'' p +  cost ''add'' p + cost ''icmp_slt'' p\n               + cost ''if'' p + cost ''sub'' p + cost ''sift_down'' p )\"\n\n  definition heapsort_time :: \"_ \\<Rightarrow> _ \\<Rightarrow> ecost\" where\n    \"heapsort_time l h\\<^sub>0 = lift_acost (heapsort_lbc (h\\<^sub>0-l)) \n          + cost ''add'' 1 + cost ''call'' (enat (h\\<^sub>0 - Suc l) + 2)\n          + cost ''icmp_slt'' (enat (h\\<^sub>0 - Suc l) + 1 + 1 + 1) + cost ''if'' (enat (h\\<^sub>0 - Suc l) + 1 + 3)\n          + cost ''sub'' (enat (h\\<^sub>0 - Suc l) + 2) + cost ''sift_down'' (enat (h\\<^sub>0 - Suc l))\"\n\nsubsubsection \\<open>Correctness Lemma\\<close>\n  \nlemma heapsort_correct:\n  fixes xs\\<^sub>0 :: \"'a list\"\n    assumes \"l\\<le>h\\<^sub>0\" \"h\\<^sub>0\\<le>length xs\\<^sub>0\"\n    shows \"heapsort xs\\<^sub>0 l h\\<^sub>0 \\<le> SPEC (\\<lambda>xs. slice_eq_mset l h\\<^sub>0 xs xs\\<^sub>0 \\<and> sorted_wrt_lt (\\<^bold><) (slice l h\\<^sub>0 xs)) (\\<lambda>_. heapsort_time l h\\<^sub>0)\"\n  proof -\n    interpret initial: heap_context \"(\\<^bold>\\<le>)\" \"(\\<^bold><)\" l h\\<^sub>0 by unfold_locales fact\n\n    note F = initial.heapify_btu1_correct[unfolded SPEC_def, THEN gwp_specifies_rev_I, THEN gwp_conseq_0]\n    note G = initial.sift_down_ab_refine \n\n    show ?thesis  \n      using assms unfolding heapsort_def le_by_lt (* NOTE: not yet used here le_by_lt *)\n      apply(subst monadic_WHILEIET_def[symmetric, where E=\"(\\<lambda>(xs,h). heapsort_lbc (h-l) )::(('a list * nat) \\<Rightarrow>  (char list, nat) acost)\"]) \n      unfolding SPEC_def SPECc2_def mop_list_swap_def \n      apply(rule gwp_specifies_I)\n      apply (refine_vcg \\<open>-\\<close> rules: gwp_monadic_WHILEIET F If_le_rule)\n\n                apply (all \\<open>(auto dest: slice_eq_mset_eq_length;fail)?\\<close>)    \n      subgoal unfolding wfR2_def apply (auto simp: handy_if_lemma zero_acost_def)\n          unfolding heapsort_lbc_def Let_def cost_def zero_acost_def by auto\n      apply (clarsimp_all simp add: handy_if_lemma)\n      subgoal premises prems for xs\\<^sub>1 M xs h y proof -\n        (* TODO: This is the argument that swapping the max-element to the end will preserve the\n            sortedness criteria. Though apparently simple, the reasoning seems to be much too complex here.\n            Try to improve on that!\n        *)\n        interpret heap_context \"(\\<^bold>\\<le>)\" \"(\\<^bold><)\" l h using prems by (unfold_locales) auto\n        interpret N: heap_context \"(\\<^bold>\\<le>)\" \"(\\<^bold><)\" l \"h-Suc 0\" using prems by (unfold_locales) auto\n        \n        from prems have \n          [simp]: \"length xs = length xs\\<^sub>0\" \n          and [simp, arith]: \"h\\<^sub>0 \\<le> length xs\\<^sub>0\"\n        by (auto simp: slice_eq_mset_eq_length)\n        \n        {\n          fix xs'\n          assume A: \"slice_eq_mset l (h - Suc 0) xs' (swap xs l (h - Suc 0))\"  \n          hence \"slice_eq_mset l h\\<^sub>0 xs' (swap xs l (h - Suc 0))\"\n            apply (rule slice_eq_mset_subslice)\n            using prems by auto\n          from this[symmetric] have \"slice_eq_mset l h\\<^sub>0 xs' xs\"  \n            apply -\n            apply (drule slice_eq_mset_swap(2)[THEN iffD1, rotated -1])\n            using prems by (auto dest: slice_eq_mset_sym)\n          also note \\<open>slice_eq_mset l h\\<^sub>0 xs xs\\<^sub>0\\<close>   \n          finally have G1: \"slice_eq_mset l h\\<^sub>0 xs' xs\\<^sub>0\" .\n  \n          note [simp] = slice_eq_mset_eq_length[OF G1]\n          \n          have [simp]: \"slice (h - Suc 0) h\\<^sub>0 xs' = (xs'!(h-Suc 0))#slice h h\\<^sub>0 xs'\"\n            apply (rule slice_extend1_left)\n            using prems by (auto)\n          \n            \n          have \"slice h h\\<^sub>0 xs' = slice h h\\<^sub>0 (swap xs l (h - Suc 0))\"\n            apply (rule slice_eq_mset_eq_outside(2)[OF A]) using prems by auto\n          also have \"\\<dots> = slice h h\\<^sub>0 xs\" \n            by (metis Suc_lessD atLeastLessThan_iff leI le_antisym le_zero_eq nat_less_le nz_le_conv_less \\<open>Suc l < h\\<close> slice_swap_outside)\n          finally have [simp]: \"slice h h\\<^sub>0 xs' = slice h h\\<^sub>0 xs\" .\n            \n          have [arith,simp]: \"h - Suc 0 < length xs\\<^sub>0\" \"l<length xs\\<^sub>0\" using prems by (auto)\n          have [simp]: \"xs' ! (h - Suc 0) = xs!l\" \n            using slice_eq_mset_nth_outside[OF A, of \"h-Suc 0\"] \n            by auto\n            \n          have \"xs!l \\<in> set (slice l h xs)\" using prems by (auto simp: set_slice_conv)\n          then have G2: \"sorted_wrt (\\<^bold>\\<le>) (slice (h - Suc 0) h\\<^sub>0 xs')\" \n            using prems \n            by (auto)\n  \n          have [simp]: \"slice l (h - Suc 0) (swap xs l (h - Suc 0)) = xs!(h-Suc 0)#(slice (Suc l) (h-Suc 0) xs)\"\n            apply (rule nth_equalityI)\n            apply (auto simp: nth_list_update slice_nth swap_nth Suc_diff_Suc \\<open>Suc l < h\\<close>)\n            done\n            \n          have \"in_heap (h - Suc 0)\"\n            unfolding in_heap_def apply simp\n            using \\<open>Suc l < h\\<close> by linarith\n          \n          have G3: \"\\<forall>a \\<in> set (slice l (h - Suc 0) xs'). \\<forall>b \\<in> set (slice (h - Suc 0) h\\<^sub>0 xs'). a\\<^bold>\\<le>b\" \n            thm slice_eq_mset_set_inside[OF A]\n            apply (simp add: slice_eq_mset_set_inside[OF A])\n            using \\<open>\\<forall>x\\<in>set (slice l h xs). \\<forall>_\\<in>_. _\\<close>\n            apply (auto simp: set_slice_conv root_greatest[OF \\<open>is_heap xs\\<close> \\<open>in_heap (h-Suc 0)\\<close>])\n            subgoal using N.ran_not_empty \\<open>in_heap (h - Suc 0)\\<close> in_heap_bounds(2) by blast  \n            subgoal for j \n              apply (subgoal_tac \"in_heap j\")\n              using root_greatest[OF \\<open>is_heap xs\\<close>, of j] apply blast\n              unfolding in_heap_def by simp\n            subgoal by (metis Suc_le_lessD diff_le_self less_imp_le less_le_trans)\n            done\n            \n          note G1 G2 G3\n        } note aux=this\n        thm sift_down_invar_init[OF \\<open>is_heap xs\\<close> \\<open>Suc l < h\\<close>]\n\n        have \" l < h - Suc 0\" using \\<open>Suc l < h\\<close>\n          using N.ran_not_empty le_eq_less_or_eq prems(5) by blast\n\n        show ?thesis\n          unfolding sift_down_restore_a_def SPEC_REST_emb'_conv\n          apply (refine_vcg \\<open>-\\<close> )\n          subgoal for x\n            apply(rule loop_body_conditionI)\n            subgoal unfolding heapsort_lbc_def Let_def apply sc_solve by simp\n            subgoal unfolding heapsort_lbc_def Let_def apply simp\n              apply sc_solve by (auto simp: one_enat_def)\n            subgoal  \n              apply safe\n              using \\<open>Suc l < h\\<close> \\<open>h\\<le>h\\<^sub>0\\<close>\n              by (auto simp: aux)\n            done\n          subgoal using sift_down_invar_init[OF \\<open>is_heap xs\\<close> \\<open>Suc l < h\\<close>] \\<open>l < h - Suc 0\\<close> by simp\n          done\n          \n      qed\n      subgoal for xs\\<^sub>1 M xs h y\n        apply(rule loop_exit_conditionI)\n        apply (refine_vcg \\<open>-\\<close> rules: If_le_Some_rule2)\n        subgoal \n          unfolding initial.heapify_btu_cost_def heapsort_time_def\n          apply(simp add: lift_acost_zero lift_acost_diff_to_the_front lift_acost_diff_to_the_right lift_acost_diff_to_the_right_Some)\n\n          apply(simp only: add.assoc)\n          apply(rule add_left_mono)  \n          apply sc_solve_debug apply safe by (all \\<open>(auto simp: sc_solve_debug_def numeral_eq_enat one_enat_def;fail)?\\<close>)\n        subgoal \n          \n      \n      apply clarsimp\n      subgoal premises prems\n      proof -\n        have [simp]: \"h=l+1\" using prems by auto\n      \n        from prems have [simp]: \"length xs = length xs\\<^sub>0\"\n          and [simp, arith]: \"l<length xs\\<^sub>0\" \"h<length xs\\<^sub>0\"\n          by (auto dest: slice_eq_mset_eq_length)\n        \n        have \"set (slice l (Suc l) xs) = {xs!l}\" by simp\n        \n        show ?thesis using prems\n          by (auto simp: slice_split_hd le_by_lt)\n      qed\n      done\n    done\n    prefer 3\n  subgoal\n    by (simp add: sorted_wrt01)\n  subgoal by auto\n  subgoal unfolding heapsort_time_def apply sc_solve by (auto simp: numeral_eq_enat one_enat_def)\n  done\n                                                                                      \nqed\n\nsubsection \\<open>Verification of heapsort2\\<close>\n\n\n  definition heapsort2 :: \"'a list \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ('a list,_) nrest\" where \"heapsort2 xs\\<^sub>0 l h\\<^sub>0 \\<equiv> doN {\n    ASSERT (l\\<le>h\\<^sub>0);\n    hl \\<leftarrow> SPECc2 ''sub'' (-) h\\<^sub>0 l;\n    b \\<leftarrow> SPECc2 ''icmp_slt'' (<) 1 hl;\n    MIf b (doN {\n      xs \\<leftarrow> heapify_btu2 (\\<^bold><) l h\\<^sub>0 xs\\<^sub>0;\n      \n      (xs,h)\\<leftarrow> monadic_WHILEIT (\\<lambda>(xs,h).  True )\n        (\\<lambda>(xs,h). doN { l' \\<leftarrow> SPECc2 ''add'' (+) l 1;\n                        SPECc2 ''icmp_slt'' (<) l' h }) \n        (\\<lambda>(xs,h). doN {\n          ASSERT (h>0 \\<and> l\\<noteq>h-1);\n          h' \\<leftarrow> SPECc2 ''sub'' (-) h 1;\n          xs \\<leftarrow> mop_list_swapN xs l h';\n          xs \\<leftarrow> sift_down4 (\\<^bold><) l h' l xs;\n          RETURN (xs,h')\n        })\n        (xs,h\\<^sub>0);\n      \n      RETURN xs\n    } ) (\n      RETURN xs\\<^sub>0 )\n  }\"\n\n\n\nsubsection \\<open>Refinement Lemma\\<close>\n\nlemma heapsort2_refine:\n  fixes xs\\<^sub>0 :: \"'a list\"\n  assumes \"l\\<le>h\\<^sub>0\" \"h\\<^sub>0\\<le>length xs\\<^sub>0\"\n  shows \"heapsort2  xs\\<^sub>0 l h\\<^sub>0 \\<le> \\<Down>Id (timerefine (Rsd_a (h\\<^sub>0-l)) (heapsort xs\\<^sub>0 l h\\<^sub>0))\"\nproof -\n    interpret initial: heap_context \"(\\<^bold>\\<le>)\" \"(\\<^bold><)\" l h\\<^sub>0 by unfold_locales fact\n\n    \n\n    show ?thesis\n      unfolding heapsort_def heapsort2_def \n      supply bindT_refine_conc_time_my_inres[refine]\n      apply(refine_rcg SPECc2_refine MIf_refine monadic_WHILEIT_refine' )\n      apply refine_dref_type\n      prefer 10\n      subgoal\n        apply(rule  initial.heapify_btu2_refine[unfolded heapify_btu1.refine[OF initial.heap_context_axioms]\n                                                Rsd_a.refine[OF initial.heap_context_axioms]\n                                                heapify_btu2.refine[OF initial.heap_context_axioms]\n                    ])\n        done\n      apply(auto simp: Rsd_a_def wfR''_TId sp_TId simp del: conc_Id \n                intro!: wfR''_upd cost_n_leq_TId_n struct_preserving_upd_I )\n      subgoal \n        apply(refine_rcg)\n        by (auto simp: timerefineA_upd)\n      unfolding SPECc2_def apply (simp del: conc_Id)\n      subgoal premises prems for d _ _ _ xs\\<^sub>1 h h' proof -\n        interpret N: heap_context \"(\\<^bold>\\<le>)\" \"(\\<^bold><)\" l \"h-Suc 0\" using prems by (unfold_locales) auto\n\n        from prems have *: \"h' \\<le> h\\<^sub>0\" by simp\n\n        show ?thesis\n          unfolding Rsd_a_def[symmetric]\n          using N.sift_down4_refine_restore[of \"swap xs\\<^sub>1 l h'\" \"swap xs\\<^sub>1 l h'\"]\n          unfolding Rsd_a.refine[OF N.heap_context_axioms]\n          unfolding Rsd_a_def  N.sift_down3_cost_def initial.sift_down3_cost_def\n          unfolding prems(8)\n          apply(rule order.trans)\n          apply simp\n          apply(rule timerefine_R_mono_wfR'')\n          subgoal by(auto simp: wfR''_TId intro: wfR''_upd)\n          subgoal apply(auto simp: le_fun_def)\n            unfolding N.E_sd3_l_def Let_def prems(1)[symmetric]\n            apply simp\n            apply (clarsimp simp add: the_acost_costs_distrib costmult_add_distrib costmult_cost the_acost_cost_mult acostC_the_acost_cost)\n            apply(simp add: the_acost_propagate  acostC_the_acost_cost add.assoc)\n            apply sc_solve_debug apply safe using \\<open>h' \\<le> h\\<^sub>0\\<close>  apply (all \\<open>(auto intro: log_mono[THEN monoD] simp: sc_solve_debug_def numeral_eq_enat one_enat_def;fail)?\\<close>)\n            apply (auto intro: log_mono[THEN monoD] intro!: add_mono simp: sc_solve_debug_def numeral_eq_enat one_enat_def)\n            done\n          done\n      qed\n      done        \nqed\n\ndefinition heapsort_TR\n  where \"heapsort_TR l h = pp (Rsd_a (h-l)) (TId(''slice_sort'':=heapsort_time l h))\"\n\nlemma wfR''_Rsd_a[simp]: \"wfR'' (Rsd_a x)\"\n  unfolding Rsd_a_def by auto\n\nlemma wfR''_heapsort_TR[simp]: \" wfR'' (heapsort_TR l h)\"\n  unfolding heapsort_TR_def\n  by (auto intro!: wfR''_ppI)\n\nlemma Sum_any_cost: \"Sum_any (the_acost (cost n x)) = x\"\n  unfolding cost_def by (simp add: zero_acost_def)\n\nlemma finite_sum_nonzero_cost_enat:\n  \"finite {a. the_acost (cost n m) a \\<noteq> 0}\"\n  unfolding cost_def by (auto simp: zero_acost_def)\n\nlemma finite_sum_nonzero_if_summands_finite_nonzero_enat:\n  \"finite {a. f a \\<noteq> 0} \\<Longrightarrow> finite {a. g a \\<noteq> 0} \\<Longrightarrow> finite {a. (f a ::enat) + g a \\<noteq> 0}\"\n  apply(rule finite_subset[where B=\"{a. f a \\<noteq> 0} \\<union> {a. g a \\<noteq> 0}\"])\n  by auto\n\n\nsubsubsection \\<open>Complexity Bound for Heapsort\\<close>\n\ntext \\<open>Heap sort is in O(n log n)\\<close>\n\nlemma \"Sum_any (the_acost (timerefineA (heapsort_TR l h) (cost ''slice_sort'' 1))) = \n      enat (73 * (h - Suc l) + 75 * (h - l) + 12 + 29 * (Discrete.log (h - l) * (h - Suc l)) + 29 * ((h - l) * Discrete.log (h - l))) \"\n  unfolding heapsort_TR_def  singleton_heap_context.sift_down3_cost_def heapsort_time_def\n  unfolding pp_fun_upd pp_TId_absorbs_right \n  apply(auto simp add: timerefineA_propagate)\n  unfolding Rsd_a_def heapsort_lbc_def \n  apply(auto simp:   timerefineA_update_apply_same_cost' lift_acost_cost costmult_cost\n                lift_acost_propagate timerefineA_update_cost wfR''_TId intro!: wfR''_upd)\n  apply(subst timerefineA_propagate, auto)+\n  unfolding singleton_heap_context.sift_down3_cost_def  singleton_heap_context.E_sd3_l_def\n  apply(auto simp: costmult_cost costmult_add_distrib lift_acost_propagate lift_acost_cost)\n  apply(simp only: add.left_commute add.assoc cost_same_curr_left_add plus_enat_simps)\n  apply(simp add: timerefineA_update_apply_same_cost' costmult_cost costmult_add_distrib)\n  apply(simp only: the_acost_propagate )\n  apply(subst  Sum_any.distrib; auto  simp only: Sum_any_cost intro!: finite_sum_nonzero_if_summands_finite_nonzero_enat finite_sum_nonzero_cost)+\n  apply (simp add: plus_enat_simps one_enat_def numeral_eq_enat add_mult_distrib2 add_mult_distrib)\n  done\n\n\nsubsubsection \\<open>Correctness Theorem\\<close>\n\nlemma heapsort_correct': \n  \"\\<lbrakk>(xs,xs')\\<in>Id; (l,l')\\<in>Id; (h,h')\\<in>Id\\<rbrakk> \\<Longrightarrow> heapsort2 xs l h \\<le>\n      \\<Down>Id (timerefine (heapsort_TR l h) (slice_sort_spec (\\<^bold><) xs' l' h'))\"\n    unfolding slice_sort_spec_alt              \n    apply (rule refine0)\n    apply(rule order.trans)\n     apply(rule heapsort2_refine) apply simp apply simp\n    apply simp\n    unfolding heapsort_TR_def\n    apply(subst timerefine_iter2[symmetric])\n    subgoal by(auto simp: Rsd_a_def wfR''_TId intro: wfR''_upd) \n    subgoal by(auto simp: wfR''_TId intro: wfR''_upd) \n    apply(rule timerefine_mono2) \n    subgoal by(auto simp: Rsd_a_def wfR''_TId intro: wfR''_upd) \n    subgoal \n      apply(rule order.trans[OF heapsort_correct])\n      apply simp apply simp\n      apply(rule SPEC_timerefine)\n      subgoal by (auto simp: slice_eq_mset_alt)\n      subgoal by(simp add: timerefineA_update_apply_same_cost)\n      done\n    done\n  \nend\n\n\nsubsection \\<open>Synthesis of LLVM Code\\<close>\n\nconcrete_definition heapsort1 for less xs\\<^sub>0 l h\\<^sub>0 is weak_ordering.heapsort_def\n\n\ncontext weak_ordering begin  \n  lemmas heapsort1_correct = heapsort_correct'[unfolded heapsort1.refine[OF weak_ordering_axioms]]\nend\n\ncontext heap_context begin\n\nend\n\ncontext size_t_context begin\n\nsepref_register mop_lchild3 mop_rchild3 mop_has_rchild3 mop_has_lchild3 mop_geth3  mop_seth3  \nsepref_def mop_lchild_impl [llvm_inline] is \"uncurry mop_lchild3\" :: \"size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k \\<rightarrow>\\<^sub>a size_assn\"\n  unfolding mop_lchild3_def apply (annot_snat_const \"TYPE ('size_t)\")\n  by sepref\n\nsepref_def mop_rchild_impl [llvm_inline] is \"uncurry mop_rchild3\" :: \"size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k \\<rightarrow>\\<^sub>a size_assn\"\n  unfolding mop_rchild3_def apply (annot_snat_const \"TYPE ('size_t)\")\n  by sepref\n\nsepref_def has_lchild_impl [llvm_inline] is \"uncurry2 mop_has_lchild3\" :: \"[\\<lambda>((l,h),i). l\\<le>h]\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k \\<rightarrow> bool1_assn\"\n  unfolding mop_has_lchild3_def apply (annot_snat_const \"TYPE ('size_t)\") by sepref\n\nsepref_def has_rchild_impl [llvm_inline] is \"uncurry2 mop_has_rchild3\" :: \"[\\<lambda>((l,h),i). l<h]\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k \\<rightarrow> bool1_assn\"\n  unfolding mop_has_rchild3_def apply (annot_snat_const \"TYPE ('size_t)\") by sepref \n\nsepref_def mop_geth_impl [llvm_inline] is \"uncurry3 mop_geth3\" \n  (*:: \"size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a (eoarray_assn elem_assn)\\<^sup>d *\\<^sub>a size_assn\\<^sup>k \\<rightarrow>\\<^sub>a elem_assn \\<times>\\<^sub>a eoarray_assn elem_assn\" *)\n  :: \"size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a (eoarray_assn elem_assn)\\<^sup>d *\\<^sub>a size_assn\\<^sup>k \\<rightarrow>\\<^sub>a\\<^sub>d (\\<lambda>_ ((_,ai),_). elem_assn \\<times>\\<^sub>a cnc_assn (\\<lambda>x. x=ai) (eoarray_assn elem_assn))\"\n  unfolding mop_geth3_def\n  unfolding mop_oarray_extract_def[symmetric]\n  by sepref\n  \nsepref_def mop_seth_impl [llvm_inline] is \"uncurry4 mop_seth3\" \n  :: \"size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a (eoarray_assn elem_assn)\\<^sup>d *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a elem_assn\\<^sup>d \\<rightarrow>\\<^sub>a\\<^sub>d (\\<lambda>_ (((_,ai),_),_). cnc_assn (\\<lambda>x. x=ai) (eoarray_assn elem_assn))\"\n  unfolding mop_seth3_def  \n  unfolding mop_oarray_upd_def[symmetric] thm mop_oarray_extract_def[symmetric]\n  by sepref\n   \nend\n\ncontext sort_impl_context begin\n\nsubsubsection \\<open>sift_down5\\<close>\n\n  definition sift_down5 :: \" _ \\<Rightarrow> _ \\<Rightarrow> nat \\<Rightarrow> 'a list \\<Rightarrow> ('a list, _) nrest\" where \"sift_down5 l h i\\<^sub>0 xs \\<equiv> doN {\n    ASSERT (l\\<le>i\\<^sub>0 \\<and> i\\<^sub>0<h);\n    i\\<^sub>1 \\<leftarrow> SPECc2 ''sub'' (-) i\\<^sub>0 l;\n    xs \\<leftarrow> mop_to_eo_conv xs;\n    (v,xs) \\<leftarrow> mop_geth3 l h xs i\\<^sub>1;\n    \n    (xs,i,_) \\<leftarrow> monadic_WHILEIT (\\<lambda>(xs,i,ctd). i<h-l \\<and> i\\<ge>i\\<^sub>1)\n       (\\<lambda>(xs,i,ctd). do { hrc \\<leftarrow> mop_has_rchild3 l h i;\n                          SPECc2 ''and'' (\\<and>) hrc ctd }) (\\<lambda>(xs,i,ctd). doN {\n      lci \\<leftarrow> mop_lchild3 h i;\n      rci \\<leftarrow> mop_rchild3 h i;\n\n      ASSERT (l+lci<h \\<and> l+rci<h \\<and> l+lci \\<noteq> l+rci);\n      lplci \\<leftarrow> SPECc2 ''add'' (+) l lci;\n      lprci \\<leftarrow> SPECc2 ''add'' (+) l rci;\n      ASSERT (lplci \\<noteq> lprci);\n      b \\<leftarrow> cmpo_idxs2' xs lplci lprci;\n      \n      MIf b (doN {\n        b \\<leftarrow> cmpo_v_idx2' xs v lprci;\n        MIf b ( doN {\n          (rc,xs) \\<leftarrow> mop_geth3 l h xs rci;\n          xs \\<leftarrow> mop_seth3 l h xs i rc;\n          RETURN (xs,rci,True)\n        } ) (  RETURN (xs,i,False) )\n      } ) ( doN {\n        b \\<leftarrow> cmpo_v_idx2' xs v lplci;\n        MIf b ( doN {\n          (lc,xs) \\<leftarrow> mop_geth3 l h xs lci;\n          xs \\<leftarrow> mop_seth3 l h xs i lc;\n          RETURN (xs,lci,True)\n        } ) ( RETURN (xs,i,False) )\n      } )\n    }) (xs,i\\<^sub>1,True);\n    \n    ASSERT (i\\<ge>i\\<^sub>1);\n    \n    hlc \\<leftarrow> mop_has_lchild3 l h i;\n    MIf hlc ( doN {\n      lci \\<leftarrow> mop_lchild3 h i;\n      ASSERT (l+lci<h);\n      lplci \\<leftarrow> SPECc2 ''add'' (+) l lci;\n      b \\<leftarrow> cmpo_v_idx2' xs v lplci;\n      MIf b ( doN {\n        (lc,xs) \\<leftarrow> mop_geth3 l h xs lci;\n        xs \\<leftarrow> mop_seth3 l h xs i lc;\n        xs \\<leftarrow> mop_seth3 l h xs lci v;\n        xs \\<leftarrow> mop_to_wo_conv xs;\n        RETURN xs\n      } )( doN {\n        xs \\<leftarrow> mop_seth3 l h xs i v;\n        xs \\<leftarrow> mop_to_wo_conv xs;\n        RETURN xs\n      }  )\n    } )( doN {\n      xs \\<leftarrow> mop_seth3 l h xs i v;\n      xs \\<leftarrow> mop_to_wo_conv xs;\n      RETURN xs\n    }  )\n  }\" \n\n\nlemma mop_geth3_refine_aux1: \"enat (Suc 0) = 1\" by (simp add: one_enat_def)\n\nlemma mop_geth3_refine:\n  assumes \n     \"preserves_curr TR ''add''\"\n   and \"preserves_curr TR ''load''\"\n   and \"preserves_curr TR ''ofs_ptr''\"\n  shows \"wfR'' TR \\<Longrightarrow> (a,a')\\<in>Id \\<Longrightarrow> (b,b')\\<in>Id  \\<Longrightarrow> (h,h')\\<in>Id  \\<Longrightarrow> (l,l')\\<in>Id \\<Longrightarrow> mop_geth3 h l a b \\<le> \\<Down> Id (timerefine TR (mop_geth3 h' l' a' b'))\"\n  unfolding mop_geth3_def mop_eo_extract_def\n  apply(intro refine0 bindT_refine_easy SPECc2_refine)\n  apply refine_dref_type\n  using assms    \n  by (auto simp: mop_geth3_refine_aux1 norm_cost preserves_curr_def)\n\nlemma  mop_seth3_refine:\n  fixes TR :: \"_ \\<Rightarrow> (_, enat) acost\"\n  assumes \n     \"preserves_curr TR ''add''\"\n   and \"preserves_curr TR ''store''\"\n   and \"preserves_curr TR ''ofs_ptr''\"\n  shows \"(a,a')\\<in>Id \\<Longrightarrow> (b,b')\\<in>Id \\<Longrightarrow> (c,c')\\<in>Id \\<Longrightarrow> (h,h')\\<in>Id \\<Longrightarrow> (l,l')\\<in>Id \\<Longrightarrow> wfR'' TR \\<Longrightarrow> mop_seth3 h l a b c \\<le> \\<Down> Id (timerefine TR (mop_seth3 h' l' a' b' c'))\"\n    \n  unfolding mop_seth3_def mop_eo_set_def\n  apply(intro refine0 bindT_refine_easy SPECc2_refine)\n  apply refine_dref_type\n  using assms   \n  by (auto simp: norm_cost preserves_curr_def ) \n\n\n\nlemma mop_has_rchild3_refine:\n  fixes TR :: \"_ \\<Rightarrow> ecost\"\n  assumes \"preserves_curr TR ''sub''\"\n  assumes \"preserves_curr TR ''udiv''\"\n  assumes \"preserves_curr TR ''icmp_slt''\"\n  shows \"wfR'' TR \\<Longrightarrow> (a,a')\\<in>Id   \\<Longrightarrow> (h,h')\\<in>Id  \\<Longrightarrow> (l,l')\\<in>Id \\<Longrightarrow> mop_has_rchild3 h l a \\<le> \\<Down> bool_rel (timerefine TR (mop_has_rchild3 h' l' a'))\"\n  unfolding mop_has_rchild3_def SPECc2_alt\n  apply(intro refine0 bindT_refine_easy SPECc2_refine')\n  apply refine_dref_type\n  using assms    \n  by (auto simp: norm_cost preserves_curr_def ) \n\nlemma mop_lchild3_refine:\n  fixes TR :: \"_ \\<Rightarrow> ecost\"\n  assumes \"preserves_curr TR ''mul''\"\n  assumes \"preserves_curr TR ''add''\"\n  shows \"wfR'' TR \\<Longrightarrow> (a,a')\\<in>Id \\<Longrightarrow> (l,l')\\<in>Id \\<Longrightarrow> mop_lchild3 l a \\<le> \\<Down> Id (timerefine TR (mop_lchild3 l' a'))\"\n  unfolding mop_lchild3_def SPECc2_alt\n  apply(intro refine0 bindT_refine_easy SPECc2_refine')\n  apply refine_dref_type\n  using assms    \n  by (auto simp: norm_cost preserves_curr_def ) \n\nlemma mop_rchild3_refine:\n  fixes TR :: \"_ \\<Rightarrow> ecost\"\n  assumes \"preserves_curr TR ''mul''\"\n  assumes \"preserves_curr TR ''add''\"\n  shows \"wfR'' TR \\<Longrightarrow> (a,a')\\<in>Id \\<Longrightarrow> (l,l')\\<in>Id \\<Longrightarrow> mop_rchild3 l a \\<le> \\<Down> Id (timerefine TR (mop_rchild3 l' a'))\"\n  unfolding mop_rchild3_def SPECc2_alt\n  apply(intro refine0 bindT_refine_easy SPECc2_refine')\n  apply refine_dref_type\n  using assms    \n  by (auto simp: norm_cost preserves_curr_def ) \n\nlemma mop_has_lchild3_refine:\n  fixes TR :: \"_ \\<Rightarrow> ecost\"\n  assumes \"preserves_curr TR ''sub''\"\n  assumes \"preserves_curr TR ''udiv''\"\n  assumes \"preserves_curr TR ''icmp_slt''\"\n  assumes \"(h,h')\\<in>Id\" \"(l,l')\\<in>Id\"\n  shows \"wfR'' TR \\<Longrightarrow> (a,a')\\<in>Id \\<Longrightarrow> mop_has_lchild3 h l a \\<le> \\<Down> bool_rel (timerefine TR (mop_has_lchild3 h' l' a'))\"\n  unfolding mop_has_lchild3_def SPECc2_alt\n  apply(intro refine0 bindT_refine_easy SPECc2_refine')\n  apply refine_dref_type\n  using assms    \n  by (auto simp: norm_cost preserves_curr_def ) \n\n\n\nlemma cmpo_idxs2'_refines_mop_cmpo_idxs_with_E':\n  \"b'\\<noteq>c' \\<Longrightarrow> (a,a')\\<in>Id \\<Longrightarrow> (b,b')\\<in>Id \\<Longrightarrow> (c,c')\\<in>Id \\<Longrightarrow>\n    cmpo_idxs2' a b c \\<le> \\<Down> bool_rel (timerefine TR_cmp_swap (mop_cmpo_idxs (cost ''cmpo_idxs'' 1) a' b' c'))\"\n  apply(rule cmpo_idxs2'_refines_mop_cmpo_idxs_with_E)\n  by (auto simp: timerefineA_update_apply_same_cost')\n  \n\nlemma  cmpo_v_idx2'_refines_mop_cmpo_v_idx_with_E':\n \"(a,a')\\<in>Id \\<Longrightarrow> (b,b')\\<in>Id \\<Longrightarrow> (c,c')\\<in>Id\n     \\<Longrightarrow> cmpo_v_idx2' a b c \\<le> \\<Down> bool_rel (timerefine TR_cmp_swap (mop_cmpo_v_idx (cost ''cmpo_v_idx'' 1) a' b' c'))\"\n  apply(rule cmpo_v_idx2'_refines_mop_cmpo_v_idx_with_E)\n  by (auto simp: timerefineA_update_apply_same_cost')\n  \n\nlemma sift_down5_refine_flexible: \n  assumes \"(l,l')\\<in>Id\" \"(h,h')\\<in>Id\" \"(i\\<^sub>0,i\\<^sub>0')\\<in>Id\" \"(xs,xs')\\<in>Id\"\n  shows \" sift_down5 l h i\\<^sub>0 xs \\<le> \\<Down>Id (timerefine TR_cmp_swap (sift_down4 (\\<^bold><) l' h' i\\<^sub>0' xs'))\"\n  using assms\n  supply conc_Id[simp del] mop_cmpo_v_idx_def[simp del]\n  unfolding sift_down5_def sift_down4_def\n  supply [refine] =\n    mop_to_eo_conv_refine\n    mop_geth3_refine\n    mop_seth3_refine\n    mop_has_rchild3_refine\n    mop_has_lchild3_refine\n    mop_lchild3_refine\n    mop_rchild3_refine\n    mop_to_wo_conv_refines\n    cmpo_idxs2'_refines_mop_cmpo_idxs_with_E'\n    cmpo_v_idx2'_refines_mop_cmpo_v_idx_with_E'\n  apply(refine_rcg MIf_refine SPECc2_refine' bindT_refine_conc_time_my_inres monadic_WHILEIT_refine' )\n  apply refine_dref_type\n  apply(all \\<open>(intro  preserves_curr_other_updI wfR''_upd wfR''_TId preserves_curr_TId)?\\<close>)\n  apply (simp_all (no_asm))\n  apply auto\n  done\n\n\nsubsubsection \\<open>heapify_btu3\\<close>\n\n  definition \"heapify_btu3 l h xs\\<^sub>0 \\<equiv> doN {\n    ASSERT(h>0);\n    h' \\<leftarrow> SPECc2 ''sub'' (-) h 1;\n    (xs,l') \\<leftarrow> monadic_WHILEIT (\\<lambda>_. True) \n      (\\<lambda>(xs,l'). SPECc2 ''icmp_slt'' (<) l l') \n      (\\<lambda>(xs,l'). doN {\n        ASSERT (l'>0);\n        l'' \\<leftarrow> SPECc2 ''sub'' (-) l' 1;\n        xs \\<leftarrow> sift_down5 l h l'' xs;\n        RETURN (xs,l'')\n      })\n      (xs\\<^sub>0,h');\n    RETURN xs\n  }\"   \n\n\nlemma heapify_btu3_refine: \"(l,l')\\<in>Id \\<Longrightarrow> (h,h')\\<in>Id \\<Longrightarrow> (xs\\<^sub>0,xs\\<^sub>0')\\<in>Id \\<Longrightarrow> heapify_btu3 l h xs\\<^sub>0 \\<le> \\<Down> Id (timerefine TR_cmp_swap (heapify_btu2 (\\<^bold><) l' h' xs\\<^sub>0'))\"\n  supply conc_Id[simp del] \n  unfolding heapify_btu3_def heapify_btu2_def\n  supply SPECc2_refine'[refine]\n  supply sift_down5_refine_flexible[refine]\n  apply(refine_rcg bindT_refine_easy monadic_WHILEIT_refine')\n  apply refine_dref_type \n  apply(all \\<open>(intro preserves_curr_other_updI wfR''_upd wfR''_TId preserves_curr_TId)?\\<close>)\n  by auto\n\n\nsubsubsection \\<open>heapsort3\\<close>\n\n  definition heapsort3 :: \"'a list \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> ('a list,_) nrest\" where \"heapsort3 xs\\<^sub>0 l h\\<^sub>0 \\<equiv> doN {\n    ASSERT (l\\<le>h\\<^sub>0);\n    hl \\<leftarrow> SPECc2 ''sub'' (-) h\\<^sub>0 l;\n    b \\<leftarrow> SPECc2 ''icmp_slt'' (<) 1 hl;\n    MIf b (doN {\n      xs \\<leftarrow> heapify_btu3 l h\\<^sub>0 xs\\<^sub>0;\n      \n      (xs,h)\\<leftarrow> monadic_WHILEIT (\\<lambda>(xs,h).  True )\n        (\\<lambda>(xs,h). doN { l' \\<leftarrow> SPECc2 ''add'' (+) l 1;\n                        SPECc2 ''icmp_slt'' (<) l' h }) \n        (\\<lambda>(xs,h). doN {\n          ASSERT (h>0 \\<and> l\\<noteq>h-1);\n          h' \\<leftarrow> SPECc2 ''sub'' (-) h 1;\n          xs \\<leftarrow> myswap xs l h';\n          xs \\<leftarrow> sift_down5 l h' l xs;\n          RETURN (xs,h')\n        })\n        (xs,h\\<^sub>0);\n      \n      RETURN xs\n    } ) (\n      RETURN xs\\<^sub>0 )\n  }\"\n\n\n\nlemma heapsort3_refine:\n  fixes xs\\<^sub>0 :: \"'a list\" \n  shows \"(xs\\<^sub>0,xs\\<^sub>0')\\<in>Id \\<Longrightarrow> (l,l')\\<in>Id \\<Longrightarrow> (h\\<^sub>0,h\\<^sub>0')\\<in>Id \\<Longrightarrow> heapsort3  xs\\<^sub>0 l h\\<^sub>0 \\<le> \\<Down>Id (timerefine TR_cmp_swap (heapsort2 xs\\<^sub>0' l' h\\<^sub>0'))\" \n  unfolding heapsort3_def heapsort2_def\n  supply conc_Id[simp del] \n  supply SPECc2_refine'[refine]\n  supply heapify_btu3_refine[refine]\n  supply sift_down5_refine_flexible[refine]\n  supply myswap_TR_cmp_swap_refine[refine]\n  apply(refine_rcg bindT_refine_conc_time_my_inres MIf_refine monadic_WHILEIT_refine')\n  apply refine_dref_type \n  apply(all \\<open>(intro preserves_curr_other_updI wfR''_upd wfR''_TId preserves_curr_TId)?\\<close>)\n  by (auto simp: SPECc2_def)\n\n\nsubsubsection \\<open>synthesize with Sepref\\<close>\n\nsepref_register \"sift_down5\"\nsepref_def sift_down_impl [llvm_inline] is \"uncurry3 (PR_CONST sift_down5)\" :: \"size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a (array_assn elem_assn)\\<^sup>d \\<rightarrow>\\<^sub>a (array_assn elem_assn)\"\n  unfolding sift_down5_def PR_CONST_def\n  supply [[goals_limit = 1]]\n  apply sepref_dbg_preproc\n     apply sepref_dbg_cons_init\n    apply sepref_dbg_id  \n  apply sepref_dbg_monadify\n  apply sepref_dbg_opt_init\n      apply sepref_dbg_trans (* Takes loooong! *)\n\n  apply sepref_dbg_opt\n  apply sepref_dbg_cons_solve\n  apply sepref_dbg_cons_solve\n  apply sepref_dbg_constraints \n  done\n\n\n  \n\nsepref_register \"heapify_btu3\"\nsepref_def heapify_btu_impl [llvm_inline] is \"uncurry2 (PR_CONST (heapify_btu3))\" :: \"size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a (array_assn elem_assn)\\<^sup>d \\<rightarrow>\\<^sub>a (array_assn elem_assn)\"\n  unfolding heapify_btu3_def PR_CONST_def\n  apply (annot_snat_const \"TYPE ('size_t)\")\n  supply [[goals_limit = 1]]\n  apply sepref\n  done\n  \nsepref_register \"heapsort3\"\nsepref_def heapsort_impl is \"uncurry2 (PR_CONST (heapsort3))\" :: \"(array_assn elem_assn)\\<^sup>d *\\<^sub>a size_assn\\<^sup>k *\\<^sub>a size_assn\\<^sup>k \\<rightarrow>\\<^sub>a (array_assn elem_assn)\"\n  unfolding heapsort3_def unfolding myswap_def PR_CONST_def\n  apply (rewrite at \"sift_down5 _ _ \\<hole> _\" fold_COPY)\n  apply (annot_snat_const \"TYPE ('size_t)\")\n  by sepref\n\nlemmas heapsort_hnr[sepref_fr_rules] = heapsort_impl.refine[unfolded heapsort1.refine[OF weak_ordering_axioms,symmetric]]  \n\n\nsubsection \\<open>Final Correctness Lemma\\<close>\n\nschematic_goal heapsort3_correct:\n  \"heapsort3 xs l h \\<le> \\<Down> Id (timerefine ?E (slice_sort_spec (\\<^bold><) xs l h))\"\n  unfolding slice_sort_spec_def\n  apply(cases \"l \\<le> h \\<and> h \\<le> length xs\")\n   prefer 2 \n  subgoal by auto\n  apply simp\n\n  apply(rule order.trans)\n   apply(rule heapsort3_refine[of xs xs l l h h])\n     apply simp_all\n\n  apply(rule order.trans)\n   apply(rule timerefine_mono2) apply simp\n   apply(rule heapsort_correct'[of xs xs l l h h])\n    apply simp\n    apply simp\n   apply simp\n\n  unfolding slice_sort_spec_def apply simp\n  apply (subst timerefine_iter2)  \n    apply simp\n   apply simp\n  apply(rule order.refl)\n  done\n\n  \nconcrete_definition heapsort3_TR is heapsort3_correct uses \"_ \\<le> \\<Down> Id (timerefine \\<hole> _) \"\n                                              \n  \n\n\nlemmas heapsort_correct_hnr = hn_refine_result[OF heapsort_impl.refine[to_hnr],\n                                              unfolded PR_CONST_def APP_def,\n                                              OF heapsort3_TR.refine ]\n\nlemma pull_heapsort3_TR_into_spec: \"(timerefine (heapsort3_TR l h) (slice_sort_spec (\\<^bold><) xs l h))\n    = slice_sort_specT (heapsort3_TR l h ''slice_sort'') (\\<^bold><) xs l h\"\n  unfolding slice_sort_spec_def slice_sort_specT_def\n  apply(cases \"l \\<le> h \\<and> h \\<le> length xs\")\n   apply(auto simp: SPEC_timerefine_conv)\n  apply(rule SPEC_cong) apply simp\n  by (auto simp: timerefineA_cost)\n\nlemma heapsort_impl_correct:\n \"hn_refine (hn_ctxt arr_assn a ai \\<and>* hn_val snat_rel ba bia \\<and>* hn_val snat_rel b bi)\n       (heapsort_impl ai bia bi)\n (hn_invalid arr_assn a ai \\<and>* hn_val snat_rel ba bia \\<and>* hn_val snat_rel b bi) (hr_comp arr_assn Id)\n  (timerefine (heapsort3_TR ba b) (slice_sort_spec (\\<^bold><) a ba b))\"\n  apply(rule heapsort_correct_hnr)\n  apply(rule attains_sup_sv) by simp\n\ntext \\<open>extract Hoare Triple\\<close>\n\nlemmas heapsort_ht = heapsort_impl_correct[unfolded slice_sort_spec_def SPEC_REST_emb'_conv,\n                                          THEN ht_from_hnr]\n\n\nlemma ub_heapsort3_yx: \"y - Suc x = (y - x) - 1\"\n  by auto\n\nschematic_goal ub_heapsort3: \"timerefineA (heapsort3_TR l h) (cost ''slice_sort'' 1) \\<le> ?x\"\n  unfolding heapsort3_TR_def heapsort_TR_def singleton_heap_context.sift_down3_cost_def\n      Rsd_a_def heapsort_time_def  heapsort_lbc_def\n  unfolding singleton_heap_context.E_sd3_l_def\n  unfolding myswap_cost_def cmpo_idxs2'_cost_def cmpo_v_idx2'_cost_def cmp_idxs2'_cost_def\n  apply(simp add: norm_pp norm_cost )\n  apply(subst timerefineA_propagate, (auto intro!: wfR''_upd)[1])+ \n  apply(simp add: norm_pp norm_cost )\n  apply(subst timerefineA_propagate, intro wfR''_upd wfR''_TId)\n  apply(simp only: norm_pp norm_cost )\n  apply(simp add: add.commute add.left_commute)\n  apply(simp add: cost_same_curr_left_add cost_same_curr_add) \n  apply(subst timerefineA_propagate, intro wfR''_upd wfR''_TId, (simp add: norm_cost)?)+\n  apply(simp add: add.commute add.left_commute)\n  apply(simp add: cost_same_curr_left_add cost_same_curr_add) \n  apply(simp add: add.commute add.left_commute)\n  apply(simp add: cost_same_curr_left_add cost_same_curr_add) \n  apply(simp add: add.assoc add.commute add.left_commute)\n\n  apply sc_solve_upperbound\n  by simp\n\ntext \\<open>and give it a name\\<close>\nconcrete_definition heapsort3_acost' is ub_heapsort3 uses \"_ \\<le> \\<hole>\"\n\nlemma enat_mono: \"x\\<le>y \\<Longrightarrow> enat x \\<le> enat y\"\n  by simp\n\nlemma aprox_aux: \"h - Suc l \\<le> h - l\"\n  by auto\n\ntext \\<open>estimate \"h-(l+1)\" with \"h-l\"\\<close>\nschematic_goal aprox: \"heapsort3_acost' l h \\<le> ?x\"\n  unfolding heapsort3_acost'_def\n  unfolding numeral_eq_enat times_enat_simps plus_enat_simps one_enat_def\n  apply(rule cost_mono add_mono enat_mono  mult_le_mono log_mono[THEN monoD]   \n       aprox_aux  order.refl[of \"h - l\"] order.refl[of \"numeral x\" for x]  order.refl[of \"1\"]   )+\n  done\n\n\nthm order.trans[OF heapsort3_acost'.refine aprox]\n\n\nconcrete_definition heapsort_impl_cost is order.trans[OF heapsort3_acost'.refine aprox]  uses \"_ \\<le> \\<hole>\"\n\ntext \\<open>we pull the lifting to the outer most:\\<close>\nschematic_goal lift_heapsort3_acost: \"heapsort_impl_cost x y = lift_acost ?y\"\n  unfolding heapsort_impl_cost_def\n  apply(simp add: numeral_eq_enat one_enat_def)\n  unfolding lift_acost_cost[symmetric]  lift_acost_propagate[symmetric]\n  unfolding ub_heapsort3_yx[where x=x and y=y]\n  apply(rule refl)\n  done\n\ntext \\<open>We define the finite part of the cost expression:\\<close>\nconcrete_definition heapsort3_cost is lift_heapsort3_acost uses \"_ = lift_acost \\<hole>\"\n\nabbreviation \"slice_sort_aux xs\\<^sub>0 xs l h \\<equiv> (length xs = length xs\\<^sub>0 \\<and> take l xs = take l xs\\<^sub>0\n                    \\<and> drop h xs = drop h xs\\<^sub>0 \\<and> sort_spec (\\<^bold><) (slice l h xs\\<^sub>0) (slice l h xs))\"\n\nlemma heapsort_final_hoare_triple:\n  assumes \"l \\<le> h \\<and> h \\<le> length xs\\<^sub>0\"\n  shows \"llvm_htriple ($heapsort_impl_cost l h \\<and>* hn_ctxt arr_assn xs\\<^sub>0 p\n           \\<and>* hn_val snat_rel l l' \\<and>* hn_val snat_rel h h')\n        (heapsort_impl p l' h')\n      (\\<lambda>r. (\\<lambda>s. \\<exists>xs. (\\<up>(slice_sort_aux xs\\<^sub>0 xs l h) \\<and>* arr_assn xs r) s)\n           \\<and>* hn_invalid arr_assn xs\\<^sub>0 p \\<and>* hn_val snat_rel l l' \\<and>* hn_val snat_rel h h')\"\n  using assms    \n  by(rule  llvm_htriple_more_time[OF heapsort_impl_cost.refine heapsort_ht,\n                unfolded  hr_comp_Id2  ])\n\n\n\ndefinition (in -) \"project_all T =  (Sum_any (the_enat o the_acost T))\"\n\nlemma (in -) project_all_is_Sumany_if_lifted:\n  \"f = lift_acost g \\<Longrightarrow> project_all f = (Sum_any (the_acost g))\"\n  unfolding project_all_def lift_acost_def\n  by simp\n\n\ndefinition (in -) \"norm_cost_tag a b = (a=b)\"\n\nlemma (in -) norm_cost_tagI: \"norm_cost_tag a a\"\n  unfolding norm_cost_tag_def\n  by simp\n\n\ntext \\<open>Calculate the cost for all currencies:\\<close>\nschematic_goal heapsort3_cost_Sum_any_calc: \"project_all (heapsort_impl_cost l h) = ?x\"\n  unfolding norm_cost_tag_def[symmetric]\n  apply(subst project_all_is_Sumany_if_lifted[OF heapsort3_cost.refine])\n  unfolding heapsort3_cost_def\n  apply(simp add: the_acost_propagate add.assoc) \n  apply(subst Sum_any.distrib;  ( auto simp only: Sum_any_cost \n          intro!: finite_sum_nonzero_cost finite_sum_nonzero_if_summands_finite_nonzero))+\n  apply(rule norm_cost_tagI)\n  done\n\ntext \\<open>Give the result a name:\\<close>\nconcrete_definition (in -) heapsort3_allcost' is sort_impl_context.heapsort3_cost_Sum_any_calc\n    uses \"_ = \\<hole>\"\n\nlemma heapsort3_allcost'_Sum_any: \n  \"heapsort3_allcost' l h = project_all (heapsort_impl_cost l h)\"  \n  apply(subst heapsort3_allcost'.refine[OF sort_impl_context_axioms, symmetric])\n  by simp\n\nend  \n\n\nlemma heapsort3_allcost'_simplified:\n  \"heapsort3_allcost' l h = 12 + 187 * (h - l)  + 82 * (h - l) * Discrete.log (h - l)\"\n  unfolding heapsort3_allcost'_def\n  apply (simp add: algebra_simps del: algebra_simps(19,20) )\n  done\n\ndefinition \"heapsort3_allcost n = 12 + 187 * n  + 82 * (n * Discrete.log n)\"\n\n\nlemma heapsort3_allcost_simplified:\n  \"heapsort3_allcost n = 12 + 187 * n  + 82 * n * Discrete.log n\"\n  unfolding heapsort3_allcost_def\n  by simp\n\nlemma heapsort3_allcost_is_heapsort3_allcost': \n  \"heapsort3_allcost (h-l) = heapsort3_allcost' l h\"\n  unfolding heapsort3_allcost_def heapsort3_allcost'_simplified by auto\n\n\nlemma heapsort3_allcost_nlogn:\n  \"(\\<lambda>x. real (heapsort3_allcost x)) \\<in> \\<Theta>(\\<lambda>n. (real n)*(ln (real n)))\"\n  unfolding heapsort3_allcost_def\n  by auto2\n\n\n\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm_time", "sha": "42dd7f59998d76047bb4b6bce76d8f67b53a08b6", "save_path": "github-repos/isabelle/lammich-isabelle_llvm_time", "path": "github-repos/isabelle/lammich-isabelle_llvm_time/isabelle_llvm_time-42dd7f59998d76047bb4b6bce76d8f67b53a08b6/thys/examples/sorting/Sorting_Heapsort.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5195213219520929, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.303972525107358}}
{"text": "section \\<open>Nested List Assertion\\<close>\ntheory LLVM_DS_List_Assn\nimports \"../vcg/LLVM_VCG_Main\"\nbegin\n  (* TODO: Improve handling of pure assertions. \n    Dirty hacks like for pure list-assn shouldn't be necessary!\n  *)\n\n  (* TODO: Move *)  \n  lemma gen_drule:\n    assumes \"P\\<turnstile>Q\"\n    assumes \"FRAME A P F\"\n    assumes \"Q**F\\<turnstile>B\"\n    shows \"A\\<turnstile>B\"\n    using assms unfolding FRAME_def\n    using sep_rule(1) sep_rule(2) by blast\n  \n\n\n  (* TODO: Move *)\n  lemma pure_part_set_imgD[vcg_prep_ext_rules]:\n    shows \"pure_part (sep_set_img S P) \\<longrightarrow> (\\<forall>x\\<in>S. pure_part (P x))\"\n  proof (cases \"finite S\")\n    case True thus ?thesis\n      by (induction S) (auto dest: pure_part_split_conj)\n  next\n    case False then show ?thesis by simp\n  qed    \n\n\n  \n  \n  \n  \n  subsection \\<open>Tags\\<close>  \n  text \\<open>Ghost instructions to guide the VCG and Frame Inference\\<close>\n  lemma entails_is_noop_htriple: \"(A \\<turnstile> B) \\<Longrightarrow> llvm_htriple A (return x) (\\<lambda>_. B)\"\n    apply (auto simp: htriple_def wp_return)\n    by (metis entails_def sep_conj_impl1)\n\n  lemma tag_op_ruleI: \n    assumes \"tag_op = return x\"  \n    assumes \"A\\<turnstile>B\"\n    shows \"llvm_htriple A tag_op (\\<lambda>_. B)\"\n    using entails_is_noop_htriple assms by metis\n\n  text \\<open>Assertion to be matched with anything. \n    To obtain abstract from concrete variable.\\<close>  \n  definition \"tag_assn \\<equiv> mk_pure_assn (\\<lambda>_ _. True)\"\n  lemma tag_assn_pure[is_pure_rule]: \"is_pure (tag_assn)\" unfolding tag_assn_def by auto\n  \n  lemma tag_assnI[fri_rules]: \"PRECOND (SOLVE_ASM (\\<flat>\\<^sub>pA a c)) \\<Longrightarrow> \\<box> \\<turnstile> \\<upharpoonleft>\\<^sub>ptag_assn a c\"\n    by (auto simp: tag_assn_def sep_algebra_simps)\n    \n  (* TODO: Move *)  \n  lemma split_pure_assn: \"is_pure A \\<Longrightarrow> \\<upharpoonleft>A a c \\<turnstile> \\<upharpoonleft>A a c ** \\<upharpoonleft>A a c\"\n    by (smt entails_eq_iff entails_pureI extract_pure_assn pure_part_pureD pure_true_conv sep.add.right_neutral)  \n    \n  definition tag_split_pure :: \"'b::llvm_rep \\<Rightarrow> unit llM\" \n    where \"tag_split_pure x = return ()\"  \n\n  lemma tag_split_pure_rl[vcg_rules]:\n    shows \"llvm_htriple \n      (\\<up>(is_pure A) ** \\<upharpoonleft>A a c)\n      (tag_split_pure c)\n      (\\<lambda>_. \\<upharpoonleft>A a c ** \\<upharpoonleft>A a c)\"\n    supply [vcg_rules] = tag_op_ruleI[OF tag_split_pure_def[where x=c] split_pure_assn[of A a c]]\n    by vcg  \n    \n    \n  lemma bury_pure_assn: \"is_pure A \\<Longrightarrow> \\<upharpoonleft>A a c \\<turnstile> \\<box>\"\n    by (smt entails_eq_iff entails_pureI extract_pure_assn pure_part_pureD pure_true_conv)\n\n  lemma bury_pure_assn': \"\\<upharpoonleft>\\<^sub>pA a c \\<turnstile> \\<box>\"\n    by (simp add: dr_assn_pure_prefix_def entails_lift_extract_simps(1))\n    \n        \n  definition tag_bury_pure :: \"'b::llvm_rep \\<Rightarrow> unit llM\" \n    where \"tag_bury_pure x = return ()\"  \n\n  lemma tag_bury_pure_rl[vcg_rules]:\n    shows \"llvm_htriple \n      (\\<up>(is_pure A) ** \\<upharpoonleft>A a c)\n      (tag_bury_pure c)\n      (\\<lambda>_. \\<box>)\"\n    supply [vcg_rules] = tag_op_ruleI[OF tag_bury_pure_def[where x=c] bury_pure_assn[of A a c]]\n    by vcg  \n    \n    \n      \n  \n  \n  subsection \\<open>Map of Valid Indexes in List\\<close>\n  (* TODO: DUP in Array_of_Array_List. *)\n  definition \"idxe_map l i \\<equiv> if i<length l then Some (l!i) else None\"\n\n  lemma idxe_map_empty[simp]: \"idxe_map [] = Map.empty\" unfolding idxe_map_def by auto\n  \n  lemma idxe_map_dom[simp]: \"dom (idxe_map l) = {0..<length l}\" unfolding idxe_map_def by (auto split: if_splits)\n  \n  lemma le_idxe_map_updI: \"i<length l \\<Longrightarrow> m \\<subseteq>\\<^sub>m idxe_map l \\<Longrightarrow> m(i\\<mapsto>l!i) \\<subseteq>\\<^sub>m idxe_map l\"\n    unfolding idxe_map_def map_le_def by (auto split: if_splits)\n    \n  lemma le_idxe_map_delD: \"m \\<subseteq>\\<^sub>m idxe_map l \\<Longrightarrow> m(i:=None) \\<subseteq>\\<^sub>m idxe_map (l[i:=x])\"\n    unfolding idxe_map_def map_le_def by (auto split: if_splits)\n    \n  lemma le_idxe_map_delD': \"m \\<subseteq>\\<^sub>m idxe_map l \\<Longrightarrow> m(i:=None) \\<subseteq>\\<^sub>m idxe_map l\"\n    unfolding idxe_map_def map_le_def by (auto split: if_splits)\n    \n  lemma le_idxe_mapD: \"m \\<subseteq>\\<^sub>m idxe_map l \\<Longrightarrow> m i = Some xi \\<Longrightarrow> l!i = xi\"  \n    unfolding idxe_map_def map_le_def \n    apply (clarsimp split: if_splits) \n    by (metis domI domIff option.inject)\n\n  lemma le_idxe_map_lenD: \"m \\<subseteq>\\<^sub>m idxe_map l \\<Longrightarrow> m i = Some xi \\<Longrightarrow> i < length l\"  \n    unfolding idxe_map_def map_le_def \n    apply (clarsimp split: if_splits) \n    by (metis domI domIff)\n\n  lemma le_idxe_map_append1I: \"A\\<subseteq>\\<^sub>midxe_map (xs@[y]) \\<Longrightarrow> A(length xs := None)\\<subseteq>\\<^sub>midxe_map (xs)\"  \n    by (auto simp: map_le_def idxe_map_def split: if_splits)\n\n  lemma le_idxe_map_append2I: \"A\\<subseteq>\\<^sub>midxe_map xs \\<Longrightarrow> A\\<subseteq>\\<^sub>midxe_map (xs@ys)\"  \n    by (auto simp: map_le_def idxe_map_def split: if_splits)\n    \n  subsection \\<open>Nested List Assertion\\<close>\n\n  definition \"list_assn A R \\<equiv> mk_assn (\\<lambda>xs ys. \n     \\<up>(length xs=length ys) \n  ** \\<up>(R \\<subseteq>\\<^sub>m idxe_map ys)\n  ** (\\<Union>*i\\<in>{0..<length ys} - dom R. \\<upharpoonleft>A (xs!i) (ys!i)))\"\n\n    \n  lemma list_assn_pure_partD[vcg_prep_ext_rules]:\n    \"pure_part (\\<upharpoonleft>(list_assn A R) xs ys) \n      \\<Longrightarrow> length xs = length ys \\<and> R \\<subseteq>\\<^sub>m idxe_map ys \\<and> (\\<forall>x\\<in>{0..<length ys} - dom R. pure_part (\\<upharpoonleft>A (xs ! x) (ys ! x)))\"\n    unfolding list_assn_def\n    apply vcg_prepare_external by blast\n    \n\n  subsection \\<open>Transformations\\<close>  \n  \n  subsubsection \\<open>Initialization and Destruction\\<close>\n    text \\<open>Initialization if there is a pure initial element\\<close>    \n  lemma list_assn_init_pure: \n    assumes \"\\<box> \\<turnstile> \\<upharpoonleft>A x xi\"\n    shows \"\\<box> \\<turnstile> \\<upharpoonleft>(list_assn A Map.empty) (replicate n x) (replicate n xi)\"\n  proof -\n    have \"\\<box> \\<turnstile> (\\<Union>*xa\\<in>{0..<n}. \\<upharpoonleft>A x xi)\" \n      apply (induction n)\n      subgoal by simp\n      subgoal for n\n        apply (simp add: atLeast0_lessThan_Suc)\n        using conj_entails_mono[OF assms] by simp\n      done    \n    \n    thus ?thesis\n      unfolding list_assn_def \n      by (simp add: sep_algebra_simps)\n  qed\n    \n  text \\<open>Arbitrary initialization, no elements owned. Can be used to justify init-algorithm\\<close>\n  lemma list_assn_init_none:\n    assumes \"length xs = length ys\"\n    shows \"\\<box> \\<turnstile> \\<upharpoonleft>(list_assn A (idxe_map ys)) xs ys\"\n    using assms unfolding list_assn_def \n    by (simp add: sep_algebra_simps)\n  \n  lemma list_assn_empty: \"\\<box> \\<turnstile> \\<upharpoonleft>(list_assn A Map.empty) [] []\"  \n    unfolding list_assn_def\n    by (auto simp: sep_algebra_simps)\n    \n  text \\<open>Destruction if all elements have been extracted\\<close>\n  lemma list_assn_free_none:\n    assumes \"dom R \\<supseteq> {0..<length ys}\"\n    shows \"\\<upharpoonleft>(list_assn A R) xs ys \\<turnstile> \\<box>\"\n    using assms unfolding list_assn_def \n    by (auto simp: sep_algebra_simps entails_lift_extract_simps dest: map_le_implies_dom_le)\n\n  subsubsection \\<open>Extracting and Joining Elements\\<close>  \n  \n  lemma list_assn_extract_aux: \n    assumes \"i<length xs\" \"i\\<notin>R\"  \n    shows \"sep_set_img ({0..<length xs} - R) P \n        = (P i ** sep_set_img ({0..<length xs} - insert i R) P)\"\n  proof -\n    from assms have 1: \"{0..<length xs} - R = insert i ({0..<length xs} - insert i R)\" by auto\n    show ?thesis\n      by (subst 1) auto\n  qed    \n  \n  \n  lemma list_assn_extract:\n    assumes \"i<length xs\" \"R i = None\"\n    shows \"\\<upharpoonleft>(list_assn A R) xs ys \\<turnstile> \\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys ** \\<upharpoonleft>A (xs!i) (ys!i)\"\n    using assms unfolding list_assn_def\n    supply [simp] = le_idxe_map_updI list_assn_extract_aux ndomIff\n    supply fri_red_img[fri_red_rules]\n    apply (clarsimp simp: sep_algebra_simps entails_lift_extract_simps)\n    apply (rule ENTAILSD)\n    apply vcg\n    done\n    \n  lemma list_assn_upd_aux: \n    fixes I xs xsi\n    defines \"I \\<equiv> {0..<length xsi}\"\n    assumes \"i\\<in>I\" \"i\\<in>R\" and [simp]: \"length xsi = length xs\"\n    shows \"(\\<Union>*j\\<in>I - (R - {i}). \\<upharpoonleft>A (xs[i := x] ! j) (xsi[i := xi] ! j)) = (\\<upharpoonleft>A x xi ** (\\<Union>*j\\<in>I - R. \\<upharpoonleft>A (xs ! j) (xsi ! j)))\"\n  proof -\n    from assms have 1: \"I - (R - {i}) = insert i (I-R)\" by auto\n    from assms have [simplified,simp]: \"i\\<notin>I-R\" by auto\n    have [simp]: \"i<length xs\" using \\<open>i\\<in>I\\<close> unfolding I_def by auto\n    have [simp]: \"j\\<in>I-R \\<Longrightarrow> i\\<noteq>j\" for j using \\<open>i\\<in>R\\<close> by auto\n    show ?thesis apply (subst 1) by simp\n  qed  \n    \n  lemma list_assn_update:\n    assumes \"R i \\<noteq> None\"\n    shows \"\\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y \\<turnstile> \\<upharpoonleft>(list_assn A (R(i:=None))) (xs[i:=x]) (ys[i:=y])\"\n    using assms unfolding list_assn_def\n    apply -\n    apply (rule entails_pureI)\n    \n    supply [simp] = le_idxe_map_updI le_idxe_map_delD\n    supply fri_red_img[fri_red_rules]\n    apply (clarsimp simp: sep_algebra_simps entails_lift_extract_simps)\n    apply (subst list_assn_upd_aux)\n    subgoal by (metis domI idxe_map_dom map_leD)\n    apply auto [2]\n    apply (rule ENTAILSD)\n    apply vcg\n    done\n    \n  lemma list_assn_join:\n    assumes \"R i = Some y\"\n    assumes \"x = xs!i\"\n    shows \"\\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y \\<turnstile> \\<upharpoonleft>(list_assn A (R(i:=None))) xs ys\"\n    apply (rule entails_pureI)\n    apply (subst (asm) list_assn_def)\n    apply (clarsimp simp: sep_algebra_simps dest!: pure_part_split_conj)\n    apply (rule entails_trans[OF list_assn_update[where i=i]])\n    using assms by (auto dest: le_idxe_mapD)\n    \n  lemma list_assn_join':\n    assumes \"R i = None\"\n    assumes \"x = xs!i\" \"y=ys!i\"\n    shows \"\\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys ** \\<upharpoonleft>A x y \\<turnstile> \\<upharpoonleft>(list_assn A R) xs ys\"\n    apply (sep_drule_simple list_assn_join[where i=i])\n    using assms by (auto simp: fun_upd_idem)\n\n  subsubsection \\<open>Push and Pop\\<close>    \n  lemma list_assn_push_back:\n    shows \"(\\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y) \\<turnstile> (\\<upharpoonleft>(list_assn A R) (xs@[x]) (ys@[y]))\"\n    unfolding list_assn_def\n    apply (clarsimp simp: sep_algebra_simps atLeast0_lessThan_Suc entails_lift_extract_simps \n      insert_Diff_if le_idxe_map_append2I; safe)\n    apply (auto dest: le_idxe_map_lenD; fail)\n    apply (rule ENTAILSD)\n    supply [simp] = nth_append\n    by vcg\n\n    \n    \n  lemma list_assn_pop_back1:\n    assumes \"R (length xs - 1) \\<noteq> None\"\n    shows \"\\<upharpoonleft>(list_assn A R) xs ys \\<turnstile> \\<upharpoonleft>(list_assn A (R(length xs-1 := None))) (butlast xs) (butlast ys)\"  \n    using assms unfolding list_assn_def\n    apply (rule_tac entails_pureI)\n    apply (cases xs rule: rev_cases; cases ys rule: rev_cases)\n    apply (clarsimp_all \n      dest!: pure_part_split_conj \n      simp: sep_algebra_simps atLeast0_lessThan_Suc domI set_minus_minus_disj_conv)\n    apply (rule ENTAILSD)\n    supply [simp] = le_idxe_map_append1I\n    by vcg\n    \n    \n  lemma list_assn_pop_back2:\n    assumes \"xs\\<noteq>[]\" \"R (length xs - 1) = None\"\n    shows \"(\\<upharpoonleft>(list_assn A R) xs ys) \\<turnstile> (\\<upharpoonleft>(list_assn A R) (butlast xs) (butlast ys) ** \\<upharpoonleft>A (last xs) (last ys))\"  \n    apply (rule entails_pureI) using assms\n    apply vcg_prepare_external\n    apply (sep_drule_simple list_assn_extract[where i=\"length xs - 1\"])\n    subgoal by (cases ys; simp)\n    subgoal by simp\n    apply (sep_drule_simple list_assn_pop_back1)\n    subgoal by auto\n    by (cases ys rule: rev_cases; simp add: last_conv_nth fun_upd_idem)\n    \n    \n  subsection \\<open>Fri-Reduce Rules for List-Assertion\\<close>  \n  lemma la_red_extract:\n    \"PRECOND (SOLVE_AUTO (R i = None \\<and> i<length xs)) \n      \\<Longrightarrow> is_sep_red (\\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys) \\<box> (\\<upharpoonleft>(list_assn A R) xs ys) (\\<upharpoonleft>A (xs!i) (ys!i))\"\n    apply (clarsimp simp: vcg_tag_defs)\n    apply (rule is_sep_redI)\n    apply (sep_drule_simple list_assn_extract, assumption+)\n    apply (erule gen_drule, fri)\n    apply (rule ENTAILSD, fri)\n    done\n  \n  lemma la_red_join:\n    \"PRECOND (SOLVE_AUTO (R i = None \\<and> i<length xs \\<and> x=xs!i \\<and> y=ys!i)) \n      \\<Longrightarrow> is_sep_red \\<box> (\\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys) (\\<upharpoonleft>A x y) (\\<upharpoonleft>(list_assn A R) xs ys)\"\n    apply (clarsimp simp: vcg_tag_defs)\n    apply (rule is_sep_redI)\n    apply (sep_rule list_assn_join')\n    apply assumption+\n    apply (erule gen_drule, fri)\n    apply (rule ENTAILSD, fri)\n    done\n    \n\n  subsection \\<open>Tags for List-Assertion\\<close>\n  \n  definition tag_la_upd :: \"'b::llvm_rep \\<Rightarrow> 'a word \\<Rightarrow> 'd::llvm_rep \\<Rightarrow> unit llM\" \n    where \"tag_la_upd p i y = return ()\"  \n\n  lemma tag_la_upd_rl[vcg_rules]:\n    shows \"llvm_htriple \n      (\\<upharpoonleft>tag_assn i ii ** \\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y ** \\<up>(R i \\<noteq> None))\n      (tag_la_upd p ii y)\n      (\\<lambda>_. \\<upharpoonleft>(list_assn A (R(i:=None))) (xs[i:=x]) (ys[i:=y]) ** \\<upharpoonleft>AA ys p)\"\n    supply [vcg_rules] = tag_op_ruleI[OF tag_la_upd_def[where i=ii] list_assn_update[where i=i]]\n    by vcg  \n    \n\n  definition tag_la_join :: \"'b::llvm_rep \\<Rightarrow> 'a word \\<Rightarrow> 'd::llvm_rep \\<Rightarrow> unit llM\" \n    where \"tag_la_join p i y = return ()\"\n    \n  lemma tag_la_join_rl[vcg_rules]:\n    shows \"llvm_htriple \n      (\\<upharpoonleft>tag_assn i ii ** \\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y ** \\<up>(R i = Some y \\<and> x=xs!i))\n      (tag_la_join p ii y)\n      (\\<lambda>_. \\<upharpoonleft>(list_assn A (R(i:=None))) xs ys ** \\<upharpoonleft>AA ys p)\"\n    supply [vcg_rules] = tag_op_ruleI[OF tag_la_join_def[where i=ii] list_assn_join[where i=i]]\n    by vcg  \n    \n  definition \"tag_la_extract p i = return ()\"  \n\n      \n  (*\n    TODO: We have to use tag-assn for pure (i), and variables (AA) for impure assertions: \n      Otherwise, current frame-inference's pure extraction will not unify \n      variable assertion with pure assertion! FIX THAT! \n  *)  \n    \n  lemma tag_la_extract_rl[vcg_rules]: \n    \"llvm_htriple\n      (\\<upharpoonleft>tag_assn i ii ** \\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<up>(R i = None \\<and> i<length xs))\n      (tag_la_extract p ii)\n      (\\<lambda>_. \\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys ** \\<upharpoonleft>A (xs!i) (ys!i) ** \\<upharpoonleft>AA ys p ** \\<up>(length xs = length ys))\" \n    supply [vcg_rules] = tag_op_ruleI[OF tag_la_extract_def[where i=ii] list_assn_extract[where i=i]]\n    apply vcg\n    done\n\n        \n  definition \"tag_la_push_back p x = return ()\"    \n  \n  lemma tag_la_push_back_rl[vcg_rules]:\n    \"llvm_htriple \n      (\\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<upharpoonleft>A x y)\n      (tag_la_push_back p y)\n      (\\<lambda>_. \\<upharpoonleft>(list_assn A R) (xs@[x]) (ys@[y]) ** \\<upharpoonleft>AA ys p)\"\n    supply [vcg_rules] = tag_op_ruleI[OF tag_la_push_back_def[where p=p] list_assn_push_back]\n    by vcg\n\n  definition \"tag_la_pop_back p = return ()\"\n  lemma tag_la_pop_back_rl[vcg_rules]:\n    \"llvm_htriple\n      (\\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<up>(xs\\<noteq>[] \\<and> R (length xs-1) = None))\n      (tag_la_pop_back p)\n      (\\<lambda>_. \\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) (butlast xs) (butlast ys) ** \\<upharpoonleft>A (last xs) (last ys) ** \\<up>(xs\\<noteq>[] \\<and> ys\\<noteq>[]))\"  \n    supply [vcg_rules] = tag_op_ruleI[OF tag_la_pop_back_def[where p=p] list_assn_pop_back2]\n    apply (rule htriple_pure_preI)\n    by vcg\n  \n  subsection \\<open>Pure List Assertion\\<close>  \n  (* TODO: is_pure list_assn rule *)\n  \n  definition \"tag_la_exfree_pure p i = return ()\"  \n\n  lemma bury_pure_red: \"PRECOND (SOLVE_ASM (is_pure A)) \\<Longrightarrow> is_sep_red \\<box> \\<box> (\\<upharpoonleft>A a c) \\<box>\"\n    unfolding vcg_tag_defs\n    apply (rule is_sep_redI)\n    apply (sep_drule bury_pure_assn)\n    by simp\n  \n  lemma tag_la_exfree_pure_rl[vcg_rules]: \n    \"llvm_htriple\n      (\\<upharpoonleft>tag_assn i ii ** \\<upharpoonleft>AA ys p ** \\<upharpoonleft>(list_assn A R) xs ys ** \\<up>(is_pure A \\<and> R i = None \\<and> i<length xs))\n      (tag_la_exfree_pure p ii)\n      (\\<lambda>_. \\<upharpoonleft>(list_assn A (R(i\\<mapsto>ys!i))) xs ys ** \\<upharpoonleft>AA ys p ** \\<up>(length xs = length ys))\" \n    supply R[vcg_rules] = \n      tag_op_ruleI[OF tag_la_exfree_pure_def[where i=ii] list_assn_extract[where i=i], of xs R A ys]\n    thm R\n    apply vcg\n    apply vcg_try_solve\n    subgoal (* TODO: Dirty hack! *)\n      unfolding FRAME_INFER_def FRI_END_def\n      apply (sep_drule_simple bury_pure_assn')\n      by simp\n    done\n\nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys/ds/LLVM_DS_List_Assn.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5851011397337391, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.30397251759014843}}
{"text": "theory WellTypedAlt\n  imports WTLemma\nbegin\n  \ndatatype wta_tag =\n  ConstRule\n  | OpRule\n  | VarRule\n  | PairRule wta_tag wta_tag\n  | IfRule wta_tag wta_tag wta_tag\n  | LamRule wta_tag\n  | AppRule wta_tag wta_tag\n  | WeakPostRule wta_tag\n  | StrReqRule wta_tag\n  | WeakReqRule wta_tag\n    \nfun well_typed_alt :: \"wta_tag \\<Rightarrow> pt_env \\<Rightarrow> owner_env \\<Rightarrow> perm_use_env \\<Rightarrow> p_exp \\<Rightarrow> p_type \\<Rightarrow> perm_use_env \\<Rightarrow> perm_use_env \\<Rightarrow> bool\" where\n  \"well_typed_alt ConstRule env delta r_s1 e tau r_s2 rx = (\\<exists> c. e = ConstExp c \\<and> tau \\<in> const_type c \\<and> r_s2 = r_s1 \\<and> rx = empty_use_env)\"\n| \"well_typed_alt OpRule env delta r_s1 e tau r_s2 rx = (\\<exists> xop. e = OpExp xop \\<and> tau = op_type xop \\<and> r_s2 = r_s1 \\<and> rx = empty_use_env)\"\n| \"well_typed_alt VarRule env delta r_s1 e tau r_s2 rx = (\\<exists> v tau_x. e = VarExp v \\<and> env (res_name v) = Some tau \\<and>\n    env (owner_name delta v) = Some tau_x \\<and> leq_use_env (ereq_use_env (owner_name delta v) tau_x) r_s1 \\<and> r_s2 = diff_use_env r_s1 (ereq_use_env (owner_name delta v) tau_x) \\<and>\n    rx = diff_use_env (ereq_use_env (owner_name delta v) tau_x) (ereq_use_env (owner_name delta v) tau_x))\"\n| \"well_typed_alt (PairRule w1 w2) env delta r_s1 e tau r_s3 rf = (\\<exists> e1 e2 t1 t2 r r_s2 rx1 rx2. e = PairExp e1 e2 \\<and>\n    tau = PairTy t1 t2 r \\<and> well_typed_alt w1 env delta r_s1 e1 t1 r_s2 rx1 \\<and> well_typed_alt w2 env delta r_s2 e2 t2 r_s3 rx2 \\<and>\n    leq_use_env (lift_use_env rx1 r) r_s3 \\<and> leq_use_env (lift_use_env rx2 r) r_s3 \\<and> aff_leq (max_aff (req_type t1) (req_type t2)) r \\<and>\n    disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r) \\<and>\n    rf = pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) empty_use_env tau\n  )\"  \n| \"well_typed_alt (IfRule w1 w2 w3) env delta r_s1 e tau r_s3 rx = (\\<exists> e1 e2 e3 rx' r_s2 rx1 rx2. e = IfExp e1 e2 e3 \\<and>\n    well_typed_alt w1 env delta r_s1 e1 BoolTy r_s2 rx' \\<and> well_typed_alt w2 env delta r_s2 e2 tau r_s3 rx1 \\<and> well_typed_alt w3 env delta r_s2 e3 tau r_s3 rx2 \\<and>\n    rx = comp_use_env rx1 rx2)\"\n| \"well_typed_alt (LamRule w) env delta r_s1 ex tau r_s2 rx = (\\<exists> x e t1 t2 r a r_end r_s'. ex = LamExp x e \\<and>\n    tau = FunTy t1 t2 r a \\<and>\n    well_typed_alt w (add_env env (Var x) t1) delta (add_use_env rx (Var x) r) e t2 r_s' r_end \\<and> aff_use_env rx a \\<and>\n    leq_use_env rx r_s1 \\<and> r_s2 = r_s1)\"\n| \"well_typed_alt (AppRule w1 w2) env delta r_s1 e tau r_sf rx = (\\<exists> e1 e2 t1 r a r_s2 rx1 rx2 r_s3. e = AppExp e1 e2 \\<and>\n    well_typed_alt w1 env delta r_s1 e1 (FunTy t1 tau r a) r_s2 rx1 \\<and> well_typed_alt w2 env delta r_s2 e2 t1 r_s3 rx2 \\<and>\n    r_sf = diff_use_env r_s3 (comp_use_env rx1 (lift_use_env rx2 r)) \\<and> (*r \\<noteq> NoPerm \\<and>*) (*safe_use_lift rx2 r \\<and>\n    safe_type t1 r \\<and>*) leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3 \\<and>\n    disj_use_env rx1 (lift_use_env rx2 r) \\<and> leq_use_env rx r_sf \\<and> \n    rx = app_req rx1 rx2 r tau empty_use_env\n  )\"\n| \"well_typed_alt (WeakPostRule tag) env delta r_s1 e tau r_s2 rx = (\\<exists> r_c. well_typed_alt tag env delta r_s1 e tau r_c rx \\<and>\n    leq_use_env rx r_s2 \\<and> leq_use_env r_s2 r_c)\"\n| \"well_typed_alt (StrReqRule tag) env delta r_s1 e tau r_s2 rx = (\\<exists> rx'. well_typed_alt tag env delta r_s1 e tau r_s2 rx' \\<and>\n    leq_use_env rx' rx \\<and> leq_use_env rx r_s2)\"\n| \"well_typed_alt (WeakReqRule tag) env delta r_s1 e tau r_s2 rx = (\\<exists> r_se r_xe r_ex. well_typed_alt tag env delta r_s1 e tau r_se r_xe \\<and>\n    r_s2 = diff_use_env r_se r_ex \\<and> rx = diff_use_env r_xe r_ex \\<and> leq_use_env r_ex r_s1)\"\n  \n  \nlemma well_typed_equiv1: \"\\<lbrakk> well_typed env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> (\\<exists> tag. well_typed_alt tag env delta r_s1 e tau r_s2 rx)\"  \n  apply (induct e arbitrary: env r_s1 r_s2 tau rx)\n        apply (auto)\n    (* const case *)\n        apply (rule_tac x=\"StrReqRule (WeakPostRule ConstRule)\" in exI)\n        apply (auto)\n         apply (rule_tac leq_empty_use_env)\n        apply (rule_tac leq_empty_use_env)\n    (* op case *)\n       apply (rule_tac x=\"StrReqRule (WeakPostRule OpRule)\" in exI)\n       apply (auto)\n        apply (rule_tac leq_empty_use_env)\n       apply (rule_tac leq_empty_use_env)\n    (* var case *)\n      apply (rule_tac x=\"WeakPostRule (StrReqRule (WeakReqRule VarRule))\" in exI)\n      apply (auto)\n      apply (rule_tac x=\"diff_use_env (diff_use_env r_s1 (ereq_use_env (owner_name delta x) tau_x)) r_ex\" in exI)\n      apply (auto)\n       apply (rule_tac x=\"diff_use_env (diff_use_env (ereq_use_env (owner_name delta x) tau_x) (ereq_use_env (owner_name delta x) tau_x)) r_ex\" in exI)\n       apply (auto)\n        apply (rule_tac lhs_fold_dcl_use_env)\n        apply (simp)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (rule_tac rhs_fold_dcl_use_env)\n        apply (simp_all)\n      apply (rule_tac rhs_fold_dcl_use_env)\n      apply (simp)\n    (* pair case *)\n     apply (case_tac \"\\<exists>tag. well_typed_alt tag env delta r_s1 e1 t1 r_s2a rx1\")\n      apply (erule_tac exE)\n      apply (auto)\n     apply (case_tac \"\\<exists>tag. well_typed_alt tag env delta r_s2a e2 t2 r_s3 rx2\")\n      apply (erule_tac exE)\n      apply (auto)\n     apply (rule_tac x=\"WeakPostRule (StrReqRule (WeakReqRule (PairRule tag taga)))\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"diff_use_env r_s3 r_ex\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex (PairTy t1 t2 r)\" in exI)\n     apply (auto)\n      apply (rule_tac x=\"r_s3\" in exI)\n      apply (rule_tac x=\"pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) empty_use_env (PairTy t1 t2 r)\" in exI)\n      apply (auto)\n      apply (rule_tac x=\"r_ex\" in exI)\n      apply (auto)\n      apply (simp add: pair_req_def)\n      apply (auto)\n       apply (simp add: diff_empty_use_env1)\n      apply (simp add: diff_empty_use_env2)\n     apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n      apply (auto)\n    (* if case *)\n     apply (case_tac \"\\<exists>tag. well_typed_alt tag env delta r_s1 e1 BoolTy r_s2a rx'\")\n      apply (erule_tac exE)\n      apply (auto)\n     apply (case_tac \"\\<exists>tag. well_typed_alt tag env delta r_s2a e2 tau r_s2 rx1\")\n      apply (erule_tac exE)\n      apply (auto)\n     apply (case_tac \"\\<exists>tag. well_typed_alt tag env delta r_s2a e3 tau r_s2 rx2\")\n      apply (erule_tac exE)\n      apply (auto)\n    apply (rule_tac x=\"IfRule tag taga tagb\" in exI)\n    apply (auto)\n    (* lam case *)\n   apply (case_tac \"\\<exists>tag. well_typed_alt tag (add_env env (Var x1a) t1) delta (add_use_env rxa (Var x1a) r) e t2 r_s' r_end\")\n    apply (erule_tac exE)\n    apply (auto)\n   apply (rule_tac x=\"WeakPostRule (StrReqRule (WeakReqRule (LamRule tag)))\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"diff_use_env r_s1 r_ex\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"diff_use_env rxa r_ex\" in exI)\n   apply (auto)\n   apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n    apply (auto)\n    (* app case *)\n  apply (case_tac \"\\<exists>tag. well_typed_alt tag env delta r_s1 e1 (FunTy t1 tau r a) r_s2a rx1\")\n   apply (erule_tac exE)\n   apply (auto)\n  apply (case_tac \"\\<exists>tag. well_typed_alt tag env delta r_s2a e2 t1 r_s3 rx2\")\n   apply (erule_tac exE)\n   apply (auto)\n  apply (rule_tac x=\"WeakPostRule (StrReqRule (WeakReqRule (AppRule tag taga)))\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"diff_use_env (diff_use_env r_s3 (comp_use_env rx1 (lift_use_env rx2 r))) r_ex\" in exI)\n  apply (auto)\n   apply (rule_tac x=\"app_req rx1 rx2 r tau r_ex\" in exI)\n   apply (auto)\n    apply (rule_tac x=\"diff_use_env r_s3 (comp_use_env rx1 (lift_use_env rx2 r))\" in exI)\n    apply (rule_tac x=\"app_req rx1 rx2 r tau empty_use_env\" in exI)\n    apply (auto)\n     apply (rule_tac x=\"t1\" in exI)\n     apply (rule_tac x=\"r\" in exI)\n     apply (rule_tac x=\"a\" in exI)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (auto)\n     apply (simp add: app_req_def)\n     apply (auto)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac dist_diff_leq_use_env_gen)\n      apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n       apply (simp)\n      apply (rule_tac dist_comp_leq_use_env)\n       apply (rule_tac self_comp_leq_use_env1)\n      apply (rule_tac comp_leq_use_env2)\n      apply (rule_tac self_lift_leq_use_env)\n     apply (rule_tac self_comp_leq_use_env1)\n    apply (rule_tac x=\"r_ex\" in exI)\n    apply (auto)\n    apply (simp add: app_req_def)\n    apply (auto)\n     apply (simp add: diff_empty_use_env1)\n    apply (simp add: comp_empty_use_env2)\n    apply (simp add: diff_comp_use_env)\n   apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n    apply (rule_tac rhs_fold_dcl_use_env)\n    apply (simp_all)\n  apply (rule_tac rhs_fold_dcl_use_env)\n  apply (simp)\n  done\n   \nlemma well_typed_equiv2: \"\\<lbrakk> well_typed_alt tag env delta r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow> well_typed env delta r_s1 e tau r_s2 rx\"      \n  apply (induct tag arbitrary: env r_s1 e tau r_s2 rx)  \n           apply (auto)\n    (* const + op case *)\n             apply (rule_tac id_leq_use_env)\n            apply (rule_tac leq_empty_use_env)\n           apply (rule_tac id_leq_use_env)\n          apply (rule_tac leq_empty_use_env)\n    (* var case *)\n         apply (rule_tac x=\"empty_use_env\" in exI)\n         apply (auto)\n           apply (rule_tac dist_diff_leq_use_env_gen)\n            apply (rule_tac id_leq_use_env)\n           apply (rule_tac dist_comp_leq_use_env)\n            apply (rule_tac id_leq_use_env)\n           apply (rule_tac leq_empty_use_env)\n          apply (rule_tac dist_diff_leq_use_env_gen)\n           apply (simp)\n          apply (rule_tac id_leq_use_env)\n         apply (rule_tac leq_empty_use_env)\n        apply (rule_tac dist_diff_leq_use_env_gen)\n         apply (rule_tac id_leq_use_env)\n        apply (rule_tac self_comp_leq_use_env1)\n    (* pair case *)\n       apply (rule_tac x=\"r_s2a\" in exI)\n       apply (rule_tac x=\"r_s2\" in exI)\n       apply (rule_tac x=\"rx1\" in exI)\n       apply (auto)\n       apply (rule_tac x=\"rx2\" in exI)\n       apply (auto)\n       apply (rule_tac x=\"empty_use_env\" in exI)\n       apply (auto)\n          apply (simp add: diff_empty_use_env2)\n          apply (rule_tac id_leq_use_env)\n         apply (simp add: pair_req_def)\n         apply (auto)\n          apply (rule_tac leq_empty_use_env)\n         apply (rule_tac diff_leq_use_env)\n         apply (rule_tac dist_comp_leq_use_env)\n          apply (simp_all)\n        apply (rule_tac leq_empty_use_env)\n       apply (simp add: pair_req_def)\n       apply (auto)\n        apply (rule_tac leq_empty_use_env)\n        apply (rule_tac id_leq_use_env)\n    (* if case *)\n      apply (rule_tac x=\"rx'\" in exI)\n      apply (rule_tac x=\"r_s2a\" in exI)\n       apply (auto)\n       apply (rule_tac x=\"rx1\" in exI)\n       apply (auto)\n       apply (rule_tac x=\"rx2\" in exI)\n       apply (auto)\n    (* lam case *)\n      apply (rule_tac x=\"rx\" in exI)\n      apply (auto)\n       apply (rule_tac x=\"r_end\" in exI)\n       apply (rule_tac x=\"r_s'\" in exI)\n       apply (auto)\n      apply (rule_tac x=\"empty_use_env\" in exI)\n      apply (auto)\n         apply (simp add: diff_empty_use_env2)\n         apply (rule_tac id_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n      apply (rule_tac self_diff_leq_use_env)\n    (* app case *)\n     apply (rule_tac x=\"t1\" in exI)\n     apply (rule_tac x=\"r\" in exI)\n     apply (rule_tac x=\"a\" in exI)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"empty_use_env\" in exI)\n     apply (auto)\n       apply (rule_tac dist_diff_leq_use_env_gen)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac dist_comp_leq_use_env)\n        apply (rule_tac id_leq_use_env)\n       apply (rule_tac leq_empty_use_env)\n      apply (rule_tac leq_empty_use_env)\n     apply (rule_tac id_leq_use_env)\n    (* post weakening case *)\n    apply (rule_tac r_c=\"r_c\" in well_typed_decr_end_perm)\n      apply (auto)\n    (* req strengthening case *)\n   apply (rule_tac rx=\"rx'\" in well_typed_incr_req)\n     apply (auto)\n    (* req weakening case *)\n  apply (rule_tac well_typed_diff_end_perm)\n   apply (auto)\n  done\n\nend", "meta": {"author": "dcco", "repo": "perm_lang_thesis", "sha": "81661c97a0c43701c9ec0a75074d9553b2dd0263", "save_path": "github-repos/isabelle/dcco-perm_lang_thesis", "path": "github-repos/isabelle/dcco-perm_lang_thesis/perm_lang_thesis-81661c97a0c43701c9ec0a75074d9553b2dd0263/isa_code/WellTypedAlt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.3039365556728161}}
{"text": "theory ArityTransformSafe\nimports ArityTransform ArityConsistent ArityAnalysisSpec ArityEtaExpansionSafe AbstractTransform ConstOn\nbegin\n\nlocale CardinalityArityTransformation = ArityAnalysisLetSafeNoCard\nbegin\n  sublocale AbstractTransformBoundSubst\n    \"\\<lambda> a . inc\\<cdot>a\"\n    \"\\<lambda> a . pred\\<cdot>a\"\n    \"\\<lambda> \\<Delta> e a . (a, Aheap \\<Delta> e\\<cdot>a)\"\n    \"fst\"\n    \"snd\"\n    \"\\<lambda> _. 0\"\n    \"Aeta_expand\"\n    \"snd\"\n  apply standard\n  apply (simp add: Aheap_subst)\n  apply (rule subst_Aeta_expand)\n  done\n\n  abbreviation ccTransform where \"ccTransform \\<equiv> transform\"\n\n  lemma supp_transform: \"supp (transform a e) \\<subseteq> supp e\"\n    by (induction rule: transform.induct)\n       (auto simp add: exp_assn.supp Let_supp dest!: subsetD[OF supp_map_transform] subsetD[OF supp_map_transform_step] )\n  interpretation supp_bounded_transform transform\n    by standard (auto simp add: fresh_def supp_transform) \n\n  fun transform_alts :: \"Arity list \\<Rightarrow> stack \\<Rightarrow> stack\"\n    where \n      \"transform_alts _ [] = []\"\n    | \"transform_alts (a#as) (Alts e1 e2 # S) = (Alts (ccTransform a e1) (ccTransform a e2)) # transform_alts as S\"\n    | \"transform_alts as (x # S) = x # transform_alts as S\"\n\n  lemma transform_alts_Nil[simp]: \"transform_alts [] S = S\"\n    by (induction  S) auto\n\n  lemma Astack_transform_alts[simp]:\n    \"Astack (transform_alts as S) = Astack S\"\n   by (induction rule: transform_alts.induct) auto\n\n  lemma fresh_star_transform_alts[intro]: \"a \\<sharp>* S \\<Longrightarrow> a \\<sharp>* transform_alts as S\"\n   by (induction as S  rule: transform_alts.induct) (auto simp add: fresh_star_Cons)\n\n  fun a_transform :: \"astate \\<Rightarrow> conf \\<Rightarrow> conf\"\n  where \"a_transform (ae, a, as) (\\<Gamma>, e, S) =\n    (map_transform Aeta_expand ae (map_transform ccTransform ae \\<Gamma>), \n     ccTransform a e,\n     transform_alts as  S)\"\n\n  fun restr_conf :: \"var set \\<Rightarrow> conf \\<Rightarrow> conf\"\n    where \"restr_conf V (\\<Gamma>, e, S) = (restrictA V \\<Gamma>, e, restr_stack V S)\"\n\n  inductive consistent :: \"astate \\<Rightarrow> conf \\<Rightarrow> bool\" where\n    consistentI[intro!]: \n    \"a_consistent (ae, a, as) (\\<Gamma>, e, S)\n    \\<Longrightarrow> (\\<And> x. x \\<in> thunks \\<Gamma> \\<Longrightarrow>  ae x = up\\<cdot>0)\n    \\<Longrightarrow> consistent (ae, a, as) (\\<Gamma>, e, S)\"  \n  inductive_cases consistentE[elim!]: \"consistent (ae, a, as) (\\<Gamma>, e, S)\"\n\n  lemma closed_consistent:\n    assumes \"fv e = ({}::var set)\"\n    shows \"consistent (\\<bottom>, 0, []) ([], e, [])\"\n  by (auto simp add: edom_empty_iff_bot closed_a_consistent[OF assms])\n\n  lemma arity_tranform_safe:\n    fixes c c'\n    assumes \"c \\<Rightarrow>\\<^sup>* c'\" and \"\\<not> boring_step c'\" and \"heap_upds_ok_conf c\" and \"consistent (ae,a,as) c\"\n    shows \"\\<exists>ae' a' as'. consistent (ae',a',as') c' \\<and> a_transform (ae,a,as) c \\<Rightarrow>\\<^sup>* a_transform (ae',a',as') c'\"\n  using assms(1,2) heap_upds_ok_invariant assms(3-)\n  proof(induction c c' arbitrary: ae a as rule:step_invariant_induction)\n  case (app\\<^sub>1 \\<Gamma> e x S)\n    from app\\<^sub>1 have \"consistent (ae, inc\\<cdot>a, as) (\\<Gamma>, e, Arg x # S)\"\n      by (auto intro: a_consistent_app\\<^sub>1)\n    moreover\n    have \"a_transform (ae, a, as) (\\<Gamma>, App e x, S) \\<Rightarrow> a_transform (ae, inc\\<cdot>a, as) (\\<Gamma>, e, Arg x # S)\"\n      by simp rule\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n  case (app\\<^sub>2 \\<Gamma> y e x S)\n    have \"consistent (ae, pred\\<cdot>a, as) (\\<Gamma>, e[y::=x], S)\" using app\\<^sub>2\n      by (auto 4 3 intro: a_consistent_app\\<^sub>2)\n    moreover\n    have \"a_transform (ae, a, as) (\\<Gamma>, Lam [y]. e, Arg x # S) \\<Rightarrow> a_transform (ae, pred \\<cdot> a, as) (\\<Gamma>, e[y::=x], S)\" by (simp add: subst_transform[symmetric]) rule\n    ultimately\n    show ?case by (blast  del: consistentI consistentE)\n  next\n  case (thunk \\<Gamma> x e S)\n    hence \"x \\<in> thunks \\<Gamma>\" by auto\n    hence [simp]: \"x \\<in> domA \\<Gamma>\" by (rule subsetD[OF thunks_domA])\n\n    from \\<open>heap_upds_ok_conf (\\<Gamma>, Var x, S)\\<close>\n    have \"x \\<notin> upds S\"  by (auto dest!: heap_upds_okE)\n    \n    have \"x \\<in> edom ae\" using thunk by auto\n    have \"ae x = up\\<cdot>0\" using thunk \\<open>x \\<in> thunks \\<Gamma>\\<close> by (auto)\n\n    have \"a_consistent (ae, 0, as) (delete x \\<Gamma>, e, Upd x # S)\" using thunk \\<open>ae x = up\\<cdot>0\\<close>\n      by (auto intro!: a_consistent_thunk_0 simp del: restr_delete)\n    hence \"consistent (ae, 0, as) (delete x \\<Gamma>, e, Upd x # S)\" using thunk \\<open>ae x = up\\<cdot>0\\<close> \n      by (auto simp add:  restr_delete_twist)\n    moreover\n  \n    from  \\<open>map_of \\<Gamma> x = Some e\\<close> \\<open>ae x = up\\<cdot>0\\<close>\n    have \"map_of (map_transform Aeta_expand ae (map_transform ccTransform ae \\<Gamma>)) x = Some (transform 0 e)\"\n      by (simp add: map_of_map_transform)\n    with \\<open>\\<not> isVal e\\<close>\n    have \"a_transform (ae, a, as) (\\<Gamma>, Var x, S) \\<Rightarrow> a_transform (ae, 0, as) (delete x \\<Gamma>, e, Upd x # S)\"\n      by (auto simp add: map_transform_delete restr_delete_twist intro!: step.intros  simp del: restr_delete)\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n  case (lamvar \\<Gamma> x e S)\n    from lamvar(1) have [simp]: \"x \\<in> domA \\<Gamma>\" by (metis domI dom_map_of_conv_domA)\n\n    have \"up\\<cdot>a \\<sqsubseteq> (Aexp (Var x)\\<cdot>a f|` (domA \\<Gamma> \\<union> upds S)) x\"\n      by (simp) (rule Aexp_Var)\n    also from lamvar have \"Aexp (Var x)\\<cdot>a f|` (domA \\<Gamma> \\<union> upds S) \\<sqsubseteq> ae\" by (auto simp add: join_below_iff env_restr_join a_consistent.simps)\n    finally\n    obtain u where \"ae x = up\\<cdot>u\" by (cases \"ae x\") (auto simp add: edom_def)\n    hence \"x \\<in> edom ae\" by (auto simp add: edomIff)\n\n    have \"a_consistent (ae, u, as) ((x,e) # delete x \\<Gamma>, e, S)\" using lamvar \\<open>ae x = up\\<cdot>u\\<close>\n      by (auto intro!: a_consistent_lamvar simp del: restr_delete)\n    hence \"consistent (ae, u, as) ((x, e) # delete x \\<Gamma>, e, S)\"\n      using lamvar by (auto simp add:  thunks_Cons restr_delete_twist elim: below_trans)\n    moreover\n\n    from \\<open>a_consistent _ _\\<close>\n    have \"Astack (transform_alts as S) \\<sqsubseteq> u\" by (auto elim: a_consistent_stackD)\n  \n    {\n    from \\<open>isVal e\\<close>\n    have \"isVal (transform u e)\" by simp\n    hence \"isVal (Aeta_expand u (transform u e))\" by (rule isVal_Aeta_expand)\n    moreover\n    from  \\<open>map_of \\<Gamma> x = Some e\\<close>  \\<open>ae x = up \\<cdot> u\\<close>  \\<open>isVal (transform u e)\\<close>\n    have \"map_of (map_transform Aeta_expand ae (map_transform transform ae \\<Gamma>)) x = Some (Aeta_expand u (transform u e))\"\n      by (simp add: map_of_map_transform)\n    ultimately\n    have \"a_transform (ae, a, as) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sup>*\n          ((x, Aeta_expand u (transform u e)) # delete x (map_transform Aeta_expand ae (map_transform transform ae \\<Gamma>)), Aeta_expand u (transform u e), transform_alts as S)\"\n       by (auto intro: lambda_var simp del: restr_delete)\n    also have \"\\<dots> = ((map_transform Aeta_expand ae (map_transform transform ae ((x,e) # delete x \\<Gamma>))), Aeta_expand u (transform u e), transform_alts as S)\"\n      using \\<open>ae x = up \\<cdot> u\\<close> \\<open>isVal (transform u e)\\<close>\n      by (simp add: map_transform_Cons map_transform_delete  del: restr_delete)\n    also(subst[rotated]) have \"\\<dots> \\<Rightarrow>\\<^sup>* a_transform (ae, u, as) ((x, e) # delete x \\<Gamma>, e, S)\"\n      by (simp add: restr_delete_twist) (rule Aeta_expand_safe[OF \\<open>Astack _ \\<sqsubseteq> u\\<close>])\n    finally(rtranclp_trans)\n    have \"a_transform (ae, a, as) (\\<Gamma>, Var x, S) \\<Rightarrow>\\<^sup>* a_transform (ae, u, as) ((x, e) # delete x \\<Gamma>, e, S)\".\n    }\n    ultimately show ?case by (blast del: consistentI consistentE)\n  next\n  case (var\\<^sub>2 \\<Gamma> x e S)\n    from var\\<^sub>2\n    have \"a_consistent (ae, a, as) (\\<Gamma>, e, Upd x # S)\" by auto\n    from a_consistent_UpdD[OF this]\n    have \"ae x = up\\<cdot>0\" and \"a = 0\".\n\n    have \"a_consistent (ae, a, as) ((x, e) # \\<Gamma>, e, S)\"\n      using var\\<^sub>2 by (auto intro!: a_consistent_var\\<^sub>2)\n    hence \"consistent (ae, 0, as) ((x, e) # \\<Gamma>, e, S)\"\n      using var\\<^sub>2 \\<open>a = 0\\<close>\n      by (auto simp add: thunks_Cons elim: below_trans)\n    moreover\n    have \"a_transform (ae, a, as) (\\<Gamma>, e, Upd x # S) \\<Rightarrow> a_transform (ae, 0, as) ((x, e) # \\<Gamma>, e, S)\"\n      using \\<open>ae x = up\\<cdot>0\\<close> \\<open>a = 0\\<close> var\\<^sub>2\n      by (auto intro!: step.intros simp add: map_transform_Cons)\n    ultimately show ?case by (blast del: consistentI consistentE)\n  next\n    case (let\\<^sub>1 \\<Delta> \\<Gamma> e S)\n    let ?ae = \"Aheap \\<Delta> e\\<cdot>a\"\n  \n    have \"domA \\<Delta> \\<inter> upds S = {}\" using fresh_distinct_fv[OF let\\<^sub>1(2)] by (auto dest: subsetD[OF ups_fv_subset])\n    hence *: \"\\<And> x. x \\<in> upds S \\<Longrightarrow> x \\<notin> edom ?ae\" by (auto simp add:  dest!: subsetD[OF edom_Aheap])\n    have restr_stack_simp2: \"restr_stack (edom (?ae \\<squnion> ae)) S = restr_stack (edom ae) S\"\n      by (auto intro: restr_stack_cong dest!: *)\n\n    have \"edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S\" using let\\<^sub>1 by (auto dest!: a_consistent_edom_subsetD)\n    from subsetD[OF this] fresh_distinct[OF let\\<^sub>1(1)] fresh_distinct_fv[OF let\\<^sub>1(2)]\n    have \"edom ae \\<inter> domA \\<Delta> = {}\" by (auto dest: subsetD[OF ups_fv_subset])\n\n    {\n    { fix x e'\n      assume \"x \\<in> thunks \\<Gamma>\"\n      with let\\<^sub>1\n      have \"(?ae \\<squnion> ae) x = up\\<cdot>0\" by auto\n    }\n    moreover\n    { fix x e'\n      assume \"x \\<in> thunks \\<Delta>\" \n      hence \"(?ae \\<squnion> ae) x = up\\<cdot>0\" by (auto simp add: Aheap_heap3)\n    }\n    moreover\n    \n    have \"a_consistent (ae, a, as) (\\<Gamma>, Let \\<Delta> e, S)\"\n      using let\\<^sub>1 by auto\n    hence \"a_consistent (?ae \\<squnion> ae, a, as) (\\<Delta> @ \\<Gamma>, e, S)\"\n      using let\\<^sub>1(1,2) \\<open>edom ae \\<inter> domA \\<Delta> = {}\\<close> \n      by (auto intro!:  a_consistent_let simp del: join_comm)\n    ultimately\n    have \"consistent (?ae \\<squnion> ae, a, as) (\\<Delta> @ \\<Gamma>, e, S)\"\n      by auto\n    }\n    moreover\n    {\n      have \"\\<And> x. x \\<in> domA \\<Gamma> \\<Longrightarrow> x \\<notin> edom ?ae\"\n        using fresh_distinct[OF let\\<^sub>1(1)]\n        by (auto dest!: subsetD[OF edom_Aheap])\n      hence \"map_transform Aeta_expand (?ae \\<squnion> ae) (map_transform transform (?ae \\<squnion> ae) \\<Gamma>)\n         = map_transform Aeta_expand ae (map_transform transform ae \\<Gamma>)\"\n         by (auto intro!: map_transform_cong restrictA_cong simp add: edomIff)\n      moreover\n  \n      from \\<open>edom ae \\<subseteq> domA \\<Gamma> \\<union> upds S\\<close>\n      have  \"\\<And> x. x \\<in> domA \\<Delta> \\<Longrightarrow> x \\<notin> edom ae\"\n         using fresh_distinct[OF let\\<^sub>1(1)] fresh_distinct_fv[OF let\\<^sub>1(2)] \n         by (auto dest!:  subsetD[OF ups_fv_subset])\n      hence \"map_transform Aeta_expand (?ae \\<squnion> ae) (map_transform transform (?ae \\<squnion> ae) \\<Delta>)\n         = map_transform Aeta_expand ?ae (map_transform transform ?ae \\<Delta>)\"\n         by (auto intro!: map_transform_cong restrictA_cong simp add: edomIff)\n      ultimately\n      \n      \n      have \"a_transform (ae, a, as) (\\<Gamma>, Let \\<Delta> e, S) \\<Rightarrow> a_transform (?ae \\<squnion> ae,  a, as) (\\<Delta> @ \\<Gamma>, e, S)\"\n        using restr_stack_simp2 let\\<^sub>1(1,2)\n        apply (auto simp add: map_transform_append restrictA_append  restr_stack_simp2[simplified] map_transform_restrA)\n        apply (rule step.let\\<^sub>1)\n        apply (auto dest: subsetD[OF edom_Aheap])\n        done\n    }\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case (if\\<^sub>1 \\<Gamma> scrut e1 e2 S)\n    have \"consistent (ae, 0, a#as) (\\<Gamma>, scrut, Alts e1 e2 # S)\"\n      using if\\<^sub>1  by (auto dest: a_consistent_if\\<^sub>1)\n    moreover\n    have \"a_transform (ae,  a, as) (\\<Gamma>, scrut ? e1 : e2, S) \\<Rightarrow> a_transform (ae, 0, a#as) (\\<Gamma>, scrut, Alts e1 e2 # S)\"\n      by (auto intro: step.intros)\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case (if\\<^sub>2 \\<Gamma> b e1 e2 S)\n    hence \"a_consistent (ae, a, as) (\\<Gamma>, Bool b, Alts e1 e2 # S)\" by auto\n    then  obtain a' as' where [simp]: \"as = a' # as'\" \"a = 0\"\n      by (rule a_consistent_alts_on_stack)\n\n    have \"consistent (ae, a', as') (\\<Gamma>, if b then e1 else e2, S)\" \n      using if\\<^sub>2 by (auto dest!: a_consistent_if\\<^sub>2)\n    moreover\n    have \"a_transform (ae, a, as) (\\<Gamma>, Bool b, Alts e1 e2 # S) \\<Rightarrow> a_transform (ae,  a', as') (\\<Gamma>, if b then e1 else e2, S)\"\n      by (auto intro: step.if\\<^sub>2[where b = True, simplified] step.if\\<^sub>2[where b = False, simplified])\n    ultimately\n    show ?case by (blast del: consistentI consistentE)\n  next\n    case refl thus ?case by auto\n  next\n    case (trans c c' c'')\n      from trans(3)[OF trans(5)]\n      obtain ae' a' as' where \"consistent (ae', a', as') c'\" and *: \"a_transform (ae, a, as) c \\<Rightarrow>\\<^sup>* a_transform (ae', a', as') c'\" by blast\n      from trans(4)[OF this(1)]\n      obtain ae'' a'' as'' where \"consistent (ae'', a'', as'') c''\" and **: \"a_transform (ae', a', as') c' \\<Rightarrow>\\<^sup>* a_transform (ae'', a'', as'') c''\" by blast\n      from this(1) rtranclp_trans[OF * **]\n      show ?case by blast\n  qed\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/ArityTransformSafe.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.303936555672816}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory PolicySystemSAC\nimports\n  Noninterference\n  \"Access.ExampleSystem\"\nbegin\n\ntext \\<open>\n  Reads/Affects sets:\n  - NicA, NicB, NicD: reads all except T\n       affects {RM, R, NicA, NicB, NicD}\n  - NicC: reads all except T, affects self only\n  - R:  reads all except T\n        affects {NicA, NicB, NicD, R, RM, NTFN3}\n  - RM: reads all except T\n        affects {SC, EP, RM, R, NicA, NicB, NicD, NTFN2}\n  - SC: reads all except T\n        affects {EP, SC, NicC, RM, R, NicA, NicB, NicD, NTFN1}\n  - EP: reads all except T\n        affects {EP, SC, NicC, RM, R, NicA, NicB, NicD}\n  - NTFN1: reads all except T, affects {NTFN1, SC, NicC}\n  - NTFN2: ''                , affects {NTFN2, RM, R, NicA, NicB, NicD}\n  - NTFN3: ''                , affects {NTFN3, R, NicB, NicD}\n  - T: reads T, affects all except EP\n\\<close>\n\nsubsection \\<open>Definitions\\<close>\n\ndatatype SACLabels =\n    NicA | NicB | NicC | NicD\n  | R | RM |  SC | EP\n  | T | NTFN1 | NTFN2 | NTFN3\n\ndefinition complete_AgentAuthGraph where\n  \"complete_AgentAuthGraph g \\<equiv>\n     g \\<union> {(y,a,y) | a y. True}\n       \\<union> {(x,a,y) | x a y. (x,Control,y) \\<in> g }\n       \\<union> {(x,a,y)|x a y. \\<exists> z. (x,Control,z) \\<in> g \\<and> (z, Control,y) \\<in> g} \"\ndeclare complete_AgentAuthGraph_def [simp]\n\nabbreviation partition_label where\n  \"partition_label l \\<equiv> OrdinaryLabel l\"\n\ndefinition SACGraph where\n  \"SACGraph \\<equiv>\n  { (partition_label R, Read,  partition_label NicB), (partition_label R, Write, partition_label NicB),\n    (partition_label R, Read,  partition_label NicD), (partition_label R, Write, partition_label NicD),\n    (partition_label SC, Read,  partition_label NicC), (partition_label SC, Write, partition_label NicC),\n    (partition_label SC, SyncSend, partition_label EP),\n    (partition_label RM, Receive, partition_label EP),\n    (partition_label RM, Control, partition_label R),\n    (partition_label RM, Control, partition_label NicA),\n    (partition_label RM, Control, partition_label NicB),\n    (partition_label RM, Control, partition_label NicD),\n    (partition_label T, Notify, partition_label NTFN1),\n    (partition_label T, Notify, partition_label NTFN2),\n    (partition_label T, Notify, partition_label NTFN3),\n    (partition_label SC, Receive, partition_label NTFN1),\n    (partition_label RM, Receive, partition_label NTFN2),\n    (partition_label R, Receive, partition_label NTFN3)\n  }\"\ndeclare SACGraph_def [simp]\n\ndefinition SACAuthGraph  where\n  \"SACAuthGraph = complete_AgentAuthGraph SACGraph\"\ndeclare SACAuthGraph_def [simp]\n\ndefinition SACAllLabels where\n  \"SACAllLabels \\<equiv> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC}\"\n\ndefinition RMControls where\n  \"RMControls = {partition_label RM, partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}\"\ndeclare RMControls_def [simp]\n\nlemma reads_all_rm_controlled_subjects : \"\\<lbrakk>partition_label RM \\<in> subjectReads SACAuthGraph (partition_label x); l \\<in> RMControls\\<rbrakk> \\<Longrightarrow> l \\<in> subjectReads SACAuthGraph (partition_label x)\"\n  apply (simp only:RMControls_def)\n  apply (erule insertE, rule_tac t=\"partition_label RM\" in reads_read_thread_read_pages, simp, simp)+\n  apply simp\ndone\n\nlemma reads_ntfn3_via_r : \"partition_label R \\<in> subjectReads SACAuthGraph (partition_label x) \\<Longrightarrow> partition_label NTFN3 \\<in> subjectReads SACAuthGraph (partition_label x)\"\n  apply (rule_tac ep=\"partition_label NTFN3\" and t=\"partition_label R\" and auth=\"Receive\" and auth'=\"Notify\" and a=\"partition_label T\" in reads_read_queued_thread_read_ep)\n  apply simp_all\ndone\n\nlemma reads_ntfn2_via_rm : \"partition_label RM \\<in> subjectReads SACAuthGraph (partition_label x) \\<Longrightarrow> partition_label NTFN2 \\<in> subjectReads SACAuthGraph (partition_label x)\"\n  apply (rule_tac ep=\"partition_label NTFN2\" and t=\"partition_label RM\" and auth=\"Receive\" and auth'=\"Notify\" and a=\"partition_label T\" in reads_read_queued_thread_read_ep)\n  apply simp_all\ndone\n\nlemma reads_ntfn1_via_sc : \"partition_label SC \\<in> subjectReads SACAuthGraph (partition_label x) \\<Longrightarrow> partition_label NTFN1 \\<in> subjectReads SACAuthGraph (partition_label x)\"\n  apply (rule_tac ep=\"partition_label NTFN1\" and t=\"partition_label SC\" and auth=\"Receive\" and auth'=\"Notify\" and a=\"partition_label T\" in reads_read_queued_thread_read_ep)\n  apply simp_all\ndone\n\nsubsection \\<open>NicA, NicB, NicD reads/affects\\<close>\n\nlemma reads_Control_rev':\n  \"(x,Control,y) \\<in> aag \\<Longrightarrow>\n    x \\<in> subjectReads (complete_AgentAuthGraph aag) y\"\n  apply(rule reads_read_page_read_thread)\n   apply(rule reads_lrefl)\n  apply simp\n  done\n\nlemma reads_Control_rev:\n  \"(x,Control,y) \\<in> SACGraph \\<Longrightarrow>\n   x \\<in> subjectReads SACAuthGraph y\"\n  apply(subst SACAuthGraph_def)\n  apply(erule reads_Control_rev')\n  done\n\n\nlemma abdrm_reads_ep : \"x \\<in> {NicA, NicB, NicD, RM} \\<Longrightarrow> partition_label EP \\<in> subjectReads SACAuthGraph (partition_label x)\"\n  apply (rule_tac t = \"partition_label RM\" and a = \"partition_label SC\" and auth' = \"SyncSend\" and auth = \"Receive\" in reads_read_queued_thread_read_ep)\n      apply (simp+)[4]\n  apply safe\n     apply(fastforce intro: reads_Control_rev simp del: complete_AgentAuthGraph_def)\n    apply(fastforce intro: reads_Control_rev simp del: complete_AgentAuthGraph_def)\n   apply(fastforce intro: reads_Control_rev simp del: complete_AgentAuthGraph_def)\n  done\n\nlemma abdrm_reads_sc : \"x \\<in> {NicA, NicB, NicD, RM} \\<Longrightarrow> partition_label SC \\<in> subjectReads SACAuthGraph (partition_label x)\"\n    apply (rule_tac auth = \"Receive\" and b = \"partition_label SC\" and a = \"partition_label RM\" and ep = \"partition_label EP\" in read_sync_ep_read_senders)\n      apply (simp, simp, simp del: SACAuthGraph_def add: abdrm_reads_ep, simp)\ndone\n\nlemma abd_reads_rm : \"x \\<in> {NicA, NicB, NicD} \\<Longrightarrow> partition_label RM \\<in> subjectReads SACAuthGraph (partition_label x)\"\n  apply (rule reads_Control_rev)\n  apply auto\ndone\n\nlemma abd_reads_c : \"x \\<in> {NicA, NicB, NicD} \\<Longrightarrow> partition_label NicC \\<in> subjectReads SACAuthGraph (partition_label x)\"\n  apply (rule_tac t = \"partition_label SC\" in reads_read_thread_read_pages)\n  apply (rule abdrm_reads_sc, simp, blast, simp)\ndone\n\nlemma abd_reads_r : \"x \\<in> {NicA, NicB, NicD} \\<Longrightarrow> partition_label R \\<in> subjectReads SACAuthGraph (partition_label x)\"\n  apply (rule_tac p=\"partition_label R\" and t=\"partition_label RM\" in reads_read_thread_read_pages)\n  apply (rule abd_reads_rm, simp, simp)\ndone\n\nlemma abd_reads_ntfn3 : \"x \\<in> {NicA, NicB, NicD} \\<Longrightarrow> partition_label NTFN3 \\<in> subjectReads SACAuthGraph (partition_label x)\"\n  apply (rule_tac ep=\"partition_label NTFN3\" and t=\"partition_label R\" and auth=\"Receive\" and auth'=\"Notify\" and a=\"partition_label T\" in reads_read_queued_thread_read_ep)\n  apply (simp_all add: abd_reads_r del:SACAuthGraph_def, simp_all)\ndone\n\nlemma abd_reads_all_bw : \"x \\<in> {NicA, NicB, NicD} \\<Longrightarrow> {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \\<subseteq> subjectReads SACAuthGraph (partition_label x)\"\n  apply (rule subsetI)\n  (* refl cases *)\n  apply (case_tac \"partition_label x = xa\")\n  apply simp\n  (* non refl cases *)\n  apply (case_tac \"xa \\<in> RMControls\")\n    apply (rule reads_all_rm_controlled_subjects, rule abd_reads_rm, simp, simp)\n  apply (erule_tac a = xa in insertE, simp)\n  apply (erule_tac a = xa in insertE, simp only:, rule abd_reads_rm, simp)\n  apply (erule_tac a = xa in insertE, simp)\n  apply (erule_tac a = xa in insertE, simp)\n  apply (erule_tac a = xa in insertE, simp)\n  apply (erule_tac a = xa in insertE, simp only:, rule abdrm_reads_ep, simp, blast)\n  apply (erule_tac a = xa in insertE, simp only:, rule abdrm_reads_sc, simp, blast)\n  apply (erule_tac a = xa in insertE, simp only:, rule abd_reads_c, simp)\n  apply (erule_tac a = xa in insertE, simp only:, rule reads_ntfn1_via_sc, rule abdrm_reads_sc, simp, blast)\n  apply (erule_tac a = xa in insertE, simp only:, rule reads_ntfn2_via_rm, rule abd_reads_rm, simp)\n  apply (erule_tac a = xa in insertE, simp only:, rule reads_ntfn3_via_r, rule abd_reads_r, simp)\n  apply simp\ndone\n\nlemma abd_reads : \"x \\<in> {NicA, NicB, NicD} \\<Longrightarrow> subjectReads SACAuthGraph (partition_label x) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n   apply (rule subset_antisym)\n   defer\n   apply (rule abd_reads_all_bw)\n   apply (simp)\n   apply (rule subsetI)\n     apply (erule subjectReads.induct)\n     (* warning: slow *)\n     by (simp, blast?)+\n\n\ndefinition abd_affects_set where\n \"abd_affects_set \\<equiv> {NicB, RM, R, NicA, NicD,\n                     EP, NTFN2}\" (* these two added for NTFN binding *)\ndeclare abd_affects_set_def[simp]\n\nlemma abd_affects_bw : \"x \\<in> {NicA, NicB, NicD} \\<Longrightarrow> partition_label ` abd_affects_set \\<subseteq> subjectAffects SACAuthGraph (partition_label x)\"\n  apply (simp only:abd_affects_set_def)\n  apply (rule subsetI)\n  (* refl cases *)\n  apply (case_tac \"partition_label x = xa\")\n    apply (simp add: affects_lrefl)\n  (* non-refl cases *)\n  apply (simp only: image_insert)\n  apply (erule_tac a = xa in insertE)\n    apply (rule_tac auth = SyncSend and ep = \"partition_label x\" and l' = \"partition_label RM\" in affects_send)\n    apply (simp, simp, simp, simp)\n  apply (erule_tac a = xa in insertE)\n    apply (simp only:)\n    apply (rule_tac ep = \"partition_label x\" and l' = \"partition_label RM\" in affects_recv)\n      apply (simp)\n      apply (auto)[1]\n  apply (erule_tac a = xa in insertE)\n    apply (simp only:)\n    apply (rule_tac auth = SyncSend and ep = \"partition_label x\" and l' = \"partition_label RM\" in affects_send)\n    apply (simp, simp, simp, simp)\n  apply (erule_tac a = xa in insertE)\n    apply (simp only:)\n    apply (clarify)\n    apply (erule notE)\n    apply (rule_tac auth = SyncSend and ep = \"partition_label x\" and l' = \"partition_label RM\" in affects_send)\n    apply (simp, simp, simp, simp)\n  apply (erule_tac a = xa in insertE)\n    apply (rule_tac auth = SyncSend and ep = \"partition_label x\" and l' = \"partition_label RM\" in affects_send)\n    apply (simp, simp, simp, simp)\n  apply (erule_tac a = xa in insertE)\n    apply (rule_tac ep = \"xa\" and l = \"partition_label x\" in affects_ep_bound_trans)\n    apply (rule_tac x = \"partition_label RM\" in exI)\n    apply (rule_tac x = \"partition_label x\" in exI)\n    apply (intro conjI)\n    apply (simp,simp,simp)\n  apply (erule_tac a = xa in insertE)\n    apply (rule_tac ep = \"xa\" and l = \"partition_label x\" in affects_ep_bound_trans)\n    apply (rule_tac x = \"partition_label RM\" in exI)\n    apply (rule_tac x = \"partition_label x\" in exI)\n    apply (intro conjI)\n    apply (simp,simp,simp,simp)\n  done\n\nlemma abd_affects : \"x \\<in> {NicA, NicB, NicD} \\<Longrightarrow> subjectAffects SACAuthGraph (partition_label x) = partition_label ` abd_affects_set\"\n   apply (rule subset_antisym)\n   defer\n   apply (rule abd_affects_bw)\n   apply (simp)\n   apply (rule subsetI)\n     apply (erule subjectAffects.induct)\n     by auto\n\nsubsection \\<open>NicC reads/affects\\<close>\n\nlemma c_reads_sc : \"partition_label SC \\<in> subjectReads SACAuthGraph (partition_label NicC)\"\n  apply (rule_tac b = \"partition_label NicC\" in reads_read_page_read_thread)\n  apply (rule reads_lrefl)\n  apply (simp)\ndone\n\nlemma c_reads_ep : \"partition_label EP \\<in> subjectReads SACAuthGraph (partition_label NicC)\"\n  apply (rule_tac a = \"partition_label EP\" and ep = \"partition_label EP\" and t = \"partition_label SC\" and auth = \"SyncSend\" and auth' = \"Reset\" in reads_read_queued_thread_read_ep)\n  apply (simp,simp,simp,simp)\n  apply (rule c_reads_sc)\ndone\n\nlemma c_reads_rm : \"partition_label RM \\<in> subjectReads SACAuthGraph (partition_label NicC)\"\n  apply (rule_tac auth = SyncSend and a = \"partition_label SC\" and ep = \"partition_label EP\" in read_sync_ep_read_receivers)\n   apply (simp, simp)\n   apply (rule c_reads_ep)\n   apply (simp)\ndone\n\nlemma c_reads_any_controlled_by_rm : \"x \\<in> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD} \\<Longrightarrow> x \\<in> subjectReads SACAuthGraph (partition_label NicC)\"\n  apply (rule_tac t = \"partition_label RM\" in reads_read_thread_read_pages)\n    apply (rule c_reads_rm)\n    apply auto\ndone\n\nlemma c_reads : \"subjectReads SACAuthGraph (partition_label NicC) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n  apply (rule subset_antisym)\n    defer\n    (* backward *)\n    apply (rule subsetI)\n      apply (case_tac \"x \\<in> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD}\")\n        apply (rule c_reads_any_controlled_by_rm, assumption)\n        apply (erule insertE, simp)\n        apply (erule insertE, simp only:, rule c_reads_rm)\n        apply (erule insertE, simp, erule insertE, simp, erule insertE, simp)\n        apply (erule insertE, simp only:, rule c_reads_ep)\n        apply (erule insertE, simp only:, rule c_reads_sc)\n        apply (erule insertE, simp only:, rule reads_lrefl)\n        apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule c_reads_sc)\n        apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule c_reads_rm)\n        apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule c_reads_any_controlled_by_rm, simp)\n        apply simp\n    (* forward *)\n    apply (rule subsetI)\n    apply (erule subjectReads.induct)\n    by (simp, blast?)+\n\nlemma c_affects_self_only : \"x \\<in> {partition_label NicC} \\<Longrightarrow> x \\<in> subjectAffects SACAuthGraph (partition_label NicC)\"\n  apply (erule insertE)\n    apply (simp only:, rule affects_lrefl)\n    apply simp\ndone\n\nlemma c_affects : \"subjectAffects SACAuthGraph (partition_label NicC) = {partition_label NicC}\"\n  apply (rule subset_antisym)\n  defer\n    (* backward *)\n    apply (rule subsetI)\n    apply (rule c_affects_self_only, assumption)\n    (* forward *)\n    apply (rule subsetI)\n    apply (erule subjectAffects.induct)\n    by (simp, blast?)+\n\nsubsection \\<open>R reads/affects\\<close>\n\nlemma r_reads_bd : \"x \\<in> {partition_label NicB, partition_label NicD} \\<Longrightarrow> x \\<in> subjectReads SACAuthGraph (partition_label R)\"\n  apply (rule reads_read)\n  apply auto\ndone\n\nlemma r_reads_ep : \"partition_label EP \\<in> subjectReads SACAuthGraph (partition_label R)\"\n    apply (rule_tac a=\"partition_label SC\" and auth'=\"SyncSend\" and ep=\"partition_label EP\" and t=\"partition_label RM\" and auth=\"Receive\" in reads_read_queued_thread_read_ep)\n    apply (simp, simp, simp, simp, rule reads_Control_rev, simp)\ndone\n\nlemma r_reads_sc : \"partition_label SC \\<in> subjectReads SACAuthGraph (partition_label R)\"\n    apply (rule_tac a=\"partition_label RM\" and auth=\"Receive\" and ep=\"partition_label EP\" and b=\"partition_label SC\" in read_sync_ep_read_senders)\n    apply (simp, simp, rule r_reads_ep, simp)\ndone\n\nlemma r_reads_a : \"partition_label NicA \\<in> subjectReads SACAuthGraph (partition_label R)\"\n  apply (rule_tac a=\"partition_label NicA\" and auth'=\"Reset\" and ep=\"partition_label NicA\" and t=\"partition_label RM\" and auth=\"Receive\" in reads_read_queued_thread_read_ep)\n  apply (simp_all add:reads_Control_rev[simplified])\ndone\n\nlemma r_reads_c : \"partition_label NicC \\<in> subjectReads SACAuthGraph (partition_label R)\"\n  apply (rule_tac t=\"partition_label SC\" in reads_read_thread_read_pages)\n  apply (rule r_reads_sc, simp)\ndone\n\nlemma r_reads : \"subjectReads SACAuthGraph (partition_label R) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n  apply (rule subset_antisym)\n    defer\n    (* backward *)\n    apply (rule subsetI)\n    apply (erule insertE, rule r_reads_bd, simp)\n    apply (erule insertE, rule reads_Control_rev, simp)\n    apply (erule insertE, simp only:, rule reads_lrefl)\n    apply (erule insertE, simp only:, rule r_reads_a)\n    apply (erule insertE, rule r_reads_bd, simp)\n    apply (erule insertE, simp only:, rule r_reads_ep)\n    apply (erule insertE, simp only:, rule r_reads_sc)\n    apply (erule insertE, simp only:, rule r_reads_c)\n    apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule r_reads_sc)\n    apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule reads_Control_rev, simp)\n    apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule reads_lrefl)\n    apply simp\n    (* forward *)\n    apply (rule subsetI)\n    apply (erule subjectReads.induct)\n    by (simp, blast?)+\n\nlemma r_affects_bd : \"x \\<in> {partition_label NicB, partition_label NicD} \\<Longrightarrow> x \\<in> subjectAffects SACAuthGraph (partition_label R)\"\n  apply (rule_tac auth=\"Write\" in affects_write)\n  apply auto\ndone\n\nlemma r_affects_rm : \"partition_label RM \\<in> subjectAffects SACAuthGraph (partition_label R)\"\n  apply (rule_tac l=\"partition_label R\" and ep=\"partition_label R\" in affects_recv)\n  apply simp_all\ndone\n\nlemma r_affects_a : \"partition_label NicA \\<in> subjectAffects SACAuthGraph (partition_label R)\"\n  apply (rule_tac l=\"partition_label R\" and ep=\"partition_label R\" and l'=\"partition_label RM\" and auth=\"Receive\" in affects_reset)\n  apply auto\ndone\n\nlemma r_affects_ntfn3 : \"partition_label NTFN3 \\<in> subjectAffects SACAuthGraph (partition_label R)\"\n  apply (rule_tac l=\"partition_label R\" and auth=\"Receive\" in affects_ep)\n  apply simp_all\ndone\n\nlemma r_affects_ntfn2 : \"partition_label NTFN2 \\<in> subjectAffects SACAuthGraph (partition_label R)\"\n  apply (rule_tac l=\"partition_label R\" in affects_ep_bound_trans)\n  by auto\n\nlemma r_affects_ep : \"partition_label EP \\<in> subjectAffects SACAuthGraph (partition_label R)\"\n  apply (rule_tac l=\"partition_label R\" in affects_ep_bound_trans)\n  by auto\n\nlemma r_affects : \"subjectAffects SACAuthGraph (partition_label R) =\n                   {partition_label NicB, partition_label NicD, partition_label R,\n                    partition_label RM, partition_label NicA, partition_label NTFN3,\n                    partition_label EP, partition_label NTFN2 \\<comment> \\<open>these 2 added for NTFN binding\\<close> }\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI)\n  apply (erule insertE, rule r_affects_bd, simp)\n  apply (erule insertE, rule r_affects_bd, simp)\n  apply (erule insertE, simp only:, rule affects_lrefl)\n  apply (erule insertE, simp only:, rule r_affects_rm)\n  apply (erule insertE, simp only:, rule r_affects_a)\n  apply (erule insertE, simp only:, rule r_affects_ntfn3)\n  apply (erule insertE, simp only:, rule r_affects_ep)\n  apply (erule insertE, simp only:, rule r_affects_ntfn2)\n  apply simp\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectAffects.induct)\n  by (simp, blast?)+\n\nsubsection \\<open>RM reads/affects\\<close>\n\nlemma rm_reads_sc : \"partition_label SC \\<in> subjectReads SACAuthGraph (partition_label RM)\"\n  apply (rule_tac a=\"partition_label RM\" and auth=\"Receive\" and ep=\"partition_label EP\" in read_sync_ep_read_senders)\n  apply (simp_all add:reads_ep)\ndone\n\nlemma rm_reads_c : \"partition_label NicC \\<in> subjectReads SACAuthGraph (partition_label RM)\"\n  apply (rule_tac t=\"partition_label SC\" in reads_read_thread_read_pages)\n  apply (rule rm_reads_sc, simp)\ndone\n\nlemma rm_reads : \"subjectReads SACAuthGraph (partition_label RM) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI)\n  apply (erule insertE, simp only:, rule reads_read, simp)\n  apply (erule insertE, simp only:, rule reads_lrefl)\n  apply (erule insertE, simp only:, rule reads_read, simp)\n  apply (erule insertE, simp only:, rule reads_read, simp)\n  apply (erule insertE, simp only:, rule reads_read, simp)\n  apply (erule insertE, simp only:, rule reads_ep, simp, simp)\n  apply (erule insertE, simp only:, rule rm_reads_sc)\n  apply (erule insertE, simp only:, rule rm_reads_c)\n  apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule rm_reads_sc)\n  apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule reads_lrefl)\n  apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule reads_read, simp)\n  apply simp\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectReads.induct)\n  by (simp, blast?)+\n\nlemma rm_affects_via_control : \"x \\<in> {partition_label R, partition_label NicA, partition_label NicB, partition_label NicD} \\<Longrightarrow> x \\<in> subjectAffects SACAuthGraph (partition_label RM)\"\n  apply (rule_tac l=\"partition_label RM\" and auth=\"Control\" in affects_write)\n  apply (simp, simp)\ndone\n\nlemma rm_affects_ep : \"partition_label EP \\<in> subjectAffects SACAuthGraph (partition_label RM)\"\n  apply (rule_tac auth=\"Receive\" in affects_ep)\n  apply simp_all\ndone\n\nlemma rm_affects_sc : \"partition_label SC \\<in> subjectAffects SACAuthGraph (partition_label RM)\"\n  apply (rule_tac l=\"partition_label RM\" and ep=\"partition_label EP\" in affects_recv)\n  apply simp_all\ndone\n\nlemma rm_affects_ntfn2 : \"partition_label NTFN2 \\<in> subjectAffects SACAuthGraph (partition_label RM)\"\n  apply (rule_tac l=\"partition_label RM\" and auth=\"Receive\" in affects_ep)\n  apply simp_all\ndone\n\nlemma rm_affects_ntfn3 : \"partition_label NTFN3 \\<in> subjectAffects SACAuthGraph (partition_label RM)\"\n  apply (rule_tac l=\"partition_label RM\" in affects_ep_bound_trans)\n  apply clarsimp\n  by auto\n\n\nlemma rm_affects : \"subjectAffects SACAuthGraph (partition_label RM) =\n                    {partition_label NicA, partition_label NicB, partition_label NicD,\n                     partition_label R, partition_label SC, partition_label EP,\n                     partition_label RM, partition_label NTFN2,\n                     partition_label NTFN3 \\<comment> \\<open>added for NTFN binding\\<close>}\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI)\n  apply (erule insertE, simp only:, rule rm_affects_via_control, simp)\n  apply (erule insertE, simp only:, rule rm_affects_via_control, simp)\n  apply (erule insertE, simp only:, rule rm_affects_via_control, simp)\n  apply (erule insertE, simp only:, rule rm_affects_via_control, simp)\n  apply (erule insertE, simp only:, rule rm_affects_sc)\n  apply (erule insertE, simp only:, rule rm_affects_ep)\n  apply (erule insertE, simp only:, rule affects_lrefl)\n  apply (erule insertE, simp only:, rule rm_affects_ntfn2)\n  apply (erule insertE, simp only:, rule rm_affects_ntfn3)\n  apply simp\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectAffects.induct)\n  by (simp, blast?)+\n\nsubsection \\<open>SC\\<close>\n\nlemma sc_reads_rm : \"partition_label RM \\<in> subjectReads SACAuthGraph (partition_label SC)\"\n  apply (rule_tac a=\"partition_label SC\" and ep=\"partition_label EP\" and auth=\"SyncSend\" and b=\"partition_label RM\" in read_sync_ep_read_receivers)\n  apply (simp_all add:reads_ep)\ndone\n\nlemma sc_reads : \"subjectReads SACAuthGraph (partition_label SC) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI)\n  apply (erule insertE, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\napply (erule insertE, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\napply (erule insertE, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\napply (erule insertE, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\napply (erule insertE, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\n  apply (erule insertE, simp only:, rule_tac auth=\"SyncSend\" in reads_ep, simp, simp)\n  apply (erule insertE, simp only:, rule reads_lrefl)\n  apply (erule insertE, simp only:, rule reads_read, simp)\n  apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule reads_lrefl)\n  apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule sc_reads_rm)\n  apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule reads_all_rm_controlled_subjects, rule sc_reads_rm, simp)\n  apply simp\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectReads.induct)\n  apply (simp, blast?)+\ndone\n\nlemma sc_affects_all_rm_controls : \"l \\<in> RMControls \\<Longrightarrow> l \\<in> subjectAffects SACAuthGraph (partition_label SC)\"\n  apply (simp only:RMControls_def)\n  apply (erule insertE, rule_tac l=\"partition_label SC\" and auth=\"SyncSend\" and ep=\"partition_label EP\" and l'=\"partition_label RM\" in affects_send, simp, simp, simp, simp)+\n  apply simp\ndone\n\nlemma sc_affects : \"subjectAffects SACAuthGraph (partition_label SC) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1}\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI)\n  apply (erule insertE, rule sc_affects_all_rm_controls, simp)\n  apply (erule insertE, rule sc_affects_all_rm_controls, simp)\n  apply (erule insertE, rule sc_affects_all_rm_controls, simp)\n  apply (erule insertE, rule sc_affects_all_rm_controls, simp)\n  apply (erule insertE, rule sc_affects_all_rm_controls, simp)\n  apply (erule insertE, simp only:, rule_tac l=\"partition_label SC\" and auth=\"SyncSend\" in affects_ep, simp, simp)\n  apply (erule insertE, simp only:, rule affects_lrefl)\n  apply (erule insertE, simp only:, rule_tac l=\"partition_label SC\" and auth=\"Write\" in affects_write, simp, simp)\n  apply (erule insertE, simp only:, rule_tac l=\"partition_label SC\" and auth=\"Receive\" in affects_ep, simp, simp)\n  apply simp\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectAffects.induct)\n  apply (simp, blast?)+\ndone\n\nsubsection \\<open>EP\\<close>\n\nlemma ep_reads_sc : \"partition_label SC \\<in> subjectReads SACAuthGraph (partition_label EP)\"\n  apply (rule_tac a=\"partition_label EP\" and ep=\"partition_label EP\" and auth=\"Receive\" in read_sync_ep_read_senders)\n  apply (simp, simp, rule reads_lrefl, simp_all)\ndone\n\nlemma ep_reads_rm : \"partition_label RM \\<in> subjectReads SACAuthGraph (partition_label EP)\"\n  apply (rule_tac a=\"partition_label SC\" and ep=\"partition_label EP\" and b=\"partition_label RM\" and auth=\"SyncSend\" in read_sync_ep_read_receivers)\n  apply (simp, simp, rule reads_lrefl, simp)\ndone\n\nlemma ep_reads_c : \"partition_label NicC \\<in> subjectReads SACAuthGraph (partition_label EP)\"\n  apply (rule_tac t=\"partition_label SC\" and p=\"partition_label NicC\" in reads_read_thread_read_pages)\n  apply (rule ep_reads_sc, simp)\ndone\n\nlemma ep_reads : \"subjectReads SACAuthGraph (partition_label EP) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI)\n  apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp)\n  apply (erule insertE, simp only:, rule ep_reads_rm)\n  apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp)\n  apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp)\n  apply (erule insertE, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp)\n  apply (erule insertE, simp only:, rule reads_lrefl)\n  apply (erule insertE, simp only:, rule ep_reads_sc)\n  apply (erule insertE, simp only:, rule ep_reads_c)\n  apply (erule insertE, simp only:, rule reads_ntfn1_via_sc, rule ep_reads_sc)\n  apply (erule insertE, simp only:, rule reads_ntfn2_via_rm, rule ep_reads_rm)\n  apply (erule insertE, simp only:, rule reads_ntfn3_via_r, rule reads_all_rm_controlled_subjects, rule ep_reads_rm, simp)\n  apply simp\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectReads.induct)\n  apply (simp, blast?)+\ndone\n\nlemma ep_affects_sc : \"partition_label SC \\<in> subjectAffects SACAuthGraph (partition_label EP)\"\n  apply (rule_tac l=\"partition_label EP\" and ep=\"partition_label EP\" in affects_recv)\n  apply simp_all\ndone\n\nlemma ep_affects_c : \"partition_label NicC \\<in> subjectAffects SACAuthGraph (partition_label EP)\"\n  apply (rule_tac l=\"partition_label EP\" and l'=\"partition_label SC\" and auth=\"SyncSend\" and ep=\"partition_label EP\" in affects_reset)\n  apply simp_all\ndone\n\nlemma ep_affects_ntfn2 : \"partition_label NTFN2 \\<in> subjectAffects SACAuthGraph (partition_label EP)\"\n  apply (rule_tac ep=\"partition_label NTFN2\" in affects_ep_bound_trans)\n  by auto\n\nlemma ep_affects_rm_controls : \"x \\<in> RMControls \\<Longrightarrow> x \\<in> subjectAffects SACAuthGraph (partition_label EP)\"\n  apply (rule_tac l=\"partition_label EP\" and ep=\"partition_label EP\" and auth=\"SyncSend\" and l'=\"partition_label RM\" in affects_send)\n  apply (simp_all)\ndone\n\nlemma ep_affects: \"subjectAffects SACAuthGraph (partition_label EP) = {partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN2} \\<union> RMControls\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI)\n  apply (erule UnE)\n  apply (erule insertE, simp only:, rule affects_lrefl)\n  apply (erule insertE, simp only:, rule ep_affects_sc)\n  apply (erule insertE, simp only:, rule ep_affects_c)\n  apply (erule insertE, simp only:, rule ep_affects_ntfn2)\n  apply simp\n  apply (rule ep_affects_rm_controls, simp)\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectAffects.induct)\n  by (simp, blast?)+\n\nsubsection \\<open>NTFN1,2,3\\<close>\n\nsubsubsection \\<open>NTFN1 reads SC, EP, RM, R\\<close>\n\nlemma ntfn1_reads_sc : \"partition_label SC \\<in> subjectReads SACAuthGraph (partition_label NTFN1)\"\n  apply (rule_tac ep=\"partition_label NTFN1\" and auth=\"SyncSend\" and a=\"partition_label NTFN1\" in read_sync_ep_read_receivers)\n  apply (simp, simp, rule reads_lrefl, simp)\ndone\n\nlemma ntfn1_reads_ep : \"partition_label EP \\<in> subjectReads SACAuthGraph (partition_label NTFN1)\"\n  apply (rule_tac ep=\"partition_label EP\" and auth=\"SyncSend\" and t=\"partition_label SC\" and auth'=\"Reset\" and a=\"partition_label EP\" in reads_read_queued_thread_read_ep)\n  apply (simp, simp, simp, simp, rule ntfn1_reads_sc)\ndone\n\nlemma ntfn1_reads_rm : \"partition_label RM \\<in> subjectReads SACAuthGraph (partition_label NTFN1)\"\n  apply (rule_tac b=\"partition_label RM\" and ep=\"partition_label EP\" and auth=\"SyncSend\" and a=\"partition_label SC\" in read_sync_ep_read_receivers)\n  apply (simp, simp, rule ntfn1_reads_ep, simp)\ndone\n\nsubsubsection \\<open>NTFN2 reads SC, EP, RM, R\\<close>\n\nlemma ntfn2_reads_rm : \"partition_label RM \\<in> subjectReads SACAuthGraph (partition_label NTFN2)\"\n  apply (rule_tac ep=\"partition_label NTFN2\" and auth=\"SyncSend\" and a=\"partition_label NTFN2\" in read_sync_ep_read_receivers)\n  apply (simp, simp, rule reads_lrefl, simp)\ndone\n\nlemma ntfn2_reads_ep : \"partition_label EP \\<in> subjectReads SACAuthGraph (partition_label NTFN2)\"\n  apply (rule_tac ep=\"partition_label EP\" and auth=\"Receive\" and t=\"partition_label RM\" and auth'=\"Reset\" and a=\"partition_label EP\" in reads_read_queued_thread_read_ep)\n  apply (simp, simp, simp, simp, rule ntfn2_reads_rm)\ndone\n\nlemma ntfn2_reads_sc : \"partition_label SC \\<in> subjectReads SACAuthGraph (partition_label NTFN2)\"\n  apply (rule_tac b=\"partition_label SC\" and ep=\"partition_label EP\" and auth=\"Reset\" and a=\"partition_label EP\" in read_sync_ep_read_senders)\n  apply (simp, simp, rule ntfn2_reads_ep, simp)\ndone\n\nsubsubsection \\<open>NTFN3 reads SC, EP, RM, R\\<close>\n\nlemma ntfn3_reads_r : \"partition_label R \\<in> subjectReads SACAuthGraph (partition_label NTFN3)\"\n  apply (rule_tac ep=\"partition_label NTFN3\" and auth=\"SyncSend\" and a=\"partition_label NTFN3\" in read_sync_ep_read_receivers)\n  apply (simp, simp, rule reads_lrefl, simp)\ndone\n\nlemma ntfn3_reads_rm : \"partition_label RM \\<in> subjectReads SACAuthGraph (partition_label NTFN3)\"\n  apply (rule_tac b=\"partition_label R\" in reads_read_page_read_thread)\n  apply (rule ntfn3_reads_r, simp)\ndone\n\nlemma ntfn3_reads_ep : \"partition_label EP \\<in> subjectReads SACAuthGraph (partition_label NTFN3)\"\n  apply (rule_tac t=\"partition_label RM\" and auth=\"Receive\" and auth'=\"SyncSend\" and a=\"partition_label SC\" in reads_read_queued_thread_read_ep)\n  apply (simp, simp, simp, simp, rule ntfn3_reads_rm)\ndone\n\nlemma ntfn3_reads_sc : \"partition_label SC \\<in> subjectReads SACAuthGraph (partition_label NTFN3)\"\n  apply (rule_tac ep=\"partition_label EP\" and auth=\"Receive\" and a=\"partition_label RM\" in read_sync_ep_read_senders)\n  apply (simp, simp, rule ntfn3_reads_ep, simp)\ndone\n\nsubsubsection \\<open>NTFN1,2,3 reads C\\<close>\n\nlemma ntfn123_reads_c : \"x \\<in> {NTFN1, NTFN2, NTFN3} \\<Longrightarrow> partition_label NicC \\<in> subjectReads SACAuthGraph (partition_label x)\"\n  apply (rule_tac t=\"partition_label SC\" in reads_read_thread_read_pages)\n  apply (erule insertE, simp only:, rule ntfn1_reads_sc, erule insertE, simp only:, rule ntfn2_reads_sc, erule insertE, simp only:, rule ntfn3_reads_sc, simp)\n  apply simp\ndone\n\nsubsubsection \\<open>NTFN1,2,3 reads each other\\<close>\n\nlemma ntfn13_reads_ntfn2 : \"l \\<in> {NTFN1, NTFN3} \\<Longrightarrow> partition_label NTFN2 \\<in> subjectReads SACAuthGraph (partition_label l)\"\n  apply (rule_tac t=\"partition_label RM\" and auth=\"Receive\" and auth'=\"Reset\" and a=\"partition_label NTFN2\" in reads_read_queued_thread_read_ep)\n  apply (simp, simp, simp, simp)\n  apply (erule insertE, simp only:, rule ntfn1_reads_rm, erule insertE, simp only:, rule ntfn3_reads_rm, simp)\ndone\n\nlemma ntfn12_reads_ntfn3 : \"l \\<in> {NTFN1, NTFN2} \\<Longrightarrow> partition_label NTFN3 \\<in> subjectReads SACAuthGraph (partition_label l)\"\n  apply (rule_tac t=\"partition_label R\" and auth=\"Receive\" and auth'=\"Reset\" and a=\"partition_label NTFN3\" in reads_read_queued_thread_read_ep)\n  apply (simp, simp, simp, simp)\n  apply (erule insertE, simp only:, rule reads_all_rm_controlled_subjects, rule ntfn1_reads_rm, simp, erule insertE, simp only:, rule reads_all_rm_controlled_subjects, rule ntfn2_reads_rm, simp_all)\ndone\n\nlemma ntfn23_reads_ntfn1 : \"l \\<in> {NTFN2, NTFN3} \\<Longrightarrow> partition_label NTFN1 \\<in> subjectReads SACAuthGraph (partition_label l)\"\n  apply (rule_tac t=\"partition_label SC\" and auth=\"Receive\" and auth'=\"Reset\" and a=\"partition_label NTFN1\" in reads_read_queued_thread_read_ep)\n  apply (simp, simp, simp, simp)\n  apply (erule insertE, simp only:, rule ntfn2_reads_sc, erule insertE, simp only:, rule ntfn3_reads_sc, simp)\ndone\n\nsubsubsection \\<open>NTFN1,2,3 reads\\<close>\ndeclare SACAuthGraph_def[simp del]\n\nlemma ntfn123_reads_rm : \"l \\<in> {NTFN1, NTFN2, NTFN3} \\<Longrightarrow> partition_label RM \\<in> subjectReads SACAuthGraph (partition_label l)\"\nby (auto simp:ntfn1_reads_rm ntfn2_reads_rm ntfn3_reads_rm)\n\nlemma ntfn123_reads_sc : \"l \\<in> {NTFN1, NTFN2, NTFN3} \\<Longrightarrow> partition_label SC \\<in> subjectReads SACAuthGraph (partition_label l)\"\nby (auto simp:ntfn1_reads_sc ntfn2_reads_sc ntfn3_reads_sc)\n\nlemma ntfn123_reads_ep : \"l \\<in> {NTFN1, NTFN2, NTFN3} \\<Longrightarrow> partition_label EP \\<in> subjectReads SACAuthGraph (partition_label l)\"\nby (auto simp:ntfn1_reads_ep ntfn2_reads_ep ntfn3_reads_ep)\n\nlemma ntfn123_reads_ntfn123 : \"\\<lbrakk>l \\<in> {NTFN1, NTFN2, NTFN3}; x \\<in> {NTFN1, NTFN2, NTFN3}\\<rbrakk> \\<Longrightarrow> partition_label l \\<in> subjectReads SACAuthGraph (partition_label x)\"\nby (auto simp:ntfn12_reads_ntfn3 ntfn13_reads_ntfn2 ntfn23_reads_ntfn1)\n\nlemma ntfn123_reads : \"l \\<in> {NTFN1, NTFN2, NTFN3} \\<Longrightarrow> subjectReads SACAuthGraph (partition_label l) = {partition_label NicB, partition_label RM, partition_label R, partition_label NicA, partition_label NicD, partition_label EP, partition_label SC, partition_label NicC, partition_label NTFN1, partition_label NTFN2, partition_label NTFN3}\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI)\n  apply (erule_tac a=x in insertE, rule reads_all_rm_controlled_subjects, rule ntfn123_reads_rm, simp, simp)\n  apply (erule_tac a=x in insertE, simp only:, rule ntfn123_reads_rm, simp)\n  apply (erule_tac a=x in insertE, rule reads_all_rm_controlled_subjects, rule ntfn123_reads_rm, simp, simp)\n  apply (erule_tac a=x in insertE, rule reads_all_rm_controlled_subjects, rule ntfn123_reads_rm, simp, simp)\n  apply (erule_tac a=x in insertE, rule reads_all_rm_controlled_subjects, rule ntfn123_reads_rm, simp, simp)\n  apply (erule_tac a=x in insertE, simp only:, rule ntfn123_reads_ep, simp)\n  apply (erule_tac a=x in insertE, simp only:, rule ntfn123_reads_sc, simp)\n  apply (erule_tac a=x in insertE, simp only:, rule ntfn123_reads_c, simp)\n  apply (auto simp:ntfn123_reads_ntfn123)[1]\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectReads.induct)\n  by (simp add:SACAuthGraph_def, blast?)+\n\nsubsubsection \\<open>NTFN1,2,3 affects\\<close>\n\nlemma ntfn1_affects_sc : \"partition_label SC \\<in> subjectAffects SACAuthGraph (partition_label NTFN1)\"\n  apply (rule_tac l''=\"partition_label SC\" and l'=\"partition_label SC\" and ep=\"partition_label NTFN1\" and auth=\"Notify\" and l=\"partition_label NTFN1\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma ntfn1_affects_c : \"partition_label NicC \\<in> subjectAffects SACAuthGraph (partition_label NTFN1)\"\n  apply (rule_tac l'=\"partition_label SC\" and ep=\"partition_label NTFN1\" and l=\"partition_label NTFN1\" and auth=\"Notify\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma ntfn1_affects : \"subjectAffects SACAuthGraph (partition_label NTFN1) = {partition_label NTFN1, partition_label SC, partition_label NicC}\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI)\n  apply (erule insertE, simp only:, rule affects_lrefl)\n  apply (erule insertE, simp only:, rule ntfn1_affects_sc)\n  apply (erule insertE, simp only:, rule ntfn1_affects_c)\n  apply simp\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectAffects.induct)\n  apply (simp add:SACAuthGraph_def, blast?)+\ndone\n\nlemma ntfn2_affects_rm : \"partition_label RM \\<in> subjectAffects SACAuthGraph (partition_label NTFN2)\"\n  apply (rule_tac l'=\"partition_label RM\" and ep=\"partition_label NTFN2\" and auth=\"Notify\" and l=\"partition_label NTFN2\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma ntfn2_affects_ep : \"partition_label EP \\<in> subjectAffects SACAuthGraph (partition_label NTFN2)\"\n  apply (rule affects_ep_bound_trans)\n  by (auto simp: SACAuthGraph_def)\n\nlemma ntfn2_affects_rm_controls : \"x \\<in> RMControls \\<Longrightarrow> x \\<in> subjectAffects SACAuthGraph (partition_label NTFN2)\"\n  apply (rule_tac l=\"partition_label NTFN2\" and ep=\"partition_label NTFN2\" and auth=\"SyncSend\" and l'=\"partition_label RM\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma ntfn2_affects : \"subjectAffects SACAuthGraph (partition_label NTFN2) = {partition_label NTFN2, partition_label RM, partition_label EP} \\<union> RMControls\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI)\n  apply (erule UnE)\n  apply (erule insertE, simp only:, rule affects_lrefl)\n  apply (erule insertE, simp only:, rule ntfn2_affects_rm)\n  apply (erule insertE, simp only:, rule ntfn2_affects_ep)\n  apply simp\n  apply (rule ntfn2_affects_rm_controls, simp)\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectAffects.induct)\n  by (simp add:SACAuthGraph_def, blast?)+\n\nlemma ntfn3_affects_r : \"partition_label R \\<in> subjectAffects SACAuthGraph (partition_label NTFN3)\"\n  apply (rule_tac l'=\"partition_label R\" and ep=\"partition_label NTFN3\" and auth=\"Notify\" and l=\"partition_label NTFN3\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma ntfn3_affects_bd : \"l \\<in> {NicB, NicD} \\<Longrightarrow> partition_label l \\<in> subjectAffects SACAuthGraph (partition_label NTFN3)\"\n  apply (rule_tac l'=\"partition_label R\" and ep=\"partition_label NTFN3\" and l=\"partition_label NTFN3\" and auth=\"Notify\" in affects_send)\n  apply (simp add:SACAuthGraph_def, blast?)+\ndone\n\nlemma ntfn3_affects : \"subjectAffects SACAuthGraph (partition_label NTFN3) = {partition_label NTFN3, partition_label R} \\<union> {partition_label NicB, partition_label NicD}\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI, erule UnE)\n  apply (erule insertE, simp only:, rule affects_lrefl)\n  apply (erule insertE, simp only:, rule ntfn3_affects_r, simp)\n  apply (auto simp:ntfn3_affects_bd)[1]\n  (* forward *)\n  apply (rule subsetI)\n  apply (erule subjectAffects.induct)\n  apply (simp add:SACAuthGraph_def, blast?)+\ndone\n\nsubsection \\<open>T\\<close>\n\nlemma t_reads : \"subjectReads SACAuthGraph (partition_label T) = {partition_label T}\"\n  apply (rule subset_antisym)\n  defer\n  apply (rule subsetI, erule insertE, simp only:, rule reads_lrefl, simp)\n  apply (rule subsetI, erule subjectReads.induct)\n  apply (simp add:SACAuthGraph_def, blast?)+\ndone\n\nlemma t_affects_ntfn123 : \"l \\<in> {NTFN1, NTFN2, NTFN3} \\<Longrightarrow>  partition_label l \\<in> subjectAffects SACAuthGraph (partition_label T)\"\n  apply (rule_tac auth=\"Notify\" in affects_ep)\n  apply (simp_all add:SACAuthGraph_def, blast)\ndone\n\nlemma t_affects_sc : \"partition_label SC \\<in> subjectAffects SACAuthGraph (partition_label T)\"\n  apply (rule_tac l''=\"partition_label SC\" and l'=\"partition_label SC\" and ep=\"partition_label NTFN1\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma t_affects_rm : \"partition_label RM \\<in> subjectAffects SACAuthGraph (partition_label T)\"\n  apply (rule_tac l''=\"partition_label RM\" and l'=\"partition_label RM\" and ep=\"partition_label NTFN2\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma t_affects_r : \"partition_label R \\<in> subjectAffects SACAuthGraph (partition_label T)\"\n  apply (rule_tac l''=\"partition_label R\" and l'=\"partition_label R\" and ep=\"partition_label NTFN3\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma t_affects_ep : \"partition_label EP \\<in> subjectAffects SACAuthGraph (partition_label T)\"\n  apply (rule affects_ep_bound_trans)\n  by (auto simp: SACAuthGraph_def)\n\nlemma t_affects_c : \"partition_label NicC \\<in> subjectAffects SACAuthGraph (partition_label T)\"\n  apply (rule_tac l''=\"partition_label NicC\" and l'=\"partition_label SC\" and ep=\"partition_label NTFN1\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma t_affects_a : \"partition_label NicA \\<in> subjectAffects SACAuthGraph (partition_label T)\"\n  apply (rule_tac l''=\"partition_label NicA\" and l'=\"partition_label RM\" and ep=\"partition_label NTFN2\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def)\ndone\n\nlemma t_affects_bd : \"l \\<in> {NicB, NicD} \\<Longrightarrow> partition_label l \\<in> subjectAffects SACAuthGraph (partition_label T)\"\n  apply (rule_tac l'=\"partition_label R\" and ep=\"partition_label NTFN3\" and auth=\"Notify\" and l=\"partition_label T\" in affects_send)\n  apply (simp_all add:SACAuthGraph_def, blast)\ndone\n\nlemma t_affects : \"subjectAffects SACAuthGraph (partition_label T) = {partition_label NTFN1, partition_label NTFN2, partition_label NTFN3} \\<union> {partition_label T, partition_label SC, partition_label RM, partition_label R, partition_label NicA, partition_label NicB, partition_label NicD, partition_label NicC, partition_label EP}\"\n  apply (rule subset_antisym)\n  defer\n  (* backward *)\n  apply (rule subsetI, erule UnE)\n  apply (auto simp:t_affects_ntfn123)[1]\n  apply (erule insertE, simp only:, rule affects_lrefl)\n  apply (erule insertE, simp only:, rule t_affects_sc)\n  apply (erule insertE, simp only:, rule t_affects_rm)\n  apply (erule insertE, simp only:, rule t_affects_r)\n  apply (erule insertE, simp only:, rule t_affects_a)\n  apply (erule insertE, simp only:, rule t_affects_bd, simp)\n  apply (erule insertE, simp only:, rule t_affects_bd, simp)\n  apply (erule insertE, simp only:, rule t_affects_c)\n  apply (erule insertE, simp only:, rule t_affects_ep)\n  apply simp\n  (* forward *)\n  apply (rule subsetI, erule subjectAffects.induct)\n  by (simp add:SACAuthGraph_def, blast?)+\n\nsubsection \\<open>Policy\\<close>\n\nlemmas SAC_reads = sc_reads ep_reads c_reads rm_reads r_reads abd_reads ntfn123_reads t_reads\n\nlemmas SAC_affects = sc_affects ep_affects c_affects rm_affects r_affects abd_affects ntfn1_affects ntfn2_affects ntfn3_affects t_affects\n\ndefinition SACFlowDoms where\n  \"SACFlowDoms \\<equiv> {Partition EP, Partition SC, Partition NicC, Partition RM, Partition R, Partition NicA, Partition NicB, Partition NicD, Partition NTFN1, Partition NTFN2, Partition NTFN3}\"\ndeclare SACFlowDoms_def [simp]\n\ndefinition SACPolicyFlows :: \"(SACLabels partition \\<times> SACLabels partition) set\" where\n  \"SACPolicyFlows \\<equiv>\n     {(PSched,d)| d. True}\n   \\<union> {(Partition l, Partition k)| l k. (k = T \\<longrightarrow> l = T)}\"\n\nlemma SAC_partsSubjectAffects_exceptT : \"x \\<noteq> T \\<Longrightarrow> partsSubjectAffects SACAuthGraph x = SACFlowDoms\"\n  apply (rule equalityI)\n  defer\n  apply (rule subsetI)\n    apply (simp add:partsSubjectAffects_def image_def label_can_affect_partition_def)\n    apply (case_tac x)\n     apply ((erule disjE, clarify, simp add:SAC_affects SAC_reads, blast?)+, simp add:SAC_affects SAC_reads, blast?)+\n  apply (rule subsetI)\n    apply (simp add:partsSubjectAffects_def image_def label_can_affect_partition_def)\n    apply (clarify)\n    apply (case_tac x)\n      apply (case_tac[!] xaa)\n        apply (auto simp: SAC_affects SAC_reads)\ndone\n\nlemma SAC_partsSubjectAffects_T : \"(partsSubjectAffects SACAuthGraph T) = {Partition NTFN1, Partition NTFN2, Partition NTFN3} \\<union> {Partition T, Partition SC, Partition RM, Partition R, Partition NicA, Partition NicB, Partition NicD, Partition NicC, Partition EP}\"\n    apply (rule equalityI)\n    apply (rule subsetI)\n    apply (simp add: partsSubjectAffects_def image_def label_can_affect_partition_def SAC_affects SAC_reads)\n    apply (clarify)\n    apply (case_tac xa, simp_all)[1]\n    apply (rule subsetI)\n    apply (simp add: partsSubjectAffects_def image_def label_can_affect_partition_def SAC_affects SAC_reads)\n    apply (erule disjE, simp add: SAC_reads) (* Do not collapse this in with a blast? because attempting blast takes too long *)\n    apply ((erule disjE)?, simp add: SAC_reads, blast)+\ndone\n\nlemma SAC_policyFlows : \"policyFlows SACAuthGraph = SACPolicyFlows\"\n  apply (rule subset_antisym)\n  (* forward *)\n  apply (rule subsetI)\n  apply clarify\n  apply (erule policyFlows.cases)\n    (* subject case *)\n    apply (clarsimp simp:SACPolicyFlows_def)\n    apply (case_tac \"d = Partition T\")\n      apply (case_tac l, auto simp:SAC_partsSubjectAffects_T SAC_partsSubjectAffects_exceptT)[1]\n      apply (case_tac l, auto simp:SAC_partsSubjectAffects_T SAC_partsSubjectAffects_exceptT)[1]\n    (* scheduler case *)\n    apply (simp add:SACPolicyFlows_def)\n  (* backward *)\n  apply (rule subsetI)\n  apply (clarsimp simp:SACPolicyFlows_def)\n  apply (erule disjE)\n    (* scheduler flows to all *)\n    apply (simp add:PSched_flows_to_all)\n    (* all subjects flow to all subjects *)\n    apply (clarify, simp)\n    apply (rule policy_affects)\n    apply (case_tac l, case_tac[1-12] k, auto simp:SAC_partsSubjectAffects_T SAC_partsSubjectAffects_exceptT)\ndone\n\nend\n", "meta": {"author": "NICTA", "repo": "l4v", "sha": "3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b", "save_path": "github-repos/isabelle/NICTA-l4v", "path": "github-repos/isabelle/NICTA-l4v/l4v-3c3514fe99082f7b6a6fb8445b8dfc592ff7f02b/proof/infoflow/PolicySystemSAC.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.607663184043154, "lm_q2_score": 0.5, "lm_q1q2_score": 0.303831592021577}}
{"text": "theory NoCardinalityAnalysis\nimports CardinalityAnalysisSpec ArityAnalysisStack\nbegin\n\nlocale NoCardinalityAnalysis = ArityAnalysisLetSafe +\n  assumes Aheap_thunk: \"x \\<in> thunks \\<Gamma> \\<Longrightarrow> (Aheap \\<Gamma> e\\<cdot>a) x = up\\<cdot>0\"\nbegin\n\ndefinition a2c :: \"Arity\\<^sub>\\<bottom> \\<rightarrow> two\" where \"a2c = (\\<Lambda> a. if a \\<sqsubseteq> \\<bottom> then \\<bottom> else many)\"\nlemma a2c_simp: \"a2c\\<cdot>a = (if a \\<sqsubseteq> \\<bottom> then \\<bottom> else many)\"\n  unfolding a2c_def by (rule beta_cfun[OF cont_if_else_above]) auto\n\n\nlemma a2c_eqvt[eqvt]: \"\\<pi> \\<bullet> a2c = a2c\"\n  unfolding a2c_def\n  apply perm_simp\n  apply (rule Abs_cfun_eqvt)\n  apply (rule cont_if_else_above)\n  apply auto\n  done\n\ndefinition ae2ce :: \"AEnv \\<Rightarrow> (var \\<Rightarrow> two)\" where \"ae2ce ae x = a2c\\<cdot>(ae x)\"\n\nlemma ae2ce_cont: \"cont ae2ce\"\n  by (auto simp add: ae2ce_def) \nlemmas cont_compose[OF ae2ce_cont, cont2cont, simp]\n\nlemma ae2ce_eqvt[eqvt]: \"\\<pi> \\<bullet> ae2ce ae x = ae2ce (\\<pi> \\<bullet> ae) (\\<pi> \\<bullet> x)\"\n  unfolding ae2ce_def by perm_simp rule\n\nlemma ae2ce_to_env_restr: \"ae2ce ae = (\\<lambda>_ . many) f|` edom ae\"\n  by (auto simp add: ae2ce_def lookup_env_restr_eq edom_def a2c_simp)\n\nlemma edom_ae2ce[simp]: \"edom (ae2ce ae) = edom ae\"\n  unfolding edom_def\n  by (auto simp add: ae2ce_def  a2c_simp)\n\n\ndefinition cHeap :: \"heap \\<Rightarrow> exp \\<Rightarrow> Arity \\<rightarrow> (var \\<Rightarrow> two)\"\n  where \"cHeap \\<Gamma> e = (\\<Lambda> a. ae2ce (Aheap \\<Gamma> e\\<cdot>a))\"\nlemma cHeap_simp[simp]: \"cHeap \\<Gamma> e\\<cdot>a = ae2ce (Aheap \\<Gamma> e\\<cdot>a)\"\n  unfolding cHeap_def by simp\n\nsublocale CardinalityHeap cHeap.\n\nsublocale CardinalityHeapSafe cHeap Aheap\n  apply standard\n  apply (erule Aheap_thunk)\n  apply simp\n  done\n\nfun prognosis where \n  \"prognosis ae as a (\\<Gamma>, e, S) = ((\\<lambda>_. many) f|` (edom (ABinds \\<Gamma>\\<cdot>ae) \\<union> edom (Aexp e\\<cdot>a) \\<union> edom (AEstack as S)))\"\n\nlemma record_all_noop[simp]:\n  \"record_call x\\<cdot>((\\<lambda>_. many) f|` S) = (\\<lambda>_. many) f|` S\"\n  by (auto simp add: record_call_def lookup_env_restr_eq)\n\nlemma const_on_restr_constI[intro]:\n  \"S' \\<subseteq> S \\<Longrightarrow> const_on ((\\<lambda> _. x) f|` S) S' x\"\n  by fastforce\n\nlemma ap_subset_edom_AEstack: \"ap S \\<subseteq> edom (AEstack as S)\"\n  by (induction as S rule:AEstack.induct) (auto simp del: fun_meet_simp)\n  \n\nsublocale CardinalityPrognosis prognosis.\n\nsublocale CardinalityPrognosisShape prognosis\nproof (standard, goal_cases)\n  case 1\n  thus ?case by (simp cong: Abinds_env_restr_cong)\nnext\n  case 2\n  thus ?case by (simp cong: Abinds_reorder)\nnext\n  case 3\n  thus ?case by (auto dest: subsetD[OF ap_subset_edom_AEstack])\nnext\n  case 4\n  thus ?case by (auto intro: env_restr_mono2 )\nnext\n  case (5 ae x as a \\<Gamma> e S)\n  from \\<open>ae x = \\<bottom>\\<close>\n  have \"ABinds (delete x \\<Gamma>)\\<cdot>ae = ABinds \\<Gamma>\\<cdot>ae\" by (rule ABinds_delete_bot)\n  thus ?case by simp\nnext\n  case (6 ae as a \\<Gamma> x S)\n  from Aexp_Var[where n = a and x = x]\n  have \"(Aexp (Var x)\\<cdot>a) x \\<noteq> \\<bottom>\" by auto\n  hence \"x \\<in> edom (Aexp (Var x)\\<cdot>a)\" by (simp add: edomIff)\n  thus ?case by simp\nqed\n\nsublocale CardinalityPrognosisApp prognosis\nproof (standard, goal_cases)\n  case 1\n  thus ?case\n    using edom_mono[OF Aexp_App] by (auto intro!: env_restr_mono2)\nqed\n\nsublocale CardinalityPrognosisLam prognosis\nproof (standard, goal_cases)\n  case (1 ae as a \\<Gamma> e y x S)\n  have \"edom (Aexp e[y::=x]\\<cdot>(pred\\<cdot>a)) \\<subseteq> insert x (edom (env_delete y (Aexp e\\<cdot>(pred\\<cdot>a))))\"\n    by (auto dest: subsetD[OF edom_mono[OF Aexp_subst]] )\n  also have \"\\<dots> \\<subseteq> insert x (edom (Aexp (Lam [y]. e)\\<cdot>a))\"\n    using edom_mono[OF Aexp_Lam] by auto\n  finally show ?case by (auto intro!: env_restr_mono2)\nqed\n\nsublocale CardinalityPrognosisVar prognosis\nproof (standard, goal_cases)\n  case prems: 1\n  thus ?case by (auto intro!: env_restr_mono2 simp add: Abinds_reorder1[OF prems(1)])\nnext\n  case prems: 2\n  thus ?case\n    by (auto intro!: env_restr_mono2 simp add: Abinds_reorder1[OF prems(1)])\n       (metis Aexp_Var edomIff not_up_less_UU)\nnext\n  case (3 e x \\<Gamma> ae as S)\n  have \"fup\\<cdot>(Aexp e)\\<cdot>(ae x) \\<sqsubseteq> Aexp e\\<cdot>0\" by (cases \"ae x\") (auto intro: monofun_cfun_arg)\n  from edom_mono[OF this]\n  show ?case by (auto intro!: env_restr_mono2 dest: subsetD[OF edom_mono[OF ABinds_delete_below]])\nqed\n\nsublocale CardinalityPrognosisIfThenElse prognosis\nproof (standard, goal_cases)\n  case (1 ae a as \\<Gamma> scrut e1 e2 S)\n  have \"edom (Aexp scrut\\<cdot>0 \\<squnion> Aexp e1\\<cdot>a \\<squnion> Aexp e2\\<cdot>a) \\<subseteq> edom (Aexp (scrut ? e1 : e2)\\<cdot>a)\"\n    by (rule edom_mono[OF Aexp_IfThenElse])\n  thus ?case\n    by (auto intro!: env_restr_mono2)\nnext\n  case (2 ae as a \\<Gamma> b e1 e2 S)\n  show ?case by (auto intro!: env_restr_mono2)\nqed\n\n  \nsublocale CardinalityPrognosisLet prognosis  cHeap Aheap\nproof (standard, goal_cases)\n  case prems: (1 \\<Delta> \\<Gamma> S ae e a as)\n\n  from subsetD[OF prems(3)] fresh_distinct[OF prems(1)] fresh_distinct_fv[OF prems(2)]\n  have  \"ae f|` domA \\<Delta> = \\<bottom>\"\n    by (auto dest: subsetD[OF ups_fv_subset])\n  hence [simp]: \"ABinds \\<Delta>\\<cdot>(ae \\<squnion> Aheap \\<Delta> e\\<cdot>a) = ABinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)\" by (simp cong: Abinds_env_restr_cong add: env_restr_join)\n\n  from  fresh_distinct[OF prems(1)]\n  have \"Aheap \\<Delta> e\\<cdot>a f|` domA \\<Gamma> = \\<bottom>\" by (auto dest!: subsetD[OF edom_Aheap])\n  hence [simp]: \"ABinds \\<Gamma>\\<cdot>(ae \\<squnion> Aheap \\<Delta> e\\<cdot>a) = ABinds \\<Gamma>\\<cdot>ae\" by (simp cong: Abinds_env_restr_cong add: env_restr_join)\n  \n  have \"edom (ABinds (\\<Delta> @ \\<Gamma>)\\<cdot>(Aheap \\<Delta> e\\<cdot>a \\<squnion> ae)) \\<union> edom (Aexp e\\<cdot>a)  = edom (ABinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a)) \\<union> edom (ABinds \\<Gamma>\\<cdot>ae) \\<union>  edom (Aexp e\\<cdot>a) \"\n    by (simp add: Abinds_append_disjoint[OF fresh_distinct[OF prems(1)]] Un_commute)\n  also have \"\\<dots> = edom (ABinds \\<Gamma>\\<cdot>ae) \\<union> edom (ABinds \\<Delta>\\<cdot>(Aheap \\<Delta> e\\<cdot>a) \\<squnion> Aexp e\\<cdot>a)\"\n    by force\n  also have \"\\<dots> \\<subseteq> edom (ABinds \\<Gamma>\\<cdot>ae) \\<union> edom (Aheap \\<Delta> e\\<cdot>a \\<squnion> Aexp (Let \\<Delta> e)\\<cdot>a)\"\n    using  edom_mono[OF Aexp_Let] by force\n  also have \"\\<dots> = edom (Aheap \\<Delta> e\\<cdot>a) \\<union> edom (ABinds \\<Gamma>\\<cdot>ae) \\<union> edom (Aexp (Let \\<Delta> e)\\<cdot>a)\"\n    by auto\n  finally\n  have \"edom (ABinds (\\<Delta> @ \\<Gamma>)\\<cdot>(Aheap \\<Delta> e\\<cdot>a \\<squnion> ae)) \\<union> edom (Aexp e\\<cdot>a) \\<subseteq> edom (Aheap \\<Delta> e\\<cdot>a) \\<union> edom (ABinds \\<Gamma>\\<cdot>ae) \\<union> edom (Aexp (Let \\<Delta> e)\\<cdot>a)\".\n  hence \"edom (ABinds (\\<Delta> @ \\<Gamma>)\\<cdot>(Aheap \\<Delta> e\\<cdot>a \\<squnion> ae)) \\<union> edom (Aexp e\\<cdot>a) \\<union> edom (AEstack as S) \\<subseteq> edom (Aheap \\<Delta> e\\<cdot>a) \\<union> edom (ABinds \\<Gamma>\\<cdot>ae) \\<union> edom (Aexp (Let \\<Delta> e)\\<cdot>a) \\<union> edom (AEstack as S)\" by auto\n  thus ?case by (simp add: ae2ce_to_env_restr env_restr_join2 Un_assoc[symmetric] env_restr_mono2)\nqed\n\nsublocale CardinalityPrognosisEdom prognosis\n  by standard (auto dest: subsetD[OF Aexp_edom] subsetD[OF ap_fv_subset] subsetD[OF edom_AnalBinds]  subsetD[OF edom_AEstack])\n\n\nsublocale CardinalityPrognosisSafe prognosis cHeap Aheap Aexp..\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Call_Arity/NoCardinalityAnalysis.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631840431539, "lm_q2_score": 0.5, "lm_q1q2_score": 0.30383159202157695}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n(*<*)\ntheory EgTop\nimports GenFilterSystem\nbegin\n(*>*)\n\nsubsection {* \\label{ssec:archprop}Architectural Properties *}\n\ntext {*\n  Using the most generalised (untrusted) version of the system, we cannot show\n  anything except architectural properties. These are true by construction of\n  the generated system. To demonstrate this, we show a proof that the\n  @{term client} and @{term store} instances cannot directly communicate.\n\n  First we introduce some definitions to aid the statement of the property. A\n  predicate specifying that a component sends on a given channel is defined as\n  @{term sends_on}.\n*}\n\nfun\n  sends_on :: \"channel \\<Rightarrow> component \\<Rightarrow> bool\"\nwhere\n   \"sends_on c (Request f _) = (\\<exists>s. \\<exists>q \\<in> f s. q_channel q = c)\"\n | \"sends_on c (a ;; b) = (sends_on c a \\<or> sends_on c b)\"\n | \"sends_on c (IF cond THEN a ELSE b) =\n     (\\<forall>s. cond s \\<and> sends_on c a \\<or> \\<not> cond s \\<and> sends_on c b)\"\n | \"sends_on c (WHILE cond DO a) = (\\<forall>s. cond s \\<and> sends_on c a \\<or> \\<not> cond s)\"\n | \"sends_on c (a \\<squnion> b) = (sends_on c a \\<or> sends_on c b)\"\n | \"sends_on _ _ = False\"\n\ntext {*\n  The corresponding predicate for receiving on a channel is defined as\n  @{term receives_on}.\n*}\n\nfun\n  receives_on :: \"channel \\<Rightarrow> component \\<Rightarrow> bool\"\nwhere\n   \"receives_on c (Response f) = (\\<exists>q s. \\<exists>a \\<in> f q s. a_channel (snd a) = c)\"\n | \"receives_on c (a ;; b) = (receives_on c a \\<or> receives_on c b)\"\n | \"receives_on c (IF cond THEN a ELSE b) =\n     (\\<forall>s. cond s \\<and> receives_on c a \\<or> \\<not> cond s \\<and> receives_on c b)\"\n | \"receives_on c (WHILE cond DO a) =\n     (\\<forall>s. cond s \\<and> receives_on c a \\<or> \\<not> cond s)\"\n | \"receives_on c (a \\<squnion> b) = (receives_on c a \\<or> receives_on c b)\"\n | \"receives_on _ _ = False\"\n\ntext {*\n  Now whether a component communicates on a channel can be defined as the\n  disjunction of these two.\n*}\n\ndefinition\n  communicates_on :: \"channel \\<Rightarrow> component \\<Rightarrow> bool\"\nwhere\n  \"communicates_on ch c \\<equiv> sends_on ch c \\<or> receives_on ch c\"\n\ntext {*\n  We can now state, and prove, the property that @{term client} and\n  @{term store} never directly communicate.\n*}\n\nlemma \"\\<forall>c.\n  \\<not>(communicates_on c client_untrusted \\<and> communicates_on c store_untrusted)\"\n  unfolding communicates_on_def client_untrusted_def Client_untrusted_def\n            store_untrusted_def Store_untrusted_def\n  apply clarsimp\n  unfolding UserStep_def ArbitraryRequest_def ArbitraryResponse_def\n  apply clarsimp\n  apply (case_tac c, clarsimp+)\n  done\n\ntext {*\n  Were we to try reasoning about a property of the system that depended upon\n  the behaviour of any component in the system, we would not be able to do it\n  using the existing definitions. To show a property of this form we need to\n  provide a more precise definition of the critical components. An example of\n  this is shown in the next section.\n*}\n\n(*<*)\n(* Whether a component ever sends a question in a given set. *)\nfun\n  sends :: \"component \\<Rightarrow> channel question set \\<Rightarrow> bool\"\nwhere\n   \"sends (Request f _) qs = (\\<exists>s. \\<exists>q \\<in> f s. q \\<in> qs)\"\n | \"sends (a ;; b) qs = (sends a qs \\<or> sends b qs)\"\n | \"sends (IF cond THEN a ELSE b) qs = (\\<forall>s. cond s \\<and> sends a qs \\<or> \\<not> cond s \\<and> sends b qs)\"\n | \"sends (WHILE cond DO a) qs = (\\<forall>s. cond s \\<and> sends a qs \\<or> \\<not> cond s)\"\n | \"sends (a \\<squnion> b) qs = (sends a qs \\<or> sends b qs)\"\n | \"sends _ _ = False\"\n\ntext {*\n  Reasoning about a property of the system execution itself is not possible\n  because we have not described what the components themselves actually do. For\n  example, proving that the client never reads the secret is not possible.\n*}\n\nlemma \"\\<forall>p. \\<exists>e s. gs\\<^sub>0 p = Some (e, s) \\<and>\n           (e = client_untrusted \\<or>\n            \\<not>(\\<exists>c. sends e {x. q_channel x = c \\<and> q_data x = Return [String ''baz'']} \\<and>\n              receives_on c client_untrusted))\"\n  oops\n\nend\n(*>*)\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/camkes/glue-spec/example-untrusted/EgTop.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.5, "lm_q1q2_score": 0.30383158491644585}}
{"text": "theory METASINVAR_SystemBoundary\nimports SINVAR_BLPtrusted_impl\n        SINVAR_SubnetsInGW_impl\n        \"../TopoS_Composition_Theory_impl\"\nbegin\n\n\nsubsubsection \\<open>Meta SecurityInvariant: System Boundaries\\<close>\n\n\ndatatype system_components = SystemComponent\n                           | SystemBoundaryInput\n                           | SystemBoundaryOutput\n                           | SystemBoundaryInputOutput\n\n\nfun system_components_to_subnets :: \"system_components \\<Rightarrow> subnets\" where\n  \"system_components_to_subnets SystemComponent = Member\" |\n  \"system_components_to_subnets SystemBoundaryInput = InboundGateway\" |\n  \"system_components_to_subnets SystemBoundaryOutput = Member\" |\n  \"system_components_to_subnets SystemBoundaryInputOutput = InboundGateway\"\n\nfun system_components_to_blp :: \"system_components \\<Rightarrow> SINVAR_BLPtrusted.node_config\" where\n  \"system_components_to_blp SystemComponent = \\<lparr> security_level = 1, trusted = False \\<rparr>\" |\n  \"system_components_to_blp SystemBoundaryInput = \\<lparr> security_level = 1, trusted = False \\<rparr>\" |\n  \"system_components_to_blp SystemBoundaryOutput = \\<lparr> security_level = 0, trusted = True \\<rparr>\" |\n  \"system_components_to_blp SystemBoundaryInputOutput = \\<lparr> security_level = 0, trusted = True \\<rparr>\"\n\ndefinition new_meta_system_boundary :: \"('v::vertex \\<times> system_components) list \\<Rightarrow> string \\<Rightarrow> ('v SecurityInvariant) list\" where \n  \"new_meta_system_boundary C description = [\n      new_configured_list_SecurityInvariant SINVAR_LIB_SubnetsInGW \\<lparr> \n          node_properties = map_of (map (\\<lambda>(v,c). (v, system_components_to_subnets c)) C)\n          \\<rparr> (description @ '' (ACS)'')\n      ,\n      new_configured_list_SecurityInvariant SINVAR_LIB_BLPtrusted \\<lparr> \n          node_properties = map_of (map (\\<lambda>(v,c). (v, system_components_to_blp c)) C)\n          \\<rparr> (description @ '' (IFS)'')\n      ]\"\n\n\nlemma system_components_to_subnets:\n      \"SINVAR_SubnetsInGW.allowed_subnet_flow\n        SINVAR_SubnetsInGW.default_node_properties\n        (system_components_to_subnets c) \\<longleftrightarrow>\n       c = SystemBoundaryInput \\<or> c = SystemBoundaryInputOutput\"\nby(cases c)(simp_all add: SINVAR_SubnetsInGW.default_node_properties_def)\n\nlemma system_components_to_blp:\n      \"(\\<not> trusted SINVAR_BLPtrusted.default_node_properties \\<longrightarrow>\n       security_level (system_components_to_blp c) \\<le> security_level SINVAR_BLPtrusted.default_node_properties)\n       \\<longleftrightarrow>\n       c = SystemBoundaryOutput \\<or> c = SystemBoundaryInputOutput\"\nby(cases c)(simp_all add: SINVAR_BLPtrusted.default_node_properties_def)\n\n\nlemma \"all_security_requirements_fulfilled (new_meta_system_boundary C description) G \\<longleftrightarrow>\n       (\\<forall>(v\\<^sub>1, v\\<^sub>2) \\<in> set (edgesL G). case ((map_of C) v\\<^sub>1, (map_of C) v\\<^sub>2)\n          of \n          \\<comment> \\<open>No restrictions outside of the component\\<close>\n             (None, None) \\<Rightarrow> True\n\n          \\<comment> \\<open>no restrictions inside the component\\<close>\n          |  (Some c1, Some c2) \\<Rightarrow> True\n\n          \\<comment> \\<open>System Boundaries Input\\<close>\n          |  (None, Some SystemBoundaryInputOutput) \\<Rightarrow> True\n          |  (None, Some SystemBoundaryInput) \\<Rightarrow> True\n\n          \\<comment> \\<open>System Boundaries Output\\<close>\n          |  (Some SystemBoundaryOutput, None) \\<Rightarrow> True\n          |  (Some SystemBoundaryInputOutput, None) \\<Rightarrow> True\n\n          \\<comment> \\<open>everything else is prohibited\\<close>\n          |  _ \\<Rightarrow> False\n       )\"\napply(simp)\napply(simp add: new_meta_system_boundary_def)\napply(simp add: all_security_requirements_fulfilled_def)\napply(simp add: Let_def)\napply(simp add: SINVAR_LIB_SubnetsInGW_def SINVAR_LIB_BLPtrusted_def)\napply(simp add: SINVAR_SubnetsInGW_impl.NetModel_node_props_def SINVAR_BLPtrusted_impl.NetModel_node_props_def)\napply(rule iffI)\n apply(clarsimp)\n subgoal for a b\n apply(erule_tac x=\"(a,b)\" in ballE)+\n  apply(simp_all)\n apply(case_tac \"map_of C a\")\n  apply(case_tac \"map_of C b\")\n   apply(simp_all)\n  apply(simp add: map_of_map)\n  apply(simp split: system_components.split)\n  apply(simp add: system_components_to_subnets)\n  apply blast\n apply(case_tac \"map_of C b\")\n  apply(simp add: map_of_map)\n  apply(simp split: system_components.split)\n  apply(simp add: system_components_to_blp)\n  apply blast\n apply(simp add: map_of_map)\n apply(simp split: system_components.split; fail)\n done\napply(intro conjI)\n apply(simp add: map_of_map)\n apply(clarsimp)\n subgoal for a b\n apply(erule_tac x=\"(a,b)\" in ballE)+\n  apply(simp_all)\n apply(simp split: option.split_asm system_components.split_asm)\n    by(simp_all add: SINVAR_SubnetsInGW.default_node_properties_def)\napply(clarsimp)\nsubgoal for a b\napply(erule_tac x=\"(a,b)\" in ballE)+\n apply(simp_all)\napply(simp add: map_of_map)\napply(simp split: option.split_asm system_components.split_asm)\n  apply(simp add: SINVAR_BLPtrusted.default_node_properties_def; fail)\n apply(rename_tac x, case_tac x, simp_all)+\ndone\ndone\n\n\nvalue[code] \"let nodes = [1,2,3,4,8,9,10];\n           sinvars = new_meta_system_boundary\n              [(1::int, SystemBoundaryInput),\n               (2, SystemComponent),\n               (3, SystemBoundaryOutput),\n               (4, SystemBoundaryInputOutput)\n               ] ''foobar''\n       in generate_valid_topology sinvars \\<lparr>nodesL = nodes, edgesL = List.product nodes nodes \\<rparr>\"\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Network_Security_Policy_Verification/Security_Invariants/METASINVAR_SystemBoundary.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.3036817325211338}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory L2Opt\nimports L2Defs L2Peephole\nbegin\n\n(* Flow-sensitive simplification rules for L2 programs. *)\nnamed_theorems L2flow\n\n(*\n * The monads \"A\" and \"B\" are equivalent under precondition \"P\".\n * Additionally, under this precondition, they always leave the\n * postcondition \"Q\" (normally) or \"E\" (if an exception occurs).\n *)\ndefinition\n  \"monad_equiv P A B Q E \\<equiv> (\\<forall>s. P s \\<longrightarrow> A s = B s) \\<and> \\<lbrace> P \\<rbrace> A \\<lbrace> Q \\<rbrace>, \\<lbrace> E \\<rbrace>\"\n\nlemma monad_equivI [intro]:\n  \"\\<lbrakk> \\<And>s. P s \\<Longrightarrow> A s = B s; \\<lbrace> P \\<rbrace> A \\<lbrace> Q \\<rbrace>, \\<lbrace> E \\<rbrace> \\<rbrakk> \\<Longrightarrow> monad_equiv P A B Q E\"\n  apply (clarsimp simp: monad_equiv_def)\n  done\n\nlemma monad_equiv_eqI [intro]:\n  \"\\<lbrakk> \\<lbrace> P \\<rbrace> A \\<lbrace> Q \\<rbrace>, \\<lbrace> E \\<rbrace> \\<rbrakk> \\<Longrightarrow> monad_equiv P A A Q E\"\n  apply (clarsimp simp: monad_equiv_def)\n  done\n\nlemma monad_equiv_eq:\n    \"monad_equiv (\\<lambda>_. True) A B X Y \\<Longrightarrow> A = B\"\n  apply (rule ext)\n  apply (clarsimp simp: monad_equiv_def)\n  done\n\nlemma monad_equiv_triv [L2flow]:\n    \"monad_equiv P A A (\\<lambda>_ _. \\<exists>s. P s) (\\<lambda>_ _. \\<exists>s. P s)\"\n  apply rule\n  apply wp\n  apply force\n  done\n\nlemma monad_equiv_symmetric:\n  \"monad_equiv P A B X Y = monad_equiv P B A X Y\"\n  apply (clarsimp simp: monad_equiv_def validE_def2 Ball_def split: sum.splits)\n  apply force\n  done\n\nlemma monad_equivD: \"\\<lbrakk> monad_equiv P A B R E; P s \\<rbrakk> \\<Longrightarrow> A s = B s\"\n  apply (clarsimp simp: monad_equiv_def)\n  done\n\n(*\n * Show that under condition \"P\", the values \"A\" and \"B\" are equal.\n *\n * We use this to simplify expressions inside our monads in a (somewhat)\n * controlled fashion.\n *)\ndefinition \"simp_expr P A B \\<equiv> P \\<longrightarrow> A = B\"\n\nlemma simp_expr_triv: \"simp_expr P A A\"\n  apply (clarsimp simp: simp_expr_def)\n  done\n\nlemma simp_expr_P_cong:\n  \"\\<lbrakk> P = P' \\<rbrakk> \\<Longrightarrow> simp_expr P A B = simp_expr P' A B\"\n  apply (clarsimp simp: simp_expr_def)\n  done\n\nlemma simp_expr_rhs_cong [cong]:\n  \"\\<lbrakk> P = P'; P' \\<Longrightarrow> B = B' \\<rbrakk> \\<Longrightarrow> simp_expr P A B = simp_expr P' A B'\"\n  apply (clarsimp simp: simp_expr_def simp_implies_def)\n  done\n\nlemma simp_expr_weaken:\n  \"\\<lbrakk> simp_expr P A B; Q \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> simp_expr Q A B\"\n  apply (clarsimp simp: simp_expr_def)\n  done\n\n(*\n * Monad simplification rules.\n *\n * When solving \"monad_equiv P A B R E\", the l2_opt tactics assume that P is concrete;\n * to ensure this, monad_equiv rules should result in R being instantiated.\n * See e.g. monad_equiv_unreachable where we have to constrain the rule.\n *)\n\nlemma monad_equiv_gets [L2flow]:\n    \"simp_expr True v v' \\<Longrightarrow> monad_equiv P (L2_gets (\\<lambda>s. v s) n) (L2_gets (\\<lambda>s. v' s) n)\n        (\\<lambda>r s. P s \\<and> r = v' s) (\\<lambda>_ _. False)\"\n  apply rule\n   apply (clarsimp simp: L2_defs simp_expr_def)+\n  done\n\nlemma monad_equiv_throw [L2flow]:\n    \"simp_expr True v v' \\<Longrightarrow>\n       monad_equiv P (L2_throw v n) (L2_throw v' n) (\\<lambda>_ _. False) (\\<lambda>r s. P s \\<and> r = v')\"\n  apply (clarsimp simp: monad_equiv_def L2_defs simp_expr_def)\n  apply wp\n  apply force\n  done\n\nlemma monad_equiv_guard:\n    \"\\<lbrakk> \\<And>s. simp_expr (P s) (G s) (G' s) \\<rbrakk> \\<Longrightarrow>\n        monad_equiv P (L2_guard (\\<lambda>s. G s)) (L2_guard (\\<lambda>s. G' s)) (\\<lambda>r s. P s \\<and> G' s \\<and> r = ()) (\\<lambda>_ _. False)\"\n  apply (clarsimp simp: monad_equiv_def L2_defs simp_expr_def)\n  apply rule\n   apply (clarsimp simp: liftE_def guard_def bind_def in_return snd_return)\n  apply wp\n  apply force\n  done\n\n(* We use this weaker form of guard simplification to prevent bound\n * variables being expanded inside of guard statements. *)\nlemma monad_equiv_guard' [L2flow]:\n    \"\\<lbrakk> \\<And>s. simp_expr True (G s) (G' s) \\<rbrakk> \\<Longrightarrow>\n        monad_equiv P (L2_guard G) (L2_guard G') (\\<lambda>r s. P s \\<and> G' s \\<and> r = ()) (\\<lambda>_ _. False)\"\n  apply (rule monad_equiv_guard)\n  apply (rule simp_expr_weaken)\n   apply assumption\n  apply simp\n  done\n\nlemma monad_equiv_guard_False [L2flow]:\n    \"\\<lbrakk> \\<And>s. simp_expr (P s) False (G s) \\<rbrakk>\n          \\<Longrightarrow> monad_equiv P (L2_guard G) (L2_fail) (\\<lambda>_ _. False) (\\<lambda>_ _. False)\"\n  apply (monad_eq simp: L2_defs monad_equiv_def simp_expr_def validE_def2)\n  done\n\nlemma monad_equiv_guard_True [L2flow]:\n    \"\\<lbrakk> \\<And>s. simp_expr (P s) True (G s) \\<rbrakk>\n          \\<Longrightarrow> monad_equiv P (L2_guard G) L2_skip (\\<lambda>r s. P s \\<and> r = ()) (\\<lambda>_ _. False)\"\n  apply (auto simp: L2_defs simp_expr_def guard_def liftE_def return_def returnOk_def bind_def validE_def valid_def)\n  done\n\nlemma monad_equiv_guard_conj [L2flow]:\n    \"\\<lbrakk> monad_equiv P (L2_guard G1) G1' R1 E1;\n       monad_equiv (\\<lambda>s. R1 () s) (L2_guard G2) G2' R2 E2 \\<rbrakk> \\<Longrightarrow>\n        monad_equiv P (L2_guard (\\<lambda>s. G1 s \\<and> G2 s)) (L2_seq G1' (\\<lambda>_. G2')) (\\<lambda>r s. R2 () s) (\\<lambda>_ _. False)\"\n  apply (subst (asm) (1 2) monad_equiv_symmetric)\n  apply (subst monad_equiv_symmetric)\n  apply rule\n   apply (monad_eq simp: L2_defs monad_equiv_def validE_def2 Bex_def Ball_def split: sum.splits)\n   apply fast\n  apply (monad_eq simp: monad_equiv_def L2_defs validE_def2 Ball_def split: sum.splits)\n  apply fast\n  done\n\nlemma monad_equiv_unknown [L2flow]:\n    \"monad_equiv P (L2_unknown name) (L2_unknown name) (\\<lambda>r s. P s) (\\<lambda>_ _. False)\"\n  apply (clarsimp simp: monad_equiv_def L2_defs)\n  apply (wp select_wp)\n  apply force\n  done\n\nlemma monad_equiv_modify [L2flow]:\n    \"\\<lbrakk> \\<And>s. simp_expr True (m s) (m' s) \\<rbrakk> \\<Longrightarrow>\n        monad_equiv P (L2_modify (\\<lambda>s. m s)) (L2_modify (\\<lambda>s. m' s)) (\\<lambda>r s'. \\<exists>s. P s \\<and> m' s = s' \\<and> r = ()) (\\<lambda>_ _. False)\"\n  apply rule\n   apply (clarsimp simp: L2_defs simp_expr_def liftE_def modify_def put_def get_def bind_def)\n  apply (clarsimp simp: L2_defs simp_expr_def)\n  apply force\n  done\n\nlemma monad_equiv_spec [L2flow]:\n    \"\\<lbrakk> \\<And>s s'. simp_expr True ((s, s') \\<in> S) (S' s s') \\<rbrakk> \\<Longrightarrow>\n        monad_equiv P (L2_spec S) (L2_spec ({(s, s'). S' s s'})) (\\<lambda>r s. \\<exists>s. P s) (\\<lambda>_ _. False)\"\n  apply rule\n   apply (clarsimp simp: L2_defs simp_expr_def liftE_def spec_def bind_def)\n  apply (clarsimp simp: L2_defs)\n  apply wp\n  apply force\n  done\n\nlemma monad_equiv_fail [L2flow]:\n    \"monad_equiv P L2_fail L2_fail (\\<lambda>_ _. False) (\\<lambda>_ _. False)\"\n  apply (clarsimp simp: monad_equiv_def L2_defs)\n  done\n\nlemma monad_equiv_condition [L2flow]:\n  \"\\<lbrakk> \\<And>s. simp_expr True (C s) (C' s);\n     monad_equiv (\\<lambda>s. P s \\<and> C' s) L L' QL EL;\n     monad_equiv (\\<lambda>s. P s \\<and> \\<not> C' s) R R' QR ER \\<rbrakk> \\<Longrightarrow>\n   monad_equiv P (L2_condition (\\<lambda>s. C s) L R) (L2_condition (\\<lambda>s. C' s) L' R')\n      (\\<lambda>r s. \\<exists>s. P s) (* Deliberately weak to avoid exponential growth. *)\n      (\\<lambda>r s. \\<exists>s. P s)\"\n  apply rule\n   apply (monad_eq simp: L2_defs monad_equiv_def simp_expr_def split: condition_splits)\n  apply (monad_eq simp: L2_defs monad_equiv_def validE_def2 split: condition_splits sum.splits)\n  apply force\n  done\n\nlemma monad_equiv_condition_True [L2flow]:\n  \"\\<lbrakk> \\<And>s. simp_expr (P s) (C s) True;\n     monad_equiv P L L' QL EL \\<rbrakk> \\<Longrightarrow>\n     monad_equiv P (L2_condition C L R) L' QL EL\"\n  unfolding L2_defs condition_def\n  apply (monad_eq simp: simp_expr_def monad_equiv_def validE_def2 Ball_def split: sum.splits)\n  done\n\nlemma monad_equiv_condition_False [L2flow]:\n  \"\\<lbrakk> \\<And>s. simp_expr (P s) (C s) False;\n     monad_equiv P R R' QR ER \\<rbrakk> \\<Longrightarrow>\n     monad_equiv P (L2_condition C L R) R' QR ER\"\n  unfolding L2_defs condition_def\n  apply (monad_eq simp: simp_expr_def monad_equiv_def validE_def2 Ball_def split: sum.splits)\n  done\n\n(* C-parser sometimes generates boolean expressions like\n     if P then (if P then 1 else 0) else Q\n   This simplifies the branches. *)\nlemma monad_equiv_gets_if [L2flow]:\n   \"\\<lbrakk> \\<And>s. simp_expr (P s) True (b s) \\<rbrakk> \\<Longrightarrow>\n       monad_equiv P (L2_gets (\\<lambda>s. if (b s) then L else R) f)\n                     (L2_gets (\\<lambda>s. L) f) (%r s. P s) (\\<lambda>r s. False)\"\n   \"\\<lbrakk> \\<And>s. simp_expr (P s) False (b s) \\<rbrakk> \\<Longrightarrow>\n       monad_equiv P (L2_gets (\\<lambda>s. if (b s) then L else R) f)\n                     (L2_gets (\\<lambda>s. R) f) (%r s. P s) (\\<lambda>r s. False)\"\n  apply (monad_eq simp: L2_defs simp_expr_def monad_equiv_def\n         validE_def valid_def split: sum.splits)+\n  done\n\nlemma monad_equiv_seq [L2flow]:\n  \"\\<lbrakk> monad_equiv P A A' Q E;\n     \\<And>x. monad_equiv (Q x) (B x) (B' x) (R x) (E2 x) \\<rbrakk> \\<Longrightarrow>\n   monad_equiv P (L2_seq A (\\<lambda>x. B x)) (L2_seq A' (\\<lambda>x. B' x)) (\\<lambda>r s. \\<exists>r'. R r' r s) (\\<lambda>r s. \\<exists>s. P s)\"\n  apply rule\n   apply (clarsimp simp: monad_equiv_def L2_defs simp_expr_def)\n   apply (rule bindE_apply_cong)\n    apply simp\n   apply (clarsimp simp: validE_def valid_def)\n   apply force\n  apply (clarsimp simp: monad_equiv_def L2_defs\n               validE_def valid_def in_bindE simp_expr_def split: sum.splits)\n  apply (erule allE, erule (1) impE)+\n  apply fastforce\n  done\n\nlemma monad_equiv_catch [L2flow]:\n  \"\\<lbrakk> monad_equiv P A A' Q E;\n    \\<And>x. monad_equiv (E x) (B x) (B' x) (Q' x) (E2 x) \\<rbrakk> \\<Longrightarrow>\n   monad_equiv P (L2_catch A (\\<lambda>x. B x)) (L2_catch A' (\\<lambda>x. B' x)) (\\<lambda>r s. \\<exists>s. P s) (\\<lambda>r s. \\<exists>r'. E2 r' r s)\"\n  apply rule\n   apply atomize\n   apply (clarsimp simp: simp_expr_def L2_defs monad_equiv_def)\n   apply (erule allE, erule impE, assumption)\n   apply (clarsimp simp: validE_def2 split: sum.splits)\n   apply (erule allE, erule impE, assumption)\n   apply (rule monad_state_eqI)\n     apply (clarsimp simp: in_handleE')\n     apply force\n    apply (clarsimp simp: in_handleE')\n    apply force\n   apply (fastforce simp: snd_handleE')\n  apply (clarsimp simp: monad_equiv_def L2_defs\n      validE_def valid_def simp_expr_def in_handleE' split: sum.splits)\n  apply (erule allE, erule (1) impE)+\n  apply fastforce\n  done\n\nlemma monad_equiv_cong:\n  \"\\<lbrakk> \\<And>s. P s = P' s;\n     \\<And>s. P s \\<Longrightarrow> A s = A' s;\n     \\<And>s. P s \\<Longrightarrow> B s = B' s;\n     \\<And>s s' r. P s \\<Longrightarrow> Q r s' = Q' r s';\n     \\<And>s s' r. P s \\<Longrightarrow> R r s' = R' r s' \\<rbrakk> \\<Longrightarrow>\n   monad_equiv P A B Q R = monad_equiv P' A' B' Q' R'\"\n  apply atomize\n  apply (clarsimp simp: monad_equiv_def validE_def valid_def split: sum.splits)\n  apply (rule iffI)\n   apply clarsimp\n   apply fastforce\n  apply clarsimp\n  apply fastforce\n  done\n\nlemma monad_equiv_while [L2flow]:\n  assumes cond_simp: \"\\<And>s r. simp_expr True (c r s) (c' r s)\"\n  assumes body_equiv: \"\\<And>r. monad_equiv (\\<lambda>s. (\\<exists>s'. P s') \\<and> c' r s) (B r) (B' r) (Q r) (E r)\"\n  assumes init_simp: \"\\<And>s r. simp_expr True x x'\"\n  shows \"monad_equiv P (L2_while (\\<lambda>r s. c r s) B x n) (L2_while (\\<lambda>r s. c' r s) B' x' n) (\\<lambda>r s. \\<not> c' r s \\<and> (\\<exists>x. P x)) (\\<lambda>r s. \\<exists>x. E x r s)\"\n  apply (insert cond_simp [unfolded simp_expr_def] init_simp [unfolded simp_expr_def])\n  apply rule\n   apply (clarsimp simp: L2_while_def)\n   apply (rule whileLoopE_cong [THEN fun_cong, THEN fun_cong])\n     apply force\n    apply (cut_tac r=r in body_equiv)\n    apply (clarsimp simp: monad_equiv_def)\n    apply (erule allE, erule impE, auto)[1]\n   apply simp\n  apply (clarsimp simp: L2_while_def)\n  apply (rule validE_whileLoopE [where I=\"\\<lambda>r s. \\<exists>s. P s\"])\n    apply force\n   apply (cut_tac r=r in body_equiv)\n   apply (clarsimp simp: validE_def valid_def monad_equiv_def split: sum.splits)\n   apply blast\n  apply simp\n  done\n\nlemma monad_equiv_recguard [L2flow]:\n  \"\\<lbrakk> monad_equiv P B B' Q E \\<rbrakk> \\<Longrightarrow>\n    monad_equiv P (L2_recguard a B) (L2_recguard a B') Q E\"\n  apply rule\n   apply (clarsimp simp: L2_recguard_def monad_equiv_def valid_def validE_def\n        split: sum.splits condition_splits)\n  apply (clarsimp simp: L2_recguard_def monad_equiv_def valid_def validE_def in_fail\n       split: sum.splits condition_splits)\n  done\n\nlemma monad_equiv_unreachable' [L2flow]:\n  \"monad_equiv (\\<lambda>_. False) L (L2_gets (\\<lambda>_. undefined) [''L2Opt_internal_var'']) Q R\"\n  by (simp add: monad_equiv_def)\n\n(* avoid leaving schematic Q in goal *)\nlemma monad_equiv_unreachable [L2flow]:\n  \"monad_equiv (\\<lambda>_. False) L (L2_gets (\\<lambda>_. undefined) [''L2Opt_internal_var'']) (\\<lambda>_ _. False) R\"\n  by (rule monad_equiv_unreachable')\n\nlemma monad_equiv_split [L2flow]:\n  \"\\<lbrakk> \\<And>a b. monad_equiv (P (a, b)) (X a b) (Y a b) (Q a b) (E a b) \\<rbrakk> \\<Longrightarrow>\n    monad_equiv (P x) (case x of (a, b) \\<Rightarrow> X a b) (case x of (a, b) \\<Rightarrow> Y a b)\n          (case x of (a, b) \\<Rightarrow> Q a b) (case x of (a, b) \\<Rightarrow> E a b)\"\n  apply (clarsimp simp: monad_equiv_def validE_def valid_def split_def)\n  done\n\nlemma simp_expr_solve_constant: \"\\<lbrakk> A \\<Longrightarrow> B = C \\<rbrakk> \\<Longrightarrow> simp_expr A B C\"\n  by (clarsimp simp: simp_expr_def)\n\nlemma monad_equiv_weaken_pre':\n  \"\\<lbrakk> \\<And>s. P' s \\<Longrightarrow> P s; monad_equiv P L R Q E \\<rbrakk> \\<Longrightarrow> monad_equiv P' L R Q E\"\n  by (fastforce simp: monad_equiv_def validE_def valid_def)\n\nlemma monad_equiv_weaken_pre'':\n  \"\\<lbrakk> P' \\<equiv> P; monad_equiv P L R Q E \\<rbrakk> \\<Longrightarrow> monad_equiv P' L R Q E\"\n  by (fastforce simp: monad_equiv_def validE_def valid_def)\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/tools/autocorres/L2Opt.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5888891451980403, "lm_q2_score": 0.5156199157230156, "lm_q1q2_score": 0.3036429714172122}}
{"text": "section \\<open>Observable Sets of Nodes\\<close>\n\ntheory Observable imports ReturnAndCallNodes begin\n\ncontext CFG begin\n\n\nsubsection \\<open>Intraprocedural observable sets\\<close>\n\ninductive_set obs_intra :: \"'node \\<Rightarrow> 'node set \\<Rightarrow> 'node set\" \nfor n::\"'node\" and S::\"'node set\"\nwhere obs_intra_elem:\n  \"\\<lbrakk>n -as\\<rightarrow>\\<^sub>\\<iota>* n'; \\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> S; n' \\<in> S\\<rbrakk> \\<Longrightarrow> n' \\<in> obs_intra n S\"\n\n\nlemma obs_intraE:\n  assumes \"n' \\<in> obs_intra n S\"\n  obtains as where \"n -as\\<rightarrow>\\<^sub>\\<iota>* n'\" and \"\\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> S\" and \"n' \\<in> S\"\n  using \\<open>n' \\<in> obs_intra n S\\<close>\n  by(fastforce elim:obs_intra.cases)\n\n\nlemma n_in_obs_intra:\n  assumes \"valid_node n\" and \"n \\<in> S\" shows \"obs_intra n S = {n}\"\nproof -\n  from \\<open>valid_node n\\<close> have \"n -[]\\<rightarrow>* n\" by(rule empty_path)\n  hence \"n -[]\\<rightarrow>\\<^sub>\\<iota>* n\" by(simp add:intra_path_def)\n  with \\<open>n \\<in> S\\<close> have \"n \\<in> obs_intra n S\" \n    by(fastforce elim:obs_intra_elem simp:sourcenodes_def)\n  { fix n' assume \"n' \\<in> obs_intra n S\"\n    have \"n' = n\"\n    proof(rule ccontr)\n      assume \"n' \\<noteq> n\"\n      from \\<open>n' \\<in> obs_intra n S\\<close> obtain as where \"n -as\\<rightarrow>\\<^sub>\\<iota>* n'\"\n        and \"\\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> S\"\n        and \"n' \\<in> S\" by(fastforce elim:obs_intra.cases)\n      from \\<open>n -as\\<rightarrow>\\<^sub>\\<iota>* n'\\<close> have \"n -as\\<rightarrow>* n'\" by(simp add:intra_path_def)\n      from this \\<open>\\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> S\\<close> \\<open>n' \\<noteq> n\\<close> \\<open>n \\<in> S\\<close>\n      show False\n      proof(induct rule:path.induct)\n        case (Cons_path n'' as n' a n)\n        from \\<open>\\<forall>nx\\<in>set (sourcenodes (a#as)). nx \\<notin> S\\<close> \\<open>sourcenode a = n\\<close>\n        have \"n \\<notin> S\" by(simp add:sourcenodes_def)\n        with \\<open>n \\<in> S\\<close> show False by simp\n      qed simp\n    qed }\n  with \\<open>n \\<in> obs_intra n S\\<close> show ?thesis by fastforce\nqed\n\n\nlemma in_obs_intra_valid:\n  assumes \"n' \\<in> obs_intra n S\" shows \"valid_node n\" and \"valid_node n'\"\n  using \\<open>n' \\<in> obs_intra n S\\<close>\n  by(auto elim!:obs_intraE intro:path_valid_node simp:intra_path_def)\n\n\nlemma edge_obs_intra_subset:\n  assumes \"valid_edge a\" and \"intra_kind (kind a)\" and \"sourcenode a \\<notin> S\"\n  shows \"obs_intra (targetnode a) S \\<subseteq> obs_intra (sourcenode a) S\"\nproof\n  fix n assume \"n \\<in> obs_intra (targetnode a) S\"\n  then obtain as where \"targetnode a -as\\<rightarrow>\\<^sub>\\<iota>* n\" \n    and all:\"\\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> S\" and \"n \\<in> S\" by(erule obs_intraE)\n  from \\<open>valid_edge a\\<close> \\<open>intra_kind (kind a)\\<close> \\<open>targetnode a -as\\<rightarrow>\\<^sub>\\<iota>* n\\<close>\n  have \"sourcenode a -[a]@as\\<rightarrow>\\<^sub>\\<iota>* n\" by(fastforce intro:Cons_path simp:intra_path_def)\n  moreover\n  from all \\<open>sourcenode a \\<notin> S\\<close> have \"\\<forall>nx \\<in> set(sourcenodes (a#as)). nx \\<notin> S\"\n    by(simp add:sourcenodes_def)\n  ultimately show \"n \\<in> obs_intra (sourcenode a) S\" using \\<open>n \\<in> S\\<close>\n    by(fastforce intro:obs_intra_elem)\nqed\n\n\nlemma path_obs_intra_subset:\n  assumes \"n -as\\<rightarrow>\\<^sub>\\<iota>* n'\" and \"\\<forall>n' \\<in> set(sourcenodes as). n' \\<notin> S\"\n  shows \"obs_intra n' S \\<subseteq> obs_intra n S\"\nproof -\n  from \\<open>n -as\\<rightarrow>\\<^sub>\\<iota>* n'\\<close> have \"n -as\\<rightarrow>* n'\" and \"\\<forall>a \\<in> set as. intra_kind (kind a)\"\n    by(simp_all add:intra_path_def)\n  from this \\<open>\\<forall>n' \\<in> set(sourcenodes as). n' \\<notin> S\\<close> show ?thesis\n  proof(induct rule:path.induct)\n    case (Cons_path n'' as n' a n)\n    note IH = \\<open>\\<lbrakk>\\<forall>a\\<in>set as. intra_kind (kind a); \\<forall>n'\\<in>set (sourcenodes as). n' \\<notin> S\\<rbrakk>\n      \\<Longrightarrow> obs_intra n' S \\<subseteq> obs_intra n'' S\\<close>\n    from \\<open>\\<forall>n'\\<in>set (sourcenodes (a#as)). n' \\<notin> S\\<close> \n    have all:\"\\<forall>n'\\<in>set (sourcenodes as). n' \\<notin> S\" and \"sourcenode a \\<notin> S\"\n      by(simp_all add:sourcenodes_def)\n    from \\<open>\\<forall>a \\<in> set (a#as). intra_kind (kind a)\\<close>\n    have \"intra_kind (kind a)\" and \"\\<forall>a \\<in> set as. intra_kind (kind a)\"\n      by(simp_all add:intra_path_def)\n    from IH[OF \\<open>\\<forall>a \\<in> set as. intra_kind (kind a)\\<close> all]\n    have \"obs_intra n' S \\<subseteq> obs_intra n'' S\" .\n    from \\<open>valid_edge a\\<close> \\<open>intra_kind (kind a)\\<close> \\<open>targetnode a = n''\\<close>\n      \\<open>sourcenode a = n\\<close> \\<open>sourcenode a \\<notin> S\\<close>\n    have \"obs_intra n'' S \\<subseteq> obs_intra n S\" by(fastforce dest:edge_obs_intra_subset)\n    with \\<open>obs_intra n' S \\<subseteq> obs_intra n'' S\\<close> show ?case by fastforce\n  qed simp\nqed\n\n\nlemma path_ex_obs_intra:\n  assumes \"n -as\\<rightarrow>\\<^sub>\\<iota>* n'\" and \"n' \\<in> S\"\n  obtains m where \"m \\<in> obs_intra n S\"\nproof(atomize_elim)\n  show \"\\<exists>m. m \\<in> obs_intra n S\"\n  proof(cases \"\\<forall>nx \\<in> set(sourcenodes as). nx \\<notin> S\")\n    case True\n    with \\<open>n -as\\<rightarrow>\\<^sub>\\<iota>* n'\\<close> \\<open>n' \\<in> S\\<close> have \"n' \\<in> obs_intra n S\" by -(rule obs_intra_elem)\n    thus ?thesis by fastforce\n  next\n    case False\n    hence \"\\<exists>nx \\<in> set(sourcenodes as). nx \\<in> S\" by fastforce\n    then obtain nx ns ns' where \"sourcenodes as = ns@nx#ns'\"\n      and \"nx \\<in> S\" and \"\\<forall>n' \\<in> set ns. n' \\<notin> S\"\n      by(fastforce elim!:split_list_first_propE)\n    from \\<open>sourcenodes as = ns@nx#ns'\\<close> obtain as' a as'' \n      where \"ns = sourcenodes as'\"\n      and \"as = as'@a#as''\" and \"sourcenode a = nx\"\n      by(fastforce elim:map_append_append_maps simp:sourcenodes_def)\n    with \\<open>n -as\\<rightarrow>\\<^sub>\\<iota>* n'\\<close> have \"n -as'\\<rightarrow>\\<^sub>\\<iota>* nx\"\n      by(fastforce dest:path_split simp:intra_path_def)\n    with \\<open>nx \\<in> S\\<close> \\<open>\\<forall>n' \\<in> set ns. n' \\<notin> S\\<close> \\<open>ns = sourcenodes as'\\<close> \n    have \"nx \\<in> obs_intra n S\" by(fastforce intro:obs_intra_elem)\n    thus ?thesis by fastforce\n  qed\nqed\n\n\nsubsection \\<open>Interprocedural observable sets restricted to the slice\\<close>\n\n\nfun obs :: \"'node list \\<Rightarrow> 'node set \\<Rightarrow> 'node list set\" \n  where \"obs [] S = {}\"\n  | \"obs (n#ns) S = (let S' = obs_intra n S in \n  (if (S' = {} \\<or> (\\<exists>n' \\<in> set ns. \\<exists>nx. call_of_return_node n' nx \\<and> nx \\<notin> S)) \n   then obs ns S else (\\<lambda>nx. nx#ns) ` S'))\"\n\n\nlemma obsI:\n  assumes \"n' \\<in> obs_intra n S\"\n  and \"\\<forall>nx \\<in> set nsx'. \\<exists>nx'. call_of_return_node nx nx' \\<and> nx' \\<in> S\"\n  shows \"\\<lbrakk>ns = nsx@n#nsx'; \\<forall>xs x xs'. nsx = xs@x#xs' \\<and> obs_intra x S \\<noteq> {}\n     \\<longrightarrow> (\\<exists>x'' \\<in> set (xs'@[n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S)\\<rbrakk>\n  \\<Longrightarrow> n'#nsx' \\<in> obs ns S\"\nproof(induct ns arbitrary:nsx)\ncase (Cons x xs)\n  note IH = \\<open>\\<And>nsx. \\<lbrakk>xs = nsx@n#nsx'; \n    \\<forall>xs x xs'. nsx = xs @ x # xs' \\<and> obs_intra x S \\<noteq> {} \\<longrightarrow>\n    (\\<exists>x''\\<in>set (xs'@[n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S)\\<rbrakk>\n    \\<Longrightarrow> n'#nsx' \\<in> obs xs S\\<close>\n  note nsx = \\<open>\\<forall>xs x xs'. nsx = xs @ x # xs' \\<and> obs_intra x S \\<noteq> {} \\<longrightarrow>\n    (\\<exists>x''\\<in>set (xs' @ [n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S)\\<close>\n  show ?case\n  proof(cases nsx)\n    case Nil\n    with \\<open>x#xs = nsx@n#nsx'\\<close> have \"n = x\" and \"xs = nsx'\" by simp_all\n    with \\<open>n' \\<in> obs_intra n S\\<close>\n      \\<open>\\<forall>nx\\<in>set nsx'. \\<exists>nx'. call_of_return_node nx nx' \\<and> nx' \\<in> S\\<close>\n    show ?thesis by(fastforce simp:Let_def)\n  next\n    case (Cons z zs)\n    with \\<open>x#xs = nsx@n#nsx'\\<close> have [simp]:\"x = z\" \"xs = zs@n#nsx'\" by simp_all\n    from nsx Cons\n    have \"\\<forall>xs x xs'. zs = xs @ x # xs' \\<and> obs_intra x S \\<noteq> {} \\<longrightarrow>\n      (\\<exists>x''\\<in>set (xs' @ [n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S)\"\n      by clarsimp(erule_tac x=\"z#xs\" in allE,auto)\n    from IH[OF \\<open>xs = zs@n#nsx'\\<close> this] have \"n'#nsx' \\<in> obs xs S\" by simp\n    show ?thesis\n    proof(cases \"obs_intra z S = {}\")\n      case True\n      with Cons \\<open>n'#nsx' \\<in> obs xs S\\<close> show ?thesis by(simp add:Let_def)\n    next\n      case False\n      from nsx Cons\n      have \"obs_intra z S \\<noteq> {} \\<longrightarrow>\n        (\\<exists>x''\\<in>set (zs @ [n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S)\"\n        by clarsimp\n      with False have \"\\<exists>x''\\<in>set (zs @ [n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S\"\n        by simp\n      with \\<open>xs = zs@n#nsx'\\<close> \n      have \"\\<exists>n' \\<in> set xs. \\<exists>nx. call_of_return_node n' nx \\<and> nx \\<notin> S\" by fastforce\n      with Cons \\<open>n'#nsx' \\<in> obs xs S\\<close> show ?thesis by(simp add:Let_def)\n    qed\n  qed\nqed simp\n\n\n\nlemma obsE [consumes 2]:\n  assumes \"ns' \\<in> obs ns S\" and \"\\<forall>n \\<in> set (tl ns). return_node n\"\n  obtains nsx n nsx' n' where \"ns = nsx@n#nsx'\" and \"ns' = n'#nsx'\" \n  and \"n' \\<in> obs_intra n S\" \n  and \"\\<forall>nx \\<in> set nsx'. \\<exists>nx'. call_of_return_node nx nx' \\<and> nx' \\<in> S\"\n  and \"\\<forall>xs x xs'. nsx = xs@x#xs' \\<and> obs_intra x S \\<noteq> {}\n  \\<longrightarrow> (\\<exists>x'' \\<in> set (xs'@[n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S)\"\nproof(atomize_elim)\n  from \\<open>ns' \\<in> obs ns S\\<close> \\<open>\\<forall>n \\<in> set (tl ns). return_node n\\<close>\n  show \"\\<exists>nsx n nsx' n'. ns = nsx @ n # nsx' \\<and> ns' = n' # nsx' \\<and>\n    n' \\<in> obs_intra n S \\<and> (\\<forall>nx\\<in>set nsx'. \\<exists>nx'. call_of_return_node nx nx' \\<and> nx' \\<in> S) \\<and>\n    (\\<forall>xs x xs'. nsx = xs @ x # xs' \\<and> obs_intra x S \\<noteq> {} \\<longrightarrow>\n    (\\<exists>x''\\<in>set (xs' @ [n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S))\"\n  proof(induct ns)\n    case Nil thus ?case by simp\n  next\n    case (Cons nx ns'')\n    note IH = \\<open>\\<lbrakk>ns' \\<in> obs ns'' S; \\<forall>a\\<in>set (tl ns''). return_node a\\<rbrakk>\n      \\<Longrightarrow> \\<exists>nsx n nsx' n'. ns'' = nsx @ n # nsx' \\<and> ns' = n' # nsx' \\<and>\n      n' \\<in> obs_intra n S \\<and> \n      (\\<forall>nx\\<in>set nsx'. \\<exists>nx'. call_of_return_node nx nx' \\<and> nx' \\<in> S) \\<and>\n      (\\<forall>xs x xs'. nsx = xs @ x # xs' \\<and> obs_intra x S \\<noteq> {} \\<longrightarrow>\n         (\\<exists>x''\\<in>set (xs' @ [n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S))\\<close>\n    from \\<open>\\<forall>a\\<in>set (tl (nx # ns'')). return_node a\\<close> have \"\\<forall>n \\<in> set ns''. return_node n\"\n      by simp\n    show ?case\n    proof(cases ns'')\n      case Nil\n      with \\<open>ns' \\<in> obs (nx#ns'') S\\<close> obtain x where \"ns' = [x]\" and \"x \\<in> obs_intra nx S\"\n        by(auto simp:Let_def split:if_split_asm)\n      with Nil show ?thesis by fastforce\n    next\n      case Cons\n      with \\<open>\\<forall>n \\<in> set ns''. return_node n\\<close> have \"\\<forall>a\\<in>set (tl ns''). return_node a\"\n        by simp\n      show ?thesis\n      proof(cases \"\\<exists>n' \\<in> set ns''. \\<exists>nx'. call_of_return_node n' nx' \\<and> nx' \\<notin> S\")\n        case True\n        with \\<open>ns' \\<in> obs (nx#ns'') S\\<close> have \"ns' \\<in> obs ns'' S\" by simp\n        from IH[OF this \\<open>\\<forall>a\\<in>set (tl ns''). return_node a\\<close>]\n        obtain nsx n nsx' n' where split:\"ns'' = nsx @ n # nsx'\"\n          \"ns' = n' # nsx'\" \"n' \\<in> obs_intra n S\"\n          \"\\<forall>nx\\<in>set nsx'. \\<exists>nx'. call_of_return_node nx nx' \\<and> nx' \\<in> S\"\n          and imp:\"\\<forall>xs x xs'. nsx = xs @ x # xs' \\<and> obs_intra x S \\<noteq> {} \\<longrightarrow>\n          (\\<exists>x''\\<in>set (xs' @ [n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S)\"\n          by blast\n        from True \\<open>ns'' = nsx @ n # nsx'\\<close>\n          \\<open>\\<forall>nx\\<in>set nsx'. \\<exists>nx'. call_of_return_node nx nx' \\<and> nx' \\<in> S\\<close>\n        have \"(\\<exists>nx'. call_of_return_node n nx' \\<and> nx' \\<notin> S) \\<or>\n          (\\<exists>n'\\<in>set nsx. \\<exists>nx'. call_of_return_node n' nx' \\<and> nx' \\<notin> S)\" by fastforce\n        thus ?thesis\n        proof\n          assume \"\\<exists>nx'. call_of_return_node n nx' \\<and> nx' \\<notin> S\"\n          with split show ?thesis by clarsimp\n        next\n          assume \"\\<exists>n'\\<in>set nsx. \\<exists>nx'. call_of_return_node n' nx' \\<and> nx' \\<notin> S\"\n          with imp have \"\\<forall>xs x xs'. nx#nsx = xs @ x # xs' \\<and> obs_intra x S \\<noteq> {} \\<longrightarrow>\n          (\\<exists>x''\\<in>set (xs' @ [n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S)\"\n            apply clarsimp apply(case_tac xs) apply auto\n            by(erule_tac x=\"list\" in allE,auto)+\n          with split Cons show ?thesis by auto\n        qed\n      next\n        case False\n        hence \"\\<forall>n'\\<in>set ns''. \\<forall>nx'. call_of_return_node n' nx' \\<longrightarrow> nx' \\<in> S\" by simp\n        show ?thesis\n        proof(cases \"obs_intra nx S = {}\")\n          case True\n          with \\<open>ns' \\<in> obs (nx#ns'') S\\<close> have \"ns' \\<in> obs ns'' S\" by simp\n          from IH[OF this \\<open>\\<forall>a\\<in>set (tl ns''). return_node a\\<close>]\n          obtain nsx n nsx' n' where split:\"ns'' = nsx @ n # nsx'\"\n            \"ns' = n' # nsx'\" \"n' \\<in> obs_intra n S\"\n            \"\\<forall>nx\\<in>set nsx'. \\<exists>nx'. call_of_return_node nx nx' \\<and> nx' \\<in> S\"\n            and imp:\"\\<forall>xs x xs'. nsx = xs @ x # xs' \\<and> obs_intra x S \\<noteq> {} \\<longrightarrow>\n            (\\<exists>x''\\<in>set (xs' @ [n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S)\"\n            by blast\n          from True imp Cons \n          have \"\\<forall>xs x xs'. nx#nsx = xs @ x # xs' \\<and> obs_intra x S \\<noteq> {} \\<longrightarrow>\n            (\\<exists>x''\\<in>set (xs' @ [n]). \\<exists>nx. call_of_return_node x'' nx \\<and> nx \\<notin> S)\"\n            by clarsimp (hypsubst_thin,case_tac xs,clarsimp+,erule_tac x=\"list\" in allE,auto)\n          with split Cons show ?thesis by auto\n        next\n          case False\n          with \\<open>\\<forall>n'\\<in>set ns''. \\<forall>nx'. call_of_return_node n' nx' \\<longrightarrow> nx' \\<in> S\\<close>\n            \\<open>ns' \\<in> obs (nx # ns'') S\\<close>\n          obtain nx'' where \"ns' = nx''#ns''\" and \"nx'' \\<in> obs_intra nx S\"\n          by(fastforce simp:Let_def split:if_split_asm)\n          { fix n' assume \"n'\\<in>set ns''\"\n            with \\<open>\\<forall>n \\<in> set ns''. return_node n\\<close> have \"return_node n'\" by simp\n            hence \"\\<exists>!n''. call_of_return_node n' n''\" \n              by(rule return_node_call_of_return_node)\n            from \\<open>n'\\<in>set ns''\\<close> \n              \\<open>\\<forall>n'\\<in>set ns''. \\<forall>nx'. call_of_return_node n' nx' \\<longrightarrow> nx' \\<in> S\\<close>\n            have \"\\<forall>nx'. call_of_return_node n' nx' \\<longrightarrow> nx' \\<in> S\" by simp\n            with \\<open>\\<exists>!n''. call_of_return_node n' n''\\<close> \n            have \"\\<exists>n''. call_of_return_node n' n'' \\<and> n'' \\<in> S\" by fastforce }\n          with \\<open>ns' = nx''#ns''\\<close> \\<open>nx'' \\<in> obs_intra nx S\\<close> show ?thesis by fastforce\n        qed\n      qed\n    qed\n  qed\nqed\n\n\n\nlemma obs_split_det:\n  assumes \"xs@x#xs' = ys@y#ys'\" \n  and \"obs_intra x S \\<noteq> {}\" \n  and \"\\<forall>x' \\<in> set xs'. \\<exists>x''. call_of_return_node x' x'' \\<and> x'' \\<in> S\"\n  and \"\\<forall>zs z zs'. xs = zs@z#zs' \\<and> obs_intra z S \\<noteq> {}\n  \\<longrightarrow> (\\<exists>z'' \\<in> set (zs'@[x]). \\<exists>nx. call_of_return_node z'' nx \\<and> nx \\<notin> S)\"\n  and \"obs_intra y S \\<noteq> {}\" \n  and \"\\<forall>y' \\<in> set ys'. \\<exists>y''. call_of_return_node y' y'' \\<and> y'' \\<in> S\"\n  and \"\\<forall>zs z zs'. ys = zs@z#zs' \\<and> obs_intra z S \\<noteq> {}\n  \\<longrightarrow> (\\<exists>z'' \\<in> set (zs'@[y]). \\<exists>ny. call_of_return_node z'' ny \\<and> ny \\<notin> S)\"\n  shows \"xs = ys \\<and> x = y \\<and> xs' = ys'\"\nusing assms\nproof(induct xs arbitrary:ys)\n  case Nil\n  note impy = \\<open>\\<forall>zs z zs'. ys = zs@z#zs' \\<and> obs_intra z S \\<noteq> {}\n    \\<longrightarrow> (\\<exists>z'' \\<in> set (zs'@[y]). \\<exists>ny. call_of_return_node z'' ny \\<and> ny \\<notin> S)\\<close>\n  show ?case\n  proof(cases \"ys = []\")\n    case True\n    with Nil \\<open>[]@x#xs' = ys@y#ys'\\<close> show ?thesis by simp\n  next\n    case False\n    with \\<open>[] @ x # xs' = ys @ y # ys'\\<close> \n    obtain zs where \"x#zs = ys\" and \"xs' = zs@y#ys'\" by(auto simp:Cons_eq_append_conv)\n    from \\<open>x#zs = ys\\<close> \\<open>obs_intra x S \\<noteq> {}\\<close> impy \n    have \"\\<exists>z'' \\<in> set (zs@[y]). \\<exists>ny. call_of_return_node z'' ny \\<and> ny \\<notin> S\"\n      by blast\n    with \\<open>xs' = zs@y#ys'\\<close> \\<open>\\<forall>x' \\<in> set xs'. \\<exists>x''. call_of_return_node x' x'' \\<and> x'' \\<in> S\\<close>\n    have False by fastforce\n    thus ?thesis by simp\n  qed\nnext\n  case (Cons w ws)\n  note IH = \\<open>\\<And>ys. \\<lbrakk>ws @ x # xs' = ys @ y # ys'; obs_intra x S \\<noteq> {};\n    \\<forall>x'\\<in>set xs'. \\<exists>x''. call_of_return_node x' x'' \\<and> x'' \\<in> S;\n    \\<forall>zs z zs'. ws = zs @ z # zs' \\<and> obs_intra z S \\<noteq> {} \\<longrightarrow>\n      (\\<exists>z''\\<in>set (zs' @ [x]). \\<exists>nx. call_of_return_node z'' nx \\<and> nx \\<notin> S);\n    obs_intra y S \\<noteq> {}; \\<forall>y'\\<in>set ys'. \\<exists>y''. call_of_return_node y' y'' \\<and> y'' \\<in> S;\n    \\<forall>zs z zs'. ys = zs @ z # zs' \\<and> obs_intra z S \\<noteq> {} \\<longrightarrow>\n      (\\<exists>z''\\<in>set (zs' @ [y]). \\<exists>ny. call_of_return_node z'' ny \\<and> ny \\<notin> S)\\<rbrakk>    \n    \\<Longrightarrow> ws = ys \\<and> x = y \\<and> xs' = ys'\\<close>\n  note impw = \\<open>\\<forall>zs z zs'. w # ws = zs @ z # zs' \\<and> obs_intra z S \\<noteq> {} \\<longrightarrow>\n    (\\<exists>z''\\<in>set (zs' @ [x]). \\<exists>nx. call_of_return_node z'' nx \\<and> nx \\<notin> S)\\<close>\n  note impy = \\<open>\\<forall>zs z zs'. ys = zs @ z # zs' \\<and> obs_intra z S \\<noteq> {} \\<longrightarrow>\n    (\\<exists>z''\\<in>set (zs' @ [y]). \\<exists>ny. call_of_return_node z'' ny \\<and> ny \\<notin> S)\\<close>\n  show ?case\n  proof(cases ys)\n    case Nil\n    with \\<open>(w#ws) @ x # xs' = ys @ y # ys'\\<close> have \"y = w\" and \"ys' = ws @ x # xs'\"\n      by simp_all\n    from \\<open>y = w\\<close> \\<open>obs_intra y S \\<noteq> {}\\<close> impw\n    have \"\\<exists>z''\\<in>set (ws @ [x]). \\<exists>nx. call_of_return_node z'' nx \\<and> nx \\<notin> S\" by blast\n    with \\<open>ys' = ws @ x # xs'\\<close> \n      \\<open>\\<forall>y'\\<in>set ys'. \\<exists>y''. call_of_return_node y' y'' \\<and> y'' \\<in> S\\<close>\n    have False by fastforce\n    thus ?thesis by simp\n  next\n    case (Cons w' ws')\n    with \\<open>(w # ws) @ x # xs' = ys @ y # ys'\\<close> have \"w = w'\"\n      and \"ws @ x # xs' = ws' @ y # ys'\" by simp_all\n    from impw have imp1:\"\\<forall>zs z zs'. ws = zs @ z # zs' \\<and> obs_intra z S \\<noteq> {} \\<longrightarrow>\n      (\\<exists>z''\\<in>set (zs' @ [x]). \\<exists>nx. call_of_return_node z'' nx \\<and> nx \\<notin> S)\"\n      by clarsimp(erule_tac x=\"w#zs\" in allE,clarsimp)\n    from Cons impy have imp2:\"\\<forall>zs z zs'. ws' = zs @ z # zs' \\<and> obs_intra z S \\<noteq> {} \\<longrightarrow>\n      (\\<exists>z''\\<in>set (zs' @ [y]). \\<exists>ny. call_of_return_node z'' ny \\<and> ny \\<notin> S)\"\n      by clarsimp(erule_tac x=\"w'#zs\" in allE,clarsimp)\n    from IH[OF \\<open>ws @ x # xs' = ws' @ y # ys'\\<close> \\<open>obs_intra x S \\<noteq> {}\\<close>\n      \\<open>\\<forall>x'\\<in>set xs'. \\<exists>x''. call_of_return_node x' x'' \\<and> x'' \\<in> S\\<close> imp1\n      \\<open>obs_intra y S \\<noteq> {}\\<close> \\<open>\\<forall>y'\\<in>set ys'. \\<exists>y''. call_of_return_node y' y'' \\<and> y'' \\<in> S\\<close> \n      imp2]\n    have \"ws = ws' \\<and> x = y \\<and> xs' = ys'\" .\n    with \\<open>w = w'\\<close> Cons show ?thesis by simp\n  qed\nqed\n\n\nlemma in_obs_valid:\n  assumes \"ns' \\<in> obs ns S\" and \"\\<forall>n \\<in> set ns. valid_node n\"\n  shows \"\\<forall>n \\<in> set ns'. valid_node n\"\n  using \\<open>ns' \\<in> obs ns S\\<close> \\<open>\\<forall>n \\<in> set ns. valid_node n\\<close>\n  by(induct ns)(auto intro:in_obs_intra_valid simp:Let_def split:if_split_asm)\n\n\n\nend\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/HRB-Slicing/StaticInter/Observable.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.588889130767832, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3036429639767095}}
{"text": "theory SimpViaMetaRec\nimports \"../metarec/HOLMetaRec\"\nbegin\n\n(* simpto_const already exists in HOLMetaRec *)\n(* synth  t2  from  t1,   t1 is primary *)\ndefinition\n  simpto2_const :: \"'a::{} => 'a => prop\" (\"(_) simpto2 (_)\" [30,30] 20)\nwhere\n  [MRjud 1 1]: \"simpto2_const t1 t2 == (t1 == t2)\"\n(* synth  t2  from  t1,   t1 is primary *)\ndefinition\n  irewto_const :: \"'a::{} => 'a => prop\" (\"(_) irewto (_)\" [10,10] 10)\nwhere\n  [MRjud 1 1]: \"irewto_const t1 t2 == (t1 == t2)\"\n(* rewto_const already exists in HOLMetaRec *)\n(* synth  t2  from  t1,   t1 is primary *)\ndefinition\n  rewto2_const :: \"'a::{} => 'a => prop\" (\"(_) rewto2 (_)\" [10,10] 10)\nwhere\n  [MRjud 1 1]: \"rewto2_const t1 t2 == (t1 == t2)\"\n\n(* synth  t2  from  t1,   t1 is primary *)\ndefinition\n  subsimpto_const :: \"'a::{} => 'a => prop\" (\"(_) subsimpto (_)\" [10,10] 10)\nwhere\n  [MRjud 1 1]: \"subsimpto_const t1 t2 == (t1 == t2)\"\n\n(* synth  t'  from  t1,t2   t1 is primary *)\ndefinition\n  checkbeta_const :: \"('a::{} => 'b::{}) => 'a => 'b => prop\" (\"checkbeta (_) (_) to (_)\" [10,10,10] 10)\nwhere\n  [MRjud 2 1]: \"checkbeta_const t1 t2 t' == ((t1 t2) == t')\"\n\n\n(* low prior *)\nlemma id_sub[MR]:\n  \"  t subsimpto t  \"\n  unfolding subsimpto_const_def by simp\n\n(* beachte: decompose matching auf primaere Objekte eta-expandiert diese nicht on-the-fly\n     sichert hier Termination weil sonst auf t in t(x) in der Premisse wieder diese Regel\n     passen wuerde *)\nlemma lam_sub[MR]:\n  \"(!! x. (t x) simpto2 (t' x))\n  ==>  (% x. t(x)) subsimpto (% x. t'(x))\"\n  unfolding simpto2_const_def subsimpto_const_def\n  ML_prf {* Thm.axiom @{theory} \"Pure.abstract_rule\"  *}\n  by (tactic {* rtac (Thm.axiom @{theory} \"Pure.abstract_rule\") 1 *})\n\nlemma app_sub[MR]:\n  \"[|  t1 simpto2 t1'  ;  t2 simpto2 t2'  ;  checkbeta t1' t2' to t' |]\n  ==>  (t1 t2) subsimpto t'\"\n  unfolding simpto2_const_def checkbeta_const_def subsimpto_const_def by simp\n\n(* congruence rule for meta implication *)\nlemma imp_sub[MR]:\n  \"[|  (PROP t1) simpto2 (PROP t1')  ;  PROP t1' ==> (PROP t2) simpto2 (PROP t2') |]\n  ==> (PROP t1 ==> PROP t2) subsimpto (PROP t1' ==> PROP t2')\"\n unfolding subsimpto_const_def simpto2_const_def by simp\n\n\n(* low prior *)\nlemma checkbeta_id[MR]:\n  \"checkbeta t1 t2 to (t1 t2)\"\n  unfolding checkbeta_const_def by simp\n\n(* high priority *)\n(* TODO: checks perfectly fine, but we want simpto2 to depend implicitly on rewto2,\n   using what is there ATM, to avoid what is interpreted as cyclic dependencies *)\nlemma checkbeta_rew[MR_unchecked]:\n  \"[|  try ( (t1(t2)) rewto2 t' )  ;  t' simpto2 t'' |]\n  ==>  checkbeta (% x. t1(x)) t2 to t''   \"\n  unfolding try_const_def simpto2_const_def rewto2_const_def checkbeta_const_def by simp\n\nlemma simpto2_rule[MR]:\n \"[|  t subsimpto t'  ;  t' irewto t''  |]\n ==>  t simpto2 t''  \"\n unfolding simpto2_const_def irewto_const_def subsimpto_const_def by simp\n\n(* not always what is wanted in automation! *)\nlemma simpto2_eq:  \"[|  t simpto2 t'  ;  t2 simpto2 t'  |] ==>\n  (t = t2) simpto2 True \"\n  by(simp add: simpto2_const_def)\n  \n\n\n(* low prior *)\nlemma irewto_id[MR]:\n  \"t irewto t\"\n  unfolding irewto_const_def by simp\n\n(* high prior *)\n(* bottom-up *)\n(* TODO: checks perfectly fine, but we want simpto2 to depend implicitly on rewto2,\n   using what is there ATM, to avoid what is interpreted as cyclic dependencies *)\nlemma irewto_rule[MR_unchecked]:\n  \"[|  try (t rewto2 t')  ;  t' simpto2 t'' |]\n  ==>  t irewto t''\"\n unfolding rewto2_const_def irewto_const_def try_const_def simpto2_const_def subsimpto_const_def\n by simp\n\n\n\n\nlemma simpto2_prop_fconv: \"  P simpto2 P' ==> PROP P' ==> PROP P  \"\n  by (simp add: simpto2_const_def)\n\n\nML {*\n  MetaRec.fconv_metarec\n*}\n\nmethod_setup mrsimp = {*\n  let fun solver ths =\n    FIRST' [resolve_tac (reflexive_thm :: @{thm TrueI} :: @{thm refl} :: ths),\n      atac, etac @{thm FalseE}, K all_tac]\n  in\n    Attrib.thms >> (fn thms => fn ctxt => METHOD (fn facts =>\n      let\n        val ths = facts @ thms\n        val ctxt2 = ctxt\n          |> Context.proof_map (MetaRec.add_rule 0 @{thm simpto2_eq})\n          |> fold (MetaRec.add_assm true) ths\n      in\n        MetaRec.fconv_metarec @{thm simpto2_prop_fconv} (solver ths) ctxt2 1\n      end))\n  end\n*} \"\"\n\n(* \"competing\" animation methods: ares_tac tries the rules in the list, priorized from left to right *)\nmethod_setup dfs_solve = {*\n  Attrib.thms >> (fn thms => K (METHOD (fn facts =>\n  (DEPTH_SOLVE (HEADGOAL (ares_tac (facts @ thms)))))))\n*} \"\"\nmethod_setup bfs_solve = {*\n  Attrib.thms >> (fn thms => K (METHOD (fn facts =>\n  (BREADTH_FIRST (has_fewer_prems 1) (HEADGOAL (ares_tac (facts @ thms)))))))\n*} \"\"\nmethod_setup iterdeep_solve = {*\n  Attrib.thms >> (fn thms => K (METHOD (fn facts =>\n  (ITER_DEEPEN 20 (has_fewer_prems 1) (ares_tac (facts @ thms))))))\n*} \"\"\n\n\n\n\n\nlocale tests = \n  fixes dummy :: 'dummy\nbegin\n\n(* lets have some stupid examples *)\n\ndefinition\n  A ::nat\nwhere \"A = 0\"\ndefinition\n  B ::nat\nwhere \"B = 0\"\n\nlemma Asimp: \"A == B\" by (simp add: A_def B_def)\n\n(* some trivial fact to rewrite with *)\nlemma userrewdecl[MR]:\n  \"A rewto2 B\"\nby (simp add: rewto2_const_def A_def B_def)\n\n\n\nschematic_lemma test: \"A simpto2 ?C\"\n(* doesnt terminate? *)\n (* by (dfs_solve tryI app_sub id_sub checkbeta_rew checkbeta_id simpto2_rule irewto_rule irewto_id userrewdecl) *)\n(* manually: *)\n(* apply (rule simpto2_rule)\n  apply (rule id_sub)\n  apply (rule irewto_rule)\n  apply (rule tryI)\n  apply (rule userrewdecl)\n  apply (rule simpto2_rule)\n  apply (rule id_sub)\n  by (rule irewto_id)  *)\nby (tactic {* MetaRec.metarec_tac @{context} 1 *})\n\nschematic_lemma test2: \"((!! P. A = A ==> P ==> True) ==> True) simpto2 ?C\"\n(* doesnt terminate?\n   lam_sub Regel muss man rausnehmen sonst triviale nicht-Term wg Unif modulo eta *)\n (* by (dfs_solve tryI app_sub id_sub checkbeta_rew checkbeta_id simpto2_rule irewto_rule irewto_id userrewdecl)  *)\n(* bfs_solve, iterdeep_solve use wrong execution model: don't rewrite at all *)\n (* by (bfs_solve tryI app_sub id_sub checkbeta_rew checkbeta_id simpto2_rule irewto_rule irewto_id userrewdecl) *)\n (* by (iterdeep_solve  tryI app_sub id_sub checkbeta_rew checkbeta_id simpto2_rule irewto_rule irewto_id userrewdecl)  *)\n(* 38ms without optimizations, 25 ms with no_comp_rules Optimization *)\nby (tactic {* MetaRec.metarec_tac @{context} 1 *})\n\n(* 3ms *)\nlemma test2': \"((!! P. A = A ==> P ==> True) ==> True)\"\nby (simp add: userrewdecl[simplified rewto2_const_def])\n\nML {*\n  val ct = @{term \"((!! P. A = A ==> P ==> True) ==> True)\"}\n    |> cterm_of @{theory}\n  val simpth = @{thm Asimp}\n  fun runsimp () =\n    let val _ = Raw_Simplifier.rewrite true [simpth] ct in () end\n*}\n(* 1 ms! *)\nML {*\n  val _ = runsimp ()\n*}\n\n\nschematic_lemma test3: assumes [MRassm]: \"(0::nat) rewto2 1\" shows \"(0::nat) simpto2 ?C\"\nby (tactic {* MetaRec.metarec_tac @{context} 1 *})\n\n\nschematic_lemma test4: assumes [MRassm]: \"(0::nat) rewto2 1\" shows \"Suc (0::nat) = Suc 1\"\nby mrsimp\n\n\n\ndefinition\n  foo :: \"'a => 'a => bool\"\nwhere\n  [MRjud 1 1]: \"foo x y == True\"\n\n(* test local frules *)\nschematic_lemma test5:\n  assumes [MRassm]: \"foo (0::nat) (1::nat)\"\n  and [MRassm]: \"!! (x::nat) y. frule(foo x y ==> x rewto2 y)\"\n  shows \"(0::nat) simpto2 ?C\"\nby (tactic {* MetaRec.metarec_tac @{context} 1 *})\n\n(* test local brules *)\nschematic_lemma test6:\n  assumes [MRassm]: \"foo (0::nat) (1::nat)\"\n  and [MRassm]: \"!! (x::nat) y. foo x y ==> x rewto2 y\"\n  shows \"(0::nat) rewto2 ?C\"\nby (tactic {* MetaRec.metarec_tac @{context} 1 *})\n\n\nschematic_lemma\n  assumes [MRassm]: \"!! P1 P2. Trueprop (P1 --> P2) rewto2  (P1 ==> P2)\"\n  shows \"Trueprop (P1 --> P2 --> P3)  simpto2 ?Q\"\n  by (tactic {* MetaRec.metarec_tac @{context} 1 *})\n\n\nend\n\n\nend\n", "meta": {"author": "metaforcy", "repo": "nonfree-data", "sha": "f3ce28278a88fdd240faa2e51f893fee5c15f2f2", "save_path": "github-repos/isabelle/metaforcy-nonfree-data", "path": "github-repos/isabelle/metaforcy-nonfree-data/nonfree-data-f3ce28278a88fdd240faa2e51f893fee5c15f2f2/SimpViaMetaRec.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5156199157230156, "lm_q2_score": 0.588889130767832, "lm_q1q2_score": 0.3036429639767094}}
{"text": "(*  Title:      HOL/Auth/n_mesi.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mesi Protocol Case Study*} \n\ntheory n_mesi imports n_mesi_lemma_invs_on_rules n_mesi_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/mesi/n_mesi.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3036429565362066}}
{"text": "(*  Title:       Jive Data and Store Model\n    Author:      Norbert Schirmer <schirmer at informatik.tu-muenchen.de>, 2003\n    Maintainer:  Nicole Rauch <rauch at informatik.uni-kl.de>\n    License:     LGPL\n*)\n\nheader {* Location *}\n\ntheory Location\nimports AttributesIndep \"../Isabelle/Value\"\nbegin \n\ntext {* A storage location can be a field of an object, a static field,\n the length of an array, or the contents of an array.  \n*}\n\ndatatype Location = objLoc    CAttId ObjectId     --{* field in object *} \n                  | staticLoc AttId               --{* static field in concrete class *}\n                  | arrLenLoc Arraytype ObjectId   --{* length of an array *}\n                  | arrLoc    Arraytype ObjectId nat --{* contents of an array *}\n\ntext {* We only directly support one-dimensional arrays. Multidimensional\narrays can be simulated by arrays of references to arrays.\n*}\n\ntext {* The function @{text \"ltype\"} yields the content type of a location. *}\ndefinition ltype:: \"Location \\<Rightarrow> Javatype\" where\n\"ltype l = (case l of\n              objLoc cf a  \\<Rightarrow> rtype (att cf)\n            | staticLoc f     \\<Rightarrow> rtype f\n            | arrLenLoc T a   \\<Rightarrow> IntgT\n            | arrLoc T a i \\<Rightarrow> at2jt T)\" \n\nlemma ltype_simps [simp]:\n\"ltype (objLoc cf a)  = rtype (att cf)\"\n\"ltype (staticLoc f)     = rtype f\"\n\"ltype (arrLenLoc T a)   = IntgT\"\n\"ltype (arrLoc T a i) = at2jt T\" \n  by (simp_all add: ltype_def)\n\ntext {* Discriminator functions to test whether a location denotes an array length\nor whether it denotes a static object. Currently, the discriminator functions for\nobject and array locations are not specified. They can be added if they are needed.\n*}\n\ndefinition isArrLenLoc:: \"Location \\<Rightarrow> bool\" where\n\"isArrLenLoc l = (case l of\n                 objLoc cf a  \\<Rightarrow> False \n               | staticLoc f     \\<Rightarrow> False\n               | arrLenLoc T a   \\<Rightarrow> True\n               | arrLoc T a i \\<Rightarrow> False)\"\n\n\n\ndefinition isStaticLoc:: \"Location \\<Rightarrow> bool\" where\n\"isStaticLoc l = (case l of\n                 objLoc cff a \\<Rightarrow> False\n               | staticLoc f     \\<Rightarrow> True\n               | arrLenLoc T a   \\<Rightarrow> False\n               | arrLoc T a i \\<Rightarrow> False)\"\nlemma isStaticLoc_simps [simp]:\n\"isStaticLoc (objLoc cf a) = False\"\n\"isStaticLoc (staticLoc f)     = True\"\n\"isStaticLoc (arrLenLoc T a)   = False\"\n\"isStaticLoc (arrLoc T a i) = False\"\n  by (simp_all add: isStaticLoc_def)\n\ntext {* The function @{text \"ref\"} yields the\nobject or array containing the location that is passed\nas argument (see the function @{text \"obj\"} in \n\\cite[p. 43 f.]{Poetzsch-Heffter97specification}).\nNote that for static locations\nthe result is @{text \"nullV\"} since static locations \nare not associated to any object.\n\\label{ref_def}\n*}\ndefinition ref:: \"Location \\<Rightarrow> Value\" where\n\"ref l = (case l of\n            objLoc cf a  \\<Rightarrow> objV (cls cf) a\n          | staticLoc f     \\<Rightarrow> nullV\n          | arrLenLoc T a   \\<Rightarrow> arrV T a\n          | arrLoc T a i \\<Rightarrow> arrV T a)\"\n\nlemma ref_simps [simp]:\n\"ref (objLoc cf a)  = objV (cls cf) a\"\n\"ref (staticLoc f)     = nullV\"\n\"ref (arrLenLoc T a)   = arrV T a\"\n\"ref (arrLoc T a i) = arrV T a\"\n  by (simp_all add: ref_def)\n\ntext {* The function @{text \"loc\"} denotes the subscription of an object \nreference with an attribute. *}\nprimrec loc:: \"Value \\<Rightarrow> AttId \\<Rightarrow> Location\"  (\"_.._\" [80,80] 80)\nwhere \"loc (objV c a) f = objLoc (catt c f) a\"\ntext {* Note that we only define subscription properly for object references.\nFor all other values we do not provide any defining equation, so they will \ninternally be mapped to @{text \"arbitrary\"}.\n*}\n\ntext {* The length of an array can be selected with the function @{text \"arr_len\"}. *}\nprimrec arr_len:: \"Value \\<Rightarrow> Location\"\nwhere \"arr_len (arrV T a) = arrLenLoc T a\"\n\ntext {* Arrays can be indexed by the function @{text \"arr_loc\"}. *}\nprimrec arr_loc:: \"Value \\<Rightarrow> nat \\<Rightarrow> Location\" (\"_.[_]\" [80,80] 80)\nwhere \"arr_loc (arrV T a) i = arrLoc T a i\" \n\ntext {* The functions @{term \"loc\"}, @{term \"arr_len\"} and @{term \"arr_loc\"}\ndefine the interface between the basic store model (based on locations) and\nthe programming language Java. Instance field access {\\tt obj.x} is modelled as \n@{term \"obj..x\"} or @{text \"loc obj x\"} (without the syntactic sugar), \narray length {\\tt a.length} with @{term \"arr_len a\"},\narray indexing {\\tt a[i]} with @{term \"a.[i]\"} or @{text \"arr_loc a i\"}. \nThe accessing of a static field \n{\\tt C.f} can be expressed by the location itself @{text \"staticLoc C'f\"}.\nOf course one can build more infrastructure to make access to instance fields\nand static fields more uniform. We could for example define a \nfunction @{text \"static\"} which indicates whether a field is static or not and\nbased on that create an @{term \"objLoc\"} location or a @{term \"staticLoc\"} location. But \nthis will only complicate the actual proofs and we can already easily \nperform the distinction whether a field is static or not in the \\jive-frontend and \ntherefore keep the verification simpler.\n*} \n\nlemma ref_loc [simp]: \"\\<lbrakk>isObjV r; typeof r \\<le> dtype f\\<rbrakk> \\<Longrightarrow> ref (r..f) = r\"\n  apply (case_tac r)\n  apply (case_tac [!] f)\n  apply (simp_all)\n  done\n\nlemma obj_arr_loc [simp]: \"isArrV r \\<Longrightarrow> ref (r.[i]) = r\"\n  by (cases r) simp_all\n\nlemma obj_arr_len [simp]: \"isArrV r \\<Longrightarrow> ref (arr_len r) = r\"\n  by (cases r) simp_all\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JiveDataStoreModel/Isabelle_Store/Location.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.5156199157230157, "lm_q1q2_score": 0.3036429565362066}}
{"text": "(*\nTitle: WHATandWHERE-Security\nAuthors: Sylvia Grewe, Alexander Lux, Heiko Mantel, Jens Sauer\n*)\ntheory WHATWHERE_Security\nimports Strong_Security.Types\nbegin\n\nlocale WHATWHERE = \nfixes SR :: \"('exp, 'id, 'val, 'com) TLSteps\"\nand E :: \"('exp, 'id, 'val) Evalfunction\"\nand pp :: \"'com \\<Rightarrow> nat\"\nand DA :: \"('id, 'd::order) DomainAssignment\"\nand lH :: \"('d::order, 'exp) lHatches\"\n\nbegin\n\n\\<comment> \\<open>define when two states are indistinguishable for an observer on domain d\\<close>\ndefinition d_equal :: \"'d::order \\<Rightarrow> ('id, 'val) State \n  \\<Rightarrow> ('id, 'val) State \\<Rightarrow> bool\"\nwhere\n\"d_equal d m m' \\<equiv> \\<forall>x. ((DA x) \\<le> d \\<longrightarrow> (m x) = (m' x))\"\n\nabbreviation d_equal' :: \"('id, 'val) State \n  \\<Rightarrow> 'd::order \\<Rightarrow> ('id, 'val) State \\<Rightarrow> bool\" \n( \"(_ =\\<^bsub>_\\<^esub> _)\" )\nwhere\n\"m =\\<^bsub>d\\<^esub> m' \\<equiv> d_equal d m m'\"\n\n\\<comment> \\<open>transitivity of d-equality\\<close>\nlemma d_equal_trans:\n\"\\<lbrakk> m =\\<^bsub>d\\<^esub> m'; m' =\\<^bsub>d\\<^esub> m'' \\<rbrakk> \\<Longrightarrow> m =\\<^bsub>d\\<^esub> m''\"\nby (simp add: d_equal_def)\n\n\nabbreviation SRabbr :: \"('exp, 'id, 'val, 'com) TLSteps_curry\"\n(\"(1\\<langle>_,/_\\<rangle>) \\<rightarrow>\\<lhd>_\\<rhd>/ (1\\<langle>_,/_\\<rangle>)\" [0,0,0,0,0] 81)\nwhere\n\"\\<langle>c,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle> \\<equiv> ((c,m),\\<alpha>,(p,m')) \\<in> SR\"\n\n\n\\<comment> \\<open>function for obtaining the unique memory (state) after one step for a command and a memory (state)\\<close>\ndefinition NextMem :: \"'com \\<Rightarrow> ('id, 'val) State \\<Rightarrow> ('id, 'val) State\"\n( \"\\<lbrakk>_\\<rbrakk>'(_')\" )\nwhere\n\"\\<lbrakk>c\\<rbrakk>(m) \\<equiv> (THE m'. (\\<exists>p \\<alpha>. \\<langle>c,m\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m'\\<rangle>))\"\n\n\\<comment> \\<open>function getting all escape hatches for some location\\<close>\ndefinition htchLoc :: \"nat \\<Rightarrow> ('d, 'exp) Hatches\"\nwhere\n\"htchLoc \\<iota> \\<equiv> {(d,e). (d,e,\\<iota>) \\<in> lH}\"\n\n\\<comment> \\<open>function for getting all escape hatches for some set of locations\\<close>\ndefinition htchLocSet :: \"nat set \\<Rightarrow> ('d, 'exp) Hatches\"\nwhere\n\"htchLocSet PP \\<equiv> \\<Union>{h. (\\<exists>\\<iota> \\<in> PP. h = htchLoc \\<iota>)}\"\n\n\\<comment> \\<open>predicate for (d,H)-equality\\<close>\ndefinition dH_equal :: \"'d \\<Rightarrow> ('d, 'exp) Hatches\n  \\<Rightarrow> ('id, 'val) State \\<Rightarrow> ('id, 'val) State \\<Rightarrow> bool\"\nwhere\n\"dH_equal d H m m' \\<equiv> (m =\\<^bsub>d\\<^esub> m' \\<and> \n  (\\<forall>(d',e) \\<in> H. (d' \\<le> d \\<longrightarrow> (E e m = E e m'))))\"\n\nabbreviation dH_equal' :: \"('id, 'val) State \\<Rightarrow> 'd \\<Rightarrow> ('d, 'exp) Hatches\n  \\<Rightarrow> ('id, 'val) State \\<Rightarrow> bool\"\n( \"(_ \\<sim>\\<^bsub>_,_\\<^esub> _)\" )\nwhere\n\"m \\<sim>\\<^bsub>d,H\\<^esub> m' \\<equiv> dH_equal d H m m'\"\n\n\\<comment> \\<open>predicate indicating that a command is not a d-declassification command\\<close>\ndefinition NDC :: \"'d \\<Rightarrow> 'com \\<Rightarrow> bool\"\nwhere\n\"NDC d c \\<equiv> (\\<forall>m m'. m =\\<^bsub>d\\<^esub> m' \\<longrightarrow> \\<lbrakk>c\\<rbrakk>(m) =\\<^bsub>d\\<^esub> \\<lbrakk>c\\<rbrakk>(m'))\"\n\n\\<comment> \\<open>predicate indicating an 'immediate d-declassification command' for a set of escape hatches\\<close>\ndefinition IDC :: \"'d \\<Rightarrow> 'com \\<Rightarrow> ('d, 'exp) Hatches \\<Rightarrow> bool\"\nwhere\n\"IDC d c H \\<equiv> (\\<exists>m m'. m =\\<^bsub>d\\<^esub> m' \\<and> \n  (\\<not> \\<lbrakk>c\\<rbrakk>(m) =\\<^bsub>d\\<^esub> \\<lbrakk>c\\<rbrakk>(m')))\n  \\<and> (\\<forall>m m'. m \\<sim>\\<^bsub>d,H\\<^esub> m' \\<longrightarrow> \\<lbrakk>c\\<rbrakk>(m) =\\<^bsub>d\\<^esub> \\<lbrakk>c\\<rbrakk>(m') )\"\n\ndefinition stepResultsinR :: \"'com ProgramState \\<Rightarrow> 'com ProgramState \n  \\<Rightarrow> 'com Bisimulation_type \\<Rightarrow> bool\"\nwhere\n\"stepResultsinR p p' R \\<equiv> (p = None \\<and> p' = None) \\<or> \n  (\\<exists>c c'. (p = Some c \\<and> p' = Some c' \\<and> ([c],[c']) \\<in> R))\"\n\n\ndefinition dhequality_alternative ::  \"'d \\<Rightarrow> nat set \\<Rightarrow> nat \n  \\<Rightarrow> ('id, 'val) State \\<Rightarrow> ('id, 'val) State \\<Rightarrow> bool\"\nwhere\n\"dhequality_alternative d PP \\<iota> m m' \\<equiv> m \\<sim>\\<^bsub>d,(htchLocSet PP)\\<^esub> m' \\<or>\n            (\\<not> (htchLoc \\<iota>) \\<subseteq> (htchLocSet PP))\"\n\ndefinition Strong_dlHPP_Bisimulation :: \"'d \\<Rightarrow> nat set \n  \\<Rightarrow> 'com Bisimulation_type \\<Rightarrow> bool\"\nwhere\n\"Strong_dlHPP_Bisimulation d PP R \\<equiv> \n  (sym R) \\<and> (trans R) \\<and>\n  (\\<forall>(V,V') \\<in> R. length V = length V') \\<and>\n  (\\<forall>(V,V') \\<in> R. \\<forall>i < length V. \n    ((NDC d (V!i)) \\<or> \n     (IDC d (V!i) (htchLoc (pp (V!i)))))) \\<and>\n  (\\<forall>(V,V') \\<in> R. \\<forall>i < length V. \\<forall>m1 m1' m2 \\<alpha> p.\n    ( \\<langle>V!i,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m2\\<rangle> \\<and> m1 \\<sim>\\<^bsub>d,(htchLocSet PP)\\<^esub> m1')\n    \\<longrightarrow> (\\<exists>p' \\<alpha>' m2'. ( \\<langle>V'!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n        (stepResultsinR p p' R) \\<and> (\\<alpha>,\\<alpha>') \\<in> R \\<and> \n        (dhequality_alternative d PP (pp (V!i)) m2 m2'))))\"\n\n\n\\<comment> \\<open>predicate to define when a program is strongly secure\\<close>\ndefinition WHATWHERE_Secure :: \"'com list \\<Rightarrow> bool\"\nwhere\n\"WHATWHERE_Secure V \\<equiv> (\\<forall>d PP. \n  (\\<exists>R. Strong_dlHPP_Bisimulation d PP R \\<and> (V,V) \\<in> R))\"\n\n\n\\<comment> \\<open>auxiliary lemma to obtain central strong (d,lH,PP)-Bisimulation property as Lemma\n in meta logic (allows instantiating all the variables manually if necessary)\\<close>\nlemma strongdlHPPB_aux: \n \"\\<And>V V' m1 m1' m2 p i \\<alpha>. \\<lbrakk> Strong_dlHPP_Bisimulation d PP R;\n  i < length V; (V,V') \\<in> R; \n  \\<langle>V!i,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m2\\<rangle>; m1 \\<sim>\\<^bsub>d,(htchLocSet PP)\\<^esub> m1' \\<rbrakk>\n \\<Longrightarrow> (\\<exists>p' \\<alpha>' m2'. \\<langle>V'!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle>\n  \\<and> stepResultsinR p p' R \\<and> (\\<alpha>,\\<alpha>') \\<in> R \\<and> \n  (dhequality_alternative d PP (pp (V!i)) m2 m2'))\"\n  by (simp add: Strong_dlHPP_Bisimulation_def, fastforce)\n\n\\<comment> \\<open>auxiliary lemma to obtain 'NDC or IDC' from strong (d,lH,PP)-Bisimulation as lemma\n  in meta logic allowing instantiation of the variables\\<close>\nlemma strongdlHPPB_NDCIDCaux:\n\"\\<And>V V' i. \\<lbrakk>Strong_dlHPP_Bisimulation d PP R;\n  (V,V') \\<in> R; i < length V \\<rbrakk>\n        \\<Longrightarrow> (NDC d (V!i) \\<or> IDC d (V!i) (htchLoc (pp (V!i))))\"\n  by (simp add: Strong_dlHPP_Bisimulation_def, auto)\n\nlemma WHATWHERE_empty:\n\"WHATWHERE_Secure []\"\n  by (simp add: WHATWHERE_Secure_def, auto,\n  rule_tac x=\"{([],[])}\" in exI,\n  simp add: Strong_dlHPP_Bisimulation_def sym_def trans_def)\n\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/WHATandWHERE_Security/WHATWHERE_Security.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7248702761768248, "lm_q2_score": 0.41869690935568665, "lm_q1q2_score": 0.30350094431903957}}
{"text": "section \\<open>Generic Scheduler\\<close>\ntheory Gen_Scheduler\nimports Main\n  CAVA_Automata.Stuttering_Extension\n  \"../Lib/LTS\" \"../Lib/SOS_Misc_Add\"\n  \"HOL-Library.Multiset\"\nbegin\n\n  lemmas [simp del] = union_mset_add_mset_left union_mset_add_mset_right\n\n  text \\<open>\n    A generic scheduler, that is parameterized with local LTS and\n    enabledness/effects of labels.\n\\<close>\n\n  record ('c,'ls) local_config =\n    command :: 'c\n    state :: 'ls\n\n  record ('c,'ls,'gs) global_config =\n    processes :: \"('c,'ls) local_config multiset\"  \n    state :: 'gs\n\n  locale Gen_Scheduler = cs: LTS cstep \n    for cstep :: \"'c \\<Rightarrow> 'a+'b \\<Rightarrow> 'c \\<Rightarrow> bool\" +\n    fixes en :: \"('ls\\<times>'gs) \\<Rightarrow> 'a \\<rightharpoonup> bool\"\n    fixes ex :: \"('ls\\<times>'gs) \\<Rightarrow> 'a \\<rightharpoonup> ('ls\\<times>'gs)\"\n  begin\n    \n    definition gstep_succ \n      :: \"('c,'ls,'gs)global_config \\<Rightarrow> ('c,'ls,'gs)global_config option set\" \n      where\n      \"gstep_succ gc \\<equiv> do {\n        \\<comment> \\<open> Select process \\<close>\n        let lcs = global_config.processes gc;\n        (lc,lcs') \\<leftarrow> {(lc,lcs'). lcs = {#lc#} + lcs'};\n        \\<comment> \\<open> Focus state \\<close>\n        let gs = global_config.state gc;\n        let ls = local_config.state lc;\n  \n        \\<comment> \\<open> Select action \\<close>\n        let cmd = local_config.command lc;\n        (a,cmd') \\<leftarrow> {(a,cmd'). cstep cmd a cmd'};\n        \n        case a of\n          Inl a \\<Rightarrow> (\n            case en (ls,gs) a of\n              None \\<Rightarrow> {None} \\<comment> \\<open> Error \\<close>\n            | Some False \\<Rightarrow> {} \\<comment> \\<open> Not enabled \\<close>\n            | Some True \\<Rightarrow> {do { \\<comment> \\<open> Enabled \\<close>\n                \\<comment> \\<open> Execute \\<close>\n                (ls,gs) \\<leftarrow> ex (ls,gs) a;\n                \\<comment> \\<open> Unfocus state. \\<close>\n                Some \\<lparr> \n                  global_config.processes = {# \n                    \\<lparr> local_config.command = cmd', local_config.state = ls\\<rparr> \n                  #} + lcs',\n                  global_config.state = gs  \n                \\<rparr>\n              }}\n          )\n        | Inr _ \\<Rightarrow> {None}\n      }\"\n  \n    definition gstep\n      :: \"(('c, 'ls, 'gs) global_config option \\<times> ('c, 'ls, 'gs) global_config option) set\"\n      where \"gstep \\<equiv> {(Some c, c') |c c'. c' \\<in> gstep_succ c}\"\n\n    text \\<open>For the final step function, we apply stutter extension\\<close>\n    definition \"step \\<equiv> stutter_extend_edges UNIV gstep\"\n\n    lemma gstep_eq_pred_of_succ: \"gstep = rel_of_succ (m2r_succ gstep_succ)\"\n      unfolding gstep_def by auto\n  \n    lemma gstep_eq_conv: \"(c, c') \\<in> gstep \\<longleftrightarrow> (\\<exists>cc. c=Some cc \\<and> c'\\<in>gstep_succ cc)\"\n      unfolding gstep_def by auto\n\n    \n\n    lemma [simp]: \"\\<not>(All Not)\" by blast \n\n    lemma ne_Some_b_conv:\n      \"(a\\<noteq>Some b) \\<longleftrightarrow> (a=Some (\\<not>b) \\<or> a=None)\"\n      by (cases a) auto\n\n\n    lemma gstep_succE[cases set: gstep_succ, case_names fail_cfg fail_en fail_ex succ]: \n      assumes \"gc' \\<in> gstep_succ gc\"\n      obtains \n        lc lcs c' b \n        where\n        \"processes gc = {#lc#} + lcs\"\n        \"cstep (command lc) (Inr b) c'\"\n        \"gc'=None\"\n      | lc lcs c' a \n        where\n        \"processes gc = {#lc#} + lcs\"\n        \"cstep (command lc) (Inl a) c'\"\n        \"en (local_config.state lc, global_config.state gc) a = None\"\n        \"gc' = None\"\n      | lc lcs c' a \n        where\n        \"processes gc = {#lc#} + lcs\"\n        \"cstep (command lc) (Inl a) c'\"\n        \"en (local_config.state lc, global_config.state gc) a = Some True\"\n        \"ex (local_config.state lc, global_config.state gc) a = None\"\n        \"gc' = None\"\n      | lc lcs c' a ls' gs'\n        where\n        \"processes gc = {#lc#} + lcs\"\n        \"cstep (command lc) (Inl a) c'\"\n        \"en (local_config.state lc, global_config.state gc) a = Some True\"\n        \"ex (local_config.state lc, global_config.state gc) a = Some (ls',gs')\"\n        \"gc' = Some \\<lparr>\n          global_config.processes \n            = {#\\<lparr> local_config.command = c', local_config.state = ls' \\<rparr>#} + lcs,\n          global_config.state \n            = gs'\n        \\<rparr>\"\n      using assms\n      unfolding gstep_succ_def\n      apply (auto\n        split: option.splits bool.splits Option.bind_splits sum.splits\n        simp: all_conj_distrib \n        elim!: neq_Some_bool_cases)\n      apply (case_tac aa)\n      apply (auto simp: ne_Some_b_conv)\n      done\n\n    lemma gstep_succ_fail_cmd:\n      assumes \"processes gc = {#lc#} + lcs\"\n      assumes \"cstep (command lc) (Inr b) c'\"\n      shows \"None \\<in> gstep_succ gc\"\n      using assms unfolding gstep_succ_def\n      by (fastforce)\n\n\n    lemma gstep_succ_fail_en:\n      assumes \"processes gc = {#lc#} + lcs\"\n      assumes \"cstep (command lc) (Inl a) c'\"\n      assumes \"en (local_config.state lc, global_config.state gc) a = None\"\n      shows \"None \\<in> gstep_succ gc\"\n      using assms unfolding gstep_succ_def\n      by (fastforce)\n      \n    lemma gstep_succ_fail_ex:\n      assumes \"processes gc = {#lc#} + lcs\"\n      assumes \"cstep (command lc) (Inl a) c'\"\n      assumes \"en (local_config.state lc, global_config.state gc) a = Some True\"\n      assumes \"ex (local_config.state lc, global_config.state gc) a = None\"\n      shows \"None \\<in> gstep_succ gc\"\n      using assms unfolding gstep_succ_def\n      by (fastforce)\n\n    lemma gstep_succ_succ:\n      assumes \"processes gc = {#lc#} + lcs\"\n      assumes \"cstep (command lc) (Inl a) c'\"\n      assumes \"en (local_config.state lc, global_config.state gc) a = Some True\"\n      assumes \"ex (local_config.state lc, global_config.state gc) a = Some (ls',gs')\"\n      shows \"Some \\<lparr>\n          global_config.processes \n            = {#\\<lparr> local_config.command = c', local_config.state = ls' \\<rparr>#} + lcs,\n          global_config.state \n            = gs'\n        \\<rparr> \\<in> gstep_succ gc\"\n      using assms unfolding gstep_succ_def\n      by (fastforce)\n\n  end    \n\n  locale Gen_Scheduler_linit = \n    Gen_Scheduler cstep en ex\n    for cstep :: \"'c \\<Rightarrow> 'a+'b \\<Rightarrow> 'c \\<Rightarrow> bool\"\n    and en :: \"('ls\\<times>'gs) \\<Rightarrow> 'a \\<rightharpoonup> bool\"\n    and ex :: \"('ls\\<times>'gs) \\<Rightarrow> 'a \\<rightharpoonup> ('ls\\<times>'gs)\" +\n    fixes ginit :: \"('c,'ls,'gs) global_config set\"\n    fixes glabel :: \"('c,'ls,'gs) global_config \\<Rightarrow> 'l\"\n  begin\n\n    definition init where \"init \\<equiv> Some ` ginit\"\n    fun label where \"label None = undefined\" | \"label (Some gc) = glabel gc\"\n\n    lemma init_conv: \"gco \\<in> init \\<longleftrightarrow> (\\<exists>gc. gco=Some gc \\<and> gc \\<in> ginit)\"\n      unfolding init_def by auto\n\n    definition system_automaton' :: \"(('c,'ls,'gs) global_config option, 'l) sa_rec\"\n      where \"system_automaton' \\<equiv> \\<lparr> g_V = UNIV, g_E = gstep, g_V0 = init, sa_L = label \\<rparr>\"\n\n    lemma system_automaton'_simps[simp]:\n      \"g_V system_automaton' = UNIV\"\n      \"g_E system_automaton' = gstep\"\n      \"g_V0 system_automaton' = init\"\n      \"sa_L system_automaton' = label\"\n      unfolding system_automaton'_def by simp+\n\n    definition system_automaton :: \"(('c,'ls,'gs) global_config option, 'l) sa_rec\"\n      where \"system_automaton \\<equiv> \\<lparr> g_V = UNIV, g_E = step, g_V0 = init, sa_L = label \\<rparr>\"\n\n    lemma system_automaton_simps[simp]:\n      \"g_V system_automaton = UNIV\"\n      \"g_E system_automaton = step\"\n      \"g_V0 system_automaton = init\"\n      \"sa_L system_automaton = label\"\n      unfolding system_automaton_def by simp+\n\n    lemma system_automaton_alt_def: \"system_automaton = stutter_extend system_automaton'\"\n      unfolding step_def system_automaton'_def system_automaton_def stutter_extend_def by simp\n\n    sublocale sa': sa system_automaton' by unfold_locales auto\n    sublocale sa: sa system_automaton unfolding system_automaton_alt_def by (rule sa'.stutter_extend_sa)\n\n  end\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/RefPoint/Gen_Scheduler.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544210587586, "lm_q2_score": 0.43398146480389854, "lm_q1q2_score": 0.30346345792168206}}
{"text": "(* memory_model.thy *)\n(* William Mansky *)\n(* Memory model locales for PTRANS. *)\n\ntheory memory_model\nimports \"$AFP/List-Infinite/ListInfinite\"\nbegin\n\nprint_locale \"ord\"\n\ninstantiation option :: (ord) ord\nbegin\nfun less_eq_option where\n   \"(None \\<le> None) = True\"\n | \"(None \\<le> (Some _ )) = True\"\n | \"((Some _) \\<le> None) = False\"\n | \"((Some x) \\<le> (Some y)) = (x \\<le> y)\"\n\nfun less_option where\n   \"(None < None) = False\"\n | \"(None < (Some _)) = True\"\n | \"((Some _) < None) = False\"\n | \"((Some x) < (Some y)) = (x < y)\"\n\ninstance proof qed\nend\n\nlemma map_add_dom_upd [simp]: \"dom m' = {k} \\<Longrightarrow> (m ++ m')(k \\<mapsto> v) = m(k \\<mapsto> v)\"\nby (auto intro!: ext simp add: map_add_def split: option.splits)\n\nlemma dud_set [simp]: \"{(l, v). False} = {}\"\nby simp\n\n(* Extra utility function: enumerate the elements of a set in arbitrary order. \n   Useful for memory models. Could conceivably be replaced by Eps over finite_distinct_list. *)\nthm finite_distinct_list\nfunction list_of_set where\n\"list_of_set S = (if infinite S \\<or> S = {} then [] else let a = SOME a. a \\<in> S in a # list_of_set (S - {a}))\"\nby pat_completeness auto\ntermination \napply (relation \"measure (\\<lambda>S. card S)\", auto)\napply (frule card_Diff_singleton, rule someI, simp)\napply (case_tac \"card S\", simp_all)\ndone\nlemma list_of_set_empty [simp]: \"list_of_set {} = []\"\nby simp\nlemma list_of_set_inf [simp]: \"infinite S \\<Longrightarrow> list_of_set S = []\"\nby simp\nlemma list_of_set_card [simp]: \"(list_of_set S \\<noteq> []) = (card S \\<noteq> 0)\"\nby (auto simp add: Let_def)\ndeclare list_of_set.simps [simp del]\n\nlemma set_some [simp]: \"S \\<noteq> {} \\<Longrightarrow> insert (SOME a. a \\<in> S) S = S\"\nby (metis insert_absorb not_ex_in_conv someI)\n\nlemma set_some2 [simp]: \"S \\<noteq> {} \\<Longrightarrow> (SOME a. a \\<in> S) \\<in> S\"\nby (metis not_ex_in_conv someI)\n\nlemma list_of_set_set [simp]: \"finite S \\<Longrightarrow> set (list_of_set S) = S\"\napply (induct \"card S\" arbitrary: S, simp_all)\napply (rule trans, simp add: list_of_set.simps, simp add: Let_def)\ndone\n\ncorollary list_of_set_nth: \"\\<lbrakk>list_of_set S ! i = x; i < length (list_of_set S)\\<rbrakk> \\<Longrightarrow> x \\<in> S\"\napply (subgoal_tac \"finite S\", subgoal_tac \"x \\<in> set (list_of_set S)\", simp, \n simp add: set_conv_nth, force)\napply (auto simp add: list_of_set.simps split: if_splits)\ndone\n\nlemma list_of_set_distinct [simp]: \"distinct (list_of_set S)\"\napply (induct \"card S\" arbitrary: S, clarsimp simp add: list_of_set.simps)\napply (rule_tac P=distinct in list_of_set.simps [THEN sym [THEN subst]], clarsimp simp add: Let_def)\ndone  \n\ndatatype ('thread, 'loc, 'val) access = Read 'thread 'loc 'val | Write 'thread 'loc 'val \n  | ARW 'thread 'loc 'val 'val | Alloc 'thread 'loc | Free 'thread 'loc\nprimrec get_thread where\n\"get_thread (Read t _ _) = t\" |\n\"get_thread (Write t _ _) = t\" |\n\"get_thread (ARW t _ _ _) = t\" |\n\"get_thread (Alloc t _) = t\" |\n\"get_thread (Free t _) = t\"\nprimrec get_loc where\n\"get_loc (Read _ l _) = l\" |\n\"get_loc (Write _ l _) = l\" |\n\"get_loc (ARW _ l _ _) = l\" |\n\"get_loc (Alloc _ l) = l\" |\n\"get_loc (Free _ l) = l\"\nprimrec set_thread where\n\"set_thread t' (Read t l v) = Read t' l v\" |\n\"set_thread t' (Write t l v) = Write t' l v\" |\n\"set_thread t' (ARW t l v v') = ARW t' l v v'\" |\n\"set_thread t' (Alloc t l) = Alloc t' l\" |\n\"set_thread t' (Free t l) = Free t' l\"\nlemma set_get_thread [simp]: \"set_thread (get_thread a) a = a\"\nby (case_tac a, auto)\nlemma get_set_thread [simp]: \"get_thread (set_thread t a) = t\"\nby (case_tac a, auto)\nlemma set_thread_frees [simp]: \"set_thread t' ` Free t ` S = Free t' ` S\"\nby (auto simp add: image_def)\n\nabbreviation \"get_ptrs ops \\<equiv> get_loc ` ops\"\n\n\ntype_synonym ('block, 'os) pointer = \"'block * 'os\"\ntype_synonym ('add, 'size) block_structure = \"'add * 'size\"\n\ndatatype ('add,'val,'size,'os) raw_block =\n    RawBlk \"('add, 'size) block_structure\" \"('os \\<rightharpoonup> 'val)\"\n\ntype_synonym ('add, 'val, 'size) allocation = \"(('add, 'size) block_structure) set\"\n\ntype_synonym ('add,'val,'size,'os) block_allocation = \"('add,'val,'size,'os) raw_block set\"\n\nfun get_addr_s where\n  \"get_addr_s ((addr,_)::(('add,'size) block_structure)) = addr\"\n\nfun get_size_s where\n  \"get_size_s ((_,s)::(('add,'size) block_structure)) = s\"\n\nfun get_addr where \"get_addr ( RawBlk (addr,_) _) = addr\"\n\nfun get_size where \"get_size (RawBlk(_,s) _) = s\"\n\nfun block_to_struct where \"block_to_struct (RawBlk blk _) = blk\"\n\ndeclare[[show_types = true]]\ndeclare[[show_sorts = true]]\n  \n(* locale for reasoning about blocks and the mapping of block offsets to memory locations *)\n(* FUNCTIONS *)\n(* block_s_start: partial function giving the first memory location of a \n    block_structure (if it exists) \n   block_exists: see assumptions for block existence conditions \n   block_start_os: gives the offset of a block that can be passed into block_s_ptr\n    such that the same memory location is returned as for block_s_start \n   block_s_ptr: partial function mapping offsets into a block to memory locations \n   size_to_offset: conversion between abstract types *)\n(* ASSUMPTIONS *)\n(* block_firstlast_offset: if a block exists, the start offset must be \\<le> the offset\n    returned by calling size_to_offset on the block size (corresponds to the last memory\n    location of the block.\n   pointer_inbounds_exists: For any offset into a block that is between the start \n    and end offsets (inclusive), there must be a valid mapping to a memory location for\n    that offset.\n   block_s_same_add_same_loc: Two blocks with the same starting address must also have\n    the same starting memory location.\n   block_s_ptr_monotonic: block_s_ptr is a monotonic function\n   block_s_ptr_one_to_one: block_s_ptr is a one to one function\n   block_s_start_offset: Assumes that block_start_os is a total function. There will\n    exist an offset such that block_s_ptr and block_s_start will be equal (even if\n    it is because they both return None) *)\nlocale block_structure =\n  fixes block_s_start::\"('add, 'size::ord) block_structure \\<rightharpoonup> ('loc::ord)\"\n    and block_exists::\"('add, 'size::ord) block_structure \\<Rightarrow> bool\"\n    and block_start_os :: \"('add, 'size::ord) block_structure \\<Rightarrow> ('os::{ord,plus})\"\n    and block_s_ptr::\"('add, 'size) block_structure * 'os \\<rightharpoonup> ('loc::ord)\"\n    and size_to_offset::\"'size \\<Rightarrow> 'os\"\n    and struct_to_rb::\"('add,'size) block_structure \\<Rightarrow> ('add,'val,'size,'os) raw_block\"\n  assumes block_exists_defin: \"block_exists blk = (\\<exists>x. block_s_start(blk) = (Some x))\"\n      and block_firstlast_offset:\n          \"block_exists (addr,size1) \\<Longrightarrow>\n           (block_start_os (addr,size1)) \\<le> (size_to_offset size1)\"\n      and pointer_inbounds_exists:\n          \"\\<lbrakk>block_exists (addr,size1); os \\<ge> block_start_os(addr,size1); \n            os \\<le> size_to_offset(size1)\\<rbrakk> \\<Longrightarrow>\n           \\<exists> l. (block_s_ptr ((addr,size1),os) = (Some l))\"\n      and block_s_same_add_same_loc:\n        \"\\<lbrakk>block_exists (add, size1); block_exists (add, size2)\\<rbrakk> \\<Longrightarrow>\n        block_s_start (add,size1) = block_s_start(add, size2)\"\n      and block_s_ptr_monotonic: \"\\<lbrakk>os1 < os2; block_s_ptr(blk,os1) = Some x;\n                                   block_s_ptr(blk,os2) = Some y\\<rbrakk> \\<Longrightarrow> x < y\"\n      and block_s_ptr_one_to_one: \"\\<lbrakk>block_s_ptr(blk,os1) = Some x;\n                                   block_s_ptr(blk,os2) = Some y;\n                                   (x = y)\\<rbrakk> \\<Longrightarrow> (os1 = os2)\"\n      and block_s_start_offset: \"\\<exists>os_1. block_s_ptr(blk,os_1) = block_s_start(blk)\"\n      and block_s_start_defin: \"(block_s_start blk = block_s_ptr(blk,(block_start_os blk)))\"\ncontext block_structure\nbegin\n\nfun good_block_s_ptr where\n  \"good_block_s_ptr ((start,len), os) = ((block_exists (start,len)) \\<and> \n  ((block_start_os (start,len)) \\<le> os) \\<and> (os \\<le> (size_to_offset len)))\"\n\nfun good_rb_s_pair where\n  \"good_rb_s_pair blk1 blk2 =\n  ((\\<exists> os_1. (\\<exists> os_2. ((good_block_s_ptr(blk1,os_1)) \\<and>\n                      (good_block_s_ptr(blk2,os_2)) \\<and>\n                      ((good_block_s_ptr(blk1,os_1)) = (good_block_s_ptr(blk2,os_2)))))) \\<longrightarrow>\n   (blk1 = blk2))\"\n  \nfun good_allocation where\n  \"good_allocation (alloc::('add,'val,'size) allocation) = \n  (\\<forall> rb1 \\<in> alloc. (\\<forall> rb2 \\<in> alloc. (good_rb_s_pair rb1 rb2)))\"\n  \nfun good_block_allocation where\n  \"good_block_allocation (alloc::('add,'val,'size,'os) block_allocation) =\n  good_allocation (block_to_struct ` alloc)\"\n\nlemma good_rb_s_pair_refl [simp]: \"good_rb_s_pair a a\"\napply auto\ndone\nlemma good_rb_s_pair_symm [simp]: \"good_rb_s_pair a b = good_rb_s_pair b a\"\napply auto\ndone\nlemma good_rb_s_pair_trans [simp]: \"((good_allocation alloc) \\<and> \n  (a \\<in> alloc) \\<and> (b \\<in> alloc) \\<and> (c \\<in> alloc) \\<and> \n  (good_rb_s_pair a b) \\<and> (good_rb_s_pair b c) \\<longrightarrow> good_rb_s_pair a c)\"\napply auto\ndone\nend\n\ntype_synonym ('block,'size, 'os) access_region = \"('block * 'size * 'os)\"\n\ntype_synonym ('add,'val,'size,'os) block_access_region =\n    \"(('add,'val,'size,'os) raw_block,'size,'os) access_region\"\n    \ntype_synonym ('add,'val,'size,'os) block_s_access_region =\n    \"(('add,'size) block_structure,'size,'os) access_region\"\n\nfun region_get_block where\n  \"region_get_block ((b,s,os)::('block,'size, 'os) access_region) = b\"\n   \ncontext block_structure\nbegin\n\n (* Define the set of ptr or os that are \"in\" a region *)\nfun os_in_region where\n  \"os_in_region ((b,s,os1)::('add,'val,'size,'os) block_access_region) (os2::'os) = \n    ((((block_start_os (block_to_struct b))+os1) \\<le> os2) \\<and> \n    (((block_start_os (block_to_struct b))+os1+(size_to_offset s)) \\<ge> os2))\"\n\nfun region_eq where\n  \"region_eq ((b1, s1, os1)::('add,'val,'size,'os) block_access_region)\n  ((b2, s2, os2)::('add,'val,'size,'os) block_access_region) = \n  ((block_s_ptr((block_to_struct b1),os1) = block_s_ptr((block_to_struct b2),os2))\n  \\<and> (block_s_ptr((block_to_struct b1),(os1+(size_to_offset s1))) = \n  block_s_ptr((block_to_struct b2),(os2+(size_to_offset s2)))))\"\n\nlemma region_eq_all_ptr:\n  \"region_eq (b1,s1,os1) (b2, s2, os2) \\<Longrightarrow> (\\<forall> (os_a::'os). \\<exists> (os_b::'os).\n    (((os_in_region (b1,s1,os1) os_a) \\<and> (os_in_region (b2,s2,os2) os_b))\n    \\<and> (block_s_ptr((block_to_struct b1),os_a)) = block_s_ptr((block_to_struct b2),os_b)))\"\n  oops\n   \nfun region_overlap where\n  \"region_overlap ((b1, s1, os1)::('add,'val,'size,'os) block_access_region)\n  ((b2, s2, os2)::(('add,'val,'size,'os) block_access_region)) = (\\<exists> (os_a::'os). \n  (\\<exists> (os_b::'os). ((os_a \\<ge> os1) \\<and> (os_b \\<ge> os2) \\<and> (os_a \\<le> (os1+(size_to_offset s1))) \\<and>\n  (os_b \\<le> (os2+(size_to_offset s2))) \\<and> (block_s_ptr((block_to_struct b1),os_a)) = \n  block_s_ptr((block_to_struct b2),os_b))))\"\n\nfun region_inbounds where\n  \"region_inbounds ((b, s, os)::('add,'val,'size,'os) block_access_region)\n  = (((os + (size_to_offset s)) \\<le> (size_to_offset (get_size b))) \\<and> \n  (block_start_os((block_to_struct b)) \\<le> os))\"\n  \n(* tells us if a region describes an entire block *)\nfun region_block_eq where\n  \"region_block_eq ((b, s, os)::('add,'val,'size,'os) block_access_region)\n  = ((block_start_os((block_to_struct b)) = os) \\<and> ((get_size_s(block_to_struct b)) = s))\"\nend\n\ndeclare[[show_types = true]] \ndeclare[[show_sorts = true]]\n\nlocale memory_model = fixes free_set::\"'memory \\<Rightarrow> 'loc set\" \nand can_read::\"'memory \\<Rightarrow> 'thread \\<Rightarrow> 'loc \\<Rightarrow> 'val set\"\nand update_mem::\"'memory \\<Rightarrow> ('thread, 'loc, 'val) access set \\<Rightarrow> 'memory \\<Rightarrow> bool\"\nand start_mem::'memory\nassumes alloc_not_free: \"\\<lbrakk>update_mem mem ops mem'; Alloc t l \\<in> ops; \\<forall>t. Free t l \\<notin> ops\\<rbrakk> \\<Longrightarrow> \n l \\<notin> free_set mem'\"\n    and stays_not_free: \"\\<lbrakk>update_mem mem ops mem'; l \\<notin> free_set mem; \\<forall>t. Free t l \\<notin> ops\\<rbrakk> \\<Longrightarrow>\n l \\<notin> free_set mem'\"\n\n (*\ndatatype ('thread, 'add, 'size,'os) block_access =\n    bRead 'thread \"('add,'size,'os) block_s_access_region\" 'val\n  | bWrite 'thread \"('add,'size,'os) block_s_access_region\" 'val\n  | bARW 'thread \"('add,'size,'os) block_s_access_region\" 'val 'val\n  | bAlloc 'thread \"('add,'size) block_structure\"\n  | bFree 'thread \"('add,'size) block_structure\"*)\n  \ndatatype ('thread, 'block, 'region,'val) block_access =\n    bRead 'thread 'region 'val\n  | bWrite 'thread 'region 'val\n  | bARW 'thread 'region 'val 'val\n  | bAlloc 'thread 'block\n  | bFree 'thread 'block\n  \nlocale block_structur =\n  fixes good_block ::\"'block \\<Rightarrow> bool\"\n    and good_region :: \"'region \\<Rightarrow> bool\"\n    and block_overlap::\"'block \\<Rightarrow> 'block \\<Rightarrow> bool\"\n    and region_overlap::\"'region \\<Rightarrow> 'region \\<Rightarrow> bool\"\n    and subblock::\"'block \\<Rightarrow> 'block \\<Rightarrow> bool\"\n    and subregion :: \"'region \\<Rightarrow> 'region \\<Rightarrow> bool\"\n    and region_get_block ::\"'region \\<Rightarrow> 'block\"\n    and block_as_region ::\"'block \\<Rightarrow> 'region\"\n    and value_fits_region :: \"'val \\<Rightarrow> 'region \\<Rightarrow> bool\"\n    and region_fits_block ::\"'region \\<Rightarrow> 'block \\<Rightarrow> bool\"\n    (* define does_not_modify later *)\n    and does_not_modify :: \"('thread, 'block, 'region,'val) block_access \n        \\<Rightarrow> 'region \\<Rightarrow>  bool\" \n   (* and get_access_region:: \"('thread, 'block, 'region,'val) block_access \\<Rightarrow> 'region\"*)\n  assumes value_fits_bigger_region :\n    \"\\<lbrakk> subregion r1 r2; value_fits_region v r1 \\<rbrakk> \\<Longrightarrow> value_fits_region v r2\"\n  and subblock_good: \"\\<lbrakk>good_block b ; subblock b' b\\<rbrakk> \\<Longrightarrow> good_block b'\"\n  and region_overlap_symm: \"region_overlap r r' \\<Longrightarrow> region_overlap r' r\"\n(*  and dummy: \"\\<exists> b. block_as_region b = block_as_region b\" *)\n\nfun (in block_structur) get_access_region::\"('thread, 'block, 'region,'val) block_access \\<Rightarrow> 'region\" where\n  \"get_access_region (bRead _ r _) = r\" |\n  \"get_access_region (bWrite _ r _) = r\" |\n  \"get_access_region (bARW _ r _ _) = r\" |\n  \"get_access_region (bAlloc _ b) = (block_as_region b)\" |\n  \"get_access_region (bFree _ b) = (block_as_region b)\"\nthm block_structur.get_access_region.simps\nthm block_structur_def\n\nlocale basic_can_do = block_structur\n  where     good_block = \"good_block :: 'block \\<Rightarrow> bool\"\n    and     good_region = \"good_region :: 'region \\<Rightarrow> bool\"\n  for       good_block \n    and     good_region +\n  fixes     can_do::\"('thread, 'block, 'region,'val) block_access list \\<Rightarrow> \n            ('thread, 'block, 'region,'val) block_access \\<Rightarrow> bool\"\n  assumes   base_allows_alloc: \"good_block b \\<Longrightarrow> (can_do [] (bAlloc t b))\"     \n    and     free_allows_alloc: \"\\<lbrakk>good_block b; can_do m (bFree t b); subblock b' b\\<rbrakk>\n            \\<Longrightarrow> (can_do ((bFree t b)#m) (bAlloc t' b'))\"\n    and     alloc_allows_free: \"\\<lbrakk>good_block b; can_do m (bAlloc t b)\\<rbrakk> \\<Longrightarrow> \n            (can_do ((bAlloc t b)#m) (bFree t b))\"\n   (* and     alloc_allows_write: \"\\<lbrakk>good_block b; can_do m (bAlloc t b); \n            region_fits_block r b\\<rbrakk> \\<Longrightarrow> \n            (can_do ((bAlloc t b)#m) (bWrite t' r v))\"*)\n    and     alloc_allows_write_same_thread: \"\\<lbrakk>good_block b; can_do m (bAlloc t b); \n            region_fits_block r b\\<rbrakk> \\<Longrightarrow> \n            (can_do ((bAlloc t b)#m) (bWrite t r v))\"\n    and     write_any_value_same_thread: \"\\<lbrakk>value_fits_region v' r; \n            (can_do m (bWrite t r v))\\<rbrakk> \\<Longrightarrow> (can_do m (bWrite t r v'))\"\n    and     not_mod_write_drop: \"\\<lbrakk>can_do m opr; does_not_modify opr r; \n            can_do (opr#m) (bWrite t r v)\\<rbrakk> \n            \\<Longrightarrow> can_do m (bWrite t r v)\"\n    and     not_mod_write_add: \"\\<lbrakk>can_do m opr; does_not_modify opr r;\n            can_do m (bWrite t r v)\\<rbrakk> \\<Longrightarrow> can_do (opr#m) (bWrite t r v)\"\n    and     write_not_read_drop: \"\\<lbrakk>can_do m (bWrite t r v); \n            \\<forall>r' v' .(region_overlap r r') \\<longrightarrow> (opr \\<noteq> (bRead t' r' v'));\n            can_do ((bWrite t r v)#m) opr\\<rbrakk> \\<Longrightarrow> can_do m opr\"\n    and     write_not_read_add: \"\\<lbrakk>can_do m (bWrite t r v); \n            \\<forall>r' v' .(region_overlap r r') \\<longrightarrow> (opr \\<noteq> (bRead t' r' v'));\n            can_do m opr\\<rbrakk> \\<Longrightarrow> can_do ((bWrite t r v)#m) opr\"\n    and     read_only_written: \"\\<lbrakk>can_do m (bWrite t r v); \n            can_do ((bWrite t r v)#m) (bRead t' r v')\\<rbrakk> \\<Longrightarrow> v = v'\"\n    and     read_written: \"can_do m (bWrite t r v) \\<Longrightarrow>\n            can_do ((bWrite t r v)#m) (bRead t' r v)\"\n    and     read_noop_drop: \"\\<lbrakk>can_do m (bRead t r v); can_do ((bRead t r v)#m) opr\\<rbrakk>\n            \\<Longrightarrow> can_do m opr\"\n    and     read_noop_add: \"\\<lbrakk>can_do m (bRead t r v); can_do m opr\\<rbrakk>\n            \\<Longrightarrow> can_do ((bRead t r v)#m) opr\"\n    and     reg_drop: \"\\<lbrakk>\\<not>(region_overlap (get_access_region opr) (get_access_region opr'));\n            can_do m opr; can_do (opr#m) opr'\\<rbrakk> \\<Longrightarrow> can_do m opr'\"\n    and     reg_add: \"\\<lbrakk>\\<not>(region_overlap (get_access_region opr) (get_access_region opr'));\n            can_do m opr; can_do m opr'\\<rbrakk> \\<Longrightarrow> can_do (opr#m) opr'\"\n    (*and     reg_comm: \"\\<lbrakk>\\<not>(region_overlap (get_access_region opr) (get_access_region opr'));\n            can_do (opr#m) opr'\\<rbrakk> \\<Longrightarrow> can_do (opr'#m) opr\"*)\n    and     prefix_closed: \"\\<lbrakk>can_do (opr#m) opr'\\<rbrakk> \\<Longrightarrow> can_do m opr\"\n\nlemma (in basic_can_do) reg_comm: \"\\<lbrakk>\\<not>(region_overlap (get_access_region opr) (get_access_region opr'));\n            can_do (opr#m) opr'\\<rbrakk> \\<Longrightarrow> can_do (opr'#m) opr\"\napply (rule reg_add)\napply (erule contrapos_nn)\napply (erule_tac r = \"(get_access_region opr')\" and r' = \"(get_access_region opr)\"\n       in region_overlap_symm)\nprefer 2\napply (erule prefix_closed)\napply (erule reg_drop)\napply (erule prefix_closed)\napply auto\ndone\n\n            \n  (* Commented out to the end\ncontext block_structure\nbegin\nprimrec block_get_thread where\n\"block_get_thread (bRead t _ _) = t\" |\n\"block_get_thread (bWrite t _ _) = t\" |\n\"block_get_thread (bARW t _ _ _) = t\" |\n\"block_get_thread (bAlloc t _) = t\" |\n\"block_get_thread (bFree t _) = t\"\nfun block_get_region where\n\"block_get_region (bRead _ r  _) = r\" |\n\"block_get_region (bWrite _ r _) = r\" |\n\"block_get_region (bARW _ r  _ _) = r\"|\n\"block_get_region (bAlloc _ b) = ((struct_to_rb b),(get_size_s b),(block_start_os(b)))\" |\n\"block_get_region (bFree _ b) = ((struct_to_rb b),(get_size_s b),(block_start_os(b)))\"\nprimrec block_get_block where\n\"block_get_block (bRead _ r _) = (region_get_block r)\" |\n\"block_get_block (bWrite _ r _) = (region_get_block r)\" |\n\"block_get_block (bARW _ r _ _) = (region_get_block r)\" |\n\"block_get_block (bAlloc _ b) = (struct_to_rb b)\" |\n\"block_get_block (bFree _ b) = (struct_to_rb b)\"\nprimrec block_set_thread where\n\"block_set_thread t' (bRead t r v) = bRead t' r v\" |\n\"block_set_thread t' (bWrite t r v) = bWrite t' r v\" |\n\"block_set_thread t' (bARW t r v v') = bARW t' r v v'\" |\n\"block_set_thread t' (bAlloc t l) = bAlloc t' l\" |\n\"block_set_thread t' (bFree t l) = bFree t' l\" \nend\n\n locale block_seq_can_do = fixes can_do::\"('thread,'add,'val,'size,'os) \n  block_access list \\<Rightarrow> ('thread,'add,'val,'size,'os) block_access \\<Rightarrow> bool\"\nassumes base_allows_alloc: \"(can_do [] (bAlloc t b))\"\n    and free_allows_alloc: \"\\<lbrakk>can_do m (bFree t b); b=b'\\<rbrakk>\n          \\<Longrightarrow> (\\<not>(can_do ((bFree t b)#m) (bFree t' b')))\"\n    and alloc_allows_write: \"\\<lbrakk>can_do m (bAlloc t b); \n          region_inbounds ((struct_to_block b),s,os)\\<rbrakk> \\<Longrightarrow> \n          (can_do ((bAlloc t b)#m) \n          (bWrite t' ((struct_to_block b),s,os) v))\"\n    and alloc_allows_alloc: \"\\<lbrakk>can_do m (bAlloc t b); b=b'\\<rbrakk> \\<Longrightarrow> \n          (\\<not>(can_do ((bAlloc t b)#m) (bAlloc t' b')))\"\n    and alloc_allows_free: \"\\<lbrakk>can_do m (bAlloc t b); b=b'\\<rbrakk> \\<Longrightarrow> \n          (can_do ((bAlloc t b)#m) (bFree t' b'))\"\n    and write_any_value: \"(can_do m (bWrite t r v)) = (can_do m (bWrite t' r v'))\"(*\n    and not_mod_write: \"\\<lbrakk>can_do m (bRead t' r' v'); can_do m (bWrite t' r' v'); \n      can_do m (bAlloc t' b); can_do m (bFree t' b); region_block_eq(b,s,os);\n      \\<not>(region_overlap r r'); \\<not>(region_overlap r (b,s,os))\\<rbrakk> \\<Longrightarrow> \n      ((can_do ((bRead t' r' v')#m) (bWrite t r v)) = \n        (can_do (m) (bWrite t r v))) \\<and> \n      ((can_do ((bWrite t' r' v')#m) (bWrite t r v)) = \n        (can_do (m) (bWrite t r v))) \\<and> \n      ((can_do ((bAlloc t' b)#m) (bWrite t r v)) = \n        (can_do (m) (bWrite t r v))) \\<and> \n      ((can_do ((bFree t' b)#m) (bWrite t r v)) = \n        (can_do (m) (bWrite t r v)))\" \n    and write_not_read: \"\\<lbrakk>can_do m (bWrite t r v);  opr \\<noteq> (bRead t' r v')\\<rbrakk> \\<Longrightarrow> \n      (can_do ((bWrite t r v)#m) opr) = (can_do m opr)\"\n    and read_written: \"\\<lbrakk>can_do m (bWrite t r v)\\<rbrakk> \\<Longrightarrow> ((can_do ((bWrite t r v)#m) \n      (bRead t' r v')) = (v = v'))\"\n    and read_noop: \"\\<lbrakk>can_do m (bRead t r v)\\<rbrakk> \\<Longrightarrow> (can_do ((bRead t r v)#m) opr = \n      can_do m opr)\"*)(*\n    and loc_drop: \"\\<lbrakk>\\<not>region_overlap((block_get_region opr) (block_get_region opr'));\n      (can_do m opr)\\<rbrakk> \\<Longrightarrow> (can_do (opr#m) opr') = (can_do m opr')\"  \n    and loc_comm: \"\\<lbrakk>\\<not>region_overlap((block_get_region opr) (block_get_region opr'))\\<rbrakk> \n      \\<Longrightarrow> (can_do (opr#m) opr') = (can_do (opr'#m) opr)\"*)\n      \nlocale block_seq_can_do_extend = block_seq_can_do +\n  assumes base_disallows_free:\"(\\<not>(can_do [] (bFree t b)))\"\n  and     free_dissallows_free:\"\\<lbrakk>can_do m (bFree t b); b=b'\\<rbrakk>\n          \\<Longrightarrow> (\\<not>(can_do ((bFree t b)#m) (bFree t' b')))\"\n \n \nlocale seq_can_do = fixes can_do::\"('thread, 'loc, 'val) access list \\<Rightarrow>\n  ('thread, 'loc, 'val) access \\<Rightarrow> bool\"\nassumes base_allows: \"(\\<not>(can_do [] (Read t l v))) \\<and> (can_do [] (Alloc t l))\n  \\<and>(\\<not>(can_do [] (Free t l)))\"\n    and free_allows: \"\\<lbrakk>can_do m (Free t l)\\<rbrakk> \\<Longrightarrow> (\\<not>(can_do ((Free t l)#m) (Read t' l v)))\n      \\<and> (can_do ((Free t l)#m) (Alloc t' l)) \\<and> (\\<not>(can_do ((Free t l)#m) (Free t' l)))\"\n    and alloc_allows: \"\\<lbrakk>can_do m (Alloc t l)\\<rbrakk> \\<Longrightarrow> (can_do ((Alloc t l)#m) (Write t l v))\n      \\<and> (\\<not>(can_do ((Alloc t l)#m) (Alloc t' l))) \\<and> (can_do ((Alloc t l)#m) (Free t l))\"\n    and write_any_value: \"(can_do m (Write t l v)) = (can_do m (Write t l v'))\"\n    and not_mod_write: \"\\<lbrakk>can_do m (Read t l v); can_do m (Write t l' v); \n      can_do m (Alloc t l'); can_do m (Free t l'); l \\<noteq> l'\\<rbrakk> \\<Longrightarrow> ((can_do ((Read t l v)#m) \n      (Write t' l v)) = (can_do (m) (Write t' l v))) \\<and> ((can_do ((Write t l' v)#m) \n      (Write t' l v)) = (can_do (m) (Write t' l v))) \\<and> ((can_do ((Alloc t l')#m) \n      (Write t' l v)) = (can_do (m) (Write t' l v))) \\<and> ((can_do ((Free t l')#m) \n      (Write t' l v)) = (can_do (m) (Write t' l v)))\" \n    and write_not_read: \"\\<lbrakk>can_do m (Write t l v);  opr \\<noteq> (Read t' l v')\\<rbrakk> \\<Longrightarrow> \n      (can_do ((Write t l v)#m) opr) = (can_do m opr)\"\n    and read_written: \"\\<lbrakk>can_do m (Write t l v)\\<rbrakk> \\<Longrightarrow> ((can_do ((Write t l v)#m) \n      (Read t' l v')) = (v = v'))\"\n    and read_noop: \"\\<lbrakk>can_do m (Read t l v)\\<rbrakk> \\<Longrightarrow> (can_do ((Read t l v)#m) a = can_do m a)\"\n    and loc_drop: \"\\<lbrakk>get_loc (opr) \\<noteq> get_loc(opr'); (can_do m opr)\\<rbrakk> \\<Longrightarrow> (can_do (opr#m) opr')\n      = (can_do m opr')\" \n    and loc_comm: \"\\<lbrakk>get_loc (opr) \\<noteq> get_loc(opr')\\<rbrakk> \\<Longrightarrow> (can_do (opr#m) opr') = \n      (can_do (opr'#m) opr)\"\n      \n    \n(* how can we define a memory as only being a \"good\" allocation? *)\n locale block_memory_model = fixes free_set::\"'memory \\<Rightarrow> 'a word set\"\nand can_read::\"'memory \\<Rightarrow> 'thread \\<Rightarrow> 'loc \\<Rightarrow> 'block set\"\nand update_mem::\"'memory \\<Rightarrow> ('thread, 'loc, 'val) block_access set \\<Rightarrow> 'memory \\<Rightarrow> bool\"\nand allocation::\"'loc allocation\"\nand start_mem::'memory\n(*and memory_max_word:: \"'loc::len word\" *) (*largest address *) (* note: we may want to condense these into one *)\nand memory_max_int:: int\nand memory_min:: int (* smallest address *)           \n(*assumes good_allocations: \"\\<lbrakk>update_mem mem ops mem'; good_allocation *)\n(*assumes good_allocation_word: \"good_allocation memory_max_word allocation\"*)\nassumes good_allocation_int: \"good_allocation (word_of_int memory_max_int) allocation\"\n\n\n\n(* TSO memory model *)\nlocale TSO = fixes undef::'val begin\n(* This isn't really a TSO-specific locale, but I might have other assumptions later.\n   More to the point, it's convenient to have a separate locale for each memory model, even if\n   they don't actually rely on separate assumptions. *)\n\nabbreviation \"free_set mem \\<equiv> UNIV - dom (fst mem)\"\ndefinition \"can_read mem t l \\<equiv> case List.find (\\<lambda>(l', v). l' = l) ((snd mem) t) of \n Some (l, v) \\<Rightarrow> {v} | None \\<Rightarrow> {v. fst mem l = Some v}\"\ndefinition \"can_read2 mem t l \\<equiv> case mem of (mem_map, bufs) \\<Rightarrow> (case List.find (\\<lambda>(l', v). l' = l) (bufs t) of \n Some (l, v) \\<Rightarrow> {v} | None \\<Rightarrow> {v. mem_map l = Some v})\"\n(* Switch to the inductive approach... sometime. *)\ninductive update_mem where \nno_atomic [intro]: \"\\<lbrakk>\\<And>t l v v'. ARW t l v v' \\<notin> ops; \\<And>t. \\<exists>up. bufs' t = up @ bufs t \\<and> \n set up = {(l, v) | l v. Write t l v \\<in> ops} \\<and> distinct up\\<rbrakk> \\<Longrightarrow> \n update_mem (mem, bufs) ops (mem |` (UNIV - {l. \\<exists>t. Free t l \\<in> ops}) ++ \n (\\<lambda>l. if \\<exists>t. Alloc t l \\<in> ops then Some undef else None), bufs')\" |\nupdate [intro]: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); bufs' t = buf @ [(l, v)]\\<rbrakk> \\<Longrightarrow>\n update_mem (mem, bufs) ops (mem'(l \\<mapsto> v), bufs'(t := buf))\" |\natomic [intro!]: \"bufs t = [] \\<Longrightarrow> update_mem (mem, bufs) {ARW t l v v'} (mem(l \\<mapsto> v'), bufs)\"\nabbreviation \"start_mem \\<equiv> (empty, \\<lambda>t. [])\"\n\nlemma alloc_not_free: \"\\<lbrakk>update_mem mem ops mem'; Alloc t l \\<in> ops; \\<forall>t. Free t l \\<notin> ops\\<rbrakk> \\<Longrightarrow> \n l \\<notin> free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nlemma stays_not_free: \"\\<lbrakk>update_mem mem ops mem'; l \\<notin> free_set mem; \\<forall>t. Free t l \\<notin> ops\\<rbrakk> \\<Longrightarrow>\n l \\<notin> free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nend\n\nsublocale TSO \\<subseteq> memory_model free_set can_read update_mem start_mem\nby (unfold_locales, metis alloc_not_free, metis stays_not_free)\n\ncontext TSO begin\n\nlemma update_none [intro!, simp]: \"update_mem C {} C\"\nby (cases C, cut_tac ops=\"{}\" and mem=a and bufs=b in no_atomic, auto simp add: restrict_map_def)\n\nlemma can_read_thread: \"\\<lbrakk>v \\<in> can_read (mem, b) t l; b t = b' t\\<rbrakk> \\<Longrightarrow> \n v \\<in> can_read (mem, b') t l\"\nby (auto simp add: can_read_def split: option.splits)\n\nlemma first_entry: \"\\<lbrakk>update_mem (mem, bufs) {Write t l v} (mem', bufs'); \n bufs' t = a # rest\\<rbrakk> \\<Longrightarrow> a = (l, v)\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). \\<forall>a rest. ops = {Write t l v} \\<and> \n bufs' t = a # rest \\<longrightarrow> a = (l, v)\" in update_mem.induct, simp_all, clarsimp)\napply (subgoal_tac \"\\<exists>up. bufs'a t = up @ bufs t \\<and> set up = {ab. t = t \\<and> (case ab of (la, va) \\<Rightarrow> \n la = l \\<and> va = v)} \\<and> distinct up\", clarify, simp+)\napply (case_tac up, simp, simp)\napply (thin_tac \"bufs'a t = ((aa, b) # resta)\", force)\napply auto\napply (cases a, auto)\ndone\n\nlemma update_map: \"update_mem (mem, bufs) {} (mem', bufs') \\<Longrightarrow>\n \\<exists>map. \\<forall>mem2. update_mem (mem2, bufs) {} (mem2 ++ map, bufs')\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). ops = {} \\<longrightarrow> \n (\\<exists>map. \\<forall>mem2. update_mem (mem2, bufs) {} (mem2 ++ map, bufs'))\" in update_mem.induct, auto)\napply (subgoal_tac \"bufs' = bufs\", rule_tac x=empty in exI, simp, rule ext)\napply (subgoal_tac \"\\<exists>up. bufs' x = (up @ bufs x) \\<and> set up = {(l, v). False} \\<and> distinct up\", clarify, auto)\napply (rule_tac x=\"map(l \\<mapsto> v)\" in exI, auto)\ndone\n\nlemma update_trans_rev: \"\\<lbrakk>update_mem (mem', bufs') {} (mem'', bufs'');\n update_mem (mem, bufs) ops (mem', bufs')\\<rbrakk> \\<Longrightarrow> update_mem (mem, bufs) ops (mem'', bufs'')\"\napply (drule_tac P=\"\\<lambda>(mem', bufs') ops' (mem'', bufs''). ops' = {} \\<and> update_mem (mem, bufs) ops (mem', bufs') \\<longrightarrow>\n update_mem (mem, bufs) ops (mem'', bufs'')\" in update_mem.induct, auto simp add: restrict_map_def)\napply (subgoal_tac \"bufs'a = bufsa\", simp, rule ext)\napply (subgoal_tac \"\\<exists>up. bufs'a x = up @ bufsa x \\<and> set up = {(l, v). False} \\<and> distinct up\", \n clarify, auto)\ndone\n\nlemma update_trans [trans]: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs');\n update_mem (mem', bufs') {} (mem'', bufs'')\\<rbrakk> \\<Longrightarrow> update_mem (mem, bufs) ops (mem'', bufs'')\"\nby (erule update_trans_rev, simp)\n\nlemma update_canonical: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); \n \\<And>t l v v'. ARW t l v v' \\<notin> ops\\<rbrakk> \\<Longrightarrow>\n \\<exists>writes bufs''. (\\<forall>t. bufs'' t = writes t @ bufs t \\<and> set (writes t) = {(l, v) | l v. Write t l v \\<in> ops} \\<and> distinct (writes t)) \\<and> \n update_mem (mem, bufs) ops (mem |` (UNIV - {l. \\<exists>t. Free t l \\<in> ops}) ++ \n (\\<lambda>l. if \\<exists>t. Alloc t l \\<in> ops then Some undef else None), bufs'') \\<and>\n update_mem (mem |` (UNIV - {l. \\<exists>t. Free t l \\<in> ops}) ++ \n (\\<lambda>l. if \\<exists>t. Alloc t l \\<in> ops then Some undef else None), bufs'') {} (mem', bufs')\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). (\\<forall>t l v v'. ARW t l v v' \\<notin> ops) \\<longrightarrow>\n (\\<exists>writes bufs''. (\\<forall>t. bufs'' t = writes t @ bufs t \\<and>\n set (writes t) = {(l, v) | l v. Write t l v \\<in> ops} \\<and> distinct (writes t)) \\<and> update_mem (mem, bufs) ops \n (mem |` (UNIV - {l. \\<exists>t. Free t l \\<in> ops}) ++ (\\<lambda>l. if \\<exists>t. Alloc t l \\<in> ops then Some undef else None), bufs'') \\<and>\n update_mem (mem |` (UNIV - {l. \\<exists>t. Free t l \\<in> ops}) ++ \n (\\<lambda>l. if \\<exists>t. Alloc t l \\<in> ops then Some undef else None), bufs'') {} (mem', bufs'))\" in update_mem.induct, auto)\napply (rule_tac x=\"\\<lambda>t. SOME up. bufs' t = up @ bufs t \\<and> set up = {(l, v). Write t l v \\<in> opsa} \\<and> \n distinct up\" in exI)\napply (rule_tac x=bufs' in exI)\napply (rule conjI, clarsimp)\napply (rule someI_ex, auto)\ndone\n\ncorollary update_write: \"\\<lbrakk>update_mem (mem, bufs) {Write t l v} (mem', bufs')\\<rbrakk> \\<Longrightarrow>\n update_mem (mem, bufs(t := (l, v) # bufs t)) {} (mem', bufs')\"\napply (drule update_canonical, auto)\napply (subgoal_tac \"bufs'' = bufs(t := (l, v) # bufs t)\", simp add: restrict_map_def, rule ext, \n clarsimp)\napply (erule_tac x=x in allE, rule conjI, clarsimp)\napply (case_tac \"writes t\", simp+, case_tac list, simp+)\napply clarsimp\ndone\n\nlemma update_later: \"\\<lbrakk>update_mem (mem, bufs) {} (mem', bufs')\\<rbrakk> \\<Longrightarrow>\n update_mem (mem, bufs) {Write t l v} (mem', bufs'(t := (l, v) # bufs' t))\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). ops = {} \\<longrightarrow> \n update_mem (mem, bufs) {Write t l v} (mem', bufs'(t := (l, v) # bufs' t))\" in update_mem.induct, auto)\napply (cut_tac ops=\"{Write t l v}\" in no_atomic, auto)\napply (drule_tac ops=\"{Write t l v}\" in update, auto)\napply (drule_tac ops=\"{Write t l v}\" and t=ta in update, auto)\nby (metis (hide_lams, no_types) fun_upd_twist)\n\nlemma update_later2: \"\\<lbrakk>update_mem (mem, bufs) {} (mem', bufs'(t := buf)); bufs' t = (l, v) # buf\\<rbrakk> \\<Longrightarrow> \n update_mem (mem, bufs) {Write t l v} (mem', bufs')\"\nby (smt fun_upd_idem_iff fun_upd_upd list.inject update_later)\n\nlemma update_past: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); t \\<notin> get_thread ` ops\\<rbrakk> \\<Longrightarrow> \n update_mem (mem, bufs(t := b @ bufs t)) ops (mem', bufs'(t := b @ bufs' t))\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). t \\<notin> get_thread ` ops \\<longrightarrow> \n update_mem (mem, bufs(t := b @ bufs t)) ops (mem', bufs'(t := b @ bufs' t))\" \n in update_mem.induct, auto)\napply (rule no_atomic, auto)\napply (rule_tac x=\"[]\" in exI, simp)\napply (subgoal_tac \"\\<forall>a b. Write t a b \\<notin> opsa\", subgoal_tac \"\\<exists>up. bufs' t = up @ bufs t \n \\<and> set up = {(l, v). Write t l v \\<in> opsa} \\<and> distinct up\", clarify, simp, metis, auto)\napply (metis get_thread.simps(2) imageI)\napply (drule_tac bufs=\"bufs(t := b @ bufs t)\" in update, auto)\napply (drule_tac bufs=\"bufs(t := b @ bufs t)\" and t=ta in update, auto)\napply (simp add: fun_upd_twist)\ndone\n\nlemma update_past2: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); \n \\<And>l v. Write t l v \\<notin> ops; \\<And>l v v'. ARW t l v v' \\<notin> ops\\<rbrakk> \\<Longrightarrow> \n update_mem (mem, bufs(t := b @ bufs t)) ops (mem', bufs'(t := b @ bufs' t))\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). (\\<forall>l v. Write t l v \\<notin> ops) \\<and> \n (\\<forall>l v v'. ARW t l v v' \\<notin> ops) \\<longrightarrow> update_mem (mem, bufs(t := b @ bufs t)) ops (mem', bufs'(t := b @ bufs' t))\" \n in update_mem.induct, auto)\napply (rule no_atomic, auto)\napply (subgoal_tac \"\\<exists>up. bufs' t = up @ bufs t \\<and> set up = {(l, v). Write t l v \\<in> opsa} \\<and> \n distinct up\", simp)\napply (metis (full_types))\napply (drule_tac bufs=\"bufs(t := b @ bufs t)\" in update, auto)\napply (drule_tac bufs=\"bufs(t := b @ bufs t)\" and t=ta in update, auto simp add: fun_upd_twist)\ndone\n\nlemma process_buffer: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); bufs' t = a @ b\\<rbrakk> \\<Longrightarrow>\n update_mem (mem, bufs) ops (mem' ++ map_of b, bufs'(t := a))\"\napply (induct b arbitrary: mem' bufs' rule: rev_induct, auto simp add: map_upd_triv)\napply (drule_tac t=t in update, auto)\napply force\ndone\n\nend\n\n(* assorted useful list lemmas*)\nlemma map_upt_zip_Suc [simp]: \"l' = map (\\<lambda>(x, n). (x, Suc n)) l \\<Longrightarrow> map (\\<lambda>((l, v), n). (l, v) # map (Pair l) (f n)) l' =\n map (\\<lambda>((l, v), n). (l, v) # map (Pair l) (f (Suc n))) l\"\nby auto\n\ndeclare map_Suc_upt [simp]\n\nlemma zip_Suc [simp]: \"zip l [Suc i..<Suc j] = map (\\<lambda>(x, n). (x, Suc n)) (zip l [i..<j])\"\nby (simp only: zip_map2 [THEN sym], simp)\n\n(* The redundant store produces buffers with redundant elements.\n   add_red is a general characterization of such buffers. *)\ndefinition \"add_red l f = \n concat (map (\\<lambda>((l, v), n). (l, v) # map (\\<lambda>v. (l, v)) (f n)) (zip l [0..<length l]))\"\n\nlemma add_red_nil [simp]: \"add_red [] f = []\"\nby (simp add: add_red_def)\n\nlemma add_red_cons [simp]: \"add_red (x # l) f = x # map (\\<lambda>v. (fst x, v)) (f 0) @ add_red l (\\<lambda>n. f (Suc n))\"\napply (auto simp add: add_red_def)\napply (case_tac \"map (\\<lambda>((l, v), n). (l, v) # map (Pair l) (f n)) (zip (x # l) ([0..<length l] @ [length l]))\", auto)\napply (case_tac \"[0..<length l] @ [length l]\", auto)\napply (case_tac \"[0..<length l] @ [length l]\", auto)\napply (case_tac \"[0..<length l] @ [length l]\", auto)\napply (cut_tac i=0 and j=\"Suc (length l)\" and x=ba and xs=list in upt_eq_Cons_conv, auto)\napply (rule_tac f=concat in arg_cong)\napply (rule map_upt_zip_Suc)\nby (metis upt_Suc_append zip_Suc)\n\nlemma add_red_app [simp]: \"add_red (l @ l') f = add_red l f @ add_red l' (\\<lambda>n. f (n + length l))\"\nby (induct l arbitrary: f, auto)\n\nlemma add_red_id [simp]: \"(\\<And>n. n < length l \\<Longrightarrow> f n = []) \\<Longrightarrow> add_red l f = l\"\nby (induct l arbitrary: f, auto)\n\nlemma find_append: \"(\\<And>x. x \\<in> set l \\<Longrightarrow> \\<not>P x) \\<Longrightarrow> List.find P (l @ l') = List.find P l'\"\nby (induct l, auto)\n\nlemma find_append2 [simp]: \"List.find P l = None \\<Longrightarrow> List.find P (l @ l') = List.find P l'\"\nby (induct l, auto)\n\nlemma find_append3 [simp]: \"List.find P l = Some x \\<Longrightarrow> List.find P (l @ l') = Some x\"\nby (induct l, auto)\n\nlemma add_red_find [simp]: \"List.find (\\<lambda>(l, v). l = x) (add_red buf f) = \n List.find (\\<lambda>(l, v). l = x) buf\"\napply (induct buf arbitrary: f, auto)\napply (rule trans, rule find_append, auto)\ndone\n\ncontext TSO begin\n\nlemma update_red: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); \\<And>t. red t = add_red (bufs t) (f t)\\<rbrakk> \\<Longrightarrow>\n \\<exists>red' f'. update_mem (mem, red) ops (mem', red') \\<and> (\\<forall>t. red' t = add_red (bufs' t) (f' t))\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). (\\<forall>t. red t = add_red (bufs t) (f t)) \\<longrightarrow> \n (\\<exists>red' f'. update_mem (mem, red) ops (mem', red') \\<and> (\\<forall>t. red' t = add_red (bufs' t) (f' t)))\" \n in update_mem.induct, auto)\napply (rule_tac x=\"\\<lambda>t. (SOME up. bufs' t = up @ bufsa t \\<and> set up = {(l, v). Write t l v \\<in> ops} \\<and> \n distinct up) @ red t\" in exI, auto)\napply (rule no_atomic, simp_all)\napply (cut_tac P=\"\\<lambda>up. bufs' t = up @ bufsa t \\<and> set up = {(l, v). Write t l v \\<in> ops} \\<and> \n distinct up\" in someI_ex, simp+)\napply (rule_tac x=\"\\<lambda>t n. if n < length (SOME up. bufs' t = up @ bufsa t \\<and> \n set up = {(l, v). Write t l v \\<in> ops} \\<and> distinct up) then [] else f t (n - length (SOME up. \n bufs' t = up @ bufsa t \\<and> set up = {(l, v). Write t l v \\<in> ops} \\<and> distinct up))\" in exI, clarsimp)\napply (subgoal_tac \"\\<exists>up. bufs' t = up @ bufsa t \\<and> set up = {(l, v). Write t l v \\<in> ops} \\<and> distinct up\", \n clarify, clarsimp)\napply (cut_tac P=\"\\<lambda>upa. up = upa \\<and> set upa = {(l, v). Write t l v \\<in> ops} \\<and> distinct upa\" in someI, \n force, clarsimp)\napply metis\napply (drule_tac bufs=red and t=t and a=\"add_red buf (f' t)\" in process_buffer, simp, clarsimp)\napply (subgoal_tac \"dom (map_of (map (Pair l) (f' t (length buf)))) = {l} \\<or> f' t (length buf) = []\", \n erule disjE, simp+)\napply (rule_tac x=\"red'(t := add_red buf (f' t))\" in exI, clarsimp)\napply (rule_tac x=f' in exI, simp)\napply (rule_tac x=\"red'(t := add_red buf (f' t))\" in exI, clarsimp)\napply (rule_tac x=f' in exI, simp)\napply (auto simp add: dom_map_of_conv_image_fst intro!: set_eqI)\napply (case_tac \"f' t (length buf)\", simp+)\napply (rule_tac x=red in exI, auto)+\ndone\n\nlemma update_red1: \"update_mem (mem, bufs) ops (mem', bufs') \\<Longrightarrow>\n \\<exists>f'. update_mem (mem, bufs(t := add_red (bufs t) f)) ops (mem', bufs'(t := add_red (bufs' t) f'))\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). \\<exists>f'. update_mem (mem, bufs(t := add_red (bufs t) f)) \n ops (mem', bufs'(t := add_red (bufs' t) f'))\" in update_mem.induct, auto)\napply (rule_tac x=\"\\<lambda>n. if n < length (SOME x. bufs' t = x @ bufs t \\<and> set x = {(l, v). Write t l v \\<in> ops} \\<and> distinct x) \n then [] else f (n - length (SOME x. bufs' t = x @ bufs t \\<and> set x = {(l, v). Write t l v \\<in> ops} \\<and> distinct x))\" \n in exI, rule no_atomic, auto)\napply (cut_tac P=\"\\<lambda>up. bufs' t = up @ bufs t \\<and> set up = {(l, v). Write t l v \\<in> ops} \\<and> \n distinct up\" in someI_ex, force, clarsimp)\napply (rule_tac x=\"SOME x. bufs' t = x @ bufs t \\<and> set x = {(l, v). Write t l v \\<in> ops} \\<and> distinct x\"\n in exI, clarsimp)\napply (rule_tac s=\"add_red ((SOME x. bufs' t = x @ bufs t \\<and> set x = {(l, v). Write t l v \\<in> ops} \\<and> distinct x) @ bufs t)\n        (\\<lambda>n. if n < length (SOME x. bufs' t = x @ bufs t \\<and> set x = {(l, v). Write t l v \\<in> ops} \\<and> distinct x) then []\n             else f (n - length (SOME x. bufs' t = x @ bufs t \\<and> set x = {(l, v). Write t l v \\<in> ops} \\<and> distinct x)))\" \n in trans, simp, simp (no_asm))\napply (drule_tac bufs=\"bufs(t := add_red (bufs t) f)\" and t=t and a=\"add_red buf f'\" in process_buffer,\n simp, clarsimp)\napply (subgoal_tac \"dom (map_of (map (Pair l) (f' (length buf)))) = {l} \\<or> f' (length buf) = []\", \n auto simp add: dom_map_of_conv_image_fst intro!: set_eqI)\napply (metis (full_types) append_Nil fst_conv imageI in_set_conv_decomp list.exhaust)\napply (drule_tac bufs=\"bufs(t := add_red (bufs t) f)\" in update, simp, force, \n force simp add: fun_upd_twist)\napply force\ndone\n\nlemma can_read_red: \"b' t = add_red (b t) f \\<Longrightarrow> can_read (mem, b') t = can_read (mem, b) t\"\nby (clarsimp intro!: ext simp add: can_read_def split: option.splits)\n\nlemma can_read_red_loc: \"\\<lbrakk>b' t = (l', v) # add_red (b t) f; l' \\<noteq> l\\<rbrakk> \\<Longrightarrow> \n can_read (mem, b') t l = can_read (mem, b) t l\"\nby (clarsimp intro!: ext simp add: can_read_def split: option.splits)\n\nend\n\n(* Sequential consistency memory model *)\nlocale SC = fixes undef::'val begin\n\nabbreviation \"free_set mem \\<equiv> UNIV - dom mem\"\nabbreviation \"can_read mem t l \\<equiv> {v. mem l = Some v}\"\ninductive update_mem where \nno_atomic [intro]: \"\\<lbrakk>\\<And>t l v v'. ARW t l v v' \\<notin> ops; \\<And>l. (\\<forall>t v. Write t l v \\<notin> ops) \\<Longrightarrow> writes l = None; \n \\<And>t l v. Write t l v \\<in> ops \\<Longrightarrow> \\<exists>t v. Write t l v \\<in> ops \\<and> writes l = Some v; finite ops\\<rbrakk> \\<Longrightarrow> \n update_mem mem ops (mem |` (UNIV - {l. \\<exists>t. Free t l \\<in> ops}) ++ \n (\\<lambda>l. if \\<exists>t. Alloc t l \\<in> ops then Some undef else None) ++ writes)\" |\natomic [intro!]: \"update_mem mem {ARW t l v v'} (mem(l \\<mapsto> v'))\"\nabbreviation \"start_mem \\<equiv> empty\"\n\nlemma update_threads: \"\\<lbrakk>update_mem mem ops mem'; \\<forall>a'\\<in>ops'. \\<exists>a\\<in>ops. \\<exists>t. a' = set_thread (t::'t) \n  (a::('t, 'l, 'val) access)\\<rbrakk> \\<Longrightarrow> update_mem mem ops' mem'\"\napply (drule_tac P=\"\\<lambda>mem ops mem'. \\<forall>ops'. (\\<forall>a'\\<in>ops'. \\<exists>a\\<in>ops. \\<exists>t. a' = set_thread t a) \\<longrightarrow>\n  update_mem mem ops' mem'\" in update_mem.induct, auto)\napply (subgoal_tac \"{l. \\<exists>t. Free t l \\<in> opsa} = {l. \\<exists>t. Free t l \\<in> ops'a} \\<and> (\\<lambda>l. if \\<exists>t. Alloc t l \\<in> \n  opsa then Some undef else None) = (\\<lambda>l. if \\<exists>t. Alloc t l \\<in> ops'a then Some undef else None)\", simp)\napply (rule no_atomic, clarsimp)\napply (thin_tac \"\\<forall>a'\\<in>ops'. \\<exists>a\\<in>ops. \\<exists>t. a' = set_thread t a\")\napply (erule_tac x=\"ARW t l v v'\" in ballE, simp_all, clarsimp)\napply (case_tac a, simp_all)\napply (subgoal_tac \"\\<forall>t v. Write t l v \\<notin> opsa\", simp, clarsimp)\noops\n\nlemma update_threads: \"update_mem mem ops mem' \\<Longrightarrow> update_mem mem (set_thread t ` ops) mem'\"\napply (drule_tac P=\"\\<lambda>mem ops mem'. update_mem mem (set_thread t ` ops) mem'\" in update_mem.induct, auto)\napply (subgoal_tac \"{l. \\<exists>t. Free t l \\<in> ops} = {l. \\<exists>ta. Free ta l \\<in> set_thread t ` ops} \\<and> (\\<lambda>l. if \n  \\<exists>t. Alloc t l \\<in> ops then Some undef else None) = (\\<lambda>l. if \\<exists>ta. Alloc ta l \\<in> set_thread t ` ops \n  then Some undef else None)\", simp)\napply (rule no_atomic, clarsimp)\napply (case_tac x, simp_all)\napply (subgoal_tac \"\\<forall>t v. Write t l v \\<notin> ops\", simp, clarsimp)\napply (erule_tac x=t in allE, erule_tac x=v in allE, force simp add: image_def)\napply (subgoal_tac \"\\<exists>t v. Write t l v \\<in> ops \\<and> writes l = Some v\", clarsimp simp add: image_def)\napply (rule_tac x=t in exI, rule_tac x=\"Write tb l va\" in bexI, simp+)\napply (clarsimp simp add: image_def)\napply (case_tac x, simp_all)\napply (auto simp add: image_def)\napply (rule_tac x=t in exI, rule bexI, simp_all)\napply (case_tac xa, simp_all, metis)\napply (rule ext, auto)\napply (rule_tac x=t in exI, rule bexI, simp_all)\napply (case_tac x, simp_all)\ndone\n\nlemma stays_not_free: \"\\<lbrakk>update_mem mem ops mem'; l \\<notin> free_set mem; \\<forall>t. Free t l \\<notin> ops\\<rbrakk> \\<Longrightarrow>\n l \\<notin> free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nlemma alloc_not_free: \"\\<lbrakk>update_mem mem ops mem'; Alloc t l \\<in> ops; Free t l \\<notin> ops\\<rbrakk> \\<Longrightarrow> \n l \\<notin> free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nend\n\nsublocale SC \\<subseteq> memory_model free_set can_read update_mem start_mem\nby (unfold_locales, metis alloc_not_free, metis stays_not_free)\n\ncontext SC begin\n\nlemma update_none [intro!, simp]: \"update_mem C {} C\"\nby (cut_tac no_atomic, auto simp add: restrict_map_def)\n\nlemma update_none_only [simp, dest!]: \"update_mem mem {} mem' \\<Longrightarrow> mem' = mem\"\nby (erule update_mem.cases, auto simp add: restrict_map_def map_add_def)\n\nlemma update_one_write [intro!, simp]: \"mem' = mem(l \\<mapsto> v) \\<Longrightarrow>\n update_mem mem {Write t l v} mem'\"\nby (cut_tac ops=\"{Write t l v}\" and writes=\"[l \\<mapsto> v]\" in no_atomic, auto simp add: restrict_map_def)\n\nlemma update_one_writeD [dest!, simp]: \"update_mem mem {Write t l v} mem' \\<Longrightarrow> mem' = mem(l \\<mapsto> v)\"\nby (erule update_mem.cases, auto intro!: ext simp add: map_add_def split: option.splits)\n\nlemma update_one_read [intro, simp]: \"update_mem mem {Read t l v} mem\"\nby (cut_tac ops=\"{Read t l v}\" in no_atomic, auto simp add: restrict_map_def)\n\nlemma update_one_readD [dest!, simp]: \"update_mem mem {Read t l v} mem' \\<Longrightarrow> mem' = mem\"\nby (erule update_mem.cases, auto intro!: ext simp add: restrict_map_def map_add_def)\n\nlemma update_one_alloc [intro!, simp]: \"mem' = mem(l \\<mapsto> undef) \\<Longrightarrow>\n update_mem mem {Alloc t l} mem'\"\napply (cut_tac ops=\"{Alloc t l}\" and mem=mem in no_atomic, auto simp add: restrict_map_def)\napply (subgoal_tac \"mem ++ (\\<lambda>la. if la = l then Some undef else None) = mem(l \\<mapsto> undef)\", simp,\n auto intro!: ext simp add: map_add_def)\ndone\n\nlemma update_one_allocD [dest!]: \"update_mem mem {Alloc t l} mem' \\<Longrightarrow> mem' = mem(l \\<mapsto> undef)\"\nby (erule update_mem.cases, auto simp add: restrict_map_def map_add_def)\n\nlemma update_frees [intro!, simp]: \"\\<lbrakk>mem' = mem |` (UNIV - S); finite S\\<rbrakk> \\<Longrightarrow> \n update_mem mem (Free t ` S) mem'\"\napply (cut_tac ops=\"Free t ` S\" and mem=mem in no_atomic, auto)\napply (rule subst, rule_tac f=\"update_mem mem (Free t ` S)\" in arg_cong, simp_all)\napply (auto intro!: ext simp add: map_add_def restrict_map_def, force)\ndone\n\nlemma update_freesD [dest!, simp]: \"update_mem mem (Free t ` S) mem' \\<Longrightarrow>\n mem' = mem |` (UNIV - S)\"\napply (erule update_mem.cases, auto intro!: ext simp add: map_add_def restrict_map_def \n split: option.splits)\napply (metis image_eqI)\napply (metis access.distinct(13) image_iff option.distinct(1))\napply (metis image_eqI)\nby (metis access.distinct(13) image_iff option.distinct(1))\n\nlemma update_ARW [intro!]: \"mem' = mem(l \\<mapsto> v') \\<Longrightarrow> update_mem mem {ARW t l v v'} mem'\"\nby clarsimp\n\nlemma update_ARWD [dest!]: \"update_mem mem {ARW t l v v'} mem' \\<Longrightarrow> mem' = mem(l \\<mapsto> v')\"\nby (erule update_mem.cases, auto)\n\nlemma update_past: \"\\<lbrakk>update_mem mem ops mem'; \\<And>t v. Write t l v \\<notin> ops; \n \\<And>t v v'. ARW t l v v' \\<notin> ops; \\<And>t. Free t l \\<notin> ops; \\<And>t. Alloc t l \\<notin> ops\\<rbrakk> \\<Longrightarrow>\n update_mem (mem(l := v)) ops (mem'(l := v))\"\napply (induct rule: update_mem.induct, auto)\napply (cut_tac ops=ops and mem=\"mem(l := v)\" and writes=writes in no_atomic, auto)\napply (rule_tac f1=\"update_mem (mem(l := v))\" in arg_cong2 [THEN subst], \n auto intro!: ext simp add: map_add_def restrict_map_def split: option.splits)\nby (metis atomic fun_upd_twist)\n\nend\n\nlocale undef = fixes undef::'val\nsublocale undef \\<subseteq> TSO: TSO .\nsublocale undef \\<subseteq> SC: SC .\n\ncontext undef begin\n\n(* SC can be modeled by TSO. *)\n(*\n\nlemma process_all_buffers [rule_format]: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); \n \\<forall>t. bufs' t = ma t @ mb t; finite {t. mb t \\<noteq> []}\\<rbrakk> \\<Longrightarrow>\n \\<exists>m'. update_mem (mem, bufs) ops (mem' ++ m', (\\<lambda>t. ma t)) \\<and>\n (\\<forall>l v. ((m' l = Some v) \\<longrightarrow> (\\<exists>t. map_of (mb t) l = Some v)) \\<and>\n (m' l = None \\<longrightarrow> (\\<forall>t. map_of (mb t) l = None)))\"\napply (drule_tac P=\"\\<lambda>S. \\<forall>mem' bufs' ma mb. (update_mem (mem, bufs) ops (mem', bufs') \\<and>\n (\\<forall>t. bufs' t = ma t @ mb t)) \\<and> S = {t. mb t \\<noteq> []} \\<longrightarrow> \n (\\<exists>m'. update_mem (mem, bufs) ops (mem' ++ m', (\\<lambda>t. ma t)) \\<and>\n (\\<forall>l v. ((m' l = Some v) \\<longrightarrow> (\\<exists>t. map_of (mb t) l = Some v)) \\<and>\n (m' l = None \\<longrightarrow> (\\<forall>t. map_of (mb t) l = None))))\" in finite_induct, auto)\napply (rule_tac x=empty in exI, simp)\napply (subgoal_tac \"bufs'a = maa\", simp)\napply (auto intro!: ext split: option.split)\napply (cut_tac a=x and B=F in insertI1, clarsimp)\napply (thin_tac \"\\<forall>t. bufs' t = ma t @ mb t\")\napply (drule_tac bufs'=bufs'a and t=x and a=\"ma x\" in process_buffer, auto)\napply (erule_tac x=\"mem'a ++ map_of (mb x)\" in allE, erule_tac x=\"bufs'a(x := ma x)\" in allE, \n erule_tac x=ma in allE, erule_tac x=\"mb(x := [])\" in allE, clarsimp, erule impE, force, clarsimp)\napply (rule_tac x=\"map_of (mb x) ++ m'\" in exI, auto split: if_splits, metis, metis)\napply (erule_tac x=mem' in allE, erule_tac x=bufs' in allE, simp)\ndone\n\nlemma SC_lt_update [simp, intro]: \"update_mem_SC mem ops mem' \\<Longrightarrow> \n update_mem (mem, \\<lambda>t. []) ops (mem', \\<lambda>t. [])\"\napply (erule update_mem_SC.cases, auto split: if_splits)\napply (cut_tac ops=ops and mem=mem and bufs=\"\\<lambda>t. []\" and\n bufs'=\"\\<lambda>t. list_of_set {(l, v) | l v. Write t l v \\<in> ops \\<and> writes l = Some v} @ \n list_of_set {(l, v) | l v. Write t l v \\<in> ops \\<and> writes l \\<noteq> Some v}\" in no_atomic, simp_all)\napply (subgoal_tac \"finite {(l, v). Write t l v \\<in> ops}\", auto)\napply (rule finite_vimageI, auto simp add: inj_on_def)\napply (drule_tac ma=\"\\<lambda>t. list_of_set {(l, v) | l v. Write t l v \\<in> ops \\<and> writes l = Some v}\" and \n mb=\"\\<lambda>t. list_of_set {(l, v) | l v. Write t l v \\<in> ops \\<and> writes l \\<noteq> Some v}\" in process_all_buffers)\napply (simp split: if_splits)\napply clarsimp\napply (rule_tac B=\"{t. \\<exists>a \\<in> ops. get_thread a = t}\" in finite_subset, clarsimp)\napply (clarsimp simp add: card_gt_0_iff, rule_tac x=\"Write x a b\" in bexI, simp+)\napply clarsimp\napply (drule_tac ma=\"\\<lambda>t. []\" and \n mb=\"\\<lambda>t. list_of_set {(l, v) | l v. Write t l v \\<in> ops \\<and> writes l = Some v}\" in process_all_buffers)\napply (simp split: if_splits)\napply clarsimp\napply (rule_tac B=\"{t. \\<exists>a \\<in> ops. get_thread a = t}\" in finite_subset, clarsimp)\napply (clarsimp simp add: card_gt_0_iff, rule_tac x=\"Write x a b\" in bexI, simp+)\napply clarsimp\napply (rule_tac x1=\"(mem |` (UNIV - {l. \\<exists>t. Free t l \\<in> ops}) ++ \n (\\<lambda>l. if \\<exists>t. Alloc t l \\<in> ops then Some undef else None) ++ m' ++ m'a, \\<lambda>t. case case if t \\<in> dom threads\n                       then Some (list_of_set {(l, v) |l v. Write t l v \\<in> ops \\<and> writes l = Some v} @\n                                  list_of_set {(l, v) |l v. Write t l v \\<in> ops \\<and> writes l \\<noteq> Some v})\n                       else None of\n                  None \\<Rightarrow> None | Some x \\<Rightarrow> Some (list_of_set {(l, v) |l v. Write t l v \\<in> ops \\<and> writes l = Some v}) of\n             None \\<Rightarrow> None | Some x \\<Rightarrow> Some [])\" in cong [THEN subst], simp, auto)\napply (subgoal_tac \"m' ++ m'a = writes\")\napply (metis map_add_assoc)\napply (rule ext, (erule_tac x=x in allE)+, clarsimp simp add: map_add_def split: option.split)\napply (case_tac \"writes x\", simp_all)\napply (subgoal_tac \"\\<forall>t v. Write t x v \\<notin> ops\", rule ccontr, clarsimp, erule disjE, \n clarsimp split: if_splits)\napply (drule map_of_is_SomeD)\napply (subgoal_tac \"finite {(l, v). Write t l v \\<in> ops}\", simp+)\napply (rule finite_vimageI, simp, simp add: inj_on_def)\napply (clarsimp split: if_splits)\napply (drule map_of_is_SomeD)\napply (subgoal_tac \"finite {(l, v). Write t l v \\<in> ops}\", simp+)\napply (rule finite_vimageI, simp, simp add: inj_on_def)\napply (metis not_Some_eq)\napply (subgoal_tac \"\\<exists>t. Write t x a \\<in> ops\", clarsimp)\napply (rule conjI, clarsimp)\napply (erule_tac x=t in allE)\napply (clarsimp simp add: map_of_eq_None_iff)\napply (subgoal_tac \"finite {(l, v). Write t l v \\<in> ops}\", simp+)\napply (erule notE, rule_tac x=\"(x, a)\" in image_eqI, simp+)\napply (rule finite_vimageI, simp, simp add: inj_on_def)\napply clarsimp\napply (drule map_of_is_SomeD)\napply (subgoal_tac \"finite {(l, v). Write ta l v \\<in> ops}\", simp+)\napply (rule finite_vimageI, simp, simp add: inj_on_def)\nby (metis (hide_lams, full_types) not_Some_eq option.inject)\n\nlemma make_bufs_can_read [simp]: \"can_read (mem, \\<lambda>t. []) t = can_read_SC mem t\"\nby (rule ext, simp add: can_read_def)\n(* Because can_read and update_mem are the only interfaces to the memory provided by memory_model,\n   this implies that SC refines TSO for any language.  Is there a way to make this explicit? *)\n*)\nend\n\nlocale PSO = fixes undef::'val begin\n\n(* PSO memory model *)\nabbreviation \"free_set mem \\<equiv> UNIV - dom (fst mem)\"\ndefinition \"can_read mem t l \\<equiv> case snd mem t l of v # buf \\<Rightarrow> {v}\n | [] \\<Rightarrow> {v. fst mem l = Some v}\"\ninductive update_mem where \nno_atomic [intro]: \"\\<lbrakk>\\<And>t l v v'. ARW t l v v' \\<notin> ops; \\<And>t l. \\<exists>up. bufs' t l = up @ bufs t l \\<and> \n set up = {v. Write t l v \\<in> ops} \\<and> distinct up\\<rbrakk> \\<Longrightarrow> \n update_mem (mem, bufs) ops (mem |` (UNIV - {l. \\<exists>t. Free t l \\<in> ops}) ++ \n (\\<lambda>l. if \\<exists>t. Alloc t l \\<in> ops then Some undef else None), bufs')\" |\nupdate [intro]: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); bufs' t l = buf @ [v]\\<rbrakk> \\<Longrightarrow>\n update_mem (mem, bufs) ops (mem'(l \\<mapsto> v), bufs'(t := (bufs' t)(l := buf)))\" |\natomic [intro!]: \"bufs t l = [] \\<Longrightarrow>\n update_mem (mem, bufs) {ARW t l v v'} (mem(l \\<mapsto> v'), bufs)\"\nabbreviation \"start_mem \\<equiv> (empty, \\<lambda>t l. [])\"\n\nlemma alloc_not_free: \"\\<lbrakk>update_mem mem ops mem'; Alloc t l \\<in> ops; \\<forall>t. Free t l \\<notin> ops\\<rbrakk> \\<Longrightarrow> \n l \\<notin> free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nlemma stays_not_free: \"\\<lbrakk>update_mem mem ops mem'; l \\<notin> free_set mem; \\<forall>t. Free t l \\<notin> ops\\<rbrakk> \\<Longrightarrow>\n l \\<notin> free_set mem'\"\nby (induct rule: update_mem.induct, auto split: if_splits)\n\nend\n\nsublocale PSO \\<subseteq> memory_model free_set can_read update_mem start_mem\nby (unfold_locales, metis alloc_not_free, metis stays_not_free)\n\ncontext PSO begin\n\nlemma update_none [intro!, simp]: \"update_mem C {} C\"\nby (cases C, cut_tac ops=\"{}\" and mem=a and bufs=b in no_atomic, auto simp add: restrict_map_def)\n\nlemma process_buffer: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); bufs' t l = a @ v # b\\<rbrakk> \\<Longrightarrow>\n update_mem (mem, bufs) ops (mem'(l \\<mapsto> v), bufs'(t := (bufs' t)(l := a)))\"\napply (induct b arbitrary: mem' bufs' v rule: rev_induct, auto simp add: map_upd_triv)\napply (drule_tac t=t and l=l in update, simp, force)\ndone\n\nlemma update_later: \"\\<lbrakk>update_mem (mem, bufs) {} (mem', bufs')\\<rbrakk> \\<Longrightarrow>\n update_mem (mem, bufs) {Write t l v} (mem', bufs'(t := (bufs' t)(l := v # bufs' t l)))\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). ops = {} \\<longrightarrow> \n update_mem (mem, bufs) {Write t l v} (mem', bufs'(t := (bufs' t)(l := v # bufs' t l)))\" \n in update_mem.induct, auto)\napply (cut_tac ops=\"{Write t l v}\" in no_atomic, auto)\napply (drule_tac ops=\"{Write t l v}\" in update, auto)\napply (drule_tac ops=\"{Write t l v}\" and t=ta in update, auto simp add: fun_upd_twist)\napply (drule_tac ops=\"{Write t l v}\" and l=la in update, auto simp add: fun_upd_twist)\napply (drule_tac ops=\"{Write t l v}\" and t=ta in update, auto simp add: fun_upd_twist)\ndone\n\nlemma update_later2: \"\\<lbrakk>update_mem (mem, bufs) {} (mem', bufs'(t := (bufs' t)(l := buf))); \n bufs' t l = v # buf\\<rbrakk> \\<Longrightarrow> update_mem (mem, bufs) {Write t l v} (mem', bufs')\"\nby (smt fun_upd_idem_iff fun_upd_upd list.inject update_later)\n\nlemma update_past2: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); \n \\<And>v. Write t l v \\<notin> ops; \\<And>l v v'. ARW t l v v' \\<notin> ops\\<rbrakk> \\<Longrightarrow> \n update_mem (mem, bufs(t := (bufs t)(l := b @ bufs t l))) ops \n                (mem', bufs'(t := (bufs' t)(l := b @ bufs' t l)))\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). (\\<forall>v. Write t l v \\<notin> ops) \\<and> \n (\\<forall>l v v'. ARW t l v v' \\<notin> ops) \\<longrightarrow> update_mem (mem, bufs(t := (bufs t)(l := b @ bufs t l))) ops \n                (mem', bufs'(t := (bufs' t)(l := b @ bufs' t l)))\" in update_mem.induct, auto)\napply (rule no_atomic, auto)\napply (subgoal_tac \"\\<exists>up. bufs' t l = up @ bufs t l \\<and> set up = {v. Write t l v \\<in> opsa} \\<and> \n distinct up\", simp)\napply (metis (full_types))\napply (drule_tac bufs=\"bufs(t := (bufs t)(l := b @ bufs t l))\" in update, auto)\napply (drule_tac bufs=\"bufs(t := (bufs t)(l := b @ bufs t l))\" and t=ta in update, \n auto simp add: fun_upd_twist)\napply (drule_tac bufs=\"bufs(t := (bufs t)(l := b @ bufs t l))\" in update, \n auto simp add: fun_upd_twist)\napply (drule_tac bufs=\"bufs(t := (bufs t)(l := b @ bufs t l))\" and t=ta in update, \n auto simp add: fun_upd_twist)\ndone\n\nlemma update_write: \"\\<lbrakk>update_mem (mem, bufs) {Write t l v} (mem', bufs')\\<rbrakk> \\<Longrightarrow>\n update_mem (mem, bufs(t := (bufs t)(l := v # bufs t l))) {} (mem', bufs')\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). ops = {Write t l v} \\<longrightarrow>\n update_mem (mem, bufs(t := (bufs t)(l := v # bufs t l))) {} (mem', bufs')\" \n in update_mem.induct, auto)\napply (cut_tac ops=\"{}\" and bufs=\"bufs(t := (bufs t)(l := v # bufs t l))\" and\n bufs'=bufs' in no_atomic, simp_all)\napply (subgoal_tac \"\\<exists>up. bufs' ta la = up @ bufs ta la \\<and> set up = {va. va = v \\<and> ta = t \\<and> la = l} \\<and> \n distinct up\", clarify, auto)\napply (case_tac up, auto, case_tac list, auto)\ndone\n\nlemma update_trans_rev: \"\\<lbrakk>update_mem (mem', bufs') {} (mem'', bufs'');\n update_mem (mem, bufs) ops (mem', bufs')\\<rbrakk> \\<Longrightarrow> update_mem (mem, bufs) ops (mem'', bufs'')\"\napply (drule_tac P=\"\\<lambda>(mem', bufs') ops' (mem'', bufs''). ops' = {} \\<and> update_mem (mem, bufs) ops (mem', bufs') \\<longrightarrow>\n update_mem (mem, bufs) ops (mem'', bufs'')\" in update_mem.induct, auto simp add: restrict_map_def)\napply (subgoal_tac \"bufs'a = bufsa\", auto)\ndone\n\nend\n\n(* In PSO, redundant elements are added to the buffers for individual locations. *)\ndefinition \"add_red2 l f = concat (map (\\<lambda>(v, n). v # f n) (zip l [0..<length l]))\"\n\nlemma add_red2_nil [simp]: \"add_red2 [] f = []\"\nby (simp add: add_red2_def)\n\nlemma upt_0 [simp]: \"j > i \\<Longrightarrow> [i..<j] ! 0 = i\"\nby (induct i, auto)\n\nlemma add_red2_nil2 [simp]: \"(add_red2 l f = []) = (l = [])\"\napply (auto simp add: add_red2_def)\napply (case_tac l, auto)\napply (erule_tac x=\"(a, 0)\" in ballE, auto simp add: set_conv_nth)\napply (erule_tac x=0 in allE, auto)\nby (metis gr_implies_not0 le0 upt_0 upt_Suc zero_less_Suc)\n\nlemma map_upt_zip_Suc2 [simp]: \"l' = map (\\<lambda>(x, n). (x, Suc n)) l \\<Longrightarrow> map (\\<lambda>(v, n). v # f n) l' =\n map (\\<lambda>(v, n). v # f (Suc n)) l\"\nby auto\n\nlemma add_red2_cons [simp]: \"add_red2 (x # l) f = x # f 0 @ add_red2 l (\\<lambda>n. f (Suc n))\"\napply (auto simp add: add_red2_def)\napply (case_tac \"map (\\<lambda>(v, n). v # f n) (zip (x # l) ([0..<length l] @ [length l]))\", auto)\napply (case_tac \"[0..<length l] @ [length l]\", auto)\napply (case_tac \"[0..<length l] @ [length l]\", auto)\napply (case_tac \"[0..<length l] @ [length l]\", auto)\napply (cut_tac i=0 and j=\"Suc (length l)\" and x=b and xs=list in upt_eq_Cons_conv, auto)\napply (rule_tac f=concat in arg_cong)\napply (rule map_upt_zip_Suc2)\nby (metis upt_Suc_append zip_Suc)\n\nlemma add_red2_app [simp]: \"add_red2 (l @ l') f = add_red2 l f @ add_red2 l' (\\<lambda>n. f (n + length l))\"\nby (induct l arbitrary: f, auto)\n\nlemma add_red2_id [simp]: \"(\\<And>n. n < length l \\<Longrightarrow> f n = []) \\<Longrightarrow> add_red2 l f = l\"\nby (induct l arbitrary: f, auto)\n\ncontext PSO begin\n\nlemma update_red2: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs');\n \\<And>t l. red t l = add_red2 (bufs t l) (f t l)\\<rbrakk> \\<Longrightarrow>\n \\<exists>red' f'. update_mem (mem, red) ops (mem', red') \\<and> \n (\\<forall>t l. red' t l = add_red2 (bufs' t l) (f' t l))\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). (\\<forall>t l. red t l = add_red2 (bufs t l) (f t l)) \\<longrightarrow> \n (\\<exists>red' f'. update_mem (mem, red) ops (mem', red') \\<and> (\\<forall>t l. red' t l = add_red2 (bufs' t l) (f' t l)))\" \n in update_mem.induct, auto)\napply (rule_tac x=\"\\<lambda>t l. (SOME up. bufs' t l = up @ (bufsa t l) \\<and> set up = {v. Write t l v \\<in> ops} \\<and> \n distinct up) @ red t l\" in exI, auto)\napply (rule no_atomic, simp_all)\napply (cut_tac P=\"\\<lambda>up. bufs' t l = up @ bufsa t l \\<and> set up = {v. Write t l v \\<in> ops} \\<and> \n distinct up\" in someI_ex, simp+)\napply (rule_tac x=\"\\<lambda>t l n. if n < length (SOME up. bufs' t l = up @ bufsa t l \\<and> set up = \n {v. Write t l v \\<in> ops} \\<and> distinct up) then [] else f t l (n - length (SOME up. bufs' t l = \n up @ bufsa t l \\<and> set up = {v. Write t l v \\<in> ops} \\<and> distinct up))\" in exI, clarsimp)\napply (subgoal_tac \"\\<exists>up. bufs' t l = up @ bufsa t l \\<and> set up = {v. Write t l v \\<in> ops} \\<and> distinct up\", \n clarify, clarsimp)\napply (cut_tac P=\"\\<lambda>upa. up = upa \\<and> set upa = {v. Write t l v \\<in> ops} \\<and> distinct upa\" in someI, \n force, clarsimp)\napply metis\napply (drule_tac bufs=red and t=t and l=l and a=\"add_red2 buf (f' t l)\" in process_buffer, force)\napply (rule_tac x=\"red'(t := (red' t)(l := add_red2 buf (f' t l)))\" in exI, clarsimp, metis)\napply (rule_tac x=red in exI, auto)\ndone\n\nlemma update_red2_one_buf: \"\\<lbrakk>update_mem (mem, bufs) ops (mem', bufs'); \n \\<And>t'. t' \\<noteq> t \\<Longrightarrow> red t' = bufs t'; \\<And>l. red t l = add_red2 (bufs t l) (f l)\\<rbrakk> \\<Longrightarrow>\n \\<exists>red' f'. update_mem (mem, red) ops (mem', red') \\<and> (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> red' t' = bufs' t') \\<and>\n (\\<forall>l. red' t l = add_red2 (bufs' t l) (f' l))\"\napply (drule_tac P=\"\\<lambda>(mem, bufs) ops (mem', bufs'). ((\\<forall>t'. t' \\<noteq> t \\<longrightarrow> red t' = bufs t') \\<and>\n (\\<forall>l. red t l = add_red2 (bufs t l) (f l))) \\<longrightarrow> (\\<exists>red' f'. update_mem (mem, red) ops (mem', red') \\<and> \n (\\<forall>t'. t' \\<noteq> t \\<longrightarrow> red' t' = bufs' t') \\<and> (\\<forall>l. red' t l = add_red2 (bufs' t l) (f' l)))\" \n in update_mem.induct, simp_all, clarsimp)\napply (rule_tac x=\"bufs'(t := \\<lambda>l. (SOME up. bufs' t l = up @ (bufsa t l) \\<and> set up = {v. Write t l v \\<in> ops} \\<and> \n distinct up) @ red t l)\" in exI, clarsimp)\napply (rule conjI, rule no_atomic, simp_all)\napply (cut_tac P=\"\\<lambda>up. bufs' t l = up @ bufsa t l \\<and> set up = {v. Write t l v \\<in> ops} \\<and> \n distinct up\" in someI_ex, simp+)\napply (rule_tac x=\"\\<lambda>l n. if n < length (SOME up. bufs' t l = up @ bufsa t l \\<and> set up = \n {v. Write t l v \\<in> ops} \\<and> distinct up) then [] else f l (n - length (SOME up. bufs' t l = \n up @ bufsa t l \\<and> set up = {v. Write t l v \\<in> ops} \\<and> distinct up))\" in exI, clarsimp)\napply (subgoal_tac \"\\<exists>up. bufs' t l = up @ bufsa t l \\<and> set up = {v. Write t l v \\<in> ops} \\<and> distinct up\", \n clarify, clarsimp)\napply (cut_tac P=\"\\<lambda>upa. up = upa \\<and> set upa = {v. Write t l v \\<in> ops} \\<and> distinct upa\" in someI, \n force, clarsimp)\napply metis\napply auto\napply (drule_tac bufs=red and t=t and l=l in process_buffer, force)\napply (rule_tac x=\"red'(t := (red' t)(l := add_red2 buf (f' l)))\" in exI, clarsimp, metis)\napply (drule_tac bufs=red and t=ta and l=l in process_buffer, force)\napply (rule_tac x=\"red'(ta := (red' ta)(l := buf))\" in exI, clarsimp, metis)\napply (rule_tac x=red in exI, auto)\napply (case_tac \"ta = t\", auto)\ndone\n\nlemma can_read_red [simp]: \"b' t l = add_red2 (b t l) f \\<Longrightarrow> \n can_read (mem, b') t l = can_read (mem, b) t l\"\nby (clarsimp intro!: ext simp add: can_read_def split: list.splits)\n\nlemma can_read_loc: \"b' t l = b t l \\<Longrightarrow> \n can_read (mem, b') t l = can_read (mem, b) t l\"\nby (clarsimp intro!: ext simp add: can_read_def split: list.splits)\n\nlemma two_part_buf [simp]: \"bufs t l = buf \\<Longrightarrow> bufs(t := (bufs t)(l := buf)) = bufs\"\nby (clarsimp intro!: ext)\n\nend\n*)\nend\n", "meta": {"author": "liyili2", "repo": "timed-relaxed-memory-model", "sha": "6d85bc75d8b04228b3e581b945e3f672395f0c66", "save_path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model", "path": "github-repos/isabelle/liyili2-timed-relaxed-memory-model/timed-relaxed-memory-model-6d85bc75d8b04228b3e581b945e3f672395f0c66/PLS/memory_model.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819874558604, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3033028314265194}}
{"text": "theory Sep_Logic\n  imports\n\"../compcert/Cminor\"\nSep_Generic_Wp\nBasic_Lens\nState_Ops\nTSA_Map\nbegin\n\nsection \\<open>Misc\\<close>\n\nfun tsa_opt_to_option :: \"'a tsa_opt \\<Rightarrow> 'a option\" where\n  \"tsa_opt_to_option (TRIV v) = Some v\"\n| \"tsa_opt_to_option ZERO = None\"\n\nfun option_to_tsa_opt :: \"'a option \\<Rightarrow> 'a tsa_opt\" where\n  \"option_to_tsa_opt (Some v) = TRIV v\"\n| \"option_to_tsa_opt None = ZERO\"\n\nlemma option_to_tsa_opt_inj: \"option_to_tsa_opt x = option_to_tsa_opt y \\<Longrightarrow> x = y\"\n  by (metis option_to_tsa_opt.elims tsa_opt.distinct(1) tsa_opt.inject)\n\nabbreviation \"I\\<^sub>0 \\<equiv> \\<lambda>_. True\" (* the 'always' invariant *)\n\ninterpretation mem_access_lens: basic_lens \"BLENS mem_access (\\<lambda>ma' m. m\\<lparr>mem_access := ma'\\<rparr>)\"\n  apply standard\n  by auto\n\nlemmas mem_access_laws = mem_access_lens.laws[unfolded mem_access_lens.ground_defs, simplified basic_lens.sel]\n\ninterpretation mem_contents_lens: basic_lens \"BLENS mem_contents (\\<lambda>mc' m. m\\<lparr>mem_contents := mc'\\<rparr>)\"\n  apply standard\n  by auto\n\nlemmas mem_contents_laws = mem_contents_lens.laws[unfolded mem_contents_lens.ground_defs, simplified basic_lens.sel]\n\nsection \\<open>Environment\\<close>\n\ntype_synonym cminor_env = \"(ident, val) tsa_map\"\n\ndefinition env_access :: \"ident \\<Rightarrow> (val option \\<lhd> env)\" where\n  \"env_access i \\<equiv> BLENS (\\<lambda>e. e i) (\\<lambda>v e. e(i := v))\"\n\ninterpretation env_access: tsa_map_\\<alpha> env_access Some id\n  unfolding env_access_def\n  apply standard\n  by auto\n\nlocale env_assns = Lc: basic_lens Lc + L\\<alpha>: sep_algebra_lens L\\<alpha>\n  for \\<alpha>_full :: \"'fc \\<Rightarrow> 'fa::stronger_sep_algebra\"\n  and Lc :: \"(env \\<lhd> 'fc)\"\n  and L\\<alpha> :: \"(cminor_env \\<lhd> 'fa)\" +\nassumes lenses:\n  \"L\\<alpha>.get (\\<alpha>_full s) = env_access.\\<alpha> (Lc.get s)\"\n  \"L\\<alpha>.put (env_access.\\<alpha> a) (\\<alpha>_full s) = \\<alpha>_full (Lc.put a s)\"\nfixes state_I :: \"'fc \\<Rightarrow> bool\"\nassumes I_independent: \"\\<And>a. state_I (Lc.put a s) \\<longleftrightarrow> state_I s\"\nbegin\n\nsublocale compose_lens_assertion Some TRIV env_access.\\<alpha> \"\\<lambda>vo. vo = None\" env_access sep_algebra_func_lens\n  apply (simp add: compose_lens_assertion_def; safe)\n     apply (simp add: env_access.lens_assertion_axioms[simplified])\n    apply (simp add: Lc.basic_lens_axioms)\n   apply (simp add: L\\<alpha>.sep_algebra_lens_axioms)\n  unfolding compose_lens_assertion_axioms_def\n  by (auto simp add: lenses)\n\nlemmas concrete_unfold = concrete.compose_inner_unfold[OF env_access_def[abs_def]]\n\ndefinition \"op_concrete_put i v' \\<equiv> Update (concrete.put i (Some v'))\"\n\ndefinition \"op_set_params \\<equiv> \\<lambda>vs is. Update (Lc.put (set_params vs is))\"\ndefinition \"op_set_locals \\<equiv> \\<lambda>is. Update (Lc.update (set_locals is))\"\ndefinition \"op_set_optvar \\<equiv> \\<lambda>io v. Update (Lc.update (set_optvar io v))\"\n\nlemma wp_set_optvar_none[vcg_decomp_rules]:\n  assumes \"Q r_dummy s\"\n  shows \"wp_stateop (op_set_optvar None v') Q s\"\n  using assms\n  unfolding op_concrete_put_def op_set_optvar_def concrete_unfold\n  by (simp add: set_optvar.simps[abs_def] Lc.update_id)\n\nlemma wp_set_optvar_some[vcg_decomp_rules]:\n  assumes \"wp_stateop (op_concrete_put i v') Q s\"\n  shows \"wp_stateop (op_set_optvar (Some i) v') Q s\"\n  using assms\n  unfolding op_concrete_put_def op_set_optvar_def concrete_unfold\n  by (simp add: set_optvar.simps[abs_def])\n\nlemma ht_set[vcg_rules]:\n  shows \"state_ht \\<alpha>_full state_I\n          (assn_is i v)\n          (op_concrete_put i v')\n          (\\<lambda>_. assn_is i v')\"\n  apply (rule state_htI)\n  unfolding op_concrete_put_def\n  apply (auto split: option.splits simp: assn_is_update[simplified] intro!: wp_stateopI)\n  unfolding concrete.compose_defs Lc.update_def\n  using I_independent by simp\n\nend\n\nsection \\<open>Memory\\<close>\n\ntype_synonym cminor_ptr = \"(block \\<times> Z)\"\n\nlemma ptrI: \"(\\<And>b ofs. p = (b, ofs) \\<Longrightarrow> f (b, ofs)) \\<Longrightarrow> f p\"\n  by (metis surj_pair)\n\ntype_synonym cminor_mem = \"(cminor_ptr, memval) tsa_map\"\n\ntype_synonym cminor_mem_range = \"memval list\"\n\ntype_synonym cminor_perm = \"perm_kind \\<Rightarrow> permission option\"\n\ndefinition perm_none :: cminor_perm where\n  \"perm_none \\<equiv> \\<lambda>_. None\"\ndefinition perm_freeable :: cminor_perm where\n  \"perm_freeable \\<equiv> \\<lambda>_. Some Freeable\"\n\nlemma perms_different[iff]:\n  \"perm_none \\<noteq> perm_freeable\"\n  unfolding perm_none_def perm_freeable_def\n  by (meson option.distinct(1))\n\ndefinition mem_ptr_lens :: \"cminor_ptr \\<Rightarrow> ((memval \\<times> cminor_perm) \\<lhd> mem)\" where\n  \"mem_ptr_lens \\<equiv> \\<lambda>p. BLENS\n    (\\<lambda>m. ((mem_contents m) (fst p) (snd p), (mem_access m) (fst p) (snd p)))\n    (\\<lambda>(mv', perm').\n      mem_contents_update (PMap.update (fst p) (ZMap.set (snd p) mv')) o\n      mem_access_update (PMap.update (fst p) (\\<lambda>block ofs'. if ofs' = snd p then perm' else block ofs')))\"\n\ninterpretation mem_ptr_lens: tsa_map_\\<alpha> mem_ptr_lens\n  \"\\<lambda>mv. (mv, perm_freeable)\" \"\\<lambda>(mv, perm). if perm = perm_freeable then Some mv else None\"\n  unfolding mem_ptr_lens_def\n  apply standard\n  by (auto intro!: mem.equality ext split: if_splits option.splits)\n\nlemma mem_ptr_lens_unfold_adapter:\n  assumes \"mem_ptr_lens \\<equiv> \\<lambda>(b, ofs). BLENS (get_f (b, ofs)) (put_f (b, ofs))\"\n  shows \"mem_ptr_lens \\<equiv> \\<lambda>p. BLENS (get_f p) (put_f p)\"\n  unfolding assms\n  by (simp add: cond_case_prod_eta)\n\nlemmas mem_ptr_lens_unfold =\n  mem_ptr_lens.concrete.unfold[OF mem_ptr_lens_def, where ?p=\"(b, ofs)\", simplified fst_conv snd_conv] for b ofs\n\nlemma mem_ptr_lens_nextblock_indifferent:\n  \"mem_ptr_lens.\\<alpha> (mem_nextblock_update f m) = mem_ptr_lens.\\<alpha> m\"\n  unfolding mem_ptr_lens.\\<alpha>_def\n  apply standard+\n  by (auto split: option.splits if_splits prod.splits simp: mem_ptr_lens_unfold)\n\nlocale mem_assns_defs =\n  mem_lens: basic_lens Lc_mem +\n  mem_\\<alpha>_lens: sep_algebra_lens L\\<alpha>_mem\n  for Lc_mem :: \"(mem \\<lhd> 'fc)\"\n  and L\\<alpha>_mem :: \"(cminor_mem \\<lhd> 'fa::stronger_sep_algebra)\"\n\nlocale mem_assns = mem_assns_defs Lc_mem L\\<alpha>_mem\n  for \\<alpha>_full :: \"'fc \\<Rightarrow> 'fa::stronger_sep_algebra\"\n  and Lc_mem :: \"(mem \\<lhd> 'fc)\"\n  and L\\<alpha>_mem :: \"(cminor_mem \\<lhd> 'fa)\" +\nassumes mem_lenses:\n  \"mem_\\<alpha>_lens.get (\\<alpha>_full s) = mem_ptr_lens.\\<alpha> (mem_lens.get s)\"\n  \"\\<And>m. mem_\\<alpha>_lens.put (mem_ptr_lens.\\<alpha> m) (\\<alpha>_full s) = \\<alpha>_full (mem_lens.put m s)\"\nassumes nextblock_indifferent:\n  \"\\<And>f. \\<alpha>_full (mem_lens.update (mem_nextblock_update f) s) = \\<alpha>_full s\"\nbegin\n\ndefinition \"invariants \\<equiv> \\<lambda>fc. Mem.mem_invariants (mem_lens.get fc)\"\n\nlemma invariants_update:\n  assumes \"invariants s\"\n  assumes \"\\<And>m. Mem.mem_invariants m \\<Longrightarrow> Mem.mem_invariants (f m)\"\n  shows \"invariants (mem_lens.update f s)\"\n  using assms\n  unfolding invariants_def\n  by (simp add: mem_lens.get_update)\n\nabbreviation \"htriple \\<equiv> state_ht \\<alpha>_full invariants\"\nabbreviation \"htriple_weak \\<equiv> state_ht \\<alpha>_full I\\<^sub>0\" (* without invariants, for intermediate steps*)\n\nlemmas htripleI = state_op.htripleI\n\nsublocale compose_lens_assertion \"\\<lambda>mv. (mv, perm_freeable)\" TRIV mem_ptr_lens.\\<alpha>\n  \"\\<lambda>(mv, perm). perm \\<noteq> perm_freeable\" mem_ptr_lens sep_algebra_func_lens Lc_mem L\\<alpha>_mem \\<alpha>_full\n  apply (simp add: compose_lens_assertion_def; safe)\n  using mem_ptr_lens.lens_assertion_axioms\n     apply (simp split: prod.splits if_splits)\n  apply (smt (verit) Pair_inject cond_case_prod_eta)\n    apply (simp add: mem_lens.basic_lens_axioms)\n  apply (simp add: mem_\\<alpha>_lens.sep_algebra_lens_axioms)\n  unfolding compose_lens_assertion_axioms_def\n  by (simp add: mem_lenses)\n\nlemma concrete_get:\n  shows \"concrete.get (b, ofs) s = (mem_contents (mem_lens.get s) b ofs, mem_access (mem_lens.get s) b ofs)\"\n  unfolding concrete.compose_defs\n  unfolding mem_ptr_lens_unfold\n  by auto\n\nlemma concrete_is:\n  shows \"concrete.is (b, ofs) (mv, perm) s = (mem_contents (mem_lens.get s) b ofs = mv \\<and> mem_access (mem_lens.get s) b ofs = perm)\"\n  unfolding concrete.compose_defs\n  unfolding mem_ptr_lens_unfold\n  by auto\n\nschematic_goal concrete_put:\n  shows \"concrete.put (b, ofs) (mv, perm)\n      = (mem_lens.update ?x)\"\n  unfolding concrete.compose_defs\n  unfolding mem_ptr_lens_unfold\n  by simp\n  \nsubsection \\<open>Assertions\\<close>\n\nlemma assn_is_perm: \"(assn_is (b, ofs) v ** F) (\\<alpha>_full s) \\<Longrightarrow> Mem.perm (mem_lens.get s) b ofs kind perm\"\n  apply (simp add: Mem.perm.simps Mem.perm_order'.simps perm_order.simps assn_is_concrete)\n  unfolding perm_freeable_def\n  using concrete.laws concrete_get by auto\n\ndefinition val_range :: \"cminor_ptr \\<Rightarrow> memval list \\<Rightarrow> 'fa \\<Rightarrow> bool\" where\n\"val_range \\<equiv>\n  \\<lambda> (b, ofs) vs.\n  (\\<Union>*i \\<in> {0..<length vs}. assn_is (b, ofs + int i) (vs ! i))\"\n\nlemma val_range_unfold: \"val_range (b, ofs) vs = (\\<Union>*i \\<in> {0..<length vs}. assn_is (b, ofs + int i) (vs ! i))\"\n  unfolding val_range_def\n  by auto\n\nlemma val_range0[simp]: \"val_range p [] = \\<box>\"\n  unfolding val_range_def by (auto split: prod.splits)\n\nlemma split_assn_eq:\n  assumes \"P = P'\"\n  assumes \"Q = Q'\"\n  shows \"(P ** Q) = (P' ** Q')\"\n  using assms\n  by simp\n\nlemma val_range_split:\n  assumes \"sz \\<le> length vs\"\n  shows \"val_range (b, ofs) vs = (val_range (b, ofs) (take sz vs) \\<and>* val_range (b, ofs + sz) (drop sz vs))\"\nproof -\n  let ?r1 = \"{0..<sz}\"\n  let ?r2 = \"{sz..<length vs}\"\n\n  have split_range: \"{0..<length vs} = ?r1 \\<union> ?r2\" \"?r1 \\<inter> ?r2 = {}\" using assms by auto\n\n  note split_union = sep_set_img_union[OF split_range(2)]\n\n  have split_map_lhs:\n      \"\\<And>x i. x + int sz + int i = x + int (i + sz)\"\n      \"\\<And>i. drop sz vs ! i = vs ! (i + sz)\"\n    using assms\n    by (auto simp add: add.commute)\n\n  have \"inj_on (\\<lambda>i. i + sz) {0..<length (drop sz vs)}\" by simp\n  note split_map = sep_set_img_map[OF this, of \"\\<lambda>i. assn_is (b, ofs + i) (vs ! i)\", symmetric]\n\n  show ?thesis unfolding val_range_unfold\n    unfolding split_range\n    unfolding split_union\n    apply (rule split_assn_eq)\n     apply (rule sep_set_img_cong)\n    using assms apply simp\n     apply simp\n    unfolding split_map_lhs\n    unfolding split_map\n    by (simp add: assms)\nqed\n\nlemma val_range_split_deltalen:\n  assumes \"delta+len \\<le> length vs\"\n  shows \"val_range (b, ofs) vs\n      = (val_range (b, ofs) (take delta vs)\n      ** val_range (b, ofs+delta) (take len (drop delta vs))\n      ** val_range (b, ofs+delta+len) (drop (delta+len) vs))\"\nproof -\n  from assms have \"delta \\<le> length vs\"\n    by auto\n\n  note split1 = val_range_split[OF this]\n\n  from assms have \"len \\<le> length (drop delta vs)\"\n    by auto\n\n  note split2 = val_range_split[OF this]\n\n  show ?thesis\n    apply (subst split1)\n    apply (subst split2)\n    by (simp add: add.commute)\nqed\n\nlemma val_range_step:\n  shows \"val_range (b, ofs) (v # vs) = (assn_is (b, ofs) v ** val_range (b, ofs + 1) vs)\"\n  using val_range_split[of 1 \"v # vs\"] unfolding val_range_unfold\n  by auto\n\nlemma val_range_step_end:\n  shows \"val_range (b, ofs) (vs @ [v]) = (assn_is (b, ofs+length vs) v ** val_range (b, ofs) vs)\"\n  apply (simp add: val_range_split[of \"length vs\" \"vs @ [v]\"])\n  apply (subst sep_conj_commute)\n  apply (rule sep_conj_trivial_strip2)\n  unfolding val_range_unfold\n  by auto\n\nlemma val_range_split_concat:\n  shows \"val_range (b, ofs) (vs1@vs2)\n      = (val_range (b, ofs) vs1 ** val_range (b,ofs + length vs1) vs2)\"\n  apply (induction vs1 arbitrary: ofs)\n   apply simp\n  apply (simp add: val_range_step)\n  by (smt (z3))\n\nlemmas val_range_merge = val_range_split_concat[symmetric]\n\nlemma val_range_range_perm:\n  notes [simp] = Mem.range_perm_def\n  shows \"(val_range (b, ofs) vs \\<and>* F) (\\<alpha>_full s) \\<Longrightarrow> Mem.range_perm (mem_lens.get s) b ofs (ofs + length vs) Cur perm\"\nproof (induction vs arbitrary: ofs F)\n  case Nil\n  then show ?case\n    by simp\nnext\n  case (Cons a vs)\n\n  from Cons(2)\n  have ofs_perm: \"Mem.perm (mem_lens.get s) b ofs Cur perm\"\n    by (simp add: val_range_step assn_is_perm)\n\n  obtain F' where F': \"(val_range (b, ofs+1) vs \\<and>* F') (\\<alpha>_full s)\"\n    using Cons(2)\n    apply (simp add: val_range_step)\n    apply (subst(asm)(2) sep_conj_commute)\n    apply (subst(asm) sep_conj_assoc)\n    by auto\n\n  note IH = Cons(1)[OF this]\n\n  then show ?case\n    using ofs_perm apply auto\n    by (smt (verit) atLeastLessThan_iff)\nqed\n\ndefinition mem_chunk :: \"memory_chunk \\<Rightarrow> cminor_ptr \\<Rightarrow> cminor_mem_range \\<Rightarrow> 'fa \\<Rightarrow> bool\" where\n  \"mem_chunk \\<equiv> \\<lambda> chunk p vs.\n  \\<up>(length vs = size_chunk_nat chunk \\<and> align_chunk chunk dvd (snd p)) ** val_range p vs\"\n\nlemma range_to_chunk:\n  assumes \"length vs = size_chunk_nat chunk\"\n  assumes \"align_chunk chunk dvd (snd p)\"\n  shows \"val_range p vs = mem_chunk chunk p vs\"\n  unfolding mem_chunk_def\n  using assms\n  by (simp add: sep_algebra_simps)\n\nabbreviation \"mem_val chunk p v \\<equiv> mem_chunk chunk p (encode_val chunk v)\"\n\ninductive chunk_fit :: \"memory_chunk \\<Rightarrow> val \\<Rightarrow> bool\" where\n  \"chunk_fit Mint32 (Vint n)\"\n| \"chunk_fit Many32 (Vint n)\"\n| \"chunk_fit Mfloat32 (Vsingle f)\"\n| \"chunk_fit Many32 (Vsingle f)\"\n| \"chunk_fit Mint64 (Vlong n)\"\n| \"chunk_fit Many64 (Vlong n)\"\n| \"chunk_fit Mfloat64 (Vfloat f)\"\n| \"chunk_fit Many64 (Vfloat f)\"\n| \"chunk_fit Mint64 (Vptr b ofs)\"\n| \"chunk_fit Many64 (Vptr b ofs)\"\n\n\n\nlemma chunk_fit_load_result[simp]:\n  assumes \"chunk_fit chunk v\"\n  shows \"Val.load_result chunk v = v\"\n  using assms\n  apply (rule chunk_fit.cases)\n  by (auto simp: encode_val.simps decode_val.simps)\n\nlemma chunk_fit_length:\n  assumes \"chunk_fit chunk v\" \"chunk_fit chunk v'\"\n  shows \"length (encode_val chunk v) = length (encode_val chunk v')\"\n  apply (cases rule: chunk_fit.cases[OF assms(1)]; cases rule: chunk_fit.cases[OF assms(2)])\n  by (auto simp: encode_val.simps)\n\nabbreviation \"mem_val_fit chunk p v \\<equiv> \\<up>(chunk_fit chunk v) ** mem_val chunk p v\"\n\nsubsection \\<open>Cminor Ops\\<close>\n\ndefinition \"op_concrete_get p \\<equiv> Read (concrete.get p)\"\ndefinition \"op_concrete_put v p \\<equiv> Update (concrete.put p v)\"\n\ndefinition \"op_valid_access \\<equiv> \\<lambda>chunk (b, ofs) perm. Read (\\<lambda>fc. Mem.valid_access (mem_lens.get fc) chunk b ofs perm)\"\n\ndefinition \"op_getN \\<equiv> \\<lambda>sz (b, ofs). Read (\\<lambda>fc. Mem.getN sz ofs (mem_contents (mem_lens.get fc) b))\"\ndefinition \"op_setN \\<equiv> \\<lambda>vs (b, ofs). Update (mem_lens.update (mem_contents_update (PMap.update b (Mem.setN vs ofs))))\"\n\ndefinition \"op_load \\<equiv> \\<lambda>chunk (b, ofs). ReadMaybe (\\<lambda>fc. Mem.load chunk (mem_lens.get fc) b ofs)\"\ndefinition \"op_store \\<equiv> \\<lambda>chunk (b, ofs) v. UpdateMaybe (mem_lens.update_maybe (\\<lambda>m. Mem.store chunk m b ofs v))\"\n\ndefinition \"op_loadv chunk vptr \\<equiv> ReadMaybe (\\<lambda>fc. Mem.loadv chunk (mem_lens.get fc) vptr)\"\ndefinition \"op_storev chunk vptr v \\<equiv> UpdateMaybe (mem_lens.update_maybe (\\<lambda>m. Mem.storev chunk m vptr v))\"\n\ndefinition \"op_alloc lo hi \\<equiv> ReadUpdate (\\<lambda>fc. case Mem.alloc (mem_lens.get fc) lo hi of (m', b) \\<Rightarrow> (mem_lens.put m' fc, b))\"\ndefinition \"op_free b lo hi \\<equiv> UpdateMaybe (mem_lens.update_maybe (\\<lambda>m. Mem.free m b lo hi))\"\n\ndefinition \"op_outcome_free_mem out sp sz \\<equiv> UpdateMaybe (mem_lens.update_maybe (\\<lambda>m. outcome_free_mem_func out m sp sz))\"\n\n(* wrappers *)\n\ndefinition \"op_decode_chunk chunk p \\<equiv> op_getN (size_chunk_nat chunk) p\"\ndefinition \"op_encode_chunk chunk v' p \\<equiv> op_setN (encode_val chunk v') p\"\n\nlemma [iff]: \"readonly_op (op_concrete_get p)\" unfolding op_concrete_get_def ..\nlemma [iff]: \"readonly_op (op_valid_access chunk p perm)\" unfolding op_valid_access_def by (auto split: prod.splits)\nlemma [iff]: \"readonly_op (op_getN sz p)\" unfolding op_getN_def by (auto split: prod.splits)\nlemma [iff]: \"readonly_op (op_loadv chunk vptr)\" unfolding op_loadv_def ..\nlemma [iff]: \"readonly_op (op_decode_chunk chunk p)\" unfolding op_decode_chunk_def ..\n\nsubsection \\<open>WP decomp rules\\<close>\n\nlemma setN_unpack:\n  \"Mem.setN (v # vs) ofs = (Mem.setN vs (ofs+1)) o (ZMap.set ofs v)\"\n  apply standard+\n  by (simp add: Mem.setN.simps)\n\nlemma wp_getN_induct:\n  assumes \"wp_stateop (op_concrete_get (b, ofs)) (\\<lambda>(v, po). wp_stateop (op_getN sz (b, ofs+1)) (\\<lambda>vs. Q (v # vs))) s\"\n  shows \"wp_stateop (op_getN (Suc sz) (b, ofs)) Q s\"\n  using assms unfolding op_concrete_get_def op_getN_def\n  using concrete_get by (auto simp: Mem.getN.simps)\n\nlemma mem_lens_update_equ: \"\\<And>f f'. (f (mem_lens.get s) = f' (mem_lens.get s)) \\<Longrightarrow> mem_lens.update f s = mem_lens.update f' s\"\n  by (metis mem_lens.update_def)\n\nlemma wp_setN_induct:\n  notes setN_unpack[simp]\n  assumes \"concrete.get (b, ofs) s = (v', po)\"\n  assumes \"wp_stateop (op_concrete_put (v, po) (b, ofs)) (\\<lambda>_. wp_stateop (op_setN vs (b, ofs+1)) Q) s\"\n  shows \"wp_stateop (op_setN (v # vs) (b, ofs)) Q s\"\n  using assms unfolding op_concrete_put_def op_setN_def\n  apply (simp add: concrete.compose_defs mem_lens.laws)\n  unfolding mem_ptr_lens_unfold\n  apply clarify\nproof (goal_cases)\n  case 1\n\n  have Q_equ: \"\\<And>x x'. x = x' \\<Longrightarrow> Q r_dummy x = Q r_dummy x'\"\n    by simp\n\n  have access_update:\n    \"(mem_access_update (\\<lambda>m. m(b := \\<lambda>ofs'. if ofs' = ofs then mem_access (mem_lens.get s) b ofs else m b ofs')))\n     (mem_lens.get s) = (mem_lens.get s)\"\n    apply (rule mem.equality)\n       apply auto\n    apply standard+\n    by auto\n\n  show ?case\n    apply (rule iffD1[OF _ 1(1)])\n    apply (rule Q_equ)\n    apply (rule mem_lens_update_equ)\n    by (simp add: access_update)\nqed\n\nlemma wp_load[vcg_decomp_rules]:\n  assumes \"wp_stateop (op_valid_access chunk p Readable)\n    (\\<lambda>r fc. r \\<and> wp_stateop (op_decode_chunk chunk p)\n      (\\<lambda>vs. Q (decode_val chunk vs)) fc) s\"\n  shows \"wp_stateop (op_load chunk p) Q s\"\n  apply (cases p)\n  using assms\n  unfolding op_valid_access_def op_getN_def op_load_def op_decode_chunk_def\n  by (auto split: option.splits simp: Mem.loadv.simps Mem.load.simps)\n\nlemma wp_loadv[vcg_decomp_rules]:\n  assumes \"wp_stateop (op_load chunk (b, uint ofs)) Q s\"\n  shows \"wp_stateop (op_loadv chunk (Vptr b ofs)) Q s\"\n  using assms\n  unfolding op_load_def op_loadv_def\n  by (auto simp: Mem.loadv.simps)\n\nlemma wp_store:\n  assumes \"wp_stateop (op_valid_access chunk p Writable)\n    (\\<lambda>r fc. r \\<and> wp_stateop (op_encode_chunk chunk v' p) Q fc) s\"\n  shows \"wp_stateop (op_store chunk p v') Q s\"\n  apply (cases p)\n  using assms\n  unfolding op_valid_access_def op_setN_def op_store_def op_encode_chunk_def\n  apply (auto simp: Mem.storev.simps Mem.store.simps mem_lens.update_maybe_def split: option.splits)\n  by (simp add: mem_lens.update_def)\n\nlemma wp_storev[vcg_decomp_rules]:\n  assumes \"wp_stateop (op_store chunk (b, uint ofs) v') Q s\"\n  shows \"wp_stateop (op_storev chunk (Vptr b ofs) v') Q s\"\n  using assms\n  unfolding op_store_def op_storev_def\n  by (auto simp: Mem.storev.simps)\n\n(* lemma wp_outcome_free_mem:\n  assumes \"(\\<exists>x. out = Out_tailcall_return x) \\<Longrightarrow> Q r_dummy s\"\n  assumes \"\\<not>(\\<exists>x. out \\<noteq> Out_tailcall_return x) \\<Longrightarrow> wp_stateop (op_free sp 0 sz) Q s\"\n  shows \"wp_stateop (op_outcome_free_mem out sp sz) Q s\"\n  unfolding op_free_def op_outcome_free_mem_def mem_lens.update_maybe_def\n  apply (cases \"\\<exists>x. out = Out_tailcall_return x\")\n  apply (rule wp_stateopI)\n   apply (auto split: option.splits simp: mem_lens.laws)\n   apply (cases out)\n  apply auto *)\n\nsubsection \\<open>HT rules (without invariant-guarantee)\\<close>\n\nlemma ht_concrete_get[vcg_rules]:\n  shows \"htriple_weak\n          (assn_is p v)\n          (op_concrete_get p)\n          (\\<lambda>r. \\<up>(r = (v, perm_freeable)) ** assn_is p v)\"\n  apply (cases p)\n  apply (rule state_htI)\n  apply (simp add: op_concrete_get_def)\n  subgoal for b ofs F s\n    apply (rule sep_conjI[of _ 0 _ \"(\\<alpha>_full s)\"])\n    unfolding pred_lift_def\n    by (auto simp add: assn_is_concrete concrete.laws)\n  done\n\nlemma ht_concrete_set[vcg_rules]:\n  shows \"htriple_weak\n          (assn_is p v)\n          (op_concrete_put (v', perm_freeable) p)\n          (\\<lambda>_. assn_is p v')\"\n  apply (rule state_htI)\n  unfolding op_concrete_put_def\n  by (auto split: option.splits simp: assn_is_update[simplified])\n\nlemma ht_getN[vcg_rules]:\n  assumes \"len = length vs\"\n  shows \"htriple_weak\n          (val_range p vs)\n          (op_getN len p)\n          (\\<lambda>r. \\<up>(r = vs) ** val_range p vs)\"\n  apply (cases p)\n  subgoal for b ofs\n  using assms\nproof (induction vs arbitrary: p ofs len)\n  case Nil\n  then show ?case\n    unfolding val_range_def op_getN_def\n    apply simp\n    apply (rule state_htI)\n    by (auto simp: Mem.getN.simps pure_true_conv)\nnext\n  case (Cons v vs)\n\n  then obtain p' len' where p': \"p' = (b, ofs+1)\" \"len' = length vs\" by simp\n\n  note IH[vcg_rules] = Cons(1)[OF this, unfolded p'(1)]\n\n  have [simp]: \"len = Suc len'\"\n    by (simp add: Cons.prems \\<open>len' = length vs\\<close>)\n\n  note wp_getN_induct[vcg_decomp_rules]\n\n  show ?case\n    apply (simp add: Cons val_range_step)\n    by vcg\nqed\n  done\n\nlemma ht_setN[vcg_rules]:\n  assumes \"length vs = length vs'\"\n  shows \"htriple_weak\n          (val_range p vs)\n          (op_setN vs' p)\n          (\\<lambda>_. val_range p vs')\"\n  apply (cases p)\n  subgoal for b ofs\n  using assms\nproof (induction vs vs' arbitrary: p ofs rule: list_induct2)\n  case Nil\n\n  have [simp]: \"\\<And>p. Mem.setN [] p = id\"\n    apply standard+\n    by (simp add: Mem.setN.simps)\n\n  have [simp]: \"\\<And>b. PMap.update b id = id\"\n    by auto\n\n  show ?case\n    apply (rule state_htI)\n    by (simp add: op_setN_def val_range_def mem_lens.laws mem_update_id)\nnext\n  case (Cons v vs v' vs')\n\n  note p = \\<open>p = (b, ofs)\\<close>\n  obtain p' where p': \"p' = (b, ofs+1)\" by simp\n\n  note Cons(2)[OF this, unfolded p', vcg_rules]\n\n  note wp_setN_induct[of b ofs _ v perm_freeable, vcg_decomp_rules]\n\n  have vcg_help: \"\\<And>F s. STATE \\<alpha>_full I\\<^sub>0 (assn_is (b, ofs) v \\<and>* val_range (b, ofs + 1) vs \\<and>* F) s \\<Longrightarrow>\n           concrete.get (b, ofs) s = (v, perm_freeable)\"\n    unfolding STATE_def\n    apply simp\n    using assn_is_concrete\n    by (simp add: concrete.laws(5))\n\n  show ?case\n    apply (simp add: p val_range_step)\n    using vcg_help\n    by vcg\nqed\n  done\n\nlemma ht_valid_access[vcg_rules]:\n  shows \"htriple_weak\n        (mem_chunk chunk p vs)\n        (op_valid_access chunk p perm)\n        (\\<lambda>r. \\<up>r ** mem_chunk chunk p vs)\"\n  apply (cases p)\n  apply (rule state_htI)\n  unfolding op_valid_access_def mem_chunk_def\n  apply (auto simp add: Mem.valid_access.simps pred_lift_extract_simps)\n  using val_range_range_perm\n  by (metis)\n\nlemma ht_decode_chunk[vcg_rules]:\n  shows \"htriple_weak\n          (mem_val chunk p v)\n          (op_decode_chunk chunk p)\n          (\\<lambda>r. \\<up>(decode_val chunk r = Val.load_result chunk v) ** (mem_val chunk p v))\"\n  unfolding op_decode_chunk_def\n  apply vcg\n  unfolding mem_chunk_def\n  by vcg\n\nlemma ht_encode_chunk[vcg_rules]:\n  shows \"htriple_weak\n    (mem_chunk chunk p vs)\n    (op_encode_chunk chunk v' p)\n    (\\<lambda>_. (mem_val chunk p v'))\"\n  unfolding op_encode_chunk_def\n  apply vcg\n  unfolding mem_chunk_def\n  by vcg\n\nlemma ht_store[vcg_rules]: (* needs to be explicit rule to proof invariants *)\n  notes [vcg_decomp_rules] = wp_store\n  shows \"htriple_weak\n    (mem_chunk chunk p vs)\n    (op_store chunk p v')\n    (\\<lambda>_. mem_val chunk p v')\"\n  by vcg\n\nlemma ht_free[vcg_rules]:\n  assumes [iff]: \"lo \\<le> hi\"\n  defines \"len \\<equiv> nat (hi - lo)\"\n  assumes len_vs: \"length vs = len\"\n  shows \"htriple_weak\n    (val_range (b, lo) vs)\n    (op_free b lo hi)\n    (\\<lambda>_. \\<box>)\"\n  unfolding op_free_def mem_lens.update_maybe_def\n  apply (rule state_htI)\n  supply [simp] = val_range_range_perm[where ?ofs=lo and ?vs=vs, unfolded len_vs, unfolded len_def, simplified]\n  apply (simp add: Mem.free.simps split: option.splits)\n  subgoal for F s\n  using assms\nproof (induction vs arbitrary: lo len s)\n  case Nil\n\n  have [simp]: \"\\<And>ofs x. (if lo \\<le> ofs \\<and> ofs < lo then None else x) = x\"\n    by auto\n\n  with Nil show ?case\n    by (simp add: Mem.unchecked_free.simps mem_update_id mem_lens.laws)\nnext\n  case (Cons v vs)\n\n  then have v_s: \"(assn_is (b, lo) v ** val_range (b, lo + 1) vs \\<and>* F) (\\<alpha>_full s)\"\n    using val_range_step\n    by (simp)\n\n  note range_s' = assn_is_destroy[where ?v'=\"(v, perm_none)\", simplified, OF this]\n  let ?step = \"concrete.put (b, lo) (v, perm_none)\"\n  let ?s' = \"?step s\"\n\n  have \"lo + 1 \\<le> hi\" \"length vs = nat (hi - (lo + 1))\" using \\<open>length (v # vs) = nat (hi - lo)\\<close>\n    by auto\n\n  note IH = Cons(1)[OF range_s' this]\n\n  have prev_v: \"(mem_contents (mem_lens.get s))(b := (mem_contents (mem_lens.get s) b)(lo := v))\n              = mem_contents (mem_lens.get s)\"\n    using v_s\n    unfolding assn_is_concrete concrete_is\n    by (auto intro!: ext)\n                \n  have \"((mem_lens.update (\\<lambda>m. Mem.unchecked_free m b (lo + 1) hi)) o (?step)) s\n      = mem_lens.update (\\<lambda>m. Mem.unchecked_free m b lo hi) s\"\n    apply (subst concrete_put)\n    apply (subst mem_lens.update_comp')\n    unfolding mem_lens.update_def\n    apply (subst mem_lens.put_equality)\n    apply (simp add: Mem.unchecked_free.simps concrete_put)\n    apply (rule mem.equality)\n    using \\<open>lo + 1 \\<le> hi\\<close>\n    by (auto simp: prev_v perm_none_def intro!: ext)\n\n  then show ?case\n    unfolding mem_lens.update_def\n    using IH by auto\nqed\n  done\n\nsubsection \\<open>HT rules (with invariants)\\<close>\n\nlemma from_weak_unchanged:\n  assumes ht: \"htriple_weak P c Q\"\n  assumes ro: \"readonly_op c\"\n  shows \"htriple P c Q\"\n  using ro\n  apply (rule readonly_op.cases)\n  using ht\n  unfolding state_op.htriple_def\n    apply (auto split: option.splits)\n  by force\n\nlemmas ht_concrete_get_inv[vcg_rules] = from_weak_unchanged[OF ht_concrete_get, simplified]\nlemmas ht_getN_inv[vcg_rules] = from_weak_unchanged[OF ht_getN, simplified]\nlemmas ht_decode_chunk_inv[vcg_rules] = from_weak_unchanged[OF ht_decode_chunk, simplified]\nlemmas ht_valid_access_inv[vcg_rules] = from_weak_unchanged[OF ht_valid_access, simplified]\n  \nlemma ht_store_inv[vcg_rules]:\n  notes [vcg_decomp_rules] = wp_store\n  shows \"htriple\n    (mem_chunk chunk p vs)\n    (op_store chunk p v')\n    (\\<lambda>_. mem_val chunk p v')\"\n  using ht_store\n  apply (rule state_op.htriple_strengthen_inv)\n   apply simp\n  unfolding op_store_def\n  apply (simp split: prod.splits option.splits add: mem_lens.update_maybe_def mem_lens.laws invariants_def)\n  using Mem.store_inv\n  by auto\n\nlemma ht_alloc_inv[vcg_rules]:\n  assumes \"lo \\<le> hi\"\n  defines \"len \\<equiv> nat (hi - lo)\"\n  shows \"htriple\n    (\\<box>)\n    (op_alloc lo hi)\n    (\\<lambda>b. val_range (b, lo) (replicate len Undef))\"\n  apply (rule state_htI)\n  unfolding op_alloc_def\nproof (goal_cases)\n  case (1 F s)\n\n  obtain m where m: \"m = mem_lens.get s\" by simp\n\n  obtain m'' b where m''_alloc: \"(m'', b) = Mem.alloc m lo hi\"\n    by (metis old.prod.exhaust)\n\n  then obtain s'' where s''_alloc: \"s'' = mem_lens.put m'' s\"\n    by simp\n\n  with m''_alloc 1(1) have inv_s'': \"invariants s''\"\n    using invariants_def Mem.alloc_inv m\n    by (metis mem_lens.get_put)\n\n  have b: \"b = mem_nextblock m\"\n    using m''_alloc Mem.alloc.simps by auto\n\n  let ?contents_update = \"mem_contents_update (PMap.set (mem_nextblock m) (ZMap.init Undef))\"\n  let ?access_update = \"\\<lambda>hi. mem_access_update (PMap.set (mem_nextblock m) (\\<lambda>ofs k. if lo \\<le> ofs \\<and> ofs < hi then Some Freeable else None))\"\n  let ?contents_access_update = \"\\<lambda>hi. ?contents_update o (?access_update hi)\"\n  let ?nextblock_update = \"mem_nextblock_update ((+) 1)\"\n\n  obtain m' where m':\n    \"m' = (?contents_access_update hi) m\"\n    \"?nextblock_update m' = m''\"\n    using m m''_alloc\n    by (simp add: Mem.alloc.simps)\n\n  then obtain s' where s':\n    \"s' = mem_lens.update (?contents_access_update hi) s\"\n    \"mem_lens.update ?nextblock_update s' = s''\"\n    using Mem.alloc.simps m mem_lens.laws mem_lens.update_def s''_alloc\n    by auto\n\n  note mem_inv' = \\<open>invariants s\\<close>[unfolded invariants_def m[symmetric], unfolded Mem.mem_invariants_def]\n  then have mem_inv:\n    \"(\\<And>b ofs k. mem_nextblock m \\<le> b \\<Longrightarrow> mem_access m b ofs k = None)\"\n    \"(\\<And>b ofs. mem_nextblock m \\<le> b \\<Longrightarrow> mem_contents m b ofs = Undef)\"\n    by auto\n\n  have \"(val_range (b, lo) (replicate len Undef) \\<and>* F) (\\<alpha>_full s')\"\n    using assms s'(1) 1\n  proof (induction len arbitrary: hi m' s')\n    case 0\n\n    have [simp]: \"(mem_contents_update (\\<lambda>a b. if b = mem_nextblock m then \\<lambda>a. Undef else a b)\n       (mem_access_update (\\<lambda>a b. if b = mem_nextblock m then \\<lambda>ofs. Map.empty else a b) m)) = m\"\n      apply (rule mem.equality)\n      using mem_inv\n      by (auto intro!: ext)\n\n    have [simp]: \"\\<And>ofs. (lo \\<le> ofs \\<and> ofs < lo) = False\" by simp\n\n    from 0 have \"s' = s\"\n      apply (simp add: Mem.alloc.simps mem_update_id(2) mem_lens.laws mem_lens.update_def m[symmetric])\n      by (simp add: m mem_lens.put_get)\n\n    then show ?case\n      unfolding val_range_def\n      using \"1\"(2) by auto\n  next\n    case (Suc len)\n\n    obtain hi_prev where hi_prev: \"hi = hi_prev + 1\"\n      using diff_eq_eq by auto\n\n    have \"lo \\<noteq> hi\" using \\<open>Suc len = nat (hi - lo)\\<close> by simp\n\n    then have lo_hi_prev: \"lo \\<le> hi_prev\" \"len = nat (hi_prev - lo)\"\n      using \\<open>lo \\<le> hi\\<close> hi_prev apply simp\n      using \\<open>Suc len = nat (hi - lo)\\<close> hi_prev by simp\n\n    moreover obtain s_prev where s_prev: \"s_prev = mem_lens.update (?contents_access_update hi_prev) s\"\n      by simp\n\n    note val_range_prev = Suc(1)[OF calculation this \\<open>invariants s\\<close> \\<open>(\\<box> \\<and>* F) (\\<alpha>_full s)\\<close>]\n\n    from lo_hi_prev have hi_prev_lo_len: \"hi_prev = lo + int len\"\n      by simp\n\n    let ?single_update = \"mem_ptr_lens.concrete.put (mem_nextblock m, hi_prev) (Undef, perm_freeable)\"\n\n    have single_update: \"?contents_access_update hi = ?single_update o (?contents_access_update hi_prev)\"\n      apply standard\n      apply (rule mem.equality)\n      unfolding mem_ptr_lens_unfold\n      using mem_inv\n      by (auto intro!: ext simp add: perm_freeable_def hi_prev lo_hi_prev)\n\n    have \"s' = mem_lens.update (?single_update) s_prev\"\n      using s_prev Suc(4) single_update\n      using mem_lens.update_comp by auto\n\n    with single_update have s_step: \"s' = concrete.put (mem_nextblock m, hi_prev) (Undef, perm_freeable) s_prev\"\n      by (simp add: concrete.compose_defs(2))\n\n    have concrete_prev: \"concrete.get (mem_nextblock m, hi_prev) s_prev = (Undef, perm_none)\"\n      unfolding perm_none_def s_prev\n      by (auto simp: concrete_get m[symmetric] mem_lens.laws)\n\n    note create = assn_is_create[where ?c=\"s_prev\" and ?F=\"(val_range (b, lo) (replicate len Undef) \\<and>* F)\",\n        OF _ val_range_prev, simplified]\n\n    show ?case\n      apply (simp add: replicate_append_same[symmetric] val_range_step_end s_step hi_prev_lo_len b[symmetric])\n      apply (rule create)\n      by (simp add: concrete_prev hi_prev_lo_len[symmetric] b)\n  qed\n\n  note new_val_range = this\n\n  note intro = wp_stateopI(6)[of _ _ s'' b]\n  show ?case\n    apply (rule intro)\n    apply (metis m m''_alloc old.prod.case s''_alloc)\n    apply (simp add: inv_s'')\n    using new_val_range nextblock_indifferent s'(2)[symmetric]\n    by simp\nqed\n\nlemma ht_free_inv[vcg_rules]:\n  assumes \"lo \\<le> hi\"\n  defines \"len \\<equiv> nat (hi - lo)\"\n  assumes \"length vs = len\"\n  shows \"htriple\n    (val_range (b, lo) vs)\n    (op_free b lo hi)\n    (\\<lambda>_. \\<box>)\"\n  apply (rule state_op.htriple_strengthen_inv[OF ht_free])\n     apply (fact assms(1))\n    apply (simp add: assms(3) len_def)\n   apply simp\n  unfolding op_free_def mem_lens.update_maybe_def\n  apply (simp split: option.splits)\n  by (metis Mem'.free_inv invariants_def mem_lens.get_put)\n  \n\nend\n\nsection \\<open>State\\<close>\n\ndatatype concrete_cminor_state = CMSTATE (env: env) (mem: mem)\n\ntype_synonym cminor_stmt = \"func \\<times> val \\<times> stmt\"\ntype_synonym cminor_expr = \"val \\<times> expr\"\n\nlemmas fold_state = concrete_cminor_state.collapse\n\ntype_synonym abstract_cminor_state = \"(cminor_env \\<times> cminor_mem)\"\ntype_synonym cminor_assn = \"abstract_cminor_state \\<Rightarrow> bool\"\n\ndefinition cminor_\\<alpha> :: \"concrete_cminor_state \\<Rightarrow> abstract_cminor_state\" where\n  \"cminor_\\<alpha> s = (env_access.\\<alpha> (env s), mem_ptr_lens.\\<alpha> (mem s))\"\n\nsubsection \\<open>Interpretations\\<close>\n\nsubsubsection \\<open>Mem\\<close>\n\ndefinition \"concrete_mem_lens \\<equiv> BLENS mem (\\<lambda>m' s. CMSTATE (env s) m')\"\n\ninterpretation concrete_mem_lens: basic_lens concrete_mem_lens\n  unfolding concrete_mem_lens_def\n  apply standard\n  by auto\n\nlemmas concrete_mem_lens_unfold = concrete_mem_lens.unfold[OF concrete_mem_lens_def]\n\ndefinition abstract_mem_lens :: \"(cminor_mem \\<lhd> abstract_cminor_state)\" where\n  \"abstract_mem_lens \\<equiv> BLENS (\\<lambda>(e,m). m) (\\<lambda>m' (e,m). (e,m'))\"\n\ninterpretation abstract_mem_lens: sep_algebra_lens abstract_mem_lens\n  unfolding sep_algebra_lens_def\n  apply safe\nproof -\n  show \"basic_lens abstract_mem_lens\"\n    by unfold_locales (auto simp: abstract_mem_lens_def)\n\n  then interpret basic: basic_lens abstract_mem_lens .\n\n  show \"sep_algebra_lens_axioms abstract_mem_lens\"\n    apply unfold_locales\n    unfolding basic.defs\n    unfolding abstract_mem_lens_def\n    by (auto simp add: zero_prod_def fst_plus plus_prod_def sep_disj_prod_lower)\nqed\n\ninterpretation mem_defs: mem_assns_defs concrete_mem_lens abstract_mem_lens\n  by standard\n\ninterpretation mem: mem_assns cminor_\\<alpha> concrete_mem_lens abstract_mem_lens\n  apply standard\n  unfolding cminor_\\<alpha>_def abstract_mem_lens.ground_defs\n  unfolding abstract_mem_lens_def\n  unfolding concrete_mem_lens_unfold\n  using mem_ptr_lens_nextblock_indifferent\n  by auto\n\nsubsubsection \\<open>Env\\<close>\n\ndefinition \"concrete_env_lens \\<equiv> BLENS env (\\<lambda>e' s. CMSTATE e' (mem s))\"\n\ninterpretation concrete_env_lens: basic_lens concrete_env_lens\n  unfolding concrete_env_lens_def\n  apply standard\n  by auto\n\nlemmas concrete_env_lens_unfold = concrete_env_lens.unfold[OF concrete_env_lens_def]\n\ndefinition abstract_env_lens :: \"(cminor_env \\<lhd> abstract_cminor_state)\" where\n  \"abstract_env_lens \\<equiv> BLENS fst (\\<lambda>e' (e,m). (e',m))\"\n\ninterpretation abstract_env_lens: sep_algebra_lens abstract_env_lens\n  unfolding sep_algebra_lens_def\n  apply safe\nproof -\n  show \"basic_lens abstract_env_lens\"\n    by unfold_locales (auto simp: abstract_env_lens_def)\n\n  then interpret basic: basic_lens abstract_env_lens .\n\n  show \"sep_algebra_lens_axioms abstract_env_lens\"\n    apply unfold_locales\n    unfolding basic.defs\n    unfolding abstract_env_lens_def\n    by (auto simp add: zero_prod_def fst_plus plus_prod_def sep_disj_prod_lower)\nqed\n\ninterpretation env: env_assns cminor_\\<alpha> concrete_env_lens abstract_env_lens mem.invariants\n  apply standard\n  unfolding cminor_\\<alpha>_def abstract_env_lens.defs concrete_env_lens.defs\n  unfolding abstract_env_lens_def concrete_env_lens_def\n    apply auto\n  unfolding mem.invariants_def Mem.mem_invariants_def concrete_mem_lens_unfold\n  by auto\n\nlemmas env_concrete_unfold = env.concrete.unfold\n\nlemma env_concrete_is: \"env.concrete.is ident v s \\<longleftrightarrow> env s ident = v\"\n  unfolding env.concrete.compose_ground_defs\n  unfolding env_access_def concrete_env_lens_def\n  by simp\n\nlemma env_concrete_put: \"(env.concrete.put ident (Some v) s = s') \\<longleftrightarrow> (mem s' = mem s \\<and> env s' = env s(ident \\<mapsto> v))\"\n  unfolding env.concrete.compose_ground_defs\n  unfolding concrete_env_lens_def env_access_def\n  apply simp\n  by (metis concrete_cminor_state.exhaust_sel concrete_cminor_state.sel(1) concrete_cminor_state.sel(2))\n\nsection \\<open>WP setup\\<close>\n\nsubsection \\<open>WP for expressions\\<close>\n\ninterpretation expr: wp_from_inductive_determ \"\\<lambda>(ge, sp) a s v s'. eval_expr ge sp (env s) (mem s) a v \\<and> s'=s\"\n  apply (unfold_locales)\n  using eval_expr_determ by auto\n\nthm expr.wp_determI\n\nlemmas expr_wpI = expr.wp_determI[of \"(ge, sp)\" a \"CMSTATE e m\" v \"CMSTATE e m\", simplified] for ge sp a e m v e' m'\nlemmas expr_wp_intros[intro] = eval_expr.intros[THEN expr_wpI, where ?e=\"env s\" and ?m=\"mem s\", simplified] for s\n\n(* exprlists *)\n\ninterpretation exprlist: wp_from_inductive_determ \"\\<lambda>(ge, sp) as s vs s'. eval_exprlist ge sp (env s) (mem s) as vs \\<and> s'=s\"\n  apply (unfold_locales)\n  using eval_exprlist_determ by auto\n\nlemmas exprlist_wpI = exprlist.wp_determI[of \"(ge, sp)\" as \"CMSTATE e m\" v \"CMSTATE e m\", simplified] for ge sp as e m v e' m'\nlemmas exprlist_wp_intros[intro] = eval_exprlist.intros[THEN exprlist_wpI, where ?e=\"env s\" and ?m=\"mem s\", simplified] for s\n\nsubsection \\<open>WP for external calls\\<close>\n\ninterpretation extcall: wp_from_inductive \"\\<lambda>(ge, vargs) ef s (t, vres) s'. external_call ef (Genv.to_senv ge) vargs (mem s) t vres (mem s') \\<and> (env s' = env s)\"\n  .\n\nlemmas extcall_wpI = extcall.wpI[of \"(ge, vargs)\" ef \"CMSTATE e m\" \"(t, vres)\" \"CMSTATE e m'\", simplified] for ge vargs ef e m t vres m'\nlemmas extcall_wp_intros[intro] =\n  external_call_intros[THEN extcall_wpI, where ?e=\"env s\" and ?m=\"mem s\", simplified, simplified extcall_simps, simplified] for s\n\nsubsection \\<open>WP for statements\\<close>\n\ninterpretation stmt: wp_from_inductive \"\\<lambda>(ge, f, sp) st s (t, out) s'. exec_stmt ge f sp (env s) (mem s) st t (env s') (mem s') out\"\n  .\n\nlemmas stmt_wpI = stmt.wpI[of \"(ge, f, sp)\" st \"CMSTATE e m\" \"(t, out)\" \"CMSTATE e' m'\", simplified] for ge f sp st e m t out e' m'\nlemmas stmt_validI = stmt.validI[of \"(ge, f, sp)\" st \"CMSTATE e m\" \"(t, out)\" \"CMSTATE e' m'\", simplified] for ge f sp st e m t out e' m'\n\nlemmas wp_intros = eval_funcall_exec_stmt.intros(3-)[THEN stmt_wpI, where ?e=\"env s'\" and ?m=\"mem s'\", simplified] for s'\nlemmas valid_intros = eval_funcall_exec_stmt.intros(3-)[THEN stmt_validI, where ?e=\"env s'\" and ?m=\"mem s'\", simplified] for s'\n\nsubsection \\<open>WP for functions\\<close>\n\ntype_synonym cminor_func_call = \"(func AST.fundef \\<times> val list)\"\ntype_synonym cminor_func_res = \"(trace \\<times> val)\"\n\ninterpretation func: wp_from_inductive \"\\<lambda>(ge, vargs) f s (t, vres) s'. eval_funcall ge (mem s) f vargs t (mem s') vres \\<and> (env s' = env s)\"\n  .\n\nlemmas func_wpI = func.wpI[of \"(ge, vargs)\" f \"CMSTATE e m\" \"(t, vres)\" \"CMSTATE e m'\", simplified] for ge vargs f e m t vres m'\nlemmas func_wp_intros[intro] =\n  eval_funcall_exec_stmt.intros(1)[THEN func_wpI, where ?e=\"env s\" and ?m=\"mem s\", simplified, simplified eval_funcall_internal_simp] for s\n\nthm eval_funcall_internal_simp\n\nlemma wp_func_internal: (* TODO: turn into decomp rule *)\n  assumes \"\\<exists>m1 sp e t e2 m2 out vres m3.\n            (Mem.alloc (mem s) 0 (fn_stackspace f) = (m1, sp) \\<and>\n            set_locals (fn_vars f) (set_params vargs (fn_params f)) = e \\<and>\n            exec_stmt ge f (Vptr sp 0) e m1 (fn_body f) t e2 m2 out \\<and>\n            outcome_result_value out vres \\<and>\n            outcome_free_mem out m2 sp (fn_stackspace f) m3)\"\n          \"\\<And>m1 sp e t e2 m2 out vres m3.\n            (Mem.alloc (mem s) 0 (fn_stackspace f) = (m1, sp) \\<Longrightarrow>\n            set_locals (fn_vars f) (set_params vargs (fn_params f)) = e \\<Longrightarrow>\n            exec_stmt ge f (Vptr sp 0) e m1 (fn_body f) t e2 m2 out \\<Longrightarrow>\n            outcome_result_value out vres \\<Longrightarrow>\n            outcome_free_mem out m2 sp (fn_stackspace f) m3) \\<Longrightarrow>\n            Q (t, vres) (CMSTATE (env s) m3)\"\n  shows \"func.wp (ge, vargs) (Internal f) Q s\"\n  using assms\n  apply (auto intro!: func_wp_intros)\n  by (metis concrete_cminor_state.collapse)\n\n(* lemma wp_func_internal:\n  assumes \"wp_stateop (mem.op_alloc 0 (fn_stackspace f) (\n      \\<lambda>sp. wp_stateop (op_set_params vargs (fn_params f)) (\n       \\<lambda>_. wp_stateop (op_set_locals (fn_vars f)) (\n       \\<lambda>_. stmt.wp (ge, f, sp) (fn_body f) (\n\\<lambda>(t, out). wp_stateop (Maybe (outcome_result_value_func out)) (\n    \\<lambda>vres. wp_stateop (UpdateMaybe (outcome_free_mem *)\n\nsection \"WP-rules for expressions\"\n\nlemma wp_Econst[vcg_decomp_rules]:\n  \"wp_stateop (Maybe (eval_constant ge sp c)) Q s \\<Longrightarrow> expr.wp (ge, sp) (Econst c) Q s\"\n  by (auto simp del: wp_stateop.simps)\n\nlemma wp_Eunop[vcg_decomp_rules]:\n  \"expr.wp (ge, sp) a (\\<lambda>v. wp_stateop (Maybe (eval_unop op v)) Q) s \\<Longrightarrow>\n    expr.wp (ge, sp) (Eunop op a) Q s\"\n  by (auto elim!: expr.wpE)\n\nlemma wp_Ebinop[vcg_decomp_rules]:\n  \"expr.wp (ge, sp) (a1) (\\<lambda>v1.\n    expr.wp (ge, sp) (a2) (\\<lambda>v2. \n      (wp_stateop (ReadMaybe (\\<lambda>s. eval_binop op v1 v2 (mem s))) Q))) s \\<Longrightarrow>\n    expr.wp (ge, sp) (Ebinop op a1 a2) Q s\"\n  by (auto elim!: expr.wpE_concrete)\n\nlemma wp_Eload[vcg_decomp_rules]:\n  \"expr.wp (ge, sp) (addr) (\\<lambda>vaddr. wp_stateop (mem.op_loadv chunk vaddr) Q) s \\<Longrightarrow>\n    expr.wp (ge, sp) (Eload chunk addr) Q s\"\n  unfolding mem.op_loadv_def\n  by (auto elim!: expr.wpE simp: concrete_mem_lens_unfold)\n\nlemma wp_exprlist_nil[vcg_decomp_rules]:\n  \"Q [] s \\<Longrightarrow> exprlist.wp (ge, sp) ([]) Q s\"\n  by (metis (mono_tags, lifting) exprlist_wp_intros(1))\n\nlemma wp_exprlist_step[vcg_decomp_rules]:\n  assumes \"expr.wp (ge, sp) (a) (\\<lambda>v. exprlist.wp (ge, sp) (as) (\\<lambda>vs. Q (v # vs))) s\"\n  shows \"exprlist.wp (ge, sp) (a # as) Q s\"\n  using assms\n  by (smt (verit, best) expr.wp_determE exprlist.wp_determE exprlist_wp_intros(2) old.prod.case)\n\nsection \\<open>WP-rules for external calls\\<close>\n\nlemma wp_extcall_malloc:\n  assumes \"wp_stateop (mem.op_alloc (- size_chunk Mptr) (Int64.unsigned sz))\n          (\\<lambda>b. wp_stateop (mem.op_store Mptr (b, - size_chunk Mptr) (Vptrofs sz)) (\\<lambda>_. Q (E0, (Vptr b 0)))) s\"\n  shows \"extcall.wp (ge, [Vptrofs sz]) EF_malloc Q s\"\n  using assms\n  unfolding mem.op_alloc_def mem.op_store_def concrete_mem_lens_unfold\n  apply (auto split: prod.splits option.splits intro!: extcall_wp_intros)\n  by (metis concrete_cminor_state.collapse)\n\nlemma wp_extcall_free:\n  assumes \"wp_stateop (mem.op_load Mptr (b, - size_chunk Mptr))\n          (\\<lambda>v s. case v of Vlong sz \\<Rightarrow>\n            sz > 0 \\<and> wp_stateop (mem.op_free b (- size_chunk Mptr) (uint sz)) (\\<lambda>_. Q (E0, Vundef)) s\n           | _ \\<Rightarrow> False) s\"\n  shows \"extcall.wp (ge, [Vptr b 0]) EF_free Q s\"\n  using assms\n  unfolding mem.op_load_def mem.op_free_def concrete_mem_lens_unfold\n  apply (auto split: prod.splits option.splits val.splits intro!: extcall_wp_intros\n          simp: Vptrofs_def Vnullptr_def word_less_def)\n  by (metis concrete_cminor_state.collapse)\n\nsection \\<open>WP-rules for statements\\<close>\n\nlemma wp_Sskip[vcg_decomp_rules]: \"stmt.wp (ge, f, sp) (Sskip) Q s = Q (E0, Out_normal) s\"\n  by (smt (z3) case_prodE' concrete_cminor_state.expand exec_stmt_Sskip_simp old.prod.case stmt.wlp_def stmt.wp_def wp_intros(1))\n\nlemma wp_Sassign[vcg_decomp_rules]:\n  assumes \"expr.wp (ge, sp) (a) (\\<lambda>v. wp_stateop (env.op_concrete_put ident v) (\\<lambda>_. Q (E0, Out_normal))) s\"\n  shows \"stmt.wp (ge, f, sp) (Sassign ident a) Q s\"\n  using assms unfolding env.op_concrete_put_def\n  apply (auto elim!: expr.wpE exec_stmt.cases intro!: wp_intros)\n  by (metis env_concrete_put)\n\nlemma wp_Sstore[vcg_decomp_rules]:\n  assumes \"expr.wp (ge, sp) (addr) (\\<lambda>vaddr. \n            expr.wp (ge, sp) (a) (\\<lambda>v.\n              wp_stateop (mem.op_storev chunk vaddr v) (\\<lambda>_. Q (E0, Out_normal))\n            )\n          )  s\"\n  shows \"stmt.wp (ge, f, sp) (Sstore chunk addr a) Q s\"\n  using assms unfolding mem.op_storev_def concrete_mem_lens_unfold\n  apply (rule expr.wpE)\n  apply (erule expr.wpE)\n  apply (erule wp_stateopE; simp)\nproof (goal_cases)\n  case (1 r ra f s')\n\n  obtain m' where m': \"Mem.storev chunk (mem s) r ra = Some m'\"\n    using \"1\"(3) \"1\"(4) by fastforce\n\n  note intro = wp_intros(3)[OF\n      \\<open>eval_expr ge sp (env s) (mem s) addr r\\<close>\n      \\<open>eval_expr ge sp (env s) (mem s) a ra\\<close> m']\n\n  show ?case\n    apply (rule intro)\n    apply safe\n    by (metis \"1\"(1) \"1\"(4) concrete_cminor_state.exhaust_sel eval_expr_determ option.simps(5))\nqed\n\ninductive_cases exec_Sseq_cases: \"exec_stmt ge f sp (env s) (mem s) (Sseq st1 st2) t (env s') (mem s') out\"\n\nlemma wp_Sseq[vcg_decomp_rules]:\n  assumes \"stmt.wp (ge, f, sp) (st1) (\\<lambda>(t1, out1).\n      if out1 = Out_normal\n      then stmt.wp (ge, f, sp) (st2) (\\<lambda>(t2, out2). Q (t1 @ t2, out2))\n      else Q (t1, out1)) s\"\n  shows \"stmt.wp (ge, f, sp) (Sseq st1 st2) Q s\"\n  apply (rule stmt.wp_to_wp[OF assms]; clarsimp)\nproof (goal_cases)\n  case (1 t out s')\n  then show ?case\n    apply (cases \"out = Out_normal\"; clarsimp)\n     apply (erule stmt.wpE)\n    apply simp\n    using exec_Sseq_continue apply fastforce\n    using exec_Sseq_stop by blast\nnext\n  case (2 t' out' s'')\n\n  show ?case\n  proof (cases rule: exec_Sseq_cases[OF 2(2)])\n    case (1 t1 e1 m1 t2)\n    then obtain s1 where\n      \"exec_stmt ge f sp (env s) (mem s) st1 t1 (env s1) (mem s1) Out_normal\"\n      \"exec_stmt ge f sp (env s1) (mem s1) st2 t2 (env s'') (mem s'') out'\"\n      by (metis concrete_cminor_state.sel(1) concrete_cminor_state.sel(2))\n    with 1(1) 2 show ?thesis\n      using stmt.wpD(2) by fastforce\n  next\n    case 2\n    then show ?thesis\n      using assms stmt.wpD(2) by fastforce\n  qed\nqed\n\nlemma wp_Scall:\n  assumes\n    \"expr.wp (ge, sp) (a)(\n    \\<lambda>vf. wp_stateop (Maybe (Genv.find_funct ge vf)) (\n    \\<lambda>fd s. funsig fd = sig \\<and> exprlist.wp (ge, sp) (bl) (\n    \\<lambda>vargs. func.wp (ge, vargs) fd (\n    \\<lambda>(t, vres). wp_stateop (env.op_set_optvar optid vres) (\\<lambda>_. Q (t, Out_normal)))) s)) s\"\n  shows \"stmt.wp (ge, f, sp) (Scall optid sig a bl) Q s\"\n  using assms\n  unfolding env.op_set_optvar_def\n  unfolding concrete_env_lens_unfold\n  apply (auto elim!: expr.wpE exprlist.wpE func.wpE)\n  apply (rule wp_intros)\n  apply (auto simp add: eval_expr_determ' eval_exprlist_determ')\n  by (metis (no_types, hide_lams) concrete_cminor_state.exhaust_sel concrete_cminor_state.sel(1) concrete_cminor_state.sel(2))\n\nlemma wp_Sbuiltin:\n  assumes\n    \"exprlist.wp (ge, sp) (bl) (\n    \\<lambda>vargs. extcall.wp (ge, vargs) ef (\n    \\<lambda>(t, vres). wp_stateop (env.op_set_optvar optid vres) (\n    \\<lambda>_. Q (t, Out_normal)))) s\"\n  shows \"stmt.wp (ge, f, sp) (Sbuiltin optid ef bl) Q s\"\n  using assms\n  unfolding env.op_set_optvar_def\n  apply (auto elim!: exprlist.wpE extcall.wpE simp: concrete_env_lens_unfold[abs_def] simp del: set_optvar.simps)\n  apply (rule wp_intros)\n     apply (auto simp: eval_exprlist_determ')\n  by (metis (no_types, lifting) concrete_cminor_state.exhaust_sel concrete_cminor_state.sel(1) concrete_cminor_state.sel(2))\n\n\n(* TODO: needs more work *)\n(* lemma wp_Stailcall:\n  assumes\n    \"wp_stateop (mem.op_free sp 0 (fn_stackspace f)) (\n    \\<lambda>_. expr.wp (ge, Vptr sp 0) a (\n    \\<lambda>vf. wp_stateop (Maybe (Genv.find_funct ge vf)) (\n    \\<lambda>fd s. funsig fd = sig \\<and> exprlist.wp (ge, Vptr sp 0) bl (\n    \\<lambda>vargs. func.wp (ge, vargs) fd (\\<lambda>(t, vres).\n          Q (t, Out_tailcall_return vres)\n    )) s))) s\"\n  shows \"stmt.wp (ge, f, (Vptr sp 0)) (Stailcall sig a bl) Q s\"\n  using assms\n  unfolding mem.op_free_def\n  apply (auto elim!: expr.wpE exprlist.wpE func.wpE simp del: wp_stateop.simps)\n  apply (rule wp_intros)\n        apply (auto simp add: eval_expr_determ' eval_exprlist_determ' concrete_mem_lens.unfold[OF concrete_mem_lens_def])\n  sorry *)\n\ninductive_cases exec_Sifthenelse_cases: \"exec_stmt ge f sp (env s) (mem s) (Sifthenelse a st1 st2) t e' m' out\"\n\nlemma wp_Sifthenelse:\n  assumes \"expr.wp (ge, sp) (a) (\\<lambda>v _. Val.bool_of_val v True \\<and> stmt.wp (ge, f, sp) (st1) Q s) s\"\n  assumes \"expr.wp (ge, sp) (a) (\\<lambda>v _. Val.bool_of_val v False \\<and> stmt.wp (ge, f, sp) (st2) Q s) s\"\n  shows \"stmt.wp (ge, f, sp) (Sifthenelse a st1 st2) Q s\"\n  apply (rule expr.wpE[OF assms(1)])\n  apply (rule expr.wpE[OF assms(2)])\n  apply (simp split: prod.splits add: eval_expr_determ')\nproof (goal_cases)\n  case (1 r)\n\n  then obtain b where b: \"Val.bool_of_val r b\" \"stmt.wp (ge, f, sp) (if b then st1 else st2) Q s\"\n    by (smt (verit, ccfv_threshold))\n\n  note from_wp = stmt.wpD[OF b(2), simplified]\n\n  show ?case\n    apply (rule wp_intros)\n       apply (fact 1(2))\n      apply (fact b(1))\n    using from_wp\n    using \"1\"(3) \"1\"(1) bool_of_val_determ by blast+\nqed\n\nlemma wlp_Sloop:\n  assumes init: \"I (f, sp) (E0, Out_normal) s\"\n  assumes step: \"\\<And>f sp t out s. I (f, sp) (t, out) s \\<Longrightarrow>\n      if out = Out_normal\n      then stmt.wlp (ge, f, sp) (st) (\\<lambda>(t2, out2). I (f, sp) (t @ t2, out2)) s\n      else Q (t, out) s\"\n  shows \"stmt.wlp (ge, f, sp) (Sloop st) Q s\"\n  apply (rule stmt.wlpI)\nproof (clarsimp; goal_cases)\n  case (1 t out s')\n\n  then have exec: \"exec_stmt ge f sp (env s) (mem s) (Sloop st) t (env s') (mem s') out\"\n    using 1 by simp\n\n  note induct = eval_funcall_exec_stmt.inducts(2)[where ?P1.0=\"top\"]\n\n  {\n    fix t0\n    assume init: \"I (f, sp) (t0, Out_normal) s\"\n    have \"Q (t0 @ t, out) s'\" using exec init\n    proof (induction f sp \"env s\" \"mem s\" \"(Sloop st)\" t \"env s'\" \"mem s'\" out arbitrary: t0 s s' rule: induct)\n      case (eval_funcall_internal m f m1 sp vargs e t e2 m2 out vres m3)\n      then show ?case by simp\n    next\n      case (eval_funcall_external ef args m t res m')\n      then show ?case by simp\n    next\n      case (exec_Sloop_loop f sp t t1 e1 m1 t2 out s s' t0)\n\n      note step[OF \\<open>I (f, sp) (t0, Out_normal) s\\<close>, simplified]\n      note next_inv = stmt.wlpD[OF this, of \"(t1, Out_normal)\", simplified]\n\n      show ?case\n        using next_inv exec_Sloop_loop(1,4,5)\n        by (metis append_assoc concrete_cminor_state.sel(1) concrete_cminor_state.sel(2))\n    next\n      case (exec_Sloop_stop f sp t out s s' t0)\n\n      note step[OF \\<open>I (f, sp) (t0, Out_normal) s\\<close>, simplified]\n      note next_inv = stmt.wlpD[OF this, of \"(t, out)\", simplified]\n\n      show ?case\n        using next_inv exec_Sloop_stop(1,2)\n        by (meson exec_Sloop_stop.hyps(3) local.step)\n    qed\n  }\n\n  then show ?case using init by fastforce\nqed\n\nlemma wp_Sloop: (* TODO: define whileI *)\n  assumes wf: \"wf R\"\n  assumes init: \"I (f, sp) (E0, Out_normal) s\"\n  assumes step: \"\\<And>f sp t out s. I (f, sp) (t, out) s \\<Longrightarrow>\n      if out = Out_normal\n      then stmt.wp (ge, f, sp) (st)\n        (\\<lambda>(t2, out2) s'. I (f, sp) (t @ t2, out2) s' \\<and> (s',s) \\<in> R) s\n      else Q (t, out) s\"\n  shows \"stmt.wp (ge, f, sp) (Sloop st) Q s\"\n  unfolding stmt.wp_def\nproof(standard, goal_cases)\n  case 1\n\n  {\n    fix t0\n    assume init: \"I (f, sp) (t0, Out_normal) s\"\n\n    have ?case\n    using wf init\n    proof (induction arbitrary: t0 rule: wf_induct_rule[where a=s])\n      case (less s)\n\n      note valid_Sloop_loop = valid_intros(9)\n      note valid_Sloop_stop = valid_intros(10)\n\n      note next_step = step[OF less(2), simplified]\n\n      then show ?case\n        apply (cases rule: stmt.wpE_concrete)\n        apply clarsimp\n      proof (goal_cases)\n        case (1 t out s')\n\n        show ?case\n        proof (cases \"out = Out_normal\")\n          case True\n\n          with less(1) 1(2,3)\n          have \"stmt.valid (ge, f, sp) (Sloop st) s'\" by simp\n          then obtain t' e'' m'' out'\n            where valid_loop: \"exec_stmt ge f sp (env s') (mem s') (Sloop st) t' e'' m'' out'\"\n            by (auto elim!: stmt.validE)\n\n          show ?thesis\n            apply (rule valid_Sloop_loop)\n            using 1(1,2) True apply simp\n             apply (fact valid_loop)\n            by simp\n        next\n          case False\n          show ?thesis\n            apply (rule valid_Sloop_stop)\n            using 1(1) False by auto\n        qed\n      qed\n    qed\n  }\n\n  then show ?case using init by simp\nnext\n  case 2\n  then show ?case\n    using step[unfolded stmt.wp_def] wlp_Sloop\n    by (smt case_prodI2' case_prod_conv init local.step stmt.wlpI stmt.wpE)\nqed\n\nlemma wp_Sblock[vcg_decomp_rules]:\n  assumes \"stmt.wp (ge, f, sp) (st) (\\<lambda>(t, out) s'. Q (t, outcome_block out) s') s\"\n  shows \"stmt.wp (ge, f, sp) (Sblock st) Q s\"\n  using assms\n  by (auto intro!: wp_intros elim!: stmt.wpE elim: exec_stmt.cases)\n\nlemma wp_Sexit: \"Q (E0, Out_exit n) s \\<Longrightarrow> stmt.wp (ge, f, sp) (Sexit n) Q s\"\n  using concrete_cminor_state.expand\n  by (auto intro!: wp_intros elim!: exec_stmt.cases)\n\nlemma wp_Sswitch:\n  assumes \"expr.wp (ge, sp) (a) (\\<lambda>v s. \\<exists>n. switch_argument islong v n \\<and>\n            Q (E0, Out_exit (switch_target n def cases)) s) s\"\n    shows \"stmt.wp (ge, f, sp) (Sswitch islong a cases def) Q s\"\n  using assms\n  apply (auto intro!: wp_intros elim!: expr.wpE exec_stmt.cases)\n  using concrete_cminor_state.expand switch_argument_determ by blast\n\ninductive_cases exec_Sreturn_cases: \"exec_stmt ge f sp (env s) (mem s) (Sreturn (Some a)) t (env s') (mem s') out\"\n\nlemma wp_Sreturn_None[vcg_decomp_rules]:\n  assumes \"Q (E0, Out_return None) s\"\n  shows \"stmt.wp (ge, f, sp) (Sreturn None) Q s\"\n  using assms\n  apply (auto intro!: wp_intros elim!: exec_stmt.cases)\n  by (metis concrete_cminor_state.expand)\n\nlemma wp_Sreturn_Some[vcg_decomp_rules]:\n  assumes \"expr.wp (ge, sp) (a) (\\<lambda>v. Q (E0, Out_return (Some v))) s\"\n  shows \"stmt.wp (ge, f, sp) (Sreturn (Some a)) Q s\"\nproof (-)\n  from assms have \"expr.wp (ge, sp) (a) (\\<lambda>v s. Q (E0, Out_return (Some v)) s) s\" by simp\n  then show ?thesis\n    apply (auto elim!: expr.wpE exec_Sreturn_cases intro!: stmt.wpI)\n    by (metis concrete_cminor_state.expand)\nqed\n\nsection \\<open>Expression hoare rules\\<close>\n\ncontext\n  fixes ge :: genv\nbegin\n\nabbreviation \"expr_ht sp P c Qp \\<equiv> expr.htriple (ge, sp) cminor_\\<alpha> mem.invariants P c (\\<lambda>r. \\<up>(Qp r) ** P)\"\n\nnotation expr_ht (\"_ \\<Turnstile>\\<^sub>e\")\n\nlemma ht_Evar[vcg_rules]:\n  shows \"sp \\<Turnstile>\\<^sub>e\n        (env.assn_is ident v)\n        (Evar ident)\n        (\\<lambda>r. r = v)\"\n  apply (rule expr.htripleI)\n  apply (rule expr_wp_intros)\n   apply (simp add: env.assn_is_concrete env_concrete_is)\n  by (simp add: pred_lift_extract_simps(2))\n\nsection \\<open>Stmt hoare rules\\<close>\n\nabbreviation silent_op :: \"cminor_assn \\<Rightarrow> (trace \\<times> outcome \\<Rightarrow> cminor_assn)\" where\n  \"silent_op P \\<equiv> \\<lambda>(t, out). \\<up>(t = E0 \\<and> out = Out_normal) ** P\"\n\nabbreviation \"stmt_ht_weak f sp \\<equiv> stmt.htriple (ge, f, sp) cminor_\\<alpha> I\\<^sub>0\"\nabbreviation \"stmt_ht f sp \\<equiv> stmt.htriple (ge, f, sp) cminor_\\<alpha> mem.invariants\"\nabbreviation \"stmt_htF f sp \\<equiv> stmt.htripleF (ge, f, sp) cminor_\\<alpha> mem.invariants\"\n\nlemma ht_Sassign[vcg_rules]:\n  assumes [vcg_rules]:\n    \"expr_ht sp (env.assn_is i v ** F) e (\\<lambda>r. r = v')\"\n  shows \"stmt_htF f sp\n      F (env.assn_is i v)\n      (Sassign i e)\n      (silent_op (env.assn_is i v'))\"\n  by vcg\n\nlemma ht_Sassign':\n  shows \"stmt_ht f sp\n      (env.assn_is i v)\n      (Sassign i (Econst (Ointconst 42)))\n      (silent_op (env.assn_is i (Vint 42)))\"\n  by vcg\n\nlemma ht_Sstore[vcg_rules]:\n  fixes b ofs\n  defines [simp]: \"p \\<equiv> (b, uint ofs)\"\n  assumes fit: \"mem.chunk_fit chunk v'\"\n  assumes expr_addr[vcg_rules]:\n    \"expr_ht sp (mem.mem_chunk chunk p vs ** P) expr_addr (\\<lambda>r. r = (Vptr b ofs))\"\n  assumes expr_v[vcg_rules]:\n    \"expr_ht sp (mem.mem_chunk chunk p vs ** P) expr_v (\\<lambda>r. r = v')\"\n  shows \"stmt_ht f sp\n      (mem.mem_chunk chunk p vs ** P)\n      (Sstore chunk expr_addr expr_v)\n      (silent_op (mem.mem_val_fit chunk p v' ** P))\"\n  using fit by vcg\n\nlemma ht_Sstore':\n  fixes b ofs\n  defines [simp]: \"p \\<equiv> (b, uint ofs)\"\n  defines [simp]: \"chunk \\<equiv> Mint32\"\n  shows \"stmt_ht f (Vptr b ofs)\n      (mem.mem_chunk chunk p vs)\n      (Sstore chunk (Econst (Oaddrstack 0)) (Econst (Ointconst 42)))\n      (silent_op (mem.mem_val_fit chunk p (Vint 42)))\"\n  using mem.chunk_fit.intros\n  by vcg\n\nlemma ht_malloc[vcg_rules]:\n  notes [simp] = Vptrofs_def Mptr_def\n  notes wp_extcall_malloc[simplified, vcg_decomp_rules]\n  notes wp_Sbuiltin[vcg_decomp_rules]\n  shows \"stmt_ht f sp\n      (env.assn_is env_b b')\n      (Sbuiltin (Some env_b) (EF_malloc) [Econst (Olongconst sz)])\n      (silent_op (EXS b. env.assn_is env_b (Vptr b 0)\n               ** mem.mem_val_fit Mptr (b, - size_chunk Mptr) (Vptrofs sz)\n               \\<and>* mem.val_range (b, 0) (replicate (nat (Int64.unsigned sz)) Undef)))\"\nproof -\n  have split_okay: \"8 \\<le> length (replicate (nat (Int64.unsigned sz + 8)) Undef)\"\n    apply (simp)\n    by (metis Word.of_nat_unat le_add2 nat_int_add of_nat_numeral)\n\n  note split' = mem.val_range_split[OF this, simplified]\n\n  have sep_sep: \"\\<And>P P' Q Q'. P = P' \\<Longrightarrow> Q = Q' \\<Longrightarrow> (P ** Q) = (P' ** Q')\"\n    by simp\n\n  have split:\n    \"\\<And>r. mem.val_range (r, - 8)\n          (replicate (nat (Int64.unsigned sz + 8)) Undef)\n       = (mem.mem_chunk Mint64 (r, - 8) (replicate (size_chunk_nat Mint64) Undef)\n      **  mem.val_range (r, 0) (replicate (nat (Int64.unsigned sz)) Undef))\"\n    unfolding mem.mem_chunk_def\n    apply (simp add: split')\n    apply (simp add: sep_algebra_simps)\n    apply (rule sep_sep)\n    using split_okay apply force\n    using nat_add_distrib by auto\n\n  note [vcg_rules del] = mem.ht_store_inv\n\n  show ?thesis\n    apply vcg\n    apply (subst (asm) split)\n    supply [vcg_rules] = mem.ht_store_inv\n    apply vcg\n       apply (auto simp add: mem.chunk_fit.intros(5))\n    by vcg\nqed\n\nlemma ht_free[vcg_rules]:\n  notes mem.wp_load[vcg_decomp_rules]\n  notes wp_extcall_free[vcg_decomp_rules]\n  notes wp_Sbuiltin[vcg_decomp_rules]\n  assumes [iff]: \"0 < sz\"\n  assumes [simp]: \"length vs = unat sz\"\n  shows \"stmt_ht f sp\n      (env.assn_is env_b (Vptr b 0)\n       ** mem.mem_val Mptr (b, - size_chunk Mptr) (Vptrofs sz)\n       \\<and>* mem.val_range (b, 0) vs)\n      (Sbuiltin None (EF_free) [Evar env_b])\n      (silent_op (EXS v. env.assn_is env_b v))\"\nproof -\n\n  have [simp]: \"Mptr = Mint64\" \"Vptrofs = Vlong\"\n    unfolding Mptr_def Vptrofs_def by auto\n\n  have merge:\n    \"\\<And>F.(mem.mem_val Mint64 (b, - 8) (Vlong sz)\n      \\<and>* mem.val_range (b, 0) vs \\<and>* F \\<and>* env.assn_is env_b (Vptr b 0))\n      = (mem.val_range (b, - 8) (encode_val Mint64 (Vlong sz) @ vs)\n      \\<and>* F \\<and>* env.assn_is env_b (Vptr b 0))\"\n    unfolding Vptrofs_def Mptr_def mem.mem_chunk_def\n    apply (simp add: mem.val_range_split_concat)\n    by (simp add: mem.chunk_fit.simps sep_algebra_simps)\n\n  show ?thesis\n    apply vcg\n    apply (subst (asm) merge)\n    apply vcg\n    apply (auto simp: Int.nat_add_distrib sep_algebra_simps)\n    by vcg\nqed\n\nend\n\nend", "meta": {"author": "mckirk", "repo": "Isabelle_Cminor", "sha": "76ae3d8bb8f84fefdf67f028f2db08020a79ceb1", "save_path": "github-repos/isabelle/mckirk-Isabelle_Cminor", "path": "github-repos/isabelle/mckirk-Isabelle_Cminor/Isabelle_Cminor-76ae3d8bb8f84fefdf67f028f2db08020a79ceb1/theory/src/Sep_Logic.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6113819732941511, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.30330282440098283}}
{"text": "section \\<open>Execution rules for groups\\<close>\n\ntheory KPL_execution_group imports \n  KPL_execution_thread\nbegin\n\ntext \\<open>Intra-group race detection\\<close>\ndefinition group_race \n  :: \"lid set \\<Rightarrow> (lid \\<rightharpoonup> thread_state) \\<Rightarrow> bool\"\nwhere \"group_race T \\<gamma> \\<equiv> \n  \\<exists>j \\<in> T. \\<exists>k \\<in> T. j \\<noteq> k \\<and> \n  W (the (\\<gamma> j)) \\<inter> (R (the (\\<gamma> k)) \\<union> W (the (\\<gamma> k))) \\<noteq> {}\"\n\ntext \\<open>The constraints for the @{term \"merge\"} map\\<close>\ninductive pre_merge \n  :: \"lid set \\<Rightarrow> (lid \\<rightharpoonup> thread_state) \\<Rightarrow> nat \\<Rightarrow> word \\<Rightarrow> bool\"\nwhere \n  \"\\<lbrakk> j \\<in> T ; z \\<in> W (the (\\<gamma> j)) ; dom \\<gamma> = T \\<rbrakk> \\<Longrightarrow>\n  pre_merge T \\<gamma> z (sh (the (\\<gamma> j)) z)\"\n| \"\\<lbrakk> \\<forall>j \\<in> T. z \\<notin> W (the (\\<gamma> j)) ; dom \\<gamma> = T \\<rbrakk> \\<Longrightarrow> \n  pre_merge T \\<gamma> z (sh (the (\\<gamma> 0)) z)\"\n\ninductive_cases pre_merge_inv [elim!]: \"pre_merge P \\<gamma> z z'\"\n\ntext \\<open>The @{term \"merge\"} map maps each nat to the word that \n   satisfies the above constaints. The \\<open>merge_is_unique\\<close>\n   lemma shows that there exists exactly one such word \n   per nat, provided there are no group races.\\<close>\ndefinition merge :: \"lid set \\<Rightarrow> (lid \\<rightharpoonup> thread_state) \\<Rightarrow> nat \\<Rightarrow> word\"\nwhere \"merge T \\<gamma> \\<equiv> \\<lambda>z. The (pre_merge T \\<gamma> z)\"\n\nlemma no_races_imp_no_write_overlap: \n  \"\\<not> (group_race T \\<gamma>) \\<Longrightarrow> \n  \\<forall>i \\<in> T. \\<forall>j \\<in> T. \n  i \\<noteq> j \\<longrightarrow> W (the (\\<gamma> i)) \\<inter> W (the (\\<gamma> j)) = {}\"\nunfolding group_race_def \nby blast\n\nlemma merge_is_unique:\n  assumes \"dom \\<gamma> = T\"\n  assumes \"\\<not> (group_race T \\<gamma>)\"\n  shows \"\\<exists>!z'. pre_merge T \\<gamma> z z'\"\napply (insert assms)\napply (drule no_races_imp_no_write_overlap)\napply (intro allI ex_ex1I)\napply (metis pre_merge.intros)\napply clarify\nproof -\n  fix z1 z2\n  assume a: \"\\<forall>i\\<in>dom \\<gamma>. \\<forall>j\\<in>dom \\<gamma>. i \\<noteq> j \\<longrightarrow> W (the (\\<gamma> i)) \\<inter> W (the (\\<gamma> j)) = {}\"\n  assume \"pre_merge (dom \\<gamma>) \\<gamma> z z1\" \n  and \"pre_merge (dom \\<gamma>) \\<gamma> z z2\"\n  thus \"z1 = z2\"\n  apply (elim pre_merge_inv)\n  apply (rename_tac j1 j2)\n  apply (case_tac \"j1 = j2\")\n  apply auto[1]\n  apply simp\n  apply (subgoal_tac \"W (the (\\<gamma> j1)) \\<inter> W (the (\\<gamma> j2)) = {}\")\n  apply auto[1]\n  apply (auto simp add: a)\n  done\nqed\n \ntext \\<open>The rules of Figure 5, plus an additional rule for\n  equality abstraction (Fig 7a), plus an additional rule for\n  adversarial abstraction (Fig 7b)\\<close>\ninductive step_g\n  :: \"abs_level \\<Rightarrow> gid \\<Rightarrow> (gid \\<rightharpoonup> lid set) \\<Rightarrow> (group_state \\<times> pred_stmt) \\<Rightarrow> group_state option \\<Rightarrow> bool\"\nwhere\n  G_Race:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). step_t a (the (\\<gamma> \\<^sub>t\\<^sub>s j), (s, p)) (the (\\<gamma>' \\<^sub>t\\<^sub>s j)) ; \n    group_race (the (T i)) ((\\<gamma>' :: group_state)\\<^sub>t\\<^sub>s) \\<rbrakk>\n  \\<Longrightarrow> step_g a i T (\\<gamma>, (Basic s, p)) None\"\n| G_Basic:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). step_t a (the (\\<gamma> \\<^sub>t\\<^sub>s j), (s, p)) (the (\\<gamma>' \\<^sub>t\\<^sub>s j)) ; \n    \\<not> (group_race (the (T i)) (\\<gamma>' \\<^sub>t\\<^sub>s)) ;\n    R_group \\<gamma>' = R_group \\<gamma> \\<union> (\\<Union>j \\<in> the (T i). ({j} \\<times> R (the (\\<gamma>' \\<^sub>t\\<^sub>s j)))) ;\n    W_group \\<gamma>' = W_group \\<gamma> \\<union> (\\<Union>j \\<in> the (T i). ({j} \\<times> W (the (\\<gamma>' \\<^sub>t\\<^sub>s j)))) \\<rbrakk>\n  \\<Longrightarrow> step_g a i T (\\<gamma>, (Basic s, p)) (Some \\<gamma>')\"\n| G_No_Op:\n  \"\\<forall>j \\<in> the (T i). \\<not> (eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j)))\n  \\<Longrightarrow> step_g a i T (\\<gamma>, (Barrier, p)) (Some \\<gamma>)\"\n| G_Divergence:\n  \"\\<lbrakk> j \\<noteq> k ; j \\<in> the (T i) ; k \\<in> the (T i) ;\n   eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j)) ; \\<not> (eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s k))) \\<rbrakk>\n  \\<Longrightarrow> step_g a i T (\\<gamma>, (Barrier, p)) None\"\n| G_Sync:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j)) ;\n    \\<forall>j \\<in> the (T i). the (\\<gamma>' \\<^sub>t\\<^sub>s j) = (the (\\<gamma> \\<^sub>t\\<^sub>s j)) (| \n    sh := merge P (\\<gamma> \\<^sub>t\\<^sub>s), R := {}, W := {} |) \\<rbrakk> \n  \\<Longrightarrow> step_g No_Abst i T (\\<gamma>, (Barrier, p)) (Some \\<gamma>')\"\n| G_Sync_Eq:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j)) ;\n    \\<forall>j \\<in> the (T i). the (\\<gamma>' \\<^sub>t\\<^sub>s j) = (the (\\<gamma> \\<^sub>t\\<^sub>s j)) (| \n    sh := sh', R := {}, W := {} |) \\<rbrakk> \n  \\<Longrightarrow> step_g Eq_Abst i T (\\<gamma>, (Barrier, p)) (Some \\<gamma>')\"\n| G_Sync_Adv:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j)) ;\n    \\<forall>j \\<in> the (T i). \\<exists>sh'. the (\\<gamma>' \\<^sub>t\\<^sub>s j) = (the (\\<gamma> \\<^sub>t\\<^sub>s j)) (| \n    sh := sh', R := {}, W := {} |) \\<rbrakk> \n  \\<Longrightarrow> step_g Adv_Abst i T (\\<gamma>, (Barrier, p)) (Some \\<gamma>')\"\n\ntext \\<open>Rephrasing \\<open>G_No_Op\\<close> to make it more usable\\<close>\nlemma G_No_Op_helper:\n  \"\\<lbrakk> \\<forall>j \\<in> the (T i). \\<not> (eval_bool p (the (\\<gamma> \\<^sub>t\\<^sub>s j))) ; \\<gamma> = \\<gamma>' \\<rbrakk>\n  \\<Longrightarrow> step_g a i T (\\<gamma>, (Barrier, p)) (Some \\<gamma>')\"\nby (simp add: step_g.G_No_Op)\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/GPU_Kernel_PL/KPL_execution_group.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6688802603710086, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.303177902916776}}
{"text": "theory flash32Rev imports flashPub\nbegin\nsection{*Main defintions*}\nlemma NI_FAckVsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_FAck ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_InvVsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Inv  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_InvAck_1VsInv32:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_InvAck_1  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_InvAck_1_HomeVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_InvAck_1_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_InvAck_2VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_InvAck_2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_GetXVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak1VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak2VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_Nak3VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX1VsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX2VsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX2 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX3VsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX3 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX4VsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX4 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX5VsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX5 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX6VsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX6 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX7VsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX7 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8VsInv32:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX8 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX8_homeVsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX8_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_GetX_PutX9VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX9 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX10VsInv32:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX10 N  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Local_GetX_PutX10_homeVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX10_home N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_GetX_PutX11VsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_GetX_PutX11 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_Get_GetVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_Get_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak1VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak2VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_Get_Nak2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Nak3VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_Get_Nak3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put1VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_Get_Put1 N  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put2VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_Get_Put2  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Local_Get_Put3VsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_Get_Put3  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_PutVsInv32:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n     have allCases:\"formEval  ( eqn ( IVar ( Para ''InvMarked'' Home) )  ( Const true ))  s  \\<or>formEval   (neg ( eqn ( IVar ( Para ''InvMarked'' Home) )  ( Const true )) )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume b1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) )  ( Const true ))  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n\n    moreover\n                       {assume b1:\"formEval  (neg ( eqn ( IVar ( Para ''InvMarked'' Home) )  ( Const true )) )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Local_PutXAcksDoneVsInv32:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Local_PutXAcksDone ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Para ''UniMsg_Cmd'' Home) )  ( Const UNI_PutX ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma NI_NakVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Nak  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Nak_ClearVsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Nak_Clear ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Nak_HomeVsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Nak_Home ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_Remote_GetX_NakVsInv32:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Remote_GetX_Nak  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Remote_GetX_Nak_HomeVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Remote_GetX_Nak_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Remote_GetX_PutXVsInv32:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Remote_GetX_PutX  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_GetX_PutX_HomeVsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Remote_GetX_PutX_Home  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Nak1VsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Remote_Get_Nak1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_Remote_Get_Nak2VsInv32:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Remote_Get_Nak2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have \"?P2 s\" \n\n     by(cut_tac a1 a2 a3 a4, auto) \n   then show \"?P1 s\\<or>?P2 s\\<or>?P3 s\"\n      by auto \n qed\n  lemma NI_Remote_Get_Put1VsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Remote_Get_Put1  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_Get_Put2VsInv32:  \n    (*Rule2VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iRule2 \\<le> N\" and  a3:\"iInv1 \\<le> N\" and  a4:\"iRule1~=iRule2  \" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Remote_Get_Put2  iRule1  iRule2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))   \\<or>((iRule1~=iInv1 )\\<and>iRule2=iInv1)   \\<or>((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  a3  a4  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>iRule2=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  a3  a4  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 )\\<and>(iRule2~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  a3  a4  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutVsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Remote_Put  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                     have allCases:\"formEval  ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true ))  s  \\<or>formEval   (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true )) )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume c1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true ))  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n\n    moreover\n                       {assume c1:\"formEval  (neg ( eqn ( IVar ( Para ''InvMarked'' iInv1) )  ( Const true )) )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1  c1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately have \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_Remote_PutXVsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1  a2  b1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''UniMsg_Cmd'' iInv1) )  ( Const UNI_PutX ))    ( eqn ( IVar ( Para ''CacheState'' Home) )  ( Const CACHE_E ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma NI_ReplaceVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_ReplaceHomeVsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_ReplaceHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_ReplaceHomeShrVldVsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_ReplaceHomeShrVld ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_ReplaceShrVldVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_ReplaceShrVld  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma NI_ShWbVsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_ShWb N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma NI_WbVsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (NI_Wb ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_GetX1VsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Local_GetX_GetX1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_GetX2VsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Local_GetX_GetX2 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_GetX_PutX1VsInv32:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Local_GetX_PutX1 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma PI_Local_GetX_PutX2VsInv32:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Local_GetX_PutX2 N ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Para ''CacheState'' Home) )  ( Const CACHE_S ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma PI_Local_GetX_PutX3VsInv32:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Local_GetX_PutX3 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Global ''Dir_Dirty'') )  ( Const false ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma PI_Local_GetX_PutX4VsInv32:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Local_GetX_PutX4 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P3 s\"\n\n         \n        apply(   cut_tac  a1 , simp)\n\n        apply(rule_tac x=\" (neg ( andForm ( eqn ( IVar ( Para ''CacheState'' iInv1) )  ( Const CACHE_E ))    ( eqn ( IVar ( Para ''CacheState'' Home) )  ( Const CACHE_S ))  ) ) \" in exI,auto)\n \n        \n        done\n\n       \n       then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\n qed\nlemma PI_Local_Get_GetVsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Local_Get_Get ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n lemma PI_Local_Get_PutVsInv32:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Local_Get_Put ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n     have allCases:\"formEval  ( eqn ( IVar ( Para ''InvMarked'' Home) )  ( Const true ))  s  \\<or>formEval   (neg ( eqn ( IVar ( Para ''InvMarked'' Home) )  ( Const true )) )  s  \"  \n\t                      by auto \n\n    moreover\n                       {assume b1:\"formEval ( eqn ( IVar ( Para ''InvMarked'' Home) )  ( Const true ))  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n\n    moreover\n                       {assume b1:\"formEval  (neg ( eqn ( IVar ( Para ''InvMarked'' Home) )  ( Const true )) )  s\"\n\n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n    }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Local_PutXVsInv32:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Local_PutX ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma PI_Local_ReplaceVsInv32:  \n  (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Local_Replace ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n\n  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1 , auto)\n\n         \n        done\n\n        then  show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\n qed\nlemma PI_Remote_GetVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Remote_Get  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma PI_Remote_GetXVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Remote_GetX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma PI_Remote_PutXVsInv32:  \n  (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Remote_PutX  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n  proof - \n \n\n     have allCases:\"(iRule1=iInv1)   \\<or>((iRule1~=iInv1 ))   \"  \n\t                      by( cut_tac  a1  a2  , auto) \nmoreover\n                {assume b1:\"(iRule1=iInv1)\"\n\n                  \n      have \"?P1 s\"\n         \n        apply(cut_tac  a1  a2  b1 , auto)\n\n         \n        done\n\n        then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n       by blast\n\n  \n\n\t                }\nmoreover\n                {assume b1:\"((iRule1~=iInv1 ))\"\n\n                  have \"?P2 s\"\n\n   \n  apply(cut_tac  a1  a2  b1 , auto intro!:forallVars1 simp  add :invHoldForRule2'_def varsOfVar_def)\n       \n  done\n\n  then  have \"?P1 s\\<or> ?P2 s \\<or> ?P3 s\"\n\n        by blast\n\n  \n\n\t                }\n   ultimately show \"?P1 s\\<or> ?P2 s\\<or> ?P3 s\"\n\n\t                         by metis\n\n                     \n\n\n qed\nlemma PI_Remote_ReplaceVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (PI_Remote_Replace  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma StoreVsInv32:  \n    (*Rule1VsPInv1*)\n  assumes   a1:\"iRule1 \\<le> N\" and  a2:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (Store  iRule1 ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by  (cut_tac  a1  a2 , auto)\n lemma StoreHomeVsInv32:  \n    (*Rule0VsPInv1*)\n  assumes   a1:\"iInv1 \\<le> N\" \n\n  shows  \"invHoldForRule' s (inv32  iInv1 ) (StoreHome ) (invariants   N)\" (is \" ?P1 s\\<or>?P2 s\\<or>?P3 s\")  \n\n    by (cut_tac  a1 , auto)\n end\n", "meta": {"author": "lyj238Gmail", "repo": "IsabelleCourse", "sha": "cd49d944d3504328ad8210fbd987abebdf192ed8", "save_path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse", "path": "github-repos/isabelle/lyj238Gmail-IsabelleCourse/IsabelleCourse-cd49d944d3504328ad8210fbd987abebdf192ed8/flash/flash32Rev.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6688802603710085, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.30317790291677593}}
{"text": "(*  Title:      HOL/Auth/Guard/GuardK.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2002  University of Cambridge\n\nVery similar to Guard except:\n- Guard is replaced by GuardK, guard by guardK, Nonce by Key\n- some scripts are slightly modified (+ keyset_in, kparts_parts)\n- the hypothesis Key n ~:G (keyset G) is added\n*)\n\nsection\\<open>protocol-independent confidentiality theorem on keys\\<close>\n\ntheory GuardK\nimports Analz Extensions\nbegin\n\n(******************************************************************************\nmessages where all the occurrences of Key n are\nin a sub-message of the form Crypt (invKey K) X with K:Ks\n******************************************************************************)\n\ninductive_set\n  guardK :: \"nat => key set => msg set\"\n  for n :: nat and Ks :: \"key set\"\nwhere\n  No_Key [intro]: \"Key n \\<notin> parts {X} \\<Longrightarrow> X \\<in> guardK n Ks\"\n| Guard_Key [intro]: \"invKey K \\<in> Ks ==> Crypt K X \\<in> guardK n Ks\"\n| Crypt [intro]: \"X \\<in> guardK n Ks \\<Longrightarrow> Crypt K X \\<in> guardK n Ks\"\n| Pair [intro]: \"[| X \\<in> guardK n Ks; Y \\<in> guardK n Ks |] ==> \\<lbrace>X,Y\\<rbrace> \\<in> guardK n Ks\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>guardK\\<close>\\<close>\n\nlemma Nonce_is_guardK [iff]: \"Nonce p \\<in> guardK n Ks\"\nby auto\n\nlemma Agent_is_guardK [iff]: \"Agent A \\<in> guardK n Ks\"\nby auto\n\nlemma Number_is_guardK [iff]: \"Number r \\<in> guardK n Ks\"\nby auto\n\nlemma Key_notin_guardK: \"X \\<in> guardK n Ks \\<Longrightarrow> X \\<noteq> Key n\"\nby (erule guardK.induct, auto)\n\nlemma Key_notin_guardK_iff [iff]: \"Key n \\<notin> guardK n Ks\"\nby (auto dest: Key_notin_guardK)\n\nlemma guardK_has_Crypt [rule_format]: \"X \\<in> guardK n Ks \\<Longrightarrow> Key n \\<in> parts {X}\n\\<longrightarrow> (\\<exists>K Y. Crypt K Y \\<in> kparts {X} \\<and> Key n \\<in> parts {Y})\"\nby (erule guardK.induct, auto)\n\nlemma Key_notin_kparts_msg: \"X \\<in> guardK n Ks \\<Longrightarrow> Key n \\<notin> kparts {X}\"\nby (erule guardK.induct, auto dest: kparts_parts)\n\nlemma Key_in_kparts_imp_no_guardK: \"Key n \\<in> kparts H\n\\<Longrightarrow> \\<exists>X. X \\<in> H \\<and> X \\<notin> guardK n Ks\"\napply (drule in_kparts, clarify)\napply (rule_tac x=X in exI, clarify)\nby (auto dest: Key_notin_kparts_msg)\n\nlemma guardK_kparts [rule_format]: \"X \\<in> guardK n Ks \\<Longrightarrow>\nY \\<in> kparts {X} \\<longrightarrow> Y \\<in> guardK n Ks\"\nby (erule guardK.induct, auto dest: kparts_parts parts_sub)\n\nlemma guardK_Crypt: \"[| Crypt K Y \\<in> guardK n Ks; K \\<notin> invKey`Ks |] ==> Y \\<in> guardK n Ks\"\n  by (ind_cases \"Crypt K Y \\<in> guardK n Ks\") (auto intro!: image_eqI)\n\nlemma guardK_MPair [iff]: \"(\\<lbrace>X,Y\\<rbrace> \\<in> guardK n Ks)\n= (X \\<in> guardK n Ks \\<and> Y \\<in> guardK n Ks)\"\nby (auto, (ind_cases \"\\<lbrace>X,Y\\<rbrace> \\<in> guardK n Ks\", auto)+)\n\nlemma guardK_not_guardK [rule_format]: \"X \\<in>guardK n Ks \\<Longrightarrow>\nCrypt K Y \\<in> kparts {X} \\<longrightarrow> Key n \\<in> kparts {Y} \\<longrightarrow> Y \\<notin> guardK n Ks\"\nby (erule guardK.induct, auto dest: guardK_kparts)\n\nlemma guardK_extand: \"[| X \\<in> guardK n Ks; Ks \\<subseteq> Ks';\n[| K \\<in> Ks'; K \\<notin> Ks |] ==> Key K \\<notin> parts {X} |] ==> X \\<in> guardK n Ks'\"\nby (erule guardK.induct, auto)\n\nsubsection\\<open>guarded sets\\<close>\n\ndefinition GuardK :: \"nat \\<Rightarrow> key set \\<Rightarrow> msg set \\<Rightarrow> bool\" where\n\"GuardK n Ks H \\<equiv> \\<forall>X. X \\<in> H \\<longrightarrow> X \\<in> guardK n Ks\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>GuardK\\<close>\\<close>\n\nlemma GuardK_empty [iff]: \"GuardK n Ks {}\"\nby (simp add: GuardK_def)\n\nlemma Key_notin_kparts [simplified]: \"GuardK n Ks H \\<Longrightarrow> Key n \\<notin> kparts H\"\nby (auto simp: GuardK_def dest: in_kparts Key_notin_kparts_msg)\n\nlemma GuardK_must_decrypt: \"[| GuardK n Ks H; Key n \\<in> analz H |] ==>\n\\<exists>K Y. Crypt K Y \\<in> kparts H \\<and> Key (invKey K) \\<in> kparts H\"\napply (drule_tac P=\"\\<lambda>G. Key n \\<in> G\" in analz_pparts_kparts_substD, simp)\nby (drule must_decrypt, auto dest: Key_notin_kparts)\n\nlemma GuardK_kparts [intro]: \"GuardK n Ks H \\<Longrightarrow> GuardK n Ks (kparts H)\"\nby (auto simp: GuardK_def dest: in_kparts guardK_kparts)\n\nlemma GuardK_mono: \"[| GuardK n Ks H; G \\<subseteq> H |] ==> GuardK n Ks G\"\nby (auto simp: GuardK_def)\n\nlemma GuardK_insert [iff]: \"GuardK n Ks (insert X H)\n= (GuardK n Ks H \\<and> X \\<in> guardK n Ks)\"\nby (auto simp: GuardK_def)\n\nlemma GuardK_Un [iff]: \"GuardK n Ks (G Un H) = (GuardK n Ks G & GuardK n Ks H)\"\nby (auto simp: GuardK_def)\n\nlemma GuardK_synth [intro]: \"GuardK n Ks G \\<Longrightarrow> GuardK n Ks (synth G)\"\nby (auto simp: GuardK_def, erule synth.induct, auto)\n\nlemma GuardK_analz [intro]: \"[| GuardK n Ks G; \\<forall>K. K \\<in> Ks \\<longrightarrow> Key K \\<notin> analz G |]\n==> GuardK n Ks (analz G)\"\napply (auto simp: GuardK_def)\napply (erule analz.induct, auto)\nby (ind_cases \"Crypt K Xa \\<in> guardK n Ks\" for K Xa, auto)\n\nlemma in_GuardK [dest]: \"[| X \\<in> G; GuardK n Ks G |] ==> X \\<in> guardK n Ks\"\nby (auto simp: GuardK_def)\n\nlemma in_synth_GuardK: \"[| X \\<in> synth G; GuardK n Ks G |] ==> X \\<in> guardK n Ks\"\nby (drule GuardK_synth, auto)\n\nlemma in_analz_GuardK: \"[| X \\<in> analz G; GuardK n Ks G;\n\\<forall>K. K \\<in> Ks \\<longrightarrow> Key K \\<notin> analz G |] ==> X \\<in> guardK n Ks\"\nby (drule GuardK_analz, auto)\n\nlemma GuardK_keyset [simp]: \"[| keyset G; Key n \\<notin> G |] ==> GuardK n Ks G\"\nby (simp only: GuardK_def, clarify, drule keyset_in, auto)\n\nlemma GuardK_Un_keyset: \"[| GuardK n Ks G; keyset H; Key n \\<notin> H |]\n==> GuardK n Ks (G Un H)\"\nby auto\n\nlemma in_GuardK_kparts: \"[| X \\<in> G; GuardK n Ks G; Y \\<in> kparts {X} |] ==> Y \\<in> guardK n Ks\"\nby blast\n\nlemma in_GuardK_kparts_neq: \"[| X \\<in> G; GuardK n Ks G; Key n' \\<in> kparts {X} |]\n==> n \\<noteq> n'\"\nby (blast dest: in_GuardK_kparts)\n\nlemma in_GuardK_kparts_Crypt: \"[| X \\<in> G; GuardK n Ks G; is_MPair X;\nCrypt K Y \\<in> kparts {X}; Key n \\<in> kparts {Y} |] ==> invKey K \\<in> Ks\"\napply (drule in_GuardK, simp)\napply (frule guardK_not_guardK, simp+)\napply (drule guardK_kparts, simp)\nby (ind_cases \"Crypt K Y \\<in> guardK n Ks\", auto)\n\nlemma GuardK_extand: \"[| GuardK n Ks G; Ks \\<subseteq> Ks';\n[| K \\<in> Ks'; K \\<notin> Ks |] ==> Key K \\<notin> parts G |] ==> GuardK n Ks' G\"\nby (auto simp: GuardK_def dest: guardK_extand parts_sub)\n\nsubsection\\<open>set obtained by decrypting a message\\<close>\n\nabbreviation (input)\n  decrypt :: \"msg set \\<Rightarrow> key \\<Rightarrow> msg \\<Rightarrow> msg set\" where\n  \"decrypt H K Y \\<equiv> insert Y (H - {Crypt K Y})\"\n\nlemma analz_decrypt: \"[| Crypt K Y \\<in> H; Key (invKey K) \\<in> H; Key n \\<in> analz H |]\n==> Key n \\<in> analz (decrypt H K Y)\"\napply (drule_tac P=\"\\<lambda>H. Key n \\<in> analz H\" in ssubst [OF insert_Diff])\napply assumption \napply (simp only: analz_Crypt_if, simp)\ndone\n\nlemma parts_decrypt: \"[| Crypt K Y \\<in> H; X \\<in> parts (decrypt H K Y) |] ==> X \\<in> parts H\"\nby (erule parts.induct, auto intro: parts.Fst parts.Snd parts.Body)\n\nsubsection\\<open>number of Crypt's in a message\\<close>\n\nfun crypt_nb :: \"msg => nat\" where\n\"crypt_nb (Crypt K X) = Suc (crypt_nb X)\" |\n\"crypt_nb \\<lbrace>X,Y\\<rbrace> = crypt_nb X + crypt_nb Y\" |\n\"crypt_nb X = 0\" (* otherwise *)\n\nsubsection\\<open>basic facts about \\<^term>\\<open>crypt_nb\\<close>\\<close>\n\nlemma non_empty_crypt_msg: \"Crypt K Y \\<in> parts {X} \\<Longrightarrow> crypt_nb X \\<noteq> 0\"\nby (induct X, simp_all, safe, simp_all)\n\nsubsection\\<open>number of Crypt's in a message list\\<close>\n\nprimrec cnb :: \"msg list => nat\" where\n\"cnb [] = 0\" |\n\"cnb (X#l) = crypt_nb X + cnb l\"\n\nsubsection\\<open>basic facts about \\<^term>\\<open>cnb\\<close>\\<close>\n\nlemma cnb_app [simp]: \"cnb (l @ l') = cnb l + cnb l'\"\nby (induct l, auto)\n\nlemma mem_cnb_minus: \"x \\<in> set l ==> cnb l = crypt_nb x + (cnb l - crypt_nb x)\"\nby (induct l, auto)\n\nlemmas mem_cnb_minus_substI = mem_cnb_minus [THEN ssubst]\n\nlemma cnb_minus [simp]: \"x \\<in> set l ==> cnb (remove l x) = cnb l - crypt_nb x\"\napply (induct l, auto)\nby (erule_tac l=l and x=x in mem_cnb_minus_substI, simp)\n\nlemma parts_cnb: \"Z \\<in> parts (set l) \\<Longrightarrow>\ncnb l = (cnb l - crypt_nb Z) + crypt_nb Z\"\nby (erule parts.induct, auto simp: in_set_conv_decomp)\n\nlemma non_empty_crypt: \"Crypt K Y \\<in> parts (set l) \\<Longrightarrow> cnb l \\<noteq> 0\"\nby (induct l, auto dest: non_empty_crypt_msg parts_insert_substD)\n\nsubsection\\<open>list of kparts\\<close>\n\nlemma kparts_msg_set: \"\\<exists>l. kparts {X} = set l \\<and> cnb l = crypt_nb X\"\napply (induct X, simp_all)\napply (rename_tac agent, rule_tac x=\"[Agent agent]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Number nat]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Nonce nat]\" in exI, simp)\napply (rename_tac nat, rule_tac x=\"[Key nat]\" in exI, simp)\napply (rule_tac x=\"[Hash X]\" in exI, simp)\napply (clarify, rule_tac x=\"l@la\" in exI, simp)\nby (clarify, rename_tac nat X y, rule_tac x=\"[Crypt nat X]\" in exI, simp)\n\nlemma kparts_set: \"\\<exists>l'. kparts (set l) = set l' & cnb l' = cnb l\"\napply (induct l)\napply (rule_tac x=\"[]\" in exI, simp, clarsimp)\napply (rename_tac a b l')\napply (subgoal_tac \"\\<exists>l''.  kparts {a} = set l'' & cnb l'' = crypt_nb a\", clarify)\napply (rule_tac x=\"l''@l'\" in exI, simp)\napply (rule kparts_insert_substI, simp)\nby (rule kparts_msg_set)\n\nsubsection\\<open>list corresponding to \"decrypt\"\\<close>\n\ndefinition decrypt' :: \"msg list => key => msg => msg list\" where\n\"decrypt' l K Y == Y # remove l (Crypt K Y)\"\n\ndeclare decrypt'_def [simp]\n\nsubsection\\<open>basic facts about \\<^term>\\<open>decrypt'\\<close>\\<close>\n\nlemma decrypt_minus: \"decrypt (set l) K Y <= set (decrypt' l K Y)\"\nby (induct l, auto)\n\ntext\\<open>if the analysis of a finite guarded set gives n then it must also give\none of the keys of Ks\\<close>\n\nlemma GuardK_invKey_by_list [rule_format]: \"\\<forall>l. cnb l = p\n\\<longrightarrow> GuardK n Ks (set l) \\<longrightarrow> Key n \\<in> analz (set l)\n\\<longrightarrow> (\\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz (set l))\"\napply (induct p)\n(* case p=0 *)\napply (clarify, drule GuardK_must_decrypt, simp, clarify)\napply (drule kparts_parts, drule non_empty_crypt, simp)\n(* case p>0 *)\napply (clarify, frule GuardK_must_decrypt, simp, clarify)\napply (drule_tac P=\"\\<lambda>G. Key n \\<in> G\" in analz_pparts_kparts_substD, simp)\napply (frule analz_decrypt, simp_all)\napply (subgoal_tac \"\\<exists>l'. kparts (set l) = set l' \\<and> cnb l' = cnb l\", clarsimp)\napply (drule_tac G=\"insert Y (set l' - {Crypt K Y})\"\nand H=\"set (decrypt' l' K Y)\" in analz_sub, rule decrypt_minus)\napply (rule_tac analz_pparts_kparts_substI, simp)\napply (case_tac \"K \\<in> invKey`Ks\")\n(* K:invKey`Ks *)\napply (clarsimp, blast)\n(* K ~:invKey`Ks *)\napply (subgoal_tac \"GuardK n Ks (set (decrypt' l' K Y))\")\napply (drule_tac x=\"decrypt' l' K Y\" in spec, simp)\napply (subgoal_tac \"Crypt K Y \\<in> parts (set l)\")\napply (drule parts_cnb, rotate_tac -1, simp)\napply (clarify, drule_tac X=\"Key Ka\" and H=\"insert Y (set l')\" in analz_sub)\napply (rule insert_mono, rule set_remove)\napply (simp add: analz_insertD, blast)\n(* Crypt K Y:parts (set l) *)\napply (blast dest: kparts_parts)\n(* GuardK n Ks (set (decrypt' l' K Y)) *)\napply (rule_tac H=\"insert Y (set l')\" in GuardK_mono)\napply (subgoal_tac \"GuardK n Ks (set l')\", simp)\napply (rule_tac K=K in guardK_Crypt, simp add: GuardK_def, simp)\napply (drule_tac t=\"set l'\" in sym, simp)\napply (rule GuardK_kparts, simp, simp)\napply (rule_tac B=\"set l'\" in subset_trans, rule set_remove, blast)\nby (rule kparts_set)\n\nlemma GuardK_invKey_finite: \"[| Key n \\<in> analz G; GuardK n Ks G; finite G |]\n==> \\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz G\"\napply (drule finite_list, clarify)\nby (rule GuardK_invKey_by_list, auto)\n\nlemma GuardK_invKey: \"[| Key n \\<in> analz G; GuardK n Ks G |]\n==> \\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz G\"\nby (auto dest: analz_needs_only_finite GuardK_invKey_finite)\n\ntext\\<open>if the analyse of a finite guarded set and a (possibly infinite) set of\nkeys gives n then it must also gives Ks\\<close>\n\nlemma GuardK_invKey_keyset: \"[| Key n \\<in> analz (G \\<union> H); GuardK n Ks G; finite G;\nkeyset H; Key n \\<notin> H |] ==> \\<exists>K. K \\<in> Ks \\<and> Key K \\<in> analz (G \\<union> H)\"\napply (frule_tac P=\"\\<lambda>G. Key n \\<in> G\" and G=G in analz_keyset_substD, simp_all)\napply (drule_tac G=\"G Un (H Int keysfor G)\" in GuardK_invKey_finite)\napply (auto simp: GuardK_def intro: analz_sub)\nby (drule keyset_in, auto)\n\nend\n", "meta": {"author": "m-fleury", "repo": "isabelle-emacs", "sha": "756c662195e138a1941d22d4dd7ff759cbf6b6b9", "save_path": "github-repos/isabelle/m-fleury-isabelle-emacs", "path": "github-repos/isabelle/m-fleury-isabelle-emacs/isabelle-emacs-756c662195e138a1941d22d4dd7ff759cbf6b6b9/src/HOL/Auth/Guard/GuardK.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3031684709816578}}
{"text": "(*  Title: L3_Lib.thy\n    Original author: Anthony Fox, University of Cambridge\n    Contributions by: Kyndylan Nienhuis, University of Cambridge\n\nL3 operations.\n*)\n\ntheory L3_Lib\nimports \"$ISABELLE_HOME/src/HOL/Word/Word\"\n        \"$ISABELLE_HOME/src/HOL/Library/Code_Target_Numeral\"\n        \"$ISABELLE_HOME/src/HOL/Library/Code_Char\"\nbegin\n\n(* basic state Monad *)\n\ndefinition \"return = Pair\"\n\ndefinition bind :: \"('state \\<Rightarrow> ('a \\<times> 'state)) \\<Rightarrow>\n                    ('a \\<Rightarrow> 'state \\<Rightarrow> ('b \\<times> 'state)) \\<Rightarrow>\n                    ('state \\<Rightarrow> ('b \\<times> 'state))\" where\n  \"bind f g = (\\<lambda>s. let (a, s') = f s in g a s')\"\n\ndefinition read_state :: \"('state \\<Rightarrow> 'a) \\<Rightarrow> 'state \\<Rightarrow> 'a \\<times> 'state\" where\n  \"read_state f = (\\<lambda>s. (f s, s))\"\n\ndefinition update_state :: \"('state \\<Rightarrow> 'state) \\<Rightarrow> 'state \\<Rightarrow> unit \\<times> 'state\" where\n  \"update_state f = (\\<lambda>s. ((), f s))\"\n\ndefinition extend_state :: \"'b \\<Rightarrow> ('b \\<times> 'state \\<Rightarrow> 'a \\<times> 'b \\<times> 'state) \\<Rightarrow> 'state \\<Rightarrow> 'a \\<times> 'state\" where\n  \"extend_state v f = (\\<lambda>s. let (a, s') = f (v, s) in (a, snd s'))\"\n\ndefinition trim_state :: \"('state \\<Rightarrow> 'a \\<times> 'state) \\<Rightarrow> 'b \\<times> 'state \\<Rightarrow> 'a \\<times> 'b \\<times> 'state\" where\n  \"trim_state f = (\\<lambda>(s1, s2). let (a, s') = f s2 in (a, s1, s'))\"\n\nfun foreach_loop :: \"'a list \\<times> ('a \\<Rightarrow> 'state \\<Rightarrow> unit \\<times> 'state) \\<Rightarrow> 'state \\<Rightarrow> unit \\<times> 'state\" where\n  \"foreach_loop ([], _) = return ()\" |\n  \"foreach_loop (h # t, a) = bind (a h) (\\<lambda>u. foreach_loop (t, a))\"\n\nfunction for_loop :: \"nat \\<times> nat \\<times> (nat \\<Rightarrow> 'state \\<Rightarrow> unit \\<times> 'state) \\<Rightarrow> 'state \\<Rightarrow> unit \\<times> 'state\" where\n  \"for_loop (i, j, a) =\n   (if i = j then\n      a i\n    else\n      bind (a i) (\\<lambda>u. for_loop ((if i < j then i + 1 else i - 1), j, a)))\"\n  by auto\n  termination by (relation \"measure (\\<lambda>(i, j, _). if i < j then j - i else i - j)\") auto\n\n(* Because there are no constraints on i, j and a on the left-hand side of the definition, every\noccurrence of for_loop can be simplified by for_loop.simps, and since the definition is recursive\nthe simplifier might diverge. For this reason we remove for_loop.simps from the simp set. *)\n\ndeclare for_loop.simps [simp del]\n\n(* Monad laws *)\n\nlemma bind_left_identity [simp]:\n  shows \"bind (return a) f = f a\"\nunfolding return_def bind_def\nby auto\n\nlemma bind_right_identity [simp]:\n  shows \"bind m return = m\"\nunfolding return_def bind_def\nby auto\n\nlemma bind_associativity:\n  shows \"bind (bind m f) g = bind m (\\<lambda>a. bind (f a) g)\" \n        (is \"?l = ?r\")\nproof\n  fix s\n  show \"?l s = ?r s\"\n    unfolding return_def bind_def \n    by (cases \"m s\") auto\nqed\n\n(* Projections *)\n\nlemma project_return [simp]:\n  shows \"fst (return a s) = a\"\n    and \"snd (return a s) = s\"\nunfolding return_def\nby auto\n\nlemma project_read_state [simp]:\n  shows \"fst (read_state f s) = f s\"\n    and \"snd (read_state f s) = s\"\nunfolding read_state_def\nby auto\n\nlemma project_update_state [simp]:\n  shows \"fst (update_state f s) = ()\"\n    and \"snd (update_state f s) = f s\"\nunfolding update_state_def\nby auto\n\n(* Other monad simplifications *)\n\nlemma read_state_constant [simp]:\n  shows \"read_state (\\<lambda>s. a) = return a\" \nunfolding read_state_def return_def\n..\n\nlemma update_state_id [simp]:\n  shows \"update_state (\\<lambda>s. s) = return ()\" \nunfolding update_state_def return_def\n..\n\nlemma foreach_loop_return [simp]:\n  shows \"foreach_loop (l, \\<lambda>_. return a) = return ()\"\nby (induct l) simp_all\n\nlemma extend_state_return [simp]:\n  shows \"extend_state v (return a) = return a\"\nunfolding extend_state_def return_def\nby simp\n\nlemma extend_state_trim_state [simp]:\n  shows \"extend_state v (trim_state m) = m\" \n        (is \"?l = ?r\")\nproof\n  fix s\n  show \"?l s = ?r s\"\n    unfolding extend_state_def trim_state_def\n    by (cases \"m s\") auto\nqed\n\n(* extra character operations *)\n\ndefinition Ord :: \"char \\<Rightarrow> nat\" where\n   \"Ord = nat_of_char\" \n\ndefinition Chr :: \"nat \\<Rightarrow> char\" where\n   \"Chr = char_of_nat\"\n\ndefinition is_lower :: \"char \\<Rightarrow> bool\" where\n   \"is_lower c = (Ord (CHR ''a'') \\<le> Ord c \\<and> Ord c \\<le> Ord (CHR ''z''))\"\n\ndefinition is_upper :: \"char \\<Rightarrow> bool\" where\n   \"is_upper c = (Ord (CHR ''A'') \\<le> Ord c \\<and> Ord c \\<le> Ord (CHR ''Z''))\"\n\ndefinition is_space :: \"char \\<Rightarrow> bool\" where\n   \"is_space c = (Ord (CHR '' '') = Ord c \\<or> 9 \\<le> Ord c \\<and> Ord c \\<le> 13)\"\n\ndefinition is_digit :: \"char \\<Rightarrow> bool\" where\n   \"is_digit c = (Ord (CHR ''0'') \\<le> Ord c \\<and> Ord c \\<le> Ord (CHR ''9''))\"\n\ndefinition is_hex_digit :: \"char \\<Rightarrow> bool\" where\n   \"is_hex_digit c = (is_digit c \\<or> Ord (CHR ''a'') \\<le> Ord c \\<and> Ord c \\<le> Ord (CHR ''f'') \\<or>\n                                   Ord (CHR ''A'') \\<le> Ord c \\<and> Ord c \\<le> Ord (CHR ''F''))\"\n\ndefinition is_alpha :: \"char \\<Rightarrow> bool\" where\n   \"is_alpha c = (is_lower c \\<or> is_upper c)\"\n\ndefinition is_alpha_num :: \"char \\<Rightarrow> bool\" where\n   \"is_alpha_num c = (is_alpha c \\<or> is_digit c)\"\n\ndefinition to_lower :: \"char \\<Rightarrow> char\" where\n   \"to_lower c = (if is_upper c then Chr (Ord c + 32) else c)\"\n\ndefinition to_upper :: \"char \\<Rightarrow> char\" where\n   \"to_upper c = (if is_lower c then Chr (Ord c - 32) else c)\"\n\n(* numeric strings *)\n\nfun list_to_nat :: \"nat \\<Rightarrow> nat list \\<Rightarrow> nat\" where\n  \"list_to_nat _ [] = 0\" |\n  \"list_to_nat base (h # t) = h mod base + base * list_to_nat base t\"\n\nfun nat_to_list :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat list\" where\n  \"nat_to_list base n =\n   (if n < base \\<or> base < 2 then [n mod base] else n mod base # nat_to_list base (n div base))\"\n\n(* Because there are no constraints on n on the left-hand side of the definition, every occurrence\nof nat_to_list can be simplified by nat_to_list.simps, and since the definition is recursive the\nsimplifier might diverge. For this reason we remove nat_to_list.simps from the simp set. *)\n\ndeclare nat_to_list.simps [simp del]\n\ndefinition hex :: \"nat \\<Rightarrow> char\" where\n  \"hex n = (if n = 0 then CHR ''0''\n            else if n = 1 then CHR ''1''\n            else if n = 2 then CHR ''2''\n            else if n = 3 then CHR ''3''\n            else if n = 4 then CHR ''4''\n            else if n = 5 then CHR ''5''\n            else if n = 6 then CHR ''6''\n            else if n = 7 then CHR ''7''\n            else if n = 8 then CHR ''8''\n            else if n = 9 then CHR ''9''\n            else if n = 10 then CHR ''A''\n            else if n = 11 then CHR ''B''\n            else if n = 12 then CHR ''C''\n            else if n = 13 then CHR ''D''\n            else if n = 14 then CHR ''E''\n            else if n = 15 then CHR ''F''\n            else undefined)\"\n\ndefinition unhex :: \"char \\<Rightarrow> nat\" where\n  \"unhex c = (if c = CHR ''0'' then 0\n              else if c = CHR ''1'' then 1\n              else if c = CHR ''2'' then 2\n              else if c = CHR ''3'' then 3\n              else if c = CHR ''4'' then 4\n              else if c = CHR ''5'' then 5\n              else if c = CHR ''6'' then 6\n              else if c = CHR ''7'' then 7\n              else if c = CHR ''8'' then 8\n              else if c = CHR ''9'' then 9\n              else if c = CHR ''a'' \\<or> c = CHR ''A'' then 10\n              else if c = CHR ''b'' \\<or> c = CHR ''B'' then 11\n              else if c = CHR ''c'' \\<or> c = CHR ''C'' then 12\n              else if c = CHR ''d'' \\<or> c = CHR ''D'' then 13\n              else if c = CHR ''e'' \\<or> c = CHR ''E'' then 14\n              else if c = CHR ''f'' \\<or> c = CHR ''F'' then 15\n              else undefined)\"\n\ndefinition string_to_nat :: \"nat \\<Rightarrow> string \\<Rightarrow> nat\" where\n  \"string_to_nat base s = list_to_nat base (map unhex (rev s))\"\n\ndefinition nat_to_string :: \"nat \\<Rightarrow> nat \\<Rightarrow> string\" where\n  \"nat_to_string base n = rev (map hex (nat_to_list base n))\"\n\ndefinition \"bin_string_to_nat \\<equiv> string_to_nat 2\"\ndefinition \"nat_to_bin_string \\<equiv> nat_to_string 2\"\ndefinition \"dec_string_to_nat \\<equiv> string_to_nat 10\"\ndefinition \"nat_to_dec_string \\<equiv> nat_to_string 10\"\ndefinition \"hex_string_to_nat \\<equiv> string_to_nat 16\"\ndefinition \"nat_to_hex_string \\<equiv> nat_to_string 16\"\n\ndefinition nat_from_bin_string :: \"string \\<Rightarrow> nat option\" where\n  \"nat_from_bin_string s =\n   (if s \\<noteq> '''' \\<and> list_all (\\<lambda>c. c = CHR ''0'' \\<or> c = CHR ''1'') s then\n      Some (bin_string_to_nat s)\n    else None)\"\n\ndefinition nat_from_dec_string :: \"string \\<Rightarrow> nat option\" where\n  \"nat_from_dec_string s =\n   (if s \\<noteq> '''' \\<and> list_all is_digit s then Some (dec_string_to_nat s) else None)\"\n\ndefinition nat_from_hex_string :: \"string \\<Rightarrow> nat option\" where\n  \"nat_from_hex_string s =\n   (if s \\<noteq> '''' \\<and> list_all is_hex_digit s then Some (hex_string_to_nat s) else None)\"\n\ndefinition dec_string_to_int :: \"string \\<Rightarrow> int\" where\n  \"dec_string_to_int r = \n   (case r of []    \\<Rightarrow> 0 |\n              h # t \\<Rightarrow> (if h = CHR ''-'' \\<or> h = CHR ''~'' \n                        then -int (dec_string_to_nat t)\n                        else  int (dec_string_to_nat r)))\"\n\ndefinition int_to_dec_string :: \"int \\<Rightarrow> string\" where\n  \"int_to_dec_string i =\n   (if i < 0 then CHR ''~'' # nat_to_dec_string (nat (-i)) else nat_to_dec_string (nat i))\"\n\ndefinition string_to_bool :: \"string \\<Rightarrow> bool\" where\n  \"string_to_bool s = (if s = ''true'' then True\n                       else if s = ''false'' then False\n                       else undefined)\"\n\ndefinition string_to_char :: \"string \\<Rightarrow> char\" where\n  \"string_to_char s = (case s of [c] \\<Rightarrow> c | _ \\<Rightarrow> undefined)\"\n\n(* extra Nat operation *)\n\nfun log2 :: \"nat \\<Rightarrow> nat\" where\n  \"log2 n = (if n = 0 then undefined else if n = 1 then 0 else Suc (log2 (n div 2)))\"\n\n(* Because there are no constraints on n on the left-hand side of the definition, every occurrence\nof log2 can be simplified by log2.simps, and since the definition is recursive the simplifier might\ndiverge. For this reason we remove log2.simps from the simp set. *)\n\ndeclare log2.simps [simp del]\n\nlemma log2_bounds:\n  assumes \"n \\<noteq> 0\"\n  shows   \"2 ^ (log2 n) \\<le> n\"\n    and   \"n < 2 ^ (Suc (log2 n))\"\nproof -\n  -- \"The induction works better if we prove one goal instead of two goals\"\n  have \"2 ^ (log2 n) \\<le> n \\<and> n < 2 ^ (Suc (log2 n))\"\n    using assms\n    proof (induct \"log2 n\" arbitrary: n)\n      case 0\n      hence \"n = 1\" \n        by (simp add: log2.simps) (meson nat.simps(3))\n      thus ?case by (simp add: log2.simps)\n    next\n      case (Suc k)\n      show ?case\n        proof (cases \"n = 1\")\n          case True\n          thus ?thesis by (simp add: log2.simps)\n        next\n          case False\n          hence \"1 < n\" using Suc(3) by simp\n          hence \"(n div 2) \\<noteq> 0\" by auto\n          have log2: \"log2 n = Suc (log2 (n div 2))\"\n            using `1 < n` by (simp add: log2.simps)\n          hence \"k = log2 (n div 2)\" using Suc(2) by simp\n          note Suc(1)[OF this `(n div 2) \\<noteq> 0`]\n          thus ?thesis\n            using log2 by auto\n        qed\n    qed\n  thus \"2 ^ (log2 n) \\<le> n\" \"n < 2 ^ (Suc (log2 n))\" by auto\nqed\n\nlemma log2_unat_bounds:\n  fixes x :: \"('a :: len) word\"\n  assumes \"x \\<noteq> 0\"\n  shows \"log2 (unat x) < len_of TYPE('a)\"\nproof -\n  have \"unat x \\<noteq> 0\" \n    using assms \n    by (simp add: unat_eq_zero)\n  have \"unat x < 2 ^ len_of TYPE('a)\"\n    by simp\n  note le_less_trans[OF log2_bounds(1)[OF `unat x \\<noteq> 0`] this]\n  thus ?thesis by auto\nqed\n\n(* extra int operations *)\n\ndefinition quot :: \"int \\<Rightarrow> int \\<Rightarrow> int\" (infixl \"quot\" 70) where\n  \"i quot j = (if j = 0 then undefined\n               else if 0 < j then if 0 \\<le> i then i div j else -(-i div j)\n               else if 0 \\<le> i then -(i div -j)\n               else -i div -j)\"\n\ndefinition rem :: \"int \\<Rightarrow> int \\<Rightarrow> int\" (infixl \"rem\" 70) where\n  \"i rem j = (if j = 0 then undefined else i - i quot j * j)\"\n\ndefinition quot_rem :: \"int * int \\<Rightarrow> int * int\" where\n  \"quot_rem p = (case p of (i, j) \\<Rightarrow> (i div j, i rem j))\"\n\n(* extra option operations *)\n\ndefinition is_some :: \"'a option \\<Rightarrow> bool\" where\n  \"is_some x = (case x of Some _ \\<Rightarrow> True | _ \\<Rightarrow> False)\"\n\nlemma is_some_alt:\n  shows \"is_some x = (x \\<noteq> None)\"\nunfolding is_some_def \nusing option.disc_eq_case(2) \nby auto\n\nlemma is_some_simps [simp]:\n  shows \"\\<not> (is_some None)\"\n    and \"is_some (Some x)\"\nunfolding is_some_def by simp_all\n\n(* extra list operations *)\n\nfun splitl :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> 'a list \\<times> 'a list\" where\n  \"splitl _ [] = ([], [])\" |\n  \"splitl P (h # t) = (if P h then let (l, r) = splitl P t in (h # l, r) else ([], h # t))\"\n\ndefinition splitr :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a list \\<Rightarrow> 'a list \\<times> 'a list\" where\n  \"splitr P x = (let (l, r) = splitl P (rev x) in (rev r, rev l))\"\n\ndefinition pad_left :: \"'a \\<Rightarrow> nat \\<Rightarrow> 'a list \\<Rightarrow> 'a list\" where\n  \"pad_left c n s = replicate (n - length s) c @ s\"\n\ndefinition pad_right :: \"'a \\<Rightarrow> nat \\<Rightarrow> 'a list \\<Rightarrow> 'a list\" where\n  \"pad_right c n s = s @ replicate (n - length s) c\"\n\nfun index_find :: \"nat \\<Rightarrow> 'a \\<times> 'a list \\<Rightarrow> nat option\" where\n  \"index_find _ (_, []) = None\" |\n  \"index_find i (v, h # t) = (if v = h then Some i else index_find (Suc i) (v, t))\"\n\ndefinition \"index_of = index_find 0\"\n\ndefinition remove :: \"'a list * 'a list \\<Rightarrow> 'a list\" where\n  \"remove p = (case p of (l1, l2) \\<Rightarrow> filter (\\<lambda>x. x \\<notin> set l1) l2)\"\n\ndefinition remove_except :: \"'a list * 'a list \\<Rightarrow> 'a list\" where\n  \"remove_except p = (case p of (l1, l2) \\<Rightarrow> filter (\\<lambda>x. x \\<in> set l1) l2)\"\n\nfun remove_duplicates :: \"'a list \\<Rightarrow> 'a list\" where\n  \"remove_duplicates [] = []\" |\n  \"remove_duplicates (h # t) = (if h \\<in> set t then remove_duplicates t else h # remove_duplicates t)\"\n\nlemma splitl_length:\n  shows \"length (fst (splitl P l)) + length (snd (splitl P l)) = length l\"\nby (induct l, auto simp add: case_prod_beta)\n\nlemma splitl_fst_length [simp]:\n  shows \"length (fst (splitl P x)) \\<le> length x\"\nusing splitl_length \nby (metis order_refl trans_le_add1)\n\nlemma splitl_snd_length [simp]:\n  shows \"length (snd (splitl P x)) \\<le> length x\"\nusing splitl_length \nby (metis order_refl trans_le_add2)\n\nlemma pad_left_length [simp]:\n  shows \"length (pad_left e n l) = max (length l) n\"\nunfolding pad_left_def\nby auto \n\nlemma pad_right_length [simp]:\n  shows \"length (pad_right e n l) = max (length l) n\"\nunfolding pad_right_def\nby auto\n\nlemma pad_left_nth:\n  shows \"pad_left e n l ! m = \n         (if m < n - List.length l \n          then e \n          else l ! (m - (n - List.length l)))\"\nunfolding pad_left_def nth_append\nby simp\n\n(* extra string operations *)\n\nlemma fields_termination_lem [simp]:\n  assumes \"a \\<noteq> []\" and \"length a \\<le> length c\"\n  shows \"length a - b < Suc (length c)\"\n  by (simp add: assms(2) le_imp_less_Suc less_imp_diff_less)\n\nfunction (sequential) tokens :: \"(char \\<Rightarrow> bool) \\<Rightarrow> string \\<Rightarrow> string list\" where\n  \"tokens _ '''' = []\" |\n  \"tokens P x =\n   (let (l, r) = splitl (\\<lambda>e. ~P e) x in if l = [] then tokens P (tl r) else l # tokens P r)\"\n  by pat_completeness auto\n  termination tokens\n  apply (relation \"measure (length o snd)\")\n  apply auto\n  apply (case_tac \"~ P v\", auto simp add: case_prod_beta le_imp_less_Suc)\n  apply (case_tac \"~ P v\", auto simp add: case_prod_beta le_imp_less_Suc)\n  done\n\nfunction (sequential) fields :: \"(char \\<Rightarrow> bool) \\<Rightarrow> string \\<Rightarrow> string list\" where\n  \"fields _ '''' = [[]]\" |\n  \"fields P x =\n   (let (l, r) = splitl (\\<lambda>e. ~P e) x in if l = [] then [] # fields P (tl r)\n                                        else if r = [] then [l]\n                                        else l # fields P (tl r))\"\n  by pat_completeness auto\n  termination fields\n  apply (relation \"measure (length o snd)\")\n  apply auto\n  apply (case_tac \"~ P v\", auto simp add: case_prod_beta le_imp_less_Suc)\n  apply (case_tac \"~ P v\", auto simp add: case_prod_beta)\n  done\n\n(* bit-string operations - extends Bool_List_Representation.thy *)\n\ndefinition nat_to_bitstring :: \"nat \\<Rightarrow> bool list\" where\n  \"nat_to_bitstring n = \n   (if n = 0 then [False] else bin_to_bl (log2 n + 1) (int n))\"\n\ndefinition \"bitstring_to_nat = nat o bl_to_bin\"\n\ndefinition fixwidth :: \"nat \\<Rightarrow> bool list \\<Rightarrow> bool list\" where\n  \"fixwidth n v = (let l = length v in if l < n then pad_left False n v else drop (l - n) v)\"\n\ndefinition bitwise :: \"(bool \\<Rightarrow> bool \\<Rightarrow> bool) \\<Rightarrow> bool list \\<Rightarrow> bool list \\<Rightarrow> bool list\" where\n  \"bitwise f v1 v2 =\n   (let m = max (length v1) (length v2) in map (case_prod f) (zip (fixwidth m v1) (fixwidth m v2)))\"\n\ndefinition \"bor  = bitwise (op \\<or>)\"\ndefinition \"band = bitwise (op \\<and>)\"\ndefinition \"bxor = bitwise (op \\<noteq>)\"\n\ndefinition bitstring_shiftl :: \"bool list \\<Rightarrow> nat \\<Rightarrow> bool list\" where\n  \"bitstring_shiftl v m = pad_right False (length v + m) v\"\n\ndefinition bitstring_shiftr :: \"bool list \\<Rightarrow> nat \\<Rightarrow> bool list\" where\n  \"bitstring_shiftr v m = take (length v - m) v\"\n\ndefinition bitstring_field :: \"nat \\<Rightarrow> nat \\<Rightarrow> bool list \\<Rightarrow> bool list\" where\n  \"bitstring_field h l v = fixwidth (Suc h - l) (bitstring_shiftr v l)\"\n\ndefinition bitstring_rotate :: \"bool list \\<Rightarrow> nat \\<Rightarrow> bool list\" where\n  \"bitstring_rotate v m =\n   (let l = length v in\n    let x = m mod l in\n      if l = 0 \\<or> x = 0 then v else bitstring_field (x - 1) 0 v @ bitstring_field (l - 1) x v)\"\n\ndefinition bitstring_test_bit :: \"bool list \\<Rightarrow> nat \\<Rightarrow> bool\" where\n  \"bitstring_test_bit v n = (bitstring_field n n v = [True])\"\n\ndefinition bitstring_modify ::  \"(nat \\<times> bool \\<Rightarrow> bool) \\<times> bool list \\<Rightarrow> bool list\" where\n  \"bitstring_modify p = (case p of (f, l) \\<Rightarrow> map f (zip (rev (upt 0 (length l))) l))\"\n\ndefinition bitstring_field_insert :: \"nat \\<Rightarrow> nat \\<Rightarrow> bool list \\<Rightarrow> bool list \\<Rightarrow> bool list\" where\n  \"bitstring_field_insert h l v1 v2 =\n   bitstring_modify (\\<lambda>(i, b). if l \\<le> i \\<and> i \\<le> h then bitstring_test_bit v1 (i - l) else b, v2)\"\n\nlemma nat_to_bitstring_zero [simp]:\n  shows \"nat_to_bitstring 0 = [False]\"\nunfolding nat_to_bitstring_def by simp\n\n(* We do not add the following rule to the simp set, because n occurs twice at the right hand side,\nand therefore the state might not become simpler when applying this rule. *)\n\nlemma nat_to_bitstring_length:\n  shows \"length (nat_to_bitstring n) = (if n = 0 then 1 else log2 n + 1)\"\nunfolding nat_to_bitstring_def\nby (simp del: bin_to_bl_def)\n\nlemma fixwidth_length [simp]:\n  shows \"length (fixwidth n l) = n\"\nunfolding fixwidth_def Let_def\nby auto\n\nlemma bitwise_length [simp]:\n  shows \"length (bitwise f v1 v2) = max (length v1) (length v2)\"\nunfolding bitwise_def Let_def\nby auto\n\n(* extra word operations *)\n\ndefinition unsigned_min :: \"'a::len word \\<times> 'a::len word \\<Rightarrow> 'a::len word\" where\n  \"unsigned_min p = (case p of (w1, w2) \\<Rightarrow> (if w1 \\<le> w2 then w1 else w2))\"\n\ndefinition unsigned_max :: \"'a::len word \\<times> 'a::len word \\<Rightarrow> 'a::len word\" where\n  \"unsigned_max p = (case p of (w1, w2) \\<Rightarrow> (if w1 \\<le> w2 then w2 else w1))\"\n\ndefinition word_log2 :: \"'a::len word \\<Rightarrow> 'a::len word\" where\n  \"word_log2 w = of_nat (log2 (unat w))\"\n\ndefinition word_quot :: \"'a::len word \\<Rightarrow> 'a::len word \\<Rightarrow> 'a::len word\" where\n  \"word_quot i j = of_int (sint i quot sint j)\"\n  \ndefinition word_rem :: \"'a::len word \\<Rightarrow> 'a::len word \\<Rightarrow> 'a::len word\" where\n  \"word_rem i j = of_int (sint i rem sint j)\"\n\ndefinition word_sdiv :: \"'a::len word \\<Rightarrow> 'a::len word \\<Rightarrow> 'a::len word\" where\n  \"word_sdiv i j = of_int (sint i div sint j)\"\n  \ndefinition word_smod :: \"'a::len word \\<Rightarrow> 'a::len word \\<Rightarrow> 'a::len word\" where\n  \"word_smod i j = of_int (sint i mod sint j)\"\n  \ndefinition word_modify :: \"(nat \\<times> bool \\<Rightarrow> bool) \\<times> 'a::len word \\<Rightarrow> 'a::len word\" where\n  \"word_modify p = (case p of (f, w) \\<Rightarrow> of_bl (bitstring_modify (f, to_bl w)))\"\n\ndefinition word_bit_field_insert :: \"nat \\<Rightarrow> nat \\<Rightarrow> 'a::len word \\<Rightarrow> 'b::len word \\<Rightarrow> 'b::len word\" where\n  \"word_bit_field_insert h l w1 w2 =\n   word_modify (\\<lambda>(i, b). if l \\<le> i \\<and> i \\<le> h then test_bit w1 (i - l) else b, w2)\"\n\ndefinition word_bits :: \"nat \\<Rightarrow> nat \\<Rightarrow> 'a::len word \\<Rightarrow> 'a::len word\" where\n  \"word_bits h l w = (w >> l) AND mask (Suc h - l)\"\n\ndefinition word_extract :: \"nat \\<Rightarrow> nat \\<Rightarrow> 'a::len word \\<Rightarrow> 'b::len word\" where\n  \"word_extract h l w = ucast (word_bits h l w)\"\n\ndefinition word_replicate :: \"nat \\<Rightarrow> 'a::len word \\<Rightarrow> 'b::len word\" where\n  \"word_replicate n a = word_rcat (replicate n a)\"\n\n(* floating-point stubs *)\n\ndatatype ieee_rounding =\n  roundTiesToEven | roundTowardPositive | roundTowardNegative | roundTowardZero\n\ndatatype ieee_compare = LT | EQ | GT | UN\n\nrecord ieee_flags = \n  DivideByZero :: bool\n  InvalidOp :: bool\n  Overflow :: bool\n  Precision :: bool\n  Underflow :: bool\n  \nconsts\n  fp32_abs :: \"32 word \\<Rightarrow> 32 word\"\n  fp32_add :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 32 word\"\n  fp32_add_with_flags :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> ieee_flags \\<times> 32 word\"\n  fp32_compare :: \"32 word \\<Rightarrow> 32 word \\<Rightarrow> ieee_compare\"\n  fp32_div :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 32 word\"\n  fp32_div_with_flags :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> ieee_flags \\<times> 32 word\"\n  fp32_equal :: \"32 word \\<Rightarrow> 32 word \\<Rightarrow> bool\"\n  fp32_from_int :: \"ieee_rounding \\<Rightarrow> int \\<Rightarrow> 32 word\"\n  fp32_greater :: \"32 word \\<Rightarrow> 32 word \\<Rightarrow> bool\"\n  fp32_greater_equal :: \"32 word \\<Rightarrow> 32 word \\<Rightarrow> bool\"\n  fp32_is_integral :: \"32 word \\<Rightarrow> bool\"\n  fp32_is_finite :: \"32 word \\<Rightarrow> bool\"\n  fp32_is_nan :: \"32 word \\<Rightarrow> bool\"\n  fp32_is_normal :: \"32 word \\<Rightarrow> bool\"\n  fp32_is_signalling_nan :: \"32 word \\<Rightarrow> bool\"\n  fp32_is_subnormal :: \"32 word \\<Rightarrow> bool\"\n  fp32_less :: \"32 word \\<Rightarrow> 32 word \\<Rightarrow> bool\"\n  fp32_less_equal :: \"32 word \\<Rightarrow> 32 word \\<Rightarrow> bool\"\n  fp32_mul :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 32 word\"\n  fp32_mul_with_flags :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> ieee_flags \\<times> 32 word\"\n  fp32_mul_add :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 32 word\"\n  fp32_mul_add_with_flags :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> ieee_flags \\<times> 32 word\"\n  fp32_mul_sub :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 32 word\"\n  fp32_mul_sub_with_flags :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> ieee_flags \\<times> 32 word\"\n  fp32_neg_inf :: \"32 word\"\n  fp32_neg_max :: \"32 word\"\n  fp32_neg_min :: \"32 word\"\n  fp32_neg_zero :: \"32 word\"\n  fp32_negate :: \"32 word \\<Rightarrow> 32 word\"\n  fp32_pos_inf :: \"32 word\"\n  fp32_pos_max :: \"32 word\"\n  fp32_pos_min :: \"32 word\"\n  fp32_pos_zero :: \"32 word\"\n  fp32_round_to_integral :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word\"\n  fp32_snan :: \"32 word\"\n  fp32_sqrt :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word\"\n  fp32_sqrt_with_flags :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> ieee_flags \\<times> 32 word\"\n  fp32_sub :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> 32 word\"\n  fp32_sub_with_flags :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> 32 word \\<Rightarrow> ieee_flags \\<times> 32 word\"\n  fp32_qnan :: \"32 word\"\n  fp32_to_int :: \"ieee_rounding \\<Rightarrow> 32 word \\<Rightarrow> int option\"\n\nconsts\n  fp64_abs :: \"64 word \\<Rightarrow> 64 word\"\n  fp64_add :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> 64 word\"\n  fp64_add_with_flags :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> ieee_flags \\<times> 64 word\"\n  fp64_compare :: \"64 word \\<Rightarrow> 64 word \\<Rightarrow> ieee_compare\"\n  fp64_div :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> 64 word\"\n  fp64_div_with_flags :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> ieee_flags \\<times> 64 word\"\n  fp64_equal :: \"64 word \\<Rightarrow> 64 word \\<Rightarrow> bool\"\n  fp64_from_int :: \"ieee_rounding \\<Rightarrow> int \\<Rightarrow> 64 word\"\n  fp64_greater :: \"64 word \\<Rightarrow> 64 word \\<Rightarrow> bool\"\n  fp64_greater_equal :: \"64 word \\<Rightarrow> 64 word \\<Rightarrow> bool\"\n  fp64_is_integral :: \"64 word \\<Rightarrow> bool\"\n  fp64_is_finite :: \"64 word \\<Rightarrow> bool\"\n  fp64_is_nan :: \"64 word \\<Rightarrow> bool\"\n  fp64_is_normal :: \"64 word \\<Rightarrow> bool\"\n  fp64_is_signalling_nan :: \"64 word \\<Rightarrow> bool\"\n  fp64_is_subnormal :: \"64 word \\<Rightarrow> bool\"\n  fp64_less :: \"64 word \\<Rightarrow> 64 word \\<Rightarrow> bool\"\n  fp64_less_equal :: \"64 word \\<Rightarrow> 64 word \\<Rightarrow> bool\"\n  fp64_mul :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> 64 word\"\n  fp64_mul_with_flags :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> ieee_flags \\<times> 64 word\"\n  fp64_mul_add :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> 64 word\"\n  fp64_mul_add_with_flags :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> ieee_flags \\<times> 64 word\"\n  fp64_mul_sub :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> 64 word\"\n  fp64_mul_sub_with_flags :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> ieee_flags \\<times> 64 word\"\n  fp64_neg_inf :: \"64 word\"\n  fp64_neg_min :: \"64 word\"\n  fp64_neg_max :: \"64 word\"\n  fp64_neg_zero :: \"64 word\"\n  fp64_negate :: \"64 word \\<Rightarrow> 64 word\"\n  fp64_pos_inf :: \"64 word\"\n  fp64_pos_min :: \"64 word\"\n  fp64_pos_max :: \"64 word\"\n  fp64_pos_zero :: \"64 word\"\n  fp64_round_to_integral :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word\"\n  fp64_snan :: \"64 word\"\n  fp64_sqrt :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word\"\n  fp64_sqrt_with_flags :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> ieee_flags \\<times> 64 word\"\n  fp64_sub :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> 64 word\"\n  fp64_sub_with_flags :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 64 word \\<Rightarrow> ieee_flags \\<times> 64 word\"\n  fp64_qnan :: \"64 word\"\n  fp64_to_int :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> int option\"\n\nconsts\n  fp32_to_fp64 :: \"32 word \\<Rightarrow> 64 word\"\n  fp64_to_fp32 :: \"ieee_rounding \\<Rightarrow> 64 word \\<Rightarrow> 32 word\"\n\ncode_printing\n    constant \"fp32_abs\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp32'_abs\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_abs\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_abs\\\")\"\n  | constant \"fp32_add\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_add\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_add\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_add\\\")\"\n  | constant \"fp32_add_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_add'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_add'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_add'_with'_flag\\\")\"\n  | constant \"fp32_compare\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_compare\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_compare\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_compare\\\")\"\n  | constant \"fp32_div\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_div\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_div\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_div\\\")\"\n  | constant \"fp32_div_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_div'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_div'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_div'_with'_flag\\\")\"\n  | constant \"fp32_equal\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_equal\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_equal\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_equal\\\")\"\n  | constant \"fp32_from_int\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_from'_int\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_from'_int\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_from'_int\\\")\"\n  | constant \"fp32_greater\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_greater\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_greater\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_greater\\\")\"\n  | constant \"fp32_greater_equal\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_greater'_equal\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_greater'_equal\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_greater'_equal\\\")\"\n  | constant \"fp32_is_integral\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp32'_is'_integral\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_is'_integral\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_is'_intagral\\\")\"\n  | constant \"fp32_is_finite\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp32'_is'_finite\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_is'_finite\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_is'_finite\\\")\"\n  | constant \"fp32_is_nan\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp32'_is'_nan\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_is'_nan\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_is'_nan\\\")\"\n  | constant \"fp32_is_normal\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp32'_is'_normal\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_is'_normal\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_is'_normal\\\")\"\n  | constant \"fp32_is_signalling_nan\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp32'_is'_signalling'_nan\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_is'_signalling'_nan\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_is'_signalling'_nan\\\")\"\n  | constant \"fp32_is_subnormal\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp32'_is'_subnormal\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_is'_subnormal\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_is'_subnormal\\\")\"\n  | constant \"fp32_less\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_less\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_less\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_less\\\")\"\n  | constant \"fp32_less_equal\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_less'_equal\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_less'_equal\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_less'_equal\\\")\"\n  | constant \"fp32_mul\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_mul\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_mul\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_mul\\\")\"\n  | constant \"fp32_mul_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_mul'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_mul'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_mul'_with'_flag\\\")\"\n  | constant \"fp32_mul_add\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_mul'_add\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ '_ -> failwith \\\"fp32'_mul'_add\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ '_ -> error \\\"fp32'_mul'_add\\\")\"\n  | constant \"fp32_mul_add_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_mul'_add'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_mul'_add'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_mul'_add'_with'_flag\\\")\"\n  | constant \"fp32_mul_sub\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_mul'_sub\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ '_ -> failwith \\\"fp32'_mul'_sub\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ '_ -> error \\\"fp32'_mul'_sub\\\")\"\n  | constant \"fp32_mul_sub_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_sub'_add'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_mul'_sub'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_mul'_sub'_with'_flag\\\")\"\n  | constant \"fp32_neg_inf\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp32'_neg'_inf\\\")\"\n      and (OCaml) \"!(failwith \\\"fp32'_neg'_inf\\\")\"\n      and (Haskell) \"!(error \\\"fp32'_neg'_inf\\\")\"\n  | constant \"fp32_neg_min\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp32'_neg'_min\\\")\"\n      and (OCaml) \"!(failwith \\\"fp32'_neg'_min\\\")\"\n      and (Haskell) \"!(error \\\"fp32'_neg'_min\\\")\"\n  | constant \"fp32_neg_max\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp32'_neg'_max\\\")\"\n      and (OCaml) \"!(failwith \\\"fp32'_neg'_max\\\")\"\n      and (Haskell) \"!(error \\\"fp32'_neg'_min\\\")\"\n  | constant \"fp32_neg_zero\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp32'_neg'_zero\\\")\"\n      and (OCaml) \"!(failwith \\\"fp32'_neg'_zero\\\")\"\n      and (Haskell) \"!(error \\\"fp32'_neg'_zero\\\")\"\n  | constant \"fp32_negate\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp32'_negate\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_negate\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_negate\\\")\"\n  | constant \"fp32_pos_inf\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp32'_pos'_inf\\\")\"\n      and (OCaml) \"!(failwith \\\"fp32'_pos'_inf\\\")\"\n      and (Haskell) \"!(error \\\"fp32'_pos'_inf\\\")\"\n  | constant \"fp32_pos_min\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp32'_pos'_min\\\")\"\n      and (OCaml) \"!(failwith \\\"fp32'_pos'_min\\\")\"\n      and (Haskell) \"!(error \\\"fp32'_pos'_min\\\")\"\n  | constant \"fp32_pos_max\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp32'_pos'_max\\\")\"\n      and (OCaml) \"!(failwith \\\"fp32'_pos'_max\\\")\"\n      and (Haskell) \"!(error \\\"fp32'_pos'_max\\\")\"\n  | constant \"fp32_pos_zero\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp32'_pos'_zero\\\")\"\n      and (OCaml) \"!(failwith \\\"fp32'_pos'_zero\\\")\"\n      and (Haskell) \"!(error \\\"fp32'_pos'_zero\\\")\"\n  | constant \"fp32_snan\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp32'_snan\\\")\"\n      and (OCaml) \"!(failwith \\\"fp32'_snan\\\")\"\n      and (Haskell) \"!(error \\\"fp32'_snan\\\")\"\n  | constant \"fp32_round_to_integral\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_round'_to'_integral\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_round'_to'_integral\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_to'_integral\\\")\"\n  | constant \"fp32_sqrt\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_sqrt\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_sqrt\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_sqrt\\\")\"\n  | constant \"fp32_sqrt_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_sqrt'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_sqrt'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_sqrt'_with'_flag\\\")\"\n  | constant \"fp32_sub\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_sub\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_sub\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_sub\\\")\"\n  | constant \"fp32_sub_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp32'_sub'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp32'_sub'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp32'_sub'_with'_flag\\\")\"\n  | constant \"fp32_qnan\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp32'_qnan\\\")\"\n      and (OCaml) \"!(failwith \\\"fp32'_qnan\\\")\"\n      and (Haskell) \"!(error \\\"fp32'_qnan\\\")\"\n  | constant \"fp32_to_int\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp32'_to'_int\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp32'_to'_int\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp32'_to'_int\\\")\"\n  | constant \"fp64_abs\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp64'_abs\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_abs\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_abs\\\")\"\n  | constant \"fp64_add\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_add\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_add\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_add\\\")\"\n  | constant \"fp64_add_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_add'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_add'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_add'_with'_flag\\\")\"\n  | constant \"fp64_compare\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_compare\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_compare\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_compare\\\")\"\n  | constant \"fp64_div\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_div\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_div\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_div\\\")\"\n  | constant \"fp64_div_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_div'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_div'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_div'_with'_flag\\\")\"\n  | constant \"fp64_equal\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_equal\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_equal\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_equal\\\")\"\n  | constant \"fp64_from_int\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_from'_int\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_from'_int\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_from'_int\\\")\"\n  | constant \"fp64_greater\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_greater\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_greater\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_greater\\\")\"\n  | constant \"fp64_greater_equal\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_greater'_equal\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_greater'_equal\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_greater'_equal\\\")\"\n  | constant \"fp64_is_integral\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp64'_is'_integral\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_is'_integral\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_is'_intagral\\\")\"\n  | constant \"fp64_is_finite\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp64'_is'_finite\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_is'_finite\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_is'_finite\\\")\"\n  | constant \"fp64_is_nan\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp64'_is'_nan\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_is'_nan\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_is'_nan\\\")\"\n  | constant \"fp64_is_normal\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp64'_is'_normal\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_is'_normal\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_is'_normal\\\")\"\n  | constant \"fp64_is_signalling_nan\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp64'_is'_signalling'_nan\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_is'_signalling'_nan\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_is'_signalling'_nan\\\")\"\n  | constant \"fp64_is_subnormal\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp64'_is'_subnormal\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_is'_subnormal\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_is'_subnormal\\\")\"\n  | constant \"fp64_less\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_less\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_less\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_less\\\")\"\n  | constant \"fp64_less_equal\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_less'_equal\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_less'_equal\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_less'_equal\\\")\"\n  | constant \"fp64_mul\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_mul\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_mul\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_mul\\\")\"\n  | constant \"fp64_mul_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_mul'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_mul'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_mul'_with'_flag\\\")\"\n  | constant \"fp64_mul_add\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_mul'_add\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ '_ -> failwith \\\"fp64'_mul'_add\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ '_ -> error \\\"fp64'_mul'_add\\\")\"\n  | constant \"fp64_mul_add_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_mul'_add'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_mul'_add'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_mul'_add'_with'_flag\\\")\"\n  | constant \"fp64_mul_sub\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_mul'_sub\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ '_ -> failwith \\\"fp64'_mul'_sub\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ '_ -> error \\\"fp64'_mul'_sub\\\")\"\n  | constant \"fp64_mul_sub_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_sub'_add'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_mul'_sub'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_mul'_sub'_with'_flag\\\")\"\n  | constant \"fp64_neg_inf\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp64'_neg'_inf\\\")\"\n      and (OCaml) \"!(failwith \\\"fp64'_neg'_inf\\\")\"\n      and (Haskell) \"!(error \\\"fp64'_neg'_inf\\\")\"\n  | constant \"fp64_neg_min\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp64'_neg'_min\\\")\"\n      and (OCaml) \"!(failwith \\\"fp64'_neg'_min\\\")\"\n      and (Haskell) \"!(error \\\"fp64'_neg'_min\\\")\"\n  | constant \"fp64_neg_max\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp64'_neg'_max\\\")\"\n      and (OCaml) \"!(failwith \\\"fp64'_neg'_max\\\")\"\n      and (Haskell) \"!(error \\\"fp64'_neg'_max\\\")\"\n  | constant \"fp64_neg_zero\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp64'_neg'_zero\\\")\"\n      and (OCaml) \"!(failwith \\\"fp64'_neg'_zero\\\")\"\n      and (Haskell) \"!(error \\\"fp64'_neg'_zero\\\")\"\n  | constant \"fp64_negate\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp64'_negate\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp64'_negate\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp64'_negate\\\")\"\n  | constant \"fp64_pos_inf\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp64'_pos'_inf\\\")\"\n      and (OCaml) \"!(failwith \\\"fp64'_pos'_inf\\\")\"\n      and (Haskell) \"!(error \\\"fp64'_pos'_inf\\\")\"\n  | constant \"fp64_pos_min\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp64'_pos'_min\\\")\"\n      and (OCaml) \"!(failwith \\\"fp64'_pos'_min\\\")\"\n      and (Haskell) \"!(error \\\"fp64'_pos'_min\\\")\"\n  | constant \"fp64_pos_max\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp64'_pos'_max\\\")\"\n      and (OCaml) \"!(failwith \\\"fp64'_pos'_max\\\")\"\n      and (Haskell) \"!(error \\\"fp64'_pos'_max\\\")\"\n  | constant \"fp64_pos_zero\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp64'_pos'_zero\\\")\"\n      and (OCaml) \"!(failwith \\\"fp64'_pos'_zero\\\")\"\n      and (Haskell) \"!(error \\\"fp64'_pos'_zero\\\")\"\n  | constant \"fp64_snan\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp64'_snan\\\")\"\n      and (OCaml) \"!(failwith \\\"fp64'_snan\\\")\"\n      and (Haskell) \"!(error \\\"fp64'_snan\\\")\"\n  | constant \"fp64_round_to_integral\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_round'_to'_integral\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_round'_to'_integral\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_to'_integral\\\")\"\n  | constant \"fp64_sqrt\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_sqrt\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_sqrt\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_sqrt\\\")\"\n  | constant \"fp64_sqrt_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_sqrt'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_sqrt'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_sqrt'_with'_flag\\\")\"\n  | constant \"fp64_qnan\" \\<rightharpoonup>\n      (SML) \"!(raise Fail \\\"fp64'_qnan\\\")\"\n      and (OCaml) \"!(failwith \\\"fp64'_qnan\\\")\"\n      and (Haskell) \"!(error \\\"fp64'_qnan\\\")\"\n  | constant \"fp64_sub\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_sub\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_sub\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_sub\\\")\"\n  | constant \"fp64_sub_with_flags\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => fn '_ => raise Fail \\\"fp64'_sub'_with'_flags\\\")\"\n      and (OCaml) \"!(fun '_ '_ '_ -> failwith \\\"fp64'_sub'_with'_flag\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ '_ -> error \\\"fp64'_sub'_with'_flag\\\")\"\n  | constant \"fp64_to_int\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_to'_int\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_to'_int\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_to'_int\\\")\"\n  | constant \"fp32_to_fp64\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => raise Fail \\\"fp32'_to'_fp64\\\")\"\n      and (OCaml) \"!(fun '_ -> failwith \\\"fp32'_to'_fp64\\\")\"\n      and (Haskell) \"!(\\\\ '_ -> error \\\"fp32'_to'_fp64\\\")\"\n  | constant \"fp64_to_fp32\" \\<rightharpoonup>\n      (SML) \"!(fn '_ => fn '_ => raise Fail \\\"fp64'_to'_fp32\\\")\"\n      and (OCaml) \"!(fun '_ '_ -> failwith \\\"fp64'_to'_fp32\\\")\"\n      and (Haskell) \"!(\\\\ '_ '_ -> error \\\"fp64'_to'_fp32\\\")\"\n\nend\n", "meta": {"author": "CTSRD-CHERI", "repo": "l3-cheri-mips-proofs", "sha": "239c37ad1587caf261501478bbcd1293b9ecb7b7", "save_path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs", "path": "github-repos/isabelle/CTSRD-CHERI-l3-cheri-mips-proofs/l3-cheri-mips-proofs-239c37ad1587caf261501478bbcd1293b9ecb7b7/specification/L3_Lib.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3031684709816578}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2009-2       |\n            |                October 2010  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2016         |\n            |                    May 2016  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory Domain_T_cms\nimports Domain_T RS\nbegin\n\n(*****************************************************************\n\n         1. \n         2. \n         3. \n         4. \n\n *****************************************************************)\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  Union (B ` A) = (UN x:A. B x)                      *)\n(*                  Inter (B ` A) = (INT x:A. B x)                     *)\n\n(*\ndeclare Union_image_eq [simp del]\ndeclare Inter_image_eq [simp del]\n*)\n\ndeclare Sup_image_eq [simp del]\ndeclare Inf_image_eq [simp del]\n\n(**********************************************************\n           Definitions (Restriction in domT)\n **********************************************************)\n\n(*\ninstance domT :: (type) ms0\nby (intro_classes)\n*)\n\ndefinition\n  restT      :: \"'a domT => nat => 'a trace set\" (\"_ restT _\" [84,900] 84)\n  where\n  restT_def  : \"T restT n == {s. s :t T & (lengtht s) <= n}\"\n\n(* (\"_ restT _\" [55,56] 55) in Isabelle 2005 *)\n\ndefinition\n  LimitT     :: \"'a domT infinite_seq => 'a trace set\"\n  where\n  LimitT_def : \"LimitT Ts == {s. s :t Ts (lengtht s)}\"\n  \ndefinition  \n  Limit_domT :: \"'a domT infinite_seq => 'a domT\"\n  where\n  Limit_domT_def    : \"Limit_domT Ts    == Abs_domT (LimitT Ts)\"\n\n(* isabelle 2009-2 *)\n\ninstantiation domT :: (type) rs0\nbegin\n\ndefinition\n  rest_domT_def : \"T .|. n == Abs_domT (T restT n)\"\n\n  instance ..\n\nend\n\n(* isabelle 2009-1\ndefs (overloaded)\n  rest_domT_def : \"T .|. n == Abs_domT (T restT n)\"\n*)\n\n\n\n(**********************************************************\n              Lemmas (Restriction in Dom_T)\n **********************************************************)\n\n(*** restT_def in domT ***)\n\nlemma restT_in[simp] : \"T restT n : domT\"\napply (simp add: restT_def)\napply (simp add: domT_def HC_T1_def)\napply (rule conjI)\napply (rule_tac x=\"<>\" in exI, simp)\n\napply (simp add: prefix_closed_def)\napply (intro allI impI)\napply (elim conjE exE)\n\napply (rule conjI)\napply (rule memT_prefix_closed, simp_all)\n\napply (subgoal_tac \"lengtht s <= lengtht t\", simp)\napply (rule length_of_prefix)\napply (simp)\ndone\n\n(*** restT in domT ***)\n\nlemmas restT_def_in = restT_in[simplified memT_def restT_def]\n\n(*********************************************************\n                     .|. on dom_T\n *********************************************************)\n\nlemma rest_domT_iff: \"T .|. n = {s. s :t T & lengtht s <= n}t\"\napply (simp add: rest_domT_def)\napply (simp add: restT_in[simplified restT_def] Abs_domT_inject)\napply (simp add: restT_def)\ndone\n\nlemma in_rest_domT: \"s :t T .|. n = (s :t T & lengtht s <= n)\"\napply (simp add: memT_def rest_domT_def)\napply (simp add: Abs_domT_inverse)\napply (simp add: memT_def restT_def)\ndone\n\nlemma rest_domT_eq_iff:\n   \"(T .|. n = S .|. m) =\n    (ALL s. (s :t T & lengtht s <= n) = (s :t S & lengtht s <= m))\"\napply (simp add: rest_domT_def Abs_domT_inject)\napply (simp add: restT_def)\nby (auto)\n\n(*********************************************************\n                     Dom_T --> RS\n *********************************************************)\n\n(*******************************\n        zero_eq_rs_domT\n *******************************)\n\n(*** restT 0 ***)\n\nlemma zero_domT: \"T restT 0 = {<>}\"\napply (simp add: restT_def)\napply (rule order_antisym)\n\napply (rule subsetI)\napply (simp)\napply (erule conjE)\napply (simp add: lengtht_zero)\nby (simp)\n\n(*** zero_eq_rs_domT ***)\n\nlemma zero_rs_domT: \"T .|. 0 = {<>}t\"\napply (simp add: rest_domT_def)\napply (simp add: Abs_domT_inject)\napply (simp add: zero_domT)\ndone\n\nlemma zero_eq_rs_domT: \"(T::'a domT) .|. 0 = S .|. 0\"\napply (simp add: zero_rs_domT)\ndone\n\n(*******************************\n         min_rs_domT\n *******************************)\n\nlemma min_rs_domT: \"((T::'a domT) .|. m) .|. n = T .|. (min m n)\"\napply (simp add: rest_domT_def)\napply (simp add: Abs_domT_inject)\n\napply (simp add: restT_def memT_def)\napply (simp add: restT_in[simplified memT_def restT_def]\n                 Abs_domT_inverse)\ndone\n\n(*******************************\n         diff_rs_domT\n *******************************)\n\n(*** contra = ***)\n\nlemma contra_diff_rs_domT: \n  \"(ALL n. (T::'a domT) .|. n = S .|. n) ==> T = S\"\napply (simp add: rest_domT_eq_iff)\napply (rule order_antisym)\nby (auto)\n\n(*** diff_rs_domT ***)\n\nlemma diff_rs_domT: \n  \"(T::'a domT) ~= S ==> (EX n. T .|. n ~= S .|. n)\"\napply (erule contrapos_pp)\napply (simp)\napply (rule contra_diff_rs_domT, simp)\ndone\n\n(***************************************************************\n                       domT ==> RS\n ***************************************************************)\n\ninstance domT :: (type) rs\napply (intro_classes)\napply (simp add: zero_eq_rs_domT)\napply (simp add: min_rs_domT)\napply (simp add: diff_rs_domT)\ndone\n\n(************************************************************\n                        domT ==> MS\n ************************************************************)\n\n\ninstantiation domT :: (type) ms0\nbegin\n\ndefinition\n  domT_distance_def:\n     \"distance (TT::('a domT * 'a domT)) = distance_rs TT\"\n  instance ..\nend\n\ninstance domT :: (type) ms\napply (intro_classes)\napply (simp_all add: domT_distance_def)\napply (simp add: diagonal_rs)\napply (simp add: symmetry_rs)\napply (simp add: triangle_inequality_rs)\ndone\n\n(************************************************************\n                 i.e.  domT ==> MS & RS \n ************************************************************)\n\ninstance domT :: (type) ms_rs\napply (intro_classes)\napply (simp add: domT_distance_def)\ndone\n\n(***********************************************************\n                      lemmas (Limit)\n ***********************************************************)\n\n(*** normal_seq lemma ***)\n\nlemma normal_seq_domT:\n  \"[| normal Ts ; lengtht s <= n |]\n   ==> (s :t Ts (lengtht s)) = (s :t Ts n)\"\napply (simp add: normal_def)\napply (drule_tac x=\"lengtht s\" in spec)\napply (drule_tac x=\"n\" in spec)\napply (simp add: min_is)\n\napply (simp add: to_distance_rs)\napply (simp add: distance_rs_le_1[THEN sym])\napply (simp add: rest_domT_eq_iff)\napply (drule_tac x=\"s\" in spec)\nby (simp)\n\nlemma normal_seq_domT_only_if:\n  \"[| normal Ts ; lengtht s <= n ; s :t Ts (lengtht s) |]\n   ==> s :t Ts n\"\nby (simp add: normal_seq_domT)\n\nlemma normal_seq_domT_if:\n  \"[| normal Ts ; lengtht s <= n ; s :t Ts n |]\n   ==>  s :t Ts (lengtht s)\"\nby (simp add: normal_seq_domT)\n\n(*** LimitT_def in domT ***)\n\nlemma LimitT_in[simp]:\n  \"normal (Ts::'a domT infinite_seq) ==> LimitT Ts : domT\"\napply (simp add: domT_def HC_T1_def)\napply (rule conjI)\n\napply (simp add: LimitT_def)\napply (rule_tac x=\"<>\" in exI)\napply (simp)\n\napply (simp add: prefix_closed_def LimitT_def)\napply (intro allI impI)\napply (elim conjE exE)\n\napply (subgoal_tac \"lengtht s <= lengtht t\")\napply (rule normal_seq_domT_if)\napply (simp_all)\napply (rule memT_prefix_closed, simp_all)\napply (rule length_of_prefix)\napply (simp)\ndone\n\n(*** :t Limit_domT ***)\n\nlemma Limit_domT_memT: \n  \"normal (Ts::'a domT infinite_seq)\n   ==> (s :t Limit_domT Ts) = (s :t Ts (lengtht s))\"\napply (simp add: memT_def)\napply (simp add: Limit_domT_def)\napply (simp add: Abs_domT_inverse)\napply (simp add: LimitT_def memT_def)\ndone\n\n(*** Limit_domT lemma ***)\n\nlemma Limit_domT_Limit_lm:\n  \"normal (Ts::'a domT infinite_seq)\n   ==> (ALL n. (Limit_domT Ts) .|. n = (Ts n) .|. n)\"\napply (intro allI)\napply (simp add: rest_domT_eq_iff)\napply (simp add: Limit_domT_memT)\nby (auto simp add: normal_seq_domT)\n\n(*** (normal) Ts converges to (Limit_domT Ts) ***)\n\nlemma Limit_domT_Limit:\n  \"normal (Ts::'a domT infinite_seq) ==> Ts convergeTo (Limit_domT Ts)\"\nby (simp add: to_distance_rs Limit_domT_Limit_lm rest_Limit)\n\n(*** (cauchy) Ts converges to (Limit_domT NF Ts) ***)\n\nlemma cauchy_Limit_domT_Limit:\n  \"cauchy (Ts::'a domT infinite_seq) ==> Ts convergeTo (Limit_domT (NF Ts))\"\napply (simp add: normal_form_seq_same_Limit)\napply (simp add: Limit_domT_Limit normal_form_seq_normal)\ndone\n\n(***************************************\n     Dom_T --> Complete Metric Space\n ***************************************)\n\nlemma domT_cms:\n  \"cauchy (Ts::'a domT infinite_seq) ==> (EX T. Ts convergeTo T)\"\napply (rule_tac x=\"Limit_domT (NF Ts)\" in exI)\nby (simp add: cauchy_Limit_domT_Limit)\n\n(************************************************************\n                   domT ==> CMS and RS\n ************************************************************)\n\ninstance domT :: (type) cms\napply (intro_classes)\nby (simp add: domT_cms)\n\ninstance domT :: (type) cms_rs\nby (intro_classes)\n\n(*** (normal) Limit Ts = Limit_domT Ts ***)\n\nlemma Limit_domT_Limit_eq:\n  \"normal (Ts::'a domT infinite_seq) ==> Limit Ts = Limit_domT Ts\"\napply (insert unique_convergence[of Ts \"Limit Ts\" \"Limit_domT Ts\"])\nby (simp add: Limit_domT_Limit Limit_is normal_cauchy)\n\n(*----------------------------------------------------------*\n |                                                          |\n |                       cms rs order                       |\n |                                                          |\n *----------------------------------------------------------*)\n\ninstance domT :: (type) ms_rs_order0\napply (intro_classes)\ndone\n\ninstance domT :: (type) ms_rs_order\napply (intro_classes)\napply (intro allI)\napply (rule iffI)\napply (simp add: rest_domT_def)\napply (simp add: subdomT_def)\napply (simp add: Abs_domT_inverse)\napply (fold subdomT_def)\napply (rule)\napply (drule_tac x=\"lengtht t\" in spec)\napply (simp add: restT_def)\napply (force)\n\napply (intro allI)\napply (simp add: rest_domT_def)\napply (simp add: subdomT_def)\napply (simp add: Abs_domT_inverse)\napply (fold subdomT_def)\napply (rule)\napply (simp add: restT_def)\napply (force)\ndone\n\ninstance domT :: (type) cms_rs_order\nby (intro_classes)\n\n(*----------------------------------------------------------*\n |                                                          |\n |  i.e. lemma \"continuous_rs (Ref_fun (S::'a domT))\"       |\n |       by (simp add: continuous_rs_Ref_fun)               |\n |                                                          |\n |  see RS.thy                                              |\n |                                                          |\n *----------------------------------------------------------*)\n\n(****************** to add them again ******************)\n(*\ndeclare Union_image_eq [simp]\ndeclare Inter_image_eq [simp]\n*)\n\ndeclare Sup_image_eq [simp]\ndeclare Inf_image_eq [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/CSP_T/Domain_T_cms.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3031684709816578}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory BinarySearch\nimports \"AutoCorres.AutoCorres\" \"../../DataStructures\"\nbegin\n\nexternal_file \"binary_search.c\"\ninstall_C_file \"binary_search.c\"\n\nautocorres [ts_rules = nondet, unsigned_word_abs=binary_search] \"binary_search.c\"\n\ncontext binary_search begin\n\nlemma uint_of_nat:\n    \"uint (of_nat x :: 'a::len word) = (int x) mod 2^ len_of TYPE('a)\"\n  apply (clarsimp simp only: uint_nat unat_of_nat)\n  apply (metis of_nat_numeral semiring_1_class.of_nat_power zmod_int)\n  done\n\nlemma ptr_add_uint_of_nat [simp]:\n    \"p +\\<^sub>p uint (of_nat x :: addr) = p +\\<^sub>p int x\"\n  apply (subst uint_of_nat)\n  apply (unfold CTypesDefs.ptr_add_def)\n  apply (metis (hide_lams, no_types) uint_of_nat of_int_of_nat_eq of_int_uint)\n  done\n\nlemmas [simp] = sint_ucast_eq_uint is_up is_down\n\n\nprimrec\n  array :: \"lifted_globals \\<Rightarrow> word32 ptr \\<Rightarrow> word32 list \\<Rightarrow> bool\"\nwhere\n    \"array s p [] = True\"\n  | \"array s p (x#xs) = ((heap_w32 s p = x) \\<and> (is_valid_w32 s p) \\<and> array s (p +\\<^sub>p 1) xs)\"\n\ndefinition\n  \"is_array s p n \\<equiv> \\<exists>l. array s p l \\<and> length l = n\"\n\ndefinition\n  \"the_array s p n \\<equiv> (THE l. length l = n \\<and> array s p l)\"\n\nlemma array_unique:\n    \"\\<lbrakk> array s p l; array s p l'; length l = length l' \\<rbrakk> \\<Longrightarrow> l = l'\"\n  apply (induct l arbitrary: l' p)\n   apply clarsimp\n  apply (case_tac l')\n   apply clarsimp\n   apply clarsimp\n  done\n\nlemma array_concat [simp]:\n  \"array s p (a @ b) = (array s p a \\<and> array s (p +\\<^sub>p int (length a)) b)\"\n  apply (induct a arbitrary: p)\n   apply clarsimp\n  apply clarsimp\n  apply atomize\n  apply (erule_tac x=\"p +\\<^sub>p 1\" in allE)\n  apply (clarsimp simp: CTypesDefs.ptr_add_def field_simps)\n  done\n\nlemma array_is_array: \"array s p a \\<Longrightarrow> is_array s p (length a)\"\n  apply (clarsimp simp: is_array_def)\n  apply force\n  done\n\nlemma array_the_array: \"\\<lbrakk> array s p a; length a = n \\<rbrakk> \\<Longrightarrow> the_array s p n = a\"\n  apply (simp add: the_array_def)\n  apply (metis (lifting, mono_tags) array_unique the_equality)\n  done\n\nlemma length_the_array [simp]: \"is_array s p n \\<Longrightarrow> length (the_array s p n) = n\"\n  apply (induct n arbitrary: n)\n   apply (clarsimp simp: is_array_def)\n   apply (metis array_the_array)\n  apply (clarsimp simp: is_array_def)\n  done\n\nlemma the_array_Suc:\n  \"\\<lbrakk> is_array s p n; n > 0 \\<rbrakk> \\<Longrightarrow> the_array s p n = (heap_w32 s p) # (the_array s (p +\\<^sub>p 1) (n - 1))\"\n  apply (clarsimp simp: is_array_def)\n  apply (case_tac l)\n   apply clarsimp\n  apply clarsimp\n  apply (metis One_nat_def Suc_eq_plus1 list.size(4) array.simps(2) array_the_array)\n  done\n\nlemma the_array_0 [simp]:\n  \"the_array s p 0 = []\"\n  by (metis list.size(3) array.simps(1) array_the_array)\n\nlemma is_array_0 [simp]:\n  \"is_array s p 0\"\n  apply (clarsimp simp: is_array_def)\n  done\n\nlemma is_array_Suc:\n  \"\\<lbrakk> is_array s p n; is_valid_w32 s (p +\\<^sub>p int n) \\<rbrakk> \\<Longrightarrow>\n      is_array s p (Suc n)\"\n  apply (clarsimp simp: is_array_def)\n  apply (rule_tac x=\"l @ [heap_w32 s (p +\\<^sub>p int (length l))]\" in exI)\n  apply clarsimp\n  done\n\nlemma array_expand: \"array s p n \\<Longrightarrow> array s (p +\\<^sub>p 1) (tl n)\"\n  apply (case_tac n)\n   apply clarsimp\n  apply clarsimp\n  done\n\nlemma array_Ex:\n  \"\\<lbrakk> array s p n; 0 \\<le> i; i < int (length n) \\<rbrakk> \\<Longrightarrow> is_valid_w32 s (p +\\<^sub>p i)\"\n  apply (induct n arbitrary: p i)\n   apply clarsimp\n  apply clarsimp\n  apply atomize\n  apply (erule_tac x=\"p +\\<^sub>p 1\" in allE)\n  apply (erule_tac x=\"i - 1\" in allE)\n  apply (clarsimp simp: CTypesDefs.ptr_add_def)\n  done\n\nlemma sorted_index_lt:\n  \"\\<lbrakk> sorted xs; unat (xs ! m) < v; n \\<le> m; m < length xs \\<rbrakk> \\<Longrightarrow>  unat (xs ! n) < v\"\n  by (meson le_less_trans sorted_nth_mono unat_arith_simps(1))\n\nlemma sorted_index_gt:\n    \"\\<lbrakk> sorted xs; v < unat (xs ! m); m \\<le> n; n < length xs \\<rbrakk> \\<Longrightarrow>  v < unat (xs ! n)\"\n  by (metis le_less_linear le_less_trans less_irrefl sorted_nth_mono word_less_nat_alt)\n\nlemma array_access_to_list_access:\n    \"\\<lbrakk> array s p data; n < length data \\<rbrakk> \\<Longrightarrow> (heap_w32 s (p +\\<^sub>p int n)) = data ! n\"\n  apply (induct data arbitrary: n p)\n   apply clarsimp\n  apply (case_tac \"n = 0\")\n   apply clarsimp\n  apply atomize\n  apply (erule_tac x=\"n - 1\" in allE)\n  apply (erule_tac x=\"p +\\<^sub>p 1\" in allE)\n  apply (erule impE)\n   apply clarsimp\n  apply (erule impE)\n   apply clarsimp\n   apply arith\n  apply (clarsimp simp: field_simps CTypesDefs.ptr_add_def)\n  done\n\nlemma binary_search_correct:\n  \"\\<lbrace> \\<lambda>s. array s arr data \\<and> length data < 1000000000 \\<and> n = length data \\<and> sorted data \\<rbrace>\n           binary_search' arr n v\n        \\<lbrace> \\<lambda>r s. r \\<noteq> 0 \\<longleftrightarrow> v \\<in> unat ` set data \\<rbrace>!\"\n  apply (rule validNF_assume_pre)\n  apply (unfold binary_search'_def)\n  apply (case_tac \"n = 0\")\n   apply (subst whileLoop_add_inv [where I=\"\\<lambda>(f, l, r) _. f = 0 \\<and> l = 0 \\<and> r = 0\" and M=\"\\<lambda>_. 0\"])\n   apply ((wp | clarsimp)+)[1]\n  apply (subst whileLoop_add_inv [where\n        I=\"\\<lambda>(found, l, r) s. array s arr data  \\<and> (r \\<le> n)\n                \\<and> (\\<forall>i. i < l \\<longrightarrow> i < n \\<longrightarrow> unat (data ! i) <  v)\n                \\<and> (\\<forall>i. i \\<ge> r \\<longrightarrow> i < n \\<longrightarrow> v < unat (data ! i))\n                \\<and> (found \\<noteq> 0 \\<longrightarrow> v \\<in> unat ` set data)\"\n          and  M=\"\\<lambda>((found, l, r), s). if found = 0 then 1 + (r - l) else 0\" ])\n  apply wp\n     apply (clarsimp split del: if_split cong: if_cong\n       simp: field_simps array_access_to_list_access array_Ex UINT_MAX_def)\n    apply (subgoal_tac \"aa \\<le> ((aa + b)  div 2) \\<and> ((aa + b) div 2) \\<le> b\")\n     apply (case_tac \"unat (data ! ((aa + b) div 2)) = v\")\n      apply (clarsimp simp: UINT_MAX_def INT_MAX_def)\n     apply (case_tac \"unat (data ! ((aa + b) div 2)) < v\")\n      apply (auto elim: sorted_index_lt simp: UINT_MAX_def INT_MAX_def cong: if_cong)[1]\n     apply (subgoal_tac \"unat (data ! ((aa + b) div 2)) > v\")\n      apply (clarsimp simp: UINT_MAX_def INT_MAX_def)\n      apply (fastforce elim: sorted_index_gt)\n     apply force\n    apply force\n   apply (clarsimp split del: if_split simp: field_simps cong: if_cong)\n   apply rule\n    apply clarsimp\n   apply clarsimp\n   apply (metis (no_types) in_set_conv_nth le_less_trans neq_iff not_less)\n  apply clarsimp\n  done\n\nend\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/autocorres/tests/examples/BinarySearch.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3031501573425136}}
{"text": "theory Old_Bisimulation\n  imports Old_Simulation \"NewPsi.Bisimulation\"\nbegin\n\ncontext old_psi begin\n\nlemma old_mono_coinduct: \"\\<And>x y xa xb xc P Q \\<Psi>.\n                      x \\<le> y \\<Longrightarrow>\n                      (\\<Psi> \\<rhd> Q \\<leadsto>[{(xc, xb, xa). x xc xb xa}]\\<^sub>O P) \\<longrightarrow>\n                     (\\<Psi> \\<rhd> Q \\<leadsto>[{(xb, xa, xc). y xb xa xc}]\\<^sub>O P)\"\nby(auto intro: old_monotonic dest:le_funE)\n\ncoinductive_set old_bisim :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\" \nwhere\n  step: \"\\<lbrakk>(insert_assertion (extract_frame P)) \\<Psi> \\<simeq>\\<^sub>F (insert_assertion (extract_frame Q) \\<Psi>);\n          \\<Psi> \\<rhd> P \\<leadsto>[old_bisim]\\<^sub>O Q;\n          \\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>',  P, Q) \\<in> old_bisim; (\\<Psi>, Q, P) \\<in> old_bisim\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, Q) \\<in> old_bisim\"\nmonos old_mono_coinduct\n\nabbreviation\n  old_bisim_judge (\"_ \\<rhd> _ \\<sim>\\<^sub>O _\" [70, 70, 70] 65) where \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>O Q \\<equiv> (\\<Psi>, P, Q) \\<in> old_bisim\"\nabbreviation\n  old_bisim_nil_judge (\"_ \\<sim>\\<^sub>O _\" [70, 70] 65) where \"P \\<sim>\\<^sub>O Q \\<equiv> S_bottom' \\<rhd> P \\<sim> Q\"\n\nlemma old_bisim_coinduct_aux[consumes 1]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi> \\<and>\n                                    (\\<Psi> \\<rhd> P \\<leadsto>[(X \\<union> old_bisim)]\\<^sub>O Q) \\<and>\n                                    (\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X \\<or> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> old_bisim) \\<and>\n                                    ((\\<Psi>, Q, P) \\<in> X \\<or> (\\<Psi>, Q, P) \\<in> old_bisim)\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> old_bisim\"\nproof -\n  have \"X \\<union> old_bisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> old_bisim}\" by auto\n  with assms show ?thesis\n    by coinduct simp\nqed\n\nlemma old_bisim_coinduct[consumes 1, case_names c_stat_eq c_sim c_ext c_sym]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame R) \\<Psi>' \\<simeq>\\<^sub>F insert_assertion (extract_frame S) \\<Psi>'\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> \\<Psi>' \\<rhd> R \\<leadsto>[(X \\<union> old_bisim)]\\<^sub>O S\"\n  and     \"\\<And>\\<Psi>' R S \\<Psi>''. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>' \\<otimes> \\<Psi>'', R, S) \\<in> X \\<or> (\\<Psi>' \\<otimes> \\<Psi>'', R, S) \\<in> old_bisim\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>', S, R) \\<in> X \\<or> (\\<Psi>', S, R) \\<in> old_bisim\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> old_bisim\"\nproof -\n  have \"X \\<union> old_bisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> old_bisim}\" by auto\n  with assms show ?thesis\n    by coinduct simp\nqed\n\nlemma old_bisimE:\n  fixes P  :: \"('a, 'b, 'c) psi\"\n  and   Q  :: \"('a, 'b, 'c) psi\"\n  and   \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n\n  assumes \"(\\<Psi>, P, Q) \\<in> old_bisim\"\n\n  shows \"insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n  and   \"\\<Psi> \\<rhd> P \\<leadsto>[old_bisim]\\<^sub>O Q\"\n  and   \"(\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> old_bisim\"\n  and   \"(\\<Psi>, Q, P) \\<in> old_bisim\"\nusing assms\nby(auto simp add: intro: old_bisim.cases)\n\nlemma old_bisim_weak_coinduct_aux[consumes 1]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi> \\<and>\n                                     \\<Psi> \\<rhd> P \\<leadsto>[X]\\<^sub>O Q \\<and>\n                                    (\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X) \\<and> (\\<Psi>, Q, P) \\<in> X\" \n\n  shows \"(\\<Psi>, P, Q) \\<in> old_bisim\"\nusing assms\nby(coinduct rule: old_bisim_coinduct_aux) (blast intro: old_monotonic)\n\nlemma old_bisim_sound:\n  assumes \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>O Q\"\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\n  using assms\n  by(coinduct rule: bisim_weak_coinduct) (auto intro: old_bisimE simp add: old_simulation_is_new[symmetric])\n\nlemma old_bisim_weak_coinduct[consumes 1, case_names c_stat_eq c_sim c_ext c_sym]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insert_assertion (extract_frame P) \\<Psi> \\<simeq>\\<^sub>F insert_assertion (extract_frame Q) \\<Psi>\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[X]\\<^sub>O Q\"\n  and     \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi>, Q, P) \\<in> X\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> old_bisim\"\nproof -\n  have \"X \\<union> old_bisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> old_bisim}\" by auto\n  with assms show ?thesis\n  by(coinduct rule: old_bisim_coinduct) (blast intro: old_monotonic)+\nqed\n\nlemma old_bisim_complete:\n  assumes \"\\<Psi> \\<rhd> P \\<sim> Q\"\n  shows \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>O Q\"\n  using assms\n  by(coinduct rule: old_bisim_weak_coinduct) (auto intro: bisimE simp add: old_simulation_is_new)\n\nlemma old_bisim_eq_bisim:\n  shows \"old_bisim = bisim\"\n  by(auto intro: old_bisim_sound old_bisim_complete)\n  \nend\n\nend", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Old_Bisimulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.3030952252287381}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\nsection \"Solving Word Equalities\"\n\ntheory Word_EqI\n  imports\n    More_Word\n    Traditional_Infix_Syntax\n    \"HOL-Eisbach.Eisbach_Tools\"\nbegin\n\ntext \\<open>\n  Some word equalities can be solved by considering the problem bitwise for all\n  @{prop \"n < LENGTH('a::len)\"}, which is different to running @{text word_bitwise}\n  and expanding into an explicit list of bits.\n\\<close>\n\nnamed_theorems word_eqI_simps\n\nlemmas [word_eqI_simps] =\n  word_ops_nth_size\n  word_size\n  word_or_zero\n  neg_mask_test_bit\n  nth_ucast\n  nth_w2p nth_shiftl\n  nth_shiftr\n  less_2p_is_upper_bits_unset\n  le_mask_high_bits\n  bang_eq\n  neg_test_bit\n  is_up\n  is_down\n\nlemmas word_eqI_rule = word_eqI [rule_format]\n\nlemma test_bit_lenD:\n  \"x !! n \\<Longrightarrow> n < LENGTH('a) \\<and> x !! n\" for x :: \"'a :: len word\"\n  by (fastforce dest: test_bit_size simp: word_size)\n\nmethod word_eqI uses simp simp_del split split_del cong flip =\n  ((* reduce conclusion to test_bit: *)\n   rule word_eqI_rule,\n   (* make sure we're in clarsimp normal form: *)\n   (clarsimp simp: simp simp del: simp_del simp flip: flip split: split split del: split_del cong: cong)?,\n   (* turn x < 2^n assumptions into mask equations: *)\n   ((drule less_mask_eq)+)?,\n   (* expand and distribute test_bit everywhere: *)\n   (clarsimp simp: word_eqI_simps simp simp del: simp_del simp flip: flip\n             split: split split del: split_del cong: cong)?,\n   (* add any additional word size constraints to new indices: *)\n   ((drule test_bit_lenD)+)?,\n   (* try to make progress (can't use +, would loop): *)\n   (clarsimp simp: word_eqI_simps simp simp del: simp_del simp flip: flip\n             split: split split del: split_del cong: cong)?,\n   (* helps sometimes, rarely: *)\n   (simp add: simp test_bit_conj_lt del: simp_del flip: flip split: split split del: split_del cong: cong)?)\n\nmethod word_eqI_solve uses simp simp_del split split_del cong flip =\n  solves \\<open>word_eqI simp: simp simp_del: simp_del split: split split_del: split_del\n                   cong: cong simp flip: flip;\n          (fastforce dest: test_bit_size simp: word_eqI_simps simp flip: flip\n                     simp: simp simp del: simp_del split: split split del: split_del cong: cong)?\\<close>\n\nend\n", "meta": {"author": "ethereum", "repo": "yul-isabelle", "sha": "4d760a0dabfeab19efc772330be1059021208ad9", "save_path": "github-repos/isabelle/ethereum-yul-isabelle", "path": "github-repos/isabelle/ethereum-yul-isabelle/yul-isabelle-4d760a0dabfeab19efc772330be1059021208ad9/Word_Lib/Word_EqI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.30309522522873805}}
{"text": "section \\<open>LLVM Code Generator\\<close>\ntheory LLVM_Codegen\nimports LLVM_Shallow\nbegin\n\n    (* DO NOT USE IN PRODUCTION VERSION \\<rightarrow> SLOWDOWN *)\n    (* declare [[ML_exception_debugger, ML_debugger, ML_exception_trace]] *)\n\n  text \\<open>This is the trusted part of the code generator, which accepts\n    Isabelle-LLVM programs that follow a strict format \n    (fully monadified, only \\<open>ll_\\<close> instructions).\n    \n    The preprocessor and user-interface of the code generator can be found in \n    @{file \"../preproc/LLVM_Codegen_Preproc.thy\"}\n  \\<close>\n\n  subsection \\<open>Pair Types\\<close>\n  text \\<open>The code generator will translate pair instructions if such a predicate is registered.\n    here, @{typ 't} must be of form \\<open>(...)type\\<close>, and \\<open>tfrees 't\\<^sub>1,'t\\<^sub>2 \\<subseteq> tfrees 't\\<close>, \n    and there can only be one such predicate per type.\n  \\<close>\n  definition \n    ll_is_pair_type :: \"bool \\<Rightarrow> 't::llvm_rep itself \\<Rightarrow> 't\\<^sub>1::llvm_rep itself \\<Rightarrow> 't\\<^sub>2::llvm_rep itself \\<Rightarrow> bool\"\n  where \"ll_is_pair_type anonymous _ _ _ \\<equiv> struct_of TYPE('t) = llvm_s_pair (struct_of TYPE('t\\<^sub>1)) (struct_of TYPE('t\\<^sub>2))\"\n\n  named_theorems ll_is_pair_type_thms \\<open>Isabelle-LLVM: Theorems for user-defined tuple types\\<close>\n  \n  lemma TERM_TYPE_I: \"TERM (TYPE ('a))\" .\n  \n  lemma ll_dest_pair_type:\n    assumes \"ll_is_pair_type anon TYPE('t::llvm_rep) TYPE('t\\<^sub>1::llvm_rep) TYPE('t\\<^sub>2::llvm_rep)\"\n    assumes \"TERM (TYPE('t))\"\n    shows \"TERM (TYPE('t\\<^sub>1))\" \"TERM (TYPE('t\\<^sub>2))\"\n    .\n  \n  \n  \n  subsection \\<open>General Functions\\<close>\n  ML \\<open> structure LLC_Lib = \n    struct\n      fun dest_llM (Type (@{type_name M},[T,@{typ unit},@{typ cost},@{typ llvm_memory},@{typ err}])) = T\n        | dest_llM ty = raise TYPE(\"dest_llM\",[ty],[]);\n      \n      val is_llM = can dest_llM\n\n      fun dest_ptrT (Type (@{type_name ptr},[T])) = T\n        | dest_ptrT ty = raise TYPE(\"dest_ptrT\",[ty],[]);\n      \n      fun dest_numeralT (Type (@{type_name \\<open>bit0\\<close>},[ty])) = 2*dest_numeralT ty\n        | dest_numeralT (Type (@{type_name \\<open>bit1\\<close>},[ty])) = 2*dest_numeralT ty+1\n        | dest_numeralT (Type (@{type_name \\<open>num0\\<close>},[])) = 0\n        | dest_numeralT (Type (@{type_name \\<open>num1\\<close>},[])) = 1\n        | dest_numeralT ty = raise TYPE (\"dest_numeralT\",[ty],[])\n    \n      fun dest_wordT (Type (@{type_name word},[T])) = dest_numeralT T\n        | dest_wordT T = raise TYPE(\"dest_wordT\",[T],[])\n        \n      fun dest_word_const (t) = HOLogic.dest_number t |>> dest_wordT\n      \n      fun dest_eqn @{mpat \"?lhs\\<equiv>?rhs\"} = (lhs,rhs)\n        | dest_eqn @{mpat \\<open>Trueprop (?lhs = ?rhs)\\<close>} = (lhs,rhs)\n        | dest_eqn t = raise TERM (\"dest_eqn\",[t])\n\n      val is_eqn = can dest_eqn\n        \n      val dest_eqn_thm = dest_eqn o Thm.prop_of  \n      \n      val lhs_of_eqn = fst o dest_eqn\n      val rhs_of_eqn = snd o dest_eqn\n      \n      val head_of_eqn =head_of o lhs_of_eqn\n      val head_of_eqn_thm = head_of_eqn o Thm.prop_of\n      \n      fun eqn_conv cvl cvr ct = let \n        val cv = Conv.arg1_conv cvl then_conv Conv.arg_conv cvr \n      in\n        (case Thm.term_of ct of\n          @{mpat \"_\\<equiv>_\"} => cv ct\n        | @{mpat \"Trueprop (_ = _)\"} => HOLogic.Trueprop_conv cv ct\n        | _ => raise CTERM (\"rhs_conv\", [ct]))\n      end\n      \n      fun lhs_conv cv = eqn_conv cv Conv.all_conv\n      fun rhs_conv cv = eqn_conv Conv.all_conv cv\n      \n              \n      (* TODO: Move *)\n      fun instantiate_uc (tyenv,tenv) thm = let\n        val thy = Thm.theory_of_thm thm\n        \n        val tyi = Vartab.dest tyenv |> map (fn (n,(s,T)) => ((n,s),Thm.global_ctyp_of thy T))\n        val ti = Vartab.dest tenv |> map (fn (n,(s,t)) => ((n,s),Thm.global_cterm_of thy t))\n      in\n        Thm.instantiate (tyi,ti) thm\n      end\n\n      fun is_monomorphic_const (Const (_,T)) = \n        not (Term.exists_subtype (fn TVar _ => true | TFree _ => true | _ => false) T)\n      | is_monomorphic_const _ = false\n\n      fun assert_monomorphic_const t = \n        is_monomorphic_const t orelse \n          raise TYPE(\"Expected monomorphic constant\",[fastype_of t],[t])\n            \n\n      fun unique_variant1 n name ntab = let\n        val name' = if n=0 then name else name ^ Int.toString n\n      in    \n        if Symtab.defined ntab name' then unique_variant1 (n+1) name ntab\n        else (name', Symtab.insert_set name' ntab)\n      end\n      \n      val unique_variant = unique_variant1 0\n      \n      \n      fun the_assert msg NONE = raise Fail msg \n         | the_assert _ (SOME x) = x \n      \n      \n      fun dest_is_pair_type_thm thm = case Thm.prop_of thm of \n        @{mpat (typs) \"Trueprop (ll_is_pair_type \n            ?anon \n            TYPE(?'v_t::llvm_rep) \n            TYPE(?'v_ta::llvm_rep) \n            TYPE(?'v_tb::llvm_rep))\"} => let \n              val anon = case anon of @{mpat \"True\"} => true | @{mpat \"False\"} => false | _ => raise THM(\"dest_is_pair_type_thm: Not a literal Boolean\",~1,[thm])\n            in\n              (anon,t,ta,tb)\n            end\n      | _ => raise THM(\"dest_is_pair_type_thm\",~1,[thm])\n         \n      \n      fun expand_eta_all t = let\n        fun declare_bnames (Free (a,_)) = Name.declare a\n          | declare_bnames (Abs (x,_,t)) = declare_bnames t #> Name.declare x\n          | declare_bnames (t1$t2) = declare_bnames t1 #> declare_bnames t2\n          | declare_bnames _ = I\n      \n        val context = declare_bnames t Name.context\n        val Ts = binder_types (fastype_of t)\n        val xTs = Name.invent context \"x\" (length Ts) ~~ Ts\n      \n        fun exp [] t = t\n          | exp (_::Ts) (Abs (x,T,t)) = Abs (x,T,exp Ts t)\n          | exp ((x,T)::Ts) t = Abs (x,T,exp Ts (incr_boundvars 1 t $ Bound 0))\n        \n      in\n        exp xTs t\n      end  \n      \n\n      fun dest_head (Const nt) = nt\n        | dest_head (Free nt) = nt\n        | dest_head t = raise TERM(\"dest_head\", [t])\n            \n      val is_valid_head = can dest_head\n      fun check_valid_head f = \n        (is_valid_head f orelse raise TERM(\"Invalid head (expected const or free)\",[f]); f)\n      \n      val name_of_head = fst o dest_head\n      \n      val llc_compile_while =\n        Attrib.setup_config_bool @{binding llc_compile_while} (K true)\n      \n    end\n  \\<close>\n  \n  subsection \\<open>Intermediate Representation\\<close>\n  text \\<open>\n    The code generator translates Isabelle terms into this intermediate representation,\n    and then generates LLVM code from this. \n    No transformations are done on the intermediate representation, but it merely serves \n    to cleanly separate the interpretation and checking of Isabelle terms, and the generation\n    of LLVM code.\n  \\<close>\n  \n  (*\n  TODO: conceptually, named types should be disambiguated during monomorphization,\n    such that all named types come without type parameters!\n    Is this feasible? Monomorphization would have to define new types.\n  *)  \n  \n  ML \\<open> structure LLC_Intermediate = \n    struct\n    \n      (* LLC intermediate representation. Somewhere in between Isabelle and LLVM-IR *)    \n      \n      datatype llc_type = TInt of int | TPtr of llc_type | TPair of llc_type*llc_type | TNamed of string\n      datatype llc_const = CInit | CInt of int | CNull\n      datatype llc_opr = OVar of string | OConst of llc_const\n      type llc_topr = llc_type * llc_opr\n      datatype llc_topr' = OOOp of llc_topr | OOType of llc_type\n\n      datatype llc_cmd = \n                 CmIf of llc_topr * llc_block * llc_block\n               | CmWhile of (llc_type * string) * llc_block * llc_block * llc_topr\n               | CmInstr of string * llc_topr' list\n               | CmCall of llc_type option * string * llc_topr list\n      \n          and llc_block =\n                BlBind of (llc_type * string) option * llc_cmd * llc_block\n              | BlReturn of llc_topr option \n    \n      datatype llc_eqn =              \n                EQN of llc_type option * string * (llc_type * string) list * llc_block\n    \n      datatype llc_named_type = Named_Type of string * llc_type list                \n                \n      fun pretty_mstr m s = Pretty.markup m [Pretty.str s]\n      \n      fun pretty_type (TInt w) = pretty_mstr Markup.keyword1 (\"i\" ^ Int.toString w)\n        | pretty_type (TPtr T) = Pretty.block [pretty_type T, Pretty.str \"*\"]\n        | pretty_type (TPair (T1,T2)) = Pretty.list \"{\" \"}\" (map pretty_type [T1,T2])\n        | pretty_type (TNamed name) = Pretty.str name\n      \n      fun pretty_const CInit = pretty_mstr Markup.keyword1 \"zeroinitializer\"\n        | pretty_const (CInt i) = pretty_mstr Markup.numeral (Int.toString i)\n        | pretty_const CNull = pretty_mstr Markup.keyword1 \"null\"\n\n      fun pretty_opr (OVar name) = Pretty.str name\n        | pretty_opr (OConst c) = pretty_const c\n        \n      fun pretty_topr (T,opr) = Pretty.block [pretty_type T, Pretty.brk 1, pretty_opr opr]\n      \n      fun pretty_topr' (OOOp x) = pretty_topr x \n        | pretty_topr' (OOType T) = pretty_type T\n      \n      fun pretty_tname (T,v) = Pretty.block [pretty_type T, Pretty.brk 1, Pretty.str v]  \n        \n      fun pretty_type' (SOME t) = pretty_type t \n        | pretty_type' NONE = pretty_mstr Markup.keyword1 \"void\"  \n        \n      fun pretty_cmd (CmIf (b, c1, c2)) = Pretty.block [\n          pretty_mstr Markup.keyword2 \"if\", Pretty.brk 1, pretty_topr b, Pretty.brk 1, pretty_mstr Markup.keyword2 \"then\", Pretty.fbrk,\n            Pretty.blk (4, [pretty_block c1]),\n            Pretty.fbrk, pretty_mstr Markup.keyword2 \"else\", Pretty.fbrk,\n            Pretty.blk (4, [pretty_block c2])\n          ]  \n        | pretty_cmd (CmWhile (v,b,c,s)) = Pretty.block [\n            pretty_mstr Markup.keyword2 \"while\", Pretty.enclose \"[\" \"]\" [pretty_tname v], Pretty.fbrk, \n              Pretty.blk (4, [pretty_block b]),\n              Pretty.fbrk, pretty_mstr Markup.keyword2 \"do\", Pretty.fbrk,\n              Pretty.blk (4, [pretty_block c]),\n              Pretty.fbrk, pretty_mstr Markup.keyword2 \"init \", pretty_topr s\n          ] \n        | pretty_cmd (CmInstr (name,ops)) = Pretty.block [Pretty.str name, Pretty.brk 1, Pretty.list \"\" \"\" (map pretty_topr' ops)]\n        | pretty_cmd (CmCall (T,name,ops)) = Pretty.block [pretty_type' T, pretty_mstr Markup.keyword2 \" call \", Pretty.str name, Pretty.brk 1, Pretty.list \"(\" \")\" (map pretty_topr ops)]\n        \n      and pretty_block blk = let\n        fun pblst (BlBind (SOME tv,c,b)) = Pretty.block [pretty_tname tv, Pretty.str \" = \", pretty_cmd c] :: pblst b\n          | pblst (BlBind (NONE,c,b)) = pretty_cmd c :: pblst b\n          | pblst (BlReturn NONE) = [pretty_mstr Markup.keyword2 \"return\"]\n          | pblst (BlReturn (SOME x)) = [Pretty.block [pretty_mstr Markup.keyword2 \"return \",pretty_topr x]]\n          \n      in\n        Pretty.block (Pretty.fbreaks (pblst blk))\n      end\n        \n      fun pretty_eqn (EQN (ty,name,params,block)) = Pretty.block [\n        Pretty.block [pretty_type' ty, Pretty.brk 1, Pretty.str name, Pretty.list \"(\" \")\" (map pretty_tname params), Pretty.str \" {\", \n          Pretty.fbrk, Pretty.blk (4,[pretty_block block]), Pretty.fbrk, Pretty.str \"}\"], Pretty.fbrk\n        ]\n\n      fun pretty_eqns eqns = Pretty.block (Pretty.fbreaks (map pretty_eqn eqns))\n      \n      fun pretty_named_type (Named_Type (name,tys)) = Pretty.block [pretty_mstr Markup.keyword3 \"type \", Pretty.str name, Pretty.str \" = \", \n        Pretty.list \"{\" \"}\" (map pretty_type tys) ]\n      \n      fun pretty_named_tys ntys = Pretty.block (Pretty.fbreaks (map pretty_named_type ntys))\n        \n      fun pretty_llc (ntys,eqns) = Pretty.block [pretty_named_tys ntys, Pretty.fbrk, pretty_eqns eqns]\n\n    end\n  \\<close>\n        \n  subsection \\<open>Isabelle Term Parser\\<close>\n  text \\<open>Parser from Isabelle terms to intermediate representation\\<close>\n  ML \\<open> structure LLC_Compiler = \n    struct\n      open LLC_Lib LLC_Intermediate\n    \n      (* Maps Isabelle type names to named type theorems *)\n      structure Named_Type_Tab = Proof_Data (\n        type T = thm Symtab.table\n        val init = K Symtab.empty\n      )\n\n      (* Record type instance: LLVM name and field types *)\n      type named_type_inst = string * llc_type list\n      \n      (* Maps instantiated (monomorphic) Isabelle types to instances *)\n      structure NTInst_Tab = Proof_Data (\n        type T = named_type_inst Typtab.table\n        val init = K Typtab.empty\n      )\n\n      fun build_named_type_tables ctxt = let\n        fun check_pt thm = let\n          val (_, typ, typa, typb) = dest_is_pair_type_thm thm\n          val _ = is_Type typ orelse raise TYPE(\"check_pt: Expected type\",[typ],[])\n          val (tname,args) = dest_Type typ\n          \n          val _ = forall is_TVar args orelse raise TYPE(\"check_pt: Expected simple type\",[typ],[])\n          \n          val tvars = Term.add_tvarsT typ []\n          val tvarsa = Term.add_tvarsT typa []\n          val tvarsb = Term.add_tvarsT typb []\n          \n          val _ = subset op= (tvarsa, tvars) andalso subset op= (tvarsb, tvars)\n            orelse raise TYPE(\"check_pt: additional type vars in element types\",[typ,typa,typb],[])\n          \n        in\n          (tname,thm)\n        end\n        \n        val typtab = Named_Theorems.get ctxt @{named_theorems ll_is_pair_type_thms} |> map check_pt |> Symtab.make\n      in\n        ctxt\n        |> Named_Type_Tab.put typtab\n      \n      end\n      \n      fun mk_type_thm ctxt T = Thm.instantiate' [SOME (Thm.ctyp_of ctxt T)] [] @{thm TERM_TYPE_I}\n      val dest_type_thm = Thm.prop_of #> Logic.dest_term #> Logic.dest_type\n\n      fun inst_pair_type ctxt (T as Type(tname,_)) = let\n        val thm = Symtab.lookup (Named_Type_Tab.get ctxt) tname\n        val _ = is_none thm andalso raise TYPE(\"Not a registered pair type\",[T],[]);\n        val thm = the thm\n        val (anon,_,_,_) = dest_is_pair_type_thm thm\n      \n        val ftypes = map (fn x => dest_type_thm (x OF [thm,mk_type_thm ctxt T])) @{thms ll_dest_pair_type}\n      in\n        (anon,ftypes)\n      end\n      | inst_pair_type _ T = raise TYPE(\"Invalid type for pair type\",[T],[])\n      \n      fun llc_parse_type (Type (@{type_name word},[T])) ctxt = (dest_numeralT T |> TInt, ctxt)\n        | llc_parse_type (Type (@{type_name ptr},[T])) ctxt = llc_parse_type T ctxt |>> TPtr\n        | llc_parse_type (T as Type _) ctxt = llc_make_type_inst T ctxt\n        | llc_parse_type T _ = raise TYPE (\"llc_parse_type: \",[T],[])\n      and\n      (* Lookup or make named type instance *)\n      llc_make_type_inst T ctxt = case Typtab.lookup (NTInst_Tab.get ctxt) T of\n        SOME (name,_) => (TNamed name, ctxt)\n      | NONE => let\n          val (tname,_) = dest_Type T\n          \n          (* Get anonymity and instantiated field types *)\n          val (anon,field_types) = inst_pair_type ctxt T\n        in  \n          if anon then let\n            (* Recursively parse field types *)\n            val (field_ltypes,ctxt) = fold_map llc_parse_type field_types ctxt\n            \n            val (lta,ltb) = case field_ltypes of\n              [lta,ltb] => (lta,ltb)\n            | _ => raise TYPE(\"Internal: Currently expecting exactly 2 fields!\",T::field_types,[])\n          in\n            (TPair (lta,ltb), ctxt)\n          end\n          else let\n            (* Make name variant *)\n            val used_names = NTInst_Tab.get ctxt |> Typtab.dest |> map (fst o snd) |> Name.make_context\n            val (lname,_) = Name.variant (Name.desymbolize NONE tname) used_names\n            \n            (* Register this instance, with empty fields first *)\n            val ctxt = NTInst_Tab.map (Typtab.update (T,(lname,[]))) ctxt\n            \n            (* Recursively parse field types *)\n            val (field_ltypes,ctxt) = fold_map llc_parse_type field_types ctxt\n            \n            (* Register fields for this instance *)\n            val ctxt = NTInst_Tab.map (Typtab.update (T,(lname,field_ltypes))) ctxt\n        \n          in\n            (TNamed lname, ctxt)\n          end\n        end\n    \n      fun compute_fun_names fixes thms = let\n        val _ = map (assert_monomorphic_const o fst) fixes\n      \n        val ftab = Termtab.make fixes\n        val names = fold (fn (_,n) => Symtab.update_new (n,())) fixes Symtab.empty\n        \n        fun add_thm thm (ftab,names) = let\n          val c = head_of_eqn_thm thm\n        in\n          if Termtab.defined ftab c then\n            (ftab,names)\n          else let\n            val n = name_of_head c |> Name.desymbolize NONE\n            val (n,names) = unique_variant n names\n            val ftab = Termtab.update_new (c,n) ftab\n          in\n            (ftab,names)\n          end\n        end\n        \n        val (ftab,_) = fold add_thm thms (ftab,names)\n      in\n        ftab\n      end\n\n                \n      (* TODO/FIXME: Populate with actual instructions! Register them, together with their compilers! *)  \n      fun is_llvm_instr name = String.isPrefix \"LLVM_Shallow.ll_\" name\n                \n      fun llc_parse_vtype (Type (@{type_name unit},[])) ctxt = (NONE, ctxt)\n        | llc_parse_vtype T ctxt = llc_parse_type T ctxt |>> SOME\n        \n      fun llc_parse_const @{mpat (typs) \\<open>init::?'v_T::llvm_rep\\<close>} ctxt = llc_parse_type T ctxt |>> (fn T => (T,CInit))\n        | llc_parse_const @{mpat (typs) \\<open>null::?'v_T::llvm_rep ptr\\<close>} ctxt = llc_parse_type T ctxt |>> (fn T => (TPtr T, CNull))\n        | llc_parse_const t ctxt = case try dest_word_const t of\n            SOME (w,v) => ((TInt w, CInt v), ctxt)\n          | NONE => raise TERM (\"llc_parse_const: \",[t])\n      \n      local    \n\n        type Tstored = (llc_type * string) option list\n            \n        local\n          val env_empty = (Symtab.empty,Termtab.empty,[])\n          \n          structure LLC_Env = Proof_Data (\n            type T = Symtab.set * (llc_type * string) Termtab.table * (llc_type * string) option list   \n            fun init _ = env_empty\n          )\n          \n        in\n\n          val env_init = LLC_Env.put env_empty\n          val env_save = #3 o LLC_Env.get \n          fun env_restore bnds ctxt = let\n            val (syms,params,_) = LLC_Env.get ctxt\n            val ctxt = LLC_Env.put (syms,params,bnds) ctxt\n          in ctxt end\n        \n          (* val env_syms = LLC_Env.get #> #1 *)\n          val env_params = LLC_Env.get #> #2\n          val env_bnds = LLC_Env.get #> #3\n                \n          fun make_uniqueN n tab name = let\n            val name' = if n=0 then name else name ^ Int.toString n\n          in\n            if Symtab.defined tab name' then\n              make_uniqueN (n+1) tab name\n            else\n              name'\n          end\n          \n          val make_unique = make_uniqueN 0\n          \n          \n          fun env_add_sym name ctxt = let\n            val (syms,params,bnds) = LLC_Env.get ctxt\n            val name = Name.desymbolize NONE name |> make_unique syms\n            val syms = Symtab.insert_set name syms\n            val ctxt = LLC_Env.put (syms,params,bnds) ctxt\n          in\n            (name,ctxt)\n          end\n          \n          fun env_add_bound lty name ctxt = let\n            val (name,ctxt) = env_add_sym name ctxt\n            val (syms,params,bnds) = LLC_Env.get ctxt\n            val bnds = SOME (lty,name)::bnds\n            val ctxt = LLC_Env.put (syms,params,bnds) ctxt\n          in\n            (name,ctxt)\n          end\n          \n          fun env_add_unit_bound ctxt = let\n            val (syms,params,bnds) = LLC_Env.get ctxt\n            val ctxt = LLC_Env.put (syms,params,NONE::bnds) ctxt\n          in\n            ctxt\n          end\n          \n          fun env_add_param v ctxt = let\n            val (iname,ty) = dest_Var v\n            val name = fst iname\n            val (lty,ctxt) = llc_parse_type ty ctxt\n          \n            val (name,ctxt) = env_add_sym name ctxt\n            val (syms,params,bnds) = LLC_Env.get ctxt\n            val params = Termtab.update_new (v,(lty,name)) params\n            val ctxt = LLC_Env.put (syms,params,bnds) ctxt\n          in\n            ((lty,name),ctxt)\n          end\n        end\n\n        fun env_lookup_bound ctxt i = case nth (env_bnds ctxt) i of SOME x => x | NONE => raise TERM (\"Reference to bound unit variable\",[])\n        fun env_lookup_param ctxt v = Termtab.lookup (env_params ctxt) v |> the\n                \n      \n        fun env_parse_add_bound T x ctxt = case llc_parse_vtype T ctxt of\n          (NONE,ctxt) => (NONE, env_add_unit_bound ctxt)\n        | (SOME ty,ctxt) => let\n            val (x,ctxt) = env_add_bound ty x ctxt\n          in\n            (SOME (ty,x),ctxt)\n          end  \n        \n        \n      in\n      \n        fun llc_parse_op (Bound i) ctxt = (env_lookup_bound ctxt i ||> OVar, ctxt)\n          | llc_parse_op (t as Var _) ctxt = (env_lookup_param ctxt t ||> OVar, ctxt)\n          | llc_parse_op t ctxt = llc_parse_const t ctxt |>> apsnd OConst\n      \n        fun llc_parse_op' (t as @{mpat \\<open>TYPE (_)\\<close>}) ctxt = llc_parse_type (Logic.dest_type t) ctxt |>> OOType\n          | llc_parse_op' t ctxt = llc_parse_op t ctxt |>> OOOp\n          \n        fun llc_parse_op_opt @{mpat \"()\"} ctxt = (NONE, ctxt)  \n          | llc_parse_op_opt t ctxt = llc_parse_op t ctxt |>> SOME\n          \n        fun llc_parse_op_bool t ctxt = let\n          val ((ty,x),ctxt) = llc_parse_op t ctxt\n          val _ = ty=TInt 1 orelse raise TERM (\"parse_op_bool: not a Boolean\",[t])\n        in\n          ((ty,x), ctxt)\n        end  \n          \n        structure Fun_Tab = Proof_Data (\n          type T = string Termtab.table \n          val init = K Termtab.empty\n        )\n        \n        \n        fun ftab_lookup ctxt f = let\n          val fname = Termtab.lookup (Fun_Tab.get ctxt) f\n          val _ = is_none fname andalso raise TYPE(\"No such function in ftab\",[fastype_of f],[f])\n          val fname = the fname\n        in fname end  \n\n        \n        fun check_valid_pair_inst ctxt t pT i fT = let\n          val (_,fTs') = inst_pair_type ctxt pT\n          val _ = i < length fTs' andalso fT = nth fTs' i\n            orelse raise TYPE(\"Invalid pair instruction instance\",[fastype_of (head_of t)],[t])\n          \n          (*val _ = Pretty.block [Pretty.str \"Type instance OK \", Syntax.pretty_term ctxt t, Pretty.str \" :: \", Syntax.pretty_typ ctxt (fastype_of t) ]\n            |> Pretty.string_of |> writeln\n          *)  \n        in\n          ()\n        end\n        \n        \n        fun check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_extract_fst :: ?'v_pT::llvm_rep \\<Rightarrow> ?'v_aT::llvm_rep llM\\<close>}) = \n              check_valid_pair_inst ctxt t pT 0 aT\n          | check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_extract_snd :: ?'v_pT::llvm_rep \\<Rightarrow> ?'v_bT::llvm_rep llM\\<close>}) = \n              check_valid_pair_inst ctxt t pT 1 bT\n          | check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_insert_fst :: ?'v_pT::llvm_rep \\<Rightarrow> ?'v_aT::llvm_rep \\<Rightarrow> _\\<close>}) = \n              check_valid_pair_inst ctxt t pT 0 aT\n          | check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_insert_snd :: ?'v_pT::llvm_rep \\<Rightarrow> ?'v_bT::llvm_rep \\<Rightarrow> _\\<close>}) = \n              check_valid_pair_inst ctxt t pT 1 bT\n          | check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_gep_fst :: ?'v_pT::llvm_rep ptr \\<Rightarrow> ?'v_aT::llvm_rep ptr llM\\<close>}) = \n              check_valid_pair_inst ctxt t pT 0 aT\n          | check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_gep_snd :: ?'v_pT::llvm_rep ptr \\<Rightarrow> ?'v_bT::llvm_rep ptr llM\\<close>}) = \n              check_valid_pair_inst ctxt t pT 1 bT\n          | check_llvm_struct_cmd _ _ = ()\n\n        \n                        \n        fun llc_parse_cmd rty t ctxt = \n          let\n            val (f,args) = strip_comb t\n\n            val _ = check_valid_head f            \n            val cname = name_of_head f\n            \n          in\n            case cname of\n              @{const_name \\<open>llc_if\\<close>} => (case args of \n                  [arg_cond,arg_then,arg_else] => let\n                    val (l_cond, ctxt) = llc_parse_op_bool arg_cond ctxt\n                    val (l_then,ctxt) = llc_parse_block arg_then ctxt\n                    val (l_else,ctxt) = llc_parse_block arg_else ctxt\n                  in\n                    (CmIf (l_cond,l_then,l_else), ctxt)\n                  end\n                | _ => raise TERM (\"parse_cmd: If needs 3 arguments\",[t])\n              )\n            | @{const_name \\<open>llc_while\\<close>} => (case args of [@{mpat \"\\<lambda>_. ?tcond\"}, @{mpat \"\\<lambda>xb. ?tbody\"}, arg_inits] => let\n                    val (inits,ctxt) = llc_parse_op arg_inits ctxt\n\n                    val env = env_save ctxt\n                                        \n                    val (sv,ctxt) = env_parse_add_bound xb_T xb ctxt\n                    val sv = case sv of NONE => raise TERM (\"While with unit-state not yet supported\",[t])\n                                      | SOME sv => sv\n                    \n                    val (cond,ctxt) = llc_parse_block tcond ctxt\n                    val (body,ctxt) = llc_parse_block tbody ctxt\n                    \n                    val ctxt = env_restore env ctxt\n                    \n                  in\n                    (CmWhile (sv, cond, body, inits), ctxt)\n                  end\n                | _ => raise TERM (\"parse_cmd: llc_while needs 3 arguments\",[t])\n              )\n            | @{const_name ll_call} => (case args of [fxs] => let\n                  val (cf,cargs) = strip_comb fxs\n                  val _ = check_valid_head cf\n                  val (ops,ctxt) = fold_map llc_parse_op cargs ctxt\n                  val fname = ftab_lookup ctxt cf\n                in (CmCall (rty, fname ,ops), ctxt) end\n                | _ => raise TERM (\"parse_cmd: ll_call needs one argument\",[t])\n              )\n            | _ => \n                if is_llvm_instr cname then let \n                    val _ = check_llvm_struct_cmd ctxt f\n                    val (ops,ctxt) = fold_map llc_parse_op' args ctxt\n                  in (CmInstr (cname,ops), ctxt) end\n                else let \n                    val _ = raise TERM(\"parse_cmd: command not recognized: \"^ cname ^\" (function calls must be wrapped in ll_call)\",[t])\n                    val (ops,ctxt) = fold_map llc_parse_op args ctxt\n                    val fname = ftab_lookup ctxt f\n                  in (CmCall (rty, fname ,ops), ctxt) end\n                   \n          end\n        and llc_parse_block @{mpat \"bind ?m (\\<lambda>x. ?f)\"} ctxt = \n          let \n            val (rty,ctxt) = llc_parse_vtype x_T ctxt\n            val (cmd, ctxt) = llc_parse_cmd rty m ctxt\n            val env = env_save ctxt\n            val (sv,ctxt) = env_parse_add_bound x_T x ctxt\n            val (blk,ctxt) = llc_parse_block f ctxt\n            val ctxt = env_restore env ctxt\n          in\n            (BlBind (sv,cmd,blk),ctxt)\n          end\n          | llc_parse_block @{mpat \"return ()\"} ctxt = (BlReturn NONE, ctxt)\n          | llc_parse_block @{mpat \"return ?x\"} ctxt = llc_parse_op x ctxt |>> SOME |>> BlReturn\n          | llc_parse_block t _ = raise TERM (\"llc_parse_block: structural error\",[t])\n         \n          \n        fun llc_parse_eqn @{mpat \"Trueprop (?lhs = ?rhs)\"} ctxt = let\n          val (hdc,params) = strip_comb lhs\n        \n          val _ = check_valid_head hdc\n          val _ = map (fn a => is_Var a orelse raise TERM (\"llc_parse_eqn: arguments must be vars\",[a])) params\n\n          val fname = ftab_lookup ctxt hdc \n          \n          val ctxt = env_init ctxt\n                    \n          val (params,ctxt) = fold_map env_add_param params ctxt\n          val (blk,ctxt) = llc_parse_block rhs ctxt\n          \n          val (rlty, ctxt) = llc_parse_vtype (dest_llM (fastype_of lhs)) ctxt\n\n          (* Erase meaningless environment after equation has been parsed! *)\n          val ctxt = env_init ctxt \n        in\n          (EQN (rlty,fname,params,blk), ctxt)\n        end\n        | llc_parse_eqn t _ = raise TERM (\"llc_parse_eqn: Expected equation of form lhs = rhs\", [t])\n          \n          \n      end      \n      \n      fun parse_cthms_aux thms ctxt = fold_map (llc_parse_eqn o Thm.prop_of) thms ctxt\n            \n      fun parse_cthms ftab thms ctxt = let\n        val ctxt = Fun_Tab.put ftab ctxt\n        val (eqns,ctxt) = parse_cthms_aux thms (build_named_type_tables ctxt)\n        \n        val named_tys = NTInst_Tab.get ctxt |> Typtab.dest |> map (Named_Type o snd)\n      in \n        (named_tys,eqns)\n      end\n          \n    end\n    \n  \\<close>  \n\n  subsection \\<open>LLVM Writer\\<close>\n  \n  text \\<open>LLVM Builder. Interface to build actual LLVM text.\\<close>\n  ML_file \"LLVM_Builder.ml\"\n  \n  text \\<open>Compiler from intermediate representation to actual LLVM text.\\<close>\n  ML \\<open> structure LLC_Backend = \n    struct\n      open LLC_Lib LLC_Intermediate\n    \n      type vtab = LLVM_Builder.value Symtab.table\n      type builder = vtab -> LLVM_Builder.regname -> llc_topr' list -> LLVM_Builder.T -> LLVM_Builder.value option\n    \n      fun llc_ty _ (TInt w) = LLVM_Builder.mkty_i w\n        | llc_ty b (TPtr ty) = LLVM_Builder.mkty_ptr (llc_ty b ty)\n        | llc_ty b (TPair (ty1, ty2)) = LLVM_Builder.mkty_struct [llc_ty b ty1, llc_ty b ty2]\n        | llc_ty b (TNamed name) = LLVM_Builder.mkty_named b name\n      \n      \n      fun llc_const_to_val b ty CInit = LLVM_Builder.mkc_zeroinit (llc_ty b ty)\n        | llc_const_to_val b ty (CInt v) = LLVM_Builder.mkc_i (llc_ty b ty) v\n        | llc_const_to_val b ty (CNull) = LLVM_Builder.mkc_null (llc_ty b ty)\n      \n      fun llc_op_to_val _ vtab (_,OVar x) = the_assert (\"Variable not in vtab \" ^ x) (Symtab.lookup vtab x)\n        | llc_op_to_val b _ (ty,OConst c) = llc_const_to_val b ty c\n        \n      \n      fun dstreg NONE = NONE | dstreg (SOME s) = SOME s\n        \n      \n      fun arith_instr_builder iname vtab dst [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_arith_instr iname b dst (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2) |> SOME\n      ) | arith_instr_builder _ _ _ _ _ = raise Fail \"arith_instr_builder: invalid arguments\"\n      \n      fun icmp_instr_builder cmpcode vtab dst [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_icmp_instr cmpcode b dst (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2) |> SOME\n      ) | icmp_instr_builder _ _ _ _ _ = raise Fail \"icmp_instr_builder: invalid arguments\"\n\n      fun ptrcmp_instr_builder cmpcode vtab dst [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_ptrcmp_instr cmpcode b dst (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2) |> SOME\n      ) | ptrcmp_instr_builder _ _ _ _ _ = raise Fail \"icmp_instr_builder: invalid arguments\"\n            \n      fun conv_instr_builder cmpcode vtab dst [OOOp x1, OOType ty] b = (\n        LLVM_Builder.mk_conv_instr cmpcode b dst (llc_op_to_val b vtab x1) (llc_ty b ty) |> SOME\n      ) | conv_instr_builder _ _ _ _ _ = raise Fail \"conv_instr_builder: invalid arguments\"\n\n      fun extract_value_builder idx vtab dst [OOOp x1] b = (\n        LLVM_Builder.mk_extractvalue b dst (llc_op_to_val b vtab x1) idx |> SOME\n      ) | extract_value_builder _ _ _ _ _ = raise Fail \"extract_value_builder: invalid arguments\"\n\n      fun insert_value_builder idx vtab dst [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_insertvalue b dst (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2) idx |> SOME\n      ) | insert_value_builder _ _ _ _ _ = raise Fail \"insert_value_builder: invalid arguments\"\n      \n      fun malloc_builder vtab dst [OOType ty, OOOp x] b = (\n        LLVM_Builder.mk_malloc b dst (llc_ty b ty) (llc_op_to_val b vtab x) |> SOME\n      ) | malloc_builder _ _ _ _ = raise Fail \"malloc_builder: invalid arguments\"\n            \n      fun free_builder vtab _ [OOOp x] b = (\n        LLVM_Builder.mk_free b (llc_op_to_val b vtab x); NONE\n      ) | free_builder _ _ _ _ = raise Fail \"free_builder: invalid arguments\"\n\n      fun load_builder vtab dst [OOOp x] b = (\n        LLVM_Builder.mk_load b dst (llc_op_to_val b vtab x) |> SOME\n      ) | load_builder _ _ _ _ = raise Fail \"load_builder: invalid arguments\"\n      \n      fun store_builder vtab _ [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_store b (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2); NONE\n      ) | store_builder _ _ _ _ = raise Fail \"store_builder: invalid arguments\"\n\n      fun ofs_ptr_builder vtab dst [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_ofs_ptr b dst (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2) |> SOME\n      ) | ofs_ptr_builder _ _ _ _ = raise Fail \"ofs_ptr_builder: invalid arguments\"\n      \n      fun gep_idx_builder idx vtab dst [OOOp x1] b = (\n        LLVM_Builder.mk_gep_idx b dst (llc_op_to_val b vtab x1) (LLVM_Builder.mkc_iw 32 idx) |> SOME\n      ) | gep_idx_builder _ _ _ _ _ = raise Fail \"gep_idx_builder: invalid arguments\"\n      \n      fun register_builder (b:builder) (n:string) = Symtab.update_new (n,b)\n      \n      fun register_prfx_builder prfx b n = let\n        val iname = Long_Name.base_name n |> unprefix prfx\n      in\n        register_builder (b iname) n\n      end\n\n      val builders = Symtab.empty\n        |> fold (register_prfx_builder \"ll_\" arith_instr_builder) \n          [@{const_name ll_add}, @{const_name ll_sub}, @{const_name ll_mul},\n           @{const_name ll_udiv}, @{const_name ll_urem}, @{const_name ll_sdiv}, @{const_name ll_srem},\n           @{const_name ll_shl}, @{const_name ll_lshr}, @{const_name ll_ashr},\n           @{const_name ll_and}, @{const_name ll_or}, @{const_name ll_xor}\n          ]\n        |> fold (register_prfx_builder \"ll_\" conv_instr_builder) [\n             @{const_name ll_trunc}, @{const_name ll_sext}, @{const_name ll_zext}\n          ]  \n        |> fold (register_prfx_builder \"ll_icmp_\" icmp_instr_builder) [\n             @{const_name ll_icmp_eq}, @{const_name ll_icmp_ne}, \n             @{const_name ll_icmp_slt}, @{const_name ll_icmp_sle}, \n             @{const_name ll_icmp_ult}, @{const_name ll_icmp_ule} \n          ]  \n        |> fold (register_prfx_builder \"ll_ptrcmp_\" ptrcmp_instr_builder) [\n             @{const_name ll_ptrcmp_eq}, @{const_name ll_ptrcmp_ne}\n          ]  \n        |> register_builder (extract_value_builder 0) @{const_name ll_extract_fst}          \n        |> register_builder (extract_value_builder 1) @{const_name ll_extract_snd}          \n        |> register_builder (insert_value_builder 0) @{const_name ll_insert_fst}          \n        |> register_builder (insert_value_builder 1) @{const_name ll_insert_snd}          \n\n        |> register_builder (malloc_builder) @{const_name ll_malloc}          \n        |> register_builder (free_builder) @{const_name ll_free}          \n        |> register_builder (load_builder) @{const_name ll_load}          \n        |> register_builder (store_builder) @{const_name ll_store}          \n      \n        |> register_builder (ofs_ptr_builder) @{const_name ll_ofs_ptr}          \n        |> register_builder (gep_idx_builder 0) @{const_name ll_gep_fst}          \n        |> register_builder (gep_idx_builder 1) @{const_name ll_gep_snd}          \n            \n\n      fun vtab_bind (SOME dst) (SOME v) vtab = Symtab.update_new (dst,v) vtab  \n        | vtab_bind (SOME dst) NONE _ = raise Fail (\"Void instruction bound to value (\" ^ dst ^ \") \")\n        | vtab_bind _ _ vtab = vtab\n        \n      fun build_instr b vtab dst (iname,args) = let\n        val bld = Symtab.lookup builders iname \n          |> the_assert (\"Unknown instruction \" ^ iname)\n          \n        val v = bld vtab (dstreg dst) args b\n      in\n        vtab_bind dst v vtab\n      end  \n      \n      fun build_call b vtab dst (rty,pname,args) = let\n        val args = map (llc_op_to_val b vtab) args\n        val rty = map_option (llc_ty b) rty\n        \n        val v = case rty of \n          NONE => (LLVM_Builder.mk_call_void b pname args; NONE)\n        | SOME rty => LLVM_Builder.mk_call b (dstreg dst) rty pname args |> SOME\n\n      in\n        vtab_bind dst v vtab\n      end\n      \n      fun build_if build_block b vtab dst (op_cond, blk_then, blk_else) = let\n        val l_then = LLVM_Builder.variant_label b \"then\"\n        val l_else = LLVM_Builder.variant_label b \"else\"\n        val l_ctd_if = LLVM_Builder.variant_label b \"ctd_if\"\n      \n        val _ = LLVM_Builder.mk_cbr b (llc_op_to_val b vtab op_cond) l_then l_else\n        \n        val _ = LLVM_Builder.open_bb b l_then \n        val r_then = build_block b vtab blk_then\n        val l_then' = LLVM_Builder.mk_br b l_ctd_if\n        \n        val _ = LLVM_Builder.open_bb b l_else\n        val r_else = build_block b vtab blk_else\n        val l_else' = LLVM_Builder.mk_br b l_ctd_if\n        \n        val _ = LLVM_Builder.open_bb b l_ctd_if\n        val res = case (r_then, r_else) of\n          (NONE,NONE) => NONE\n        | (SOME r_then, SOME r_else) => \n            SOME (LLVM_Builder.mk_phi' b (dstreg dst) [(r_then,l_then'), (r_else,l_else')])\n        | _ => raise Fail (\"If type mismatch (void/non-void)\")\n      in\n        vtab_bind dst res vtab\n      end\n      \n      (*\n        \"while [x] cond body s\" is compiled to\n      \n        br start (in l_this)\n        \n        start:\n          %s = Phi (l_this,%s) (l_body',%s')\n          %b = \\<lbrakk>cond\\<rbrakk>(x\\<mapsto>%s)\n          cbr %b body end\n      \n        body:\n          %s' = \\<lbrakk>body\\<rbrakk>(x\\<mapsto>%s)\n          br start (in l_body')\n          \n        end:\n          (returns %s)\n\n      *)\n      fun build_while build_block b vtab dst (sv, blk_cond, blk_body, op_init) = let\n        val l_start = LLVM_Builder.variant_label b \"while_start\"\n        val l_body = LLVM_Builder.variant_label b \"while_body\"\n        val l_end = LLVM_Builder.variant_label b \"while_end\"\n        \n        val v_init = llc_op_to_val b vtab op_init\n        val l_this = LLVM_Builder.mk_br b l_start\n\n        val (s_ty,sname) = apfst (llc_ty b) sv\n        \n        (* start: *)\n        val _ = LLVM_Builder.open_bb b l_start\n        \n        (* s = \\<Phi> [v_init,this] [\\<dots>] *)\n        val (phi_handle,v_state) = LLVM_Builder.mk_phi b s_ty (SOME sname)\n        val _ = LLVM_Builder.phi_add b phi_handle (v_init, l_this)\n        val vtab' = vtab_bind (SOME sname) (SOME v_state) vtab\n        \n        (* cond *)\n        val r_cond = build_block b vtab' blk_cond\n        val r_cond = case r_cond of SOME x => x | NONE => raise Fail \"While (bug): Cond-block with no result\"\n        \n        (* cbr r_cond body end *)\n        val _ = LLVM_Builder.mk_cbr b r_cond l_body l_end\n        \n        (* body: *)\n        val _ = LLVM_Builder.open_bb b l_body\n        val r_body = build_block b vtab' blk_body\n        val r_body = case r_body of SOME x => x | NONE => raise Fail \"While (bug): Body-block with no result\"\n        val l_body' = LLVM_Builder.mk_br b l_start\n        \n        (* add [r_body,l_body'] to \\<Phi>-node of l_start *)\n        val _ = LLVM_Builder.phi_add b phi_handle (r_body,l_body')\n        \n        val _ = LLVM_Builder.open_bb b l_end\n      in\n        vtab_bind dst (SOME v_state) vtab\n      end\n      \n      fun build_cmd _ b vtab dst (CmInstr ia) = build_instr b vtab dst ia\n        | build_cmd _ b vtab dst (CmCall na) = build_call b vtab dst na\n        | build_cmd ctxt b vtab dst (CmIf bte) = build_if (build_block ctxt) b vtab dst bte\n        | build_cmd ctxt b vtab dst (CmWhile cbi) = \n            if Config.get ctxt llc_compile_while then\n              build_while (build_block ctxt) b vtab dst cbi\n            else\n              raise Fail \"Direct while compilation disabled! Declare [[llc_compile_while=true]] to enable!\"\n            \n      and build_block ctxt b vtab (BlBind (dst,cmd,blk)) = let\n            val dst = map_option snd dst\n            val vtab = build_cmd ctxt b vtab dst cmd\n          in\n            build_block ctxt b vtab blk\n          end\n        | build_block _ b vtab (BlReturn x) = map_option (llc_op_to_val b vtab) x\n              \n        \n        \n      fun build_eqn ctxt b (EQN (rty, pname, params, blk)) = let\n        val params = map (apfst (llc_ty b)) params\n        val rty = map_option (llc_ty b) rty\n        \n        val paramsv = LLVM_Builder.open_proc b rty pname params\n        \n        val vtab = fold (Symtab.update_new o apfst snd) (params ~~ paramsv) Symtab.empty\n        \n        val retv = build_block ctxt b vtab blk\n        \n        val _ = LLVM_Builder.mk_return b retv\n        val _ = LLVM_Builder.close_proc b\n      in\n        ()\n      end\n\n      fun build_named_ty b (Named_Type (name,ftys)) = let\n        val ltys = map (llc_ty b) ftys\n        val sty = LLVM_Builder.mkty_struct ltys\n      in\n        LLVM_Builder.decl_named_ty b name sty\n      end\n          \n      fun compile_to_llvm ctxt (tys,eqns) = let\n        val b = LLVM_Builder.builder ()\n        (* val _ = LLVM_Builder.set_dbg_trace b true *)\n        val _ = map (build_named_ty b) tys\n        val _ = map (build_eqn ctxt b) eqns\n        val res = LLVM_Builder.string_of b\n      in\n        res\n      end\n      \n    end\n       \n  \\<close>  \n\n  ML \\<open> structure Simple_PP = struct\n    datatype T = Word of string | NWord of string | Space of bool | Newline of bool | Block of int * T list\n\n    datatype last_tk = NL | WR | NW | SP (* Newline | word | nonword | space *)\n    \n    type state = int * last_tk  (* indentation, last token *)\n    \n    val init_state = (0,NL)\n\n    val indentS = \"  \"\n    val spaceS = \" \"\n    val newlineS = \"\\n\"\n    \n    fun indentation i = implode (replicate i indentS)\n    \n    fun string_of' (Word kw) (i,NL) = (indentation i ^ kw, (i,WR))\n      | string_of' (Word kw) (i,WR) = (spaceS ^ kw, (i,WR))\n      | string_of' (Word kw) (i,NW) = (kw, (i,WR))\n      | string_of' (Word kw) (i,SP) = (kw, (i,WR))\n      \n      | string_of' (NWord c) (i,NL) = (indentation i ^ c, (i,NW))\n      | string_of' (NWord c) (i,WR) = (c, (i,NW))\n      | string_of' (NWord c) (i,NW) = (c, (i,NW))\n      | string_of' (NWord c) (i,SP) = (c, (i,NW))\n      \n      | string_of' (Newline true) (i,_) = (newlineS, (i,NL))\n      | string_of' (Newline false) (i,NL) = (\"\", (i,NL))\n      | string_of' (Newline false) (i,_) = (newlineS, (i,NL))\n      \n      | string_of' (Space true) (i,_) = (spaceS, (i,SP))\n      | string_of' (Space false) (i,NL) = (\"\", (i,SP))\n      | string_of' (Space false) (i,SP) = (\"\", (i,SP))\n      | string_of' (Space false) (i,_) = (spaceS, (i,SP))\n      \n      | string_of' (Block (ii,tks)) (i,lt) = let \n          val (strs,(_,lt)) = fold_map string_of' tks (i+ii,lt)\n          val str = implode strs\n        in (str,(i,lt)) end\n      \n    (* User Interface *)    \n    fun string_of tk = string_of' tk init_state |> fst\n            \n    (* Basic Functions *)\n    val word = Word\n    val nword = NWord\n    val brk = Newline false\n    val fbrk = Newline true\n    val sep = Space false\n    val fsep = Space true\n    \n    fun block_indent i tks = Block (i,tks)\n    val block = block_indent 0\n    \n    (* Derived Functions *)\n    \n    fun enclose_indent i lpar rpar prt = block_indent i ([nword lpar,prt,nword rpar])\n\n    fun line prts = block (prts@[fbrk])\n    \n    val enclose = enclose_indent 0\n    val paren = enclose \"(\" \")\"\n    val braces = enclose \"{\" \"}\"\n    \n    fun big_block lpar rpar prts = block [block_indent 1 (nword lpar::brk::prts),brk,nword rpar]\n    val big_braces = big_block \"{\" \"}\"\n    \n    fun separate sep prts = block (Library.separate sep prts)\n    val commas = separate (nword \",\")\n    val brks = separate brk\n    val fbrks = separate fbrk\n\n    fun list sep lpar rpar prts = enclose lpar rpar (separate sep prts)\n    val parlist = list (nword \", \") \"(\" \")\"\n        \n    (* enclose, enclose_indent, separate, ... *)\n  \n  end\n  \\<close>\n  \n  ML \\<open>structure Parser_Util = struct\n    fun scan_if_then_else scan1 scan2 scan3 xs = let\n      val r = SOME (Scan.catch scan1 xs) handle Fail _ => NONE\n    in\n      case r of \n        NONE => scan3 xs\n      | SOME (a,xs) => scan2 a xs\n    end\n    \n\n    (* Choices, where first parser's success commits to this choice *)  \n    infixr 0 |||\n\n    fun (g,p) ||| e = scan_if_then_else g p e\n        \n    fun lastg (g,p) = g :|-- p\n  \n    val pkw = Parse.keyword_markup (true,Markup.keyword1)\n    val pcm = Parse.keyword_markup (true,Markup.keyword2)\n\n    \n    fun parse_inner kws p ctxt src = let\n      val s = src |> apfst cartouche |> Symbol_Pos.explode |> Symbol_Pos.cartouche_content\n      val kws = kws |> map (fn x => ((x,Position.none),Keyword.no_spec))\n      val kws = Keyword.add_keywords kws Keyword.empty_keywords\n      val tks = s |> Token.tokenize kws {strict=true} \n      (*val _ = map (Token.reports kws) tks |> flat*)\n      val tks = filter Token.is_proper tks\n      \n      fun parse_all src = let\n        val src = map Token.init_assignable src\n        val (res,_) = Scan.catch (Scan.finite Token.stopper (p --| Scan.ahead Parse.eof)) src\n        \n        val rp = map Token.reports_of_value src |> flat\n        val _ = Context_Position.reports ctxt rp\n        \n        (*val _ = map Token.reports_of_value src |> flat*)\n      in\n        res\n      end\n      \n      val res = parse_all tks\n    in\n      res\n    end\n    \n        \n    \n  end\\<close> \n  \n  \n  ML \\<open>structure C_Interface = struct\n    datatype cprim = \n        PRIM_CHAR\n      | PRIM_SI8 | PRIM_UI8\n      | PRIM_SI16 | PRIM_UI16\n      | PRIM_SI32 | PRIM_UI32\n      | PRIM_SI64 | PRIM_UI64\n      | PRIM_NAMED of string\n    datatype cfield = FLD_NAMED of ctype * string | FLD_ANON of cfield * cfield\n         and ctype = CTY_PRIM of cprim | CTY_PTR of ctype | CTY_PAIR of cfield * cfield\n  \n         \n    datatype typedef = TYPEDEF of string * ctype\n    fun dest_tydef (TYPEDEF (n,t)) = (n,t)\n    val mk_tydef = TYPEDEF\n\n    (* Signature *)\n    datatype c_sig = CSIG of ctype option * string * ctype list \n    \n    \n         \n    (* Parsing *)\n    local open Parser_Util in\n    \n      (* TODO: Check for valid C identifier *)\n      val parse_id = Parse.short_ident\n      \n      val parse_cprim = \n         pcm \"char\" >> K PRIM_CHAR\n      || pcm \"int8_t\" >> K PRIM_SI8\n      || pcm \"int16_t\" >> K PRIM_SI16\n      || pcm \"int32_t\" >> K PRIM_SI32\n      || pcm \"int64_t\" >> K PRIM_SI64\n      || pcm \"uint8_t\" >> K PRIM_UI8\n      || pcm \"uint16_t\" >> K PRIM_UI16\n      || pcm \"uint32_t\" >> K PRIM_UI32\n      || pcm \"uint64_t\" >> K PRIM_UI64\n      || parse_id >> PRIM_NAMED\n  \n      fun mk_ptr ty [] = ty\n        | mk_ptr ty (_::xs) = CTY_PTR (mk_ptr ty xs)\n      \n      fun parse_cfield s = (\n           parse_ctype -- parse_id --| Parse.$$$ \";\" >> FLD_NAMED\n        || parse_fld_pair --| Parse.$$$ \";\" >> FLD_ANON\n      ) s\n      and parse_fld_pair s = (pkw \"struct\" |-- Parse.$$$ \"{\" |-- parse_cfield -- parse_cfield --| Parse.$$$ \"}\") s\n      and parse_ctype1 s = (\n           parse_cprim >> CTY_PRIM\n        || parse_fld_pair >> CTY_PAIR\n      ) s\n      and parse_ctype s = (\n        parse_ctype1 -- Scan.repeat (Parse.$$$ \"*\") >> (fn (ty,ptrs) => mk_ptr ty ptrs)\n      ) s\n         \n      val parse_rtype = parse_ctype >> SOME || pcm \"void\" >> K NONE\n      \n      val parse_typedef = pkw \"typedef\" |-- parse_ctype -- parse_id --| Parse.$$$ \";\" >> (fn (ty,name) => mk_tydef (name,ty))\n      val parse_typedefs = Scan.repeat parse_typedef\n    \n    end\n    \n    val ct_basic_kws =       [\n      \"auto\",\n      \"break\",\n      \"case\",\n      \"char\",\n      \"const\",\n      \"continue\",\n      \"default\",\n      \"do\",\n      \"double\",\n      \"else\",\n      \"enum\",\n      \"extern\",\n      \"float\",\n      \"for\",\n      \"goto\",\n      \"if\",\n      \"inline\",\n      \"int\",\n      \"long\",\n      \"register\",\n      \"restrict\",\n      \"return\",\n      \"short\",\n      \"signed\",\n      \"sizeof\",\n      \"static\",\n      \"struct\",\n      \"switch\",\n      \"typedef\",\n      \"union\",\n      \"unsigned\",\n      \"void\",\n      \"volatile\",\n      \"while\",\n      \"_Alignas\",\n      \"_Alignof\",\n      \"_Atomic\",\n      \"_Bool\",\n      \"_Complex\",\n      \"_Generic\",\n      \"_Imaginary\",\n      \"_Noreturn\",\n      \"_Static_assert\",\n      \"_Thread_local\"\n    ]\n    val ct_basic_kw_set = Symtab.make_set ct_basic_kws\n    \n    val ct_kws = \n    [\"(\",\")\",\";\",\"{\",\"}\",\"*\",\",\"] (* TODO: Complete this list *)      \n    @\n    ct_basic_kws\n    @\n    [\"int8_t\", \"int16_t\", \"int32_t\", \"int64_t\",\n     \"uint8_t\", \"uint16_t\", \"uint32_t\", \"uint64_t\"]\n      \n    (* Checking *)\n    \n    fun is_cid_start s = Symbol.is_ascii_letter s orelse s=\"_\"\n    fun is_cid_ctd s = is_cid_start s orelse Symbol.is_ascii_digit s\n    \n    fun is_c_identifier s =\n      size s > 0 andalso is_cid_start (String.substring (s, 0, 1)) andalso\n      forall_string is_cid_ctd s andalso\n      not (Symtab.defined ct_basic_kw_set s);\n         \n    fun check_identifier name = (is_c_identifier name orelse error (\"Invalid identifier \" ^ name); ())\n      \n\n    fun check_decl (decl,_) name = (Symtab.defined decl name orelse error (\"Undeclared type \" ^ name); ())\n    fun check_complete (decl,def) name = (check_decl (decl,def) name; Symtab.defined def name orelse error (\"Incomplete type \" ^ name); ())\n          \n    fun check_type dd (CTY_PRIM (PRIM_NAMED name)) = check_complete dd name\n      | check_type _ (CTY_PRIM _) = ()\n      | check_type dd (CTY_PTR (CTY_PRIM (PRIM_NAMED name))) = check_decl dd name\n      | check_type dd (CTY_PTR t) = check_type dd t\n      | check_type dd (CTY_PAIR (f1,f2)) = (check_field dd f1; check_field dd f2)\n    and check_field dd (FLD_NAMED (ty,name)) = (check_type dd ty; check_identifier name)\n      | check_field dd (FLD_ANON (f1,f2)) = (check_field dd f1; check_field dd f2)\n      \n    fun is_valid_rty (dd as (_,def)) (CTY_PRIM (PRIM_NAMED name)) = \n          (case Symtab.lookup def name of NONE => false | SOME t => is_valid_rty dd t)\n      | is_valid_rty _ (CTY_PRIM _) = true\n      | is_valid_rty _ (CTY_PTR _) = true\n      | is_valid_rty _ (CTY_PAIR _) = false\n    \n    fun check_valid_rty dd t = (is_valid_rty dd t orelse error \"Aggregate return type not supported by C\"; ())  \n      \n    fun check_rtype _ NONE = ()\n      | check_rtype dd (SOME t) = (check_type dd t; check_valid_rty dd t)\n      \n    fun check_csig dd (CSIG (rty,name,argtys)) = (\n      check_rtype dd rty;\n      check_identifier name;\n      map (check_type dd) argtys;\n      ()\n    ) handle ERROR msg => error (\"Signature \" ^ name ^ \": \" ^ msg)\n      \n    (* Check list of type definitions, and create lookup table *)\n    fun check_tydefs tydefs = let\n      val tydefs = map dest_tydef tydefs\n      val _ = map (check_identifier o fst) tydefs\n      val decl = Symtab.make_set (map fst tydefs)\n            \n      fun add_tydef (name,ty) def = let\n        val _ = check_identifier name\n        val _ = Symtab.defined def name andalso error (\"Duplicate typedef \" ^ name)\n        val _ = check_type (decl,def) ty\n        val def = Symtab.update (name,ty) def\n      in\n        def\n      end\n    \n      val def = fold add_tydef tydefs Symtab.empty\n    in\n      (decl,def)\n    end\n      \n    \n    (* Printing *)\n    local open Simple_PP in\n      (* TODO: Rename _to_Cs \\<mapsto> pretty_ *)\n      fun cprim_to_Cs PRIM_CHAR = word \"char\"\n        | cprim_to_Cs PRIM_SI8 = word \"int8_t\" \n        | cprim_to_Cs PRIM_SI16 = word \"int16_t\"\n        | cprim_to_Cs PRIM_SI32 = word \"int32_t\"\n        | cprim_to_Cs PRIM_SI64 = word \"int64_t\"\n        | cprim_to_Cs PRIM_UI8 = word \"uint8_t\" \n        | cprim_to_Cs PRIM_UI16 = word \"uint16_t\"\n        | cprim_to_Cs PRIM_UI32 = word \"uint32_t\"\n        | cprim_to_Cs PRIM_UI64 = word \"uint64_t\"\n        | cprim_to_Cs (PRIM_NAMED name) = word name\n                                                  \n      fun cfield_to_Cs (FLD_NAMED (ty,name)) = block [ctype_to_Cs ty, word name, nword \";\"]  \n        | cfield_to_Cs (FLD_ANON fs) = block [fldpair_to_Cs fs, nword \";\"]\n      and fldpair_to_Cs (f1,f2) = block [word \"struct\", sep, big_braces [line [cfield_to_Cs f1], line [cfield_to_Cs f2]]]\n      and ctype_to_Cs (CTY_PRIM t) = cprim_to_Cs t\n        | ctype_to_Cs (CTY_PTR t) = block [ctype_to_Cs t, nword \"*\"]\n        | ctype_to_Cs (CTY_PAIR fs) = fldpair_to_Cs fs\n        \n      fun tydef_to_Cs (TYPEDEF (name,ty)) = block [word \"typedef\", ctype_to_Cs ty, sep, word name, nword \";\"]\n      \n      val tydefs_to_Cs = fbrks o map tydef_to_Cs\n        \n      fun rty_to_Cs NONE = word \"void\" | rty_to_Cs (SOME ty) = ctype_to_Cs ty\n      \n      fun csig_to_Cs (CSIG (rty,name,partys)) = block [rty_to_Cs rty,fsep,word name,parlist (map ctype_to_Cs partys),word \";\"]\n                \n      val csigs_to_Cs = fbrks o map csig_to_Cs\n    end\n\n    \n    (* Interface to LLVM types *)\n    \n    local open LLC_Intermediate in      \n      (* TODO: Will loop on recursive types! *)\n      fun lty_of_prim _ PRIM_CHAR = TInt 8\n        | lty_of_prim _ PRIM_SI8 = TInt 8\n        | lty_of_prim _ PRIM_SI16 = TInt 16\n        | lty_of_prim _ PRIM_SI32 = TInt 32\n        | lty_of_prim _ PRIM_SI64 = TInt 64\n        | lty_of_prim _ PRIM_UI8 = TInt 8\n        | lty_of_prim _ PRIM_UI16 = TInt 16\n        | lty_of_prim _ PRIM_UI32 = TInt 32\n        | lty_of_prim _ PRIM_UI64 = TInt 64\n        | lty_of_prim ntab (PRIM_NAMED name) = \n            case Symtab.lookup ntab name of \n              NONE => error (\"Undefined named type \" ^ name)\n            | SOME ty => lty_of_ctype ntab ty  \n      and lty_of_cfield ntab (FLD_NAMED (ty,_)) = lty_of_ctype ntab ty\n        | lty_of_cfield ntab (FLD_ANON (f1,f2)) = TPair (lty_of_cfield ntab f1, lty_of_cfield ntab f2)\n      and lty_of_ctype ntab (CTY_PRIM t) = lty_of_prim ntab t               \n        | lty_of_ctype ntab (CTY_PTR t) = TPtr (lty_of_ctype ntab t)\n        | lty_of_ctype ntab (CTY_PAIR (f1,f2)) = TPair (lty_of_cfield ntab f1, lty_of_cfield ntab f2)\n    \n        \n      fun cty_of_lty (TInt 8) = CTY_PRIM PRIM_SI8\n        | cty_of_lty (TInt 16) = CTY_PRIM PRIM_SI16\n        | cty_of_lty (TInt 32) = CTY_PRIM PRIM_SI32\n        | cty_of_lty (TInt 64) = CTY_PRIM PRIM_SI64\n        | cty_of_lty (TInt w) = error (\"cty_of_lty: Unsupported integer width \" ^ Int.toString w)\n        | cty_of_lty (TPtr ty) = CTY_PTR (cty_of_lty ty)\n        | cty_of_lty (TPair (ty1,ty2)) = CTY_PAIR (FLD_NAMED (cty_of_lty ty1,\"fst\"), FLD_NAMED (cty_of_lty ty2,\"snd\"))\n        | cty_of_lty (TNamed name) = error (\"cty_of_lty: Named ltys not supported: \" ^ name)\n        \n        \n      val cty_of_rlty = map_option cty_of_lty  \n        \n    end\n  end\\<close>\n  \n  \n  ML \\<open>structure LLC_HeaderGen = struct\n    open C_Interface\n  \n    (* Optional signature *)\n    datatype raw_sig = RSIG of ctype option option * string * ctype option list option\n    \n    datatype sigspec = NAME of string | SIG of raw_sig\n    \n    \n    fun name_of_rsig (RSIG (_,name,_)) = name\n    fun name_of_sigspec (NAME name) = name | name_of_sigspec (SIG sg) = name_of_rsig sg\n    \n    fun short_sig name = NAME name\n    fun long_sig sg = SIG sg\n    \n    (* Parsing of optional signature *)\n    fun parse_wildcard p = Parse.underscore >> K NONE || p >> SOME\n\n    fun parse_parlist p = Parse.$$$ \"(\" |-- Parse.enum \",\" p --| Parse.$$$ \")\"\n        \n    val parse_long_sig = \n      parse_wildcard parse_rtype -- parse_id -- Scan.option (parse_parlist (parse_wildcard parse_ctype))\n      >> (fn ((r,n),p) => long_sig (RSIG (r,n,p)))\n                           \n    val parse_short_sig = parse_id >> short_sig  \n    val parse_sig = parse_long_sig || parse_short_sig\n      \n    val parse_raw_sig = Parse.position (Parse.cartouche || Parse.short_ident || Parse.string)\n    val parse_raw_tydefs = Parse.position Parse.cartouche\n    \n    val check_raw_tydefs = Parser_Util.parse_inner ct_kws parse_typedefs\n    val check_raw_sig = Parser_Util.parse_inner ct_kws parse_sig\n    \n    \n    fun check_sigs dd sigs = let\n      fun add_sig (sg as RSIG (rt,name,args)) tab = let  \n        val _ = map_option (check_rtype dd) rt\n        val _ = map_option (map (map_option (check_type dd))) args\n        val _ = check_identifier name\n        \n        val _ = Symtab.defined tab name andalso error (\"Duplicate name\")\n        \n        val tab = Symtab.update (name,sg) tab\n        \n      in tab end handle ERROR msg => error (\"Signature \" ^ name ^ \": \" ^ msg)\n        \n      val tab = fold add_sig sigs Symtab.empty\n    \n    in\n      tab\n    end \n    \n    fun match_sig dd (rty,args) (RSIG (crty,name,cargs)) = let\n      val argtys = map fst args\n      val crty = the_default (cty_of_rlty rty) crty\n      \n      val cargs = the_default (replicate (length argtys) NONE) cargs\n    \n      val _ = length argtys = length cargs orelse error (\"Wrong number of arguments\")\n      \n      val cargs = map (fn (lty,cty) => the_default (cty_of_lty lty) cty) (argtys ~~ cargs)\n      \n      (* Consistency check *)\n      fun check_match (lty,cty) = if lty_of_ctype (snd dd) cty = lty then () else error \"Type mismatch\" (* TODO: More specific error message *)\n      \n      val _ = case (rty,crty) of \n        (NONE,NONE) => () \n      | (SOME lty, SOME cty) => check_match (lty,cty)\n      | _ => error \"Return type voidness mismatch\"\n      \n      val _ = map check_match (argtys ~~ cargs)\n    \n    in\n      CSIG (crty,name,cargs)\n    end handle ERROR msg => error (\"Signature \" ^ name ^ \": \" ^ msg)\n    \n    \n    fun make_header hfname tydefs sigspecs eqns = let\n      val sigs = map_filter (fn (NAME _) => NONE | (SIG sg) => SOME sg) sigspecs\n    \n      val dd = check_tydefs tydefs\n      val stab = check_sigs dd sigs\n\n      fun make_hd_id name = let \n        val name = Symbol.explode name |> filter is_cid_ctd |> map Symbol.to_ascii_upper |> implode\n        val name = \"_\" ^ name ^ \"_H\"\n      in name end  \n        \n      val hfname = make_hd_id hfname\n      \n            \n      fun process_eqn (LLC_Intermediate.EQN (rty,name,args,_)) = case Symtab.lookup stab name of\n        NONE => NONE\n      | SOME sg => SOME (match_sig dd (rty,args) sg)\n      \n      val csigs = map_filter process_eqn eqns\n      \n      val _ = map (check_csig dd) csigs\n      \n      val h_to_C = let\n        open Simple_PP\n        val hfsym = word hfname\n      in block [\n          (* TODO: Include information for which version of ll-file this has been generated! *)\n          line [word \"// Generated by Isabelle-LLVM. Do not modify.\"],\n          line [word \"#ifndef\", hfsym],\n          line [word \"#define\", hfsym, word \"1\"],\n          fbrk, fbrk,\n          tydefs_to_Cs tydefs,\n          fbrk, fbrk,\n          csigs_to_Cs csigs,\n          fbrk, fbrk,\n          line [word \"#endif\"]\n        ]\n      end\n      \n    in\n      case csigs of [] => NONE | _ => SOME (Simple_PP.string_of h_to_C)\n    end\n    \n    \n  end    \n    \n\\<close>    \n \n(*\noops   \n    \n    local open LLC_Intermediate Simple_PP in      \n         \n\n        \n\n          \n        fun resolve_lty_def (name,cty) ntab = \n          Symtab.update_new (name,lty_of_ctype ntab cty) ntab\n          handle Symtab.DUP _ => error (\"Duplicate named type \" ^ name)\n\n        fun resolve_lty_defs defs = fold resolve_lty_def defs Symtab.empty\n        \n        (*\n        xxx, ctd here: \n          Allow named types for function return types and arguments.\n          Look them up in ntab, and check for compatibility!\n        *)\n          \n          \n          \n      end\n      \n      val parse_tyn = parse_id >> SOME || Parse.underscore >> (fn _ => NONE)\n      val parse_rtyn = Parse.$$$ \"void\" >> (K (SOME NONE)) || parse_tyn >> map_option SOME\n      val parse_parlist = Parse.$$$ \"(\" |-- Parse.enum \",\" parse_tyn --| Parse.$$$ \")\"\n      val parse_long_sig = parse_rtyn -- parse_id -- parse_parlist\n        >> (fn ((rty,name),pars) => (name,RSIG (rty,SOME pars)))\n      \n      val parse_short_sig = Parse.short_ident >> (fn name => (name,RSIG (NONE,NONE)))\n      val parse_sig = parse_long_sig || parse_short_sig\n      \n            \n      \n      \n      \n      \n      val parse_sig_spec = Parse.position (Parse.cartouche || Parse.short_ident || Parse.string)\n      val parse_tydefs_spec = Parse.position Parse.cartouche\n\n            \n\n      val check_sig_spec = parse_inner ct_kws parse_sig\n      val check_tydefs_spec = parse_inner ct_kws parse_typedefs\n      \n      fun check_ctype tdtab lty cty = let\n        val lty' = lty_of_ctype tdtab cty\n        val _ = lty = lty' orelse error \"Declared ctype does not match ltype\" (* TODO: Better error message *)\n      in\n        cty\n      end\n      \n      fun mk_ctype tdtab (lty, NONE) = check_ctype tdtab lty (cty_of_lty lty)\n        | mk_ctype tdtab (lty, SOME name) = check_ctype tdtab lty (CTY_PRIM (PRIM_NAMED name))\n      \n      fun mk_rtype _ NONE NONE = NONE\n        | mk_rtype _ NONE (SOME NONE) = NONE\n        | mk_rtype _ NONE (SOME (SOME _)) = error \"Return type declared for void function\"\n        | mk_rtype _ (SOME _) (SOME NONE) = error \"Void type for non-void function\"\n        | mk_rtype tdtab (SOME lty) NONE = SOME (mk_ctype tdtab (lty, NONE))\n        | mk_rtype tdtab (SOME lty) (SOME (SOME name)) = SOME (mk_ctype tdtab (lty,SOME name))\n        \n      fun mk_csig tdtab (LLC_Intermediate.EQN (rty,name,pars,_), RSIG (rtyn,partyns)) = let\n        val rcty = mk_rtype tdtab rty rtyn\n        \n        val partyns = the_default (map (K NONE) pars) partyns\n        val pars = map fst pars\n        \n        val _ = length pars = length partyns orelse error \"Parameter number mismatch\"\n        val cpartys = (pars ~~ partyns) |> map (mk_ctype tdtab)\n        \n      in\n        CSIG (rcty,name,cpartys)\n      end handle ERROR msg => error (\"Signature for \" ^ name ^ \": \" ^ msg)\n        \n      fun is_valid_rty tdtab (CTY_PRIM (PRIM_NAMED name)) = \n            (case Symtab.lookup tdtab name of NONE => false | SOME t => is_valid_rty tdtab t)\n            \n        | is_valid_rty _ (CTY_PRIM _) = true\n        | is_valid_rty _ (CTY_PTR _) = true\n        | is_valid_rty _ (CTY_PAIR _) = false\n        \n      fun is_valid_rty' tdtab = the_default true o map_option (is_valid_rty tdtab)\n      \n      fun check_csig tdtab (CSIG (rty,name,_)) = let\n        (* TODO: Are there more restrictions? *)\n        \n        fun err msg = error (\"In function \" ^ name ^ \": \" ^ msg)\n      \n        val _ = is_valid_rty' tdtab rty orelse err \"Complex return type not supported by C\"\n        val _ = is_c_identifier name orelse err \"Invalid name\"\n      in () end  \n      \n      fun check_tydef_name (name,_) = ( is_c_identifier name orelse error (\"Invalid name \" ^ name)  ;())\n      \n                \n      fun make_header hfname eqns sigtab tydefs = let\n      \n        fun is_valid_cidchar s = \n          Symbol.is_ascii_letter s \n          orelse Symbol.is_ascii_digit s\n          orelse s=\"_\"\n\n        fun make_hd_id name = let \n          val name = Symbol.explode name |> filter is_valid_cidchar |> map Symbol.to_ascii_upper |> implode\n          val name = \"_\" ^ name ^ \"_H\"\n        in name end  \n          \n        val hfname = make_hd_id hfname\n      \n        val _ = map check_tydef_name tydefs\n        \n        val tdtab = resolve_lty_defs tydefs\n        \n        (* Filter equations for which header entry is to be generated *)\n        val eqns = map_filter (fn eqn as LLC_Intermediate.EQN (_,name,_,_) => case Symtab.lookup sigtab name of\n            NONE => NONE\n          | SOME sg => SOME (eqn,sg)\n        ) eqns\n\n        (* Generate header entries *)\n        val csigs = map (mk_csig tdtab) eqns\n        \n        val _ = map (check_csig (Symtab.make tydefs)) csigs\n        \n        (* TODO: Check that only ASCII-Names are used *)\n\n        val h_to_C = let\n          open Simple_PP\n          val hfsym = word (\"_\"^hfname^\"_H\")\n        in block [\n            (* TODO: Include information for which version of ll-file this has been generated! *)\n            line [word \"// Generated by Isabelle-LLVM. Do not modify.\"],\n            line [word \"#ifndef\", hfsym],\n            line [word \"#define\", hfsym, word \"1\"],\n            fbrk, fbrk,\n            tydefs_to_Cs tydefs,\n            fbrk, fbrk,\n            csigs_to_Cs csigs,\n            fbrk, fbrk,\n            line [word \"#endif\"]\n          ]\n        end\n      \n      in\n        case csigs of [] => NONE | _ => SOME (Simple_PP.string_of h_to_C)\n      end\n  \n    end\n  \\<close>\n  *)\n  \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm_time", "sha": "42dd7f59998d76047bb4b6bce76d8f67b53a08b6", "save_path": "github-repos/isabelle/lammich-isabelle_llvm_time", "path": "github-repos/isabelle/lammich-isabelle_llvm_time/isabelle_llvm_time-42dd7f59998d76047bb4b6bce76d8f67b53a08b6/thys/basic/kernel/LLVM_Codegen.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5583269943353744, "lm_q1q2_score": 0.30309522522873805}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(* License: BSD, terms see file ./LICENSE *)\n\n(*\n  Structures supporting CTypes.\n  Primarily sets up types, defines pointers and the raw heap view.\n*)\n\ntheory CTypesBase\nimports\n  \"./$L4V_ARCH/Addr_Type\"\n  \"~~/src/HOL/Library/Prefix_Order\"\n  \"../../lib/Word_Lib/Signed_Words\"\nbegin\n\nsection \"Type setup\"\n\ntype_synonym byte = \"8 word\"\n\nclass unit_class =\n  assumes there_is_only_one: \"x = y\"\n\ninstantiation unit :: unit_class\nbegin\ninstance by (intro_classes, simp)\nend\n\nsubsection \"Pointers\"\n\ndatatype 'a ptr = Ptr addr\n\nabbreviation\n  NULL :: \"'a ptr\" where\n  \"NULL \\<equiv> Ptr 0\"\n\nprimrec\n  ptr_val :: \"'a ptr \\<Rightarrow> addr\"\nwhere\n  ptr_val_def: \"ptr_val (Ptr a) = a\"\n\nprimrec\n  ptr_coerce :: \"'a ptr \\<Rightarrow> 'b ptr\" where\n  \"ptr_coerce (Ptr a) = Ptr a\"\n\ndefinition\n  (* no ctype/memtype-class constraints on these so as to allow comparison of\n     void * pointers, which are represented as Isabelle type unit ptr *)\n  ptr_less :: \"'a ptr \\<Rightarrow> 'a ptr \\<Rightarrow> bool\" (infixl \"<\\<^sub>p\" 50) where\n  \"p <\\<^sub>p q \\<equiv> ptr_val p < ptr_val q\"\n\ndefinition\n  ptr_le :: \"'a ptr \\<Rightarrow> 'a ptr \\<Rightarrow> bool\" (infixl \"\\<le>\\<^sub>p\" 50) where\n  \"p \\<le>\\<^sub>p q \\<equiv> ptr_val p \\<le> ptr_val q\"\n\ninstantiation ptr :: (type) ord\nbegin\n\ndefinition\n  ptr_less_def': \"p < q \\<equiv> p <\\<^sub>p q\"\ndefinition\n  ptr_le_def': \"p \\<le> q \\<equiv> p \\<le>\\<^sub>p q\"\n\ninstance ..\n\nend\n\nlemma ptr_val_case: \"ptr_val p = (case p of Ptr v \\<Rightarrow> v)\"\n  by (cases p) simp\n\ninstantiation ptr :: (type) linorder\nbegin\ninstance\n  by (intro_classes)\n     (unfold ptr_le_def' ptr_le_def ptr_less_def' ptr_less_def ptr_val_case,\n      auto split: ptr.splits)\nend\n\nsubsection \"Raw heap\"\n\ntext {* A raw map from addresses to bytes *}\n\ntype_synonym heap_mem = \"addr \\<Rightarrow> byte\"\n\ntext {* For heap h, pointer p and nat n, (heap_list h n p) returns the list\n        of bytes in the heap taken from addresses {p..+n} *}\n\nprimrec\n  heap_list :: \"heap_mem \\<Rightarrow> nat \\<Rightarrow> addr \\<Rightarrow> byte list\"\nwhere\n  heap_list_base: \"heap_list h 0 p = []\"\n| heap_list_rec:  \"heap_list h (Suc n) p = h p # heap_list h n (p + 1)\"\n\n\nsection \"Intervals\"\n\ntext {*\n  For word a and nat b, {a..+b} is the set of words x,\n  with unat (x - a) < b. *}\n\ndefinition\n  intvl :: \"'a::len word \\<times> nat \\<Rightarrow> 'a::len word set\" where\n  \"intvl x \\<equiv> {z. \\<exists>k. z = fst x + of_nat k \\<and> k < snd x}\"\n\nabbreviation\n  \"intvl_abbr\" :: \"'a::len word \\<Rightarrow> nat \\<Rightarrow> 'a word set\" (\"{_..+_}\") where\n  \"{a..+b} \\<equiv> intvl (a,b)\"\n\n\nsection \"dt_pair: a reimplementation of 2 item tuples\"\n\ndatatype (plugins del: size)\n    ('a,'b) dt_pair = DTPair 'a 'b\n\nprimrec\n  dt_fst :: \"('a,'b) dt_pair \\<Rightarrow> 'a\"\nwhere\n  \"dt_fst (DTPair a b) = a\"\n\nprimrec\n  dt_snd :: \"('a,'b) dt_pair \\<Rightarrow> 'b\"\nwhere\n  \"dt_snd (DTPair a b) = b\"\n\ntype_synonym normalisor = \"byte list \\<Rightarrow> byte list\"\n\n\nsection \"Properties of pointers\"\n\nlemma Ptr_ptr_val [simp]:\n  \"Ptr (ptr_val p) = p\"\n  by (case_tac p) simp\n\nlemma ptr_val_ptr_coerce [simp]:\n  \"ptr_val (ptr_coerce p) = ptr_val p\"\n  by (case_tac p) simp\n\nlemma Ptr_ptr_coerce [simp]:\n  \"Ptr (ptr_val p) = ptr_coerce p\"\n  by (case_tac p) simp\n\nlemma ptr_coerce_id [simp]:\n  \"ptr_coerce p = p\"\n  by (case_tac p) simp\n\nlemma ptr_coerce_idem [simp]:\n  \"ptr_coerce (ptr_coerce p) = ptr_coerce p\"\n  by (case_tac p) simp\n\nlemma ptr_val_inj [simp]:\n  \"(ptr_val p = ptr_val q) = (p = q)\"\n  by (case_tac p, case_tac q) auto\n\nlemma ptr_coerce_NULL [simp]:\n  \"(ptr_coerce p = NULL) = (p = NULL)\"\n  by (case_tac p) simp\n\nlemma NULL_ptr_val:\n  \"(p = NULL) = (ptr_val p = 0)\"\n  by (case_tac p) simp\n\ninstantiation ptr :: (type) finite\nbegin\ninstance\n  by (intro_classes)\n     (auto intro!: finite_code finite_imageD [where f=ptr_val] injI)\nend\n\nsection \"Properties of the raw heap\"\n\nlemma heap_list_length [simp]:\n  \"length (heap_list h n p) = n\"\n  by (induct n arbitrary: p) auto\n\nlemma heap_list_split:\n  shows \"k \\<le> n \\<Longrightarrow> heap_list h n x = heap_list h k x @ heap_list h (n - k) (x + of_nat k)\"\nproof (induct n arbitrary: k x)\n  case 0 thus ?case by simp\nnext\n  case (Suc n) thus ?case\n    by (cases k, auto simp: ac_simps)\nqed\n\nlemma heap_list_split2:\n  \"heap_list h (x + y) p = heap_list h x p @ heap_list h y (p + of_nat x)\"\n  by (subst heap_list_split [where k=x], auto)\n\n\nsection \"Properties of intervals\"\n\nlemma intvlI:\n  \"x < n \\<Longrightarrow> p + of_nat x \\<in> {p..+n}\"\n  by (force simp: intvl_def)\n\nlemma intvlD:\n  \"q \\<in> {p..+n} \\<Longrightarrow> \\<exists>k. q = p + of_nat k \\<and> k < n\"\n  by (force simp: intvl_def)\n\nlemma intvl_empty [simp]:\n  \"{p..+0} = {}\"\n  by (fast dest: intvlD)\n\nlemma intvl_Suc:\n  \"q \\<in> {p..+Suc 0} \\<Longrightarrow> p = q\"\n  by (force dest: intvlD)\n\nlemma intvl_self:\n  \"0 < n \\<Longrightarrow> x \\<in> {x..+n}\"\n  by (force simp: intvl_def)\n\nlemma intvl_start_inter:\n  \"\\<lbrakk> 0 < m; 0 < n \\<rbrakk> \\<Longrightarrow> {p..+m} \\<inter> {p..+n} \\<noteq> {}\"\n  by (force simp: disjoint_iff_not_equal dest: intvl_self)\n\nlemma intvl_overflow:\n  assumes \"2^len_of TYPE('a) \\<le> n\"\n  shows \"{(p::'a::len word)..+n} = UNIV\"\nproof -\n  have witness:\n    \"\\<And>x. x = p + of_nat (unat (x - p)) \\<and> unat (x - p) < n\"\n    using assms by simp unat_arith\n  show ?thesis unfolding intvl_def by (auto intro!: witness)\nqed\n\ndeclare of_nat_diff [simp]\n\nlemma intvl_self_offset:\n  fixes p::\"'a::len word\"\n  assumes a: \"2^len_of TYPE('a) - n < x\" and b: \"x < 2^len_of TYPE('a)\" and\n      c: \"(p::'a::len word) \\<notin> {p + of_nat x..+n}\"\n  shows False\nproof -\n  let ?j = \"2^len_of TYPE('a) - x\"\n  from b have b': \"of_nat x + of_nat ?j  = (0::'a::len word)\" using of_nat_2p by auto\n  moreover from a b have \"?j < n\" by arith\n  with b b' c show  ?thesis by (force simp: intvl_def)\nqed\n\nlemma intvl_mem_offset:\n  \"\\<lbrakk> q \\<in> {p..+unat x}; q \\<notin> {p..+unat y}; unat y \\<le> unat x \\<rbrakk> \\<Longrightarrow>\n      q \\<in> {p + y..+unat x - unat y}\"\n  by (clarsimp simp: intvl_def) (rule_tac x=\"k - unat y\" in exI, auto)\n\nlemma intvl_plus_sub_offset:\n  \"x \\<in> {p + y..+q - unat y} \\<Longrightarrow> x \\<in> {p..+q}\"\n  by (clarsimp simp: intvl_def) (rule_tac x=\"k + unat y\" in exI, auto)\n\nlemma intvl_plus_sub_Suc:\n  \"x \\<in> {p + 1..+q - Suc 0} \\<Longrightarrow> x \\<in> {p..+q}\"\n  by (rule intvl_plus_sub_offset [where y=1], simp)\n\nlemma intvl_neq_start:\n  \"\\<lbrakk> (q::'a::len word) \\<in> {p..+n}; p \\<noteq> q \\<rbrakk> \\<Longrightarrow> q \\<in> {p + 1..+n - Suc 0}\"\n  by (clarsimp simp: intvl_def)\n     (metis (no_types) Suc_diff_1 add.commute add_Suc_right diff_diff_left neq0_conv\n                       of_nat_Suc semiring_1_class.of_nat_0 zero_less_diff)\n\nlemmas unat_simps' =\n  word_arith_nat_defs word_unat.eq_norm len_of_addr_card mod_less\n\nlemma intvl_offset_nmem:\n  \"\\<lbrakk> q \\<in> {(p::'a::len word)..+unat x}; y \\<le>  2^len_of TYPE('a) - unat x \\<rbrakk> \\<Longrightarrow>\n      q \\<notin> {p + x..+y}\"\n  apply (clarsimp simp: intvl_def)\n  apply (simp only: unat_simps')\n  apply (subst (asm) word_unat.Abs_inject)\n    apply (auto simp: unats_def)\n  done\n\nlemma intvl_Suc_nmem' [simp]:\n  \"n < 2^len_of TYPE('a) \\<Longrightarrow> (p::'a::len word) \\<notin> {p + 1..+n - Suc 0}\"\n  by (clarsimp simp: intvl_def)\n     (unat_arith, simp only: unat_simps')\n\nlemma intvl_start_le:\n  \"x \\<le> y \\<Longrightarrow> {p..+x} \\<subseteq> {p..+y}\"\n  by (force simp: intvl_def)\n\nlemma intvl_sub_eq:\n  assumes \"x \\<le> y\"\n  shows \"{p + x..+unat (y - x)} = {p..+unat y} - {p..+unat x}\"\nproof -\n  have \"unat y - unat x \\<le> 2 ^ len_of TYPE('a) - unat x\"\n    by (insert unat_lt2p [of y], arith)\n  moreover have \"x \\<le> y\" by fact\n  moreover hence \"unat (y - x) = unat y - unat x\"\n    by (simp add: word_le_nat_alt, unat_arith)\n  ultimately show ?thesis\n    by (force dest: intvl_offset_nmem intvl_mem_offset elim: intvl_plus_sub_offset\n              simp: word_le_nat_alt)\n\nqed\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/c-parser/umm_heap/CTypesBase.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331462646255, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3028758279225509}}
{"text": "section \"Simplifiying the definition\"\n\ntheory Evaluate_Clock\nimports Evaluate_Termination\nbegin\n\nhide_const (open) sem_env.v\n\nlemma fix_clock:\n  \"fix_clock s1 (s2, x) = (s, x) \\<Longrightarrow> clock s \\<le> clock s1\"\n  \"fix_clock s1 (s2, x) = (s, x) \\<Longrightarrow> clock s \\<le> clock s2\"\nunfolding fix_clock_alt_def by auto\n\nlemma dec_clock[simp]: \"clock (dec_clock st) = clock st - 1\"\nunfolding dec_clock_def by auto\n\ncontext begin\n\nprivate lemma fun_evaluate_clock0:\n  \"clock (fst (fun_evaluate_match s1 env v p v')) \\<le> clock s1\"\n  \"clock (fst (fun_evaluate s1 env e)) \\<le> clock s1\"\nproof (induction rule: fun_evaluate_match_fun_evaluate.induct)\n  case (2 st env e1 e2 es)\n\n  obtain st' r where *[simp]: \"fix_clock st (fun_evaluate st env [e1]) = (st', r)\"\n    by force\n\n  show ?case\n    apply (auto split: prod.splits result.splits)\n    subgoal\n      using 2(2)[OF *[symmetric]]\n      by (smt \"*\" fix_clock(1) fix_clock.simps fst_conv le_trans prod.collapse)\n    subgoal\n      using 2(2)[OF *[symmetric]]\n      by (smt \"*\" fix_clock(1) fix_clock.simps fst_conv le_trans prod.collapse)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps prod.collapse prod.sel(2))\n    done\nnext\n  case (5 st env e pes)\n\n  obtain st' r where *[simp]: \"fix_clock st (fun_evaluate st env [e]) = (st', r)\"\n    by force\n\n  show ?case\n    apply (auto split: prod.splits result.splits)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps prod.collapse prod.sel(2))\n    subgoal\n      using 5(2)[OF *[symmetric]]\n      by (smt \"*\" \"5.IH\"(1) dual_order.trans eq_fst_iff error_result.exhaust error_result.simps(5) error_result.simps(6) fix_clock(2) fix_clock.simps)\n    done\nnext\n  case (9 st env op1 es)\n\n  obtain st' r where *[simp]: \"fix_clock st (fun_evaluate st env (rev es)) = (st', r)\"\n    by force\n\n  note do_app.simps[simp del]\n\n  show ?case\n    apply (auto split: prod.splits result.splits option.splits if_splits)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps prod.collapse prod.sel(2))\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps prod.collapse prod.sel(2))\n    subgoal\n      by (smt \"*\" \"9.IH\"(2) One_nat_def Suc_pred dec_clock dual_order.trans fix_clock(1) fix_clock.simps fst_conv le_imp_less_Suc nat_less_le prod.collapse)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps fst_conv prod.collapse)\n    subgoal\n      using 9(2)[OF *[symmetric], simplified]\n      by (smt \"*\" Suc_pred dual_order.trans fix_clock(1) fix_clock.simps le_imp_less_Suc less_irrefl_nat nat_le_linear prod.collapse prod.sel(2))\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps prod.collapse prod.sel(2))\n    subgoal\n      using 9(2)[OF *[symmetric], simplified]\n      by (smt \"*\" Suc_pred dual_order.trans fix_clock(1) fix_clock.simps le_imp_less_Suc less_irrefl_nat nat_le_linear prod.collapse prod.sel(2))\n    done\nnext\n  case (10 st env lop e1 e2)\n\n  obtain st' r where *[simp]: \"fix_clock st (fun_evaluate st env [e1]) = (st', r)\"\n    by force\n\n  show ?case\n    apply (auto split: prod.splits result.splits option.splits exp_or_val.splits)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps fst_conv prod.collapse)\n    subgoal\n      using 10(2)[OF *[symmetric]]\n      by (metis (no_types, lifting) \"*\" dual_order.trans fix_clock(1) fix_clock.simps fstI prod.collapse)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps prod.collapse snd_conv)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps fst_conv prod.exhaust_sel)\n    done\nnext\n  case (11 st env e1 e2 e3)\n\n  obtain st' r where *[simp]: \"fix_clock st (fun_evaluate st env [e1]) = (st', r)\"\n    by force\n\n  show ?case\n    apply (auto split: prod.splits result.splits option.splits)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps fst_conv prod.collapse)\n    subgoal\n      using 11(2)[OF *[symmetric]]\n      by (metis (no_types, lifting) \"*\" dual_order.trans eq_fst_iff fix_clock(1) fix_clock.simps)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps fst_conv prod.exhaust_sel)\n    done\nnext\n  case (12 st env e pes)\n\n  obtain st' r where *[simp]: \"fix_clock st (fun_evaluate st env [e]) = (st', r)\"\n    by force\n\n  show ?case\n    apply (auto split: prod.splits result.splits option.splits)\n    subgoal\n      using 12(2)[OF *[symmetric]]\n      by (metis (no_types, lifting) \"*\" dual_order.trans eq_fst_iff fix_clock(1) fix_clock.simps)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps fst_conv prod.exhaust_sel)\n    done\nnext\n  case (13 st env xo e1 e2)\n\n  obtain st' r where *[simp]: \"fix_clock st (fun_evaluate st env [e1]) = (st', r)\"\n    by force\n\n  show ?case\n    apply (auto split: prod.splits result.splits option.splits)\n    subgoal\n      using 13(2)[OF *[symmetric]]\n      by (metis (no_types, lifting) \"*\" dual_order.trans eq_fst_iff fix_clock(1) fix_clock.simps)\n    subgoal\n      by (metis \"*\" fix_clock(1) fix_clock.simps fst_conv prod.exhaust_sel)\n    done\nqed (auto split: prod.splits result.splits option.splits match_result.splits)\n\nlemma fun_evaluate_clock:\n  \"fun_evaluate_match s1 env v p v' = (s2, r) \\<Longrightarrow> clock s2 \\<le> clock s1\"\n  \"fun_evaluate s1 env e = (s2, r) \\<Longrightarrow> clock s2 \\<le> clock s1\"\nusing fun_evaluate_clock0 by (metis fst_conv)+\n\nend\n\nlemma fix_clock_evaluate[simp]:\n  \"fix_clock s1 (fun_evaluate s1 env e) = fun_evaluate s1 env e\"\nunfolding fix_clock_alt_def\nusing fun_evaluate_clock by (fastforce split: prod.splits)\n\ndeclare fun_evaluate.simps[simp del]\ndeclare fun_evaluate_match.simps[simp del]\n\nlemmas fun_evaluate_simps[simp] =\n  fun_evaluate.simps[unfolded fix_clock_evaluate]\n  fun_evaluate_match.simps[unfolded fix_clock_evaluate]\n\nlemmas fun_evaluate_induct =\n  fun_evaluate_match_fun_evaluate.induct[unfolded fix_clock_evaluate]\n\nlemma fun_evaluate_length:\n  \"fun_evaluate_match s env v pes err_v = (s', res) \\<Longrightarrow> (case res of Rval vs \\<Rightarrow> length vs = 1 | _ \\<Rightarrow> True)\"\n  \"fun_evaluate s env es = (s', res) \\<Longrightarrow> (case res of Rval vs \\<Rightarrow> length vs = length es | _ \\<Rightarrow> True)\"\nproof (induction arbitrary: s' res and s' res rule: fun_evaluate_match_fun_evaluate.induct)\n  case (9 st env op1 es)\n  then show ?case\n    supply do_app.simps[simp del]\n    apply (fastforce\n        split: if_splits prod.splits result.splits option.splits exp_or_val.splits match_result.splits error_result.splits\n        simp: list_result_alt_def)\n    done\nqed (fastforce\n      split: if_splits prod.splits result.splits option.splits exp_or_val.splits\n             match_result.splits error_result.splits)+\n\nlemma fun_evaluate_matchE:\n  assumes \"fun_evaluate_match s env v pes err_v = (s', Rval vs)\"\n  obtains v where \"vs = [v]\"\nusing fun_evaluate_length(1)[OF assms]\nby (cases vs) auto\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CakeML/Evaluate_Clock.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.30287582792255086}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\nsection \"Additional Syntax for Word Bit Operations\"\n\ntheory Word_Syntax\nimports\n  \"HOL-Word.More_Word\"\n  WordBitwise_Signed\n  Hex_Words\n  Norm_Words\n  Word_Type_Syntax\nbegin\n\ntext \\<open>Additional bit and type syntax that forces word types.\\<close>\n\ntype_synonym word8 = \"8 word\"\ntype_synonym word16 = \"16 word\"\ntype_synonym word32 = \"32 word\"\ntype_synonym word64 = \"64 word\"\n\nlemma len8: \"len_of (x :: 8 itself) = 8\" by simp\nlemma len16: \"len_of (x :: 16 itself) = 16\" by simp\nlemma len32: \"len_of (x :: 32 itself) = 32\" by simp\nlemma len64: \"len_of (x :: 64 itself) = 64\" by simp\n\n\nabbreviation\n  wordNOT  :: \"'a::len0 word \\<Rightarrow> 'a word\"      (\"~~ _\" [70] 71)\nwhere\n  \"~~ x == NOT x\"\n\nabbreviation\n  wordAND  :: \"'a::len0 word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixr \"&&\" 64)\nwhere\n  \"a && b == a AND b\"\n\nabbreviation\n  wordOR   :: \"'a::len0 word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixr \"||\"  59)\nwhere\n  \"a || b == a OR b\"\n\nabbreviation\n  wordXOR  :: \"'a::len0 word \\<Rightarrow> 'a word \\<Rightarrow> 'a word\" (infixr \"xor\" 59)\nwhere\n  \"a xor b == a XOR b\"\n\n(* testing for presence of word_bitwise *)\nlemma \"((x :: word32) >> 3) AND 7 = (x AND 56) >> 3\"\n  by word_bitwise\n\n(* FIXME: move to Word distribution *)\nlemma bin_nth_minus_Bit0[simp]:\n  \"0 < n \\<Longrightarrow> bin_nth (numeral (num.Bit0 w)) n = bin_nth (numeral w) (n - 1)\"\n  by (cases n; simp)\n\nlemma bin_nth_minus_Bit1[simp]:\n  \"0 < n \\<Longrightarrow> bin_nth (numeral (num.Bit1 w)) n = bin_nth (numeral w) (n - 1)\"\n  by (cases n; simp)\n\nend\n", "meta": {"author": "Daohub-io", "repo": "cap9-spec", "sha": "de42d102f2054547c1aa0c8d0dc6d9cc2c763181", "save_path": "github-repos/isabelle/Daohub-io-cap9-spec", "path": "github-repos/isabelle/Daohub-io-cap9-spec/cap9-spec-de42d102f2054547c1aa0c8d0dc6d9cc2c763181/Word_Lib/Word_Syntax.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.30287582792255086}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Strong_Early_Bisim_Pres\n  imports Strong_Early_Bisim Strong_Early_Sim_Pres\nbegin\n\n(************* Preservation rules *************)\n\nlemma tauPres:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"\\<tau>.(P) \\<sim> \\<tau>.(Q)\"\nproof -\n  let ?X = \"{(\\<tau>.(P), \\<tau>.(Q)) | P Q. P \\<sim> Q}\"\n  from `P \\<sim> Q` have \"(\\<tau>.(P), \\<tau>.(Q)) \\<in> ?X\" by auto\n  thus ?thesis\n    by(coinduct rule: bisimCoinduct) (auto intro: tauPres dest: bisimE)\nqed\n\nlemma inputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   x :: name\n\n  assumes PSimQ: \"\\<forall>y. P[x::=y] \\<sim> Q[x::=y]\"\n  \n  shows \"a<x>.P \\<sim> a<x>.Q\"\nproof -\n  let ?X = \"{(a<x>.P, a<x>.Q) | a x P Q. \\<forall>y. P[x::=y] \\<sim> Q[x::=y]}\"\n  {\n    fix axP axQ p\n    assume \"(axP, axQ) \\<in> ?X\"\n    then obtain a x P Q where A: \"\\<forall>y. P[x::=y] \\<sim> Q[x::=y]\" and B: \"axP = a<x>.P\" and C: \"axQ = a<x>.Q\"\n      by auto\n    have \"\\<And>y. ((p::name prm) \\<bullet> P)[(p \\<bullet> x)::=y] \\<sim> (p \\<bullet> Q)[(p \\<bullet> x)::=y]\"\n    proof -\n      fix y\n      from A have \"P[x::=(rev p \\<bullet> y)] \\<sim> Q[x::=(rev p \\<bullet> y)]\"\n        by blast\n      hence \"(p \\<bullet> (P[x::=(rev p \\<bullet> y)])) \\<sim> p \\<bullet> (Q[x::=(rev p \\<bullet> y)])\"\n        by(rule bisimClosed)\n      thus \"(p \\<bullet> P)[(p \\<bullet> x)::=y] \\<sim> (p \\<bullet> Q)[(p \\<bullet> x)::=y]\"\n        by(simp add: eqvts pt_pi_rev[OF pt_name_inst, OF at_name_inst])\n    qed\n    hence \"((p::name prm) \\<bullet> axP, p \\<bullet> axQ) \\<in> ?X\" using B C\n      by auto\n  }\n  hence \"eqvt ?X\" by(simp add: eqvt_def)\n  from PSimQ have \"(a<x>.P, a<x>.Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cSim P Q)\n    thus ?case using `eqvt ?X`\n      by(force intro: inputPres)\n  next\n    case(cSym P Q)\n    thus ?case\n      by(blast dest: bisimE)\n  qed\nqed\n\nlemma outputPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"a{b}.P \\<sim> a{b}.Q\"\nproof -\n  let ?X = \"{(a{b}.P, a{b}.Q) | a b P Q. P \\<sim> Q}\"\n  from `P \\<sim> Q` have \"(a{b}.P, a{b}.Q) \\<in> ?X\" by auto\n  thus ?thesis\n    by(coinduct rule: bisimCoinduct) (blast intro: outputPres dest: bisimE)+\nqed\n\n\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"[a\\<frown>b]P \\<sim> [a\\<frown>b]Q\"\nproof -\n  let ?X = \"{x. \\<exists>P Q a b. P \\<sim> Q \\<and> x = ([a\\<frown>b]P, [a\\<frown>b]Q)}\"\n  from assms have \"([a\\<frown>b]P, [a\\<frown>b]Q) \\<in> ?X\" by blast\n  thus ?thesis\n    by(coinduct rule: bisimCoinduct) (blast intro: matchPres dest: bisimE)+\nqed\n\nlemma mismatchPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   a :: name\n  and   b :: name\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"[a\\<noteq>b]P \\<sim> [a\\<noteq>b]Q\"\nproof -\n  let ?X = \"{x. \\<exists>P Q a b. P \\<sim> Q \\<and> x = ([a\\<noteq>b]P, [a\\<noteq>b]Q)}\"\n  from assms have \"([a\\<noteq>b]P, [a\\<noteq>b]Q) \\<in> ?X\" by blast\n  thus ?thesis\n    by(coinduct rule: bisimCoinduct) (blast intro: mismatchPres dest: bisimE)+\nqed\n\nlemma sumPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n  \n  assumes \"P \\<sim> Q\"\n\n  shows \"P \\<oplus> R \\<sim> Q \\<oplus> R\"\nproof -\n  let ?X = \"{(P \\<oplus> R, Q \\<oplus> R) | P Q R. P \\<sim> Q}\"\n  from assms have \"(P \\<oplus> R, Q \\<oplus> R) \\<in> ?X\" by blast\n  thus ?thesis\n    by(coinduct rule: bisimCoinduct) (auto dest: bisimE intro: reflexive sumPres)\nqed\n\n\n\n  shows \"<\\<nu>x>P \\<sim> <\\<nu>x>Q\"\nproof -\n  let ?X = \"{x. \\<exists>P Q. P \\<sim> Q \\<and> (\\<exists>a. x = (<\\<nu>a>P, <\\<nu>a>Q))}\"\n  from assms have \"(<\\<nu>x>P, <\\<nu>x>Q) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cSim xP xQ)\n    moreover {\n      fix P Q a\n      assume \"P \\<sim> Q\"\n      hence \"P \\<leadsto>[bisim] Q\" by(rule bisimE)\n      moreover have \"\\<And>P Q a. P \\<sim> Q \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> ?X \\<union> bisim\" by blast\n      moreover have \"bisim \\<subseteq> ?X \\<union> bisim\" by blast\n      moreover have \"eqvt bisim\" by(rule eqvt)\n      moreover have \"eqvt (?X \\<union> bisim)\" using eqvts\n        by(auto simp add: eqvt_def) blast\n      ultimately have \"<\\<nu>a>P \\<leadsto>[(?X \\<union> bisim)] <\\<nu>a>Q\"\n        by(rule Strong_Early_Sim_Pres.resPres)\n    }\n    ultimately show ?case by auto\n  next\n    case(cSym xP xQ)\n    thus ?case by(auto dest: bisimE)\n  qed\nqed\n\nlemma parPres:\n  fixes P :: pi\n  and   Q :: pi\n  and   R :: pi\n  and   T :: pi\n\n  assumes \"P \\<sim> Q\"\n\n  shows \"P \\<parallel> R \\<sim> Q \\<parallel> R\"\nproof -\n  let ?X = \"{(resChain lst (P \\<parallel> R), resChain lst (Q \\<parallel> R)) | lst P Q R. P \\<sim> Q}\"\n  have BC: \"\\<And>P Q. P \\<parallel> Q = resChain [] (P \\<parallel> Q)\" by auto\n  from assms have \"(P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\" by(blast intro: BC)\n  thus ?thesis\n  proof(coinduct rule: bisimWeakCoinduct)\n    case(cSim PR QR)\n    moreover {\n      fix lst P Q R\n      assume \"P \\<sim> Q\"\n      have \"eqvt ?X\" using eqvts by(auto simp add: eqvt_def) blast\n      moreover have Res: \"\\<And>P Q x. (P, Q) \\<in> ?X \\<Longrightarrow> (<\\<nu>x>P, <\\<nu>x>Q) \\<in> ?X\"\n        by(auto, rule_tac x=\"x#lst\" in exI) auto\n      moreover {\n        from `P \\<sim> Q` have \"P \\<leadsto>[bisim] Q\" by(rule bisimE)\n        moreover note `P \\<sim> Q`\n        moreover have \"\\<And>P Q R. P \\<sim> Q \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> R) \\<in> ?X\"\n          by(blast intro: BC)\n        ultimately have \"P \\<parallel> R \\<leadsto>[?X] Q \\<parallel> R\" using Res\n          by(rule parPres)\n      }\n\n      ultimately have \"resChain lst (P \\<parallel> R) \\<leadsto>[?X] resChain lst (Q \\<parallel> R)\"\n        by(rule resChainI)\n    }\n    ultimately show ?case by auto\n  next\n    case(cSym P Q)\n    thus ?case by(auto dest: bisimE)\n  qed\nqed\n\nlemma bangRelBisimE: \n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n\n  assumes A:   \"(P, Q) \\<in> bangRel Rel\"\n  and     Sym: \"\\<And>P Q. (P, Q) \\<in> Rel \\<Longrightarrow> (Q, P) \\<in> Rel\"\n\n  shows \"(Q, P) \\<in> bangRel Rel\"\nproof -\n  from A show ?thesis\n  proof(induct)\n    fix P Q\n    assume \"(P, Q) \\<in> Rel\"\n    hence \"(Q, P) \\<in> Rel\" by(rule Sym)\n    thus \"(!Q, !P) \\<in> bangRel Rel\" by(rule BRBang)\n  next\n    fix P Q R T\n    assume RRelT: \"(R, T) \\<in> Rel\"\n    assume IH: \"(Q, P) \\<in> bangRel Rel\"\n    from RRelT have \"(T, R) \\<in> Rel\" by(rule Sym)\n    thus \"(T \\<parallel> Q, R \\<parallel> P) \\<in> bangRel Rel\" using IH by(rule BRPar)\n  next\n    fix P Q a\n    assume \"(Q, P) \\<in> bangRel Rel\"\n    thus \"(<\\<nu>a>Q, <\\<nu>a>P) \\<in> bangRel Rel\" by(rule BRRes)\n  qed\nqed\n\n\n\n  assumes PBiSimQ: \"P \\<sim> Q\"\n\n  shows \"!P \\<sim> !Q\"\nproof -\n  let ?X = \"bangRel bisim\"\n    from PBiSimQ have \"(!P, !Q) \\<in> ?X\" by(rule BRBang)\n    thus ?thesis\n    proof(coinduct rule: bisimWeakCoinduct)\n      case(cSim bP bQ)\n      {\n        fix P Q\n        assume \"(P, Q) \\<in> ?X\"\n        hence \"P \\<leadsto>[?X] Q\"\n        proof(induct)\n          fix P Q\n          assume \"P \\<sim> Q\"\n          thus \"!P \\<leadsto>[?X] !Q\" using bisimE(1) eqvt\n            by(rule Strong_Early_Sim_Pres.bangPres)\n        next\n          fix P Q R T\n          assume RBiSimT: \"R \\<sim> T\"\n          assume PBangRelQ: \"(P, Q) \\<in> ?X\"\n          assume PSimQ: \"P \\<leadsto>[?X] Q\"\n          from RBiSimT  have \"R \\<leadsto>[bisim] T\" by(blast dest: bisimE)\n          thus \"R \\<parallel> P \\<leadsto>[?X] T \\<parallel> Q\" using PSimQ RBiSimT PBangRelQ BRPar BRRes eqvt eqvtBangRel\n            by(blast intro: Strong_Early_Sim_Pres.parCompose)\n        next\n          fix P Q a\n          assume \"P \\<leadsto>[?X] Q\"\n          moreover from eqvtBangRel eqvt have \"eqvt ?X\" by blast \n          ultimately show \"<\\<nu>a>P \\<leadsto>[?X] <\\<nu>a>Q\" using BRRes by(blast intro: Strong_Early_Sim_Pres.resPres)\n        qed\n      }\n      with `(bP, bQ) \\<in> ?X` show ?case by blast\n    next\n      case(cSym bP bQ)\n      thus ?case by(metis bangRelSymetric bisimE)\n  qed\nqed\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Pi_Calculus/Strong_Early_Bisim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5964331462646254, "lm_q1q2_score": 0.30287582792255086}}
{"text": "(*  Title:       Conflict analysis/Operational Semantics\n    Author:      Peter Lammich <peter.lammich@uni-muenster.de>\n    Maintainer:  Peter Lammich <peter.lammich@uni-muenster.de>\n*)\nsection \"Operational Semantics\"\ntheory Semantics\nimports Main Flowgraph \"HOL-Library.Multiset\" LTS Interleave ThreadTracking\nbegin\ntext_raw \\<open>\\label{thy:Semantics}\\<close>\n\nsubsection \"Configurations and labels\"\ntext \\<open>\n  The state of a single thread is described by a stack of control nodes. The top node is the current control node and the nodes deeper in the stack are stored return addresses. \n  The configuration of a whole program is described by a multiset of stacks. \n\n  Note that we model stacks as lists here, the first element being the top element.\n\\<close>\ntype_synonym 'n conf = \"('n list) multiset\"\n\ntext \\<open>\n  A step is labeled according to the executed edge. Additionally, we introduce a label for a procedure return step, that has no corresponding edge. \n\\<close>\ndatatype ('p,'ba) label = LBase 'ba | LCall 'p | LRet | LSpawn 'p\n\nsubsection \\<open>Monitors\\<close>\ntext \\<open>\n  The following defines the monitors of nodes, stacks, configurations, step labels and paths (sequences of step labels)\n\\<close>\ndefinition\n  \\<comment> \\<open>The monitors of a node are the monitors the procedure of the node synchronizes on\\<close>\n  \"mon_n fg n == mon fg (proc_of fg n)\"\n\ndefinition\n  \\<comment> \\<open>The monitors of a stack are the monitors of all its nodes\\<close>\n  \"mon_s fg s == \\<Union> { mon_n fg n | n . n \\<in> set s }\"\n\ndefinition\n  \\<comment> \\<open>The monitors of a configuration are the monitors of all its stacks\\<close>\n  \"mon_c fg c == \\<Union> { mon_s fg s | s . s \\<in># c }\"\n\n\\<comment> \\<open>The monitors of a step label are the monitors of procedures that are called by this step\\<close>\ndefinition mon_e :: \"('b, 'c, 'd, 'a, 'e) flowgraph_rec_scheme \\<Rightarrow> ('c, 'f) label \\<Rightarrow> 'a set\" where\n  \"mon_e fg e = (case e of (LCall p) \\<Rightarrow> mon fg p | _ \\<Rightarrow> {})\"\n\nlemma mon_e_simps [simp]:\n  \"mon_e fg (LBase a) = {}\"\n  \"mon_e fg (LCall p) = mon fg p\"\n  \"mon_e fg (LRet) = {}\"\n  \"mon_e fg (LSpawn p) = {}\"\n  by (simp_all add: mon_e_def)\n\n\\<comment> \\<open>The monitors of a path are the monitors of all procedures that are called on the path\\<close>\ndefinition\n  \"mon_w fg w == \\<Union> { mon_e fg e | e. e \\<in> set w}\"\n\nlemma mon_s_alt: \"mon_s fg s == \\<Union> (mon fg ` proc_of fg ` set s)\"\n  by (unfold mon_s_def mon_n_def) (auto intro!: eq_reflection)\nlemma mon_c_alt: \"mon_c fg c == \\<Union> (mon_s fg ` set_mset c)\"\n  by (unfold mon_c_def set_mset_def) (auto intro!: eq_reflection)\nlemma mon_w_alt: \"mon_w fg w == \\<Union> (mon_e fg ` set w)\"\n  by (unfold mon_w_def) (auto intro!: eq_reflection)\n\nlemma mon_sI: \"\\<lbrakk>n\\<in>set s; m\\<in>mon_n fg n\\<rbrakk> \\<Longrightarrow> m\\<in>mon_s fg s\"\n  by (unfold mon_s_def, auto)\nlemma mon_sD: \"m\\<in>mon_s fg s \\<Longrightarrow> \\<exists>n\\<in>set s. m\\<in>mon_n fg n\"\n  by (unfold mon_s_def, auto)\n\nlemma mon_n_same_proc: \n  \"proc_of fg n = proc_of fg n' \\<Longrightarrow> mon_n fg n = mon_n fg n'\"\n  by (unfold mon_n_def, simp)\nlemma mon_s_same_proc: \n  \"proc_of fg ` set s = proc_of fg ` set s' \\<Longrightarrow> mon_s fg s = mon_s fg s'\"\n  by (unfold mon_s_alt, simp)\n\nlemma (in flowgraph) mon_of_entry[simp]: \"mon_n fg (entry fg p) = mon fg p\"\n  by (unfold mon_n_def, simp add: entry_valid)\nlemma (in flowgraph) mon_of_ret[simp]: \"mon_n fg (return fg p) = mon fg p\"\n  by (unfold mon_n_def, simp add: return_valid)\n\nlemma mon_c_single[simp]: \"mon_c fg {#s#} = mon_s fg s\"\n  by (unfold mon_c_def) auto\nlemma mon_s_single[simp]: \"mon_s fg [n] = mon_n fg n\"\n  by (unfold mon_s_def) auto\nlemma mon_s_empty[simp]: \"mon_s fg [] = {}\"\n  by (unfold mon_s_def) auto\nlemma mon_c_empty[simp]: \"mon_c fg {#} = {}\"\n  by (unfold mon_c_def) auto\n\nlemma mon_s_unconc: \"mon_s fg (a@b) = mon_s fg a \\<union> mon_s fg b\"\n  by (unfold mon_s_def) auto\nlemma mon_s_uncons[simp]: \"mon_s fg (a#as) = mon_n fg a \\<union> mon_s fg as\"\n  by (rule mon_s_unconc[where a=\"[a]\", simplified])\n\nlemma mon_c_union_conc: \"mon_c fg (a+b) = mon_c fg a \\<union> mon_c fg b\"\n  by (unfold mon_c_def) auto\n\nlemma mon_c_add_mset_unconc: \"mon_c fg (add_mset x b) = mon_s fg x \\<union> mon_c fg b\"\n  by (unfold mon_c_def) auto\n\nlemmas mon_c_unconc = mon_c_union_conc mon_c_add_mset_unconc\n\nlemma mon_cI: \"\\<lbrakk>s \\<in># c; m\\<in>mon_s fg s\\<rbrakk> \\<Longrightarrow> m\\<in>mon_c fg c\"\n  by (unfold mon_c_def, auto)\nlemma mon_cD: \"\\<lbrakk>m\\<in>mon_c fg c\\<rbrakk> \\<Longrightarrow> \\<exists>s. s \\<in># c \\<and> m\\<in>mon_s fg s\"\n  by (unfold mon_c_def, auto)\n\nlemma mon_s_mono: \"set s \\<subseteq> set s' \\<Longrightarrow> mon_s fg s \\<subseteq> mon_s fg s'\"\n  by (unfold mon_s_def) auto\nlemma mon_c_mono: \"c\\<subseteq>#c' \\<Longrightarrow> mon_c fg c \\<subseteq> mon_c fg c'\"\n  by (unfold mon_c_def) (auto dest: mset_subset_eqD)\n\nlemma mon_w_empty[simp]: \"mon_w fg [] = {}\"\n  by (unfold mon_w_def, auto)\nlemma mon_w_single[simp]: \"mon_w fg [e] = mon_e fg e\"\n  by (unfold mon_w_def, auto)\nlemma mon_w_unconc: \"mon_w fg (wa@wb) = mon_w fg wa \\<union> mon_w fg wb\"\n  by (unfold mon_w_def) auto\nlemma mon_w_uncons[simp]: \"mon_w fg (e#w) = mon_e fg e \\<union> mon_w fg w\"\n  by (rule mon_w_unconc[where wa=\"[e]\", simplified])\nlemma mon_w_ileq: \"w\\<preceq>w' \\<Longrightarrow> mon_w fg w \\<subseteq> mon_w fg w'\"\n  by (induct rule: less_eq_list_induct) auto\n\n\n\nsubsection \\<open>Valid configurations\\<close>\ntext_raw \\<open>\\label{sec:Semantics:validity}\\<close>\ntext \\<open>We call a configuration {\\em valid} if each monitor is owned by at most one thread.\\<close>\ndefinition\n  \"valid fg c == \\<forall>s s'. {#s, s'#} \\<subseteq># c \\<longrightarrow> mon_s fg s \\<inter> mon_s fg s' = {}\"\n\nlemma valid_empty[simp, intro!]: \"valid fg {#}\" \n  by (unfold valid_def, auto)\n\nlemma valid_single[simp, intro!]: \"valid fg {#s#}\" \n  by (unfold valid_def subset_mset_def) auto\n\nlemma valid_split1: \n  \"valid fg (c+c') \\<Longrightarrow> valid fg c \\<and> valid fg c' \\<and> mon_c fg c \\<inter> mon_c fg c' = {}\"\n  apply (unfold valid_def)\n  apply (auto simp add: mset_le_incr_right)\n  apply (drule mon_cD)+\n  apply auto\n  apply (subgoal_tac \"{#s#}+{#sa#} \\<subseteq># c+c'\")\n  apply (auto dest!: multi_member_split)\n  done\n  \nlemma valid_split2: \n  \"\\<lbrakk>valid fg c; valid fg c'; mon_c fg c \\<inter> mon_c fg c' = {}\\<rbrakk> \\<Longrightarrow> valid fg (c+c')\"\n  apply (unfold valid_def)\n  apply (intro impI allI)\n  apply (erule mset_2dist2_cases)\n  apply simp_all\n  apply (blast intro: mon_cI)+\n  done\n\nlemma valid_union_conc: \n  \"valid fg (c+c') \\<longleftrightarrow> (valid fg c \\<and> valid fg c' \\<and> mon_c fg c \\<inter> mon_c fg c' = {})\" \n  by (blast dest: valid_split1 valid_split2)\n\nlemma valid_add_mset_conc: \n  \"valid fg (add_mset x c') \\<longleftrightarrow> (valid fg c' \\<and> mon_s fg x \\<inter> mon_c fg c' = {})\"\n  unfolding add_mset_add_single[of x c'] valid_union_conc by (auto simp: mon_s_def)\n\nlemmas valid_unconc = valid_union_conc valid_add_mset_conc\n\nlemma valid_no_mon: \"mon_c fg c = {} \\<Longrightarrow> valid fg c\" \nproof (unfold valid_def, intro allI impI)\n  fix s s'\n  assume A: \"mon_c fg c = {}\" and B: \"{#s, s'#} \\<subseteq># c\"\n  from mon_c_mono[OF B, of fg] A have \"mon_s fg s = {}\" \"mon_s fg s' = {}\" by (auto simp add: mon_c_unconc)\n  thus \"mon_s fg s \\<inter> mon_s fg s' = {}\" by blast\nqed\n\nsubsection \\<open>Configurations at control points\\<close>\n\n\\<comment> \\<open>A stack is {\\em at} @{term U} if its top node is from the set @{term U}\\<close>\nprimrec atU_s :: \"'n set \\<Rightarrow> 'n list \\<Rightarrow> bool\" where\n  \"atU_s U [] = False\"\n| \"atU_s U (u#r) = (u\\<in>U)\"\n\nlemma atU_s_decomp[simp]: \"atU_s U (s@s') = (atU_s U s \\<or> (s=[] \\<and> atU_s U s'))\"\n  by (induct s) auto\n\n\\<comment> \\<open>A configuration is {\\em at} @{term U} if it contains a stack that is at @{term U}\\<close>\ndefinition\n  \"atU U c == \\<exists>s. s \\<in># c \\<and> atU_s U s\"\n\nlemma atU_fmt: \"\\<lbrakk>atU U c; !!ui r. \\<lbrakk>ui#r \\<in># c; ui\\<in>U\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  apply (unfold atU_def)\n  apply auto\n  apply (case_tac s)\n  apply auto\n  done\n\nlemma atU_union_cases[case_names left right, consumes 1]: \"\\<lbrakk> \n    atU U (c1+c2); \n    atU U c1 \\<Longrightarrow> P; \n    atU U c2 \\<Longrightarrow> P \n  \\<rbrakk> \\<Longrightarrow> P\"\n  by (unfold atU_def) (blast elim: mset_un_cases)\n\n\n\nlemma atU_union[simp]: \"atU U (c1+c2) = (atU U c1 \\<or> atU U c2)\"\n  by (auto simp add: atU_add elim: atU_union_cases)\n\nlemma atU_empty[simp]: \"\\<not>atU U {#}\"\n  by (unfold atU_def, auto)\nlemma atU_single[simp]: \"atU U {#s#} = atU_s U s\"\n  by (unfold atU_def, auto)\n\n\nlemma atU_add_mset[simp]: \"atU U (add_mset c c2) = (atU_s U c \\<or> atU U c2)\"\n  unfolding add_mset_add_single[of c c2] atU_union by auto\n\nlemma atU_xchange_stack: \"atU U (add_mset (u#r) c) \\<Longrightarrow> atU U (add_mset (u#r') c)\"\n  by (simp)\n\n\\<comment> \\<open>A configuration is {\\em simultaneously at} @{term U} and @{term V} if it contains a stack at @{term U} and another one at @{term V}\\<close>\ndefinition \n  \"atUV U V c == \\<exists>su sv. {#su#}+{#sv#} \\<subseteq># c \\<and> atU_s U su \\<and> atU_s V sv\"\n\nlemma atUV_empty[simp]: \"\\<not>atUV U V {#}\"\n  by (unfold atUV_def) auto\nlemma atUV_single[simp]: \"\\<not>atUV U V {#s#}\"\n  by (unfold atUV_def) auto\n\nlemma atUV_union[simp]: \"\n  atUV U V (c1+c2) \\<longleftrightarrow> \n  (\n    (atUV U V c1) \\<or> \n    (atUV U V c2) \\<or> \n    (atU U c1 \\<and> atU V c2) \\<or> \n    (atU V c1 \\<and> atU U c2)\n  )\"\n  apply (unfold atUV_def atU_def)\n  apply (auto elim!: mset_2dist2_cases intro: mset_le_incr_right iff add: mset_le_mono_add_single)\n  apply (subst union_commute)\n  apply (auto iff add: mset_le_mono_add_single)\n  done\n\nlemma atUV_add_mset[simp]: \"\n  atUV U V (add_mset c c2) \\<longleftrightarrow>\n  (\n    (atUV U V c2) \\<or>\n    (atU U {#c#} \\<and> atU V c2) \\<or>\n    (atU V {#c#} \\<and> atU U c2)\n  )\"\n  unfolding add_mset_add_single[of c c2]\n  unfolding atUV_union\n  by auto\n\nlemma atUV_union_cases[case_names left right lr rl, consumes 1]: \"\\<lbrakk>\n    atUV U V (c1+c2); \n    atUV U V c1 \\<Longrightarrow> P; \n    atUV U V c2 \\<Longrightarrow> P; \n    \\<lbrakk>atU U c1; atU V c2\\<rbrakk> \\<Longrightarrow> P; \n    \\<lbrakk>atU V c1; atU U c2\\<rbrakk> \\<Longrightarrow> P \n  \\<rbrakk> \\<Longrightarrow> P\"\n  by auto\n\nsubsection \\<open>Operational semantics\\<close>\n\nsubsubsection \"Semantic reference point\"\ntext \\<open>We now define our semantic reference point. We assess correctness and completeness of analyses relative to this reference point.\\<close>\ninductive_set \n  refpoint :: \"('n,'p,'ba,'m,'more) flowgraph_rec_scheme \\<Rightarrow> \n                 ('n conf \\<times> ('p,'ba) label \\<times> 'n conf) set\"\n  for fg\nwhere\n  \\<comment> \\<open>A base edge transforms the top node of one stack and leaves the other stacks untouched.\\<close>\n  refpoint_base: \"\\<lbrakk> (u,Base a,v)\\<in>edges fg; valid fg ({#u#r#}+c) \\<rbrakk> \n    \\<Longrightarrow> (add_mset (u#r) c,LBase a,add_mset (v#r) c)\\<in>refpoint fg\" |\n  \\<comment> \\<open>A call edge transforms the top node of a stack and then pushes the entry node of the called procedure onto that stack. \n      It can only be executed if all monitors the called procedure synchronizes on are available. Reentrant monitors are modeled here by\n      checking availability of monitors just against the other stacks, not against the stack of the thread that executes the call. The other stacks are left untouched.\\<close>\n  refpoint_call: \"\\<lbrakk> (u,Call p,v)\\<in>edges fg; valid fg ({#u#r#}+c); \n                    mon fg p \\<inter> mon_c fg c = {} \\<rbrakk> \n    \\<Longrightarrow> (add_mset (u#r) c,LCall p, add_mset (entry fg p#v#r) c)\\<in>refpoint fg\" |\n  \\<comment> \\<open>A return step pops a return node from a stack. There is no corresponding flowgraph edge for a return step. The other stacks are left untouched.\\<close>\n  refpoint_ret: \"\\<lbrakk> valid fg ({#return fg p#r#}+c) \\<rbrakk> \n    \\<Longrightarrow> (add_mset (return fg p#r) c,LRet,(add_mset r c))\\<in>refpoint fg\" |\n  \\<comment> \\<open>A spawn edge transforms the top node of a stack and adds a new stack to the environment, with the entry node of the spawned procedure at the top and no stored return addresses. The other stacks are also left untouched.\\<close>\n  refpoint_spawn: \"\\<lbrakk> (u,Spawn p,v)\\<in>edges fg; valid fg (add_mset (u#r) c) \\<rbrakk> \n    \\<Longrightarrow> (add_mset (u#r) c,LSpawn p, add_mset (v#r) (add_mset [entry fg p] c))\\<in>refpoint fg\"\n\ntext \\<open>\n  Instead of working directly with the reference point semantics, we define the operational semantics of flowgraphs by describing how a single stack is transformed in a context of environment threads, \n  and then use the theory developed in Section~\\ref{thy:ThreadTracking} to derive an interleaving semantics. \n  Note that this semantics is also defined for invalid configurations (cf. Section~\\ref{sec:Semantics:validity}). In Section~\\ref{sec:Semantics:valid_preserve} we will show that it preserves validity\n  of a configuration, and in Section~\\ref{sec:Semantics: refpoint_eq} we show that it is equivalent \n  to the reference point semantics on valid configurations.\n\\<close>\n\ninductive_set\n  trss :: \"('n,'p,'ba,'m,'more) flowgraph_rec_scheme \\<Rightarrow> \n             (('n list * 'n conf) * ('p,'ba) label * ('n list * 'n conf)) set\"\n  for fg\n  where\n    trss_base: \"\\<lbrakk>(u,Base a,v)\\<in>edges fg\\<rbrakk> \\<Longrightarrow> \n      ((u#r,c), LBase a, (v#r,c) ) \\<in> trss fg\"\n  | trss_call: \"\\<lbrakk>(u,Call p,v)\\<in>edges fg; mon fg p \\<inter> mon_c fg c = {} \\<rbrakk> \\<Longrightarrow> \n    ((u#r,c),LCall p, ((entry fg p)#v#r,c)) \\<in> trss fg\"\n  | trss_ret: \"((((return fg p)#r),c),LRet,(r,c)) \\<in> trss fg\"\n  | trss_spawn: \"\\<lbrakk> (u,Spawn p,v)\\<in>edges fg \\<rbrakk> \\<Longrightarrow> \n    ((u#r,c),LSpawn p,(v#r,add_mset [entry fg p] c)) \\<in> trss fg\"\n\n(* Not needed\nlemma trss_base': \"\\<lbrakk>(u,Base a,v)\\<in>edges fg; s=u#r; s'=v#r; e=LBase a\\<rbrakk> \\<Longrightarrow> ((s,c), e, (s',c) ) \\<in> trss fg\"\n  by (simp add: trss_base)\nlemma trss_call': \"\\<lbrakk>(u,Call p,v)\\<in>edges fg; mon fg p \\<inter> mon_c fg c = {}; s=u#r; e=LCall p; s'=(entry fg p)#v#r\\<rbrakk> \\<Longrightarrow> ((s,c),e, (s',c)) \\<in> trss fg\"\n  by (simp add: trss_call)\nlemma trss_ret': \"\\<lbrakk> s=(return fg p)#r; e=LRet \\<rbrakk> \\<Longrightarrow> ((s,c),e,(r,c)) \\<in> trss fg\"\n  by (simp add: trss_ret)\nlemma trss_spawn': \"\\<lbrakk> (u,Spawn p,v)\\<in>edges fg; s=u#r; e=LSpawn p; s'=v#r; c'={#[entry fg p]#}+c\\<rbrakk> \\<Longrightarrow> ((s,c),e,(s',c')) \\<in> trss fg\"\n  by (simp add: trss_spawn)\n*)\n\n\\<comment> \\<open>The interleaving semantics is generated using the general techniques from Section~\\ref{thy:ThreadTracking}\\<close>\nabbreviation tr where \"tr fg == gtr (trss fg)\"\n\\<comment> \\<open>We also generate the loc/env-semantics\\<close>\nabbreviation trp where \"trp fg == gtrp (trss fg)\"\n\n\nsubsection \"Basic properties\"\nsubsubsection \"Validity\"\ntext_raw\\<open>\\label{sec:Semantics:valid_preserve}\\<close>\nlemma (in flowgraph) trss_valid_preserve_s: \n  \"\\<lbrakk>valid fg (add_mset s c); ((s,c),e,(s',c'))\\<in>trss fg\\<rbrakk> \\<Longrightarrow> valid fg (add_mset s' c')\"\n  apply (erule trss.cases)\n  apply (simp_all add: valid_unconc mon_c_unconc)\nby (blast dest: mon_n_same_proc edges_part)+\n\nlemma (in flowgraph) trss_valid_preserve: \n  \"\\<lbrakk>((s,c),w,(s',c'))\\<in>trcl (trss fg); valid fg ({#s#}+c)\\<rbrakk> \\<Longrightarrow> valid fg ({#s'#}+c')\"\n  by (induct rule: trcl_pair_induct) (auto intro: trss_valid_preserve_s)\n\nlemma (in flowgraph) tr_valid_preserve_s: \n  \"\\<lbrakk>(c,e,c')\\<in>tr fg; valid fg c\\<rbrakk> \\<Longrightarrow> valid fg c'\"\n  by (rule gtr_preserve_s[where P=\"valid fg\"]) (auto dest: trss_valid_preserve_s)\n\nlemma (in flowgraph) tr_valid_preserve: \n  \"\\<lbrakk>(c,w,c')\\<in>trcl (tr fg); valid fg c\\<rbrakk> \\<Longrightarrow> valid fg c'\"\n  by (rule gtr_preserve[where P=\"valid fg\"]) (auto dest: trss_valid_preserve_s)\n  \nlemma (in flowgraph) trp_valid_preserve_s: \n  \"\\<lbrakk>((s,c),e,(s',c'))\\<in>trp fg; valid fg (add_mset s c)\\<rbrakk> \\<Longrightarrow> valid fg (add_mset s' c')\"\n  by (rule gtrp_preserve_s[where P=\"valid fg\"]) (auto dest: trss_valid_preserve_s)\n\nlemma (in flowgraph) trp_valid_preserve: \n  \"\\<lbrakk>((s,c),w,(s',c'))\\<in>trcl (trp fg); valid fg ({#s#}+c)\\<rbrakk> \\<Longrightarrow> valid fg (add_mset s' c')\"\n  by (rule gtrp_preserve[where P=\"valid fg\"]) (auto dest: trss_valid_preserve_s)\n\n\nsubsubsection \"Equivalence to reference point\"\ntext_raw \\<open>\\label{sec:Semantics: refpoint_eq}\\<close>\n\\<comment> \\<open>The equivalence between the semantics that we derived using the techniques from Section~\\ref{thy:ThreadTracking} and the semantic reference point is shown nearly automatically.\\<close>\nlemma refpoint_eq_s: \"valid fg c \\<Longrightarrow> ((c,e,c')\\<in>refpoint fg) \\<longleftrightarrow> ((c,e,c')\\<in>tr fg)\"\n  apply rule\n  apply (erule refpoint.cases)\n      apply (auto intro: gtrI_s trss.intros simp add: union_assoc add_mset_commute)\n  apply (erule gtrE)\n  apply (erule trss.cases)\n  apply (auto intro: refpoint.intros simp add: union_assoc[symmetric] add_mset_commute)\n  done\n  \nlemma (in flowgraph) refpoint_eq: \n  \"valid fg c \\<Longrightarrow> ((c,w,c')\\<in>trcl (refpoint fg)) \\<longleftrightarrow> ((c,w,c')\\<in>trcl (tr fg))\" \nproof -\n  have \"((c,w,c')\\<in>trcl (refpoint fg)) \\<Longrightarrow> valid fg c \\<Longrightarrow> ((c,w,c')\\<in>trcl (tr fg))\" by (induct rule: trcl.induct) (auto simp add: refpoint_eq_s tr_valid_preserve_s)\n  moreover have \"((c,w,c')\\<in>trcl (tr fg)) \\<Longrightarrow> valid fg c \\<Longrightarrow> ((c,w,c')\\<in>trcl (refpoint fg))\" by (induct rule: trcl.induct) (auto simp add: refpoint_eq_s tr_valid_preserve_s)\n  ultimately show \"valid fg c \\<Longrightarrow> ((c,w,c')\\<in>trcl (refpoint fg)) = ((c,w,c')\\<in>trcl (tr fg))\" ..\nqed\n\nsubsubsection \\<open>Case distinctions\\<close>\n\nlemma trss_c_cases_s[cases set, case_names no_spawn spawn]: \"\\<lbrakk> \n    ((s,c),e,(s',c'))\\<in>trss fg; \n    \\<lbrakk> c'=c \\<rbrakk> \\<Longrightarrow> P; \n    !!p u v. \\<lbrakk> e=LSpawn p; (u,Spawn p,v)\\<in>edges fg; \n               hd s=u; hd s'=v; c'={#[ entry fg p ]#}+c \\<rbrakk> \\<Longrightarrow> P \n  \\<rbrakk> \\<Longrightarrow> P\" \nby (auto elim!: trss.cases)\nlemma trss_c_fmt_s: \"\\<lbrakk>((s,c),e,(s',c'))\\<in>trss fg\\<rbrakk> \n  \\<Longrightarrow> \\<exists>csp. c'=csp+c \\<and> \n        (csp={#} \\<or> (\\<exists>p. e=LSpawn p \\<and> csp={#[ entry fg p ]#}))\"\n  by (force elim!: trss_c_cases_s)\n  \nlemma (in flowgraph) trss_c'_split_s: \"\\<lbrakk>\n    ((s,c),e,(s',c'))\\<in>trss fg; \n    !!csp. \\<lbrakk>c'=csp+c; mon_c fg csp={}\\<rbrakk> \\<Longrightarrow> P \n  \\<rbrakk> \\<Longrightarrow> P\" \n  apply (erule trss_c_cases_s)\n  apply (subgoal_tac \"c'={#}+c\")\n  apply (fastforce)\n  apply auto\n  done\n\nlemma trss_c_cases[cases set, case_names c_case]: \"!!s c. \\<lbrakk> \n    ((s,c),w,(s',c'))\\<in>trcl (trss fg); \n    !!csp. \\<lbrakk> c'=csp+c; !!s. s \\<in># csp \\<Longrightarrow> \\<exists>p u v. s=[entry fg p] \\<and> \n                                               (u,Spawn p,v)\\<in>edges fg \\<and> \n                                               initialproc fg p\\<rbrakk> \n            \\<Longrightarrow> P \n  \\<rbrakk> \\<Longrightarrow> P\" \nproof (induct w)\n  case Nil note A=this \n  hence \"s'=s\" \"c'=c\" by simp_all\n  hence \"c'={#}+c\" by simp\n  from A(2)[OF this] show P by simp\nnext  \n  case (Cons e w) note IHP=this\n  then obtain sh ch where SPLIT1: \"((s,c),e,(sh,ch))\\<in>trss fg\" and SPLIT2: \"((sh,ch),w,(s',c'))\\<in>trcl (trss fg)\" by (fastforce dest: trcl_uncons)\n  from SPLIT2 show ?case proof (rule IHP(1))\n    fix csp\n    assume C'FMT: \"c'=csp+ch\" and CSPFMT: \"!!s. s \\<in># csp \\<Longrightarrow> \\<exists>p u v. s=[entry fg p] \\<and> (u,Spawn p, v)\\<in>edges fg \\<and> initialproc fg p\"\n    from SPLIT1 show ?thesis\n    proof (rule trss_c_cases_s)\n      assume \"ch=c\" with C'FMT CSPFMT IHP(3) show ?case by blast\n    next\n      fix p\n      assume EFMT: \"e=LSpawn p\" and CHFMT: \"ch={#[entry fg p]#}+c\" \n      with C'FMT have \"c'=({#[entry fg p]#}+csp)+c\" by (simp add: union_ac)\n      moreover \n      from EFMT SPLIT1 have \"\\<exists>u v. (u,Spawn p, v)\\<in>edges fg\" by (blast elim!: trss.cases)\n      hence \"!!s. s \\<in># {#[entry fg p]#} + csp \\<Longrightarrow> \\<exists>p u v. s=[entry fg p] \\<and> (u,Spawn p, v)\\<in>edges fg \\<and> initialproc fg p\" using CSPFMT by (unfold initialproc_def, erule_tac mset_un_cases) (auto)\n      ultimately show ?case using IHP(3) by blast\n    qed\n  qed\nqed\n\nlemma (in flowgraph) c_of_initial_no_mon: \n  assumes A: \"!!s. s \\<in># csp \\<Longrightarrow> \\<exists>p. s=[entry fg p] \\<and> initialproc fg p\" \n  shows \"mon_c fg csp = {}\"\n  by (unfold mon_c_def) (auto dest: A initial_no_mon)\n  \n  (* WARNING: Don't declare this [simp], as c=c' will cause a simplifier loop *)\nlemma (in flowgraph) trss_c_no_mon_s: \n  assumes A: \"((s,c),e,(s',c'))\\<in>trss fg\" \n  shows \"mon_c fg c' = mon_c fg c\" \n  using A \nproof (erule_tac trss_c_cases_s)\n  assume \"c'=c\" thus ?thesis by simp\nnext\n  fix p assume EFMT: \"e=LSpawn p\" and C'FMT: \"c'={#[entry fg p]#} + c\"\n  from EFMT obtain u v where \"(u,Spawn p,v)\\<in>edges fg\" using A by (auto elim: trss.cases)\n  with spawn_no_mon have \"mon_c fg {#[entry fg p]#} = {}\" by simp\n  with C'FMT show ?thesis by (simp add: mon_c_unconc)\nqed\n        \n  (* WARNING: Don't declare this [simp], as c=c' will cause a simplifier loop *)\n  (* FIXME: Dirty proof, not very robust *)\ncorollary (in flowgraph) trss_c_no_mon: \n  \"((s,c),w,(s',c'))\\<in>trcl (trss fg) \\<Longrightarrow> mon_c fg c' = mon_c fg c\" \n  apply (auto elim!: trss_c_cases simp add: mon_c_unconc)\nproof -\n  fix csp x\n  assume \"x\\<in>mon_c fg csp\"\n  then obtain s where \"s \\<in># csp\" and M: \"x\\<in>mon_s fg s\" by (unfold mon_c_def, auto) \n  moreover assume \"\\<forall>s. s \\<in># csp \\<longrightarrow> (\\<exists>p. s = [entry fg p] \\<and> (\\<exists>u v. (u, Spawn p, v) \\<in> edges fg) \\<and> initialproc fg p)\"\n  ultimately obtain p u v where \"s=[entry fg p]\" and \"(u,Spawn p,v)\\<in>edges fg\" by blast\n  hence \"mon_s fg s = {}\" by (simp)\n  with M have False by simp\n  thus \"x\\<in>mon_c fg c\" ..\nqed\n\n\nlemma (in flowgraph) trss_spawn_no_mon_step[simp]: \n  \"((s,c),LSpawn p, (s',c'))\\<in>trss fg \\<Longrightarrow> mon fg p = {}\"\n  by (auto elim: trss.cases)\n\nlemma trss_no_empty_s[simp]: \"(([],c),e,(s',c'))\\<in>trss fg = False\"\n  by (auto elim!: trss.cases)\nlemma trss_no_empty[simp]: \n  assumes A: \"(([],c),w,(s',c'))\\<in>trcl (trss fg)\" \n  shows \"w=[] \\<and> s'=[] \\<and> c=c'\" \nproof -\n  note A \n  moreover { \n    fix s\n    have \"((s,c),w,(s',c'))\\<in>trcl (trss fg) \\<Longrightarrow> s=[] \\<Longrightarrow> w=[] \\<and> s'=[] \\<and> c=c'\"\n      by (induct rule: trcl_pair_induct) auto\n  } ultimately show ?thesis by blast\nqed\n\n\nlemma trs_step_cases[cases set, case_names NO_SPAWN SPAWN]: \n  assumes A: \"(c,e,c')\\<in>tr fg\" \n  assumes A_NO_SPAWN: \"!!s ce s' csp. \\<lbrakk>\n      ((s,ce),e,(s',ce))\\<in>trss fg; \n      c={#s#}+ce; c'={#s'#}+ce\n    \\<rbrakk> \\<Longrightarrow> P\"\n  assumes A_SPAWN: \"!!s ce s' p. \\<lbrakk>\n      ((s,ce),LSpawn p,(s',{#[entry fg p]#}+ce))\\<in>trss fg; \n      c={#s#}+ce; \n      c'={#s'#}+{#[entry fg p]#}+ce; \n      e=LSpawn p\n    \\<rbrakk> \\<Longrightarrow> P\"\n  shows P\nproof -\n  from A show ?thesis proof (erule_tac gtr_find_thread)\n    fix s ce s' ce' \n    assume FMT: \"c = add_mset s ce\" \"c' = add_mset s' ce'\"\n    assume B: \"((s, ce), e, s', ce') \\<in> trss fg\" thus ?thesis proof (cases rule: trss_c_cases_s)\n      case no_spawn thus ?thesis using FMT B by (-) (rule A_NO_SPAWN, auto)  \n    next\n      case (spawn p) thus ?thesis using FMT B by (-) (rule A_SPAWN, auto simp add: union_assoc)\n    qed\n  qed\nqed\n\nsubsection \"Advanced properties\"\nsubsubsection \"Stack composition / decomposition\"\nlemma trss_stack_comp_s: \n  \"((s,c),e,(s',c'))\\<in>trss fg \\<Longrightarrow> ((s@r,c),e,(s'@r,c'))\\<in>trss fg\"\n  by (auto elim!: trss.cases intro: trss.intros)\n\nlemma trss_stack_comp: \n  \"((s,c),w,(s',c'))\\<in>trcl (trss fg) \\<Longrightarrow> ((s@r,c),w,(s'@r,c'))\\<in>trcl (trss fg)\" \nproof (induct rule: trcl_pair_induct)\n  case empty thus ?case by auto\nnext\n  case (cons s c e sh ch w s' c') note IHP=this\n  from trss_stack_comp_s[OF IHP(1)] have \"((s @ r, c), e, sh @ r, ch) \\<in> trss fg\" .\n  also note IHP(3)\n  finally show ?case .\nqed\n\nlemma trss_stack_decomp_s: \"\\<lbrakk> ((s@r,c),e,(s',c'))\\<in>trss fg; s\\<noteq>[] \\<rbrakk> \n  \\<Longrightarrow> \\<exists>sp'. s'=sp'@r \\<and> ((s,c),e,(sp',c'))\\<in>trss fg\" \n  by (cases s, simp) (auto intro: trss.intros elim!: trss.cases)\n\n\n\n    (* TODO: Try backward induction proof \\<dots> is this simpler ? *)\nlemma trss_return_cases[cases set]: \"!!u r c. \\<lbrakk> \n    ((u#r,c),w,(r',c'))\\<in>trcl (trss fg);\n    !! s' u'. \\<lbrakk> r'=s'@u'#r; (([u],c),w,(s'@[u'],c'))\\<in>trcl (trss fg) \\<rbrakk> \\<Longrightarrow> P; \n    !! wa wb ch. \\<lbrakk> w=wa@wb; (([u],c),wa,([],ch))\\<in>trcl (trss fg); \n                   ((r,ch),wb,(r',c'))\\<in>trcl (trss fg) \\<rbrakk> \\<Longrightarrow> P \n  \\<rbrakk> \\<Longrightarrow> P\"\nproof (induct w rule: length_compl_induct)\n  case Nil thus ?case by auto\nnext\n  case (Cons e w) note IHP=this\n  then obtain sh ch where SPLIT1: \"((u#r,c),e,(sh,ch))\\<in>trss fg\" and SPLIT2: \"((sh,ch),w,(r',c'))\\<in>trcl (trss fg)\" by (fast dest: trcl_uncons)\n  {\n    fix ba q\n    assume CASE: \"e=LBase ba \\<or> e=LSpawn q\"\n    with SPLIT1 obtain v where E: \"sh=v#r\" \"(([u],c),e,([v],ch))\\<in>trss fg\" by (auto elim!: trss.cases intro: trss.intros)\n    with SPLIT2 have \"((v#r,ch),w,(r',c'))\\<in>trcl (trss fg)\" by simp\n    hence ?case proof (cases rule: IHP(1)[of w, simplified, cases set])\n      case (1 s' u') note CC=this\n      with E(2) have \"(([u],c),e#w,(s'@[u'],c'))\\<in>trcl (trss fg)\" by simp\n      from IHP(3)[OF CC(1) this] show ?thesis .\n    next\n      case (2 wa wb ct) note CC=this\n      with E(2) have \"(([u],c),e#wa,([],ct))\\<in>trcl (trss fg)\" \"e#w = (e#wa)@wb\" by simp_all\n      from IHP(4)[OF this(2,1) CC(3)] show ?thesis .\n    qed\n  } moreover {\n    assume CASE: \"e=LRet\"\n    with SPLIT1 have \"sh=r\" \"(([u],c),[e],([],ch))\\<in>trcl (trss fg)\" by (auto elim!: trss.cases intro: trss.intros)\n    with IHP(4)[OF _ this(2)] SPLIT2 have ?case by auto\n  } moreover {\n    fix q\n    assume CASE: \"e=LCall q\"\n    with SPLIT1 obtain u' where SHFMT: \"sh=entry fg q # u' # r\" \"(([u],c),e,(entry fg q # [u'],ch))\\<in>trss fg\" by (auto elim!: trss.cases intro: trss.intros)\n    with SPLIT2 have \"((entry fg q # u' # r,ch),w,(r',c'))\\<in>trcl (trss fg)\" by simp\n    hence ?case proof (cases rule: IHP(1)[of w, simplified, cases set])\n      case (1 st ut) note CC=this\n      from trss_stack_comp[OF CC(2), where r=\"[u']\"] have \"((entry fg q#[u'], ch), w, (st @ [ut]) @ [u'], c') \\<in> trcl (trss fg)\" by auto\n      with SHFMT(2) have \"(([u],c),e#w, (st @ [ut]) @ [u'], c') \\<in> trcl (trss fg)\" by auto\n      from IHP(3)[OF _ this] CC(1) show ?thesis by simp\n    next\n      case (2 wa wb ct) note CC=this\n      from trss_stack_comp[OF CC(2), where r=\"[u']\"] have \"((entry fg q # [u'], ch), wa, [u'], ct) \\<in> trcl (trss fg)\" by simp\n      with SHFMT have PREPATH: \"(([u],c),e#wa, [u'], ct) \\<in> trcl (trss fg)\" by simp\n      from CC have L: \"length wb\\<le>length w\" by simp\n      from CC(3) show ?case proof (cases rule: IHP(1)[OF L, cases set])\n        case (1 s'' u'') note CCC=this from trcl_concat[OF PREPATH CCC(2)] CC(1) have \"(([u],c),e#w,(s''@[u''],c'))\\<in>trcl (trss fg)\" by (simp)\n        from IHP(3)[OF CCC(1) this] show ?thesis .\n      next\n        case (2 wba wbb c'') note CCC=this from trcl_concat[OF PREPATH CCC(2)] CC(1) CCC(1) have \"e#w = (e#wa@wba)@wbb\" \"(([u], c), e # wa @ wba, [], c'') \\<in> trcl (trss fg)\" by auto\n        from IHP(4)[OF this CCC(3)] show ?thesis .\n      qed\n    qed\n  } ultimately show ?case by (cases e, auto)\nqed\n\nlemma (in flowgraph) trss_find_call: \n  \"!!v r' c'. \\<lbrakk> (([sp],c),w,(v#r',c')) \\<in> trcl (trss fg); r'\\<noteq>[] \\<rbrakk> \n  \\<Longrightarrow> \\<exists>rh ch p wa wb. \n        w=wa@(LCall p)#wb \\<and> \n        proc_of fg v = p \\<and> \n        (([sp],c),wa,(rh,ch))\\<in>trcl (trss fg) \\<and> \n        ((rh,ch),LCall p,((entry fg p)#r',ch))\\<in>trss fg \\<and> \n        (([entry fg p],ch),wb,([v],c'))\\<in>trcl (trss fg)\"\nproof (induct w rule: length_compl_rev_induct)\n  case Nil thus ?case by (auto) \nnext\n  case (snoc w e) note IHP=this\n  then obtain rh ch where SPLIT1: \"(([sp],c),w,(rh,ch))\\<in>trcl (trss fg)\" and SPLIT2: \"((rh,ch),e,(v#r',c'))\\<in>trss fg\" by (fast dest: trcl_rev_uncons)\n\n  {\n    assume \"\\<exists>u. rh=u#r'\"\n    then obtain u where RHFMT[simp]: \"rh=u#r'\" by blast\n    with SPLIT2 have \"proc_of fg u = proc_of fg v\" by (auto elim: trss.cases intro: edges_part)\n    moreover from IHP(1)[of w u r' ch, OF _ SPLIT1[simplified] IHP(3)] obtain rt ct p wa wb where \n      IHAPP: \"w = wa @ LCall p # wb\" \"proc_of fg u = p\" \"(([sp], c), wa, (rt, ct)) \\<in> trcl (trss fg)\" \"((rt, ct), LCall p, entry fg p # r', ct) \\<in> trss fg\"  \n          \"(([entry fg p], ct), wb, ([u], ch)) \\<in> trcl (trss fg)\" by (blast)\n    moreover\n    have \"(([entry fg p], ct), wb@[e], ([v], c')) \\<in> trcl (trss fg)\" proof -\n      note IHAPP(5)\n      also from SPLIT2 have \"(([u],ch),e,([v],c')) \\<in> trss fg\" by (auto elim!: trss.cases intro!: trss.intros)\n      finally show ?thesis .\n    qed\n    moreover from IHAPP have \"w@[e] = wa @ LCall p # (wb@[e])\" by auto\n    ultimately have ?case by auto\n  }\n  moreover have \"(\\<exists>u. rh=u#r') \\<or> ?case\"\n  proof (rule trss.cases[OF SPLIT2], simp_all, goal_cases) \\<comment> \\<open>Cases for base- and spawn edge are discharged automatically\\<close>\n      \\<comment> \\<open>Case: call-edge\\<close>\n    case (1 ca p r u vv) with SPLIT1 SPLIT2 show ?case by fastforce \n  next\n      \\<comment> \\<open>Case: return edge\\<close>\n    case CC: (2 q r ca)\n    hence [simp]: \"rh=(return fg q)#v#r'\" by simp\n    with IHP(1)[of w \"(return fg q)\" \"v#r'\" ch, OF _ SPLIT1[simplified]] obtain rt ct wa wb where \n      IHAPP: \"w = wa @ LCall q # wb\" \"(([sp], c), wa, rt, ct) \\<in> trcl (trss fg)\" \"((rt, ct), LCall q, entry fg q # v # r', ct) \\<in> trss fg\"\n          \"(([entry fg q], ct), wb, [return fg q], ch) \\<in> trcl (trss fg)\" by force\n    then obtain u where RTFMT [simp]: \"rt=u#r'\" and PROC_OF_U: \"proc_of fg u = proc_of fg v\" by (auto elim: trss.cases intro: edges_part)\n    from IHAPP(1) have LENWA: \"length wa \\<le> length w\" by auto\n    from IHP(1)[OF LENWA IHAPP(2)[simplified] IHP(3)] obtain rhh chh p waa wab where \n      IHAPP': \"wa=waa@LCall p # wab\" \"proc_of fg u = p\" \"(([sp],c),waa,(rhh,chh))\\<in>trcl (trss fg)\" \"((rhh,chh),LCall p, (entry fg p#r',chh))\\<in>trss fg\" \n          \"(([entry fg p],chh),wab,([u],ct))\\<in>trcl (trss fg)\" \n      by blast\n    from IHAPP IHAPP' PROC_OF_U have \"w@[e]=waa@LCall p#(wab@LCall q#wb@[e]) \\<and> proc_of fg v = p\" by auto\n    moreover have \"(([entry fg p],chh),wab@(LCall q)#wb@[e],([v],c'))\\<in>trcl (trss fg)\" proof -\n      note IHAPP'(5)\n      also from IHAPP have \"(([u], ct), LCall q, entry fg q # [v], ct) \\<in> trss fg\" by (auto elim!: trss.cases intro!: trss.intros)\n      also from trss_stack_comp[OF IHAPP(4)] have \"((entry fg q#[v],ct),wb,(return fg q#[v],ch))\\<in>trcl (trss fg)\" by simp\n      also from CC have \"((return fg q#[v],ch),e,([v],c'))\\<in>trss fg\" by (auto intro: trss_ret)\n      finally show ?thesis by simp\n    qed\n    moreover note IHAPP' CC\n    ultimately show ?case by auto\n  qed\n  ultimately show ?case by blast\nqed\n\n\\<comment> \\<open>This lemma is better suited for application in soundness proofs of constraint systems than @{thm [source] flowgraph.trss_find_call}\\<close>\nlemma (in flowgraph) trss_find_call': \n  assumes A: \"(([sp],c),w,(return fg p#[u'],c')) \\<in> trcl (trss fg)\" \n  and EX: \"!!uh ch wa wb. \\<lbrakk>\n      w=wa@(LCall p)#wb; \n      (([sp],c),wa,([uh],ch))\\<in>trcl (trss fg); \n      (([uh],ch),LCall p,((entry fg p)#[u'],ch))\\<in>trss fg;\n      (uh,Call p,u')\\<in>edges fg; \n      (([entry fg p],ch),wb,([return fg p],c'))\\<in>trcl (trss fg)\n    \\<rbrakk> \\<Longrightarrow> P\" \n  shows \"P\"\nproof -\n  from trss_find_call[OF A] obtain rh ch wa wb where FC: \n    \"w = wa @ LCall p # wb\" \n    \"(([sp], c), wa, rh, ch) \\<in> trcl (trss fg)\" \n    \"((rh, ch), LCall p, [entry fg p, u'], ch) \\<in> trss fg\" \n    \"(([entry fg p], ch), wb, [return fg p], c') \\<in> trcl (trss fg)\"\n    by auto\n  moreover from FC(3) obtain uh where ADD: \"rh=[uh]\" \"(uh,Call p,u')\\<in>edges fg\" by (auto elim: trss.cases)\n  ultimately show ?thesis using EX by auto\nqed\n      \nlemma (in flowgraph) trss_bot_proc_const: \n  \"!!s' u' c'. ((s@[u],c),w,(s'@[u'],c'))\\<in>trcl (trss fg) \n    \\<Longrightarrow> proc_of fg u = proc_of fg u'\" \nproof (induct w rule: rev_induct)\n  case Nil thus ?case by auto\nnext\n  case (snoc e w) note IHP=this then obtain sh ch where SPLIT1: \"((s@[u],c),w,(sh,ch))\\<in>trcl (trss fg)\" and SPLIT2: \"((sh,ch),e,(s'@[u'],c'))\\<in>trss fg\" by (fast dest: trcl_rev_uncons)\n  from SPLIT2 have \"sh\\<noteq>[]\" by (auto elim!: trss.cases)\n  then obtain ssh uh where SHFMT: \"sh=ssh@[uh]\" by (blast dest: list_rev_decomp)\n  with IHP(1)[of ssh uh ch] SPLIT1 have \"proc_of fg u = proc_of fg uh\" by auto\n  also from SPLIT2 SHFMT have \"proc_of fg uh = proc_of fg u'\" by (cases rule: trss.cases) (cases ssh, auto simp add: edges_part)+\n  finally show ?case .\nqed\n\n\\<comment> \\<open>Specialized version of @{thm [source] flowgraph.trss_bot_proc_const}that comes in handy for precision proofs of constraint systems\\<close>\nlemma (in flowgraph) trss_er_path_proc_const: \n  \"(([entry fg p],c),w,([return fg q],c'))\\<in>trcl (trss fg) \\<Longrightarrow> p=q\"\n  using trss_bot_proc_const[of \"[]\" \"entry fg p\" _ _ \"[]\" \"return fg q\", simplified] .\n\nlemma trss_2empty_to_2return: \"\\<lbrakk> ((s,c),w,([],c'))\\<in>trcl (trss fg); s\\<noteq>[] \\<rbrakk> \\<Longrightarrow> \n  \\<exists>w' p. w=w'@[LRet] \\<and> ((s,c),w',([return fg p],c'))\\<in>trcl (trss fg)\" \nproof -\n  assume A: \"((s,c),w,([],c'))\\<in>trcl (trss fg)\" \"s\\<noteq>[]\"\n  hence \"w\\<noteq>[]\" by auto\n  then obtain w' e where WD: \"w=w'@[e]\" by (blast dest: list_rev_decomp)\n  with A(1) obtain sh ch where SPLIT: \"((s,c),w',(sh,ch))\\<in>trcl (trss fg)\" \"((sh,ch),e,([],c'))\\<in>trss fg\" by (fast dest: trcl_rev_uncons)\n  from SPLIT(2) obtain p where \"e=LRet\" \"sh=[return fg p]\" \"ch=c'\" by (cases rule: trss.cases, auto)\n  with SPLIT(1) WD show ?thesis by blast\nqed\n  \nlemma trss_2return_to_2empty: \"\\<lbrakk> ((s,c),w,([return fg p],c'))\\<in>trcl (trss fg) \\<rbrakk> \n  \\<Longrightarrow> ((s,c),w@[LRet],([],c'))\\<in>trcl (trss fg)\"\n  apply (subgoal_tac \"(([return fg p],c'),LRet,([],c'))\\<in>trss fg\")\n  by (auto dest: trcl_rev_cons intro: trss.intros)\n\nsubsubsection \"Adding threads\"\nlemma trss_env_increasing_s: \"((s,c),e,(s',c'))\\<in>trss fg \\<Longrightarrow> c\\<subseteq>#c'\"\n  by (auto elim!: trss.cases)\nlemma trss_env_increasing: \"((s,c),w,(s',c'))\\<in>trcl (trss fg) \\<Longrightarrow> c\\<subseteq>#c'\"\n  by (induct rule: trcl_pair_induct) (auto dest: trss_env_increasing_s order_trans)\n\nsubsubsection \"Conversion between environment and monitor restrictions\"\nlemma trss_mon_e_no_ctx: \n  \"((s,c),e,(s',c'))\\<in>trss fg \\<Longrightarrow> mon_e fg e \\<inter> mon_c fg c = {}\"\n  by (erule trss.cases) auto\nlemma (in flowgraph) trss_mon_w_no_ctx: \n  \"((s,c),w,(s',c'))\\<in>trcl (trss fg) \\<Longrightarrow> mon_w fg w \\<inter> mon_c fg c = {}\"\n  by (induct rule: trcl_pair_induct) (auto dest: trss_mon_e_no_ctx simp add: trss_c_no_mon_s)\n\nlemma (in flowgraph) trss_modify_context_s: \n  \"!!cn. \\<lbrakk>((s,c),e,(s',c'))\\<in>trss fg; mon_e fg e \\<inter> mon_c fg cn = {}\\<rbrakk> \n    \\<Longrightarrow> \\<exists>csp. c'=csp+c \\<and> mon_c fg csp = {} \\<and> ((s,cn),e,(s',csp+cn))\\<in>trss fg\"\n  by (erule trss.cases) (auto intro!: trss.intros)\n\nlemma (in flowgraph) trss_modify_context[rule_format]: \n  \"\\<lbrakk>((s,c),w,(s',c'))\\<in>trcl (trss fg)\\<rbrakk> \n  \\<Longrightarrow> \\<forall>cn. mon_w fg w \\<inter> mon_c fg cn = {} \n      \\<longrightarrow> (\\<exists>csp. c'=csp+c \\<and> mon_c fg csp = {} \\<and> \n                 ((s,cn),w,(s',csp+cn))\\<in>trcl (trss fg))\"\nproof (induct rule: trcl_pair_induct)\n  case empty thus ?case by simp \nnext\n  case (cons s c e sh ch w s' c') note IHP=this show ?case \n  proof (intro allI impI)\n    fix cn\n    assume MON: \"mon_w fg (e # w) \\<inter> mon_c fg cn = {}\"\n    from trss_modify_context_s[OF IHP(1)] MON obtain csph where S1: \"ch = csph + c\" \"mon_c fg csph={}\" \"((s, cn), e, sh, csph + cn) \\<in> trss fg\" by auto\n    with MON have \"mon_w fg w \\<inter> mon_c fg (csph+cn) = {}\" by (auto simp add: mon_c_unconc)\n    with IHP(3)[rule_format] obtain csp where S2: \"c'=csp+ch\" \"mon_c fg csp={}\" \"((sh,csph+cn),w,(s',csp+(csph+cn)))\\<in>trcl (trss fg)\" by blast \n    from S1 S2 have \"c'=(csp+csph)+c\" \"mon_c fg (csp+csph)={}\" \"((s,cn),e#w,(s',(csp+csph)+cn))\\<in>trcl (trss fg)\" by (auto simp add: union_assoc mon_c_unconc)\n    thus \"\\<exists>csp. c' = csp + c \\<and> mon_c fg csp = {} \\<and> ((s, cn), e # w, s', csp + cn) \\<in> trcl (trss fg)\" by blast\n  qed\nqed\n\nlemma trss_add_context_s: \n  \"\\<lbrakk>((s,c),e,(s',c'))\\<in>trss fg; mon_e fg e \\<inter> mon_c fg ce = {}\\<rbrakk> \n    \\<Longrightarrow> ((s,c+ce),e,(s',c'+ce))\\<in>trss fg\"\n  by (auto elim!: trss.cases intro!: trss.intros simp add: union_assoc mon_c_unconc)\n\nlemma trss_add_context: \n  \"\\<lbrakk>((s,c),w,(s',c'))\\<in>trcl (trss fg); mon_w fg w \\<inter> mon_c fg ce = {}\\<rbrakk> \n    \\<Longrightarrow> ((s,c+ce),w,(s',c'+ce))\\<in>trcl (trss fg)\" \nproof (induct rule: trcl_pair_induct)\n  case empty thus ?case by simp\nnext\n  case (cons s c e sh ch w s' c') note IHP=this\n  from IHP(4) have MM: \"mon_e fg e \\<inter> mon_c fg ce = {}\" \"mon_w fg w \\<inter> mon_c fg ce = {}\" by auto\n  from trcl.cons[OF trss_add_context_s[OF IHP(1) MM(1)] IHP(3)[OF MM(2)]] show ?case .\nqed\n  \nlemma trss_drop_context_s: \"\\<lbrakk> ((s,c+ce),e,(s',c'+ce))\\<in>trss fg \\<rbrakk> \n  \\<Longrightarrow> ((s,c),e,(s',c'))\\<in>trss fg \\<and> mon_e fg e \\<inter> mon_c fg ce = {}\"\n  by (erule trss.cases) (auto intro!: trss.intros simp add: mon_c_unconc union_assoc[of _ c ce, symmetric])\n\nlemma trss_drop_context: \"!!s c. \\<lbrakk> ((s,c+ce),w,(s',c'+ce))\\<in>trcl (trss fg) \\<rbrakk> \n  \\<Longrightarrow> ((s,c),w,(s',c'))\\<in>trcl (trss fg) \\<and> mon_w fg w \\<inter> mon_c fg ce = {}\" \nproof (induct w)\n  case Nil thus ?case by auto\nnext\n  case (Cons e w) note IHP=this\n  then obtain sh ch where SPLIT: \"((s,c+ce),e,(sh,ch))\\<in>trss fg\" \"((sh,ch),w,(s',c'+ce))\\<in> trcl (trss fg)\" by (fast dest: trcl_uncons)\n  from trss_c_fmt_s[OF SPLIT(1)] obtain csp where CHFMT: \"ch = (csp + c) + ce\" by (auto simp add: union_assoc)\n  from CHFMT trss_drop_context_s SPLIT(1) have \"((s,c),e,(sh,csp+c))\\<in>trss fg\" \"mon_e fg e \\<inter> mon_c fg ce = {}\" by blast+\n  moreover from CHFMT IHP(1) SPLIT(2) have \"((sh,csp+c),w,(s',c'))\\<in>trcl (trss fg)\" \"mon_w fg w \\<inter> mon_c fg ce = {}\" by blast+\n  ultimately show ?case by auto\nqed\n\nlemma trss_xchange_context_s: \n  assumes A: \"((s,c),e,(s',csp+c))\\<in>trss fg\" \n  and M:\"mon_c fg cn \\<subseteq> mon_c fg c\" \n  shows \"((s,cn),e,(s',csp+cn))\\<in>trss fg\"\nproof -\n  from trss_drop_context_s[of _ \"{#}\", simplified, OF A] have DC: \"((s, {#}), e, s', csp) \\<in> trss fg\" \"mon_e fg e \\<inter> mon_c fg c = {}\" by simp_all\n  with M have \"mon_e fg e \\<inter> mon_c fg cn = {}\" by auto\n  from trss_add_context_s[OF DC(1) this] show ?thesis by auto\nqed\n  \nlemma trss_xchange_context: \n  assumes A: \"((s,c),w,(s',csp+c))\\<in>trcl (trss fg)\" \n  and M:\"mon_c fg cn \\<subseteq> mon_c fg c\" \n  shows \"((s,cn),w,(s',csp+cn))\\<in>trcl (trss fg)\"\nproof -\n  from trss_drop_context[of _ \"{#}\", simplified, OF A] have DC: \"((s, {#}), w, s', csp) \\<in> trcl (trss fg)\" \"mon_w fg w \\<inter> mon_c fg c = {}\" by simp_all\n  with M have \"mon_w fg w \\<inter> mon_c fg cn = {}\" by auto\n  from trss_add_context[OF DC(1) this] show ?thesis by auto\nqed\n\nlemma trss_drop_all_context_s[cases set, case_names dropped]: \n  assumes A: \"((s,c),e,(s',c'))\\<in>trss fg\" \n  and C: \"!!csp. \\<lbrakk> c'=csp+c; ((s,{#}),e,(s',csp))\\<in>trss fg \\<rbrakk> \\<Longrightarrow> P\" \n  shows P\nusing A proof (cases rule: trss_c_cases_s)\n  case no_spawn with trss_xchange_context_s[of s c e s' \"{#}\" fg \"{#}\"] A C show P by auto\nnext\n  case (spawn p u v) with trss_xchange_context_s[of s c e s' \"{#[entry fg p]#}\" fg \"{#}\"] A C show P by auto\nqed\n\nlemma trss_drop_all_context[cases set, case_names dropped]: \n  assumes A: \"((s,c),w,(s',c'))\\<in>trcl (trss fg)\" \n  and C: \"!!csp. \\<lbrakk> c'=csp+c; ((s,{#}),w,(s',csp))\\<in>trcl (trss fg)\\<rbrakk> \\<Longrightarrow> P\" \n  shows P\nusing A proof (cases rule: trss_c_cases)\n  case (c_case csp) with trss_xchange_context[of s c w s' csp fg \"{#}\"] A C show P by auto\nqed\n\nlemma tr_add_context_s: \n  \"\\<lbrakk> (c,e,c')\\<in>tr fg; mon_e fg e \\<inter> mon_c fg ce = {} \\<rbrakk> \\<Longrightarrow> (c+ce,e,c'+ce)\\<in>tr fg\"\n  by (erule gtrE) (auto simp add: mon_c_unconc union_assoc intro: gtrI_s dest: trss_add_context_s)\n\nlemma tr_add_context: \n  \"\\<lbrakk> (c,w,c')\\<in>trcl (tr fg); mon_w fg w \\<inter> mon_c fg ce = {} \\<rbrakk> \n    \\<Longrightarrow> (c+ce,w,c'+ce)\\<in>trcl (tr fg)\" \nproof (induct rule: trcl.induct)\n  case empty thus ?case by auto\nnext\n  case (cons c e c' w c'') note IHP=this\n  from tr_add_context_s[OF IHP(1), of ce] IHP(4) have \"(c + ce, e, c' + ce) \\<in> tr fg\" by auto\n  also from IHP(3,4) have \"(c' + ce, w, c'' + ce) \\<in> trcl (tr fg)\" by auto\n  finally show ?case .\nqed\n   \nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Program-Conflict-Analysis/Semantics.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961013, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.3028756287569702}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory Sep_Cancel\nimports Sep_Provers Sep_Tactic_Helpers Sep_Cancel_Set\nbegin\n\n(* Sep_Cancel performs cancellative elimination of conjuncts *)\n\n\nlemma sep_curry': \"\\<lbrakk>(P \\<and>* F) s; \\<And>s. (Q \\<and>* P \\<and>* F) s \\<Longrightarrow> R s\\<rbrakk> \\<Longrightarrow> (Q \\<longrightarrow>* R) s\"\n  by (metis (full_types) sep.mult_commute sep_curry)\n\nlemma sep_conj_sep_impl_safe:\n  \"(P \\<longrightarrow>* P') s \\<Longrightarrow> (\\<And>s. ((P \\<longrightarrow>* P') \\<and>* Q) s \\<Longrightarrow> (Q') s) \\<Longrightarrow> (Q \\<longrightarrow>* Q') s\"\n  by (rule sep_curry)\n\nlemma  sep_conj_sep_impl_safe': \"P s \\<Longrightarrow> (\\<And>s. (P \\<and>* Q) s \\<Longrightarrow> (P \\<and>* R) s) \\<Longrightarrow> (Q \\<longrightarrow>* P \\<and>* R) s\"\n  by (rule sep_curry)\n\nlemma sep_wand_lens_simple: \"(\\<And>s. T s = (Q \\<and>* R) s) \\<Longrightarrow> (P \\<longrightarrow>* T) s \\<Longrightarrow> (P \\<longrightarrow>* Q \\<and>* R) s\"\n  by (clarsimp simp: sep_impl_def)\n\nschematic_goal schem_impAny: \" (?C \\<and>* B) s \\<Longrightarrow> A s\" by (erule sep_mp)\n\nML {*\n  fun sep_cancel_tactic ctxt concl  =\n    let val thms = rev (SepCancel_Rules.get ctxt)\n        val tac  = assume_tac ctxt ORELSE'\n                   eresolve_tac ctxt [@{thm sep_mp}, @{thm sep_conj_empty}, @{thm sep_empty_conj}] ORELSE'\n                   sep_erule_tactic ctxt thms\n        val direct_tac = eresolve_tac ctxt thms\n        val safe_sep_wand_tac = rotator' ctxt (resolve0_tac [@{thm sep_wand_lens_simple}]) (eresolve0_tac [@{thm sep_conj_sep_impl_safe'}])\n        fun sep_cancel_tactic_inner true   = sep_erule_full_tac' tac ctxt\n          | sep_cancel_tactic_inner false  = sep_erule_full_tac tac ctxt\n  in sep_cancel_tactic_inner concl ORELSE'\n      eresolve_tac ctxt [@{thm sep_curry'}, @{thm sep_conj_sep_impl_safe}, @{thm sep_imp_empty}, @{thm sep_empty_imp'}] ORELSE'\n      safe_sep_wand_tac ORELSE'\n      direct_tac\n  end\n\n  fun sep_cancel_tactic' ctxt concl =\n    let\n      val sep_cancel = sep_cancel_tactic ctxt\n    in\n      (sep_flatten ctxt THEN_ALL_NEW sep_cancel concl) ORELSE' sep_cancel concl\n    end\n\n  fun sep_cancel_method (concl,_) ctxt = SIMPLE_METHOD' (sep_cancel_tactic' ctxt concl)\n\n  val sep_cancel_syntax =\n    Method.sections [Args.add -- Args.colon >> K (Method.modifier SepCancel_Rules.add @{here})];\n\n  val sep_cancel_syntax' =\n    Scan.lift (Args.mode \"concl\") -- sep_cancel_syntax\n*}\n\nmethod_setup sep_cancel =\n  {* sep_cancel_syntax' >> sep_cancel_method *}  {* Simple elimination of conjuncts *}\n\nend\n", "meta": {"author": "carl88888", "repo": "filesystem", "sha": "2700e011249e8a675f675c5e0fd13efc1a0957f7", "save_path": "github-repos/isabelle/carl88888-filesystem", "path": "github-repos/isabelle/carl88888-filesystem/filesystem-2700e011249e8a675f675c5e0fd13efc1a0957f7/lib/sep_algebra/Sep_Cancel.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.30287562092239223}}
{"text": "(*\nTitle: WHATandWHERE-Security\nAuthors: Sylvia Grewe, Alexander Lux, Heiko Mantel, Jens Sauer\n*)\ntheory Parallel_Composition\nimports Up_To_Technique MWLs\nbegin\n\nlocale WHATWHERE_Secure_Programs =\nL? : MWLs_semantics \"E\" \"BMap\"\n+ WWs? : WHATWHERE \"MWLsSteps_det\" \"E\" \"pp\" \"DA\" \"lH\"\nfor E :: \"('exp, 'id, 'val) Evalfunction\"\nand BMap :: \"'val \\<Rightarrow> bool\"\nand DA :: \"('id, 'd::order) DomainAssignment\"\nand lH :: \"('d, 'exp) lHatches\"\nbegin\n\nlemma SdlHPPB_restricted_on_PP_is_SdlHPPB:\n  assumes SdlHPPB: \"SdlHPPB d PP R'\"\n  assumes inR': \"(V,V) \\<in> R'\"\n  assumes Rdef: \"R = {(V',V''). (V',V'') \\<in> R' \n    \\<and> set (PPV V') \\<subseteq> set (PPV V)\n    \\<and> set (PPV V'') \\<subseteq> set (PPV V)}\"\n  shows \"SdlHPPB d PP R\"\nproof (simp add: Strong_dlHPP_Bisimulation_def, auto)\n  from SdlHPPB have \"sym R'\" \n    by (simp add: Strong_dlHPP_Bisimulation_def)\n  with Rdef show \"sym R\" \n    by (simp add: sym_def)\nnext\n  from SdlHPPB have \"trans R'\" \n    by (simp add: Strong_dlHPP_Bisimulation_def)\n  with Rdef show \"trans R\" \n    by (simp add: trans_def, auto)\nnext\n  fix V' V''\n  assume inR_part: \"(V',V'') \\<in> R\"\n  with SdlHPPB Rdef show \"length V' = length V''\"\n    by (simp add: Strong_dlHPP_Bisimulation_def, auto)\nnext\n  fix V' V'' i\n  assume inR_part: \"(V',V'') \\<in> R\"\n  assume irange: \"i < length V'\"\n  assume notIDC: \n    \"\\<not> IDC d (V'!i) (htchLoc (pp (V'!i)))\"\n  with SdlHPPB inR_part irange Rdef \n  show \"NDC d (V'!i)\"\n    by (simp add: Strong_dlHPP_Bisimulation_def, auto)\nnext\n  fix V' V'' i \\<alpha> p m1 m1' m2\n  assume inR_part: \"(V',V'') \\<in> R\"\n  assume irange: \"i < length V'\"\n  assume step: \"\\<langle>V'!i,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m2\\<rangle>\"\n  assume dhequal: \"m1 \\<sim>\\<^bsub>d,(htchLocSet PP)\\<^esub> m1'\"\n  \n  from inR_part SdlHPPB Rdef have eqlen: \"length V' = length V''\"\n    by (simp add: Strong_dlHPP_Bisimulation_def, auto)\n  \n  from inR_part Rdef \n  have \"set (PPV V') \\<subseteq> set (PPV V) \\<and> set (PPV V'') \\<subseteq> set (PPV V)\"\n    by auto\n  \n  with irange PPc_in_PPV_version eqlen\n  have PPc_Vs_at_i: \n    \"set (PPc (V'!i)) \\<subseteq> set (PPV V) \\<and> set (PPc (V''!i)) \\<subseteq> set (PPV V)\"\n    by (metis subset_trans)\n  \n  from SdlHPPB inR_part Rdef irange step dhequal\n    strongdlHPPB_aux[of \"d\" \"PP\" \"R'\" \"i\" \n    \"V'\" \"V''\" \"m1\" \"\\<alpha>\" \"p\" \"m2\" \"m1'\"]\n  obtain p' \\<alpha>' m2' where stepreq: \"\\<langle>V''!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n    stepResultsinR p p' R' \\<and> (\\<alpha>,\\<alpha>') \\<in> R' \\<and>\n    dhequality_alternative d PP (pp (V'!i)) m2 m2'\"\n    by auto\n  have Rpp': \"stepResultsinR p p' R\"\n  proof -\n    {\n      fix c c'\n      assume step1: \"\\<langle>V'!i,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>Some c,m2\\<rangle>\"\n      assume step2: \"\\<langle>V''!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>Some c',m2'\\<rangle>\"\n      assume inR'_res: \"([c],[c']) \\<in> R'\"\n      \n      from PPc_Vs_at_i step1 step2 PPsc_of_step\n      have \"set (PPc c) \\<subseteq> set (PPV V) \\<and> set (PPc c') \\<subseteq> set (PPV V)\"\n        by (metis (no_types) option.sel xt1(6))\n      \n      with inR'_res Rdef have \"([c],[c']) \\<in> R\"\n        by auto\n    }\n    thus ?thesis      \n      by (metis step stepResultsinR_def stepreq)\n  qed\n             \n  have R\\<alpha>\\<alpha>': \"(\\<alpha>,\\<alpha>') \\<in> R\"\n  proof - \n    from PPc_Vs_at_i step stepreq PPs\\<alpha>_of_step have \n      \"set (PPV \\<alpha>) \\<subseteq> set (PPV V) \\<and> set (PPV \\<alpha>') \\<subseteq> set (PPV V)\"\n      by (metis (no_types) xt1(6))\n    with stepreq Rdef show ?thesis\n      by auto\n  qed\n  \n  from stepreq Rpp' R\\<alpha>\\<alpha>' show \n    \"\\<exists>p' \\<alpha>' m2'. \\<langle>V''!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n    stepResultsinR p p' R \\<and> (\\<alpha>,\\<alpha>') \\<in> R \\<and>\n    dhequality_alternative d PP (pp (V'!i)) m2 m2'\"\n    by auto\nqed\n\n\ntheorem parallel_composition:\n  \"\\<lbrakk> \\<forall>i < length V. WHATWHERE_Secure [V!i]; unique_PPV V \\<rbrakk>\n  \\<Longrightarrow> WHATWHERE_Secure V\"\nproof (simp add: WHATWHERE_Secure_def, induct V, auto)\n  fix d PP\n  from WHATWHERE_empty \n  show \"\\<exists>R. SdlHPPB d PP R \\<and> ([],[]) \\<in> R\"\n    by (simp add: WHATWHERE_Secure_def)\nnext\n  fix c V d PP\n  assume IH: \"\\<lbrakk> \\<forall>i < length V.\n    \\<forall>d PP. \\<exists>R. SdlHPPB d PP R \\<and> ([V!i],[V!i]) \\<in> R;\n    unique_PPV V \\<rbrakk>\n    \\<Longrightarrow> \\<forall>d PP. \\<exists>R. SdlHPPB d PP R \\<and> (V,V) \\<in> R\"\n  assume ISassump: \"\\<forall>i < Suc (length V).\n    \\<forall>d PP. \\<exists>R. SdlHPPB d PP R \\<and> ([(c#V)!i],[(c#V)!i]) \\<in> R\"\n  assume uniPPcV: \"unique_PPV (c#V)\"\n  \n  hence IHassump1: \"unique_PPV V\"\n    by (simp add: unique_PPV_def)\n\n  from uniPPcV have nocommonPP: \"set (PPc c) \\<inter> set (PPV V) = {}\"\n    by (simp add: unique_PPV_def)\n  \n  from ISassump have IHassump2: \"\\<forall>i < length V. \n    \\<forall>d PP. \\<exists>R. SdlHPPB d PP R \\<and> ([V!i],[V!i]) \\<in> R\"\n    by auto\n\n  with IHassump1 IH obtain RV' where RV'assump:\n    \"SdlHPPB d PP RV' \\<and> (V,V) \\<in> RV'\"\n    by blast\n\n  define RV where \"RV = {(V',V''). (V',V'') \\<in> RV' \\<and> set (PPV V') \\<subseteq> set (PPV V)\n    \\<and> set (PPV V'') \\<subseteq> set (PPV V)}\"\n\n  with RV'assump RV_def SdlHPPB_restricted_on_PP_is_SdlHPPB\n  have SdlHPPRV: \"SdlHPPB d PP RV\"\n    by force\n\n  from ISassump obtain Rc' where Rc'assump: \n    \"SdlHPPB d PP Rc' \\<and> ([c],[c]) \\<in> Rc'\"\n    by (metis append_Nil drop_Nil neq0_conv not_Cons_self \n      nth_append_length Cons_nth_drop_Suc zero_less_Suc)\n \n  define Rc where \"Rc = {(V',V''). (V',V'') \\<in> Rc' \\<and> set (PPV V') \\<subseteq> set (PPc c)\n    \\<and> set (PPV V'') \\<subseteq> set (PPc c)}\"\n\n  with Rc'assump Rc_def SdlHPPB_restricted_on_PP_is_SdlHPPB\n  have SdlHPPRc: \"SdlHPPB d PP Rc\"\n    by force\n\n  from nocommonPP have \"Domain RV \\<inter> Domain Rc \\<subseteq> {[]}\"\n    by (simp add: RV_def Rc_def, auto,\n      metis Int_mono inf_commute inf_idem le_bot nocommonPP unique_V_uneq)\n\n  with commonArefl_subset_commonDomain\n  have Areflassump1: \"Arefl RV \\<inter> Arefl Rc \\<subseteq> {[]}\"\n    by force\n    \n  define R where \"R = {(V',V''). \\<exists>c c' W W'. V' = c#W \\<and> V'' = c'#W' \\<and> W \\<noteq> []\n    \\<and> W' \\<noteq> [] \\<and> ([c],[c']) \\<in> Rc \\<and> (W,W') \\<in> RV}\"\n\n  with RV_def RV'assump Rc_def Rc'assump have inR: \n    \"V \\<noteq> [] \\<Longrightarrow> (c#V,c#V) \\<in> R\"\n    by auto\n    \n  from R_def Rc_def RV_def nocommonPP\n  have \"Domain R \\<inter> Domain (Rc \\<union> RV) = {}\"\n    by (simp add: R_def Rc_def RV_def, auto,\n      metis inf_bot_right le_inf_iff subset_empty unique_V_uneq,\n      metis (hide_lams, no_types) inf_absorb1 inf_bot_right le_inf_iff unique_c_uneq)\n            \n  with commonArefl_subset_commonDomain\n  have Areflassump2: \"Arefl R \\<inter> Arefl (Rc \\<union> RV) \\<subseteq> {[]}\"\n    by force\n\n  have disjuptoR: \n    \"disj_dlHPP_Bisimulation_Up_To_R' d PP (Rc \\<union> RV) R\"\n    proof (simp add: disj_dlHPP_Bisimulation_Up_To_R'_def, auto)\n        from Areflassump1 SdlHPPRc SdlHPPRV Union_Strong_dlHPP_Bisim\n        show \"SdlHPPB d PP (Rc \\<union> RV)\"\n          by force\n      next\n        from SdlHPPRV have symRV: \"sym RV\"\n          by (simp add: Strong_dlHPP_Bisimulation_def)\n        from SdlHPPRc have symRc: \"sym Rc\"\n          by (simp add: Strong_dlHPP_Bisimulation_def)\n        with symRV R_def show \"sym R\"\n          by (simp add: sym_def, auto)\n      next\n        from SdlHPPRV have transRV: \"trans RV\"\n          by (simp add: Strong_dlHPP_Bisimulation_def)\n        from SdlHPPRc have transRc: \"trans Rc\"\n          by (simp add: Strong_dlHPP_Bisimulation_def)\n        show \"trans R\"\n           proof -\n            {\n            fix V V' V''\n            assume p1: \"(V,V') \\<in> R\"\n            assume p2: \"(V',V'') \\<in> R\"\n            have \"(V,V'') \\<in> R\"\n              proof -\n                from p1 R_def obtain c c' W W' where p1assump:\n                  \"V = c#W \\<and> V' = c'#W' \\<and> W \\<noteq> [] \\<and> W' \\<noteq> [] \\<and>\n                  ([c],[c']) \\<in> Rc \\<and> (W,W') \\<in> RV\"\n                  by auto\n                with p2 R_def obtain c'' W'' where p2assump:\n                  \"V'' = c''#W'' \\<and> W'' \\<noteq> [] \\<and>\n                  ([c'],[c'']) \\<in> Rc \\<and> (W',W'') \\<in> RV\"\n                  by auto\n                with p1assump transRc transRV have \n                  trans_assump: \"([c],[c'']) \\<in> Rc \\<and> (W,W'') \\<in> RV\"\n                  by (simp add: trans_def, blast)\n                with p1assump p2assump R_def show ?thesis\n                  by auto\n              qed\n             }\n            thus ?thesis unfolding trans_def by blast\n           qed\n      next\n        fix V V'\n        assume \"(V,V') \\<in> R\"\n        with R_def SdlHPPRV show \"length V = length V'\"\n          by (simp add: Strong_dlHPP_Bisimulation_def, auto)\n      next\n        fix V V' i\n        assume inR: \"(V,V') \\<in> R\"\n        assume irange: \"i < length V\"\n        assume notIDC: \"\\<not> IDC d (V!i) \n          (htchLoc (pp (V!i)))\"\n        from inR R_def obtain c c' W W' where VV'assump:\n          \"V = c#W \\<and> V'=c'#W' \\<and> W \\<noteq> [] \\<and> W' \\<noteq> [] \\<and>\n          ([c],[c']) \\<in> Rc \\<and> (W,W') \\<in> RV\"\n          by auto\n        \\<comment> \\<open>Case separation for i\\<close>\n        from VV'assump SdlHPPRc have Case_i0:\n          \"i = 0 \\<Longrightarrow> (NDC d (V!i) \\<or>\n            IDC d (V!i) (htchLoc (pp (V!i))))\"\n          by (simp add: Strong_dlHPP_Bisimulation_def, auto)\n\n        from VV'assump SdlHPPRV have \"\\<forall>i < length W. \n          (NDC d (W!i) \\<or>\n            IDC d (W!i) (htchLoc (pp (W!i))))\"\n          by (simp add: Strong_dlHPP_Bisimulation_def, auto)\n\n        with irange VV'assump have Case_in0:\n          \"i > 0 \\<Longrightarrow> (NDC d (V!i) \\<or> \n          IDC d (V!i) (htchLoc (pp (V!i))))\"\n          by simp\n        from notIDC Case_i0 Case_in0 \n        show \"NDC d (V!i)\"\n          by auto\n      next\n        fix V V' m1 m1' m2 \\<alpha> p i\n        assume inR: \"(V,V') \\<in> R\"\n        assume irange: \"i < length V\"\n        assume step: \"\\<langle>V!i,m1\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>\\<rhd> \\<langle>p,m2\\<rangle>\"\n        assume dhequal: \"m1 \\<sim>\\<^bsub>d,(htchLocSet PP)\\<^esub> m1'\"\n        \n        from inR R_def obtain c c' W W' where VV'assump:\n          \"V = c#W \\<and> V'=c'#W' \\<and> W \\<noteq> [] \\<and> W' \\<noteq> [] \\<and>\n          ([c],[c']) \\<in> Rc \\<and> (W,W') \\<in> RV\"\n          by auto\n        \\<comment> \\<open>Case separation for i\\<close>\n        from VV'assump SdlHPPRc strongdlHPPB_aux[of \"d\" \"PP\" \n          \"Rc\" \"0\" \"[c]\" \"[c']\"] step dhequal\n        have Case_i0:\n          \"i = 0 \\<Longrightarrow> \\<exists>p' \\<alpha>' m2'.\n          \\<langle>V'!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n          stepResultsinR p p' (R \\<union> (Rc \\<union> RV)) \\<and>\n          ((\\<alpha>,\\<alpha>') \\<in> R \\<or> (\\<alpha>,\\<alpha>') \\<in> Rc \\<or> (\\<alpha>,\\<alpha>') \\<in> RV) \\<and>\n          dhequality_alternative d PP (pp (V!i)) m2 m2'\"\n          by (simp add: stepResultsinR_def, blast)\n\n        from step VV'assump irange have rewV: \n          \"i > 0 \\<Longrightarrow> (i-Suc 0) < length W \\<and> V!i = W!(i-Suc 0)\"\n          by simp\n\n        with irange VV'assump step dhequal SdlHPPRV \n          strongdlHPPB_aux[of \"d\" \"PP\" \"RV\" _ \"W\" \"W'\"]\n        have Case_in0:\n          \"i > 0 \\<Longrightarrow>  \\<exists>p' \\<alpha>' m2'.\n          \\<langle>V'!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n          stepResultsinR p p' (R \\<union> (Rc \\<union> RV)) \\<and>\n          ((\\<alpha>,\\<alpha>') \\<in> R \\<or> (\\<alpha>,\\<alpha>') \\<in> Rc \\<or> (\\<alpha>,\\<alpha>') \\<in> RV) \\<and>\n          dhequality_alternative d PP (pp (V!i)) m2 m2'\"\n          by (simp add: stepResultsinR_def, blast)\n        \n        from Case_i0 Case_in0 \n        show \"\\<exists>p' \\<alpha>' m2'.\n          \\<langle>V'!i,m1'\\<rangle> \\<rightarrow>\\<lhd>\\<alpha>'\\<rhd> \\<langle>p',m2'\\<rangle> \\<and>\n          stepResultsinR p p' (R \\<union> (Rc \\<union> RV)) \\<and>\n          ((\\<alpha>,\\<alpha>') \\<in> R \\<or> (\\<alpha>,\\<alpha>') \\<in> Rc \\<or> (\\<alpha>,\\<alpha>') \\<in> RV) \\<and>\n          dhequality_alternative d PP (pp (V!i)) m2 m2'\"\n          by auto\n      qed\n  with Areflassump2 Rc'assump Up_To_Technique\n  show \"\\<exists>R. SdlHPPB d PP R \\<and> (c#V, c#V) \\<in> R\"\n    by (metis UnCI inR)\n\nqed\n\nend\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/WHATandWHERE_Security/Parallel_Composition.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548646660543, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.3028159001049494}}
{"text": "(*\n * Copyright 2022, Proofcraft Pty Ltd\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchKernelInit_AI\nimports\n  ADT_AI\n  Tcb_AI\n  Arch_AI\nbegin\n\ncontext Arch begin global_naming AARCH64\n\ntext \\<open>\n  Showing that there is a state that satisfies the abstract invariants.\n\\<close>\n\nlemmas ptr_defs = idle_thread_ptr_def init_irq_node_ptr_def arm_global_pt_ptr_def\nlemmas state_defs = init_A_st_def init_kheap_def init_arch_state_def\n                    init_vspace_uses_def ptr_defs global_pt_obj_def\n\nlemma is_tcb_TCB[simp]: \"is_tcb (TCB t)\" by (simp add: is_tcb_def)\n\nlemma ran_empty_cnode[simp]: \"ran (empty_cnode n) = {NullCap}\"\n  apply (rule equalityI; clarsimp simp: ran_def empty_cnode_def)\n  apply (rule_tac x=\"replicate n False\" in exI)\n  apply simp\n  done\n\nlemma empty_cnode_apply[simp]:\n  \"(empty_cnode n xs = Some cap) = (length xs = n \\<and> cap = NullCap)\"\n  by (auto simp add: empty_cnode_def)\n\nlemma valid_cs_size_empty[simp]:\n  \"valid_cs_size n (empty_cnode n) = (n < word_bits - cte_level_bits)\"\n  using wf_empty_bits [of n] by (simp add: valid_cs_size_def)\n\nlemma init_cdt [simp]:\n  \"cdt init_A_st = init_cdt\"\n  by (simp add: state_defs)\n\nlemma mdp_parent_empty[simp]:\n  \"\\<not>Map.empty \\<Turnstile> x \\<rightarrow> y\"\n  by (auto simp: cdt_parent_of_def dest: tranclD)\n\nlemma descendants_empty[simp]:\n  \"descendants_of x Map.empty = {}\"\n  by (clarsimp simp: descendants_of_def)\n\nlemma is_reply_cap_NullCap[simp]: \"\\<not>is_reply_cap NullCap\"\n  by (simp add: is_reply_cap_def)\n\ndeclare cap_range_NullCap [simp]\n\nlemma pptr_base_num:\n  \"pptr_base = 0x8000000000\"\n  by (simp add: pptr_base_def pptrBase_def canonical_bit_def)\n\ndefinition irq_node_bits :: nat where\n  \"irq_node_bits = cte_level_bits + LENGTH(irq_len)\"\n\nlemmas irq_node_bits_num = irq_node_bits_def[unfolded cte_level_bits_def, simplified]\n\n(* Some other architectures need to prove more here, but if the init_irq_node is the last object\n   in the init state, we only need info about  init_irq_node_ptr, and not about\n   init_irq_node_ptr + mask irq_node bits *)\nlemma init_irq_ptrs_ineqs:\n  \"init_irq_node_ptr + (ucast (irq :: irq) << cte_level_bits) \\<ge> init_irq_node_ptr\"\nproof -\n  have P: \"ucast irq < (2 ^ (irq_node_bits - cte_level_bits) :: machine_word)\"\n    apply (rule order_le_less_trans[OF\n        ucast_le_ucast[where 'a=irq_len and 'b=machine_word_len, simplified, THEN iffD2, OF word_n1_ge]])\n    apply (simp add: cte_level_bits_def minus_one_norm irq_node_bits_def)\n    done\n  show \"init_irq_node_ptr + (ucast (irq :: irq) << cte_level_bits) \\<ge> init_irq_node_ptr\"\n    apply (rule is_aligned_no_wrap'[where sz=irq_node_bits])\n     apply (simp add: is_aligned_def init_irq_node_ptr_def pptr_base_num irq_node_bits_num)\n    apply (rule shiftl_less_t2n[OF P])\n    apply (simp add: irq_node_bits_num)\n    done\nqed\n\nlemmas init_irq_ptrs_less_ineqs\n   = init_irq_ptrs_ineqs(1)[THEN order_less_le_trans[rotated]]\n\nlemmas init_irq_ptrs_all_ineqs[unfolded init_irq_node_ptr_def cte_level_bits_def]\n   = init_irq_ptrs_ineqs(1)[THEN order_trans[rotated]]\n     init_irq_ptrs_less_ineqs\n     init_irq_ptrs_less_ineqs[THEN less_imp_neq]\n     init_irq_ptrs_less_ineqs[THEN less_imp_neq, THEN not_sym]\n\nlemma init_irq_ptrs_eq:\n  \"((ucast irq << cte_level_bits) = (ucast (irq' :: irq) << cte_level_bits :: machine_word))\n   = (irq = irq')\"\n  by word_bitwise (clarsimp simp: cte_level_bits_def)\n\nlemma pspace_aligned_init_A:\n  \"pspace_aligned init_A_st\"\n  apply (clarsimp simp: pspace_aligned_def state_defs wf_obj_bits [OF wf_empty_bits]\n                        dom_if_Some cte_level_bits_def bit_simps pptr_base_num kernel_elf_base_def)\n  apply (safe intro!: aligned_add_aligned[OF _ is_aligned_shiftl_self order_refl],\n           simp_all add: is_aligned_def word_bits_def)[1]\n  done\n\nlemma pspace_distinct_init_A:\n  notes ineqs = pptr_base_num init_irq_ptrs_all_ineqs[simplified pptr_base_num mask_def, simplified]\n  shows \"pspace_distinct init_A_st\"\n  unfolding pspace_distinct_def\n  apply (clarsimp simp: state_defs empty_cnode_bits cte_level_bits_def linorder_not_le\n                  split del: if_split cong: if_cong)\n  apply (clarsimp simp: ineqs split: if_split_asm)\n    apply (simp add: bit_simps ineqs)\n   apply (simp add: bit_simps ineqs)\n  apply (cut_tac x=\"init_irq_node_ptr + (ucast irq << cte_level_bits)\"\n             and y=\"init_irq_node_ptr + (ucast irqa << cte_level_bits)\"\n             and sz=cte_level_bits in aligned_neq_into_no_overlap;\n         simp add: init_irq_node_ptr_def pptr_base_num cte_level_bits_def)\n    apply (rule aligned_add_aligned[OF _ is_aligned_shiftl_self order_refl])\n    apply (simp add: is_aligned_def)\n   apply (rule aligned_add_aligned[OF _ is_aligned_shiftl_self order_refl])\n   apply (simp add: is_aligned_def)\n  apply (simp add: linorder_not_le)\n  done\n\nlemma caps_of_state_init_A_st_Null:\n  \"caps_of_state (init_A_st::'z::state_ext state) x\n     = (if cte_at x (init_A_st::'z::state_ext state) then Some NullCap else None)\"\n  apply (subgoal_tac \"\\<not> cte_wp_at ((\\<noteq>) NullCap) x init_A_st\")\n   apply (auto simp add: cte_wp_at_caps_of_state)[1]\n  apply (clarsimp, erule cte_wp_atE)\n   apply (auto simp add: state_defs tcb_cap_cases_def split: if_split_asm)\n  done\n\nlemma cte_wp_at_init_A_st_Null:\n  \"cte_wp_at P p init_A_st \\<Longrightarrow> P cap.NullCap\"\n  apply (subst(asm) cte_wp_at_caps_of_state)\n  apply (simp add:caps_of_state_init_A_st_Null split: if_splits)\n  done\n\nlemmas cte_wp_at_caps_of_state_eq\n    = cte_wp_at_caps_of_state[where P=\"(=) cap\" for cap]\n\nlemma pspace_respects_device_region_init[simp]:\n  \"pspace_respects_device_region init_A_st\"\n   apply (clarsimp simp: pspace_respects_device_region_def state_defs init_machine_state_def\n                         device_mem_def in_device_frame_def obj_at_def a_type_def)\n   apply (rule ext)\n   apply clarsimp\n   done\n\nlemma cap_refs_respects_device_region_init[simp]:\n  \"cap_refs_respects_device_region init_A_st\"\n   apply (clarsimp simp: cap_refs_respects_device_region_def)\n   apply (frule cte_wp_at_caps_of_state[THEN iffD1])\n   apply clarsimp\n   apply (subst(asm) caps_of_state_init_A_st_Null)\n   apply (clarsimp simp: cte_wp_at_caps_of_state cap_range_respects_device_region_def)\n   done\n\nlemma pool_for_asid_init_A_st[simp]:\n  \"pool_for_asid asid init_A_st = None\"\n  by (simp add: pool_for_asid_def state_defs)\n\nlemma vspace_for_asid_init_A_st[simp]:\n  \"vspace_for_asid asid init_A_st = None\"\n  by (simp add: vspace_for_asid_def entry_for_asid_def obind_def)\n\nlemma global_pt_init_A_st[simp]:\n  \"global_pt init_A_st = arm_global_pt_ptr\"\n  by (simp add: state_defs)\n\nlemma is_alignedarm_global_pt_ptr[simp]:\n  \"is_aligned arm_global_pt_ptr (pt_bits VSRootPT_T)\"\n  by (simp add: arm_global_pt_ptr_def pptr_base_num bit_simps is_aligned_def)\n\nlemma ptes_of_init_A_st_global:\n  \"ptes_of init_A_st =\n   (\\<lambda>pt_t p. if pt_t = VSRootPT_T \\<and> table_base VSRootPT_T p = arm_global_pt_ptr \\<and>\n             is_aligned p pte_bits then Some InvalidPTE else None)\"\n  by (rule ext)+ (auto simp: state_defs level_pte_of_def obind_def opt_map_def split: option.splits)\n\nlemma pt_walk_init_A_st[simp]:\n  \"pt_walk max_pt_level level arm_global_pt_ptr vref (ptes_of init_A_st) =\n   Some (max_pt_level, arm_global_pt_ptr)\"\n  apply (subst pt_walk.simps)\n  apply (simp add: in_omonad ptes_of_init_A_st_global\n                   table_base_pt_slot_offset[where level=max_pt_level, simplified]\n                   is_aligned_pt_slot_offset_pte[where pt_t=VSRootPT_T])\n  done\n\nlemma kernel_window_init_st:\n  \"kernel_window init_A_st = { pptr_base ..< pptr_base + (1 << 30) }\"\n  by (auto simp: state_defs kernel_window_def)\n\nlemma valid_global_vspace_mappings_init_A_st[simp]:\n  \"valid_global_vspace_mappings init_A_st\"\n  unfolding valid_global_vspace_mappings_def\n  by simp\n\nlemma valid_uses_init_A_st[simp]: \"valid_uses_2 init_vspace_uses\"\nproof -\n  have [simp]: \"pptr_base < pptr_base + 0x40000000\"\n    by (simp add: pptr_base_def pptrBase_def)\n  have \"\\<And>p. p < pptr_base + 0x40000000 \\<Longrightarrow> canonical_address p\"\n    by (simp add: canonical_address_range canonical_bit_def mask_def pptr_base_def pptrBase_def\n                  word_le_nat_alt word_less_nat_alt)\n  moreover\n  have \"pptr_base + 0x40000000 < pptrTop\"\n    by (simp add: pptrTop_def pptr_base_def pptrBase_def)\n  moreover\n  have \"pptr_base + 0x40000000 < kdev_base\"\n    by (simp add: kdev_base_def kdevBase_def pptr_base_def pptrBase_def)\n  ultimately\n  show ?thesis\n    unfolding valid_uses_2_def init_vspace_uses_def window_defs\n    by auto\nqed\n\nlemma valid_global_arch_objs_init_A_st[simp]:\n  \"valid_global_arch_objs init_A_st\"\n  by (simp add: valid_global_arch_objs_def state_defs level_defs obj_at_def)\n\nlemma vspace_for_pool_init_A_st[simp]:\n  \"vspace_for_pool ap asid (asid_pools_of init_A_st) = None\"\n  by (clarsimp simp: vspace_for_pool_def obind_def in_opt_map_eq state_defs entry_for_pool_def\n               split: option.splits)\n\nlemma user_region_vs_lookup_target_init_A_st[simp]:\n  \"vref \\<in> user_region \\<Longrightarrow> vs_lookup_target bot_level asid vref init_A_st = None\"\n  by (clarsimp simp: vs_lookup_target_def obind_def vs_lookup_slot_def vs_lookup_table_def\n               split: option.splits)\n\nlemma valid_vs_lookup_init_A_st[simp]:\n  \"valid_vs_lookup init_A_st\"\n  by (clarsimp simp: valid_vs_lookup_def)\n\nlemma valid_vspace_objs_init_A_st[simp]:\n  \"valid_vspace_objs init_A_st\"\n  by (clarsimp simp: valid_vspace_objs_def in_omonad vs_lookup_table_def)\n\nlemma idle_thread_in_kernel_window_init_arch_state[simp]:\n  \"{idle_thread_ptr..0x3FF + idle_thread_ptr} \\<subseteq>\n     kernel_window_2 (arm_kernel_vspace init_arch_state)\"\n  apply (clarsimp simp: state_defs pptr_base_num bit_simps kernel_window_def kernel_elf_base_def)\n  apply (rule conjI; unat_arith)\n  done\n\nlemma irq_node_in_kernel_window_init_arch_state':\n  \"\\<lbrakk> init_irq_node_ptr + m \\<le> x; x \\<le> init_irq_node_ptr + m + mask cte_level_bits;\n     m \\<le> mask (size (irq::irq)) << cte_level_bits\\<rbrakk>\n   \\<Longrightarrow> x \\<in> kernel_window_2 (arm_kernel_vspace init_arch_state)\"\n  apply (clarsimp simp: kernel_window_def init_vspace_uses_def init_arch_state_def)\n  apply (rule conjI)\n   apply (clarsimp simp: state_defs)\n   apply (rule ccontr, simp add:not_le)\n   apply (drule(1) le_less_trans)\n   (* We pick 30 for alignment of pptr_base, because pttr_base is set to 2^40-2^30 *)\n   apply (cut_tac is_aligned_no_wrap'[where ptr=pptr_base\n                                      and off=\"0xc000 + m\"\n                                      and sz=30, simplified])\n     apply (simp add: add_ac)\n    apply (simp add: pptr_base_num canonical_bit_def is_aligned_def)\n   apply (simp add: pptr_base_num cte_level_bits_def canonical_bit_def mask_def word_size)\n   apply unat_arith\n  apply (simp add: cte_level_bits_def mask_def init_irq_node_ptr_def pptr_base_num word_size)\n  apply unat_arith\n  done\n\nlemma irq_node_in_kernel_window_init_arch_state[simp]:\n  \"\\<lbrakk> init_irq_node_ptr + (ucast (irq::irq) << cte_level_bits) \\<le> x;\n     x \\<le> init_irq_node_ptr + (ucast irq << cte_level_bits) + 2 ^ cte_level_bits - 1 \\<rbrakk>\n   \\<Longrightarrow> x \\<in> kernel_window_2 (arm_kernel_vspace init_arch_state)\"\n  apply (erule irq_node_in_kernel_window_init_arch_state')\n   apply (simp add: mask_def add_diff_eq)\n  apply (simp add: word_size mask_def cte_level_bits_def)\n  apply (thin_tac P for P)\n  apply word_bitwise\n  done\n\nlemma tcb_vcpu_init_arch_tcb_None[simp]:\n  \"tcb_vcpu init_arch_tcb = None\"\n  by (simp add: init_arch_tcb_def)\n\nlemma pspace_in_kernel_window_init_A_st:\n  \"pspace_in_kernel_window init_A_st\"\n  apply (clarsimp simp: pspace_in_kernel_window_def init_A_st_def init_kheap_def)\n  apply (safe; clarsimp)\n       apply (clarsimp simp: ptr_defs pptr_base_num)\n      apply (clarsimp simp: ptr_defs pptr_base_num kernel_window_def init_arch_state_def\n                            init_vspace_uses_def)\n      apply unat_arith\n     apply (clarsimp simp: global_pt_obj_def bit_simps ptr_defs pptr_base_num kernel_window_def\n                           init_arch_state_def init_vspace_uses_def\n                     split: if_split_asm)\n      apply unat_arith\n     apply unat_arith\n    apply (clarsimp simp: ptr_defs pptr_base_num kernel_window_def init_arch_state_def init_vspace_uses_def)\n   apply (clarsimp simp: ptr_defs pptr_base_num kernel_window_def init_arch_state_def init_vspace_uses_def)\n   apply unat_arith\n  apply (clarsimp simp: global_pt_obj_def bit_simps ptr_defs pptr_base_num kernel_window_def\n                        init_arch_state_def init_vspace_uses_def\n                  split: if_split_asm)\n   apply unat_arith\n  apply unat_arith\n  done\n\nlemma invs_A:\n  \"invs init_A_st\" (is \"invs ?st\")\n  supply is_aligned_def[THEN iffD2, simp]\n  supply image_cong_simp [cong del]\n  supply pptr_base_num[simp] kernel_elf_base_def[simp]\n  apply (simp add: invs_def)\n  apply (rule conjI)\n   prefer 2\n   apply (simp add: cur_tcb_def state_defs obj_at_def)\n  apply (simp add: valid_state_def)\n  apply (rule conjI)\n   apply (simp add: valid_pspace_def)\n   apply (rule conjI)\n    apply (clarsimp simp: valid_objs_def state_defs wellformed_pte_def valid_pt_range_def\n                          valid_obj_def valid_vm_rights_def vm_kernel_only_def\n                          dom_if_Some cte_level_bits_def)\n    apply (clarsimp simp: valid_tcb_def tcb_cap_cases_def is_master_reply_cap_def\n                          valid_cap_def obj_at_def valid_tcb_state_def valid_arch_tcb_def\n                          cap_aligned_def word_bits_def valid_ipc_buffer_cap_simps)+\n    apply (clarsimp simp: valid_cs_def word_bits_def cte_level_bits_def\n                          valid_tcb_def\n                   split: if_split_asm)\n   apply (simp add: pspace_aligned_init_A pspace_distinct_init_A)\n    apply (clarsimp simp: if_live_then_nonz_cap_def obj_at_def state_defs live_def hyp_live_def arch_live_def)\n    apply (clarsimp simp: zombies_final_def cte_wp_at_cases state_defs ex_nonz_cap_to_def\n                          tcb_cap_cases_def is_zombie_def)\n   apply (clarsimp simp: sym_refs_def state_refs_of_def state_defs state_hyp_refs_of_def)\n  apply (rule conjI)\n   apply (clarsimp simp: valid_mdb_def init_cdt_def no_mloop_def\n                         mdb_cte_at_def)\n   apply (clarsimp simp: untyped_mdb_def caps_of_state_init_A_st_Null\n                         untyped_inc_def ut_revocable_def\n                         irq_revocable_def reply_master_revocable_def\n                         reply_mdb_def reply_caps_mdb_def\n                         reply_masters_mdb_def valid_arch_mdb_def)\n   apply (simp add:descendants_inc_def)\n  apply (rule conjI)\n   apply (simp add: valid_ioc_def init_A_st_def init_ioc_def cte_wp_at_cases2)\n   apply (intro allI impI, elim exE conjE)\n   apply (case_tac obj, simp_all add: cap_of_def)\n   apply (clarsimp simp: init_kheap_def split: if_split_asm)\n  apply (rule conjI)\n   apply (clarsimp simp: valid_idle_def pred_tcb_at_def obj_at_def state_defs valid_arch_idle_def)\n  apply (rule conjI, clarsimp simp: only_idle_def pred_tcb_at_def obj_at_def state_defs)\n  apply (rule conjI, clarsimp simp: if_unsafe_then_cap_def caps_of_state_init_A_st_Null)\n  apply (subgoal_tac \"valid_reply_caps ?st \\<and> valid_reply_masters ?st \\<and> valid_global_refs ?st\")\n   prefer 2\n   subgoal\n     using cte_wp_at_init_A_st_Null\n     by (fastforce simp: valid_reply_caps_def unique_reply_caps_def\n                         has_reply_cap_def is_reply_cap_to_def pred_tcb_at_def obj_at_def\n                         caps_of_state_init_A_st_Null is_master_reply_cap_to_def\n                         valid_reply_masters_def valid_global_refs_def\n                         valid_refs_def[unfolded cte_wp_at_caps_of_state])\n  apply (clarsimp, (thin_tac \"_\")+) (* use new proven assumptions, then drop them *)\n  apply (rule conjI)\n   apply (clarsimp simp: valid_arch_state_def)\n   apply (rule conjI)\n    apply (clarsimp simp: valid_asid_table_def state_defs)\n   apply (simp add: valid_arch_state_def state_defs obj_at_def a_type_def cur_vcpu_2_def\n                    vmid_inv_def is_inv_def vmid_for_asid_2_def obind_def\n                    valid_global_tables_2_def empty_pt_def)\n  apply (rule conjI)\n   apply (clarsimp simp: valid_irq_node_def obj_at_def state_defs\n                         is_cap_table_def wf_empty_bits\n                         init_irq_ptrs_all_ineqs cte_level_bits_def\n                         init_irq_ptrs_eq[unfolded cte_level_bits_def])\n   apply (intro conjI)\n    apply (rule inj_onI)\n    apply (simp add: init_irq_ptrs_eq[unfolded cte_level_bits_def])\n   apply (clarsimp; word_bitwise)\n  apply (simp add: valid_irq_handlers_def caps_of_state_init_A_st_Null\n                   ran_def cong: rev_conj_cong)\n  apply (rule conjI)\n   apply (clarsimp simp: valid_irq_states_def state_defs init_machine_state_def\n                         valid_irq_masks_def init_irq_masks_def)\n  apply (rule conjI)\n   apply (clarsimp simp: valid_machine_state_def state_defs\n                         init_machine_state_def init_underlying_memory_def)\n  apply (rule conjI)\n   apply (clarsimp simp: valid_arch_caps_def valid_asid_pool_caps_def unique_table_caps_def\n                         caps_of_state_init_A_st_Null valid_table_caps_def unique_table_refs_def)\n   apply (clarsimp simp: state_defs)\n  apply (clarsimp simp: valid_global_objs_def valid_kernel_mappings_def valid_asid_map_def)\n  apply (rule conjI)\n   apply (clarsimp simp: equal_kernel_mappings_def)\n  apply (simp add: pspace_in_kernel_window_init_A_st cap_refs_in_kernel_window_def\n                   caps_of_state_init_A_st_Null valid_refs_def[unfolded cte_wp_at_caps_of_state])\n  done\n\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/AARCH64/ArchKernelInit_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6513548511303336, "lm_q2_score": 0.46490157137338844, "lm_q1q2_score": 0.3028158938121716}}
{"text": "theory ASC_Sufficiency\n  imports ASC_Suite\nbegin\n\nsection {* Sufficiency of the test suite to test for reduction *}\n\ntext \\<open>\nThis section provides a proof that the test suite generated by the adaptive state counting algorithm\nis sufficient to test for reduction.\n\\<close>\n\nsubsection {* Properties of minimal sequences to failures extending the deterministic state cover *}\n\ntext \\<open>\nThe following two lemmata show that minimal sequences to failures extending the deterministic state\ncover do not with their extending suffix visit any state twice or visit a state also reached by a\nsequence in the chosen permutation of reactions to the deterministic state cover.\n\\<close>\n\nlemma minimal_sequence_to_failure_extending_implies_Rep_Pre :\n  assumes \"minimal_sequence_to_failure_extending V M1 M2 vs xs\"\n  and     \"OFSM M1\"\n  and     \"OFSM M2\"\n  and     \"test_tools M2 M1 FAIL PM V \\<Omega>\"\n  and     \"V'' \\<in> N (vs@xs') M1 V\"\n  and     \"prefix xs' xs\"\n  shows \"\\<not> Rep_Pre M2 M1 vs xs'\"\nproof \n  assume \"Rep_Pre M2 M1 vs xs'\" \n  then obtain xs1 xs2 s1 s2 where  \"prefix xs1 xs2\"   \n                                   \"prefix xs2 xs'\"\n                                   \"xs1 \\<noteq> xs2\"\n                                   \"io_targets M2 (initial M2) (vs @ xs1) = {s2}\" \n                                   \"io_targets M2 (initial M2) (vs @ xs2) = {s2}\"\n                                   \"io_targets M1 (initial M1) (vs @ xs1) = {s1}\"\n                                   \"io_targets M1 (initial M1) (vs @ xs2) = {s1}\"\n    by auto\n  then have \"s2 \\<in> io_targets M2 (initial M2) (vs @ xs1)\"\n            \"s2 \\<in> io_targets M2 (initial M2) (vs @ xs2)\"\n            \"s1 \\<in> io_targets M1 (initial M1) (vs @ xs1)\"\n            \"s1 \\<in> io_targets M1 (initial M1) (vs @ xs2)\"            \n    by auto\n\n  have \"vs@xs1 \\<in> L M1\" \n    using io_target_implies_L[OF \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs1)\\<close>] by assumption\n  have \"vs@xs2 \\<in> L M1\" \n    using io_target_implies_L[OF \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs2)\\<close>] by assumption\n  have \"vs@xs1 \\<in> L M2\" \n    using io_target_implies_L[OF \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs1)\\<close>] by assumption\n  have \"vs@xs2 \\<in> L M2\" \n    using io_target_implies_L[OF \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs2)\\<close>] by assumption\n\n  obtain tr1_1 where \"path M1 (vs@xs1 || tr1_1) (initial M1)\" \n                     \"length tr1_1 = length (vs@xs1)\" \n                     \"target (vs@xs1 || tr1_1) (initial M1) = s1\"\n    using \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs1)\\<close> by auto\n  obtain tr1_2 where \"path M1 (vs@xs2 || tr1_2) (initial M1)\" \n                     \"length tr1_2 = length (vs@xs2)\" \n                     \"target (vs@xs2 || tr1_2) (initial M1) = s1\"\n    using \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs2)\\<close> by auto \n  obtain tr2_1 where \"path M2 (vs@xs1 || tr2_1) (initial M2)\" \n                     \"length tr2_1 = length (vs@xs1)\" \n                     \"target (vs@xs1 || tr2_1) (initial M2) = s2\"\n    using \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs1)\\<close> by auto\n  obtain tr2_2 where \"path M2 (vs@xs2 || tr2_2) (initial M2)\"\n                     \"length tr2_2 = length (vs@xs2)\"\n                     \"target (vs@xs2 || tr2_2) (initial M2) = s2\"\n    using \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs2)\\<close> by auto \n\n\n  have \"productF M2 M1 FAIL PM\" \n    using assms(4) by auto\n  have \"well_formed M1\" \n    using assms(2) by auto\n  have \"well_formed M2\" \n    using assms(3) by auto\n  have \"observable PM\"\n    by (meson assms(2) assms(3) assms(4) observable_productF)\n\n  have \"length (vs@xs1) = length tr2_1\"\n    using \\<open>length tr2_1 = length (vs @ xs1)\\<close> by presburger\n  then have \"length tr2_1 = length tr1_1\" \n    using \\<open>length tr1_1 = length (vs@xs1)\\<close> by presburger\n\n  have \"vs@xs1 \\<in> L PM\" \n    using productF_path_inclusion[OF \\<open>length (vs@xs1) = length tr2_1\\<close> \\<open>length tr2_1 = length tr1_1\\<close> \n                                     \\<open>productF M2 M1 FAIL PM\\<close> \\<open>well_formed M2\\<close> \\<open>well_formed M1\\<close>]\n    by (meson Int_iff \\<open>productF M2 M1 FAIL PM\\<close> \\<open>vs @ xs1 \\<in> L M1\\<close> \\<open>vs @ xs1 \\<in> L M2\\<close> \\<open>well_formed M1\\<close> \n        \\<open>well_formed M2\\<close> productF_language)\n    \n\n  have \"length (vs@xs2) = length tr2_2\"\n    using \\<open>length tr2_2 = length (vs @ xs2)\\<close> by presburger\n  then have \"length tr2_2 = length tr1_2\" \n    using \\<open>length tr1_2 = length (vs@xs2)\\<close> by presburger\n\n  have \"vs@xs2 \\<in> L PM\" \n    using productF_path_inclusion[OF \\<open>length (vs@xs2) = length tr2_2\\<close> \\<open>length tr2_2 = length tr1_2\\<close> \n                                     \\<open>productF M2 M1 FAIL PM\\<close> \\<open>well_formed M2\\<close> \\<open>well_formed M1\\<close>]\n    by (meson Int_iff \\<open>productF M2 M1 FAIL PM\\<close> \\<open>vs @ xs2 \\<in> L M1\\<close> \\<open>vs @ xs2 \\<in> L M2\\<close> \\<open>well_formed M1\\<close> \n        \\<open>well_formed M2\\<close> productF_language)\n\n\n  \n\n  have \"io_targets PM (initial M2, initial M1) (vs @ xs1) = {(s2, s1)}\" \n    using productF_path_io_targets_reverse\n          [OF \\<open>productF M2 M1 FAIL PM\\<close> \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs1)\\<close> \n              \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs1)\\<close> \\<open>vs @ xs1 \\<in> L M2\\<close> \\<open>vs @ xs1 \\<in> L M1\\<close> ]\n  proof -\n    have \"\\<forall>c f. c \\<noteq> initial (f::('a, 'b, 'c) FSM) \\<or> c \\<in> nodes f\"\n      by blast\n    then show ?thesis\n      by (metis (no_types) \\<open>\\<lbrakk>observable M2; observable M1; well_formed M2; well_formed M1; \n                             initial M2 \\<in> nodes M2; initial M1 \\<in> nodes M1\\<rbrakk> \n                            \\<Longrightarrow> io_targets PM (initial M2, initial M1) (vs @ xs1) = {(s2, s1)}\\<close> \n          assms(2) assms(3))\n  qed \n\n  have \"io_targets PM (initial M2, initial M1) (vs @ xs2) = {(s2, s1)}\" \n    using productF_path_io_targets_reverse\n          [OF \\<open>productF M2 M1 FAIL PM\\<close> \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs2)\\<close> \n              \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs2)\\<close> \\<open>vs @ xs2 \\<in> L M2\\<close> \\<open>vs @ xs2 \\<in> L M1\\<close> ]\n  proof -\n    have \"\\<forall>c f. c \\<noteq> initial (f::('a, 'b, 'c) FSM) \\<or> c \\<in> nodes f\"\n      by blast\n    then show ?thesis\n      by (metis (no_types) \\<open>\\<lbrakk>observable M2; observable M1; well_formed M2; well_formed M1; \n                             initial M2 \\<in> nodes M2; initial M1 \\<in> nodes M1\\<rbrakk> \n                            \\<Longrightarrow> io_targets PM (initial M2, initial M1) (vs @ xs2) = {(s2, s1)}\\<close> \n          assms(2) assms(3))\n  qed\n\n  have \"prefix (vs @ xs1) (vs @ xs2)\"\n    using \\<open>prefix xs1 xs2\\<close> by auto\n\n\n\n  have \"sequence_to_failure M1 M2 (vs@xs)\" \n    using assms(1) by auto\n  \n\n  have \"prefix (vs@xs1) (vs@xs')\"\n    using \\<open>prefix xs1 xs2\\<close> \\<open>prefix xs2 xs'\\<close> prefix_order.dual_order.trans same_prefix_prefix \n    by blast \n  have \"prefix (vs@xs2) (vs@xs')\"\n    using \\<open>prefix xs2 xs'\\<close> prefix_order.dual_order.trans same_prefix_prefix by blast \n\n   \n\n  have \"io_targets PM (initial PM) (vs @ xs1) = {(s2,s1)}\"\n    using \\<open>io_targets PM (initial M2, initial M1) (vs @ xs1) = {(s2, s1)}\\<close> assms(4) by auto\n  have \"io_targets PM (initial PM) (vs @ xs2) = {(s2,s1)}\"\n    using \\<open>io_targets PM (initial M2, initial M1) (vs @ xs2) = {(s2, s1)}\\<close> assms(4) by auto\n\n\n  have \"(vs @ xs2) @ (drop (length xs2) xs) = vs@xs\"\n    by (metis \\<open>prefix xs2 xs'\\<close>  append_eq_appendI append_eq_conv_conj assms(6) prefixE) \n  moreover have \"io_targets PM (initial PM) (vs@xs) = {FAIL}\" \n    using sequence_to_failure_reaches_FAIL_ob[OF \\<open>sequence_to_failure M1 M2 (vs@xs)\\<close> assms(2,3) \n                                                 \\<open>productF M2 M1 FAIL PM\\<close>] \n    by assumption\n  ultimately have \"io_targets PM (initial PM) ((vs @ xs2) @ (drop (length xs2) xs)) = {FAIL}\" \n    by auto\n  \n  have \"io_targets PM (s2,s1) (drop (length xs2) xs) = {FAIL}\" \n    using observable_io_targets_split\n          [OF \\<open>observable PM\\<close>\n              \\<open>io_targets PM (initial PM) ((vs @ xs2) @ (drop (length xs2) xs)) = {FAIL}\\<close>\n              \\<open>io_targets PM (initial PM) (vs @ xs2) = {(s2, s1)}\\<close>] \n    by assumption\n\n  have \"io_targets PM (initial PM) (vs@xs1@(drop (length xs2) xs)) = {FAIL}\"\n    using observable_io_targets_append\n          [OF \\<open>observable PM\\<close> \\<open>io_targets PM (initial PM) (vs @ xs1) = {(s2,s1)}\\<close> \n              \\<open>io_targets PM (s2,s1) (drop (length xs2) xs) = {FAIL}\\<close>] \n    by simp\n  have \"sequence_to_failure M1 M2 (vs@xs1@(drop (length xs2) xs))\"\n    using sequence_to_failure_alt_def\n          [OF \\<open>io_targets PM (initial PM) (vs@xs1@(drop (length xs2) xs)) = {FAIL}\\<close> assms(2,3)]\n          assms(4) \n    by blast \n\n  have \"length xs1 < length xs2\"\n    using \\<open>prefix xs1 xs2\\<close> \\<open>xs1 \\<noteq> xs2\\<close> prefix_length_prefix by fastforce     \n  have \"xs = (xs1 @ (drop (length xs1) xs))\"\n    by (metis (no_types) \\<open>(vs @ xs2) @ drop (length xs2) xs = vs @ xs\\<close> \\<open>prefix xs1 xs2\\<close> \n        append_assoc append_eq_conv_conj prefixE)\n  have \"length xs1 < length xs\"\n    using \\<open>prefix xs1 xs2\\<close> \\<open>prefix xs2 xs'\\<close> \\<open>xs = xs1 @ drop (length xs1) xs\\<close> \\<open>xs1 \\<noteq> xs2\\<close> \n          assms(6) leI \n    by fastforce \n  have \"length (xs1@(drop (length xs2) xs)) < length xs\"\n    using \\<open>length xs1 < length xs2\\<close> \\<open>length xs1 < length xs\\<close> by auto\n\n\n  have \"vs \\<in> L\\<^sub>i\\<^sub>n M1 V \n        \\<and> sequence_to_failure M1 M2 (vs @ xs1@(drop (length xs2) xs)) \n        \\<and> length (xs1@(drop (length xs2) xs)) < length xs\"\n    using \\<open>length (xs1 @ drop (length xs2) xs) < length xs\\<close> \n          \\<open>sequence_to_failure M1 M2 (vs @ xs1 @ drop (length xs2) xs)\\<close> \n          assms(1) minimal_sequence_to_failure_extending.simps \n    by blast\n  \n  then have \"\\<not> minimal_sequence_to_failure_extending V M1 M2 vs xs\"\n    by (meson minimal_sequence_to_failure_extending.elims(2))\n   \n\n  then show \"False\" \n    using assms(1) by linarith\nqed\n  \n\n\n\nlemma minimal_sequence_to_failure_extending_implies_Rep_Cov :\n  assumes \"minimal_sequence_to_failure_extending V M1 M2 vs xs\"\n  and     \"OFSM M1\"\n  and     \"OFSM M2\"\n  and     \"test_tools M2 M1 FAIL PM V \\<Omega>\"\n  and     \"V'' \\<in> N (vs@xsR) M1 V\"\n  and     \"prefix xsR xs\"\nshows \"\\<not> Rep_Cov M2 M1 V'' vs xsR\"\nproof \n  assume \"Rep_Cov M2 M1 V'' vs xsR\"\n  then obtain xs' vs' s2 s1 where \"xs' \\<noteq> []\" \n                                  \"prefix xs' xsR\" \n                                  \"vs' \\<in> V''\"\n                                  \"io_targets M2 (initial M2) (vs @ xs') = {s2}\" \n                                  \"io_targets M2 (initial M2) (vs') = {s2}\"\n                                  \"io_targets M1 (initial M1) (vs @ xs') = {s1}\" \n                                  \"io_targets M1 (initial M1) (vs') = {s1}\"\n    by auto\n\n  then have \"s2 \\<in> io_targets M2 (initial M2) (vs @ xs')\"\n            \"s2 \\<in> io_targets M2 (initial M2) (vs')\"\n            \"s1 \\<in> io_targets M1 (initial M1) (vs @ xs')\"\n            \"s1 \\<in> io_targets M1 (initial M1) (vs')\"            \n    by auto\n\n  have \"vs@xs' \\<in> L M1\" \n    using io_target_implies_L[OF \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs')\\<close>] by assumption\n  have \"vs' \\<in> L M1\" \n    using io_target_implies_L[OF \\<open>s1 \\<in> io_targets M1 (initial M1) (vs')\\<close>] by assumption\n  have \"vs@xs' \\<in> L M2\" \n    using io_target_implies_L[OF \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs')\\<close>] by assumption\n  have \"vs' \\<in> L M2\" \n    using io_target_implies_L[OF \\<open>s2 \\<in> io_targets M2 (initial M2) (vs')\\<close>] by assumption\n\n  obtain tr1_1 where \"path M1 (vs@xs' || tr1_1) (initial M1)\"\n                     \"length tr1_1 = length (vs@xs')\"\n                     \"target (vs@xs' || tr1_1) (initial M1) = s1\"\n    using \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs')\\<close> by auto\n  obtain tr1_2 where \"path M1 (vs' || tr1_2) (initial M1)\"\n                     \"length tr1_2 = length (vs')\"\n                     \"target (vs' || tr1_2) (initial M1) = s1\"\n    using \\<open>s1 \\<in> io_targets M1 (initial M1) (vs')\\<close> by auto \n  obtain tr2_1 where \"path M2 (vs@xs' || tr2_1) (initial M2)\"\n                     \"length tr2_1 = length (vs@xs')\"\n                     \"target (vs@xs' || tr2_1) (initial M2) = s2\"\n    using \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs')\\<close> by auto\n  obtain tr2_2 where \"path M2 (vs' || tr2_2) (initial M2)\"\n                     \"length tr2_2 = length (vs')\"\n                     \"target (vs' || tr2_2) (initial M2) = s2\" \n    using \\<open>s2 \\<in> io_targets M2 (initial M2) (vs')\\<close> by auto \n\n\n  have \"productF M2 M1 FAIL PM\" \n    using assms(4) by auto\n  have \"well_formed M1\" \n    using assms(2) by auto\n  have \"well_formed M2\" \n    using assms(3) by auto\n  have \"observable PM\"\n    by (meson assms(2) assms(3) assms(4) observable_productF)\n\n  have \"length (vs@xs') = length tr2_1\"\n    using \\<open>length tr2_1 = length (vs @ xs')\\<close> by presburger\n  then have \"length tr2_1 = length tr1_1\" \n    using \\<open>length tr1_1 = length (vs@xs')\\<close> by presburger\n\n  have \"vs@xs' \\<in> L PM\" \n    using productF_path_inclusion[OF \\<open>length (vs@xs') = length tr2_1\\<close> \\<open>length tr2_1 = length tr1_1\\<close> \n                                     \\<open>productF M2 M1 FAIL PM\\<close> \\<open>well_formed M2\\<close> \\<open>well_formed M1\\<close>]\n    by (meson Int_iff \\<open>productF M2 M1 FAIL PM\\<close> \\<open>vs @ xs' \\<in> L M1\\<close> \\<open>vs @ xs' \\<in> L M2\\<close> \\<open>well_formed M1\\<close>\n        \\<open>well_formed M2\\<close> productF_language)\n    \n\n  have \"length (vs') = length tr2_2\"\n    using \\<open>length tr2_2 = length (vs')\\<close> by presburger\n  then have \"length tr2_2 = length tr1_2\" \n    using \\<open>length tr1_2 = length (vs')\\<close> by presburger\n\n  have \"vs' \\<in> L PM\" \n    using productF_path_inclusion[OF \\<open>length (vs') = length tr2_2\\<close> \\<open>length tr2_2 = length tr1_2\\<close> \n                                     \\<open>productF M2 M1 FAIL PM\\<close> \\<open>well_formed M2\\<close> \\<open>well_formed M1\\<close>]\n    by (meson Int_iff \\<open>productF M2 M1 FAIL PM\\<close> \\<open>vs' \\<in> L M1\\<close> \\<open>vs' \\<in> L M2\\<close> \\<open>well_formed M1\\<close> \n        \\<open>well_formed M2\\<close> productF_language)\n\n\n  \n\n  have \"io_targets PM (initial M2, initial M1) (vs @ xs') = {(s2, s1)}\" \n    using productF_path_io_targets_reverse\n          [OF \\<open>productF M2 M1 FAIL PM\\<close> \\<open>s2 \\<in> io_targets M2 (initial M2) (vs @ xs')\\<close> \n              \\<open>s1 \\<in> io_targets M1 (initial M1) (vs @ xs')\\<close> \\<open>vs @ xs' \\<in> L M2\\<close> \\<open>vs @ xs' \\<in> L M1\\<close> ]\n  proof -\n    have \"\\<forall>c f. c \\<noteq> initial (f::('a, 'b, 'c) FSM) \\<or> c \\<in> nodes f\"\n      by blast\n    then show ?thesis\n      by (metis (no_types) \\<open>\\<lbrakk>observable M2; observable M1; well_formed M2; well_formed M1; \n                              initial M2 \\<in> nodes M2; initial M1 \\<in> nodes M1\\<rbrakk> \n                            \\<Longrightarrow> io_targets PM (initial M2, initial M1) (vs @ xs') = {(s2, s1)}\\<close> \n          assms(2) assms(3))\n  qed \n\n  have \"io_targets PM (initial M2, initial M1) (vs') = {(s2, s1)}\" \n    using productF_path_io_targets_reverse\n          [OF \\<open>productF M2 M1 FAIL PM\\<close> \\<open>s2 \\<in> io_targets M2 (initial M2) (vs')\\<close> \n              \\<open>s1 \\<in> io_targets M1 (initial M1) (vs')\\<close> \\<open>vs' \\<in> L M2\\<close> \\<open>vs' \\<in> L M1\\<close> ]\n  proof -\n    have \"\\<forall>c f. c \\<noteq> initial (f::('a, 'b, 'c) FSM) \\<or> c \\<in> nodes f\"\n      by blast\n    then show ?thesis\n      by (metis (no_types) \\<open>\\<lbrakk>observable M2; observable M1; well_formed M2; well_formed M1; \n                              initial M2 \\<in> nodes M2; initial M1 \\<in> nodes M1\\<rbrakk> \n                            \\<Longrightarrow> io_targets PM (initial M2, initial M1) (vs') = {(s2, s1)}\\<close> \n          assms(2) assms(3))\n  qed\n  have \"io_targets PM (initial PM) (vs') = {(s2, s1)}\"\n    by (metis (no_types) \\<open>io_targets PM (initial M2, initial M1) vs' = {(s2, s1)}\\<close> \n        \\<open>productF M2 M1 FAIL PM\\<close> productF_simps(4))\n   \n\n  have \"sequence_to_failure M1 M2 (vs@xs)\" \n    using assms(1) by auto\n\n  have \"xs = xs' @ (drop (length xs') xs)\"\n    by (metis \\<open>prefix xs' xsR\\<close> append_assoc append_eq_conv_conj assms(6) prefixE)\n  then have \"io_targets PM (initial M2, initial M1) (vs @ xs' @ (drop (length xs') xs)) = {FAIL}\"\n    by (metis \\<open>productF M2 M1 FAIL PM\\<close> \\<open>sequence_to_failure M1 M2 (vs @ xs)\\<close> assms(2) assms(3) \n        productF_simps(4) sequence_to_failure_reaches_FAIL_ob)\n  then have \"io_targets PM (initial M2, initial M1) ((vs @ xs') @ (drop (length xs') xs)) = {FAIL}\"    \n    by auto\n  have \"io_targets PM (s2, s1) (drop (length xs') xs) = {FAIL}\" \n    using observable_io_targets_split\n          [OF \\<open>observable PM\\<close> \n              \\<open>io_targets PM (initial M2,initial M1) ((vs @ xs') @ (drop (length xs') xs)) = {FAIL}\\<close> \n              \\<open>io_targets PM (initial M2, initial M1) (vs @ xs') = {(s2, s1)}\\<close>] \n    by assumption\n\n  have \"io_targets PM (initial PM) (vs' @ (drop (length xs') xs)) = {FAIL}\" \n    using observable_io_targets_append\n          [OF \\<open>observable PM\\<close> \\<open>io_targets PM (initial PM) (vs') = {(s2, s1)}\\<close>\n              \\<open>io_targets PM (s2, s1) (drop (length xs') xs) = {FAIL}\\<close>] \n    by assumption\n\n  have \"sequence_to_failure M1 M2 (vs' @ (drop (length xs') xs))\"   \n    using sequence_to_failure_alt_def\n          [OF \\<open>io_targets PM (initial PM) (vs' @ (drop (length xs') xs)) = {FAIL}\\<close> assms(2,3)] \n          assms(4) \n    by blast\n\n  have \"length (drop (length xs') xs) < length xs\"\n    by (metis (no_types) \\<open>xs = xs' @ drop (length xs') xs\\<close> \\<open>xs' \\<noteq> []\\<close> length_append \n        length_greater_0_conv less_add_same_cancel2)   \n\n  have \"vs' \\<in> L\\<^sub>i\\<^sub>n M1 V\" \n  proof -\n    have \"V'' \\<in> Perm V M1\" \n      using assms(5) unfolding N.simps by blast\n\n    then obtain f where f_def : \"V'' = image f V \n                                  \\<and> (\\<forall> v \\<in> V . f v \\<in> language_state_for_input M1 (initial M1) v)\"\n      unfolding Perm.simps by blast\n    then obtain v where \"v \\<in> V\" \"vs' = f v\" \n      using \\<open>vs' \\<in> V''\\<close> by auto\n    then have \"vs' \\<in> language_state_for_input M1 (initial M1) v\" \n      using f_def by auto\n    \n    have \"language_state_for_input M1 (initial M1) v = L\\<^sub>i\\<^sub>n M1 {v}\"\n      by auto\n    moreover have \"{v} \\<subseteq> V\" \n      using \\<open>v \\<in> V\\<close> by blast   \n    ultimately have \"language_state_for_input M1 (initial M1) v \\<subseteq> L\\<^sub>i\\<^sub>n M1 V\"\n      unfolding language_state_for_inputs.simps language_state_for_input.simps by blast\n    then show ?thesis\n      using\\<open>vs' \\<in> language_state_for_input M1 (initial M1) v\\<close> by blast\n  qed\n  \n  have \"\\<not> minimal_sequence_to_failure_extending V M1 M2 vs xs\" \n    using \\<open>vs' \\<in> L\\<^sub>i\\<^sub>n M1 V\\<close>\n          \\<open>sequence_to_failure M1 M2 (vs' @ (drop (length xs') xs))\\<close>\n          \\<open>length (drop (length xs') xs) < length xs\\<close>\n    using minimal_sequence_to_failure_extending.elims(2) by blast \n  then show \"False\" \n    using assms(1) by linarith\nqed\n\n\n\n\nlemma mstfe_no_repetition :\n  assumes \"minimal_sequence_to_failure_extending V M1 M2 vs xs\"\n  and     \"OFSM M1\"\n  and     \"OFSM M2\"\n  and     \"test_tools M2 M1 FAIL PM V \\<Omega>\"\n  and     \"V'' \\<in> N (vs@xs') M1 V\"\n  and     \"prefix xs' xs\"\nshows \"\\<not> Rep_Pre M2 M1 vs xs'\"\n  and \"\\<not> Rep_Cov M2 M1 V'' vs xs'\"\n  using minimal_sequence_to_failure_extending_implies_Rep_Pre[OF assms]\n        minimal_sequence_to_failure_extending_implies_Rep_Cov[OF assms]\n  by linarith+\n\n\nsubsection {* Sufficiency of the test suite to test for reduction *}\n\ntext \\<open>\nThe following lemma proves that set of input sequences generated in the final iteration of the\n@{verbatim TS} function constitutes a test suite sufficient to test for reduction the FSMs it has \nbeen generated for.\n\nThis proof is performed by contradiction: If the test suite is not sufficient, then some minimal\nsequence to a failure extending the deterministic state cover must exist. Due to the test suite\nbeing assumed insufficient, this sequence cannot be contained in it and hence a prefix of it must\nhave been contained in one of the sets calculated by the @{verbatim R} function. This is only \npossible if the prefix is not a minimal sequence to a failure extending the deterministic state \ncover or if the test suite observes a failure, both of which violates the assumptions.\n\\<close>\n\n\nlemma asc_sufficiency :\n  assumes \"OFSM M1\"\n  and     \"OFSM M2\"\n  and     \"asc_fault_domain M2 M1 m\"\n  and     \"test_tools M2 M1 FAIL PM V \\<Omega>\"\n  and     \"final_iteration M2 M1 \\<Omega> V m i\"  \nshows \"M1 \\<preceq>\\<lbrakk>(TS M2 M1 \\<Omega> V m i) . \\<Omega>\\<rbrakk> M2 \\<longrightarrow> M1 \\<preceq> M2\"\nproof \n  assume \"atc_io_reduction_on_sets M1 (TS M2 M1 \\<Omega> V m i) \\<Omega> M2\"\n  show \"M1 \\<preceq> M2\"\n  proof (rule ccontr)\n  \n    let ?TS = \"\\<lambda> n . TS M2 M1 \\<Omega> V m n\"\n    let ?C = \"\\<lambda> n . C M2 M1 \\<Omega> V m n\"\n    let ?RM = \"\\<lambda> n . RM M2 M1 \\<Omega> V m n\"\n  \n  \n    assume \"\\<not> M1 \\<preceq> M2\"\n    obtain vs xs where \"minimal_sequence_to_failure_extending V M1 M2 vs xs\" \n      using  assms(1) assms(2) assms(4) \n             minimal_sequence_to_failure_extending_det_state_cover_ob[OF _ _ _  \\<open>\\<not> M1 \\<preceq> M2\\<close>, of V]\n      by blast \n  \n    then have \"vs \\<in> L\\<^sub>i\\<^sub>n M1 V\" \n              \"sequence_to_failure M1 M2 (vs @ xs)\" \n              \"\\<not> (\\<exists> io' . \\<exists> w' \\<in> L\\<^sub>i\\<^sub>n M1 V . sequence_to_failure M1 M2 (w' @ io') \n                                                          \\<and> length io' < length xs)\"\n      by auto\n  \n    then have \"vs@xs \\<in> L M1 - L M2\" \n      by auto\n  \n    have \"vs@xs \\<in> L\\<^sub>i\\<^sub>n M1 {map fst (vs@xs)}\"\n      by (metis (full_types) Diff_iff \\<open>vs @ xs \\<in> L M1 - L M2\\<close> insertI1 \n          language_state_for_inputs_map_fst)\n  \n    have \"vs@xs \\<notin> L\\<^sub>i\\<^sub>n M2 {map fst (vs@xs)}\"\n      by (meson Diff_iff \\<open>vs @ xs \\<in> L M1 - L M2\\<close> language_state_for_inputs_in_language_state \n          subsetCE) \n  \n    have \"finite V\" \n      using det_state_cover_finite assms(4,2) by auto\n    then have \"finite (?TS i)\"\n      using TS_finite[of V M2] assms(2) by auto\n    then have \"io_reduction_on M1 (?TS i) M2\" \n      using io_reduction_from_atc_io_reduction\n            [OF \\<open>atc_io_reduction_on_sets M1 (TS M2 M1 \\<Omega> V m i) \\<Omega> M2\\<close>] \n      by auto\n  \n    have \"map fst (vs@xs) \\<notin> ?TS i\"\n    proof -\n      have f1: \"\\<forall>ps P Pa. (ps::('a \\<times> 'b) list) \\<notin> P - Pa \\<or> ps \\<in> P \\<and> ps \\<notin> Pa\"\n        by blast\n      have \"\\<forall>P Pa ps. \\<not> P \\<subseteq> Pa \\<or> (ps::('a \\<times> 'b) list) \\<in> Pa \\<or> ps \\<notin> P\"\n        by blast\n      then show ?thesis\n        using f1 by (metis (no_types) \\<open>vs @ xs \\<in> L M1 - L M2\\<close> \\<open>io_reduction_on M1 (?TS i) M2\\<close> \n                     language_state_for_inputs_in_language_state language_state_for_inputs_map_fst)\n    qed \n  \n    have \"map fst vs \\<in> V\"\n      using \\<open>vs \\<in> L\\<^sub>i\\<^sub>n M1 V\\<close> by auto \n    \n    let ?stf = \"map fst (vs@xs)\"\n    let ?stfV = \"map fst vs\"\n    let ?stfX = \"map fst xs\"\n    have \"?stf = ?stfV @ ?stfX\"\n      by simp \n  \n    then have \"?stfV @ ?stfX \\<notin> ?TS i\"\n      using \\<open>?stf \\<notin> ?TS i\\<close> by auto \n  \n    have \"mcp (?stfV @ ?stfX) V ?stfV\"\n      by (metis \\<open>map fst (vs @ xs) = map fst vs @ map fst xs\\<close> \n          \\<open>minimal_sequence_to_failure_extending V M1 M2 vs xs\\<close> assms(1) assms(2) assms(4) \n          minimal_sequence_to_failure_extending_mcp)\n  \n    have \"set ?stf \\<subseteq> inputs M1\"\n      by (meson DiffD1 \\<open>vs @ xs \\<in> L M1 - L M2\\<close> assms(1) language_state_inputs) \n    then have \"set ?stf \\<subseteq> inputs M2\"\n      using assms(3) by blast \n    moreover have \"set ?stf = set ?stfV \\<union> set ?stfX\"\n      by simp \n    ultimately have \"set ?stfX \\<subseteq> inputs M2\"\n      by blast \n  \n  \n    obtain xr j where \"xr \\<noteq> ?stfX\" \n                      \"prefix xr ?stfX\" \n                      \"Suc j \\<le> i\" \n                      \"?stfV@xr \\<in> RM M2 M1 \\<Omega> V m (Suc j)\"\n      using TS_non_containment_causes_final_suc[OF \\<open>?stfV @ ?stfX \\<notin> ?TS i\\<close> \n            \\<open>mcp (?stfV @ ?stfX) V ?stfV\\<close> \\<open>set ?stfX \\<subseteq> inputs M2\\<close> assms(5,2)] \n      by blast\n  \n    \n    let ?yr = \"take (length xr) (map snd xs)\"\n    have \"length ?yr = length xr\"\n      using \\<open>prefix xr (map fst xs)\\<close> prefix_length_le by fastforce \n    have \"(xr || ?yr) = take (length xr) xs\"\n      by (metis (no_types, hide_lams) \\<open>prefix xr (map fst xs)\\<close> append_eq_conv_conj prefixE take_zip\n          zip_map_fst_snd) \n  \n    have \"prefix (vs@(xr || ?yr)) (vs@xs)\"\n      by (simp add: \\<open>xr || take (length xr) (map snd xs) = take (length xr) xs\\<close> take_is_prefix)\n  \n    have \"xr = take (length xr) (map fst xs)\"\n      by (metis \\<open>length (take (length xr) (map snd xs)) = length xr\\<close> \n          \\<open>xr || take (length xr) (map snd xs) = take (length xr) xs\\<close> map_fst_zip take_map) \n  \n    have \"vs@(xr || ?yr) \\<in> L M1\"\n      by (metis DiffD1 \\<open>prefix (vs @ (xr || take (length xr) (map snd xs))) (vs @ xs)\\<close> \n          \\<open>vs @ xs \\<in> L M1 - L M2\\<close> language_state_prefix prefixE) \n  \n    then have \"vs@(xr || ?yr) \\<in> L\\<^sub>i\\<^sub>n M1 {?stfV @ xr}\"\n      by (metis \\<open>length (take (length xr) (map snd xs)) = length xr\\<close> insertI1 \n          language_state_for_inputs_map_fst map_append map_fst_zip) \n  \n    have \"length xr < length xs\"\n      by (metis \\<open>xr = take (length xr) (map fst xs)\\<close> \\<open>xr \\<noteq> map fst xs\\<close> not_le_imp_less take_all \n          take_map)\n  \n  \n  \n    from \\<open>?stfV@xr \\<in> RM M2 M1 \\<Omega> V m (Suc j)\\<close> have \"?stfV@xr \\<in> {xs' \\<in> C M2 M1 \\<Omega> V m (Suc j) .\n        (\\<not> atc_io_reduction_on M1 M2 xs' \\<Omega>)\n        \\<or> (\\<forall> io \\<in> L\\<^sub>i\\<^sub>n M1 {xs'} .\n            (\\<exists> V'' \\<in> N io M1 V .  \n              (\\<exists> S1 . \n                (\\<exists> vs xs .\n                  io = (vs@xs)\n                  \\<and> mcp (vs@xs) V'' vs\n                  \\<and> S1 \\<subseteq> nodes M2\n                  \\<and> (\\<forall> s1 \\<in> S1 . \\<forall> s2 \\<in> S1 .\n                    s1 \\<noteq> s2 \\<longrightarrow> \n                      (\\<forall> io1 \\<in> RP M2 s1 vs xs V'' .\n                         \\<forall> io2 \\<in> RP M2 s2 vs xs V'' .\n                           B M1 io1 \\<Omega> \\<noteq> B M1 io2 \\<Omega> ))\n                  \\<and> m < LB M2 M1 vs xs (TS M2 M1 \\<Omega> V m j \\<union> V) S1 \\<Omega> V'' ))))}\" \n      unfolding RM.simps by blast\n  \n    moreover have \"\\<forall> xs' \\<in> ?C (Suc j) . (atc_io_reduction_on M1 M2 xs' \\<Omega>)\"\n    proof -\n      have \"\\<forall>as. atc_io_reduction_on M1 M2 as \\<Omega> \\<or> as \\<notin> C M2 M1 \\<Omega> V m (Suc j)\"\n        by (meson C_subset TS_subset \\<open>M1 \\<preceq>\\<lbrakk>(TS M2 M1 \\<Omega> V m i).\\<Omega>\\<rbrakk> M2\\<close> \\<open>Suc j \\<le> i\\<close> atc_io_reduction_on_sets.simps subsetCE)\n      then show ?thesis\n        by blast\n    qed\n  \n    ultimately have \"(\\<forall> io \\<in> L\\<^sub>i\\<^sub>n M1 {?stfV@xr} .\n            (\\<exists> V'' \\<in> N io M1 V .  \n              (\\<exists> S1 . \n                (\\<exists> vs xs .\n                  io = (vs@xs)\n                  \\<and> mcp (vs@xs) V'' vs\n                  \\<and> S1 \\<subseteq> nodes M2\n                  \\<and> (\\<forall> s1 \\<in> S1 . \\<forall> s2 \\<in> S1 .\n                    s1 \\<noteq> s2 \\<longrightarrow> \n                      (\\<forall> io1 \\<in> RP M2 s1 vs xs V'' .\n                         \\<forall> io2 \\<in> RP M2 s2 vs xs V'' .\n                           B M1 io1 \\<Omega> \\<noteq> B M1 io2 \\<Omega> ))\n                  \\<and> m < LB M2 M1 vs xs (TS M2 M1 \\<Omega> V m j \\<union> V) S1 \\<Omega> V'' ))))\"\n      by blast \n  \n    then have \"\n            (\\<exists> V'' \\<in> N (vs@(xr || ?yr)) M1 V .  \n              (\\<exists> S1 . \n                (\\<exists> vs' xs' .\n                  vs@(xr || ?yr) = (vs'@xs')\n                  \\<and> mcp (vs'@xs') V'' vs'\n                  \\<and> S1 \\<subseteq> nodes M2\n                  \\<and> (\\<forall> s1 \\<in> S1 . \\<forall> s2 \\<in> S1 .\n                    s1 \\<noteq> s2 \\<longrightarrow> \n                      (\\<forall> io1 \\<in> RP M2 s1 vs' xs' V'' .\n                         \\<forall> io2 \\<in> RP M2 s2 vs' xs' V'' .\n                           B M1 io1 \\<Omega> \\<noteq> B M1 io2 \\<Omega> ))\n                  \\<and> m < LB M2 M1 vs' xs' (TS M2 M1 \\<Omega> V m j \\<union> V) S1 \\<Omega> V'' )))\"\n      using \\<open>vs@(xr || ?yr) \\<in> L\\<^sub>i\\<^sub>n M1 {?stfV @ xr}\\<close>\n      by blast \n  \n    then obtain V'' S1 vs' xs' where RM_impl :  \n                                     \"V'' \\<in> N (vs@(xr || ?yr)) M1 V\"\n                                     \"vs@(xr || ?yr) = (vs'@xs')\"\n                                     \"mcp (vs'@xs') V'' vs'\"\n                                     \"S1 \\<subseteq> nodes M2\"\n                                     \"(\\<forall> s1 \\<in> S1 . \\<forall> s2 \\<in> S1 .\n                                       s1 \\<noteq> s2 \\<longrightarrow> \n                                          (\\<forall> io1 \\<in> RP M2 s1 vs' xs' V'' .\n                                             \\<forall> io2 \\<in> RP M2 s2 vs' xs' V'' .\n                                               B M1 io1 \\<Omega> \\<noteq> B M1 io2 \\<Omega> ))\"\n                                     \" m < LB M2 M1 vs' xs' (TS M2 M1 \\<Omega> V m j \\<union> V) S1 \\<Omega> V''\"\n      by blast\n  \n   \n    have \"?stfV = mcp' (map fst (vs @ (xr || take (length xr) (map snd xs)))) V\"\n      by (metis (full_types) \\<open>length (take (length xr) (map snd xs)) = length xr\\<close> \n          \\<open>mcp (map fst vs @ map fst xs) V (map fst vs)\\<close> \\<open>prefix xr (map fst xs)\\<close> map_append \n          map_fst_zip mcp'_intro mcp_prefix_of_suffix) \n  \n    have \"is_det_state_cover M2 V\"\n      using assms(4) by blast \n    moreover have \"well_formed M2\" \n      using assms(2) by auto\n    moreover have \"finite V\" \n      using det_state_cover_finite assms(4,2) by auto\n    ultimately have \"vs \\<in> V''\"  \n                    \"vs = mcp' (vs @ (xr || take (length xr) (map snd xs))) V''\"\n      using N_mcp_prefix[OF \\<open>?stfV = mcp' (map fst (vs @ (xr || take (length xr) (map snd xs)))) V\\<close> \n            \\<open>V'' \\<in> N (vs@(xr || ?yr)) M1 V\\<close>, of M2] \n      by simp+\n    \n    have \"vs' = vs\"\n      by (metis (no_types) \\<open>mcp (vs' @ xs') V'' vs'\\<close> \n          \\<open>vs = mcp' (vs @ (xr || take (length xr) (map snd xs))) V''\\<close> \n          \\<open>vs @ (xr || take (length xr) (map snd xs)) = vs' @ xs'\\<close> mcp'_intro)\n     \n    then have \"xs' = (xr || ?yr)\"\n      using \\<open>vs @ (xr || take (length xr) (map snd xs)) = vs' @ xs'\\<close> by blast  \n  \n  \n    have \"V \\<subseteq> ?TS i\"\n    proof -\n      have \"1 \\<le> i\"\n        using \\<open>Suc j \\<le> i\\<close> by linarith\n      then have \"?TS 1 \\<subseteq> ?TS i\"\n        using TS_subset by blast   \n      then show ?thesis \n        by auto\n    qed\n      \n    have \"?stfV@xr \\<in> ?C (Suc j)\" \n      using \\<open>?stfV@xr \\<in> RM M2 M1 \\<Omega> V m (Suc j)\\<close> unfolding RM.simps by blast\n  \n  \n  \n    \\<comment> \\<open>show that the prerequisites (@{verbatim Prereq}) for @{verbatim LB} are met by construction\\<close>\n  \n    have \"(\\<forall>vs'a\\<in>V''. prefix vs'a (vs' @ xs') \\<longrightarrow> length vs'a \\<le> length vs')\"\n      using \\<open>mcp (vs' @ xs') V'' vs'\\<close> by auto\n  \n    moreover have \"atc_io_reduction_on_sets M1 (?TS j \\<union> V) \\<Omega> M2\"   \n    proof -\n      have \"j < i\" \n        using \\<open>Suc j \\<le> i\\<close> by auto\n      then have \"?TS j \\<subseteq> ?TS i\" \n        by (simp add: TS_subset) \n      then show ?thesis \n        using atc_io_reduction_on_subset\n              [OF \\<open>atc_io_reduction_on_sets M1 (TS M2 M1 \\<Omega> V m i) \\<Omega> M2\\<close>, of \"?TS j\"]\n        by (meson Un_subset_iff \\<open>V \\<subseteq> ?TS i\\<close> \\<open>atc_io_reduction_on_sets M1 (TS M2 M1 \\<Omega> V m i) \\<Omega> M2\\<close>\n            atc_io_reduction_on_subset) \n    qed\n  \n    moreover have \"finite (?TS j \\<union> V)\"\n    proof -\n      have \"finite (?TS j)\"\n        using TS_finite[OF \\<open>finite V\\<close>, of M2 M1 \\<Omega> m j] assms(2) by auto \n      then show ?thesis \n        using \\<open>finite V\\<close> by blast\n    qed\n  \n    moreover have \"V \\<subseteq> ?TS j \\<union> V\" \n      by blast\n  \n    moreover have \"(\\<forall> p . (prefix p xs' \\<and> p \\<noteq> xs') \\<longrightarrow> map fst (vs' @ p) \\<in> ?TS j \\<union> V)\"\n    proof \n      fix p \n      show \"prefix p xs' \\<and> p \\<noteq> xs' \\<longrightarrow> map fst (vs' @ p) \\<in> TS M2 M1 \\<Omega> V m j \\<union> V\"\n      proof\n        assume \"prefix p xs' \\<and> p \\<noteq> xs'\"\n  \n        have \"prefix (map fst (vs' @ p)) (map fst (vs' @ xs'))\"\n          by (simp add: \\<open>prefix p xs' \\<and> p \\<noteq> xs'\\<close> map_mono_prefix)\n        have \"prefix (map fst (vs' @ p)) (?stfV @ xr)\"\n          using \\<open>length (take (length xr) (map snd xs)) = length xr\\<close> \n                \\<open>prefix (map fst (vs' @ p)) (map fst (vs' @ xs'))\\<close> \n                \\<open>vs' = vs\\<close> \\<open>xs' = xr || take (length xr) (map snd xs)\\<close> \n          by auto\n        then have \"prefix (map fst vs' @ map fst p) (?stfV @ xr)\"\n          by simp \n        then have \"prefix (map fst p) xr\"\n          by (simp add: \\<open>vs' = vs\\<close>)\n  \n        have \"?stfV @ xr \\<in> ?TS (Suc j)\" \n        proof (cases j)\n          case 0\n          then show ?thesis\n            using \\<open>map fst vs @ xr \\<in> C M2 M1 \\<Omega> V m (Suc j)\\<close> by auto  \n        next\n          case (Suc nat)\n          then show ?thesis\n            using TS.simps(3) \\<open>map fst vs @ xr \\<in> C M2 M1 \\<Omega> V m (Suc j)\\<close> by blast \n        qed\n  \n        have \"mcp (map fst vs @ xr) V (map fst vs)\"\n          using \\<open>mcp (map fst vs @ map fst xs) V (map fst vs)\\<close> \\<open>prefix xr (map fst xs)\\<close> \n                mcp_prefix_of_suffix \n          by blast \n  \n        have \"map fst vs @ map fst p \\<in> TS M2 M1 \\<Omega> V m (Suc j)\"\n          using TS_prefix_containment[OF \\<open>?stfV @ xr \\<in> ?TS (Suc j)\\<close> \n                                         \\<open>mcp (map fst vs @ xr) V (map fst vs)\\<close> \n                                         \\<open>prefix (map fst p) xr\\<close>] \n          by assumption\n   \n  \n        have \"Suc (length xr) = (Suc j)\" \n          using C_index[OF \\<open>?stfV@xr \\<in> ?C (Suc j)\\<close> \\<open>mcp (map fst vs @ xr) V (map fst vs)\\<close>] \n          by assumption\n        \n        have\"Suc (length p) < (Suc j)\"\n        proof -\n          have \"map fst xs' = xr\"\n            by (metis \\<open>xr = take (length xr) (map fst xs)\\<close> \n                \\<open>xr || take (length xr) (map snd xs) = take (length xr) xs\\<close> \n                \\<open>xs' = xr || take (length xr) (map snd xs)\\<close> take_map)\n          then show ?thesis\n            by (metis (no_types) Suc_less_eq \\<open>Suc (length xr) = Suc j\\<close> \\<open>prefix p xs' \\<and> p \\<noteq> xs'\\<close> \n                append_eq_conv_conj length_map nat_less_le prefixE prefix_length_le take_all)\n        qed\n  \n        have \"mcp (map fst vs @ map fst p) V (map fst vs)\"\n          using \\<open>mcp (map fst vs @ xr) V (map fst vs)\\<close> \\<open>prefix (map fst p) xr\\<close> mcp_prefix_of_suffix \n          by blast \n  \n        then have \"map fst vs @ map fst p \\<in> ?C (Suc (length (map fst p)))\" \n          using TS_index(2)[OF \\<open>map fst vs @ map fst p \\<in> TS M2 M1 \\<Omega> V m (Suc j)\\<close>] by auto\n  \n        have \"map fst vs @ map fst p \\<in> ?TS j\"\n          using TS_union[of M2 M1 \\<Omega> V m j]\n        proof -\n          have \"Suc (length p) \\<in> {0..<Suc j}\"\n            using \\<open>Suc (length p) < Suc j\\<close> by force\n          then show ?thesis\n            by (metis UN_I \\<open>TS M2 M1 \\<Omega> V m j = (\\<Union>j\\<in>set [0..<Suc j]. C M2 M1 \\<Omega> V m j)\\<close> \n                \\<open>map fst vs @ map fst p \\<in> C M2 M1 \\<Omega> V m (Suc (length (map fst p)))\\<close> \n                length_map set_upt)\n        qed \n  \n        then show \"map fst (vs' @ p) \\<in> TS M2 M1 \\<Omega> V m j \\<union> V\"\n          by (simp add: \\<open>vs' = vs\\<close>) \n      qed\n    qed\n\n    moreover have \"vs' @ xs' \\<in> L M2 \\<inter> L M1\"\n    proof -\n      have \"\\<forall>xs'\\<in>C M2 M1 \\<Omega> V m (Suc j). L\\<^sub>i\\<^sub>n M1 {xs'} \\<subseteq> L\\<^sub>i\\<^sub>n M2 {xs'}\" \n        using \\<open>\\<forall>xs'\\<in>C M2 M1 \\<Omega> V m (Suc j). atc_io_reduction_on M1 M2 xs' \\<Omega>\\<close>\n        unfolding atc_io_reduction_on.simps\n        by auto\n      show ?thesis \n        by (metis (no_types, lifting) IntI RM_impl(2) \n            \\<open>\\<forall>xs'\\<in>C M2 M1 \\<Omega> V m (Suc j). L\\<^sub>i\\<^sub>n M1 {xs'} \\<subseteq> L\\<^sub>i\\<^sub>n M2 {xs'}\\<close> \n            \\<open>map fst vs @ xr \\<in> C M2 M1 \\<Omega> V m (Suc j)\\<close> \n            \\<open>vs @ (xr || take (length xr) (map snd xs)) \\<in> L\\<^sub>i\\<^sub>n M1 {map fst vs @ xr}\\<close> \n            language_state_for_inputs_in_language_state subsetCE)\n    qed     \n          \n    \n    ultimately have \"Prereq M2 M1 vs' xs' (?TS j \\<union> V) S1 \\<Omega> V''\"\n      using RM_impl(4,5) unfolding Prereq.simps by blast\n  \n    have \"V'' \\<in> Perm V M1\"\n      using \\<open>V'' \\<in> N (vs@(xr || ?yr)) M1 V\\<close> unfolding N.simps by blast\n  \n    have \\<open>prefix (xr || ?yr) xs\\<close>\n      by (simp add: \\<open>xr || take (length xr) (map snd xs) = take (length xr) xs\\<close> take_is_prefix)\n  \n  \n    \\<comment> \\<open> show that furthermore neither @{verbatim Rep_Pre} nor @{verbatim Rep_Cov} holds \\<close>\n\n    have \"\\<not> Rep_Pre M2 M1 vs (xr || ?yr)\"\n      using minimal_sequence_to_failure_extending_implies_Rep_Pre\n            [OF \\<open>minimal_sequence_to_failure_extending V M1 M2 vs xs\\<close> assms(1,2) \n                \\<open>test_tools M2 M1 FAIL PM V \\<Omega>\\<close> RM_impl(1) \n                \\<open>prefix (xr || take (length xr) (map snd xs)) xs\\<close>]\n      by assumption\n    then have \"\\<not> Rep_Pre M2 M1 vs' xs'\"\n      using \\<open>vs' = vs\\<close> \\<open>xs' = xr || ?yr\\<close> by blast \n  \n    have \"\\<not> Rep_Cov M2 M1 V'' vs (xr || ?yr)\" \n      using minimal_sequence_to_failure_extending_implies_Rep_Cov\n            [OF \\<open>minimal_sequence_to_failure_extending V M1 M2 vs xs\\<close> assms(1,2) \n                \\<open>test_tools M2 M1 FAIL PM V \\<Omega>\\<close> RM_impl(1) \n                \\<open>prefix (xr || take (length xr) (map snd xs)) xs\\<close>]\n      by assumption\n    then have \"\\<not> Rep_Cov M2 M1 V'' vs' xs'\"\n      using \\<open>vs' = vs\\<close> \\<open>xs' = xr || ?yr\\<close> by blast \n  \n    have \"vs'@xs' \\<in> L M1\"\n      using \\<open>vs @ (xr || take (length xr) (map snd xs)) \\<in> L M1\\<close> \n            \\<open>vs' = vs\\<close> \\<open>xs' = xr || take (length xr) (map snd xs)\\<close> \n      by blast \n    \n  \n    \\<comment> \\<open> therefore it is impossible to remove the prefix of the minimal sequence to a failure,\n         as this would require @{verbatim M1} to have more than m states \\<close>\n    \n    have \"LB M2 M1 vs' xs' (?TS j \\<union> V) S1 \\<Omega> V'' \\<le> card (nodes M1)\"\n      using LB_count[OF \\<open>vs'@xs' \\<in> L M1\\<close> assms(1,2,3) \\<open>test_tools M2 M1 FAIL PM V \\<Omega>\\<close> \n                        \\<open>V'' \\<in> Perm V M1\\<close> \\<open>Prereq M2 M1 vs' xs' (?TS j \\<union> V) S1 \\<Omega> V''\\<close> \n                        \\<open>\\<not> Rep_Pre M2 M1 vs' xs'\\<close> \\<open> \\<not> Rep_Cov M2 M1 V'' vs' xs'\\<close>]\n      by assumption\n    then have \"LB M2 M1 vs' xs' (?TS j \\<union> V) S1 \\<Omega> V'' \\<le> m\" \n      using assms(3) by linarith\n  \n    then show \"False\" \n      using \\<open>m < LB M2 M1 vs' xs' (?TS j \\<union> V) S1 \\<Omega> V''\\<close> by linarith\n  qed\nqed\n\n\n\n\nsubsection {* Main result *}\n\ntext \\<open>\nThe following lemmata add to the previous result to show that some FSM @{verbatim M1} is a reduction \nof FSM @{verbatim M2} if and only if it is a reduction on the test suite generated by the adaptive \nstate counting algorithm for these FSMs.\n\\<close>\n\nlemma asc_soundness :\n  assumes     \"OFSM M1\"\n  and         \"OFSM M2\"\nshows \"M1 \\<preceq> M2 \\<longrightarrow> atc_io_reduction_on_sets M1 T \\<Omega> M2\"\n  using atc_io_reduction_on_sets_reduction assms by blast\n\n\n\nlemma asc_main_theorem :\n  assumes \"OFSM M1\"\n  and     \"OFSM M2\"\n  and     \"asc_fault_domain M2 M1 m\"\n  and     \"test_tools M2 M1 FAIL PM V \\<Omega>\"\n  and     \"final_iteration M2 M1 \\<Omega> V m i\"\nshows     \"M1 \\<preceq> M2 \\<longleftrightarrow> atc_io_reduction_on_sets M1 (TS M2 M1 \\<Omega> V m i) \\<Omega> M2\"\nby (metis asc_sufficiency assms(1-5) atc_io_reduction_on_sets_reduction)\n\n\n\n\n\n\n\n\n\n\n\n\nend", "meta": {"author": "RobertSachtleben", "repo": "Refined-Adaptive-State-Counting", "sha": "3691de6f16cec5ec74282465495c12e6a40133aa", "save_path": "github-repos/isabelle/RobertSachtleben-Refined-Adaptive-State-Counting", "path": "github-repos/isabelle/RobertSachtleben-Refined-Adaptive-State-Counting/Refined-Adaptive-State-Counting-3691de6f16cec5ec74282465495c12e6a40133aa/Adaptive_State_Counting/ASC/ASC_Sufficiency.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.4921881357207956, "lm_q1q2_score": 0.3027389449109549}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\ntheory SubMonadLib\nimports\n  EmptyFailLib\n  Corres_UL\nbegin\n\nlocale submonad_args =\n  fixes fetch :: \"'a \\<Rightarrow> 'b\"\n  fixes replace :: \"'b \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  fixes guard :: \"'a \\<Rightarrow> bool\"\n\n  assumes args:\n   \"\\<forall>x s. guard s \\<longrightarrow> fetch (replace x s) = x\"\n   \"\\<forall>x y s. replace x (replace y s) = replace x s\"\n   \"\\<forall>s. replace (fetch s) s = s\"\n\n  assumes replace_preserves_guard:\n   \"\\<And>s x. guard (replace x s) = guard s\"\n\ndefinition\n  submonad_fn :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('b \\<Rightarrow> 'a \\<Rightarrow> 'a) \\<Rightarrow> ('a \\<Rightarrow> bool) \\<Rightarrow>\n                  ('b, 'c) nondet_monad \\<Rightarrow> ('a, 'c) nondet_monad\"\nwhere\n \"submonad_fn fetch replace guard m \\<equiv> do\n    stateAssert guard [];\n    substate \\<leftarrow> gets fetch;\n    (rv, substate') \\<leftarrow> select_f (m substate);\n    modify (replace substate');\n    return rv\n  od\"\n\nlocale submonad = submonad_args +\n  fixes fn :: \"('b, 'c) nondet_monad \\<Rightarrow> ('a, 'c) nondet_monad\"\n\n  assumes fn_is_sm: \"fn = submonad_fn fetch replace guard\"\n\nlemma (in submonad_args) argsD1:\n  \"\\<And>x s. guard s \\<Longrightarrow> fetch (replace x s) = x\"\n  by (simp add: args)\n\nlemma (in submonad) guarded_sm:\n  \"\\<And>s. guard s \\<Longrightarrow>\n   fn m s = (do\n     substate \\<leftarrow> gets fetch;\n     (rv, substate') \\<leftarrow> select_f (m substate);\n     modify (replace substate');\n     return rv\n   od) s\"\n  unfolding fn_is_sm submonad_fn_def\n  by (simp add: stateAssert_def get_def assert_def bind_def return_def)\n\nlemma modify_modify:\n  \"modify fn1 >>= (\\<lambda>x. modify fn2) = modify (fn2 \\<circ> fn1)\"\n  by (simp add: bind_def modify_def get_def put_def)\n\nlemma select_f_walk:\n  assumes m1: \"empty_fail m1\"\n  assumes S: \"fst S = {} \\<Longrightarrow> snd S\"\n  shows \"(do a \\<leftarrow> m1; b \\<leftarrow> select_f S; m2 a b od) = (do b \\<leftarrow> select_f S; a \\<leftarrow> m1; m2 a b od)\"\n  apply (rule ext)\n  apply (rule prod.expand)\n  apply (rule conjI)\n   apply (simp add: select_f_def bind_def split_def)\n   apply fastforce\n  apply (simp add: select_f_def bind_def split_def)\n  apply (case_tac \"fst S = {}\")\n   apply clarsimp\n   apply (case_tac \"fst (m1 x) = {}\")\n    apply (simp add: empty_failD [OF m1] S)\n   apply (frule S)\n   apply force\n  apply safe\n     apply clarsimp\n     apply force\n    apply force\n   apply clarsimp\n   apply force\n  apply clarsimp\n  apply (case_tac \"fst (m1 x) = {}\", simp add: empty_failD [OF m1])\n  apply force\n  done\n\nlemma stateAssert_stateAssert:\n  \"(stateAssert g [] >>= (\\<lambda>u. stateAssert g' [])) = stateAssert (g and g') []\"\n  by (simp add: ext stateAssert_def bind_def get_def assert_def fail_def return_def)\n\nlemma modify_stateAssert:\n  \"\\<lbrakk> \\<And>s x. g (r x s) = g s \\<rbrakk> \\<Longrightarrow>\n   (modify (r x) >>= (\\<lambda>u. stateAssert g []))\n            = (stateAssert g [] >>= (\\<lambda>u. modify (r x)))\"\n  by (simp add: ext stateAssert_def bind_def get_def assert_def fail_def\n                return_def modify_def put_def)\n\nlemma gets_stateAssert:\n  \"(gets f >>= (\\<lambda>x. stateAssert g' [] >>= (\\<lambda>u. m x)))\n            = (stateAssert g' [] >>= (\\<lambda>u. gets f >>= (\\<lambda>x. m x)))\"\n  by (simp add: ext stateAssert_def bind_def gets_def get_def\n                assert_def fail_def return_def)\n\nlemma select_f_stateAssert:\n  \"empty_fail m \\<Longrightarrow>\n   (select_f (m a) >>= (\\<lambda>x. stateAssert g [] >>= (\\<lambda>u. n x))) =\n   (stateAssert g [] >>= (\\<lambda>u. select_f (m a) >>= (\\<lambda>x. n x)))\"\n  apply (rule ext)\n  apply (clarsimp simp: stateAssert_def bind_def select_f_def get_def\n                        assert_def return_def fail_def split_def image_image)\n  apply (simp only: image_def)\n  apply (clarsimp simp: stateAssert_def bind_def select_f_def get_def\n                        assert_def return_def fail_def split_def image_image)\n  apply (simp only: image_def mem_simps empty_fail_def simp_thms)\n  apply fastforce\n  done\n\nlemma bind_select_f_bind':\n  shows \"(select_f (m s) >>= (\\<lambda>x. select_f (split n x))) = (select_f ((m >>= n) s))\"\n  apply (rule ext)\n  apply (force simp: select_f_def bind_def split_def)\n  done\n\nlemma bind_select_f_bind:\n  \"(select_f (m1 s) >>= (\\<lambda>x. select_f (m2 (fst x) (snd x)))) = (select_f ((m1 >>= m2) s))\"\n  by (insert bind_select_f_bind' [where m=m1 and n=m2 and s=s],\n      simp add: split_def)\n\nlemma select_from_gets: \"select_f (gets f s) = return (f s, s)\"\n  apply (rule ext)\n  apply (simp add: select_f_def return_def simpler_gets_def)\n  done\n\nlemma select_from_gets':\n  \"(select_f \\<circ> gets f) = (\\<lambda>s. return (f s, s))\"\n  apply (rule ext)\n  apply (simp add: o_def select_from_gets)\n  done\n\nlemma bind_subst_lift:\n  \"(f >>= g) = h \\<Longrightarrow> (do x \\<leftarrow> f; y \\<leftarrow> g x; j y od) = (h >>= j)\"\n  by (simp add: bind_assoc[symmetric])\n\nlemma modify_gets:\n  \"\\<lbrakk> \\<And>x s. g (r x s) = g s; \\<And>x s. g s \\<longrightarrow> f (r x s) = x \\<rbrakk>\n   \\<Longrightarrow> (modify (r x) >>= (\\<lambda>u. stateAssert g [] >>= (\\<lambda>u'. gets f)))\n            = (stateAssert g [] >>= (\\<lambda>u'. modify (r x) >>= (\\<lambda>u. return x)))\"\n  by (simp add: ext stateAssert_def assert_def modify_def bind_def get_def\n                put_def gets_def return_def fail_def)\n\nlemma (in submonad_args) gets_modify:\n  \"\\<And>s. guard s \\<Longrightarrow>\n   (do x \\<leftarrow> gets fetch; u \\<leftarrow> modify (replace x); f x od) s = ((gets fetch) >>= f) s\"\n  by (clarsimp simp: modify_def gets_def return_def bind_def\n                     put_def args get_def\n              split: option.split)\n\nlemma submonad_bind:\n  \"\\<lbrakk> submonad f r g m; submonad f r g m'; submonad f r g m'';\n     empty_fail a; \\<And>x. empty_fail (b x) \\<rbrakk> \\<Longrightarrow>\n   m (a >>= b) = (m' a) >>= (\\<lambda>rv. m'' (b rv))\"\n  apply (subst submonad.fn_is_sm, assumption)+\n  apply (clarsimp simp: submonad_def bind_assoc split_def submonad_fn_def)\n  apply (subst bind_subst_lift [OF modify_gets, unfolded bind_assoc])\n    apply (simp add: submonad_args.args submonad_args.replace_preserves_guard)+\n  apply (subst select_f_stateAssert, assumption)\n  apply (subst gets_stateAssert)\n  apply (subst bind_subst_lift [OF stateAssert_stateAssert])\n  apply (clarsimp simp: pred_conj_def)\n  apply (clarsimp simp: bind_assoc split_def select_f_walk\n                empty_fail_stateAssert empty_failD\n                bind_subst_lift[OF modify_modify] submonad_args.args o_def\n                bind_subst_lift[OF bind_select_f_bind])\n  done\n\nlemma (in submonad) guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> (rv, s') \\<in> fst (fn m s) \\<rbrakk> \\<Longrightarrow> guard s'\"\n  unfolding fn_is_sm submonad_fn_def\n  by (clarsimp simp: stateAssert_def gets_def get_def bind_def modify_def put_def\n                     return_def select_f_def replace_preserves_guard in_monad)\n\nlemma fst_stateAssertD:\n  \"\\<And>s s' v. (v, s') \\<in> fst (stateAssert g [] s) \\<Longrightarrow> s' = s \\<and> g s\"\n  by (clarsimp simp: stateAssert_def in_monad)\n\nlemma(in submonad) guarded_gets:\n  \"\\<And>s. guard s \\<Longrightarrow> fn (gets f) s = gets (f \\<circ> fetch) s\"\n  apply (simp add: guarded_sm select_from_gets gets_modify)\n  apply (simp add: gets_def)\n  done\n\nlemma (in submonad) guarded_return:\n  \"\\<And>s. guard s \\<Longrightarrow> fn (return x) s = return x s\"\n  using args guarded_gets\n  by (fastforce simp: gets_def bind_def get_def)\n\nlemma (in submonad_args) submonad_fn_gets:\n  \"submonad_fn fetch replace guard (gets f) =\n   (stateAssert guard [] >>= (\\<lambda>u. gets (f \\<circ> fetch)))\"\n  apply (simp add: ext select_from_gets submonad_fn_def)\n  apply (rule bind_cong [OF refl])\n  apply (clarsimp simp: gets_modify dest!: fst_stateAssertD)\n  apply (simp add: gets_def)\n  done\n\nlemma(in submonad) gets:\n  \"fn (gets f) = (stateAssert guard [] >>= (\\<lambda>u. gets (f \\<circ> fetch)))\"\n  unfolding fn_is_sm submonad_fn_gets\n  by (rule refl)\n\nlemma (in submonad) return:\n  \"fn (return x) = (stateAssert guard [] >>= (\\<lambda>u. return x))\"\n  using args gets\n  by (fastforce simp: gets_def bind_def get_def)\n\nlemma (in submonad) mapM_guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> guard s; \\<exists>rv. (rv, s') \\<in> fst (mapM (fn \\<circ> m) xs s)\\<rbrakk> \\<Longrightarrow> guard s'\"\nproof (induct xs)\n  case Nil\n  thus ?case\n    by (simp add: mapM_def sequence_def return_def)\n  next\n  case (Cons x xs)\n  thus ?case\n    apply (clarsimp simp: o_def mapM_Cons return_def bind_def)\n    apply (drule guard_preserved)\n    apply fastforce\n    done\nqed\n\nlemma (in submonad) mapM_x_guard_preserved:\n  \"\\<And>s s'. \\<lbrakk> guard s; \\<exists>rv. (rv, s') \\<in> fst (mapM_x (fn \\<circ> m) xs s)\\<rbrakk> \\<Longrightarrow> guard s'\"\nproof (induct xs)\n  case Nil\n  thus ?case\n    by (simp add: mapM_x_def sequence_x_def return_def)\n  next\n  case (Cons x xs)\n  thus ?case\n    apply (clarsimp simp: o_def mapM_x_Cons return_def bind_def)\n    apply (drule guard_preserved)\n    apply fastforce\n    done\nqed\n\nlemma (in submonad) stateAssert_fn:\n  \"stateAssert guard [] >>= (\\<lambda>u. fn m) = fn m\"\n  by (simp add: fn_is_sm submonad_fn_def pred_conj_def\n                bind_subst_lift [OF stateAssert_stateAssert])\n\nlemma (in submonad) fn_stateAssert:\n  \"fn m >>= (\\<lambda>x. stateAssert guard [] >>= (\\<lambda>u. n x)) = (fn m >>= n)\"\n  apply (simp add: fn_is_sm submonad_fn_def bind_assoc split_def)\n  apply (rule ext)\n  apply (rule bind_apply_cong [OF refl])+\n  apply (clarsimp simp: stateAssert_def bind_assoc in_monad select_f_def)\n  apply (drule iffD2 [OF replace_preserves_guard])\n  apply (fastforce simp: bind_def assert_def get_def return_def)\n  done\n\nlemma submonad_mapM:\n  assumes sm: \"submonad f r g sm\" and sm': \"submonad f r g sm'\"\n  assumes efm: \"\\<And>x. empty_fail (m x)\"\n  shows\n  \"(sm (mapM m l)) = (stateAssert g [] >>= (\\<lambda>u. mapM (sm' \\<circ> m) l))\"\nproof (induct l)\n  case Nil\n  thus ?case\n    by (simp add: mapM_def sequence_def bind_def submonad.return [OF sm])\n  next\n  case (Cons x xs)\n  thus ?case\n    using sm sm' efm\n    apply (simp add: mapM_Cons)\n    apply (simp add: bind_subst_lift [OF submonad.stateAssert_fn])\n    apply (simp add: bind_assoc submonad_bind submonad.return)\n    apply (subst submonad.fn_stateAssert [OF sm'])\n    apply (intro ext bind_apply_cong [OF refl])\n    apply (subgoal_tac \"g sta\")\n     apply (clarsimp simp: stateAssert_def bind_def get_def assert_def return_def)\n    apply (frule(1) submonad.guard_preserved)\n    apply (erule(1) submonad.mapM_guard_preserved, fastforce simp: o_def)\n    done\nqed\n\nlemma submonad_mapM_x:\n  assumes sm: \"submonad f r g sm\" and sm': \"submonad f r g sm'\"\n  assumes efm: \"\\<And>x. empty_fail (m x)\"\n  shows\n  \"(sm (mapM_x m l)) = (stateAssert g [] >>= (\\<lambda>u. mapM_x (sm' \\<circ> m) l))\"\nproof (induct l)\n  case Nil\n  thus ?case\n    by (simp add: mapM_x_def sequence_x_def bind_def submonad.return [OF sm])\n  next\n  case (Cons x xs)\n  thus ?case\n    using sm sm' efm\n    apply (simp add: mapM_x_Cons)\n    apply (simp add: bind_subst_lift [OF submonad.stateAssert_fn])\n    apply (simp add: bind_assoc submonad_bind submonad.return)\n    apply (subst submonad.fn_stateAssert [OF sm'])\n    apply (intro ext bind_apply_cong [OF refl])\n    apply (subgoal_tac \"g st\")\n     apply (clarsimp simp: stateAssert_def bind_def get_def assert_def return_def)\n    apply (frule(1) submonad.guard_preserved, simp)\n    done\nqed\n\nlemma corres_select:\n  \"(\\<forall>s' \\<in> S'. \\<exists>s \\<in> S. rvr s s') \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select S) (select S')\"\n  by (clarsimp simp: select_def corres_underlying_def)\n\nlemma corres_select_f:\n  \"\\<lbrakk> \\<forall>s' \\<in> fst S'. \\<exists>s \\<in> fst S. rvr s s'; nf' \\<Longrightarrow> \\<not> snd S' \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select_f S) (select_f S')\"\n  by (clarsimp simp: select_f_def corres_underlying_def)\n\nlemma corres_modify':\n  \"\\<lbrakk> (\\<forall>s s'. (s, s') \\<in> sr \\<longrightarrow> (f s, f' s') \\<in> sr); r () () \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' r \\<top> \\<top> (modify f) (modify f')\"\n  by (clarsimp simp: modify_def corres_underlying_def bind_def get_def put_def)\n\n(* FIXME: this should only be used for the lemma below *)\nlemma corres_select_f_stronger:\n  \"\\<lbrakk> \\<forall>s' \\<in> fst S'. \\<exists>s \\<in> fst S. rvr s s'; nf' \\<Longrightarrow> \\<not> snd S' \\<rbrakk>\n      \\<Longrightarrow> corres_underlying sr nf nf' rvr \\<top> \\<top> (select_f S) (select_f S')\"\n  by (clarsimp simp: select_f_def corres_underlying_def)\n\nlemma stateAssert_sp:\n  \"\\<lbrace>P\\<rbrace> stateAssert Q l \\<lbrace>\\<lambda>_. P and Q\\<rbrace>\"\n  by (clarsimp simp: valid_def stateAssert_def in_monad)\n\nlemma corres_submonad:\n  \"\\<lbrakk> submonad f r g fn; submonad f' r' g' fn';\n     \\<forall>s s'. (s, s') \\<in> sr \\<and> g s \\<and> g' s' \\<longrightarrow> (f s, f' s') \\<in> ssr;\n     \\<forall>s s' ss ss'. ((s, s') \\<in> sr \\<and> (ss, ss') \\<in> ssr) \\<longrightarrow> (r ss s, r' ss' s') \\<in> sr;\n     corres_underlying ssr False nf' rvr \\<top> \\<top> x x'\\<rbrakk>\n   \\<Longrightarrow> corres_underlying sr False nf' rvr g g' (fn x) (fn' x')\"\n  apply (subst submonad.fn_is_sm, assumption)+\n  apply (clarsimp simp: submonad_fn_def)\n  apply (rule corres_split' [OF _ _ stateAssert_sp stateAssert_sp])\n   apply (fastforce simp: corres_underlying_def stateAssert_def get_def\n                         assert_def return_def bind_def)\n  apply (rule corres_split' [where r'=\"\\<lambda>x y. (x, y) \\<in> ssr\",\n                             OF _ _ hoare_post_taut hoare_post_taut])\n   apply clarsimp\n  apply (rule corres_split' [where r'=\"\\<lambda>(x, x') (y, y'). rvr x y \\<and> (x', y') \\<in> ssr\",\n                             OF _ _ hoare_post_taut hoare_post_taut])\n   defer\n   apply clarsimp\n   apply (rule corres_split' [where r'=dc, OF _ _ hoare_post_taut hoare_post_taut])\n    apply (simp add: corres_modify')\n   apply clarsimp\n  apply (rule corres_select_f_stronger)\n   apply (clarsimp simp: corres_underlying_def)\n   apply (drule (1) bspec, clarsimp)\n   apply (drule (1) bspec, simp)\n   apply blast\n  apply (clarsimp simp: corres_underlying_def)\n  apply (drule (1) bspec, clarsimp)\n  done\n\nlemma stateAssert_top [simp]:\n  \"stateAssert \\<top> l >>= f = f ()\"\n  by (clarsimp simp add: stateAssert_def get_def bind_def return_def)\n\nlemma stateAssert_A_top [simp]:\n  \"stateAssert \\<top> l = return ()\"\n  by (simp add: stateAssert_def get_def bind_def return_def)\n\ntext \\<open>Use of the submonad concept to demonstrate commutativity.\\<close>\n\nlemma gets_modify_comm:\n  \"\\<And> s. \\<lbrakk> g (f s) = g s \\<rbrakk> \\<Longrightarrow>\n   (do x \\<leftarrow> modify f; y \\<leftarrow> gets g; m x y od) s =\n   (do y \\<leftarrow> gets g; x \\<leftarrow> modify f; m x y od) s\"\n  by (simp add: modify_def gets_def get_def bind_def put_def return_def)\n\nlemma bind_subst_lhs_inv:\n  \"\\<And>s. \\<lbrakk> \\<And>x s'. P s' \\<Longrightarrow> (f x >>= g x) s' = h x s'; \\<lbrace>P\\<rbrace> a \\<lbrace>\\<lambda>_. P\\<rbrace>; P s \\<rbrakk> \\<Longrightarrow>\n   (do x \\<leftarrow> a; y \\<leftarrow> f x; g x y od) s = (a >>= h) s\"\n  apply (rule bind_apply_cong [OF refl])\n  apply (drule(2) use_valid)\n  apply simp\n  done\n\nlemma gets_comm:\n  \"do x \\<leftarrow> gets f; y \\<leftarrow> gets g; m x y od = do y \\<leftarrow> gets g; x \\<leftarrow> gets f; m x y od\"\n  by (simp add: gets_def get_def return_def bind_def)\n\nlemma submonad_comm:\n  assumes x1: \"submonad_args f r g\" and x2: \"submonad_args f' r' g'\"\n  assumes y: \"m = submonad_fn f r g im\" \"m' = submonad_fn f' r' g' im'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"(do x \\<leftarrow> m; y \\<leftarrow> m'; n x y od) = (do y \\<leftarrow> m'; x \\<leftarrow> m; n x y od)\"\nproof -\n  have P: \"\\<And>x s. g s \\<Longrightarrow> f (r' x s) = f s\"\n    apply (subgoal_tac \"f (r' x (r (f s) s)) = f s\")\n     apply (simp add: submonad_args.args[OF x1])\n    apply (simp add: z[symmetric])\n    apply (subst(asm) gp [symmetric])\n    apply (fastforce dest: submonad_args.argsD1[OF x1])\n    done\n  have Q: \"\\<And>x s. g' s \\<Longrightarrow> f' (r x s) = f' s\"\n    apply (subgoal_tac \"f' (r x (r' (f' s) s)) = f' s\")\n     apply (simp add: submonad_args.args[OF x2])\n    apply (simp add: z)\n    apply (subst(asm) gp' [symmetric])\n    apply (fastforce dest: submonad_args.argsD1[OF x2])\n    done\n  note empty_failD [OF efim, simp]\n  note empty_failD [OF efim', simp]\n  show ?thesis\n    apply (clarsimp simp: submonad_fn_def y bind_assoc split_def)\n    apply (subst bind_subst_lift [OF modify_stateAssert], rule gp gp')+\n    apply (simp add: bind_assoc)\n    apply (subst select_f_stateAssert, rule efim efim')+\n    apply (subst gets_stateAssert bind_subst_lift [OF stateAssert_stateAssert])+\n    apply (rule bind_cong)\n     apply (simp add: pred_conj_def conj_comms)\n    apply (simp add: bind_assoc select_f_walk[symmetric])\n    apply (clarsimp dest!: fst_stateAssertD)\n    apply (subst bind_assoc[symmetric],\n           subst bind_subst_lhs_inv [OF gets_modify_comm],\n           erule P Q, wp, simp, simp)+\n    apply (simp add: bind_assoc)\n    apply (simp add: select_f_walk[symmetric])\n    apply (subst gets_comm)\n    apply (rule bind_apply_cong [OF refl])+\n    apply (subst select_f_walk, simp, simp,\n           subst select_f_walk, simp, simp,\n           rule bind_apply_cong [OF refl])\n    apply (subst select_f_walk, simp, simp, rule bind_apply_cong [OF refl])\n    apply (clarsimp simp: simpler_gets_def select_f_def)\n    apply (simp add: bind_def get_def put_def modify_def z)\n    done\nqed\n\nlemma submonad_comm2:\n  assumes x1: \"submonad_args f r g\" and x2: \"m = submonad_fn f r g im\"\n  assumes y: \"submonad f' r' g' m'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"do x \\<leftarrow> m; y \\<leftarrow> m' im'; n x y od = do y \\<leftarrow> m' im'; x \\<leftarrow> m; n x y od\"\n  apply (rule submonad_comm[where f'=f' and r'=r', OF x1 _ x2 _ z])\n       apply (insert y)\n       apply (fastforce simp add: submonad_def)\n      apply (fastforce dest: submonad.fn_is_sm)\n     apply (simp add: efim efim' gp gp')+\n  done\n\nlemma submonad_bind_alt:\n  assumes x: \"submonad_args f r g\"\n  assumes y: \"a = submonad_fn f r g a'\" \"\\<And>rv. b rv = submonad_fn f r g (b' rv)\"\n  assumes efa: \"empty_fail a'\" and efb: \"\\<And>x. empty_fail (b' x)\"\n  shows      \"(a >>= b) = submonad_fn f r g (a' >>= b')\"\nproof -\n  have P: \"submonad f r g (submonad_fn f r g)\"\n    by (simp add: x submonad_def submonad_axioms_def)\n  have Q: \"b = (\\<lambda>rv. submonad_fn f r g (b' rv))\"\n    by (rule ext) fact+\n  show ?thesis\n    by (simp add: y Q submonad_bind [OF P P P efa efb])\nqed\n\nlemma submonad_singleton:\n  \"submonad_fn fetch replace \\<top> (\\<lambda>s. ({(rv s, s' s)}, False))\n     = (\\<lambda>s. ({(rv (fetch s), replace (s' (fetch s)) s)}, False))\"\n  apply (rule ext)\n  apply (simp add: submonad_fn_def bind_def gets_def\n                put_def get_def modify_def return_def\n                select_f_def UNION_eq)\n  done\n\nlemma gets_submonad:\n  \"\\<lbrakk> submonad_args fetch replace \\<top>; \\<And>s. f s = f' (fetch s); m = gets f' \\<rbrakk>\n   \\<Longrightarrow> gets f = submonad_fn fetch replace \\<top> m\"\n  apply (drule submonad_args.args(3))\n  apply (clarsimp simp add: simpler_gets_def submonad_singleton)\n  done\n\nlemma modify_submonad:\n  \"\\<lbrakk> \\<And>s. f s = replace (K_record (f' (fetch s))) s; m = modify f' \\<rbrakk>\n     \\<Longrightarrow> modify f = submonad_fn fetch (replace o K_record) \\<top> m\"\n  by (simp add: simpler_modify_def submonad_singleton)\n\nlemma fail_submonad:\n  \"fail = submonad_fn fetch replace \\<top> fail\"\n  by (simp add: submonad_fn_def simpler_gets_def return_def\n                simpler_modify_def select_f_def bind_def fail_def)\n\nlemma return_submonad:\n  \"submonad_args fetch replace guard \\<Longrightarrow>\n   return v = submonad_fn fetch replace \\<top> (return v)\"\n  by (simp add: return_def submonad_singleton submonad_args.args)\n\nlemma assert_opt_submonad:\n  \"submonad_args fetch replace \\<top> \\<Longrightarrow>\n   assert_opt v = submonad_fn fetch replace \\<top> (assert_opt v)\"\n  apply (case_tac v, simp_all add: assert_opt_def)\n   apply (rule fail_submonad)\n  apply (rule return_submonad)\n  apply assumption\n  done\n\nlemma is_stateAssert_gets:\n  \"\\<lbrakk> \\<forall>s. \\<lbrace>(=) s\\<rbrace> f \\<lbrace>\\<lambda>_. (=) s\\<rbrace>; \\<lbrace>\\<top>\\<rbrace> f \\<lbrace>\\<lambda>_. guard\\<rbrace>;\n     empty_fail f; no_fail guard f; \\<lbrace>guard\\<rbrace> f \\<lbrace>\\<lambda>rv s. fetch s = rv\\<rbrace> \\<rbrakk>\n    \\<Longrightarrow> f = do stateAssert guard []; gets fetch od\"\n  apply (rule ext)\n  apply (clarsimp simp: bind_def empty_fail_def valid_def no_fail_def\n                        stateAssert_def assert_def gets_def get_def\n                        return_def fail_def image_def split_def)\n  apply (case_tac \"f x\")\n  apply (intro conjI impI)\n   apply (drule_tac x=x in spec)+\n   apply (subgoal_tac \"\\<forall>xa\\<in>fst (f x). fst xa = fetch x \\<and> snd xa = x\")\n    apply fastforce\n   apply clarsimp\n  apply (drule_tac x=x in spec)+\n  apply fastforce\n  done\n\nlemma is_modify:\n  \"\\<And>s. \\<lbrakk> \\<lbrace>(=) s\\<rbrace> f \\<lbrace>\\<lambda>_. (=) (replace s)\\<rbrace>; empty_fail f;\n          no_fail guard f; guard s \\<rbrakk>\n    \\<Longrightarrow> f s = modify replace s\"\n  apply (clarsimp simp: bind_def empty_fail_def valid_def no_fail_def\n                        stateAssert_def assert_def modify_def get_def put_def\n                        return_def fail_def image_def split_def)\n  apply (case_tac \"f s\")\n  apply force\n  done\n\nlemma submonad_comm':\n  assumes sm1: \"submonad f r g m\" and sm2: \"submonad f' r' g' m'\"\n  assumes z: \"\\<And>s x x'. r x (r' x' s) = r' x' (r x s)\"\n  assumes gp: \"\\<And>s x. g (r' x s) = g s\" and gp': \"\\<And>s x. g' (r x s) = g' s\"\n  assumes efim: \"empty_fail im\" and efim': \"empty_fail im'\"\n  shows      \"(do x \\<leftarrow> m im; y \\<leftarrow> m' im'; n x y od) =\n              (do y \\<leftarrow> m' im'; x \\<leftarrow> m im; n x y od)\"\n  apply (rule submonad_comm [where f'=f' and r'=r', OF _ _ _ _ z])\n         apply (insert sm1 sm2)\n         apply (fastforce dest: submonad.fn_is_sm simp: submonad_def)+\n     apply (simp add: efim efim' gp gp')+\n  done\n\nend\n", "meta": {"author": "amblafont", "repo": "AutoCorres", "sha": "a8e96bff9fb22d633ff473401947ca84235d3b73", "save_path": "github-repos/isabelle/amblafont-AutoCorres", "path": "github-repos/isabelle/amblafont-AutoCorres/AutoCorres-a8e96bff9fb22d633ff473401947ca84235d3b73/lib/SubMonadLib.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5312093733737563, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.30271106987308793}}
{"text": "section \"Solution to Day 4 of AoC 2020\"\n\ntheory day4\n  imports Main \"HOL.Code_Numeral\" string_utils list_natural_utils natural_utils list_utils\nbegin\n\ntext \"This is a solution to the puzzle for day 4\"\n\nsubsection \"Input parsing\"\n\ntext \"The input for this puzzle has records separated by two newlines, where each record is split\nacross multiple lines. We parse it by joining together the multiline records into single lines\nand collapsing the double newlines into single newlines, then splitting on newlines and parsing each\nline as a record\"\n\ndefinition join_records :: \"string \\<Rightarrow> string\"\n  where \"join_records = join_lines CHR '' ''\"\n\ntext \"Passport information is stored as a record of string options, since some fields can be missing\"\n\nrecord passport =\n  byr :: \"string option\"\n  iyr :: \"string option\"\n  eyr :: \"string option\"\n  hgt :: \"string option\"\n  hcl :: \"string option\"\n  ecl :: \"string option\"\n  pid :: \"string option\"\n  cid :: \"string option\"\n\ndefinition Blank_Passport :: \"passport\"\n  where \"Blank_Passport = \\<lparr>\n    byr = None\n    ,iyr = None\n    ,eyr = None\n    ,hgt = None\n    ,hcl = None\n    ,ecl = None\n    ,pid = None\n    ,cid = None\n  \\<rparr>\"\n\nfun update_passport :: \"passport \\<Rightarrow> string \\<Rightarrow> passport\"\n  where \"update_passport p s = (let (field, value) = (split_once CHR '':'' s) in\n    case field of\n      ''byr'' \\<Rightarrow> p\\<lparr> byr:=Some value \\<rparr>\n      |''iyr'' \\<Rightarrow> p\\<lparr> iyr:=Some value \\<rparr>\n      |''eyr'' \\<Rightarrow> p\\<lparr> eyr:=Some value \\<rparr>\n      |''hgt'' \\<Rightarrow> p\\<lparr> hgt:=Some value \\<rparr>\n      |''hcl'' \\<Rightarrow> p\\<lparr> hcl:=Some value \\<rparr>\n      |''ecl'' \\<Rightarrow> p\\<lparr> ecl:=Some value \\<rparr>\n      |''pid'' \\<Rightarrow> p\\<lparr> pid:=Some value \\<rparr>\n      |''cid'' \\<Rightarrow> p\\<lparr> cid:=Some value \\<rparr>\n  )\"\n\ntext \"this representation, plus the update\\\\_passport function which updates an arbitraty field in\na passport record, enables us to define passport parsing as simply reducing the list of fields to\nparse over the update function\"\n\ndefinition parse_passport :: \"string \\<Rightarrow> passport\"\n  where \"parse_passport r = reduce update_passport Blank_Passport (split CHR '' '' r)\"\n\ndefinition parse_all :: \"string \\<Rightarrow> passport list\"\n  where \"parse_all s = map parse_passport (split CHR ''\\<newline>'' (join_records (trim s)))\"\n\nsubsection \"Solution Algorithm\"\n\ntext \"Passports must have all fields present, or have only cid missing, the task for part1 is simply\nto count the valid ones according to those rules\"\n\ndefinition is_some :: \"'a option \\<Rightarrow> bool\"\n  where \"is_some a = (a \\<noteq> None)\"\n\ndefinition is_valid :: \"passport \\<Rightarrow> bool\"\n  where \"is_valid p = (\n    is_some (byr p)\n    \\<and> is_some (iyr p)\n    \\<and> is_some (eyr p)\n    \\<and> is_some (hgt p)\n    \\<and> is_some (hcl p)\n    \\<and> is_some (ecl p)\n    \\<and> is_some (pid p)\n  )\"\n\ndefinition num_valid :: \"(passport \\<Rightarrow> bool) \\<Rightarrow> string \\<Rightarrow> natural\"\n  where \"num_valid f = sum_list \\<circ> (map count_bool) \\<circ> (map f) \\<circ> parse_all\"\n\ndefinition part1 :: \"string \\<Rightarrow> natural\"\n  where \"part1 = num_valid is_valid\"\n\ntext \"In part 2 we do the same but with lots of extra rules. The rules suck and you would never get\naway with implementing these rules in the real world, but I guess I'll look past that for now.\"\n\ndefinition all :: \"bool list \\<Rightarrow> bool\"\n  where \"all = reduce (\\<and>) True\"\n\ndefinition is_number_between :: \"natural \\<Rightarrow> natural \\<Rightarrow> string \\<Rightarrow> bool\"\n  where \"is_number_between n_min n_max num = ((all (map is_digit num)) \\<and> (let n = str_to_nat num in ((n_min \\<le> n) \\<and> (n \\<le> n_max))))\"\n\ndefinition valid_height :: \"string \\<Rightarrow> bool\"\n  where \"valid_height s = (let l = length s in\n    if l = 4 then is_number_between 59 76 (fst (split_once CHR ''i'' s)) else\n    if l = 5 then is_number_between 150 193 (fst (split_once CHR ''c'' s)) else\n    False\n  )\"\n\nfun valid_color :: \"string \\<Rightarrow> bool\"\n  where \"valid_color (Cons CHR ''#'' digits) = (length digits = 6 \\<and> (all (map is_hexit digits)))\"\n  | \"valid_color s = False\"\n\ndefinition valid_eye_color :: \"string \\<Rightarrow> bool\"\n  where \"valid_eye_color s = (\n    s = ''amb''\n    \\<or> s = ''blu''\n    \\<or> s = ''brn''\n    \\<or> s = ''gry''\n    \\<or> s = ''grn''\n    \\<or> s = ''hzl''\n    \\<or> s = ''oth''\n  )\"\n\ndefinition valid_pid :: \"string \\<Rightarrow> bool\"\n  where \"valid_pid a = ((length a = 9) \\<and> (all (map is_digit a)))\"\n\nfun present_and_matches :: \"('a \\<Rightarrow> bool) \\<Rightarrow> 'a option \\<Rightarrow> bool\"\n  where \"present_and_matches _ None = False\"\n  | \"present_and_matches f (Some a) = f a\"\n\ndefinition is_valid_2 :: \"passport \\<Rightarrow> bool\"\n  where \"is_valid_2 p = (\n    present_and_matches (is_number_between 1920 2002) (byr p)\n    \\<and> present_and_matches (is_number_between 2010 2020) (iyr p)\n    \\<and> present_and_matches (is_number_between 2020 2030) (eyr p)\n    \\<and> present_and_matches valid_height (hgt p)\n    \\<and> present_and_matches valid_color (hcl p)\n    \\<and> present_and_matches valid_eye_color (ecl p)\n    \\<and> present_and_matches valid_pid (pid p)\n  )\"\n\ndefinition part2 :: \"string \\<Rightarrow> natural\"\n  where \"part2 = num_valid is_valid_2\"\n\nsubsection \"Testing\"\n\ntext \"We expect our test case to return 2\"\n\ndefinition example_input::string where \"example_input = ''\necl:gry pid:860033327 eyr:2020 hcl:#fffffd\nbyr:1937 iyr:2017 cid:147 hgt:183cm\n\niyr:2013 ecl:amb cid:350 eyr:2023 pid:028048884\nhcl:#cfa07d byr:1929\n\nhcl:#ae17e1 iyr:2013\neyr:2024\necl:brn pid:760753108 byr:1931\nhgt:179cm\n\nhcl:#cfa07d eyr:2025 pid:166559648\niyr:2011 ecl:brn hgt:59in\n''\"\n\nlemma \"part1 example_input = 2\"\n  by eval\n\ntext \"For part 2 the example also returns 2\"\n\nlemma \"part2 example_input = 2\"\n  by eval\n\n\nexport_code \"part1\" \"part2\" in Haskell module_name Solution\n\nend\n", "meta": {"author": "lexbailey", "repo": "AOC2020_isabelle", "sha": "c08c347793814e9cc3e9d9638dd889d2ada2eb1d", "save_path": "github-repos/isabelle/lexbailey-AOC2020_isabelle", "path": "github-repos/isabelle/lexbailey-AOC2020_isabelle/AOC2020_isabelle-c08c347793814e9cc3e9d9638dd889d2ada2eb1d/day4.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5312093585306514, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.30271106141470533}}
{"text": "theory func_cor_other\nimports func_cor_lemma\nbegin\n\nsection \\<open>Functional correctness of Schedule\\<close>\n\nthm Schedule_def\nlemma Schedule_satRG_h1: \n  \"\\<Gamma> \\<turnstile>\\<^sub>I Some (IF \\<exists>y. \\<acute>cur = Some y THEN \\<acute>thd_state := \\<acute>thd_state(the \\<acute>cur := READY);; Basic (cur_update Map.empty) FI;;\n           Basic (cur_update (\\<lambda>_. Some t));;\n           \\<acute>thd_state := \\<acute>thd_state\n           (t := RUNNING)) sat\\<^sub>p [\\<lbrace>\\<acute>inv\\<rbrace> \\<inter> \\<lbrace>\\<acute>thd_state t = READY\\<rbrace> \\<inter>\n                                 {V}, {(s, t). s = t}, UNIV, \\<lbrace>\\<acute>(Pair V) \\<in> Schedule_guar\\<rbrace> \\<inter> \\<lbrace>\\<acute>inv\\<rbrace>]\"\n  apply(case_tac \"\\<lbrace>\\<acute>inv\\<rbrace> \\<inter> \\<lbrace>\\<acute>thd_state t = READY\\<rbrace> \\<inter> {V} = {}\")\n    using Emptyprecond apply auto[1]\n    apply simp\n    apply(case_tac \"\\<exists>y. cur V = Some y\")\n    \n    apply(rule Seq[where mid = \"{V\\<lparr>thd_state := (thd_state V)(the (cur V) := READY), cur := Some t\\<rparr>}\"])\n      apply(rule Seq[where mid = \"{V\\<lparr>thd_state := (thd_state V)(the (cur V) := READY), cur := None\\<rparr>}\"])\n        apply(rule Cond)\n          apply(simp add:stable_def)\n          apply(rule Seq[where mid = \"{V\\<lparr>thd_state := (thd_state V)(the (cur V) := READY)\\<rparr>}\"])\n          apply(rule Basic)\n            apply auto[1]\n            apply(simp add:stable_def)+\n          apply(rule Basic)\n            apply auto[1]\n            apply(simp add:stable_def)+\n          apply(simp add:Skip_def) apply(rule Basic) apply(simp add:stable_def)+\n\n        apply(rule Basic)\n         apply auto[1]\n          apply(simp add:stable_def)+\n\n        apply(rule Basic)\n         apply(simp add:Schedule_guar_def)\n         apply(subgoal_tac \"inv (V\\<lparr>cur := Some t, thd_state := (thd_state V)(the (cur V) := READY, t := RUNNING)\\<rparr>) \\<and>\n                (\\<forall>x. (V, V\\<lparr>cur := Some t, thd_state := (thd_state V)(the (cur V) := READY, t := RUNNING)\\<rparr>) \\<in> lvars_nochange_rel x)\")\n         apply simp\n         apply(rule conjI) apply(simp add:inv_def) apply clarify\n         apply(rule conjI) apply(simp add:inv_cur_def) apply force\n          apply(simp add:inv_thd_waitq_def inv_cur_def)\n            apply (metis Thread_State_Type.distinct(3) Thread_State_Type.distinct(6))\n         apply auto[1] using lvars_nochange_rel_def lvars_nochange_def apply simp\n          apply(simp add: stable_def)+\n\n    apply(rule Seq[where mid = \"{V\\<lparr>cur := Some t\\<rparr>}\"])\n      apply(rule Seq[where mid = \"{V}\"])\n        apply(rule Cond)\n          apply(simp add:stable_def)\n          apply(rule Seq[where mid = \"{}\"])\n          apply(rule Basic)\n            apply auto[1]\n            apply(simp add:stable_def)+\n          apply(rule Basic)\n            apply auto[1]\n            apply(simp add:stable_def)+\n          apply(simp add:Skip_def) apply(rule Basic) apply(simp add:stable_def)+\n        apply(rule Basic)\n         apply auto[1]\n          apply(simp add:stable_def)+\n         apply(rule Basic)\n           apply(simp add:Schedule_guar_def)\n           apply(subgoal_tac \"inv (V\\<lparr>cur := Some t, thd_state := (thd_state V)(t := RUNNING)\\<rparr>) \\<and>\n              (\\<forall>x. (V, V\\<lparr>cur := Some t, thd_state := (thd_state V)(t := RUNNING)\\<rparr>) \\<in> lvars_nochange_rel x)\")\n           apply simp\n           apply(rule conjI) apply(simp add:inv_def) apply clarify\n           apply(rule conjI) apply(simp add:inv_cur_def)\n           apply(simp add:inv_thd_waitq_def) apply auto[1] \n\n          apply auto[1] using lvars_nochange_rel_def lvars_nochange_def apply simp\n          apply(simp add:stable_def)+\ndone\n\nlemma Schedule_satRG: \"\\<Gamma> (Schedule t) \\<turnstile> Schedule_RGCond t\"\n  apply(simp add:Evt_sat_RG_def) \n  apply (simp add: Schedule_def Schedule_RGCond_def)\n  apply(rule BasicEvt)\n    apply(simp add:body_def Pre\\<^sub>f_def Post\\<^sub>f_def guard_def\n                  Rely\\<^sub>f_def Guar\\<^sub>f_def getrgformula_def)\n    apply(rule Await)\n      using stable_inv_sched_rely1 apply simp using stable_inv_sched_rely1 apply simp\n      using Schedule_satRG_h1 apply simp\n    \n    apply(simp add:Pre\\<^sub>f_def Rely\\<^sub>f_def getrgformula_def)\n    using stable_inv_sched_rely1 apply simp\n\n    by(simp add:Guar\\<^sub>f_def getrgformula_def Schedule_guar_def)\n\nsection \\<open>Functional correctness of Tick\\<close>\nlemma Tick_satRG: \"\\<Gamma> Tick \\<turnstile> Tick_RGCond\"\n  apply(simp add:Evt_sat_RG_def) \n  apply (simp add: Tick_def Tick_RGCond_def Tick_rely_def Tick_guar_def)\n  apply(rule BasicEvt)\n    apply(simp add:body_def Pre\\<^sub>f_def Post\\<^sub>f_def guard_def\n                  Rely\\<^sub>f_def Guar\\<^sub>f_def getrgformula_def)\n    apply(rule Basic)\n      apply simp\n      using lvars_nochange_rel_def lvars_nochange_def apply simp apply auto[1]\n      apply(simp add:stable_def)+\n    apply(simp add: stable_def Pre\\<^sub>f_def getrgformula_def Rely\\<^sub>f_def) apply auto[1]\n    by (simp add: Guar\\<^sub>f_def getrgformula_def)\n\n\nend", "meta": {"author": "zerrymore", "repo": "Verified-Mailbox", "sha": "778ac0f3b87f342e02dd4a6ad86abeb32be82d42", "save_path": "github-repos/isabelle/zerrymore-Verified-Mailbox", "path": "github-repos/isabelle/zerrymore-Verified-Mailbox/Verified-Mailbox-778ac0f3b87f342e02dd4a6ad86abeb32be82d42/PiCore-SIMP-mailbox/func_cor_other.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6791786861878392, "lm_q2_score": 0.4455295350395727, "lm_q1q2_score": 0.30259416426605584}}
{"text": "section {*FUNCTION\\_\\_DPDA\\_EA\\_STD\\_\\_DPDA\\_ENFORCE\\_ACCESSIBLE\\_STD*}\ntheory\n  FUNCTION__DPDA_EA_STD__DPDA_ENFORCE_ACCESSIBLE_STD\n\nimports\n  PRJ_12_08_02__ENTRY\n\nbegin\n\nlemma F_DPDA_EA_STD__preserves_DPDA: \"\n  valid_dpda G\n  \\<Longrightarrow> valid_dpda (F_DPDA_EA_STD G)\"\n  apply(simp add: F_DPDA_EA_STD_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac G=\"G\" and E=\"(F_DPDA_DAE G)\" in F_EPDA_RE__SOUND)\n   apply(simp add: F_EPDA_RE__SpecInput_def)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac G=\"G\" in F_DPDA_DAE__SOUND)\n    apply(simp add: F_DPDA_DAE__SpecInput_def)\n   apply(simp add: F_DPDA_DAE__SpecOutput_def)\n   apply(thin_tac \"F_DPDA_DAE G = epdaH_accessible_edges G\")\n   apply (metis epdaH_accessible_edges_vs_epdaS_accessible_edges valid_dpda_def valid_pda_def)\n  apply(simp add: F_EPDA_RE__SpecOutput_def)\n  done\n\nlemma F_DPDA_EA_STD__preserves_lang: \"\n  valid_dpda G\n  \\<Longrightarrow> epdaS.marked_language G = epdaS.marked_language (F_DPDA_EA_STD G)\"\n  apply(simp add: F_DPDA_EA_STD_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac G=\"G\" and E=\"(F_DPDA_DAE G)\" in F_EPDA_RE__SOUND)\n   apply(simp add: F_EPDA_RE__SpecInput_def)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac G=\"G\" in F_DPDA_DAE__SOUND)\n    apply(simp add: F_DPDA_DAE__SpecInput_def)\n   apply(simp add: F_DPDA_DAE__SpecOutput_def)\n   apply(thin_tac \"F_DPDA_DAE G = epdaH_accessible_edges G\")\n   apply (metis epdaH_accessible_edges_vs_epdaS_accessible_edges valid_dpda_def valid_pda_def)\n  apply(simp add: F_EPDA_RE__SpecOutput_def)\n  done\n\nlemma F_DPDA_EA_STD__preserves_unmarked_language: \"\n  valid_dpda G\n  \\<Longrightarrow> epdaS.unmarked_language G = epdaS.unmarked_language (F_DPDA_EA_STD G)\"\n  apply(simp add: F_DPDA_EA_STD_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac G=\"G\" and E=\"(F_DPDA_DAE G)\" in F_EPDA_RE__SOUND)\n   apply(simp add: F_EPDA_RE__SpecInput_def)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac G=\"G\" in F_DPDA_DAE__SOUND)\n    apply(simp add: F_DPDA_DAE__SpecInput_def)\n   apply(simp add: F_DPDA_DAE__SpecOutput_def)\n   apply(thin_tac \"F_DPDA_DAE G = epdaH_accessible_edges G\")\n   apply (metis epdaH_accessible_edges_vs_epdaS_accessible_edges valid_dpda_def valid_pda_def)\n  apply(simp add: F_EPDA_RE__SpecOutput_def)\n  done\n\nlemma F_DPDA_EA_STD__enforces_accessible: \"\n  valid_dpda G\n  \\<Longrightarrow> epdaS.accessible (F_DPDA_EA_STD G)\"\n  apply(simp add: F_DPDA_EA_STD_def)\n  apply(subgoal_tac \"X\" for X)\n   prefer 2\n   apply(rule_tac G=\"G\" and E=\"(F_DPDA_DAE G)\" in F_EPDA_RE__SOUND)\n   apply(simp add: F_EPDA_RE__SpecInput_def)\n   apply(subgoal_tac \"X\" for X)\n    prefer 2\n    apply(rule_tac G=\"G\" in F_DPDA_DAE__SOUND)\n    apply(simp add: F_DPDA_DAE__SpecInput_def)\n   apply(simp add: F_DPDA_DAE__SpecOutput_def)\n   apply(thin_tac \"F_DPDA_DAE G = epdaH_accessible_edges G\")\n   apply (metis epdaH_accessible_edges_vs_epdaS_accessible_edges valid_dpda_def valid_pda_def)\n  apply(simp add: F_EPDA_RE__SpecOutput_def)\n  done\n\nlemma F_DPDA_EA_STD__preserves_epdaH_no_livelocks_from_marking_states: \"\n  valid_dpda G\n  \\<Longrightarrow> epdaH_no_livelocks_from_marking_states G\n  \\<Longrightarrow> epdaH_no_livelocks_from_marking_states (F_DPDA_EA_STD G)\"\n  apply(simp add: epdaH_no_livelocks_from_marking_states_def F_DPDA_EA_STD_def)\n  apply(clarsimp)\n  apply(rename_tac d n e c)(*strict*)\n  apply(erule_tac\n      x=\"d\"\n      in allE)\n  apply(erule_tac\n      x=\"n\"\n      in allE)\n  apply(clarsimp)\n  apply(erule impE)\n   apply(rename_tac d n e c)(*strict*)\n   prefer 2\n   apply(simp add: F_EPDA_R_def F_EPDA_RE_def F_DPDA_DAE_def Let_def)\n  apply(rename_tac d n e c)(*strict*)\n  apply(rule epdaH.derivation_initialI)\n   apply(rename_tac d n e c)(*strict*)\n   prefer 2\n   apply(clarsimp)\n   apply(rename_tac d n e c ca)(*strict*)\n   apply(simp add: get_configuration_def epdaH_initial_configurations_def epdaH.derivation_initial_def)\n   apply(rule conjI)\n    apply(rename_tac d n e c ca)(*strict*)\n    apply(simp add: F_ALT_EPDA_RE_def F_DPDA_DAE_def Let_def F_EPDA_R_def F_EPDA_RE_def)\n   apply(rename_tac d n e c ca)(*strict*)\n   apply(rule conjI)\n    apply(rename_tac d n e c ca)(*strict*)\n    apply(simp add: F_ALT_EPDA_RE_def F_DPDA_DAE_def Let_def F_EPDA_R_def F_EPDA_RE_def)\n   apply(rename_tac d n e c ca)(*strict*)\n   apply(simp add: F_ALT_EPDA_RE_def F_DPDA_DAE_def Let_def epdaH_configurations_def valid_dpda_def valid_pda_def valid_epda_def)\n   apply(clarsimp)\n   apply(simp add: F_ALT_EPDA_RE_def F_DPDA_DAE_def Let_def F_EPDA_R_def F_EPDA_RE_def)\n  apply(rename_tac d n e c)(*strict*)\n  apply(simp add: epdaH.derivation_initial_def)\n  apply(clarsimp)\n  apply(thin_tac \"d n = Some (pair (Some e) c)\")\n  apply(thin_tac \"case d 0 of None \\<Rightarrow> False | Some (pair a b) \\<Rightarrow> b \\<in> epdaH_initial_configurations (F_EPDA_RE G (F_DPDA_DAE G)) \\<and> a = None\")\n  apply(rename_tac d n e c)(*strict*)\n  apply(thin_tac \"edge_src e \\<in> epda_marking (F_EPDA_RE G (F_DPDA_DAE G))\")\n  apply(thin_tac \"edge_event e = None\")\n  apply(simp (no_asm) add: epdaH.derivation_def)\n  apply(rename_tac d)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac d i)(*strict*)\n   apply(clarsimp)\n   apply(rename_tac d)(*strict*)\n   apply(simp add: epdaH.derivation_def)\n   apply(erule_tac\n      x=\"0\"\n      in allE)\n   apply(clarsimp)\n  apply(rename_tac d i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d nat)(*strict*)\n  apply(case_tac \"d (Suc nat)\")\n   apply(rename_tac d nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac d nat a)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac d nat a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      n=\"nat\"\n      and m=\"Suc nat\"\n      in epdaH.step_detail_before_some_position)\n     apply(rename_tac d nat a)(*strict*)\n     apply(force)\n    apply(rename_tac d nat a)(*strict*)\n    apply(force)\n   apply(rename_tac d nat a)(*strict*)\n   apply(force)\n  apply(rename_tac d nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac d nat e1 e2 c1 c2)(*strict*)\n  apply(simp add: epdaH_step_relation_def)\n  apply(clarsimp)\n  apply(rename_tac d nat e1 e2 c1 c2 w)(*strict*)\n  apply(simp add: F_ALT_EPDA_RE_def F_DPDA_DAE_def Let_def F_EPDA_R_def F_EPDA_RE_def)\n  done\n\ndefinition F_DPDA_EA_STD__SpecInput :: \"\n  ('state, 'event, 'stack) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EA_STD__SpecInput G \\<equiv>\n  valid_dpda G\n  \\<and> nonblockingness_language (epdaS.unmarked_language G) (epdaS.marked_language G)\n  \\<and> epdaH_no_livelocks_from_marking_states G\"\n\ndefinition F_DPDA_EA_STD__SpecOutput :: \"\n  ('p, 'event, 'stack) epda\n  \\<Rightarrow> ('state, 'event, 'stackx) epda\n  \\<Rightarrow> bool\"\n  where\n    \"F_DPDA_EA_STD__SpecOutput Gi Go \\<equiv>\n  valid_dpda Go\n  \\<and> epdaS.marked_language Gi = epdaS.marked_language Go\n  \\<and> epdaS.unmarked_language Gi = epdaS.unmarked_language Go\n  \\<and> nonblockingness_language (epdaS.unmarked_language Go) (epdaS.marked_language Go)\n  \\<and> epdaS.accessible Go\n  \\<and> epdaH_no_livelocks_from_marking_states Go\"\n\ntheorem F_DPDA_EA_STD__SOUND: \"\n  F_DPDA_EA_STD__SpecInput G\n  \\<Longrightarrow> F_DPDA_EA_STD__SpecOutput G (F_DPDA_EA_STD G)\"\n  apply(simp add: F_DPDA_EA_STD__SpecInput_def F_DPDA_EA_STD__SpecOutput_def)\n  apply(rule conjI)\n   apply (metis F_DPDA_EA_STD__preserves_DPDA)\n  apply(rule context_conjI)\n   apply(rule F_DPDA_EA_STD__preserves_lang)\n   apply(force)\n  apply(rule context_conjI)\n   apply(subgoal_tac \"epdaS.unmarked_language G = epdaS.unmarked_language (F_DPDA_EA_STD G)\")\n    apply(force)\n   apply(rule F_DPDA_EA_STD__preserves_unmarked_language)\n   apply(force)\n  apply(rule context_conjI)\n   apply(subgoal_tac \"epdaS.unmarked_language G = epdaS.unmarked_language (F_DPDA_EA_STD G)\")\n    apply(force)\n   apply(rule F_DPDA_EA_STD__preserves_unmarked_language)\n   apply(force)\n  apply(rule conjI)\n   apply(rule F_DPDA_EA_STD__enforces_accessible)\n   apply(force)\n  apply(rule F_DPDA_EA_STD__preserves_epdaH_no_livelocks_from_marking_states)\n   apply(force)\n  apply(force)\n  done\n\nhide_fact F_DPDA_EA_STD__preserves_DPDA\nhide_fact F_DPDA_EA_STD__preserves_lang\nhide_fact F_DPDA_EA_STD__preserves_unmarked_language\nhide_fact F_DPDA_EA_STD__enforces_accessible\nhide_fact F_DPDA_EA_STD__preserves_epdaH_no_livelocks_from_marking_states\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_12_08_02/FUNCTION__DPDA_EA_STD__DPDA_ENFORCE_ACCESSIBLE_STD.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.30259327751118414}}
{"text": "theory Numerical_Example\nimports\n  Environment_Executable\n  Test_Code_Generation_Real_Approx\n  Overtaking_rules\nbegin                                                          \n \ntext \\<open>The lane consists of two lanelets with the same direction. All lane boundaries are\n  simply straight lanes.\\<close> \n  \ndefinition bound0 :: \"(real2 \\<times> real2) list\" where \"bound0 = [((-35,-2.25),(200,-2.251))]\"\ndefinition bound1 :: \"(real2 \\<times> real2) list\" where \"bound1 = [((-35, 2.25),(200, 2.251))]\"\ndefinition bound2 :: \"(real2 \\<times> real2) list\" where \"bound2 = [((-35, 6.75),(200, 6.751))]\"\n  \ntext \\<open>Interpreting the definition @{term \"lane2'\"} locale\\<close>  \n  \nglobal_interpretation l2': lane2' bound0 bound1 bound2\n  defines lane_detection = l2'.Lane.lane_detection and \n  in_lane = l2'.in_lane2  and \n  in_lane' = l2'.Lane.in_lane and \n  lines_inside0 = l2'.lane0.lines_inside and\n  lines_inside1 = l2'.lane1.lines_inside and\n  intersect_boundaries0 = l2'.lane0.intersect_boundaries and\n  intersect_boundaries1 = l2'.lane1.intersect_boundaries and\n  intersect_right_boundary0 = l2'.lane0.intersect_right_boundary and\n  intersect_right_boundary1 = l2'.lane1.intersect_right_boundary and  \n  intersect_left_boundary0 = l2'.lane0.intersect_left_boundary and \n  intersect_left_boundary1 = l2'.lane1.intersect_left_boundary and   \n  rectangle_inside0 = l2'.lane0.rectangle_inside and\n  rectangle_inside1 = l2'.lane1.rectangle_inside and\n  lane_boundaries_touched = l2'.Lane.lane_boundaries_touched and\n  point_in_drivable_area0 = l2'.lane0.point_in_drivable_area and\n  point_in_drivable_area1 = l2'.lane1.point_in_drivable_area and\n  direction_right0 = l2'.lane0.direction_right and\n  direction_right1 = l2'.lane1.direction_right and\n  rectangle_intersect0 = l2'.bound0.rectangle_intersect and \n  rectangle_intersect1 = l2'.bound1.rectangle_intersect and \n  rectangle_intersect2 = l2'.bound2.rectangle_intersect and \n  vertices_inside0 = l2'.lane0.vertices_inside and\n  lane_boundaries_touched2 = l2'.lane_boundaries_touched2 and\n  vertices_inside1 = l2'.lane1.vertices_inside and \n  initial_lane = l2'.Lane.initial_lane and \n  start_inc_lane = l2'.Lane.start_inc_lane and \n  finish_inc_lane = l2'.Lane.finish_inc_lane and\n  increase_lane = l2'.Lane.increase_lane and \n  decrease_lane = l2'.Lane.decrease_lane and\n  start_dec_lane = l2'.Lane.start_dec_lane and\n  finish_dec_lane = l2'.Lane.finish_dec_lane and \n  overtaking = l2'.Lane.overtaking and \n  overtaking_trace = l2'.Lane.overtaking_trace and\n  fast_lane_trace = l2'.Lane.fast_lane_trace and\n  merging_trace = l2'.Lane.merging_trace and\n  original_lane_trace = l2'.Lane.original_lane_trace and\n  time_points_to_ov_bools = l2'.Lane.time_points_to_ov_bools and\n  time_points_to_fl_bools = l2'.Lane.time_points_to_fl_bools and\n  time_points_to_merge_bools = l2'.Lane.time_points_to_merge_bools and \n  time_points_to_ori_bools = l2'.Lane.time_points_to_ori_bools and\n  overtaking_checker = l2'.Lane.overtaking_checker and \n  onfastlane_checker = l2'.Lane.onfastlane_checker and \n  merging_checker = l2'.Lane.merging_checker and \n  original_lane_checker = l2'.Lane.original_lane_checker and \n  sd_rear_checker = l2'.Lane.sd_rear_checker and \n  sd_rear_checker' = l2'.Lane.sd_rear_checker' and \n  sd_rears = l2'.Lane.sd_rears and \n  sd_rear = l2'.Lane.sd_rear and  \n  sd_rear' = l2'.Lane.sd_rear' and\n  sd_raw_state = l2'.Lane.sd_raw_state and\n  vehicles_behind = l2'.Lane.vehicles_behind and \n  trim_vehicles_same_lane = l2'.Lane.trim_vehicles_same_lane and \n  safe_to_return_trace = l2'.Lane.safe_to_return_trace and \n  safe_to_return_checker = l2'.Lane.safe_to_return_checker and \n  closest_vehicles_infront_idx = l2'.Lane.closest_vehicles_infront_idx and \n  vehicles_infront = l2'.Lane.vehicles_infront and \n  sd_raw_state_list' = l2'.Lane.sd_raw_state_list' and \n  sd_raw_state_list = l2'.Lane.sd_raw_state_list\n  by (unfold_locales) (eval+)  \n    \n\n\nlemma [code]: \"finish_dec_lane uu i num =\n  (case i of\n    0 \\<Rightarrow> None\n  | Suc v \\<Rightarrow>\n    case uu of\n      [] \\<Rightarrow> None\n   | (rect # rects) \\<Rightarrow>\n  (case lane_detection rect of Outside \\<Rightarrow> None\n   | Lane n \\<Rightarrow> if n = Suc v - 1 then Some (num, rects) else None\n   | Boundaries ns \\<Rightarrow>\n       if tl ns = [] \\<and> hd ns = Suc v\n       then finish_dec_lane rects (Suc v) (num + 1) else None))\"\n  by (auto split: nat.splits list.splits)\n        \ntext \\<open>Preparing the trace\\<close>\n  \ndefinition xpos :: \"real list\" where\n\"xpos = \n[\n         0,    1.6657,    3.3299,    4.9924,    6.6525,    8.3097,    9.9629,   11.6121,   13.2576,   14.8995,   16.5373,   18.1708,   19.7999,   21.4245,   23.0449,   24.6612,\n   26.2739,   27.8833,   29.4899,   31.0942,   32.6956,   34.2943,   35.8899,   37.4826,   39.0721,   40.6585,   42.2417,   43.8217,   45.3985,   46.9722,   48.5428,   50.1104,\n   51.6749,   53.2366,   54.7955,   56.3516,   57.9051,   59.4560,   61.0044,   62.5505,   64.0943,   65.6359,   67.1755,   68.7131,   70.2490,   71.7831,   73.3156,   74.8467,\n   76.3764,   77.9050,   79.4326,   80.9593,   82.4852,   84.0106,   85.5356,   87.0603,   88.5850,   90.1098,   91.6349,   93.1606,   94.6869,   96.2141,   97.7425,   99.2722,\n  100.8035,  102.3365,  103.8716,  105.4097,  106.9516,  108.4977,  110.0486,  111.6043,  113.1649,  114.7304,  116.3007,  117.8756,  119.4551,  121.0392,  122.6280,  124.2215,\n  125.8199,  127.4233,  129.0319,  130.6458,  132.2650,  133.8893,  135.5186,  137.1525,  138.7910,  140.4335,  142.0797,  143.7293,  145.3821,  147.0375,  148.6949,  150.3541,\n  152.0148,  153.6768,  155.3399,  157.0040,  158.6687\n]\"  \n \ndefinition ypos :: \"real list\" where\n\"ypos = \n[\n   -0.0005,    0.0185,    0.0712,    0.1619,    0.2923,    0.4609,    0.6655,    0.9007,    1.1607,    1.4384,    1.7260,    2.0161,    2.3057,    2.5874,    2.8549,    3.1037,\n    3.3271,    3.5250,    3.6917,    3.8293,    3.9450,    4.0410,    4.1199,    4.1843,    4.2365,    4.2785,    4.3123,    4.3393,    4.3608,    4.3780,    4.3916,    4.4023,\n    4.4109,    4.4177,    4.4230,    4.4272,    4.4306,    4.4332,    4.4353,    4.4369,    4.4382,    4.4392,    4.4400,    4.4406,    4.4411,    4.4415,    4.4418,    4.4420,\n    4.4422,    4.4424,    4.4425,    4.4425,    4.4426,    4.4426,    4.4427,    4.4427,    4.4427,    4.4427,    4.4427,    4.4427,    4.4427,    4.4427,    4.4427,    4.4427,\n    4.4427,    4.4426,    4.4256,    4.3786,    4.2998,    4.1888,    4.0469,    3.8764,    3.6807,    3.4639,    3.2304,    2.9854,    2.7336,    2.4800,    2.2291,    1.9851,\n    1.7516,    1.5314,    1.3270,    1.1397,    0.9706,    0.8200,    0.6875,    0.5725,    0.4738,    0.3901,    0.3198,    0.2614,    0.2132,    0.1738,    0.1416,    0.1154,\n    0.0942,    0.0769,    0.0629,    0.0513,    0.0419\n]\"\n\ndefinition oris :: \"real list\" where\n\"oris = \n[\n         0,    0.0102,    0.0244,    0.0425,    0.0625,    0.0830,    0.1036,    0.1220,    0.1383,    0.1511,    0.1603,    0.1656,    0.1689,    0.1678,    0.1633,    0.1557,\n    0.1442,    0.1313,    0.1154,    0.1010,    0.0872,    0.0743,    0.0627,    0.0525,    0.0436,    0.0360,    0.0295,    0.0241,    0.0196,    0.0159,    0.0129,    0.0104,\n    0.0083,    0.0067,    0.0053,    0.0043,    0.0034,    0.0027,    0.0022,    0.0017,    0.0014,    0.0011,    0.0009,    0.0007,    0.0005,    0.0004,    0.0003,    0.0003,\n    0.0002,    0.0002,    0.0001,    0.0001,    0.0001,    0.0001,    0.0001,    0.0000,    0.0000,    0.0000,    0.0000,    0.0000,    0.0000,    0.0000,    0.0000,    0.0000,\n    0.0000,    0.0000,   -0.0099,   -0.0235,   -0.0397,   -0.0572,   -0.0749,   -0.0920,   -0.1078,   -0.1217,   -0.1332,   -0.1421,   -0.1483,   -0.1516,   -0.1522,   -0.1502,\n   -0.1459,   -0.1397,   -0.1318,   -0.1226,   -0.1125,   -0.1020,   -0.0913,   -0.0807,   -0.0706,   -0.0611,   -0.0523,   -0.0444,   -0.0373,   -0.0312,   -0.0259,   -0.0214,\n   -0.0176,   -0.0145,   -0.0119,   -0.0098,   -0.0081\n]\"\n\ndefinition lengths :: \"real list\" where\n  \"lengths = replicate 101 4.8\" \n  \ndefinition widths :: \"real list\" where\n  \"widths = replicate 101 2\" \n    \ndefinition veloxs :: \"real list\" where\n\"veloxs =\n[\n   16.6667,   16.6596,   16.6519,   16.6401,   16.6242,   16.6017,   16.5709,   16.5368,   16.5027,   16.4650,   16.4239,   16.3803,   16.3360,   16.2915,   16.2484,   16.2078,\n   16.1709,   16.1375,   16.1085,   16.0809,   16.0528,   16.0239,   15.9940,   15.9632,   15.9316,   15.8995,   15.8671,   15.8347,   15.8024,   15.7704,   15.7388,   15.7078,\n   15.6774,   15.6477,   15.6187,   15.5906,   15.5632,   15.5367,   15.5112,   15.4866,   15.4629,   15.4403,   15.4188,   15.3983,   15.3790,   15.3608,   15.3439,   15.3282,\n   15.3138,   15.3008,   15.2891,   15.2789,   15.2702,   15.2630,   15.2575,   15.2535,   15.2513,   15.2509,   15.2523,   15.2555,   15.2607,   15.2679,   15.2772,   15.2885,\n   15.3021,   15.3179,   15.3382,   15.3655,   15.3995,   15.4391,   15.4825,   15.5282,   15.5746,   15.6209,   15.6664,   15.7111,   15.7553,   15.7998,   15.8450,   15.8911,\n   15.9386,   15.9879,   16.0389,   16.0911,   16.1433,   16.1951,   16.2455,   16.2940,   16.3402,   16.3829,   16.4226,   16.4594,   16.4932,   16.5215,   16.5460,   16.5672,\n   16.5856,   16.6016,   16.6152,   16.6264,   16.6352\n]\"  \n  \ndefinition veloys :: \"real list\" where\n\"veloys =\n[\n         0,    0.1692,    0.4065,    0.7073,    1.0404,    1.3816,    1.7223,    2.0276,    2.2965,    2.5071,    2.6553,    2.7370,    2.7850,    2.7597,    2.6766,    2.5442,\n    2.3487,    2.1312,    1.8666,    1.6294,    1.4026,    1.1932,    1.0049,    0.8390,    0.6954,    0.5726,    0.4690,    0.3822,    0.3103,    0.2509,    0.2023,    0.1627,\n    0.1305,    0.1045,    0.0835,    0.0667,    0.0531,    0.0423,    0.0337,    0.0268,    0.0213,    0.0169,    0.0134,    0.0106,    0.0084,    0.0067,    0.0053,    0.0042,\n    0.0033,    0.0026,    0.0021,    0.0017,    0.0013,    0.0010,    0.0008,    0.0007,    0.0005,    0.0004,    0.0003,    0.0003,    0.0002,    0.0002,    0.0001,    0.0001,\n    0.0001,    0.0001,   -0.1513,   -0.3615,   -0.6114,   -0.8834,   -1.1619,   -1.4332,   -1.6858,   -1.9103,   -2.0994,   -2.2480,   -2.3530,   -2.4134,   -2.4300,   -2.4051,\n   -2.3427,   -2.2476,   -2.1255,   -1.9823,   -1.8242,   -1.6573,   -1.4870,   -1.3183,   -1.1554,   -1.0018,   -0.8597,   -0.7309,   -0.6162,   -0.5156,   -0.4288,   -0.3549,\n   -0.2927,   -0.2409,   -0.1981,   -0.1630,   -0.1343\n]\"\n\ndefinition velos :: \"real2 list\" where\n  \"velos = zip veloxs veloys\"\n\ndefinition max_decelxs :: \"real list\" where\n\"max_decelxs =\n[\n   -8.0000,   -7.9996,   -7.9976,   -7.9928,   -7.9844,   -7.9724,   -7.9571,   -7.9405,   -7.9236,   -7.9088,   -7.8975,   -7.8906,   -7.8862,   -7.8876,   -7.8936,   -7.9032,\n   -7.9169,   -7.9311,   -7.9468,   -7.9592,   -7.9696,   -7.9779,   -7.9843,   -7.9890,   -7.9924,   -7.9948,   -7.9965,   -7.9977,   -7.9985,   -7.9990,   -7.9993,   -7.9996,\n   -7.9997,   -7.9998,   -7.9999,   -7.9999,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,\n   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,   -8.0000,\n   -8.0000,   -8.0000,   -7.9996,   -7.9978,   -7.9937,   -7.9869,   -7.9776,   -7.9661,   -7.9535,   -7.9408,   -7.9291,   -7.9193,   -7.9122,   -7.9083,   -7.9076,   -7.9099,\n   -7.9150,   -7.9221,   -7.9307,   -7.9400,   -7.9494,   -7.9584,   -7.9667,   -7.9739,   -7.9801,   -7.9851,   -7.9891,   -7.9921,   -7.9944,   -7.9961,   -7.9973,   -7.9982,\n   -7.9988,   -7.9992,   -7.9994,   -7.9996,   -7.9997\n]\"\n\ndefinition max_decelys :: \"real list\" where\n\"max_decelys =\n[\n         0,   -0.0812,   -0.1952,   -0.3397,   -0.4997,   -0.6635,   -0.8270,   -0.9736,   -1.1026,   -1.2043,   -1.2768,   -1.3184,   -1.3445,   -1.3361,   -1.3003,   -1.2406,\n   -1.1499,   -1.0474,   -0.9209,   -0.8065,   -0.6963,   -0.5941,   -0.5016,   -0.4199,   -0.3488,   -0.2879,   -0.2363,   -0.1931,   -0.1570,   -0.1273,   -0.1028,   -0.0829,\n   -0.0666,   -0.0534,   -0.0428,   -0.0342,   -0.0273,   -0.0218,   -0.0174,   -0.0138,   -0.0110,   -0.0087,   -0.0070,   -0.0055,   -0.0044,   -0.0035,   -0.0028,   -0.0022,\n   -0.0017,   -0.0014,   -0.0011,   -0.0009,   -0.0007,   -0.0005,   -0.0004,   -0.0003,   -0.0003,   -0.0002,   -0.0002,   -0.0001,   -0.0001,   -0.0001,   -0.0001,   -0.0000,\n   -0.0000,   -0.0000,    0.0789,    0.1882,    0.3174,    0.4570,    0.5987,    0.7353,    0.8609,    0.9711,    1.0626,    1.1331,    1.1817,    1.2080,    1.2127,    1.1972,\n    1.1634,    1.1137,    1.0510,    0.9782,    0.8983,    0.8144,    0.7292,    0.6451,    0.5643,    0.4883,    0.4182,    0.3549,    0.2987,    0.2496,    0.2073,    0.1713,\n    0.1411,    0.1161,    0.0954,    0.0784,    0.0646\n]\"\n\ndefinition max_decels :: \"real2 list\" where\n  \"max_decels = zip max_decelxs max_decelys\"\n  \nfun mk_rectangles :: \"real list \\<Rightarrow> real list \\<Rightarrow> real list \\<Rightarrow> real list \\<Rightarrow> real list \\<Rightarrow> rectangle list\" where\n  \"mk_rectangles    []       []      []        []       []    = []\" |\n  \"mk_rectangles (x # xs) (y # ys) (p # ps) (l # ls) (w # ws) = \\<lparr>Xcoord = x, Ycoord = y, Orient = p, Length = l, Width = w\\<rparr> # mk_rectangles xs ys ps ls ws\"\n  \ndefinition rectangles where \"rectangles = mk_rectangles xpos ypos oris lengths widths\"  \n  \ndefinition \"test\" where \"test \\<equiv> \\<lambda>rect. start_inc_lane rect 0 0\"  \n   \ndeclare [[ML_print_depth=1000]] \n  \nML\\<open>\nval rectangles = @{code rectangles};\nval test_rectangle = nth rectangles 13;\nval test_rectangle2 = nth rectangles 84;\nval get_vertices = @{code get_vertices_zero};\nval tr_gv = get_vertices test_rectangle2;\nval transpose = @{code List.transpose};\nval test_rectangle3 = nth rectangles 8;\nval get_vertices_rot = @{code get_vertices_rotated_translated};\nval rotated3 =  get_vertices_rot test_rectangle3;\nval in_lane = @{code in_lane};\nval test_in_lane = in_lane test_rectangle\nval rectangle_intersect1 = @{code rectangle_intersect1};\nval test_intersect1 = rectangle_intersect1 test_rectangle;\nval get_lines = @{code get_lines};\nval test_get_lines = get_lines test_rectangle;\nval first_line = nth test_get_lines 0;\nval rectangle_inside1 = @{code rectangle_inside1};\nval test_rectin1 = map rectangle_inside1 rectangles;\nval vertices_inside1 = @{code vertices_inside1};\nval test_inside1 = map vertices_inside1 rectangles;\nval lane_detection = @{code lane_detection};\nval test_lane_detection = map lane_detection rectangles;\nval start_inc_lane = @{code test};\nval test_start_inc_lane = start_inc_lane rectangles ;\nval increase_lane = @{code increase_lane};\nval test_overtaking = increase_lane rectangles;\nval decrease_lane = @{code decrease_lane}\nval overtaking = @{code overtaking}\nval test_overtaking = overtaking rectangles;\nval overtaking_trace = @{code overtaking_trace};\nval test_overtaking_trace = overtaking_trace rectangles; \nval fast_lane_trace = @{code fast_lane_trace}\nval test_fast_lane_trace = fast_lane_trace rectangles;\nval merging_trace = @{code merging_trace}\nval test_merging_trace = merging_trace rectangles;\nval original_lane_trace = @{code original_lane_trace};\nval test_original_lane_trace = original_lane_trace rectangles;\n\\<close>  \n   \nfun mk_raw_state :: \"real list \\<Rightarrow> real list \\<Rightarrow> real list \\<Rightarrow> real list \\<Rightarrow> real list \\<Rightarrow> real2 list \\<Rightarrow> real2 list \\<Rightarrow> raw_state list\" where\n  \"mk_raw_state    []       []      []        []       []       []       []    = []\" |\n  \"mk_raw_state (x # xs) (y # ys) (p # ps) (l # ls) (w # ws) (v # vs) (a # as) = \\<lparr>Xcoord = x, Ycoord = y, Orient = p, Length = l, Width = w, velocity = v, acceleration = a\\<rparr> # mk_raw_state xs ys ps ls ws vs as\"\n  \ndefinition raw_states where \"raw_states = mk_raw_state xpos ypos oris lengths widths velos max_decels\"\ndefinition ego_run where \"ego_run = (Motorised, raw_states)\"\n  \ntext \\<open>Trace for vehicle being overtaken. The length of the trace is equivalent to that of \nego vehicle.\\<close>   \n  \nlemma \"length veloxs = 101\" unfolding veloxs_def by auto\n\ntext \\<open>The other vehicle is positioned at @{term \"(19,0)\"} initially. The rest is calculated by \nsimply using @{term \"s + v * t\"}. Each time point is @{term \"0.1\"} s.\\<close>   \n  \ndefinition xpos_one :: \"real list\" where\n  \"xpos_one = 19 # [19 + 11.1 * 0.1 * t . t \\<leftarrow> [1..100]]\"  \n  \ndefinition ypos_one :: \"real list\" where\n  \"ypos_one = replicate 101 0\"\n  \ndefinition oris_one :: \"real list\" where\n  \"oris_one = replicate 101 0\"  \n  \ndefinition rectangles_other_one where \"rectangles_other_one \\<equiv> mk_rectangles xpos_one ypos_one oris_one lengths widths\"\n  \ntext \\<open>The vehicle being overtaken is assumed to maintain its current speed. It is not allowed \nto accelerate when the vehicle is being overtaken.\\<close>\n    \ndefinition veloxs_one :: \"real list\" where\n  \"veloxs_one = replicate 101 11.1\"\n  \ndefinition veloys_one :: \"real list\" where\n  \"veloys_one = replicate 101 0\"\n  \ndefinition velos_one :: \"real2 list\" where\n  \"velos_one = zip veloxs_one veloys_one\"  \n  \ndefinition reaction_time :: \"real\" where\n  \"reaction_time = 0.5\"  \n  \ndefinition raw_states_other where \"raw_states_other = mk_raw_state xpos_one ypos_one oris_one lengths widths velos_one max_decels\" \ndefinition other_one_run where \"other_one_run = (Motorised, raw_states_other)\"\n  \ntext \\<open>Trace for the second vehicle.\\<close>  \n  \ndefinition xpos_two :: \"real list\" where\n  \"xpos_two = -25 # [-25 + 16.7 * 0.1 * t. t \\<leftarrow> [1..100]]\"\n\nlemma \"length xpos_two = 101\" unfolding xpos_two_def by eval\n    \ndefinition ypos_two :: \"real list\" where\n  \"ypos_two = replicate 101 4.5\"\n  \ndefinition oris_two :: \"real list\" where\n  \"oris_two = replicate 101 0\"\n\ndefinition rectangles_other_two where \"rectangles_other_two \\<equiv> mk_rectangles xpos_two ypos_two oris_two lengths widths\"\n  \ndefinition veloxs_two :: \"real list\" where\n  \"veloxs_two = replicate 101 16.7\"\n\ndefinition veloys_two :: \"real list\" where\n  \"veloys_two = replicate 101 0\"  \n  \ndefinition velos_two :: \"real2 list\" where\n  \"velos_two = zip veloxs_two veloys_two\"  \n  \ndefinition raw_states_other_two where \"raw_states_other_two \\<equiv> mk_raw_state xpos_two ypos_two oris_two lengths widths velos_two max_decels\"\ndefinition other_two_run where \"other_two_run \\<equiv> (Motorised, raw_states_other_two)\"\ndefinition black_boxes :: black_boxes where \"black_boxes = (ego_run, [other_one_run, other_two_run])\"\n    \ndefinition toc where \"toc \\<equiv> overtaking_checker black_boxes\"  \ndefinition tfl where \"tfl \\<equiv> onfastlane_checker black_boxes\"\ndefinition tm where \"tm \\<equiv> merging_checker black_boxes\"\ndefinition tol where \"tol \\<equiv> original_lane_checker black_boxes\"\ndefinition tsd where \"tsd \\<equiv> sd_rear_checker black_boxes reaction_time\"  \ndefinition tsr where \"tsr \\<equiv> safe_to_return_checker black_boxes reaction_time\"  \n \nvalue [code] \"toc\"   \nvalue [code] \"tfl\"  \nvalue [code] \"tm\"  \nvalue [code] \"tol\"  \nvalue [code] \"tsd\" \nvalue [code] \"List.enumerate 0 (zip tol tsd)\"  \n    \ndefinition eight_list where \"eight_list \\<equiv> nth_list 73 (map snd (snd black_boxes))\"  \n  \nML \\<open>\nval test = @{code sd_rear_checker'} @{code black_boxes} @{code reaction_time};\nval other_runs_t = @{code List.transpose} (map snd (snd @{code black_boxes}));\nval ego_run = snd (fst @{code black_boxes});\nval test = @{code sd_rears} other_runs_t ego_run @{code reaction_time};\nval eight_list = @{code eight_list};\nval eight_ego = List.nth (ego_run, 73);\nval test2 = @{code sd_rear} eight_list eight_ego @{code reaction_time};\nval veh_behind = @{code vehicles_behind} eight_list eight_ego;\nval sd_rear_prime = @{code sd_rear'} veh_behind eight_ego @{code reaction_time};\n(* val sd_raw_state = @{code sd_raw_state} (hd veh_behind) eight_ego @{code reaction_time};\n *)\n\\<close>\n  \nvalue [code] \"tsr\"  \n  \ndefinition temp where \"temp or so \\<equiv>  [f or. f \\<leftarrow> (map nth_list so)]\"\ndefinition temp2 where \"temp2 bb so \\<equiv> [f (snd (fst bb)) . f \\<leftarrow> (map (\\<lambda>n xs. xs ! n) so)]\"  \ndefinition temp3 where \"temp3 or ovp \\<equiv> [f or. f \\<leftarrow> (map (\\<lambda>n xss. xss !n) ovp)]\"    \nML \\<open>\nval ego_rects = @{code bb_to_rects} @{code black_boxes};\nval ov_nums = @{code overtaking} ego_rects;\nval start_ovs = map fst ov_nums;\nval other_runs = map snd (snd @{code black_boxes});\nval choppeds = @{code temp} other_runs start_ovs; \nval ego_chopped = @{code temp2} @{code black_boxes} start_ovs;\nval overtaken_vehs = map ((fn f => fn p => f (fst p) (snd p)) @{code closest_vehicles_infront_idx})\n                                                              (@{code zip} (@{code List.transpose} choppeds) ego_chopped);\nval overtaken_vehs' = @{code take_some} overtaken_vehs;\nval relevant_trace = @{code temp3} other_runs overtaken_vehs';\nval result = @{code sd_raw_state_list} relevant_trace (snd (fst @{code black_boxes})) @{code reaction_time}\nval result2 = @{code List.enumerate} @{code \"0 :: nat\"} (@{code nth} result @{code \"0 :: nat\"});\nList.nth(snd (fst @{code black_boxes}), 36);\nList.nth(List.nth (relevant_trace, 0), 36);\n\\<close>  \n        \nfun combine_to_trace :: \"tr_atom set list list \\<Rightarrow> tr_atom set list \\<Rightarrow> tr_atom set list\" where\n  \"combine_to_trace [] res = res\" | \n  \"combine_to_trace (x # xs) res = combine_to_trace xs (map (\\<lambda>x. union (fst x) (snd x)) (zip x res))\"\n\ndefinition empty_trace :: \"tr_atom set list\" where \"empty_trace \\<equiv> replicate 101 {}\"\ndefinition complete_trace where \"complete_trace \\<equiv> combine_to_trace [toc, tfl, tm, tol, tsd, tsr] empty_trace\"\n  \ndefinition semantics_ltlf_tr :: \"tr_atom set list \\<Rightarrow> tr_atom ltlf \\<Rightarrow> bool\" where\n  \"semantics_ltlf_tr \\<equiv> semantics_ltlf\"\n    \nML \\<open>\nval monitor = @{code monitor_tr};\nval monitor2 = @{code semantics_ltlf_tr};\nval comp_trace = @{code complete_trace};   \nval phi1 = @{code \\<Phi>1}\nval test_phi1 = monitor comp_trace phi1;\nval test_phi1' = monitor2 comp_trace phi1;\nval phi3_weaker = @{code \\<Phi>3_weaker};\nval test_phi3_weaker = monitor comp_trace phi3_weaker;\nval test_phi3'_weaker = monitor2 comp_trace phi3_weaker;\nval phi3 = @{code \\<Phi>3};\nval test_phi3 = monitor comp_trace phi3;\nval phi4 = @{code \\<Phi>4};\nval test_phi4 = monitor2 comp_trace phi4;\n\\<close>  \n\n  \n    \n ", "meta": {"author": "rizaldialbert", "repo": "overtaking", "sha": "0e76426d75f791635cd9e23b8e07669b7ce61a81", "save_path": "github-repos/isabelle/rizaldialbert-overtaking", "path": "github-repos/isabelle/rizaldialbert-overtaking/overtaking-0e76426d75f791635cd9e23b8e07669b7ce61a81/Numerical_Example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6619228758499941, "lm_q2_score": 0.4571367168274948, "lm_q1q2_score": 0.30258925025907973}}
{"text": "theory LaunchburyCombined\nimports Terms Heap \"FMap-Heap\" \"FMap-Nominal\" Flag\nbegin\n\nlemma fdom_fmap_of_conv_heapVars: \"fdom (fmap_of (asToHeap as)) = heapVars (asToHeap as)\"\n  by (metis dom_map_of_conv_heapVars fdom.rep_eq fmap_of.rep_eq)\n\nlemma set_bn_to_atom_fdom: \"set (bn as) = atom ` fdom (fmap_of (asToHeap as))\"\n  by (metis fdom_fmap_of_conv_heapVars set_bn_to_atom_heapVars)\n\nlemma fresh_at_base_list: \"atom (x::'a::at_base) \\<sharp> l \\<longleftrightarrow> x \\<notin> set l\"\n  by (metis List.finite_set fresh_finite_set_at_base fresh_set)\n\nlemma fresh_star_list_distinct:  \"atom ` (S::var set) \\<sharp>* (l::var list) \\<longleftrightarrow> (set l \\<inter> S = {})\"\n  by (auto simp add: fresh_star_def set_not_fresh fresh_at_base_list dest:bspec)\n\nsubsubsection {* The natural semantics, all variants at once*}\n\ninductive\n  reds :: \"Heap \\<Rightarrow> exp \\<Rightarrow> Flag \\<Rightarrow> Flag \\<Rightarrow> var list \\<Rightarrow> Heap \\<Rightarrow> exp \\<Rightarrow> bool\"\n  (\"(4_ : _/ \\<Down>\\<^sup>_\\<^sup>_\\<^bsub>_\\<^esub>/ _ : _)\" [50,50,50,50,50,50] 50)\nwhere\n  Lambda: \"atom x \\<sharp> (\\<Gamma>, L)\n    \\<Longrightarrow> \\<Gamma> : Lam [x]. e \\<Down>\\<^sup>i\\<^sup>b\\<^bsub>L\\<^esub> \\<Gamma> : Lam [x]. e\"\n | Application: \"\\<lbrakk>\n    atom y \\<sharp> (\\<Gamma>,e,x,L,\\<Delta>,\\<Theta>,z) ;\n    \\<Gamma> : e \\<Down>\\<^sup>\\<times>\\<^sup>b\\<^bsub>x#L\\<^esub> \\<Delta> : (Lam [y]. e');\n    \\<Delta> : e'[y ::= x] \\<Down>\\<^sup>\\<times>\\<^sup>b\\<^bsub>L\\<^esub> \\<Theta> : z\n  \\<rbrakk>  \\<Longrightarrow>\n    \\<Gamma> : App e x \\<Down>\\<^sup>\\<times>\\<^sup>b\\<^bsub>L\\<^esub> \\<Theta> : z\" \n | ApplicationInd: \"\\<lbrakk>\n    atom y \\<sharp> (\\<Gamma>,e,x,L);\n    \\<Gamma> : e \\<Down>\\<^sup>\\<surd>\\<^sup>u\\<^bsub>y#x#L\\<^esub> \\<Delta> : (Lam [y]. e');\n    \\<Delta>(y f\\<mapsto> Var x) : e' \\<Down>\\<^sup>\\<surd>\\<^sup>u \\<^bsub>L\\<^esub> \\<Theta> : z\n  \\<rbrakk>  \\<Longrightarrow>\n    \\<Gamma> : App e x \\<Down>\\<^sup>\\<surd>\\<^sup>u\\<^bsub>L\\<^esub> \\<Theta> : z\" \n | Variable: \"\\<lbrakk>\n    lookup \\<Gamma> x = Some e; fmap_delete x \\<Gamma> : e \\<Down>\\<^sup>i\\<^sup>\\<surd>\\<^bsub>x#L\\<^esub> \\<Delta> : z\n  \\<rbrakk> \\<Longrightarrow>\n    \\<Gamma> : Var x \\<Down>\\<^sup>i\\<^sup>\\<surd>\\<^bsub>L\\<^esub> \\<Delta>(x f\\<mapsto> z) : z\"\n | VariableNoBH: \"\\<lbrakk>\n    lookup \\<Gamma> x = Some e;  \\<Gamma> : e \\<Down>\\<^sup>i\\<^sup>\\<times>\\<^bsub>x#L\\<^esub> \\<Delta> : z\n  \\<rbrakk> \\<Longrightarrow>\n    \\<Gamma> : Var x \\<Down>\\<^sup>i\\<^sup>\\<times>\\<^bsub>L\\<^esub> \\<Delta>(x f\\<mapsto> z) : z\"\n | Let: \"\\<lbrakk>\n    set (bn as) \\<sharp>* (\\<Gamma>, L);\n    \\<Gamma> f++ (fmap_of (asToHeap as)) : body \\<Down>\\<^sup>i\\<^sup>u\\<^bsub>L\\<^esub> \\<Delta> : z\n  \\<rbrakk> \\<Longrightarrow>\n    \\<Gamma> : Let as body \\<Down>\\<^sup>i\\<^sup>u\\<^bsub>L\\<^esub> \\<Delta> : z\"\n\nequivariance reds\n\nnominal_inductive reds\navoids Lambda: \"x\" | Application: \"y\"\napply (auto simp add: fresh_star_def fresh_Pair pure_fresh)\ndone\n\nlemma LambdaI: \"\\<Gamma> : Lam [x]. e \\<Down>\\<^sup>i\\<^sup>u\\<^bsub>L\\<^esub> \\<Gamma> : Lam [x]. e\"\nproof-\n  obtain x' :: var where \"atom x' \\<sharp> (\\<Gamma>, L, e)\"  by (rule obtain_fresh)\n  hence \"atom x' \\<sharp> (\\<Gamma>, L)\" and [simp]:\"atom x' \\<sharp> e\" by (simp_all add: fresh_Pair)\n\n  \n  have \"(x \\<leftrightarrow> x') \\<bullet> Lam [x]. e = Lam [x]. e\"\n    by (rule flip_fresh_fresh) simp+\n  moreover\n  have \"(x \\<leftrightarrow> x') \\<bullet> Lam [x]. e = Lam [x']. ((x \\<leftrightarrow> x') \\<bullet> e)\" by simp\n  moreover\n  from `atom x' \\<sharp> (\\<Gamma>, L)`\n  have \"\\<Gamma> : Lam [x']. ((x \\<leftrightarrow> x') \\<bullet> e) \\<Down>\\<^sup>i\\<^sup>u\\<^bsub>L\\<^esub> \\<Gamma> : Lam [x']. ((x \\<leftrightarrow> x') \\<bullet> e)\"\n    by (rule Lambda)\n  ultimately\n  show ?thesis by metis\nqed\n\nsubsubsection {* Specializations*}\n\nabbreviation\n  reds_NS :: \"Heap \\<Rightarrow> exp \\<Rightarrow> var list \\<Rightarrow> Heap \\<Rightarrow> exp \\<Rightarrow> bool\" (\"_ : _ \\<Down>\\<^bsub>_\\<^esub> _ : _\" [50,50,50,50] 50)\nwhere\n  \"\\<Gamma> : e \\<Down>\\<^bsub>L\\<^esub> \\<Delta> : z \\<equiv> \\<Gamma> : e \\<Down>\\<^sup>\\<times>\\<^sup>\\<surd>\\<^bsub>L\\<^esub> \\<Delta> : z\"\n\nlemma eval_test_NS:\n  \"f\\<emptyset> : (Let (ACons x (Lam [y]. Var y) ANil) (Var x)) \\<Down>\\<^bsub>[]\\<^esub> f\\<emptyset>(x f\\<mapsto> Lam [y]. Var y) : (Lam [y]. Var y)\"\n  by (auto intro!: LambdaI Variable Let simp add: fresh_Pair fresh_Cons fresh_Nil fresh_star_def)\n  \n\nlemma eval_test2_NS:\n  \"y \\<noteq> x \\<Longrightarrow> n \\<noteq> y \\<Longrightarrow> n \\<noteq> x \\<Longrightarrow>\n  f\\<emptyset> : (Let (ACons x (Lam [y]. Var y) ANil) (App (Var x) x)) \\<Down>\\<^bsub>[]\\<^esub> f\\<emptyset>(x f\\<mapsto> Lam [y]. Var y) : Lam [y]. Var y\"\n  by (auto intro!: LambdaI Application Variable Let simp add: fresh_Pair fresh_at_base fresh_Cons fresh_Nil fresh_star_def pure_fresh fresh_fmap_upd_eq)\n\ntext {* This lemma shows that variables not free in the initial expression can still become \nnew names on the heap. *}\nlemma eval_test3_NS:\n  \"y \\<noteq> x \\<Longrightarrow> f\\<emptyset> : (App (Lam [y]. let x be Var x in (Lam [z].Var z))) x \\<Down>\\<^bsub>[]\\<^esub> f\\<emptyset>(x f\\<mapsto> Var x) : Lam [z]. Var z\"\napply (rule Application[where y = y, rotated])\n  apply (rule LambdaI)\n apply (simp add: subst_fresh_noop fresh_at_base)\n apply (rule Let)\n   apply (simp add: fresh_star_Pair fresh_star_def fresh_Nil)\n  apply simp\n apply (rule LambdaI)\n apply (simp add: fresh_Pair fresh_Nil fresh_Cons fresh_at_base fresh_fmap_upd_eq)\ndone\n\nsubsubsection {* Properties of the semantics *}\n\ntext {*\nHeap entries are never removed.\n*}\n\nlemma reds_doesnt_forget:\n  \"\\<Gamma> : e \\<Down>\\<^sup>i\\<^sup>b\\<^bsub>L\\<^esub> \\<Delta> : z \\<Longrightarrow> fdom \\<Gamma> \\<subseteq> fdom \\<Delta>\"\n  by(induct rule: reds.induct) auto\n\ntext {*\nLive variables are not added to the heap.\n*}\n\nlemma reds_avoids_live:\n  \"\\<lbrakk> \\<Gamma> : e \\<Down>\\<^sup>i\\<^sup>b\\<^bsub>L\\<^esub> \\<Delta> : z;\n   x \\<in> set L;\n   x \\<notin> fdom \\<Gamma>\n  \\<rbrakk> \\<Longrightarrow> x \\<notin> fdom \\<Delta>\"\nproof(induction rule:reds.induct)\ncase (Lambda \\<Gamma> x e L) thus ?case by auto\nnext\ncase (Application y \\<Gamma> e x' L \\<Delta> z \\<Theta> u e')\n  thus ?case by (auto simp add: fresh_Pair dest: fresh_list_elem)\nnext\ncase (ApplicationInd y \\<Gamma> e x' L \\<Delta> z u e' \\<Theta>)\n  thus ?case by (auto simp add: fresh_Pair dest: fresh_list_elem)\nnext\ncase (Variable  x e \\<Gamma> L \\<Delta> z) thus ?case by auto\nnext\ncase (VariableNoBH  x e \\<Gamma> L \\<Delta> z) thus ?case by auto\nnext\ncase (Let as \\<Gamma> L body \\<Delta> z)\n  have \"x \\<notin> fdom \\<Gamma>\" by fact moreover\n  have \"set (bn as) \\<sharp>* L\" using `set (bn as) \\<sharp>* (\\<Gamma>, L)` by (simp add: fresh_star_Pair)\n  hence \"x \\<notin> fdom (fmap_of (asToHeap as))\"\n    using `x \\<in> set L`\n    apply (auto simp add: fdom_fmap_of_conv_heapVars set_bn_to_atom_fdom)\n    by (metis disjoint_iff_not_equal fresh_star_list_distinct)\n  ultimately\n  have\"x \\<notin> fdom (\\<Gamma> f++ fmap_of (asToHeap as))\" by auto\n  thus ?case\n    by (rule Let.IH[OF `x \\<in> set L`])\nqed\n\ntext {*\nFresh variables either stay fresh or are added to the heap.\n*}\n\nlemma reds_fresh:\" \\<lbrakk> \\<Gamma> : e \\<Down>\\<^sup>i\\<^sup>b\\<^bsub>L\\<^esub> \\<Delta> : z;\n   atom (x::var) \\<sharp> (\\<Gamma>, e)\n  \\<rbrakk> \\<Longrightarrow> atom x \\<sharp> (\\<Delta>, z) \\<or> x \\<in> (fdom \\<Delta> - set L)\"\nproof(induction rule: reds.induct)\ncase (Lambda \\<Gamma> x e) thus ?case by auto\nnext\ncase (Application y \\<Gamma> e x' L \\<Delta> \\<Theta> z u e')\n  hence \"atom x \\<sharp> (\\<Delta>, Lam [y]. e') \\<or> x \\<in> fdom \\<Delta> - set (x' # L)\" by (auto simp add: fresh_Pair)\n\n  thus ?case\n  proof\n    assume  \"atom x \\<sharp> (\\<Delta>, Lam [y]. e')\"\n    moreover\n    have \"atom x \\<sharp> e'[y ::= x']\" \n    proof(cases \"x = y\")\n    case False\n      hence \"atom x \\<sharp> e'\" using `atom x \\<sharp> (\\<Delta>, Lam [y]. e')`\n        by (auto simp add:fresh_Pair)\n      thus ?thesis using Application.prems\n        by (auto intro: subst_pres_fresh[rule_format] simp add: fresh_Pair)\n    next\n    case True\n      thus ?thesis using `atom x \\<sharp> (\\<Delta>, Lam [y]. e')` Application.prems\n        by (auto intro:subst_is_fresh simp add: fresh_Pair)\n    qed\n    ultimately\n    have \"atom x \\<sharp> (\\<Delta>, e'[y::=x'])\" by simp\n    thus ?thesis by (rule Application.IH(2))\n  next\n    assume \"x \\<in> fdom \\<Delta>  - set (x' # L)\"\n    thus ?thesis using reds_doesnt_forget[OF Application.hyps(3)] by auto\n  qed\nnext\ncase (ApplicationInd y \\<Gamma> e x' L u \\<Delta> e' \\<Theta> z)\n  hence \"atom x \\<sharp> (\\<Gamma>, e)\" by (simp add: fresh_Pair)\n  hence \"atom x \\<sharp> (\\<Delta>, Lam [y]. e') \\<or> x \\<in> fdom \\<Delta> - set (y # x' # L)\" \n    by (rule ApplicationInd.IH(1))\n  thus ?case\n  proof\n    assume  \"atom x \\<sharp> (\\<Delta>, Lam [y]. e')\"\n    show ?thesis\n    proof(cases \"x = y\")\n    case False\n      from ApplicationInd.prems `atom x \\<sharp> (\\<Delta>, Lam [y]. e')` False\n      have \"atom x \\<sharp> (\\<Delta>(y f\\<mapsto>  Var x') , e')\" by (simp add: fresh_Pair fresh_Cons fresh_fmap_upd_eq fresh_fmap_delete_subset)\n      thus ?thesis by (rule ApplicationInd.IH(2))\n    next\n    case True\n      hence \"x \\<in> fdom (\\<Delta>(y f\\<mapsto>  Var x'))\" by simp\n      hence \"x \\<in> fdom \\<Theta>\" by (rule set_mp[OF reds_doesnt_forget[OF ApplicationInd.hyps(3)]])\n      moreover\n      have \"atom x \\<sharp> L\" using True ApplicationInd by (simp add: fresh_Pair)\n      hence \"x \\<notin> set L\" by (metis fresh_list_elem not_self_fresh)\n      ultimately\n      show ?thesis by simp\n    qed\n  next\n    assume \"x \\<in> fdom \\<Delta>  - set (y # x' # L)\"\n    thus ?thesis using reds_doesnt_forget[OF ApplicationInd.hyps(3)] by auto\n  qed\nnext\n\ncase(Variable \\<Gamma> v e i L \\<Delta> z)\n  have \"atom x \\<sharp> \\<Gamma>\" and \"atom x \\<sharp> v\" using Variable.prems(1) by (auto simp add: fresh_Pair)\n  hence \"atom x \\<sharp> fmap_delete v \\<Gamma>\" and \"atom x \\<sharp> e\" using `lookup \\<Gamma> v = Some e`\n    apply (auto intro: fresh_fmap_delete_subset dest:fresh_list_elem)\n    by (metis fmap_upd_noop fresh_fmap_upd_eq lookup_fdom the.simps)\n  hence \"atom x \\<sharp> (fmap_delete v \\<Gamma>, e)\" by (simp add: fresh_Pair)\n  hence \"atom x \\<sharp> (\\<Delta>, z) \\<or> x \\<in> fdom \\<Delta> - set (v # L)\"  by (rule Variable.IH)\n  thus ?case using `atom x \\<sharp> e` `atom x \\<sharp> v`\n    by (auto simp add: fresh_Pair fresh_Cons fresh_at_base fresh_fmap_upd_eq fresh_fmap_delete_subset)\nnext\n\ncase(VariableNoBH \\<Gamma> v e i L \\<Delta> z)\n  have \"atom x \\<sharp> \\<Gamma>\" and \"atom x \\<sharp> v\" using VariableNoBH.prems(1) by (auto simp add: fresh_Pair)\n  hence \"atom x \\<sharp> \\<Gamma>\" and \"atom x \\<sharp> e\" using `lookup \\<Gamma> v = Some e`\n    apply (auto) by (metis fmap_upd_noop fresh_fmap_upd_eq lookup_fdom the.simps)\n  hence \"atom x \\<sharp> (\\<Gamma>, e)\" by (simp add: fresh_Pair)\n  hence \"atom x \\<sharp> (\\<Delta>, z) \\<or> x \\<in> fdom \\<Delta> - set (v # L)\"  by (rule VariableNoBH.IH)\n  thus ?case using `atom x \\<sharp> e` `atom x \\<sharp> v`\n    by (auto simp add: fresh_Pair fresh_Cons fresh_at_base fresh_fmap_upd_eq fresh_fmap_delete_subset)\nnext\n\ncase (Let as \\<Gamma> L body \\<Delta> z)\n  show ?case\n    proof (cases \"atom x \\<in> set(bn as)\")\n    case False\n      hence \"atom x \\<sharp> as\" using Let.prems by(auto simp add: fresh_Pair)      \n      hence \"atom x \\<sharp> asToHeap as\"\n        by (rule fresh_fun_eqvt_app[OF asToHeap_eqvt])\n      show ?thesis\n        apply(rule Let.IH)\n        using Let.prems `atom x \\<sharp> asToHeap as` False\n        by (auto simp add: fresh_Pair fresh_append fresh_fun_merge_subset eqvt_fresh_cong1[OF fmap_of_eqvt])\n    next\n    case True\n      hence \"x \\<in> fdom (fmap_of (asToHeap as))\" \n        by (simp add: fdom_fmap_of_conv_heapVars image_iff set_bn_to_atom_heapVars)\n      moreover\n      have \"x \\<notin> set L\"\n        using Let(1)\n        by (metis True fresh_list_elem fresh_star_Pair fresh_star_def not_self_fresh)\n      ultimately\n      show ?thesis\n      using reds_doesnt_forget[OF Let.hyps(2)] by auto\n    qed\nqed\n\nlemma reds_fresh_L:\" \\<lbrakk> \\<Gamma> : e \\<Down>\\<^sup>i\\<^sup>u\\<^bsub>L\\<^esub> \\<Delta> : z;\n   atom (x::var) \\<sharp> (\\<Gamma>, e) ; x \\<in> set L\n  \\<rbrakk> \\<Longrightarrow> atom x \\<sharp> (\\<Delta>, z)\"\n  by (metis reds_fresh Diff_iff)\n\n\ntext {*\nReducing the set of variables to avoid is always possible.\n*} \n\n\nlemma fresh_set_subset: \"x \\<sharp> L \\<Longrightarrow> set L' \\<subseteq> set L \\<Longrightarrow> x \\<sharp> L'\"\n  by (induction L') (auto simp add: fresh_Cons fresh_Nil dest: fresh_list_elem)\n\nlemma fresh_set_eq: \"set L' = set L \\<Longrightarrow> x \\<sharp> L' \\<longleftrightarrow> x \\<sharp> L\"\n  by (metis fresh_set_subset order_refl)\n\nlemma reds_smaller_L: \"\\<lbrakk> \\<Gamma> : e \\<Down>\\<^sup>i\\<^sup>u\\<^bsub>L\\<^esub> \\<Delta> : z;\n   set L' \\<subseteq> set L\n  \\<rbrakk> \\<Longrightarrow> \\<Gamma> : e \\<Down>\\<^sup>i\\<^sup>u\\<^bsub>L'\\<^esub> \\<Delta> : z\"\nproof(nominal_induct avoiding : L' rule: reds.strong_induct)\ncase (Lambda \\<Gamma> x e L L')\n  show ?case\n    by (rule LambdaI)\nnext\ncase (Application y \\<Gamma> e x L \\<Delta> \\<Theta> z b e' L')\n  show ?case\n  proof(rule reds.Application)\n    show \"atom y \\<sharp> (\\<Gamma>, e, x, L', \\<Delta>, \\<Theta>, z)\"\n      using Application\n      by (auto simp add: fresh_Pair dest: fresh_set_subset)\n  \n    have \"set (x # L') \\<subseteq> set (x # L)\"\n      using `set L' \\<subseteq> set L` by auto\n    thus \"\\<Gamma> : e \\<Down>\\<^sup>\\<times>\\<^sup>b\\<^bsub>x # L'\\<^esub> \\<Delta> : Lam [y]. e'\"\n      by (rule Application.hyps(10))\n\n    show \"\\<Delta> : e'[y ::= x] \\<Down>\\<^sup>\\<times>\\<^sup>b\\<^bsub>L'\\<^esub> \\<Theta> : z \"\n      by (rule Application.hyps(12)[OF Application.prems])\n  qed\nnext \ncase (ApplicationInd y \\<Gamma> e x L u \\<Delta> e' \\<Theta> z L')\n  show ?case\n  proof(rule reds.ApplicationInd)\n    show \"atom y \\<sharp> (\\<Gamma>, e, x, L')\"\n      using ApplicationInd\n      by (auto simp add: fresh_Pair dest: fresh_set_subset)\n  \n    have \"set (y # x # L') \\<subseteq> set (y # x # L)\"\n      using `set L' \\<subseteq> set L` by auto\n    thus \"\\<Gamma> : e \\<Down>\\<^sup>\\<surd>\\<^sup>u\\<^bsub>y # x # L'\\<^esub> \\<Delta> : Lam [y]. e'\"\n      by (rule ApplicationInd.hyps(6))\n\n    show \"\\<Delta>(y f\\<mapsto> Var x) : e' \\<Down>\\<^sup>\\<surd>\\<^sup>u\\<^bsub>L'\\<^esub> \\<Theta> : z \"\n      by (rule ApplicationInd.hyps(8)[OF ApplicationInd.prems])\n  qed\nnext \ncase (Variable \\<Gamma> x e i L \\<Delta> z L')\n  have \"set (x # L') \\<subseteq> set (x # L)\"\n    using Variable.prems by auto\n  thus ?case\n    by (rule reds.Variable[OF Variable(1) Variable.hyps(3)])\nnext\ncase (VariableNoBH \\<Gamma> x e i L \\<Delta> z L')\n  have \"set (x # L') \\<subseteq> set (x # L)\"\n    using VariableNoBH.prems by auto\n  thus ?case\n    by (rule reds.VariableNoBH[OF VariableNoBH(1) VariableNoBH.hyps(3)])\nnext\ncase (Let as \\<Gamma>  L body \\<Delta> z L')\n  have \"set (bn as) \\<sharp>* (\\<Gamma>, L')\"\n    using Let(1-3) Let.prems\n    by (auto simp add: fresh_star_Pair  fresh_star_set_subset)\n  thus ?case\n    by (rule reds.Let[OF _  Let.hyps(4)[OF Let.prems]])\nqed\n\nend\n\n", "meta": {"author": "nomeata", "repo": "isa-launchbury", "sha": "2caa8d7d588e218aef1c49f2f327597af06d116e", "save_path": "github-repos/isabelle/nomeata-isa-launchbury", "path": "github-repos/isabelle/nomeata-isa-launchbury/isa-launchbury-2caa8d7d588e218aef1c49f2f327597af06d116e/Scratchpad/LaunchburyCombined.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.30251011104279185}}
{"text": "theory VTcomp\nimports \n  Array_Map_Default\n  Dynamic_Array\n  (*Impl_List_Set_Ndj*)\n  Synth_Definition\n  Exc_Nres_Monad\nbegin\n\nno_notation Ref.lookup (\"!_\" 61)\nno_notation Ref.update (\"_ := _\" 62)\n\nsection \\<open>Added Stuff\\<close>\n\nlemma nfoldli_upt_rule:\n  assumes INTV: \"lb\\<le>ub\"\n  assumes I0: \"I lb \\<sigma>0\"\n  assumes IS: \"\\<And>i \\<sigma>. \\<lbrakk> lb\\<le>i; i<ub; I i \\<sigma>; c \\<sigma> \\<rbrakk> \\<Longrightarrow> f i \\<sigma> \\<le> SPEC (I (i+1))\"\n  assumes FNC: \"\\<And>i \\<sigma>. \\<lbrakk> lb\\<le>i; i\\<le>ub; I i \\<sigma>; \\<not>c \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  assumes FC: \"\\<And>\\<sigma>. \\<lbrakk> I ub \\<sigma>; c \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"nfoldli [lb..<ub] c f \\<sigma>0 \\<le> SPEC P\"\n  apply (rule nfoldli_rule[where I=\"\\<lambda>l _ \\<sigma>. I (lb+length l) \\<sigma>\"])\n  apply simp_all\n  apply (simp add: I0)\n  subgoal using IS\n    by (metis Suc_eq_plus1 add_diff_cancel_left' eq_diff_iff le_add1 length_upt upt_eq_lel_conv)\n  subgoal for l1 l2 \\<sigma> \n    apply (rule FNC[where i=\"lb + length l1\"])\n    apply (auto simp: INTV)\n    using INTV upt_eq_append_conv by auto\n  apply (rule FC) using INTV \n  by auto  \n\nterm Refine_Basic.bind\n  \nabbreviation (do_notation) bind_doN where \"bind_doN \\<equiv> Refine_Basic.bind\"\n\nnotation (output) bind_doN (infixr \"\\<bind>\" 54)\nnotation (ASCII output) bind_doN (infixr \">>=\" 54)\n\n\nnonterminal doN_binds and doN_bind\nsyntax\n  \"_doN_block\" :: \"doN_binds \\<Rightarrow> 'a\" (\"doN {//(2  _)//}\" [12] 62)\n  \"_doN_bind\"  :: \"[pttrn, 'a] \\<Rightarrow> doN_bind\" (\"(2_ \\<leftarrow>/ _)\" 13)\n  \"_doN_let\" :: \"[pttrn, 'a] \\<Rightarrow> doN_bind\" (\"(2let _ =/ _)\" [1000, 13] 13)\n  \"_doN_then\" :: \"'a \\<Rightarrow> doN_bind\" (\"_\" [14] 13)\n  \"_doN_final\" :: \"'a \\<Rightarrow> doN_binds\" (\"_\")\n  \"_doN_cons\" :: \"[doN_bind, doN_binds] \\<Rightarrow> doN_binds\" (\"_;//_\" [13, 12] 12)\n  \"_thenM\" :: \"['a, 'b] \\<Rightarrow> 'c\" (infixr \"\\<then>\" 54)\n\nsyntax (ASCII)\n  \"_doN_bind\" :: \"[pttrn, 'a] \\<Rightarrow> doN_bind\" (\"(2_ <-/ _)\" 13)\n  \"_thenM\" :: \"['a, 'b] \\<Rightarrow> 'c\" (infixr \">>\" 54)\n\ntranslations\n  \"_doN_block (_doN_cons (_doN_then t) (_doN_final e))\"\n    \\<rightleftharpoons> \"CONST bind_doN t (\\<lambda>_. e)\"\n  \"_doN_block (_doN_cons (_doN_bind p t) (_doN_final e))\"\n    \\<rightleftharpoons> \"CONST bind_doN t (\\<lambda>p. e)\"\n  \"_doN_block (_doN_cons (_doN_let p t) bs)\"\n    \\<rightleftharpoons> \"let p = t in _doN_block bs\"\n  \"_doN_block (_doN_cons b (_doN_cons c cs))\"\n    \\<rightleftharpoons> \"_doN_block (_doN_cons b (_doN_final (_doN_block (_doN_cons c cs))))\"\n  \"_doN_cons (_doN_let p t) (_doN_final s)\"\n    \\<rightleftharpoons> \"_doN_final (let p = t in s)\"\n  \"_doN_block (_doN_final e)\" \\<rightharpoonup> \"e\"\n  \"(m \\<then> n)\" \\<rightharpoonup> \"(m \\<bind> (\\<lambda>_. n))\"\n  \n  \ndefinition [enres_unfolds]: \"efor (lb::int) ub f \\<sigma> \\<equiv> doE {\n  EASSERT (lb\\<le>ub);\n  (_,\\<sigma>) \\<leftarrow> EWHILET (\\<lambda>(i,\\<sigma>). i<ub) (\\<lambda>(i,\\<sigma>). doE { \\<sigma> \\<leftarrow> f i \\<sigma>; ERETURN (i+1,\\<sigma>) }) (lb,\\<sigma>);\n  ERETURN \\<sigma>\n}\"  \n  \nthm EWHILEIT_rule\n\n  \nlemma efor_rule:\n  assumes INTV: \"lb\\<le>ub\"\n  assumes I0: \"I lb \\<sigma>0\"\n  assumes IS: \"\\<And>i \\<sigma>. \\<lbrakk> lb\\<le>i; i<ub; I i \\<sigma> \\<rbrakk> \\<Longrightarrow> f i \\<sigma> \\<le> ESPEC E (I (i+1))\"\n  assumes FC: \"\\<And>\\<sigma>. \\<lbrakk> I ub \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"efor lb ub f \\<sigma>0 \\<le> ESPEC E P\"\n  unfolding efor_def\n  supply EWHILET_rule[where R=\"measure (\\<lambda>(i,_). nat (ub-i))\" and I=\"\\<lambda>(i,\\<sigma>). lb\\<le>i \\<and> i\\<le>ub \\<and> I i \\<sigma>\", refine_vcg]\n  apply refine_vcg\n  apply auto\n  using assms apply auto\n  done\n  \n\n\nend\n", "meta": {"author": "wimmers", "repo": "verifythis", "sha": "985e51621f3a21d8376c99e9c9233f7193eeaffe", "save_path": "github-repos/isabelle/wimmers-verifythis", "path": "github-repos/isabelle/wimmers-verifythis/verifythis-985e51621f3a21d8376c99e9c9233f7193eeaffe/VTcomp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5736784074525098, "lm_q1q2_score": 0.3025101033557842}}
{"text": "theory Setup\n  imports   \n    Isabelle_LLVM.LLVM_DS_All\n    Abstract_Rbt\n    \"Separation_Logic_Solver/Methods\"\nbegin\n\n\nsubsection \\<open>RBT NODE Datatype\\<close>\n\ntext_raw \\<open>\\snip{rbtnodedef}{1}{2}{%\\<close>\ndatatype ('k :: llvm_rep, 'v :: llvm_rep) rbt_node =\n  RBT_NODE\n  (color: \"8 word\")\n  (left: \"('k, 'v) rbt_node ptr\")\n  (key: 'k) \n  (val: 'v)\n  (right: \"('k, 'v) rbt_node ptr\")\ntext_raw \\<open>}%endsnip\\<close>\n\nhide_const (open) color left key val right\n\n\ntype_synonym ('k, 'v) rbti = \"('k, 'v) rbt_node ptr\"  \n\n\nsubsubsection \\<open>Encoding to heap-representable\\<close>\n\n\ninstantiation rbt_node :: (llvm_rep, llvm_rep) llvm_rep\nbegin\n\n\nfun to_val_rbt_node where\n  \"to_val_rbt_node (RBT_NODE col l_child k v r_child) = \n    LL_STRUCT [to_val col, to_val l_child, to_val k, to_val v, to_val r_child]\"\n\n\nfun from_val_rbt_node where\n  \"from_val_rbt_node (LL_STRUCT [col, l_child_rep, k_rep, v_rep, r_child_rep]) = \n    RBT_NODE (from_val col)\n             (from_val l_child_rep)\n             (from_val k_rep)\n             (from_val v_rep)\n             (from_val r_child_rep)\"\n| \"from_val_rbt_node _ = undefined\"\n\n\ndefinition \"struct_of_rbt_node (_::('a, 'b) rbt_node itself) =\n    VS_STRUCT [VS_INT 8, VS_PTR, struct_of TYPE('a), struct_of TYPE('b), VS_PTR]\"\n\n\ndefinition \"init_rbt_node \\<equiv> RBT_NODE init init init init init\"\n\n\ninstance\nproof(standard, goal_cases)\n  case 1\n  then show ?case unfolding comp_def id_def \n  proof\n    fix x:: \"('a,'b) rbt_node\"\n    show \"from_val (to_val x) = x\" by (cases x; simp)\n  qed\nnext\n  case (2 v)\n  then show ?case\n    unfolding struct_of_rbt_node_def\n    by (cases v rule: from_val_rbt_node.cases; simp)\nnext\n  case (3 x)\n  then show ?case\n    unfolding struct_of_rbt_node_def\n    by (cases x; simp)\nnext\n  case 4\n  then show ?case\n    by (simp add: init_zero init_rbt_node_def struct_of_rbt_node_def to_val_word_def to_val_ptr_def null_def)\nqed\nend\n\n\nsubsubsection \\<open>Setup for LLVM code export\\<close>\ntext \\<open>Declare structure to code generator.\\<close>\nlemma to_val_rbt_node [ll_struct_of]:\n  \"struct_of TYPE(('k::llvm_rep, 'v::llvm_rep) rbt_node) =\n      VS_STRUCT \n      [\n        struct_of TYPE(8 word),\n        struct_of TYPE(('k, 'v) rbt_node ptr),\n        struct_of TYPE('k),\n        struct_of TYPE('v),\n        struct_of TYPE(('k, 'v) rbt_node ptr)\n      ]\"\n  unfolding struct_of_rbt_node_def\n  by auto\n\n\ntext \\<open>Declare as named structure. Required b/c of circular reference.\\<close>\nlemma [ll_identified_structures]:\n  \"ll_is_identified_structure ''rbt_node'' TYPE((_, _) rbt_node)\"  \n  unfolding ll_is_identified_structure_def\n    struct_of_rbt_node_def\n  by simp\n\n\nsubsubsection \\<open>Code Generator Preprocessor Setup\\<close>  \ntext \\<open>The next two are auxiliary lemmas\\<close>\nlemma rbt_node_insert_value [simp]:\n  \"ll_insert_value (RBT_NODE c l k v r) ci 0 = Mreturn (RBT_NODE ci l k v r)\"\n  \"ll_insert_value (RBT_NODE c l k v r) li (Suc 0) = Mreturn (RBT_NODE c li k v r)\"\n  \"ll_insert_value (RBT_NODE c l k v r) ki 2 = Mreturn (RBT_NODE c l ki v r)\"\n  \"ll_insert_value (RBT_NODE c l k v r) vi 3 = Mreturn (RBT_NODE c l k vi r)\"\n  \"ll_insert_value (RBT_NODE c l k v r) ri 4 = Mreturn (RBT_NODE c l k v ri)\"\n  by (simp_all add:\n      ll_insert_value_def llvm_insert_value_def\n      Let_def checked_from_val_def struct_of_rbt_node_def)\n\n\nlemma rbt_node_extract_value [simp]:\n  \"ll_extract_value (RBT_NODE c l k v r) 0 = Mreturn c\"\n  \"ll_extract_value (RBT_NODE c l k v r) (Suc 0) = Mreturn l\"\n  \"ll_extract_value (RBT_NODE c l k v r) 2 = Mreturn k\"\n  \"ll_extract_value (RBT_NODE c l k v r) 3 = Mreturn v\"\n  \"ll_extract_value (RBT_NODE c l k v r) 4 = Mreturn r\"\n  by (simp_all add:\n      ll_extract_value_def llvm_extract_value_def Let_def checked_from_val_def)\n\n\ntext \\<open>Lemmas to translate node construction and destruction\\<close>\nlemma inline_return_node [llvm_pre_simp]: \"Mreturn (RBT_NODE c l k v r) =\n   doM {\n    res \\<leftarrow> ll_insert_value init c 0;\n    res \\<leftarrow> ll_insert_value res l 1;\n    res \\<leftarrow> ll_insert_value res k 2;\n    res \\<leftarrow> ll_insert_value res v 3;\n    res \\<leftarrow> ll_insert_value res r 4;\n    Mreturn res\n  }\"\n  by (auto simp: init_rbt_node_def)\n\n\nlemma inline_node_case [llvm_pre_simp]: \"\n  (case x of (RBT_NODE c l k v r) \\<Rightarrow> f c l k v r) =\n   doM {\n    c \\<leftarrow> ll_extract_value x 0;\n    l \\<leftarrow> ll_extract_value x 1;\n    k \\<leftarrow> ll_extract_value x 2;\n    v \\<leftarrow> ll_extract_value x 3;\n    r \\<leftarrow> ll_extract_value x 4;\n    f c l k v r\n  }\"\n  apply (cases x)\n  by auto\n\n\nlemma inline_return_node_case [llvm_pre_simp]: \n  \"Mreturn (case x of (RBT_NODE c l k v r) \\<Rightarrow> f c l k v r) = \n  doM {\n    c \\<leftarrow> ll_extract_value x 0;\n    l \\<leftarrow> ll_extract_value x 1;\n    k \\<leftarrow> ll_extract_value x 2;\n    v \\<leftarrow> ll_extract_value x 3;\n    r \\<leftarrow> ll_extract_value x 4;\n    Mreturn (f c l k v r)   \n  }\"\n  apply (cases x)\n  by auto\n\n\nlemmas [llvm_inline] = \n  rbt_node.color_def\n  rbt_node.left_def\n  rbt_node.key_def\n  rbt_node.val_def\n  rbt_node.right_def\n\n\nsubsubsection \\<open>Setters\\<close>\n\n\ndefinition set_color :: \n  \"('k::llvm_rep, 'v::llvm_rep) rbt_node \\<Rightarrow> 8 word \\<Rightarrow> _\"\n  where \"set_color node col \\<equiv> ll_insert_value node col 0\"\ndefinition set_left :: \n  \"('k::llvm_rep, 'v::llvm_rep) rbt_node \\<Rightarrow> ('k, 'v) rbti \\<Rightarrow> _\"\n  where \"set_left node lhs \\<equiv> ll_insert_value node lhs 1\"\ndefinition set_key :: \n  \"('k::llvm_rep, 'v::llvm_rep) rbt_node \\<Rightarrow> 'k \\<Rightarrow> _\"\n  where \"set_key node k \\<equiv> ll_insert_value node k 2\"\ndefinition set_value :: \n  \"('k::llvm_rep, 'v::llvm_rep) rbt_node \\<Rightarrow> 'v \\<Rightarrow> _\"\n  where \"set_value node v \\<equiv> ll_insert_value node v 3\"\ndefinition set_right :: \n  \"('k::llvm_rep, 'v::llvm_rep) rbt_node \\<Rightarrow> ('k, 'v) rbti \\<Rightarrow> _\"\n  where \"set_right node rhs \\<equiv> ll_insert_value node rhs 4\"\n\n\ndefinition [llvm_pre_simp, simp]: \n  \"mod_ptr f n_p \\<equiv>\n  doM {\n    n_pre \\<leftarrow> ll_load n_p;\n    n_post \\<leftarrow> f n_pre;\n    ll_store n_post n_p \n  }\"\n\n\ndefinition \"set_color_p x \\<equiv> mod_ptr (\\<lambda>n. set_color n x)\"\ndefinition \"set_left_p x \\<equiv> mod_ptr (\\<lambda>n. set_left n x)\"\ndefinition \"set_key_p x \\<equiv> mod_ptr (\\<lambda>n. set_key n x)\"\ndefinition \"set_value_p x \\<equiv> mod_ptr (\\<lambda>n. set_value n x)\"\ndefinition \"set_right_p x \\<equiv> mod_ptr (\\<lambda>n. set_right n x)\"\n\n\nlemmas [llvm_inline, simp] =\n  set_color_def\n  set_left_def\n  set_key_def\n  set_value_def\n  set_right_def\n\nset_color_p_def\nset_left_p_def\nset_key_p_def\nset_value_p_def\nset_right_p_def\n\n\nsubsection \\<open>Color Assertion\\<close>\n\n\nfun color_pred where \n  \"color_pred color.R ci = (ci = 0)\"\n| \"color_pred color.B ci = (ci = 1)\"\n\n\nabbreviation \"color_assn c ci \\<equiv> \\<up>(color_pred c ci)\" \n\n\nlemma color_assn_R_0 [fri_red_rules]:\n  \"is_sep_red \\<box> \\<box> \\<box> (color_assn color.R 0)\"\n  apply (rule is_sep_redI)\n  apply sep\n  by simp_all\n\n\nlemma color_assn_B_1 [fri_red_rules]:\n  \"is_sep_red \\<box> \\<box> \\<box> (color_assn color.B 1)\"\n  apply (rule is_sep_redI)\n  apply sep\n  by simp_all\n\n\nsubsection \\<open>Linorder Locale\\<close>\n\n\nlocale linorder_impl =\n  fixes \n    abs_type :: \"'a :: linorder itself\" and\n    conc_type :: \"'ai :: llvm_rep itself\" and\n    lt_impl :: \"'ai \\<Rightarrow> 'ai \\<Rightarrow> 1 word llM\" and\n    elem_assn :: \"('a, 'ai) dr_assn\"\n  assumes lt_impl_rule [vcg_rules]: \n    \"llvm_htriple\n            (\\<upharpoonleft>elem_assn l li ** \\<upharpoonleft>elem_assn r ri)\n            (lt_impl li ri)\n            (\\<lambda>res. \n              \\<upharpoonleft>bool.assn (l < r) res **\n              \\<upharpoonleft>elem_assn l li **\n              \\<upharpoonleft>elem_assn r ri)\"\n\n\nsubsection \\<open>RBT Locale\\<close>\n\n\nlocale monad_syntax_M_loc\nbegin\n\nunbundle monad_syntax_M\n\nend\n\n\nlocale rbt_impl_deps = \n  monad_syntax_M_loc +\n  llvm_prim_ctrl_setup +\n  llvm_prim_arith_setup +\n  llvm_prim_setup\n\n\nlocale rbt_impl =\n  linorder_impl key_type key_type_i lt_impl key_assn\n  for\n    key_type :: \"'k :: linorder itself\" and\n    key_type_i :: \"'ki :: llvm_rep itself\" and\n    value_type :: \"'v itself\" and\n    value_type_i :: \"'vi :: llvm_rep itself\" and    \n\nlt_impl and\nkey_assn and\nkey_free :: \"'ki \\<Rightarrow> unit llM\" and\nvalue_assn :: \"('v, 'vi) dr_assn\" and\nvalue_free :: \"'vi \\<Rightarrow> unit llM\" +\nassumes\n  key_free_rule [vcg_rules]: \n  \"\n      llvm_htriple\n      (\\<upharpoonleft>key_assn k ki)\n      (key_free ki)\n      (\\<lambda>_. \\<box>)\n    \" and\n  value_free_rule [vcg_rules]:\n  \"\n      llvm_htriple\n      (\\<upharpoonleft>value_assn v vi)\n      (value_free vi)\n      (\\<lambda>_. \\<box>)\n    \"\nbegin\ninterpretation rbt_impl_deps .\n\n\nsubsection \\<open>RBT Assertion\\<close>\n\nfun rbt_assn :: \"\n  ('k, 'v) rbt \\<Rightarrow>\n  ('ki, 'vi) rbti \\<Rightarrow>\n  ll_assn\n\" where\n  \"rbt_assn rbt.Empty p = \\<up>(p=null)\"\n| \"rbt_assn (rbt.Branch c l k v r) p = (\n    EXS ci li ki vi ri. \n      \\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) p **\n      color_assn c ci **\n      rbt_assn l li **\n      \\<upharpoonleft>key_assn k ki **\n      \\<upharpoonleft>value_assn v vi **\n      rbt_assn r ri\n  )\"\ndeclare rbt_assn.simps(2)[simp del]\nlemmas rbt_assn_unfold = rbt_assn.simps(2)\n\nfun rbt_assn_full where \"rbt_assn_full t ti = (rbt_assn t ti ** \\<up>(is_rbt t))\"\n\nlemma rbt_sorted_key_uniqI:\n  \"rbt_sorted (Branch c l k v r) \\<Longrightarrow> k \\<notin> set (RBT_Impl.keys l)\"\n  \"rbt_sorted (Branch c l k v r) \\<Longrightarrow> k \\<notin> set (RBT_Impl.keys r)\"\n   apply simp_all\n  unfolding rbt_less_prop rbt_greater_prop\n  by blast+\n\n\nlemma rbt_sorted_subtrees_disjoint:\n  \"rbt_sorted (Branch c l k v r) \\<Longrightarrow> set (RBT_Impl.keys l) \\<inter> set (RBT_Impl.keys r) = {}\"\n  apply simp\n  unfolding rbt_less_prop rbt_greater_prop\n  by fastforce\n\n\n\n\n\nlemma [simp]: \"rbt_assn_full t null = \\<up>(t=rbt.Empty)\"\n  by (cases t; simp add: pure_true_conv)\n\n\nsubsection \\<open>Load Rule\\<close>\n\n\nlemma load_rbt [vcg_rules]:\n  \"\n    llvm_htriple\n    (rbt_assn (Branch c l k v r) ti)\n    (ll_load ti)\n    (\\<lambda>res.\n      EXS ci li ki vi ri.\n        \\<upharpoonleft>ll_bpto res ti **\n        color_assn c ci **\n        rbt_assn l li **\n        \\<upharpoonleft>key_assn k ki **\n        \\<upharpoonleft>value_assn v vi **  \n        rbt_assn r ri **\n        \\<up>(res = RBT_NODE ci li ki vi ri)\n    )\n  \"\n  unfolding rbt_assn_unfold\n  apply vcg\n  done\n\n\nlemma load_rbt_non_null [vcg_rules]:\n  \"\n    llvm_htriple\n    (rbt_assn t ti ** \\<up>(ti \\<noteq> null))\n    (ll_load ti)\n    (\\<lambda>res.\n      EXS ci li ki vi ri c l k v r.\n        \\<upharpoonleft>ll_bpto res ti **\n        color_assn c ci **\n        rbt_assn l li **\n        \\<upharpoonleft>key_assn k ki **\n        \\<upharpoonleft>value_assn v vi **  \n        rbt_assn r ri **\n        \\<up>(res = RBT_NODE ci li ki vi ri) **\n        \\<up>(t = rbt.Branch c l k v r))\n  \"\n  apply vcg\n  apply (cases t)\n  subgoal by (simp add: rbt_assn_unfold) (*contradiction*)\n  subgoal by vcg\n  done\n\n\nsubsection \\<open>Reduction Rules\\<close>\n\n\nlemma unfold_rbt_assn_red_rule [fri_red_rules]: \n  \"\n    is_sep_red\n    \\<box>\n    (color_assn c ci \\<and>* rbt_assn l li \\<and>* \\<upharpoonleft>key_assn k ki \\<and>* \\<upharpoonleft>value_assn v vi \\<and>* rbt_assn r ri)\n    (\\<upharpoonleft>ll_bpto (RBT_NODE ci li ki vi ri) ti)\n    (rbt_assn (rbt.Branch c l k v r) ti)\n  \"\n  apply (rule is_sep_redI)\n  apply (simp add: rbt_assn_unfold)\n  subgoal premises prems for Ps Qs\n    apply (sepE isep_dest: prems)\n      (*\n    apply (sep_drule prems)\n    apply (simp only: fri_extract_simps entails_lift_extract_simps cong: entails_pre_cong)\n    apply clarify\n    apply fri\n    *)\n    done\n  done\n\nsubsection \\<open>Empty Constructor\\<close>\n\n\ndefinition empty :: \"('ki, 'vi) rbti llM\"\n  where [llvm_code]: \"empty \\<equiv> Mreturn null\"\n\n\nlemma empty_correct [vcg_rules]: \n  \"llvm_htriple\n   \\<box>\n   empty\n   (\\<lambda> r. rbt_assn rbt.Empty r)\"\n  unfolding empty_def\n  by vcg\n\nend\n\n\nend", "meta": {"author": "leanderBehr", "repo": "isabelle-llvm-RBT", "sha": "9456c7160d0d190bdb3ac358bc0058d22fb19926", "save_path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT", "path": "github-repos/isabelle/leanderBehr-isabelle-llvm-RBT/isabelle-llvm-RBT-9456c7160d0d190bdb3ac358bc0058d22fb19926/LLVM_DS_RBT/Setup.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5736784074525096, "lm_q1q2_score": 0.30251010335578415}}
{"text": "(*  Title:      JinjaThreads/Execute/TypeRelRefine.thy\n    Author:     Andreas Lochbihler\n\n    Tabulation for lookup functions\n*)\n\nsection \\<open>Tabulation for lookup functions\\<close>\n\ntheory TypeRelRefine\nimports\n  \"../Common/TypeRel\"\n  \"HOL-Library.AList_Mapping\"\nbegin\n\nsubsection \\<open>Auxiliary lemmata\\<close>\n\n\n\nlemma map_of_map2: \"map_of (map (\\<lambda>(k, v). (k, f k v)) xs) k = map_option (f k) (map_of xs k)\"\nby(induct xs) auto\n\nlemma map_of_map_K: \"map_of (map (\\<lambda>k. (k, c)) xs) k = (if k \\<in> set xs then Some c else None)\"\nby(induct xs) auto\n\nlift_definition map_values :: \"('a \\<Rightarrow> 'b \\<Rightarrow> 'c) \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'c) mapping\"\nis \"\\<lambda>f m k. map_option (f k) (m k)\" .\n\n\n\nlemma map_Mapping: \"Mapping.map f g (Mapping.Mapping m) = Mapping.Mapping (map_option g \\<circ> m \\<circ> f)\"\nby(rule map.abs_eq)\n\nabbreviation subclst :: \"'m prog \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> bool\"\nwhere \"subclst P \\<equiv> (subcls1 P)^++\"\n\nsubsection \\<open>Representation type for tabulated lookup functions\\<close>\n\ntype_synonym\n  'm prog_impl' = \n  \"'m cdecl list \\<times>\n   (cname, 'm class) mapping \\<times>\n   (cname, cname set) mapping \\<times> \n   (cname, (vname, cname \\<times> ty \\<times> fmod) mapping) mapping \\<times> \n   (cname, (mname, cname \\<times> ty list \\<times> ty \\<times> 'm option) mapping) mapping\"\n\nlift_definition tabulate_class :: \"'m cdecl list \\<Rightarrow> (cname, 'm class) mapping\"\nis \"class \\<circ> Program\" .\n\nlift_definition tabulate_subcls :: \"'m cdecl list \\<Rightarrow> (cname, cname set) mapping\"\nis \"\\<lambda>P C. if is_class (Program P) C then Some {D. Program P \\<turnstile> C \\<preceq>\\<^sup>* D} else None\" .\n\nlift_definition tabulate_sees_field :: \"'m cdecl list \\<Rightarrow> (cname, (vname, cname \\<times> ty \\<times> fmod) mapping) mapping\"\nis \"\\<lambda>P C. if is_class (Program P) C then\n        Some (\\<lambda>F. if \\<exists>T fm D. Program P \\<turnstile> C sees F:T (fm) in D then Some (field (Program P) C F) else None)\n      else None\" .\n\nlift_definition tabulate_Method :: \"'m cdecl list \\<Rightarrow> (cname, (mname, cname \\<times> ty list \\<times> ty \\<times> 'm option) mapping) mapping\"\nis \"\\<lambda>P C. if is_class (Program P) C then\n         Some (\\<lambda>M. if \\<exists>Ts T mthd D. Program P \\<turnstile> C sees M:Ts\\<rightarrow>T=mthd in D then Some (method (Program P) C M) else None)\n      else None\" .\n\nfun wf_prog_impl' :: \"'m prog_impl' \\<Rightarrow> bool\"\nwhere\n  \"wf_prog_impl' (P, c, s, f, m) \\<longleftrightarrow>\n  c = tabulate_class P \\<and>\n  s = tabulate_subcls P \\<and>\n  f = tabulate_sees_field P \\<and>\n  m = tabulate_Method P\"\n\nsubsection \\<open>Implementation type for tabulated lookup functions\\<close>\n\ntypedef 'm prog_impl = \"{P :: 'm prog_impl'. wf_prog_impl' P}\"\n  morphisms impl_of ProgRefine \nproof\n  show \"([], Mapping.empty, Mapping.empty, Mapping.empty, Mapping.empty) \\<in> ?prog_impl\"\n    apply clarsimp\n    by transfer (simp_all add: fun_eq_iff is_class_def rel_funI)\nqed\n\nlemma impl_of_ProgImpl [simp]:\n  \"wf_prog_impl' Pfsm \\<Longrightarrow> impl_of (ProgRefine Pfsm) = Pfsm\"\nby(simp add: ProgRefine_inverse)\n\ndefinition program :: \"'m prog_impl \\<Rightarrow> 'm prog\"\nwhere \"program = Program \\<circ> fst \\<circ> impl_of\"\n\ncode_datatype program\n\nlemma prog_impl_eq_iff:\n  \"Pi = Pi' \\<longleftrightarrow> program Pi = program Pi'\" for Pi Pi'\napply(cases Pi)\napply(cases Pi')\napply(auto simp add: ProgRefine_inverse program_def ProgRefine_inject)\ndone\n\nlemma wf_prog_impl'_impl_of [simp, intro!]:\n  \"wf_prog_impl' (impl_of Pi)\" for Pi\nusing impl_of[of Pi] by simp\n\nlemma ProgImpl_impl_of [simp, code abstype]:\n  \"ProgRefine (impl_of Pi) = Pi\" for Pi\nby(rule impl_of_inverse)\n\nlemma program_ProgRefine [simp]: \"wf_prog_impl' Psfm \\<Longrightarrow> program (ProgRefine Psfm) = Program (fst Psfm)\"\nby(simp add: program_def)\n\nlemma classes_program [code]: \"classes (program P) = fst (impl_of P)\"\nby(simp add: program_def)\n\nlemma class_program [code]: \"class (program Pi) = Mapping.lookup (fst (snd (impl_of Pi)))\" for Pi\nby(cases Pi)(clarsimp simp add: tabulate_class_def lookup.rep_eq Mapping_inverse)\n\nsubsection \\<open>Refining sub class and lookup functions to use precomputed mappings\\<close>\n\ndeclare subcls'.equation [code del]\n\nlemma subcls'_program [code]: \n  \"subcls' (program Pi) C D \\<longleftrightarrow> \n  C = D \\<or>\n  (case Mapping.lookup (fst (snd (snd (impl_of Pi)))) C of None \\<Rightarrow> False\n   | Some m \\<Rightarrow> D \\<in> m)\" for Pi\napply(cases Pi)\napply(clarsimp simp add: subcls'_def tabulate_subcls_def lookup.rep_eq Mapping_inverse)\napply(auto elim!: rtranclp_tranclpE dest: subcls_is_class intro: tranclp_into_rtranclp)\ndone\n\nlemma subcls'_i_i_i_program [code]:\n  \"subcls'_i_i_i P C D = (if subcls' P C D then Predicate.single () else bot)\"\nby(rule pred_eqI)(auto elim: subcls'_i_i_iE intro: subcls'_i_i_iI)\n\nlemma subcls'_i_i_o_program [code]:\n  \"subcls'_i_i_o (program Pi) C = \n  sup (Predicate.single C) (case Mapping.lookup (fst (snd (snd (impl_of Pi)))) C of None \\<Rightarrow> bot | Some m \\<Rightarrow> pred_of_set m)\" for Pi\nby(cases Pi)(fastforce simp add: subcls'_i_i_o_def subcls'_def tabulate_subcls_def lookup.rep_eq Mapping_inverse intro!: pred_eqI split: if_split_asm elim: rtranclp_tranclpE dest: subcls_is_class intro: tranclp_into_rtranclp)\n\nlemma rtranclp_FioB_i_i_subcls1_i_i_o_code [code_unfold]:\n  \"rtranclp_FioB_i_i (subcls1_i_i_o P) = subcls'_i_i_i P\"\nby(auto simp add: fun_eq_iff subcls1_i_i_o_def subcls'_def rtranclp_FioB_i_i_def subcls'_i_i_i_def)\n\ndeclare Method.equation[code del]\nlemma Method_program [code]:\n  \"program Pi \\<turnstile> C sees M:Ts\\<rightarrow>T=meth in D \\<longleftrightarrow> \n  (case Mapping.lookup (snd (snd (snd (snd (impl_of Pi))))) C of \n    None \\<Rightarrow> False\n  | Some m \\<Rightarrow> \n    (case Mapping.lookup m M of \n       None \\<Rightarrow> False\n     | Some (D', Ts', T', meth') \\<Rightarrow> Ts = Ts' \\<and> T = T' \\<and> meth = meth' \\<and> D = D'))\" for Pi\nby(cases Pi)(auto split: if_split_asm dest: sees_method_is_class simp add: tabulate_Method_def lookup.rep_eq Mapping_inverse)\n\nlemma Method_i_i_i_o_o_o_o_program [code]:\n  \"Method_i_i_i_o_o_o_o (program Pi) C M = \n  (case Mapping.lookup (snd (snd (snd (snd (impl_of Pi))))) C of\n    None \\<Rightarrow> bot\n  | Some m \\<Rightarrow>\n    (case Mapping.lookup m M of\n      None \\<Rightarrow> bot\n    | Some (D, Ts, T, meth) \\<Rightarrow> Predicate.single (Ts, T, meth, D)))\" for Pi\nby(auto simp add: Method_i_i_i_o_o_o_o_def Method_program intro!: pred_eqI)\n\nlemma Method_i_i_i_o_o_o_i_program [code]:\n  \"Method_i_i_i_o_o_o_i (program Pi) C M D = \n  (case Mapping.lookup (snd (snd (snd (snd (impl_of Pi))))) C of\n    None \\<Rightarrow> bot\n  | Some m \\<Rightarrow>\n    (case Mapping.lookup m M of\n      None \\<Rightarrow> bot\n    | Some (D', Ts, T, meth) \\<Rightarrow> if D = D' then Predicate.single (Ts, T, meth) else bot))\" for Pi\nby(auto simp add: Method_i_i_i_o_o_o_i_def Method_program intro!: pred_eqI)\n\ndeclare sees_field.equation[code del]\n\nlemma sees_field_program [code]:\n  \"program Pi \\<turnstile> C sees F:T (fd) in D \\<longleftrightarrow>\n  (case Mapping.lookup (fst (snd (snd (snd (impl_of Pi))))) C of\n    None \\<Rightarrow> False\n  | Some m \\<Rightarrow> \n    (case Mapping.lookup m F of \n       None \\<Rightarrow> False\n     | Some (D', T', fd') \\<Rightarrow> T = T' \\<and> fd = fd' \\<and> D = D'))\" for Pi\nby(cases Pi)(auto split: if_split_asm dest: has_visible_field[THEN has_field_is_class] simp add: tabulate_sees_field_def lookup.rep_eq Mapping_inverse)\n\nlemma sees_field_i_i_i_o_o_o_program [code]:\n  \"sees_field_i_i_i_o_o_o (program Pi) C F =\n  (case Mapping.lookup (fst (snd (snd (snd (impl_of Pi))))) C of\n    None \\<Rightarrow> bot\n  | Some m \\<Rightarrow>\n    (case Mapping.lookup m F of\n       None \\<Rightarrow> bot\n    | Some (D, T, fd) \\<Rightarrow> Predicate.single(T, fd, D)))\" for Pi\nby(auto simp add: sees_field_program sees_field_i_i_i_o_o_o_def intro: pred_eqI)\n\nlemma sees_field_i_i_i_o_o_i_program [code]:\n  \"sees_field_i_i_i_o_o_i (program Pi) C F D =\n  (case Mapping.lookup (fst (snd (snd (snd (impl_of Pi))))) C of\n    None \\<Rightarrow> bot\n  | Some m \\<Rightarrow>\n    (case Mapping.lookup m F of\n       None \\<Rightarrow> bot\n    | Some (D', T, fd) \\<Rightarrow> if D = D' then Predicate.single(T, fd) else bot))\" for Pi\nby(auto simp add: sees_field_program sees_field_i_i_i_o_o_i_def intro: pred_eqI)\n\nlemma field_program [code]:\n  \"field (program Pi) C F = \n  (case Mapping.lookup (fst (snd (snd (snd (impl_of Pi))))) C of \n    None \\<Rightarrow> Code.abort (STR ''not_unique'') (\\<lambda>_. Predicate.the bot)\n  | Some m \\<Rightarrow> \n    (case Mapping.lookup m F of\n       None \\<Rightarrow> Code.abort (STR ''not_unique'') (\\<lambda>_. Predicate.the bot)\n     | Some (D', T, fd) \\<Rightarrow> (D', T, fd)))\" for Pi\nunfolding field_def\nby(cases Pi)(fastforce simp add: Predicate.the_def tabulate_sees_field_def lookup.rep_eq Mapping_inverse split: if_split_asm intro: arg_cong[where f=The] dest: has_visible_field[THEN has_field_is_class] sees_field_fun)\n\nsubsection \\<open>Implementation for precomputing mappings\\<close>\n\ndefinition tabulate_program :: \"'m cdecl list \\<Rightarrow> 'm prog_impl\"\nwhere \"tabulate_program P = ProgRefine (P, tabulate_class P, tabulate_subcls P, tabulate_sees_field P, tabulate_Method P)\"\n\nlemma impl_of_tabulate_program [code abstract]:\n  \"impl_of (tabulate_program P) = (P, tabulate_class P, tabulate_subcls P, tabulate_sees_field P, tabulate_Method P)\"\nby(simp add: tabulate_program_def)\n\nlemma Program_code [code]:\n  \"Program = program \\<circ> tabulate_program\"\nby(simp add: program_def fun_eq_iff tabulate_program_def)\n\nsubsubsection \\<open>@{term \"class\" }\\<close>\n\nlemma tabulate_class_code [code]:\n  \"tabulate_class = Mapping.of_alist\"\n  by transfer (simp add: fun_eq_iff)\n\nsubsubsection \\<open>@{term \"subcls\" }\\<close>\n\ninductive subcls1' :: \"'m cdecl list \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> bool\"\nwhere \n  find: \"C \\<noteq> Object \\<Longrightarrow> subcls1' ((C, D, rest) # P) C D\"\n| step: \"\\<lbrakk> C \\<noteq> Object; C \\<noteq> C'; subcls1' P C D  \\<rbrakk> \\<Longrightarrow> subcls1' ((C', D', rest) # P) C D\"\n\ncode_pred\n  (modes: i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool)\n  subcls1' .\n\nlemma subcls1_into_subcls1':\n  assumes \"subcls1 (Program P) C D\"\n  shows \"subcls1' P C D\"\nproof -\n  from assms obtain rest where \"map_of P C = \\<lfloor>(D, rest)\\<rfloor>\" \"C \\<noteq> Object\" by cases simp\n  thus ?thesis by(induct P)(auto split: if_split_asm intro: subcls1'.intros)\nqed\n\nlemma subcls1'_into_subcls1:\n  assumes \"subcls1' P C D\"\n  shows \"subcls1 (Program P) C D\"\nusing assms\nproof(induct)\n  case find thus ?case by(auto intro: subcls1.intros)\nnext\n  case step thus ?case by(auto elim!: subcls1.cases intro: subcls1.intros)\nqed\n\nlemma subcls1_eq_subcls1':\n  \"subcls1 (Program P) = subcls1' P\"\nby(auto simp add: fun_eq_iff intro: subcls1_into_subcls1' subcls1'_into_subcls1)\n\ndefinition subcls'' :: \"'m cdecl list \\<Rightarrow> cname \\<Rightarrow> cname \\<Rightarrow> bool\"\nwhere \"subcls'' P = (subcls1' P)^**\"\n\ncode_pred\n  (modes: i \\<Rightarrow> i \\<Rightarrow> i \\<Rightarrow> bool)\n  [inductify] \n  subcls'' .\n\nlemma subcls''_eq_subcls: \"subcls'' P = subcls (Program P)\"\nby(simp add: subcls''_def subcls1_eq_subcls1')\n\nlemma subclst_snd_classD: \n  assumes \"subclst (Program P) C D\"\n  shows \"D \\<in> fst ` snd ` set P\"\nusing assms\nby(induct)(fastforce elim!: subcls1.cases dest!: map_of_SomeD intro: rev_image_eqI)+\n\ndefinition check_acyclicity :: \"(cname, cname set) mapping \\<Rightarrow> 'm cdecl list \\<Rightarrow> unit\"\nwhere \"check_acyclicity _ _ = ()\"\n\ndefinition cyclic_class_hierarchy :: unit \nwhere [code del]: \"cyclic_class_hierarchy = ()\"\n\ndeclare [[code abort: cyclic_class_hierarchy]]\n\nlemma check_acyclicity_code:\n  \"check_acyclicity mapping P =\n   (let _ = \n     map (\\<lambda>(C, D, _).\n       if C = Object then () \n       else\n         (case Mapping.lookup mapping D of \n            None \\<Rightarrow> ()\n          | Some Cs \\<Rightarrow> if C \\<in> Cs then cyclic_class_hierarchy else ()))\n       P\n    in ())\"\nby simp\n\nlemma tablulate_subcls_code [code]:\n  \"tabulate_subcls P = \n  (let cnames = map fst P;\n       cnames' = map (fst \\<circ> snd) P;\n       mapping = Mapping.tabulate cnames (\\<lambda>C. set (C # [D \\<leftarrow> cnames'. subcls'' P C D]));\n       _ = check_acyclicity mapping P\n   in mapping\n  )\"\napply(auto simp add: tabulate_subcls_def Mapping.tabulate_def fun_eq_iff is_class_def o_def map_of_map2[simplified split_def] Mapping_inject)\n apply(subst map_of_map2[simplified split_def])\n apply(auto simp add: fun_eq_iff subcls''_eq_subcls map_of_map_K dest: subclst_snd_classD elim: rtranclp_tranclpE)[1]\napply(subst map_of_map2[simplified split_def])\napply(rule sym)\napply simp\napply(case_tac \"map_of P x\")\napply auto\ndone\n\nsubsubsection \\<open>@{term Fields}\\<close>\n\ntext \\<open>\n  Problem: Does not terminate for cyclic class hierarchies!\n  This problem already occurs in Jinja's well-formedness checker: \n  \\<open>wf_cdecl\\<close> calls \\<open>wf_mdecl\\<close> before checking for acyclicity, \n  but \\<open>wf_J_mdecl\\<close> involves the type judgements, \n  which in turn requires @{term \"Fields\"} (via @{term sees_field}).\n  Checking acyclicity before executing @{term \"Fields'\"} for tabulation is difficult\n  because we would have to intertwine tabulation and well-formedness checking.\n  Possible (local) solution:\n  additional termination parameter (like memoisation for @{term \"rtranclp\"}) \n  and list option as error return parameter.\n\\<close>\ninductive\n  Fields' :: \"'m cdecl list \\<Rightarrow> cname \\<Rightarrow> ((vname \\<times> cname) \\<times> (ty \\<times> fmod)) list \\<Rightarrow> bool\"\nfor P :: \"'m cdecl list\"\nwhere \n  rec:\n  \"\\<lbrakk> map_of P C = Some(D,fs,ms); C \\<noteq> Object; Fields' P D FDTs;\n     FDTs' = map (\\<lambda>(F,Tm). ((F,C),Tm)) fs @ FDTs \\<rbrakk>\n  \\<Longrightarrow> Fields' P C FDTs'\"\n| Object:\n  \"\\<lbrakk> map_of P Object = Some(D,fs,ms); FDTs = map (\\<lambda>(F,T). ((F,Object),T)) fs \\<rbrakk>\n  \\<Longrightarrow> Fields' P Object FDTs\"\n\nlemma Fields'_into_Fields:\n  assumes \"Fields' P C FDTs\"\n  shows \"Program P \\<turnstile> C has_fields FDTs\"\nusing assms\nby induct(auto intro: Fields.intros)\n\nlemma Fields_into_Fields':\n  assumes \"Program P \\<turnstile> C has_fields FDTs\"\n  shows \"Fields' P C FDTs\"\nusing assms\nby induct(auto intro: Fields'.intros)\n\nlemma Fields'_eq_Fields:\n  \"Fields' P = Fields (Program P)\"\nby(auto simp add: fun_eq_iff intro: Fields'_into_Fields Fields_into_Fields')\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool)\n  Fields' .\n\ndefinition fields' :: \"'m cdecl list \\<Rightarrow> cname \\<Rightarrow> ((vname \\<times> cname) \\<times> (ty \\<times> fmod)) list\"\nwhere \"fields' P C = (if \\<exists>FDTs. Fields' P C FDTs then THE FDTs. Fields' P C FDTs else [])\"\n\nlemma eval_Fields'_conv:\n  \"Predicate.eval (Fields'_i_i_o P C) = Fields' P C\"\nby(auto intro: Fields'_i_i_oI elim: Fields'_i_i_oE intro!: ext)\n\nlemma fields'_code [code]:\n  \"fields' P C = \n  (let FDTs = Fields'_i_i_o P C in if Predicate.holds (FDTs \\<bind> (\\<lambda>_. Predicate.single ())) then Predicate.the FDTs else [])\"\nby(auto simp add: fields'_def holds_eq Fields'_i_i_o_def intro: Fields'_i_i_oI Predicate.the_eqI[THEN sym])\n\nlemma The_Fields [simp]:\n  \"P \\<turnstile> C has_fields FDTs \\<Longrightarrow> The (Fields P C) = FDTs\"\nby(auto dest: has_fields_fun)\n\nlemma tabulate_sees_field_code [code]:\n  \"tabulate_sees_field P =\n   Mapping.tabulate (map fst P) (\\<lambda>C. Mapping.of_alist (map (\\<lambda>((F, D), Tfm). (F, (D, Tfm))) (fields' P C)))\"\napply(simp add: tabulate_sees_field_def tabulate_def is_class_def fields'_def Fields'_eq_Fields Mapping_inject)\napply(rule ext)\napply clarsimp\napply(rule conjI)\n apply(clarsimp simp add: o_def)\n apply(subst map_of_map2[unfolded split_def])\n apply simp\n apply transfer\n apply(rule conjI)\n  apply clarsimp\n  apply(rule ext)\n  apply clarsimp\n  apply(rule conjI)\n   apply(clarsimp simp add: sees_field_def Fields'_eq_Fields)\n   apply(drule (1) has_fields_fun, clarsimp)\n  apply clarify\n  apply(rule sym)\n  apply(rule ccontr)\n  apply(clarsimp simp add: sees_field_def Fields'_eq_Fields)\n apply clarsimp\n apply(rule ext)\n apply(clarsimp simp add: sees_field_def)\napply(clarsimp simp add: o_def)\napply(subst map_of_map2[simplified split_def])\napply(rule sym)\napply(clarsimp)\napply(rule ccontr)\napply simp\ndone\n\nsubsubsection \\<open>@{term \"Methods\" }\\<close>\n\ntext \\<open>Same termination problem as for @{term Fields'}\\<close>\ninductive Methods' :: \"'m cdecl list \\<Rightarrow> cname \\<Rightarrow> (mname \\<times> (ty list \\<times> ty \\<times> 'm option) \\<times> cname) list \\<Rightarrow> bool\"\n  for P :: \"'m cdecl list\"\nwhere \n  \"\\<lbrakk> map_of P Object = Some(D,fs,ms); Mm = map (\\<lambda>(M, rest). (M, (rest, Object))) ms \\<rbrakk>\n   \\<Longrightarrow> Methods' P Object Mm\"\n| \"\\<lbrakk> map_of P C = Some(D,fs,ms); C \\<noteq> Object; Methods' P D Mm;\n     Mm' = map (\\<lambda>(M, rest). (M, (rest, C))) ms @ Mm \\<rbrakk>\n   \\<Longrightarrow> Methods' P C Mm'\"\n\nlemma Methods'_into_Methods:\n  assumes \"Methods' P C Mm\"\n  shows \"Program P \\<turnstile> C sees_methods (map_of Mm)\"\nusing assms\napply induct\n apply(clarsimp simp add: o_def split_def)\n apply(rule sees_methods_Object)\n  apply fastforce\n apply(rule ext)\n apply(subst map_of_map2[unfolded split_def])\n apply(simp add: o_def)\n\napply(rule sees_methods_rec)\n   apply fastforce\n  apply simp\n apply assumption\napply(clarsimp simp add: map_add_def map_of_map2)\ndone\n\nlemma Methods_into_Methods':\n  assumes \"Program P \\<turnstile> C sees_methods Mm\"\n  shows \"\\<exists>Mm'. Methods' P C Mm' \\<and> Mm = map_of Mm'\"\nusing assms\nby induct(auto intro: Methods'.intros simp add: map_of_map2 map_add_def)\n\ncode_pred \n  (modes: i \\<Rightarrow> i \\<Rightarrow> o \\<Rightarrow> bool)\n  Methods'\n.\n\ndefinition methods' :: \"'m cdecl list \\<Rightarrow> cname \\<Rightarrow> (mname \\<times> (ty list \\<times> ty \\<times> 'm option) \\<times> cname) list\"\nwhere \"methods' P C = (if \\<exists>Mm. Methods' P C Mm then THE Mm. Methods' P C Mm else [])\"\n\nlemma methods'_code [code]:\n  \"methods' P C =\n  (let Mm = Methods'_i_i_o P C\n   in if Predicate.holds (Mm \\<bind> (\\<lambda>_. Predicate.single ())) then Predicate.the Mm else [])\"\nunfolding methods'_def\nby(auto simp add: holds_eq Methods'_i_i_o_def Predicate.the_def)\n\nlemma Methods'_fun:\n  assumes \"Methods' P C Mm\"\n  shows \"Methods' P C Mm' \\<Longrightarrow> Mm = Mm'\"\nusing assms\napply(induct arbitrary: Mm')\n apply(fastforce elim: Methods'.cases)\napply(rotate_tac -1)\napply(erule Methods'.cases)\n apply(fastforce)\napply clarify\napply(simp)\ndone\n\nlemma The_Methods' [simp]: \"Methods' P C Mm \\<Longrightarrow> The (Methods' P C) = Mm\"\nby(auto dest: Methods'_fun)\n\nlemma methods_def2 [simp]: \"Methods' P C Mm \\<Longrightarrow> methods' P C = Mm\"\nby(auto simp add: methods'_def)\n\nlemma tabulate_Method_code [code]:\n  \"tabulate_Method P =\n   Mapping.tabulate (map fst P) (\\<lambda>C. Mapping.of_alist (map (\\<lambda>(M, (rest, D)). (M, D, rest)) (methods' P C)))\"\napply(simp add: tabulate_Method_def tabulate_def o_def lookup.rep_eq Mapping_inject)\napply(rule ext)\napply clarsimp\napply(rule conjI)\n apply clarify\n apply(rule sym)\n apply(subst map_of_map2[unfolded split_def])\n apply(simp add: is_class_def)\n apply transfer\n apply(rule ext)\n apply(simp add: map_of_map2)\n apply(rule conjI)\n  apply(clarsimp simp add: map_of_map2 Method_def)\n  apply(drule Methods_into_Methods')\n  apply clarsimp\n  apply(simp add: split_def)\n  apply(subst map_of_map2[unfolded split_def])\n  apply simp\n apply clarify\n apply(clarsimp simp add: methods'_def)\n apply(frule Methods'_into_Methods)\n apply(clarsimp simp add: Method_def)\n apply(simp add: split_def)\n apply(subst map_of_map2[unfolded split_def])\n apply(fastforce intro: ccontr)\napply clarify\napply(rule sym)\napply(simp add: map_of_eq_None_iff is_class_def)\napply(simp only: set_map[symmetric] map_map o_def fst_conv)\napply simp\ndone\n\ntext \\<open>Merge modules TypeRel, Decl and TypeRelRefine to avoid cyclic modules\\<close>\n\ncode_identifier\n  code_module TypeRel \\<rightharpoonup>\n    (SML) TypeRel and (Haskell) TypeRel and (OCaml) TypeRel\n| code_module TypeRelRefine \\<rightharpoonup>\n    (SML) TypeRel and (Haskell) TypeRel and (OCaml) TypeRel\n| code_module Decl \\<rightharpoonup>\n    (SML) TypeRel and (Haskell) TypeRel and (OCaml) TypeRel\n\nML_val \\<open>@{code Program}\\<close>\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Execute/TypeRelRefine.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3024386177109419}}
{"text": "(*  Title:       AWN_SOS.thy\n    License:     BSD 2-Clause. See LICENSE.\n    Author:      Timothy Bourke\n*)\n\nheader \"Semantics of the Algebra of Wireless Networks\"\n\ntheory AWN_SOS\nimports TransitionSystems AWN\nbegin\n\nsubsection \"Table 1: Structural operational semantics for sequential process expressions \"\n\ninductive_set\n  seqp_sos\n  :: \"('s, 'm, 'p, 'l) seqp_env \\<Rightarrow> ('s \\<times> ('s, 'm, 'p, 'l) seqp, 'm seq_action) transition set\"\n  for \\<Gamma> :: \"('s, 'm, 'p, 'l) seqp_env\"\nwhere\n    broadcastT: \"((\\<xi>, {l}broadcast(s\\<^sub>m\\<^sub>s\\<^sub>g).p),          broadcast (s\\<^sub>m\\<^sub>s\\<^sub>g \\<xi>),         (\\<xi>, p)) \\<in> seqp_sos \\<Gamma>\"\n  | groupcastT: \"((\\<xi>, {l}groupcast(s\\<^sub>i\\<^sub>p\\<^sub>s, s\\<^sub>m\\<^sub>s\\<^sub>g).p),    groupcast (s\\<^sub>i\\<^sub>p\\<^sub>s \\<xi>) (s\\<^sub>m\\<^sub>s\\<^sub>g \\<xi>), (\\<xi>, p)) \\<in> seqp_sos \\<Gamma>\"\n  | unicastT:   \"((\\<xi>, {l}unicast(s\\<^sub>i\\<^sub>p, s\\<^sub>m\\<^sub>s\\<^sub>g).p \\<triangleright> q),   unicast (s\\<^sub>i\\<^sub>p \\<xi>) (s\\<^sub>m\\<^sub>s\\<^sub>g \\<xi>),    (\\<xi>, p)) \\<in> seqp_sos \\<Gamma>\"\n  | notunicastT:\"((\\<xi>, {l}unicast(s\\<^sub>i\\<^sub>p, s\\<^sub>m\\<^sub>s\\<^sub>g).p \\<triangleright> q),    \\<not>unicast (s\\<^sub>i\\<^sub>p \\<xi>),          (\\<xi>, q)) \\<in> seqp_sos \\<Gamma>\"\n  | sendT:      \"((\\<xi>, {l}send(s\\<^sub>m\\<^sub>s\\<^sub>g).p),               send (s\\<^sub>m\\<^sub>s\\<^sub>g \\<xi>),              (\\<xi>, p)) \\<in> seqp_sos \\<Gamma>\"\n  | deliverT:   \"((\\<xi>, {l}deliver(s\\<^sub>d\\<^sub>a\\<^sub>t\\<^sub>a).p),           deliver (s\\<^sub>d\\<^sub>a\\<^sub>t\\<^sub>a \\<xi>),          (\\<xi>, p)) \\<in> seqp_sos \\<Gamma>\"\n  | receiveT:   \"((\\<xi>, {l}receive(u\\<^sub>m\\<^sub>s\\<^sub>g).p),            receive msg,       (u\\<^sub>m\\<^sub>s\\<^sub>g msg \\<xi>, p)) \\<in> seqp_sos \\<Gamma>\"\n  | assignT:    \"((\\<xi>, {l}\\<lbrakk>u\\<rbrakk> p),                      \\<tau>,                        (u \\<xi>, p)) \\<in> seqp_sos \\<Gamma>\"\n\n  | callT:      \"\\<lbrakk> ((\\<xi>, \\<Gamma> pn), a, (\\<xi>', p')) \\<in> seqp_sos \\<Gamma> \\<rbrakk> \\<Longrightarrow>\n                 ((\\<xi>, call(pn)), a, (\\<xi>', p')) \\<in> seqp_sos \\<Gamma>\" (* TPB: quite different to Table 1 *)\n\n  | choiceT1:   \"((\\<xi>, p), a, (\\<xi>', p')) \\<in> seqp_sos \\<Gamma>  \\<Longrightarrow> ((\\<xi>, p \\<oplus> q), a, (\\<xi>', p')) \\<in> seqp_sos \\<Gamma>\"\n  | choiceT2:   \"((\\<xi>, q), a, (\\<xi>', q')) \\<in> seqp_sos \\<Gamma>  \\<Longrightarrow> ((\\<xi>, p \\<oplus> q), a, (\\<xi>', q')) \\<in> seqp_sos \\<Gamma>\"\n\n  | guardT:     \"\\<xi>' \\<in> g \\<xi> \\<Longrightarrow> ((\\<xi>, {l}\\<langle>g\\<rangle> p), \\<tau>, (\\<xi>', p)) \\<in> seqp_sos \\<Gamma>\"\n\ninductive_cases\n      seqp_callTE [elim]:      \"((\\<xi>, call(pn)), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>\"\n  and seqp_choiceTE [elim]:    \"((\\<xi>, p1 \\<oplus> p2), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>\"\n\nlemma seqp_broadcastTE [elim]:\n  \"\\<lbrakk>((\\<xi>, {l}broadcast(s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>;\n    \\<lbrakk>a = broadcast (s\\<^sub>m\\<^sub>s\\<^sub>g \\<xi>); \\<xi>' = \\<xi>; q = p\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((\\<xi>, {l}broadcast(s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>\") simp\n\nlemma seqp_groupcastTE [elim]:\n  \"\\<lbrakk>((\\<xi>, {l}groupcast(s\\<^sub>i\\<^sub>p\\<^sub>s, s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>;\n    \\<lbrakk>a = groupcast (s\\<^sub>i\\<^sub>p\\<^sub>s \\<xi>) (s\\<^sub>m\\<^sub>s\\<^sub>g \\<xi>); \\<xi>' = \\<xi>; q = p\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((\\<xi>, {l}groupcast(s\\<^sub>i\\<^sub>p\\<^sub>s, s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>\") simp\n\nlemma seqp_unicastTE [elim]:\n  \"\\<lbrakk>((\\<xi>, {l}unicast(s\\<^sub>i\\<^sub>p, s\\<^sub>m\\<^sub>s\\<^sub>g). p \\<triangleright> q), a, (\\<xi>', r)) \\<in> seqp_sos \\<Gamma>;\n    \\<lbrakk>a = unicast (s\\<^sub>i\\<^sub>p \\<xi>) (s\\<^sub>m\\<^sub>s\\<^sub>g \\<xi>); \\<xi>' = \\<xi>; r = p\\<rbrakk> \\<Longrightarrow> P;\n    \\<lbrakk>a = \\<not>unicast (s\\<^sub>i\\<^sub>p \\<xi>); \\<xi>' = \\<xi>; r = q\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((\\<xi>, {l}unicast(s\\<^sub>i\\<^sub>p, s\\<^sub>m\\<^sub>s\\<^sub>g). p \\<triangleright> q), a, (\\<xi>', r)) \\<in> seqp_sos \\<Gamma>\") simp_all\n\nlemma seqp_sendTE [elim]:\n  \"\\<lbrakk>((\\<xi>, {l}send(s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>;\n    \\<lbrakk>a = send (s\\<^sub>m\\<^sub>s\\<^sub>g \\<xi>); \\<xi>' = \\<xi>; q = p\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((\\<xi>, {l}send(s\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>\") simp\n\nlemma seqp_deliverTE [elim]:\n  \"\\<lbrakk>((\\<xi>, {l}deliver(s\\<^sub>d\\<^sub>a\\<^sub>t\\<^sub>a). p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>;\n    \\<lbrakk>a = deliver (s\\<^sub>d\\<^sub>a\\<^sub>t\\<^sub>a \\<xi>); \\<xi>' = \\<xi>; q = p\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((\\<xi>, {l}deliver(s\\<^sub>d\\<^sub>a\\<^sub>t\\<^sub>a). p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>\") simp\n\nlemma seqp_receiveTE [elim]:\n  \"\\<lbrakk>((\\<xi>, {l}receive(u\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>;\n    \\<And>msg. \\<lbrakk>a = receive msg; \\<xi>' = u\\<^sub>m\\<^sub>s\\<^sub>g msg \\<xi>; q = p\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((\\<xi>, {l}receive(u\\<^sub>m\\<^sub>s\\<^sub>g). p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>\") simp\n\nlemma seqp_assignTE [elim]:\n  \"\\<lbrakk>((\\<xi>, {l}\\<lbrakk>u\\<rbrakk> p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>; \\<lbrakk>a = \\<tau>; \\<xi>' = u \\<xi>; q = p\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((\\<xi>, {l}\\<lbrakk>u\\<rbrakk> p), a, (\\<xi>', q)) \\<in> seqp_sos \\<Gamma>\") simp\n\n\n\nlemmas seqpTEs =\n  seqp_broadcastTE\n  seqp_groupcastTE\n  seqp_unicastTE\n  seqp_sendTE\n  seqp_deliverTE\n  seqp_receiveTE\n  seqp_assignTE\n  seqp_callTE\n  seqp_choiceTE\n  seqp_guardTE\n\ndeclare seqp_sos.intros [intro]\n\nsubsection \"Table 2: Structural operational semantics for parallel process expressions \"\n\ninductive_set\n  parp_sos :: \"('s1, 'm seq_action) transition set\n                    \\<Rightarrow> ('s2, 'm seq_action) transition set\n                    \\<Rightarrow> ('s1 \\<times> 's2, 'm seq_action) transition set\"\n  for S :: \"('s1, 'm seq_action) transition set\"\n  and T :: \"('s2, 'm seq_action) transition set\"\nwhere\n    parleft:  \"\\<lbrakk> (s, a, s') \\<in> S; \\<And>m. a \\<noteq> receive m \\<rbrakk> \\<Longrightarrow> ((s, t), a, (s', t)) \\<in> parp_sos S T\"\n  | parright: \"\\<lbrakk> (t, a, t') \\<in> T; \\<And>m. a \\<noteq> send m \\<rbrakk> \\<Longrightarrow> ((s, t), a, (s, t')) \\<in> parp_sos S T\"\n  | parboth:  \"\\<lbrakk> (s, receive m, s') \\<in> S; (t, send m, t') \\<in> T \\<rbrakk>\n               \\<Longrightarrow>((s, t), \\<tau>, (s', t')) \\<in> parp_sos S T\"\n\nlemma par_broadcastTE [elim]:\n  \"\\<lbrakk>((s, t), broadcast m, (s', t')) \\<in> parp_sos S T;\n    \\<lbrakk>(s, broadcast m, s') \\<in> S; t' = t\\<rbrakk> \\<Longrightarrow> P;\n    \\<lbrakk>(t, broadcast m, t') \\<in> T; s' = s\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((s, t), broadcast m, (s', t')) \\<in> parp_sos S T\") simp_all\n\nlemma par_groupcastTE [elim]:\n  \"\\<lbrakk>((s, t), groupcast ips m, (s', t')) \\<in> parp_sos S T;\n    \\<lbrakk>(s, groupcast ips m, s') \\<in> S; t' = t\\<rbrakk> \\<Longrightarrow> P;\n    \\<lbrakk>(t, groupcast ips m, t') \\<in> T; s' = s\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((s, t), groupcast ips m, (s', t')) \\<in> parp_sos S T\") simp_all\n\nlemma par_unicastTE [elim]:\n  \"\\<lbrakk>((s, t), unicast i m, (s', t')) \\<in> parp_sos S T;\n    \\<lbrakk>(s, unicast i m, s') \\<in> S; t' = t\\<rbrakk> \\<Longrightarrow> P;\n    \\<lbrakk>(t, unicast i m, t') \\<in> T; s' = s\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((s, t), unicast i m, (s', t')) \\<in> parp_sos S T\") simp_all\n\nlemma par_notunicastTE [elim]:\n  \"\\<lbrakk>((s, t), notunicast i, (s', t')) \\<in> parp_sos S T;\n    \\<lbrakk>(s, notunicast i, s') \\<in> S; t' = t\\<rbrakk> \\<Longrightarrow> P;\n    \\<lbrakk>(t, notunicast i, t') \\<in> T; s' = s\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((s, t), notunicast i, (s', t')) \\<in> parp_sos S T\") simp_all\n\nlemma par_sendTE [elim]:\n  \"\\<lbrakk>((s, t), send m, (s', t')) \\<in> parp_sos S T;\n    \\<lbrakk>(s, send m, s') \\<in> S; t' = t\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((s, t), send m, (s', t')) \\<in> parp_sos S T\") auto\n\nlemma par_deliverTE [elim]:\n  \"\\<lbrakk>((s, t), deliver d, (s', t')) \\<in> parp_sos S T;\n    \\<lbrakk>(s, deliver d, s') \\<in> S; t' = t\\<rbrakk> \\<Longrightarrow> P;\n    \\<lbrakk>(t, deliver d, t') \\<in> T; s' = s\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((s, t), deliver d, (s', t')) \\<in> parp_sos S T\") simp_all\n\nlemma par_receiveTE [elim]:\n  \"\\<lbrakk>((s, t), receive m, (s', t')) \\<in> parp_sos S T;\n    \\<lbrakk>(t, receive m, t') \\<in> T; s' = s\\<rbrakk> \\<Longrightarrow> P\\<rbrakk> \\<Longrightarrow> P\"\n  by (ind_cases \"((s, t), receive m, (s', t')) \\<in> parp_sos S T\") auto\n\ninductive_cases par_tauTE: \"((s, t), \\<tau>, (s', t')) \\<in> parp_sos S T\"\n\nlemmas parpTEs =\n  par_broadcastTE\n  par_groupcastTE\n  par_unicastTE\n  par_notunicastTE\n  par_sendTE\n  par_deliverTE\n  par_receiveTE\n\nlemma parp_sos_cases [elim]:\n  assumes \"((s, t), a, (s', t')) \\<in> parp_sos S T\"\n      and \"\\<lbrakk> (s, a, s') \\<in> S; \\<And>m. a \\<noteq> receive m; t' = t \\<rbrakk> \\<Longrightarrow> P\"\n      and \"\\<lbrakk> (t, a, t') \\<in> T; \\<And>m. a \\<noteq> send m; s' = s \\<rbrakk> \\<Longrightarrow> P\"\n      and \"\\<And>m. \\<lbrakk> (s, receive m, s') \\<in> S; (t, send m, t') \\<in> T \\<rbrakk> \\<Longrightarrow> P\"\n    shows \"P\"\n  using assms by cases auto\n\ndefinition\n  par_comp :: \"('s1, 'm seq_action) automaton\n              \\<Rightarrow> ('s2, 'm seq_action) automaton\n              \\<Rightarrow> ('s1 \\<times> 's2, 'm seq_action) automaton\"\n  (\"(_ \\<langle>\\<langle> _)\" [102, 103] 102)\nwhere\n  \"s \\<langle>\\<langle> t \\<equiv> \\<lparr> init = init s \\<times> init t, trans = parp_sos (trans s) (trans t) \\<rparr>\"\n\nlemma trans_par_comp [simp]:\n  \"trans (s \\<langle>\\<langle> t) = parp_sos (trans s) (trans t)\"\n  unfolding par_comp_def by simp\n\nlemma init_par_comp [simp]:\n  \"init (s \\<langle>\\<langle> t) = init s \\<times> init t\"\n  unfolding par_comp_def by simp\n\nsubsection \"Table 3: Structural operational semantics for node expressions \"\n\ninductive_set\n  node_sos :: \"('s, 'm seq_action) transition set \\<Rightarrow> ('s net_state, 'm node_action) transition set\"\n  for S :: \"('s, 'm seq_action) transition set\"\nwhere\n    node_bcast:\n    \"(s, broadcast m, s') \\<in> S \\<Longrightarrow> (NodeS i s R, R:*cast(m), NodeS i s' R) \\<in> node_sos S\"\n  | node_gcast:\n    \"(s, groupcast D m, s') \\<in> S \\<Longrightarrow> (NodeS i s R, (R\\<inter>D):*cast(m), NodeS i s' R) \\<in> node_sos S\"\n  | node_ucast:\n    \"\\<lbrakk> (s, unicast d m, s') \\<in> S; d\\<in>R \\<rbrakk> \\<Longrightarrow> (NodeS i s R, {d}:*cast(m), NodeS i s' R) \\<in> node_sos S\"\n  | node_notucast:\n    \"\\<lbrakk> (s, \\<not>unicast d, s') \\<in> S; d\\<notin>R \\<rbrakk> \\<Longrightarrow> (NodeS i s R, \\<tau>, NodeS i s' R) \\<in> node_sos S\"\n  | node_deliver:\n    \"(s, deliver d, s') \\<in> S \\<Longrightarrow> (NodeS i s R, i:deliver(d), NodeS i s' R) \\<in> node_sos S\"\n  | node_receive:\n    \"(s, receive m, s') \\<in> S \\<Longrightarrow> (NodeS i s R, {i}\\<not>{}:arrive(m), NodeS i s' R) \\<in> node_sos S\"\n  | node_tau:\n    \"(s, \\<tau>, s') \\<in> S         \\<Longrightarrow> (NodeS i s R, \\<tau>, NodeS i s' R) \\<in> node_sos S\"\n  | node_arrive:\n    \"(NodeS i s R, {}\\<not>{i}:arrive(m),  NodeS i s R) \\<in> node_sos S\"\n  | node_connect1:\n    \"(NodeS i s R, connect(i, i'),    NodeS i s (R \\<union> {i'})) \\<in> node_sos S\"\n  | node_connect2:\n    \"(NodeS i s R, connect(i', i),    NodeS i s (R \\<union> {i'})) \\<in> node_sos S\"\n  | node_disconnect1:\n    \"(NodeS i s R, disconnect(i, i'), NodeS i s (R - {i'})) \\<in> node_sos S\"\n  | node_disconnect2:\n    \"(NodeS i s R, disconnect(i', i), NodeS i s (R - {i'})) \\<in> node_sos S\"\n  | node_connect_other:\n    \"\\<lbrakk> i \\<noteq> i'; i \\<noteq> i'' \\<rbrakk> \\<Longrightarrow> (NodeS i s R, connect(i', i''), NodeS i s R) \\<in> node_sos S\"\n  | node_disconnect_other:\n    \"\\<lbrakk> i \\<noteq> i'; i \\<noteq> i'' \\<rbrakk> \\<Longrightarrow> (NodeS i s R, disconnect(i', i''), NodeS i s R) \\<in> node_sos S\"\n\ninductive_cases node_arriveTE:  \"(NodeS i s R, ii\\<not>ni:arrive(m), NodeS i s' R) \\<in> node_sos S\"\n            and node_arriveTE': \"(NodeS i s R, H\\<not>K:arrive(m), s') \\<in> node_sos S\"\n            and node_castTE:    \"(NodeS i s R, RM:*cast(m), NodeS i s' R') \\<in> node_sos S\"\n            and node_castTE':   \"(NodeS i s R, RM:*cast(m), s') \\<in> node_sos S\"\n            and node_deliverTE: \"(NodeS i s R, i:deliver(d), NodeS i s' R) \\<in> node_sos S\"\n            and node_deliverTE': \"(s, i:deliver(d), s') \\<in> node_sos S\"\n            and node_deliverTE'': \"(NodeS ii s R, i:deliver(d), s') \\<in> node_sos S\"\n            and node_tauTE:     \"(NodeS i s R, \\<tau>, NodeS i s' R) \\<in> node_sos S\"\n            and node_tauTE':    \"(NodeS i s R, \\<tau>, s') \\<in> node_sos S\"\n            and node_connectTE: \"(NodeS ii s R, connect(i, i'), NodeS ii s' R') \\<in> node_sos S\"\n            and node_connectTE': \"(NodeS ii s R, connect(i, i'), s') \\<in> node_sos S\"\n            and node_disconnectTE: \"(NodeS ii s R, disconnect(i, i'), NodeS ii s' R') \\<in> node_sos S\"\n            and node_disconnectTE': \"(NodeS ii s R, disconnect(i, i'), s') \\<in> node_sos S\"\n\nlemma node_sos_never_newpkt [simp]:\n  assumes \"(s, a, s') \\<in> node_sos S\"\n    shows \"a \\<noteq> i:newpkt(d, di)\"\n  using assms by cases auto\n\nlemma arrives_or_not:\n  assumes \"(NodeS i s R, ii\\<not>ni:arrive(m), NodeS i' s' R') \\<in> node_sos S\"\n    shows \"(ii = {i} \\<and> ni = {}) \\<or> (ii = {} \\<and> ni = {i})\"\n  using assms by rule simp_all\n\ndefinition\n  node_comp :: \"ip \\<Rightarrow> ('s, 'm seq_action) automaton \\<Rightarrow> ip set\n                   \\<Rightarrow> ('s net_state, 'm node_action) automaton\"\n    (\"(\\<langle>_ : (_) : _\\<rangle>)\" [0, 0, 0] 104)\nwhere\n  \"\\<langle>i : np : R\\<^sub>i\\<rangle> \\<equiv> \\<lparr> init = {NodeS i s R\\<^sub>i|s. s \\<in> init np}, trans = node_sos (trans np) \\<rparr>\"\n\nlemma trans_node_comp:\n  \"trans (\\<langle>i : np : R\\<^sub>i\\<rangle>) = node_sos (trans np)\"\n  unfolding node_comp_def by simp\n\nlemma init_node_comp:\n  \"init (\\<langle>i : np : R\\<^sub>i\\<rangle>) = {NodeS i s R\\<^sub>i|s. s \\<in> init np}\"\n  unfolding node_comp_def by simp\n\nlemmas node_comps = trans_node_comp init_node_comp\n\nlemma trans_par_node_comp [simp]:\n  \"trans (\\<langle>i : s \\<langle>\\<langle> t : R\\<rangle>) = node_sos (parp_sos (trans s) (trans t))\"\n  unfolding node_comp_def by simp\n\nlemma snd_par_node_comp [simp]:\n  \"init (\\<langle>i : s \\<langle>\\<langle> t : R\\<rangle>) = {NodeS i st R|st. st \\<in> init s \\<times> init t}\"\n  unfolding node_comp_def by simp\n\nlemma node_sos_dest_is_net_state:\n  assumes \"(s, a, s') \\<in> node_sos S\"\n    shows \"\\<exists>i' P' R'. s' = NodeS i' P' R'\"\n  using assms by induct auto\n\nlemma node_sos_dest:\n  assumes \"(NodeS i p R, a, s') \\<in> node_sos S\"\n    shows \"\\<exists>P' R'. s' = NodeS i P' R'\"\n  using assms assms [THEN node_sos_dest_is_net_state]\n  by - (erule node_sos.cases, auto)\n\nlemma node_sos_states [elim]:\n  assumes \"(ns, a, ns') \\<in> node_sos S\"\n  obtains i s R s' R' where \"ns  = NodeS i s  R\"\n                        and \"ns' = NodeS i s' R'\"\n  proof -\n    assume [intro!]: \"\\<And>i s R s' R'. ns = NodeS i s R \\<Longrightarrow> ns' = NodeS i s' R' \\<Longrightarrow> thesis\"\n    from assms(1) obtain i s R where \"ns = NodeS i s R\"\n      by (cases ns) auto\n    moreover with assms(1) obtain s' R' where \"ns' = NodeS i s' R'\"\n      by (metis node_sos_dest)\n    ultimately show thesis ..\n  qed\n\nlemma node_sos_cases [elim]:\n  \"(NodeS i p R, a, NodeS i p' R') \\<in> node_sos S \\<Longrightarrow>\n  (\\<And>m .       \\<lbrakk> a = R:*cast(m);          R' = R; (p, broadcast m, p') \\<in> S \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>m D.      \\<lbrakk> a = (R \\<inter> D):*cast(m);    R' = R; (p, groupcast D m, p') \\<in> S \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>d m.      \\<lbrakk> a = {d}:*cast(m);        R' = R; (p, unicast d m, p') \\<in> S; d \\<in> R \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>d.        \\<lbrakk> a = \\<tau>;                   R' = R; (p, \\<not>unicast d, p') \\<in> S; d \\<notin> R \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>d.        \\<lbrakk> a = i:deliver(d);        R' = R; (p, deliver d, p') \\<in> S \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>m.        \\<lbrakk> a = {i}\\<not>{}:arrive(m);    R' = R; (p, receive m, p') \\<in> S \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (            \\<lbrakk> a = \\<tau>;                   R' = R; (p, \\<tau>, p') \\<in> S \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>m.        \\<lbrakk> a = {}\\<not>{i}:arrive(m);    R' = R; p = p' \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i i'.     \\<lbrakk> a = connect(i, i');      R' = R \\<union> {i'}; p = p' \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i i'.     \\<lbrakk> a = connect(i', i);      R' = R \\<union> {i'}; p = p' \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i i'.     \\<lbrakk> a = disconnect(i, i');   R' = R - {i'}; p = p' \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i i'.     \\<lbrakk> a = disconnect(i', i);   R' = R - {i'}; p = p' \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i i' i''. \\<lbrakk> a = connect(i', i'');    R' = R; p = p'; i \\<noteq> i'; i \\<noteq> i'' \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  (\\<And>i i' i''. \\<lbrakk> a = disconnect(i', i''); R' = R; p = p'; i \\<noteq> i'; i \\<noteq> i'' \\<rbrakk> \\<Longrightarrow> P) \\<Longrightarrow>\n  P\"\n  by (erule node_sos.cases) simp_all\n\nsubsection \"Table 4: Structural operational semantics for partial network expressions \"\n\ninductive_set\n  pnet_sos :: \"('s net_state, 'm node_action) transition set\n                    \\<Rightarrow> ('s net_state, 'm node_action) transition set\n                    \\<Rightarrow> ('s net_state, 'm node_action) transition set\"\n  for S :: \"('s net_state, 'm node_action) transition set\"\n  and T :: \"('s net_state, 'm node_action) transition set\"\nwhere\n    pnet_cast1: \"\\<lbrakk> (s, R:*cast(m), s') \\<in> S; (t, H\\<not>K:arrive(m), t') \\<in> T; H \\<subseteq> R; K \\<inter> R = {} \\<rbrakk>\n      \\<Longrightarrow> (SubnetS s t, R:*cast(m), SubnetS s' t') \\<in> pnet_sos S T\"\n\n  | pnet_cast2: \"\\<lbrakk> (s, H\\<not>K:arrive(m), s') \\<in> S; (t, R:*cast(m), t') \\<in> T;  H \\<subseteq> R; K \\<inter> R = {} \\<rbrakk>\n      \\<Longrightarrow> (SubnetS s t, R:*cast(m), SubnetS s' t') \\<in> pnet_sos S T\"\n\n  | pnet_arrive: \"\\<lbrakk> (s, H\\<not>K:arrive(m), s') \\<in> S; (t, H'\\<not>K':arrive(m), t') \\<in> T \\<rbrakk>\n      \\<Longrightarrow> (SubnetS s t,  (H \\<union> H')\\<not>(K \\<union> K'):arrive(m), SubnetS s' t') \\<in> pnet_sos S T\"\n\n  | pnet_deliver1: \"(s, i:deliver(d), s') \\<in> S\n      \\<Longrightarrow> (SubnetS s t, i:deliver(d), SubnetS s' t) \\<in> pnet_sos S T\"\n  | pnet_deliver2: \"\\<lbrakk> (t, i:deliver(d), t') \\<in> T \\<rbrakk>\n      \\<Longrightarrow> (SubnetS s t, i:deliver(d), SubnetS s t') \\<in> pnet_sos S T\"\n\n  | pnet_tau1: \"(s, \\<tau>, s') \\<in> S \\<Longrightarrow> (SubnetS s t, \\<tau>, SubnetS s' t) \\<in> pnet_sos S T\"\n  | pnet_tau2: \"(t, \\<tau>, t') \\<in> T \\<Longrightarrow> (SubnetS s t, \\<tau>, SubnetS s t') \\<in> pnet_sos S T\"\n\n  | pnet_connect: \"\\<lbrakk> (s, connect(i, i'), s') \\<in> S; (t, connect(i, i'), t') \\<in> T \\<rbrakk>\n      \\<Longrightarrow> (SubnetS s t, connect(i, i'), SubnetS s' t') \\<in> pnet_sos S T\"\n\n  | pnet_disconnect: \"\\<lbrakk> (s, disconnect(i, i'), s') \\<in> S; (t, disconnect(i, i'), t') \\<in> T \\<rbrakk>\n      \\<Longrightarrow> (SubnetS s t, disconnect(i, i'), SubnetS s' t') \\<in> pnet_sos S T\"\n\ninductive_cases partial_castTE [elim]:       \"(s, R:*cast(m), s') \\<in> pnet_sos S T\"\n            and partial_arriveTE [elim]:     \"(s, H\\<not>K:arrive(m), s') \\<in> pnet_sos S T\"\n            and partial_deliverTE [elim]:    \"(s, i:deliver(d), s') \\<in> pnet_sos S T\"\n            and partial_tauTE [elim]:        \"(s, \\<tau>, s') \\<in> pnet_sos S T\"\n            and partial_connectTE [elim]:    \"(s, connect(i, i'), s') \\<in> pnet_sos S T\"\n            and partial_disconnectTE [elim]: \"(s, disconnect(i, i'), s') \\<in> pnet_sos S T\"\n\nlemma pnet_sos_never_newpkt:\n  assumes \"(st, a, st') \\<in> pnet_sos S T\"\n      and \"\\<And>i d di a s s'. (s, a, s') \\<in> S \\<Longrightarrow> a \\<noteq> i:newpkt(d, di)\"\n      and \"\\<And>i d di a t t'. (t, a, t') \\<in> T \\<Longrightarrow> a \\<noteq> i:newpkt(d, di)\"\n    shows \"a \\<noteq> i:newpkt(d, di)\"\n  using assms(1) by cases (auto dest!: assms(2-3))\n\nfun pnet :: \"(ip \\<Rightarrow> ('s, 'm seq_action) automaton)\n              \\<Rightarrow> net_tree \\<Rightarrow> ('s net_state, 'm node_action) automaton\"\nwhere\n    \"pnet np (\\<langle>i; R\\<^sub>i\\<rangle>)  =  \\<langle>i : np i : R\\<^sub>i\\<rangle>\"\n  | \"pnet np (p\\<^sub>1 \\<parallel> p\\<^sub>2) = \\<lparr> init = {SubnetS s\\<^sub>1 s\\<^sub>2 |s\\<^sub>1 s\\<^sub>2. s\\<^sub>1 \\<in> init (pnet np p\\<^sub>1)\n                                                      \\<and> s\\<^sub>2 \\<in> init (pnet np p\\<^sub>2)},\n                           trans = pnet_sos (trans (pnet np p\\<^sub>1)) (trans (pnet np p\\<^sub>2)) \\<rparr>\"\n\nlemma pnet_node_init [elim, simp]:\n  assumes \"s \\<in> init (pnet np \\<langle>i; R\\<rangle>)\"\n    shows \"s \\<in> { NodeS i s R |s. s \\<in> init (np i)}\"\n  using assms by (simp add: node_comp_def)\n\nlemma pnet_node_init' [elim]:\n assumes \"s \\<in> init (pnet np \\<langle>i; R\\<rangle>)\"\n obtains ns where \"s = NodeS i ns R\"\n             and \"ns \\<in> init (np i)\"\n   using assms by (auto simp add: node_comp_def)\n\nlemma pnet_node_trans [elim, simp]:\n  assumes \"(s, a, s') \\<in> trans (pnet np \\<langle>i; R\\<rangle>)\"\n    shows \"(s, a, s') \\<in> node_sos (trans (np i))\"\n  using assms by (simp add: trans_node_comp)\n\nlemma pnet_never_newpkt':\n  assumes \"(s, a, s') \\<in> trans (pnet np n)\"\n    shows \"\\<forall>i d di. a \\<noteq> i:newpkt(d, di)\"\n  using assms proof (induction n arbitrary: s a s')\n    fix n1 n2 s a s'\n    assume IH1: \"\\<And>s a s'. (s, a, s') \\<in> trans (pnet np n1) \\<Longrightarrow> \\<forall>i d di. a \\<noteq> i:newpkt(d, di)\"\n       and IH2: \"\\<And>s a s'. (s, a, s') \\<in> trans (pnet np n2) \\<Longrightarrow> \\<forall>i d di. a \\<noteq> i:newpkt(d, di)\"\n       and \"(s, a, s') \\<in> trans (pnet np (n1 \\<parallel> n2))\"\n    show \"\\<forall>i d di. a \\<noteq> i:newpkt(d, di)\"\n    proof (intro allI)\n      fix i d di\n      from \\<open>(s, a, s') \\<in> trans (pnet np (n1 \\<parallel> n2))\\<close>\n        have \"(s, a, s') \\<in> pnet_sos (trans (pnet np n1)) (trans (pnet np n2))\"\n          by simp\n      thus \"a \\<noteq> i:newpkt(d, di)\"\n        by (rule pnet_sos_never_newpkt) (auto dest!: IH1 IH2)\n    qed\n  qed (simp add: node_comps)\n\nlemma pnet_never_newpkt:\n  assumes \"(s, a, s') \\<in> trans (pnet np n)\"\n    shows \"a \\<noteq> i:newpkt(d, di)\"\n  proof -\n    from assms have \"\\<forall>i d di. a \\<noteq> i:newpkt(d, di)\"\n      by (rule pnet_never_newpkt')\n    thus ?thesis by clarsimp\n  qed\n\nsubsection \"Table 5: Structural operational semantics for complete network expressions \"\n\ninductive_set\n  cnet_sos :: \"('s, ('m::msg) node_action) transition set\n                    \\<Rightarrow> ('s, 'm node_action) transition set\"\n  for S :: \"('s, 'm node_action) transition set\"\nwhere\n    cnet_connect: \"(s, connect(i, i'), s') \\<in> S  \\<Longrightarrow> (s, connect(i, i'), s') \\<in> cnet_sos S\"\n  | cnet_disconnect: \"(s, disconnect(i, i'), s') \\<in> S  \\<Longrightarrow> (s, disconnect(i, i'), s') \\<in> cnet_sos S\"\n  | cnet_cast: \"(s, R:*cast(m), s') \\<in> S  \\<Longrightarrow> (s, \\<tau>, s') \\<in> cnet_sos S\"\n  | cnet_tau: \"(s, \\<tau>, s') \\<in> S  \\<Longrightarrow> (s, \\<tau>, s') \\<in> cnet_sos S\"\n  | cnet_deliver: \"(s, i:deliver(d), s') \\<in> S  \\<Longrightarrow> (s, i:deliver(d), s') \\<in> cnet_sos S\"\n  | cnet_newpkt: \"(s, {i}\\<not>K:arrive(newpkt(d, di)), s') \\<in> S  \\<Longrightarrow> (s, i:newpkt(d, di), s') \\<in> cnet_sos S\"\n\ninductive_cases connect_completeTE: \"(s, connect(i, i'), s') \\<in> cnet_sos S\"\n            and disconnect_completeTE: \"(s, disconnect(i, i'), s') \\<in> cnet_sos S\"\n            and tau_completeTE: \"(s, \\<tau>, s') \\<in> cnet_sos S\"\n            and deliver_completeTE: \"(s, i:deliver(d), s') \\<in> cnet_sos S\"\n            and newpkt_completeTE: \"(s, i:newpkt(d, di), s') \\<in> cnet_sos S\"\n\nlemmas completeTEs = connect_completeTE\n                     disconnect_completeTE\n                     tau_completeTE\n                     deliver_completeTE\n                     newpkt_completeTE\n\nlemma complete_no_cast [simp]:\n  \"(s, R:*cast(m), s') \\<notin> cnet_sos T\"\n  proof\n    assume \"(s, R:*cast(m), s') \\<in> cnet_sos T\"\n    hence \"R:*cast(m) \\<noteq> R:*cast(m)\"\n     by (rule cnet_sos.cases) auto\n    thus False by simp\n  qed\n\nlemma complete_no_arrive [simp]:\n  \"(s, ii\\<not>ni:arrive(m), s') \\<notin> cnet_sos T\"\n  proof\n    assume \"(s, ii\\<not>ni:arrive(m), s') \\<in> cnet_sos T\"\n    hence \"ii\\<not>ni:arrive(m) \\<noteq> ii\\<not>ni:arrive(m)\"\n     by (rule cnet_sos.cases) auto\n    thus False by simp\n  qed\n\nabbreviation\n  closed :: \"('s net_state, ('m::msg) node_action) automaton \\<Rightarrow> ('s net_state, 'm node_action) automaton\"\nwhere\n  \"closed \\<equiv> (\\<lambda>A. A \\<lparr> trans := cnet_sos (trans A) \\<rparr>)\"\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/AWN/AWN_SOS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3024386177109419}}
{"text": "header {* \\isaheader{Foreach Loops} *}\ntheory Refine_Foreach\nimports \n  Refine_While \n  Refine_Pfun \n  Refine_Transfer \n  (*\"../Collections/Lib/SetIterator\"\n  \"../Collections/Lib/Proper_Iterator\"*)\nbegin\n\ntext {*\n  A common pattern for loop usage is iteration over the elements of a set.\n  This theory provides the @{text \"FOREACH\"}-combinator, that iterates over \n  each element of a set.\n*}\n\nsubsection {* Auxilliary Lemmas *}\ntext {* The following lemma is commonly used when reasoning about iterator\n  invariants.\n  It helps converting the set of elements that remain to be iterated over to\n  the set of elements already iterated over. *}\nlemma it_step_insert_iff: \n  \"it \\<subseteq> S \\<Longrightarrow> x\\<in>it \\<Longrightarrow> S-(it-{x}) = insert x (S-it)\" by auto\n\nsubsection {* Definition *}\n\ntext {*\n  Foreach-loops come in different versions, depending on whether they have an \n  annotated invariant (I), a termination condition (C), and an order (O).\n\n  Note that asserting that the set is finite is not necessary to guarantee\n  termination. However, we currently provide only iteration over finite sets,\n  as this also matches the ICF concept of iterators.\n*}\n   \ndefinition \"FOREACH_body f \\<equiv> \\<lambda>(xs, \\<sigma>). do {\n  let x = hd xs; \\<sigma>'\\<leftarrow>f x \\<sigma>; RETURN (tl xs,\\<sigma>')\n  }\"\n\ndefinition FOREACH_cond where \"FOREACH_cond c \\<equiv> (\\<lambda>(xs,\\<sigma>). xs\\<noteq>[] \\<and> c \\<sigma>)\"\n\ntext {* Foreach with continuation condition, order and annotated invariant: *}\n\ndefinition FOREACHoci (\"FOREACH\\<^sub>O\\<^sub>C\\<^bsup>_,_\\<^esup>\") where \"FOREACHoci R \\<Phi> S c f \\<sigma>0 \\<equiv> do {\n  ASSERT (finite S);\n  xs \\<leftarrow> SPEC (\\<lambda>xs. distinct xs \\<and> S = set xs \\<and> sorted_by_rel R xs);\n  (_,\\<sigma>) \\<leftarrow> WHILEIT \n    (\\<lambda>(it,\\<sigma>). \\<exists>xs'. xs = xs' @ it \\<and> \\<Phi> (set it) \\<sigma>) (FOREACH_cond c) (FOREACH_body f) (xs,\\<sigma>0); \n  RETURN \\<sigma> }\"\n\ntext {* Foreach with continuation condition and annotated invariant: *}\ndefinition FOREACHci (\"FOREACH\\<^sub>C\\<^bsup>_\\<^esup>\") where \"FOREACHci \\<equiv> FOREACHoci (\\<lambda>_ _. True)\"\n\ntext {* Foreach with continuation condition: *}\ndefinition FOREACHc (\"FOREACH\\<^sub>C\") where \"FOREACHc \\<equiv> FOREACHci (\\<lambda>_ _. True)\"\n\ntext {* Foreach with annotated invariant: *}\ndefinition FOREACHi (\"FOREACH\\<^bsup>_\\<^esup>\") where \n  \"FOREACHi \\<Phi> S \\<equiv> FOREACHci \\<Phi> S (\\<lambda>_. True)\"\n\ntext {* Foreach with annotated invariant and order: *}\ndefinition FOREACHoi (\"FOREACH\\<^sub>O\\<^bsup>_,_\\<^esup>\") where \n  \"FOREACHoi R \\<Phi> S \\<equiv> FOREACHoci R \\<Phi> S (\\<lambda>_. True)\"\n\ntext {* Basic foreach *}\ndefinition \"FOREACH S \\<equiv> FOREACHc S (\\<lambda>_. True)\"\n\nsubsection {* Proof Rules *}\n\nlemma FOREACHoci_rule[refine_vcg]:\n  assumes FIN: \"finite S\"\n  assumes I0: \"I S \\<sigma>0\"\n  assumes IP: \n    \"\\<And>x it \\<sigma>. \\<lbrakk> c \\<sigma>; x\\<in>it; it\\<subseteq>S; I it \\<sigma>; \\<forall>y\\<in>it - {x}. R x y;\n                \\<forall>y\\<in>S - it. R y x \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> SPEC (I (it-{x}))\"\n  assumes II1: \"\\<And>\\<sigma>. \\<lbrakk>I {} \\<sigma>\\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  assumes II2: \"\\<And>it \\<sigma>. \\<lbrakk> it\\<noteq>{}; it\\<subseteq>S; I it \\<sigma>; \\<not>c \\<sigma>;\n                         \\<forall>x\\<in>it. \\<forall>y\\<in>S - it. R y x \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"FOREACHoci R I S c f \\<sigma>0 \\<le> SPEC P\"\n  unfolding FOREACHoci_def\n  apply (intro refine_vcg)\n\n  apply (rule FIN)\n\n  apply (subgoal_tac \"wf (measure (\\<lambda>(xs, _). length xs))\")\n    apply assumption\n    apply simp\n\n  apply (insert I0, simp add: I0) []\n  unfolding FOREACH_body_def FOREACH_cond_def\n  apply (rule refine_vcg)+\n  apply ((simp, elim conjE exE)+) []\n  apply (rename_tac xs'' s xs' \\<sigma> xs)\ndefer\n  apply (simp, elim conjE exE)+\n  apply (rename_tac x s xs' \\<sigma> xs)\ndefer\nproof -\n  fix xs' \\<sigma> xs\n\n  assume I_xs': \"I (set xs') \\<sigma>\"\n     and sorted_xs_xs': \"sorted_by_rel R (xs @ xs')\"\n     and dist: \"distinct xs\" \"distinct xs'\" \"set xs \\<inter> set xs' = {}\"\n     and S_eq: \"S = set xs \\<union> set xs'\" \n\n  from S_eq have \"set xs' \\<subseteq> S\" by simp\n  from dist S_eq have S_diff: \"S - set xs' = set xs\" by blast\n\n  { assume \"xs' \\<noteq> []\" \"c \\<sigma>\"\n    from `xs' \\<noteq> []` obtain x xs'' where xs'_eq: \"xs' = x # xs''\" by (cases xs', auto)\n\n    have x_in_xs': \"x \\<in> set xs'\" and x_nin_xs'': \"x \\<notin> set xs''\" \n       using `distinct xs'` unfolding xs'_eq by simp_all\n  \n    from IP[of \\<sigma> x \"set xs'\", OF `c \\<sigma>` x_in_xs' `set xs' \\<subseteq> S` `I (set xs') \\<sigma>`] x_nin_xs''\n         sorted_xs_xs' S_diff\n    show \"f (hd xs') \\<sigma> \\<le> SPEC\n            (\\<lambda>x. (\\<exists>xs'a. xs @ xs' = xs'a @ tl xs') \\<and>\n                 I (set (tl xs')) x)\"\n      apply (simp add: xs'_eq)\n      apply (simp add: sorted_by_rel_append)\n    done\n  }\n\n  { assume \"xs' = [] \\<or> \\<not>(c \\<sigma>)\"\n    show \"P \\<sigma>\" \n    proof (cases \"xs' = []\")\n      case True thus \"P \\<sigma>\" using `I (set xs') \\<sigma>` by (simp add: II1)\n    next\n      case False note xs'_neq_nil = this\n      with `xs' = [] \\<or> \\<not> c \\<sigma>` have \"\\<not> c \\<sigma>\" by simp\n \n      from II2 [of \"set xs'\" \\<sigma>] S_diff sorted_xs_xs'\n      show \"P \\<sigma>\" \n        apply (simp add: xs'_neq_nil S_eq `\\<not> c \\<sigma>` I_xs')\n        apply (simp add: sorted_by_rel_append)\n      done\n    qed\n  }\nqed\n\nlemma FOREACHoi_rule[refine_vcg]:\n  assumes FIN: \"finite S\"\n  assumes I0: \"I S \\<sigma>0\"\n  assumes IP: \n    \"\\<And>x it \\<sigma>. \\<lbrakk> x\\<in>it; it\\<subseteq>S; I it \\<sigma>; \\<forall>y\\<in>it - {x}. R x y;\n                \\<forall>y\\<in>S - it. R y x \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> SPEC (I (it-{x}))\"\n  assumes II1: \"\\<And>\\<sigma>. \\<lbrakk>I {} \\<sigma>\\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"FOREACHoi R I S f \\<sigma>0 \\<le> SPEC P\"\n  unfolding FOREACHoi_def \n  by (rule FOREACHoci_rule) (simp_all add: assms)\n\nlemma FOREACHci_rule[refine_vcg]:\n  assumes FIN: \"finite S\"\n  assumes I0: \"I S \\<sigma>0\"\n  assumes IP: \n    \"\\<And>x it \\<sigma>. \\<lbrakk> x\\<in>it; it\\<subseteq>S; I it \\<sigma>; c \\<sigma> \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> SPEC (I (it-{x}))\"\n  assumes II1: \"\\<And>\\<sigma>. \\<lbrakk>I {} \\<sigma>\\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  assumes II2: \"\\<And>it \\<sigma>. \\<lbrakk> it\\<noteq>{}; it\\<subseteq>S; I it \\<sigma>; \\<not>c \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"FOREACHci I S c f \\<sigma>0 \\<le> SPEC P\"\n  unfolding FOREACHci_def\n  by (rule FOREACHoci_rule) (simp_all add: assms)\n\nsubsubsection {* Refinement: *}\n\ntext {*\n  Refinement rule using a coupling invariant over sets of remaining\n  items and the state.\n*}\n\nlemma FOREACHoci_refine_genR:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\" -- \"Abstraction mapping of elements\"\n  fixes S :: \"'S set\" -- \"Concrete set\"\n  fixes S' :: \"'Sa set\" -- \"Abstract set\"\n  fixes \\<sigma>0 :: \"'\\<sigma>\"\n  fixes \\<sigma>0' :: \"'\\<sigma>a\"\n  fixes R :: \"(('S set \\<times> '\\<sigma>) \\<times> ('Sa set \\<times> '\\<sigma>a)) set\"\n  assumes INJ: \"inj_on \\<alpha> S\" \n  assumes REFS[simp]: \"S' = \\<alpha>`S\"\n  assumes RR_OK: \"\\<And>x y. \\<lbrakk>x \\<in> S; y \\<in> S; RR x y\\<rbrakk> \\<Longrightarrow> RR' (\\<alpha> x) (\\<alpha> y)\"\n  assumes REF0: \"((S,\\<sigma>0),(\\<alpha>`S,\\<sigma>0')) \\<in> R\"\n  assumes REFC: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; \\<Phi> it \\<sigma>; \n    \\<forall>x\\<in>S-it. \\<forall>y\\<in>it. RR x y; \\<forall>x\\<in>S'-it'. \\<forall>y\\<in>it'. RR' x y;\n    it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R\n  \\<rbrakk> \\<Longrightarrow> c \\<sigma> \\<longleftrightarrow> c' \\<sigma>'\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>';\n    \\<forall>x\\<in>S-it. \\<forall>y\\<in>it. RR x y; \\<forall>x\\<in>S'-it'. \\<forall>y\\<in>it'. RR' x y;\n    it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk>\n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';\n    \\<forall>x\\<in>S-it. \\<forall>y\\<in>it. RR x y; \\<forall>x\\<in>S'-it'. \\<forall>y\\<in>it'. RR' x y;\n    x'=\\<alpha> x; it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R;\n    x\\<in>it; \\<forall>y\\<in>it-{x}. RR x y;\n    x'\\<in>it'; \\<forall>y'\\<in>it'-{x'}. RR' x' y';\n    c \\<sigma>; c' \\<sigma>'\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). ((it-{x},\\<sigma>),(it'-{x'},\\<sigma>'))\\<in>R}) (f' x' \\<sigma>')\"\n  assumes REF_R_DONE: \"\\<And>\\<sigma> \\<sigma>'. \\<lbrakk> \\<Phi> {} \\<sigma>; \\<Phi>' {} \\<sigma>'; (({},\\<sigma>),({},\\<sigma>'))\\<in>R \\<rbrakk> \n    \\<Longrightarrow> (\\<sigma>,\\<sigma>')\\<in>R'\"\n  assumes REF_R_BRK: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';\n    \\<forall>x\\<in>S-it. \\<forall>y\\<in>it. RR x y; \\<forall>x\\<in>S'-it'. \\<forall>y\\<in>it'. RR' x y;\n    it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R;\n    it\\<noteq>{}; it'\\<noteq>{};\n    \\<not>c \\<sigma>; \\<not>c' \\<sigma>'\n  \\<rbrakk> \\<Longrightarrow> (\\<sigma>,\\<sigma>')\\<in>R'\"\n  assumes SV: \"single_valued { ((it,\\<sigma>),(it',\\<sigma>')) . \n    it'=\\<alpha>`it \\<and> ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R }\"\n  assumes SV': \"single_valued R'\"\n  shows \"FOREACHoci RR \\<Phi> S c f \\<sigma>0 \\<le> \\<Down>R' (FOREACHoci RR' \\<Phi>' S' c' f' \\<sigma>0')\"\n  (* TODO: Clean up this mess !!! *)\n  unfolding FOREACHoci_def\n  apply (refine_rcg WHILEIT_refine_genR[where \n    R'=\"{((xs,\\<sigma>),(xs',\\<sigma>')) . \n      xs'=map \\<alpha> xs \\<and> \n      set xs \\<subseteq> S \\<and> set xs' \\<subseteq> S' \\<and>\n      (\\<forall>x\\<in>S - set xs. \\<forall>y\\<in>set xs. RR x y) \\<and>\n      (\\<forall>x\\<in>S' - set xs'. \\<forall>y\\<in>set xs'. RR' x y) \\<and>\n      ((set xs,\\<sigma>),(set xs',\\<sigma>')) \\<in> R }\"\n    ])\n\n  using REFS INJ apply (auto dest: finite_imageD) []\n  apply (rule intro_prgR[where R=\"{(xs,xs') . xs'=map \\<alpha> xs }\"])\n  apply (rule SPEC_refine_sv)\n  apply (auto simp: single_valued_def) []\n  using INJ RR_OK \n  apply (auto \n    simp add: distinct_map sorted_by_rel_map \n    intro: sorted_by_rel_weaken[of _ RR]) []\n  using REF0 apply auto []\n  defer\n\n  apply simp apply (rule conjI)\n  using INJ apply clarsimp\n  apply (erule map_eq_concE)\n  apply clarsimp\n  apply (rule_tac x=l in exI)\n  apply simp\n  apply (subst inj_on_map_eq_map[where f=\\<alpha>,symmetric])\n  apply (rule subset_inj_on, assumption, blast)\n  apply assumption\n\n  apply (simp split: prod.split_asm, elim conjE)\n  apply (rule REFPHI, auto) []\n\n  apply (simp add: FOREACH_cond_def split: prod.split prod.split_asm, \n    intro allI impI conj_cong) []\n  apply auto []\n  apply (rule REFC, auto) []\n\n  unfolding FOREACH_body_def\n  apply refine_rcg\n  apply (rule REFSTEP) []\n  prefer 3 apply auto []\n  prefer 3 apply auto []\n  apply simp_all[13]\n  apply auto []\n  apply (rename_tac a b d e f g h i) \n  apply (case_tac h, auto simp: FOREACH_cond_def) []\n  apply auto []\n  apply (auto simp: FOREACH_cond_def) []\n  apply (clarsimp simp: FOREACH_cond_def)\n  apply (rule ccontr)\n  apply (rename_tac a b d e f)\n  apply (case_tac b)\n  apply (auto simp: sorted_by_rel_append) [2]\n\n  apply (auto simp: FOREACH_cond_def) []\n  apply (rename_tac a b d e)\n  apply (case_tac b)\n  apply (auto) [2]\n\n  apply (clarsimp simp: FOREACH_cond_def)\n  apply (rule ccontr)\n  apply (rename_tac a b d e f)\n  apply (case_tac b)\n  apply (auto simp: sorted_by_rel_append) [2]\n\n  apply (clarsimp simp: FOREACH_cond_def)\n  apply (clarsimp simp: FOREACH_cond_def)\n  \n  using SV apply (auto simp: single_valued_def) []\n  \n  apply (clarsimp simp: map_tl)\n  apply (intro conjI)\n\n  apply (rename_tac a b d e f g)\n  apply (case_tac b, auto) []\n  apply (rename_tac a b d e f g)\n  apply (case_tac b, auto) []\n  apply (rename_tac a b d e f g)\n  apply (case_tac b, auto simp: sorted_by_rel_append) []\n  apply (rename_tac a b d e f g)\n  apply (case_tac b, auto simp: sorted_by_rel_append) []\n  apply (rename_tac a b d e f g)\n  apply (case_tac b, auto) []\n\n  apply (rule introR[where R=\"{((xs,\\<sigma>),(xs',\\<sigma>')). \n      xs'=map \\<alpha> xs \\<and> \\<Phi> (set xs) \\<sigma> \\<and> \\<Phi>' (set xs') \\<sigma>' \\<and>\n      set xs \\<subseteq> S \\<and> set xs' \\<subseteq> S' \\<and>\n      (\\<forall>x\\<in>S - set xs. \\<forall>y\\<in>set xs. RR x y) \\<and>\n      (\\<forall>x\\<in>S' - set xs'. \\<forall>y\\<in>set xs'. RR' x y) \\<and>\n      ((set xs,\\<sigma>),(set xs',\\<sigma>')) \\<in> R \\<and>\n      \\<not> FOREACH_cond c (xs,\\<sigma>) \\<and> \\<not> FOREACH_cond c' (xs',\\<sigma>')\n    }\n    \"])\n  apply auto []\n  apply (rule SV')\n  apply (simp add: FOREACH_cond_def, elim conjE)\n  apply (elim disjE1, simp_all) []\n  using REF_R_DONE apply auto []\n  using REF_R_BRK apply auto []\n\n  using SV apply (auto simp: single_valued_def) []\n  done\n\nlemma FOREACHoci_refine:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes RR_OK: \"\\<And>x y. \\<lbrakk>x \\<in> S; y \\<in> S; RR x y\\<rbrakk> \\<Longrightarrow> RR' (\\<alpha> x) (\\<alpha> y)\"\n  assumes REFPHI0: \"\\<Phi>'' S \\<sigma>0 (\\<alpha>`S) \\<sigma>0'\"\n  assumes REFC: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>';  \\<Phi>'' it \\<sigma> it' \\<sigma>'; \\<Phi> it \\<sigma>; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> c \\<sigma> \\<longleftrightarrow> c' \\<sigma>'\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; \\<Phi>'' it \\<sigma> it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk>\\<forall>y\\<in>it-{x}. RR x y; \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';  \\<Phi>'' it \\<sigma> it' \\<sigma>'; c \\<sigma>; c' \\<sigma>';\n    (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). (\\<sigma>, \\<sigma>') \\<in> R \\<and> \\<Phi>'' (it - {x}) \\<sigma> (it' - {x'}) \\<sigma>'}) (f' x' \\<sigma>')\"\n  shows \"FOREACHoci RR \\<Phi> S c f \\<sigma>0 \\<le> \\<Down>R (FOREACHoci RR' \\<Phi>' S' c' f' \\<sigma>0')\"\n\n  apply (rule FOREACHoci_refine_genR[\n    where R = \"{((it,\\<sigma>),(it',\\<sigma>')). (\\<sigma>,\\<sigma>')\\<in>R \\<and> \\<Phi>'' it \\<sigma> it' \\<sigma>'}\"\n    ])\n  apply fact\n  apply fact\n  apply fact\n  using REF0 REFPHI0 apply blast\n  using REFC apply auto []\n  using REFPHI apply auto []\n  using REFSTEP apply auto []\n  apply auto []\n  apply auto []\n  using SV apply (auto simp: single_valued_def) []\n  apply fact\n  done\n \nlemma FOREACHoci_refine_rcg[refine]:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes RR_OK: \"\\<And>x y. \\<lbrakk>x \\<in> S; y \\<in> S; RR x y\\<rbrakk> \\<Longrightarrow> RR' (\\<alpha> x) (\\<alpha> y)\"\n  assumes SV: \"single_valued R\"\n  assumes REFC: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; \\<Phi> it \\<sigma>; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> c \\<sigma> \\<longleftrightarrow> c' \\<sigma>'\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \\<forall>y\\<in>it-{x}. RR x y;\n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>'; c \\<sigma>; c' \\<sigma>';\n    (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> \\<Down>R (f' x' \\<sigma>')\"\n  shows \"FOREACHoci RR \\<Phi> S c f \\<sigma>0 \\<le> \\<Down>R (FOREACHoci RR' \\<Phi>' S' c' f' \\<sigma>0')\"\n  apply (rule FOREACHoci_refine[where \\<Phi>''=\"\\<lambda>_ _ _ _. True\"])\n  apply (rule assms)+\n  using assms by simp_all\n\nlemma FOREACHoci_weaken:\n  assumes IREF: \"\\<And>it \\<sigma>. it\\<subseteq>S \\<Longrightarrow> I it \\<sigma> \\<Longrightarrow> I' it \\<sigma>\"\n  shows \"FOREACHoci RR I' S c f \\<sigma>0 \\<le> FOREACHoci RR I S c f \\<sigma>0\"\n  apply (rule FOREACHoci_refine_rcg[where \\<alpha>=id and R=Id, simplified])\n  apply (auto intro: IREF)\n  done\n\nlemma FOREACHoci_weaken_order:\n  assumes RRREF: \"\\<And>x y. x \\<in> S \\<Longrightarrow> y \\<in> S \\<Longrightarrow> RR x y \\<Longrightarrow> RR' x y\"\n  shows \"FOREACHoci RR I S c f \\<sigma>0 \\<le> FOREACHoci RR' I S c f \\<sigma>0\"\n  apply (rule FOREACHoci_refine_rcg[where \\<alpha>=id and R=Id, simplified])\n  apply (auto intro: RRREF)\n  done\n\n\nsubsubsection {* Rules for Derived Constructs *}\n\nlemma FOREACHoi_refine_genR:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\" -- \"Abstraction mapping of elements\"\n  fixes S :: \"'S set\" -- \"Concrete set\"\n  fixes S' :: \"'Sa set\" -- \"Abstract set\"\n  fixes \\<sigma>0 :: \"'\\<sigma>\"\n  fixes \\<sigma>0' :: \"'\\<sigma>a\"\n  fixes R :: \"(('S set \\<times> '\\<sigma>) \\<times> ('Sa set \\<times> '\\<sigma>a)) set\"\n  assumes INJ: \"inj_on \\<alpha> S\" \n  assumes REFS[simp]: \"S' = \\<alpha>`S\"\n  assumes RR_OK: \"\\<And>x y. \\<lbrakk>x \\<in> S; y \\<in> S; RR x y\\<rbrakk> \\<Longrightarrow> RR' (\\<alpha> x) (\\<alpha> y)\"\n  assumes REF0: \"((S,\\<sigma>0),(\\<alpha>`S,\\<sigma>0')) \\<in> R\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>';\n    \\<forall>x\\<in>S-it. \\<forall>y\\<in>it. RR x y; \\<forall>x\\<in>S'-it'. \\<forall>y\\<in>it'. RR' x y;\n    it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk>\n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';\n    \\<forall>x\\<in>S-it. \\<forall>y\\<in>it. RR x y; \\<forall>x\\<in>S'-it'. \\<forall>y\\<in>it'. RR' x y;\n    x'=\\<alpha> x; it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R;\n    x\\<in>it; \\<forall>y\\<in>it-{x}. RR x y;\n    x'\\<in>it'; \\<forall>y'\\<in>it'-{x'}. RR' x' y'\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). ((it-{x},\\<sigma>),(it'-{x'},\\<sigma>'))\\<in>R}) (f' x' \\<sigma>')\"\n  assumes REF_R_DONE: \"\\<And>\\<sigma> \\<sigma>'. \\<lbrakk> \\<Phi> {} \\<sigma>; \\<Phi>' {} \\<sigma>'; (({},\\<sigma>),({},\\<sigma>'))\\<in>R \\<rbrakk> \n    \\<Longrightarrow> (\\<sigma>,\\<sigma>')\\<in>R'\"\n  assumes SV: \"single_valued { ((it,\\<sigma>),(it',\\<sigma>')) . \n    it'=\\<alpha>`it \\<and> ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R }\"\n  assumes SV': \"single_valued R'\"\n  shows \"FOREACHoi RR \\<Phi> S f \\<sigma>0 \\<le> \\<Down>R' (FOREACHoi RR' \\<Phi>' S' f' \\<sigma>0')\"\n  unfolding FOREACHoi_def\n  apply (rule FOREACHoci_refine_genR)\n  apply (fact | simp)+\n  using REFSTEP apply auto []\n  apply (fact | simp)+\n  done\n\nlemma FOREACHoi_refine:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes RR_OK: \"\\<And>x y. \\<lbrakk>x \\<in> S; y \\<in> S; RR x y\\<rbrakk> \\<Longrightarrow> RR' (\\<alpha> x) (\\<alpha> y)\"\n  assumes REFPHI0: \"\\<Phi>'' S \\<sigma>0 (\\<alpha>`S) \\<sigma>0'\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; \\<Phi>'' it \\<sigma> it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk>\\<forall>y\\<in>it-{x}. RR x y; \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';  \\<Phi>'' it \\<sigma> it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). (\\<sigma>, \\<sigma>') \\<in> R \\<and> \\<Phi>'' (it - {x}) \\<sigma> (it' - {x'}) \\<sigma>'}) (f' x' \\<sigma>')\"\n  shows \"FOREACHoi RR \\<Phi> S f \\<sigma>0 \\<le> \\<Down>R (FOREACHoi RR' \\<Phi>' S' f' \\<sigma>0')\"\n  unfolding FOREACHoi_def\n  apply (rule FOREACHoci_refine [of \\<alpha> _ _ _ _ _ _ _ \\<Phi>''])\n  apply (simp_all add: assms)\ndone\n\nlemma FOREACHoi_refine_rcg[refine]:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes RR_OK: \"\\<And>x y. \\<lbrakk>x \\<in> S; y \\<in> S; RR x y\\<rbrakk> \\<Longrightarrow> RR' (\\<alpha> x) (\\<alpha> y)\"\n  assumes SV: \"single_valued R\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \\<forall>y\\<in>it-{x}. RR x y;\n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> \\<Down>R (f' x' \\<sigma>')\"\n  shows \"FOREACHoi RR \\<Phi> S f \\<sigma>0 \\<le> \\<Down>R (FOREACHoi RR' \\<Phi>' S' f' \\<sigma>0')\"\n  apply (rule FOREACHoi_refine[where \\<Phi>''=\"\\<lambda>_ _ _ _. True\"])\n  apply (rule assms)+\n  using assms by simp_all\n\nlemma FOREACHci_refine_genR:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\" -- \"Abstraction mapping of elements\"\n  fixes S :: \"'S set\" -- \"Concrete set\"\n  fixes S' :: \"'Sa set\" -- \"Abstract set\"\n  fixes \\<sigma>0 :: \"'\\<sigma>\"\n  fixes \\<sigma>0' :: \"'\\<sigma>a\"\n  fixes R :: \"(('S set \\<times> '\\<sigma>) \\<times> ('Sa set \\<times> '\\<sigma>a)) set\"\n  assumes INJ: \"inj_on \\<alpha> S\" \n  assumes REFS[simp]: \"S' = \\<alpha>`S\"\n  assumes REF0: \"((S,\\<sigma>0),(\\<alpha>`S,\\<sigma>0')) \\<in> R\"\n  assumes REFC: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; \\<Phi> it \\<sigma>; \n    it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R\n  \\<rbrakk> \\<Longrightarrow> c \\<sigma> \\<longleftrightarrow> c' \\<sigma>'\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>';\n    it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk>\n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';\n    x'=\\<alpha> x; it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R;\n    x\\<in>it; x'\\<in>it';\n    c \\<sigma>; c' \\<sigma>'\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). ((it-{x},\\<sigma>),(it'-{x'},\\<sigma>'))\\<in>R}) (f' x' \\<sigma>')\"\n  assumes REF_R_DONE: \"\\<And>\\<sigma> \\<sigma>'. \\<lbrakk> \\<Phi> {} \\<sigma>; \\<Phi>' {} \\<sigma>'; (({},\\<sigma>),({},\\<sigma>'))\\<in>R \\<rbrakk> \n    \\<Longrightarrow> (\\<sigma>,\\<sigma>')\\<in>R'\"\n  assumes REF_R_BRK: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';\n    it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R;\n    it\\<noteq>{}; it'\\<noteq>{};\n    \\<not>c \\<sigma>; \\<not>c' \\<sigma>'\n  \\<rbrakk> \\<Longrightarrow> (\\<sigma>,\\<sigma>')\\<in>R'\"\n  assumes SV: \"single_valued { ((it,\\<sigma>),(it',\\<sigma>')) . \n    it'=\\<alpha>`it \\<and> ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R }\"\n  assumes SV': \"single_valued R'\"\n  shows \"FOREACHci \\<Phi> S c f \\<sigma>0 \\<le> \\<Down>R' (FOREACHci \\<Phi>' S' c' f' \\<sigma>0')\"\n  unfolding FOREACHci_def\n  apply (rule FOREACHoci_refine_genR)\n  apply (fact|simp)+\n  using REFC apply auto []\n  using REFPHI apply auto []\n  using REFSTEP apply auto []\n  apply (fact|simp)+\n  using REF_R_BRK apply auto []\n  apply (fact|simp)+\n  done\n\nlemma FOREACHci_refine:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes REFPHI0: \"\\<Phi>'' S \\<sigma>0 (\\<alpha>`S) \\<sigma>0'\"\n  assumes REFC: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>';  \\<Phi>'' it \\<sigma> it' \\<sigma>'; \\<Phi> it \\<sigma>; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> c \\<sigma> \\<longleftrightarrow> c' \\<sigma>'\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; \\<Phi>'' it \\<sigma> it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';  \\<Phi>'' it \\<sigma> it' \\<sigma>'; c \\<sigma>; c' \\<sigma>';\n    (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). (\\<sigma>, \\<sigma>') \\<in> R \\<and> \\<Phi>'' (it - {x}) \\<sigma> (it' - {x'}) \\<sigma>'}) (f' x' \\<sigma>')\"\n  shows \"FOREACHci \\<Phi> S c f \\<sigma>0 \\<le> \\<Down>R (FOREACHci \\<Phi>' S' c' f' \\<sigma>0')\"\n  unfolding FOREACHci_def\n  apply (rule FOREACHoci_refine [of \\<alpha> _ _ _ _ _ _ _ \\<Phi>''])\n  apply (simp_all add: assms)\ndone\n\nlemma FOREACHci_refine_rcg[refine]:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes REFC: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; \\<Phi> it \\<sigma>; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> c \\<sigma> \\<longleftrightarrow> c' \\<sigma>'\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>'; c \\<sigma>; c' \\<sigma>';\n    (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> \\<Down>R (f' x' \\<sigma>')\"\n  shows \"FOREACHci \\<Phi> S c f \\<sigma>0 \\<le> \\<Down>R (FOREACHci \\<Phi>' S' c' f' \\<sigma>0')\"\n  apply (rule FOREACHci_refine[where \\<Phi>''=\"\\<lambda>_ _ _ _. True\"])\n  apply (rule assms)+\n  using assms by auto\n\nlemma FOREACHci_weaken:\n  assumes IREF: \"\\<And>it \\<sigma>. it\\<subseteq>S \\<Longrightarrow> I it \\<sigma> \\<Longrightarrow> I' it \\<sigma>\"\n  shows \"FOREACHci I' S c f \\<sigma>0 \\<le> FOREACHci I S c f \\<sigma>0\"\n  apply (rule FOREACHci_refine_rcg[where \\<alpha>=id and R=Id, simplified])\n  apply (auto intro: IREF)\n  done\n\nlemma FOREACHi_rule[refine_vcg]:\n  assumes FIN: \"finite S\"\n  assumes I0: \"I S \\<sigma>0\"\n  assumes IP: \n    \"\\<And>x it \\<sigma>. \\<lbrakk> x\\<in>it; it\\<subseteq>S; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> SPEC (I (it-{x}))\"\n  assumes II: \"\\<And>\\<sigma>. \\<lbrakk>I {} \\<sigma>\\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"FOREACHi I S f \\<sigma>0 \\<le> SPEC P\"\n  unfolding FOREACHi_def\n  apply (rule FOREACHci_rule[of S I])\n  using assms by auto\n\n\n\nlemma FOREACH_rule:\n  assumes FIN: \"finite S\"\n  assumes I0: \"I S \\<sigma>0\"\n  assumes IP: \n    \"\\<And>x it \\<sigma>. \\<lbrakk> x\\<in>it; it\\<subseteq>S; I it \\<sigma> \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> SPEC (I (it-{x}))\"\n  assumes II: \"\\<And>\\<sigma>. \\<lbrakk>I {} \\<sigma>\\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"FOREACH S f \\<sigma>0 \\<le> SPEC P\"\n  unfolding FOREACH_def FOREACHc_def\n  apply (rule order_trans[OF FOREACHci_weaken], rule TrueI)\n  apply (rule FOREACHci_rule[where I=I])\n  using assms by auto\n\n\nlemma FOREACHc_refine_genR:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\" -- \"Abstraction mapping of elements\"\n  fixes S :: \"'S set\" -- \"Concrete set\"\n  fixes S' :: \"'Sa set\" -- \"Abstract set\"\n  fixes \\<sigma>0 :: \"'\\<sigma>\"\n  fixes \\<sigma>0' :: \"'\\<sigma>a\"\n  fixes R :: \"(('S set \\<times> '\\<sigma>) \\<times> ('Sa set \\<times> '\\<sigma>a)) set\"\n  assumes INJ: \"inj_on \\<alpha> S\" \n  assumes REFS[simp]: \"S' = \\<alpha>`S\"\n  assumes REF0: \"((S,\\<sigma>0),(\\<alpha>`S,\\<sigma>0')) \\<in> R\"\n  assumes REFC: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it\\<subseteq>S; it'\\<subseteq>S'; \n    it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R\n  \\<rbrakk> \\<Longrightarrow> c \\<sigma> \\<longleftrightarrow> c' \\<sigma>'\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk>\n    it\\<subseteq>S; it'\\<subseteq>S'; \n    x'=\\<alpha> x; it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R;\n    x\\<in>it; x'\\<in>it';\n    c \\<sigma>; c' \\<sigma>'\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). ((it-{x},\\<sigma>),(it'-{x'},\\<sigma>'))\\<in>R}) (f' x' \\<sigma>')\"\n  assumes REF_R_DONE: \"\\<And>\\<sigma> \\<sigma>'. \\<lbrakk> (({},\\<sigma>),({},\\<sigma>'))\\<in>R \\<rbrakk> \n    \\<Longrightarrow> (\\<sigma>,\\<sigma>')\\<in>R'\"\n  assumes REF_R_BRK: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it\\<subseteq>S; it'\\<subseteq>S'; \n    it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R;\n    it\\<noteq>{}; it'\\<noteq>{};\n    \\<not>c \\<sigma>; \\<not>c' \\<sigma>'\n  \\<rbrakk> \\<Longrightarrow> (\\<sigma>,\\<sigma>')\\<in>R'\"\n  assumes SV: \"single_valued { ((it,\\<sigma>),(it',\\<sigma>')) . \n    it'=\\<alpha>`it \\<and> ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R }\"\n  assumes SV': \"single_valued R'\"\n  shows \"FOREACHc S c f \\<sigma>0 \\<le> \\<Down>R' (FOREACHc S' c' f' \\<sigma>0')\"\n  unfolding FOREACHc_def\n  apply (rule FOREACHci_refine_genR)\n  apply simp_all\n  apply (fact|simp)+\n  using REFC apply auto []\n  using REFSTEP apply auto []\n  using REF_R_DONE apply auto []\n  using REF_R_BRK apply auto []\n  apply (fact|simp)+\n  done\n\nlemma FOREACHc_refine:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes REFPHI0: \"\\<Phi>'' S \\<sigma>0 (\\<alpha>`S) \\<sigma>0'\"\n  assumes REFC: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>'' it \\<sigma> it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> c \\<sigma> \\<longleftrightarrow> c' \\<sigma>'\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi>'' it \\<sigma> it' \\<sigma>'; c \\<sigma>; c' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). (\\<sigma>, \\<sigma>') \\<in> R \\<and> \\<Phi>'' (it - {x}) \\<sigma> (it' - {x'}) \\<sigma>'}) (f' x' \\<sigma>')\"\n  shows \"FOREACHc S c f \\<sigma>0 \\<le> \\<Down>R (FOREACHc S' c' f' \\<sigma>0')\"\n  unfolding FOREACHc_def\n  apply (rule FOREACHci_refine[where \\<Phi>''=\\<Phi>'', OF INJ REFS REF0 SV REFPHI0])\n  apply (erule (4) REFC)\n  apply (rule TrueI)\n  apply (erule (9) REFSTEP)\n  done\n\nlemma FOREACHc_refine_rcg[refine]:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes REFC: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> c \\<sigma> \\<longleftrightarrow> c' \\<sigma>'\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; c \\<sigma>; c' \\<sigma>';\n    (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> \\<Down>R (f' x' \\<sigma>')\"\n  shows \"FOREACHc S c f \\<sigma>0 \\<le> \\<Down>R (FOREACHc S' c' f' \\<sigma>0')\"\n  unfolding FOREACHc_def\n  apply (rule FOREACHci_refine_rcg)\n  apply (rule assms)+\n  using assms by auto\n\nlemma FOREACHi_refine_genR:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\" -- \"Abstraction mapping of elements\"\n  fixes S :: \"'S set\" -- \"Concrete set\"\n  fixes S' :: \"'Sa set\" -- \"Abstract set\"\n  fixes \\<sigma>0 :: \"'\\<sigma>\"\n  fixes \\<sigma>0' :: \"'\\<sigma>a\"\n  fixes R :: \"(('S set \\<times> '\\<sigma>) \\<times> ('Sa set \\<times> '\\<sigma>a)) set\"\n  assumes INJ: \"inj_on \\<alpha> S\" \n  assumes REFS[simp]: \"S' = \\<alpha>`S\"\n  assumes REF0: \"((S,\\<sigma>0),(\\<alpha>`S,\\<sigma>0')) \\<in> R\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>';\n    it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk>\n    it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';\n    x'=\\<alpha> x; it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R;\n    x\\<in>it; x'\\<in>it'\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). ((it-{x},\\<sigma>),(it'-{x'},\\<sigma>'))\\<in>R}) (f' x' \\<sigma>')\"\n  assumes REF_R_DONE: \"\\<And>\\<sigma> \\<sigma>'. \\<lbrakk> \\<Phi> {} \\<sigma>; \\<Phi>' {} \\<sigma>'; (({},\\<sigma>),({},\\<sigma>'))\\<in>R \\<rbrakk> \n    \\<Longrightarrow> (\\<sigma>,\\<sigma>')\\<in>R'\"\n  assumes SV: \"single_valued { ((it,\\<sigma>),(it',\\<sigma>')) . \n    it'=\\<alpha>`it \\<and> ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R }\"\n  assumes SV': \"single_valued R'\"\n  shows \"FOREACHi \\<Phi> S f \\<sigma>0 \\<le> \\<Down>R' (FOREACHi \\<Phi>' S' f' \\<sigma>0')\"\n  unfolding FOREACHi_def\n  apply (rule FOREACHci_refine_genR)\n  apply (fact|simp)+\n  using REFSTEP apply auto []\n  apply (fact|simp)+\n  done\n\nlemma FOREACHi_refine:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes REFPHI0: \"\\<Phi>'' S \\<sigma>0 (\\<alpha>`S) \\<sigma>0'\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; \\<Phi>'' it \\<sigma> it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';  \\<Phi>'' it \\<sigma> it' \\<sigma>';\n    (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). (\\<sigma>, \\<sigma>') \\<in> R \\<and> \\<Phi>'' (it - {x}) \\<sigma> (it' - {x'}) \\<sigma>'}) (f' x' \\<sigma>')\"\n  shows \"FOREACHi \\<Phi> S f \\<sigma>0 \\<le> \\<Down>R (FOREACHi \\<Phi>' S' f' \\<sigma>0')\"\n  unfolding FOREACHi_def\n  apply (rule FOREACHci_refine[where \\<Phi>''=\\<Phi>'', OF INJ REFS REF0 SV REFPHI0])\n  apply (rule refl)\n  apply (erule (5) REFPHI)\n  apply (erule (9) REFSTEP)\n  done\n\nlemma FOREACHi_refine_rcg[refine]:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes REFPHI: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> \\<Phi> it \\<sigma>\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi> it \\<sigma>; \\<Phi>' it' \\<sigma>';\n    (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> \\<Down>R (f' x' \\<sigma>')\"\n  shows \"FOREACHi \\<Phi> S f \\<sigma>0 \\<le> \\<Down>R (FOREACHi \\<Phi>' S' f' \\<sigma>0')\"\n  unfolding FOREACHi_def\n  apply (rule FOREACHci_refine_rcg)\n  apply (rule assms)+\n  using assms apply auto\n  done\n\nlemma FOREACH_refine_genR:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\" -- \"Abstraction mapping of elements\"\n  fixes S :: \"'S set\" -- \"Concrete set\"\n  fixes S' :: \"'Sa set\" -- \"Abstract set\"\n  fixes \\<sigma>0 :: \"'\\<sigma>\"\n  fixes \\<sigma>0' :: \"'\\<sigma>a\"\n  fixes R :: \"(('S set \\<times> '\\<sigma>) \\<times> ('Sa set \\<times> '\\<sigma>a)) set\"\n  assumes INJ: \"inj_on \\<alpha> S\" \n  assumes REFS[simp]: \"S' = \\<alpha>`S\"\n  assumes REF0: \"((S,\\<sigma>0),(\\<alpha>`S,\\<sigma>0')) \\<in> R\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk>\n    it\\<subseteq>S; it'\\<subseteq>S';\n    x'=\\<alpha> x; it'=\\<alpha>`it; ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R;\n    x\\<in>it; x'\\<in>it'\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). ((it-{x},\\<sigma>),(it'-{x'},\\<sigma>'))\\<in>R}) (f' x' \\<sigma>')\"\n  assumes REF_R_DONE: \"\\<And>\\<sigma> \\<sigma>'. \\<lbrakk> (({},\\<sigma>),({},\\<sigma>'))\\<in>R \\<rbrakk> \n    \\<Longrightarrow> (\\<sigma>,\\<sigma>')\\<in>R'\"\n  assumes SV: \"single_valued { ((it,\\<sigma>),(it',\\<sigma>')) . \n    it'=\\<alpha>`it \\<and> ((it,\\<sigma>),(it',\\<sigma>'))\\<in>R }\"\n  assumes SV': \"single_valued R'\"\n  shows \"FOREACH S f \\<sigma>0 \\<le> \\<Down>R' (FOREACH S' f' \\<sigma>0')\"\n  unfolding FOREACH_def\n  apply (rule FOREACHc_refine_genR)\n  apply (fact|simp)+\n  using REFSTEP apply auto []\n  apply (fact|simp)+\n  done\n\nlemma FOREACH_refine:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes REFPHI0: \"\\<Phi>'' S \\<sigma>0 (\\<alpha>`S) \\<sigma>0'\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi>'' it \\<sigma> it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \n    \\<le> \\<Down>({(\\<sigma>, \\<sigma>'). (\\<sigma>, \\<sigma>') \\<in> R \\<and> \\<Phi>'' (it - {x}) \\<sigma> (it' - {x'}) \\<sigma>'}) (f' x' \\<sigma>')\"\n  shows \"FOREACH S f \\<sigma>0 \\<le> \\<Down>R (FOREACH S' f' \\<sigma>0')\"\n  unfolding FOREACH_def\n  apply (rule FOREACHc_refine[where \\<Phi>''=\\<Phi>'', OF INJ REFS REF0 SV REFPHI0])\n  apply (rule refl)\n  apply (erule (7) REFSTEP)\n  done\n\nlemma FOREACH_refine_rcg[refine]:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> \\<Down>R (f' x' \\<sigma>')\"\n  shows \"FOREACH S f \\<sigma>0 \\<le> \\<Down>R (FOREACH S' f' \\<sigma>0')\"\n  unfolding FOREACH_def\n  apply (rule FOREACHc_refine_rcg)\n  apply (rule assms)+\n  using assms by auto\n\nlemma FOREACHci_refine_rcg'[refine]:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes REFC: \"\\<And>it \\<sigma> it' \\<sigma>'. \\<lbrakk> \n    it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S'; \\<Phi>' it' \\<sigma>'; (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> c \\<sigma> \\<longleftrightarrow> c' \\<sigma>'\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi>' it' \\<sigma>'; c \\<sigma>; c' \\<sigma>';\n    (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> \\<Down>R (f' x' \\<sigma>')\"\n  shows \"FOREACHc S c f \\<sigma>0 \\<le> \\<Down>R (FOREACHci \\<Phi>' S' c' f' \\<sigma>0')\"\n  unfolding FOREACHc_def\n  apply (rule FOREACHci_refine_rcg) \n  apply (rule assms)\n  apply (rule assms)\n  apply (rule assms)\n  apply (rule assms)\n  apply (erule (4) REFC)\n  apply (rule TrueI)\n  apply (rule REFSTEP, assumption+)\n  done\n\nlemma FOREACHi_refine_rcg'[refine]:\n  fixes \\<alpha> :: \"'S \\<Rightarrow> 'Sa\"\n  fixes S :: \"'S set\"\n  fixes S' :: \"'Sa set\"\n  assumes INJ: \"inj_on \\<alpha> S\"\n  assumes REFS: \"S' = \\<alpha>`S\"\n  assumes REF0: \"(\\<sigma>0,\\<sigma>0')\\<in>R\"\n  assumes SV: \"single_valued R\"\n  assumes REFSTEP: \"\\<And>x it \\<sigma> x' it' \\<sigma>'. \\<lbrakk> \n    x'=\\<alpha> x; x\\<in>it; x'\\<in>it'; it'=\\<alpha>`it; it\\<subseteq>S; it'\\<subseteq>S';\n    \\<Phi>' it' \\<sigma>';\n    (\\<sigma>,\\<sigma>')\\<in>R\n  \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> \\<Down>R (f' x' \\<sigma>')\"\n  shows \"FOREACH S f \\<sigma>0 \\<le> \\<Down>R (FOREACHi \\<Phi>' S' f' \\<sigma>0')\"\n  unfolding FOREACH_def FOREACHi_def\n  apply (rule FOREACHci_refine_rcg') \n  apply (rule assms)+\n  apply simp\n  apply (rule REFSTEP, assumption+)\n  done\n\nsubsubsection {* Alternative set of FOREACHc-rules *}\ntext {* Here, we provide an alternative set of FOREACH rules with \n  interruption. In some cases, they are easier to use, as they avoid \n  redundancy between the final cases for interruption and non-interruption *}\n\nlemma FOREACHoci_rule':\n  assumes FIN: \"finite S\"\n  assumes I0: \"I S \\<sigma>0\"\n  assumes IP: \n    \"\\<And>x it \\<sigma>. \\<lbrakk> c \\<sigma>; x\\<in>it; it\\<subseteq>S; I it \\<sigma>; \\<forall>y\\<in>it - {x}. R x y;\n                \\<forall>y\\<in>S - it. R y x \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> SPEC (I (it-{x}))\"\n  assumes II1: \"\\<And>\\<sigma>. \\<lbrakk>I {} \\<sigma>; c \\<sigma>\\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  assumes II2: \"\\<And>it \\<sigma>. \\<lbrakk> it\\<subseteq>S; I it \\<sigma>; \\<not>c \\<sigma>;\n                         \\<forall>x\\<in>it. \\<forall>y\\<in>S - it. R y x \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"FOREACHoci R I S c f \\<sigma>0 \\<le> SPEC P\"\n  apply (rule FOREACHoci_rule[OF FIN, where I=I, OF I0])\n  apply (rule IP, assumption+)\n  apply (case_tac \"c \\<sigma>\")\n  apply (blast intro: II1)\n  apply (blast intro: II2)\n  apply (blast intro: II2)\n  done\n  \nlemma FOREACHci_rule'[refine_vcg]:\n  assumes FIN: \"finite S\"\n  assumes I0: \"I S \\<sigma>0\"\n  assumes IP: \n    \"\\<And>x it \\<sigma>. \\<lbrakk> x\\<in>it; it\\<subseteq>S; I it \\<sigma>; c \\<sigma> \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> SPEC (I (it-{x}))\"\n  assumes II1: \"\\<And>\\<sigma>. \\<lbrakk>I {} \\<sigma>; c \\<sigma>\\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  assumes II2: \"\\<And>it \\<sigma>. \\<lbrakk> it\\<subseteq>S; I it \\<sigma>; \\<not>c \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"FOREACHci I S c f \\<sigma>0 \\<le> SPEC P\"\n  unfolding FOREACHci_def\n  by (rule FOREACHoci_rule') (simp_all add: assms)\n\nlemma FOREACHc_rule':\n  assumes FIN: \"finite S\"\n  assumes I0: \"I S \\<sigma>0\"\n  assumes IP: \n    \"\\<And>x it \\<sigma>. \\<lbrakk> x\\<in>it; it\\<subseteq>S; I it \\<sigma>; c \\<sigma> \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> SPEC (I (it-{x}))\"\n  assumes II1: \"\\<And>\\<sigma>. \\<lbrakk>I {} \\<sigma>; c \\<sigma>\\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  assumes II2: \"\\<And>it \\<sigma>. \\<lbrakk> it\\<subseteq>S; I it \\<sigma>; \\<not>c \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"FOREACHc S c f \\<sigma>0 \\<le> SPEC P\"\n  unfolding FOREACHc_def\n  apply (rule order_trans[OF FOREACHci_weaken], rule TrueI)\n  apply (rule FOREACHci_rule'[where I=I])\n  using assms by auto\n\n\n\nsubsection {* FOREACH with empty sets *}\n\nlemma FOREACHoci_emp [simp] :\n  \"FOREACHoci R \\<Phi> {} c f \\<sigma> = do {ASSERT (\\<Phi> {} \\<sigma>); RETURN \\<sigma>}\"\napply (simp add: FOREACHoci_def bind_RES image_def)\napply (simp add: WHILEIT_unfold FOREACH_cond_def)\ndone\n\nlemma FOREACHoi_emp [simp] :\n  \"FOREACHoi R \\<Phi> {} f \\<sigma> = do {ASSERT (\\<Phi> {} \\<sigma>); RETURN \\<sigma>}\"\nby (simp add: FOREACHoi_def)\n\nlemma FOREACHci_emp [simp] :\n  \"FOREACHci \\<Phi> {} c f \\<sigma> = do {ASSERT (\\<Phi> {} \\<sigma>); RETURN \\<sigma>}\"\nby (simp add: FOREACHci_def)\n\nlemma FOREACHc_emp [simp] :\n  \"FOREACHc {} c f \\<sigma> = RETURN \\<sigma>\"\nby (simp add: FOREACHc_def)\n\nlemma FOREACH_emp [simp] :\n  \"FOREACH {} f \\<sigma> = RETURN \\<sigma>\"\nby (simp add: FOREACH_def)\n\nlemma FOREACHi_emp [simp] :\n  \"FOREACHi \\<Phi> {} f \\<sigma> = do {ASSERT (\\<Phi> {} \\<sigma>); RETURN \\<sigma>}\"\nby (simp add: FOREACHi_def)\n\nsubsubsection \"Monotonicity\"\n\nlemma FOREACHoci_mono[refine_mono]:\n  assumes \"\\<And>x. f x \\<le> f' x\"\n  shows \"FOREACHoci I S R c f s0 \\<le> FOREACHoci I S R c f' s0\"\n  using assms apply -\n  unfolding FOREACHoci_def FOREACH_body_def\n  apply (refine_mono)\n  done\nlemma FOREACHoi_mono[refine_mono]:\n  assumes \"\\<And>x. f x \\<le> f' x\"\n  shows \"FOREACHoi I S R f s0 \\<le> FOREACHoi I S R f' s0\"\n  using assms apply -\n  unfolding FOREACHoi_def FOREACH_body_def\n  apply (refine_mono)\n  done\nlemma FOREACHci_mono[refine_mono]:\n  assumes \"\\<And>x. f x \\<le> f' x\"\n  shows \"FOREACHci I S c f s0 \\<le> FOREACHci I S c f' s0\"\n  using assms apply -\n  unfolding FOREACHci_def FOREACH_body_def\n  apply (refine_mono)\n  done\nlemma FOREACHc_mono[refine_mono]:\n  assumes \"\\<And>x. f x \\<le> f' x\"\n  shows \"FOREACHc S c f s0 \\<le> FOREACHc S c f' s0\"\n  using assms apply -\n  unfolding FOREACHc_def \n  apply (refine_mono)\n  done\nlemma FOREACHi_mono[refine_mono]:\n  assumes \"\\<And>x. f x \\<le> f' x\"\n  shows \"FOREACHi I S f s0 \\<le> FOREACHi I S f' s0\"\n  using assms apply -\n  unfolding FOREACHi_def \n  apply (refine_mono)\n  done\nlemma FOREACH_mono[refine_mono]:\n  assumes \"\\<And>x. f x \\<le> f' x\"\n  shows \"FOREACH S f s0 \\<le> FOREACH S f' s0\"\n  using assms apply -\n  unfolding FOREACH_def \n  apply (refine_mono)\n  done\n\nsubsubsection {* Transfer to fold *}\ntext {*\n  A foreach-loop can be conveniently expressed as an operation that converts\n  the set to a list, followed by folding over the list.\n  \n  This representation is handy for automatic refinement, as the complex \n  foreach-operation is expressed by two relatively simple operations.\n*}\n\ntext {* We first define a fold-function in the nres-monad *}\npartial_function (nrec) nfoldli where\n  \"nfoldli l c f s = (case l of \n    [] \\<Rightarrow> RETURN s \n    | x#ls \\<Rightarrow> if c s then do { s\\<leftarrow>f x s; nfoldli ls c f s} else RETURN s\n  )\"\n\nlemma nfoldli_simps[simp]:\n  \"nfoldli [] c f s = RETURN s\"\n  \"nfoldli (x#ls) c f s = \n    (if c s then do { s\\<leftarrow>f x s; nfoldli ls c f s} else RETURN s)\"\n  apply (subst nfoldli.simps, simp)+\n  done\n  \nlemma param_nfoldli[param]:\n  assumes \"single_valued Rb\"\n  shows \"(nfoldli,nfoldli) \\<in> \n    \\<langle>Ra\\<rangle>list_rel \\<rightarrow> (Rb\\<rightarrow>Id) \\<rightarrow> (Ra\\<rightarrow>Rb\\<rightarrow>\\<langle>Rb\\<rangle>nres_rel) \\<rightarrow> Rb \\<rightarrow> \\<langle>Rb\\<rangle>nres_rel\"\n  apply (intro fun_relI)\nproof -\n  case (goal1 l l' c c' f f' s s')\n  thus ?case\n    apply (induct arbitrary: s s')\n    using assms\n    apply -\n    apply (simp only: nfoldli_simps True_implies_equals)\n    apply parametricity\n    apply (simp only: nfoldli_simps True_implies_equals)\n    apply (parametricity)\n    done\nqed\n\ntext {* The fold-function over the nres-monad is transfered to a plain \n  foldli function *}\nlemma nfoldli_transfer_plain[refine_transfer]:\n  assumes \"\\<And>x s. RETURN (f x s) \\<le> f' x s\"\n  shows \"RETURN (foldli l c f s) \\<le> (nfoldli l c f' s)\"\n  using assms\n  apply (induct l arbitrary: s)\n  apply (auto)\n  by (metis (lifting) plain_bind)\n\nlemma nfoldli_transfer_dres[refine_transfer]:\n  fixes l :: \"'a list\" and c:: \"'b \\<Rightarrow> bool\"\n  assumes FR: \"\\<And>x s. nres_of (f x s) \\<le> f' x s\"\n  shows \"nres_of \n    (foldli l (case_dres False False c) (\\<lambda>x s. s\\<guillemotright>=f x) (dRETURN s)) \n    \\<le> (nfoldli l c f' s)\"\nproof (induct l arbitrary: s)\n  case Nil thus ?case by auto\nnext\n  case (Cons a l)\n  thus ?case\n    apply (auto)\n    apply (cases \"f a s\")\n    apply (cases l, simp_all) []\n    apply simp\n    apply (rule order_trans[rotated])\n    apply (rule bind_mono)\n    apply (rule FR)\n    apply assumption\n    apply simp\n    apply simp\n    using FR[of a s]\n    apply simp\n    done\nqed\n\n\n\ntext {* We relate our fold-function to the while-loop that we used in\n  the original definition of the foreach-loop *}\nlemma nfoldli_while: \"nfoldli l c f \\<sigma>\n          \\<le>\n         (WHILE\\<^sub>T\\<^bsup>I\\<^esup>\n           (FOREACH_cond c) (FOREACH_body f) (l, \\<sigma>) \\<guillemotright>=\n          (\\<lambda>(_, \\<sigma>). RETURN \\<sigma>))\"\nproof (induct l arbitrary: \\<sigma>)\n  case Nil thus ?case by (subst WHILEIT_unfold) (auto simp: FOREACH_cond_def)\nnext\n  case (Cons x ls)\n  show ?case\n  proof (cases \"c \\<sigma>\")\n    case False thus ?thesis\n      apply (subst WHILEIT_unfold)\n      unfolding FOREACH_cond_def\n      by simp\n  next\n    case True[simp]\n    from Cons show ?thesis\n      apply (subst WHILEIT_unfold)\n      unfolding FOREACH_cond_def FOREACH_body_def\n      apply clarsimp\n      apply (rule Refine_Basic.bind_mono)\n      apply simp_all\n      done\n  qed\nqed\n\nlemma while_nfoldli:\n  \"do {\n    (_,\\<sigma>) \\<leftarrow> WHILE\\<^sub>T (FOREACH_cond c) (FOREACH_body f) (l,\\<sigma>);\n    RETURN \\<sigma>\n  } \\<le> nfoldli l c f \\<sigma>\"\n  apply (induct l arbitrary: \\<sigma>)\n  apply (subst WHILET_unfold)\n  apply (simp add: FOREACH_cond_def)\n\n  apply (subst WHILET_unfold)\n  apply (auto\n    simp: FOREACH_cond_def FOREACH_body_def\n    intro: bind_mono)\n  done\n\nlemma while_eq_nfoldli: \"do {\n    (_,\\<sigma>) \\<leftarrow> WHILE\\<^sub>T (FOREACH_cond c) (FOREACH_body f) (l,\\<sigma>);\n    RETURN \\<sigma>\n  } = nfoldli l c f \\<sigma>\"\n  apply (rule antisym)\n  apply (rule while_nfoldli)\n  apply (rule order_trans[OF nfoldli_while[where I=\"\\<lambda>_. True\"]])\n  apply (simp add: WHILET_def)\n  done\n\nlemma nfoldli_rule:\n  assumes I0: \"I [] l0 \\<sigma>0\"\n  assumes IS: \"\\<And>x l1 l2 \\<sigma>. \\<lbrakk> l0=l1@x#l2; I l1 (x#l2) \\<sigma>; c \\<sigma> \\<rbrakk> \\<Longrightarrow> f x \\<sigma> \\<le> SPEC (I (l1@[x]) l2)\"\n  assumes FNC: \"\\<And>l1 l2 \\<sigma>. \\<lbrakk> l0=l1@l2; I l1 l2 \\<sigma>; \\<not>c \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  assumes FC: \"\\<And>\\<sigma>. \\<lbrakk> I l0 [] \\<sigma>; c \\<sigma> \\<rbrakk> \\<Longrightarrow> P \\<sigma>\"\n  shows \"nfoldli l0 c f \\<sigma>0 \\<le> SPEC P\"\n  apply (rule order_trans[OF nfoldli_while[\n    where I=\"\\<lambda>(l2,\\<sigma>). \\<exists>l1. l0=l1@l2 \\<and> I l1 l2 \\<sigma>\"]])\n  unfolding FOREACH_cond_def FOREACH_body_def\n  apply (refine_rcg WHILEIT_rule[where R=\"measure (length o fst)\"] refine_vcg)\n  apply simp\n  using I0 apply simp\n\n  apply (case_tac a, simp)\n  apply simp\n  apply (elim exE conjE)\n  apply (rule order_trans[OF IS], assumption+)\n  apply auto []\n\n  apply simp\n  apply (elim exE disjE2)\n  using FC apply auto []\n  using FNC apply auto []\n  done\n\n\n(* TODO: Remove --- Hopefully obsolete \ndefinition \"it_FOREACH tsl s c f \\<sigma> \\<equiv> do { \n  l \\<leftarrow> tsl s; \n  nfoldli l c f \\<sigma> \n}\"\n\nlemma param_it_FOREACH[param]:\n  assumes \"single_valued R\\<sigma>\"\n  shows \"(it_FOREACH,it_FOREACH) \\<in> \n    (\\<langle>Rk\\<rangle>Rs \\<rightarrow> \\<langle>\\<langle>Rk\\<rangle>list_rel\\<rangle>nres_rel) \\<rightarrow> \\<langle>Rk\\<rangle>Rs \\<rightarrow> \n      (R\\<sigma>\\<rightarrow>Id) \\<rightarrow> (Rk\\<rightarrow>R\\<sigma>\\<rightarrow>\\<langle>R\\<sigma>\\<rangle>nres_rel) \n    \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel\"\n  using assms\n  unfolding it_FOREACH_def[abs_def]\n  by parametricity\n\nlemma FOREACH_to_it_FOREACH:\n  fixes R I tsl\n  defines \"lspec \\<equiv> \\<lambda>s. (SPEC (\\<lambda>l. distinct l \\<and> s = set l \\<and> sorted_by_rel R l))\"\n  assumes SV: \"single_valued R\\<sigma>\"\n  assumes LS: \"\\<And>s s'. (s,s')\\<in>\\<langle>Rk\\<rangle>Rs \\<Longrightarrow> tsl s \\<le> \\<Down>(\\<langle>Rk\\<rangle>list_rel) (lspec s')\"\n  shows \"(it_FOREACH tsl,FOREACHoci R I) \n    \\<in> \\<langle>Rk\\<rangle>Rs \\<rightarrow> (R\\<sigma>\\<rightarrow>Id) \\<rightarrow> (Rk\\<rightarrow>R\\<sigma>\\<rightarrow>\\<langle>R\\<sigma>\\<rangle>nres_rel) \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel\"\nproof (intro fun_relI nres_relI)\n  fix s s' c c' f f' \\<sigma> \\<sigma>'\n  assume [param]:\n    \"(s,s')\\<in>\\<langle>Rk\\<rangle>Rs\"\n    \"(c,c')\\<in>R\\<sigma>\\<rightarrow>(Id::(bool\\<times>_) set)\" \n    \"(f,f')\\<in>Rk\\<rightarrow>R\\<sigma>\\<rightarrow>\\<langle>R\\<sigma>\\<rangle>nres_rel\"\n    \"(\\<sigma>,\\<sigma>')\\<in>R\\<sigma>\"\n\n  have \"it_FOREACH tsl s c f \\<sigma> \\<le> \\<Down>R\\<sigma> (it_FOREACH lspec s' c' f' \\<sigma>')\"\n    apply (rule nres_relD)\n    using SV LS[THEN nres_relI]\n    by parametricity\n  also have \n    \"it_FOREACH lspec s' c' f' \\<sigma>' \\<le> FOREACHoci R I s' c' f' \\<sigma>'\"\n    apply (rule refine_IdD)\n    unfolding it_FOREACH_def FOREACHoci_def lspec_def\n    apply refine_rcg\n    apply simp\n    apply (rule nfoldli_while)\n    done \n  finally show \"it_FOREACH tsl s c f \\<sigma> \\<le> \\<Down> R\\<sigma> (FOREACH\\<^sub>O\\<^sub>C\\<^bsup>R,I\\<^esup> s' c' f' \\<sigma>')\" .\nqed\n\nlemma it_FOREACH_transfer_plain[refine_transfer]:\n  assumes \"\\<And>s. RETURN (tsl s) \\<le> TSL s\"\n  assumes \"\\<And>x \\<sigma>. RETURN (f x \\<sigma>) \\<le> F x \\<sigma>\"\n  shows \"RETURN (foldli (tsl s) c f \\<sigma>) \\<le> it_FOREACH TSL s c F \\<sigma>\"\nproof -\n  have \"RETURN (let x = tsl s in foldli x c f \\<sigma>) \\<le> it_FOREACH TSL s c F \\<sigma>\"\n    using assms\n    unfolding it_FOREACH_def\n    apply refine_transfer\n    done\n  thus ?thesis by simp\nqed\n\ndefinition \"dres_it_FOREACH tsl s c f \\<sigma> \\<equiv> \n  tsl s \\<guillemotright>= (\\<lambda>l. foldli l (case_dres False False c) (\\<lambda>x s. s\\<guillemotright>=f x) (dRETURN \\<sigma>))\"\n\nlemma it_FOREACH_transfer_dres[refine_transfer]:\n  assumes \"\\<And>s. nres_of (tsl s) \\<le> (TSL s)\"\n  assumes \"\\<And>x \\<sigma>. nres_of (f x \\<sigma>) \\<le> F x \\<sigma>\"\n  shows \"nres_of (dres_it_FOREACH tsl s c f \\<sigma>) \\<le> it_FOREACH TSL s c F \\<sigma>\"\n  using assms\n  unfolding it_FOREACH_def dres_it_FOREACH_def\n  by refine_transfer\n\nlemma it_FOREACH_mono[refine_mono]:\n  \"\\<lbrakk> \\<And>x. f x \\<le> f' x \\<rbrakk> \\<Longrightarrow> it_FOREACH it s c f \\<sigma> \\<le> it_FOREACH it s c f' \\<sigma>\"\n  unfolding it_FOREACH_def\n  by refine_mono\n*)\n\n\nlemma foldli_mono_dres_aux1:\n  fixes \\<sigma> :: \"'a :: {order_bot, order_top}\"\n  assumes COND: \"\\<And>\\<sigma> \\<sigma>'. \\<sigma>\\<le>\\<sigma>' \\<Longrightarrow> c \\<sigma> \\<noteq> c \\<sigma>' \\<Longrightarrow> \\<sigma>=bot \\<or> \\<sigma>'=top \"\n  assumes STRICT: \"\\<And>x. f x bot = bot\" \"\\<And>x. f' x top = top\"\n  assumes B: \"\\<sigma>\\<le>\\<sigma>'\"\n  assumes A: \"\\<And>a x x'. x\\<le>x' \\<Longrightarrow> f a x \\<le> f' a x'\"\n  shows \"foldli l c f \\<sigma> \\<le> foldli l c f' \\<sigma>'\"\nproof -\n  { fix l \n    have \"foldli l c f bot = bot\" by (induct l) (auto simp: STRICT)\n  } note [simp] = this\n  { fix l \n    have \"foldli l c f' top = top\" by (induct l) (auto simp: STRICT)\n  } note [simp] = this\n\n  show ?thesis\n    using B\n    apply (induct l arbitrary: \\<sigma> \\<sigma>')\n    apply (auto simp: A STRICT dest!: COND)\n    done\nqed\n\n\n\nlemma foldli_mono_dres[refine_mono]:\n  assumes A: \"\\<And>a x. f a x \\<le> f' a x\"\n  shows \"foldli l (case_dres False False c) (\\<lambda>x s. dbind s (f x)) \\<sigma> \n    \\<le> foldli l (case_dres False False c) (\\<lambda>x s. dbind s (f' x)) \\<sigma>\"\n  apply (rule foldli_mono_dres_aux2)\n  apply (simp_all)\n  apply (rule dbind_mono)\n  apply (simp_all add: A)\n  done\n\n(*\nlemma dres_it_FOREACH_mono[refine_mono]: \n  assumes A: \"\\<And>a x. f a x \\<le> f' a x\"\n  shows \"dres_it_FOREACH l s c f \\<sigma> \\<le> dres_it_FOREACH l s c f' \\<sigma>\"\n  using assms\n  unfolding dres_it_FOREACH_def\n  by refine_mono\n*)\n\nlemma dres_foldli_ne_bot[refine_transfer]:\n  assumes 1: \"\\<sigma> \\<noteq> dSUCCEED\"\n  assumes 2: \"\\<And>x \\<sigma>. f x \\<sigma> \\<noteq> dSUCCEED\"\n  shows \"foldli l c (\\<lambda>x s. s \\<guillemotright>= f x) \\<sigma> \\<noteq> dSUCCEED\"\n  using 1 apply (induct l arbitrary: \\<sigma>)\n  apply simp\n  apply (simp split: dres.split, intro allI impI)\n  apply rprems\n  using 2\n  apply (simp add: dres_ne_bot_basic)\n  done\n\n(*lemma dres_it_FOREACH_ne_bot[refine_transfer]:\n  assumes \"\\<And>s. l s\\<noteq>dSUCCEED\"\n  assumes \"\\<And>x \\<sigma>. f x \\<sigma> \\<noteq> dSUCCEED\"\n  shows \"dres_it_FOREACH l s c f \\<sigma> \\<noteq> dSUCCEED\"\n  using assms\n  unfolding dres_it_FOREACH_def\n  apply refine_transfer\n  done\n*)\n\nsubsection {* Autoref Setup *}\ntext {*\n  Foreach-loops are mapped to the combinator @{text \"LIST_FOREACH\"}, that\n  takes as first argument an explicit @{text \"to_list\"} operation. \n  This mapping is done during operation identification. \n  It is then the responsibility of the various implementations to further map\n  the @{text \"to_list\"} operations to custom @{text \"to_list\"} operations, like\n  @{text \"set_to_list\"}, @{text \"map_to_list\"}, @{text \"nodes_to_list\"}, etc.\n*}\n\nlemma autoref_nfoldli[autoref_rules]:\n  assumes \"PREFER single_valued Rb\"\n  shows \"(nfoldli, nfoldli)\n  \\<in> \\<langle>Ra\\<rangle>list_rel \\<rightarrow> (Rb \\<rightarrow> bool_rel) \\<rightarrow> (Ra \\<rightarrow> Rb \\<rightarrow> \\<langle>Rb\\<rangle>nres_rel) \\<rightarrow> Rb \\<rightarrow> \\<langle>Rb\\<rangle>nres_rel\"\n  using assms param_nfoldli by simp\n\n\ntext {* This constant is a placeholder to be converted to\n  custom operations by pattern rules *}\ndefinition \"it_to_sorted_list R s \n  \\<equiv> SPEC (\\<lambda>l. distinct l \\<and> s = set l \\<and> sorted_by_rel R l)\"\n\ndefinition \"LIST_FOREACH \\<Phi> tsl c f \\<sigma>0 \\<equiv> do {\n  xs \\<leftarrow> tsl;\n  (_,\\<sigma>) \\<leftarrow> WHILE\\<^sub>T\\<^bsup>\\<lambda>(it, \\<sigma>). \\<exists>xs'. xs = xs' @ it \\<and> \\<Phi> (set it) \\<sigma>\\<^esup>\n    (FOREACH_cond c) (FOREACH_body f) (xs, \\<sigma>0);\n    RETURN \\<sigma>}\"\n\nlemma FOREACHoci_by_LIST_FOREACH:\n  \"FOREACHoci R \\<Phi> S c f \\<sigma>0 = do {\n    ASSERT (finite S);\n    LIST_FOREACH \\<Phi> (it_to_sorted_list R S) c f \\<sigma>0\n  }\"\n  unfolding OP_def FOREACHoci_def LIST_FOREACH_def it_to_sorted_list_def \n  by simp\n\ntext {* Patterns that convert FOREACH-constructs \n  to @{text \"LIST_FOREACH\"}\n*}\ncontext begin interpretation autoref_syn .\n\nlemma FOREACH_patterns[autoref_op_pat]:\n  \"FOREACH\\<^bsup>I\\<^esup> s f \\<equiv> FOREACH\\<^sub>O\\<^sub>C\\<^bsup>\\<lambda>_ _. True,I\\<^esup> s (\\<lambda>_. True) f\"\n  \"FOREACHci I s c f \\<equiv> FOREACHoci (\\<lambda>_ _. True) I s c f\"\n  \"FOREACH\\<^sub>O\\<^sub>C\\<^bsup>R,\\<Phi>\\<^esup> s c f \\<equiv> \\<lambda>\\<sigma>. do {\n    ASSERT (finite s);\n    Autoref_Tagging.OP (LIST_FOREACH \\<Phi>) (it_to_sorted_list R s) c f \\<sigma>\n  }\"\n  \"FOREACH s f \\<equiv> FOREACHoci (\\<lambda>_ _. True) (\\<lambda>_ _. True) s (\\<lambda>_. True) f\"\n  \"FOREACHoi R I s f \\<equiv> FOREACHoci R I s (\\<lambda>_. True) f\"\n  \"FOREACHc s c f \\<equiv> FOREACHoci (\\<lambda>_ _. True) (\\<lambda>_ _. True) s c f\"\n  unfolding \n    FOREACHoci_by_LIST_FOREACH[abs_def]\n    FOREACHc_def[abs_def] \n    FOREACH_def[abs_def] \n    FOREACHci_def[abs_def] \n    FOREACHi_def[abs_def] \n    FOREACHoi_def[abs_def] \n  by simp_all\n\n(*lemma FOREACH_patterns[autoref_op_pat]: \n  \"FOREACHoci R \\<Phi> s c f \\<sigma> \\<equiv> do {\n    ASSERT (finite s);\n    OP (LIST_FOREACH \\<Phi>) (it_to_sorted_list R s) c f \\<sigma>\n  }\"\n  \"FOREACHc s c f \\<sigma> \\<equiv> FOREACHoci (\\<lambda>_ _. True) (\\<lambda>_ _. True) s c f \\<sigma>\"\n  \"FOREACH s f \\<sigma> \\<equiv> FOREACHoci (\\<lambda>_ _. True) (\\<lambda>_ _. True) s (\\<lambda>_. True) f \\<sigma>\"\n  \"FOREACHci I s c f \\<sigma> \\<equiv> FOREACHoci (\\<lambda>_ _. True) I s c f \\<sigma>\"\n  \"FOREACHi I s f \\<sigma> \\<equiv> FOREACHoci (\\<lambda>_ _. True) I s (\\<lambda>_. True) f \\<sigma>\"\n  \"FOREACHoi R I s f \\<sigma> \\<equiv> FOREACHoci R I s (\\<lambda>_. True) f \\<sigma>\"\n  unfolding \n    FOREACHoci_by_LIST_FOREACH[abs_def]\n    FOREACHc_def[abs_def] \n    FOREACH_def[abs_def] \n    FOREACHci_def[abs_def] \n    FOREACHi_def[abs_def] \n    FOREACHoi_def[abs_def] \n  by simp_all*)\nend\ndefinition \"LIST_FOREACH' tsl c f \\<sigma> \\<equiv> do {xs \\<leftarrow> tsl; nfoldli xs c f \\<sigma>}\"\n\nlemma LIST_FOREACH'_param[param]: \n  assumes \"single_valued R\\<sigma>\"\n  shows \"(LIST_FOREACH',LIST_FOREACH') \n  \\<in> (\\<langle>\\<langle>Rv\\<rangle>list_rel\\<rangle>nres_rel \\<rightarrow> (R\\<sigma>\\<rightarrow>bool_rel) \n    \\<rightarrow> (Rv \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel) \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel)\"\n  using assms\n  unfolding LIST_FOREACH'_def[abs_def]\n  by parametricity\n\nlemma LIST_FOREACH_autoref[autoref_rules]:\n  assumes SV: \"PREFER single_valued R\\<sigma>\"\n  shows \"(LIST_FOREACH', LIST_FOREACH \\<Phi>) \\<in> \n    (\\<langle>\\<langle>Rv\\<rangle>list_rel\\<rangle>nres_rel \\<rightarrow> (R\\<sigma>\\<rightarrow>bool_rel) \n      \\<rightarrow> (Rv \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel) \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel)\"\nproof (intro fun_relI nres_relI)\n  fix tsl tsl' c c' f f' \\<sigma> \\<sigma>'\n  assume [param]:\n    \"(tsl,tsl')\\<in>\\<langle>\\<langle>Rv\\<rangle>list_rel\\<rangle>nres_rel\"\n    \"(c,c')\\<in>R\\<sigma>\\<rightarrow>bool_rel\" \n    \"(f,f')\\<in>Rv\\<rightarrow>R\\<sigma>\\<rightarrow>\\<langle>R\\<sigma>\\<rangle>nres_rel\"\n    \"(\\<sigma>,\\<sigma>')\\<in>R\\<sigma>\"\n\n  note SV = SV[simplified]\n\n  have \"LIST_FOREACH' tsl c f \\<sigma> \\<le> \\<Down>R\\<sigma> (LIST_FOREACH' tsl' c' f' \\<sigma>')\"\n    apply (rule nres_relD)\n    using SV\n    by parametricity\n  also have \"LIST_FOREACH' tsl' c' f' \\<sigma>'\n    \\<le> LIST_FOREACH \\<Phi> tsl' c' f' \\<sigma>'\"\n    apply (rule refine_IdD)\n    unfolding LIST_FOREACH_def LIST_FOREACH'_def\n    apply refine_rcg\n    apply simp\n    apply (rule nfoldli_while)\n    done \n  finally show \n    \"LIST_FOREACH' tsl c f \\<sigma> \\<le> \\<Down> R\\<sigma> (LIST_FOREACH \\<Phi> tsl' c' f' \\<sigma>')\"\n    .\nqed\n\nlemma LIST_FOREACH'_mono[refine_mono]:\n  assumes \"tsl \\<le> tsl'\"\n  assumes \"\\<And>x \\<sigma>. f x \\<sigma> \\<le> f' x \\<sigma>\"\n  shows \"LIST_FOREACH' tsl c f \\<sigma> \\<le> LIST_FOREACH' tsl' c f' \\<sigma>\"\n  using assms unfolding LIST_FOREACH'_def\n  by refine_mono\n\nlemma LIST_FOREACH'_transfer_plain[refine_transfer]:\n  assumes \"RETURN tsl \\<le> tsl'\"\n  assumes \"\\<And>x \\<sigma>. RETURN (f x \\<sigma>) \\<le> f' x \\<sigma>\"\n  shows \"RETURN (foldli tsl c f \\<sigma>) \\<le> LIST_FOREACH' tsl' c f' \\<sigma>\"\n  apply (rule order_trans[rotated])\n  unfolding LIST_FOREACH'_def\n  using assms\n  apply refine_transfer\n  by simp\n\nthm refine_transfer\n\nlemma LIST_FOREACH'_transfer_nres[refine_transfer]:\n  assumes \"nres_of tsl \\<le> tsl'\"\n  assumes \"\\<And>x \\<sigma>. nres_of (f x \\<sigma>) \\<le> f' x \\<sigma>\"\n  shows \"nres_of (\n    do {\n      xs\\<leftarrow>tsl; \n      foldli xs (case_dres False False c) (\\<lambda>x s. s\\<guillemotright>=f x) (dRETURN \\<sigma>)\n    }) \\<le> LIST_FOREACH' tsl' c f' \\<sigma>\"\n  unfolding LIST_FOREACH'_def\n  using assms\n  by refine_transfer\n\n(*\nlemma FOREACHoci_autoref[autoref_rules]:\n  assumes SV: \"PREFER single_valued R\\<sigma>\"\n  assumes LS: \"GEN_OP tsl (it_to_sorted_list R) (\\<langle>Rk\\<rangle>Rs\\<rightarrow>\\<langle>\\<langle>Rk\\<rangle>list_rel\\<rangle>nres_rel)\"\n  shows \"(it_FOREACH tsl,FOREACHoci R I)\n    \\<in> \\<langle>Rk\\<rangle>Rs \\<rightarrow> (R\\<sigma>\\<rightarrow>Id) \\<rightarrow> (Rk\\<rightarrow>R\\<sigma>\\<rightarrow>\\<langle>R\\<sigma>\\<rangle>nres_rel) \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel\"\n  using FOREACH_to_it_FOREACH[OF SV[simplified], OF nres_relD] LS\n  apply (simp add: it_to_sorted_list_def[abs_def])\n  apply parametricity\n  apply (erule (1) fun_relD)\n  done\n\nlemma FOREACHoi_autoref[autoref_rules]:\n  assumes SV: \"PREFER single_valued R\\<sigma>\"\n  assumes LS: \"GEN_OP tsl (it_to_sorted_list R) (\\<langle>Rk\\<rangle>Rs\\<rightarrow>\\<langle>\\<langle>Rk\\<rangle>list_rel\\<rangle>nres_rel)\"\n  shows \"(\\<lambda>s. it_FOREACH tsl s (\\<lambda>_. True),FOREACHoi R I)\n    \\<in> \\<langle>Rk\\<rangle>Rs \\<rightarrow> (Rk\\<rightarrow>R\\<sigma>\\<rightarrow>\\<langle>R\\<sigma>\\<rangle>nres_rel) \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel\"\nproof -\n  note [relator_props] = SV[unfolded autoref_tag_defs]\n  note [autoref_rules] = LS[unfolded autoref_tag_defs]\n  show ?thesis\n    unfolding FOREACHoi_def[abs_def]\n    by (autoref (keep_goal))\n\nqed\n\nlemma FOREACHci_autoref[autoref_rules]:\n  assumes SV: \"PREFER single_valued R\\<sigma>\"\n  assumes LS: \n    \"GEN_OP tsl (it_to_sorted_list (\\<lambda>_ _. True)) (\\<langle>Rk\\<rangle>Rs\\<rightarrow>\\<langle>\\<langle>Rk\\<rangle>list_rel\\<rangle>nres_rel)\"\n  shows \"(it_FOREACH tsl,FOREACHci I)\n    \\<in> \\<langle>Rk\\<rangle>Rs \\<rightarrow> (R\\<sigma>\\<rightarrow>Id) \\<rightarrow> (Rk\\<rightarrow>R\\<sigma>\\<rightarrow>\\<langle>R\\<sigma>\\<rangle>nres_rel) \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel\"\nproof -\n  note [relator_props] = SV[unfolded autoref_tag_defs]\n  note [autoref_rules] = LS[unfolded autoref_tag_defs]\n  show ?thesis\n    unfolding FOREACHci_def[abs_def]\n    by (autoref)\nqed\n\nlemma FOREACHi_autoref[autoref_rules]:\n  assumes SV: \"PREFER single_valued R\\<sigma>\"\n  assumes LS:\n    \"GEN_OP tsl (it_to_sorted_list (\\<lambda>_ _. True)) (\\<langle>Rk\\<rangle>Rs\\<rightarrow>\\<langle>\\<langle>Rk\\<rangle>list_rel\\<rangle>nres_rel)\"\n  shows \"(\\<lambda>s. it_FOREACH tsl s (\\<lambda>_. True),FOREACHi I)\n    \\<in> \\<langle>Rk\\<rangle>Rs \\<rightarrow> (Rk\\<rightarrow>R\\<sigma>\\<rightarrow>\\<langle>R\\<sigma>\\<rangle>nres_rel) \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel\"\nproof -\n  note [relator_props] = SV[unfolded autoref_tag_defs]\n  note [autoref_rules] = LS[unfolded autoref_tag_defs]\n  show ?thesis\n    unfolding FOREACHi_def[abs_def]\n    by (autoref (keep_goal))\nqed\n\nlemma FOREACHc_autoref[autoref_rules]:\n  assumes SV: \"PREFER single_valued R\\<sigma>\"\n  assumes LS:\n    \"GEN_OP tsl (it_to_sorted_list (\\<lambda>_ _. True)) (\\<langle>Rk\\<rangle>Rs\\<rightarrow>\\<langle>\\<langle>Rk\\<rangle>list_rel\\<rangle>nres_rel)\"\n  shows \"(it_FOREACH tsl,FOREACHc)\n    \\<in> \\<langle>Rk\\<rangle>Rs \\<rightarrow> (R\\<sigma>\\<rightarrow>Id) \\<rightarrow> (Rk\\<rightarrow>R\\<sigma>\\<rightarrow>\\<langle>R\\<sigma>\\<rangle>nres_rel) \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel\"\nproof -\n  note [relator_props] = SV[unfolded autoref_tag_defs]\n  note [autoref_rules] = LS[unfolded autoref_tag_defs]\n  show ?thesis\n    unfolding FOREACHc_def[abs_def]\n    by (autoref)\nqed\n\nlemma FOREACH_autoref[autoref_rules]:\n  assumes SV: \"PREFER single_valued R\\<sigma>\"\n  assumes LS:\n    \"GEN_OP tsl (it_to_sorted_list (\\<lambda>_ _. True)) (\\<langle>Rk\\<rangle>Rs\\<rightarrow>\\<langle>\\<langle>Rk\\<rangle>list_rel\\<rangle>nres_rel)\"\n  shows \"(\\<lambda>s. it_FOREACH tsl s (\\<lambda>_. True),FOREACH)\n    \\<in> \\<langle>Rk\\<rangle>Rs \\<rightarrow> (Rk\\<rightarrow>R\\<sigma>\\<rightarrow>\\<langle>R\\<sigma>\\<rangle>nres_rel) \\<rightarrow> R\\<sigma> \\<rightarrow> \\<langle>R\\<sigma>\\<rangle>nres_rel\"\nproof -\n  note [relator_props] = SV[unfolded autoref_tag_defs]\n  note [autoref_rules] = LS[unfolded autoref_tag_defs]\n  show ?thesis\n    unfolding FOREACH_def[abs_def]\n    by (autoref (keep_goal))\nqed\n*)\n\ntext {* Simplification rules to summarize iterators *}\nlemma [refine_transfer_post_simp]: \n  \"do {\n    xs \\<leftarrow> dRETURN tsl;\n    foldli xs c f \\<sigma>\n  } = foldli tsl c f \\<sigma>\" \n  by simp\n\nlemma [refine_transfer_post_simp]: \n  \"(let xs = tsl in foldli xs c f \\<sigma>) = foldli tsl c f \\<sigma>\" \n  by simp\n\nsubsection {* Miscellanneous Utility Lemmas *}\n\n(* TODO: Can we make this somewhat more general ? *)\nlemma map_foreach:\n  assumes \"finite S\"\n  shows \"FOREACH S (\\<lambda>x \\<sigma>. RETURN (insert (f x) \\<sigma>)) R0 \\<le> SPEC (op = (R0 \\<union> f`S))\"\n  apply (rule FOREACH_rule[where I=\"\\<lambda>it \\<sigma>. \\<sigma>=R0 \\<union> f`(S-it)\"])\n  apply (auto intro: assms)\n  done\n\nlemma map_sigma_foreach:\n  fixes f :: \"'a \\<times> 'b \\<Rightarrow> 'c\"\n  assumes \"finite A\"\n  assumes \"\\<And>x. x\\<in>A \\<Longrightarrow> finite (B x)\"\n  shows \"FOREACH A (\\<lambda>a \\<sigma>. \n    FOREACH (B a) (\\<lambda>b \\<sigma>. RETURN (insert (f (a,b)) \\<sigma>)) \\<sigma>\n  ) R0 \\<le> SPEC (op = (R0 \\<union> f`Sigma A B))\"\n  apply (rule FOREACH_rule[where I=\"\\<lambda>it \\<sigma>. \\<sigma>=R0 \\<union> f`(Sigma (A-it) B)\"])\n  apply (auto intro: assms) [2]\n  \n  apply (rule_tac I=\"\\<lambda>it' \\<sigma>. \\<sigma>=R0 \\<union> f`(Sigma (A - it) B) \n    \\<union> f`({x} \\<times> (B x - it'))\"\n    in FOREACH_rule)\n  apply (auto intro: assms) [2]\n  apply (rule refine_vcg)\n  apply auto []\n  apply auto []\n  apply auto []\n  done\n\nlemma map_sigma_sigma_foreach:\n  fixes f :: \"'a \\<times> ('b \\<times> 'c) \\<Rightarrow> 'd\"\n  assumes \"finite A\"\n  assumes \"\\<And>a. a\\<in>A \\<Longrightarrow> finite (B a)\"\n  assumes \"\\<And>a b. \\<lbrakk>a\\<in>A; b\\<in>B a\\<rbrakk> \\<Longrightarrow> finite (C a b)\"\n  shows \"FOREACH A (\\<lambda>a \\<sigma>. \n    FOREACH (B a) (\\<lambda>b \\<sigma>. \n      FOREACH (C a b) (\\<lambda>c \\<sigma>.\n        RETURN (insert (f (a,(b,c))) \\<sigma>)) \\<sigma>) \\<sigma>\n  ) R0 \\<le> SPEC (op = (R0 \\<union> f`Sigma A (\\<lambda>a. Sigma (B a) (C a))))\"\n  apply (rule FOREACH_rule[where \n    I=\"\\<lambda>it \\<sigma>. \\<sigma>=R0 \\<union> f`(Sigma (A-it) (\\<lambda>a. Sigma (B a) (C a)))\"])\n  apply (auto intro: assms) [2]\n  apply (rule_tac \n    I=\"\\<lambda>it' \\<sigma>. \\<sigma>=R0 \\<union> f`(Sigma (A - it) (\\<lambda>a. Sigma (B a) (C a))) \n      \\<union> f`({x} \\<times> ( Sigma (B x - it') (C x)))\"\n    in FOREACH_rule)\n  apply (auto intro: assms) [2]\n  apply (rule_tac \n    I=\"\\<lambda>it'' \\<sigma>. \\<sigma>=R0 \\<union> f`(Sigma (A - it) (\\<lambda>a. Sigma (B a) (C a))) \n      \\<union> f`({x} \\<times> ( Sigma (B x - ita) (C x)))\n      \\<union> f`({x} \\<times> ({xa} \\<times> (C x xa - it'')))\n    \"\n    in FOREACH_rule)\n  apply (auto intro: assms) [2]\n  \n  apply auto\n  done\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Refine_Monadic/Refine_Foreach.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5039061705290805, "lm_q2_score": 0.600188359260205, "lm_q1q2_score": 0.3024386177109419}}
{"text": "subsection\\<open>\\<open>\\<Sigma>\\<close>-AND statements\\<close>\n\ntheory Sigma_AND imports\n  Sigma_Protocols\n  Xor\nbegin \n\nlocale \\<Sigma>_AND_base = \\<Sigma>0: \\<Sigma>_protocols_base init0 response0 check0 Rel0 S0_raw \\<A>ss0 \"carrier L\" valid_pub0\n  + \\<Sigma>1: \\<Sigma>_protocols_base init1 response1 check1 Rel1 S1_raw \\<A>ss1 \"carrier L\" valid_pub1\n  for init1 :: \"'pub1 \\<Rightarrow> 'witness1 \\<Rightarrow> ('rand1 \\<times> 'msg1) spmf\"\n    and response1 :: \"'rand1 \\<Rightarrow> 'witness1 \\<Rightarrow> 'bool  \\<Rightarrow> 'response1 spmf\"\n    and check1 :: \"'pub1 \\<Rightarrow> 'msg1 \\<Rightarrow> 'bool \\<Rightarrow> 'response1 \\<Rightarrow> bool\"\n    and Rel1 :: \"('pub1 \\<times> 'witness1) set\"\n    and S1_raw :: \"'pub1 \\<Rightarrow> 'bool \\<Rightarrow> ('msg1 \\<times> 'response1) spmf\"\n    and \\<A>ss1 :: \"'pub1 \\<Rightarrow> 'msg1 \\<times> 'bool \\<times> 'response1 \\<Rightarrow> 'msg1 \\<times> 'bool \\<times> 'response1 \\<Rightarrow> 'witness1 spmf\"\n    and challenge_space1 :: \"'bool set\"\n    and valid_pub1 :: \"'pub1 set\"\n    and init0 :: \"'pub0 \\<Rightarrow> 'witness0 \\<Rightarrow> ('rand0 \\<times> 'msg0) spmf\"\n    and response0 :: \"'rand0 \\<Rightarrow> 'witness0 \\<Rightarrow> 'bool \\<Rightarrow> 'response0 spmf\"\n    and check0 :: \"'pub0 \\<Rightarrow> 'msg0 \\<Rightarrow> 'bool \\<Rightarrow> 'response0 \\<Rightarrow> bool\"\n    and Rel0 :: \"('pub0 \\<times> 'witness0) set\"\n    and S0_raw :: \"'pub0 \\<Rightarrow> 'bool \\<Rightarrow> ('msg0 \\<times> 'response0) spmf\"\n    and \\<A>ss0 :: \"'pub0 \\<Rightarrow> 'msg0 \\<times> 'bool \\<times> 'response0 \\<Rightarrow> 'msg0 \\<times> 'bool \\<times> 'response0 \\<Rightarrow> 'witness0 spmf\"\n    and challenge_space0 :: \"'bool set\"\n    and valid_pub0 :: \"'pub0 set\"\n    and G :: \"(('pub0 \\<times> 'pub1)  \\<times> ('witness0 \\<times> 'witness1)) spmf\"\n    and L :: \"'bool boolean_algebra\" (structure)\n    + \n  assumes \\<Sigma>_prot1: \"\\<Sigma>1.\\<Sigma>_protocol\"  \n    and \\<Sigma>_prot0: \"\\<Sigma>0.\\<Sigma>_protocol\"  \n    and lossless_init: \"lossless_spmf (init0 h0 w0)\" \"lossless_spmf (init1 h1 w1)\"\n    and lossless_response: \"lossless_spmf (response0 r0 w0 e0)\" \"lossless_spmf (response1 r1 w1 e1)\"\n    and lossless_S: \"lossless_spmf (S0 h0 e0)\" \"lossless_spmf (S1 h1 e1)\"\n    and lossless_\\<A>ss: \"lossless_spmf (\\<A>ss0 x0 (a0,e,z0) (a0,e',z0'))\" \"lossless_spmf (\\<A>ss1 x1 (a1,e,z1) (a1,e',z1'))\" \n    and lossless_G: \"lossless_spmf G\"\n    and set_spmf_G [simp]: \"(h,w) \\<in> set_spmf G \\<Longrightarrow> Rel h w\"\nbegin\n\ndefinition \"challenge_space = carrier L\"\n\ndefinition Rel_AND :: \"(('pub0 \\<times> 'pub1) \\<times> 'witness0 \\<times> 'witness1) set\" \n  where \"Rel_AND = {((x0,x1), (w0,w1)). ((x0,w0) \\<in> Rel0 \\<and> (x1,w1) \\<in> Rel1)}\"\n\ndefinition init_AND :: \"('pub0 \\<times> 'pub1) \\<Rightarrow> ('witness0 \\<times> 'witness1) \\<Rightarrow> (('rand0 \\<times> 'rand1) \\<times> 'msg0 \\<times> 'msg1) spmf\" \n  where \"init_AND X W = do {\n    let (x0, x1) = X;\n    let (w0,w1) = W;\n    (r0, a0) \\<leftarrow> init0 x0 w0;\n    (r1, a1) \\<leftarrow> init1 x1 w1;\n    return_spmf ((r0,r1), (a0,a1))}\"   \n\nlemma lossless_init_AND: \"lossless_spmf (init_AND X W)\"\n  by(simp add: lossless_init init_AND_def split_def)\n    \ndefinition response_AND :: \"('rand0 \\<times> 'rand1) \\<Rightarrow> ('witness0 \\<times> 'witness1) \\<Rightarrow> 'bool \\<Rightarrow> ('response0 \\<times> 'response1) spmf\"\n  where \"response_AND R W s = do {\n    let (r0,r1) = R;\n    let (w0,w1) = W;  \n    z0 \\<leftarrow> response0 r0 w0 s;\n    z1  :: 'response1 \\<leftarrow> response1 r1 w1 s;\n    return_spmf (z0,z1)}\" \n\nlemma lossless_response_AND: \"lossless_spmf (response_AND R W s)\"\n  by(simp add: response_AND_def lossless_response split_def)\n\nfun check_AND :: \"('pub0 \\<times> 'pub1) \\<Rightarrow> ('msg0 \\<times> 'msg1) \\<Rightarrow> 'bool \\<Rightarrow> ('response0 \\<times> 'response1) \\<Rightarrow> bool\"\n  where \"check_AND (x0,x1) (a0,a1) s (z0,z1) = (check0 x0 a0 s z0 \\<and> check1 x1 a1 s z1)\"\n\ndefinition S_AND :: \"'pub0 \\<times> 'pub1 \\<Rightarrow> 'bool \\<Rightarrow> (('msg0 \\<times> 'msg1) \\<times> 'response0 \\<times> 'response1) spmf\"\n  where \"S_AND X e = do {\n    let (x0,x1) = X;\n    (a0, z0) \\<leftarrow> S0_raw x0 e;\n    (a1, z1) \\<leftarrow> S1_raw x1 e;\n    return_spmf ((a0,a1),(z0,z1))}\"\n\nfun \\<A>ss_AND :: \"'pub0 \\<times> 'pub1 \\<Rightarrow> ('msg0 \\<times> 'msg1) \\<times> 'bool \\<times> 'response0 \\<times> 'response1 \\<Rightarrow> ('msg0 \\<times> 'msg1) \\<times> 'bool \\<times> 'response0 \\<times> 'response1 \\<Rightarrow> ('witness0 \\<times> 'witness1) spmf\"\n  where \"\\<A>ss_AND (x0,x1) ((a0,a1), e, (z0,z1)) ((a0',a1'), e', (z0',z1')) = do {\n    w0 :: 'witness0 \\<leftarrow> \\<A>ss0 x0 (a0,e,z0) (a0',e',z0');\n    w1 \\<leftarrow> \\<A>ss1 x1 (a1,e,z1) (a1',e',z1');\n    return_spmf (w0,w1)}\"\n\ndefinition \"valid_pub_AND = {(x0,x1). x0 \\<in> valid_pub0 \\<and> x1 \\<in> valid_pub1}\"\n\nsublocale \\<Sigma>_AND: \\<Sigma>_protocols_base init_AND response_AND check_AND Rel_AND S_AND \\<A>ss_AND challenge_space valid_pub_AND \n  apply unfold_locales apply(simp add: Rel_AND_def valid_pub_AND_def)\n  using \\<Sigma>1.domain_subset_valid_pub \\<Sigma>0.domain_subset_valid_pub by blast\n\nend \n\nlocale \\<Sigma>_AND = \\<Sigma>_AND_base +\n  assumes set_spmf_G_L: \"((x0, x1), w0, w1) \\<in> set_spmf G \\<Longrightarrow> ((x0, x1), (w0,w1)) \\<in> Rel_AND\"\nbegin\n\nlemma hvzk: \n  assumes Rel_AND: \"((x0,x1), (w0,w1)) \\<in> Rel_AND\"\n  and \"e \\<in> challenge_space\" \n  shows \"\\<Sigma>_AND.R (x0,x1) (w0,w1) e = \\<Sigma>_AND.S (x0,x1) e\"\n  including monad_normalisation\nproof-\n  have x_in_dom: \"x0 \\<in> Domain Rel0\" and \"x1 \\<in> Domain Rel1\" \n    using Rel_AND Rel_AND_def by auto\n  have \"\\<Sigma>_AND.R (x0,x1) (w0,w1) e = do {\n    ((r0,r1),(a0,a1)) \\<leftarrow> init_AND (x0,x1) (w0,w1);\n    (z0,z1) \\<leftarrow> response_AND (r0,r1) (w0,w1) e;\n    return_spmf ((a0,a1),e,(z0,z1))}\"\n    by(simp add: \\<Sigma>_AND.R_def split_def)\n  also have \"... = do {\n    (r0, a0) \\<leftarrow> init0 x0 w0;\n    z0 \\<leftarrow> response0 r0 w0 e;\n    (r1, a1) \\<leftarrow> init1 x1 w1;\n    z1 :: 'f \\<leftarrow> response1 r1 w1 e;\n    return_spmf ((a0,a1),e,(z0,z1))}\"\n    apply(simp add: init_AND_def response_AND_def split_def)\n    apply(rewrite bind_commute_spmf[of \"response0 _ w0 e\"])\n    by simp\n  also have \"... = do {\n    (a0, c0, z0) \\<leftarrow> \\<Sigma>0.R x0 w0 e;\n    (a1, c1, z1) \\<leftarrow> \\<Sigma>1.R x1 w1 e;\n    return_spmf ((a0,a1),e,(z0,z1))}\"\n    by(simp add: \\<Sigma>0.R_def \\<Sigma>1.R_def split_def)\n  also have \"... = do {\n    (a0, c0, z0) \\<leftarrow> \\<Sigma>0.S x0 e;\n    (a1, c1, z1) \\<leftarrow> \\<Sigma>1.S x1 e;\n    return_spmf ((a0,a1),e,(z0,z1))}\"\n    using Rel_AND_def S_AND_def \\<Sigma>_prot1 \\<Sigma>_prot0 assms  \\<Sigma>0.HVZK_unfold1 \\<Sigma>1.HVZK_unfold1 \n          valid_pub_AND_def split_def challenge_space_def x_in_dom\n    by auto\n  ultimately show ?thesis \n    by(simp add: \\<Sigma>0.S_def \\<Sigma>1.S_def bind_map_spmf o_def split_def Let_def \\<Sigma>_AND.S_def map_spmf_conv_bind_spmf S_AND_def)\nqed\n\nlemma HVZK: \"\\<Sigma>_AND.HVZK\"\n  using \\<Sigma>_AND.HVZK_def hvzk challenge_space_def \n  apply(simp add: S_AND_def split_def)\n  using \\<Sigma>_prot1 \\<Sigma>_prot0 \\<Sigma>0.HVZK_unfold2 \\<Sigma>1.HVZK_unfold2 valid_pub_AND_def by auto\n\nlemma correct: \n  assumes Rel_AND: \"((x0,x1), (w0,w1)) \\<in> Rel_AND\"\n  and \"e \\<in> challenge_space\" \n  shows \"\\<Sigma>_AND.completeness_game (x0,x1) (w0,w1) e = return_spmf True\"\n  including monad_normalisation\nproof-\n  have \"\\<Sigma>_AND.completeness_game (x0,x1) (w0,w1) e = do {\n    ((r0,r1),(a0,a1)) \\<leftarrow> init_AND (x0,x1) (w0,w1);\n    (z0,z1) \\<leftarrow> response_AND (r0,r1) (w0,w1) e;\n    return_spmf (check_AND (x0,x1) (a0,a1) e (z0,z1))}\" \n    by(simp add: \\<Sigma>_AND.completeness_game_def split_def del: check_AND.simps)\n  also have \"... = do {\n    (r0, a0) \\<leftarrow> init0 x0 w0;\n    z0 \\<leftarrow> response0 r0 w0 e;\n    (r1, a1) \\<leftarrow> init1 x1 w1;\n    z1 \\<leftarrow> response1 r1 w1 e;\n    return_spmf ((check0 x0 a0 e z0 \\<and> check1 x1 a1 e z1))}\" \n    apply(simp add: init_AND_def response_AND_def split_def)\n    apply(rewrite bind_commute_spmf[of \"response0 _ w0 e\"])\n    by simp\n  ultimately show ?thesis\n    using \\<Sigma>1.complete_game_return_true \\<Sigma>_prot1 \\<Sigma>1.\\<Sigma>_protocol_def \\<Sigma>1.completeness_game_def assms\n          \\<Sigma>0.complete_game_return_true \\<Sigma>_prot0 \\<Sigma>0.\\<Sigma>_protocol_def \\<Sigma>0.completeness_game_def challenge_space_def\n    apply(auto simp add: Let_def split_def bind_eq_return_spmf lossless_init lossless_response Rel_AND_def)\n    by(metis (mono_tags, lifting) assms(2) fst_conv snd_conv)+\nqed\n\nlemma completeness: \"\\<Sigma>_AND.completeness\"\n  using \\<Sigma>_AND.completeness_def correct challenge_space_def by force\n\nlemma ss:\n  assumes e_neq_e': \"s \\<noteq> s'\"\n    and valid_pub: \"(x0,x1) \\<in> valid_pub_AND\"\n    and challenge_space: \"s \\<in> challenge_space\" \"s' \\<in> challenge_space\"\n    and \"check_AND (x0,x1) (a0,a1) s (z0,z1)\" \n    and \"check_AND  (x0,x1) (a0,a1) s' (z0',z1')\" \n  shows  \"lossless_spmf (\\<A>ss_AND  (x0,x1) ((a0,a1), s, (z0,z1)) ((a0,a1), s', (z0',z1'))) \n              \\<and> (\\<forall>w'\\<in>set_spmf (\\<A>ss_AND  (x0,x1) ((a0,a1), s, (z0,z1)) ((a0,a1), s', (z0',z1'))). ((x0,x1), w') \\<in> Rel_AND)\"\nproof-\n  have x0_in_dom: \"x0 \\<in> valid_pub0\" and x1_in_dom: \"x1 \\<in> valid_pub1\" \n    using valid_pub valid_pub_AND_def by auto\n  moreover have 3: \"check0 x0 a0 s z0\"\n      using assms  by simp \n  moreover have 4: \"check1 x1 a1 s' z1'\"\n    using assms by simp \n  moreover have \"w0 \\<in> set_spmf (\\<A>ss0 x0 (a0, s, z0) (a0, s', z0')) \\<longrightarrow> (x0,w0) \\<in> Rel0\" for w0\n    using 3 4 \\<Sigma>0.special_soundness_def \\<Sigma>_prot0 \\<Sigma>0.\\<Sigma>_protocol_def x0_in_dom challenge_space_def assms valid_pub_AND_def valid_pub by fastforce\n  moreover have \"w1 \\<in> set_spmf (\\<A>ss1 x1 (a1, s, z1) (a1, s', z1')) \\<longrightarrow> (x1,w1) \\<in> Rel1\" for w1\n     using 3 4 \\<Sigma>1.special_soundness_def \\<Sigma>_prot1 \\<Sigma>1.\\<Sigma>_protocol_def x1_in_dom challenge_space_def assms valid_pub_AND_def valid_pub by fastforce \n  ultimately show ?thesis\n    by(auto simp add: lossless_\\<A>ss Rel_AND_def) \nqed\n\nlemma special_soundness:\n  shows \"\\<Sigma>_AND.special_soundness\"\n  using \\<Sigma>_AND.special_soundness_def ss by fast\n\ntheorem \\<Sigma>_protocol:\n  shows \"\\<Sigma>_AND.\\<Sigma>_protocol\"\n  by(auto simp add: \\<Sigma>_AND.\\<Sigma>_protocol_def completeness HVZK special_soundness)\n\nsublocale AND_\\<Sigma>_commit: \\<Sigma>_protocols_to_commitments init_AND response_AND check_AND Rel_AND S_AND \\<A>ss_AND challenge_space valid_pub_AND G \n  apply unfold_locales\n  by(auto simp add: \\<Sigma>_protocol set_spmf_G_L lossless_G lossless_init_AND lossless_response_AND)\n\nlemma \"AND_\\<Sigma>_commit.abstract_com.correct\"\n  using AND_\\<Sigma>_commit.commit_correct by simp\n\nlemma \"AND_\\<Sigma>_commit.abstract_com.perfect_hiding_ind_cpa \\<A>\"\n  using AND_\\<Sigma>_commit.perfect_hiding by blast\n\nlemma bind_advantage_bound_dis_log: \n  shows \"AND_\\<Sigma>_commit.abstract_com.bind_advantage \\<A> \\<le> AND_\\<Sigma>_commit.rel_advantage (AND_\\<Sigma>_commit.adversary \\<A>)\"\n  using AND_\\<Sigma>_commit.bind_advantage by simp\n\nend\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Sigma_Commit_Crypto/Sigma_AND.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.30243861050363874}}
{"text": "(*\n\nCopyright (c) 2017, ETH Zurich\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\n   list of conditions and the following disclaimer.\n2. Redistributions in binary form must reproduce the above copyright notice,\n   this list of conditions and the following disclaimer in the documentation\n   and/or other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND\nON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\n(* ######################################################################### *) \nchapter \"Deterministic Exception Handler for the MIPS R4600\"\n(* ######################################################################### *)\n\n(*<*)\ntheory MipsTLBReplacementHandlerDeter\n  imports MipsTLB MipsTLBPageTable \nbegin\n(*>*)\n\ntext \"This model is a deterministic version of a TLB + exceptin handler for\n      the MIPS R4600 TLB model. In this model, each page table entry for a\n      particular VPN will always be present int the very same entry in the\n      TLB, if at all. \"  \n  \n\n(* ========================================================================= *)  \nsection \"MIPS TLB + MIPS PageTables\"\n(* ========================================================================= *)    \n  \ntext \"We now define the combination of a MIPS TLB and a MIPS PageTable. All\n      entries of the TLB will be populated based on the page table.\"\n  \nrecord MipsTLBPT = \n  tlb :: MIPSTLB\n  pte :: MIPSPT\n\n    \n  \n(* ========================================================================= *)  \nsection \"Deterministic Exception Handler\"\n(* ========================================================================= *)\n  \ntext \"This MIPS TLB exception handler replaces an entry of the TLB with \n      the contents of the page table in a deterministic fashion, i.e.\n      for each VPN the entry to be replaced will always be the same. For\n      this we defined first a TLB index function.\"\n\n  \n(* ------------------------------------------------------------------------- *)   \nsubsection \"TLB Index calculation\"  \n(* ------------------------------------------------------------------------- *)  \n  \n  \ntext \"We define the following function that takes a TLB entry and a TLB and\n      produces an natural number, i.e. the index of the entry in the TLB. For\n      this we use a simple hash function from the VPN2 of the entry modulo\n      the TLB capacity.\"\n\ndefinition MIPSTLBIndex :: \"MIPSTLB \\<Rightarrow> TLBENTRY \\<Rightarrow> nat\"\n  where \"MIPSTLBIndex t e = ((vpn2 (hi (e))) mod (capacity t))\"  \n\n \ntext \"The definition above will always produce a TLB Index which is within the\n      valid range of the TLB i.e. does not exceed it's capacity.\"\n\nlemma MIPSTLBIndex_in_range:\n  \"\\<forall>e.  (capacity t) > 0 \\<Longrightarrow>  MIPSTLBIndex t e <  (capacity t)\"\n  by(auto simp:MIPSTLBIndex_def)\n\n\ntext \"Moreover, this definition of the index calculation gives us that if the \n      calculated indexes are different this implies that the two entries are not\n      the same.\"\n\n  \nlemma \"\\<And>e f. MIPSTLBIndex t e \\<noteq> MIPSTLBIndex t f \n                  \\<Longrightarrow> ((vpn2 (hi e)) \\<noteq> (vpn2 (hi f)))\"\n  by(auto simp add:MIPSTLBIndex_def)\n\nlemma \"\\<And>e f. MIPSTLBIndex t e \\<noteq> MIPSTLBIndex t f \\<Longrightarrow> e \\<noteq> f\"\n  by(auto simp add:MIPSTLBIndex_def)    \n\n    \n(* ------------------------------------------------------------------------- *)   \nsubsection \"Deterministic Exception Handler\"  \n(* ------------------------------------------------------------------------- *)    \n    \ntext \"Based on the index calculation above we can define the deterministic\n      exception handler.  \"\n    \ndefinition MipsTLBPT_update_tlb :: \"MipsTLBPT \\<Rightarrow> ASID \\<Rightarrow> VPN  \\<Rightarrow> MipsTLBPT\"\n  where \"MipsTLBPT_update_tlb mpt as vpn = \\<lparr>\n         tlb = \\<lparr> \n            capacity = (capacity (tlb mpt)), \n            wired = (wired (tlb mpt)), \n            random = random (tlb mpt), \n            entries = (entries (tlb mpt))(\n               (MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn))\n                :=  MIPSPT_mk_tlbentry (pte mpt) as vpn) \\<rparr>, \n         pte = (pte mpt)\\<rparr>\"\n\n\ntext \"we show that the definition produces the same result as when using the \n      tlbwi function, and therefore we can use the simpler, direct\n      equivalent.\"\n  \nlemma MipsTLBPT_update_equivalence:\n  \"(capacity  (tlb mpt)) > 0  \\<Longrightarrow> \n    {\\<lparr>tlb = t, pte = (pte mpt)\\<rparr> | t. \n       t \\<in> tlbwi (MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn))\n                 (MIPSPT_mk_tlbentry (pte mpt) as vpn) (tlb mpt)} \n     = {MipsTLBPT_update_tlb mpt as vpn}\"    \nby(simp add:MipsTLBPT_update_tlb_def tlbwi_def MIPSTLBIndex_def)\n\n  \ntext \"The TLB update function does not change the capacity of the TLB.\"\n  \n  \nlemma MipsTLBPT_det_capacity :\n  \"(capacity (tlb (MipsTLBPT_update_tlb mpt as vpn))) = (capacity (tlb mpt))\"\n  by(simp add:MipsTLBPT_update_tlb_def)\n  \n    \n(* ========================================================================= *)  \nsection \"Valid TLB+PageTables\"\n(* ========================================================================= *) \n\n  \ntext \"We say that the combination is valid, if both the TLB and the page table\n     are valid. In addition, the TLB is an instance of the page table if there\n     is a corresponding entry in the page table for all entries in the TLB with\n     a matching ASID. In addition, the deterministic replacement handler\n     ensures a particular location for the entry.\"\n  \n    \ndefinition MipsTLBPT_is_instance :: \"MipsTLBPT \\<Rightarrow> bool\"\n  where \"MipsTLBPT_is_instance mt = (\\<forall>i<(capacity (tlb mt)). \n       (((entries (tlb mt) i) = \n            MIPSPT_mk_tlbentry (pte mt) (asid (hi(entries (tlb mt) i))) (vpn2(hi(entries (tlb mt) i)))) \\<and> \n       (i = MIPSTLBIndex (tlb mt) (entries (tlb mt) i))))\"    \n        \n\ntext \"If the TLB is an instance of the page table then forall entries if\n      the ASID matches with the the ASID of the page table, then the \n      TLB entry must be the same as if its created from the page table.\"  \n  \nlemma  \"MipsTLBPT_is_instance mt \\<Longrightarrow>i < (capacity (tlb mt)) \\<Longrightarrow> \n      (entries (tlb mt) i) = MIPSPT_mk_tlbentry (pte mt)  (asid (hi(entries (tlb mt) i))) (vpn2(hi(entries (tlb mt) i)))\"\n  by(simp add:MipsTLBPT_is_instance_def)\n\n \n  \ntext \"We therefore can define the validity of a MIPS TLB + PageTable combination\n      as the page tables and the TLB are valid and the TLB is an instance of\n      the page tables.\"\n  \ndefinition MipsTLBPT_valid :: \"MipsTLBPT \\<Rightarrow> bool\"\n  where \"MipsTLBPT_valid mt = ((MIPSPT_valid (pte mt)) \\<and> (TLBValid (tlb mt)) \n                              \\<and> (MipsTLBPT_is_instance mt) )\"\n\n    \ntext \"If the MIPS TLB and PageTables are valid then for all VPNs the translate\n      set of the TLB must be a subset of equal to the translate set of the \n      PageTable.\"\n  \n(* TODO *)  \n  \nlemma \"\\<forall>vpn. MipsTLBPT_valid mt \\<Longrightarrow> MIPSTLB_translate (tlb mpt) as vpn\n                 \\<subseteq>  MIPSPT_translate (pte mpt) as vpn\"\n  oops\n    \n\n\n    \n\n(* ========================================================================= *)  \nsection \"Translate Function\"\n(* ========================================================================= *)    \n\ntext \"The Translate function checks whether the VPN can be translated using the\n      TLB. \"  \n       \n  \ndefinition MipsTLBPT_translate :: \"MipsTLBPT \\<Rightarrow> ASID \\<Rightarrow> VPN \\<Rightarrow> PFN set\"\n  where \"MipsTLBPT_translate  mtlb as vpn = \n          MIPSTLB_translate (tlb (MipsTLBPT_update_tlb mtlb as vpn)) as vpn \"\n\n\n\n  \n(* ========================================================================= *)  \nsection \"Proofs\"\n(* ========================================================================= *)    \n\ntext \"Next we proof that if the state of the MIPSTLB and page tables is valid\n      then handling an exception will always results in a valid state again.\"  \n\nlemma MipsTLBT_keeps_instance: \n  \"\\<And>vpn mpt as. MipsTLBPT_valid mpt \\<Longrightarrow> vpn < MIPSPT_EntriesMax \n           \\<Longrightarrow> MipsTLBPT_is_instance(MipsTLBPT_update_tlb mpt as vpn)\"       \n  apply(simp add:MipsTLBPT_valid_def)\n  apply(simp add:MipsTLBPT_is_instance_def)\n  apply(simp add:MipsTLBPT_update_tlb_def MIPSTLBIndex_in_range \n                 MIPSPT_TLBENTRY_asidmatch)\n  apply(simp add:MIPSTLBIndex_def)\n  apply(simp add:MIPSPT_mk_tlbentry_def)\n  apply(simp add:TLBENTRY.make_def)\n  done     \n\nlemma MipsTLBPT_not_match :\nassumes valid: \"MipsTLBPT_valid mpt\"    \n    and inrange: \"\\<And>vpn. vpn < MIPSPT_EntriesMax\"\n    and inoteq : \"\\<And>i vpn. i \\<noteq>  MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)\"\n    and ibound: \"\\<And>i. i < (capacity (tlb mt))\" \n  shows \"\\<And>i vpn.  EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) i) \\<Longrightarrow> False\"\nproof -\n  from valid have inst: \"MipsTLBPT_is_instance mpt\"\n    by(simp add:MipsTLBPT_valid_def)\n  \n  from  inoteq ibound inrange inst have nomatch:\n    \"\\<And>i.  EntryASIDMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) i) = False\"\n    by(auto simp add:EntryASIDMatch_def MipsTLBPT_is_instance_def MIPSPT_TLBENTRY_asid_is \n                     MIPSPT_mk_tlbentry_def TLBENTRY.make_def)\n  \n  from  inoteq ibound inrange inst nomatch \n    show \"\\<And>i vpn.  EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) i) \\<Longrightarrow> False\"\n    by(auto simp:EntryASIDMatch_def)\nqed\n    \n\n\n\n  \nlemma MipsTLBT_keeps_TLBValid :\n  assumes valid: \"MipsTLBPT_valid mpt \"\n    and inrange: \"\\<And>vpn. vpn < MIPSPT_EntriesMax\"\n    and inrange2: \"\\<And>as. ASIDValid as\"\n      shows \"\\<And>vpn as. TLBValid(tlb (MipsTLBPT_update_tlb mpt as vpn))\"       \nproof -\n  from valid have X0: \"TLBValid (tlb mpt)\" \n    by(auto simp add:MipsTLBPT_valid_def)\n  \n  from X0 have alleven: \"\\<forall>i < (capacity (tlb mpt)). even (vpn2 (hi (entries (tlb mpt) i)))\"\n    by(simp add:TLBValid_def TLBEntryWellFormed_def TLBENTRYWellFormed_def TLBENTRYHIWellFormed_def \n                VPN2Valid_def)\n      \n  also have X1: \"\\<And>vpn as. (wired (tlb (MipsTLBPT_update_tlb mpt as vpn))) =  (wired (tlb mpt)) \"\n    by(simp add:MipsTLBPT_update_tlb_def)\n\n  from valid have X2: \"MipsTLBPT_is_instance mpt\"\n    by(auto simp:MipsTLBPT_valid_def)\n      \n  from valid have X3: \" MIPSPT_valid (pte mpt)\" \n    by(auto simp:MipsTLBPT_valid_def)\n  \n  from inrange inrange2 X3 have X5: \n      \"\\<And>vpn as. TLBENTRYWellFormed ( MIPSPT_mk_tlbentry (pte mpt) as vpn) \"      \n      by(simp add:MIPSPT_TLBENTRY_wellformed)\n      \n  from inrange X3 X0 X5 have X4: \"\\<And>vpn as. \\<forall>i<(capacity (tlb mpt)).\n        TLBEntryWellFormed (tlb (MipsTLBPT_update_tlb mpt as vpn)) i\"\n  proof -\n    \n    have A0:  \"\\<And>vpn as. (\\<forall>i<(capacity (tlb mpt)).\n           TLBEntryWellFormed (tlb (MipsTLBPT_update_tlb mpt as vpn)) i) =\n          (\\<forall>i<(capacity (tlb mpt)). \n              (i = (MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn))\n                   \\<longrightarrow> TLBEntryWellFormed (tlb (MipsTLBPT_update_tlb mpt as vpn)) i) \\<and>\n              (i \\<noteq> (MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn))\n                   \\<longrightarrow> TLBEntryWellFormed (tlb (MipsTLBPT_update_tlb mpt as vpn)) i))\"\n      by(auto)\n    \n        \n    have A1:  \"... = ( \\<lambda>vpn as. \\<forall>i<(capacity (tlb mpt)).\n        (i = MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n            \\<longrightarrow> TLBENTRYWellFormed (MIPSPT_mk_tlbentry (pte mpt) as vpn)) \\<and>\n        (i \\<noteq> MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)\n            \\<longrightarrow> TLBENTRYWellFormed (entries (tlb mpt) i)))\"\n      \n      by(simp add:MipsTLBPT_update_tlb_def TLBEntryWellFormed_def)\n    \n    with inrange A1 A0 X0 X3 show \"\\<And>vpn as. \\<forall>i<(capacity (tlb mpt)).\n        TLBEntryWellFormed (tlb (MipsTLBPT_update_tlb mpt as vpn)) i\"\n      by(auto simp:MIPSPT_TLBENTRY_wellformed TLBValid_def TLBEntryWellFormed_def MIPSTLBIndex_in_range)\n  qed\n      \n  from X0 X1 X4 have X6: \n      \"\\<And>vpn as. TLBValid (tlb (MipsTLBPT_update_tlb mpt as vpn)) = \n      (\\<forall>i<(capacity (tlb mpt)).\n          TLBEntryConflictSet (entries (tlb (MipsTLBPT_update_tlb mpt as vpn)) i)\n                              (tlb (MipsTLBPT_update_tlb mpt as vpn)) \\<subseteq> {i})\"\n    by(simp add:TLBValid_def MipsTLBPT_det_capacity)\n  \n  from inrange X2 have X7: \"... =  (\\<lambda>vpn as. \\<forall>i<(capacity (tlb mpt)). \n        {ia. ia < (capacity (tlb mpt)) \\<and> \n            EntryMatch (entries (tlb (MipsTLBPT_update_tlb mpt as vpn)) ia) \n                       (entries (tlb (MipsTLBPT_update_tlb mpt as vpn)) i)} \\<subseteq> {i})\"\n   by(simp add:TLBEntryConflictSet_def MipsTLBPT_det_capacity)\n    \n      \n  from inrange X2 have X8: \"... = (\\<lambda>vpn as. \\<forall>i. (i = MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \\<longrightarrow>\n          {ia. ia \\<noteq> MIPSTLBIndex  (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n            \\<longrightarrow> ia < (capacity (tlb mpt)) \\<and> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) ia)}\n          \\<subseteq> {MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as  vpn)}) \\<and>\n         (i \\<noteq> MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt)as vpn) \\<longrightarrow>\n          i < (capacity (tlb mpt)) \\<longrightarrow>\n          {ia. (ia = MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n              \\<longrightarrow> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) i)) \\<and>\n               (ia \\<noteq> MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n              \\<longrightarrow> ia < (capacity (tlb mpt)) \\<and> EntryMatch (entries (tlb mpt) i) (entries (tlb mpt) ia))}\n          \\<subseteq> {i}))\"      \n    by(auto simp add:MipsTLBPT_update_tlb_def MIPSTLBIndex_in_range EntryMatch_true EntryMatch_commute  )\n            \n  from inrange valid  have X10: \"... =  (\\<lambda>vpn as. \\<forall>i. (i = MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)\n         \\<longrightarrow>  {ia. ia \\<noteq> MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n              \\<longrightarrow> ia < (capacity (tlb mpt)) \\<and> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) ia)}\n          \\<subseteq> {MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)}) \\<and>\n         (i \\<noteq> MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \\<longrightarrow>\n          i < (capacity (tlb mpt)) \\<longrightarrow>\n          {ia. ia \\<noteq> MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \\<and>\n                ia < (capacity (tlb mpt)) \\<and> EntryMatch (entries (tlb mpt) i) (entries (tlb mpt) ia)}\n          \\<subseteq> {i}))\"\n    by(auto simp add:MipsTLBPT_not_match)\n  \n    from inrange valid X0 have X11:  \"... =  (\\<lambda>vpn as. \\<forall>i. (i = MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \\<longrightarrow>\n          {ia. ia \\<noteq> MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)\n      \\<longrightarrow> ia < (capacity (tlb mpt)) \\<and> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) ia)}\n          \\<subseteq> {MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)}))\"\n      by(auto simp add:TLBValid_def TLBEntryConflictSet_def)\n    \n    have X12: \"... = (\\<lambda>vpn as. {ia. ia \\<noteq> MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)\n      \\<longrightarrow> ia < (capacity (tlb mpt)) \\<and> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) ia)}\n          \\<subseteq> {MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)})\"\n      by(auto)\n        \n    \n    have X13: \"... = (\\<lambda>vpn as. \n          { MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) } \\<union> \n          {ia. ia < (capacity (tlb mpt)) \\<and> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) ia)}\n          \\<subseteq> {MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)})\"\n      by(auto)\n        \n    have X14: \"... =  (\\<lambda>vpn as. \n          { MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) } \\<union>\n           {ia. ia < (capacity (tlb mpt)) \n              \\<and>  ia \\<noteq>  MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)\n              \\<and> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) ia)} \\<union>\n           {ia. ia < (capacity (tlb mpt)) \n              \\<and> ia =  MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n              \\<and> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) ia)}\n          \\<subseteq> {MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)})\"\n     by(auto)\n   \n   have X15: \"... =  (\\<lambda>vpn as. \n     {ia. ia < (capacity (tlb mpt)) \n        \\<and> ia \\<noteq> MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n        \\<and> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) ia)} \\<union>\n     {ia. ia < (capacity (tlb mpt)) \n        \\<and> ia = MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n        \\<and> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) ia)}\n     \\<subseteq> {MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)})\"\n     by(simp)\n   \n   from valid inrange have X16: \"... = ( \\<lambda>vpn as. \n      {ia. ia < (capacity (tlb mpt)) \n          \\<and> ia = MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn) \n          \\<and> EntryMatch (MIPSPT_mk_tlbentry (pte mpt) as vpn) (entries (tlb mpt) ia)}\n     \\<subseteq> {MIPSTLBIndex (tlb mpt) (MIPSPT_mk_tlbentry (pte mpt) as vpn)})\"\n     by(auto simp add:MipsTLBPT_not_match )\n   \n   with valid inrange alleven inrange2 X0 X1 X2 X3 X4 X5 X6 X7 X8 X10 X11 X12 X13 X14 X15 X16\n    show \"\\<And>vpn as. TLBValid(tlb (MipsTLBPT_update_tlb mpt as vpn))\"\n      by(auto)\nqed\n  \n  \n\nlemma MipsTLBT_keeps_ptvalid: \"\\<And>vpn mpt as. MipsTLBPT_valid mpt \\<Longrightarrow> vpn < MIPSPT_EntriesMax \n           \\<Longrightarrow>  MIPSPT_valid (pte (MipsTLBPT_update_tlb mpt as vpn))\"       \n  by(simp add:MipsTLBPT_valid_def MipsTLBPT_update_tlb_def)\n  \n    \n    \nlemma \n    assumes valid: \"MipsTLBPT_valid mpt \"\n    and inrange: \"\\<And>vpn. vpn < MIPSPT_EntriesMax\"\n    and inrange2: \"\\<And>as. ASIDValid as\"\nshows  \"\\<And>vpn as.  MipsTLBPT_valid(MipsTLBPT_update_tlb mpt as vpn)\"\n  apply(subst MipsTLBPT_valid_def)\n  apply(simp add:MipsTLBT_keeps_ptvalid valid inrange)\n  apply(simp add:MipsTLBT_keeps_instance valid inrange)\n  apply(simp add:MipsTLBT_keeps_TLBValid valid inrange inrange2)\n  done\n\n    \n(* ========================================================================= *)  \nsection \"Equivalence to Large TLB\"\n(* ========================================================================= *)  \n\ntext \"Next we show that for all \" \n\nlemma \"\\<And>mpt vpn as. MipsTLBPT_translate mpt as vpn = MIPSTLB_translate (MipsTLBLarge_create (pte mpt)) as vpn\"\n  oops\n    \nend ", "meta": {"author": "BarrelfishOS", "repo": "Isabelle-hardware-models", "sha": "a638383df9dd8db15805c59efb65724bc919df0a", "save_path": "github-repos/isabelle/BarrelfishOS-Isabelle-hardware-models", "path": "github-repos/isabelle/BarrelfishOS-Isabelle-hardware-models/Isabelle-hardware-models-a638383df9dd8db15805c59efb65724bc919df0a/theories/mipstlb/MipsTLBReplacementHandlerDeter.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.6001883449573376, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.30243861050363874}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Weak_Early_Sim_Pres\n  imports Weak_Early_Sim\nbegin\n\nlemma tauPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"\\<tau>.(P) \\<leadsto><Rel> \\<tau>.(Q)\"\nproof(induct rule: simCases)\n  case(Bound Q' a x)\n  have \"\\<tau>.(Q) \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n  hence False by(induct rule: tauCases', auto)\n  thus ?case by simp\nnext\n  case(Free Q' \\<alpha>)\n  have \"\\<tau>.(Q) \\<longmapsto>(\\<alpha> \\<prec> Q')\" by fact\n  thus ?case\n  proof(induct rule: tauCases', auto simp only: pi.inject residual.inject)\n    have \"\\<tau>.(P) \\<Longrightarrow>\\<^sup>^ \\<tau> \\<prec> P\" by(rule Tau)\n    with PRelQ show \"\\<exists>P'. \\<tau>.(P) \\<Longrightarrow>\\<^sup>^\\<tau> \\<prec> P' \\<and> (P', Q) \\<in> Rel\" by blast\n  qed\nqed\n\nlemma inputPres:\n  fixes P    :: pi\n  and   x    :: name\n  and   Q    :: pi\n  and   a    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"\\<forall>y. (P[x::=y], Q[x::=y]) \\<in> Rel\"\n  and     Eqvt: \"eqvt Rel\"\n\n  shows \"a<x>.P \\<leadsto><Rel> a<x>.Q\"\nusing Eqvt\nproof(induct rule: simCasesCont[where C=\"(x, a, P, Q)\"])\n  case(Bound b y Q')\n  from \\<open>y \\<sharp> (x, a, P, Q)\\<close> have \"y \\<noteq> x\" \"y \\<noteq> a\" \"y \\<sharp> P\" \"y \\<sharp> Q\" by simp+\n  from \\<open>a<x>.Q \\<longmapsto>b<\\<nu>y> \\<prec> Q'\\<close> \\<open>y \\<noteq> a\\<close> \\<open>y \\<noteq> x\\<close> \\<open>y \\<sharp> Q\\<close> show ?case\n    by(erule_tac inputCases') auto\nnext\n  case(Free \\<alpha> Q')\n  from \\<open>a<x>.Q \\<longmapsto> \\<alpha> \\<prec> Q'\\<close>\n  show ?case\n  proof(induct rule: inputCases)\n    case(cInput u)\n    have \"a<x>.P \\<Longrightarrow>\\<^sup>^(a<u>) \\<prec> P[x::=u]\"\n      by(rule Input)\n    moreover from PRelQ have \"(P[x::=u], Q[x::=u]) \\<in> Rel\" by auto\n    ultimately show ?case by blast\n  qed\nqed\n\nlemma outputPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n\n  assumes PRelQ: \"(P, Q) \\<in> Rel\"\n\n  shows \"a{b}.P \\<leadsto><Rel> a{b}.Q\"\nproof(induct rule: simCases)\n  case(Bound Q' c x)\n  have \"a{b}.Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n  hence False by(induct rule: outputCases', auto)\n  thus ?case by simp\nnext\n  case(Free Q' \\<alpha>)\n  have \"a{b}.Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus \"\\<exists>P'. a{b}.P \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel\"\n  proof(induct rule: outputCases', auto simp add: pi.inject residual.inject)\n    have \"a{b}.P \\<Longrightarrow>\\<^sup>^ a[b] \\<prec> P\" by(rule Output)\n    with PRelQ show \"\\<exists>P'. a{b}.P \\<Longrightarrow>\\<^sup>^ a[b] \\<prec> P' \\<and> (P', Q) \\<in> Rel\" by blast\n  qed\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     RelStay: \"\\<And>R S c. (R, S) \\<in> Rel \\<Longrightarrow> ([c\\<frown>c]R, S) \\<in> Rel\"\n\n  shows \"[a\\<frown>b]P \\<leadsto><Rel'> [a\\<frown>b]Q\"\nproof(induct rule: simCases)\n  case(Bound Q' c x)\n  have \"x \\<sharp> [a\\<frown>b]P\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n  have \"[a\\<frown>b]Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case Match\n    have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>c<\\<nu>x> \\<prec> P'\"\n                                   and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans have \"[a\\<frown>a]P \\<Longrightarrow>c<\\<nu>x> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Match)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nnext\n  case(Free Q' \\<alpha>)\n  have \"[a\\<frown>b]Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: matchCases)\n    case Match\n    have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where \"P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P'\" and \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    thus ?case\n    proof(induct rule: transitionCases)\n      case Step\n      have \"P \\<Longrightarrow>\\<alpha> \\<prec> P'\" by fact\n      hence \"[a\\<frown>a]P \\<Longrightarrow>\\<alpha> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Match)\n      with RelRel' \\<open>(P', Q') \\<in> Rel\\<close> show ?case by(force simp add: weakFreeTransition_def)\n    next\n      case Stay\n      have \"[a\\<frown>a]P \\<Longrightarrow>\\<^sup>^\\<tau> \\<prec> [a\\<frown>a]P\" by(simp add: weakFreeTransition_def)\n      moreover from \\<open>(P, Q') \\<in> Rel\\<close> have \"([a\\<frown>a]P, Q') \\<in> Rel\" by(blast intro: RelStay)\n      ultimately show ?case using RelRel' by blast\n    qed\n  qed\nqed\n\nlemma mismatchPres:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   a    :: name\n  and   b    :: name\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     RelStay: \"\\<And>R S c d. \\<lbrakk>(R, S) \\<in> Rel; c \\<noteq> d\\<rbrakk> \\<Longrightarrow> ([c\\<noteq>d]R, S) \\<in> Rel\"\n\n  shows \"[a\\<noteq>b]P \\<leadsto><Rel'> [a\\<noteq>b]Q\"\nproof(induct rule: simCases)\n  case(Bound Q' c x)\n  have \"x \\<sharp> [a\\<noteq>b]P\" by fact\n  hence xFreshP: \"(x::name) \\<sharp> P\" by simp\n  have \"[a\\<noteq>b]Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: mismatchCases)\n    case Mismatch\n    have aineqb: \"a \\<noteq> b\" by fact\n    have \"Q \\<longmapsto>c<\\<nu>x> \\<prec> Q'\" by fact\n    with PSimQ xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>c<\\<nu>x> \\<prec> P'\"\n                                   and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    from PTrans aineqb have \"[a\\<noteq>b]P \\<Longrightarrow>c<\\<nu>x> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Mismatch)\n    moreover from P'RelQ' RelRel' have \"(P', Q') \\<in> Rel'\" by blast\n    ultimately show ?case by blast\n  qed\nnext\n  case(Free Q' \\<alpha>)\n  have \"[a\\<noteq>b]Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n  thus ?case\n  proof(induct rule: mismatchCases)\n    case Mismatch\n    have aineqb: \"a \\<noteq> b\" by fact\n    have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    with PSimQ obtain P' where \"P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P'\" and \"(P', Q') \\<in> Rel\"\n      by(blast dest: simE)\n    thus ?case\n    proof(induct rule: transitionCases)\n      case Step\n      have \"P \\<Longrightarrow>\\<alpha> \\<prec> P'\" by fact\n      hence \"[a\\<noteq>b]P \\<Longrightarrow>\\<alpha> \\<prec> P'\" using aineqb by(rule Weak_Early_Step_Semantics.Mismatch)\n      with RelRel' \\<open>(P', Q') \\<in> Rel\\<close> show ?case by(force simp add: weakFreeTransition_def)\n    next\n      case Stay\n      have \"[a\\<noteq>b]P \\<Longrightarrow>\\<^sup>^\\<tau> \\<prec> [a\\<noteq>b]P\" by(simp add: weakFreeTransition_def)\n      moreover from \\<open>(P, Q') \\<in> Rel\\<close> aineqb have \"([a\\<noteq>b]P, Q') \\<in> Rel\" by(blast intro: RelStay)\n      ultimately show ?case using RelRel' by blast\n    qed\n  qed\nqed\n\nlemma parCompose:\n  fixes P     :: pi\n  and   Q     :: pi\n  and   R     :: pi\n  and   S     :: pi\n  and   Rel   :: \"(pi \\<times> pi) set\"\n  and   Rel'  :: \"(pi \\<times> pi) set\"\n  and   Rel'' :: \"(pi \\<times> pi) set\"\n  \n  assumes PSimQ:    \"P \\<leadsto><Rel> Q\"\n  and     RSimT:    \"R \\<leadsto><Rel'> S\"\n  and     PRelQ:    \"(P, Q) \\<in> Rel\"\n  and     RRel'T:   \"(R, S) \\<in> Rel'\"\n  and     Par:      \"\\<And>P' Q' R' S'. \\<lbrakk>(P', Q') \\<in> Rel; (R', S') \\<in> Rel'\\<rbrakk> \\<Longrightarrow> (P' \\<parallel> R', Q' \\<parallel> S') \\<in> Rel''\"\n  and     Res:      \"\\<And>T U x. (T, U) \\<in> Rel'' \\<Longrightarrow> (<\\<nu>x>T, <\\<nu>x>U) \\<in> Rel''\"\n\n  shows \"P \\<parallel> R \\<leadsto><Rel''> Q \\<parallel> S\"\nproof -\n  show ?thesis\n  proof(induct rule: simCases)\n    case(Bound Q' a x)\n    have \"x \\<sharp> P \\<parallel> R\" by fact\n    hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n    have \"Q \\<parallel> S \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" by fact\n    thus ?case\n    proof(induct rule: parCasesB)\n      case(cPar1 Q')\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" and xFreshT: \"x \\<sharp> S\" by fact+\n      from xFreshP PSimQ QTrans obtain P' where PTrans:\"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n                                            and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>x> \\<prec> (P' \\<parallel> R)\" by(rule Weak_Early_Step_Semantics.Par1B)\n      moreover from P'RelQ' RRel'T have \"(P' \\<parallel> R, Q' \\<parallel> S) \\<in> Rel''\" by(rule Par)\n      ultimately show ?case by blast\n    next\n      case(cPar2 S')\n      have STrans: \"S \\<longmapsto> a<\\<nu>x> \\<prec> S'\" and xFreshQ: \"x \\<sharp> Q\" by fact+\n      from xFreshR RSimT STrans obtain R' where RTrans:\"R \\<Longrightarrow>a<\\<nu>x> \\<prec> R'\"\n                                            and R'Rel'T': \"(R', S') \\<in>  Rel'\"\n        by(blast dest: simE)\n      from RTrans xFreshP xFreshR have ParTrans: \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>x> \\<prec> (P \\<parallel> R')\"\n        by(blast intro: Weak_Early_Step_Semantics.Par2B)\n      moreover from PRelQ R'Rel'T' have \"(P \\<parallel> R', Q \\<parallel>  S') \\<in> Rel''\" by(rule Par)\n      ultimately show ?case by blast\n    qed\n  next\n    case(Free QT' \\<alpha>)\n    have \"Q \\<parallel> S \\<longmapsto> \\<alpha> \\<prec> QT'\" by fact\n    thus ?case\n    proof(induct rule: parCasesF[of _ _ _ _ _ \"(P, R)\"])\n      case(cPar1 Q')\n      have \"Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n      with PSimQ obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> P'\" and PRel: \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Early_Semantics.Par1F)\n      moreover from PRel RRel'T have \"(P' \\<parallel> R, Q' \\<parallel> S) \\<in> Rel''\" by(blast intro: Par)\n      ultimately show ?case by blast\n    next\n      case(cPar2 S')\n      have \"S \\<longmapsto> \\<alpha> \\<prec> S'\" by fact\n      with RSimT obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> R'\" and RRel: \"(R', S') \\<in> Rel'\"\n        by(blast dest: simE)\n      from RTrans have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> P \\<parallel> R'\" by(rule Weak_Early_Semantics.Par2F)\n      moreover from PRelQ RRel have \"(P \\<parallel> R', Q \\<parallel> S') \\<in> Rel''\" by(blast intro: Par)\n      ultimately show ?case by blast\n    next\n      case(cComm1 Q' S' a b)\n      have QTrans: \"Q \\<longmapsto> a<b> \\<prec> Q'\" and STrans: \"S \\<longmapsto> a[b] \\<prec> S'\" by fact+\n\n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<b> \\<prec> P'\"\n                                    and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(fastforce dest: simE simp add: weakFreeTransition_def)\n      \n      from RSimT STrans obtain R' where RTrans: \"R \\<Longrightarrow>a[b] \\<prec> R'\"\n                                    and RRel: \"(R', S') \\<in> Rel'\"\n        by(fastforce dest: simE simp add: weakFreeTransition_def)\n      \n      from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> P' \\<parallel> R'\" by(rule Weak_Early_Step_Semantics.Comm1)\n      hence \"P \\<parallel> R \\<Longrightarrow>\\<^sup>^\\<tau> \\<prec> P' \\<parallel> R'\" \n        by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n\n      moreover from P'RelQ' RRel have \"(P' \\<parallel> R', Q' \\<parallel> S') \\<in> Rel''\" by(rule Par)\n      ultimately show ?case by blast\n    next\n      case(cComm2 Q' S' a b)\n      have QTrans: \"Q \\<longmapsto>a[b] \\<prec> Q'\" and STrans: \"S \\<longmapsto>a<b> \\<prec> S'\" by fact+\n      \n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a[b] \\<prec> P'\"\n                                    and PRel: \"(P', Q') \\<in> Rel\"\n        by(fastforce dest: simE simp add: weakFreeTransition_def)\n      \n      from RSimT STrans obtain R' where RTrans: \"R \\<Longrightarrow>a<b> \\<prec> R'\"\n                                   and R'Rel'T': \"(R', S') \\<in> Rel'\"\n        by(fastforce dest: simE simp add: weakFreeTransition_def)\n      \n      from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> P' \\<parallel> R'\" by(rule Weak_Early_Step_Semantics.Comm2)\n      hence \"P \\<parallel> R \\<Longrightarrow>\\<^sup>^\\<tau> \\<prec> P' \\<parallel> R'\" \n        by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n      moreover from PRel R'Rel'T' have \"(P' \\<parallel> R', Q' \\<parallel> S') \\<in> Rel''\" by(rule Par)\n      ultimately show ?case by blast\n    next\n      case(cClose1 Q' S' a x)\n      have QTrans: \"Q \\<longmapsto>a<x> \\<prec> Q'\" and STrans: \"S \\<longmapsto>a<\\<nu>x> \\<prec> S'\" by fact+\n      have \"x \\<sharp> (P, R)\" by fact\n      hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by(simp add: fresh_prod)+\n      \n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<x> \\<prec> P'\"\n                                    and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(fastforce dest: simE simp add: weakFreeTransition_def)\n      \n      from RSimT STrans xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>a<\\<nu>x> \\<prec> R'\" \n                                            and R'Rel'T': \"(R', S') \\<in> Rel'\"\n        by(blast dest: simE)\n       \n      from PTrans RTrans xFreshP have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n        by(rule Weak_Early_Step_Semantics.Close1)\n      hence \"P \\<parallel> R \\<Longrightarrow>\\<^sup>^\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\" \n        by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n      moreover from P'RelQ' R'Rel'T' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> S')) \\<in> Rel''\"\n        by(blast intro: Par Res)\n      ultimately show ?case by blast\n    next\n      case(cClose2 Q' S' a x)\n      have QTrans: \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" and STrans: \"S \\<longmapsto>a<x> \\<prec> S'\" by fact+\n      have \"x \\<sharp> (P, R)\" by fact\n      hence xFreshR: \"x \\<sharp> R\" and xFreshP: \"x \\<sharp> P\" by(simp add: fresh_prod)+\n\n      from PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n                                            and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      \n      from RSimT STrans obtain R' where RTrans: \"R \\<Longrightarrow>a<x> \\<prec> R'\"\n                                    and R'Rel'T': \"(R', S') \\<in> Rel'\"\n        by(fastforce dest: simE simp add: weakFreeTransition_def)\n      from PTrans RTrans xFreshR have Trans: \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n        by(rule Weak_Early_Step_Semantics.Close2)\n      hence \"P \\<parallel> R \\<Longrightarrow>\\<^sup>^\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\" \n        by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n      moreover from P'RelQ' R'Rel'T' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> S')) \\<in> Rel''\"\n        by(blast intro: Par Res)\n      ultimately show ?case by blast\n    qed\n  qed\nqed\n\nlemma parPres:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   R   :: pi\n  and   a   :: name\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   Rel' :: \"(pi \\<times> pi) set\"\n  \n  assumes PSimQ:    \"P \\<leadsto><Rel> Q\"\n  and     PRelQ:    \"(P, Q) \\<in> Rel\"\n  and     Par:      \"\\<And>S T U. (S, T) \\<in> Rel \\<Longrightarrow> (S \\<parallel> U, T \\<parallel> U) \\<in> Rel'\"\n  and     Res:      \"\\<And>S T x. (S, T) \\<in> Rel' \\<Longrightarrow> (<\\<nu>x>S, <\\<nu>x>T) \\<in> Rel'\"\n\n  shows \"P \\<parallel> R \\<leadsto><Rel'> Q \\<parallel> R\"\nproof -\n  note PSimQ \n  moreover have RSimR: \"R \\<leadsto><Id> R\" by(auto intro: reflexive)\n  moreover note PRelQ moreover have \"(R, R) \\<in> Id\" by auto\n  moreover from Par have \"\\<And>P Q R T. \\<lbrakk>(P, Q) \\<in> Rel; (R, T) \\<in> Id\\<rbrakk> \\<Longrightarrow> (P \\<parallel> R, Q \\<parallel> T) \\<in> Rel'\"\n    by auto\n  ultimately show ?thesis using Res by(rule parCompose)\nqed\n\n\n\n  assumes PSimQ: \"P \\<leadsto><Rel> Q\"\n  and     ResRel: \"\\<And>R S y. (R, S) \\<in> Rel \\<Longrightarrow> (<\\<nu>y>R, <\\<nu>y>S) \\<in> Rel'\"\n  and     RelRel': \"Rel \\<subseteq> Rel'\"\n  and     EqvtRel: \"eqvt Rel\"\n  and     EqvtRel': \"eqvt Rel'\"\n\n  shows \"<\\<nu>x>P \\<leadsto><Rel'> <\\<nu>x>Q\"\nproof -\n  from EqvtRel' show ?thesis\n  proof(induct rule: simCasesCont[where C=\"(P, x)\"])\n    case(Bound a y Q')\n    have Trans: \"<\\<nu>x>Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" by fact\n    have \"y \\<sharp> (P, x)\" by fact\n    hence yineqx: \"y \\<noteq> x\" and yFreshP: \"y \\<sharp> P\" by(simp add: fresh_prod)+\n    from Trans yineqx show ?case\n    proof(induct rule: resCasesB)\n      case(Open Q')\n      have QTrans: \"Q \\<longmapsto>a[x] \\<prec> Q'\" and aineqx: \"a \\<noteq> x\" by fact+\n\n      from PSimQ QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sup>^a[x] \\<prec> P'\"\n                                    and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      \n      from PTrans aineqx have \"<\\<nu>x>P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\" \n        by(force intro: Weak_Early_Step_Semantics.Open simp add: weakFreeTransition_def)\n      with \\<open>y \\<sharp> P\\<close> \\<open>y \\<noteq> x\\<close> have \"<\\<nu>x>P \\<Longrightarrow>a<\\<nu>y> \\<prec> ([(y, x)] \\<bullet> P')\"\n        by(force intro: weakTransitionAlpha simp add: abs_fresh name_swap)\n      moreover from EqvtRel P'RelQ' RelRel' have \"([(y, x)] \\<bullet> P', [(y, x)] \\<bullet> Q') \\<in> Rel'\"\n        by(blast intro: eqvtRelI)\n      ultimately show ?case by blast\n    next\n      case(Res Q')\n      have QTrans: \"Q \\<longmapsto>a<\\<nu>y> \\<prec> Q'\" and xineqa: \"x \\<noteq> a\" by fact+\n\n      from PSimQ yFreshP QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>y> \\<prec> P'\"\n                                            and P'RelQ': \"(P', Q') \\<in> Rel\"\n        by(blast dest: simE)\n      from PTrans xineqa yineqx yFreshP have ResTrans: \"<\\<nu>x>P \\<Longrightarrow>a<\\<nu>y> \\<prec> (<\\<nu>x>P')\"\n        by(blast intro: Weak_Early_Step_Semantics.ResB)\n      moreover from P'RelQ' have \"((<\\<nu>x>P'), (<\\<nu>x>Q')) \\<in> Rel'\"\n        by(rule ResRel)\n      ultimately show ?case by blast\n    qed\n  next\n    case(Free \\<alpha> Q')\n    have QTrans: \"<\\<nu>x>Q \\<longmapsto> \\<alpha> \\<prec> Q'\" by fact\n    have \"\\<exists>c::name. c \\<sharp> (P, Q, Q', \\<alpha>)\" by(blast intro: name_exists_fresh)\n    then obtain c::name where cFreshQ: \"c \\<sharp> Q\" and cFreshAlpha: \"c \\<sharp> \\<alpha>\" and cFreshQ': \"c \\<sharp> Q'\" and cFreshP: \"c \\<sharp> P\"\n      by(force simp add: fresh_prod)\n    from cFreshP have \"<\\<nu>x>P = <\\<nu>c>([(x, c)] \\<bullet> P)\" by(simp add: alphaRes)\n    moreover have \"\\<exists>P'.<\\<nu>c>([(x, c)] \\<bullet> P) \\<Longrightarrow>\\<^sup>^ \\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel'\"\n    proof -\n      from QTrans cFreshQ have \"<\\<nu>c>([(x, c)] \\<bullet> Q) \\<longmapsto>\\<alpha> \\<prec> Q'\" by(simp add: alphaRes)\n      moreover have \"c \\<sharp> \\<alpha>\" by(rule cFreshAlpha)\n      moreover from PSimQ EqvtRel have \"([(x, c)] \\<bullet> P) \\<leadsto><Rel> ([(x, c)] \\<bullet> Q)\"\n        by(blast intro: eqvtI)\n      ultimately show ?thesis\n        apply(induct rule: resCasesF, auto simp add: residual.inject pi.inject name_abs_eq)\n        by(blast intro: ResF ResRel dest: simE)\n    qed\n\n    ultimately show ?case by force\n  qed\nqed\n\nlemma resChainI:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n  and   lst :: \"name list\"\n\n  assumes eqvtRel: \"eqvt Rel\"\n  and     Res:     \"\\<And>R S y. (R, S) \\<in> Rel \\<Longrightarrow> (<\\<nu>y>R, <\\<nu>y>S) \\<in> Rel\"\n  and     PRelQ:   \"P \\<leadsto><Rel> Q\"\n\n  shows \"(resChain lst) P \\<leadsto><Rel> (resChain lst) Q\"\nproof -\n  show ?thesis\n  proof(induct lst) (* Base case *)\n    from PRelQ show \"resChain [] P \\<leadsto><Rel> resChain [] Q\" by simp\n  next (* Inductive step *)\n    fix a lst\n    assume IH: \"(resChain lst P) \\<leadsto><Rel> (resChain lst Q)\"\n    moreover from Res have \"\\<And>P Q a. (P, Q) \\<in> Rel \\<Longrightarrow> (<\\<nu>a>P, <\\<nu>a>Q) \\<in> Rel\"\n      by simp\n    moreover have \"Rel \\<subseteq> Rel\" by simp\n    ultimately have \"<\\<nu>a>(resChain lst P) \\<leadsto><Rel> <\\<nu>a>(resChain lst Q)\" using eqvtRel\n      by(rule_tac resPres)\n    thus \"resChain (a # lst) P \\<leadsto><Rel> resChain (a # lst) Q\"\n      by simp\n  qed\nqed\n\n\n\n  and     ParComp:     \"\\<And>R S T U. \\<lbrakk>(R, S) \\<in> Rel; (T, U) \\<in> Rel'\\<rbrakk> \\<Longrightarrow> (R \\<parallel> T, S \\<parallel> U) \\<in> Rel'\"\n  and     Res:         \"\\<And>R S x. (R, S) \\<in> Rel' \\<Longrightarrow> (<\\<nu>x>R, <\\<nu>x>S) \\<in> Rel'\"\n\n  and     RelStay:        \"\\<And>R S. (R \\<parallel> !R, S) \\<in> Rel' \\<Longrightarrow> (!R, S) \\<in> Rel'\"\n  and     BangRelRel': \"(bangRel Rel) \\<subseteq> Rel'\"\n  and     eqvtRel':    \"eqvt Rel'\"\n\n  shows \"!P \\<leadsto><Rel'> !Q\"\nproof -\n  let ?Sim = \"\\<lambda>P Rs. (\\<forall>a x Q'. Rs = a<\\<nu>x> \\<prec> Q' \\<longrightarrow> x \\<sharp> P \\<longrightarrow> (\\<exists>P'. P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel')) \\<and>\n                     (\\<forall>\\<alpha> Q'. Rs = \\<alpha> \\<prec> Q' \\<longrightarrow> (\\<exists>P'. P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel'))\"\n  {\n    fix Rs P\n    assume \"!Q \\<longmapsto> Rs\" and \"(P, !Q) \\<in> bangRel Rel\"\n    hence \"?Sim P Rs\" using PRelQ\n    proof(nominal_induct avoiding: P rule: bangInduct)\n      case(Par1B a x Q')\n      have QTrans: \"Q \\<longmapsto>a<\\<nu>x> \\<prec> Q'\" and xFreshQ: \"x \\<sharp> Q\" by fact+\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelT: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        from PRelQ have PSimQ: \"P \\<leadsto><Rel> Q\" by(rule Sim)\n        from \\<open>x \\<sharp> P\\<close> \\<open>x \\<sharp> Q\\<close> show ?case\n        proof(auto simp add: residual.inject alpha' name_fresh_fresh)\n          from PSimQ QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n                                                and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: simE)\n          from PTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>x>\\<prec> (P' \\<parallel> R)\"\n            by(rule Weak_Early_Step_Semantics.Par1B)\n          moreover from P'RelQ' RBangRelT BangRelRel' have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> Rel'\"\n            by(blast intro: Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q' \\<parallel> !Q) \\<in> Rel'\" by blast\n        next\n          fix y\n          assume \"(y::name) \\<sharp> Q'\" and \"y \\<sharp> P\" and \"y \\<sharp> R\"\n          from QTrans \\<open>y \\<sharp> Q'\\<close> have \"Q \\<longmapsto>a<\\<nu>y> \\<prec> ([(x, y)] \\<bullet> Q')\" by(simp add: alphaBoundOutput)\n          with PSimQ \\<open>y \\<sharp> P\\<close> obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>y> \\<prec> P'\"\n                                         and P'RelQ': \"(P', [(x, y)] \\<bullet> Q') \\<in> Rel\"\n            by(blast dest: simE)\n          from PTrans \\<open>y \\<sharp> R\\<close> have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>y>\\<prec> (P' \\<parallel> R)\" by(rule Weak_Early_Step_Semantics.Par1B)\n          moreover from P'RelQ' RBangRelT BangRelRel' have \"(P' \\<parallel> R, ([(y, x)] \\<bullet> Q') \\<parallel> !Q) \\<in> Rel'\"\n            by(fastforce intro: Rel.BRPar simp add: name_swap) \n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>a<\\<nu>y> \\<prec> P' \\<and> (P', ([(y, x)] \\<bullet> Q') \\<parallel> !Q) \\<in> Rel'\" by blast\n        qed\n      qed\n    next\n      case(Par1F \\<alpha> Q' P)\n      have QTrans: \"Q \\<longmapsto>\\<alpha> \\<prec> Q'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto><Rel> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: simE)\n\n          from PTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P' \\<parallel> R\" by(rule Weak_Early_Semantics.Par1F)\n          moreover from P'RelQ' RBangRelQ have \"(P' \\<parallel> R, Q' \\<parallel> !Q) \\<in> bangRel Rel\"\n            by(rule Rel.BRPar)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P' \\<and> (P', Q' \\<parallel> !Q) \\<in> Rel'\" using BangRelRel' by blast\n        qed\n      qed\n    next\n      case(Par2B a x Q' P)\n      hence IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim P (a<\\<nu>x> \\<prec> Q')\" by simp\n      have xFreshQ: \"x \\<sharp> Q\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        show ?case using \\<open>x \\<sharp> Q\\<close>\n        proof(auto simp add: residual.inject alpha' name_fresh_fresh)\n          from IH RBangRelQ have \"?Sim R (a<\\<nu>x> \\<prec> Q')\" by blast\n          with xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>a<\\<nu>x> \\<prec> R'\" and R'BangRelQ': \"(R', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n          from RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>x> \\<prec> (P \\<parallel> R')\"\n            by(auto intro: Weak_Early_Step_Semantics.Par2B)\n          moreover from PRelQ R'BangRelQ' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> Rel'\"\n            by(rule ParComp)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q \\<parallel> Q') \\<in> Rel'\" by blast\n        next\n          fix y\n          assume \"(y::name) \\<sharp> Q'\" and \"y \\<sharp> R\" and \"y \\<sharp> P\"\n          from IH RBangRelQ have \"?Sim R (a<\\<nu>x> \\<prec> Q')\" by blast\n          with \\<open>y \\<sharp> Q'\\<close> have  \"?Sim R (a<\\<nu>y> \\<prec> ([(x, y)] \\<bullet> Q'))\" by(simp add: alphaBoundOutput)\n          with \\<open>y \\<sharp> R\\<close>obtain R' where RTrans: \"R \\<Longrightarrow>a<\\<nu>y> \\<prec> R'\" and R'BangRelQ': \"(R', [(x, y)] \\<bullet> Q') \\<in> Rel'\"\n            by(blast dest: simE)\n          from RTrans \\<open>y \\<sharp> P\\<close> have \"P \\<parallel> R \\<Longrightarrow>a<\\<nu>y> \\<prec> (P \\<parallel> R')\"\n            by(auto intro: Weak_Early_Step_Semantics.Par2B)\n          moreover from PRelQ R'BangRelQ' have \"(P \\<parallel> R', Q \\<parallel> ([(y, x)] \\<bullet> Q')) \\<in> Rel'\"\n            by(fastforce intro: ParComp simp add: name_swap)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>a<\\<nu>y> \\<prec> P' \\<and> (P', Q \\<parallel> ([(y, x)] \\<bullet> Q')) \\<in> Rel'\" by blast\n        qed\n      qed\n    next\n      case(Par2F \\<alpha> Q' P)\n      hence IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim P (\\<alpha> \\<prec> Q')\" by simp\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from RBangRelQ have \"?Sim R (\\<alpha> \\<prec> Q')\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> R'\" and R'RelQ': \"(R', Q') \\<in> Rel'\"\n            by(blast dest: simE)\n          from RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P \\<parallel> R'\" by(rule Weak_Early_Semantics.Par2F)\n          moreover from PRelQ R'RelQ' have \"(P \\<parallel> R', Q \\<parallel> Q') \\<in> Rel'\" by(rule ParComp)\n          ultimately show \"\\<exists>P'. P \\<parallel> R \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P' \\<and> (P', Q \\<parallel> Q') \\<in> Rel'\" by blast\n        qed\n      qed\n    next\n      case(Comm1 a Q' b Q'' P)\n      hence IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim P (a[b] \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto> a<b> \\<prec> Q'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto><Rel> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<b> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(fastforce dest: simE simp add: weakFreeTransition_def)\n\n          from RBangRelQ have \"?Sim R (a[b] \\<prec> Q'')\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>a[b] \\<prec> R'\"\n                           and R'RelQ'': \"(R', Q'') \\<in> Rel'\"\n            by(fastforce dest: simE simp add: weakFreeTransition_def)\n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> (P' \\<parallel> R')\"\n            by(rule Weak_Early_Step_Semantics.Comm1)\n          hence \"P \\<parallel> R \\<Longrightarrow>\\<^sub>\\<tau> P' \\<parallel> R'\" \n            by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n          moreover from P'RelQ' R'RelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q'') \\<in> Rel'\"\n            by(rule ParComp)\n          ultimately show \"\\<exists>P'. (P \\<parallel> R, P') \\<in> {(P, P'). P \\<longmapsto> \\<tau> \\<prec> P'}\\<^sup>* \\<and> (P', Q' \\<parallel> Q'') \\<in> Rel'\"\n            by auto\n        qed\n      qed\n    next\n      case(Comm2 a b Q' Q'' P)\n      hence IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim P (a<b> \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto>a[b] \\<prec> Q'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto><Rel> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a[b] \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(fastforce dest: simE simp add: weakFreeTransition_def)\n\n          from RBangRelQ have \"?Sim R (a<b> \\<prec> Q'')\" by(rule IH)\n          then obtain R' where RTrans: \"R \\<Longrightarrow>a<b> \\<prec> R'\" and R'BangRelQ'': \"(R', Q'') \\<in> Rel'\"\n            by(fastforce dest: simE simp add: weakFreeTransition_def)\n        \n          from PTrans RTrans have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> (P' \\<parallel> R')\"\n            by(rule Weak_Early_Step_Semantics.Comm2)\n          hence \"P \\<parallel> R \\<Longrightarrow>\\<^sub>\\<tau> P' \\<parallel> R'\" \n            by(auto simp add: trancl_into_rtrancl dest: Weak_Early_Step_Semantics.tauTransitionChain)\n          moreover from P'RelQ' R'BangRelQ'' have \"(P' \\<parallel> R', Q' \\<parallel> Q'') \\<in> Rel'\"\n            by(rule ParComp)\n          ultimately show \"\\<exists>P'. (P \\<parallel> R, P') \\<in> {(P, P'). P \\<longmapsto> \\<tau> \\<prec> P'}\\<^sup>* \\<and> (P', Q' \\<parallel> Q'') \\<in> Rel'\" by auto\n        qed\n      qed\n    next\n      case(Close1 a x Q' Q'' P)\n      hence IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim P (a<\\<nu>x> \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto> a<x> \\<prec> Q'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshR: \"x \\<sharp> R\" and xFreshP: \"x \\<sharp> P\" by simp+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto><Rel> Q\" by(rule Sim)\n          with QTrans obtain P' where PTrans: \"P \\<Longrightarrow>a<x> \\<prec> P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(fastforce dest: simE simp add: weakFreeTransition_def)\n          \n          from RBangRelQ have \"?Sim R (a<\\<nu>x> \\<prec> Q'') \" by(rule IH)\n          with xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>a<\\<nu>x> \\<prec> R'\"\n                                   and R'RelQ'': \"(R', Q'') \\<in> Rel'\"\n            by(blast dest: simE)\n        \n          from PTrans RTrans xFreshP have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n            by(rule Weak_Early_Step_Semantics.Close1)\n          moreover from P'RelQ' R'RelQ'' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> Rel'\"\n            by(force intro: ParComp Res)\n          ultimately show \"\\<exists>P'. (P \\<parallel> R, P') \\<in> {(P, P'). P \\<longmapsto> \\<tau> \\<prec> P'}\\<^sup>* \\<and> (P', <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> Rel'\" by auto\n        qed\n      qed\n    next\n      case(Close2 a x Q' Q'' P)\n      hence IH: \"\\<And>P. (P, !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim P (a<x> \\<prec> Q'')\" by simp\n      have QTrans: \"Q \\<longmapsto> a<\\<nu>x> \\<prec> Q'\" by fact\n      have \"(P, Q \\<parallel> !Q) \\<in> bangRel Rel\" and \"x \\<sharp> P\" by fact+\n      thus ?case\n      proof(induct rule: BRParCases)\n        case(BRPar P R)\n        have PRelQ: \"(P, Q) \\<in> Rel\" and RBangRelQ: \"(R, !Q) \\<in> bangRel Rel\" by fact+\n        have \"x \\<sharp> P \\<parallel> R\" by fact\n        hence xFreshP: \"x \\<sharp> P\" and xFreshR: \"x \\<sharp> R\" by simp+\n        show ?case\n        proof(auto simp add: residual.inject)\n          from PRelQ have \"P \\<leadsto><Rel> Q\" by(rule Sim)\n          with QTrans xFreshP obtain P' where PTrans: \"P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n                                          and P'RelQ': \"(P', Q') \\<in> Rel\"\n            by(blast dest: simE)\n\n          from RBangRelQ have \"?Sim R (a<x> \\<prec> Q'')\" by(rule IH)\n          with xFreshR obtain R' where RTrans: \"R \\<Longrightarrow>a<x> \\<prec> R'\"\n                                       and R'RelQ'': \"(R', Q'') \\<in> Rel'\"\n            by(fastforce simp add: weakFreeTransition_def)\n          from PTrans RTrans xFreshR have \"P \\<parallel> R \\<Longrightarrow>\\<tau> \\<prec> <\\<nu>x>(P' \\<parallel> R')\"\n            by(rule Weak_Early_Step_Semantics.Close2)\n          moreover from P'RelQ' R'RelQ'' have \"(<\\<nu>x>(P' \\<parallel> R'), <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> Rel'\"\n            by(force intro: ParComp Res)\n          ultimately show \"\\<exists>P'. (P \\<parallel> R, P') \\<in> {(P, P'). P \\<longmapsto> \\<tau> \\<prec> P'}\\<^sup>* \\<and> (P', <\\<nu>x>(Q' \\<parallel> Q'')) \\<in> Rel'\" by auto\n        qed\n      qed\n    next\n      case(Bang Rs)\n      hence IH: \"\\<And>P. (P, Q \\<parallel> !Q) \\<in> bangRel Rel \\<Longrightarrow> ?Sim P Rs\" by simp\n      have \"(P, !Q) \\<in> bangRel Rel\" by fact\n      thus ?case\n      proof(induct rule: BRBangCases)\n        case(BRBang P)\n        have PRelQ: \"(P, Q) \\<in> Rel\" by fact\n        hence \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n        with PRelQ have \"(P \\<parallel> !P, Q \\<parallel> !Q) \\<in> bangRel Rel\" by(rule Rel.BRPar)\n        hence IH: \"?Sim (P \\<parallel> !P) Rs\" by(rule IH)\n        show ?case\n        proof(intro conjI allI impI)\n          fix Q' a x\n          assume \"Rs = a<\\<nu>x> \\<prec> Q'\" and \"x \\<sharp> !P\"\n          then obtain P' where PTrans: \"(P \\<parallel> !P) \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n                           and P'RelQ': \"(P', Q') \\<in> Rel'\" using IH\n            by(auto simp add: residual.inject)\n          from PTrans have \"!P \\<Longrightarrow>a<\\<nu>x> \\<prec> P'\"\n            by(force intro: Weak_Early_Step_Semantics.Bang simp add: weakFreeTransition_def)\n          with P'RelQ' show \"\\<exists>P'. !P \\<Longrightarrow>a<\\<nu>x> \\<prec> P' \\<and> (P', Q') \\<in> Rel'\" by blast\n        next\n          fix Q' \\<alpha>\n          assume \"Rs = \\<alpha> \\<prec> Q'\"\n          then obtain P' where PTrans: \"(P \\<parallel> !P) \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P'\"\n                           and P'RelQ': \"(P', Q') \\<in> Rel'\" using IH\n            by auto\n          from PTrans show \"\\<exists>P'. !P \\<Longrightarrow>\\<^sup>^\\<alpha> \\<prec> P' \\<and> (P', Q') \\<in> Rel'\" using P'RelQ'\n          proof(induct rule: transitionCases)\n            case Step\n            have \"P \\<parallel> !P \\<Longrightarrow>\\<alpha> \\<prec> P'\" by fact\n            hence \"!P \\<Longrightarrow>\\<alpha> \\<prec> P'\" by(rule Weak_Early_Step_Semantics.Bang)\n            with P'RelQ' show ?case by(force simp add: weakFreeTransition_def)\n          next\n            case Stay\n            have \"!P \\<Longrightarrow>\\<^sup>^\\<tau> \\<prec> !P\" by(simp add: weakFreeTransition_def)\n            moreover assume \"(P \\<parallel> !P, Q') \\<in> Rel'\"\n            hence \"(!P, Q') \\<in> Rel'\" by(blast intro: RelStay)\n            ultimately show ?case by blast\n          qed\n        qed\n      qed\n    qed\n  }\n  moreover from PRelQ have \"(!P, !Q) \\<in> bangRel Rel\" by(rule Rel.BRBang)\n  ultimately show ?thesis by(auto simp add: weakSimulation_def)\nqed\n\nlemma bangRelSim:\n  fixes P    :: pi\n  and   Q    :: pi\n  and   Rel  :: \"(pi \\<times> pi) set\"\n  and   Rel'l :: \"(pi \\<times> pi) set\"\n\n  assumes PBangRelQ: \"(P, Q) \\<in> bangRel Rel\"\n  and     Sim:       \"\\<And>R S. (R, S) \\<in> Rel \\<Longrightarrow> R \\<leadsto><Rel> S\"\n\n  and     ParComp:     \"\\<And>R S T U. \\<lbrakk>(R, S) \\<in> Rel; (T, U) \\<in> Rel'\\<rbrakk> \\<Longrightarrow> (R \\<parallel> T, S \\<parallel> U) \\<in> Rel'\"\n  and     Res:         \"\\<And>R S x. (R, S) \\<in> Rel' \\<Longrightarrow> (<\\<nu>x>R, <\\<nu>x>S) \\<in> Rel'\"\n\n  and     RelStay:        \"\\<And>R S. (R \\<parallel> !R, S) \\<in> Rel' \\<Longrightarrow> (!R, S) \\<in> Rel'\"\n  and     BangRelRel': \"(bangRel Rel) \\<subseteq> Rel'\"\n  and     eqvtRel':    \"eqvt Rel'\"\n  and     Eqvt: \"eqvt Rel\"\n\n  shows \"P \\<leadsto><Rel'> Q\"\nproof -\n  from PBangRelQ show ?thesis\n  proof(induct rule: bangRel.induct)\n    case(BRBang P Q)\n    have PRelQ: \"(P, Q) \\<in> Rel\" by fact\n    thus ?case using ParComp Res BangRelRel' eqvtRel' Eqvt RelStay Sim\n      by(rule_tac bangPres)\n  next\n    case(BRPar P Q R T) \n    have \"(P, Q) \\<in> Rel\" by fact\n    moreover hence \"P \\<leadsto><Rel> Q\" by(rule Sim)\n    moreover have \"R \\<leadsto><Rel'> T\" by fact\n    moreover have \"(R, T) \\<in> bangRel Rel\" by fact\n    ultimately show ?case using ParComp eqvtRel' Res Eqvt BangRelRel'\n      by(blast intro: parCompose)\n  next\n    case(BRRes P Q x)\n    have \"P \\<leadsto><Rel'> Q\" by fact\n    thus ?case using BangRelRel' eqvtRel' Res by(blast intro: resPres)\n  qed\nqed\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Weak_Early_Sim_Pres.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.30227283316687614}}
{"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\n(*\n * Program specifications generated from:\n *   cogent --type-proof=FunFun --fml-typing-tree fun.cogent\n *   cogent -gfun_dsl --infer-c-func=fun.ac fun.cogent && cat fun_dsl.c fun_pp_inferred.c > fun.c\n *)\ntheory FunFun\nimports\n  \"../Cogent_Corres\"\n  \"../TypeProofGen\"\n  \"../Corres_Tac\"\n  \"../Tidy\"\nbegin\n\nlemmas abbreviated_type_defs =\n  TrueI\n\ndefinition\n  \"abs_type \\<equiv> ([], (TUnit, TFun TUnit TUnit))\"\n\ndefinition\n  \"i_type \\<equiv> ([], (TUnit, TUnit))\"\n\ndefinition\n  \"i \\<equiv> Let (Var 0) (Var 0)\"\n\ndefinition\n  \"i2_type \\<equiv> ([], (TUnit, TUnit))\"\n\ndefinition\n  \"i2 \\<equiv> Let (Var 0) (App (Fun i []) (Var 0))\"\n\ndefinition\n  \"f_type \\<equiv> ([], (TUnit, TUnit))\"\n\ndefinition\n  \"f \\<equiv> Let (Var 0) (Let (App (AFun ''abs'' []) (Var 0)) (App (Var 0) (Var 1)))\"\n\ndefinition\n  \"\\<Xi> func_name' \\<equiv> case func_name' of ''abs'' \\<Rightarrow> abs_type | ''i'' \\<Rightarrow> i_type | ''i2'' \\<Rightarrow> i2_type | ''f'' \\<Rightarrow> f_type\"\n\ndefinition\n  \"\\<xi> func_name' \\<equiv> case func_name' of ''abs'' \\<Rightarrow> undefined\"\n\ndefinition\n  \"i_typetree \\<equiv> TyTrSplit (Cons (Some TSK_L) []) [] TyTrLeaf [Some TUnit] TyTrLeaf\"\n\ndefinition\n  \"i2_typetree \\<equiv> TyTrSplit (Cons (Some TSK_L) []) [] TyTrLeaf [Some TUnit] TyTrLeaf\"\n\ndefinition\n  \"f_typetree \\<equiv> TyTrSplit (Cons (Some TSK_L) []) [] TyTrLeaf [Some TUnit] (TyTrSplit (Cons (Some TSK_S) (Cons None [])) [] TyTrLeaf [Some (TFun TUnit TUnit)] TyTrLeaf)\"\n\nML {* open TTyping_Tactics *}\n\nML_quiet {*\nval typing_helper_1_script : tac list = [\n(RTac @{thm kind_tunit[where k = \"{E,S,D}\"]})\n] *}\n\n\nlemma typing_helper_1[unfolded abbreviated_type_defs] :\n  \"kinding [] TUnit {E, S, D}\"\n  apply (unfold abbreviated_type_defs)?\n  apply (tactic {* map (fn t => DETERM (interpret_tac t @{context} 1)) typing_helper_1_script |> EVERY *})\n  done\n\nML_quiet {*\nval typing_helper_2_script : tac list = [\n(SimpTac ([],[(nth @{thms HOL.simp_thms} (25-1)),(nth @{thms HOL.simp_thms} (26-1))]))\n] *}\n\n\nlemma typing_helper_2[unfolded abbreviated_type_defs] :\n  \"list_all2 (kinding []) [] []\"\n  apply (unfold abbreviated_type_defs)?\n  apply (tactic {* map (fn t => DETERM (interpret_tac t @{context} 1)) typing_helper_2_script |> EVERY *})\n  done\n\nML_quiet {*\nval typing_helper_3_script : tac list = [\n(RTac @{thm kind_tfun[where k = \"{E,S,D}\"]}),\n(RTac @{thm typing_helper_1}),\n(RTac @{thm typing_helper_1})\n] *}\n\n\nlemma typing_helper_3[unfolded abbreviated_type_defs] :\n  \"kinding [] (TFun TUnit TUnit) {E, S, D}\"\n  apply (unfold abbreviated_type_defs)?\n  apply (tactic {* map (fn t => DETERM (interpret_tac t @{context} 1)) typing_helper_3_script |> EVERY *})\n  done\n\nML_quiet {*\nval typing_helper_4_script : tac list = [\n(RTac @{thm kind_tfun[where k = \"{E,S,D}\"]}),\n(RTac @{thm typing_helper_1}),\n(RTac @{thm typing_helper_3})\n] *}\n\n\nlemma typing_helper_4[unfolded abbreviated_type_defs] :\n  \"kinding [] (TFun TUnit (TFun TUnit TUnit)) {E, S, D}\"\n  apply (unfold abbreviated_type_defs)?\n  apply (tactic {* map (fn t => DETERM (interpret_tac t @{context} 1)) typing_helper_4_script |> EVERY *})\n  done\n\nML_quiet {*\nval i_typecorrect_script : hints list = [\nKindingTacs [(RTac @{thm typing_helper_1})],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nTypingTacs []\n] *}\n\n\nML_quiet {*\nval i_ttyping_details_future = get_all_typing_details_future @{context} \"i\"\n   i_typecorrect_script*}\n\n\nlemma i_typecorrect :\n  \"\\<Xi>, fst i_type, (i_typetree, [Some (fst (snd i_type))]) T\\<turnstile> i : snd (snd i_type)\"\n  apply (tactic {* resolve_future_typecorrect @{context} i_ttyping_details_future *})\n  done\n\nML_quiet {*\nval i2_typecorrect_script : hints list = [\nKindingTacs [(RTac @{thm typing_helper_1})],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nTypingTacs [(RTac @{thm typing_app}),(SplitsTac (2,[(0,[(RTac @{thm split_comp.right}),(RTac @{thm typing_helper_1})])])),(RTac @{thm typing_fun'}),(RTac @{thm i_typecorrect[simplified i_type_def i_typetree_def, simplified]}),(RTac @{thm typing_helper_2}),(SimpTac ([],[])),(SimpTac ([],[])),(RTac @{thm exI[where x = \"{E,S,D}\"]}),(RTac @{thm typing_helper_1}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[]))]\n] *}\n\n\nML_quiet {*\nval i2_ttyping_details_future = get_all_typing_details_future @{context} \"i2\"\n   i2_typecorrect_script*}\n\n\nlemma i2_typecorrect :\n  \"\\<Xi>, fst i2_type, (i2_typetree, [Some (fst (snd i2_type))]) T\\<turnstile> i2 : snd (snd i2_type)\"\n  apply (tactic {* resolve_future_typecorrect @{context} i2_ttyping_details_future *})\n  done\n\nML_quiet {*\nval f_typecorrect_script : hints list = [\nKindingTacs [(RTac @{thm typing_helper_1})],\nKindingTacs [(RTac @{thm typing_helper_1})],\nTypingTacs [],\nKindingTacs [(RTac @{thm typing_helper_3})],\nTypingTacs [(RTac @{thm typing_app}),(SplitsTac (2,[(0,[(RTac @{thm split_comp.right}),(RTac @{thm typing_helper_1})])])),(RTac @{thm typing_afun'}),(SimpTac ([@{thm \\<Xi>_def},@{thm abs_type_def}],[])),(RTac @{thm typing_helper_2}),(SimpTac ([],[])),(SimpTac ([],[])),(RTac @{thm exI[where x = \"{E,S,D}\"]}),(RTac @{thm typing_helper_4}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac []),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[]))],\nTypingTacs [(RTac @{thm typing_app}),(SplitsTac (3,[(0,[(RTac @{thm split_comp.left}),(RTac @{thm typing_helper_3})]),(1,[(RTac @{thm split_comp.right}),(RTac @{thm typing_helper_1})])])),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_3}]),(SimpTac ([],[])),(RTac @{thm typing_var}),(SimpTac ([@{thm empty_def}],[])),(WeakeningTac [@{thm typing_helper_1}]),(SimpTac ([],[]))]\n] *}\n\n\nML_quiet {*\nval f_ttyping_details_future = get_all_typing_details_future @{context} \"f\"\n   f_typecorrect_script*}\n\n\nlemma f_typecorrect :\n  \"\\<Xi>, fst f_type, (f_typetree, [Some (fst (snd f_type))]) T\\<turnstile> f : snd (snd f_type)\"\n  apply (tactic {* resolve_future_typecorrect @{context} f_ttyping_details_future *})\n  done\n\nML_quiet {*\nval (_, i_typing_tree, i_typing_bucket)\n= Future.join i_ttyping_details_future\n*}\n\n\nML_quiet {*\nval (_, i2_typing_tree, i2_typing_bucket)\n= Future.join i2_ttyping_details_future\n*}\n\n\nML_quiet {*\nval (_, f_typing_tree, f_typing_bucket)\n= Future.join f_ttyping_details_future\n*}\n\n\nnew_C_include_dir \"../../cogent/tests\"\ninstall_C_file \"fun.c\"\nautocorres [ts_rules = nondet, no_opt, skip_word_abs] \"fun.c\"\n\ninstantiation bool_t_C :: cogent_C_val\nbegin\ndefinition type_rel_bool_t_C_def:\n  \"type_rel typ (_ :: bool_t_C itself) \\<equiv> (typ = RPrim Bool)\"\n\ndefinition val_rel_bool_t_C_def:\n  \"val_rel uv (x :: bool_t_C) \\<equiv> uv = UPrim (LBool (bool_t_C.boolean_C x \\<noteq> 0))\"\ninstance ..\nend\n\ninstantiation unit_t_C :: cogent_C_val begin\n  definition type_rel_unit_t_C: \"type_rel r (_ :: unit_t_C itself) \\<equiv> r = RUnit\"\n  definition val_rel_unit_t_C: \"val_rel uv (_ :: unit_t_C) \\<equiv> uv = UUnit\"\n  instance ..\nend\n\n\n(* [abs, f] is a non-terminating program, so we cannot prove correspondence. *)\ncontext \"fun\" begin\n  thm abs'_def\n  thm f'.simps dispatch_t1'.simps\nend\n\n\n(* [i, i2] is a terminating program. *)\nlocale fun_u_sem = \"fun\" + update_sem_init\nbegin\n\nlocal_setup {* fold tidy_C_fun_def' [\"i\", \"i2\"] *}\nthm i_def i'_def' i2_def i2'_def'\n\nlemmas corres_nested_let = TrueI (* unused *)\n\nlemma i_corres: \"val_rel a a' \\<Longrightarrow> corres srel i (i' a') \\<xi> [a] \\<Xi> [Some TUnit] \\<sigma> s\"\n  apply (tactic {* corres_tac @{context}\n    (peel_two i_typing_tree)\n    @{thms i_def i'_def' i_type_def abbreviated_type_defs} [] []\n    @{thm TrueI} [] [] [] [] @{thm LETBANG_TRUE_def} [] true *})\n  done\n\nlemma i2_corres: \"val_rel a a' \\<Longrightarrow> corres srel i2 (i2' a') \\<xi> [a] \\<Xi> [Some TUnit] \\<sigma> s\"\n  apply (tactic {* corres_tac @{context}\n    (peel_two i2_typing_tree)\n    @{thms i2_def i2'_def' i2_type_def abbreviated_type_defs} [] @{thms i_corres}\n    @{thm TrueI} [] [] [] [] @{thm LETBANG_TRUE_def} [] true *})\n  done\n\nend\n\nend\n", "meta": {"author": "au-ts", "repo": "cogent", "sha": "a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2", "save_path": "github-repos/isabelle/au-ts-cogent", "path": "github-repos/isabelle/au-ts-cogent/cogent-a1464313bbd1bbfaa5c4e58ab14f669c6d2436a2/c-refinement/tests/FunFun.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5774953797290153, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.30227283316687614}}
{"text": "(*<*)\n(*\n   Title:  Theory  DataDependenciesCaseStudy.thy\n   Author: Maria Spichkova <maria.spichkova at rmit.edu.au>, 2014\n*)\n(*>*)\n\nheader \"Case Study: Verification of Properties\"\n \ntheory DataDependenciesCaseStudy\n  imports DataDependencies\nbegin\n\n\nsubsection {* Correct composition of components *}\n\n--\"the lemmas  AbstrLevels X Y with corresponding proofs can be composend\"\n--\"and proven automatically, their proofs are identical\"\nlemma AbstrLevels_A1_A11:\n  assumes \"sA1 \\<in> AbstrLevel i\"\n  shows \"sA11 \\<notin> AbstrLevel i\"\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n\nlemma AbstrLevels_A1_A12:\n  assumes \"sA1 \\<in> AbstrLevel i\"\n  shows \"sA12 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A2_A21:\n  assumes \"sA2 \\<in> AbstrLevel i\"\n  shows \"sA21 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A2_A22:\n  assumes \"sA2 \\<in> AbstrLevel i\"\n  shows \"sA22 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A2_A23:\n  assumes \"sA2 \\<in> AbstrLevel i\"\n  shows \"sA23 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A3_A31:\n  assumes \"sA3 \\<in> AbstrLevel i\"\n  shows \"sA31 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A3_A32:\n  assumes \"sA3 \\<in> AbstrLevel i\"\n  shows \"sA32 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A4_A41:\n  assumes \"sA4 \\<in> AbstrLevel i\"\n  shows \"sA41 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A4_A42:\n  assumes \"sA4 \\<in> AbstrLevel i\"\n  shows \"sA42 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A7_A71:\n  assumes \"sA7 \\<in> AbstrLevel i\"\n  shows \"sA71 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A7_A72:\n  assumes \"sA7 \\<in> AbstrLevel i\"\n  shows \"sA72 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\nlemma AbstrLevels_A8_A81:\n  assumes \"sA8 \\<in> AbstrLevel i\"\n  shows \"sA81 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\nlemma AbstrLevels_A8_A82:\n  assumes \"sA8 \\<in> AbstrLevel i\"\n  shows \"sA82 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A9_A91:\n  assumes \"sA9 \\<in> AbstrLevel i\"\n  shows \"sA91 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A9_A92:\n  assumes \"sA9 \\<in> AbstrLevel i\"\n  shows \"sA92 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_A9_A93:\n  assumes \"sA9 \\<in> AbstrLevel i\"\n  shows \"sA93 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S1_A12:\n  assumes \"sS1 \\<in> AbstrLevel i\"\n  shows \"sA12 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S2_A11:\n  assumes \"sS2 \\<in> AbstrLevel i\"\n  shows \"sA11 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S3_A21:\n  assumes \"sS3 \\<in> AbstrLevel i\"\n  shows \"sA21 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4_A23:\n  assumes \"sS4 \\<in> AbstrLevel i\"\n  shows \"sA23 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S5_A32:\n  assumes \"sS5 \\<in> AbstrLevel i\"\n  shows \"sA32 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S6_A22:\n  assumes \"sS6 \\<in> AbstrLevel i\"\n  shows \"sA22 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S6_A31:\n  assumes \"sS6 \\<in> AbstrLevel i\"\n  shows \"sA31 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S6_A41:\n  assumes \"sS6 \\<in> AbstrLevel i\"\n  shows \"sA41 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S7_A42:\n  assumes \"sS7 \\<in> AbstrLevel i\"\n  shows \"sA42 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S8_A5:\n  assumes \"sS8 \\<in> AbstrLevel i\"\n  shows \"sA5 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S9_A6:\n  assumes \"sS9 \\<in> AbstrLevel i\"\n  shows \"sA6 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S10_A71:\n  assumes \"sS10 \\<in> AbstrLevel i\"\n  shows \"sA71 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S11_A72:\n  assumes \"sS11 \\<in> AbstrLevel i\"\n  shows \"sA72 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S12_A81:\n  assumes \"sS12 \\<in> AbstrLevel i\"\n  shows \"sA81 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S12_A91:\n  assumes \"sS12 \\<in> AbstrLevel i\"\n  shows \"sA91 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S13_A92:\n  assumes \"sS13 \\<in> AbstrLevel i\"\n  shows \"sA92 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S14_A82:\n  assumes \"sS14 \\<in> AbstrLevel i\"\n  shows \"sA82 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S15_A93:\n  assumes \"sS15 \\<in> AbstrLevel i\"\n  shows \"sA93 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S1opt_A11:\n  assumes \"sS1opt \\<in> AbstrLevel i\"\n  shows \"sA11 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S1opt_A12:\n  assumes \"sS1opt \\<in> AbstrLevel i\"\n  shows \"sA12 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4opt_A23:\n  assumes \"sS4opt \\<in> AbstrLevel i\"\n  shows \"sA23 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4opt_A32:\n  assumes \"sS4opt \\<in> AbstrLevel i\"\n  shows \"sA32 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4opt_A22:\n  assumes \"sS4opt \\<in> AbstrLevel i\"\n  shows \"sA22 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4opt_A31:\n  assumes \"sS4opt \\<in> AbstrLevel i\"\n  shows \"sA31 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S4opt_A41:\n  assumes \"sS4opt \\<in> AbstrLevel i\"\n  shows \"sA41 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S7opt_A42:\n  assumes \"sS7opt \\<in> AbstrLevel i\"\n  shows \"sA42 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S7opt_A5:\n  assumes \"sS7opt \\<in> AbstrLevel i\"\n  shows \"sA5 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S11opt_A72:\n  assumes \"sS11opt \\<in> AbstrLevel i\"\n  shows \"sA72 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S11opt_A82:\n  assumes \"sS11opt \\<in> AbstrLevel i\"\n  shows \"sA82 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma AbstrLevels_S11opt_A93:\n  assumes \"sS11opt \\<in> AbstrLevel i\"\n  shows \"sA93 \\<notin> AbstrLevel i\"\n(*<*)\nusing assms \nby (induct i, simp add: AbstrLevel0, simp add:  AbstrLevel1, simp add:  AbstrLevel2,  simp add:  AbstrLevel3)\n(*>*)\n\n\nlemma correctCompositionDiffLevelsA1: \"correctCompositionDiffLevels sA1\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A1_A11 AbstrLevels_A1_A12)(*>*)\n\n\nlemma correctCompositionDiffLevelsA2: \"correctCompositionDiffLevels sA2\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A2_A21 AbstrLevels_A2_A22 AbstrLevels_A2_A23)(*>*)\n\n\nlemma correctCompositionDiffLevelsA3: \"correctCompositionDiffLevels sA3\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A3_A31 AbstrLevels_A3_A32)(*>*)\n\n\nlemma correctCompositionDiffLevelsA4: \"correctCompositionDiffLevels sA4\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A4_A41 AbstrLevels_A4_A42)(*>*)\n\n\n--\"lemmas  correctCompositionDiffLevelsX and corresponding proofs\"\n--\"are identical for all elementary components, they can be constructed automatically\" \nlemma correctCompositionDiffLevelsA5: \"correctCompositionDiffLevels sA5\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA6: \"correctCompositionDiffLevels sA6\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA7: \"correctCompositionDiffLevels sA7\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A7_A71 AbstrLevels_A7_A72)(*>*)\n\nlemma correctCompositionDiffLevelsA8: \"correctCompositionDiffLevels sA8\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A8_A81 AbstrLevels_A8_A82)(*>*)\n\nlemma correctCompositionDiffLevelsA9: \"correctCompositionDiffLevels sA9\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_A9_A91 AbstrLevels_A9_A92 AbstrLevels_A9_A93)(*>*)\n\n\n\nlemma correctCompositionDiffLevelsA12: \"correctCompositionDiffLevels sA12\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA21: \"correctCompositionDiffLevels sA21\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA22: \"correctCompositionDiffLevels sA22\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA23: \"correctCompositionDiffLevels sA23\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA31: \"correctCompositionDiffLevels sA31\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA32: \"correctCompositionDiffLevels sA32\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA41: \"correctCompositionDiffLevels sA41\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA42: \"correctCompositionDiffLevels sA42\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA71: \"correctCompositionDiffLevels sA71\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA72: \"correctCompositionDiffLevels sA72\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA81: \"correctCompositionDiffLevels sA81\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA82: \"correctCompositionDiffLevels sA82\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA91: \"correctCompositionDiffLevels sA91\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\nlemma correctCompositionDiffLevelsA92: \"correctCompositionDiffLevels sA92\"\n(*<*)by (simp add: correctCompositionDiffLevels_def) (*>*)\n\n\n\nlemma correctCompositionDiffLevelsS1: \"correctCompositionDiffLevels sS1\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S1_A12) (*>*)\n\nlemma correctCompositionDiffLevelsS2: \"correctCompositionDiffLevels sS2\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S2_A11) (*>*)\n\nlemma correctCompositionDiffLevelsS3: \"correctCompositionDiffLevels sS3\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S3_A21) (*>*)\n\nlemma correctCompositionDiffLevelsS4: \"correctCompositionDiffLevels sS4\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S4_A23) (*>*)\n\nlemma correctCompositionDiffLevelsS5: \"correctCompositionDiffLevels sS5\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S5_A32) (*>*)\n\nlemma correctCompositionDiffLevelsS6: \"correctCompositionDiffLevels sS6\"\n(*<*)by (simp add: correctCompositionDiffLevels_def  AbstrLevels_S6_A22 AbstrLevels_S6_A31 AbstrLevels_S6_A41) (*>*)\n\nlemma correctCompositionDiffLevelsS7: \"correctCompositionDiffLevels sS7\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S7_A42) (*>*)\n\nlemma correctCompositionDiffLevelsS8: \"correctCompositionDiffLevels sS8\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S8_A5) (*>*)\n\nlemma correctCompositionDiffLevelsS9: \"correctCompositionDiffLevels sS9\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S9_A6) (*>*)\n\nlemma correctCompositionDiffLevelsS10: \"correctCompositionDiffLevels sS10\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S10_A71) (*>*)\n\nlemma correctCompositionDiffLevelsS11: \"correctCompositionDiffLevels sS11\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S11_A72) (*>*)\n\nlemma correctCompositionDiffLevelsS12: \"correctCompositionDiffLevels sS12\"\n(*<*)by (simp add: correctCompositionDiffLevels_def  AbstrLevels_S12_A81 AbstrLevels_S12_A91) (*>*)\n\nlemma correctCompositionDiffLevelsS13: \"correctCompositionDiffLevels sS13\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S13_A92) (*>*)\n\nlemma correctCompositionDiffLevelsS14: \"correctCompositionDiffLevels sS14\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S14_A82) (*>*)\n\nlemma correctCompositionDiffLevelsS15: \"correctCompositionDiffLevels sS15\"\n(*<*)by (simp add: correctCompositionDiffLevels_def AbstrLevels_S15_A93) (*>*)\n\nlemma correctCompositionDiffLevelsS1opt: \"correctCompositionDiffLevels sS1opt\"\n(*<*)by (simp add: correctCompositionDiffLevels_def  AbstrLevels_S1opt_A11 AbstrLevels_S1opt_A12) (*>*)\n\nlemma correctCompositionDiffLevelsS4opt: \"correctCompositionDiffLevels sS4opt\"\n(*<*)by (simp add: correctCompositionDiffLevels_def  AbstrLevels_S4opt_A22 \n      AbstrLevels_S4opt_A23  AbstrLevels_S4opt_A31  \n      AbstrLevels_S4opt_A32  AbstrLevels_S4opt_A41) (*>*)\n\n\n\nlemma correctCompositionDiffLevelsS11opt: \"correctCompositionDiffLevels sS11opt\"\n(*<*)by (simp add: correctCompositionDiffLevels_def  AbstrLevels_S11opt_A72 \n        AbstrLevels_S11opt_A82 AbstrLevels_S11opt_A93) (*>*)\n\nlemma correctCompositionDiffLevelsSYSTEM_holds:\n\"correctCompositionDiffLevelsSYSTEM\"\n(*<*)by (simp add: correctCompositionDiffLevelsSYSTEM_def, clarify, case_tac S, \nsimp add: correctCompositionDiffLevelsA1, \nsimp add: correctCompositionDiffLevelsA2,\nsimp add: correctCompositionDiffLevelsA3,\nsimp add: correctCompositionDiffLevelsA4,\nsimp add: correctCompositionDiffLevelsA5,\nsimp add: correctCompositionDiffLevelsA6,\nsimp add: correctCompositionDiffLevelsA7,\nsimp add: correctCompositionDiffLevelsA8,\nsimp add: correctCompositionDiffLevelsA9,\nsimp add: correctCompositionDiffLevelsA11,\nsimp add: correctCompositionDiffLevelsA12,\nsimp add: correctCompositionDiffLevelsA21,\nsimp add: correctCompositionDiffLevelsA22,\nsimp add: correctCompositionDiffLevelsA23,\nsimp add: correctCompositionDiffLevelsA31,\nsimp add: correctCompositionDiffLevelsA32,\nsimp add: correctCompositionDiffLevelsA41,\nsimp add: correctCompositionDiffLevelsA42,\nsimp add: correctCompositionDiffLevelsA71,\nsimp add: correctCompositionDiffLevelsA72,\nsimp add: correctCompositionDiffLevelsA81,\nsimp add: correctCompositionDiffLevelsA82,\nsimp add: correctCompositionDiffLevelsA91,\nsimp add: correctCompositionDiffLevelsA92,\nsimp add: correctCompositionDiffLevelsA93,\nsimp add: correctCompositionDiffLevelsS1,\nsimp add: correctCompositionDiffLevelsS2,\nsimp add: correctCompositionDiffLevelsS3,\nsimp add: correctCompositionDiffLevelsS4,\nsimp add: correctCompositionDiffLevelsS5,\nsimp add: correctCompositionDiffLevelsS6,\nsimp add: correctCompositionDiffLevelsS7,\nsimp add: correctCompositionDiffLevelsS8,\nsimp add: correctCompositionDiffLevelsS9,\nsimp add: correctCompositionDiffLevelsS10,\nsimp add: correctCompositionDiffLevelsS11,\nsimp add: correctCompositionDiffLevelsS12,\nsimp add: correctCompositionDiffLevelsS13,\nsimp add: correctCompositionDiffLevelsS14,\nsimp add: correctCompositionDiffLevelsS15,\nsimp add: correctCompositionDiffLevelsS1opt,\nsimp add: correctCompositionDiffLevelsS4opt,\nsimp add: correctCompositionDiffLevelsS7opt, \nsimp add: correctCompositionDiffLevelsS11opt)(*>*)\n\nlemma correctCompositionVARSYSTEM_holds:\n\"correctCompositionVARSYSTEM\"\nby (simp add: correctCompositionVARSYSTEM_def, clarify, case_tac S, (simp add: correctCompositionVAR_def)+)\n\nlemma correctDeCompositionVARSYSTEM_holds:\n\"correctDeCompositionVARSYSTEM\"\nby (simp add: correctDeCompositionVARSYSTEM_def, clarify, case_tac S, (simp add: correctDeCompositionVAR_def)+)\n\n\nsubsection {* Correct specification of the relations between channels *}\n\nlemma OUTfromChCorrect_data1: \"OUTfromChCorrect data1\"\nby (simp add: OUTfromChCorrect_def)\n\n\n\nlemma OUTfromChCorrect_data3: \"OUTfromChCorrect data3\"\nby (metis OUTfromCh.simps(3) OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data4: \"OUTfromChCorrect data4\"\nby (metis IN.simps(2) OUT.simps(2) OUTfromCh.simps(4) OUTfromChCorrect_def insertI1 singleton_iff)\n\nlemma OUTfromChCorrect_data5: \"OUTfromChCorrect data5\"\nby  (simp add: OUTfromChCorrect_def, metis IN.simps(14) OUT.simps(14) insertI1)\n\nlemma OUTfromChCorrect_data6: \"OUTfromChCorrect data6\"\nby  (simp add: OUTfromChCorrect_def, metis IN.simps(15) OUT.simps(15) insertI1)\n\nlemma OUTfromChCorrect_data7: \"OUTfromChCorrect data7\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(16) OUT.simps(16) insertI1)\n\nlemma OUTfromChCorrect_data8: \"OUTfromChCorrect data8\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(18) OUT.simps(18) insertI1) \n\n \nlemma OUTfromChCorrect_data9: \"OUTfromChCorrect data9\"\nby (simp add: OUTfromChCorrect_def , metis IN.simps(33) OUT.simps(33) singleton_iff)\n\nlemma OUTfromChCorrect_data10: \"OUTfromChCorrect data10\"\nby (simp add: OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data11: \"OUTfromChCorrect data11\"\nby (simp add: OUTfromChCorrect_def, metis (full_types) IN.simps(2) \nOUT.simps(2) OUT.simps(31) Un_empty_right Un_insert_left Un_insert_right insertI1)\n\nlemma OUTfromChCorrect_data12: \"OUTfromChCorrect data12\"\nby (simp add: OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data13: \"OUTfromChCorrect data13\"\nby (simp add: OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data14: \"OUTfromChCorrect data14\"\nby (metis OUTfromCh.simps(14) OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data15: \"OUTfromChCorrect data15\"\nby (metis OUTfromCh.simps(15) OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data16: \"OUTfromChCorrect data16\"\nby (metis OUTfromCh.simps(16) OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data17: \"OUTfromChCorrect data17\"\nproof - \n  have \"data17 \\<in> OUT sA71 \\<and> data15 \\<in> IN sA71\"\n    by (metis IN.simps(19) OUT.simps(19) insertI1)  \n  thus ?thesis by (metis IN.simps(19) OUTfromCh.simps(17) OUTfromChCorrect_def) \nqed\n\nlemma OUTfromChCorrect_data18: \"OUTfromChCorrect data18\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(20) OUT.simps(20) insertI1)\n\nlemma OUTfromChCorrect_data19: \"OUTfromChCorrect data19\"\nby (metis OUTfromCh.simps(19) OUTfromChCorrect_def)\n\nlemma OUTfromChCorrect_data20: \"OUTfromChCorrect data20\"\nby  (simp add: OUTfromChCorrect_def, metis IN.simps(21) OUT.simps(21) insertI1 insert_subset subset_insertI)\n\nlemma OUTfromChCorrect_data21: \"OUTfromChCorrect data21\"\nby (simp add: OUTfromChCorrect_def, metis (full_types) \nIN.simps(22) OUT.simps(22) insertI1 insert_subset subset_insertI)\n\nlemma OUTfromChCorrect_data22: \"OUTfromChCorrect data22\"\nby (simp add: OUTfromChCorrect_def, metis (full_types) IN.simps(23) OUT.simps(23) insertI1)\n\nlemma OUTfromChCorrect_data23: \"OUTfromChCorrect data23\"\nby (simp add: OUTfromChCorrect_def, metis (full_types) IN.simps(9) OUT.simps(9) insert_subset subset_insertI)\n\nlemma OUTfromChCorrect_data24: \"OUTfromChCorrect data24\"\nby (simp add: OUTfromChCorrect_def, metis IN.simps(9) OUT.simps(9) insertI1 insert_subset subset_insertI)\n\nlemma OUTfromChCorrectSYSTEM_holds: \"OUTfromChCorrectSYSTEM\"\nby (simp add: OUTfromChCorrectSYSTEM_def,  clarify, case_tac x,\nsimp add: OUTfromChCorrect_data1, simp add: OUTfromChCorrect_data2, \nsimp add: OUTfromChCorrect_data3, simp add: OUTfromChCorrect_data4,  \nsimp add: OUTfromChCorrect_data5, simp add: OUTfromChCorrect_data6, \nsimp add: OUTfromChCorrect_data7, simp add: OUTfromChCorrect_data8,\nsimp add: OUTfromChCorrect_data9, simp add: OUTfromChCorrect_data10,\nsimp add: OUTfromChCorrect_data11, simp add: OUTfromChCorrect_data12,\nsimp add: OUTfromChCorrect_data13, simp add: OUTfromChCorrect_data14, \nsimp add: OUTfromChCorrect_data15, simp add: OUTfromChCorrect_data16,\nsimp add: OUTfromChCorrect_data17, simp add: OUTfromChCorrect_data18,\nsimp add: OUTfromChCorrect_data19, simp add: OUTfromChCorrect_data20,\nsimp add: OUTfromChCorrect_data21, simp add: OUTfromChCorrect_data22, \nsimp add: OUTfromChCorrect_data23, simp add: OUTfromChCorrect_data24)\n\nlemma OUTfromVCorrect1_data1: \"OUTfromVCorrect1 data1\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data2: \"OUTfromVCorrect1 data2\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data3: \"OUTfromVCorrect1 data3\"\nproof - \n  have \"data3 \\<in> OUT sA41 \\<and> stA4 \\<in> VAR sA41\"\n    by (metis OUT.simps(17) VAR.simps(17) insertI1) \n  thus ?thesis by (metis OUTfromV.simps(3) OUTfromVCorrect1_def VAR.simps(17)) \nqed\n\nlemma OUTfromVCorrect1_data4: \"OUTfromVCorrect1 data4\"\nby (simp add: OUTfromVCorrect1_def, metis (full_types) OUT.simps(2) VAR.simps(2) insertI1) \n\nlemma OUTfromVCorrect1_data5: \"OUTfromVCorrect1 data5\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data6: \"OUTfromVCorrect1 data6\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data7: \"OUTfromVCorrect1 data7\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data8: \"OUTfromVCorrect1 data8\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data9: \"OUTfromVCorrect1 data9\"\nby (simp add: OUTfromVCorrect1_def)\n\n\n\nlemma OUTfromVCorrect1_data11: \"OUTfromVCorrect1 data11\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data12: \"OUTfromVCorrect1 data12\"\nproof - \n  have \"data12 \\<in> OUT sA22 \\<and> stA2 \\<in> VAR sA22\"\n    by (metis (full_types) OUT.simps(13) VAR.simps(13) insertCI) \n  thus ?thesis by (metis OUTfromV.simps(12) OUTfromVCorrect1_def VAR.simps(13)) \nqed\n\nlemma OUTfromVCorrect1_data13: \"OUTfromVCorrect1 data13\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data14: \"OUTfromVCorrect1 data14\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data15: \"OUTfromVCorrect1 data15\"\nproof -\n  have A6ch:\"data15 \\<in> OUT sA6 \\<and> stA6 \\<in> VAR sA6\"\n    by (metis OUT.simps(6) VAR.simps(6) insertI1) \n  thus ?thesis by (simp add: OUTfromVCorrect1_def, metis A6ch) \nqed\n\n\n\nlemma OUTfromVCorrect1_data17: \"OUTfromVCorrect1 data17\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data18: \"OUTfromVCorrect1 data18\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data19: \"OUTfromVCorrect1 data19\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data20: \"OUTfromVCorrect1 data20\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data21: \"OUTfromVCorrect1 data21\"\nby (simp add: OUTfromVCorrect1_def)\n\n\n\nlemma OUTfromVCorrect1_data23: \"OUTfromVCorrect1 data23\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1_data24: \"OUTfromVCorrect1 data24\"\nby (simp add: OUTfromVCorrect1_def)\n\nlemma OUTfromVCorrect1SYSTEM_holds: \"OUTfromVCorrect1SYSTEM\"\nby (simp add: OUTfromVCorrect1SYSTEM_def, clarify, case_tac x, \nsimp add: OUTfromVCorrect1_data1, simp add: OUTfromVCorrect1_data2,\nsimp add: OUTfromVCorrect1_data3, simp add: OUTfromVCorrect1_data4, \nsimp add: OUTfromVCorrect1_data5, simp add: OUTfromVCorrect1_data6, \nsimp add: OUTfromVCorrect1_data7, simp add: OUTfromVCorrect1_data8, \nsimp add: OUTfromVCorrect1_data9, simp add: OUTfromVCorrect1_data10, \nsimp add: OUTfromVCorrect1_data11, simp add: OUTfromVCorrect1_data12, \nsimp add: OUTfromVCorrect1_data13, simp add: OUTfromVCorrect1_data14, \nsimp add: OUTfromVCorrect1_data15, simp add: OUTfromVCorrect1_data16, \nsimp add: OUTfromVCorrect1_data17, simp add: OUTfromVCorrect1_data18,\nsimp add: OUTfromVCorrect1_data19, simp add: OUTfromVCorrect1_data20,\nsimp add: OUTfromVCorrect1_data21, simp add: OUTfromVCorrect1_data22,\nsimp add: OUTfromVCorrect1_data23, simp add: OUTfromVCorrect1_data24)\n\nlemma OUTfromVCorrect2SYSTEM: \"OUTfromVCorrect2SYSTEM\"\nby (simp add: OUTfromVCorrect2SYSTEM_def, auto, case_tac x,\n      ((simp add: OUTfromVCorrect2_def, auto, case_tac v, auto) | \n       (simp add: OUTfromVCorrect2_def) )+)\n\nlemma OUTfromV_VARto_holds:\n\"OUTfromV_VARto\"\nby (simp add: OUTfromV_VARto_def, auto, (case_tac x, auto), (case_tac v, auto))\n\nlemma VARfromCorrectSYSTEM_holds:\n\"VARfromCorrectSYSTEM\"\nby (simp add: VARfromCorrectSYSTEM_def AbstrLevel0 AbstrLevel1)\n\nlemma VARtoCorrectSYSTEM_holds:\n\"VARtoCorrectSYSTEM\"\nby (simp add: VARtoCorrectSYSTEM_def AbstrLevel0 AbstrLevel1)\n\nlemma VARusefulSYSTEM_holds:\n\"VARusefulSYSTEM\"\nby (simp add: VARusefulSYSTEM_def, auto, case_tac v, auto)\n\n\nsubsection {* Elementary components *}\n\n--\"On the abstraction level 0 only the components sA5 and sA6 are elementary\"\n\nlemma NOT_elementaryCompDD_sA1:  \"\\<not> elementaryCompDD sA1\" \nproof -\n  have \"outSetCorelated data2 \\<inter> outSetCorelated data10 = {}\"\n  by (metis OUTfromV.simps(2) inf_bot_left outSetCorelatedEmpty1) \n  thus ?thesis by (simp add: elementaryCompDD_def)\nqed\n\nlemma NOT_elementaryCompDD_sA2: \"\\<not> elementaryCompDD sA2\" \nproof -\n  have \"outSetCorelated data5 \\<inter> outSetCorelated data11 = {}\"\n  by (metis OUTfromV.simps(5) inf_bot_right inf_commute outSetCorelatedEmpty1)\n  thus ?thesis by (simp add: elementaryCompDD_def)\nqed \n\nlemma NOT_elementaryCompDD_sA3:  \"\\<not> elementaryCompDD sA3\" \nproof -\n  have \"outSetCorelated data6 \\<inter> outSetCorelated data7 = {}\"\n  by (metis OUTfromV.simps(7) inf_bot_right outSetCorelatedEmpty1) \n  thus ?thesis by (simp add: elementaryCompDD_def)\nqed\n\nlemma NOT_elementaryCompDD_sA4:  \"\\<not> elementaryCompDD sA4\" \nproof -\n  have \"outSetCorelated data3 \\<inter> outSetCorelated data8 = {}\"\n  by (metis OUTfromV.simps(8) inf_bot_left inf_commute outSetCorelatedEmpty1)\n  thus ?thesis by (simp add: elementaryCompDD_def)  \nqed\n\nlemma elementaryCompDD_sA5:  \"elementaryCompDD sA5\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA6:  \"elementaryCompDD sA6\" \nproof -\n  have oSet15:\"outSetCorelated data15 \\<noteq> {}\" \n    by (simp add: outSetCorelated_def, auto)\n  have oSet16:\"outSetCorelated data16 \\<noteq> {}\"\n    by (simp add: outSetCorelated_def, auto)\n  have \"outSetCorelated data15 \\<inter> outSetCorelated data16 \\<noteq> {}\"\n    by (simp add: outSetCorelated_def, auto)\n  with oSet15 oSet16 show ?thesis by (simp add: elementaryCompDD_def, auto) \nqed\n\nlemma NOT_elementaryCompDD_sA7:  \"\\<not> elementaryCompDD sA7\" \nproof - \n  have \"outSetCorelated data17 \\<inter> outSetCorelated data18 = {}\"\n  by (metis (full_types) OUTfromV.simps(17) disjoint_iff_not_equal empty_iff outSetCorelatedEmpty1) \n  thus ?thesis by  (simp add: elementaryCompDD_def)\nqed\n\nlemma NOT_elementaryCompDD_sA8:  \"\\<not> elementaryCompDD sA8\" \nproof - \n  have \"outSetCorelated data20 \\<inter> outSetCorelated data21 = {}\"\n  by (metis OUTfromV.simps(21) inf_bot_right outSetCorelatedEmpty1)\n  thus ?thesis by  (simp add: elementaryCompDD_def)\nqed\n\nlemma NOT_elementaryCompDD_sA9:  \"\\<not> elementaryCompDD sA9\" \nproof - \n  have \"outSetCorelated data23 \\<inter> outSetCorelated data24 = {}\"\n  by (metis (full_types) OUTfromV.simps(23) disjoint_iff_not_equal empty_iff outSetCorelatedEmpty1)\n  thus ?thesis by  (simp add: elementaryCompDD_def)  \nqed\n\n--\"On the abstraction level 1 all components are elementary\"\n\nlemma elementaryCompDD_sA11:  \"elementaryCompDD sA11\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA12:  \"elementaryCompDD sA12\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA21: \"elementaryCompDD sA21\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA22: \"elementaryCompDD sA22\" \nproof - \n  have oSet4:\"outSetCorelated data4 \\<noteq> {}\"  \n    by (simp add: outSetCorelated_def, auto)\n  have oSet12:\"outSetCorelated data12 \\<noteq> {}\"  \n    by (simp add: outSetCorelated_def, auto)\n  have \"outSetCorelated data4 \\<inter> outSetCorelated data12 \\<noteq> {}\"\n    by (simp add: outSetCorelated_def, auto)\n  with oSet4 oSet12 show ?thesis \n    by  (simp add: elementaryCompDD_def, auto)\nqed \n\nlemma elementaryCompDD_sA23: \"elementaryCompDD sA23\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA31: \"elementaryCompDD sA31\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA32: \"elementaryCompDD sA32\" \nby  (simp add: elementaryCompDD_def)\n\n\nlemma elementaryCompDD_sA41: \"elementaryCompDD sA41\" \nby  (simp add: elementaryCompDD_def) \n\nlemma elementaryCompDD_sA42: \"elementaryCompDD sA42\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA71: \"elementaryCompDD sA71\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA72: \"elementaryCompDD sA72\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA81: \"elementaryCompDD sA81\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA82: \"elementaryCompDD sA82\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA91: \"elementaryCompDD sA91\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA92: \"elementaryCompDD sA92\" \nby  (simp add: elementaryCompDD_def)\n\nlemma elementaryCompDD_sA93: \"elementaryCompDD sA93\" \nby  (simp add: elementaryCompDD_def)\n\nsubsection {* Source components *}\n\n--\"Abstraction level 0\"\n\nlemma A5_NotDSource_level0: \"isNotDSource level0 sA5\"\nby (simp add: isNotDSource_def, auto,  case_tac \"Z\", auto)\n\nlemma DSourcesA1_L0: \"DSources level0 sA1 = {}\"\nby (simp add: DSources_def, auto, case_tac \"x\", auto) \n\nlemma DSourcesA2_L0: \"DSources level0 sA2 = { sA1, sA4}\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma DSourcesA3_L0: \"DSources level0 sA3 = { sA2 }\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma DSourcesA4_L0: \"DSources level0 sA4 = { sA3 }\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma DSourcesA5_L0: \"DSources level0 sA5 = { sA4 }\"\nby (simp add: DSources_def AbstrLevel0, auto)  \n\nlemma DSourcesA6_L0: \"DSources level0 sA6 = {}\"\nby (simp add: DSources_def, auto, case_tac \"x\", auto) \n\nlemma DSourcesA7_L0: \"DSources level0 sA7 = {sA6}\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma DSourcesA8_L0: \"DSources level0 sA8 = {sA7, sA9}\"\nby (simp add: DSources_def AbstrLevel0, force)\n\nlemma DSourcesA9_L0: \"DSources level0 sA9 = {sA8}\"\nby (simp add: DSources_def AbstrLevel0, auto) \n\nlemma A1_DAcc_level0: \"DAcc level0 sA1 = { sA2 }\" \nby (simp add: DAcc_def  AbstrLevel0, auto)\n\nlemma A2_DAcc_level0: \"DAcc level0 sA2 = { sA3 }\" \nby (simp add: DAcc_def  AbstrLevel0, force)\n\nlemma A3_DAcc_level0: \"DAcc level0 sA3 = { sA4 }\" \nby (simp add: DAcc_def  AbstrLevel0, auto)\n\nlemma A4_DAcc_level0: \"DAcc level0 sA4 = { sA2, sA5 }\" \nby (simp add: DAcc_def  AbstrLevel0, auto)\n\nlemma A5_DAcc_level0: \"DAcc level0 sA5 = {}\" \nby (simp add: DAcc_def  AbstrLevel0, auto)\n\nlemma A6_DAcc_level0: \"DAcc level0 sA6 = { sA7 }\" \nby (simp add: DAcc_def  AbstrLevel0, auto)\n\nlemma A7_DAcc_level0: \"DAcc level0 sA7 = { sA8 }\" \nby (simp add: DAcc_def  AbstrLevel0, auto)\n\nlemma A8_DAcc_level0: \"DAcc level0 sA8 = { sA9 }\" \nby (simp add: DAcc_def  AbstrLevel0, auto)\n\nlemma A9_DAcc_level0: \"DAcc level0 sA9 = { sA8 }\" \nby (simp add: DAcc_def  AbstrLevel0, force)\n\nlemma A8_NSources:\n\"\\<forall> C \\<in> (AbstrLevel level0). (C \\<noteq> sA9 \\<and> C \\<noteq> sA8 \\<longrightarrow> sA8 \\<notin> (Sources level0 C))\"\nby (metis A8_DAcc_level0 A9_DAcc_level0 singleDSourceLoop)\n\nlemma A9_NSources:\n\"\\<forall> C \\<in> (AbstrLevel level0). (C \\<noteq> sA9 \\<and> C \\<noteq> sA8 \\<longrightarrow> sA9 \\<notin> (Sources level0 C))\"\nby (metis A8_DAcc_level0 A9_DAcc_level0 singleDSourceLoop)\n\nlemma A7_Acc:\n\"(Acc level0 sA7) = {sA8, sA9}\"\n  by (metis A7_DAcc_level0 A8_DAcc_level0 A9_DAcc_level0 AccDef AccSigleLoop insert_commute) \n\nlemma A7_NSources:\n\"\\<forall> C \\<in> (AbstrLevel level0). (C \\<noteq> sA9 \\<and> C \\<noteq> sA8 \\<longrightarrow> sA7 \\<notin> (Sources level0 C))\"\nby (metis A7_Acc Acc_Sources insert_iff singleton_iff)\n\nlemma A5_Acc: \"(Acc level0 sA5) = {}\"\nby (metis A5_NotDSource_level0 isNotDSource_EmptyAcc)\n\nlemma A6_Acc:\n\"(Acc level0 sA6) = {sA7, sA8, sA9}\"\nproof -\n  have daA6:  \"DAcc level0 sA6 = { sA7 }\"  by (rule A6_DAcc_level0)\n  hence \"(\\<Union> S \\<in> (DAcc level0 sA6). (Acc level0 S)) = (Acc level0 sA7)\"  by simp\n  hence aA6:\"(\\<Union> S \\<in> (DAcc level0 sA6). (Acc level0 S)) = { sA8, sA9 }\" by (simp add: A7_Acc)\n  have \"(Acc level0 sA6) = (DAcc level0 sA6) \\<union> (\\<Union> S \\<in> (DAcc level0 sA6). (Acc level0 S))\"  \n    by (rule AccDef)\n  with daA6 aA6 show ?thesis by auto\nqed\n\nlemma A6_NSources:\n\"\\<forall> C \\<in> (AbstrLevel level0). (C \\<noteq> sA9 \\<and> C \\<noteq> sA8 \\<and> C \\<noteq> sA7 \\<longrightarrow> sA6 \\<notin> (Sources level0 C))\"\nby (metis (full_types) A6_Acc A7_Acc Acc_SourcesNOT insert_iff singleton_iff)\n\nlemma SourcesA1_L0: \"Sources level0 sA1 = {}\"  \nby (simp add: DSourcesA1_L0 DSourcesEmptySources) \n     \nlemma SourcesA2_L0: \"Sources level0 sA2 = { sA1, sA2, sA3, sA4 }\"\nproof \n  show \"Sources level0 sA2 \\<subseteq> {sA1, sA2, sA3, sA4}\"\n  proof -\n    have A2level0:\"sA2 \\<in> (AbstrLevel level0)\" by (simp add: AbstrLevel0)\n    have sgA5:\"sA5 \\<notin> Sources level0 sA2\" \n      by (metis A5_NotDSource_level0 DSource_level NoDSourceNoSource \n            allNotDSource_NotSource isNotSource_Sources)\n     from A2level0 have sgA6:\"sA6 \\<notin> Sources level0 sA2\" by (simp add: A6_NSources)\n     from A2level0 have sgA7:\"sA7 \\<notin> Sources level0 sA2\" by (simp add: A7_NSources)\n     from A2level0 have sgA8:\"sA8 \\<notin> Sources level0 sA2\" by (simp add: A8_NSources)\n     from A2level0 have sgA9:\"sA9 \\<notin> Sources level0 sA2\" by (simp add: A9_NSources)\n     have \"Sources level0 sA2 \\<subseteq> {sA1, sA2, sA3, sA4, sA5, sA6, sA7, sA8, sA9}\"\n        by (metis AbstrLevel0 SourcesLevelX) \n     with sgA5 sgA6 sgA7 sgA8 sgA9 show \"Sources level0 sA2 \\<subseteq> {sA1, sA2, sA3, sA4}\"\n        by blast   \n  qed\nnext\n  show \"{sA1, sA2, sA3, sA4} \\<subseteq> Sources level0 sA2\"\n  proof -\n    have dsA4:\"{ sA3 } \\<subseteq> Sources level0 sA2\"\n       by (metis DSource_Sources DSourcesA2_L0 DSourcesA4_L0 \n             Sources_DSources insertI1 insert_commute subset_trans)\n    have \"{ sA2 } \\<subseteq> Sources level0 sA2\"\n      by (metis DSource_Sources DSourcesA2_L0 DSourcesA3_L0 \n             DSourcesA4_L0 Sources_DSources insertI1 \n             insert_commute subset_trans)\n    with dsA4 show \"{sA1, sA2, sA3, sA4} \\<subseteq> Sources level0 sA2\"\n       by (metis DSourcesA2_L0 Sources_DSources insert_subset)\n   qed\nqed\n        \nlemma SourcesA3_L0: \"Sources level0 sA3 = { sA1, sA2, sA3, sA4 }\"\nproof \n  show \"Sources level0 sA3 \\<subseteq> {sA1, sA2, sA3, sA4}\"\n  proof -\n    have a2:\"Sources level0 sA2 = { sA1, sA2, sA3, sA4}\" by (simp add: SourcesA2_L0)\n    have \"{ sA2 } \\<subseteq> DSources level0 sA3\" by (simp add: DSourcesA3_L0)\n    with a2 show \"Sources level0 sA3 \\<subseteq> {sA1, sA2, sA3, sA4}\"\n       by (metis DSource_Sources DSourcesA2_L0 DSourcesA4_L0 insertI1 insert_commute subset_trans)\n  qed\nnext\n   show \"{sA1, sA2, sA3, sA4} \\<subseteq> Sources level0 sA3\"\n   by (metis (full_types) DSource_Sources DSourcesA3_L0  SourcesA2_L0 insertI1)\nqed    \n             \nlemma SourcesA4_L0: \"Sources level0 sA4 = { sA1, sA2, sA3, sA4 }\"\nproof -\n  have  A3s:\"Sources level0 sA3 = { sA1, sA2, sA3, sA4 }\" by (rule  SourcesA3_L0)\n  have  \"Sources level0 sA4 = {sA3} \\<union> Sources level0 sA3\"\n    by (metis DSourcesA4_L0 Sources_singleDSource) \n  with A3s show ?thesis by auto\nqed  \n\nlemma SourcesA5_L0: \"Sources level0 sA5 = { sA1, sA2, sA3, sA4 }\"\nproof -  \n  have  A4s:\"Sources level0 sA4 = { sA1, sA2, sA3, sA4 }\" by (rule  SourcesA4_L0)\n  have  \"Sources level0 sA5 = {sA4} \\<union> Sources level0 sA4\"\n    by (metis DSourcesA5_L0 Sources_singleDSource) \n  with A4s show ?thesis by auto\nqed  \n\nlemma SourcesA6_L0: \"Sources level0 sA6 = {}\"  \nby (simp add: DSourcesA6_L0 DSourcesEmptySources) \n\nlemma SourcesA7_L0: \"Sources level0 sA7 = { sA6 }\"  \nby (metis DSourcesA7_L0 SourcesA6_L0 SourcesEmptyDSources SourcesOnlyDSources singleton_iff)\n\n \n\n\nlemma SourcesA9_L0: \"Sources level0 sA9 = { sA6, sA7, sA8, sA9 }\"  \nproof - \n  have \"(Sources level0 sA9) = (DSources level0 sA9) \\<union> (\\<Union> S \\<in> (DSources level0 sA9). (Sources level0 S))\" \n    by (rule SourcesDef)\n  hence sourcesA9:\"(Sources level0 sA9) = ({sA8} \\<union> (Sources level0 sA8))\" \n    by (simp add:  DSourcesA9_L0)\n   thus ?thesis  by (metis SourcesA8_L0 Un_insert_right insert_absorb2 insert_is_Un) \nqed\n \n\n--\"Abstraction level 1\"\n\nlemma A12_NotSource_level1: \"isNotDSource level1 sA12\"\nby (simp add: isNotDSource_def, auto,  case_tac \"Z\", auto)\n\nlemma A21_NotSource_level1: \"isNotDSource level1 sA21\"\nby (simp add: isNotDSource_def, auto,  case_tac \"Z\", auto)\n\nlemma A5_NotSource_level1: \"isNotDSource level1 sA5\"\nby (simp add: isNotDSource_def, auto,  case_tac \"Z\", auto)\n\nlemma A92_NotSource_level1: \"isNotDSource level1 sA92\"\nby (simp add: isNotDSource_def, auto,  case_tac \"Z\", auto)\n\nlemma A93_NotSource_level1: \"isNotDSource level1 sA93\"\nby (simp add: isNotDSource_def, auto,  case_tac \"Z\", auto)\n\n\nlemma A11_DAcc_level1: \"DAcc level1 sA11 = { sA21, sA22, sA23 }\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A12_DAcc_level1: \"DAcc level1 sA12 = {}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A21_DAcc_level1: \"DAcc level1 sA21 = {}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A22_DAcc_level1: \"DAcc level1 sA22 = {sA31}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A23_DAcc_level1: \"DAcc level1 sA23 = {sA32}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A31_DAcc_level1: \"DAcc level1 sA31 = {sA41}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A32_DAcc_level1: \"DAcc level1 sA32 = {sA41}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A41_DAcc_level1: \"DAcc level1 sA41 = {sA22}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A42_DAcc_level1: \"DAcc level1 sA42 = {sA5}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A5_DAcc_level1: \"DAcc level1 sA5 = {}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A6_DAcc_level1: \"DAcc level1 sA6 = {sA71, sA72}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A71_DAcc_level1: \"DAcc level1 sA71 = {sA81}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A72_DAcc_level1: \"DAcc level1 sA72 = {sA82}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A81_DAcc_level1: \"DAcc level1 sA81 = {sA91, sA92}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A82_DAcc_level1: \"DAcc level1 sA82 = {sA93}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A91_DAcc_level1: \"DAcc level1 sA91 = {sA81}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A92_DAcc_level1: \"DAcc level1 sA92 = {}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A93_DAcc_level1: \"DAcc level1 sA93 = {}\" \nby (simp add: DAcc_def  AbstrLevel1, auto)\n\nlemma A42_NSources_L1:\n\"\\<forall> C \\<in> (AbstrLevel level1). C \\<noteq> sA5 \\<longrightarrow> sA42 \\<notin> (Sources level1 C)\"\nby (metis A42_DAcc_level1 A5_NotSource_level1 singleDSourceEmpty4isNotSource)\n\nlemma A5_NotSourceSet_level1 :\n\"\\<forall> C  \\<in> (AbstrLevel level1). sA5 \\<notin> (Sources level1 C)\"\nby (metis A5_NotSource_level1 isNotSource_Sources)\n\nlemma A92_NotSourceSet_level1 :\n\"\\<forall> C  \\<in> (AbstrLevel level1). sA92 \\<notin> (Sources level1 C)\" \nby (metis A92_NotSource_level1 isNotSource_Sources)\n\nlemma A93_NotSourceSet_level1 :\n\"\\<forall> C  \\<in> (AbstrLevel level1). sA93 \\<notin> (Sources level1 C)\" \nby (metis A93_NotSource_level1 isNotSource_Sources)\n\n\nlemma DSourcesA11_L1: \"DSources level1 sA11 = {}\"\nby (simp add: DSources_def, auto, case_tac \"x\", auto) \n\nlemma DSourcesA12_L1: \"DSources level1 sA12 = {}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA21_L1: \"DSources level1 sA21 = {sA11}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA22_L1: \"DSources level1 sA22 = {sA11, sA41}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA23_L1: \"DSources level1 sA23 = {sA11}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA31_L1: \"DSources level1 sA31 = { sA22 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA32_L1: \"DSources level1 sA32 = { sA23 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA41_L1: \"DSources level1 sA41 = { sA31, sA32 }\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA42_L1: \"DSources level1 sA42 = {}\"\nby (simp add: DSources_def AbstrLevel1, auto) \n\nlemma DSourcesA5_L1: \"DSources level1 sA5 = { sA42 }\"\nby (simp add: DSources_def AbstrLevel1, auto)  \n\nlemma DSourcesA6_L1: \"DSources level1 sA6 = {}\"\nby (simp add: DSources_def AbstrLevel1, auto)  \n\nlemma DSourcesA71_L1: \"DSources level1 sA71 = { sA6 }\"\nby (simp add: DSources_def AbstrLevel1, auto)  \n\nlemma DSourcesA72_L1: \"DSources level1 sA72 = { sA6 }\"\nby (simp add: DSources_def AbstrLevel1, auto)  \n\nlemma DSourcesA81_L1: \"DSources level1 sA81 = { sA71, sA91 }\"\nby (simp add: DSources_def AbstrLevel1, auto)  \n\nlemma DSourcesA82_L1: \"DSources level1 sA82 = { sA72 }\"\nby (simp add: DSources_def AbstrLevel1, auto)  \n\nlemma DSourcesA91_L1: \"DSources level1 sA91 = { sA81 }\"\nby (simp add: DSources_def AbstrLevel1, auto)  \n\nlemma DSourcesA92_L1: \"DSources level1 sA92 = { sA81 }\"\nby (simp add: DSources_def AbstrLevel1, auto)  \n\nlemma DSourcesA93_L1: \"DSources level1 sA93 = { sA82 }\"\nby (simp add: DSources_def AbstrLevel1, auto)  \n\nlemma A82_Acc: \"(Acc level1 sA82) = {sA93}\"\nby (metis A82_DAcc_level1 A93_NotSource_level1 singleDSourceEmpty_Acc) \n\nlemma A82_NSources_L1:\n\"\\<forall> C \\<in> (AbstrLevel level1). (C \\<noteq> sA93 \\<longrightarrow> sA82 \\<notin> (Sources level1 C))\"\nby (metis A82_Acc Acc_Sources singleton_iff) \n\nlemma A72_Acc: \"(Acc level1 sA72) = {sA82, sA93}\"\nproof -\n  have daA72:  \"DAcc level1 sA72 = { sA82 }\"  by (rule A72_DAcc_level1)\n  hence \"(\\<Union> S \\<in> (DAcc level1 sA72). (Acc level1 S)) = (Acc level1 sA82)\"  by simp\n  hence aA72:\"(\\<Union> S \\<in> (DAcc level1 sA72). (Acc level1 S)) = { sA93 }\" by (simp add: A82_Acc)\n  have \"(Acc level1 sA72) = (DAcc level1 sA72) \\<union> (\\<Union> S \\<in> (DAcc level1 sA72). (Acc level1 S))\"  \n    by (rule AccDef)\n  with daA72 aA72 show ?thesis by auto\nqed\n\nlemma A72_NSources_L1:\n\"\\<forall> C \\<in> (AbstrLevel level1). (C \\<noteq> sA93 \\<and> C \\<noteq> sA82 \\<longrightarrow> sA72 \\<notin> (Sources level1 C))\"\nby (metis A72_Acc Acc_Sources insert_iff singleton_iff) \n\nlemma A92_Acc: \"(Acc level1 sA92) = {}\"\nby (metis A92_NotSource_level1 isNotDSource_EmptyAcc)\n\nlemma A92_NSources_L1:\n\"\\<forall> C \\<in> (AbstrLevel level1). (sA92 \\<notin> (Sources level1 C))\"\nby (metis A92_NotSourceSet_level1)\n \nlemma A91_Acc: \"(Acc level1 sA91) = {sA81, sA91, sA92}\"\nproof -\n  have da91:  \"DAcc level1 sA91 = { sA81 }\"  by (rule A91_DAcc_level1)\n  hence a91:\"(\\<Union> S \\<in> (DAcc level1 sA91). (Acc level1 S)) = (Acc level1 sA81)\"  by simp\n  have \"(Acc level1 sA91) = (DAcc level1 sA91) \\<union> (\\<Union> S \\<in> (DAcc level1 sA91). (Acc level1 S))\"  by (rule AccDef)\n  with da91 a91 have acc91:\"(Acc level1 sA91) = { sA81 } \\<union> (Acc level1 sA81)\" by simp\n  have da81:  \"DAcc level1 sA81 = { sA91, sA92 }\"  by (rule A81_DAcc_level1)\n  hence a81:\"(\\<Union> S \\<in> (DAcc level1 sA81). (Acc level1 S)) = (Acc level1 sA92) \\<union> (Acc level1 sA91)\"  by auto\n  have \"(Acc level1 sA81) = (DAcc level1 sA81) \\<union> (\\<Union> S \\<in> (DAcc level1 sA81). (Acc level1 S))\"  by (rule AccDef)\n  with da81 a81 have acc81: \"(Acc level1 sA81) = { sA91, sA92 }  \\<union> (Acc level1 sA91)\"\n    by (metis A92_Acc sup_bot.left_neutral)\n  from acc91 acc81 have \"(Acc level1 sA91) = { sA81 } \\<union> { sA91, sA92 }  \\<union> {sA91, sA81}\"\n   by (metis AccLoop)\n  thus ?thesis by auto\nqed\n\nlemma A91_NSources_L1:\n\"\\<forall> C \\<in> (AbstrLevel level1). (C \\<noteq> sA92 \\<and> C \\<noteq> sA91 \\<and> C \\<noteq> sA81 \\<longrightarrow> sA91 \\<notin> (Sources level1 C))\"\nproof -\n  have \"\\<forall> C \\<in> (AbstrLevel level1). (C \\<noteq> sA92 \\<and> C \\<noteq> sA91 \\<and> C \\<noteq> sA81  \\<longrightarrow> (C \\<notin> (Acc level1 sA91)))\"\n    by (metis A91_Acc insert_iff singleton_iff)\n  thus ?thesis  by (metis Acc_SourcesNOT) \nqed\n\nlemma A81_Acc: \"(Acc level1 sA81) = {sA81, sA91, sA92}\"\nproof -\n  have da91:  \"DAcc level1 sA91 = { sA81 }\"  by (rule A91_DAcc_level1)\n  hence a91:\"(\\<Union> S \\<in> (DAcc level1 sA91). (Acc level1 S)) = (Acc level1 sA81)\"  by simp\n  have \"(Acc level1 sA91) = (DAcc level1 sA91) \\<union> (\\<Union> S \\<in> (DAcc level1 sA91). (Acc level1 S))\"  by (rule AccDef)\n  with da91 a91 have acc91:\"(Acc level1 sA91) = { sA81 } \\<union> (Acc level1 sA81)\" by simp\n  have da81:  \"DAcc level1 sA81 = { sA91, sA92 }\"  by (rule A81_DAcc_level1)\n  hence a81:\"(\\<Union> S \\<in> (DAcc level1 sA81). (Acc level1 S)) = (Acc level1 sA92) \\<union> (Acc level1 sA91)\"  by auto\n  have \"(Acc level1 sA81) = (DAcc level1 sA81) \\<union> (\\<Union> S \\<in> (DAcc level1 sA81). (Acc level1 S))\"  by (rule AccDef)\n  with da81 a81 have acc81: \"(Acc level1 sA81) = { sA91, sA92 }  \\<union> (Acc level1 sA91)\"\n    by (metis A92_Acc sup_bot.left_neutral)\n  from acc81 acc91 have \"(Acc level1 sA81) =  { sA91, sA92 }  \\<union> { sA81 } \\<union> {sA81, sA91}\"\n   by (metis AccLoop)\n  thus ?thesis by auto\nqed\n\nlemma A81_NSources_L1:\n\"\\<forall> C \\<in> (AbstrLevel level1). (C \\<noteq> sA92 \\<and> C \\<noteq> sA91 \\<and> C \\<noteq> sA81 \\<longrightarrow> sA81 \\<notin> (Sources level1 C))\"\nproof -\n  have \"\\<forall> C \\<in> (AbstrLevel level1). (C \\<noteq> sA92 \\<and> C \\<noteq> sA91 \\<and> C \\<noteq> sA81  \\<longrightarrow> (C \\<notin> (Acc level1 sA81)))\"\n    by (metis A81_Acc insert_iff singleton_iff)\n  thus ?thesis  by (metis Acc_SourcesNOT) \nqed\n\nlemma A71_Acc: \"(Acc level1 sA71) = {sA81, sA91, sA92}\"\nproof -\n  have da71:  \"DAcc level1 sA71 = { sA81 }\"  by (rule A71_DAcc_level1)\n  hence a71:\"(\\<Union> S \\<in> (DAcc level1 sA71). (Acc level1 S)) = (Acc level1 sA81)\"  by simp\n  have \"(Acc level1 sA71) = (DAcc level1 sA71) \\<union> (\\<Union> S \\<in> (DAcc level1 sA71). (Acc level1 S))\"  by (rule AccDef)\n  with da71 a71 show ?thesis by (metis A91_Acc A91_DAcc_level1 AccDef) \nqed\n\nlemma A71_NSources_L1:\n\"\\<forall> C \\<in> (AbstrLevel level1). (C \\<noteq> sA92 \\<and> C \\<noteq> sA91 \\<and> C \\<noteq> sA81 \\<longrightarrow> sA71 \\<notin> (Sources level1 C))\"\nproof -\n  have \"\\<forall> C \\<in> (AbstrLevel level1). (C \\<noteq> sA92 \\<and> C \\<noteq> sA91 \\<and> C \\<noteq> sA81  \\<longrightarrow> (C \\<notin> (Acc level1 sA71)))\"\n    by (metis A71_Acc insert_iff singleton_iff)\n  thus ?thesis  by (metis Acc_SourcesNOT) \nqed\n\nlemma A6_Acc_L1:\n\"(Acc level1 sA6) = {sA71, sA72, sA81, sA82, sA91, sA92, sA93}\"\nproof -\n  have daA6:  \"DAcc level1 sA6 = { sA71, sA72 }\"  by (rule A6_DAcc_level1)\n  hence \"(\\<Union> S \\<in> (DAcc level1 sA6). (Acc level1 S)) = (Acc level1 sA71) \\<union> (Acc level1 sA72)\"  by simp\n  hence aA6:\"(\\<Union> S \\<in> (DAcc level1 sA6). (Acc level1 S)) = {sA81, sA91, sA92} \\<union> {sA82, sA93}\" \n    by (simp add: A71_Acc A72_Acc)\n  have \"(Acc level1 sA6) = (DAcc level1 sA6) \\<union> (\\<Union> S \\<in> (DAcc level1 sA6). (Acc level1 S))\"  \n    by (rule AccDef)\n  with daA6 aA6 show ?thesis by auto\nqed\n\nlemma A6_NSources_L1Acc:\n\"\\<forall> C \\<in> (AbstrLevel level1). (C \\<notin> (Acc level1 sA6) \\<longrightarrow> sA6 \\<notin> (Sources level1 C))\"\nby (metis Acc_SourcesNOT)\n\n\nlemma A6_NSources_L1:\n\"\\<forall> C \\<in> (AbstrLevel level1). (C \\<noteq> sA93 \\<and> C \\<noteq> sA92 \\<and> C \\<noteq> sA91 \\<and> C \\<noteq> sA82  \\<and> C \\<noteq> sA81 \\<and> C \\<noteq> sA72 \\<and> C \\<noteq> sA71 \n\\<longrightarrow> sA6 \\<notin> (Sources level1 C))\"\nproof -\n  have \"\\<forall> C \\<in> (AbstrLevel level1). \n  (C \\<noteq> sA93 \\<and> C \\<noteq> sA92 \\<and> C \\<noteq> sA91 \\<and> C \\<noteq> sA82  \\<and> C \\<noteq> sA81 \\<and> C \\<noteq> sA72 \\<and> C \\<noteq> sA71 \n  \\<longrightarrow> (C \\<notin> (Acc level1 sA6)))\"\n     by (metis A6_Acc_L1 empty_iff insert_iff)\n  thus ?thesis  by (metis Acc_SourcesNOT) \nqed\n\nlemma A5_Acc_L1: \"(Acc level1 sA5) = {}\"\nby (metis A5_NotSource_level1 isNotDSource_EmptyAcc)\n\n\nlemma SourcesA11_L1: \"Sources level1 sA11 = {}\"  \nby (simp add: DSourcesA11_L1 DSourcesEmptySources) \n\nlemma SourcesA12_L1: \"Sources level1 sA12 = {}\"  \nby (simp add: DSourcesA12_L1  DSourcesEmptySources) \n\nlemma SourcesA21_L1: \"Sources level1 sA21 = {sA11}\"\nby (simp add: DSourcesA21_L1 SourcesA11_L1  Sources_singleDSource) \n\nlemma SourcesA22_L1: \"Sources level1 sA22 = {sA11, sA22,  sA23, sA31, sA32, sA41}\"\nproof\n  show \"Sources level1 sA22 \\<subseteq> {sA11, sA22, sA23, sA31, sA32, sA41}\"\n  proof -\n     have A2level1:\"sA22 \\<in> (AbstrLevel level1)\" by (simp add: AbstrLevel1)\n     from A2level1 have sgA42:\"sA42 \\<notin> Sources level1 sA22\" by (metis A42_NSources_L1 CSet.distinct(347)) \n     have sgA5:\"sA5 \\<notin> Sources level1 sA22\"\n     by (metis A5_NotSource_level1 Acc_Sources all_not_in_conv isNotDSource_EmptyAcc)  \n     have sgA12:\"sA12 \\<notin> Sources level1 sA22\" by (metis A12_NotSource_level1 A2level1 isNotSource_Sources)   \n     have sgA21:\"sA21 \\<notin> Sources level1 sA22\"\n     by (metis A21_NotSource_level1 DAcc_DSourcesNOT NDSourceExistsDSource empty_iff isNotDSource_EmptyDAcc)\n     from A2level1 have sgA6:\"sA6 \\<notin> Sources level1 sA22\" by (simp add: A6_NSources_L1)\n     from A2level1 have sgA71:\"sA71 \\<notin> Sources level1 sA22\" by (simp add: A71_NSources_L1)\n     from A2level1 have sgA72:\"sA72 \\<notin> Sources level1 sA22\" by (simp add: A72_NSources_L1)\n     from A2level1 have sgA81:\"sA81 \\<notin> Sources level1 sA22\" by (simp add: A81_NSources_L1)\n     from A2level1 have sgA82:\"sA82 \\<notin> Sources level1 sA22\" by (simp add: A82_NSources_L1)\n     from A2level1 have sgA91:\"sA91 \\<notin> Sources level1 sA22\" by (simp add: A91_NSources_L1)\n     from A2level1 have sgA92:\"sA92 \\<notin> Sources level1 sA22\" by (simp add: A92_NSources_L1) \n     from A2level1 have sgA93:\"sA93 \\<notin> Sources level1 sA22\" by (metis A93_NotSourceSet_level1)  \n     have \"Sources level1 sA22 \\<subseteq> {sA11, sA12, sA21, sA22, sA23, sA31, sA32, \n        sA41, sA42, sA5, sA6, sA71, sA72, sA81, sA82, sA91, sA92, sA93}\"\n        by (metis AbstrLevel1 SourcesLevelX) \n     with sgA5 sgA12 sgA21 sgA42 sgA6 sgA71 sgA72 sgA81 sgA82 sgA91 sgA92 sgA93 show \n     \"Sources level1 sA22 \\<subseteq> {sA11, sA22, sA23, sA31, sA32, sA41}\"\n         by auto \n    qed\nnext \n  show \"{sA11, sA22, sA23, sA31, sA32, sA41} \\<subseteq> Sources level1 sA22\" \n  proof - \n    have sDef:\"(Sources level1 sA22) = (DSources level1 sA22) \\<union> (\\<Union> S \\<in> (DSources level1 sA22). (Sources level1 S))\" \n       by (rule SourcesDef) \n    have A11s: \"sA11 \\<in> Sources level1 sA22\" by (metis DSourceIsSource DSourcesA22_L1 insertI1)  \n    have A41s: \"sA41 \\<in> Sources level1 sA22\" by (metis (full_types) DSourceIsSource DSourcesA22_L1 insertCI)\n    have A31s: \"sA31 \\<in> Sources level1 sA22\" \n      by (metis (full_types) A41s DSourceIsSource DSourcesA41_L1 SourcesTrans insertCI)\n    have A32s: \"sA32 \\<in> Sources level1 sA22\"\n      by (metis A32_DAcc_level1 A41s DAcc_DSourcesNOT DSourceOfSource insertI1)\n    have A23s: \"sA23 \\<in> Sources level1 sA22\"  by (metis A32s DSourceOfSource DSourcesA32_L1 insertI1)\n    have A22s: \"sA22 \\<in> Sources level1 sA22\"  by (metis A31s DSourceOfSource DSourcesA31_L1 insertI1)\n    with A11s A22s A23s A31s A32s A41s show ?thesis by auto\n    qed\nqed \n\nlemma SourcesA23_L1: \"Sources level1 sA23 = {sA11}\"\nby (simp add: DSourcesA23_L1 SourcesA11_L1  Sources_singleDSource)  \n\nlemma SourcesA31_L1: \"Sources level1 sA31 = {sA11, sA22, sA23, sA31, sA32, sA41}\"\nby (metis DSourcesA31_L1 SourcesA22_L1 Sources_singleDSource Un_insert_right insert_absorb2 insert_is_Un)\n\nlemma SourcesA32_L1: \"Sources level1 sA32 = {sA11, sA23}\"\nby (metis DSourcesA32_L1 SourcesA23_L1 Sources_singleDSource Un_insert_right insert_is_Un)\n \nlemma SourcesA41_L1: \"Sources level1 sA41 = {sA11, sA22, sA23, sA31, sA32, sA41}\"\nby (metis DSourcesA41_L1 SourcesA31_L1 SourcesA32_L1 Sources_2DSources Un_absorb Un_commute Un_insert_left)\n\nlemma SourcesA42_L1: \"Sources level1 sA42 = {}\"  \nby (simp add: DSourcesA42_L1  DSourcesEmptySources) \n\nlemma SourcesA5_L1: \"Sources level1 sA5 = {sA42}\"\nby (simp add: DSourcesA5_L1 SourcesA42_L1  Sources_singleDSource) \n\nlemma SourcesA6_L1: \"Sources level1 sA6 = {}\"  \nby (simp add: DSourcesA6_L1 DSourcesEmptySources) \n\nlemma SourcesA71_L1: \"Sources level1 sA71 = {sA6}\"\nby (metis DSourcesA71_L1 SourcesA6_L1 SourcesEmptyDSources SourcesOnlyDSources singleton_iff)   \n\nlemma SourcesA81_L1: \"Sources level1 sA81 = {sA6, sA71, sA81, sA91}\"  \nproof - \n  have  dA81:\"DSources level1 sA81 = {sA71, sA91}\" by (rule DSourcesA81_L1)\n  have  dA91:\"DSources level1 sA91 = {sA81}\" by (rule DSourcesA91_L1)\n  have \"(Sources level1 sA81) = (DSources level1 sA81) \\<union> (\\<Union> S \\<in> (DSources level1 sA81). (Sources level1 S))\" \n    by (rule SourcesDef)\n  with dA81 have  \"(Sources level1 sA81) = ({sA71, sA91} \\<union> (Sources level1 sA71) \\<union> (Sources level1 sA91))\"\n    by (metis (hide_lams, no_types) SUP_empty UN_insert Un_insert_left sup_bot.left_neutral sup_commute)\n  hence sourcesA81:\"(Sources level1 sA81) = ({sA71, sA91, sA6} \\<union> (Sources level1 sA91))\"\n    by (metis SourcesA71_L1 insert_is_Un sup_assoc)\n  have \"(Sources level1 sA91) = (DSources level1 sA91) \\<union> (\\<Union> S \\<in> (DSources level1 sA91). (Sources level1 S))\" \n    by (rule SourcesDef)\n  with dA91 have \"(Sources level1 sA91) = ({sA81} \\<union> (Sources level1 sA81))\"  by simp\n  with sourcesA81 have \"(Sources level1 sA81) = {sA71, sA91, sA6} \\<union> {sA81} \\<union> {sA81, sA91}\"\n    by (metis SourcesLoop)  \n  thus  ?thesis by auto\nqed\n\n(*lemma Sources_singleDSource:\n  assumes \"DSources i S = {C}\" \n  shows    \"Sources i S = {C} \\<union> Sources i C\" *)\nlemma SourcesA91_L1: \"Sources level1 sA91 = {sA6, sA71, sA81, sA91}\"\nproof -\n  have  \"DSources level1 sA91 = {sA81}\" by (rule DSourcesA91_L1)\n  thus ?thesis by (metis SourcesA81_L1 Sources_singleDSource \n          Un_empty_left Un_insert_left insert_absorb2 insert_commute) \nqed\n\nlemma SourcesA92_L1: \"Sources level1 sA92 = {sA6, sA71, sA81, sA91}\"\nby (metis DSourcesA91_L1 DSourcesA92_L1 SourcesA91_L1 Sources_singleDSource) \n\nlemma SourcesA72_L1: \"Sources level1 sA72 = {sA6}\"\nby (metis DSourcesA6_L1 DSourcesA72_L1 SourcesOnlyDSources singleton_iff)   \n\nlemma SourcesA82_L1: \"Sources level1 sA82 = {sA6, sA72}\"  \nproof - \n  have  dA82:\"DSources level1 sA82 = {sA72}\" by (rule DSourcesA82_L1)\n  have \"(Sources level1 sA82) = (DSources level1 sA82) \\<union> (\\<Union> S \\<in> (DSources level1 sA82). (Sources level1 S))\" \n    by (rule SourcesDef)\n  with dA82 have \"(Sources level1 sA82) =  {sA72} \\<union> (Sources level1 sA72)\"  by simp\n  thus ?thesis by (metis SourcesA72_L1 Un_commute insert_is_Un) \nqed\n\nlemma SourcesA93_L1: \"Sources level1 sA93 = {sA6, sA72, sA82}\"\nby (metis DSourcesA93_L1 SourcesA82_L1 Sources_singleDSource Un_insert_right insert_is_Un)   \n\n\n--\"Abstraction level 2\"\n\nlemma SourcesS1_L2: \"Sources level2 sS1 = {}\"\nproof -\n  have \"DSources level2 sS1 = {}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  thus ?thesis  by (simp add: DSourcesEmptySources)\nqed\n\nlemma SourcesS2_L2: \"Sources level2 sS2 = {}\"\nproof -\n  have \"DSources level2 sS2 = {}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  thus ?thesis  by (simp add: DSourcesEmptySources)\nqed\n\nlemma SourcesS3_L2: \"Sources level2 sS3 = {sS2}\"\nproof -\n  have DSourcesS3:\"DSources level2 sS3 = {sS2}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  have \"Sources level2 sS2 = {}\"  by (rule SourcesS2_L2)\n  with DSourcesS3 show ?thesis  by  (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS4_L2:  \"Sources level2 sS4 = {sS2}\"\nproof -\n  have DSourcesS4:\"DSources level2 sS4 = {sS2}\" by (simp add: DSources_def AbstrLevel2, auto)\n  have \"Sources level2 sS2 = {}\"  by (rule SourcesS2_L2)\n  with DSourcesS4 show ?thesis  by  (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS5_L2:  \"Sources level2 sS5 = {sS2, sS4}\"\nproof -\n  have DSourcesS5:\"DSources level2 sS5 = {sS4}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  have \"Sources level2 sS4 = {sS2}\" by (rule SourcesS4_L2)\n  with DSourcesS5 show ?thesis  by  (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS6_L2:  \"Sources level2 sS6 = {sS2, sS4, sS5}\"\nproof -\n  have DSourcesS6:\"DSources level2 sS6 = {sS2, sS5}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  have SourcesS2:\"Sources level2 sS2 = {}\"  by (rule SourcesS2_L2)\n  have \"Sources level2 sS5 = {sS2, sS4}\"  by (rule SourcesS5_L2)\n  with  SourcesS2 DSourcesS6 show ?thesis  by (simp add: Sources_2DSources, auto)\nqed\n\nlemma SourcesS7_L2:  \"Sources level2 sS7 = {}\"\nproof -\n  have \"DSources level2 sS7 = {}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  thus ?thesis  by (simp add: DSourcesEmptySources)\nqed\n\nlemma SourcesS8_L2:\n \"Sources level2 sS8 = {sS7}\"\nproof -\n  have DSourcesS8:\"DSources level2 sS8 = {sS7}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  have \"Sources level2 sS7 = {}\"  by (rule SourcesS7_L2)\n  with DSourcesS8 show ?thesis  by  (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS9_L2:\n \"Sources level2 sS9 = {}\"\nproof -\n  have \"DSources level2 sS9 = {}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  thus ?thesis  by (simp add: DSourcesEmptySources)\nqed\n\nlemma SourcesS10_L2: \"Sources level2 sS10 = {sS9}\"\nproof -\n  have DSourcesS10:\"DSources level2 sS10 = {sS9}\" by (simp add: DSources_def AbstrLevel2, auto)\n  have \"Sources level2 sS9 = {}\" by (rule SourcesS9_L2)\n  with DSourcesS10 show ?thesis  by  (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS11_L2: \"Sources level2 sS11 = {sS9}\"\nproof -\n  have DSourcesS11:\"DSources level2 sS11 = {sS9}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  have \"Sources level2 sS9 = {}\"  by (rule SourcesS9_L2)\n  with DSourcesS11 show ?thesis  by  (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS12_L2: \"Sources level2 sS12 = {sS9, sS10}\"\nproof -\n  have DSourcesS12:\"DSources level2 sS12 = {sS10}\" by (simp add: DSources_def AbstrLevel2, auto)\n  have \"Sources level2 sS10 = {sS9}\"  by (rule SourcesS10_L2)\n  with DSourcesS12 show ?thesis  by  (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS13_L2: \"Sources level2 sS13 = {sS9, sS10, sS12}\"\nproof -\n  have DSourcesS13:\"DSources level2 sS13 = {sS12}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  have \"Sources level2 sS12 = {sS9, sS10}\" by (rule SourcesS12_L2)\n  with DSourcesS13 show ?thesis by  (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS14_L2: \"Sources level2 sS14 = {sS9, sS11}\"\nproof -\n  have DSourcesS14:\"DSources level2 sS14 = {sS11}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  have \"Sources level2 sS11 = {sS9}\"  by (rule SourcesS11_L2)\n  with DSourcesS14 show ?thesis  by  (simp add: Sources_singleDSource)\nqed\n\nlemma SourcesS15_L2: \"Sources level2 sS15 = {sS9, sS11, sS14}\"\nproof -\n  have DSourcesS15:\"DSources level2 sS15= {sS14}\"  by (simp add: DSources_def AbstrLevel2, auto)\n  have \"Sources level2 sS14 = {sS9, sS11}\"  by (rule SourcesS14_L2)\n  with DSourcesS15 show ?thesis by  (simp add: Sources_singleDSource)\nqed\n\n\nsubsection {* Minimal sets of components to prove certain properties *}\n\nlemma minSetOfComponentsTestL2p1:\n\"minSetOfComponents level2 {data10, data13} = {sS1}\"\nproof - \n  have outL2:\"outSetOfComponents level2 {data10, data13} = {sS1}\"\n    by (simp add: outSetOfComponents_def  AbstrLevel2, auto) \n  have \"Sources level2 sS1 = {}\" by (simp add: SourcesS1_L2)\n  with outL2 show ?thesis by (simp add:  minSetOfComponents_def)\nqed\n\nlemma NOT_noIrrelevantChannelsTestL2p1:\n\" \\<not> noIrrelevantChannels level2 {data10, data13}\"\nby (simp add: noIrrelevantChannels_def systemIN_def minSetOfComponentsTestL2p1 AbstrLevel2)\n\nlemma NOT_allNeededINChannelsTestL2p1:\n\"\\<not> allNeededINChannels  level2 {data10, data13}\"\nby (simp add: allNeededINChannels_def minSetOfComponentsTestL2p1  systemIN_def AbstrLevel2)\n\nlemma minSetOfComponentsTestL2p2:\n\"minSetOfComponents level2 {data1, data12} = {sS2, sS4, sS5, sS6}\"\nproof - \n  have outL2:\"outSetOfComponents level2 {data1, data12} = {sS6}\"\n    by (simp add: outSetOfComponents_def  AbstrLevel2, auto) \n  have \"Sources level2 sS6 = {sS2, sS4, sS5}\"\n    by  (simp add: SourcesS6_L2) \n  with outL2 show ?thesis \n    by (simp add:  minSetOfComponents_def) \nqed\n \nlemma noIrrelevantChannelsTestL2p2:\n\"noIrrelevantChannels level2  {data1, data12}\"\nby (simp add: noIrrelevantChannels_def systemIN_def minSetOfComponentsTestL2p2 AbstrLevel2)\n\nlemma allNeededINChannelsTestL2p2:\n\"allNeededINChannels  level2 {data1, data12}\"\nby (simp add: allNeededINChannels_def minSetOfComponentsTestL2p2  systemIN_def AbstrLevel2)\n\nlemma minSetOfComponentsTestL1p3:\n\"minSetOfComponents level1 {data1, data10, data11} = {sA12, sA11, sA21}\"\nproof - \n  have sg1:\"outSetOfComponents level1 {data1, data10, data11} = {sA12, sA21}\"\n    by (simp add: outSetOfComponents_def  AbstrLevel1, auto)  \n  have \"DSources level1 sA12 = {}\"\n    by (simp add: DSources_def AbstrLevel1, auto) \n  hence sg2:\"Sources level1 sA12 = {}\"\n    by (simp add: DSourcesEmptySources)  \n  have sg3:\"DSources level1 sA21 = {sA11}\"\n    by (simp add: DSources_def AbstrLevel1, auto) \n  have sg4:\"DSources level1 sA11 = {}\"\n    by (simp add: DSources_def AbstrLevel1, auto)  \n  hence \"Sources level1 sA21 = {sA11}\"\n    by (metis SourcesOnlyDSources sg3 singleton_iff)\n  from this and sg1 and sg2 show ?thesis\n     by (simp add:  minSetOfComponents_def, blast) \nqed\n\nlemma noIrrelevantChannelsTestL1p3:\n\"noIrrelevantChannels level1  {data1, data10, data11}\"\nby (simp add: noIrrelevantChannels_def systemIN_def minSetOfComponentsTestL1p3 AbstrLevel1)\n\nlemma allNeededINChannelsTestL1p3:\n\"allNeededINChannels  level1 {data1, data10, data11}\"\nby (simp add: allNeededINChannels_def minSetOfComponentsTestL1p3  systemIN_def AbstrLevel1)\n\nlemma minSetOfComponentsTestL2p3:\n\"minSetOfComponents level2 {data1, data10, data11} = {sS1, sS2, sS3}\"\nproof - \n  have sg1:\"outSetOfComponents level2 {data1, data10, data11} = {sS1, sS3}\"\n    by (simp add: outSetOfComponents_def  AbstrLevel2, auto)  \n  have sS1:\"Sources level2 sS1 = {}\" by (simp add: SourcesS1_L2)\n  have \"Sources level2 sS3 = {sS2}\" by (simp add: SourcesS3_L2)\n   with sg1 sS1 show ?thesis\n     by (simp add:  minSetOfComponents_def, blast) \nqed\n \nlemma noIrrelevantChannelsTestL2p3:\n\"noIrrelevantChannels level2  {data1, data10, data11}\"\nby (simp add: noIrrelevantChannels_def systemIN_def minSetOfComponentsTestL2p3 AbstrLevel2)\n\nlemma allNeededINChannelsTestL2p3:\n\"allNeededINChannels  level2 {data1, data10, data11}\"\nby (simp add: allNeededINChannels_def minSetOfComponentsTestL2p3  systemIN_def AbstrLevel2)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/ComponentDependencies/DataDependenciesCaseStudy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5774953651858117, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.30227282555466745}}
{"text": "(*  Title:       AWN.thy\n    License:     BSD 2-Clause. See LICENSE.\n    Author:      Timothy Bourke\n*)\n\nheader \"Terms of the Algebra for Wireless Networks\"\n\ntheory AWN\nimports Lib\nbegin\n\nsubsection \"Sequential Processes\"\n\ntype_synonym ip = nat\ntype_synonym data = nat\n\ntext \\<open>\n  Most of AWN is independent of the type of messages, but the closed layer turns\n  newpkt actions into the arrival of newpkt messages. We use a type class to maintain\n  some abstraction (and independence from the definition of particular protocols).\n\\<close>\n\nclass msg =\n  fixes newpkt :: \"data \\<times> ip \\<Rightarrow> 'a\"\n    and eq_newpkt :: \"'a \\<Rightarrow> bool\"\n  assumes eq_newpkt_eq [simp]: \"eq_newpkt (newpkt (d, i))\"\n\ntext \\<open>\n  Sequential process terms abstract over the types of data states (@{typ 's}),\n  messages (@{typ 'm}), process names (@{typ 'p}),and labels (@{typ 'l}).\n\\<close>\n\ndatatype (dead 's, dead 'm, dead 'p, 'l) seqp =\n    GUARD \"'l\" \"'s \\<Rightarrow> 's set\" \"('s, 'm, 'p, 'l) seqp\"\n  | ASSIGN \"'l\" \"'s \\<Rightarrow> 's\" \"('s, 'm, 'p, 'l) seqp\"\n  | CHOICE \"('s, 'm, 'p, 'l) seqp\" \"('s, 'm, 'p, 'l) seqp\"\n  | UCAST \"'l\" \"'s \\<Rightarrow> ip\" \"'s \\<Rightarrow> 'm\" \"('s, 'm, 'p, 'l) seqp\" \"('s, 'm, 'p, 'l) seqp\"\n  | BCAST \"'l\" \"'s \\<Rightarrow> 'm\" \"('s, 'm, 'p, 'l) seqp\"\n  | GCAST \"'l\" \"'s \\<Rightarrow> ip set\" \"'s \\<Rightarrow> 'm\" \"('s, 'm, 'p, 'l) seqp\"\n  | SEND \"'l\" \"'s \\<Rightarrow> 'm\" \"('s, 'm, 'p, 'l) seqp\"\n  | DELIVER \"'l\" \"'s \\<Rightarrow> data\" \"('s, 'm, 'p, 'l) seqp\"\n  | RECEIVE \"'l\" \"'m \\<Rightarrow> 's \\<Rightarrow> 's\" \"('s, 'm, 'p, 'l) seqp\"\n  | CALL 'p\n  for map: labelmap\n\nsyntax\n  \"_guard\"    :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(00\\<langle>_\\<rangle>)//_\" [0, 60] 60)\n  \"_lguard\"   :: \"['a, 'a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"{_}(00\\<langle>_\\<rangle>)//_\" [0, 0, 60] 60)\n  \"_ifguard\"  :: \"[pttrn, bool,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(00\\<langle>_. _\\<rangle>)//_\" [0, 0, 60] 60)\n\n  \"_bassign\"  :: \"[pttrn, 'a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(00\\<lbrakk>_. _\\<rbrakk>)//_\" [0, 0, 60] 60)\n  \"_lbassign\" :: \"['a, pttrn, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"{_}(00\\<lbrakk>_. _\\<rbrakk>)//_\" [0, 0, 0, 60] 60)\n\n  \"_assign\"  :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"((00\\<lbrakk>_\\<rbrakk>))//_\" [0, 60] 60)\n  \"_lassign\" :: \"['a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"({_}(00\\<lbrakk>_\\<rbrakk>))//_\" [0, 0, 60] 60)\n\n  \"_unicast\"  :: \"['a, 'a,  ('s, 'm, 'p, unit) seqp,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3unicast'((1(3_),/ (3_))') .//(_)/ (2\\<triangleright> _))\" [0, 0, 60, 60] 60)\n  \"_lunicast\" :: \"['a, 'a, 'a, ('s, 'm, 'p, 'a) seqp, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}unicast'((1(3_),/ (3_))') .//(_)/ (2\\<triangleright> _))\" [0, 0, 0, 60, 60] 60)\n\n  \"_bcast\"    :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3broadcast'((1(_))') .)//_\" [0, 60] 60)\n  \"_lbcast\"   :: \"['a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}broadcast'((1(_))') .)//_\" [0, 0, 60] 60)\n\n  \"_gcast\"    :: \"['a, 'a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3groupcast'((1(_),/ (_))') .)//_\" [0, 0, 60] 60)\n  \"_lgcast\"   :: \"['a, 'a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}groupcast'((1(_),/ (_))') .)//_\" [0, 0, 0, 60] 60)\n\n  \"_send\"     :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3send'((_)') .)//_\" [0, 60] 60)\n  \"_lsend\"    :: \"['a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}send'((_)') .)//_\" [0, 0, 60] 60)\n\n  \"_deliver\"  :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3deliver'((_)') .)//_\" [0, 60] 60)\n  \"_ldeliver\" :: \"['a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}deliver'((_)') .)//_\" [0, 0, 60] 60)\n\n  \"_receive\"  :: \"['a,  ('s, 'm, 'p, unit) seqp] \\<Rightarrow>  ('s, 'm, 'p, unit) seqp\"\n                 (\"(3receive'((_)') .)//_\" [0, 60] 60)\n  \"_lreceive\" :: \"['a, 'a, ('s, 'm, 'p, 'a) seqp] \\<Rightarrow> ('s, 'm, 'p, 'a) seqp\"\n                 (\"(3{_}receive'((_)') .)//_\" [0, 0, 60] 60)\n\ntranslations\n  \"_guard f p\"     \\<rightleftharpoons> \"CONST GUARD () f p\"\n  \"_lguard l f p\"  \\<rightleftharpoons> \"CONST GUARD l f p\"\n  \"_ifguard \\<xi> e p\" \\<rightharpoonup> \"CONST GUARD () (\\<lambda>\\<xi>. if e then {\\<xi>} else {}) p\"\n\n  \"_assign f p\"    \\<rightleftharpoons> \"CONST ASSIGN () f p\"\n  \"_lassign l f p\" \\<rightleftharpoons> \"CONST ASSIGN l f p\"\n\n  \"_bassign \\<xi> e p\"    \\<rightleftharpoons> \"CONST ASSIGN () (\\<lambda>\\<xi>. e) p\"\n  \"_lbassign l \\<xi> e p\" \\<rightleftharpoons> \"CONST ASSIGN l (\\<lambda>\\<xi>. e) p\"\n\n  \"_unicast fip fmsg p q\"    \\<rightleftharpoons> \"CONST UCAST () fip fmsg p q\"\n  \"_lunicast l fip fmsg p q\" \\<rightleftharpoons> \"CONST UCAST l fip fmsg p q\"\n\n  \"_bcast fmsg p\"    \\<rightleftharpoons> \"CONST BCAST () fmsg p\"\n  \"_lbcast l fmsg p\" \\<rightleftharpoons> \"CONST BCAST l fmsg p\"\n\n  \"_gcast fipset fmsg p\"    \\<rightleftharpoons> \"CONST GCAST () fipset fmsg p\"\n  \"_lgcast l fipset fmsg p\" \\<rightleftharpoons> \"CONST GCAST l fipset fmsg p\"\n\n  \"_send fmsg p\"    \\<rightleftharpoons> \"CONST SEND () fmsg p\"\n  \"_lsend l fmsg p\" \\<rightleftharpoons> \"CONST SEND l fmsg p\"\n\n  \"_deliver fdata p\"    \\<rightleftharpoons> \"CONST DELIVER () fdata p\"\n  \"_ldeliver l fdata p\" \\<rightleftharpoons> \"CONST DELIVER l fdata p\"\n\n  \"_receive fmsg p\"    \\<rightleftharpoons> \"CONST RECEIVE () fmsg p\"\n  \"_lreceive l fmsg p\" \\<rightleftharpoons> \"CONST RECEIVE l fmsg p\"\n\nnotation \"CHOICE\" (\"((_)//\\<oplus>//(_))\" [56, 55] 55)\n     and \"CALL\"   (\"(3call'((3_)'))\" [0] 60)\n\ndefinition not_call :: \"('s, 'm, 'p, 'l) seqp \\<Rightarrow> bool\"\nwhere \"not_call p \\<equiv> \\<forall>pn. p \\<noteq> call(pn)\"\n\nlemma not_call_simps [simp]:\n  \"\\<And>l fg p.         not_call ({l}\\<langle>fg\\<rangle> p)\"\n  \"\\<And>l fa p.         not_call ({l}\\<lbrakk>fa\\<rbrakk> p)\"\n  \"\\<And>p1 p2.          not_call (p1 \\<oplus> p2)\"\n  \"\\<And>l fip fmsg p q. not_call ({l}unicast(fip, fmsg).p \\<triangleright> q)\"\n  \"\\<And>l fmsg p.       not_call ({l}broadcast(fmsg).p)\"\n  \"\\<And>l fips fmsg p.  not_call ({l}groupcast(fips, fmsg).p)\"\n  \"\\<And>l fmsg p.       not_call ({l}send(fmsg).p)\"\n  \"\\<And>l fdata p.      not_call ({l}deliver(fdata).p)\"\n  \"\\<And>l fmsg p.       not_call ({l}receive(fmsg).p)\"\n  \"\\<And>l pn.         \\<not>(not_call (call(pn)))\"\n  unfolding not_call_def by auto\n\ndefinition not_choice :: \"('s, 'm, 'p, 'l) seqp \\<Rightarrow> bool\"\nwhere \"not_choice p \\<equiv> \\<forall>p1 p2. p \\<noteq> p1 \\<oplus> p2\"\n\nlemma not_choice_simps [simp]:\n  \"\\<And>l fg p.         not_choice ({l}\\<langle>fg\\<rangle> p)\"\n  \"\\<And>l fa p.         not_choice ({l}\\<lbrakk>fa\\<rbrakk> p)\"\n  \"\\<And>p1 p2.        \\<not>(not_choice (p1 \\<oplus> p2))\"\n  \"\\<And>l fip fmsg p q. not_choice ({l}unicast(fip, fmsg).p \\<triangleright> q)\"\n  \"\\<And>l fmsg p.       not_choice ({l}broadcast(fmsg).p)\"\n  \"\\<And>l fips fmsg p.  not_choice ({l}groupcast(fips, fmsg).p)\"\n  \"\\<And>l fmsg p.       not_choice ({l}send(fmsg).p)\"\n  \"\\<And>l fdata p.      not_choice ({l}deliver(fdata).p)\"\n  \"\\<And>l fmsg p.       not_choice ({l}receive(fmsg).p)\"\n  \"\\<And>l pn.           not_choice (call(pn))\"\n  unfolding not_choice_def by auto\n\nlemma seqp_congs:\n  \"\\<And>l fg p. {l}\\<langle>fg\\<rangle> p = {l}\\<langle>fg\\<rangle> p\"\n  \"\\<And>l fa p. {l}\\<lbrakk>fa\\<rbrakk> p = {l}\\<lbrakk>fa\\<rbrakk> p\"\n  \"\\<And>p1 p2. p1 \\<oplus> p2 = p1 \\<oplus> p2\"\n  \"\\<And>l fip fmsg p q. {l}unicast(fip, fmsg).p \\<triangleright> q = {l}unicast(fip, fmsg).p \\<triangleright> q\"\n  \"\\<And>l fmsg p. {l}broadcast(fmsg).p = {l}broadcast(fmsg).p\"\n  \"\\<And>l fips fmsg p. {l}groupcast(fips, fmsg).p = {l}groupcast(fips, fmsg).p\"\n  \"\\<And>l fmsg p. {l}send(fmsg).p = {l}send(fmsg).p\"\n  \"\\<And>l fdata p. {l}deliver(fdata).p = {l}deliver(fdata).p\"\n  \"\\<And>l fmsg p. {l}receive(fmsg).p = {l}receive(fmsg).p\"\n  \"\\<And>l pn. call(pn) = call(pn)\"\n  by auto\n\ntext \\<open>Remove data expressions from process terms.\\<close>\n\nfun seqp_skeleton :: \"('s, 'm, 'p, 'l) seqp \\<Rightarrow> (unit, unit, 'p, 'l) seqp\"\nwhere\n    \"seqp_skeleton ({l}\\<langle>_\\<rangle> p)                 = {l}\\<langle>\\<lambda>_. {()}\\<rangle> (seqp_skeleton p)\"\n  | \"seqp_skeleton ({l}\\<lbrakk>_\\<rbrakk> p)                 = {l}\\<lbrakk>\\<lambda>_. ()\\<rbrakk> (seqp_skeleton p)\"\n  | \"seqp_skeleton (p \\<oplus> q)                   = (seqp_skeleton p) \\<oplus> (seqp_skeleton q)\"\n  | \"seqp_skeleton ({l}unicast(_, _). p \\<triangleright> q) = {l}unicast(\\<lambda>_. 0, \\<lambda>_. ()). (seqp_skeleton p) \\<triangleright> (seqp_skeleton q)\"\n  | \"seqp_skeleton ({l}broadcast(_). p)      = {l}broadcast(\\<lambda>_. ()). (seqp_skeleton p)\"\n  | \"seqp_skeleton ({l}groupcast(_, _). p)   = {l}groupcast(\\<lambda>_. {}, \\<lambda>_. ()). (seqp_skeleton p)\"\n  | \"seqp_skeleton ({l}send(_). p)           = {l}send(\\<lambda>_. ()). (seqp_skeleton p)\"\n  | \"seqp_skeleton ({l}deliver(_). p)        = {l}deliver(\\<lambda>_. 0). (seqp_skeleton p)\"\n  | \"seqp_skeleton ({l}receive(_). p)        = {l}receive(\\<lambda>_ _. ()). (seqp_skeleton p)\"\n  | \"seqp_skeleton (call(pn))                = call(pn)\"\n\ntext \\<open>Calculate the subterms of a term.\\<close>\n\nfun subterms :: \"('s, 'm, 'p, 'l) seqp \\<Rightarrow> ('s, 'm, 'p, 'l) seqp set\"\nwhere\n    \"subterms ({l}\\<langle>fg\\<rangle> p) = {{l}\\<langle>fg\\<rangle> p} \\<union> subterms p\"\n  | \"subterms ({l}\\<lbrakk>fa\\<rbrakk> p) = {{l}\\<lbrakk>fa\\<rbrakk> p} \\<union> subterms p\"\n  | \"subterms (p1 \\<oplus> p2) = {p1 \\<oplus> p2} \\<union> subterms p1 \\<union> subterms p2\"\n  | \"subterms ({l}unicast(fip, fmsg). p \\<triangleright> q) =\n       {{l}unicast(fip, fmsg). p \\<triangleright> q} \\<union> subterms p \\<union> subterms q\"\n  | \"subterms ({l}broadcast(fmsg). p) = {{l}broadcast(fmsg). p} \\<union> subterms p\"\n  | \"subterms ({l}groupcast(fips, fmsg). p) = {{l}groupcast(fips, fmsg). p} \\<union> subterms p\"\n  | \"subterms ({l}send(fmsg). p) = {{l}send(fmsg).p} \\<union> subterms p\"\n  | \"subterms ({l}deliver(fdata). p) = {{l}deliver(fdata).p} \\<union> subterms p\"\n  | \"subterms ({l}receive(fmsg). p) = {{l}receive(fmsg).p} \\<union> subterms p\"\n  | \"subterms (call(pn)) = {call(pn)}\"\n\nlemma subterms_refl [simp]: \"p \\<in> subterms p\"\n  by (cases p) simp_all\n\nlemma subterms_trans [elim]:\n  assumes \"q \\<in> subterms p\"\n      and \"r \\<in> subterms q\"\n    shows \"r \\<in> subterms p\"\n  using assms by (induction p) auto\n\nlemma root_in_subterms [simp]:\n   \"\\<And>\\<Gamma> pn. \\<exists>pn'. \\<Gamma> pn \\<in> subterms (\\<Gamma> pn')\"\n  by (rule_tac x=pn in exI) simp\n\nlemma deriv_in_subterms [elim, dest]:\n  \"\\<And>l f p q. {l}\\<langle>f\\<rangle> q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fa p q. {l}\\<lbrakk>fa\\<rbrakk> q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>p1 p2 p. p1 \\<oplus> p2 \\<in> subterms p \\<Longrightarrow> p1 \\<in> subterms p\"\n  \"\\<And>p1 p2 p. p1 \\<oplus> p2 \\<in> subterms p \\<Longrightarrow> p2 \\<in> subterms p\"\n  \"\\<And>l fip fmsg p q r. {l}unicast(fip, fmsg). q \\<triangleright> r \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fip fmsg p q r. {l}unicast(fip, fmsg). q \\<triangleright> r \\<in> subterms p \\<Longrightarrow> r \\<in> subterms p\"\n  \"\\<And>l fmsg p q. {l}broadcast(fmsg). q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fips fmsg p q. {l}groupcast(fips, fmsg). q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fmsg p q. {l}send(fmsg). q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fdata p q. {l}deliver(fdata). q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  \"\\<And>l fmsg p q. {l}receive(fmsg). q \\<in> subterms p \\<Longrightarrow> q \\<in> subterms p\"\n  by auto\n\nsubsection \"Actions\"\n\ntext \\<open>\n  There are two sorts of @{text \\<tau>} actions in AWN: one at the level of individual processes\n  (within nodes), and one at the network level (outside nodes). We define a class so that\n  we can ignore this distinction whenever it is not critical.\n\\<close>\n\nclass tau =\n  fixes tau :: \"'a\" (\"\\<tau>\")\n\nsubsubsection \"Sequential Actions (and related predicates)\"\n\ndatatype 'm seq_action =\n    broadcast 'm\n  | groupcast \"ip set\" 'm\n  | unicast ip 'm\n  | notunicast ip           (\"\\<not>unicast _\" [1000] 60)\n  | send 'm\n  | deliver data\n  | receive 'm\n  | seq_tau                 (\"\\<tau>\\<^sub>s\")\n\ninstantiation \"seq_action\" :: (type) tau\nbegin\ndefinition step_seq_tau [simp]: \"\\<tau> \\<equiv> \\<tau>\\<^sub>s\"\ninstance ..\nend\n\ndefinition recvmsg :: \"('m \\<Rightarrow> bool) \\<Rightarrow> 'm seq_action \\<Rightarrow> bool\"\nwhere \"recvmsg P a \\<equiv> case a of receive m \\<Rightarrow> P m\n                             | _ \\<Rightarrow> True\"\n\nlemma recvmsg_simps[simp]:\n  \"\\<And>m.     recvmsg P (broadcast m)     = True\"\n  \"\\<And>ips m. recvmsg P (groupcast ips m) = True\"\n  \"\\<And>ip m.  recvmsg P (unicast ip m)    = True\"\n  \"\\<And>ip.    recvmsg P (notunicast ip)   = True\"\n  \"\\<And>m.     recvmsg P (send m)          = True\"\n  \"\\<And>d.     recvmsg P (deliver d)       = True\"\n  \"\\<And>m.     recvmsg P (receive m)       = P m\"\n  \"        recvmsg P \\<tau>\\<^sub>s                 = True\"\n  unfolding recvmsg_def by simp_all\n\nlemma recvmsgTT [simp]: \"recvmsg TT a\"\n  by (cases a) simp_all\n\nlemma recvmsgE [elim]:\n  assumes \"recvmsg (R \\<sigma>) a\"\n      and \"\\<And>m. R \\<sigma> m \\<Longrightarrow> R \\<sigma>' m\"\n    shows \"recvmsg (R \\<sigma>') a\"\n  using assms(1) by (cases a) (auto elim!: assms(2))\n\ndefinition anycast :: \"('m \\<Rightarrow> bool) \\<Rightarrow> 'm seq_action \\<Rightarrow> bool\"\nwhere \"anycast P a \\<equiv> case a of broadcast m \\<Rightarrow> P m\n                             | groupcast _ m \\<Rightarrow> P m\n                             | unicast _ m \\<Rightarrow> P m\n                             | _ \\<Rightarrow> True\"\n\nlemma anycast_simps [simp]:\n  \"\\<And>m.     anycast P (broadcast m)     = P m\"\n  \"\\<And>ips m. anycast P (groupcast ips m) = P m\"\n  \"\\<And>ip m.  anycast P (unicast ip m)    = P m\"\n  \"\\<And>ip.    anycast P (notunicast ip)   = True\"\n  \"\\<And>m.     anycast P (send m)          = True\"\n  \"\\<And>d.     anycast P (deliver d)       = True\"\n  \"\\<And>m.     anycast P (receive m)       = True\"\n  \"        anycast P \\<tau>\\<^sub>s                 = True\"\n  unfolding anycast_def by simp_all\n\ndefinition orecvmsg :: \"((ip \\<Rightarrow> 's) \\<Rightarrow> 'm \\<Rightarrow> bool) \\<Rightarrow> (ip \\<Rightarrow> 's) \\<Rightarrow> 'm seq_action \\<Rightarrow> bool\"\nwhere \"orecvmsg P \\<sigma> a \\<equiv> (case a of receive m \\<Rightarrow> P \\<sigma> m\n                                         | _ \\<Rightarrow> True)\"\n\nlemma orecvmsg_simps [simp]:\n  \"\\<And>m.     orecvmsg P \\<sigma> (broadcast m)     = True\"\n  \"\\<And>ips m. orecvmsg P \\<sigma> (groupcast ips m) = True\"\n  \"\\<And>ip m.  orecvmsg P \\<sigma> (unicast ip m)    = True\"\n  \"\\<And>ip.    orecvmsg P \\<sigma> (notunicast ip)   = True\"\n  \"\\<And>m.     orecvmsg P \\<sigma> (send m)          = True\"\n  \"\\<And>d.     orecvmsg P \\<sigma> (deliver d)       = True\"\n  \"\\<And>m.     orecvmsg P \\<sigma> (receive m)       = P \\<sigma> m\"\n  \"         orecvmsg P \\<sigma> \\<tau>\\<^sub>s                = True\"\n  unfolding orecvmsg_def by simp_all\n\nlemma orecvmsgEI [elim]:\n  \"\\<lbrakk> orecvmsg P \\<sigma> a; \\<And>\\<sigma> a. P \\<sigma> a \\<Longrightarrow> Q \\<sigma> a \\<rbrakk> \\<Longrightarrow> orecvmsg Q \\<sigma> a\"\n  by (cases a) simp_all\n\nlemma orecvmsg_stateless_recvmsg [elim]:\n  \"orecvmsg (\\<lambda>_. P) \\<sigma> a \\<Longrightarrow> recvmsg P a\"\n  by (cases a) simp_all\n\nlemma orecvmsg_recv_weaken [elim]:\n  \"\\<lbrakk> orecvmsg P \\<sigma> a; \\<And>\\<sigma> a. P \\<sigma> a \\<Longrightarrow> Q a \\<rbrakk> \\<Longrightarrow> recvmsg Q a\"\n  by (cases a) simp_all\n\nlemma orecvmsg_recvmsg [elim]:\n  \"orecvmsg P \\<sigma> a \\<Longrightarrow> recvmsg (P \\<sigma>) a\"\n  by (cases a) simp_all\n\ndefinition sendmsg :: \"('m \\<Rightarrow> bool) \\<Rightarrow> 'm seq_action \\<Rightarrow> bool\"\nwhere \"sendmsg P a \\<equiv> case a of send m \\<Rightarrow> P m | _ \\<Rightarrow> True\"\n\nlemma sendmsg_simps [simp]:\n  \"\\<And>m.     sendmsg P (broadcast m)     = True\"\n  \"\\<And>ips m. sendmsg P (groupcast ips m) = True\"\n  \"\\<And>ip m.  sendmsg P (unicast ip m)    = True\"\n  \"\\<And>ip.    sendmsg P (notunicast ip)   = True\"\n  \"\\<And>m.     sendmsg P (send m)          = P m\"\n  \"\\<And>d.     sendmsg P (deliver d)       = True\"\n  \"\\<And>m.     sendmsg P (receive m)       = True\"\n  \"        sendmsg P \\<tau>\\<^sub>s                 = True\"\n  unfolding sendmsg_def by simp_all\n\ntype_synonym ('s, 'm, 'p, 'l) seqp_env = \"'p \\<Rightarrow> ('s, 'm, 'p, 'l) seqp\"\n\nsubsubsection \"Node Actions (and related predicates)\"\n\ndatatype 'm node_action =\n    node_cast \"ip set\" 'm             (\"_:*cast'(_')\"       [200, 200] 200)                                                 \n  | node_deliver ip data              (\"_:deliver'(_')\"     [200, 200] 200)\n  | node_arrive \"ip set\" \"ip set\" 'm  (\"_\\<not>_:arrive'(_')\"    [200, 200, 200] 200)\n  | node_connect ip ip                (\"connect'(_, _')\"    [200, 200] 200)\n  | node_disconnect ip ip             (\"disconnect'(_, _')\" [200, 200] 200)\n  | node_newpkt ip data ip            (\"_:newpkt'(_, _')\"   [200, 200, 200] 200)\n  | node_tau                          (\"\\<tau>\\<^sub>n\")\n\ninstantiation \"node_action\" :: (type) tau\nbegin\ndefinition step_node_tau [simp]: \"\\<tau> \\<equiv> \\<tau>\\<^sub>n\"\ninstance ..\nend\n\ndefinition arrivemsg :: \"ip \\<Rightarrow> ('m \\<Rightarrow> bool) \\<Rightarrow> 'm node_action \\<Rightarrow> bool\"\nwhere \"arrivemsg i P a \\<equiv> case a of node_arrive ii ni m \\<Rightarrow> ((ii = {i} \\<longrightarrow> P m))\n                                  | _ \\<Rightarrow> True\"\n\nlemma arrivemsg_simps[simp]:\n  \"\\<And>R m.       arrivemsg i P (R:*cast(m))         = True\"\n  \"\\<And>d m.       arrivemsg i P (d:deliver(m))       = True\"\n  \"\\<And>i ii ni m. arrivemsg i P (ii\\<not>ni:arrive(m))    = (ii = {i} \\<longrightarrow> P m)\"\n  \"\\<And>i1 i2.     arrivemsg i P (connect(i1, i2))    = True\"\n  \"\\<And>i1 i2.     arrivemsg i P (disconnect(i1, i2)) = True\"\n  \"\\<And>i i' d di. arrivemsg i P (i':newpkt(d, di))   = True\"\n  \"             arrivemsg i P \\<tau>\\<^sub>n                   = True\"\n  unfolding arrivemsg_def by simp_all\n\nlemma arrivemsgTT [simp]: \"arrivemsg i TT = TT\"\n  by (rule ext) (clarsimp simp: arrivemsg_def split: node_action.split)\n\ndefinition oarrivemsg :: \"((ip \\<Rightarrow> 's) \\<Rightarrow> 'm \\<Rightarrow> bool) \\<Rightarrow> (ip \\<Rightarrow> 's) \\<Rightarrow> 'm node_action \\<Rightarrow> bool\"\nwhere \"oarrivemsg P \\<sigma> a \\<equiv> case a of node_arrive ii ni m \\<Rightarrow> P \\<sigma> m | _ \\<Rightarrow> True\"\n\nlemma oarrivemsg_simps[simp]:\n  \"\\<And>R m.       oarrivemsg P \\<sigma> (R:*cast(m))         = True\"\n  \"\\<And>d m.       oarrivemsg P \\<sigma> (d:deliver(m))       = True\"\n  \"\\<And>i ii ni m. oarrivemsg P \\<sigma> (ii\\<not>ni:arrive(m))    = P \\<sigma> m\"\n  \"\\<And>i1 i2.     oarrivemsg P \\<sigma> (connect(i1, i2))    = True\"\n  \"\\<And>i1 i2.     oarrivemsg P \\<sigma> (disconnect(i1, i2)) = True\"\n  \"\\<And>i i' d di. oarrivemsg P \\<sigma> (i':newpkt(d, di))   = True\"\n  \"             oarrivemsg P \\<sigma> \\<tau>\\<^sub>n                   = True\"\n  unfolding oarrivemsg_def by simp_all\n\nlemma oarrivemsg_True [simp, intro]: \"oarrivemsg (\\<lambda>_ _. True) \\<sigma> a\"\n  by (cases a) auto\n\ndefinition castmsg :: \"('m \\<Rightarrow> bool) \\<Rightarrow> 'm node_action \\<Rightarrow> bool\"\nwhere \"castmsg P a \\<equiv> case a of _:*cast(m) \\<Rightarrow> P m\n                              | _ \\<Rightarrow> True\"\n\nlemma castmsg_simps[simp]:\n  \"\\<And>R m.       castmsg P (R:*cast(m))         = P m\"\n  \"\\<And>d m.       castmsg P (d:deliver(m))       = True\"\n  \"\\<And>i ii ni m. castmsg P (ii\\<not>ni:arrive(m))    = True\"\n  \"\\<And>i1 i2.     castmsg P (connect(i1, i2))    = True\"\n  \"\\<And>i1 i2.     castmsg P (disconnect(i1, i2)) = True\"\n  \"\\<And>i i' d di. castmsg P (i':newpkt(d, di))   = True\"\n  \"             castmsg P \\<tau>\\<^sub>n                   = True\"\n  unfolding castmsg_def by simp_all\n\nsubsection \"Networks\"\n\ndatatype net_tree =\n    Node ip \"ip set\"          (\"\\<langle>_; _\\<rangle>\")\n  | Subnet net_tree net_tree  (infixl \"\\<parallel>\" 90)\n\ndeclare net_tree.induct [[induct del]]\nlemmas net_tree_induct [induct type: net_tree] = net_tree.induct [rename_abs i R p1 p2]\n\ndatatype 's net_state =\n    NodeS ip 's \"ip set\"\n  | SubnetS \"'s net_state\" \"'s net_state\"\n\nfun net_ips :: \"'s net_state \\<Rightarrow> ip set\"\nwhere\n    \"net_ips (NodeS i s R) = {i}\"\n  | \"net_ips (SubnetS n1 n2) = net_ips n1 \\<union> net_ips n2\"\n\nfun net_tree_ips :: \"net_tree \\<Rightarrow> ip set\"\nwhere\n    \"net_tree_ips (p1 \\<parallel> p2) = net_tree_ips p1 \\<union> net_tree_ips p2\"\n  | \"net_tree_ips (\\<langle>i; R\\<rangle>) = {i}\"\n\nlemma net_tree_ips_commute:\n  \"net_tree_ips (p1 \\<parallel> p2) = net_tree_ips (p2 \\<parallel> p1)\"\n  by simp (rule Un_commute)\n\nfun wf_net_tree :: \"net_tree \\<Rightarrow> bool\"\nwhere\n   \"wf_net_tree (p1 \\<parallel> p2) = (net_tree_ips p1 \\<inter> net_tree_ips p2 = {}\n                             \\<and> wf_net_tree p1 \\<and> wf_net_tree p2)\"\n | \"wf_net_tree (\\<langle>i; R\\<rangle>) = True\"\n\nlemma wf_net_tree_children [elim]:\n  assumes \"wf_net_tree (p1 \\<parallel> p2)\"\n  obtains \"wf_net_tree p1\"\n      and \"wf_net_tree p2\"\n  using assms by simp\n\nfun netmap :: \"'s net_state \\<Rightarrow> ip \\<Rightarrow> 's option\"\nwhere\n    \"netmap (NodeS i p R\\<^sub>i) = [i \\<mapsto> p]\"\n  | \"netmap (SubnetS s t) = netmap s ++ netmap t\"\n\nlemma not_in_netmap [simp]:\n  assumes \"i \\<notin> net_ips ns\"\n    shows \"netmap ns i = None\"\n  using assms by (induction ns) simp_all\n\nlemma netmap_none_not_in_net_ips:\n  assumes \"netmap ns i = None\"\n    shows \"i\\<notin>net_ips ns\"\n  using assms by (induction ns) auto\n\nlemma net_ips_is_dom_netmap: \"net_ips s = dom(netmap s)\"\n  proof (induction s)\n    fix i R\\<^sub>i and p :: 's\n    show \"net_ips (NodeS i p R\\<^sub>i) = dom (netmap (NodeS i p R\\<^sub>i))\"\n      by auto\n  next\n    fix s1 s2 :: \"'s net_state\"\n    assume \"net_ips s1 = dom (netmap s1)\"\n       and \"net_ips s2 = dom (netmap s2)\"\n    thus \"net_ips (SubnetS s1 s2) = dom (netmap (SubnetS s1 s2))\"\n      by auto\n  qed\n\nlemma in_netmap [simp]:\n  assumes \"i \\<in> net_ips ns\"\n    shows \"netmap ns i \\<noteq> None\"\n  using assms by (auto simp add: net_ips_is_dom_netmap)\n\nlemma netmap_subnets_same:\n  assumes \"netmap s1 i = x\"\n      and \"netmap s2 i = x\"\n    shows \"netmap (SubnetS s1 s2) i = x\"\n  using assms by simp (metis map_add_dom_app_simps(1) map_add_dom_app_simps(3))\n\nlemma netmap_subnets_samef:\n  assumes \"netmap s1 = f\"\n      and \"netmap s2 = f\"\n    shows \"netmap (SubnetS s1 s2) = f\"\n  using assms by simp (metis map_add_le_mapI map_le_antisym map_le_map_add map_le_refl)\n\nlemma netmap_add_disjoint [elim]:\n  assumes \"\\<forall>i\\<in>net_ips s1 \\<union> net_ips s2. the ((netmap s1 ++ netmap s2) i) = \\<sigma> i\"\n      and \"net_ips s1 \\<inter> net_ips s2 = {}\"\n    shows \"\\<forall>i\\<in>net_ips s1. the (netmap s1 i) = \\<sigma> i\"\n  proof\n    fix i\n    assume \"i \\<in> net_ips s1\"\n    hence \"i \\<in> dom(netmap s1)\" by (simp add: net_ips_is_dom_netmap)\n    moreover with assms(2) have \"i \\<notin> dom(netmap s2)\" by (auto simp add: net_ips_is_dom_netmap)\n    ultimately have \"the (netmap s1 i) = the ((netmap s1 ++ netmap s2) i)\"\n      by (simp add: map_add_dom_app_simps)\n    with assms(1) and \\<open>i\\<in>net_ips s1\\<close> show \"the (netmap s1 i) = \\<sigma> i\" by simp\n  qed\n\nlemma netmap_add_disjoint2 [elim]:\n  assumes \"\\<forall>i\\<in>net_ips s1 \\<union> net_ips s2. the ((netmap s1 ++ netmap s2) i) = \\<sigma> i\"\n    shows \"\\<forall>i\\<in>net_ips s2. the (netmap s2 i) = \\<sigma> i\"\n  using assms by (simp add: net_ips_is_dom_netmap)\n                 (metis Un_iff map_add_dom_app_simps(1))\n\nlemma net_ips_netmap_subnet [elim]:\n  assumes \"net_ips s1 \\<inter> net_ips s2 = {}\"\n      and \"\\<forall>i\\<in>net_ips (SubnetS s1 s2). the (netmap (SubnetS s1 s2) i) = \\<sigma> i\"\n    shows \"\\<forall>i\\<in>net_ips s1. the (netmap s1 i) = \\<sigma> i\"\n      and \"\\<forall>i\\<in>net_ips s2. the (netmap s2 i) = \\<sigma> i\"\n  proof -\n    from assms(2) have \"\\<forall>i\\<in>net_ips s1 \\<union> net_ips s2. the ((netmap s1 ++ netmap s2) i) = \\<sigma> i\" by auto\n    with assms(1) show \"\\<forall>i\\<in>net_ips s1. the (netmap s1 i) = \\<sigma> i\"\n      by - (erule(1) netmap_add_disjoint)\n  next\n    from assms(2) have \"\\<forall>i\\<in>net_ips s1 \\<union> net_ips s2. the ((netmap s1 ++ netmap s2) i) = \\<sigma> i\" by auto\n    thus \"\\<forall>i\\<in>net_ips s2. the (netmap s2 i) = \\<sigma> i\"\n      by - (erule netmap_add_disjoint2)\n  qed\n\nfun inoclosed :: \"'s \\<Rightarrow> 'm::msg node_action \\<Rightarrow> bool\"\nwhere\n    \"inoclosed _ (node_arrive ii ni m) = eq_newpkt m\"\n  | \"inoclosed _ (node_newpkt i d di)  = False\"\n  | \"inoclosed _ _ = True\"\n\nlemma inclosed_simps [simp]:\n  \"\\<And>\\<sigma> ii ni. inoclosed \\<sigma> (ii\\<not>ni:arrive(m))   = eq_newpkt m\"\n  \"\\<And>\\<sigma> d di.  inoclosed \\<sigma> (i:newpkt(d, di))   = False\"\n  \"\\<And>\\<sigma> R m.   inoclosed \\<sigma> (R:*cast(m))        = True\"\n  \"\\<And>\\<sigma> i d.   inoclosed \\<sigma> (i:deliver(d))      = True\"\n  \"\\<And>\\<sigma> i i'.  inoclosed \\<sigma> (connect(i, i'))    = True\"\n  \"\\<And>\\<sigma> i i'.  inoclosed \\<sigma> (disconnect(i, i')) = True\"\n  \"\\<And>\\<sigma>.       inoclosed \\<sigma> (\\<tau>)                 = True\"\n  by auto\n\ndefinition\n  netmask :: \"ip set \\<Rightarrow> ((ip \\<Rightarrow> 's) \\<times> 'l) \\<Rightarrow> ((ip \\<Rightarrow> 's option) \\<times> 'l)\"\nwhere\n  \"netmask I s \\<equiv> (\\<lambda>i. if i\\<in>I then Some (fst s i) else None, snd s)\"\n\nlemma netmask_def' [simp]:\n  \"netmask I (\\<sigma>, \\<zeta>) = (\\<lambda>i. if i\\<in>I then Some (\\<sigma> i) else None, \\<zeta>)\"\n  unfolding netmask_def by auto\n\nfun netgmap :: \"('s \\<Rightarrow> 'g \\<times> 'l) \\<Rightarrow> 's net_state \\<Rightarrow> (nat \\<Rightarrow> 'g option) \\<times> 'l net_state\"\n  where\n    \"netgmap sr (NodeS i s R) = ([i \\<mapsto> fst (sr s)], NodeS i (snd (sr s)) R)\"\n  | \"netgmap sr (SubnetS s\\<^sub>1 s\\<^sub>2) = (let (\\<sigma>\\<^sub>1, ss) = netgmap sr s\\<^sub>1 in\n                                   let (\\<sigma>\\<^sub>2, tt) = netgmap sr s\\<^sub>2 in\n                                   (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2, SubnetS ss tt))\"\n\nlemma dom_fst_netgmap [simp, intro]: \"dom (fst (netgmap sr n)) = net_ips n\"\n  using assms proof (induction n)\n    fix i s R\n    show \"dom (fst (netgmap sr (NodeS i s R))) = net_ips (NodeS i s R)\"\n      by simp\n  next\n    fix n1 n2\n    assume a1: \"dom (fst (netgmap sr n1)) = net_ips n1\"\n       and a2: \"dom (fst (netgmap sr n2)) = net_ips n2\"\n    obtain \\<sigma>\\<^sub>1 \\<zeta>\\<^sub>1 \\<sigma>\\<^sub>2 \\<zeta>\\<^sub>2 where nm1: \"netgmap sr n1 = (\\<sigma>\\<^sub>1, \\<zeta>\\<^sub>1)\"\n                        and nm2: \"netgmap sr n2 = (\\<sigma>\\<^sub>2, \\<zeta>\\<^sub>2)\"\n      by (metis surj_pair)\n    hence \"netgmap sr (SubnetS n1 n2) = (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2, SubnetS \\<zeta>\\<^sub>1 \\<zeta>\\<^sub>2)\" by simp\n    hence \"dom (fst (netgmap sr (SubnetS n1 n2))) = dom (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2)\" by simp\n    also from a1 a2 nm1 nm2 have \"dom (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2) = net_ips (SubnetS n1 n2)\" by auto\n    finally show \"dom (fst (netgmap sr (SubnetS n1 n2))) = net_ips (SubnetS n1 n2)\" .\n  qed\n\nlemma netgmap_pair_dom [elim]:\n  obtains \\<sigma> \\<zeta> where \"netgmap sr n = (\\<sigma>, \\<zeta>)\"\n                and \"dom \\<sigma> = net_ips n\"\n    by (metis dom_fst_netgmap surjective_pairing)\n\nlemma net_ips_netgmap [simp]:\n  \"net_ips (snd (netgmap sr s)) = net_ips s\"\n  proof (induction s)\n    fix s1 s2\n    assume \"net_ips (snd (netgmap sr s1)) = net_ips s1\"\n       and \"net_ips (snd (netgmap sr s2)) = net_ips s2\"\n    thus \"net_ips (snd (netgmap sr (SubnetS s1 s2))) = net_ips (SubnetS s1 s2)\"\n      by (cases \"netgmap sr s1\", cases \"netgmap sr s2\") auto\n  qed simp\n\nlemma some_the_fst_netgmap:\n  assumes \"i \\<in> net_ips s\"\n    shows \"Some (the (fst (netgmap sr s) i)) = fst (netgmap sr s) i\"\n  using assms by (metis domIff dom_fst_netgmap option.collapse)\n\n\nlemma fst_netgmap_none [simp]:\n  assumes \"i \\<notin> net_ips s\"\n    shows \"fst (netgmap sr s) i = None\"\n  using assms by (metis domIff dom_fst_netgmap)\n\nlemma fst_netgmap_subnet [simp]:\n  \"fst (case netgmap sr s1 of (\\<sigma>\\<^sub>1, ss) \\<Rightarrow>\n        case netgmap sr s2 of (\\<sigma>\\<^sub>2, tt) \\<Rightarrow>\n        (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2, SubnetS ss tt)) = (fst (netgmap sr s1) ++ fst (netgmap sr s2))\"\n  by (metis (mono_tags) fst_conv netgmap_pair_dom split_conv)\n\nlemma snd_netgmap_subnet [simp]:\n  \"snd (case netgmap sr s1 of (\\<sigma>\\<^sub>1, ss) \\<Rightarrow>\n        case netgmap sr s2 of (\\<sigma>\\<^sub>2, tt) \\<Rightarrow>\n        (\\<sigma>\\<^sub>1 ++ \\<sigma>\\<^sub>2, SubnetS ss tt)) = (SubnetS (snd (netgmap sr s1)) (snd (netgmap sr s2)))\"\n  by (metis (lifting, no_types) Pair_inject split_beta' surjective_pairing)\n\nlemma fst_netgmap_not_none [simp]:\n  assumes \"i \\<in> net_ips s\"\n    shows \"fst (netgmap sr s) i \\<noteq> None\"\n  using assms by (induction s) auto\n\nlemma netgmap_netgmap_not_rhs [simp]:\n  assumes \"i \\<notin> net_ips s2\"\n    shows \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i = (fst (netgmap sr s1)) i\"\n  proof -\n    from assms(1) have \"i \\<notin> dom (fst (netgmap sr s2))\" by simp\n    thus ?thesis by (simp add: map_add_dom_app_simps)\n  qed\n\nlemma netgmap_netgmap_rhs [simp]:\n  assumes \"i \\<in> net_ips s2\"\n    shows \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i = (fst (netgmap sr s2)) i\"\n  using assms by (simp add: map_add_dom_app_simps)\n\nlemma netgmap_netmask_subnets [elim]:\n  assumes \"netgmap sr s1 = netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1))\"\n      and \"netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\"\n    shows \"fst (netgmap sr (SubnetS s1 s2))\n            = fst (netmask (net_tree_ips (n1 \\<parallel> n2)) (\\<sigma>, snd (netgmap sr (SubnetS s1 s2))))\"\n  proof (rule ext)\n    fix i\n    have \"i \\<in> net_tree_ips n1 \\<or> i \\<in> net_tree_ips n2 \\<or> (i\\<notin>net_tree_ips n1 \\<union> net_tree_ips n2)\"\n      by auto\n    thus \"fst (netgmap sr (SubnetS s1 s2)) i\n            = fst (netmask (net_tree_ips (n1 \\<parallel> n2)) (\\<sigma>, snd (netgmap sr (SubnetS s1 s2)))) i\"\n    proof (elim disjE)\n      assume \"i \\<in> net_tree_ips n1\"\n      with \\<open>netgmap sr s1 = netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1))\\<close>\n           \\<open>netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\\<close>\n        show ?thesis\n          by (cases \"netgmap sr s1\", cases \"netgmap sr s2\", clarsimp)\n             (metis (lifting, mono_tags) map_add_Some_iff)\n    next\n      assume \"i \\<in> net_tree_ips n2\"\n      with \\<open>netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\\<close>\n        show ?thesis\n          by simp (metis (lifting, mono_tags) fst_conv map_add_find_right)\n    next\n      assume \"i\\<notin>net_tree_ips n1 \\<union> net_tree_ips n2\"\n      with \\<open>netgmap sr s1 = netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1))\\<close>\n           \\<open>netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\\<close>\n        show ?thesis\n          by simp (metis (lifting, mono_tags) fst_conv)\n    qed\n  qed\n\nlemma netgmap_netmask_subnets' [elim]:\n  assumes \"netgmap sr s1 = netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1))\"\n      and \"netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\"\n      and \"s = SubnetS s1 s2\"\n    shows \"netgmap sr s = netmask (net_tree_ips (n1 \\<parallel> n2)) (\\<sigma>, snd (netgmap sr s))\"\n  by (simp only: assms(3))\n     (rule prod_eqI [OF netgmap_netmask_subnets [OF assms(1-2)]], simp)\n\nlemma netgmap_subnet_split1:\n  assumes \"netgmap sr (SubnetS s1 s2) = netmask (net_tree_ips (n1 \\<parallel> n2)) (\\<sigma>, \\<zeta>)\"\n      and \"net_tree_ips n1 \\<inter> net_tree_ips n2 = {}\"\n      and \"net_ips s1 = net_tree_ips n1\"\n      and \"net_ips s2 = net_tree_ips n2\"\n    shows \"netgmap sr s1 = netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1))\"\n  proof (rule prod_eqI)\n    show \"fst (netgmap sr s1) = fst (netmask (net_tree_ips n1) (\\<sigma>, snd (netgmap sr s1)))\"\n    proof (rule ext, simp, intro conjI impI)\n      fix i\n      assume \"i\\<in>net_tree_ips n1\"\n      with \\<open>net_tree_ips n1 \\<inter> net_tree_ips n2 = {}\\<close> have \"i\\<notin>net_tree_ips n2\"\n        by auto\n      from assms(1) [simplified prod_eq_iff]\n        have \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i =\n                 (if i \\<in> net_tree_ips n1 \\<or> i \\<in> net_tree_ips n2 then Some (\\<sigma> i) else None)\"\n          by simp\n      also from \\<open>i\\<notin>net_tree_ips n2\\<close> and \\<open>net_ips s2 = net_tree_ips n2\\<close>\n        have \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i = fst (netgmap sr s1) i\"\n          by (metis dom_fst_netgmap map_add_dom_app_simps(3))\n      finally show \"fst (netgmap sr s1) i = Some (\\<sigma> i)\"\n        using \\<open>i\\<in>net_tree_ips n1\\<close> by simp\n    next\n      fix i\n      assume \"i \\<notin> net_tree_ips n1\"\n      with \\<open>net_ips s1 = net_tree_ips n1\\<close> have \"i \\<notin> net_ips s1\" by simp\n      thus \"fst (netgmap sr s1) i = None\" by simp\n    qed\n  qed simp\n\nlemma netgmap_subnet_split2:\n  assumes \"netgmap sr (SubnetS s1 s2) = netmask (net_tree_ips (n1 \\<parallel> n2)) (\\<sigma>, \\<zeta>)\"\n      and \"net_ips s1 = net_tree_ips n1\"\n      and \"net_ips s2 = net_tree_ips n2\"\n    shows \"netgmap sr s2 = netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2))\"\n  proof (rule prod_eqI)\n    show \"fst (netgmap sr s2) = fst (netmask (net_tree_ips n2) (\\<sigma>, snd (netgmap sr s2)))\"\n    proof (rule ext, simp, intro conjI impI)\n      fix i\n      assume \"i\\<in>net_tree_ips n2\"\n      from assms(1) [simplified prod_eq_iff]\n        have \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i =\n                 (if i \\<in> net_tree_ips n1 \\<or> i \\<in> net_tree_ips n2 then Some (\\<sigma> i) else None)\"\n          by simp\n      also from \\<open>i\\<in>net_tree_ips n2\\<close> and \\<open>net_ips s2 = net_tree_ips n2\\<close>\n        have \"(fst (netgmap sr s1) ++ fst (netgmap sr s2)) i = fst (netgmap sr s2) i\"\n          by (metis dom_fst_netgmap map_add_dom_app_simps(1))\n      finally show \"fst (netgmap sr s2) i = Some (\\<sigma> i)\"\n        using \\<open>i\\<in>net_tree_ips n2\\<close> by simp\n    next\n      fix i\n      assume \"i \\<notin> net_tree_ips n2\"\n      with \\<open>net_ips s2 = net_tree_ips n2\\<close> have \"i \\<notin> net_ips s2\" by simp\n      thus \"fst (netgmap sr s2) i = None\" by simp\n    qed\n  qed simp\n\nlemma netmap_fst_netgmap_rel:\n  shows \"(\\<lambda>i. map_option (fst o sr) (netmap s i)) = fst (netgmap sr s)\"\n  proof (induction s)\n    fix ii s R\n    show \"(\\<lambda>i. map_option (fst \\<circ> sr) (netmap (NodeS ii s R) i)) = fst (netgmap sr (NodeS ii s R))\"\n      by auto\n  next\n    fix s1 s2\n    assume a1: \"(\\<lambda>i. map_option (fst \\<circ> sr) (netmap s1 i)) = fst (netgmap sr s1)\"\n       and a2: \"(\\<lambda>i. map_option (fst \\<circ> sr) (netmap s2 i)) = fst (netgmap sr s2)\"\n    show \"(\\<lambda>i. map_option (fst \\<circ> sr) (netmap (SubnetS s1 s2) i)) = fst (netgmap sr (SubnetS s1 s2))\"\n    proof (rule ext)\n      fix i\n      from a1 a2 have \"map_option (fst \\<circ> sr) ((netmap s1 ++ netmap s2) i)\n                                    = (fst (netgmap sr s1) ++ fst (netgmap sr s2)) i\"\n        by (metis fst_conv map_add_dom_app_simps(1) map_add_dom_app_simps(3)\n                  net_ips_is_dom_netmap netgmap_pair_dom)\n      thus \"map_option (fst \\<circ> sr) (netmap (SubnetS s1 s2) i) = fst (netgmap sr (SubnetS s1 s2)) i\"\n        by simp\n    qed\n  qed\n\nlemma netmap_is_fst_netgmap:\n  assumes \"netmap s' = netmap s\"\n    shows \"fst (netgmap sr s') = fst (netgmap sr s)\"\n  using assms by (metis netmap_fst_netgmap_rel)\n\nlemma netmap_is_fst_netgmap':\n  assumes \"netmap s' i = netmap s i\"\n    shows \"fst (netgmap sr s') i = fst (netgmap sr s) i\"\n  using assms by (metis netmap_fst_netgmap_rel)\n\nlemma fst_netgmap_pair_fst [simp]:\n  \"fst (netgmap (\\<lambda>(p, q). (fst p, snd p, q)) s) = fst (netgmap fst s)\"\n  by (induction s) auto\n\ntext \\<open>Introduce streamlined alternatives to netgmap to simplify certain property\n        statements and thus make them easier to understand and to present.\\<close>\n\nfun netlift :: \"('s \\<Rightarrow> 'g \\<times> 'l) \\<Rightarrow> 's net_state \\<Rightarrow> (nat \\<Rightarrow> 'g option)\"\n  where\n    \"netlift sr (NodeS i s R) = [i \\<mapsto> fst (sr s)]\"\n  | \"netlift sr (SubnetS s t) = (netlift sr s) ++ (netlift sr t)\"\n\nlemma fst_netgmap_netlift:\n  \"fst (netgmap sr s) = netlift sr s\"\n  by (induction s) simp_all\n\nfun netliftl :: \"('s \\<Rightarrow> 'g \\<times> 'l) \\<Rightarrow> 's net_state \\<Rightarrow> 'l net_state\"\n  where\n    \"netliftl sr (NodeS i s R) = NodeS i (snd (sr s)) R\"\n  | \"netliftl sr (SubnetS s t) = SubnetS (netliftl sr s) (netliftl sr t)\"\n\nlemma snd_netgmap_netliftl:\n  \"snd (netgmap sr s) = netliftl sr s\"\n  by (induction s) simp_all\n \nlemma netgmap_netlift_netliftl: \"netgmap sr s = (netlift sr s, netliftl sr s)\"\n  by rule (simp_all add: fst_netgmap_netlift snd_netgmap_netliftl)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/AWN/AWN.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.577495350642608, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.3022728179424587}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2005         |\n            |               Februaru 2006               |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory FNF_F_sf_hide\nimports FNF_F_sf_induct FNF_F_sf_ext\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*  The following simplification rules are deleted in this theory file *)\n(*       P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y))        *)\n(* Isabelle 2017: split_if --> if_split *)\n\ndeclare if_split  [split del]\n\n(*****************************************************************\n\n         1. full sequentialization for Hiding (P -- X)\n         2.\n         3.\n\n *****************************************************************)\n\n(*============================================================*\n |                                                            |\n |                     Hiding P -- X                          |\n |                                                            |\n *============================================================*)\n\ndefinition\n  Pfun_Hiding :: \"'a set => (('p,'a) proc => ('p,'a) proc)\"\n  where\n  Pfun_Hiding_def :\n    \"Pfun_Hiding X == (%P1. P1 -- X)\"\n  \ndefinition\n  SP_step_Hiding :: \n   \"'a set => ('a set => ('a => ('p,'a) proc) => ('p,'a) proc =>\n    ('a => ('p,'a) proc) => ('p,'a) proc)\"\n  where\n  SP_step_Hiding_def :\n    \"SP_step_Hiding X == (%A1 Pf1 Q1 SPf.\n     (if (Q1 = STOP) \n      then if (A1 Int X = {}) \n           then ((? :A1 -> SPf) [+] Q1)\n           else (((? :(A1-X) -> SPf) [+] Q1)\n                 [>seq\n                (! :(A1 Int X) ..seq SPf))\n      else (((? :(A1-X) -> SPf) [+] Q1) |~|seq\n            (! :(A1 Int X) ..seq SPf))))\"\n\ndefinition\n  fsfF_Hiding :: \"('p,'a) proc => 'a set => ('p,'a) proc\"\n                          (\"(1_ /--seq _)\" [84,85] 84)\n  where\n  fsfF_Hiding_def :\n    \"P1 --seq X == \n       (fsfF_induct1 (Pfun_Hiding X) (SP_step_Hiding X) P1)\"\n\n(*------------------------------------------------------------*\n |                        in fsfF_proc                        |\n *------------------------------------------------------------*)\n\nlemma fsfF_Hiding_in:\n    \"P1 : fsfF_proc ==> P1 --seq X : fsfF_proc\"\napply (simp add: fsfF_Hiding_def)\napply (rule fsfF_induct1_in)\napply (simp_all add: SP_step_Hiding_def)\napply (simp split: if_split)\napply (intro conjI impI)\napply (simp_all add: fsfF_proc.intros)\napply (rule fsfF_Int_choice_in)\napply (simp_all add: fsfF_proc.intros)\napply (simp add: fsfF_Rep_int_choice_com_in)\napply (rule fsfF_Timeout_in)\napply (simp_all add: fsfF_proc.intros)\napply (simp add: fsfF_Rep_int_choice_com_in)\napply (rule fsfF_Int_choice_in)\napply (simp add: fsfF_proc.intros)\napply (simp add: fsfF_Rep_int_choice_com_in)\ndone\n\n(*------------------------------------------------------------*\n |             syntactical transformation to fsfF             |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Hiding_eqF: \"P1 -- X =F P1 --seq X\"\napply (simp add: fsfF_Hiding_def)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_induct1_eqF[THEN cspF_sym])\napply (simp_all add: Pfun_Hiding_def\n                     SP_step_Hiding_def)\n\napply (case_tac \"Q1 = STOP\")\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_unit)\n\napply (rule cspF_rw_left)\napply (rule cspF_step)\napply (simp)\n\napply (simp split: if_split)\napply (intro conjI impI)\napply (rule cspF_rw_left)\napply (rule cspF_IF)\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left)\napply (rule cspF_IF)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (simp)\napply (simp)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Rep_int_choice_com_eqF[THEN cspF_sym])\napply (simp)\n\n(* Q1 ~= STOP *)\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_or_DIV)\napply (simp)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Rep_int_choice_com_eqF[THEN cspF_sym])\napply (rule cspF_reflex)\n\n(* congruence *)\napply (simp split: if_split)\napply (intro conjI impI)\napply (rule cspF_rw_left,\n     (simp\n     | rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Rep_int_choice_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Rep_int_choice_com_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Timeout_eqF[THEN cspF_sym]\n     | rule cspF_decompo \n     | rule cspF_reflex)+ ,\n       rule cspF_rw_right,\n     (simp\n     | rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Rep_int_choice_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Rep_int_choice_com_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Timeout_eqF[THEN cspF_sym]\n     | rule cspF_decompo \n     | rule cspF_reflex)+)+\ndone\n\n(****************** to add them again ******************)\n\ndeclare if_split    [split]\ndeclare disj_not1   [simp]\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/FNF_F/FNF_F_sf_hide.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.672331699179286, "lm_q2_score": 0.44939263446475963, "lm_q1q2_score": 0.3021409135283476}}
{"text": "theory SM_Datastructures\nimports Main \n  CAVA_Base.CAVA_Base\n  \"../Lib/SOS_Misc_Add\"\n  DFS_Framework.Feedback_Arcs (* TODO: Only for oo-symbol !?*)\n\nbegin\n\n  lemma [code_unfold]: \"{(a,b). (a,b)\\<in>X \\<and> P a b} = Set.filter (\\<lambda>(a,b). P a b) X\"\n    by auto\n\n  lemma in_dom_map_code[code_unfold]: \n    \"x\\<in>dom m = (case m x of None \\<Rightarrow> False | _ \\<Rightarrow> True)\"\n    by (auto split: option.splits)\n\n  (* TODO: Move to gen_set. Generic algorithm for set_of_list *)\n  lemma set_by_fold: \"set l = fold insert l {}\"\n  proof -\n    {\n      fix s\n      have \"fold insert l s = s \\<union> set l\"\n        by (induction l arbitrary: s) auto\n    } from this[of \"{}\"] show ?thesis by simp\n  qed\n\n  context\n  begin\n\n    interpretation autoref_syn .\n\n    lemma [autoref_itype]: \"set ::\\<^sub>i \\<langle>I\\<rangle>\\<^sub>ii_list \\<rightarrow>\\<^sub>i \\<langle>I\\<rangle>\\<^sub>ii_set\" by simp\n\n  end\n\n  lemma gen_set[autoref_rules_raw]:\n    fixes R :: \"('c\\<times>'a)set\" and Rs :: \"('c\\<times>'a) set \\<Rightarrow> (_\\<times>'a set) set\"\n    assumes [simplified,param]:\n      \"GEN_OP em {} (\\<langle>R\\<rangle>Rs)\"\n      \"GEN_OP ins insert (R \\<rightarrow> \\<langle>R\\<rangle>Rs \\<rightarrow> \\<langle>R\\<rangle>Rs)\"\n    shows \"(\\<lambda>li. fold ins li em,set)\\<in>\\<langle>R\\<rangle>list_rel \\<rightarrow> \\<langle>R\\<rangle>Rs\"\n      unfolding set_by_fold[abs_def]\n      by parametricity\n\n  schematic_goal\n    shows \"(?c,set [1,2,3::nat])\\<in>\\<langle>nat_rel\\<rangle>dflt_ahs_rel\"\n      using [[autoref_trace_failed_id]]\n      by (autoref (trace, keep_goal))\n\n  (* TODO: Possibly, we can drop the\n    find_min_idx_f - stuff, and formalize our ample-set \n    using the abstract LEAST, which is then implemented\n    by collecti_index.\n  *)\n\n  text \\<open>Find minimum index and result where function returns non-none value\\<close>\n  primrec find_min_idx_f :: \"('a \\<rightharpoonup> 'b) \\<Rightarrow> 'a list \\<rightharpoonup> (nat \\<times> 'b)\" where\n    \"find_min_idx_f f [] = None\"\n  | \"find_min_idx_f f (x#xs) = (\n      case f x of \n        Some r \\<Rightarrow> Some (0,r) \n      | None \\<Rightarrow> map_option (map_prod Suc id) (find_min_idx_f f xs)\n    )\"\n  \n  lemma find_min_idx_f_None_conv: \n    \"find_min_idx_f f l = None \\<longleftrightarrow> (\\<forall>a\\<in>set l. f a = None)\"\n    apply (induction l)\n    apply (auto split: option.splits)\n    done\n\n  lemma find_min_idx_f_SomeD:\n    \"find_min_idx_f f l = Some (i,r) \\<Longrightarrow> f (l!i) = Some r \\<and> i < length l\"\n    by (induction l arbitrary: i) (auto split: if_split_asm option.splits)\n\n  lemma find_min_idx_f_SomeD_complete: \n    \"find_min_idx_f f l = Some (i,r) \n      \\<Longrightarrow> (f (l!i) = Some r \\<and> i < length l \\<and> (\\<forall>j<i. f (l!j) = None))\"\n    apply (induction l arbitrary: i) \n    apply (auto split: if_split_asm option.splits)\n    apply (case_tac j)\n    apply auto\n    done\n\n  lemma find_min_idx_f_LEAST_eq: \"find_min_idx_f f l = (\n    if \\<exists>i<length l. f (l!i) \\<noteq> None then\n      let i = LEAST i. i<length l \\<and> f (l!i) \\<noteq> None in Some (i,the (f (l!i)))\n    else\n      None\n  )\"\n  proof (cases \"find_min_idx_f f l\")\n    case None\n    show ?thesis using None by (auto simp: find_min_idx_f_None_conv)\n  next\n    case (Some a)\n    obtain i r where 1: \"a = (i, r)\" by force\n    have 2: \"f (l ! i) = Some r\" \"i < length l\" \"\\<forall> j < i. f (l ! j) = None\"\n      using find_min_idx_f_SomeD_complete[OF Some[unfolded 1]] by auto\n    have 3: \"(LEAST i. i < length l \\<and> (\\<exists> y. f (l ! i) = Some y)) = i\"\n      using 2 linorder_neqE_nat by (force intro!: Least_equality)\n    show ?thesis unfolding Some 1 using 2 3 by auto\n  qed  \n\n  primrec collect_indexr' :: \"nat \\<Rightarrow> (nat\\<times>'b) set \\<Rightarrow> (nat \\<Rightarrow> 'a \\<Rightarrow> 'b set) \\<Rightarrow> 'a list \\<Rightarrow> (nat\\<times>'b) set\" where\n    \"collect_indexr' i a c [] = a\"\n  | \"collect_indexr' i a c (x#xs) = (collect_indexr' (Suc i) (a\\<union>({i} \\<times> c i x)) c xs)\"  \n\n  abbreviation \"collect_indexr \\<equiv> collect_indexr' 0 {}\"\n\n  lemma collect_indexr'_collect: \"collect_indexr' i0 a f l \n    = a \\<union> {(i0+i,x) | i x. i<length l \\<and> x\\<in>f (i0+i) (l!i)}\"\n    apply (induction l arbitrary: i0 a)\n    apply simp\n    apply simp\n    apply auto\n    apply (case_tac i, auto)\n    apply (case_tac i, auto)\n    done\n\n  lemma collect_indexr_collect: \"collect_indexr f l \n    = {(i,x) | i x. i<length l \\<and> x\\<in>f i (l!i)}\"  \n    by (simp add: collect_indexr'_collect)\n  \n\n  primrec collecti_index' :: \"nat \\<Rightarrow> (nat\\<times>'b) set \\<Rightarrow> (nat \\<Rightarrow> 'a \\<Rightarrow> (bool \\<times> 'b set)) \\<Rightarrow> 'a list \\<Rightarrow> (nat\\<times>'b) set\" where\n    \"collecti_index' i a c [] = a\"\n  | \"collecti_index' i a c (x#xs) = (case c i x of\n      (False,s) \\<Rightarrow> collecti_index' (Suc i) (a \\<union> {i}\\<times>s) c xs\n    | (True,s) \\<Rightarrow> {i}\\<times>s)\"\n\n  abbreviation \"collecti_index \\<equiv> collecti_index' 0 {}\"\n\n  lemma collecti_index'_collect: \"collecti_index' i0 a0 f l \n    = (\n      if \\<exists>i<length l. fst (f (i0+i) (l!i)) then\n        let i=LEAST i . i<length l \\<and> fst (f (i0+i) (l!i)) in {i0+i} \\<times> snd (f (i0+i) (l!i))\n      else\n        a0 \\<union> {(i0+i,x) | i x. i<length l \\<and> x\\<in>snd (f (i0+i) (l!i))})\"\n  proof (cases \"\\<exists>i<length l. fst (f (i0+i) (l!i))\")\n    case False\n    note False[simp]\n    hence \"\\<forall>i<length l. \\<not>fst (f (i0+i) (l!i))\" by blast\n    hence \"collecti_index' i0 a0 f l = collect_indexr' i0 a0 (snd oo f) l\"\n    proof (induction l arbitrary: i0 a0)\n      case (Cons x l)\n      from Cons.prems have \"\\<not>fst (f i0 x)\" by auto\n      hence [simp]: \"\\<And>v. f i0 x \\<noteq> (True,v)\" by auto\n      have \"collecti_index' i0 a0 f (x#l) = \n        collecti_index' (Suc i0) (a0 \\<union> {i0} \\<times> (snd (f i0 x))) f l\" \n        by (simp split: prod.splits bool.splits)\n      also have \"\\<dots> = collect_indexr' (Suc i0) ((a0 \\<union> {i0} \\<times> (snd (f i0 x)))) (snd oo f) l\" \n        apply (subst Cons.IH)\n        using Cons.prems\n        by auto\n      finally have 1: \"collecti_index' i0 a0 f (x # l) =\n        collect_indexr' (Suc i0) (a0 \\<union> {i0} \\<times> snd (f i0 x)) (snd \\<circ>\\<circ> f) l\" . \n      show ?case by (subst 1) simp\n    qed simp\n    also note collect_indexr'_collect\n    finally show ?thesis by simp\n  next\n    case True\n    note True[simp]\n    define im where \"im \\<equiv> \\<lambda>l (i0::nat). LEAST i . i<length l \\<and> fst (f (i0+i) (l!i))\"\n    from LeastI_ex[OF True] have \n      1: \"im l i0<length l\" \"fst (f (i0+im l i0) (l!im l i0))\" \n      unfolding im_def by (auto) \n    have 2: \"\\<forall>i<im l i0. \\<not> fst (f (i0+i) (l!i))\"\n    proof safe\n      fix i\n      assume A: \"i<im l i0\" with 1 have \"i<length l\" by simp\n      moreover assume \"fst (f (i0+i) (l!i))\"\n      ultimately have \"im l i0 \\<le> i\"\n        unfolding im_def by (auto intro: Least_le)\n      with A show False by simp  \n    qed  \n\n    from 1 2 have \"collecti_index' i0 a0 f l = {i0+im l i0} \\<times> snd (f (i0+im l i0) (l!im l i0))\"\n    proof (induction l arbitrary: i0 a0)\n      case (Cons x l)\n      show ?case proof (cases \"fst (f i0 x)\")\n        case True\n        hence [simp]: \"\\<And>y. f i0 x \\<noteq> (False,y)\" by auto\n        note [simp] = True        \n\n        from Cons.prems(3) have [simp]: \"im (x#l) i0 = 0\"\n          by auto\n\n        thus ?thesis\n          by (auto split: prod.splits bool.splits)\n      next\n        case False\n        hence \"im (x#l) i0 = Suc (im l (Suc i0))\"\n          unfolding im_def\n          apply (subst Least_Suc)\n          apply (rule conjI) \n          apply (rule Cons.prems)+\n          apply simp\n          apply simp\n          done\n        hence ims: \"im (x#l) i0 > 0\" \"im l (Suc i0) = im (x#l) i0 - 1\" \n          by simp_all\n\n        from False have 1: \"collecti_index' i0 a0 f (x # l) \n          = collecti_index' (Suc i0) (a0 \\<union> {i0} \\<times> (snd (f i0 x))) f l\"\n          by (auto)\n\n        show ?thesis\n          apply (subst 1)\n          apply (subst Cons.IH)\n          using Cons.prems(1) ims apply (simp)\n          using Cons.prems(2) ims apply simp\n          using Cons.prems(3)\n          apply (auto simp: ims nth_Cons less_diff_conv split: nat.splits) []\n          using ims(1) apply (auto simp: ims(2))\n          done\n      qed\n    qed simp\n    thus ?thesis\n      by (simp add: im_def)\n\n  qed      \n\n  lemma collecti_index_collect: \"collecti_index f l \n    = (\n      if \\<exists>i<length l. fst (f i (l!i)) then\n        let i=LEAST i . i<length l \\<and> fst (f i (l!i)) in {i} \\<times> snd (f i (l!i))\n      else\n        {(i,x) | i x. i<length l \\<and> x\\<in>snd (f i (l!i))})\"\n    using collecti_index'_collect[of 0 \"{}\" f l]\n    by (simp cong: if_cong)\n\n  primrec collecti_index'_list :: \"nat \\<Rightarrow> (nat\\<times>'b) list \\<Rightarrow> (nat \\<Rightarrow> 'a \\<Rightarrow> (bool \\<times> 'b list)) \\<Rightarrow> 'a list \\<Rightarrow> (nat\\<times>'b) list\" where\n    \"collecti_index'_list i a c [] = a\"\n  | \"collecti_index'_list i a c (x#xs) = (case c i x of\n      (False,s) \\<Rightarrow> collecti_index'_list (Suc i) (a @ map (Pair i) s) c xs\n    | (True,s) \\<Rightarrow> map (Pair i) s)\"\n\n  abbreviation \"collecti_index_list \\<equiv> collecti_index'_list 0 []\"\n\n  lemma collecti_index'_list_invar:\n    assumes \"\\<And>i x b l. c i x = (b,l) \\<Longrightarrow> distinct l\"\n    assumes \"fst`set a \\<subseteq> {0..<i0}\" \"distinct a\"\n    shows \"distinct (collecti_index'_list i0 a c l)\"\n    using assms\n    apply (induction l arbitrary: i0 a)\n    apply simp\n    apply (auto split: prod.splits bool.splits simp: nth_Cons' distinct_map)\n    apply rprems\n    apply (auto simp: distinct_map)\n    done\n\n  lemma image_Pair_eq_prod_sng[simp]: \"Pair x ` s = {x}\\<times>s\" by auto  \n\n  lemma collecti_index'_list_\\<alpha>: \n    assumes \"\\<And>i x b l. ci i x = (b,l) \\<Longrightarrow> c i x = (b,set l)\"\n    shows \n      \"set (collecti_index'_list i0 ai ci l) = collecti_index' i0 (set ai) c l\"\n  proof -\n    from assms have A: \"\\<And>i x b s. c i x = (b,s) \\<longleftrightarrow> (\\<exists>l. ci i x = (b, l) \\<and> s=set l)\"\n      apply auto apply (case_tac \"ci i x\") apply auto done\n\n    show ?thesis  \n      apply (induction l arbitrary: i0 ai)\n      apply simp\n      apply simp\n      apply (split prod.split, clarsimp)\n      apply (split bool.split, clarsimp, intro allI impI conjI)\n      apply (force simp add: A) []\n  \n      apply (simp split: prod.splits bool.splits add: A)\n      apply safe\n      apply simp_all\n      apply blast\n      done\n  qed\n\n  lemma collecti_index_list_refine:\n    \"(collecti_index_list,collecti_index)\\<in>\n       (nat_rel \\<rightarrow> Id \\<rightarrow> bool_rel \\<times>\\<^sub>r \\<langle>Id\\<rangle>list_set_rel) \\<rightarrow> \\<langle>Id\\<rangle>list_rel \n    \\<rightarrow> \\<langle>nat_rel\\<times>\\<^sub>rId\\<rangle>list_set_rel\"\n    apply (intro fun_relI)\n    apply (simp add: list_set_rel_def)\n    apply (rule brI)\n\n    apply (simp add: br_def)\n    apply (rule collecti_index'_list_\\<alpha>[of _ _ 0 \"[]\", simplified, symmetric])\n    apply (drule_tac x=i and x'=i in fun_relD, simp)\n    apply (drule_tac x=x and x'=x in fun_relD, simp)\n    apply (auto simp: prod_rel_def) []\n\n    apply (rule collecti_index'_list_invar)\n    apply auto\n    apply (drule_tac x=i and x'=i in fun_relD, simp)\n    apply (drule_tac x=x and x'=x in fun_relD, simp)\n    apply (auto simp: prod_rel_def br_def) []\n    done\n\n\n\n\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/CAVA_LTL_Modelchecker/SM/Impl/SM_Datastructures.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.30214021113107636}}
{"text": "(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      HoareTotalDef.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2004-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {* Hoare Logic for Total Correctness *}\n\ntheory HoareTotalDef imports HoarePartialDef Termination begin \n\nsubsection {* Validity of Hoare Tuples: @{text  \"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"} *}\n\ndefinition\n  validt :: \"[('s,'p,'f) body,'f set,'s assn,('s,'p,'f) com,'s assn,'s assn] \\<Rightarrow> bool\"\n                (\"_\\<Turnstile>\\<^sub>t\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> \\<Gamma>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A \\<and> (\\<forall>s \\<in> Normal ` P. \\<Gamma>\\<turnstile>c\\<down>s)\"\n\ndefinition\n  cvalidt::\n  \"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n    's assn,('s,'p,'f) com,'s assn,'s assn] \\<Rightarrow> bool\"\n                (\"_,_\\<Turnstile>\\<^sub>t\\<^bsub>'/_\\<^esub>/ _ _ _,_\"  [61,60, 60,1000, 20, 1000,1000] 60)\nwhere\n \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A \\<equiv> (\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A) \\<longrightarrow> \\<Gamma> \\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n\nnotation (ascii)\n  validt  (\"_|=t'/_/ _ _ _,_\"  [61,60,1000, 20, 1000,1000] 60) and\n  cvalidt  (\"_,_|=t'/_ / _ _ _,_\"  [61,60,60,1000, 20, 1000,1000] 60)\n\nsubsection {* Properties of Validity *}\n\nlemma validtI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P;t \\<notin> Fault ` F\\<rbrakk> \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A;\n   \\<And>s. s \\<in> P \\<Longrightarrow> \\<Gamma>\\<turnstile> c\\<down>(Normal s) \\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: validt_def valid_def)\n\nlemma cvalidtI: \n \"\\<lbrakk>\\<And>s t. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s\\<rangle> \\<Rightarrow> t;s \\<in> P; \n          t \\<notin> Fault ` F\\<rbrakk> \n          \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A;\n   \\<And>s. \\<lbrakk>\\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A; s\\<in>P\\<rbrakk> \\<Longrightarrow>  \\<Gamma>\\<turnstile>c\\<down>(Normal s)\\<rbrakk>\n  \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (auto simp add: cvalidt_def validt_def valid_def)\n\nlemma cvalidt_postD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;\\<Gamma>\\<turnstile>\\<langle>c,Normal s \\<rangle> \\<Rightarrow> t;\n   s \\<in> P;t \\<notin> Fault ` F\\<rbrakk> \n  \\<Longrightarrow> t \\<in> Normal ` Q \\<union> Abrupt ` A\"\n  by (simp add: cvalidt_def validt_def valid_def)\n\nlemma cvalidt_termD: \n \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\<forall>(P,p,Q,A)\\<in>\\<Theta>. \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A;s \\<in> P\\<rbrakk> \n  \\<Longrightarrow> \\<Gamma>\\<turnstile>c\\<down>(Normal s)\"\n  by (simp add: cvalidt_def validt_def valid_def)\n\n\nlemma validt_augment_Faults:\n  assumes valid:\"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  assumes F': \"F \\<subseteq> F'\"\n  shows \"\\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F'\\<^esub> P c Q,A\"\n  using valid F'\n  by (auto intro: valid_augment_Faults simp add: validt_def)\n\nsubsection {* The Hoare Rules: @{text \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" } *}\n\ninductive \"hoaret\"::\"[('s,'p,'f) body,('s,'p) quadruple set,'f set,\n                        's assn,('s,'p,'f) com,'s assn,'s assn] \n                       => bool\"\n    (\"(3_,_/\\<turnstile>\\<^sub>t\\<^bsub>'/_\\<^esub> (_/ (_)/ _,_))\" [61,60,60,1000,20,1000,1000]60)  \n   for \\<Gamma>::\"('s,'p,'f) body\"\nwhere\n  Skip: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> Q Skip Q,A\"\n\n| Basic: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> {s. f s \\<in> Q} (Basic f) Q,A\"\n\n| Spec: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> {s. (\\<forall>t. (s,t) \\<in> r \\<longrightarrow> t \\<in> Q) \\<and> (\\<exists>t. (s,t) \\<in> r)} (Spec r) Q,A\"\n\n| Seq: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 R,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk>\n        \\<Longrightarrow>\n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P Seq c\\<^sub>1 c\\<^sub>2 Q,A\"\n  \n| Cond: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P \\<inter> b) c\\<^sub>1 Q,A; \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P \\<inter> - b) c\\<^sub>2 Q,A\\<rbrakk>\n         \\<Longrightarrow> \n         \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Cond b c\\<^sub>1 c\\<^sub>2) Q,A\"\n\n| While: \"\\<lbrakk>wf r; \\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<sigma>} \\<inter> P \\<inter> b) c ({t. (t,\\<sigma>)\\<in>r} \\<inter> P),A\\<rbrakk>\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (While b c) (P \\<inter> - b),A\"\n\n| Guard: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\n          \\<Longrightarrow>\n          \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (g \\<inter> P) Guard f g c Q,A\"\n\n| Guarantee: \"\\<lbrakk>f \\<in> F; \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (g \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Guard f g c) Q,A\"\n\n| CallRec: \n  \"\\<lbrakk>(P,p,Q,A) \\<in> Specs;\n    wf r; \n    Specs_wf = (\\<lambda>p \\<sigma>. (\\<lambda>(P,q,Q,A). (P \\<inter> {s. ((s,q),(\\<sigma>,p)) \\<in> r},q,Q,A)) ` Specs);\n    \\<forall>(P,p,Q,A)\\<in> Specs. \n      p \\<in> dom \\<Gamma> \\<and> (\\<forall>\\<sigma>. \\<Gamma>,\\<Theta> \\<union> Specs_wf p \\<sigma>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<sigma>} \\<inter> P) (the (\\<Gamma> p)) Q,A)\n    \\<rbrakk>\n    \\<Longrightarrow>\n    \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n\n| DynCom:  \"\\<forall>s \\<in> P. \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (c s) Q,A \n            \\<Longrightarrow> \n            \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (DynCom c) Q,A\"\n\n\n| Throw: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> A Throw Q,A\"\n\n| Catch: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c\\<^sub>1 Q,R; \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> R c\\<^sub>2 Q,A\\<rbrakk> \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P Catch c\\<^sub>1 c\\<^sub>2 Q,A\"\n\n| Conseq: \"\\<forall>s \\<in> P. \\<exists>P' Q' A'. \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A' \\<and> s \\<in> P' \\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A \n           \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n\n\n| Asm: \"(P,p,Q,A) \\<in> \\<Theta> \n        \\<Longrightarrow> \n        \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P (Call p) Q,A\"\n\n| ExFalso: \"\\<lbrakk>\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A; \\<not> \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\\<rbrakk> \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  -- {* This is a hack rule that enables us to derive completeness for\n        an arbitrary context @{text \"\\<Theta>\"}, from completeness for an empty context.*}\n\n  \ntext {* Does not work, because of rule ExFalso, the context @{text \\<Theta>} is to blame.\n A weaker version with empty context can be derived from soundness \n later on. *}\nlemma hoaret_to_hoarep:\n  assumes hoaret: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P p Q,A\"\nusing hoaret\nproof (induct)\n  case Skip thus ?case by (rule hoarep.intros)\nnext\n  case Basic thus ?case by (rule hoarep.intros)\nnext\n  case Seq thus ?case by - (rule hoarep.intros)\nnext\n  case Cond thus ?case by - (rule hoarep.intros)\nnext\n  case (While r \\<Theta> F P b c A)\n  hence \"\\<forall>\\<sigma>. \\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> ({\\<sigma>} \\<inter> P \\<inter> b) c ({t. (t, \\<sigma>) \\<in> r} \\<inter> P),A\"\n    by iprover\n  hence \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> (P \\<inter> b) c P,A\"\n    by (rule HoarePartialDef.conseq) blast\n  then show \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^bsub>/F\\<^esub> P While b c (P \\<inter> - b),A\"\n    by (rule hoarep.While)\nnext\n  case Guard thus ?case by - (rule hoarep.intros)\n(*next\n  case (CallRec A F P Procs Q Z \\<Theta>  p r)\n  hence hyp: \"\\<forall>p\\<in>Procs. \\<forall>\\<tau> Z. \n           \\<Gamma>,\\<Theta> \\<union> (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r},\n                      Call q, Q q Z,A q Z)})\\<turnstile>\\<^bsub>/F\\<^esub>\n              ({\\<tau>} \\<inter> P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n    by blast\n  have \"\\<forall>p\\<in>Procs. \\<forall>Z. \n           \\<Gamma>,\\<Theta> \\<union> (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z,\n                      Call q, Q q Z,A q Z)})\\<turnstile>\\<^bsub>/F\\<^esub>\n              (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\" \n  proof (intro ballI allI)\n    fix p Z\n    assume \"p \\<in> Procs\"\n    with hyp\n    have hyp': \"\\<And> \\<tau>. \n           \\<Gamma>,\\<Theta> \\<union> (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r},\n                      Call q, Q q Z, A q Z)})\\<turnstile>\\<^bsub>/F\\<^esub>\n              ({\\<tau>} \\<inter> P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n      by blast\n    have \"\\<forall>\\<tau>. \n           \\<Gamma>,\\<Theta> \\<union> (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z,\n                      Call q, Q q Z,A q Z)})\\<turnstile>\\<^bsub>/F\\<^esub>\n              ({\\<tau>} \\<inter> P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n      (is \"\\<forall>\\<tau>. \\<Gamma>,?\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> ({\\<tau>} \\<inter> P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\")\n    proof (rule allI, rule WeakenContext [OF hyp'],clarify)\n      fix \\<tau> P' c Q' A'\n      assume \"(P', c, Q', A') \\<in> \\<Theta> \\<union>\n         (\\<Union>q\\<in>Procs.\n             \\<Union>Z. {(P q Z \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r},\n                  Call q, Q q Z,\n                  A q Z)})\" (is \"(P', c, Q', A') \\<in> \\<Theta> \\<union> ?Spec\")\n      then show \"\\<Gamma>,?\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> P' c Q',A'\"\n      proof (cases rule: UnE [consumes 1])\n        assume \"(P',c,Q',A') \\<in> \\<Theta>\" \n        then show ?thesis\n          by (blast intro: HoarePartialDef.Asm)\n      next\n        assume \"(P',c,Q',A') \\<in> ?Spec\" \n        then show ?thesis\n        proof (clarify)\n          fix q Z\n          assume q: \"q \\<in> Procs\"\n          show \"\\<Gamma>,?\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> (P q Z \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r}) \n                         Call  q \n                        (Q q Z),(A q Z)\"\n          proof -\n            from q\n            have \"\\<Gamma>,?\\<Theta>'\\<turnstile>\\<^bsub>/F\\<^esub> (P q Z) Call q (Q q Z),(A q Z)\"\n              by - (rule HoarePartialDef.Asm,blast)\n            thus ?thesis\n              by (rule HoarePartialDef.conseqPre) blast\n          qed\n        qed\n      qed\n    qed\n    then show \"\\<Gamma>,\\<Theta> \\<union> (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z, Call q, Q q Z,A q Z)})\n                \\<turnstile>\\<^bsub>/F\\<^esub> (P p Z) (the (\\<Gamma> p)) (Q p Z),(A p Z)\"\n      by (rule HoarePartialDef.conseq) blast\n  qed\n  thus ?case\n    by - (rule hoarep.CallRec)*)\nnext\n  case DynCom thus ?case by (blast intro: hoarep.DynCom)\nnext\n  case Throw thus ?case by - (rule hoarep.Throw)\nnext\n  case Catch thus ?case by - (rule hoarep.Catch)\nnext\n  case Conseq thus ?case by - (rule hoarep.Conseq,blast)\nnext\n  case Asm thus ?case by (rule HoarePartialDef.Asm)\nnext\n  case (ExFalso \\<Theta> F P c Q A)\n  assume \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  hence \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^bsub>/F\\<^esub> P c Q,A\"\n    oops\n\n\nlemma hoaret_augment_context: \n  assumes deriv: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\n  shows \"\\<And>\\<Theta>'. \\<Theta> \\<subseteq> \\<Theta>' \\<Longrightarrow> \\<Gamma>,\\<Theta>'\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P p Q,A\"\nusing deriv\nproof (induct)\n  case (CallRec P p Q A Specs r Specs_wf \\<Theta> F \\<Theta>')\n  have aug: \"\\<Theta> \\<subseteq> \\<Theta>'\" by fact\n  then\n  have h: \"\\<And>\\<tau> p. \\<Theta> \\<union> Specs_wf p \\<tau>\n       \\<subseteq> \\<Theta>' \\<union> Specs_wf p \\<tau>\"\n    by blast\n  have \"\\<forall>(P,p,Q,A)\\<in>Specs. p \\<in> dom \\<Gamma> \\<and>\n     (\\<forall>\\<tau>. \\<Gamma>,\\<Theta> \\<union> Specs_wf p \\<tau>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<tau>} \\<inter> P) (the (\\<Gamma> p)) Q,A \\<and>\n           (\\<forall>x. \\<Theta> \\<union> Specs_wf p \\<tau>\n                 \\<subseteq> x \\<longrightarrow>\n                 \\<Gamma>,x\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<tau>} \\<inter> P) (the (\\<Gamma> p)) Q,A))\" by fact\n  hence \"\\<forall>(P,p,Q,A)\\<in>Specs. p \\<in> dom \\<Gamma> \\<and> \n         (\\<forall>\\<tau>. \\<Gamma>,\\<Theta>'\\<union> Specs_wf p \\<tau> \\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<tau>} \\<inter> P) (the (\\<Gamma> p)) Q,A)\"\n    apply (clarify)\n    apply (rename_tac P p Q A)\n    apply (drule (1) bspec)\n    apply (clarsimp)\n    apply (erule_tac x=\\<tau> in allE)\n    apply clarify\n    apply (erule_tac x=\"\\<Theta>' \\<union> Specs_wf p \\<tau>\" in allE)\n    apply (insert aug)\n    apply auto\n    done\n  with CallRec show ?case by - (rule hoaret.CallRec)\nnext\n  case DynCom thus ?case by (blast intro: hoaret.DynCom)\nnext\n  case (Conseq P \\<Theta> F c Q A \\<Theta>')\n  from Conseq\n  have \"\\<forall>s \\<in> P. (\\<exists>P' Q' A'. (\\<Gamma>,\\<Theta>' \\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A') \\<and> s \\<in> P'\\<and> Q' \\<subseteq> Q \\<and> A' \\<subseteq> A)\"\n    by blast\n  with Conseq show ?case by - (rule hoaret.Conseq)\nnext\n  case (ExFalso \\<Theta> F P  c Q A \\<Theta>')\n  have \"\\<Gamma>,\\<Theta>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \"\\<not> \\<Gamma>\\<Turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\" \"\\<Theta> \\<subseteq> \\<Theta>'\"  by fact+\n  then show ?case\n    by (fastforce intro: hoaret.ExFalso simp add: cvalidt_def)\nqed (blast intro: hoaret.intros)+\n\nsubsection {* Some Derived Rules *}\n\n\nlemma  Conseq': \"\\<forall>s. s \\<in> P \\<longrightarrow> \n            (\\<exists>P' Q' A'. \n              (\\<forall> Z. \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z)) \\<and>\n                    (\\<exists>Z. s \\<in> P' Z \\<and> (Q' Z \\<subseteq> Q) \\<and> (A' Z \\<subseteq> A)))\n           \\<Longrightarrow>\n           \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\napply (rule Conseq)\napply (rule ballI)\napply (erule_tac x=s in allE)\napply (clarify)\napply (rule_tac x=\"P' Z\" in exI)\napply (rule_tac x=\"Q' Z\" in exI)\napply (rule_tac x=\"A' Z\" in exI)\napply blast\ndone\n\nlemma conseq:\"\\<lbrakk>\\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P' Z) c (Q' Z),(A' Z);\n              \\<forall>s. s \\<in> P \\<longrightarrow> (\\<exists> Z. s\\<in>P' Z \\<and> (Q' Z \\<subseteq> Q)\\<and> (A' Z \\<subseteq> A))\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule Conseq) blast\n\ntheorem conseqPrePost: \n  \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q',A' \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow>  Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \\<Longrightarrow>  \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq [where ?P'=\"\\<lambda>Z. P'\" and ?Q'=\"\\<lambda>Z. Q'\"]) auto\n\nlemma conseqPre: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P' c Q,A \\<Longrightarrow> P \\<subseteq> P' \\<Longrightarrow> \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\nby (rule conseq) auto\n\nlemma conseqPost: \"\\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q',A'\\<Longrightarrow> Q' \\<subseteq> Q \\<Longrightarrow> A' \\<subseteq> A \\<Longrightarrow>   \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> P c Q,A\"\n  by (rule conseq) auto\n\n\nlemma Spec_wf_conv: \n  \"(\\<lambda>(P, q, Q, A). (P \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r}, q, Q, A)) `\n                (\\<Union>p\\<in>Procs. \\<Union>Z. {(P p Z, p, Q p Z, A p Z)}) = \n        (\\<Union>q\\<in>Procs. \\<Union>Z. {(P q Z \\<inter> {s. ((s, q), \\<tau>, p) \\<in> r}, q, Q q Z, A q Z)})\"\napply (rule)\napply  fastforce\napply (fastforce simp add: image_def)\ndone\n\nlemma CallRec': \n  \"\\<lbrakk>p\\<in>Procs; Procs \\<subseteq> dom \\<Gamma>;\n    wf r; \n   \\<forall>p\\<in>Procs. \\<forall>\\<tau> Z. \n   \\<Gamma>,\\<Theta>\\<union>(\\<Union>q\\<in>Procs. \\<Union>Z. \n    {((P q Z) \\<inter> {s. ((s,q),(\\<tau>,p)) \\<in> r},q,Q q Z,(A q Z))})\n     \\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> ({\\<tau>} \\<inter> (P p Z)) (the (\\<Gamma> p)) (Q p Z),(A p Z)\\<rbrakk>\n   \\<Longrightarrow>\n   \\<Gamma>,\\<Theta>\\<turnstile>\\<^sub>t\\<^bsub>/F\\<^esub> (P p Z) (Call p) (Q p Z),(A p Z)\"\napply (rule CallRec [where Specs=\"\\<Union>p\\<in>Procs. \\<Union>Z. {((P p Z),p,Q p Z,A p Z)}\" and\n         r=r])\napply    blast\napply   assumption\napply  (rule refl)\napply (clarsimp)\napply (rename_tac p')\napply (rule conjI)\napply  blast\napply (intro allI)\napply (rename_tac Z \\<tau>)\napply (drule_tac x=p' in bspec, assumption)\napply (erule_tac x=\\<tau> in allE)\napply (erule_tac x=Z in allE)\napply (fastforce simp add: Spec_wf_conv)\ndone\n\nend\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Simpl/HoareTotalDef.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804337438501, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.30214021113107636}}
{"text": "theory HC_Compl_Consistency\nimports Consistency HC\nbegin\n\ncontext begin\nprivate lemma dt: \"F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H G \\<Longrightarrow> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H F \\<^bold>\\<rightarrow> G\"\n  by (metis AX100 Deduction_theorem Un_insert_right sup_left_commute)\nlemma sim: \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H F \\<Longrightarrow> F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H G \\<Longrightarrow> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H G\"\n  using MP dt by blast\nlemma sim_conj: \"F \\<triangleright> G \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H H \\<Longrightarrow> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H F \\<Longrightarrow> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H G \\<Longrightarrow> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H H\"\n  using MP dt by (metis Un_insert_left)\nlemma sim_disj: \"\\<lbrakk>F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H H; G \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H H; \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H F \\<^bold>\\<or> G\\<rbrakk> \\<Longrightarrow> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H H\"\nproof goal_cases\n  case 1\n  have 2: \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H F \\<^bold>\\<rightarrow> H\" by (simp add: 1 dt)\n  have 3: \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H G \\<^bold>\\<rightarrow> H\" by (simp add: 1 dt)\n  have 4: \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H (F \\<^bold>\\<or> G) \\<^bold>\\<rightarrow> H\" by (meson 2 3 HC.simps HC_intros(7) HC_mono sup_ge2)\n  thus ?case  using 1(3) MP by blast\nqed\n\nprivate lemma someax: \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H F \\<^bold>\\<rightarrow> \\<^bold>\\<not> F \\<^bold>\\<rightarrow> \\<bottom>\"\nproof -\n  have \"F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> F \\<^bold>\\<rightarrow> F \\<^bold>\\<rightarrow> \\<bottom>\"\n    by (meson HC_intros(12) HC_mono subset_insertI sup_ge2)\n  then have \"\\<^bold>\\<not> F \\<triangleright> F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<bottom>\"\n    by (meson HC.simps HC_mono insertI1 subset_insertI)\n  then show ?thesis\n    by (metis (no_types) Un_insert_left dt)\nqed\n\nlemma lem: \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> F \\<^bold>\\<or> F\"\nproof -\n  thm HC_intros(7)[of F \\<bottom> \"Not F\"]\n  have \"F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H ( \\<^bold>\\<not> F \\<^bold>\\<or> F)\"\n    by (metis AX10.intros(3) Ax HC_mono MP Un_commute Un_insert_left insertI1 sup_ge1)\n  hence \"F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> ( \\<^bold>\\<not> F \\<^bold>\\<or> F) \\<^bold>\\<rightarrow> \\<bottom>\" using someax by (metis HC.simps Un_insert_left)\n  hence \"\\<^bold>\\<not> ( \\<^bold>\\<not> F \\<^bold>\\<or> F) \\<triangleright> F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<bottom>\" by (meson Ax HC_mono MP insertI1 subset_insertI)\n  hence \"\\<^bold>\\<not> ( \\<^bold>\\<not> F \\<^bold>\\<or> F) \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H F \\<^bold>\\<rightarrow> \\<bottom>\"\n    by (metis Un_insert_left dt insert_commute)\n      \n  have \"\\<^bold>\\<not>F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H ( \\<^bold>\\<not> F \\<^bold>\\<or> F)\"\n    by (metis HC.simps HC_intros(5) HC_mono inf_sup_ord(4) insertI1 insert_is_Un)\n  hence \"\\<^bold>\\<not>F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> ( \\<^bold>\\<not> F \\<^bold>\\<or> F) \\<^bold>\\<rightarrow> \\<bottom>\" using someax by (metis HC.simps Un_insert_left)\n  hence \"\\<^bold>\\<not> ( \\<^bold>\\<not> F \\<^bold>\\<or> F) \\<triangleright> \\<^bold>\\<not>F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<bottom>\" by (meson Ax HC_mono MP insertI1 subset_insertI)\n  hence \"\\<^bold>\\<not> ( \\<^bold>\\<not> F \\<^bold>\\<or> F) \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not>F \\<^bold>\\<rightarrow> \\<bottom>\"\n    by (metis Un_insert_left dt insert_commute)\n  \n  hence \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> ( \\<^bold>\\<not> F \\<^bold>\\<or> F) \\<^bold>\\<rightarrow> \\<bottom>\"\n    by (meson HC_intros(13) HC_mono MP \\<open>\\<^bold>\\<not> (\\<^bold>\\<not> F \\<^bold>\\<or> F) \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H F \\<^bold>\\<rightarrow> \\<bottom>\\<close> dt subset_insertI sup_ge2)\n  thus ?thesis by (meson HC.simps HC_intros(13) HC_mono sup_ge2)\n(*    apply(insert HC_mono dt HC_intros(3-)[THEN HC_mono, OF sup_ge2] sim HC.intros)\n    sledgehammer[debug,max_facts=50,timeout=120]*)\nqed\n\nlemma exchg: \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H F \\<^bold>\\<or> G \\<Longrightarrow> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H G \\<^bold>\\<or> F\"\n  by (meson AX10.intros(3) HC.simps HC_intros(5) HC_intros(7) HC_mono sup_ge2)\n    \n\n\n\nlemma nor_sim: \nassumes \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> (F \\<^bold>\\<or> G)\"\nshows \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> F\" \" \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> G\"\n  using HC_contrapos_nn assms by (metis HC_intros(5,6) HC_mono sup_ge2)+\n    \nlemma HC_contrapos_np:\n  \"\\<lbrakk>\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> F; \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> G \\<^bold>\\<rightarrow> F\\<rbrakk> \\<Longrightarrow> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H G\"\n    by (meson HC_intros(12) HC_intros(13) HC_mono MP sup_ge2  HC_contrapos_nn[of \\<Gamma> F \"Not G\"])    \n    \nlemma not_imp: \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> F \\<^bold>\\<rightarrow> F \\<^bold>\\<rightarrow> G\"\nproof goal_cases case 1\n  have \"\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<^bold>\\<not> F \\<^bold>\\<rightarrow> F \\<^bold>\\<rightarrow> \\<bottom>\" by (simp add: AX10.intros(9) Ax)\n  hence \"\\<^bold>\\<not> F \\<triangleright> F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<bottom>\" by (meson HC.simps HC_mono insertI1 subset_insertI)\n  hence \"\\<^bold>\\<not> F \\<triangleright> F \\<triangleright> \\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H G\" by (metis (no_types, hide_lams) Un_commute Un_insert_right inpcp)\n  thus ?case by (metis Un_insert_left dt insert_commute)\nqed\n\nlemma HC_consistent:  \"pcp {\\<Gamma>| \\<Gamma>. \\<not>(\\<Gamma> \\<union> AX10 \\<turnstile>\\<^sub>H \\<bottom>)}\"\n  unfolding pcp_def\n  apply(intro ballI conjI; unfold mem_Collect_eq; elim exE conjE; erule contrapos_np; clarsimp)\n          subgoal by (simp add: HC.Ax)\n         subgoal by (meson Ax HC_intros(12) HC_mono MP Un_upper1 sup_ge2)\n        subgoal using sim_conj by (metis (no_types, lifting) Ax HC_intros(8) HC_intros(9) HC_mono MP sup_ge1 sup_ge2)\n       subgoal using sim_disj using Ax by blast\n      subgoal by (erule (1) sim_disj) (simp add: Ax imp_sim)\n     subgoal by (metis Ax HC_contrapos_nn MP Un_iff Un_insert_left dt inpcp someax)  \n    subgoal by(erule (1) sim_disj) (simp add: Ax nand_sim)\n   subgoal by(erule  sim_conj) (meson Ax Un_iff nor_sim)+\n  subgoal for \\<Gamma> F G apply(erule sim_conj) \n     subgoal by (meson Ax HC_Compl_Consistency.not_imp HC_contrapos_np Un_iff) \n    subgoal by (metis Ax HC_contrapos_nn HC_intros(3) HC_mono sup_ge1 sup_ge2)\n  done\ndone\n\nend\n\ncorollary HC_complete: \n  fixes F :: \"'a :: countable formula\"\n  shows \"\\<Turnstile> F \\<Longrightarrow> AX10 \\<turnstile>\\<^sub>H F\"\nproof(erule contrapos_pp)\n  let ?W = \"{\\<Gamma>| \\<Gamma>. \\<not>((\\<Gamma> :: ('a :: countable) formula set) \\<union> AX10 \\<turnstile>\\<^sub>H \\<bottom>)}\"\n    note [[show_types]]\n  assume \\<open>\\<not> (AX10 \\<turnstile>\\<^sub>H F)\\<close>\n  hence \"\\<not> (\\<^bold>\\<not>F \\<triangleright> AX10 \\<turnstile>\\<^sub>H \\<bottom>)\"\n    by (metis AX100 Deduction_theorem HC_intros(13) MP Un_insert_right)\n  hence \"{\\<^bold>\\<not>F} \\<in> ?W\" by simp\n  with pcp_sat HC_consistent have \"sat {\\<^bold>\\<not> F}\" .\n  thus \"\\<not> \\<Turnstile> F\" by (simp add: sat_def)\nqed\n    \n\n  \nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Propositional_Proof_Systems/HC_Compl_Consistency.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6187804196836383, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.3021402042657084}}
{"text": "theory DP_CRelVH_Ext\nimports DP_CRelVH\nbegin\ncontext dp_consistency_heap begin\n\ndefinition \"crel_vs1 R v f \\<equiv>\n  \\<forall>heap. P heap \\<longrightarrow>\n    (case execute f heap of None \\<Rightarrow> False | Some (v', heap') \\<Rightarrow> P heap' \\<and> (state_dp_consistency.cmem heap \\<longrightarrow> R v v' \\<and> state_dp_consistency.cmem heap'))\n\"\n\nlemma crel_vs1_execute_None:\n  False if \"crel_vs1 R a b\" \"execute b heap = None\" \"P heap\"\n  using that unfolding crel_vs1_def by auto\n\nlemma crel_vs1_execute_Some:\n  assumes \"crel_vs1 R a b\" \"P heap\"\n  obtains x heap' where \"execute b heap = Some (x, heap')\" \"P heap'\"\n  using assms unfolding crel_vs1_def by (cases \"execute b heap\") auto\n\nlemma crel_vs1_executeD:\n  assumes \"crel_vs1 R a b\" \"P heap\" \"state_dp_consistency.cmem heap\"\n  obtains x heap' where \"execute b heap = Some (x, heap')\" \"P heap'\" \"state_dp_consistency.cmem heap'\" \"R a x\"\n  using assms unfolding crel_vs1_def by (cases \"execute b heap\") auto\n\nlemma rel_state_state_of:\n  \"rel_state (=) (state_of b) b\" if \"crel_vs1 R a b\"\n  unfolding rel_state_def state_of_def\n  by (auto split: option.split elim: crel_vs1_execute_Some[OF that])\n\nlemma crel_vs1_state_of:\n  \"state_dp_consistency.crel_vs R a (state_of b)\" if \"crel_vs1 R a b\"\n  unfolding state_dp_consistency.crel_vs_def state_of_def by (auto elim: crel_vs1_executeD[OF that])\n\nlemma crel_vs1_alt_def:\n  \"crel_vs1 R = (state_dp_consistency.crel_vs R OO rel_state (=))\"\nproof (intro ext)\n  fix a b\n  have \"(state_dp_consistency.crel_vs R OO rel_state (=)) a b\" if \"crel_vs1 R a b\"\n    using that by - (rule relcomppI; erule crel_vs1_state_of rel_state_state_of)\n  moreover have \"crel_vs1 R a b\" if \"(state_dp_consistency.crel_vs R OO rel_state (=)) a b\"\n    using that by (auto 4 3 elim: state_dp_consistency.crel_vs_elim rel_state_elim simp: crel_vs1_def)\n  ultimately show \"crel_vs1 R a b = (state_dp_consistency.crel_vs R OO rel_state (=)) a b\" ..\nqed\n\ncontext\n  includes lifting_syntax\nbegin\n\nlemma transfer_return1[transfer_rule]:\n  \"(R ===> crel_vs1 R) Wrap return\"\n  unfolding crel_vs1_alt_def Wrap_def by (rule rel_fun_comp1 state_dp_consistency.return_transfer[unfolded Wrap_def] transfer_return)+ auto\n\nlemma crel_vs_return1:\n  \"\\<lbrakk>R x y\\<rbrakk> \\<Longrightarrow> crel_vs1 R (Wrap x) (return y)\"\n  by (rule transfer_return1[unfolded rel_fun_def, rule_format])\nterm 0 (**)\n\nlemma crel_vs_rel_state:\n  \"(R0 ===> state_dp_consistency.crel_vs R1) x (state_of o y)\" if \"(R0 ===> state_dp_consistency.crel_vs R1 OO rel_state (=)) x y\"\n  using that\n  unfolding state_of_def\n  apply -\n  apply (rule rel_funI)\n  apply (drule rel_funD, assumption)\n  apply (erule relcomppE)\n  apply auto\n  apply (rule state_dp_consistency.crel_vs_intro)\n  apply auto\n   apply (erule rel_state_elim, assumption)\n    apply (erule state_dp_consistency.crel_vs_elim)\n      apply assumption+\n    apply simp\n  subgoal premises prems for x' y' b M v' M'\n  proof -\n    from prems(2,3) have \"crel_vs1 R1 (x x') (y y')\"\n      unfolding crel_vs1_alt_def by (rule relcomppI)\n    with prems show ?thesis\n      by (auto elim: crel_vs1_executeD)\n  qed\n  subgoal premises prems for x' y' b M v' M'\n  proof -\n    from prems(2,3) have \"crel_vs1 R1 (x x') (y y')\"\n      unfolding crel_vs1_alt_def by (rule relcomppI)\n    with prems show ?thesis\n      by (auto elim: crel_vs1_executeD)\n  qed\n  done\n\nlemma bind_transfer1:\n  \"(crel_vs1 R0 ===> (R0 ===> crel_vs1 R1) ===> crel_vs1 R1) (\\<lambda>v f. f v) (\\<bind>)\"\n  if \"\\<And> x. R0 x x\"\n  unfolding crel_vs1_alt_def\n  apply (rule rel_fun_comp2')\n    apply (rule state_dp_consistency.bind_transfer)\n   apply (rule transfer_bind)\n  apply (drule rel_fun_relcompp)\n  apply (erule rel_fun_mono)\n   defer\n   apply assumption\n  apply (intro impI relcomppI)\n   apply (erule crel_vs_rel_state)\n  by (auto 4 4 dest: rel_funD intro: that elim: rel_state_state_of simp: crel_vs1_alt_def[symmetric])\n\nlemma fun_app_transfer[transfer_rule]:\n  \"(crel_vs1 (R0 ===> crel_vs1 R1) ===> crel_vs1 R0 ===> crel_vs1 R1) App Heap_Monad_Ext.fun_app_lifted\"\n  unfolding App_def Heap_Monad_Ext.fun_app_lifted_def\n  oops\nend (* Lifting Syntax *)\n\nend (* Dynamic Programming Problem *)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Monad_Memo_DP/heap_monad/DP_CRelVH_Ext.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6442251064863697, "lm_q2_score": 0.4687906266262437, "lm_q1q2_score": 0.3020066913581038}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: GPL-2.0-only\n *)\n\ntheory ArchVSpaceLookup_AI\nimports\n  SubMonad_AI\n  \"Lib.Crunch_Instances_NonDet\"\nbegin\n\ndefinition\n  \"lookup_walk cs m ref p \\<equiv> {(r, q). \\<exists>h. ref = h @ r \\<and> (r, q) \\<in> cs\\<^sup>* `` m \\<and> (([], q),h, p) \\<in> cs\\<^sup>*}\"\n\ndefinition\n  \"trans_depends kh cs f \\<equiv> \\<forall>q h p. (([],q),h,p) \\<in> cs = (\\<exists>obj. obj = kh q \\<and> f obj p h)\"\n\ndefinition\n  \"lookup_leaf ptr cs =  {(ref,p). (([],ptr),ref, p) \\<in> cs^*}\"\n\ndefinition\nlookup_refs ::\"'c \\<Rightarrow> ('c \\<Rightarrow> 'b \\<Rightarrow> 'a list \\<Rightarrow> bool) \\<Rightarrow> ('a list \\<times> 'b) set\"\nwhere \"lookup_refs obj f \\<equiv> {(h,p). f obj p h}\"\n\ndefinition\nlookupable_refs :: \"(('a list \\<times> 'b) \\<times> 'a list \\<times> 'b) set \\<Rightarrow> 'a list set \\<Rightarrow> ('a list \\<times> 'b) set \\<Rightarrow> ('a list \\<times> 'b) set\"\nwhere  \"lookupable_refs cs refs m \\<equiv> {(ref, p). \\<exists>tref href. href\\<in>refs \\<and> ref=tref@href \\<and> (tref,p)\\<in>cs^* `` m}\"\n\ndefinition\n  \"reachable vset \\<equiv> (\\<lambda>(ref, p). p) ` vset\"\n\nlocale wellformed_lookup =\n  fixes cs :: \"(('c list \\<times> 'a) \\<times> 'c list \\<times> 'a) set\" and kh and f\n  assumes trans_depends: \"trans_depends kh cs f\"\n  assumes lookup1_is_append:\n      \"((r , q), rs, p) \\<in> cs \\<Longrightarrow> \\<exists>ref. rs = ref # r\"\n  assumes lookup1_append:\n      \"((ra @ b, q), r @ b, p) \\<in> cs \\<Longrightarrow> ((ra, q), r, p) \\<in> cs\"\n  assumes lookup1_cut:\n      \"((ra, q), r, p) \\<in> cs \\<Longrightarrow> ((ra @ b, q), r @ b, p) \\<in> cs\"\n  assumes graph_inject:\n      \"\\<And>p q obj ref. \\<lbrakk>f obj p ref; f obj q ref\\<rbrakk> \\<Longrightarrow> p = q\"\n  assumes graph_single_step:\n      \"\\<And>p obj ref. \\<lbrakk>f obj p ref\\<rbrakk> \\<Longrightarrow> \\<exists>r. ref = [r]\"\n\ncontext wellformed_lookup\nbegin\n\nlemma lookup_refs_lookup1:\n  \"lookup_refs (kh ptr) f = {(h,p). (([],ptr),h,p) \\<in> cs}\"\n  apply (insert  trans_depends)\n  apply (clarsimp simp: trans_depends_def lookup_refs_def)\n  done\n\nlemma lookupable_refs_reach_self:\n  \"(rs, ptr) \\<in> lookupable_refs cs {ref. (ref, ptr) \\<in> cs\\<^sup>* `` rset} refs\n  \\<Longrightarrow> \\<exists>rs'. (rs', ptr) \\<in> cs^* `` rset\"\n  apply (clarsimp simp: lookupable_refs_def Image_def)\n  apply fastforce\n  done\n\nlemma lookup1_append_singleton:\n  \"((a, b), ref # a, q) \\<in> cs \\<Longrightarrow> (([], b), [ref], q) \\<in> cs\"\n  apply (rule lookup1_append)\n  apply fastforce\n  done\n\nlemma lookup1_cut_singleton:\n  \"(([], b), [ref], q) \\<in> cs \\<Longrightarrow> ((a, b), ref # a, q) \\<in> cs \"\n  apply (drule lookup1_cut)\n  apply fastforce\n  done\n\nlemma trans_dependsD:\n  \"(([],p), ref, q ) \\<in> cs \\<Longrightarrow> f (kh p) q ref\"\n  apply (insert trans_depends)\n  apply (simp add: trans_depends_def)\n  done\n\nlemma trans_depends_eq:\n  \"(([],q),h,p) \\<in> cs = f (kh q) p h\"\n  apply (insert trans_depends)\n  apply (clarsimp simp: trans_depends_def)\n  done\n\nlemma lookup_empty_refl:\n  \"((a, p), [], q) \\<in> cs\\<^sup>* \\<Longrightarrow> a = [] \\<and> p = q\"\n  apply (erule rtranclE)\n   apply simp\n  apply (case_tac y)\n  apply (clarsimp dest!: lookup1_is_append)\n  done\n\nlemma lookup_empty_refl_eq[simp]:\n  \"((a, p), [], q) \\<in> cs\\<^sup>* \\<longleftrightarrow> a = [] \\<and> p = q\"\n  using lookup_empty_refl by auto\n\nlemma lookup1_same_leaf:\n  \"\\<lbrakk>(a, refs, p) \\<in> cs; (a, refs, q) \\<in> cs\\<rbrakk> \\<Longrightarrow> p = q\"\n  apply (case_tac a)\n  apply clarsimp\n  apply (frule lookup1_is_append)\n  apply clarsimp\n  apply (drule lookup1_append_singleton)\n  apply (drule lookup1_append_singleton)\n  apply (clarsimp dest!: trans_dependsD)\n  apply (drule graph_inject)\n  apply simp+\n  done\n\nlemma lookup_ref_step:\n  \"((ref, ptr), ref', p) \\<in> cs\\<^sup>* \\<Longrightarrow> \\<exists>r. ref' = r @ ref\"\n  proof (induct \"length ref'\" arbitrary: ref' ref ptr p)\n  case 0\n    assume xs: \"0 = length ref'\"\n      and  \"((ref, ptr), ref', p) \\<in> cs\\<^sup>*\"\n  thus ?case\n    apply simp\n    done\n  next\n  case Suc\n  show ?case\n    apply (cut_tac Suc.prems Suc.hyps(2))\n    apply (erule rtranclE)\n     apply fastforce\n    apply (case_tac y)\n    apply (case_tac ref')\n     apply clarsimp\n    apply simp\n    apply (drule Suc.hyps(1)[rotated])\n     apply (clarsimp dest!: lookup1_is_append )+\n    done\n  qed\n\nlemma lookup_trancl_append_1: (* This is true because the lengh of the lookup is always increased by 1 *)\n  \"((ra @ [b], q), r @ [b], p) \\<in> cs\\<^sup>*\n  \\<Longrightarrow> ((ra, q), r, p) \\<in> cs\\<^sup>*\"\n  proof (induct \"length r - length ra\" arbitrary: ra r q p)\n  case 0\n    assume \"0 = length r - length ra\"\n    and \"((ra @ [b], q), r @ [b], p) \\<in> cs\\<^sup>*\"\n  thus ?case\n    apply simp\n    apply (erule rtranclE)\n     apply simp\n    apply (case_tac y)\n    apply simp\n    apply (frule lookup_ref_step)\n    apply (clarsimp dest!: lookup1_is_append)\n    done\n  next\n  case Suc\n  show ?case\n    apply (insert Suc.prems Suc.hyps(2))\n    apply (erule rtranclE)\n     apply simp\n    apply (case_tac y)\n    apply clarsimp\n    apply (frule lookup_ref_step)\n    apply clarsimp\n    apply (drule Suc.hyps(1)[where r = \"a @ b\" for a b, rotated,simplified])\n     apply (clarsimp dest!: lookup1_is_append)\n    apply (drule lookup1_append[where ra = \"a @ b\" for a b, simplified])\n    apply (erule rtrancl.intros)\n    apply simp\n    done\n  qed\n\n\nlemma lookup_trancl_append:\n  \"((ra @ ref, b), r @ ref, p) \\<in> cs^* \\<Longrightarrow> ((ra, b), r, p) \\<in> cs^*\"\n  proof (induct \"length ref\" arbitrary: ref ra r b p)\n  case 0\n  assume \"((ra @ ref, b), r @ ref, p) \\<in> cs ^*\"\n     and \" 0 = length ref\"\n  thus ?case\n    by simp\n  next\n  case Suc\n  have t: \"\\<And>a b c. a @ b # c = (a @ [b]) @ c\"\n    by auto\n  show ?case\n    apply (insert Suc.prems Suc.hyps(2))\n    apply (case_tac ref)\n     apply clarsimp+\n    apply (subst(asm) t)\n    apply (subst(asm) t[where a = r])\n    apply (frule(1) Suc.hyps(1)[rotated])\n    apply (drule lookup_trancl_append_1)\n    apply fastforce\n    done\n  qed\n\nlemma lookup_leaf_from_lookup:\n  assumes neq: \"ref' \\<noteq> ref\"\n  shows \"\\<lbrakk>((ref, p), ref', q) \\<in> cs\\<^sup>* \\<rbrakk>\n  \\<Longrightarrow> \\<exists>r ptr. ref' = r @ ref \\<and> (([],p),[last r],ptr) \\<in> cs \\<and> (r,q) \\<in> lookup_leaf p cs\"\n  apply (frule lookup_ref_step)\n  apply clarsimp\n  apply (erule converse_rtranclE)\n   apply (insert neq)\n   apply clarsimp\n  apply (case_tac y)\n  apply (rule conjI)\n   apply clarsimp\n   apply (rename_tac r mref ptr)\n   apply (rule_tac x = ptr in exI)\n   subgoal ex\n    apply (clarsimp dest!: lookup_ref_step)\n    apply (rule_tac ra = \"[]\" and b = ref in lookup1_append)\n    apply (frule lookup1_is_append)\n    apply clarsimp\n    done\n  apply (clarsimp simp: lookup_leaf_def)\n  apply (rule converse_rtrancl_into_rtrancl)\n  apply (rule ex)\n      apply simp+\n  apply (rule_tac ref = ref in lookup_trancl_append)\n  apply (frule lookup_ref_step)\n  apply (clarsimp dest!: lookup1_is_append)\n  done\n\nlemma lookupE:\n  assumes rcl: \"((ref, p), ref', q) \\<in> cs\\<^sup>*\"\n  assumes eq: \"\\<lbrakk>ref' = ref; p = q\\<rbrakk> \\<Longrightarrow> P ref' ref p q cs\"\n  and neq: \"\\<And>r ptr. \\<lbrakk>ref' \\<noteq> ref; ref' = r @ ref;  (([],p),[last r],ptr) \\<in> cs; (r,q) \\<in> lookup_leaf p cs\\<rbrakk> \\<Longrightarrow> P ref' ref p q cs\"\n  shows \"P ref' ref p q cs\"\n  apply (insert rcl)\n  apply (case_tac \"ref' = ref\")\n   apply (rule eq)\n    apply simp\n   apply (erule rtranclE)\n    apply simp\n   apply (clarsimp dest!: lookup1_is_append lookup_ref_step)\n  apply (frule(1) lookup_leaf_from_lookup)\n  apply (elim disjE conjE exE)\n  apply (rule neq)\n   apply simp+\n  done\n\nlemma lookup_forwardE:\n  assumes rcl: \"(([], p), ref, q) \\<in> cs\\<^sup>*\"\n  assumes eq: \"\\<lbrakk>ref = []; p = q\\<rbrakk> \\<Longrightarrow> P ref p q cs\"\n  and neq1: \"\\<And>r. \\<lbrakk>ref = [r]; (([], p), [r], q) \\<in> cs\\<rbrakk> \\<Longrightarrow> P ref p q cs\"\n  and neq: \"\\<And>r ptr ref'. \\<lbrakk>ref \\<noteq> []; ref = r @ [ref'];  (([],p),[ref'],ptr) \\<in> cs; (([], ptr), r, q) \\<in> cs\\<^sup>*\\<rbrakk> \\<Longrightarrow> P ref p q cs\"\n  shows \"P ref p q cs\"\n  apply (insert rcl)\n  apply (erule converse_rtranclE)\n   apply (rule eq)\n    apply (simp add: eq)\n   apply simp\n  apply clarsimp\n  apply (frule lookup_ref_step)\n  apply (frule lookup1_is_append)\n  apply (elim exE)+\n  apply (case_tac r)\n   apply (rule neq1)\n    apply simp\n   apply clarsimp\n   apply (erule rtranclE, simp)\n   apply (clarsimp dest!: lookup1_is_append)\n  apply clarsimp\n  apply (drule lookup_trancl_append[where ra = \"[]\" and r = \"h # g\" for h g,simplified])\n  apply (drule neq[rotated 2])\n    apply simp+\n  done\n\nlemma lookup_rtrancl_stepD:\n  \"(([],p), [r], q) \\<in> cs^* \\<Longrightarrow> (([],p),[r],q) \\<in> cs\"\n  apply (erule rtranclE)\n  apply simp\n  apply clarsimp\n  apply (frule lookup_ref_step)\n  apply clarsimp\n  apply (erule rtranclE)\n   apply simp\n  apply (clarsimp dest!: lookup_ref_step lookup1_is_append)\n  done\n\nlemma lookup_rtrancl_stepsD:\n  \"(([], p), r @ [ref'], q) \\<in> cs\\<^sup>* \\<Longrightarrow> \\<exists>ptr. (([],p),[ref'],ptr) \\<in> cs \\<and> (([], ptr), r, q) \\<in> cs\\<^sup>*\"\n  apply (erule lookup_forwardE)\n  apply clarsimp+\n  apply force+\n  done\n\nlemma lookup_trancl_cut_1:\n  (* This is true because the lengh of the lookup is always increased by 1 *)\n  \"((ra, q), r, p) \\<in> cs\\<^sup>* \\<Longrightarrow> ((ra @ [b], q), r @ [b], p) \\<in> cs\\<^sup>*\"\n    proof (induct \"length r - length ra\" arbitrary: ra r q p)\n  case 0\n    assume \" 0 = length r - length ra\"\n    and \"((ra , q), r , p) \\<in> cs\\<^sup>*\"\n  thus ?case\n    apply simp\n    apply (frule lookup_ref_step)\n    apply clarsimp\n    apply (erule rtranclE)\n     apply simp\n    apply (case_tac y)\n    apply simp\n    apply (frule lookup_ref_step)\n    apply (clarsimp dest!: lookup1_is_append)\n    done\n  next\n  case Suc\n  show ?case\n    apply (insert Suc.prems Suc.hyps(2))\n    apply (erule rtranclE)\n     apply simp\n    apply (case_tac y)\n    apply clarsimp\n    apply (frule lookup_ref_step)\n    apply clarsimp\n    apply (drule Suc.hyps(1)[where r = \"a @ b\" for a b, rotated,simplified])\n     apply (clarsimp dest!: lookup1_is_append)\n    apply (erule rtrancl.intros)\n    apply (frule lookup1_cut)\n    apply simp\n    done\n  qed\n\nlemma lookup_trancl_cut:\n  \"((ra, b), r, p) \\<in> cs\\<^sup>* \\<Longrightarrow> ((ra @ ref, b), r @ ref, p) \\<in> cs\\<^sup>*\"\n  proof (induct \"length ref\" arbitrary: ref ra r b p)\n  case 0\n  assume \"((ra, b), r, p) \\<in> cs\\<^sup>*\"\n     and \" 0 = length ref\"\n  thus ?case\n    by simp\n  next\n  case Suc\n  have t: \"\\<And>a b c. a @ b # c = (a @ [b]) @ c\"\n    by auto\n  show ?case\n    apply (insert Suc.prems Suc.hyps(2))\n    apply (case_tac ref rule: rev_cases)\n     apply clarsimp+\n    apply (frule(1) Suc.hyps(1)[rotated])\n    apply (drule lookup_trancl_cut_1)\n        apply (drule lookup_trancl_cut_1)\n    apply fastforce\n    done\n  qed\n\nlemma empty_lookup_walk:\n  \"lookup_walk cs m [] p = {ptr. ptr \\<in> m \\<and> fst ptr = [] \\<and> snd ptr = p }\"\n  by (fastforce simp: lookup_walk_def)\n\nlemma lookup_walk_stepI1:\n  \"\\<lbrakk>p \\<in> lookup_walk cs m ref ptr; (([], ptr), [q], ptr') \\<in> cs\\<rbrakk> \\<Longrightarrow> p \\<in> lookup_walk cs m (q # ref) ptr'\"\n  apply (clarsimp simp: lookup_walk_def)\n  apply (rule conjI, fastforce)\n  apply (erule rtrancl_into_rtrancl)\n  apply (erule lookup1_cut[where ra = \"[]\" and r = \"[q]\", simplified])\n  done\n\nlemma lookup_walk_stepsI1:\n  \"\\<lbrakk>p \\<in> lookup_walk cs m ref ptr; (([], ptr), refs, ptr') \\<in> cs^*\\<rbrakk> \\<Longrightarrow> p \\<in> lookup_walk cs m (refs @ ref) ptr'\"\n  apply (clarsimp simp: lookup_walk_def)\n  apply (rule conjI, fastforce)\n  apply (erule rtrancl_trans)\n  apply (erule lookup_trancl_cut[where ra = \"[]\" and r = \"refs\", simplified])\n  done\n\nlemma lookup_walk_stepI2:\n  \"\\<lbrakk>(ref, ptr) \\<in> lookup_walk cs m ref ptr; (([], ptr), [q], ptr') \\<in> cs\\<rbrakk>\n  \\<Longrightarrow> (q#ref,ptr') \\<in> lookup_walk cs m (q # ref) ptr'\"\n  apply (clarsimp simp: lookup_walk_def Image_def)\n  apply (erule bexI[rotated])\n  apply (erule rtrancl_into_rtrancl)\n  apply (drule lookup1_cut)\n  apply fastforce\n  done\n\nlemma lookup_walk_step_hdD:\n  \"(refs, p) \\<in> lookup_walk cs m refs p \\<Longrightarrow> (refs, p)\\<in> m \\<or> (\\<exists>y. (tl refs,y) \\<in> lookup_walk cs m (tl refs) y \\<and> (([],y), [hd refs], p) \\<in> cs)\"\n  apply (clarsimp simp: lookup_walk_def del: disjCI)\n  apply (erule rtranclE)\n   apply simp\n  apply (rule disjI2)\n  apply (case_tac y, clarsimp)\n  apply (frule lookup1_is_append)\n  apply clarsimp\n  apply (intro conjI exI)\n   apply fastforce\n  apply (erule lookup1_append_singleton)\n  done\n\nlemma lookup_walk_stepD:\n  \"p \\<in> lookup_walk cs m (ref # refs) q\n  \\<Longrightarrow> p = (ref # refs, q)\n      \\<or> (\\<exists>ptr r. r @ (fst p) = refs \\<and> p \\<in> lookup_walk cs m refs ptr \\<and> (([],ptr),[ref], q) \\<in> cs)\"\n  apply (clarsimp simp: lookup_walk_def del: disjCI)\n  apply (erule rtranclE)\n   apply clarsimp\n  apply (case_tac ya, clarsimp del: disjCI)\n  apply (frule lookup1_is_append)\n  apply (clarsimp del: disjCI)\n  apply (rule conjI)\n   apply force\n  apply (intro exI conjI)\n   apply force\n  apply (erule lookup1_append_singleton)\n  done\n\nlemma reachable_walk:\n  \"(ref, p) \\<in> (cs^* `` m) \\<Longrightarrow> (ref, p) \\<in> lookup_walk cs m ref p\"\n  by (clarsimp simp: lookup_walk_def)\n\nlemma lookup_trans_eq:\n  \"((refs, b), refs, p) \\<in> cs\\<^sup>* \\<Longrightarrow> b = p\"\n  by (erule lookup_trancl_append[where ra = \"[]\" and r = \"[]\" , simplified])\n\nlemma lookup1_same_parent:\n  \"\\<lbrakk>(a, refs, p) \\<in> cs; (b, refs, q) \\<in> cs\\<rbrakk> \\<Longrightarrow> fst a = fst b\"\n  apply (insert trans_depends)\n  apply (case_tac a,case_tac b)\n  apply (clarsimp dest!: lookup1_is_append)\n  done\n\nlemma lookupable_is_unique:\n \"\\<lbrakk>(sref, refs, p) \\<in> cs^*; (sref, refs, q) \\<in> cs^* \\<rbrakk>\n \\<Longrightarrow> p = q\"\n  proof (induct \"length refs - length (fst sref)\" arbitrary: p q sref refs)\n  case 0\n  thus ?case\n    apply (insert \"local.0.prems\" \"local.0.hyps\")\n    apply (cases sref, simp)\n    apply (case_tac \"fst sref = refs\")\n     apply (clarsimp dest!: lookup_trans_eq)\n    apply clarsimp\n    apply (drule lookup_leaf_from_lookup[rotated])\n     apply simp\n    apply clarsimp\n    done\n  next\n  case Suc\n  show ?case\n    apply (insert Suc.prems Suc.hyps(2))\n    apply (erule rtranclE, simp)\n    apply (erule rtranclE, simp)\n    apply (frule_tac a = y and b = ya in lookup1_same_parent)\n     apply simp\n    apply (case_tac y, clarsimp)\n    apply (drule(1) Suc.hyps(1)[rotated])\n     apply (fastforce dest!: lookup1_is_append)\n   apply clarsimp\n   apply (erule(1) lookup1_same_leaf)\n   done\n  qed\n\nlemma lookup_walk_reduce:\n  \"(ref, ptr) \\<in> lookup_walk cs m refs q\n  \\<Longrightarrow> (ref, ptr) \\<in> lookup_walk cs m ref ptr\"\n  by (clarsimp simp: lookup_walk_def)\n\nlemma lookup_walk_trivial:\n  \"a \\<in> lookup_walk cs m ref ptr\n  \\<Longrightarrow> (ref, ptr) \\<in> lookup_walk cs m ref ptr\"\n  apply (clarsimp simp: lookup_walk_def Image_def)\n  apply (erule bexI[rotated])\n  apply (erule rtrancl_trans)\n  apply clarsimp\n  apply (drule_tac ref = x in lookup_trancl_cut)\n  apply clarsimp\n  done\n\nlemma lookup_walk_imp_reachable:\n  \"p \\<in> lookup_walk cs m r ptr \\<Longrightarrow> (r, ptr) \\<in> cs^* `` m\"\n  apply (clarsimp simp: lookup_walk_def Image_def)\n  apply (erule bexI[rotated])\n  apply (erule rtrancl_trans)\n  apply (erule lookup_trancl_cut[where ra = \"[]\", simplified])\n  done\n\nlemma lookup_trancl_walk:\n  \"(([], pa), ref, rptr) \\<in> cs\\<^sup>* \\<Longrightarrow> (ref, rptr) \\<in> lookup_walk cs {([],pa)} ref rptr\"\n  by (clarsimp simp: lookup_walk_def)\n\nlemma lookup1_eq_ref:\n  \"(ref, ptr) \\<in> lookup_walk cs m ref p \\<Longrightarrow> p = ptr\"\n  by (clarsimp simp: lookup_walk_def)\n\nlemma lookup_walk_decomp:\n  \"(a, ptr) \\<in> lookup_walk cs rset r rptr \\<Longrightarrow>\n  \\<exists>h. r = h @ a \\<and> (h,rptr) \\<in> lookup_walk cs ({([], ptr)}) h rptr\"\n  apply (clarsimp simp: lookup_walk_def)\n  done\n\nlemma lookup_walk_decomp_more:\n  \"(h @ [b],rptr) \\<in> lookup_walk cs ({([], ptr)}) (h @ [b]) rptr \\<Longrightarrow>\n    \\<exists>p. (([], ptr), [b], p) \\<in> cs \\<and> (([], p), h, rptr) \\<in> cs\\<^sup>*\"\n  apply (clarsimp simp: lookup_walk_def)\n  apply (erule converse_rtranclE)\n   apply clarsimp\n  apply clarsimp\n  apply (frule lookup1_is_append)\n  apply clarsimp\n  apply (frule lookup_ref_step)\n  apply (intro exI conjI)\n   apply force\n  apply (rule lookup_trancl_append)\n  apply force\n  done\n\nlemma lookupable_refs_set:\n  shows \"lookupable_refs cs refs (lookup_refs a f)\n    \\<subseteq> lookupable_refs cs refs (lookup_refs a f - lookup_refs b f) \\<union> lookupable_refs cs refs (lookup_refs b f)\"\n  apply (fastforce simp: lookupable_refs_def Image_def)\n  done\n\nlemma in_lookupable_refsI:\n  \"\\<lbrakk>(ref, ptr) \\<in> cs\\<^sup>* `` rset; f obj b a ; ((a, b), refs, rptr) \\<in> cs\\<^sup>*\\<rbrakk> \\<Longrightarrow>\n  (refs @ ref, rptr) \\<in> lookupable_refs cs {ref. (ref, ptr) \\<in> cs\\<^sup>* `` rset} (lookup_refs obj f)\"\n  apply (clarsimp simp: lookupable_refs_def Image_def)\n  apply (intro exI conjI)\n    apply fastforce\n   apply fastforce\n  apply (clarsimp simp: lookup_refs_def)\n  apply fastforce\n  done\n\n(* The main result for this locale *)\ntheorem khupd_graph_subset:\n  assumes wlcs: \"wellformed_lookup cs' (kh(ptr := obj)) f\"\n  shows \"(refs, p) \\<in> cs'^* `` rset \\<Longrightarrow> \\<exists>sref. (sref, p) \\<in> cs^* `` rset \\<union> lookupable_refs cs\n      {ref. (ref, ptr) \\<in> cs^* `` rset} (lookup_refs obj f)\"\n  proof (induct \"length refs\" arbitrary: refs p)\n   case 0\n   note \"0.prems\" \"0.hyps\"\n   thus ?case\n    apply clarsimp\n    apply (erule rtranclE, fastforce)\n    apply (clarsimp dest!: wellformed_lookup.lookup1_is_append[OF wlcs])\n    done\n   next\n   case Suc\n   thus ?case\n    apply (insert Suc.hyps(2) Suc.prems)\n    apply (clarsimp del: disjCI)\n    apply (erule rtranclE)\n     apply fastforce\n    apply (case_tac y, clarsimp del: disjCI)\n    apply (rename_tac ref mptr)\n    apply (frule  wellformed_lookup.lookup1_is_append[OF wlcs])\n    apply (clarsimp del: disjCI)\n    apply (drule Suc.hyps(1))\n     apply (fastforce simp: Image_def)\n    apply clarsimp\n    apply (case_tac \"mptr = ptr\")\n     apply (elim disjE)\n      apply (rule_tac x = \"refa # sref\" in exI)\n      apply (rule disjI2)\n      apply (clarsimp simp: lookupable_refs_def lookup_refs_def)\n      apply (drule wellformed_lookup.lookup1_append_singleton[OF wlcs])\n      apply (clarsimp dest!:wellformed_lookup.trans_dependsD[OF wlcs])\n      apply ((rule exI | rule conjI | force)+)[1]\n     apply clarsimp\n     apply (clarsimp simp: lookupable_refs_def)\n     apply (intro disjI2 exI conjI | force)+\n      apply (drule wellformed_lookup.lookup1_append_singleton[OF wlcs])\n      apply (clarsimp dest!:wellformed_lookup.trans_dependsD[OF wlcs])\n      apply (fastforce simp: Image_def lookup_refs_def)\n    apply (clarsimp simp: Image_def)\n    apply (drule wellformed_lookup.lookup1_append_singleton[OF wlcs])\n    apply (clarsimp dest!:wellformed_lookup.trans_dependsD[OF wlcs])\n    apply (rule exI)\n    apply (elim disjE)\n     apply (rule disjI1)\n     apply (clarsimp simp: Image_def trans_depends_eq[symmetric])\n     apply ((intro conjI bexI\n              | simp add: obj_at_def\n              | erule lookup1_cut_singleton\n              | erule rtrancl_into_rtrancl)+)[1]\n    apply (rule disjI2)\n    apply (clarsimp simp: lookupable_refs_def Image_def trans_depends_eq[symmetric])\n    apply (intro conjI exI)\n      apply (rule_tac x = \"(aa,ba)\" in bexI)\n       apply simp+\n    apply (clarsimp simp: lookup_refs_def)\n    apply ((intro conjI exI bexI\n              | simp add: obj_at_def\n              | erule lookup1_cut_singleton\n              | erule rtrancl_into_rtrancl)+)[1]\n    done\n   qed\nend\n\nlemma lookup_bound_estimate:\n  assumes wlcs: \"wellformed_lookup cs kh f\"\n  and   wlcs': \"wellformed_lookup cs' kh' f\"\n  and bound: \"\\<And>p. lookup_refs (kh' p) f \\<subseteq> lookup_refs (kh p) f\"\n  shows \"(refs, p) \\<in> cs'^* `` rset \\<Longrightarrow> (refs, p) \\<in> cs^* `` rset\"\n  apply (clarsimp simp: Image_def)\n  apply (erule_tac x = \"(a,b)\" in bexI[rotated])\n  apply (induct refs arbitrary: p)\n   apply (erule rtranclE)\n   apply (clarsimp dest!: wellformed_lookup.lookup1_is_append[OF wlcs'])+\n  apply (erule rtranclE)\n   apply simp\n  apply (rule_tac b = y in rtrancl_into_rtrancl)\n   apply (clarsimp dest!: wellformed_lookup.lookup1_is_append[OF wlcs'])\n  apply (case_tac y,clarsimp)\n  apply (frule wellformed_lookup.lookup_ref_step[OF wlcs'])\n  apply clarsimp\n  apply (frule wellformed_lookup.lookup1_is_append[OF wlcs'])\n  apply clarsimp\n  apply (rule  wellformed_lookup.lookup1_cut[OF wlcs,where ra = \"[]\" and r = \"[a]\" for a,simplified])\n  apply (drule wellformed_lookup.lookup1_append[OF wlcs', where ra = \"[]\" and r = \"[a]\" for a, simplified])\n  apply (simp add: wellformed_lookup.trans_depends_eq[OF wlcs] wellformed_lookup.trans_depends_eq[OF wlcs'])\n  apply (insert bound)\n  apply (clarsimp simp: lookup_refs_def)\n  apply fastforce\n  done\n\nlemma trans_depends_vs_walk:\n  assumes wlcs: \"wellformed_lookup cs kh f\"\n    and   wlcs': \"wellformed_lookup cs' kh' f\"\n    and stick: \"\\<And>r q. (r, q) \\<in> lookup_walk cs m ref p \\<Longrightarrow> kh' q = kh q\"\n  shows \"lookup_walk cs m ref p \\<subseteq> lookup_walk cs' m ref p\"\n  apply (subgoal_tac \"\\<forall>r q. (r, q) \\<in> lookup_walk cs m ref p \\<longrightarrow> kh' q = kh q\")\n  prefer 2\n    apply (clarsimp simp: stick)\n  proof (induct ref arbitrary: p)\n  case Nil\n  show ?case\n    by (simp add: wellformed_lookup.empty_lookup_walk[OF wlcs]\n                  wellformed_lookup.empty_lookup_walk[OF wlcs'])\n  next\n  case Cons\n  show ?case\n    apply clarsimp\n    apply (frule wellformed_lookup.lookup_walk_stepD[OF wlcs])\n    apply (elim disjE)\n     apply clarsimp\n     apply (drule wellformed_lookup.lookup_walk_step_hdD[OF wlcs])\n     apply (erule disjE)\n      apply (fastforce simp: lookup_walk_def Image_def)\n     apply clarsimp\n     apply (rule wellformed_lookup.lookup_walk_stepI2[OF wlcs'])\n      apply (erule subsetD[OF Cons.hyps, rotated])\n      apply clarsimp\n      apply (drule(1) wellformed_lookup.lookup_walk_stepI1[OF wlcs])\n      apply (insert Cons.prems, fastforce)\n     apply (drule(1) wellformed_lookup.lookup_walk_stepI1[OF wlcs])\n     apply (clarsimp simp: wellformed_lookup.trans_depends_eq[OF wlcs] wellformed_lookup.trans_depends_eq[OF wlcs'])\n    apply (elim exE conjE)\n    apply (rule wellformed_lookup.lookup_walk_stepI1[OF wlcs'])\n     apply (erule subsetD[OF Cons.hyps,rotated])\n     apply clarsimp\n      apply (drule(1) wellformed_lookup.lookup_walk_stepI1[OF wlcs])\n      apply (insert Cons.prems, fastforce)\n    apply clarsimp\n    apply (drule_tac ptr = ptr in wellformed_lookup.lookup_walk_trivial[OF wlcs])\n    apply (drule(1) wellformed_lookup.lookup_walk_stepI1[OF wlcs])\n    apply (clarsimp simp: wellformed_lookup.trans_depends_eq[OF wlcs] wellformed_lookup.trans_depends_eq[OF wlcs'])\n    done\n  qed\n\n\nlocale wellformed_order_lookup = wellformed_lookup +\n  fixes ev :: \"'b\\<Rightarrow>nat\" and rset\n  assumes lookup1_increase: \"\\<And>p q r ref. \\<lbrakk>(ref,p) \\<in> cs^* `` rset; (([],p),[r],q) \\<in> cs \\<rbrakk> \\<Longrightarrow> ev (kh p) < ev (kh q)\"\n\ncontext wellformed_order_lookup\nbegin\nlemma lookup1_increaseD:\n  \"\\<lbrakk>(ref,p) \\<in> cs^* `` rset; (([],p),[r],q) \\<in> cs\\<rbrakk> \\<Longrightarrow> ev (kh p) < ev (kh q)\"\n  apply (insert lookup1_increase)\n  apply (fastforce)\n  done\n\nlemma lookup_walk_distinct_strong:\n  \"(ref, ptr) \\<in> lookup_walk cs rset (r @ ref) q \\<Longrightarrow> (ev (kh ptr)) < (ev (kh q)) \\<or> r = []\"\n  proof (induct \"length r\" arbitrary: ref ptr q r)\n  case 0\n  show ?case\n    apply (insert \"local.0\")\n    by clarsimp\n  next\n  case Suc\n  show ?case\n    apply (insert Suc.prems Suc.hyps(2))\n    apply (case_tac r, simp)\n    apply clarsimp\n    apply (drule lookup_walk_stepD)\n    apply (elim disjE, clarsimp)\n    apply clarsimp\n    apply (frule Suc.hyps(1)[rotated])\n     apply fastforce\n    apply (elim disjE)\n     apply (frule lookup_walk_imp_reachable)\n     apply (drule(1) lookup1_increaseD)\n     apply clarsimp\n    apply (frule lookup_walk_imp_reachable)\n    apply (drule(1) lookup1_increaseD)\n    apply (clarsimp dest!:lookup1_eq_ref)\n    done\n  qed\n\nlemma lookup1_trans_increase:\n  \"\\<lbrakk>(ref,p) \\<in> cs^* `` rset; ((a,p),b,q) \\<in> cs^+ \\<rbrakk> \\<Longrightarrow> ev (kh p) < ev (kh q)\"\n  apply (drule reachable_walk)\n  apply (frule lookup_ref_step[OF trancl_into_rtrancl])\n  apply clarsimp\n  apply (drule lookup_walk_stepsI1)\n   apply (rule lookup_trancl_append)\n   apply force\n  apply (drule lookup_walk_distinct_strong)\n  apply clarsimp\n  apply (erule tranclE)\n   apply (clarsimp dest!: lookup1_is_append lookup_ref_step trancl_into_rtrancl)+\n  done\n\nlemma lookup_walk_unique:\n  \"(ref', ptr) \\<in> lookup_walk cs rset ref ptr \\<Longrightarrow> ref = ref'\"\n  proof (induct \"length ref\" arbitrary: ref ptr ref')\n  case 0\n  show ?case\n    apply (insert \"local.0\")\n    by (clarsimp simp:empty_lookup_walk)\n  next\n  case Suc\n  show ?case\n    apply (insert Suc.prems Suc.hyps(2))\n    apply (case_tac ref)\n     apply simp\n    apply clarsimp\n    apply (drule lookup_walk_stepD)\n    apply (elim disjE, clarsimp)\n    apply clarsimp\n    apply (frule lookup_walk_distinct_strong)\n    apply (frule lookup_walk_imp_reachable)\n    apply (drule(1) lookup1_increaseD)\n    apply (clarsimp dest!: lookup1_eq_ref)\n    done\n  qed\n\nlemma lookup_walk_unique_from_root:\n  \"\\<lbrakk>(([], ptr), b, ptr) \\<in> cs^*; (ref,ptr) \\<in> cs^* `` rset\\<rbrakk> \\<Longrightarrow> b = []\"\n  apply (subgoal_tac \"b @ ref = ref\")\n   apply simp\n  apply (rule lookup_walk_unique)\n  apply (simp add: lookup_walk_def)\n  done\n\nlemma  lookup_walk_kh_upd:\n  \"\\<lbrakk>wellformed_order_lookup cs' (kh(ptr := obj)) f ev rset; (q, ptr) \\<in> lookup_walk cs rset q ptr \\<rbrakk>\n    \\<Longrightarrow> (q, ptr) \\<in> lookup_walk cs' rset q ptr\"\n  apply (case_tac q)\n   apply (clarsimp simp: empty_lookup_walk)\n   apply (fastforce simp: lookup_walk_def Image_def)\n  apply clarsimp\n  apply (frule lookup_walk_step_hdD)\n   apply (elim disjE)\n   apply (fastforce simp: lookup_walk_def Image_def)\n  apply (clarsimp simp: Image_def)\n  apply (cut_tac m = rset and ref = list and p = y\n          in trans_depends_vs_walk[OF local.wellformed_lookup_axioms])\n    apply (erule wellformed_order_lookup.axioms)\n   apply clarsimp\n   apply (drule_tac p = \"(r, ptr)\" in lookup_walk_stepI1[rotated])\n    apply simp\n   apply (clarsimp dest!: lookup_walk_unique)\n   apply (drule lookup_walk_decomp)\n   apply simp\n  apply (rule wellformed_lookup.lookup_walk_stepI2)\n    apply (erule wellformed_order_lookup.axioms)\n   apply fastforce\n  apply (subst wellformed_lookup.trans_depends_eq)\n   apply (erule wellformed_order_lookup.axioms)\n  apply (subgoal_tac \"y \\<noteq> ptr\")\n   apply (simp add: trans_depends_eq)\n  apply clarsimp\n   apply (drule_tac p = \"(list, ptr)\" in lookup_walk_stepI1[rotated])\n   apply simp\n  apply (clarsimp dest!: lookup_walk_unique)\n  done\n\nlemma lookup_walk_path_distinct:\n  \"h \\<noteq> [] \\<Longrightarrow> (q, ptr) \\<in> lookup_walk cs rset (h @ q) rptr \\<Longrightarrow> ptr \\<noteq> rptr\"\n  apply (rule ccontr)\n  apply clarsimp\n  apply (drule lookup_walk_unique)\n  apply simp\n  done\n\n(*\n   This lemma should not be used out side of this locale.\n   Please use kpupd_wellformed_order_lookup instead.\n*)\nlemma khupd_wellform_order_lookup_pref:\n  assumes wlos: \"wellformed_order_lookup cs' (kh(ptr := obj)) f ev rset\"\n  shows \"cs'^* `` rset \\<subseteq> cs^* `` rset \\<union> lookupable_refs cs\n      {ref. (ref, ptr) \\<in> cs^* `` rset} (lookup_refs obj f)\"\n  proof -\n  have wlcs: \"wellformed_lookup cs' (kh(ptr := obj)) f\"\n   by (intro wellformed_order_lookup.axioms[OF wlos])\n  have kh_upd_dummy[simp]:\n     \"(kh(ptr := obj, ptr := kh ptr)) = kh\"\n  by auto\n  have l: \"\\<And>ys y q.  ys @ y # q = (ys @ [y]) @ q\"\n  by auto\n  show ?thesis\n  apply (rule subsetI)\n  apply (clarsimp del: disjCI)\n  apply (rename_tac r rptr ref p)\n  apply (erule rtranclE)\n   apply (fastforce simp: wellformed_lookup.empty_lookup_walk[OF wlcs] Image_def)\n  apply (insert wlcs)\n  apply (drule wellformed_lookup.reachable_walk)\n   apply (simp add: Image_def)\n   apply fastforce\n  apply (case_tac \"\\<exists>q. (q, ptr) \\<in> lookup_walk cs' rset r rptr\")\n   apply (clarsimp del: disjCI)\n   apply (frule_tac ptr = ptr in wellformed_lookup.lookup_walk_reduce[OF wlcs])\n   apply (drule_tac obj = \"kh ptr\" and ptr = ptr and cs' = cs in wellformed_order_lookup.lookup_walk_kh_upd[rotated -1,OF _ wlos])\n    apply simp\n    apply (rule wellformed_order_lookup_axioms)\n   apply (frule_tac rptr = rptr in wellformed_lookup.lookup_walk_decomp[OF wlcs])\n   apply (clarsimp del: disjCI)\n   apply (rule_tac xs = h in rev_cases)\n    apply (clarsimp simp: wellformed_lookup.empty_lookup_walk[OF wlcs])\n    apply (simp add: lookup_walk_def)\n   apply (rule disjI2)\n   apply clarsimp\n   apply (drule wellformed_lookup.lookup_walk_decomp_more[OF wlcs])\n   apply clarsimp\n   apply (drule wellformed_lookup.lookup_trancl_walk[OF wlcs])\n   apply (drule_tac ref = q in wellformed_lookup.lookup_walk_reduce[OF wlcs])\n   apply (drule_tac c=\"(ys, rptr)\" in subsetD[OF trans_depends_vs_walk,rotated -1])\n      apply (rule wlcs)\n     apply (rule local.wellformed_lookup_axioms)\n    apply clarsimp\n    apply (drule_tac ref = r in wellformed_lookup.lookup_walk_reduce[OF wlcs])\n    apply (frule_tac ptr = ptr in wellformed_order_lookup.lookup_walk_unique_from_root\n                 [OF wlos _ wellformed_lookup.lookup_walk_imp_reachable[OF wlcs],rotated])\n     apply (erule converse_rtrancl_into_rtrancl)\n     apply (drule wellformed_lookup.lookup_walk_imp_reachable[OF wlcs])+\n     apply (clarsimp simp: Image_def)\n     apply (rule wellformed_lookup.lookup_trancl_cut[OF wlcs, where ra = \"[]\",simplified])\n     apply simp\n    apply simp\n   apply (subst l)\n   apply (rule in_lookupable_refsI)\n     apply (clarsimp dest!: lookup_walk_imp_reachable)\n    apply (drule wellformed_lookup.trans_dependsD[OF wlcs])\n    apply simp\n   apply (rule lookup_trancl_cut[where ra =\"[]\",simplified])\n   apply (clarsimp dest!: lookup_walk_imp_reachable)\n   apply simp\n  apply (cut_tac m = rset and ref=r and p = rptr\n          in trans_depends_vs_walk[OF wlcs local.wellformed_lookup_axioms])\n   apply clarsimp\n  apply (drule subsetD)\n   apply (rule wellformed_lookup.reachable_walk[OF wlcs])\n   apply (clarsimp simp: Image_def)\n   apply (erule bexI[rotated])\n   apply (erule(1) rtrancl_into_rtrancl)\n  apply (simp add: lookup_walk_imp_reachable)\n  done\n  qed\n\nlemma lookupable_refs_reachable:\n  \"lookupable_refs cs {ref. (ref, ptr) \\<in> cs\\<^sup>* `` rset} (lookup_refs (kh ptr) f)\n   \\<subseteq> cs\\<^sup>* `` rset\"\n   apply (clarsimp simp: lookupable_refs_def Image_def lookup_refs_lookup1)\n   apply (erule bexI[rotated])\n   apply (erule rtrancl_trans)\n   apply (frule lookup1_is_append)\n   apply clarsimp\n   apply (erule converse_rtrancl_into_rtrancl[OF lookup1_cut_singleton])\n   apply (drule lookup_trancl_cut)\n   apply force\n   done\n\nlemma khupd_wellformed_order_lookup_private:\n  assumes well_order:\n    \"\\<And>nref np stepref nq sref. \\<lbrakk>(nref,np) \\<in> cs^* `` (lookup_refs obj f); (([],np),[stepref],nq) \\<in> cs; (sref, ptr)\\<in> cs^* `` rset\\<rbrakk>\n    \\<Longrightarrow> ev (kh np) < ev (kh nq)\"\n  and well_order_as_parent:\n    \"\\<And>nref np sref. \\<lbrakk>(nref,np) \\<in> lookup_refs obj f; (sref, ptr)\\<in> cs^* `` rset\\<rbrakk> \\<Longrightarrow> ev (obj) < ev (kh np)\"\n  and well_order_as_leaf:\n    \"\\<And>p r sref. \\<lbrakk>((r, p), sref, ptr) \\<in> cs^+ ;(r, p) \\<in> cs^* `` rset\\<rbrakk> \\<Longrightarrow> ev (kh p) < ev (obj)\"\n  and wlcs: \"wellformed_lookup cs' (kh(ptr := obj)) f\"\n  shows \"ev (kh ptr) \\<le> ev obj \\<Longrightarrow> wellformed_order_lookup cs' (kh(ptr := obj)) f ev rset\"\n  apply (intro wellformed_order_lookup.intro[OF wlcs])\n  apply (intro wellformed_order_lookup_axioms.intro)\n  apply (drule khupd_graph_subset[OF wlcs])\n  apply (clarsimp simp: wellformed_lookup.trans_depends_eq[OF wlcs])\n  apply (elim disjE)\n   apply (clarsimp split: if_splits)\n    apply (cut_tac nref = \"[r]\" and np = q in well_order_as_parent)\n      apply (clarsimp simp: Image_def lookup_refs_def)\n     apply (fastforce simp: Image_def)\n    apply clarsimp\n   apply (clarsimp simp: trans_depends_eq[symmetric])\n   apply (intro conjI impI)\n    apply (rule well_order_as_leaf[rotated])\n     apply (fastforce simp: Image_def)\n    apply (rule r_into_trancl')\n    apply (rule lookup1_cut_singleton)\n    apply force\n   apply (rule lookup1_increase)\n    apply (clarsimp simp: Image_def)\n    apply (erule bexI[rotated])\n    apply simp\n   apply simp\n  apply (clarsimp simp: lookupable_refs_def split: if_splits)\n   apply (cut_tac nref = \"[r]\" and np = q in well_order_as_parent)\n     apply (clarsimp simp: Image_def lookup_refs_def)\n    apply (fastforce simp: Image_def)\n   apply clarsimp\n  apply (clarsimp simp: trans_depends_eq[symmetric])\n  apply (intro conjI impI)\n   apply clarsimp\n   apply (frule well_order_as_parent)\n    apply fastforce\n   apply (drule well_order[rotated])\n     apply fastforce+\n  apply (frule well_order[rotated])\n    apply (fastforce)+\n  done\n\nlemma khupd_wellformed_order_lookup:\n  assumes well_order:\n    \"\\<And>nref np stepref nq sref. \\<lbrakk>(nref,np) \\<in> cs^* `` (lookup_refs obj f - lookup_refs (kh ptr) f); (([],np),[stepref],nq) \\<in> cs; (sref, ptr)\\<in> cs^* `` rset\\<rbrakk>\n    \\<Longrightarrow> ev (kh np) < ev (kh nq)\"\n  and well_order_as_parent:\n    \"\\<And>nref np sref. \\<lbrakk>(nref,np) \\<in> (lookup_refs obj f - lookup_refs (kh ptr) f); (sref, ptr)\\<in> cs^* `` rset\\<rbrakk> \\<Longrightarrow> ev (obj) < ev (kh np)\"\n  and well_order_as_leaf:\n    \"\\<And>p r sref. \\<lbrakk>((r, p), sref, ptr) \\<in> cs^+ ;(r, p) \\<in> cs^* `` rset\\<rbrakk> \\<Longrightarrow> ev (kh p) < ev (obj)\"\n  and wlcs: \"wellformed_lookup cs' (kh(ptr := obj)) f\"\n  shows \"ev (kh ptr) = ev obj \\<Longrightarrow> wellformed_order_lookup cs' (kh(ptr := obj)) f ev rset\"\n  apply (rule khupd_wellformed_order_lookup_private[OF _ _ well_order_as_leaf wlcs])\n       apply clarsimp\n       apply (case_tac \"(a,b) \\<in> lookup_refs (kh ptr) f\")\n        apply (rule lookup1_increaseD)\n         apply (clarsimp simp: Image_def)\n         apply (erule bexI[rotated])\n         apply (erule rtrancl_trans)\n         apply (rule converse_rtrancl_into_rtrancl)\n          apply (simp add: lookup_refs_lookup1)\n          apply (drule_tac b = sref in lookup1_cut[where q = ptr])\n          apply fastforce\n         apply (erule lookup_trancl_cut)\n        apply simp\n       apply (rule well_order, fastforce+)\n     apply clarsimp\n     apply (case_tac \"(nref,np) \\<in> lookup_refs (kh ptr) f\")\n      apply (clarsimp simp: Image_def lookup_refs_lookup1)\n      apply (frule lookup1_is_append)\n      apply clarsimp\n      apply (erule subst)\n       apply (rule lookup1_trans_increase)\n       apply (clarsimp simp: Image_def)\n       apply (erule bexI[rotated])\n        apply (simp add: lookup_refs_lookup1)+\n       apply fastforce\n      apply (rule well_order_as_parent,fastforce+)\n   done\n\n(* The main result for this locale *)\ntheorem khupd_graph_subset:\n  assumes wlos: \"wellformed_order_lookup cs' (kh(ptr := obj)) f ev rset\"\n  shows \"cs'^* `` rset \\<subseteq> cs^* `` rset \\<union> lookupable_refs cs\n      {ref. (ref, ptr) \\<in> cs^* `` rset} (lookup_refs obj f - lookup_refs (kh ptr) f)\"\n  proof -\n  have set_plus_mono: \"\\<And>a b c d. \\<lbrakk>a \\<subseteq> b \\<union> c; c \\<subseteq> d\\<rbrakk> \\<Longrightarrow> a \\<subseteq> b \\<union> d\"\n    by auto\n  show ?thesis\n    apply (insert khupd_wellform_order_lookup_pref[OF wlos])\n    apply (drule set_plus_mono)\n     apply (rule_tac b = \"kh ptr\" in lookupable_refs_set)\n    apply (cut_tac ptr = ptr in lookupable_refs_reachable)\n    apply fastforce\n    done\n  qed\nend\n\ncontext Arch begin global_naming X64\n\nlocale_abbrev \"vs_lookup_leaf ptr s \\<equiv> lookup_leaf ptr (vs_lookup1 s)\"\n\nprimrec vsref_of :: \"vs_ref \\<Rightarrow> word64\"\nwhere\n  \"vsref_of (VSRef x _ ) = x\"\n\ndefinition\n  vs_ref_lvl_arch :: \"arch_kernel_obj \\<Rightarrow> nat\"\nwhere\n  \"vs_ref_lvl_arch atype \\<equiv> case aa_type atype of\n      AASIDPool \\<Rightarrow> 1\n    | APageMapL4 \\<Rightarrow> 2\n    | APDPointerTable \\<Rightarrow> 3\n    | APageDirectory \\<Rightarrow> 4\n    | APageTable \\<Rightarrow> 5\n    | _ \\<Rightarrow> 6\"\n\ndefinition\n  \"vs_ref_lvl obj_opt \\<equiv> case_option 7 (arch_obj_fun_lift vs_ref_lvl_arch 7) obj_opt\"\n\nlemma vs_ref_lvl_arch_obj [simp]:\n  \"vs_ref_lvl (Some (ArchObj aobj)) = vs_ref_lvl_arch aobj\"\n  by (simp add: vs_ref_lvl_def)\n\nlemma vs_ref_lvl_arch_simps [simp]:\n  \"vs_ref_lvl_arch (ASIDPool ap) = 1\"\n  \"vs_ref_lvl_arch (PageMapL4 pm) = 2\"\n  \"vs_ref_lvl_arch (PDPointerTable pdpt) = 3\"\n  \"vs_ref_lvl_arch (PageDirectory pd) = 4\"\n  \"vs_ref_lvl_arch (PageTable pt) = 5\"\n  \"vs_ref_lvl_arch (DataPage dev sz) = 6\"\n  by (auto simp: vs_ref_lvl_arch_def aa_type_def)\n\ndefinition\n  \"vs_lookup1_on_heap_obj \\<equiv> \\<lambda>obj q h. (\\<exists>ko. obj = Some ko \\<and> (\\<exists>r. h = [r] \\<and> (r, q) \\<in> vs_refs ko))\"\n\ndefinition\n  \"vs_lookup_pages1_on_heap_obj \\<equiv> \\<lambda>obj q h. (\\<exists>ko. obj = Some ko \\<and> (\\<exists>r. h = [r] \\<and> (r, q) \\<in> vs_refs_pages ko))\"\n\nsublocale vs_lookup1_wellformed:\n  wellformed_lookup \"vs_lookup1 s\" \"kheap s\" vs_lookup1_on_heap_obj\n  apply unfold_locales\n       apply (clarsimp simp: trans_depends_def vs_lookup1_def obj_at_def vs_lookup1_on_heap_obj_def)+\n   apply (clarsimp simp: vs_refs_def up_ucast_inj_eq graph_of_def\n                  split: kernel_object.splits arch_kernel_obj.splits)\n  apply (clarsimp simp: vs_lookup1_on_heap_obj_def)\n  done\n\nlemmas vs_lookup1_is_wellformed_lookup\n  = vs_lookup1_wellformed.wellformed_lookup_axioms\n\nsublocale vs_lookup_pages1_wellformed:\n  wellformed_lookup \"vs_lookup_pages1 s\" \"kheap s\" vs_lookup_pages1_on_heap_obj\n  apply unfold_locales\n       apply (clarsimp simp: trans_depends_def vs_lookup_pages1_def obj_at_def vs_lookup_pages1_on_heap_obj_def)+\n   apply (clarsimp simp: vs_refs_pages_def up_ucast_inj_eq graph_of_def\n                  split: kernel_object.splits arch_kernel_obj.splits)\n  apply (clarsimp simp: vs_lookup_pages1_on_heap_obj_def)\n  done\n\nlemmas vs_lookup_pages1_is_wellformed_lookup\n  = vs_lookup_pages1_wellformed.wellformed_lookup_axioms\n\nlemma vs_refs_pages_vs_ref_lvl:\n  \"\\<lbrakk> ko_at (ArchObj aobj) p s; (r, q) \\<in> vs_refs_pages (ArchObj aobj); valid_vspace_obj aobj s \\<rbrakk>\n     \\<Longrightarrow> vs_ref_lvl (kheap s p) < vs_ref_lvl (kheap s q)\"\n  apply (cases aobj;\n         clarsimp simp: vs_refs_pages_def graph_of_def ball_ran_eq obj_at_def\n                        pte_ref_pages_def pde_ref_pages_def pdpte_ref_pages_def pml4e_ref_pages_def\n                 split: if_splits pte.splits pde.splits pdpte.splits pml4e.splits;\n         match premises in H [thin]: \"\\<forall>i. P (t i)\" and J: \"t i = v\" for P t i v \\<Rightarrow>\n                              \\<open>insert spec[where x=i, OF H]\\<close>\n                         \\<bar> H [thin]: \"\\<forall>i \\<in> S. P (t i)\" and J: \"t i = v\" for P S t i v \\<Rightarrow>\n                              \\<open>insert bspec[where x=i, OF H]\\<close>)\n  by (auto simp: obj_at_def data_at_def)\n\nlemmas vs_refs_vs_ref_lvl = vs_refs_pages_vs_ref_lvl[OF _ vs_refs_vs_refs_pages]\n\nlemma vs_lookup1_wellformed_order:\n  \"valid_vspace_objs s\n    \\<Longrightarrow> wellformed_order_lookup (vs_lookup1 s) (kheap s) vs_lookup1_on_heap_obj\n                                vs_ref_lvl (vs_asid_refs (x64_asid_table (arch_state s)))\"\n  apply (intro wellformed_order_lookup.intro vs_lookup1_wellformed.wellformed_lookup_axioms\n               wellformed_order_lookup_axioms.intro)\n  apply (simp only: vs_lookup_def2[symmetric])\n  apply (clarsimp simp add: vs_lookup1_def)\n  apply (case_tac ko; (clarsimp simp: vs_refs_def; fail)?; rename_tac ako; clarsimp)\n  apply (frule (2) valid_vspace_objsD)\n  apply (case_tac ako; clarsimp simp: vs_refs_def)\n     apply (drule (1) graph_of_in_ranD; clarsimp simp: obj_at_def)\n    apply (match premises in \"(i,_) \\<in> graph_of _\" for i \\<Rightarrow>\n            \\<open>match premises in H[thin]: \"\\<forall>i. P i\" for P \\<Rightarrow> \\<open>insert spec[where x=i, OF H]\\<close>\n                             \\<bar> H[thin]: \"\\<forall>i\\<in>_. P i\" for P \\<Rightarrow> \\<open>insert bspec[where x=i, OF H]\\<close>\\<close>;\n           fastforce simp: graph_of_def obj_at_def\n                           pde_ref_def pdpte_ref_def pml4e_ref_def\n                    split: pde.splits pdpte.splits pml4e.splits if_splits)+\n  done\n\nlemma vs_lookup_pages1_wellformed_order:\n  \"\\<lbrakk> valid_vspace_objs s; valid_asid_table (x64_asid_table (arch_state s)) s \\<rbrakk>\n    \\<Longrightarrow> wellformed_order_lookup (vs_lookup_pages1 s) (kheap s) vs_lookup_pages1_on_heap_obj\n                                vs_ref_lvl (vs_asid_refs (x64_asid_table (arch_state s)))\"\n  apply (intro wellformed_order_lookup.intro vs_lookup_pages1_wellformed.wellformed_lookup_axioms\n               wellformed_order_lookup_axioms.intro)\n  apply (simp only: vs_lookup_pages_def2[symmetric])\n  apply (clarsimp simp add: vs_lookup_pages1_def)\n  apply (case_tac ko; (clarsimp simp: vs_refs_pages_def; fail)?; rename_tac ako; clarsimp)\n  apply (frule (3) valid_vspace_objsD')\n  apply (case_tac ako; clarsimp simp: vs_refs_pages_def)\n      apply (drule (1) graph_of_in_ranD; clarsimp simp: obj_at_def)\n     apply (match premises in \"(x,y) \\<in> graph_of f\" for f x y \\<Rightarrow>\n             \\<open>match premises in H[thin]: \"\\<forall>i. P i\" for P \\<Rightarrow> \\<open>insert spec[where x=x, OF H]\\<close>\n                              \\<bar> H[thin]: \"\\<forall>i\\<in>_. P i\" for P \\<Rightarrow> \\<open>insert bspec[where x=x, OF H]\\<close>\\<close>;\n            fastforce simp: graph_of_def obj_at_def data_at_def\n                            pte_ref_pages_def pde_ref_pages_def pdpte_ref_pages_def pml4e_ref_pages_def\n                     split: pte.splits pde.splits pdpte.splits pml4e.splits if_splits)+\n  done\n\ndefinition\n  refs_diff :: \"(kernel_object option \\<Rightarrow> 'b \\<Rightarrow> 'a list \\<Rightarrow> bool)\n                  \\<Rightarrow> arch_kernel_obj \\<Rightarrow> 64 word \\<Rightarrow> 'c abstract_state_scheme \\<Rightarrow> ('a list \\<times> 'b) set\"\nwhere\n  \"refs_diff lf obj ptr s = (lookup_refs (Some (ArchObj obj)) lf - lookup_refs (kheap s ptr) lf)\"\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/proof/invariant-abstract/X64/ArchVSpaceLookup_AI.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5813031051514762, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.3019993576431514}}
{"text": "(*  Title:      HOL/Bali/AxExample.thy\n    Author:     David von Oheimb\n*)\n\nsubsection \\<open>Example of a proof based on the Bali axiomatic semantics\\<close>\n\ntheory AxExample\nimports AxSem Example\nbegin\n\ndefinition\n  arr_inv :: \"st \\<Rightarrow> bool\" where\n \"arr_inv = (\\<lambda>s. \\<exists>obj a T el. globs s (Stat Base) = Some obj \\<and>\n                              values obj (Inl (arr, Base)) = Some (Addr a) \\<and>\n                              heap s a = Some \\<lparr>tag=Arr T 2,values=el\\<rparr>)\"\n\nlemma arr_inv_new_obj: \n\"\\<And>a. \\<lbrakk>arr_inv s; new_Addr (heap s)=Some a\\<rbrakk> \\<Longrightarrow> arr_inv (gupd(Inl a\\<mapsto>x) s)\"\napply (unfold arr_inv_def)\napply (force dest!: new_AddrD2)\ndone\n\nlemma arr_inv_set_locals [simp]: \"arr_inv (set_locals l s) = arr_inv s\"\napply (unfold arr_inv_def)\napply (simp (no_asm))\ndone\n\nlemma arr_inv_gupd_Stat [simp]: \n  \"Base \\<noteq> C \\<Longrightarrow> arr_inv (gupd(Stat C\\<mapsto>obj) s) = arr_inv s\"\napply (unfold arr_inv_def)\napply (simp (no_asm_simp))\ndone\n\nlemma ax_inv_lupd [simp]: \"arr_inv (lupd(x\\<mapsto>y) s) = arr_inv s\"\napply (unfold arr_inv_def)\napply (simp (no_asm))\ndone\n\n\ndeclare if_split_asm [split del]\ndeclare lvar_def [simp]\n\nML \\<open>\nfun inst1_tac ctxt s t xs st =\n  (case AList.lookup (op =) (rev (Term.add_var_names (Thm.prop_of st) [])) s of\n    SOME i => PRIMITIVE (Rule_Insts.read_instantiate ctxt [(((s, i), Position.none), t)] xs) st\n  | NONE => Seq.empty);\n\nfun ax_tac ctxt =\n  REPEAT o resolve_tac ctxt [allI] THEN'\n  resolve_tac ctxt\n    @{thms ax_Skip ax_StatRef ax_MethdN ax_Alloc ax_Alloc_Arr ax_SXAlloc_Normal ax_derivs.intros(8-)};\n\\<close>\n\n\ntheorem ax_test: \"tprg,({}::'a triple set)\\<turnstile> \n  {Normal (\\<lambda>Y s Z::'a. heap_free four s \\<and> \\<not>initd Base s \\<and> \\<not> initd Ext s)} \n  .test [Class Base]. \n  {\\<lambda>Y s Z. abrupt s = Some (Xcpt (Std IndOutBound))}\"\napply (unfold test_def arr_viewed_from_def)\napply (tactic \"ax_tac @{context} 1\" (*;;*))\ndefer (* We begin with the last assertion, to synthesise the intermediate\n         assertions, like in the fashion of the weakest\n         precondition. *)\napply  (tactic \"ax_tac @{context} 1\" (* Try *))\ndefer\napply    (tactic \\<open>inst1_tac @{context} \"Q\" \n                 \"\\<lambda>Y s Z. arr_inv (snd s) \\<and> tprg,s\\<turnstile>catch SXcpt NullPointer\" []\\<close>)\nprefer 2\napply    simp\napply   (rule_tac P' = \"Normal (\\<lambda>Y s Z. arr_inv (snd s))\" in conseq1)\nprefer 2\napply    clarsimp\napply   (rule_tac Q' = \"(\\<lambda>Y s Z. Q Y s Z)\\<leftarrow>=False\\<down>=\\<diamondsuit>\" and Q = Q for Q in conseq2)\nprefer 2\napply    simp\napply   (tactic \"ax_tac @{context} 1\" (* While *))\nprefer 2\napply    (rule ax_impossible [THEN conseq1], clarsimp)\napply   (rule_tac P' = \"Normal P\" and P = P for P in conseq1)\nprefer 2\napply    clarsimp\napply   (tactic \"ax_tac @{context} 1\")\napply   (tactic \"ax_tac @{context} 1\" (* AVar *))\nprefer 2\napply    (rule ax_subst_Val_allI)\napply    (tactic \\<open>inst1_tac @{context} \"P'\" \"\\<lambda>a. Normal (PP a\\<leftarrow>x)\" [\"PP\", \"x\"]\\<close>)\napply    (simp del: avar_def2 peek_and_def2)\napply    (tactic \"ax_tac @{context} 1\")\napply   (tactic \"ax_tac @{context} 1\")\n      (* just for clarification: *)\napply   (rule_tac Q' = \"Normal (\\<lambda>Var:(v, f) u ua. fst (snd (avar tprg (Intg 2) v u)) = Some (Xcpt (Std IndOutBound)))\" in conseq2)\nprefer 2\napply    (clarsimp simp add: split_beta)\napply   (tactic \"ax_tac @{context} 1\" (* FVar *))\napply    (tactic \"ax_tac @{context} 2\" (* StatRef *))\napply   (rule ax_derivs.Done [THEN conseq1])\napply   (clarsimp simp add: arr_inv_def inited_def in_bounds_def)\ndefer\napply  (rule ax_SXAlloc_catch_SXcpt)\napply  (rule_tac Q' = \"(\\<lambda>Y (x, s) Z. x = Some (Xcpt (Std NullPointer)) \\<and> arr_inv s) \\<and>. heap_free two\" in conseq2)\nprefer 2\napply   (simp add: arr_inv_new_obj)\napply  (tactic \"ax_tac @{context} 1\") \napply  (rule_tac C = \"Ext\" in ax_Call_known_DynT)\napply     (unfold DynT_prop_def)\napply     (simp (no_asm))\napply    (intro strip)\napply    (rule_tac P' = \"Normal P\" and P = P for P in conseq1)\napply     (tactic \"ax_tac @{context} 1\" (* Methd *))\napply     (rule ax_thin [OF _ empty_subsetI])\napply     (simp (no_asm) add: body_def2)\napply     (tactic \"ax_tac @{context} 1\" (* Body *))\n(* apply       (rule_tac [2] ax_derivs.Abrupt) *)\ndefer\napply      (simp (no_asm))\napply      (tactic \"ax_tac @{context} 1\") (* Comp *)\n            (* The first statement in the  composition \n                 ((Ext)z).vee = 1; Return Null \n                will throw an exception (since z is null). So we can handle\n                Return Null with the Abrupt rule *)\napply       (rule_tac [2] ax_derivs.Abrupt)\n             \napply      (rule ax_derivs.Expr) (* Expr *)\napply      (tactic \"ax_tac @{context} 1\") (* Ass *)\nprefer 2\napply       (rule ax_subst_Var_allI)\napply       (tactic \\<open>inst1_tac @{context} \"P'\" \"\\<lambda>a vs l vf. PP a vs l vf\\<leftarrow>x \\<and>. p\" [\"PP\", \"x\", \"p\"]\\<close>)\napply       (rule allI)\napply       (tactic \\<open>simp_tac (@{context} delloop \"split_all_tac\" delsimps [@{thm peek_and_def2}, @{thm heap_def2}, @{thm subst_res_def2}, @{thm normal_def2}]) 1\\<close>)\napply       (rule ax_derivs.Abrupt)\napply      (simp (no_asm))\napply      (tactic \"ax_tac @{context} 1\" (* FVar *))\napply       (tactic \"ax_tac @{context} 2\", tactic \"ax_tac @{context} 2\", tactic \"ax_tac @{context} 2\")\napply      (tactic \"ax_tac @{context} 1\")\napply     (tactic \\<open>inst1_tac @{context} \"R\" \"\\<lambda>a'. Normal ((\\<lambda>Vals:vs (x, s) Z. arr_inv s \\<and> inited Ext (globs s) \\<and> a' \\<noteq> Null \\<and> vs = [Null]) \\<and>. heap_free two)\" []\\<close>)\napply     fastforce\nprefer 4\napply    (rule ax_derivs.Done [THEN conseq1],force)\napply   (rule ax_subst_Val_allI)\napply   (tactic \\<open>inst1_tac @{context} \"P'\" \"\\<lambda>a. Normal (PP a\\<leftarrow>x)\" [\"PP\", \"x\"]\\<close>)\napply   (simp (no_asm) del: peek_and_def2 heap_free_def2 normal_def2 o_apply)\napply   (tactic \"ax_tac @{context} 1\")\nprefer 2\napply   (rule ax_subst_Val_allI)\napply    (tactic \\<open>inst1_tac @{context} \"P'\" \"\\<lambda>aa v. Normal (QQ aa v\\<leftarrow>y)\" [\"QQ\", \"y\"]\\<close>)\napply    (simp del: peek_and_def2 heap_free_def2 normal_def2)\napply    (tactic \"ax_tac @{context} 1\")\napply   (tactic \"ax_tac @{context} 1\")\napply  (tactic \"ax_tac @{context} 1\")\napply  (tactic \"ax_tac @{context} 1\")\n(* end method call *)\napply (simp (no_asm))\n    (* just for clarification: *)\napply (rule_tac Q' = \"Normal ((\\<lambda>Y (x, s) Z. arr_inv s \\<and> (\\<exists>a. the (locals s (VName e)) = Addr a \\<and> obj_class (the (globs s (Inl a))) = Ext \\<and> \n invocation_declclass tprg IntVir s (the (locals s (VName e))) (ClassT Base)  \n     \\<lparr>name = foo, parTs = [Class Base]\\<rparr> = Ext)) \\<and>. initd Ext \\<and>. heap_free two)\"\n  in conseq2)\nprefer 2\napply  clarsimp\napply (tactic \"ax_tac @{context} 1\")\napply (tactic \"ax_tac @{context} 1\")\ndefer\napply  (rule ax_subst_Var_allI)\napply  (tactic \\<open>inst1_tac @{context} \"P'\" \"\\<lambda>vf. Normal (PP vf \\<and>. p)\" [\"PP\", \"p\"]\\<close>)\napply  (simp (no_asm) del: split_paired_All peek_and_def2 initd_def2 heap_free_def2 normal_def2)\napply  (tactic \"ax_tac @{context} 1\" (* NewC *))\napply  (tactic \"ax_tac @{context} 1\" (* ax_Alloc *))\n     (* just for clarification: *)\napply  (rule_tac Q' = \"Normal ((\\<lambda>Y s Z. arr_inv (store s) \\<and> vf=lvar (VName e) (store s)) \\<and>. heap_free three \\<and>. initd Ext)\" in conseq2)\nprefer 2\napply   (simp add: invocation_declclass_def dynmethd_def)\napply   (unfold dynlookup_def)\napply   (simp add: dynmethd_Ext_foo)\napply   (force elim!: arr_inv_new_obj atleast_free_SucD atleast_free_weaken)\n     (* begin init *)\napply  (rule ax_InitS)\napply     force\napply    (simp (no_asm))\napply   (tactic \\<open>simp_tac (@{context} delloop \"split_all_tac\") 1\\<close>)\napply   (rule ax_Init_Skip_lemma)\napply  (tactic \\<open>simp_tac (@{context} delloop \"split_all_tac\") 1\\<close>)\napply  (rule ax_InitS [THEN conseq1] (* init Base *))\napply      force\napply     (simp (no_asm))\napply    (unfold arr_viewed_from_def)\napply    (rule allI)\napply    (rule_tac P' = \"Normal P\" and P = P for P in conseq1)\napply     (tactic \\<open>simp_tac (@{context} delloop \"split_all_tac\") 1\\<close>)\napply     (tactic \"ax_tac @{context} 1\")\napply     (tactic \"ax_tac @{context} 1\")\napply     (rule_tac [2] ax_subst_Var_allI)\napply      (tactic \\<open>inst1_tac @{context} \"P'\" \"\\<lambda>vf l vfa. Normal (P vf l vfa)\" [\"P\"]\\<close>)\napply     (tactic \\<open>simp_tac (@{context} delloop \"split_all_tac\" delsimps [@{thm split_paired_All}, @{thm peek_and_def2}, @{thm heap_free_def2}, @{thm initd_def2}, @{thm normal_def2}, @{thm supd_lupd}]) 2\\<close>)\napply      (tactic \"ax_tac @{context} 2\" (* NewA *))\napply       (tactic \"ax_tac @{context} 3\" (* ax_Alloc_Arr *))\napply       (tactic \"ax_tac @{context} 3\")\napply      (tactic \\<open>inst1_tac @{context} \"P\" \"\\<lambda>vf l vfa. Normal (P vf l vfa\\<leftarrow>\\<diamondsuit>)\" [\"P\"]\\<close>)\napply      (tactic \\<open>simp_tac (@{context} delloop \"split_all_tac\") 2\\<close>)\napply      (tactic \"ax_tac @{context} 2\")\napply     (tactic \"ax_tac @{context} 1\" (* FVar *))\napply      (tactic \"ax_tac @{context} 2\" (* StatRef *))\napply     (rule ax_derivs.Done [THEN conseq1])\napply     (tactic \\<open>inst1_tac @{context} \"Q\" \"\\<lambda>vf. Normal ((\\<lambda>Y s Z. vf=lvar (VName e) (snd s)) \\<and>. heap_free four \\<and>. initd Base \\<and>. initd Ext)\" []\\<close>)\napply     (clarsimp split del: if_split)\napply     (frule atleast_free_weaken [THEN atleast_free_weaken])\napply     (drule initedD)\napply     (clarsimp elim!: atleast_free_SucD simp add: arr_inv_def)\napply    force\napply   (tactic \\<open>simp_tac (@{context} delloop \"split_all_tac\") 1\\<close>)\napply   (rule ax_triv_Init_Object [THEN peek_and_forget2, THEN conseq1])\napply     (rule wf_tprg)\napply    clarsimp\napply   (tactic \\<open>inst1_tac @{context} \"P\" \"\\<lambda>vf. Normal ((\\<lambda>Y s Z. vf = lvar (VName e) (snd s)) \\<and>. heap_free four \\<and>. initd Ext)\" []\\<close>)\napply   clarsimp\napply  (tactic \\<open>inst1_tac @{context} \"PP\" \"\\<lambda>vf. Normal ((\\<lambda>Y s Z. vf = lvar (VName e) (snd s)) \\<and>. heap_free four \\<and>. Not \\<circ> initd Base)\" []\\<close>)\napply  clarsimp\n     (* end init *)\napply (rule conseq1)\napply (tactic \"ax_tac @{context} 1\")\napply clarsimp\ndone\n\n(*\nwhile (true) {\n  if (i) {throw xcpt;}\n  else i=j\n}\n*)\nlemma Loop_Xcpt_benchmark: \n \"Q = (\\<lambda>Y (x,s) Z. x \\<noteq> None \\<longrightarrow> the_Bool (the (locals s i))) \\<Longrightarrow>  \n  G,({}::'a triple set)\\<turnstile>{Normal (\\<lambda>Y s Z::'a. True)}  \n  .lab1\\<bullet> While(Lit (Bool True)) (If(Acc (LVar i)) (Throw (Acc (LVar xcpt))) Else\n        (Expr (Ass (LVar i) (Acc (LVar j))))). {Q}\"\napply (rule_tac P' = \"Q\" and Q' = \"Q\\<leftarrow>=False\\<down>=\\<diamondsuit>\" in conseq12)\napply  safe\napply  (tactic \"ax_tac @{context} 1\" (* Loop *))\napply   (rule ax_Normal_cases)\nprefer 2\napply    (rule ax_derivs.Abrupt [THEN conseq1], clarsimp simp add: Let_def)\napply   (rule conseq1)\napply    (tactic \"ax_tac @{context} 1\")\napply   clarsimp\nprefer 2\napply  clarsimp\napply (tactic \"ax_tac @{context} 1\" (* If *))\napply  (tactic \n  \\<open>inst1_tac @{context} \"P'\" \"Normal (\\<lambda>s.. (\\<lambda>Y s Z. True)\\<down>=Val (the (locals s i)))\" []\\<close>)\napply  (tactic \"ax_tac @{context} 1\")\napply  (rule conseq1)\napply   (tactic \"ax_tac @{context} 1\")\napply  clarsimp\napply (rule allI)\napply (rule ax_escape)\napply auto\napply  (rule conseq1)\napply   (tactic \"ax_tac @{context} 1\" (* Throw *))\napply   (tactic \"ax_tac @{context} 1\")\napply   (tactic \"ax_tac @{context} 1\")\napply  clarsimp\napply (rule_tac Q' = \"Normal (\\<lambda>Y s Z. True)\" in conseq2)\nprefer 2\napply  clarsimp\napply (rule conseq1)\napply  (tactic \"ax_tac @{context} 1\")\napply  (tactic \"ax_tac @{context} 1\")\nprefer 2\napply   (rule ax_subst_Var_allI)\napply   (tactic \\<open>inst1_tac @{context} \"P'\" \"\\<lambda>b Y ba Z vf. \\<lambda>Y (x,s) Z. x=None \\<and> snd vf = snd (lvar i s)\" []\\<close>)\napply   (rule allI)\napply   (rule_tac P' = \"Normal P\" and P = P for P in conseq1)\nprefer 2\napply    clarsimp\napply   (tactic \"ax_tac @{context} 1\")\napply   (rule conseq1)\napply    (tactic \"ax_tac @{context} 1\")\napply   clarsimp\napply  (tactic \"ax_tac @{context} 1\")\napply clarsimp\ndone\n\nend\n\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/isabelle/src/HOL/Bali/AxExample.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813031051514762, "lm_q2_score": 0.5195213219520929, "lm_q1q2_score": 0.3019993576431514}}
{"text": "section\\<open>The Axiom of Replacement in $M[G]$\\<close>\ntheory Replacement_Axiom\n  imports\n    Least Relative_Univ Separation_Axiom Renaming_Auto\nbegin\n\nrename \"renrep1\" src \"[p,P,leq,o,\\<rho>,\\<tau>]\" tgt \"[V,\\<tau>,\\<rho>,p,\\<alpha>,P,leq,o]\"\n\ndefinition renrep_fn :: \"i \\<Rightarrow> i\" where\n  \"renrep_fn(env) \\<equiv> sum(renrep1_fn,id(length(env)),6,8,length(env))\"\n\ndefinition\n  renrep :: \"[i,i] \\<Rightarrow> i\" where\n  \"renrep(\\<phi>,env) = ren(\\<phi>)`(6#+length(env))`(8#+length(env))`renrep_fn(env)\"\n\nlemma renrep_type [TC]:\n  assumes \"\\<phi>\\<in>formula\" \"env \\<in> list(M)\"\n  shows \"renrep(\\<phi>,env) \\<in> formula\"\n  unfolding renrep_def renrep_fn_def renrep1_fn_def\n  using assms renrep1_thm(1) ren_tc\n  by simp\n\nlemma arity_renrep:\n  assumes  \"\\<phi>\\<in>formula\" \"arity(\\<phi>)\\<le> 6#+length(env)\" \"env \\<in> list(M)\"\n  shows \"arity(renrep(\\<phi>,env)) \\<le> 8#+length(env)\"\n  unfolding  renrep_def renrep_fn_def renrep1_fn_def\n  using assms renrep1_thm(1) arity_ren\n  by simp\n\nlemma renrep_sats :\n  assumes  \"arity(\\<phi>) \\<le> 6 #+ length(env)\"\n          \"[P,leq,o,p,\\<rho>,\\<tau>] @ env \\<in> list(M)\"\n    \"V \\<in> M\" \"\\<alpha> \\<in> M\"\n    \"\\<phi>\\<in>formula\"\n  shows \"sats(M, \\<phi>, [p,P,leq,o,\\<rho>,\\<tau>] @ env) \\<longleftrightarrow> sats(M, renrep(\\<phi>,env), [V,\\<tau>,\\<rho>,p,\\<alpha>,P,leq,o] @ env)\"\n  unfolding  renrep_def renrep_fn_def renrep1_fn_def\n  by (rule sats_iff_sats_ren,insert assms, auto simp add:renrep1_thm(1)[of _ M,simplified]\n        renrep1_thm(2)[simplified,where p=p and \\<alpha>=\\<alpha>])\n\nrename \"renpbdy1\" src \"[\\<rho>,p,\\<alpha>,P,leq,o]\" tgt \"[\\<rho>,p,x,\\<alpha>,P,leq,o]\"\n\ndefinition renpbdy_fn :: \"i \\<Rightarrow> i\" where\n  \"renpbdy_fn(env) \\<equiv> sum(renpbdy1_fn,id(length(env)),6,7,length(env))\"\n\ndefinition\n  renpbdy :: \"[i,i] \\<Rightarrow> i\" where\n  \"renpbdy(\\<phi>,env) = ren(\\<phi>)`(6#+length(env))`(7#+length(env))`renpbdy_fn(env)\"\n\n\nlemma\n  renpbdy_type [TC]: \"\\<phi>\\<in>formula \\<Longrightarrow> env\\<in>list(M) \\<Longrightarrow> renpbdy(\\<phi>,env) \\<in> formula\"\n  unfolding renpbdy_def renpbdy_fn_def renpbdy1_fn_def\n  using  renpbdy1_thm(1) ren_tc\n  by simp\n\nlemma  arity_renpbdy: \"\\<phi>\\<in>formula \\<Longrightarrow> arity(\\<phi>) \\<le> 6 #+ length(env) \\<Longrightarrow> env\\<in>list(M) \\<Longrightarrow> arity(renpbdy(\\<phi>,env)) \\<le> 7 #+ length(env)\"\n  unfolding renpbdy_def renpbdy_fn_def renpbdy1_fn_def\n  using  renpbdy1_thm(1) arity_ren\n  by simp\n\nlemma\n  sats_renpbdy: \"arity(\\<phi>) \\<le> 6 #+ length(nenv) \\<Longrightarrow> [\\<rho>,p,x,\\<alpha>,P,leq,o,\\<pi>] @ nenv \\<in> list(M) \\<Longrightarrow> \\<phi>\\<in>formula \\<Longrightarrow>\n       sats(M, \\<phi>, [\\<rho>,p,\\<alpha>,P,leq,o] @ nenv) \\<longleftrightarrow> sats(M, renpbdy(\\<phi>,nenv), [\\<rho>,p,x,\\<alpha>,P,leq,o] @ nenv)\"\n  unfolding renpbdy_def renpbdy_fn_def renpbdy1_fn_def\n  by (rule sats_iff_sats_ren,auto simp add: renpbdy1_thm(1)[of _ M,simplified]\n                                            renpbdy1_thm(2)[simplified,where \\<alpha>=\\<alpha> and x=x])\n\n\nrename \"renbody1\" src \"[x,\\<alpha>,P,leq,o]\" tgt \"[\\<alpha>,x,m,P,leq,o]\"\n\ndefinition renbody_fn :: \"i \\<Rightarrow> i\" where\n  \"renbody_fn(env) \\<equiv> sum(renbody1_fn,id(length(env)),5,6,length(env))\"\n\ndefinition\n  renbody :: \"[i,i] \\<Rightarrow> i\" where\n  \"renbody(\\<phi>,env) = ren(\\<phi>)`(5#+length(env))`(6#+length(env))`renbody_fn(env)\"\n\nlemma\n  renbody_type [TC]: \"\\<phi>\\<in>formula \\<Longrightarrow> env\\<in>list(M) \\<Longrightarrow> renbody(\\<phi>,env) \\<in> formula\"\n  unfolding renbody_def renbody_fn_def renbody1_fn_def\n  using  renbody1_thm(1) ren_tc\n  by simp\n\nlemma  arity_renbody: \"\\<phi>\\<in>formula \\<Longrightarrow> arity(\\<phi>) \\<le> 5 #+ length(env) \\<Longrightarrow> env\\<in>list(M) \\<Longrightarrow>\n  arity(renbody(\\<phi>,env)) \\<le> 6 #+ length(env)\"\n  unfolding renbody_def renbody_fn_def renbody1_fn_def\n  using  renbody1_thm(1) arity_ren\n  by simp\n\nlemma\n  sats_renbody: \"arity(\\<phi>) \\<le> 5 #+ length(nenv) \\<Longrightarrow> [\\<alpha>,x,m,P,leq,o] @ nenv \\<in> list(M) \\<Longrightarrow> \\<phi>\\<in>formula \\<Longrightarrow>\n       sats(M, \\<phi>, [x,\\<alpha>,P,leq,o] @ nenv) \\<longleftrightarrow> sats(M, renbody(\\<phi>,nenv), [\\<alpha>,x,m,P,leq,o] @ nenv)\"\n  unfolding renbody_def renbody_fn_def renbody1_fn_def\n  by (rule sats_iff_sats_ren, auto simp add:renbody1_thm(1)[of _ M,simplified]\n                                            renbody1_thm(2)[where \\<alpha>=\\<alpha> and m=m,simplified])\n\ncontext G_generic\nbegin\n\nlemma pow_inter_M:\n  assumes\n    \"x\\<in>M\" \"y\\<in>M\"\n  shows\n    \"powerset(##M,x,y) \\<longleftrightarrow> y = Pow(x) \\<inter> M\"\n  using assms by auto\n\n\nschematic_goal sats_prebody_fm_auto:\n  assumes\n    \"\\<phi>\\<in>formula\" \"[P,leq,one,p,\\<rho>,\\<pi>] @ nenv \\<in>list(M)\"  \"\\<alpha>\\<in>M\" \"arity(\\<phi>) \\<le> 2 #+ length(nenv)\"\n  shows\n    \"(\\<exists>\\<tau>\\<in>M. \\<exists>V\\<in>M. is_Vset(##M,\\<alpha>,V) \\<and> \\<tau>\\<in>V \\<and> sats(M,forces(\\<phi>),[p,P,leq,one,\\<rho>,\\<tau>] @ nenv))\n   \\<longleftrightarrow> sats(M,?prebody_fm,[\\<rho>,p,\\<alpha>,P,leq,one] @ nenv)\"\n  apply (insert assms; (rule sep_rules is_Vset_iff_sats[OF _ _ _ _ _ nonempty[simplified]] | simp))\n   apply (rule sep_rules is_Vset_iff_sats is_Vset_iff_sats[OF _ _ _ _ _ nonempty[simplified]] | simp)+\n        apply (rule nonempty[simplified])\n       apply (simp_all)\n    apply (rule length_type[THEN nat_into_Ord], blast)+\n  apply ((rule sep_rules | simp))\n    apply ((rule sep_rules | simp))\n      apply ((rule sep_rules | simp))\n       apply ((rule sep_rules | simp))\n      apply ((rule sep_rules | simp))\n     apply ((rule sep_rules | simp))\n    apply ((rule sep_rules | simp))\n   apply (rule renrep_sats[simplified])\n       apply (insert assms)\n       apply(auto simp add: renrep_type definability)\nproof -\n  from assms\n  have \"nenv\\<in>list(M)\" by simp\n  with \\<open>arity(\\<phi>)\\<le>_\\<close> \\<open>\\<phi>\\<in>_\\<close>\n  show \"arity(forces(\\<phi>)) \\<le> succ(succ(succ(succ(succ(succ(length(nenv)))))))\"\n    using arity_forces_le by simp\nqed\n\n(* The formula synthesized above *)\nsynthesize_notc \"prebody_fm\" from_schematic sats_prebody_fm_auto\n\nlemma prebody_fm_type [TC]:\n  assumes \"\\<phi>\\<in>formula\"\n    \"env \\<in> list(M)\"\n  shows \"prebody_fm(\\<phi>,env)\\<in>formula\"\nproof -\n  from \\<open>\\<phi>\\<in>formula\\<close>\n  have \"forces(\\<phi>)\\<in>formula\" by simp\n  then\n  have \"renrep(forces(\\<phi>),env)\\<in>formula\"\n    using \\<open>env\\<in>list(M)\\<close> by simp\n  then show ?thesis unfolding prebody_fm_def by simp\nqed\n\nlemmas new_fm_defs = fm_defs is_transrec_fm_def is_eclose_fm_def mem_eclose_fm_def\n  finite_ordinal_fm_def is_wfrec_fm_def  Memrel_fm_def eclose_n_fm_def is_recfun_fm_def is_iterates_fm_def\n  iterates_MH_fm_def is_nat_case_fm_def quasinat_fm_def pre_image_fm_def restriction_fm_def\n\nlemma sats_prebody_fm:\n  assumes\n    \"[P,leq,one,p,\\<rho>] @ nenv \\<in>list(M)\" \"\\<phi>\\<in>formula\" \"\\<alpha>\\<in>M\" \"arity(\\<phi>) \\<le> 2 #+ length(nenv)\"\n  shows\n    \"sats(M,prebody_fm(\\<phi>,nenv),[\\<rho>,p,\\<alpha>,P,leq,one] @ nenv) \\<longleftrightarrow>\n     (\\<exists>\\<tau>\\<in>M. \\<exists>V\\<in>M. is_Vset(##M,\\<alpha>,V) \\<and> \\<tau>\\<in>V \\<and> sats(M,forces(\\<phi>),[p,P,leq,one,\\<rho>,\\<tau>] @ nenv))\"\n  unfolding prebody_fm_def using assms sats_prebody_fm_auto by force\n\n\nlemma arity_prebody_fm:\n  assumes\n    \"\\<phi>\\<in>formula\" \"\\<alpha>\\<in>M\" \"env \\<in> list(M)\" \"arity(\\<phi>) \\<le> 2 #+ length(env)\"\n  shows\n    \"arity(prebody_fm(\\<phi>,env))\\<le>6 #+ length(env)\"\n  unfolding prebody_fm_def is_HVfrom_fm_def is_powapply_fm_def\n  using assms new_fm_defs nat_simp_union\n    arity_renrep[of \"forces(\\<phi>)\"] arity_forces_le[simplified] pred_le by auto\n\n\ndefinition\n  body_fm' :: \"[i,i]\\<Rightarrow>i\" where\n  \"body_fm'(\\<phi>,env) \\<equiv> Exists(Exists(And(pair_fm(0,1,2),renpbdy(prebody_fm(\\<phi>,env),env))))\"\n\nlemma body_fm'_type[TC]: \"\\<phi>\\<in>formula \\<Longrightarrow> env\\<in>list(M) \\<Longrightarrow> body_fm'(\\<phi>,env)\\<in>formula\"\n  unfolding body_fm'_def using prebody_fm_type\n  by simp\n\nlemma arity_body_fm':\n  assumes\n    \"\\<phi>\\<in>formula\" \"\\<alpha>\\<in>M\" \"env\\<in>list(M)\" \"arity(\\<phi>) \\<le> 2 #+ length(env)\"\n  shows\n    \"arity(body_fm'(\\<phi>,env))\\<le>5  #+ length(env)\"\n  unfolding body_fm'_def\n  using assms new_fm_defs nat_simp_union arity_prebody_fm pred_le  arity_renpbdy[of \"prebody_fm(\\<phi>,env)\"]\n  by auto\n\nlemma sats_body_fm':\n  assumes\n    \"\\<exists>t p. x=\\<langle>t,p\\<rangle>\" \"x\\<in>M\" \"[\\<alpha>,P,leq,one,p,\\<rho>] @ nenv \\<in>list(M)\" \"\\<phi>\\<in>formula\" \"arity(\\<phi>) \\<le> 2 #+ length(nenv)\"\n  shows\n    \"sats(M,body_fm'(\\<phi>,nenv),[x,\\<alpha>,P,leq,one] @ nenv) \\<longleftrightarrow>\n     sats(M,renpbdy(prebody_fm(\\<phi>,nenv),nenv),[fst(x),snd(x),x,\\<alpha>,P,leq,one] @ nenv)\"\n  using assms fst_snd_closed[OF \\<open>x\\<in>M\\<close>] unfolding body_fm'_def\n  by (auto)\n\ndefinition\n  body_fm :: \"[i,i]\\<Rightarrow>i\" where\n  \"body_fm(\\<phi>,env) \\<equiv> renbody(body_fm'(\\<phi>,env),env)\"\n\nlemma body_fm_type [TC]: \"env\\<in>list(M) \\<Longrightarrow> \\<phi>\\<in>formula \\<Longrightarrow>  body_fm(\\<phi>,env)\\<in>formula\"\n  unfolding body_fm_def by simp\n\nlemma sats_body_fm:\n  assumes\n    \"\\<exists>t p. x=\\<langle>t,p\\<rangle>\" \"[\\<alpha>,x,m,P,leq,one] @ nenv \\<in>list(M)\"\n    \"\\<phi>\\<in>formula\" \"arity(\\<phi>) \\<le> 2 #+ length(nenv)\"\n  shows\n    \"sats(M,body_fm(\\<phi>,nenv),[\\<alpha>,x,m,P,leq,one] @ nenv) \\<longleftrightarrow>\n     sats(M,renpbdy(prebody_fm(\\<phi>,nenv),nenv),[fst(x),snd(x),x,\\<alpha>,P,leq,one] @ nenv)\"\n  using assms sats_body_fm' sats_renbody[OF _ assms(2), symmetric] arity_body_fm'\n  unfolding body_fm_def\n  by auto\n\nlemma sats_renpbdy_prebody_fm:\n  assumes\n    \"\\<exists>t p. x=\\<langle>t,p\\<rangle>\" \"x\\<in>M\" \"[\\<alpha>,m,P,leq,one] @ nenv \\<in>list(M)\"\n    \"\\<phi>\\<in>formula\" \"arity(\\<phi>) \\<le> 2 #+ length(nenv)\"\n  shows\n    \"sats(M,renpbdy(prebody_fm(\\<phi>,nenv),nenv),[fst(x),snd(x),x,\\<alpha>,P,leq,one] @ nenv) \\<longleftrightarrow>\n     sats(M,prebody_fm(\\<phi>,nenv),[fst(x),snd(x),\\<alpha>,P,leq,one] @ nenv)\"\n  using assms fst_snd_closed[OF \\<open>x\\<in>M\\<close>]\n    sats_renpbdy[OF arity_prebody_fm _ prebody_fm_type, of concl:M, symmetric]\n  by force\n\nlemma body_lemma:\n  assumes\n    \"\\<exists>t p. x=\\<langle>t,p\\<rangle>\" \"x\\<in>M\" \"[x,\\<alpha>,m,P,leq,one] @ nenv \\<in>list(M)\"\n    \"\\<phi>\\<in>formula\" \"arity(\\<phi>) \\<le> 2 #+ length(nenv)\"\n  shows\n    \"sats(M,body_fm(\\<phi>,nenv),[\\<alpha>,x,m,P,leq,one] @ nenv) \\<longleftrightarrow>\n  (\\<exists>\\<tau>\\<in>M. \\<exists>V\\<in>M. is_Vset(\\<lambda>a. (##M)(a),\\<alpha>,V) \\<and> \\<tau> \\<in> V \\<and> (snd(x) \\<tturnstile> \\<phi> ([fst(x),\\<tau>]@nenv)))\"\n  using assms sats_body_fm[of x \\<alpha> m nenv] sats_renpbdy_prebody_fm[of x \\<alpha>]\n    sats_prebody_fm[of \"snd(x)\" \"fst(x)\"] fst_snd_closed[OF \\<open>x\\<in>M\\<close>]\n  by (simp, simp flip: setclass_iff,simp)\n\nlemma Replace_sats_in_MG:\n  assumes\n    \"c\\<in>M[G]\" \"env \\<in> list(M[G])\"\n    \"\\<phi> \\<in> formula\" \"arity(\\<phi>) \\<le> 2 #+ length(env)\"\n    \"univalent(##M[G], c, \\<lambda>x v. (M[G] , [x,v]@env \\<Turnstile> \\<phi>) )\"\n  shows\n    \"{v. x\\<in>c, v\\<in>M[G] \\<and> (M[G] , [x,v]@env \\<Turnstile> \\<phi>)} \\<in> M[G]\"\nproof -\n  let ?R = \"\\<lambda> x v . v\\<in>M[G] \\<and> (M[G] , [x,v]@env \\<Turnstile> \\<phi>)\"\n  from \\<open>c\\<in>M[G]\\<close>\n  obtain \\<pi>' where \"val(G, \\<pi>') = c\" \"\\<pi>' \\<in> M\"\n    using GenExt_def by auto\n  then\n  have \"domain(\\<pi>')\\<times>P\\<in>M\" (is \"?\\<pi>\\<in>M\")\n    using cartprod_closed P_in_M domain_closed by simp\n  from \\<open>val(G, \\<pi>') = c\\<close>\n  have \"c \\<subseteq> val(G,?\\<pi>)\"\n    using def_val[of G ?\\<pi>] one_in_P one_in_G[OF generic] elem_of_val\n      domain_of_prod[OF one_in_P, of \"domain(\\<pi>')\"] by force\n  from \\<open>env \\<in> _\\<close>\n  obtain nenv where \"nenv\\<in>list(M)\" \"env = map(val(G),nenv)\"\n    using map_val by auto\n  then\n  have \"length(nenv) = length(env)\" by simp\n  define f where \"f(\\<rho>p) \\<equiv> \\<mu> \\<alpha>. \\<alpha>\\<in>M \\<and> (\\<exists>\\<tau>\\<in>M. \\<tau> \\<in> Vset(\\<alpha>) \\<and>\n        (snd(\\<rho>p) \\<tturnstile> \\<phi> ([fst(\\<rho>p),\\<tau>] @ nenv)))\" (is \"_ \\<equiv> \\<mu> \\<alpha>. ?P(\\<rho>p,\\<alpha>)\") for \\<rho>p\n  have \"f(\\<rho>p) = (\\<mu> \\<alpha>. \\<alpha>\\<in>M \\<and> (\\<exists>\\<tau>\\<in>M. \\<exists>V\\<in>M. is_Vset(##M,\\<alpha>,V) \\<and> \\<tau>\\<in>V \\<and>\n        (snd(\\<rho>p) \\<tturnstile> \\<phi> ([fst(\\<rho>p),\\<tau>] @ nenv))))\" (is \"_ = (\\<mu> \\<alpha>. \\<alpha>\\<in>M \\<and> ?Q(\\<rho>p,\\<alpha>))\") for \\<rho>p\n    unfolding f_def using Vset_abs Vset_closed Ord_Least_cong[of \"?P(\\<rho>p)\" \"\\<lambda> \\<alpha>. \\<alpha>\\<in>M \\<and> ?Q(\\<rho>p,\\<alpha>)\"]\n    by (simp, simp del:setclass_iff)\n  moreover\n  have \"f(\\<rho>p) \\<in> M\" for \\<rho>p\n    unfolding f_def using Least_closed[of \"?P(\\<rho>p)\"] by simp\n  ultimately\n  have 1:\"least(##M,\\<lambda>\\<alpha>. ?Q(\\<rho>p,\\<alpha>),f(\\<rho>p))\" for \\<rho>p\n    using least_abs[of \"\\<lambda>\\<alpha>. \\<alpha>\\<in>M \\<and> ?Q(\\<rho>p,\\<alpha>)\" \"f(\\<rho>p)\"] least_conj\n    by (simp flip: setclass_iff)\n  have \"Ord(f(\\<rho>p))\" for \\<rho>p unfolding f_def by simp\n  define QQ where \"QQ\\<equiv>?Q\"\n  from 1\n  have \"least(##M,\\<lambda>\\<alpha>. QQ(\\<rho>p,\\<alpha>),f(\\<rho>p))\" for \\<rho>p\n    unfolding QQ_def .\n  from \\<open>arity(\\<phi>) \\<le> _\\<close> \\<open>length(nenv) = _\\<close>\n  have \"arity(\\<phi>) \\<le> 2 #+ length(nenv)\"\n    by simp\n  moreover\n  note assms \\<open>nenv\\<in>list(M)\\<close> \\<open>?\\<pi>\\<in>M\\<close>\n  moreover\n  have \"\\<rho>p\\<in>?\\<pi> \\<Longrightarrow> \\<exists>t p. \\<rho>p=\\<langle>t,p\\<rangle>\" for \\<rho>p\n    by auto\n  ultimately\n  have body:\"M , [\\<alpha>,\\<rho>p,m,P,leq,one] @ nenv \\<Turnstile> body_fm(\\<phi>,nenv) \\<longleftrightarrow> ?Q(\\<rho>p,\\<alpha>)\"\n    if \"\\<rho>p\\<in>?\\<pi>\" \"\\<rho>p\\<in>M\" \"m\\<in>M\" \"\\<alpha>\\<in>M\" for \\<alpha> \\<rho>p m\n    using that P_in_M leq_in_M one_in_M body_lemma[of \\<rho>p \\<alpha> m nenv \\<phi>] by simp\n  let ?f_fm=\"least_fm(body_fm(\\<phi>,nenv),1)\"\n  {\n    fix \\<rho>p m\n    assume asm: \"\\<rho>p\\<in>M\" \"\\<rho>p\\<in>?\\<pi>\" \"m\\<in>M\"\n    note inM = this P_in_M leq_in_M one_in_M \\<open>nenv\\<in>list(M)\\<close>\n    with body\n    have body':\"\\<And>\\<alpha>. \\<alpha> \\<in> M \\<Longrightarrow> (\\<exists>\\<tau>\\<in>M. \\<exists>V\\<in>M. is_Vset(\\<lambda>a. (##M)(a), \\<alpha>, V) \\<and> \\<tau> \\<in> V \\<and>\n          (snd(\\<rho>p) \\<tturnstile> \\<phi> ([fst(\\<rho>p),\\<tau>] @ nenv))) \\<longleftrightarrow>\n          M, Cons(\\<alpha>, [\\<rho>p, m, P, leq, one] @ nenv) \\<Turnstile> body_fm(\\<phi>,nenv)\" by simp\n    from inM\n    have \"M , [\\<rho>p,m,P,leq,one] @ nenv \\<Turnstile> ?f_fm \\<longleftrightarrow> least(##M, QQ(\\<rho>p), m)\"\n      using sats_least_fm[OF body', of 1] unfolding QQ_def\n      by (simp, simp flip: setclass_iff)\n  }\n  then\n  have \"M, [\\<rho>p,m,P,leq,one] @ nenv \\<Turnstile> ?f_fm \\<longleftrightarrow> least(##M, QQ(\\<rho>p), m)\"\n    if \"\\<rho>p\\<in>M\" \"\\<rho>p\\<in>?\\<pi>\" \"m\\<in>M\" for \\<rho>p m using that by simp\n  then\n  have \"univalent(##M, ?\\<pi>, \\<lambda>\\<rho>p m. M , [\\<rho>p,m] @ ([P,leq,one] @ nenv) \\<Turnstile> ?f_fm)\"\n    unfolding univalent_def by (auto intro:unique_least)\n  moreover from \\<open>length(_) = _\\<close> \\<open>env \\<in> _\\<close>\n  have \"length([P,leq,one] @ nenv) = 3 #+ length(env)\" by simp\n  moreover from \\<open>arity(_) \\<le> 2 #+ length(nenv)\\<close>\n    \\<open>length(_) = length(_)\\<close>[symmetric] \\<open>nenv\\<in>_\\<close> \\<open>\\<phi>\\<in>_\\<close>\n  have \"arity(?f_fm) \\<le> 5 #+ length(env)\"\n    unfolding body_fm_def  new_fm_defs least_fm_def\n    using arity_forces arity_renrep arity_renbody arity_body_fm' nonempty\n    by (simp add: pred_Un Un_assoc, simp add: Un_assoc[symmetric] nat_union_abs1 pred_Un)\n      (auto simp add: nat_simp_union, rule pred_le, auto intro:leI)\n  moreover from \\<open>\\<phi>\\<in>formula\\<close> \\<open>nenv\\<in>list(M)\\<close>\n  have \"?f_fm\\<in>formula\" by simp\n  moreover\n  note inM = P_in_M leq_in_M one_in_M \\<open>nenv\\<in>list(M)\\<close> \\<open>?\\<pi>\\<in>M\\<close>\n  ultimately\n  obtain Y where \"Y\\<in>M\"\n    \"\\<forall>m\\<in>M. m \\<in> Y \\<longleftrightarrow> (\\<exists>\\<rho>p\\<in>M. \\<rho>p \\<in> ?\\<pi> \\<and> M, [\\<rho>p,m] @ ([P,leq,one] @ nenv) \\<Turnstile> ?f_fm)\"\n    using replacement_ax[of ?f_fm \"[P,leq,one] @ nenv\"]\n    unfolding strong_replacement_def by auto\n  with \\<open>least(_,QQ(_),f(_))\\<close> \\<open>f(_) \\<in> M\\<close> \\<open>?\\<pi>\\<in>M\\<close>\n    \\<open>_ \\<Longrightarrow> _ \\<Longrightarrow> _ \\<Longrightarrow> M,_ \\<Turnstile> ?f_fm \\<longleftrightarrow> least(_,_,_)\\<close>\n  have \"f(\\<rho>p)\\<in>Y\" if \"\\<rho>p\\<in>?\\<pi>\" for \\<rho>p\n    using that transitivity[OF _ \\<open>?\\<pi>\\<in>M\\<close>]\n    by (clarsimp, rule_tac x=\"\\<langle>x,y\\<rangle>\" in bexI, auto)\n  moreover\n  have \"{y\\<in>Y. Ord(y)} \\<in> M\"\n    using \\<open>Y\\<in>M\\<close> separation_ax sats_ordinal_fm trans_M\n      separation_cong[of \"##M\" \"\\<lambda>y. sats(M,ordinal_fm(0),[y])\" \"Ord\"]\n      separation_closed by simp\n  then\n  have \"\\<Union> {y\\<in>Y. Ord(y)} \\<in> M\" (is \"?sup \\<in> M\")\n    using Union_closed by simp\n  then\n  have \"{x\\<in>Vset(?sup). x \\<in> M} \\<in> M\"\n    using Vset_closed by simp\n  moreover\n  have \"{one} \\<in> M\"\n    using one_in_M singletonM by simp\n  ultimately\n  have \"{x\\<in>Vset(?sup). x \\<in> M} \\<times> {one} \\<in> M\" (is \"?big_name \\<in> M\")\n    using cartprod_closed by simp\n  then\n  have \"val(G,?big_name) \\<in> M[G]\"\n    by (blast intro:GenExtI)\n  {\n    fix v x\n    assume \"x\\<in>c\"\n    moreover\n    note \\<open>val(G,\\<pi>')=c\\<close> \\<open>\\<pi>'\\<in>M\\<close>\n    moreover\n    from calculation\n    obtain \\<rho> p where \"\\<langle>\\<rho>,p\\<rangle>\\<in>\\<pi>'\"  \"val(G,\\<rho>) = x\" \"p\\<in>G\" \"\\<rho>\\<in>M\"\n      using elem_of_val_pair'[of \\<pi>' x G] by blast\n    moreover\n    assume \"v\\<in>M[G]\"\n    then\n    obtain \\<sigma> where \"val(G,\\<sigma>) = v\" \"\\<sigma>\\<in>M\"\n      using GenExtD by auto\n    moreover\n    assume \"sats(M[G], \\<phi>, [x,v] @ env)\"\n    moreover\n    note \\<open>\\<phi>\\<in>_\\<close> \\<open>nenv\\<in>_\\<close> \\<open>env = _\\<close> \\<open>arity(\\<phi>)\\<le> 2 #+ length(env)\\<close>\n    ultimately\n    obtain q where \"q\\<in>G\" \"q \\<tturnstile> \\<phi> ([\\<rho>,\\<sigma>]@nenv)\"\n      using truth_lemma[OF \\<open>\\<phi>\\<in>_\\<close> generic, symmetric, of \"[\\<rho>,\\<sigma>] @ nenv\"]\n      by auto\n    with \\<open>\\<langle>\\<rho>,p\\<rangle>\\<in>\\<pi>'\\<close> \\<open>\\<langle>\\<rho>,q\\<rangle>\\<in>?\\<pi> \\<Longrightarrow> f(\\<langle>\\<rho>,q\\<rangle>)\\<in>Y\\<close>\n    have \"f(\\<langle>\\<rho>,q\\<rangle>)\\<in>Y\"\n      using generic unfolding M_generic_def filter_def by blast\n    let ?\\<alpha>=\"succ(rank(\\<sigma>))\"\n    note \\<open>\\<sigma>\\<in>M\\<close>\n    moreover from this\n    have \"?\\<alpha> \\<in> M\"\n      using rank_closed cons_closed by (simp flip: setclass_iff)\n    moreover\n    have \"\\<sigma> \\<in> Vset(?\\<alpha>)\"\n      using Vset_Ord_rank_iff by auto\n    moreover\n    note \\<open>q \\<tturnstile> \\<phi> ([\\<rho>,\\<sigma>] @ nenv)\\<close>\n    ultimately\n    have \"?P(\\<langle>\\<rho>,q\\<rangle>,?\\<alpha>)\" by (auto simp del: Vset_rank_iff)\n    moreover\n    have \"(\\<mu> \\<alpha>. ?P(\\<langle>\\<rho>,q\\<rangle>,\\<alpha>)) = f(\\<langle>\\<rho>,q\\<rangle>)\"\n      unfolding f_def by simp\n    ultimately\n    obtain \\<tau> where \"\\<tau>\\<in>M\" \"\\<tau> \\<in> Vset(f(\\<langle>\\<rho>,q\\<rangle>))\" \"q \\<tturnstile> \\<phi> ([\\<rho>,\\<tau>] @ nenv)\"\n      using LeastI[of \"\\<lambda> \\<alpha>. ?P(\\<langle>\\<rho>,q\\<rangle>,\\<alpha>)\" ?\\<alpha>] by auto\n    with \\<open>q\\<in>G\\<close> \\<open>\\<rho>\\<in>M\\<close> \\<open>nenv\\<in>_\\<close> \\<open>arity(\\<phi>)\\<le> 2 #+ length(nenv)\\<close>\n    have \"M[G], map(val(G),[\\<rho>,\\<tau>] @ nenv) \\<Turnstile> \\<phi>\"\n      using truth_lemma[OF \\<open>\\<phi>\\<in>_\\<close> generic, of \"[\\<rho>,\\<tau>] @ nenv\"] by auto\n    moreover from \\<open>x\\<in>c\\<close> \\<open>c\\<in>M[G]\\<close>\n    have \"x\\<in>M[G]\" using transitivity_MG by simp\n    moreover\n    note \\<open>M[G],[x,v] @ env\\<Turnstile> \\<phi>\\<close> \\<open>env = map(val(G),nenv)\\<close> \\<open>\\<tau>\\<in>M\\<close> \\<open>val(G,\\<rho>)=x\\<close>\n      \\<open>univalent(##M[G],_,_)\\<close> \\<open>x\\<in>c\\<close> \\<open>v\\<in>M[G]\\<close>\n    ultimately\n    have \"v=val(G,\\<tau>)\"\n      using GenExtI[of \\<tau> G] unfolding univalent_def by (auto)\n    from \\<open>\\<tau> \\<in> Vset(f(\\<langle>\\<rho>,q\\<rangle>))\\<close> \\<open>Ord(f(_))\\<close>  \\<open>f(\\<langle>\\<rho>,q\\<rangle>)\\<in>Y\\<close>\n    have \"\\<tau> \\<in> Vset(?sup)\"\n      using Vset_Ord_rank_iff lt_Union_iff[of _ \"rank(\\<tau>)\"] by auto\n    with \\<open>\\<tau>\\<in>M\\<close>\n    have \"val(G,\\<tau>) \\<in> val(G,?big_name)\"\n      using domain_of_prod[of one \"{one}\" \"{x\\<in>Vset(?sup). x \\<in> M}\" ] def_val[of G ?big_name]\n        one_in_G[OF generic] one_in_P  by (auto simp del: Vset_rank_iff)\n    with \\<open>v=val(G,\\<tau>)\\<close>\n    have \"v \\<in> val(G,{x\\<in>Vset(?sup). x \\<in> M} \\<times> {one})\"\n      by simp\n  }\n  then\n  have \"{v. x\\<in>c, ?R(x,v)} \\<subseteq> val(G,?big_name)\" (is \"?repl\\<subseteq>?big\")\n    by blast\n  with \\<open>?big_name\\<in>M\\<close>\n  have \"?repl = {v\\<in>?big. \\<exists>x\\<in>c. sats(M[G], \\<phi>, [x,v] @ env )}\" (is \"_ = ?rhs\")\n  proof(intro equalityI subsetI)\n    fix v\n    assume \"v\\<in>?repl\"\n    with \\<open>?repl\\<subseteq>?big\\<close>\n    obtain x where \"x\\<in>c\" \"M[G], [x, v] @ env \\<Turnstile> \\<phi>\" \"v\\<in>?big\"\n      using subsetD by auto\n    with \\<open>univalent(##M[G],_,_)\\<close> \\<open>c\\<in>M[G]\\<close>\n    show \"v \\<in> ?rhs\"\n      unfolding univalent_def\n      using transitivity_MG ReplaceI[of \"\\<lambda> x v. \\<exists>x\\<in>c. M[G], [x, v] @ env \\<Turnstile> \\<phi>\"] by blast\n  next\n    fix v\n    assume \"v\\<in>?rhs\"\n    then\n    obtain x where\n      \"v\\<in>val(G, ?big_name)\" \"M[G], [x, v] @ env \\<Turnstile> \\<phi>\" \"x\\<in>c\"\n      by blast\n    moreover from this \\<open>c\\<in>M[G]\\<close>\n    have \"v\\<in>M[G]\" \"x\\<in>M[G]\"\n      using transitivity_MG GenExtI[OF \\<open>?big_name\\<in>_\\<close>,of G] by auto\n    moreover from calculation \\<open>univalent(##M[G],_,_)\\<close>\n    have \"?R(x,y) \\<Longrightarrow> y = v\" for y\n      unfolding univalent_def by auto\n    ultimately\n    show \"v\\<in>?repl\"\n      using ReplaceI[of ?R x v c]\n      by blast\n  qed\n  moreover\n  let ?\\<psi> = \"Exists(And(Member(0,2#+length(env)),\\<phi>))\"\n  have \"v\\<in>M[G] \\<Longrightarrow> (\\<exists>x\\<in>c. M[G], [x,v] @ env \\<Turnstile> \\<phi>) \\<longleftrightarrow> M[G], [v] @ env @ [c] \\<Turnstile> ?\\<psi>\"\n    \"arity(?\\<psi>) \\<le> 2 #+ length(env)\" \"?\\<psi>\\<in>formula\"\n    for v\n  proof -\n    fix v\n    assume \"v\\<in>M[G]\"\n    with \\<open>c\\<in>M[G]\\<close>\n    have \"nth(length(env)#+1,[v]@env@[c]) = c\"\n      using  \\<open>env\\<in>_\\<close>nth_concat[of v c \"M[G]\" env]\n      by auto\n    note inMG= \\<open>nth(length(env)#+1,[v]@env@[c]) = c\\<close> \\<open>c\\<in>M[G]\\<close> \\<open>v\\<in>M[G]\\<close> \\<open>env\\<in>_\\<close>\n    show \"(\\<exists>x\\<in>c. M[G], [x,v] @ env \\<Turnstile> \\<phi>) \\<longleftrightarrow> M[G], [v] @ env @ [c] \\<Turnstile> ?\\<psi>\"\n    proof\n      assume \"\\<exists>x\\<in>c. M[G], [x, v] @ env \\<Turnstile> \\<phi>\"\n      then obtain x where\n        \"x\\<in>c\" \"M[G], [x, v] @ env \\<Turnstile> \\<phi>\" \"x\\<in>M[G]\"\n        using transitivity_MG[OF _ \\<open>c\\<in>M[G]\\<close>]\n        by auto\n      with \\<open>\\<phi>\\<in>_\\<close> \\<open>arity(\\<phi>)\\<le>2#+length(env)\\<close> inMG\n      show \"M[G], [v] @ env @ [c] \\<Turnstile> Exists(And(Member(0, 2 #+ length(env)), \\<phi>))\"\n        using arity_sats_iff[of \\<phi> \"[c]\" _ \"[x,v]@env\"]\n        by auto\n    next\n      assume \"M[G], [v] @ env @ [c] \\<Turnstile> Exists(And(Member(0, 2 #+ length(env)), \\<phi>))\"\n      with inMG\n      obtain x where\n        \"x\\<in>M[G]\" \"x\\<in>c\" \"M[G], [x,v]@env@[c] \\<Turnstile> \\<phi>\"\n        by auto\n      with \\<open>\\<phi>\\<in>_\\<close> \\<open>arity(\\<phi>)\\<le>2#+length(env)\\<close> inMG\n      show \"\\<exists>x\\<in>c. M[G], [x, v] @ env\\<Turnstile> \\<phi>\"\n        using arity_sats_iff[of \\<phi> \"[c]\" _ \"[x,v]@env\"]\n        by auto\n    qed\n  next\n    from \\<open>env\\<in>_\\<close> \\<open>\\<phi>\\<in>_\\<close>\n    show \"arity(?\\<psi>)\\<le>2#+length(env)\"\n      using pred_mono[OF _ \\<open>arity(\\<phi>)\\<le>2#+length(env)\\<close>] lt_trans[OF _ le_refl]\n      by (auto simp add:nat_simp_union)\n  next\n    from \\<open>\\<phi>\\<in>_\\<close>\n    show \"?\\<psi>\\<in>formula\" by simp\n  qed\n  moreover from this\n  have \"{v\\<in>?big. \\<exists>x\\<in>c. M[G], [x,v] @ env \\<Turnstile> \\<phi>} = {v\\<in>?big. M[G], [v] @ env @ [c] \\<Turnstile>  ?\\<psi>}\"\n    using transitivity_MG[OF _ GenExtI, OF _ \\<open>?big_name\\<in>M\\<close>]\n    by simp\n  moreover from calculation and \\<open>env\\<in>_\\<close> \\<open>c\\<in>_\\<close> \\<open>?big\\<in>M[G]\\<close>\n  have \"{v\\<in>?big. M[G] , [v] @ env @ [c] \\<Turnstile> ?\\<psi>} \\<in> M[G]\"\n    using Collect_sats_in_MG by auto\n  ultimately\n  show ?thesis by simp\nqed\n\ntheorem strong_replacement_in_MG:\n  assumes\n    \"\\<phi>\\<in>formula\" and \"arity(\\<phi>) \\<le> 2 #+ length(env)\" \"env \\<in> list(M[G])\"\n  shows\n    \"strong_replacement(##M[G],\\<lambda>x v. sats(M[G],\\<phi>,[x,v] @ env))\"\nproof -\n  let ?R=\"\\<lambda>x y . M[G], [x, y] @ env \\<Turnstile> \\<phi>\"\n  {\n    fix A\n    let ?Y=\"{v . x \\<in> A, v\\<in>M[G] \\<and> ?R(x,v)}\"\n    assume 1: \"(##M[G])(A)\"\n      \"\\<forall>x[##M[G]]. x \\<in> A \\<longrightarrow> (\\<forall>y[##M[G]]. \\<forall>z[##M[G]]. ?R(x,y) \\<and> ?R(x,z) \\<longrightarrow> y = z)\"\n    then\n    have \"univalent(##M[G], A, ?R)\" \"A\\<in>M[G]\"\n      unfolding univalent_def by simp_all\n    with assms \\<open>A\\<in>_\\<close>\n    have \"(##M[G])(?Y)\"\n      using Replace_sats_in_MG by auto\n    have \"b \\<in> ?Y \\<longleftrightarrow> (\\<exists>x[##M[G]]. x \\<in> A \\<and> ?R(x,b))\" if \"(##M[G])(b)\" for b\n    proof(rule)\n      from \\<open>A\\<in>_\\<close>\n      show \"\\<exists>x[##M[G]]. x \\<in> A \\<and> ?R(x,b)\" if \"b \\<in> ?Y\"\n        using that transitivity_MG by auto\n    next\n      show \"b \\<in> ?Y\" if \"\\<exists>x[##M[G]]. x \\<in> A \\<and> ?R(x,b)\"\n      proof -\n        from \\<open>(##M[G])(b)\\<close>\n        have \"b\\<in>M[G]\" by simp\n        with that\n        obtain x where \"(##M[G])(x)\" \"x\\<in>A\" \"b\\<in>M[G] \\<and> ?R(x,b)\"\n          by blast\n        moreover from this 1 \\<open>(##M[G])(b)\\<close>\n        have \"x\\<in>M[G]\" \"z\\<in>M[G] \\<and> ?R(x,z) \\<Longrightarrow> b = z\" for z\n          by auto\n        ultimately\n        show ?thesis\n          using ReplaceI[of \"\\<lambda> x y. y\\<in>M[G] \\<and> ?R(x,y)\"] by auto\n      qed\n    qed\n    then\n    have \"\\<forall>b[##M[G]]. b \\<in> ?Y \\<longleftrightarrow> (\\<exists>x[##M[G]]. x \\<in> A \\<and> ?R(x,b))\"\n      by simp\n    with \\<open>(##M[G])(?Y)\\<close>\n    have \" (\\<exists>Y[##M[G]]. \\<forall>b[##M[G]]. b \\<in> Y \\<longleftrightarrow> (\\<exists>x[##M[G]]. x \\<in> A \\<and> ?R(x,b)))\"\n      by auto\n  }\n  then show ?thesis unfolding strong_replacement_def univalent_def\n    by auto\nqed\n\nend (* context G_generic *)\n\nend", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Forcing/Replacement_Axiom.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5813030906443133, "lm_q2_score": 0.519521321952093, "lm_q1q2_score": 0.30199935010637097}}
{"text": "section \\<open>Operational Semantics\\<close>\n\ntheory RG_Tran\nimports RG_Com\nbegin\n\nsubsection \\<open>Semantics of Component Programs\\<close>\n\nsubsubsection \\<open>Environment transitions\\<close>\n\ntype_synonym 'a conf = \"(('a com) option) \\<times> 'a\"\n\ninductive_set\n  etran :: \"('a conf \\<times> 'a conf) set\" \n  and etran' :: \"'a conf \\<Rightarrow> 'a conf \\<Rightarrow> bool\"  (\"_ -e\\<rightarrow> _\" [81,81] 80)\nwhere\n  \"P -e\\<rightarrow> Q \\<equiv> (P,Q) \\<in> etran\"\n| Env: \"(P, s) -e\\<rightarrow> (P, t)\"\n\nlemma etranE: \"c -e\\<rightarrow> c' \\<Longrightarrow> (\\<And>P s t. c = (P, s) \\<Longrightarrow> c' = (P, t) \\<Longrightarrow> Q) \\<Longrightarrow> Q\"\n  by (induct c, induct c', erule etran.cases, blast)\n\nsubsubsection \\<open>Component transitions\\<close>\n\ninductive_set\n  ctran :: \"('a conf \\<times> 'a conf) set\"\n  and ctran' :: \"'a conf \\<Rightarrow> 'a conf \\<Rightarrow> bool\"   (\"_ -c\\<rightarrow> _\" [81,81] 80)\n  and ctrans :: \"'a conf \\<Rightarrow> 'a conf \\<Rightarrow> bool\"   (\"_ -c*\\<rightarrow> _\" [81,81] 80)\nwhere\n  \"P -c\\<rightarrow> Q \\<equiv> (P,Q) \\<in> ctran\"\n| \"P -c*\\<rightarrow> Q \\<equiv> (P,Q) \\<in> ctran\\<^sup>*\"\n\n| Basic:  \"(Some(Basic f), s) -c\\<rightarrow> (None, f s)\"\n\n| Seq1:   \"(Some P0, s) -c\\<rightarrow> (None, t) \\<Longrightarrow> (Some(Seq P0 P1), s) -c\\<rightarrow> (Some P1, t)\"\n\n| Seq2:   \"(Some P0, s) -c\\<rightarrow> (Some P2, t) \\<Longrightarrow> (Some(Seq P0 P1), s) -c\\<rightarrow> (Some(Seq P2 P1), t)\"\n\n| CondT: \"s\\<in>b  \\<Longrightarrow> (Some(Cond b P1 P2), s) -c\\<rightarrow> (Some P1, s)\"\n| CondF: \"s\\<notin>b \\<Longrightarrow> (Some(Cond b P1 P2), s) -c\\<rightarrow> (Some P2, s)\"\n\n| WhileF: \"s\\<notin>b \\<Longrightarrow> (Some(While b P), s) -c\\<rightarrow> (None, s)\"\n| WhileT: \"s\\<in>b  \\<Longrightarrow> (Some(While b P), s) -c\\<rightarrow> (Some(Seq P (While b P)), s)\"\n\n| Await:  \"\\<lbrakk>s\\<in>b; (Some P, s) -c*\\<rightarrow> (None, t)\\<rbrakk> \\<Longrightarrow> (Some(Await b P), s) -c\\<rightarrow> (None, t)\" \n\nmonos \"rtrancl_mono\"\n\nsubsection \\<open>Semantics of Parallel Programs\\<close>\n\ntype_synonym 'a par_conf = \"('a par_com) \\<times> 'a\"\n\ninductive_set\n  par_etran :: \"('a par_conf \\<times> 'a par_conf) set\"\n  and par_etran' :: \"['a par_conf,'a par_conf] \\<Rightarrow> bool\" (\"_ -pe\\<rightarrow> _\" [81,81] 80)\nwhere\n  \"P -pe\\<rightarrow> Q \\<equiv> (P,Q) \\<in> par_etran\"\n| ParEnv:  \"(Ps, s) -pe\\<rightarrow> (Ps, t)\"\n\ninductive_set\n  par_ctran :: \"('a par_conf \\<times> 'a par_conf) set\"\n  and par_ctran' :: \"['a par_conf,'a par_conf] \\<Rightarrow> bool\" (\"_ -pc\\<rightarrow> _\" [81,81] 80)\nwhere\n  \"P -pc\\<rightarrow> Q \\<equiv> (P,Q) \\<in> par_ctran\"\n| ParComp: \"\\<lbrakk>i<length Ps; (Ps!i, s) -c\\<rightarrow> (r, t)\\<rbrakk> \\<Longrightarrow> (Ps, s) -pc\\<rightarrow> (Ps[i:=r], t)\"\n\nlemma par_ctranE: \"c -pc\\<rightarrow> c' \\<Longrightarrow>\n  (\\<And>i Ps s r t. c = (Ps, s) \\<Longrightarrow> c' = (Ps[i := r], t) \\<Longrightarrow> i < length Ps \\<Longrightarrow>\n     (Ps ! i, s) -c\\<rightarrow> (r, t) \\<Longrightarrow> P) \\<Longrightarrow> P\"\n  by (induct c, induct c', erule par_ctran.cases, blast)\n\nsubsection \\<open>Computations\\<close>\n\nsubsubsection \\<open>Sequential computations\\<close>\n\ntype_synonym 'a confs = \"'a conf list\"\n\ninductive_set cptn :: \"'a confs set\"\nwhere\n  CptnOne: \"[(P,s)] \\<in> cptn\"\n| CptnEnv: \"(P, t)#xs \\<in> cptn \\<Longrightarrow> (P,s)#(P,t)#xs \\<in> cptn\"\n| CptnComp: \"\\<lbrakk>(P,s) -c\\<rightarrow> (Q,t); (Q, t)#xs \\<in> cptn \\<rbrakk> \\<Longrightarrow> (P,s)#(Q,t)#xs \\<in> cptn\"\n\ndefinition cp :: \"('a com) option \\<Rightarrow> 'a \\<Rightarrow> ('a confs) set\" where\n  \"cp P s \\<equiv> {l. l!0=(P,s) \\<and> l \\<in> cptn}\"  \n\nsubsubsection \\<open>Parallel computations\\<close>\n\ntype_synonym 'a par_confs = \"'a par_conf list\"\n\ninductive_set par_cptn :: \"'a par_confs set\"\nwhere\n  ParCptnOne: \"[(P,s)] \\<in> par_cptn\"\n| ParCptnEnv: \"(P,t)#xs \\<in> par_cptn \\<Longrightarrow> (P,s)#(P,t)#xs \\<in> par_cptn\"\n| ParCptnComp: \"\\<lbrakk> (P,s) -pc\\<rightarrow> (Q,t); (Q,t)#xs \\<in> par_cptn \\<rbrakk> \\<Longrightarrow> (P,s)#(Q,t)#xs \\<in> par_cptn\"\n\ndefinition par_cp :: \"'a par_com \\<Rightarrow> 'a \\<Rightarrow> ('a par_confs) set\" where\n  \"par_cp P s \\<equiv> {l. l!0=(P,s) \\<and> l \\<in> par_cptn}\"  \n\nsubsection\\<open>Modular Definition of Computation\\<close>\n\ndefinition lift :: \"'a com \\<Rightarrow> 'a conf \\<Rightarrow> 'a conf\" where\n  \"lift Q \\<equiv> \\<lambda>(P, s). (if P=None then (Some Q,s) else (Some(Seq (the P) Q), s))\"\n\ninductive_set cptn_mod :: \"('a confs) set\"\nwhere\n  CptnModOne: \"[(P, s)] \\<in> cptn_mod\"\n| CptnModEnv: \"(P, t)#xs \\<in> cptn_mod \\<Longrightarrow> (P, s)#(P, t)#xs \\<in> cptn_mod\"\n| CptnModNone: \"\\<lbrakk>(Some P, s) -c\\<rightarrow> (None, t); (None, t)#xs \\<in> cptn_mod \\<rbrakk> \\<Longrightarrow> (Some P,s)#(None, t)#xs \\<in>cptn_mod\"\n| CptnModCondT: \"\\<lbrakk>(Some P0, s)#ys \\<in> cptn_mod; s \\<in> b \\<rbrakk> \\<Longrightarrow> (Some(Cond b P0 P1), s)#(Some P0, s)#ys \\<in> cptn_mod\"\n| CptnModCondF: \"\\<lbrakk>(Some P1, s)#ys \\<in> cptn_mod; s \\<notin> b \\<rbrakk> \\<Longrightarrow> (Some(Cond b P0 P1), s)#(Some P1, s)#ys \\<in> cptn_mod\"\n| CptnModSeq1: \"\\<lbrakk>(Some P0, s)#xs \\<in> cptn_mod; zs=map (lift P1) xs \\<rbrakk>\n                 \\<Longrightarrow> (Some(Seq P0 P1), s)#zs \\<in> cptn_mod\"\n| CptnModSeq2: \n  \"\\<lbrakk>(Some P0, s)#xs \\<in> cptn_mod; fst(last ((Some P0, s)#xs)) = None; \n  (Some P1, snd(last ((Some P0, s)#xs)))#ys \\<in> cptn_mod; \n  zs=(map (lift P1) xs)@ys \\<rbrakk> \\<Longrightarrow> (Some(Seq P0 P1), s)#zs \\<in> cptn_mod\"\n\n| CptnModWhile1: \n  \"\\<lbrakk> (Some P, s)#xs \\<in> cptn_mod; s \\<in> b; zs=map (lift (While b P)) xs \\<rbrakk> \n  \\<Longrightarrow> (Some(While b P), s)#(Some(Seq P (While b P)), s)#zs \\<in> cptn_mod\"\n| CptnModWhile2: \n  \"\\<lbrakk> (Some P, s)#xs \\<in> cptn_mod; fst(last ((Some P, s)#xs))=None; s \\<in> b; \n  zs=(map (lift (While b P)) xs)@ys; \n  (Some(While b P), snd(last ((Some P, s)#xs)))#ys \\<in> cptn_mod\\<rbrakk> \n  \\<Longrightarrow> (Some(While b P), s)#(Some(Seq P (While b P)), s)#zs \\<in> cptn_mod\"\n\nsubsection \\<open>Equivalence of Both Definitions.\\<close>\n\nlemma last_length: \"((a#xs)!(length xs))=last (a#xs)\"\n  by (induct xs) auto\n\nlemma div_seq [rule_format]: \"list \\<in> cptn_mod \\<Longrightarrow>\n (\\<forall>s P Q zs. list=(Some (Seq P Q), s)#zs \\<longrightarrow>\n  (\\<exists>xs. (Some P, s)#xs \\<in> cptn_mod  \\<and> (zs=(map (lift Q) xs) \\<or>\n  ( fst(((Some P, s)#xs)!length xs)=None \\<and> \n  (\\<exists>ys. (Some Q, snd(((Some P, s)#xs)!length xs))#ys \\<in> cptn_mod  \n  \\<and> zs=(map (lift (Q)) xs)@ys)))))\"\napply(erule cptn_mod.induct)\napply simp_all\n    apply clarify\n    apply(force intro:CptnModOne)\n   apply clarify\n   apply(erule_tac x=Pa in allE)\n   apply(erule_tac x=Q in allE)\n   apply simp\n   apply clarify\n   apply(erule disjE)\n    apply(rule_tac x=\"(Some Pa,t)#xsa\" in exI)\n    apply(rule conjI)\n     apply clarify\n     apply(erule CptnModEnv)\n    apply(rule disjI1)\n    apply(simp add:lift_def)\n   apply clarify\n   apply(rule_tac x=\"(Some Pa,t)#xsa\" in exI)\n   apply(rule conjI)\n    apply(erule CptnModEnv)\n   apply(rule disjI2)\n   apply(rule conjI)\n    apply(case_tac xsa,simp,simp)\n   apply(rule_tac x=\"ys\" in exI)\n   apply(rule conjI)\n    apply simp\n   apply(simp add:lift_def)\n  apply clarify\n  apply(erule ctran.cases,simp_all)\n apply clarify\n apply(rule_tac x=\"xs\" in exI)\n apply simp\n apply clarify\napply(rule_tac x=\"xs\" in exI)\napply(simp add: last_length)\ndone\n\nlemma cptn_onlyif_cptn_mod_aux [rule_format]:\n  \"\\<forall>s Q t xs.((Some a, s), Q, t) \\<in> ctran \\<longrightarrow> (Q, t) # xs \\<in> cptn_mod \n  \\<longrightarrow> (Some a, s) # (Q, t) # xs \\<in> cptn_mod\"\n  supply [[simproc del: defined_all]]\napply(induct a)\napply simp_all\n\\<comment> \\<open>basic\\<close>\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,rule Basic,simp)\napply clarify\napply(erule ctran.cases,simp_all)\n\\<comment> \\<open>Seq1\\<close>\napply(rule_tac xs=\"[(None,ta)]\" in CptnModSeq2)\n  apply(erule CptnModNone)\n  apply(rule CptnModOne)\n apply simp\napply simp\napply(simp add:lift_def)\n\\<comment> \\<open>Seq2\\<close>\napply(erule_tac x=sa in allE)\napply(erule_tac x=\"Some P2\" in allE)\napply(erule allE,erule impE, assumption)\napply(drule div_seq,simp)\napply clarify\napply(erule disjE)\n apply clarify\n apply(erule allE,erule impE, assumption)\n apply(erule_tac CptnModSeq1)\n apply(simp add:lift_def)\napply clarify \napply(erule allE,erule impE, assumption)\napply(erule_tac CptnModSeq2)\n  apply (simp add:last_length)\n apply (simp add:last_length)\napply(simp add:lift_def)\n\\<comment> \\<open>Cond\\<close>\napply clarify\napply(erule ctran.cases,simp_all)\napply(force elim: CptnModCondT)\napply(force elim: CptnModCondF)\n\\<comment> \\<open>While\\<close>\napply  clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,erule WhileF,simp)\napply(drule div_seq,force)\napply clarify\napply (erule disjE)\n apply(force elim:CptnModWhile1)\napply clarify\napply(force simp add:last_length elim:CptnModWhile2)\n\\<comment> \\<open>await\\<close>\napply clarify\napply(erule ctran.cases,simp_all)\napply(rule CptnModNone,erule Await,simp+)\ndone\n\nlemma cptn_onlyif_cptn_mod [rule_format]: \"c \\<in> cptn \\<Longrightarrow> c \\<in> cptn_mod\"\napply(erule cptn.induct)\n  apply(rule CptnModOne)\n apply(erule CptnModEnv)\napply(case_tac P)\n apply simp\n apply(erule ctran.cases,simp_all)\napply(force elim:cptn_onlyif_cptn_mod_aux)\ndone\n\nlemma lift_is_cptn: \"c\\<in>cptn \\<Longrightarrow> map (lift P) c \\<in> cptn\"\napply(erule cptn.induct)\n  apply(force simp add:lift_def CptnOne)\n apply(force intro:CptnEnv simp add:lift_def)\napply(force simp add:lift_def intro:CptnComp Seq2 Seq1 elim:ctran.cases)\ndone\n\nlemma cptn_append_is_cptn [rule_format]: \n \"\\<forall>b a. b#c1\\<in>cptn \\<longrightarrow>  a#c2\\<in>cptn \\<longrightarrow> (b#c1)!length c1=a \\<longrightarrow> b#c1@c2\\<in>cptn\"\napply(induct c1)\n apply simp\napply clarify\napply(erule cptn.cases,simp_all)\n apply(force intro:CptnEnv)\napply(force elim:CptnComp)\ndone\n\nlemma last_lift: \"\\<lbrakk>xs\\<noteq>[]; fst(xs!(length xs - (Suc 0)))=None\\<rbrakk> \n \\<Longrightarrow> fst((map (lift P) xs)!(length (map (lift P) xs)- (Suc 0)))=(Some P)\"\n  by (cases \"(xs ! (length xs - (Suc 0)))\") (simp add:lift_def)\n\nlemma last_fst [rule_format]: \"P((a#x)!length x) \\<longrightarrow> \\<not>P a \\<longrightarrow> P (x!(length x - (Suc 0)))\" \n  by (induct x) simp_all\n\nlemma last_fst_esp: \n \"fst(((Some a,s)#xs)!(length xs))=None \\<Longrightarrow> fst(xs!(length xs - (Suc 0)))=None\" \napply(erule last_fst)\napply simp\ndone\n\nlemma last_snd: \"xs\\<noteq>[] \\<Longrightarrow> \n  snd(((map (lift P) xs))!(length (map (lift P) xs) - (Suc 0)))=snd(xs!(length xs - (Suc 0)))\"\n  by (cases \"(xs ! (length xs - (Suc 0)))\") (simp_all add:lift_def)\n\nlemma Cons_lift: \"(Some (Seq P Q), s) # (map (lift Q) xs) = map (lift Q) ((Some P, s) # xs)\"\n  by (simp add:lift_def)\n\nlemma Cons_lift_append: \n  \"(Some (Seq P Q), s) # (map (lift Q) xs) @ ys = map (lift Q) ((Some P, s) # xs)@ ys \"\n  by (simp add:lift_def)\n\nlemma lift_nth: \"i<length xs \\<Longrightarrow> map (lift Q) xs ! i = lift Q  (xs! i)\"\n  by (simp add:lift_def)\n\nlemma snd_lift: \"i< length xs \\<Longrightarrow> snd(lift Q (xs ! i))= snd (xs ! i)\"\n  by (cases \"xs!i\") (simp add:lift_def)\n\nlemma cptn_if_cptn_mod: \"c \\<in> cptn_mod \\<Longrightarrow> c \\<in> cptn\"\napply(erule cptn_mod.induct)\n        apply(rule CptnOne)\n       apply(erule CptnEnv)\n      apply(erule CptnComp,simp)\n     apply(rule CptnComp)\n      apply(erule CondT,simp)\n    apply(rule CptnComp)\n     apply(erule CondF,simp)\n\\<comment> \\<open>Seq1\\<close>\napply(erule cptn.cases,simp_all)\n  apply(rule CptnOne)\n apply clarify\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\n apply(rule CptnEnv,simp)\napply clarify\napply(simp add:lift_def)\napply(rule conjI)\n apply clarify\n apply(rule CptnComp)\n  apply(rule Seq1,simp)\n apply(drule_tac P=P1 in lift_is_cptn)\n apply(simp add:lift_def)\napply clarify\napply(rule CptnComp)\n apply(rule Seq2,simp)\napply(drule_tac P=P1 in lift_is_cptn)\napply(simp add:lift_def)\n\\<comment> \\<open>Seq2\\<close>\napply(rule cptn_append_is_cptn)\n  apply(drule_tac P=P1 in lift_is_cptn)\n  apply(simp add:lift_def)\n apply simp\napply(simp split: if_split_asm)\napply(frule_tac P=P1 in last_lift)\n apply(rule last_fst_esp)\n apply (simp add:last_length)\napply(simp add:Cons_lift lift_def split_def last_conv_nth)\n\\<comment> \\<open>While1\\<close>\napply(rule CptnComp)\n apply(rule WhileT,simp)\napply(drule_tac P=\"While b P\" in lift_is_cptn)\napply(simp add:lift_def)\n\\<comment> \\<open>While2\\<close>\napply(rule CptnComp)\n apply(rule WhileT,simp)\napply(rule cptn_append_is_cptn)\n  apply(drule_tac P=\"While b P\" in lift_is_cptn)\n  apply(simp add:lift_def)\n apply simp\napply(simp split: if_split_asm)\napply(frule_tac P=\"While b P\" in last_lift)\n apply(rule last_fst_esp,simp add:last_length)\napply(simp add:Cons_lift lift_def split_def last_conv_nth)\ndone\n\ntheorem cptn_iff_cptn_mod: \"(c \\<in> cptn) = (c \\<in> cptn_mod)\"\napply(rule iffI)\n apply(erule cptn_onlyif_cptn_mod)\napply(erule cptn_if_cptn_mod)\ndone\n\nsection \\<open>Validity  of Correctness Formulas\\<close>\n\nsubsection \\<open>Validity for Component Programs.\\<close>\n\ntype_synonym 'a rgformula =\n  \"'a com \\<times> 'a set \\<times> ('a \\<times> 'a) set \\<times> ('a \\<times> 'a) set \\<times> 'a set\"\n\ndefinition assum :: \"('a set \\<times> ('a \\<times> 'a) set) \\<Rightarrow> ('a confs) set\" where\n  \"assum \\<equiv> \\<lambda>(pre, rely). {c. snd(c!0) \\<in> pre \\<and> (\\<forall>i. Suc i<length c \\<longrightarrow> \n               c!i -e\\<rightarrow> c!(Suc i) \\<longrightarrow> (snd(c!i), snd(c!Suc i)) \\<in> rely)}\"\n\ndefinition comm :: \"(('a \\<times> 'a) set \\<times> 'a set) \\<Rightarrow> ('a confs) set\" where\n  \"comm \\<equiv> \\<lambda>(guar, post). {c. (\\<forall>i. Suc i<length c \\<longrightarrow> \n               c!i -c\\<rightarrow> c!(Suc i) \\<longrightarrow> (snd(c!i), snd(c!Suc i)) \\<in> guar) \\<and> \n               (fst (last c) = None \\<longrightarrow> snd (last c) \\<in> post)}\"\n\ndefinition com_validity :: \"'a com \\<Rightarrow> 'a set \\<Rightarrow> ('a \\<times> 'a) set \\<Rightarrow> ('a \\<times> 'a) set \\<Rightarrow> 'a set \\<Rightarrow> bool\" \n                 (\"\\<Turnstile> _ sat [_, _, _, _]\" [60,0,0,0,0] 45) where\n  \"\\<Turnstile> P sat [pre, rely, guar, post] \\<equiv> \n   \\<forall>s. cp (Some P) s \\<inter> assum(pre, rely) \\<subseteq> comm(guar, post)\"\n\nsubsection \\<open>Validity for Parallel Programs.\\<close>\n\ndefinition All_None :: \"(('a com) option) list \\<Rightarrow> bool\" where\n  \"All_None xs \\<equiv> \\<forall>c\\<in>set xs. c=None\"\n\ndefinition par_assum :: \"('a set \\<times> ('a \\<times> 'a) set) \\<Rightarrow> ('a par_confs) set\" where\n  \"par_assum \\<equiv> \\<lambda>(pre, rely). {c. snd(c!0) \\<in> pre \\<and> (\\<forall>i. Suc i<length c \\<longrightarrow> \n             c!i -pe\\<rightarrow> c!Suc i \\<longrightarrow> (snd(c!i), snd(c!Suc i)) \\<in> rely)}\"\n\ndefinition par_comm :: \"(('a \\<times> 'a) set \\<times> 'a set) \\<Rightarrow> ('a par_confs) set\" where\n  \"par_comm \\<equiv> \\<lambda>(guar, post). {c. (\\<forall>i. Suc i<length c \\<longrightarrow>   \n        c!i -pc\\<rightarrow> c!Suc i \\<longrightarrow> (snd(c!i), snd(c!Suc i)) \\<in> guar) \\<and> \n         (All_None (fst (last c)) \\<longrightarrow> snd( last c) \\<in> post)}\"\n\ndefinition par_com_validity :: \"'a  par_com \\<Rightarrow> 'a set \\<Rightarrow> ('a \\<times> 'a) set \\<Rightarrow> ('a \\<times> 'a) set \n\\<Rightarrow> 'a set \\<Rightarrow> bool\"  (\"\\<Turnstile> _ SAT [_, _, _, _]\" [60,0,0,0,0] 45) where\n  \"\\<Turnstile> Ps SAT [pre, rely, guar, post] \\<equiv> \n   \\<forall>s. par_cp Ps s \\<inter> par_assum(pre, rely) \\<subseteq> par_comm(guar, post)\"\n\nsubsection \\<open>Compositionality of the Semantics\\<close>\n\nsubsubsection \\<open>Definition of the conjoin operator\\<close>\n\ndefinition same_length :: \"'a par_confs \\<Rightarrow> ('a confs) list \\<Rightarrow> bool\" where\n  \"same_length c clist \\<equiv> (\\<forall>i<length clist. length(clist!i)=length c)\"\n \ndefinition same_state :: \"'a par_confs \\<Rightarrow> ('a confs) list \\<Rightarrow> bool\" where\n  \"same_state c clist \\<equiv> (\\<forall>i <length clist. \\<forall>j<length c. snd(c!j) = snd((clist!i)!j))\"\n\ndefinition same_program :: \"'a par_confs \\<Rightarrow> ('a confs) list \\<Rightarrow> bool\" where\n  \"same_program c clist \\<equiv> (\\<forall>j<length c. fst(c!j) = map (\\<lambda>x. fst(nth x j)) clist)\"\n\ndefinition compat_label :: \"'a par_confs \\<Rightarrow> ('a confs) list \\<Rightarrow> bool\" where\n  \"compat_label c clist \\<equiv> (\\<forall>j. Suc j<length c \\<longrightarrow> \n         (c!j -pc\\<rightarrow> c!Suc j \\<and> (\\<exists>i<length clist. (clist!i)!j -c\\<rightarrow> (clist!i)! Suc j \\<and> \n                       (\\<forall>l<length clist. l\\<noteq>i \\<longrightarrow> (clist!l)!j -e\\<rightarrow> (clist!l)! Suc j))) \\<or> \n         (c!j -pe\\<rightarrow> c!Suc j \\<and> (\\<forall>i<length clist. (clist!i)!j -e\\<rightarrow> (clist!i)! Suc j)))\"\n\ndefinition conjoin :: \"'a par_confs \\<Rightarrow> ('a confs) list \\<Rightarrow> bool\"  (\"_ \\<propto> _\" [65,65] 64) where\n  \"c \\<propto> clist \\<equiv> (same_length c clist) \\<and> (same_state c clist) \\<and> (same_program c clist) \\<and> (compat_label c clist)\"\n\nsubsubsection \\<open>Some previous lemmas\\<close>\n\nlemma list_eq_if [rule_format]: \n  \"\\<forall>ys. xs=ys \\<longrightarrow> (length xs = length ys) \\<longrightarrow> (\\<forall>i<length xs. xs!i=ys!i)\"\n  by (induct xs) auto\n\nlemma list_eq: \"(length xs = length ys \\<and> (\\<forall>i<length xs. xs!i=ys!i)) = (xs=ys)\"\napply(rule iffI)\n apply clarify\n apply(erule nth_equalityI)\n apply simp+\ndone\n\nlemma nth_tl: \"\\<lbrakk> ys!0=a; ys\\<noteq>[] \\<rbrakk> \\<Longrightarrow> ys=(a#(tl ys))\"\n  by (cases ys) simp_all\n\nlemma nth_tl_if [rule_format]: \"ys\\<noteq>[] \\<longrightarrow> ys!0=a \\<longrightarrow> P ys \\<longrightarrow> P (a#(tl ys))\"\n  by (induct ys) simp_all\n\nlemma nth_tl_onlyif [rule_format]: \"ys\\<noteq>[] \\<longrightarrow> ys!0=a \\<longrightarrow> P (a#(tl ys)) \\<longrightarrow> P ys\"\n  by (induct ys) simp_all\n\nlemma seq_not_eq1: \"Seq c1 c2\\<noteq>c1\"\n  by (induct c1) auto\n\nlemma seq_not_eq2: \"Seq c1 c2\\<noteq>c2\"\n  by (induct c2) auto\n\nlemma if_not_eq1: \"Cond b c1 c2 \\<noteq>c1\"\n  by (induct c1) auto\n\nlemma if_not_eq2: \"Cond b c1 c2\\<noteq>c2\"\n  by (induct c2) auto\n\nlemmas seq_and_if_not_eq [simp] = seq_not_eq1 seq_not_eq2 \nseq_not_eq1 [THEN not_sym] seq_not_eq2 [THEN not_sym] \nif_not_eq1 if_not_eq2 if_not_eq1 [THEN not_sym] if_not_eq2 [THEN not_sym]\n\nlemma prog_not_eq_in_ctran_aux:\n  assumes c: \"(P,s) -c\\<rightarrow> (Q,t)\"\n  shows \"P\\<noteq>Q\" using c\n  by (induct x1 \\<equiv> \"(P,s)\" x2 \\<equiv> \"(Q,t)\" arbitrary: P s Q t) auto\n\nlemma prog_not_eq_in_ctran [simp]: \"\\<not> (P,s) -c\\<rightarrow> (P,t)\"\napply clarify\napply(drule prog_not_eq_in_ctran_aux)\napply simp\ndone\n\nlemma prog_not_eq_in_par_ctran_aux [rule_format]: \"(P,s) -pc\\<rightarrow> (Q,t) \\<Longrightarrow> (P\\<noteq>Q)\"\napply(erule par_ctran.induct)\napply(drule prog_not_eq_in_ctran_aux)\napply clarify\napply(drule list_eq_if)\n apply simp_all\napply force\ndone\n\nlemma prog_not_eq_in_par_ctran [simp]: \"\\<not> (P,s) -pc\\<rightarrow> (P,t)\"\napply clarify\napply(drule prog_not_eq_in_par_ctran_aux)\napply simp\ndone\n\nlemma tl_in_cptn: \"\\<lbrakk> a#xs \\<in>cptn; xs\\<noteq>[] \\<rbrakk> \\<Longrightarrow> xs\\<in>cptn\"\n  by (force elim: cptn.cases)\n\nlemma tl_zero[rule_format]: \n  \"P (ys!Suc j) \\<longrightarrow> Suc j<length ys \\<longrightarrow> ys\\<noteq>[] \\<longrightarrow> P (tl(ys)!j)\"\n  by (induct ys) simp_all\n\nsubsection \\<open>The Semantics is Compositional\\<close>\n\nlemma aux_if [rule_format]: \n  \"\\<forall>xs s clist. (length clist = length xs \\<and> (\\<forall>i<length xs. (xs!i,s)#clist!i \\<in> cptn) \n  \\<and> ((xs, s)#ys \\<propto> map (\\<lambda>i. (fst i,s)#snd i) (zip xs clist)) \n   \\<longrightarrow> (xs, s)#ys \\<in> par_cptn)\"\napply(induct ys)\n apply(clarify)\n apply(rule ParCptnOne)\napply(clarify)\napply(simp add:conjoin_def compat_label_def)\napply clarify\napply(erule_tac x=\"0\" and P=\"\\<lambda>j. H j \\<longrightarrow> (P j \\<or> Q j)\" for H P Q in all_dupE, simp)\napply(erule disjE)\n\\<comment> \\<open>first step is a Component step\\<close>\n apply clarify \n apply simp\n apply(subgoal_tac \"a=(xs[i:=(fst(clist!i!0))])\")\n  apply(subgoal_tac \"b=snd(clist!i!0)\",simp)\n   prefer 2\n   apply(simp add: same_state_def)\n   apply(erule_tac x=i in allE,erule impE,assumption, \n         erule_tac x=1 and P=\"\\<lambda>j. (H j) \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE, simp)\n  prefer 2\n  apply(simp add:same_program_def)\n  apply(erule_tac x=1 and P=\"\\<lambda>j. H j \\<longrightarrow> (fst (s j))=(t j)\" for H s t in allE,simp)\n  apply(rule nth_equalityI,simp)\n  apply clarify\n  apply(case_tac \"i=ia\",simp,simp)\n  apply(erule_tac x=ia and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE)\n  apply(drule_tac t=i in not_sym,simp)\n  apply(erule etranE,simp)\n apply(rule ParCptnComp)\n  apply(erule ParComp,simp)\n\\<comment> \\<open>applying the induction hypothesis\\<close>\n apply(erule_tac x=\"xs[i := fst (clist ! i ! 0)]\" in allE)\n apply(erule_tac x=\"snd (clist ! i ! 0)\" in allE)\n apply(erule mp)\n apply(rule_tac x=\"map tl clist\" in exI,simp)\n apply(rule conjI,clarify)\n  apply(case_tac \"i=ia\",simp)\n   apply(rule nth_tl_if)\n     apply(force simp add:same_length_def length_Suc_conv)\n    apply simp\n   apply(erule allE,erule impE,assumption,erule tl_in_cptn)\n   apply(force simp add:same_length_def length_Suc_conv)\n  apply(rule nth_tl_if)\n    apply(force simp add:same_length_def length_Suc_conv)\n   apply(simp add:same_state_def)\n   apply(erule_tac x=ia in allE, erule impE, assumption, \n     erule_tac x=1 and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE)\n   apply(erule_tac x=ia and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE)\n   apply(drule_tac t=i  in not_sym,simp)\n   apply(erule etranE,simp)\n  apply(erule allE,erule impE,assumption,erule tl_in_cptn)\n  apply(force simp add:same_length_def length_Suc_conv)\n apply(simp add:same_length_def same_state_def)\n apply(rule conjI)\n  apply clarify\n  apply(case_tac j,simp,simp)\n  apply(erule_tac x=ia in allE, erule impE, assumption,\n        erule_tac x=\"Suc(Suc nat)\" and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n  apply(force simp add:same_length_def length_Suc_conv)\n apply(rule conjI)\n  apply(simp add:same_program_def)\n  apply clarify\n  apply(case_tac j,simp)\n   apply(rule nth_equalityI,simp)\n   apply clarify\n   apply(case_tac \"i=ia\",simp,simp)\n  apply(erule_tac x=\"Suc(Suc nat)\" and P=\"\\<lambda>j. H j \\<longrightarrow> (fst (s j))=(t j)\" for H s t in allE,simp)\n  apply(rule nth_equalityI,simp,simp)\n  apply(force simp add:length_Suc_conv)\n apply(rule allI,rule impI)\n apply(erule_tac x=\"Suc j\" and P=\"\\<lambda>j. H j \\<longrightarrow> (I j \\<or> J j)\" for H I J in allE,simp)\n apply(erule disjE) \n  apply clarify\n  apply(rule_tac x=ia in exI,simp)\n  apply(case_tac \"i=ia\",simp)\n   apply(rule conjI)\n    apply(force simp add: length_Suc_conv)\n   apply clarify\n   apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE,erule impE,assumption)\n   apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE,erule impE,assumption)\n   apply simp\n   apply(case_tac j,simp)\n    apply(rule tl_zero)\n      apply(erule_tac x=l in allE, erule impE, assumption, \n            erule_tac x=1 and P=\"\\<lambda>j.  (H j) \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n      apply(force elim:etranE intro:Env)\n     apply force\n    apply force\n   apply simp\n   apply(rule tl_zero)\n     apply(erule tl_zero)\n      apply force\n     apply force\n    apply force\n   apply force\n  apply(rule conjI,simp)\n   apply(rule nth_tl_if)\n     apply force\n    apply(erule_tac x=ia  in allE, erule impE, assumption,\n          erule_tac x=1 and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE)\n    apply(erule_tac x=ia and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE)\n    apply(drule_tac t=i  in not_sym,simp)\n    apply(erule etranE,simp)\n   apply(erule tl_zero)\n    apply force\n   apply force\n  apply clarify\n  apply(case_tac \"i=l\",simp)\n   apply(rule nth_tl_if)\n     apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n    apply simp\n   apply(erule_tac P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE,erule impE,assumption,erule impE,assumption)\n   apply(erule tl_zero,force)\n   apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n   apply(rule nth_tl_if)\n     apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n    apply(erule_tac x=l  in allE, erule impE, assumption,\n          erule_tac x=1 and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE)\n    apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE,erule impE, assumption,simp)\n    apply(erule etranE,simp)\n   apply(rule tl_zero)\n    apply force\n   apply force\n  apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n apply(rule disjI2)\n apply(case_tac j,simp)\n  apply clarify\n  apply(rule tl_zero)\n    apply(erule_tac x=ia and P=\"\\<lambda>j. H j \\<longrightarrow> I j\\<in>etran\" for H I in allE,erule impE, assumption)\n    apply(case_tac \"i=ia\",simp,simp)\n    apply(erule_tac x=ia  in allE, erule impE, assumption,\n    erule_tac x=1 and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE)\n    apply(erule_tac x=ia and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE,erule impE, assumption,simp)\n    apply(force elim:etranE intro:Env)\n   apply force\n  apply(erule_tac x=ia and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n apply simp\n apply clarify\n apply(rule tl_zero)\n   apply(rule tl_zero,force)\n    apply force\n   apply(erule_tac x=ia and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n  apply force\n apply(erule_tac x=ia and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n\\<comment> \\<open>first step is an environmental step\\<close>\napply clarify\napply(erule par_etran.cases)\napply simp\napply(rule ParCptnEnv)\napply(erule_tac x=\"Ps\" in allE)\napply(erule_tac x=\"t\" in allE)\napply(erule mp)\napply(rule_tac x=\"map tl clist\" in exI,simp)\napply(rule conjI)\n apply clarify\n apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<in> cptn\" for H I in allE,simp)\n apply(erule cptn.cases)\n   apply(simp add:same_length_def)\n   apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n  apply(simp add:same_state_def)\n  apply(erule_tac x=i  in allE, erule impE, assumption,\n   erule_tac x=1 and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> J j \\<in>etran\" for H J in allE,simp)\n apply(erule etranE,simp)\napply(simp add:same_state_def same_length_def)\napply(rule conjI,clarify)\n apply(case_tac j,simp,simp)\n apply(erule_tac x=i  in allE, erule impE, assumption,\n       erule_tac x=\"Suc(Suc nat)\" and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(rule tl_zero)\n   apply(simp)\n  apply force\n apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\napply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n  apply(rule nth_equalityI,simp)\n  apply clarify\n  apply simp\n apply(erule_tac x=\"Suc(Suc nat)\" and P=\"\\<lambda>j. H j \\<longrightarrow> (fst (s j))=(t j)\" for H s t in allE,simp)\n apply(rule nth_equalityI,simp,simp)\n apply(force simp add:length_Suc_conv)\napply(rule allI,rule impI)\napply(erule_tac x=\"Suc j\" and P=\"\\<lambda>j. H j \\<longrightarrow> (I j \\<or> J j)\" for H I J in allE,simp)\napply(erule disjE) \n apply clarify\n apply(rule_tac x=i in exI,simp)\n apply(rule conjI)\n  apply(erule_tac x=i and P=\"\\<lambda>i. H i \\<longrightarrow> J i \\<in>etran\" for H J in allE, erule impE, assumption)\n  apply(erule etranE,simp)\n  apply(erule_tac x=i  in allE, erule impE, assumption,\n        erule_tac x=1 and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n  apply(rule nth_tl_if)\n   apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n  apply simp\n apply(erule tl_zero,force) \n  apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n apply clarify\n apply(erule_tac x=l and P=\"\\<lambda>i. H i \\<longrightarrow> J i \\<in>etran\" for H J in allE, erule impE, assumption)\n apply(erule etranE,simp)\n apply(erule_tac x=l  in allE, erule impE, assumption,\n       erule_tac x=1 and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(rule nth_tl_if)\n   apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n  apply simp\n  apply(rule tl_zero,force)\n  apply force\n apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\napply(rule disjI2)\napply simp\napply clarify\napply(case_tac j,simp)\n apply(rule tl_zero)\n   apply(erule_tac x=i and P=\"\\<lambda>i. H i \\<longrightarrow> J i \\<in>etran\" for H J in allE, erule impE, assumption)\n   apply(erule_tac x=i and P=\"\\<lambda>i. H i \\<longrightarrow> J i \\<in>etran\" for H J in allE, erule impE, assumption)\n   apply(force elim:etranE intro:Env)\n  apply force\n apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\napply simp\napply(rule tl_zero)\n  apply(rule tl_zero,force)\n   apply force\n  apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n apply force\napply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\ndone\n\nlemma aux_onlyif [rule_format]: \"\\<forall>xs s. (xs, s)#ys \\<in> par_cptn \\<longrightarrow> \n  (\\<exists>clist. (length clist = length xs) \\<and> \n  (xs, s)#ys \\<propto> map (\\<lambda>i. (fst i,s)#(snd i)) (zip xs clist) \\<and> \n  (\\<forall>i<length xs. (xs!i,s)#(clist!i) \\<in> cptn))\"\n  supply [[simproc del: defined_all]]\napply(induct ys)\n apply(clarify)\n apply(rule_tac x=\"map (\\<lambda>i. []) [0..<length xs]\" in exI)\n apply(simp add: conjoin_def same_length_def same_state_def same_program_def compat_label_def)\n apply(rule conjI)\n  apply(rule nth_equalityI,simp,simp)\n apply(force intro: cptn.intros)\napply(clarify)\napply(erule par_cptn.cases,simp)\n apply simp\n apply(erule_tac x=\"xs\" in allE)\n apply(erule_tac x=\"t\" in allE,simp)\n apply clarify\n apply(rule_tac x=\"(map (\\<lambda>j. (P!j, t)#(clist!j)) [0..<length P])\" in exI,simp)\n apply(rule conjI)\n  prefer 2\n  apply clarify\n  apply(rule CptnEnv,simp)\n apply(simp add:conjoin_def same_length_def same_state_def)\n apply (rule conjI)\n  apply clarify\n  apply(case_tac j,simp,simp)\n apply(rule conjI)\n  apply(simp add:same_program_def)\n  apply clarify\n  apply(case_tac j,simp)\n   apply(rule nth_equalityI,simp,simp)\n  apply simp\n  apply(rule nth_equalityI,simp,simp)\n apply(simp add:compat_label_def)\n apply clarify\n apply(case_tac j,simp)\n  apply(simp add:ParEnv)\n  apply clarify\n  apply(simp add:Env)\n apply simp\n apply(erule_tac x=nat in allE,erule impE, assumption)\n apply(erule disjE,simp)\n  apply clarify\n  apply(rule_tac x=i in exI,simp)\n apply force\napply(erule par_ctran.cases,simp)\napply(erule_tac x=\"Ps[i:=r]\" in allE)\napply(erule_tac x=\"ta\" in allE,simp)\napply clarify\napply(rule_tac x=\"(map (\\<lambda>j. (Ps!j, ta)#(clist!j)) [0..<length Ps]) [i:=((r, ta)#(clist!i))]\" in exI,simp)\napply(rule conjI)\n prefer 2\n apply clarify\n apply(case_tac \"i=ia\",simp)\n  apply(erule CptnComp)\n  apply(erule_tac x=ia and P=\"\\<lambda>j. H j \\<longrightarrow> (I j \\<in> cptn)\" for H I in allE,simp)\n apply simp\n apply(erule_tac x=ia in allE)\n apply(rule CptnEnv,simp)\napply(simp add:conjoin_def)\napply (rule conjI)\n apply(simp add:same_length_def)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\napply(rule conjI)\n apply(simp add:same_state_def)\n apply clarify\n apply(case_tac j, simp, simp (no_asm_simp))\n apply(case_tac \"i=ia\",simp,simp)\napply(rule conjI)\n apply(simp add:same_program_def)\n apply clarify\n apply(case_tac j,simp)\n  apply(rule nth_equalityI,simp,simp)\n apply simp\n apply(rule nth_equalityI,simp,simp)\n apply(erule_tac x=nat and P=\"\\<lambda>j. H j \\<longrightarrow> (fst (a j))=((b j))\" for H a b in allE)\n apply(case_tac nat)\n  apply clarify\n  apply(case_tac \"i=ia\",simp,simp)\n apply clarify\n apply(case_tac \"i=ia\",simp,simp)\napply(simp add:compat_label_def)\napply clarify\napply(case_tac j)\n apply(rule conjI,simp)\n  apply(erule ParComp,assumption)\n  apply clarify\n  apply(rule_tac x=i in exI,simp)\n apply clarify\n apply(rule Env)\napply simp\napply(erule_tac x=nat and P=\"\\<lambda>j. H j \\<longrightarrow> (P j \\<or> Q j)\" for H P Q in allE,simp)\napply(erule disjE)\n apply clarify\n apply(rule_tac x=ia in exI,simp)\n apply(rule conjI)\n  apply(case_tac \"i=ia\",simp,simp)\n apply clarify\n apply(case_tac \"i=l\",simp)\n  apply(case_tac \"l=ia\",simp,simp)\n  apply(erule_tac x=l in allE,erule impE,assumption,erule impE, assumption,simp)\n apply simp\n apply(erule_tac x=l in allE,erule impE,assumption,erule impE, assumption,simp)\napply clarify\napply(erule_tac x=ia and P=\"\\<lambda>j. H j \\<longrightarrow> (P j)\\<in>etran\" for H P in allE, erule impE, assumption)\napply(case_tac \"i=ia\",simp,simp)\ndone\n\nlemma one_iff_aux: \"xs\\<noteq>[] \\<Longrightarrow> (\\<forall>ys. ((xs, s)#ys \\<in> par_cptn) = \n (\\<exists>clist. length clist= length xs \\<and> \n ((xs, s)#ys \\<propto> map (\\<lambda>i. (fst i,s)#(snd i)) (zip xs clist)) \\<and> \n (\\<forall>i<length xs. (xs!i,s)#(clist!i) \\<in> cptn))) = \n (par_cp (xs) s = {c. \\<exists>clist. (length clist)=(length xs) \\<and>\n (\\<forall>i<length clist. (clist!i) \\<in> cp(xs!i) s) \\<and> c \\<propto> clist})\" \napply (rule iffI)\n apply(rule subset_antisym)\n  apply(rule subsetI) \n  apply(clarify)\n  apply(simp add:par_cp_def cp_def)\n  apply(case_tac x)\n   apply(force elim:par_cptn.cases)\n  apply simp\n  apply(rename_tac a list)\n  apply(erule_tac x=\"list\" in allE)\n  apply clarify\n  apply simp\n  apply(rule_tac x=\"map (\\<lambda>i. (fst i, s) # snd i) (zip xs clist)\" in exI,simp)\n apply(rule subsetI) \n apply(clarify)\n apply(case_tac x)\n  apply(erule_tac x=0 in allE)\n  apply(simp add:cp_def conjoin_def same_length_def same_program_def same_state_def compat_label_def)\n  apply clarify\n  apply(erule cptn.cases,force,force,force)\n apply(simp add:par_cp_def conjoin_def  same_length_def same_program_def same_state_def compat_label_def)\n apply clarify\n apply(erule_tac x=0 and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in all_dupE)\n apply(subgoal_tac \"a = xs\")\n  apply(subgoal_tac \"b = s\",simp)\n   prefer 3\n   apply(erule_tac x=0 and P=\"\\<lambda>j. H j \\<longrightarrow> (fst (s j))=((t j))\" for H s t in allE)\n   apply (simp add:cp_def)\n   apply(rule nth_equalityI,simp,simp)\n  prefer 2\n  apply(erule_tac x=0 in allE)\n  apply (simp add:cp_def)\n  apply(erule_tac x=0 and P=\"\\<lambda>j. H j \\<longrightarrow> (\\<forall>i. T i \\<longrightarrow> (snd (d j i))=(snd (e j i)))\" for H T d e in allE,simp)\n  apply(erule_tac x=0 and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n apply(erule_tac x=list in allE)\n apply(rule_tac x=\"map tl clist\" in exI,simp) \n apply(rule conjI)\n  apply clarify\n  apply(case_tac j,simp)\n   apply(erule_tac x=i  in allE, erule impE, assumption,\n        erule_tac x=\"0\" and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE,simp)\n  apply(erule_tac x=i  in allE, erule impE, assumption,\n        erule_tac x=\"Suc nat\" and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE)\n  apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n  apply(case_tac \"clist!i\",simp,simp)\n apply(rule conjI)\n  apply clarify\n  apply(rule nth_equalityI,simp,simp)\n  apply(case_tac j)\n   apply clarify\n   apply(erule_tac x=i in allE)\n   apply(simp add:cp_def)\n  apply clarify\n  apply simp\n  apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n  apply(case_tac \"clist!i\",simp,simp)\n apply(thin_tac \"H = (\\<exists>i. J i)\" for H J)\n apply(rule conjI)\n  apply clarify\n  apply(erule_tac x=j in allE,erule impE, assumption,erule disjE)\n   apply clarify\n   apply(rule_tac x=i in exI,simp)\n   apply(case_tac j,simp)\n    apply(rule conjI)\n     apply(erule_tac x=i in allE)\n     apply(simp add:cp_def)\n     apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n     apply(case_tac \"clist!i\",simp,simp)\n    apply clarify\n    apply(erule_tac x=l in allE)\n    apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE)\n    apply clarify\n    apply(simp add:cp_def)\n    apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n    apply(case_tac \"clist!l\",simp,simp)\n   apply simp\n   apply(rule conjI)\n    apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n    apply(case_tac \"clist!i\",simp,simp)\n   apply clarify\n   apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE)\n   apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n   apply(case_tac \"clist!l\",simp,simp)\n  apply clarify\n  apply(erule_tac x=i in allE)\n  apply(simp add:cp_def)\n  apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n  apply(case_tac \"clist!i\",simp)\n  apply(rule nth_tl_if,simp,simp)\n  apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (P j)\\<in>etran\" for H P in allE, erule impE, assumption,simp)\n  apply(simp add:cp_def)\n  apply clarify\n  apply(rule nth_tl_if)\n   apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n   apply(case_tac \"clist!i\",simp,simp)\n  apply force\n apply force\napply clarify\napply(rule iffI)\n apply(simp add:par_cp_def)\n apply(erule_tac c=\"(xs, s) # ys\" in equalityCE)\n  apply simp\n  apply clarify\n  apply(rule_tac x=\"map tl clist\" in exI)\n  apply simp\n  apply (rule conjI)\n   apply(simp add:conjoin_def cp_def)\n   apply(rule conjI)\n    apply clarify\n    apply(unfold same_length_def)\n    apply clarify\n    apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,simp)\n   apply(rule conjI)\n    apply(simp add:same_state_def)\n    apply clarify\n    apply(erule_tac x=i in allE, erule impE, assumption,\n       erule_tac x=j and P=\"\\<lambda>j. H j \\<longrightarrow> (snd (d j))=(snd (e j))\" for H d e in allE)\n    apply(case_tac j,simp)\n    apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n    apply(case_tac \"clist!i\",simp,simp)\n   apply(rule conjI)\n    apply(simp add:same_program_def)\n    apply clarify\n    apply(rule nth_equalityI,simp,simp)\n    apply(case_tac j,simp)\n    apply clarify\n    apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n    apply(case_tac \"clist!i\",simp,simp)\n   apply clarify\n   apply(simp add:compat_label_def)\n   apply(rule allI,rule impI)\n   apply(erule_tac x=j in allE,erule impE, assumption)\n   apply(erule disjE)\n    apply clarify\n    apply(rule_tac x=i in exI,simp)\n    apply(rule conjI)\n     apply(erule_tac x=i in allE)\n     apply(case_tac j,simp)\n      apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n      apply(case_tac \"clist!i\",simp,simp)\n     apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n     apply(case_tac \"clist!i\",simp,simp)\n    apply clarify\n    apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> I j \\<longrightarrow> J j\" for H I J in allE)\n    apply(erule_tac x=l and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE)\n    apply(case_tac \"clist!l\",simp,simp)\n    apply(erule_tac x=l in allE,simp)\n   apply(rule disjI2)\n   apply clarify\n   apply(rule tl_zero)\n     apply(case_tac j,simp,simp)\n     apply(rule tl_zero,force)   \n      apply force\n     apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n    apply force\n   apply(erule_tac x=i and P=\"\\<lambda>j. H j \\<longrightarrow> (length (s j) = t)\" for H s t in allE,force)\n  apply clarify\n  apply(erule_tac x=i in allE)\n  apply(simp add:cp_def)\n  apply(rule nth_tl_if)\n    apply(simp add:conjoin_def)\n    apply clarify\n    apply(simp add:same_length_def)\n    apply(erule_tac x=i in allE,simp)\n   apply simp\n  apply simp\n apply simp\napply clarify\napply(erule_tac c=\"(xs, s) # ys\" in equalityCE)\n apply(simp add:par_cp_def)\napply simp\napply(erule_tac x=\"map (\\<lambda>i. (fst i, s) # snd i) (zip xs clist)\" in allE)\napply simp\napply clarify\napply(simp add:cp_def)\ndone\n\ntheorem one: \"xs\\<noteq>[] \\<Longrightarrow> \n par_cp xs s = {c. \\<exists>clist. (length clist)=(length xs) \\<and> \n               (\\<forall>i<length clist. (clist!i) \\<in> cp(xs!i) s) \\<and> c \\<propto> clist}\"\napply(frule one_iff_aux)\napply(drule sym)\napply(erule iffD2)\napply clarify\napply(rule iffI)\n apply(erule aux_onlyif)\napply clarify\napply(force intro:aux_if)\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Hoare_Parallel/RG_Tran.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259584, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3019659168629792}}
{"text": "(* Title:     Xml\n   Author:    Christian Sternagel\n   Author:    René Thiemann\n*)\n\nsection \\<open>A Sum Type with Bottom Element\\<close>\n\ntheory Strict_Sum\nimports\n  \"HOL-Library.Monad_Syntax\"\n  Error_Syntax\n  Partial_Function_MR.Partial_Function_MR\nbegin\n\ndatatype (dead 'e, 'a) sum_bot (infixr \"+\\<^sub>\\<bottom>\" 10) = Bottom | Left 'e | Right 'a for map: sum_bot_map\n\n\nsubsection \\<open>Setup for Partial Functions\\<close>\n\nabbreviation sum_bot_ord :: \"'e +\\<^sub>\\<bottom> 'a \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'a \\<Rightarrow> bool\"\nwhere\n  \"sum_bot_ord \\<equiv> flat_ord Bottom\"\n\ninterpretation sum_bot:\n  partial_function_definitions sum_bot_ord \"flat_lub Bottom\"\n  by (rule flat_interpretation)\n\ndeclaration \\<open>\nPartial_Function.init\n  \"sum_bot\"\n  @{term sum_bot.fixp_fun}\n  @{term sum_bot.mono_body}\n  @{thm sum_bot.fixp_rule_uc}\n  @{thm sum_bot.fixp_induct_uc}\n  NONE\n\\<close>\n\n\nsubsection \\<open>Monad Setup\\<close>\n\nfun bind :: \"'e +\\<^sub>\\<bottom> 'a \\<Rightarrow> ('a \\<Rightarrow> ('e +\\<^sub>\\<bottom> 'b)) \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'b\"\nwhere\n  \"bind Bottom f = Bottom\" |\n  \"bind (Left e) f = Left e\" |\n  \"bind (Right x) f = f x\"\n\n\n\nabbreviation mono_sum_bot :: \"(('a \\<Rightarrow> ('e +\\<^sub>\\<bottom> 'b)) \\<Rightarrow> 'f +\\<^sub>\\<bottom> 'c) \\<Rightarrow> bool\"\nwhere\n  \"mono_sum_bot \\<equiv> monotone (fun_ord sum_bot_ord) sum_bot_ord\"\n\n(* TODO: perhaps use Partial_Function.bind_mono to proof this result immediately *)\nlemma bind_mono [partial_function_mono]:\n  assumes mf: \"mono_sum_bot B\" and mg: \"\\<And>y. mono_sum_bot (\\<lambda>f. C y f)\"\n  shows \"mono_sum_bot (\\<lambda>f. bind (B f) (\\<lambda>y. C y f))\"\nproof (rule monotoneI)\n  fix f g :: \"'a \\<Rightarrow> 'b +\\<^sub>\\<bottom> 'c\"\n  assume fg: \"fun_ord sum_bot_ord f g\"\n  with mf have \"sum_bot_ord (B f) (B g)\" by (rule monotoneD [of _ _ _ f g])\n  then have \"sum_bot_ord (bind (B f) (\\<lambda>y. C y f)) (bind (B g) (\\<lambda>y. C y f))\"\n    unfolding flat_ord_def by auto\n  also from mg have \"\\<And>y'. sum_bot_ord (C y' f) (C y' g)\"\n    by (rule monotoneD) (rule fg)\n  then have \"sum_bot_ord (bind (B g) (\\<lambda>y'. C y' f)) (bind (B g) (\\<lambda>y'. C y' g))\"\n    unfolding flat_ord_def by (cases \"B g\") auto\n  finally (sum_bot.leq_trans)\n  show \"sum_bot_ord (bind (B f) (\\<lambda>y. C y f)) (bind (B g) (\\<lambda>y'. C y' g))\" .\nqed\n\nadhoc_overloading\n  Monad_Syntax.bind bind\n\nhide_const (open) bind\n\nfun catch_error :: \"'e +\\<^sub>\\<bottom> 'a \\<Rightarrow> ('e \\<Rightarrow> ('f +\\<^sub>\\<bottom> 'a)) \\<Rightarrow> 'f +\\<^sub>\\<bottom> 'a\"\nwhere\n  \"catch_error Bottom f = Bottom \" |\n  \"catch_error (Left a) f = f a\" |\n  \"catch_error (Right a) f = Right a\"\n\nadhoc_overloading\n  Error_Syntax.catch catch_error\n\nlemma catch_mono [partial_function_mono]:\n  assumes mf: \"mono_sum_bot B\" and mg: \"\\<And>y. mono_sum_bot (\\<lambda>f. C y f)\"\n  shows \"mono_sum_bot (\\<lambda>f. try (B f) catch (\\<lambda>y. C y f))\"\nproof (rule monotoneI)\n  fix f g :: \"'a \\<Rightarrow> 'b +\\<^sub>\\<bottom> 'c\"\n  assume fg: \"fun_ord sum_bot_ord f g\"\n  with mf have \"sum_bot_ord (B f) (B g)\" by (rule monotoneD [of _ _ _ f g])\n  then have \"sum_bot_ord (try (B f) catch (\\<lambda>y. C y f)) (try (B g) catch (\\<lambda>y. C y f))\"\n    unfolding flat_ord_def by auto\n  also from mg\n  have \"\\<And>y'. sum_bot_ord (C y' f) (C y' g)\"\n    by (rule monotoneD) (rule fg)\n  then have \"sum_bot_ord (try (B g) catch (\\<lambda>y'. C y' f)) (try (B g) catch (\\<lambda>y'. C y' g))\"\n    unfolding flat_ord_def by (cases \"B g\") auto\n  finally (sum_bot.leq_trans)\n    show \"sum_bot_ord (try (B f) catch (\\<lambda>y. C y f)) (try (B g) catch (\\<lambda>y'. C y' g))\" .\nqed\n\ndefinition error :: \"'e \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'a\"\nwhere\n  [simp]: \"error x = Left x\"\n\ndefinition return :: \"'a \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'a\"\nwhere\n  [simp]: \"return x = Right x\"\n\nfun map_sum_bot :: \"('a \\<Rightarrow> ('e +\\<^sub>\\<bottom> 'b)) \\<Rightarrow> 'a list \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'b list\"\nwhere\n  \"map_sum_bot f [] = return []\" |\n  \"map_sum_bot f (x#xs) = do {\n    y \\<leftarrow> f x;\n    ys \\<leftarrow> map_sum_bot f xs;\n    return (y # ys)\n  }\"\n\nlemma map_sum_bot_cong [fundef_cong]:\n  assumes \"xs = ys\" and \"\\<And>x. x \\<in> set ys \\<Longrightarrow> f x = g x\"\n  shows \"map_sum_bot f xs = map_sum_bot g ys\"\n  unfolding assms(1) using assms(2) by (induct ys) auto\n\nlemmas sum_bot_const_mono =\n  sum_bot.const_mono [of \"fun_ord sum_bot_ord\"]\n\nlemma map_sum_bot_mono [partial_function_mono]:\n  fixes C :: \"'a \\<Rightarrow> ('b \\<Rightarrow> ('e +\\<^sub>\\<bottom> 'c)) \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'd\"\n  assumes \"\\<And>y. y \\<in> set B \\<Longrightarrow> mono_sum_bot (C y)\"\n  shows \"mono_sum_bot (\\<lambda>f. map_sum_bot (\\<lambda>y. C y f) B)\"\n  using assms by (induct B) (auto intro!: partial_function_mono)\n\nabbreviation update_error :: \"'e +\\<^sub>\\<bottom> 'a \\<Rightarrow> ('e \\<Rightarrow> 'f) \\<Rightarrow> 'f +\\<^sub>\\<bottom> 'a\"\nwhere\n  \"update_error r f \\<equiv> try r catch (\\<lambda> e. error (f e))\"\n\nadhoc_overloading\n  Error_Syntax.update_error update_error\n\nfun sumbot :: \"'e + 'a \\<Rightarrow> 'e +\\<^sub>\\<bottom> 'a\"\nwhere\n  \"sumbot (Inl x) = Left x\" |\n  \"sumbot (Inr x) = Right x\"\n\ncode_datatype sumbot\n\n\n\nlemma [code]:\n  \"(try (sumbot a) catch f) = (case a of Inl b \\<Rightarrow> f b | Inr a \\<Rightarrow> sumbot (Inr a))\"\n  by (cases a) auto\n\nlemma [code]: \"Right x = sumbot (Inr x)\" by simp\n\nlemma [code]: \"Left x = sumbot (Inl x)\" by simp\n\nlemma [code]: \"return x = sumbot (Inr x)\" by simp\n\nlemma [code]: \"error x = sumbot (Inl x)\" by simp\n\nlemma [code]:\n  \"case_sum_bot f g h (sumbot p) = case_sum g h p\"\n  by (cases p) auto\n\n\nsubsection \\<open>Connection to @{theory Partial_Function_MR.Partial_Function_MR}\\<close>\n\nlemma sum_bot_map_mono [partial_function_mono]:\n  assumes mf: \"mono_sum_bot B\"\n  shows \"mono_sum_bot (\\<lambda>f. sum_bot_map h (B f))\"\nproof (rule monotoneI)\n  fix f g :: \"'a \\<Rightarrow> 'b +\\<^sub>\\<bottom> 'c\"\n  assume fg: \"fun_ord sum_bot_ord f g\"\n  with mf have \"sum_bot_ord (B f) (B g)\" by (rule monotoneD [of _ _ _ f g])\n  then show \"sum_bot_ord (sum_bot_map h (B f)) (sum_bot_map h (B g))\"\n    unfolding flat_ord_def by auto    \nqed\n\ndeclaration \\<open>\nPartial_Function_MR.init \n  \"sum_bot\" \n  (fn (mt, t_to_ss, mtT, msT, t_to_sTs) =>\n      list_comb (Const (@{const_name sum_bot_map}, t_to_sTs ---> mtT --> msT), t_to_ss) $ mt)\n  (fn (commonTs, argTs) => Type (@{type_name sum_bot}, commonTs @ argTs))\n  (fn mT => Term.dest_Type mT |> #2 |> (fn [err, res] => ([err], [res]))) \n  @{thms sum_bot.map_comp} \n  @{thms sum_bot.map_ident}\n\\<close>\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Certification_Monads/Strict_Sum.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5, "lm_q1q2_score": 0.30196591686297913}}
{"text": "(* uses Isabelle2019 and autocorres version 1.6 *)\ntheory ShortestPathNegCVerification\n  imports\n  \"HOL-Library.Option_ord\"\n  \"Library/Autocorres_Misc\"\n  \"ShortestPath/ShortestPathNeg\"\nbegin\n\ninstall_C_file \"shortest_path_neg_checker.c\"\n\nautocorres [unsigned_word_abs=awalktwo cas cyc_in_graph C_se ] \"shortest_path_neg_checker.c\"\n\ncontext shortest_path_neg_checker begin\n\n\n(* Implementation types *)\n\ntype_synonym IVertex = \"32 word\"\ntype_synonym IEdge_Id = \"32 word\"\ntype_synonym IEdge = \"IVertex \\<times> IVertex\"\ntype_synonym IPEdge = \"IVertex \\<Rightarrow> IEdge_Id\"\ntype_synonym IENInt = \"IVertex \\<Rightarrow> (32 signed word \\<times> 32 signed word)\"\ntype_synonym IEInt = \"IVertex \\<Rightarrow> 32 word\"\ntype_synonym ICost = \"IEdge_Id \\<Rightarrow> 32 signed word\"\ntype_synonym IGraph = \"32 word \\<times> 32 word \\<times> (IEdge_Id \\<Rightarrow> IEdge)\"\n(* for locale 3 *)\ntype_synonym IPath = \"IEdge_Id list\"\ntype_synonym ICycle = \"IVertex \\<times> IPath\"\ntype_synonym ICycle_Set = \"ICycle list\"\n\ntype_synonym IPathPtr = \"32 word ptr\"\ntype_synonym ICycle' = \"IVertex \\<times> 32 word \\<times> IPathPtr\"\ntype_synonym ICycle_Set' = \"ICycle' list\"\n\nabbreviation ivertex_cnt :: \n  \"IGraph \\<Rightarrow> 32 word\"\nwhere \n  \"ivertex_cnt G \\<equiv> fst G\"\n\nabbreviation iedge_cnt :: \n  \"IGraph \\<Rightarrow> 32 word\"\nwhere \n  \"iedge_cnt G \\<equiv> fst (snd G)\"\n\nabbreviation iedges :: \n  \"IGraph \\<Rightarrow> IEdge_Id \\<Rightarrow> IEdge\"\nwhere                     \n  \"iedges G \\<equiv> snd (snd G)\"\n\nabbreviation val_d :: \n  \"IENInt \\<Rightarrow> IVertex \\<Rightarrow> int\"\nwhere \n  \"val_d f v \\<equiv> sint (fst (f v))\"\n\nabbreviation is_inf_d :: \n  \"IENInt \\<Rightarrow> IVertex \\<Rightarrow> int\"\nwhere \n  \"is_inf_d f v \\<equiv>  sint (snd (f v))\"\n\nabbreviation icycle_start ::\n  \"ICycle \\<Rightarrow> 32 word\"\nwhere\n  \"icycle_start C \\<equiv> fst C\"\n\nabbreviation icycle_path ::\n  \"ICycle \\<Rightarrow> IPath\"\nwhere\n  \"icycle_path C \\<equiv> snd C\"\n\nabbreviation icycle'_start ::\n  \"ICycle' \\<Rightarrow> 32 word\"\nwhere\n  \"icycle'_start C \\<equiv> fst C\"\n\nabbreviation icycle'_length ::\n  \"ICycle' \\<Rightarrow> 32 word\"\nwhere\n  \"icycle'_length C \\<equiv> fst (snd C)\"\n\nabbreviation icycle'_path ::\n  \"ICycle' \\<Rightarrow> IPathPtr\"\nwhere\n  \"icycle'_path C \\<equiv> snd (snd C)\"\n\n(* Implementation functions to lists *)\n\nfun bool :: \n  \"32 word \\<Rightarrow> bool\" \nwhere \n  \"bool b = (if b=0 then False else True)\"\n\nfun mk_list' :: \n  \"nat \\<Rightarrow> (32 word \\<Rightarrow> 'b) \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list' n f = map f (map of_nat [0..<n])\"\n\nfun mk_list'_int :: \n  \"nat \\<Rightarrow> (32 signed word \\<Rightarrow> 'b) \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list'_int n f = map f (map of_int [0..<n])\"\n\nfun mk_list'_temp :: \n  \"nat \\<Rightarrow> (32 word \\<Rightarrow> 'b) \\<Rightarrow> nat \\<Rightarrow> 'b list\" \nwhere \n  \"mk_list'_temp 0 _ _ = []\" |\n  \"mk_list'_temp (Suc x) f i = (f (of_nat i)) # mk_list'_temp x f (Suc i)\"\n\n  (* Make graph lists *)\nfun mk_iedge_list :: \n  \"IGraph \\<Rightarrow> IEdge list\"\nwhere \n  \"mk_iedge_list G = mk_list' (unat (iedge_cnt G)) (iedges G)\"\n\nfun mk_inum_list :: \n  \"IGraph \\<Rightarrow> IEInt \\<Rightarrow> 32 word list\"\nwhere \n  \"mk_inum_list G num = mk_list' (unat (ivertex_cnt G)) num\"\n  \nfun mk_ipedge_list :: \n  \"IGraph \\<Rightarrow> IPEdge \\<Rightarrow> 32 word list\"\nwhere\n  \"mk_ipedge_list G pedge = mk_list' (unat (ivertex_cnt G)) pedge\"\n\nfun mk_idist_list :: \n  \"IGraph \\<Rightarrow> IENInt \\<Rightarrow> (32 signed word \\<times> 32 signed word) list\"\nwhere\n  \"mk_idist_list G dis = mk_list' (unat (ivertex_cnt G)) dis\"\n\nfun mk_icost_list :: \n  \"IGraph \\<Rightarrow> ICost \\<Rightarrow> 32 signed word list\"\nwhere\n  \"mk_icost_list G cost = mk_list' (unat (iedge_cnt G)) cost\"\n\n(* Make cycle lists *)\nfun mk_ipath_list ::\n  \"ICycle \\<Rightarrow> IPath\"\nwhere\n  \"mk_ipath_list C = icycle_path C\"\n\nfun mk_ipath'_list ::\n  \"'a lifted_globals_scheme \\<Rightarrow> ICycle' \\<Rightarrow> IPath\"\nwhere\n  \"mk_ipath'_list h C = map (heap_w32 h) \n                         (array_addrs (icycle'_path C) (unat (icycle'_length C)))\"\n\n(*Helper word lemmas*)\n\nlemma word_nat_simp[simp]:\n  assumes \"(a :: 32 word) < max_word\"\n  shows \"unat (a + 1) = unat a + 1\"\n  by(insert assms less_is_non_zero_p1 word_overflow_unat, blast)\n\nlemma word_max_limit_simp[simp]:\n  \"unat (x :: 32 word) \\<le> unat (max_word :: 32 word)\"\n  using word_le_nat_alt by blast\n\nlemma sint_ucast: \n  \"sint (ucast (x ::word32) :: sword32) = sint x\"\n  by (clarsimp simp: sint_uint uint_up_ucast is_up)\n\nlemma long_ucast:\n  \"unat (ucast (x ::word32) :: word64) = unat x\"\n  by (simp add: is_up uint_up_ucast unat_def)\n\n\nfun cast_long :: \n  \"32 word \\<Rightarrow> 64 word\"\nwhere \n  \"cast_long x = ucast x\"\n\nfun cast_signed_long ::\n  \"32 signed word \\<Rightarrow> 64 signed word\"\n  where\n  \"cast_signed_long x = scast x\"\n\n(* Lemmas for unat and of_nat *)\nlemma eq_of_nat_conv:\n  assumes \"unat w1 = n\"\n  shows \"w2 = of_nat n \\<longleftrightarrow> w2 = w1\"\n  using assms by auto\n\nlemma less_unat_plus1: \n  assumes \"a < unat (b + 1)\"\n  shows \"a < unat b \\<or> a = unat b\"\n  apply (subgoal_tac  \"b + 1 \\<noteq> 0 \")\n  using assms unat_minus_one add_diff_cancel \n  by fastforce+\n\nlemma unat_minus_plus1_less:\n  fixes a b\n  assumes \"a < b\"\n  shows \"unat (b - (a + 1)) < unat (b - a)\"\n  by (metis (no_types) ab_semigroup_add_class.add_ac(1) right_minus_eq measure_unat\n      add_diff_cancel2 assms is_num_normalize(1) zadd_diff_inverse linorder_neq_iff)\n\n\n\n\n\n(*Helper Lemmas*)\n\n\n\nlemma unat_image_upto:\n  fixes n :: \"32 word\"\n  shows \"unat ` {0..<n} = {unat 0..<unat n}\" (is \"?A = ?B\")\nproof\n  show \"?B \\<subseteq> ?A\"\n  proof \n    fix i assume a: \"i \\<in> ?B\"\n    then obtain i':: \"32 word\" where ii: \"i=  unat i'\"\n      by (metis atLeastLessThan_iff le_unat_uoi less_or_eq_imp_le)\n    then have \"i' \\<in> {0..<n}\" \n      using a word_less_nat_alt by auto\n    thus  \"i \\<in> ?A\" using ii by fast\n  qed\nnext\n  show \"?A \\<subseteq> ?B\"\n  proof\n     fix i assume a: \"i \\<in> ?A\"\n    then obtain i':: \"32 word\" where ii: \"i=  unat i'\" by blast\n    then have \"i' \\<in> {0..<n}\" using a by force\n    thus  \"i \\<in> ?B\"   \n      by (metis Un_iff atLeast0LessThan ii ivl_disj_un(8) \n          lessThan_iff unat_0 unat_mono word_zero_le)\n  qed\nqed\n\n\n\nlemma unat_simp: \n  \"\\<And>x y:: 32 word. unat (x + y) \\<ge> unat x \\<longleftrightarrow> \n      unat (x + y) = unat x + unat y\"\n  using unat_plus_simple word_le_nat_alt by blast\n\nlemma unat_simp_2:\n  \"\\<And>x y :: 32 word. unat (x + y) = unat x + unat y \\<longrightarrow> unat x + unat y \\<ge> unat x\"\n  by simp\n\nlemma unat_leq_plus:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"unat x \\<le> unat y + unat z\" \n  by (simp add: assms word_unat_less_le)\n\nlemma unat_leq_plus_64:\n  fixes x y z :: \"64 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"unat x \\<le> unat y + unat z\" \n  by (simp add: assms word_unat_less_le)\n\nlemma real_unat_leq_plus:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"real (unat x) \\<le> real (unat y) + real (unat z)\" \n  using assms unat_leq_plus by fastforce\n\nlemma real_unat_leq_plus_64:\n  fixes x y z :: \"64 word\"\n  assumes a1: \"x \\<le> y + z\"\n  shows \"real (unat x) \\<le> real (unat y) + real (unat z)\" \n  using assms unat_leq_plus_64 by fastforce\n\nlemma real_nat:\n  fixes x y z :: \"nat\"\n  assumes a1: \"real x \\<le> real y + real z\"\n  shows \"x \\<le> y + z\"\n  using assms by linarith\n\nlemma unat_leq_trian_plus:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"unat x \\<le> unat y + unat z\"\n  assumes a2: \"unat y + unat z \\<ge> unat y\"\n  assumes a3: \"unat (y + z) \\<ge> unat y\"\n  shows \"x \\<le> y + z\"\n  using a1 a3 unat_simp word_le_nat_alt by fastforce\n\nlemma unat_leq_plus_unats:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"unat x \\<le> unat (y + z)\"\n  shows \"x \\<le> y + z\"\nproof -\n  have f1: \"unat x \\<le> unat y + unat z\"\n    using a1 by (meson not_le unat_leq_plus word_less_nat_alt)\n  then show ?thesis\n    by (simp add: assms word_le_nat_alt)\nqed\n\nlemma unat_plus_leq_unats:\n  fixes y z :: \"32 word\"\n  assumes a1: \"unat y + unat z \\<le> unat (max_word :: 32 word)\"\n  shows \"unat y + unat z \\<le> unat (y + z)\"\n  using a1 \n  by unat_arith\n\nlemma trian_imp_valid:\n  fixes x y z :: \"32 word\"\n  assumes a1: \"real (unat y) + real (unat z) \\<le> real (unat (max_word :: 32 word)) \\<and> \n               real(unat x) \\<le> real (unat y) + real (unat z)\"\n  shows \"unat y + unat z \\<le> unat (max_word::32 word)\"\n  using a1 by linarith\n\nlemma c: \"UCAST(32 \\<rightarrow> 64) (x::word32) = cast_long x\"\n  by simp\n\nlemma cast_long_max: \"unat (cast_long (x::32 word)) \\<le> unat (max_word::word32)\"\n  using word_le_nat_alt long_ucast by auto\n\nlemma cast_long_max_extend: \"unat (cast_long (x::32 word)) \\<le> unat (max_word::word64)\"\n  using word_le_nat_alt by blast\n\nlemma trian_64_reverse:\n  fixes x y z :: \"word32\"\n  assumes a1: \"UCAST(32 \\<rightarrow> 64) x \\<le> UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z\"\n  shows \"unat x \\<le> unat y + unat z\"\n  by (metis (no_types, hide_lams) assms is_up len_of_word_comparisons(2) unat_leq_plus_64 \n            uint_up_ucast unat_def)\n\nlemma unat_plus_less_two_power_length:\n  assumes len: \"len_of TYPE('a::len) < len_of TYPE('b::len)\"\n  shows \"unat (C:: 'a word) + unat (D:: 'a word) < (2::nat) ^ LENGTH('b)\"\nproof -\n  have bounded: \"uint C < 2 ^ LENGTH('a)\" \"uint D < (2 :: int) ^ LENGTH('a)\"\n    by (insert uint_bounded)\nhave unat_bounded: \"unat C < 2 ^ LENGTH('a)\" \"unat D < (2 :: nat) ^ LENGTH('a)\"\n  by simp+\n  have suc_leq: \"Suc (len_of (TYPE('a)::'a itself)) \\<le> len_of (TYPE('b)::'b itself)\"\n    using len Suc_leI by blast\n  then have two_power_suc_leq: \"(2::nat) ^ (len_of (TYPE('a)::'a itself) + 1) \\<le> \n        2 ^ len_of (TYPE('b)::'b itself)\"\n    by (metis (no_types) One_nat_def add.right_neutral add_Suc_right \n             power_increasing_iff rel_simps(49) rel_simps(9))\n  have \"(2::nat) ^ (LENGTH ('a) + 1) = (2 ^ LENGTH ('a)) + (2 ^ LENGTH ('a))\" \n    by auto\n  then have \"unat (C:: 'a word) + unat (D:: 'a word) < (2::nat) ^ (LENGTH ('a) + 1)\"\n    using unat_bounded by linarith  \n  thus ?thesis using two_power_suc_leq \n    by linarith\nqed\n\nlemma abstract_val_ucast_add_strict_upcast:\n    \"\\<lbrakk> len_of TYPE('a::len) < len_of TYPE('b::len);\n       abstract_val P C' unat C; abstract_val P D' unat D \\<rbrakk>\n            \\<Longrightarrow>  abstract_val P (C' + D') unat \n                    ((ucast (C :: 'a word) :: 'b word) +\n                      ucast (D :: 'a word) :: 'b word)\"\n  apply (clarsimp simp: is_up unat_ucast_upcast ucast_def )\n  apply (clarsimp simp:  word_of_int_def unat_word_ariths(1))\n  apply (frule unat_plus_less_two_power_length[where C=C and D=D]) \n  by (metis (mono_tags, hide_lams) unat_of_nat_eq \n        add.right_neutral zero_less_power\n        unat_plus_less_two_power_length uint_inverse \n        uint_mod_same uint_nat unat_of_nat zero_less_numeral) \nlemmas word_add_strict_up_cast_no_overflow_32_64 = \n      abstract_val_ucast_add_strict_upcast\n        [unfolded abstract_val_def,\n          OF word_abs_base(18) impI, where P=True, simplified]\nlemma word_add_cast_up_no_overflow: \n  \"unat y + unat z = unat (UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\"\n  using word_add_strict_up_cast_no_overflow_32_64 by blast\n  \nlemma add_ucast_no_overflow_64: (* add_ucast_no_overflow *)\n  fixes x y z :: \"word32\"\n  assumes a1: \"unat x \\<le> unat y + unat z\"\n  shows \"(UCAST(32 \\<rightarrow> 64) x) \\<le> (UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\"\n  apply (insert a1) \n  apply (subgoal_tac \"unat (UCAST(32 \\<rightarrow> 64) x) \\<le> \n                      unat (UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\")\n   using word_le_nat_alt apply blast\n  apply (subst word_add_cast_up_no_overflow[symmetric])\n  using long_ucast by auto\n\nlemma add_ucast_no_overflow_unat:\n  fixes x y z :: \"word32\"\n  shows \"(UCAST(32 \\<rightarrow> 64) x = UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z) = \n         (unat x = unat y + unat z)\"\nproof -\n  have \"(UCAST(32 \\<rightarrow> 64) x = UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z) \\<longrightarrow> \n         unat x = unat y + unat z\"\n    by (metis (mono_tags, hide_lams) is_up le_add_same_cancel1 \n              len_of_word_comparisons(2) add_ucast_no_overflow_64 uint_up_ucast unat_def \n              unat_plus_simple zero_le)\n  moreover \n  have \"unat x = unat y + unat z \\<longrightarrow> \n        (UCAST(32 \\<rightarrow> 64) x = UCAST(32 \\<rightarrow> 64) y + UCAST(32 \\<rightarrow> 64) z)\"\n    by (metis (mono_tags, hide_lams) is_up len_of_word_comparisons(2) \n              uint_up_ucast unat_def word_arith_nat_add word_unat.Rep_inverse)\n  ultimately show ?thesis by blast\nqed\n\n\nlemma signed_overflow':\n  fixes x :: \"32 signed word\" and y :: \"32 signed word\"\n  shows \"sint(x) + sint(y) \\<le> 4294967294\" \nproof-\n  have sx: \"sint x \\<le> 2147483647\"\n    using INT_MAX_def by auto\n  moreover have \"sint(y) \\<le> 2147483647\"\n    using INT_MAX_def by auto\n  thus ?thesis using sx by linarith\nqed\n\nlemma signed_overflow:\n  fixes x :: \"32 signed word\" and y :: \"32 signed word\"\n  shows \"sint x + sint y \\<le> 9223372036854775807\"\nproof -\n  have \"sint x + sint y \\<le> 4294967294\"\n    by (simp add: signed_overflow')\n  then show ?thesis\n    by fastforce\nqed \n\nlemma signed_underflow':\n  fixes x :: \"32 signed word\" and y :: \"32 signed word\"\n  shows \"-4294967296 \\<le> sint x + sint y\"\nproof-\n  have sx: \"-2147483648 \\<le> sint(x)\"\n    using INT_MIN_def by auto\n  then have \"-2147483648 \\<le> sint(y)\"\n    using INT_MIN_def by auto\n  thus \"-4294967296 \\<le> sint(x) + sint(y)\"\n    using sx by linarith\nqed\n\nlemma signed_underflow:\n  fixes x :: \"32 signed word\" and y :: \"32 signed word\"\n  shows \"-9223372036854775808 \\<le> sint(x) + sint(y)\"\nproof-\n  have \"-4294967296 \\<le> sint x + sint y\"\n    by (simp add: signed_underflow')\n  show ?thesis\n    using \\<open>-4294967296 \\<le> sint x + sint y\\<close> by linarith\nqed\n\nlemma ptr_coerce_ptr_add_uint[simp]:\n  \"ptr_coerce (p +\\<^sub>p uint x) =  p +\\<^sub>p  (uint x)\"\n  by auto\n\n\n\n(* Refinement function from implementation types using lists to C types *)\nfun to_edge :: \n  \"IEdge \\<Rightarrow> Edge_C\"\nwhere\n  \"to_edge (u,v) = Edge_C u v\"\n\nlemma s_C_pte[simp]:\n  \"first_C (to_edge e) = fst e\"\n  by (cases e) auto\n\nlemma t_C_pte[simp]:\n  \"second_C (to_edge e) = snd e\"\n  by (cases e) auto\n\nfun to_enint :: \n  \"(32 signed word \\<times> 32 signed word) \\<Rightarrow> ENInt_C\"\nwhere\n  \"to_enint p = ENInt_C (fst p) (snd p)\"\n\nfun to_cycle ::\n  \"ICycle' \\<Rightarrow> Cycle_C\"\nwhere\n  \"to_cycle C = Cycle_C (fst C) (fst (snd C)) (snd (snd C))\"\n\nlemma ENInt_val_C_pte[simp]:\n  \"ENInt_C.val_C (to_enint p) = fst p\"\n  by (case_tac \"p\") auto\n\nlemma ENInt_isInf_C_pte[simp]:\n  \"ENInt_C.isInf_C (to_enint p) = snd p\"\n  by (cases p) auto\n\ndefinition is_graph\nwhere\n  \"is_graph h iG p \\<equiv>\n    is_valid_Graph_C h p \\<and> \n    ivertex_cnt iG = num_vertices_C (heap_Graph_C h p) \\<and> \n    iedge_cnt iG = num_edges_C (heap_Graph_C h p) \\<and>\n    arrlist (heap_Edge_C h) (is_valid_Edge_C h)\n      (map to_edge (mk_iedge_list iG)) (arcs_C (heap_Graph_C h p))\"\n\ndefinition is_numm\nwhere\n  \"is_numm h iG iN p \\<equiv> \n        arrlist (heap_w32 h) (is_valid_w32 h) (mk_inum_list iG iN) p\"\n\ndefinition is_pedge\nwhere\n  \"is_pedge h iG iP (p:: 32 signed word ptr) \\<equiv> arrlist (\\<lambda>p. heap_w32 h (ptr_coerce p))\n        (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) (mk_ipedge_list iG iP) p\"\n\ndefinition is_dist\nwhere\n  \"is_dist h iG iD p \\<equiv> \n        arrlist (\\<lambda>p. heap_ENInt_C h p) (\\<lambda>p. is_valid_ENInt_C h p) \n        (map to_enint (mk_idist_list iG iD)) p\"\n                              \n(* the following needs clarification... *)\ndefinition is_cost\nwhere\n  \"is_cost h iG iC (p :: 32 signed word ptr) \\<equiv> \n        arrlist (\\<lambda>p. UCAST(32 \\<rightarrow> 32 signed) (heap_w32 h (ptr_coerce p))) \n        (\\<lambda>p. is_valid_w32 h (ptr_coerce p)) (mk_icost_list iG iC) p\"\n\nfun abs_ICycle' ::  \n  \"'a lifted_globals_scheme \\<Rightarrow> ICycle' \\<Rightarrow> ICycle\" \nwhere\n  \"abs_ICycle' h iC' = \n        (icycle'_start iC', \n         mk_ipath'_list h iC')\"\n\nabbreviation \n  is_path :: \"'a lifted_globals_scheme \\<Rightarrow> IPath \\<Rightarrow> 32 word ptr \\<Rightarrow> bool\"\nwhere\n  \"is_path h iP p \\<equiv> \n        arrlist (heap_w32 h) (is_valid_w32 h) iP p\"\n\ndefinition \n  is_cycle' :: \"'a lifted_globals_scheme \\<Rightarrow> ICycle' \\<Rightarrow> Cycle_C ptr \\<Rightarrow> bool\"\nwhere\n  \"is_cycle' h iC' p \\<equiv>\n    is_valid_Cycle_C h p \\<and> \n    icycle'_start iC' = start_C (heap_Cycle_C h p) \\<and> \n    icycle'_length iC' = length_C (heap_Cycle_C h p) \\<and>\n    icycle'_path iC' = path_C (heap_Cycle_C h p) \\<and>\n    (\\<forall>i<unat (icycle'_length iC'). \n       is_valid_w32 h ((icycle'_path iC') +\\<^sub>p int i))\"\n\ndefinition \n  is_cycle :: \"'a lifted_globals_scheme \\<Rightarrow> ICycle \\<Rightarrow> Cycle_C ptr \\<Rightarrow> bool\"\nwhere\n  \"is_cycle h iC p \\<equiv>\n    is_valid_Cycle_C h p \\<and> \n    icycle_start iC = start_C (heap_Cycle_C h p) \\<and> \n    length (icycle_path iC) = unat (length_C (heap_Cycle_C h p)) \\<and>\n    is_path h (icycle_path iC) (path_C (heap_Cycle_C h p))\"\n\ndefinition \n  abs_ICycles' :: \"'a lifted_globals_scheme \\<Rightarrow> ICycle_Set' \\<Rightarrow> ICycle_Set\"\nwhere                           \n  \"abs_ICycles' h CS' \\<equiv> map (abs_ICycle' h)  CS'\"\n\ndefinition \n  are_cycles' :: \n  \"'a lifted_globals_scheme \\<Rightarrow> ICycle_Set' \\<Rightarrow> Cycle_set_C ptr \\<Rightarrow> bool\"\nwhere\n  \"are_cycles' h iCS' p \\<equiv>\n    is_valid_Cycle_set_C h p \\<and>\n    length iCS' = unat (no_cycles_C (heap_Cycle_set_C h p)) \\<and> \n    arrlist (heap_Cycle_C h) (is_valid_Cycle_C h)\n       (map to_cycle iCS') (cyc_obj_C (heap_Cycle_set_C h p)) \\<and>\n    (\\<forall>i<length iCS'. \n       is_valid_w32 h (icycle'_path (iCS'! i)))\"\n\n\ndefinition \n  are_cycles'' :: \n  \"'a lifted_globals_scheme \\<Rightarrow> ICycle_Set' \\<Rightarrow> Cycle_set_C ptr \\<Rightarrow> bool\"\nwhere\n  \"are_cycles'' h iCS' p \\<equiv>\n    is_valid_Cycle_set_C h p \\<and>\n    length iCS' = unat (no_cycles_C (heap_Cycle_set_C h p)) \\<and> \n   (\\<forall>i< length iCS'. \n          is_cycle' h (iCS'!i) (cyc_obj_C (heap_Cycle_set_C h p) +\\<^sub>p int i))\"\n\n(* Abstract Graph *)\n\ndefinition no_loops :: \n  \"('a, 'b) pre_digraph \\<Rightarrow> bool\" \nwhere\n  \"no_loops G \\<equiv> \\<forall>e \\<in> arcs G. tail G e \\<noteq> head G e\"\n\ndefinition abs_IGraph :: \n  \"IGraph \\<Rightarrow> (32 word, 32 word) pre_digraph\" \nwhere\n  \"abs_IGraph G \\<equiv> \\<lparr> verts = {0..<ivertex_cnt G}, arcs = {0..<iedge_cnt G},\n    tail = fst o iedges G, head = snd o iedges G \\<rparr>\"\n\nlemma verts_absI[simp]: \"verts (abs_IGraph G) = {0..<ivertex_cnt G}\"\n  and edges_absI[simp]: \"arcs (abs_IGraph G) = {0..<iedge_cnt G}\"\n  and start_absI[simp]: \"tail (abs_IGraph G) e = fst (iedges G e)\"\n  and target_absI[simp]: \"head (abs_IGraph G) e = snd (iedges G e)\"\n  by (auto simp: abs_IGraph_def)\n\ndefinition abs_ICost :: \n  \"ICost \\<Rightarrow> IEdge_Id \\<Rightarrow> real\"\nwhere\n  \"abs_ICost c e \\<equiv> real_of_int (sint (c e))\"\n\ndefinition abs_IDist :: \n  \"IENInt \\<Rightarrow> IVertex \\<Rightarrow> ereal\"\nwhere\n  \"abs_IDist d v \\<equiv> if sint (snd (d v)) > 0 then PInfty\n         else if sint (snd (d v)) < 0 then MInfty else\n         real_of_int (sint (fst (d v)))\"\n\ndefinition abs_INum :: \n  \"IEInt \\<Rightarrow> IENInt \\<Rightarrow> IVertex \\<Rightarrow> enat\"\nwhere\n  \"abs_INum n d v \\<equiv> if sint (snd (d v)) \\<noteq> 0 then \\<infinity> else unat (n v)\"\n\ndefinition abs_INat :: \n  \"IEInt \\<Rightarrow> IVertex \\<Rightarrow> nat\"\nwhere\n  \"abs_INat n v \\<equiv> unat (n v)\"\n\ndefinition abs_IPedge :: \n  \"IPEdge \\<Rightarrow> IVertex \\<Rightarrow> 32 word option\" \nwhere\n  \"abs_IPedge p v \\<equiv> if msb (p v) then None else Some (p v)\"\n\nlemma None_abs_pedgeI[simp]:\n  \"(abs_IPedge p v = None) = msb (p v)\"\n  using abs_IPedge_def by auto\n\nlemma Some_abs_pedgeI[simp]: \n  \"(\\<exists>e. abs_IPedge p v = Some e) =  (~ (msb (p v)))\"\n  using None_not_eq None_abs_pedgeI \n  by (metis abs_IPedge_def)\n\n\n\n(* Helper lemmas *)\nlemma wellformed_iGraph:\n  assumes \"wf_digraph (abs_IGraph G)\"\n  shows \"\\<And>e. e < iedge_cnt G \\<Longrightarrow> \n        fst (iedges G e) < ivertex_cnt G \\<and> \n        snd (iedges G e) < ivertex_cnt G\" \n  using assms unfolding wf_digraph_def by simp\n\nlemma path_length:\n  assumes \"vpath p (abs_IGraph iG)\"\n  shows \"vwalk_length p < unat (ivertex_cnt iG)\" \nproof -\n  have pne: \"p \\<noteq> []\" and dp: \"distinct p\" using assms by fast+\n  have \"unat (ivertex_cnt iG) = card (unat ` {0..<(fst iG)})\"  \n    using unat_image_upto by simp\n  then have \"unat (ivertex_cnt iG) = card ((verts (abs_IGraph iG)))\"  \n     by (simp add: inj_on_def card_image)\n  hence \"length p  \\<le> unat (ivertex_cnt iG)\" \n      by (metis finite_code card_mono vwalk_def\n          distinct_card[OF dp] vpath_def assms)\n  hence \"length p - 1 < unat (ivertex_cnt iG)\" \n    by (metis pne Nat.diff_le_self le_neq_implies_less \n        less_imp_diff_less minus_eq one_neq_zero length_0_conv)\n  thus \"vwalk_length p < unat (fst iG)\"\n    using  assms \n    unfolding vpath_def vwalk_def by simp\nqed\n\n\n\n\nlemma heap_ptr_coerce:\n  \"\\<lbrakk>arrlist (\\<lambda>p. h (ptr_coerce p)) (\\<lambda>p. v (ptr_coerce p)) \n  (map (iL \\<circ> of_nat) [0..<unat n]) l; i < n; 0 \\<le> i\\<rbrakk> \\<Longrightarrow>\n    iL i = h (ptr_coerce (l +\\<^sub>p int (unat i)))\" \n  apply (subgoal_tac \n  \"h (ptr_coerce (l +\\<^sub>p int (unat i))) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (drule arrlist_nth_value[where i=\"int (unat i)\"], (simp add:unat_mono)+)\n  done\n\nlemma arrlist_heap:\n  \"\\<lbrakk>arrlist h v (map (iL \\<circ> of_nat) [0..<unat n]) l; \n  i < n\\<rbrakk> \\<Longrightarrow>\n    iL i = h (l +\\<^sub>p int (unat i))\" \n  apply (subgoal_tac \n  \"h (l +\\<^sub>p int (unat i)) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (simp add: arrlist_nth_value unat_mono)\n  done\n\nlemma arrlist_d_heap:\n  \"\\<lbrakk>arrlist h v (map (iL \\<circ> (of_int \\<circ> int)) [0..<unat n]) l; \n  i < n\\<rbrakk> \\<Longrightarrow>\n    iL i = h (l +\\<^sub>p int (unat i))\" \n  apply (subgoal_tac \n  \"h (l +\\<^sub>p int (unat i)) = map (iL \\<circ> of_nat) [0..<unat n] ! unat i\") \n   apply (subgoal_tac \"map (iL \\<circ> of_nat) [0..<unat n] ! unat i = iL i\") \n    apply fastforce\n   apply (metis (hide_lams, mono_tags) unat_mono word_unat.Rep_inverse \n    minus_nat.diff_0 nth_map_upt o_apply plus_nat.add_0)\n  apply (simp add: arrlist_nth_value unat_mono)\n  done\n\nlemma two_comp_arrlist_heap:\n  \"\\<lbrakk> arrlist h v (map (f \\<circ> (iL \\<circ> of_nat)) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> f (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_heap \n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n\nlemmas two_comp_to_edge_arrlist_heap = \n  two_comp_arrlist_heap[where f=to_edge]\n\nlemma two_comp_to_enint_arrlist_d_heap:\n  \"\\<lbrakk> arrlist h v (map (to_enint \\<circ> (iL \\<circ> (of_int \\<circ> int))) [0..<unat n]) l;\n  i < n\\<rbrakk> \\<Longrightarrow> to_enint (iL i) = h (l +\\<^sub>p (int (unat i)))\" \n  using arrlist_d_heap\n  by (metis (no_types, hide_lams) comp_apply comp_assoc)\n \nlemma head_heap:\n  \"\\<lbrakk>arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  snd ((iedges iG) e) = second_C (h (ep +\\<^sub>p (uint e)))\" \n  using two_comp_arrlist_heap to_edge.simps t_C_pte by (metis uint_nat)\n\nlemma tail_heap:\n  \"\\<lbrakk>arrlist h v (map (to_edge \\<circ> (iedges iG \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  fst ((iedges iG) e) =  first_C (h (ep +\\<^sub>p  (uint e)))\" \n  using two_comp_arrlist_heap to_edge.simps s_C_pte uint_nat by metis\n\nlemma val_d_heap:\n  \"\\<lbrakk>arrlist h v (map (to_enint \\<circ> (f \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  val_d f e = sint (ENInt_C.val_C (h (ptr_coerce (ep +\\<^sub>p (uint e)))))\"\n  using to_enint.simps ENInt_val_C_pte \n  by (metis int_unat ptr_coerce_id two_comp_arrlist_heap)\n\nlemma is_inf_d_heap:\n  \"\\<lbrakk>arrlist h v (map (to_enint \\<circ> (f \\<circ> of_nat)) [0..<unat m]) ep; e < m\\<rbrakk> \\<Longrightarrow>\n  is_inf_d f e =  sint (ENInt_C.isInf_C (h (ep +\\<^sub>p (uint e))))\"\n  using to_enint.simps  ENInt_isInf_C_pte\n  by (metis int_unat two_comp_arrlist_heap)\n\nlemma arrlist_cycle_path_heap:\n  \"\\<lbrakk>arrlist h v (icycle_path iY) p; \n   i < length (icycle_path iY)\\<rbrakk> \\<Longrightarrow>\n    icycle_path iY !  i = h (p +\\<^sub>p int i)\"\n  using arrlist_nth_value by fastforce\n\nlemmas unat_le_mono = word_le_nat_alt [THEN iffD1]\n\nlemma is_numm_arrlist_heap: \n  \"is_numm s iG iN n \\<Longrightarrow>  i < (ivertex_cnt iG) \\<Longrightarrow>  iN i = heap_w32 s (n +\\<^sub>p uint i)\"  \nby (fastforce dest!:arrlist_heap simp: is_numm_def uint_nat)\n\nlemma is_numm_valid:\n  \"is_numm s iG iN n \\<Longrightarrow> i < ivertex_cnt iG \\<Longrightarrow> is_valid_w32 s (n +\\<^sub>p uint i)\"\nby (fastforce dest!:arrlist_nth_valid simp: is_numm_def uint_nat word_less_def)\n\nlemma is_dist_arrlist_is_inf:\n  \"is_dist s iG iD d  \\<Longrightarrow> i < ivertex_cnt iG \\<Longrightarrow> \n   is_inf_d iD i = sint (isInf_C (heap_ENInt_C s (d +\\<^sub>p uint i)))\"\nby (simp add:  is_inf_d_heap is_dist_def)\n\nlemma is_dist_valid:\n  \"is_dist s iG iD d  \\<Longrightarrow> i < ivertex_cnt iG \\<Longrightarrow> is_valid_ENInt_C s (d +\\<^sub>p uint i)\"\nby (fastforce dest!:arrlist_nth_valid simp: is_dist_def uint_nat word_less_def)\n\nlemma is_pedge_arrlist_eq: \n  \"is_pedge s iG iP p \\<Longrightarrow>i < (ivertex_cnt iG) \\<Longrightarrow>  0 \\<le> i \\<Longrightarrow>  \n     iP i = heap_w32 s (PTR_COERCE(32 signed word \\<rightarrow> 32 word)(p +\\<^sub>p uint i))\"  \nby (fastforce dest!: heap_ptr_coerce simp:is_pedge_def uint_nat)\n\nlemma is_pedge_valid:\n  \"is_pedge s iG iP p \\<Longrightarrow>i < (ivertex_cnt iG) \\<Longrightarrow>  \n    is_valid_w32 s (PTR_COERCE(32 signed word \\<rightarrow> 32 word) (p +\\<^sub>p uint i))\"\nby (fastforce intro: arrlist_nth_valid simp: is_pedge_def uint_nat word_less_def)\n\nlemma is_graph_head_arrlist_eq: \n  \"is_graph s iG g \\<Longrightarrow> e < (iedge_cnt iG) \\<Longrightarrow> \n    snd (snd (snd iG) e) = second_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint e))\"     \n  by (fastforce simp: is_graph_def dest: head_heap)\n\nlemma is_graph_tail_arrlist_eq: \n  \"is_graph s iG g \\<Longrightarrow> e < (iedge_cnt iG) \\<Longrightarrow> \n    fst (snd (snd iG) e) = first_C (heap_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint e))\"     \nby (fastforce simp: is_graph_def dest: tail_heap)\n\nlemma is_graph_valid_graph:\n  \"is_graph s iG g \\<Longrightarrow> is_valid_Graph_C s g\"\nby (force dest!: arrlist_nth_valid simp:is_graph_def uint_nat unat_mono) \n\nlemma is_graph_valid_edge:\n  \"\\<lbrakk>is_graph s iG g; e < (iedge_cnt iG)\\<rbrakk> \\<Longrightarrow> \n   is_valid_Edge_C s (arcs_C (heap_Graph_C s g) +\\<^sub>p uint e)\"\nby (force dest!: arrlist_nth_valid simp:is_graph_def uint_nat unat_mono) \n\nlemma parent_head_in_verts:\n  \"\\<lbrakk>wf_digraph (abs_IGraph iG); \n    v < ivertex_cnt iG;\n    \\<forall>i\\<le>n. iP (((\\<lambda>v. snd (snd (snd iG) (iP v))) ^^ unat (i::32 word)) v) < iedge_cnt iG;\n    i\\<le>n;\n    j=unat i -1  \\<rbrakk> \\<Longrightarrow> \n    ((\\<lambda>v. snd (iedges iG (iP v))) ^^ unat i) v < ivertex_cnt iG\"\n  apply (case_tac \"i=0\", simp)\n   apply (frule_tac e1=\"iP (((\\<lambda>v. snd (snd (snd iG) (iP v))) ^^ j) v) \" in\n          wellformed_iGraph[THEN conjunct2])\n  apply (metis less_1_simp unat_minus_one word_le_less_eq)\n  apply clarsimp\n  apply (erule_tac x=\"i - 1\" in allE)\n  apply (subst (asm) unat_minus_one, simp)\n  apply (frule_tac e1=\"iP (((\\<lambda>v. snd (snd (snd iG) (iP v))) ^^ j) v) \" in\n          wellformed_iGraph[THEN conjunct2])\n  apply (simp add: less_1_simp word_le_less_eq)\n  apply (metis (mono_tags, lifting) Suc_pred funpow_simp_l unat_gt_0)\n  done\n\nlemma parent_tail_in_verts:\n  \"\\<lbrakk> wf_digraph (abs_IGraph iG); \n     v < ivertex_cnt iG;\n     \\<forall>i<n. iP (((\\<lambda>v. fst (snd (snd iG) (iP v))) ^^ unat (i::32 word)) v) < iedge_cnt iG;\n     i\\<le>n  \\<rbrakk> \\<Longrightarrow> \n   ((\\<lambda>v. fst (iedges iG (iP v))) ^^ unat i) v < ivertex_cnt iG\"\n   apply (cases \"unat i\"; simp)\n   apply (rename_tac j)\n   apply (rule wellformed_iGraph[THEN conjunct1], simp)\n   apply (erule_tac x=\"i - 1\" in allE)\n   apply (metis Zero_not_Suc diff_Suc_1 unat_0 unat_minus_one less_1_simp)\n  done\n\n(*helpers for icycle intermediate abstraction *)\n\nfun mk_ipath ::\n  \"'a lifted_globals_scheme \\<Rightarrow> IPathPtr \\<Rightarrow> nat \\<Rightarrow> IPath\"\nwhere\n  \"mk_ipath h p l = map (heap_w32 h) (array_addrs p l)\"\n\n\nlemma array_addrs_length: \"length (array_addrs p l) = l\"\napply (induct l arbitrary: p) \n  by (simp add:array_addrs.simps(2)) +\n\nlemma mk_ipath_length:\n  \"length (mk_ipath h p l) = l\"\n  using array_addrs_length \n  by auto \n\nlemma arrlist_next_item:\n  assumes \"arrlist h v (x # xs) p\"\n  shows \"arrlist h v xs (p +\\<^sub>p 1)\"\n  using assms by simp\n\nlemma array_addrs_arrlist:\n  \"\\<lbrakk>\\<forall>i<n. v (p +\\<^sub>p int i); xs= map h (array_addrs p n)\\<rbrakk> \\<Longrightarrow> arrlist h v xs p\"\n  apply (induct n arbitrary: p xs) \n   apply simp\n  apply (simp add: array_addrs.simps(2)) \n  apply (erule_tac x=\"p +\\<^sub>p 1\" in meta_allE)\n  apply (frule_tac x=0 in spec, simp)\n  by force\n\nlemma arrlist_array_addrs:\n  assumes \"arrlist h v xs p\" \n  assumes \"n = length xs\"\n  shows \"xs= map h (array_addrs p n)\"  \n  using assms   \n  by (induct n arbitrary: xs p, simp)\n     (case_tac xs; simp add: array_addrs.simps(2))\n\nlemma is_path_absICycle':\n  \"\\<forall>i<unat (icycle'_length iC'). \n       is_valid_w32 h ((icycle'_path iC') +\\<^sub>p int i) \\<Longrightarrow>\n       is_path h (icycle_path (abs_ICycle' h iC')) (icycle'_path iC')\"\n  by (simp add: array_addrs_arrlist)\n\nlemma is_icycle'_is_icycle:\n  \"\\<lbrakk>is_cycle' h iC' p\\<rbrakk> \\<Longrightarrow> is_cycle h (abs_ICycle' h iC') p\"\n  unfolding is_cycle'_def is_cycle_def \n  using is_path_absICycle' \n  by (clarsimp simp: array_addrs_length) \n\nlemma are_cycles_is_icycle':\n  \"\\<lbrakk>are_cycles'' h iCS' p \\<rbrakk> \\<Longrightarrow> \n  \\<forall>i<length iCS'.  \n     is_cycle' h (iCS'!i) \n         (cyc_obj_C (heap_Cycle_set_C h p) +\\<^sub>p i)\"\n  unfolding are_cycles''_def\n  by clarsimp \n\nlemma are_cycles_is_icycle:\n  \"\\<lbrakk>are_cycles'' h iCS' p \\<rbrakk> \\<Longrightarrow> \n  \\<forall>i<length iCS'.  \n     is_cycle h (abs_ICycle' h (iCS'!i)) \n         (cyc_obj_C (heap_Cycle_set_C h p) +\\<^sub>p i)\"\n  using are_cycles_is_icycle' is_icycle'_is_icycle \n  by fast\n\nlemma word_less_arith_simp[simp]:\n  \"\\<lbrakk> x \\<noteq> 0; (x :: 32 word) < l \\<rbrakk> \\<Longrightarrow> (x - 1) < l\"\n  by (simp add: less_1_simp)\n  \n\n(* Try structure for locale 3 **)\n(*\nif(shortest_paths_locale_step2(g, s, c, num, pred, dist, parent_edge) == 0) return 0;\n    if(C_se(g, cse, c, dist) == 0) return 0;\n    if(int_neg_cyc(g, s, dist, cse, c, parent_edge, num) == 0) return 0;\n*)\n\n\n(****)\n\n\n\n\ndefinition is_wellformed_inv :: \"IGraph \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"is_wellformed_inv G i \\<equiv> \\<forall>k < i. ivertex_cnt G > fst (iedges G k)\n                                 \\<and> ivertex_cnt G > snd (iedges G k)\"\n\ndeclare arrlist_nth [simp]\ndeclare if_split_asm [split]\n\nlemma is_wellformed_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g) \\<rbrace>\n   is_wellformed' g\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> is_wellformed_inv iG (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: is_wellformed'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> is_wellformed_inv iG ee \\<and> \n                   ee \\<le> iedge_cnt iG \\<and> \n                   is_graph s iG g\"])\n  apply (simp add: skipE_def)\n  apply wp\n  unfolding is_graph_def is_wellformed_inv_def\n     apply (subst if_bool_eq_conj)+\n     apply ((rule conjI)+, rule impI, clarsimp, rule_tac x = \"ee\" in exI, clarsimp, simp add: tail_heap)\n       apply (rule impI, (rule conjI)+, rule impI, clarsimp, rule_tac x = \"ee\" in exI, clarsimp, simp add: head_heap)\n        apply (rule impI, rule conjI, rule conjI, clarsimp, rule conjI)\n           apply (metis inc_le not_le head_heap tail_heap word_le_less_eq) \n          apply (metis inc_le)\n         apply (metis unat_minus_plus1_less)\n        apply (force intro: unat_minus_plus1_less)\n       apply (fast intro: unat_minus_plus1_less)\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n     apply (clarsimp simp: if_bool_eq_conj)+\n   apply wp\n  apply force\n  done\n\ndefinition trian_inv :: \"IGraph \\<Rightarrow> IENInt \\<Rightarrow> ICost \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"trian_inv G d c m \\<equiv> \n    \\<forall>i < m. (is_inf_d d (fst (iedges G i)) = 0 \\<longrightarrow> \n              (is_inf_d d (snd (iedges G i)) \\<le> 0 \\<and> (is_inf_d d (snd (iedges G i)) = 0 \\<longrightarrow> \n              val_d d (snd (iedges G i)) \\<le> val_d d (fst (iedges G i)) + sint (c i)))) \\<and>\n            (is_inf_d d (fst (iedges G i)) < 0 \\<longrightarrow> is_inf_d d (snd (iedges G i)) < 0)\"\n\nlemma trian_inv_step:\n  assumes i_less_max: \"i < (max_word::32 word)\"\n  shows \"trian_inv G d c (i + 1) \\<longleftrightarrow> trian_inv G d c i \\<and>\n  ((is_inf_d d (fst (iedges G i)) = 0 \\<longrightarrow> \n     (is_inf_d d (snd (iedges G i)) \\<le> 0 \\<and> (is_inf_d d (snd (iedges G i)) = 0 \\<longrightarrow> \n     val_d d (snd (iedges G i)) \\<le> val_d d (fst (iedges G i)) + sint (c i)))) \\<and>\n   (is_inf_d d (fst (iedges G i)) < 0 \\<longrightarrow> is_inf_d d (snd (iedges G i)) < 0))\"\n  unfolding trian_inv_def apply safe\n  by (metis i_less_max less_x_plus_1 max_word_max not_le)+\n\nlemma trian_inv_le:\n  assumes leq: \"j \\<le> i\" \n  assumes trian_i: \"trian_inv G d c i\"\n  shows \"trian_inv G d c j\"\n  using assms \n  by (induct j) (auto simp add: trian_inv_def)\n\ndeclare if_bool_eq_conj [[simp add]]\n\nlemma trian_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c)\\<rbrace>\n   trian' g d c\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> trian_inv iG iD iC (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: trian'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> trian_inv iG iD iC ee \\<and> \n                   ee \\<le> iedge_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and> \n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_cost s iG iC c\"])\n  apply (simp add: skipE_def)\n  apply wp\n     apply (subst if_bool_eq_conj)+\n     apply (clarsimp simp del: Word_Lemmas.sint_0)\n     apply (rule conjI, rule impI, rule conjI, rule impI)\n       apply (unfold trian_inv_def is_dist_def is_graph_def)[1] \n       apply (clarsimp simp del: Word_Lemmas.sint_0, rule_tac x=ee in exI, clarsimp simp del: Word_Lemmas.sint_0)\n       apply (metis Word.sint_0 int_unat not_le is_inf_d_heap s_C_pte t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph)\n      apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI)\n         apply (unfold trian_inv_def is_dist_def is_cost_def is_graph_def)[1] \n         apply (clarsimp simp del: Word_Lemmas.sint_0, rule_tac x=ee in exI, clarsimp simp del: Word_Lemmas.sint_0)\n         apply (rule conjI, metis Word.sint_0 is_inf_d_heap s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n         apply (rule impI, rule conjI, metis (no_types, hide_lams) Word.sint_0 int_unat is_inf_d_heap t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph)\n         apply (subst arrlist_heap[where iL=iC], blast, blast, subst tail_heap, blast, blast, subst head_heap, blast, blast)\n         apply (subst val_d_heap, blast, metis t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n         apply (subst val_d_heap, blast, metis s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n         apply (simp add: uint_nat)\n        apply (rule conjI, rule impI, rule conjI)\n          apply (unfold is_dist_def is_numm_def is_pedge_def is_cost_def is_graph_def)[1] \n          apply (subgoal_tac \" ee + 1 \\<le> fst (snd iG)\")\n           apply (subgoal_tac \"ee < (max_word::32 word)\") \n            apply (drule trian_inv_step[where d=iD and G=iG and c=iC])\n            apply (clarsimp simp del: Word_Lemmas.sint_0)\n            apply (rule conjI, rule impI, rule conjI)\n              apply (subst head_heap, blast, simp, subst is_inf_d_heap, blast,\n                     metis (no_types, hide_lams) not_le t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat, simp)\n             apply (rule impI, subst arrlist_heap[where iL=iC], blast, fast)\n             apply (subst head_heap, blast, fast, subst tail_heap, blast, fast)\n             apply (subst val_d_heap, blast, metis t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n             apply (subst val_d_heap, blast, metis s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n             apply (simp add: uint_nat)\n            apply (rule impI, subst head_heap, blast, blast, subst is_inf_d_heap, blast, metis t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n            apply (metis is_inf_d_heap s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n           apply (metis max_word_max not_le word_le_less_eq)\n          apply (metis inc_le)\n         apply (rule conjI, unfold is_graph_def, metis inc_le)[1]\n         apply (rule conjI, metis unat_minus_plus1_less)\n         apply (rule conjI)\n          apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule conjI, unfold is_dist_def)[1]\n          apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n          apply (metis wellformed_iGraph word_less_nat_alt)\n         apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n        apply (rule conjI, blast intro: signed_overflow)\n        apply (rule conjI, blast intro: signed_underflow)\n        apply (rule conjI, unfold is_cost_def is_graph_def is_dist_def)[1]\n         apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n        apply (clarsimp simp: if_bool_eq_conj)+\n        apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n        apply (metis wellformed_iGraph word_less_nat_alt)\n       apply (rule conjI, rule impI, rule conjI)\n         apply (unfold is_dist_def is_numm_def is_pedge_def is_cost_def is_graph_def)[1] \n         apply (subgoal_tac \" ee + 1 \\<le> fst (snd iG)\")\n          apply (subgoal_tac \"ee < (max_word::32 word)\") \n           apply (drule trian_inv_step[where d=iD and G=iG and c=iC])\n           apply (clarsimp simp del: Word_Lemmas.sint_0)\n           apply (metis (no_types, hide_lams) Word_Lemmas.sint_0 int_unat less_le not_le is_inf_d_heap t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph)\n          apply (metis max_word_max not_le word_le_less_eq)\n         apply (metis inc_le)\n        apply (rule conjI, unfold is_graph_def, metis inc_le)[1]\n        apply (rule conjI, metis unat_minus_plus1_less)\n        apply (rule conjI)\n         apply (clarsimp simp: if_bool_eq_conj)+\n        apply (rule conjI, unfold is_dist_def)[1]\n         apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n         apply (metis wellformed_iGraph word_less_nat_alt)\n        apply (clarsimp simp: if_bool_eq_conj)+\n        apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n       apply (unfold is_graph_def is_dist_def, rule conjI)[1]\n        apply (clarsimp simp: if_bool_eq_conj)+\n        apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n        apply (metis wellformed_iGraph word_less_nat_alt)\n       apply (clarsimp simp: if_bool_eq_conj)+\n       apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n      apply (unfold is_graph_def is_dist_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n      apply (metis wellformed_iGraph word_less_nat_alt)\n     apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI)\n        apply (unfold trian_inv_def is_graph_def is_dist_def)[1]\n        apply (clarsimp simp del: Word_Lemmas.sint_0, rule_tac x=ee in exI, clarsimp simp del: Word_Lemmas.sint_0)\n        apply (subst (asm) (4) tail_heap, fast, fast, subst (asm) (4) head_heap, fast, fast)\n        apply (subst (asm) (7) is_inf_d_heap, blast, metis head_heap wellformed_iGraph)\n        apply (subst (asm) (6) is_inf_d_heap, blast, metis tail_heap wellformed_iGraph)\n        apply linarith\n       apply (rule conjI, rule impI, rule conjI)\n         apply (unfold is_dist_def is_numm_def is_pedge_def is_cost_def is_graph_def)[1] \n         apply (subgoal_tac \" ee + 1 \\<le> fst (snd iG)\")\n          apply (subgoal_tac \"ee < (max_word::32 word)\") \n           apply (drule trian_inv_step[where d=iD and G=iG and c=iC])\n           apply (clarsimp simp del: Word_Lemmas.sint_0)\n           apply (metis (no_types, hide_lams) less_le not_le is_inf_d_heap t_C_pte two_comp_to_edge_arrlist_heap \n                  wellformed_iGraph uint_nat)\n          apply (metis max_word_max not_le word_le_less_eq)\n         apply (metis inc_le)\n        apply (rule conjI, unfold is_graph_def, metis inc_le)[1]\n        apply (rule conjI, metis unat_minus_plus1_less)\n        apply (clarsimp simp: if_bool_eq_conj)+\n       apply (unfold is_graph_def is_dist_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n       apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n       apply (metis wellformed_iGraph word_less_nat_alt)\n      apply (rule conjI, rule impI, rule conjI)\n        apply (unfold is_dist_def is_numm_def is_pedge_def is_cost_def is_graph_def)[1] \n        apply (subgoal_tac \" ee + 1 \\<le> fst (snd iG)\")\n         apply (subgoal_tac \"ee < (max_word::32 word)\") \n          apply (drule trian_inv_step[where d=iD and G=iG and c=iC])\n          apply (clarsimp simp del: Word_Lemmas.sint_0)\n          apply (metis Word_Lemmas.sint_0 int_unat is_inf_d_heap s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph)\n         apply (metis max_word_max not_le word_le_less_eq)\n        apply (metis inc_le)\n       apply (rule conjI, unfold is_graph_def, metis inc_le)[1]\n       apply (rule conjI, metis shortest_path_neg_checker.unat_minus_plus1_less)\n       apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule conjI, unfold is_graph_def is_dist_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n       apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n       apply (metis wellformed_iGraph word_less_nat_alt)\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n     apply (rule conjI, unfold is_graph_def is_dist_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n      apply (metis wellformed_iGraph word_less_nat_alt)\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n    apply (metis is_graph_def word_le_less_eq)\n   apply wp\n  apply (unfold is_graph_def trian_inv_def, force)\n  done\n\ndefinition just_inv :: \n  \"IGraph \\<Rightarrow> IENInt \\<Rightarrow> ICost \\<Rightarrow> IVertex \\<Rightarrow> IEInt \\<Rightarrow> IPEdge \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"just_inv G d c s n p k \\<equiv>\n    \\<forall>v < k. v \\<noteq> s \\<and> is_inf_d d v = 0 \\<longrightarrow> \n      sint (p v) \\<ge> 0 \\<and>\n      (\\<exists> e. e = p v \\<and> e < iedge_cnt G \\<and>\n        v = snd (iedges G e) \\<and>\n        is_inf_d d (fst (iedges G e)) = 0 \\<and> \n        val_d d v = val_d d (fst (iedges G e)) + sint (c e) \\<and>\n        cast_long (n v) = cast_long (n (fst (iedges G e))) + 1)\"\n\nlemma just_inv_step:\n  assumes v_less_max: \"v < (max_word::32 word)\"\n  shows \"just_inv G d c s n p (v + 1) \\<longleftrightarrow> just_inv G d c s n p v\n    \\<and> (v \\<noteq> s \\<and> is_inf_d d v = 0 \\<longrightarrow> \n      sint (p v) \\<ge> 0 \\<and>\n      (\\<exists> e. e = p v \\<and> e < iedge_cnt G \\<and> \n        v = snd (iedges G e) \\<and>\n        is_inf_d d (fst (iedges G e)) = 0 \\<and>\n        val_d d v = val_d d (fst (iedges G e)) + sint (c e) \\<and>\n        cast_long (n v) = cast_long (n (fst (iedges G e))) + 1))\"\n  unfolding just_inv_def apply safe\n  by (metis less_x_plus_1 max_word_max not_le v_less_max)+\n                  \n  \nlemma just_inv_le:\n  assumes leq: \"j \\<le> i\" \n  assumes just_i: \"just_inv G d c s n p i\"\n  shows \"just_inv G d c s n p j\"\n  using assms \n  by (induct j) (auto simp add: just_inv_def)\n\nlemma  word32_minus_comm: \"(x:: 32 word) - y - z = x - z - y\" by simp\n\nlemma just_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   just' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> just_inv iG iD iC sc iN iP (ivertex_cnt iG)) \\<rbrace>!\" \n  apply (clarsimp simp: just'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(vv, s). unat (ivertex_cnt iG - vv)\" and\n        I=\"\\<lambda>vv s. P s \\<and> just_inv iG iD iC sc iN iP vv \\<and>\n                   vv \\<le> ivertex_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and>\n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_cost s iG iC c \\<and>\n                   is_numm s iG iN n \\<and>\n                   is_pedge s iG iP p\"])\n  apply (simp add: skipE_def)\n  apply wp\n     apply (subst if_bool_eq_conj)+\n     apply simp\n     apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI, rule conjI, blast)\n        apply (unfold just_inv_def is_graph_def is_pedge_def is_dist_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n        apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n        apply (rule conjI, subst is_inf_d_heap, blast, fast, fastforce)\n        apply (clarsimp, subst (asm) (13) arrlist_heap[where iL=iP], blast, blast, simp add: int_unat sint_ucast)\n       apply (rule impI, rule conjI, rule impI, rule conjI, blast)\n        apply (unfold just_inv_def is_graph_def is_pedge_def is_dist_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n        apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n        apply (rule conjI, subst is_inf_d_heap, blast, fast, fastforce)\n        apply (clarsimp, subst (asm) (12) arrlist_heap[where iL=iP], blast, blast, simp add: int_unat sint_ucast)\n       apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, blast)\n         apply (unfold just_inv_def is_graph_def is_pedge_def is_dist_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n         apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n         apply (rule conjI, subst is_inf_d_heap, blast, fast, fastforce)\n         apply (clarsimp, subst (asm) (11) arrlist_heap[where iL=iP], blast, blast)\n         apply (subst (asm) (2) head_heap, blast, simp add: uint_nat, simp add: uint_nat)\n        apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, blast)\n          apply (unfold just_inv_def is_graph_def is_pedge_def is_dist_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n          apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n          apply (rule conjI, subst is_inf_d_heap, blast, fast, fastforce)\n          apply (clarsimp simp del: Word_Lemmas.sint_0, subst (asm) (10) arrlist_heap[where iL=iP], blast, blast)\n          apply (subst (asm) (5) tail_heap, blast, simp add: uint_nat)\n          apply (subst (asm) (3) is_inf_d_heap, fast, metis not_le s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n          apply (simp add: uint_nat)\n         apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, blast)\n           apply (unfold just_inv_def is_graph_def is_pedge_def is_dist_def is_cost_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n           apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n           apply (rule conjI, subst is_inf_d_heap, blast, fast, fastforce)\n           apply (clarsimp simp del: Word_Lemmas.sint_0, subst (asm) (9) arrlist_heap[where iL=iP], blast, blast)\n           apply (subst (asm) (2) arrlist_heap[where iL=iC], blast, simp add: uint_nat)\n           apply (subst (asm) (8) arrlist_heap[where iL=iP], blast, blast)\n           apply (subst (asm) (4) tail_heap, blast, simp add: uint_nat)\n           apply (subst (asm) (4) val_d_heap, fast, metis not_le s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n           apply (subst (asm) (3) val_d_heap, fast, fast, simp add: uint_nat)\n          apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, blast)\n            apply (unfold just_inv_def is_graph_def is_pedge_def is_dist_def is_numm_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n            apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n            apply (rule conjI, subst is_inf_d_heap, blast, fast, fastforce)\n            apply (clarsimp, subst (asm) (14) arrlist_heap[where iL=iP], blast, blast)\n            apply (subst (asm) (6) tail_heap, blast, simp add: uint_nat)\n            apply (subst (asm) (4) arrlist_heap[where iL=iN], fast, metis not_le s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n            apply (subst (asm) (3) arrlist_heap[where iL=iN], fast, fast, simp add: uint_nat)\n           apply (rule conjI, rule impI, clarsimp)\n            apply (rule conjI)\n             apply (subgoal_tac \" vv + 1 \\<le> fst iG\")\n              apply (subgoal_tac \"vv < (max_word::32 word)\")\n               apply (drule just_inv_step[where G=iG and d=iD and c=iC and s=sc and n=iN and p=iP])\n               apply (clarsimp simp del: Word_Lemmas.sint_0)+\n               apply (unfold is_graph_def is_dist_def is_numm_def is_cost_def is_pedge_def)[1]\n               apply (rule conjI, subst arrlist_heap[where iL=iP], simp, fast, simp add: sint_ucast uint_nat)\n               apply (rule conjI, subst arrlist_heap[where iL=iP], simp, fast, simp add: uint_nat)\n               apply (rule conjI, subst arrlist_heap[where iL=iP], simp, fast, subst head_heap, force, simp add: uint_nat, simp add: uint_nat)\n               apply (rule conjI, subst arrlist_heap[where iL=iP], simp, fast, subst tail_heap, force, simp add: uint_nat, subst is_inf_d_heap,\n                      simp, simp add: uint_nat, metis not_le s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph, simp add: uint_nat)\n               apply (rule conjI, subst arrlist_heap[where iL=iP], simp, fast, subst arrlist_heap[where iL=iP], simp, fast,\n                      subst arrlist_heap[where iL=iC], simp, simp add: uint_nat, subst tail_heap, force, simp add: uint_nat,\n                      subst val_d_heap, simp, fast, subst val_d_heap, simp, simp add: uint_nat,\n                      metis not_le s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph, simp add: uint_nat)\n               apply (subst arrlist_heap[where iL=iP], simp, fast, subst tail_heap, force, simp add: uint_nat,\n                      subst arrlist_heap[where iL=iN], simp, fast, subst arrlist_heap[where iL=iN], simp, simp add: uint_nat, \n                      metis not_le s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph, simp add: uint_nat)\n              apply (metis max_word_max not_le word_le_less_eq)\n             apply (metis inc_le is_graph_def)\n            apply (rule conjI, metis inc_le is_graph_def)\n            apply (rule conjI, metis is_graph_def unat_minus_plus1_less)\n            apply (unfold is_graph_def)[1]\n            apply (clarsimp simp: if_bool_eq_conj)+\n           apply (unfold is_graph_def is_dist_def is_pedge_def is_numm_def is_cost_def)[1]\n           apply (rule conjI)\n            apply (clarsimp simp: if_bool_eq_conj)+\n            apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n           apply (rule conjI)\n            apply (clarsimp simp: if_bool_eq_conj)+\n            apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n            apply (metis not_le wellformed_iGraph word_less_nat_alt)\n            apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n          apply (rule conjI, unfold is_graph_def is_dist_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n          apply (rule conjI, blast intro: signed_overflow)\n          apply (rule conjI, blast intro: signed_underflow)\n          apply (rule conjI)\n           apply (unfold is_graph_def is_cost_def is_pedge_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n          apply (rule conjI)\n           apply (unfold is_graph_def is_dist_def is_pedge_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n           apply (metis not_le wellformed_iGraph word_less_nat_alt)\n          apply (rule conjI)\n           apply (unfold is_graph_def is_pedge_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n          apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule conjI)\n           apply (unfold is_graph_def is_dist_def is_pedge_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n           apply (metis not_le wellformed_iGraph word_less_nat_alt)\n          apply (rule conjI)\n           apply (unfold is_graph_def is_pedge_def)[1]\n          apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n         apply (unfold is_graph_def)[1]\n         apply (clarsimp simp: if_bool_eq_conj)+\n        apply (rule conjI)\n         apply (unfold is_graph_def is_pedge_def)[1]\n         apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n        apply (unfold is_graph_def)[1]\n        apply (clarsimp simp: if_bool_eq_conj)+\n       apply (unfold is_graph_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule conjI, rule impI, rule conjI)\n        apply (subgoal_tac \" vv + 1 \\<le> fst iG\")\n         apply (subgoal_tac \"vv < (max_word::32 word)\")\n          apply (drule just_inv_step[where G=iG and d=iD and c=iC and s=sc and n=iN and p=iP])\n          apply (clarsimp simp del: Word_Lemmas.sint_0)\n          apply (unfold is_graph_def is_dist_def)[1]\n          apply (subst (asm) is_inf_d_heap, force, fastforce, simp)\n         apply (metis max_word_max not_le word_le_less_eq)\n        apply (metis inc_le is_graph_def)\n       apply (rule conjI, metis inc_le is_graph_def)\n       apply (rule conjI, simp add: is_graph_def unat_minus_plus1_less)\n       apply (unfold is_graph_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n      apply (unfold is_graph_def is_dist_def is_pedge_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule conjI)\n      apply (subgoal_tac \" sc + 1 \\<le> fst iG\")\n       apply (subgoal_tac \"sc < (max_word::32 word)\")\n        apply (drule just_inv_step[where G=iG and d=iD and c=iC and s=sc and n=iN and p=iP])\n        apply clarsimp\n       apply (metis max_word_max not_le word_le_less_eq)\n      apply (metis inc_le is_graph_def)\n     apply (rule conjI, metis inc_le is_graph_def)\n     apply (rule conjI, simp add: is_graph_def unat_minus_plus1_less)\n     apply (rule conjI, force simp add: is_graph_def)\n     apply (unfold is_graph_def is_pedge_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n    apply (metis is_graph_def word_le_less_eq)\n   apply wp\n  apply (unfold just_inv_def is_graph_def)[1]\n  apply auto\n  done\n\n\n(* this should not be correct *)\nlemma signed_word_nonzero:\n  fixes a :: \"32 signed word\"\n  shows \"a \\<le> 0 \\<longleftrightarrow> a = 0\"\n  using word_le_0_iff by simp\n\n\nlemma wf_inv_is_fin_digraph:\n   \"is_wellformed_inv G (iedge_cnt G) \\<longleftrightarrow> fin_digraph (abs_IGraph G)\"\n    unfolding is_wellformed_inv_def fin_digraph_def fin_digraph_axioms_def\n      wf_digraph_def no_loops_def \n    by auto\n\nlemma wf_inv_is_wf_digraph:\n   \"is_wellformed_inv G (iedge_cnt G) \\<longleftrightarrow> wf_digraph (abs_IGraph G)\"\n    unfolding is_wellformed_inv_def fin_digraph_def fin_digraph_axioms_def\n      wf_digraph_def no_loops_def \n    by auto\n\nlemma trian_inv_eq_math:\n  \"trian_inv G d c (fst (snd G)) \\<longleftrightarrow> \n   (\\<forall>e. e \\<in> arcs (abs_IGraph G) \\<longrightarrow> \n    abs_IDist d (head (abs_IGraph G) e) \\<le> \n    abs_IDist d (tail (abs_IGraph G) e) + ereal (abs_ICost c e))\"\n  apply safe\n   apply (unfold abs_IDist_def abs_ICost_def abs_IGraph_def trian_inv_def)[1]\n   apply (erule_tac x=e in allE)\n   apply force\n   apply (unfold abs_IDist_def abs_ICost_def abs_IGraph_def trian_inv_def)[1]\n  apply (rule allI, clarsimp, force)\n  done\n\nlemma just_inv_eq_math: \n  \"just_inv G d c s n p (ivertex_cnt G) \\<longleftrightarrow> \n    (\\<forall>v<fst G. v \\<noteq> s \\<longrightarrow>\n    (\\<exists>i. abs_INum n d v = enat i) \\<longrightarrow>\n    (\\<exists> e. (abs_IPedge p v) = Some e \\<and>\n     e < (fst (snd G)) \\<and>\n     v = snd (snd (snd G) e) \\<and>\n     abs_IDist d v =\n       abs_IDist d (fst (snd (snd G) e)) + ereal (abs_ICost c e) \\<and>\n     abs_INum n d v = \n       abs_INum n d (fst (snd (snd G) e)) + enat (Suc 0)))\"\n  apply (simp add: just_inv_def)\n  apply (rule iffI; clarsimp; erule_tac x=v in allE)\n   apply (rule_tac x=\"p v\" in exI; clarsimp simp: abs_IPedge_def)\n   apply (case_tac \"snd(d v) = 0\"; clarsimp simp: not_le word_msb_sint abs_INum_def)\n   apply (rule conjI)\n    apply (simp add: add_ucast_no_overflow_unat abs_IDist_def abs_ICost_def abs_IPedge_def)\n   apply (metis add.right_neutral add_Suc_right long_ucast word_add_cast_up_no_overflow unat_eq_1(2))\n  apply (clarsimp simp add: abs_IPedge_def)\n   apply (subgoal_tac \"\\<exists>i. abs_INum n d v = enat i\"; simp add: abs_INum_def) \n  apply (case_tac \"msb (p v)\"; \n      clarsimp simp: not_le word_msb_sint \n      abs_INum_def abs_IDist_def abs_ICost_def)  \n  apply (case_tac \"n (fst (snd (snd G) (p v))) = 0\") \n   apply (case_tac \"snd (d v) = 0\"; \n      case_tac \"snd (d (fst (snd (snd G) (p v)))) = 0\"; \n      clarsimp simp: add_ucast_no_overflow_unat)\n   apply (simp add: unat_eq_1(2))\n  apply (metis add.commute of_nat_Suc ucast_nat_def)\n  done\n\ndefinition basic_just_sp_inv :: \n  \"IGraph \\<Rightarrow> IENInt \\<Rightarrow> ICost \\<Rightarrow> IVertex \\<Rightarrow> IEInt \\<Rightarrow> IPEdge \\<Rightarrow> bool\" where\n  \"basic_just_sp_inv G d c s n p \\<equiv>\n       (is_wellformed_inv G (iedge_cnt G) \\<and>\n        is_inf_d d s \\<le> 0 \\<and>\n        (is_inf_d d s = 0 \\<longrightarrow> val_d d s \\<le> 0) \\<and>\n        trian_inv G d c (iedge_cnt G) \\<and> \n        just_inv G d c s n p (ivertex_cnt G))\"\n\nlemma check_basic_just_sp_spc_intermediate:\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          sc < ivertex_cnt iG \\<and> \n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   check_basic_just_sp' g d c sc n p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n        basic_just_sp_inv iG iD iC sc iN iP)\\<rbrace>!\"\n  apply (clarsimp simp: check_basic_just_sp'_def basic_just_sp_inv_def)\n  apply wp\n        apply (rule_tac P1=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          sc < ivertex_cnt iG \\<and> \n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          is_wellformed_inv iG (iedge_cnt iG) \\<and>\n          is_inf_d iD sc \\<le> 0 \\<and>\n          (is_inf_d iD sc = 0 \\<longrightarrow> val_d iD sc \\<le> 0) \\<and>\n          trian_inv iG iD iC (iedge_cnt iG))\" \n      in validNF_post_imp[OF _ just_spc'])\n        apply fastforce \n       apply wp\n      apply wp\n      apply (rule_tac P1=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          sc < ivertex_cnt iG \\<and> \n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          is_wellformed_inv iG (iedge_cnt iG) \\<and>\n          is_inf_d iD sc \\<le> 0 \\<and>\n          (is_inf_d iD sc = 0 \\<longrightarrow> val_d iD sc \\<le> 0))\"\n      in validNF_post_imp[OF _ trian_spc']) \n  using fin_digraph_def fin_digraph_axioms_def\n      apply (fastforce simp: wf_inv_is_fin_digraph) \n     apply wp\n    apply wp\n   apply (rule_tac P1 = \" P and (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          sc < ivertex_cnt iG \\<and> \n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p) \"\n      in validNF_post_imp[OF _ is_wellformed_spc'])\n   apply clarsimp\n   defer\n   apply blast\n  apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI, fast)\n    apply (rule impI, rule conjI, rule impI, rule impI, rule impI, rule disjI1)\n     apply (unfold is_graph_def is_dist_def)[1]\n     apply (subst Word_Lemmas.sint_0[symmetric], subst is_inf_d_heap, simp, argo, subst val_d_heap, simp, argo, simp)\n    apply (unfold is_graph_def is_dist_def)[1]\n    apply (clarsimp simp: if_bool_eq_conj)+\n    apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n   apply (rule impI, rule conjI, rule impI, rule conjI, rule impI, blast)\n    apply (rule impI, rule conjI, rule impI, rule impI, rule disjI2)\n     apply (unfold just_inv_def is_graph_def is_dist_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n     apply (rule_tac x=sc in exI, clarsimp simp del: Word_Lemmas.sint_0)\n     apply (metis not_le ENInt_isInf_C_pte two_comp_arrlist_heap)\n    apply (unfold is_graph_def is_dist_def)[1]\n    apply (clarsimp simp: if_bool_eq_conj)+\n    apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n   apply (rule impI, rule conjI, (rule impI)+, rule disjI2)\n    apply (unfold just_inv_def is_graph_def is_dist_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n   apply (rule impI, rule conjI, unfold is_graph_def is_dist_def)[1]\n    apply (subst is_inf_d_heap, simp, argo, simp add: uint_nat)\n    apply (subst Word_Lemmas.sint_0[symmetric], subst is_inf_d_heap, simp, presburger, simp add: uint_nat)\n   apply (rule conjI, metis wf_inv_is_wf_digraph)\n    apply (clarsimp simp: if_bool_eq_conj)+\n   apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n  apply (rule impI, rule conjI, rule impI, rule conjI, (rule impI)+, rule disjI1)\n     apply (unfold is_graph_def is_dist_def)[1]\n    apply (subst Word_Lemmas.sint_0[symmetric], subst is_inf_d_heap, simp, argo, subst val_d_heap, simp, argo, simp)\n   apply (rule impI, rule conjI, unfold is_graph_def is_dist_def)[1]\n    apply (subst is_inf_d_heap, simp, argo, simp add: uint_nat)\n   apply (rule conjI, rule impI, subst val_d_heap, simp, argo, simp add: uint_nat)\n  apply (rule conjI, metis wf_inv_is_wf_digraph)\n    apply (clarsimp simp: if_bool_eq_conj)+\n   apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n  apply (rule impI, rule conjI, rule impI, rule conjI, rule impI, argo)\n   apply (rule impI, rule conjI, rule impI, rule impI, rule disjI2)\n     apply (unfold just_inv_def is_graph_def is_dist_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n     apply (rule_tac x=sc in exI, clarsimp simp del: Word_Lemmas.sint_0)\n    apply (metis not_le ENInt_isInf_C_pte two_comp_arrlist_heap)\n  apply (unfold is_graph_def is_dist_def)[1]\n    apply (clarsimp simp: if_bool_eq_conj)+\n   apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n  apply (rule impI, rule conjI, rule impI, meson)\n  apply (rule impI, rule conjI, unfold is_graph_def is_dist_def)[1]\n   apply (subst is_inf_d_heap, simp, argo, simp add: uint_nat)\n  apply (rule conjI, subst Word_Lemmas.sint_0[symmetric], subst is_inf_d_heap, simp, argo, simp add: uint_nat)\n  apply (rule conjI, metis wf_inv_is_wf_digraph)\n    apply (clarsimp simp: if_bool_eq_conj)+\n  apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n  done\n\nlemma basic_just_sp_eq_invariants_imp:\n  \"\\<And>G d c s n p. \n    (is_wellformed_inv G (iedge_cnt G) \\<and> \n    s < ivertex_cnt G \\<and>\n    is_inf_d d s \\<le> 0 \\<and>\n    (is_inf_d d s = 0 \\<longrightarrow> val_d d s \\<le> 0) \\<and>\n    trian_inv G d c (iedge_cnt G) \\<and> \n    just_inv G d c s n p (ivertex_cnt G))\n    =\n    basic_just_sp_pred \n    (abs_IGraph G) (abs_IDist d) \n    (abs_ICost c) s (abs_INum n d) (abs_IPedge p) \n    \"\nproof -\n  fix G d c s n p \n  let ?aG = \"abs_IGraph G\"\n  let ?ad = \"abs_IDist d\"\n  let ?ac = \"abs_ICost c\"\n  let ?an = \"abs_INum n d\"  \n  let ?ap = \"abs_IPedge p\"\n  show \"?thesis G d c s n p\"\n    unfolding \n      basic_just_sp_pred_def \n      basic_just_sp_pred_axioms_def \n      basic_sp_def basic_sp_axioms_def\n    by (auto simp: wf_inv_is_fin_digraph[where ?G=G]\n        trian_inv_eq_math[where ?G=G and ?d=d and ?c=c]\n        just_inv_eq_math[where ?G=G and ?d=d and ?c=c and ?s=s and ?n=n and ?p=p],\n        (simp add: abs_IDist_def)+)\nqed\n\nlemma basic_just_sp_eq_maths:\n  \"\\<And>G d c s n p. \n    (s < ivertex_cnt G \\<and>\n    basic_just_sp_inv G d c s n p)\n    =\n    basic_just_sp_pred \n    (abs_IGraph G) (abs_IDist d) \n    (abs_ICost c) s (abs_INum n d) (abs_IPedge p) \n    \"\nproof -\n  fix G d c s n p \n  let ?aG = \"abs_IGraph G\"\n  let ?ad = \"abs_IDist d\"\n  let ?ac = \"abs_ICost c\"\n  let ?an = \"abs_INum n d\"  \n  let ?ap = \"abs_IPedge p\"\n  show \"?thesis G d c s n p\"\n    unfolding basic_just_sp_inv_def\n    using basic_just_sp_eq_invariants_imp \n    by blast\nqed\n\ndefinition s_assms_inv :: \"IGraph \\<Rightarrow> IVertex \\<Rightarrow> IENInt \\<Rightarrow> IPEdge \\<Rightarrow> IEInt \\<Rightarrow> bool\" where\n  \"s_assms_inv G sc d p n \\<equiv> \n      sc < ivertex_cnt G \\<and>\n      is_inf_d d sc \\<le> 0 \\<and>\n      sint (p sc) < 0 \\<and>\n      n sc = 0\"\n\nlemma s_assms_spc':\n  \"wf_digraph (abs_IGraph iG) \\<Longrightarrow>\n   is_graph s iG g \\<Longrightarrow>\n   is_dist s iG iD d \\<Longrightarrow>\n   is_pedge s iG iP p \\<Longrightarrow>\n   is_numm s iG iN n \\<Longrightarrow>\n   s_assms' g sc d p n s = \n   Some (if s_assms_inv iG sc iD iP iN then 1 else 0)\" \n  apply (clarsimp simp: s_assms'_def)\n  apply (simp add: ocondition_def oguard_def ogets_def oreturn_def obind_def)\n  apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI)\n       apply (unfold s_assms_inv_def is_graph_def is_numm_def)[1]\n       apply (clarsimp, subst (asm) arrlist_heap[where iL=iN], fast, blast, metis uint_nat)\n      apply (unfold s_assms_inv_def is_graph_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule conjI, rule ccontr, erule_tac P=\"is_valid_ENInt_C s (d +\\<^sub>p uint sc)\" in notE)\n      apply (unfold s_assms_inv_def is_graph_def is_dist_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n     apply (rule ccontr, erule_tac P=\"is_valid_ENInt_C s (d +\\<^sub>p int (unat sc))\" in notE)\n     apply (unfold s_assms_inv_def is_graph_def is_dist_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n    apply (rule impI, rule ccontr, erule_tac P=\"is_valid_w32 s (PTR_COERCE(32 signed word \\<rightarrow> 32 word) (p +\\<^sub>p int (unat sc)))\" in notE)\n    apply (unfold s_assms_inv_def is_graph_def is_pedge_def)[1]\n    apply (clarsimp simp: if_bool_eq_conj)+\n    apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n    apply (metis not_le word_less_nat_alt)\n   apply (rule impI, rule conjI, rule impI)\n    apply (rule ccontr, erule_tac P=\"is_valid_w32 s (n +\\<^sub>p uint sc)\" in notE)\n    apply (unfold s_assms_inv_def is_graph_def is_numm_def)[1]\n    apply (clarsimp simp: if_bool_eq_conj)+\n    apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n    apply (metis not_le word_less_nat_alt)\n   apply (rule impI, rule ccontr, erule_tac P=\"is_valid_w32 s (n +\\<^sub>p uint sc)\" in notE)\n   apply (unfold s_assms_inv_def is_graph_def is_numm_def)[1]\n   apply (clarsimp simp: if_bool_eq_conj)+\n   apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n   apply (metis not_le word_less_nat_alt)\n  apply (rule impI, rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI)\n       apply (unfold s_assms_inv_def is_graph_def is_pedge_def, clarsimp)[1]\n       apply (subst (asm) arrlist_heap[where iL=iP], blast, force, metis int_unat sint_ucast)\n      apply (unfold s_assms_inv_def is_graph_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule ccontr, erule_tac P=\"is_valid_ENInt_C s (d +\\<^sub>p uint sc)\" in notE)\n     apply (unfold s_assms_inv_def is_graph_def is_dist_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n     apply (metis not_le word_less_nat_alt)\n    apply (rule impI, rule ccontr, erule_tac P=\"is_valid_w32 s (PTR_COERCE(32 signed word \\<rightarrow> 32 word) (p +\\<^sub>p uint sc))\" in notE)\n    apply (unfold s_assms_inv_def is_graph_def is_pedge_def)[1]\n    apply (clarsimp simp: if_bool_eq_conj)+\n    apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n    apply (metis not_le word_less_nat_alt)\n   apply (rule impI, rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI)\n       apply (unfold s_assms_inv_def is_dist_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n       apply (metis int_unat not_le ENInt_isInf_C_pte two_comp_arrlist_heap)\n      apply (unfold s_assms_inv_def is_graph_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule ccontr, erule_tac P=\"is_valid_ENInt_C s (d +\\<^sub>p (uint sc))\" in notE)\n     apply (unfold s_assms_inv_def is_graph_def is_dist_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n     apply (metis not_le word_less_nat_alt)\n    apply (rule impI, rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI)\n       apply (unfold s_assms_inv_def is_graph_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n       apply (force intro: not_le)\n      apply (unfold s_assms_inv_def is_graph_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule conjI, rule impI)\n      apply (unfold s_assms_inv_def is_graph_def is_pedge_def is_numm_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule conjI, force)\n      apply (rule conjI, unfold is_graph_def is_dist_def, subst is_inf_d_heap, force, simp, fastforce)\n      apply (rule conjI, subst arrlist_heap[where iL=iP], fast, simp, metis uint_nat sint_ucast)\n      apply (subst arrlist_heap[where iL=iN], fast, simp, metis uint_nat)\n     apply (clarsimp simp: if_bool_eq_conj)+\n    apply (rule ccontr, erule_tac P=\"is_valid_ENInt_C s (d +\\<^sub>p uint sc)\" in notE)\n    apply (unfold s_assms_inv_def is_graph_def is_numm_def)[1]\n    apply (clarsimp simp: if_bool_eq_conj)+\n    apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n    apply (metis not_le word_less_nat_alt)\n   apply (rule impI, rule ccontr, erule_tac P=\"is_valid_w32 s (PTR_COERCE(32 signed word \\<rightarrow> 32 word) (p +\\<^sub>p uint sc))\" in notE)\n   apply (unfold s_assms_inv_def is_graph_def is_pedge_def)[1]\n   apply (clarsimp simp: if_bool_eq_conj)+\n   apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n   apply (metis not_le word_less_nat_alt)\n  apply (rule impI, rule ccontr, erule_tac P=\"is_valid_w32 s (n +\\<^sub>p uint sc)\" in notE)\n  apply (unfold s_assms_inv_def is_graph_def is_numm_def)[1]\n  apply (clarsimp simp: if_bool_eq_conj)+\n  apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n  apply (metis not_le word_less_nat_alt)\n  done\n\n  \ndefinition parent_num_assms_inv :: \n  \"IGraph \\<Rightarrow> IVertex \\<Rightarrow> IENInt \\<Rightarrow> IPEdge \\<Rightarrow> IEInt  \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"parent_num_assms_inv G s d p n k \\<equiv>\n    \\<forall>v < k. v \\<noteq> s \\<and> is_inf_d d v \\<le> 0 \\<longrightarrow> \n      sint (p v) \\<ge> 0 \\<and>\n      (\\<exists> e. e = p v \\<and> e < iedge_cnt G \\<and>\n        v = snd (iedges G e) \\<and>\n        is_inf_d d (fst (iedges G e)) \\<le> 0 \\<and>\n        cast_long (n v) = cast_long (n (fst (iedges G e))) + 1)\"\n\nlemma parent_num_assms_inv_step:\n  assumes v_less_max: \"v < (max_word::32 word)\"\n  shows \"parent_num_assms_inv G s d p n (v + 1) \\<longleftrightarrow> parent_num_assms_inv G s d p n v\n    \\<and> (v \\<noteq> s \\<and> is_inf_d d v \\<le> 0 \\<longrightarrow> \n      sint (p v) \\<ge> 0 \\<and>\n      (\\<exists> e. e = p v \\<and> e < iedge_cnt G \\<and>\n        v = snd (iedges G e) \\<and>\n        is_inf_d d (fst (iedges G e)) \\<le> 0 \\<and>\n          cast_long (n v) = cast_long (n (fst (iedges G e))) + 1))\"\n  unfolding parent_num_assms_inv_def apply safe\n  by (metis less_x_plus_1 max_word_max not_le v_less_max)+\n                  \nlemma parent_num_assms_le:\n  assumes leq: \"j \\<le> i\" \n  assumes parent_num_assms_i: \"parent_num_assms_inv G s d p n i\"\n  shows \"parent_num_assms_inv G s d p n j\"\n  using assms \n  by (induct j) (auto simp add: parent_num_assms_inv_def)\n\nlemma parent_num_assms_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   parent_num_assms' g sc d p n\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> parent_num_assms_inv iG sc iD iP iN (ivertex_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: parent_num_assms'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(vv, s). unat (ivertex_cnt iG - vv)\" and\n        I=\"\\<lambda>vv s. P s \\<and> parent_num_assms_inv iG sc iD iP iN vv \\<and>\n                   vv \\<le> ivertex_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and>\n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d \\<and>\n                   is_numm s iG iN n \\<and>\n                   is_pedge s iG iP p\"])\n  apply (simp add: skipE_def)\n  apply wp\n     apply (subst if_bool_eq_conj)+\n     apply simp\n     apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, rule impI, rule conjI)\n         apply blast\n        apply (unfold parent_num_assms_inv_def is_graph_def is_dist_def is_pedge_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n        apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n        apply (rule conjI, subst is_inf_d_heap, fast, fast, blast) \n        apply (clarsimp, subst (asm) (9) arrlist_heap[where iL=iP], fast, fast, simp add: uint_nat sint_ucast)\n       apply (rule impI, rule conjI, rule impI, rule conjI, blast)\n        apply (unfold parent_num_assms_inv_def is_graph_def is_dist_def is_pedge_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n        apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n        apply (rule conjI, subst is_inf_d_heap, fast, fast, blast)\n        apply (clarsimp, subst (asm) (8) arrlist_heap[where iL=iP], fast, fast, simp add: uint_nat sint_ucast)\n       apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, blast)\n         apply (unfold parent_num_assms_inv_def is_graph_def is_dist_def is_pedge_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n         apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n         apply (rule conjI, subst is_inf_d_heap, fast, fast, blast)\n         apply (clarsimp, subst (asm) (2) head_heap, blast, blast)\n         apply (subst (asm) (7) arrlist_heap[where iL=iP], fast, fast, simp add: uint_nat sint_ucast)\n        apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, blast)\n          apply (unfold parent_num_assms_inv_def is_graph_def is_dist_def is_numm_def is_pedge_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n          apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n          apply (rule conjI, subst is_inf_d_heap, fast, fast, blast)\n          apply (clarsimp, subst (asm) (6) arrlist_heap[where iL=iP], blast, fast)\n          apply (subst (asm) (3) tail_heap, blast, simp add: uint_nat) \n          apply (subst (asm) (3) is_inf_d_heap, blast, metis not_le tail_heap wellformed_iGraph uint_nat, simp add: uint_nat)\n         apply (rule conjI, rule impI, rule conjI, rule impI, rule conjI, blast)\n           apply (unfold parent_num_assms_inv_def is_graph_def is_dist_def is_numm_def is_pedge_def, clarsimp simp del: Word_Lemmas.sint_0)[1]\n           apply (rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n           apply (rule conjI, subst is_inf_d_heap, fast, fast, blast)\n           apply (clarsimp, subst (asm) (10) arrlist_heap[where iL=iP], blast, fast, subst (asm) (4) tail_heap, blast, simp add: uint_nat)\n           apply (subst (asm) (4) arrlist_heap[where iL=iN], fast, metis not_le s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph uint_nat)\n           apply (subst (asm) (3) arrlist_heap[where iL=iN], fast, fast, simp add: uint_nat)\n          apply (rule conjI, clarsimp)\n           apply (rule conjI) \n            apply (subgoal_tac \" vv + 1 \\<le> fst iG\")\n             apply (subgoal_tac \"vv < (max_word::32 word)\")\n              apply (drule parent_num_assms_inv_step[where G=iG and s=sc and d=iD and p=iP and n=iN])\n              apply clarsimp\n              apply (unfold is_graph_def is_dist_def is_pedge_def is_numm_def)[1] \n              apply (rule conjI, subst arrlist_heap[where iL=iP], simp, fast, simp add: sint_ucast uint_nat)\n              apply (rule conjI, subst arrlist_heap[where iL=iP], simp, fast, simp add: uint_nat)\n              apply (rule conjI, subst arrlist_heap[where iL=iP], simp, fast, subst head_heap, force, simp add: uint_nat, metis uint_nat)\n              apply (rule conjI, subst arrlist_heap[where iL=iP], simp, fast, subst tail_heap, force, simp add: uint_nat,\n                     subst is_inf_d_heap, simp, simp add: uint_nat, metis not_le tail_heap wellformed_iGraph uint_nat, simp add:uint_nat)\n              apply (subst arrlist_heap[where iL=iP], simp, fast, subst tail_heap, force, simp add: uint_nat,\n                     subst arrlist_heap[where iL=iN], simp, fast, subst arrlist_heap[where iL=iN], simp, simp add: uint_nat,\n                     metis not_le s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph, simp add: uint_nat)\n             apply (metis max_word_max not_le word_le_less_eq)\n            apply (metis inc_le is_graph_def)\n           apply (rule conjI, metis inc_le is_graph_def)\n           apply (rule conjI, metis is_graph_def unat_minus_plus1_less)\n           apply (unfold parent_num_assms_inv_def is_graph_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule conjI, unfold parent_num_assms_inv_def is_graph_def is_numm_def is_pedge_def)[1]\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n          apply (rule conjI)\n           apply (clarsimp simp: if_bool_eq_conj)+\n           apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n           apply (metis not_le wellformed_iGraph word_less_nat_alt)\n          apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n         apply (rule conjI, unfold parent_num_assms_inv_def is_graph_def is_dist_def is_pedge_def)[1]\n          apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n          apply (metis not_le wellformed_iGraph word_less_nat_alt)\n         apply (rule conjI, unfold parent_num_assms_inv_def is_graph_def is_numm_def is_pedge_def)[1]\n          apply (clarsimp simp: if_bool_eq_conj)+\n          apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n         apply (clarsimp simp: if_bool_eq_conj)+\n        apply (rule conjI, unfold parent_num_assms_inv_def is_graph_def is_numm_def is_pedge_def)[1]\n         apply (clarsimp simp: if_bool_eq_conj)+\n         apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n       apply (clarsimp simp: if_bool_eq_conj)+\n       apply (unfold is_graph_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule conjI, rule impI, rule conjI)\n        apply (subgoal_tac \" vv + 1 \\<le> fst iG\")\n         apply (subgoal_tac \"vv < (max_word::32 word)\")\n          apply (drule parent_num_assms_inv_step[where G=iG and s=sc and d=iD and p=iP and n=iN])\n          apply clarsimp\n          apply (unfold is_graph_def is_dist_def)[1]\n          apply (subst (asm) (1) is_inf_d_heap, force, fast, linarith)\n         apply (metis max_word_max not_le word_le_less_eq)\n        apply (simp add: inc_le is_graph_def)\n       apply (rule conjI, simp add: inc_le is_graph_def)\n       apply (rule conjI, simp add: is_graph_def unat_minus_plus1_less)\n       apply (unfold is_graph_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule conjI, unfold is_graph_def is_dist_def is_pedge_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n       apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n     apply clarsimp\n     apply (rule conjI)\n      apply (subgoal_tac \" sc + 1 \\<le> fst iG\")\n       apply (subgoal_tac \"sc < (max_word::32 word)\")\n        apply (drule parent_num_assms_inv_step[where G=iG and s=sc and d=iD and p=iP and n=iN])\n        apply clarsimp\n       apply (metis max_word_max not_le word_le_less_eq)\n      apply (simp add: inc_le is_graph_def)\n     apply (rule conjI, simp add: inc_le is_graph_def)\n     apply (rule conjI, simp add: is_graph_def unat_minus_plus1_less)\n     apply (rule conjI)\n      apply (unfold is_graph_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n     apply (unfold is_graph_def is_pedge_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n    apply (metis is_graph_def word_le_less_eq)\n   apply wp\n  apply (unfold parent_num_assms_inv_def is_graph_def is_dist_def is_numm_def is_pedge_def, force)\n  done\n\nlemma parent_num_assms_inv_eq_math: \n  \"parent_num_assms_inv G s d p n (ivertex_cnt G) \\<longleftrightarrow> \n    (\\<forall>v<fst G. v \\<noteq> s \\<longrightarrow>\n    (\\<exists>i. abs_IDist d v \\<noteq> \\<infinity>) \\<longrightarrow>\n    (\\<exists> e. (abs_IPedge p v) = Some e \\<and>\n     e < (fst (snd G)) \\<and>\n     v = snd (snd (snd G) e) \\<and>\n     abs_IDist d (fst (snd (snd G) e)) \\<noteq> \\<infinity> \\<and>\n     abs_INat n v = \n     abs_INat n (fst (snd (snd G) e)) + enat (Suc 0)))\"\n  apply (simp add: parent_num_assms_inv_def)\n  apply (rule iffI; clarsimp; erule_tac x=v in allE)\n   apply (rule_tac x= \"p v\" in exI, rule conjI, clarsimp simp: abs_IPedge_def, metis abs_IDist_def infinity_ereal_def \n      not_le word_msb_sint)\n   apply (clarsimp simp: not_le word_msb_sint abs_INat_def) \n   apply (rule conjI, metis abs_IDist_def infinity_ereal_def not_le)\n   apply (metis (mono_tags, hide_lams) abs_IDist_def PInfty_neq_ereal(1) add.right_neutral add_Suc_right ereal.distinct(5) \n      infinity_ereal_def not_le long_ucast word_add_cast_up_no_overflow unat_eq_1(2))\n  apply ((safe)[1], (fastforce simp add: abs_IDist_def)+, unfold abs_IGraph_def abs_IDist_def abs_INat_def abs_IPedge_def, simp_all)\n     apply (simp add: word_msb_sint)+\n   apply (metis (mono_tags, hide_lams) add.right_neutral add_Suc_right long_ucast word_add_cast_up_no_overflow unat_eq_1(2) word_unat.Rep_inject)+\n  done\n\nlemma s_assms_eq_math:\n  \"s_assms_inv G sc d p n  \\<longleftrightarrow> \n   (sc \\<in> verts (abs_IGraph G) \\<and>\n    abs_IDist d sc \\<noteq> \\<infinity> \\<and>\n    abs_IPedge p sc = None \\<and>\n    abs_INat n sc = 0)\"\n  apply safe\n      apply (unfold s_assms_inv_def abs_IGraph_def, clarsimp)[1]\n     apply (unfold s_assms_inv_def abs_IDist_def, clarsimp)[1]\n    apply (unfold s_assms_inv_def abs_IDist_def, clarsimp)[1]\n  using word_msb_sint apply blast\n   apply (unfold s_assms_inv_def abs_INat_def, clarsimp)[1]\n  apply (unfold s_assms_inv_def abs_IGraph_def abs_IDist_def abs_INat_def abs_IPedge_def, clarsimp)\n   apply (simp add: unat_eq_zero word_msb_sint zero_enat_def)+\n  done\n\ndefinition shortest_paths_locale_step1_inv :: \n  \"IGraph \\<Rightarrow> IVertex \\<Rightarrow> IEInt \\<Rightarrow> IPEdge \\<Rightarrow> IENInt \\<Rightarrow> bool\" where\n  \"shortest_paths_locale_step1_inv G sc n p d \\<equiv>\n       is_wellformed_inv G (iedge_cnt G) \\<and>\n       s_assms_inv G sc d p n \\<and>\n       parent_num_assms_inv G sc d p n (ivertex_cnt G)\"\n\nlemma shortest_paths_locale_step1_spc_intermediate:\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\\<rbrace>\n   shortest_paths_locale_step1' g sc n p d\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n        shortest_paths_locale_step1_inv iG sc iN iP iD)\\<rbrace>!\"\n  apply (clarsimp simp: shortest_paths_locale_step1'_def shortest_paths_locale_step1_inv_def)\n  apply wp\n        apply (rule_tac P1=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          is_wellformed_inv iG (iedge_cnt iG) \\<and>\n          s_assms_inv iG sc iD iP iN)\" \n      in validNF_post_imp[OF _ parent_num_assms_spc'])\n        apply fastforce \n       apply wp\n        apply (rule_tac P1=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p)\" \n      in validNF_post_imp[OF _ is_wellformed_spc'])\n   defer\n  apply force\n  apply clarsimp\n  apply (rule conjI, rule impI, rule conjI, rule impI, rule impI, rule impI)\n    apply blast\n  apply (rule impI, rule conjI)\n apply (metis fin_digraph_def s_assms_spc' wf_inv_is_fin_digraph)\n   apply (rule impI)\n  apply (subgoal_tac \"\\<And>pa. \\<not> wf_digraph (abs_IGraph iG) \\<or> \\<not> is_graph s iG pa \\<or> s_assms' pa sc d p n s = Some (if True then 1 else 0)\")\n    apply (metis (no_types) fin_digraph_def option.sel shortest_path_neg_checker.wf_inv_is_fin_digraph zero_neq_one)\n   apply (simp add: s_assms_spc')\n  apply (rule impI, rule conjI, rule impI, rule impI, rule impI)\n   apply blast\n  apply (rule impI, rule conjI)\n   apply (metis fin_digraph_def s_assms_spc' wf_inv_is_fin_digraph)\n  apply rule\n   apply (subgoal_tac \"wf_digraph (abs_IGraph iG)\")\n    apply (simp add: s_assms_spc')\n  apply (meson fin_digraph_def wf_inv_is_fin_digraph)\n  apply (metis fin_digraph.axioms(1) shortest_path_neg_checker.wf_inv_is_fin_digraph)\n  done\n\nlemma shortest_paths_locale_step1_inv_eq_maths:\n  \"\\<And>G d s n p. \n    shortest_paths_locale_step1_inv G s n p d\n    =\n    shortest_paths_locale_step1\n    (abs_IGraph G) s (abs_INat n)\n    (abs_IPedge p) (abs_IDist d)\n    \"\nproof -\n  fix G d c s n p \n  let ?aG = \"abs_IGraph G\"\n  let ?ad = \"abs_IDist d\"\n  let ?an = \"abs_INat n\"  \n  let ?ap = \"abs_IPedge p\"\n  show \"?thesis G d s n p\"\n    unfolding \n      shortest_paths_locale_step1_def\n      shortest_paths_locale_step1_inv_def\n    apply (auto simp: wf_inv_is_fin_digraph[where ?G=G]\n        s_assms_eq_math[where ?G=G and ?sc=s and ?d=d and ?p=p and ?n=n]\n        parent_num_assms_inv_eq_math[where ?G=G and ?s=s and ?d=d and ?p=p and ?n=n])\n     apply (unfold parent_num_assms_inv_def abs_IPedge_def abs_INat_def abs_IDist_def)[1]\n     apply clarsimp\n        apply (metis (mono_tags, hide_lams) Word_Lemmas.sint_0 add.right_neutral add_Suc_right \n        less_le not_le long_ucast word_add_cast_up_no_overflow unat_eq_1(2) word_msb_sint)\n       apply (metis (mono_tags, hide_lams) Word_Lemmas.sint_0 add.right_neutral add_Suc_right less_le \n        not_le long_ucast word_add_cast_up_no_overflow unat_eq_1(2) word_msb_sint)\n      apply (metis (mono_tags, hide_lams) Word_Lemmas.sint_0 add.right_neutral add_Suc_right \n        less_le not_le long_ucast word_add_cast_up_no_overflow unat_eq_1(2) word_msb_sint)\n     apply (metis (mono_tags, hide_lams) Word_Lemmas.sint_0 add.right_neutral add_Suc_right \n        less_le not_le long_ucast word_add_cast_up_no_overflow unat_eq_1(2) word_msb_sint)\n    apply (unfold parent_num_assms_inv_def abs_IPedge_def abs_INat_def abs_IDist_def)[1]\n    apply clarsimp\n     apply safe[1]\n         apply (metis not_le word_msb_sint)\n        apply (metis not_le)\n       apply (metis not_le)\n      apply (metis not_le not_less_iff_gr_or_eq)\n     apply (subgoal_tac \"\\<forall>n. n + unat (1::64 word) = Suc n\")\n      apply (subgoal_tac \"\\<forall>w. unat (UCAST(32 \\<rightarrow> 64) (w::32 word) + (1::64 word)) = Suc (unat (UCAST(32 \\<rightarrow> 64) w::64 word))\")\n       apply (subgoal_tac \"Suc (unat (UCAST(32 \\<rightarrow> 64) (n (fst (snd (snd G) (p v))))::64 word)) = unat (UCAST(32 \\<rightarrow> 64) (n v)::64 word)\")\n        apply (metis (no_types) word_unat.Rep_inject)\n       apply (metis (no_types) not_le long_ucast)\n      apply (metis (full_types) long_ucast word_add_cast_up_no_overflow unat_eq_1(2))\n     apply simp\n    apply safe\n        apply (metis not_le word_msb_sint)\n       apply (metis not_le)\n      apply (metis not_le)\n     apply (metis not_le not_less_iff_gr_or_eq)\n    apply (metis (mono_tags, hide_lams) add.right_neutral add_Suc_right not_le long_ucast word_add_cast_up_no_overflow \n        unat_eq_1(2) word_unat.Rep_inverse)\n    done\nqed\n\ndefinition source_val_inv :: \n  \"IGraph \\<Rightarrow> IVertex \\<Rightarrow> IENInt \\<Rightarrow> IEInt \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"source_val_inv G s d n k \\<equiv>\n    (\\<exists>v < k. is_inf_d d v = 0) \\<longrightarrow>\n       (is_inf_d d s = 0 \\<and>\n        val_d d s = 0)\"\n\nlemma source_val_inv_step:\n  assumes v_less_max: \"v < (max_word::32 word)\"\n  shows \"source_val_inv G s d n (v + 1) \\<longleftrightarrow> \n         (source_val_inv G s d n v \\<and> is_inf_d d s = 0 \\<and> val_d d s = 0) \\<or>\n         (source_val_inv G s d n v \\<and> is_inf_d d v \\<noteq> 0)\"\n  unfolding source_val_inv_def\n  by (metis less_irrefl less_x_plus_1 v_less_max)\n  \n\nlemma source_val_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          sc < ivertex_cnt iG \\<and> \n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n)\\<rbrace>\n   source_val' g sc d n\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> source_val_inv iG sc iD iN (ivertex_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: source_val'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(vv, s). unat (ivertex_cnt iG - vv)\" and\n        I=\"\\<lambda>vv s. P s \\<and> source_val_inv iG sc iD iN vv \\<and>\n                   vv \\<le> ivertex_cnt iG \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and>\n                   is_graph s iG g \\<and>\n                   sc < ivertex_cnt iG \\<and> \n                   is_dist s iG iD d \\<and>\n                   is_numm s iG iN n\"])\n  apply (simp add: skipE_def)\n  apply wp\n     apply (subst if_bool_eq_conj)+\n     apply (clarsimp simp del: Word_Lemmas.sint_0)\n     apply (rule conjI, rule impI, rule conjI, rule impI)\n       apply (unfold source_val_inv_def is_graph_def is_dist_def)[1]\n       apply (clarsimp simp del: Word_Lemmas.sint_0)\n       apply (rule, rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n        apply (subst is_inf_d_heap, blast, force, simp)\n       apply (rule impI, subst val_d_heap, blast, fast)\n       apply (metis Word_Lemmas.sint_0 int_unat ENInt_isInf_C_pte two_comp_arrlist_heap)\n      apply (rule conjI, rule impI, rule conjI, rule impI)\n        apply (unfold source_val_inv_def is_graph_def is_dist_def)[1]\n        apply (clarsimp simp del: Word_Lemmas.sint_0, rule, rule_tac x=vv in exI, clarsimp simp del: Word_Lemmas.sint_0)\n         apply (subst is_inf_d_heap, blast, force, simp)\n        apply (rule impI, subst val_d_heap, blast, blast, fastforce)\n       apply (rule conjI, rule impI)\n        apply (unfold source_val_inv_def is_graph_def is_dist_def)[1]\n        apply (rule, rule conjI, subst is_inf_d_heap, force, argo, simp)\n        apply (subst val_d_heap, force, argo, simp)\n       apply (unfold is_graph_def is_dist_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n       apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n      apply (unfold is_graph_def is_dist_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n     apply (rule conjI, rule impI, rule conjI)\n       apply (subgoal_tac \" vv + 1 \\<le> fst iG\")\n        apply (subgoal_tac \"vv < (max_word::32 word)\")\n         apply (drule source_val_inv_step[where G=iG and s=sc and d=iD and n=iN])\n         apply (clarsimp simp del: Word_Lemmas.sint_0)+\n         apply (unfold is_graph_def is_dist_def is_cost_def)[1]\n         apply (subst (asm) (2) is_inf_d_heap, simp, fast, simp add: uint_nat)\n        apply (metis max_word_max not_le word_le_less_eq)\n       apply (metis inc_le is_graph_def)\n      apply (rule conjI, metis inc_le is_graph_def)\n      apply (rule conjI, metis is_graph_def unat_minus_plus1_less)\n      apply (unfold is_graph_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (unfold is_graph_def is_dist_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n    apply (metis shortest_path_neg_checker.is_graph_def word_le_less_eq)\n   apply wp\n  apply (unfold source_val_inv_def is_graph_def, force)\n  done\n\ndefinition no_edge_Vm_Vf_inv :: \"IGraph \\<Rightarrow> IENInt \\<Rightarrow> 32 word \\<Rightarrow> bool\" where\n  \"no_edge_Vm_Vf_inv G d m \\<equiv> \n    \\<forall>i < m. is_inf_d d (fst (iedges G i)) < 0 \\<longrightarrow> is_inf_d d (snd (iedges G i)) \\<noteq> 0\"\n\nlemma no_edge_Vm_Vf_inv_step:\n  assumes i_less_max: \"i < (max_word::32 word)\"\n  shows \"no_edge_Vm_Vf_inv G d (i + 1) \\<longleftrightarrow> no_edge_Vm_Vf_inv G d i \\<and>\n  (is_inf_d d (fst (iedges G i)) < 0 \\<longrightarrow> is_inf_d d (snd (iedges G i)) \\<noteq> 0)\"\n  unfolding no_edge_Vm_Vf_inv_def\n  by (metis i_less_max less_x_plus_1 max_word_max not_le)+\n\nlemma no_edge_Vm_Vf_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d)\\<rbrace>\n   no_edge_Vm_Vf' g d\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longleftrightarrow> no_edge_Vm_Vf_inv iG iD (iedge_cnt iG)) \\<rbrace>!\"\n  apply (clarsimp simp: no_edge_Vm_Vf'_def)\n  apply (subst whileLoopE_add_inv [where \n        M=\"\\<lambda>(ee, s). unat (iedge_cnt iG - ee)\" and\n        I=\"\\<lambda>ee s. P s \\<and> no_edge_Vm_Vf_inv iG iD ee \\<and>\n                   wf_digraph (abs_IGraph iG) \\<and>\n                   is_graph s iG g \\<and>\n                   is_dist s iG iD d\"])\n  apply (simp add: skipE_def)\n  apply wp\n     apply (subst if_bool_eq_conj)+\n     apply (clarsimp simp del: Word_Lemmas.sint_0)\n     apply (rule conjI, rule impI, rule conjI, rule impI)\n       apply (unfold no_edge_Vm_Vf_inv_def is_graph_def is_dist_def)[1]\n       apply (clarsimp simp del: Word_Lemmas.sint_0, rule_tac x=ee in exI, clarsimp simp del: Word_Lemmas.sint_0)\n       apply (rule conjI, subst tail_heap, blast, blast, subst is_inf_d_heap, blast, \n              metis int_unat s_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph, fast)\n       apply (subst head_heap, blast, blast, subst is_inf_d_heap, blast, \n              metis int_unat t_C_pte two_comp_to_edge_arrlist_heap wellformed_iGraph, force)\n      apply (rule conjI, rule impI, rule conjI)\n        apply (unfold is_graph_def is_dist_def)[1]\n        apply (subgoal_tac \" ee + 1 \\<le> fst (snd iG)\")\n         apply (subgoal_tac \"ee < (max_word::32 word)\")\n          apply (drule no_edge_Vm_Vf_inv_step[where G=iG and d=iD])\n          apply (clarsimp simp del: Word_Lemmas.sint_0)\n          apply (metis (no_types, hide_lams) Word_Lemmas.sint_0 ENInt_isInf_C_pte head_heap \n                 two_comp_arrlist_heap wellformed_iGraph uint_nat)\n         apply (metis max_word_max not_le word_le_less_eq)\n        apply (metis inc_le)\n       apply (rule conjI, simp add: is_graph_def unat_minus_plus1_less)\n       apply (unfold is_graph_def)[1]\n       apply (clarsimp simp: if_bool_eq_conj)+\n      apply (unfold is_graph_def is_dist_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n      apply (metis wellformed_iGraph word_less_nat_alt)\n     apply (rule conjI, rule impI, rule conjI)\n       apply (unfold is_graph_def is_dist_def)[1]\n       apply (subgoal_tac \" ee + 1 \\<le> fst (snd iG)\")\n        apply (subgoal_tac \"ee < (max_word::32 word)\")\n         apply (drule no_edge_Vm_Vf_inv_step[where G=iG and d=iD])\n         apply (clarsimp simp del: Word_Lemmas.sint_0)\n         apply (metis is_inf_d_heap tail_heap wellformed_iGraph)\n        apply (metis max_word_max not_le word_le_less_eq)\n       apply (metis inc_le)\n      apply (rule conjI, simp add: is_graph_def unat_minus_plus1_less)\n      apply (unfold is_graph_def)[1]\n      apply (clarsimp simp: if_bool_eq_conj)+\n     apply (unfold is_graph_def is_dist_def)[1]\n     apply (clarsimp simp: if_bool_eq_conj)+\n     apply (rule conjI)\n      apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n      apply (metis wellformed_iGraph word_less_nat_alt)\n     apply (rule arrlist_nth, (simp add: uint_nat unat_mono )+)\n    apply (simp add: no_edge_Vm_Vf_inv_def is_graph_def)\n   apply wp\n  apply (unfold no_edge_Vm_Vf_inv_def is_graph_def, fastforce)\n  done\n\nlemma source_val_inv_eq_maths:\n  \"source_val_inv G s d n (ivertex_cnt G) \\<longleftrightarrow>\n   (\\<exists> v \\<in> verts (abs_IGraph G). abs_INum n d v \\<noteq> \\<infinity>) \\<longrightarrow> abs_IDist d s = 0\"\n  unfolding source_val_inv_def abs_INum_def abs_IDist_def by fastforce\n\nlemma no_edge_Vm_Vf_inv_eq_maths:\n  \"no_edge_Vm_Vf_inv G d (iedge_cnt G) \\<longleftrightarrow>\n  (\\<forall>e \\<in> arcs (abs_IGraph G). \n    abs_IDist d (tail (abs_IGraph G) e) = -\\<infinity> \\<longrightarrow> (\\<forall>r. abs_IDist d (head (abs_IGraph G) e) \\<noteq> ereal r))\"\n  unfolding no_edge_Vm_Vf_inv_def abs_IDist_def abs_IGraph_def by auto\n\ndefinition shortest_paths_locale_step2_inv :: \n  \"IGraph \\<Rightarrow> IVertex \\<Rightarrow> ICost \\<Rightarrow> IEInt \\<Rightarrow> IPEdge \\<Rightarrow> IENInt \\<Rightarrow> IPEdge \\<Rightarrow> bool\" where\n  \"shortest_paths_locale_step2_inv G sc c n p d pred  \\<equiv>\n   shortest_paths_locale_step1_inv G sc n p d \\<and>\n   basic_just_sp_inv G d c sc n pred \\<and>\n   source_val_inv G sc d n (ivertex_cnt G)\\<and>\n   no_edge_Vm_Vf_inv G d (iedge_cnt G)\"\n\nlemma shortest_paths_locale_step2_spc_intermediate:\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_cost s iG iC c \\<and>\n          is_pedge s iG iP p \\<and>\n          is_pedge s iG iPred pred)\\<rbrace>\n   shortest_paths_locale_step2' g sc c n pred d p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n        shortest_paths_locale_step2_inv iG sc iC iN iP iD iPred)\\<rbrace>!\"\n  apply (clarsimp simp: shortest_paths_locale_step2'_def shortest_paths_locale_step2_inv_def)\n  apply wp\n      apply (rule_tac P1=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_cost s iG iC c \\<and>\n          is_pedge s iG iP p \\<and>\n          is_pedge s iG iPred pred \\<and>\n          shortest_paths_locale_step1_inv iG sc iN iP iD \\<and> \n          basic_just_sp_inv iG iD iC sc iN iPred \\<and>\n          source_val_inv iG sc iD iN (fst iG))\" \n      in validNF_post_imp[OF _ no_edge_Vm_Vf_spc'])\n      apply fastforce  \n     apply (rule_tac P1=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_cost s iG iC c \\<and>\n          is_pedge s iG iP p \\<and>\n          is_pedge s iG iPred pred \\<and>\n          shortest_paths_locale_step1_inv iG sc iN iP iD \\<and> \n          basic_just_sp_inv iG iD iC sc iN iPred)\" \n      in validNF_post_imp[OF _ source_val_spc'])\n     apply (unfold basic_just_sp_inv_def, fastforce simp: wf_inv_is_wf_digraph)[1]\n    apply (rule_tac P1=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_cost s iG iC c \\<and>\n          is_pedge s iG iP p \\<and>\n          is_pedge s iG iPred pred \\<and>\n          shortest_paths_locale_step1_inv iG sc iN iP iD)\" \n      in validNF_post_imp[OF _ check_basic_just_sp_spc_intermediate])\n    apply (unfold shortest_paths_locale_step1_inv_def s_assms_inv_def, fastforce simp: wf_inv_is_wf_digraph)[1]\n   apply (rule_tac P1=\" P and \n    (\\<lambda>s.  is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_cost s iG iC c \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          is_pedge s iG iPred pred)\" \n      in validNF_post_imp[OF _ shortest_paths_locale_step1_spc_intermediate])\n   apply (clarsimp, unfold shortest_paths_locale_step1_inv_def s_assms_inv_def, fast) \n  apply blast\n  done \n\nlemma abs_INat_to_abs_INum:\n    \"shortest_paths_locale_step1\n    (abs_IGraph G) s (abs_INat n)\n    (abs_IPedge pred) (abs_IDist d) \\<Longrightarrow> (shortest_paths_locale_step1.enum (abs_INat n) (abs_IDist d)) = (abs_INum n d)\"\n  using shortest_paths_locale_step1.enum_def[where\n      ?G=\"(abs_IGraph G)\" and ?s=s and ?num=\"(abs_INat n)\" and\n      ?parent_edge=\"(abs_IPedge pred)\" and ?dist=\"(abs_IDist d)\"]\n  unfolding abs_INum_def abs_IDist_def abs_INat_def\n  by auto\n\nlemma shortest_paths_locale_step2_inv_eq_maths:\n  \"\\<And>G s c n p d pred.\n    shortest_paths_locale_step2_inv G s c n p d pred\n    =\n    shortest_paths_locale_step2_pred\n    (abs_IGraph G) s (abs_ICost c) (abs_INat n)\n    (abs_IPedge p) (abs_IDist d) (abs_IPedge pred)\"\nproof -\n  fix G c s n p d pred\n  let ?aG = \"abs_IGraph G\"\n  let ?ad = \"abs_IDist d\"\n  let ?ac = \"abs_ICost c\"\n  let ?an = \"abs_INat n\"\n  let ?ap = \"abs_IPedge p\"\n  show \"?thesis G s c n p d pred\"\n    unfolding shortest_paths_locale_step2_inv_def \n      shortest_paths_locale_step2_pred_def \n      shortest_paths_locale_step2_pred_axioms_def\n    by (metis (no_types, hide_lams) atLeastLessThan_iff no_edge_Vm_Vf_inv_eq_maths abs_INat_to_abs_INum \n      basic_just_sp_eq_maths shortest_paths_locale_step1_inv_eq_maths source_val_inv_eq_maths verts_absI \n      shortest_paths_locale_step1.s_assms(1))\nqed\n\nlemma shortest_paths_locale_step2_spc:\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_cost s iG iC c \\<and>\n          is_pedge s iG iP p \\<and>\n          is_pedge s iG iPred pred)\\<rbrace>\n   shortest_paths_locale_step2' g sc c n pred d p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n        shortest_paths_locale_step2_pred\n    (abs_IGraph iG) sc (abs_ICost iC) (abs_INat iN)\n    (abs_IPedge iP) (abs_IDist iD) (abs_IPedge iPred))\\<rbrace>!\"\n     using validNF_post_imp[OF _ shortest_paths_locale_step2_spc_intermediate] \n        shortest_paths_locale_step2_inv_eq_maths \n     by simp\n\ndefinition awalk_edge_inv ::\n  \"IGraph \\<Rightarrow> ICycle \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"awalk_edge_inv G C k \\<equiv>\n      \\<forall> i < k. icycle_path C ! i < iedge_cnt G\"\n\nlemma awalk_edge_inv_step:\n  \"awalk_edge_inv G C (Suc k) \\<longleftrightarrow> \n   awalk_edge_inv G C k \\<and>  icycle_path C ! k < iedge_cnt G\"\n  unfolding awalk_edge_inv_def \n  by (rule iffI; clarsimp; rename_tac i;case_tac \"i=k\"; simp)\n\n\nlemma awalk_edge_inv_le:\n  assumes leq: \"j \\<le> i\" \n  assumes cas_i: \"awalk_edge_inv G C i\"\n  shows \"awalk_edge_inv G C j\"\n  using assms \n  by (induct j) (auto simp add: awalk_edge_inv_def)\n\ndefinition awalk_cas_inv ::\n  \"IGraph \\<Rightarrow> ICycle \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"awalk_cas_inv G C k \\<equiv> \n    (length (icycle_path C) \\<noteq> 0 \\<longrightarrow>\n      pre_digraph.cas (abs_IGraph G) \n                      (icycle_start C) \n                      (take k (icycle_path C)) \n                      (snd (iedges G (last (take k (icycle_path C))))) \\<and>\n      ((k = length (icycle_path C) \\<and> k \\<noteq> 0) \\<longrightarrow> snd (iedges G (last (icycle_path C))) = icycle_start C))\"\n\n\ndefinition cas_inv ::\n  \"IGraph \\<Rightarrow> IPath \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"cas_inv G P k  \\<equiv> \n    length P \\<noteq> 0 \\<longrightarrow>\n       (\\<forall>i<k-1. \n         snd (iedges G (P! i)) = \n         fst (iedges G (P! (i+1))))\"\n\ndefinition cas_inv' ::\n   \"IGraph \\<Rightarrow> IVertex \\<Rightarrow> IPath \\<Rightarrow> IVertex \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"cas_inv' G u P v k  \\<equiv> \n    ((length P = 0 \\<longrightarrow> u=v) \\<and>\n     (length P \\<noteq> 0 \\<longrightarrow>\n      fst (iedges G (hd P)) = u \\<and>\n      snd (iedges G (last P)) = v \\<and>\n       cas_inv G P k))\"\n\nabbreviation cas_cyc_inv ::\n  \"IGraph \\<Rightarrow> ICycle \\<Rightarrow> nat \\<Rightarrow> bool\"\nwhere\n  \"cas_cyc_inv G C k  \\<equiv> \n   (cas_inv' G (icycle_start C) (icycle_path C) (icycle_start C) k)\"\n\nlemma cas_inv_step:\n  assumes \"k \\<le> length P\"\n  shows \"cas_inv G P (k + 1) \\<longleftrightarrow> \n          cas_inv G P k\n          \\<and> (k > 0 \\<longrightarrow> (snd (iedges G (P ! (k-1))) = \n                      fst (iedges G (P ! k))))\"\n  using assms \n  unfolding cas_inv_def  \n  by (case_tac P; safe; clarsimp) \n     (case_tac \"i = k -1\"; simp) \n\nlemma cas_inv_le:\n  assumes leq: \"j \\<le> i\" \n  assumes cas_i: \"cas_inv G P i\"\n  shows \"cas_inv G P j\"\n  using assms \n  by (induct j) (auto simp add: cas_inv_def)\n\nlemma cas_inv_ConsD:\n  \"\\<lbrakk>cas_inv G (e # P) k'; k' = k + 1; k \\<le> length P\\<rbrakk> \\<Longrightarrow>\n          (cas_inv G P k\n          \\<and> (k > 0 \\<longrightarrow> (snd (iedges G e)) = \n                      fst (iedges G (hd P))))\"\n  by (case_tac P; clarsimp simp add: cas_inv_def)\n     (metis (no_types, hide_lams) Suc_le_eq Suc_pred diff_le_self \n      linorder_neqE_nat not_le not_less_zero nth_Cons_0 nth_Cons_Suc)\n\nlemma cas_inv_Cons:\n  assumes \"k \\<le> length P\"\n  assumes \"k' = k + 1\"\n  shows \"cas_inv G (e # P) k' =\n          (cas_inv G P k\n          \\<and> (k > 0 \\<longrightarrow> (snd (iedges G e)) = \n                      fst (iedges G (hd P))))\"\n  apply (rule iffI)\n  apply (fastforce dest: cas_inv_ConsD simp: assms)\n  using assms \n  unfolding cas_inv_def\n  apply (case_tac P; clarsimp; case_tac i; clarsimp) \n  done\n\nlemma cas_inv'_NilD:\n  \"\\<lbrakk>cas_inv' G u [] v k; k=0 \\<rbrakk> \\<Longrightarrow> u=v\"\n  unfolding cas_inv'_def by simp\n\nlemma cas_inv'_Nil:\n  \"cas_inv' G u [] v 0 =  (u=v)\"\n  unfolding cas_inv'_def by simp\n\nlemma cas_inv'_ConsD:\n  \"\\<lbrakk>cas_inv' G u (e # P) v k'; k'=k+1; k \\<le> length P\\<rbrakk> \\<Longrightarrow>\n      fst (iedges G e) = u \\<and>\n      snd (iedges G (last (e# P))) = v \\<and>\n      cas_inv G P k \\<and> \n      (k > 0 \\<longrightarrow> snd (iedges G e) = fst (iedges G (hd P)))\"\n  by (clarsimp simp: cas_inv'_def, simp add: cas_inv_def)\n     (fastforce dest: cas_inv_ConsD)\n \nlemma cas_inv'_Cons:\n \"\\<lbrakk>k'=k+1; k \\<le> length P\\<rbrakk> \\<Longrightarrow>\n     cas_inv' G u (e # P) v k' =\n      (fst (iedges G e) = u \\<and>\n      snd (iedges G (last (e# P))) = v \\<and>\n      cas_inv G P k \\<and> \n      (k > 0 \\<longrightarrow> snd (iedges G e) = fst (iedges G (hd P))))\"\n  unfolding cas_inv'_def\n  by (subst cas_inv_Cons[where k=k]; simp)\n\nlemma cas_cyc_inv_stepD:\n  assumes \"cas_cyc_inv G C k\"\n  assumes \"k \\<le> length (icycle_path C)\"\n  assumes \"k > 0 \\<Longrightarrow> (snd (iedges G ((icycle_path C)! (k-1))) = \n                      fst (iedges G ((icycle_path C)! k)))\"\n  shows \"cas_cyc_inv G C (k + 1)\"\n  using assms cas_inv_step \n  unfolding cas_inv'_def \n  by auto     \n\nlemma cas_cyc_inv_step:\n  assumes \"k \\<le> length (icycle_path C)\"\n  shows \"cas_cyc_inv G C (k + 1) = \n          (cas_cyc_inv G C k\n          \\<and> (k > 0 \\<longrightarrow> (snd (iedges G ((icycle_path C)! (k-1))) = \n                      fst (iedges G ((icycle_path C)! k)))))\"\n  unfolding  cas_inv'_def \n  using assms cas_inv_step \n  by auto        \n  \nlemma cas_cyc_inv_le:\n  assumes awalk_i: \"cas_cyc_inv G C i\"\n  assumes leq: \"j \\<le> i\" \n  shows \"cas_cyc_inv G C j\"\n  using assms \n  by (induct j) (auto simp add: cas_inv'_def cas_inv_def)\n \ndefinition awalk_spc ::\n  \"IGraph \\<Rightarrow> ICycle \\<Rightarrow> bool\"\nwhere\n  \"awalk_spc G C \\<equiv>\n      icycle_start C < ivertex_cnt G \\<and>\n      awalk_edge_inv G C (length (icycle_path C)) \\<and>\n      awalk_cas_inv G C (length (icycle_path C))\"\n\n\ndefinition awalk_spc' ::\n  \"IGraph \\<Rightarrow> ICycle \\<Rightarrow> bool\"\nwhere\n  \"awalk_spc' G C \\<equiv>\n      icycle_start C < ivertex_cnt G \\<and>\n      awalk_edge_inv G C (length (icycle_path C)) \\<and>\n      cas_cyc_inv G C (length (icycle_path C))\"\n\nlemma last_cas_elem[simp]: \n  \"p \\<noteq> [] \\<Longrightarrow> pre_digraph.cas G u p u \\<Longrightarrow> u = head G (last p)\"\n  by (metis append_butlast_last_id pre_digraph.cas.simps pre_digraph.cas_append_iff)\n\nlemma awalk_spc_eq_math:\n  \"awalk_spc iG iY \\<longleftrightarrow> pre_digraph.awalk (abs_IGraph iG) \n                        (icycle_start iY) \n                        (icycle_path iY) \n                        (icycle_start iY)\"\n  apply (unfold awalk_spc_def pre_digraph.awalk_def)\n  apply (rule iffI)\n    (* spc to math *)\n   apply safe[1]\n     apply fastforce\n    apply (metis atLeastLessThan_iff in_set_conv_nth awalk_edge_inv_def edges_absI word_zero_le)\n   apply (clarsimp simp add: awalk_edge_inv_def)\n   apply (case_tac \"snd iY \\<noteq> []\")\n  apply (fastforce simp: awalk_cas_inv_def)[1]\n   apply (simp add: pre_digraph.cas.simps(1))\n  (* math to spc*)\n  apply safe\n    apply simp\n   apply (metis (no_types, hide_lams) atLeastLessThan_iff nth_mem awalk_edge_inv_def edges_absI subsetD)\n  apply (metis (mono_tags, hide_lams) le_refl length_0_conv awalk_cas_inv_def last_cas_elem target_absI take_all)\n  done\n\nlemma cas_inv'_impl_cas:\n  \"cas_inv' G u P v (length P) \\<Longrightarrow> pre_digraph.cas (abs_IGraph G) u P v\"\n  by (induct P arbitrary: u,\n      simp add: cas_inv'_def pre_digraph.cas.simps(1))\n     (fastforce dest: cas_inv_ConsD simp: cas_inv'_def pre_digraph.cas_simp)\n\nlemma cas_impl_cas_inv':\n  \"pre_digraph.cas (abs_IGraph G) u P v \\<Longrightarrow> cas_inv' G u P v (length P)\"\n  by (induct P arbitrary: u, simp add: cas_inv'_def pre_digraph.cas.simps(1))\n     (clarsimp simp: cas_inv'_Cons pre_digraph.cas_simp,\n         force simp: cas_inv'_def cas_inv_def)\n\nlemma cas_inv'_eq_cas: \n  \"cas_inv' G u P v (length P) = pre_digraph.cas (abs_IGraph G) u P v\"\n  by (fastforce intro: cas_inv'_impl_cas cas_impl_cas_inv')\n\nlemma awalk_spc'_eq_awalk:\n  \"awalk_spc' iG iY \\<longleftrightarrow> pre_digraph.awalk (abs_IGraph iG) \n                        (icycle_start iY) \n                        (icycle_path iY) \n                        (icycle_start iY)\"\n  unfolding awalk_spc'_def awalk_edge_inv_def pre_digraph.awalk_def\n  by (simp add: cas_inv'_eq_cas) \n     (metis (no_types, hide_lams) atLeastLessThan_iff  \n            subset_code(1) word_zero_le in_set_conv_nth)\n\nlemma drop_impl_conj_leftI: \"\\<lbrakk>Q; P \\<longrightarrow> R;  P' \\<longrightarrow> R'\\<rbrakk> \\<Longrightarrow> (P \\<longrightarrow> Q \\<and> R) \\<and> (P' \\<longrightarrow> Q \\<and> R')\"\n  by simp\n\nlemma drop_impl_conj_rightI: \"\\<lbrakk>P \\<longrightarrow> Q;  P' \\<longrightarrow> Q'; R\\<rbrakk> \\<Longrightarrow> (P \\<longrightarrow> Q \\<and> R) \\<and> (P' \\<longrightarrow> Q' \\<and> R)\"\n  by simp\n\nlemma cyc_in_graph_spc:\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_cycle s iY y)\\<rbrace>\n   cyc_in_graph' g y\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n         icycle_start iY < ivertex_cnt iG \\<and>\n          awalk_edge_inv iG iY (length (icycle_path iY))) \\<rbrace>!\"\n  apply (simp add: cyc_in_graph'_def )\n  apply wpsimp\n     apply (subst whileLoopE_add_inv [where \n                   M=\"\\<lambda>(r, s). length (icycle_path iY) - r\" and\n                   I=\"\\<lambda>r s. P s \\<and> \n                            is_graph s iG g \\<and> \n                            is_cycle s iY y \\<and> icycle_start iY < ivertex_cnt iG \\<and>\n                            awalk_edge_inv iG iY r \\<and>\n                            r \\<le> length (icycle_path iY)\"])\n     apply wpsimp\n      apply (rule conjI; rule impI) \n       apply (fastforce dest: unat_mono simp: not_le is_cycle_def is_graph_def awalk_edge_inv_def)\n      apply (clarsimp simp: awalk_edge_inv_step word_less_nat_alt is_cycle_def is_graph_def)\n      apply (rule conjI, simp)  \n      apply (metis INT_MIN_MAX_lemmas(15) le_trans not_le not_less_eq_eq)\n     apply (metis dual_order.order_iff_strict is_cycle_def)\n    apply wp+\n  by (clarsimp simp: is_cycle_def is_graph_def awalk_edge_inv_def word_less_nat_alt)\n\nlemma arrlistD : \n  assumes \"arrlist h v xs p\"\n  shows \"\\<forall>i. i\\<ge>0  \\<longrightarrow> i <int (length xs) \\<longrightarrow> v (p +\\<^sub>p i) \\<and> (xs ! nat i = h (p +\\<^sub>p i))\"\n  using assms by clarsimp\n\nlemma cas_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_cycle s iY y \\<and>\n          icycle_start iY < ivertex_cnt iG \\<and>\n          awalk_edge_inv iG iY (length (icycle_path iY)))\\<rbrace>\n   cas' g y\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n         cas_cyc_inv iG iY (length (icycle_path iY))) \\<rbrace>!\"\n  apply (simp add: cas'_def skipE_def)\n  apply (wpsimp simp: validNF_conj_prop)\n           apply (subst whileLoopE_add_inv [where \n                    M=\"\\<lambda>(r, s). length (icycle_path iY) - Suc r\" and\n                    I=\"\\<lambda>r s. P s \\<and> \n                              wf_digraph (abs_IGraph iG) \\<and> is_graph s iG g \\<and> \n                              is_cycle s iY y \\<and> icycle_start iY < ivertex_cnt iG \\<and>\n                              awalk_edge_inv iG iY (length (icycle_path iY)) \\<and>\n                              cas_cyc_inv iG iY (r+1) \\<and>\n                              length (icycle_path iY) \\<ge> 1 \\<and>\n                              r \\<le> length (icycle_path iY) - 1\"])\n           apply (wpsimp simp: validNF_conj_prop) defer\n            apply (fastforce intro: cas_cyc_inv_le simp: is_cycle_def)\n           apply wp+\n   apply clarsimp\n   apply (case_tac \"length (icycle_path iY)\") \n    apply (clarsimp simp: is_cycle_def cas_inv'_def)\n   apply (clarsimp simp: is_graph_def is_cycle_def awalk_edge_inv_def)\n   apply (frule arrlist_nth_valid[where i=0, simplified], fastforce) \n   apply (frule head_heap[where e=\"icycle_path iY !(length (icycle_path iY) - 1)\"])\n     apply simp\n    apply (frule arrlistD)\n    apply (erule_tac x=\"uint (icycle_path iY ! 0)\" in all_dupE)\n    apply (erule impE, simp add: word_less_nat_alt)\n    apply (erule_tac x=\"uint (icycle_path iY ! nat (int (length (icycle_path iY) - 1)))\" in allE)\n    apply (erule impE, simp add: word_less_nat_alt uint_nat,\n           erule impE, simp,\n           erule impE, simp add: uint_nat word_less_nat_alt)\n    apply (frule arrlist_cycle_path_heap[where i=0], simp) \n   apply (rule conjI; clarsimp simp: cas_inv'_def cas_inv_def)\n    apply (metis One_nat_def int_minus last_conv_nth list.size(3) nat.distinct(1) nat_int of_nat_1)\n   apply (rule conjI; clarsimp)  \n    apply (metis hd_conv_nth list.size(3) nat.distinct(1)  tail_heap zero_less_Suc)\n   apply (metis (no_types, hide_lams) One_nat_def hd_conv_nth int_minus last_conv_nth \n                list.size(3) nat.distinct(1) nat_int of_nat_1 s_C_pte two_comp_arrlist_heap \n                uint_nat zero_less_Suc)\n  apply (clarsimp simp: awalk_edge_inv_def is_graph_def is_cycle_def)\n  apply (subst conj_assoc[symmetric, where P=\"cas_inv' _ _ _ _ _\"])\n  apply (frule_tac e=\"  (snd iY ! r)\" in head_heap, simp)\n  apply (frule_tac e=\"(snd iY ! (r+1))\" in tail_heap, simp) \n  apply (frule arrlistD)\n  apply (erule_tac x=\"uint (icycle_path iY ! r)\" in all_dupE)\n  apply (erule impE, simp add: word_less_nat_alt)\n  apply (erule impE, simp add:  int_unat) \n   apply (meson Suc_less_SucD diff_less_Suc less_trans_Suc word_less_def)\n  apply (erule_tac x=\"uint ((icycle_path iY ! Suc r))\" in allE)\n  apply (erule impE, simp add: word_less_nat_alt)+\n   apply (metis Suc_eq_plus1 int_unat less_diff_conv nat_1 nat_int of_nat_1 of_nat_less_iff)\n  apply (rule drop_impl_conj_rightI, clarsimp)\n    apply (clarsimp simp: cas_inv'_def cas_inv_def)\n    apply (erule_tac x=r in allE, simp)\n    apply (case_tac r; simp) \n    apply (metis (no_types, hide_lams) add.commute add_2_eq_Suc' nat_int.Rep_inverse of_nat_add of_nat_numeral)\n   apply clarsimp\n   apply (rule conjI)\n    apply (clarsimp simp: cas_inv'_def cas_inv_def)\n    apply  (case_tac \"i=r\"; clarsimp) \n  apply (metis nat_int.Rep_inverse of_nat_Suc)\n  apply (fastforce intro: diff_less_mono2)\n  apply (rule conjI; clarsimp)\n  apply (metis (no_types, hide_lams) INT_MIN_MAX_lemmas(12) diff_commute diff_is_0_eq' diff_less_mono not_less0 not_less_eq_eq zero_diff)\n  apply (metis nat_int of_nat_Suc)\n  done\n\nlemma awalk_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_cycle s iY y)\\<rbrace>\n   awalktwo' g y\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n         awalk_spc' iG iY)\\<rbrace>!\"\n  apply (simp add: awalktwo'_def awalk_spc'_def)\n  apply wp \n    apply (rule_tac P1=\" P and \n    (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_cycle s iY y \\<and>\n          icycle_start iY < ivertex_cnt iG \\<and>\n          awalk_edge_inv iG iY (length (icycle_path iY)))\" \n      in validNF_post_imp[OF _ cas_spc'])\n    apply fastforce\n   apply (rule_tac P1=\" P and \n    (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_cycle s iY y)\" \n      in validNF_post_imp[OF _ cyc_in_graph_spc])\n   apply fastforce\n  apply fastforce\n  done\n\n\n\n\n\n\n\ndefinition awalk_neg_cyc_cost ::\n  \"ICost \\<Rightarrow> ICycle \\<Rightarrow> nat \\<Rightarrow> int\"\nwhere\n  \"awalk_neg_cyc_cost iC iY ee \\<equiv> \n   sum_list (map (sint \\<circ> iC) (take ee (icycle_path iY)))\"\n                              \nlemma sum_list_step:\n  assumes \"i < length xs\" \n  assumes \"xs \\<noteq> []\"\n  shows \"sum_list (take (i + 1) xs) = sum_list (take i xs) + xs ! i\"\nproof -\n  have \"\\<forall>n. n + 1 = Suc n\"\n    by simp\n  then show ?thesis\n    by (metis (no_types) add.right_neutral assms(1) sum_list.Cons \n              sum_list.Nil sum_list_append take_Suc_conv_app_nth)\nqed\n\nlemma sum_list_step_sint:\n  assumes \"i < length xs\" \n  assumes \"xs \\<noteq> []\"\n  shows \"sum_list (map sint (take (i + 1) xs)) = \n          sum_list (map sint (take i xs)) + sint (xs ! i)\"\nproof -\n  have \"sum_list (take i (map sint xs)) + sint (xs ! i) = \n        sum_list (take (i + 1) (map sint xs))\"\n    by (metis (no_types) add.commute assms(1) gen_length_code(1) \n       gen_length_def length_map not_add_less1 nth_map sum_list_step)\n  then show ?thesis\n    by (simp add: take_map)\nqed\n\nlemma sum_list_int_le:\n  assumes \"length xs \\<le> n\" \n  assumes \"m \\<ge> 0\"\n  assumes \"\\<forall>x\\<in> set xs. (x::int) \\<le> m\"\n  shows   \"sum_list xs \\<le> (m * n)\"\nusing assms \nproof(induct xs arbitrary: n)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons x1 xs)\n  then show ?case \n    by (case_tac n; \n        fastforce elim!: meta_allE simp: distrib_left)\nqed\n\nlemma sum_list_ge:\n  assumes \"length xs \\<le> n\" \n  assumes \"m \\<le> 0\"\n  assumes \"\\<forall>x\\<in> set xs. (x::int) \\<ge> m\"\n  shows   \"sum_list xs \\<ge> (m * n)\"\nusing assms \nproof(induct xs arbitrary: n)\n  case Nil\n  then show ?case by (simp add: mult_nonpos_nonneg)\nnext\n  case (Cons x1 xs)\n  then show ?case \n    by (case_tac n; \n       fastforce elim!: meta_allE simp: distrib_left)\nqed\n\nlemma sum_list_take_le:\n  assumes \"i < length xs\"\n  assumes \"\\<forall>x\\<in> set xs. (x::int) \\<le> m\"\n  shows   \"sum_list (take i xs) \\<le> (m * i)\"\nusing assms \nproof(induct i)\n  case 0\n  then show ?case by simp \nnext\n  case (Suc i)\n  then show ?case \n    apply clarsimp \n    apply (subst distrib_left, simp) \n    apply (subst take_Suc_conv_app_nth, simp+) \n    by (simp add: \n        add.commute \n        add_mono_thms_linordered_semiring(1))\n\nqed\n\nlemma sum_list_take_ge:\n  assumes \"i < length xs\"\n  assumes \"\\<forall>x\\<in> set xs. (x::int) \\<ge> m\"\n  shows   \"sum_list (take i xs) \\<ge> (m * i)\"\nusing assms \nproof(induct i)\n  case 0\n  then show ?case by simp \nnext\n  case (Suc i)\n  then show ?case \n    apply clarsimp \n    apply (subst distrib_left, simp) \n    apply (subst take_Suc_conv_app_nth, simp+) \n    by (simp add: \n        add.commute \n        add_mono_thms_linordered_semiring(1))\nqed\n\nlemma awalk_neg_cyc_cost_step':\n  assumes \"is_cycle s iY y\"\n    and   \"i  < (length (icycle_path iY))\"\n    and   \"icycle_path iY \\<noteq> []\"\n  shows \"awalk_neg_cyc_cost iC iY (i + 1) = awalk_neg_cyc_cost iC iY i +\n  sint (map iC (icycle_path iY) ! i)\"\n  unfolding awalk_neg_cyc_cost_def is_cycle_def\n  using  assms\n  apply (subgoal_tac \"sum_list (map sint (take (i + 1) \n          (map iC (icycle_path iY)))) =\n        sum_list (map sint (take i (map iC (icycle_path iY)))) + \n         sint (map iC (icycle_path iY) ! i)\")\n  apply (simp add: take_map)\n  apply (metis (no_types, lifting) \n        Nil_is_map_conv add.commute length_map sum_list_step_sint)\n  done\n\ncorollary awalk_neg_cyc_cost_step:\n  assumes \"is_cycle s iY y\"\n    and \"i < length (icycle_path iY)\"\n    and \"icycle_path iY \\<noteq> []\"\n  shows \"awalk_neg_cyc_cost iC iY (i + 1) = \n          awalk_neg_cyc_cost iC iY i +\n          sint (iC (icycle_path iY ! i))\"\n  unfolding awalk_neg_cyc_cost_def\n  using assms awalk_neg_cyc_cost_def awalk_neg_cyc_cost_step'\n  by (metis (no_types, hide_lams) One_nat_def add_Suc_right nth_map\n              gen_length_code(1) gen_length_def list.size(3))\n\nlemma is_cycle_valid: \n  \"is_cycle s iY y \\<Longrightarrow> is_valid_Cycle_C s y\"\nby (simp add: is_cycle_def)\n\nlemma is_cycle_valid_path: \n  \"\\<lbrakk> is_cycle s iY y; i < length_C (heap_Cycle_C s y) \\<rbrakk> \\<Longrightarrow> \n      is_valid_w32 s (path_C (heap_Cycle_C s y) +\\<^sub>p uint i)\"\nunfolding is_cycle_def\n  by (force intro!:arrlist_nth_valid simp: int_unat word_less_def)\n\nlemma is_cycle_path_eq: \n  \"\\<lbrakk> is_cycle s iY y; i < length_C (heap_Cycle_C s y) \\<rbrakk> \\<Longrightarrow> \n     (icycle_path iY ! unat i) = heap_w32 s (path_C (heap_Cycle_C s y) +\\<^sub>p uint i)\"   \nby (fastforce dest: arrlist_cycle_path_heap simp: is_cycle_def int_unat word_less_nat_alt)\n  \nlemma is_cycle_valid_path_cost: \n    \"\\<lbrakk> awalk_edge_inv iG iY (length (icycle_path iY)); \n      is_cost s iG iC c; is_cycle s iY y;  i < length_C (heap_Cycle_C s y)\\<rbrakk> \\<Longrightarrow> \n     is_valid_w32 s\n         (PTR_COERCE(32 signed word \\<rightarrow> 32 word)\n         (c +\\<^sub>p uint (heap_w32 s (path_C (heap_Cycle_C s y) +\\<^sub>p uint i)))) \"\n  by (fastforce simp: awalk_edge_inv_def \n      is_cost_def is_cycle_def \n      uint_nat word_less_nat_alt\n      intro: arrlist_nth_valid) \n\nlemma is_cost_eq: \n  \"is_cost s iG iC c  \\<Longrightarrow> i < iedge_cnt iG \\<Longrightarrow>\n    iC i = \n    UCAST(32 \\<rightarrow> 32 signed) (heap_w32 s (PTR_COERCE(32 signed word \\<rightarrow> 32 word) (c +\\<^sub>p uint i)))\"\n  unfolding is_cost_def\n  by (fastforce dest!: arrlist_heap simp: int_unat)\n\nlemma INT_MIN_times_uint_plus_1:\n  assumes \"a < (max_word :: 32 word)\"\n  shows \"INT_MIN * uint (a + 1) = INT_MIN + INT_MIN * uint a\"\n  using assms\n  by (metis (no_types, hide_lams) add.commute distrib_left less_irrefl less_x_plus_1 mult.right_neutral not_le uint_1 uint_plus_simple_iff)\n\nlemma INT_MIN_times_uint_plus_1_le:\n  assumes \"a < (max_word :: 32 word)\"\n    and \"INT_MIN * uint a \\<le> x\"\n    and \"INT_MIN \\<le> y\"\n  shows \"INT_MIN * uint (a + 1) \\<le> x + y\"\n  using assms\n  using INT_MIN_times_uint_plus_1 by force\n\nlemma INT_MAX_times_uint_plus_1:\n  assumes \"a < (max_word :: 32 word)\"\n  shows \"INT_MAX * uint (a + 1) = INT_MAX + INT_MAX * uint a\"\n  using assms\n  by (metis (no_types, hide_lams) add.commute distrib_left less_irrefl less_x_plus_1 mult.right_neutral not_le uint_1 uint_plus_simple_iff)\n\nlemma INT_MAX_times_uint_plus_1_le:\n  assumes \"a < (max_word :: 32 word)\"\n    and \"x \\<le> INT_MAX * uint a\"\n    and \"y \\<le> INT_MAX\"\n  shows \"x + y \\<le> INT_MAX * uint (a + 1)\"\n  using assms\n  using INT_MAX_times_uint_plus_1 by force\n\nlemma INT_MAX_times_uint_max_word_le_LONG_MAX: \n  \"INT_MAX * uint (max_word :: 32 word) \\<le> LONG_MAX\"\n  unfolding INT_MAX_def LONG_MAX_def max_word_def\n  by fastforce\n\nlemma INT_MIN_times_uint_max_word_ge_LONG_MIN: \n  \"LONG_MIN \\<le> INT_MIN * uint (max_word :: 32 word)\"\n  unfolding INT_MIN_def LONG_MIN_def max_word_def\n  by fastforce\n\nlemma test1:\n  assumes \"a < (max_word :: 32 word)\"\n  shows \"uint (a + 1) \\<le> uint (max_word :: 32 word)\"\n  using word_le_def by blast\n\nlemma test2:\n  assumes \"a < (max_word :: 32 word)\"\n  shows \"INT_MIN * uint (a + 1) \\<le> INT_MIN * uint a\"\n  by (metis INT_MIN_MAX_lemmas(18) add.right_neutral assms le_less INT_MIN_times_uint_plus_1_le)\n\nlemma INT_MAX_times_uint_plus_1_le_LONG_MAX:\n  assumes \"a < (max_word :: 32 word)\"\n  shows \"INT_MAX * uint (a + 1) \\<le> LONG_MAX\"\n  using INT_MAX_times_uint_max_word_le_LONG_MAX test1[OF assms(1)] \n  by (metis (no_types, hide_lams) INT_MIN_MAX_lemmas(17) add.commute mult.commute mult_right_mono order_trans)\n\nlemma INT_MIN_times_uint_plus_1_ge_LONG_MIN: \n  assumes \"a < (max_word :: 32 word)\"\n  shows \"LONG_MIN \\<le> INT_MIN * uint (a + 1)\"\n  using INT_MIN_times_uint_max_word_ge_LONG_MIN test1[OF assms(1)] test2[OF assms(1)]\n  by (meson INT_MIN_MAX_lemmas(9) le_less mult_le_cancel_left mult_nonneg_nonneg order.trans uint_ge_0 un_ui_le)\n\nlemma awalk_cost_neg_spc':\n  \"ovalidNF (\\<lambda> s. \n   awalk_edge_inv iG iY (length (icycle_path iY)) \\<and>\n   wf_digraph (abs_IGraph iG) \\<and>\n   is_graph s iG g \\<and>\n   is_cost s iG iC c \\<and>\n   is_cycle s iY y) (awalk_cost_neg' c y) (\\<lambda>r s. r = \n   awalk_neg_cyc_cost iC iY (length (icycle_path iY)))\"\n  apply (unfold awalk_neg_cyc_cost_def awalk_cost_neg'_def)[1]\n  apply (subst owhile_add_inv [where \n         M=\"\\<lambda> (ee, total) s. (length (icycle_path iY) - unat ee)\" and\n         I=\"\\<lambda> (ee, total) s. \n             \n              awalk_edge_inv iG iY (length (icycle_path iY)) \\<and>\n              wf_digraph (abs_IGraph iG) \\<and>\n              is_graph s iG g \\<and>\n              is_cost s iG iC c \\<and>\n              is_cycle s iY y \\<and>\n              total \\<le> INT_MAX * uint ee \\<and>\n              INT_MIN * uint ee \\<le> total \\<and>\n              total = awalk_neg_cyc_cost iC iY (unat ee)\"])\n  apply wpsimp\n     apply (rule conjI, simp add: is_cycle_valid) \n     apply (rule conjI, simp add: is_cycle_valid_path)\n     apply (rule conjI, simp add: is_cycle_valid_path_cost) \n     apply (subst is_cycle_path_eq[symmetric], simp, simp)+\n     apply (subst is_cost_eq[symmetric], simp, \n      metis (no_types, hide_lams) awalk_edge_inv_def is_cycle_def \n      word_less_nat_alt)+\n     apply (frule_tac i=\"unat a\" in awalk_neg_cyc_cost_step[where iC=iC and iY=\"iY\"]) \n       apply (fastforce intro: unat_mono simp: is_cycle_def)\n      apply (metis add.right_neutral list.size(3) not_add_less2 is_cycle_def word_less_nat_alt)\n\n     apply (subst (asm) word_nat_simp[symmetric]) \n      apply (metis max_word_max not_le not_less_iff_gr_or_eq)\n     apply clarsimp\n     apply (subgoal_tac \"a < (max_word :: 32 word)\")\n      apply (fold LONG_MAX_def LONG_MIN_def)\n      apply safe[1] \n         apply (meson INT_MIN_MAX_lemmas(11) order.trans INT_MIN_times_uint_plus_1_ge_LONG_MIN INT_MIN_times_uint_plus_1_le)\n        apply (meson INT_MIN_MAX_lemmas(10) order.trans INT_MAX_times_uint_plus_1_le_LONG_MAX INT_MAX_times_uint_plus_1_le)\n       apply (metis INT_MIN_MAX_lemmas(10) add.commute add_mono_thms_linordered_semiring(1) INT_MAX_times_uint_plus_1)\n      apply (metis INT_MIN_MAX_lemmas(11) add.commute add_mono INT_MIN_times_uint_plus_1 shortest_path_neg_checker.word_nat_simp)\n     apply (metis less_linear max_word_max word_le_not_less)\n    apply wpsimp\n    apply (clarsimp simp add: awalk_neg_cyc_cost_def is_cycle_def)  \n    apply(fastforce simp: unat_sub[symmetric] unat_minus_plus1_less inc_le)\n   apply clarsimp\n   apply (clarsimp simp add: is_cycle_def awalk_neg_cyc_cost_def)\n   apply (simp add: word_less_nat_alt)\n  apply wpsimp\n  apply (clarsimp simp add: is_cycle_def awalk_neg_cyc_cost_def) \n  done\n\nlemma int_real_add_simp: \"foldr (+) (map (real_of_int \\<circ> sint) xs) 0 = \n                          real_of_int (foldr (+) (map sint xs) 0)\"\n  by (induct xs) simp+\n\nlemma acc_list_simp: \"real_of_int (awalk_neg_cyc_cost iC iY (length (icycle_path iY))) = \n       sum_list (map (real_of_int \\<circ> sint \\<circ> iC) (icycle_path iY))\"\n  unfolding awalk_neg_cyc_cost_def\n  using int_real_add_simp\n  by (metis (no_types, hide_lams) le_refl map_map sum_list.eq_foldr take_all)\n\nlemma awalk_cost_eq_math:\n  assumes \"wf_digraph (abs_IGraph iG)\"\n  shows \"real_of_int (awalk_neg_cyc_cost iC iY (length (icycle_path iY))) = wf_digraph.awalk_cost (abs_ICost iC) (icycle_path iY)\"\n  apply (insert assms)\n  apply (simp add: acc_list_simp)\n  apply (unfold awalk_neg_cyc_cost_def wf_digraph.awalk_cost_def abs_ICost_def)\n  using acc_list_simp\n  by (metis comp_apply)\n\ndefinition C_se_inv :: \n  \"IGraph \\<Rightarrow> ICycle_Set \\<Rightarrow> ICost \\<Rightarrow>  IENInt \\<Rightarrow> nat \\<Rightarrow> bool\" \n  where\n  \"C_se_inv G cse c d k \\<equiv>\n   \\<forall>i < k.  is_inf_d d (icycle_start (cse ! i)) \\<le> 0 \\<and> \n   awalk_spc' G (cse ! i) \\<and>\n   awalk_neg_cyc_cost c (cse ! i) (length (icycle_path(cse ! i))) < 0\"\n\n\nlemma C_se_inv_step:\n  \"C_se_inv G cse c d (Suc i) \\<longleftrightarrow> \n       C_se_inv G cse c d i \\<and>\n       (is_inf_d d (icycle_start (cse ! i)) \\<le> 0) \\<and>\n        awalk_spc' G (cse ! i) \\<and>\n        awalk_neg_cyc_cost c (cse ! i) (length (icycle_path(cse ! i))) < 0\"\n  unfolding C_se_inv_def \n  apply (rule iffI; clarsimp)\n  using less_antisym by blast\n\nlemma C_se_inv_le:\n  assumes leq: \"j \\<le> i\" \n  assumes C_se_i: \"C_se_inv G cse c d i\"\n  shows \"C_se_inv G cse c d j\"\n  using assms \n  by (induct j) (auto simp add: C_se_inv_def)\n\nlemma are_cyclesD: \n  assumes \"are_cycles'' s iYs cse\"\n  shows \"length iYs = unat (no_cycles_C (heap_Cycle_set_C s cse))\"\n        \"is_valid_Cycle_set_C s cse\"\n        \"(\\<forall>i<length iYs. is_cycle' s (iYs ! i) (cyc_obj_C (heap_Cycle_set_C s cse) +\\<^sub>p int i))\"\n  using assms unfolding are_cycles''_def by simp_all\n\nlemma length_abs_ICycles': \"length (abs_ICycles' h iYs) = length iYs\"\n  unfolding abs_ICycles'_def\n  by simp\n\nlemma awalk_cost_neg_spc:\n    \"\\<lbrakk>is_graph s iG g;  \n      wf_digraph (abs_IGraph iG);\n      is_cost s iG iC c;\n      is_cycle s iY y; \n      n = length (snd iY);\n      awalk_edge_inv iG iY n\\<rbrakk> \\<Longrightarrow>\n      awalk_cost_neg' c y s \\<noteq> None \\<and> \n      (\\<forall>r. awalk_cost_neg' c y s = Some r \\<longrightarrow> \n      r = awalk_neg_cyc_cost iC iY n)\"\nby (simp add: awalk_cost_neg_spc'[simplified ovalidNF_def])\n\nlemma abs_ICycles'_nth_eq:\n  \"i < length iY' \\<Longrightarrow> abs_ICycles' s iY' ! i = abs_ICycle' s  (iY'! i)\"\nby (simp add: abs_ICycles'_def)\n\nlemma abs_ICycle'_simps:\n   \"fst (abs_ICycle' h iC) = icycle'_start iC\"\n   \"snd (abs_ICycle' h iC) = mk_ipath'_list h iC\"\n  by simp+\n\nlemma length_mk_ipath'_list: \n  \"length (mk_ipath'_list h C) = unat (icycle'_length C)\"\n  using mk_ipath_length by simp\n\nlemma awalk_spc'D:\n  assumes \"awalk_spc' G C \"\n  shows \"icycle_start C < ivertex_cnt G\"\n        \"awalk_edge_inv G C (length (icycle_path C))\"\n        \"cas_cyc_inv G C (length (icycle_path C))\"\nusing assms unfolding awalk_spc'_def by simp+\n\nlemma awalk_spc'I:\n  \"\\<lbrakk> icycle_start C < ivertex_cnt G;\n     awalk_edge_inv G C (length (icycle_path C));\n     cas_cyc_inv G C (length (icycle_path C))\\<rbrakk> \\<Longrightarrow> awalk_spc' G C \"\nunfolding awalk_spc'_def by simp\n\ndeclare abs_ICycle'.simps [simp del]\ndeclare abs_ICycle'_simps [simp]\ndeclare mk_ipath'_list.simps [simp del]\n\nlemma is_cycle'D: \n  assumes \"is_cycle' h iC' p\"\n  shows \"is_valid_Cycle_C h p\"\n        \"start_C (heap_Cycle_C h p) = icycle'_start iC'\"\n        \"length_C (heap_Cycle_C h p) = icycle'_length iC'\"\n        \"path_C (heap_Cycle_C h p) = icycle'_path iC'\"\n        \"(\\<forall>i<unat (icycle'_length iC'). is_valid_w32 h ((icycle'_path iC') +\\<^sub>p int i))\"\n  using assms unfolding is_cycle'_def by simp+\n\nlemma C_se_spc':\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          are_cycles'' s iY' cse  \\<and>\n          iY = abs_ICycles' s iY' \\<and>\n          is_cost s iG iC c \\<and>\n          is_dist s iG iD d )\\<rbrace>\n   C_se' g cse c d \n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n         C_se_inv iG iY iC iD (length iY))\\<rbrace>!\"\n  (is \"\\<lbrace> ?pre  \\<rbrace> \n       ?prog \n       \\<lbrace> (\\<lambda>_ s. P s) And (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow>  ?inv (?ncycles:: nat)) \\<rbrace>!\" )\n  unfolding C_se'_def \n  apply wpsimp\n    apply (subst whileLoopE_add_inv [where \n            M=\"\\<lambda>(cc, s). ?ncycles - cc\" and\n            I=\"\\<lambda>cc s. ?pre s \\<and> \n                   C_se_inv iG iY iC iD cc \\<and> \n                   cc \\<le> length iY\"])\n    apply wp\n       apply (rename_tac cc s' x cc')\n       apply (rule_tac P1=\"(\\<lambda>s. ?pre s \\<and>\n                   C_se_inv iG iY iC iD cc \\<and> \n                   cc < length iY \\<and> \n                   cc < UINT_MAX)\"\n                   and iG1=iG and iY1=\"iY!cc\"\n              in validNF_post_imp[OF _ awalk_spc'])\n       apply (clarsimp simp: are_cyclesD(2))\n       apply (rename_tac cc r s)\n       apply (case_tac \"r\\<noteq>0\"; clarsimp simp: length_abs_ICycles')\n        apply (frule are_cyclesD(3)[THEN spec, THEN mp], simp)\n        apply (clarsimp simp: is_cycle'D)\n        apply (subst (asm) abs_ICycles'_nth_eq, simp)\n        apply (frule is_icycle'_is_icycle)\n        apply (frule awalk_spc'D(1), frule awalk_spc'D(2), frule awalk_spc'D(3))\n        apply (frule awalk_cost_neg_spc, (simp add: is_cycle'D abs_ICycles'_nth_eq)+)\n        apply (frule is_dist_arrlist_is_inf, simp)\n        apply (drule is_dist_valid; simp)\n        apply (frule less_eq_Suc_le[THEN iffD1])\n        apply (fastforce dest!: C_se_inv_le \n                         simp: C_se_inv_step is_cycle'_def abs_ICycles'_nth_eq)\n       apply (simp add: C_se_inv_def)\n      apply wp+\n     apply (clarsimp simp: are_cyclesD(1)[symmetric] )\n     apply (frule are_cycles_is_icycle[THEN spec, THEN  mp], assumption)\n     apply (clarsimp simp: is_cycle_valid abs_ICycles'_nth_eq)\n     apply (metis INT_MIN_MAX_lemmas(12) Suc_le_eq le_trans are_cycles''_def length_abs_ICycles') \n    apply (metis (mono_tags) nat_less_le pred_conj_app are_cyclesD(1) length_abs_ICycles')\n   apply wp\n  apply (clarsimp simp: C_se_inv_def are_cyclesD)\n  done\n\n\ndefinition vertex_not_in_cycles_start_inv :: \n  \"ICycle_Set \\<Rightarrow> IVertex \\<Rightarrow> nat \\<Rightarrow> bool\" \nwhere\n  \"vertex_not_in_cycles_start_inv CS v k = (\\<forall>i< k. v \\<noteq> fst (CS!  i))\"\n\nlemma vertex_not_in_cycles_start_inv_step :\n  assumes \"i < length CS\"\n  shows \"vertex_not_in_cycles_start_inv CS v (Suc i) = \n           (v\\<noteq>fst (CS! i) \\<and> vertex_not_in_cycles_start_inv CS v i)\"\n  using assms unfolding vertex_not_in_cycles_start_inv_def \n  by (simp add: antisym less_Suc_eq)\n\n  \nlemma vertex_not_in_cycles_start_inv_take :\n  \"i \\<le> length CS \\<Longrightarrow> vertex_not_in_cycles_start_inv CS v i = (v \\<notin> fst `(set (take i CS)))\"\n  unfolding vertex_not_in_cycles_start_inv_def\n  by (force dest!: nth_image[symmetric]) \n\nlemma are_cycles_valid:\n  assumes \"are_cycles'' s iCS' cse\"\n  assumes \"i < no_cycles_C (heap_Cycle_set_C s cse)\"\n  shows \"is_valid_Cycle_C s (cyc_obj_C (heap_Cycle_set_C s cse) +\\<^sub>p uint i)\"\n        \"is_valid_Cycle_set_C s cse\"\n  using assms unfolding are_cycles''_def \n  by (force dest!: spec[where x=\"unat i\" for i] \n            simp: int_unat unat_mono is_cycle'_def)+\n\nlemma vertex_not_in_cycles_start_spc:\n  \"\\<lbrace> P and \n     (\\<lambda>s. are_cycles'' s iCS' cse  \\<and>\n          iCS = abs_ICycles' s iCS') \\<rbrace>\n   vert_not_in_cycles_start' cse v\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n         vertex_not_in_cycles_start_inv iCS v (length iCS)) \\<rbrace>!\"   \n  (is \"\\<lbrace> ?pre  \\<rbrace> \n       ?prog \n       \\<lbrace> (\\<lambda>_ s. P s) And (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow>  ?inv (?ncycles:: nat)) \\<rbrace>!\" )\n  unfolding vert_not_in_cycles_start'_def\n  apply wpsimp\n    apply (subst whileLoopE_add_inv [where \n            M=\"\\<lambda>(i, s).  ?ncycles - unat i\" and\n            I=\"\\<lambda>i s. ?pre s \\<and> unat i \\<le> ?ncycles \\<and> ?inv (unat i)\"])\n    apply wp\n     apply (clarsimp simp: are_cycles_valid)\n     apply (rule conjI; clarsimp)\n      apply (unfold vertex_not_in_cycles_start_inv_def[where k = \"length _\"])\n      apply (drule_tac x=\"unat i\" in spec, simp add: uint_nat abs_ICycles'_def) \n      apply (simp add: are_cycles''_def is_cycle'_def)\n     apply (rule conjI, metis not_le less_unat_plus1 unat_mono length_abs_ICycles' are_cycles''_def)\n     apply (rule conjI)\n      apply (subst unatSuc2, blast dest: less_is_non_zero_p1)\n      apply (subst vertex_not_in_cycles_start_inv_step) \n       apply (simp add: word_less_nat_alt are_cycles''_def length_abs_ICycles') \n      apply (frule are_cycles_is_icycle)\n      apply (simp add: is_cycle_def abs_ICycles'_def are_cycles''_def uint_nat word_less_nat_alt)\n     apply (simp add: are_cycles''_def length_abs_ICycles')\n     apply (metis (no_types, hide_lams) Suc_diff_Suc Suc_eq_plus1  \n              add.commute add.left_neutral less_add_eq_less  less_one \n              word_less_nat_alt word_overflow_unat less_is_non_zero_p1)\n     apply (case_tac \" unat i = length iCS\"; \n            clarsimp simp: are_cycles''_def length_abs_ICycles' word_less_nat_alt) \n    apply (fastforce simp: word_le_nat_alt vertex_not_in_cycles_start_inv_def ) \n   apply wp\n  apply (clarsimp simp: vertex_not_in_cycles_start_inv_def are_cycles''_def)\n  done\n\ndefinition parents_not_in_cycles_start_inv :: \n  \"IGraph\\<Rightarrow> ICycle_Set \\<Rightarrow> IPEdge \\<Rightarrow> IVertex \\<Rightarrow> nat \\<Rightarrow> bool\" \nwhere\n  \"parents_not_in_cycles_start_inv G CS p v k = \n   (\\<forall>i \\<le> k. vertex_not_in_cycles_start_inv CS \n               (((\\<lambda>v. fst (iedges G (p v)))^^ i) v) (length CS))\"           \n\nlemma parents_not_in_cycles_start_inv_stepD:\n  \"parents_not_in_cycles_start_inv G CS p v i \\<Longrightarrow>\n   vertex_not_in_cycles_start_inv CS (((\\<lambda>v. fst (iedges G (p v)))^^  (Suc i)) v) (length CS) \\<Longrightarrow> \n  parents_not_in_cycles_start_inv G CS p v (Suc i)\"\n  unfolding parents_not_in_cycles_start_inv_def \n  by (fastforce elim: le_SucE)\n\nlemma parents_not_in_cycles_start_inv_step :\n  \"parents_not_in_cycles_start_inv G CS p v (Suc i) = \n           (vertex_not_in_cycles_start_inv CS \n               (((\\<lambda>v. fst (iedges G (p v)))^^  (Suc i)) v) (length CS) \\<and> \n           parents_not_in_cycles_start_inv G CS p v i)\"\n  unfolding parents_not_in_cycles_start_inv_def \n  by (fastforce elim: le_SucE)\n\nlemma parents_not_in_cycles_start_inv_le :\n  assumes \"i\\<le>j\"\n  assumes \"parents_not_in_cycles_start_inv G CS p v j\"\n  shows \"parents_not_in_cycles_start_inv G CS p v i\"\n  using assms \n  by (induct j) \n     (auto simp add: parents_not_in_cycles_start_inv_def)\n\nlemma parents_not_in_cycles_start_spc:\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          are_cycles'' s iCS' cse  \\<and>\n          iCS = abs_ICycles' s iCS' \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          v < ivertex_cnt iG \\<and>\n          (\\<forall>i<iN v. iP (((\\<lambda>v. fst (iedges iG (iP v))) ^^ unat i) v) < iedge_cnt iG)) \\<rbrace>\n   parents_not_in_cycles_start' g cse p n v\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n         parents_not_in_cycles_start_inv iG iCS iP v (unat (iN v))) \\<rbrace>!\"   \n  (is \"\\<lbrace> ?pre  \\<rbrace> ?prog \\<lbrace> (\\<lambda>_ s. P s) And (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> ?inv (unat ?numv)) \\<rbrace>!\" )\n  unfolding parents_not_in_cycles_start'_def\n  apply wpsimp\n      apply (subst whileLoopE_add_inv [where \n              M=\"\\<lambda>((i, u), s). ?numv - i\" and\n              I=\"\\<lambda>(i, u) s. ?pre s \\<and> \n                            i \\<le> ?numv \\<and> \n                            u = ((\\<lambda>v. fst (iedges iG (iP v)))^^ (unat i)) v \\<and>\n                            ?inv (unat i)\" ])\n      apply wpsimp\n          apply (rename_tac u'' r i' u' s i ba u)\n apply (rule_tac P1=\"(\\<lambda>s.\n                       ?pre s \\<and>\n                        i + 1 \\<le> ?numv \\<and>\n                        i=i'\\<and>\n                        i < ?numv \\<and> \n                        (if ?numv=0 \n                          then u = v \n                          else \n                               u = ((\\<lambda>v. fst (iedges iG (iP v)))^^ (unat (i + 1))) v) \\<and>\n                       ?inv (unat i))\"\n                      and iCS1 =\"iCS\" and iCS'1=\"iCS'\"\n              in validNF_post_imp[OF _ vertex_not_in_cycles_start_spc])\n         (* apply (rule_tac P1=\"(\\<lambda>s.\n                       ?pre s \\<and>\n                       i + 1 \\<le> ?numv \\<and>\n                       i < ?numv \\<and>\n                       i = i' \\<and> u = fst (iedges iG (iP u')) \\<and> \n                       u = ((\\<lambda>v. fst (iedges iG (iP v)))^^ (unat (i + 1))) v \\<and>  \n                       ?inv (unat i))\"\n                      and iCS1 =\"iCS\" and iCS'1=\"iCS'\"\n              in validNF_post_imp[OF _ vertex_not_in_cycles_start_spc])*)\n          apply clarsimp \n          apply (rename_tac i r s) \n          apply (rule conjI; clarsimp simp: parents_not_in_cycles_start_inv_def)\n           apply (blast intro: unat_le_mono)\n          apply (rule conjI, clarsimp, metis nat_less_le not_le less_unat_plus1)\n          apply (rule conjI, simp add: unat_minus_plus1_less word_less_nat_alt)\n          apply(fastforce dest!: arrlist_nth_valid simp: is_numm_def uint_nat word_less_def)\n         apply wp+\n       apply clarsimp\n       apply (rename_tac i s)\n       apply(subgoal_tac \"unat (i + 1) = unat i + 1\", simp)\n        apply (clarsimp simp: is_graph_valid_graph)\n        apply (rule conjI; clarsimp simp: inc_le is_numm_arrlist_heap)\n        apply (rule conjI)\n         apply (subst is_graph_tail_arrlist_eq, simp, simp)\n         apply (subst is_pedge_arrlist_eq[symmetric,where iP=iP], simp)\n           apply (blast intro!: parent_tail_in_verts)\n          apply simp+\n       apply (rule conjI)\n        apply (rule is_graph_valid_edge, simp)\n         apply (subst is_pedge_arrlist_eq[symmetric,where iP=iP], simp)\n           apply (blast intro!: parent_tail_in_verts)\n          apply simp+\n        apply (fast intro: is_pedge_valid dest: parent_tail_in_verts)\n       apply (fastforce simp:less_le_trans)\n      apply clarsimp\n      apply (case_tac \"a=iN v\"; simp add:is_numm_arrlist_heap)\n     apply wp\n    apply (rule_tac P1=\"(\\<lambda>s. ?pre s \\<and> u=v)\" and iCS1 =\"iCS\" and iCS'1=\"iCS'\"\n           in validNF_post_imp[OF _ vertex_not_in_cycles_start_spc])\n    apply (fastforce simp: parents_not_in_cycles_start_inv_def intro: is_numm_valid)\n   apply wp\n   apply clarsimp\n   done \n\ndefinition int_neg_cyc_inv :: \n  \"IGraph \\<Rightarrow> IENInt \\<Rightarrow>ICycle_Set \\<Rightarrow> IPEdge \\<Rightarrow> IEInt \\<Rightarrow> IVertex \\<Rightarrow> bool\" \nwhere\n  \"int_neg_cyc_inv G d CS P n k = \n    (\\<forall>i< k. is_inf_d d i < 0 \\<longrightarrow>  \n            \\<not> parents_not_in_cycles_start_inv G CS P i (unat (n i)))\"\n\nlemma int_neg_cyc_inv_step :\n  \"k < max_word \\<Longrightarrow> \n   int_neg_cyc_inv G d CS P n (k + 1) = \n    (int_neg_cyc_inv G d CS P n k \\<and> \n    (is_inf_d d k < 0 \\<longrightarrow>  \n      \\<not> parents_not_in_cycles_start_inv G CS P k (unat (n k))))\"\nby (fastforce simp: int_neg_cyc_inv_def less_x_plus_1 not_less_iff_gr_or_eq)\n\nlemma int_neg_cyc_spc:\n  \"\\<lbrace> P and \n     (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          are_cycles'' s iCS' cse  \\<and>\n          iCS = abs_ICycles' s iCS' \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_pedge s iG iP p \\<and>\n          (\\<forall>v <ivertex_cnt iG.  \\<forall>i<iN v. abs_IDist iD v \\<noteq> \\<infinity> \\<longrightarrow>\n             iP (((\\<lambda>v. fst ((iedges iG) (iP v))) ^^ unat i) v) < iedge_cnt iG)) \\<rbrace>\n   int_neg_cyc' g d cse p n\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n         int_neg_cyc_inv iG iD iCS iP iN (ivertex_cnt iG)) \\<rbrace>!\"   \n(is \n  \"\\<lbrace> ?pre  \\<rbrace> \n   ?prog\n   \\<lbrace> (\\<lambda>_ s. P s) And (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n        ?inv (?verts:: 32 word)) \\<rbrace>!\" )\n  unfolding int_neg_cyc'_def\n  apply wpsimp\n    apply (subst whileLoopE_add_inv [where \n            M=\"\\<lambda>(i, s). ?verts -  i\" and\n            I=\"\\<lambda>i s. ?pre s \\<and>  i \\<le> ?verts \\<and> ?inv i\"])\n    apply wp\n       apply clarsimp\n       apply (rule_tac P1=\"(\\<lambda>s.\n                       ?pre s \\<and>\n                       i < ?verts \\<and>\n                       is_inf_d iD  i < 0\\<and>\n                       ?inv i)\"\n                      and iCS1 =\"iCS\" and iCS'1=\"iCS'\" and iN1=iN and iP1=iP and iG1=iG\n              in validNF_post_imp[OF _ parents_not_in_cycles_start_spc])\n       apply clarsimp\n       apply (rule conjI; rule impI)\n        apply (fastforce simp: int_neg_cyc_inv_def) \n       apply (rule conjI, fastforce intro: inc_le) \n       apply (rule conjI, fastforce simp: int_neg_cyc_inv_def intro: le_step)\n       apply (simp add: is_graph_valid_graph unat_minus_plus1_less word_less_nat_alt)\n      apply wp+\n     apply clarsimp\n     apply (rule conjI; clarsimp simp:abs_IDist_def)\n      apply (fastforce dest: is_dist_arrlist_is_inf is_dist_valid simp: is_graph_def)\n     apply (rule conjI, fastforce intro!: inc_le simp: is_graph_def) \n     apply (rule conjI)\n      apply (rule int_neg_cyc_inv_step[THEN iffD2])\n       apply (metis max_word_max not_le not_less_iff_gr_or_eq)\n      apply (simp add: is_graph_def is_dist_arrlist_is_inf)\n     apply (simp add: is_graph_def unat_minus_plus1_less word_less_nat_alt is_dist_valid)\n    apply (clarsimp simp: is_graph_def)\n   apply wp\n  apply (clarsimp simp: int_neg_cyc_inv_def is_graph_valid_graph)\n  done\n\n\ndefinition shortest_paths_locale_step3_inv :: \n  \"IGraph \\<Rightarrow> IVertex \\<Rightarrow> ICost \\<Rightarrow> IEInt \\<Rightarrow> IPEdge \\<Rightarrow> \n   IENInt \\<Rightarrow> IPEdge \\<Rightarrow> ICycle_Set \\<Rightarrow> bool\" \nwhere\n  \"shortest_paths_locale_step3_inv G sc c n p d pred cse \\<equiv>\n   shortest_paths_locale_step2_inv G sc c n p d pred  \\<and>\n   C_se_inv G cse c d (length cse) \\<and>\n   int_neg_cyc_inv  G d cse p n (ivertex_cnt G)\"\n\nlemma C_se_inv_eq_math: \n  \"wf_digraph (abs_IGraph G) \\<Longrightarrow>\n   C_se_inv G cse c d (length cse) =\n   (set cse \\<subseteq> \n      {(u, p). abs_IDist d u \\<noteq> \\<infinity> \\<and> \n                pre_digraph.awalk (abs_IGraph G) u p u \\<and> \n                wf_digraph.awalk_cost (abs_ICost c) p < 0})\"\n  unfolding C_se_inv_def     \n  apply (rule iffI; clarsimp simp: abs_IDist_def)\n   apply (metis (no_types, hide_lams) awalk_cost_eq_math[symmetric] of_int_0\n      dual_order.order_iff_strict in_set_conv_nth awalk_neg_cyc_cost_def\n      fst_conv of_int_sint awalk_spc'_eq_awalk snd_conv of_int_less_0_iff)\n  apply (rule conjI, fastforce simp: in_set_conv_nth)\n  apply (rule conjI, fastforce dest: nth_mem simp: awalk_spc'_eq_awalk) \n  apply (frule_tac iY=\"cse ! i\" in awalk_cost_eq_math[where iC=c])\n  apply(force dest!: nth_mem)  \n  done\n\nlemma vertex_not_in_cycles_start_inv_eq_math:\n  \"vertex_not_in_cycles_start_inv CS v (length CS) = (v \\<notin> fst ` set CS)\"\nunfolding vertex_not_in_cycles_start_inv_def \nby (metis (no_types, hide_lams) image_iff in_set_conv_nth)\n\n(* move to ShortestPathNeg or a Util file  *)\nlemma (in shortest_paths_locale_step1) length_pwalk: \n  \"\\<lbrakk> v \\<noteq> s \\<and> v \\<in> verts G \\<and> dist v \\<noteq> \\<infinity> \\<or> v = s\\<rbrakk> \\<Longrightarrow>\n   length (pwalk v) = num v\"\n  apply (induct \"num v\" arbitrary: v) \n   apply (fastforce dest: num_s_is_min \n      pwalk_simps(1))\n  apply (case_tac \"v=s\", clarsimp simp: s_assms) \n  apply (drule_tac x=\"tail G (the (parent_edge v))\" in meta_spec)\n  apply (metis Suc_eq_plus1 arc_implies_awalk awalk_hd_in_verts\n      length_append_singleton nat_add_right_cancel option.sel \n      path_from_root_Vr_ex pwalk_simps(2))\n  done\n \nlemma (in shortest_paths_locale_step1)length_awalk: \n  \"\\<lbrakk> v \\<noteq> s \\<and> v \\<in> verts G \\<and> dist v \\<noteq> \\<infinity> \\<or> v = s \\<rbrakk> \\<Longrightarrow>\n   length (awalk_verts s (pwalk v)) =  Suc (num v)\"\nby (metis length_awalk_verts length_pwalk)\n\nlemma (in shortest_paths_locale_step1) pwalk_verts_in_verts:\n  \"v \\<in> pwalk_verts u \\<Longrightarrow> v\\<in> verts G\"\nby (metis awalk_decomp awalk_hd_in_verts awalk_verts.simps(1) \n          pwalk_awalk  pwalk.elims mem_Collect_eq s_assms(1)\n          pwalk_verts_def vwalk_singleton vwalk_verts_in_verts)\n\nlemma (in shortest_paths_locale_step1) pwalk_in_arcs:\n  \"e \\<in> set (pwalk v) \\<Longrightarrow> e\\<in> arcs G\"\nby (metis awalkE  empty_set equals0D  pwalk.simps pwalk_awalk  subsetD)\n\n(* set lemma not really in this locale just need to move  *)\nlemma (in shortest_paths_locale_step1) not_in_nth_eq_disjoint:\n  \"\\<lbrakk> n = length W'; W = set W'\\<rbrakk> \\<Longrightarrow> (\\<forall>i<n. W' ! i \\<notin> C) \\<equiv> (C \\<inter> W = {})\" \n  using disjoint_iff_not_equal in_set_conv_nth by smt \n\nlemma (in shortest_paths_locale_step1) rev_awalk_verts_pwalk_at_zero_eq:\n  assumes \" v\\<noteq>s\"\n  assumes \"dist v \\<noteq> \\<infinity>\"\n  assumes \" v \\<in> verts G\"\n  shows \"rev (awalk_verts s (pwalk v)) ! 0 = v\"\n  apply (subst pwalk.simps)\n  apply (simp del: pwalk.simps)\n  apply safe\n  using assms(2) apply blast\n  using assms(3) apply blast \n  apply (insert shortest_paths_locale_step1_axioms)\n  apply (simp only: shortest_paths_locale_step1_def; safe)\n  apply (erule_tac x=v in allE)\n  apply safe\n  apply (simp del: pwalk.simps)\n  by (smt append.assoc append.left_neutral append.right_neutral append_Cons append_Nil \n      append_eq_append_conv append_is_Nil_conv assms(3) awalkE' awalkI rev.simps(2)\n      awalk_decomp_verts awalk_verts_conv length_awalk_verts nat.inject nth_Cons_0 \n      option.sel pwalk_awalk pwalk_simps(2) rev_append singleton_rev_conv)\n\nlemma (in pre_digraph) rev_awalk_verts_conv:\n  \"rev (awalk_verts u p) = \n    (if p = [] then [u] else head G (last p) # (map (tail G) (rev p)))\"\n  by (fastforce simp: awalk_verts_conv rev_map)\n\nlemma (in pre_digraph) rev_awalk_verts_conv':\n  assumes \"cas u p v\"\n  shows \"rev (awalk_verts u p) = (if p = [] then [u] else (map (head G) (rev p)) @[tail G (hd p)])\"\n  using assms awalk_verts_conv' rev_map by fastforce \n\nlemma (in shortest_paths_locale_step1) rev_awalk_verts_pwalk_conv:\n  notes pwalk.simps[simp del]\n  shows \"rev (awalk_verts s (pwalk v)) = \n          (if (pwalk v) = [] then [s] else head G (the (parent_edge v)) # \n             (rev (awalk_verts s (pwalk (tail G (the (parent_edge v)))))))\" \nby (smt append_Cons append_Nil2 awalkE cas.simps(2) list.simps(8) list.simps(9)\n        nth_Cons_0 option.sel pwalk.simps pwalk_awalk rev.simps(1) rev_append \n        rev_awalk_verts_conv rev_singleton_conv rev_awalk_verts_pwalk_at_zero_eq \n        parent_num_assms shortest_paths_locale_step1_axioms)\n\n(*pwalk (tail G (the (parent_edge v)))*)\n\nlemma (in shortest_paths_locale_step1) rev_awalk_verts_pwalk_Suc_nth_eq:\n  notes pwalk.simps[simp del]\n  assumes \" v \\<in> verts G\"\n  assumes \"dist v \\<noteq> \\<infinity>\"\n  assumes \" v\\<noteq>s\"\n  assumes \"i < num v\"   \n  shows \n    \"rev (awalk_verts s (pwalk v)) ! Suc i =\n      tail G (the (parent_edge (rev (awalk_verts s (pwalk v)) ! i)))\" \n  using assms \n  apply (induct i arbitrary: v)\n   apply (subst rev_awalk_verts_pwalk_conv, clarsimp)\n   apply (smt nth_Cons_Suc rev_awalk_verts_pwalk_conv rev_awalk_verts_pwalk_at_zero_eq cas.simps(2) \n              nth_Cons_0 pwalk_simps pwalk_awalk self_append_conv2 awalkE)\n  apply (smt rev_awalk_verts_pwalk_conv Suc_less_eq length_append_singleton less_nat_zero_code \n             nth_Cons_Suc length_pwalk list.size(3) shortest_paths_locale_step1_axioms pwalk_simps)\n  done\n\nlemma (in shortest_paths_locale_step1) head_parent_nth_eq_pwalk_nth:\n  notes pwalk.simps[simp del]\n  assumes \" v \\<in> verts G\"\n  assumes \"dist v \\<noteq> \\<infinity>\"\n  assumes \" v\\<noteq>s\"\n  assumes \"i \\<le> num v\"   \n  shows \"((\\<lambda>v. tail G (the (parent_edge v))) ^^ i) v = \n          rev (awalk_verts s (pwalk v)) ! i\"\n  using assms\n  apply (induct i arbitrary: v) \n   apply (fastforce dest: rev_awalk_verts_pwalk_at_zero_eq)\n  apply (simp add: rev_awalk_verts_pwalk_Suc_nth_eq)\n  done\n\nlemma (in shortest_paths_locale_step1) cycle_does_not_intersect_path_eq':\n  \" \\<lbrakk> wf_digraph G; v \\<in> verts G; v\\<noteq>s;\n    dist v \\<noteq> \\<infinity>\\<rbrakk> \\<Longrightarrow>\n    (\\<forall>i\\<le>num v. awalk_verts s (pwalk v) ! i \\<notin> S) =\n    (S \\<inter> pwalk_verts v = {})\" \n  using length_awalk_verts length_pwalk n_not_Suc_n mem_Collect_eq in_set_conv_nth\n        head_parent_nth_eq_pwalk_nth pwalk_verts_def less_Suc_eq_le disjoint_iff_not_equal     \n  by smt\n\ndefinition (in shortest_paths_locale_step1) pwalk_verts_rev :: \"'a  \\<Rightarrow> 'a set\" where \n  \"pwalk_verts_rev v = {u. u \\<in> set (rev (awalk_verts s (pwalk v)))}\" \n\nlemma (in shortest_paths_locale_step1) pwalks_verts_rev_same: \n  \"pwalk_verts v = pwalk_verts_rev v\"\n  unfolding shortest_paths_locale_step1.pwalk_verts_rev_def[OF shortest_paths_locale_step1_axioms]\n    shortest_paths_locale_step1.pwalk_verts_def[OF shortest_paths_locale_step1_axioms]\n  by simp\n\nlemma (in shortest_paths_locale_step1) cycle_does_not_intersect_path_eq'':\n  \" \\<lbrakk> wf_digraph G; v \\<in> verts G; v\\<noteq>s;\n    dist v \\<noteq> \\<infinity>\\<rbrakk> \\<Longrightarrow>\n    (\\<forall>i\\<le>num v. rev (awalk_verts s (pwalk v)) ! i \\<notin> S) =\n    (S \\<inter> pwalk_verts v = {})\" \n  apply (simp only: pwalks_verts_rev_same)\n  using length_awalk_verts length_pwalk n_not_Suc_n mem_Collect_eq in_set_conv_nth\n        head_parent_nth_eq_pwalk_nth pwalk_verts_rev_def less_Suc_eq_le disjoint_iff_not_equal\n  by (smt length_rev)\n\nlemma cycle_does_not_intersect_path_eq:\n  \"\\<lbrakk> v\\<noteq>s; wf_digraph (abs_IGraph G);\n     v \\<in> verts (abs_IGraph G);\n     abs_IDist d v \\<noteq> \\<infinity>; \n     C_se_inv G cse c d (length cse); \n     shortest_paths_locale_step2_inv G s c n p d pred;\n     \\<forall>i\\<le>abs_INat n v.\n         ((\\<lambda>v. fst (snd (snd G) (p v))) ^^ i) v =\n         pre_digraph.awalk_verts (abs_IGraph G) s\n          (shortest_paths_locale_step1.pwalk (abs_IGraph G) s (abs_IPedge p)\n            (abs_IDist d) v) ! i \\<rbrakk> \\<Longrightarrow>\n    (\\<forall>i\\<le>abs_INat n v.\n        ((\\<lambda>v. fst (snd (snd G) (p v))) ^^ i) v \\<notin> fst ` set cse) =\n    (fst ` set cse \\<inter>\n     shortest_paths_locale_step1.pwalk_verts (abs_IGraph G) s (abs_IPedge p)\n      (abs_IDist d) v =\n     {})\"\n  by (simp add: shortest_paths_locale_step1.cycle_does_not_intersect_path_eq'\n                shortest_paths_locale_step1_inv_eq_maths \n                shortest_paths_locale_step2_inv_def)\n\nlemma cycle_does_not_intersect_path_eq':\n  \"\\<lbrakk> v\\<noteq>s; wf_digraph (abs_IGraph G);\n     v \\<in> verts (abs_IGraph G);\n     abs_IDist d v \\<noteq> \\<infinity>; \n     C_se_inv G cse c d (length cse); \n     shortest_paths_locale_step1 (abs_IGraph G) s (abs_INat n) (abs_IPedge p) (abs_IDist d);\n     \\<forall>i\\<le>abs_INat n v.\n         ((\\<lambda>v. fst (snd (snd G) (p v))) ^^ i) v =\n         rev (pre_digraph.awalk_verts (abs_IGraph G) s\n          (shortest_paths_locale_step1.pwalk (abs_IGraph G) s (abs_IPedge p)\n            (abs_IDist d) v)) ! i \\<rbrakk> \\<Longrightarrow>\n    (\\<forall>i\\<le>abs_INat n v.\n        ((\\<lambda>v. fst (snd (snd G) (p v))) ^^ i) v \\<notin> fst ` set cse) =\n    (fst ` set cse \\<inter>\n     shortest_paths_locale_step1.pwalk_verts (abs_IGraph G) s (abs_IPedge p)\n      (abs_IDist d) v =\n     {})\"\n  by (simp add: shortest_paths_locale_step1.cycle_does_not_intersect_path_eq''\n                shortest_paths_locale_step1_inv_eq_maths)\n\nlemma the_abs_IPedge_simp: \n  \"\\<lbrakk> v < fst G ; v\\<noteq>s ; d v \\<noteq> \\<infinity> ;\n     shortest_paths_locale_step1 (abs_IGraph G) s n (abs_IPedge p) d\\<rbrakk> \\<Longrightarrow> \n   the (abs_IPedge p v) = p v\"\nby (fastforce dest!: shortest_paths_locale_step1.parent_num_assms simp: abs_IPedge_def) \n\nlemma msb_abs_IPedgeI:\n  \"\\<lbrakk> shortest_paths_locale_step1 G s n (abs_IPedge p) d \\<rbrakk> \\<Longrightarrow> \n   msb (p s)\" \nby (meson None_abs_pedgeI shortest_paths_locale_step1.s_assms(3))\n\nlemma not_msb_abs_IPedgeD:\n  \"\\<lbrakk> shortest_paths_locale_step1 (abs_IGraph G) s n (abs_IPedge p) d; \n    v < fst G ; d v \\<noteq> \\<infinity> ;  \\<not> msb (p v)\\<rbrakk> \\<Longrightarrow> \n   v\\<noteq> s\"   \nusing msb_abs_IPedgeI by blast\n\nlemma msb_abs_IPedgeD:\n  \"\\<lbrakk> shortest_paths_locale_step1 (abs_IGraph G) s n (abs_IPedge p) d; \n    v < fst G ; d v \\<noteq> \\<infinity> ; msb (p v)\\<rbrakk> \\<Longrightarrow> \n   v= s\" \nby (fastforce dest: shortest_paths_locale_step1.parent_num_assms simp add: abs_IPedge_def)\n\nlemma not_msb_abs_IPedgeI:\n  \"\\<lbrakk> shortest_paths_locale_step1 (abs_IGraph G) s n (abs_IPedge p) d; \n    v < fst G ; d v \\<noteq> \\<infinity> ; v\\<noteq> s\\<rbrakk> \\<Longrightarrow> \n    \\<not> msb (p v)\" \n  using msb_abs_IPedgeD by blast\n\nlemma (in shortest_paths_locale_step1) nth_parent_facts:\n notes pwalk.simps[simp del]\n shows \n  \"\\<lbrakk> v \\<in>verts G ; v\\<noteq>s ; dist v \\<noteq> \\<infinity> ; i < num v; \n     f = (\\<lambda>v. tail G (the (parent_edge v)))\\<rbrakk> \\<Longrightarrow> \n      (f ^^ i) v \\<in>verts G \\<and> (f ^^ i) v \\<noteq> s \\<and> dist ((f ^^ i) v) \\<noteq> \\<infinity>\"\n  apply (induct i arbitrary:v; simp) \n  apply (rule conjI, fastforce dest: parent_num_assms)\n  apply (rule conjI)\n   apply (case_tac \"i=num v\"; clarsimp) \n   apply (metis Suc_eq_plus1 Suc_lessD Zero_not_Suc funpow_swap1 path_from_root_Vr_ex\n                less_handy_casesE not_less_less_Suc_eq option.sel s_assms(4) tail_in_verts)\n  apply (fastforce dest: parent_num_assms)\n  done\n\nlemma nth_abs_IPedge_simp:\n  \"\\<lbrakk> v < fst G ; v\\<noteq>s ; d v \\<noteq> \\<infinity> ; i \\<le> n v;\n     shortest_paths_locale_step1 (abs_IGraph G) s n (abs_IPedge p) ( d)\\<rbrakk> \\<Longrightarrow> \n  ((\\<lambda>v. fst ((iedges G) (the (abs_IPedge p v)))) ^^ i) v = \n  ((\\<lambda>v. fst ((iedges G) (p v))) ^^ i) v \" \n  apply (induct i arbitrary:v; simp)\n  apply (frule_tac i=i in shortest_paths_locale_step1.nth_parent_facts, simp+, clarsimp) \n  apply (auto simp: the_abs_IPedge_simp)\n  done\n\nlemma nth_parent_eq_math:\n  \"v < fst G \\<Longrightarrow>\n   shortest_paths_locale_step1 (abs_IGraph G) s (abs_INat n) (abs_IPedge p) (abs_IDist d)  \\<Longrightarrow>\n    abs_IDist d v = - \\<infinity> \\<Longrightarrow>\n    v \\<noteq> s \\<Longrightarrow>\n    \\<forall>i\\<le>abs_INat n v.\n       ((\\<lambda>v. fst (snd (snd G) (p v))) ^^ i) v =\n       rev (pre_digraph.awalk_verts (abs_IGraph G) s (shortest_paths_locale_step1.pwalk (abs_IGraph G) s \n       (abs_IPedge p) (abs_IDist d) v)) ! i\"\n  apply (clarsimp simp: shortest_paths_locale_step2_inv_eq_maths )\n  apply (subst shortest_paths_locale_step1.head_parent_nth_eq_pwalk_nth[symmetric], simp_all)\n  apply (simp add: nth_abs_IPedge_simp [symmetric, where d=\"abs_IDist d\"])\n  done\n\nlemma parents_not_in_cycles_start_inv_eq_math: \n  \"\\<lbrakk>v \\<in> verts (abs_IGraph G);\n     abs_IDist d v \\<noteq> \\<infinity>;\n     C_se_inv G cse c d (length cse); \n     shortest_paths_locale_step1 (abs_IGraph G) s (abs_INat n) (abs_IPedge p) (abs_IDist d);\n     v\\<noteq>s \\<and> v \\<in> verts (abs_IGraph G) \\<and> abs_IDist d v = - \\<infinity> \\<or> v=s \\<rbrakk> \\<Longrightarrow>\n   parents_not_in_cycles_start_inv G cse p v (abs_INat n v) = \n   (fst ` set cse \\<inter> \n    shortest_paths_locale_step1.pwalk_verts \n     (abs_IGraph G) s (abs_IPedge p) (abs_IDist d) v = {})\"\n  unfolding parents_not_in_cycles_start_inv_def\n    vertex_not_in_cycles_start_inv_eq_math \n  apply (case_tac \"v = s\")\n   apply (clarsimp simp: shortest_paths_locale_step1.pwalk_verts_def\n      shortest_paths_locale_step1.pwalk.simps\n      shortest_paths_locale_step1.s_assms pre_digraph.awalk_verts.simps) \n  apply(subst cycle_does_not_intersect_path_eq'[symmetric], simp_all)\n   apply (metis shortest_paths_locale_step1.graphG  shortest_paths_locale_step1_def fin_digraph_def)\n  using nth_parent_eq_math by blast\n\nlemma int_neg_cyc_inv_eq_math:\n  \"\\<lbrakk> wf_digraph (abs_IGraph G);\n     C_se_inv G cse c d (length cse);\n     shortest_paths_locale_step1 (abs_IGraph G) s (abs_INat n) (abs_IPedge p) (abs_IDist d) \\<rbrakk> \\<Longrightarrow>\n     int_neg_cyc_inv G d cse p n (fst G) =\n     (\\<forall>v<fst G. abs_IDist d v = - \\<infinity> \\<longrightarrow> \n        fst ` set cse \\<inter> \n        shortest_paths_locale_step1.pwalk_verts\n          (abs_IGraph G) s (abs_IPedge p) (abs_IDist d) v \\<noteq> {})\"\n  unfolding int_neg_cyc_inv_def \n  apply (rule iffI; clarsimp)\n   apply(subst (asm) parents_not_in_cycles_start_inv_eq_math\n      [unfolded abs_INat_def, symmetric, where ?n=n], simp_all) \n  unfolding abs_INat_def apply simp\n   apply (fastforce simp: abs_IDist_def)\n  apply (erule_tac x=i in allE, clarsimp simp: abs_IDist_def)\n  apply(subst (asm) parents_not_in_cycles_start_inv_eq_math\n      [unfolded abs_INat_def, symmetric, where ?n=n], simp)\n  unfolding abs_INat_def \n  using shortest_paths_locale_step1_inv_eq_maths \n      apply (fastforce simp: abs_IDist_def)+\n  done\n\nlemma shortest_paths_locale_step3_eq_maths:\n  \"\\<And>G s c n p d pred cse.\n    shortest_paths_locale_step3_inv G s c n p d pred cse\n    =\n    shortest_paths_locale_step3_pred\n    (abs_IGraph G) s (abs_ICost c) (abs_INat n)\n    (abs_IPedge p) (abs_IDist d) (abs_IPedge pred) (set cse)\"\nproof -\n  fix G c s n p d pred cse\n  let ?aG = \"abs_IGraph G\"\n  let ?ad = \"abs_IDist d\"\n  let ?ac = \"abs_ICost c\"\n  let ?an = \"abs_INat n\"\n  let ?ap = \"abs_IPedge p\"\n  show \"?thesis G s c n p d pred cse\"\n    unfolding  shortest_paths_locale_step3_inv_def \n      shortest_paths_locale_step3_pred_def \n      shortest_paths_locale_step3_pred_axioms_def\n      shortest_paths_locale_step2_inv_eq_maths\n    apply (fastforce simp: shortest_paths_locale_step2_pred_def fin_digraph_def\n           shortest_paths_locale_step1_def C_se_inv_eq_math int_neg_cyc_inv_eq_math)  \n    done\nqed\n(**to be updated to step3 *)\n\n\nlemma shortest_paths_locale_step3_spc_intermediate:\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_cost s iG iC c \\<and>\n          is_pedge s iG iP p \\<and>\n          is_pedge s iG iPred pred \\<and>\n          are_cycles'' s iCS' cse \\<and>\n          iCS = abs_ICycles' s iCS') \\<rbrace>\n   shortest_paths_locale_step3' g sc c n pred d cse p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n        shortest_paths_locale_step3_inv iG sc iC iN iP iD iPred iCS)\\<rbrace>!\"\n  apply (clarsimp simp: shortest_paths_locale_step3'_def shortest_paths_locale_step3_inv_def)\n  apply wp\n      apply (rule_tac P1=\"P and \n                          (\\<lambda>s. wf_digraph (abs_IGraph iG) \\<and>\n                               is_graph s iG g \\<and>\n                               is_dist s iG iD d \\<and>\n                               is_numm s iG iN n \\<and>\n                               is_cost s iG iC c \\<and>\n                               is_pedge s iG iP p \\<and>\n                               is_pedge s iG iPred pred \\<and>\n                               are_cycles'' s iCS' cse \\<and>\n                               iCS = abs_ICycles' s iCS' \\<and>\n                               shortest_paths_locale_step2_inv iG sc iC iN iP iD iPred \\<and>\n                               C_se_inv iG iCS iC iD (length iCS) )\" \n                      in validNF_post_imp[OF _ int_neg_cyc_spc[where iCS=iCS]])\n     apply fastforce\n      apply (rule_tac P1=\" P and \n    (\\<lambda>s.  wf_digraph (abs_IGraph iG) \\<and>\n          is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_cost s iG iC c \\<and>\n          is_pedge s iG iP p \\<and>\n          is_pedge s iG iPred pred \\<and>\n          are_cycles'' s iCS' cse \\<and>\n          iCS = abs_ICycles' s iCS' \\<and>\n          shortest_paths_locale_step2_inv iG sc iC iN iP iD iPred)\" \n      in validNF_post_imp[OF _ C_se_spc'[where iY=iCS]])\n    apply clarsimp\n    apply (case_tac \"r=0\", fastforce, clarsimp) \n    apply (rule conjI, simp)+\n    apply (clarsimp simp: shortest_paths_locale_step2_inv_eq_maths)\n    apply (drule shortest_paths_locale_step2_pred.axioms(1))\n    apply (case_tac \"v\\<noteq>sc\")\n     apply (subst nth_abs_IPedge_simp[symmetric, where n=\"abs_INat iN\" and p=\" iP\"], simp+)\n       apply (fastforce dest: unat_mono simp: abs_INat_def, simp)\n     apply (frule shortest_paths_locale_step1.nth_parent_facts, simp+)\n       apply (fastforce intro!: unat_mono simp: abs_INat_def, simp+)\n     apply (fastforce dest!: shortest_paths_locale_step1.parent_num_assms simp: abs_IPedge_def)\n     apply (fastforce dest!:shortest_paths_locale_step1.s_assms(4) simp:unat_eq_zero abs_INat_def)\n  apply (rule_tac P1=\"P and \n                     (\\<lambda>s. is_graph s iG g \\<and>\n                          is_dist s iG iD d \\<and>\n                          is_numm s iG iN n \\<and>\n                          is_cost s iG iC c \\<and>\n                          is_pedge s iG iP p \\<and>\n                          is_pedge s iG iPred pred \\<and>\n                          are_cycles'' s iCS' cse \\<and>\n                          iCS = abs_ICycles' s iCS')\" \n                  in validNF_post_imp[OF _ shortest_paths_locale_step2_spc_intermediate]) \n   apply (fastforce dest: shortest_paths_locale_step1.graphG \n                    simp: shortest_paths_locale_step2_inv_eq_maths \n                          shortest_paths_locale_step2_pred_def fin_digraph_def)\n  apply fastforce\n  done\n\ntheorem shortest_paths_locale_step3_spc:\n  \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_cost s iG iC c \\<and>\n          is_pedge s iG iP p \\<and>\n          is_pedge s iG iPred pred \\<and>\n          are_cycles'' s iCS' cse \\<and> iCS = abs_ICycles' s iCS')\\<rbrace>\n   shortest_paths_locale_step3' g sc c n pred d cse p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0  \\<longleftrightarrow> \n        shortest_paths_locale_step3_pred\n    (abs_IGraph iG) sc (abs_ICost iC) (abs_INat iN)\n    (abs_IPedge iP) (abs_IDist iD) (abs_IPedge iPred) (set iCS))\\<rbrace>!\"\n  by (fastforce intro!: validNF_post_imp[OF _ shortest_paths_locale_step3_spc_intermediate] \n                   simp: shortest_paths_locale_step3_eq_maths) \n\ncorollary shortest_paths_checker_is_correct:\n    \"\\<lbrace> P and \n     (\\<lambda>s. is_graph s iG g \\<and>\n          is_dist s iG iD d \\<and>\n          is_numm s iG iN n \\<and>\n          is_cost s iG iC c \\<and>\n          is_pedge s iG iP p \\<and>\n          is_pedge s iG iPred pred \\<and>\n          are_cycles'' s iCS' cse \\<and> \n          iCS = abs_ICycles' s iCS')\\<rbrace>\n   shortest_paths_locale_step3' g sc c n pred d cse p\n   \\<lbrace> (\\<lambda>_ s. P s) And \n     (\\<lambda>rr s. rr \\<noteq> 0 \\<longrightarrow> \n  (\\<forall>v \\<in> verts (abs_IGraph iG).\n   (abs_IDist iD) v = wf_digraph.\\<mu> (abs_IGraph iG) (abs_ICost iC) sc v))\\<rbrace>!\"\n  using validNF_post_imp[OF _ shortest_paths_locale_step3_spc] \n         shortest_paths_locale_step3_pred.correct_shortest_path[of \"(abs_IGraph iG)\"] \n  by auto\n\nend\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-isa19/ShortestPathNegCVerification.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6039318337259583, "lm_q2_score": 0.5, "lm_q1q2_score": 0.30196591686297913}}
{"text": "section \"Completeness\"\ntheory completeness\n  imports single_invocation_reduction\nsingle_invocation_correctness\nbegin\n\ntext \"The goal here is to prove the inverse of the soundness theorem @{thm show_correctness_via_single_session}.\"\n\nlemma false_step_invarariant_false:\n  assumes \"S ~~ (i, a, False) \\<leadsto>\\<^sub>S S'\"\n  shows \"\\<not>invariant_all S' \\<or> a = ALocal False\"\n  using assms by (auto simp add: step_s.simps)\n\nlemma completeness_1:\n  assumes step_s: \"S ~~ (i, a, False) \\<leadsto>\\<^sub>S S'\"\n    and wf: \"state_wellFormed S\"\n  shows \"\\<exists>tr. (initialState (prog S) ~~ tr \\<leadsto>* S') \\<and> (i,a) \\<in> set tr\" \nproof (cases \"\\<exists>p. a = AInvoc p\")\n  case True\n  from this obtain p where \"a = AInvoc p\" by blast\n\n  from `a = AInvoc p` step_s\n  show \"\\<exists>tr. (initialState (prog S) ~~ tr \\<leadsto>* S') \\<and> (i, a) \\<in> set tr\"\n  proof (auto simp add: step_s.simps, fuzzy_goal_cases InvocStep)\n    case (InvocStep initState impl S_invoc)\n\n    have h1: \"localState S_invoc i = None\"\n      by (simp add: InvocStep.invocOp_eq2 InvocStep.state_wellFormed wf_localState_needs_invocOp)\n\n    from h1 \n    have \"S_invoc ~~ (i,a) \\<leadsto> S'\"\n      by (auto simp add: step.simps  InvocStep)\n\n    from `state_wellFormed S_invoc`\n    obtain tr1 where \"initialState (prog S) ~~ tr1 \\<leadsto>* S_invoc\"\n      using state_wellFormed_def ` prog S_invoc = prog S` by metis\n\n    with `S_invoc ~~ (i,a) \\<leadsto> S'`\n    show ?case\n      by (auto simp add: InvocStep.a_def InvocStep.S'_def steps_step intro!: exI[where x=\"tr1@[(i,a)]\"])\n  qed\nnext \n  case False\n  text \"Other cases are: endAtomic, local, return. \n    For these we can exactly reproduce the step:\"\n\n  from step_s False\n  have \"S ~~ (i, a) \\<leadsto> S'\"\n    by (auto simp add: step_s.simps)\n      (auto simp add: step.simps intro!: exI)\n\n  obtain tr where \"initialState (prog S) ~~ tr \\<leadsto>* S\"\n    using local.wf state_wellFormed_def by blast\n\n  with `S ~~ (i, a) \\<leadsto> S'`\n  have \"initialState (prog S) ~~ tr@[(i,a)] \\<leadsto>* S'\"\n    using wf state_wellFormed_def steps_step by blast\n\n  thus ?thesis\n    by auto\nqed\n\ntext_raw \\<open>\\DefineSnippet{completeness}{\\<close>\ntheorem completeness:\n  assumes correct: \"programCorrect program\"\nshows \"programCorrect_s program\"\n  text_raw \\<open>}%EndSnippet\\<close>\nproof (rule ccontr)\n  assume \"\\<not> programCorrect_s program\"\n  from this\n  obtain trace i S_final\n    where \"\\<not> traceCorrect_s trace\"\n      and \"initialState program ~~ (i, trace) \\<leadsto>\\<^sub>S* S_final\"\n    by (auto simp add: programCorrect_s_def)\n\n\n  from `\\<not> traceCorrect_s trace`\n  obtain tr1 a tr2\n    where \"trace = tr1 @ [(a, False)] @ tr2\"\n    by (auto simp add: traceCorrect_s_def dest: split_list)\n\n\n  obtain S S' \n    where \"initialState program ~~ (i, tr1) \\<leadsto>\\<^sub>S* S\"\n      and \"S ~~ (i, a, False) \\<leadsto>\\<^sub>S S'\" \n    using `initialState program ~~ (i, trace) \\<leadsto>\\<^sub>S* S_final` \n      and `trace = tr1 @ [(a, False)] @ tr2`\n    by (auto simp add: steps_s_append_simp steps_s_cons_simp)\n\n  have \"state_wellFormed S\"\n    using \\<open>initialState program ~~ (i, tr1) \\<leadsto>\\<^sub>S* S\\<close> state_wellFormed_s_def state_wellFormed_s_to_wf by blast  \n\n  have \"prog S = program\"\n    using \\<open>initialState program ~~ (i, tr1) \\<leadsto>\\<^sub>S* S\\<close> prog_initial unchangedProg by fastforce\n\n\n  from this obtain tr\n    where \"initialState program ~~ tr \\<leadsto>* S'\" and \"(i,a) \\<in> set tr\"\n    using \\<open>S ~~ (i, a, False) \\<leadsto>\\<^sub>S S'\\<close> \\<open>state_wellFormed S\\<close> completeness_1 by blast\n\n  have \"\\<not>invariant_all S' \\<or> a = ALocal False\"\n    using \\<open>S ~~ (i, a, False) \\<leadsto>\\<^sub>S S'\\<close> false_step_invarariant_false by blast\n\n  thus False\n  proof\n    assume \"\\<not>invariant_all S'\"\n\n    hence \"S' ~~ (i, AInvcheck False) \\<leadsto> S'\" \n      by (auto simp add: step.simps)\n\n    with `initialState program ~~ tr \\<leadsto>* S'`\n    have \"initialState program ~~ tr@[(i, AInvcheck False)] \\<leadsto>* S'\"\n      using steps_step by blast\n\n    have \"\\<not>traceCorrect (tr@[(i, AInvcheck False)])\"\n      by (simp add: actionCorrect_def traceCorrect_def)\n\n    with `programCorrect program` and `initialState program ~~ tr@[(i, AInvcheck False)] \\<leadsto>* S'`\n    show False\n      by (auto simp add: programCorrect_def traces_def)\n  next \n    assume \"a = ALocal False\"\n\n    hence \"\\<not>traceCorrect tr\"\n      using \\<open>(i, a) \\<in> set tr\\<close> actionCorrect_def traceCorrect_def by fastforce\n\n    with `programCorrect program` and `initialState program ~~ tr \\<leadsto>* S'`\n    show False\n      by (auto simp add: programCorrect_def traces_def)\n  qed\nqed\n\ntheorem complete_and_sound:\n  assumes inv_init: \"invariant_all (initialState program)\"\n  shows \"programCorrect_s program \\<longleftrightarrow> programCorrect program\"\n  using show_correctness_via_single_session completeness inv_init by blast\n\n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/completeness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6548947290421276, "lm_q2_score": 0.4610167793123159, "lm_q1q2_score": 0.30191745877161347}}
{"text": "theory ReduceSetOwn\n  imports SubstDropEnv ReduceProper\nbegin\n  \n    (* ##### defines a properly formed memory *)\n  \nfun mem_ty where\n  \"mem_ty (ArrayTy tau) = unlim tau\"\n| \"mem_ty (ChanTy tau c_end) = True\"\n| \"mem_ty tau = False\"\n    \ndefinition mem_val_env where\n  \"mem_val_env env = (\\<forall> x. case env x of\n    None \\<Rightarrow> True\n    | Some tau \\<Rightarrow> mem_ty tau\n  )\"      \n  \n    (*\n      ##### preliminary definitions for defining how permission environments change after ownership rewriting\n     *)\n  \n    (* defines the set of ownership annotation vars in an expression *)\n  \nfun ann_vars where\n  \"ann_vars (ConstExp c) = {}\"\n| \"ann_vars (OpExp xop) = {}\"\n| \"ann_vars (VarExp (VarType x)) = {}\"\n| \"ann_vars (VarExp (LocType x y)) = {y}\"\n| \"ann_vars (PairExp e1 e2) = (ann_vars e1 \\<union> ann_vars e2)\"    \n| \"ann_vars (IfExp e1 e2 e3) = (ann_vars e1 \\<union> ann_vars e2 \\<union> ann_vars e3)\"  \n| \"ann_vars (LamExp x e) = (ann_vars e)\"  \n| \"ann_vars (AppExp e1 e2) = (ann_vars e1 \\<union> ann_vars e2)\"   \n  \ndefinition not_ann_var where\n  \"not_ann_var x e = (x \\<notin> ann_vars e)\"  \n  \nlemma ann_res_vars: \"\\<lbrakk> Loc x \\<in> res_vars e \\<rbrakk> \\<Longrightarrow> x \\<in> ann_vars e\"  \n  apply (induct e)\n        apply (auto)\n  apply (case_tac xa)\n   apply (auto)\n  done\n  \n    (* semi-weakness: defines weakness over a set of variables *)\n  \ndefinition semi_weak_use_env where\n  \"semi_weak_use_env r_s r_set = (\\<forall> x. x \\<in> r_set \\<longrightarrow> r_s (Loc x) \\<noteq> OwnPerm)\"\n\nlemma sw_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s; semi_weak_use_env r_s r_set \\<rbrakk> \\<Longrightarrow> semi_weak_use_env r_x r_set\"  \n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_s (Loc x)\")\n    apply (auto)\n  done      \n\nlemma sw_add_use_env: \"\\<lbrakk> semi_weak_use_env r_s r_set; x \\<notin> r_set \\<rbrakk> \\<Longrightarrow> semi_weak_use_env (add_use_env r_s (Loc x) r) r_set\"    \n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: add_use_env_def)\n  done\n  \nlemma sw_add_use_env2: \"\\<lbrakk> semi_weak_use_env r_s r_set \\<rbrakk> \\<Longrightarrow> semi_weak_use_env (add_use_env r_s (Var x) r) r_set\"    \n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: add_use_env_def)\n  done\n    \nlemma rhs_sw_leq_use_none: \"\\<lbrakk> leq_use_env (diff_use_env r_x r_ex) r_s; r_s (Loc x) = NoPerm; semi_weak_use_env r_ex r_set; x \\<in> r_set  \\<rbrakk> \\<Longrightarrow> r_x (Loc x) = NoPerm\"    \n  apply (simp add: leq_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_ex (Loc x)\")\n    apply (auto)\n   apply (case_tac \"r_x (Loc x)\")\n     apply (auto)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  done \n    \nlemma semi_weak_drop_use_env: \"semi_weak_use_env (drop_use_env r_s) r_set\"    \n  apply (simp add: semi_weak_use_env_def)\n  apply (auto)\n  apply (simp add: drop_use_env_def)\n  apply (case_tac \"r_s (Loc x)\")\n    apply (auto)\n  done    \n    \n    (* pwrite_use_env: pwrite(P, S, x) =\n        if (exists z \\<in> S and z \\<in> P) P + {x: use}\n        else P\n      (x is only written if one of the vars from S is in P)\n    *)\n    \ndefinition set_use_none :: \"perm_use_env \\<Rightarrow> string set \\<Rightarrow> bool\" where\n  \"set_use_none r_s r_set = (\\<forall> x. x \\<in> r_set \\<longrightarrow> r_s (Loc x) = NoPerm)\"\n    \ndefinition pwrite_use_env :: \"perm_use_env \\<Rightarrow> string set \\<Rightarrow> string \\<Rightarrow> perm_use_env\" where\n  \"pwrite_use_env r_s r_set x = (if set_use_none r_s r_set then r_s else add_use_env r_s (Loc x) UsePerm)\"\n    \nlemma leq_set_use_none: \"\\<lbrakk> leq_use_env r_x r_s; set_use_none r_s s \\<rbrakk> \\<Longrightarrow> set_use_none r_x s\"  \n  apply (simp add: set_use_none_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"x\" in allE)\n  apply (erule_tac x=\"Loc x\" in allE)\n  apply (auto)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  done    \n    \nlemma dist_pwrite_leq_use_env: \"\\<lbrakk> semi_weak_use_env r_s r_set; x \\<in> r_set; leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (pwrite_use_env r_x r_set x) (pwrite_use_env r_s r_set x)\"\n  apply (case_tac \"set_use_none r_s r_set\")\n   apply (cut_tac r_x=\"r_x\" and r_s=\"r_s\" and s=\"r_set\" in leq_set_use_none)\n     apply (auto)\n   apply (simp add: pwrite_use_env_def)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (simp)\n   apply (cut_tac r_x=\"r_x\" and r_s=\"r_s\" and x=\"Loc x\" in leq_use_no_own)\n     apply (simp add: semi_weak_use_env_def)\n    apply (auto)\n   apply (case_tac \"r_x (Loc x)\")\n     apply (auto)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)\n  done\n \nlemma rem_pwrite_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (rem_use_env r_x (Loc x)) (pwrite_use_env r_s r_set x)\"       \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (rule_tac rem_leq_use_env)\n   apply (simp)\n  apply (rule_tac rhs_add_leq_use_env)\n   apply (rule_tac rem_leq_use_env)\n   apply (simp)\n  apply (simp add: rem_use_env_def)\n  done\n  \nlemma pwrite_leq_use_env: \"\\<lbrakk> semi_weak_use_env r_s r_set; x \\<in> r_set; leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env r_x (pwrite_use_env r_s r_set x)\"    \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n  apply (rule_tac rhs_add_leq_use_env)\n   apply (simp)\n  apply (cut_tac r_x=\"r_x\" and r_s=\"r_s\" and x=\"Loc x\" in leq_use_no_own)\n    apply (simp add: semi_weak_use_env_def)\n   apply (auto)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  done\n \nlemma add_pwrite_leq_use_env: \"\\<lbrakk> semi_weak_use_env r_x r_set; x \\<in> r_set; leq_use_env (add_use_env r_x (Loc x) UsePerm) r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (pwrite_use_env r_x r_set x) r_s\"      \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n  apply (rule_tac r_sb=\"add_use_env r_x (Loc x) UsePerm\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac rhs_add_leq_use_env)\n   apply (rule_tac id_leq_use_env)\n  apply (simp add: semi_weak_use_env_def)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  done    \n    \nlemma lift_pwrite_leq_use_env: \"\\<lbrakk> semi_weak_use_env r_s r_set; x \\<in> r_set; leq_use_env (lift_use_env r_x r) r_s \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (lift_use_env (pwrite_use_env r_x r_set x) r) (add_use_env r_s (Loc x) UsePerm)\"    \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (simp)\n   apply (cut_tac r_x=\"lift_use_env r_x r\" and r_s=\"r_s\" in sw_leq_use_env)\n     apply (auto)\n   apply (simp add: semi_weak_use_env_def)\n   apply (case_tac \"lift_use_env r_x r (Loc x)\")\n     apply (auto)\n  apply (simp add: set_use_none_def)\n  apply (auto)\n  apply (case_tac \"r = OwnPerm\")\n   apply (case_tac \"r_s (Loc xa) \\<noteq> OwnPerm\")\n    apply (simp add: leq_use_env_def)\n    apply (erule_tac x=\"Loc xa\" in allE)\n    apply (auto)\n    apply (case_tac \"r_s (Loc xa)\")\n      apply (auto)\n   apply (simp add: semi_weak_use_env_def)\n  apply (case_tac \"lift_use_env r_x r \\<noteq> r_x\")\n   apply (case_tac r)\n     apply (auto)\n  apply (case_tac \"lift_use_env (add_use_env r_x (Loc x) UsePerm) r \\<noteq> add_use_env r_x (Loc x) UsePerm\")\n   apply (case_tac r)\n     apply (auto)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)\n  done    \n    \nlemma rhs_pwrite_diff_leq_use_env: \"\\<lbrakk> leq_use_env r_x r_s \\<rbrakk> \\<Longrightarrow> leq_use_env (diff_use_env r_x r_ex) (diff_use_env r_s (pwrite_use_env r_ex r_set x))\"    \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (simp)\n  apply (simp add: leq_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (auto)\n   apply (erule_tac x=\"Loc x\" in allE)\n   apply (simp add: set_use_none_def)\n   apply (case_tac \"r_ex (Loc x)\")\n     apply (auto)\n  apply (erule_tac x=\"xa\" in allE)\n  apply (simp add: set_use_none_def)\n  apply (case_tac \"r_ex xa\")\n    apply (auto)\n  done    \n    \nlemma disj_add_use_env_sw: \"\\<lbrakk> disj_use_env r_x r_s; semi_weak_use_env r_s r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow> disj_use_env (add_use_env r_x (Loc x) UsePerm) r_s\"    \n  apply (simp add: disj_use_env_def)\n  apply (simp add: mini_disj_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (auto)\n  apply (simp add: semi_weak_use_env_def)\n  done    \n    \nlemma disj_pwrite_use_env: \"\\<lbrakk> semi_weak_use_env r_x r_set; semi_weak_use_env r_s r_set; x \\<in> r_set; disj_use_env r_x r_s \\<rbrakk> \\<Longrightarrow>\n  disj_use_env (pwrite_use_env r_x r_set x) (pwrite_use_env r_s r_set x)\"   \n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n    apply (rule_tac comm_disj_use_env)\n    apply (rule_tac disj_add_use_env_sw)\n    apply (rule_tac comm_disj_use_env)\n     apply (auto)\n   apply (rule_tac disj_add_use_env_sw)\n    apply (auto)\n  apply (rule_tac disj_add_use_env_sw)\n   apply (rule_tac comm_disj_use_env)\n   apply (rule_tac disj_add_use_env_sw)\n    apply (rule_tac comm_disj_use_env)\n    apply (auto)\n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: add_use_env_def)\n  done\n  \nlemma disj_lift_pwrite_use_env: \"\\<lbrakk> disj_use_env (lift_use_env r_x r) (lift_use_env r_s r);\n  leq_use_env (lift_use_env r_x r) r_c; leq_use_env (lift_use_env r_s r) r_c; semi_weak_use_env r_c r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow>\n  disj_use_env (lift_use_env (pwrite_use_env r_x r_set x) r) (lift_use_env (pwrite_use_env r_s r_set x) r)\"    \n  apply (case_tac \"\\<not> is_own r\")\n   apply (simp add: is_own_def)\n    apply (case_tac r)\n      apply (auto)\n    apply (rule_tac disj_pwrite_use_env)\n       apply (auto)\n     apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n      apply (auto)\n    apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n     apply (auto)\n   apply (rule_tac disj_pwrite_use_env)\n     apply (auto)\n    apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n     apply (auto)\n   apply (rule_tac r_s=\"r_c\" in sw_leq_use_env)\n    apply (auto)\n  apply (case_tac \"\\<not> set_use_none r_x r_set\")\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (simp add: leq_use_env_def)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (simp add: is_own_def)\n   apply (simp add: semi_weak_use_env_def)\n   apply (case_tac \"r_c (Loc xa)\")\n     apply (auto)\n    (* if r_s uses x in r_set, r_c x = Own, a contradiction by semi-weakness *)\n  apply (case_tac \"\\<not> set_use_none r_s r_set\")\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (simp add: leq_use_env_def)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (erule_tac x=\"Loc xa\" in allE)\n   apply (simp add: semi_weak_use_env_def)\n   apply (simp add: is_own_def)\n   apply (case_tac \"r_c (Loc xa)\")\n     apply (auto)\n  apply (simp add: pwrite_use_env_def)\n  done    \n\n    (* - pwrite equality lemmas *)\n    \nlemma lift_pwrite_use_env: \"\\<lbrakk> semi_weak_use_env (lift_use_env r_s r) r_set \\<rbrakk> \\<Longrightarrow>\n  pwrite_use_env (lift_use_env r_s r) r_set x = lift_use_env (pwrite_use_env r_s r_set x) r\"\n  apply (case_tac \"is_own r\")\n   apply (case_tac \"\\<not> set_use_none r_s r_set\")\n    apply (simp add: set_use_none_def)\n    apply (auto)\n    apply (simp add: semi_weak_use_env_def)\n    apply (simp add: is_own_def)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (auto)\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (simp add: is_own_def)\n  apply (simp add: is_own_def)\n  apply (case_tac r)\n    apply (auto)\n  done\n    \nlemma pwc_add_use_env1: \"\\<lbrakk> semi_weak_use_env r_x r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow> comp_use_env r_x (add_use_env r_s (Loc x) UsePerm) = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm\"    \n  apply (case_tac \"\\<forall> y. comp_use_env r_x (add_use_env r_s (Loc x) UsePerm) y = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm y\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (case_tac \"Loc x = y\")\n   apply (auto)\n  apply (case_tac \"r_x (Loc x)\")\n    apply (auto)\n  done\n\nlemma pwc_add_use_env2: \"\\<lbrakk> semi_weak_use_env r_s r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow> comp_use_env (add_use_env r_x (Loc x) UsePerm) r_s = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm\"    \n  apply (case_tac \"\\<forall> y. comp_use_env (add_use_env r_x (Loc x) UsePerm) r_s y = add_use_env (comp_use_env r_x r_s) (Loc x) UsePerm y\")\n   apply (auto)\n  apply (simp add: comp_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (case_tac \"Loc x = y\")\n   apply (auto)\n  apply (case_tac \"r_s (Loc x)\")\n    apply (auto)\n  done    \n  \nlemma pwrite_comp_use_env: \"\\<lbrakk> semi_weak_use_env r_x r_set; semi_weak_use_env r_s r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow>\n  comp_use_env (pwrite_use_env r_x r_set x) (pwrite_use_env r_s r_set x) = pwrite_use_env (comp_use_env r_x r_s) r_set x\"\n  apply (case_tac \"set_use_none r_x r_set\")\n   apply (case_tac \"set_use_none r_s r_set\")\n    apply (simp add: pwrite_use_env_def)\n    apply (auto)\n    apply (simp add: set_use_none_def)\n    apply (simp add: comp_use_env_def)\n    apply (auto)\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n    apply (simp add: set_use_none_def)\n    apply (simp add: comp_use_env_def)\n    apply (auto)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (auto)\n    apply (case_tac \"r_s (Loc xa)\")\n      apply (auto)\n   apply (rule_tac pwc_add_use_env1)\n   apply (auto)\n  apply (case_tac \"set_use_none r_s r_set\")\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n    apply (simp add: set_use_none_def)\n    apply (simp add: comp_use_env_def)\n    apply (auto)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (erule_tac x=\"xa\" in allE)\n    apply (auto)\n    apply (case_tac \"r_x (Loc xa)\")\n      apply (auto)\n   apply (rule_tac pwc_add_use_env2)\n   apply (auto)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (simp add: set_use_none_def)\n   apply (simp add: comp_use_env_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (auto) \n   apply (case_tac \"r_x (Loc xa)\")\n     apply (auto)\n   apply (case_tac \"r_s (Loc xa)\")\n     apply (auto)\n  apply (rule_tac dist_add_comp_use_env)\n  done    \n  \nlemma diff_pwrite_rem_use_env: \"\\<lbrakk> semi_weak_use_env r_x r_set; x \\<in> r_set \\<rbrakk> \\<Longrightarrow>\n  diff_use_env (pwrite_use_env r_s r_set x) (rem_use_env r_x (Loc x)) = pwrite_use_env (diff_use_env r_s r_x) r_set x\"    \n  apply (case_tac \"set_use_none r_s r_set\")\n   apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (simp add: set_use_none_def)\n    apply (case_tac \"\\<forall> y. diff_use_env r_s (rem_use_env r_x (Loc x)) y = diff_use_env r_s r_x y\")\n     apply (auto)\n    apply (simp add: diff_use_env_def)\n    apply (simp add: rem_use_env_def)\n    apply (case_tac \"Loc x = y\")\n     apply (auto)\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (auto)\n   apply (cut_tac r_x=\"diff_use_env r_s r_x\" and r_s=\"r_s\" and x=\"Loc xa\" in leq_use_none)\n     apply (auto)\n   apply (rule_tac self_diff_leq_use_env)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (erule_tac x=\"xa\" in allE)\n   apply (auto)\n   apply (case_tac \"r_x (Loc xa) \\<noteq> OwnPerm\")\n    apply (simp add: diff_use_env_def)\n    apply (case_tac \"r_x (Loc xa)\")\n      apply (auto)\n   apply (simp add: semi_weak_use_env_def)\n  apply (simp add: semi_weak_use_env_def)\n  apply (simp add: diff_add_rem_use_env)\n  done    \n    \n    (* #### actual ownership rewriting algorithm *)\n  \nfun set_own where\n  \"set_own (ConstExp c) b = ConstExp c\"\n| \"set_own (OpExp xop) b = OpExp xop\"\n| \"set_own (VarExp v) b = (case v of\n    VarType x \\<Rightarrow> VarExp v\n    | LocType x y \\<Rightarrow> VarExp (LocType x b))\"\n| \"set_own (PairExp e1 e2) b = (PairExp (set_own e1 b) (set_own e2 b))\"\n| \"set_own (IfExp e1 e2 e3) b = (IfExp (set_own e1 b) (set_own e2 b) (set_own e3 b))\"\n| \"set_own (LamExp x e) b = (LamExp x (set_own e b))\"  \n| \"set_own (AppExp e1 e2) b = (AppExp (set_own e1 b) (set_own e2 b))\"\n  \nlemma well_typed_set_own_ann_vars: \"\\<lbrakk> well_typed env r_s1 (set_own e b) tau r_s2 rx; x \\<noteq> b \\<rbrakk> \\<Longrightarrow> x \\<notin> ann_vars (set_own e b)\"  \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* var case *)\n          apply (case_tac xa)\n           apply (auto)\n    (* other cases *)\n         apply (iprover)\n        apply (iprover)\n       apply (iprover)\n      apply (iprover)\n     apply (iprover)\n    apply (iprover)\n   apply (iprover)\n  apply (iprover)\n  done\n    \nlemma well_typed_set_own_none: \"\\<lbrakk> ann_vars e = {}; well_typed env r_s1 e tau r_s2 rx \\<rbrakk> \\<Longrightarrow>\n   well_typed env r_s1 (set_own e b) tau r_s2 rx\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)  \n        apply (auto)\n    (* var case *)\n      apply (case_tac x)\n       apply (auto)\n    (* pair case *)\n     apply (rule_tac x=\"r_s2a\" in exI)\n     apply (rule_tac x=\"r_s3\" in exI)\n     apply (rule_tac x=\"rx1\" in exI)\n     apply (auto)\n     apply (rule_tac x=\"rx2\" in exI)\n     apply (auto)\n    (* if case *)\n    apply (rule_tac x=\"rx'\" in exI)\n    apply (rule_tac x=\"r_s2a\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx1\" in exI)\n    apply (auto)\n    apply (rule_tac x=\"rx2\" in exI)\n    apply (auto)\n    (* lam case *)\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n   apply (rule_tac x=\"r_end\" in exI)\n   apply (rule_tac x=\"r_s'\" in exI)\n   apply (auto)\n    (* app case *)\n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"r_s2a\" in exI)\n  apply (rule_tac x=\"rx1\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"rx2\" in exI)\n  apply (rule_tac x=\"r_s3\" in exI)\n  apply (auto)\n  done  \n \nlemma well_typed_no_av_use: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx; r_s1 (Loc x) = NoPerm \\<rbrakk> \\<Longrightarrow> not_ann_var x e\"    \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const + op cases *)\n        apply (simp add: not_ann_var_def)\n       apply (simp add: not_ann_var_def)\n    (* var case *)\n      apply (simp add: not_ann_var_def)\n      apply (auto)\n      apply (simp add: leq_use_env_def)\n      apply (simp add: ereq_use_env_def)\n      apply (simp add: one_use_env_def)\n      apply (erule_tac x=\"Loc x\" in allE)\n      apply (case_tac xa)\n       apply (auto)\n      apply (simp add: end_req_perm_def)\n    (* pair case *)\n     apply (simp add: not_ann_var_def)\n     apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"Loc x\" in leq_use_none)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n    (* if case *)\n    apply (simp add: not_ann_var_def)\n    apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"Loc x\" in leq_use_none)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    (* lam case *)\n   apply (simp add: not_ann_var_def)\n   apply (cut_tac r_x=\"rxa\" and r_s=\"r_s1\" and x=\"Loc x\" in leq_use_none)\n     apply (auto)\n   apply (case_tac \"\\<not> add_use_env rxa (Var x1a) r (Loc x) = NoPerm\")\n    apply (simp add: add_use_env_def)\n   apply (auto)\n   apply (iprover)\n    (* app case *)\n  apply (simp add: not_ann_var_def)\n  apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and x=\"Loc x\" in leq_use_none)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  done    \n    \nlemma water_var_case: \"\\<lbrakk>ann_vars (VarExp x) \\<subseteq> r_set; semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t; env (res_name x) = Some tau;\n        env (owner_name x) = Some tau_x; value_req x tau tau_x; leq_use_env (ereq_use_env (owner_name x) tau_x) r_s1;\n        leq_use_env r_s2 (diff_use_env r_s1 (comp_use_env (ereq_use_env (owner_name x) tau_x) r_ex)); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n        leq_use_env (diff_use_env (ereq_use_env (owner_name x) tau_x) (comp_use_env (ereq_use_env (owner_name x) tau_x) r_ex)) rx\\<rbrakk>\n       \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (case x of VarType xa \\<Rightarrow> VarExp x | LocType x y \\<Rightarrow> VarExp (LocType x b)) tau\n            (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b)\"\n    (* var case. non-value *)\n       (*apply (simp add: not_free_var_def)*)\n  apply (case_tac x)\n   apply (auto)\n      apply (rule_tac rhs_add_leq_use_env)\n       apply (auto)\n      apply (simp add: ereq_use_env_def)\n      apply (simp add: one_use_env_def)\n     apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n     apply (auto)\n        apply (rule_tac r_sb=\"diff_use_env (add_use_env r_s1 (Loc b) UsePerm) (rem_use_env (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex) (Loc b))\" in trans_leq_use_env)\n         apply (simp add: dist_rem_comp_use_env)\n         apply (rule_tac unroll_dcl_use_env)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (rule_tac rhs_diff_rem_leq_use_env2)\n          apply (simp add: ereq_use_env_def)\n          apply (simp add: one_use_env_def)\n         apply (rule_tac id_leq_use_env)\n        apply (rule_tac t=\"diff_use_env (add_use_env r_s1 (Loc b) UsePerm) (rem_use_env (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex) (Loc b))\"\n           and s=\"add_use_env (diff_use_env r_s1 (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)) (Loc b) UsePerm\" in subst)\n         apply (rule_tac diff_add_rem_use_env)\n        apply (rule_tac dist_add_leq_use_env)\n        apply (simp)\n       apply (rule_tac add_pwrite_leq_use_env)\n         apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n          apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)\" in trans_leq_use_env)\n           apply (rule_tac self_diff_leq_use_env)\n          apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n           apply (auto)\n       apply (rule_tac dist_add_leq_use_env)\n       apply (simp)\n      apply (rule_tac rhs_add_leq_use_env)\n       apply (rule_tac rem_leq_use_env)\n       apply (simp)\n      apply (simp add: rem_use_env_def)\n     apply (rule_tac r_sb=\"diff_use_env (ereq_use_env (Var x1) tau_x) (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac pwrite_leq_use_env)\n        apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n         apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Var x1) tau_x) r_ex)\" in trans_leq_use_env)\n          apply (rule_tac self_diff_leq_use_env)\n         apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n          apply (auto)\n     apply (rule_tac unroll_dcl_use_env)\n     apply (rule_tac rhs_diff_rem_leq_use_env2)\n      apply (cut_tac r_x=\"r_ex\" and r_s=\"r_s1\" in sw_leq_use_env)\n        apply (simp)\n       apply (auto)\n      apply (simp add: semi_weak_use_env_def)\n     apply (rule_tac id_leq_use_env)\n    apply (case_tac t)\n          apply (auto)\n   apply (rule_tac ereq_leq_use_envx)\n   apply (simp add: end_req_perm_def)\n   apply (simp add: add_use_env_def)\n   apply (case_tac t)\n         apply (auto)\n    (* var case. value cases *)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n     apply (rule_tac rhs_flip_use_env)\n     apply (rule_tac rhs_unroll_dcl_use_env)\n     apply (rule_tac rhs_weak_leq_use_env)\n      apply (rule_tac weak_ereq_use_env)\n      apply (simp add: unlim_def)\n      apply (case_tac t)\n            apply (auto)\n     apply (rule_tac t=\"diff_use_env (add_use_env r_s1 (Loc b) UsePerm) (rem_use_env r_ex (Loc b))\" and s=\"add_use_env (diff_use_env r_s1 r_ex) (Loc b) UsePerm\" in subst)\n      apply (rule_tac diff_add_rem_use_env)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Loc x22) tau_x) r_ex)\" in trans_leq_use_env)\n      apply (rule_tac dist_diff_leq_use_env_gen)\n       apply (rule_tac id_leq_use_env)\n      apply (rule_tac self_comp_leq_use_env2)\n     apply (simp)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s1 (comp_use_env (ereq_use_env (Loc x22) tau_x) r_ex)\" in trans_leq_use_env)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (simp)\n   apply (simp add: rem_use_env_def)\n    (* - req bound manipulation *)\n  apply (simp add: pwrite_use_env_def)\n  apply (auto)\n    (* - say that we do not add a perm to rx. this means x1a is not in rx, which is impossible since r_s1 is weak *)\n   apply (case_tac \"rx (Loc x22) \\<noteq> NoPerm\")\n    apply (simp add: set_use_none_def)\n   apply (case_tac \"ereq_use_env (Loc x22) tau_x (Loc x22) \\<noteq> UsePerm\")\n    apply (simp add: ereq_use_env_def)\n    apply (simp add: one_use_env_def)\n    apply (simp add: end_req_perm_def)\n   apply (case_tac \"comp_use_env (ereq_use_env (Loc x22) tau_x) r_ex (Loc x22) \\<noteq> OwnPerm\")\n    apply (cut_tac r_x=\"ereq_use_env (Loc x22) tau_x\" and r_s=\"rx\" and r_ex=\"comp_use_env (ereq_use_env (Loc x22) tau_x) r_ex\" and x=\"Loc x22\" in diff_use_leq)\n      apply (auto)\n   apply (cut_tac r_x=\"comp_use_env (ereq_use_env (Loc x22) tau_x) r_ex\" and r_s=\"r_s1\" and x=\"Loc x22\" in leq_use_own)\n     apply (simp)\n    apply (rule_tac dist_comp_leq_use_env)\n     apply (auto)\n   apply (simp add: semi_weak_use_env_def)\n    (* - otherwise we know what x is *)\n  apply (rule_tac diff_leq_use_env)\n  apply (rule_tac ereq_leq_use_envx)\n  apply (simp add: add_use_env_def)\n  apply (simp add: end_req_perm_def)\n  apply (case_tac t)\n        apply (auto)\n  done  \n  \nlemma water_pair_case: \"\\<lbrakk>\\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e1 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e2 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e2 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t; ann_vars e1 \\<subseteq> r_set; ann_vars e2 \\<subseteq> r_set; well_typed env r_s1 e1 t1 r_s2a rx1;\n        well_typed env r_s2a e2 t2 r_s3 rx2; leq_use_env (lift_use_env rx1 r) r_s3; leq_use_env (lift_use_env rx2 r) r_s3;\n        aff_leq (max_aff (req_type t1) (req_type t2)) r; disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r); leq_use_env r_s2 (diff_use_env r_s3 r_ex);\n        leq_use_env rx r_s2; leq_use_env r_ex r_s1; leq_use_env (pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex (PairTy t1 t2 r)) rx\\<rbrakk>\n       \\<Longrightarrow> \\<exists>r_s2a r_s3 rx1.\n              well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) t1 r_s2a rx1 \\<and>\n              (\\<exists>rx2. well_typed env r_s2a (set_own e2 b) t2 r_s3 rx2 \\<and>\n                     leq_use_env (lift_use_env rx1 r) r_s3 \\<and>\n                     leq_use_env (lift_use_env rx2 r) r_s3 \\<and>\n                     disj_use_env (lift_use_env rx1 r) (lift_use_env rx2 r) \\<and>\n                     (\\<exists>r_ex. leq_use_env (add_use_env r_s2 (Loc b) UsePerm) (diff_use_env r_s3 r_ex) \\<and>\n                             leq_use_env (pwrite_use_env rx r_set b) (add_use_env r_s2 (Loc b) UsePerm) \\<and>\n                             leq_use_env r_ex (add_use_env r_s1 (Loc b) UsePerm) \\<and>\n                             leq_use_env (pair_req (comp_use_env (lift_use_env rx1 r) (lift_use_env rx2 r)) r_ex (PairTy t1 t2 r)) (pwrite_use_env rx r_set b)))\"    \n  apply (rule_tac x=\"add_use_env r_s2a (Loc b) UsePerm\" in exI)\n  apply (rule_tac x=\"add_use_env r_s3 (Loc b) UsePerm\" in exI)\n  apply (rule_tac x=\"pwrite_use_env rx1 r_set b\" in exI)\n  apply (auto)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (cut_tac r_x=\"lift_use_env rx1 r\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx2 r_set b\" in exI)\n  apply (auto)\n      apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in sw_leq_use_env)\n        apply (rule_tac well_typed_perm_leq)\n        apply (auto)\n     apply (rule_tac lift_pwrite_leq_use_env)\n       apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n        apply (auto)\n    apply (rule_tac lift_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (auto)\n   apply (rule_tac r_c=\"r_s1\" in disj_lift_pwrite_use_env)\n       apply (auto)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n   apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n    apply (auto)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n     apply (rule_tac t=\"diff_use_env (add_use_env r_s3 (Loc b) UsePerm) (rem_use_env r_ex (Loc b))\"\n          and s=\"add_use_env (diff_use_env r_s3 r_ex) (Loc b) UsePerm\" in subst)\n      apply (rule_tac diff_add_rem_use_env)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n        apply (rule_tac diff_leq_use_env)\n        apply (simp)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (auto)\n   apply (simp add: rem_use_env_def)\n  apply (case_tac \"req_type (PairTy t1 t2 r) = Prim\")\n   apply (simp add: pair_req_def)\n   apply (rule_tac leq_empty_use_env)\n  apply (simp add: pair_req_def)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx1 r_set b) r\" and s=\"pwrite_use_env (lift_use_env rx1 r) r_set b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx2 r_set b) r\" and s=\"pwrite_use_env (lift_use_env rx2 r) r_set b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n     apply (auto)\n  apply (simp add: pwrite_comp_use_env)\n  apply (cut_tac r_x=\"r_ex\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (auto)\n  apply (simp add: diff_pwrite_rem_use_env)\n  apply (rule_tac dist_pwrite_leq_use_env)\n    apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac r_sb=\"diff_use_env r_s3 r_ex\" in trans_leq_use_env)\n      apply (rule_tac diff_leq_use_env)\n      apply (simp)\n     apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n      apply (auto)\n  done\n\nlemma water_if_case: \"\\<lbrakk>\\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e1 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e2 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e2 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e3 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e3 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t; ann_vars e1 \\<subseteq> r_set; well_typed env r_s1 e1 BoolTy r_s2a rx';\n        ann_vars e2 \\<subseteq> r_set; ann_vars e3 \\<subseteq> r_set; well_typed env r_s2a e2 tau r_s2 rx1; well_typed env r_s2a e3 tau r_s2 rx2\\<rbrakk>\n       \\<Longrightarrow> \\<exists>rx' r_s2a.\n              well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) BoolTy r_s2a rx' \\<and>\n              (\\<exists>rx1a. well_typed env r_s2a (set_own e2 b) tau (add_use_env r_s2 (Loc b) UsePerm) rx1a \\<and>\n                      (\\<exists>rx2a. well_typed env r_s2a (set_own e3 b) tau (add_use_env r_s2 (Loc b) UsePerm) rx2a \\<and>\n                              pwrite_use_env (comp_use_env rx1 rx2) r_set b = comp_use_env rx1a rx2a))\"    \n  apply (rule_tac x=\"pwrite_use_env rx' r_set b\" in exI)\n  apply (rule_tac x=\"add_use_env r_s2a (Loc b) UsePerm\" in exI)\n  apply (auto)\n  apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" and r_set=\"r_set\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx1 r_set b\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx2 r_set b\" in exI)\n  apply (auto)\n  apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s2a\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (cut_tac r_x=\"rx1\" and r_s=\"r_s2\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leqx)\n    apply (auto)\n  apply (cut_tac r_x=\"rx2\" and r_s=\"r_s2\" in sw_leq_use_env)\n    apply (rule_tac well_typed_perm_leqx)\n    apply (auto)\n  apply (simp add: pwrite_comp_use_env)\n  done    \n    \nlemma wtae_end_leq_use_env2: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s r_ex) \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (add_use_env r_x x UsePerm) (diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_ex x))\"  \n  apply (rule_tac t=\"diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_ex x)\"\n      and s=\"add_use_env (diff_use_env r_s r_ex) x UsePerm\" in subst)\n   apply (rule_tac diff_add_rem_use_env)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)  \n  done    \n    \nlemma water_lam_case: \"\\<lbrakk>\\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        ann_vars e \\<subseteq> r_set; semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t;\n        well_typed (add_env env (Var x1a) t1) (add_use_env rxa (Var x1a) r) e t2 r_s' r_end; aff_use_env rxa a; leq_use_env rxa r_s1;\n        leq_use_env r_s2 (diff_use_env r_s1 r_ex); leq_use_env rx r_s2; leq_use_env r_ex r_s1; leq_use_env (diff_use_env rxa r_ex) rx\\<rbrakk>\n       \\<Longrightarrow> \\<exists>rxa. (\\<exists>r_end r_s'. well_typed (add_env env (Var x1a) t1) (add_use_env rxa (Var x1a) r) (set_own e b) t2 r_s' r_end) \\<and>\n                 aff_use_env rxa a \\<and>\n                 leq_use_env rxa (add_use_env r_s1 (Loc b) UsePerm) \\<and>\n                 (\\<exists>r_ex. leq_use_env (add_use_env r_s2 (Loc b) UsePerm) (diff_use_env (add_use_env r_s1 (Loc b) UsePerm) r_ex) \\<and>\n                         leq_use_env (pwrite_use_env rx r_set b) (add_use_env r_s2 (Loc b) UsePerm) \\<and>\n                         leq_use_env r_ex (add_use_env r_s1 (Loc b) UsePerm) \\<and> leq_use_env (diff_use_env rxa r_ex) (pwrite_use_env rx r_set b))\"\n    (* lam case. rxa does not contain any members of r_set *)\n  apply (case_tac \"set_use_none rxa r_set\")\n   apply (rule_tac x=\"rxa\" in exI)\n   apply (auto)\n     apply (rule_tac x=\"r_end\" in exI)\n     apply (rule_tac x=\"r_s'\" in exI)\n     apply (rule_tac well_typed_set_own_none)\n      apply (auto)\n     apply (cut_tac env=\"add_env env (Var x1a) t1\" and ?r_s1.0=\"add_use_env rxa (Var x1a) r\" and x=\"x\" and e=\"e\" in well_typed_no_av_use)\n       apply (auto)\n      apply (simp add: add_use_env_def)\n      apply (simp add: set_use_none_def)\n      apply (auto)\n     apply (simp add: not_ann_var_def)\n    apply (rule_tac rhs_add_leq_use_env)\n     apply (simp)\n    apply (simp add: set_use_none_def)\n   apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n   apply (auto)\n      apply (rule_tac wtae_end_leq_use_env2)\n      apply (simp)\n     apply (rule_tac add_pwrite_leq_use_env)\n       apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n        apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n         apply (rule_tac self_diff_leq_use_env)\n        apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n         apply (auto)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    apply (rule_tac rhs_add_leq_use_env)\n     apply (rule_tac rem_leq_use_env)\n     apply (simp)\n    apply (simp add: rem_use_env_def)\n   apply (rule_tac pwrite_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n      apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n       apply (rule_tac self_diff_leq_use_env)\n      apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n       apply (auto)\n   apply (rule_tac r_sb=\"diff_use_env rxa r_ex\" in trans_leq_use_env)\n    apply (simp)\n    apply (rule_tac rhs_diff_rem_leq_use_env)\n    apply (simp add: set_use_none_def)\n   apply (rule_tac id_leq_use_env)  \n    (* lam case. rxa contains at least one member of r_set *)\n    (* - prelim: rxa is not primitive *)\n  apply (case_tac \"a = Prim\")\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (simp add: aff_use_env_def)\n  apply (simp add: null_use_env_def)\n    (* - prelim: rx has at least one value as well *)\n  apply (case_tac \"set_use_none rx r_set\")\n   apply (simp add: set_use_none_def)\n   apply (auto)\n   apply (erule_tac x=\"x\" in allE)\n   apply (cut_tac r_ex=\"r_ex\" and r_x=\"rxa\" and r_s=\"rx\" and x=\"x\" in rhs_sw_leq_use_none)\n       apply (auto)\n   apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n    apply (auto)\n    (* - prelim: x \\<noteq> x1a *)\n  apply (rule_tac x=\"add_use_env rxa (Loc b) UsePerm\" in exI)\n  apply (auto)\n     apply (rule_tac x=\"pwrite_use_env r_end r_set b\" in exI)\n     apply (rule_tac x=\"add_use_env r_s' (Loc b) UsePerm\" in exI)\n     apply (rule_tac t=\"add_use_env (add_use_env rxa (Loc b) UsePerm) (Var x1a) r\" and s=\"add_use_env (add_use_env rxa (Var x1a) r) (Loc b) UsePerm\" in subst)\n      apply (simp add: almost_comm_add_use_env)\n     apply (cut_tac r_s=\"rxa\" and x=\"x1a\" and r=\"r\" and r_set=\"r_set\" in sw_add_use_env2)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (auto)\n     apply (case_tac \"\\<not> add_env env (Var x1a) t1 (Loc b) = Some t\")\n      apply (simp add: add_env_def)\n     apply (auto)\n    apply (simp add: aff_use_env_def)\n    apply (case_tac a)\n      apply (auto)\n    apply (simp add: weak_use_env_def)\n    apply (simp add: add_use_env_def)\n   apply (rule_tac dist_add_leq_use_env)\n   apply (simp)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n     apply (rule_tac t=\"diff_use_env (add_use_env r_s1(Loc b) UsePerm) (rem_use_env r_ex (Loc b))\" and\n        s=\"add_use_env (diff_use_env r_s1 r_ex) (Loc b) UsePerm\" in subst)\n      apply (rule_tac diff_add_rem_use_env)\n     apply (rule_tac dist_add_leq_use_env)\n     apply (simp)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"diff_use_env r_s1 r_ex\" in trans_leq_use_env)\n        apply (rule_tac self_diff_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (simp)\n   apply (simp add: rem_use_env_def)\n  apply (simp add: pwrite_use_env_def)\n  apply (rule_tac t=\"diff_use_env (add_use_env rxa (Loc b) UsePerm) (rem_use_env r_ex (Loc b))\" and\n      s=\"add_use_env (diff_use_env rxa r_ex) (Loc b) UsePerm\" in subst)\n   apply (rule_tac diff_add_rem_use_env)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)\n  done\n    \nlemma wtae_end_leq_use_env1: \"\\<lbrakk> leq_use_env r_x (diff_use_env r_s (comp_use_env r_exa r_exb)); r_exa x \\<noteq> OwnPerm \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (add_use_env r_x x UsePerm) (diff_use_env (add_use_env r_s x UsePerm) (comp_use_env r_exa (rem_use_env r_exb x)))\"    \n  apply (rule_tac r_sb=\"diff_use_env (add_use_env r_s x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\" in trans_leq_use_env)\n   apply (simp add: dist_rem_comp_use_env)\n   apply (rule_tac unroll_dcl_use_env)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (rule_tac rhs_diff_rem_leq_use_env2)\n    apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac t=\"diff_use_env (add_use_env r_s x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\"\n      and s=\"add_use_env (diff_use_env r_s (comp_use_env r_exa r_exb)) x UsePerm\" in subst)\n   apply (rule_tac diff_add_rem_use_env)\n  apply (rule_tac dist_add_leq_use_env)\n  apply (simp)\n  done\n    \nlemma wtae_req_leq_use_env1: \"\\<lbrakk> leq_use_env (diff_use_env r_x (comp_use_env r_exa r_exb)) r_s \\<rbrakk> \\<Longrightarrow>\n  leq_use_env (diff_use_env (add_use_env r_x x UsePerm) (comp_use_env r_exa (rem_use_env r_exb x))) (add_use_env r_s x UsePerm)\"\n  apply (rule_tac r_sb=\"diff_use_env (add_use_env r_x x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\" in trans_leq_use_env)\n   apply (rule_tac t=\"diff_use_env (add_use_env r_x x UsePerm) (rem_use_env (comp_use_env r_exa r_exb) x)\"\n      and s=\"add_use_env (diff_use_env r_x (comp_use_env r_exa r_exb)) x UsePerm\" in subst)\n    apply (rule_tac diff_add_rem_use_env)\n   apply (rule_tac dist_add_leq_use_env)\n   apply (simp)\n  apply (rule_tac dist_diff_leq_use_env_gen)\n   apply (rule_tac id_leq_use_env)\n  apply (simp add: dist_rem_comp_use_env)\n  apply (rule_tac dist_comp_leq_use_env)\n   apply (rule_tac comp_leq_use_env1)\n   apply (rule_tac self_rem_leq_use_env)\n  apply (rule_tac self_comp_leq_use_env2)\n  done\n    \nlemma water_app_case: \"\\<lbrakk>\\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e1 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        \\<And>env r_s1 tau r_s2 rx.\n           \\<lbrakk>well_typed env r_s1 e2 tau r_s2 rx; semi_weak_use_env r_s1 r_set; env (Loc b) = Some t\\<rbrakk>\n           \\<Longrightarrow> well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e2 b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b);\n        semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t; ann_vars e1 \\<subseteq> r_set; ann_vars e2 \\<subseteq> r_set;\n        well_typed env r_s1 e1 (FunTy t1 tau r a) r_s2a rx1; well_typed env r_s2a e2 t1 r_s3 rx2;\n        leq_use_env r_s2 (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex));\n        leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3; disj_use_env rx1 (lift_use_env rx2 r); leq_use_env rx r_s2; leq_use_env r_ex r_s1;\n        leq_use_env (app_req rx1 rx2 r tau r_ex) rx\\<rbrakk>\n       \\<Longrightarrow> \\<exists>t1 r a r_s2a rx1.\n              well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e1 b) (FunTy t1 tau r a) r_s2a rx1 \\<and>\n              (\\<exists>rx2 r_s3. well_typed env r_s2a (set_own e2 b) t1 r_s3 rx2 \\<and>\n                          (\\<exists>r_ex. leq_use_env (add_use_env r_s2 (Loc b) UsePerm) (diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)) \\<and>\n                                  leq_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_s3 \\<and>\n                                  disj_use_env rx1 (lift_use_env rx2 r) \\<and>\n                                  leq_use_env (pwrite_use_env rx r_set b) (add_use_env r_s2 (Loc b) UsePerm) \\<and>\n                                  leq_use_env r_ex (add_use_env r_s1 (Loc b) UsePerm) \\<and> leq_use_env (app_req rx1 rx2 r tau r_ex) (pwrite_use_env rx r_set b)))\"    \n  apply (rule_tac x=\"t1\" in exI)\n  apply (rule_tac x=\"r\" in exI)\n  apply (rule_tac x=\"a\" in exI)\n  apply (rule_tac x=\"add_use_env r_s2a (Loc b) UsePerm\" in exI)\n  apply (rule_tac x=\"pwrite_use_env rx1 r_set b\" in exI)\n  apply (auto)\n  apply (rule_tac x=\"pwrite_use_env rx2 r_set b\" in exI)\n  apply (rule_tac x=\"add_use_env r_s3 (Loc b) UsePerm\" in exI)\n  apply (auto)\n   apply (cut_tac r_x=\"r_s2a\" and r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n  apply (cut_tac r_sc=\"r_s3\" and r_sb=\"r_s2a\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac well_typed_perm_leq)\n    apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (cut_tac r_sc=\"r_s2\" and r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" and r_sa=\"r_s1\" in trans_leq_use_env)\n    apply (rule_tac diff_leq_use_env)\n    apply (auto)\n  apply (cut_tac r_x=\"lift_use_env rx2 r\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n    apply (rule_tac self_comp_leq_use_env2)\n  apply (cut_tac r_x=\"rx1\" and r_s=\"r_s1\" in sw_leq_use_env)\n    apply (rule_tac r_sb=\"comp_use_env rx1 (lift_use_env rx2 r)\" in trans_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n    apply (rule_tac self_comp_leq_use_env1)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx2 r_set b) r\" and s=\"pwrite_use_env (lift_use_env rx2 r) r_set b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (simp)\n  apply (simp add: pwrite_comp_use_env)\n  apply (rule_tac x=\"rem_use_env r_ex (Loc b)\" in exI)\n  apply (auto)\n       apply (rule_tac wtae_end_leq_use_env1)\n        apply (rule_tac r_sb=\"diff_use_env r_s3 (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n         apply (rule_tac unroll_dcl_use_env)\n         apply (rule_tac dist_diff_leq_use_env)\n         apply (rule_tac rhs_pwrite_diff_leq_use_env)\n         apply (rule_tac id_leq_use_env)\n        apply (simp)\n       apply (simp add: pwrite_use_env_def)\n       apply (auto)\n        apply (cut_tac r_x=\"comp_use_env rx1 (lift_use_env rx2 r)\" and r_s=\"r_s1\" and x=\"Loc b\" in leq_use_no_own)\n          apply (simp add: semi_weak_use_env_def)\n         apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n          apply (auto)\n       apply (simp add: add_use_env_def)\n      apply (rule_tac add_pwrite_leq_use_env)\n        apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n         apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n          apply (auto)\n      apply (rule_tac dist_add_leq_use_env)\n      apply (simp)\n     apply (rule_tac disj_pwrite_use_env)\n        apply (auto)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n       apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n        apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (simp)\n   apply (rule_tac rhs_add_leq_use_env)\n    apply (rule_tac rem_leq_use_env)\n    apply (simp)\n   apply (simp add: rem_use_env_def)\n  apply (simp add: app_req_def)\n  apply (auto)\n   apply (rule_tac leq_empty_use_env)\n  apply (rule_tac t=\"lift_use_env (pwrite_use_env rx2 r_set b) r\" and s=\"pwrite_use_env (lift_use_env rx2 r) r_set b\" in subst)\n   apply (rule_tac lift_pwrite_use_env)\n   apply (simp)\n  apply (cut_tac r_x=\"rx2\" and r_s=\"lift_use_env rx2 r\" in sw_leq_use_env)\n    apply (rule_tac self_lift_leq_use_env)\n   apply (simp)\n  apply (simp add: pwrite_comp_use_env)\n  apply (case_tac \"\\<not> set_use_none (comp_use_env rx1 rx2) r_set\")\n   apply (case_tac \"pwrite_use_env (comp_use_env rx1 rx2) r_set b \\<noteq> add_use_env (comp_use_env rx1 rx2) (Loc b) UsePerm\")\n    apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (case_tac \"set_use_none rx r_set\")\n    apply (simp add: set_use_none_def)\n    apply (auto)\n    apply (cut_tac r_x=\"comp_use_env rx1 rx2\" and r_s=\"rx\" and r_ex=\"comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex\" and x=\"x\" in rhs_sw_leq_use_none)\n        apply (auto)\n    apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac dist_comp_leq_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (auto)\n   apply (case_tac \"pwrite_use_env rx r_set b \\<noteq> add_use_env rx (Loc b) UsePerm\")\n    apply (simp add: pwrite_use_env_def)\n   apply (auto)\n   apply (rule_tac wtae_req_leq_use_env1)\n   apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n    apply (simp)\n   apply (rule_tac unroll_dcl_use_env)\n   apply (rule_tac dist_diff_leq_use_env)\n   apply (rule_tac dist_diff_leq_use_env_gen)\n    apply (rule_tac id_leq_use_env)\n   apply (rule_tac pwrite_leq_use_env)\n     apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n      apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n       apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (case_tac \"pwrite_use_env (comp_use_env rx1 rx2) r_set b \\<noteq> comp_use_env rx1 rx2\")\n   apply (simp add: pwrite_use_env_def)\n  apply (auto)\n  apply (rule_tac pwrite_leq_use_env)\n    apply (rule_tac sw_leq_use_env)\n     apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n      apply (auto)\n  apply (rule_tac r_sb=\"diff_use_env (comp_use_env rx1 rx2) (comp_use_env (comp_use_env rx1 (lift_use_env rx2 r)) r_ex)\" in trans_leq_use_env)\n   apply (simp)\n  apply (rule_tac unroll_dcl_use_env)\n  apply (rule_tac rhs_diff_rem_leq_use_env2)\n   apply (rule_tac r_s=\"r_s1\" in leq_use_no_own)\n    apply (simp add: semi_weak_use_env_def)\n   apply (simp)\n  apply (rule_tac dist_diff_leq_use_env)\n  apply (rule_tac dist_diff_leq_use_env_gen)\n   apply (rule_tac id_leq_use_env)\n  apply (rule_tac pwrite_leq_use_env)\n    apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n     apply (rule_tac r_sb=\"r_s3\" in trans_leq_use_env)\n      apply (auto)\n  apply (rule_tac id_leq_use_env) \n  done\n    \nlemma well_typed_set_own_rep: \"\\<lbrakk> well_typed env r_s1 e tau r_s2 rx;\n  ann_vars e \\<subseteq> r_set; semi_weak_use_env r_s1 r_set; b \\<in> r_set; env (Loc b) = Some t; mem_ty t \\<rbrakk> \\<Longrightarrow>\n  well_typed env (add_use_env r_s1 (Loc b) UsePerm) (set_own e b) tau (add_use_env r_s2 (Loc b) UsePerm) (pwrite_use_env rx r_set b)\"      \n  apply (induct e arbitrary: env r_s1 tau r_s2 rx)\n        apply (auto)\n    (* const + op cases *)\n           apply (rule_tac dist_add_leq_use_env)\n            apply (auto)\n          apply (rule_tac add_pwrite_leq_use_env)\n           apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n           apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n            apply (auto)\n          apply (rule_tac dist_add_leq_use_env)\n          apply (auto)\n         apply (rule_tac dist_add_leq_use_env)\n         apply (auto)\n        apply (rule_tac add_pwrite_leq_use_env)\n         apply (rule_tac r_s=\"r_s1\" in sw_leq_use_env)\n           apply (rule_tac r_sb=\"r_s2\" in trans_leq_use_env)\n            apply (auto)\n        apply (rule_tac dist_add_leq_use_env)\n        apply (auto)\n    (* var case. *)\n      apply (rule_tac water_var_case)\n                  apply (auto)\n    (* pair case. *)\n     apply (rule_tac water_pair_case)\n                      apply (auto)\n    (* if case *)\n    apply (rule_tac water_if_case)\n                apply (auto)\n    (* lam case *)\n   apply (rule_tac water_lam_case)\n               apply (auto)\n    (* app case *)\n  apply (rule_tac water_app_case)\n                 apply (auto)\n  done  \n  \nlemma wtae_diff_use_env: \"\\<lbrakk> strong_use_env r_s \\<rbrakk> \\<Longrightarrow> diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_s x) = one_use_env x UsePerm\"    \n  apply (case_tac \"\\<forall> y. diff_use_env (add_use_env r_s x UsePerm) (rem_use_env r_s x) y = one_use_env x UsePerm y\")\n   apply (auto)\n  apply (simp add: one_use_env_def)\n  apply (simp add: rem_use_env_def)\n  apply (simp add: diff_use_env_def)\n  apply (simp add: add_use_env_def)\n  apply (simp add: strong_use_env_def)\n  apply (case_tac \"x = y\")\n   apply (auto)\n  apply (erule_tac x=\"y\" in allE)\n  apply (case_tac \"r_s y\")\n    apply (auto)\n  done    \n  \nlemma well_typed_set_own: \"\\<lbrakk> well_typed env r_x e tau r_x r_x; is_value e;\n  env (Loc b) = Some t; mem_ty t; unlim tau; r_s (Loc b) \\<noteq> NoPerm; mem_val_env env; sub_env s env \\<rbrakk> \\<Longrightarrow>\n  well_typed env r_s (set_own e b) tau r_s (one_use_env (Loc b) UsePerm)\"    \n    (* to prove that ack_exp works with arbitrary permissions, we want to prove that it works with just x. *)\n  apply (rule_tac r_s=\"one_use_env (Loc b) UsePerm\" in well_typed_incr_simul_perm)\n   apply (simp add: leq_use_env_def)\n   apply (simp add: one_use_env_def)\n   apply (case_tac \"r_s (Loc b)\")\n     apply (auto)\n    (* call the induction hypothesis *)\n  apply (cut_tac env=\"env\" and ?r_s1.0=\"drop_use_env r_x\" and e=\"e\" and tau=\"tau\" and\n        ?r_s2.0=\"drop_use_env r_x\" and rx=\"drop_use_env r_x\" and b=\"b\" and r_set=\"{b} \\<union> ann_vars e\" and\n        t=\"t\" in well_typed_set_own_rep)    \n        apply (rule_tac wt_sexp_drop_all)\n          apply (auto)\n     apply (simp add: unlim_def)\n    apply (rule_tac value_is_sexp)\n    apply (simp)\n   apply (rule_tac semi_weak_drop_use_env)\n    (* to reduce r_x to just b, we must invoke the diff lemma *)\n  apply (cut_tac eq_own)\n  apply (auto)\n  apply (rule_tac t=\"one_use_env (Loc b) UsePerm\" and s=\"diff_use_env (add_use_env (lift_use_env r_x r) (Loc b) UsePerm)\n    (rem_use_env (lift_use_env r_x r) (Loc b))\" in subst)\n   apply (rule_tac wtae_diff_use_env)\n   apply (rule_tac strong_lift_use_env)\n   apply (simp)\n    (* permission manipulation *)\n  apply (rule_tac well_typed_diff_perms)\n   apply (rule_tac rx=\"pwrite_use_env (drop_use_env r_x) (insert b (ann_vars e)) b\" in well_typed_incr_req)\n     apply (rule_tac r_s=\"add_use_env (drop_use_env r_x) (Loc b) UsePerm\" in well_typed_incr_simul_perm)\n      apply (rule_tac dist_add_leq_use_env)\n      apply (rule_tac drop_leq_use_env)\n      apply (rule_tac self_lift_leq_use_env)\n     apply (simp)\n    (* proving requirements change was valid *)\n    apply (rule_tac add_pwrite_leq_use_env)\n      apply (rule_tac semi_weak_drop_use_env)\n     apply (auto)\n    apply (rule_tac dist_add_leq_use_env)\n    apply (rule_tac drop_leq_use_env)\n    apply (rule_tac self_lift_leq_use_env)\n   apply (rule_tac id_leq_use_env)\n    (* proving that the diff was valid, which should be true since b is the only non-prim var. say that x \\<noteq> b *)\n  apply (case_tac \"x \\<noteq> Loc b\")\n   apply (auto)\n   apply (case_tac x)\n    apply (auto)\n    (* - say that x is a var. then it must be in the env, which is impossible since env is under some s *)\n    apply (simp add: non_prim_vars_def)\n    apply (simp add: non_prim_entry_def)\n    apply (simp add: sub_env_def)\n    apply (erule_tac x=\"Var x1\" in allE)\n    apply (auto)\n    (* - otherwise, x is a res var in set_own, which means it must be an ann var, which is impossible *)\n   apply (simp add: non_prim_vars_def)\n   apply (auto)\n   apply (cut_tac x=\"x2\" and e=\"set_own e b\" in ann_res_vars)\n    apply (auto)\n   apply (cut_tac x=\"x2\" and e=\"e\" and b=\"b\" in well_typed_set_own_ann_vars)\n     apply (auto)\n    (* - then x = b, which is fine *)\n  apply (simp add: own_env_vars_def)\n  apply (simp add: rem_use_env_def)\n  done\n    \n    (* ##### other set_own lemmas *)\n    \nlemma set_own_value: \"\\<lbrakk> is_value v \\<rbrakk> \\<Longrightarrow> is_value (set_own v b)\"    \n  apply (induct v)\n        apply (auto)\n   apply (case_tac x)\n    apply (auto)\n  apply (case_tac v1)\n        apply (auto)\n  done\n    \n    (* a permission env is \"proper\" relative to x if every location used cen be found from x. *)\n    \ndefinition proper_use_env where\n  \"proper_use_env rs_map x e r_s = (\\<forall> y. (y \\<in> ref_vars e \\<and> r_s (Loc y) \\<noteq> NoPerm) \\<longrightarrow> (\\<exists> l. path_lookup rs_map x l y))\"\n  \nlemma leq_proper_use_env: \"\\<lbrakk> proper_use_env rs_map x e r_s; leq_use_env r_x r_s; ref_vars e' \\<subseteq> ref_vars e \\<rbrakk> \\<Longrightarrow> proper_use_env rs_map x e' r_x\"\n  apply (simp add: proper_use_env_def)\n  apply (simp add: leq_use_env_def)\n  apply (auto)\n  apply (erule_tac x=\"y\" in allE)\n  apply (erule_tac x=\"Loc y\" in allE)\n  apply (auto)\n  apply (case_tac \"r_x (Loc y)\")\n    apply (auto)\n  done\n  \nlemma add_proper_use_env: \"\\<lbrakk> proper_use_env rs_map x e r_s \\<rbrakk> \\<Longrightarrow>\n  proper_use_env rs_map x e (add_use_env r_s (Var y) r)\"    \n  apply (simp add: proper_use_env_def)\n  apply (simp add: add_use_env_def)\n  done    \n    \nlemma proper_set_own_ih: \"\\<lbrakk> proper_use_env rs_map b e r_s; proper_exp rs_map e;\n   well_typed env r_s e tau r_se r_xe \\<rbrakk> \\<Longrightarrow> proper_exp rs_map (set_own e b)\"    \n  apply (induct e arbitrary: env r_s tau r_se r_xe)\n        apply (auto)\n    (* var case. we first posit that there is a path between b \\<leadsto> x22 *)\n      apply (case_tac \"x\")\n       apply (auto)\n      apply (simp add: proper_exp_def)\n      apply (case_tac \"\\<not> (\\<exists> l. path_lookup rs_map b l x22)\")\n       apply (simp add: proper_use_env_def)\n       apply (erule_tac x=\"x22\" in allE)\n       apply (auto)\n       apply (cut_tac r_x=\"ereq_use_env (Loc x22) tau_x\" and r_s=\"r_s\" and x=\"Loc x22\" in leq_use_none)\n         apply (simp_all)\n       apply (simp add: ereq_use_env_def)\n       apply (simp add: one_use_env_def)\n       apply (simp add: end_req_perm_def)\n    (* - we merge this with x22 \\<leadsto> x21 *)\n      apply (rule_tac x=\"la @ l\" in exI)\n      apply (rule_tac y=\"x22\" in path_lookup_append)\n       apply (auto)\n    (* pair case *)\n     apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_pair)\n      apply (auto)\n     apply (cut_tac r_x=\"r_s\" and r_s=\"r_s\" and rs_map=\"rs_map\" and e=\"PairExp e1 e2\" and e'=\"e1\" and x=\"b\" in leq_proper_use_env)\n        apply (auto)\n      apply (rule_tac id_leq_use_env)\n     apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s\" and rs_map=\"rs_map\" and e=\"PairExp e1 e2\" and e'=\"e2\" and x=\"b\" in leq_proper_use_env)\n        apply (auto)\n      apply (rule_tac well_typed_perm_leq)\n      apply (auto)\n     apply (simp add: proper_exp_def)\n    (* if case *)\n    apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" and ?e3.0=\"e3\" in proper_if)\n     apply (auto)\n    apply (cut_tac r_x=\"r_s\" and r_s=\"r_s\" and rs_map=\"rs_map\" and x=\"b\" and e=\"IfExp e1 e2 e3\" and e'=\"e1\"  in leq_proper_use_env)\n       apply (auto)\n     apply (rule_tac id_leq_use_env)\n    apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s\" and rs_map=\"rs_map\" and x=\"b\" and e=\"IfExp e1 e2 e3\" and e'=\"e2\" in leq_proper_use_env)\n       apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s\" and rs_map=\"rs_map\" and x=\"b\" and e=\"IfExp e1 e2 e3\" and e'=\"e3\"  in leq_proper_use_env)\n      apply (auto)\n     apply (rule_tac well_typed_perm_leq)\n     apply (auto)\n    apply (simp add: proper_exp_def)\n    (* lam case *)\n   apply (cut_tac r_s=\"rx\" and rs_map=\"rs_map\" and e=\"e\" and x=\"b\" and y=\"x1a\" and r=\"r\" in add_proper_use_env)\n     apply (rule_tac r_s=\"r_s\" and e=\"e\" in leq_proper_use_env)\n       apply (simp add: proper_use_env_def)\n      apply (auto)\n   apply (simp add: proper_exp_def)\n    (* app case *)\n  apply (cut_tac rs_map=\"rs_map\" and ?e1.0=\"e1\" and ?e2.0=\"e2\" in proper_app)\n   apply (auto)\n  apply (cut_tac r_x=\"r_s\" and r_s=\"r_s\" and rs_map=\"rs_map\" and e=\"AppExp e1 e2\" and e'=\"e1\" and x=\"b\" in leq_proper_use_env)\n     apply (auto)\n   apply (rule_tac id_leq_use_env)\n  apply (cut_tac r_x=\"r_s2\" and r_s=\"r_s\" and rs_map=\"rs_map\" and e=\"AppExp e1 e2\" and e'=\"e2\" and x=\"b\" in leq_proper_use_env)\n     apply (auto)\n   apply (rule_tac well_typed_perm_leq)\n   apply (auto)\n  apply (simp add: proper_exp_def)\n  done    \n    \nlemma proper_set_own: \"\\<lbrakk> path_lookup rs_map b l a; rs_map a = Some r_s;\n  proper_exp rs_map e; mem_val_env env;\n  well_typed env r_s e tau r_se r_xe \\<rbrakk> \\<Longrightarrow> proper_exp rs_map (set_own e b)\"   \n  apply (rule_tac env=\"env\" and r_s=\"r_s\" and r_se=\"r_se\" and tau=\"tau\" and r_xe=\"r_xe\" in proper_set_own_ih)\n    (* we expect everything from r_s1 to be contained in the completion of rs_map since\n        r_s1 is derived from some resource y, where there is a path from x to y *)\n    apply (simp add: proper_use_env_def)\n    apply (auto)\n  apply (rule_tac x=\"l @ [y]\" in exI)\n  apply (rule_tac y=\"a\" in path_lookup_append)\n   apply (auto)\n  done\n    \n\n  \nend", "meta": {"author": "anon-ef", "repo": "perm_lang_ef2", "sha": "0fcb6e4c175193cc7b94f297a8aaa605f502d711", "save_path": "github-repos/isabelle/anon-ef-perm_lang_ef2", "path": "github-repos/isabelle/anon-ef-perm_lang_ef2/perm_lang_ef2-0fcb6e4c175193cc7b94f297a8aaa605f502d711/perm_ref/ReduceSetOwn.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.63341026367784, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.301870442443736}}
{"text": "theory HOL_Specific\nimports Base \"~~/src/HOL/Library/Old_Datatype\" \"~~/src/HOL/Library/Old_Recdef\"\n  \"~~/src/Tools/Adhoc_Overloading\"\nbegin\n\nchapter \\<open>Higher-Order Logic\\<close>\n\ntext \\<open>Isabelle/HOL is based on Higher-Order Logic, a polymorphic\n  version of Church's Simple Theory of Types.  HOL can be best\n  understood as a simply-typed version of classical set theory.  The\n  logic was first implemented in Gordon's HOL system\n  @{cite \"mgordon-hol\"}.  It extends Church's original logic\n  @{cite \"church40\"} by explicit type variables (naive polymorphism) and\n  a sound axiomatization scheme for new types based on subsets of\n  existing types.\n\n  Andrews's book @{cite andrews86} is a full description of the\n  original Church-style higher-order logic, with proofs of correctness\n  and completeness wrt.\\ certain set-theoretic interpretations.  The\n  particular extensions of Gordon-style HOL are explained semantically\n  in two chapters of the 1993 HOL book @{cite pitts93}.\n\n  Experience with HOL over decades has demonstrated that higher-order\n  logic is widely applicable in many areas of mathematics and computer\n  science.  In a sense, Higher-Order Logic is simpler than First-Order\n  Logic, because there are fewer restrictions and special cases.  Note\n  that HOL is \\emph{weaker} than FOL with axioms for ZF set theory,\n  which is traditionally considered the standard foundation of regular\n  mathematics, but for most applications this does not matter.  If you\n  prefer ML to Lisp, you will probably prefer HOL to ZF.\n\n  \\medskip The syntax of HOL follows @{text \"\\<lambda>\"}-calculus and\n  functional programming.  Function application is curried.  To apply\n  the function @{text f} of type @{text \"\\<tau>\\<^sub>1 \\<Rightarrow> \\<tau>\\<^sub>2 \\<Rightarrow> \\<tau>\\<^sub>3\"} to the\n  arguments @{text a} and @{text b} in HOL, you simply write @{text \"f\n  a b\"} (as in ML or Haskell).  There is no ``apply'' operator; the\n  existing application of the Pure @{text \"\\<lambda>\"}-calculus is re-used.\n  Note that in HOL @{text \"f (a, b)\"} means ``@{text \"f\"} applied to\n  the pair @{text \"(a, b)\"} (which is notation for @{text \"Pair a\n  b\"}).  The latter typically introduces extra formal efforts that can\n  be avoided by currying functions by default.  Explicit tuples are as\n  infrequent in HOL formalizations as in good ML or Haskell programs.\n\n  \\medskip Isabelle/HOL has a distinct feel, compared to other\n  object-logics like Isabelle/ZF.  It identifies object-level types\n  with meta-level types, taking advantage of the default\n  type-inference mechanism of Isabelle/Pure.  HOL fully identifies\n  object-level functions with meta-level functions, with native\n  abstraction and application.\n\n  These identifications allow Isabelle to support HOL particularly\n  nicely, but they also mean that HOL requires some sophistication\n  from the user.  In particular, an understanding of Hindley-Milner\n  type-inference with type-classes, which are both used extensively in\n  the standard libraries and applications.  Beginners can set\n  @{attribute show_types} or even @{attribute show_sorts} to get more\n  explicit information about the result of type-inference.\\<close>\n\n\nchapter \\<open>Derived specification elements\\<close>\n\nsection \\<open>Inductive and coinductive definitions \\label{sec:hol-inductive}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"inductive\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n    @{command_def (HOL) \"inductive_set\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n    @{command_def (HOL) \"coinductive\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n    @{command_def (HOL) \"coinductive_set\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n    @{command_def \"print_inductives\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{attribute_def (HOL) mono} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  An \\emph{inductive definition} specifies the least predicate or set\n  @{text R} closed under given rules: applying a rule to elements of\n  @{text R} yields a result within @{text R}.  For example, a\n  structural operational semantics is an inductive definition of an\n  evaluation relation.\n\n  Dually, a \\emph{coinductive definition} specifies the greatest\n  predicate or set @{text R} that is consistent with given rules:\n  every element of @{text R} can be seen as arising by applying a rule\n  to elements of @{text R}.  An important example is using\n  bisimulation relations to formalise equivalence of processes and\n  infinite data structures.\n\n  Both inductive and coinductive definitions are based on the\n  Knaster-Tarski fixed-point theorem for complete lattices.  The\n  collection of introduction rules given by the user determines a\n  functor on subsets of set-theoretic relations.  The required\n  monotonicity of the recursion scheme is proven as a prerequisite to\n  the fixed-point definition and the resulting consequences.  This\n  works by pushing inclusion through logical connectives and any other\n  operator that might be wrapped around recursive occurrences of the\n  defined relation: there must be a monotonicity theorem of the form\n  @{text \"A \\<le> B \\<Longrightarrow> \\<M> A \\<le> \\<M> B\"}, for each premise @{text \"\\<M> R t\"} in an\n  introduction rule.  The default rule declarations of Isabelle/HOL\n  already take care of most common situations.\n\n  @{rail \\<open>\n    (@@{command (HOL) inductive} | @@{command (HOL) inductive_set} |\n      @@{command (HOL) coinductive} | @@{command (HOL) coinductive_set})\n    @{syntax target}? \\<newline>\n    @{syntax \"fixes\"} (@'for' @{syntax \"fixes\"})? (@'where' clauses)? \\<newline>\n    (@'monos' @{syntax thmrefs})?\n    ;\n    clauses: (@{syntax thmdecl}? @{syntax prop} + '|')\n    ;\n    @@{attribute (HOL) mono} (() | 'add' | 'del')\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"inductive\"} and @{command (HOL)\n  \"coinductive\"} define (co)inductive predicates from the introduction\n  rules.\n\n  The propositions given as @{text \"clauses\"} in the @{keyword\n  \"where\"} part are either rules of the usual @{text \"\\<And>/\\<Longrightarrow>\"} format\n  (with arbitrary nesting), or equalities using @{text \"\\<equiv>\"}.  The\n  latter specifies extra-logical abbreviations in the sense of\n  @{command_ref abbreviation}.  Introducing abstract syntax\n  simultaneously with the actual introduction rules is occasionally\n  useful for complex specifications.\n\n  The optional @{keyword \"for\"} part contains a list of parameters of\n  the (co)inductive predicates that remain fixed throughout the\n  definition, in contrast to arguments of the relation that may vary\n  in each occurrence within the given @{text \"clauses\"}.\n\n  The optional @{keyword \"monos\"} declaration contains additional\n  \\emph{monotonicity theorems}, which are required for each operator\n  applied to a recursive set in the introduction rules.\n\n  \\item @{command (HOL) \"inductive_set\"} and @{command (HOL)\n  \"coinductive_set\"} are wrappers for to the previous commands for\n  native HOL predicates.  This allows to define (co)inductive sets,\n  where multiple arguments are simulated via tuples.\n\n  \\item @{command \"print_inductives\"} prints (co)inductive definitions and\n  monotonicity rules.\n\n  \\item @{attribute (HOL) mono} declares monotonicity rules in the\n  context.  These rule are involved in the automated monotonicity\n  proof of the above inductive and coinductive definitions.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Derived rules\\<close>\n\ntext \\<open>A (co)inductive definition of @{text R} provides the following\n  main theorems:\n\n  \\begin{description}\n\n  \\item @{text R.intros} is the list of introduction rules as proven\n  theorems, for the recursive predicates (or sets).  The rules are\n  also available individually, using the names given them in the\n  theory file;\n\n  \\item @{text R.cases} is the case analysis (or elimination) rule;\n\n  \\item @{text R.induct} or @{text R.coinduct} is the (co)induction\n  rule;\n\n  \\item @{text R.simps} is the equation unrolling the fixpoint of the\n  predicate one step.\n\n  \\end{description}\n\n  When several predicates @{text \"R\\<^sub>1, \\<dots>, R\\<^sub>n\"} are\n  defined simultaneously, the list of introduction rules is called\n  @{text \"R\\<^sub>1_\\<dots>_R\\<^sub>n.intros\"}, the case analysis rules are\n  called @{text \"R\\<^sub>1.cases, \\<dots>, R\\<^sub>n.cases\"}, and the list\n  of mutual induction rules is called @{text\n  \"R\\<^sub>1_\\<dots>_R\\<^sub>n.inducts\"}.\n\\<close>\n\n\nsubsection \\<open>Monotonicity theorems\\<close>\n\ntext \\<open>The context maintains a default set of theorems that are used\n  in monotonicity proofs.  New rules can be declared via the\n  @{attribute (HOL) mono} attribute.  See the main Isabelle/HOL\n  sources for some examples.  The general format of such monotonicity\n  theorems is as follows:\n\n  \\begin{itemize}\n\n  \\item Theorems of the form @{text \"A \\<le> B \\<Longrightarrow> \\<M> A \\<le> \\<M> B\"}, for proving\n  monotonicity of inductive definitions whose introduction rules have\n  premises involving terms such as @{text \"\\<M> R t\"}.\n\n  \\item Monotonicity theorems for logical operators, which are of the\n  general form @{text \"(\\<dots> \\<longrightarrow> \\<dots>) \\<Longrightarrow> \\<dots> (\\<dots> \\<longrightarrow> \\<dots>) \\<Longrightarrow> \\<dots> \\<longrightarrow> \\<dots>\"}.  For example, in\n  the case of the operator @{text \"\\<or>\"}, the corresponding theorem is\n  \\[\n  \\infer{@{text \"P\\<^sub>1 \\<or> P\\<^sub>2 \\<longrightarrow> Q\\<^sub>1 \\<or> Q\\<^sub>2\"}}{@{text \"P\\<^sub>1 \\<longrightarrow> Q\\<^sub>1\"} & @{text \"P\\<^sub>2 \\<longrightarrow> Q\\<^sub>2\"}}\n  \\]\n\n  \\item De Morgan style equations for reasoning about the ``polarity''\n  of expressions, e.g.\n  \\[\n  @{prop \"\\<not> \\<not> P \\<longleftrightarrow> P\"} \\qquad\\qquad\n  @{prop \"\\<not> (P \\<and> Q) \\<longleftrightarrow> \\<not> P \\<or> \\<not> Q\"}\n  \\]\n\n  \\item Equations for reducing complex operators to more primitive\n  ones whose monotonicity can easily be proved, e.g.\n  \\[\n  @{prop \"(P \\<longrightarrow> Q) \\<longleftrightarrow> \\<not> P \\<or> Q\"} \\qquad\\qquad\n  @{prop \"Ball A P \\<equiv> \\<forall>x. x \\<in> A \\<longrightarrow> P x\"}\n  \\]\n\n  \\end{itemize}\n\\<close>\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>The finite powerset operator can be defined inductively like this:\\<close>\n\ninductive_set Fin :: \"'a set \\<Rightarrow> 'a set set\" for A :: \"'a set\"\nwhere\n  empty: \"{} \\<in> Fin A\"\n| insert: \"a \\<in> A \\<Longrightarrow> B \\<in> Fin A \\<Longrightarrow> insert a B \\<in> Fin A\"\n\ntext \\<open>The accessible part of a relation is defined as follows:\\<close>\n\ninductive acc :: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> bool\"\n  for r :: \"'a \\<Rightarrow> 'a \\<Rightarrow> bool\"  (infix \"\\<prec>\" 50)\nwhere acc: \"(\\<And>y. y \\<prec> x \\<Longrightarrow> acc r y) \\<Longrightarrow> acc r x\"\n\ntext \\<open>Common logical connectives can be easily characterized as\nnon-recursive inductive definitions with parameters, but without\narguments.\\<close>\n\ninductive AND for A B :: bool\nwhere \"A \\<Longrightarrow> B \\<Longrightarrow> AND A B\"\n\ninductive OR for A B :: bool\nwhere \"A \\<Longrightarrow> OR A B\"\n  | \"B \\<Longrightarrow> OR A B\"\n\ninductive EXISTS for B :: \"'a \\<Rightarrow> bool\"\nwhere \"B a \\<Longrightarrow> EXISTS B\"\n\ntext \\<open>Here the @{text \"cases\"} or @{text \"induct\"} rules produced by\n  the @{command inductive} package coincide with the expected\n  elimination rules for Natural Deduction.  Already in the original\n  article by Gerhard Gentzen @{cite \"Gentzen:1935\"} there is a hint that\n  each connective can be characterized by its introductions, and the\n  elimination can be constructed systematically.\\<close>\n\n\nsection \\<open>Recursive functions \\label{sec:recursion}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"primrec\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n    @{command_def (HOL) \"fun\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n    @{command_def (HOL) \"function\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def (HOL) \"termination\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"} \\\\\n    @{command_def (HOL) \"fun_cases\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) primrec} @{syntax target}? @{syntax \"fixes\"} @'where' equations\n    ;\n    (@@{command (HOL) fun} | @@{command (HOL) function}) @{syntax target}? functionopts?\n      @{syntax \"fixes\"} \\<newline> @'where' equations\n    ;\n\n    equations: (@{syntax thmdecl}? @{syntax prop} + '|')\n    ;\n    functionopts: '(' (('sequential' | 'domintros') + ',') ')'\n    ;\n    @@{command (HOL) termination} @{syntax term}?\n    ;\n    @@{command (HOL) fun_cases} (@{syntax thmdecl}? @{syntax prop} + @'and')\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"primrec\"} defines primitive recursive\n  functions over datatypes (see also @{command_ref (HOL) datatype}).\n  The given @{text equations} specify reduction rules that are produced\n  by instantiating the generic combinator for primitive recursion that\n  is available for each datatype.\n\n  Each equation needs to be of the form:\n\n  @{text [display] \"f x\\<^sub>1 \\<dots> x\\<^sub>m (C y\\<^sub>1 \\<dots> y\\<^sub>k) z\\<^sub>1 \\<dots> z\\<^sub>n = rhs\"}\n\n  such that @{text C} is a datatype constructor, @{text rhs} contains\n  only the free variables on the left-hand side (or from the context),\n  and all recursive occurrences of @{text \"f\"} in @{text \"rhs\"} are of\n  the form @{text \"f \\<dots> y\\<^sub>i \\<dots>\"} for some @{text i}.  At most one\n  reduction rule for each constructor can be given.  The order does\n  not matter.  For missing constructors, the function is defined to\n  return a default value, but this equation is made difficult to\n  access for users.\n\n  The reduction rules are declared as @{attribute simp} by default,\n  which enables standard proof methods like @{method simp} and\n  @{method auto} to normalize expressions of @{text \"f\"} applied to\n  datatype constructions, by simulating symbolic computation via\n  rewriting.\n\n  \\item @{command (HOL) \"function\"} defines functions by general\n  wellfounded recursion. A detailed description with examples can be\n  found in @{cite \"isabelle-function\"}. The function is specified by a\n  set of (possibly conditional) recursive equations with arbitrary\n  pattern matching. The command generates proof obligations for the\n  completeness and the compatibility of patterns.\n\n  The defined function is considered partial, and the resulting\n  simplification rules (named @{text \"f.psimps\"}) and induction rule\n  (named @{text \"f.pinduct\"}) are guarded by a generated domain\n  predicate @{text \"f_dom\"}. The @{command (HOL) \"termination\"}\n  command can then be used to establish that the function is total.\n\n  \\item @{command (HOL) \"fun\"} is a shorthand notation for ``@{command\n  (HOL) \"function\"}~@{text \"(sequential)\"}, followed by automated\n  proof attempts regarding pattern matching and termination.  See\n  @{cite \"isabelle-function\"} for further details.\n\n  \\item @{command (HOL) \"termination\"}~@{text f} commences a\n  termination proof for the previously defined function @{text f}.  If\n  this is omitted, the command refers to the most recent function\n  definition.  After the proof is closed, the recursive equations and\n  the induction principle is established.\n\n  \\item @{command (HOL) \"fun_cases\"} generates specialized elimination\n  rules for function equations. It expects one or more function equations\n  and produces rules that eliminate the given equalities, following the cases\n  given in the function definition.\n  \\end{description}\n\n  Recursive definitions introduced by the @{command (HOL) \"function\"}\n  command accommodate reasoning by induction (cf.\\ @{method induct}):\n  rule @{text \"f.induct\"} refers to a specific induction rule, with\n  parameters named according to the user-specified equations. Cases\n  are numbered starting from 1.  For @{command (HOL) \"primrec\"}, the\n  induction principle coincides with structural recursion on the\n  datatype where the recursion is carried out.\n\n  The equations provided by these packages may be referred later as\n  theorem list @{text \"f.simps\"}, where @{text f} is the (collective)\n  name of the functions defined.  Individual equations may be named\n  explicitly as well.\n\n  The @{command (HOL) \"function\"} command accepts the following\n  options.\n\n  \\begin{description}\n\n  \\item @{text sequential} enables a preprocessor which disambiguates\n  overlapping patterns by making them mutually disjoint.  Earlier\n  equations take precedence over later ones.  This allows to give the\n  specification in a format very similar to functional programming.\n  Note that the resulting simplification and induction rules\n  correspond to the transformed specification, not the one given\n  originally. This usually means that each equation given by the user\n  may result in several theorems.  Also note that this automatic\n  transformation only works for ML-style datatype patterns.\n\n  \\item @{text domintros} enables the automated generation of\n  introduction rules for the domain predicate. While mostly not\n  needed, they can be helpful in some proofs about partial functions.\n\n  \\end{description}\n\\<close>\n\nsubsubsection \\<open>Example: evaluation of expressions\\<close>\n\ntext \\<open>Subsequently, we define mutual datatypes for arithmetic and\n  boolean expressions, and use @{command primrec} for evaluation\n  functions that follow the same recursive structure.\\<close>\n\ndatatype 'a aexp =\n    IF \"'a bexp\"  \"'a aexp\"  \"'a aexp\"\n  | Sum \"'a aexp\"  \"'a aexp\"\n  | Diff \"'a aexp\"  \"'a aexp\"\n  | Var 'a\n  | Num nat\nand 'a bexp =\n    Less \"'a aexp\"  \"'a aexp\"\n  | And \"'a bexp\"  \"'a bexp\"\n  | Neg \"'a bexp\"\n\n\ntext \\<open>\\medskip Evaluation of arithmetic and boolean expressions\\<close>\n\nprimrec evala :: \"('a \\<Rightarrow> nat) \\<Rightarrow> 'a aexp \\<Rightarrow> nat\"\n  and evalb :: \"('a \\<Rightarrow> nat) \\<Rightarrow> 'a bexp \\<Rightarrow> bool\"\nwhere\n  \"evala env (IF b a1 a2) = (if evalb env b then evala env a1 else evala env a2)\"\n| \"evala env (Sum a1 a2) = evala env a1 + evala env a2\"\n| \"evala env (Diff a1 a2) = evala env a1 - evala env a2\"\n| \"evala env (Var v) = env v\"\n| \"evala env (Num n) = n\"\n| \"evalb env (Less a1 a2) = (evala env a1 < evala env a2)\"\n| \"evalb env (And b1 b2) = (evalb env b1 \\<and> evalb env b2)\"\n| \"evalb env (Neg b) = (\\<not> evalb env b)\"\n\ntext \\<open>Since the value of an expression depends on the value of its\n  variables, the functions @{const evala} and @{const evalb} take an\n  additional parameter, an \\emph{environment} that maps variables to\n  their values.\n\n  \\medskip Substitution on expressions can be defined similarly.  The\n  mapping @{text f} of type @{typ \"'a \\<Rightarrow> 'a aexp\"} given as a\n  parameter is lifted canonically on the types @{typ \"'a aexp\"} and\n  @{typ \"'a bexp\"}, respectively.\n\\<close>\n\nprimrec substa :: \"('a \\<Rightarrow> 'b aexp) \\<Rightarrow> 'a aexp \\<Rightarrow> 'b aexp\"\n  and substb :: \"('a \\<Rightarrow> 'b aexp) \\<Rightarrow> 'a bexp \\<Rightarrow> 'b bexp\"\nwhere\n  \"substa f (IF b a1 a2) = IF (substb f b) (substa f a1) (substa f a2)\"\n| \"substa f (Sum a1 a2) = Sum (substa f a1) (substa f a2)\"\n| \"substa f (Diff a1 a2) = Diff (substa f a1) (substa f a2)\"\n| \"substa f (Var v) = f v\"\n| \"substa f (Num n) = Num n\"\n| \"substb f (Less a1 a2) = Less (substa f a1) (substa f a2)\"\n| \"substb f (And b1 b2) = And (substb f b1) (substb f b2)\"\n| \"substb f (Neg b) = Neg (substb f b)\"\n\ntext \\<open>In textbooks about semantics one often finds substitution\n  theorems, which express the relationship between substitution and\n  evaluation.  For @{typ \"'a aexp\"} and @{typ \"'a bexp\"}, we can prove\n  such a theorem by mutual induction, followed by simplification.\n\\<close>\n\nlemma subst_one:\n  \"evala env (substa (Var (v := a')) a) = evala (env (v := evala env a')) a\"\n  \"evalb env (substb (Var (v := a')) b) = evalb (env (v := evala env a')) b\"\n  by (induct a and b) simp_all\n\nlemma subst_all:\n  \"evala env (substa s a) = evala (\\<lambda>x. evala env (s x)) a\"\n  \"evalb env (substb s b) = evalb (\\<lambda>x. evala env (s x)) b\"\n  by (induct a and b) simp_all\n\n\nsubsubsection \\<open>Example: a substitution function for terms\\<close>\n\ntext \\<open>Functions on datatypes with nested recursion are also defined\n  by mutual primitive recursion.\\<close>\n\ndatatype ('a, 'b) \"term\" = Var 'a | App 'b \"('a, 'b) term list\"\n\ntext \\<open>A substitution function on type @{typ \"('a, 'b) term\"} can be\n  defined as follows, by working simultaneously on @{typ \"('a, 'b)\n  term list\"}:\\<close>\n\nprimrec subst_term :: \"('a \\<Rightarrow> ('a, 'b) term) \\<Rightarrow> ('a, 'b) term \\<Rightarrow> ('a, 'b) term\" and\n  subst_term_list :: \"('a \\<Rightarrow> ('a, 'b) term) \\<Rightarrow> ('a, 'b) term list \\<Rightarrow> ('a, 'b) term list\"\nwhere\n  \"subst_term f (Var a) = f a\"\n| \"subst_term f (App b ts) = App b (subst_term_list f ts)\"\n| \"subst_term_list f [] = []\"\n| \"subst_term_list f (t # ts) = subst_term f t # subst_term_list f ts\"\n\ntext \\<open>The recursion scheme follows the structure of the unfolded\n  definition of type @{typ \"('a, 'b) term\"}.  To prove properties of this\n  substitution function, mutual induction is needed:\n\\<close>\n\nlemma \"subst_term (subst_term f1 \\<circ> f2) t = subst_term f1 (subst_term f2 t)\" and\n  \"subst_term_list (subst_term f1 \\<circ> f2) ts = subst_term_list f1 (subst_term_list f2 ts)\"\n  by (induct t and ts rule: subst_term.induct subst_term_list.induct) simp_all\n\n\nsubsubsection \\<open>Example: a map function for infinitely branching trees\\<close>\n\ntext \\<open>Defining functions on infinitely branching datatypes by\n  primitive recursion is just as easy.\n\\<close>\n\ndatatype 'a tree = Atom 'a | Branch \"nat \\<Rightarrow> 'a tree\"\n\nprimrec map_tree :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> 'a tree \\<Rightarrow> 'b tree\"\nwhere\n  \"map_tree f (Atom a) = Atom (f a)\"\n| \"map_tree f (Branch ts) = Branch (\\<lambda>x. map_tree f (ts x))\"\n\ntext \\<open>Note that all occurrences of functions such as @{text ts}\n  above must be applied to an argument.  In particular, @{term\n  \"map_tree f \\<circ> ts\"} is not allowed here.\\<close>\n\ntext \\<open>Here is a simple composition lemma for @{term map_tree}:\\<close>\n\nlemma \"map_tree g (map_tree f t) = map_tree (g \\<circ> f) t\"\n  by (induct t) simp_all\n\n\nsubsection \\<open>Proof methods related to recursive definitions\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) pat_completeness} & : & @{text method} \\\\\n    @{method_def (HOL) relation} & : & @{text method} \\\\\n    @{method_def (HOL) lexicographic_order} & : & @{text method} \\\\\n    @{method_def (HOL) size_change} & : & @{text method} \\\\\n    @{method_def (HOL) induction_schema} & : & @{text method} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) relation} @{syntax term}\n    ;\n    @@{method (HOL) lexicographic_order} (@{syntax clasimpmod} * )\n    ;\n    @@{method (HOL) size_change} ( orders (@{syntax clasimpmod} * ) )\n    ;\n    @@{method (HOL) induction_schema}\n    ;\n    orders: ( 'max' | 'min' | 'ms' ) *\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{method (HOL) pat_completeness} is a specialized method to\n  solve goals regarding the completeness of pattern matching, as\n  required by the @{command (HOL) \"function\"} package (cf.\\\n  @{cite \"isabelle-function\"}).\n\n  \\item @{method (HOL) relation}~@{text R} introduces a termination\n  proof using the relation @{text R}.  The resulting proof state will\n  contain goals expressing that @{text R} is wellfounded, and that the\n  arguments of recursive calls decrease with respect to @{text R}.\n  Usually, this method is used as the initial proof step of manual\n  termination proofs.\n\n  \\item @{method (HOL) \"lexicographic_order\"} attempts a fully\n  automated termination proof by searching for a lexicographic\n  combination of size measures on the arguments of the function. The\n  method accepts the same arguments as the @{method auto} method,\n  which it uses internally to prove local descents.  The @{syntax\n  clasimpmod} modifiers are accepted (as for @{method auto}).\n\n  In case of failure, extensive information is printed, which can help\n  to analyse the situation (cf.\\ @{cite \"isabelle-function\"}).\n\n  \\item @{method (HOL) \"size_change\"} also works on termination goals,\n  using a variation of the size-change principle, together with a\n  graph decomposition technique (see @{cite krauss_phd} for details).\n  Three kinds of orders are used internally: @{text max}, @{text min},\n  and @{text ms} (multiset), which is only available when the theory\n  @{text Multiset} is loaded. When no order kinds are given, they are\n  tried in order. The search for a termination proof uses SAT solving\n  internally.\n\n  For local descent proofs, the @{syntax clasimpmod} modifiers are\n  accepted (as for @{method auto}).\n\n  \\item @{method (HOL) induction_schema} derives user-specified\n  induction rules from well-founded induction and completeness of\n  patterns. This factors out some operations that are done internally\n  by the function package and makes them available separately. See\n  @{file \"~~/src/HOL/ex/Induction_Schema.thy\"} for examples.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Functions with explicit partiality\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"partial_function\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n    @{attribute_def (HOL) \"partial_function_mono\"} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) partial_function} @{syntax target}?\n      '(' @{syntax nameref} ')' @{syntax \"fixes\"} \\<newline>\n      @'where' @{syntax thmdecl}? @{syntax prop}\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"partial_function\"}~@{text \"(mode)\"} defines\n  recursive functions based on fixpoints in complete partial\n  orders. No termination proof is required from the user or\n  constructed internally. Instead, the possibility of non-termination\n  is modelled explicitly in the result type, which contains an\n  explicit bottom element.\n\n  Pattern matching and mutual recursion are currently not supported.\n  Thus, the specification consists of a single function described by a\n  single recursive equation.\n\n  There are no fixed syntactic restrictions on the body of the\n  function, but the induced functional must be provably monotonic\n  wrt.\\ the underlying order.  The monotonicity proof is performed\n  internally, and the definition is rejected when it fails. The proof\n  can be influenced by declaring hints using the\n  @{attribute (HOL) partial_function_mono} attribute.\n\n  The mandatory @{text mode} argument specifies the mode of operation\n  of the command, which directly corresponds to a complete partial\n  order on the result type. By default, the following modes are\n  defined:\n\n  \\begin{description}\n\n  \\item @{text option} defines functions that map into the @{type\n  option} type. Here, the value @{term None} is used to model a\n  non-terminating computation. Monotonicity requires that if @{term\n  None} is returned by a recursive call, then the overall result must\n  also be @{term None}. This is best achieved through the use of the\n  monadic operator @{const \"Option.bind\"}.\n\n  \\item @{text tailrec} defines functions with an arbitrary result\n  type and uses the slightly degenerated partial order where @{term\n  \"undefined\"} is the bottom element.  Now, monotonicity requires that\n  if @{term undefined} is returned by a recursive call, then the\n  overall result must also be @{term undefined}. In practice, this is\n  only satisfied when each recursive call is a tail call, whose result\n  is directly returned. Thus, this mode of operation allows the\n  definition of arbitrary tail-recursive functions.\n\n  \\end{description}\n\n  Experienced users may define new modes by instantiating the locale\n  @{const \"partial_function_definitions\"} appropriately.\n\n  \\item @{attribute (HOL) partial_function_mono} declares rules for\n  use in the internal monotonicity proofs of partial function\n  definitions.\n\n  \\end{description}\n\n\\<close>\n\n\nsubsection \\<open>Old-style recursive function definitions (TFL)\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"recdef\"} & : & @{text \"theory \\<rightarrow> theory)\"} \\\\\n    @{command_def (HOL) \"recdef_tc\"}@{text \"\\<^sup>*\"} & : & @{text \"theory \\<rightarrow> proof(prove)\"} \\\\\n  \\end{matharray}\n\n  The old TFL commands @{command (HOL) \"recdef\"} and @{command (HOL)\n  \"recdef_tc\"} for defining recursive are mostly obsolete; @{command\n  (HOL) \"function\"} or @{command (HOL) \"fun\"} should be used instead.\n\n  @{rail \\<open>\n    @@{command (HOL) recdef} ('(' @'permissive' ')')? \\<newline>\n      @{syntax name} @{syntax term} (@{syntax prop} +) hints?\n    ;\n    recdeftc @{syntax thmdecl}? tc\n    ;\n    hints: '(' @'hints' ( recdefmod * ) ')'\n    ;\n    recdefmod: (('recdef_simp' | 'recdef_cong' | 'recdef_wf')\n      (() | 'add' | 'del') ':' @{syntax thmrefs}) | @{syntax clasimpmod}\n    ;\n    tc: @{syntax nameref} ('(' @{syntax nat} ')')?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"recdef\"} defines general well-founded\n  recursive functions (using the TFL package), see also\n  @{cite \"isabelle-HOL\"}.  The ``@{text \"(permissive)\"}'' option tells\n  TFL to recover from failed proof attempts, returning unfinished\n  results.  The @{text recdef_simp}, @{text recdef_cong}, and @{text\n  recdef_wf} hints refer to auxiliary rules to be used in the internal\n  automated proof process of TFL.  Additional @{syntax clasimpmod}\n  declarations may be given to tune the context of the Simplifier\n  (cf.\\ \\secref{sec:simplifier}) and Classical reasoner (cf.\\\n  \\secref{sec:classical}).\n\n  \\item @{command (HOL) \"recdef_tc\"}~@{text \"c (i)\"} recommences the\n  proof for leftover termination condition number @{text i} (default\n  1) as generated by a @{command (HOL) \"recdef\"} definition of\n  constant @{text c}.\n\n  Note that in most cases, @{command (HOL) \"recdef\"} is able to finish\n  its internal proofs without manual intervention.\n\n  \\end{description}\n\n  \\medskip Hints for @{command (HOL) \"recdef\"} may be also declared\n  globally, using the following attributes.\n\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) recdef_simp} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) recdef_cong} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) recdef_wf} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    (@@{attribute (HOL) recdef_simp} | @@{attribute (HOL) recdef_cong} |\n      @@{attribute (HOL) recdef_wf}) (() | 'add' | 'del')\n  \\<close>}\n\\<close>\n\n\nsection \\<open>Old-style datatypes \\label{sec:hol-datatype}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"old_datatype\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n    @{command_def (HOL) \"old_rep_datatype\"} & : & @{text \"theory \\<rightarrow> proof(prove)\"} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) old_datatype} (spec + @'and')\n    ;\n    @@{command (HOL) old_rep_datatype} ('(' (@{syntax name} +) ')')? (@{syntax term} +)\n    ;\n\n    spec: @{syntax typespec_sorts} @{syntax mixfix}? '=' (cons + '|')\n    ;\n    cons: @{syntax name} (@{syntax type} * ) @{syntax mixfix}?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"old_datatype\"} defines old-style inductive\n  datatypes in HOL.\n\n  \\item @{command (HOL) \"old_rep_datatype\"} represents existing types as\n  old-style datatypes.\n\n  \\end{description}\n\n  These commands are mostly obsolete; @{command (HOL) \"datatype\"}\n  should be used instead.\n\n  See @{cite \"isabelle-HOL\"} for more details on datatypes, but beware of\n  the old-style theory syntax being used there!  Apart from proper\n  proof methods for case-analysis and induction, there are also\n  emulations of ML tactics @{method (HOL) case_tac} and @{method (HOL)\n  induct_tac} available, see \\secref{sec:hol-induct-tac}; these admit\n  to refer directly to the internal structure of subgoals (including\n  internally bound parameters).\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>We define a type of finite sequences, with slightly different\n  names than the existing @{typ \"'a list\"} that is already in @{theory\n  Main}:\\<close>\n\ndatatype 'a seq = Empty | Seq 'a \"'a seq\"\n\ntext \\<open>We can now prove some simple lemma by structural induction:\\<close>\n\nlemma \"Seq x xs \\<noteq> xs\"\nproof (induct xs arbitrary: x)\n  case Empty\n  txt \\<open>This case can be proved using the simplifier: the freeness\n    properties of the datatype are already declared as @{attribute\n    simp} rules.\\<close>\n  show \"Seq x Empty \\<noteq> Empty\"\n    by simp\nnext\n  case (Seq y ys)\n  txt \\<open>The step case is proved similarly.\\<close>\n  show \"Seq x (Seq y ys) \\<noteq> Seq y ys\"\n    using \\<open>Seq y ys \\<noteq> ys\\<close> by simp\nqed\n\ntext \\<open>Here is a more succinct version of the same proof:\\<close>\n\nlemma \"Seq x xs \\<noteq> xs\"\n  by (induct xs arbitrary: x) simp_all\n\n\nsection \\<open>Records \\label{sec:hol-record}\\<close>\n\ntext \\<open>\n  In principle, records merely generalize the concept of tuples, where\n  components may be addressed by labels instead of just position.  The\n  logical infrastructure of records in Isabelle/HOL is slightly more\n  advanced, though, supporting truly extensible record schemes.  This\n  admits operations that are polymorphic with respect to record\n  extension, yielding ``object-oriented'' effects like (single)\n  inheritance.  See also @{cite \"NaraschewskiW-TPHOLs98\"} for more\n  details on object-oriented verification and record subtyping in HOL.\n\\<close>\n\n\nsubsection \\<open>Basic concepts\\<close>\n\ntext \\<open>\n  Isabelle/HOL supports both \\emph{fixed} and \\emph{schematic} records\n  at the level of terms and types.  The notation is as follows:\n\n  \\begin{center}\n  \\begin{tabular}{l|l|l}\n    & record terms & record types \\\\ \\hline\n    fixed & @{text \"\\<lparr>x = a, y = b\\<rparr>\"} & @{text \"\\<lparr>x :: A, y :: B\\<rparr>\"} \\\\\n    schematic & @{text \"\\<lparr>x = a, y = b, \\<dots> = m\\<rparr>\"} &\n      @{text \"\\<lparr>x :: A, y :: B, \\<dots> :: M\\<rparr>\"} \\\\\n  \\end{tabular}\n  \\end{center}\n\n  \\noindent The ASCII representation of @{text \"\\<lparr>x = a\\<rparr>\"} is @{text\n  \"(| x = a |)\"}.\n\n  A fixed record @{text \"\\<lparr>x = a, y = b\\<rparr>\"} has field @{text x} of value\n  @{text a} and field @{text y} of value @{text b}.  The corresponding\n  type is @{text \"\\<lparr>x :: A, y :: B\\<rparr>\"}, assuming that @{text \"a :: A\"}\n  and @{text \"b :: B\"}.\n\n  A record scheme like @{text \"\\<lparr>x = a, y = b, \\<dots> = m\\<rparr>\"} contains fields\n  @{text x} and @{text y} as before, but also possibly further fields\n  as indicated by the ``@{text \"\\<dots>\"}'' notation (which is actually part\n  of the syntax).  The improper field ``@{text \"\\<dots>\"}'' of a record\n  scheme is called the \\emph{more part}.  Logically it is just a free\n  variable, which is occasionally referred to as ``row variable'' in\n  the literature.  The more part of a record scheme may be\n  instantiated by zero or more further components.  For example, the\n  previous scheme may get instantiated to @{text \"\\<lparr>x = a, y = b, z =\n  c, \\<dots> = m'\\<rparr>\"}, where @{text m'} refers to a different more part.\n  Fixed records are special instances of record schemes, where\n  ``@{text \"\\<dots>\"}'' is properly terminated by the @{text \"() :: unit\"}\n  element.  In fact, @{text \"\\<lparr>x = a, y = b\\<rparr>\"} is just an abbreviation\n  for @{text \"\\<lparr>x = a, y = b, \\<dots> = ()\\<rparr>\"}.\n\n  \\medskip Two key observations make extensible records in a simply\n  typed language like HOL work out:\n\n  \\begin{enumerate}\n\n  \\item the more part is internalized, as a free term or type\n  variable,\n\n  \\item field names are externalized, they cannot be accessed within\n  the logic as first-class values.\n\n  \\end{enumerate}\n\n  \\medskip In Isabelle/HOL record types have to be defined explicitly,\n  fixing their field names and types, and their (optional) parent\n  record.  Afterwards, records may be formed using above syntax, while\n  obeying the canonical order of fields as given by their declaration.\n  The record package provides several standard operations like\n  selectors and updates.  The common setup for various generic proof\n  tools enable succinct reasoning patterns.  See also the Isabelle/HOL\n  tutorial @{cite \"isabelle-hol-book\"} for further instructions on using\n  records in practice.\n\\<close>\n\n\nsubsection \\<open>Record specifications\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"record\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) record} @{syntax typespec_sorts} '=' \\<newline>\n      (@{syntax type} '+')? (constdecl +)\n    ;\n    constdecl: @{syntax name} '::' @{syntax type} @{syntax mixfix}?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"record\"}~@{text \"(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t = \\<tau> + c\\<^sub>1 :: \\<sigma>\\<^sub>1\n  \\<dots> c\\<^sub>n :: \\<sigma>\\<^sub>n\"} defines extensible record type @{text \"(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\"},\n  derived from the optional parent record @{text \"\\<tau>\"} by adding new\n  field components @{text \"c\\<^sub>i :: \\<sigma>\\<^sub>i\"} etc.\n\n  The type variables of @{text \"\\<tau>\"} and @{text \"\\<sigma>\\<^sub>i\"} need to be\n  covered by the (distinct) parameters @{text \"\\<alpha>\\<^sub>1, \\<dots>,\n  \\<alpha>\\<^sub>m\"}.  Type constructor @{text t} has to be new, while @{text\n  \\<tau>} needs to specify an instance of an existing record type.  At\n  least one new field @{text \"c\\<^sub>i\"} has to be specified.\n  Basically, field names need to belong to a unique record.  This is\n  not a real restriction in practice, since fields are qualified by\n  the record name internally.\n\n  The parent record specification @{text \\<tau>} is optional; if omitted\n  @{text t} becomes a root record.  The hierarchy of all records\n  declared within a theory context forms a forest structure, i.e.\\ a\n  set of trees starting with a root record each.  There is no way to\n  merge multiple parent records!\n\n  For convenience, @{text \"(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\"} is made a\n  type abbreviation for the fixed record type @{text \"\\<lparr>c\\<^sub>1 ::\n  \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n\\<rparr>\"}, likewise is @{text\n  \"(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m, \\<zeta>) t_scheme\"} made an abbreviation for\n  @{text \"\\<lparr>c\\<^sub>1 :: \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n, \\<dots> ::\n  \\<zeta>\\<rparr>\"}.\n\n  \\end{description}\n\\<close>\n\n\nsubsection \\<open>Record operations\\<close>\n\ntext \\<open>\n  Any record definition of the form presented above produces certain\n  standard operations.  Selectors and updates are provided for any\n  field, including the improper one ``@{text more}''.  There are also\n  cumulative record constructor functions.  To simplify the\n  presentation below, we assume for now that @{text \"(\\<alpha>\\<^sub>1, \\<dots>,\n  \\<alpha>\\<^sub>m) t\"} is a root record with fields @{text \"c\\<^sub>1 ::\n  \\<sigma>\\<^sub>1, \\<dots>, c\\<^sub>n :: \\<sigma>\\<^sub>n\"}.\n\n  \\medskip \\textbf{Selectors} and \\textbf{updates} are available for\n  any field (including ``@{text more}''):\n\n  \\begin{matharray}{lll}\n    @{text \"c\\<^sub>i\"} & @{text \"::\"} & @{text \"\\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<sigma>\\<^sub>i\"} \\\\\n    @{text \"c\\<^sub>i_update\"} & @{text \"::\"} & @{text \"\\<sigma>\\<^sub>i \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\"} \\\\\n  \\end{matharray}\n\n  There is special syntax for application of updates: @{text \"r\\<lparr>x :=\n  a\\<rparr>\"} abbreviates term @{text \"x_update a r\"}.  Further notation for\n  repeated updates is also available: @{text \"r\\<lparr>x := a\\<rparr>\\<lparr>y := b\\<rparr>\\<lparr>z :=\n  c\\<rparr>\"} may be written @{text \"r\\<lparr>x := a, y := b, z := c\\<rparr>\"}.  Note that\n  because of postfix notation the order of fields shown here is\n  reverse than in the actual term.  Since repeated updates are just\n  function applications, fields may be freely permuted in @{text \"\\<lparr>x\n  := a, y := b, z := c\\<rparr>\"}, as far as logical equality is concerned.\n  Thus commutativity of independent updates can be proven within the\n  logic for any two fields, but not as a general theorem.\n\n  \\medskip The \\textbf{make} operation provides a cumulative record\n  constructor function:\n\n  \\begin{matharray}{lll}\n    @{text \"t.make\"} & @{text \"::\"} & @{text \"\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\"} \\\\\n  \\end{matharray}\n\n  \\medskip We now reconsider the case of non-root records, which are\n  derived of some parent.  In general, the latter may depend on\n  another parent as well, resulting in a list of \\emph{ancestor\n  records}.  Appending the lists of fields of all ancestors results in\n  a certain field prefix.  The record package automatically takes care\n  of this by lifting operations over this context of ancestor fields.\n  Assuming that @{text \"(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>m) t\"} has ancestor\n  fields @{text \"b\\<^sub>1 :: \\<rho>\\<^sub>1, \\<dots>, b\\<^sub>k :: \\<rho>\\<^sub>k\"},\n  the above record operations will get the following types:\n\n  \\medskip\n  \\begin{tabular}{lll}\n    @{text \"c\\<^sub>i\"} & @{text \"::\"} & @{text \"\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<sigma>\\<^sub>i\"} \\\\\n    @{text \"c\\<^sub>i_update\"} & @{text \"::\"} & @{text \"\\<sigma>\\<^sub>i \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\"} \\\\\n    @{text \"t.make\"} & @{text \"::\"} & @{text \"\\<rho>\\<^sub>1 \\<Rightarrow> \\<dots> \\<rho>\\<^sub>k \\<Rightarrow> \\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow>\n      \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\"} \\\\\n  \\end{tabular}\n  \\medskip\n\n  \\noindent Some further operations address the extension aspect of a\n  derived record scheme specifically: @{text \"t.fields\"} produces a\n  record fragment consisting of exactly the new fields introduced here\n  (the result may serve as a more part elsewhere); @{text \"t.extend\"}\n  takes a fixed record and adds a given more part; @{text\n  \"t.truncate\"} restricts a record scheme to a fixed record.\n\n  \\medskip\n  \\begin{tabular}{lll}\n    @{text \"t.fields\"} & @{text \"::\"} & @{text \"\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>n \\<Rightarrow> \\<lparr>\\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\"} \\\\\n    @{text \"t.extend\"} & @{text \"::\"} & @{text \"\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr> \\<Rightarrow>\n      \\<zeta> \\<Rightarrow> \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr>\"} \\\\\n    @{text \"t.truncate\"} & @{text \"::\"} & @{text \"\\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>, \\<dots> :: \\<zeta>\\<rparr> \\<Rightarrow> \\<lparr>\\<^vec>b :: \\<^vec>\\<rho>, \\<^vec>c :: \\<^vec>\\<sigma>\\<rparr>\"} \\\\\n  \\end{tabular}\n  \\medskip\n\n  \\noindent Note that @{text \"t.make\"} and @{text \"t.fields\"} coincide\n  for root records.\n\\<close>\n\n\nsubsection \\<open>Derived rules and proof tools\\<close>\n\ntext \\<open>\n  The record package proves several results internally, declaring\n  these facts to appropriate proof tools.  This enables users to\n  reason about record structures quite conveniently.  Assume that\n  @{text t} is a record type as specified above.\n\n  \\begin{enumerate}\n\n  \\item Standard conversions for selectors or updates applied to\n  record constructor terms are made part of the default Simplifier\n  context; thus proofs by reduction of basic operations merely require\n  the @{method simp} method without further arguments.  These rules\n  are available as @{text \"t.simps\"}, too.\n\n  \\item Selectors applied to updated records are automatically reduced\n  by an internal simplification procedure, which is also part of the\n  standard Simplifier setup.\n\n  \\item Inject equations of a form analogous to @{prop \"(x, y) = (x',\n  y') \\<equiv> x = x' \\<and> y = y'\"} are declared to the Simplifier and Classical\n  Reasoner as @{attribute iff} rules.  These rules are available as\n  @{text \"t.iffs\"}.\n\n  \\item The introduction rule for record equality analogous to @{text\n  \"x r = x r' \\<Longrightarrow> y r = y r' \\<dots> \\<Longrightarrow> r = r'\"} is declared to the Simplifier,\n  and as the basic rule context as ``@{attribute intro}@{text \"?\"}''.\n  The rule is called @{text \"t.equality\"}.\n\n  \\item Representations of arbitrary record expressions as canonical\n  constructor terms are provided both in @{method cases} and @{method\n  induct} format (cf.\\ the generic proof methods of the same name,\n  \\secref{sec:cases-induct}).  Several variations are available, for\n  fixed records, record schemes, more parts etc.\n\n  The generic proof methods are sufficiently smart to pick the most\n  sensible rule according to the type of the indicated record\n  expression: users just need to apply something like ``@{text \"(cases\n  r)\"}'' to a certain proof problem.\n\n  \\item The derived record operations @{text \"t.make\"}, @{text\n  \"t.fields\"}, @{text \"t.extend\"}, @{text \"t.truncate\"} are \\emph{not}\n  treated automatically, but usually need to be expanded by hand,\n  using the collective fact @{text \"t.defs\"}.\n\n  \\end{enumerate}\n\\<close>\n\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>See @{file \"~~/src/HOL/ex/Records.thy\"}, for example.\\<close>\n\nsection \\<open>Typedef axiomatization \\label{sec:hol-typedef}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"typedef\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"} \\\\\n  \\end{matharray}\n\n  A Gordon/HOL-style type definition is a certain axiom scheme that\n  identifies a new type with a subset of an existing type.  More\n  precisely, the new type is defined by exhibiting an existing type\n  @{text \\<tau>}, a set @{text \"A :: \\<tau> set\"}, and a theorem that proves\n  @{prop \"\\<exists>x. x \\<in> A\"}.  Thus @{text A} is a non-empty subset of @{text\n  \\<tau>}, and the new type denotes this subset.  New functions are\n  postulated that establish an isomorphism between the new type and\n  the subset.  In general, the type @{text \\<tau>} may involve type\n  variables @{text \"\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n\"} which means that the type definition\n  produces a type constructor @{text \"(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n) t\"} depending on\n  those type arguments.\n\n  The axiomatization can be considered a ``definition'' in the sense of the\n  particular set-theoretic interpretation of HOL @{cite pitts93}, where the\n  universe of types is required to be downwards-closed wrt.\\ arbitrary\n  non-empty subsets. Thus genuinely new types introduced by @{command\n  \"typedef\"} stay within the range of HOL models by construction.\n\n  In contrast, the command @{command_ref type_synonym} from Isabelle/Pure\n  merely introduces syntactic abbreviations, without any logical\n  significance. Thus it is more faithful to the idea of a genuine type\n  definition, but less powerful in practice.\n\n  @{rail \\<open>\n    @@{command (HOL) typedef} abs_type '=' rep_set\n    ;\n    abs_type: @{syntax typespec_sorts} @{syntax mixfix}?\n    ;\n    rep_set: @{syntax term} (@'morphisms' @{syntax name} @{syntax name})?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"typedef\"}~@{text \"(\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n) t = A\"} produces an\n  axiomatization (\\secref{sec:axiomatizations}) for a type definition in the\n  background theory of the current context, depending on a non-emptiness\n  result of the set @{text A} that needs to be proven here. The set @{text\n  A} may contain type variables @{text \"\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n\"} as specified on the\n  LHS, but no term variables.\n\n  Even though a local theory specification, the newly introduced type\n  constructor cannot depend on parameters or assumptions of the\n  context: this is structurally impossible in HOL.  In contrast, the\n  non-emptiness proof may use local assumptions in unusual situations,\n  which could result in different interpretations in target contexts:\n  the meaning of the bijection between the representing set @{text A}\n  and the new type @{text t} may then change in different application\n  contexts.\n\n  For @{command (HOL) \"typedef\"}~@{text \"t = A\"} the newly introduced\n  type @{text t} is accompanied by a pair of morphisms to relate it to\n  the representing set over the old type.  By default, the injection\n  from type to set is called @{text Rep_t} and its inverse @{text\n  Abs_t}: An explicit @{keyword (HOL) \"morphisms\"} specification\n  allows to provide alternative names.\n\n  The core axiomatization uses the locale predicate @{const\n  type_definition} as defined in Isabelle/HOL.  Various basic\n  consequences of that are instantiated accordingly, re-using the\n  locale facts with names derived from the new type constructor.  Thus\n  the generic @{thm type_definition.Rep} is turned into the specific\n  @{text \"Rep_t\"}, for example.\n\n  Theorems @{thm type_definition.Rep}, @{thm\n  type_definition.Rep_inverse}, and @{thm type_definition.Abs_inverse}\n  provide the most basic characterization as a corresponding\n  injection/surjection pair (in both directions).  The derived rules\n  @{thm type_definition.Rep_inject} and @{thm\n  type_definition.Abs_inject} provide a more convenient version of\n  injectivity, suitable for automated proof tools (e.g.\\ in\n  declarations involving @{attribute simp} or @{attribute iff}).\n  Furthermore, the rules @{thm type_definition.Rep_cases}~/ @{thm\n  type_definition.Rep_induct}, and @{thm type_definition.Abs_cases}~/\n  @{thm type_definition.Abs_induct} provide alternative views on\n  surjectivity.  These rules are already declared as set or type rules\n  for the generic @{method cases} and @{method induct} methods,\n  respectively.\n\n  \\end{description}\n\\<close>\n\nsubsubsection \\<open>Examples\\<close>\n\ntext \\<open>Type definitions permit the introduction of abstract data\n  types in a safe way, namely by providing models based on already\n  existing types.  Given some abstract axiomatic description @{text P}\n  of a type, this involves two steps:\n\n  \\begin{enumerate}\n\n  \\item Find an appropriate type @{text \\<tau>} and subset @{text A} which\n  has the desired properties @{text P}, and make a type definition\n  based on this representation.\n\n  \\item Prove that @{text P} holds for @{text \\<tau>} by lifting @{text P}\n  from the representation.\n\n  \\end{enumerate}\n\n  You can later forget about the representation and work solely in\n  terms of the abstract properties @{text P}.\n\n  \\medskip The following trivial example pulls a three-element type\n  into existence within the formal logical environment of HOL.\\<close>\n\ntypedef three = \"{(True, True), (True, False), (False, True)}\"\n  by blast\n\ndefinition \"One = Abs_three (True, True)\"\ndefinition \"Two = Abs_three (True, False)\"\ndefinition \"Three = Abs_three (False, True)\"\n\nlemma three_distinct: \"One \\<noteq> Two\"  \"One \\<noteq> Three\"  \"Two \\<noteq> Three\"\n  by (simp_all add: One_def Two_def Three_def Abs_three_inject)\n\nlemma three_cases:\n  fixes x :: three obtains \"x = One\" | \"x = Two\" | \"x = Three\"\n  by (cases x) (auto simp: One_def Two_def Three_def Abs_three_inject)\n\ntext \\<open>Note that such trivial constructions are better done with\n  derived specification mechanisms such as @{command datatype}:\\<close>\n\ndatatype three' = One' | Two' | Three'\n\ntext \\<open>This avoids re-doing basic definitions and proofs from the\n  primitive @{command typedef} above.\\<close>\n\n\n\nsection \\<open>Functorial structure of types\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"functor\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"}\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) functor} (@{syntax name} ':')? @{syntax term}\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"functor\"}~@{text \"prefix: m\"} allows to\n  prove and register properties about the functorial structure of type\n  constructors.  These properties then can be used by other packages\n  to deal with those type constructors in certain type constructions.\n  Characteristic theorems are noted in the current local theory.  By\n  default, they are prefixed with the base name of the type\n  constructor, an explicit prefix can be given alternatively.\n\n  The given term @{text \"m\"} is considered as \\emph{mapper} for the\n  corresponding type constructor and must conform to the following\n  type pattern:\n\n  \\begin{matharray}{lll}\n    @{text \"m\"} & @{text \"::\"} &\n      @{text \"\\<sigma>\\<^sub>1 \\<Rightarrow> \\<dots> \\<sigma>\\<^sub>k \\<Rightarrow> (\\<^vec>\\<alpha>\\<^sub>n) t \\<Rightarrow> (\\<^vec>\\<beta>\\<^sub>n) t\"} \\\\\n  \\end{matharray}\n\n  \\noindent where @{text t} is the type constructor, @{text\n  \"\\<^vec>\\<alpha>\\<^sub>n\"} and @{text \"\\<^vec>\\<beta>\\<^sub>n\"} are distinct\n  type variables free in the local theory and @{text \"\\<sigma>\\<^sub>1\"},\n  \\ldots, @{text \"\\<sigma>\\<^sub>k\"} is a subsequence of @{text \"\\<alpha>\\<^sub>1 \\<Rightarrow>\n  \\<beta>\\<^sub>1\"}, @{text \"\\<beta>\\<^sub>1 \\<Rightarrow> \\<alpha>\\<^sub>1\"}, \\ldots,\n  @{text \"\\<alpha>\\<^sub>n \\<Rightarrow> \\<beta>\\<^sub>n\"}, @{text \"\\<beta>\\<^sub>n \\<Rightarrow>\n  \\<alpha>\\<^sub>n\"}.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Quotient types\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"quotient_type\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"}\\\\\n    @{command_def (HOL) \"quotient_definition\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"}\\\\\n    @{command_def (HOL) \"print_quotmapsQ3\"} & : & @{text \"context \\<rightarrow>\"}\\\\\n    @{command_def (HOL) \"print_quotientsQ3\"} & : & @{text \"context \\<rightarrow>\"}\\\\\n    @{command_def (HOL) \"print_quotconsts\"} & : & @{text \"context \\<rightarrow>\"}\\\\\n    @{method_def (HOL) \"lifting\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"lifting_setup\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"descending\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"descending_setup\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"partiality_descending\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"partiality_descending_setup\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"regularize\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"injection\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"cleaning\"} & : & @{text method} \\\\\n    @{attribute_def (HOL) \"quot_thm\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"quot_lifted\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"quot_respect\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"quot_preserve\"} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  The quotient package defines a new quotient type given a raw type\n  and a partial equivalence relation. The package also historically \n  includes automation for transporting definitions and theorems. \n  But most of this automation was superseded by the Lifting and Transfer\n  packages. The user should consider using these two new packages for\n  lifting definitions and transporting theorems.\n\n  @{rail \\<open>\n    @@{command (HOL) quotient_type} (spec)\n    ;\n    spec: @{syntax typespec} @{syntax mixfix}? '=' \\<newline>\n     @{syntax type} '/' ('partial' ':')? @{syntax term} \\<newline>\n     (@'morphisms' @{syntax name} @{syntax name})? (@'parametric' @{syntax thmref})?\n  \\<close>}\n\n  @{rail \\<open>\n    @@{command (HOL) quotient_definition} constdecl? @{syntax thmdecl}? \\<newline>\n    @{syntax term} 'is' @{syntax term}\n    ;\n    constdecl: @{syntax name} ('::' @{syntax type})? @{syntax mixfix}?\n  \\<close>}\n\n  @{rail \\<open>\n    @@{method (HOL) lifting} @{syntax thmrefs}?\n    ;\n    @@{method (HOL) lifting_setup} @{syntax thmrefs}?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"quotient_type\"} defines a new quotient type @{text \\<tau>}. The\n  injection from a quotient type to a raw type is called @{text\n  rep_\\<tau>}, its inverse @{text abs_\\<tau>} unless explicit @{keyword (HOL)\n  \"morphisms\"} specification provides alternative names. @{command\n  (HOL) \"quotient_type\"} requires the user to prove that the relation\n  is an equivalence relation (predicate @{text equivp}), unless the\n  user specifies explicitly @{text partial} in which case the\n  obligation is @{text part_equivp}.  A quotient defined with @{text\n  partial} is weaker in the sense that less things can be proved\n  automatically.\n\n  The command internally proves a Quotient theorem and sets up the Lifting\n  package by the command @{command (HOL) setup_lifting}. Thus the Lifting \n  and Transfer packages can be used also with quotient types defined by\n  @{command (HOL) \"quotient_type\"} without any extra set-up. The parametricity \n  theorem for the equivalence relation R can be provided as an extra argument \n  of the command and is passed to the corresponding internal call of @{command (HOL) setup_lifting}.\n  This theorem allows the Lifting package to generate a stronger transfer rule for equality.\n  \n  \\end{description}\n\n  The most of the rest of the package was superseded by the Lifting and Transfer\n  packages. The user should consider using these two new packages for\n  lifting definitions and transporting theorems.\n\n  \\begin{description}  \n\n  \\item @{command (HOL) \"quotient_definition\"} defines a constant on\n  the quotient type.\n\n  \\item @{command (HOL) \"print_quotmapsQ3\"} prints quotient map\n  functions.\n\n  \\item @{command (HOL) \"print_quotientsQ3\"} prints quotients.\n\n  \\item @{command (HOL) \"print_quotconsts\"} prints quotient constants.\n\n  \\item @{method (HOL) \"lifting\"} and @{method (HOL) \"lifting_setup\"}\n    methods match the current goal with the given raw theorem to be\n    lifted producing three new subgoals: regularization, injection and\n    cleaning subgoals. @{method (HOL) \"lifting\"} tries to apply the\n    heuristics for automatically solving these three subgoals and\n    leaves only the subgoals unsolved by the heuristics to the user as\n    opposed to @{method (HOL) \"lifting_setup\"} which leaves the three\n    subgoals unsolved.\n\n  \\item @{method (HOL) \"descending\"} and @{method (HOL)\n    \"descending_setup\"} try to guess a raw statement that would lift\n    to the current subgoal. Such statement is assumed as a new subgoal\n    and @{method (HOL) \"descending\"} continues in the same way as\n    @{method (HOL) \"lifting\"} does. @{method (HOL) \"descending\"} tries\n    to solve the arising regularization, injection and cleaning\n    subgoals with the analogous method @{method (HOL)\n    \"descending_setup\"} which leaves the four unsolved subgoals.\n\n  \\item @{method (HOL) \"partiality_descending\"} finds the regularized\n    theorem that would lift to the current subgoal, lifts it and\n    leaves as a subgoal. This method can be used with partial\n    equivalence quotients where the non regularized statements would\n    not be true. @{method (HOL) \"partiality_descending_setup\"} leaves\n    the injection and cleaning subgoals unchanged.\n\n  \\item @{method (HOL) \"regularize\"} applies the regularization\n    heuristics to the current subgoal.\n\n  \\item @{method (HOL) \"injection\"} applies the injection heuristics\n    to the current goal using the stored quotient respectfulness\n    theorems.\n\n  \\item @{method (HOL) \"cleaning\"} applies the injection cleaning\n    heuristics to the current subgoal using the stored quotient\n    preservation theorems.\n\n  \\item @{attribute (HOL) quot_lifted} attribute tries to\n    automatically transport the theorem to the quotient type.\n    The attribute uses all the defined quotients types and quotient\n    constants often producing undesired results or theorems that\n    cannot be lifted.\n\n  \\item @{attribute (HOL) quot_respect} and @{attribute (HOL)\n    quot_preserve} attributes declare a theorem as a respectfulness\n    and preservation theorem respectively.  These are stored in the\n    local theory store and used by the @{method (HOL) \"injection\"}\n    and @{method (HOL) \"cleaning\"} methods respectively.\n\n  \\item @{attribute (HOL) quot_thm} declares that a certain theorem\n    is a quotient extension theorem. Quotient extension theorems\n    allow for quotienting inside container types. Given a polymorphic\n    type that serves as a container, a map function defined for this\n    container using @{command (HOL) \"functor\"} and a relation\n    map defined for for the container type, the quotient extension\n    theorem should be @{term \"Quotient3 R Abs Rep \\<Longrightarrow> Quotient3\n    (rel_map R) (map Abs) (map Rep)\"}. Quotient extension theorems\n    are stored in a database and are used all the steps of lifting\n    theorems.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Definition by specification \\label{sec:hol-specification}\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"specification\"} & : & @{text \"theory \\<rightarrow> proof(prove)\"} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) specification} '(' (decl +) ')' \\<newline>\n      (@{syntax thmdecl}? @{syntax prop} +)\n    ;\n    decl: (@{syntax name} ':')? @{syntax term} ('(' @'overloaded' ')')?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"specification\"}~@{text \"decls \\<phi>\"} sets up a\n  goal stating the existence of terms with the properties specified to\n  hold for the constants given in @{text decls}.  After finishing the\n  proof, the theory will be augmented with definitions for the given\n  constants, as well as with theorems stating the properties for these\n  constants.\n\n  @{text decl} declares a constant to be defined by the\n  specification given.  The definition for the constant @{text c} is\n  bound to the name @{text c_def} unless a theorem name is given in\n  the declaration.  Overloaded constants should be declared as such.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Adhoc overloading of constants\\<close>\n\ntext \\<open>\n  \\begin{tabular}{rcll}\n  @{command_def \"adhoc_overloading\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n  @{command_def \"no_adhoc_overloading\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n  @{attribute_def \"show_variants\"} & : & @{text \"attribute\"} & default @{text false} \\\\\n  \\end{tabular}\n\n  \\medskip\n\n  Adhoc overloading allows to overload a constant depending on\n  its type. Typically this involves the introduction of an\n  uninterpreted constant (used for input and output) and the addition\n  of some variants (used internally). For examples see\n  @{file \"~~/src/HOL/ex/Adhoc_Overloading_Examples.thy\"} and\n  @{file \"~~/src/HOL/Library/Monad_Syntax.thy\"}.\n\n  @{rail \\<open>\n    (@@{command adhoc_overloading} | @@{command no_adhoc_overloading})\n      (@{syntax nameref} (@{syntax term} + ) + @'and')\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command \"adhoc_overloading\"}~@{text \"c v\\<^sub>1 ... v\\<^sub>n\"}\n  associates variants with an existing constant.\n\n  \\item @{command \"no_adhoc_overloading\"} is similar to\n  @{command \"adhoc_overloading\"}, but removes the specified variants\n  from the present context.\n  \n  \\item @{attribute \"show_variants\"} controls printing of variants\n  of overloaded constants. If enabled, the internally used variants\n  are printed instead of their respective overloaded constants. This\n  is occasionally useful to check whether the system agrees with a\n  user's expectations about derived variants.\n\n  \\end{description}\n\\<close>\n\n\nchapter \\<open>Proof tools\\<close>\n\nsection \\<open>Adhoc tuples\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) split_format}@{text \"\\<^sup>*\"} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{attribute (HOL) split_format} ('(' 'complete' ')')?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{attribute (HOL) split_format}\\ @{text \"(complete)\"} causes\n  arguments in function applications to be represented canonically\n  according to their tuple type structure.\n\n  Note that this operation tends to invent funny names for new local\n  parameters introduced.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Transfer package\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"transfer\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"transfer'\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"transfer_prover\"} & : & @{text method} \\\\\n    @{attribute_def (HOL) \"Transfer.transferred\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"untransferred\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"transfer_rule\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"transfer_domain_rule\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"relator_eq\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"relator_domain\"} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  \\begin{description}\n\n  \\item @{method (HOL) \"transfer\"} method replaces the current subgoal\n    with a logically equivalent one that uses different types and\n    constants. The replacement of types and constants is guided by the\n    database of transfer rules. Goals are generalized over all free\n    variables by default; this is necessary for variables whose types\n    change, but can be overridden for specific variables with e.g.\n    @{text \"transfer fixing: x y z\"}.\n\n  \\item @{method (HOL) \"transfer'\"} is a variant of @{method (HOL)\n    transfer} that allows replacing a subgoal with one that is\n    logically stronger (rather than equivalent). For example, a\n    subgoal involving equality on a quotient type could be replaced\n    with a subgoal involving equality (instead of the corresponding\n    equivalence relation) on the underlying raw type.\n\n  \\item @{method (HOL) \"transfer_prover\"} method assists with proving\n    a transfer rule for a new constant, provided the constant is\n    defined in terms of other constants that already have transfer\n    rules. It should be applied after unfolding the constant\n    definitions.\n\n  \\item @{attribute (HOL) \"untransferred\"} proves the same equivalent theorem\n     as @{method (HOL) \"transfer\"} internally does.\n\n  \\item @{attribute (HOL) Transfer.transferred} works in the opposite\n    direction than @{method (HOL) \"transfer'\"}. E.g., given the transfer\n    relation @{text \"ZN x n \\<equiv> (x = int n)\"}, corresponding transfer rules and the theorem\n    @{text \"\\<forall>x::int \\<in> {0..}. x < x + 1\"}, the attribute would prove \n    @{text \"\\<forall>n::nat. n < n + 1\"}. The attribute is still in experimental\n    phase of development.\n\n  \\item @{attribute (HOL) \"transfer_rule\"} attribute maintains a\n    collection of transfer rules, which relate constants at two\n    different types. Typical transfer rules may relate different type\n    instances of the same polymorphic constant, or they may relate an\n    operation on a raw type to a corresponding operation on an\n    abstract type (quotient or subtype). For example:\n\n    @{text \"((A ===> B) ===> list_all2 A ===> list_all2 B) map map\"}\\\\\n    @{text \"(cr_int ===> cr_int ===> cr_int) (\\<lambda>(x,y) (u,v). (x+u, y+v)) plus\"}\n\n    Lemmas involving predicates on relations can also be registered\n    using the same attribute. For example:\n\n    @{text \"bi_unique A \\<Longrightarrow> (list_all2 A ===> op =) distinct distinct\"}\\\\\n    @{text \"\\<lbrakk>bi_unique A; bi_unique B\\<rbrakk> \\<Longrightarrow> bi_unique (rel_prod A B)\"}\n\n    Preservation of predicates on relations (@{text \"bi_unique, bi_total,\n    right_unique, right_total, left_unique, left_total\"}) with the respect to a relator\n    is proved automatically if the involved type is BNF\n    @{cite \"isabelle-datatypes\"} without dead variables.\n\n  \\item @{attribute (HOL) \"transfer_domain_rule\"} attribute maintains a collection\n    of rules, which specify a domain of a transfer relation by a predicate.\n    E.g., given the transfer relation @{text \"ZN x n \\<equiv> (x = int n)\"}, \n    one can register the following transfer domain rule: \n    @{text \"Domainp ZN = (\\<lambda>x. x \\<ge> 0)\"}. The rules allow the package to produce\n    more readable transferred goals, e.g., when quantifiers are transferred.\n\n  \\item @{attribute (HOL) relator_eq} attribute collects identity laws\n    for relators of various type constructors, e.g. @{term \"rel_set\n    (op =) = (op =)\"}. The @{method (HOL) transfer} method uses these\n    lemmas to infer transfer rules for non-polymorphic constants on\n    the fly. For examples see @{file\n    \"~~/src/HOL/Lifting_Set.thy\"} or @{file \"~~/src/HOL/Lifting.thy\"}. \n    This property is proved automatically if the involved type is BNF without dead variables.\n\n  \\item @{attribute_def (HOL) \"relator_domain\"} attribute collects rules \n    describing domains of relators by predicators. E.g., \n    @{term \"Domainp (rel_set T) = (\\<lambda>A. Ball A (Domainp T))\"}. This allows the package \n    to lift transfer domain rules through type constructors. For examples see @{file\n    \"~~/src/HOL/Lifting_Set.thy\"} or @{file \"~~/src/HOL/Lifting.thy\"}.\n    This property is proved automatically if the involved type is BNF without dead variables.\n\n  \\end{description}\n\n  Theoretical background can be found in @{cite \"Huffman-Kuncar:2013:lifting_transfer\"}.\n\\<close>\n\n\nsection \\<open>Lifting package\\<close>\n\ntext \\<open>\n  The Lifting package allows users to lift terms of the raw type to the abstract type, which is \n  a necessary step in building a library for an abstract type. Lifting defines a new constant \n  by combining coercion functions (Abs and Rep) with the raw term. It also proves an appropriate \n  transfer rule for the Transfer package and, if possible, an equation for the code generator.\n\n  The Lifting package provides two main commands: @{command (HOL) \"setup_lifting\"} for initializing \n  the package to work with a new type, and @{command (HOL) \"lift_definition\"} for lifting constants. \n  The Lifting package works with all four kinds of type abstraction: type copies, subtypes, \n  total quotients and partial quotients.\n\n  Theoretical background can be found in @{cite \"Huffman-Kuncar:2013:lifting_transfer\"}.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"setup_lifting\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"}\\\\\n    @{command_def (HOL) \"lift_definition\"} & : & @{text \"local_theory \\<rightarrow> proof(prove)\"}\\\\\n    @{command_def (HOL) \"lifting_forget\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"}\\\\\n    @{command_def (HOL) \"lifting_update\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"}\\\\\n    @{command_def (HOL) \"print_quot_maps\"} & : & @{text \"context \\<rightarrow>\"}\\\\\n    @{command_def (HOL) \"print_quotients\"} & : & @{text \"context \\<rightarrow>\"}\\\\\n    @{attribute_def (HOL) \"quot_map\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"relator_eq_onp\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"relator_mono\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"relator_distr\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"quot_del\"} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) \"lifting_restore\"} & : & @{text attribute} \\\\   \n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) setup_lifting} ('(' 'no_code' ')')? \\<newline>\n      @{syntax thmref} @{syntax thmref}? (@'parametric' @{syntax thmref})?;\n  \\<close>}\n\n  @{rail \\<open>\n    @@{command (HOL) lift_definition} @{syntax name} '::' @{syntax type}  @{syntax mixfix}? \\<newline>\n      'is' @{syntax term} (@'parametric' (@{syntax thmref}+))?;\n  \\<close>}\n\n  @{rail \\<open>\n    @@{command (HOL) lifting_forget} @{syntax nameref};\n  \\<close>}\n\n  @{rail \\<open>\n    @@{command (HOL) lifting_update} @{syntax nameref};\n  \\<close>}\n\n  @{rail \\<open>\n    @@{attribute (HOL) lifting_restore} @{syntax thmref} (@{syntax thmref} @{syntax thmref})?;\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"setup_lifting\"} Sets up the Lifting package\n    to work with a user-defined type. \n    The command supports two modes. The first one is a low-level mode when \n    the user must provide as a first\n    argument of @{command (HOL) \"setup_lifting\"} a\n    quotient theorem @{term \"Quotient R Abs Rep T\"}. The\n    package configures a transfer rule for equality, a domain transfer\n    rules and sets up the @{command_def (HOL) \"lift_definition\"}\n    command to work with the abstract type. An optional theorem @{term \"reflp R\"}, which certifies that \n    the equivalence relation R is total,\n    can be provided as a second argument. This allows the package to generate stronger transfer\n    rules. And finally, the parametricity theorem for R can be provided as a third argument.\n    This allows the package to generate a stronger transfer rule for equality.\n\n    Users generally will not prove the @{text Quotient} theorem manually for \n    new types, as special commands exist to automate the process.\n    \n    When a new subtype is defined by @{command (HOL) typedef}, @{command (HOL) \"lift_definition\"} \n    can be used in its\n    second mode, where only the type_definition theorem @{text \"type_definition Rep Abs A\"}\n    is used as an argument of the command. The command internally proves the corresponding \n    Quotient theorem and registers it with @{command (HOL) setup_lifting} using its first mode.\n\n    For quotients, the command @{command (HOL) quotient_type} can be used. The command defines \n    a new quotient type and similarly to the previous case, the corresponding Quotient theorem is proved \n    and registered by @{command (HOL) setup_lifting}.\n    \n    The command @{command (HOL) \"setup_lifting\"} also sets up the code generator\n    for the new type. Later on, when a new constant is defined by @{command (HOL) \"lift_definition\"},\n    the Lifting package proves and registers a code equation (if there is one) for the new constant.\n    If the option @{text \"no_code\"} is specified, the Lifting package does not set up the code\n    generator and as a consequence no code equations involving an abstract type are registered\n    by @{command (HOL) \"lift_definition\"}.\n\n  \\item @{command (HOL) \"lift_definition\"} @{text \"f :: \\<tau>\"} @{keyword (HOL) \"is\"} @{text t}\n    Defines a new function @{text f} with an abstract type @{text \\<tau>}\n    in terms of a corresponding operation @{text t} on a\n    representation type. More formally, if @{text \"t :: \\<sigma>\"}, then\n    the command builds a term @{text \"F\"} as a corresponding combination of abstraction \n    and representation functions such that @{text \"F :: \\<sigma> \\<Rightarrow> \\<tau>\" } and \n    defines @{text f} is as @{text \"f \\<equiv> F t\"}.\n    The term @{text t} does not have to be necessarily a constant but it can be any term.\n\n    The command opens a proof environment and the user must discharge \n    a respectfulness proof obligation. For a type copy, i.e., a typedef with @{text\n    UNIV}, the obligation is discharged automatically. The proof goal is\n    presented in a user-friendly, readable form. A respectfulness\n    theorem in the standard format @{text f.rsp} and a transfer rule\n    @{text f.transfer} for the Transfer package are generated by the\n    package.\n\n    The user can specify a parametricity theorems for @{text t} after the keyword \n    @{keyword \"parametric\"}, which allows the command\n    to generate parametric transfer rules for @{text f}.\n\n    For each constant defined through trivial quotients (type copies or\n    subtypes) @{text f.rep_eq} is generated. The equation is a code certificate\n    that defines @{text f} using the representation function.\n\n    For each constant @{text f.abs_eq} is generated. The equation is unconditional\n    for total quotients. The equation defines @{text f} using\n    the abstraction function.\n\n    Integration with [@{attribute code} abstract]: For subtypes (e.g.,\n    corresponding to a datatype invariant, such as dlist), @{command\n    (HOL) \"lift_definition\"} uses a code certificate theorem\n    @{text f.rep_eq} as a code equation.\n\n    Integration with [@{attribute code} equation]: For total quotients, @{command\n    (HOL) \"lift_definition\"} uses @{text f.abs_eq} as a code equation.\n\n  \\item @{command (HOL) lifting_forget} and  @{command (HOL) lifting_update}\n    These two commands serve for storing and deleting the set-up of\n    the Lifting package and corresponding transfer rules defined by this package.\n    This is useful for hiding of type construction details of an abstract type \n    when the construction is finished but it still allows additions to this construction\n    when this is later necessary.\n\n    Whenever the Lifting package is set up with a new abstract type @{text \"\\<tau>\"} by  \n    @{command_def (HOL) \"lift_definition\"}, the package defines a new bundle\n    that is called @{text \"\\<tau>.lifting\"}. This bundle already includes set-up for the Lifting package. \n    The new transfer rules\n    introduced by @{command (HOL) \"lift_definition\"} can be stored in the bundle by\n    the command @{command (HOL) \"lifting_update\"} @{text \"\\<tau>.lifting\"}.\n\n    The command @{command (HOL) \"lifting_forget\"} @{text \"\\<tau>.lifting\"} deletes set-up of the Lifting \n    package\n    for @{text \\<tau>} and deletes all the transfer rules that were introduced\n    by @{command (HOL) \"lift_definition\"} using @{text \\<tau>} as an abstract type.\n\n    The stored set-up in a bundle can be reintroduced by the Isar commands for including a bundle\n    (@{command \"include\"}, @{keyword \"includes\"} and @{command \"including\"}).\n\n  \\item @{command (HOL) \"print_quot_maps\"} prints stored quotient map\n    theorems.\n\n  \\item @{command (HOL) \"print_quotients\"} prints stored quotient\n    theorems.\n\n  \\item @{attribute (HOL) quot_map} registers a quotient map\n    theorem, a theorem showing how to \"lift\" quotients over type constructors. \n    E.g., @{term \"Quotient R Abs Rep T \\<Longrightarrow> \n    Quotient (rel_set R) (image Abs) (image Rep) (rel_set T)\"}. \n    For examples see @{file\n    \"~~/src/HOL/Lifting_Set.thy\"} or @{file \"~~/src/HOL/Lifting.thy\"}.\n    This property is proved automatically if the involved type is BNF without dead variables.\n\n  \\item @{attribute (HOL) relator_eq_onp} registers a theorem that\n    shows that a relator applied to an equality restricted by a predicate @{term P} (i.e., @{term\n    \"eq_onp P\"}) is equal \n    to a predicator applied to the @{term P}. The combinator @{const eq_onp} is used for \n    internal encoding of proper subtypes. Such theorems allows the package to hide @{text\n    eq_onp} from a user in a user-readable form of a\n    respectfulness theorem. For examples see @{file\n    \"~~/src/HOL/Lifting_Set.thy\"} or @{file \"~~/src/HOL/Lifting.thy\"}.\n    This property is proved automatically if the involved type is BNF without dead variables.\n\n  \\item @{attribute (HOL) \"relator_mono\"} registers a property describing a monotonicity of a relator.\n    E.g., @{term \"A \\<le> B \\<Longrightarrow> rel_set A \\<le> rel_set B\"}. \n    This property is needed for proving a stronger transfer rule in @{command_def (HOL) \"lift_definition\"}\n    when a parametricity theorem for the raw term is specified and also for the reflexivity prover.\n    For examples see @{file\n    \"~~/src/HOL/Lifting_Set.thy\"} or @{file \"~~/src/HOL/Lifting.thy\"}.\n    This property is proved automatically if the involved type is BNF without dead variables.\n\n  \\item @{attribute (HOL) \"relator_distr\"} registers a property describing a distributivity\n    of the relation composition and a relator. E.g., \n    @{text \"rel_set R \\<circ>\\<circ> rel_set S = rel_set (R \\<circ>\\<circ> S)\"}. \n    This property is needed for proving a stronger transfer rule in @{command_def (HOL) \"lift_definition\"}\n    when a parametricity theorem for the raw term is specified.\n    When this equality does not hold unconditionally (e.g., for the function type), the user can specified\n    each direction separately and also register multiple theorems with different set of assumptions.\n    This attribute can be used only after the monotonicity property was already registered by\n    @{attribute (HOL) \"relator_mono\"}. For examples see @{file\n    \"~~/src/HOL/Lifting_Set.thy\"} or @{file \"~~/src/HOL/Lifting.thy\"}.\n    This property is proved automatically if the involved type is BNF without dead variables.\n\n  \\item @{attribute (HOL) quot_del} deletes a corresponding Quotient theorem\n    from the Lifting infrastructure and thus de-register the corresponding quotient. \n    This effectively causes that @{command (HOL) lift_definition}  will not\n    do any lifting for the corresponding type. This attribute is rather used for low-level\n    manipulation with set-up of the Lifting package because @{command (HOL) lifting_forget} is\n    preferred for normal usage.\n\n  \\item @{attribute (HOL) lifting_restore} @{text \"Quotient_thm pcr_def pcr_cr_eq_thm\"} \n    registers the Quotient theorem @{text Quotient_thm} in the Lifting infrastructure \n    and thus sets up lifting for an abstract type @{text \\<tau>} (that is defined by @{text Quotient_thm}).\n    Optional theorems @{text pcr_def} and @{text pcr_cr_eq_thm} can be specified to register \n    the parametrized\n    correspondence relation for @{text \\<tau>}. E.g., for @{text \"'a dlist\"}, @{text pcr_def} is\n    @{text \"pcr_dlist A \\<equiv> list_all2 A \\<circ>\\<circ> cr_dlist\"} and @{text pcr_cr_eq_thm} is \n    @{text \"pcr_dlist op= = op=\"}.\n    This attribute is rather used for low-level\n    manipulation with set-up of the Lifting package because using of the bundle @{text \\<tau>.lifting} \n    together with the commands @{command (HOL) lifting_forget} and @{command (HOL) lifting_update} is\n    preferred for normal usage.\n\n  \\item Integration with the BNF package @{cite \"isabelle-datatypes\"}:\n    As already mentioned, the theorems that are registered\n    by the following attributes are proved and registered automatically if the involved type\n    is BNF without dead variables: @{attribute (HOL) quot_map}, @{attribute (HOL) relator_eq_onp}, \n    @{attribute (HOL) \"relator_mono\"}, @{attribute (HOL) \"relator_distr\"}. Also the definition of a \n    relator and predicator is provided automatically. Moreover, if the BNF represents a datatype, \n    simplification rules for a predicator are again proved automatically.\n  \n  \\end{description}\n\\<close>\n\n\nsection \\<open>Coercive subtyping\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{attribute_def (HOL) coercion} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) coercion_enabled} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) coercion_map} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  Coercive subtyping allows the user to omit explicit type\n  conversions, also called \\emph{coercions}.  Type inference will add\n  them as necessary when parsing a term. See\n  @{cite \"traytel-berghofer-nipkow-2011\"} for details.\n\n  @{rail \\<open>\n    @@{attribute (HOL) coercion} (@{syntax term})?\n    ;\n    @@{attribute (HOL) coercion_map} (@{syntax term})?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{attribute (HOL) \"coercion\"}~@{text \"f\"} registers a new\n  coercion function @{text \"f :: \\<sigma>\\<^sub>1 \\<Rightarrow> \\<sigma>\\<^sub>2\"} where @{text \"\\<sigma>\\<^sub>1\"} and\n  @{text \"\\<sigma>\\<^sub>2\"} are type constructors without arguments.  Coercions are\n  composed by the inference algorithm if needed.  Note that the type\n  inference algorithm is complete only if the registered coercions\n  form a lattice.\n\n  \\item @{attribute (HOL) \"coercion_map\"}~@{text \"map\"} registers a\n  new map function to lift coercions through type constructors. The\n  function @{text \"map\"} must conform to the following type pattern\n\n  \\begin{matharray}{lll}\n    @{text \"map\"} & @{text \"::\"} &\n      @{text \"f\\<^sub>1 \\<Rightarrow> \\<dots> \\<Rightarrow> f\\<^sub>n \\<Rightarrow> (\\<alpha>\\<^sub>1, \\<dots>, \\<alpha>\\<^sub>n) t \\<Rightarrow> (\\<beta>\\<^sub>1, \\<dots>, \\<beta>\\<^sub>n) t\"} \\\\\n  \\end{matharray}\n\n  where @{text \"t\"} is a type constructor and @{text \"f\\<^sub>i\"} is of type\n  @{text \"\\<alpha>\\<^sub>i \\<Rightarrow> \\<beta>\\<^sub>i\"} or @{text \"\\<beta>\\<^sub>i \\<Rightarrow> \\<alpha>\\<^sub>i\"}.  Registering a map function\n  overwrites any existing map function for this particular type\n  constructor.\n\n  \\item @{attribute (HOL) \"coercion_enabled\"} enables the coercion\n  inference algorithm.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Arithmetic proof support\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) arith} & : & @{text method} \\\\\n    @{attribute_def (HOL) arith} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) arith_split} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  \\begin{description}\n\n  \\item @{method (HOL) arith} decides linear arithmetic problems (on\n  types @{text nat}, @{text int}, @{text real}).  Any current facts\n  are inserted into the goal before running the procedure.\n\n  \\item @{attribute (HOL) arith} declares facts that are supplied to\n  the arithmetic provers implicitly.\n\n  \\item @{attribute (HOL) arith_split} attribute declares case split\n  rules to be expanded before @{method (HOL) arith} is invoked.\n\n  \\end{description}\n\n  Note that a simpler (but faster) arithmetic prover is already\n  invoked by the Simplifier.\n\\<close>\n\n\nsection \\<open>Intuitionistic proof search\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) iprover} & : & @{text method} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) iprover} (@{syntax rulemod} *)\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{method (HOL) iprover} performs intuitionistic proof search,\n  depending on specifically declared rules from the context, or given\n  as explicit arguments.  Chained facts are inserted into the goal\n  before commencing proof search.\n\n  Rules need to be classified as @{attribute (Pure) intro},\n  @{attribute (Pure) elim}, or @{attribute (Pure) dest}; here the\n  ``@{text \"!\"}'' indicator refers to ``safe'' rules, which may be\n  applied aggressively (without considering back-tracking later).\n  Rules declared with ``@{text \"?\"}'' are ignored in proof search (the\n  single-step @{method (Pure) rule} method still observes these).  An\n  explicit weight annotation may be given as well; otherwise the\n  number of rule premises will be taken into account here.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Model Elimination and Resolution\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"meson\"} & : & @{text method} \\\\\n    @{method_def (HOL) \"metis\"} & : & @{text method} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) meson} @{syntax thmrefs}?\n    ;\n    @@{method (HOL) metis}\n      ('(' ('partial_types' | 'full_types' | 'no_types' | @{syntax name}) ')')?\n      @{syntax thmrefs}?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{method (HOL) meson} implements Loveland's model elimination\n  procedure @{cite \"loveland-78\"}.  See @{file\n  \"~~/src/HOL/ex/Meson_Test.thy\"} for examples.\n\n  \\item @{method (HOL) metis} combines ordered resolution and ordered\n  paramodulation to find first-order (or mildly higher-order) proofs.\n  The first optional argument specifies a type encoding; see the\n  Sledgehammer manual @{cite \"isabelle-sledgehammer\"} for details.  The\n  directory @{file \"~~/src/HOL/Metis_Examples\"} contains several small\n  theories developed to a large extent using @{method (HOL) metis}.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Algebraic reasoning via Gr\\\"obner bases\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"algebra\"} & : & @{text method} \\\\\n    @{attribute_def (HOL) algebra} & : & @{text attribute} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) algebra}\n      ('add' ':' @{syntax thmrefs})?\n      ('del' ':' @{syntax thmrefs})?\n    ;\n    @@{attribute (HOL) algebra} (() | 'add' | 'del')\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{method (HOL) algebra} performs algebraic reasoning via\n  Gr\\\"obner bases, see also @{cite \"Chaieb-Wenzel:2007\"} and\n  @{cite \\<open>\\S3.2\\<close> \"Chaieb-thesis\"}. The method handles deals with two main\n  classes of problems:\n\n  \\begin{enumerate}\n\n  \\item Universal problems over multivariate polynomials in a\n  (semi)-ring/field/idom; the capabilities of the method are augmented\n  according to properties of these structures. For this problem class\n  the method is only complete for algebraically closed fields, since\n  the underlying method is based on Hilbert's Nullstellensatz, where\n  the equivalence only holds for algebraically closed fields.\n\n  The problems can contain equations @{text \"p = 0\"} or inequations\n  @{text \"q \\<noteq> 0\"} anywhere within a universal problem statement.\n\n  \\item All-exists problems of the following restricted (but useful)\n  form:\n\n  @{text [display] \"\\<forall>x\\<^sub>1 \\<dots> x\\<^sub>n.\n    e\\<^sub>1(x\\<^sub>1, \\<dots>, x\\<^sub>n) = 0 \\<and> \\<dots> \\<and> e\\<^sub>m(x\\<^sub>1, \\<dots>, x\\<^sub>n) = 0 \\<longrightarrow>\n    (\\<exists>y\\<^sub>1 \\<dots> y\\<^sub>k.\n      p\\<^sub>1\\<^sub>1(x\\<^sub>1, \\<dots> ,x\\<^sub>n) * y\\<^sub>1 + \\<dots> + p\\<^sub>1\\<^sub>k(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>k = 0 \\<and>\n      \\<dots> \\<and>\n      p\\<^sub>t\\<^sub>1(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>1 + \\<dots> + p\\<^sub>t\\<^sub>k(x\\<^sub>1, \\<dots>, x\\<^sub>n) * y\\<^sub>k = 0)\"}\n\n  Here @{text \"e\\<^sub>1, \\<dots>, e\\<^sub>n\"} and the @{text \"p\\<^sub>i\\<^sub>j\"} are multivariate\n  polynomials only in the variables mentioned as arguments.\n\n  \\end{enumerate}\n\n  The proof method is preceded by a simplification step, which may be\n  modified by using the form @{text \"(algebra add: ths\\<^sub>1 del: ths\\<^sub>2)\"}.\n  This acts like declarations for the Simplifier\n  (\\secref{sec:simplifier}) on a private simpset for this tool.\n\n  \\item @{attribute algebra} (as attribute) manages the default\n  collection of pre-simplification rules of the above proof method.\n\n  \\end{description}\n\\<close>\n\n\nsubsubsection \\<open>Example\\<close>\n\ntext \\<open>The subsequent example is from geometry: collinearity is\n  invariant by rotation.\\<close>\n\ntype_synonym point = \"int \\<times> int\"\n\nfun collinear :: \"point \\<Rightarrow> point \\<Rightarrow> point \\<Rightarrow> bool\" where\n  \"collinear (Ax, Ay) (Bx, By) (Cx, Cy) \\<longleftrightarrow>\n    (Ax - Bx) * (By - Cy) = (Ay - By) * (Bx - Cx)\"\n\nlemma collinear_inv_rotation:\n  assumes \"collinear (Ax, Ay) (Bx, By) (Cx, Cy)\" and \"c\\<^sup>2 + s\\<^sup>2 = 1\"\n  shows \"collinear (Ax * c - Ay * s, Ay * c + Ax * s)\n    (Bx * c - By * s, By * c + Bx * s) (Cx * c - Cy * s, Cy * c + Cx * s)\"\n  using assms by (algebra add: collinear.simps)\n\ntext \\<open>\n See also @{file \"~~/src/HOL/ex/Groebner_Examples.thy\"}.\n\\<close>\n\n\nsection \\<open>Coherent Logic\\<close>\n\ntext \\<open>\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) \"coherent\"} & : & @{text method} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) coherent} @{syntax thmrefs}?\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{method (HOL) coherent} solves problems of \\emph{Coherent\n  Logic} @{cite \"Bezem-Coquand:2005\"}, which covers applications in\n  confluence theory, lattice theory and projective geometry.  See\n  @{file \"~~/src/HOL/ex/Coherent.thy\"} for some examples.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Proving propositions\\<close>\n\ntext \\<open>\n  In addition to the standard proof methods, a number of diagnosis\n  tools search for proofs and provide an Isar proof snippet on success.\n  These tools are available via the following commands.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"solve_direct\"}@{text \"\\<^sup>*\"} & : & @{text \"proof \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"try\"}@{text \"\\<^sup>*\"} & : & @{text \"proof \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"try0\"}@{text \"\\<^sup>*\"} & : & @{text \"proof \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"sledgehammer\"}@{text \"\\<^sup>*\"} & : & @{text \"proof \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"sledgehammer_params\"} & : & @{text \"theory \\<rightarrow> theory\"}\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) try}\n    ;\n\n    @@{command (HOL) try0} ( ( ( 'simp' | 'intro' | 'elim' | 'dest' ) ':' @{syntax thmrefs} ) + ) ?\n      @{syntax nat}?\n    ;\n\n    @@{command (HOL) sledgehammer} ( '[' args ']' )? facts? @{syntax nat}?\n    ;\n\n    @@{command (HOL) sledgehammer_params} ( ( '[' args ']' ) ? )\n    ;\n    args: ( @{syntax name} '=' value + ',' )\n    ;\n    facts: '(' ( ( ( ( 'add' | 'del' ) ':' ) ? @{syntax thmrefs} ) + ) ? ')'\n  \\<close>} % FIXME check args \"value\"\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"solve_direct\"} checks whether the current\n  subgoals can be solved directly by an existing theorem. Duplicate\n  lemmas can be detected in this way.\n\n  \\item @{command (HOL) \"try0\"} attempts to prove a subgoal\n  using a combination of standard proof methods (@{method auto},\n  @{method simp}, @{method blast}, etc.).  Additional facts supplied\n  via @{text \"simp:\"}, @{text \"intro:\"}, @{text \"elim:\"}, and @{text\n  \"dest:\"} are passed to the appropriate proof methods.\n\n  \\item @{command (HOL) \"try\"} attempts to prove or disprove a subgoal\n  using a combination of provers and disprovers (@{command (HOL)\n  \"solve_direct\"}, @{command (HOL) \"quickcheck\"}, @{command (HOL)\n  \"try0\"}, @{command (HOL) \"sledgehammer\"}, @{command (HOL)\n  \"nitpick\"}).\n\n  \\item @{command (HOL) \"sledgehammer\"} attempts to prove a subgoal\n  using external automatic provers (resolution provers and SMT\n  solvers). See the Sledgehammer manual @{cite \"isabelle-sledgehammer\"}\n  for details.\n\n  \\item @{command (HOL) \"sledgehammer_params\"} changes @{command (HOL)\n  \"sledgehammer\"} configuration options persistently.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Checking and refuting propositions\\<close>\n\ntext \\<open>\n  Identifying incorrect propositions usually involves evaluation of\n  particular assignments and systematic counterexample search.  This\n  is supported by the following commands.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"value\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"values\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"quickcheck\"}@{text \"\\<^sup>*\"} & : & @{text \"proof \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"nitpick\"}@{text \"\\<^sup>*\"} & : & @{text \"proof \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"quickcheck_params\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n    @{command_def (HOL) \"nitpick_params\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n    @{command_def (HOL) \"quickcheck_generator\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n    @{command_def (HOL) \"find_unused_assms\"} & : & @{text \"context \\<rightarrow>\"}\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) value} ( '[' @{syntax name} ']' )? modes? @{syntax term}\n    ;\n\n    @@{command (HOL) values} modes? @{syntax nat}? @{syntax term}\n    ;\n\n    (@@{command (HOL) quickcheck} | @@{command (HOL) nitpick})\n      ( '[' args ']' )? @{syntax nat}?\n    ;\n\n    (@@{command (HOL) quickcheck_params} |\n      @@{command (HOL) nitpick_params}) ( '[' args ']' )?\n    ;\n\n    @@{command (HOL) quickcheck_generator} @{syntax nameref} \\<newline>\n      'operations:' ( @{syntax term} +)\n    ;\n\n    @@{command (HOL) find_unused_assms} @{syntax name}?\n    ;\n    modes: '(' (@{syntax name} +) ')'\n    ;\n    args: ( @{syntax name} '=' value + ',' )\n  \\<close>} % FIXME check \"value\"\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"value\"}~@{text t} evaluates and prints a\n  term; optionally @{text modes} can be specified, which are appended\n  to the current print mode; see \\secref{sec:print-modes}.\n  Evaluation is tried first using ML, falling\n  back to normalization by evaluation if this fails.\n  Alternatively a specific evaluator can be selected using square\n  brackets; typical evaluators use the current set of code equations\n  to normalize and include @{text simp} for fully symbolic evaluation\n  using the simplifier, @{text nbe} for \\emph{normalization by\n  evaluation} and \\emph{code} for code generation in SML.\n\n  \\item @{command (HOL) \"values\"}~@{text t} enumerates a set\n  comprehension by evaluation and prints its values up to the given\n  number of solutions; optionally @{text modes} can be specified,\n  which are appended to the current print mode; see\n  \\secref{sec:print-modes}.\n\n  \\item @{command (HOL) \"quickcheck\"} tests the current goal for\n  counterexamples using a series of assignments for its free\n  variables; by default the first subgoal is tested, an other can be\n  selected explicitly using an optional goal index.  Assignments can\n  be chosen exhausting the search space up to a given size, or using a\n  fixed number of random assignments in the search space, or exploring\n  the search space symbolically using narrowing.  By default,\n  quickcheck uses exhaustive testing.  A number of configuration\n  options are supported for @{command (HOL) \"quickcheck\"}, notably:\n\n    \\begin{description}\n\n    \\item[@{text tester}] specifies which testing approach to apply.\n    There are three testers, @{text exhaustive}, @{text random}, and\n    @{text narrowing}.  An unknown configuration option is treated as\n    an argument to tester, making @{text \"tester =\"} optional.  When\n    multiple testers are given, these are applied in parallel.  If no\n    tester is specified, quickcheck uses the testers that are set\n    active, i.e., configurations @{attribute\n    quickcheck_exhaustive_active}, @{attribute\n    quickcheck_random_active}, @{attribute\n    quickcheck_narrowing_active} are set to true.\n\n    \\item[@{text size}] specifies the maximum size of the search space\n    for assignment values.\n\n    \\item[@{text genuine_only}] sets quickcheck only to return genuine\n    counterexample, but not potentially spurious counterexamples due\n    to underspecified functions.\n\n    \\item[@{text abort_potential}] sets quickcheck to abort once it\n    found a potentially spurious counterexample and to not continue\n    to search for a further genuine counterexample.\n    For this option to be effective, the @{text genuine_only} option\n    must be set to false.\n\n    \\item[@{text eval}] takes a term or a list of terms and evaluates\n    these terms under the variable assignment found by quickcheck.\n    This option is currently only supported by the default\n    (exhaustive) tester.\n\n    \\item[@{text iterations}] sets how many sets of assignments are\n    generated for each particular size.\n\n    \\item[@{text no_assms}] specifies whether assumptions in\n    structured proofs should be ignored.\n\n    \\item[@{text locale}] specifies how to process conjectures in\n    a locale context, i.e., they can be interpreted or expanded.\n    The option is a whitespace-separated list of the two words\n    @{text interpret} and @{text expand}. The list determines the\n    order they are employed. The default setting is to first use\n    interpretations and then test the expanded conjecture.\n    The option is only provided as attribute declaration, but not\n    as parameter to the command.\n\n    \\item[@{text timeout}] sets the time limit in seconds.\n\n    \\item[@{text default_type}] sets the type(s) generally used to\n    instantiate type variables.\n\n    \\item[@{text report}] if set quickcheck reports how many tests\n    fulfilled the preconditions.\n\n    \\item[@{text use_subtype}] if set quickcheck automatically lifts\n    conjectures to registered subtypes if possible, and tests the\n    lifted conjecture.\n\n    \\item[@{text quiet}] if set quickcheck does not output anything\n    while testing.\n\n    \\item[@{text verbose}] if set quickcheck informs about the current\n    size and cardinality while testing.\n\n    \\item[@{text expect}] can be used to check if the user's\n    expectation was met (@{text no_expectation}, @{text\n    no_counterexample}, or @{text counterexample}).\n\n    \\end{description}\n\n  These option can be given within square brackets.\n\n  Using the following type classes, the testers generate values and convert\n  them back into Isabelle terms for displaying counterexamples.\n    \\begin{description}\n    \\item[@{text exhaustive}] The parameters of the type classes @{class exhaustive}\n      and @{class full_exhaustive} implement the testing. They take a \n      testing function as a parameter, which takes a value of type @{typ \"'a\"}\n      and optionally produces a counterexample, and a size parameter for the test values.\n      In @{class full_exhaustive}, the testing function parameter additionally \n      expects a lazy term reconstruction in the type @{typ Code_Evaluation.term}\n      of the tested value.\n\n      The canonical implementation for @{text exhaustive} testers calls the given\n      testing function on all values up to the given size and stops as soon\n      as a counterexample is found.\n\n    \\item[@{text random}] The operation @{const Quickcheck_Random.random}\n      of the type class @{class random} generates a pseudo-random\n      value of the given size and a lazy term reconstruction of the value\n      in the type @{typ Code_Evaluation.term}. A pseudo-randomness generator\n      is defined in theory @{theory Random}.\n      \n    \\item[@{text narrowing}] implements Haskell's Lazy Smallcheck @{cite \"runciman-naylor-lindblad\"}\n      using the type classes @{class narrowing} and @{class partial_term_of}.\n      Variables in the current goal are initially represented as symbolic variables.\n      If the execution of the goal tries to evaluate one of them, the test engine\n      replaces it with refinements provided by @{const narrowing}.\n      Narrowing views every value as a sum-of-products which is expressed using the operations\n      @{const Quickcheck_Narrowing.cons} (embedding a value),\n      @{const Quickcheck_Narrowing.apply} (product) and @{const Quickcheck_Narrowing.sum} (sum).\n      The refinement should enable further evaluation of the goal.\n\n      For example, @{const narrowing} for the list type @{typ \"'a :: narrowing list\"}\n      can be recursively defined as\n      @{term \"Quickcheck_Narrowing.sum (Quickcheck_Narrowing.cons [])\n                (Quickcheck_Narrowing.apply\n                  (Quickcheck_Narrowing.apply\n                    (Quickcheck_Narrowing.cons (op #))\n                    narrowing)\n                  narrowing)\"}.\n      If a symbolic variable of type @{typ \"_ list\"} is evaluated, it is replaced by (i)~the empty\n      list @{term \"[]\"} and (ii)~by a non-empty list whose head and tail can then be recursively\n      refined if needed.\n\n      To reconstruct counterexamples, the operation @{const partial_term_of} transforms\n      @{text narrowing}'s deep representation of terms to the type @{typ Code_Evaluation.term}.\n      The deep representation models symbolic variables as\n      @{const Quickcheck_Narrowing.Narrowing_variable}, which are normally converted to\n      @{const Code_Evaluation.Free}, and refined values as\n      @{term \"Quickcheck_Narrowing.Narrowing_constructor i args\"}, where @{term \"i :: integer\"}\n      denotes the index in the sum of refinements. In the above example for lists,\n      @{term \"0\"} corresponds to @{term \"[]\"} and @{term \"1\"}\n      to @{term \"op #\"}.\n\n      The command @{command (HOL) \"code_datatype\"} sets up @{const partial_term_of}\n      such that the @{term \"i\"}-th refinement is interpreted as the @{term \"i\"}-th constructor,\n      but it does not ensures consistency with @{const narrowing}.\n    \\end{description}\n\n  \\item @{command (HOL) \"quickcheck_params\"} changes @{command (HOL)\n  \"quickcheck\"} configuration options persistently.\n\n  \\item @{command (HOL) \"quickcheck_generator\"} creates random and\n  exhaustive value generators for a given type and operations.  It\n  generates values by using the operations as if they were\n  constructors of that type.\n\n  \\item @{command (HOL) \"nitpick\"} tests the current goal for\n  counterexamples using a reduction to first-order relational\n  logic. See the Nitpick manual @{cite \"isabelle-nitpick\"} for details.\n\n  \\item @{command (HOL) \"nitpick_params\"} changes @{command (HOL)\n  \"nitpick\"} configuration options persistently.\n\n  \\item @{command (HOL) \"find_unused_assms\"} finds potentially superfluous\n  assumptions in theorems using quickcheck.\n  It takes the theory name to be checked for superfluous assumptions as\n  optional argument. If not provided, it checks the current theory.\n  Options to the internal quickcheck invocations can be changed with\n  common configuration declarations.\n\n  \\end{description}\n\\<close>\n\n\nsection \\<open>Unstructured case analysis and induction \\label{sec:hol-induct-tac}\\<close>\n\ntext \\<open>\n  The following tools of Isabelle/HOL support cases analysis and\n  induction in unstructured tactic scripts; see also\n  \\secref{sec:cases-induct} for proper Isar versions of similar ideas.\n\n  \\begin{matharray}{rcl}\n    @{method_def (HOL) case_tac}@{text \"\\<^sup>*\"} & : & @{text method} \\\\\n    @{method_def (HOL) induct_tac}@{text \"\\<^sup>*\"} & : & @{text method} \\\\\n    @{method_def (HOL) ind_cases}@{text \"\\<^sup>*\"} & : & @{text method} \\\\\n    @{command_def (HOL) \"inductive_cases\"}@{text \"\\<^sup>*\"} & : & @{text \"local_theory \\<rightarrow> local_theory\"} \\\\\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{method (HOL) case_tac} @{syntax goal_spec}? @{syntax term} rule?\n    ;\n    @@{method (HOL) induct_tac} @{syntax goal_spec}? (@{syntax insts} * @'and') rule?\n    ;\n    @@{method (HOL) ind_cases} (@{syntax prop}+) (@'for' (@{syntax name}+))?\n    ;\n    @@{command (HOL) inductive_cases} (@{syntax thmdecl}? (@{syntax prop}+) + @'and')\n    ;\n    rule: 'rule' ':' @{syntax thmref}\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{method (HOL) case_tac} and @{method (HOL) induct_tac} admit\n  to reason about inductive types.  Rules are selected according to\n  the declarations by the @{attribute cases} and @{attribute induct}\n  attributes, cf.\\ \\secref{sec:cases-induct}.  The @{command (HOL)\n  datatype} package already takes care of this.\n\n  These unstructured tactics feature both goal addressing and dynamic\n  instantiation.  Note that named rule cases are \\emph{not} provided\n  as would be by the proper @{method cases} and @{method induct} proof\n  methods (see \\secref{sec:cases-induct}).  Unlike the @{method\n  induct} method, @{method induct_tac} does not handle structured rule\n  statements, only the compact object-logic conclusion of the subgoal\n  being addressed.\n\n  \\item @{method (HOL) ind_cases} and @{command (HOL)\n  \"inductive_cases\"} provide an interface to the internal @{ML_text\n  mk_cases} operation.  Rules are simplified in an unrestricted\n  forward manner.\n\n  While @{method (HOL) ind_cases} is a proof method to apply the\n  result immediately as elimination rules, @{command (HOL)\n  \"inductive_cases\"} provides case split theorems at the theory level\n  for later use.  The @{keyword \"for\"} argument of the @{method (HOL)\n  ind_cases} method allows to specify a list of variables that should\n  be generalized before applying the resulting rule.\n\n  \\end{description}\n\\<close>\n\n\nchapter \\<open>Executable code\\<close>\n\ntext \\<open>For validation purposes, it is often useful to \\emph{execute}\n  specifications.  In principle, execution could be simulated by\n  Isabelle's inference kernel, i.e. by a combination of resolution and\n  simplification.  Unfortunately, this approach is rather inefficient.\n  A more efficient way of executing specifications is to translate\n  them into a functional programming language such as ML.\n\n  Isabelle provides a generic framework to support code generation\n  from executable specifications.  Isabelle/HOL instantiates these\n  mechanisms in a way that is amenable to end-user applications.  Code\n  can be generated for functional programs (including overloading\n  using type classes) targeting SML @{cite SML}, OCaml @{cite OCaml},\n  Haskell @{cite \"haskell-revised-report\"} and Scala\n  @{cite \"scala-overview-tech-report\"}.  Conceptually, code generation is\n  split up in three steps: \\emph{selection} of code theorems,\n  \\emph{translation} into an abstract executable view and\n  \\emph{serialization} to a specific \\emph{target language}.\n  Inductive specifications can be executed using the predicate\n  compiler which operates within HOL.  See @{cite \"isabelle-codegen\"} for\n  an introduction.\n\n  \\begin{matharray}{rcl}\n    @{command_def (HOL) \"export_code\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{attribute_def (HOL) code} & : & @{text attribute} \\\\\n    @{command_def (HOL) \"code_datatype\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n    @{command_def (HOL) \"print_codesetup\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{attribute_def (HOL) code_unfold} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) code_post} & : & @{text attribute} \\\\\n    @{attribute_def (HOL) code_abbrev} & : & @{text attribute} \\\\\n    @{command_def (HOL) \"print_codeproc\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"code_thms\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"code_deps\"}@{text \"\\<^sup>*\"} & : & @{text \"context \\<rightarrow>\"} \\\\\n    @{command_def (HOL) \"code_reserved\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n    @{command_def (HOL) \"code_printing\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n    @{command_def (HOL) \"code_identifier\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n    @{command_def (HOL) \"code_monad\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n    @{command_def (HOL) \"code_reflect\"} & : & @{text \"theory \\<rightarrow> theory\"} \\\\\n    @{command_def (HOL) \"code_pred\"} & : & @{text \"theory \\<rightarrow> proof(prove)\"}\n  \\end{matharray}\n\n  @{rail \\<open>\n    @@{command (HOL) export_code} ( @'open' ) ? ( constexpr + ) \\<newline>\n       ( ( @'in' target ( @'module_name' @{syntax string} ) ? \\<newline>\n        ( @'file' @{syntax string} ) ? ( '(' args ')' ) ?) + ) ?\n    ;\n\n    const: @{syntax term}\n    ;\n\n    constexpr: ( const | 'name._' | '_' )\n    ;\n\n    typeconstructor: @{syntax nameref}\n    ;\n\n    class: @{syntax nameref}\n    ;\n\n    target: 'SML' | 'OCaml' | 'Haskell' | 'Scala' | 'Eval'\n    ;\n\n    @@{attribute (HOL) code} ( 'del' | 'equation' | 'abstype' | 'abstract'\n      | 'drop:' ( const + ) | 'abort:' ( const + ) )?\n    ;\n\n    @@{command (HOL) code_datatype} ( const + )\n    ;\n\n    @@{attribute (HOL) code_unfold} ( 'del' ) ?\n    ;\n\n    @@{attribute (HOL) code_post} ( 'del' ) ?\n    ;\n\n    @@{attribute (HOL) code_abbrev}\n    ;\n\n    @@{command (HOL) code_thms} ( constexpr + ) ?\n    ;\n\n    @@{command (HOL) code_deps} ( constexpr + ) ?\n    ;\n\n    @@{command (HOL) code_reserved} target ( @{syntax string} + )\n    ;\n\n    symbol_const: ( @'constant' const )\n    ;\n\n    symbol_typeconstructor: ( @'type_constructor' typeconstructor )\n    ;\n\n    symbol_class: ( @'type_class' class )\n    ;\n\n    symbol_class_relation: ( @'class_relation' class ( '<' | '\\<subseteq>' ) class )\n    ;\n\n    symbol_class_instance: ( @'class_instance' typeconstructor @'::' class )\n    ;\n\n    symbol_module: ( @'code_module' name )\n    ;\n\n    syntax: @{syntax string} | ( @'infix' | @'infixl' | @'infixr' ) @{syntax nat} @{syntax string}\n    ;\n\n    printing_const: symbol_const ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' syntax ? + @'and' )\n    ;\n\n    printing_typeconstructor: symbol_typeconstructor ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' syntax ? + @'and' )\n    ;\n\n    printing_class: symbol_class ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' @{syntax string} ? + @'and' )\n    ;\n\n    printing_class_relation: symbol_class_relation ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' @{syntax string} ? + @'and' )\n    ;\n\n    printing_class_instance: symbol_class_instance ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' '-' ? + @'and' )\n    ;\n\n    printing_module: symbol_module ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' ( @{syntax string} ( @'attach' ( const + ) ) ? ) ? + @'and' )\n    ;\n\n    @@{command (HOL) code_printing} ( ( printing_const | printing_typeconstructor\n      | printing_class | printing_class_relation | printing_class_instance\n      | printing_module ) + '|' )\n    ;\n\n    @@{command (HOL) code_identifier} ( ( symbol_const | symbol_typeconstructor\n      | symbol_class | symbol_class_relation | symbol_class_instance\n      | symbol_module ) ( '\\<rightharpoonup>' | '=>' ) \\<newline>\n      ( '(' target ')' @{syntax string} ? + @'and' ) + '|' )\n    ;\n\n    @@{command (HOL) code_monad} const const target\n    ;\n\n    @@{command (HOL) code_reflect} @{syntax string} \\<newline>\n      ( @'datatypes' ( @{syntax string} '=' ( '_' | ( @{syntax string} + '|' ) + @'and' ) ) ) ? \\<newline>\n      ( @'functions' ( @{syntax string} + ) ) ? ( @'file' @{syntax string} ) ?\n    ;\n\n    @@{command (HOL) code_pred} \\<newline> ('(' @'modes' ':' modedecl ')')? \\<newline> const\n    ;\n\n    modedecl: (modes | ((const ':' modes) \\<newline>\n        (@'and' ((const ':' modes @'and') +))?))\n    ;\n\n    modes: mode @'as' const\n  \\<close>}\n\n  \\begin{description}\n\n  \\item @{command (HOL) \"export_code\"} generates code for a given list\n  of constants in the specified target language(s).  If no\n  serialization instruction is given, only abstract code is generated\n  internally.\n\n  Constants may be specified by giving them literally, referring to\n  all executable constants within a certain theory by giving @{text\n  \"name._\"}, or referring to \\emph{all} executable constants currently\n  available by giving @{text \"_\"}.\n\n  By default, exported identifiers are minimized per module.  This\n  can be suppressed by prepending @{keyword \"open\"} before the list\n  of contants.\n\n  By default, for each involved theory one corresponding name space\n  module is generated.  Alternatively, a module name may be specified\n  after the @{keyword \"module_name\"} keyword; then \\emph{all} code is\n  placed in this module.\n\n  For \\emph{SML}, \\emph{OCaml} and \\emph{Scala} the file specification\n  refers to a single file; for \\emph{Haskell}, it refers to a whole\n  directory, where code is generated in multiple files reflecting the\n  module hierarchy.  Omitting the file specification denotes standard\n  output.\n\n  Serializers take an optional list of arguments in parentheses.\n  For \\emph{Haskell} a module name prefix may be given using the\n  ``@{text \"root:\"}'' argument; ``@{text string_classes}'' adds a\n  ``@{verbatim \"deriving (Read, Show)\"}'' clause to each appropriate\n  datatype declaration.\n\n  \\item @{attribute (HOL) code} declare code equations for code\n  generation.  Variant @{text \"code equation\"} declares a conventional\n  equation as code equation.  Variants @{text \"code abstype\"} and\n  @{text \"code abstract\"} declare abstract datatype certificates or\n  code equations on abstract datatype representations respectively.\n  Vanilla @{text \"code\"} falls back to @{text \"code equation\"}\n  or @{text \"code abstype\"} depending on the syntactic shape\n  of the underlying equation.  Variant @{text \"code del\"}\n  deselects a code equation for code generation.\n\n  Variants @{text \"code drop:\"} and @{text \"code abort:\"} take\n  a list of constant as arguments and drop all code equations declared\n  for them.  In the case of {text abort}, these constants then are\n  are not required to have a definition by means of code equations;\n  if needed these are implemented by program abort (exception) instead.\n\n  Usually packages introducing code equations provide a reasonable\n  default setup for selection.  \n\n  \\item @{command (HOL) \"code_datatype\"} specifies a constructor set\n  for a logical type.\n\n  \\item @{command (HOL) \"print_codesetup\"} gives an overview on\n  selected code equations and code generator datatypes.\n\n  \\item @{attribute (HOL) code_unfold} declares (or with option\n  ``@{text \"del\"}'' removes) theorems which during preprocessing\n  are applied as rewrite rules to any code equation or evaluation\n  input.\n\n  \\item @{attribute (HOL) code_post} declares (or with option ``@{text\n  \"del\"}'' removes) theorems which are applied as rewrite rules to any\n  result of an evaluation.\n\n  \\item @{attribute (HOL) code_abbrev} declares (or with option ``@{text\n  \"del\"}'' removes) equations which are\n  applied as rewrite rules to any result of an evaluation and\n  symmetrically during preprocessing to any code equation or evaluation\n  input.\n\n  \\item @{command (HOL) \"print_codeproc\"} prints the setup of the code\n  generator preprocessor.\n\n  \\item @{command (HOL) \"code_thms\"} prints a list of theorems\n  representing the corresponding program containing all given\n  constants after preprocessing.\n\n  \\item @{command (HOL) \"code_deps\"} visualizes dependencies of\n  theorems representing the corresponding program containing all given\n  constants after preprocessing.\n\n  \\item @{command (HOL) \"code_reserved\"} declares a list of names as\n  reserved for a given target, preventing it to be shadowed by any\n  generated code.\n\n  \\item @{command (HOL) \"code_printing\"} associates a series of symbols\n  (constants, type constructors, classes, class relations, instances,\n  module names) with target-specific serializations; omitting a serialization\n  deletes an existing serialization.\n\n  \\item @{command (HOL) \"code_monad\"} provides an auxiliary mechanism\n  to generate monadic code for Haskell.\n\n  \\item @{command (HOL) \"code_identifier\"} associates a a series of symbols\n  (constants, type constructors, classes, class relations, instances,\n  module names) with target-specific hints how these symbols shall be named.\n  These hints gain precedence over names for symbols with no hints at all.\n  Conflicting hints are subject to name disambiguation.\n  \\emph{Warning:} It is at the discretion\n  of the user to ensure that name prefixes of identifiers in compound\n  statements like type classes or datatypes are still the same.\n\n  \\item @{command (HOL) \"code_reflect\"} without a ``@{text \"file\"}''\n  argument compiles code into the system runtime environment and\n  modifies the code generator setup that future invocations of system\n  runtime code generation referring to one of the ``@{text\n  \"datatypes\"}'' or ``@{text \"functions\"}'' entities use these\n  precompiled entities.  With a ``@{text \"file\"}'' argument, the\n  corresponding code is generated into that specified file without\n  modifying the code generator setup.\n\n  \\item @{command (HOL) \"code_pred\"} creates code equations for a\n    predicate given a set of introduction rules. Optional mode\n    annotations determine which arguments are supposed to be input or\n    output. If alternative introduction rules are declared, one must\n    prove a corresponding elimination rule.\n\n  \\end{description}\n\\<close>\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/Doc/Isar_Ref/HOL_Specific.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5156199306096344, "lm_q2_score": 0.5851011542032312, "lm_q1q2_score": 0.3016898165298871}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2005         |\n            |               Februaru 2006               |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory FNF_F_sf_hide\nimports FNF_F_sf_induct FNF_F_sf_ext\nbegin\n\n(*  The following simplification rules are deleted in this theory file *)\n(*  because they unexpectly rewrite UnionT and InterT.                 *)\n(*                  disj_not1: (~ P | Q) = (P --> Q)                   *)\n\ndeclare disj_not1 [simp del]\n\n(*  The following simplification rules are deleted in this theory file *)\n(*       P (if Q then x else y) = ((Q --> P x) & (~ Q --> P y))        *)\n\ndeclare split_if  [split del]\n\n(*****************************************************************\n\n         1. full sequentialization for Hiding (P -- X)\n         2.\n         3.\n\n *****************************************************************)\n\n(*============================================================*\n |                                                            |\n |                     Hiding P -- X                          |\n |                                                            |\n *============================================================*)\n\ndefinition\n  Pfun_Hiding :: \"'a set => (('p,'a) proc => ('p,'a) proc)\"\n  where\n  Pfun_Hiding_def :\n    \"Pfun_Hiding X == (%P1. P1 -- X)\"\n  \ndefinition\n  SP_step_Hiding :: \n   \"'a set => ('a set => ('a => ('p,'a) proc) => ('p,'a) proc =>\n    ('a => ('p,'a) proc) => ('p,'a) proc)\"\n  where\n  SP_step_Hiding_def :\n    \"SP_step_Hiding X == (%A1 Pf1 Q1 SPf.\n     (if (Q1 = STOP) \n      then if (A1 Int X = {}) \n           then ((? :A1 -> SPf) [+] Q1)\n           else (((? :(A1-X) -> SPf) [+] Q1)\n                 [>seq\n                (! :(A1 Int X) ..seq SPf))\n      else (((? :(A1-X) -> SPf) [+] Q1) |~|seq\n            (! :(A1 Int X) ..seq SPf))))\"\n\ndefinition\n  fsfF_Hiding :: \"('p,'a) proc => 'a set => ('p,'a) proc\"\n                          (\"(1_ /--seq _)\" [84,85] 84)\n  where\n  fsfF_Hiding_def :\n    \"P1 --seq X == \n       (fsfF_induct1 (Pfun_Hiding X) (SP_step_Hiding X) P1)\"\n\n(*------------------------------------------------------------*\n |                        in fsfF_proc                        |\n *------------------------------------------------------------*)\n\nlemma fsfF_Hiding_in:\n    \"P1 : fsfF_proc ==> P1 --seq X : fsfF_proc\"\napply (simp add: fsfF_Hiding_def)\napply (rule fsfF_induct1_in)\napply (simp_all add: SP_step_Hiding_def)\napply (simp split: split_if)\napply (intro conjI impI)\napply (simp_all add: fsfF_proc.intros)\napply (rule fsfF_Int_choice_in)\napply (simp_all add: fsfF_proc.intros)\napply (simp add: fsfF_Rep_int_choice_com_in)\napply (rule fsfF_Timeout_in)\napply (simp_all add: fsfF_proc.intros)\napply (simp add: fsfF_Rep_int_choice_com_in)\napply (rule fsfF_Int_choice_in)\napply (simp add: fsfF_proc.intros)\napply (simp add: fsfF_Rep_int_choice_com_in)\ndone\n\n(*------------------------------------------------------------*\n |             syntactical transformation to fsfF             |\n *------------------------------------------------------------*)\n\nlemma cspF_fsfF_Hiding_eqF: \"P1 -- X =F P1 --seq X\"\napply (simp add: fsfF_Hiding_def)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_induct1_eqF[THEN cspF_sym])\napply (simp_all add: Pfun_Hiding_def\n                     SP_step_Hiding_def)\n\napply (case_tac \"Q1 = STOP\")\napply (rule cspF_rw_left)\napply (rule cspF_decompo)\napply (simp)\napply (simp)\napply (rule cspF_unit)\n\napply (rule cspF_rw_left)\napply (rule cspF_step)\napply (simp)\n\napply (simp split: split_if)\napply (intro conjI impI)\napply (rule cspF_rw_left)\napply (rule cspF_IF)\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_left)\napply (rule cspF_IF)\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Timeout_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (rule cspF_decompo)\napply (rule cspF_rw_right)\napply (rule cspF_unit)\napply (simp)\napply (simp)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Rep_int_choice_com_eqF[THEN cspF_sym])\napply (simp)\n\n(* Q1 ~= STOP *)\napply (simp)\n\napply (rule cspF_rw_left)\napply (rule cspF_SKIP_or_DIV)\napply (simp)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym])\napply (rule cspF_decompo)\napply (rule cspF_reflex)\n\napply (rule cspF_rw_right)\napply (rule cspF_fsfF_Rep_int_choice_com_eqF[THEN cspF_sym])\napply (rule cspF_reflex)\n\n(* congruence *)\napply (simp split: split_if)\napply (intro conjI impI)\napply (rule cspF_rw_left,\n     (simp\n     | rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Rep_int_choice_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Rep_int_choice_com_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Timeout_eqF[THEN cspF_sym]\n     | rule cspF_decompo \n     | rule cspF_reflex)+ ,\n       rule cspF_rw_right,\n     (simp\n     | rule cspF_fsfF_Int_choice_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Rep_int_choice_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Rep_int_choice_com_eqF[THEN cspF_sym]\n     | rule cspF_fsfF_Timeout_eqF[THEN cspF_sym]\n     | rule cspF_decompo \n     | rule cspF_reflex)+)+\ndone\n\n(****************** to add them again ******************)\n\ndeclare split_if    [split]\ndeclare disj_not1   [simp]\n\nend\n", "meta": {"author": "pefribeiro", "repo": "CSP-Prover", "sha": "8967cc482e5695fca4abb52d9dc2cf36b7b7a44e", "save_path": "github-repos/isabelle/pefribeiro-CSP-Prover", "path": "github-repos/isabelle/pefribeiro-CSP-Prover/CSP-Prover-8967cc482e5695fca4abb52d9dc2cf36b7b7a44e/FNF_F/FNF_F_sf_hide.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.665410558746814, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.3016052195465316}}
{"text": "(*  Title:      JinjaThreads/Execute/Round_Robin.thy\n    Author:     Andreas Lochbihler\n*)\n\nheader {* \\isaheader{Round robin scheduler} *}\n\ntheory Round_Robin\nimports\n  Scheduler\nbegin\n\ntext {* \n  A concrete scheduler must pick one possible reduction step from the small-step semantics for invidivual threads.\n  Currently, this is only possible if there is only one such by using @{term Predicate.the}.\n*}\n\nsection {* Concrete schedulers *}\n\nsubsection {* Round-robin schedulers *}\n\ntype_synonym 'queue round_robin = \"'queue \\<times> nat\"\n  -- \"Waiting queue of threads and remaining number of steps of the first thread until it has to return resources\"\n\nprimrec enqueue_new_thread :: \"'t list \\<Rightarrow> ('t,'x,'m) new_thread_action \\<Rightarrow> 't list\"\nwhere \n  \"enqueue_new_thread queue (NewThread t x m) = queue @ [t]\"\n| \"enqueue_new_thread queue (ThreadExists t b) = queue\"\n\ndefinition enqueue_new_threads :: \"'t list \\<Rightarrow> ('t,'x,'m) new_thread_action list \\<Rightarrow> 't list\"\nwhere\n  \"enqueue_new_threads = foldl enqueue_new_thread\"\n\nprimrec round_robin_update_state :: \"nat \\<Rightarrow> 't list round_robin \\<Rightarrow> 't \\<Rightarrow> ('l,'t,'x,'m,'w,'o) thread_action \\<Rightarrow> 't list round_robin\"\nwhere \n  \"round_robin_update_state n0 (queue, n) t ta =\n   (let queue' = enqueue_new_threads queue \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>\n    in if n = 0 \\<or> Yield \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>c\\<^esub> then (rotate1 queue', n0) else (queue', n - 1))\"\n\ncontext multithreaded_base begin\n\nabbreviation round_robin_step :: \"nat \\<Rightarrow> 't list round_robin \\<Rightarrow> ('l,'t,'x,'m,'w) state \\<Rightarrow> 't \\<Rightarrow> ('t \\<times> (('l,'t,'x,'m,'w,'o) thread_action \\<times> 'x \\<times> 'm) option \\<times> 't list round_robin) option\"\nwhere\n  \"round_robin_step n0 \\<sigma> s t \\<equiv> step_thread (round_robin_update_state n0 \\<sigma> t) s t\"\n\npartial_function (option) round_robin_reschedule :: \"'t \\<Rightarrow> \n    't list \\<Rightarrow> nat \\<Rightarrow> ('l,'t,'x,'m,'w) state \\<Rightarrow> ('t \\<times> (('l,'t,'x,'m,'w,'o) thread_action \\<times> 'x \\<times> 'm) option \\<times> 't list round_robin) option\"\nwhere\n  \"round_robin_reschedule t0 queue n0 s =\n   (let\n      t = hd queue;\n      queue' = tl queue\n    in\n      if t = t0 then\n        None\n      else\n        case round_robin_step n0 (t # queue', n0) s t of\n          None \\<Rightarrow> round_robin_reschedule t0 (queue' @ [t]) n0 s\n        | \\<lfloor>ttaxm\\<sigma>\\<rfloor> \\<Rightarrow> \\<lfloor>ttaxm\\<sigma>\\<rfloor>)\"\n\nfun round_robin :: \"nat \\<Rightarrow> 't list round_robin \\<Rightarrow> ('l,'t,'x,'m,'w) state \\<Rightarrow> ('t \\<times> (('l,'t,'x,'m,'w,'o) thread_action \\<times> 'x \\<times> 'm) option \\<times> 't list round_robin) option\"\nwhere \n  \"round_robin n0 ([], n) s = None\"\n| \"round_robin n0 (t # queue, n) s =\n   (case round_robin_step n0 (t # queue, n) s t of\n      \\<lfloor>ttaxm\\<sigma>\\<rfloor> \\<Rightarrow> \\<lfloor>ttaxm\\<sigma>\\<rfloor>\n    | None \\<Rightarrow> round_robin_reschedule t (queue @ [t]) n0 s)\"\n\nend\n\nprimrec round_robin_invar :: \"'t list round_robin \\<Rightarrow> 't set \\<Rightarrow> bool\"\nwhere \"round_robin_invar (queue, n) T \\<longleftrightarrow> set queue = T \\<and> distinct queue\"\n\nlemma set_enqueue_new_thread: \n  \"set (enqueue_new_thread queue nta) = set queue \\<union> {t. \\<exists>x m. nta = NewThread t x m}\"\nby(cases nta) auto\n\nlemma set_enqueue_new_threads: \n  \"set (enqueue_new_threads queue ntas) = set queue \\<union> {t. \\<exists>x m. NewThread t x m \\<in> set ntas}\"\napply(induct ntas arbitrary: queue)\napply(auto simp add: enqueue_new_threads_def set_enqueue_new_thread)\ndone\n\nlemma enqueue_new_thread_eq_Nil [simp]:\n  \"enqueue_new_thread queue nta = [] \\<longleftrightarrow> queue = [] \\<and> (\\<exists>t b. nta = ThreadExists t b)\"\nby(cases nta) simp_all\n\nlemma enqueue_new_threads_eq_Nil [simp]:\n  \"enqueue_new_threads queue ntas = [] \\<longleftrightarrow> queue = [] \\<and> set ntas \\<subseteq> {ThreadExists t b|t b. True}\"\napply(induct ntas arbitrary: queue)\napply(auto simp add: enqueue_new_threads_def)\ndone\n\nlemma distinct_enqueue_new_threads:\n  fixes ts :: \"('l,'t,'x) thread_info\"\n  and ntas :: \"('t,'x,'m) new_thread_action list\"\n  assumes \"thread_oks ts ntas\" \"set queue = dom ts\" \"distinct queue\"\n  shows \"distinct (enqueue_new_threads queue ntas)\"\nusing assms\nproof(induct ntas arbitrary: ts queue)\n  case Nil thus ?case by(simp add: enqueue_new_threads_def)\nnext\n  case (Cons nt ntas)\n  from `thread_oks ts (nt # ntas)`\n  have \"thread_ok ts nt\" and \"thread_oks (redT_updT ts nt) ntas\" by simp_all\n  from `thread_ok ts nt` `set queue = dom ts` `distinct queue`\n  have \"set (enqueue_new_thread queue nt) = dom (redT_updT ts nt) \\<and> distinct (enqueue_new_thread queue nt)\"\n    by(cases nt)(auto)\n  with `thread_oks (redT_updT ts nt) ntas`\n  have \"distinct (enqueue_new_threads (enqueue_new_thread queue nt) ntas)\"\n    by(blast intro: Cons.hyps)\n  thus ?case by(simp add: enqueue_new_threads_def)\nqed\n\nlemma round_robin_reschedule_induct [consumes 1, case_names head rotate]:\n  assumes major: \"t0 \\<in> set queue\"\n  and head: \"\\<And>queue. P (t0 # queue)\"\n  and rotate: \"\\<And>queue t. \\<lbrakk> t \\<noteq> t0; t0 \\<in> set queue; P (queue @ [t]) \\<rbrakk> \\<Longrightarrow> P (t # queue)\"\n  shows \"P queue\"\nusing major\nproof(induct n\\<equiv>\"length (takeWhile (\\<lambda>x. x\\<noteq>t0) queue)\" arbitrary: queue)\n  case 0\n  then obtain queue' where \"queue = t0 # queue'\"\n    by(cases queue)(auto split: split_if_asm)\n  thus ?case by(simp add: head)\nnext\n  case (Suc n)\n  then obtain t queue' where [simp]: \"queue = t # queue'\"\n    and t: \"t \\<noteq> t0\" and n: \"n = length (takeWhile (\\<lambda>x. x \\<noteq> t0) queue')\"\n    and t0: \"t0 \\<in> set queue'\"\n    by(cases queue)(auto split: split_if_asm)\n  from n t0 have \"n = length (takeWhile (\\<lambda>x. x \\<noteq> t0) (queue' @ [t]))\" by(simp)\n  moreover from t0 have \"t0 \\<in> set (queue' @ [t])\" by simp\n  ultimately have \"P (queue' @ [t])\" by(rule Suc.hyps)\n  with t t0 show ?case by(simp add: rotate)\nqed\n\ncontext multithreaded_base begin\n\ndeclare actions_ok_iff [simp del]\ndeclare actions_ok.cases [rule del]\n\nlemma round_robin_step_invar_None:\n  \"\\<lbrakk> round_robin_step n0 \\<sigma> s t' = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>; round_robin_invar \\<sigma> (dom (thr s)) \\<rbrakk>\n  \\<Longrightarrow> round_robin_invar \\<sigma>' (dom (thr s))\"\nby(cases \\<sigma>)(auto dest: step_thread_Some_NoneD simp add: set_enqueue_new_threads distinct_enqueue_new_threads)\n\nlemma round_robin_step_invar_Some:\n  \"\\<lbrakk> deterministic I; round_robin_step n0 \\<sigma> s t' = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>; round_robin_invar \\<sigma> (dom (thr s)); s \\<in> I \\<rbrakk>\n  \\<Longrightarrow> round_robin_invar \\<sigma>' (dom (thr s) \\<union> {t. \\<exists>x m. NewThread t x m \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>})\"\napply(cases \\<sigma>)\napply clarsimp\napply(frule (1) step_thread_Some_SomeD)\napply(auto split: split_if_asm simp add: split_beta set_enqueue_new_threads deterministic_THE)\napply(auto simp add: actions_ok_iff distinct_enqueue_new_threads)\ndone\n\nlemma round_robin_reschedule_Cons:\n  \"round_robin_reschedule t0 (t0 # queue) n0 s = None\"\n  \"t \\<noteq> t0 \\<Longrightarrow> round_robin_reschedule t0 (t # queue) n0 s =\n   (case round_robin_step n0 (t # queue, n0) s t of\n      None \\<Rightarrow> round_robin_reschedule t0 (queue @ [t]) n0 s\n    | Some ttaxm\\<sigma> \\<Rightarrow> Some ttaxm\\<sigma>)\"\nby(simp_all add: round_robin_reschedule.simps)\n\nlemma round_robin_reschedule_NoneD:\n  assumes rrr: \"round_robin_reschedule t0 queue n0 s = None\"\n  and t0: \"t0 \\<in> set queue\"\n  shows \"set (takeWhile (\\<lambda>t'. t' \\<noteq> t0) queue) \\<inter> active_threads s = {}\"\nusing t0 rrr\nproof(induct queue rule: round_robin_reschedule_induct)\n  case (head queue)\n  thus ?case by simp\nnext\n  case (rotate queue t)\n  from `round_robin_reschedule t0 (t # queue) n0 s = None` `t \\<noteq> t0`\n  have \"round_robin_step n0 (t # queue, n0) s t = None\" \n    and \"round_robin_reschedule t0 (queue @ [t]) n0 s = None\"\n    by(simp_all add: round_robin_reschedule_Cons)\n  from this(1) have \"t \\<notin> active_threads s\" by(rule step_thread_NoneD)\n  moreover from `round_robin_reschedule t0 (queue @ [t]) n0 s = None` \n  have \"set (takeWhile (\\<lambda>t'. t' \\<noteq> t0) (queue @ [t])) \\<inter> active_threads s = {}\"\n    by(rule rotate.hyps)\n  moreover have \"takeWhile (\\<lambda>t'. t' \\<noteq> t0) (queue @ [t]) = takeWhile (\\<lambda>t'. t' \\<noteq> t0) queue\"\n    using `t0 \\<in> set queue` by simp\n  ultimately show ?case using `t \\<noteq> t0` by simp\nqed\n\nlemma round_robin_reschedule_Some_NoneD:\n  assumes rrr: \"round_robin_reschedule t0 queue n0 s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\"\n  and t0: \"t0 \\<in> set queue\"\n  shows \"\\<exists>x ln n. thr s t = \\<lfloor>(x, ln)\\<rfloor> \\<and> ln $ n > 0 \\<and> \\<not> waiting (wset s t) \\<and> may_acquire_all (locks s) t ln\"\nusing t0 rrr\nproof(induct queue rule: round_robin_reschedule_induct)\n  case head thus ?case by(simp add: round_robin_reschedule_Cons)\nnext\n  case (rotate queue t')\n  show ?case\n  proof(cases \"round_robin_step n0 (t' # queue, n0) s t'\")\n    case None\n    with `round_robin_reschedule t0 (t' # queue) n0 s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>` `t' \\<noteq> t0`\n    have \"round_robin_reschedule t0 (queue @ [t']) n0 s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\"\n      by(simp add: round_robin_reschedule_Cons)\n    thus ?thesis by(rule rotate.hyps)\n  next\n    case (Some a)\n    with `round_robin_reschedule t0 (t' # queue) n0 s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>` `t' \\<noteq> t0`\n    have \"round_robin_step n0 (t' # queue, n0) s t' = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\"\n      by(simp add: round_robin_reschedule_Cons)\n    thus ?thesis by(blast dest: step_thread_Some_NoneD)\n  qed\nqed\n\nlemma round_robin_reschedule_Some_SomeD:\n  assumes \"deterministic I\"\n  and rrr: \"round_robin_reschedule t0 queue n0 s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\"\n  and t0: \"t0 \\<in> set queue\"\n  and I: \"s \\<in> I\"\n  shows \"\\<exists>x. thr s t = \\<lfloor>(x, no_wait_locks)\\<rfloor> \\<and> t \\<turnstile> \\<langle>x, shr s\\<rangle> -ta\\<rightarrow> \\<langle>x', m'\\<rangle> \\<and> actions_ok s t ta\"\nusing t0 rrr\nproof(induct queue rule: round_robin_reschedule_induct)\n  case head thus ?case by(simp add: round_robin_reschedule_Cons)\nnext\n  case (rotate queue t')\n  show ?case\n  proof(cases \"round_robin_step n0 (t' # queue, n0) s t'\")\n    case None\n    with `round_robin_reschedule t0 (t' # queue) n0 s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>` `t' \\<noteq> t0`\n    have \"round_robin_reschedule t0 (queue @ [t']) n0 s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\"\n      by(simp add: round_robin_reschedule_Cons)\n    thus ?thesis by(rule rotate.hyps)\n  next\n    case (Some a)\n    with `round_robin_reschedule t0 (t' # queue) n0 s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>` `t' \\<noteq> t0`\n    have \"round_robin_step n0 (t' # queue, n0) s t' = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\"\n      by(simp add: round_robin_reschedule_Cons)\n    thus ?thesis using I by(blast dest: step_thread_Some_SomeD[OF `deterministic I`])\n  qed\nqed\n\nlemma round_robin_reschedule_invar_None:\n  assumes rrr: \"round_robin_reschedule t0 queue n0 s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\"\n  and invar: \"round_robin_invar (queue, n0) (dom (thr s))\"\n  and t0: \"t0 \\<in> set queue\"\n  shows \"round_robin_invar \\<sigma>' (dom (thr s))\"\nusing t0 rrr invar\nproof(induct queue rule: round_robin_reschedule_induct)\n  case head thus ?case by(simp add: round_robin_reschedule_Cons)\nnext\n  case (rotate queue t')\n  show ?case\n  proof(cases \"round_robin_step n0 (t' # queue, n0) s t'\")\n    case None\n    with `round_robin_reschedule t0 (t' # queue) n0 s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>` `t' \\<noteq> t0`\n    have \"round_robin_reschedule t0 (queue @ [t']) n0 s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\"\n      by(simp add: round_robin_reschedule_Cons)\n    moreover from `round_robin_invar (t' # queue, n0) (dom (thr s))`\n    have \"round_robin_invar (queue @ [t'], n0) (dom (thr s))\" by simp\n    ultimately show ?thesis by(rule rotate.hyps)\n  next\n    case (Some a)\n    with `round_robin_reschedule t0 (t' # queue) n0 s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>` `t' \\<noteq> t0`\n    have \"round_robin_step n0 (t' # queue, n0) s t' = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\"\n      by(simp add: round_robin_reschedule_Cons)\n    thus ?thesis using `round_robin_invar (t' # queue, n0) (dom (thr s))`\n      by(rule round_robin_step_invar_None)\n  qed\nqed\n\nlemma round_robin_reschedule_invar_Some:\n  assumes \"deterministic I\"\n  and rrr: \"round_robin_reschedule t0 queue n0 s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\"\n  and invar: \"round_robin_invar (queue, n0) (dom (thr s))\"\n  and t0: \"t0 \\<in> set queue\"\n  and \"s \\<in> I\"\n  shows \"round_robin_invar \\<sigma>' (dom (thr s) \\<union> {t. \\<exists>x m. NewThread t x m \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>})\"\nusing t0 rrr invar\nproof(induct queue rule: round_robin_reschedule_induct)\n  case head thus ?case by(simp add: round_robin_reschedule_Cons)\nnext\n  case (rotate queue t')\n  show ?case\n  proof(cases \"round_robin_step n0 (t' # queue, n0) s t'\")\n    case None\n    with `round_robin_reschedule t0 (t' # queue) n0 s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>` `t' \\<noteq> t0`\n    have \"round_robin_reschedule t0 (queue @ [t']) n0 s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\"\n      by(simp add: round_robin_reschedule_Cons)\n    moreover from `round_robin_invar (t' # queue, n0) (dom (thr s))`\n    have \"round_robin_invar (queue @ [t'], n0) (dom (thr s))\" by simp\n    ultimately show ?thesis by(rule rotate.hyps)\n  next\n    case (Some a)\n    with `round_robin_reschedule t0 (t' # queue) n0 s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>` `t' \\<noteq> t0`\n    have \"round_robin_step n0 (t' # queue, n0) s t' = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\"\n      by(simp add: round_robin_reschedule_Cons)\n    thus ?thesis using `round_robin_invar (t' # queue, n0) (dom (thr s))` `s \\<in> I`\n      by(rule round_robin_step_invar_Some[OF `deterministic I`])\n  qed\nqed\n\nlemma round_robin_NoneD: \n  assumes rr: \"round_robin n0 \\<sigma> s = None\"\n  and invar: \"round_robin_invar \\<sigma> (dom (thr s))\"\n  shows \"active_threads s = {}\"\nproof -\n  obtain queue n where \\<sigma>: \"\\<sigma> = (queue, n)\" by(cases \\<sigma>)\n  show ?thesis\n  proof(cases queue)\n    case Nil\n    thus ?thesis using invar \\<sigma> by(fastforce elim: active_threads.cases)\n  next\n    case (Cons t queue')\n    with rr \\<sigma> have \"round_robin_step n0 (t # queue', n) s t = None\"\n      and \"round_robin_reschedule t (queue' @ [t]) n0 s = None\" by simp_all\n    from `round_robin_step n0 (t # queue', n) s t = None`\n    have \"t \\<notin> active_threads s\" by(rule step_thread_NoneD)\n    moreover from `round_robin_reschedule t (queue' @ [t]) n0 s = None`\n    have \"set (takeWhile (\\<lambda>x. x \\<noteq> t) (queue' @ [t])) \\<inter> active_threads s = {}\"\n      by(rule round_robin_reschedule_NoneD) simp\n    moreover from invar \\<sigma> Cons\n    have \"takeWhile (\\<lambda>x. x \\<noteq> t) (queue' @ [t]) = queue'\"\n      by(subst takeWhile_append2) auto\n    moreover from invar have \"active_threads s \\<subseteq> set queue\"\n      using \\<sigma> by(auto elim: active_threads.cases)\n    ultimately show ?thesis using Cons by auto\n  qed\nqed\n\nlemma round_robin_Some_NoneD:\n  assumes rr: \"round_robin n0 \\<sigma> s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\"\n  shows \"\\<exists>x ln n. thr s t = \\<lfloor>(x, ln)\\<rfloor> \\<and> ln $ n > 0 \\<and> \\<not> waiting (wset s t) \\<and> may_acquire_all (locks s) t ln\"\nproof -\n  obtain queue n where \\<sigma>: \"\\<sigma> = (queue, n)\" by(cases \\<sigma>)\n  with rr have \"queue \\<noteq> []\" by clarsimp\n  then obtain t' queue' where queue: \"queue = t' # queue'\"\n    by(auto simp add: neq_Nil_conv)\n  show ?thesis\n  proof(cases \"round_robin_step n0 (t' # queue', n) s t'\")\n    case (Some a)\n    with rr queue \\<sigma> have \"round_robin_step n0 (t' # queue', n) s t' = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\" by simp\n    thus ?thesis by(blast dest: step_thread_Some_NoneD)\n  next\n    case None\n    with rr queue \\<sigma> have \"round_robin_reschedule t' (queue' @ [t']) n0 s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\" by simp\n    thus ?thesis by(rule round_robin_reschedule_Some_NoneD)simp\n  qed\nqed\n\nlemma round_robin_Some_SomeD:\n  assumes \"deterministic I\"\n  and rr: \"round_robin n0 \\<sigma> s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\"\n  and \"s \\<in> I\"\n  shows \"\\<exists>x. thr s t = \\<lfloor>(x, no_wait_locks)\\<rfloor> \\<and> t \\<turnstile> \\<langle>x, shr s\\<rangle> -ta\\<rightarrow> \\<langle>x', m'\\<rangle> \\<and> actions_ok s t ta\"\nproof -\n  obtain queue n where \\<sigma>: \"\\<sigma> = (queue, n)\" by(cases \\<sigma>)\n  with rr have \"queue \\<noteq> []\" by clarsimp\n  then obtain t' queue' where queue: \"queue = t' # queue'\"\n    by(auto simp add: neq_Nil_conv)\n  show ?thesis\n  proof(cases \"round_robin_step n0 (t' # queue', n) s t'\")\n    case (Some a)\n    with rr queue \\<sigma> have \"round_robin_step n0 (t' # queue', n) s t' = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\" by simp\n    thus ?thesis using `s \\<in> I` by(blast dest: step_thread_Some_SomeD[OF `deterministic I`])\n  next\n    case None\n    with rr queue \\<sigma> have \"round_robin_reschedule t' (queue' @ [t']) n0 s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\" by simp\n    thus ?thesis by(rule round_robin_reschedule_Some_SomeD[OF `deterministic I`])(simp_all add: `s \\<in> I`)\n  qed\nqed\n\nlemma round_robin_invar_None:\n  assumes rr: \"round_robin n0 \\<sigma> s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\"\n  and invar: \"round_robin_invar \\<sigma> (dom (thr s))\"\n  shows \"round_robin_invar \\<sigma>' (dom (thr s))\"\nproof -\n  obtain queue n where \\<sigma>: \"\\<sigma> = (queue, n)\" by(cases \\<sigma>)\n  with rr have \"queue \\<noteq> []\" by clarsimp\n  then obtain t' queue' where queue: \"queue = t' # queue'\"\n    by(auto simp add: neq_Nil_conv)\n  show ?thesis\n  proof(cases \"round_robin_step n0 (t' # queue', n) s t'\")\n    case (Some a)\n    with rr queue \\<sigma> have \"round_robin_step n0 (t' # queue', n) s t' = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\" by simp\n    thus ?thesis using invar unfolding \\<sigma> queue by(rule round_robin_step_invar_None)\n  next\n    case None\n    with rr queue \\<sigma> have \"round_robin_reschedule t' (queue' @ [t']) n0 s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\" by simp\n    moreover from invar queue \\<sigma> have \"round_robin_invar (queue' @ [t'], n0) (dom (thr s))\" by simp\n    ultimately show ?thesis by(rule round_robin_reschedule_invar_None) simp\n  qed\nqed\n\nlemma round_robin_invar_Some:\n  assumes \"deterministic I\"\n  and rr: \"round_robin n0 \\<sigma> s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\"\n  and invar: \"round_robin_invar \\<sigma> (dom (thr s))\" \"s \\<in> I\"\n  shows \"round_robin_invar \\<sigma>' (dom (thr s) \\<union> {t. \\<exists>x m. NewThread t x m \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>})\"\nproof -\n  obtain queue n where \\<sigma>: \"\\<sigma> = (queue, n)\" by(cases \\<sigma>)\n  with rr have \"queue \\<noteq> []\" by clarsimp\n  then obtain t' queue' where queue: \"queue = t' # queue'\"\n    by(auto simp add: neq_Nil_conv)\n  show ?thesis\n  proof(cases \"round_robin_step n0 (t' # queue', n) s t'\")\n    case (Some a)\n    with rr queue \\<sigma> have \"round_robin_step n0 (t' # queue', n) s t' = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\" by simp\n    thus ?thesis using invar unfolding \\<sigma> queue by(rule round_robin_step_invar_Some[OF `deterministic I`])\n  next\n    case None\n    with rr queue \\<sigma> have \"round_robin_reschedule t' (queue' @ [t']) n0 s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\" by simp\n    moreover from invar queue \\<sigma>\n    have \"round_robin_invar (queue' @ [t'], n0) (dom (thr s))\" by simp\n    ultimately show ?thesis by(rule round_robin_reschedule_invar_Some[OF `deterministic I`])(simp_all add: `s \\<in> I`)\n  qed\nqed\n\nend\n\nlocale round_robin_base =\n  scheduler_base_aux\n    final r convert_RA\n    thr_\\<alpha> thr_invar thr_lookup thr_update\n    ws_\\<alpha> ws_invar ws_lookup\n    is_\\<alpha> is_invar is_memb is_ins is_delete\n  for final :: \"'x \\<Rightarrow> bool\"\n  and r :: \"'t \\<Rightarrow> ('x \\<times> 'm) \\<Rightarrow> (('l,'t,'x,'m,'w,'o) thread_action \\<times> 'x \\<times> 'm) Predicate.pred\"\n  and convert_RA :: \"'l released_locks \\<Rightarrow> 'o list\"\n  and \"output\" :: \"'queue round_robin \\<Rightarrow> 't \\<Rightarrow> ('l,'t,'x,'m,'w,'o) thread_action \\<Rightarrow> 'q option\"\n  and thr_\\<alpha> :: \"'m_t \\<Rightarrow> ('l,'t,'x) thread_info\"\n  and thr_invar :: \"'m_t \\<Rightarrow> bool\"\n  and thr_lookup :: \"'t \\<Rightarrow> 'm_t \\<rightharpoonup> ('x \\<times> 'l released_locks)\"\n  and thr_update :: \"'t \\<Rightarrow> 'x \\<times> 'l released_locks \\<Rightarrow> 'm_t \\<Rightarrow> 'm_t\"\n  and ws_\\<alpha> :: \"'m_w \\<Rightarrow> ('w,'t) wait_sets\"\n  and ws_invar :: \"'m_w \\<Rightarrow> bool\"\n  and ws_lookup :: \"'t \\<Rightarrow> 'm_w \\<rightharpoonup> 'w wait_set_status\"\n  and ws_update :: \"'t \\<Rightarrow> 'w wait_set_status \\<Rightarrow> 'm_w \\<Rightarrow> 'm_w\"\n  and ws_delete :: \"'t \\<Rightarrow> 'm_w \\<Rightarrow> 'm_w\"\n  and ws_iterate :: \"'m_w \\<Rightarrow> ('t \\<times> 'w wait_set_status, 'm_w) set_iterator\"\n  and ws_sel :: \"'m_w \\<Rightarrow> ('t \\<times> 'w wait_set_status \\<Rightarrow> bool) \\<rightharpoonup> ('t \\<times> 'w wait_set_status)\"\n  and is_\\<alpha> :: \"'s_i \\<Rightarrow> 't interrupts\"\n  and is_invar :: \"'s_i \\<Rightarrow> bool\"\n  and is_memb :: \"'t \\<Rightarrow> 's_i \\<Rightarrow> bool\"\n  and is_ins :: \"'t \\<Rightarrow> 's_i \\<Rightarrow> 's_i\"\n  and is_delete :: \"'t \\<Rightarrow> 's_i \\<Rightarrow> 's_i\"\n  +\n  fixes queue_\\<alpha> :: \"'queue \\<Rightarrow> 't list\"\n  and queue_invar :: \"'queue \\<Rightarrow> bool\"\n  and queue_empty :: \"unit \\<Rightarrow> 'queue\"\n  and queue_isEmpty :: \"'queue \\<Rightarrow> bool\"\n  and queue_enqueue :: \"'t \\<Rightarrow> 'queue \\<Rightarrow> 'queue\"\n  and queue_dequeue :: \"'queue \\<Rightarrow> 't \\<times> 'queue\"\n  and queue_push :: \"'t \\<Rightarrow> 'queue \\<Rightarrow> 'queue\"\nbegin\n\ndefinition queue_rotate1 :: \"'queue \\<Rightarrow> 'queue\"\nwhere \"queue_rotate1 = split queue_enqueue \\<circ> queue_dequeue\"\n\nprimrec enqueue_new_thread :: \"'queue \\<Rightarrow> ('t,'x,'m) new_thread_action \\<Rightarrow> 'queue\"\nwhere \n  \"enqueue_new_thread ts (NewThread t x m) = queue_enqueue t ts\"\n| \"enqueue_new_thread ts (ThreadExists t b) = ts\"\n\ndefinition enqueue_new_threads :: \"'queue \\<Rightarrow> ('t,'x,'m) new_thread_action list \\<Rightarrow> 'queue\"\nwhere\n  \"enqueue_new_threads = foldl enqueue_new_thread\"\n\nprimrec round_robin_update_state :: \"nat \\<Rightarrow> 'queue round_robin \\<Rightarrow> 't \\<Rightarrow> ('l,'t,'x,'m,'w,'o) thread_action \\<Rightarrow> 'queue round_robin\"\nwhere \n  \"round_robin_update_state n0 (queue, n) t ta =\n   (let queue' = enqueue_new_threads queue \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>\n    in if n = 0 \\<or> Yield \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>c\\<^esub> then (queue_rotate1 queue', n0) else (queue', n - 1))\"\n\nabbreviation round_robin_step ::\n  \"nat \\<Rightarrow> 'queue round_robin \\<Rightarrow> ('l,'t,'m,'m_t,'m_w,'s_i) state_refine \\<Rightarrow> 't \n  \\<Rightarrow> ('t \\<times> (('l,'t,'x,'m,'w,'o) thread_action \\<times> 'x \\<times> 'm) option \\<times> 'queue round_robin) option\"\nwhere\n  \"round_robin_step n0 \\<sigma> s t \\<equiv> step_thread (round_robin_update_state n0 \\<sigma> t) s t\"\n\npartial_function (option) round_robin_reschedule ::\n  \"'t \\<Rightarrow> 'queue \\<Rightarrow> nat \\<Rightarrow> ('l,'t,'m,'m_t,'m_w,'s_i) state_refine \n  \\<Rightarrow> ('t \\<times> (('l,'t,'x,'m,'w,'o) thread_action \\<times> 'x \\<times> 'm) option \\<times> 'queue round_robin) option\"\nwhere\n  \"round_robin_reschedule t0 queue n0 s =\n   (let\n      (t, queue') = queue_dequeue queue\n    in\n      if t = t0 then\n        None \n      else\n        case round_robin_step n0 (queue_push t queue', n0) s t of\n          None \\<Rightarrow> round_robin_reschedule t0 (queue_enqueue t queue') n0 s\n        | \\<lfloor>ttaxm\\<sigma>\\<rfloor> \\<Rightarrow> \\<lfloor>ttaxm\\<sigma>\\<rfloor>)\"\n\nprimrec round_robin :: \"nat \\<Rightarrow> ('l,'t,'x,'m,'w,'o,'m_t,'m_w,'s_i,'queue round_robin) scheduler\"\nwhere \n  \"round_robin n0 (queue, n) s = \n   (if queue_isEmpty queue then None\n    else\n      let\n        (t, queue') = queue_dequeue queue\n      in\n        (case round_robin_step n0 (queue_push t queue', n) s t of\n           \\<lfloor>ttaxm\\<sigma>\\<rfloor> \\<Rightarrow> \\<lfloor>ttaxm\\<sigma>\\<rfloor>\n         | None \\<Rightarrow> round_robin_reschedule t (queue_enqueue t queue') n0 s))\"\n\nprimrec round_robin_invar :: \"'queue round_robin \\<Rightarrow> 't set \\<Rightarrow> bool\"\nwhere \"round_robin_invar (queue, n) T \\<longleftrightarrow> queue_invar queue \\<and> Round_Robin.round_robin_invar (queue_\\<alpha> queue, n) T\"\n\ndefinition round_robin_\\<alpha> :: \"'queue round_robin \\<Rightarrow> 't list round_robin\"\nwhere \"round_robin_\\<alpha> = apfst queue_\\<alpha>\"\n\ndefinition round_robin_start :: \"nat \\<Rightarrow> 't \\<Rightarrow> 'queue round_robin\"\nwhere \"round_robin_start n0 t = (queue_enqueue t (queue_empty ()), n0)\"\n\nlemma round_robin_invar_correct:\n  \"round_robin_invar \\<sigma> T \\<Longrightarrow> Round_Robin.round_robin_invar (round_robin_\\<alpha> \\<sigma>) T\"\nby(cases \\<sigma>)(simp add: round_robin_\\<alpha>_def)\n\nend\n\nlocale round_robin =\n  round_robin_base\n    final r convert_RA \"output\"\n    thr_\\<alpha> thr_invar thr_lookup thr_update\n    ws_\\<alpha> ws_invar ws_lookup ws_update ws_delete ws_iterate ws_sel\n    is_\\<alpha> is_invar is_memb is_ins is_delete\n    queue_\\<alpha> queue_invar queue_empty queue_isEmpty queue_enqueue queue_dequeue queue_push\n  +\n  scheduler_aux\n    final r convert_RA\n    thr_\\<alpha> thr_invar thr_lookup thr_update\n    ws_\\<alpha> ws_invar ws_lookup\n    is_\\<alpha> is_invar is_memb is_ins is_delete\n  +\n  ws!: map_update ws_\\<alpha> ws_invar ws_update +\n  ws!: map_delete ws_\\<alpha> ws_invar ws_delete +\n  ws!: map_iteratei ws_\\<alpha> ws_invar ws_iterate +\n  ws!: map_sel' ws_\\<alpha> ws_invar ws_sel +\n  queue!: list queue_\\<alpha> queue_invar +\n  queue!: list_empty queue_\\<alpha> queue_invar queue_empty +\n  queue!: list_isEmpty queue_\\<alpha> queue_invar queue_isEmpty +\n  queue!: list_enqueue queue_\\<alpha> queue_invar queue_enqueue +\n  queue!: list_dequeue queue_\\<alpha> queue_invar queue_dequeue +\n  queue!: list_push queue_\\<alpha> queue_invar queue_push\n  for final :: \"'x \\<Rightarrow> bool\"\n  and r :: \"'t \\<Rightarrow> ('x \\<times> 'm) \\<Rightarrow> (('l,'t,'x,'m,'w,'o) thread_action \\<times> 'x \\<times> 'm) Predicate.pred\"\n  and convert_RA :: \"'l released_locks \\<Rightarrow> 'o list\"\n  and \"output\" :: \"'queue round_robin \\<Rightarrow> 't \\<Rightarrow> ('l,'t,'x,'m,'w,'o) thread_action \\<Rightarrow> 'q option\"\n  and thr_\\<alpha> :: \"'m_t \\<Rightarrow> ('l,'t,'x) thread_info\"\n  and thr_invar :: \"'m_t \\<Rightarrow> bool\"\n  and thr_lookup :: \"'t \\<Rightarrow> 'm_t \\<rightharpoonup> ('x \\<times> 'l released_locks)\"\n  and thr_update :: \"'t \\<Rightarrow> 'x \\<times> 'l released_locks \\<Rightarrow> 'm_t \\<Rightarrow> 'm_t\"\n  and ws_\\<alpha> :: \"'m_w \\<Rightarrow> ('w,'t) wait_sets\"\n  and ws_invar :: \"'m_w \\<Rightarrow> bool\"\n  and ws_lookup :: \"'t \\<Rightarrow> 'm_w \\<rightharpoonup> 'w wait_set_status\"\n  and ws_update :: \"'t \\<Rightarrow> 'w wait_set_status \\<Rightarrow> 'm_w \\<Rightarrow> 'm_w\"\n  and ws_delete :: \"'t \\<Rightarrow> 'm_w \\<Rightarrow> 'm_w\"\n  and ws_iterate :: \"'m_w \\<Rightarrow> ('t \\<times> 'w wait_set_status, 'm_w) set_iterator\"\n  and ws_sel :: \"'m_w \\<Rightarrow> ('t \\<times> 'w wait_set_status \\<Rightarrow> bool) \\<rightharpoonup> ('t \\<times> 'w wait_set_status)\"\n  and is_\\<alpha> :: \"'s_i \\<Rightarrow> 't interrupts\"\n  and is_invar :: \"'s_i \\<Rightarrow> bool\"\n  and is_memb :: \"'t \\<Rightarrow> 's_i \\<Rightarrow> bool\"\n  and is_ins :: \"'t \\<Rightarrow> 's_i \\<Rightarrow> 's_i\"\n  and is_delete :: \"'t \\<Rightarrow> 's_i \\<Rightarrow> 's_i\"\n  and queue_\\<alpha> :: \"'queue \\<Rightarrow> 't list\"\n  and queue_invar :: \"'queue \\<Rightarrow> bool\"\n  and queue_empty :: \"unit \\<Rightarrow> 'queue\"\n  and queue_isEmpty :: \"'queue \\<Rightarrow> bool\"\n  and queue_enqueue :: \"'t \\<Rightarrow> 'queue \\<Rightarrow> 'queue\"\n  and queue_dequeue :: \"'queue \\<Rightarrow> 't \\<times> 'queue\"\n  and queue_push :: \"'t \\<Rightarrow> 'queue \\<Rightarrow> 'queue\"\nbegin\n\nlemma queue_rotate1_correct:\n  assumes \"queue_invar queue\" \"queue_\\<alpha> queue \\<noteq> []\"\n  shows \"queue_\\<alpha> (queue_rotate1 queue) = rotate1 (queue_\\<alpha> queue)\"\n  and \"queue_invar (queue_rotate1 queue)\"\nusing assms\napply(auto simp add: queue_rotate1_def split_beta queue.dequeue_correct queue.enqueue_correct)\nby(cases \"queue_\\<alpha> queue\") simp_all\n\nlemma enqueue_thread_correct:\n  assumes \"queue_invar queue\"\n  shows \"queue_\\<alpha> (enqueue_new_thread queue nta) = Round_Robin.enqueue_new_thread (queue_\\<alpha> queue) nta\"\n  and \"queue_invar (enqueue_new_thread queue nta)\"\nusing assms\nby(case_tac [!] nta)(simp_all add: queue.enqueue_correct)\n\nlemma enqueue_threads_correct:\n  assumes \"queue_invar queue\"\n  shows \"queue_\\<alpha> (enqueue_new_threads queue ntas) = Round_Robin.enqueue_new_threads (queue_\\<alpha> queue) ntas\"\n  and \"queue_invar (enqueue_new_threads queue ntas)\"\nusing assms\napply(induct ntas arbitrary: queue)\napply(simp_all add: enqueue_new_threads_def Round_Robin.enqueue_new_threads_def enqueue_thread_correct)\ndone\n\nlemma round_robin_update_thread_correct:\n  assumes \"round_robin_invar \\<sigma> T\" \"t' \\<in> T\"\n  shows \"round_robin_\\<alpha> (round_robin_update_state n0 \\<sigma> t ta) = Round_Robin.round_robin_update_state n0 (round_robin_\\<alpha> \\<sigma>) t ta\"\nusing assms\napply(cases \\<sigma>)\napply(auto simp add: round_robin_\\<alpha>_def queue_rotate1_correct enqueue_threads_correct del: conjI)\napply(subst (1 2) queue_rotate1_correct)\napply(auto simp add: enqueue_threads_correct)\ndone\n\nlemma round_robin_step_correct:\n  assumes det: \"\\<alpha>.deterministic I\"\n  and invar: \"round_robin_invar \\<sigma> (dom (thr_\\<alpha> (thr s)))\" \"state_invar s\" \"state_\\<alpha> s \\<in> I\"\n  shows\n  \"map_option (apsnd (apsnd round_robin_\\<alpha>)) (round_robin_step n0 \\<sigma> s t) = \n   \\<alpha>.round_robin_step n0 (round_robin_\\<alpha> \\<sigma>) (state_\\<alpha> s) t\" (is ?thesis1)\n  and \"case_option True (\\<lambda>(t, taxm, \\<sigma>). round_robin_invar \\<sigma> (case taxm of None \\<Rightarrow> dom (thr_\\<alpha> (thr s)) | Some (ta, x', m') \\<Rightarrow> dom (thr_\\<alpha> (thr s)) \\<union> {t. \\<exists>x m. NewThread t x m \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>})) (round_robin_step n0 \\<sigma> s t)\"\n  (is ?thesis2)\nproof -\n  have \"?thesis1 \\<and> ?thesis2\"\n  proof(cases \"dom (thr_\\<alpha> (thr s)) = {}\")\n    case True\n    thus ?thesis using invar\n      apply(cases \\<sigma>)\n      apply(auto dest: step_thread_Some_NoneD[OF det] step_thread_Some_SomeD[OF det])\n      apply(fastforce simp add: \\<alpha>.step_thread_eq_None_conv elim: \\<alpha>.active_threads.cases intro: sym)\n      done\n  next\n    case False\n    then obtain t' where t': \"t' \\<in> dom (thr_\\<alpha> (thr s))\" by blast\n    hence ?thesis1\n      using step_thread_correct(1)[of I round_robin_invar \\<sigma> s round_robin_\\<alpha> \"round_robin_update_state n0 \\<sigma> t\" t, OF det invar]\n      unfolding o_def using invar\n      by(subst (asm) round_robin_update_thread_correct) auto\n    moreover\n    { fix ta :: \"('l, 't, 'x, 'm, 'w, 'o) thread_action\"\n      assume \"FWThread.thread_oks (thr_\\<alpha> (thr s)) \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>\"\n      moreover from t' invar have \"queue_\\<alpha> (fst \\<sigma>) \\<noteq> []\" by(cases \\<sigma>) auto\n      ultimately have \"round_robin_invar (round_robin_update_state n0 \\<sigma> t ta) (dom (thr_\\<alpha> (thr s)) \\<union> {t. \\<exists>x m. NewThread t x m \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>})\"\n        using invar t' by(cases \\<sigma>)(auto simp add: queue_rotate1_correct enqueue_threads_correct set_enqueue_new_threads iff del: domIff intro: distinct_enqueue_new_threads) }\n    from step_thread_correct(2)[OF det, of round_robin_invar \\<sigma> s \"round_robin_update_state n0 \\<sigma> t\" t, OF invar this]\n    have ?thesis2 using t' invar by simp\n    ultimately show ?thesis by blast\n  qed\n  thus ?thesis1 ?thesis2 by blast+\nqed\n\nlemma round_robin_reschedule_correct:\n  assumes det: \"\\<alpha>.deterministic I\"\n  and invar: \"round_robin_invar (queue, n) (dom (thr_\\<alpha> (thr s)))\" \"state_invar s\" \"state_\\<alpha> s \\<in> I\"\n  and t0: \"t0 \\<in> set (queue_\\<alpha> queue)\"\n  shows \"map_option (apsnd (apsnd round_robin_\\<alpha>)) (round_robin_reschedule t0 queue n0 s) =\n     \\<alpha>.round_robin_reschedule t0 (queue_\\<alpha> queue) n0 (state_\\<alpha> s)\"\n  and \"case_option True (\\<lambda>(t, taxm, \\<sigma>). round_robin_invar \\<sigma> (case taxm of None \\<Rightarrow> dom (thr_\\<alpha> (thr s)) | Some (ta, x', m') \\<Rightarrow> dom (thr_\\<alpha> (thr s)) \\<union> {t. \\<exists>x m. NewThread t x m \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>})) (round_robin_reschedule t0 queue n0 s)\"\nusing t0 invar\nproof(induct \"queue_\\<alpha> queue\" arbitrary: queue n rule: round_robin_reschedule_induct)\n  case head\n  { case 1 thus ?case using head[symmetric]\n      by(subst round_robin_reschedule.simps)(subst \\<alpha>.round_robin_reschedule.simps, clarsimp simp add: split_beta queue.dequeue_correct) \n  next\n    case 2 thus ?case using head[symmetric]\n      by(subst round_robin_reschedule.simps)(clarsimp simp add: split_beta queue.dequeue_correct) }\nnext\n  case (rotate \\<alpha>queue' t)\n  obtain t' queue' where queue': \"queue_dequeue queue = (t', queue')\" by(cases \"queue_dequeue queue\")\n  note [simp] = `t # \\<alpha>queue' = queue_\\<alpha> queue`[symmetric]\n  { case 1\n    with queue' have [simp]: \"t' = t\" \"\\<alpha>queue' = queue_\\<alpha> queue'\" \"queue_invar queue'\" by(auto elim: queue.removelE)\n    from 1 queue' have invar': \"round_robin_invar (queue_push t queue', n0) (dom (thr_\\<alpha> (thr s)))\"\n      by(auto simp add: queue.push_correct)\n    show ?case\n    proof(cases \"round_robin_step n0 (queue_push t queue', n0) s t\")\n      case Some thus ?thesis\n        using queue' `t \\<noteq> t0` round_robin_step_correct[OF det invar' `state_invar s`, of n0 t] invar' `state_\\<alpha> s \\<in> I`\n        by(subst round_robin_reschedule.simps)(subst \\<alpha>.round_robin_reschedule.simps, auto simp add: round_robin_\\<alpha>_def queue.push_correct)\n    next\n      case None\n      hence \\<alpha>None: \"\\<alpha>.round_robin_step n0 (queue_\\<alpha> (queue_push t queue'), n0) (state_\\<alpha> s) t = None\"\n        using round_robin_step_correct[OF det invar' `state_invar s`, of n0 t] invar' `state_\\<alpha> s \\<in> I`\n        by(auto simp add: queue.push_correct round_robin_\\<alpha>_def)\n      have \"\\<alpha>queue' @ [t] = queue_\\<alpha> (queue_enqueue t queue')\" by(simp add: queue.enqueue_correct)\n      moreover from invar'\n      have \"round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\\<alpha> (thr s)))\"\n        by(auto simp add: queue.enqueue_correct queue.push_correct)\n      ultimately \n      have \"map_option (apsnd (apsnd round_robin_\\<alpha>)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s) =\n            \\<alpha>.round_robin_reschedule t0 (queue_\\<alpha> (queue_enqueue t queue')) n0 (state_\\<alpha> s)\"\n        using `state_invar s` `state_\\<alpha> s \\<in> I` by(rule rotate.hyps)\n      thus ?thesis using None \\<alpha>None `t \\<noteq> t0` invar' queue'\n        by(subst round_robin_reschedule.simps)(subst \\<alpha>.round_robin_reschedule.simps, auto simp add: queue.enqueue_correct queue.push_correct)\n    qed\n  next\n    case 2\n    with queue' have [simp]: \"t' = t\" \"\\<alpha>queue' = queue_\\<alpha> queue'\" \"queue_invar queue'\" by(auto elim: queue.removelE)\n    from 2 queue' have invar': \"round_robin_invar (queue_push t queue', n0) (dom (thr_\\<alpha> (thr s)))\"\n      by(auto simp add: queue.push_correct)\n    show ?case\n    proof(cases \"round_robin_step n0 (queue_push t queue', n0) s t\")\n      case Some thus ?thesis\n        using queue' `t \\<noteq> t0` round_robin_step_correct[OF det invar' `state_invar s`, of n0 t] invar' `state_\\<alpha> s \\<in> I`\n        by(subst round_robin_reschedule.simps)(auto simp add: round_robin_\\<alpha>_def queue.push_correct)\n    next\n      case None\n      have \"\\<alpha>queue' @ [t] = queue_\\<alpha> (queue_enqueue t queue')\" by(simp add: queue.enqueue_correct)\n      moreover from invar'\n      have \"round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\\<alpha> (thr s)))\"\n        by(auto simp add: queue.enqueue_correct queue.push_correct)\n      ultimately \n      have \"case_option True (\\<lambda>(t, taxm, \\<sigma>). round_robin_invar \\<sigma> (case_option (dom (thr_\\<alpha> (thr s))) (\\<lambda>(ta, x', m'). dom (thr_\\<alpha> (thr s)) \\<union> {t. \\<exists>x m. NewThread t x m \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>}) taxm)) (round_robin_reschedule t0 (queue_enqueue t queue') n0 s)\"\n        using `state_invar s` `state_\\<alpha> s \\<in> I` by(rule rotate.hyps)\n      thus ?thesis using None `t \\<noteq> t0` invar' queue'\n        by(subst round_robin_reschedule.simps)(auto simp add: queue.enqueue_correct queue.push_correct)\n    qed\n  }\nqed\n\nlemma round_robin_correct:\n  assumes det: \"\\<alpha>.deterministic I\"\n  and invar: \"round_robin_invar \\<sigma> (dom (thr_\\<alpha> (thr s)))\" \"state_invar s\" \"state_\\<alpha> s \\<in> I\"\n  shows \"map_option (apsnd (apsnd round_robin_\\<alpha>)) (round_robin n0 \\<sigma> s) =\n         \\<alpha>.round_robin n0 (round_robin_\\<alpha> \\<sigma>) (state_\\<alpha> s)\"\n    (is ?thesis1)\n  and \"case_option True (\\<lambda>(t, taxm, \\<sigma>). round_robin_invar \\<sigma> (case taxm of None \\<Rightarrow> dom (thr_\\<alpha> (thr s)) | Some (ta, x', m') \\<Rightarrow> dom (thr_\\<alpha> (thr s)) \\<union> {t. \\<exists>x m. NewThread t x m \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>})) (round_robin n0 \\<sigma> s)\"\n    (is ?thesis2)\nproof -\n  obtain queue n where \\<sigma>: \"\\<sigma> = (queue, n)\" by(cases \\<sigma>)\n  have \"?thesis1 \\<and> ?thesis2\"\n  proof(cases \"queue_\\<alpha> queue\")\n    case Nil thus ?thesis using invar \\<sigma>\n      by(auto simp add: split_beta queue.isEmpty_correct round_robin_\\<alpha>_def)\n  next\n    case (Cons t \\<alpha>queue')\n    with invar \\<sigma> obtain queue'\n      where [simp]: \"queue_dequeue queue = (t, queue')\" \"\\<alpha>queue' = queue_\\<alpha> queue'\" \"queue_invar queue'\"\n      by(auto elim: queue.removelE)\n    from invar \\<sigma> Cons have invar': \"round_robin_invar (queue_push t queue', n) (dom (thr_\\<alpha> (thr s)))\"\n      by(auto simp add: queue.push_correct)\n    from invar \\<sigma> Cons have invar'': \"round_robin_invar (queue_enqueue t queue', n0) (dom (thr_\\<alpha> (thr s)))\"\n      by(auto simp add: queue.enqueue_correct)\n    show ?thesis\n    proof(cases \"round_robin_step n0 (queue_push t queue', n) s t\")\n      case Some\n      with \\<sigma> Cons invar show ?thesis\n        using round_robin_step_correct[OF det invar' `state_invar s`, of n0 t]\n        by(auto simp add: queue.isEmpty_correct queue.push_correct round_robin_\\<alpha>_def)\n    next\n      case None\n      from invar \\<sigma> Cons have \"t \\<in> set (queue_\\<alpha> (queue_enqueue t queue'))\"\n        by(auto simp add: queue.enqueue_correct)      \n      from round_robin_reschedule_correct[OF det invar'' `state_invar s`, OF `state_\\<alpha> s \\<in> I` this, of n0] None \\<sigma> Cons invar\n        round_robin_step_correct[OF det invar' `state_invar s`, of n0 t]\n      show ?thesis by(auto simp add: queue.isEmpty_correct queue.push_correct round_robin_\\<alpha>_def queue.enqueue_correct)\n    qed\n  qed\n  thus ?thesis1 ?thesis2 by simp_all\nqed\n\nlemma round_robin_scheduler_spec:\n  assumes det: \"\\<alpha>.deterministic I\"\n  shows \"scheduler_spec final r (round_robin n0) round_robin_invar thr_\\<alpha> thr_invar ws_\\<alpha> ws_invar is_\\<alpha> is_invar I\"\nproof\n  fix \\<sigma> s\n  assume rr: \"round_robin n0 \\<sigma> s = None\"\n    and invar: \"round_robin_invar \\<sigma> (dom (thr_\\<alpha> (thr s)))\" \"state_invar s\" \"state_\\<alpha> s \\<in> I\"\n  from round_robin_correct[OF det, OF invar, of n0] rr\n  have \"\\<alpha>.round_robin n0 (round_robin_\\<alpha> \\<sigma>) (state_\\<alpha> s) = None\" by simp\n  moreover from invar have \"Round_Robin.round_robin_invar (round_robin_\\<alpha> \\<sigma>) (dom (thr (state_\\<alpha> s)))\"\n    by(simp add: round_robin_invar_correct)\n  ultimately show \"\\<alpha>.active_threads (state_\\<alpha> s) = {}\" by(rule \\<alpha>.round_robin_NoneD)\nnext\n  fix \\<sigma> s t \\<sigma>'\n  assume rr: \"round_robin n0 \\<sigma> s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\"\n    and invar: \"round_robin_invar \\<sigma> (dom (thr_\\<alpha> (thr s)))\" \"state_invar s\" \"state_\\<alpha> s \\<in> I\"\n  from round_robin_correct[OF det, OF invar, of n0] rr\n  have rr': \"\\<alpha>.round_robin n0 (round_robin_\\<alpha> \\<sigma>) (state_\\<alpha> s) = \\<lfloor>(t, None, round_robin_\\<alpha> \\<sigma>')\\<rfloor>\" by simp\n  then show \"\\<exists>x ln n. thr_\\<alpha> (thr s) t = \\<lfloor>(x, ln)\\<rfloor> \\<and> 0 < ln $ n \\<and> \\<not> waiting (ws_\\<alpha> (wset s) t) \\<and> may_acquire_all (locks s) t ln\"\n    by(rule \\<alpha>.round_robin_Some_NoneD[where s=\"state_\\<alpha> s\", unfolded state_\\<alpha>_conv])\nnext\n  fix \\<sigma> s t ta x' m' \\<sigma>'\n  assume rr: \"round_robin n0 \\<sigma> s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\"\n    and invar: \"round_robin_invar \\<sigma> (dom (thr_\\<alpha> (thr s)))\" \"state_invar s\" \"state_\\<alpha> s \\<in> I\"\n  from round_robin_correct[OF det, OF invar, of n0] rr\n  have rr': \"\\<alpha>.round_robin n0 (round_robin_\\<alpha> \\<sigma>) (state_\\<alpha> s) = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, round_robin_\\<alpha> \\<sigma>')\\<rfloor>\" by simp\n  thus \"\\<exists>x. thr_\\<alpha> (thr s) t = \\<lfloor>(x, no_wait_locks)\\<rfloor> \\<and> Predicate.eval (r t (x, shr s)) (ta, x', m') \\<and> \\<alpha>.actions_ok (state_\\<alpha> s) t ta\"\n    using `state_\\<alpha> s \\<in> I` by(rule \\<alpha>.round_robin_Some_SomeD[OF det, where s=\"state_\\<alpha> s\", unfolded state_\\<alpha>_conv])\nnext\n  fix \\<sigma> s t \\<sigma>'\n  assume rr: \"round_robin n0 \\<sigma> s = \\<lfloor>(t, None, \\<sigma>')\\<rfloor>\"\n    and invar: \"round_robin_invar \\<sigma> (dom (thr_\\<alpha> (thr s)))\" \"state_invar s\" \"state_\\<alpha> s \\<in> I\"\n  from round_robin_correct[OF det, OF invar, of n0] rr\n  show \"round_robin_invar \\<sigma>' (dom (thr_\\<alpha> (thr s)))\" by simp\nnext\n  fix \\<sigma> s t ta x' m' \\<sigma>'\n  assume rr: \"round_robin n0 \\<sigma> s = \\<lfloor>(t, \\<lfloor>(ta, x', m')\\<rfloor>, \\<sigma>')\\<rfloor>\"\n    and invar: \"round_robin_invar \\<sigma> (dom (thr_\\<alpha> (thr s)))\" \"state_invar s\" \"state_\\<alpha> s \\<in> I\"\n  from round_robin_correct[OF det, OF invar, of n0] rr\n  show \"round_robin_invar \\<sigma>' (dom (thr_\\<alpha> (thr s)) \\<union> {t. \\<exists>x m. NewThread t x m \\<in> set \\<lbrace>ta\\<rbrace>\\<^bsub>t\\<^esub>})\" by simp\nqed\n\nlemma round_robin_start_invar:\n  \"round_robin_invar (round_robin_start n0 t0) {t0}\"\nby(simp add: round_robin_start_def queue.empty_correct queue.enqueue_correct)\n\nend\n\nsublocale round_robin_base <\n  scheduler_base\n    final r convert_RA\n    \"round_robin n0\" \"output\" \"pick_wakeup_via_sel (\\<lambda>s P. ws_sel s (\\<lambda>(k,v). P k v))\" round_robin_invar\n    thr_\\<alpha> thr_invar thr_lookup thr_update\n    ws_\\<alpha> ws_invar ws_lookup ws_update ws_delete ws_iterate\n    is_\\<alpha> is_invar is_memb is_ins is_delete\n  for n0 .\n\nsublocale round_robin <\n  pick_wakeup_spec\n    final r convert_RA\n    \"pick_wakeup_via_sel (\\<lambda>s P. ws_sel s (\\<lambda>(k,v). P k v))\" round_robin_invar\n    thr_\\<alpha> thr_invar\n    ws_\\<alpha> ws_invar\n    is_\\<alpha> is_invar\nby(rule pick_wakeup_spec_via_sel)(unfold_locales)\n\ncontext round_robin begin\n\nlemma round_robin_scheduler:\n  assumes det: \"\\<alpha>.deterministic I\"\n  shows \n  \"scheduler\n     final r convert_RA\n     (round_robin n0) (pick_wakeup_via_sel (\\<lambda>s P. ws_sel s (\\<lambda>(k,v). P k v))) round_robin_invar \n     thr_\\<alpha> thr_invar thr_lookup thr_update \n     ws_\\<alpha> ws_invar ws_lookup ws_update ws_delete ws_iterate\n     is_\\<alpha> is_invar is_memb is_ins is_delete\n     I\"\nproof -\n  interpret scheduler_spec\n      final r convert_RA\n      \"round_robin n0\" round_robin_invar\n      thr_\\<alpha> thr_invar\n      ws_\\<alpha> ws_invar\n      is_\\<alpha> is_invar\n      I\n    using det by(rule round_robin_scheduler_spec)\n\n  show ?thesis by(unfold_locales)(rule \\<alpha>.deterministic_invariant3p[OF det])\nqed\n\nend\n\nlemmas [code] =\n  round_robin_base.queue_rotate1_def\n  round_robin_base.enqueue_new_thread.simps\n  round_robin_base.enqueue_new_threads_def\n  round_robin_base.round_robin_update_state.simps\n  round_robin_base.round_robin_reschedule.simps\n  round_robin_base.round_robin.simps\n  round_robin_base.round_robin_start_def\n\nend", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/JinjaThreads/Execute/Round_Robin.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6654105454764747, "lm_q2_score": 0.45326184801538616, "lm_q1q2_score": 0.3016052135315931}}
{"text": "section \\<open>Priority Search Trees on top of RBTs\\<close>\n\ntheory PST_RBT\n  imports\n  \"HOL-Data_Structures.Cmp\"\n  \"HOL-Data_Structures.Isin2\"\n  \"HOL-Data_Structures.Lookup2\"\n  PST_General\n  \"Eval_Base.Eval_Base\"\nbegin\n  \ntext \\<open>\nWe obtain a priority search map based on red-black trees via the \ngeneral priority search tree augmentation.\n\nThis theory has been derived from the standard Isabelle implementation of red \nblack trees in @{session \"HOL-Data_Structures\"}.\n\\<close>\n\nsubsection \\<open>Definitions\\<close>\n\nsubsubsection \\<open>The Code\\<close>\n\ndatatype tcolor = Red | Black\n\ntype_synonym ('k,'p) rbth = \"(('k\\<times>'p) \\<times> (tcolor \\<times> ('k \\<times> 'p))) tree\"\n\nabbreviation R where \"R mkp l a r \\<equiv> Node l (a, Red,mkp) r\"\nabbreviation B where \"B mkp l a r \\<equiv> Node l (a, Black,mkp) r\"\n\nabbreviation \"mkR \\<equiv> mkNode Red\"\nabbreviation \"mkB \\<equiv> mkNode Black\"\n\nfun baliL :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k\\<times>'p \\<Rightarrow> ('k,'p) rbth \\<Rightarrow> ('k,'p) rbth\" \n  where\n  \"baliL (R _ (R _ t1 a1 t2) a2 t3) a3 t4 = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\"\n| \"baliL (R _ t1 a1 (R _ t2 a2 t3)) a3 t4 = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\"\n| \"baliL t1 a t2 = mkB t1 a t2\"\n\nfun baliR :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k\\<times>'p \\<Rightarrow> ('k,'p) rbth \\<Rightarrow> ('k,'p) rbth\" \n  where\n\"baliR t1 a1 (R _ (R _ t2 a2 t3) a3 t4) = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\" |\n\"baliR t1 a1 (R _ t2 a2 (R _ t3 a3 t4)) = mkR (mkB t1 a1 t2) a2 (mkB t3 a3 t4)\" |\n\"baliR t1 a t2 = mkB t1 a t2\"\n\nfun paint :: \"tcolor \\<Rightarrow> ('k,'p::linorder) rbth \\<Rightarrow> ('k,'p::linorder) rbth\" where\n\"paint c Leaf = Leaf\" |\n\"paint c (Node l (a, (_,mkp)) r) = Node l (a, (c,mkp)) r\"\n\nfun baldL :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k \\<times> 'p \\<Rightarrow> ('k,'p::linorder) rbth \n    \\<Rightarrow> ('k,'p::linorder) rbth\" \nwhere\n\"baldL (R _ t1 x t2) y t3 = mkR (mkB t1 x t2) y t3\" |\n\"baldL bl x (B _ t1 y t2) = baliR bl x (mkR t1 y t2)\" |\n\"baldL bl x (R _ (B _ t1 y t2) z t3) \n  = mkR (mkB bl x t1) y (baliR t2 z (paint Red t3))\" |\n\"baldL t1 x t2 = mkR t1 x t2\"\n\nfun baldR :: \"('k,'p::linorder) rbth \\<Rightarrow> 'k \\<times> 'p \\<Rightarrow> ('k,'p::linorder) rbth \n    \\<Rightarrow> ('k,'p::linorder) rbth\" \nwhere\n\"baldR t1 x (R _ t2 y t3) = mkR t1 x (mkB t2 y t3)\" |\n\"baldR (B _ t1 x t2) y t3 = baliL (mkR t1 x t2) y t3\" |\n\"baldR (R _ t1 x (B _ t2 y t3)) z t4 \n  = mkR (baliL (paint Red t1) x t2) y (mkB t3 z t4)\" |\n\"baldR t1 x t2 = mkR t1 x t2\"\n\nfun combine :: \"('k,'p::linorder) rbth \\<Rightarrow> ('k,'p::linorder) rbth \n    \\<Rightarrow> ('k,'p::linorder) rbth\" \nwhere\n\"combine Leaf t = t\" |\n\"combine t Leaf = t\" |\n\"combine (R _ t1 a t2) (R _ t3 c t4) =\n  (case combine t2 t3 of\n     R _ u2 b u3 \\<Rightarrow> (mkR (mkR t1 a u2) b (mkR u3 c t4)) |\n     t23 \\<Rightarrow> mkR t1 a (mkR t23 c t4))\" |\n\"combine (B _ t1 a t2) (B _ t3 c t4) =\n  (case combine t2 t3 of\n     R _ t2' b t3' \\<Rightarrow> mkR (mkB t1 a t2') b (mkB t3' c t4) |\n     t23 \\<Rightarrow> baldL t1 a (mkB t23 c t4))\" |\n\"combine t1 (R _ t2 a t3) = mkR (combine t1 t2) a t3\" |\n\"combine (R _ t1 a t2) t3 = mkR t1 a (combine t2 t3)\"\n\nfun color :: \"('k,'p) rbth \\<Rightarrow> tcolor\" where\n\"color Leaf = Black\" |\n\"color (Node _ (_, (c,_)) _) = c\"\n\n\nfun upd :: \"'a::linorder \\<Rightarrow> 'b::linorder \\<Rightarrow> ('a,'b) rbth \\<Rightarrow> ('a,'b) rbth\" where\n\"upd x y Leaf = mkR Leaf (x,y) Leaf\" |\n\"upd x y (B _ l (a,b) r) = (case cmp x a of\n  LT \\<Rightarrow> baliL (upd x y l) (a,b) r |\n  GT \\<Rightarrow> baliR l (a,b) (upd x y r) |\n  EQ \\<Rightarrow> mkB l (x,y) r)\" |\n\"upd x y (R _ l (a,b) r) = (case cmp x a of\n  LT \\<Rightarrow> mkR (upd x y l) (a,b) r |\n  GT \\<Rightarrow> mkR l (a,b) (upd x y r) |\n  EQ \\<Rightarrow> mkR l (x,y) r)\"\n\ndefinition update :: \"'a::linorder \\<Rightarrow> 'b::linorder \\<Rightarrow> ('a,'b) rbth \\<Rightarrow> ('a,'b) rbth\" \nwhere\n\"update x y t = paint Black (upd x y t)\"\n\n\nfun del :: \"'a::linorder \\<Rightarrow> ('a,'b::linorder)rbth \\<Rightarrow> ('a,'b)rbth\" where\n\"del x Leaf = Leaf\" |\n\"del x (Node l ((a,b), (c,_)) r) = (case cmp x a of\n     LT \\<Rightarrow> if l \\<noteq> Leaf \\<and> color l = Black\n           then baldL (del x l) (a,b) r else mkR (del x l) (a,b) r |\n     GT \\<Rightarrow> if r \\<noteq> Leaf\\<and> color r = Black\n           then baldR l (a,b) (del x r) else mkR l (a,b) (del x r) |\n  EQ \\<Rightarrow> combine l r)\"\n\ndefinition delete :: \"'a::linorder \\<Rightarrow> ('a,'b::linorder) rbth \\<Rightarrow> ('a,'b) rbth\" where\n\"delete x t = paint Black (del x t)\"\n\n\nsubsubsection \\<open>Invariants\\<close>\n\nfun bheight :: \"('k,'p) rbth \\<Rightarrow> nat\" where\n\"bheight Leaf = 0\" |\n\"bheight (Node l (x, (c,_)) r) = (if c = Black then bheight l + 1 else bheight l)\"\n\nfun invc :: \"('k,'p) rbth \\<Rightarrow> bool\" where\n\"invc Leaf = True\" |\n\"invc (Node l (a, (c,_)) r) =\n  (invc l \\<and> invc r \\<and> (c = Red \\<longrightarrow> color l = Black \\<and> color r = Black))\"\n\nfun invc2 :: \"('k,'p) rbth \\<Rightarrow> bool\" \\<comment> \\<open>Weaker version\\<close> where\n\"invc2 Leaf = True\" |\n\"invc2 (Node l (a, _) r) = (invc l \\<and> invc r)\"\n\nfun invh :: \"('k,'p) rbth \\<Rightarrow> bool\" where\n\"invh Leaf = True\" |\n\"invh (Node l (x, _) r) = (invh l \\<and> invh r \\<and> bheight l = bheight r)\"\n\ndefinition rbt :: \"('k,'p::linorder) rbth \\<Rightarrow> bool\" where\n\"rbt t = (invc t \\<and> invh t \\<and> invpst t \\<and> color t = Black)\"\n\n\nsubsection \\<open>Functional Correctness\\<close>\n\nlemma inorder_paint[simp]: \"inorder(paint c t) = inorder t\"\nby(cases t) (auto)\n\nlemma inorder_mkNode[simp]:\n  \"inorder (mkNode c l a r) = inorder l @ a # inorder r\"\nby (auto simp: mkNode_def)\n\n\nlemma inorder_baliL[simp]:\n  \"inorder(baliL l a r) = inorder l @ a # inorder r\"\nby(cases \"(l,a,r)\" rule: baliL.cases) (auto)\n\nlemma inorder_baliR[simp]:\n  \"inorder(baliR l a r) = inorder l @ a # inorder r\"\nby(cases \"(l,a,r)\" rule: baliR.cases) (auto)\n\n\nlemma inorder_baldL[simp]:\n  \"inorder(baldL l a r) = inorder l @ a # inorder r\"\nby (cases \"(l,a,r)\" rule: baldL.cases) auto\n\nlemma inorder_baldR[simp]:\n  \"inorder(baldR l a r) = inorder l @ a # inorder r\"\nby(cases \"(l,a,r)\" rule: baldR.cases) auto\n\nlemma inorder_combine[simp]:\n  \"inorder(combine l r) = inorder l @ inorder r\"\n  apply2 (induction l r rule: combine.induct) by(auto split: tree.split tcolor.split)\n\nlemma inorder_upd:\n  \"sorted1(inorder t) \\<Longrightarrow> inorder(upd x y t) = upd_list x y (inorder t)\"\napply2(induction x y t rule: upd.induct)\n  by(auto simp: upd_list_simps)\n\nlemma inorder_update:\n  \"sorted1(inorder t) \\<Longrightarrow> inorder(update x y t) = upd_list x y (inorder t)\"\nby(simp add: update_def inorder_upd)\n\nlemma inorder_del:\n \"sorted1(inorder t) \\<Longrightarrow>  inorder(del x t) = del_list x (inorder t)\"\napply2(induction x t rule: del.induct)\n  by(auto simp: del_list_simps)\n\nlemma inorder_delete:\n  \"sorted1(inorder t) \\<Longrightarrow> inorder(delete x t) = del_list x (inorder t)\"\nby(simp add: delete_def inorder_del)\n\n\nsubsection \\<open>Invariant Preservation\\<close>\n\nlemma color_paint_Black: \"color (paint Black t) = Black\"\nby (cases t) auto\n\ntheorem rbt_Leaf: \"rbt Leaf\"\nby (simp add: rbt_def)\n\nlemma invc2I: \"invc t \\<Longrightarrow> invc2 t\"\nby (cases t rule: invc.cases) simp+\n\nlemma paint_invc2: \"invc2 t \\<Longrightarrow> invc2 (paint c t)\"\nby (cases t) auto\n\nlemma invc_paint_Black: \"invc2 t \\<Longrightarrow> invc (paint Black t)\"\nby (cases t) auto\n\nlemma invh_paint: \"invh t \\<Longrightarrow> invh (paint c t)\"\nby (cases t) auto\n\nlemma invc_mkRB[simp]:\n  \"invc (mkR l a r) \\<longleftrightarrow> invc l \\<and> invc r \\<and> color l = Black \\<and> color r = Black\"\n  \"invc (mkB l a r) \\<longleftrightarrow> invc l \\<and> invc r\"\nby (simp_all add: mkNode_def)\n\nlemma color_mkNode[simp]: \"color (mkNode c l a r) = c\"\nby (simp_all add: mkNode_def)\n\n\nsubsubsection \\<open>Update\\<close>\n\nlemma invc_baliL:\n  \"\\<lbrakk>invc2 l; invc r\\<rbrakk> \\<Longrightarrow> invc (baliL l a r)\"\napply2 (induct l a r rule: baliL.induct) by auto\n\nlemma invc_baliR:\n  \"\\<lbrakk>invc l; invc2 r\\<rbrakk> \\<Longrightarrow> invc (baliR l a r)\"\napply2 (induct l a r rule: baliR.induct) by auto\n\nlemma bheight_mkRB[simp]:\n  \"bheight (mkR l a r) = bheight l\"\n  \"bheight (mkB l a r) = Suc (bheight l)\"\n  by (simp_all add: mkNode_def)\n\nlemma bheight_baliL:\n  \"bheight l = bheight r \\<Longrightarrow> bheight (baliL l a r) = Suc (bheight l)\"\napply2 (induct l a r rule: baliL.induct) by auto\n\nlemma bheight_baliR:\n  \"bheight l = bheight r \\<Longrightarrow> bheight (baliR l a r) = Suc (bheight l)\"\napply2 (induct l a r rule: baliR.induct) by auto\n\nlemma invh_mkNode[simp]:\n  \"invh (mkNode c l a r) \\<longleftrightarrow> invh l \\<and> invh r \\<and> bheight l = bheight r\"\nby (simp add: mkNode_def)\n\nlemma invh_baliL:\n  \"\\<lbrakk> invh l; invh r; bheight l = bheight r \\<rbrakk> \\<Longrightarrow> invh (baliL l a r)\"\napply2 (induct l a r rule: baliL.induct) by auto\n\nlemma invh_baliR:\n  \"\\<lbrakk> invh l; invh r; bheight l = bheight r \\<rbrakk> \\<Longrightarrow> invh (baliR l a r)\"\napply2 (induct l a r rule: baliR.induct) by auto\n\n\nlemma invc_upd: assumes \"invc t\"\n  shows \"color t = Black \\<Longrightarrow> invc (upd x y t)\" \"invc2 (upd x y t)\"\nusing assms\napply2 (induct x y t rule: upd.induct) \n  by(auto simp: invc_baliL invc_baliR invc2I mkNode_def)\n\nlemma invh_upd: assumes \"invh t\"\n  shows \"invh (upd x y t)\" \"bheight (upd x y t) = bheight t\"\nusing assms\napply2(induct x y t rule: upd.induct)\n  by(auto simp: invh_baliL invh_baliR bheight_baliL bheight_baliR)\n\n\nlemma invpst_paint[simp]: \"invpst (paint c t) = invpst t\"\nby (cases \"(c,t)\" rule: paint.cases) auto\n\nlemma invpst_baliR: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baliR l a r)\"\nby (cases \"(l,a,r)\" rule: baliR.cases) auto\n\nlemma invpst_baliL: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baliL l a r)\"\nby (cases \"(l,a,r)\" rule: baliL.cases) auto\n\nlemma invpst_upd: \"invpst t \\<Longrightarrow> invpst (upd x y t)\"\napply2 (induct x y t rule: upd.induct) by(auto simp: invpst_baliR invpst_baliL)\n\n\ntheorem rbt_update: \"rbt t \\<Longrightarrow> rbt (update x y t)\"\nby (simp add: invc_upd(2) invh_upd(1) color_paint_Black invc_paint_Black \n  invh_paint rbt_def update_def invpst_upd)\n\n\nsubsubsection \\<open>Delete\\<close>\n\nlemma bheight_paint_Red:\n  \"color t = Black \\<Longrightarrow> bheight (paint Red t) = bheight t - 1\"\nby (cases t) auto\n\nlemma invh_baldL_invc:\n  \"\\<lbrakk> invh l;  invh r;  bheight l + 1 = bheight r;  invc r \\<rbrakk>\n   \\<Longrightarrow> invh (baldL l a r) \\<and> bheight (baldL l a r) = bheight l + 1\"\napply2 (induct l a r rule: baldL.induct)\n   by(auto simp: invh_baliR invh_paint bheight_baliR bheight_paint_Red)\n\nlemma invh_baldL_Black:\n  \"\\<lbrakk> invh l;  invh r;  bheight l + 1 = bheight r;  color r = Black \\<rbrakk>\n   \\<Longrightarrow> invh (baldL l a r) \\<and> bheight (baldL l a r) = bheight r\"\napply2 (induct l a r rule: baldL.induct) by(auto simp add: invh_baliR bheight_baliR)\n\nlemma invc_baldL: \"\\<lbrakk>invc2 l; invc r; color r = Black\\<rbrakk> \\<Longrightarrow> invc (baldL l a r)\"\napply2 (induct l a r rule: baldL.induct) by(auto simp: invc_baliR invc2I mkNode_def)\n\nlemma invc2_baldL: \"\\<lbrakk> invc2 l; invc r \\<rbrakk> \\<Longrightarrow> invc2 (baldL l a r)\"\napply2 (induct l a r rule: baldL.induct) \n  by(auto simp: invc_baliR paint_invc2 invc2I mkNode_def)\n\nlemma invh_baldR_invc:\n  \"\\<lbrakk> invh l;  invh r;  bheight l = bheight r + 1;  invc l \\<rbrakk>\n  \\<Longrightarrow> invh (baldR l a r) \\<and> bheight (baldR l a r) = bheight l\"\napply2(induct l a r rule: baldR.induct)\n  by(auto simp: invh_baliL bheight_baliL invh_paint bheight_paint_Red)\n\nlemma invc_baldR: \"\\<lbrakk>invc a; invc2 b; color a = Black\\<rbrakk> \\<Longrightarrow> invc (baldR a x b)\"\napply2 (induct a x b rule: baldR.induct) by(simp_all add: invc_baliL mkNode_def)\n\nlemma invc2_baldR: \"\\<lbrakk> invc l; invc2 r \\<rbrakk> \\<Longrightarrow>invc2 (baldR l x r)\"\napply2 (induct l x r rule: baldR.induct) \n  by(auto simp: invc_baliL paint_invc2 invc2I mkNode_def)\n\nlemma invh_combine:\n  \"\\<lbrakk> invh l; invh r; bheight l = bheight r \\<rbrakk>\n  \\<Longrightarrow> invh (combine l r) \\<and> bheight (combine l r) = bheight l\"\napply2 (induct l r rule: combine.induct)\n  by(auto simp: invh_baldL_Black split: tree.splits tcolor.splits)\n\nlemma invc_combine:\n  assumes \"invc l\" \"invc r\"\n  shows \"color l = Black \\<Longrightarrow> color r = Black \\<Longrightarrow> invc (combine l r)\"\n         \"invc2 (combine l r)\"\nusing assms\napply2 (induct l r rule: combine.induct)\n  by(auto simp: invc_baldL invc2I mkNode_def split: tree.splits tcolor.splits)\n\nlemma neq_LeafD: \"t \\<noteq> Leaf \\<Longrightarrow> \\<exists>l x c r. t = Node l (x,c) r\"\nby(cases t) auto\n\nlemma del_invc_invh: \"invh t \\<Longrightarrow> invc t \\<Longrightarrow> invh (del x t) \\<and>\n   (color t = Red \\<and> bheight (del x t) = bheight t \\<and> invc (del x t) \\<or>\n    color t = Black \\<and> bheight (del x t) = bheight t - 1 \\<and> invc2 (del x t))\"\nproof2 (induct x t rule: del.induct)\ncase (2 x _ y _ c)\n  have \"x = y \\<or> x < y \\<or> x > y\" by auto\n  thus ?case proof (elim disjE)\n    assume \"x = y\"\n    with 2 show ?thesis\n    by (cases c) (simp_all add: invh_combine invc_combine)\n  next\n    assume \"x < y\"\n    with 2 show ?thesis\n      by(cases c)\n        (auto \n          simp: invh_baldL_invc invc_baldL invc2_baldL mkNode_def \n          dest: neq_LeafD)\n  next\n    assume \"y < x\"\n    with 2 show ?thesis\n      by(cases c)\n        (auto \n          simp: invh_baldR_invc invc_baldR invc2_baldR mkNode_def \n          dest: neq_LeafD)\n  qed\nqed auto\n\nlemma invpst_baldR: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baldR l a r)\"\nby (cases \"(l,a,r)\" rule: baldR.cases) (auto simp: invpst_baliL)\n\nlemma invpst_baldL: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (baldL l a r)\"\nby (cases \"(l,a,r)\" rule: baldL.cases) (auto simp: invpst_baliR)\n\nlemma invpst_combine: \"invpst l \\<Longrightarrow> invpst r \\<Longrightarrow> invpst (combine l r)\"\napply2(induction l r rule: combine.induct)\n  by(auto split: tree.splits tcolor.splits simp: invpst_baldR invpst_baldL)\n\nlemma invpst_del: \"invpst t \\<Longrightarrow> invpst (del x t)\"\napply2(induct x t rule: del.induct)\n  by(auto simp: invpst_baldR invpst_baldL invpst_combine)\n\ntheorem rbt_delete: \"rbt t \\<Longrightarrow> rbt (delete k t)\"\napply (clarsimp simp: delete_def rbt_def)\napply (frule (1) del_invc_invh[where x=k])\napply (auto simp: invc_paint_Black invh_paint color_paint_Black invpst_del)\ndone\n\nlemma rbt_getmin_ismin: \n  \"rbt t \\<Longrightarrow> t\\<noteq>Leaf \\<Longrightarrow> is_min2 (pst_getmin t) (set_tree t)\"\nunfolding rbt_def by (simp add: pst_getmin_ismin)\n\ndefinition \"rbt_is_empty t \\<equiv> t = Leaf\"\n\nlemma rbt_is_empty: \"rbt_is_empty t \\<longleftrightarrow> inorder t = []\"\nby (cases t) (auto simp: rbt_is_empty_def)\n\ndefinition empty where \"empty = Leaf\"\n\n\nsubsection \\<open>Overall Correctness\\<close>\n\ninterpretation PM: PrioMap_by_Ordered\nwhere empty = empty and lookup = lookup and update = update and delete = delete\nand inorder = inorder and inv = \"rbt\" and is_empty = rbt_is_empty \nand getmin = pst_getmin\napply standard\napply (auto simp: lookup_map_of inorder_update inorder_delete rbt_update \n                  rbt_delete rbt_Leaf rbt_is_empty empty_def \n            dest: rbt_getmin_ismin)\ndone\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation_PLDI_Small/Priority_Search_Trees/PST_RBT.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6224593312018546, "lm_q2_score": 0.4843800842769844, "lm_q1q2_score": 0.30150690330654967}}
{"text": "(*  Title:      Jinja/Common/Type.thy\n\n    Author:     David von Oheimb, Tobias Nipkow\n    Copyright   1999 Technische Universitaet Muenchen\n*)\n\nsection \\<open>Jinja types\\<close>\n\ntheory Type imports Auxiliary begin\n\ntype_synonym cname = string \\<comment> \\<open>class names\\<close>\ntype_synonym mname = string \\<comment> \\<open>method name\\<close>\ntype_synonym vname = string \\<comment> \\<open>names for local/field variables\\<close>\n\ndefinition Object :: cname\nwhere\n  \"Object \\<equiv> ''Object''\"\n\ndefinition this :: vname\nwhere\n  \"this \\<equiv> ''this''\"\n\n\\<comment> \\<open>types\\<close>\ndatatype ty\n  = Void          \\<comment> \\<open>type of statements\\<close>\n  | Boolean\n  | Integer\n  | NT            \\<comment> \\<open>null type\\<close>\n  | Class cname   \\<comment> \\<open>class type\\<close>\n\ndefinition is_refT :: \"ty \\<Rightarrow> bool\"\nwhere\n  \"is_refT T  \\<equiv>  T = NT \\<or> (\\<exists>C. T = Class C)\"\n\n\n\nlemma [iff]: \"is_refT(Class C)\"\n(*<*)by(simp add:is_refT_def)(*>*)\n\nlemma refTE:\n  \"\\<lbrakk>is_refT T; T = NT \\<Longrightarrow> P; \\<And>C. T = Class C \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> P\"\n(*<*)by (auto simp add: is_refT_def)(*>*)\n\nlemma not_refTE:\n  \"\\<lbrakk> \\<not>is_refT T; T = Void \\<or> T = Boolean \\<or> T = Integer \\<Longrightarrow> P \\<rbrakk> \\<Longrightarrow> P\"\n(*<*)by (cases T, auto simp add: is_refT_def)(*>*)\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/Common/Type.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631840431539, "lm_q2_score": 0.4960938294709195, "lm_q1q2_score": 0.3014579560004604}}
{"text": "(*  Title:      HOL/Auth/n_germanish.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_germanish Protocol Case Study*} \n\ntheory n_germanish imports n_germanish_lemma_invs_on_rules n_germanish_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/germanish/n_germanish.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.607663184043154, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3014579560004604}}
{"text": "(*\n  Theory: PDF_Transformations.thy\n  Author: Manuel Eberl\n\n  Provides lemmas for transformations of measure spaces with a density.\n*)\n\nsection \\<open>Measure Space Transformations\\<close>\n\ntheory PDF_Transformations\nimports Density_Predicates\nbegin\n\nlemma not_top_le_1_ennreal[simp]: \"\\<not> top \\<le> (1::ennreal)\"\n  by (simp add: top_unique)\n\nlemma range_int: \"range int = {n. n \\<ge> 0}\"\nproof (intro equalityI subsetI)\n  fix n :: int assume \"n \\<in> {n. n \\<ge> 0}\"\n  hence \"n = int (nat n)\" by simp\n  thus \"n \\<in> range int\" by blast\nqed auto\n\nlemma range_exp: \"range (exp :: real \\<Rightarrow> real) = {x. x > 0}\"\nproof (intro equalityI subsetI)\n  fix x :: real assume \"x \\<in> {x. x > 0}\"\n  hence \"x = exp (ln x)\" by simp\n  thus \"x \\<in> range exp\" by blast\nqed auto\n\nlemma Int_stable_Icc: \"Int_stable (range (\\<lambda>(a, b). {a .. b::real}))\"\n  by (auto simp: Int_stable_def)\n\nlemma distr_mult_real:\n  assumes \"c \\<noteq> 0\" \"has_density M lborel (f :: real \\<Rightarrow> ennreal)\"\n  shows \"has_density (distr M borel ((*) c)) lborel (\\<lambda>x. f (x / c) * inverse (abs c))\"\n            (is \"has_density ?M' _ ?f'\")\nproof\n  from assms(2) have \"M = density lborel f\" by (rule has_densityD)\n  also from assms have Mf[measurable]: \"f \\<in> borel_measurable borel\"\n    by (auto dest: has_densityD)\n  hence \"distr (density lborel f) borel ((*) c) = density lborel ?f'\" (is \"?M1 = ?M2\")\n  proof (intro measure_eqI)\n    fix X assume X[measurable]: \"X \\<in> sets (distr (density lborel f) borel ((*) c))\"\n    with assms have \"emeasure ?M1 X = \\<integral>\\<^sup>+x. f x * indicator X (c * x) \\<partial>lborel\"\n      by (subst emeasure_distr, simp, simp, subst emeasure_density)\n         (auto dest: has_densityD intro!: measurable_sets_borel nn_integral_cong\n               split: split_indicator)\n    also from assms(1) and X have \"... = \\<integral>\\<^sup>+x. ?f' x * indicator X x \\<partial>lborel\"\n      apply (subst lborel_distr_mult'[of \"inverse c\"])\n      apply simp\n      apply (subst nn_integral_density)\n      apply (simp_all add: nn_integral_distr field_simps)\n      done\n    also from X have \"... = emeasure ?M2 X\"\n      by (subst emeasure_density) auto\n    finally show \"emeasure ?M1 X = emeasure ?M2 X\" .\n  qed simp\n  finally show \"distr M borel ((*) c) = density lborel ?f'\" .\nqed (insert assms, auto dest: has_densityD)\n\nlemma distr_uminus_real:\n  assumes \"has_density M lborel (f :: real \\<Rightarrow> ennreal)\"\n  shows \"has_density (distr M borel uminus) lborel (\\<lambda>x. f (- x))\"\nproof-\n  from assms have \"has_density (distr M borel ((*) (- 1))) lborel\n                       (\\<lambda>x. f (x / -1) * ennreal (inverse (abs (-1))))\"\n    by (intro distr_mult_real) simp_all\n  also have \"(*) (-1) = (uminus :: real \\<Rightarrow> real)\" by (intro ext) simp\n  also have \"(\\<lambda>x. f (x / -1) * ennreal (inverse (abs (-1)))) = (\\<lambda>x. f (-x))\"\n    by (intro ext) (simp add: one_ennreal_def[symmetric])\n  finally show ?thesis .\nqed\n\nlemma distr_plus_real:\n  assumes \"has_density M lborel (f :: real \\<Rightarrow> ennreal)\"\n  shows \"has_density (distr M borel ((+) c)) lborel (\\<lambda>x. f (x - c))\"\nproof\n  from assms have \"M = density lborel f\" by (rule has_densityD)\n  also from assms have Mf[measurable]: \"f \\<in> borel_measurable borel\"\n    by (auto dest: has_densityD)\n  hence \"distr (density lborel f) borel ((+) c) = density lborel (\\<lambda>x. f (x - c))\" (is \"?M1 = ?M2\")\n  proof (intro measure_eqI)\n    fix X assume X: \"X \\<in> sets (distr (density lborel f) borel ((+) c))\"\n    with assms have \"emeasure ?M1 X = \\<integral>\\<^sup>+x. f x * indicator X (c + x) \\<partial>lborel\"\n      by (subst emeasure_distr, simp, simp, subst emeasure_density)\n         (auto dest: has_densityD intro!: measurable_sets_borel nn_integral_cong\n               split: split_indicator)\n    also from X have \"... = \\<integral>\\<^sup>+x. f (x - c) * indicator X x \\<partial>lborel\"\n      by (subst lborel_distr_plus[where c = \"-c\", symmetric], subst nn_integral_distr) auto\n    also from X have \"... = emeasure ?M2 X\"\n      by (subst emeasure_density)\n         (auto simp: emeasure_density intro!: measurable_compose[OF borel_measurable_diff Mf])\n    finally show \"emeasure ?M1 X = emeasure ?M2 X\" .\n  qed simp\n  finally show \"distr M borel ((+) c) = density lborel (\\<lambda>x. f (x - c))\" .\nqed (insert assms, auto dest: has_densityD)\n\nlemma count_space_uminus:\n  \"count_space UNIV = distr (count_space UNIV) (count_space UNIV) (uminus :: ('a :: ring \\<Rightarrow> _))\"\nproof (rule distr_bij_count_space[symmetric])\n  show \"bij (uminus :: 'a \\<Rightarrow> 'a)\"\n    by (auto intro!: o_bij[where g=uminus])\nqed\n\nlemma count_space_plus:\n  \"count_space UNIV = distr (count_space UNIV) (count_space UNIV) ((+) (c :: ('a :: ring)))\"\n  by (rule distr_bij_count_space [symmetric]) simp\n\nlemma distr_uminus_ring_count_space:\n  assumes \"has_density M (count_space UNIV) (f :: _ :: ring \\<Rightarrow> ennreal)\"\n  shows \"has_density (distr M (count_space UNIV) uminus) (count_space UNIV) (\\<lambda>x. f (- x))\"\nproof\n  from assms have \"M = density (count_space UNIV) f\" by (rule has_densityD)\n  also have \"distr (density (count_space UNIV) f) (count_space UNIV) uminus =\n               density (count_space UNIV)(\\<lambda>x. f (- x))\" (is \"?M1 = ?M2\")\n  proof (intro measure_eqI)\n    fix X assume X: \"X \\<in> sets (distr (density (count_space UNIV) f) (count_space UNIV) uminus)\"\n    with assms have \"emeasure ?M1 X = \\<integral>\\<^sup>+x. f x * indicator X (-x) \\<partial>count_space UNIV\"\n      by (subst emeasure_distr, simp, simp, subst emeasure_density)\n         (auto dest: has_densityD intro!: measurable_sets_borel nn_integral_cong\n               split: split_indicator)\n    also from X have \"... = emeasure ?M2 X\"\n      by (subst count_space_uminus) (simp_all add: nn_integral_distr emeasure_density)\n    finally show \"emeasure ?M1 X = emeasure ?M2 X\" .\n  qed simp\n  finally show \"distr M (count_space UNIV) uminus = density (count_space UNIV) (\\<lambda>x. f (- x))\" .\nqed (insert assms, auto dest: has_densityD)\n\nlemma distr_plus_ring_count_space:\n  assumes \"has_density M (count_space UNIV) (f :: _ :: ring \\<Rightarrow> ennreal)\"\n  shows \"has_density (distr M (count_space UNIV) ((+) c)) (count_space UNIV) (\\<lambda>x. f (x - c))\"\nproof\n  from assms have \"M = density (count_space UNIV) f\" by (rule has_densityD)\n  also have \"distr (density (count_space UNIV) f) (count_space UNIV) ((+) c) =\n               density (count_space UNIV)(\\<lambda>x. f (x - c))\" (is \"?M1 = ?M2\")\n  proof (intro measure_eqI)\n    fix X assume X: \"X \\<in> sets (distr (density (count_space UNIV) f) (count_space UNIV) ((+) c))\"\n    with assms have \"emeasure ?M1 X = \\<integral>\\<^sup>+x. f x * indicator X (c + x) \\<partial>count_space UNIV\"\n      by (subst emeasure_distr, simp, simp, subst emeasure_density)\n         (auto dest: has_densityD intro!: measurable_sets_borel nn_integral_cong\n               split: split_indicator)\n    also from X have \"... = emeasure ?M2 X\"\n      by (subst count_space_plus[of \"-c\"]) (simp_all add: nn_integral_distr emeasure_density)\n    finally show \"emeasure ?M1 X = emeasure ?M2 X\" .\n  qed simp\n  finally show \"distr M (count_space UNIV) ((+) c) = density (count_space UNIV) (\\<lambda>x. f (x - c))\" .\nqed (insert assms, auto dest: has_densityD)\n\n\nlemma subprob_density_distr_real_eq:\n  assumes dens: \"has_subprob_density M lborel f\"\n  assumes Mh: \"h \\<in> borel_measurable borel\"\n  assumes Mg: \"g \\<in> borel_measurable borel\"\n  assumes measure_eq:\n    \"\\<And>a b. a \\<le> b \\<Longrightarrow> emeasure (distr (density lborel f) lborel h) {a..b} =\n                          emeasure (density lborel g) {a..b}\"\n  shows \"has_subprob_density (distr M borel (h :: real \\<Rightarrow> real)) lborel g\"\nproof (rule has_subprob_densityI)\n  from dens have sets_M: \"sets M = sets borel\" by (auto dest: has_subprob_densityD)\n  have meas_M[simp]: \"measurable M = measurable borel\"\n    by (intro ext, subst measurable_cong_sets[OF sets_M refl]) auto\n  from Mh and dens show subprob_space: \"subprob_space (distr M borel h)\"\n    by (intro subprob_space.subprob_space_distr) (auto dest: has_subprob_densityD)\n  show \"distr M borel h = density lborel g\"\n  proof (rule measure_eqI_generator_eq[OF Int_stable_Icc, of UNIV])\n    {\n      fix x :: real\n      obtain n :: nat where \"n > abs x\" using reals_Archimedean2 by auto\n      hence \"\\<exists>n::nat. x \\<in> {-real n..real n}\" by (intro exI[of _ n]) auto\n    }\n    thus \"(\\<Union>i::nat. {-real i..real i}) = UNIV\" by blast\n  next\n    fix i :: nat\n    from subprob_space have \"emeasure (distr M borel h) {-real i..real i} \\<le> 1\"\n      by (intro subprob_space.subprob_emeasure_le_1) (auto dest: has_subprob_densityD)\n    thus \"emeasure (distr M borel h) {- real i..real i} \\<noteq> \\<infinity>\" by auto\n  next\n    fix X :: \"real set\" assume \"X \\<in> range (\\<lambda>(a,b). {a..b})\"\n    then obtain a b where \"X = {a..b}\" by auto\n    with dens have \"emeasure (distr M lborel h) X = emeasure (density lborel g) X\"\n      by (cases \"a \\<le> b\") (auto simp: measure_eq dest: has_subprob_densityD)\n    also have \"distr M lborel h = distr M borel h\"\n      by (rule distr_cong) auto\n    finally show \"emeasure (distr M borel h) X = emeasure (density lborel g) X\" .\n  qed (auto simp: borel_eq_atLeastAtMost)\nqed (insert assms, auto)\n\nlemma subprob_density_distr_real_exp:\n  assumes dens: \"has_subprob_density M lborel f\"\n  shows \"has_subprob_density (distr M borel exp) lborel\n           (\\<lambda>x. if x > 0 then f (ln x) * ennreal (inverse x) else 0)\"\n           (is \"has_subprob_density _ _ ?g\")\nproof (rule subprob_density_distr_real_eq[OF dens])\n  from dens have [measurable]: \"f \\<in> borel_measurable borel\"\n    by (auto dest: has_subprob_densityD)\n\n  have Mf: \"(\\<lambda>x. f (ln x) * ennreal (inverse x)) \\<in> borel_measurable borel\" by simp\n\n  fix a b :: real assume \"a \\<le> b\"\n\n  let ?A = \"\\<lambda>i. {inverse (Suc i) :: real ..}\"\n  let ?M1 = \"distr (density lborel f) lborel exp\" and ?M2 = \"density lborel ?g\"\n  {\n    fix x :: real assume \"\\<forall>i. x < inverse (Suc i)\"\n    hence \"x \\<le> 0\" by (intro tendsto_lowerbound[OF LIMSEQ_inverse_real_of_nat])\n                     (auto intro!: always_eventually less_imp_le)\n  }\n  hence decomp: \"{a..b} = {x\\<in>{a..b}. x \\<le> 0} \\<union> (\\<Union>i. ?A i \\<inter> {a..b})\" (is \"_ = ?C \\<union> ?D\")\n    by (auto simp: not_le)\n  have inv_le: \"\\<And>x i. x \\<ge> inverse (real (Suc i)) \\<Longrightarrow> \\<not>(x \\<le> 0)\"\n    by (subst not_le, erule dual_order.strict_trans1, simp)\n  hence \"emeasure ?M1 {a..b} = emeasure ?M1 ?C + emeasure ?M1 ?D\"\n    by (subst decomp, intro plus_emeasure[symmetric]) auto\n  also have \"emeasure ?M1 ?C = 0\" by (subst emeasure_distr) auto\n  also have \"0 = emeasure ?M2 ?C\"\n    by (subst emeasure_density, simp, simp, rule sym, subst nn_integral_0_iff) auto\n  also have \"emeasure ?M1 (\\<Union>i. ?A i \\<inter> {a..b}) = (SUP i. emeasure ?M1 (?A i \\<inter> {a..b}))\"\n    by (rule SUP_emeasure_incseq[symmetric])\n       (auto simp: incseq_def max_def not_le dest: order.strict_trans1)\n  also have \"\\<And>i. emeasure ?M1 (?A i \\<inter> {a..b}) = emeasure ?M2 (?A i \\<inter> {a..b})\"\n  proof (case_tac \"inverse (Suc i) \\<le> b\")\n    fix i assume True: \"inverse (Suc i) \\<le> b\"\n    let ?a = \"inverse (Suc i)\"\n    from \\<open>a \\<le> b\\<close> have A: \"?A i \\<inter> {a..b} = {max ?a a..b}\" (is \"?E = ?F\") by auto\n    hence \"emeasure ?M1 ?E = emeasure ?M1 ?F\" by simp\n    also have \"strict_mono_on ln {max (inverse (real (Suc i))) a..b}\"\n      by (rule strict_mono_onI, subst ln_less_cancel_iff)\n         (auto dest: inv_le simp del: of_nat_Suc)\n    with \\<open>a \\<le> b\\<close> True dens\n      have \"emeasure ?M1 ?F = emeasure (density lborel (\\<lambda>x. f (ln x) * inverse x)) ?F\"\n      by (intro emeasure_density_distr_interval)\n         (auto simp: Mf not_less not_le range_exp dest: has_subprob_densityD dest!: inv_le\n               intro!: DERIV_ln continuous_on_inverse continuous_on_id simp del: of_nat_Suc)\n    also note A[symmetric]\n    also have \"emeasure (density lborel (\\<lambda>x. f (ln x) * inverse x)) ?E = emeasure ?M2 ?E\"\n      by (subst (1 2) emeasure_density)\n         (auto intro!: nn_integral_cong split: split_indicator dest!: inv_le simp del: of_nat_Suc)\n    finally show \"emeasure ?M1 (?A i \\<inter> {a..b}) = emeasure ?M2 (?A i \\<inter> {a..b})\" .\n  qed simp\n  hence \"(SUP i. emeasure ?M1 (?A i \\<inter> {a..b})) = (SUP i. emeasure ?M2 (?A i \\<inter> {a..b}))\" by simp\n  also have \"... = emeasure ?M2 (\\<Union>i. ?A i \\<inter> {a..b})\"\n    by (rule SUP_emeasure_incseq)\n       (auto simp: incseq_def max_def not_le dest: order.strict_trans1)\n  also have \"emeasure ?M2 ?C + emeasure ?M2 ?D = emeasure ?M2 (?C \\<union> ?D)\"\n    by (rule plus_emeasure) (auto dest: inv_le simp del: of_nat_Suc)\n  also note decomp[symmetric]\n  finally show \"emeasure ?M1 {a..b} = emeasure ?M2 {a..b}\" .\nqed (insert dens, auto dest!: has_subprob_densityD(1))\n\nlemma subprob_density_distr_real_inverse_aux:\n  assumes dens: \"has_subprob_density M lborel f\"\n  shows \"has_subprob_density (distr M borel (\\<lambda>x. - inverse x)) lborel\n              (\\<lambda>x. f (-inverse x) * ennreal (inverse (x * x)))\"\n           (is \"has_subprob_density _ _ ?g\")\nproof (rule subprob_density_distr_real_eq[OF dens])\n  from dens have Mf[measurable]: \"f \\<in> borel_measurable borel\" by (auto dest: has_subprob_densityD)\n  show Mg: \"?g \\<in> borel_measurable borel\" by measurable\n\n  have surj[simp]: \"surj (\\<lambda>x. - inverse x :: real)\"\n    by (intro surjI[of _ \"\\<lambda>x. - inverse x\"]) (simp add: field_simps)\n  fix a b :: real assume \"a \\<le> b\"\n  let ?A1 = \"\\<lambda>i. {..-inverse (Suc i) :: real}\" and  ?A2 = \"\\<lambda>i. {inverse (Suc i) :: real ..}\"\n  let ?C = \"if 0 \\<in> {a..b} then {0} else {}\"\n  let ?M1 = \"distr (density lborel f) lborel (\\<lambda>x. - inverse x)\" and ?M2 = \"density lborel ?g\"\n  have inv_le: \"\\<And>x i. x \\<ge> inverse (real (Suc i)) \\<Longrightarrow> \\<not>(x \\<le> 0)\"\n    by (subst not_le, erule dual_order.strict_trans1, simp)\n  have \"\\<And>x. x > 0 \\<Longrightarrow> \\<exists>i. x \\<ge> inverse (Suc i)\"\n  proof (rule ccontr)\n    fix x :: real assume \"x > 0\" \"\\<not>(\\<exists>i. x \\<ge> inverse (Suc i))\"\n    hence \"x \\<le> 0\" by (intro tendsto_lowerbound[OF LIMSEQ_inverse_real_of_nat])\n                      (auto intro!: always_eventually less_imp_le simp: not_le)\n    with \\<open>x > 0\\<close> show False by simp\n  qed\n  hence A: \"(\\<Union>i. ?A2 i) = {0<..}\" by (auto dest: inv_le simp del: of_nat_Suc)\n  moreover have \"\\<And>x. x < 0 \\<Longrightarrow> \\<exists>i. x \\<le> -inverse (Suc i)\"\n  proof (rule ccontr)\n    fix x :: real assume \"x < 0\" \"\\<not>(\\<exists>i. x \\<le> -inverse (Suc i))\"\n    hence \"x \\<ge> 0\"\n      by (intro tendsto_upperbound, simp)\n         (auto intro!: always_eventually less_imp_le LIMSEQ_inverse_real_of_nat_add_minus simp: not_le)\n    with \\<open>x < 0\\<close> show False by simp\n  qed\n  hence B: \"(\\<Union>i. ?A1 i) = {..<0}\"\n    by (auto simp: le_minus_iff[of _ \"inverse x\" for x] dest!: inv_le simp del: of_nat_Suc)\n  ultimately have C: \"UNIV = (\\<Union>i. ?A1 i) \\<union> (\\<Union>i. ?A2 i) \\<union> {0}\" by (subst A, subst B) force\n  have UN_Int_distrib: \"\\<And>f A. (\\<Union>i. f i) \\<inter> A = (\\<Union>i. f i \\<inter> A)\" by blast\n  have decomp: \"{a..b} = (\\<Union>i. ?A1 i \\<inter> {a..b}) \\<union> (\\<Union>i. ?A2 i \\<inter> {a..b}) \\<union> ?C\" (is \"_ = ?D \\<union> ?E \\<union> _\")\n    by (subst Int_UNIV_left[symmetric], simp only: C Int_Un_distrib2 UN_Int_distrib)\n       (simp split: if_split)\n  have \"emeasure ?M1 {a..b} = emeasure ?M1 ?D + emeasure ?M1 ?E + emeasure ?M1 ?C\"\n    apply (subst decomp)\n    apply (subst plus_emeasure[symmetric], simp, simp, simp)\n    apply (subst plus_emeasure[symmetric])\n    apply (auto dest!: inv_le simp: not_le le_minus_iff[of _ \"inverse x\" for x] simp del: of_nat_Suc)\n    done\n  also have \"(\\<lambda>x. - inverse x) -` {0 :: real} = {0}\" by (auto simp: field_simps)\n  hence \"emeasure ?M1 ?C = 0\"\n    by (subst emeasure_distr)  (auto split: if_split simp: emeasure_density Mf)\n  also have \"emeasure ?M2 {0} = 0\" by (simp add: emeasure_density)\n  hence \"0 = emeasure ?M2 ?C\"\n    by (rule_tac sym, rule_tac order.antisym, rule_tac order.trans, rule_tac emeasure_mono[of _ \"{0}\"]) simp_all\n  also have \"emeasure ?M1 (\\<Union>i. ?A1 i \\<inter> {a..b}) = (SUP i. emeasure ?M1 (?A1 i \\<inter> {a..b}))\"\n    by (rule SUP_emeasure_incseq[symmetric])\n       (auto simp: incseq_def max_def not_le dest: order.strict_trans1)\n  also have \"\\<And>i. emeasure ?M1 (?A1 i \\<inter> {a..b}) = emeasure ?M2 (?A1 i \\<inter> {a..b})\"\n  proof (case_tac \"-inverse (Suc i) \\<ge> a\")\n    fix i assume True: \"-inverse (Suc i) \\<ge> a\"\n    let ?a = \"-inverse (Suc i)\"\n    from \\<open>a \\<le> b\\<close> have A: \"?A1 i \\<inter> {a..b} = {a..min ?a b}\" (is \"?F = ?G\") by auto\n    hence \"emeasure ?M1 ?F = emeasure ?M1 ?G\" by simp\n    also have \"strict_mono_on (\\<lambda>x. -inverse x) {a..min ?a b}\"\n      by (rule strict_mono_onI)\n         (auto simp: le_minus_iff[of _ \"inverse x\" for x] dest!: inv_le simp del: of_nat_Suc)\n    with \\<open>a \\<le> b\\<close> True dens\n      have \"emeasure ?M1 ?G = emeasure ?M2 ?G\"\n      by (intro emeasure_density_distr_interval)\n         (auto simp: Mf not_less dest: has_subprob_densityD inv_le\n               intro!: derivative_eq_intros continuous_on_mult continuous_on_inverse continuous_on_id)\n    also note A[symmetric]\n    finally show \"emeasure ?M1 (?A1 i \\<inter> {a..b}) = emeasure ?M2 (?A1 i \\<inter> {a..b})\" .\n  qed simp\n  hence \"(SUP i. emeasure ?M1 (?A1 i \\<inter> {a..b})) = (SUP i. emeasure ?M2 (?A1 i \\<inter> {a..b}))\" by simp\n  also have \"... = emeasure ?M2 (\\<Union>i. ?A1 i \\<inter> {a..b})\"\n    by (rule SUP_emeasure_incseq)\n       (auto simp: incseq_def max_def not_le dest: order.strict_trans1)\n  also have \"emeasure ?M1 (\\<Union>i. ?A2 i \\<inter> {a..b}) = (SUP i. emeasure ?M1 (?A2 i \\<inter> {a..b}))\"\n    by (rule SUP_emeasure_incseq[symmetric])\n       (auto simp: incseq_def max_def not_le dest: order.strict_trans1)\n  also have \"\\<And>i. emeasure ?M1 (?A2 i \\<inter> {a..b}) = emeasure ?M2 (?A2 i \\<inter> {a..b})\"\n  proof (case_tac \"inverse (Suc i) \\<le> b\")\n    fix i assume True: \"inverse (Suc i) \\<le> b\"\n    let ?a = \"inverse (Suc i)\"\n    from \\<open>a \\<le> b\\<close> have A: \"?A2 i \\<inter> {a..b} = {max ?a a..b}\" (is \"?F = ?G\") by auto\n    hence \"emeasure ?M1 ?F = emeasure ?M1 ?G\" by simp\n    also have \"strict_mono_on (\\<lambda>x. -inverse x) {max ?a a..b}\"\n      by (rule strict_mono_onI) (auto dest!: inv_le simp: not_le simp del: of_nat_Suc)\n    with \\<open>a \\<le> b\\<close> True dens\n      have \"emeasure ?M1 ?G = emeasure ?M2 ?G\"\n      by (intro emeasure_density_distr_interval)\n         (auto simp: Mf not_less dest: has_subprob_densityD inv_le\n               intro!: derivative_eq_intros continuous_on_mult continuous_on_inverse continuous_on_id)\n    also note A[symmetric]\n    finally show \"emeasure ?M1 (?A2 i \\<inter> {a..b}) = emeasure ?M2 (?A2 i \\<inter> {a..b})\" .\n  qed simp\n  hence \"(SUP i. emeasure ?M1 (?A2 i \\<inter> {a..b})) = (SUP i. emeasure ?M2 (?A2 i \\<inter> {a..b}))\" by simp\n  also have \"... = emeasure ?M2 (\\<Union>i. ?A2 i \\<inter> {a..b})\"\n    by (rule SUP_emeasure_incseq)\n       (auto simp: incseq_def max_def not_le dest: order.strict_trans1)\n  also have \"emeasure ?M2 ?D + emeasure ?M2 ?E + emeasure ?M2 ?C = emeasure ?M2 {a..b}\"\n    apply (subst (4) decomp)\n    apply (subst plus_emeasure, simp, simp)\n    apply (auto dest!: inv_le simp: not_le le_minus_iff[of _ \"inverse x\" for x] simp del: of_nat_Suc)\n    apply (subst plus_emeasure)\n    apply (auto dest!: inv_le simp: not_le le_minus_iff[of _ \"inverse x\" for x])\n    done\n  finally show \"emeasure ?M1 {a..b} = emeasure ?M2 {a..b}\" .\nqed simp\n\nlemma subprob_density_distr_real_inverse:\n  assumes dens: \"has_subprob_density M lborel f\"\n  shows \"has_subprob_density (distr M borel inverse) lborel (\\<lambda>x. f (inverse x) * ennreal (inverse (x * x)))\"\nproof (unfold has_subprob_density_def, intro conjI)\n  let ?g' = \"(\\<lambda>x. f (-inverse x) * ennreal (inverse (x * x)))\"\n  have prob: \"has_subprob_density (distr M borel (\\<lambda>x. -inverse x)) lborel ?g'\"\n    by (rule subprob_density_distr_real_inverse_aux[OF assms])\n  from assms have sets_M: \"sets M = sets borel\" by (auto dest: has_subprob_densityD)\n  have [simp]: \"measurable M = measurable borel\"\n    by (intro ext, subst measurable_cong_sets[OF sets_M refl]) auto\n  from prob have dens: \"has_density (distr M lborel (\\<lambda>x. -inverse x)) lborel\n                 (\\<lambda>x. f (-inverse x) * ennreal (inverse (x * x)))\"\n    unfolding has_subprob_density_def by (simp cong: distr_cong)\n  from distr_uminus_real[OF this]\n    show \"has_density (distr M borel inverse) lborel\n              (\\<lambda>x. f (inverse x) * ennreal (inverse (x * x)))\"\n    by (simp add: distr_distr o_def cong: distr_cong)\n  show \"subprob_space (distr M borel inverse)\"\n    by (intro subprob_space.subprob_space_distr has_subprob_densityD[OF assms]) simp_all\nqed\n\n\n\n  from assms have sets_M: \"sets M = sets borel\" by (auto dest: has_densityD)\n  hence [simp]: \"space M = UNIV\" by (subst sets_eq_imp_space_eq[OF sets_M]) simp\n  from sets_M have [simp]: \"measurable M = measurable borel\"\n    by (intro ext measurable_cong_sets) simp_all\n  have M_add: \"case_prod (+) \\<in> borel_measurable (borel :: (real \\<times> real) measure)\"\n    by (simp add: borel_prod[symmetric])\n\n  show \"distr M borel (case_prod (+)) = density lborel ?f'\"\n  proof (rule measure_eqI)\n    fix X :: \"real set\" assume X[measurable]: \"X \\<in> sets (distr M borel (case_prod (+)))\"\n    hence \"emeasure (distr M borel (case_prod (+))) X = emeasure M ((\\<lambda>(x, y). x + y) -` X)\"\n      by (simp_all add: M_add emeasure_distr)\n    also from X have \"... = \\<integral>\\<^sup>+z. f z * indicator ((\\<lambda>(x, y). x + y) -` X) z \\<partial>(lborel \\<Otimes>\\<^sub>M lborel)\"\n      by (simp add: emeasure_density has_densityD[OF assms]\n                     measurable_sets_borel[OF M_add] lborel_prod)\n    also have \"... = \\<integral>\\<^sup>+x. \\<integral>\\<^sup>+y. f (x, y) * indicator ((\\<lambda>(x, y). x + y) -` X) (x,y) \\<partial>lborel \\<partial>lborel\"\n      apply (rule lborel.nn_integral_fst[symmetric])\n      apply measurable\n      apply (simp_all add: borel_prod)\n      done\n    also have \"... = \\<integral>\\<^sup>+x. \\<integral>\\<^sup>+y. f (x, y) * indicator ((\\<lambda>(x, y). x + y) -` X) (x,y)\n                          \\<partial>distr lborel borel ((+) (-x)) \\<partial>lborel\"\n      by (rule nn_integral_cong, subst lborel_distr_plus) simp\n    also have \"... = \\<integral>\\<^sup>+x. \\<integral>\\<^sup>+z. f (x, z-x) * indicator ((\\<lambda>(x, y). x + y) -` X) (x, z-x)\n                          \\<partial>lborel \\<partial>lborel\"\n      apply (rule nn_integral_cong)\n      apply (subst nn_integral_distr)\n      apply simp_all\n      apply measurable\n      apply (subst space_count_space)\n      apply auto\n      done\n    also have \"... = \\<integral>\\<^sup>+x. \\<integral>\\<^sup>+z. f (x, z-x) * indicator X z \\<partial>lborel \\<partial>lborel\"\n      by (intro nn_integral_cong) (simp split: split_indicator)\n    also have \"... = \\<integral>\\<^sup>+z. \\<integral>\\<^sup>+x. f (x, z-x) * indicator X z \\<partial>lborel \\<partial>lborel\" using X\n      by (subst lborel_pair.Fubini')\n         (simp_all add: pair_sigma_finite_def)\n    also have \"... = \\<integral>\\<^sup>+z. (\\<integral>\\<^sup>+x. f (x, z-x) \\<partial>lborel) * indicator X z \\<partial>lborel\"\n      by (rule nn_integral_cong) (simp split: split_indicator)\n    also have \"... = emeasure (density lborel ?f') X\" using X\n      by (simp add: emeasure_density)\n    finally show \"emeasure (distr M borel (case_prod (+))) X = emeasure (density lborel ?f') X\" .\n  qed (insert assms, auto dest: has_densityD)\nqed simp_all\n\nlemma distr_convolution_ring_count_space:\n  assumes C: \"countable (UNIV :: 'a set)\"\n  assumes \"has_density M (count_space UNIV) (f :: (('a :: ring) \\<times> 'a) \\<Rightarrow> ennreal)\"\n  shows \"has_density (distr M (count_space UNIV) (case_prod (+))) (count_space UNIV)\n             (\\<lambda>z. \\<integral>\\<^sup>+x. f (x, z - x) \\<partial>count_space UNIV)\"\n            (is \"has_density ?M' _ ?f'\")\nproof\n  let ?CS = \"count_space UNIV :: 'a measure\" and ?CSP = \"count_space UNIV :: ('a \\<times> 'a) measure\"\n  show Mf': \"(\\<lambda>z. \\<integral>\\<^sup>+ x. f (x, z - x) \\<partial>count_space UNIV) \\<in> borel_measurable ?CS\" by simp\n\n  from assms have sets_M: \"sets M = UNIV\" and [simp]: \"space M = UNIV\"\n    by (auto dest: has_densityD)\n  from assms have [simp]: \"measurable M = measurable (count_space UNIV)\"\n    by (intro ext measurable_cong_sets) (simp_all add: sets_M)\n\n  interpret sigma_finite_measure ?CS by (rule sigma_finite_measure_count_space_countable[OF C])\n  show \"distr M ?CS (case_prod (+)) = density ?CS ?f'\"\n  proof (rule measure_eqI)\n    fix X :: \"'a set\" assume X: \"X \\<in> sets (distr M ?CS (case_prod (+)))\"\n    hence \"emeasure (distr M ?CS (case_prod (+))) X = emeasure M ((\\<lambda>(x, y). x + y) -` X)\"\n      by (simp_all add: emeasure_distr)\n    also from X have \"... = \\<integral>\\<^sup>+z. f z * indicator ((\\<lambda>(x, y). x + y) -` X) z \\<partial>(?CS \\<Otimes>\\<^sub>M ?CS)\"\n      by (simp add: emeasure_density has_densityD[OF assms(2)]\n                     sets_M pair_measure_countable C)\n    also have \"... = \\<integral>\\<^sup>+x. \\<integral>\\<^sup>+y. f (x, y) * indicator ((\\<lambda>(x, y). x + y) -` X) (x,y) \\<partial>?CS \\<partial>?CS\"\n      by (rule nn_integral_fst[symmetric]) (simp add: pair_measure_countable C)\n    also have \"... = \\<integral>\\<^sup>+x. \\<integral>\\<^sup>+y. f (x, y) * indicator ((\\<lambda>(x, y). x + y) -` X) (x,y)\n                          \\<partial>distr ?CS ?CS ((+) (-x)) \\<partial>?CS\"\n      by (rule nn_integral_cong, subst count_space_plus) simp\n    also have \"... = \\<integral>\\<^sup>+x. \\<integral>\\<^sup>+z. f (x, z-x) * indicator ((\\<lambda>(x, y). x + y) -` X) (x, z-x) \\<partial>?CS \\<partial>?CS\"\n      by (rule nn_integral_cong) (simp_all add: nn_integral_distr)\n    also have \"... = \\<integral>\\<^sup>+x. \\<integral>\\<^sup>+z. f (x, z-x) * indicator X z \\<partial>?CS \\<partial>?CS\"\n      by (intro nn_integral_cong) (simp split: split_indicator)\n    also have \"... = \\<integral>\\<^sup>+z. \\<integral>\\<^sup>+x. f (x, z-x) * indicator X z \\<partial>?CS \\<partial>?CS\" using X\n      by (subst pair_sigma_finite.Fubini')\n         (simp_all add: pair_sigma_finite_def sigma_finite_measure_count_space_countable\n                        C pair_measure_countable)\n    also have \"... = \\<integral>\\<^sup>+z. (\\<integral>\\<^sup>+x. f (x, z-x) \\<partial>?CS) * indicator X z \\<partial>?CS\"\n      by (rule nn_integral_cong) (simp split: split_indicator)\n    also have \"... = emeasure (density ?CS ?f') X\" using X by (simp add: emeasure_density)\n    finally show \"emeasure (distr M ?CS (case_prod (+))) X = emeasure (density ?CS ?f') X\" .\n  qed (insert assms, auto dest: has_densityD)\nqed simp_all\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Density_Compiler/PDF_Transformations.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631840431539, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3014579560004603}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory GraphLangLemmas\n\nimports GraphLang CommonOpsLemmas\n\nbegin\n\ndefinition\n  get_state_function_call :: \"(string \\<Rightarrow> graph_function option)\n    \\<Rightarrow> (next_node \\<times> state \\<times> string) \\<Rightarrow> string option\"\nwhere\n  \"get_state_function_call Gamma x \\<equiv> case x of (NextNode nn, st, fname) \\<Rightarrow>\n        (case Gamma fname of Some gf \\<Rightarrow>\n            (case function_graph gf nn of Some (Call _ fname' _ _) \\<Rightarrow> Some fname' | _ \\<Rightarrow> None)\n          | None \\<Rightarrow> None)\n    | _ \\<Rightarrow> None\"\n\ndefinition\n  exec_graph_invariant :: \"(string \\<Rightarrow> graph_function option) \\<Rightarrow> string \\<Rightarrow> stack \\<Rightarrow> bool\"\nwhere\n  \"exec_graph_invariant Gamma gf xs = (xs \\<noteq> []\n    \\<and> (\\<forall>frame \\<in> set (tl xs). get_state_function_call Gamma frame \\<noteq> None)\n    \\<and> map (Some o snd o snd) xs = map (get_state_function_call Gamma) (tl xs) @ [Some gf])\"\n\nlemma exec_graph_invariant_Cons:\n  \"exec_graph_invariant Gamma fname (x # xs) = (if xs = [] then snd (snd x) = fname\n    else (get_state_function_call Gamma (hd xs) = Some (snd (snd x))\n        \\<and> exec_graph_invariant Gamma fname xs))\"\n  by (cases xs, auto simp add: exec_graph_invariant_def)\n\nlemma exec_step_invariant:\n  \"(stack, stack') \\<in> exec_graph_step Gamma\n    \\<Longrightarrow> exec_graph_invariant Gamma gf stack\n    \\<Longrightarrow> exec_graph_invariant Gamma gf stack'\"\n  by (auto simp: all_exec_graph_step_cases exec_graph_invariant_Cons\n                 get_state_function_call_def\n          split: graph_function.split_asm)\n\nlemma exec_trace_invariant':\n  \"tr \\<in> exec_trace Gamma gf\n    \\<Longrightarrow> (\\<forall>stack. tr i = Some stack\n        \\<longrightarrow> exec_graph_invariant Gamma gf stack)\"\n  apply (induct i)\n   apply (clarsimp simp: exec_trace_def exec_graph_invariant_def)\n   apply (clarsimp split: next_node.split_asm list.split_asm)\n  apply (clarsimp simp: exec_trace_def nat_trace_rel_def)\n  apply (drule_tac x=i in spec, clarsimp)\n  apply (auto elim: exec_step_invariant)\n  done\n\nlemmas exec_trace_invariant = exec_trace_invariant'[rule_format]\n\nlemma exec_trace_Nil:\n  \"tr \\<in> exec_trace Gamma gf \\<Longrightarrow> tr i \\<noteq> Some []\"\n  apply safe\n  apply (drule(1) exec_trace_invariant)\n  apply (simp add: exec_graph_invariant_def)\n  done\n\nlemma exec_trace_step_cases:\n  assumes exec: \"tr \\<in> exec_trace Gamma gf\"\n  shows \"((tr i = None \\<and> tr (Suc i) = None))\n        \\<or> (\\<exists>state. tr i = Some [state] \\<and> fst state \\<in> {Ret, Err} \\<and> tr (Suc i) = None)\n        \\<or> (tr i \\<noteq> None \\<and> tr (Suc i) \\<noteq> None \\<and> (the (tr i), the (tr (Suc i))) \\<in> exec_graph_step Gamma)\"\n  using exec exec_trace_Nil[OF exec]\n  apply (clarsimp simp: exec_trace_def nat_trace_rel_def continuing_def Ball_def)\n  apply (drule_tac x=i in spec)+\n  apply (auto split: list.split_asm option.split_asm prod.split_asm next_node.split_asm)[1]\n  done\n\ndefinition\n  reachable_step :: \"(nat \\<Rightarrow> node option) \\<Rightarrow> (next_node \\<times> next_node) set\"\nwhere\n  \"reachable_step graph = {(s, t). (case s of NextNode i \\<Rightarrow>\n    (case graph i of None \\<Rightarrow> False\n        | Some (Cond l r _) \\<Rightarrow> (t = l \\<or> t = r)\n        | Some (Basic c _) \\<Rightarrow> t = c\n        | Some (Call c _ _ _) \\<Rightarrow> t = c \\<or> t = Err) | _ \\<Rightarrow> False)}\"\n\nabbreviation\n  \"reachable_step' gf \\<equiv> reachable_step (function_graph gf)\"\n\nlemma exec_trace_None_dom_subset:\n  \"tr n = None \\<Longrightarrow> tr \\<in> exec_trace Gamma f\n    \\<Longrightarrow> dom tr \\<subseteq> {..< n}\"\n  unfolding exec_trace_def\n  by (blast elim: CollectE dest: trace_None_dom_subset)\n\nlemma trace_Some_dom_superset:\n  \"tr \\<in> nat_trace_rel c R\n    \\<Longrightarrow> tr i = Some v\n    \\<Longrightarrow> {..i} \\<subseteq> dom tr\"\n  apply (clarsimp, rule ccontr, clarsimp)\n  apply (drule(1) trace_None_dom_subset)\n  apply auto\n  done\n\nlemma nat_trace_rel_final:\n  \"tr \\<in> nat_trace_rel c R\n    \\<Longrightarrow> tr i = Some v\n    \\<Longrightarrow> \\<not> c' v\n    \\<Longrightarrow> restrict_map tr {.. i} \\<in> nat_trace_rel c' R\"\n  apply (frule(1) trace_Some_dom_superset)\n  apply (clarsimp simp: nat_trace_rel_def restrict_map_def Suc_le_eq)\n  apply (drule_tac c=\"Suc n\" in subsetD, auto)\n  done\n\nlemma trace_None_dom_eq:\n  \"tr n = None \\<Longrightarrow> tr \\<in> nat_trace_rel cont R\n    \\<Longrightarrow> (\\<exists>n'. n' \\<le> n \\<and> dom tr = {..< n'})\"\n  apply (cases \"\\<forall>i. tr i = None\")\n   apply (rule_tac x=0 in exI)\n   apply (simp add: fun_eq_iff)\n  apply clarsimp\n  apply (rule_tac x=\"Suc (Max (dom tr))\" in exI)\n  apply (drule(1) nat_trace_Max_dom_None[rotated, simplified, OF exI])\n  apply clarsimp\n  apply (frule(1) trace_None_dom_subset)\n  apply (rule conjI)\n   apply auto[1]\n  apply (rule equalityI)\n   apply (auto simp: less_Suc_eq_le intro!: Max_ge elim: finite_subset)[1]\n  apply (clarsimp, rule ccontr, clarsimp simp: less_Suc_eq_le)\n  apply (drule(1) trace_None_dom_subset)+\n  apply auto\n  done\n\nlemma trace_end_eq_Some:\n  \"tr \\<in> nat_trace_rel c R\n    \\<Longrightarrow> tr i = Some v\n    \\<Longrightarrow> tr (Suc i) = None\n    \\<Longrightarrow> trace_end tr = Some v\"\n  apply (frule(1) trace_Some_dom_superset)\n  apply (frule(1) trace_None_dom_eq)\n  apply (clarsimp simp: le_Suc_eq lessThan_Suc_atMost[symmetric])\n  apply (simp add: trace_end_def)\n  apply (subst Max_eqI[where x=i], simp_all)\n  apply auto\n  done\n\nlemma trace_end_cut:\n  \"tr \\<in> nat_trace_rel c R\n    \\<Longrightarrow> tr i = Some v\n    \\<Longrightarrow> trace_end (restrict_map tr {.. i}) = Some v\"\n  apply (frule(1) trace_Some_dom_superset)\n  apply (simp add: trace_end_def Int_absorb1)\n  apply (subst Max_eqI[where x=i], simp_all)\n  apply (simp add: restrict_map_def)\n  apply (metis Suc_n_not_le_n)\n  done\n\ndefinition\n  trace_drop_n :: \"nat \\<Rightarrow> nat \\<Rightarrow> trace \\<Rightarrow> trace\"\nwhere\n  \"trace_drop_n start n_drop tr = (\\<lambda>i. if (\\<forall>j < i. tr (start + j) \\<noteq> None\n        \\<and> continuing (rev (drop n_drop (rev (the (tr (start + j)))))))\n    then option_map (rev o drop n_drop o rev) (tr (i + start)) else None)\"\n\nlemma rev_drop_step:\n  \"(stack, stack') \\<in> exec_graph_step Gamma\n    \\<Longrightarrow> continuing (rev (drop k (rev stack)))\n    \\<Longrightarrow> (rev (drop k (rev stack)), rev (drop k (rev stack'))) \\<in> exec_graph_step Gamma\"\n  apply (subgoal_tac \"\\<exists>xs ys. stack = xs @ ys \\<and> k = length ys\")\n   apply clarsimp\n   apply (frule(1) exec_graph_step_stack_extend[THEN iffD1])\n   apply clarsimp\n  apply (rule_tac x=\"take (length stack - k) stack\" in exI)\n  apply (rule_tac x=\"drop (length stack - k) stack\" in exI)\n  apply (cases \"length (rev (drop k (rev stack)))\")\n   apply simp\n  apply simp\n  done\n\nlemma rev_drop_continuing:\n  \"continuing (rev (drop k (rev stack))) \\<Longrightarrow> continuing stack\"\n  by (simp add: continuing_def split: list.split next_node.split,\n      auto simp: drop_Cons split: nat.split_asm)\n\nlemma all_less_Suc_eq:\n  \"(\\<forall>x < Suc i. P x) = (P i \\<and> (\\<forall>x < i. P x))\"\n  by (auto simp: less_Suc_eq)\n\nlemma exec_trace_drop_n_Cons:\n  assumes tr: \"tr \\<in> exec_trace Gamma fn\" \"Gamma fn'' = Some gf\"\n  shows \"tr i = Some ((NextNode n, st, fn'') # xs)\n    \\<Longrightarrow> function_graph gf n = Some (Call nn fn' inps outps)\n    \\<Longrightarrow> Gamma fn' = Some gf'\n    \\<Longrightarrow> trace_drop_n (Suc i) (Suc (length xs)) tr \\<in> exec_trace Gamma fn'\"\n  using tr\n  apply (clarsimp simp: exec_trace_def)\n  apply (intro conjI)\n   apply (simp add: trace_drop_n_def)\n   apply (cut_tac exec_trace_step_cases[where i=i, OF tr(1)])\n   apply (clarsimp simp: all_exec_graph_step_cases exec_graph_invariant_Cons\n                  split: graph_function.split_asm)\n  apply (clarsimp simp: nat_trace_rel_def trace_drop_n_def\n                        all_less_Suc_eq\n             split del: if_split)\n  apply (cut_tac i=\"Suc i + na\" in exec_trace_Nil[OF tr(1)])\n  apply (drule_tac x=\"Suc i + na\" in spec)+\n  apply (clarsimp simp: field_simps)\n  apply (safe, simp_all)\n  apply (safe intro!: rev_drop_step)\n  apply (auto dest!: rev_drop_continuing)\n  done\n\nlemma exec_trace_drop_n:\n  assumes tr: \"tr \\<in> exec_trace Gamma fn\" \"Gamma fn = Some gf\"\n  shows \"tr i = Some [(NextNode n, st, fn'')]\n    \\<Longrightarrow> function_graph gf n = Some (Call nn fn' inps outps)\n    \\<Longrightarrow> Gamma fn' = Some gf'\n    \\<Longrightarrow> trace_drop_n (Suc i) 1 tr \\<in> exec_trace Gamma fn'\"\n  apply (frule exec_trace_invariant[OF tr(1)])\n  apply (simp add: exec_graph_invariant_Cons)\n  apply (drule(2) exec_trace_drop_n_Cons[OF tr])\n  apply simp\n  done\n\nlemma exec_trace_drop_n_rest_Cons:\n  \"tr \\<in> exec_trace Gamma fn\n    \\<Longrightarrow> tr i = Some ((NextNode n, st, fn'') # xs)\n    \\<Longrightarrow> Gamma fn'' = Some gf\n    \\<Longrightarrow> function_graph gf n = Some (Call nn fn' inps outps)\n    \\<Longrightarrow> Gamma fn' = Some gf'\n    \\<Longrightarrow> (\\<forall>stk. trace_drop_n (Suc i) (Suc (length xs)) tr k = Some stk\n     \\<longrightarrow> tr (Suc i + k) = Some (stk @ (NextNode n, st, fn'') # xs))\"\nproof (induct k)\n  case 0 show ?case using 0\n    apply (clarsimp simp: trace_drop_n_def)\n    apply (frule_tac i=i in exec_trace_step_cases)\n    apply (clarsimp simp: exec_graph_step_def exec_graph_invariant_Cons\n                   split: graph_function.split_asm)\n    done\nnext\n  case (Suc k)\n  have rev_drop_eq: \"\\<And>xs ys n. length ys = n\n    \\<Longrightarrow> (xs = rev (drop n (rev xs)) @ ys)\n        = (\\<exists>zs. xs = zs @ ys)\"\n    by auto\n  show ?case using Suc.prems Suc.hyps\n    apply (clarsimp simp: trace_drop_n_def field_simps)\n    apply (frule_tac i=\"Suc k + i\" in exec_trace_step_cases)\n    apply (clarsimp simp: field_simps all_less_Suc_eq rev_drop_eq)\n    apply (clarsimp simp: exec_graph_step_stack_extend)\n    done\nqed\n\nlemma exec_trace_drop_n_rest:\n  \"tr \\<in> exec_trace Gamma fn \\<Longrightarrow> Gamma fn = Some gf\n    \\<Longrightarrow> tr i = Some [(NextNode n, st, fn'')]\n    \\<Longrightarrow> function_graph gf n = Some (Call nn fn' inps outps)\n    \\<Longrightarrow> Gamma fn' = Some gf'\n    \\<Longrightarrow> (\\<forall>stk. trace_drop_n (Suc i) 1 tr k = Some stk\n     \\<longrightarrow> tr (Suc i + k) = Some (stk @ [(NextNode n, st, fn'')]))\"\n  apply (frule(1) exec_trace_invariant)\n  apply (clarsimp simp: exec_graph_invariant_Cons)\n  apply (drule(4) exec_trace_drop_n_rest_Cons)\n  apply auto\n  done\n\nlemma trace_drop_n_init:\n  \"tr \\<in> exec_trace Gamma fn \\<Longrightarrow> Gamma fn = Some f\n    \\<Longrightarrow> function_graph f n = Some (Call nn fname inputs outputs)\n    \\<Longrightarrow> Gamma fname = Some f'\n    \\<Longrightarrow> tr i = Some [(NextNode n, st, fn')]\n    \\<Longrightarrow> trace_drop_n (Suc i) 1 tr 0 = Some [(NextNode (entry_point f'),\n            init_vars (function_inputs f') inputs st, fname)]\"\n  apply (frule(1) exec_trace_invariant)\n  apply (clarsimp simp: exec_graph_invariant_Cons)\n  apply (frule_tac i=i in exec_trace_step_cases, clarsimp)\n  apply (clarsimp simp: all_exec_graph_step_cases trace_drop_n_def)\n  done\n\nlemma exec_trace_init:\n  \"tr \\<in> exec_trace Gamma fn\n   \\<Longrightarrow> \\<exists>st gf. Gamma fn = Some gf \\<and> tr 0 = Some [(NextNode (entry_point gf), st, fn)]\"\n  by (clarsimp simp: exec_trace_def)\n\nlemma dom_Max_None:\n  \"tr \\<in> exec_trace Gamma f \\<Longrightarrow> (tr (Max (dom tr)) \\<noteq> None)\"\n  apply (rule notI)\n  apply (frule(1) exec_trace_None_dom_subset)\n  apply (cases \"dom tr = {}\")\n   apply (clarsimp dest!: exec_trace_init)\n  apply (drule Max_in[rotated])\n   apply (simp add: finite_subset)\n  apply clarsimp\n  done\n\nlemma trace_end_trace_drop_n_None:\n  \"trace_end (trace_drop_n i j tr) = None \\<Longrightarrow> tr \\<in> exec_trace Gamma f\n    \\<Longrightarrow> trace_drop_n i j tr \\<in> exec_trace Gamma f'\n    \\<Longrightarrow> trace_end tr = None\"\n  apply (clarsimp simp: trace_end_def dom_Max_None split: if_split_asm)\n  apply (rule ccontr, simp)\n  apply (drule(1) exec_trace_None_dom_subset)\n  apply (drule_tac x=\"n + i + 1\" in spec)\n  apply (clarsimp simp: trace_drop_n_def split: if_split_asm)\n  apply auto[1]\n  done\n\nlemma trace_end_trace_drop_n_Some:\n  \"trace_end (trace_drop_n (Suc i) (Suc 0) tr) = Some [(Ret, st', dontcare)]\n    \\<Longrightarrow> tr \\<in> exec_trace Gamma fn \\<Longrightarrow> Gamma fn = Some f\n    \\<Longrightarrow> function_graph f n = Some (Call nn fname inputs outputs)\n    \\<Longrightarrow> Gamma fname = Some f'\n    \\<Longrightarrow> tr i = Some [(NextNode n, st, fn')]\n    \\<Longrightarrow> \\<exists>j. tr (Suc i + j) = Some [(nn, return_vars (function_outputs f') outputs st' st, fn)]\n\"\n  apply (frule(4) exec_trace_drop_n)\n  apply (drule trace_end_SomeD, fastforce simp add: exec_trace_def)\n  apply clarsimp\n  apply (frule(4) exec_trace_drop_n_rest, simp, drule spec, drule(1) mp)\n  apply simp\n  apply (frule(1) exec_trace_invariant[where stack=\"[a, b]\" for a b])\n  apply (clarsimp simp: exec_graph_invariant_Cons get_state_function_call_def)\n  apply (frule_tac i=\"Suc i + na\" in exec_trace_step_cases, clarsimp)\n  apply (clarsimp simp: all_exec_graph_step_cases)\n  apply (metis add_Suc_right)\n  done\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/tools/asmrefine/GraphLangLemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328917, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.30145794895083694}}
{"text": "(******************************************************************************\n * Orca: A Functional Correctness Verifier for Imperative Programs\n *       Based on Isabelle/UTP\n *\n * Copyright (c) 2016-2018 Virginia Tech, USA\n *               2016-2018 Technische Universität München, Germany\n *               2016-2018 University of York, UK\n *               2016-2018 Université Paris-Saclay, Univ. Paris-Sud, France\n *\n * This software may be distributed and modified according to the terms of\n * the GNU Lesser General Public License version 3.0 or any later version.\n * Note that NO WARRANTY is provided.\n *\n * See CONTRIBUTORS, LICENSE and CITATION files for details.\n ******************************************************************************)\n\ntheory utp_sp\nimports \"../../Isabelle-UTP/utp/utp_wp\"\n    \nbegin\n\nnamed_theorems slp\n\nmethod slp_tac = (simp add: slp)\n\nconsts\n  usp :: \"'a \\<Rightarrow> 'b \\<Rightarrow> 'c\" (infix \"slp\" 60)\n\ntext \\<open>Since the definition of strongest post condition  below do not require termination. We name\n      it strongest liberal post-condition. Thus we follow Dijkstra terminology.\\<close>\n  \ndefinition slp_upred :: \"'\\<alpha> cond \\<Rightarrow> ('\\<alpha>, '\\<beta>) rel \\<Rightarrow> '\\<beta> cond\" where\n\"slp_upred p Q = \\<lfloor>(\\<lceil>p\\<rceil>\\<^sub>> ;; Q) :: ('\\<alpha>, '\\<beta>) rel\\<rfloor>\\<^sub>>\"\n\nadhoc_overloading\n  usp slp_upred\n\ndeclare slp_upred_def [upred_defs]\n\nlemma slp_false [slp]: \"p slp false = false\"\n  by (rel_simp) \n\nlemma slp_true [slp]: \"q \\<noteq> false \\<Longrightarrow> q slp true = true\"\n  by (rel_auto) \n    \nlemma slp_is_post_condition:\n  \"\\<lbrace>p\\<rbrace>prog\\<lbrace>p slp prog\\<rbrace>\\<^sub>u\"\n  by rel_blast\n    \nlemma slp_is_the_strongest_post:\n  \"`p slp prog \\<Rightarrow> Q`\\<Longrightarrow>\\<lbrace>p\\<rbrace>prog\\<lbrace>Q\\<rbrace>\\<^sub>u\"\n  by rel_blast\n    \nlemma slp_is_the_strongest_post':\n  \"(Q \\<sqsubseteq> p slp prog) \\<Longrightarrow>\\<lbrace>p\\<rbrace>prog\\<lbrace>Q\\<rbrace>\\<^sub>u\"\n  by rel_auto\n    \nlemma hoare_r_slp_eq:\n  \" \\<lbrace>p\\<rbrace>prog\\<lbrace>Q\\<rbrace>\\<^sub>u = `p slp prog \\<Rightarrow> Q` \"\n  by rel_blast\n    \ntheorem hoare_r_slp_eq':\n  \"\\<lbrace>p\\<rbrace>prog\\<lbrace>Q\\<rbrace>\\<^sub>u \\<longleftrightarrow> (Q \\<sqsubseteq> p slp prog)\"\n  by rel_auto                               \n     \ntheorem slp_eq_intro: \n  \"\\<lbrakk>\\<And>r. r slp P = r slp Q\\<rbrakk> \\<Longrightarrow> P = Q\"\n  by (rel_auto robust, fastforce+)  \n    \nlemma wlp_slp_sym:\n  \"`prog wp (true slp prog)`\"\n  by rel_auto\n     \nlemma wlp_is_pre_condition:\n  \"\\<lbrace>prog wp Q\\<rbrace>prog\\<lbrace>Q\\<rbrace>\\<^sub>u\"\n  by rel_blast    \n\nlemma wlp_is_the_weakest_pre:\n  \"`P \\<Rightarrow> prog wp Q` \\<Longrightarrow> \\<lbrace>P\\<rbrace>prog\\<lbrace>Q\\<rbrace>\\<^sub>u\"\n  by rel_blast  \n    \nlemma wlp_is_the_weakest_pre':\n  \"(prog wp Q) \\<sqsubseteq> P \\<Longrightarrow> \\<lbrace>P\\<rbrace>prog\\<lbrace>Q\\<rbrace>\\<^sub>u\"\n  by rel_blast \n    \nlemma hoare_r_wlp_eq:\n  \"\\<lbrace>P\\<rbrace>prog\\<lbrace>Q\\<rbrace>\\<^sub>u = `P \\<Rightarrow> prog wp Q`\"\n  by rel_blast\n \nlemma skip_r_slp:\n  \"P slp SKIP\\<^sub>r = P\"\n  by rel_simp\n\nlemma skip_r_wlp:\n  \"SKIP\\<^sub>r wp Q = Q\"\n  by rel_simp\n    \nlemma assigns_r_slp[slp]: \n  \"vwb_lens x \\<Longrightarrow> (p slp x :== e ) = (\\<^bold>\\<exists>v \\<bullet> p\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/x\\<rbrakk> \\<and> &x =\\<^sub>u e\\<lbrakk>\\<guillemotleft>v\\<guillemotright>/x\\<rbrakk>)\"\n  apply (rel_simp) \n    apply transfer\n  apply auto\n   apply (rule_tac x = \\<open>get\\<^bsub>x\\<^esub> y\\<close> in exI)\n    apply simp\n  apply (metis vwb_lens.put_eq)\n  done  \n \nlemma assigns_r_wlp[wp]:\n  \"(\\<langle>\\<sigma>\\<rangle>\\<^sub>a wp Q) = (\\<sigma> \\<dagger> Q)\"\n  by rel_simp\n \nlemma seq_r_slp[slp]:\n  \" P slp (S\\<^sub>1 ;; S\\<^sub>2) = (P slp S\\<^sub>1) slp S\\<^sub>2\"\n  by rel_auto\n\nlemma seq_r_wlp[wp]:\n  \"(S\\<^sub>1 ;; S\\<^sub>2) wp Q = S\\<^sub>1 wp (S\\<^sub>2 wp Q)\"\n  by rel_auto \n    \nlemma If_r_slp[slp]:\n  \"P slp (bif b then S\\<^sub>1 else S\\<^sub>2 eif) = (((P \\<and> b) slp S\\<^sub>1) \\<or> ((P \\<and> \\<not>b) slp S\\<^sub>2))\"\n  by rel_auto\n\nlemma If_r_wlp[wp]:\n  \"(bif b then S\\<^sub>1 else S\\<^sub>2 eif) wp Q = ((S\\<^sub>1 wp Q \\<and> b)\\<or> (S\\<^sub>2 wp Q \\<and> \\<not>b))\"\n  by rel_auto\n    \nlemma while_gfp_rel_slp [slp]:\n  \"P slp (while\\<^sup>\\<top> b do body od) = ((((P \\<and> b) slp body) slp (while\\<^sup>\\<top> b do body od)) \\<or> (P \\<and> \\<not>b))\"\n  apply (subst while_gfp_rel_unfold)\n  apply rel_auto\n  done\n\nlemma while_gfp_rel_wlp[wp]:\n  \"(while\\<^sup>\\<top> b do body od) wp Q = ((body wp ((while\\<^sup>\\<top> b do body od)  wp Q) \\<and> b) \\<or> (Q \\<and> \\<not>b))\"\n  apply (subst while_gfp_rel_unfold)\n  apply rel_auto\n  done\n    \nlemma gfp_rel_slp [slp]:\n  \"mono F \\<Longrightarrow> P slp \\<nu> F =  P slp F(\\<nu> F)\"\n  apply (subst lfp_unfold)\n   apply simp_all\n  done\n    \nlemma gfp_rel_wlp [wp]:\n  \"mono F \\<Longrightarrow> \\<nu> F wp Q  =  F(\\<nu> F) wp Q\"\n  apply (subst lfp_unfold)\n   apply simp_all\n  done\nend  \n  \n\n", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/C-verifier/src/Midend-IVL/Isabelle-UTP-Extended/utp/utp_sp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6076631698328916, "lm_q2_score": 0.49609382947091946, "lm_q1q2_score": 0.3014579489508369}}
{"text": "theory InstanceTrees\nimports NonFreeAnimation\nbegin \n\n\ndatatype 'a tree2 = Tree2 \"'a\" \"('a treelist)\"\n  and 'a treelist = Emp2 | Cons2 \"('a tree2)\" \"('a treelist)\"\n\nthm tree2_treelist.induct tree2_treelist.inducts\n\n\n(* these don't work, mutually rec datatypes must have exact same type parameters *)\n(* datatype 'a bla = Emp3 | One \"'a blub\"\n   and  'b blub = Blub *)\n(* datatype 'a bla = Emp3 | One3 'a | Blub1 \"blub\"\n  and blub = Blub *)\n\n\n\n(*\nFinitely branching unordered trees\n\ndatatype  'a tree = Tree 'a ('a tfset) \nand      'a tfset = Emp | Ins ('a tree) ('a tfset) \nwhere \n  Ins a (Ins a s) = Ins a s\n\n  Ins a1 (Ins a2 s) = Ins a2 (Ins a1 s)\n*)\n\n\n\nlocale results =\n  fixes alpha :: tyvar\n    and tree_name :: tyco\n    and tfset_name :: tyco\n    and Empty_name :: oper\n    and Ins_name :: oper\n    and Tree_name :: oper\n    and dummy :: 'a\nbegin\n\nlemma [ffact]: \"decl_tyvars () [alpha]\" ..\nlemma [ffact]: \"alpha tyinterpr TYPE('a)\" ..\n\nlemma [ffact]: \"tree_name tycohaskind (ExtType =K=> IntType)\" ..\nlemma [ffact]: \"tfset_name tycohaskind (ExtType =K=> IntType)\" ..\n\nlemma [ffact]: \"Empty_name operhasty (tfset_name ** alpha)\" ..\nlemma [ffact]: \"Ins_name operhasty (tree_name ** alpha =T=> tfset_name ** alpha =T=> tfset_name ** alpha)\" ..\nlemma [ffact]: \"Tree_name operhasty (alpha =T=> tfset_name ** alpha =T=> tree_name ** alpha)\" ..\n\ndefinition \"ins_clause1_name = (0::nat)\"\ndefinition \"ins_clause2_name = (0::nat)\"\n\n\nlemma [ffact]: \"decl_hcl ins_clause1_name (QUANT t: tree_name ** alpha. QUANT S: tfset_name ** alpha.\n  Ins_name $ t $ (Ins_name $ t $ S) === Ins_name $ t $ S)\" ..\nlemma [ffact]: \"decl_hcl ins_clause2_name (QUANT t: tree_name ** alpha. QUANT t2: tree_name ** alpha. QUANT S: tfset_name ** alpha.\n  Ins_name $ t $ (Ins_name $ t2 $ S) === Ins_name $ t2 $ (Ins_name $ t $ S))\" ..\n\n\n\n\n(*\nlocal_setup {*  MetaRec.add_non_pervasive_declaration (fn _ => MetaRec.set_trace_depth (10, 10))  *}\ndeclare [[show_hyps]]\n*)\n\nlocal_setup {* MetaRec.run_expl_frules *}\n\nend\n\n\nthm results.ins_clause2\n\nterm \"TYPE('b results.tree)\"\n\n\n(*type_synonym 'a tree = \"'a results.sorts_enum_Constr0_reified\"\ntype_synonym 'a tfset = \"'a results.sorts_enum_Constr1_reified\" *)\n\nlocale map_fun =\n  results alpha tree_name tfset_name Empty_name Ins_name Tree_name dummy\n     for alpha :: tyvar and tree_name :: tyco and tfset_name :: tyco and Empty_name :: oper\n     and Ins_name :: oper and Tree_name :: oper  and dummy :: 'a +\n  fixes f :: \"'a => 'b\"\nbegin\n\n\nlemma tree_ty_interpr[ffact]: \"(tree_name ** alpha) alginterpr TYPE('b tree)\" ..\nlemma tfset_ty_interpr[ffact]: \"(tfset_name ** alpha) alginterpr TYPE('b tfset)\" ..\n\nlemma empty_interpr[ffact]: \"Empty_name operalginterpr (results.Empty :: 'b tfset)\" ..\nlemma ins_interpr[ffact]: \"Ins_name operalginterpr (results.Ins :: 'b tree => 'b tfset => 'b tfset)\" ..\nlemma tree_interpr[ffact]: \"Tree_name operalginterpr (% (x::'a) (ts :: 'b tfset). results.Tree (f x) ts)\" ..\n\nlemma [ffact]: \"proven_hcl (ALL t :: 'b tree. ALL S :: 'b tfset.\n  results.Ins t (results.Ins t S) = results.Ins t S)\" sorry\nlemma [ffact]: \"proven_hcl (ALL t :: 'b tree. ALL t2 :: 'b tree. ALL S :: 'b tfset.\n  results.Ins t (results.Ins t2 S) = results.Ins t2 (results.Ins t S))\" sorry\n\nML {*\n  MetaRec.print_depgraph (Context.Proof @{context})\n*}\n\nlocal_setup {*\n  (* MetaRec.set_running_expl_frules true\n  #> MetaRec.add_facts_decl [@{thm tree_ty_interpr}, @{thm tfset_ty_interpr},\n    @{thm empty_interpr}, @{thm ins_interpr}, @{thm tree_interpr}]\n  #> *)\n  MetaRec.run_expl_frules\n*}\n\nend\n\nthm map_fun.iter_op_clauses0\n\n\n\nend\n", "meta": {"author": "metaforcy", "repo": "nonfree-data", "sha": "f3ce28278a88fdd240faa2e51f893fee5c15f2f2", "save_path": "github-repos/isabelle/metaforcy-nonfree-data", "path": "github-repos/isabelle/metaforcy-nonfree-data/nonfree-data-f3ce28278a88fdd240faa2e51f893fee5c15f2f2/manual-instantiations/InstanceTrees.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5888891163376235, "lm_q2_score": 0.5117166047041654, "lm_q1q2_score": 0.30134433915952497}}
{"text": "theory task2\n  imports task1\nbegin\n\n\ndefinition inv_s' :: \"state \\<Rightarrow> bool\" where\n \"inv_s' s = (s T \\<le> 0.045 \\<and> s C \\<le> 0.02)\"\n\ndefinition T2 :: \"estate proc\" where\n\"T2 = IF (\\<lambda>(a,s) . status a = WAIT) \n        THEN (Cont (ODE ((\\<lambda> _ _ . 0)(T := (\\<lambda> _ .1)))) (\\<lambda> s. s T < 0.045);T ::= (\\<lambda>_. 0); Basic (ent_assign ezero);Basic (ready_assign)) \n      ELSE \n      (IF(\\<lambda>(a,s) . status a = READY) \n        THEN (Cm ((req_ch 2)[!](\\<lambda>(a,s). task_prior a)); \n             (Interrupt (ODE ((\\<lambda> _ _ . 0)(T := (\\<lambda> _ .1)))) (\\<lambda> s. s T < 0.045) [(run_ch 2[?]F,Basic run_assign)]); \n             (IF (\\<lambda>(a,s) . status a = READY \\<and> s T = 0.045) THEN (EChoice [(exit_ch 2[!](\\<lambda>_.0),Basic wait_assign),(run_ch 2[?]F,Basic run_assign)]) ELSE Skip FI))  \n      ELSE \n      (IF(\\<lambda>(a,s) . entered a = ezero) THEN \n             (C ::= (\\<lambda>_ . 0); Basic (ent_assign eone)) ELSE Skip FI; \n        (Interrupt (ODE ((\\<lambda> _ _ . 0)(T := (\\<lambda> _ .1),C := (\\<lambda>_ .1)))) (\\<lambda> s. s T < 0.045 \\<and> s C < 0.02) [(preempt_ch 2[?]F,Basic ready_assign)]); \n        IF (\\<lambda>(a,s) . status a = RUNNING) THEN EChoice [(free_ch 2[!](\\<lambda>_.0),Basic wait_assign),(preempt_ch 2[?]F,Basic wait_assign)] ELSE Skip FI) \n      FI) FI\"\n\n\nfun T2_tr:: \"nat \\<Rightarrow> estate ext_state \\<Rightarrow> estate tassn\" where\n  \"T2_tr 0 (Task st ent tp,ss)  = emp\\<^sub>t\"\n| \"T2_tr (Suc k) (Task WAIT ent tp,ss) = \n   (Wait\\<^sub>t (9 / 200 - ss T) (\\<lambda>t. EState (Task WAIT ent tp, ss(T:= ss T + t))) ({}, {}) @\\<^sub>t T2_tr k (Task READY ezero tp,ss(T:=0)))\"\n| \"T2_tr (Suc k) (Task READY ent tp,ss) = (\n             (\\<exists>\\<^sub>t v tt. \\<up>(tt\\<ge>0 \\<and> tt \\<le> 0.045 - ss T) \\<and>\\<^sub>t Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp @\\<^sub>t\n                   Waitin\\<^sub>t tt (\\<lambda>t. EState (Task READY ent tp, ss(T := ss T + t)))\n                    (run_ch 2) v ({}, {run_ch 2}) @\\<^sub>t \n                   T2_tr k (Task RUNNING ent tp,ss(T := ss T + tt, F:=v)))\n           \\<or>\\<^sub>t (Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp @\\<^sub>t\n                   Wait\\<^sub>t (9 / 200 - ss T) (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>)))\n                    ({}, {run_ch 2}) @\\<^sub>t\n                    (outrdy_assn (Task READY ent tp, ss(T:=0.045)) (exit_ch 2) 0 ({exit_ch 2},{run_ch 2}) @\\<^sub>t T2_tr k (Task WAIT ent tp,ss(T:=0.045))\n                  \\<or>\\<^sub>t (\\<exists>\\<^sub>t v. inrdy_assn (Task READY ent tp, ss(T:=0.045)) (run_ch 2) v ({exit_ch 2},{run_ch 2}) @\\<^sub>t T2_tr k (Task RUNNING ent tp,ss(T:=0.045,F:=v))))))\"\n| \"T2_tr (Suc k) (Task RUNNING ent tp,ss) = (\n             (\\<exists>\\<^sub>t v tt. \\<up>(tt\\<ge>0 \\<and> tt \\<le> (min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) \\<and>\\<^sub>t Waitin\\<^sub>t tt\n                           (\\<lambda>t. EState\n                                 (Task RUNNING eone tp, ss\n                                  (T := ss T + t,\n                                   C := C_upd ent (ss C) + t)))\n                           (preempt_ch 2) v ({}, {preempt_ch 2}) @\\<^sub>t\n                         T2_tr k (Task READY eone tp,ss\n                         (T := ss T + tt,\n                          C := C_upd ent (ss C) + tt, F := v)))\n            \\<or>\\<^sub>t (Wait\\<^sub>t (min (0.045 - ss T) (0.02 - C_upd ent (ss C)))\n          (\\<lambda>\\<tau>. EState\n                (Task RUNNING eone tp, ss(T := ss T + \\<tau>, C := C_upd ent (ss C) + \\<tau>)))\n          ({}, {preempt_ch 2}) @\\<^sub>t \n             ((Outrdy\\<^sub>t ((Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C))))) (free_ch 2) 0 ({free_ch 2},{preempt_ch 2})@\\<^sub>t\n                T2_tr k (Task WAIT eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))))\n     \\<or>\\<^sub>t (\\<exists>\\<^sub>t v.(Inrdy\\<^sub>t ((Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C))))) (preempt_ch 2) v ({free_ch 2},{preempt_ch 2})@\\<^sub>t\n                T2_tr k (Task WAIT eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)),F:=v)))))\n)\n)\"\n                                                                                                                              \n\nlemma T2_Valid_WAIT:\n\"\\<Turnstile> {\\<lambda>s t. s = (Task WAIT ent tp,ss) \\<and> inv_s' (snd s) \\<and> P s t}\n   T2\n    {\\<lambda> s t. s = (Task READY ezero tp,ss(T:=0)) \\<and> inv_s' (snd s) \\<and> (P (Task WAIT ent tp,ss) @\\<^sub>t Wait\\<^sub>t (9 / 200 - ss T) (\\<lambda>t. EState (Task WAIT ent tp, ss(T:= ss T + t))) ({}, {})) t}\"\n  unfolding T2_def\n  apply(rule Valid_strengthen_post)\n   prefer 2\n   apply(rule Valid_cond_sp)\n    apply(rule Valid_seq)\n     apply(rule Valid_pre_cases'[where P=\"\\<lambda>(a,s) . s T< 0.045\"])\n      apply(rule Valid_weaken_pre)\n       prefer 2\n       apply(rule Valid_strengthen_post[where Q'=\"\\<lambda> s t. s = (Task WAIT ent tp,ss(T:=0.045)) \\<and> inv_s' (snd s) \\<and> (P (Task WAIT ent tp,ss) @\\<^sub>t\n         Wait\\<^sub>t (45 / 10 ^ 3 - ss T) (\\<lambda>t. EState (Task WAIT ent tp, ss(T := ss T + t))) ({}, {})) t\"])\n        prefer 2\n        apply(rule Valid_ode_sol_sp[where ss= ss and aa = \"Task WAIT ent tp\" and d=\"0.045- ss T\" and p=\"\\<lambda> t. ss(T:= ss T+t)\" and P = \"\\<lambda>(a,s) t. inv_s' (snd (a, s)) \\<and> P (a, s) t\"])\n     subgoal by auto\n     subgoal \n       apply auto unfolding state2vec_def has_vderiv_on_def\n       apply clarify\n       apply (rule has_vector_derivative_projI)\n       apply auto\n       apply (rule has_vector_derivative_eq_rhs)\n        apply (fast intro!: derivative_intros)\n       by auto\n     subgoal by auto\n     subgoal by auto\n     subgoal\n       apply auto unfolding state2vec_def vec2state_def\n       apply (rule c1_implies_local_lipschitz[where f'=\"(\\<lambda>(t,v). Blinfun(\\<lambda>(v::vec) . \\<chi> x. 0))\"])\n       apply auto\n       unfolding has_derivative_def\n       apply auto\n        prefer 2\n        apply (rule vec_tendstoI)\n       subgoal\n       proof-\n         have b1:\"bounded_linear (\\<lambda> (v::vec). \\<chi> a . 0)\"\n           apply (rule bounded_linearI')\n           using vec_lambda_unique by fastforce+\n         then have b2:\"blinfun_apply (Blinfun (\\<lambda> (v::vec). \\<chi> x. 0)) = (\\<lambda>v. \\<chi> x. 0)\"\n           apply(rule bounded_linear_Blinfun_apply)\n           done\n         then have b3:\"bounded_linear (blinfun_apply (Blinfun (\\<lambda> (v::vec). \\<chi> x. 0)))\"\n           using b1 \n           by (simp add: blinfun.bounded_linear_right)\n         show ?thesis\n           by(auto simp add:b2)\n       qed\n       by (simp add: blinfun.bounded_linear_right)\n     subgoal\n       unfolding entails_def inv_s'_def by (auto simp add:C_def T_def pure_assn_def conj_assn_def)\n     subgoal unfolding entails_def by auto\n        apply(rule Valid_weaken_pre)\n         prefer 2\n         apply(rule Valid_strengthen_post)\n          prefer 2\n          apply(rule Valid_ode_not_sp[where ss= ss and aa = \"Task WAIT ent tp\" and d=\"0.045- ss T\" and p=\"\\<lambda> t. ss(T:= ss T+t)\" and P = \"\\<lambda>(a,s) t. inv_s' (snd (a, s)) \\<and> P (a, s) t\"])\n     subgoal by auto\n     subgoal by auto\n     subgoal unfolding entails_def inv_s'_def by (auto simp add:C_def T_def pure_assn_def conj_assn_def)\n     subgoal unfolding entails_def inv_s'_def by (auto simp add:C_def T_def)\n     apply(rule Valid_seq)\n  apply(rule Valid_assign_sp1)\n    apply(rule Valid_seq)\n     apply(rule Valid_basic_sp1)\n    apply simp\n    apply(rule Valid_basic_sp1)\n  unfolding entails_def\n   apply simp\n   apply(rule Valid_weaken_pre[where P'=\"\\<lambda> s t. False\"])\n  unfolding entails_def\n    apply auto[1]\n   apply(rule Valid_False)\n  apply(auto simp add: pure_assn_def conj_assn_def inv_s'_def C_def T_def)\n  subgoal for ss' tr x\n    apply (rule ext) subgoal for v\n      apply (cases \"v = CHR ''t''\")\n      subgoal by auto\n      subgoal premises pre proof -\n        have \"(ss'(CHR ''t'' := x)) v = (ss(CHR ''t'' := 9 / 200)) v\"\n          using pre(2) by auto\n        then have \"ss' v = ss v\"\n          using pre(6) by auto\n        then show ?thesis\n          using pre(6) by auto\n      qed\n      done\n    done\n  done\n\n  \n  \n    \n  \n\n\nlemma T2_Valid_READY:\n\"\\<Turnstile> {\\<lambda>s t. s = (Task READY ent tp,ss) \\<and> inv_s' (snd s) \\<and> P s t}\n   T2\n    {\\<lambda> s tr. (inv_s' (snd s) \\<and> (\\<exists> tt v. tt\\<ge>0 \\<and> tt \\<le> 0.045 - ss T \\<and> s = (Task RUNNING ent tp,ss(T:= ss T + tt,F := v)) \\<and>\n                    ((P (Task READY ent tp, ss) @\\<^sub>t\n                    Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                   Waitin\\<^sub>t tt (\\<lambda>t. EState (Task READY ent tp, ss(T := ss T + t)))\n                    (run_ch 2) v ({}, {run_ch 2})) tr)) \n              \\<or> (inv_s' (snd s) \\<and> s = (Task WAIT ent tp,ss(T:=0.045)) \\<and> \n                   ((P (Task READY ent tp, ss) @\\<^sub>t\n                    Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                   Wait\\<^sub>t (9 / 200 - ss T) (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>)))\n                    ({}, {run_ch 2}) @\\<^sub>t\n                    Outrdy\\<^sub>t (Task READY ent tp, ss(T:=0.045)) (exit_ch 2) 0 ({exit_ch 2},{run_ch 2}))\n                   tr)\n              \\<or> (\\<exists> v. (inv_s' (snd s) \\<and> s = (Task RUNNING ent tp,ss(T:=0.045,F:=v)) \\<and> \n                   ((P (Task READY ent tp, ss) @\\<^sub>t\n                    Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                   Wait\\<^sub>t (9 / 200 - ss T) (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>)))\n                    ({}, {run_ch 2}) @\\<^sub>t\n                    Inrdy\\<^sub>t (Task READY ent tp, ss(T:=0.045)) (run_ch 2) v ({exit_ch 2},{run_ch 2}))\n                   tr))}\"\nunfolding T2_def\n  apply(rule Valid_strengthen_post)\n   prefer 2\n   apply(rule Valid_cond_sp)\n  apply(rule Valid_weaken_pre[where P'=\"\\<lambda> s t. False\"])\nunfolding entails_def\n    apply auto[1]\n  apply(rule Valid_False)\n  apply(rule Valid_cond_sp)\n  prefer 2\napply(rule Valid_weaken_pre[where P'=\"\\<lambda> s t. False\"])\nunfolding entails_def\n    apply auto[1]\n  apply(rule Valid_False)\n  apply(rule Valid_seq)\n  apply(rule Valid_send_sp)\n  apply(rule Valid_seq[where \n    Q=\"\\<lambda> (a,s) tr. (\\<exists> tt v. tt\\<ge>0 \\<and> tt \\<le> 0.045 - ss T \\<and> (a,s) = (Task RUNNING ent tp,ss(T:= ss T + tt,F := v)) \\<and> inv_s' s \\<and> (\n                   (P (Task READY ent tp, ss) @\\<^sub>t\n                    Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                   Waitin\\<^sub>t tt (\\<lambda>t. EState (Task READY ent tp, ss(T := ss T + t)))\n                    (run_ch 2) v ({}, {run_ch 2})) tr)\n              \\<or>  ((a,s) = (Task READY ent tp,ss(T:=0.045)) \\<and> inv_s' s \\<and> \n                   ((P (Task READY ent tp, ss) @\\<^sub>t\n                    Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                   Wait\\<^sub>t (9 / 200 - ss T) (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>)))\n                    ({}, {run_ch 2}))\n                   tr)\"])\n  apply(rule Valid_pre_cases'[where P=\"(\\<lambda>(a,s). s T < 45 / 10 ^ 3)\"])\n   apply(rule Valid_weaken_pre)\n  prefer 2\n  apply(rule Valid_strengthen_post)\n     prefer 2\n     apply(rule Valid_interrupt_in_sol[where ss= ss and d=\"0.045- ss T\" and p=\"\\<lambda> t. ss(T:= ss T + t)\" and aa= \"Task READY ent tp\" and P=\"\\<lambda>(a,s) t. inv_s' s \\<and> (P (a, s) @\\<^sub>t Out\\<^sub>t (EState (a, s)) (req_ch 2) tp) t\"])\n  subgoal by auto\n  subgoal \n    apply auto unfolding state2vec_def has_vderiv_on_def\n    apply clarify\n    apply (rule has_vector_derivative_projI)\n    apply auto\n    apply (rule has_vector_derivative_eq_rhs)\n     apply (fast intro!: derivative_intros)\n    by auto\n  subgoal by auto\n  subgoal by auto\n  subgoal\n    apply auto unfolding state2vec_def vec2state_def\n    apply (rule c1_implies_local_lipschitz[where f'=\"(\\<lambda>(t,v). Blinfun(\\<lambda>(v::vec) . \\<chi> x. 0))\"])\n       apply auto\n    unfolding has_derivative_def\n    apply auto\n    prefer 2\n     apply (rule vec_tendstoI)\n    subgoal\n    proof-\n    have b1:\"bounded_linear (\\<lambda> (v::vec). \\<chi> a . 0)\"\n      apply (rule bounded_linearI')\n      using vec_lambda_unique by fastforce+\n    then have b2:\"blinfun_apply (Blinfun (\\<lambda> (v::vec). \\<chi> x. 0)) = (\\<lambda>v. \\<chi> x. 0)\"\n      apply(rule bounded_linear_Blinfun_apply)\n      done\n    then have b3:\"bounded_linear (blinfun_apply (Blinfun (\\<lambda> (v::vec). \\<chi> x. 0)))\"\n      using b1 \n      by (simp add: blinfun.bounded_linear_right)\n    show ?thesis\n      by(auto simp add:b2)\n  qed\n  by (simp add: blinfun.bounded_linear_right)\n     apply auto[1]\n     apply(rule Valid_basic_sp1)\n    prefer 2\n  subgoal unfolding entails_def join_assn_def by auto\n     prefer 2\n  apply(rule Valid_weaken_pre)\n  prefer 2\n  apply(rule Valid_strengthen_post)\n       prefer 2\n       apply(rule Valid_interrupt_in_not[where p = \"\\<lambda> t. ss(T:= ss T + t)\" and ss= ss and aa= \"Task READY ent tp\" and P=\"\\<lambda>(a,s) t. inv_s' s \\<and> (P (a, s) @\\<^sub>t Out\\<^sub>t (EState (a, s)) (req_ch 2) tp) t\"])\n  subgoal by auto\n  apply auto[1]\n       apply(rule Valid_basic_sp1)\n      prefer 2\n  subgoal unfolding entails_def join_assn_def by auto\n  subgoal unfolding entails_def inv_s'_def pure_assn_def join_assn_def conj_assn_def\n    apply (auto simp add: T_def C_def F_def)\n    subgoal for v tr1 tr3 tr2\n      apply(rule exI[where x = 0])\n      apply auto\n      apply(rule exI[where x = v])\n      apply auto\n      apply(rule exI[where x = \"tr1@tr2\"])\n      by auto\n    done\n  subgoal \n    apply(rule entails_disjE)\n     apply (auto simp del: fun_upd_apply)\n    subgoal\n    apply(rule entails_trans[where Q =\"(\\<lambda>a. case a of\n         (a, s) \\<Rightarrow>\n           \\<lambda>tr. (\\<exists>tt\\<ge>0.\n                    tt \\<le> 9 / 200 - ss T \\<and>\n                    a = Task RUNNING ent tp \\<and>\n                    (\\<exists>v. s = ss(T := ss T + tt, F := v) \\<and>\n                         inv_s' s \\<and>\n                         ((P (Task READY ent tp, ss) @\\<^sub>t\n                           Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                          Waitin\\<^sub>t tt (\\<lambda>t. EState (Task READY ent tp, ss(T := ss T + t)))\n                           (run_ch 2) v ({}, {run_ch 2}))\n                          tr)))\"])\n      subgoal \n        unfolding entails_def C_def T_def F_def inv_s'_def pure_assn_def conj_assn_def join_assn_def\n        apply (auto simp del: fun_upd_apply)\n        subgoal for tt vv tr1 tr2 tr3\n          apply(rule exI[where x=\"tt\"])\n          apply auto\n          apply(rule exI[where x=\"vv\"])\n          apply auto\n          apply(rule exI[where x=\"tr1@tr3\"])\n          by auto\n        done\n      unfolding entails_def by auto\n    subgoal\n      apply(rule entails_trans[where Q=\"\\<lambda>a. case a of\n         (a, s) \\<Rightarrow>\n           \\<lambda>tr. a = Task READY ent tp \\<and>\n                s = ss(T := 9 / 200) \\<and>\n                inv_s' s \\<and>\n                ((P (Task READY ent tp, ss) @\\<^sub>t\n                  Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                 Wait\\<^sub>t (9 / 200 - ss T)\n                  (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>))) ({}, {run_ch 2}))\n                 tr\"])\n      unfolding entails_def C_def T_def F_def inv_s'_def pure_assn_def conj_assn_def join_assn_def\n      by auto\n    done\n   apply(rule Valid_cond_sp)\n  apply simp\n  apply(rule Valid_echoice[where R =\"\\<lambda> s tr.(inv_s' (snd s) \\<and> s = (Task WAIT ent tp,ss(T:=0.045)) \\<and> \n                   ((P (Task READY ent tp, ss) @\\<^sub>t\n                    Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                   Wait\\<^sub>t (9 / 200 - ss T) (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>)))\n                    ({}, {run_ch 2}) @\\<^sub>t\n                    Outrdy\\<^sub>t (Task READY ent tp, ss(T:=0.045)) (exit_ch 2) 0 ({exit_ch 2},{run_ch 2}))\n                   tr)\n              \\<or> (\\<exists> v. (inv_s' (snd s) \\<and> s = (Task RUNNING ent tp,ss(T:=0.045,F:=v)) \\<and> \n                   ((P (Task READY ent tp, ss) @\\<^sub>t\n                    Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                   Wait\\<^sub>t (9 / 200 - ss T) (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>)))\n                    ({}, {run_ch 2}) @\\<^sub>t\n                    Inrdy\\<^sub>t (Task READY ent tp, ss(T:=0.045)) (run_ch 2) v ({exit_ch 2},{run_ch 2}))\n                   tr))\"])\n  subgoal for i\n    apply(cases i)\n    subgoal\n      apply auto\n      apply(rule exI[where x=\"\\<lambda>s tr.\n               inv_s' (snd s) \\<and>\n               s = (Task READY ent tp, ss(T := 9 / 200)) \\<and>\n               ((P (Task READY ent tp, ss) @\\<^sub>t\n                 Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                Wait\\<^sub>t (9 / 200 - ss T)\n                 (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>))) ({}, {run_ch 2}) @\\<^sub>t\n                Outrdy\\<^sub>t (Task READY ent tp, ss(T := 9 / 200)) (exit_ch 2) 0\n                 ({exit_ch 2}, {run_ch 2}))\n                tr\"])\n      apply auto\n      subgoal\n        apply(rule Valid_strengthen_post)\n         prefer 2\n         apply(rule Valid_basic_sp1)\n        unfolding entails_def\n        by auto\n      subgoal unfolding entails_def\n        apply (auto simp add:join_assn_def join_assoc)\n        subgoal for tr1a tr2 tr2a\n          apply(rule exI[where x=\"tr1a@tr2a\"])\n          apply auto\n          apply(rule exI[where x=\"tr2\"])\n          apply auto\n          apply(rule )\n          done\n        done\n      subgoal unfolding entails_def\n        apply (auto simp add:join_assn_def join_assoc)\n        subgoal for d tr1a tr2 tr2a\n          apply(rule exI[where x=\"tr1a@tr2a\"])\n          apply auto\n          apply(rule exI[where x=\"tr2\"])\n          apply auto\n          apply rule \n          by auto\n        done\n      done\n    subgoal for i'\n      apply auto\n      apply(rule exI[where x=\"\\<lambda> s tr. (\\<exists> v. (inv_s' (snd s) \\<and> s = (Task READY ent tp,ss(T:=0.045,F:=v)) \\<and> \n                   ((P (Task READY ent tp, ss) @\\<^sub>t\n                    Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                   Wait\\<^sub>t (9 / 200 - ss T) (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>)))\n                    ({}, {run_ch 2}) @\\<^sub>t\n                    Inrdy\\<^sub>t (Task READY ent tp, ss(T:=0.045)) (run_ch 2) v ({exit_ch 2},{run_ch 2}))\n                   tr))\"])\n      apply auto\n      subgoal\n        apply(rule Valid_strengthen_post)\n         prefer 2\n         apply(rule Valid_basic_sp1)\n        unfolding entails_def\n        by auto\n      subgoal unfolding entails_def\n        apply (auto simp add:inv_s'_def F_def T_def C_def join_assn_def join_assoc)\n        subgoal for tr1a tr2 tr2a v\n          apply(rule exI[where x=v])\n          apply auto\n          apply(rule exI[where x=\"tr1a@tr2a\"])\n          apply auto\n          apply(rule exI[where x=tr2])\n          apply auto\n          apply rule\n          done\n        done\n      subgoal unfolding entails_def\n        apply (auto simp add:inv_s'_def F_def T_def C_def join_assn_def join_assoc)\n        subgoal for d tr1a tr2 tr2a v\n          apply(rule exI[where x=v])\n          apply auto\n          apply(rule exI[where x=\"tr1a@tr2a\"])\n          apply auto\n          apply(rule exI[where x=tr2])\n          apply auto\n          apply rule\n          by auto\n        done\n      done\n    done\n   apply(rule Valid_skip)\n  by auto\n\n\n    \n\nlemma T2_Valid_RUNNING:\n\"\\<Turnstile> {\\<lambda>s t. s = (Task RUNNING ent tp,ss) \\<and> inv_s' (snd s) \\<and> P s t}\n   T2\n    {\\<lambda> s tr. ((inv_s' (snd s) \\<and> (\\<exists> tt v. tt\\<ge>0 \\<and> tt \\<le> (min (0.045 - ss T) (0.02 - C_upd ent (ss C))) \\<and> \n                          s = (Task READY eone tp,ss\n                         (CHR ''t'' := ss CHR ''t'' + tt,\n                          CHR ''c'' := C_upd ent (ss CHR ''c'') + tt, F := v)) \\<and> (\n                    P (Task RUNNING ent tp, ss) @\\<^sub>t\n                          Waitin\\<^sub>t tt\n                           (\\<lambda>t. EState\n                                 (Task RUNNING eone tp, ss\n                                  (CHR ''t'' := ss CHR ''t'' + t,\n                                   CHR ''c'' := C_upd ent (ss CHR ''c'') + t)))\n                           (preempt_ch 2) v ({}, {preempt_ch 2}))\n                          tr)) \n              \\<or>  (inv_s' (snd s) \\<and> s =\n          (Task WAIT eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) \\<and> \n                   ((P (Task RUNNING ent tp, ss)) @\\<^sub>t\n         Wait\\<^sub>t (min (0.045 - ss T) (0.02 - C_upd ent (ss C)))\n          (\\<lambda>\\<tau>. EState\n                (Task RUNNING eone tp, ss(T := ss T + \\<tau>, C := C_upd ent (ss C) + \\<tau>)))\n          ({}, {preempt_ch 2}) @\\<^sub>t\n             Outrdy\\<^sub>t (Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) (free_ch 2) 0 ({free_ch 2},{preempt_ch 2}))\n         tr)\n             \\<or> (\\<exists> v. (inv_s' (snd s) \\<and> s =\n          (Task WAIT eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)), F := v)) \\<and> \n                   ((P (Task RUNNING ent tp, ss)) @\\<^sub>t\n         Wait\\<^sub>t (min (0.045 - ss T) (0.02 - C_upd ent (ss C)))\n          (\\<lambda>\\<tau>. EState\n                (Task RUNNING eone tp, ss(T := ss T + \\<tau>, C := C_upd ent (ss C) + \\<tau>)))\n          ({}, {preempt_ch 2}) @\\<^sub>t\n             Inrdy\\<^sub>t (Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) (preempt_ch 2) v ({free_ch 2},{preempt_ch 2}))\n         tr)))}\"\n  unfolding T2_def\napply(rule Valid_strengthen_post)\n   prefer 2\n   apply(rule Valid_cond_sp)\n  apply(rule Valid_weaken_pre[where P'=\"\\<lambda> s t. False\"])\nunfolding entails_def\n    apply auto[1]\n  apply(rule Valid_False)\napply(rule Valid_cond_sp)\n  apply(rule Valid_weaken_pre[where P'=\"\\<lambda> s t. False\"])\nunfolding entails_def\n    apply auto[1]\n  apply(rule Valid_False)\n  apply(rule Valid_seq[where Q=\"\\<lambda> s t. s = (Task RUNNING eone tp, ss(C := C_upd ent (ss C))) \\<and> inv_s' (snd s) \\<and> P (Task RUNNING ent tp, ss) t\"])\n  apply(rule Valid_strengthen_post)\n  prefer 2\n   apply(rule Valid_cond_sp)\n   apply(rule Valid_seq)\n    apply(rule Valid_assign_sp1)\n    apply(rule Valid_basic_sp1)\n   apply(rule Valid_skip)\n  subgoal unfolding entails_def inv_s'_def C_upd_def\n    apply auto\n    using entered.exhaust by blast\n   apply(rule Valid_seq[where \n    Q=\"\\<lambda> (a,s) tr. (\\<exists> tt v. tt\\<ge>0 \\<and> tt \\<le> (min (0.045 - ss T) (0.02 - C_upd ent (ss C))) \\<and> \n                          (a,s) = (Task READY eone tp,ss\n                         (CHR ''t'' := ss CHR ''t'' + tt,\n                          CHR ''c'' := C_upd ent (ss CHR ''c'') + tt, F := v)) \\<and> inv_s' s \\<and> (\n                    P (Task RUNNING ent tp, ss) @\\<^sub>t\n                          Waitin\\<^sub>t tt\n                           (\\<lambda>t. EState\n                                 (Task RUNNING eone tp, ss\n                                  (CHR ''t'' := ss CHR ''t'' + t,\n                                   CHR ''c'' := C_upd ent (ss CHR ''c'') + t)))\n                           (preempt_ch 2) v ({}, {preempt_ch 2}))\n                          tr) \n              \\<or>  ((a, s) =\n          (Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) \\<and> inv_s' s \\<and> \n                   ((P (Task RUNNING ent tp, ss)) @\\<^sub>t\n         Wait\\<^sub>t (min (0.045 - ss T) (0.02 - C_upd ent (ss C)))\n          (\\<lambda>\\<tau>. EState\n                (Task RUNNING eone tp, ss(T := ss T + \\<tau>, C := C_upd ent (ss C) + \\<tau>)))\n          ({}, {preempt_ch 2}))\n         tr)\"])\n apply(rule Valid_pre_cases'[where P=\"(\\<lambda>(a,s). s T < 45 / 10 ^ 3 \\<and> s C < 2 / 10\\<^sup>2)\"])\n   apply(rule Valid_weaken_pre)\n  prefer 2\n  apply(rule Valid_strengthen_post)\n     prefer 2\n     apply(rule Valid_interrupt_in_sol[where ss= \"ss(C := C_upd ent (ss C))\" and d=\"min (0.045 - ss T) (0.02 - C_upd ent (ss C))\" and p=\"\\<lambda> t. ss(T:= ss T + t, C:= C_upd ent (ss C) + t)\" and aa= \"Task RUNNING eone tp\" and P=\"\\<lambda>(a,s) t. inv_s' s \\<and> P (Task RUNNING ent tp, ss)  t\"])\n  subgoal apply auto unfolding T_def C_def by auto\n  subgoal \n    apply auto unfolding state2vec_def has_vderiv_on_def\n    apply clarify\n    apply (rule has_vector_derivative_projI)\n    apply auto\n    unfolding T_def C_def\n    apply auto\n    apply (rule has_vector_derivative_eq_rhs)\n      apply (fast intro!: derivative_intros)\n     apply auto\n      apply (rule has_vector_derivative_eq_rhs)\n      apply (fast intro!: derivative_intros)\n    by auto\n  subgoal by auto\n  subgoal unfolding T_def C_def\n     apply auto\n    apply(cases \"(9 / 200 - ss CHR ''t'') \\<le> (2 / 100 - C_upd ent (ss CHR ''c''))\")\n    by auto\n  subgoal\n    apply auto unfolding state2vec_def vec2state_def\n    apply (rule c1_implies_local_lipschitz[where f'=\"(\\<lambda>(t,v). Blinfun(\\<lambda>(v::vec) . \\<chi> x. 0))\"])\n       apply auto\n    unfolding has_derivative_def\n    apply auto\n    prefer 2\n     apply (rule vec_tendstoI)\n    subgoal\n    proof-\n    have b1:\"bounded_linear (\\<lambda> (v::vec). \\<chi> a . 0)\"\n      apply (rule bounded_linearI')\n      using vec_lambda_unique by fastforce+\n    then have b2:\"blinfun_apply (Blinfun (\\<lambda> (v::vec). \\<chi> x. 0)) = (\\<lambda>v. \\<chi> x. 0)\"\n      apply(rule bounded_linear_Blinfun_apply)\n      done\n    then have b3:\"bounded_linear (blinfun_apply (Blinfun (\\<lambda> (v::vec). \\<chi> x. 0)))\"\n      using b1 \n      by (simp add: blinfun.bounded_linear_right)\n    show ?thesis\n      by(auto simp add:b2)\n    qed\n    by (simp add: blinfun.bounded_linear_right)\n  apply clarify[1]\n       apply (simp add: T_def C_def)[1]\n       apply(rule Valid_basic_sp1)\n      prefer 2\n  subgoal unfolding entails_def\n    by auto\n     prefer 2\n     apply(rule Valid_weaken_pre)\n  prefer 2\n     apply(rule Valid_strengthen_post)\n       prefer 2\n       apply(rule Valid_interrupt_in_not[where ss= \"ss(C := C_upd ent (ss C))\" and p=\"\\<lambda> t. ss(T:= ss T + t, C:= C_upd ent (ss C) + t)\" and aa= \"Task RUNNING eone tp\" and P=\"\\<lambda>(a,s) t. inv_s' s \\<and> P (Task RUNNING ent tp, ss)  t\"])\n  subgoal by auto\n  unfolding T_def C_def \n  apply auto[1]\n       apply(rule Valid_basic_sp1)\n      prefer 2\n  subgoal unfolding entails_def by auto\n  subgoal \n    unfolding entails_def\n    apply (rule allI)+\n    apply(rule impI)\n    subgoal for s tr\n      apply(cases s)\n      subgoal for a sss\n        apply simp\n        apply(erule disjE)\n        subgoal apply(rule disjI1)\n          apply(rule exI[where x=0])\n          apply clarify\n          apply(rule conjI) subgoal by auto\n          apply(rule conjI) subgoal unfolding pure_assn_def join_assn_def conj_assn_def inv_s'_def T_def C_def by auto\n          apply(rule conjI) subgoal unfolding pure_assn_def join_assn_def conj_assn_def inv_s'_def T_def C_def by auto\n          subgoal for v\n            apply simp\n            apply(rule exI[where x=v])\n            unfolding pure_assn_def join_assn_def conj_assn_def inv_s'_def T_def C_def F_def by auto\n          done\n        subgoal apply(rule disjI2)\n          apply simp\n          apply(rule conjI) subgoal unfolding pure_assn_def join_assn_def conj_assn_def inv_s'_def T_def C_def F_def by auto\n          apply(rule conjI) subgoal unfolding pure_assn_def join_assn_def conj_assn_def inv_s'_def T_def C_def F_def by auto\n          unfolding pure_assn_def join_assn_def conj_assn_def inv_s'_def T_def C_def F_def \n          apply(subgoal_tac\"(min (9 / 200 - ss CHR ''t'') (2 / 100 - C_upd ent (ss CHR ''c''))) = 0\")\n          subgoal by (auto simp add: emp_assn_def)\n          by auto \n        done\n      done\n    done\n  subgoal \n    unfolding entails_def\n    apply (rule allI)+\n    apply(rule impI)\n    subgoal for s tr\n      apply(cases s)\n      subgoal for a sss\n        apply simp\n        apply(erule disjE)\n        subgoal apply(rule disjI1)\n          apply auto\n          subgoal for tt vv\n            apply(rule exI[where x=tt])\n            apply auto\n            apply(rule exI[where x=vv])\n            apply auto\n            unfolding pure_assn_def join_assn_def conj_assn_def inv_s'_def T_def C_def F_def\n            by auto\n          done\n        subgoal apply(rule disjI2)\n          unfolding pure_assn_def join_assn_def conj_assn_def inv_s'_def T_def C_def F_def\n          apply auto\n          subgoal\n           apply(cases \"(9 / 200 - ss CHR ''t'') \\<le>(2 / 100 - C_upd ent (ss CHR ''c''))\")\n            by auto\n          subgoal\n           apply(cases \"(9 / 200 - ss CHR ''t'') \\<le>(2 / 100 - C_upd ent (ss CHR ''c''))\")\n            by auto\n          done\n        done\n      done\n    done\n   apply(rule Valid_cond_sp)\n    apply simp\n    apply(rule Valid_echoice[where R=\"\\<lambda> s tr.(inv_s' (snd s) \\<and> s =\n          (Task WAIT eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) \\<and> \n                   ((P (Task RUNNING ent tp, ss)) @\\<^sub>t\n         Wait\\<^sub>t (min (0.045 - ss T) (0.02 - C_upd ent (ss C)))\n          (\\<lambda>\\<tau>. EState\n                (Task RUNNING eone tp, ss(T := ss T + \\<tau>, C := C_upd ent (ss C) + \\<tau>)))\n          ({}, {preempt_ch 2}) @\\<^sub>t\n             Outrdy\\<^sub>t (Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) (free_ch 2) 0 ({free_ch 2},{preempt_ch 2}))\n         tr)\n             \\<or> (\\<exists> v. (inv_s' (snd s) \\<and> s =\n          (Task WAIT eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)), F := v)) \\<and> \n                   ((P (Task RUNNING ent tp, ss)) @\\<^sub>t\n         Wait\\<^sub>t (min (0.045 - ss T) (0.02 - C_upd ent (ss C)))\n          (\\<lambda>\\<tau>. EState\n                (Task RUNNING eone tp, ss(T := ss T + \\<tau>, C := C_upd ent (ss C) + \\<tau>)))\n          ({}, {preempt_ch 2}) @\\<^sub>t\n             Inrdy\\<^sub>t (Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) (preempt_ch 2) v ({free_ch 2},{preempt_ch 2}))\n         tr))\"])\n  subgoal for i\n    apply(cases i)\n    subgoal\n      apply simp\n      apply(rule exI[where x = \"\\<lambda> s tr.(inv_s' (snd s) \\<and> s =\n          (Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) \\<and> \n                   ((P (Task RUNNING ent tp, ss)) @\\<^sub>t\n         Wait\\<^sub>t (min (0.045 - ss T) (0.02 - C_upd ent (ss C)))\n          (\\<lambda>\\<tau>. EState\n                (Task RUNNING eone tp, ss(T := ss T + \\<tau>, C := C_upd ent (ss C) + \\<tau>)))\n          ({}, {preempt_ch 2}) @\\<^sub>t\n             Outrdy\\<^sub>t (Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) (free_ch 2) 0 ({free_ch 2},{preempt_ch 2}))\n         tr)\"])\n      apply(rule conjI)\n      subgoal\n        apply(rule Valid_strengthen_post)\n         prefer 2\n         apply(rule Valid_basic_sp1)\n        unfolding entails_def\n        by auto\n      subgoal unfolding entails_def\n        apply (auto simp add:T_def C_def join_assn_def)\n        subgoal for tr1 tr2\n          apply(rule exI[where x= tr1])\n          apply auto\n          apply(rule exI[where x= tr2])\n          apply auto\n          apply rule\n          done\n        subgoal for d tr1 tr2\n          apply(rule exI[where x= tr1])\n          apply auto\n          apply(rule exI[where x= tr2])\n          apply auto\n          apply rule\n          by auto\n        done\n      done\n    subgoal for i'\n      apply simp\n      apply(rule exI[where x=\"\\<lambda> s tr.(\\<exists> v. (inv_s' (snd s) \\<and> s =\n          (Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)), F := v)) \\<and> \n                   ((P (Task RUNNING ent tp, ss)) @\\<^sub>t\n         Wait\\<^sub>t (min (0.045 - ss T) (0.02 - C_upd ent (ss C)))\n          (\\<lambda>\\<tau>. EState\n                (Task RUNNING eone tp, ss(T := ss T + \\<tau>, C := C_upd ent (ss C) + \\<tau>)))\n          ({}, {preempt_ch 2}) @\\<^sub>t\n             Inrdy\\<^sub>t (Task RUNNING eone tp, ss\n         (T := ss T + min (0.045 - ss T) (0.02 - C_upd ent (ss C)),\n          C := C_upd ent (ss C) +\n               min (0.045 - ss T) (0.02 - C_upd ent (ss C)))) (preempt_ch 2) v ({free_ch 2},{preempt_ch 2}))\n         tr))\"])\n      apply(rule conjI)\n      subgoal\n        apply(rule Valid_ex_pre)\n        subgoal for v\n          apply(rule Valid_strengthen_post)\n         prefer 2\n         apply(rule Valid_basic_sp1)\n        unfolding entails_def\n        by auto\n      done\n    subgoal unfolding entails_def\n      apply (auto simp add:T_def C_def F_def join_assn_def inv_s'_def)\n      subgoal for tr1 tr2 v\n        apply(rule exI[where x= v])\n        apply auto\n        apply(rule exI[where x= tr1])\n        apply auto\n        apply(rule exI[where x= tr2])\n        apply auto\n        apply rule\n        done\n      subgoal for d tr1 tr2 v\n        apply(rule exI[where x= v])\n        apply auto\n        apply(rule exI[where x= tr1])\n        apply auto\n        apply(rule exI[where x= tr2])\n        apply auto\n        apply rule\n        by auto\n      done\n    done\n  done\n  apply(rule Valid_skip)\n  apply(rule allI)+\n  apply(rule impI)\n  apply(erule disjE)\n  subgoal by auto\n  apply(erule disjE)\n  subgoal by auto\n  apply(erule disjE)\n  subgoal for s tr\n    by (auto simp add:T_def C_def )\n  subgoal for s tr\n    by auto\n  done\n  \n  \n\n\n         \nlemma Valid_T2_rep:\n  \"\\<Turnstile> {\\<lambda>s t. s = (Task st ent tp,ss) \\<and> inv_s' (snd s) \\<and> emp\\<^sub>t t}\n                      Rep T2\n      {\\<lambda>s t. inv_s' (snd s) \\<and> (\\<exists>n. (emp\\<^sub>t @\\<^sub>t T2_tr n (Task st ent tp,ss)) t)}\"\n  apply(rule Valid_rep')\n  subgoal for n p\n    apply(induction n arbitrary:p st ent tp ss)\n    subgoal for p\n      apply auto\n      apply(rule Valid_strengthen_post)\n       prefer 2\n       apply(rule Valid_skip)\n      unfolding entails_def by auto\n    subgoal premises pre for n p st ent tp ss\n      apply auto\n      apply(cases st)\n      subgoal\n        apply simp\n        apply(rule Valid_seq)\n         apply(rule T2_Valid_WAIT)\n        apply(rule Valid_strengthen_post)\n         prefer 2\n         apply(rule pre)\n        unfolding entails_def by (auto simp add:join_assoc)\n      subgoal\n        apply simp\n        apply(rule Valid_seq)\n         apply(rule T2_Valid_READY)\n        apply(rule Valid_pre_or)\n        subgoal\n          thm pre\n          apply auto\n          apply(rule Valid_weaken_pre[where P' = \"\\<lambda>s tr. \\<exists>tt v . s = (Task RUNNING ent tp, ss(T := ss T + tt, F := v)) \\<and> inv_s' (snd s) \\<and>\n               (((\\<up>(0 \\<le> tt \\<and> tt \\<le> 9 / 200 - ss T) \\<and>\\<^sub>t p @\\<^sub>t Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                         Waitin\\<^sub>t tt (\\<lambda>t. EState (Task READY ent tp, ss(T := ss T + t)))\n                          (run_ch 2) v ({}, {run_ch 2}))\n                         tr)\"])\n          subgoal unfolding entails_def\n            by(auto simp add: pure_assn_def conj_assn_def)\n          apply(rule Valid_ex_pre)+\n          apply(rule Valid_strengthen_post)\n           prefer 2\n           apply(rule pre)\n          unfolding entails_def\n          apply (auto simp add: join_disj_assn)\n          unfolding disj_assn_def\n          apply(rule disjI1)\n          apply(auto simp add: ex_assn_def pure_assn_def conj_assn_def join_assn_def)\n          subgoal for tt v b tr2 tr1b tr2a tr2b\n            apply(rule exI[where x=\"tr1b\"])\n            apply auto\n            apply(rule exI[where x=v])\n            apply(rule exI[where x=tt])\n            by auto\n          done\n        apply(rule Valid_pre_or)\n        subgoal\n        apply(rule Valid_weaken_pre[where P'=\"\\<lambda>s tr. \n                s = (Task WAIT ent tp, ss(T := 45 / 10 ^ 3)) \\<and> inv_s' (snd s) \\<and>\n               ((p @\\<^sub>t Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                Wait\\<^sub>t (9 / 200 - ss T)\n                 (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>))) ({}, {run_ch 2}) @\\<^sub>t\n                Outrdy\\<^sub>t ((Task READY ent tp, ss(T := 45 / 10 ^ 3))) (exit_ch 2) 0 ({exit_ch 2},{run_ch 2}))\n                tr\"])\n        subgoal unfolding entails_def by auto\n        apply(rule Valid_strengthen_post)\n           prefer 2\n           apply(rule pre)\n          unfolding entails_def\n          apply (auto simp add: join_disj_assn)\n          unfolding disj_assn_def\n          apply(rule disjI2)\n          by(auto simp add: join_assoc) \n        subgoal\n          apply(rule Valid_ex_pre)\n          subgoal for v\n          apply(rule Valid_weaken_pre[where P'=\"\\<lambda>s tr. \n                s = (Task RUNNING ent tp, ss(T := 45 / 10 ^ 3,F:=v)) \\<and> inv_s' (snd s) \\<and>\n               ((p @\\<^sub>t Out\\<^sub>t (EState (Task READY ent tp, ss)) (req_ch 2) tp) @\\<^sub>t\n                Wait\\<^sub>t (9 / 200 - ss T)\n                 (\\<lambda>\\<tau>. EState (Task READY ent tp, ss(T := ss T + \\<tau>))) ({}, {run_ch 2}) @\\<^sub>t\n                Inrdy\\<^sub>t ((Task READY ent tp, ss(T := 45 / 10 ^ 3))) (run_ch 2) v ({exit_ch 2},{run_ch 2}))\n                tr\"])\n        subgoal unfolding entails_def by auto\n        apply(rule Valid_strengthen_post)\n           prefer 2\n         apply(rule pre)\n          unfolding entails_def\n          apply (auto simp add: join_disj_assn ex_assn_def)\n          unfolding disj_assn_def\n          apply(rule disjI2)+\n          apply (auto simp add: join_assoc join_assn_def)\n          subgoal for b tr2 tr1b tr2b tr1c tr2c\n            apply(rule exI[where x= tr1b])\n            apply auto\n            apply(rule exI[where x= tr2b])\n            apply auto\n            apply(rule exI[where x= tr1c])\n            apply auto\n            done\n          done\n        done\n      done\n        subgoal\n          apply simp\n          apply(rule Valid_seq)\n           apply(rule T2_Valid_RUNNING)\n          apply(rule Valid_pre_or)\n        subgoal\n          thm pre\n          apply auto\n          apply(rule Valid_weaken_pre[where P' = \"\\<lambda>s tr. \\<exists>tt v . s = (Task READY eone tp, ss\n                         (CHR ''t'' := ss CHR ''t'' + tt,CHR ''c'' := C_upd ent (ss CHR ''c'') + tt, F := v)) \\<and> inv_s' (snd s) \\<and>\n               ((\\<up>(0 \\<le> tt \\<and> tt \\<le> 9 / 200 - ss T \\<and> tt \\<le> 2 / 100 - C_upd ent (ss C)) \n                       \\<and>\\<^sub>t p @\\<^sub>t Waitin\\<^sub>t tt\n                          (\\<lambda>t. EState\n                                (Task RUNNING eone tp, ss\n                                 (CHR ''t'' := ss CHR ''t'' + t,\n                                  CHR ''c'' := C_upd ent (ss CHR ''c'') + t)))\n                          (preempt_ch 2) v ({}, {preempt_ch 2}))\n                         tr)\"])\n          subgoal unfolding entails_def\n            by(auto simp add: pure_assn_def conj_assn_def)\n          apply(rule Valid_ex_pre)+\n          apply(rule Valid_strengthen_post)\n           prefer 2\n           apply(rule pre)\n          unfolding entails_def\n          apply (auto simp add: join_disj_assn)\n          unfolding disj_assn_def\n          apply(rule disjI1)\n          apply(auto simp add: ex_assn_def pure_assn_def conj_assn_def join_assn_def T_def C_def)\n          subgoal for tt v b tr1a tr2 tr2a\n            apply(rule exI[where x=\"tr1a\"])\n            by auto\n          done\n        apply(rule Valid_pre_or)\n        subgoal\n        apply(rule Valid_weaken_pre[where P'=\"\\<lambda>s tr. \n                s = (Task WAIT eone tp, ss\n                (T := ss T + min (45 / 10 ^ 3 - ss T) (2 / 10\\<^sup>2 - C_upd ent (ss C)),\n                 C := C_upd ent (ss C) +\n                      min (45 / 10 ^ 3 - ss T) (2 / 10\\<^sup>2 - C_upd ent (ss C)))) \\<and> inv_s' (snd s) \\<and>\n               ((p @\\<^sub>t Wait\\<^sub>t (min (45 / 10 ^ 3 - ss T) (2 / 10\\<^sup>2 - C_upd ent (ss C)))\n          (\\<lambda>\\<tau>. EState (Task RUNNING eone tp, ss(T := ss T + \\<tau>, C := C_upd ent (ss C) + \\<tau>))) ({}, {preempt_ch 2}) @\\<^sub>t\n         Outrdy\\<^sub>t ((Task RUNNING eone tp, ss(T := ss T + min (45 / 10 ^ 3 - ss T) (2 / 10\\<^sup>2 - C_upd ent (ss C)),\n              C := C_upd ent (ss C) + min (45 / 10 ^ 3 - ss T) (2 / 10\\<^sup>2 - C_upd ent (ss C)))))(free_ch 2) 0 ({free_ch 2}, {preempt_ch 2}))\n                tr)\"])\n        subgoal unfolding entails_def by auto\n        apply(rule Valid_strengthen_post)\n           prefer 2\n           apply(rule pre)\n          unfolding entails_def\n          apply (auto simp add: join_disj_assn)\n          unfolding disj_assn_def\n          apply(rule disjI2)\n          by(auto simp add: join_assoc) \n        subgoal\n          apply(rule Valid_ex_pre)\n          subgoal for v\n            apply(rule Valid_weaken_pre[where P'=\"\\<lambda>s tr. \n                s = (Task WAIT eone tp, ss\n                (T := ss T + min (45 / 10 ^ 3 - ss T) (2 / 10\\<^sup>2 - C_upd ent (ss C)),\n                 C := C_upd ent (ss C) +\n                      min (45 / 10 ^ 3 - ss T) (2 / 10\\<^sup>2 - C_upd ent (ss C)),F:=v)) \\<and> inv_s' (snd s) \\<and>\n               ((p @\\<^sub>t Wait\\<^sub>t (min (45 / 10 ^ 3 - ss T) (2 / 10\\<^sup>2 - C_upd ent (ss C)))\n          (\\<lambda>\\<tau>. EState (Task RUNNING eone tp, ss(T := ss T + \\<tau>, C := C_upd ent (ss C) + \\<tau>))) ({}, {preempt_ch 2}) @\\<^sub>t\n         Inrdy\\<^sub>t ((Task RUNNING eone tp, ss(T := ss T + min (45 / 10 ^ 3 - ss T) (2 / 10\\<^sup>2 - C_upd ent (ss C)),\n              C := C_upd ent (ss C) + min (45 / 10 ^ 3 - ss T) (2 / 10\\<^sup>2 - C_upd ent (ss C)))))(preempt_ch 2) v ({free_ch 2}, {preempt_ch 2}))\n                tr)\"])\n        subgoal unfolding entails_def by auto\n        apply(rule Valid_strengthen_post)\n           prefer 2\n           apply(rule pre)\n          unfolding entails_def\n          apply (auto simp add: join_disj_assn)\n          unfolding disj_assn_def\n          apply(rule disjI2)\n          apply(rule disjI2)\n          apply(auto simp add: join_assoc ex_assn_def join_assn_def) \n          subgoal for b tr1a tr2 tr1b tr2b\n            apply(rule exI[where x = tr1a])\n            apply auto\n            apply(rule exI[where x = tr1b])\n            by auto\n        done\n      done\n    done\n  done\n  done\n  done\n\n\n\nend", "meta": {"author": "AgHHL", "repo": "lics2023", "sha": "e2ea9c15a8c0e1bf658679274ee87f30baf4abc3", "save_path": "github-repos/isabelle/AgHHL-lics2023", "path": "github-repos/isabelle/AgHHL-lics2023/lics2023-e2ea9c15a8c0e1bf658679274ee87f30baf4abc3/case2/task2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6477982179521103, "lm_q2_score": 0.4649015713733885, "lm_q1q2_score": 0.3011624094588169}}
{"text": "theory Privacy_Notions_2 imports\nCryptHOL.CryptHOL\nbegin\n(*NB: the message type must have a size function avaliavle,  can make it more general than bitstrings atm but\nfor now we leave it like this. Do not think making it more general will effect the proofs.*)\n\n(*Atm we are assuming the batch queries are only (r_0,r_1) where r_0 and r_1 are both batches, not tuples of batches*)\n\nsledgehammer_params[timeout = 1000]\n\ntype_synonym ('sender', 'receiver', 'aux') communication = \"'sender' \\<times> 'receiver' \\<times> bool list \\<times> 'aux'\"\n\ntype_synonym ('sender', 'receiver', 'aux') batch = \"('sender', 'receiver', 'aux') communication list\"\n\ntype_synonym ('sender', 'receiver', 'aux', 'adversary_observations') protocol_model \n                = \"('sender', 'receiver', 'aux') batch \\<Rightarrow> 'adversary_observations'\"\n\ntype_synonym ('sender', 'receiver', 'aux') scenerio = \"('sender', 'receiver', 'aux') batch list\"\n\ntype_synonym ('sender', 'receiver', 'aux') challenge \n              = \"('sender', 'receiver', 'aux') scenerio \\<times> ('sender', 'receiver', 'aux') scenerio\"\n\nlocale simple_game = \n  fixes protocol_model :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> 'adversary_observations spmf\" \n    and checks_batch :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\"\n  assumes lossless_prot_model: \"\\<forall> batch. lossless_spmf (protocol_model batch)\" \nbegin\n\nprimrec simple_game :: \n          \"((('sender, 'receiver, 'aux) batch \\<times> ('sender, 'receiver, 'aux) batch) \\<times> 'state) spmf \n              \\<times> ('adversary_observations \\<Rightarrow> 'state \\<Rightarrow> bool spmf) \\<Rightarrow> bool spmf\"\n  where \"simple_game (\\<A>1, \\<A>2) = do {\n    b \\<leftarrow> coin_spmf;\n    ((r0,r1), \\<sigma>) \\<leftarrow> \\<A>1;\n    _ :: unit \\<leftarrow> assert_spmf (checks_batch r0 r1);\n    c \\<leftarrow> protocol_model (if b then r1 else r0);\n    b' \\<leftarrow> \\<A>2 c \\<sigma>;\n    return_spmf (b = b')}\"\n\ndefinition \"advantage \\<A> = spmf (simple_game \\<A>) True - 1/2\"\n\n(*primrec simple_game :: \n          \"('aux_info \\<Rightarrow> ((('sender, 'receiver, 'aux) batch \\<times> ('sender, 'receiver, 'aux) batch) \\<times> 'state) spmf )\n              \\<times> ('adversary_observations \\<Rightarrow> 'state \\<Rightarrow> bool spmf) \\<Rightarrow> 'aux_info  \\<Rightarrow> bool spmf\"\n  where \"simple_game (\\<A>1, \\<A>2) aux = do {\n    b \\<leftarrow> coin_spmf;\n    ((r0,r1), \\<sigma>) \\<leftarrow> \\<A>1 aux;\n    _ :: unit \\<leftarrow> assert_spmf (checks_batch r0 r1);\n    c \\<leftarrow> protocol_model (if b then r1 else r0);\n    b' \\<leftarrow> \\<A>2 c \\<sigma>;\n    return_spmf (b = b')}\"\n\ndefinition \"advantage \\<A> aux = spmf (simple_game \\<A> aux) True - 1/2\"*)\n\nend \n\nlocale reductions = simple_game protocol_model\n  for protocol_model :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> 'adversary_observations spmf\" +\n  assumes lossless_prot_model: \"\\<forall> batch. lossless_spmf (protocol_model batch)\" \nbegin\n\n\n(*TODO: look at the definitions of L_b and L_b', think they need changing slightly, think this may be okay*)\n\ndefinition user_messages :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> 'sender \\<Rightarrow> bool list set\"\n  where \"user_messages b u \\<equiv> {m. \\<exists> com \\<in> set b. fst com = u \\<and> fst (snd (snd com)) = m}\"\n\nlemma assumes \"b = [(s0,r0,m0,a0), (s1,r1,m1,a1)]\" and \"s0 \\<noteq> u2 \\<and> s1 \\<noteq> u2\"\n  shows \"user_messages b u2 = {}\"\n  by(auto simp add: user_messages_def assms)\n\ndefinition L_b :: \"('sender, 'receiver, 'aux) scenerio \\<Rightarrow> nat \\<Rightarrow> ('sender \\<times> bool list set) set\"\n  where \"L_b S i \\<equiv> {(user,M). \\<exists> com \\<in> set (nth S i). fst com = user \\<and> M = user_messages (nth S i) user}\"\n\nlemma assumes \"S = [[(s0,r0,m0,a0), (s1,r1,m1,a1)], [(s3,r3,m3,a3), (s4,r4,m4,a4)]]\"\n  and \"s0 \\<noteq> s1\"\n  shows \"L_b S 0 = {(s0,{m0}), (s1,{m1})}\"\n  apply(auto simp add: L_b_def assms user_messages_def)\n  using assms by auto \n\ndefinition receiver_messages :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> 'receiver \\<Rightarrow> bool list set\"\n  where \"receiver_messages b r \\<equiv> {m. \\<exists> com \\<in> set b. fst (snd com) = r \\<and> fst (snd (snd com)) = m}\"\n\ndefinition L_b' :: \"('sender, 'receiver, 'aux) scenerio \\<Rightarrow> nat \\<Rightarrow> ('receiver \\<times> bool list set) set\"\n  where \"L_b' S i \\<equiv> {(receiver,M). \\<exists> com \\<in> set (nth S i). fst (snd com) = receiver \n                       \\<and> M = receiver_messages (nth S i) receiver}\"\n\n(*definition L_b :: \"bool \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender \\<times> bool list set) set\"\n  where \"L_b b batch0 batch1 \\<equiv> {(s, M). \\<forall> m \\<in> M. \\<exists> batch \\<in> set (if b then batch1 else batch0). fst batch = s \\<and> fst (snd (snd batch)) = m}\"\n\ndefinition L_b' :: \"bool \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> ('receiver \\<times> bool list set) set\"\n  where \"L_b' b batch0 batch1 \\<equiv> {(s, M). \\<forall> m \\<in> M. \\<exists> batch \\<in> set (if b then batch1 else batch0). fst (snd batch) = s \\<and> fst (snd (snd batch)) = m}\"*)\n\ndefinition U_b :: \"('sender, 'receiver, 'aux) scenerio \\<Rightarrow> nat \\<Rightarrow> 'sender set\"\n  where \"U_b S i = {u. \\<forall> M. (u,M) \\<in> L_b S i}\"\n\ndefinition U_b' :: \"('sender, 'receiver, 'aux) scenerio \\<Rightarrow> nat \\<Rightarrow> 'receiver set\"\n  where \"U_b' S i = {u. \\<forall> M. (u,M) \\<in> L_b' S i}\"\n\ndefinition Q_b :: \"('sender, 'receiver, 'aux) scenerio \\<Rightarrow> nat \\<Rightarrow> ('sender \\<times> nat) set\"\n  where \"Q_b S i = {(u,n). \\<forall> M. (u,M) \\<in> L_b S i \\<and> (\\<forall> m \\<in> M. length m = n)}\"\n\ndefinition Q_b' :: \"('sender, 'receiver, 'aux) scenerio \\<Rightarrow> nat \\<Rightarrow> ('receiver \\<times> nat) set\"\n  where \"Q_b' S i = {(u,n). \\<forall> M. (u,M) \\<in> L_b' S i \\<and> (\\<forall> m \\<in> M. length m = n)}\"\n\ndefinition U :: \"('sender, 'receiver, 'aux) challenge \\<Rightarrow> nat \\<Rightarrow> bool\"\n  where \"U C k \\<equiv> (U_b (fst C) k  = U_b (snd C) k)\" \n\ndefinition U' :: \"('sender, 'receiver, 'aux) challenge \\<Rightarrow> nat \\<Rightarrow> bool\"\n  where \"U' C k \\<equiv> (U_b' (fst C) k  = U_b' (snd C) k)\" \n\ndefinition Q :: \"('sender, 'receiver, 'aux) challenge \\<Rightarrow> nat \\<Rightarrow> bool\"\n  where \"Q C k \\<equiv> (Q_b (fst C) k = Q_b (snd C) k)\"\n\ndefinition Q' :: \"('sender, 'receiver, 'aux) challenge \\<Rightarrow> nat \\<Rightarrow> bool\"\n  where \"Q' C k \\<equiv> (Q_b' (fst C) k = Q_b' (snd C) k)\"\n\ndefinition U_card :: \"('sender, 'receiver, 'aux) challenge \\<Rightarrow> nat \\<Rightarrow> bool\"\n  where \"U_card C k \\<equiv> (card (U_b (fst C) k) = card (U_b (snd C) k))\" \n\ndefinition U_card' :: \"('sender, 'receiver, 'aux) challenge \\<Rightarrow> nat \\<Rightarrow> bool\"\n  where \"U_card' C k \\<equiv> (card (U_b' (fst C) k) = card (U_b' (snd C) k))\" \n\ndefinition M_card :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\"\n  where \"M_card r0 r1 \\<equiv> (\\<forall> (s0,r0,m0,aux0) \\<in> List.list.set r0. \\<forall> (s1,r1,m1,aux1) \\<in> List.list.set r1. size m0 = size m1)\"\n\ndefinition ES :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"ES r0 r1 \\<equiv> (\\<forall> com0 \\<in> List.list.set r0. \\<forall> com1 \\<in> List.list.set r1. \n                                fst (snd com0) = fst (snd com1) \\<and> fst (snd (snd com0)) = fst (snd (snd com1)) \n                                  \\<and> snd (snd (snd com0)) = snd (snd (snd com1)))\"\n\ndefinition ER :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"ER r0 r1 = (\\<forall> com0 \\<in> List.list.set r0. \\<forall> com1 \\<in> List.list.set r1. \n                                fst com0 = fst com1 \\<and> fst (snd (snd com0)) = fst (snd (snd com1)) \n                                  \\<and> snd (snd (snd com0)) = snd (snd (snd com1)))\"\n\ndefinition EM :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"EM r0 r1 = (\\<forall> com0 \\<in> List.list.set r0. \\<forall> com1 \\<in> List.list.set r1. \n                                fst com0 = fst com1 \\<and> fst (snd com0) = fst (snd com1) \n                                  \\<and> snd (snd (snd com0)) = snd (snd (snd com1)))\"\n\ndefinition ESM :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"ESM r0 r1 = (\\<forall> (s0,r0,m0,aux0) \\<in> List.list.set r0. \\<forall> (s1,r1,m1,aux1) \\<in> List.list.set r1. r0 = r1 \\<and> aux0 = aux1)\"\n\ndefinition ERM :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"ERM r0 r1 = (\\<forall> com0 \\<in> List.list.set r0. \\<forall> com1 \\<in> List.list.set r1. \n                           fst com0 = fst com1 \\<and> snd (snd (snd com0)) = snd (snd (snd com1)))\"\n\ndefinition ESR :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"ESR r0 r1 \\<equiv> (\\<forall> com0 \\<in> List.list.set r0. \\<forall> com1 \\<in> List.list.set r1. \n                                  fst (snd (snd com0)) = fst (snd (snd com1)) \n                                  \\<and> snd (snd (snd com0)) = snd (snd (snd com1)))\"\n\ndefinition checks_batch_O where \"checks_batch_O r0 r1 = True\"\n\ndefinition  checks_batch_RO :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_RO r0 r1 = ER r0 r1\"\n\ndefinition  checks_batch_SO :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_SO r0 r1 = ES r0 r1\"\n\ndefinition  checks_batch_SO_cardU :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_SO_cardU r0 r1 = (ES r0 r1 \\<and> U_card r0 r1)\"\n\ndefinition  checks_batch_RO_cardU' :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_RO_cardU' r0 r1 = (ER r0 r1 \\<and> U_card' r0 r1)\"\n\ndefinition  checks_batch_SML :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_SML r0 r1 = (ES r0 r1 \\<and> Q r0 r1)\"\n\ndefinition  checks_batch_RML :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_RML r0 r1 = (ER r0 r1 \\<and> Q' r0 r1)\"\n\ndefinition  checks_batch_SFL :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_SFL r0 r1 = (ES r0 r1 \\<and> U r0 r1)\"\n\ndefinition  checks_batch_RFL :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_RFL r0 r1 = (ER r0 r1 \\<and> U' r0 r1)\"\n\ndefinition  checks_batch_SOMO :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_SOMO r0 r1 \\<equiv> (ESM r0 r1)\"\n\ndefinition  checks_batch_ROMO :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_ROMO r0 r1 \\<equiv> (ERM r0 r1)\"\n\ndefinition  checks_batch_SOMO_M :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_SOMO_M r0 r1 \\<equiv> (ESM r0 r1 \\<and> M_card r0 r1)\"\n\ndefinition  checks_batch_ROMO_M :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_ROMO_M r0 r1 \\<equiv> (ESM r0 r1 \\<and> M_card r0 r1)\"\n\ndefinition  checks_batch_SO_RO :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_SO_RO r0 r1 = ES r0 r1\"\n\ndefinition checks_batch_RO_brSO_U_cardbr :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_RO_brSO_U_cardbr r0 r1 = (U_card r0 r1)\"\n\ndefinition checks_batch_SO_brRO_U_card'br :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_SO_brRO_U_card'br r0 r1 = (U_card' r0 r1)\"\n\ndefinition checks_batch_SO_brRFLbr :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_SO_brRFLbr r0 r1 = (U' r0 r1)\"\n\ndefinition checks_batch_RO_brSFLbr :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_RO_brSFLbr r0 r1 = (U r0 r1)\"\n\ndefinition checks_batch_SO_brRMLbr :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_SO_brRMLbr r0 r1 = (Q' r0 r1)\"\n\ndefinition checks_batch_RO_brSMLbr :: \"('sender, 'receiver, 'aux) batch \\<Rightarrow> ('sender, 'receiver, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_RO_brSMLbr r0 r1 = (Q r0 r1)\"\n\nlemma Q_imp_U:\n  assumes \"Q batch0 batch1\" \n  shows \"U batch0 batch1\"\n  using assms by(simp add: Q_def U_def Q_b_def U_b_def; blast) \n\nsublocale O: simple_game protocol_model checks_batch_O\n  by(simp add: simple_game_axioms)\n\nsublocale RO: simple_game protocol_model checks_batch_RO\n  by(simp add: simple_game_axioms)\n\nsublocale SO: simple_game protocol_model checks_batch_SO\n  by(simp add: simple_game_axioms)\n\nsublocale SO_cardU: simple_game protocol_model checks_batch_SO_cardU\n  by(simp add: simple_game_axioms)\n\nsublocale SFL: simple_game protocol_model checks_batch_SFL\n  by(simp add: simple_game_axioms)\n\nsublocale SML: simple_game protocol_model checks_batch_SML\n  by(simp add: simple_game_axioms)\n\nsublocale SOMO_M: simple_game protocol_model checks_batch_SOMO_M\n  by(simp add: simple_game_axioms)\n\nsublocale SOMO: simple_game protocol_model checks_batch_SOMO\n  by(simp add: simple_game_axioms)\n\nsublocale RO_brSMLbr: simple_game protocol_model checks_batch_RO_brSMLbr\n  by(simp add: simple_game_axioms)\n\nsublocale SO_brRMLbr: simple_game protocol_model checks_batch_SO_brRMLbr\n  by(simp add: simple_game_axioms)\n\nsublocale RO_brSFLbr: simple_game protocol_model checks_batch_RO_brSFLbr\n  by(simp add: simple_game_axioms)\n\nsublocale SO_brRFLbr: simple_game protocol_model checks_batch_SO_brRFLbr\n  by(simp add: simple_game_axioms)\n\nsublocale SO_brRO_U_card'br: simple_game protocol_model checks_batch_SO_brRO_U_card'br\n  by(simp add: simple_game_axioms)\n\nsublocale RO_brSO_U_cardbr: simple_game protocol_model checks_batch_RO_brSO_U_cardbr\n  by(simp add: simple_game_axioms)\n\nlemma ESM_imp_L_b'_True_eq_False:\n  assumes \"(\\<forall> (s0,r0,m0,aux0) \\<in> List.list.set batch0. \\<forall> (s1,r1,m1,aux1) \\<in> List.list.set batch1. r0 = r1 \\<and> aux0 = aux1)\"\n  shows \"L_b' True batch0 batch1 = L_b' False batch0 batch1\"\n  using assms L_b'_def oops\nlemma ESM_imp_Q_b'_unfold:\n  assumes \"(\\<forall> (s0,r0,m0,aux0) \\<in> List.list.set batch0. \\<forall> (s1,r1,m1,aux1) \\<in> List.list.set batch1. r0 = r1 \\<and> aux0 = aux1)\"\n  shows \"Q_b' True batch0 batch1 = Q_b' False batch0 batch1\"\n  using ESM_imp_L_b'_True_eq_False Q_b'_def assms by simp\n(*proof\n  show \"Q_b' True batch0 batch1 \\<subseteq> Q_b' False batch0 batch1\"\n  proof\n    fix x \n    assume asm: \"x \\<in> Q_b' True batch0 batch1\"\n    then obtain u M where uM: \"(u,M) = x\" \n      using Q_b'_def by auto\n    hence \"(u,M) \\<in> Q_b' True batch0 batch1\" \n      using asm by simp\n    hence \"(u,M) \\<in> {(u,n). \\<exists> M. (u,M) \\<in> L_b' True batch0 batch1 \\<and> card M = n}\"\n      using Q_b'_def by simp\n    hence \"(u,M) \\<in> {(u,n). \\<exists> M. (u,M) \\<in> L_b' False batch0 batch1 \\<and> card M = n}\"\n      using ESM_imp_L_b'_True_eq_False assms by simp\n    thus \"x \\<in> Q_b' False batch0 batch1\" \n      by (simp add: uM Q_b'_def)\n  qed\nnext \n  show \"Q_b' False batch0 batch1 \\<subseteq> Q_b' True batch0 batch1\"\n    sorry\nqed*)\n\nlemma Q'_imp_ESM: assumes \"ESM r0 r1\" shows \"Q' r0 r1\"\nusing ESM_imp_Q_b'_unfold assms ESM_def Q'_def by simp\n\nlemma SO_brRMLbr_imp_SOMO: shows \"SOMO.advantage \\<A> \\<le> SO_brRMLbr.advantage \\<A>\"\nproof-\n  have \"spmf (SO_brRMLbr.simple_game \\<A>) True \\<ge> spmf (SOMO.simple_game \\<A>) True\"\n    apply(simp add: SOMO.simple_game_def SO_brRMLbr.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: checks_batch_SOMO_def checks_batch_SO_brRMLbr_def assert_spmf_def Q'_imp_ESM)\n  thus ?thesis by (simp add: SOMO.advantage_def SO_brRMLbr.advantage_def)\nqed\n\nlemma SOMO_imp_SOMO_M: shows \"SOMO.advantage \\<A> \\<ge> SOMO_M.advantage \\<A>\"\nproof-\n  have \"spmf (SOMO_M.simple_game \\<A>) True \\<le> spmf (SOMO.simple_game \\<A>) True\"\n    apply(simp add: SOMO.simple_game_def SOMO_M.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: assert_spmf_def checks_batch_SOMO_def checks_batch_SOMO_M_def ESM_def ES_def M_card_def)\n  thus ?thesis by (simp add: SOMO.advantage_def SOMO_M.advantage_def)\nqed\n\nlemma SOMO_M_imp_SO: shows \"SO.advantage \\<A> \\<le> SOMO_M.advantage \\<A>\"\nproof-\n  have \"spmf (SOMO_M.simple_game \\<A>) True \\<ge> spmf (SO.simple_game \\<A>) True\"\n    apply(simp add: SO.simple_game_def SOMO_M.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: assert_spmf_def checks_batch_SO_def checks_batch_SOMO_M_def ESM_def ES_def M_card_def)\n  thus ?thesis by (simp add: SO.advantage_def SOMO_M.advantage_def)\nqed\n\nlemma SO_imp_SO_cardU: shows \"SO_cardU.advantage \\<A> \\<le> SO.advantage \\<A>\"\nproof-\n  have \"spmf (SO.simple_game \\<A>) True \\<ge> spmf (SO_cardU.simple_game \\<A>) True\"\n    apply(simp add: SO.simple_game_def SO_cardU.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: assert_spmf_def checks_batch_SO_def checks_batch_SO_cardU_def)\n  thus ?thesis by (simp add: SO.advantage_def SO_cardU.advantage_def)\nqed\n\nlemma SO_cardU_imp_SFL: shows \"SO_cardU.advantage \\<A> \\<ge> SFL.advantage \\<A>\"\nproof-\n  have \"spmf (SFL.simple_game \\<A>) True \\<le> spmf (SO_cardU.simple_game \\<A>) True\"\n    apply(simp add: SFL.simple_game_def SO_cardU.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: assert_spmf_def checks_batch_SFL_def checks_batch_SO_cardU_def U_card_def U_def)\n  thus ?thesis by (simp add: SFL.advantage_def SO_cardU.advantage_def)\nqed\n\nlemma SFL_imp_SML: shows \"SML.advantage \\<A> \\<le> SFL.advantage \\<A>\"\nproof-\n  have \"spmf (SFL.simple_game \\<A>) True \\<ge> spmf (SML.simple_game \\<A>) True\"\n    apply(simp add: SFL.simple_game_def SML.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: assert_spmf_def checks_batch_SFL_def checks_batch_SML_def Q_def U_def U_b_def Q_b_def)\n  thus ?thesis by (simp add: SFL.advantage_def SML.advantage_def)\nqed\n\nlemma O_imp_RO: shows \"O.advantage \\<A> \\<ge> RO.advantage \\<A>\"\nproof-\n  have \"spmf (O.simple_game \\<A>) True \\<ge> spmf (RO.simple_game \\<A>) True\"\n    apply(simp add: O.simple_game_def RO.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: assert_spmf_def  lossless_prot_model checks_batch_RO_def checks_batch_O_def)\n  thus ?thesis by (simp add: O.advantage_def RO.advantage_def)\nqed\n\nlemma O_imp_SO_brRO_U_card'br: shows \"O.advantage \\<A> \\<ge> SO_brRO_U_card'br.advantage \\<A>\"\nproof-\n  have \"spmf (O.simple_game \\<A>) True \\<ge> spmf (SO_brRO_U_card'br.simple_game \\<A>) True\"\n    apply(simp add: O.simple_game_def SO_brRO_U_card'br.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: assert_spmf_def  lossless_prot_model checks_batch_RO_def checks_batch_O_def)\n  thus ?thesis by (simp add: O.advantage_def SO_brRO_U_card'br.advantage_def)\nqed\n\nlemma SO_brRO_U_card'br_imp_SO_brRFLbr: shows \"SO_brRFLbr.advantage \\<A> \\<le> SO_brRO_U_card'br.advantage \\<A>\"\nproof-\n  have \"spmf (SO_brRFLbr.simple_game \\<A>) True \\<le> spmf (SO_brRO_U_card'br.simple_game \\<A>) True\"\n    apply(simp add: SO_brRFLbr.simple_game_def SO_brRO_U_card'br.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: assert_spmf_def  checks_batch_SO_brRO_U_card'br_def checks_batch_SO_brRFLbr_def U'_def U_card'_def)\n  thus ?thesis by (simp add: SO_brRFLbr.advantage_def SO_brRO_U_card'br.advantage_def)\nqed\n\nlemma SO_brRFLbr_imp_SO_brRMLbr: shows \"SO_brRFLbr.advantage \\<A> \\<ge> SO_brRMLbr.advantage \\<A>\"\nproof-\n  have \"spmf (SO_brRFLbr.simple_game \\<A>) True \\<ge> spmf (SO_brRMLbr.simple_game \\<A>) True\"\n    apply(simp add: SO_brRFLbr.simple_game_def SO_brRMLbr.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: assert_spmf_def checks_batch_SO_brRMLbr_def checks_batch_SO_brRFLbr_def U_b'_def U'_def Q'_def Q_b'_def)\n  thus ?thesis by (simp add: SO_brRFLbr.advantage_def SO_brRMLbr.advantage_def)\nqed\n\nlemma O_imp_SO: shows \"O.advantage \\<A> \\<ge> SO.advantage \\<A>\"\nproof-\n  have \"spmf (O.simple_game \\<A>) True \\<ge> spmf (SO.simple_game \\<A>) True\"\n    apply(simp add: O.simple_game_def SO.simple_game_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(auto simp add: assert_spmf_def  lossless_prot_model checks_batch_SO_def checks_batch_O_def)\n  thus ?thesis by (simp add: O.advantage_def SO.advantage_def)\nqed\n\nend \n\nlocale simple_game_O =\n  fixes protocol_model :: \"('sender, 'receiver, bool list, 'aux) batch \\<Rightarrow> 'adversary_observations spmf\" \nbegin\n\n(*test proof, not in proper locale form. Have not worked out which is best yet*)\n\nfun checks_batch_O where \"checks_batch_O r0 r1 = True\"\n\nfun  checks_batch_RO :: \"('sender, 'receiver, bool list, 'aux) batch \\<Rightarrow> ('sender, 'receiver, bool list, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch_RO r0 r1 = (\\<forall> com0 \\<in> List.list.set r0. \\<forall> com1 \\<in> List.list.set r1. \n                                fst com0 = fst com1 \\<and> fst (snd (snd com0)) = fst (snd (snd com1)) \n                                  \\<and> snd (snd (snd com0)) = snd (snd (snd com1)))\"\n\nprimrec simple_game_O :: \n          \"((('sender, 'receiver, bool list, 'aux) batch \\<times> ('sender, 'receiver, bool list, 'aux) batch) \\<times> 'state) spmf \n              \\<times> ('adversary_observations \\<Rightarrow> 'state \\<Rightarrow> bool spmf) \\<Rightarrow> bool spmf\"\n  where \"simple_game_O (\\<A>1, \\<A>2) = do {\n    b \\<leftarrow> coin_spmf;\n    ((r0,r1), \\<sigma>) \\<leftarrow> \\<A>1;\n    _ :: unit \\<leftarrow> assert_spmf (checks_batch_O r0 r1);\n    c \\<leftarrow> protocol_model (if b then r1 else r0);\n    b' \\<leftarrow> \\<A>2 c \\<sigma>;\n    return_spmf (b = b')}\"\n\nprimrec simple_game_RO :: \n          \"((('sender, 'receiver, bool list, 'aux) batch \\<times> ('sender, 'receiver, bool list, 'aux) batch) \\<times> 'state) spmf \n              \\<times> ('adversary_observations \\<Rightarrow> 'state \\<Rightarrow> bool spmf) \\<Rightarrow> bool spmf\"\n  where \"simple_game_RO (\\<A>1, \\<A>2) = do {\n    b \\<leftarrow> coin_spmf;\n    ((r0,r1), \\<sigma>) \\<leftarrow> \\<A>1;\n    _ :: unit \\<leftarrow> assert_spmf (checks_batch_RO r0 r1);\n    c \\<leftarrow> protocol_model (if b then r1 else r0);\n    b' \\<leftarrow> \\<A>2 c \\<sigma>;\n    return_spmf (b = b')}\"\n\ndefinition \"advantage_O \\<A> = spmf (simple_game_O \\<A>) True - 1/2\"\n\ndefinition \"advantage_RO \\<A> = spmf (simple_game_RO \\<A>) True - 1/2\"\n\nlemma \n  assumes \"spmf (simple_game_O \\<A>) True \\<ge> 1/2\" \n    and \"spmf (simple_game_RO \\<A>) True > 1/2\"\n  shows \n    \"advantage_O \\<A> \\<ge> advantage_RO \\<A>\"\nproof-\n  have \"spmf (simple_game_O \\<A>) True \\<ge> spmf (simple_game_RO \\<A>) True\"\n    apply(simp add: simple_game_O_def simple_game_RO_def split_def)\n    apply(rule ord_spmf_eq_leD)\n    apply(rule ord_spmf_bind_reflI;clarsimp)+\n    by(simp add: assert_spmf_def)\n  thus ?thesis \n    using assms by (simp add: simple_game_O.advantage_O_def simple_game_O.advantage_RO_def)\nqed\n\n\nend \n\nlocale simple_game_RO =\n  fixes protocol_model :: \"('sender, 'receiver, bool list, 'aux) batch \\<Rightarrow> 'adversary_observations spmf\" \nbegin\n(*everything same except receivers is the same*)\n\nlemma \n  \"fst (a1,a2,a3,a4) = a1\" \n  \"fst (snd (a1,a2,a3,a4)) = a2\"\n  \"fst (snd (snd (a1,a2,a3,a4))) = a3\" \n  \"snd (snd (snd (a1,a2,a3,a4))) = a4\" \n  by auto\n\nfun  checks_batch :: \"('sender, 'receiver, bool list, 'aux) batch \\<Rightarrow> ('sender, 'receiver, bool list, 'aux) batch \\<Rightarrow> bool\" \n  where \"checks_batch r0 r1 = (\\<forall> com0 \\<in> List.list.set r0. \\<forall> com1 \\<in> List.list.set r1. \n                                fst com0 = fst com1 \\<and> fst (snd (snd com0)) = fst (snd (snd com1)) \n                                  \\<and> snd (snd (snd com0)) = snd (snd (snd com1)))\"\n\nsublocale simple_game_R0: simple_game protocol_model checks_batch .\n\n\n", "meta": {"author": "Davetbutler", "repo": "Privacy-ID", "sha": "a9d67b9ef02dea9ae51e5c6de8630666c4d0a148", "save_path": "github-repos/isabelle/Davetbutler-Privacy-ID", "path": "github-repos/isabelle/Davetbutler-Privacy-ID/Privacy-ID-a9d67b9ef02dea9ae51e5c6de8630666c4d0a148/Privacy_Formalisation/Privacy_Notions_2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6370307806984444, "lm_q2_score": 0.4726834766204328, "lm_q1q2_score": 0.30111392413476923}}
{"text": "(*  Title:      HOL/HOLCF/ex/Pattern_Match.thy\n    Author:     Brian Huffman\n*)\n\nsection {* An experimental pattern-matching notation *}\n\ntheory Pattern_Match\nimports HOLCF\nbegin\n\ndefault_sort pcpo\n\ntext {* FIXME: Find a proper way to un-hide constants. *}\n\nabbreviation fail :: \"'a match\"\nwhere \"fail \\<equiv> Fixrec.fail\"\n\nabbreviation succeed :: \"'a \\<rightarrow> 'a match\"\nwhere \"succeed \\<equiv> Fixrec.succeed\"\n\nabbreviation run :: \"'a match \\<rightarrow> 'a\"\nwhere \"run \\<equiv> Fixrec.run\"\n\nsubsection {* Fatbar combinator *}\n\ndefinition\n  fatbar :: \"('a \\<rightarrow> 'b match) \\<rightarrow> ('a \\<rightarrow> 'b match) \\<rightarrow> ('a \\<rightarrow> 'b match)\" where\n  \"fatbar = (\\<Lambda> a b x. a\\<cdot>x +++ b\\<cdot>x)\"\n\nabbreviation\n  fatbar_syn :: \"['a \\<rightarrow> 'b match, 'a \\<rightarrow> 'b match] \\<Rightarrow> 'a \\<rightarrow> 'b match\" (infixr \"\\<parallel>\" 60)  where\n  \"m1 \\<parallel> m2 == fatbar\\<cdot>m1\\<cdot>m2\"\n\nlemma fatbar1: \"m\\<cdot>x = \\<bottom> \\<Longrightarrow> (m \\<parallel> ms)\\<cdot>x = \\<bottom>\"\nby (simp add: fatbar_def)\n\nlemma fatbar2: \"m\\<cdot>x = fail \\<Longrightarrow> (m \\<parallel> ms)\\<cdot>x = ms\\<cdot>x\"\nby (simp add: fatbar_def)\n\nlemma fatbar3: \"m\\<cdot>x = succeed\\<cdot>y \\<Longrightarrow> (m \\<parallel> ms)\\<cdot>x = succeed\\<cdot>y\"\nby (simp add: fatbar_def)\n\nlemmas fatbar_simps = fatbar1 fatbar2 fatbar3\n\nlemma run_fatbar1: \"m\\<cdot>x = \\<bottom> \\<Longrightarrow> run\\<cdot>((m \\<parallel> ms)\\<cdot>x) = \\<bottom>\"\nby (simp add: fatbar_def)\n\nlemma run_fatbar2: \"m\\<cdot>x = fail \\<Longrightarrow> run\\<cdot>((m \\<parallel> ms)\\<cdot>x) = run\\<cdot>(ms\\<cdot>x)\"\nby (simp add: fatbar_def)\n\nlemma run_fatbar3: \"m\\<cdot>x = succeed\\<cdot>y \\<Longrightarrow> run\\<cdot>((m \\<parallel> ms)\\<cdot>x) = y\"\nby (simp add: fatbar_def)\n\nlemmas run_fatbar_simps [simp] = run_fatbar1 run_fatbar2 run_fatbar3\n\nsubsection {* Bind operator for match monad *}\n\ndefinition match_bind :: \"'a match \\<rightarrow> ('a \\<rightarrow> 'b match) \\<rightarrow> 'b match\" where\n  \"match_bind = (\\<Lambda> m k. sscase\\<cdot>(\\<Lambda> _. fail)\\<cdot>(fup\\<cdot>k)\\<cdot>(Rep_match m))\"\n\nlemma match_bind_simps [simp]:\n  \"match_bind\\<cdot>\\<bottom>\\<cdot>k = \\<bottom>\"\n  \"match_bind\\<cdot>fail\\<cdot>k = fail\"\n  \"match_bind\\<cdot>(succeed\\<cdot>x)\\<cdot>k = k\\<cdot>x\"\nunfolding match_bind_def fail_def succeed_def\nby (simp_all add: cont_Rep_match cont_Abs_match\n  Rep_match_strict Abs_match_inverse)\n\nsubsection {* Case branch combinator *}\n\ndefinition\n  branch :: \"('a \\<rightarrow> 'b match) \\<Rightarrow> ('b \\<rightarrow> 'c) \\<rightarrow> ('a \\<rightarrow> 'c match)\" where\n  \"branch p \\<equiv> \\<Lambda> r x. match_bind\\<cdot>(p\\<cdot>x)\\<cdot>(\\<Lambda> y. succeed\\<cdot>(r\\<cdot>y))\"\n\nlemma branch_simps:\n  \"p\\<cdot>x = \\<bottom> \\<Longrightarrow> branch p\\<cdot>r\\<cdot>x = \\<bottom>\"\n  \"p\\<cdot>x = fail \\<Longrightarrow> branch p\\<cdot>r\\<cdot>x = fail\"\n  \"p\\<cdot>x = succeed\\<cdot>y \\<Longrightarrow> branch p\\<cdot>r\\<cdot>x = succeed\\<cdot>(r\\<cdot>y)\"\nby (simp_all add: branch_def)\n\nlemma branch_succeed [simp]: \"branch succeed\\<cdot>r\\<cdot>x = succeed\\<cdot>(r\\<cdot>x)\"\nby (simp add: branch_def)\n\nsubsection {* Cases operator *}\n\ndefinition\n  cases :: \"'a match \\<rightarrow> 'a::pcpo\" where\n  \"cases = Fixrec.run\"\n\ntext {* rewrite rules for cases *}\n\nlemma cases_strict [simp]: \"cases\\<cdot>\\<bottom> = \\<bottom>\"\nby (simp add: cases_def)\n\nlemma cases_fail [simp]: \"cases\\<cdot>fail = \\<bottom>\"\nby (simp add: cases_def)\n\nlemma cases_succeed [simp]: \"cases\\<cdot>(succeed\\<cdot>x) = x\"\nby (simp add: cases_def)\n\nsubsection {* Case syntax *}\n\nnonterminal Case_pat and Case_syn and Cases_syn\n\nsyntax\n  \"_Case_syntax\":: \"['a, Cases_syn] => 'b\"               (\"(Case _ of/ _)\" 10)\n  \"_Case1\"      :: \"[Case_pat, 'b] => Case_syn\"          (\"(2_ =>/ _)\" 10)\n  \"\"            :: \"Case_syn => Cases_syn\"               (\"_\")\n  \"_Case2\"      :: \"[Case_syn, Cases_syn] => Cases_syn\"  (\"_/ | _\")\n  \"_strip_positions\" :: \"'a => Case_pat\"                 (\"_\")\n\nsyntax (xsymbols)\n  \"_Case1\"      :: \"[Case_pat, 'b] => Case_syn\"          (\"(2_ \\<Rightarrow>/ _)\" 10)\n\ntranslations\n  \"_Case_syntax x ms\" == \"CONST cases\\<cdot>(ms\\<cdot>x)\"\n  \"_Case2 m ms\" == \"m \\<parallel> ms\"\n\ntext {* Parsing Case expressions *}\n\nsyntax\n  \"_pat\" :: \"'a\"\n  \"_variable\" :: \"'a\"\n  \"_noargs\" :: \"'a\"\n\ntranslations\n  \"_Case1 p r\" => \"CONST branch (_pat p)\\<cdot>(_variable p r)\"\n  \"_variable (_args x y) r\" => \"CONST csplit\\<cdot>(_variable x (_variable y r))\"\n  \"_variable _noargs r\" => \"CONST unit_when\\<cdot>r\"\n\nparse_translation {*\n(* rewrite (_pat x) => (succeed) *)\n(* rewrite (_variable x t) => (Abs_cfun (%x. t)) *)\n [(@{syntax_const \"_pat\"}, fn _ => fn _ => Syntax.const @{const_syntax Fixrec.succeed}),\n  Syntax_Trans.mk_binder_tr (@{syntax_const \"_variable\"}, @{const_syntax Abs_cfun})];\n*}\n\ntext {* Printing Case expressions *}\n\nsyntax\n  \"_match\" :: \"'a\"\n\nprint_translation {*\n  let\n    fun dest_LAM (Const (@{const_syntax Rep_cfun},_) $ Const (@{const_syntax unit_when},_) $ t) =\n          (Syntax.const @{syntax_const \"_noargs\"}, t)\n    |   dest_LAM (Const (@{const_syntax Rep_cfun},_) $ Const (@{const_syntax csplit},_) $ t) =\n          let\n            val (v1, t1) = dest_LAM t;\n            val (v2, t2) = dest_LAM t1;\n          in (Syntax.const @{syntax_const \"_args\"} $ v1 $ v2, t2) end\n    |   dest_LAM (Const (@{const_syntax Abs_cfun},_) $ t) =\n          let\n            val abs =\n              case t of Abs abs => abs\n                | _ => (\"x\", dummyT, incr_boundvars 1 t $ Bound 0);\n            val (x, t') = Syntax_Trans.atomic_abs_tr' abs;\n          in (Syntax.const @{syntax_const \"_variable\"} $ x, t') end\n    |   dest_LAM _ = raise Match; (* too few vars: abort translation *)\n\n    fun Case1_tr' [Const(@{const_syntax branch},_) $ p, r] =\n          let val (v, t) = dest_LAM r in\n            Syntax.const @{syntax_const \"_Case1\"} $\n              (Syntax.const @{syntax_const \"_match\"} $ p $ v) $ t\n          end;\n\n  in [(@{const_syntax Rep_cfun}, K Case1_tr')] end;\n*}\n\ntranslations\n  \"x\" <= \"_match (CONST succeed) (_variable x)\"\n\n\nsubsection {* Pattern combinators for data constructors *}\n\ntype_synonym ('a, 'b) pat = \"'a \\<rightarrow> 'b match\"\n\ndefinition\n  cpair_pat :: \"('a, 'c) pat \\<Rightarrow> ('b, 'd) pat \\<Rightarrow> ('a \\<times> 'b, 'c \\<times> 'd) pat\" where\n  \"cpair_pat p1 p2 = (\\<Lambda>(x, y).\n    match_bind\\<cdot>(p1\\<cdot>x)\\<cdot>(\\<Lambda> a. match_bind\\<cdot>(p2\\<cdot>y)\\<cdot>(\\<Lambda> b. succeed\\<cdot>(a, b))))\"\n\ndefinition\n  spair_pat ::\n  \"('a, 'c) pat \\<Rightarrow> ('b, 'd) pat \\<Rightarrow> ('a::pcpo \\<otimes> 'b::pcpo, 'c \\<times> 'd) pat\" where\n  \"spair_pat p1 p2 = (\\<Lambda>(:x, y:). cpair_pat p1 p2\\<cdot>(x, y))\"\n\ndefinition\n  sinl_pat :: \"('a, 'c) pat \\<Rightarrow> ('a::pcpo \\<oplus> 'b::pcpo, 'c) pat\" where\n  \"sinl_pat p = sscase\\<cdot>p\\<cdot>(\\<Lambda> x. fail)\"\n\ndefinition\n  sinr_pat :: \"('b, 'c) pat \\<Rightarrow> ('a::pcpo \\<oplus> 'b::pcpo, 'c) pat\" where\n  \"sinr_pat p = sscase\\<cdot>(\\<Lambda> x. fail)\\<cdot>p\"\n\ndefinition\n  up_pat :: \"('a, 'b) pat \\<Rightarrow> ('a u, 'b) pat\" where\n  \"up_pat p = fup\\<cdot>p\"\n\ndefinition\n  TT_pat :: \"(tr, unit) pat\" where\n  \"TT_pat = (\\<Lambda> b. If b then succeed\\<cdot>() else fail)\"\n\ndefinition\n  FF_pat :: \"(tr, unit) pat\" where\n  \"FF_pat = (\\<Lambda> b. If b then fail else succeed\\<cdot>())\"\n\ndefinition\n  ONE_pat :: \"(one, unit) pat\" where\n  \"ONE_pat = (\\<Lambda> ONE. succeed\\<cdot>())\"\n\ntext {* Parse translations (patterns) *}\ntranslations\n  \"_pat (XCONST Pair x y)\" => \"CONST cpair_pat (_pat x) (_pat y)\"\n  \"_pat (XCONST spair\\<cdot>x\\<cdot>y)\" => \"CONST spair_pat (_pat x) (_pat y)\"\n  \"_pat (XCONST sinl\\<cdot>x)\" => \"CONST sinl_pat (_pat x)\"\n  \"_pat (XCONST sinr\\<cdot>x)\" => \"CONST sinr_pat (_pat x)\"\n  \"_pat (XCONST up\\<cdot>x)\" => \"CONST up_pat (_pat x)\"\n  \"_pat (XCONST TT)\" => \"CONST TT_pat\"\n  \"_pat (XCONST FF)\" => \"CONST FF_pat\"\n  \"_pat (XCONST ONE)\" => \"CONST ONE_pat\"\n\ntext {* CONST version is also needed for constructors with special syntax *}\ntranslations\n  \"_pat (CONST Pair x y)\" => \"CONST cpair_pat (_pat x) (_pat y)\"\n  \"_pat (CONST spair\\<cdot>x\\<cdot>y)\" => \"CONST spair_pat (_pat x) (_pat y)\"\n\ntext {* Parse translations (variables) *}\ntranslations\n  \"_variable (XCONST Pair x y) r\" => \"_variable (_args x y) r\"\n  \"_variable (XCONST spair\\<cdot>x\\<cdot>y) r\" => \"_variable (_args x y) r\"\n  \"_variable (XCONST sinl\\<cdot>x) r\" => \"_variable x r\"\n  \"_variable (XCONST sinr\\<cdot>x) r\" => \"_variable x r\"\n  \"_variable (XCONST up\\<cdot>x) r\" => \"_variable x r\"\n  \"_variable (XCONST TT) r\" => \"_variable _noargs r\"\n  \"_variable (XCONST FF) r\" => \"_variable _noargs r\"\n  \"_variable (XCONST ONE) r\" => \"_variable _noargs r\"\n\ntranslations\n  \"_variable (CONST Pair x y) r\" => \"_variable (_args x y) r\"\n  \"_variable (CONST spair\\<cdot>x\\<cdot>y) r\" => \"_variable (_args x y) r\"\n\ntext {* Print translations *}\ntranslations\n  \"CONST Pair (_match p1 v1) (_match p2 v2)\"\n      <= \"_match (CONST cpair_pat p1 p2) (_args v1 v2)\"\n  \"CONST spair\\<cdot>(_match p1 v1)\\<cdot>(_match p2 v2)\"\n      <= \"_match (CONST spair_pat p1 p2) (_args v1 v2)\"\n  \"CONST sinl\\<cdot>(_match p1 v1)\" <= \"_match (CONST sinl_pat p1) v1\"\n  \"CONST sinr\\<cdot>(_match p1 v1)\" <= \"_match (CONST sinr_pat p1) v1\"\n  \"CONST up\\<cdot>(_match p1 v1)\" <= \"_match (CONST up_pat p1) v1\"\n  \"CONST TT\" <= \"_match (CONST TT_pat) _noargs\"\n  \"CONST FF\" <= \"_match (CONST FF_pat) _noargs\"\n  \"CONST ONE\" <= \"_match (CONST ONE_pat) _noargs\"\n\nlemma cpair_pat1:\n  \"branch p\\<cdot>r\\<cdot>x = \\<bottom> \\<Longrightarrow> branch (cpair_pat p q)\\<cdot>(csplit\\<cdot>r)\\<cdot>(x, y) = \\<bottom>\"\napply (simp add: branch_def cpair_pat_def)\napply (cases \"p\\<cdot>x\", simp_all)\ndone\n\nlemma cpair_pat2:\n  \"branch p\\<cdot>r\\<cdot>x = fail \\<Longrightarrow> branch (cpair_pat p q)\\<cdot>(csplit\\<cdot>r)\\<cdot>(x, y) = fail\"\napply (simp add: branch_def cpair_pat_def)\napply (cases \"p\\<cdot>x\", simp_all)\ndone\n\nlemma cpair_pat3:\n  \"branch p\\<cdot>r\\<cdot>x = succeed\\<cdot>s \\<Longrightarrow>\n   branch (cpair_pat p q)\\<cdot>(csplit\\<cdot>r)\\<cdot>(x, y) = branch q\\<cdot>s\\<cdot>y\"\napply (simp add: branch_def cpair_pat_def)\napply (cases \"p\\<cdot>x\", simp_all)\napply (cases \"q\\<cdot>y\", simp_all)\ndone\n\nlemmas cpair_pat [simp] =\n  cpair_pat1 cpair_pat2 cpair_pat3\n\nlemma spair_pat [simp]:\n  \"branch (spair_pat p1 p2)\\<cdot>r\\<cdot>\\<bottom> = \\<bottom>\"\n  \"\\<lbrakk>x \\<noteq> \\<bottom>; y \\<noteq> \\<bottom>\\<rbrakk>\n     \\<Longrightarrow> branch (spair_pat p1 p2)\\<cdot>r\\<cdot>(:x, y:) =\n         branch (cpair_pat p1 p2)\\<cdot>r\\<cdot>(x, y)\"\nby (simp_all add: branch_def spair_pat_def)\n\nlemma sinl_pat [simp]:\n  \"branch (sinl_pat p)\\<cdot>r\\<cdot>\\<bottom> = \\<bottom>\"\n  \"x \\<noteq> \\<bottom> \\<Longrightarrow> branch (sinl_pat p)\\<cdot>r\\<cdot>(sinl\\<cdot>x) = branch p\\<cdot>r\\<cdot>x\"\n  \"y \\<noteq> \\<bottom> \\<Longrightarrow> branch (sinl_pat p)\\<cdot>r\\<cdot>(sinr\\<cdot>y) = fail\"\nby (simp_all add: branch_def sinl_pat_def)\n\nlemma sinr_pat [simp]:\n  \"branch (sinr_pat p)\\<cdot>r\\<cdot>\\<bottom> = \\<bottom>\"\n  \"x \\<noteq> \\<bottom> \\<Longrightarrow> branch (sinr_pat p)\\<cdot>r\\<cdot>(sinl\\<cdot>x) = fail\"\n  \"y \\<noteq> \\<bottom> \\<Longrightarrow> branch (sinr_pat p)\\<cdot>r\\<cdot>(sinr\\<cdot>y) = branch p\\<cdot>r\\<cdot>y\"\nby (simp_all add: branch_def sinr_pat_def)\n\nlemma up_pat [simp]:\n  \"branch (up_pat p)\\<cdot>r\\<cdot>\\<bottom> = \\<bottom>\"\n  \"branch (up_pat p)\\<cdot>r\\<cdot>(up\\<cdot>x) = branch p\\<cdot>r\\<cdot>x\"\nby (simp_all add: branch_def up_pat_def)\n\nlemma TT_pat [simp]:\n  \"branch TT_pat\\<cdot>(unit_when\\<cdot>r)\\<cdot>\\<bottom> = \\<bottom>\"\n  \"branch TT_pat\\<cdot>(unit_when\\<cdot>r)\\<cdot>TT = succeed\\<cdot>r\"\n  \"branch TT_pat\\<cdot>(unit_when\\<cdot>r)\\<cdot>FF = fail\"\nby (simp_all add: branch_def TT_pat_def)\n\nlemma FF_pat [simp]:\n  \"branch FF_pat\\<cdot>(unit_when\\<cdot>r)\\<cdot>\\<bottom> = \\<bottom>\"\n  \"branch FF_pat\\<cdot>(unit_when\\<cdot>r)\\<cdot>TT = fail\"\n  \"branch FF_pat\\<cdot>(unit_when\\<cdot>r)\\<cdot>FF = succeed\\<cdot>r\"\nby (simp_all add: branch_def FF_pat_def)\n\nlemma ONE_pat [simp]:\n  \"branch ONE_pat\\<cdot>(unit_when\\<cdot>r)\\<cdot>\\<bottom> = \\<bottom>\"\n  \"branch ONE_pat\\<cdot>(unit_when\\<cdot>r)\\<cdot>ONE = succeed\\<cdot>r\"\nby (simp_all add: branch_def ONE_pat_def)\n\n\nsubsection {* Wildcards, as-patterns, and lazy patterns *}\n\ndefinition\n  wild_pat :: \"'a \\<rightarrow> unit match\" where\n  \"wild_pat = (\\<Lambda> x. succeed\\<cdot>())\"\n\ndefinition\n  as_pat :: \"('a \\<rightarrow> 'b match) \\<Rightarrow> 'a \\<rightarrow> ('a \\<times> 'b) match\" where\n  \"as_pat p = (\\<Lambda> x. match_bind\\<cdot>(p\\<cdot>x)\\<cdot>(\\<Lambda> a. succeed\\<cdot>(x, a)))\"\n\ndefinition\n  lazy_pat :: \"('a \\<rightarrow> 'b::pcpo match) \\<Rightarrow> ('a \\<rightarrow> 'b match)\" where\n  \"lazy_pat p = (\\<Lambda> x. succeed\\<cdot>(cases\\<cdot>(p\\<cdot>x)))\"\n\ntext {* Parse translations (patterns) *}\ntranslations\n  \"_pat _\" => \"CONST wild_pat\"\n\ntext {* Parse translations (variables) *}\ntranslations\n  \"_variable _ r\" => \"_variable _noargs r\"\n\ntext {* Print translations *}\ntranslations\n  \"_\" <= \"_match (CONST wild_pat) _noargs\"\n\nlemma wild_pat [simp]: \"branch wild_pat\\<cdot>(unit_when\\<cdot>r)\\<cdot>x = succeed\\<cdot>r\"\nby (simp add: branch_def wild_pat_def)\n\nlemma as_pat [simp]:\n  \"branch (as_pat p)\\<cdot>(csplit\\<cdot>r)\\<cdot>x = branch p\\<cdot>(r\\<cdot>x)\\<cdot>x\"\napply (simp add: branch_def as_pat_def)\napply (cases \"p\\<cdot>x\", simp_all)\ndone\n\nlemma lazy_pat [simp]:\n  \"branch p\\<cdot>r\\<cdot>x = \\<bottom> \\<Longrightarrow> branch (lazy_pat p)\\<cdot>r\\<cdot>x = succeed\\<cdot>(r\\<cdot>\\<bottom>)\"\n  \"branch p\\<cdot>r\\<cdot>x = fail \\<Longrightarrow> branch (lazy_pat p)\\<cdot>r\\<cdot>x = succeed\\<cdot>(r\\<cdot>\\<bottom>)\"\n  \"branch p\\<cdot>r\\<cdot>x = succeed\\<cdot>s \\<Longrightarrow> branch (lazy_pat p)\\<cdot>r\\<cdot>x = succeed\\<cdot>s\"\napply (simp_all add: branch_def lazy_pat_def)\napply (cases \"p\\<cdot>x\", simp_all)+\ndone\n\nsubsection {* Examples *}\n\nterm \"Case t of (:up\\<cdot>(sinl\\<cdot>x), sinr\\<cdot>y:) \\<Rightarrow> (x, y)\"\n\nterm \"\\<Lambda> t. Case t of up\\<cdot>(sinl\\<cdot>a) \\<Rightarrow> a | up\\<cdot>(sinr\\<cdot>b) \\<Rightarrow> b\"\n\nterm \"\\<Lambda> t. Case t of (:up\\<cdot>(sinl\\<cdot>_), sinr\\<cdot>x:) \\<Rightarrow> x\"\n\nsubsection {* ML code for generating definitions *}\n\nML {*\nlocal open HOLCF_Library in\n\ninfixr 6 ->>;\ninfix 9 ` ;\n\nval beta_rules =\n  @{thms beta_cfun cont_id cont_const cont2cont_APP cont2cont_LAM'} @\n  @{thms cont2cont_fst cont2cont_snd cont2cont_Pair};\n\nval beta_ss =\n  simpset_of (put_simpset HOL_basic_ss @{context} addsimps (@{thms simp_thms} @ beta_rules));\n\nfun define_consts\n    (specs : (binding * term * mixfix) list)\n    (thy : theory)\n    : (term list * thm list) * theory =\n  let\n    fun mk_decl (b, t, mx) = (b, fastype_of t, mx);\n    val decls = map mk_decl specs;\n    val thy = Cont_Consts.add_consts decls thy;\n    fun mk_const (b, T, mx) = Const (Sign.full_name thy b, T);\n    val consts = map mk_const decls;\n    fun mk_def c (b, t, mx) =\n      (Thm.def_binding b, Logic.mk_equals (c, t));\n    val defs = map2 mk_def consts specs;\n    val (def_thms, thy) =\n      Global_Theory.add_defs false (map Thm.no_attributes defs) thy;\n  in\n    ((consts, def_thms), thy)\n  end;\n\nfun prove\n    (thy : theory)\n    (defs : thm list)\n    (goal : term)\n    (tacs : {prems: thm list, context: Proof.context} -> tactic list)\n    : thm =\n  let\n    fun tac {prems, context} =\n      rewrite_goals_tac context defs THEN\n      EVERY (tacs {prems = map (rewrite_rule context defs) prems, context = context})\n  in\n    Goal.prove_global thy [] [] goal tac\n  end;\n\nfun get_vars_avoiding\n    (taken : string list)\n    (args : (bool * typ) list)\n    : (term list * term list) =\n  let\n    val Ts = map snd args;\n    val ns = Name.variant_list taken (Old_Datatype_Prop.make_tnames Ts);\n    val vs = map Free (ns ~~ Ts);\n    val nonlazy = map snd (filter_out (fst o fst) (args ~~ vs));\n  in\n    (vs, nonlazy)\n  end;\n\n(******************************************************************************)\n(************** definitions and theorems for pattern combinators **************)\n(******************************************************************************)\n\nfun add_pattern_combinators\n    (bindings : binding list)\n    (spec : (term * (bool * typ) list) list)\n    (lhsT : typ)\n    (exhaust : thm)\n    (case_const : typ -> term)\n    (case_rews : thm list)\n    (thy : theory) =\n  let\n\n    (* utility functions *)\n    fun mk_pair_pat (p1, p2) =\n      let\n        val T1 = fastype_of p1;\n        val T2 = fastype_of p2;\n        val (U1, V1) = apsnd dest_matchT (dest_cfunT T1);\n        val (U2, V2) = apsnd dest_matchT (dest_cfunT T2);\n        val pat_typ = [T1, T2] --->\n            (mk_prodT (U1, U2) ->> mk_matchT (mk_prodT (V1, V2)));\n        val pat_const = Const (@{const_name cpair_pat}, pat_typ);\n      in\n        pat_const $ p1 $ p2\n      end;\n    fun mk_tuple_pat [] = succeed_const HOLogic.unitT\n      | mk_tuple_pat ps = foldr1 mk_pair_pat ps;\n    fun branch_const (T,U,V) = \n      Const (@{const_name branch},\n        (T ->> mk_matchT U) --> (U ->> V) ->> T ->> mk_matchT V);\n\n    (* define pattern combinators *)\n    local\n      val tns = map (fst o dest_TFree) (snd (dest_Type lhsT));\n\n      fun pat_eqn (i, (bind, (con, args))) : binding * term * mixfix =\n        let\n          val pat_bind = Binding.suffix_name \"_pat\" bind;\n          val Ts = map snd args;\n          val Vs =\n              (map (K \"'t\") args)\n              |> Old_Datatype_Prop.indexify_names\n              |> Name.variant_list tns\n              |> map (fn t => TFree (t, @{sort pcpo}));\n          val patNs = Old_Datatype_Prop.indexify_names (map (K \"pat\") args);\n          val patTs = map2 (fn T => fn V => T ->> mk_matchT V) Ts Vs;\n          val pats = map Free (patNs ~~ patTs);\n          val fail = mk_fail (mk_tupleT Vs);\n          val (vs, nonlazy) = get_vars_avoiding patNs args;\n          val rhs = big_lambdas vs (mk_tuple_pat pats ` mk_tuple vs);\n          fun one_fun (j, (_, args')) =\n            let\n              val (vs', nonlazy) = get_vars_avoiding patNs args';\n            in if i = j then rhs else big_lambdas vs' fail end;\n          val funs = map_index one_fun spec;\n          val body = list_ccomb (case_const (mk_matchT (mk_tupleT Vs)), funs);\n        in\n          (pat_bind, lambdas pats body, NoSyn)\n        end;\n    in\n      val ((pat_consts, pat_defs), thy) =\n          define_consts (map_index pat_eqn (bindings ~~ spec)) thy\n    end;\n\n    (* syntax translations for pattern combinators *)\n    local\n      fun syntax c = Lexicon.mark_const (fst (dest_Const c));\n      fun app s (l, r) = Ast.mk_appl (Ast.Constant s) [l, r];\n      val capp = app @{const_syntax Rep_cfun};\n      val capps = Library.foldl capp\n\n      fun app_var x = Ast.mk_appl (Ast.Constant \"_variable\") [x, Ast.Variable \"rhs\"];\n      fun app_pat x = Ast.mk_appl (Ast.Constant \"_pat\") [x];\n      fun args_list [] = Ast.Constant \"_noargs\"\n        | args_list xs = foldr1 (app \"_args\") xs;\n      fun one_case_trans (pat, (con, args)) =\n        let\n          val cname = Ast.Constant (syntax con);\n          val pname = Ast.Constant (syntax pat);\n          val ns = 1 upto length args;\n          val xs = map (fn n => Ast.Variable (\"x\"^(string_of_int n))) ns;\n          val ps = map (fn n => Ast.Variable (\"p\"^(string_of_int n))) ns;\n          val vs = map (fn n => Ast.Variable (\"v\"^(string_of_int n))) ns;\n        in\n          [Syntax.Parse_Rule (app_pat (capps (cname, xs)),\n            Ast.mk_appl pname (map app_pat xs)),\n           Syntax.Parse_Rule (app_var (capps (cname, xs)),\n            app_var (args_list xs)),\n           Syntax.Print_Rule (capps (cname, ListPair.map (app \"_match\") (ps,vs)),\n            app \"_match\" (Ast.mk_appl pname ps, args_list vs))]\n        end;\n      val trans_rules : Ast.ast Syntax.trrule list =\n          maps one_case_trans (pat_consts ~~ spec);\n    in\n      val thy = Sign.add_trrules trans_rules thy;\n    end;\n\n    (* prove strictness and reduction rules of pattern combinators *)\n    local\n      val tns = map (fst o dest_TFree) (snd (dest_Type lhsT));\n      val rn = singleton (Name.variant_list tns) \"'r\";\n      val R = TFree (rn, @{sort pcpo});\n      fun pat_lhs (pat, args) =\n        let\n          val Ts = map snd args;\n          val Vs =\n              (map (K \"'t\") args)\n              |> Old_Datatype_Prop.indexify_names\n              |> Name.variant_list (rn::tns)\n              |> map (fn t => TFree (t, @{sort pcpo}));\n          val patNs = Old_Datatype_Prop.indexify_names (map (K \"pat\") args);\n          val patTs = map2 (fn T => fn V => T ->> mk_matchT V) Ts Vs;\n          val pats = map Free (patNs ~~ patTs);\n          val k = Free (\"rhs\", mk_tupleT Vs ->> R);\n          val branch1 = branch_const (lhsT, mk_tupleT Vs, R);\n          val fun1 = (branch1 $ list_comb (pat, pats)) ` k;\n          val branch2 = branch_const (mk_tupleT Ts, mk_tupleT Vs, R);\n          val fun2 = (branch2 $ mk_tuple_pat pats) ` k;\n          val taken = \"rhs\" :: patNs;\n        in (fun1, fun2, taken) end;\n      fun pat_strict (pat, (con, args)) =\n        let\n          val (fun1, fun2, taken) = pat_lhs (pat, args);\n          val defs = @{thm branch_def} :: pat_defs;\n          val goal = mk_trp (mk_strict fun1);\n          val rules = @{thms match_bind_simps} @ case_rews;\n          fun tacs ctxt = [simp_tac (put_simpset beta_ss ctxt addsimps rules) 1];\n        in prove thy defs goal (tacs o #context) end;\n      fun pat_apps (i, (pat, (con, args))) =\n        let\n          val (fun1, fun2, taken) = pat_lhs (pat, args);\n          fun pat_app (j, (con', args')) =\n            let\n              val (vs, nonlazy) = get_vars_avoiding taken args';\n              val con_app = list_ccomb (con', vs);\n              val assms = map (mk_trp o mk_defined) nonlazy;\n              val rhs = if i = j then fun2 ` mk_tuple vs else mk_fail R;\n              val concl = mk_trp (mk_eq (fun1 ` con_app, rhs));\n              val goal = Logic.list_implies (assms, concl);\n              val defs = @{thm branch_def} :: pat_defs;\n              val rules = @{thms match_bind_simps} @ case_rews;\n              fun tacs ctxt = [asm_simp_tac (put_simpset beta_ss ctxt addsimps rules) 1];\n            in prove thy defs goal (tacs o #context) end;\n        in map_index pat_app spec end;\n    in\n      val pat_stricts = map pat_strict (pat_consts ~~ spec);\n      val pat_apps = flat (map_index pat_apps (pat_consts ~~ spec));\n    end;\n\n  in\n    (pat_stricts @ pat_apps, thy)\n  end\n\nend\n*}\n\n(*\nCut from HOLCF/Tools/domain_constructors.ML\nin function add_domain_constructors:\n\n    ( * define and prove theorems for pattern combinators * )\n    val (pat_thms : thm list, thy : theory) =\n      let\n        val bindings = map #1 spec;\n        fun prep_arg (lazy, sel, T) = (lazy, T);\n        fun prep_con c (b, args, mx) = (c, map prep_arg args);\n        val pat_spec = map2 prep_con con_consts spec;\n      in\n        add_pattern_combinators bindings pat_spec lhsT\n          exhaust case_const cases thy\n      end\n\n*)\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/HOL/HOLCF/ex/Pattern_Match.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5506073655352404, "lm_q2_score": 0.5467381519846138, "lm_q1q2_score": 0.3010380535018541}}
{"text": "(* \n   Title: The pi-calculus   \n   Author/Maintainer: Jesper Bengtson (jebe.dk), 2012\n*)\ntheory Strong_Early_Late_Comp\n  imports Strong_Late_Bisim_Subst_SC Strong_Early_Bisim_Subst\nbegin\n\nabbreviation TransitionsLate_judge (\"_ \\<longmapsto>\\<^sub>l _\" [80, 80] 80) where \"P \\<longmapsto>\\<^sub>l Rs \\<equiv> transitions P Rs\"\nabbreviation TransitionsEarly_judge (\"_ \\<longmapsto>\\<^sub>e _\" [80, 80] 80) where \"P \\<longmapsto>\\<^sub>e Rs \\<equiv> TransitionsEarly P Rs\"\n\nabbreviation Transitions_InputjudgeLate (\"_<_> \\<prec>\\<^sub>l _\" [80, 80] 80) where \"a<x> \\<prec>\\<^sub>l P' \\<equiv> (Late_Semantics.BoundR (Late_Semantics.InputS a) x P')\"\nabbreviation Transitions_OutputjudgeLate (\"_[_] \\<prec>\\<^sub>l _\" [80, 80] 80) where \"a[b] \\<prec>\\<^sub>l P' \\<equiv> (Late_Semantics.FreeR (Late_Semantics.OutputR a b) P')\"\nabbreviation Transitions_BoundOutputjudgeLate (\"_<\\<nu>_> \\<prec>\\<^sub>l _\" [80, 80] 80) where \"a<\\<nu>x> \\<prec>\\<^sub>l P' \\<equiv> (Late_Semantics.BoundR (Late_Semantics.BoundOutputS a) x P')\"\nabbreviation Transitions_TaujudgeLate (\"\\<tau> \\<prec>\\<^sub>l _\" 80) where \"\\<tau> \\<prec>\\<^sub>l P' \\<equiv> (Late_Semantics.FreeR Late_Semantics.TauR P')\"\n\nabbreviation Transitions_InputjudgeEarly (\"_<_> \\<prec>\\<^sub>e _\" [80, 80] 80) where \"a<x> \\<prec>\\<^sub>e P' \\<equiv> (Early_Semantics.FreeR (Early_Semantics.InputR a x) P')\"\nabbreviation Transitions_OutputjudgeEarly (\"_[_] \\<prec>\\<^sub>e _\" [80, 80] 80) where \"a[b] \\<prec>\\<^sub>e P' \\<equiv> (Early_Semantics.FreeR (Early_Semantics.OutputR a b) P')\"\nabbreviation Transitions_BoundOutputjudgeEarly (\"_<\\<nu>_> \\<prec>\\<^sub>e _\" [80, 80] 80) where \"a<\\<nu>x> \\<prec>\\<^sub>e P' \\<equiv>(Early_Semantics.BoundOutputR a x P')\"\nabbreviation Transitions_TaujudgeEarly (\"\\<tau> \\<prec>\\<^sub>e _\" 80) where \"\\<tau> \\<prec>\\<^sub>e P' \\<equiv> (Early_Semantics.FreeR Early_Semantics.TauR P')\"\n\nlemma earlyLateOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  assumes \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\"\n\n  shows \"P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\"\nusing assms\nproof(nominal_induct rule: Early_Semantics.outputInduct)\n  case(Output a b P)\n  show ?case by(rule Late_Semantics.Output)\nnext\n  case(Match P a b P' c)\n  have \"P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\" by fact\n  thus ?case by(rule Late_Semantics.Match)\nnext\n  case(Mismatch P a b P' c d)\n  from \\<open>P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\\<close> \\<open>c \\<noteq> d\\<close>\n  show ?case by(rule Late_Semantics.Mismatch)\nnext\n  case(Sum1 P a b P' Q)\n  have \"P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\" by fact\n  thus ?case by(rule Late_Semantics.Sum1)\nnext\n  case(Sum2 Q a b Q' P)\n  have \"Q \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l Q'\" by fact\n  thus ?case by(rule Late_Semantics.Sum2)\nnext\n  case(Par1 P a b P' Q)\n  have \"P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\" by fact\n  thus ?case by(rule Late_Semantics.Par1F)\nnext\n  case(Par2 Q a b Q' P)\n  have \"Q \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l Q'\" by fact\n  thus ?case by(rule Late_Semantics.Par2F)\nnext\n  case(Res P a b P' x)\n  have \"P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\" and \"x \\<noteq> a\" and \"x \\<noteq> b\" by fact+\n  thus ?case by(force intro: Late_Semantics.ResF)\nnext\n  case(Bang P a b P')\n  have \"P \\<parallel> !P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\" by fact\n  thus ?case by(rule Late_Semantics.Bang)\nqed\n\nlemma lateEarlyOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  assumes \"P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\"\n\n  shows \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\"\nusing assms\nproof(nominal_induct rule: Late_Semantics.outputInduct)\n  case(Output a b P)\n  thus ?case by(rule Early_Semantics.Output)\nnext\n  case(Match P a b P' c)\n  have \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\" by fact\n  thus ?case by(rule Early_Semantics.Match)\nnext\n  case(Mismatch P a b P' c d)\n  have \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\" and \"c \\<noteq> d\" by fact+\n  thus ?case by(rule Early_Semantics.Mismatch)\nnext\n  case(Sum1 P a b P' Q)\n  have \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\" by fact\n  thus ?case by(rule Early_Semantics.Sum1)\nnext\n  case(Sum2 Q a b Q' P)\n  have \"Q \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e Q'\" by fact\n  thus ?case by(rule Early_Semantics.Sum2)\nnext\n  case(Par1 P a b P' Q)\n  have \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\" by fact\n  thus ?case by(rule Early_Semantics.Par1F)\nnext\n  case(Par2 Q a b Q' P)\n  have \"Q \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e Q'\" by fact\n  thus ?case by(rule Early_Semantics.Par2F)\nnext\n  case(Res P a b P' x)\n  have \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\" and \"x \\<noteq> a\" and \"x \\<noteq> b\" by fact+\n  thus ?case by(force intro: Early_Semantics.ResF)\nnext\n  case(Bang P a b P')\n  have \"P \\<parallel> !P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\" by fact\n  thus ?case by(rule Early_Semantics.Bang)\nqed\n\nlemma outputEq:\n  fixes P  :: pi\n  and   a  :: name\n  and   b  :: name\n  and   P' :: pi\n\n  shows \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P' = P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\"\nby(auto intro: lateEarlyOutput earlyLateOutput)\n\nlemma lateEarlyBoundOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n\n  assumes \"P \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P'\"\n\n  shows \"P \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P'\"\nproof -\n  have Goal: \"\\<And>P a x P'. \\<lbrakk>P \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P'; x \\<sharp> P\\<rbrakk> \\<Longrightarrow> P \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P'\"\n  proof -\n    fix P a x P'\n    assume \"P \\<longmapsto>\\<^sub>l a<\\<nu>x> \\<prec>\\<^sub>l P'\" and \"x \\<sharp> P\"\n    thus \"P \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P'\"\n    proof(nominal_induct rule: Late_Semantics.boundOutputInduct)\n      case(Match P a x P' b)\n      have \"P \\<longmapsto>\\<^sub>e a<\\<nu>x> \\<prec>\\<^sub>e P'\" by fact\n      thus ?case by(rule Early_Semantics.Match)\n    next\n      case(Mismatch P a x P' b c)\n      have \"P \\<longmapsto>\\<^sub>e a<\\<nu>x> \\<prec>\\<^sub>e P'\" and \"b \\<noteq> c\" by fact+\n      thus ?case by(rule Early_Semantics.Mismatch)\n    next\n      case(Open P a x P')\n      have \"P \\<longmapsto>\\<^sub>la[x] \\<prec>\\<^sub>l P'\" by fact\n      hence \"P \\<longmapsto>\\<^sub>ea[x] \\<prec>\\<^sub>e P'\" by(rule lateEarlyOutput)\n      moreover have \"a \\<noteq> x\" by fact\n      ultimately show ?case by(rule Early_Semantics.Open)\n    next\n      case(Sum1 P Q a x P')\n      have \"P \\<longmapsto>\\<^sub>e a<\\<nu>x> \\<prec>\\<^sub>e P'\" by fact\n      thus ?case by(rule Early_Semantics.Sum1)\n    next\n      case(Sum2 P Q a x Q')\n      have \"Q \\<longmapsto>\\<^sub>e a<\\<nu>x> \\<prec>\\<^sub>e Q'\" by fact\n      thus ?case by(rule Early_Semantics.Sum2)\n    next\n      case(Par1 P P' Q a x)\n      have \"P \\<longmapsto>\\<^sub>e a<\\<nu>x> \\<prec>\\<^sub>e P'\" and \"x \\<sharp> Q\" by fact+\n      thus ?case by(rule Early_Semantics.Par1B)\n    next\n      case(Par2 P Q Q' a x)\n      have \"Q \\<longmapsto>\\<^sub>e a<\\<nu>x> \\<prec>\\<^sub>e Q'\" and \"x \\<sharp> P\" by fact+\n      thus ?case by(rule Early_Semantics.Par2B)\n    next\n      case(Res P P' a x y)\n      have \"P \\<longmapsto>\\<^sub>e a<\\<nu>x> \\<prec>\\<^sub>e P'\" and \"y \\<noteq> a\" and \"y \\<noteq> x\" by fact+\n      thus ?case by(force intro: Early_Semantics.ResB)\n    next\n      case(Bang P a x P')\n      have \"P \\<parallel> !P \\<longmapsto>\\<^sub>e a<\\<nu>x> \\<prec>\\<^sub>e P'\" by fact\n      thus ?case by(rule Early_Semantics.Bang)\n    qed\n  qed\n\n  have \"\\<exists>c::name. c \\<sharp> (P, P', x)\" by(blast intro: name_exists_fresh)\n  then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshP': \"c \\<sharp> P'\" and \"c \\<noteq> x\"\n    by(force simp add: fresh_prod)\n  from assms cFreshP' have \"P \\<longmapsto>\\<^sub>la<\\<nu>c> \\<prec>\\<^sub>l ([(x, c)] \\<bullet> P')\"\n    by(simp add: Late_Semantics.alphaBoundResidual)\n  hence \"P \\<longmapsto>\\<^sub>e a<\\<nu>c> \\<prec>\\<^sub>e ([(x, c)] \\<bullet> P')\" using cFreshP\n    by(rule Goal)\n  moreover from cFreshP' \\<open>c \\<noteq> x\\<close> have \"x \\<sharp> [(x, c)] \\<bullet> P'\" by(simp add: name_fresh_left name_calc)\n  ultimately show ?thesis by(simp add: Early_Semantics.alphaBoundOutput name_swap)\nqed\n\nlemma earlyLateBoundOutput:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n\n  assumes \"P \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P'\"\n\n  shows \"P \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P'\"\nproof -\n  have Goal: \"\\<And>P a x P'. \\<lbrakk>P \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P'; x \\<sharp> P\\<rbrakk> \\<Longrightarrow> P \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P'\"\n  proof -\n    fix P a x P'\n    assume \"P \\<longmapsto>\\<^sub>e a<\\<nu>x> \\<prec> P'\" and \"x \\<sharp> P\"\n    thus \"P \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P'\"\n    proof(nominal_induct rule: Early_Semantics.boundOutputInduct)\n      case(Match P a x P' b)\n      have \"P \\<longmapsto>\\<^sub>l a<\\<nu>x> \\<prec> P'\" by fact\n      thus ?case by(rule Late_Semantics.Match)\n    next\n      case(Mismatch P a x P' b c)\n      have \"P \\<longmapsto>\\<^sub>l a<\\<nu>x> \\<prec> P'\" and \"b \\<noteq> c\" by fact+\n      thus ?case by(rule Late_Semantics.Mismatch)\n    next\n      case(Open P a x P')\n      have \"P \\<longmapsto>\\<^sub>ea[x] \\<prec>\\<^sub>e P'\" by fact\n      hence \"P \\<longmapsto>\\<^sub>la[x] \\<prec>\\<^sub>l P'\" by(rule earlyLateOutput)\n      moreover have \"a \\<noteq> x\" by fact\n      ultimately show ?case by(rule Late_Semantics.Open)\n    next\n      case(Sum1 P Q a x P')\n      have \"P \\<longmapsto>\\<^sub>l a<\\<nu>x> \\<prec>\\<^sub>l P'\" by fact\n      thus ?case by(rule Late_Semantics.Sum1)\n    next\n      case(Sum2 P Q a x Q')\n      have \"Q \\<longmapsto>\\<^sub>l a<\\<nu>x> \\<prec>\\<^sub>l Q'\" by fact\n      thus ?case by(rule Late_Semantics.Sum2)\n    next\n      case(Par1 P P' Q a x)\n      have \"P \\<longmapsto>\\<^sub>l a<\\<nu>x> \\<prec>\\<^sub>l P'\" and \"x \\<sharp> Q\" by fact+\n      thus ?case by(rule Late_Semantics.Par1B)\n    next\n      case(Par2 P Q Q' a x)\n      have \"Q \\<longmapsto>\\<^sub>l a<\\<nu>x> \\<prec>\\<^sub>l Q'\" and \"x \\<sharp> P\" by fact+\n      thus ?case by(rule Late_Semantics.Par2B)\n    next\n      case(Res P P' a x y)\n      have \"P \\<longmapsto>\\<^sub>l a<\\<nu>x> \\<prec>\\<^sub>l P'\" and \"y \\<noteq> a\" and \"y \\<noteq> x\" by fact+\n      thus ?case by(force intro: Late_Semantics.ResB)\n    next\n      case(Bang P a x P')\n      have \"P \\<parallel> !P \\<longmapsto>\\<^sub>l a<\\<nu>x> \\<prec> P'\" by fact\n      thus ?case by(rule Late_Semantics.Bang)\n    qed\n  qed\n\n  have \"\\<exists>c::name. c \\<sharp> (P, P', x)\" by(blast intro: name_exists_fresh)\n  then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshP': \"c \\<sharp> P'\" and \"c \\<noteq> x\"\n    by(force simp add: fresh_prod)\n  from assms cFreshP' have \"P \\<longmapsto>\\<^sub>ea<\\<nu>c> \\<prec>\\<^sub>e ([(x, c)] \\<bullet> P')\"\n    by(simp add: Early_Semantics.alphaBoundOutput)\n  hence \"P \\<longmapsto>\\<^sub>l a<\\<nu>c> \\<prec>\\<^sub>l ([(x, c)] \\<bullet> P')\" using cFreshP\n    by(rule Goal)\n  moreover from cFreshP' \\<open>c \\<noteq> x\\<close> have \"x \\<sharp> [(x, c)] \\<bullet> P'\" by(simp add: name_fresh_left name_calc)\n  ultimately show ?thesis by(simp add: Late_Semantics.alphaBoundResidual name_swap)\nqed\n\nlemma BoundOutputEq:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n\n  shows \"P \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P' = P \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P'\"\nby(auto intro: earlyLateBoundOutput lateEarlyBoundOutput)\n\nlemma lateEarlyInput:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n  and   u  :: name\n\n  assumes PTrans: \"P \\<longmapsto>\\<^sub>l a<x> \\<prec>\\<^sub>l P'\"\n\n  shows \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (P'[x::=u])\"\nproof -\n  have Goal: \"\\<And>P a x P' u. \\<lbrakk>P \\<longmapsto>\\<^sub>l a<x> \\<prec>\\<^sub>l P'; x \\<sharp> P\\<rbrakk> \\<Longrightarrow> P \\<longmapsto>\\<^sub>e a<u> \\<prec>\\<^sub>e (P'[x::=u])\"\n  proof -\n    fix P a x P' u\n    assume \"P \\<longmapsto>\\<^sub>l a<x> \\<prec>\\<^sub>l P'\" and \"x \\<sharp> P\"\n    thus \"P \\<longmapsto>\\<^sub>e a<u> \\<prec>\\<^sub>e (P'[x::=u])\"\n    proof(nominal_induct avoiding: u rule: Late_Semantics.inputInduct)\n      case(Input a x P)\n      thus ?case by(rule Early_Semantics.Input)\n    next\n      case(Match P a x P' b u)\n      have \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (P'[x::=u])\" by fact\n      thus ?case by(rule Early_Semantics.Match)\n    next\n      case(Mismatch P a x P' b c u)\n      have \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (P'[x::=u])\" by fact\n      moreover have \"b\\<noteq>c\" by fact\n      ultimately show ?case by(rule Early_Semantics.Mismatch)\n    next\n      case(Sum1 P Q a x P')\n      have \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (P'[x::=u])\" by fact\n      thus ?case by(rule Early_Semantics.Sum1)\n    next\n      case(Sum2 P Q a x Q')\n      have \"Q \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (Q'[x::=u])\" by fact\n      thus ?case by(rule Early_Semantics.Sum2)\n    next\n      case(Par1 P P' Q a x)\n      have \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (P'[x::=u])\" by fact\n      hence \"P \\<parallel> Q \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (P'[x::=u] \\<parallel> Q)\" by(rule Early_Semantics.Par1F)\n      moreover have \"x \\<sharp> Q\" by fact\n      ultimately show ?case by(simp add: forget)\n    next\n      case(Par2 P Q Q' a x)\n      have \"Q \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (Q'[x::=u])\" by fact\n      hence \"P \\<parallel> Q \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (P \\<parallel> Q'[x::=u])\" by(rule Early_Semantics.Par2F)\n      moreover have \"x \\<sharp> P\" by fact\n      ultimately show ?case by(simp add: forget)\n    next\n      case(Res P P' a x y u)\n      have \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (P'[x::=u])\" and \"y \\<noteq> a\" and yinequ: \"y \\<sharp> u\" by fact+\n      hence \"<\\<nu>y>P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e <\\<nu>y>(P'[x::=u])\" by(force intro: Early_Semantics.ResF)\n      moreover have \"y \\<noteq> x\" by fact\n      ultimately show ?case using yinequ by simp\n    next\n      case(Bang P a x P' u)\n      have \"P \\<parallel> !P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e (P'[x::=u])\" by fact\n      thus ?case by(rule Early_Semantics.Bang)\n    qed\n  qed\n\n  have \"\\<exists>c::name. c \\<sharp> (P, P')\" by(blast intro: name_exists_fresh)\n  then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshP': \"c \\<sharp> P'\"\n    by(force simp add: fresh_prod)\n  from assms cFreshP' have \"P \\<longmapsto>\\<^sub>la<c> \\<prec>\\<^sub>l ([(x, c)] \\<bullet> P')\"\n    by(simp add: Late_Semantics.alphaBoundResidual)\n  hence \"P \\<longmapsto>\\<^sub>e a<u> \\<prec>\\<^sub>e ([(x, c)] \\<bullet> P')[c::=u]\" using cFreshP\n    by(rule Goal)\n  with cFreshP' show ?thesis by(simp add: renaming name_swap)\nqed\n\nlemma earlyLateInput:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n  and   u  :: name\n  and   C  :: \"'a::fs_name\"\n\n  assumes \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e P'\"\n  and     \"x \\<sharp> P\"\n\n  shows \"\\<exists>P''. P \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l P'' \\<and> P' = P''[x::=u]\"\nproof -\n  {\n    fix P a u P'\n    assume \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e P'\"\n    hence \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l P'' \\<and> P' = P''[x::=u]\"\n    proof(nominal_induct rule: Early_Semantics.inputInduct)\n      case(cInput a x P u)\n      have \"a<x>.P \\<longmapsto>\\<^sub>la<x> \\<prec> P\" by(rule Late_Semantics.Input)\n      thus ?case by blast\n    next\n      case(cMatch P a u P' b)\n      have \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      from PTrans have \"[b\\<frown>b]P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" by(rule Late_Semantics.Match)\n      with P'eqP'' show ?case by blast\n    next\n      case(cMismatch P a u P' b c)\n      have \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      have \"b \\<noteq> c\" by fact\n      with PTrans have \"[b\\<noteq>c]P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" by(rule Late_Semantics.Mismatch)\n      with P'eqP'' show ?case by blast\n    next\n      case(cSum1 P a u P' Q)\n      have \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      from PTrans have \"P \\<oplus> Q \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" by(rule Late_Semantics.Sum1)\n      with P'eqP'' show ?case by blast\n    next\n      case(cSum2 Q a u Q' P)\n      have \"\\<exists>Q'' x. Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q'' \\<and> Q' = Q''[x::=u]\" by fact\n      then obtain Q'' x where QTrans: \"Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q''\" and Q'eqQ'': \"Q' = Q''[x::=u]\" by blast\n      from QTrans have \"P \\<oplus> Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q''\" by(rule Late_Semantics.Sum2)\n      with Q'eqQ'' show ?case by blast\n    next\n      case(cPar1 P a u P' Q)\n      have \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      have \"\\<exists>c::name. c \\<sharp> (Q, P'')\" by(blast intro: name_exists_fresh)\n      then obtain c::name where cFreshQ: \"c \\<sharp> Q\" and cFreshP'': \"c \\<sharp> P''\" by(force simp add: fresh_prod)\n      from PTrans cFreshP'' have \"P \\<longmapsto>\\<^sub>la<c> \\<prec> [(x, c)] \\<bullet> P''\" by(simp add: Late_Semantics.alphaBoundResidual)\n      hence \"P \\<parallel> Q \\<longmapsto>\\<^sub>la<c> \\<prec> ([(x, c)] \\<bullet> P'') \\<parallel> Q\" using \\<open>c \\<sharp> Q\\<close> by(rule Late_Semantics.Par1B)\n      moreover from cFreshQ cFreshP'' P'eqP'' have \"P' \\<parallel> Q = (([(x, c)] \\<bullet> P'') \\<parallel> Q)[c::=u]\"\n        by(simp add: forget renaming name_swap)\n      ultimately show ?case by blast\n    next\n      case(cPar2 Q a u Q' P)\n      have \"\\<exists>Q'' x. Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q'' \\<and> Q' = Q''[x::=u]\" by fact\n      then obtain Q'' x where QTrans: \"Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q''\" and Q'eqQ'': \"Q' = Q''[x::=u]\" by blast\n      have \"\\<exists>c::name. c \\<sharp> (P, Q'')\" by(blast intro: name_exists_fresh)\n      then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshQ'': \"c \\<sharp> Q''\" by(force simp add: fresh_prod)\n      from QTrans cFreshQ'' have \"Q \\<longmapsto>\\<^sub>la<c> \\<prec> [(x, c)] \\<bullet> Q''\" by(simp add: Late_Semantics.alphaBoundResidual)\n      hence \"P \\<parallel> Q \\<longmapsto>\\<^sub>la<c> \\<prec> P \\<parallel> ([(x, c)] \\<bullet> Q'')\" using \\<open>c \\<sharp> P\\<close> by(rule Late_Semantics.Par2B)\n      moreover from cFreshP cFreshQ'' Q'eqQ'' have \"P \\<parallel> Q' = (P \\<parallel> ([(x, c)] \\<bullet> Q''))[c::=u]\"\n        by(simp add: forget renaming name_swap)\n      ultimately show ?case by blast\n    next\n      case(cRes P a u P' y)\n      have \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      have yinequ: \"y \\<noteq> u\" by fact\n      have \"\\<exists>c::name. c \\<sharp> (y, P'')\" by(blast intro: name_exists_fresh)\n      then obtain c::name where cineqy: \"c \\<noteq> y\" and cFreshP'': \"c \\<sharp> P''\" by(force simp add: fresh_prod)\n      from PTrans cFreshP'' have \"P \\<longmapsto>\\<^sub>la<c> \\<prec> [(x, c)] \\<bullet> P''\" by(simp add: Late_Semantics.alphaBoundResidual)\n      moreover have \"y \\<noteq> a\" by fact\n      ultimately have \"<\\<nu>y>P \\<longmapsto>\\<^sub>la<c> \\<prec> <\\<nu>y>(([(x, c)] \\<bullet> P''))\" using cineqy\n        by(force intro: Late_Semantics.ResB)\n      moreover from cineqy cFreshP'' P'eqP'' yinequ have \"<\\<nu>y>P' = (<\\<nu>y>([(x, c)] \\<bullet> P''))[c::=u]\"\n        by(simp add: renaming name_swap)\n      ultimately show ?case by blast\n    next\n      case(cBang P a u P')\n      have \"\\<exists>P'' x. P \\<parallel> !P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<parallel> !P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      from PTrans have \"!P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" by(rule Late_Semantics.Bang)\n      with P'eqP'' show ?case by blast\n    qed\n  }\n  with assms obtain P'' y where PTrans: \"P \\<longmapsto>\\<^sub>la<y> \\<prec> P''\" and P'eqP'': \"P' = P''[y::=u]\" by blast\n  show ?thesis\n  proof(cases \"x=y\")\n    case True\n    from PTrans P'eqP'' \\<open>x = y\\<close> show ?thesis by blast\n  next\n    case False\n    from PTrans \\<open>x \\<noteq> y\\<close> \\<open>x \\<sharp> P\\<close> have \"x \\<sharp> P''\" by(fastforce dest: freshBoundDerivative simp add: residual.inject)\n    with PTrans have \"P \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l ([(x, y)] \\<bullet> P'')\"\n      by(simp add: Late_Semantics.alphaBoundResidual)\n    moreover from \\<open>x \\<sharp> P''\\<close> have \"P''[y::=u] = ([(x, y)] \\<bullet> P'')[x::=u]\" by(simp add: renaming name_swap)\n    ultimately show ?thesis using P'eqP'' by blast\n  qed\nqed\n(*\nlemma earlyLateInput:\n  fixes P  :: pi\n  and   a  :: name\n  and   x  :: name\n  and   P' :: pi\n  and   u  :: name\n  and   C  :: \"'a::fs_name\"\n\n  assumes PTrans: \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e P'\"\n\n  shows \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l P'' \\<and> P' = P''[x::=u] \\<and> x \\<sharp> C\"\nproof -\n  have \"\\<And>P a u P'. P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e P' \\<Longrightarrow> \\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l P'' \\<and> P' = P''[x::=u]\"\n  proof -\n    fix P a u P'\n    assume \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e P'\"\n    thus \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l P'' \\<and> P' = P''[x::=u]\"\n    proof(nominal_induct rule: Early_Semantics.inputInduct)\n      case(cInput a x P u)\n      have \"a<x>.P \\<longmapsto>\\<^sub>la<x> \\<prec> P\" by(rule Late_Semantics.Input)\n      thus ?case by blast\n    next\n      case(cMatch P a u P' b)\n      have \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      from PTrans have \"[b\\<frown>b]P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" by(rule Late_Semantics.Match)\n      with P'eqP'' show ?case by blast\n    next\n      case(cMismatch P a u P' b c)\n      have \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      have \"b \\<noteq> c\" by fact\n      with PTrans have \"[b\\<noteq>c]P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" by(rule Late_Semantics.Mismatch)\n      with P'eqP'' show ?case by blast\n    next\n      case(cSum1 P a u P' Q)\n      have \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      from PTrans have \"P \\<oplus> Q \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" by(rule Late_Semantics.Sum1)\n      with P'eqP'' show ?case by blast\n    next\n      case(cSum2 Q a u Q' P)\n      have \"\\<exists>Q'' x. Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q'' \\<and> Q' = Q''[x::=u]\" by fact\n      then obtain Q'' x where QTrans: \"Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q''\" and Q'eqQ'': \"Q' = Q''[x::=u]\" by blast\n      from QTrans have \"P \\<oplus> Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q''\" by(rule Late_Semantics.Sum2)\n      with Q'eqQ'' show ?case by blast\n    next\n      case(cPar1 P a u P' Q)\n      have \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      have \"\\<exists>c::name. c \\<sharp> (Q, P'')\" by(blast intro: name_exists_fresh)\n      then obtain c::name where cFreshQ: \"c \\<sharp> Q\" and cFreshP'': \"c \\<sharp> P''\" by(force simp add: fresh_prod)\n      from PTrans cFreshP'' have \"P \\<longmapsto>\\<^sub>la<c> \\<prec> [(x, c)] \\<bullet> P''\" by(simp add: Late_Semantics.alphaBoundResidual)\n      hence \"P \\<parallel> Q \\<longmapsto>\\<^sub>la<c> \\<prec> ([(x, c)] \\<bullet> P'') \\<parallel> Q\" using `c \\<sharp> Q` by(rule Late_Semantics.Par1B)\n      moreover from cFreshQ cFreshP'' P'eqP'' have \"P' \\<parallel> Q = (([(x, c)] \\<bullet> P'') \\<parallel> Q)[c::=u]\"\n        by(simp add: forget renaming name_swap)\n      ultimately show ?case by blast\n    next\n      case(cPar2 Q a u Q' P)\n      have \"\\<exists>Q'' x. Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q'' \\<and> Q' = Q''[x::=u]\" by fact\n      then obtain Q'' x where QTrans: \"Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q''\" and Q'eqQ'': \"Q' = Q''[x::=u]\" by blast\n      have \"\\<exists>c::name. c \\<sharp> (P, Q'')\" by(blast intro: name_exists_fresh)\n      then obtain c::name where cFreshP: \"c \\<sharp> P\" and cFreshQ'': \"c \\<sharp> Q''\" by(force simp add: fresh_prod)\n      from QTrans cFreshQ'' have \"Q \\<longmapsto>\\<^sub>la<c> \\<prec> [(x, c)] \\<bullet> Q''\" by(simp add: Late_Semantics.alphaBoundResidual)\n      hence \"P \\<parallel> Q \\<longmapsto>\\<^sub>la<c> \\<prec> P \\<parallel> ([(x, c)] \\<bullet> Q'')\" using `c \\<sharp> P` by(rule Late_Semantics.Par2B)\n      moreover from cFreshP cFreshQ'' Q'eqQ'' have \"P \\<parallel> Q' = (P \\<parallel> ([(x, c)] \\<bullet> Q''))[c::=u]\"\n        by(simp add: forget renaming name_swap)\n      ultimately show ?case by blast\n    next\n      case(cRes P a u P' y)\n      have \"\\<exists>P'' x. P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      have yinequ: \"y \\<noteq> u\" by fact\n      have \"\\<exists>c::name. c \\<sharp> (y, P'')\" by(blast intro: name_exists_fresh)\n      then obtain c::name where cineqy: \"c \\<noteq> y\" and cFreshP'': \"c \\<sharp> P''\" by(force simp add: fresh_prod)\n      from PTrans cFreshP'' have \"P \\<longmapsto>\\<^sub>la<c> \\<prec> [(x, c)] \\<bullet> P''\" by(simp add: Late_Semantics.alphaBoundResidual)\n      moreover have \"y \\<noteq> a\" by fact\n      ultimately have \"<\\<nu>y>P \\<longmapsto>\\<^sub>la<c> \\<prec> <\\<nu>y>(([(x, c)] \\<bullet> P''))\" using cineqy\n        by(force intro: Late_Semantics.ResB)\n      moreover from cineqy cFreshP'' P'eqP'' yinequ have \"<\\<nu>y>P' = (<\\<nu>y>([(x, c)] \\<bullet> P''))[c::=u]\"\n        by(simp add: renaming name_swap)\n      ultimately show ?case by blast\n    next\n      case(cBang P a u P')\n      have \"\\<exists>P'' x. P \\<parallel> !P \\<longmapsto>\\<^sub>la<x> \\<prec> P'' \\<and> P' = P''[x::=u]\" by fact\n      then obtain P'' x where PTrans: \"P \\<parallel> !P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n      from PTrans have \"!P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" by(rule Late_Semantics.Bang)\n      with P'eqP'' show ?case by blast\n    qed\n  qed\n  with PTrans obtain P'' x where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=u]\" by blast\n  have \"\\<exists>c::name. c \\<sharp> (P'', C)\" by(blast intro: name_exists_fresh)\n  then obtain c::name where cFreshP'': \"c \\<sharp> P''\" and cFreshC: \"c \\<sharp> C\" by force\n  from cFreshP'' PTrans have \"P \\<longmapsto>\\<^sub>la<c> \\<prec>\\<^sub>l ([(x, c)] \\<bullet> P'')\"\n    by(simp add: Late_Semantics.alphaBoundResidual)\n  moreover from cFreshP'' have \"P''[x::=u] = ([(x, c)] \\<bullet> P'')[c::=u]\" by(simp add: renaming name_swap)\n  ultimately show ?thesis using P'eqP'' cFreshC by blast\nqed\n*)\nlemma lateEarlyTau:\n  fixes P  :: pi\n  and   P' :: pi\n\n  assumes \"P \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\"\n\n  shows \"P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\"\nusing assms\nproof(nominal_induct rule: Late_Semantics.tauInduct)\n  case(Tau P)\n  thus ?case by(rule Early_Semantics.Tau)\nnext\n  case(Match P P' a)\n  have \"P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by fact\n  thus \"[a\\<frown>a]P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by(rule Early_Semantics.Match)\nnext\n  case(Mismatch P P' a b)\n  have \"P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by fact\n  moreover have \"a \\<noteq> b\" by fact\n  ultimately show \"[a\\<noteq>b]P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by(rule Early_Semantics.Mismatch)\nnext\n  case(Sum1 P P' Q)\n  have \"P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by fact\n  thus \"P \\<oplus> Q \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by(rule Early_Semantics.Sum1)\nnext\n  case(Sum2 Q Q' P)\n  have \"Q \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e Q'\" by fact\n  thus \"P \\<oplus> Q \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e Q'\" by(rule Early_Semantics.Sum2)\nnext\n  case(Par1 P P' Q)\n  have \"P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by fact\n  thus \"P \\<parallel> Q \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P' \\<parallel> Q\" by(rule Early_Semantics.Par1F)\nnext\n  case(Par2 Q Q' P)\n  have \"Q \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e Q'\" by fact\n  thus \"P \\<parallel> Q \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P \\<parallel> Q'\" by(rule Early_Semantics.Par2F)\nnext\n  case(Comm1 P a x P' Q b Q')\n  have \"P \\<longmapsto>\\<^sub>ea<b> \\<prec>\\<^sub>e P'[x::=b]\"\n  proof -\n    have \"P \\<longmapsto>\\<^sub>l a<x> \\<prec> P'\" by fact\n    thus ?thesis by(rule lateEarlyInput)\n  qed\n  moreover have \"Q \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e Q'\"\n  proof -\n    have \"Q \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l Q'\" by fact\n    thus ?thesis by(rule lateEarlyOutput)\n  qed\n  ultimately show ?case by(rule Early_Semantics.Comm1)\nnext\n  case(Comm2 P a b P' Q x Q')\n  have \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\"\n  proof -\n    have \"P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\" by fact\n    thus ?thesis by(rule lateEarlyOutput)\n  qed\n  moreover have \"Q \\<longmapsto>\\<^sub>ea<b> \\<prec>\\<^sub>e Q'[x::=b]\"\n  proof -\n    have \"Q \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l Q'\" by fact\n    thus ?thesis by(rule lateEarlyInput)\n  qed\n  ultimately show ?case by(rule Early_Semantics.Comm2)\nnext\n  case(Close1 P a x P' Q y Q')\n  have \"P \\<longmapsto>\\<^sub>ea<y> \\<prec>\\<^sub>e P'[x::=y]\"\n  proof -\n    have \"P \\<longmapsto>\\<^sub>l a<x> \\<prec> P'\" by fact\n    thus ?thesis by(rule lateEarlyInput)\n  qed\n  moreover have \"Q \\<longmapsto>\\<^sub>ea<\\<nu>y> \\<prec> Q'\"\n  proof -\n    have \"Q \\<longmapsto>\\<^sub>la<\\<nu>y> \\<prec>\\<^sub>l Q'\" by fact\n    thus ?thesis by(rule lateEarlyBoundOutput)\n  qed\n  moreover have \"y \\<sharp> P\" by fact\n  ultimately show ?case by(rule Early_Semantics.Close1)\nnext\n  case(Close2 P a y P' Q x Q')\n  have \"P \\<longmapsto>\\<^sub>ea<\\<nu>y> \\<prec> P'\"\n  proof -\n    have \"P \\<longmapsto>\\<^sub>la<\\<nu>y> \\<prec>\\<^sub>l P'\" by fact\n    thus ?thesis by(rule lateEarlyBoundOutput)\n  qed\n  moreover have \"Q \\<longmapsto>\\<^sub>ea<y> \\<prec>\\<^sub>e Q'[x::=y]\"\n  proof -\n    have \"Q \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l Q'\" by fact\n    thus ?thesis by(rule lateEarlyInput)\n  qed\n  moreover have \"y \\<sharp> Q\" by fact\n  ultimately show ?case by(rule Early_Semantics.Close2)\nnext\n  case(Res P P' x)\n  have \"P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by fact\n  thus ?case by(force intro: Early_Semantics.ResF)\nnext\n  case(Bang P P')\n  have \"P \\<parallel> !P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by fact\n  thus ?case by(rule Early_Semantics.Bang)\nqed\n\nlemma earlyLateTau:\n  fixes P  :: pi\n  and   P' :: pi\n\n  assumes \"P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\"\n\n  shows \"P \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\"\nusing assms\nproof(nominal_induct rule: Early_Semantics.tauInduct)\n  case(Tau P)\n  thus ?case by(rule Late_Semantics.Tau)\nnext\n  case(Match P P' a)\n  have \"P \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\" by fact\n  thus ?case by(rule Late_Semantics.Match)\nnext\n  case(Mismatch P P' a b)\n  have \"P \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\" by fact\n  moreover have \"a \\<noteq> b\" by fact\n  ultimately show ?case by(rule Late_Semantics.Mismatch)\nnext\n  case(Sum1 P P' Q)\n  have \"P \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\" by fact\n  thus ?case by(rule Late_Semantics.Sum1)\nnext\n  case(Sum2 Q Q' P)\n  have \"Q \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l Q'\" by fact\n  thus ?case by(rule Late_Semantics.Sum2)\nnext\n  case(Par1 P P' Q)\n  have \"P \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\" by fact\n  thus ?case by(rule Late_Semantics.Par1F)\nnext\n  case(Par2 Q Q' P)\n  have \"Q \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l Q'\" by fact\n  thus ?case by(rule Late_Semantics.Par2F)\nnext\n  case(Comm1 P a b P' Q Q')\n  have \"P \\<longmapsto>\\<^sub>ea<b> \\<prec>\\<^sub>e P'\" by fact\n  moreover obtain x::name  where \"x \\<sharp> P\" by(generate_fresh \"name\") auto\n  ultimately obtain P'' where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and P'eqP'': \"P' = P''[x::=b]\"\n    by(blast dest: earlyLateInput)\n  have \"Q \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e Q'\" by fact\n  hence \"Q \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l Q'\" by(rule earlyLateOutput)\n  with PTrans P'eqP'' show ?case\n    by(blast intro: Late_Semantics.Comm1)\nnext\n  case(Comm2 P a b P' Q Q')\n  have \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\" by fact\n  hence QTrans: \"P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\" by(rule earlyLateOutput)\n  have \"Q \\<longmapsto>\\<^sub>ea<b> \\<prec>\\<^sub>e Q'\" by fact\n  moreover obtain x::name  where \"x \\<sharp> Q\" by(generate_fresh \"name\") auto\n  ultimately obtain Q'' x where \"Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q''\" and \"Q' = Q''[x::=b]\"\n    by(blast dest: earlyLateInput)\n  with QTrans show ?case\n    by(blast intro: Late_Semantics.Comm2)\nnext\n  case(Close1 P a x P' Q Q')\n  have  \"P \\<longmapsto>\\<^sub>ea<x> \\<prec>\\<^sub>e P'\" and \"x \\<sharp> P\" by fact+\n  then obtain P'' where \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P''\" and \"P' = P''[x::=x]\"\n    by(blast dest: earlyLateInput)\n  \n  moreover have \"Q \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e Q'\" by fact\n  hence \"Q \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l Q'\" by(rule earlyLateBoundOutput)\n  moreover have \"x \\<sharp> P\" by fact\n  ultimately show ?case\n    by(blast intro: Late_Semantics.Close1)\nnext\n  case(Close2 P a x P' Q Q')\n  have  \"P \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P'\" by fact\n  hence PTrans: \"P \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P'\" by(rule earlyLateBoundOutput)\n\n  have \"Q \\<longmapsto>\\<^sub>ea<x> \\<prec>\\<^sub>e Q'\" and \"x \\<sharp> Q\" by fact+\n  then obtain Q'' y where \"Q \\<longmapsto>\\<^sub>la<x> \\<prec> Q''\" and \"Q' = Q''[x::=x]\"\n    by(blast dest: earlyLateInput)\n  moreover have \"x \\<sharp> Q\" by fact\n  ultimately show ?case using PTrans\n    by(blast intro: Late_Semantics.Close2)\nnext\n  case(Res P P' x)\n  have  \"P \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\" by fact\n  thus ?case by(force intro: Late_Semantics.ResF)\nnext\n  case(Bang P P')\n  have  \"P \\<parallel> !P \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\" by fact\n  thus ?case by(force intro: Late_Semantics.Bang)\nqed\n\nlemma tauEq:\n  fixes P  :: pi\n  and   P' :: pi\n\n  shows \"P \\<longmapsto>\\<^sub>e(Early_Semantics.FreeR Early_Semantics.TauR P') = P \\<longmapsto>\\<tau> \\<prec>\\<^sub>l P'\"\nby(auto intro: earlyLateTau lateEarlyTau)\n\n(****************** Simulation ******************)\n\nabbreviation simLate_judge (\"_ \\<leadsto>\\<^sub>l[_] _\" [80, 80, 80] 80) where \"P \\<leadsto>\\<^sub>l[Rel] Q \\<equiv> Strong_Late_Sim.simulation P Rel Q\"\nabbreviation simEarly_judge (\"_ \\<leadsto>\\<^sub>e[_] _\" [80, 80, 80] 80) where \"P \\<leadsto>\\<^sub>e[Rel] Q \\<equiv> Strong_Early_Sim.strongSimEarly P Rel Q\"\n\nlemma lateEarlySim:\n  fixes P   :: pi\n  and   Q   :: pi\n  and   Rel :: \"(pi \\<times> pi) set\"\n\n  assumes PSimQ: \"P \\<leadsto>\\<^sub>l[Rel] Q\"\n\n  shows \"P \\<leadsto>\\<^sub>e[Rel] Q\"\nproof(induct rule: Strong_Early_Sim.simCases)\n  case(Bound a x Q')\n  have \"Q \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e Q'\" by fact\n  hence \"Q \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l Q'\" by(rule earlyLateBoundOutput)\n  moreover have \"x \\<sharp> P\" by fact\n  ultimately obtain P' where PTrans: \"P \\<longmapsto>\\<^sub>la<\\<nu>x> \\<prec>\\<^sub>l P'\" and P'RelQ': \"(P', Q') \\<in> Rel\" using PSimQ\n    by(force dest: Strong_Late_Sim.simE simp add: derivative_def)\n  from PTrans have \"P \\<longmapsto>\\<^sub>ea<\\<nu>x> \\<prec>\\<^sub>e P'\" by(rule lateEarlyBoundOutput)\n  with P'RelQ' show ?case by blast\nnext\n  case(Free \\<alpha> Q')\n  have \"Q \\<longmapsto>\\<^sub>e Early_Semantics.residual.FreeR \\<alpha> Q'\" by fact\n  thus ?case\n  proof(nominal_induct \\<alpha> rule: freeRes.strong_induct)\n    case(InputR a u)\n    obtain x::name where \"x \\<sharp> Q\" and \"x \\<sharp> P\" by(generate_fresh \"name\") auto\n    with \\<open>Q \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e Q'\\<close> obtain Q'' where QTrans: \"Q \\<longmapsto>\\<^sub>la<x> \\<prec>\\<^sub>l Q''\" and Q'eqQ'': \"Q' = Q''[x::=u]\"\n      by(blast dest: earlyLateInput)\n    from PSimQ QTrans \\<open>x \\<sharp> P\\<close>  obtain P' where PTrans: \"P \\<longmapsto>\\<^sub>la<x> \\<prec> P'\"\n                                          and P'RelQ': \"(P'[x::=u], Q''[x::=u]) \\<in> Rel\"\n      by(force dest: Strong_Late_Sim.simE simp add: derivative_def)\n    from PTrans have \"P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e P'[x::=u]\" by(rule lateEarlyInput)\n    with P'RelQ' Q'eqQ'' show \"\\<exists>P'. P \\<longmapsto>\\<^sub>ea<u> \\<prec>\\<^sub>e P' \\<and> (P', Q') \\<in> Rel\" by blast\n  next\n    case(OutputR a b)\n    from \\<open>Q \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e Q'\\<close> have \"Q \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l Q'\" by(rule earlyLateOutput)\n    with PSimQ obtain P' where PTrans: \"P \\<longmapsto>\\<^sub>la[b] \\<prec>\\<^sub>l P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: Strong_Late_Sim.simE)\n    from PTrans have \"P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P'\" by(rule lateEarlyOutput)\n    with P'RelQ' show \"\\<exists>P'. P \\<longmapsto>\\<^sub>ea[b] \\<prec>\\<^sub>e P' \\<and> (P', Q') \\<in> Rel\"  by blast\n  next\n    case TauR\n    from \\<open>Q \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e Q'\\<close> have \"Q \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l Q'\" by(rule earlyLateTau)\n    with PSimQ obtain P' where PTrans: \"P \\<longmapsto>\\<^sub>l\\<tau> \\<prec>\\<^sub>l P'\" and P'RelQ': \"(P', Q') \\<in> Rel\"\n      by(blast dest: Strong_Late_Sim.simE)\n    from PTrans have \"P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P'\" by(rule lateEarlyTau)\n    with P'RelQ' show \"\\<exists>P'. P \\<longmapsto>\\<^sub>e\\<tau> \\<prec>\\<^sub>e P' \\<and> (P', Q') \\<in> Rel\"  by blast\n  qed\nqed\n\n(*************** Bisimulation ***************)\n\nabbreviation bisimLate_judge (\"_ \\<sim>\\<^sub>l _\" [80, 80] 80) where \"P \\<sim>\\<^sub>l Q \\<equiv> (P, Q) \\<in> Strong_Late_Bisim.bisim\"\nabbreviation bisimEarly_judge (\"_ \\<sim>\\<^sub>e _\" [80, 80] 80) where \"P \\<sim>\\<^sub>e Q \\<equiv> (P, Q) \\<in> Strong_Early_Bisim.bisim\"\n\nlemma lateEarlyBisim:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<sim>\\<^sub>l Q\"\n\n  shows \"P \\<sim>\\<^sub>e Q\"\nusing assms\nby(coinduct rule: Strong_Early_Bisim.weak_coinduct)\n  (auto dest: Strong_Late_Bisim.bisimE Strong_Late_Bisim.symmetric intro: lateEarlySim)\n\n\n(*************** Congruence ***************)\n\nabbreviation congLate_judge (\"_ \\<sim>\\<^sup>s\\<^sub>l _\" [80, 80] 80) where \"P \\<sim>\\<^sup>s\\<^sub>l Q \\<equiv> (P, Q) \\<in> (substClosed Strong_Late_Bisim.bisim)\"\nabbreviation congEarly_judge (\"_ \\<sim>\\<^sup>s\\<^sub>e _\" [80, 80] 80) where \"P \\<sim>\\<^sup>s\\<^sub>e Q \\<equiv> (P, Q) \\<in> (substClosed Strong_Early_Bisim.bisim)\"\n\nlemma lateEarlyCong:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<sim>\\<^sup>s\\<^sub>l Q\"\n\n  shows \"P \\<sim>\\<^sup>s\\<^sub>e Q\"\nusing assms\nby(auto simp add: substClosed_def intro: lateEarlyBisim)\n\nlemma earlyCongStructCong:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<equiv>\\<^sub>s Q\"\n\n  shows \"P \\<sim>\\<^sup>s\\<^sub>e Q\"\nusing assms lateEarlyCong bisimSubstStructCong\nby blast\n\n\nlemma earlyBisimStructCong:\n  fixes P :: pi\n  and   Q :: pi\n\n  assumes \"P \\<equiv>\\<^sub>s Q\"\n\n  shows \"P \\<sim>\\<^sub>e Q\"\nusing assms lateEarlyBisim structCongBisim\nby blast\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Pi_Calculus/Strong_Early_Late_Comp.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5506073655352404, "lm_q1q2_score": 0.3010380535018541}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\ntheory MonadSep\nimports\n  Sep_Algebra_L4v\n  \"Lib.LemmaBucket\"\nbegin\n\nlocale sep_lifted =\n  fixes lft :: \"'a \\<Rightarrow> 's :: sep_algebra\"\nbegin\n\nabbreviation\n  lift :: \"('s \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b\" (\"<_>\")\nwhere\n  \"<P> s \\<equiv> P (lft s)\"\n\nlemma hoare_gen_lifted_asm:\n  \"(P \\<Longrightarrow> \\<lbrace>\\<lambda>s. P' (lft s)\\<rbrace> f \\<lbrace>Q\\<rbrace>) \\<Longrightarrow> \\<lbrace>\\<lambda>s. (P' and K P) (lft s)\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  by (auto intro: hoare_assume_pre)\n\nlemma mapM_x_sep_inv':\n  includes no_pre\n  assumes f:\n   \"\\<And>R x. x \\<in> S \\<Longrightarrow>\n     \\<lbrace>\\<lambda>s.<P x \\<and>* I \\<and>* R> s \\<and> I' s\\<rbrace>\n      f x\n     \\<lbrace>\\<lambda>_ s.<Q x \\<and>* I \\<and>* R> s \\<and> I' s\\<rbrace>\"\n  shows\n   \"set xs \\<subseteq> S \\<Longrightarrow>\n     \\<lbrace>\\<lambda>s.<\\<And>* map P xs \\<and>* I \\<and>* R> s \\<and> I' s\\<rbrace>\n      mapM_x f xs\n     \\<lbrace>\\<lambda>_ s.<\\<And>* map Q xs \\<and>* I \\<and>* R> s \\<and> I' s\\<rbrace>\"\nproof (induct xs arbitrary: R)\n  case Nil\n  thus ?case by (simp add: mapM_x_Nil)\nnext\n  case (Cons x xs)\n  thus ?case\n    apply (simp add: sep_conj_assoc mapM_x_Cons)\n    apply (wp)\n     apply (insert Cons.hyps [where R1=\"Q x ** R\"])[1]\n     apply (simp add: sep_conj_ac)\n    apply (insert f [where R1=\"R ** \\<And>* map P xs\" and x1=x ])[1]\n    apply (simp add: sep_conj_ac)\n    done\nqed\n\nlemmas mapM_x_sep_inv = mapM_x_sep_inv' [OF _ subset_refl]\nlemmas mapM_x_sep = mapM_x_sep_inv [where I' = \\<top>, simplified]\nlemmas mapM_x_sep' = mapM_x_sep [where I=\\<box>, simplified]\n\nlemma mapM_x_set_sep_inv:\n  \"\\<lbrakk>distinct xs; set xs = X; (\\<And>R x. x \\<in> X \\<Longrightarrow> \\<lbrace><P x \\<and>* I \\<and>* R> and I'\\<rbrace> f x \\<lbrace>\\<lambda>_. <Q x \\<and>* I \\<and>* R> and I'\\<rbrace>)\\<rbrakk> \\<Longrightarrow>\n  \\<lbrace><(\\<And>* x \\<in> X. P x) \\<and>* I \\<and>* R> and I'\\<rbrace> mapM_x f xs \\<lbrace>\\<lambda>_. <(\\<And>* x \\<in> X. Q x) \\<and>* I \\<and>* R> and I'\\<rbrace>\"\n  apply (clarsimp simp: pred_conj_def)\n  apply (drule mapM_x_sep_inv [where R=R])\n  apply (subst (asm) sep_list_conj_sep_map_set_conj, assumption)+\n  apply assumption\n  done\n\nlemmas mapM_x_set_sep' = mapM_x_set_sep_inv [where I' = \\<top>, simplified]\n\nlemma mapM_x_set_sep:\n  \"\\<lbrakk>distinct xs; \\<And>R x. x \\<in> set xs \\<Longrightarrow> \\<lbrace><P x \\<and>* I \\<and>* R>\\<rbrace> f x \\<lbrace>\\<lambda>_. <Q x \\<and>* I \\<and>* R>\\<rbrace>\\<rbrakk>\n \\<Longrightarrow> \\<lbrace><(\\<And>* x \\<in> set xs. P x) \\<and>* I \\<and>* R>\\<rbrace> mapM_x f xs \\<lbrace>\\<lambda>_. <(\\<And>* x \\<in> set xs. Q x) \\<and>* I \\<and>* R>\\<rbrace>\"\n  by (erule mapM_x_set_sep', simp+)\n\n(* NOTE: unused *)\nlemma foldM_Cons:\n  \"foldM f (x # xs) acc =\n    do acc' \\<leftarrow> foldM f xs acc;\n       f x acc'\n    od\"\n  by (clarsimp simp: foldM_def)\n\nlemma foldM_sep_inv':\n  includes no_pre\n  assumes f:\n   \"\\<And>R x acc. x \\<in> S \\<Longrightarrow>\n     \\<lbrace>\\<lambda>s. <P x \\<and>* I \\<and>* R> s \\<and> I' s\\<rbrace>\n      f x acc\n     \\<lbrace>\\<lambda>acc' s. <Q x \\<and>* I \\<and>* R> s \\<and> I' s\\<rbrace>\"\n  shows\n   \"set xs \\<subseteq> S \\<Longrightarrow>\n     \\<lbrace>\\<lambda>s. <\\<And>* map P xs \\<and>* I \\<and>* R> s \\<and> I' s\\<rbrace>\n      foldM f xs acc\n     \\<lbrace>\\<lambda>acc' s. <\\<And>* map Q xs \\<and>* I \\<and>* R> s \\<and> I' s\\<rbrace>\"\nproof (induct xs arbitrary: R acc)\n  case Nil\n  thus ?case\n    by (simp add: foldM_def)\nnext\n  case (Cons x xs)\n  thus ?case\n    apply (simp add: sep_conj_assoc foldM_Cons)\n    apply wp\n     apply (insert f[where R1=\"R ** \\<And>* map Q xs\" and x1=x])[1]\n     apply (fastforce simp: sep_conj_ac)\n    apply (insert Cons.hyps [where R1=\"P x ** R\"])[1]\n    apply (clarsimp simp: sep_conj_ac)\n    done\nqed\n\nlemmas foldM_sep_inv = foldM_sep_inv' [OF _ subset_refl]\nlemmas foldM_sep = foldM_sep_inv [where I' = \\<top>, simplified]\nlemmas foldM_sep' = foldM_sep [where I=\\<box>, simplified]\n\nlemma foldM_set_sep_inv:\n  \"\\<lbrakk>distinct xs;\n    set xs = X;\n    \\<And>R x acc. x \\<in> X \\<Longrightarrow> \\<lbrace><P x \\<and>* I \\<and>* R> and I'\\<rbrace> f x acc \\<lbrace>\\<lambda>_. <Q x \\<and>* I \\<and>* R> and I'\\<rbrace>\\<rbrakk> \\<Longrightarrow>\n  \\<lbrace><(\\<And>* x \\<in> X. P x) \\<and>* I \\<and>* R> and I'\\<rbrace>\n   foldM f xs acc\n  \\<lbrace>\\<lambda>_. <(\\<And>* x \\<in> X. Q x) \\<and>* I \\<and>* R> and I'\\<rbrace>\"\n  apply (clarsimp simp: pred_conj_def)\n  apply (drule foldM_sep_inv [where R=R])\n  apply (subst (asm) sep_list_conj_sep_map_set_conj, assumption)+\n  apply assumption\n  done\n\nlemmas foldM_set_sep' = foldM_set_sep_inv [where I' = \\<top>, simplified]\n\nlemma foldM_set_sep:\n  \"\\<lbrakk>distinct xs;\n    \\<And>R x acc. x \\<in> set xs \\<Longrightarrow> \\<lbrace><P x \\<and>* I \\<and>* R>\\<rbrace> f x acc \\<lbrace>\\<lambda>_. <Q x \\<and>* I \\<and>* R>\\<rbrace>\\<rbrakk>\n   \\<Longrightarrow> \\<lbrace><(\\<And>* x \\<in> set xs. P x) \\<and>* I \\<and>* R>\\<rbrace> foldM f xs acc \\<lbrace>\\<lambda>_. <(\\<And>* x \\<in> set xs. Q x) \\<and>* I \\<and>* R>\\<rbrace>\"\n  by (erule foldM_set_sep', simp+)\n\nlemma sep_list_conj_map_singleton_wp:\n  \"\\<lbrakk>x \\<in> set xs; \\<And>R. \\<lbrace><P \\<and>* I x \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* I x \\<and>* R>\\<rbrace>\\<rbrakk>\n  \\<Longrightarrow> \\<lbrace><P \\<and>* \\<And>* map I xs \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* \\<And>* map I xs \\<and>* R>\\<rbrace>\"\n  apply (rule hoare_chain [where P=\"<P \\<and>* I x \\<and>* \\<And>* map I (remove1 x xs) \\<and>* R>\" and\n                                 Q=\"\\<lambda>_. <Q \\<and>* I x \\<and>* \\<And>* map I (remove1 x xs) \\<and>* R>\"])\n    apply fastforce\n   apply (subst (asm) sep_list_conj_map_remove1, assumption)\n   apply (sep_select_asm 3)\n   apply (sep_solve)\n  apply (subst sep_list_conj_map_remove1, sep_solve+)\n  done\n\nlemma sep_set_conj_map_singleton_wp:\n  \"\\<lbrakk>finite xs; x \\<in> xs; \\<And>R. \\<lbrace><P \\<and>* I x \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* I x \\<and>* R>\\<rbrace>\\<rbrakk>\n  \\<Longrightarrow> \\<lbrace><P \\<and>* (\\<And>* x\\<in>xs. I x) \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* (\\<And>* x\\<in>xs. I x) \\<and>* R>\\<rbrace>\"\n  apply (rule hoare_chain [where P=\"<P \\<and>* I x \\<and>* (\\<And>* x\\<in>xs - {x}. I x) \\<and>* R>\" and\n                                 Q=\"\\<lambda>_. <Q \\<and>* I x \\<and>* (\\<And>* x\\<in>xs - {x}. I x) \\<and>* R>\"], assumption)\n   apply (subst (asm) sep.prod.remove, assumption+)\n   apply sep_solve\n  apply (subst sep.prod.remove, assumption+)\n  apply sep_solve\n  done\n\nlemma sep_list_conj_submap_wp:\n  \"\\<lbrakk>set xs \\<subseteq> set ys; distinct xs; distinct ys;\n   \\<And>R. \\<lbrace><P \\<and>* \\<And>* map I xs \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* \\<And>* map I xs \\<and>* R>\\<rbrace>\\<rbrakk>\n  \\<Longrightarrow> \\<lbrace><P \\<and>* \\<And>* map I ys \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* \\<And>* map I ys \\<and>* R>\\<rbrace>\"\n  apply (subst sep_list_con_map_filter [where t=\"\\<lambda>x. x \\<in> set xs\" and xs=ys, THEN sym])\n  apply (subst sep_list_con_map_filter [where t=\"\\<lambda>x. x \\<in> set xs\" and xs=ys, THEN sym])\n  apply (subgoal_tac \"set [x\\<leftarrow>ys . x \\<in> set xs] = set xs\")\n   apply (subst sep_list_conj_eq [where xs=\"[x\\<leftarrow>ys . x \\<in> set xs]\" and ys=xs], clarsimp+)\n   apply (subst sep_list_conj_eq [where xs=\"[x\\<leftarrow>ys . x \\<in> set xs]\" and ys=xs], clarsimp+)\n   apply (clarsimp simp: sep_conj_assoc)\n  apply auto\n  done\n\n(* This just saves some rearranging later. *)\nlemma sep_list_conj_submap_wp':\n  \"\\<lbrakk>set xs \\<subseteq> set ys; distinct xs; distinct ys;\n   \\<And>R. \\<lbrace><P \\<and>* \\<And>* map I xs \\<and>* S \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* \\<And>* map I xs \\<and>* S \\<and>* R>\\<rbrace>\\<rbrakk>\n  \\<Longrightarrow> \\<lbrace><P \\<and>* \\<And>* map I ys \\<and>* S \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* \\<And>* map I ys \\<and>* S \\<and>* R>\\<rbrace>\"\n  apply (cut_tac sep_list_conj_submap_wp [where P=\"P \\<and>* S\" and Q=\"Q \\<and>* S\" and\n       I=I and R=R and ys=ys and xs=xs and f=f])\n  apply (fastforce simp: sep_conj_ac)+\n  done\n\nlemma sep_set_conj_subset_wp:\n  \"\\<lbrakk>xs \\<subseteq> ys; finite xs; finite ys;\n   \\<And>R. \\<lbrace><P \\<and>* (\\<And>* x \\<in> xs. I x) \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* (\\<And>* x \\<in> xs. I x) \\<and>* R>\\<rbrace>\\<rbrakk>\n  \\<Longrightarrow> \\<lbrace><P \\<and>* (\\<And>* x \\<in> ys. I x) \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* (\\<And>* x \\<in> ys. I x) \\<and>* R>\\<rbrace>\"\n  apply (subst sep_map_set_conj_restrict [where t=\"\\<lambda>x. x \\<in> xs\" and xs=ys], assumption)\n  apply (subst sep_map_set_conj_restrict [where t=\"\\<lambda>x. x \\<in> xs\" and xs=ys], assumption)\n  apply (subgoal_tac \"{x \\<in> ys. x \\<in> xs} = xs\")\n   apply (clarsimp simp: sep_conj_assoc)\n  apply auto\n  done\n\n(* This just saves some rearranging later. *)\nlemma sep_set_conj_subset_wp':\n  \"\\<lbrakk>xs \\<subseteq> ys; finite xs; finite ys;\n   \\<And>R. \\<lbrace><P \\<and>* (\\<And>* x \\<in> xs. I x) \\<and>* S \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* (\\<And>* x \\<in> xs. I x) \\<and>* S \\<and>* R>\\<rbrace>\\<rbrakk>\n  \\<Longrightarrow> \\<lbrace><P \\<and>* (\\<And>* x \\<in> ys. I x) \\<and>* S \\<and>* R>\\<rbrace> f \\<lbrace>\\<lambda>_. <Q \\<and>* (\\<And>* x \\<in> ys. I x) \\<and>* S \\<and>* R>\\<rbrace>\"\n  apply (cut_tac sep_set_conj_subset_wp [where P=\"P \\<and>* S\" and Q=\"Q \\<and>* S\" and\n       I=I and R=R and ys=ys and xs=xs and f=f])\n  apply (fastforce simp: sep_conj_ac)+\n  done\n\nend\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/sep_algebra/MonadSep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5467381519846138, "lm_q2_score": 0.5506073655352403, "lm_q1q2_score": 0.30103805350185403}}
{"text": "(*  Title:      Containers/Map_To_Mapping.thy\n    Author:     Andreas Lochbihler, ETH Zurich *)\n\ntheory Map_To_Mapping imports\n  Mapping_Impl\nbegin\n\nsection \\<open>Infrastructure for operation identification\\<close>\n\ntext \\<open>\n  To convert theorems from @{typ \"'a \\<Rightarrow> 'b option\"} to @{typ \"('a, 'b) mapping\"} using lifting / transfer,\n  we first introduce constants for the empty map and map lookup, then apply lifting / transfer,\n  and finally eliminate the non-converted constants again.\n\\<close>\n\ntext \\<open>Dynamic theorem list of rewrite rules that are applied before Transfer.transferred\\<close>\nML \\<open>\nstructure Containers_Pre = Named_Thms\n(\n  val name = @{binding containers_pre}\n  val description = \"Preprocessing rewrite rules in operation identification for Containers\"\n)\n\\<close>\nsetup \\<open>Containers_Pre.setup\\<close>\n\ntext \\<open>Dynamic theorem list of rewrite rules that are applied after Transfer.transferred\\<close>\nML \\<open>\nstructure Containers_Post = Named_Thms\n(\n  val name = @{binding containers_post}\n  val description = \"Postprocessing rewrite rules in operation identification for Containers\"\n)\n\\<close>\nsetup \\<open>Containers_Post.setup\\<close>\n\ncontext includes lifting_syntax\nbegin\n\ndefinition map_empty :: \"'a \\<Rightarrow> 'b option\"\nwhere [code_unfold]: \"map_empty = Map.empty\"\n\ndeclare map_empty_def[containers_post, symmetric, containers_pre]\n\ndeclare Mapping.empty.transfer[transfer_rule del]\n\nlemma map_empty_transfer [transfer_rule]:\n  \"(pcr_mapping A B) map_empty Mapping.empty\"\nunfolding map_empty_def by(rule Mapping.empty.transfer)\n\n\ndefinition map_apply :: \"('a \\<Rightarrow> 'b option) \\<Rightarrow> 'a \\<Rightarrow> 'b option\"\nwhere [code_unfold]: \"map_apply = (\\<lambda>m. m)\"\n\nlemma eq_map_apply: \"m x \\<equiv> map_apply m x\"\nby(simp add: map_apply_def)\n\ndeclare eq_map_apply[symmetric, abs_def, containers_post]\n\ntext \\<open>We cannot use @{thm [source] eq_map_apply} as a fold rule for operator identification,\n  because it would loop. We use a simproc instead.\\<close>\nML \\<open>\nval map_apply_simproc = \n  Simplifier.make_simproc @{context} \"map_apply\"\n   {lhss = [@{term \"f x :: 'a option\"}],\n    proc = fn _ => fn ctxt => fn ct =>\n      (case Thm.term_of ct of\n        Const (@{const_name map_apply}, _) $ _ $ _ => NONE\n      | f $ x => \n          let\n            val cTr = \n              Thm.typ_of_cterm ct\n              |> dest_Type\n              |> snd |> hd\n              |> Thm.ctyp_of ctxt;\n            val cTx = Thm.ctyp_of ctxt (fastype_of x);\n            val cts = map (SOME o Thm.cterm_of ctxt) [f, x];\n          in\n            SOME (Thm.instantiate' [SOME cTr, SOME cTx] cts @{thm eq_map_apply})\n          end\n      | _ => NONE)}\n\\<close>\n\nlemma map_apply_parametric [transfer_rule]:\n  \"((A ===> B) ===> A ===> B) map_apply map_apply\"\nunfolding map_apply_def by(transfer_prover)\n\nlemma map_apply_transfer [transfer_rule]:\n  \"(pcr_mapping A B ===> A ===> rel_option B) map_apply Mapping.lookup\"\nby(auto simp add: pcr_mapping_def cr_mapping_def Mapping.lookup_def map_apply_def dest: rel_funD)\n\n\ndefinition map_update :: \"'a \\<Rightarrow> 'b option \\<Rightarrow> ('a \\<Rightarrow> 'b option) \\<Rightarrow> ('a \\<Rightarrow> 'b option)\"\nwhere \"map_update x y f = f(x := y)\"\n\nlemma map_update_parametric [transfer_rule]:\n  assumes [transfer_rule]: \"bi_unique A\"\n  shows \"(A ===> rel_option B ===> (A ===> rel_option B) ===> (A ===> rel_option B)) map_update map_update\"\nunfolding map_update_def[abs_def] by transfer_prover\n\ncontext begin\nlocal_setup \\<open>Local_Theory.map_background_naming (Name_Space.mandatory_path \"Mapping\")\\<close>\n\nlift_definition update' :: \"'a \\<Rightarrow> 'b option \\<Rightarrow> ('a, 'b) mapping \\<Rightarrow> ('a, 'b) mapping\"\nis map_update parametric map_update_parametric .\n\nlemma update'_code [simp, code, code_unfold]:\n  \"update' x None = Mapping.delete x\"\n  \"update' x (Some y) = Mapping.update x y\"\nby(transfer, simp add: map_update_def fun_eq_iff)+\n\nend\n\ndeclare map_update_def[abs_def, containers_post] map_update_def[symmetric, containers_pre]\n\n\ndefinition map_is_empty :: \"('a \\<Rightarrow> 'b option) \\<Rightarrow> bool\"\nwhere \"map_is_empty m \\<longleftrightarrow> m = Map.empty\"\n\nlemma map_is_empty_folds:\n  \"m = map_empty \\<longleftrightarrow> map_is_empty m\"\n  \"map_empty = m \\<longleftrightarrow> map_is_empty m\"\nby(auto simp add: map_is_empty_def map_empty_def)\n\ndeclare map_is_empty_folds[containers_pre]\n  map_is_empty_def[abs_def, containers_post]\n\nlemma map_is_empty_transfer [transfer_rule]:\n  assumes \"bi_total A\"\n  shows \"(pcr_mapping A B ===> (=)) map_is_empty Mapping.is_empty\"\nunfolding map_is_empty_def[abs_def] Mapping.is_empty_def[abs_def] dom_eq_empty_conv[symmetric]\nby(rule rel_funI)+(auto simp del: dom_eq_empty_conv dest: rel_setD2 rel_setD1 Mapping.keys.transfer[THEN rel_funD, OF assms])\n\nend\n\nML \\<open>\nsignature CONTAINERS = sig\n  val identify : Context.generic -> thm -> thm;\n  val identify_attribute : attribute;\nend\n\nstructure Containers: CONTAINERS =\nstruct\n\nfun identify context thm =\n  let\n    val ctxt' = Context.proof_of context\n    val ss = put_simpset HOL_basic_ss ctxt'\n    val ctxt1 = ss addsimps Containers_Pre.get ctxt' addsimprocs [map_apply_simproc]\n    val ctxt2 = ss addsimps Containers_Post.get ctxt'\n\n    (* Hack to recover Transfer.transferred function from attribute *)\n    fun transfer_transferred thm = Transfer.transferred_attribute [] (context, thm) |> snd |> the\n  in\n    thm\n    |> full_simplify ctxt1\n    |> transfer_transferred\n    |> full_simplify ctxt2\n  end\n\nval identify_attribute = Thm.rule_attribute [] identify\n\nend\n\\<close>\n\nattribute_setup \"containers_identify\" =\n  \\<open>Scan.succeed Containers.identify_attribute\\<close>\n  \"Transfer theorems for operator identification in Containers\"\n\nhide_const (open) map_apply map_empty map_is_empty map_update\nhide_fact (open) map_apply_def map_empty_def eq_map_apply\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Evaluation/Containers/Map_To_Mapping.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632979641571, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.30100166523213717}}
{"text": "(*\nCopyright 2009-2014 Christian Sternagel, René Thiemann\n\nThis file is part of IsaFoR/CeTA.\n\nIsaFoR/CeTA is free software: you can redistribute it and/or modify it under the\nterms of the GNU Lesser General Public License as published by the Free Software\nFoundation, either version 3 of the License, or (at your option) any later\nversion.\n\nIsaFoR/CeTA is distributed in the hope that it will be useful, but WITHOUT ANY\nWARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A\nPARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public License along\nwith IsaFoR/CeTA. If not, see <http://www.gnu.org/licenses/>.\n*)\n\nsection \\<open>Converting Values to Readable Strings\\<close>\n\ntheory Old_Show\nimports Main\nkeywords \"standard_shows_list\" :: thy_decl\nbegin\n\ntext \\<open>\n  A type class similar to Haskell's \\texttt{Show} class, allowing for constant-time concatenation of\n  @{type string}s using function composition.\n\\<close>\n\ntype_synonym\n  \"shows\" = \"string \\<Rightarrow> string\"\n\ntext \\<open>\n  Convert a string to a show-function that simply prepends the string unchanged.\n\\<close>\ndefinition shows_string :: \"string \\<Rightarrow> shows\"\nwhere\n  \"shows_string = (@)\"\n\nclass \"show\" =\n  fixes shows_prec :: \"nat \\<Rightarrow> 'a \\<Rightarrow> shows\"\n    and shows_list :: \"'a list \\<Rightarrow> shows\"\n  assumes assoc [simp]:\n    \"shows_prec d x r @ s = shows_prec d x (r @ s)\"\n    \"shows_list xs r @ s = shows_list xs (r @ s)\"\nbegin\n\nabbreviation \"shows\" :: \"'a \\<Rightarrow> shows\"\nwhere\n  \"shows x \\<equiv> shows_prec 0 x\"\n\nabbreviation \"show\" :: \"'a \\<Rightarrow> string\"\nwhere\n  \"show x \\<equiv> shows x ''''\"\n\nend\n\nabbreviation shows_cons :: \"string \\<Rightarrow> shows \\<Rightarrow> shows\" (infixr \"+#+\" 10)\nwhere\n  \"s +#+ p \\<equiv> shows_string s \\<circ> p\"\n\nabbreviation (input) shows_append :: \"shows \\<Rightarrow> shows \\<Rightarrow> shows\" (infixr \"+@+\" 10)\nwhere\n  \"s +@+ p \\<equiv> s \\<circ> p\"\n\ndefinition shows_between :: \"shows \\<Rightarrow> shows \\<Rightarrow> shows \\<Rightarrow> shows\"\nwhere\n  \"shows_between l p r = (l +@+ p +@+ r)\"\n\nfun shows_sep :: \"('a \\<Rightarrow> shows) \\<Rightarrow> shows \\<Rightarrow> 'a list \\<Rightarrow> shows\"\nwhere\n  \"shows_sep s sep [] = shows_string ''''\" |\n  \"shows_sep s sep [x] = s x\" |\n  \"shows_sep s sep (x#xs) = (s x +@+ sep +@+ shows_sep s sep xs)\"\n\nlemma shows_sep_assoc [simp]:\n  assumes \"\\<And>r s. \\<forall>x\\<in>set xs. elt x r @ s = elt x (r @ s)\"\n    and \"\\<And>r s. sep r @ s = sep (r @ s)\"\n  shows \"shows_sep elt sep xs r @ s = shows_sep elt sep xs (r @ s)\"\nusing assms\nproof (induct xs)\n  case (Cons x xs) then show ?case by (cases xs) (simp_all)\nqed (simp add: shows_string_def)\n\nlemma shows_string_assoc [simp]:\n  \"shows_string x r @ s = shows_string x (r @ s)\"\n  by (simp add: shows_string_def)\n\nlemma shows_between_assoc [simp]:\n  assumes \"\\<And>s t. l s @ t = l (s @ t)\"\n    and \"\\<And>s t. m s @ t = m (s @ t)\"\n    and \"\\<And>s t. r s @ t = r (s @ t)\"\n  shows \"shows_between l m r s @ t = shows_between l m r (s @ t)\"\n  using assms by (simp add: shows_between_def)\n\ndefinition\n  shows_list_gen :: \"('a \\<Rightarrow> shows) \\<Rightarrow> string \\<Rightarrow> string \\<Rightarrow> string \\<Rightarrow> string \\<Rightarrow> 'a list \\<Rightarrow> shows\"\nwhere\n  \"shows_list_gen elt e l s r xs = (\n    if xs = [] then shows_string e\n    else shows_between (shows_string l) (shows_sep elt (shows_string s) xs) (shows_string r))\"\n\nlemma shows_list_gen_assoc [simp]:\n  assumes \"\\<And>r s. \\<forall>x\\<in>set xs. elt x r @ s = elt x (r @ s)\"\n  shows \"shows_list_gen elt e l sep r xs s @ t = shows_list_gen elt e l sep r xs (s @ t)\"\n  using assms by (cases xs) (simp_all add: shows_list_gen_def)\n\ndefinition shows_list_aux :: \"('a \\<Rightarrow> shows) \\<Rightarrow> 'a list \\<Rightarrow> shows\"\nwhere\n  \"shows_list_aux s xs = shows_list_gen s ''[]'' ''['' '', '' '']'' xs\"\n\nlemma assoc_elt:\n  \"\\<forall>x\\<in>set xs. shows (x::'a::show) r @ s = shows x (r @ s)\"\n  by simp\n\nlemma shows_list_aux_assoc:\n  assumes \"\\<And>r s. \\<forall>x\\<in>set xs. elt x r @ s = elt x (r @ s)\"\n  shows \"shows_list_aux elt xs r @ s = shows_list_aux elt xs (r @ s)\"\n  using assms by (simp add: shows_list_aux_def)\n\nML \\<open>\n(* FIXME export proper ML interfaces: define_shows_list, define_shows_list_cmd *)\nlet \n  fun define_shows_list assoc_thm_ref lthy =\n    let\n      val assoc_thm = singleton (Attrib.eval_thms lthy) assoc_thm_ref\n      fun get_base_type thm =\n        let\n           val lhs = thm |> Thm.prop_of |> HOLogic.dest_Trueprop |> HOLogic.dest_eq |> fst\n           fun get_ty (Const (@{const_name append}, _) $\n             (Const (@{const_name shows_prec}, _) $ _ $ x $ _) $ _) = dest_Var x |> snd\n             | get_ty t = raise TERM (\"Expecting associativity lemma for 'shows_prec'\", [t])\n        in get_ty lhs end\n      val base_ty = get_base_type assoc_thm\n     \n      val list_ty = Type (@{type_name \"list\"}, [base_ty])\n      val shows_ty = @{typ \"shows\"}\n      val shows = Abs (\"x\", base_ty, Const (@{const_name \"shows_prec\"},\n        @{typ nat} --> base_ty --> shows_ty) $ @{term \"0 :: nat\"} $ Bound 0)\n      val shows_list_aux = Const (@{const_name shows_list_aux},\n        (base_ty --> shows_ty) --> list_ty --> shows_ty)\n      val shows_list = Const (@{const_name shows_list}, list_ty --> shows_ty)\n      val rhs = shows_list_aux $ shows\n      val shows_list_eq = Logic.mk_equals (shows_list, rhs)\n     \n      val ((c, _), rhs) = Syntax.check_term lthy shows_list_eq |> Logic.dest_equals |>> dest_Free;\n      val ((_, (_, def_thm')), lthy') =\n        Local_Theory.define\n          ((Binding.name c, NoSyn), ((Binding.name (c ^ \"_def\"), @{attributes [code]}), rhs))\n          lthy\n      val def_thm =\n        Proof_Context.theory_of lthy'\n        |> Proof_Context.init_global\n        |> Proof_Context.export lthy'\n        |> (fn x => singleton x def_thm')\n\n      val lthy'' = Class.prove_instantiation_instance (fn ctxt =>\n        Class.intro_classes_tac ctxt []\n        THEN resolve_tac ctxt [assoc_thm] 1\n        THEN unfold_tac ctxt [def_thm] \n        THEN resolve_tac ctxt @{thms shows_list_aux_assoc} 1\n        THEN resolve_tac ctxt @{thms ballI} 1\n        THEN resolve_tac ctxt [assoc_thm] 1\n        ) lthy'\n    in lthy'' end\nin\n  Outer_Syntax.local_theory @{command_keyword standard_shows_list}\n    \"use standard way to extend shows to shows_list, requires associativity lemma as parameter\"\n    (*standard way: \"shows_list = shows_list_aux shows\"*)\n    (Parse.thm >> define_shows_list)\nend\n\\<close>\n\ninstantiation char :: \"show\"\nbegin\n\ndefinition \"shows_prec d (c::char) = (#) c\"\n\ndefinition \"shows_list (cs::string) = shows_string cs\"\n\ninstance\n  by (intro_classes,unfold shows_prec_char_def shows_list_char_def shows_string_def, simp) auto\n\nend\n\ninstantiation list :: (\"show\") \"show\"\nbegin\n\ndefinition \"shows_prec d (l::'a::show list) = shows_list l\"\n\nlemma assoc_list:\n  \"shows_prec d (x::'a::show list) r @ s = shows_prec d x (r @ s)\"\n  by (simp add: shows_prec_list_def)\n\nstandard_shows_list assoc_list\n\nend\n\ndefinition \"shows_nl = shows ''\\<newline>''\"\n\ndefinition \"shows_space = shows (CHR '' '')\"\n\ndefinition shows_paren :: \"shows \\<Rightarrow> shows\"\nwhere\n  \"shows_paren p = (shows (CHR ''('') +@+ p +@+ shows (CHR '')''))\"\n\nlemmas show_defs =\n  shows_prec_char_def shows_nl_def shows_space_def\n  shows_string_def shows_between_def shows_paren_def\n\ndefinition shows_lines :: \"'a::show list \\<Rightarrow> shows\"\nwhere\n  \"shows_lines = shows_sep shows shows_nl\"\n\ndefinition shows_many :: \"'a::show list \\<Rightarrow> shows\"\nwhere\n  \"shows_many = shows_sep shows id\"\n\ndefinition shows_words :: \"'a::show list \\<Rightarrow> shows\"\nwhere\n  \"shows_words = shows_sep shows shows_space\"\n\nfun shows_map :: \"('a \\<Rightarrow> shows) \\<Rightarrow> 'a list \\<Rightarrow> shows\"\nwhere\n  \"shows_map s [] = id\" |\n  \"shows_map s (x # xs) = (s x +@+ shows_map s xs)\"\n\nlemma shows_nl_assoc [simp]:\n  \"shows_nl r @ s = shows_nl (r @ s)\"\n  by (simp add: show_defs)\n\nlemma shows_id_assoc [simp]:\n  \"id r @ s = id (r @ s)\" by simp\n\nlemma shows_space_assoc [simp]:\n  \"shows_space r @ s = shows_space (r @ s)\"\n  by (simp add: show_defs)\n\nlemma shows_lines_assoc [simp]:\n  \"shows_lines xs r @ s = shows_lines xs (r @ s)\"\n  by (simp add: shows_lines_def)\n\nlemma shows_many_assoc [simp]:\n  \"shows_many xs r @ s = shows_many xs (r @ s)\"\n  by (simp add: shows_many_def)\n\nlemma shows_words_assoc [simp]:\n  \"shows_words xs r @ s = shows_words xs (r @ s)\"\n  by (simp add: shows_words_def)\n\nlemma shows_map_assoc [simp]:\n  assumes \"\\<And>r s.\\<forall>x\\<in>set xs. elt x r @ s = elt x (r @ s)\"\n  shows \"shows_map elt xs r @ s = shows_map elt xs (r @ s)\"\n  using assms by (induct xs) auto\n\nfun shows_concat :: \"shows list \\<Rightarrow> shows\"\nwhere\n  \"shows_concat [] = id\" |\n  \"shows_concat (s # ss) = (s +@+ shows_concat ss)\"\n\nlemma shows_map_cong [fundef_cong]:\n  assumes \"xs = ys\" and \"\\<And>x. x \\<in> set ys \\<Longrightarrow> f x = g x\"\n  shows \"shows_map f xs = shows_map g ys\"\n  using assms by (induct xs arbitrary: ys) auto\n\nlemma shows_sep_cong [fundef_cong]:\n  assumes \"xs = ys\" and \"\\<And>x. x \\<in> set ys \\<Longrightarrow> f x = g x\"\n  shows \"shows_sep f sep xs = shows_sep g sep ys\"\n  unfolding assms(1) using assms(2)\nproof (induct ys)\n  case (Cons y ys)\n  thus ?case by (cases ys) auto\nqed auto\n\nlemma shows_list_gen_cong [fundef_cong]:\n  assumes \"xs = ys\" and \"\\<And>x. x \\<in> set ys \\<Longrightarrow> f x = g x\"\n  shows \"shows_list_gen f e l sep r xs = shows_list_gen g e l sep r ys\"\n  using shows_sep_cong [of xs ys f g] assms by (cases xs) (auto simp: shows_list_gen_def)\n\ndefinition shows_quote :: \"shows \\<Rightarrow> shows\"\nwhere\n  \"shows_quote s = shows_between (shows (CHR 0x27)) s (shows (CHR 0x27))\"\n\ntext \\<open>\n  Don't use Haskell's existing \"Show\" class for code-generation, since it is not compatible to the\n  formalized class.\n\\<close>\ncode_reserved Haskell \"Show\"\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Show/Old_Datatype/Old_Show.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632979641571, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.30100166523213717}}
{"text": "section\\<open>Temporal Properties\\<close>\ntext\\<open>This theory presents some examples of temporal properties over the simple drinks machine.\\<close>\n\ntheory Drinks_Machine_LTL\nimports \"Drinks_Machine\" \"Extended_Finite_State_Machines.EFSM_LTL\"\nbegin\n\ndeclare One_nat_def [simp del]\n\nlemma P_ltl_step_0:\n  assumes invalid: \"P (None, [], <>)\"\n  assumes select: \"l = STR ''select'' \\<longrightarrow> P (Some 1, [], <1 $:= Some (hd i), 2 $:= Some (Num 0)>)\"\n  shows \"P (ltl_step drinks (Some 0) <> (l, i))\"\nproof-\n  have length_i: \"\\<exists>d. (l, i) = (STR ''select'', [d]) \\<Longrightarrow> length i = 1\"\n    by (induct i, auto)\n  have length_i_2: \"\\<forall>d. i \\<noteq> [d] \\<Longrightarrow> length i \\<noteq> 1\"\n    by (induct i, auto)\n  show ?thesis\n    apply (case_tac \"\\<exists>d. (l, i) = (STR ''select'', [d])\")\n     apply (simp add: possible_steps_0 length_i select_def apply_updates_def)\n    using select apply auto[1]\n    by (simp add: possible_steps_0_invalid length_i_2 invalid)\nqed\n\nlemma P_ltl_step_1:\n  assumes invalid: \"P (None, [], r)\"\n  assumes coin: \"l = STR ''coin'' \\<longrightarrow> P (Some 1, [value_plus (r $ 2) (Some (hd i))], r(2 $:= value_plus (r $ 2) (Some (i ! 0))))\"\n  assumes vend_fail: \"value_gt (Some (Num 100)) (r $ 2) = trilean.true \\<longrightarrow> P (Some 1, [],r)\"\n  assumes vend: \"\\<not>? value_gt (Some (Num 100)) (r $ 2) = trilean.true \\<longrightarrow> P (Some 2, [r$1], r)\"\n  shows \"P (ltl_step drinks (Some 1) r (l, i))\"\nproof-\n  have length_i: \"\\<And>s. \\<exists>d. (l, i) = (s, [d]) \\<Longrightarrow> length i = 1\"\n    by (induct i, auto)\n  have length_i_2: \"\\<forall>d. i \\<noteq> [d] \\<Longrightarrow> length i \\<noteq> 1\"\n    by (induct i, auto)\n  show ?thesis\n    apply (case_tac \"\\<exists>d. (l, i) = (STR ''coin'', [d])\")\n     apply (simp add: possible_steps_1_coin length_i coin_def apply_outputs_def apply_updates_def)\n    using coin apply auto[1]\n    apply (case_tac \"(l, i) = (STR ''vend'', [])\")\n     apply (case_tac \"\\<exists>n. r $ 2 = Some (Num n)\")\n      apply clarsimp\n    subgoal for n\n      apply (case_tac \"n \\<ge> 100\")\n       apply (simp add: drinks_vend_sufficient vend_def apply_updates_def apply_outputs_def)\n       apply (metis finfun_upd_triv possible_steps_2_vend vend vend_ge_100)\n      apply (simp add: drinks_vend_insufficient vend_fail_def apply_updates_def apply_outputs_def)\n      apply (metis MaybeBoolInt.simps(1) finfun_upd_triv not_less value_gt_def vend_fail)\n      done\n     apply (simp add: drinks_vend_invalid invalid)\n    by (simp add: drinks_no_possible_steps_1 length_i_2 invalid)\nqed\n\nlemma LTL_r2_not_always_gt_100: \"not (alw (check_exp (Gt (V (Rg 2)) (L (Num 100))))) (watch drinks i)\"\n  using value_gt_def by auto\n\nlemma drinks_step_2_none: \"ltl_step drinks (Some 2) r e = (None, [], r)\"\n  by (simp add: drinks_end ltl_step_none_2)\n\nlemma one_before_two_2:\n  \"alw (\\<lambda>x. statename (shd (stl x)) = Some 2 \\<longrightarrow> statename (shd x) = Some 1) (make_full_observation drinks (Some 2) r [r $ 1] x2a)\"\nproof(coinduction)\n  case alw\n  then show ?case\n    apply (simp add: drinks_step_2_none)\n    by (metis (mono_tags, lifting) alw_mono nxt.simps once_none_nxt_always_none option.distinct(1))\nqed\n\nlemma one_before_two_aux:\n  assumes \"\\<exists> p r i. j = nxt (make_full_observation drinks (Some 1) r p) i\"\n  shows \"alw (\\<lambda>x. nxt (state_eq (Some 2)) x \\<longrightarrow> state_eq (Some 1) x) j\"\n  using assms apply(coinduct)\n  apply simp\n  apply clarify\n  apply standard\n   apply simp\n  apply simp\n  subgoal for r i\n    apply (case_tac \"shd (stl i)\")\n    apply (simp del: ltl_step.simps)\n    apply (rule P_ltl_step_1)\n       apply (rule disjI2)\n       apply (rule alw_mono[of \"nxt (state_eq None)\"])\n        apply (simp add: once_none_nxt_always_none)\n       apply simp\n      apply auto[1]\n     apply auto[1]\n    apply simp\n    by (simp add: one_before_two_2)\n  done\n\nlemma LTL_nxt_2_means_vend:\n  \"alw (nxt (state_eq (Some 2)) impl (state_eq (Some 1))) (watch drinks i)\"\nproof(coinduction)\n  case alw\n  then show ?case\n    apply (case_tac \"shd i\")\n    apply (simp del: ltl_step.simps)\n    apply (rule P_ltl_step_0)\n     apply simp\n     apply (rule disjI2)\n     apply (rule alw_mono[of \"nxt (state_eq None)\"])\n      apply (simp add: once_none_nxt_always_none)\n    using one_before_two_aux by auto\nqed\n\nlemma costsMoney_aux:\n  assumes \"\\<exists>p r i. j = (nxt (make_full_observation drinks (Some 1) r p) i)\"\n  shows \"alw (\\<lambda>xs. nxt (state_eq (Some 2)) xs \\<longrightarrow> check_exp (Ge (V (Rg 2)) (L (Num 100))) xs) j\"\n  using assms apply coinduct\n  apply clarsimp\n  subgoal for r i\n    apply (case_tac \"shd (stl i)\")\n    apply (simp del: ltl_step.simps)\n    apply (rule P_ltl_step_1)\n       apply simp\n       apply (rule disjI2)\n       apply (rule alw_mono[of \"nxt (state_eq None)\"])\n        apply (simp add: once_none_nxt_always_none)\n       apply simp\n      apply auto[1]\n     apply auto[1]\n    apply simp\n    apply standard\n    apply (rule disjI2)\n    apply (rule alw_mono[of \"nxt (state_eq None)\"])\n     apply (metis (no_types, lifting) drinks_step_2_none fst_conv make_full_observation.sel(2) nxt.simps nxt_alw once_none_always_none_aux)\n    by simp\n  done\n\n(* costsMoney: THEOREM drinks |- G(X(cfstate=State_2) => gval(value_ge(r_2, Some(NUM(100))))); *)\nlemma LTL_costsMoney:\n  \"(alw (nxt (state_eq (Some 2)) impl (check_exp (Ge (V (Rg 2)) (L (Num 100)))))) (watch drinks i)\"\nproof(coinduction)\n  case alw\n  then show ?case\n    apply (cases \"shd i\")\n    subgoal for l ip\n      apply (case_tac \"l = STR ''select'' \\<and> length ip = 1\")\n       defer\n       apply (simp add: possible_steps_0_invalid)\n       apply (rule disjI2)\n       apply (rule alw_mono[of \"nxt (state_eq None)\"])\n        apply (simp add: once_none_nxt_always_none)\n       apply simp\n      apply (simp add: possible_steps_0 select_def)\n      apply (rule disjI2)\n      apply (simp only: nxt.simps[symmetric])\n      using costsMoney_aux by auto\n    done\nqed\n\nlemma LTL_costsMoney_aux:\n  \"(alw (not (check_exp (Ge (V (Rg 2)) (L (Num 100)))) impl (not (nxt (state_eq (Some 2)))))) (watch drinks i)\"\n  by (metis (no_types, lifting) LTL_costsMoney alw_mono)\n\nlemma implode_select: \"String.implode ''select'' = STR ''select''\"\n  by (metis Literal.rep_eq String.implode_explode_eq zero_literal.rep_eq)\n\nlemma implode_coin: \"String.implode ''coin'' = STR ''coin''\"\n  by (metis Literal.rep_eq String.implode_explode_eq zero_literal.rep_eq)\n\nlemma implode_vend: \"String.implode ''vend'' = STR ''vend''\"\n  by (metis Literal.rep_eq String.implode_explode_eq zero_literal.rep_eq)\n\nlemmas implode_labels = implode_select implode_coin implode_vend\n\nlemma LTL_neverReachS2:\"(((((action_eq (''select'', [Str ''coke''])))\n                    aand\n                    (nxt ((action_eq (''coin'', [Num 100])))))\n                    aand\n                    (nxt (nxt((label_eq ''vend'' aand (input_eq []))))))\n                    impl\n                    (nxt (nxt (nxt (state_eq (Some 2))))))\n                    (watch drinks i)\"\n  apply (simp add: implode_labels)\n  apply (cases i)\n  apply clarify  \n  apply simp\n  apply (simp add: possible_steps_0 select_def)\n  apply (case_tac \"shd x2\", clarify)\n  apply (simp add: possible_steps_1_coin coin_def value_plus_def finfun_update_twist apply_updates_def)\n  apply (case_tac \"shd (stl x2)\", clarify)\n  by (simp add: drinks_vend_sufficient )\n\nlemma ltl_step_not_select:\n  \"\\<nexists>i. e = (STR ''select'', [i]) \\<Longrightarrow>\n   ltl_step drinks (Some 0) r e = (None, [], r)\"\n  apply (cases e, clarify)\n  subgoal for a b\n    apply (rule ltl_step_none)\n    apply (simp add: possible_steps_empty drinks_def can_take_transition_def can_take_def select_def)\n    by (cases e, case_tac b, auto)\n  done\n\nlemma ltl_step_select:\n  \"ltl_step drinks (Some 0) <> (STR ''select'', [i]) = (Some 1, [], <1 $:= Some i, 2 $:= Some (Num 0)>)\"\n  apply (rule  ltl_step_some[of _ _ _ _ _ _ select])\n    apply (simp add: possible_steps_0)\n   apply (simp add: select_def)\n  by (simp add: select_def finfun_update_twist apply_updates_def)\n\nlemma ltl_step_not_coin_or_vend:\n  \"\\<nexists>i. e = (STR ''coin'', [i]) \\<Longrightarrow>\n    e \\<noteq> (STR ''vend'', []) \\<Longrightarrow>\n    ltl_step drinks (Some 1) r e = (None, [], r)\"\n  apply (cases e)\n  subgoal for a b\n    apply (simp del: ltl_step.simps)\n    apply (rule ltl_step_none)\n    apply (simp add: possible_steps_empty drinks_def can_take_transition_def can_take_def transitions)\n    by (case_tac e, case_tac b, auto)\n  done\n\nlemma ltl_step_coin:\n  \"\\<exists>p r'. ltl_step drinks (Some 1) r (STR ''coin'', [i]) = (Some 1, p, r')\"\n  by (simp add: possible_steps_1_coin)\n\nlemma alw_tl:\n  \"alw \\<phi> (make_full_observation e (Some 0) <> [] xs) \\<Longrightarrow>\n    alw \\<phi>\n     (make_full_observation e (fst (ltl_step e (Some 0) <> (shd xs))) (snd (snd (ltl_step e (Some 0) <> (shd xs))))\n       (fst (snd (ltl_step e (Some 0) <> (shd xs)))) (stl xs))\"\n  by auto\n\nlemma stop_at_none:\n  \"alw (\\<lambda>xs. output (shd (stl xs)) = [Some (EFSM.Str drink)] \\<longrightarrow> check_exp (Ge (V (Rg 2)) (L (Num 100))) xs)\n            (make_full_observation drinks None r p t)\"\n  apply (rule alw_mono[of \"nxt (output_eq [])\"])\n   apply (simp add: no_output_none_nxt)\n  by simp\n\nlemma drink_costs_money_aux:\n  assumes \"\\<exists>p r t. j = make_full_observation drinks (Some 1) r p t\"\n  shows \"alw (\\<lambda>xs. output (shd (stl xs)) = [Some (EFSM.Str drink)] \\<longrightarrow> check_exp (Ge (V (Rg 2)) (L (Num 100))) xs) j\"\n  using assms apply coinduct\n  apply clarsimp\n  apply (case_tac \"shd t\")\n  apply (simp del: ltl_step.simps)\n  apply (rule P_ltl_step_1)\n     apply simp\n     apply (rule disjI2)\n     apply (rule alw_mono[of \"nxt (output_eq [])\"])\n      apply (simp add: no_output_none_nxt)\n     apply simp\n    apply (simp add: Str_def value_plus_never_string)\n    apply auto[1]\n   apply auto[1]\n  apply simp\n  apply standard\n  apply (rule disjI2)\n  apply (rule alw_mono[of \"nxt (output_eq [])\"])\n   apply (simp add: drinks_step_2_none no_output_none_if_empty nxt_alw)\n  by simp\n\nlemma LTL_drinks_cost_money:\n  \"alw (nxt (output_eq [Some (Str drink)]) impl (check_exp (Ge (V (Rg 2)) (L (Num 100))))) (watch drinks t)\"\nproof(coinduction)\n  case alw\n  then show ?case\n    apply (case_tac \"shd t\")\n    apply (simp del: ltl_step.simps)\n    apply (rule P_ltl_step_0)\n     apply simp\n     apply (rule disjI2)\n     apply (rule alw_mono[of \"nxt (output_eq [])\"])\n      apply (simp add: no_output_none_nxt)\n     apply simp\n    apply simp\n    using drink_costs_money_aux\n    apply simp\n    by blast\nqed\n\nlemma steps_1_invalid:\n      \"\\<nexists>i. (a, b) = (STR ''coin'', [i]) \\<Longrightarrow>\n       \\<nexists>i. (a, b) = (STR ''vend'', []) \\<Longrightarrow>\n       possible_steps drinks 1 r a b = {||}\"\n  apply (simp add: possible_steps_empty drinks_def transitions can_take_transition_def can_take_def)\n  by (induct b, auto)\n\nlemma output_vend_aux:\n  assumes \"\\<exists>p r t. j = make_full_observation drinks (Some 1) r p t\"\n  shows \"alw (\\<lambda>xs. label_eq ''vend'' xs \\<and> output (shd (stl xs)) = [Some d] \\<longrightarrow> check_exp (Ge (V (Rg 2)) (L (Num 100))) xs) j\"\n  using assms apply coinduct\n  apply clarsimp\n  subgoal for r t\n    apply (case_tac \"shd t\")\n    apply (simp add: implode_vend del: ltl_step.simps)\n    apply (rule P_ltl_step_1)\n       apply simp\n       apply (rule disjI2)\n       apply (rule alw_mono[of \"nxt (output_eq [])\"])\n        apply (simp add: no_output_none_nxt)\n       apply simp\n      apply auto[1]\n     apply auto[1]\n    apply simp\n    apply standard\n    apply (rule disjI2)\n    apply (rule alw_mono[of \"nxt (output_eq [])\"])\n     apply (simp add: drinks_step_2_none no_output_none_if_empty nxt_alw)\n    by simp\n  done\n\ntext_raw\\<open>\\snip{outputVend}{1}{2}{%\\<close>\nlemma LTL_output_vend:\n  \"alw (((label_eq ''vend'') aand (nxt (output_eq [Some d]))) impl\n         (check_exp (Ge (V (Rg 2)) (L (Num 100))))) (watch drinks t)\"\ntext_raw\\<open>}%endsnip\\<close>\nproof(coinduction)\n  case alw\n  then show ?case\n    apply (simp add: implode_vend)\n    apply (case_tac \"shd t\")\n    apply (simp del: ltl_step.simps)\n    apply (rule P_ltl_step_0)\n     apply simp\n    apply (rule disjI2)\n     apply (rule alw_mono[of \"nxt (output_eq [])\"])\n      apply (simp add: no_output_none_nxt)\n     apply simp\n    apply simp\n    subgoal for a b\n      using output_vend_aux[of \"(make_full_observation drinks (Some 1)\n              <1 $:= Some (hd b), 2 $:= Some (Num 0)> [] (stl t))\" d]\n      using implode_vend by auto\n    done\nqed\n\ntext_raw\\<open>\\snip{outputVendUnfolded}{1}{2}{%\\<close>\nlemma LTL_output_vend_unfolded:\n  \"alw (\\<lambda>xs. (label (shd xs) = STR ''vend'' \\<and>\n             nxt (\\<lambda>s. output (shd s) = [Some d]) xs) \\<longrightarrow>\n              \\<not>? value_gt (Some (Num 100)) (datastate (shd xs) $ 2) = trilean.true)\n     (watch drinks t)\"\ntext_raw\\<open>}%endsnip\\<close>\n  apply (insert LTL_output_vend[of d t])\n  by (simp add: implode_vend)\n\nend\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Extended_Finite_State_Machines/examples/Drinks_Machine_LTL.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.542863297964157, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.3010016652321371}}
{"text": "(* \n   Title: Psi-calculi   \n   Author/Maintainer: Jesper Bengtson (jebe@itu.dk), 2012\n*)\ntheory Bisimulation\n  imports Simulation\nbegin\n\ncontext env begin\n\nlemma monoCoinduct: \"\\<And>x y xa xb xc P Q \\<Psi>.\n                      x \\<le> y \\<Longrightarrow>\n                      (\\<Psi> \\<rhd> Q \\<leadsto>[{(xc, xb, xa). x xc xb xa}] P) \\<longrightarrow>\n                     (\\<Psi> \\<rhd> Q \\<leadsto>[{(xb, xa, xc). y xb xa xc}] P)\"\napply auto\napply(rule monotonic)\nby(auto dest: le_funE)\n\ncoinductive_set bisim :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\" \nwhere\n  step: \"\\<lbrakk>(insertAssertion (extractFrame P)) \\<Psi> \\<simeq>\\<^sub>F (insertAssertion (extractFrame Q) \\<Psi>);\n          \\<Psi> \\<rhd> P \\<leadsto>[bisim] Q;\n          \\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>',  P, Q) \\<in> bisim; (\\<Psi>, Q, P) \\<in> bisim\\<rbrakk> \\<Longrightarrow> (\\<Psi>, P, Q) \\<in> bisim\"\nmonos monoCoinduct\n\nabbreviation\n  bisimJudge (\"_ \\<rhd> _ \\<sim> _\" [70, 70, 70] 65) where \"\\<Psi> \\<rhd> P \\<sim> Q \\<equiv> (\\<Psi>, P, Q) \\<in> bisim\"\nabbreviation\n  bisimNilJudge (\"_ \\<sim> _\" [70, 70] 65) where \"P \\<sim> Q \\<equiv> SBottom' \\<rhd> P \\<sim> Q\"\n\nlemma bisimCoinductAux[consumes 1]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi> \\<and>\n                                    (\\<Psi> \\<rhd> P \\<leadsto>[(X \\<union> bisim)] Q) \\<and>\n                                    (\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X \\<or> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> bisim) \\<and>\n                                    ((\\<Psi>, Q, P) \\<in> X \\<or> (\\<Psi>, Q, P) \\<in> bisim)\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nproof -\n  have \"X \\<union> bisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> bisim}\" by auto\n  with assms show ?thesis\n    by coinduct simp\nqed\n\nlemma bisimCoinduct[consumes 1, case_names cStatEq cSim cExt cSym]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> insertAssertion (extractFrame R) \\<Psi>' \\<simeq>\\<^sub>F insertAssertion (extractFrame S) \\<Psi>'\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> \\<Psi>' \\<rhd> R \\<leadsto>[(X \\<union> bisim)] S\"\n  and     \"\\<And>\\<Psi>' R S \\<Psi>''. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>' \\<otimes> \\<Psi>'', R, S) \\<in> X \\<or> (\\<Psi>' \\<otimes> \\<Psi>'', R, S) \\<in> bisim\"\n  and     \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>', S, R) \\<in> X \\<or> (\\<Psi>', S, R) \\<in> bisim\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nproof -\n  have \"X \\<union> bisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> bisim}\" by auto\n  with assms show ?thesis\n    by coinduct simp\nqed\n\nlemma bisimWeakCoinductAux[consumes 1]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi> \\<and>\n                                     \\<Psi> \\<rhd> P \\<leadsto>[X] Q \\<and>\n                                    (\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X) \\<and> (\\<Psi>, Q, P) \\<in> X\" \n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nusing assms\nby(coinduct rule: bisimCoinductAux) (blast intro: monotonic)\n\nlemma bisimWeakCoinduct[consumes 1, case_names cStatEq cSim cExt cSym]:\n  fixes F :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes \"(\\<Psi>, P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi>\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[X] Q\"\n  and     \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X\"\n  and     \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi>, Q, P) \\<in> X\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nproof -\n  have \"X \\<union> bisim = {(\\<Psi>, P, Q). (\\<Psi>, P, Q) \\<in> X \\<or> (\\<Psi>, P, Q) \\<in> bisim}\" by auto\n  with assms show ?thesis\n  by(coinduct rule: bisimCoinduct) (blast intro: monotonic)+\nqed\n\nlemma bisimE:\n  fixes P  :: \"('a, 'b, 'c) psi\"\n  and   Q  :: \"('a, 'b, 'c) psi\"\n  and   \\<Psi>  :: 'b\n  and   \\<Psi>' :: 'b\n\n  assumes \"(\\<Psi>, P, Q) \\<in> bisim\"\n\n  shows \"insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi>\"\n  and   \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] Q\"\n  and   \"(\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> bisim\"\n  and   \"(\\<Psi>, Q, P) \\<in> bisim\"\nusing assms\nby(auto simp add: intro: bisim.cases)\n\nlemma bisimI:\n  fixes P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   \\<Psi> :: 'b\n\n  assumes \"insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi>\"\n  and     \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] Q\"\n  and     \"\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> bisim\"\n  and     \"(\\<Psi>, Q, P) \\<in> bisim\"\n\n  shows \"(\\<Psi>, P, Q) \\<in> bisim\"\nusing assms\nby(auto intro: bisim.step)\n\nlemma bisimReflexive:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> P\"\nproof -\n  let ?X = \"{(\\<Psi>, P, P) | \\<Psi> P. True}\"\n  have \"(\\<Psi>, P, P) \\<in> ?X\" by simp\n  thus ?thesis\n    by(coinduct rule: bisimWeakCoinduct, auto intro: reflexive)\nqed\n\nlemma bisimClosed:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   p :: \"name prm\"\n  \n  assumes PBisimQ: \"\\<Psi> \\<rhd> P \\<sim> Q\"\n\n  shows \"(p \\<bullet> \\<Psi>) \\<rhd>  (p \\<bullet> P) \\<sim> (p \\<bullet> Q)\"\nproof -\n  let ?X = \"{(p \\<bullet> \\<Psi>, p \\<bullet> P, p \\<bullet> Q) | (p::name prm) \\<Psi>  P Q. \\<Psi> \\<rhd> P \\<sim> Q}\"\n  from PBisimQ have \"(p \\<bullet> \\<Psi>, p \\<bullet> P, p \\<bullet> Q) \\<in> ?X\" by blast\n  thus ?thesis\n  proof(coinduct rule: bisimWeakCoinduct)\n    case(cStatEq \\<Psi> P Q)\n    have \"\\<And>\\<Psi> P Q (p::name prm). insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi> \\<Longrightarrow>\n          insertAssertion (extractFrame(p \\<bullet> P)) (p \\<bullet> \\<Psi>) \\<simeq>\\<^sub>F insertAssertion (extractFrame(p \\<bullet> Q))  (p \\<bullet> \\<Psi>)\"\n      by(drule_tac p = p in FrameStatEqClosed) (simp add: eqvts)\n      \n    with \\<open>(\\<Psi>, P, Q) \\<in> ?X\\<close> show ?case by(blast dest: bisimE)\n  next\n    case(cSim \\<Psi> P Q)\n    {\n      fix p :: \"name prm\"\n      fix \\<Psi> P Q\n      have \"eqvt ?X\"\n        apply(auto simp add: eqvt_def)\n        apply(rule_tac x=\"pa@p\" in exI)\n        by(auto simp add: pt2[OF pt_name_inst])\n      moreover assume \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] Q\"\n      hence \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q\"\n        apply(rule_tac A=bisim in monotonic, auto)\n        by(rule_tac x=\"[]::name prm\" in exI) auto\n      ultimately have \"((p::name prm) \\<bullet> \\<Psi>) \\<rhd> (p \\<bullet> P) \\<leadsto>[?X] (p \\<bullet> Q)\"\n        by(rule_tac simClosed)\n    }\n    with \\<open>(\\<Psi>, P, Q) \\<in> ?X\\<close> show ?case\n      by(blast dest: bisimE)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    {\n      fix p :: \"name prm\"\n      fix \\<Psi> P Q \\<Psi>'\n      assume \"\\<forall>\\<Psi>'. (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> bisim\"\n      hence \"((p \\<bullet> \\<Psi>) \\<otimes> \\<Psi>', p \\<bullet> P, p \\<bullet> Q) \\<in> ?X\"  \n        apply(auto, rule_tac x=p in exI)\n        apply(rule_tac x=\"\\<Psi> \\<otimes> (rev p \\<bullet> \\<Psi>')\" in exI)\n        by(auto simp add: eqvts)\n    }\n    with \\<open>(\\<Psi>, P, Q) \\<in> ?X\\<close> show ?case\n      by(blast dest: bisimE)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case\n      by(blast dest: bisimE)\n  qed\nqed\n\nlemma bisimEqvt[simp]:\n  shows \"eqvt bisim\"\nby(auto simp add: eqvt_def bisimClosed)\n\nlemma statEqBisim:\n  fixes \\<Psi>  :: 'b\n  and   P  :: \"('a, 'b, 'c) psi\"\n  and   Q  :: \"('a, 'b, 'c) psi\"\n  and   \\<Psi>' :: 'b\n  \n  assumes \"\\<Psi> \\<rhd> P \\<sim> Q\"\n  and     \"\\<Psi> \\<simeq> \\<Psi>'\"\n\n  shows \"\\<Psi>' \\<rhd> P \\<sim> Q\"\nproof -\n  let ?X = \"{(\\<Psi>', P, Q) | \\<Psi> P Q \\<Psi>'. \\<Psi> \\<rhd> P \\<sim> Q \\<and> \\<Psi> \\<simeq> \\<Psi>'}\"\n  from \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> \\<open>\\<Psi> \\<simeq> \\<Psi>'\\<close> have \"(\\<Psi>', P, Q) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cStatEq \\<Psi>' P Q)\n    from \\<open>(\\<Psi>', P, Q) \\<in> ?X\\<close> obtain \\<Psi> where \"\\<Psi> \\<rhd> P \\<sim> Q\" and \"\\<Psi> \\<simeq> \\<Psi>'\"\n      by auto\n    from \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> have PeqQ: \"insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi>\"\n      by(rule bisimE)\n\n    obtain A\\<^sub>P \\<Psi>\\<^sub>P where FrP: \"extractFrame P = \\<langle>A\\<^sub>P, \\<Psi>\\<^sub>P\\<rangle>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>\" and \"A\\<^sub>P \\<sharp>* \\<Psi>'\"\n      by(rule_tac C=\"(\\<Psi>, \\<Psi>')\" in freshFrame) auto\n    obtain A\\<^sub>Q \\<Psi>\\<^sub>Q where FrQ: \"extractFrame Q = \\<langle>A\\<^sub>Q, \\<Psi>\\<^sub>Q\\<rangle>\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>\" and \"A\\<^sub>Q \\<sharp>* \\<Psi>'\"\n      by(rule_tac C=\"(\\<Psi>, \\<Psi>')\" in freshFrame) auto\n\n    from PeqQ FrP FrQ \\<open>A\\<^sub>P \\<sharp>* \\<Psi>\\<close> \\<open>A\\<^sub>Q \\<sharp>* \\<Psi>\\<close> \\<open>\\<Psi> \\<simeq> \\<Psi>'\\<close>\n    have \"\\<langle>A\\<^sub>P, \\<Psi>' \\<otimes> \\<Psi>\\<^sub>P\\<rangle> \\<simeq>\\<^sub>F \\<langle>A\\<^sub>Q, \\<Psi>' \\<otimes> \\<Psi>\\<^sub>Q\\<rangle>\"\n      by simp (metis frameIntComposition FrameStatEqTrans FrameStatEqSym)\n    with FrP FrQ \\<open>A\\<^sub>P \\<sharp>* \\<Psi>'\\<close> \\<open>A\\<^sub>Q \\<sharp>* \\<Psi>'\\<close> show ?case by simp\n  next\n    case(cSim \\<Psi>' P Q)\n    from \\<open>(\\<Psi>', P, Q) \\<in> ?X\\<close> obtain \\<Psi> where \"\\<Psi> \\<rhd> P \\<sim> Q\" and \"\\<Psi> \\<simeq> \\<Psi>'\"\n      by auto\n    from \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> have \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] Q\" by(blast dest: bisimE)\n    moreover have \"eqvt ?X\"\n      by(auto simp add: eqvt_def) (metis bisimClosed AssertionStatEqClosed)\n    hence \"eqvt(?X \\<union> bisim)\" by auto\n    moreover note \\<open>\\<Psi> \\<simeq> \\<Psi>'\\<close>\n    moreover have \"\\<And>\\<Psi> P Q \\<Psi>'. \\<lbrakk>\\<Psi> \\<rhd> P \\<sim> Q; \\<Psi> \\<simeq> \\<Psi>'\\<rbrakk> \\<Longrightarrow> (\\<Psi>', P, Q) \\<in> ?X \\<union> bisim\"\n      by auto\n    ultimately show ?case\n      by(rule statEqSim)\n  next\n    case(cExt \\<Psi>' P Q \\<Psi>'')\n    from \\<open>(\\<Psi>', P, Q) \\<in> ?X\\<close> obtain \\<Psi> where \"\\<Psi> \\<rhd> P \\<sim> Q\" and \"\\<Psi> \\<simeq> \\<Psi>'\"\n      by auto\n    from \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> have \"\\<Psi> \\<otimes> \\<Psi>'' \\<rhd> P \\<sim> Q\" by(rule bisimE)\n    moreover from \\<open>\\<Psi> \\<simeq> \\<Psi>'\\<close> have \"\\<Psi> \\<otimes> \\<Psi>'' \\<simeq> \\<Psi>' \\<otimes> \\<Psi>''\" by(rule Composition)\n    ultimately show ?case by blast\n  next\n    case(cSym \\<Psi>' P Q)\n    from \\<open>(\\<Psi>', P, Q) \\<in> ?X\\<close> obtain \\<Psi> where \"\\<Psi> \\<rhd> P \\<sim> Q\" and \"\\<Psi> \\<simeq> \\<Psi>'\"\n      by auto\n    from \\<open>\\<Psi> \\<rhd> P \\<sim> Q\\<close> have \"\\<Psi> \\<rhd> Q \\<sim> P\" by(rule bisimE)\n    thus ?case using \\<open>\\<Psi> \\<simeq> \\<Psi>'\\<close> by auto\n  qed\nqed\n\nlemma bisimTransitive:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  assumes PQ: \"\\<Psi> \\<rhd> P \\<sim> Q\"\n  and     QR: \"\\<Psi> \\<rhd> Q \\<sim> R\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> R\"\nproof -\n  let ?X = \"{(\\<Psi>, P, R) | \\<Psi> P Q R. \\<Psi> \\<rhd> P \\<sim> Q \\<and> \\<Psi> \\<rhd> Q \\<sim> R}\" \n  from PQ QR have \"(\\<Psi>, P, R) \\<in> ?X\" by auto\n  thus ?thesis\n  proof(coinduct rule: bisimCoinduct)\n    case(cStatEq \\<Psi> P R)\n    thus ?case by(blast dest: bisimE FrameStatEqTrans)\n  next\n    case(cSim \\<Psi> P R)\n    {\n      fix \\<Psi> P Q R\n      assume \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] Q\" and \"\\<Psi> \\<rhd> Q \\<leadsto>[bisim] R\"\n      moreover have \"eqvt ?X\"\n        by(force simp add: eqvt_def dest: bisimClosed)\n      with bisimEqvt have \"eqvt (?X \\<union> bisim)\" by blast\n      moreover have \"?X \\<subseteq> ?X \\<union> bisim\" by auto\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[(?X \\<union> bisim)] R\"\n        by(force intro: transitive)\n    }\n    with \\<open>(\\<Psi>, P, R) \\<in> ?X\\<close> show ?case\n      by(blast dest: bisimE)\n  next\n    case(cExt \\<Psi> P R \\<Psi>')\n    thus ?case by(blast dest: bisimE)\n  next\n    case(cSym \\<Psi> P R)\n    thus ?case by(blast dest: bisimE)\n  qed\nqed\n\nlemma weakTransitiveCoinduct[case_names cStatEq cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and rStatEq: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi>\"\n  and rSim: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[({(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and>\n                                                                        (\\<Psi>, P', Q') \\<in> X \\<and>\n                                                                        \\<Psi> \\<rhd> Q' \\<sim> Q})] Q\"\n  and rExt: \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X\"\n  and rSym: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi>, Q, P) \\<in> X\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\nproof -\n  let ?X = \"{(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n  from p have \"(\\<Psi>, P, Q) \\<in> ?X\"\n    by(blast intro: bisimReflexive)\n  thus ?thesis\n  proof(coinduct rule: bisimWeakCoinduct)\n    case(cStatEq \\<Psi> P Q)\n    thus ?case\n      by(blast dest: rStatEq bisimE FrameStatEqTrans)\n  next\n    case(cSim \\<Psi> P Q)\n    {\n      fix \\<Psi> P P' Q' Q\n      assume \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] P'\"\n      moreover assume P'RelQ': \"(\\<Psi>, P', Q') \\<in> X\"\n      hence \"\\<Psi> \\<rhd> P' \\<leadsto>[?X] Q'\" by(rule rSim)\n      moreover from \\<open>eqvt X\\<close> P'RelQ' have \"eqvt ?X\"\n        apply(auto simp add: eqvt_def)\n        apply(drule_tac p=p in bisimClosed)\n        apply(drule_tac p=p in bisimClosed)\n        apply(rule_tac x=\"p \\<bullet> P'a\" in exI, simp)\n        by(rule_tac x=\"p \\<bullet> Q'a\" in exI, auto)\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q'\"\n        by(force intro: transitive dest: bisimTransitive)\n      moreover assume \"\\<Psi> \\<rhd> Q' \\<leadsto>[bisim] Q\"\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q\" using \\<open>eqvt ?X\\<close>\n        by(force intro: transitive dest: bisimTransitive)\n    }\n    with \\<open>(\\<Psi>, P, Q) \\<in> ?X\\<close> show ?case\n      by(blast dest: bisimE)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(blast dest: bisimE intro: rExt)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(blast dest: bisimE intro: rSym)\n  qed\nqed\n\nlemma weakTransitiveCoinduct'[case_names cStatEq cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and rStatEq: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi>\"\n  and rSim: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[({(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and>\n                                                                        (\\<Psi>, P', Q') \\<in> X \\<and>\n                                                                        \\<Psi> \\<rhd> Q' \\<sim> Q})] Q\"\n  and rExt: \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X\"\n  and rSym: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow>\n                      (\\<Psi>, Q, P) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\nproof -\n  let ?X = \"{(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n  from p have \"(\\<Psi>, P, Q) \\<in> ?X\"\n    by(blast intro: bisimReflexive)\n  thus ?thesis\n  proof(coinduct rule: bisimWeakCoinduct)\n    case(cStatEq \\<Psi> P Q)\n    thus ?case\n      by(blast dest: rStatEq bisimE FrameStatEqTrans)\n  next\n    case(cSim \\<Psi> P Q)\n    {\n      fix \\<Psi> P P' Q' Q\n      assume \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] P'\"\n      moreover assume P'RelQ': \"(\\<Psi>, P', Q') \\<in> X\"\n      hence \"\\<Psi> \\<rhd> P' \\<leadsto>[?X] Q'\" by(rule rSim)\n      moreover from \\<open>eqvt X\\<close> P'RelQ' have \"eqvt ?X\"\n        apply(auto simp add: eqvt_def)\n        apply(drule_tac p=p in bisimClosed)\n        apply(drule_tac p=p in bisimClosed)\n        apply(rule_tac x=\"p \\<bullet> P'a\" in exI, simp)\n        by(rule_tac x=\"p \\<bullet> Q'a\" in exI, auto)\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q'\"\n        by(force intro: transitive dest: bisimTransitive)\n      moreover assume \"\\<Psi> \\<rhd> Q' \\<leadsto>[bisim] Q\"\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q\" using \\<open>eqvt ?X\\<close>\n        by(force intro: transitive dest: bisimTransitive)\n    }\n    with \\<open>(\\<Psi>, P, Q) \\<in> ?X\\<close> show ?case\n      by(blast dest: bisimE)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(blast dest: bisimE intro: rExt)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case\n      apply auto\n      apply(drule rSym)\n      apply auto\n      by(metis bisimTransitive bisimE(4))\n  qed\nqed\n\nlemma weakTransitiveCoinduct''[case_names cStatEq cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and rStatEq: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi>\"\n  and rSim: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[({(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and>\n                                                                        (\\<Psi>, P', Q') \\<in> X \\<and>\n                                                                        \\<Psi> \\<rhd> Q' \\<sim> Q})] Q\"\n  and rExt: \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q} \\<Longrightarrow> \n                         (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n  and rSym: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q} \\<Longrightarrow> \n                      (\\<Psi>, Q, P) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\nproof -\n  let ?X = \"{(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n  from p have \"(\\<Psi>, P, Q) \\<in> ?X\"\n    by(blast intro: bisimReflexive)\n  thus ?thesis\n  proof(coinduct rule: bisimWeakCoinduct)\n    case(cStatEq \\<Psi> P Q)\n    thus ?case\n      by(blast dest: rStatEq bisimE FrameStatEqTrans)\n  next\n    case(cSim \\<Psi> P Q)\n    {\n      fix \\<Psi> P P' Q' Q\n      assume \"\\<Psi> \\<rhd> P \\<leadsto>[bisim] P'\"\n      moreover assume P'RelQ': \"(\\<Psi>, P', Q') \\<in> X\"\n      hence \"\\<Psi> \\<rhd> P' \\<leadsto>[?X] Q'\" by(rule rSim)\n      moreover from \\<open>eqvt X\\<close> P'RelQ' have \"eqvt ?X\"\n        apply(auto simp add: eqvt_def)\n        apply(drule_tac p=p in bisimClosed)\n        apply(drule_tac p=p in bisimClosed)\n        apply(rule_tac x=\"p \\<bullet> P'a\" in exI, simp)\n        by(rule_tac x=\"p \\<bullet> Q'a\" in exI, auto)\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q'\"\n        by(force intro: transitive dest: bisimTransitive)\n      moreover assume \"\\<Psi> \\<rhd> Q' \\<leadsto>[bisim] Q\"\n      ultimately have \"\\<Psi> \\<rhd> P \\<leadsto>[?X] Q\" using \\<open>eqvt ?X\\<close>\n        by(force intro: transitive dest: bisimTransitive)\n    }\n    with \\<open>(\\<Psi>, P, Q) \\<in> ?X\\<close> show ?case\n      by(blast dest: bisimE)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case by(rule_tac rExt)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(rule_tac rSym)\n  qed\nqed\n\nlemma transitiveCoinduct[case_names cStatEq cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and rStatEq: \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> insertAssertion (extractFrame R) \\<Psi>' \\<simeq>\\<^sub>F insertAssertion (extractFrame S) \\<Psi>'\"\n  and rSim: \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> \\<Psi>' \\<rhd> R \\<leadsto>[({(\\<Psi>', R, S) | \\<Psi>' R R' S' S. \\<Psi>' \\<rhd> R \\<sim> R' \\<and>\n                                                                        ((\\<Psi>', R', S') \\<in> X \\<or> \\<Psi>' \\<rhd> R' \\<sim> S') \\<and>\n                                                                        \\<Psi>' \\<rhd> S' \\<sim> S})] S\"\n  and rExt: \"\\<And>\\<Psi>' R S \\<Psi>''. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>' \\<otimes> \\<Psi>'', R, S) \\<in> X \\<or> \\<Psi>' \\<otimes> \\<Psi>'' \\<rhd> R \\<sim> S\"\n  and rSym: \"\\<And>\\<Psi>' R S. (\\<Psi>', R, S) \\<in> X \\<Longrightarrow> (\\<Psi>', S, R) \\<in> X \\<or> \\<Psi>' \\<rhd> S \\<sim> R\"\n\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\nproof -\n  from p have \"(\\<Psi>, P, Q) \\<in> (X \\<union> bisim)\"\n    by blast\n  moreover from \\<open>eqvt X\\<close> bisimEqvt have \"eqvt (X \\<union> bisim)\"\n    by auto\n  ultimately show ?thesis\n  proof(coinduct rule: weakTransitiveCoinduct')\n    case(cStatEq \\<Psi> P Q)\n    thus ?case\n      by(blast intro: rStatEq dest: bisimE)\n  next\n    case(cSim \\<Psi> P Q)\n    thus ?case\n      apply auto\n      apply(blast intro: rSim)\n      apply(drule bisimE(2))\n      apply(rule_tac A=bisim in monotonic, simp)\n      by(force intro: bisimReflexive)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case\n      by(blast dest: bisimE rExt)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case by(blast dest: bisimE rSym intro: bisimReflexive)\n  qed\nqed\n\nlemma transitiveCoinduct'[case_names cStatEq cSim cExt cSym, case_conclusion bisim step, consumes 2]:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   X :: \"('b \\<times> ('a, 'b, 'c) psi \\<times> ('a, 'b, 'c) psi) set\"\n\n  assumes p: \"(\\<Psi>, P, Q) \\<in> X\"\n  and Eqvt: \"eqvt X\"\n  and rStatEq: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> insertAssertion (extractFrame P) \\<Psi> \\<simeq>\\<^sub>F insertAssertion (extractFrame Q) \\<Psi>\"\n  and rSim: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> \\<Psi> \\<rhd> P \\<leadsto>[({(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and>\n                                                                        (\\<Psi>, P', Q') \\<in> (X \\<union> bisim) \\<and>\n                                                                        \\<Psi> \\<rhd> Q' \\<sim> Q})] Q\"\n  and rExt: \"\\<And>\\<Psi> P Q \\<Psi>'. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow> (\\<Psi> \\<otimes> \\<Psi>', P, Q) \\<in> X \\<or> \\<Psi> \\<otimes> \\<Psi>' \\<rhd> P \\<sim> Q\"\n  and rSym: \"\\<And>\\<Psi> P Q. (\\<Psi>, P, Q) \\<in> X \\<Longrightarrow>\n                      (\\<Psi>, Q, P) \\<in> {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> ((\\<Psi>, P', Q') \\<in> (X \\<union> bisim)) \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim> Q\"\nproof -\n  from p have \"(\\<Psi>, P, Q) \\<in> (X \\<union> bisim)\"\n    by blast\n  moreover from \\<open>eqvt X\\<close> bisimEqvt have \"eqvt (X \\<union> bisim)\"\n    by auto\n  ultimately show ?thesis\n  proof(coinduct rule: weakTransitiveCoinduct')\n    case(cStatEq \\<Psi> P Q)\n    thus ?case\n      by(blast intro: rStatEq dest: bisimE)\n  next\n    case(cSim \\<Psi> P Q)\n    thus ?case\n      apply -\n      apply(case_tac \"(\\<Psi>, P, Q) \\<in> X\" for X)\n      apply(rule_tac rSim)\n      apply simp\n      apply(clarify)\n      apply(drule bisimE(2))\n      apply(rule_tac A=bisim in monotonic, simp)\n      by(force intro: bisimReflexive)\n  next\n    case(cExt \\<Psi> P Q \\<Psi>')\n    thus ?case\n      by(blast dest: bisimE rExt)\n  next\n    case(cSym \\<Psi> P Q)\n    thus ?case\n      apply auto\n      apply(drule rSym)\n      apply auto\n      apply(rule_tac x=Q in exI)\n      apply(auto intro: bisimReflexive)\n      apply(rule_tac x=P in exI)\n      by(auto intro: bisimReflexive dest: bisimE(4))\n  qed\nqed\n\nlemma bisimSymmetric:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<sim> Q\"\n  \n  shows \"\\<Psi> \\<rhd> Q \\<sim> P\"\nusing assms\nby(rule bisimE)\n\nlemma eqvtTrans[intro]:\n  assumes \"eqvt X\"\n\n  shows \"eqvt {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> ((\\<Psi>, P', Q') \\<in> X \\<or> \\<Psi> \\<rhd> P' \\<sim> Q') \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\nusing assms\napply(auto simp add: eqvt_def eqvts)\napply(erule_tac x=\"(a, P', Q')\" in ballE, auto)\nby(blast dest: bisimClosed)+\n\nlemma eqvtWeakTrans[intro]:\n  assumes \"eqvt X\"\n\n  shows \"eqvt {(\\<Psi>, P, Q) | \\<Psi> P P' Q' Q. \\<Psi> \\<rhd> P \\<sim> P' \\<and> (\\<Psi>, P', Q') \\<in> X \\<and> \\<Psi> \\<rhd> Q' \\<sim> Q}\"\nusing assms\napply(auto simp add: eqvt_def eqvts)\napply(erule_tac x=\"(a, P', Q')\" in ballE, auto)\nby(blast dest: bisimClosed)+\n\nend\n\nend\n\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Psi_Calculi/Bisimulation.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704796847395, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.30100166502389153}}
{"text": "(*\n * @TAG(OTHER_LGPL)\n *)\n\n(*\n    Author:      Norbert Schirmer\n    Maintainer:  Norbert Schirmer, norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  Title:      ProcParEx.thy\n    Author:     Norbert Schirmer, TU Muenchen\n\nCopyright (C) 2006-2008 Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader \"Examples for Procedures as Parameters\"\n\ntheory ProcParEx imports \"../Vcg\" begin\n\n\n\n\n\nlemma conseq_exploit_pre':\n             \"\\<lbrakk>\\<forall>s \\<in> S. \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P) c Q,A\\<rbrakk>\n              \\<Longrightarrow>\n              \\<Gamma>,\\<Theta>\\<turnstile> (P \\<inter> S)c Q,A\"\n  apply (rule HoarePartialDef.Conseq)\n  apply clarify\n  by (metis IntI insertI1 subset_refl)\n\n\nlemma conseq_exploit_pre'':\n             \"\\<lbrakk>\\<forall>Z. \\<forall>s \\<in> S Z.  \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P Z) c (Q Z),(A Z)\\<rbrakk>\n              \\<Longrightarrow>\n              \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile> (P Z \\<inter> S Z)c (Q Z),(A Z)\"\n  apply (rule allI)\n  apply (rule conseq_exploit_pre')\n  apply blast\n  done\n\nlemma conseq_exploit_pre''':\n             \"\\<lbrakk>\\<forall>s \\<in> S. \\<forall>Z. \\<Gamma>,\\<Theta> \\<turnstile> ({s} \\<inter> P Z) c (Q Z),(A Z)\\<rbrakk>\n              \\<Longrightarrow>\n              \\<forall>Z. \\<Gamma>,\\<Theta>\\<turnstile> (P Z \\<inter> S)c (Q Z),(A Z)\"\n  apply (rule allI)\n  apply (rule conseq_exploit_pre')\n  apply blast\n  done\n\n\n  \nrecord 'g vars = \"'g state\" +\n  compare_' :: string\n  n_'   :: nat\n  m_'   :: nat\n  b_'   :: bool\n  k_'  :: nat\n \n\n\nprocedures compare(n,m|b) = \"NoBody\"\nprint_locale! compare_signature\n\n\ncontext compare_signature\nbegin\ndeclare [[hoare_use_call_tr' = false]]\nterm \"\\<acute>b :== CALL compare(\\<acute>n,\\<acute>m)\"\nterm \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m)\"\ndeclare [[hoare_use_call_tr' = true]]\nterm \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m)\"\nend\n\n\nprocedures\n  LEQ (n,m | b) = \"\\<acute>b :== \\<acute>n \\<le> \\<acute>m\"\n  LEQ_spec: \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>}  PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) \\<lbrace>\\<acute>b = (\\<^bsup>\\<sigma>\\<^esup>n \\<le> \\<^bsup>\\<sigma>\\<^esup>m)\\<rbrace>\"\n  LEQ_modifies: \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>} PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) {t. t may_only_modify_globals \\<sigma> in []}\"\n\n\n\ndefinition mx:: \"('a \\<Rightarrow> 'a \\<Rightarrow> bool) \\<Rightarrow> 'a \\<Rightarrow> 'a \\<Rightarrow> 'a\"\n  where \"mx leq a b = (if leq a b then a else b)\"\n\nprocedures\n  Max (compare, n, m | k) = \n  \"\\<acute>b :== DYNCALL \\<acute>compare(\\<acute>n,\\<acute>m);;\n   IF \\<acute>b THEN \\<acute>k :== \\<acute>n ELSE \\<acute>k :== \\<acute>m FI\"\n\n  Max_spec: \"\\<And>leq. \\<forall>\\<sigma>. \\<Gamma>\\<turnstile> \n  ({\\<sigma>} \\<inter> {s. (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n              (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})})\n    PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m,\\<acute>k)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\n\n\nlemma (in Max_impl ) Max_spec1: \nshows\n\"\\<forall>\\<sigma> leq. \\<Gamma>\\<turnstile> \n  ({\\<sigma>} \\<inter> \\<lbrace> (\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n      (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\nproof -\n  fix \\<sigma>:: \"('a,'b) vars_scheme\" and s::\"('a,'b) vars_scheme\" and leq\n   assume compare_spec: \n       \"\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m\\<rbrace>\"\n \n  assume compare_modifies:\n        \"\\<forall>\\<tau>. \\<Gamma>\\<turnstile>{\\<tau>} \\<acute>b :== PROC \\<^bsup>s\\<^esup>compare(\\<acute>n,\\<acute>m) \n                {t. t may_only_modify_globals \\<tau> in []}\"\n\n   show \"\\<Gamma>\\<turnstile>({s} \\<inter> {\\<sigma>})\n            \\<acute>b :== DYNCALL \\<acute>compare (\\<acute>n,\\<acute>m);;\n            IF \\<acute>b THEN \\<acute>k :== \\<acute>n ELSE \\<acute>k :== \\<acute>m FI\n            \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\n     apply vcg\n     apply (clarsimp simp add: mx_def)\n     done\n qed\n\n\nlemma (in Max_impl) Max_spec2: \nshows\n\"\\<forall>\\<sigma> leq. \\<Gamma>\\<turnstile> \n  ({\\<sigma>} \\<inter> \\<lbrace>(\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n      (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in Max_impl) Max_spec3: \nshows\n\"\\<forall>n m leq. \\<Gamma>\\<turnstile> \n  (\\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace>  \\<inter> \n   \\<lbrace>(\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq \\<^bsup>\\<tau>\\<^esup>n \\<^bsup>\\<tau>\\<^esup>m)\\<rbrace>) \\<and> \n     (\\<forall>\\<tau>. \\<Gamma>\\<turnstile> {\\<tau>} \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) {t. t may_only_modify_globals \\<tau> in []})\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq n m\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply (clarsimp simp add: mx_def)\ndone\n\n\n\nlocale Max_test = Max_spec + LEQ_spec + LEQ_modifies \nlemma (in Max_test) \n\n  shows\n  \"\\<Gamma>\\<turnstile> {\\<sigma>} \\<acute>k :== CALL Max(LEQ_'proc,\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>k = mx (op \\<le>) \\<^bsup>\\<sigma>\\<^esup>n \\<^bsup>\\<sigma>\\<^esup>m\\<rbrace>\"\nproof -\n  note Max_spec = Max_spec [where leq=\"(op \\<le>)\"]\n  show ?thesis\n    apply vcg\n    apply (clarsimp)\n    apply (rule conjI)\n    apply (rule LEQ_spec [simplified])\n    apply (rule LEQ_modifies [simplified])\n    done\nqed\n\n\nlemma (in Max_impl) Max_spec5:\nshows\n\"\\<forall>n m leq. \\<Gamma>\\<turnstile> \n  (\\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace> \\<inter> \\<lbrace>\\<forall>n' m'. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n' \\<and> \\<acute>m=m'\\<rbrace> \\<acute>b :== PROC \\<acute>compare(\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>b = (leq n' m')\\<rbrace>\\<rbrace>)\n    \\<acute>k :== PROC Max(\\<acute>compare,\\<acute>n,\\<acute>m)\n  \\<lbrace>\\<acute>k = mx leq n m\\<rbrace>\"\nterm \"\\<lbrace>{s. \\<^bsup>s\\<^esup>n = n' \\<and> \\<^bsup>s\\<^esup>m = m'} = X\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcNoRec1)\napply (intro allI)\napply (rule conseq_exploit_pre')\napply (rule)\napply clarify\napply vcg\napply clarsimp\napply (clarsimp simp add: mx_def)\ndone\n\nlemma (in LEQ_impl)\n LEQ_spec: \"\\<forall>n m. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace>  PROC LEQ(\\<acute>n,\\<acute>m,\\<acute>b) \\<lbrace>\\<acute>b = (n \\<le> m)\\<rbrace>\"\n  apply vcg\n  done\n\n\nlocale Max_test' = Max_impl + LEQ_impl\nlemma (in Max_test') \n  shows\n  \"\\<forall>n m. \\<Gamma>\\<turnstile> \\<lbrace>\\<acute>n=n \\<and> \\<acute>m=m\\<rbrace> \\<acute>k :== CALL Max(LEQ_'proc,\\<acute>n,\\<acute>m) \\<lbrace>\\<acute>k = mx (op \\<le>) n m\\<rbrace>\"\nproof -\n  note Max_spec = Max_spec5\n  show ?thesis\n    apply vcg\n    apply (rule_tac x=\"op \\<le>\" in exI)\n    apply clarsimp\n    thm LEQ_spec\n    apply (rule LEQ_spec [rule_format])\n    done\nqed\n\nend\n", "meta": {"author": "crizkallah", "repo": "checker-verification", "sha": "cd5101e57ef70dcdd1680db2de2f08521605bd7c", "save_path": "github-repos/isabelle/crizkallah-checker-verification", "path": "github-repos/isabelle/crizkallah-checker-verification/checker-verification-cd5101e57ef70dcdd1680db2de2f08521605bd7c/autocorres-1.0/c-parser/hoare-package/ex/ProcParEx.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.30100165703060305}}
{"text": "(* \n    This file is a part of MMIsar - a translation of Metamath's set.mm to Isabelle 2005 (ZF logic).\n\n    Copyright (C) 2006  Slawomir Kolodynski\n\n    This program is free software; Redistribution and use in source and binary forms, \n    with or without modification, are permitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, \n   this list of conditions and the following disclaimer.\n   2. Redistributions in binary form must reproduce the above copyright notice, \n   this list of conditions and the following disclaimer in the documentation and/or \n   other materials provided with the distribution.\n   3. The name of the author may not be used to endorse or promote products \n   derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,\nINCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A\nPARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,\nINDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\nBUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,\nSTRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE\nUSE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*)\n\nsection \\<open>Logic and sets in Metamatah\\<close>\n\ntheory MMI_logic_and_sets imports MMI_prelude\n\nbegin\n\nsubsection\\<open>Basic Metamath theorems\\<close>\n\ntext\\<open>This section contains Metamath theorems that the more advanced \n  theorems from \\<open>MMIsar.thy\\<close> depend on. Most of these theorems \n  are proven automatically by Isabelle, some have to be proven by hand \n  and some have to be modified to convert from Tarski-Megill \n  metalogic used by Metamath to one based on explicit notion of \n  free and bound variables.\\<close>   \n\n(*text{*The next definition is what Metamath $X\\in V$ is\n  translated to. I am not sure why it works, probably because\n  Isabelle does a type inference and the \"=\" sign\n  indicates that both sides are sets.*}\n\nconsts\n   IsASet :: \"i\\<Rightarrow>o\" (\"_ isASet\" [90] 90)\n\ndefs\n  set_def [simp]: \"X isASet \\<equiv>  X = X\"*)\n\nlemma MMI_ax_mp: assumes \"\\<phi>\" and \"\\<phi> \\<longrightarrow> \\<psi>\" shows \"\\<psi>\"\n  using assms by auto\n\nlemma MMI_sseli: assumes A1: \"A \\<subseteq> B\"   \n   shows \"C \\<in> A \\<longrightarrow> C \\<in> B\"\n   using assms by auto\n\nlemma MMI_sselii: assumes A1: \"A \\<subseteq> B\" and\n    A2: \"C \\<in> A\"   \n   shows \"C \\<in> B\"\n   using assms by auto\n\nlemma MMI_syl: assumes A1: \"\\<phi> \\<longrightarrow> ps\" and\n    A2: \"ps \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_elimhyp: assumes A1: \"A = if ( \\<phi> , A , B ) \\<longrightarrow> ( \\<phi> \\<longleftrightarrow> \\<psi> )\" and\n    A2: \"B = if ( \\<phi> , A , B ) \\<longrightarrow> ( ch \\<longleftrightarrow> \\<psi> )\" and\n    A3: \"ch\"   \n   shows \"\\<psi>\"\nproof -\n  { assume \"\\<phi>\"\n    with A1 have \"\\<psi>\" by simp }\n  moreover\n  { assume \"\\<not>\\<phi>\"\n    with A2 A3 have \"\\<psi>\" by simp }\n  ultimately show \"\\<psi>\" by auto\nqed\n\nlemma MMI_neeq1: \n   shows \"A = B \\<longrightarrow> ( A \\<noteq> C \\<longleftrightarrow> B \\<noteq> C )\"\n  by auto\n\nlemma MMI_mp2: assumes A1: \"\\<phi>\" and\n    A2: \"\\<psi>\" and\n    A3: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> chi )\"   \n   shows \"chi\"\n   using assms by auto\n\nlemma MMI_xpex: assumes A1: \"A isASet\" and\n    A2: \"B isASet\"   \n   shows \"( A \\<times> B ) isASet\"\n   using assms by auto\n\nlemma MMI_fex: \n   shows \n  \"A \\<in> C \\<longrightarrow> ( F : A \\<rightarrow> B \\<longrightarrow> F isASet )\"\n  \"A isASet \\<longrightarrow> ( F : A \\<rightarrow> B \\<longrightarrow> F isASet )\"\n  by auto\n\nlemma MMI_3eqtr4d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> C = A\" and\n    A3: \"\\<phi> \\<longrightarrow> D = B\"   \n   shows \"\\<phi> \\<longrightarrow> C = D\"\n   using assms by auto\n\nlemma MMI_3coml: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> chi ) \\<longrightarrow> th\"   \n   shows \"( \\<psi> \\<and> chi \\<and> \\<phi> ) \\<longrightarrow> th\"\n   using assms by auto\n\nlemma MMI_sylan: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> chi\" and\n    A2: \"th \\<longrightarrow> \\<phi>\"   \n   shows \"( th \\<and> \\<psi> ) \\<longrightarrow> chi\"\n   using assms by auto\n\nlemma MMI_3impa: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> chi ) \\<longrightarrow> th\"   \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> chi ) \\<longrightarrow> th\"\n   using assms by auto\n\nlemma MMI_3adant2: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> chi\"   \n   shows \"( \\<phi> \\<and> th \\<and> \\<psi> ) \\<longrightarrow> chi\"\n   using assms by auto\n\nlemma MMI_3adant1: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> chi\"   \n   shows \"( th \\<and> \\<phi> \\<and> \\<psi> ) \\<longrightarrow> chi\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreq12d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> C = D\"   \n   shows \n  \"\\<phi> \\<longrightarrow> ( A \\<ca> C ) = ( B \\<ca> D )\"\n  \"\\<phi> \\<longrightarrow> ( A \\<cdot> C ) = ( B \\<cdot> D )\"\n  \"\\<phi> \\<longrightarrow> ( A \\<cs> C ) = ( B \\<cs> D )\"\n  \"\\<phi> \\<longrightarrow> ( A \\<cdiv> C ) = ( B \\<cdiv> D )\"\n   using assms by auto\n\nlemma MMI_mp2an: assumes A1: \"\\<phi>\" and\n    A2: \"\\<psi>\" and\n    A3: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> chi\"   \n   shows \"chi\"\n   using assms by auto\n\nlemma MMI_mp3an: assumes A1: \"\\<phi>\" and\n    A2: \"\\<psi>\" and\n    A3: \"ch\" and\n    A4: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"\\<theta>\"\n   using assms by auto\n\nlemma MMI_eqeltrr: assumes A1: \"A = B\" and\n    A2: \"A \\<in> C\"   \n   shows \"B \\<in> C\"\n   using assms by auto\n\nlemma MMI_eqtr: assumes A1: \"A = B\" and\n    A2: \"B = C\"   \n   shows \"A = C\"\n   using assms by auto\n\n(*********************10-20 ******************************************)\n\nlemma MMI_impbi: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"\\<psi> \\<longrightarrow> \\<phi>\"   \n   shows \"\\<phi> \\<longleftrightarrow> \\<psi>\"\nproof\n  assume \"\\<phi>\" with A1 show \"\\<psi>\" by simp\nnext\n  assume \"\\<psi>\" with A2 show \"\\<phi>\" by simp\nqed\n\nlemma MMI_mp3an3: assumes A1: \"ch\" and\n    A2: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_eqeq12d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> C = D\"   \n   shows \"\\<phi> \\<longrightarrow> ( A = C \\<longleftrightarrow> B = D )\"\n   using assms by auto\n\nlemma MMI_mpan2: assumes A1: \"\\<psi>\" and\n    A2: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreq2: \n   shows \n  \"A = B \\<longrightarrow> ( C \\<ca> A ) = ( C \\<ca> B )\"\n  \"A = B \\<longrightarrow> ( C \\<cdot> A ) = ( C \\<cdot> B )\"\n  \"A = B \\<longrightarrow> ( C \\<cs> A ) = ( C \\<cs> B )\"\n  \"A = B \\<longrightarrow> ( C \\<cdiv> A ) = ( C \\<cdiv> B )\"\n  by auto\n\nlemma MMI_syl5bir: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<theta> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longrightarrow> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_adantr: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"( \\<phi> \\<and> ch ) \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_mpan: assumes A1: \"\\<phi>\" and\n    A2: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"\\<psi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_eqeq1d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\"   \n   shows \"\\<phi> \\<longrightarrow> ( A = C \\<longleftrightarrow> B = C )\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreq1: \n   shows \n  \"A = B \\<longrightarrow> ( A \\<cdot> C ) = ( B \\<cdot> C )\"\n  \"A = B \\<longrightarrow> ( A \\<ca> C ) = ( B \\<ca> C )\"\n  \"A = B \\<longrightarrow> ( A \\<cs> C ) = ( B \\<cs> C )\"\n  \"A = B \\<longrightarrow> ( A \\<cdiv> C ) = ( B \\<cdiv> C )\"\n  by auto\n\nlemma MMI_syl6eq: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"B = C\"   \n   shows \"\\<phi> \\<longrightarrow> A = C\"\n   using assms by auto\n\nlemma MMI_syl6bi: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_imp: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\"   \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_sylibd: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( ch \\<longleftrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_ex: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_r19_23aiv: assumes A1: \"\\<forall>x.  (x \\<in> A  \\<longrightarrow> (\\<phi>(x) \\<longrightarrow> \\<psi> ))\"   \n   shows \"( \\<exists> x \\<in> A . \\<phi>(x) ) \\<longrightarrow> \\<psi>\"\n  using assms by auto\n\nlemma MMI_bitr: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"\\<psi> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longleftrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_eqeq12i: assumes A1: \"A = B\" and\n    A2: \"C = D\"   \n   shows \"A = C \\<longleftrightarrow> B = D\"\n   using assms by auto\n\nlemma MMI_dedth3h: \n  assumes A1: \"A = if ( \\<phi> , A , D ) \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> ta )\" and\n    A2: \"B = if ( \\<psi> , B , R ) \\<longrightarrow> ( ta \\<longleftrightarrow> et )\" and\n    A3: \"C = if ( ch , C , S ) \\<longrightarrow> ( et \\<longleftrightarrow> ze )\" and\n    A4: \"ze\"   \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_bibi1d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<longleftrightarrow> \\<theta> ) \\<longleftrightarrow> ( ch \\<longleftrightarrow> \\<theta> ) )\"\n   using assms by auto\n\nlemma MMI_eqeq1: \n   shows \"A = B \\<longrightarrow> ( A = C \\<longleftrightarrow> B = C )\"\n  by auto\n\nlemma MMI_bibi12d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> ta )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<longleftrightarrow> \\<theta> ) \\<longleftrightarrow> ( ch \\<longleftrightarrow> ta ) )\"\n   using assms by auto\n\nlemma MMI_eqeq2d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\"   \n   shows \"\\<phi> \\<longrightarrow> ( C = A \\<longleftrightarrow> C = B )\"\n   using assms by auto\n\nlemma MMI_eqeq2: \n   shows \"A = B \\<longrightarrow> ( C = A \\<longleftrightarrow> C = B )\"\n  by auto\n\nlemma MMI_elimel: assumes A1: \"B \\<in> C\"   \n   shows \"if ( A \\<in> C , A , B ) \\<in> C\"\n   using assms by auto\n\nlemma MMI_3adant3: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> \\<theta> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_bitr3d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ch \\<longleftrightarrow> \\<theta> )\"\n   using assms by auto\n\n(****************** 20-30 add12t - peano2cn *************)\n\nlemma MMI_3eqtr3d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> A = C\" and\n    A3: \"\\<phi> \\<longrightarrow> B = D\"   \n   shows \"\\<phi> \\<longrightarrow> C = D\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreq1d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\"   \n   shows \n  \"\\<phi> \\<longrightarrow> ( A \\<ca> C ) = ( B \\<ca> C )\"\n  \"\\<phi> \\<longrightarrow> ( A \\<cs> C ) = ( B \\<cs> C )\"\n  \"\\<phi> \\<longrightarrow> ( A \\<cdot> C ) = ( B \\<cdot> C )\"\n  \"\\<phi> \\<longrightarrow> ( A \\<cdiv> C ) = ( B \\<cdiv> C )\"\n   using assms by auto\n\nlemma MMI_3com12: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<psi> \\<and> \\<phi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreq2d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\"   \n   shows \n  \"\\<phi> \\<longrightarrow> ( C \\<ca> A ) = ( C \\<ca> B )\"\n  \"\\<phi> \\<longrightarrow> ( C \\<cs> A ) = ( C \\<cs> B )\"\n  \"\\<phi> \\<longrightarrow> ( C \\<cdot> A ) = ( C \\<cdot> B )\"\n  \"\\<phi> \\<longrightarrow> ( C \\<cdiv> A ) = ( C \\<cdiv> B )\"\n   using assms by auto\n\nlemma MMI_3com23: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> ch \\<and> \\<psi> ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_3expa: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_adantrr: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"( \\<phi> \\<and> ( \\<psi> \\<and> \\<theta> ) ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_3expb: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> ( \\<psi> \\<and> ch ) ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_an4s: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ( ch \\<and> \\<theta> ) ) \\<longrightarrow> \\<tau>\"   \n   shows \"( ( \\<phi> \\<and> ch ) \\<and> ( \\<psi> \\<and> \\<theta> ) ) \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_eqtrd: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> B = C\"   \n   shows \"\\<phi> \\<longrightarrow> A = C\"\n   using assms by auto\n\nlemma MMI_ad2ant2l: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"( ( \\<theta> \\<and> \\<phi> ) \\<and> ( \\<tau> \\<and> \\<psi> ) ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_pm3_2i: assumes A1: \"\\<phi>\" and\n    A2: \"\\<psi>\"   \n   shows \"\\<phi> \\<and> \\<psi>\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreq2i: assumes A1: \"A = B\"   \n   shows \n  \"( C \\<ca> A ) = ( C \\<ca> B )\"\n  \"( C \\<cs> A ) = ( C \\<cs> B )\"\n  \"( C \\<cdot> A ) = ( C \\<cdot> B )\"\n   using assms by auto\n\n(************31,33 peano2re, negeu, subval ******************************)\n\nlemma MMI_mpbir2an: assumes A1: \"\\<phi> \\<longleftrightarrow> ( \\<psi> \\<and> ch )\" and\n    A2: \"\\<psi>\" and\n    A3: \"ch\"   \n   shows \"\\<phi>\"\n   using assms by auto\n\nlemma MMI_reu4: assumes A1: \"\\<forall>x y. x = y \\<longrightarrow> ( \\<phi>(x) \\<longleftrightarrow> \\<psi>(y) )\"   \n   shows \"( \\<exists>! x . x \\<in> A \\<and> \\<phi>(x) ) \\<longleftrightarrow> \n  ( ( \\<exists> x \\<in> A . \\<phi>(x) ) \\<and> ( \\<forall> x \\<in> A . \\<forall> y \\<in> A . \n  ( ( \\<phi>(x) \\<and> \\<psi>(y) ) \\<longrightarrow> x = y ) ) )\"\n   using assms by auto\n\nlemma MMI_risset: \n   shows \"A \\<in> B \\<longleftrightarrow> ( \\<exists> x \\<in> B . x = A )\"\n  by auto\n\nlemma MMI_sylib: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"\\<psi> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_mp3an13: assumes A1: \"\\<phi>\" and\n    A2: \"ch\" and\n    A3: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"\\<psi> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_eqcomd: assumes A1: \"\\<phi> \\<longrightarrow> A = B\"   \n   shows \"\\<phi> \\<longrightarrow> B = A\"\n   using assms by auto\n\nlemma MMI_sylan9eqr: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<psi> \\<longrightarrow> B = C\"   \n   shows \"( \\<psi> \\<and> \\<phi> ) \\<longrightarrow> A = C\"\n   using assms by auto\n\nlemma MMI_exp32: assumes A1: \"( \\<phi> \\<and> ( \\<psi> \\<and> ch ) ) \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> ) )\"\n   using assms by auto\n\nlemma MMI_impcom: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\"   \n   shows \"( \\<psi> \\<and> \\<phi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_a1d: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> ( ch \\<longrightarrow> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_r19_21aiv: assumes A1: \"\\<forall>x. \\<phi> \\<longrightarrow> ( x \\<in> A \\<longrightarrow> \\<psi>(x) )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<forall> x \\<in> A . \\<psi>(x) )\"\n   using assms by auto\n\nlemma MMI_r19_22: \n   shows \"( \\<forall> x \\<in> A . ( \\<phi>(x) \\<longrightarrow> \\<psi>(x) ) ) \\<longrightarrow> \n  ( ( \\<exists> x \\<in> A . \\<phi>(x) ) \\<longrightarrow> ( \\<exists> x \\<in> A . \\<psi>(x) ) )\"\n  by auto\n\nlemma MMI_syl6: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\" and\n    A2: \"ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_mpid: assumes A1: \"\\<phi> \\<longrightarrow> ch\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> ) )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_eqtr3t: \n   shows \"( A = C \\<and> B = C ) \\<longrightarrow> A = B\"\n  by auto\n\nlemma MMI_syl5bi: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<theta> \\<longrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_mp3an1: assumes A1: \"\\<phi>\" and\n    A2: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_rgen2: assumes A1: \"\\<forall>x y. ( x \\<in> A \\<and> y \\<in> A ) \\<longrightarrow> \\<phi>(x,y)\"   \n   shows \"\\<forall> x \\<in> A . \\<forall> y \\<in> A . \\<phi>(x,y)\"\n   using assms by auto\n\n(*************** 35-37 negeq-negeqd **************************)\n\nlemma MMI_ax_17: shows \"\\<phi> \\<longrightarrow> (\\<forall>x. \\<phi>)\" by simp\n\n\nlemma MMI_3eqtr4g: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"C = A\" and\n    A3: \"D = B\"   \n   shows \"\\<phi> \\<longrightarrow> C = D\"\n   using assms by auto\n\n(*** hbneq ***************************************************)\n\nlemma MMI_3imtr4: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"ch \\<longleftrightarrow> \\<phi>\" and\n    A3: \"\\<theta> \\<longleftrightarrow> \\<psi>\"   \n   shows \"ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(*lemma MMI_hbopr: assumes A1: \"y \\<in> A \\<longrightarrow> ( \\<forall> x . y \\<in> A )\" and\n    A2: \"y \\<in> F \\<longrightarrow> ( \\<forall> x . y \\<in> F )\" and\n    A3: \"y \\<in> B \\<longrightarrow> ( \\<forall> x . y \\<in> B )\"   \n   shows \"y \\<in> ( A F B ) \\<longrightarrow> ( \\<forall> x . y \\<in> ( A F B ) )\"\n   using assms by auto \n  no way to translate hopefuly we will manage to avoid using this*)\n\nlemma MMI_eleq2i: assumes A1: \"A = B\"   \n   shows \"C \\<in> A \\<longleftrightarrow> C \\<in> B\"\n   using assms by auto\n\nlemma MMI_albii: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\"   \n   shows \"( \\<forall> x . \\<phi> ) \\<longleftrightarrow> ( \\<forall> x . \\<psi> )\"\n   using assms by auto\n\n(*************subcl-subadd **********************************)\nlemma MMI_reucl: \n   shows \"( \\<exists>! x . x \\<in> A \\<and> \\<phi>(x) ) \\<longrightarrow> \\<Union> { x \\<in> A . \\<phi>(x) } \\<in> A\"\nproof\n  assume A1: \"\\<exists>! x . x \\<in> A \\<and> \\<phi>(x)\"\n  then obtain a where I: \"a\\<in>A\"  and \"\\<phi>(a)\" by auto\n  with A1 have \"{ x \\<in> A . \\<phi>(x) } = {a}\" by blast\n  with I show \" \\<Union> { x \\<in> A . \\<phi>(x) } \\<in> A\" by simp\nqed\n\nlemma MMI_dedth2h: assumes A1: \"A = if ( \\<phi> , A , C ) \\<longrightarrow> ( ch \\<longleftrightarrow> \\<theta> )\" and\n    A2: \"B = if ( \\<psi> , B , D ) \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<tau> )\" and\n    A3: \"\\<tau>\"   \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_eleq1d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\"   \n   shows \"\\<phi> \\<longrightarrow> ( A \\<in> C \\<longleftrightarrow> B \\<in> C )\"\n   using assms by auto\n\nlemma MMI_syl5eqel: assumes A1: \"\\<phi> \\<longrightarrow> A \\<in> B\" and\n    A2: \"C = A\"   \n   shows \"\\<phi> \\<longrightarrow> C \\<in> B\"\n   using assms by auto\n\n(** a lemma in ZF that roughly corresponds to Mematamath euuni **)\n\nlemma IML_eeuni: assumes A1: \"x \\<in> A\" and A2: \"\\<exists>! t . t \\<in> A \\<and> \\<phi>(t)\"\n  shows \"\\<phi>(x) \\<longleftrightarrow> \\<Union> { x \\<in> A . \\<phi>(x) } = x\"\nproof\n  assume \"\\<phi>(x)\" \n  with A1 A2 show \"\\<Union> { x \\<in> A . \\<phi>(x) } = x\" by auto\nnext assume A3: \"\\<Union> { x \\<in> A . \\<phi>(x) } = x\"\n  from A2 obtain y where \"y\\<in>A\" and I: \"\\<phi>(y)\" by auto\n  with A2 A3 have \"x = y\" by auto\n  with I show \"\\<phi>(x)\" by simp\nqed\n    \nlemma MMI_reuuni1: \n   shows \"( x \\<in> A \\<and> ( \\<exists>! x . x \\<in> A \\<and> \\<phi>(x) ) ) \\<longrightarrow> \n  ( \\<phi>(x) \\<longleftrightarrow> \\<Union> { x \\<in> A . \\<phi>(x) } = x )\"\n  using IML_eeuni by simp\n\nlemma MMI_eqeq1i: assumes A1: \"A = B\"   \n   shows \"A = C \\<longleftrightarrow> B = C\"\n   using assms by auto\n\nlemma MMI_syl6rbbr: assumes A1: \"\\<forall>x. \\<phi>(x) \\<longrightarrow> ( \\<psi>(x) \\<longleftrightarrow> ch(x) )\" and\n    A2: \"\\<forall>x. \\<theta>(x) \\<longleftrightarrow> ch(x)\"   \n   shows \"\\<forall> x. \\<phi>(x) \\<longrightarrow> ( \\<theta>(x) \\<longleftrightarrow> \\<psi>(x) )\"\n   using assms by auto\n\n(*** the original version of MMI_syl6rbbr without quantifiers **********)\n\nlemma MMI_syl6rbbrA: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<theta> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_vtoclga: assumes A1: \"\\<forall>x. x = A \\<longrightarrow> ( \\<phi>(x) \\<longleftrightarrow> \\<psi>)\" and\n    A2: \"\\<forall>x. x \\<in> B \\<longrightarrow> \\<phi>(x)\"\n   shows \"A \\<in> B \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\n(************  subsub23 - addsubt ******************)\n\nlemma MMI_3bitr4: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"ch \\<longleftrightarrow> \\<phi>\" and\n    A3: \"\\<theta> \\<longleftrightarrow> \\<psi>\"   \n   shows \"ch \\<longleftrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_mpbii: assumes Amin: \"\\<psi>\" and\n    Amaj: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_eqid: \n   shows \"A = A\"\n  by auto\n\nlemma MMI_pm3_27: \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> \\<psi>\"\n  by auto\n\nlemma MMI_pm3_26: \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> \\<phi>\"\n  by auto\n\nlemma MMI_ancoms: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"( \\<psi> \\<and> \\<phi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_syl3anc: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longrightarrow> \\<phi>\" and\n    A3: \"\\<tau> \\<longrightarrow> \\<psi>\" and\n    A4: \"\\<tau> \\<longrightarrow> ch\"   \n   shows \"\\<tau> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_syl5eq: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"C = A\"   \n   shows \"\\<phi> \\<longrightarrow> C = B\"\n   using assms by auto\n\nlemma MMI_eqcomi: assumes A1: \"A = B\"   \n   shows \"B = A\"\n   using assms by auto\n\nlemma MMI_3eqtr: assumes A1: \"A = B\" and\n    A2: \"B = C\" and\n    A3: \"C = D\"   \n   shows \"A = D\"\n   using assms by auto\n\nlemma MMI_mpbir: assumes Amin: \"\\<psi>\" and\n    Amaj: \"\\<phi> \\<longleftrightarrow> \\<psi>\"   \n   shows \"\\<phi>\"\n   using assms by auto\n\nlemma MMI_syl3an3: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longrightarrow> ch\"   \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> \\<tau> ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_3eqtrd: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> B = C\" and\n    A3: \"\\<phi> \\<longrightarrow> C = D\"   \n   shows \"\\<phi> \\<longrightarrow> A = D\"\n   using assms by auto\n\nlemma MMI_syl5: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\" and\n    A2: \"\\<theta> \\<longrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_exp3a: assumes A1: \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> ) )\"\n   using assms by auto\n\nlemma MMI_com12: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\"   \n   shows \"\\<psi> \\<longrightarrow> ( \\<phi> \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_3imp: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> ) )\"   \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(********* addsub12t-subidt *************)\n\nlemma MMI_3eqtr3: assumes A1: \"A = B\" and\n    A2: \"A = C\" and\n    A3: \"B = D\"   \n   shows \"C = D\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreq1i: assumes A1: \"A = B\"   \n   shows \n  \"( A \\<ca> C ) = ( B \\<ca> C )\"\n  \"( A \\<cs> C ) = ( B \\<cs> C )\"\n  \"( A \\<cdiv> C ) = ( B \\<cdiv> C )\"\n  \"( A \\<cdot> C ) = ( B \\<cdot> C )\"\n   using assms by auto\n\nlemma MMI_eqtr3: assumes A1: \"A = B\" and\n    A2: \"A = C\"   \n   shows \"B = C\"\n   using assms by auto\n\nlemma MMI_dedth: assumes A1: \"A = if ( \\<phi> , A , B ) \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"ch\"   \n   shows \"\\<phi> \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_id: \n   shows \"\\<phi> \\<longrightarrow> \\<phi>\"\n  by auto\n\nlemma MMI_eqtr3d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> A = C\"   \n   shows \"\\<phi> \\<longrightarrow> B = C\"\n   using assms by auto\n\nlemma MMI_sylan2: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\" and\n    A2: \"\\<theta> \\<longrightarrow> \\<psi>\"   \n   shows \"( \\<phi> \\<and> \\<theta> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_adantl: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"( ch \\<and> \\<phi> ) \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreq12: \n   shows \n  \"( A = B \\<and> C = D ) \\<longrightarrow> ( A \\<ca> C ) = ( B \\<ca> D )\"\n  \"( A = B \\<and> C = D ) \\<longrightarrow> ( A \\<cs> C ) = ( B \\<cs> D )\"\n  \"( A = B \\<and> C = D ) \\<longrightarrow> ( A \\<cdot> C ) = ( B \\<cdot> D )\"\n  \"( A = B \\<and> C = D ) \\<longrightarrow> ( A \\<cdiv> C ) = ( B \\<cdiv> D )\"\n  by auto\n\nlemma MMI_anidms: assumes A1: \"( \\<phi> \\<and> \\<phi> ) \\<longrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\n(******** subid1t-neg11 *************************)\n\nlemma MMI_anabsan2: assumes A1: \"( \\<phi> \\<and> ( \\<psi> \\<and> \\<psi> ) ) \\<longrightarrow> ch\"   \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_3simp2: \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<psi>\"\n  by auto\n\nlemma MMI_3simp3: \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> ch\"\n  by auto\n\nlemma MMI_sylbir: assumes A1: \"\\<psi> \\<longleftrightarrow> \\<phi>\" and\n    A2: \"\\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_3eqtr3g: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"A = C\" and\n    A3: \"B = D\"   \n   shows \"\\<phi> \\<longrightarrow> C = D\"\n   using assms by auto\n\nlemma MMI_3bitr: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"\\<psi> \\<longleftrightarrow> ch\" and\n    A3: \"ch \\<longleftrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longleftrightarrow> \\<theta>\"\n   using assms by auto\n\n(************ negcon1-subeq0t**************)\n\nlemma MMI_3bitr3: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"\\<phi> \\<longleftrightarrow> ch\" and\n    A3: \"\\<psi> \\<longleftrightarrow> \\<theta>\"   \n   shows \"ch \\<longleftrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_eqcom: \n   shows \"A = B \\<longleftrightarrow> B = A\"\n  by auto\n\nlemma MMI_syl6bb: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"ch \\<longleftrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_3bitr3d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> \\<theta> )\" and\n    A3: \"\\<phi> \\<longrightarrow> ( ch \\<longleftrightarrow> \\<tau> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<tau> )\"\n   using assms by auto\n\nlemma MMI_syl3an2: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longrightarrow> \\<psi>\"   \n   shows \"( \\<phi> \\<and> \\<tau> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(********neg0-0re ********************)\n\nlemma MMI_df_rex: \n   shows \"( \\<exists> x \\<in> A . \\<phi>(x) ) \\<longleftrightarrow> ( \\<exists> x . ( x \\<in> A \\<and> \\<phi>(x) ) )\"\n  by auto\n\nlemma MMI_mpbi: assumes Amin: \"\\<phi>\" and\n    Amaj: \"\\<phi> \\<longleftrightarrow> \\<psi>\"   \n   shows \"\\<psi>\"\n   using assms by auto\n\nlemma MMI_mp3an12: assumes A1: \"\\<phi>\" and\n    A2: \"\\<psi>\" and\n    A3: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_syl5bb: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<theta> \\<longleftrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_eleq1a: \n   shows \"A \\<in> B \\<longrightarrow> ( C = A \\<longrightarrow> C \\<in> B )\"\n  by auto\n\nlemma MMI_sylbird: assumes A1: \"\\<phi> \\<longrightarrow> ( ch \\<longleftrightarrow> \\<psi> )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_19_23aiv: assumes A1: \"\\<forall>x. \\<phi>(x) \\<longrightarrow> \\<psi>\"   \n   shows \"( \\<exists> x . \\<phi>(x) ) \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_eqeltrrd: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> A \\<in> C\"   \n   shows \"\\<phi> \\<longrightarrow> B \\<in> C\"\n   using assms by auto\n\nlemma MMI_syl2an: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\" and\n    A2: \"\\<theta> \\<longrightarrow> \\<phi>\" and\n    A3: \"\\<tau> \\<longrightarrow> \\<psi>\"   \n   shows \"( \\<theta> \\<and> \\<tau> ) \\<longrightarrow> ch\"\n   using assms by auto\n\n(*********** mulid2t-muladdt *********************)\n\nlemma MMI_adantrl: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"( \\<phi> \\<and> ( \\<theta> \\<and> \\<psi> ) ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_ad2ant2r: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"( ( \\<phi> \\<and> \\<theta> ) \\<and> ( \\<psi> \\<and> \\<tau> ) ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_adantll: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"( ( \\<theta> \\<and> \\<phi> ) \\<and> \\<psi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_anandirs: assumes A1: \"( ( \\<phi> \\<and> ch ) \\<and> ( \\<psi> \\<and> ch ) ) \\<longrightarrow> \\<tau>\"   \n   shows \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_adantlr: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"( ( \\<phi> \\<and> \\<theta> ) \\<and> \\<psi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_an42s: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ( ch \\<and> \\<theta> ) ) \\<longrightarrow> \\<tau>\"   \n   shows \"( ( \\<phi> \\<and> ch ) \\<and> ( \\<theta> \\<and> \\<psi> ) ) \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\n(******* muladd11t-muladd*****************************)\n\nlemma MMI_mp3an2: assumes A1: \"\\<psi>\" and\n    A2: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(********** subdit-mulneg1 **************************)\n\nlemma MMI_3simp1: \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<phi>\"\n  by auto\n\nlemma MMI_3impb: assumes A1: \"( \\<phi> \\<and> ( \\<psi> \\<and> ch ) ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_mpbird: assumes Amin: \"\\<phi> \\<longrightarrow> ch\" and\n    Amaj: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreq12i: assumes A1: \"A = B\" and\n  A2: \"C = D\"   \n  shows \n  \"( A \\<ca> C ) = ( B \\<ca> D )\"\n  \"( A \\<cdot> C ) = ( B \\<cdot> D )\"\n  \"( A \\<cs> C ) = ( B \\<cs> D )\"\n  using assms by auto\n\nlemma MMI_3eqtr4: assumes A1: \"A = B\" and\n  A2: \"C = A\" and\n  A3: \"D = B\"   \n  shows \"C = D\"\n  using assms by auto\n\n(*********mulneg2-negdit****************)\n\nlemma MMI_eqtr4d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> C = B\"   \n   shows \"\\<phi> \\<longrightarrow> A = C\"\n   using assms by auto\n\n(**** negdi2t - nnncan1t ***************)\n\nlemma MMI_3eqtr3rd: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> A = C\" and\n    A3: \"\\<phi> \\<longrightarrow> B = D\"   \n   shows \"\\<phi> \\<longrightarrow> D = C\"\n   using assms by auto\n\nlemma MMI_sylanc: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\" and\n    A2: \"\\<theta> \\<longrightarrow> \\<phi>\" and\n    A3: \"\\<theta> \\<longrightarrow> \\<psi>\"   \n   shows \"\\<theta> \\<longrightarrow> ch\"\n   using assms by auto\n\n(*** nnncan2t-pnpcan2t *******************)\n\nlemma MMI_anim12i: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"ch \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> ch ) \\<longrightarrow> ( \\<psi> \\<and> \\<theta> )\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreqan12d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<psi> \\<longrightarrow> C = D\"   \n   shows \n  \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ( A \\<ca> C ) = ( B \\<ca> D )\"\n  \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ( A \\<cs> C ) = ( B \\<cs> D )\"\n  \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ( A \\<cdot> C ) = ( B \\<cdot> D )\"\n   using assms by auto\n\nlemma MMI_sylanr2: assumes A1: \"( \\<phi> \\<and> ( \\<psi> \\<and> ch ) ) \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longrightarrow> ch\"   \n   shows \"( \\<phi> \\<and> ( \\<psi> \\<and> \\<tau> ) ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_sylanl2: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longrightarrow> \\<psi>\"   \n   shows \"( ( \\<phi> \\<and> \\<tau> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_ancom2s: assumes A1: \"( \\<phi> \\<and> ( \\<psi> \\<and> ch ) ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> ( ch \\<and> \\<psi> ) ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_anandis: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ( \\<phi> \\<and> ch ) ) \\<longrightarrow> \\<tau>\"   \n   shows \"( \\<phi> \\<and> ( \\<psi> \\<and> ch ) ) \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_sylan9eq: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<psi> \\<longrightarrow> B = C\"   \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> A = C\"\n   using assms by auto\n\n(******pnncant-mul0ort**********************)\n\nlemma MMI_keephyp: assumes A1: \"A = if ( \\<phi> , A , B ) \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> \\<theta> )\" and\n    A2: \"B = if ( \\<phi> , A , B ) \\<longrightarrow> ( ch \\<longleftrightarrow> \\<theta> )\" and\n    A3: \"\\<psi>\" and\n    A4: \"ch\"   \n   shows \"\\<theta>\"\nproof -\n  { assume \"\\<phi>\"\n    with A1 A3 have \"\\<theta>\" by simp }\n  moreover\n  { assume \"\\<not>\\<phi>\"\n    with A2 A4 have \"\\<theta>\" by simp }\n  ultimately show \"\\<theta>\" by auto\nqed\n\nlemma MMI_eleq1: \n   shows \"A = B \\<longrightarrow> ( A \\<in> C \\<longleftrightarrow> B \\<in> C )\"\n  by auto\n\nlemma MMI_pm4_2i: \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> \\<psi> )\"\n  by auto\n\nlemma MMI_3anbi123d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<tau> )\" and\n    A3: \"\\<phi> \\<longrightarrow> ( \\<eta> \\<longleftrightarrow> \\<zeta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<and> \\<theta> \\<and> \\<eta> ) \\<longleftrightarrow> ( ch \\<and> \\<tau> \\<and> \\<zeta> ) )\"\n   using assms by auto\n\nlemma MMI_imbi12d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<tau> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<longrightarrow> \\<theta> ) \\<longleftrightarrow> ( ch \\<longrightarrow> \\<tau> ) )\"\n   using assms by auto\n\nlemma MMI_bitrd: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( ch \\<longleftrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_df_ne: \n   shows \"( A \\<noteq> B \\<longleftrightarrow> \\<not> ( A = B ) )\"\n  by auto\n\nlemma MMI_3pm3_2i: assumes A1: \"\\<phi>\" and\n    A2: \"\\<psi>\" and\n    A3: \"ch\"   \n   shows \"\\<phi> \\<and> \\<psi> \\<and> ch\"\n   using assms by auto\n\nlemma MMI_eqeq2i: assumes A1: \"A = B\"   \n   shows \"C = A \\<longleftrightarrow> C = B\"\n   using assms by auto\n\nlemma MMI_syl5bbr: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<psi> \\<longleftrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_biimpd: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_orrd: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<not> ( \\<psi> ) \\<longrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<or> ch )\"\n   using assms by auto\n\nlemma MMI_jaoi: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"ch \\<longrightarrow> \\<psi>\"   \n   shows \"( \\<phi> \\<or> ch ) \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_oridm: \n   shows \"( \\<phi> \\<or> \\<phi> ) \\<longleftrightarrow> \\<phi>\"\n  by auto\n\nlemma MMI_orbi1d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<or> \\<theta> ) \\<longleftrightarrow> ( ch \\<or> \\<theta> ) )\"\n   using assms by auto\n\nlemma MMI_orbi2d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<theta> \\<or> \\<psi> ) \\<longleftrightarrow> ( \\<theta> \\<or> ch ) )\"\n   using assms by auto\n\n(********* muln0bt-receu ******************)\n\nlemma MMI_3bitr4g: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<theta> \\<longleftrightarrow> \\<psi>\" and\n    A3: \"\\<tau> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<tau> )\"\n   using assms by auto\n\nlemma MMI_negbid: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<not> ( \\<psi> ) \\<longleftrightarrow> \\<not> ( ch ) )\"\n   using assms by auto\n\nlemma MMI_ioran: \n   shows \"\\<not> ( ( \\<phi> \\<or> \\<psi> ) ) \\<longleftrightarrow> \n ( \\<not> ( \\<phi> ) \\<and> \\<not> ( \\<psi> ) )\"\n  by auto\n\nlemma MMI_syl6rbb: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"ch \\<longleftrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_anbi12i: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"ch \\<longleftrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> ch ) \\<longleftrightarrow> ( \\<psi> \\<and> \\<theta> )\"\n   using assms by auto\n\n(*******divmul-divclz ******************)\n\n\nlemma MMI_keepel: assumes A1: \"A \\<in> C\" and\n    A2: \"B \\<in> C\"   \n   shows \"if ( \\<phi> , A , B ) \\<in> C\"\n   using assms by auto\n\nlemma MMI_imbi2d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<theta> \\<longrightarrow> \\<psi> ) \\<longleftrightarrow> ( \\<theta> \\<longrightarrow> ch ) )\"\n   using assms by auto\n\n(** this was recognized as known , although not proven yet**)\n\nlemma MMI_eqeltr: assumes \"A = B\" and \"B \\<in> C\"\n  shows \"A \\<in> C\" using assms by auto\n\n(*****divclt-divcan2t*******************)\n\nlemma MMI_3impia: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> )\"   \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(********* divne0bt-divrecz************)\n\nlemma MMI_eqneqd: assumes A1: \"\\<phi> \\<longrightarrow> ( A = B \\<longleftrightarrow> C = D )\"   \n   shows \"\\<phi> \\<longrightarrow> ( A \\<noteq> B \\<longleftrightarrow> C \\<noteq> D )\"\n   using assms by auto\n\nlemma MMI_3ad2ant2: assumes A1: \"\\<phi> \\<longrightarrow> ch\"   \n   shows \"( \\<psi> \\<and> \\<phi> \\<and> \\<theta> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_mp3anl3: assumes A1: \"ch\" and\n    A2: \"( ( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<and> \\<theta> ) \\<longrightarrow> \\<tau>\"   \n   shows \"( ( \\<phi> \\<and> \\<psi> ) \\<and> \\<theta> ) \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_bitr4d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_neeq1d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\"   \n   shows \"\\<phi> \\<longrightarrow> ( A \\<noteq> C \\<longleftrightarrow> B \\<noteq> C )\"\n   using assms by auto\n\n(*******divrect-div23***********************)\n\nlemma MMI_3anim123i: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"ch \\<longrightarrow> \\<theta>\" and\n    A3: \"\\<tau> \\<longrightarrow> \\<eta>\"   \n   shows \"( \\<phi> \\<and> ch \\<and> \\<tau> ) \\<longrightarrow> ( \\<psi> \\<and> \\<theta> \\<and> \\<eta> )\"\n   using assms by auto\n\nlemma MMI_3exp: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> ) )\"\n   using assms by auto\n\nlemma MMI_exp4a: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ( ch \\<and> \\<theta> ) \\<longrightarrow> \\<tau> ) )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> ( \\<theta> \\<longrightarrow> \\<tau> ) ) )\"\n   using assms by auto\n\nlemma MMI_3imp1: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> ( \\<theta> \\<longrightarrow> \\<tau> ) ) )\"   \n   shows \"( ( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<and> \\<theta> ) \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_anim1i: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"( \\<phi> \\<and> ch ) \\<longrightarrow> ( \\<psi> \\<and> ch )\"\n   using assms by auto\n\nlemma MMI_3adantl1: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( ( \\<tau> \\<and> \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_3adantl2: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( ( \\<phi> \\<and> \\<tau> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_3comr: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( ch \\<and> \\<phi> \\<and> \\<psi> ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(***********divdirz-div11t*************************)\n\nlemma MMI_bitr3: assumes A1: \"\\<psi> \\<longleftrightarrow> \\<phi>\" and\n    A2: \"\\<psi> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longleftrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_anbi12d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<tau> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<and> \\<theta> ) \\<longleftrightarrow> ( ch \\<and> \\<tau> ) )\"\n   using assms by auto\n\nlemma MMI_pm3_26i: assumes A1: \"\\<phi> \\<and> \\<psi>\"   \n   shows \"\\<phi>\"\n   using assms by auto\n\nlemma MMI_pm3_27i: assumes A1: \"\\<phi> \\<and> \\<psi>\"   \n   shows \"\\<psi>\"\n   using assms by auto\n\n(*********dividt-divsubdirt************************)\n\nlemma MMI_anabsan: assumes A1: \"( ( \\<phi> \\<and> \\<phi> ) \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_3eqtr4rd: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> C = A\" and\n    A3: \"\\<phi> \\<longrightarrow> D = B\"   \n   shows \"\\<phi> \\<longrightarrow> D = C\"\n   using assms by auto\n\nlemma MMI_syl3an1: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longrightarrow> \\<phi>\"   \n   shows \"( \\<tau> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_syl3anl2: assumes A1: \"( ( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<and> \\<theta> ) \\<longrightarrow> \\<tau>\" and\n    A2: \"\\<eta> \\<longrightarrow> \\<psi>\"   \n   shows \"( ( \\<phi> \\<and> \\<eta> \\<and> ch ) \\<and> \\<theta> ) \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\n(******* recrect-divmuldiv ****************)\n\n\nlemma MMI_jca: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"\\<phi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<and> ch )\"\n   using assms by auto\n\nlemma MMI_3ad2ant3: assumes A1: \"\\<phi> \\<longrightarrow> ch\"   \n   shows \"( \\<psi> \\<and> \\<theta> \\<and> \\<phi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_anim2i: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"( ch \\<and> \\<phi> ) \\<longrightarrow> ( ch \\<and> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_ancom: \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longleftrightarrow> ( \\<psi> \\<and> \\<phi> )\"\n  by auto\n\nlemma MMI_anbi1i: assumes Aaa: \"\\<phi> \\<longleftrightarrow> \\<psi>\"   \n   shows \"( \\<phi> \\<and> ch ) \\<longleftrightarrow> ( \\<psi> \\<and> ch )\"\n   using assms by auto\n\nlemma MMI_an42: \n   shows \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ( ch \\<and> \\<theta> ) ) \\<longleftrightarrow> \n ( ( \\<phi> \\<and> ch ) \\<and> ( \\<theta> \\<and> \\<psi> ) )\"\n  by auto\n\nlemma MMI_sylanb: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\" and\n    A2: \"\\<theta> \\<longleftrightarrow> \\<phi>\"   \n   shows \"( \\<theta> \\<and> \\<psi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_an4: \n   shows \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ( ch \\<and> \\<theta> ) ) \\<longleftrightarrow> \n ( ( \\<phi> \\<and> ch ) \\<and> ( \\<psi> \\<and> \\<theta> ) )\"\n  by auto\n\nlemma MMI_syl2anb: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\" and\n    A2: \"\\<theta> \\<longleftrightarrow> \\<phi>\" and\n    A3: \"\\<tau> \\<longleftrightarrow> \\<psi>\"   \n   shows \"( \\<theta> \\<and> \\<tau> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_eqtr2d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> B = C\"   \n   shows \"\\<phi> \\<longrightarrow> C = A\"\n   using assms by auto\n\nlemma MMI_sylbid: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_sylanl1: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longrightarrow> \\<phi>\"   \n   shows \"( ( \\<tau> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_sylan2b: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\" and\n    A2: \"\\<theta> \\<longleftrightarrow> \\<psi>\"   \n   shows \"( \\<phi> \\<and> \\<theta> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_pm3_22: \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ( \\<psi> \\<and> \\<phi> )\"\n  by auto\n\nlemma MMI_ancli: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<phi> \\<and> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_ad2antlr: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"( ( ch \\<and> \\<phi> ) \\<and> \\<theta> ) \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_biimpa: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_sylan2i: assumes A1: \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta> )\" and\n    A2: \"\\<tau> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<and> \\<tau> ) \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_3jca: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"\\<phi> \\<longrightarrow> ch\" and\n    A3: \"\\<phi> \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<and> ch \\<and> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_com34: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> ( \\<theta> \\<longrightarrow> \\<tau> ) ) )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( \\<theta> \\<longrightarrow> ( ch \\<longrightarrow> \\<tau> ) ) )\"\n   using assms by auto\n\nlemma MMI_imp43: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> ( \\<theta> \\<longrightarrow> \\<tau> ) ) )\"   \n   shows \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ( ch \\<and> \\<theta> ) ) \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_3anass: \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longleftrightarrow> ( \\<phi> \\<and> ( \\<psi> \\<and> ch ) )\"\n  by auto\n\n(************ divmul13-redivclt*************)\n\nlemma MMI_3eqtr4r: assumes A1: \"A = B\" and\n    A2: \"C = A\" and\n    A3: \"D = B\"   \n   shows \"D = C\"\n   using assms by auto\n\nlemma MMI_jctl: assumes A1: \"\\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<and> \\<phi> )\"\n   using assms by auto\n\nlemma MMI_sylibr: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"ch \\<longleftrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_mpanl1: assumes A1: \"\\<phi>\" and\n    A2: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_a1i: assumes A1: \"\\<phi>\"   \n   shows \"\\<psi> \\<longrightarrow> \\<phi>\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_opreqan12rd: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<psi> \\<longrightarrow> C = D\"   \n   shows \n  \"( \\<psi> \\<and> \\<phi> ) \\<longrightarrow> ( A \\<ca> C ) = ( B \\<ca> D )\"\n  \"( \\<psi> \\<and> \\<phi> ) \\<longrightarrow> ( A \\<cdot> C ) = ( B \\<cdot> D )\"\n  \"( \\<psi> \\<and> \\<phi> ) \\<longrightarrow> ( A \\<cs> C ) = ( B \\<cs> D )\"\n  \"( \\<psi> \\<and> \\<phi> ) \\<longrightarrow> ( A \\<cdiv> C ) = ( B \\<cdiv> D )\"\n   using assms by auto\n\nlemma MMI_3adantl3: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( ( \\<phi> \\<and> \\<psi> \\<and> \\<tau> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_sylbi: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"\\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\n(*******pnfnre,minfnre*******************)\n\nlemma MMI_eirr: \n   shows \"\\<not> ( A \\<in> A )\"\n  by (rule mem_not_refl)\n\nlemma MMI_eleq1i: assumes A1: \"A = B\"   \n   shows \"A \\<in> C \\<longleftrightarrow> B \\<in> C\"\n   using assms by auto\n\nlemma MMI_mtbir: assumes A1: \"\\<not> ( \\<psi> )\" and\n    A2: \"\\<phi> \\<longleftrightarrow> \\<psi>\"   \n   shows \"\\<not> ( \\<phi> )\"\n   using assms by auto\n\nlemma MMI_mto: assumes A1: \"\\<not> ( \\<psi> )\" and\n    A2: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"\\<not> ( \\<phi> )\"\n   using assms by auto\n\nlemma MMI_df_nel: \n   shows \"( A \\<notin> B \\<longleftrightarrow> \\<not> ( A \\<in> B ) )\"\n  by auto\n\nlemma MMI_snid: assumes A1: \"A isASet\"   \n   shows \"A \\<in> { A }\"\n   using assms by auto\n\nlemma MMI_en2lp: \n   shows \"\\<not> ( A \\<in> B \\<and> B \\<in> A )\"\nproof\n  assume A1: \"A \\<in> B \\<and> B \\<in> A\"\n  then have \"A \\<in> B\" by simp\n  moreover\n  { assume \"\\<not> (\\<not> ( A \\<in> B \\<and> B \\<in> A ))\"\n    then have \"B\\<in>A\" by auto}\n  ultimately have \"\\<not>( A \\<in> B \\<and> B \\<in> A )\"\n    by (rule mem_asym)\n  with A1 show False by simp\nqed\n\nlemma MMI_imnan: \n   shows \"( \\<phi> \\<longrightarrow> \\<not> ( \\<psi> ) ) \\<longleftrightarrow> \\<not> ( ( \\<phi> \\<and> \\<psi> ) )\"\n  by auto\n\n(****ressxr-ltxrltt*******************************)\n\nlemma MMI_sseqtr4: assumes A1: \"A \\<subseteq> B\" and\n    A2: \"C = B\"   \n   shows \"A \\<subseteq> C\"\n   using assms by auto\n\nlemma MMI_ssun1: \n   shows \"A \\<subseteq> ( A \\<union> B )\"\n  by auto\n\nlemma MMI_ibar: \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ( \\<phi> \\<and> \\<psi> ) )\"\n  by auto\n\nlemma MMI_mtbiri: assumes Amin: \"\\<not> ( ch )\" and\n    Amaj: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> \\<not> ( \\<psi> )\"\n   using assms by auto\n\nlemma MMI_con2i: assumes Aa: \"\\<phi> \\<longrightarrow> \\<not> ( \\<psi> )\"   \n   shows \"\\<psi> \\<longrightarrow> \\<not> ( \\<phi> )\"\n   using assms by auto\n\nlemma MMI_intnand: assumes A1: \"\\<phi> \\<longrightarrow> \\<not> ( \\<psi> )\"   \n   shows \"\\<phi> \\<longrightarrow> \\<not> ( ( ch \\<and> \\<psi> ) )\"\n   using assms by auto\n\nlemma MMI_intnanrd: assumes A1: \"\\<phi> \\<longrightarrow> \\<not> ( \\<psi> )\"   \n   shows \"\\<phi> \\<longrightarrow> \\<not> ( ( \\<psi> \\<and> ch ) )\"\n   using assms by auto\n\nlemma MMI_biorf: \n   shows \"\\<not> ( \\<phi> ) \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ( \\<phi> \\<or> \\<psi> ) )\"\n  by auto\n\nlemma MMI_bitr2d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( ch \\<longleftrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_orass: \n   shows \"( ( \\<phi> \\<or> \\<psi> ) \\<or> ch ) \\<longleftrightarrow> ( \\<phi> \\<or> ( \\<psi> \\<or> ch ) )\"\n  by auto\n\nlemma MMI_orcom: \n   shows \"( \\<phi> \\<or> \\<psi> ) \\<longleftrightarrow> ( \\<psi> \\<or> \\<phi> )\"\n  by auto\n\n(************** axlttri,axlttrn****************)\n(* note these are not really axioms of \n    complex numbers, just extensions of\n    pre_axlttri and pre_axlttrn that are assumed\n    in the context.                           \n*)\n\nlemma MMI_3bitr4d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<psi> )\" and\n    A3: \"\\<phi> \\<longrightarrow> ( \\<tau> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<tau> )\"\n   using assms by auto\n\nlemma MMI_3imtr4d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<psi> )\" and\n    A3: \"\\<phi> \\<longrightarrow> ( \\<tau> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longrightarrow> \\<tau> )\"\n   using assms by auto\n\n(**********axltadd-ltnlet*************************)\n\nlemma MMI_3impdi: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ( \\<phi> \\<and> ch ) ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_bi2anan9: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<theta> \\<longrightarrow> ( \\<tau> \\<longleftrightarrow> \\<eta> )\"   \n   shows \"( \\<phi> \\<and> \\<theta> ) \\<longrightarrow> ( ( \\<psi> \\<and> \\<tau> ) \\<longleftrightarrow> ( ch \\<and> \\<eta> ) )\"\n   using assms by auto\n\nlemma MMI_ssel2: \n   shows \"( ( A \\<subseteq> B \\<and> C \\<in> A ) \\<longrightarrow> C \\<in> B )\"\n  by auto\n\nlemma MMI_an1rs: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( ( \\<phi> \\<and> ch ) \\<and> \\<psi> ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(*lemma MMI_ralbidva_original: \n     assumes A1: \"( \\<phi> \\<and> x \\<in> A ) \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow>  ( ( \\<forall> x \\<in> A . \\<psi> ) \\<longleftrightarrow> ( \\<forall> x \\<in> A . ch ) )\"\n   using assms by auto;*)\n\nlemma MMI_ralbidva: assumes A1: \"\\<forall>x. ( \\<phi> \\<and> x \\<in> A ) \\<longrightarrow> ( \\<psi>(x) \\<longleftrightarrow> ch(x) )\"   \n   shows \"\\<phi> \\<longrightarrow>  ( ( \\<forall> x \\<in> A . \\<psi>(x) ) \\<longleftrightarrow> ( \\<forall> x \\<in> A . ch(x) ) )\"\n   using assms by auto\n\nlemma MMI_rexbidva: assumes A1: \"\\<forall>x. ( \\<phi> \\<and> x \\<in> A ) \\<longrightarrow> ( \\<psi>(x) \\<longleftrightarrow> ch(x) )\"   \n   shows \"\\<phi> \\<longrightarrow>  ( ( \\<exists> x \\<in> A . \\<psi>(x) ) \\<longleftrightarrow> ( \\<exists> x \\<in> A . ch(x) ) )\"\n   using assms by auto\n\nlemma MMI_con2bid: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> \\<not> ( ch ) )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ch \\<longleftrightarrow> \\<not> ( \\<psi> ) )\"\n   using assms by auto\n\n(********ltso***************************)\nlemma MMI_so: assumes \n  A1: \"\\<forall>x y z. ( x \\<in> A \\<and> y \\<in> A \\<and> z \\<in> A ) \\<longrightarrow>   \n  ( ( \\<langle>x,y\\<rangle> \\<in> R \\<longleftrightarrow> \\<not> ( ( x = y \\<or> \\<langle>y, x\\<rangle> \\<in> R ) ) ) \\<and> \n  ( ( \\<langle>x, y\\<rangle> \\<in> R  \\<and> \\<langle>y, z\\<rangle> \\<in> R ) \\<longrightarrow> \\<langle>x, z\\<rangle> \\<in> R ) )\"   \n  shows \"R Orders A\"\n  using assms StrictOrder_def by auto\n\n(***********lttri2t-letri3t**********************)\n\nlemma MMI_con1bid: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<not> ( \\<psi> ) \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<not> ( ch ) \\<longleftrightarrow> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_sotrieq: \n  shows \"( (R Orders A) \\<and> ( B \\<in> A \\<and> C \\<in> A ) ) \\<longrightarrow>   \n  ( B = C \\<longleftrightarrow> \\<not> ( ( \\<langle>B,C\\<rangle> \\<in> R \\<or> \\<langle>C, B\\<rangle> \\<in> R ) ) )\"\nproof -\n  { assume A1: \"R Orders A\"  and A2: \"B \\<in> A \\<and> C \\<in> A\" \n    from A1 have \"\\<forall>x y z. (x\\<in>A \\<and> y\\<in>A \\<and> z\\<in>A) \\<longrightarrow> \n      (\\<langle>x,y\\<rangle> \\<in> R \\<longleftrightarrow> \\<not>(x=y \\<or> \\<langle>y,x\\<rangle> \\<in> R)) \\<and> \n      (\\<langle>x,y\\<rangle> \\<in> R \\<and> \\<langle>y,z\\<rangle> \\<in> R \\<longrightarrow> \\<langle>x,z\\<rangle> \\<in> R)\"\n      by (unfold StrictOrder_def)\n    then have \n      \"\\<forall>x y. x\\<in>A \\<and> y\\<in>A \\<longrightarrow> (\\<langle>x,y\\<rangle> \\<in> R \\<longleftrightarrow> \\<not>(x=y \\<or> \\<langle>y,x\\<rangle> \\<in> R))\"\n      by auto\n    with A2 have I: \"\\<langle>B,C\\<rangle> \\<in> R \\<longleftrightarrow> \\<not>(B=C \\<or> \\<langle>C,B\\<rangle> \\<in> R)\"\n      by blast\n    then have \"B = C \\<longleftrightarrow> \\<not> ( \\<langle>B,C\\<rangle> \\<in> R \\<or> \\<langle>C, B\\<rangle> \\<in> R )\"\n      by auto\n  } then show \"( (R Orders A) \\<and> ( B \\<in> A \\<and> C \\<in> A ) ) \\<longrightarrow>   \n      ( B = C \\<longleftrightarrow> \\<not> ( ( \\<langle>B,C\\<rangle> \\<in> R \\<or> \\<langle>C, B\\<rangle> \\<in> R ) ) )\" by simp\nqed\n\nlemma MMI_bicomd: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ch \\<longleftrightarrow> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_sotrieq2: \n  shows \"( R Orders A \\<and> ( B \\<in> A \\<and> C \\<in> A ) ) \\<longrightarrow>   \n  ( B =  C \\<longleftrightarrow> ( \\<not> ( \\<langle>B, C\\<rangle> \\<in> R ) \\<and> \\<not> ( \\<langle>C, B\\<rangle> \\<in> R ) ) )\"\n  using  MMI_sotrieq by auto\n\nlemma MMI_orc: \n   shows \"\\<phi> \\<longrightarrow> ( \\<phi> \\<or> \\<psi> )\"\n  by auto\n\nlemma MMI_syl6bbr: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<theta> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> \\<theta> )\"\n   using assms by auto\n\n(***********leloet-lelttrd*****************)\n\nlemma MMI_orbi1i: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\"   \n   shows \"( \\<phi> \\<or> ch ) \\<longleftrightarrow> ( \\<psi> \\<or> ch )\"\n   using assms by auto\n\nlemma MMI_syl5rbbr: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<psi> \\<longleftrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( ch \\<longleftrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_anbi2d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<theta> \\<and> \\<psi> ) \\<longleftrightarrow> ( \\<theta> \\<and> ch ) )\"\n   using assms by auto\n\nlemma MMI_ord: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<or> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<not> ( \\<psi> ) \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_impbid: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( ch \\<longrightarrow> \\<psi> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"\n   using assms by blast\n\nlemma MMI_jcad: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<and> \\<theta> ) )\"\n   using assms by auto\n\nlemma MMI_ax_1: \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<phi> )\"\n  by auto\n\nlemma MMI_pm2_24: \n   shows \"\\<phi> \\<longrightarrow> ( \\<not> ( \\<phi> ) \\<longrightarrow> \\<psi> )\"\n  by auto\n\nlemma MMI_imp3a: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> ) )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_breq1: \n   shows \n  \"A = B \\<longrightarrow> ( A \\<lsq> C \\<longleftrightarrow> B \\<lsq> C )\"\n  \"A = B \\<longrightarrow> ( A \\<ls> C \\<longleftrightarrow> B \\<ls> C )\"\n  by auto\n\nlemma MMI_biimprd: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ch \\<longrightarrow> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_jaod: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<or> \\<theta> ) \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_com23: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> ) )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ch \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> ) )\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_breq2: \n   shows \n  \"A = B \\<longrightarrow> ( C \\<lsq> A \\<longleftrightarrow> C \\<lsq> B )\"\n  \"A = B \\<longrightarrow> ( C \\<ls> A \\<longleftrightarrow> C \\<ls> B )\"\n  by auto\n\nlemma MMI_syld: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( ch \\<longrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_biimpcd: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<psi> \\<longrightarrow> ( \\<phi> \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_mp2and: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"\\<phi> \\<longrightarrow> ch\" and\n    A3: \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(**********ltletrd-renemnft*********************)\n\nlemma MMI_sonr: \n   shows \"( R Orders A \\<and> B \\<in> A ) \\<longrightarrow> \\<not> ( \\<langle>B,B\\<rangle> \\<in> R )\"\n  unfolding StrictOrder_def by auto\n\nlemma MMI_orri: assumes A1: \"\\<not> ( \\<phi> ) \\<longrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<or> \\<psi>\"\n   using assms by auto\n\nlemma MMI_mpbiri: assumes Amin: \"ch\" and\n    Amaj: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_pm2_46: \n   shows \"\\<not> ( ( \\<phi> \\<or> \\<psi> ) ) \\<longrightarrow> \\<not> ( \\<psi> )\"\n  by auto\n\nlemma MMI_elun: \n   shows \"A \\<in> ( B \\<union> C ) \\<longleftrightarrow> ( A \\<in> B \\<or> A \\<in> C )\"\n  by auto\n\nlemma (in MMIsar0) MMI_pnfxr: \n   shows \"\\<cpnf> \\<in> \\<real>\\<^sup>*\"\n  using cxr_def by simp\n\nlemma MMI_elisseti: assumes A1: \"A \\<in> B\"   \n   shows \"A isASet\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_mnfxr: \n   shows \"\\<cmnf> \\<in> \\<real>\\<^sup>*\"\n  using  cxr_def by simp\n\nlemma MMI_elpr2: assumes A1: \"B isASet\" and\n    A2: \"C isASet\"   \n   shows \"A \\<in> { B , C } \\<longleftrightarrow> ( A = B \\<or> A = C )\"\n   using assms by auto\n\nlemma MMI_orbi2i: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\"   \n   shows \"( ch \\<or> \\<phi> ) \\<longleftrightarrow> ( ch \\<or> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_3orass: \n   shows \"( \\<phi> \\<or> \\<psi> \\<or> ch ) \\<longleftrightarrow> ( \\<phi> \\<or> ( \\<psi> \\<or> ch ) )\"\n  by auto\n\nlemma MMI_bitr4: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"ch \\<longleftrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longleftrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_eleq2: \n   shows \"A = B \\<longrightarrow> ( C \\<in> A \\<longleftrightarrow> C \\<in> B )\"\n  by auto\n\nlemma MMI_nelneq: \n   shows \"( A \\<in> C \\<and> \\<not> ( B \\<in> C ) ) \\<longrightarrow> \\<not> ( A = B )\"\n  by auto\n\n(************ renfdisj - pnfget *********************)\n\nlemma MMI_df_pr: \n   shows \"{ A , B } = ( { A } \\<union> { B } )\"\n  by auto\n\nlemma MMI_ineq2i: assumes A1: \"A = B\"   \n   shows \"( C \\<inter> A ) = ( C \\<inter> B )\"\n   using assms by auto\n\nlemma MMI_mt2: assumes A1: \"\\<psi>\" and\n    A2: \"\\<phi> \\<longrightarrow> \\<not> ( \\<psi> )\"   \n   shows \"\\<not> ( \\<phi> )\"\n   using assms by auto\n\nlemma MMI_disjsn: \n   shows \"( A \\<inter> { B } ) = 0 \\<longleftrightarrow> \\<not> ( B \\<in> A )\"\n  by auto\n\nlemma MMI_undisj2: \n   shows \"( ( A \\<inter> B ) =   \n 0 \\<and> ( A \\<inter> C ) =   \n 0 ) \\<longleftrightarrow> ( A \\<inter> ( B \\<union> C ) ) = 0\"\n  by auto\n\nlemma MMI_disjssun: \n   shows \"( ( A \\<inter> B ) =  0 \\<longrightarrow> ( A \\<subseteq> ( B \\<union> C ) \\<longleftrightarrow> A \\<subseteq> C ) )\"\n  by auto\n\nlemma MMI_uncom: \n   shows \"( A \\<union> B ) = ( B \\<union> A )\"\n  by auto\n\nlemma MMI_sseq2i: assumes A1: \"A = B\"   \n   shows \"( C \\<subseteq> A \\<longleftrightarrow> C \\<subseteq> B )\"\n   using assms by auto\n\nlemma MMI_disj: \n   shows \"( A \\<inter> B ) =   \n 0 \\<longleftrightarrow> ( \\<forall> x \\<in> A . \\<not> ( x \\<in> B ) )\"\n  by auto\n\nlemma MMI_syl5ibr: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\" and\n    A2: \"\\<psi> \\<longleftrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_con3d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<not> ( ch ) \\<longrightarrow> \\<not> ( \\<psi> ) )\"\n   using assms by auto\n\n(* original lemma MMI_dfrex2: \n   shows \"( \\<exists> x \\<in> A . \\<phi> ) \\<longleftrightarrow>  \\<not> ( ( \\<forall> x \\<in> A . \\<not> ( \\<phi> ) ) )\"\n  by auto*)\n\nlemma MMI_dfrex2: \n  shows \"( \\<exists> x \\<in> A . \\<phi>(x) ) \\<longleftrightarrow>  \\<not> ( ( \\<forall> x \\<in> A . \\<not> \\<phi>(x) ) )\"\n  by auto\n\nlemma MMI_visset: \n   shows \"x isASet\"\n  by auto\n\nlemma MMI_elpr: assumes A1: \"A isASet\"   \n   shows \"A \\<in> { B , C } \\<longleftrightarrow> ( A = B \\<or> A = C )\"\n   using assms by auto\n\nlemma MMI_rexbii: assumes A1: \"\\<forall>x. \\<phi>(x) \\<longleftrightarrow> \\<psi>(x)\"   \n   shows \"( \\<exists> x \\<in> A . \\<phi>(x) ) \\<longleftrightarrow> ( \\<exists> x \\<in> A . \\<psi>(x) )\"\n   using assms by auto\n\nlemma MMI_r19_43: \n   shows \"( \\<exists> x \\<in> A . ( \\<phi>(x) \\<or> \\<psi>(x) ) ) \\<longleftrightarrow>   \n ( ( \\<exists> x \\<in> A . \\<phi>(x) \\<or> ( \\<exists> x \\<in> A . \\<psi>(x) ) ) )\"\n  by auto\n\nlemma MMI_exancom: \n   shows \"( \\<exists> x . ( \\<phi>(x) \\<and> \\<psi>(x) ) ) \\<longleftrightarrow>   \n ( \\<exists> x . ( \\<psi>(x) \\<and> \\<phi>(x) ) )\"\n  by auto\n\nlemma MMI_ceqsexv: assumes A1: \"A isASet\" and\n    A2: \"\\<forall>x. x = A \\<longrightarrow> ( \\<phi>(x) \\<longleftrightarrow> \\<psi>(x) )\"   \n   shows \"( \\<exists> x . ( x = A \\<and> \\<phi>(x) ) ) \\<longleftrightarrow> \\<psi>(A)\"\n   using assms by auto\n\nlemma MMI_orbi12i_orig: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"ch \\<longleftrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<or> ch ) \\<longleftrightarrow> ( \\<psi> \\<or> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_orbi12i: assumes A1: \"(\\<exists>x. \\<phi>(x)) \\<longleftrightarrow> \\<psi>\" and\n    A2: \"(\\<exists>x. ch(x)) \\<longleftrightarrow> \\<theta>\"   \n   shows \"( \\<exists>x. \\<phi>(x) ) \\<or> (\\<exists>x. ch(x) ) \\<longleftrightarrow> ( \\<psi> \\<or> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_syl6ib: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\" and\n    A2: \"ch \\<longleftrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_intnan: assumes A1: \"\\<not> ( \\<phi> )\"   \n   shows \"\\<not> ( ( \\<psi> \\<and> \\<phi> ) )\"\n   using assms by auto\n\nlemma MMI_intnanr: assumes A1: \"\\<not> ( \\<phi> )\"   \n   shows \"\\<not> ( ( \\<phi> \\<and> \\<psi> ) )\"\n   using assms by auto\n\nlemma MMI_pm3_2ni: assumes A1: \"\\<not> ( \\<phi> )\" and\n    A2: \"\\<not> ( \\<psi> )\"   \n   shows \"\\<not> ( ( \\<phi> \\<or> \\<psi> ) )\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_breq12: \n   shows \n  \"( A = B \\<and> C = D ) \\<longrightarrow> ( A \\<ls> C \\<longleftrightarrow> B \\<ls> D )\"\n  \"( A = B \\<and> C = D ) \\<longrightarrow> ( A \\<lsq> C \\<longleftrightarrow> B \\<lsq> D )\"\n  by auto\n\nlemma MMI_necom: \n   shows \"A \\<noteq> B \\<longleftrightarrow> B \\<noteq> A\"\n  by auto\n\nlemma MMI_3jaoi: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"ch \\<longrightarrow> \\<psi>\" and\n    A3: \"\\<theta> \\<longrightarrow> \\<psi>\"   \n   shows \"( \\<phi> \\<or> ch \\<or> \\<theta> ) \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_jctr: assumes A1: \"\\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<phi> \\<and> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_olc: \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<or> \\<phi> )\"\n  by auto\n\nlemma MMI_3syl: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"\\<psi> \\<longrightarrow> ch\" and\n    A3: \"ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(************** mnflet- xrlelttrt ***************)\n\nlemma MMI_mtbird: assumes Amin: \"\\<phi> \\<longrightarrow> \\<not> ( ch )\" and\n    Amaj: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> \\<not> ( \\<psi> )\"\n   using assms by auto\n\nlemma MMI_pm2_21d: assumes A1: \"\\<phi> \\<longrightarrow> \\<not> ( \\<psi> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_3jaodan: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\" and\n    A2: \"( \\<phi> \\<and> \\<theta> ) \\<longrightarrow> ch\" and\n    A3: \"( \\<phi> \\<and> \\<tau> ) \\<longrightarrow> ch\"   \n   shows \"( \\<phi> \\<and> ( \\<psi> \\<or> \\<theta> \\<or> \\<tau> ) ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_sylan2br: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\" and\n    A2: \"\\<psi> \\<longleftrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> \\<theta> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_3jaoian: assumes A1: \"( \\<phi> \\<and> \\<psi> ) \\<longrightarrow> ch\" and\n    A2: \"( \\<theta> \\<and> \\<psi> ) \\<longrightarrow> ch\" and\n    A3: \"( \\<tau> \\<and> \\<psi> ) \\<longrightarrow> ch\"   \n   shows \"( ( \\<phi> \\<or> \\<theta> \\<or> \\<tau> ) \\<and> \\<psi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_mtbid: assumes Amin: \"\\<phi> \\<longrightarrow> \\<not> ( \\<psi> )\" and\n    Amaj: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> \\<not> ( ch )\"\n   using assms by auto\n\nlemma MMI_con1d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<not> ( \\<psi> ) \\<longrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<not> ( ch ) \\<longrightarrow> \\<psi> )\"\n   using assms by auto\n\nlemma MMI_pm2_21nd: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<not> ( \\<psi> ) \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_syl3an1b: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longleftrightarrow> \\<phi>\"   \n   shows \"( \\<tau> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_adantld: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<theta> \\<and> \\<psi> ) \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_adantrd: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<and> \\<theta> ) \\<longrightarrow> ch )\"\n   using assms by auto\n\nlemma MMI_anasss: assumes A1: \"( ( \\<phi> \\<and> \\<psi> ) \\<and> ch ) \\<longrightarrow> \\<theta>\"   \n   shows \"( \\<phi> \\<and> ( \\<psi> \\<and> ch ) ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_syl3an3b: assumes A1: \"( \\<phi> \\<and> \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longleftrightarrow> ch\"   \n   shows \"( \\<phi> \\<and> \\<psi> \\<and> \\<tau> ) \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(**************xrltletrt-lttri3***********************)\n\n\nlemma MMI_mpbid: assumes Amin: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    Amaj: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_orbi12d: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\" and\n    A2: \"\\<phi> \\<longrightarrow> ( \\<theta> \\<longleftrightarrow> \\<tau> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<or> \\<theta> ) \\<longleftrightarrow> ( ch \\<or> \\<tau> ) )\"\n   using assms by auto\n\nlemma MMI_ianor: \n   shows \"\\<not> ( \\<phi> \\<and> \\<psi> ) \\<longleftrightarrow> \\<not> \\<phi> \\<or> \\<not> \\<psi> \"\n  by auto\n\nlemma MMI_bitr2: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"\\<psi> \\<longleftrightarrow> ch\"   \n   shows \"ch \\<longleftrightarrow> \\<phi>\"\n   using assms by auto\n\nlemma MMI_biimp: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_mpan2d: assumes A1: \"\\<phi> \\<longrightarrow> ch\" and\n    A2: \"\\<phi> \\<longrightarrow> ( ( \\<psi> \\<and> ch ) \\<longrightarrow> \\<theta> )\"   \n   shows \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longrightarrow> \\<theta> )\"\n   using assms by auto\n\nlemma MMI_ad2antrr: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"( ( \\<phi> \\<and> ch ) \\<and> \\<theta> ) \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_biimpac: assumes A1: \"\\<phi> \\<longrightarrow> ( \\<psi> \\<longleftrightarrow> ch )\"   \n   shows \"( \\<psi> \\<and> \\<phi> ) \\<longrightarrow> ch\"\n   using assms by auto\n\n(***********letri3-ltne**************************)\n\nlemma MMI_con2bii: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<not> ( \\<psi> )\"   \n   shows \"\\<psi> \\<longleftrightarrow> \\<not> ( \\<phi> )\"\n   using assms by auto\n\nlemma MMI_pm3_26bd: assumes A1: \"\\<phi> \\<longleftrightarrow> ( \\<psi> \\<and> ch )\"   \n   shows \"\\<phi> \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\n(******* le2tri3 - leadd2 ***********************)\n\nlemma MMI_biimpr: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\"   \n   shows \"\\<psi> \\<longrightarrow> \\<phi>\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_3brtr3g: assumes A1: \"\\<phi> \\<longrightarrow> A \\<ls> B\" and\n    A2: \"A = C\" and\n    A3: \"B = D\"   \n   shows \"\\<phi> \\<longrightarrow> C \\<ls> D\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_breq12i: assumes A1: \"A = B\" and\n    A2: \"C = D\"   \n   shows \n  \"A \\<ls> C \\<longleftrightarrow> B \\<ls> D\"\n  \"A \\<lsq> C \\<longleftrightarrow> B \\<lsq> D\"\n   using assms by auto\n\nlemma MMI_negbii: assumes Aa: \"\\<phi> \\<longleftrightarrow> \\<psi>\"   \n   shows \"\\<not>\\<phi> \\<longleftrightarrow> \\<not>\\<psi>\"\n   using assms by auto\n\n(********* ltsubadd - addgt0 ***************)\n\nlemma (in MMIsar0) MMI_breq1i: assumes A1: \"A = B\"   \n   shows \n  \"A \\<ls> C \\<longleftrightarrow> B \\<ls> C\"\n  \"A \\<lsq> C \\<longleftrightarrow> B \\<lsq> C\"\n   using assms by auto\n\n(****** addge0 - ltneg **********************)\n\nlemma MMI_syl5eqr: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"A = C\"   \n   shows \"\\<phi> \\<longrightarrow> C = B\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_breq2d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\"   \n   shows \n   \"\\<phi> \\<longrightarrow> C \\<ls> A \\<longleftrightarrow> C \\<ls> B\"\n   \"\\<phi> \\<longrightarrow> C \\<lsq> A \\<longleftrightarrow> C \\<lsq> B\"\n   using assms by auto\n\nlemma MMI_ccase: assumes A1: \"\\<phi> \\<and> \\<psi> \\<longrightarrow> \\<tau>\" and\n    A2: \"ch \\<and> \\<psi> \\<longrightarrow> \\<tau>\" and\n    A3: \"\\<phi> \\<and> \\<theta> \\<longrightarrow> \\<tau>\" and\n    A4: \"ch \\<and> \\<theta> \\<longrightarrow> \\<tau>\"   \n   shows \"(\\<phi> \\<or> ch) \\<and> (\\<psi> \\<or> \\<theta>) \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_pm3_27bd: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi> \\<and> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_nsyl3: assumes A1: \"\\<phi> \\<longrightarrow> \\<not>\\<psi>\" and\n    A2: \"ch \\<longrightarrow> \\<psi>\"   \n   shows \"ch \\<longrightarrow> \\<not>\\<phi>\"\n   using assms by auto\n\nlemma MMI_jctild: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\" and\n    A2: \"\\<phi> \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longrightarrow> \\<theta> \\<and> ch\"\n   using assms by auto\n\nlemma MMI_jctird: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\" and\n    A2: \"\\<phi> \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longrightarrow> ch \\<and> \\<theta>\"\n   using assms by auto\n\nlemma MMI_ccase2: assumes A1: \"\\<phi> \\<and> \\<psi> \\<longrightarrow> \\<tau>\" and\n    A2: \"ch \\<longrightarrow> \\<tau>\" and\n    A3: \"\\<theta> \\<longrightarrow> \\<tau>\"   \n   shows \"(\\<phi> \\<or> ch) \\<and> (\\<psi> \\<or> \\<theta>) \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\n(******** leneg - msqgt0 **************)\n\nlemma MMI_3bitr3r: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"\\<phi> \\<longleftrightarrow> ch\" and\n    A3: \"\\<psi> \\<longleftrightarrow> \\<theta>\"   \n   shows \"\\<theta> \\<longleftrightarrow> ch\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_syl6breq: assumes A1: \"\\<phi> \\<longrightarrow> A \\<ls> B\" and\n    A2: \"B = C\"   \n   shows \n  \"\\<phi> \\<longrightarrow> A \\<ls>  C\"\n   using assms by auto\n\n(********* msqge0 - addge01t ******************)\n\nlemma MMI_pm2_61i: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"\\<not>\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"\\<psi>\"\n   using assms by auto\n\nlemma MMI_syl6req: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"B = C\"   \n   shows \"\\<phi> \\<longrightarrow> C = A\"\n   using assms by auto\n\nlemma MMI_pm2_61d: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\" and\n    A2: \"\\<phi> \\<longrightarrow> \n   \\<not>\\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_orim1d: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<or> \\<theta> \\<longrightarrow> ch \\<or> \\<theta>\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_breq1d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\"   \n   shows \n  \"\\<phi> \\<longrightarrow> A \\<ls> C \\<longleftrightarrow> B \\<ls> C\"\n  \"\\<phi> \\<longrightarrow> A \\<lsq> C \\<longleftrightarrow> B \\<lsq> C\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_breq12d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> C = D\"   \n   shows \n  \"\\<phi> \\<longrightarrow> A \\<ls> C \\<longleftrightarrow> B \\<ls> D\"\n  \"\\<phi> \\<longrightarrow> A \\<lsq> C \\<longleftrightarrow> B \\<lsq> D\"\n   using assms by auto\n\nlemma MMI_bibi2d: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   (\\<theta> \\<longleftrightarrow> \\<psi>) \\<longleftrightarrow> \n   \\<theta> \\<longleftrightarrow> ch\"\n   using assms by auto\n\n(********* addge02t - leaddsubt *************)\n\nlemma MMI_con4bid: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<not>\\<psi> \\<longleftrightarrow> \\<not>ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_3com13: assumes A1: \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"ch \\<and> \\<psi> \\<and> \\<phi> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_3bitr3rd: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\" and\n    A2: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> \\<theta>\" and\n    A3: \"\\<phi> \\<longrightarrow> \n   ch \\<longleftrightarrow> \\<tau>\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<tau> \\<longleftrightarrow> \\<theta>\"\n   using assms by auto\n\n(*********** leaddsub2t - lt2addt ***************)\nlemma MMI_3imtr4g: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\" and\n    A2: \"\\<theta> \\<longleftrightarrow> \\<psi>\" and\n    A3: \"\\<tau> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<theta> \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_expcom: assumes A1: \"\\<phi> \\<and> \\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<psi> \\<longrightarrow> \\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_breq2i: assumes A1: \"A = B\"   \n   shows \n  \"C \\<ls> A \\<longleftrightarrow> C \\<ls> B\"\n  \"C \\<lsq> A \\<longleftrightarrow> C \\<lsq> B\"\n   using assms by auto\n\nlemma MMI_3bitr2r: assumes A1: \"\\<phi> \\<longleftrightarrow> \\<psi>\" and\n    A2: \"ch \\<longleftrightarrow> \\<psi>\" and\n    A3: \"ch \\<longleftrightarrow> \\<theta>\"   \n   shows \"\\<theta> \\<longleftrightarrow> \\<phi>\"\n   using assms by auto\n\nlemma MMI_dedth4h: assumes A1: \"A =  if(\\<phi>, A, R) \\<longrightarrow> \n   \\<tau> \\<longleftrightarrow> \\<eta>\" and\n    A2: \"B =  if(\\<psi>, B, S) \\<longrightarrow> \n   \\<eta> \\<longleftrightarrow> \\<zeta>\" and\n    A3: \"C =  if(ch, C, F) \\<longrightarrow> \n   \\<zeta> \\<longleftrightarrow> si\" and\n    A4: \"D =  if(\\<theta>, D, G) \\<longrightarrow> si \\<longleftrightarrow> rh\" and\n    A5: \"rh\"   \n   shows \"(\\<phi> \\<and> \\<psi>) \\<and> ch \\<and> \\<theta> \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_anbi1d: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<and> \\<theta> \\<longleftrightarrow> ch \\<and> \\<theta>\"\n   using assms by auto\n\n\n(******** le2addt - posdift *********************)\n\nlemma (in MMIsar0) MMI_breqtrrd: assumes A1: \"\\<phi> \\<longrightarrow> A \\<ls> B\" and\n    A2: \"\\<phi> \\<longrightarrow> C = B\"   \n   shows \"\\<phi> \\<longrightarrow> A \\<ls> C\"\n   using assms by auto\n\n(******* ltnegt - posdif *****************)\n\nlemma MMI_syl3an: assumes A1: \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longrightarrow> \\<phi>\" and\n    A3: \"\\<eta> \\<longrightarrow> \\<psi>\" and\n    A4: \"\\<zeta> \\<longrightarrow> ch\"   \n   shows \"\\<tau> \\<and> \\<eta> \\<and> \\<zeta> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_3bitrd: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\" and\n    A2: \"\\<phi> \\<longrightarrow> \n   ch \\<longleftrightarrow> \\<theta>\" and\n    A3: \"\\<phi> \\<longrightarrow> \n   \\<theta> \\<longleftrightarrow> \\<tau>\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> \\<tau>\"\n   using assms by auto\n\n(************ ltnegcon1 - lt01 **********************)\n\nlemma (in MMIsar0) MMI_breqtr: assumes A1: \"A \\<ls> B\" and\n    A2: \"B = C\"   \n   shows \"A \\<ls> C\"\n   using assms by auto\n\n(*********** eqneg - ltp1 ********************)\n\nlemma MMI_mpi: assumes A1: \"\\<psi>\" and\n    A2: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_eqtr2: assumes A1: \"A = B\" and\n    A2: \"B = C\"   \n   shows \"C = A\"\n   using assms by auto\n\nlemma MMI_eqneqi: assumes A1: \"A = B \\<longleftrightarrow> C = D\"   \n   shows \"A \\<noteq> B \\<longleftrightarrow> C \\<noteq> D\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_eqbrtrrd: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<phi> \\<longrightarrow> A \\<ls> C\"   \n   shows \"\\<phi> \\<longrightarrow> B \\<ls> C\"\n   using assms by auto\n\nlemma MMI_mpd: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_mpdan: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"\\<phi> \\<and> \\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\n(************ recgt0i - ltdiv1i ***************)\n\nlemma (in MMIsar0) MMI_breqtrd: assumes A1: \"\\<phi> \\<longrightarrow> A \\<ls> B\" and\n    A2: \"\\<phi> \\<longrightarrow> B = C\"   \n   shows \"\\<phi> \\<longrightarrow> A \\<ls> C\"\n   using assms by auto\n\nlemma MMI_mpand: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_imbi1d: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   (\\<psi> \\<longrightarrow> \\<theta>) \\<longleftrightarrow> \n   (ch \\<longrightarrow> \\<theta>)\"\n   using assms by auto\n\nlemma MMI_mtbii: assumes Amin: \"\\<not>\\<psi>\" and\n    Amaj: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \\<not>ch\"\n   using assms by auto\n\n(********** ltdiv1 - lemul2t **************)\n\nlemma MMI_sylan2d: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<phi> \\<longrightarrow> \\<tau> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<and> \\<tau> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(********* ltmul2 - ltmulgt12t ***********)\nlemma MMI_imp32: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longrightarrow> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_breqan12d: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<psi> \\<longrightarrow> C = D\"   \n   shows \n  \"\\<phi> \\<and> \\<psi> \\<longrightarrow>  A \\<ls> C \\<longleftrightarrow> B \\<ls> D\"\n  \"\\<phi> \\<and> \\<psi> \\<longrightarrow>  A \\<lsq> C \\<longleftrightarrow> B \\<lsq> D\"\n   using assms by auto\n\nlemma MMI_a1dd: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longrightarrow> \\<theta> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_3brtr3d: assumes A1: \"\\<phi> \\<longrightarrow> A \\<lsq> B\" and\n    A2: \"\\<phi> \\<longrightarrow> A = C\" and\n    A3: \"\\<phi> \\<longrightarrow> B = D\"   \n   shows \"\\<phi> \\<longrightarrow> C \\<lsq> D\"\n   using assms by auto\n\nlemma MMI_ad2antll: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"ch \\<and> \\<theta> \\<and> \\<phi> \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_adantrrl: assumes A1: \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<and> \\<psi> \\<and> \\<tau> \\<and> ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_syl2ani: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<tau> \\<longrightarrow> \\<psi>\" and\n    A3: \"\\<eta> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<tau> \\<and> \\<eta> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_im2anan9: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\" and\n    A2: \"\\<theta> \\<longrightarrow> \n   \\<tau> \\<longrightarrow> \\<eta>\"   \n   shows \"\\<phi> \\<and> \\<theta> \\<longrightarrow> \n   \\<psi> \\<and> \\<tau> \\<longrightarrow> ch \\<and> \\<eta>\"\n   using assms by auto\n\nlemma MMI_ancomsd: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> \n   ch \\<and> \\<psi> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_mpani: assumes A1: \"\\<psi>\" and\n    A2: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<longrightarrow> ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_syldan: assumes A1: \"\\<phi> \\<and> \\<psi> \\<longrightarrow> ch\" and\n    A2: \"\\<phi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<and> \\<psi> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_mp3anl1: assumes A1: \"\\<phi>\" and\n    A2: \"(\\<phi> \\<and> \\<psi> \\<and> ch) \\<and> \\<theta> \\<longrightarrow> \\<tau>\"   \n   shows \"(\\<psi> \\<and> ch) \\<and> \\<theta> \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_3ad2ant1: assumes A1: \"\\<phi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<and> \\<psi> \\<and> \\<theta> \\<longrightarrow> ch\"\n   using assms by auto\n\n(********* lemulge11t - divgt0i2 ***********)\n\nlemma MMI_pm3_2: \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longrightarrow> \\<phi> \\<and> \\<psi>\"\n  by auto\n\nlemma MMI_pm2_43i: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"\\<phi> \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_jctil: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch \\<and> \\<psi>\"\n   using assms by auto\n\nlemma MMI_mpanl12: assumes A1: \"\\<phi>\" and\n    A2: \"\\<psi>\" and\n    A3: \"(\\<phi> \\<and> \\<psi>) \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(********* divgt0i - ledivmul2t ***************)\n\nlemma MMI_mpanr1: assumes A1: \"\\<psi>\" and\n    A2: \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<and> ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_ad2antrl: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"ch \\<and> \\<phi> \\<and> \\<theta> \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_3adant3r: assumes A1: \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<and> \\<psi> \\<and> ch \\<and> \\<tau> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_3adant1l: assumes A1: \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"(\\<tau> \\<and> \\<phi>) \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_3adant2r: assumes A1: \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<and> (\\<psi> \\<and> \\<tau>) \\<and> ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\n(********** lemuldivt - lerect ****************)\n\nlemma MMI_3bitr4rd: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\" and\n    A2: \"\\<phi> \\<longrightarrow> \n   \\<theta> \\<longleftrightarrow> \\<psi>\" and\n    A3: \"\\<phi> \\<longrightarrow> \n   \\<tau> \\<longleftrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<tau> \\<longleftrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_3anrev: \n   shows \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longleftrightarrow> ch \\<and> \\<psi> \\<and> \\<phi>\"\n  by auto\n\nlemma MMI_eqtr4: assumes A1: \"A = B\" and\n    A2: \"C = B\"   \n   shows \"A = C\"\n   using assms by auto\n\nlemma MMI_anidm: \n   shows \"\\<phi> \\<and> \\<phi> \\<longleftrightarrow> \\<phi>\"\n  by auto\n\nlemma MMI_bi2anan9r: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\" and\n    A2: \"\\<theta> \\<longrightarrow> \n   \\<tau> \\<longleftrightarrow> \\<eta>\"   \n   shows \"\\<theta> \\<and> \\<phi> \\<longrightarrow> \n   \\<psi> \\<and> \\<tau> \\<longleftrightarrow> ch \\<and> \\<eta>\"\n   using assms by auto\n\nlemma MMI_3imtr3g: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\" and\n    A2: \"\\<psi> \\<longleftrightarrow> \\<theta>\" and\n    A3: \"ch \\<longleftrightarrow> \\<tau>\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<theta> \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_a3d: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<not>\\<psi> \\<longrightarrow> \\<not>ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_sylan9bbr: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\" and\n    A2: \"\\<theta> \\<longrightarrow> \n   ch \\<longleftrightarrow> \\<tau>\"   \n   shows \"\\<theta> \\<and> \\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_sylan9bb: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\" and\n    A2: \"\\<theta> \\<longrightarrow> \n   ch \\<longleftrightarrow> \\<tau>\"   \n   shows \"\\<phi> \\<and> \\<theta> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_3bitr3g: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longleftrightarrow> ch\" and\n    A2: \"\\<psi> \\<longleftrightarrow> \\<theta>\" and\n    A3: \"ch \\<longleftrightarrow> \\<tau>\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<theta> \\<longleftrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_pm5_21: \n   shows \"\\<not>\\<phi> \\<and> \\<not>\\<psi> \\<longrightarrow> \n   \\<phi> \\<longleftrightarrow> \\<psi>\"\n  by auto\n\n(******** lerectOLD - ltdiv23 ************)\n\nlemma MMI_an6: \n   shows \"(\\<phi> \\<and> \\<psi> \\<and> ch) \\<and> \\<theta> \\<and> \\<tau> \\<and> \\<eta> \\<longleftrightarrow> \n   (\\<phi> \\<and> \\<theta>) \\<and> (\\<psi> \\<and> \\<tau>) \\<and> ch \\<and> \\<eta>\"\n  by auto\n\nlemma MMI_syl3anl1: assumes A1: \"(\\<phi> \\<and> \\<psi> \\<and> ch) \\<and> \\<theta> \\<longrightarrow> \\<tau>\" and\n    A2: \"\\<eta> \\<longrightarrow> \\<phi>\"   \n   shows \"(\\<eta> \\<and> \\<psi> \\<and> ch) \\<and> \\<theta> \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma MMI_imp4a: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longrightarrow> \n   ch \\<longrightarrow> \n   \\<theta> \\<longrightarrow> \\<tau>\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longrightarrow> \n   ch \\<and> \\<theta> \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_breqan12rd: assumes A1: \"\\<phi> \\<longrightarrow> A = B\" and\n    A2: \"\\<psi> \\<longrightarrow> C = D\"   \n   shows \n  \"\\<psi> \\<and> \\<phi> \\<longrightarrow>  A \\<ls> C \\<longleftrightarrow> B \\<ls> D\"\n  \"\\<psi> \\<and> \\<phi> \\<longrightarrow>  A \\<lsq> C \\<longleftrightarrow> B \\<lsq> D\"\n   using assms by auto\n\n(****** lediv23t - halfpos ******************)\n\nlemma (in MMIsar0) MMI_3brtr4d: assumes A1: \"\\<phi> \\<longrightarrow> A \\<ls> B\" and\n    A2: \"\\<phi> \\<longrightarrow> C = A\" and\n    A3: \"\\<phi> \\<longrightarrow> D = B\"   \n   shows \"\\<phi> \\<longrightarrow> C \\<ls> D\"\n   using assms by auto\n\nlemma MMI_adantrrr: assumes A1: \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<and> \\<psi> \\<and> ch \\<and> \\<tau> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_adantrlr: assumes A1: \"\\<phi> \\<and> \\<psi> \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<and> (\\<psi> \\<and> \\<tau>) \\<and> ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_imdistani: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<and> \\<psi> \\<longrightarrow> \\<phi> \\<and> ch\"\n   using assms by auto\n\nlemma MMI_anabss3: assumes A1: \"(\\<phi> \\<and> \\<psi>) \\<and> \\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<and> \\<psi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_mp3anl2: assumes A1: \"\\<psi>\" and\n    A2: \"(\\<phi> \\<and> \\<psi> \\<and> ch) \\<and> \\<theta> \\<longrightarrow> \\<tau>\"   \n   shows \"(\\<phi> \\<and> ch) \\<and> \\<theta> \\<longrightarrow> \\<tau>\"\n   using assms by auto\n\n(****** ledivp1t - squeeze0 ****************)\n\nlemma MMI_mpanl2: assumes A1: \"\\<psi>\" and\n    A2: \"(\\<phi> \\<and> \\<psi>) \\<and> ch \\<longrightarrow> \\<theta>\"   \n   shows \"\\<phi> \\<and> ch \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_mpancom: assumes A1: \"\\<psi> \\<longrightarrow> \\<phi>\" and\n    A2: \"\\<phi> \\<and> \\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<psi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_or12: \n   shows \"\\<phi> \\<or> \\<psi> \\<or> ch \\<longleftrightarrow> \\<psi> \\<or> \\<phi> \\<or> ch\"\n  by auto\n\nlemma MMI_rcla4ev: assumes A1: \"\\<forall>x. x = A \\<longrightarrow>  \\<phi>(x) \\<longleftrightarrow> \\<psi>\"   \n   shows \"A \\<in> B \\<and> \\<psi> \\<longrightarrow> ( \\<exists>x\\<in>B. \\<phi>(x) )\"\n   using assms by auto\n\nlemma MMI_jctir: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\" and\n    A2: \"ch\"   \n   shows \"\\<phi> \\<longrightarrow> \\<psi> \\<and> ch\"\n   using assms by auto\n\nlemma MMI_iffalse: \n   shows \"\\<not>\\<phi> \\<longrightarrow>  if(\\<phi>, A, B) = B\"\n  by auto\n\nlemma MMI_iftrue: \n   shows \"\\<phi> \\<longrightarrow>  if(\\<phi>, A, B) = A\"\n  by auto\n\nlemma MMI_pm2_61d2: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<not>\\<psi> \\<longrightarrow> ch\" and\n    A2: \"\\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_pm2_61dan: assumes A1: \"\\<phi> \\<and> \\<psi> \\<longrightarrow> ch\" and\n    A2: \"\\<phi> \\<and> \\<not>\\<psi> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_orcanai: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi> \\<or> ch\"   \n   shows \"\\<phi> \\<and> \\<not>\\<psi> \\<longrightarrow> ch\"\n   using assms by auto\n\nlemma MMI_ifcl: \n   shows \"A \\<in> C \\<and> B \\<in> C \\<longrightarrow>  if(\\<phi>, A, B) \\<in> C\"\n  by auto\n\nlemma MMI_imim2i: assumes A1: \"\\<phi> \\<longrightarrow> \\<psi>\"   \n   shows \"(ch \\<longrightarrow> \\<phi>) \\<longrightarrow> ch \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_com13: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longrightarrow> ch \\<longrightarrow> \\<theta>\"   \n   shows \"ch \\<longrightarrow> \n   \\<psi> \\<longrightarrow> \n   \\<phi> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_rcla4v: assumes A1: \"\\<forall>x. x = A \\<longrightarrow>  \\<phi>(x) \\<longleftrightarrow> \\<psi>\"   \n   shows \"A \\<in> B \\<longrightarrow>  (\\<forall>x\\<in>B. \\<phi>(x)) \\<longrightarrow> \\<psi>\"\n   using assms by auto\n\nlemma MMI_syl5d: assumes A1: \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longrightarrow> ch \\<longrightarrow> \\<theta>\" and\n    A2: \"\\<phi> \\<longrightarrow> \\<tau> \\<longrightarrow> ch\"   \n   shows \"\\<phi> \\<longrightarrow> \n   \\<psi> \\<longrightarrow> \n   \\<tau> \\<longrightarrow> \\<theta>\"\n   using assms by auto\n\nlemma MMI_eqcoms: assumes A1: \"A = B \\<longrightarrow> \\<phi>\"   \n   shows \"B = A \\<longrightarrow> \\<phi>\"\n   using assms by auto\n\n(******* nnssre - nnex **************)\n\nlemma MMI_rgen: assumes A1: \"\\<forall>x. x \\<in> A \\<longrightarrow> \\<phi>(x)\"   \n   shows \"\\<forall>x\\<in>A. \\<phi>(x)\"\n   using assms by auto\n\nlemma (in MMIsar0) MMI_reex: \n   shows \"\\<real> = \\<real>\"\n  by auto\n\nlemma MMI_sstri: assumes A1: \"A \\<subseteq>B\" and\n    A2: \"B \\<subseteq>C\"   \n   shows \"A \\<subseteq>C\"\n   using assms by auto\n\nlemma MMI_ssexi: assumes A1: \"B = B\" and\n    A2: \"A \\<subseteq>B\"   \n   shows \"A = A\"\n   using assms by auto\n\n\nend\n", "meta": {"author": "SKolodynski", "repo": "IsarMathLib", "sha": "879c6b779ca00364879aa0232b0aa9f18bafa85a", "save_path": "github-repos/isabelle/SKolodynski-IsarMathLib", "path": "github-repos/isabelle/SKolodynski-IsarMathLib/IsarMathLib-879c6b779ca00364879aa0232b0aa9f18bafa85a/IsarMathLib/MMI_logic_and_sets.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5428632831725052, "lm_q2_score": 0.5544704649604273, "lm_q1q2_score": 0.30100165703060305}}
{"text": "theory Lense_Knowledge_Base (* TODO: Improve Theory Name! *)\n  imports SE_Monad More_Eisbach_Tools\nbegin\n\nsection \\<open>Generic Lens Based Transfer Tool\\<close>\ndefinition \"VAL L x s \\<equiv> hlens L \\<and> get L s = Some x\"\n\nlemma VAL_get[simp]:\n  assumes \"VAL L x s\"\n  shows \"pre_get L s\" \"get' L s = x\"\n  using assms unfolding VAL_def by auto\n\n\ndefinition DEL_TAG :: \"bool \\<Rightarrow> bool\" where \"DEL_TAG x \\<equiv> x\"\ndefinition DEL_TAG' :: \"bool \\<Rightarrow> bool\" where \"DEL_TAG' x \\<equiv> True\"\nlemma DEL_TAG_cong[cong]: \"DEL_TAG x = DEL_TAG x\" ..\nlemma DEL_TAG'_cong[cong]: \"DEL_TAG' x = DEL_TAG' x\" ..\n\nlemmas DEL_congs = DEL_TAG_cong DEL_TAG'_cong\n\nlemma DEL_TAG'E: \"P \\<Longrightarrow> DEL_TAG' P \\<Longrightarrow> Q \\<Longrightarrow> Q\" .\n\nlemma DEL_TAG'_simp:\n  \"DEL_TAG' x \\<Longrightarrow> x = DEL_TAG x\"\n  by (auto simp: DEL_TAG_def)\n\n\n\ndefinition KBXFER :: \"_ \\<Rightarrow> _ \\<Rightarrow> _ \\<Rightarrow> bool\" where \"KBXFER R s s' \\<equiv> R s s'\"\n\nlemma KBXFER_trans: \"KBXFER R\\<^sub>1 s sh \\<Longrightarrow> KBXFER R\\<^sub>2 sh s' \\<Longrightarrow> KBXFER (R\\<^sub>1 OO R\\<^sub>2) s s'\"\n  by (auto simp: KBXFER_def)\n\nlemma KBXFER_transE:\n  assumes \"KBXFER R s\\<^sub>1 s\\<^sub>2\"\n  assumes \"KBXFER R' s\\<^sub>2 s\\<^sub>3\"\n  obtains \"KBXFER (R OO R') s\\<^sub>1 s\\<^sub>3\" \"DEL_TAG' (KBXFER R' s\\<^sub>2 s\\<^sub>3)\"\n  using KBXFER_trans[OF assms] by (auto simp: DEL_TAG'_def)\n\nnamed_theorems DEL_KBXFER_simps\n\nlemma [DEL_KBXFER_simps]:\n  assumes \"KBXFER R s s'\"\n  shows\n    \"VAL L x s = DEL_TAG (VAL L x s)\"\n    by (auto simp: DEL_TAG_def)\n\n\nlemma KBXFER_simp: \"KBXFER R s s' \\<Longrightarrow> eq_on\\<^sub>L R L \\<Longrightarrow> VAL L x s = VAL L x s'\"\n  unfolding VAL_def KBXFER_def\n  by (simp add: eq_on\\<^sub>L_def)\n\nmethod handle_del =\n  ((determ \\<open>erule (1) DEL_TAG'E\\<close>)+)?;\n  elim_determ thin_rl[of \"DEL_TAG _\"] thin_rl[of \"DEL_TAG' _\"]\n\nmethod kbxfer_trans =\n  (determ \\<open>erule (1) KBXFER_transE\\<close>)+;\n  handle_del;\n  (simp only: triv_forall_equality)?\n\n\nmethod kbxfer' =\n  (simp add: KBXFER_simp eq_on_ltrans_indepI eq_on_compI)\n\nmethod kbxfer =\n  kbxfer';\n  (simp only: DEL_KBXFER_simps cong: DEL_TAG_cong)?;\n  elim_determ thin_rl[of \"KBXFER _ _ _\"] thin_rl[of \"DEL_TAG _\"];\n  (simp only: triv_forall_equality)?\n\n\nsection \\<open>Wps Setup\\<close>\n\nlemma wps_use_val_eq[wps_iffs]:\n  assumes \"VAL L x s\"\n  shows \"wps (use L) Q s \\<longleftrightarrow> Q x s\"\n  supply wps_use_eq[wps_iffs]\n  using assms by (auto simp: VAL_def wps_eqs)\n\nlemma wps_upd_val_eq[wps_simps]  (* Not in wps_rls, as we will put a kbxfer-based lemma there *):\n  assumes \"VAL L x s\"\n  shows \"wps (L %= f) Q s \\<longleftrightarrow> Q () (put' L (f x) s)\"\n  supply wps_upd_eq[wps_iffs]\n  using assms by (auto simp: VAL_def wps_eqs)\n\nlemma wps_upd_valI[wps_intros]:\n  assumes \"VAL L x s\"\n  assumes \"\\<And>s'. KBXFER (ltrans L) s s' \\<Longrightarrow> VAL L (f x) s' \\<Longrightarrow> Q () s'\"\n  shows \"wps (L %= f) Q s\"\n  supply wps_upd_eq[wps_iffs]\n  apply (rule wps_rls)\n  using assms unfolding VAL_def\n  by (auto simp: KBXFER_def)\n\nlemma wps_set_valI[wps_intros]:\n  assumes \"hlens L\" \"pre_put L s\"\n  assumes \"\\<And>s'. KBXFER (ltrans L) s s' \\<Longrightarrow> VAL L x s' \\<Longrightarrow> Q () s'\"\n  shows \"wps (L ::= x) Q s\"\n  supply wps_assign_eq[wps_iffs]\n  apply (rule wps_rls)\n  using assms unfolding VAL_def\n  by (auto simp: KBXFER_def)\n\n\nend\n", "meta": {"author": "ssrg-vt", "repo": "Luce-src", "sha": "f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc", "save_path": "github-repos/isabelle/ssrg-vt-Luce-src", "path": "github-repos/isabelle/ssrg-vt-Luce-src/Luce-src-f7f1ef0fd07bba48bcb3d5e32404db6013a5f1bc/tacas2020_artifact/isabelle/Monads/Lense_Knowledge_Base.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5544704649604273, "lm_q2_score": 0.5428632831725051, "lm_q1q2_score": 0.301001657030603}}
{"text": "section \\<open> Circus Interaction Tree Semantics \\<close>\n\ntheory ITree_Circus                          \n  imports \"ITree_FDSem\" \"Shallow-Expressions-Z.Shallow_Expressions_Z\"\nbegin\n\nsubsection \\<open> Main Operators \\<close>\n\ntype_synonym ('e, 's) action = \"('e, 's) htree\"\ntype_synonym 'e process = \"('e, unit) itree\"\n\ndefinition Skip :: \"('e, 'r) htree\" where\n\"Skip = (\\<lambda> s. Ret s)\"\n\nlemma Skip_unit [simp]: \n  \"Skip ;; S = S\" \"S ;; Skip = S\"\n  by (simp_all add: seq_itree_def Skip_def kleisli_comp_def bind_itree_right_unit)\n\ntext \\<open> Like @{const Skip}, but do a single silent step. \\<close>\n\ndefinition Step :: \"('e, 'r) htree\" where\n\"Step = \\<tau> \\<circ> Skip\"\n\nlemma straces_Skip: \"traces\\<^sub>s (Skip) = ({[], [\\<checkmark> [\\<leadsto>]]})\\<^sub>e\"\n  by (simp add: Skip_def straces_def traces_Ret, expr_simp)\n\nabbreviation Div :: \"('e, 'r) htree\" where\n\"Div \\<equiv> (\\<lambda> s. diverge)\"\n\nlemma Div_left_zero [simp]: \"Div ;; P = Div\"\n  by (simp add: seq_itree_def kleisli_comp_def)\n\nlemma traces_deadlock: \"traces(deadlock) = {[]}\"\n  by (auto simp add: deadlock_def traces_Vis)\n\nabbreviation \n\"Stop \\<equiv> (\\<lambda> s. deadlock)\"\n\nlemma Stop_left_zero [simp]: \"Stop ;; S = Stop\"\n  by (simp add: seq_itree_def kleisli_comp_def)\n\ndefinition \"assume\" :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('e, 's) htree\" where\n\"assume b = (\\<lambda> s. if (b s) then Ret s else diverge)\"\n\nsyntax \"_assume\" :: \"logic \\<Rightarrow> logic\" (\"\\<questiondown>_?\")\ntranslations \"_assume b\" == \"CONST assume (b)\\<^sub>e\"\n\nlemma assume_true: \"\\<questiondown>True? = Skip\"\n  by (simp add: assume_def Skip_def)\n\nlemma assume_false: \"\\<questiondown>False? = Div\"\n  by (simp add: assume_def)\n\ndefinition test :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('e, 's) htree\" where\n\"test b = (\\<lambda> s. if (b s) then Ret s else deadlock)\"\n\nabbreviation (input) \"assert b \\<equiv> test b\"\n\nsyntax \"_test\" :: \"logic \\<Rightarrow> logic\" (\"\\<exclamdown>_!\")\ntranslations \"_test b\" == \"CONST test (b)\\<^sub>e\"\n\nlemma test_true: \"\\<exclamdown>True! = Skip\"\n  by (simp add: test_def Skip_def)\n\nlemma test_false: \"\\<exclamdown>False! = Stop\"\n  by (simp add: test_def)\n\ndefinition cond_itree :: \"('e, 's) htree \\<Rightarrow> ('s \\<Rightarrow> bool) \\<Rightarrow> ('e, 's) htree \\<Rightarrow> ('e, 's) htree\" where\n\"cond_itree P b Q = (\\<lambda> s. if b s then P s else Q s)\"\n\ntext \\<open> Similar to @{const Let} in HOL, but it evaluates the assigned expression on the initial state. \\<close>\n\ndefinition let_itree :: \"('i, 's) expr \\<Rightarrow> ('i \\<Rightarrow> ('e, 's) htree) \\<Rightarrow> ('e, 's) htree\" where\n\"let_itree e S = (\\<lambda> s. S (e s) s)\"\n\ndefinition for_itree :: \"'i list \\<Rightarrow> ('i \\<Rightarrow> ('e, 's) htree) \\<Rightarrow> ('e, 's) htree\" where\n\"for_itree I P = (\\<lambda> s. (foldr (\\<lambda> i Q. P i ;; Q) I Skip) s)\"\n\nsyntax \n  \"_cond_itree\"  :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"if _ then _ else _ fi\")\n  \"_cond_itree1\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"if _ then _ fi\")\n  \"_cond_itree_infix\"  :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"(3_ \\<lhd> _ \\<rhd>/ _)\" [52,0,53] 52)\n  \"_while_itree\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"while _ do _ od\")\n  \"_let_itree\" :: \"id \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"(let _ \\<leftarrow> (_) in (_))\" [0, 0, 10] 10)\n  \"_for_itree\"   :: \"id \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"for _ in _ do _ od\")\n  \"_for_to_itree\" :: \"id \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"for _ = _ to _ do _ od\")\n  \"_for_downto_itree\" :: \"id \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"for _ = _ downto _ do _ od\")\n\ntranslations\n  \"_cond_itree b P Q\" == \"CONST cond_itree P (b)\\<^sub>e Q\"\n  \"_cond_itree1 b P \" == \"CONST cond_itree P (b)\\<^sub>e (CONST Skip)\"\n  \"_cond_itree_infix P b Q\" => \"_cond_itree b P Q\"\n  \"_while_itree b P\" == \"CONST iterate (b)\\<^sub>e P\"\n  \"_let_itree x e S\" == \"CONST let_itree (e)\\<^sub>e (\\<lambda> x. S)\"\n  \"_for_itree i I P\" == \"CONST for_itree I (\\<lambda> i. P)\"\n  \"_for_to_itree i m n P\" == \"_for_itree i [m..<CONST Suc n] P\"\n  \"_for_downto_itree i n m P\" == \"_for_itree i (CONST rev [m..<CONST Suc n]) P\"\n\ndefinition assigns :: \"('s\\<^sub>1, 's\\<^sub>2) psubst \\<Rightarrow> ('s\\<^sub>1 \\<Rightarrow> ('e, 's\\<^sub>2) itree)\" (\"\\<langle>_\\<rangle>\\<^sub>a\") where\n\"assigns \\<sigma> = (\\<lambda> s. Ret (\\<sigma> s))\"\n\nsyntax\n  \"_assignment\"     :: \"svids \\<Rightarrow> uexprs \\<Rightarrow> logic\"  (infixr \":=\" 61)\n  \"_swap\" :: \"svid \\<Rightarrow> svid \\<Rightarrow> logic\" (\"swap'(_, _')\")\n\ntranslations\n  \"_assignment x e\" == \"CONST assigns (CONST subst_upd (CONST subst_id) x (e)\\<^sub>e)\"\n  \"_assignment (_svid_tuple (_of_svid_list (x +\\<^sub>L y))) e\" <= \"_assignment (x +\\<^sub>L y) e\"\n  \"_swap x y\" => \"(x, y) := ($y, $x)\"\n\nnamed_theorems assigns_combine\n\nlemma assigns_id: \"\\<langle>id\\<rangle>\\<^sub>a = Skip\"\n  by (simp add: assigns_def Skip_def)\n\nlemma assigns_empty: \"\\<langle>[\\<leadsto>]\\<rangle>\\<^sub>a = Skip\"\n  by (simp add: subst_id_def assigns_def Skip_def)\n\nlemma assigns_seq: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; (P ;; Q) = (\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; P) ;; Q\"\n  by (simp add: seq_itree_def kleisli_comp_def assigns_def)\n\nlemma assigns_seq_comp [assigns_combine]: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; \\<langle>\\<rho>\\<rangle>\\<^sub>a = \\<langle>\\<rho> \\<circ>\\<^sub>s \\<sigma>\\<rangle>\\<^sub>a\"\n  by (simp add: seq_itree_def kleisli_comp_def assigns_def subst_comp_def)\n\nlemma assigns_test: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; \\<exclamdown>b! = \\<exclamdown>\\<sigma> \\<dagger> b! ;; \\<langle>\\<sigma>\\<rangle>\\<^sub>a\"\n  by (simp add: seq_itree_def kleisli_comp_def assigns_def test_def fun_eq_iff expr_defs)\n\nlemma assigns_assume: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; \\<questiondown>b? = \\<questiondown>\\<sigma> \\<dagger> b? ;; \\<langle>\\<sigma>\\<rangle>\\<^sub>a\"\n  by (simp add: seq_itree_def kleisli_comp_def assigns_def assume_def fun_eq_iff expr_defs)\n\nlemma assigns_Stop: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; Stop = Stop\"\n  by (simp add: seq_itree_def assigns_def kleisli_comp_def)\n\nlemma assign_Stop: \"x := e ;; Stop = Stop\"\n  by (fact assigns_Stop)\n\nlemma assigns_Step: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; Step = Step ;; \\<langle>\\<sigma>\\<rangle>\\<^sub>a\"\n  by (simp add: seq_itree_def assigns_def Step_def kleisli_comp_def Skip_def)\n\nlemma assign_self: \"vwb_lens x \\<Longrightarrow> x := $x = Skip\"\n  by (simp add: usubst assigns_empty)\n\nlemma assign_twice: \"vwb_lens x \\<Longrightarrow> (x := e;; x := f) = x := f\\<lbrakk>e/x\\<rbrakk>\"\n  by (simp add: assigns_combine usubst)\n\nlemma assign_combine: \n  assumes \"vwb_lens x\" \"vwb_lens y\" \"x \\<bowtie> y\"\n  shows \"x := e ;; y := f = (x, y) := (e, f\\<lbrakk>e/x\\<rbrakk>)\"\n  using assms by (simp add: seq_itree_def kleisli_comp_def assigns_def fun_eq_iff expr_defs lens_defs lens_indep_comm)\n\nlemma swap_self: \"vwb_lens x \\<Longrightarrow> swap(x, x) = Skip\"\n  by (simp add: usubst assigns_empty)\n\nlemma swap_commute: \"x \\<bowtie> y \\<Longrightarrow> swap(x, y) = swap(y, x)\"\n  by (simp add: usubst usubst_upd_comm)\n\nlemma cond_assigns [assigns_combine]: \"(cond_itree \\<langle>\\<sigma>\\<rangle>\\<^sub>a b \\<langle>\\<rho>\\<rangle>\\<^sub>a) = \\<langle>expr_if \\<sigma> b \\<rho>\\<rangle>\\<^sub>a\"\n  by (auto simp add: assigns_def cond_itree_def fun_eq_iff expr_defs Skip_def)\n\nlemma cond1_assigns [assigns_combine]: \"(cond_itree \\<langle>\\<sigma>\\<rangle>\\<^sub>a b Skip) = \\<langle>expr_if \\<sigma> b [\\<leadsto>]\\<rangle>\\<^sub>a\"\n  by (auto simp add: assigns_def cond_itree_def fun_eq_iff expr_defs Skip_def)\n\nlemma assign_cond: \"if b then x := e else x := f fi = x := (if b then e else f)\"\n  by (simp add: assigns_combine usubst, simp add: expr_if_def)\n\nlemma cond_simps:\n  \"S \\<lhd> True \\<rhd> T = S\"\n  \"S \\<lhd> False \\<rhd> T = T\"\n  \"S \\<lhd> \\<not> b \\<rhd> T = T \\<lhd> b \\<rhd> S\"\n  \"S \\<lhd> b \\<rhd> (T \\<lhd> b \\<rhd> U) = S \\<lhd> b \\<rhd> U\"\n  \"(S \\<lhd> b \\<rhd> T) ;; U = (S ;; U) \\<lhd> b \\<rhd> (T ;; U)\"\n  \"x := e ;; (S \\<lhd> b \\<rhd> T) = (x := e ;; S) \\<lhd> b\\<lbrakk>e/x\\<rbrakk> \\<rhd> (x := e ;; T)\"\n   by (simp_all add: seq_itree_def cond_itree_def fun_eq_iff kleisli_comp_def assigns_def expr_defs)\n\nlemma for_empty: \"for x in [] do P x od = Skip\"\n  by (simp add: for_itree_def)\n\nlemma for_Cons: \"for_itree (x # xs) P = P x ;; for_itree xs P\"\n  by (simp add: for_itree_def)\n\ntext \\<open> A for loop terminates provided that the body does so in each iteration. We use an invariant\n  expression @{term R} to restrict the possible states encountered. \\<close>\n\nlemma terminates_for_itree:\n  assumes  \n    \"\\<And> i s\\<^sub>0 tr\\<^sub>0 s\\<^sub>1. \\<lbrakk> i < length xs; R i s\\<^sub>0; S (xs ! i) s\\<^sub>0 \\<midarrow>tr\\<^sub>0\\<leadsto> Ret s\\<^sub>1 \\<rbrakk> \\<Longrightarrow> R (i + 1) s\\<^sub>1\"\n    \"\\<And> i s\\<^sub>0. \\<lbrakk> i < length xs; R i s\\<^sub>0 \\<rbrakk> \\<Longrightarrow> terminates (S (xs ! i) s\\<^sub>0)\"\n  shows \"R 0 s \\<Longrightarrow> terminates (for_itree xs S s)\"\nusing assms proof (induct xs arbitrary: R s)\n  case Nil\n  then show ?case by (simp add: for_empty Skip_def terminates_Ret)\nnext\n  case (Cons a xs) \n  have 1: \"terminates (S a s)\"\n    by (metis Cons.prems(1) Cons.prems(3) length_greater_0_conv list.distinct(1) nth_Cons_0)\n  have 2: \"\\<And> s\\<^sub>0. s\\<^sub>0 \\<in> \\<^bold>R (S a s) \\<Longrightarrow> terminates (for_itree xs S s\\<^sub>0)\"\n  proof -\n    fix s\\<^sub>0\n    assume \"s\\<^sub>0 \\<in> \\<^bold>R (S a s)\"\n    then obtain tr\\<^sub>0 where S_term: \"S a s \\<midarrow>tr\\<^sub>0\\<leadsto> Ret s\\<^sub>0\"\n      by (auto simp add: retvals_def)\n    hence R_1: \"R 1 s\\<^sub>0\"\n      by (metis Cons.prems(1) Cons.prems(2) One_nat_def Suc_eq_plus1 length_Cons nth_Cons_0 zero_less_Suc)\n    with S_term show \"terminates (for_itree xs S s\\<^sub>0)\"\n      by (auto intro!: Cons(1)[of \"\\<lambda> i s. R (i + 1) s\"])\n         (metis Cons.prems(2) Suc_eq_plus1 Suc_less_eq length_Cons nth_Cons_Suc\n         ,metis Cons.prems(3) Suc_less_eq length_Cons nth_Cons_Suc)\n  qed\n\n  from 1 2 show ?case\n    by (auto intro!: terminates_bind simp add: for_Cons seq_itree_def kleisli_comp_def)\nqed\n\nlemma while_unfold: \"while b do S od = (S ;; Step ;; while b do S od) \\<lhd> b \\<rhd> Skip\"\n  by (auto simp add: seq_itree_def fun_eq_iff iterate.code kleisli_comp_def cond_itree_def Step_def Skip_def comp_def)\n\nlemma while_True_Skip: \"while True do Skip od = Div\"\n  by (simp add: Skip_def SEXP_def loop_Ret)\n\ntext \\<open> Hide the state of an action to produce a process \\<close>\n\ndefinition process :: \"'s::default subst \\<Rightarrow> ('e, 's, 'a) ktree \\<Rightarrow> 'e process\" where\n\"process I A = (\\<langle>(\\<lambda> _. default)\\<rangle>\\<^sub>a ;; \\<langle>I\\<rangle>\\<^sub>a ;; A ;; assigns (\\<lambda> s. ())) ()\"\n\ntext \\<open> Animatable processes -- need a show instance for the event type \\<close>\n\ndefinition anim_process :: \"'s::default subst \\<Rightarrow> ('e::show, 's, 'a) ktree \\<Rightarrow> 'e process\" where\n\"anim_process = process\"\n\nlemma deadlock_free_processI: \"(\\<And> s. deadlock_free ((\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; P) s)) \\<Longrightarrow> deadlock_free (process \\<sigma> P)\"\n  by (simp add: process_def seq_itree_def kleisli_comp_def deadlock_free_bind_iff assigns_def deadlock_free_Ret)\n\nabbreviation \"abs_st P \\<equiv> P ;; assigns (\\<lambda> s. ())\"\n\nlemma traces_inp: \"wb_prism c \\<Longrightarrow> traces (inp c) = {[]} \\<union> {[Ev (build\\<^bsub>c\\<^esub> v)] | v. True} \\<union> {[Ev (build\\<^bsub>c\\<^esub> v), \\<checkmark> v] | v. True}\" \n  apply (simp add: inp_in_where_def traces_Vis traces_Ret)\n  apply (auto simp add: inp_in_where_def bind_eq_Some_conv traces_Ret domIff pdom.abs_eq  elim!: in_tracesE trace_to_VisE)\n  done \n\ndefinition input_in_where :: \"('a \\<Longrightarrow>\\<^sub>\\<triangle> 'e) \\<Rightarrow> ('s \\<Rightarrow> 'a set) \\<Rightarrow> ('a \\<Rightarrow> (('s \\<Rightarrow> bool) \\<times> ('e, 's) htree)) \\<Rightarrow> ('e, 's) htree\" where\n\"input_in_where c A P = (\\<lambda>s. inp_in_where c (A s) (\\<lambda> v. fst (P v) s) \\<bind> (\\<lambda>x. snd (P x) s))\"\n\ndefinition input_list_where :: \"('a \\<Longrightarrow>\\<^sub>\\<triangle> 'e) \\<Rightarrow> ('s \\<Rightarrow> 'a list) \\<Rightarrow> ('a \\<Rightarrow> ('s \\<Rightarrow> bool) \\<times> ('e, 's) htree) \\<Rightarrow> ('e, 's) htree\" where\n\"input_list_where c A P = (\\<lambda>s. inp_list_where c (A s) (\\<lambda> v. fst (P v) s) \\<bind> (\\<lambda>x. snd (P x) s))\"\n\ndefinition input_map_in_where :: \"('a \\<Longrightarrow>\\<^sub>\\<triangle> 'e) \\<Rightarrow> _ \\<Rightarrow> ('a \\<Rightarrow> ('s \\<Rightarrow> bool) \\<times> ('e, 's) htree) \\<Rightarrow> ('e, 's) htree\" where\n\"input_map_in_where c A P = (\\<lambda>s. inp_map_in_where c (A s) (\\<lambda> v. fst (P v) s) \\<bind> (\\<lambda>x. snd (P x) s))\"\n\nabbreviation \"input c P \\<equiv> input_in_where c (UNIV)\\<^sub>e (\\<lambda> e. ((True)\\<^sub>e, P e))\"\n\n(*\ndefinition input :: \"('a \\<Longrightarrow>\\<^sub>\\<triangle> 'e) \\<Rightarrow> ('a \\<Rightarrow> ('e, 's) htree) \\<Rightarrow> ('e, 's) htree\" where\n\"input c P = (\\<lambda> s. inp c \\<bind> (\\<lambda> x. P x s))\"\n*)\n\nabbreviation input_in :: \"('a \\<Longrightarrow>\\<^sub>\\<triangle> 'e) \\<Rightarrow> ('s \\<Rightarrow> 'a set) \\<Rightarrow> ('a \\<Rightarrow> ('e, 's) htree) \\<Rightarrow> ('e, 's) htree\" where\n\"input_in c A P \\<equiv> input_in_where c A (\\<lambda> e. ((True)\\<^sub>e, P e))\"\n\nlemma input_in_where_map_code:\n  \"wb_prism c \\<Longrightarrow> input_in_where c A P = input_map_in_where c A P\"\n  by (simp add: input_in_where_def inp_in_where_map_code input_map_in_where_def)\n\nlemma input_in_where_enum [code_unfold]: \"wb_prism c \\<Longrightarrow> input_in_where c (UNIV)\\<^sub>e P = input_list_where c (enum_class.enum)\\<^sub>e P\"\n  by (simp add: input_in_where_def input_list_where_def inp_in_where_list_code inp_where_enum)\n\nabbreviation input_where :: \"('a \\<Longrightarrow>\\<^sub>\\<triangle> 'e) \\<Rightarrow> ('a \\<Rightarrow> ('s \\<Rightarrow> bool) \\<times> ('e, 's) htree) \\<Rightarrow> ('e, 's) htree\" where\n\"input_where c P \\<equiv> input_in_where c (UNIV)\\<^sub>e P\"\n\n(*\ndefinition \"input' c P = (\\<lambda>s. inp' c \\<bind> (\\<lambda>x. P x s))\"\n\nlemma input_code_unfold [code_unfold]: \n  \"wb_prism c \\<Longrightarrow> input c P = input' c P\"\n  using inp_in_coset by (fastforce simp add: input_def input'_def inp_in_coset inp'_def)\n\nterm inp_list\n\nlemma \"wb_prism c \\<Longrightarrow> input_where c P = (\\<lambda>s. inp_list_where c enum_class.enum (\\<lambda> v. fst (P v) s) \\<bind> (\\<lambda>x. snd (P x) s))\"\n*)\n\nbundle Circus_Syntax\nbegin\n\nunbundle Expression_Syntax\n\nno_notation disj (infixr \"|\" 30)\nno_notation conj (infixr \"&\" 35)\n\nend\n\nunbundle Circus_Syntax\n\nsyntax \n  \"_input\"          :: \"id \\<Rightarrow> pttrn \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_?_ \\<rightarrow> _\" [60, 0, 61] 61)\n  \"_input_in_where\" :: \"id \\<Rightarrow> pttrn \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_?_:_/ |/ _ \\<rightarrow> _\" [60, 0, 0, 0, 61] 61)\n  \"_input_in\"       :: \"id \\<Rightarrow> pttrn \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_?_:_ \\<rightarrow> _\" [60, 0, 0, 61] 61)\n  \"_input_where\"    :: \"id \\<Rightarrow> pttrn \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_?_/ |/ _ \\<rightarrow> _\" [60, 0, 0, 61] 61)\n\ntranslations \"c?(x) \\<rightarrow> P\" == \"CONST input c (\\<lambda> (x). P)\"\ntranslations \"c?(x):A|B \\<rightarrow> P\" == \"CONST input_in_where c (A)\\<^sub>e (\\<lambda> x. ((B)\\<^sub>e, P))\"\ntranslations \"c?(x):A \\<rightarrow> P\" == \"CONST input_in c (A)\\<^sub>e (\\<lambda> (x). P)\"\ntranslations \"c?(x)|P \\<rightarrow> Q\" == \"CONST input_where c (\\<lambda> (x). ((P)\\<^sub>e, Q))\"\n\nlemma assigns_input: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; c?(x) \\<rightarrow> P(x) = c?(x) \\<rightarrow> (\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; P(x))\"\n  by (simp add: seq_itree_def input_in_where_def kleisli_comp_def assigns_def)\n\ndefinition \"output\" :: \"('a \\<Longrightarrow>\\<^sub>\\<triangle> 'e) \\<Rightarrow> ('s \\<Rightarrow> 'a) \\<Rightarrow> ('e, 's) htree \\<Rightarrow> ('e, 's) htree\" where\n\"output c e P = (\\<lambda> s. outp c (e s) \\<then> P s)\"\n\nsyntax \"_output\" :: \"id \\<Rightarrow> logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_!'(_') \\<rightarrow> _\" [90, 0, 91] 91)\ntranslations \"c!(e) \\<rightarrow> P\" == \"CONST output c (e)\\<^sub>e P\"\n\nlemma assigns_output: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; c!(e) \\<rightarrow> P = c!(\\<sigma> \\<dagger> e) \\<rightarrow> (\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; P)\"\n  by (simp add: seq_itree_def assigns_def kleisli_comp_def output_def expr_defs)\n\nlemma trace_of_deadlock: \"deadlock \\<midarrow>t\\<leadsto> P \\<Longrightarrow> (t, P) = ([], deadlock)\"\n  by (auto simp add: deadlock_def)\n\ninstantiation \"fun\" :: (type, extchoice) extchoice\nbegin\n\ndefinition extchoice_fun :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('a \\<Rightarrow> 'b) \\<Rightarrow> 'a \\<Rightarrow> 'b\" where\n\"extchoice_fun P Q \\<equiv> (\\<lambda> s. extchoice (P s) (Q s))\"\n\ninstance ..\n\nend\n\nlemma extchoice_Stop [simp]: \"Stop \\<box> P = P\"\n  by (auto simp add: extchoice_fun_def fun_eq_iff)\n\nlemma extchoice_Stop' [simp]: \"P \\<box> Stop = P\"\n  by (auto simp add: extchoice_fun_def fun_eq_iff)\n\nlemma extchoice_commutative: \"(P :: ('s, 'e) htree) \\<box> Q = Q \\<box> P\"\n  by (simp add: extchoice_fun_def fun_eq_iff choice_commutative)\n\nlemma extchoice_Div: \"Div \\<box> P = Div\"\n  by (simp add: choice_diverge extchoice_fun_def)\n\nlemma assigns_extchoice: \"\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; (P \\<box> Q) = (\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; P) \\<box> (\\<langle>\\<sigma>\\<rangle>\\<^sub>a ;; Q)\"\n  by (simp add: seq_itree_def kleisli_comp_def extchoice_fun_def expr_defs assigns_def)\n\nno_notation conj  (infixr \"&\" 35)\n\nsyntax\n  \"_cguard\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_ & _\" [50, 51] 50)\n\ntranslations\n  \"_cguard b P\" == \"(CONST test (b)\\<^sub>e) ;; P\"\n\ntext \\<open> The frame operator deletes updates made outside of the frame @{term a}. \\<close>\n\ndefinition frame :: \"'s scene \\<Rightarrow> ('e, 's) htree \\<Rightarrow> ('e, 's) htree\" where\n\"frame a P = (\\<lambda> s. P s \\<bind> (\\<lambda> s'. Ret (s \\<oplus>\\<^sub>S s' on a)))\"\n\nsyntax\n  \"_frame\" :: \"salpha \\<Rightarrow> logic \\<Rightarrow> logic\" (\"(frame _ in (_))\" [0, 10] 10)\n\ntranslations\n  \"_frame a P\" == \"CONST ITree_Circus.frame a P\"\n\ndefinition frame_ext :: \"('s\\<^sub>1 \\<Longrightarrow> 's\\<^sub>2) \\<Rightarrow> ('e, 's\\<^sub>1) htree \\<Rightarrow> ('e, 's\\<^sub>2) htree\" where\n\"frame_ext a P = (\\<lambda> s. P (get\\<^bsub>a\\<^esub> s) \\<bind> (\\<lambda> v. Ret (put\\<^bsub>a\\<^esub> s v)))\"\n\ndefinition not_modifies :: \"('e, 's) htree \\<Rightarrow> ('a, 's) expr \\<Rightarrow> bool\" where\n\"not_modifies P e = (\\<forall> s s'. s' \\<in> \\<^bold>R(P s) \\<longrightarrow> e s' = e s)\"\n\nlemma not_modifiesI: \"(\\<And> s s'. s' \\<in> \\<^bold>R(P s) \\<Longrightarrow> e s' = e s) \\<Longrightarrow> not_modifies P e\"\n  by (auto simp add: not_modifies_def)\n\nsyntax\n  \"_nmods\" :: \"logic \\<Rightarrow> logic \\<Rightarrow> logic\" (\"_ nmods _\" [40, 41] 40)\n\ntranslations\n  \"P nmods e\" == \"CONST not_modifies P (e)\\<^sub>e\"\n\nnamed_theorems nmods\n\nlemma assigns_nmods_iff : \"\\<langle>\\<sigma>\\<rangle>\\<^sub>a nmods e \\<longleftrightarrow> \\<sigma> \\<dagger> (e)\\<^sub>e = (e)\\<^sub>e\"\n  by (simp add: not_modifies_def assigns_def subst_app_def fun_eq_iff)\n\nlemma assigns_nmods [nmods]: \"\\<sigma> \\<dagger> (e)\\<^sub>e = (e)\\<^sub>e \\<Longrightarrow> \\<langle>\\<sigma>\\<rangle>\\<^sub>a nmods e\"\n  by (simp add: assigns_nmods_iff)\n\nlemma Skip_nmods [nmods]: \"Skip nmods e\"\n  by (simp add: Skip_def not_modifies_def)\n\nlemma seq_nmods [nmods]: \"\\<lbrakk> P nmods e; Q nmods e \\<rbrakk> \\<Longrightarrow> P ;; Q nmods e\"\n  by (auto elim!:trace_to_bindE bind_RetE' simp add: seq_itree_def kleisli_comp_def not_modifies_def retvals_def)\n     (metis trace_to_Nil)+\n\ntext \\<open> The following law ignore the condition when checking for modification. However, if we were\n  checking for modification conditions, we could make use of it. \\<close>\n\nlemma cond_nmods [nmods]: \"\\<lbrakk> P nmods e; Q nmods e \\<rbrakk> \\<Longrightarrow> if b then P else Q fi nmods e\"\n  by (simp add: not_modifies_def cond_itree_def)\n\nlemma while_nmods_lemma: \"\\<lbrakk> s \\<turnstile> P \\<midarrow>chn\\<leadsto>\\<^sup>* s'; P nmods e; s\\<^sub>0 \\<in> chain_states chn \\<rbrakk> \\<Longrightarrow> e s = e s\\<^sub>0\"\n  by (induct arbitrary: s\\<^sub>0 rule: itree_chain.induct)\n     (auto simp add: SEXP_def not_modifies_def retvals_def, metis+)\n\nlemma while_nmods [nmods]: \n  assumes \"P nmods e\"\n  shows \"while b do P od nmods e\"\nproof (rule not_modifiesI, simp add: SEXP_def)\n  fix s s'\n  assume s': \"s' \\<in> \\<^bold>R (iterate b P s)\"\n  show \"e s' = e s\"\n  proof (cases \"b s\")\n    case True\n    with s' obtain chn s\\<^sub>0 tr\\<^sub>0 where \"b s\" \"\\<not> b s'\" \"s \\<turnstile> P \\<midarrow>chn\\<leadsto>\\<^sup>* s\\<^sub>0\" \"\\<forall>x\\<in>chain_states chn. b x\" \"P s\\<^sub>0 \\<midarrow>tr\\<^sub>0\\<leadsto> \\<checkmark> s'\"\n      by (auto simp add: retvals_def iterate_term_chain_iff itree_term_chain.simps)\n    have \"\\<forall> s\\<^sub>0 \\<in> chain_states chn. e s = e s\\<^sub>0\"\n      by (meson \\<open>s \\<turnstile> P \\<midarrow>chn\\<leadsto>\\<^sup>* s\\<^sub>0\\<close> assms while_nmods_lemma)\n    hence \"e s = e s\\<^sub>0\"\n      by (metis \\<open>s \\<turnstile> P \\<midarrow>chn\\<leadsto>\\<^sup>* s\\<^sub>0\\<close> final_state_in_chain itree_chain.cases list.discI)\n    then show ?thesis\n      by (metis SEXP_def \\<open>P s\\<^sub>0 \\<midarrow>tr\\<^sub>0\\<leadsto> \\<checkmark> s'\\<close> assms not_modifies_def retvals_traceI)\n  next\n    case False\n    then show ?thesis\n      using s' by force\n  qed\nqed\n\ntext \\<open> @{const not_modifies} is quite useful as a predicate to determine whether expressions are\n  invariant under a program by checking whether variables are updated. However, it may be better\n  to have a ``weakest modification condition'' calculus, that allows us to determine the weakest\n  precondition under which a program will not modify a particular expression. \\<close>\n\ndefinition promote :: \"('e, 's\\<^sub>1) htree \\<Rightarrow> ('s\\<^sub>1 \\<Longrightarrow> 's\\<^sub>2) \\<Rightarrow> ('e, 's\\<^sub>2) htree\" where\n[code_unfold]: \"promote P a = \\<exclamdown>\\<^bold>D(a)! ;; frame_ext a P\"\n\nsyntax \"_promote\" :: \"logic \\<Rightarrow> svid \\<Rightarrow> logic\" (infix \"\\<Up>\\<Up>\" 60)\ntranslations \"_promote P a\" == \"CONST promote P a\"\n\nnamed_theorems prog_defs\n\nsubsection \\<open> Event Choice Blocks \\<close>\n\ndefinition event_fun_empty :: \"('s \\<Rightarrow> 'e \\<Zpfun> ('e, 's) itree)\" (\"{}\\<^sub>E\") where\n\"event_fun_empty = (\\<lambda> s. {\\<mapsto>})\"\n\ndefinition event_fun_upd :: \"('s \\<Rightarrow> 'e \\<Zpfun> ('e, 's) itree) \\<Rightarrow> ('a \\<Longrightarrow>\\<^sub>\\<triangle> 'e) \\<Rightarrow> ('s \\<Rightarrow> 'a set) \\<Rightarrow> ('a \\<Rightarrow> ('s \\<Rightarrow> \\<bool>) \\<times> ('s \\<Rightarrow> ('e, 's) itree)) \\<Rightarrow> 's \\<Rightarrow> 'e \\<Zpfun> ('e, 's) itree\" where\n\"event_fun_upd F c A PB = (\\<lambda> s. (F s)(c{v \\<in> A s. fst (PB v) s} \\<Rightarrow> snd (PB v) s))\"\n\nsyntax\n  \"_event_fun_upd\" :: \"logic \\<Rightarrow> prism_maplets \\<Rightarrow> logic\" (\"_'(_')\\<^sub>E\" [900, 0] 900)\n  \"_event_fun\" :: \"prism_maplets \\<Rightarrow> logic\" (\"{_}\\<^sub>E\")\n\ntranslations\n  \"f(c{v \\<in> A. P} \\<Rightarrow> B)\\<^sub>E\" == \"CONST event_fun_upd f c (A)\\<^sub>e (\\<lambda> v. ((P)\\<^sub>e, B))\"\n  \"_event_fun_upd m (_prism_Maplets xy ms)\"  \\<rightleftharpoons> \"_event_fun_upd (_event_fun_upd m xy) ms\"\n  \"_event_fun ms\"                            \\<rightleftharpoons> \"_event_fun_upd {}\\<^sub>E ms\"\n  \"_event_fun (_prism_Maplets ms1 ms2)\"     \\<leftharpoondown> \"_event_fun_upd (_event_fun ms1) ms2\"\n\ndefinition \"event_choice F = (\\<lambda> s. Vis (F s))\"\n\ndefinition event_block :: \"('a \\<Longrightarrow>\\<^sub>\\<triangle> 'e) \\<Rightarrow> ('s \\<Rightarrow> 'a set) \\<Rightarrow> ('a \\<Rightarrow> ('s \\<Rightarrow> \\<bool>) \\<times> ('s \\<Rightarrow> 's)) \\<Rightarrow> ('e, 's) htree\" where\n\"event_block c A PB = (\\<lambda> s. Vis (prism_fun c (A s) (\\<lambda> c. (fst (PB c) s, Ret (snd (PB c) s)))))\"\n\nlemma case_sum_prod_dist: \"case_sum (\\<lambda> x. (f\\<^sub>1 x, f\\<^sub>2 x)) (\\<lambda> x. (g\\<^sub>1 x, g\\<^sub>2 x)) = (\\<lambda> x. (case_sum f\\<^sub>1 g\\<^sub>1 x, case_sum f\\<^sub>2 g\\<^sub>2 x))\"\n  by (simp add: fun_eq_iff sum.case_eq_if)\n\nlemma case_sum_dist: \"(case a of Inl x \\<Rightarrow> op (f x) | Inr y \\<Rightarrow> op (g y)) = op (case a of Inl x \\<Rightarrow> f x | Inr y \\<Rightarrow> g y)\"\n  by (simp add: sum.case_eq_if)\n\nlemma extchoice_event_block: \n  assumes \"wb_prism c\" \"wb_prism d\" \"c \\<nabla> d\"\n  shows \"event_block c A P\\<sigma> \\<box> event_block d B Q\\<sigma> = event_block (c +\\<^sub>\\<triangle> d) (A <+> B)\\<^sub>e (case_sum P\\<sigma> Q\\<sigma>)\"\n  using assms\n  by (auto intro!:prism_fun_cong simp add: event_block_def fun_eq_iff extchoice_fun_def map_prod_as_ovrd prism_diff_implies_indep_funs prism_fun_combine case_sum_prod_dist sum.case_eq_if)\n\n(*\nsyntax\n  \"_match_syntax\" :: \"['a, cases_syn] \\<Rightarrow> 'b\"  (\"(match _ of/ _)\" 10)\n\ntranslations\n  \"_match_syntax e y\" => \"\\<lambda> _sexp_state. _case_syntax ((e)\\<^sub>e _sexp_state) y\"\n  \"_match_syntax e y\" <= \"\\<lambda> s. _case_syntax (e)\\<^sub>e y\"\n*)\n\nend", "meta": {"author": "isabelle-utp", "repo": "interaction-trees", "sha": "90510d119364f534d2ab61daf2f274060f0a040e", "save_path": "github-repos/isabelle/isabelle-utp-interaction-trees", "path": "github-repos/isabelle/isabelle-utp-interaction-trees/interaction-trees-90510d119364f534d2ab61daf2f274060f0a040e/UTP/ITree_Circus.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5544704502361149, "lm_q2_score": 0.5428632831725052, "lm_q1q2_score": 0.30100164903731447}}
{"text": "theory Asymptotic_Security imports Concrete_Security begin\n\nsection \\<open>Asymptotic security definition\\<close>\n\nlocale constructive_security_obsf' =\n  fixes real_resource :: \"security \\<Rightarrow> ('a + 'e, 'b + 'f) resource\"\n    and ideal_resource :: \"security \\<Rightarrow> ('c + 'e, 'd + 'f) resource\"\n    and sim :: \"security \\<Rightarrow> ('a, 'b, 'c, 'd) converter\"\n    and \\<I>_real :: \"security \\<Rightarrow> ('a, 'b) \\<I>\"\n    and \\<I>_ideal :: \"security \\<Rightarrow> ('c, 'd) \\<I>\"\n    and \\<I>_common :: \"security \\<Rightarrow> ('e, 'f) \\<I>\"\n    and \\<A> :: \"security \\<Rightarrow> ('a + 'e, 'b + 'f) distinguisher_obsf\"\n  assumes constructive_security_aux_obsf: \"\\<And>\\<eta>.\n    constructive_security_aux_obsf (real_resource \\<eta>) (ideal_resource \\<eta>) (sim \\<eta>) (\\<I>_real \\<eta>) (\\<I>_ideal \\<eta>) (\\<I>_common \\<eta>) 0\"\n    and adv: \"\\<lbrakk> \\<And>\\<eta>. exception_\\<I> (\\<I>_real \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta>) \\<turnstile>g \\<A> \\<eta> \\<surd> \\<rbrakk>\n      \\<Longrightarrow> negligible (\\<lambda>\\<eta>. advantage (\\<A> \\<eta>) (obsf_resource (sim \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> ideal_resource \\<eta>)) (obsf_resource (real_resource \\<eta>)))\"\nbegin\n\nsublocale constructive_security_aux_obsf \n  \"real_resource \\<eta>\"\n  \"ideal_resource \\<eta>\"\n  \"sim \\<eta>\" \n  \"\\<I>_real \\<eta>\"\n  \"\\<I>_ideal \\<eta>\"\n  \"\\<I>_common \\<eta>\"\n  \"0\"\n  for \\<eta> by(rule constructive_security_aux_obsf)\n\nlemma constructive_security_obsf'D:\n  \"constructive_security_obsf (real_resource \\<eta>) (ideal_resource \\<eta>) (sim \\<eta>) (\\<I>_real \\<eta>) (\\<I>_ideal \\<eta>) (\\<I>_common \\<eta>) (\\<A> \\<eta>)\n    (advantage (\\<A> \\<eta>) (obsf_resource (sim \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> ideal_resource \\<eta>)) (obsf_resource (real_resource \\<eta>)))\"\n  by(rule constructive_security_obsf_refl)\n\nend\n\nlemma constructive_security_obsf'I:\n  assumes \"\\<And>\\<eta>. constructive_security_obsf (real_resource \\<eta>) (ideal_resource \\<eta>) (sim \\<eta>) (\\<I>_real \\<eta>) (\\<I>_ideal \\<eta>) (\\<I>_common \\<eta>) (\\<A> \\<eta>) (adv \\<eta>)\"\n    and \"(\\<And>\\<eta>. exception_\\<I> (\\<I>_real \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta>) \\<turnstile>g \\<A> \\<eta> \\<surd>) \\<Longrightarrow> negligible adv\"\n  shows \"constructive_security_obsf' real_resource ideal_resource sim \\<I>_real \\<I>_ideal \\<I>_common \\<A>\"\nproof -\n  interpret constructive_security_obsf \n    \"real_resource \\<eta>\"\n    \"ideal_resource \\<eta>\"\n    \"sim \\<eta>\" \n    \"\\<I>_real \\<eta>\"\n    \"\\<I>_ideal \\<eta>\"\n    \"\\<I>_common \\<eta>\"\n    \"\\<A> \\<eta>\"\n    \"adv \\<eta>\"\n    for \\<eta> by fact\n  show ?thesis \n  proof\n    show \"negligible (\\<lambda>\\<eta>. advantage (\\<A> \\<eta>) (obsf_resource (sim \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> ideal_resource \\<eta>)) (obsf_resource (real_resource \\<eta>)))\"\n      if \"\\<And>\\<eta>. exception_\\<I> (\\<I>_real \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta>) \\<turnstile>g \\<A> \\<eta> \\<surd>\" using assms(2)[OF that]\n      by(rule negligible_mono)(auto intro!: eventuallyI landau_o.big_mono simp add: advantage_nonneg adv_nonneg adv[OF that])\n  qed(rule WT_intro pfinite_intro order_refl)+\nqed\n\nlemma constructive_security_obsf'_into_constructive_security:\n  assumes \"\\<And>\\<A> :: security \\<Rightarrow> ('a + 'b, 'c + 'd) distinguisher_obsf. \n   \\<lbrakk>  \\<And>\\<eta>. interaction_bounded_by (\\<lambda>_. True) (\\<A> \\<eta>) (bound \\<eta>);\n      \\<And>\\<eta>. lossless \\<Longrightarrow> plossless_gpv (exception_\\<I> (\\<I>_real \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta>)) (\\<A> \\<eta>) \\<rbrakk>\n   \\<Longrightarrow> constructive_security_obsf' real_resource ideal_resource sim \\<I>_real \\<I>_ideal \\<I>_common \\<A>\"\n    and correct: \"\\<exists>cnv. \\<forall>\\<D>. (\\<forall>\\<eta>. \\<I>_ideal \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta> \\<turnstile>g \\<D> \\<eta> \\<surd>) \\<longrightarrow>\n               (\\<forall>\\<eta>. interaction_any_bounded_by (\\<D> \\<eta>) (bound \\<eta>)) \\<longrightarrow>\n               (\\<forall>\\<eta>. lossless \\<longrightarrow> plossless_gpv (\\<I>_ideal \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta>) (\\<D> \\<eta>)) \\<longrightarrow>\n               (\\<forall>\\<eta>. wiring (\\<I>_ideal \\<eta>) (\\<I>_real \\<eta>) (cnv \\<eta>) (w \\<eta>)) \\<and>\n               Negligible.negligible (\\<lambda>\\<eta>. advantage (\\<D> \\<eta>) (ideal_resource \\<eta>) (cnv \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> real_resource \\<eta>))\"\n  shows \"constructive_security real_resource ideal_resource sim \\<I>_real \\<I>_ideal \\<I>_common bound lossless w\"\nproof\n  interpret constructive_security_obsf' real_resource ideal_resource sim \\<I>_real \\<I>_ideal \\<I>_common \\<open>\\<lambda>_. Done undefined\\<close>\n    by(rule assms) simp_all \n  show \"\\<I>_real \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta> \\<turnstile>res real_resource \\<eta> \\<surd>\" \n    and \"\\<I>_ideal \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta> \\<turnstile>res ideal_resource \\<eta> \\<surd>\"\n    and \"\\<I>_real \\<eta>, \\<I>_ideal \\<eta> \\<turnstile>\\<^sub>C sim \\<eta> \\<surd>\" for \\<eta> by(rule WT_intro)+ \n\n  show \"\\<exists>cnv. \\<forall>\\<D>. (\\<forall>\\<eta>. \\<I>_ideal \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta> \\<turnstile>g \\<D> \\<eta> \\<surd>) \\<longrightarrow>\n               (\\<forall>\\<eta>. interaction_any_bounded_by (\\<D> \\<eta>) (bound \\<eta>)) \\<longrightarrow>\n               (\\<forall>\\<eta>. lossless \\<longrightarrow> plossless_gpv (\\<I>_ideal \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta>) (\\<D> \\<eta>)) \\<longrightarrow>\n               (\\<forall>\\<eta>. wiring (\\<I>_ideal \\<eta>) (\\<I>_real \\<eta>) (cnv \\<eta>) (w \\<eta>)) \\<and>\n               Negligible.negligible (\\<lambda>\\<eta>. advantage (\\<D> \\<eta>) (ideal_resource \\<eta>) (cnv \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> real_resource \\<eta>))\"\n    by fact\nnext\n  fix \\<A> :: \"security \\<Rightarrow> ('a + 'b, 'c + 'd) distinguisher\"\n  assume WT_adv [WT_intro]: \"\\<And>\\<eta>. \\<I>_real \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta> \\<turnstile>g \\<A> \\<eta> \\<surd>\"\n    and bound [interaction_bound]: \"\\<And>\\<eta>. interaction_any_bounded_by (\\<A> \\<eta>) (bound \\<eta>)\"\n    and lossless: \"\\<And>\\<eta>. lossless \\<Longrightarrow> plossless_gpv (\\<I>_real \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta>) (\\<A> \\<eta>)\"\n  let ?\\<A> = \"\\<lambda>\\<eta>. obsf_distinguisher (\\<A> \\<eta>)\"\n  interpret constructive_security_obsf' real_resource ideal_resource sim \\<I>_real \\<I>_ideal \\<I>_common ?\\<A>\n  proof(rule assms)\n    show \"interaction_any_bounded_by (?\\<A> \\<eta>) (bound \\<eta>)\" for \\<eta> by(rule interaction_bound)+\n    show \"plossless_gpv (exception_\\<I> (\\<I>_real \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta>)) (?\\<A> \\<eta>)\" if lossless for \\<eta>\n      using WT_adv[of \\<eta>] lossless that by(simp)\n  qed\n  have \"negligible (\\<lambda>\\<eta>. advantage (?\\<A> \\<eta>) (obsf_resource (sim \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> ideal_resource \\<eta>)) (obsf_resource (real_resource \\<eta>)))\"\n    by(rule adv)(rule WT_intro)+\n  then show \"negligible (\\<lambda>\\<eta>. advantage (\\<A> \\<eta>) (sim \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> ideal_resource \\<eta>) (real_resource \\<eta>))\"\n    unfolding advantage_obsf_distinguisher .\nqed\n\nsubsection \\<open>Composition theorems\\<close>\n\ntheorem constructive_security_obsf'_composability:\n  fixes real\n  assumes \"constructive_security_obsf' middle ideal sim_inner \\<I>_middle \\<I>_inner \\<I>_common (\\<lambda>\\<eta>. absorb (\\<A> \\<eta>) (obsf_converter (sim_outer \\<eta> |\\<^sub>= 1\\<^sub>C)))\"\n  assumes \"constructive_security_obsf' real middle sim_outer \\<I>_real \\<I>_middle \\<I>_common \\<A>\"\n  shows \"constructive_security_obsf' real ideal (\\<lambda>\\<eta>. sim_outer \\<eta> \\<odot> sim_inner \\<eta>) \\<I>_real \\<I>_inner \\<I>_common \\<A>\"\nproof(rule constructive_security_obsf'I)\n  let ?\\<A> = \"\\<lambda>\\<eta>. absorb (\\<A> \\<eta>) (obsf_converter (sim_outer \\<eta> |\\<^sub>= 1\\<^sub>C))\"\n  interpret inner: constructive_security_obsf' middle ideal sim_inner \\<I>_middle \\<I>_inner \\<I>_common ?\\<A> by fact\n  interpret outer: constructive_security_obsf' real middle sim_outer \\<I>_real \\<I>_middle \\<I>_common \\<A> by fact\n\n  let ?adv1 = \"\\<lambda>\\<eta>. advantage (?\\<A> \\<eta>) (obsf_resource (sim_inner \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> ideal \\<eta>)) (obsf_resource (middle \\<eta>))\"\n  let ?adv2 = \"\\<lambda>\\<eta>. advantage (\\<A> \\<eta>) (obsf_resource (sim_outer \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> middle \\<eta>)) (obsf_resource (real \\<eta>))\"\n  let ?adv = \"\\<lambda>\\<eta>. ?adv1 \\<eta> + ?adv2 \\<eta>\"    \n  show \"constructive_security_obsf (real \\<eta>) (ideal \\<eta>) (sim_outer \\<eta> \\<odot> sim_inner \\<eta>) (\\<I>_real \\<eta>) (\\<I>_inner \\<eta>) (\\<I>_common \\<eta>) (\\<A> \\<eta>) (?adv \\<eta>)\" for \\<eta>\n    using inner.constructive_security_obsf'D outer.constructive_security_obsf'D\n    by(rule constructive_security_obsf_composability)\n  assume [WT_intro]: \"exception_\\<I> (\\<I>_real \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta>) \\<turnstile>g \\<A> \\<eta> \\<surd>\" for \\<eta>\n  have \"negligible ?adv1\" by(rule inner.adv)(rule WT_intro)+\n  also have \"negligible ?adv2\" by(rule outer.adv)(rule WT_intro)+\n  finally (negligible_plus) show \"negligible ?adv\" .\nqed\n\ntheorem constructive_security_obsf'_lifting: (* TODO: generalize! *)\n  assumes sec: \"constructive_security_obsf' real_resource ideal_resource sim \\<I>_real \\<I>_ideal \\<I>_common (\\<lambda>\\<eta>. absorb (\\<A> \\<eta>) (obsf_converter (1\\<^sub>C |\\<^sub>= conv \\<eta>)))\"\n  assumes WT_conv [WT_intro]: \"\\<And>\\<eta>. \\<I>_common' \\<eta>, \\<I>_common \\<eta> \\<turnstile>\\<^sub>C conv \\<eta> \\<surd>\"\n    and pfinite [pfinite_intro]: \"\\<And>\\<eta>. pfinite_converter (\\<I>_common' \\<eta>) (\\<I>_common \\<eta>) (conv \\<eta>)\"\n  shows \"constructive_security_obsf'\n     (\\<lambda>\\<eta>. 1\\<^sub>C |\\<^sub>= conv \\<eta> \\<rhd> real_resource \\<eta>) (\\<lambda>\\<eta>. 1\\<^sub>C |\\<^sub>= conv \\<eta> \\<rhd> ideal_resource \\<eta>) sim\n     \\<I>_real \\<I>_ideal \\<I>_common' \\<A>\"\nproof(rule constructive_security_obsf'I)\n  let ?\\<A> = \"\\<lambda>\\<eta>. absorb (\\<A> \\<eta>) (obsf_converter (1\\<^sub>C |\\<^sub>= conv \\<eta>))\"\n  interpret constructive_security_obsf' real_resource ideal_resource sim \\<I>_real \\<I>_ideal \\<I>_common ?\\<A> by fact\n  let ?adv = \"\\<lambda>\\<eta>. advantage (?\\<A> \\<eta>) (obsf_resource (sim \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> ideal_resource \\<eta>)) (obsf_resource (real_resource \\<eta>))\" \n\n  fix \\<eta> :: security\n  show \"constructive_security_obsf (1\\<^sub>C |\\<^sub>= conv \\<eta> \\<rhd> real_resource \\<eta>) (1\\<^sub>C |\\<^sub>= conv \\<eta> \\<rhd> ideal_resource \\<eta>) (sim \\<eta>)\n     (\\<I>_real \\<eta>) (\\<I>_ideal \\<eta>) (\\<I>_common' \\<eta>) (\\<A> \\<eta>)\n     (?adv \\<eta>)\"\n    using constructive_security_obsf.constructive_security_aux_obsf[OF constructive_security_obsf'D]\n     constructive_security_obsf.constructive_security_sim_obsf[OF constructive_security_obsf'D]\n    by(rule constructive_security_obsf_lifting_usr)(rule WT_intro pfinite_intro)+\n  show \"negligible ?adv\" if [WT_intro]: \"\\<And>\\<eta>. exception_\\<I> (\\<I>_real \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common' \\<eta>) \\<turnstile>g \\<A> \\<eta> \\<surd>\"\n    by(rule adv)(rule WT_intro)+\nqed\n\ntheorem constructive_security_obsf'_trivial:\n  fixes res\n  assumes [WT_intro]: \"\\<And>\\<eta>. \\<I> \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common \\<eta> \\<turnstile>res res \\<eta> \\<surd>\"\n  shows \"constructive_security_obsf' res res (\\<lambda>_. 1\\<^sub>C) \\<I> \\<I> \\<I>_common \\<A>\"\nproof(rule constructive_security_obsf'I)\n  show \"constructive_security_obsf (res \\<eta>) (res \\<eta>) 1\\<^sub>C (\\<I> \\<eta>) (\\<I> \\<eta>) (\\<I>_common \\<eta>) (\\<A> \\<eta>) 0\" for \\<eta>\n    using assms by(rule constructive_security_obsf_trivial)\nqed simp\n\ntheorem parallel_constructive_security_obsf':\n  assumes \"constructive_security_obsf' real1 ideal1 sim1 \\<I>_real1 \\<I>_inner1 \\<I>_common1 (\\<lambda>\\<eta>. absorb (\\<A> \\<eta>) (obsf_converter (parallel_wiring \\<odot> parallel_converter 1\\<^sub>C (converter_of_resource (sim2 \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> ideal2 \\<eta>)))))\"\n    (is \"constructive_security_obsf' _ _ _ _ _ _ ?\\<A>1\")\n  assumes \"constructive_security_obsf' real2 ideal2 sim2 \\<I>_real2 \\<I>_inner2 \\<I>_common2 (\\<lambda>\\<eta>. absorb (\\<A> \\<eta>) (obsf_converter (parallel_wiring \\<odot> parallel_converter (converter_of_resource (real1 \\<eta>)) 1\\<^sub>C)))\"\n    (is \"constructive_security_obsf' _ _ _ _ _ _ ?\\<A>2\")\n  shows \"constructive_security_obsf' (\\<lambda>\\<eta>. parallel_wiring \\<rhd> real1 \\<eta> \\<parallel> real2 \\<eta>) (\\<lambda>\\<eta>. parallel_wiring \\<rhd> ideal1 \\<eta> \\<parallel> ideal2 \\<eta>) (\\<lambda>\\<eta>. sim1 \\<eta> |\\<^sub>= sim2 \\<eta>) \n    (\\<lambda>\\<eta>. \\<I>_real1 \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_real2 \\<eta>) (\\<lambda>\\<eta>. \\<I>_inner1 \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_inner2 \\<eta>) (\\<lambda>\\<eta>. \\<I>_common1 \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common2 \\<eta>) \\<A>\"\nproof(rule constructive_security_obsf'I)\n  interpret sec1: constructive_security_obsf' real1 ideal1 sim1 \\<I>_real1 \\<I>_inner1 \\<I>_common1 ?\\<A>1 by fact\n  interpret sec2: constructive_security_obsf' real2 ideal2 sim2 \\<I>_real2 \\<I>_inner2 \\<I>_common2 ?\\<A>2 by fact\n  let ?adv1 = \"\\<lambda>\\<eta>. advantage (?\\<A>1 \\<eta>) (obsf_resource (sim1 \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> ideal1 \\<eta>)) (obsf_resource (real1 \\<eta>))\"\n  let ?adv2 = \"\\<lambda>\\<eta>. advantage (?\\<A>2 \\<eta>) (obsf_resource (sim2 \\<eta> |\\<^sub>= 1\\<^sub>C \\<rhd> ideal2 \\<eta>)) (obsf_resource (real2 \\<eta>))\"\n  let ?adv = \"\\<lambda>\\<eta>. ?adv1 \\<eta> + ?adv2 \\<eta>\"\n  show \"constructive_security_obsf (parallel_wiring \\<rhd> real1 \\<eta> \\<parallel> real2 \\<eta>) (parallel_wiring \\<rhd> ideal1 \\<eta> \\<parallel> ideal2 \\<eta>)\n     (sim1 \\<eta> |\\<^sub>= sim2 \\<eta>) (\\<I>_real1 \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_real2 \\<eta>) (\\<I>_inner1 \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_inner2 \\<eta>) (\\<I>_common1 \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common2 \\<eta>) (\\<A> \\<eta>)\n     (?adv \\<eta>)\" for \\<eta>\n    using sec1.constructive_security_obsf'D sec2.constructive_security_obsf'D\n    by(rule parallel_constructive_security_obsf)\n  assume [WT_intro]: \"exception_\\<I> ((\\<I>_real1 \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_real2 \\<eta>) \\<oplus>\\<^sub>\\<I> (\\<I>_common1 \\<eta> \\<oplus>\\<^sub>\\<I> \\<I>_common2 \\<eta>)) \\<turnstile>g \\<A> \\<eta> \\<surd>\" for \\<eta>\n  have \"negligible ?adv1\" by(rule sec1.adv)(rule WT_intro)+\n  also have \"negligible ?adv2\" by(rule sec2.adv)(rule WT_intro)+\n  finally (negligible_plus) show \"negligible ?adv\" .\nqed\n\nend", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Constructive_Cryptography_CM/Asymptotic_Security.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6584175139669997, "lm_q2_score": 0.45713671682749474, "lm_q1q2_score": 0.3009868206365954}}
{"text": "header {* \\isaheader{Generic Map To Set Converter} *}\ntheory Gen_Map2Set\nimports \n  \"../Intf/Intf_Map\"\n  \"../Intf/Intf_Set\"\n  \"../Intf/Intf_Comp\"\n  \"../../Iterator/Iterator\"\nbegin\n\nlemma map_fst_unit_distinct_eq[simp]:\n  fixes l :: \"('k\\<times>unit) list\"\n  shows \"distinct (map fst l) \\<longleftrightarrow> distinct l\"\n  by (induct l) auto\n\ndefinition \n  map2set_rel :: \"\n    (('ki\\<times>'k) set \\<Rightarrow> (unit\\<times>unit) set \\<Rightarrow> ('mi\\<times>('k\\<rightharpoonup>unit))set) \\<Rightarrow> \n    ('ki\\<times>'k) set \\<Rightarrow> \n    ('mi\\<times>('k set)) set\"\n  where \n  map2set_rel_def_internal: \n  \"map2set_rel R Rk \\<equiv> \\<langle>Rk,Id::(unit\\<times>_) set\\<rangle>R O {(m,dom m)| m. True}\"\n\nlemma map2set_rel_def: \"\\<langle>Rk\\<rangle>(map2set_rel R) \n  = \\<langle>Rk,Id::(unit\\<times>_) set\\<rangle>R O {(m,dom m)| m. True}\"\n  unfolding map2set_rel_def_internal[abs_def] by (simp add: relAPP_def)\n\nlemma map2set_relI:\n  assumes \"(s,m')\\<in>\\<langle>Rk,Id\\<rangle>R\" and \"s'=dom m'\"\n  shows \"(s,s')\\<in>\\<langle>Rk\\<rangle>map2set_rel R\"\n  using assms unfolding map2set_rel_def by blast\n\nlemma map2set_relE:\n  assumes \"(s,s')\\<in>\\<langle>Rk\\<rangle>map2set_rel R\"\n  obtains m' where \"(s,m')\\<in>\\<langle>Rk,Id\\<rangle>R\" and \"s'=dom m'\"\n  using assms unfolding map2set_rel_def by blast\n\nlemma map2set_rel_sv[relator_props]:\n  \"single_valued (\\<langle>Rk,Id\\<rangle>Rm) \\<Longrightarrow> single_valued (\\<langle>Rk\\<rangle>map2set_rel Rm)\"\n  unfolding map2set_rel_def\n  by (auto intro: single_valuedI dest: single_valuedD)\n\nlemma map2set_empty[autoref_rules_raw]:\n  assumes \"PRIO_TAG_GEN_ALGO\"\n  assumes \"GEN_OP e op_map_empty (\\<langle>Rk,Id\\<rangle>R)\"\n  shows \"(e,{})\\<in>\\<langle>Rk\\<rangle>map2set_rel R\"\n  using assms\n  unfolding map2set_rel_def\n  by auto\n\nlemmas [autoref_rel_intf] = \n  REL_INTFI[of \"map2set_rel R\" i_set] for R\n\n\ndefinition \"map2set_insert i k s \\<equiv> i k () s\"\nlemma map2set_insert[autoref_rules_raw]:\n  assumes \"PRIO_TAG_GEN_ALGO\"\n  assumes \"GEN_OP i op_map_update (Rk \\<rightarrow> Id \\<rightarrow> \\<langle>Rk,Id\\<rangle>R \\<rightarrow> \\<langle>Rk,Id\\<rangle>R)\"\n  shows \n    \"(map2set_insert i,Set.insert)\\<in>Rk\\<rightarrow>\\<langle>Rk\\<rangle>map2set_rel R \\<rightarrow> \\<langle>Rk\\<rangle>map2set_rel R\"\n  using assms\n  unfolding map2set_rel_def map2set_insert_def[abs_def]\n  by (force dest: fun_relD)\n\ndefinition \"map2set_memb l k s \\<equiv> case l k s of None \\<Rightarrow> False | Some _ \\<Rightarrow> True\"\nlemma map2set_memb[autoref_rules_raw]:\n  assumes \"PRIO_TAG_GEN_ALGO\"\n  assumes \"GEN_OP l op_map_lookup (Rk \\<rightarrow> \\<langle>Rk,Id\\<rangle>R \\<rightarrow> \\<langle>Id\\<rangle>option_rel)\"\n  shows \"(map2set_memb l ,op\\<in>)\n    \\<in> Rk\\<rightarrow>\\<langle>Rk\\<rangle>map2set_rel R\\<rightarrow>Id\"\n  using assms\n  unfolding map2set_rel_def map2set_memb_def[abs_def]\n  by (force dest: fun_relD split: option.splits)\n  \nlemma map2set_delete[autoref_rules_raw]:\n  assumes \"PRIO_TAG_GEN_ALGO\"\n  assumes \"GEN_OP d op_map_delete (Rk\\<rightarrow>\\<langle>Rk,Id\\<rangle>R\\<rightarrow>\\<langle>Rk,Id\\<rangle>R)\"\n  shows \"(d,op_set_delete)\\<in>Rk\\<rightarrow>\\<langle>Rk\\<rangle>map2set_rel R\\<rightarrow>\\<langle>Rk\\<rangle>map2set_rel R\"\n  using assms\n  unfolding map2set_rel_def\n  by (force dest: fun_relD)\n\nlemma map2set_to_sorted_list[autoref_ga_rules]:\n  (*assumes SV: \"single_valued Rk\"*)\n  fixes it :: \"'m \\<Rightarrow> ('k\\<times>unit) list\"\n  assumes A: \"GEN_ALGO_tag (is_map_to_sorted_list ordR Rk Id R it)\"\n  shows \"is_set_to_sorted_list ordR Rk (map2set_rel R) \n    (it_to_list (map_iterator_dom o (foldli o it)))\"\nproof -\n  { \n    fix l::\"('k\\<times>unit) list\"\n    have \"\\<And>l0. foldli l (\\<lambda>_. True) (\\<lambda>x \\<sigma>. \\<sigma> @ [fst x]) l0 = l0@map fst l\"\n      by (induct l) auto\n  }\n  hence S: \"it_to_list (map_iterator_dom o (foldli o it)) = map fst o it\"\n    unfolding it_to_list_def[abs_def] map_iterator_dom_def[abs_def]\n      set_iterator_image_def set_iterator_image_filter_def\n    by (auto)\n  show ?thesis\n    unfolding S\n    using assms\n    unfolding is_map_to_sorted_list_def is_set_to_sorted_list_def\n    apply clarsimp\n    apply (erule map2set_relE)\n    apply (drule spec, drule spec)\n    apply (drule (1) mp)\n    apply (elim exE conjE)\n    apply (rule_tac x=\"map fst l'\" in exI)\n    apply (rule conjI)\n    apply parametricity\n\n    unfolding it_to_sorted_list_def\n    apply (simp add: map_to_set_dom)\n    apply (simp add: sorted_by_rel_map key_rel_def[abs_def])\n    done\nqed\n\nlemma map2set_to_list[autoref_ga_rules]:\n  fixes it :: \"'m \\<Rightarrow> ('k\\<times>unit) list\"\n  assumes A: \"GEN_ALGO_tag (is_map_to_list Rk Id R it)\"\n  shows \"is_set_to_list Rk (map2set_rel R) \n    (it_to_list (map_iterator_dom o (foldli o it)))\"\n  using assms unfolding is_set_to_list_def is_map_to_list_def\n  by (rule map2set_to_sorted_list)\n\n\n(*lemma map2set_it_simp[iterator_simps]:\n  \"foldli ((map fst o it) x) c f s = foldli (it x) c (\\<lambda>(k,v) s. f k s) s\" \n  by (simp add: foldli_map comp_def fn_fst_conv)\n*)\n\ntext {* Transfering also non-basic operations results in specializations\n  of map-algorithms to also be used for sets *}\nlemma map2set_union[autoref_rules_raw]:\n  assumes \"MINOR_PRIO_TAG (- 9)\"\n  assumes \"GEN_OP u op ++ (\\<langle>Rk,Id\\<rangle>R\\<rightarrow>\\<langle>Rk,Id\\<rangle>R\\<rightarrow>\\<langle>Rk,Id\\<rangle>R)\"\n  shows \"(u,op \\<union>)\\<in>\\<langle>Rk\\<rangle>map2set_rel R\\<rightarrow>\\<langle>Rk\\<rangle>map2set_rel R\\<rightarrow>\\<langle>Rk\\<rangle>map2set_rel R\"\n  using assms\n  unfolding map2set_rel_def\n  by (force dest: fun_relD)\n\nlemmas [autoref_ga_rules] = cmp_unit_eq_linorder \nlemmas [autoref_rules_raw] = param_cmp_unit\n\nlemma cmp_lex_zip_unit[simp]:\n  \"cmp_lex (cmp_prod cmp cmp_unit) (map (\\<lambda>k. (k, ())) l)\n           (map (\\<lambda>k. (k, ())) m) =\n          cmp_lex cmp l m\"\n  apply (induct cmp l m rule: cmp_lex.induct)\n  apply (auto split: comp_res.split)\n  done\n\nlemma cmp_img_zip_unit[simp]:\n  \"cmp_img (\\<lambda>m. map (\\<lambda>k. (k,())) (f m)) (cmp_lex (cmp_prod cmp1 cmp_unit))\n    = cmp_img f (cmp_lex cmp1)\"\n  unfolding cmp_img_def[abs_def]\n  apply (intro ext)\n  apply simp\n  done\n\n(* TODO: Move *)\n\nlemma map2set_finite[relator_props]:\n  assumes \"finite_map_rel (\\<langle>Rk,Id\\<rangle>R)\"\n  shows \"finite_set_rel (\\<langle>Rk\\<rangle>map2set_rel R)\"\n  using assms\n  unfolding map2set_rel_def finite_set_rel_def finite_map_rel_def\n  by auto\n\nlemma map2set_cmp[autoref_rules_raw]:\n  assumes ELO: \"SIDE_GEN_ALGO (eq_linorder cmpk)\"\n  assumes MPAR:\n    \"GEN_OP cmp (cmp_map cmpk cmp_unit) (\\<langle>Rk,Id\\<rangle>R \\<rightarrow> \\<langle>Rk,Id\\<rangle>R \\<rightarrow> Id)\"\n  assumes FIN: \"PREFER finite_map_rel (\\<langle>Rk, Id\\<rangle>R)\"\n  shows \"(cmp,cmp_set cmpk)\\<in>\\<langle>Rk\\<rangle>map2set_rel R \\<rightarrow> \\<langle>Rk\\<rangle>map2set_rel R \\<rightarrow> Id\"\nproof -\n  interpret linorder \"comp2le cmpk\" \"comp2lt cmpk\"\n    using ELO by (simp add: eq_linorder_class_conv)\n\n  show ?thesis\n    using MPAR\n    unfolding cmp_map_def cmp_set_def\n    apply simp\n    apply parametricity\n    apply (drule cmp_extend_paramD)\n    apply (insert FIN, fastforce simp add: finite_map_rel_def) []\n    apply (simp add: sorted_list_of_map_def[abs_def])\n    apply (auto simp: map2set_rel_def cmp_img_def[abs_def] dest: fun_relD) []\n\n    apply (insert map2set_finite[OF FIN[unfolded autoref_tag_defs]],\n      fastforce simp add: finite_set_rel_def)\n    done\nqed\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Collections/GenCF/Gen/Gen_Map2Set.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.30096313101869365}}
{"text": "section \\<open> Variable Blocks \\<close>\n\ntheory utp_blocks\n  imports utp_rel\nbegin\n\nsubsection \\<open> Extra Symmetric Lens Properties \\<close>\n\ntext \\<open> The following result is needed to demonstrate the combination of the view and co-view\n  covers all of the statespace. \\<close>\n\ncontext psym_lens\nbegin\n\nlemma put_region_coregion_cover: \"put\\<^bsub>\\<V>\\<^esub> (put\\<^bsub>\\<C>\\<^esub> s\\<^sub>1 v\\<^sub>1) v\\<^sub>2 = put\\<^bsub>\\<V>\\<^esub> (put\\<^bsub>\\<C>\\<^esub> s\\<^sub>2 v\\<^sub>1) v\\<^sub>2\"\nproof -\n  have \"\\<And> \\<sigma> \\<rho> v\\<^sub>1 v\\<^sub>2. put\\<^bsub>\\<V> +\\<^sub>L \\<C>\\<^esub> \\<sigma> (v\\<^sub>1, v\\<^sub>2) = put\\<^bsub>\\<V> +\\<^sub>L \\<C>\\<^esub> \\<rho> (v\\<^sub>1, v\\<^sub>2)\"\n    by (simp add: pbij_lens.put_det)\n  thus ?thesis\n    by (simp add: lens_defs)\nqed\n\nend\n\nsubsection \\<open> Extending and Contracting the Statespace \\<close>\n\ndefinition ext_state :: \"(<'s\\<^sub>1, 'c> \\<Longleftrightarrow> 's\\<^sub>2) \\<Rightarrow> ('s\\<^sub>1 \\<Rightarrow> 's\\<^sub>2)\" (\"ext\\<^bsub>_\\<^esub>\") where\n[lens_defs]: \"ext\\<^bsub>\\<X>\\<^esub> = (\\<lambda> s. put\\<^bsub>\\<V>\\<^bsub>\\<X>\\<^esub>\\<^esub> (create\\<^bsub>\\<C>\\<^bsub>\\<X>\\<^esub>\\<^esub> undefined) s)\"\n\nlemma ext_state_subst: \"psym_lens \\<X> \\<Longrightarrow> ext\\<^bsub>\\<X>\\<^esub> = \\<lparr>\\<C>[\\<X>] \\<leadsto> undefined, \\<V>[\\<X>] \\<leadsto> $\\<^bold>v\\<rparr>\"\n  by (simp add: expr_defs lens_defs fun_eq_iff psym_lens.put_region_coregion_cover)\n\ndefinition con_state :: \"(<'s\\<^sub>1, 'c> \\<Longleftrightarrow> 's\\<^sub>2) \\<Rightarrow> ('s\\<^sub>2 \\<Rightarrow> 's\\<^sub>1)\" (\"con\\<^bsub>_\\<^esub>\") where\n[lens_defs]: \"con\\<^bsub>\\<X>\\<^esub> = (\\<lambda> s. get\\<^bsub>\\<V>\\<^bsub>\\<X>\\<^esub>\\<^esub> s)\"\n\nlemma con_state_subst: \"con\\<^bsub>\\<X>\\<^esub> = \\<lparr>\\<^bold>v \\<leadsto> $\\<V>[\\<X>]\\<rparr>\"\n  by (simp add: lens_defs expr_defs)\n\nlemma ext_con: \"psym_lens \\<X> \\<Longrightarrow> con\\<^bsub>\\<X>\\<^esub> (ext\\<^bsub>\\<X>\\<^esub> s) = s\"\n  by (simp add: lens_defs comp_def id_def)\n\nlemma con_surj: \"psym_lens \\<X> \\<Longrightarrow> surj con\\<^bsub>\\<X>\\<^esub>\"\n  by (meson ext_con surjI)\n\nlemma put_con_in: \"\\<lbrakk> psym_lens \\<X>; x \\<subseteq>\\<^sub>L \\<C>\\<^bsub>\\<X>\\<^esub> \\<rbrakk> \\<Longrightarrow> con\\<^bsub>\\<X>\\<^esub> (put\\<^bsub>x\\<^esub> s v) = con\\<^bsub>\\<X>\\<^esub> s\"\n  by (simp add: con_state_def sublens_pres_indep')\n\nsubsection \\<open> Open and Close \\<close>\n\ndefinition open_var :: \"(<'s\\<^sub>1, 'c> \\<Longleftrightarrow> 's\\<^sub>2) \\<Rightarrow> 's\\<^sub>1 \\<leftrightarrow> 's\\<^sub>2\" (\"open\\<^bsub>_\\<^esub>\") where\n[pred]: \"open_var \\<X> = \\<langle>ext\\<^bsub>\\<X>\\<^esub>\\<rangle> \\<^bold>; \\<C>[\\<X>] := *\"\n\ndefinition close_var :: \"(<'s\\<^sub>1, 'c> \\<Longleftrightarrow> 's\\<^sub>2) \\<Rightarrow> 's\\<^sub>2 \\<leftrightarrow> 's\\<^sub>1\" (\"close\\<^bsub>_\\<^esub>\") where\n[pred]: \"close_var \\<X> = \\<langle>con\\<^bsub>\\<X>\\<^esub>\\<rangle>\"\n\nlemma open_close: \"psym_lens \\<X> \\<Longrightarrow> open\\<^bsub>\\<X>\\<^esub> \\<^bold>; close\\<^bsub>\\<X>\\<^esub> = II\"\n  by pred_auto\n\nsubsection \\<open> Lifting Symmetric Lenses \\<close>\n\ndefinition slens_pcomp :: \"(<'a, 'b> \\<Longleftrightarrow> 's\\<^sub>1) \\<Rightarrow> ('s\\<^sub>1 \\<Longrightarrow> 's\\<^sub>2) \\<Rightarrow> (<'a, 'b> \\<Longleftrightarrow> 's\\<^sub>2)\" where\n[lens_defs]: \"slens_pcomp S L = \\<lparr> view = view S ;\\<^sub>L L, coview = coview S ;\\<^sub>L L \\<rparr>\"\n\ntext \\<open> This rather complex looking operator converts a endogeneous lens on one state space, to one\n  on a larger state space. An example of a endogeneous lens is @{term \"tl\\<^sub>L\"}, which views the tail\n  of a list. Let's say then we have a state space with a variable denoting a list. Then the \n  following function constructs a lens which allows us to view the state space, where the only\n  change is that we are viewing the tail of the lens. \\<close>\n  \ndefinition lens_lift :: \"('s\\<^sub>1 \\<Longrightarrow> 's\\<^sub>1) \\<Rightarrow> ('s\\<^sub>1 \\<Longrightarrow> 's\\<^sub>2) \\<Rightarrow> ('s\\<^sub>2 \\<Longrightarrow> 's\\<^sub>2)\" where\n[lens_defs]: \"lens_lift X Y = \\<lparr> lens_get = (\\<lambda> s. put\\<^bsub>Y\\<^esub> s (get\\<^bsub>X\\<^esub> (get\\<^bsub>Y\\<^esub> s)))\n                              , lens_put = (\\<lambda> s v. put\\<^bsub>Y\\<^esub> v (put\\<^bsub>X\\<^esub> (get\\<^bsub>Y\\<^esub> s) (get\\<^bsub>Y\\<^esub> v)))  \\<rparr>\"\n\nlemma lens_lift_mwb [simp]: \"\\<lbrakk> mwb_lens X; vwb_lens Y \\<rbrakk> \\<Longrightarrow> mwb_lens (lens_lift X Y)\"\n  by (unfold_locales, simp_all add: lens_defs)\n\nlemma lens_lift_vwb [simp]: \"\\<lbrakk> vwb_lens X; vwb_lens Y \\<rbrakk> \\<Longrightarrow> vwb_lens (lens_lift X Y)\"\n  by (unfold_locales, simp_all add: lens_defs)\n\ndefinition slens_lift :: \"(<'s\\<^sub>1, 'a> \\<Longleftrightarrow> 's\\<^sub>1) \\<Rightarrow> ('s\\<^sub>1 \\<Longrightarrow> 's\\<^sub>2) \\<Rightarrow> (<'s\\<^sub>2, 'a> \\<Longleftrightarrow> 's\\<^sub>2)\" (infixl \"\\<up>\\<^sub>S\" 80) where\n[lens_defs]: \"slens_lift S L = \\<lparr> view = lens_lift (view S) L, coview = coview S ;\\<^sub>L L \\<rparr>\"\n\nlemma \"\\<lbrakk> psym_lens X; vwb_lens Y \\<rbrakk> \\<Longrightarrow> psym_lens (X \\<up>\\<^sub>S Y)\"\n  apply (simp add: slens_lift_def)\n  apply (rule psym_lens.intro)\n  apply (simp_all)\n  using comp_mwb_lens psym_lens.mwb_coregion vwb_lens_mwb apply blast\n  oops\n\nsubsection \\<open> Adding and Deleting Variables \\<close>\n\ntext \\<open> The functions implement addition and deletion of variables in the style proposed by\n   Back and Preoteasa. A variable is a lens point to a stack-like local variable store. We \n  By lifting a symmetric lens for splitting the statespace we can save and retrieve values\n  in the stack. \\<close>\n\nabbreviation add_var (\"add[_]\\<^bsub>_\\<^esub>\") where \"add_var \\<X> x \\<equiv> ext\\<^bsub>\\<X> \\<up>\\<^sub>S x\\<^esub>\"\nabbreviation del_var (\"del[_]\\<^bsub>_\\<^esub>\") where \"del_var \\<X> x \\<equiv> con\\<^bsub>\\<X> \\<up>\\<^sub>S x\\<^esub>\"\n\nlemma del_var_def: \"del[\\<X>]\\<^bsub>x\\<^esub> = (\\<lambda>s. put\\<^bsub>x\\<^esub> s (get\\<^bsub>\\<V>\\<^bsub>\\<X>\\<^esub>\\<^esub> (get\\<^bsub>x\\<^esub> s)))\"\n  by (simp add: con_state_def slens_lift_def lens_lift_def)\n\nlemma add_var_prop:\n  \"\\<lbrakk> psym_lens \\<X>; weak_lens x \\<rbrakk> \\<Longrightarrow> \n    put\\<^bsub>\\<V>\\<^bsub>\\<X>\\<^esub>\\<^esub> (get\\<^bsub>x\\<^esub> (create\\<^bsub>\\<C>\\<^bsub>\\<X>\\<^esub> ;\\<^sub>L x\\<^esub> undefined)) v\n    = put\\<^bsub>\\<C>\\<^bsub>\\<X>\\<^esub>\\<^esub> (put\\<^bsub>\\<V>\\<^bsub>\\<X>\\<^esub>\\<^esub> s v) undefined\"\n  using psym_lens.put_region_coregion_cover psym_lens_compl \n  by (fastforce simp add: lens_defs lens_indep_comm)\n\nlemma add_var_def: \n  \"\\<lbrakk> psym_lens \\<X>; weak_lens x \\<rbrakk> \\<Longrightarrow> \n    add[\\<X>]\\<^bsub>x\\<^esub> = (\\<lambda>s. put\\<^bsub>x\\<^esub> s (put\\<^bsub>\\<C>\\<^bsub>\\<X>\\<^esub>\\<^esub> (put\\<^bsub>\\<V>\\<^bsub>\\<X>\\<^esub>\\<^esub> undefined (get\\<^bsub>x\\<^esub> s)) undefined))\"\n  using add_var_prop by (fastforce simp add: ext_state_def slens_lift_def lens_lift_def)\n\ntext \\<open> Back and von Wright's axioms \\<close>\n\nlemma add_del:\n  \"\\<lbrakk> psym_lens \\<X>; vwb_lens x \\<rbrakk> \\<Longrightarrow> del[\\<X>]\\<^bsub>x\\<^esub> (add[\\<X>]\\<^bsub>x\\<^esub> s) = s\"\n  by (simp add: add_var_def del_var_def)\n\nlemma del_surj: \"\\<lbrakk> psym_lens \\<X>; vwb_lens x \\<rbrakk> \\<Longrightarrow> surj del[\\<X>]\\<^bsub>x\\<^esub>\"\n  by (meson add_del surjI)\n\nlemma del_get: \"x \\<bowtie> y \\<Longrightarrow> get\\<^bsub>x\\<^esub> (del[\\<X>]\\<^bsub>y\\<^esub> s) = get\\<^bsub>x\\<^esub> s\"\n  by (simp add: del_var_def)\n\nlemma put_del_diff: \"x \\<bowtie> y \\<Longrightarrow> del[\\<X>]\\<^bsub>y\\<^esub> (put\\<^bsub>x\\<^esub> s v) = put\\<^bsub>x\\<^esub> (del[\\<X>]\\<^bsub>y\\<^esub> s) v\"\n  by (simp add: del_var_def lens_indep_comm, simp add: lens_indep_sym)\n\nsubsection \\<open> Variable Stacks \\<close>\n\ntext \\<open> A variable stack is a non-empty list. This means there is always a value at the top, and\n  there is always a @{const vwb_lens} for pointing the current value of a local variable. \\<close>\n\ntypedef 'a vstack = \"{xs :: 'a list. xs \\<noteq> []}\"\n  by auto\n\nsetup_lifting type_definition_vstack\n\nlift_definition vtop :: \"'a vstack \\<Rightarrow> 'a\" is hd .\nlift_definition vpush :: \"'a \\<Rightarrow> 'a vstack \\<Rightarrow> 'a vstack\" is \"(#)\" by simp\nlift_definition vmake :: \"'a \\<Rightarrow> 'a list \\<Rightarrow> 'a vstack\" is \"(#)\" by simp\nlift_definition vtop_put :: \"'a \\<Rightarrow> 'a vstack \\<Rightarrow> 'a vstack\" is \"\\<lambda> x stk. x # tl stk\" by simp\nlift_definition vshrink :: \"'a vstack \\<Rightarrow> 'a vstack\" is \"\\<lambda> xs. if (length xs > 1) then tl xs else [undefined]\"\n  apply (auto)\n  apply (simp add: Nitpick.size_list_simp(2))\n  done\nlift_definition vappend :: \"'a vstack \\<Rightarrow> 'a vstack \\<Rightarrow> 'a vstack\" is \"(@)\"\n  by simp\n\nlemma vtop_put_vtop [simp]: \"vtop (vtop_put x s) = x\"\n  by (transfer, simp_all)\n\nlemma vpush_vtop_put [simp]: \"vtop_put y (vpush x s) = vpush y s\"\n  by (transfer, simp)\n\nlemma vtop_put_vshrink [simp]: \"vshrink (vtop_put v s) = vshrink s\"\n  by (transfer, simp)\n\nlemma vtop_put_vshrink [simp]: \"vshrink (vtop_put x s) = s\"\n  apply (transfer, auto)\n  oops\n\nlemma vtop_vpush [simp]: \"vtop (vpush x s) = x\"\n  by (transfer, simp)\n\nlemma vshrink_vpush [simp]: \"vshrink (vpush x s) = s\"\n  by (transfer, simp)\n\nlemma vtop_put_put [simp]: \"vtop_put x (vtop_put y s) = vtop_put x s\"\n  by (transfer, simp)\n\nlemma vtop_vtop_put [simp]: \"vtop_put (vtop s) s = s\"\n  by (transfer, simp)\n\ndefinition vtop\\<^sub>L :: \"'a \\<Longrightarrow> 'a vstack\" where\n[lens_defs]: \"vtop\\<^sub>L = \\<lparr> lens_get = vtop, lens_put = (\\<lambda> s v. vtop_put v s) \\<rparr>\"\n\ndefinition vshrink\\<^sub>L :: \"'a vstack \\<Longrightarrow> 'a vstack\" where\n[lens_defs]: \"vshrink\\<^sub>L = \\<lparr> lens_get = vshrink, lens_put = (\\<lambda> s v. vpush (vtop s) v) \\<rparr>\"\n\nlemma vtop_vwb [simp]: \"vwb_lens vtop\\<^sub>L\"\n  by (unfold_locales, simp_all add: lens_defs)\n\nlemma vshrink_vwb [simp]: \"mwb_lens vshrink\\<^sub>L\"\n  by (unfold_locales, simp_all add: lens_defs)\n\nlemma vshrink_vtop_indep [simp]: \"vshrink\\<^sub>L \\<bowtie> vtop\\<^sub>L\"\n  by (unfold_locales, simp_all add: lens_defs)\n\nabbreviation \"vstack\\<^sub>L \\<equiv> \\<lparr> view = vshrink\\<^sub>L, coview = vtop\\<^sub>L \\<rparr>\"\n\nlemma vstack_psym_lens [simp]: \"psym_lens vstack\\<^sub>L\"\n  apply (rule psym_lens.intro)\n     apply (simp_all)\n  apply (rule pbij_lens.intro)\n  using mwb_lens_weak plus_mwb_lens vshrink_vtop_indep vshrink_vwb vtop_vwb vwb_lens_mwb apply blast\n  apply (simp add: pbij_lens_axioms_def)\n  apply (simp add: lens_defs)\n  done\n\ntext \\<open> This theorem can only be proved when we know how to select the variable last created. \\<close>\n\nlemma put_del: \"vwb_lens x \\<Longrightarrow> del[vstack\\<^sub>L]\\<^bsub>x\\<^esub> (put\\<^bsub>vtop\\<^sub>L ;\\<^sub>L x\\<^esub> s v) = del[vstack\\<^sub>L]\\<^bsub>x\\<^esub> s\"\n  by (simp add: del_var_def lens_defs)\n\nlemma add_vstack: \"weak_lens x \\<Longrightarrow> add[vstack\\<^sub>L]\\<^bsub>x\\<^esub> = (\\<lambda> s. put\\<^bsub>x\\<^esub> s (vpush undefined (get\\<^bsub>x\\<^esub> s)))\"\n  by (simp add: lens_defs)\n\nend", "meta": {"author": "isabelle-utp", "repo": "UTP", "sha": "fc446b72cc3620e1d013ccd4d37aa693fb64ba59", "save_path": "github-repos/isabelle/isabelle-utp-UTP", "path": "github-repos/isabelle/isabelle-utp-UTP/UTP-fc446b72cc3620e1d013ccd4d37aa693fb64ba59/utp_blocks.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540698, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.30096313101869365}}
{"text": "chapter \\<open>Section 6 Material and Gödel's First Incompleteness Theorem\\<close>\n\ntheory Goedel_I\nimports Pf_Predicates Functions II_Prelims\nbegin\n\nsection\\<open>The Function W and Lemma 6.1\\<close>\n\nsubsection\\<open>Predicate form, defined on sequences\\<close>\n\nnominal_function SeqWRP :: \"tm \\<Rightarrow> tm \\<Rightarrow> tm \\<Rightarrow> fm\"\n  where \"\\<lbrakk>atom l \\<sharp> (s,k,sl); atom sl \\<sharp> (s)\\<rbrakk> \\<Longrightarrow>\n    SeqWRP s k y = LstSeqP s k y AND\n          HPair Zero Zero IN s AND\n          All2 l k (Ex sl (HPair (Var l) (Var sl) IN s AND\n                           HPair (SUCC (Var l)) (Q_Succ (Var sl)) IN s))\"\n  by (auto simp: eqvt_def SeqWRP_graph_aux_def flip_fresh_fresh) (metis obtain_fresh)\n\nnominal_termination (eqvt)\n  by lexicographic_order\n\nlemma\n  shows SeqWRP_fresh_iff [simp]: \"a \\<sharp> SeqWRP s k y \\<longleftrightarrow> a \\<sharp> s \\<and> a \\<sharp> k \\<and> a \\<sharp> y\" (is ?thesis1)\n    and SeqWRP_sf [iff]:         \"Sigma_fm (SeqWRP s k y)\"  (is ?thsf)\n    and SeqWRP_imp_OrdP:         \"{SeqWRP s k t} \\<turnstile> OrdP k\" (is ?thOrd)\n    and SeqWRP_LstSeqP:          \"{SeqWRP s k t} \\<turnstile> LstSeqP s k t\" (is ?thlstseq)\nproof -\n  obtain l::name and sl::name where \"atom l \\<sharp> (s,k,sl)\" \"atom sl \\<sharp> (s)\"\n    by (metis obtain_fresh)\n  thus ?thesis1 ?thsf ?thOrd ?thlstseq\n      by (auto intro: LstSeqP_OrdP[THEN cut1])\nqed\n\nlemma SeqWRP_subst [simp]:\n      \"(SeqWRP s k y)(i::=t) = SeqWRP (subst i t s) (subst i t k) (subst i t y)\"\nproof -\n  obtain l::name and sl::name\n    where \"atom l \\<sharp> (s,k,sl,t,i)\" \"atom sl \\<sharp> (s,k,t,i)\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    by (auto simp: SeqWRP.simps [where l=l and sl=sl])\nqed\n\nlemma SeqWRP_cong:\n  assumes \"H \\<turnstile> s EQ s'\" and  \"H \\<turnstile> k EQ k'\" and  \"H \\<turnstile> y EQ y'\"\n  shows \"H \\<turnstile> SeqWRP s k y IFF SeqWRP s' k' y'\"\n  by (rule P3_cong [OF _ assms], auto)\n\ndeclare SeqWRP.simps [simp del]\n\nsubsection\\<open>Predicate form of W\\<close>\n\nnominal_function WRP :: \"tm \\<Rightarrow> tm \\<Rightarrow> fm\"\n  where \"\\<lbrakk>atom s \\<sharp> (x,y)\\<rbrakk> \\<Longrightarrow>\n    WRP x y = Ex s (SeqWRP (Var s) x y)\"\n  by (auto simp: eqvt_def WRP_graph_aux_def flip_fresh_fresh) (metis obtain_fresh)\n\nnominal_termination (eqvt)\n  by lexicographic_order\n\nlemma\n  shows WRP_fresh_iff [simp]: \"a \\<sharp> WRP x y \\<longleftrightarrow> a \\<sharp> x \\<and> a \\<sharp> y\" (is ?thesis1)\n    and sigma_fm_WRP [simp]:  \"Sigma_fm (WRP x y)\"  (is ?thsf)\nproof -\n  obtain s::name where \"atom s \\<sharp> (x,y)\"\n    by (metis obtain_fresh)\n  thus ?thesis1 ?thsf\n    by auto\nqed\n\nlemma WRP_subst [simp]: \"(WRP x y)(i::=t) = WRP (subst i t x) (subst i t y)\"\nproof -\n  obtain s::name where \"atom s \\<sharp> (x,y,t,i)\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    by (auto simp: WRP.simps [of s])\nqed\n\nlemma WRP_cong: \"H \\<turnstile> t EQ t' \\<Longrightarrow> H \\<turnstile> u EQ u' \\<Longrightarrow> H \\<turnstile> WRP t u IFF WRP t' u'\"\n  by (rule P2_cong) auto\n\ndeclare WRP.simps [simp del]\n\nlemma ground_WRP [simp]: \"ground_fm (WRP x y) \\<longleftrightarrow> ground x \\<and> ground y\"\n  by (auto simp: ground_aux_def ground_fm_aux_def supp_conv_fresh)\n\nlemma SeqWRP_Zero: \"{} \\<turnstile> SyntaxN.Ex s (SeqWRP (Var s) Zero Zero)\"\nproof -\n  obtain l sl :: name where \"atom l \\<sharp> (s, sl)\" \"atom sl \\<sharp> s\" by (metis obtain_fresh)\n  then show ?thesis\n    apply (subst SeqWRP.simps[of l _ _ sl]; simp)\n    apply (rule Ex_I[where x=\"(Eats Zero (HPair Zero Zero))\"], simp)\n    apply (auto intro!: Mem_Eats_I2)\n    done\nqed\n\nlemma WRP_Zero: \"{} \\<turnstile> WRP Zero Zero\"\n  by (subst WRP.simps[of undefined]) (auto simp: SeqWRP_Zero)\n\nlemma SeqWRP_HPair_Zero_Zero: \"{SeqWRP s k y} \\<turnstile> HPair Zero Zero IN s\"\nproof -\n  let ?vs = \"(s,k,y)\"\n  obtain l::name and sl::name\n    where \"atom l \\<sharp> (?vs,sl)\" \"atom sl \\<sharp> (?vs)\" by (metis obtain_fresh)\n  then show ?thesis\n    by (subst SeqWRP.simps[of l _ _ sl]) auto\nqed\n\nlemma SeqWRP_Succ:\n  assumes \"atom s \\<sharp> (s1,k1,y)\"\n  shows \"{SeqWRP s1 k1 y} \\<turnstile> SyntaxN.Ex s (SeqWRP (Var s) (SUCC k1) (Q_Succ y))\"\nproof -\n  let ?vs = \"(s,s1,k1,y)\"\n  obtain l::name and sl::name and l1::name and sl1::name\n    where atoms:\n      \"atom l \\<sharp> (?vs,sl1,l1,sl)\"\n      \"atom sl \\<sharp> (?vs,sl1,l1)\"\n      \"atom l1 \\<sharp> (?vs,sl1)\"\n      \"atom sl1 \\<sharp> (?vs)\"\n    by (metis obtain_fresh)\n  let ?hyp = \"{RestrictedP s1 (SUCC k1) (Var s), OrdP k1, SeqWRP s1 k1 y}\"\n  show ?thesis\n    using assms atoms\n    apply (auto simp: SeqWRP.simps [of l \"Var s\" _ sl])\n    apply (rule cut_same [where A=\"OrdP k1\"])\n    apply (rule SeqWRP_imp_OrdP)\n    apply (rule cut_same [OF exists_RestrictedP [of s s1 \"SUCC k1\"]])\n     apply (rule AssumeH Ex_EH Conj_EH | simp)+\n      apply (rule Ex_I [where x=\"Eats (Var s) (HPair (SUCC k1)  (Q_Succ y))\"])\n      apply (simp_all (no_asm_simp))\n    apply (rule Conj_I)\n    apply (blast intro: RestrictedP_LstSeqP_Eats[THEN cut2] SeqWRP_LstSeqP[THEN cut1])\n    apply (rule Conj_I)\n     apply (rule Mem_Eats_I1)\n     apply (blast intro: RestrictedP_Mem[THEN cut3] SeqWRP_HPair_Zero_Zero[THEN cut1] Zero_In_SUCC[THEN cut1])\n  proof (rule All2_SUCC_I, simp_all)\n    show \"?hyp \\<turnstile>  SyntaxN.Ex sl\n     (HPair k1 (Var sl) IN Eats (Var s) (HPair (SUCC k1) (Q_Succ y)) AND\n      HPair (SUCC k1) (Q_Succ (Var sl)) IN\n      Eats (Var s) (HPair (SUCC k1) (Q_Succ y)))\"\n      \\<comment> \\<open>verifying the final values\\<close>\n      apply (rule Ex_I [where x=\"y\"])\n      using assms atoms apply simp\n      apply (rule Conj_I[rotated])\n       apply (rule Mem_Eats_I2, rule Refl)\n     apply (rule Mem_Eats_I1)\n      apply (rule RestrictedP_Mem[THEN cut3])\n        apply (rule AssumeH)\n       apply (simp add: LstSeqP_imp_Mem SeqWRP_LstSeqP thin1)\n      apply (rule Mem_SUCC_Refl)\n      done\n  next\n    show \"?hyp \\<turnstile> All2 l k1\n     (SyntaxN.Ex sl\n       (HPair (Var l) (Var sl) IN\n        Eats (Var s) (HPair (SUCC k1) (Q_Succ y)) AND\n        HPair (SUCC (Var l)) (Q_Succ (Var sl)) IN\n        Eats (Var s) (HPair (SUCC k1) (Q_Succ y))))\"\n      \\<comment> \\<open>verifying the sequence buildup\\<close>\n      apply (rule All_I Imp_I)+\n      using assms atoms apply simp_all\n        \\<comment> \\<open>... the sequence buildup via s1\\<close>\n    apply (simp add: SeqWRP.simps [of l s1 _ sl])\n      apply (rule AssumeH Ex_EH Conj_EH)+\n      apply (rule All2_E [THEN rotate2], auto del: Disj_EH)\n      apply (rule Ex_I [where x=\"Var sl\"], simp)\n      apply (rule Conj_I)\n       apply (blast intro: Mem_Eats_I1 [OF RestrictedP_Mem [THEN cut3]] Mem_SUCC_I1)\n      apply (blast intro: Mem_Eats_I1 [OF RestrictedP_Mem [THEN cut3]] OrdP_IN_SUCC)\n      done\n  qed\nqed (*>*)\n\nlemma WRP_Succ: \"{OrdP i, WRP i y} \\<turnstile> WRP (SUCC i) (Q_Succ y)\"\nproof -\n  obtain s t :: name where \"atom s \\<sharp> (i, y)\" \"atom t \\<sharp> (s,i, y)\" by (metis obtain_fresh)\n  then show ?thesis\n    by (subst WRP.simps[of s], simp, subst WRP.simps[of t], simp) (force intro: SeqWRP_Succ[THEN cut1])\nqed\n\nlemma WRP: \"{} \\<turnstile> WRP (ORD_OF i) \\<guillemotleft>ORD_OF i\\<guillemotright>\"\n  by (induct i)\n    (auto simp: WRP_Zero quot_Succ intro!: WRP_Succ[THEN cut2])\n\nlemma prove_WRP:  \"{} \\<turnstile> WRP \\<guillemotleft>Var x\\<guillemotright> \\<guillemotleft>\\<guillemotleft>Var x\\<guillemotright>\\<guillemotright>\"\n  unfolding quot_Var quot_Succ\n  by (rule WRP_Succ[THEN cut2]) (auto simp: WRP)\n\nsubsection\\<open>Proving that these relations are functions\\<close>\n\nlemma SeqWRP_Zero_E:\n  assumes \"insert (y EQ Zero) H \\<turnstile> A\"  \"H \\<turnstile> k EQ Zero\"\n  shows \"insert (SeqWRP s k y) H \\<turnstile> A\"\nproof -\n  obtain l::name and sl::name\n    where \"atom l \\<sharp> (s,k,sl)\" \"atom sl \\<sharp> (s)\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    apply (auto simp: SeqWRP.simps [where s=s and l=l and sl=sl])\n    apply (rule cut_same [where A = \"LstSeqP s Zero y\"])\n    apply (blast intro: thin1 assms  LstSeqP_cong [OF Refl _ Refl, THEN Iff_MP_same])\n    apply (rule cut_same [where A = \"y EQ Zero\"])\n    apply (blast intro: LstSeqP_EQ)\n    apply (metis rotate2 assms(1) thin1)\n    done\nqed\n\nlemma SeqWRP_SUCC_lemma:\n  assumes y': \"atom y' \\<sharp> (s,k,y)\"\n  shows \"{SeqWRP s (SUCC k) y} \\<turnstile> Ex y' (SeqWRP s k (Var y') AND y EQ Q_Succ (Var y'))\"\nproof -\n  obtain l::name and sl::name\n    where atoms: \"atom l \\<sharp> (s,k,y,y',sl)\" \"atom sl \\<sharp> (s,k,y,y')\"\n    by (metis obtain_fresh)\n  thus ?thesis using y'\n    apply (auto simp: SeqWRP.simps [where s=s and l=l and sl=sl])\n    apply (rule All2_SUCC_E' [where t=k, THEN rotate2], auto)\n    apply (rule Ex_I [where x = \"Var sl\"], auto)\n    apply (blast intro: LstSeqP_SUCC) \\<comment> \\<open>showing @{term\"SeqWRP s k (Var sl)\"}\\<close>\n    apply (blast intro: ContraProve LstSeqP_EQ)\n    done\nqed\n\nlemma SeqWRP_SUCC_E:\n  assumes y': \"atom y' \\<sharp> (s,k,y)\" and k': \"H \\<turnstile> k' EQ (SUCC k)\"\n  shows \"insert (SeqWRP s k' y) H  \\<turnstile> Ex y' (SeqWRP s k (Var y') AND y EQ Q_Succ (Var y'))\"\n  using SeqWRP_cong [OF Refl k' Refl] cut1 [OF SeqWRP_SUCC_lemma [of y' s k y]]\n  by (metis Assume Iff_MP_left Iff_sym y')\n\nlemma SeqWRP_unique: \"{OrdP x, SeqWRP s x y, SeqWRP s' x y'} \\<turnstile> y' EQ y\"\nproof -\n  obtain i::name and j::name and j'::name and k::name and sl::name and sl'::name and l::name and pi::name\n    where  i: \"atom i \\<sharp> (s,s',y,y')\" and j: \"atom j \\<sharp> (s,s',i,x,y,y')\" and j': \"atom j' \\<sharp> (s,s',i,j,x,y,y')\"\n      and atoms: \"atom k \\<sharp> (s,s',i,j,j')\" \"atom sl \\<sharp> (s,s',i,j,j',k)\" \"atom sl' \\<sharp> (s,s',i,j,j',k,sl)\"\n                 \"atom pi \\<sharp> (s,s',i,j,j',k,sl,sl')\"\n    by (metis obtain_fresh)\n  have \"{OrdP (Var i)} \\<turnstile> All j (All j' (SeqWRP s (Var i) (Var j) IMP (SeqWRP s' (Var i) (Var j') IMP Var j' EQ Var j)))\"\n    apply (rule OrdIndH [where j=k])\n    using i j j' atoms apply auto\n    apply (rule rotate4)\n    apply (rule OrdP_cases_E [where k=pi], simp_all)\n    \\<comment> \\<open>Zero case\\<close>\n    apply (rule SeqWRP_Zero_E [THEN rotate3])\n    prefer 2 apply blast\n    apply (rule SeqWRP_Zero_E [THEN rotate4])\n    prefer 2 apply blast\n    apply (blast intro: ContraProve [THEN rotate4] Sym Trans)\n    \\<comment> \\<open>SUCC case\\<close>\n    apply (rule Ex_I [where x = \"Var pi\"], auto)\n    apply (metis ContraProve EQ_imp_SUBS2 Mem_SUCC_I2 Refl Subset_D)\n    apply (rule cut_same)\n    apply (rule SeqWRP_SUCC_E [of sl' s' \"Var pi\", THEN rotate4], auto)\n    apply (rule cut_same)\n    apply (rule SeqWRP_SUCC_E [of sl s \"Var pi\", THEN rotate7], auto)\n    apply (rule All_E [where x = \"Var sl\", THEN rotate5], simp)\n    apply (rule All_E [where x = \"Var sl'\"], simp)\n    apply (rule Imp_E, blast)+\n    apply (rule cut_same [OF Q_Succ_cong [OF Assume]])\n    apply (blast intro: Trans [OF Hyp Sym] HPair_cong)\n    done\n  hence \"{OrdP (Var i)} \\<turnstile> (All j' (SeqWRP s (Var i) (Var j) IMP (SeqWRP s' (Var i) (Var j') IMP Var j' EQ Var j)))(j::=y)\"\n    by (metis All_D)\n  hence \"{OrdP (Var i)} \\<turnstile> (SeqWRP s (Var i) y IMP (SeqWRP s' (Var i) (Var j') IMP Var j' EQ y))(j'::=y')\"\n    using j j'\n    by simp (drule All_D [where x=y'], simp)\n  hence \"{} \\<turnstile> OrdP (Var i) IMP (SeqWRP s (Var i) y IMP (SeqWRP s' (Var i) y' IMP y' EQ y))\"\n    using j j'\n    by simp (metis Imp_I)\n  hence \"{} \\<turnstile> (OrdP (Var i) IMP (SeqWRP s (Var i) y IMP (SeqWRP s' (Var i) y' IMP y' EQ y)))(i::=x)\"\n    by (metis Subst emptyE)\n  thus ?thesis using i\n    by simp (metis anti_deduction insert_commute)\nqed\n\ntheorem WRP_unique: \"{OrdP x, WRP x y, WRP x y'} \\<turnstile> y' EQ y\"\nproof -\n  obtain s::name and s'::name\n    where \"atom s \\<sharp> (x,y,y')\"  \"atom s' \\<sharp> (x,y,y',s)\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    by (auto simp: SeqWRP_unique [THEN rotate3] WRP.simps [of s _ y]  WRP.simps [of s' _ y'])\nqed\n\nsection\\<open>The Function HF and Lemma 6.2\\<close>\n\nsubsection \\<open>Defining the syntax: quantified body\\<close>\n\nnominal_function SeqHRP :: \"tm \\<Rightarrow> tm \\<Rightarrow> tm \\<Rightarrow> tm \\<Rightarrow> fm\"\n  where \"\\<lbrakk>atom l \\<sharp> (s,k,sl,sl',m,n,sm,sm',sn,sn');\n          atom sl \\<sharp> (s,sl',m,n,sm,sm',sn,sn');\n          atom sl' \\<sharp> (s,m,n,sm,sm',sn,sn');\n          atom m \\<sharp> (s,n,sm,sm',sn,sn');\n          atom n \\<sharp> (s,sm,sm',sn,sn');\n          atom sm \\<sharp> (s,sm',sn,sn');\n          atom sm' \\<sharp> (s,sn,sn');\n          atom sn \\<sharp> (s,sn');\n          atom sn' \\<sharp> (s)\\<rbrakk> \\<Longrightarrow>\n    SeqHRP x x' s k =\n      LstSeqP s k (HPair x x') AND\n      All2 l (SUCC k) (Ex sl (Ex sl' (HPair (Var l) (HPair (Var sl) (Var sl')) IN s AND\n                ((OrdP (Var sl) AND WRP (Var sl) (Var sl')) OR\n                 Ex m (Ex n (Ex sm (Ex sm' (Ex sn (Ex sn' (Var m IN Var l AND Var n IN Var l AND\n                       HPair (Var m) (HPair (Var sm) (Var sm')) IN s AND\n                       HPair (Var n) (HPair (Var sn) (Var sn')) IN s AND\n                       Var sl EQ HPair (Var sm) (Var sn) AND\n                       Var sl' EQ Q_HPair (Var sm') (Var sn')))))))))))\"\nby (auto simp: eqvt_def SeqHRP_graph_aux_def flip_fresh_fresh) (metis obtain_fresh)\n\nnominal_termination (eqvt)\n  by lexicographic_order\n\nlemma\n shows SeqHRP_fresh_iff [simp]:\n      \"a \\<sharp> SeqHRP x x' s k \\<longleftrightarrow> a \\<sharp> x \\<and> a \\<sharp> x' \\<and> a \\<sharp> s \\<and> a \\<sharp> k\"  (is ?thesis1)\n  and SeqHRP_sf [iff]:  \"Sigma_fm (SeqHRP x x' s k)\"  (is ?thsf)\n  and SeqHRP_imp_OrdP: \"{ SeqHRP x y s k } \\<turnstile> OrdP k\"  (is ?thord)\n  and SeqHRP_imp_LstSeqP: \"{ SeqHRP x y s k } \\<turnstile> LstSeqP s k (HPair x y)\"  (is ?thlstseq)\nproof -\n  obtain l::name and sl::name and sl'::name and m::name and n::name and\n         sm::name and sm'::name and sn::name and sn'::name\n    where atoms:\n         \"atom l \\<sharp> (s,k,sl,sl',m,n,sm,sm',sn,sn')\"\n         \"atom sl \\<sharp> (s,sl',m,n,sm,sm',sn,sn')\" \"atom sl' \\<sharp> (s,m,n,sm,sm',sn,sn')\"\n         \"atom m \\<sharp> (s,n,sm,sm',sn,sn')\" \"atom n \\<sharp> (s,sm,sm',sn,sn')\"\n         \"atom sm \\<sharp> (s,sm',sn,sn')\" \"atom sm' \\<sharp> (s,sn,sn')\"\n         \"atom sn \\<sharp> (s,sn')\" \"atom sn' \\<sharp> (s)\"\n    by (metis obtain_fresh)\n  thus ?thesis1 ?thsf ?thord ?thlstseq\n    by (auto intro: LstSeqP_OrdP)\nqed\n\nlemma SeqHRP_subst [simp]:\n      \"(SeqHRP x x' s k)(i::=t) = SeqHRP (subst i t x) (subst i t x') (subst i t s) (subst i t k)\"\nproof -\n  obtain l::name and sl::name and sl'::name and m::name and n::name and\n         sm::name and sm'::name and sn::name and sn'::name\n    where \"atom l \\<sharp> (s,k,t,i,sl,sl',m,n,sm,sm',sn,sn')\"\n          \"atom sl \\<sharp> (s,t,i,sl',m,n,sm,sm',sn,sn')\"\n          \"atom sl' \\<sharp> (s,t,i,m,n,sm,sm',sn,sn')\"\n          \"atom m \\<sharp> (s,t,i,n,sm,sm',sn,sn')\" \"atom n \\<sharp> (s,t,i,sm,sm',sn,sn')\"\n          \"atom sm \\<sharp> (s,t,i,sm',sn,sn')\" \"atom sm' \\<sharp> (s,t,i,sn,sn')\"\n          \"atom sn \\<sharp> (s,t,i,sn')\" \"atom sn' \\<sharp> (s,t,i)\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    by (auto simp: SeqHRP.simps [of l _ _ sl sl' m n sm sm' sn sn'])\nqed\n\nlemma SeqHRP_cong:\n  assumes \"H \\<turnstile> x EQ x'\" and \"H \\<turnstile> y EQ y'\" \"H \\<turnstile> s EQ s'\" and  \"H \\<turnstile> k EQ k'\"\n  shows \"H \\<turnstile> SeqHRP x y s k IFF SeqHRP x' y' s' k'\"\n  by (rule P4_cong [OF _ assms], auto)\n\nsubsection \\<open>Defining the syntax: main predicate\\<close>\n\nnominal_function HRP :: \"tm \\<Rightarrow> tm \\<Rightarrow> fm\"\n  where \"\\<lbrakk>atom s \\<sharp> (x,x',k); atom k \\<sharp> (x,x')\\<rbrakk> \\<Longrightarrow>\n         HRP x x' = Ex s (Ex k (SeqHRP x x' (Var s) (Var k)))\"\n  by (auto simp: eqvt_def HRP_graph_aux_def flip_fresh_fresh) (metis obtain_fresh)\n\nnominal_termination (eqvt)\n  by lexicographic_order\n\nlemma\n shows HRP_fresh_iff [simp]: \"a \\<sharp> HRP x x' \\<longleftrightarrow> a \\<sharp> x \\<and> a \\<sharp> x'\"  (is ?thesis1)\n   and HRP_sf [iff]:         \"Sigma_fm (HRP x x')\"  (is ?thsf)\nproof -\n  obtain s::name and k::name  where \"atom s \\<sharp> (x,x',k)\"  \"atom k \\<sharp> (x,x')\"\n    by (metis obtain_fresh)\n  thus ?thesis1 ?thsf\n    by auto\nqed\n\nlemma HRP_subst [simp]: \"(HRP x x')(i::=t) = HRP (subst i t x) (subst i t x')\"\nproof -\n  obtain s::name and k::name where \"atom s \\<sharp> (x,x',t,i,k)\"  \"atom k \\<sharp> (x,x',t,i)\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    by (auto simp: HRP.simps [of s _ _ k])\nqed\n\nsubsection\\<open>Proving that these relations are functions\\<close>\n\nlemma SeqHRP_lemma:\n  assumes \"atom m \\<sharp> (x,x',s,k,n,sm,sm',sn,sn')\" \"atom n \\<sharp> (x,x',s,k,sm,sm',sn,sn')\"\n          \"atom sm \\<sharp> (x,x',s,k,sm',sn,sn')\" \"atom sm' \\<sharp> (x,x',s,k,sn,sn')\"\n          \"atom sn \\<sharp> (x,x',s,k,sn')\" \"atom sn' \\<sharp> (x,x',s,k)\"\n    shows \"{ SeqHRP x x' s k }\n         \\<turnstile> (OrdP x AND WRP x x') OR\n             Ex m (Ex n (Ex sm (Ex sm' (Ex sn (Ex sn' (Var m IN k AND Var n IN k AND\n                       SeqHRP (Var sm) (Var sm') s (Var m) AND\n                       SeqHRP (Var sn) (Var sn') s (Var n) AND\n                       x EQ HPair (Var sm) (Var sn) AND\n                       x' EQ Q_HPair (Var sm') (Var sn')))))))\"\nproof -\n  obtain l::name and sl::name and sl'::name\n    where atoms:\n          \"atom l \\<sharp> (x,x',s,k,sl,sl',m,n,sm,sm',sn,sn')\"\n          \"atom sl \\<sharp> (x,x',s,k,sl',m,n,sm,sm',sn,sn')\"\n          \"atom sl' \\<sharp> (x,x',s,k,m,n,sm,sm',sn,sn')\"\n    by (metis obtain_fresh)\n  thus ?thesis using atoms assms\n    apply (simp add: SeqHRP.simps [of l s k sl sl' m n sm sm' sn sn'])\n    apply (rule Conj_E)\n    apply (rule All2_SUCC_E' [where t=k, THEN rotate2], simp_all)\n    apply (rule rotate2)\n    apply (rule Ex_E Conj_E)+\n    apply (rule cut_same [where A = \"HPair x x' EQ HPair (Var sl) (Var sl')\"])\n    apply (metis Assume LstSeqP_EQ rotate4, simp_all, clarify)\n    apply (rule Disj_E [THEN rotate4])\n    apply (rule Disj_I1)\n    apply (metis Assume AssumeH(3) Sym thin1  Iff_MP_same [OF Conj_cong [OF OrdP_cong WRP_cong] Assume])\n    \\<comment> \\<open>auto could be used but is VERY SLOW\\<close>\n    apply (rule Disj_I2)\n    apply (rule Ex_E Conj_EH)+\n    apply simp_all\n    apply (rule Ex_I [where x = \"Var m\"], simp)\n    apply (rule Ex_I [where x = \"Var n\"], simp)\n    apply (rule Ex_I [where x = \"Var sm\"], simp)\n    apply (rule Ex_I [where x = \"Var sm'\"], simp)\n    apply (rule Ex_I [where x = \"Var sn\"], simp)\n    apply (rule Ex_I [where x = \"Var sn'\"], simp)\n    apply (simp add: SeqHRP.simps [of l _ _ sl sl' m n sm sm' sn sn'])\n    apply (rule Conj_I, blast)+\n    \\<comment> \\<open>first SeqHRP subgoal\\<close>\n    apply (rule Conj_I)+\n    apply (blast intro: LstSeqP_Mem)\n    apply (rule All2_Subset [OF Hyp], blast)\n    apply (blast intro!: SUCC_Subset_Ord LstSeqP_OrdP, blast, simp)\n    \\<comment> \\<open>next SeqHRP subgoal\\<close>\n    apply (rule Conj_I)+\n    apply (blast intro: LstSeqP_Mem)\n    apply (rule All2_Subset [OF Hyp], blast)\n    apply (auto intro!: SUCC_Subset_Ord LstSeqP_OrdP)\n    \\<comment> \\<open>finally, the equality pair\\<close>\n    apply (blast intro: Trans)+\n    done\nqed\n\nlemma SeqHRP_unique: \"{SeqHRP x y s u, SeqHRP x y' s' u'} \\<turnstile> y' EQ y\"\nproof -\n  obtain i::name and j::name and j'::name and k::name and k'::name and l::name\n     and m::name and n::name and sm::name and sn::name and sm'::name and sn'::name\n     and m2::name and n2::name and sm2::name and sn2::name and sm2'::name and sn2'::name\n    where atoms:  \"atom i \\<sharp> (s,s',y,y')\"   \"atom j \\<sharp> (s,s',i,x,y,y')\"  \"atom j' \\<sharp> (s,s',i,j,x,y,y')\"\n                  \"atom k \\<sharp> (s,s',x,y,y',u',i,j,j')\" \"atom k' \\<sharp> (s,s',x,y,y',k,i,j,j')\" \"atom l \\<sharp> (s,s',i,j,j',k,k')\"\n                  \"atom m \\<sharp> (s,s',i,j,j',k,k',l)\"   \"atom n \\<sharp> (s,s',i,j,j',k,k',l,m)\"\n                  \"atom sm \\<sharp> (s,s',i,j,j',k,k',l,m,n)\"  \"atom sn \\<sharp> (s,s',i,j,j',k,k',l,m,n,sm)\"\n                  \"atom sm' \\<sharp> (s,s',i,j,j',k,k',l,m,n,sm,sn)\"   \"atom sn' \\<sharp> (s,s',i,j,j',k,k',l,m,n,sm,sn,sm')\"\n                  \"atom m2 \\<sharp> (s,s',i,j,j',k,k',l,m,n,sm,sn,sm',sn')\"   \"atom n2 \\<sharp> (s,s',i,j,j',k,k',l,m,n,sm,sn,sm',sn',m2)\"\n                  \"atom sm2 \\<sharp> (s,s',i,j,j',k,k',l,m,n,sm,sn,sm',sn',m2,n2)\"  \"atom sn2 \\<sharp> (s,s',i,j,j',k,k',l,m,n,sm,sn,sm',sn',m2,n2,sm2)\"\n                  \"atom sm2' \\<sharp> (s,s',i,j,j',k,k',l,m,n,sm,sn,sm',sn',m2,n2,sm2,sn2)\"   \"atom sn2' \\<sharp> (s,s',i,j,j',k,k',l,m,n,sm,sn,sm',sn',m2,n2,sm2,sn2,sm2')\"\n    by (metis obtain_fresh)\n  have \"{OrdP (Var k)}\n       \\<turnstile> All i (All j (All j' (All k' (SeqHRP (Var i) (Var j) s (Var k) IMP (SeqHRP (Var i) (Var j') s' (Var k') IMP Var j' EQ Var j)))))\"\n    apply (rule OrdIndH [where j=l])\n    using atoms apply auto\n    apply (rule Swap)\n    apply (rule cut_same)\n    apply (rule cut1 [OF SeqHRP_lemma [of m \"Var i\" \"Var j\" s \"Var k\" n sm sm' sn sn']], simp_all, blast)\n    apply (rule cut_same)\n    apply (rule cut1 [OF SeqHRP_lemma [of m2 \"Var i\" \"Var j'\" s' \"Var k'\" n2 sm2 sm2' sn2 sn2']], simp_all, blast)\n    apply (rule Disj_EH Conj_EH)+\n    \\<comment> \\<open>case 1, both are ordinals\\<close>\n    apply (blast intro: cut3 [OF WRP_unique])\n    \\<comment> \\<open>case 2, @{term \"OrdP (Var i)\"} but also a pair\\<close>\n    apply (rule Conj_EH Ex_EH)+\n    apply simp_all\n    apply (rule cut_same [where A = \"OrdP (HPair (Var sm) (Var sn))\"])\n    apply (blast intro: OrdP_cong [OF Hyp, THEN Iff_MP_same], blast)\n    \\<comment> \\<open>towards second two cases\\<close>\n    apply (rule Ex_E Disj_EH Conj_EH)+\n    \\<comment> \\<open>case 3, @{term \"OrdP (Var i)\"} but also a pair\\<close>\n    apply (rule cut_same [where A = \"OrdP (HPair (Var sm2) (Var sn2))\"])\n    apply (blast intro: OrdP_cong [OF Hyp, THEN Iff_MP_same], blast)\n    \\<comment> \\<open>case 4, two pairs\\<close>\n    apply (rule Ex_E Disj_EH Conj_EH)+\n    apply (rule All_E' [OF Hyp, where x=\"Var m\"], blast)\n    apply (rule All_E' [OF Hyp, where x=\"Var n\"], blast, simp_all)\n    apply (rule Disj_EH, blast intro: thin1 ContraProve)+\n    apply (rule All_E [where x=\"Var sm\"], simp)\n    apply (rule All_E [where x=\"Var sm'\"], simp)\n    apply (rule All_E [where x=\"Var sm2'\"], simp)\n    apply (rule All_E [where x=\"Var m2\"], simp)\n    apply (rule All_E [where x=\"Var sn\", THEN rotate2], simp)\n    apply (rule All_E [where x=\"Var sn'\"], simp)\n    apply (rule All_E [where x=\"Var sn2'\"], simp)\n    apply (rule All_E [where x=\"Var n2\"], simp)\n    apply (rule cut_same [where A = \"HPair (Var sm) (Var sn) EQ HPair (Var sm2) (Var sn2)\"])\n    apply (blast intro: Sym Trans)\n    apply (rule cut_same [where A = \"SeqHRP (Var sn) (Var sn2') s' (Var n2)\"])\n    apply (blast intro: SeqHRP_cong [OF Hyp Refl Refl, THEN Iff_MP2_same])\n    apply (rule cut_same [where A = \"SeqHRP (Var sm) (Var sm2') s' (Var m2)\"])\n    apply (blast intro: SeqHRP_cong [OF Hyp Refl Refl, THEN Iff_MP2_same])\n    apply (rule Disj_EH, blast intro: thin1 ContraProve)+\n    apply (blast intro: Trans [OF Hyp Sym] intro!: HPair_cong)\n    done\n  hence \"{OrdP (Var k)}\n         \\<turnstile> All j (All j' (All k' (SeqHRP x (Var j) s (Var k)\n               IMP (SeqHRP x (Var j') s' (Var k') IMP Var j' EQ Var j))))\"\n    apply (rule All_D [where x = x, THEN cut_same])\n    using atoms by auto\n  hence \"{OrdP (Var k)}\n         \\<turnstile> All j' (All k' (SeqHRP x y s (Var k) IMP (SeqHRP x (Var j') s' (Var k') IMP Var j' EQ y)))\"\n    apply (rule All_D [where x = y, THEN cut_same])\n    using atoms by auto\n  hence \"{OrdP (Var k)}\n          \\<turnstile> All k' (SeqHRP x y s (Var k) IMP (SeqHRP x y' s' (Var k') IMP y' EQ y))\"\n    apply (rule All_D [where x = y', THEN cut_same])\n    using atoms by auto\n  hence \"{OrdP (Var k)} \\<turnstile> SeqHRP x y s (Var k) IMP (SeqHRP x y' s' u' IMP y' EQ y)\"\n    apply (rule All_D [where x = u', THEN cut_same])\n    using atoms by auto\n  hence \"{SeqHRP x y s (Var k)} \\<turnstile> SeqHRP x y s (Var k) IMP (SeqHRP x y' s' u' IMP y' EQ y)\"\n    by (metis SeqHRP_imp_OrdP cut1)\n  hence \"{} \\<turnstile> ((SeqHRP x y s (Var k) IMP (SeqHRP x y' s' u' IMP y' EQ y)))(k::=u)\"\n    by (metis Subst emptyE Assume MP_same Imp_I)\n  hence \"{} \\<turnstile> SeqHRP x y s u IMP (SeqHRP x y' s' u' IMP y' EQ y)\"\n    using atoms by simp\n  thus ?thesis\n    by (metis anti_deduction insert_commute)\nqed\n\ntheorem HRP_unique: \"{HRP x y, HRP x y'} \\<turnstile> y' EQ y\"\nproof -\n  obtain s::name and s'::name and k::name and k'::name\n    where \"atom s \\<sharp> (x,y,y')\" \"atom s' \\<sharp> (x,y,y',s)\"\n          \"atom k \\<sharp> (x,y,y',s,s')\" \"atom k' \\<sharp> (x,y,y',s,s',k)\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    by (auto simp: SeqHRP_unique HRP.simps [of s x y k]  HRP.simps [of s' x y' k'])\nqed\n\nlemma HRP_ORD_OF: \"{} \\<turnstile> HRP (ORD_OF i) \\<guillemotleft>ORD_OF i\\<guillemotright>\"\nproof -\n  let ?vs = \"(i)\"\n  obtain s k l::name and sl::name and sl'::name and m::name and n::name and\n    sm::name and sm'::name and sn::name and sn'::name\n    where atoms:\n      \"atom s \\<sharp> (?vs,sl,sl',m,n,sm,sm',sn,sn',l,k)\"\n      \"atom k \\<sharp> (?vs,sl,sl',m,n,sm,sm',sn,sn',l)\"\n      \"atom l \\<sharp> (?vs,sl,sl',m,n,sm,sm',sn,sn')\"\n      \"atom sl \\<sharp> (?vs,sl',m,n,sm,sm',sn,sn')\" \"atom sl' \\<sharp> (?vs,m,n,sm,sm',sn,sn')\"\n      \"atom m \\<sharp> (?vs,n,sm,sm',sn,sn')\" \"atom n \\<sharp> (?vs,sm,sm',sn,sn')\"\n      \"atom sm \\<sharp> (?vs,sm',sn,sn')\" \"atom sm' \\<sharp> (?vs,sn,sn')\"\n      \"atom sn \\<sharp> (?vs,sn')\" \"atom sn' \\<sharp> ?vs\"\n    by (metis obtain_fresh)\n  then show ?thesis\n  apply (subst HRP.simps[of s _ _ k]; simp)\n    apply (subst SeqHRP.simps[of l _ _ sl sl' m n sm sm' sn sn']; simp?)\n    apply (rule Ex_I[where x=\"Eats Zero (HPair Zero (HPair (ORD_OF i) \\<guillemotleft>ORD_OF i\\<guillemotright>))\"]; simp)\n    apply (rule Ex_I[where x=\"Zero\"]; simp)\n    apply (rule Conj_I[OF LstSeqP_single])\n    apply (rule All2_SUCC_I, simp)\n     apply auto [2]\n    apply (rule Ex_I[where x=\"ORD_OF i\"], simp)\n    apply (rule Ex_I[where x=\"\\<guillemotleft>ORD_OF i\\<guillemotright>\"], simp)\n    apply (auto intro!: Disj_I1 WRP Mem_Eats_I2)\n    done\nqed\n\nlemma SeqHRP_HPair:\n  assumes \"atom s \\<sharp> (k,s1,s2,k1,k2,x,y,x',y')\" \"atom k \\<sharp> (s1,s2,k1,k2,x,y,x',y')\"\n  shows \"{SeqHRP x x' s1 k1,\n            SeqHRP y y' s2 k2}\n           \\<turnstile> Ex s (Ex k (SeqHRP (HPair x y) (Q_HPair x' y') (Var s) (Var k)))\" (*<*)\nproof -\n  let ?vs = \"(s1,s2,s,k1,k2,k,x,y,x',y')\"\n  obtain km::name and kn::name and j::name and k'::name\n    and l::name and sl::name and sl'::name and m::name and n::name\n    and sm::name and sm'::name and sn::name and sn'::name\n    where atoms2: \"atom km \\<sharp> (kn,j,k',l,s1,s2,s,k1,k2,k,x,y,x',y',sl,sl',m,n,sm,sm',sn,sn')\"\n      \"atom kn \\<sharp> (j,k',l,s1,s2,s,k1,k2,k,x,y,x',y',sl,sl',m,n,sm,sm',sn,sn')\"\n      \"atom j \\<sharp> (k',l,s1,s2,s,k1,k2,k,x,y,x',y',sl,sl',m,n,sm,sm',sn,sn')\"\n      and atoms: \"atom k' \\<sharp> (l,s1,s2,s,k1,k2,k,x,y,x',y',sl,sl',m,n,sm,sm',sn,sn')\"\n      \"atom l \\<sharp> (s1,s2,s,k1,k2,k,x,y,x',y',sl,sl',m,n,sm,sm',sn,sn')\"\n      \"atom sl \\<sharp> (s1,s2,s,k1,k2,k,x,y,x',y',sl',m,n,sm,sm',sn,sn')\"\n      \"atom sl' \\<sharp> (s1,s2,s,k1,k2,k,x,y,x',y',m,n,sm,sm',sn,sn')\"\n      \"atom m \\<sharp> (s1,s2,s,k1,k2,k,x,y,x',y',n,sm,sm',sn,sn')\"\n      \"atom n \\<sharp> (s1,s2,s,k1,k2,k,x,y,x',y',sm,sm',sn,sn')\"\n      \"atom sm \\<sharp> (s1,s2,s,k1,k2,k,x,y,x',y',sm',sn,sn')\"\n      \"atom sm' \\<sharp> (s1,s2,s,k1,k2,k,x,y,x',y',sn,sn')\"\n      \"atom sn \\<sharp> (s1,s2,s,k1,k2,k,x,y,x',y',sn')\"\n      \"atom sn' \\<sharp> (s1,s2,s,k1,k2,k,x,y,x',y')\"\n    by (metis obtain_fresh)\n  let ?hyp = \"{HaddP k1 k2 (Var k'), OrdP k1, OrdP k2, SeqAppendP s1 (SUCC k1) s2 (SUCC k2) (Var s),\n               SeqHRP x x' s1 k1, SeqHRP y y' s2 k2}\"\n  show ?thesis\n    using assms atoms\n    apply (auto simp: SeqHRP.simps [of l \"Var s\" _ sl sl' m n sm sm' sn sn'])\n    apply (rule cut_same [where A=\"OrdP k1 AND OrdP k2\"])\n     apply (metis Conj_I SeqHRP_imp_OrdP thin1 thin2)\n    apply (rule cut_same [OF exists_SeqAppendP [of s s1 \"SUCC k1\" s2 \"SUCC k2\"]])\n     apply (rule AssumeH Ex_EH Conj_EH | simp)+\n      apply (rule cut_same [OF exists_HaddP [where j=k' and x=k1 and y=k2]])\n        apply (rule AssumeH Ex_EH Conj_EH | simp)+\n        apply (rule Ex_I [where x=\"Eats (Var s) (HPair (SUCC(SUCC(Var k'))) (HPair(HPair x y)(Q_HPair x' y')))\"])\n        apply (simp_all (no_asm_simp))\n    apply (rule Ex_I [where x=\"SUCC (SUCC (Var k'))\"], simp)\n    apply (rule Conj_I)\n     apply (blast intro: LstSeqP_SeqAppendP_Eats SeqHRP_imp_LstSeqP [THEN cut1])\n  proof (rule All2_SUCC_I, simp_all)\n    show \"?hyp \\<turnstile>     SyntaxN.Ex sl\n     (SyntaxN.Ex sl'\n       (HPair (SUCC (SUCC (Var k'))) (HPair (Var sl) (Var sl')) IN\n        Eats (Var s) (HPair (SUCC (SUCC (Var k'))) (HPair (HPair x y) (Q_HPair x' y'))) AND\n        (OrdP (Var sl) AND WRP (Var sl) (Var sl') OR\n         SyntaxN.Ex m\n          (SyntaxN.Ex n\n            (SyntaxN.Ex sm\n              (SyntaxN.Ex sm'\n                (SyntaxN.Ex sn\n                  (SyntaxN.Ex sn'\n                    (Var m IN SUCC (SUCC (Var k')) AND\n                     Var n IN SUCC (SUCC (Var k')) AND\n                     HPair (Var m) (HPair (Var sm) (Var sm')) IN\n                     Eats (Var s) (HPair (SUCC (SUCC (Var k'))) (HPair (HPair x y) (Q_HPair x' y'))) AND\n                     HPair (Var n) (HPair (Var sn) (Var sn')) IN\n                     Eats (Var s) (HPair (SUCC (SUCC (Var k'))) (HPair (HPair x y) (Q_HPair x' y'))) AND\n                     Var sl EQ HPair (Var sm) (Var sn) AND Var sl' EQ Q_HPair (Var sm') (Var sn'))))))))))\"\n      \\<comment> \\<open>verifying the final values\\<close>\n      apply (rule Ex_I [where x=\"HPair x y\"])\n      using assms atoms apply simp\n      apply (rule Ex_I [where x=\"Q_HPair x' y'\"], simp)\n      apply (rule Conj_I, metis Mem_Eats_I2 Refl)\n      apply (rule Disj_I2)\n      apply (rule Ex_I [where x=k1], simp)\n      apply (rule Ex_I [where x=\"SUCC (Var k')\"], simp)\n      apply (rule Ex_I [where x=x], simp)\n      apply (rule_tac x=x' in Ex_I, simp)\n      apply (rule Ex_I [where x=y], simp)\n      apply (rule_tac x=y' in Ex_I, simp)\n      apply (rule Conj_I)\n       apply (blast intro: HaddP_Mem_I LstSeqP_OrdP Mem_SUCC_I1)\n      apply (rule Conj_I [OF Mem_SUCC_Refl])\n      apply (blast intro: Disj_I1 Mem_Eats_I1 Mem_SUCC_Refl SeqHRP_imp_LstSeqP [THEN cut1]\n          LstSeqP_imp_Mem SeqAppendP_Mem1 [THEN cut3] SeqAppendP_Mem2 [THEN cut4] HaddP_SUCC1 [THEN cut1])\n      done\n  next\n    show \"?hyp \\<turnstile>  All2 l (SUCC (SUCC (Var k')))\n     (SyntaxN.Ex sl\n       (SyntaxN.Ex sl'\n         (HPair (Var l) (HPair (Var sl) (Var sl')) IN\n          Eats (Var s) (HPair (SUCC (SUCC (Var k'))) (HPair (HPair x y) (Q_HPair x' y'))) AND\n          (OrdP (Var sl) AND WRP (Var sl) (Var sl') OR\n           SyntaxN.Ex m\n            (SyntaxN.Ex n\n              (SyntaxN.Ex sm\n                (SyntaxN.Ex sm'\n                  (SyntaxN.Ex sn\n                    (SyntaxN.Ex sn'\n                      (Var m IN Var l AND\n                       Var n IN Var l AND\n                       HPair (Var m) (HPair (Var sm) (Var sm')) IN\n                       Eats (Var s) (HPair (SUCC (SUCC (Var k'))) (HPair (HPair x y) (Q_HPair x' y'))) AND\n                       HPair (Var n) (HPair (Var sn) (Var sn')) IN\n                       Eats (Var s) (HPair (SUCC (SUCC (Var k'))) (HPair (HPair x y) (Q_HPair x' y'))) AND\n                       Var sl EQ HPair (Var sm) (Var sn) AND Var sl' EQ Q_HPair (Var sm') (Var sn')))))))))))\"\n      \\<comment> \\<open>verifying the sequence buildup\\<close>\n      apply (rule cut_same [where A=\"HaddP (SUCC k1) (SUCC k2) (SUCC (SUCC (Var k')))\"])\n       apply (blast intro: HaddP_SUCC1 [THEN cut1] HaddP_SUCC2 [THEN cut1])\n      apply (rule All_I Imp_I)+\n       apply (rule HaddP_Mem_cases [where i=j])\n      using assms atoms atoms2 apply simp_all\n          apply (rule AssumeH)\n         apply (blast intro: OrdP_SUCC_I LstSeqP_OrdP)\n        \\<comment> \\<open>... the sequence buildup via s1\\<close>\n        apply (simp add: SeqHRP.simps [of l s1 _ sl sl' m n sm sm' sn sn'])\n        apply (rule AssumeH Ex_EH Conj_EH)+\n        apply (rule All2_E [THEN rotate2])\n          apply (simp | rule AssumeH Ex_EH Conj_EH)+\n            apply (rule Ex_I [where x=\"Var sl\"], simp)\n            apply (rule Ex_I [where x=\"Var sl'\"], simp)\n            apply (rule Conj_I [OF Mem_Eats_I1])\n             apply (metis SeqAppendP_Mem1 rotate3 thin2 thin4)\n            apply (rule AssumeH Disj_IE1H Ex_EH Conj_EH)+\n                        apply (rule Ex_I [where x=\"Var m\"], simp)\n                        apply (rule Ex_I [where x=\"Var n\"], simp)\n                        apply (rule Ex_I [where x=\"Var sm\"], simp)\n                        apply (rule Ex_I [where x=\"Var sm'\"], simp)\n                        apply (rule Ex_I [where x=\"Var sn\"], simp)\n                        apply (rule Ex_I [where x=\"Var sn'\"], simp_all (no_asm_simp))\n       apply (rule Conj_I, rule AssumeH)+\n       apply (rule Conj_I)\n        apply (blast intro: OrdP_Trans [OF OrdP_SUCC_I] Mem_Eats_I1 [OF SeqAppendP_Mem1 [THEN cut3]] Hyp)\n       apply (blast intro: Disj_I1 Disj_I2 OrdP_Trans [OF OrdP_SUCC_I] Mem_Eats_I1 [OF SeqAppendP_Mem1 [THEN cut3]] Hyp)\n        \\<comment> \\<open>... the sequence buildup via s2\\<close>\n      apply (simp add: SeqHRP.simps [of l s2 _ sl sl' m n sm sm' sn sn'])\n      apply (rule AssumeH Ex_EH Conj_EH)+\n      apply (rule All2_E [THEN rotate2])\n        apply (simp | rule AssumeH Ex_EH Conj_EH)+\n          apply (rule Ex_I [where x=\"Var sl\"], simp)\n          apply (rule Ex_I [where x=\"Var sl'\"], simp)\n          apply (rule cut_same [where A=\"OrdP (Var j)\"])\n           apply (metis HaddP_imp_OrdP rotate2 thin2)\n          apply (rule Conj_I)\n           apply (blast intro: Mem_Eats_I1 SeqAppendP_Mem2 [THEN cut4] del: Disj_EH)\n          apply (rule AssumeH Disj_IE1H Ex_EH Conj_EH)+\n                      apply (rule cut_same [OF exists_HaddP [where j=km and x=\"SUCC k1\" and y=\"Var m\"]])\n                        apply (blast intro: Ord_IN_Ord, simp)\n                      apply (rule cut_same [OF exists_HaddP [where j=kn and x=\"SUCC k1\" and y=\"Var n\"]])\n                        apply (metis AssumeH(6) Ord_IN_Ord0 rotate8, simp)\n                      apply (rule AssumeH Ex_EH Conj_EH | simp)+\n                          apply (rule Ex_I [where x=\"Var km\"], simp)\n                          apply (rule Ex_I [where x=\"Var kn\"], simp)\n                          apply (rule Ex_I [where x=\"Var sm\"], simp)\n                          apply (rule Ex_I [where x=\"Var sm'\"], simp)\n                          apply (rule Ex_I [where x=\"Var sn\"], simp)\n                          apply (rule Ex_I [where x=\"Var sn'\"], simp_all (no_asm_simp))\n      apply (rule Conj_I [OF _ Conj_I])\n        apply (blast intro!: HaddP_Mem_cancel_left [THEN Iff_MP2_same] OrdP_SUCC_I intro: LstSeqP_OrdP Hyp)+\n      apply (blast del: Disj_EH  intro: OrdP_Trans Hyp\n          intro!: Mem_Eats_I1 SeqAppendP_Mem2 [THEN cut4] HaddP_imp_OrdP [THEN cut1])\n      done\n  qed\nqed (*>*)\n\nlemma HRP_HPair: \"{HRP x x', HRP y y'} \\<turnstile> HRP (HPair x y) (Q_HPair x' y')\"\nproof -\n  obtain k1::name and s1::name and k2::name and s2::name and k::name and s::name\n    where \"atom s1 \\<sharp> (x,y,x',y')\"        \"atom k1 \\<sharp> (x,y,x',y',s1)\"\n      \"atom s2 \\<sharp> (x,y,x',y',k1,s1)\"  \"atom k2 \\<sharp> (x,y,x',y',s2,k1,s1)\"\n      \"atom s  \\<sharp> (x,y,x',y',k2,s2,k1,s1)\" \"atom k  \\<sharp> (x,y,x',y',s,k2,s2,k1,s1)\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    by (force simp: HRP.simps [of s \"HPair x y\" _ k]\n        HRP.simps [of s1 x _ k1]\n        HRP.simps [of s2 y _ k2]\n        intro: SeqHRP_HPair [THEN cut2])\nqed\n\nlemma HRP_HPair_quot: \"{HRP x \\<guillemotleft>x\\<guillemotright>, HRP y \\<guillemotleft>y\\<guillemotright>} \\<turnstile> HRP (HPair x y) \\<guillemotleft>HPair x y\\<guillemotright>\"\n  using HRP_HPair[of x \"\\<guillemotleft>x\\<guillemotright>\" y \"\\<guillemotleft>y\\<guillemotright>\"]\n  unfolding HPair_def quot_simps by auto\n\nlemma prove_HRP_coding_tm: fixes t::tm shows \"coding_tm t \\<Longrightarrow> {} \\<turnstile> HRP t \\<guillemotleft>t\\<guillemotright>\"\n  by (induct t rule: coding_tm.induct)\n    (auto simp: quot_simps HRP_ORD_OF HRP_HPair_quot[THEN cut2])\n\nlemmas prove_HRP = prove_HRP_coding_tm[OF quot_fm_coding]\n\nsection\\<open>The Function K and Lemma 6.3\\<close>\n\nnominal_function KRP :: \"tm \\<Rightarrow> tm \\<Rightarrow> tm \\<Rightarrow> fm\"\n  where \"atom y \\<sharp> (v,x,x') \\<Longrightarrow>\n         KRP v x x' = Ex y (HRP x (Var y) AND SubstFormP v (Var y) x x')\"\n  by (auto simp: eqvt_def KRP_graph_aux_def flip_fresh_fresh) (metis obtain_fresh)\n\nnominal_termination (eqvt)\n  by lexicographic_order\n\nlemma KRP_fresh_iff [simp]: \"a \\<sharp> KRP v x x' \\<longleftrightarrow> a \\<sharp> v \\<and> a \\<sharp> x \\<and> a \\<sharp> x'\"\nproof -\n  obtain y::name where \"atom y \\<sharp> (v,x,x')\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    by auto\nqed\n\nlemma KRP_subst [simp]: \"(KRP v x x')(i::=t) = KRP (subst i t v) (subst i t x) (subst i t x')\"\nproof -\n  obtain y::name where \"atom y \\<sharp> (v,x,x',t,i)\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    by (auto simp: KRP.simps [of y])\nqed\n\ndeclare KRP.simps [simp del]\n\nlemma prove_SubstFormP: \"{} \\<turnstile> SubstFormP \\<guillemotleft>Var i\\<guillemotright> \\<guillemotleft>\\<guillemotleft>A\\<guillemotright>\\<guillemotright> \\<guillemotleft>A\\<guillemotright> \\<guillemotleft>A(i::=\\<guillemotleft>A\\<guillemotright>)\\<guillemotright>\"\n  using SubstFormP by blast\n\nlemma prove_KRP: \"{} \\<turnstile> KRP \\<guillemotleft>Var i\\<guillemotright> \\<guillemotleft>A\\<guillemotright> \\<guillemotleft>A(i::=\\<guillemotleft>A\\<guillemotright>)\\<guillemotright>\"\n  by (auto simp: KRP.simps [of y]\n           intro!: Ex_I [where x=\"\\<guillemotleft>\\<guillemotleft>A\\<guillemotright>\\<guillemotright>\"] prove_HRP prove_SubstFormP)\n\nlemma KRP_unique: \"{KRP v x y, KRP v x y'} \\<turnstile> y' EQ y\"\nproof -\n  obtain u::name and u'::name where \"atom u \\<sharp> (v,x,y,y')\" \"atom u' \\<sharp> (v,x,y,y',u)\"\n    by (metis obtain_fresh)\n  thus ?thesis\n    by (auto simp: KRP.simps [of u v x y] KRP.simps [of u' v x y']\n             intro: SubstFormP_cong [THEN Iff_MP2_same]\n                    SubstFormP_unique [THEN cut2] HRP_unique [THEN cut2])\nqed\n\nlemma KRP_subst_fm: \"{KRP \\<guillemotleft>Var i\\<guillemotright> \\<guillemotleft>\\<beta>\\<guillemotright> (Var j)} \\<turnstile> Var j EQ \\<guillemotleft>\\<beta>(i::=\\<guillemotleft>\\<beta>\\<guillemotright>)\\<guillemotright>\"\n  by (metis KRP_unique cut0 prove_KRP)\n\nend\n\n", "meta": {"author": "isabelle-prover", "repo": "mirror-afp-devel", "sha": "c84055551f07621736c3eb6a1ef4fb7e8cc57dd1", "save_path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel", "path": "github-repos/isabelle/isabelle-prover-mirror-afp-devel/mirror-afp-devel-c84055551f07621736c3eb6a1ef4fb7e8cc57dd1/thys/Goedel_HFSet_Semanticless/Goedel_I.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5078118642792044, "lm_q2_score": 0.5926665999540698, "lm_q1q2_score": 0.30096313101869365}}
{"text": "(*File: Language.thy\n  Author: L Beringer & M Hofmann, LMU Munich\n  Date: 05/12/2008\n  Purpose: Syntax and operational semantics of subset of JVML \n*)\n(*<*)\ntheory Language imports AssocLists begin\n(*>*)\n\nsection\\<open>Language \\label{sec:language}\\<close>\nsubsection\\<open>Syntax\\<close>\n\ntext\\<open>We have syntactic classes of (local) variables, class names,\nfield names, and method names. Naming restrictions, namespaces, long\nJava names etc.~are not modelled.\\<close>\n\ntypedecl Var\ntypedecl Class\ntypedecl Field\ntypedecl Method\n\ntext\\<open>Since arithmetic operations are modelled as unimplemented\nfunctions, we introduce the type of values in this section. The domain\nof heap locations is arbitrary.\\<close>\n\ntypedecl Addr \n\ntext\\<open>A reference is either null or an address.\\<close>\n\ndatatype Ref = Nullref | Loc Addr\n\ntext\\<open>Values are either integer numbers or references.\\<close>\n\ndatatype Val = RVal Ref | IVal int\n\ntext\\<open>The type of (instruction) labels is fixed, since the operational\nsemantics increments the program counter after each instruction.\\<close>\n\ntype_synonym Label = int\n\ntext\\<open>Regarding the instructions, we support basic operand-stack\nmanipulations, object creation, field modifications, casts, static\nmethod invocations, conditional and unconditional jumps, and a return\ninstruction.\n\nFor every (Isabelle) function \\<open>f : Val\\<Rightarrow>Val\\<Rightarrow>Val\\<close> we have an\ninstruction \\<open>binop f\\<close> whose semantics is to invoke \\<open>f\\<close>\non the two topmost values on the operand stack and replace them with\nthe result.  Similarly for \\<open>unop f\\<close>.\\<close>\n\ndatatype Instr =\n  const Val\n| dup\n| pop\n| swap\n| load Var\n| store Var\n| binop \"Val \\<Rightarrow> Val \\<Rightarrow> Val\"\n| unop \"Val \\<Rightarrow> Val\" \n| new Class\n| getfield Class Field\n| putfield Class Field\n| checkcast Class\n| invokeS Class Method\n| goto Label\n| iftrue Label\n| vreturn \n\ntext\\<open>Method body declarations contain a list of formal parameters, a\nmapping from instruction labels to instructions, and a start\nlabel. The operational semantics assumes that instructions are\nlabelled consecutively\\footnote{In the paper, we slightly abstract\nfrom this by including a successor functions on labels}.\\<close>\n\ntype_synonym Mbody = \"Var list \\<times> (Label, Instr) AssList \\<times> Label\" \n\ntext\\<open>A class definition associates method bodies to method names.\\<close>\ntype_synonym Classdef = \"(Method, Mbody) AssList\"\n\ntext\\<open>Finally, a program consists of classes.\\<close>\ntype_synonym Prog = \"(Class, Classdef) AssList\"\n\ntext\\<open>Taken together, the three types \\<open>Prog\\<close>, \\<open>Classdef\\<close>,\nand \\<open>Mbody\\<close> represent an abstract model of the virtual machine\nenvironment. In our opinion, it would be desirable to avoid modelling\nthis environment at a finer level, at least for the purpose of the\nprogram logic. For example, we prefer not to consider in detail the\nrepresentation of the constant pool.\\<close>\n\nsubsection\\<open>Dynamic semantics\\<close>\nsubsubsection\\<open>Semantic components\\<close>\n\ntext\\<open>An object consists of the identifier of its dynamic class and a\nmap from field names to values. Currently, we do not model\ntype-correctness, nor do we require that all (or indeed any) of the\nfields stem from the static definition of the class, or a super-class.\nNote, however, that type correctness can be expressed in the logic.\\<close>\n\ntype_synonym Object = \"Class \\<times> (Field, Val) AssList\"\n\ntext\\<open>The heap is represented as a map from addresses to values.  The\nJVM specification does not prescribe any particular object layout. The\nproposed type reflects this indeterminacy, but allows one to calculate\nthe byte-correct size of a heap only after a layout scheme has been\nsupplied. Alternative heap models would be the store-less semantics in\nthe sense of Jonkers~\\cite{Jonkers1981} and\nDeutsch~\\cite{Deutsch1992}, (where the heap is modelled as a partial\nequivalence relation on access paths), or object-based semantics in\nthe sense of Reddy~\\cite{Reddy1996}, where the heap is represented as\na history of update operations.  H\\\"ahnle et al.~use a variant of the\nlatter in their dynamic logic for a {\\sc\nJavaCard}~~\\cite{HaehnleM:Cassis2005}.\\<close>\n\ntype_synonym Heap = \"(Addr, Object) AssList\"\n\ntext\\<open>Later, one might extend heaps by a component for static fields.\\<close>\n\ntext\\<open>The types of the (register) store and the operand stack are as\nexpected.\\<close>\n\ntype_synonym Store = \"(Var, Val) AssList\"\ntype_synonym OpStack = \"Val list\"\n\ntext\\<open>States contain an operand stack, a store, and a heap.\\<close>\ntype_synonym State = \"OpStack \\<times> Store \\<times> Heap\"\n\ndefinition heap::\"State \\<Rightarrow> Heap\"\nwhere \"heap s = snd(snd s)\"\n\ntext\\<open>The operational semantics and the program logic are defined\nrelative to a fixed program \\<open>P\\<close>.  Alternatively, the type of the\noperational semantics (and proof judgements) could be extended by a\nprogram component.  We also define the constant value \\<open>TRUE\\<close>,\nthe representation of which does not matter for the current\nformalisation.\\<close>\n\naxiomatization P::Prog and TRUE::Val\n\ntext\\<open>In order to obtain more readable rules, we define operations\nfor extracting method bodies and instructions from the program.\\<close>\n\ndefinition mbody_is::\"Class \\<Rightarrow> Method \\<Rightarrow> Mbody \\<Rightarrow> bool\"\nwhere \"mbody_is C m M = (\\<exists> CD . P\\<down>C = Some CD \\<and> CD\\<down>m = Some M)\"\n\ndefinition get_ins::\"Mbody \\<Rightarrow> Label \\<Rightarrow> Instr option\"\nwhere \"get_ins M l = (fst(snd M))\\<down>l\"\n\ndefinition ins_is::\"Class \\<Rightarrow> Method \\<Rightarrow> Label \\<Rightarrow> Instr \\<Rightarrow> bool\"\nwhere \"ins_is C m l ins = (\\<exists> M . mbody_is C m M \\<and> get_ins M l = Some ins)\"\n\ntext\\<open>The transfer of method arguments from the caller's operand stack\nto the formal parameters of an invoked method is modelled by the\npredicate\\<close>\n\ninductive_set Frame::\"(OpStack \\<times> (Var list) \\<times> Store \\<times> OpStack) set\"\nwhere\nFrameNil: \"\\<lbrakk>oo=ops\\<rbrakk> \\<Longrightarrow> (ops,[],emp,oo) : Frame\"\n|\nFrame_cons: \"\\<lbrakk>(oo,par,S,ops) : Frame; R =S[x\\<mapsto>v]\\<rbrakk>\n            \\<Longrightarrow> (v # oo, x # par,R,ops):Frame\"\n\n(*<*)\nlemma Frame_deterministic[rule_format]:\n\"(ops, par, S, os) \\<in> Frame \\<Longrightarrow> \n(\\<forall> R opsa . (ops, par, R, opsa) \\<in> Frame \\<longrightarrow> R=S \\<and> opsa = os)\"\napply (erule Frame.induct, clarsimp)\napply (erule Frame.cases, clarsimp, clarsimp)\napply (erule thin_rl, clarsimp)\napply (erule Frame.cases, clarsimp, clarsimp)\ndone\n(*>*)\n\ntext\\<open>In order to obtain a deterministic semantics, we assume the\nexistence of a function, with the obvious freshness axiom for this\nconstruction.\\<close>\n\naxiomatization nextLoc::\"Heap \\<Rightarrow> Addr\"\nwhere nextLoc_fresh: \"h\\<down>(nextLoc h) = None\"\n\nsubsubsection\\<open>Operational judgements\\<close> \n\ntext\\<open>Similar to Bannwart-M\\\"uller~\\cite{BannwartMueller05}, we define\ntwo operational judgements: a one-step relation and a relation that\nrepresents the transitive closure of the former until the end of the\ncurrent method invocation. These relations are mutually recursive,\nsince the method invocation rule contracts the execution of the\ninvoked method to a single step. The one-step relation associates a\nstate to its immediate successor state, where the program counter is\ninterpreted with respect to the current method body. The transitive\nclosure ignores the bottom part of the operand stack and the store of\nthe final configuration. It simply returns the heap and the result of\nthe method invocation, where the latter is given by the topmost value\non the operand stack. In contrast to~\\cite{BannwartMueller05}, we do\nnot use an explicit \\<open>return\\<close> variable. Both relations take an\nadditional index of type \\<open>nat\\<close> that monitors the derivation\nheight. This is useful in the proof of soundness of the program\nlogic.\\<close>\n\ntext\\<open>Intuitively, \\<open>(M,l,s,n,l',s'):Step\\<close> means that method\n(body) \\<open>M\\<close> evolves in one step from state \\<open>s\\<close> to state\n\\<open>s'\\<close>, while statement \\<open>(M,s,n,h,v):Exec\\<close> indicates that\nexecuting from \\<open>s\\<close> in method \\<open>M\\<close> leads eventually to a\nstate whose final value is \\<open>h\\<close>, where precisely the last step in\nthis sequence is a \\<open>vreturn\\<close> instruction and the return value is\n\\<open>v\\<close>.\\<close>\n\ntext\\<open>Like Bannwart and M\\\"uller, we define a \"frame-less\"\nsemantics. i.e.~the execution of a method body is modelled by a\ntransitive closure of the basic step-relation, which results in a\none-step reduction at the invocation site. Arguably, an operational\nsemantics with an explicit frame stack is closer to the real JVM. It\nshould not be difficult to verify the operational soundness of the\npresent system w.r.t.~such a finer model, or to modify the\nsemantics.\\<close>\n\ninductive_set\n  Step::\"(Mbody \\<times> Label \\<times> State \\<times> nat \\<times> Label \\<times> State) set\"\nand\n  Exec::\"(Mbody \\<times> Label \\<times> State \\<times> nat \\<times> Heap \\<times> Val) set\"\nwhere\nConst:\"\\<lbrakk>get_ins M l = Some (const v); NEXT = (v # os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(os,s,h), 1, ll, NEXT) : Step\"\n|\nDup:  \"\\<lbrakk>get_ins M l = Some dup; NEXT = (v # v # os,s,h); ll =l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # os,s,h), 1, ll, NEXT) : Step\"\n|\nPop:  \"\\<lbrakk>get_ins M l = Some pop; NEXT = (os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # os,s,h), 1, ll, NEXT) : Step\"\n|\nSwap: \"\\<lbrakk>get_ins M l = Some swap; NEXT = (w # (v # os),s,h); ll= l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # (w # os),s,h), 1, ll, NEXT) : Step\"\n|\nLoad: \"\\<lbrakk>get_ins M l = Some (load x); s\\<down>x = Some v;\n         NEXT = (v # os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(os,s,h), 1, ll,NEXT) : Step\"\n|\nStore:\"\\<lbrakk>get_ins M l = Some (store x); NEXT = (os,s[x\\<mapsto>v],h); ll= l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # os,s,h), 1, ll, NEXT) : Step\"\n|\nBinop:\"\\<lbrakk>get_ins M l = Some (binop f); NEXT = ((f v w) # os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # (w # os),s,h), 1, ll,NEXT) : Step\"\n|\nUnop: \"\\<lbrakk>get_ins M l = Some (unop f); NEXT = ((f v) # os,s,h);ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # os,s,h), 1, ll, NEXT) : Step\"\n|\nNew:  \"\\<lbrakk>get_ins M l = Some (new d); newobj = (d, emp); a=nextLoc h; \n         NEXT = ((RVal (Loc a)) # os,s,h[a\\<mapsto>newobj]); ll = l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(os,s,h), 1, ll,NEXT) : Step\"\n|\nGet:  \"\\<lbrakk>get_ins M l = Some (getfield d F); h\\<down>a = Some (d, Flds);\n         Flds\\<down>F = Some v; NEXT = (v # os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,((RVal (Loc a)) # os,s,h), 1, ll,NEXT) : Step\"\n|\nPut:  \"\\<lbrakk>get_ins M l = Some (putfield d F); h\\<down>a = Some (d, Flds);\n         newobj = (d, Flds[F\\<mapsto>v]); NEXT = (os,s,h[a\\<mapsto>newobj]); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # ((RVal (Loc a)) # os),s,h), 1, ll, NEXT) : Step\"\n|\nCast: \"\\<lbrakk>get_ins M l = Some (checkcast d); h\\<down>a = Some (d, Flds);\n         NEXT = ((RVal (Loc a)) # os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,((RVal (Loc a)) # os,s,h), 1, ll,NEXT) : Step\"\n|\nGoto: \"\\<lbrakk>get_ins M l = Some (goto pc)\\<rbrakk> \\<Longrightarrow> (M,l,S, 1, pc,S) : Step\"\n|\nIfT:  \"\\<lbrakk>get_ins M l = Some (iftrue pc); NEXT = (os,s,h)\\<rbrakk>\n       \\<Longrightarrow> (M,l,(TRUE # os,s,h), 1, pc, NEXT) : Step\"\n|\nIfF:  \"\\<lbrakk>get_ins M l = Some (iftrue pc); v \\<noteq> TRUE; NEXT = (os,s,h); ll=l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(v # os,s,h), 1, ll, NEXT) : Step\"\n|\nInvS: \"\\<lbrakk>get_ins M l = Some (invokeS C m); mbody_is C m (par,code,l0);\n         ((par,code,l0),l0,([], S,h), n, hh, v): Exec; \n         (ops,par,S,os) : Frame; NEXT = (v # os,s,hh); ll = l+1\\<rbrakk>\n       \\<Longrightarrow> (M,l,(ops,s,h), Suc n, ll, NEXT) : Step\"\n|\nVret: \"\\<lbrakk>get_ins M l = Some vreturn\\<rbrakk> \\<Longrightarrow> (M,l,(v # os,s,h), 1, h, v) : Exec\"\n|\nRun:  \"\\<lbrakk>(M,l,s,n,ll,t):Step; (M,ll,t,m,h,v):Exec; k = (max n m) +1 \\<rbrakk>\n       \\<Longrightarrow> (M,l,s,k,h,v) : Exec\"\n\ntext\\<open>A big-step operational judgement that abstracts from the\nderivation height is easily defined.\\<close>\n\ndefinition Opsem::\"Mbody \\<Rightarrow> Label \\<Rightarrow> State \\<Rightarrow> Heap \\<Rightarrow> Val \\<Rightarrow> bool\"\nwhere \"Opsem M l s h v = (\\<exists> n . (M,l,s,n,h,v):Exec)\"\n\nsubsection \\<open>Basic properties\\<close>\n\ntext \\<open>We provide elimination lemmas for the inductively defined\nrelations\\<close>\n\ninductive_cases eval_cases: \n \"(M,l,s,n,ll,t) : Step\"\n \"(M,l,s,n,h,v) : Exec\"\n(*<*)\nlemma no_zero_height_derivsAux[rule_format]: \n\"\\<forall>n . ((M,l,s,n,ll,t) : Step \\<longrightarrow> (n=0 \\<longrightarrow> False)) \\<and> ((MM,lll,ss,m,h,v):Exec \\<longrightarrow> (m=0 \\<longrightarrow> False))\"\nby (rule allI, rule Step_Exec.induct, simp_all)\n\nlemma no_zero_height_derivsAux2: \"((M,l,s,0,ll,t):Step \\<longrightarrow> False) \\<and> ((MM,lll,ss,0,h,v):Exec \\<longrightarrow> False)\"\nby (insert no_zero_height_derivsAux, fast)\n(*>*)\ntext \\<open>and observe that no derivations of height 0 exist.\\<close>\nlemma no_zero_height_Step_derivs: \"(M,l,s,0,ll,t):Step \\<Longrightarrow> False\"\n(*<*)by (insert no_zero_height_derivsAux2, fast)(*>*)\n(*<*)\nlemma no_zero_height_Step_derivs1: \"(M,l,(os,S,H),0,ll,t):Step \\<Longrightarrow> False\"\nby (insert no_zero_height_derivsAux2, fast)\n(*>*)\n\nlemma no_zero_height_Exec_derivs: \"(M,l,s,0,h,v):Exec \\<Longrightarrow> False\"\n(*<*)by (insert no_zero_height_derivsAux2, fast)(*>*)\n(*<*)\nlemma no_zero_height_Exec_derivs1: \"(M,l,(os,S,H),0,h,v):Exec \\<Longrightarrow> False\"\nby (insert no_zero_height_derivsAux2, fast)\n(*>*)\n\n(*<*)\n(*Elimination rules*)\nlemma ConstElim1:\"\\<lbrakk>(M, l, (os, S, h), n, ll,t) \\<in> Step; get_ins M l = Some (const v)\\<rbrakk> \n               \\<Longrightarrow> n = Suc 0 \\<and> t = (v # os, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma DupElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l =  Some dup\\<rbrakk> \n               \\<Longrightarrow> \\<exists> v ops . os = v # ops \\<and> n = Suc 0 \\<and> t = (v # os, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma PopElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l =  Some pop\\<rbrakk> \n               \\<Longrightarrow> \\<exists> v ops . os = v # ops \\<and> n = Suc 0 \\<and> t = (ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma SwapElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some swap\\<rbrakk>\n              \\<Longrightarrow> \\<exists> v w ops . os = v # w # ops \\<and> n = Suc 0 \\<and> t = (w # v # ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma LoadElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (load x)\\<rbrakk>\n                 \\<Longrightarrow> \\<exists> v . S\\<down>x = Some v \\<and> n = Suc 0 \\<and> t = (v # os, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma StoreElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (store x)\\<rbrakk>\n                  \\<Longrightarrow> \\<exists> v ops . os = v # ops \\<and> n = Suc 0 \\<and> t = (ops, S[x\\<mapsto>v], h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma BinopElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (binop f)\\<rbrakk>\n                  \\<Longrightarrow> \\<exists> v w ops . os = v # w # ops \\<and> n = Suc 0 \\<and> t = (f v w # ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all) \n\nlemma UnopElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (unop f)\\<rbrakk>\n                 \\<Longrightarrow> \\<exists> v ops . os = v # ops \\<and> n = Suc 0 \\<and> t = (f v # ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma NewElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (new d)\\<rbrakk>\n               \\<Longrightarrow> \\<exists> a . a = nextLoc h \\<and> n = Suc 0 \\<and> t = (RVal (Loc a) # os, S, h[a\\<mapsto>(d, emp)]) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma GetElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (getfield d F)\\<rbrakk>\n               \\<Longrightarrow> \\<exists> a Flds v ops. h\\<down>a = Some (d, Flds) \\<and> Flds\\<down>F = Some v \\<and> \n                                   os = RVal (Loc a) # ops \\<and> n = Suc 0 \\<and> t = (v # ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma PutElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (putfield d F)\\<rbrakk>\n                \\<Longrightarrow> \\<exists> a Flds v ops. h\\<down>a = Some (d, Flds) \\<and> os = v # RVal (Loc a) # ops \\<and>\n                                   n = Suc 0 \\<and> t = (ops, S, h[a\\<mapsto>(d, Flds[F\\<mapsto>v])]) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma CastElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (checkcast d)\\<rbrakk>\n                \\<Longrightarrow> \\<exists> a Flds ops . h\\<down>a = Some (d, Flds) \\<and> os = RVal (Loc a) # ops \\<and> n = Suc 0 \\<and> \n                                   t = (RVal (Loc a) # ops, S, h) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all)\n\nlemma GotoElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (goto pc)\\<rbrakk>\n                \\<Longrightarrow> n = Suc 0 \\<and> t = (os, S, h) \\<and> ll = pc\"\nby (erule eval_cases, simp_all)\n\nlemma IfElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (iftrue pc)\\<rbrakk>\n              \\<Longrightarrow> (\\<exists> ops . os = TRUE # ops \\<and> n = Suc 0 \\<and> t = (ops, S, h) \\<and> ll = pc) \\<or> \n                  (\\<exists> v ops . v \\<noteq> TRUE \\<and> os = v # ops \\<and> n = Suc 0 \\<and> t = (ops, S, h) \\<and> ll = l+1)\"\nby (erule eval_cases, simp_all)\n\nlemma InvokeElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (invokeS C m)\\<rbrakk>\n                   \\<Longrightarrow> \\<exists> code l0 v ops hh u k R par. \n                           mbody_is C m (par,code, l0) \\<and> (os,par,R,ops):Frame \\<and> \n                           ((par,code,l0), l0, ([], R, h), k, hh, v) \\<in> Exec \\<and> \n                           n = Suc k \\<and> t = (v # ops, S, hh) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all, fastforce)\nlemma InvokeElim: \"\\<lbrakk>(M, l, s, n, ll, t) \\<in> Step; get_ins M l = Some (invokeS C m)\\<rbrakk>\n                   \\<Longrightarrow> \\<exists> code l0 v ops hh u k R par. \n                           mbody_is C m (par,code, l0) \\<and> (fst s,par,R,ops):Frame \\<and> \n                           ((par,code,l0), l0, ([], R, snd(snd s)), k, hh, v) \\<in> Exec \\<and> \n                           n = Suc k \\<and> t = (v # ops, fst (snd s), hh) \\<and> ll = l+1\"\nby (erule eval_cases, simp_all, fastforce)\n\nlemma RetElim1: \"\\<lbrakk>(M, l, (os, S, h), n, ll, t) \\<in> Step; get_ins M l = Some (vreturn)\\<rbrakk> \\<Longrightarrow> False\"\nby (erule eval_cases, simp_all)\n\nlemma ExecElim1: \"\\<lbrakk>(M,l,(os,S,H),k,h,v):Exec\\<rbrakk>\n      \\<Longrightarrow> (get_ins M l = Some vreturn \\<and> (\\<exists> ops . os = v # ops \\<and> k = Suc 0 \\<and> h=H)) \\<or>\n          (\\<exists> n m t ll. (M, l,(os,S,H), n, ll,t) \\<in> Step \\<and> (M, ll, t, m, h, v) \\<in> Exec \\<and> k = Suc (max n m))\"\napply (erule eval_cases, simp_all)\napply (rule disjI2)\n  apply clarsimp\n  apply (rule, rule, rule, rule) apply (rule, rule, rule) apply assumption\n  apply (rule, assumption) apply simp\ndone\n\nlemma InstrElimNext:\n \"\\<lbrakk>(M, l, s, n, ll, t) \\<in> Step;\n   get_ins M l = Some I;\n   I = const c \\<or> I = dup \\<or> I = pop \\<or> I = swap \\<or> I = load x \\<or>\n   I = store x \\<or> I = binop f \\<or> I = unop g \\<or> I = new d \\<or>\n   I = getfield d F \\<or> I = putfield d F \\<or> I = checkcast d\\<rbrakk>\n  \\<Longrightarrow> ll = l+1\"\napply (drule eval_cases, simp_all)\napply clarsimp \napply clarsimp\ndone\n(*>*)\n\ntext\\<open>By induction on the derivation system one can show\ndeterminism.\\<close>\n\n(*<*)\nlemma StepExec_determ_Aux[rule_format]:\n\"(\\<forall> n1 l M s l1 t . n1 \\<le> n \\<longrightarrow> (M, l, s, n1, l1, t) \\<in> Step \\<longrightarrow>\n       (\\<forall> n2 l2 r. (M,l,s,n2,l2,r):Step \\<longrightarrow> (n1=n2 \\<and> t=r \\<and> l1=l2))) \\<and>\n (\\<forall> n1 l M s h v . n1 \\<le> n \\<longrightarrow> (M, l, s, n1, h, v) \\<in> Exec \\<longrightarrow>\n      (\\<forall> n2 k w . (M,l,s,n2,k,w):Exec \\<longrightarrow> (n1=n2 \\<and> h=k \\<and> v=w)))\"\napply (induct n)\napply clarsimp apply rule apply clarsimp apply (drule no_zero_height_Step_derivs1, simp)\n   apply clarsimp apply (drule no_zero_height_Exec_derivs1, simp)\napply clarsimp\napply rule\n  apply clarsimp \napply (erule Step.cases)\n  apply clarsimp apply (drule ConstElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule DupElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule PopElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule SwapElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule LoadElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule StoreElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule BinopElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule UnopElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule NewElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule GetElim1) apply fastforce apply clarsimp\n  apply clarsimp apply (drule PutElim1) apply fastforce apply clarsimp\n  apply clarsimp apply (drule CastElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule GotoElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule IfElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule IfElim1) apply simp apply clarsimp\n  apply clarsimp apply (drule InvokeElim1) apply simp apply clarsimp\n    apply (erule thin_rl)\n    apply (simp add: mbody_is_def, clarsimp)\n    apply (drule Frame_deterministic, assumption, clarsimp)\napply clarsimp\n  apply (erule Exec.cases)\n  apply clarsimp apply (erule Exec.cases)\n    apply clarsimp\n    apply clarsimp apply (drule RetElim1, simp, simp)\n  apply clarsimp apply (drule ExecElim1)\n    apply clarsimp\n    apply (erule disjE, clarsimp) apply (drule RetElim1, simp, simp)\n    apply clarsimp\n      apply (erule_tac x=na in allE, rotate_tac -1, clarsimp)\n      apply (erule_tac x=la in allE, rotate_tac -1)\n      apply (erule_tac x=ad in allE, rotate_tac -1)\n      apply (erule_tac x=ae in allE, rotate_tac -1)\n      apply (erule_tac x=bb in allE, rotate_tac -1)\n      apply (erule_tac x=af in allE, rotate_tac -1)\n      apply (erule_tac x=ag in allE, rotate_tac -1)\n      apply (erule_tac x=bc in allE, rotate_tac -1)\n      apply (erule_tac x=ll in allE, rotate_tac -1)\n      apply (erule_tac x=ah in allE, rotate_tac -1)\n      apply (erule_tac x=ai in allE, rotate_tac -1)\n      apply (erule_tac x=bd in allE, clarsimp)\n      apply (rotate_tac -1)\n      apply (erule_tac x=nb in allE, rotate_tac -1) \n      apply (erule_tac x=lla in allE, rotate_tac -1)\n      apply (erule_tac x=a in allE, rotate_tac -1)\n      apply (erule_tac x=aa in allE, rotate_tac -1)\n      apply (erule_tac x=b in allE, clarsimp)\n      apply (erule_tac x=m in allE, rotate_tac -1, clarsimp)\n      apply (erule_tac x=lla in allE, rotate_tac -1)\n      apply (erule_tac x=ad in allE, rotate_tac -1)\n      apply (erule_tac x=ae in allE, rotate_tac -1)\n      apply (erule_tac x=bb in allE, rotate_tac -1)\n      apply (erule_tac x=a in allE, rotate_tac -1)\n      apply (erule_tac x=aa in allE, rotate_tac -1)\n      apply (erule_tac x=b in allE, rotate_tac -1)\n      apply (erule_tac x=ha in allE, rotate_tac -1)\n      apply (erule_tac x=va in allE, rotate_tac -1, clarsimp)\ndone\n(*>*)\n\nlemma Step_determ:\n \"\\<lbrakk>(M,l,s,n,l1,t) \\<in> Step; (M,l,s,m,l2,r):Step\\<rbrakk> \\<Longrightarrow> n=m \\<and> t=r \\<and> l1=l2\"\n(*<*)\napply (insert StepExec_determ_Aux[of n])\napply (erule conjE)\napply (rotate_tac -1, erule thin_rl)\napply fast\ndone\n(*>*)\n\nlemma Exec_determ:\n \"\\<lbrakk>(M,l,s,n,h,v) \\<in> Exec; (M,l,s,m,k,w):Exec\\<rbrakk> \\<Longrightarrow> n=m \\<and> h=k \\<and> v=w\"\n(*<*)\napply (insert StepExec_determ_Aux[of n])\napply (erule conjE)\napply (rotate_tac -2, erule thin_rl)\napply fast\ndone\n(*>*)\n\n(*<*)\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BytecodeLogicJmlTypes/Language.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665999540697, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.3009631310186936}}
{"text": "(*  Title:      HOL/Auth/n_mutualExDeadFree.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_mutualExDeadFree Protocol Case Study*} \n\ntheory n_mutualExDeadFree imports n_mutualExDeadFree_lemma_invs_on_rules n_mutualExDeadFree_on_inis\nbegin\nlemma main:\nassumes a1: \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\nand a2: \"0 < N\"\nshows \"\\<forall> f. f \\<in> (invariants N) --> formEval f s\"\nproof (rule consistentLemma)\nshow \"consistent (invariants N) {andList (allInitSpecs N)} (rules N)\"\nproof (cut_tac a1, unfold consistent_def, rule conjI)\nshow \"\\<forall> f ini s. f \\<in> (invariants N) --> ini \\<in> {andList (allInitSpecs N)} --> formEval ini s --> formEval f s\"\nproof ((rule allI)+, (rule impI)+)\n  fix f ini s\n  assume b1: \"f \\<in> (invariants N)\" and b2: \"ini \\<in> {andList (allInitSpecs N)}\" and b3: \"formEval ini s\"\n  have b4: \"formEval (andList (allInitSpecs N)) s\"\n  apply (cut_tac b2 b3, simp) done\n  show \"formEval f s\"\n  apply (rule on_inis, cut_tac b1, assumption, cut_tac b2, assumption, cut_tac b3, assumption) done\nqed\nnext show \"\\<forall> f r s. f \\<in> invariants N --> r \\<in> rules N --> invHoldForRule s f r (invariants N)\"\nproof ((rule allI)+, (rule impI)+)\n  fix f r s\n  assume b1: \"f \\<in> invariants N\" and b2: \"r \\<in> rules N\"\n  show \"invHoldForRule s f r (invariants N)\"\n  apply (rule invs_on_rules, cut_tac b1, assumption, cut_tac b2, assumption) done\nqed\nqed\nnext show \"s \\<in> reachableSet {andList (allInitSpecs N)} (rules N)\"\n  apply (metis a1) done\nqed\nend\n", "meta": {"author": "hongjianjiang", "repo": "paraverif_dafny", "sha": "083d86afb46a847783cb9319d975b3c2ad0afe93", "save_path": "github-repos/isabelle/hongjianjiang-paraverif_dafny", "path": "github-repos/isabelle/hongjianjiang-paraverif_dafny/paraverif_dafny-083d86afb46a847783cb9319d975b3c2ad0afe93/examples/n_mutualExDeadFree/n_mutualExDeadFree.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5926665855647394, "lm_q2_score": 0.5078118642792044, "lm_q1q2_score": 0.30096312371162093}}
{"text": "(*  Title:      ZF/UNITY/Mutex.thy\n    Author:     Sidi O Ehmety, Computer Laboratory\n    Copyright   2001  University of Cambridge\n\nBased on \"A Family of 2-Process Mutual Exclusion Algorithms\" by J Misra.\n\nVariables' types are introduced globally so that type verification\nreduces to the usual ZF typechecking \\<in> an ill-tyed expression will\nreduce to the empty set.\n*)\n\nsection{*Mutual Exclusion*}\n\ntheory Mutex\nimports SubstAx\nbegin\n\ntext{*Based on \"A Family of 2-Process Mutual Exclusion Algorithms\" by J Misra\n\nVariables' types are introduced globally so that type verification reduces to\nthe usual ZF typechecking: an ill-tyed expressions reduce to the empty set.\n*}\n\nabbreviation \"p == Var([0])\"\nabbreviation \"m == Var([1])\"\nabbreviation \"n == Var([0,0])\"\nabbreviation \"u == Var([0,1])\"\nabbreviation \"v == Var([1,0])\"\n\naxiomatization where --{** Type declarations  **}\n  p_type:  \"type_of(p)=bool & default_val(p)=0\" and\n  m_type:  \"type_of(m)=int  & default_val(m)=#0\" and\n  n_type:  \"type_of(n)=int  & default_val(n)=#0\" and\n  u_type:  \"type_of(u)=bool & default_val(u)=0\" and\n  v_type:  \"type_of(v)=bool & default_val(v)=0\"\n\ndefinition\n  (** The program for process U **)\n  \"U0 == {<s,t>:state*state. t = s(u:=1, m:=#1) & s`m = #0}\"\n\ndefinition\n  \"U1 == {<s,t>:state*state. t = s(p:= s`v, m:=#2) &  s`m = #1}\"\n\ndefinition\n  \"U2 == {<s,t>:state*state. t = s(m:=#3) & s`p=0 & s`m = #2}\"\n\ndefinition\n  \"U3 == {<s,t>:state*state. t=s(u:=0, m:=#4) & s`m = #3}\"\n\ndefinition\n  \"U4 == {<s,t>:state*state. t = s(p:=1, m:=#0) & s`m = #4}\"\n\n\n   (** The program for process V **)\n\ndefinition\n  \"V0 == {<s,t>:state*state. t = s (v:=1, n:=#1) & s`n = #0}\"\n\ndefinition\n  \"V1 == {<s,t>:state*state. t = s(p:=not(s`u), n:=#2) & s`n = #1}\"\n\ndefinition\n  \"V2 == {<s,t>:state*state. t  = s(n:=#3) & s`p=1 & s`n = #2}\"\n\ndefinition\n  \"V3 == {<s,t>:state*state. t = s (v:=0, n:=#4) & s`n = #3}\"\n\ndefinition\n  \"V4 == {<s,t>:state*state. t  = s (p:=0, n:=#0) & s`n = #4}\"\n\ndefinition\n  \"Mutex == mk_program({s:state. s`u=0 & s`v=0 & s`m = #0 & s`n = #0},\n              {U0, U1, U2, U3, U4, V0, V1, V2, V3, V4}, Pow(state*state))\"\n\n  (** The correct invariants **)\n\ndefinition\n  \"IU == {s:state. (s`u = 1\\<longleftrightarrow>(#1 $<= s`m & s`m $<= #3))\n                     & (s`m = #3 \\<longrightarrow> s`p=0)}\"\n\ndefinition\n  \"IV == {s:state. (s`v = 1 \\<longleftrightarrow> (#1 $<= s`n & s`n $<= #3))\n                      & (s`n = #3 \\<longrightarrow> s`p=1)}\"\n\n  (** The faulty invariant (for U alone) **)\n\ndefinition\n  \"bad_IU == {s:state. (s`u = 1 \\<longleftrightarrow> (#1 $<= s`m & s`m  $<= #3))&\n                   (#3 $<= s`m & s`m $<= #4 \\<longrightarrow> s`p=0)}\"\n\n\n(** Variables' types **)\n\ndeclare p_type [simp] u_type [simp] v_type [simp] m_type [simp] n_type [simp]\n\nlemma u_value_type: \"s \\<in> state ==>s`u \\<in> bool\"\napply (unfold state_def)\napply (drule_tac a = u in apply_type, auto)\ndone\n\nlemma v_value_type: \"s \\<in> state ==> s`v \\<in> bool\"\napply (unfold state_def)\napply (drule_tac a = v in apply_type, auto)\ndone\n\nlemma p_value_type: \"s \\<in> state ==> s`p \\<in> bool\"\napply (unfold state_def)\napply (drule_tac a = p in apply_type, auto)\ndone\n\nlemma m_value_type: \"s \\<in> state ==> s`m \\<in> int\"\napply (unfold state_def)\napply (drule_tac a = m in apply_type, auto)\ndone\n\nlemma n_value_type: \"s \\<in> state ==>s`n \\<in> int\"\napply (unfold state_def)\napply (drule_tac a = n in apply_type, auto)\ndone\n\ndeclare p_value_type [simp] u_value_type [simp] v_value_type [simp]\n        m_value_type [simp] n_value_type [simp]\n\ndeclare p_value_type [TC] u_value_type [TC] v_value_type [TC]\n        m_value_type [TC] n_value_type [TC]\n\n\n\ntext{*Mutex is a program*}\n\nlemma Mutex_in_program [simp,TC]: \"Mutex \\<in> program\"\nby (simp add: Mutex_def)\n\n\ndeclare Mutex_def [THEN def_prg_Init, simp]\ndeclare Mutex_def [program]\n\ndeclare  U0_def [THEN def_act_simp, simp]\ndeclare  U1_def [THEN def_act_simp, simp]\ndeclare  U2_def [THEN def_act_simp, simp]\ndeclare  U3_def [THEN def_act_simp, simp]\ndeclare  U4_def [THEN def_act_simp, simp]\n\ndeclare  V0_def [THEN def_act_simp, simp]\ndeclare  V1_def [THEN def_act_simp, simp]\ndeclare  V2_def [THEN def_act_simp, simp]\ndeclare  V3_def [THEN def_act_simp, simp]\ndeclare  V4_def [THEN def_act_simp, simp]\n\ndeclare  U0_def [THEN def_set_simp, simp]\ndeclare  U1_def [THEN def_set_simp, simp]\ndeclare  U2_def [THEN def_set_simp, simp]\ndeclare  U3_def [THEN def_set_simp, simp]\ndeclare  U4_def [THEN def_set_simp, simp]\n\ndeclare  V0_def [THEN def_set_simp, simp]\ndeclare  V1_def [THEN def_set_simp, simp]\ndeclare  V2_def [THEN def_set_simp, simp]\ndeclare  V3_def [THEN def_set_simp, simp]\ndeclare  V4_def [THEN def_set_simp, simp]\n\ndeclare  IU_def [THEN def_set_simp, simp]\ndeclare  IV_def [THEN def_set_simp, simp]\ndeclare  bad_IU_def [THEN def_set_simp, simp]\n\nlemma IU: \"Mutex \\<in> Always(IU)\"\napply (rule AlwaysI, force)\napply (unfold Mutex_def, safety, auto)\ndone\n\nlemma IV: \"Mutex \\<in> Always(IV)\"\napply (rule AlwaysI, force)\napply (unfold Mutex_def, safety)\ndone\n\n(*The safety property: mutual exclusion*)\nlemma mutual_exclusion: \"Mutex \\<in> Always({s \\<in> state. ~(s`m = #3 & s`n = #3)})\"\napply (rule Always_weaken)\napply (rule Always_Int_I [OF IU IV], auto)\ndone\n\n(*The bad invariant FAILS in V1*)\n\nlemma less_lemma: \"[| x$<#1; #3 $<= x |] ==> P\"\napply (drule_tac j = \"#1\" and k = \"#3\" in zless_zle_trans)\napply (drule_tac [2] j = x in zle_zless_trans, auto)\ndone\n\nlemma \"Mutex \\<in> Always(bad_IU)\"\napply (rule AlwaysI, force)\napply (unfold Mutex_def, safety, auto)\napply (subgoal_tac \"#1 $<= #3\")\napply (drule_tac x = \"#1\" and y = \"#3\" in zle_trans, auto)\napply (simp (no_asm) add: not_zless_iff_zle [THEN iff_sym])\napply auto\n(*Resulting state: n=1, p=false, m=4, u=false.\n  Execution of V1 (the command of process v guarded by n=1) sets p:=true,\n  violating the invariant!*)\noops\n\n\n\n(*** Progress for U ***)\n\nlemma U_F0: \"Mutex \\<in> {s \\<in> state. s`m=#2} Unless {s \\<in> state. s`m=#3}\"\nby (unfold op_Unless_def Mutex_def, safety)\n\nlemma U_F1:\n     \"Mutex \\<in> {s \\<in> state. s`m=#1} LeadsTo {s \\<in> state. s`p = s`v & s`m = #2}\"\nby (unfold Mutex_def, ensures U1)\n\nlemma U_F2: \"Mutex \\<in> {s \\<in> state. s`p =0 & s`m = #2} LeadsTo {s \\<in> state. s`m = #3}\"\napply (cut_tac IU)\napply (unfold Mutex_def, ensures U2)\ndone\n\nlemma U_F3: \"Mutex \\<in> {s \\<in> state. s`m = #3} LeadsTo {s \\<in> state. s`p=1}\"\napply (rule_tac B = \"{s \\<in> state. s`m = #4}\" in LeadsTo_Trans)\n apply (unfold Mutex_def)\n apply (ensures U3)\napply (ensures U4)\ndone\n\n\nlemma U_lemma2: \"Mutex \\<in> {s \\<in> state. s`m = #2} LeadsTo {s \\<in> state. s`p=1}\"\napply (rule LeadsTo_Diff [OF LeadsTo_weaken_L\n                             Int_lower2 [THEN subset_imp_LeadsTo]])\napply (rule LeadsTo_Trans [OF U_F2 U_F3], auto)\napply (auto dest!: p_value_type simp add: bool_def)\ndone\n\nlemma U_lemma1: \"Mutex \\<in> {s \\<in> state. s`m = #1} LeadsTo {s \\<in> state. s`p =1}\"\nby (rule LeadsTo_Trans [OF U_F1 [THEN LeadsTo_weaken_R] U_lemma2], blast)\n\nlemma eq_123: \"i \\<in> int ==> (#1 $<= i & i $<= #3) \\<longleftrightarrow> (i=#1 | i=#2 | i=#3)\"\napply auto\napply (auto simp add: neq_iff_zless)\napply (drule_tac [4] j = \"#3\" and i = i in zle_zless_trans)\napply (drule_tac [2] j = i and i = \"#1\" in zle_zless_trans)\napply (drule_tac j = i and i = \"#1\" in zle_zless_trans, auto)\napply (rule zle_anti_sym)\napply (simp_all (no_asm_simp) add: zless_add1_iff_zle [THEN iff_sym])\ndone\n\n\nlemma U_lemma123: \"Mutex \\<in> {s \\<in> state. #1 $<= s`m & s`m $<= #3} LeadsTo {s \\<in> state. s`p=1}\"\nby (simp add: eq_123 Collect_disj_eq LeadsTo_Un_distrib U_lemma1 U_lemma2 U_F3)\n\n\n(*Misra's F4*)\nlemma u_Leadsto_p: \"Mutex \\<in> {s \\<in> state. s`u = 1} LeadsTo {s \\<in> state. s`p=1}\"\nby (rule Always_LeadsTo_weaken [OF IU U_lemma123], auto)\n\n\n(*** Progress for V ***)\n\nlemma V_F0: \"Mutex \\<in> {s \\<in> state. s`n=#2} Unless {s \\<in> state. s`n=#3}\"\nby (unfold op_Unless_def Mutex_def, safety)\n\nlemma V_F1: \"Mutex \\<in> {s \\<in> state. s`n=#1} LeadsTo {s \\<in> state. s`p = not(s`u) & s`n = #2}\"\nby (unfold Mutex_def, ensures \"V1\")\n\nlemma V_F2: \"Mutex \\<in> {s \\<in> state. s`p=1 & s`n = #2} LeadsTo {s \\<in> state. s`n = #3}\"\napply (cut_tac IV)\napply (unfold Mutex_def, ensures \"V2\")\ndone\n\nlemma V_F3: \"Mutex \\<in> {s \\<in> state. s`n = #3} LeadsTo {s \\<in> state. s`p=0}\"\napply (rule_tac B = \"{s \\<in> state. s`n = #4}\" in LeadsTo_Trans)\n apply (unfold Mutex_def)\n apply (ensures V3)\napply (ensures V4)\ndone\n\nlemma V_lemma2: \"Mutex \\<in> {s \\<in> state. s`n = #2} LeadsTo {s \\<in> state. s`p=0}\"\napply (rule LeadsTo_Diff [OF LeadsTo_weaken_L\n                             Int_lower2 [THEN subset_imp_LeadsTo]])\napply (rule LeadsTo_Trans [OF V_F2 V_F3], auto)\napply (auto dest!: p_value_type simp add: bool_def)\ndone\n\nlemma V_lemma1: \"Mutex \\<in> {s \\<in> state. s`n = #1} LeadsTo {s \\<in> state. s`p = 0}\"\nby (rule LeadsTo_Trans [OF V_F1 [THEN LeadsTo_weaken_R] V_lemma2], blast)\n\nlemma V_lemma123: \"Mutex \\<in> {s \\<in> state. #1 $<= s`n & s`n $<= #3} LeadsTo {s \\<in> state. s`p = 0}\"\nby (simp add: eq_123 Collect_disj_eq LeadsTo_Un_distrib V_lemma1 V_lemma2 V_F3)\n\n(*Misra's F4*)\nlemma v_Leadsto_not_p: \"Mutex \\<in> {s \\<in> state. s`v = 1} LeadsTo {s \\<in> state. s`p = 0}\"\nby (rule Always_LeadsTo_weaken [OF IV V_lemma123], auto)\n\n\n(** Absence of starvation **)\n\n(*Misra's F6*)\nlemma m1_Leadsto_3: \"Mutex \\<in> {s \\<in> state. s`m = #1} LeadsTo {s \\<in> state. s`m = #3}\"\napply (rule LeadsTo_cancel2 [THEN LeadsTo_Un_duplicate])\napply (rule_tac [2] U_F2)\napply (simp add: Collect_conj_eq)\napply (subst Un_commute)\napply (rule LeadsTo_cancel2 [THEN LeadsTo_Un_duplicate])\n apply (rule_tac [2] PSP_Unless [OF v_Leadsto_not_p U_F0])\napply (rule U_F1 [THEN LeadsTo_weaken_R], auto)\napply (auto dest!: v_value_type simp add: bool_def)\ndone\n\n\n(*The same for V*)\nlemma n1_Leadsto_3: \"Mutex \\<in> {s \\<in> state. s`n = #1} LeadsTo {s \\<in> state. s`n = #3}\"\napply (rule LeadsTo_cancel2 [THEN LeadsTo_Un_duplicate])\napply (rule_tac [2] V_F2)\napply (simp add: Collect_conj_eq)\napply (subst Un_commute)\napply (rule LeadsTo_cancel2 [THEN LeadsTo_Un_duplicate])\n apply (rule_tac [2] PSP_Unless [OF u_Leadsto_p V_F0])\napply (rule V_F1 [THEN LeadsTo_weaken_R], auto)\napply (auto dest!: u_value_type simp add: bool_def)\ndone\n\nend", "meta": {"author": "Josh-Tilles", "repo": "isabelle", "sha": "990accf749b8a6e037d25012258ecae20d59ca62", "save_path": "github-repos/isabelle/Josh-Tilles-isabelle", "path": "github-repos/isabelle/Josh-Tilles-isabelle/isabelle-990accf749b8a6e037d25012258ecae20d59ca62/src/ZF/UNITY/Mutex.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3009288816037545}}
{"text": "header {* \\isaheader{Transfer between Domains} *}\ntheory RefineG_Transfer\nimports \"../Refine_Misc\"\nbegin\n  text {* Currently, this theory is specialized to \n    transfers that include no data refinement.\n    *}\n\n\ndefinition \"REFINEG_TRANSFER_POST_SIMP x y \\<equiv> x=y\"\ndefinition [simp]: \"REFINEG_TRANSFER_ALIGN x y == True\"\nlemma REFINEG_TRANSFER_ALIGNI: \"REFINEG_TRANSFER_ALIGN x y\" by simp\n\nlemma START_REFINEG_TRANSFER: \n  assumes \"REFINEG_TRANSFER_ALIGN d c\"\n  assumes \"c\\<le>a\"\n  assumes \"REFINEG_TRANSFER_POST_SIMP c d\"\n  shows \"d\\<le>a\"\n  using assms\n  by (simp add: REFINEG_TRANSFER_POST_SIMP_def)\n\nlemma STOP_REFINEG_TRANSFER: \"REFINEG_TRANSFER_POST_SIMP c c\" \n  unfolding REFINEG_TRANSFER_POST_SIMP_def ..\n\nML {*\nstructure RefineG_Transfer = struct\n\n  structure Post_Processors = Theory_Data (\n    type T = (Proof.context -> tactic') Symtab.table\n    val empty = Symtab.empty\n    val extend = I\n    val merge = Symtab.join (K snd)\n  )\n\n  fun add_post_processor name tac =\n    Post_Processors.map (Symtab.update_new (name,tac))\n  fun delete_post_processor name =\n    Post_Processors.map (Symtab.delete name)\n  val get_post_processors = Post_Processors.get #> Symtab.dest\n\n  fun post_process_tac ctxt = let\n    val tacs = get_post_processors (Proof_Context.theory_of ctxt)\n      |> map (fn (_,tac) => tac ctxt)\n\n    val tac = REPEAT_DETERM' (CHANGED o EVERY' (map (fn t => TRY o t) tacs))\n  in\n    tac\n  end\n\n  structure Post_Simp = Generic_Data (\n      type T = simpset\n      val empty = HOL_basic_ss\n      val extend = I\n      val merge = Raw_Simplifier.merge_ss\n  )\n\n  fun post_simps_op f a context = let\n    val ctxt = Context.proof_of context\n    fun do_it ss = simpset_of (f (put_simpset ss ctxt, a))\n  in\n    Post_Simp.map do_it context\n  end\n    \n  val add_post_simps = post_simps_op (op addsimps)\n  val del_post_simps = post_simps_op (op delsimps)\n\n  fun get_post_ss ctxt = let\n    val ss = Post_Simp.get (Context.Proof ctxt)\n    val ctxt = put_simpset ss ctxt\n  in\n    ctxt\n  end\n\n  structure post_subst = Named_Thms\n    ( val name = @{binding refine_transfer_post_subst}\n      val description = \"Refinement Framework: \" ^ \n        \"Transfer postprocessing substitutions\" );\n\n  fun post_subst_tac ctxt = let\n    val s_thms = post_subst.get ctxt\n    val dis_tac = (ALLGOALS (Tagged_Solver.solve_tac ctxt))\n    val cnv = Cond_Rewr_Conv.cond_rewrs_conv dis_tac s_thms\n    val ts_conv = Conv.top_sweep_conv cnv ctxt\n    val ss = get_post_ss ctxt\n  in\n    REPEAT o CHANGED o \n    (Simplifier.simp_tac ss THEN' CONVERSION ts_conv)\n  end\n\n\n  structure transfer = Named_Thms\n    ( val name = @{binding refine_transfer}\n      val description = \"Refinement Framework: \" ^ \n        \"Transfer rules\" );\n\n  fun transfer_tac thms ctxt i st = let \n    val thms = thms @ transfer.get ctxt;\n    val ss = put_simpset HOL_basic_ss ctxt addsimps @{thms nested_prod_case_simp}\n  in\n    REPEAT_DETERM1 (\n      COND (has_fewer_prems (nprems_of st)) no_tac (\n        FIRST [\n          Method.assm_tac ctxt i,\n          resolve_tac thms i,\n          Tagged_Solver.solve_tac ctxt i,\n          CHANGED_PROP (simp_tac ss i)]\n      )) st\n  end\n\n  (* Adjust right term to have same structure as left one *)\n  val align_tac = IF_EXGOAL (fn i => fn st =>\n    case Logic.concl_of_goal (prop_of st) i of\n      @{mpat \"Trueprop (REFINEG_TRANSFER_ALIGN ?c _)\"} => let\n        val thy = theory_of_thm st\n        val c = cterm_of thy c\n        val cT = ctyp_of_term c\n        \n        val rl = @{thm REFINEG_TRANSFER_ALIGNI}\n          |> Thm.incr_indexes (Thm.maxidx_of st + 1)\n          |> instantiate' [NONE,SOME cT] [NONE,SOME c]\n        (*val _ = tracing (@{make_string} rl)*)\n      in\n        rtac rl i st\n      end\n    | _ => Seq.empty\n  )\n\n  fun post_transfer_tac thms ctxt = let open Autoref_Tacticals in\n    rtac @{thm START_REFINEG_TRANSFER} \n    THEN' align_tac \n    THEN' IF_SOLVED (transfer_tac thms ctxt)\n      (post_process_tac ctxt THEN' rtac @{thm STOP_REFINEG_TRANSFER})\n      (K all_tac)\n\n  end\n\n  fun get_post_simp_rules context = Context.proof_of context\n      |> get_post_ss\n      |> simpset_of \n      |> Raw_Simplifier.dest_ss\n      |> #simps |> map snd\n\n\n  local\n    val add_ps = Thm.declaration_attribute (add_post_simps o single)\n    val del_ps = Thm.declaration_attribute (del_post_simps o single)\n  in\n    val setup = I\n      #> add_post_processor \"RefineG_Transfer.post_subst\" post_subst_tac\n      #> post_subst.setup\n      #> transfer.setup\n      #> Attrib.setup @{binding refine_transfer_post_simp} \n          (Attrib.add_del add_ps del_ps) \n          (\"declaration of transfer post simplification rules\")\n      #> Global_Theory.add_thms_dynamic (\n           @{binding refine_transfer_post_simps}, get_post_simp_rules)\n\n  end\nend\n*}\n\nsetup {* RefineG_Transfer.setup *}\nmethod_setup refine_transfer = \n  {* Scan.lift (Args.mode \"post\") -- Attrib.thms \n  >> (fn (post,thms) => fn ctxt => SIMPLE_METHOD'\n    ( if post then RefineG_Transfer.post_transfer_tac thms ctxt\n      else RefineG_Transfer.transfer_tac thms ctxt))\n  *} \"Invoke transfer rules\"\n\n\nlocale transfer = fixes \\<alpha> :: \"'c \\<Rightarrow> 'a::complete_lattice\"\nbegin\n\ntext {*\n  In the following, we define some transfer lemmas for general\n  HOL - constructs.\n*}\n\nlemma transfer_if[refine_transfer]:\n  assumes \"b \\<Longrightarrow> \\<alpha> s1 \\<le> S1\"\n  assumes \"\\<not>b \\<Longrightarrow> \\<alpha> s2 \\<le> S2\"\n  shows \"\\<alpha> (if b then s1 else s2) \\<le> (if b then S1 else S2)\"\n  using assms by auto\n\nlemma transfer_prod[refine_transfer]:\n  assumes \"\\<And>a b. \\<alpha> (f a b) \\<le> F a b\"\n  shows \"\\<alpha> (case_prod f x) \\<le> (case_prod F x)\"\n  using assms by (auto split: prod.split)\n\nlemma transfer_Let[refine_transfer]:\n  assumes \"\\<And>x. \\<alpha> (f x) \\<le> F x\"\n  shows \"\\<alpha> (Let x f) \\<le> Let x F\"\n  using assms by auto\n\nlemma transfer_option[refine_transfer]:\n  assumes \"\\<alpha> fa \\<le> Fa\"\n  assumes \"\\<And>x. \\<alpha> (fb x) \\<le> Fb x\"\n  shows \"\\<alpha> (case_option fa fb x) \\<le> case_option Fa Fb x\"\n  using assms by (auto split: option.split)\n\nlemma transfer_list[refine_transfer]:\n  assumes \"\\<alpha> fn \\<le> Fn\"\n  assumes \"\\<And>x xs. \\<alpha> (fc x xs) \\<le> Fc x xs\"\n  shows \"\\<alpha> (case_list fn fc l) \\<le> case_list Fn Fc l\"\n  using assms by (auto split: list.split)\n\n\nlemma transfer_rec_list[refine_transfer]:\n  assumes FN: \"\\<And>s. \\<alpha> (fn s) \\<le> fn' s\"\n  assumes FC: \"\\<And>x l rec rec' s. \\<lbrakk> \\<And>s. \\<alpha> (rec s) \\<le> (rec' s) \\<rbrakk> \n    \\<Longrightarrow> \\<alpha> (fc x l rec s) \\<le> fc' x l rec' s\"\n  shows \"\\<alpha> (rec_list fn fc l s) \\<le> rec_list fn' fc' l s\"\n  apply (induct l arbitrary: s)\n  apply (simp add: FN)\n  apply (simp add: FC)\n  done\n\n\n\nend\n\ntext {* Transfer into complete lattice structure *}\nlocale ordered_transfer = transfer + \n  constrains \\<alpha> :: \"'c::complete_lattice \\<Rightarrow> 'a::complete_lattice\"\n\ntext {* Transfer into complete lattice structure with distributive\n  transfer function. *}\nlocale dist_transfer = ordered_transfer + \n  constrains \\<alpha> :: \"'c::complete_lattice \\<Rightarrow> 'a::complete_lattice\"\n  assumes \\<alpha>_dist: \"\\<And>A. is_chain A \\<Longrightarrow> \\<alpha> (Sup A) = Sup (\\<alpha>`A)\"\nbegin\n  lemma \\<alpha>_mono[simp, intro!]: \"mono \\<alpha>\"\n    apply rule\n    apply (subgoal_tac \"is_chain {x,y}\")\n    apply (drule \\<alpha>_dist)\n    apply (auto simp: le_iff_sup) []\n    apply (rule chainI)\n    apply auto\n    done\n\n  lemma \\<alpha>_strict[simp]: \"\\<alpha> bot = bot\"\n    using \\<alpha>_dist[of \"{}\"] by simp\nend\n\n\ntext {* Transfer into ccpo *}\nlocale ccpo_transfer = transfer \\<alpha> for\n  \\<alpha> :: \"'c::ccpo \\<Rightarrow> 'a::complete_lattice\" \n\ntext {* Transfer into ccpo with distributive\n  transfer function. *}\nlocale dist_ccpo_transfer = ccpo_transfer \\<alpha>\n  for \\<alpha> :: \"'c::ccpo \\<Rightarrow> 'a::complete_lattice\" + \n  assumes \\<alpha>_dist: \"\\<And>A. is_chain A \\<Longrightarrow> \\<alpha> (Sup A) = Sup (\\<alpha>`A)\"\nbegin\n\n  lemma \\<alpha>_mono[simp, intro!]: \"mono \\<alpha>\"\n  proof\n    fix x y :: 'c\n    assume LE: \"x\\<le>y\"\n    hence C[simp, intro!]: \"is_chain {x,y}\" by (auto intro: chainI)\n    from LE have \"\\<alpha> x \\<le> sup (\\<alpha> x) (\\<alpha> y)\" by simp\n    also have \"\\<dots> = Sup (\\<alpha>`{x,y})\" by simp\n    also have \"\\<dots> = \\<alpha> (Sup {x,y})\"\n      by (rule \\<alpha>_dist[symmetric]) simp\n    also have \"Sup {x,y} = y\"\n      apply (rule antisym)\n      apply (rule ccpo_Sup_least[OF C]) using LE apply auto []\n      apply (rule ccpo_Sup_upper[OF C]) by auto\n    finally show \"\\<alpha> x \\<le> \\<alpha> y\" .\n  qed\n\n  lemma \\<alpha>_strict[simp]: \"\\<alpha> (Sup {}) = bot\"\n    using \\<alpha>_dist[of \"{}\"] by simp\nend\n\nend\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/Refine_Monadic/Generic/RefineG_Transfer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5583269943353745, "lm_q2_score": 0.5389832206876841, "lm_q1q2_score": 0.3009288816037545}}
{"text": "(*  Title:      HOL/Imperative_HOL/Ref.thy\n    Author:     John Matthews, Galois Connections; Alexander Krauss, Lukas Bulwahn & Florian Haftmann, TU Muenchen\n*)\n\nsection \\<open>Monadic references\\<close>\n\ntheory Ref\nimports Array\nbegin\n\ntext \\<open>\n  Imperative reference operations; modeled after their ML counterparts.\n  See \\<^url>\\<open>https://caml.inria.fr/pub/docs/manual-caml-light/node14.15.html\\<close>\n  and \\<^url>\\<open>https://www.smlnj.org/doc/Conversion/top-level-comparison.html\\<close>.\n\\<close>\n\nsubsection \\<open>Primitives\\<close>\n\ndefinition present :: \"heap \\<Rightarrow> 'a::heap ref \\<Rightarrow> bool\" where\n  \"present h r \\<longleftrightarrow> addr_of_ref r < lim h\"\n\ndefinition get :: \"heap \\<Rightarrow> 'a::heap ref \\<Rightarrow> 'a\" where\n  \"get h = from_nat \\<circ> refs h TYPEREP('a) \\<circ> addr_of_ref\"\n\ndefinition set :: \"'a::heap ref \\<Rightarrow> 'a \\<Rightarrow> heap \\<Rightarrow> heap\" where\n  \"set r x = refs_update\n    (\\<lambda>h. h(TYPEREP('a) := ((h (TYPEREP('a))) (addr_of_ref r := to_nat x))))\"\n\ndefinition alloc :: \"'a \\<Rightarrow> heap \\<Rightarrow> 'a::heap ref \\<times> heap\" where\n  \"alloc x h = (let\n     l = lim h;\n     r = Ref l\n   in (r, set r x (h\\<lparr>lim := l + 1\\<rparr>)))\"\n\ndefinition noteq :: \"'a::heap ref \\<Rightarrow> 'b::heap ref \\<Rightarrow> bool\" (infix \"=!=\" 70) where\n  \"r =!= s \\<longleftrightarrow> TYPEREP('a) \\<noteq> TYPEREP('b) \\<or> addr_of_ref r \\<noteq> addr_of_ref s\"\n\n\nsubsection \\<open>Monad operations\\<close>\n\ndefinition ref :: \"'a::heap \\<Rightarrow> 'a ref Heap\" where\n  [code del]: \"ref v = Heap_Monad.heap (alloc v)\"\n\ndefinition lookup :: \"'a::heap ref \\<Rightarrow> 'a Heap\" (\"!_\" 61) where\n  [code del]: \"lookup r = Heap_Monad.tap (\\<lambda>h. get h r)\"\n\ndefinition update :: \"'a ref \\<Rightarrow> 'a::heap \\<Rightarrow> unit Heap\" (\"_ := _\" 62) where\n  [code del]: \"update r v = Heap_Monad.heap (\\<lambda>h. ((), set r v h))\"\n\ndefinition change :: \"('a::heap \\<Rightarrow> 'a) \\<Rightarrow> 'a ref \\<Rightarrow> 'a Heap\" where\n  \"change f r = do {\n     x \\<leftarrow> ! r;\n     let y = f x;\n     r := y;\n     return y\n   }\"\n\n\nsubsection \\<open>Properties\\<close>\n\ntext \\<open>Primitives\\<close>\n\nlemma noteq_sym: \"r =!= s \\<Longrightarrow> s =!= r\"\n  and unequal [simp]: \"r \\<noteq> r' \\<longleftrightarrow> r =!= r'\" \\<comment> \\<open>same types!\\<close>\n  by (auto simp add: noteq_def)\n\nlemma noteq_irrefl: \"r =!= r \\<Longrightarrow> False\"\n  by (auto simp add: noteq_def)\n\nlemma present_alloc_neq: \"present h r \\<Longrightarrow> r =!= fst (alloc v h)\"\n  by (simp add: present_def alloc_def noteq_def Let_def)\n\nlemma next_fresh [simp]:\n  assumes \"(r, h') = alloc x h\"\n  shows \"\\<not> present h r\"\n  using assms by (cases h) (auto simp add: alloc_def present_def Let_def)\n\nlemma next_present [simp]:\n  assumes \"(r, h') = alloc x h\"\n  shows \"present h' r\"\n  using assms by (cases h) (auto simp add: alloc_def set_def present_def Let_def)\n\nlemma get_set_eq [simp]:\n  \"get (set r x h) r = x\"\n  by (simp add: get_def set_def)\n\nlemma get_set_neq [simp]:\n  \"r =!= s \\<Longrightarrow> get (set s x h) r = get h r\"\n  by (simp add: noteq_def get_def set_def)\n\nlemma set_same [simp]:\n  \"set r x (set r y h) = set r x h\"\n  by (simp add: set_def)\n\nlemma not_present_alloc [simp]:\n  \"\\<not> present h (fst (alloc v h))\"\n  by (simp add: present_def alloc_def Let_def)\n\nlemma set_set_swap:\n  \"r =!= r' \\<Longrightarrow> set r x (set r' x' h) = set r' x' (set r x h)\"\n  by (simp add: noteq_def set_def fun_eq_iff)\n\nlemma alloc_set:\n  \"fst (alloc x (set r x' h)) = fst (alloc x h)\"\n  by (simp add: alloc_def set_def Let_def)\n\nlemma get_alloc [simp]:\n  \"get (snd (alloc x h)) (fst (alloc x' h)) = x\"\n  by (simp add: alloc_def Let_def)\n\nlemma set_alloc [simp]:\n  \"set (fst (alloc v h)) v' (snd (alloc v h)) = snd (alloc v' h)\"\n  by (simp add: alloc_def Let_def)\n\nlemma get_alloc_neq: \"r =!= fst (alloc v h) \\<Longrightarrow> \n  get (snd (alloc v h)) r  = get h r\"\n  by (simp add: get_def set_def alloc_def Let_def noteq_def)\n\nlemma lim_set [simp]:\n  \"lim (set r v h) = lim h\"\n  by (simp add: set_def)\n\nlemma present_alloc [simp]: \n  \"present h r \\<Longrightarrow> present (snd (alloc v h)) r\"\n  by (simp add: present_def alloc_def Let_def)\n\nlemma present_set [simp]:\n  \"present (set r v h) = present h\"\n  by (simp add: present_def fun_eq_iff)\n\nlemma noteq_I:\n  \"present h r \\<Longrightarrow> \\<not> present h r' \\<Longrightarrow> r =!= r'\"\n  by (auto simp add: noteq_def present_def)\n\n\ntext \\<open>Monad operations\\<close>\n\nlemma execute_ref [execute_simps]:\n  \"execute (ref v) h = Some (alloc v h)\"\n  by (simp add: ref_def execute_simps)\n\nlemma success_refI [success_intros]:\n  \"success (ref v) h\"\n  by (auto intro: success_intros simp add: ref_def)\n\nlemma effect_refI [effect_intros]:\n  assumes \"(r, h') = alloc v h\"\n  shows \"effect (ref v) h h' r\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_refE [effect_elims]:\n  assumes \"effect (ref v) h h' r\"\n  obtains \"get h' r = v\" and \"present h' r\" and \"\\<not> present h r\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_lookup [execute_simps]:\n  \"Heap_Monad.execute (lookup r) h = Some (get h r, h)\"\n  by (simp add: lookup_def execute_simps)\n\nlemma success_lookupI [success_intros]:\n  \"success (lookup r) h\"\n  by (auto intro: success_intros  simp add: lookup_def)\n\nlemma effect_lookupI [effect_intros]:\n  assumes \"h' = h\" \"x = get h r\"\n  shows \"effect (!r) h h' x\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_lookupE [effect_elims]:\n  assumes \"effect (!r) h h' x\"\n  obtains \"h' = h\" \"x = get h r\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_update [execute_simps]:\n  \"Heap_Monad.execute (update r v) h = Some ((), set r v h)\"\n  by (simp add: update_def execute_simps)\n\nlemma success_updateI [success_intros]:\n  \"success (update r v) h\"\n  by (auto intro: success_intros  simp add: update_def)\n\nlemma effect_updateI [effect_intros]:\n  assumes \"h' = set r v h\"\n  shows \"effect (r := v) h h' x\"\n  by (rule effectI) (insert assms, simp add: execute_simps)\n\nlemma effect_updateE [effect_elims]:\n  assumes \"effect (r' := v) h h' r\"\n  obtains \"h' = set r' v h\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma execute_change [execute_simps]:\n  \"Heap_Monad.execute (change f r) h = Some (f (get h r), set r (f (get h r)) h)\"\n  by (simp add: change_def bind_def Let_def execute_simps)\n\nlemma success_changeI [success_intros]:\n  \"success (change f r) h\"\n  by (auto intro!: success_intros effect_intros simp add: change_def)\n\nlemma effect_changeI [effect_intros]: \n  assumes \"h' = set r (f (get h r)) h\" \"x = f (get h r)\"\n  shows \"effect (change f r) h h' x\"\n  by (rule effectI) (insert assms, simp add: execute_simps)  \n\nlemma effect_changeE [effect_elims]:\n  assumes \"effect (change f r') h h' r\"\n  obtains \"h' = set r' (f (get h r')) h\" \"r = f (get h r')\"\n  using assms by (rule effectE) (simp add: execute_simps)\n\nlemma lookup_chain:\n  \"(!r \\<then> f) = f\"\n  by (rule Heap_eqI) (auto simp add: lookup_def execute_simps intro: execute_bind)\n\nlemma update_change [code]:\n  \"r := e = change (\\<lambda>_. e) r \\<then> return ()\"\n  by (rule Heap_eqI) (simp add: change_def lookup_chain)\n\n\ntext \\<open>Non-interaction between imperative arrays and imperative references\\<close>\n\nlemma array_get_set [simp]:\n  \"Array.get (set r v h) = Array.get h\"\n  by (simp add: Array.get_def set_def fun_eq_iff)\n\nlemma get_update [simp]:\n  \"get (Array.update a i v h) r = get h r\"\n  by (simp add: get_def Array.update_def Array.set_def)\n\nlemma alloc_update:\n  \"fst (alloc v (Array.update a i v' h)) = fst (alloc v h)\"\n  by (simp add: Array.update_def Array.get_def Array.set_def alloc_def Let_def)\n\nlemma update_set_swap:\n  \"Array.update a i v (set r v' h) = set r v' (Array.update a i v h)\"\n  by (simp add: Array.update_def Array.get_def Array.set_def set_def)\n\nlemma length_alloc [simp]: \n  \"Array.length (snd (alloc v h)) a = Array.length h a\"\n  by (simp add: Array.length_def Array.get_def alloc_def set_def Let_def)\n\nlemma array_get_alloc [simp]: \n  \"Array.get (snd (alloc v h)) = Array.get h\"\n  by (simp add: Array.get_def alloc_def set_def Let_def fun_eq_iff)\n\nlemma present_update [simp]: \n  \"present (Array.update a i v h) = present h\"\n  by (simp add: Array.update_def Array.set_def fun_eq_iff present_def)\n\nlemma array_present_set [simp]:\n  \"Array.present (set r v h) = Array.present h\"\n  by (simp add: Array.present_def set_def fun_eq_iff)\n\nlemma array_present_alloc [simp]:\n  \"Array.present h a \\<Longrightarrow> Array.present (snd (alloc v h)) a\"\n  by (simp add: Array.present_def alloc_def Let_def)\n\nlemma set_array_set_swap:\n  \"Array.set a xs (set r x' h) = set r x' (Array.set a xs h)\"\n  by (simp add: Array.set_def set_def)\n\nhide_const (open) present get set alloc noteq lookup update change\n\n\nsubsection \\<open>Code generator setup\\<close>\n\ntext \\<open>Intermediate operation avoids invariance problem in \\<open>Scala\\<close> (similar to value restriction)\\<close>\n\ndefinition ref' where\n  [code del]: \"ref' = ref\"\n\n\n\n\ntext \\<open>SML / Eval\\<close>\n\ncode_printing type_constructor ref \\<rightharpoonup> (SML) \"_/ ref\"\ncode_printing type_constructor ref \\<rightharpoonup> (Eval) \"_/ Unsynchronized.ref\"\ncode_printing constant Ref \\<rightharpoonup> (SML) \"raise/ (Fail/ \\\"bare Ref\\\")\"\ncode_printing constant ref' \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ ref/ _)\"\ncode_printing constant ref' \\<rightharpoonup> (Eval) \"(fn/ ()/ =>/ Unsynchronized.ref/ _)\"\ncode_printing constant Ref.lookup \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ !/ _)\"\ncode_printing constant Ref.update \\<rightharpoonup> (SML) \"(fn/ ()/ =>/ _/ :=/ _)\"\ncode_printing constant \"HOL.equal :: 'a ref \\<Rightarrow> 'a ref \\<Rightarrow> bool\" \\<rightharpoonup> (SML) infixl 6 \"=\"\n\ncode_reserved Eval Unsynchronized\n\n\ntext \\<open>OCaml\\<close>\n\ncode_printing type_constructor ref \\<rightharpoonup> (OCaml) \"_/ ref\"\ncode_printing constant Ref \\<rightharpoonup> (OCaml) \"failwith/ \\\"bare Ref\\\"\"\ncode_printing constant ref' \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ ref/ _)\"\ncode_printing constant Ref.lookup \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ !/ _)\"\ncode_printing constant Ref.update \\<rightharpoonup> (OCaml) \"(fun/ ()/ ->/ _/ :=/ _)\"\ncode_printing constant \"HOL.equal :: 'a ref \\<Rightarrow> 'a ref \\<Rightarrow> bool\" \\<rightharpoonup> (OCaml) infixl 4 \"=\"\n\ncode_reserved OCaml ref\n\n\ntext \\<open>Haskell\\<close>\n\ncode_printing type_constructor ref \\<rightharpoonup> (Haskell) \"Heap.STRef/ Heap.RealWorld/ _\"\ncode_printing constant Ref \\<rightharpoonup> (Haskell) \"error/ \\\"bare Ref\\\"\"\ncode_printing constant ref' \\<rightharpoonup> (Haskell) \"Heap.newSTRef\"\ncode_printing constant Ref.lookup \\<rightharpoonup> (Haskell) \"Heap.readSTRef\"\ncode_printing constant Ref.update \\<rightharpoonup> (Haskell) \"Heap.writeSTRef\"\ncode_printing constant \"HOL.equal :: 'a ref \\<Rightarrow> 'a ref \\<Rightarrow> bool\" \\<rightharpoonup> (Haskell) infix 4 \"==\"\ncode_printing class_instance ref :: HOL.equal \\<rightharpoonup> (Haskell) -\n\n\ntext \\<open>Scala\\<close>\n\ncode_printing type_constructor ref \\<rightharpoonup> (Scala) \"!Ref[_]\"\ncode_printing constant Ref \\<rightharpoonup> (Scala) \"!sys.error(\\\"bare Ref\\\")\"\ncode_printing constant ref' \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Ref((_))\"\ncode_printing constant Ref.lookup \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Ref.lookup((_))\"\ncode_printing constant Ref.update \\<rightharpoonup> (Scala) \"('_: Unit)/ =>/ Ref.update((_), (_))\"\ncode_printing constant \"HOL.equal :: 'a ref \\<Rightarrow> 'a ref \\<Rightarrow> bool\" \\<rightharpoonup> (Scala) infixl 5 \"==\"\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Imperative_HOL/Ref.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5583269943353744, "lm_q2_score": 0.538983220687684, "lm_q1q2_score": 0.30092888160375436}}
{"text": "theory DP_CPredS\n  imports \"./DP_CRelVS\"\nbegin\nlocale dp_pred =\n  fixes cmem :: \"('param \\<rightharpoonup> 'result) \\<Rightarrow> bool\"\nbegin\ncontext \n  includes lifting_syntax\nbegin\n  \ndefinition cpred_s :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('param \\<rightharpoonup> 'result, 'a) state \\<Rightarrow> bool\" where\n  \"cpred_s P s \\<equiv> \\<forall>M. cmem M \\<longrightarrow> (case runState s M of (v', M') \\<Rightarrow> P v' \\<and> cmem M')\"\n  \nlemma cpred_s_def_alt: \"cpred_s P s = pred_fun cmem (pred_prod P cmem) (runState s)\"\n  unfolding cpred_s_def by (fastforce split: pred_prod_split)\nterm 0(**)\n\nnotation pred_fun (infixr \"...>\" 55)\n\nabbreviation pred_fun_lifted :: \"('a \\<Rightarrow> bool) \\<Rightarrow> ('b \\<Rightarrow> bool) \\<Rightarrow> ('a ==_\\<Longrightarrow> 'b) \\<Rightarrow> bool\" (infixr \"...>\\<^sub>T\" 55) where\n  \"A ...>\\<^sub>T B \\<equiv> A ...> cpred_s B\"\n\n  \nlemma cpred_s_intro:\n  assumes \"\\<And>M v' M'. \\<lbrakk>cmem M; runState v\\<^sub>T M = (v', M')\\<rbrakk> \\<Longrightarrow> P v' \\<and> cmem M'\"\n  shows \"cpred_s P v\\<^sub>T\"\n  unfolding cpred_s_def using assms by blast\n\nlemma cpred_s_elim:\n  assumes \"cpred_s P v\\<^sub>T\" \"cmem M\"\n  obtains v' M' where \"runState v\\<^sub>T M = (v', M')\" \"P v'\" \"cmem M'\"\n  using assms unfolding cpred_s_def by blast\nterm 0 (**)\n\nlemma cpred_s_return:\n  \"P v \\<Longrightarrow> cpred_s P \\<langle>v\\<rangle>\"\n  unfolding return_def by (fastforce intro: cpred_s_intro)\n\nlemma return_transferP:\n  \"(P ...> cpred_s P) return\"\n  unfolding pred_fun_def by (metis cpred_s_return)\n    \nlemma bind_transferP:\n  \"(cpred_s P0 ...> (P0 ...>\\<^sub>T P1) ...> cpred_s P1) (op \\<bind>)\"\n  unfolding bind_def pred_fun_def by (fastforce intro: cpred_s_intro elim: cpred_s_elim split: prod.split)\n    \nlemma fun_app_lifted_transferP:\n  \"(cpred_s (R0 ...>\\<^sub>T R1) ...> cpred_s P0 ...> cpred_s P1) (op .)\"\n  unfolding fun_app_lifted_def\n  oops \nend\nend\n\nend", "meta": {"author": "exprosic", "repo": "praktikum-dp2", "sha": "49a8f1cdca6dadfac0d667aab0bebb2431f2a822", "save_path": "github-repos/isabelle/exprosic-praktikum-dp2", "path": "github-repos/isabelle/exprosic-praktikum-dp2/praktikum-dp2-49a8f1cdca6dadfac0d667aab0bebb2431f2a822/DP_CPredS.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.7122321842389469, "lm_q2_score": 0.42250463481418826, "lm_q1q2_score": 0.3009213989047879}}
{"text": "theory Impl_List_Playground_ChairNetwork_statefulpolicy_example\nimports \"../TopoS_Impl\"\nbegin\n\n\ntext{*An example of our chair network [simplified]*}\n\ntext{*Our access control view on the network*}\n  definition ChairNetwork_empty :: \"string list_graph\" where\n    \"ChairNetwork_empty \\<equiv> \\<lparr> nodesL = [''WebSrv'', ''FilesSrv'', ''Printer'',\n                                ''Students'',\n                                ''Employees'',\n                                ''Internet''],\n                      edgesL = [] \\<rparr>\"\n  \n  lemma \"wf_list_graph ChairNetwork_empty\" by eval\n\n\nsubsection{*Our security requirements*}\n  subsubsection{*We have a server with confidential data*}\n    definition ConfidentialChairData::\"(string SecurityInvariant)\" where\n      \"ConfidentialChairData \\<equiv> new_configured_list_SecurityInvariant SINVAR_BLPtrusted_impl.SINVAR_LIB_BLPtrusted \\<lparr> \n          node_properties = [''FilesSrv'' \\<mapsto> \\<lparr> security_level = 1, trusted = False \\<rparr>,\n                             ''Employees'' \\<mapsto> \\<lparr> security_level = 0, trusted = True \\<rparr>]\n          \\<rparr> ''confidential data''\"\n\n\n  subsubsection{* accessibly by employees and students*}\n    definition \"PrintingACL \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\<lparr> \n          node_properties = [''Printer'' \\<mapsto> Master [''Employees'', ''Students''],\n                             ''Employees'' \\<mapsto> Care,\n                             ''Students'' \\<mapsto> Care]\n          \\<rparr> ''printing acl''\"\n\n  subsubsection{* Printers are information sinks *}\n    definition \"PrintingSink \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_Sink \\<lparr> \n          node_properties = [''Printer'' \\<mapsto> Sink]\n          \\<rparr> ''printing sink''\"\n\n\n\n  subsubsection{*Students and Employees may access each other but are not accessible from the outside*}\n    definition \"InternalSubnet \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_SubnetsInGW \\<lparr> \n          node_properties = [''Students'' \\<mapsto> Member, ''Employees'' \\<mapsto> Member]\n          \\<rparr> ''internal subnet''\"\n\n\n  subsubsection{* The files server is only accessibly by employees*}\n    definition \"FilesSrvACL \\<equiv> new_configured_list_SecurityInvariant SINVAR_LIB_CommunicationPartners \\<lparr> \n          node_properties = [''FilesSrv'' \\<mapsto> Master [''Employees''],\n                             ''Employees'' \\<mapsto> Care]\n          \\<rparr> ''file srv acl''\"\n\n\ndefinition \"ChairSecurityRequirements = [ConfidentialChairData, PrintingACL, PrintingSink, InternalSubnet, FilesSrvACL]\"\n\nlemma \"\\<forall>m \\<in> set ChairSecurityRequirements. implc_sinvar m ChairNetwork_empty\" by eval\n\nvalue \"implc_get_offending_flows ChairSecurityRequirements ChairNetwork_empty\"\nvalue \"generate_valid_topology ChairSecurityRequirements ChairNetwork_empty\"\n\nvalue \"List.product (nodesL ChairNetwork_empty) (nodesL ChairNetwork_empty)\"\n\ndefinition \"ChairNetwork = generate_valid_topology ChairSecurityRequirements \n      \\<lparr>nodesL = nodesL ChairNetwork_empty, edgesL = List.product (nodesL ChairNetwork_empty) (nodesL ChairNetwork_empty) \\<rparr>\"\n\nvalue \"ChairNetwork\"\n\n\nML{*\nvisualize_graph @{context} @{term \"ChairSecurityRequirements\"} @{term \"ChairNetwork\"};\n*}\n\n\ndefinition \"ChairNetwork_stateful_IFS = \\<lparr> hostsL = nodesL ChairNetwork, flows_fixL = edgesL ChairNetwork, flows_stateL = filter_IFS_no_violations ChairNetwork ChairSecurityRequirements \\<rparr>\"\nvalue \"edgesL ChairNetwork\"\nvalue \"filter_IFS_no_violations ChairNetwork ChairSecurityRequirements\"\nvalue \"ChairNetwork_stateful_IFS\"\nlemma \"set (flows_stateL ChairNetwork_stateful_IFS) \\<subseteq> (set (flows_fixL ChairNetwork_stateful_IFS))\" by eval (*must always hold*)\nvalue \"(set (flows_fixL ChairNetwork_stateful_IFS)) - set (flows_stateL ChairNetwork_stateful_IFS)\"\n(*only problems: printers!!!*)\nvalue \"stateful_list_policy_to_list_graph ChairNetwork_stateful_IFS\"\nlemma \"set (filter_IFS_no_violations ChairNetwork [ConfidentialChairData]) = set (edgesL ChairNetwork)\" by eval\n\ndefinition \"ChairNetwork_stateful_ACS = \\<lparr> hostsL = nodesL ChairNetwork, flows_fixL = edgesL ChairNetwork, flows_stateL = filter_compliant_stateful_ACS ChairNetwork ChairSecurityRequirements \\<rparr>\"\nvalue \"edgesL ChairNetwork\"\nvalue \"filter_compliant_stateful_ACS ChairNetwork ChairSecurityRequirements\"\nvalue \"ChairNetwork_stateful_ACS\"\nlemma \"set (flows_stateL ChairNetwork_stateful_ACS) \\<subseteq> (set (flows_fixL ChairNetwork_stateful_ACS))\"\n  by eval (*must always hold*)\nvalue \"(set (flows_fixL ChairNetwork_stateful_ACS)) - set (flows_stateL ChairNetwork_stateful_ACS)\"\n\n(*flows that are already allowed in both directions are not marked as stateful*)\nvalue \"((set (flows_fixL ChairNetwork_stateful_ACS)) - set (flows_stateL ChairNetwork_stateful_ACS)) - set (backlinks (flows_fixL ChairNetwork_stateful_ACS))\"\n\n(*the new backflows*)\nvalue \"set (edgesL (stateful_list_policy_to_list_graph ChairNetwork_stateful_ACS)) - (set (edgesL ChairNetwork))\"\n\n(*the resulting ACS graph*)\nvalue \"stateful_list_policy_to_list_graph ChairNetwork_stateful_ACS\"\n\n\nvalue \"generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements\"\nvalue \"generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements\"\nlemma \"set (flows_fixL (generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements)) =\n       set (flows_fixL (generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements))\" by eval\nlemma \"set (flows_stateL (generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements)) =\n       set (flows_stateL (generate_valid_stateful_policy_IFSACS_2 ChairNetwork ChairSecurityRequirements))\" by eval\n\n\ndefinition \"ChairNetwork_stateful = generate_valid_stateful_policy_IFSACS ChairNetwork ChairSecurityRequirements\"\n\n\nML_val{*\nvisualize_edges @{context} @{term \"flows_fixL ChairNetwork_stateful\"} \n    [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL ChairNetwork_stateful\"})] \"\"; \n*}\n\n(*these requirements impose no restrictoins on the stateful flows*)\ndefinition \"ChairNetwork_stateful_v2 = generate_valid_stateful_policy_IFSACS ChairNetwork\n    [ConfidentialChairData, PrintingACL,  InternalSubnet, FilesSrvACL]\"\nML_val{*\nvisualize_edges @{context} @{term \"flows_fixL ChairNetwork_stateful_v2\"} \n    [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\",\n     @{term \"flows_stateL ChairNetwork_stateful_v2\"})] \"\"; \n*}\n\n(*The sink requirements imposes the restriction that the printer cannot answer*)\ndefinition \"ChairNetwork_stateful_v3 = generate_valid_stateful_policy_IFSACS ChairNetwork [PrintingSink]\"\nML_val{*\nvisualize_edges @{context} @{term \"flows_fixL ChairNetwork_stateful_v3\"}\n    [(\"edge [dir=\\\"arrow\\\", style=dashed, color=\\\"#FF8822\\\", constraint=false]\", @{term \"flows_stateL ChairNetwork_stateful_v3\"})] \"\"; \n*}\n\nsubsection{*An example of bad side-effects in access control policies*}\n\n  definition ACL_not_with::\"(string SecurityInvariant)\" where\n    \"ACL_not_with \\<equiv> new_configured_list_SecurityInvariant SINVAR_ACLnotCommunicateWith_impl.SINVAR_LIB_ACLnotCommunicateWith \\<lparr> \n        node_properties = [''A'' \\<mapsto> {''C''},\n                           ''B'' \\<mapsto> {},\n                           ''C'' \\<mapsto> {}]\n        \\<rparr> ''example: a must not reach C''\"\n\n  definition simple_network :: \"string list_graph\" where\n    \"simple_network \\<equiv> \\<lparr> nodesL = [''A'', ''B'', ''C''],\n                      edgesL = [(''B'', ''A''), (''B'', ''C'')] \\<rparr>\"\n  \n  lemma \"wf_list_graph ChairNetwork_empty\" by eval\n  lemma \"\\<forall>m \\<in> set [ACL_not_with]. implc_sinvar m simple_network\" by eval\n\n\n  lemma \"implc_get_offending_flows [ACL_not_with] simple_network = []\" by eval\n  lemma \"implc_get_offending_flows [ACL_not_with] \n    \\<lparr> nodesL = [''A'', ''B'', ''C''], edgesL = [(''B'', ''A''), (''B'', ''C''), (''A'', ''B'')] \\<rparr> =\n      [[(''B'', ''C'')], [(''A'', ''B'')]]\" by eval\n  lemma \"implc_get_offending_flows [ACL_not_with] \n    \\<lparr> nodesL = [''A'', ''B'', ''C''], edgesL = [(''B'', ''A''), (''B'', ''C''), (''C'', ''B'')] \\<rparr> =\n      []\" by eval\n\nvalue \"generate_valid_stateful_policy_IFSACS simple_network [ACL_not_with]\"\nvalue \"generate_valid_stateful_policy_IFSACS_2 simple_network [ACL_not_with]\"\n\n\n\n\n\n\n\n\nsubsection{*performance test*}\n(*6 minutes , about 1.8k edges in graph, most of the times, no requirements apply,\n  simply added some nodes, edges to the chair network. topology is valid*)\n(*value \"generate_valid_stateful_policy_IFSACS biggraph ChairSecurityRequirements\"*)\n\nend\n", "meta": {"author": "diekmann", "repo": "topoS", "sha": "4303ebd95a501283c02fd513c109e645a48ad080", "save_path": "github-repos/isabelle/diekmann-topoS", "path": "github-repos/isabelle/diekmann-topoS/topoS-4303ebd95a501283c02fd513c109e645a48ad080/thy/Network_Security_Policy_Verification/Examples/Impl_List_Playground_ChairNetwork_statefulpolicy_example.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241772283034, "lm_q2_score": 0.480478678047907, "lm_q1q2_score": 0.30083931696848865}}
{"text": "theory Smallstep\nimports Events Globalenvs Integers\nbegin\n\n(** Tools for small-step operational semantics *)\n\n(** This module defines generic operations and theorems over\n  the one-step transition relations that are used to specify\n  operational semantics in small-step style. *)\n\nlocale smallstep =\n  fixes step :: \"'s \\<Rightarrow> trace \\<Rightarrow> 's \\<Rightarrow> bool\"\nbegin\n\ninductive star :: \"'s \\<Rightarrow> trace \\<Rightarrow> 's \\<Rightarrow> bool\" where\n  star_refl: \"star s E0 s\"\n| star_step: \"step s1 t1 s2 \\<Longrightarrow> star s2 t2 s3 \\<Longrightarrow> t = List.append t1 t2 \\<Longrightarrow>\n      star s1 t s3\"\n\nlemma star_one: \"step s1 t s2 \\<Longrightarrow> star s1 t s2\"\n  by (metis (full_types) append_Nil2 star.simps)\n\nlemma star_trans: \"star s1 t1 s2 \\<Longrightarrow> star s2 t2 s3 \\<Longrightarrow> star s1 (List.append t1 t2) s3\"\n  apply (induction rule: star.induct)\n  apply simp\n  by (simp add: smallstep.star_step)+\n\nlemma star_trans2: \"star s1 t1 s2 \\<Longrightarrow> star s2 t2 s3 \\<Longrightarrow> star s3 t3 s4 \\<Longrightarrow> star s1 (t1 @ t2 @ t3) s4\"\n  by (simp add: star_trans)\n\nlemma star_destruct:\n  assumes \"star s1 t s2\"\n  shows \"s1 \\<noteq> s2 \\<Longrightarrow> \\<exists> s1' t1 t2. (step s1 t1 s1' \\<and> star s1' t2 s2 \\<and> t = t1 @ t2)\"\n  by (metis assms star.cases)\n\nend\n\n\n(* more lemmas for our deterministic case; CompCert doesn't have this *)\nlocale smallstep_determ = smallstep step\n  for step :: \"'s \\<Rightarrow> trace \\<Rightarrow> 's \\<Rightarrow> bool\" +\n  assumes determ: \"step s t1 s1' \\<Longrightarrow> step s t2 s2' \\<Longrightarrow> (t1 = t2 \\<and> s1' = s2')\"\nbegin\n\n(* if there's a step from s1 to s2 and s3 \\<noteq> s1,\n  then reaching s3 from s1 is equivalent to reaching s3 from s2 *)\nlemma star_step_subst:\n  assumes \"step s1 t1 s2\"\n  shows \"s1 \\<noteq> s3 \\<Longrightarrow> t = List.append t1 t2 \\<Longrightarrow>\n      star s1 t s3 = star s2 t2 s3\"\n  apply standard\n   apply (metis assms determ same_append_eq star_destruct)\n  using assms star_step by auto\nend\n\nend", "meta": {"author": "mckirk", "repo": "Isabelle_Cminor", "sha": "76ae3d8bb8f84fefdf67f028f2db08020a79ceb1", "save_path": "github-repos/isabelle/mckirk-Isabelle_Cminor", "path": "github-repos/isabelle/mckirk-Isabelle_Cminor/Isabelle_Cminor-76ae3d8bb8f84fefdf67f028f2db08020a79ceb1/theory/compcert/Smallstep.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6261241632752915, "lm_q2_score": 0.48047867804790706, "lm_q1q2_score": 0.300839310264364}}
{"text": "(*  Title:      Jinja/J/SmallProgress.thy\n\n    Author:     Tobias Nipkow\n    Copyright   2003 Technische Universitaet Muenchen\n*)\n\nsection \\<open>Progress of Small Step Semantics\\<close>\n\ntheory Progress\nimports Equivalence WellTypeRT DefAss \"../Common/Conform\"\nbegin\n\nlemma final_addrE:\n  \"\\<lbrakk> P,E,h \\<turnstile> e : Class C; final e;\n    \\<And>a. e = addr a \\<Longrightarrow> R;\n    \\<And>a. e = Throw a \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n(*<*)by(auto simp:final_def)(*>*)\n\n\nlemma finalRefE:\n \"\\<lbrakk> P,E,h \\<turnstile> e : T; is_refT T; final e;\n   e = null \\<Longrightarrow> R;\n   \\<And>a C. \\<lbrakk> e = addr a; T = Class C \\<rbrakk> \\<Longrightarrow> R;\n   \\<And>a. e = Throw a \\<Longrightarrow> R \\<rbrakk> \\<Longrightarrow> R\"\n(*<*)by(auto simp:final_def is_refT_def)(*>*)\n\n\ntext\\<open>Derivation of new induction scheme for well typing:\\<close>\n\ninductive\n  WTrt' :: \"[J_prog,heap,env,expr,ty] \\<Rightarrow> bool\"\n  and WTrts' :: \"[J_prog,heap,env,expr list, ty list] \\<Rightarrow> bool\"\n  and WTrt2' :: \"[J_prog,env,heap,expr,ty] \\<Rightarrow> bool\"\n        (\"_,_,_ \\<turnstile> _ :'' _\"   [51,51,51]50)\n  and WTrts2' :: \"[J_prog,env,heap,expr list, ty list] \\<Rightarrow> bool\"\n        (\"_,_,_ \\<turnstile> _ [:''] _\" [51,51,51]50)\n  for P :: J_prog and h :: heap\nwhere\n  \"P,E,h \\<turnstile> e :' T \\<equiv> WTrt' P h E e T\"\n| \"P,E,h \\<turnstile> es [:'] Ts \\<equiv> WTrts' P h E es Ts\"\n\n| \"is_class P C  \\<Longrightarrow>  P,E,h \\<turnstile> new C :' Class C\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e :' T; is_refT T; is_class P C \\<rbrakk>\n  \\<Longrightarrow> P,E,h \\<turnstile> Cast C e :' Class C\"\n| \"typeof\\<^bsub>h\\<^esub> v = Some T \\<Longrightarrow> P,E,h \\<turnstile> Val v :' T\"\n| \"E v = Some T  \\<Longrightarrow>  P,E,h \\<turnstile> Var v :' T\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e\\<^sub>1 :' T\\<^sub>1;  P,E,h \\<turnstile> e\\<^sub>2 :' T\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow> P,E,h \\<turnstile> e\\<^sub>1 \\<guillemotleft>Eq\\<guillemotright> e\\<^sub>2 :' Boolean\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e\\<^sub>1 :' Integer;  P,E,h \\<turnstile> e\\<^sub>2 :' Integer \\<rbrakk>\n  \\<Longrightarrow> P,E,h \\<turnstile> e\\<^sub>1 \\<guillemotleft>Add\\<guillemotright> e\\<^sub>2 :' Integer\"\n| \"\\<lbrakk> P,E,h \\<turnstile> Var V :' T;  P,E,h \\<turnstile> e :' T';  P \\<turnstile> T' \\<le> T \\<^cancel>\\<open>V \\<noteq> This\\<close> \\<rbrakk>\n  \\<Longrightarrow> P,E,h \\<turnstile> V:=e :' Void\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e :' Class C; P \\<turnstile> C has F:T in D \\<rbrakk> \\<Longrightarrow> P,E,h \\<turnstile> e\\<bullet>F{D} :' T\"\n| \"P,E,h \\<turnstile> e :' NT \\<Longrightarrow> P,E,h \\<turnstile> e\\<bullet>F{D} :' T\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e\\<^sub>1 :' Class C;  P \\<turnstile> C has F:T in D;\n    P,E,h \\<turnstile> e\\<^sub>2 :' T\\<^sub>2;  P \\<turnstile> T\\<^sub>2 \\<le> T \\<rbrakk>\n  \\<Longrightarrow> P,E,h \\<turnstile> e\\<^sub>1\\<bullet>F{D}:=e\\<^sub>2 :' Void\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e\\<^sub>1:'NT; P,E,h \\<turnstile> e\\<^sub>2 :' T\\<^sub>2 \\<rbrakk> \\<Longrightarrow> P,E,h \\<turnstile> e\\<^sub>1\\<bullet>F{D}:=e\\<^sub>2 :' Void\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e :' Class C; P \\<turnstile> C sees M:Ts \\<rightarrow> T = (pns,body) in D;\n    P,E,h \\<turnstile> es [:'] Ts'; P \\<turnstile> Ts' [\\<le>] Ts \\<rbrakk>\n  \\<Longrightarrow> P,E,h \\<turnstile> e\\<bullet>M(es) :' T\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e :' NT; P,E,h \\<turnstile> es [:'] Ts \\<rbrakk> \\<Longrightarrow> P,E,h \\<turnstile> e\\<bullet>M(es) :' T\"\n| \"P,E,h \\<turnstile> [] [:'] []\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e :' T;  P,E,h \\<turnstile> es [:'] Ts \\<rbrakk> \\<Longrightarrow>  P,E,h \\<turnstile> e#es [:'] T#Ts\"\n| \"\\<lbrakk> typeof\\<^bsub>h\\<^esub> v = Some T\\<^sub>1; P \\<turnstile> T\\<^sub>1 \\<le> T; P,E(V\\<mapsto>T),h \\<turnstile> e\\<^sub>2 :' T\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow>  P,E,h \\<turnstile> {V:T := Val v; e\\<^sub>2} :' T\\<^sub>2\"\n| \"\\<lbrakk> P,E(V\\<mapsto>T),h \\<turnstile> e :' T'; \\<not> assigned V e \\<rbrakk> \\<Longrightarrow>  P,E,h \\<turnstile> {V:T; e} :' T'\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e\\<^sub>1:' T\\<^sub>1;  P,E,h \\<turnstile> e\\<^sub>2:'T\\<^sub>2 \\<rbrakk>  \\<Longrightarrow>  P,E,h \\<turnstile> e\\<^sub>1;;e\\<^sub>2 :' T\\<^sub>2\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e :' Boolean;  P,E,h \\<turnstile> e\\<^sub>1:' T\\<^sub>1;  P,E,h \\<turnstile> e\\<^sub>2:' T\\<^sub>2;\n    P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<or> P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1;\n    P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<longrightarrow> T = T\\<^sub>2; P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1 \\<longrightarrow> T = T\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> P,E,h \\<turnstile> if (e) e\\<^sub>1 else e\\<^sub>2 :' T\"\n(*\n \"\\<lbrakk> P,E,h \\<turnstile> e :' Boolean;  P,E,h \\<turnstile> e\\<^sub>1:' T\\<^sub>1;  P,E,h \\<turnstile> e\\<^sub>2:' T\\<^sub>2; P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow> P,E,h \\<turnstile> if (e) e\\<^sub>1 else e\\<^sub>2 :' T\\<^sub>2\"\n \"\\<lbrakk> P,E,h \\<turnstile> e :' Boolean;  P,E,h \\<turnstile> e\\<^sub>1:' T\\<^sub>1;  P,E,h \\<turnstile> e\\<^sub>2:' T\\<^sub>2; P \\<turnstile> T\\<^sub>2 \\<le> T\\<^sub>1 \\<rbrakk>\n  \\<Longrightarrow> P,E,h \\<turnstile> if (e) e\\<^sub>1 else e\\<^sub>2 :' T\\<^sub>1\"\n*)\n| \"\\<lbrakk> P,E,h \\<turnstile> e :' Boolean;  P,E,h \\<turnstile> c:' T \\<rbrakk>\n  \\<Longrightarrow>  P,E,h \\<turnstile> while(e) c :' Void\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e :' T\\<^sub>r; is_refT T\\<^sub>r \\<rbrakk>  \\<Longrightarrow>  P,E,h \\<turnstile> throw e :' T\"\n| \"\\<lbrakk> P,E,h \\<turnstile> e\\<^sub>1 :' T\\<^sub>1;  P,E(V \\<mapsto> Class C),h \\<turnstile> e\\<^sub>2 :' T\\<^sub>2; P \\<turnstile> T\\<^sub>1 \\<le> T\\<^sub>2 \\<rbrakk>\n  \\<Longrightarrow> P,E,h \\<turnstile> try e\\<^sub>1 catch(C V) e\\<^sub>2 :' T\\<^sub>2\"\n\n(*<*)\nlemmas WTrt'_induct = WTrt'_WTrts'.induct [split_format (complete)]\n  and WTrt'_inducts = WTrt'_WTrts'.inducts [split_format (complete)]\n\ninductive_cases WTrt'_elim_cases[elim!]:\n  \"P,E,h \\<turnstile> V :=e :' T\"\n(*>*)\n\n\n\nlemma [iff]: \"P,E,h \\<turnstile> Val v :' T = (typeof\\<^bsub>h\\<^esub> v = Some T)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTrt'.cases intro!:WTrt'_WTrts'.intros)\ndone\n(*>*)\n\nlemma [iff]: \"P,E,h \\<turnstile> Var v :' T = (E v = Some T)\"\n(*<*)\napply(rule iffI)\napply (auto elim: WTrt'.cases intro!:WTrt'_WTrts'.intros)\ndone\n(*>*)\n\n\nlemma wt_wt': \"P,E,h \\<turnstile> e : T \\<Longrightarrow> P,E,h \\<turnstile> e :' T\"\nand wts_wts': \"P,E,h \\<turnstile> es [:] Ts \\<Longrightarrow> P,E,h \\<turnstile> es [:'] Ts\"\n(*<*)\napply (induct rule:WTrt_inducts)\nprefer 14\napply(case_tac \"assigned V e\")\napply(clarsimp simp add:fun_upd_same assigned_def simp del:fun_upd_apply)\napply(erule (2) WTrt'_WTrts'.intros)\napply(erule (1) WTrt'_WTrts'.intros)\napply(blast intro:WTrt'_WTrts'.intros)+\ndone\n(*>*)\n\n\nlemma wt'_wt: \"P,E,h \\<turnstile> e :' T \\<Longrightarrow> P,E,h \\<turnstile> e : T\"\nand wts'_wts: \"P,E,h \\<turnstile> es [:'] Ts \\<Longrightarrow> P,E,h \\<turnstile> es [:] Ts\"\n(*<*)\napply (induct rule:WTrt'_inducts)\nprefer 16\napply(rule WTrt_WTrts.intros)\napply(rule WTrt_WTrts.intros)\napply(rule WTrt_WTrts.intros)\napply simp\napply(erule (2) WTrt_WTrts.intros)\napply(blast intro:WTrt_WTrts.intros)+\ndone\n(*>*)\n\n\ncorollary wt'_iff_wt: \"(P,E,h \\<turnstile> e :' T) = (P,E,h \\<turnstile> e : T)\"\n(*<*)by(blast intro:wt_wt' wt'_wt)(*>*)\n\n\ncorollary wts'_iff_wts: \"(P,E,h \\<turnstile> es [:'] Ts) = (P,E,h \\<turnstile> es [:] Ts)\"\n(*<*)by(blast intro:wts_wts' wts'_wts)(*>*)\n\n(*<*)\nlemmas WTrt_inducts2 = WTrt'_inducts [unfolded wt'_iff_wt wts'_iff_wts,\n case_names WTrtNew WTrtCast WTrtVal WTrtVar WTrtBinOpEq WTrtBinOpAdd WTrtLAss WTrtFAcc WTrtFAccNT WTrtFAss\n WTrtFAssNT WTrtCall WTrtCallNT WTrtNil WTrtCons WTrtInitBlock WTrtBlock WTrtSeq WTrtCond\n WTrtWhile WTrtThrow WTrtTry, consumes 1]\n(*>*)\n\n\n\n\nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Jinja/J/Progress.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984434543458, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.30081977057060116}}
{"text": "(*  Title:       BDD\n\n    Author:      Veronika Ortner and Norbert Schirmer, 2004\n    Maintainer:  Norbert Schirmer,  norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  \nRepointProof.thy\n\nCopyright (C) 2004-2008 Veronika Ortner and Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nsection \\<open>Proof of Procedure Repoint\\<close>\ntheory RepointProof imports ProcedureSpecs begin\n\nhide_const (open) DistinctTreeProver.set_of tree.Node tree.Tip\n\nlemma (in Repoint_impl) Repoint_modifies:\n  shows \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile>{\\<sigma>} \\<acute>p :==  PROC Repoint (\\<acute>p)\n        {t. t may_only_modify_globals \\<sigma> in [low,high]}\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply (vcg spec=modifies)\n  done\n\nlemma low_high_exchange_dag: \nassumes pt_same: \"\\<forall>pt. pt \\<notin> set_of lt \\<longrightarrow> low pt = lowa pt \\<and> high pt = higha pt\"\nassumes pt_changed: \"\\<forall>pt \\<in> set_of lt. lowa pt = (rep \\<propto> low) pt \\<and> \n                            higha pt = (rep \\<propto> high) pt\"\nassumes rep_pt: \"\\<forall>pt \\<in> set_of rt. rep pt = pt\"\nshows \"\\<And>q.  Dag q (rep \\<propto> low) (rep \\<propto> high) rt \\<Longrightarrow> \n            Dag q (rep \\<propto> lowa) (rep \\<propto> higha) rt\"\nusing rep_pt\nproof (induct rt)\n  case Tip thus ?case by simp\nnext\n  case (Node lrt q' rrt)\n  have \"Dag q (rep \\<propto> low) (rep \\<propto> high) (Node lrt q' rrt)\" by fact\n  then obtain \n    q': \"q = q'\"  and\n    q_notNull: \"q \\<noteq> Null\" and \n    lrt: \"Dag ((rep \\<propto> low) q) (rep \\<propto> low) (rep \\<propto> high) lrt\" and\n    rrt: \"Dag ((rep \\<propto> high) q) (rep \\<propto> low) (rep \\<propto> high) rrt\" \n    by auto\n  have rlowa_rlow: \"((rep \\<propto> lowa) q) = ((rep \\<propto> low) q)\"\n  proof (cases \"q \\<in> set_of lt\")\n    case True\n    note q_in_lt=this\n    with pt_changed have lowa_q: \"lowa q = (rep \\<propto> low) q\"\n      by simp\n    thus \"(rep \\<propto> lowa) q = (rep \\<propto> low) q\"\n    proof (cases \"low q = Null\")\n      case True\n      with lowa_q have \"lowa q = Null\"\n        by (simp add: null_comp_def)\n      with True show ?thesis\n        by (simp add: null_comp_def)\n    next\n      assume lq_nNull: \"low q \\<noteq> Null\"\n      show ?thesis\n      proof (cases \"(rep \\<propto> low) q = Null\")\n        case True \n        with lowa_q have \"lowa q = Null\"\n          by simp\n        with True show ?thesis\n          by (simp add: null_comp_def)\n      next\n        assume rlq_nNull: \"(rep \\<propto> low) q \\<noteq> Null\"\n        with lrt lowa_q have \"lowa q \\<in> set_of lrt\"\n          by auto\n        with Node.prems Node have \"lowa q \\<in> set_of (Node lrt q' rrt)\"\n          by simp\n        with Node.prems have \"rep (lowa q) = lowa q\"\n          by auto\n        with lowa_q rlq_nNull show ?thesis\n          by (simp add: null_comp_def)\n      qed\n    qed\n  next\n    assume q_notin_lt: \" q \\<notin> set_of lt\"\n    with pt_same have \"low q = lowa q\"\n      by auto\n    thus ?thesis\n      by (simp add: null_comp_def)\n  qed\n  have rhigha_rhigh: \"((rep \\<propto> higha) q) = ((rep \\<propto> high) q)\"\n  proof (cases \"q \\<in> set_of lt\")\n    case True\n    note q_in_lt=this\n    with pt_changed have higha_q: \"higha q = (rep \\<propto> high) q\"\n      by simp\n    thus ?thesis\n    proof (cases \"high q = Null\")\n      case True\n      with higha_q have \"higha q = Null\"\n        by (simp add: null_comp_def)\n      with True show ?thesis\n        by (simp add: null_comp_def)\n    next\n      assume hq_nNull: \"high q \\<noteq> Null\"\n      show ?thesis\n      proof (cases \"(rep \\<propto> high) q = Null\")\n        case True \n        with higha_q have \"higha q = Null\"\n          by simp\n        with True show ?thesis\n          by (simp add: null_comp_def)\n      next\n        assume rhq_nNull: \"(rep \\<propto> high) q \\<noteq> Null\"\n        with rrt higha_q have \"higha q \\<in> set_of rrt\"\n          by auto\n        with Node.prems Node have \"higha q \\<in> set_of (Node lrt q' rrt)\"\n          by simp\n        with Node.prems have \"rep (higha q) = higha q\"\n          by auto\n        with higha_q rhq_nNull show ?thesis\n          by (simp add: null_comp_def)\n      qed\n    qed\n  next\n    assume q_notin_lt: \" q \\<notin> set_of lt\"\n    with pt_same have \"high q = higha q\"\n      by auto\n    thus ?thesis\n      by (simp add: null_comp_def)\n  qed\n  with rrt have rhigha_mixed_dag: \n    \"Dag ((rep \\<propto> higha) q) (rep \\<propto> low) (rep \\<propto> high) rrt\"\n    by simp\n  from lrt rlowa_rlow have rlowa_mixed_dag: \n    \" Dag ((rep \\<propto> lowa) q) (rep \\<propto> low) (rep \\<propto> high) lrt\"\n    by simp\n  from Node.prems have lrt_rep_eq: \" \\<forall>pt\\<in>set_of lrt. rep pt = pt\"\n    by simp\n  from Node.prems have rrt_rep_eq: \"\\<forall>pt\\<in>set_of rrt. rep pt = pt\"\n    by simp\n  from rlowa_mixed_dag lrt_rep_eq have lowa_lrt: \n    \" Dag ((rep \\<propto> lowa) q) (rep \\<propto> lowa) (rep \\<propto> higha) lrt\"\n    apply -\n    apply (rule Node.hyps)\n    apply auto\n    done\n  from rhigha_mixed_dag rrt_rep_eq have higha_rrt: \n    \" Dag ((rep \\<propto> higha) q) (rep \\<propto> lowa) (rep \\<propto> higha) rrt\"\n    apply -\n    apply (rule Node.hyps)\n    apply auto\n    done\n  with lowa_lrt q' q_notNull \n  show \" Dag q (rep \\<propto> lowa) (rep \\<propto> higha) (Node lrt q' rrt)\"\n    by simp\nqed\n\n(*lemma Repoint_spec :\nincludes Repoint_impl \nshows  \n  \"\\<forall>\\<sigma> rept. \\<Gamma>\\<turnstile> \\<lbrace>\\<sigma>. (Dag ((\\<^bsup>\\<sigma>\\<^esup>rep \\<propto> id) \\<^bsup>\\<sigma>\\<^esup>p) (\\<^bsup>\\<sigma>\\<^esup>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) (\\<^bsup>\\<sigma>\\<^esup>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>high) rept) \n  \\<and> (\\<forall> no \\<in> set_of rept. \\<^bsup>\\<sigma>\\<^esup>rep no = no) \\<rbrace>\n  \\<acute>p :== CALL Repoint (\\<acute>p)\n  \\<lbrace>Dag \\<acute>p \\<acute>low \\<acute>high rept \\<and>\n  (\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow> \\<^bsup>\\<sigma>\\<^esup>low pt = \\<acute>low pt \\<and> \\<^bsup>\\<sigma>\\<^esup>high pt = \\<acute>high pt)\\<rbrace>\"\napply (hoare_rule CallRec1_SamePost)\napply (vcg)\napply  (rule conjI)\napply  clarify\nprefer 2\napply (intro impI allI )\napply (simp add: null_comp_def)\napply (rule conjI)\nprefer 2\napply (clarsimp)\napply clarify\n*)\n\n\n\nlemma (in Repoint_impl) Repoint_spec':\nshows \n  \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile> {\\<sigma>}\n  \\<acute>p :== PROC Repoint (\\<acute>p)\n  \\<lbrace>\\<forall> rept. ((Dag ((\\<^bsup>\\<sigma>\\<^esup>rep \\<propto> id) \\<^bsup>\\<sigma>\\<^esup>p) (\\<^bsup>\\<sigma>\\<^esup>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) (\\<^bsup>\\<sigma>\\<^esup>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>high) rept) \n  \\<and> (\\<forall> no \\<in> set_of rept. \\<^bsup>\\<sigma>\\<^esup>rep no = no))\n  \\<longrightarrow> Dag \\<acute>p \\<acute>low \\<acute>high rept \\<and>\n  (\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow> \\<^bsup>\\<sigma>\\<^esup>low pt = \\<acute>low pt \\<and> \\<^bsup>\\<sigma>\\<^esup>high pt = \\<acute>high pt)\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcRec1)\napply vcg\napply  (rule conjI)\napply  clarify\nprefer 2\napply (intro impI allI )\napply (simp add: null_comp_def)\napply (rule conjI)\nprefer 2\napply (clarsimp)\napply clarify\nproof -\n  fix low high p rep lowa higha pa lowb highb pb rept\n  assume p_nNull: \"p \\<noteq> Null\"\n  assume rp_nNull: \" rep p \\<noteq> Null\"\n  assume rec_spec_lrept: \n    \"\\<forall>rept. Dag ((rep \\<propto> id) (low (rep p))) (rep \\<propto> low) (rep \\<propto> high) rept\n    \\<and> (\\<forall>no\\<in>set_of rept. rep no = no)\n    \\<longrightarrow> Dag pa lowa higha rept \\<and> \n        (\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow> low pt = lowa pt \\<and> high pt = higha pt)\"\n  assume rec_spec_rrept: \n    \"\\<forall>rept. Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa(rep p := pa)) (rep \\<propto> higha) rept\n    \\<and> (\\<forall>no\\<in>set_of rept. rep no = no)\n    \\<longrightarrow> Dag pb lowb highb rept \\<and> \n        (\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow> (lowa(rep p := pa)) pt = lowb pt \\<and> higha pt = highb pt)\"\n  assume rept_dag: \"Dag ((rep \\<propto> id) p) (rep \\<propto> low) (rep \\<propto> high) rept\"\n  assume rno_rept: \"\\<forall>no\\<in>set_of rept. rep no = no\"\n  show \" Dag (rep p) lowb (highb(rep p := pb)) rept \\<and> \n    (\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow> low pt = lowb pt \\<and> high pt = (highb(rep p := pb)) pt)\"\n  proof -\n    from rp_nNull rept_dag p_nNull obtain lrept rrept where\n      rept_def: \"rept = Node lrept (rep p) rrept\"\n      by auto\n    with rept_dag p_nNull have lrept_dag: \n      \"Dag ((rep \\<propto> low) (rep p)) (rep \\<propto> low) (rep \\<propto> high) lrept\"\n      by simp\n    from rept_def rept_dag p_nNull have rrept_dag: \n      \"Dag ((rep \\<propto> high) (rep p)) (rep \\<propto> low) (rep \\<propto> high) rrept\"\n      by simp\n    from rno_rept rept_def have rno_lrept: \"\\<forall> no \\<in> set_of lrept. rep no = no\"\n      by auto\n    from rno_rept rept_def have rno_rrept: \"\\<forall> no \\<in> set_of rrept. rep no = no\"\n      by auto\n    have repoint_post_low: \n      \" Dag pa lowa higha lrept \\<and> \n      (\\<forall>pt. pt \\<notin> set_of lrept \\<longrightarrow> low pt = lowa pt \\<and> high pt = higha pt)\"\n    proof -\n      from lrept_dag have \" Dag ((rep \\<propto> id) (low (rep p))) (rep \\<propto> low) (rep \\<propto> high) lrept\"\n        by (simp add: id_trans)\n      with  rec_spec_lrept rno_lrept show ?thesis\n        apply -\n        apply (erule_tac x=lrept in allE)\n        apply (erule impE)\n        apply simp\n        apply assumption\n        done\n    qed\n    hence low_lowa_nc: \"(\\<forall>pt. pt \\<notin> set_of lrept \\<longrightarrow> low pt = lowa pt \\<and> high pt = higha pt)\"\n      by simp\n    from lrept_dag  repoint_post_low obtain \n      pa_def: \"pa = (rep \\<propto> low) (rep p)\" and\n      lowa_higha_def: \"(\\<forall> no \\<in> set_of lrept. lowa no = (rep \\<propto> low) no \\<and> higha no = (rep \\<propto> high) no)\"\n      apply -\n      apply (drule Dags_eq_hp_eq)\n      apply auto\n      done\n    from rept_dag have rept_DAG: \"DAG rept\"\n      by (rule Dag_is_DAG)\n    with rept_def have rp_notin_lrept: \"rep p \\<notin> set_of lrept\"\n      by simp\n    from rept_DAG rept_def have rp_notin_rrept: \"rep p \\<notin> set_of rrept\"\n      by simp\n    have \"Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa(rep p := pa)) (rep \\<propto> higha) rrept\"\n    proof -\n      from low_lowa_nc rp_notin_lrept have \"(rep \\<propto> high) (rep p) = (rep \\<propto> higha) (rep p)\"\n        by (auto simp add: null_comp_def)\n      with rrept_dag have higha_mixed_rrept: \n        \"Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> low) (rep \\<propto> high) rrept\"\n        by (simp add: id_trans)\n      thm low_high_exchange_dag\n      with low_lowa_nc lowa_higha_def rno_rrept have lowa_higha_rrept:\n        \"Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa) (rep \\<propto> higha) rrept\"\n        apply -\n        apply (rule low_high_exchange_dag)\n        apply auto\n        done\n      have \"Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa) (rep \\<propto> higha) rrept = \n        Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa(rep p := pa)) (rep \\<propto> higha) rrept\"\n      proof -\n        have \"\\<forall> no \\<in> set_of rrept. (rep \\<propto> lowa) no = (rep \\<propto> lowa(rep p := pa)) no \\<and>\n          (rep \\<propto> higha) no = (rep \\<propto> higha) no\"\n        proof \n          fix no\n          assume no_in_rrept: \"no \\<in> set_of rrept\"\n          with rp_notin_rrept have \"no \\<noteq> rep p\" \n            by blast\n          thus \"(rep \\<propto> lowa) no = (rep \\<propto> lowa(rep p := pa)) no \\<and> \n            (rep \\<propto> higha) no = (rep \\<propto> higha) no\"\n            by (simp add: null_comp_def)\n        qed\n        thus ?thesis\n          by (rule heaps_eq_Dag_eq)\n      qed\n      with lowa_higha_rrept show ?thesis\n        by simp\n    qed\n    with rec_spec_rrept rno_rrept have repoint_rrept: \"Dag pb lowb highb rrept \\<and> \n      (\\<forall>pt. pt \\<notin> set_of rrept \\<longrightarrow> \n      (lowa(rep p := pa)) pt = lowb pt \\<and> higha pt = highb pt)\"\n      apply -\n      apply (erule_tac x=rrept in allE)\n      apply (erule impE)\n      apply simp\n      apply assumption\n      done\n    then have ab_nc: \"(\\<forall>pt. pt \\<notin> set_of rrept \\<longrightarrow> \n      (lowa(rep p := pa)) pt = lowb pt \\<and> higha pt = highb pt)\"\n      by simp\n    from repoint_rrept rrept_dag obtain\n      pb_def: \"pb = ((rep \\<propto> high) (rep p))\" and\n      lowb_highb_def: \"(\\<forall> no \\<in> set_of rrept. lowb no = (rep \\<propto> low) no \\<and> highb no = (rep \\<propto> high) no)\"\n      apply -\n      apply (drule Dags_eq_hp_eq)\n      apply auto\n      done\n    have rept_end_dag: \" Dag (rep p) lowb (highb(rep p := pb)) rept\"\n    proof -\n      have \"\\<forall> no \\<in> set_of rept. lowb no = (rep \\<propto> low) no \\<and> (highb(rep p := pb)) no = (rep \\<propto> high) no\"\n      proof\n        fix no\n        assume no_in_rept: \" no \\<in> set_of rept\"\n        show \"lowb no = (rep \\<propto> low) no \\<and> (highb(rep p := pb)) no = (rep \\<propto> high) no\"\n        proof (cases \"no \\<in> set_of rrept\")\n          case True\n          with lowb_highb_def pb_def show ?thesis\n            by simp\n        next\n          assume no_notin_rrept: \" no \\<notin> set_of rrept\"\n          show ?thesis\n          proof (cases \"no \\<in> set_of lrept\")\n            case True\n            with no_notin_rrept rp_notin_lrept ab_nc\n            have ab_nc_no: \"lowa no = lowb no \\<and> higha no = highb no\"\n              apply -\n              apply (erule_tac x=no in allE)\n              apply (erule impE)\n              apply simp\n              apply (subgoal_tac \"no \\<noteq> rep p\")\n              apply simp\n              apply blast\n              done\n            from lowa_higha_def True have \n              \"lowa no = (rep \\<propto> low) no \\<and> higha no = (rep \\<propto> high) no\"\n              by auto\n            with ab_nc_no have \"lowb no = (rep \\<propto> low) no \\<and> highb no =(rep \\<propto> high) no\" \n              by simp\n            with rp_notin_lrept True show ?thesis\n              apply (subgoal_tac \"no \\<noteq> rep p\")\n              apply simp\n              apply blast\n              done\n          next\n            assume no_notin_lrept: \" no \\<notin> set_of lrept\"\n            with no_in_rept rept_def no_notin_rrept have no_rp: \"no = rep p\"\n              by simp\n            with rp_notin_lrept low_lowa_nc have a_nc:  \n              \"low no = lowa no \\<and> high no = higha no\"\n              by auto\n            from rp_notin_rrept no_rp ab_nc have \n              \"(lowa(rep p := pa)) no = lowb no \\<and> higha no = highb no\"\n              by auto\n            with a_nc pa_def no_rp have \"(rep \\<propto> low) no = lowb no \\<and> high no = highb no\"\n              by auto\n            with pb_def no_rp show ?thesis\n              by simp\n          qed\n        qed\n      qed\n      with rept_dag have \" Dag (rep p) lowb (highb(rep p := pb)) rept = \n        Dag (rep p) (rep \\<propto> low) (rep \\<propto> high) rept\"      \n        apply -\n        thm heaps_eq_Dag_eq\n        apply (rule heaps_eq_Dag_eq)\n        apply auto\n        done\n      with rept_dag p_nNull show ?thesis\n        by simp\n    qed\n    have \"(\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow> low pt = lowb pt \\<and> high pt = (highb(rep p := pb)) pt)\"\n    proof (intro allI impI)\n      fix pt\n      assume pt_notin_rept: \"pt \\<notin> set_of rept\"\n      with rept_def obtain\n        pt_notin_lrept: \"pt \\<notin> set_of lrept\" and\n        pt_notin_rrept: \"pt \\<notin> set_of rrept\" and\n        pt_neq_rp: \"pt \\<noteq> rep p\"\n        by simp\n      with low_lowa_nc ab_nc show \"low pt = lowb pt \\<and> high pt = (highb(rep p := pb)) pt\"\n        by auto\n    qed\n    with rept_end_dag show ?thesis\n      by simp\n  qed\nqed\n        \nlemma (in Repoint_impl) Repoint_spec:\nshows \n  \"\\<forall>\\<sigma> rept. \\<Gamma>\\<turnstile> \\<lbrace>\\<sigma>. Dag ((\\<acute>rep \\<propto> id) \\<acute>p) (\\<acute>rep \\<propto> \\<acute>low) (\\<acute>rep \\<propto> \\<acute>high) rept \n  \\<and> (\\<forall> no \\<in> set_of rept. \\<acute>rep no = no) \\<rbrace> \n  \\<acute>p :== PROC Repoint (\\<acute>p)\n  \\<lbrace>Dag \\<acute>p \\<acute>low \\<acute>high rept \\<and>\n  (\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow> \\<^bsup>\\<sigma>\\<^esup>low pt = \\<acute>low pt \\<and> \\<^bsup>\\<sigma>\\<^esup>high pt = \\<acute>high pt)\\<rbrace>\"\napply (hoare_rule HoarePartial.ProcRec1)\napply vcg\napply (rule conjI)\nprefer 2\napply  (clarsimp simp add: null_comp_def)\napply clarify\napply (rule conjI)\nprefer 2\napply  clarsimp\napply clarify\nproof -\n  fix rept low high rep p\n  assume rept_dag: \"Dag ((rep \\<propto> id) p) (rep \\<propto> low) (rep \\<propto> high) rept\"\n  assume rno_rept: \"\\<forall>no\\<in>set_of rept. rep no = no\"\n  assume p_nNull: \"p \\<noteq> Null\"\n  assume rp_nNull: \" rep p \\<noteq> Null\"\n  show \"\\<exists>lrept.\n             Dag ((rep \\<propto> id) (low (rep p))) (rep \\<propto> low) (rep \\<propto> high) lrept \\<and>\n             (\\<forall>no\\<in>set_of lrept. rep no = no) \\<and>\n             (\\<forall>lowa higha pa.\n                 Dag pa lowa higha lrept \\<and>\n                 (\\<forall>pt. pt \\<notin> set_of lrept \\<longrightarrow>\n                       low pt = lowa pt \\<and> high pt = higha pt) \\<longrightarrow>\n                 (\\<exists>rrept.\n                     Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa(rep p := pa))\n                      (rep \\<propto> higha) rrept \\<and>\n                     (\\<forall>no\\<in>set_of rrept. rep no = no) \\<and>\n                     (\\<forall>lowb highb pb.\n                         Dag pb lowb highb rrept \\<and>\n                         (\\<forall>pt. pt \\<notin> set_of rrept \\<longrightarrow>\n                               (lowa(rep p := pa)) pt = lowb pt \\<and>\n                               higha pt = highb pt) \\<longrightarrow>\n                         Dag (rep p) lowb (highb(rep p := pb)) rept \\<and>\n                         (\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow>\n                               low pt = lowb pt \\<and>\n                               high pt = (highb(rep p := pb)) pt))))\" \n  proof -\n    from rp_nNull rept_dag p_nNull obtain lrept rrept where\n      rept_def: \"rept = Node lrept (rep p) rrept\"\n      by auto\n    with rept_dag p_nNull have lrept_dag: \n      \"Dag ((rep \\<propto> low) (rep p)) (rep \\<propto> low) (rep \\<propto> high) lrept\"\n      by simp\n    from rept_def rept_dag p_nNull have rrept_dag: \n      \"Dag ((rep \\<propto> high) (rep p)) (rep \\<propto> low) (rep \\<propto> high) rrept\"\n      by simp\n    from rno_rept rept_def have rno_lrept: \"\\<forall> no \\<in> set_of lrept. rep no = no\"\n      by auto\n    from rno_rept rept_def have rno_rrept: \"\\<forall> no \\<in> set_of rrept. rep no = no\"\n      by auto\n    show ?thesis\n      apply (rule_tac x=lrept in exI)\n      apply (rule conjI)\n      apply  (simp add: id_trans lrept_dag)\n      apply (rule conjI)\n      apply (rule rno_lrept)\n      apply clarify\n      subgoal premises prems for lowa higha pa\n      proof -\n        have lrepta: \"Dag pa lowa higha lrept\" by fact\n        have low_lowa_nc: \n          \"\\<forall>pt. pt \\<notin> set_of lrept \\<longrightarrow> low pt = lowa pt \\<and> high pt = higha pt\" by fact\n        from lrept_dag lrepta  obtain \n          pa_def: \"pa = (rep \\<propto> low) (rep p)\" and\n          lowa_higha_def: \"\\<forall>no \\<in> set_of lrept. \n          lowa no = (rep \\<propto> low) no \\<and> higha no = (rep \\<propto> high) no\"\n          apply -\n          apply (drule Dags_eq_hp_eq)\n          apply auto\n          done\n        from rept_dag have rept_DAG: \"DAG rept\"\n          by (rule Dag_is_DAG)\n        with rept_def have rp_notin_lrept: \"rep p \\<notin> set_of lrept\"\n          by simp\n        from rept_DAG rept_def have rp_notin_rrept: \"rep p \\<notin> set_of rrept\"\n          by simp\n        have rrepta: \"Dag ((rep \\<propto> id) (higha (rep p))) \n                         (rep \\<propto> lowa(rep p := pa)) (rep \\<propto> higha) rrept\"\n        proof -\n          from low_lowa_nc rp_notin_lrept \n          have \"(rep \\<propto> high) (rep p) = (rep \\<propto> higha) (rep p)\"\n            by (auto simp add: null_comp_def)\n          with rrept_dag have higha_mixed_rrept: \n            \"Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> low) (rep \\<propto> high) rrept\"\n            by (simp add: id_trans)\n          thm low_high_exchange_dag\n          with low_lowa_nc lowa_higha_def rno_rrept \n          have lowa_higha_rrept:\n              \"Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa) (rep \\<propto> higha) rrept\"\n            apply -\n            apply (rule low_high_exchange_dag)\n            apply auto\n            done\n          have \"Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa) (rep \\<propto> higha) rrept = \n                Dag ((rep \\<propto> id) (higha (rep p))) \n                        (rep \\<propto> lowa(rep p := pa)) (rep \\<propto> higha) rrept\"\n          proof -\n            have \"\\<forall>no \\<in> set_of rrept. \n                      (rep \\<propto> lowa) no = (rep \\<propto> lowa(rep p := pa)) no \\<and>\n                      (rep \\<propto> higha) no = (rep \\<propto> higha) no\"\n            proof \n              fix no\n              assume no_in_rrept: \"no \\<in> set_of rrept\"\n              with rp_notin_rrept have \"no \\<noteq> rep p\" \n                by blast\n              thus \"(rep \\<propto> lowa) no = (rep \\<propto> lowa(rep p := pa)) no \\<and> \n                (rep \\<propto> higha) no = (rep \\<propto> higha) no\"\n                by (simp add: null_comp_def)\n            qed\n            thus ?thesis\n              by (rule heaps_eq_Dag_eq)\n          qed\n          with lowa_higha_rrept show ?thesis\n            by simp\n        qed\n        show ?thesis\n          apply (rule_tac x=rrept in exI)\n          apply (rule conjI)\n          apply  (rule rrepta)\n          apply (rule conjI)\n          apply  (rule rno_rrept)\n          apply clarify\n          subgoal premises prems for lowb highb pb\n          proof -\n            have rreptb: \"Dag pb lowb highb rrept\" by fact\n            have ab_nc: \"\\<forall>pt. pt \\<notin> set_of rrept \\<longrightarrow> \n                            (lowa(rep p := pa)) pt = lowb pt \\<and> higha pt = highb pt\" by fact\n            from rreptb rrept_dag obtain\n              pb_def: \"pb = ((rep \\<propto> high) (rep p))\" and\n              lowb_highb_def: \"\\<forall>no \\<in> set_of rrept. \n                                  lowb no = (rep \\<propto> low) no \\<and> highb no = (rep \\<propto> high) no\"\n              apply -\n              apply (drule Dags_eq_hp_eq)\n              apply auto\n              done\n            have rept_end_dag: \" Dag (rep p) lowb (highb(rep p := pb)) rept\"\n            proof -\n              have \"\\<forall>no \\<in> set_of rept. \n                    lowb no = (rep \\<propto> low) no \\<and> (highb(rep p := pb)) no = (rep \\<propto> high) no\"\n              proof\n                fix no\n                assume no_in_rept: \" no \\<in> set_of rept\"\n                show \"lowb no = (rep \\<propto> low) no \\<and> \n                      (highb(rep p := pb)) no = (rep \\<propto> high) no\"\n                proof (cases \"no \\<in> set_of rrept\")\n                  case True\n                  with lowb_highb_def pb_def show ?thesis\n                    by simp\n                next\n                  assume no_notin_rrept: \" no \\<notin> set_of rrept\"\n                  show ?thesis\n                  proof (cases \"no \\<in> set_of lrept\")\n                    case True\n                    with no_notin_rrept rp_notin_lrept ab_nc\n                    have ab_nc_no: \"lowa no = lowb no \\<and> higha no = highb no\"\n                      apply -\n                      apply (erule_tac x=no in allE)\n                      apply (erule impE)\n                      apply simp\n                      apply (subgoal_tac \"no \\<noteq> rep p\")\n                      apply simp\n                      apply blast\n                      done\n                    from lowa_higha_def True have \n                      \"lowa no = (rep \\<propto> low) no \\<and> higha no = (rep \\<propto> high) no\"\n                      by auto\n                    with ab_nc_no \n                    have \"lowb no = (rep \\<propto> low) no \\<and> highb no =(rep \\<propto> high) no\" \n                      by simp\n                    with rp_notin_lrept True show ?thesis\n                      apply (subgoal_tac \"no \\<noteq> rep p\")\n                      apply simp\n                      apply blast\n                      done\n                  next\n                    assume no_notin_lrept: \" no \\<notin> set_of lrept\"\n                    with no_in_rept rept_def no_notin_rrept have no_rp: \"no = rep p\"\n                      by simp\n                    with rp_notin_lrept low_lowa_nc \n                    have a_nc: \"low no = lowa no \\<and> high no = higha no\"\n                      by auto\n                    from rp_notin_rrept no_rp ab_nc \n                    have \"(lowa(rep p := pa)) no = lowb no \\<and> higha no = highb no\"\n                      by auto\n                    with a_nc pa_def no_rp \n                    have \"(rep \\<propto> low) no = lowb no \\<and> high no = highb no\"\n                      by auto\n                    with pb_def no_rp show ?thesis\n                      by simp\n                  qed\n                qed\n              qed\n              with rept_dag \n              have \"Dag (rep p) lowb (highb(rep p := pb)) rept = \n                    Dag (rep p) (rep \\<propto> low) (rep \\<propto> high) rept\"      \n                apply -\n                apply (rule heaps_eq_Dag_eq)\n                apply auto\n                done\n              with rept_dag p_nNull show ?thesis\n                by simp\n            qed\n            have \"(\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow> low pt = lowb pt \\<and> \n                        high pt = (highb(rep p := pb)) pt)\"\n            proof (intro allI impI)\n              fix pt\n              assume pt_notin_rept: \"pt \\<notin> set_of rept\"\n              with rept_def obtain\n                pt_notin_lrept: \"pt \\<notin> set_of lrept\" and\n                pt_notin_rrept: \"pt \\<notin> set_of rrept\" and\n                pt_neq_rp: \"pt \\<noteq> rep p\"\n                by simp\n              with low_lowa_nc ab_nc \n              show \"low pt = lowb pt \\<and> high pt = (highb(rep p := pb)) pt\"\n                by auto\n            qed\n            with rept_end_dag show ?thesis\n              by simp\n          qed\n        done\n      qed\n    done\n  qed\nqed\n\nlemma (in Repoint_impl) Repoint_spec_total:\nshows \n  \"\\<forall>\\<sigma> rept. \\<Gamma>\\<turnstile>\\<^sub>t \\<lbrace>\\<sigma>. Dag ((\\<acute>rep \\<propto> id) \\<acute>p) (\\<acute>rep \\<propto> \\<acute>low) (\\<acute>rep \\<propto> \\<acute>high) rept \n  \\<and> (\\<forall> no \\<in> set_of rept. \\<acute>rep no = no) \\<rbrace> \n  \\<acute>p :== PROC Repoint (\\<acute>p)\n  \\<lbrace>Dag \\<acute>p \\<acute>low \\<acute>high rept \\<and>\n  (\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow> \\<^bsup>\\<sigma>\\<^esup>low pt = \\<acute>low pt \\<and> \\<^bsup>\\<sigma>\\<^esup>high pt = \\<acute>high pt)\\<rbrace>\"\n\napply (hoare_rule HoareTotal.ProcRec1\n          [where r=\"measure (\\<lambda>(s,p). size \n                       (dag ((\\<^bsup>s\\<^esup>rep \\<propto> id) \\<^bsup>s\\<^esup>p) (\\<^bsup>s\\<^esup>rep \\<propto> \\<^bsup>s\\<^esup>low) (\\<^bsup>s\\<^esup>rep \\<propto> \\<^bsup>s\\<^esup>high)))\"])\napply vcg\napply (rule conjI)\nprefer 2\napply  (clarsimp simp add: null_comp_def)\napply clarify\napply (rule conjI)\nprefer 2\napply  clarsimp\napply clarify\nproof -\n  fix rept low high rep p\n  assume rept_dag: \"Dag ((rep \\<propto> id) p) (rep \\<propto> low) (rep \\<propto> high) rept\"\n  assume rno_rept: \"\\<forall>no\\<in>set_of rept. rep no = no\"\n  assume p_nNull: \"p \\<noteq> Null\"\n  assume rp_nNull: \" rep p \\<noteq> Null\"\n  show \"\\<exists>lrept.\n             Dag ((rep \\<propto> id) (low (rep p))) (rep \\<propto> low) (rep \\<propto> high) lrept \\<and>\n             (\\<forall>no\\<in>set_of lrept. rep no = no) \\<and>\n             size (dag ((rep \\<propto> id) (low (rep p))) (rep \\<propto> low) (rep \\<propto> high))\n             < size (dag ((rep \\<propto> id) p) (rep \\<propto> low) (rep \\<propto> high)) \\<and>\n             (\\<forall>lowa higha pa.\n                 Dag pa lowa higha lrept \\<and>\n                 (\\<forall>pt. pt \\<notin> set_of lrept \\<longrightarrow>\n                       low pt = lowa pt \\<and> high pt = higha pt) \\<longrightarrow>\n                 (\\<exists>rrept.\n                     Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa(rep p := pa))\n                      (rep \\<propto> higha) rrept \\<and>\n                     (\\<forall>no\\<in>set_of rrept. rep no = no) \\<and>\n                     size (dag ((rep \\<propto> id) (higha (rep p)))\n                            (rep \\<propto> lowa(rep p := pa)) (rep \\<propto> higha))\n                     < size (dag ((rep \\<propto> id) p) (rep \\<propto> low) (rep \\<propto> high)) \\<and>\n                     (\\<forall>lowb highb pb.\n                         Dag pb lowb highb rrept \\<and>\n                         (\\<forall>pt. pt \\<notin> set_of rrept \\<longrightarrow>\n                               (lowa(rep p := pa)) pt = lowb pt \\<and>\n                               higha pt = highb pt) \\<longrightarrow>\n                         Dag (rep p) lowb (highb(rep p := pb)) rept \\<and>\n                         (\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow>\n                               low pt = lowb pt \\<and>\n                               high pt = (highb(rep p := pb)) pt))))\"\n  proof -\n    from rp_nNull rept_dag p_nNull obtain lrept rrept where\n      rept_def: \"rept = Node lrept (rep p) rrept\"\n      by auto\n    with rept_dag p_nNull have lrept_dag: \n      \"Dag ((rep \\<propto> low) (rep p)) (rep \\<propto> low) (rep \\<propto> high) lrept\"\n      by simp\n    from rept_def rept_dag p_nNull have rrept_dag: \n      \"Dag ((rep \\<propto> high) (rep p)) (rep \\<propto> low) (rep \\<propto> high) rrept\"\n      by simp\n    from rno_rept rept_def have rno_lrept: \"\\<forall> no \\<in> set_of lrept. rep no = no\"\n      by auto\n    from rno_rept rept_def have rno_rrept: \"\\<forall> no \\<in> set_of rrept. rep no = no\"\n      by auto\n    show ?thesis\n      apply (rule_tac x=lrept in exI)\n      apply (rule conjI)\n      apply  (simp add: id_trans lrept_dag)\n      apply (rule conjI)\n      apply (rule rno_lrept)\n      apply (rule conjI)\n      using rept_dag rept_def\n      apply  (simp only: Dag_dag)\n      apply  (clarsimp simp add: id_trans Dag_dag)\n      apply clarify\n      subgoal premises prems for lowa higha pa\n      proof -\n        have lrepta: \"Dag pa lowa higha lrept\" by fact\n        have low_lowa_nc: \n          \"\\<forall>pt. pt \\<notin> set_of lrept \\<longrightarrow> low pt = lowa pt \\<and> high pt = higha pt\" by fact\n        from lrept_dag lrepta  obtain \n          pa_def: \"pa = (rep \\<propto> low) (rep p)\" and\n          lowa_higha_def: \"\\<forall>no \\<in> set_of lrept. \n          lowa no = (rep \\<propto> low) no \\<and> higha no = (rep \\<propto> high) no\"\n          apply -\n          apply (drule Dags_eq_hp_eq)\n          apply auto\n          done\n        from rept_dag have rept_DAG: \"DAG rept\"\n          by (rule Dag_is_DAG)\n        with rept_def have rp_notin_lrept: \"rep p \\<notin> set_of lrept\"\n          by simp\n        from rept_DAG rept_def have rp_notin_rrept: \"rep p \\<notin> set_of rrept\"\n          by simp\n        have rrepta: \"Dag ((rep \\<propto> id) (higha (rep p))) \n                         (rep \\<propto> lowa(rep p := pa)) (rep \\<propto> higha) rrept\"\n        proof -\n          from low_lowa_nc rp_notin_lrept \n          have \"(rep \\<propto> high) (rep p) = (rep \\<propto> higha) (rep p)\"\n            by (auto simp add: null_comp_def)\n          with rrept_dag have higha_mixed_rrept: \n            \"Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> low) (rep \\<propto> high) rrept\"\n            by (simp add: id_trans)\n          thm low_high_exchange_dag\n          with low_lowa_nc lowa_higha_def rno_rrept \n          have lowa_higha_rrept:\n              \"Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa) (rep \\<propto> higha) rrept\"\n            apply -\n            apply (rule low_high_exchange_dag)\n            apply auto\n            done\n          have \"Dag ((rep \\<propto> id) (higha (rep p))) (rep \\<propto> lowa) (rep \\<propto> higha) rrept = \n                Dag ((rep \\<propto> id) (higha (rep p))) \n                        (rep \\<propto> lowa(rep p := pa)) (rep \\<propto> higha) rrept\"\n          proof -\n            have \"\\<forall>no \\<in> set_of rrept. \n                      (rep \\<propto> lowa) no = (rep \\<propto> lowa(rep p := pa)) no \\<and>\n                      (rep \\<propto> higha) no = (rep \\<propto> higha) no\"\n            proof \n              fix no\n              assume no_in_rrept: \"no \\<in> set_of rrept\"\n              with rp_notin_rrept have \"no \\<noteq> rep p\" \n                by blast\n              thus \"(rep \\<propto> lowa) no = (rep \\<propto> lowa(rep p := pa)) no \\<and> \n                (rep \\<propto> higha) no = (rep \\<propto> higha) no\"\n                by (simp add: null_comp_def)\n            qed\n            thus ?thesis\n              by (rule heaps_eq_Dag_eq)\n          qed\n          with lowa_higha_rrept show ?thesis\n            by simp\n        qed\n        show ?thesis\n          apply (rule_tac x=rrept in exI)\n          apply (rule conjI)\n          apply  (rule rrepta)\n          apply (rule conjI)\n          apply  (rule rno_rrept)\n          apply (rule conjI)\n          using rept_dag rept_def rrepta\n          apply  (simp only: Dag_dag)\n          apply  (clarsimp simp add: id_trans Dag_dag)\n          apply clarify\n          subgoal premises prems for lowb highb pb\n          proof -\n            have rreptb: \"Dag pb lowb highb rrept\" by fact\n            have ab_nc: \"\\<forall>pt. pt \\<notin> set_of rrept \\<longrightarrow> \n                            (lowa(rep p := pa)) pt = lowb pt \\<and> higha pt = highb pt\" by fact\n            from rreptb rrept_dag obtain\n              pb_def: \"pb = ((rep \\<propto> high) (rep p))\" and\n              lowb_highb_def: \"\\<forall>no \\<in> set_of rrept. \n                                  lowb no = (rep \\<propto> low) no \\<and> highb no = (rep \\<propto> high) no\"\n              apply -\n              apply (drule Dags_eq_hp_eq)\n              apply auto\n              done\n            have rept_end_dag: \" Dag (rep p) lowb (highb(rep p := pb)) rept\"\n            proof -\n              have \"\\<forall>no \\<in> set_of rept. \n                    lowb no = (rep \\<propto> low) no \\<and> (highb(rep p := pb)) no = (rep \\<propto> high) no\"\n              proof\n                fix no\n                assume no_in_rept: \" no \\<in> set_of rept\"\n                show \"lowb no = (rep \\<propto> low) no \\<and> \n                      (highb(rep p := pb)) no = (rep \\<propto> high) no\"\n                proof (cases \"no \\<in> set_of rrept\")\n                  case True\n                  with lowb_highb_def pb_def show ?thesis\n                    by simp\n                next\n                  assume no_notin_rrept: \" no \\<notin> set_of rrept\"\n                  show ?thesis\n                  proof (cases \"no \\<in> set_of lrept\")\n                    case True\n                    with no_notin_rrept rp_notin_lrept ab_nc\n                    have ab_nc_no: \"lowa no = lowb no \\<and> higha no = highb no\"\n                      apply -\n                      apply (erule_tac x=no in allE)\n                      apply (erule impE)\n                      apply simp\n                      apply (subgoal_tac \"no \\<noteq> rep p\")\n                      apply simp\n                      apply blast\n                      done\n                    from lowa_higha_def True have \n                      \"lowa no = (rep \\<propto> low) no \\<and> higha no = (rep \\<propto> high) no\"\n                      by auto\n                    with ab_nc_no \n                    have \"lowb no = (rep \\<propto> low) no \\<and> highb no =(rep \\<propto> high) no\" \n                      by simp\n                    with rp_notin_lrept True show ?thesis\n                      apply (subgoal_tac \"no \\<noteq> rep p\")\n                      apply simp\n                      apply blast\n                      done\n                  next\n                    assume no_notin_lrept: \" no \\<notin> set_of lrept\"\n                    with no_in_rept rept_def no_notin_rrept have no_rp: \"no = rep p\"\n                      by simp\n                    with rp_notin_lrept low_lowa_nc \n                    have a_nc: \"low no = lowa no \\<and> high no = higha no\"\n                      by auto\n                    from rp_notin_rrept no_rp ab_nc \n                    have \"(lowa(rep p := pa)) no = lowb no \\<and> higha no = highb no\"\n                      by auto\n                    with a_nc pa_def no_rp \n                    have \"(rep \\<propto> low) no = lowb no \\<and> high no = highb no\"\n                      by auto\n                    with pb_def no_rp show ?thesis\n                      by simp\n                  qed\n                qed\n              qed\n              with rept_dag \n              have \"Dag (rep p) lowb (highb(rep p := pb)) rept = \n                    Dag (rep p) (rep \\<propto> low) (rep \\<propto> high) rept\"      \n                apply -\n                apply (rule heaps_eq_Dag_eq)\n                apply auto\n                done\n              with rept_dag p_nNull show ?thesis\n                by simp\n            qed\n            have \"(\\<forall>pt. pt \\<notin> set_of rept \\<longrightarrow> low pt = lowb pt \\<and> \n                        high pt = (highb(rep p := pb)) pt)\"\n            proof (intro allI impI)\n              fix pt\n              assume pt_notin_rept: \"pt \\<notin> set_of rept\"\n              with rept_def obtain\n                pt_notin_lrept: \"pt \\<notin> set_of lrept\" and\n                pt_notin_rrept: \"pt \\<notin> set_of rrept\" and\n                pt_neq_rp: \"pt \\<noteq> rep p\"\n                by simp\n              with low_lowa_nc ab_nc \n              show \"low pt = lowb pt \\<and> high pt = (highb(rep p := pb)) pt\"\n                by auto\n            qed\n            with rept_end_dag show ?thesis\n              by simp\n          qed\n        done\n      qed\n    done\n  qed\nqed\n     \nend\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/BDD/RepointProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5621765008857982, "lm_q2_score": 0.5350984286266115, "lm_q1q2_score": 0.30081976223479745}}
{"text": "(*  Title:       BDD\n\n    Author:      Veronika Ortner and Norbert Schirmer, 2004\n    Maintainer:  Norbert Schirmer,  norbert.schirmer at web de\n    License:     LGPL\n*)\n\n(*  \nShareReduceRepListProof.thy\n\nCopyright (C) 2004 Veronika Ortner and Norbert Schirmer \nSome rights reserved, TU Muenchen\n\nThis library is free software; you can redistribute it and/or modify\nit under the terms of the GNU Lesser General Public License as\npublished by the Free Software Foundation; either version 2.1 of the\nLicense, or (at your option) any later version.\n\nThis library is distributed in the hope that it will be useful, but\nWITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU\nLesser General Public License for more details.\n\nYou should have received a copy of the GNU Lesser General Public\nLicense along with this library; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307\nUSA\n*)\n\nheader {*Proof of Procedure ShareReduceRepList*}\ntheory ShareReduceRepListProof imports ShareRepProof begin\n\nlemma (in ShareReduceRepList_impl) ShareReduceRepList_modifies:\n  shows \"\\<forall>\\<sigma>. \\<Gamma>\\<turnstile>{\\<sigma>}  PROC ShareReduceRepList (\\<acute>nodeslist)\n        {t. t may_only_modify_globals \\<sigma> in [rep]}\"\n  apply (hoare_rule HoarePartial.ProcRec1)\n  apply (vcg spec=modifies)\n  done\n\nlemma hd_filter_app: \"\\<lbrakk>filter P xs \\<noteq> []; zs=xs@ys\\<rbrakk> \\<Longrightarrow> \n       hd (filter P zs) =  hd (filter P xs)\"\n  by (induct xs arbitrary: n m) auto\n\n\nlemma (in ShareReduceRepList_impl) ShareReduceRepList_spec_total: \ndefines \"var_eq \\<equiv> (\\<lambda>ns var. (\\<forall>no1 \\<in> set ns. \\<forall>no2 \\<in> set ns. no1\\<rightarrow>var = no2\\<rightarrow>var))\"\nshows\n  \"\\<forall>\\<sigma> ns. \\<Gamma>\\<turnstile>\\<^sub>t\n   \\<lbrace>\\<sigma>. List \\<acute>nodeslist \\<acute>next ns \\<and>\n       (\\<forall>no \\<in> set ns.\n            no \\<noteq> Null \\<and> ((no\\<rightarrow>\\<acute>low = Null) = (no\\<rightarrow>\\<acute>high = Null)) \\<and> \n             no\\<rightarrow>\\<acute>low \\<notin> set ns \\<and> no\\<rightarrow>\\<acute>high \\<notin> set ns \\<and>\n             (isLeaf_pt no \\<acute>low \\<acute>high = (no\\<rightarrow>\\<acute>var \\<le> 1)) \\<and>\n             (no\\<rightarrow>\\<acute>low \\<noteq> Null \\<longrightarrow> (no\\<rightarrow>\\<acute>low)\\<rightarrow>\\<acute>rep \\<noteq> Null) \\<and>\n             ((\\<acute>rep \\<propto> \\<acute>low) no \\<notin> set ns)) \\<and>\n        var_eq ns \\<acute>var\\<rbrace> \n    PROC  ShareReduceRepList (\\<acute>nodeslist)\n   \\<lbrace>(\\<forall>no. no \\<notin> set ns \\<longrightarrow> no\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>rep = no\\<rightarrow>\\<acute>rep)  \\<and>\n    (\\<forall>no \\<in> set ns. no\\<rightarrow>\\<acute>rep \\<noteq> Null \\<and> \n      (if ((\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) no = (\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>high) no \\<and> no\\<rightarrow> \\<^bsup>\\<sigma>\\<^esup>low \\<noteq> Null) \n       then (no\\<rightarrow>\\<acute>rep = (\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) no )\n       else ((no\\<rightarrow>\\<acute>rep) \\<in> set ns \\<and> no\\<rightarrow>\\<acute>rep\\<rightarrow>\\<acute>rep = no\\<rightarrow>\\<acute>rep \\<and> \n             (\\<forall> no1 \\<in> set ns. \n                 ((\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>high) no1 = (\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>high) no \\<and> \n                 (\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) no1 = (\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) no) = (no\\<rightarrow>\\<acute>rep = no1\\<rightarrow>\\<acute>rep)))))\\<rbrace>\"\napply (hoare_rule HoareTotal.ProcNoRec1)\napply (hoare_rule anno=\n       \" \\<acute>node :== \\<acute>nodeslist;;\n         WHILE (\\<acute>node \\<noteq> Null ) \n         INV \\<lbrace>\\<exists>prx sfx. List \\<acute>node \\<acute>next sfx \\<and> \n              List \\<acute>nodeslist \\<acute>next ns \\<and> ns=prx@sfx \\<and> \n              (\\<forall>no \\<in> set ns.\n                 no \\<noteq> Null \\<and> ((no\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>low = Null) = (no\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>high = Null)) \\<and> \n                 no\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>low \\<notin> set ns \\<and> no\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>high \\<notin> set ns \\<and>\n                 (isLeaf_pt no  \\<^bsup>\\<sigma>\\<^esup>low \\<^bsup>\\<sigma>\\<^esup>high = (no\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>var \\<le> 1)) \\<and>\n                 (no\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>low \\<noteq> Null \\<longrightarrow> (no\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>low)\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>rep \\<noteq> Null) \\<and>\n                 ((\\<^bsup>\\<sigma>\\<^esup>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) no  \\<notin> set ns)) \\<and>\n              var_eq ns \\<acute>var \\<and>\n              (\\<forall>no.  no \\<notin> set prx \\<longrightarrow> no\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>rep = no \\<rightarrow>\\<acute>rep)  \\<and>\n              (\\<forall> no \\<in> set prx. no\\<rightarrow>\\<acute>rep \\<noteq> Null \\<and> \n               (if ((\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) no = (\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>high) no \\<and> no\\<rightarrow>\\<^bsup>\\<sigma>\\<^esup>low \\<noteq> Null) \n                then (no\\<rightarrow>\\<acute>rep = (\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) no )\n                else ((no\\<rightarrow>\\<acute>rep)=hd (filter (\\<lambda>sn. repNodes_eq sn no \\<^bsup>\\<sigma>\\<^esup>low \\<^bsup>\\<sigma>\\<^esup>high \\<acute>rep) \n                                     prx) \\<and> \n                     ((no\\<rightarrow>\\<acute>rep)\\<rightarrow>\\<acute>rep) = no\\<rightarrow>\\<acute>rep \\<and> \n                     (\\<forall>no1 \\<in> set prx. \n                        ((\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>high) no1 = (\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>high) no \\<and> \n                         (\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) no1 = (\\<acute>rep \\<propto> \\<^bsup>\\<sigma>\\<^esup>low) no) = \n                         (no\\<rightarrow>\\<acute>rep = no1\\<rightarrow>\\<acute>rep))))) \\<and>\n                 \\<acute>nodeslist= \\<^bsup>\\<sigma>\\<^esup>nodeslist \\<and> \\<acute>high=\\<^bsup>\\<sigma>\\<^esup>high \\<and> \\<acute>low=\\<^bsup>\\<sigma>\\<^esup>low \\<and> \\<acute>var=\\<^bsup>\\<sigma>\\<^esup>var\\<rbrace>\n         VAR MEASURE (length (list \\<acute>node \\<acute>next))\n         DO\n         IF (\\<not> isLeaf_pt \\<acute>node \\<acute>low \\<acute>high \\<and> \n            \\<acute>node \\<rightarrow> \\<acute>low \\<rightarrow> \\<acute>rep = \\<acute>node \\<rightarrow> \\<acute>high \\<rightarrow> \\<acute>rep )\n         THEN \\<acute>node \\<rightarrow> \\<acute>rep :== \\<acute>node \\<rightarrow> \\<acute>low \\<rightarrow> \\<acute>rep\n         ELSE CALL ShareRep (\\<acute>nodeslist , \\<acute>node)   \n         FI;;\n         \\<acute>node :==\\<acute>node \\<rightarrow> \\<acute>next\n         OD\" in HoareTotal.annotateI)\napply (vcg spec=spec_total)\napply   (rule_tac x=\"[]\" in exI)\napply   (rule_tac x=\"ns\" in exI)\nusing [[simp_depth_limit = 2]]\napply   (simp (no_asm_use))\nprefer 2\nusing [[simp_depth_limit = 4]]\napply (clarsimp)\nprefer 2\napply  (rule conjI)\napply   clarify\napply   (rule conjI)\napply    (clarsimp simp add: List_list) (* termination *)\napply   (simp only: List_not_Null simp_thms triv_forall_equality)\napply   clarify\napply   (simp only: triv_forall_equality)\napply   (rename_tac sfx)\napply   (rule_tac x=\"prx@[node]\" in exI)\napply   (rule_tac x=\"sfx\" in exI)\napply   (rule conjI)\napply    assumption\napply   (rule conjI)\napply    (simp (no_asm))\napply   (rule conjI)\napply    (assumption)\nprefer 2\napply   clarify\napply   (simp only: List_not_Null simp_thms triv_forall_equality)\napply   clarify\napply   (simp only: triv_forall_equality)\napply   (rename_tac sfx)\napply   (rule_tac x=\"prx@node#sfx\" in exI) (* Precondition for ShareRep *)\napply   (rule conjI)\napply    assumption\napply   (rule conjI)\napply    (rule ballI)\napply    (frule_tac x=no in bspec, assumption)\napply    (drule_tac x=node in bspec)\napply     (simp (no_asm_use))\napply    (elim conjE)\napply    (rule conjI)\napply     assumption\napply    (rule conjI)\napply     assumption\napply    (unfold var_eq_def)\napply    (drule_tac x=node in bspec, simp)\napply    (drule_tac x=no in bspec,assumption)\napply    (simp add: isLeaf_pt_def )\napply   (rule conjI)\napply    (simp (no_asm))\napply   (clarify)\napply   (rule conjI)\napply    (subgoal_tac \"List node next (node#sfx)\") (* termination *)\napply     (simp only: List_list)\napply     (simp (no_asm))\napply    (simp (no_asm_simp))\napply   (rule_tac x=\"prx@[node]\" in exI)\napply   (rule_tac x=\"sfx\" in exI)\napply   (rule conjI)\napply    assumption\napply   (rule conjI)\napply    (simp (no_asm))\napply   (rule conjI)\napply    (assumption)\nusing [[simp_depth_limit = 100]]\nproof - (* From invariant to postcondition *)\n  fix var low high rep nodeslist ns repa \"next\" no\n  assume ns: \"List nodeslist next ns\"\n  assume no_in_ns: \"no \\<in> set ns\"\n  assume while_inv: \"\\<forall>no\\<in>set ns.\n           repa no \\<noteq> Null \\<and>\n           (if (repa \\<propto> low) no = (repa \\<propto> high) no \\<and> high no \\<noteq> Null\n            then repa no = (repa \\<propto> low) no\n            else repa no = hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa] \\<and>\n                 repa (repa no) = repa no \\<and>\n                 (\\<forall>no1\\<in>set ns.\n                     ((repa \\<propto> high) no1 = (repa \\<propto> high) no \\<and>\n                      (repa \\<propto> low) no1 = (repa \\<propto> low) no) =\n                     (repa no = repa no1)))\"\n  assume pre: \"\\<forall>no\\<in>set ns.\n           no \\<noteq> Null \\<and>\n           (low no = Null) = (high no = Null) \\<and>\n           low no \\<notin> set ns \\<and>\n           high no \\<notin> set ns \\<and>\n           isLeaf_pt no low high = (var no \\<le> Suc 0) \\<and>\n           (low no \\<noteq> Null \\<longrightarrow> rep (low no) \\<noteq> Null) \\<and> (rep \\<propto> low) no \\<notin> set ns\"\n  assume same_var: \"\\<forall>no1\\<in>set ns. \\<forall>no2\\<in>set ns. var no1 = var no2\"\n  assume share_case: \"(repa \\<propto> low) no = (repa \\<propto> high) no \\<longrightarrow> high no = Null\"\n  assume unmodif: \"\\<forall>no. no \\<notin> set ns \\<longrightarrow> rep no = repa no\"\n  show \"hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa] \\<in> set ns \\<and>\n        repa (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) =\n        hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]\"\n  proof -\n    from no_in_ns pre obtain\n      no_nNull: \" no \\<noteq> Null\" and\n      no_balanced: \"(low no = Null) = (high no = Null)\" and\n      isLeaf_var: \"isLeaf_pt no low high = (var no \\<le> Suc 0)\"\n      by blast\n    have repNodes_eq_same_node: \"repNodes_eq no no low high repa\"\n      by (simp add: repNodes_eq_def)\n    from no_in_ns have ns_nempty: \"ns \\<noteq> []\"\n      by auto\n    from no_in_ns repNodes_eq_same_node \n    have repNodes_not_empty: \"[sn\\<leftarrow>ns . repNodes_eq sn no low high repa] \\<noteq> []\"\n      by (rule filter_not_empty)\n    then have hd_term_in_ns: \"hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa] \\<in> set ns\"\n      by (rule hd_filter_in_list)\n    with while_inv obtain \n      repa_hd_nNull: \"repa  (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) \\<noteq> Null\"\n      by auto\n    let ?hd = \"hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]\"\n    from hd_term_in_ns  pre obtain\n      hd_nNull: \" ?hd \\<noteq> Null\" and\n      hd_balanced: \n        \"(low (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) = Null) = \n         (high (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) = Null)\" and\n      hd_isLeaf_var: \n      \"isLeaf_pt (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) low high = \n      (var (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) \\<le> Suc 0)\"\n      by blast\n    have \"repa (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) = \n      hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]\"\n    proof (cases \"high no = Null\")\n      case True\n      with no_balanced have \"low no = Null\"\n        by simp\n      with True have no_Leaf: \"isLeaf_pt no low high\"\n        by (simp add: isLeaf_pt_def)\n      with isLeaf_var have varno: \"var no <= 1\"\n        by simp\n      from same_var [rule_format, OF no_in_ns hd_term_in_ns] varno\n      have \"var (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) \\<le> 1\"\n        by simp\n      with hd_isLeaf_var have \n        \"isLeaf_pt (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) low high\"\n        by simp\n      with while_inv hd_term_in_ns repNodes_not_empty show ?thesis\n        apply (simp add: isLeaf_pt_def)\n        apply (erule_tac x=\n          \"hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]\" in ballE)\n        prefer 2\n        apply simp\n        apply (simp (no_asm_use) add: repNodes_eq_def)\n        apply (rule filter_hd_P_rep_indep)\n        apply   (simp (no_asm_simp))\n        apply  (simp (no_asm_simp))\n        apply assumption\n        done\n    next\n      assume hno_nNull:  \"high no \\<noteq> Null\"\n      with share_case have repchildren_neq: \"(repa \\<propto> low) no \\<noteq> (repa \\<propto> high) no\"\n        by simp\n      from repNodes_not_empty have \n        \"repNodes_eq  (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) no low high repa\"\n        by (rule hd_filter_prop)\n      then \n      have \"(repa \\<propto> low) (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) = \n              (repa \\<propto> low) no \\<and> \n            (repa \\<propto> high) (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]) = \n              (repa \\<propto> high) no\"\n        by (simp add: repNodes_eq_def)\n      with repchildren_neq have \n        \"(repa \\<propto> low) (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa])\n        \\<noteq> (repa \\<propto> high) (hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa])\"\n        by simp\n      with while_inv hd_term_in_ns repNodes_not_empty show ?thesis\n        apply (simp add: isLeaf_pt_def)\n        apply (erule_tac x=\n          \"hd [sn\\<leftarrow>ns . repNodes_eq sn no low high repa]\" in ballE)\n        prefer 2\n        apply simp\n        apply (simp (no_asm_use) add: repNodes_eq_def)\n        apply (rule filter_hd_P_rep_indep)\n        apply simp\n        apply fastforce\n        apply fastforce\n        done\n    qed\n    with hd_term_in_ns\n    show ?thesis\n      by simp\n  qed\nnext\n  (* invariant to invariant, THEN part  --  REDUCING*)\n  fix var low high rep nodeslist repa \"next\" node prx sfx\n  assume ns: \"List nodeslist next (prx @ node # sfx)\"\n  assume sfx: \"List (next node) next sfx\"\n  assume node_not_Null: \"node \\<noteq> Null\"\n  assume nodes_balanced_ordered: \"\\<forall>no\\<in>set (prx @ node # sfx).\n           no \\<noteq> Null \\<and>\n           (low no = Null) = (high no = Null) \\<and>\n           low no \\<notin> set (prx @ node # sfx) \\<and>\n           high no \\<notin> set (prx @ node # sfx) \\<and>\n           isLeaf_pt no low high = (var no \\<le> (1::nat)) \\<and>\n           (low no \\<noteq> Null \\<longrightarrow> rep (low no) \\<noteq> Null) \\<and>\n           (rep \\<propto> low) no \\<notin> set (prx @ node # sfx)\"\n  assume all_nodes_same_var: \"\\<forall>no1\\<in>set (prx @ node # sfx).\n           \\<forall>no2\\<in>set (prx @ node # sfx). var no1 = var no2\"\n  assume rep_repa_nc: \"\\<forall>no. no \\<notin> set prx \\<longrightarrow> rep no = repa no\"\n  assume while_inv: \"\\<forall>no\\<in>set prx.\n           repa no \\<noteq> Null \\<and>\n           (if (repa \\<propto> low) no = (repa \\<propto> high) no \\<and> low no \\<noteq> Null\n            then repa no = (repa \\<propto> low) no\n            else repa no = hd [sn\\<leftarrow>prx . repNodes_eq sn no low high repa] \\<and>\n                 repa (repa no) = repa no \\<and>\n                 (\\<forall>no1\\<in>set prx.\n                     ((repa \\<propto> high) no1 = (repa \\<propto> high) no \\<and>\n                      (repa \\<propto> low) no1 = (repa \\<propto> low) no) =\n                     (repa no = repa no1)))\"\n  assume not_Leaf: \"\\<not> isLeaf_pt node low high\" \n  assume repchildren_eq_nln: \"repa (low node) = repa (high node)\"\n  show \"(\\<forall>no. no \\<notin> set (prx @ [node]) \\<longrightarrow>\n                rep no = (repa(node := repa (high node))) no) \\<and>\n        (\\<forall>no\\<in>set (prx @ [node]).\n              (repa(node := repa (high node))) no \\<noteq> Null \\<and>\n              (if (repa(node := repa (high node)) \\<propto> low) no =\n                  (repa(node := repa (high node)) \\<propto> high) no \\<and>\n                  low no \\<noteq> Null\n               then (repa(node := repa (high node))) no =\n                    (repa(node := repa (high node)) \\<propto> low) no\n               else (repa(node := repa (high node))) no =\n                    hd [sn\\<leftarrow>prx @ [node] .\n                        repNodes_eq sn no low high\n                         (repa(node := repa (high node)))] \\<and>\n                    (repa(node := repa (high node)))\n                     ((repa(node := repa (high node))) no) =\n                    (repa(node := repa (high node))) no \\<and>\n                    (\\<forall>no1\\<in>set (prx @ [node]).\n                        ((repa(node := repa (high node)) \\<propto> high) no1 =\n                         (repa(node := repa (high node)) \\<propto> high) no \\<and>\n                         (repa(node := repa (high node)) \\<propto> low) no1 =\n                         (repa(node := repa (high node)) \\<propto> low) no) =\n                        ((repa(node := repa (high node))) no =\n                         (repa(node := repa (high node))) no1))))\"\n    (is \"?NodesUnmodif \\<and> ?NodesModif\")\n  proof -\n    -- {* This proof was originally conducted without the\n          substitution @{term \"repa (low node) = repa (high node)\"} preformed.\n          So don't be confused if we show everythin for @{text \"repa (low node)\"}. *}\n    from rep_repa_nc\n    have nodes_unmodif: ?NodesUnmodif\n      by auto\n    hence rep_Sucna_nc:\n      \"(\\<forall>no. no \\<notin> set (prx @ [node]) \n      \\<longrightarrow> rep no = (repa(node := repa (low (node )))) no)\"\n      by auto\n    have nodes_modif: ?NodesModif (is \"\\<forall>no\\<in>set (prx @ [node]). ?P no \\<and> ?Q no\")\n    proof (rule ballI)\n      fix no\n      assume no_in_take_Sucna: \" no \\<in> set (prx @ [node])\"\n      show \"?P no \\<and> ?Q no\"\n      proof (cases \"no = node\")\n        case False\n        note no_noteq_nln=this\n        with no_in_take_Sucna \n        have no_in_take_n: \"no \\<in> set prx\"\n          by auto\n        with no_in_take_n while_inv obtain \n          repa_no_nNull: \" repa no \\<noteq> Null\" and\n          repa_cases: \"(if (repa \\<propto> low) no = (repa \\<propto> high) no \\<and> low no \\<noteq> Null \n          then repa no = (repa \\<propto> low) no\n          else  repa no = hd [sn\\<leftarrow>prx . repNodes_eq sn no low high repa] \n          \\<and> repa (repa no) = repa no \\<and> \n          (\\<forall>no1\\<in>set prx. ((repa \\<propto> high) no1 = (repa \\<propto> high) no \n          \\<and> (repa \\<propto> low) no1 = (repa \\<propto> low) no) \n          = (repa no = repa no1)))\"\n          using [[simp_depth_limit = 2]]\n          by auto \n        from no_in_take_n \n        have no_in_nodeslist: \"no \\<in> set (prx @ node # sfx)\"\n          by auto\n        from repa_no_nNull no_noteq_nln have ext_repa_nNull: \"?P no\"\n          by auto\n        from no_in_nodeslist nodes_balanced_ordered obtain\n          nln_nNull: \"node \\<noteq> Null\" and\n          nln_balanced_children: \"(low node = Null) = (high node = Null)\" and\n          lnln_notin_nodeslist: \"low node \\<notin> set (prx @ node # sfx)\" and\n          hnln_notin_nodeslist: \"high node \\<notin> set (prx @ node # sfx)\" and\n          isLeaf_var_nln: \"isLeaf_pt node low high = (var node \\<le> 1)\" and\n          node_nNull_rap_nNull_nln: \"(low node \\<noteq> Null \n          \\<longrightarrow> rep (low node) \\<noteq> Null)\" and\n          nln_varrep_le_var: \"(rep \\<propto> low) node \\<notin> set (prx @ node # sfx)\"\n          apply (erule_tac x=\"node\" in ballE)\n          apply auto\n          done\n        from  no_in_nodeslist nodes_balanced_ordered no_in_take_Sucna \n        obtain \n          no_nNull: \"no \\<noteq> Null\" and\n          balanced_children: \"(low no = Null) = (high no = Null)\" and\n          lno_notin_nodeslist: \"low no \\<notin> set (prx @ node # sfx)\" and\n          hno_notin_nodeslist: \"high no \\<notin> set (prx @ node # sfx)\" and\n          isLeaf_var_no: \"isLeaf_pt no low high = (var no \\<le> 1)\" and\n          node_nNull_rep_nNull: \"(low no \\<noteq> Null \\<longrightarrow> rep (low no) \\<noteq> Null)\" and\n          varrep_le_var: \"(rep \\<propto> low) no \\<notin> set (prx @ node # sfx)\"\n          apply -\n          apply (erule_tac x=no in ballE)\n          apply auto\n          done\n        from lno_notin_nodeslist  \n        have ext_rep_null_comp_low: \n          \"(repa (node := repa (low node)) \\<propto> low) no = (repa \\<propto> low) no\"\n          by (auto simp add: null_comp_def)\n        from hno_notin_nodeslist \n        have ext_rep_null_comp_high: \n          \"(repa (node := repa (low node)) \\<propto> high) no = (repa \\<propto> high) no\"\n          by (auto simp add: null_comp_def)\n        have share_reduce_if: \"?Q no\"\n        proof (cases \"(repa (node := repa (low node)) \\<propto> low) no = \n            (repa(node := repa (low node)) \\<propto> high) no \\<and> low no \\<noteq> Null\")\n          case True\n          then obtain \n            red_case: \"(repa (node := repa (low node)) \\<propto> low) no = \n            (repa(node := repa (low node)) \\<propto> high) no\" and\n            lno_nNull: \"low no \\<noteq> Null\"\n            by simp\n          from lno_nNull balanced_children have hno_nNull: \"high no \\<noteq> Null\"\n            by simp\n          from True ext_rep_null_comp_low ext_rep_null_comp_high \n          have repchildren_eq_no: \"(repa \\<propto> low) no = (repa \\<propto> high) no\"\n            by simp\n          with repa_cases lno_nNull have \"repa no = (repa \\<propto> low) no\"\n            by auto\n          with ext_rep_null_comp_low no_noteq_nln \n          have \"(repa(node := repa (low node))) no = \n            (repa (node := repa (low node)) \\<propto> low) no\"\n            by simp\n          with True repchildren_eq_nln show ?thesis\n            by auto\n        next\n          assume share_case_ext: \n            \" \\<not> ((repa(node := repa (low node)) \\<propto> low) no = \n            (repa(node := repa (low node)) \\<propto> high) no \\<and> low no \\<noteq> Null)\"\n          from not_Leaf isLeaf_var_nln \n          have \"1 < var node\"\n            by simp\n          with all_nodes_same_var \n          have all_nodes_nl_Suc0_l_var: \"\\<forall>x \\<in> set (prx @ node # sfx). 1 < var x\"\n            using [[simp_depth_limit=1]]\n            by auto\n          with nodes_balanced_ordered \n          have all_nodes_nl_noLeaf: \n            \"\\<forall>x \\<in> set (prx @ node # sfx). \\<not> isLeaf_pt x low high\"\n            apply -\n            apply rule\n            apply (drule_tac x=x in bspec,assumption)\n            apply (drule_tac x=x in bspec,assumption)\n            apply auto\n            done\n          from nodes_balanced_ordered \n          have all_nodes_nl_balanced: \n            \"\\<forall>x \\<in> set (prx @ node # sfx). (low x = Null) = (high x = Null)\"\n            apply -\n            apply rule\n            apply (drule_tac x=x in bspec,assumption)\n            apply auto\n            done\n          from all_nodes_nl_Suc0_l_var no_in_nodeslist \n          have Suc0_l_var_no: \"1 < var no\"\n            by auto\n          with isLeaf_var_no have no_nLeaf: \" \\<not> isLeaf_pt no low high\"\n            by simp\n          with balanced_children have lno_nNull: \"low no \\<noteq> Null\"\n            by (simp add: isLeaf_pt_def)\n          with balanced_children have hno_nNull: \"high no \\<noteq> Null\"\n            by simp\n          with share_case_ext ext_rep_null_comp_low ext_rep_null_comp_high lno_nNull \n          have repchildren_neq_no: \"(repa \\<propto> low) no \\<noteq> (repa \\<propto> high) no\"\n            by (simp add: null_comp_def)\n          with repa_cases \n          have share_case_inv: \n          \"repa no = hd [sn\\<leftarrow>prx . repNodes_eq sn no low high repa] \\<and> \n            repa (repa no) = repa no \\<and> \n            (\\<forall>no1\\<in>set prx. ((repa \\<propto> high) no1 = (repa \\<propto> high) no \\<and> \n            (repa \\<propto> low) no1 = (repa \\<propto> low) no) = (repa no = repa no1))\"\n            by auto\n          then have repa_no: \"repa no = hd [sn\\<leftarrow>prx . repNodes_eq sn no low high repa]\"\n            by simp\n          from Suc0_l_var_no have \"\\<forall>x \\<in> set (prx @ node # sfx). 1 < var no\"\n            by auto\n          from no_in_take_n have \"[sn\\<leftarrow>prx . repNodes_eq sn no low high repa] \\<noteq> []\"\n            apply -\n            apply (rule filter_not_empty)\n            apply (auto simp add: repNodes_eq_def)\n            done\n          then have \"repNodes_eq \n            (hd [sn\\<leftarrow>prx. repNodes_eq sn no low high repa]) no low high repa\"\n            by (rule hd_filter_prop)\n          with repa_no \n          have rep_children_eq_no_repa_no: \n            \"(repa \\<propto> low) (repa no) = (repa \\<propto> low) no \\<and> \n             (repa \\<propto> high) (repa no) = (repa \\<propto> high) no\"\n            by (simp add: repNodes_eq_def) \n          from lno_notin_nodeslist rep_repa_nc \n          have rep_repa_nc_low_no: \"rep (low no) = repa (low no)\"\n            apply -\n            apply (erule_tac x=\"low no\" in allE)\n            apply auto\n            done\n          have \"\\<forall>x \\<in> set (prx @ [node]). \n            repNodes_eq x no low high (repa(node := repa (low node))) = \n            repNodes_eq x no low high repa\"\n          proof (rule ballI, unfold repNodes_eq_def)\n            fix x\n            assume x_in_take_Sucn: \" x \\<in> set (prx @ [node])\"\n            hence x_in_nodeslist: \"x \\<in> set (prx @ node # sfx)\"\n              by auto\n            with all_nodes_nl_noLeaf nodes_balanced_ordered \n            have children_nNull_x: \"low x \\<noteq> Null \\<and> high x \\<noteq> Null\"\n              apply -\n              apply (drule_tac x=x in bspec,assumption)\n              apply (drule_tac x=x in bspec,assumption)\n              apply (auto simp add: isLeaf_pt_def) \n              done\n            from x_in_nodeslist nodes_balanced_ordered \n            have \"low x \\<notin> set (prx @ node # sfx) \\<and> high x \\<notin> set (prx @ node # sfx)\"\n              apply -\n              apply (drule_tac x=x in bspec,assumption)\n              apply auto\n              done\n            with lno_notin_nodeslist hno_notin_nodeslist \n              children_nNull_x lno_nNull hno_nNull\n            show \"((repa(node := repa (low node)) \\<propto> high) x = \n              (repa(node := repa (low node)) \\<propto> high) no \\<and>\n              (repa(node := repa (low node)) \\<propto> low) x = \n              (repa(node := repa (low node)) \\<propto> low) no) =\n              ((repa \\<propto> high) x = (repa \\<propto> high) no \\<and> \n              (repa \\<propto> low) x = (repa \\<propto> low) no)\"\n              by (simp add: null_comp_def)\n          qed\n          then have filter_extrep_rep: \n            \"[sn\\<leftarrow>(prx @ [node]). repNodes_eq sn no low high \n                                   (repa(node := repa (low node)))] = \n            [sn\\<leftarrow>(prx @ [node]) . repNodes_eq sn no low high repa]\"\n            by (rule P_eq_list_filter)\n          from no_in_take_n \n          have filter_n_notempty: \"[sn\\<leftarrow>prx. repNodes_eq sn no low high repa] \\<noteq> []\"\n            apply (rule filter_not_empty)\n            apply (simp add: repNodes_eq_def)\n            done\n          then have \"hd [sn\\<leftarrow>prx. repNodes_eq sn no low high repa] = \n            hd [sn\\<leftarrow>prx@[node]. repNodes_eq sn no low high repa]\"\n            by auto\n          with no_noteq_nln filter_extrep_rep repa_no \n          have ext_repa_no: \"(repa(node:= repa (low node))) no = \n            hd [sn\\<leftarrow>prx@[node] . repNodes_eq sn no low high \n            (repa(node := repa (low node)))]\"\n            by simp\n          have \"(repa(node := repa (low node))) (repa no) = repa no\"\n          proof (cases \"repa no =  node\")\n            case True\n            note rno_nln=this\n            from rep_repa_nc_low_no rep_children_eq_no_repa_no lno_nNull \n              node_nNull_rep_nNull \n            have low_rep_no_nNull: \"low (repa no) \\<noteq> Null\"\n              apply (simp add: null_comp_def)\n              apply auto\n              done\n            with nodes_balanced_ordered rno_nln \n            have high_rap_no_nNull: \"high (repa no) \\<noteq> Null\"\n              apply -\n              apply (drule_tac x=\"repa no\" in bspec)\n              apply auto\n              done\n            with low_rep_no_nNull rno_nln rep_children_eq_no_repa_no \n            have \"repa (low node) = (repa \\<propto> low) no \\<and> \n              repa (high node) = (repa \\<propto> high) no\" \n              by (simp add: null_comp_def)\n            with repchildren_eq_nln have \" (repa \\<propto> low) no = (repa \\<propto> high) no\"\n              by simp\n            with repchildren_neq_no show ?thesis\n              by simp\n          next\n            assume rno_not_nln: \"repa no \\<noteq> node\"\n            from share_case_inv have \"repa (repa no) = repa no\"\n              by auto\n            with rno_not_nln show ?thesis\n              by simp\n          qed\n          with no_noteq_nln have ext_repa_ext_repa: \n            \"(repa(node := repa (low node))) \n            ((repa(node := repa (low node))) no) \n            = (repa(node := repa (low node))) no\" \n            by simp\n          have \"(\\<forall>no1\\<in>set (prx@[node]).\n            ((repa(node := repa (low node)) \\<propto> high) no1 = \n            (repa(node  := repa (low node)) \\<propto> high) no \\<and>\n            (repa(node  := repa (low node)) \\<propto> low) no1 = \n            (repa(node  := repa (low node)) \\<propto> low) no) =\n            ((repa(node  := repa (low node))) no = \n            (repa(node  := repa (low node))) no1))\"\n          proof (rule ballI)\n            fix no1\n            assume no1_in_take_Sucn: \" no1 \\<in> set (prx@[node])\"\n            hence no1_in_nodeslist: \"no1 \\<in> set (prx @ node # sfx)\"\n              by auto\n            show \"((repa(node := repa (low node)) \\<propto> high) no1 = \n                 (repa(node := repa (low node)) \\<propto> high) no \\<and>\n                 (repa(node := repa (low node)) \\<propto> low) no1 = \n                 (repa(node := repa (low node)) \\<propto> low) no) =\n                 ((repa(node := repa (low node))) no = \n                  (repa(node := repa (low node))) no1)\"\n            proof (cases \"no1 = node\")\n              case True\n              show ?thesis\n              proof (rule, elim conjE)\n                assume ext_repa_no_no1: \n                  \"(repa(node := repa (low node))) no = \n                    (repa(node := repa (low node))) no1\"\n                with True no_noteq_nln \n                have repa_no_repa_low_nln: \"repa no = repa (low node)\"\n                  by simp\n                from filter_n_notempty \n                have repa_no_in_take_n:  \n                  \"hd [sn\\<leftarrow>prx. repNodes_eq sn no low high repa] \n                    \\<in> set prx \"\n                  apply -\n                  apply (rule hd_filter_in_list)\n                  apply auto\n                  done\n                with repa_no \n                have repa_no_in_nodeslist: \"repa no \\<in> set (prx @ node # sfx)\"\n                  by auto\n                from lnln_notin_nodeslist rep_repa_nc \n                have rep_repa_low_nln: \"rep (low node) = repa (low node)\"\n                  by auto\n                from all_nodes_nl_noLeaf nln_balanced_children\n                have \"low node \\<noteq> Null\"\n                  by (auto simp add: isLeaf_pt_def)\n                with rep_repa_low_nln lnln_notin_nodeslist lno_nNull \n                  nln_varrep_le_var \n                have \"repa (low node) \\<notin> set (prx @ node # sfx)\"\n                  by (simp add: null_comp_def) \n                with repa_no_repa_low_nln repa_no_in_nodeslist \n                show \"(repa(node := repa (low node)) \\<propto> high) no1 = \n                  (repa(node := repa (low node)) \\<propto> high) no \\<and>\n                  (repa(node := repa (low node)) \\<propto> low) no1 = \n                  (repa(node := repa (low node)) \\<propto> low) no\"\n                  by simp\n              next\n                assume no_no1_high: \n                  \"(repa(node := repa (low node)) \\<propto> high) no1 = \n                  (repa(node := repa (low node)) \\<propto> high) no\"\n                assume no_no1_low: \n                  \"(repa(node := repa (low node)) \\<propto> low) no1 = \n                  (repa(node := repa (low node)) \\<propto> low) no\"\n                from True repchildren_eq_nln \n                have repachildren_eq_no1: \" repa (low no1) = repa (high no1)\"\n                  by simp\n                from not_Leaf True nln_balanced_children \n                have children_nNull_no1: \"(low no1) \\<noteq> Null \\<and> high no1 \\<noteq> Null\"\n                  by (simp add: isLeaf_pt_def)\n                with repachildren_eq_no1 \n                have repchildren_eq_no1: \"(repa \\<propto> low) no1 = (repa \\<propto> high) no1\"\n                  by (simp add: null_comp_def)\n                from no_no1_low children_nNull_no1 lno_nNull \n                  lnln_notin_nodeslist lno_notin_nodeslist True \n                have rep_low_eq_no_no1: \"(repa \\<propto> low) no1 = (repa \\<propto> low) no\"\n                  by (simp add: null_comp_def)\n                from no_no1_high children_nNull_no1 hno_nNull \n                  hnln_notin_nodeslist hno_notin_nodeslist True \n                have rep_high_eq_no_no1: \"(repa \\<propto> high) no1 = (repa \\<propto> high) no\"\n                  by (simp add: null_comp_def)\n                with rep_low_eq_no_no1 repchildren_eq_no1 \n                have \"(repa \\<propto> low) no = (repa \\<propto> high) no\"\n                  by simp\n                with repchildren_neq_no \n                show \"(repa(node := repa (low node))) no = \n                  (repa(node := repa (low node))) no1\"\n                  by simp\n              qed\n            next\n              assume no1_neq_nln: \"no1 \\<noteq> node\"\n              from no1_in_nodeslist nodes_balanced_ordered \n              have children_notin_nl_no1: \n              \"low no1 \\<notin> set (prx @ node # sfx) \\<and> high no1 \\<notin> set (prx @ node # sfx)\"\n                apply -\n                apply (drule_tac x=no1 in bspec,assumption)\n                by auto\n              from no1_neq_nln no1_in_take_Sucn \n              have no1_in_take_n: \"no1 \\<in> set prx\"\n                by auto\n              from no1_in_nodeslist all_nodes_nl_noLeaf all_nodes_nl_balanced \n              have children_nNull_no1: \"(low no1) \\<noteq> Null \\<and> high no1 \\<noteq> Null\"\n                by  (auto simp add: isLeaf_pt_def)\n              show ?thesis\n              proof (rule, elim conjE)\n                assume ext_repa_high_no1_no: \n                \"(repa(node := repa (low node)) \\<propto> high) no1 \n                  = (repa(node := repa (low node)) \\<propto> high) no\" \n                assume ext_repa_low_no1_no: \n                  \"(repa(node := repa (low node)) \\<propto> low) no1 \n                  = (repa(node := repa (low node)) \\<propto> low) no\"\n                from children_nNull_no1 hno_nNull ext_repa_high_no1_no \n                  children_notin_nl_no1 \n                  hno_notin_nodeslist \n                have repa_high_no1_no: \"(repa \\<propto> high) no1 = (repa \\<propto> high) no\"\n                  by (simp add: null_comp_def)\n                from children_nNull_no1 lno_nNull ext_repa_low_no1_no \n                  children_notin_nl_no1 lno_notin_nodeslist \n                have repa_low_no1_no: \"(repa \\<propto> low) no1 = (repa \\<propto> low) no\"\n                  by (simp add: null_comp_def)\n                from repchildren_neq_no repa_high_no1_no repa_low_no1_no \n                have \"(repa \\<propto> low) no1 \\<noteq> (repa \\<propto> high) no1\"\n                  by simp\n                from no1_in_take_n share_case_inv repa_high_no1_no repa_low_no1_no \n                have \"repa no = repa no1\"\n                  by auto\n                with no_noteq_nln no1_neq_nln \n                show \" (repa(node := repa (low node))) no = \n                  (repa(node := repa (low node))) no1\"\n                  by simp\n              next\n                assume \"(repa(node := repa (low node))) no = \n                  (repa(node := repa (low node))) no1\"\n                with no_noteq_nln no1_neq_nln \n                have \"repa no = repa no1\"\n                  by simp\n                with share_case_inv no1_in_take_n \n                have \"((repa \\<propto> high) no1 = (repa \\<propto> high) no \\<and> \n                  (repa \\<propto> low) no1 = (repa \\<propto> low) no)\"\n                  by auto\n                with children_notin_nl_no1 children_nNull_no1 lno_notin_nodeslist \n                  hno_notin_nodeslist lno_nNull hno_nNull \n                show \"(repa(node := repa (low node)) \\<propto> high) no1 = \n                (repa(node := repa (low node)) \\<propto> high) no \\<and>\n                (repa(node := repa (low node)) \\<propto> low) no1 = \n                (repa(node := repa (low node)) \\<propto> low) no\"\n                  by (auto simp add: null_comp_def)\n              qed \n            qed\n          qed\n          from ext_repa_ext_repa ext_repa_no share_case_ext repchildren_eq_nln this \n          show ?thesis\n            using [[simp_depth_limit=4]]\n            by auto \n        qed\n        with ext_repa_nNull show ?thesis\n          by auto\n      next\n        assume no_nln: \"no = node\"\n        hence no_in_nodeslist: \"no \\<in> set (prx @ node # sfx)\"\n          by simp\n        from no_nln not_Leaf no_in_nodeslist \n          nodes_balanced_ordered [rule_format, OF this] obtain  \n          low_no_nNull: \"low no \\<noteq> Null\" and\n          high_no_nNull: \"high no \\<noteq> Null\" and\n          rep_low_no_nNull: \"rep (low no) \\<noteq> Null\" and\n          lno_notin_nl: \"low no \\<notin> set (prx @ node # sfx)\" and\n          hno_notin_nl: \"high no \\<notin> set (prx @ node # sfx)\" and\n          children_nNull_no: \"(low no \\<noteq> Null) \\<and> (high no \\<noteq> Null)\"\n          apply (unfold isLeaf_pt_def)\n          apply blast\n          done\n        then have \"low no \\<notin> set prx\"\n          by auto\n        with rep_repa_nc no_nln rep_low_no_nNull \n        have \"(repa(node := repa (low node))) no \\<noteq> Null\"\n          by simp\n        moreover\n        have \"(if (repa(node := repa (low node)) \\<propto> low) no = \n                  (repa(node := repa (low node)) \\<propto> high) no \\<and> low no \\<noteq> Null\n          then (repa(node := repa (low node))) no = \n               (repa(node := repa (low node)) \\<propto> low) no\n          else (repa(node := repa (low node))) no =\n            hd [sn\\<leftarrow>prx@[node]. repNodes_eq sn no low high \n                (repa(node := repa (low node)))] \\<and>\n          (repa(node := repa (low node))) \n            ((repa(node := repa (low node))) no) =\n            (repa(node := repa (low node))) no \\<and>\n          (\\<forall>no1\\<in>set (prx@[node]).\n            ((repa(node := repa (low node)) \\<propto> high) no1 = \n            (repa(node := repa (low node)) \\<propto> high) no \\<and>\n            (repa(node := repa (low node)) \\<propto> low) no1 = \n            (repa(node := repa (low node)) \\<propto> low) no) =\n            ((repa(node := repa (low node))) no = \n            (repa(node := repa (low node))) no1)))\"\n        proof (cases \"(repa(node := repa (low node)) \\<propto> low) no = \n          (repa(node := repa (low node)) \\<propto> high) no \\<and> low no \\<noteq> Null\")\n          case True\n          note red_case=this\n          with children_nNull_no lno_notin_nl hno_notin_nl \n          have \"(repa \\<propto> low) no = (repa \\<propto> high) no\"\n            by (auto simp add: null_comp_def)\n          from children_nNull_no lno_notin_nl \n          have ext_repa_eq_repa_low: \"(repa(node := repa (low node)) \\<propto> low) no \n            = (repa \\<propto> low) no \"\n            by (auto simp add: null_comp_def)\n          from children_nNull_no hno_notin_nl \n          have ext_repa_eq_repa_high: \n            \"(repa(node := repa (low node)) \\<propto> high) no \n            = (repa \\<propto> high) no \"\n            by (auto simp add: null_comp_def)\n          from no_nln children_nNull_no \n          have \"repa (low node) = (repa \\<propto> low) no\"\n            by (simp add: null_comp_def)\n          with red_case ext_repa_eq_repa_high ext_repa_eq_repa_low no_nln \n          show ?thesis \n            using [[simp_depth_limit=2]]\n            by (auto simp del: null_comp_not_Null)\n        next\n          assume share_case: \" \\<not> ((repa(node := repa (low node)) \\<propto> low) no \n            = (repa(node := repa (low node)) \\<propto> high) no \\<and> low no \\<noteq> Null)\"\n          with low_no_nNull have \"(repa(node := repa (low node)) \\<propto> low) no \n            \\<noteq> (repa(node := repa (low node)) \\<propto> high) no\"\n            by simp\n          with children_nNull_no lno_notin_nl hno_notin_nl \n          have \"(repa \\<propto> low) no \\<noteq> (repa \\<propto> high) no\"\n            by (auto simp add: null_comp_def)\n          with children_nNull_no have \"repa (low no) \\<noteq> repa (high no)\"\n            by (simp add: null_comp_def)\n          with repchildren_eq_nln no_nln show ?thesis\n            by simp\n        qed\n        ultimately show ?thesis\n          using repchildren_eq_nln\n          apply -\n          apply (simp only:)\n          apply (simp (no_asm))\n          done\n      qed\n    qed\n    from nodes_unmodif nodes_modif\n    show ?thesis by iprover\n  qed\nnext\n  fix var low high rep nodeslist repa \"next\" node prx sfx repb\n  assume ns: \"List nodeslist next (prx @ node # sfx)\"\n  assume sfx: \"List (next node) next sfx\"\n  assume nodes_balanced_ordered: \"\\<forall>no\\<in>set (prx @ node # sfx).\n           no \\<noteq> Null \\<and>\n           (low no = Null) = (high no = Null) \\<and>\n           low no \\<notin> set (prx @ node # sfx) \\<and>\n           high no \\<notin> set (prx @ node # sfx) \\<and>\n           isLeaf_pt no low high = (var no \\<le> (1::nat)) \\<and>\n           (low no \\<noteq> Null \\<longrightarrow> rep (low no) \\<noteq> Null) \\<and>\n           (rep \\<propto> low) no \\<notin> set (prx @ node # sfx)\"\n  assume all_nodes_same_var: \"\\<forall>no1\\<in>set (prx @ node # sfx).\n           \\<forall>no2\\<in>set (prx @ node # sfx). var no1 = var no2\"\n  assume rep_repa_nc: \"\\<forall>no. no \\<notin> set prx \\<longrightarrow> rep no = repa no\"\n  assume while_inv: \"\\<forall>no\\<in>set prx.\n           repa no \\<noteq> Null \\<and>\n           (if (repa \\<propto> low) no = (repa \\<propto> high) no \\<and> low no \\<noteq> Null\n            then repa no = (repa \\<propto> low) no\n            else repa no = hd [sn\\<leftarrow>prx . repNodes_eq sn no low high repa] \\<and>\n                 repa (repa no) = repa no \\<and>\n                 (\\<forall>no1\\<in>set prx.\n                     ((repa \\<propto> high) no1 = (repa \\<propto> high) no \\<and>\n                      (repa \\<propto> low) no1 = (repa \\<propto> low) no) =\n                     (repa no = repa no1)))\"\n  assume share_cond: \n    \"\\<not> (\\<not> isLeaf_pt node low high \\<and> repa (low node) = repa (high node))\"\n  assume repb_node: \n          \"repb node = hd [sn\\<leftarrow>prx @ node # sfx . repNodes_eq sn node low high repa]\"\n  assume repa_repb_nc: \"\\<forall>pt. pt \\<noteq> node \\<longrightarrow> repa pt = repb pt\" \n  assume var_repb_node: \"var (repb node) = var node\"\n  show \"(\\<forall>no. no \\<notin> set (prx @ [node]) \\<longrightarrow> rep no = repb no) \\<and>\n          (\\<forall>no\\<in>set (prx @ [node]).\n              repb no \\<noteq> Null \\<and>\n              (if (repb \\<propto> low) no = (repb \\<propto> high) no \\<and> low no \\<noteq> Null\n               then repb no = (repb \\<propto> low) no\n               else repb no =\n                    hd [sn\\<leftarrow>prx @ [node] . repNodes_eq sn no low high repb] \\<and>\n                    repb (repb no) = repb no \\<and>\n                    (\\<forall>no1\\<in>set (prx @ [node]).\n                        ((repb \\<propto> high) no1 = (repb \\<propto> high) no \\<and>\n                         (repb \\<propto> low) no1 = (repb \\<propto> low) no) =\n                        (repb no = repb no1))))\"\n  proof -\n    have rep_repb_nc: \"(\\<forall>no. no \\<notin> set (prx @ [node]) \\<longrightarrow> rep no = repb no)\"\n    proof (intro allI impI)\n      fix no\n      assume no_notin_take_Sucn: \"no \\<notin> set (prx @ [node])\"\n      with rep_repa_nc \n      have rep_repa_nc_Sucn: \"rep no = repa no\"\n        by auto\n      from no_notin_take_Sucn have \"no \\<noteq> node\"\n        by auto\n      with repa_repb_nc have \"repa no = repb no\"\n        by auto\n      with rep_repa_nc_Sucn show \"rep no = repb no\"\n        by simp\n    qed\n    moreover\n    have repb_no_share_def: \n      \"(\\<forall>no\\<in>set (prx @ [node]). \n      \\<not> ((repb \\<propto> low) no = (repb \\<propto> high) no \\<and> low no \\<noteq> Null) \\<longrightarrow> \n          repb no = hd [sn\\<leftarrow>(prx @ [node]) . repNodes_eq sn no low high repb])\" \n    proof (intro ballI impI)\n      fix no\n      assume no_in_take_Sucn: \" no \\<in> set (prx @ [node])\"\n      assume share_prop: \"\\<not> ((repb \\<propto> low) no = (repb \\<propto> high) no \\<and> low no \\<noteq> Null)\"\n      from share_prop have share_or: \n        \"(repb \\<propto> low) no \\<noteq> (repb \\<propto> high) no \\<or> low no = Null\"\n        using [[simp_depth_limit=2]]\n        by simp\n      from no_in_take_Sucn have no_in_nl: \"no \\<in> set (prx @ node # sfx)\"\n        by auto\n      from nodes_balanced_ordered [rule_format, OF this] obtain\n        no_nNull: \"no \\<noteq> Null\" and\n        balanced_no: \"(low no = Null) = (high no = Null)\" and\n        lno_notin_nl: \"low no \\<notin> set (prx @ node # sfx)\" and\n        hno_notin_nl: \"high no \\<notin> set (prx @ node # sfx)\" and\n        isLeaf_var_no: \"isLeaf_pt no low high = (var no \\<le> 1)\"\n        by auto\n      have nodes_notin_nl_neq_nln: \"\\<forall>p. p \\<notin> set (prx @ node # sfx) \\<longrightarrow> p \\<noteq> node \"\n        by auto \n      show \" repb no = hd [sn\\<leftarrow>(prx @ [node]). repNodes_eq sn no low high repb]\"\n      proof (cases \"no = node\")\n        case False\n        note no_notin_nl=this\n        with no_in_take_Sucn have no_in_take_n: \"no \\<in> set prx\"\n          by auto\n        from False repa_repb_nc have repb_repa_no: \"repb no = repa no\" \n          by auto\n        with while_inv [rule_format, OF no_in_take_n] no_in_take_n obtain \n          repa_no_nNull: \"repa no \\<noteq> Null\" and\n          while_share_red_exp: \n          \"(if (repa \\<propto> low) no = (repa \\<propto> high) no \\<and> low no \\<noteq> Null \n              then repa no = (repa \\<propto> low) no\n              else repa no = hd [sn\\<leftarrow>prx . repNodes_eq sn no low high repa] \\<and>\n              repa (repa no) = repa no \\<and> \n              (\\<forall>no1\\<in>set prx. ((repa \\<propto> high) no1 = (repa \\<propto> high) no \\<and> \n              (repa \\<propto> low) no1 = (repa \\<propto> low) no) = (repa no = repa no1)))\"\n          using [[simp_depth_limit = 2]]\n          by auto \n        from no_in_take_n \n        have filter_take_n_notempty: \"[sn\\<leftarrow>prx. \n          repNodes_eq sn no low high repa] \\<noteq> []\"\n          apply -\n          apply (rule filter_not_empty)\n          apply (auto simp add: repNodes_eq_def)\n          done\n        then have hd_term_n_Sucn: \n          \"hd [sn\\<leftarrow>prx. repNodes_eq sn no low high repa] \n              = hd [sn\\<leftarrow>prx@[node] . repNodes_eq sn no low high repa]\"\n          by auto\n        thus ?thesis\n        proof (cases \"low no = Null\")\n          case True\n          note lno_Null=this\n          with balanced_no have hno_Null: \"high no = Null\" \n            by simp\n          from lno_Null hno_Null have isLeaf_no: \"isLeaf_pt no low high\"\n            by (simp add: isLeaf_pt_def)\n          from True while_share_red_exp \n          have while_low_Null: \n            \"repa no = hd [sn\\<leftarrow>prx. repNodes_eq sn no low high repa] \\<and>\n             repa (repa no) = repa no \\<and> \n             (\\<forall>no1\\<in>set prx. ((repa \\<propto> high) no1 = (repa \\<propto> high) no \n             \\<and> (repa \\<propto> low) no1 = (repa \\<propto> low) no) = (repa no = repa no1))\"\n            by auto\n          have all_nodes_in_nl_Leafs: \n            \"\\<forall>x \\<in> set (prx @ node # sfx). isLeaf_pt x low high\"\n          proof (intro ballI)\n            fix x\n            assume x_in_nodeslist: \"x \\<in> set (prx @ node # sfx)\"\n            from isLeaf_no isLeaf_var_no have \"var no \\<le> 1\"\n              by simp\n            with all_nodes_same_var [rule_format, OF x_in_nodeslist no_in_nl]\n            have \"var x \\<le> 1\"\n              by simp\n            with nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n            show \"isLeaf_pt x low high\"\n              by (auto simp add: isLeaf_pt_def)  \n          qed\n          have \"\\<forall> x \\<in> set (prx@[node]). repNodes_eq x no low high repb \n                = repNodes_eq x no low high repa\"\n          proof (rule ballI)\n            fix x\n            assume x_in_take_Sucn: \"x \\<in> set (prx@[node])\"\n            hence x_in_nodeslist: \"x \\<in> set (prx @ node # sfx)\"\n              by auto\n            with all_nodes_in_nl_Leafs have \"isLeaf_pt x low high\"\n              by auto\n            with isLeaf_no repa_repb_nc show \"repNodes_eq x no low high repb \n                  = repNodes_eq x no low high repa\"\n              by (simp add: repNodes_eq_def null_comp_def isLeaf_pt_def)\n          qed\n          then have \" [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repa] \n                = [sn\\<leftarrow>(prx@[node]) . repNodes_eq sn no low high repb]\"\n            apply -\n            apply (rule P_eq_list_filter)\n            apply simp\n            done\n          with hd_term_n_Sucn while_low_Null repb_repa_no show ?thesis \n            by auto\n        next\n          assume lno_nNull: \" low no \\<noteq> Null\"\n          with balanced_no have hno_nNull: \"high no \\<noteq> Null\"\n            by simp\n          with lno_nNull have no_nLeaf: \"\\<not> isLeaf_pt no low high\"\n            by (simp add: isLeaf_pt_def)\n          with isLeaf_var_no have Sucn_s_varno: \"1 < var no\"\n            by auto\n          with no_in_nl all_nodes_same_var \n          have all_nodes_nl_var: \"\\<forall> x \\<in> set (prx @ node # sfx). 1 < var x\"\n            apply -\n            apply (rule ballI)\n            apply (drule_tac x=no in bspec,assumption)\n            apply (drule_tac x=x in bspec,assumption)\n            apply auto\n            done\n          with nodes_balanced_ordered \n          have all_nodes_nl_nLeaf: \n            \"\\<forall>x \\<in> set (prx @ node # sfx). \\<not> isLeaf_pt x low high\"\n            apply -\n            apply (rule ballI)\n            apply (drule_tac x=x in bspec,assumption)\n            apply (drule_tac x=x in bspec,assumption)\n            apply auto\n            done\n          from lno_nNull share_or \n          have repbchildren_eq_no: \"(repb \\<propto> low) no \\<noteq> (repb \\<propto> high) no\"\n            by simp\n          with lno_nNull hno_nNull lno_notin_nl hno_notin_nl repa_repb_nc  \n            nodes_notin_nl_neq_nln \n          have repachildren_eq_no: \"(repa \\<propto> low) no \\<noteq> (repa \\<propto> high) no\"\n            using [[simp_depth_limit=2]]\n            by (simp add: null_comp_def) \n          with while_share_red_exp \n          have repa_no_def: \n            \"repa no = hd [sn\\<leftarrow>prx . repNodes_eq sn no low high repa] \"\n            by auto\n          with no_notin_nl repa_repb_nc \n          have \"repb no =  hd [sn\\<leftarrow>prx. repNodes_eq sn no low high repa] \"\n            by simp\n          with hd_term_n_Sucn \n          have repb_no_hd_term_repa: \"repb no = \n                 hd [sn\\<leftarrow>prx@[node] . repNodes_eq sn no low high repa] \"\n            by simp\n          have \"\\<forall>x \\<in> set (prx@[node]). \n            repNodes_eq x no low high repa = repNodes_eq x no low high repb\" \n          proof (intro ballI)\n            fix x\n            assume x_in_take_Sucn: \"x \\<in> set (prx@[node]) \"\n            hence x_in_nodeslist: \"x \\<in> set (prx @ node # sfx)\"\n              by auto\n            with all_nodes_nl_nLeaf have x_nLeaf: \"\\<not> isLeaf_pt x low high\"\n              by auto\n            from nodes_balanced_ordered [rule_format, OF x_in_nodeslist] obtain\n              balanced_x: \"(low x = Null) = (high x = Null)\" and\n              lx_notin_nl: \"low x \\<notin> set (prx @ node # sfx)\" and\n              hx_notin_nl: \"high x \\<notin> set (prx @ node # sfx)\" \n              by auto\n            with nodes_notin_nl_neq_nln lno_notin_nl hno_notin_nl lno_nNull \n              hno_nNull repa_repb_nc \n            show \" repNodes_eq x no low high repa = repNodes_eq x no low high repb\"\n              by (simp add: repNodes_eq_def null_comp_def)\n          qed\n          then have \" [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repa] = \n            [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]\"\n            apply -\n            apply (rule P_eq_list_filter)\n            apply auto\n            done\n          with repb_no_hd_term_repa show ?thesis\n            by simp\n        qed\n      next \n        assume no_nln: \"no = node\"\n        with repb_node have repb_no_def: \"repb no = \n          hd [sn\\<leftarrow>(prx @ node # sfx). repNodes_eq sn node low high repa]\" \n          by simp\n        show ?thesis\n        proof (cases \"isLeaf_pt no low high\")\n          case True\n          note isLeaf_no=this\n          have \"\\<forall>x \\<in> set (prx @ node # sfx). repNodes_eq x no low high repb \n            = repNodes_eq x no low high repa\"\n          proof (rule ballI)\n            fix x\n            assume x_in_nodeslist: \"x \\<in> set (prx @ node # sfx)\"\n            have all_nodes_in_nl_Leafs: \n              \"\\<forall>x \\<in> set (prx @ node # sfx). isLeaf_pt x low high\"\n            proof (intro ballI)\n              fix x\n              assume x_in_nodeslist: \" x \\<in> set (prx @ node # sfx)\"\n              from isLeaf_no isLeaf_var_no have \"var no \\<le> 1\"\n                by simp\n              with all_nodes_same_var [rule_format, OF x_in_nodeslist no_in_nl]\n              have \"var x \\<le> 1\"\n                by simp\n              with nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n              show \"isLeaf_pt x low high\"\n                by (auto simp add: isLeaf_pt_def)\n            qed\n            with x_in_nodeslist have \"isLeaf_pt x low high\"\n              by auto\n            with isLeaf_no repa_repb_nc \n            show \"repNodes_eq x no low high repb = repNodes_eq x no low high repa\"\n              by (simp add: repNodes_eq_def null_comp_def isLeaf_pt_def)\n          qed\n          with repb_no_def no_nln have repb_no_whole_nl: \"repb no = \n            hd [sn\\<leftarrow> (prx @ node # sfx). repNodes_eq sn node low high repb]\"\n            apply -\n            apply (subgoal_tac \n              \"[sn\\<leftarrow> (prx@node#sfx). repNodes_eq sn node low high repa] \n              = [sn\\<leftarrow>(prx @ node # sfx) . repNodes_eq sn node low high repb]\")\n            apply simp\n            apply (rule P_eq_list_filter)\n            apply auto\n            done\n          from no_in_take_Sucn no_nln \n          have \"[sn\\<leftarrow> (prx@[node]). repNodes_eq sn node low high repb]  \\<noteq> []\"\n            apply -\n            apply (rule filter_not_empty)\n            apply (auto simp add: repNodes_eq_def)\n            done\n          then\n          have \"hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn node low high repb] = \n                hd [sn\\<leftarrow>(prx @ node # sfx). repNodes_eq sn node low high repb]\"\n            apply -\n            apply (rule hd_filter_app [symmetric])\n            apply auto\n            done\n          with repb_no_whole_nl no_nln show ?thesis\n            by simp         \n        next\n          assume no_nLeaf: \" \\<not> isLeaf_pt no low high\"\n          with share_or balanced_no have \"(repb \\<propto> low) no \\<noteq> (repb \\<propto> high) no\"\n            using [[simp_depth_limit=2]]\n            by (simp add: isLeaf_pt_def)\n          from no_nLeaf share_cond no_nln have \"repa (low no) \\<noteq> repa (high no)\"\n            by auto\n          with no_nLeaf balanced_no have \"(repa \\<propto> low) no \\<noteq> (repa \\<propto> high) no \"\n            by (simp add: null_comp_def isLeaf_pt_def)\n          have \"\\<forall> x \\<in> set (prx@node#sfx). repNodes_eq x no low high repb \n            = repNodes_eq x no low high repa\"\n          proof (rule ballI)\n            fix x\n            assume x_in_nodeslist: \" x \\<in> set (prx@node#sfx)\"\n            have all_nodes_in_nl_Leafs: \n              \"\\<forall>x \\<in> set (prx@node#sfx). \\<not> isLeaf_pt x low high\"\n            proof (intro ballI)\n              fix x\n              assume x_in_nodeslist: \" x \\<in> set (prx@node#sfx)\"\n              from no_nLeaf isLeaf_var_no have \"1 < var no \"\n                by simp\n              with all_nodes_same_var [rule_format, OF x_in_nodeslist no_in_nl]\n              have \"1 < var x\" \n                by auto\n              with nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n              show \"\\<not> isLeaf_pt x low high\"\n                apply (unfold isLeaf_pt_def)\n                apply fastforce\n                done\n            qed\n            with x_in_nodeslist have x_nLeaf: \"\\<not> isLeaf_pt x low high\"\n              by auto\n            from nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n            have \"(low x = Null) = (high x = Null) \n                  \\<and> low x \\<notin> set (prx@node#sfx) \\<and> high x \\<notin> set (prx@node#sfx)\"\n              by auto\n            with x_nLeaf balanced_no no_nLeaf repa_repb_nc \n              nodes_notin_nl_neq_nln lno_notin_nl hno_notin_nl\n            show \"repNodes_eq x no low high repb = repNodes_eq x no low high repa\"\n              using [[simp_depth_limit=2]]\n              by (simp add: repNodes_eq_def null_comp_def isLeaf_pt_def)\n          qed\n          with repb_no_def no_nln \n          have repb_no_whole_nl: \n            \"repb no = hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn node low high repb]\"\n            apply -\n            apply (subgoal_tac \n                  \"[sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn node low high repa] \n                  = [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn node low high repb]\")\n            apply simp\n            apply (rule P_eq_list_filter)\n            apply auto\n            done\n          from no_in_take_Sucn no_nln \n          have \"[sn\\<leftarrow>(prx@[node]) . repNodes_eq sn node low high repb]  \\<noteq> []\"\n            apply -\n            apply (rule filter_not_empty)\n            apply (auto simp add: repNodes_eq_def)\n            done\n          then have \n            \"hd [sn\\<leftarrow> (prx@[node]) . repNodes_eq sn node low high repb] = \n            hd [sn\\<leftarrow>(prx@node#sfx) . repNodes_eq sn node low high repb]\"\n            apply -\n            apply (rule hd_filter_app [symmetric])\n            apply auto\n            done\n          with repb_no_whole_nl no_nln show ?thesis\n            by simp        \n        qed\n      qed\n    qed\n    have repb_no_red_def: \"(\\<forall>no\\<in>set (prx@[node]).(repb \\<propto> low) no = (repb \\<propto> high) no \n      \\<and> low no \\<noteq> Null \\<longrightarrow>  repb no = (repb \\<propto> low) no)\" \n    proof (intro ballI impI)\n      fix no\n      assume no_in_take_Sucn: \"no \\<in> set (prx@[node])\"\n      assume red_cond_no: \" (repb \\<propto> low) no = (repb \\<propto> high) no \\<and> low no \\<noteq> Null\"\n      from no_in_take_Sucn have no_in_nl: \"no \\<in> set (prx@node#sfx)\"\n        by auto\n      from nodes_balanced_ordered [rule_format, OF this]obtain\n        no_nNull: \"no \\<noteq> Null\" and\n        balanced_no: \"(low no = Null) = (high no = Null)\" and\n        lno_notin_nl: \"low no \\<notin> set (prx@node#sfx)\" and\n        hno_notin_nl: \"high no \\<notin> set (prx@node#sfx)\" and\n        isLeaf_var_no: \"isLeaf_pt no low high = (var no \\<le> 1)\"\n        by auto\n      have nodes_notin_nl_neq_nln: \"\\<forall> p. p \\<notin> set (prx@node#sfx) \\<longrightarrow> p \\<noteq> node\"\n        by auto\n      show \" repb no = (repb \\<propto> low) no\"\n      proof (cases \"no = node\")\n        case False\n        note no_notin_nl=this\n        with no_in_take_Sucn have no_in_take_n: \"no \\<in> set prx\"\n          by auto\n        from False repa_repb_nc have repb_repa_no: \"repb no = repa no\" \n          by auto\n        with while_inv [rule_format, OF no_in_take_n] obtain \n          repa_no_nNull: \"repa no \\<noteq> Null\" and\n          while_share_red_exp: \n          \"(if (repa \\<propto> low) no = (repa \\<propto> high) no \\<and> low no \\<noteq> Null \n          then repa no = (repa \\<propto> low) no\n          else repa no = hd [sn\\<leftarrow>prx. repNodes_eq sn no low high repa] \\<and>\n          repa (repa no) = repa no \\<and> \n          (\\<forall>no1\\<in>set prx. ((repa \\<propto> high) no1 = (repa \\<propto> high) no \\<and> \n          (repa \\<propto> low) no1 = (repa \\<propto> low) no) = (repa no = repa no1)))\"\n          using [[simp_depth_limit=2]]\n          by auto\n        from red_cond_no nodes_notin_nl_neq_nln lno_notin_nl \n          hno_notin_nl while_share_red_exp balanced_no repa_repb_nc \n        have red_repa_no: \"repa no = (repa \\<propto> low) no\"\n          by (auto simp add: null_comp_def)\n        from red_cond_no nodes_notin_nl_neq_nln lno_notin_nl repa_repb_nc \n        have \"(repb \\<propto> low) no =  (repa \\<propto> low) no\"\n          by (auto simp add: null_comp_def)\n        with red_repa_no no_notin_nl balanced_no repa_repb_nc \n        have \"repb no = (repb \\<propto> low) no\"\n          by auto\n        with red_cond_no show ?thesis\n          by auto\n      next\n        assume \"no = node\"\n        with share_cond \n        have share_cond_pre: \n          \"isLeaf_pt no low high \\<or> repa (low no) \\<noteq> repa (high no)\" \n          by simp\n        show ?thesis\n        proof (cases \"isLeaf_pt no low high\")\n          case True\n          with red_cond_no show ?thesis\n            by (simp add: isLeaf_pt_def)\n        next\n          assume no_nLeaf: \"\\<not> isLeaf_pt no low high\"\n          with share_cond_pre \n          have \"repa (low no) \\<noteq> repa (high no)\"\n            by simp\n          with no_nLeaf lno_notin_nl hno_notin_nl nodes_notin_nl_neq_nln \n            balanced_no repa_repb_nc\n          have \"repb (low no) \\<noteq> repb (high no)\"\n            using [[simp_depth_limit=2]]\n            by (auto simp add: isLeaf_pt_def)\n          with no_nLeaf balanced_no have \"(repb \\<propto> low) no \\<noteq> (repb \\<propto> high) no\"\n            by (simp add: null_comp_def isLeaf_pt_def)\n          with red_cond_no show ?thesis\n            by simp\n        qed\n      qed\n    qed\n    have while_while: \"(\\<forall>no\\<in>set (prx@[node]).\n          repb no \\<noteq> Null \\<and>\n          (if (repb \\<propto> low) no = (repb \\<propto> high) no \\<and> low no \\<noteq> Null \n          then repb no = (repb \\<propto> low) no\n          else repb no = hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb] \\<and>\n          repb (repb no) = repb no \\<and>\n          (\\<forall>no1\\<in>set ((prx@[node])). ((repb \\<propto> high) no1 = (repb \\<propto> high) no \n          \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no) = (repb no = repb no1))))\"\n      (is \"\\<forall>no\\<in>set (prx@[node]). ?P no \\<and> ?Q no\")\n    proof (intro ballI)\n      fix no\n      assume no_in_take_Sucn: \"no \\<in> set (prx@[node])\"\n      hence no_in_nl: \"no \\<in> set (prx@node#sfx)\"\n        by auto\n      from nodes_balanced_ordered [rule_format, OF this] obtain\n        no_nNull: \"no \\<noteq> Null\" and\n        balanced_no: \"(low no = Null) = (high no = Null)\" and\n        lno_notin_nl: \"low no \\<notin> set (prx@node#sfx)\" and\n        hno_notin_nl: \"high no \\<notin> set (prx@node#sfx)\" and\n        isLeaf_var_no: \"isLeaf_pt no low high = (var no \\<le> 1)\"\n        by auto\n      from no_in_take_Sucn \n      have filter_take_Sucn_not_empty: \n            \"[sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb] \\<noteq> []\"\n        apply -\n        apply (rule filter_not_empty)\n        apply (auto simp add: repNodes_eq_def)\n        done\n      then have hd_filter_Sucn_in_Sucn: \n            \"hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb] \\<in> \n            set (prx@[node])\"\n        by (rule hd_filter_in_list)\n      have nodes_notin_nl_neq_nln: \"\\<forall>p. p \\<notin> set (prx@node#sfx) \\<longrightarrow> p \\<noteq> node\"\n        by auto\n      show \"?P no \\<and> ?Q no\"\n      proof (cases \"no = node\")\n        case False\n        note no_notin_nl=this\n        with no_in_take_Sucn \n        have no_in_take_n: \"no \\<in> set prx\"\n          by auto\n        from False repa_repb_nc have repb_repa_no: \"repb no = repa no\" \n          by auto\n        with while_inv [rule_format, OF no_in_take_n] obtain \n          repa_no_nNull: \"repa no \\<noteq> Null\" and\n          while_share_red_exp: \n          \"(if (repa \\<propto> low) no = (repa \\<propto> high) no \\<and> low no \\<noteq> Null \n              then repa no = (repa \\<propto> low) no\n              else repa no = hd [sn\\<leftarrow>prx. repNodes_eq sn no low high repa] \\<and>\n              repa (repa no) = repa no \\<and> \n              (\\<forall>no1\\<in>set prx. ((repa \\<propto> high) no1 = (repa \\<propto> high) no \\<and> \n              (repa \\<propto> low) no1 = (repa \\<propto> low) no) = (repa no = repa no1)))\"\n          using [[simp_depth_limit=2]]\n          by auto\n        from repb_repa_no repa_no_nNull have repb_no_nNull: \"?P no\"\n          by simp\n        have \"?Q no\"\n        proof (cases \"(repb \\<propto> low) no = (repb \\<propto> high) no \\<and> low no \\<noteq> Null\")\n          case True\n          with no_in_take_Sucn repb_no_red_def show ?thesis\n            by auto\n        next\n          assume share_case_repb: \n            \" \\<not> ((repb \\<propto> low) no = (repb \\<propto> high) no \\<and> low no \\<noteq> Null)\"\n          with repb_no_share_def no_in_take_Sucn \n          have repb_no_def: \"repb no = hd [sn\\<leftarrow> (prx@[node]). \n            repNodes_eq sn no low high repb]\"\n            by auto\n          with share_case_repb \n          have \"(repb \\<propto> low) no \\<noteq> (repb \\<propto> high) no \\<or> low no = Null\"\n            using [[simp_depth_limit=2]]\n            by simp\n          thus ?thesis\n          proof (cases \"low no = Null\")\n            case True\n            note lno_Null=this\n            with balanced_no have hno_Null: \"high no = Null\" \n              by simp\n            from lno_Null hno_Null have isLeaf_no: \"isLeaf_pt no low high\"\n              by (simp add: isLeaf_pt_def)\n            from True while_share_red_exp \n            have while_low_Null: \n              \"repa no = hd [sn\\<leftarrow>prx. repNodes_eq sn no low high repa] \\<and>\n                  repa (repa no) = repa no \\<and> \n                  (\\<forall>no1\\<in>set prx. ((repa \\<propto> high) no1 = (repa \\<propto> high) no \n              \\<and> (repa \\<propto> low) no1 = (repa \\<propto> low) no) = (repa no = repa no1))\"\n              by auto\n            from no_in_take_n \n            have \"[sn\\<leftarrow>prx. repNodes_eq sn no low high repa] \\<noteq> []\"\n              apply -\n              apply (rule filter_not_empty)\n              apply (auto simp add: repNodes_eq_def)\n              done\n            then have hd_term_n_Sucn: \"hd [sn\\<leftarrow>prx. repNodes_eq sn no low high repa] = \n                  hd [sn\\<leftarrow>(prx@[node]) . repNodes_eq sn no low high repa]\"\n              apply -\n              apply (rule hd_filter_app [symmetric])\n              apply auto\n              done\n            have all_nodes_in_nl_Leafs: \n              \"\\<forall>x \\<in> set (prx@node#sfx). isLeaf_pt x low high\"\n            proof (intro ballI)\n              fix x\n              assume x_in_nodeslist: \" x \\<in> set (prx@node#sfx)\"\n              from isLeaf_no isLeaf_var_no have \"var no \\<le> 1\"\n                by simp\n              with all_nodes_same_var [rule_format, OF x_in_nodeslist no_in_nl] \n              have \"var x \\<le> 1\" \n                by simp\n              with nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n              show \"isLeaf_pt x low high\"\n                by (auto simp add: isLeaf_pt_def)\n            qed\n            from no_in_take_Sucn have \n              filter_Sucn_no_notempty: \n              \"[sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb] \\<noteq> []\"\n              apply -\n              apply (rule filter_not_empty)\n              apply (auto simp add: repNodes_eq_def)\n              done\n            then have hd_term_in_take_Sucn: \n              \"hd [sn\\<leftarrow>(prx@[node]) . repNodes_eq sn no low high repb] \n                  \\<in> set (prx@[node])\"\n              by (rule hd_filter_in_list)\n            then have hd_term_in_nl: \n              \"hd [sn\\<leftarrow>(prx@[node]) . repNodes_eq sn no low high repb] \n              \\<in> set (prx@node#sfx)\"\n              by auto \n            with all_nodes_in_nl_Leafs \n            have hd_term_Leaf: \"isLeaf_pt (hd [sn\\<leftarrow> (prx@[node]). \n              repNodes_eq sn no low high repb]) low high \"\n              by auto            \n            from while_low_Null have \"repa (repa no) = repa no\"\n              by auto\n            with no_notin_nl repa_repb_nc \n            have repa_repb_no_repb: \"repa (repb no) = repb no\"\n              by auto\n            have repb_repb_no: \"repb (repb no) = repb no\" \n            proof (cases \"repb no = node\")\n              case False\n              with repa_repb_nc repa_repb_no_repb show ?thesis\n                by auto\n            next\n              assume repb_no_nln: \" repb no = node\"\n              with hd_term_Leaf isLeaf_no all_nodes_in_nl_Leafs  \n              have nested_hd_repa_repb: \n                \"hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn \n                   (hd [sn\\<leftarrow>(prx@[node]) . repNodes_eq sn no low high repb]) \n                        low high repa] =  \n                 hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn \n                    ( hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]) \n                        low high repb]\"\n                by (simp add: isLeaf_pt_def repNodes_eq_def null_comp_def)\n              from  hd_term_in_take_Sucn \n              have \"[sn\\<leftarrow>(prx@[node]). repNodes_eq sn \n                      (hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]) \n                       low high repb] \\<noteq> []\"\n                apply -\n                apply (rule filter_not_empty)\n                apply (auto simp add: repNodes_eq_def)\n                done\n              then have \"hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn \n                    ( hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]) \n                          low high repb] = \n                    hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn \n                    ( hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]) \n                           low high repb]\"\n                apply -\n                apply (rule hd_filter_app [symmetric])\n                apply auto\n                done\n              then have hd_term_nodeslist_Sucn: \n                \"hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn \n                    ( hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]) \n                             low high repb] =\n                    hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn \n                    ( hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]) \n                          low high repb]\"\n                by simp\n              from no_in_take_Sucn filter_Sucn_no_notempty \n              have filter_filter: \"hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn  \n                    (hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]) \n                          low high repb] =  \n                    hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]\"\n                apply -\n                apply (rule filter_hd_P_rep_indep)\n                apply (auto simp add: repNodes_eq_def)\n                done\n              from repb_no_def repb_no_nln repb_node \n              have \"repb (repb no) =  hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn \n                    ( hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]) \n                           low high repa]\"\n                by simp\n              with nested_hd_repa_repb \n              have \"repb (repb no) =  hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn \n                    (hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]) \n                        low high repb]\"\n                by simp\n              with hd_term_nodeslist_Sucn \n              have \"repb (repb no) =  hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn \n                    ( hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]) \n                         low high repb]\"\n                by simp\n              with filter_filter \n              have \"repb (repb no) = hd [sn\\<leftarrow>(prx@[node]). \n                repNodes_eq sn no low high repb]\"\n                by simp\n              with repb_no_def show ?thesis\n                by simp\n            qed\n            have two_nodes_repb: \"(\\<forall>no1\\<in>set (prx@[node]). \n                  ((repb \\<propto> high) no1 = (repb \\<propto> high) no \n                  \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no) = (repb no = repb no1))\"\n            proof (intro ballI)\n              fix no1\n              assume no1_in_take_Sucn: \" no1 \\<in> set (prx@[node])\"\n              then have \"no1 \\<in> set (prx@node#sfx)\" by auto\n              with all_nodes_in_nl_Leafs \n              have isLeaf_no1: \"isLeaf_pt no1 low high\"\n                by auto\n              with isLeaf_no \n              have repbchildren_eq_no_no1: \"(repb \\<propto> high) no1 = (repb \\<propto> high) no \n                \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no\"\n                by (simp add: null_comp_def isLeaf_pt_def)\n              from isLeaf_no1 isLeaf_no \n              have repachildren_eq_no_no1: \"(repa \\<propto> high) no1 = (repa \\<propto> high) no \n                \\<and> (repa \\<propto> low) no1 = (repa \\<propto> low) no\"\n                by (simp add: null_comp_def isLeaf_pt_def)\n              from while_low_Null \n              have while_low_same_rep: \"(\\<forall>no1\\<in>set prx. \n                ((repa \\<propto> high) no1 = (repa \\<propto> high) no \n                    \\<and> (repa \\<propto> low) no1 = (repa \\<propto> low) no) = (repa no = repa no1))\"\n                by auto\n              show \"((repb \\<propto> high) no1 = (repb \\<propto> high) no \\<and> \n                    (repb \\<propto> low) no1 = (repb \\<propto> low) no) = (repb no = repb no1)\"\n              proof (cases \"no1 = node\")\n                case False\n                with no1_in_take_Sucn have \"no1 \\<in> set prx\"\n                  by auto\n                with while_low_same_rep repachildren_eq_no_no1 \n                have \"repa no = repa no1\"\n                  by auto\n                with repa_repb_nc no_notin_nl False repbchildren_eq_no_no1 \n                show ?thesis \n                  by auto\n              next\n                assume no1_nln: \"no1 = node\"\n                hence no1_in_take_Sucn: \"no1 \\<in> set (prx@[node])\"\n                  by auto\n                hence no1_in_nl: \"no1 \\<in> set (prx@node#sfx)\"\n                  by auto\n                from nodes_balanced_ordered [rule_format, OF this] have \n                  balanced_no1: \"(low no1 = Null) = (high no1 = Null)\"\n                  by auto\n                with no1_in_take_Sucn repb_no_share_def isLeaf_no1 \n                have repb_no1: \"repb no1 = hd [sn\\<leftarrow>(prx@[node]). \n                  repNodes_eq sn no1 low high repb]\"\n                  by (auto simp add: isLeaf_pt_def)\n                from balanced_no1 isLeaf_no1 isLeaf_no balanced_no \n                have repbchildren_eq_no1_no: \"(repb \\<propto> high) no1 = (repb \\<propto> high) no \n                      \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no\"\n                  by (simp add: null_comp_def isLeaf_pt_def)\n                have \"\\<forall> x \\<in> set (prx@[node]).  repNodes_eq x no low high repb \n                  =  repNodes_eq x no1 low high repb\"\n                proof (intro ballI)\n                  fix x\n                  assume x_in_take_Sucn: \" x \\<in> set (prx@[node])\"\n                  with repbchildren_eq_no1_no show \"repNodes_eq x no low high repb \n                    = repNodes_eq x no1 low high repb\"\n                    by (simp add: repNodes_eq_def)\n                qed\n                then have \" [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb] \n                      = [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no1 low high repb]\"\n                  by (rule P_eq_list_filter)\n                with repb_no_def repb_no1 have repb_no_no1: \"repb no = repb no1\"\n                  by simp\n                with repbchildren_eq_no1_no show ?thesis\n                  by simp\n              qed\n            qed\n            with repb_repb_no repb_no_share_def no_in_take_Sucn share_case_repb \n            show ?thesis\n              using [[simp_depth_limit=4]]\n              by auto\n          next\n            assume lno_nNull: \"low no \\<noteq> Null\"\n            with share_case_repb \n            have repbchildren_neq_no: \"(repb \\<propto> low) no \\<noteq> (repb \\<propto> high) no\"\n              by auto\n            from balanced_no lno_nNull \n            have hno_nNull: \"high no \\<noteq> Null\"\n              by simp\n            with repbchildren_neq_no lno_nNull repa_repb_nc \n              lno_notin_nl hno_notin_nl nodes_notin_nl_neq_nln \n            have repachildren_neq_no: \"(repa \\<propto> low) no \\<noteq> (repa \\<propto> high) no\"\n              using [[simp_depth_limit=2]]\n              by (auto simp add: null_comp_def)\n            with while_share_red_exp \n            have repa_while_inv: \"repa (repa no) = repa no \n              \\<and> (\\<forall>no1\\<in>set prx. ((repa \\<propto> high) no1 = (repa \\<propto> high) no \n              \\<and> (repa \\<propto> low) no1 = (repa \\<propto> low) no) = (repa no = repa no1))\"\n              by auto\n            from lno_nNull hno_nNull \n            have no_nLeaf: \"\\<not> isLeaf_pt no low high\"\n              by (simp add: isLeaf_pt_def)\n            have all_nodes_in_nl_nLeafs: \n              \"\\<forall>x \\<in> set (prx@node#sfx). \\<not> isLeaf_pt x low high\"\n            proof (intro ballI)\n              fix x\n              assume x_in_nodeslist: \" x \\<in> set (prx@node#sfx)\"\n              from no_nLeaf isLeaf_var_no have \"1 < var no \"\n                by simp\n              with all_nodes_same_var [rule_format, OF x_in_nodeslist no_in_nl] \n              have \"1 < var x\"\n                by simp\n              with nodes_balanced_ordered [rule_format, OF x_in_nodeslist]\n              show \" \\<not> isLeaf_pt x low high\"\n                using [[simp_depth_limit = 2]]\n                by (auto simp add: isLeaf_pt_def)\n            qed\n            have repb_repb_no: \"repb (repb no) = repb no\"\n            proof -\n              from repa_while_inv no_notin_nl repa_repb_nc \n              have \"repa (repb no) = repb no\"\n                by simp\n              from hd_filter_Sucn_in_Sucn repb_no_def \n              have repb_no_in_take_Sucn: \"repb no \\<in> set (prx@[node])\"\n                by simp\n              hence repb_no_in_nl: \"repb no \\<in> set (prx@node#sfx)\"\n                by auto\n              from all_nodes_in_nl_nLeafs repb_no_in_nl \n              have repb_no_nLeaf: \"\\<not> isLeaf_pt (repb no) low high\"\n                by auto\n              from nodes_balanced_ordered [rule_format, OF repb_no_in_nl]\n              have \"(low (repb no) = Null) = (high (repb no) = Null) \n                \\<and> low (repb no) \\<notin> set (prx@node#sfx) \\<and> \n                high (repb no) \\<notin> set (prx@node#sfx)\"\n                by auto\n              from filter_take_Sucn_not_empty \n              have \" repNodes_eq (hd [sn\\<leftarrow>(prx@[node]). \n                repNodes_eq sn no low high repb]) no low high repb\"\n                by (rule hd_filter_prop)\n              with repb_no_def have \"repNodes_eq (repb no) no low high repb\"\n                by simp\n              then have \"(repb \\<propto> low) (repb no) = (repb \\<propto> low) no \n                \\<and> (repb \\<propto> high) (repb no) = (repb \\<propto> high) no\"\n                by (simp add: repNodes_eq_def)\n              with repbchildren_neq_no have \"(repb \\<propto> low) (repb no) \n                \\<noteq> (repb \\<propto> high) (repb no)\"\n                by simp\n              with repb_no_in_take_Sucn repb_no_share_def \n              have repb_repb_no_double_hd: \n                \"repb (repb no) = hd [sn\\<leftarrow>(prx@[node]). \n                repNodes_eq sn (repb no) low high repb]\"\n                by auto\n              from filter_take_Sucn_not_empty \n              have \" hd [sn\\<leftarrow>(prx@[node]). \n                repNodes_eq sn (repb no) low high repb] = repb no\"\n                apply (simp only: repb_no_def )\n                apply (rule filter_hd_P_rep_indep)\n                apply (auto simp add: repNodes_eq_def)\n                done\n              with repb_repb_no_double_hd show ?thesis\n                by simp\n            qed\n            have \"(\\<forall>no1\\<in>set (prx@[node]). \n                ((repb \\<propto> high) no1 = (repb \\<propto> high) no \\<and> \n                (repb \\<propto> low) no1 = (repb \\<propto> low) no) = (repb no = repb no1))\"\n            proof (intro ballI)\n              fix no1\n              assume no1_in_take_Sucn: \"no1 \\<in> set (prx@[node])\"\n              hence no1_in_nl: \"no1 \\<in> set (prx@node#sfx)\"\n                by auto\n              from all_nodes_in_nl_nLeafs no1_in_nl \n              have no1_nLeaf: \"\\<not> isLeaf_pt no1 low high\"\n                by auto\n              from nodes_balanced_ordered [rule_format, OF no1_in_nl]\n              have no1_props: \"(low no1 = Null) = (high no1 = Null) \n                \\<and> low no1 \\<notin> set (prx@node#sfx) \\<and> high no1 \\<notin> set (prx@node#sfx)\"\n                by auto\n              show \"((repb \\<propto> high) no1 = (repb \\<propto> high) no \n                \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no) = (repb no = repb no1)\"\n              proof (cases \"no1 = node\")\n                case False\n                note no1_neq_nln=this\n                with no1_in_take_Sucn \n                have no1_in_take_n: \"no1 \\<in> set prx\"\n                  by auto\n                with repa_while_inv have \"((repa \\<propto> high) no1 = (repa \\<propto> high) no \n                  \\<and> (repa \\<propto> low) no1 = (repa \\<propto> low) no) = (repa no = repa no1)\"\n                  by fastforce\n                with no1_props no1_nLeaf no_nLeaf balanced_no lno_notin_nl \n                  hno_notin_nl nodes_notin_nl_neq_nln no_notin_nl \n                  no1_neq_nln repa_repb_nc\n                show ?thesis\n                  using [[simp_depth_limit=1]]\n                  by (auto simp add: null_comp_def isLeaf_pt_def)\n              next\n                assume no1_nln: \" no1 = node\"\n                show ?thesis\n                proof\n                  assume repbchildren_eq_no1_no: \n                    \"(repb \\<propto> high) no1 = (repb \\<propto> high) no \n                    \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no\"\n                  with repbchildren_neq_no \n                  have \"(repb \\<propto> high) no1 \\<noteq> (repb \\<propto> low) no1\"\n                    by auto\n                  with repb_no_share_def no1_in_take_Sucn \n                  have repb_no1_def: \" repb no1 = hd [sn\\<leftarrow>(prx@[node]). \n                    repNodes_eq sn no1 low high repb]\"\n                    by auto\n                  have filter_no1_eq_filter_no: \"[sn\\<leftarrow>(prx@[node]). \n                    repNodes_eq sn no1 low high repb] =  \n                    [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]\"\n                  proof -\n                    have \"\\<forall>x \\<in> set (prx@[node]). \n                      repNodes_eq x no1 low high repb = \n                      repNodes_eq x no low high repb\"\n                    proof (intro ballI)\n                      fix x\n                      assume x_in_take_Sucn: \"x \\<in> set (prx@[node])\"\n                      with repbchildren_eq_no1_no \n                      show \"repNodes_eq x no1 low high repb = \n                        repNodes_eq x no low high repb\"\n                        by (simp add: repNodes_eq_def)\n                    qed\n                    then show ?thesis\n                      by (rule P_eq_list_filter)\n                  qed\n                  with repb_no1_def repb_no_def show \" repb no = repb no1\"\n                    by simp\n                next\n                  assume repb_no_no1_eq: \"repb no = repb no1\"\n                  from no1_nln repb_node repb_no_def have repb_no1_def: \n                    \"repb no1 =  \n                    hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn node low high repa]\"\n                    by auto\n                  with no1_nln repb_no_def repb_no_no1_eq \n                  have repb_Sucn_repa_nl_hd: \" hd [sn\\<leftarrow>(prx@[node]). \n                    repNodes_eq sn no low high repb] = \n                    hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no1 low high repa]\"\n                    by simp\n                  from filter_take_Sucn_not_empty \n                  have \" hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb] \n                    =  hd [sn\\<leftarrow>(prx@node#sfx) . repNodes_eq sn no low high repb]\"\n                    apply -\n                    apply (rule hd_filter_app [symmetric])\n                    apply auto\n                    done\n                  then have hd_Sucn_hd_whole_list: \n                    \"hd [sn\\<leftarrow>(prx@[node]) . \n                    repNodes_eq sn no low high repb] =  \n                    hd [sn\\<leftarrow> (prx@node#sfx). repNodes_eq sn no low high repb]\"\n                    by simp\n                  have hd_nl_repb_repa: \n                    \"[sn\\<leftarrow> (prx@node#sfx). repNodes_eq sn no low high repb] \n                    = [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no low high repa]\"\n                  proof -\n                    have \"\\<forall>x \\<in> set (prx@node#sfx).  \n                      repNodes_eq x no low high repb =  \n                      repNodes_eq x no low high repa\"\n                    proof (intro ballI)\n                      fix x\n                      assume x_in_nl: \"x \\<in> set (prx@node#sfx)\"\n                      from all_nodes_in_nl_nLeafs x_in_nl \n                      have x_nLeaf: \"\\<not> isLeaf_pt x low high\"\n                        by auto\n                      from  nodes_balanced_ordered [rule_format, OF x_in_nl]\n                      have x_props: \"(low x = Null) = (high x = Null) \\<and> \n                        low x \\<notin> set (prx@node#sfx) \\<and> high x \\<notin> set (prx@node#sfx)\"\n                        by auto\n                      with x_nLeaf lno_nNull hno_nNull lno_notin_nl hno_notin_nl \n                        nodes_notin_nl_neq_nln repa_repb_nc \n                      show \"repNodes_eq x no low high repb = \n                        repNodes_eq x no low high repa\"\n                        using [[simp_depth_limit=1]]\n                        by (simp add: repNodes_eq_def isLeaf_pt_def null_comp_def)\n                    qed\n                    then show ?thesis\n                      by (rule P_eq_list_filter)\n                  qed\n                  with repb_Sucn_repa_nl_hd hd_Sucn_hd_whole_list \n                  have filter_nl_no_no1: \n                    \"hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no low high repa] \n                    =  hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no1 low high repa]\"\n                    by simp\n                  from no_in_nl have filter_no_not_empty: \n                    \"[sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no low high repa] \\<noteq> []\"\n                    apply -\n                    apply (rule filter_not_empty)\n                    apply (auto simp add: repNodes_eq_def)\n                    done\n                  from no1_in_nl have filter_no1_not_empty: \n                    \"[sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no1 low high repa] \\<noteq> []\"\n                    apply -\n                    apply (rule filter_not_empty)\n                    apply (auto simp add: repNodes_eq_def)\n                    done\n                  from repb_no_def hd_Sucn_hd_whole_list hd_nl_repb_repa \n                  have \"repb no =\n                    hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no low high repa]\" \n                    by simp\n                  with hd_filter_prop [OF filter_no_not_empty ]\n                  have repNodes_no_repa: \"repNodes_eq (repb no) no low high repa\"\n                    by auto\n                  from repb_no1_def no1_nln \n                  have \n                    \"repb no1 = hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no1 \n                    low high repa]\"\n                    by simp\n                  with hd_filter_prop [OF filter_no1_not_empty ]\n                  have \"repNodes_eq (repb no1) no1 low high repa\"\n                    by auto\n                  with filter_nl_no_no1 repNodes_no_repa repb_no_no1_eq \n                  have \"(repa \\<propto> high) no1 = \n                    (repa \\<propto> high) no \\<and> (repa \\<propto> low) no1 = (repa \\<propto> low) no\"\n                    by (simp add: repNodes_eq_def)\n                  with hno_nNull no1_props no1_nLeaf lno_nNull lno_notin_nl \n                    hno_notin_nl nodes_notin_nl_neq_nln repa_repb_nc\n                  show \"(repb \\<propto> high) no1 = \n                    (repb \\<propto> high) no \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no\"\n                    using [[simp_depth_limit=1]]\n                    by (auto simp add: isLeaf_pt_def null_comp_def)\n                qed\n              qed\n            qed\n            with repb_repb_no repb_no_share_def share_case_repb no_in_take_Sucn \n            show ?thesis\n              using [[simp_depth_limit=1]]\n              by auto\n          qed\n        qed\n        with repb_no_nNull show ?thesis\n          by simp\n      next\n        assume no_nln: \"no = node\"\n        with repb_node have repb_no_def: \n          \"repb no = hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no low high repa]\"\n          by simp\n        from no_nln have \"no \\<in> set (prx@node#sfx)\"\n          by auto\n        then have filter_nl_repa_not_empty: \n          \"[sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no low high repa] \\<noteq> []\"\n          apply -\n          apply (rule filter_not_empty)\n          apply (auto simp add: repNodes_eq_def)\n          done\n        then have hd_filter_nl_in_nl: \n          \"hd [sn\\<leftarrow>(prx@node#sfx). repNodes_eq sn no low high repa] \\<in> set (prx@node#sfx)\"\n          by (rule hd_filter_in_list)\n        with repb_no_def \n        have repb_no_in_nodeslist: \"repb no \\<in> set (prx@node#sfx)\"\n          by simp\n        from nodes_balanced_ordered [rule_format,OF this]\n        have repb_no_nNull: \"repb no \\<noteq> Null\"\n          by auto\n        from share_cond no_nln have share_cond_or: \n          \"isLeaf_pt no low high \\<or> repa (low no) \\<noteq> repa (high no)\"\n          by auto\n        have share_reduce_if: \" (if (repb \\<propto> low) no = (repb \\<propto> high) no \\<and> low no \\<noteq> Null \n              then repb no = (repb \\<propto> low) no\n              else repb no = hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb] \\<and>\n              repb (repb no) = repb no \n              \\<and> (\\<forall>no1\\<in>set (prx@[node]). ((repb \\<propto> high) no1 = (repb \\<propto> high) no \n              \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no) = (repb no = repb no1)))\"\n        proof (cases \"isLeaf_pt no low high\")\n          case True\n          note isLeaf_no=this\n          then have lno_Null: \"low no = Null\" by (simp add: isLeaf_pt_def)\n          from isLeaf_no no_in_take_Sucn repb_no_share_def \n          have repb_no_repb_def: \"repb no \n                = hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]\"\n            by (auto simp add: isLeaf_pt_def)\n          from isLeaf_no nodes_balanced_ordered [rule_format, OF no_in_nl]\n          have var_no: \"var no \\<le> 1\" \n            by auto\n          have all_nodes_nl_var_l_1: \"\\<forall>x \\<in> set (prx@node#sfx). var x \\<le> 1\"\n          proof (intro ballI)\n            fix x\n            assume x_in_nl: \" x \\<in> set (prx@node#sfx)\"\n            from all_nodes_same_var [rule_format, OF x_in_nl no_in_nl] var_no \n            show \" var x \\<le> 1\"\n              by auto\n          qed              \n          have all_nodes_nl_Leafs: \"\\<forall>x \\<in> set (prx@node#sfx). isLeaf_pt x low high\" \n          proof (intro ballI)\n            fix x\n            assume x_in_nl: \" x \\<in> set (prx@node#sfx)\"\n            with all_nodes_nl_var_l_1 have \"var x \\<le> 1\"\n              by auto\n            with nodes_balanced_ordered [rule_format, OF x_in_nl ]\n            show \"isLeaf_pt x low high\"\n              by auto\n          qed \n          have repb_repb_no: \"repb (repb no) = repb no\"\n          proof -\n            from repb_no_share_def no_in_take_Sucn lno_Null \n            have repb_no_def: \" repb no = \n              hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]\"\n              by auto\n            with hd_filter_Sucn_in_Sucn \n            have repb_no_in_take_Sucn: \"repb no \\<in> set (prx@[node])\"\n              by simp\n            hence repb_no_in_nl: \"repb no \\<in> set (prx@[node])\"\n              by auto\n            with all_nodes_nl_Leafs \n            have repb_no_Leaf: \"isLeaf_pt (repb no) low high\" \n              by auto\n            with repb_no_in_take_Sucn repb_no_share_def \n            have repb_repb_no_def: \"repb (repb no) = \n              hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn (repb no) low high repb] \"\n              by (auto simp add: isLeaf_pt_def)\n            from filter_take_Sucn_not_empty \n            show ?thesis\n              apply (simp only: repb_repb_no_def  )\n              apply (simp only: repb_no_def)\n              apply (rule filter_hd_P_rep_indep)\n              apply (auto simp add: repNodes_eq_def)\n              done\n          qed\n          have two_nodes_repb: \"(\\<forall>no1\\<in>set (prx@[node]). \n                ((repb \\<propto> high) no1 = (repb \\<propto> high) no \\<and> \n                (repb \\<propto> low) no1 = (repb \\<propto> low) no) = (repb no = repb no1))\"\n          proof (intro ballI)\n            fix no1 \n            assume no1_in_take_Sucn: \"no1 \\<in> set (prx@[node])\"\n            from no1_in_take_Sucn \n            have \"no1 \\<in> set (prx@node#sfx)\"\n              by auto\n            with all_nodes_nl_Leafs \n            have isLeaf_no1: \"isLeaf_pt no1 low high\"\n              by auto\n            with repb_no_share_def no1_in_take_Sucn \n            have repb_no1_def: \"repb no1 =  \n                  hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no1 low high repb]\" \n              by (auto simp add: isLeaf_pt_def)\n            show \"((repb \\<propto> high) no1 = (repb \\<propto> high) no \n                  \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no) = (repb no = repb no1)\"\n            proof \n              assume repbchildren_eq_no1_no: \"(repb \\<propto> high) no1 = (repb \\<propto> high) no \n                    \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no\"\n              have \"[sn\\<leftarrow>(prx@[node]). repNodes_eq sn no1 low high repb] \n                    = [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]\"\n              proof -\n                have \"\\<forall>x \\<in> set (prx@[node]). \n                      repNodes_eq x no1 low high repb = repNodes_eq x no low high repb\"\n                proof (intro ballI)\n                  fix x\n                  assume x_in_take_Sucn: \" x \\<in> set (prx@[node])\"\n                  with repbchildren_eq_no1_no \n                  show \" repNodes_eq x no1 low high repb = repNodes_eq x no low high repb\"\n                    by (simp add: repNodes_eq_def)\n                qed\n                then show ?thesis\n                  by (rule P_eq_list_filter)\n              qed\n              with repb_no1_def repb_no_repb_def \n              show \"repb no = repb no1\"\n                by simp\n            next\n              assume repb_no_no1: \"repb no = repb no1\"\n              with isLeaf_no isLeaf_no1 \n              show \"(repb \\<propto> high) no1 = (repb \\<propto> high) no \n                \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no\"\n                by (simp add: null_comp_def isLeaf_pt_def)\n            qed\n          qed\n          with repb_repb_no lno_Null no_in_take_Sucn repb_no_share_def show ?thesis\n            by auto\n        next\n          assume no_nLeaf: \"\\<not> isLeaf_pt no low high\"\n          with balanced_no obtain \n            lno_nNull: \"low no \\<noteq> Null\" and \n            hno_nNull: \"high no \\<noteq> Null\"\n            by (simp add: isLeaf_pt_def)\n          from no_nLeaf nodes_balanced_ordered [rule_format, OF no_in_nl]\n          have var_no: \"1 < var no\" \n            by auto\n          have all_nodes_nl_var_l_1: \"\\<forall>x \\<in> set (prx@node#sfx). 1 < var x\"\n          proof (intro ballI)\n            fix x\n            assume x_in_nl: \" x \\<in> set (prx@node#sfx)\"\n            with all_nodes_same_var [rule_format, OF x_in_nl no_in_nl] var_no \n            show \"1 < var x\"\n              by simp\n          qed         \n          have all_nodes_nl_nLeafs: \"\\<forall> x \\<in> set (prx@node#sfx). \\<not> isLeaf_pt x low high\" \n          proof (intro ballI)\n            fix x\n            assume x_in_nl: \" x \\<in> set (prx@node#sfx)\"\n            with all_nodes_nl_var_l_1 have \"1 < var x\"\n              by auto\n            with nodes_balanced_ordered [rule_format, OF x_in_nl] show \" \\<not> isLeaf_pt x low high\"\n              by auto\n          qed \n          from no_nLeaf share_cond_or \n          have repachildren_neq_no: \"repa (low no) \\<noteq> repa (high no)\"\n            by auto\n          with lno_nNull hno_nNull \n          have \"(repa \\<propto> low) no \\<noteq> (repa \\<propto> high) no\"\n            by (simp add: null_comp_def)\n          with repa_repb_nc lno_notin_nl hno_notin_nl \n            nodes_notin_nl_neq_nln lno_nNull hno_nNull \n          have repbchildren_neq_no: \"(repb \\<propto> low) no \\<noteq> (repb \\<propto> high) no\"\n            using [[simp_depth_limit=1]]\n            by (auto simp add: null_comp_def)\n          have repb_repb_no: \"repb (repb no) = repb no\"\n          proof -\n            from repb_no_share_def no_in_take_Sucn repbchildren_neq_no \n            have repb_no_def: \"repb no = \n              hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]\"\n              by auto\n            from filter_take_Sucn_not_empty \n            have \"repNodes_eq (repb no) no low high repb\"\n              apply (simp only: repb_no_def)\n              apply (rule hd_filter_prop)\n              apply simp\n              done\n            with repbchildren_neq_no \n            have repbchildren_neq_repb_no: \"(repb \\<propto> low) (repb no) \\<noteq> (repb \\<propto> high) (repb no)\"\n              by (simp add: repNodes_eq_def)\n            from filter_take_Sucn_not_empty \n            have \"repb no \\<in> set (prx@[node])\"\n              apply (simp only: repb_no_def )\n              apply (rule hd_filter_in_list)\n              apply simp\n              done\n            with repbchildren_neq_repb_no repb_no_share_def \n            have repb_repb_no_def: \" repb (repb no) = \n              hd [sn\\<leftarrow>(prx@[node]) . repNodes_eq sn (repb no) low high repb] \"\n              by auto\n            from filter_take_Sucn_not_empty show ?thesis\n              apply (simp only: repb_repb_no_def )\n              apply (simp only: repb_no_def)\n              apply (rule filter_hd_P_rep_indep)\n              apply (auto simp add: repNodes_eq_def)\n              done\n          qed\n          have two_nodes_repb: \"(\\<forall>no1\\<in>set (prx@[node]). \n            ((repb \\<propto> high) no1 = (repb \\<propto> high) no \\<and> \n            (repb \\<propto> low) no1 = (repb \\<propto> low) no) = (repb no = repb no1))\"\n            (is \"(\\<forall>no1\\<in>set (prx@[node]). ?P no1)\")\n          proof (intro ballI)\n            fix no1\n            assume no1_in_take_Sucn: \" no1 \\<in> set (prx@[node])\"\n            hence no1_in_nodeslist: \"no1 \\<in> set (prx@node#sfx)\"\n              by auto\n            with all_nodes_nl_nLeafs \n            have no1_nLeaf: \"\\<not> isLeaf_pt no1 low high\"\n              by auto\n            show \"?P no1\"\n            proof\n              assume repbchildren_eq_no1_no: \"(repb \\<propto> high) no1 = (repb \\<propto> high) no \n                \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no\"\n              with repbchildren_neq_no have \"(repb \\<propto> high) no1 \\<noteq> (repb \\<propto> low) no1\"\n                by auto\n              with no1_in_take_Sucn repb_no_share_def have repb_no1_def: \"repb no1 = \n                hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no1 low high repb]\"\n                by auto\n              from repb_no_share_def no_in_take_Sucn repbchildren_neq_no \n              have repb_no_def: \"repb no = \n                hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]\"\n                by auto\n              have \"[sn\\<leftarrow>(prx@[node]). repNodes_eq sn no1 low high repb] = \n                [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]\"\n              proof -\n                have \"\\<forall> x \\<in> set (prx@[node]). \n                  repNodes_eq x no1 low high repb = repNodes_eq x no low high repb\"\n                proof (intro ballI)\n                  fix x\n                  assume x_in_take_Sucn: \" x \\<in> set (prx@[node])\"\n                  with repbchildren_eq_no1_no \n                  show \" repNodes_eq x no1 low high repb = repNodes_eq x no low high repb\"\n                    by (simp add: repNodes_eq_def)\n                qed\n                then show ?thesis\n                  by (rule P_eq_list_filter)\n              qed\n              with repb_no_def repb_no1_def show \" repb no = repb no1\"\n                by simp\n            next\n              assume repb_no_no1: \"repb no = repb no1\"\n              from repb_no_share_def no_in_take_Sucn repbchildren_neq_no \n              have repb_no_def: \"repb no = \n                hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no low high repb]\"\n                by auto\n              from filter_take_Sucn_not_empty \n              have \"repb no \\<in> set (prx@[node])\"\n                apply (simp only: repb_no_def)\n                apply (rule hd_filter_in_list)\n                apply simp\n                done\n              then have repb_no_in_nl: \"repb no \\<in> set (prx@node#sfx)\"\n                by auto\n              from filter_take_Sucn_not_empty \n              have repNodes_repb_no: \"repNodes_eq (repb no) no low high repb\"\n                apply (simp only: repb_no_def)\n                apply (rule hd_filter_prop)\n                apply simp\n                done\n              show \"(repb \\<propto> high) no1 = (repb \\<propto> high) no \n                \\<and> (repb \\<propto> low) no1 = (repb \\<propto> low) no\"\n              proof (cases \"(repb \\<propto> low) no1 = (repb \\<propto> high) no1\")\n                case True\n                note red_cond=this\n                from no1_in_nodeslist all_nodes_nl_nLeafs\n                have no1_nLeaf: \"\\<not> isLeaf_pt no1 low high\"\n                  by auto\n                from nodes_balanced_ordered [rule_format, OF no1_in_nodeslist]\n                have no1_props: \"(low no1 \\<notin> set (prx@node#sfx)) \n                      \\<and> (high no1 \\<notin> set (prx@node#sfx)) \\<and>(low no1 = Null) = (high no1 = Null) \n                      \\<and> ((rep \\<propto> low) no1 \\<notin> set (prx@node#sfx))\"\n                  by auto\n                with red_cond no1_nLeaf no1_in_take_Sucn repb_no_red_def \n                have repb_no1_def: \"repb no1 = (repb \\<propto> low) no1\"\n                  by (auto simp add: isLeaf_pt_def)\n                with no1_nLeaf no1_props have \"repb no1 = repb (low no1)\"\n                  by (simp add: null_comp_def isLeaf_pt_def)\n                from no1_props no1_nLeaf have \"rep (low no1) \\<notin> set (prx@node#sfx)\"\n                  by (auto simp add: isLeaf_pt_def null_comp_def)\n                with rep_repb_nc no1_props \n                have \"repb (low no1) \\<notin> set (prx@node#sfx)\"\n                  by auto\n                with repb_no1_def repb_no_no1 no1_props no1_nLeaf \n                have \"repb no \\<notin> set (prx@node#sfx)\"\n                  by (simp add: isLeaf_pt_def null_comp_def)\n                with repb_no_in_nl show ?thesis\n                  by simp\n              next\n                assume \"(repb \\<propto> low) no1 \\<noteq> (repb \\<propto> high) no1\"\n                with repb_no_share_def no1_in_take_Sucn \n                have repb_no1_def: \" repb no1 = \n                  hd [sn\\<leftarrow>(prx@[node]). repNodes_eq sn no1 low high repb]\"\n                  by auto\n                from no1_in_take_Sucn \n                have \"[sn\\<leftarrow>(prx@[node]). repNodes_eq sn no1 low high repb] \\<noteq> []\" \n                  apply -\n                  apply (rule filter_not_empty)\n                  apply (auto simp add: repNodes_eq_def)\n                  done\n                then \n                have repNodes_repb_no1: \"repNodes_eq (repb no1) no1 low high repb\"\n                  apply (simp only: repb_no1_def ) \n                  apply (rule hd_filter_prop)\n                  apply simp\n                  done\n                with repNodes_repb_no repb_no_no1 \n                have \"repNodes_eq no1 no low high repb\"\n                  by (simp add: repNodes_eq_def)\n                then show ?thesis\n                  by (simp add: repNodes_eq_def)\n              qed\n            qed\n          qed\n          with repb_repb_no repb_no_share_def no_in_take_Sucn repbchildren_neq_no\n          show ?thesis\n            using [[simp_depth_limit=2]]\n            by fastforce\n        qed\n        with repb_no_nNull show ?thesis\n          by simp\n      qed\n    qed\n    with rep_repb_nc show ?thesis\n      by (intro conjI)\n  qed\nqed\n\nend\n\n\n\n\n", "meta": {"author": "Josh-Tilles", "repo": "AFP", "sha": "f4bf1d502bde2a3469d482b62c531f1c3af3e881", "save_path": "github-repos/isabelle/Josh-Tilles-AFP", "path": "github-repos/isabelle/Josh-Tilles-AFP/AFP-f4bf1d502bde2a3469d482b62c531f1c3af3e881/thys/BDD/ShareReduceRepListProof.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5621765008857981, "lm_q2_score": 0.5350984286266116, "lm_q1q2_score": 0.30081976223479745}}
{"text": "theory Nominal2_Lemmas\n  imports Main \"Nominal2.Nominal2\"\nbegin\n\nlemma Abs_lst_rename:\n  fixes a c::\"'a::at\" and e::\"'e::fs\"\n  assumes \"atom c \\<sharp> e\"\n  shows \"[[atom a]]lst. e = [[atom c]]lst. (a \\<leftrightarrow> c) \\<bullet> e\"\nproof -\n  from assms have 1: \"atom c \\<notin> supp e - set [atom a]\" by (simp add: fresh_def)\n  have 2: \"atom a \\<notin> supp e - set [atom a]\" by simp\n  show ?thesis using Abs_swap2[OF 2 1] by (simp add: flip_def)\nqed\n\nlemma eqvt_at_deep:\n  assumes fresh: \"atom a \\<sharp> (e, x)\" \"atom c \\<sharp> (e, x)\"\n  and eqvt_at: \"eqvt_at f (e2, e, x)\"\nshows \"(a \\<leftrightarrow> c) \\<bullet> f (e2, e, x) = f ((a \\<leftrightarrow> c) \\<bullet> e2, e, x)\"\nproof -\n  have 1: \"(a \\<leftrightarrow> c) \\<bullet> f (e2, e, x) = f ((a \\<leftrightarrow> c) \\<bullet> (e2, e, x))\" using eqvt_at eqvt_at_def by blast\n  have 2: \"(a \\<leftrightarrow> c) \\<bullet> (e2, e, x) = ((a \\<leftrightarrow> c) \\<bullet> e2, e, x)\" using fresh fresh_Pair flip_fresh_fresh by fastforce\n\n  show ?thesis using 1 2 by argo\nqed\n\nlemma Abs_lst_rename_deep:\n  fixes a c::\"'a::at\" and x::\"'b::fs\" and e::\"'c::fs\" and e2::\"'d::fs\" and f::\"'d * 'c * 'b \\<Rightarrow> 'e::fs\"\n  assumes fresh: \"atom c \\<sharp> f (e2, e, x)\" \"atom c \\<sharp> (e, x)\" \"atom a \\<sharp> (e, x)\"\n  and eqvt_at: \"eqvt_at f (e2, e, x)\"\nshows \"[[atom a]]lst. f (e2, e, x) = [[atom c]]lst. f ((a \\<leftrightarrow> c) \\<bullet> e2, e, x)\"\nproof -\n  have 1: \"[[atom a]]lst. f (e2, e, x) = [[atom c]]lst. (a \\<leftrightarrow> c) \\<bullet> f (e2, e, x)\" by (rule Abs_lst_rename[OF fresh(1)])\n  have 2: \"(a \\<leftrightarrow> c) \\<bullet> f (e2, e, x) = f ((a \\<leftrightarrow> c) \\<bullet> e2, e, x)\" by (rule eqvt_at_deep[OF fresh(3) fresh(2) eqvt_at])\n  show ?thesis using 1 2 by argo\nqed\n\nlemma Abs_lst_rename_both:\n  fixes a c::\"'a::at\" and e e'::\"'b::fs\"\n  assumes fresh: \"atom c \\<sharp> (y, e, y', e')\"\n  and equal: \"[[atom y]]lst. e = [[atom y']]lst. e'\"\nshows \"(y \\<leftrightarrow> c) \\<bullet> e = (y' \\<leftrightarrow> c) \\<bullet> e'\"\nproof -\n  from assms have \"(y \\<leftrightarrow> c) \\<bullet> ([[atom y]]lst. e) = (y' \\<leftrightarrow> c) \\<bullet> ([[atom y']]lst. e')\" by auto\n  then have \"[[atom c]]lst. (y \\<leftrightarrow> c) \\<bullet> e = [[atom c]]lst. (y' \\<leftrightarrow> c) \\<bullet> e'\" by auto\n  then show ?thesis using Abs1_eq(3) by blast\nqed\n\nlemma Abs_sumC:\n  fixes y y'::\"'a::at\" and x x'::\"'b::fs\" and e e'::\"'c::fs\" and e2 e2'::\"'d::fs\" and f::\"'d * 'c * 'b \\<Rightarrow> 'e::fs\"\n  assumes fresh: \"atom y \\<sharp> (e, x)\" \"atom y' \\<sharp> (e', x')\"\n  and eqvt_at: \"eqvt_at f (e2, e, x)\" \"eqvt_at f (e2', e', x')\"\n  and equal: \"[[atom y]]lst. e2 = [[atom y']]lst. e2'\" \"x = x'\" \"e = e'\"\n  shows \"[[atom y]]lst. f (e2, e, x) = [[atom y']]lst. f (e2', e', x')\"\nproof -\n  obtain c::\"'a\" where \"atom c \\<sharp> (y, y', e, e', x, x', e2, e2', f (e2, e, x), f (e2', e', x'))\" using obtain_fresh by blast\n  then have c: \"atom c \\<sharp> f (e2, e, x)\" \"atom c \\<sharp> (e, x)\" \"atom c \\<sharp> f (e2', e', x')\"  \"atom c \\<sharp> (e', x')\" \"atom c \\<sharp> (y, e2, y', e2')\" using fresh_Pair by auto\n\n  have 1: \"[[atom y]]lst. f (e2, e, x) = [[atom c]]lst. f ((y \\<leftrightarrow> c) \\<bullet> e2, e, x)\" by (rule Abs_lst_rename_deep[OF c(1) c(2) fresh(1) eqvt_at(1)])\n  have 2: \"[[atom y']]lst. f (e2', e', x') = [[atom c]]lst. f ((y' \\<leftrightarrow> c) \\<bullet> e2', e', x')\" by (rule Abs_lst_rename_deep[OF c(3) c(4) fresh(2) eqvt_at(2)])\n  have 3: \"(y \\<leftrightarrow> c) \\<bullet> e2 = (y' \\<leftrightarrow> c) \\<bullet> e2'\" by (rule Abs_lst_rename_both[OF c(5) equal(1)])\n\n  show ?thesis using 1 2 3 equal by argo\nqed\n\nlemma Abs_fresh_var:\n  fixes y::\"'a::at\" and e ::\"'b::fs\"\n  obtains c::\"'a\" and e'::\"'b\" where \"([[atom y]]lst. e = [[atom c]]lst. e') \\<and> atom y \\<sharp> [[atom c]]lst. e'\"\nproof -\n  obtain c::\"'a\" where \"atom c \\<sharp> (y, e)\" using obtain_fresh by blast\n  have 1: \"[[atom y]]lst. e = [[atom c]]lst. (y \\<leftrightarrow> c) \\<bullet> e\" using Abs_lst_rename \\<open>atom c \\<sharp> (y, e)\\<close> by fastforce\n  have 2: \"atom y \\<sharp> [[atom c]]lst. (y \\<leftrightarrow> c) \\<bullet> e\"\n    by (metis Abs_fresh_iff(3) \\<open>atom c \\<sharp> (y, e)\\<close> flip_at_simps(2) fresh_PairD(2) fresh_at_base_permute_iff)\n  from 1 2 show ?thesis using that[of c \"(y \\<leftrightarrow> c) \\<bullet> e\"] by simp\nqed\n\nlemma Abs_rename_body:\n  fixes a b::\"'a::at\" and e1 e2::\"'b::fs\"\n  assumes  \"[[atom a]]lst. e1 = [[atom b]]lst. e2\"\n  shows \"(a \\<leftrightarrow> b) \\<bullet> e1 = e2\"\n  by (metis Abs1_eq_iff'(3) Nominal2_Base.swap_self assms flip_commute flip_def fresh_star_zero supp_perm_eq_test)\n\nlemma fresh_filter: \"a = b \\<or> atom a \\<sharp> xs \\<Longrightarrow> atom a \\<sharp> filter (\\<lambda>x. x \\<noteq> b) xs\"\n  by (induction xs) (auto simp: fresh_Cons fresh_Nil)\n\nend\n", "meta": {"author": "jvanbruegge", "repo": "isabelle-lambda-calculus", "sha": "41fba58ed18fcb494b6b7abb6c8641a63002a1d5", "save_path": "github-repos/isabelle/jvanbruegge-isabelle-lambda-calculus", "path": "github-repos/isabelle/jvanbruegge-isabelle-lambda-calculus/isabelle-lambda-calculus-41fba58ed18fcb494b6b7abb6c8641a63002a1d5/Nominal2_Lemmas.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266116, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.30081976223479745}}
{"text": "section \\<open>LLVM Code Generator\\<close>\ntheory LLVM_Codegen\nimports LLVM_Shallow\nbegin\n\n    (* DO NOT USE IN PRODUCTION VERSION \\<rightarrow> SLOWDOWN *)\n    (* declare [[ML_exception_debugger, ML_debugger, ML_exception_trace]] *)\n\n  text \\<open>This is the trusted part of the code generator, which accepts\n    Isabelle-LLVM programs that follow a strict format \n    (fully monadified, only \\<open>ll_\\<close> instructions).\n    \n    The preprocessor and user-interface of the code generator can be found in \n    @{file \"../preproc/LLVM_Codegen_Preproc.thy\"}\n  \\<close>\n\n  subsection \\<open>Pair Types\\<close>\n  text \\<open>The code generator will translate pair instructions if such a predicate is registered.\n    here, @{typ 't} must be of form \\<open>(...)type\\<close>, and \\<open>tfrees 't\\<^sub>1,'t\\<^sub>2 \\<subseteq> tfrees 't\\<close>, \n    and there can only be one such predicate per type.\n  \\<close>\n  definition \n    ll_is_pair_type :: \"bool \\<Rightarrow> 't::llvm_rep itself \\<Rightarrow> 't\\<^sub>1::llvm_rep itself \\<Rightarrow> 't\\<^sub>2::llvm_rep itself \\<Rightarrow> bool\"\n  where \"ll_is_pair_type anonymous _ _ _ \\<equiv> struct_of TYPE('t) = llvm_s_pair (struct_of TYPE('t\\<^sub>1)) (struct_of TYPE('t\\<^sub>2))\"\n\n  named_theorems ll_is_pair_type_thms \\<open>Isabelle-LLVM: Theorems for user-defined tuple types\\<close>\n  \n  lemma TERM_TYPE_I: \"TERM (TYPE ('a))\" .\n  \n  lemma ll_dest_pair_type:\n    assumes \"ll_is_pair_type anon TYPE('t::llvm_rep) TYPE('t\\<^sub>1::llvm_rep) TYPE('t\\<^sub>2::llvm_rep)\"\n    assumes \"TERM (TYPE('t))\"\n    shows \"TERM (TYPE('t\\<^sub>1))\" \"TERM (TYPE('t\\<^sub>2))\"\n    .\n  \n  \n  \n  subsection \\<open>General Functions\\<close>\n  ML \\<open> structure LLC_Lib = \n    struct\n      fun dest_llM (Type (@{type_name M},[T,@{typ unit},@{typ llvm_memory},@{typ err}])) = T\n        | dest_llM ty = raise TYPE(\"dest_llM\",[ty],[]);\n      \n      val is_llM = can dest_llM\n\n      fun dest_ptrT (Type (@{type_name ptr},[T])) = T\n        | dest_ptrT ty = raise TYPE(\"dest_ptrT\",[ty],[]);\n      \n      fun dest_numeralT (Type (@{type_name \\<open>bit0\\<close>},[ty])) = 2*dest_numeralT ty\n        | dest_numeralT (Type (@{type_name \\<open>bit1\\<close>},[ty])) = 2*dest_numeralT ty+1\n        | dest_numeralT (Type (@{type_name \\<open>num0\\<close>},[])) = 0\n        | dest_numeralT (Type (@{type_name \\<open>num1\\<close>},[])) = 1\n        | dest_numeralT ty = raise TYPE (\"dest_numeralT\",[ty],[])\n    \n      fun dest_wordT (Type (@{type_name word},[T])) = dest_numeralT T\n        | dest_wordT T = raise TYPE(\"dest_wordT\",[T],[])\n        \n      fun dest_word_const (t) = HOLogic.dest_number t |>> dest_wordT\n      \n      fun dest_eqn @{mpat \"?lhs\\<equiv>?rhs\"} = (lhs,rhs)\n        | dest_eqn @{mpat \\<open>Trueprop (?lhs = ?rhs)\\<close>} = (lhs,rhs)\n        | dest_eqn t = raise TERM (\"dest_eqn\",[t])\n\n      val is_eqn = can dest_eqn\n        \n      val dest_eqn_thm = dest_eqn o Thm.prop_of  \n      \n      val lhs_of_eqn = fst o dest_eqn\n      val rhs_of_eqn = snd o dest_eqn\n      \n      val head_of_eqn =head_of o lhs_of_eqn\n      val head_of_eqn_thm = head_of_eqn o Thm.prop_of\n      \n      fun eqn_conv cvl cvr ct = let \n        val cv = Conv.arg1_conv cvl then_conv Conv.arg_conv cvr \n      in\n        (case Thm.term_of ct of\n          @{mpat \"_\\<equiv>_\"} => cv ct\n        | @{mpat \"Trueprop (_ = _)\"} => HOLogic.Trueprop_conv cv ct\n        | _ => raise CTERM (\"rhs_conv\", [ct]))\n      end\n      \n      fun lhs_conv cv = eqn_conv cv Conv.all_conv\n      fun rhs_conv cv = eqn_conv Conv.all_conv cv\n      \n              \n      (* TODO: Move *)\n      fun instantiate_uc (tyenv,tenv) thm = let\n        val thy = Thm.theory_of_thm thm\n        \n        val tyi = Vartab.dest tyenv |> map (fn (n,(s,T)) => ((n,s),Thm.global_ctyp_of thy T))\n        val ti = Vartab.dest tenv |> map (fn (n,(s,t)) => ((n,s),Thm.global_cterm_of thy t))\n      in\n        Thm.instantiate (tyi,ti) thm\n      end\n\n      fun is_monomorphic_const (Const (_,T)) = \n        not (Term.exists_subtype (fn TVar _ => true | TFree _ => true | _ => false) T)\n      | is_monomorphic_const _ = false\n\n      fun assert_monomorphic_const t = \n        is_monomorphic_const t orelse \n          raise TYPE(\"Expected monomorphic constant\",[fastype_of t],[t])\n            \n\n      fun unique_variant1 n name ntab = let\n        val name' = if n=0 then name else name ^ Int.toString n\n      in    \n        if Symtab.defined ntab name' then unique_variant1 (n+1) name ntab\n        else (name', Symtab.insert_set name' ntab)\n      end\n      \n      val unique_variant = unique_variant1 0\n      \n      \n      fun the_assert msg NONE = raise Fail msg \n         | the_assert _ (SOME x) = x \n      \n      \n      fun dest_is_pair_type_thm thm = case Thm.prop_of thm of \n        @{mpat (typs) \"Trueprop (ll_is_pair_type \n            ?anon \n            TYPE(?'v_t::llvm_rep) \n            TYPE(?'v_ta::llvm_rep) \n            TYPE(?'v_tb::llvm_rep))\"} => let \n              val anon = case anon of @{mpat \"True\"} => true | @{mpat \"False\"} => false | _ => raise THM(\"dest_is_pair_type_thm: Not a literal Boolean\",~1,[thm])\n            in\n              (anon,t,ta,tb)\n            end\n      | _ => raise THM(\"dest_is_pair_type_thm\",~1,[thm])\n         \n      \n      fun expand_eta_all t = let\n        fun declare_bnames (Free (a,_)) = Name.declare a\n          | declare_bnames (Abs (x,_,t)) = declare_bnames t #> Name.declare x\n          | declare_bnames (t1$t2) = declare_bnames t1 #> declare_bnames t2\n          | declare_bnames _ = I\n      \n        val context = declare_bnames t Name.context\n        val Ts = binder_types (fastype_of t)\n        val xTs = Name.invent context \"x\" (length Ts) ~~ Ts\n      \n        fun exp [] t = t\n          | exp (_::Ts) (Abs (x,T,t)) = Abs (x,T,exp Ts t)\n          | exp ((x,T)::Ts) t = Abs (x,T,exp Ts (incr_boundvars 1 t $ Bound 0))\n        \n      in\n        exp xTs t\n      end  \n      \n\n      fun dest_head (Const nt) = nt\n        | dest_head (Free nt) = nt\n        | dest_head t = raise TERM(\"dest_head\", [t])\n            \n      val is_valid_head = can dest_head\n      fun check_valid_head f = \n        (is_valid_head f orelse raise TERM(\"Invalid head (expected const or free)\",[f]); f)\n      \n      val name_of_head = fst o dest_head\n                    \n      \n      \n      val llc_compile_while =\n        Config.bool (Config.declare (\"llc_compile_while\", \\<^here>) (fn _ => Config.Bool true));\n      \n      \n      \n    end\n  \\<close>\n  \n  subsection \\<open>Intermediate Representation\\<close>\n  text \\<open>\n    The code generator translates Isabelle terms into this intermediate representation,\n    and then generates LLVM code from this. \n    No transformations are done on the intermediate representation, but it merely serves \n    to cleanly separate the interpretation and checking of Isabelle terms, and the generation\n    of LLVM code.\n  \\<close>\n  \n  (*\n  TODO: conceptually, named types should be disambiguated during monomorphization,\n    such that all named types come without type parameters!\n    Is this feasible? Monomorphization would have to define new types.\n  *)  \n  \n  ML \\<open> structure LLC_Intermediate = \n    struct\n    \n      (* LLC intermediate representation. Somewhere in between Isabelle and LLVM-IR *)    \n      \n      datatype llc_type = TInt of int | TPtr of llc_type | TPair of llc_type*llc_type | TNamed of string\n      datatype llc_const = CInit | CInt of int | CNull\n      datatype llc_opr = OVar of string | OConst of llc_const\n      type llc_topr = llc_type * llc_opr\n      datatype llc_topr' = OOOp of llc_topr | OOType of llc_type\n\n      datatype llc_cmd = \n                 CmIf of llc_topr * llc_block * llc_block\n               | CmWhile of (llc_type * string) * llc_block * llc_block * llc_topr\n               | CmInstr of string * llc_topr' list\n               | CmCall of llc_type option * string * llc_topr list\n      \n          and llc_block =\n                BlBind of (llc_type * string) option * llc_cmd * llc_block\n              | BlReturn of llc_topr option \n    \n      datatype llc_eqn =              \n                EQN of llc_type option * string * (llc_type * string) list * llc_block\n    \n      datatype llc_named_type = Named_Type of string * llc_type list                \n                \n      fun pretty_mstr m s = Pretty.markup m [Pretty.str s]\n      \n      fun pretty_type (TInt w) = pretty_mstr Markup.keyword1 (\"i\" ^ Int.toString w)\n        | pretty_type (TPtr T) = Pretty.block [pretty_type T, Pretty.str \"*\"]\n        | pretty_type (TPair (T1,T2)) = Pretty.list \"{\" \"}\" (map pretty_type [T1,T2])\n        | pretty_type (TNamed name) = Pretty.str name\n      \n      fun pretty_const CInit = pretty_mstr Markup.keyword1 \"zeroinitializer\"\n        | pretty_const (CInt i) = pretty_mstr Markup.numeral (Int.toString i)\n        | pretty_const CNull = pretty_mstr Markup.keyword1 \"null\"\n\n      fun pretty_opr (OVar name) = Pretty.str name\n        | pretty_opr (OConst c) = pretty_const c\n        \n      fun pretty_topr (T,opr) = Pretty.block [pretty_type T, Pretty.brk 1, pretty_opr opr]\n      \n      fun pretty_topr' (OOOp x) = pretty_topr x \n        | pretty_topr' (OOType T) = pretty_type T\n      \n      fun pretty_tname (T,v) = Pretty.block [pretty_type T, Pretty.brk 1, Pretty.str v]  \n        \n      fun pretty_type' (SOME t) = pretty_type t \n        | pretty_type' NONE = pretty_mstr Markup.keyword1 \"void\"  \n        \n      fun pretty_cmd (CmIf (b, c1, c2)) = Pretty.block [\n          pretty_mstr Markup.keyword2 \"if\", Pretty.brk 1, pretty_topr b, Pretty.brk 1, pretty_mstr Markup.keyword2 \"then\", Pretty.fbrk,\n            Pretty.blk (4, [pretty_block c1]),\n            Pretty.fbrk, pretty_mstr Markup.keyword2 \"else\", Pretty.fbrk,\n            Pretty.blk (4, [pretty_block c2])\n          ]  \n        | pretty_cmd (CmWhile (v,b,c,s)) = Pretty.block [\n            pretty_mstr Markup.keyword2 \"while\", Pretty.enclose \"[\" \"]\" [pretty_tname v], Pretty.fbrk, \n              Pretty.blk (4, [pretty_block b]),\n              Pretty.fbrk, pretty_mstr Markup.keyword2 \"do\", Pretty.fbrk,\n              Pretty.blk (4, [pretty_block c]),\n              Pretty.fbrk, pretty_mstr Markup.keyword2 \"init \", pretty_topr s\n          ] \n        | pretty_cmd (CmInstr (name,ops)) = Pretty.block [Pretty.str name, Pretty.brk 1, Pretty.list \"\" \"\" (map pretty_topr' ops)]\n        | pretty_cmd (CmCall (T,name,ops)) = Pretty.block [pretty_type' T, pretty_mstr Markup.keyword2 \" call \", Pretty.str name, Pretty.brk 1, Pretty.list \"(\" \")\" (map pretty_topr ops)]\n        \n      and pretty_block blk = let\n        fun pblst (BlBind (SOME tv,c,b)) = Pretty.block [pretty_tname tv, Pretty.str \" = \", pretty_cmd c] :: pblst b\n          | pblst (BlBind (NONE,c,b)) = pretty_cmd c :: pblst b\n          | pblst (BlReturn NONE) = [pretty_mstr Markup.keyword2 \"return\"]\n          | pblst (BlReturn (SOME x)) = [Pretty.block [pretty_mstr Markup.keyword2 \"return \",pretty_topr x]]\n          \n      in\n        Pretty.block (Pretty.fbreaks (pblst blk))\n      end\n        \n      fun pretty_eqn (EQN (ty,name,params,block)) = Pretty.block [\n        Pretty.block [pretty_type' ty, Pretty.brk 1, Pretty.str name, Pretty.list \"(\" \")\" (map pretty_tname params), Pretty.str \" {\", \n          Pretty.fbrk, Pretty.blk (4,[pretty_block block]), Pretty.fbrk, Pretty.str \"}\"], Pretty.fbrk\n        ]\n\n      fun pretty_eqns eqns = Pretty.block (Pretty.fbreaks (map pretty_eqn eqns))\n      \n      fun pretty_named_type (Named_Type (name,tys)) = Pretty.block [pretty_mstr Markup.keyword3 \"type \", Pretty.str name, Pretty.str \" = \", \n        Pretty.list \"{\" \"}\" (map pretty_type tys) ]\n      \n      fun pretty_named_tys ntys = Pretty.block (Pretty.fbreaks (map pretty_named_type ntys))\n        \n      fun pretty_llc (ntys,eqns) = Pretty.block [pretty_named_tys ntys, Pretty.fbrk, pretty_eqns eqns]\n\n    end\n  \\<close>\n        \n  subsection \\<open>Isabelle Term Parser\\<close>\n  text \\<open>Parser from Isabelle terms to intermediate representation\\<close>\n  ML \\<open> structure LLC_Compiler = \n    struct\n      open LLC_Lib LLC_Intermediate\n    \n      (* Maps Isabelle type names to named type theorems *)\n      structure Named_Type_Tab = Proof_Data (\n        type T = thm Symtab.table\n        val init = K Symtab.empty\n      )\n\n      (* Record type instance: LLVM name and field types *)\n      type named_type_inst = string * llc_type list\n      \n      (* Maps instantiated (monomorphic) Isabelle types to instances *)\n      structure NTInst_Tab = Proof_Data (\n        type T = named_type_inst Typtab.table\n        val init = K Typtab.empty\n      )\n\n      fun build_named_type_tables ctxt = let\n        fun check_pt thm = let\n          val (_, typ, typa, typb) = dest_is_pair_type_thm thm\n          val _ = is_Type typ orelse raise TYPE(\"check_pt: Expected type\",[typ],[])\n          val (tname,args) = dest_Type typ\n          \n          val _ = forall is_TVar args orelse raise TYPE(\"check_pt: Expected simple type\",[typ],[])\n          \n          val tvars = Term.add_tvarsT typ []\n          val tvarsa = Term.add_tvarsT typa []\n          val tvarsb = Term.add_tvarsT typb []\n          \n          val _ = subset op= (tvarsa, tvars) andalso subset op= (tvarsb, tvars)\n            orelse raise TYPE(\"check_pt: additional type vars in element types\",[typ,typa,typb],[])\n          \n        in\n          (tname,thm)\n        end\n        \n        val typtab = Named_Theorems.get ctxt @{named_theorems ll_is_pair_type_thms} |> map check_pt |> Symtab.make\n      in\n        ctxt\n        |> Named_Type_Tab.put typtab\n      \n      end\n      \n      fun mk_type_thm ctxt T = Thm.instantiate' [SOME (Thm.ctyp_of ctxt T)] [] @{thm TERM_TYPE_I}\n      val dest_type_thm = Thm.prop_of #> Logic.dest_term #> Logic.dest_type\n\n      fun inst_pair_type ctxt (T as Type(tname,_)) = let\n        val thm = Symtab.lookup (Named_Type_Tab.get ctxt) tname\n        val _ = is_none thm andalso raise TYPE(\"Not a registered pair type\",[T],[]);\n        val thm = the thm\n        val (anon,_,_,_) = dest_is_pair_type_thm thm\n      \n        val ftypes = map (fn x => dest_type_thm (x OF [thm,mk_type_thm ctxt T])) @{thms ll_dest_pair_type}\n      in\n        (anon,ftypes)\n      end\n      | inst_pair_type _ T = raise TYPE(\"Invalid type for pair type\",[T],[])\n      \n      fun llc_parse_type (Type (@{type_name word},[T])) ctxt = (dest_numeralT T |> TInt, ctxt)\n        | llc_parse_type (Type (@{type_name ptr},[T])) ctxt = llc_parse_type T ctxt |>> TPtr\n        | llc_parse_type (T as Type _) ctxt = llc_make_type_inst T ctxt\n        | llc_parse_type T _ = raise TYPE (\"llc_parse_type: \",[T],[])\n      and\n      (* Lookup or make named type instance *)\n      llc_make_type_inst T ctxt = case Typtab.lookup (NTInst_Tab.get ctxt) T of\n        SOME (name,_) => (TNamed name, ctxt)\n      | NONE => let\n          val (tname,_) = dest_Type T\n          \n          (* Get anonymity and instantiated field types *)\n          val (anon,field_types) = inst_pair_type ctxt T\n        in  \n          if anon then let\n            (* Recursively parse field types *)\n            val (field_ltypes,ctxt) = fold_map llc_parse_type field_types ctxt\n            \n            val (lta,ltb) = case field_ltypes of\n              [lta,ltb] => (lta,ltb)\n            | _ => raise TYPE(\"Internal: Currently expecting exactly 2 fields!\",T::field_types,[])\n          in\n            (TPair (lta,ltb), ctxt)\n          end\n          else let\n            (* Make name variant *)\n            val used_names = NTInst_Tab.get ctxt |> Typtab.dest |> map (fst o snd) |> Name.make_context\n            val (lname,_) = Name.variant (Name.desymbolize NONE tname) used_names\n            \n            (* Register this instance, with empty fields first *)\n            val ctxt = NTInst_Tab.map (Typtab.update (T,(lname,[]))) ctxt\n            \n            (* Recursively parse field types *)\n            val (field_ltypes,ctxt) = fold_map llc_parse_type field_types ctxt\n            \n            (* Register fields for this instance *)\n            val ctxt = NTInst_Tab.map (Typtab.update (T,(lname,field_ltypes))) ctxt\n        \n          in\n            (TNamed lname, ctxt)\n          end\n        end\n    \n      fun compute_fun_names fixes thms = let\n        val _ = map (assert_monomorphic_const o fst) fixes\n      \n        val ftab = Termtab.make fixes\n        val names = fold (fn (_,n) => Symtab.update_new (n,())) fixes Symtab.empty\n        \n        fun add_thm thm (ftab,names) = let\n          val c = head_of_eqn_thm thm\n        in\n          if Termtab.defined ftab c then\n            (ftab,names)\n          else let\n            val n = name_of_head c |> Name.desymbolize NONE\n            val (n,names) = unique_variant n names\n            val ftab = Termtab.update_new (c,n) ftab\n          in\n            (ftab,names)\n          end\n        end\n        \n        val (ftab,_) = fold add_thm thms (ftab,names)\n      in\n        ftab\n      end\n\n                \n      (* TODO/FIXME: Populate with actual instructions! Register them, together with their compilers! *)  \n      fun is_llvm_instr name = String.isPrefix \"LLVM_Shallow.ll_\" name\n                \n      fun llc_parse_vtype (Type (@{type_name unit},[])) ctxt = (NONE, ctxt)\n        | llc_parse_vtype T ctxt = llc_parse_type T ctxt |>> SOME\n        \n      fun llc_parse_const @{mpat (typs) \\<open>init::?'v_T::llvm_rep\\<close>} ctxt = llc_parse_type T ctxt |>> (fn T => (T,CInit))\n        | llc_parse_const @{mpat (typs) \\<open>null::?'v_T::llvm_rep ptr\\<close>} ctxt = llc_parse_type T ctxt |>> (fn T => (TPtr T, CNull))\n        | llc_parse_const t ctxt = case try dest_word_const t of\n            SOME (w,v) => ((TInt w, CInt v), ctxt)\n          | NONE => raise TERM (\"llc_parse_const: \",[t])\n      \n      local    \n\n        type Tstored = (llc_type * string) option list\n            \n        local\n          val env_empty = (Symtab.empty,Termtab.empty,[])\n          \n          structure LLC_Env = Proof_Data (\n            type T = Symtab.set * (llc_type * string) Termtab.table * (llc_type * string) option list   \n            fun init _ = env_empty\n          )\n          \n        in\n\n          val env_init = LLC_Env.put env_empty\n          val env_save = #3 o LLC_Env.get \n          fun env_restore bnds ctxt = let\n            val (syms,params,_) = LLC_Env.get ctxt\n            val ctxt = LLC_Env.put (syms,params,bnds) ctxt\n          in ctxt end\n        \n          (* val env_syms = LLC_Env.get #> #1 *)\n          val env_params = LLC_Env.get #> #2\n          val env_bnds = LLC_Env.get #> #3\n                \n          fun make_uniqueN n tab name = let\n            val name' = if n=0 then name else name ^ Int.toString n\n          in\n            if Symtab.defined tab name' then\n              make_uniqueN (n+1) tab name\n            else\n              name'\n          end\n          \n          val make_unique = make_uniqueN 0\n          \n          \n          fun env_add_sym name ctxt = let\n            val (syms,params,bnds) = LLC_Env.get ctxt\n            val name = Name.desymbolize NONE name |> make_unique syms\n            val syms = Symtab.insert_set name syms\n            val ctxt = LLC_Env.put (syms,params,bnds) ctxt\n          in\n            (name,ctxt)\n          end\n          \n          fun env_add_bound lty name ctxt = let\n            val (name,ctxt) = env_add_sym name ctxt\n            val (syms,params,bnds) = LLC_Env.get ctxt\n            val bnds = SOME (lty,name)::bnds\n            val ctxt = LLC_Env.put (syms,params,bnds) ctxt\n          in\n            (name,ctxt)\n          end\n          \n          fun env_add_unit_bound ctxt = let\n            val (syms,params,bnds) = LLC_Env.get ctxt\n            val ctxt = LLC_Env.put (syms,params,NONE::bnds) ctxt\n          in\n            ctxt\n          end\n          \n          fun env_add_param v ctxt = let\n            val (iname,ty) = dest_Var v\n            val name = fst iname\n            val (lty,ctxt) = llc_parse_type ty ctxt\n          \n            val (name,ctxt) = env_add_sym name ctxt\n            val (syms,params,bnds) = LLC_Env.get ctxt\n            val params = Termtab.update_new (v,(lty,name)) params\n            val ctxt = LLC_Env.put (syms,params,bnds) ctxt\n          in\n            ((lty,name),ctxt)\n          end\n        end\n\n        fun env_lookup_bound ctxt i = case nth (env_bnds ctxt) i of SOME x => x | NONE => raise TERM (\"Reference to bound unit variable\",[])\n        fun env_lookup_param ctxt v = Termtab.lookup (env_params ctxt) v |> the\n                \n      \n        fun env_parse_add_bound T x ctxt = case llc_parse_vtype T ctxt of\n          (NONE,ctxt) => (NONE, env_add_unit_bound ctxt)\n        | (SOME ty,ctxt) => let\n            val (x,ctxt) = env_add_bound ty x ctxt\n          in\n            (SOME (ty,x),ctxt)\n          end  \n        \n        \n      in\n      \n        fun llc_parse_op (Bound i) ctxt = (env_lookup_bound ctxt i ||> OVar, ctxt)\n          | llc_parse_op (t as Var _) ctxt = (env_lookup_param ctxt t ||> OVar, ctxt)\n          | llc_parse_op t ctxt = llc_parse_const t ctxt |>> apsnd OConst\n      \n        fun llc_parse_op' (t as @{mpat \\<open>TYPE (_)\\<close>}) ctxt = llc_parse_type (Logic.dest_type t) ctxt |>> OOType\n          | llc_parse_op' t ctxt = llc_parse_op t ctxt |>> OOOp\n          \n        fun llc_parse_op_opt @{mpat \"()\"} ctxt = (NONE, ctxt)  \n          | llc_parse_op_opt t ctxt = llc_parse_op t ctxt |>> SOME\n          \n        fun llc_parse_op_bool t ctxt = let\n          val ((ty,x),ctxt) = llc_parse_op t ctxt\n          val _ = ty=TInt 1 orelse raise TERM (\"parse_op_bool: not a Boolean\",[t])\n        in\n          ((ty,x), ctxt)\n        end  \n          \n        structure Fun_Tab = Proof_Data (\n          type T = string Termtab.table \n          val init = K Termtab.empty\n        )\n        \n        \n        fun ftab_lookup ctxt f = let\n          val fname = Termtab.lookup (Fun_Tab.get ctxt) f\n          val _ = is_none fname andalso raise TYPE(\"No such function in ftab\",[fastype_of f],[f])\n          val fname = the fname\n        in fname end  \n\n        \n        fun check_valid_pair_inst ctxt t pT i fT = let\n          val (_,fTs') = inst_pair_type ctxt pT\n          val _ = i < length fTs' andalso fT = nth fTs' i\n            orelse raise TYPE(\"Invalid pair instruction instance\",[fastype_of (head_of t)],[t])\n          \n          (*val _ = Pretty.block [Pretty.str \"Type instance OK \", Syntax.pretty_term ctxt t, Pretty.str \" :: \", Syntax.pretty_typ ctxt (fastype_of t) ]\n            |> Pretty.string_of |> writeln\n          *)  \n        in\n          ()\n        end\n        \n        \n        fun check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_extract_fst :: ?'v_pT::llvm_rep \\<Rightarrow> ?'v_aT::llvm_rep llM\\<close>}) = \n              check_valid_pair_inst ctxt t pT 0 aT\n          | check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_extract_snd :: ?'v_pT::llvm_rep \\<Rightarrow> ?'v_bT::llvm_rep llM\\<close>}) = \n              check_valid_pair_inst ctxt t pT 1 bT\n          | check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_insert_fst :: ?'v_pT::llvm_rep \\<Rightarrow> ?'v_aT::llvm_rep \\<Rightarrow> _\\<close>}) = \n              check_valid_pair_inst ctxt t pT 0 aT\n          | check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_insert_snd :: ?'v_pT::llvm_rep \\<Rightarrow> ?'v_bT::llvm_rep \\<Rightarrow> _\\<close>}) = \n              check_valid_pair_inst ctxt t pT 1 bT\n          | check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_gep_fst :: ?'v_pT::llvm_rep ptr \\<Rightarrow> ?'v_aT::llvm_rep ptr llM\\<close>}) = \n              check_valid_pair_inst ctxt t pT 0 aT\n          | check_llvm_struct_cmd ctxt (t as @{mpat (typs) \\<open>ll_gep_snd :: ?'v_pT::llvm_rep ptr \\<Rightarrow> ?'v_bT::llvm_rep ptr llM\\<close>}) = \n              check_valid_pair_inst ctxt t pT 1 bT\n          | check_llvm_struct_cmd _ _ = ()\n\n        \n                        \n        fun llc_parse_cmd rty t ctxt = \n          let\n            val (f,args) = strip_comb t\n\n            val _ = check_valid_head f            \n            val cname = name_of_head f\n            \n          in\n            case cname of\n              @{const_name \\<open>llc_if\\<close>} => (case args of \n                  [arg_cond,arg_then,arg_else] => let\n                    val (l_cond, ctxt) = llc_parse_op_bool arg_cond ctxt\n                    val (l_then,ctxt) = llc_parse_block arg_then ctxt\n                    val (l_else,ctxt) = llc_parse_block arg_else ctxt\n                  in\n                    (CmIf (l_cond,l_then,l_else), ctxt)\n                  end\n                | _ => raise TERM (\"parse_cmd: If needs 3 arguments\",[t])\n              )\n            | @{const_name \\<open>llc_while\\<close>} => (case args of [@{mpat \"\\<lambda>_. ?tcond\"}, @{mpat \"\\<lambda>xb. ?tbody\"}, arg_inits] => let\n                    val (inits,ctxt) = llc_parse_op arg_inits ctxt\n\n                    val env = env_save ctxt\n                                        \n                    val (sv,ctxt) = env_parse_add_bound xb_T xb ctxt\n                    val sv = case sv of NONE => raise TERM (\"While with unit-state not yet supported\",[t])\n                                      | SOME sv => sv\n                    \n                    val (cond,ctxt) = llc_parse_block tcond ctxt\n                    val (body,ctxt) = llc_parse_block tbody ctxt\n                    \n                    val ctxt = env_restore env ctxt\n                    \n                  in\n                    (CmWhile (sv, cond, body, inits), ctxt)\n                  end\n                | _ => raise TERM (\"parse_cmd: While needs 3 arguments\",[t])\n              )\n            | _ => \n                if is_llvm_instr cname then let \n                    val _ = check_llvm_struct_cmd ctxt f\n                    val (ops,ctxt) = fold_map llc_parse_op' args ctxt\n                  in (CmInstr (cname,ops), ctxt) end\n                else let \n                    val (ops,ctxt) = fold_map llc_parse_op args ctxt\n                    val fname = ftab_lookup ctxt f\n                  in (CmCall (rty, fname ,ops), ctxt) end\n                   \n          end\n        and llc_parse_block @{mpat \"bind ?m (\\<lambda>x. ?f)\"} ctxt = \n          let \n            val (rty,ctxt) = llc_parse_vtype x_T ctxt\n            val (cmd, ctxt) = llc_parse_cmd rty m ctxt\n            val env = env_save ctxt\n            val (sv,ctxt) = env_parse_add_bound x_T x ctxt\n            val (blk,ctxt) = llc_parse_block f ctxt\n            val ctxt = env_restore env ctxt\n          in\n            (BlBind (sv,cmd,blk),ctxt)\n          end\n          | llc_parse_block @{mpat \"return ()\"} ctxt = (BlReturn NONE, ctxt)\n          | llc_parse_block @{mpat \"return ?x\"} ctxt = llc_parse_op x ctxt |>> SOME |>> BlReturn\n          | llc_parse_block t _ = raise TERM (\"llc_parse_block: structural error\",[t])\n         \n          \n        fun llc_parse_eqn @{mpat \"Trueprop (?lhs = ?rhs)\"} ctxt = let\n          val (hdc,params) = strip_comb lhs\n        \n          val _ = check_valid_head hdc\n          val _ = map (fn a => is_Var a orelse raise TERM (\"llc_parse_eqn: arguments must be vars\",[a])) params\n\n          val fname = ftab_lookup ctxt hdc \n          \n          val ctxt = env_init ctxt\n                    \n          val (params,ctxt) = fold_map env_add_param params ctxt\n          val (blk,ctxt) = llc_parse_block rhs ctxt\n          \n          val (rlty, ctxt) = llc_parse_vtype (dest_llM (fastype_of lhs)) ctxt\n\n          (* Erase meaningless environment after equation has been parsed! *)\n          val ctxt = env_init ctxt \n        in\n          (EQN (rlty,fname,params,blk), ctxt)\n        end\n        | llc_parse_eqn t _ = raise TERM (\"llc_parse_eqn: Expected equation of form lhs = rhs\", [t])\n          \n          \n      end      \n      \n      fun parse_cthms_aux thms ctxt = fold_map (llc_parse_eqn o Thm.prop_of) thms ctxt\n            \n      fun parse_cthms ftab thms ctxt = let\n        val ctxt = Fun_Tab.put ftab ctxt\n        val (eqns,ctxt) = parse_cthms_aux thms (build_named_type_tables ctxt)\n        \n        val named_tys = NTInst_Tab.get ctxt |> Typtab.dest |> map (Named_Type o snd)\n      in \n        (named_tys,eqns)\n      end\n          \n    end\n    \n  \\<close>  \n\n  subsection \\<open>LLVM Writer\\<close>\n  \n  text \\<open>LLVM Builder. Interface to build actual LLVM text.\\<close>\n  ML_file \"LLVM_Builder.ml\"\n  \n  text \\<open>Compiler from intermediate representation to actual LLVM text.\\<close>\n  ML \\<open> structure LLC_Backend = \n    struct\n      open LLC_Lib LLC_Intermediate\n    \n      type vtab = LLVM_Builder.value Symtab.table\n      type builder = vtab -> LLVM_Builder.regname -> llc_topr' list -> LLVM_Builder.T -> LLVM_Builder.value option\n    \n      fun llc_ty _ (TInt w) = LLVM_Builder.mkty_i w\n        | llc_ty b (TPtr ty) = LLVM_Builder.mkty_ptr (llc_ty b ty)\n        | llc_ty b (TPair (ty1, ty2)) = LLVM_Builder.mkty_struct [llc_ty b ty1, llc_ty b ty2]\n        | llc_ty b (TNamed name) = LLVM_Builder.mkty_named b name\n      \n      \n      fun llc_const_to_val b ty CInit = LLVM_Builder.mkc_zeroinit (llc_ty b ty)\n        | llc_const_to_val b ty (CInt v) = LLVM_Builder.mkc_i (llc_ty b ty) v\n        | llc_const_to_val b ty (CNull) = LLVM_Builder.mkc_null (llc_ty b ty)\n      \n      fun llc_op_to_val _ vtab (_,OVar x) = the_assert (\"Variable not in vtab \" ^ x) (Symtab.lookup vtab x)\n        | llc_op_to_val b _ (ty,OConst c) = llc_const_to_val b ty c\n        \n      \n      fun dstreg NONE = NONE | dstreg (SOME s) = SOME s\n        \n      \n      fun arith_instr_builder iname vtab dst [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_arith_instr iname b dst (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2) |> SOME\n      ) | arith_instr_builder _ _ _ _ _ = raise Fail \"arith_instr_builder: invalid arguments\"\n      \n      fun icmp_instr_builder cmpcode vtab dst [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_icmp_instr cmpcode b dst (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2) |> SOME\n      ) | icmp_instr_builder _ _ _ _ _ = raise Fail \"icmp_instr_builder: invalid arguments\"\n\n      fun ptrcmp_instr_builder cmpcode vtab dst [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_ptrcmp_instr cmpcode b dst (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2) |> SOME\n      ) | ptrcmp_instr_builder _ _ _ _ _ = raise Fail \"icmp_instr_builder: invalid arguments\"\n            \n      fun conv_instr_builder cmpcode vtab dst [OOOp x1, OOType ty] b = (\n        LLVM_Builder.mk_conv_instr cmpcode b dst (llc_op_to_val b vtab x1) (llc_ty b ty) |> SOME\n      ) | conv_instr_builder _ _ _ _ _ = raise Fail \"conv_instr_builder: invalid arguments\"\n\n      fun extract_value_builder idx vtab dst [OOOp x1] b = (\n        LLVM_Builder.mk_extractvalue b dst (llc_op_to_val b vtab x1) idx |> SOME\n      ) | extract_value_builder _ _ _ _ _ = raise Fail \"extract_value_builder: invalid arguments\"\n\n      fun insert_value_builder idx vtab dst [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_insertvalue b dst (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2) idx |> SOME\n      ) | insert_value_builder _ _ _ _ _ = raise Fail \"insert_value_builder: invalid arguments\"\n      \n      fun malloc_builder vtab dst [OOType ty, OOOp x] b = (\n        LLVM_Builder.mk_malloc b dst (llc_ty b ty) (llc_op_to_val b vtab x) |> SOME\n      ) | malloc_builder _ _ _ _ = raise Fail \"malloc_builder: invalid arguments\"\n            \n      fun free_builder vtab _ [OOOp x] b = (\n        LLVM_Builder.mk_free b (llc_op_to_val b vtab x); NONE\n      ) | free_builder _ _ _ _ = raise Fail \"free_builder: invalid arguments\"\n\n      fun load_builder vtab dst [OOOp x] b = (\n        LLVM_Builder.mk_load b dst (llc_op_to_val b vtab x) |> SOME\n      ) | load_builder _ _ _ _ = raise Fail \"load_builder: invalid arguments\"\n      \n      fun store_builder vtab _ [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_store b (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2); NONE\n      ) | store_builder _ _ _ _ = raise Fail \"store_builder: invalid arguments\"\n\n      fun ofs_ptr_builder vtab dst [OOOp x1, OOOp x2] b = (\n        LLVM_Builder.mk_ofs_ptr b dst (llc_op_to_val b vtab x1) (llc_op_to_val b vtab x2) |> SOME\n      ) | ofs_ptr_builder _ _ _ _ = raise Fail \"ofs_ptr_builder: invalid arguments\"\n      \n      fun gep_idx_builder idx vtab dst [OOOp x1] b = (\n        LLVM_Builder.mk_gep_idx b dst (llc_op_to_val b vtab x1) (LLVM_Builder.mkc_iw 32 idx) |> SOME\n      ) | gep_idx_builder _ _ _ _ _ = raise Fail \"gep_idx_builder: invalid arguments\"\n      \n      fun register_builder (b:builder) (n:string) = Symtab.update_new (n,b)\n      \n      fun register_prfx_builder prfx b n = let\n        val iname = Long_Name.base_name n |> unprefix prfx\n      in\n        register_builder (b iname) n\n      end\n\n      val builders = Symtab.empty\n        |> fold (register_prfx_builder \"ll_\" arith_instr_builder) \n          [@{const_name ll_add}, @{const_name ll_sub}, @{const_name ll_mul},\n           @{const_name ll_udiv}, @{const_name ll_urem}, @{const_name ll_sdiv}, @{const_name ll_srem},\n           @{const_name ll_shl}, @{const_name ll_lshr}, @{const_name ll_ashr},\n           @{const_name ll_and}, @{const_name ll_or}, @{const_name ll_xor}\n          ]\n        |> fold (register_prfx_builder \"ll_\" conv_instr_builder) [\n             @{const_name ll_trunc}, @{const_name ll_sext}, @{const_name ll_zext}\n          ]  \n        |> fold (register_prfx_builder \"ll_icmp_\" icmp_instr_builder) [\n             @{const_name ll_icmp_eq}, @{const_name ll_icmp_ne}, \n             @{const_name ll_icmp_slt}, @{const_name ll_icmp_sle}, \n             @{const_name ll_icmp_ult}, @{const_name ll_icmp_ule} \n          ]  \n        |> fold (register_prfx_builder \"ll_ptrcmp_\" ptrcmp_instr_builder) [\n             @{const_name ll_ptrcmp_eq}, @{const_name ll_ptrcmp_ne}\n          ]  \n        |> register_builder (extract_value_builder 0) @{const_name ll_extract_fst}          \n        |> register_builder (extract_value_builder 1) @{const_name ll_extract_snd}          \n        |> register_builder (insert_value_builder 0) @{const_name ll_insert_fst}          \n        |> register_builder (insert_value_builder 1) @{const_name ll_insert_snd}          \n\n        |> register_builder (malloc_builder) @{const_name ll_malloc}          \n        |> register_builder (free_builder) @{const_name ll_free}          \n        |> register_builder (load_builder) @{const_name ll_load}          \n        |> register_builder (store_builder) @{const_name ll_store}          \n      \n        |> register_builder (ofs_ptr_builder) @{const_name ll_ofs_ptr}          \n        |> register_builder (gep_idx_builder 0) @{const_name ll_gep_fst}          \n        |> register_builder (gep_idx_builder 1) @{const_name ll_gep_snd}          \n            \n\n      fun vtab_bind (SOME dst) (SOME v) vtab = Symtab.update_new (dst,v) vtab  \n        | vtab_bind (SOME dst) NONE _ = raise Fail (\"Void instruction bound to value (\" ^ dst ^ \") \")\n        | vtab_bind _ _ vtab = vtab\n        \n      fun build_instr b vtab dst (iname,args) = let\n        val bld = Symtab.lookup builders iname \n          |> the_assert (\"Unknown instruction \" ^ iname)\n          \n        val v = bld vtab (dstreg dst) args b\n      in\n        vtab_bind dst v vtab\n      end  \n      \n      fun build_call b vtab dst (rty,pname,args) = let\n        val args = map (llc_op_to_val b vtab) args\n        val rty = map_option (llc_ty b) rty\n        \n        val v = case rty of \n          NONE => (LLVM_Builder.mk_call_void b pname args; NONE)\n        | SOME rty => LLVM_Builder.mk_call b (dstreg dst) rty pname args |> SOME\n\n      in\n        vtab_bind dst v vtab\n      end\n      \n      fun build_if build_block b vtab dst (op_cond, blk_then, blk_else) = let\n        val l_then = LLVM_Builder.variant_label b \"then\"\n        val l_else = LLVM_Builder.variant_label b \"else\"\n        val l_ctd_if = LLVM_Builder.variant_label b \"ctd_if\"\n      \n        val _ = LLVM_Builder.mk_cbr b (llc_op_to_val b vtab op_cond) l_then l_else\n        \n        val _ = LLVM_Builder.open_bb b l_then \n        val r_then = build_block b vtab blk_then\n        val l_then' = LLVM_Builder.mk_br b l_ctd_if\n        \n        val _ = LLVM_Builder.open_bb b l_else\n        val r_else = build_block b vtab blk_else\n        val l_else' = LLVM_Builder.mk_br b l_ctd_if\n        \n        val _ = LLVM_Builder.open_bb b l_ctd_if\n        val res = case (r_then, r_else) of\n          (NONE,NONE) => NONE\n        | (SOME r_then, SOME r_else) => \n            SOME (LLVM_Builder.mk_phi' b (dstreg dst) [(r_then,l_then'), (r_else,l_else')])\n        | _ => raise Fail (\"If type mismatch (void/non-void)\")\n      in\n        vtab_bind dst res vtab\n      end\n      \n      (*\n        \"while [x] cond body s\" is compiled to\n      \n        br start (in l_this)\n        \n        start:\n          %s = Phi (l_this,%s) (l_body',%s')\n          %b = \\<lbrakk>cond\\<rbrakk>(x\\<mapsto>%s)\n          cbr %b body end\n      \n        body:\n          %s' = \\<lbrakk>body\\<rbrakk>(x\\<mapsto>%s)\n          br start (in l_body')\n          \n        end:\n          (returns %s)\n\n      *)\n      fun build_while build_block b vtab dst (sv, blk_cond, blk_body, op_init) = let\n        val l_start = LLVM_Builder.variant_label b \"while_start\"\n        val l_body = LLVM_Builder.variant_label b \"while_body\"\n        val l_end = LLVM_Builder.variant_label b \"while_end\"\n        \n        val v_init = llc_op_to_val b vtab op_init\n        val l_this = LLVM_Builder.mk_br b l_start\n\n        val (s_ty,sname) = apfst (llc_ty b) sv\n        \n        (* start: *)\n        val _ = LLVM_Builder.open_bb b l_start\n        \n        (* s = \\<Phi> [v_init,this] [\\<dots>] *)\n        val (phi_handle,v_state) = LLVM_Builder.mk_phi b s_ty (SOME sname)\n        val _ = LLVM_Builder.phi_add b phi_handle (v_init, l_this)\n        val vtab' = vtab_bind (SOME sname) (SOME v_state) vtab\n        \n        (* cond *)\n        val r_cond = build_block b vtab' blk_cond\n        val r_cond = case r_cond of SOME x => x | NONE => raise Fail \"While (bug): Cond-block with no result\"\n        \n        (* cbr r_cond body end *)\n        val _ = LLVM_Builder.mk_cbr b r_cond l_body l_end\n        \n        (* body: *)\n        val _ = LLVM_Builder.open_bb b l_body\n        val r_body = build_block b vtab' blk_body\n        val r_body = case r_body of SOME x => x | NONE => raise Fail \"While (bug): Body-block with no result\"\n        val l_body' = LLVM_Builder.mk_br b l_start\n        \n        (* add [r_body,l_body'] to \\<Phi>-node of l_start *)\n        val _ = LLVM_Builder.phi_add b phi_handle (r_body,l_body')\n        \n        val _ = LLVM_Builder.open_bb b l_end\n      in\n        vtab_bind dst (SOME v_state) vtab\n      end\n      \n      fun build_cmd _ b vtab dst (CmInstr ia) = build_instr b vtab dst ia\n        | build_cmd _ b vtab dst (CmCall na) = build_call b vtab dst na\n        | build_cmd ctxt b vtab dst (CmIf bte) = build_if (build_block ctxt) b vtab dst bte\n        | build_cmd ctxt b vtab dst (CmWhile cbi) = \n            if Config.get ctxt llc_compile_while then\n              build_while (build_block ctxt) b vtab dst cbi\n            else\n              raise Fail \"Direct while compilation disabled! Declare [[llc_compile_while=true]] to enable!\"\n            \n      and build_block ctxt b vtab (BlBind (dst,cmd,blk)) = let\n            val dst = map_option snd dst\n            val vtab = build_cmd ctxt b vtab dst cmd\n          in\n            build_block ctxt b vtab blk\n          end\n        | build_block _ b vtab (BlReturn x) = map_option (llc_op_to_val b vtab) x\n              \n        \n        \n      fun build_eqn ctxt b (EQN (rty, pname, params, blk)) = let\n        val params = map (apfst (llc_ty b)) params\n        val rty = map_option (llc_ty b) rty\n        \n        val paramsv = LLVM_Builder.open_proc b rty pname params\n        \n        val vtab = fold (Symtab.update_new o apfst snd) (params ~~ paramsv) Symtab.empty\n        \n        val retv = build_block ctxt b vtab blk\n        \n        val _ = LLVM_Builder.mk_return b retv\n        val _ = LLVM_Builder.close_proc b\n      in\n        ()\n      end\n\n      fun build_named_ty b (Named_Type (name,ftys)) = let\n        val ltys = map (llc_ty b) ftys\n        val sty = LLVM_Builder.mkty_struct ltys\n      in\n        LLVM_Builder.decl_named_ty b name sty\n      end\n          \n      fun compile_to_llvm ctxt (tys,eqns) = let\n        val b = LLVM_Builder.builder ()\n        (* val _ = LLVM_Builder.set_dbg_trace b true *)\n        val _ = map (build_named_ty b) tys\n        val _ = map (build_eqn ctxt b) eqns\n        val res = LLVM_Builder.string_of b\n      in\n        res\n      end\n      \n    end\n       \n  \\<close>  \n\n  ML \\<open> structure Simple_PP = struct\n    datatype T = Word of string | NWord of string | Space of bool | Newline of bool | Block of int * T list\n\n    datatype last_tk = NL | WR | NW | SP (* Newline | word | nonword | space *)\n    \n    type state = int * last_tk  (* indentation, last token *)\n    \n    val init_state = (0,NL)\n\n    val indentS = \"  \"\n    val spaceS = \" \"\n    val newlineS = \"\\n\"\n    \n    fun indentation i = implode (replicate i indentS)\n    \n    fun string_of' (Word kw) (i,NL) = (indentation i ^ kw, (i,WR))\n      | string_of' (Word kw) (i,WR) = (spaceS ^ kw, (i,WR))\n      | string_of' (Word kw) (i,NW) = (kw, (i,WR))\n      | string_of' (Word kw) (i,SP) = (kw, (i,WR))\n      \n      | string_of' (NWord c) (i,NL) = (indentation i ^ c, (i,NW))\n      | string_of' (NWord c) (i,WR) = (c, (i,NW))\n      | string_of' (NWord c) (i,NW) = (c, (i,NW))\n      | string_of' (NWord c) (i,SP) = (c, (i,NW))\n      \n      | string_of' (Newline true) (i,_) = (newlineS, (i,NL))\n      | string_of' (Newline false) (i,NL) = (\"\", (i,NL))\n      | string_of' (Newline false) (i,_) = (newlineS, (i,NL))\n      \n      | string_of' (Space true) (i,_) = (spaceS, (i,SP))\n      | string_of' (Space false) (i,NL) = (\"\", (i,SP))\n      | string_of' (Space false) (i,SP) = (\"\", (i,SP))\n      | string_of' (Space false) (i,_) = (spaceS, (i,SP))\n      \n      | string_of' (Block (ii,tks)) (i,lt) = let \n          val (strs,(_,lt)) = fold_map string_of' tks (i+ii,lt)\n          val str = implode strs\n        in (str,(i,lt)) end\n      \n    (* User Interface *)    \n    fun string_of tk = string_of' tk init_state |> fst\n            \n    (* Basic Functions *)\n    val word = Word\n    val nword = NWord\n    val brk = Newline false\n    val fbrk = Newline true\n    val sep = Space false\n    val fsep = Space true\n    \n    fun block_indent i tks = Block (i,tks)\n    val block = block_indent 0\n    \n    (* Derived Functions *)\n    \n    fun enclose_indent i lpar rpar prt = block_indent i ([nword lpar,prt,nword rpar])\n\n    fun line prts = block (prts@[fbrk])\n    \n    val enclose = enclose_indent 0\n    val paren = enclose \"(\" \")\"\n    val braces = enclose \"{\" \"}\"\n    \n    fun big_block lpar rpar prts = block [block_indent 1 (nword lpar::brk::prts),brk,nword rpar]\n    val big_braces = big_block \"{\" \"}\"\n    \n    fun separate sep prts = block (Library.separate sep prts)\n    val commas = separate (nword \",\")\n    val brks = separate brk\n    val fbrks = separate fbrk\n\n    fun list sep lpar rpar prts = enclose lpar rpar (separate sep prts)\n    val parlist = list (nword \", \") \"(\" \")\"\n        \n    (* enclose, enclose_indent, separate, ... *)\n  \n  end\n  \\<close>\n  \n  ML \\<open>structure Parser_Util = struct\n    fun scan_if_then_else scan1 scan2 scan3 xs = let\n      val r = SOME (Scan.catch scan1 xs) handle Fail _ => NONE\n    in\n      case r of \n        NONE => scan3 xs\n      | SOME (a,xs) => scan2 a xs\n    end\n    \n\n    (* Choices, where first parser's success commits to this choice *)  \n    infixr 0 |||\n\n    fun (g,p) ||| e = scan_if_then_else g p e\n        \n    fun lastg (g,p) = g :|-- p\n  \n    val pkw = Parse.keyword_markup (true,Markup.keyword1)\n    val pcm = Parse.keyword_markup (true,Markup.keyword2)\n\n    \n    fun parse_inner kws p ctxt src = let\n      val s = src |> apfst cartouche |> Symbol_Pos.explode |> Symbol_Pos.cartouche_content\n      val kws = kws |> map (fn x => ((x,Position.none),Keyword.no_spec))\n      val kws = Keyword.add_keywords kws Keyword.empty_keywords\n      val tks = s |> Token.tokenize kws {strict=true} \n      (*val _ = map (Token.reports kws) tks |> flat*)\n      val tks = filter Token.is_proper tks\n      \n      fun parse_all src = let\n        val src = map Token.init_assignable src\n        val (res,_) = Scan.catch (Scan.finite Token.stopper (p --| Scan.ahead Parse.eof)) src\n        \n        val rp = map Token.reports_of_value src |> flat\n        val _ = Context_Position.reports ctxt rp\n        \n        (*val _ = map Token.reports_of_value src |> flat*)\n      in\n        res\n      end\n      \n      val res = parse_all tks\n    in\n      res\n    end\n    \n        \n    \n  end\\<close> \n  \n  \n  ML \\<open>structure C_Interface = struct\n    datatype cprim = \n        PRIM_CHAR\n      | PRIM_SI8 | PRIM_UI8\n      | PRIM_SI16 | PRIM_UI16\n      | PRIM_SI32 | PRIM_UI32\n      | PRIM_SI64 | PRIM_UI64\n      | PRIM_NAMED of string\n    datatype cfield = FLD_NAMED of ctype * string | FLD_ANON of cfield * cfield\n         and ctype = CTY_PRIM of cprim | CTY_PTR of ctype | CTY_PAIR of cfield * cfield\n  \n         \n    datatype typedef = TYPEDEF of string * ctype\n    fun dest_tydef (TYPEDEF (n,t)) = (n,t)\n    val mk_tydef = TYPEDEF\n\n    (* Signature *)\n    datatype c_sig = CSIG of ctype option * string * ctype list \n    \n    \n         \n    (* Parsing *)\n    local open Parser_Util in\n    \n      (* TODO: Check for valid C identifier *)\n      val parse_id = Parse.short_ident\n      \n      val parse_cprim = \n         pcm \"char\" >> K PRIM_CHAR\n      || pcm \"int8_t\" >> K PRIM_SI8\n      || pcm \"int16_t\" >> K PRIM_SI16\n      || pcm \"int32_t\" >> K PRIM_SI32\n      || pcm \"int64_t\" >> K PRIM_SI64\n      || pcm \"uint8_t\" >> K PRIM_UI8\n      || pcm \"uint16_t\" >> K PRIM_UI16\n      || pcm \"uint32_t\" >> K PRIM_UI32\n      || pcm \"uint64_t\" >> K PRIM_UI64\n      || parse_id >> PRIM_NAMED\n  \n      fun mk_ptr ty [] = ty\n        | mk_ptr ty (_::xs) = CTY_PTR (mk_ptr ty xs)\n      \n      fun parse_cfield s = (\n           parse_ctype -- parse_id --| Parse.$$$ \";\" >> FLD_NAMED\n        || parse_fld_pair --| Parse.$$$ \";\" >> FLD_ANON\n      ) s\n      and parse_fld_pair s = (pkw \"struct\" |-- Parse.$$$ \"{\" |-- parse_cfield -- parse_cfield --| Parse.$$$ \"}\") s\n      and parse_ctype1 s = (\n           parse_cprim >> CTY_PRIM\n        || parse_fld_pair >> CTY_PAIR\n      ) s\n      and parse_ctype s = (\n        parse_ctype1 -- Scan.repeat (Parse.$$$ \"*\") >> (fn (ty,ptrs) => mk_ptr ty ptrs)\n      ) s\n         \n      val parse_rtype = parse_ctype >> SOME || pcm \"void\" >> K NONE\n      \n      val parse_typedef = pkw \"typedef\" |-- parse_ctype -- parse_id --| Parse.$$$ \";\" >> (fn (ty,name) => mk_tydef (name,ty))\n      val parse_typedefs = Scan.repeat parse_typedef\n    \n    end\n    \n    val ct_basic_kws =       [\n      \"auto\",\n      \"break\",\n      \"case\",\n      \"char\",\n      \"const\",\n      \"continue\",\n      \"default\",\n      \"do\",\n      \"double\",\n      \"else\",\n      \"enum\",\n      \"extern\",\n      \"float\",\n      \"for\",\n      \"goto\",\n      \"if\",\n      \"inline\",\n      \"int\",\n      \"long\",\n      \"register\",\n      \"restrict\",\n      \"return\",\n      \"short\",\n      \"signed\",\n      \"sizeof\",\n      \"static\",\n      \"struct\",\n      \"switch\",\n      \"typedef\",\n      \"union\",\n      \"unsigned\",\n      \"void\",\n      \"volatile\",\n      \"while\",\n      \"_Alignas\",\n      \"_Alignof\",\n      \"_Atomic\",\n      \"_Bool\",\n      \"_Complex\",\n      \"_Generic\",\n      \"_Imaginary\",\n      \"_Noreturn\",\n      \"_Static_assert\",\n      \"_Thread_local\"\n    ]\n    val ct_basic_kw_set = Symtab.make_set ct_basic_kws\n    \n    val ct_kws = \n    [\"(\",\")\",\";\",\"{\",\"}\",\"*\",\",\"] (* TODO: Complete this list *)      \n    @\n    ct_basic_kws\n    @\n    [\"int8_t\", \"int16_t\", \"int32_t\", \"int64_t\",\n     \"uint8_t\", \"uint16_t\", \"uint32_t\", \"uint64_t\"]\n      \n    (* Checking *)\n    \n    fun is_cid_start s = Symbol.is_ascii_letter s orelse s=\"_\"\n    fun is_cid_ctd s = is_cid_start s orelse Symbol.is_ascii_digit s\n    \n    fun is_c_identifier s =\n      size s > 0 andalso is_cid_start (String.substring (s, 0, 1)) andalso\n      forall_string is_cid_ctd s andalso\n      not (Symtab.defined ct_basic_kw_set s);\n         \n    fun check_identifier name = (is_c_identifier name orelse error (\"Invalid identifier \" ^ name); ())\n      \n\n    fun check_decl (decl,_) name = (Symtab.defined decl name orelse error (\"Undeclared type \" ^ name); ())\n    fun check_complete (decl,def) name = (check_decl (decl,def) name; Symtab.defined def name orelse error (\"Incomplete type \" ^ name); ())\n          \n    fun check_type dd (CTY_PRIM (PRIM_NAMED name)) = check_complete dd name\n      | check_type _ (CTY_PRIM _) = ()\n      | check_type dd (CTY_PTR (CTY_PRIM (PRIM_NAMED name))) = check_decl dd name\n      | check_type dd (CTY_PTR t) = check_type dd t\n      | check_type dd (CTY_PAIR (f1,f2)) = (check_field dd f1; check_field dd f2)\n    and check_field dd (FLD_NAMED (ty,name)) = (check_type dd ty; check_identifier name)\n      | check_field dd (FLD_ANON (f1,f2)) = (check_field dd f1; check_field dd f2)\n      \n    fun is_valid_rty (dd as (_,def)) (CTY_PRIM (PRIM_NAMED name)) = \n          (case Symtab.lookup def name of NONE => false | SOME t => is_valid_rty dd t)\n      | is_valid_rty _ (CTY_PRIM _) = true\n      | is_valid_rty _ (CTY_PTR _) = true\n      | is_valid_rty _ (CTY_PAIR _) = false\n    \n    fun check_valid_rty dd t = (is_valid_rty dd t orelse error \"Aggregate return type not supported by C\"; ())  \n      \n    fun check_rtype _ NONE = ()\n      | check_rtype dd (SOME t) = (check_type dd t; check_valid_rty dd t)\n      \n    fun check_csig dd (CSIG (rty,name,argtys)) = (\n      check_rtype dd rty;\n      check_identifier name;\n      map (check_type dd) argtys;\n      ()\n    ) handle ERROR msg => error (\"Signature \" ^ name ^ \": \" ^ msg)\n      \n    (* Check list of type definitions, and create lookup table *)\n    fun check_tydefs tydefs = let\n      val tydefs = map dest_tydef tydefs\n      val _ = map (check_identifier o fst) tydefs\n      val decl = Symtab.make_set (map fst tydefs)\n            \n      fun add_tydef (name,ty) def = let\n        val _ = check_identifier name\n        val _ = Symtab.defined def name andalso error (\"Duplicate typedef \" ^ name)\n        val _ = check_type (decl,def) ty\n        val def = Symtab.update (name,ty) def\n      in\n        def\n      end\n    \n      val def = fold add_tydef tydefs Symtab.empty\n    in\n      (decl,def)\n    end\n      \n    \n    (* Printing *)\n    local open Simple_PP in\n      (* TODO: Rename _to_Cs \\<mapsto> pretty_ *)\n      fun cprim_to_Cs PRIM_CHAR = word \"char\"\n        | cprim_to_Cs PRIM_SI8 = word \"int8_t\" \n        | cprim_to_Cs PRIM_SI16 = word \"int16_t\"\n        | cprim_to_Cs PRIM_SI32 = word \"int32_t\"\n        | cprim_to_Cs PRIM_SI64 = word \"int64_t\"\n        | cprim_to_Cs PRIM_UI8 = word \"uint8_t\" \n        | cprim_to_Cs PRIM_UI16 = word \"uint16_t\"\n        | cprim_to_Cs PRIM_UI32 = word \"uint32_t\"\n        | cprim_to_Cs PRIM_UI64 = word \"uint64_t\"\n        | cprim_to_Cs (PRIM_NAMED name) = word name\n                                                  \n      fun cfield_to_Cs (FLD_NAMED (ty,name)) = block [ctype_to_Cs ty, word name, nword \";\"]  \n        | cfield_to_Cs (FLD_ANON fs) = block [fldpair_to_Cs fs, nword \";\"]\n      and fldpair_to_Cs (f1,f2) = block [word \"struct\", sep, big_braces [line [cfield_to_Cs f1], line [cfield_to_Cs f2]]]\n      and ctype_to_Cs (CTY_PRIM t) = cprim_to_Cs t\n        | ctype_to_Cs (CTY_PTR t) = block [ctype_to_Cs t, nword \"*\"]\n        | ctype_to_Cs (CTY_PAIR fs) = fldpair_to_Cs fs\n        \n      fun tydef_to_Cs (TYPEDEF (name,ty)) = block [word \"typedef\", ctype_to_Cs ty, sep, word name, nword \";\"]\n      \n      val tydefs_to_Cs = fbrks o map tydef_to_Cs\n        \n      fun rty_to_Cs NONE = word \"void\" | rty_to_Cs (SOME ty) = ctype_to_Cs ty\n      \n      fun csig_to_Cs (CSIG (rty,name,partys)) = block [rty_to_Cs rty,fsep,word name,parlist (map ctype_to_Cs partys),word \";\"]\n                \n      val csigs_to_Cs = fbrks o map csig_to_Cs\n    end\n\n    \n    (* Interface to LLVM types *)\n    \n    local open LLC_Intermediate in      \n      (* TODO: Will loop on recursive types! *)\n      fun lty_of_prim _ PRIM_CHAR = TInt 8\n        | lty_of_prim _ PRIM_SI8 = TInt 8\n        | lty_of_prim _ PRIM_SI16 = TInt 16\n        | lty_of_prim _ PRIM_SI32 = TInt 32\n        | lty_of_prim _ PRIM_SI64 = TInt 64\n        | lty_of_prim _ PRIM_UI8 = TInt 8\n        | lty_of_prim _ PRIM_UI16 = TInt 16\n        | lty_of_prim _ PRIM_UI32 = TInt 32\n        | lty_of_prim _ PRIM_UI64 = TInt 64\n        | lty_of_prim ntab (PRIM_NAMED name) = \n            case Symtab.lookup ntab name of \n              NONE => error (\"Undefined named type \" ^ name)\n            | SOME ty => lty_of_ctype ntab ty  \n      and lty_of_cfield ntab (FLD_NAMED (ty,_)) = lty_of_ctype ntab ty\n        | lty_of_cfield ntab (FLD_ANON (f1,f2)) = TPair (lty_of_cfield ntab f1, lty_of_cfield ntab f2)\n      and lty_of_ctype ntab (CTY_PRIM t) = lty_of_prim ntab t               \n        | lty_of_ctype ntab (CTY_PTR t) = TPtr (lty_of_ctype ntab t)\n        | lty_of_ctype ntab (CTY_PAIR (f1,f2)) = TPair (lty_of_cfield ntab f1, lty_of_cfield ntab f2)\n    \n        \n      fun cty_of_lty (TInt 8) = CTY_PRIM PRIM_SI8\n        | cty_of_lty (TInt 16) = CTY_PRIM PRIM_SI16\n        | cty_of_lty (TInt 32) = CTY_PRIM PRIM_SI32\n        | cty_of_lty (TInt 64) = CTY_PRIM PRIM_SI64\n        | cty_of_lty (TInt w) = error (\"cty_of_lty: Unsupported integer width \" ^ Int.toString w)\n        | cty_of_lty (TPtr ty) = CTY_PTR (cty_of_lty ty)\n        | cty_of_lty (TPair (ty1,ty2)) = CTY_PAIR (FLD_NAMED (cty_of_lty ty1,\"fst\"), FLD_NAMED (cty_of_lty ty2,\"snd\"))\n        | cty_of_lty (TNamed name) = error (\"cty_of_lty: Named ltys not supported: \" ^ name)\n        \n        \n      val cty_of_rlty = map_option cty_of_lty  \n        \n    end\n  end\\<close>\n  \n  \n  ML \\<open>structure LLC_HeaderGen = struct\n    open C_Interface\n  \n    (* Optional signature *)\n    datatype raw_sig = RSIG of ctype option option * string * ctype option list option\n    \n    datatype sigspec = NAME of string | SIG of raw_sig\n    \n    \n    fun name_of_rsig (RSIG (_,name,_)) = name\n    fun name_of_sigspec (NAME name) = name | name_of_sigspec (SIG sg) = name_of_rsig sg\n    \n    fun short_sig name = NAME name\n    fun long_sig sg = SIG sg\n    \n    (* Parsing of optional signature *)\n    fun parse_wildcard p = Parse.underscore >> K NONE || p >> SOME\n\n    fun parse_parlist p = Parse.$$$ \"(\" |-- Parse.enum \",\" p --| Parse.$$$ \")\"\n        \n    val parse_long_sig = \n      parse_wildcard parse_rtype -- parse_id -- Scan.option (parse_parlist (parse_wildcard parse_ctype))\n      >> (fn ((r,n),p) => long_sig (RSIG (r,n,p)))\n                           \n    val parse_short_sig = parse_id >> short_sig  \n    val parse_sig = parse_long_sig || parse_short_sig\n      \n    val parse_raw_sig = Parse.position (Parse.cartouche || Parse.short_ident || Parse.string)\n    val parse_raw_tydefs = Parse.position Parse.cartouche\n    \n    val check_raw_tydefs = Parser_Util.parse_inner ct_kws parse_typedefs\n    val check_raw_sig = Parser_Util.parse_inner ct_kws parse_sig\n    \n    \n    fun check_sigs dd sigs = let\n      fun add_sig (sg as RSIG (rt,name,args)) tab = let  \n        val _ = map_option (check_rtype dd) rt\n        val _ = map_option (map (map_option (check_type dd))) args\n        val _ = check_identifier name\n        \n        val _ = Symtab.defined tab name andalso error (\"Duplicate name\")\n        \n        val tab = Symtab.update (name,sg) tab\n        \n      in tab end handle ERROR msg => error (\"Signature \" ^ name ^ \": \" ^ msg)\n        \n      val tab = fold add_sig sigs Symtab.empty\n    \n    in\n      tab\n    end \n    \n    fun match_sig dd (rty,args) (RSIG (crty,name,cargs)) = let\n      val argtys = map fst args\n      val crty = the_default (cty_of_rlty rty) crty\n      \n      val cargs = the_default (replicate (length argtys) NONE) cargs\n    \n      val _ = length argtys = length cargs orelse error (\"Wrong number of arguments\")\n      \n      val cargs = map (fn (lty,cty) => the_default (cty_of_lty lty) cty) (argtys ~~ cargs)\n      \n      (* Consistency check *)\n      fun check_match (lty,cty) = if lty_of_ctype (snd dd) cty = lty then () else error \"Type mismatch\" (* TODO: More specific error message *)\n      \n      val _ = case (rty,crty) of \n        (NONE,NONE) => () \n      | (SOME lty, SOME cty) => check_match (lty,cty)\n      | _ => error \"Return type voidness mismatch\"\n      \n      val _ = map check_match (argtys ~~ cargs)\n    \n    in\n      CSIG (crty,name,cargs)\n    end handle ERROR msg => error (\"Signature \" ^ name ^ \": \" ^ msg)\n    \n    \n    fun make_header hfname tydefs sigspecs eqns = let\n      val sigs = map_filter (fn (NAME _) => NONE | (SIG sg) => SOME sg) sigspecs\n    \n      val dd = check_tydefs tydefs\n      val stab = check_sigs dd sigs\n\n      fun make_hd_id name = let \n        val name = Symbol.explode name |> filter is_cid_ctd |> map Symbol.to_ascii_upper |> implode\n        val name = \"_\" ^ name ^ \"_H\"\n      in name end  \n        \n      val hfname = make_hd_id hfname\n      \n            \n      fun process_eqn (LLC_Intermediate.EQN (rty,name,args,_)) = case Symtab.lookup stab name of\n        NONE => NONE\n      | SOME sg => SOME (match_sig dd (rty,args) sg)\n      \n      val csigs = map_filter process_eqn eqns\n      \n      val _ = map (check_csig dd) csigs\n      \n      val h_to_C = let\n        open Simple_PP\n        val hfsym = word hfname\n      in block [\n          (* TODO: Include information for which version of ll-file this has been generated! *)\n          line [word \"// Generated by Isabelle-LLVM. Do not modify.\"],\n          line [word \"#ifndef\", hfsym],\n          line [word \"#define\", hfsym, word \"1\"],\n          fbrk, fbrk,\n          tydefs_to_Cs tydefs,\n          fbrk, fbrk,\n          csigs_to_Cs csigs,\n          fbrk, fbrk,\n          line [word \"#endif\"]\n        ]\n      end\n      \n    in\n      case csigs of [] => NONE | _ => SOME (Simple_PP.string_of h_to_C)\n    end\n    \n    \n  end    \n    \n\\<close>    \n \n(*\noops   \n    \n    local open LLC_Intermediate Simple_PP in      \n         \n\n        \n\n          \n        fun resolve_lty_def (name,cty) ntab = \n          Symtab.update_new (name,lty_of_ctype ntab cty) ntab\n          handle Symtab.DUP _ => error (\"Duplicate named type \" ^ name)\n\n        fun resolve_lty_defs defs = fold resolve_lty_def defs Symtab.empty\n        \n        (*\n        xxx, ctd here: \n          Allow named types for function return types and arguments.\n          Look them up in ntab, and check for compatibility!\n        *)\n          \n          \n          \n      end\n      \n      val parse_tyn = parse_id >> SOME || Parse.underscore >> (fn _ => NONE)\n      val parse_rtyn = Parse.$$$ \"void\" >> (K (SOME NONE)) || parse_tyn >> map_option SOME\n      val parse_parlist = Parse.$$$ \"(\" |-- Parse.enum \",\" parse_tyn --| Parse.$$$ \")\"\n      val parse_long_sig = parse_rtyn -- parse_id -- parse_parlist\n        >> (fn ((rty,name),pars) => (name,RSIG (rty,SOME pars)))\n      \n      val parse_short_sig = Parse.short_ident >> (fn name => (name,RSIG (NONE,NONE)))\n      val parse_sig = parse_long_sig || parse_short_sig\n      \n            \n      \n      \n      \n      \n      val parse_sig_spec = Parse.position (Parse.cartouche || Parse.short_ident || Parse.string)\n      val parse_tydefs_spec = Parse.position Parse.cartouche\n\n            \n\n      val check_sig_spec = parse_inner ct_kws parse_sig\n      val check_tydefs_spec = parse_inner ct_kws parse_typedefs\n      \n      fun check_ctype tdtab lty cty = let\n        val lty' = lty_of_ctype tdtab cty\n        val _ = lty = lty' orelse error \"Declared ctype does not match ltype\" (* TODO: Better error message *)\n      in\n        cty\n      end\n      \n      fun mk_ctype tdtab (lty, NONE) = check_ctype tdtab lty (cty_of_lty lty)\n        | mk_ctype tdtab (lty, SOME name) = check_ctype tdtab lty (CTY_PRIM (PRIM_NAMED name))\n      \n      fun mk_rtype _ NONE NONE = NONE\n        | mk_rtype _ NONE (SOME NONE) = NONE\n        | mk_rtype _ NONE (SOME (SOME _)) = error \"Return type declared for void function\"\n        | mk_rtype _ (SOME _) (SOME NONE) = error \"Void type for non-void function\"\n        | mk_rtype tdtab (SOME lty) NONE = SOME (mk_ctype tdtab (lty, NONE))\n        | mk_rtype tdtab (SOME lty) (SOME (SOME name)) = SOME (mk_ctype tdtab (lty,SOME name))\n        \n      fun mk_csig tdtab (LLC_Intermediate.EQN (rty,name,pars,_), RSIG (rtyn,partyns)) = let\n        val rcty = mk_rtype tdtab rty rtyn\n        \n        val partyns = the_default (map (K NONE) pars) partyns\n        val pars = map fst pars\n        \n        val _ = length pars = length partyns orelse error \"Parameter number mismatch\"\n        val cpartys = (pars ~~ partyns) |> map (mk_ctype tdtab)\n        \n      in\n        CSIG (rcty,name,cpartys)\n      end handle ERROR msg => error (\"Signature for \" ^ name ^ \": \" ^ msg)\n        \n      fun is_valid_rty tdtab (CTY_PRIM (PRIM_NAMED name)) = \n            (case Symtab.lookup tdtab name of NONE => false | SOME t => is_valid_rty tdtab t)\n            \n        | is_valid_rty _ (CTY_PRIM _) = true\n        | is_valid_rty _ (CTY_PTR _) = true\n        | is_valid_rty _ (CTY_PAIR _) = false\n        \n      fun is_valid_rty' tdtab = the_default true o map_option (is_valid_rty tdtab)\n      \n      fun check_csig tdtab (CSIG (rty,name,_)) = let\n        (* TODO: Are there more restrictions? *)\n        \n        fun err msg = error (\"In function \" ^ name ^ \": \" ^ msg)\n      \n        val _ = is_valid_rty' tdtab rty orelse err \"Complex return type not supported by C\"\n        val _ = is_c_identifier name orelse err \"Invalid name\"\n      in () end  \n      \n      fun check_tydef_name (name,_) = ( is_c_identifier name orelse error (\"Invalid name \" ^ name)  ;())\n      \n                \n      fun make_header hfname eqns sigtab tydefs = let\n      \n        fun is_valid_cidchar s = \n          Symbol.is_ascii_letter s \n          orelse Symbol.is_ascii_digit s\n          orelse s=\"_\"\n\n        fun make_hd_id name = let \n          val name = Symbol.explode name |> filter is_valid_cidchar |> map Symbol.to_ascii_upper |> implode\n          val name = \"_\" ^ name ^ \"_H\"\n        in name end  \n          \n        val hfname = make_hd_id hfname\n      \n        val _ = map check_tydef_name tydefs\n        \n        val tdtab = resolve_lty_defs tydefs\n        \n        (* Filter equations for which header entry is to be generated *)\n        val eqns = map_filter (fn eqn as LLC_Intermediate.EQN (_,name,_,_) => case Symtab.lookup sigtab name of\n            NONE => NONE\n          | SOME sg => SOME (eqn,sg)\n        ) eqns\n\n        (* Generate header entries *)\n        val csigs = map (mk_csig tdtab) eqns\n        \n        val _ = map (check_csig (Symtab.make tydefs)) csigs\n        \n        (* TODO: Check that only ASCII-Names are used *)\n\n        val h_to_C = let\n          open Simple_PP\n          val hfsym = word (\"_\"^hfname^\"_H\")\n        in block [\n            (* TODO: Include information for which version of ll-file this has been generated! *)\n            line [word \"// Generated by Isabelle-LLVM. Do not modify.\"],\n            line [word \"#ifndef\", hfsym],\n            line [word \"#define\", hfsym, word \"1\"],\n            fbrk, fbrk,\n            tydefs_to_Cs tydefs,\n            fbrk, fbrk,\n            csigs_to_Cs csigs,\n            fbrk, fbrk,\n            line [word \"#endif\"]\n          ]\n        end\n      \n      in\n        case csigs of [] => NONE | _ => SOME (Simple_PP.string_of h_to_C)\n      end\n  \n    end\n  \\<close>\n  *)\n  \nend\n", "meta": {"author": "lammich", "repo": "isabelle_llvm", "sha": "6be37a9c3cae74a1134dbef2979e312abb5f7f42", "save_path": "github-repos/isabelle/lammich-isabelle_llvm", "path": "github-repos/isabelle/lammich-isabelle_llvm/isabelle_llvm-6be37a9c3cae74a1134dbef2979e312abb5f7f42/thys-2020/basic/kernel/LLVM_Codegen.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5350984286266115, "lm_q2_score": 0.5621765008857981, "lm_q1q2_score": 0.3008197622347974}}
{"text": "(*<*)\ntheory EverythingAdequacy\nimports CorrectnessOriginal Adequacy \"HOL-Library.LaTeXsugar\" \nbegin\n\n(*\nnotation (latex output) DenotationalUpd.ESem (\"\\<lbrakk>_\\<rbrakk>\\<^bsup>u\\<^esup>\\<^bsub>_\\<^esub>\"  [60,60] 60)\nnotation (latex output) \"Denotational-PropsUpd.HSem_syn\" (\"\\<lbrace>_\\<rbrace>\\<^bsup>u\\<^esup>_\"  [60,60] 60)\n*)\n\ntranslations\n  \"xs\" <= \"CONST set xs\"\ntranslations\n  \"a\" <= \"CONST atom a\"\ntranslations\n  \"a\" <= \"CONST image (CONST atom) a\"\n\nabbreviation map_of_syntax :: \"'a::type \\<Rightarrow> 'b::type \\<Rightarrow> ('a \\<times> 'b) list \\<Rightarrow> bool\" (\"'(_, _') \\<in> _\") \n  where \"map_of_syntax x e \\<Gamma> \\<equiv> map_of \\<Gamma> x = Some e\"\n\nabbreviation delete_syntax :: \"heap \\<Rightarrow> var \\<Rightarrow> heap\" (\"_\\\\_\") \n  where \"delete_syntax \\<Gamma> x \\<equiv> delete x \\<Gamma>\"\n\nnotation (latex output) domA (\"\\<^latex>\\<open>\\\\textrm{\\\\textsf{dom}}\\<close> _\")\nnotation (latex output) bn (\"\\<^latex>\\<open>\\\\textrm{\\\\textsf{dom}}\\<close> _\")\n\ndeclare [[names_short]]\ndeclare [[show_question_marks = false]]\n\n\n(*>*)\nsubsection \\<open>Main definitions and theorems\\<close>\n\ntext \\<open>\nFor your convenience, the main definitions and theorems of the present work are assembled in this section. The following \nformulas are mechanically pretty-printed versions of the statements as defined resp.\\ proven in Isabelle.\nFree variables are all-quantified. Some type conversion functions (like @{term_type set}) are omitted.\nThe relations \\<open>\\<sharp>\\<close> and \\<open>\\<sharp>*\\<close> come from the Nominal package and express freshness of the\nvariables on the left with regard to the expressions on the right.\n\n\\input{map.tex}\n\\<close>\n\nsubsubsection \\<open>Expressions\\<close>\n\ntext \\<open>\nThe type @{typ var} of variables is abstract and provided by the Nominal package. All we know about\nit is that it is countably infinite.\nExpressions of type @{typ exp} are given by the following grammar:\n\\begin{alignatstar}{2}\n@{term e} \\Coloneqq {}& @{term \"Lam [x]. e\"} &\\quad& \\text{lambda abstraction}\\\\\n\\mid {} & @{term \"App e x\"} && \\text{application}\\\\\n\\mid {} & @{term \"Var x\"} && \\text{variable} \\\\\n\\mid {} & @{term \"Let as e\"} && \\text{recursive let}\n\\end{alignatstar}\nIn the introduction we pretty-print expressions to resemble the notation in \\cite{launchbury} and omit\nthe constructor names @{term Var}, @{term App}, \\<open>Lam\\<close> and @{term Let}. In the actual theories, these are visible.\nThese expressions are, due to the machinery of the Nominal package, actually alpha-equivalency classes, so @{thm alpha_test} holds provably. This differs from Launchbury's original definition, which expects distinctly-named expressions and performs explicit alpha-renaming in the semantics.\n\nThe type @{type heap} is an abbreviation for @{typ \"(var \\<times> exp) list\"}. These are \\emph{not} alpha-equivalency classes, i.e.\\ we manage the bindings in heaps explicitly.\n\\<close>\n\nsubsubsection \\<open>The natural semantics\\<close>\n\ntext_raw \\<open>\n\\newlength{\\rulelen}\n\\setlength{\\rulelen}{\\linewidth}\n\\newlength{\\rulenamelen}\n\\settowidth{\\rulenamelen}{~{\\sc Application}}\n\\addtolength{\\rulelen}{-\\rulenamelen}\n\\<close>\n\ntext \\<open>\nLaunchbury's original semantics, extended with some technical overhead related to name binding (following \\cite{sestoft}),\nis defined as follows:\\\\\n%\\begin{center}\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Axiom] Launchbury.reds.Lambda}}~{\\sc Lambda}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] Launchbury.reds.Application}}~{\\sc Application}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] Launchbury.reds.Variable}}~{\\sc Variable}\\\\[2ex]\n\\parbox[t]{\\rulelen}{\\centering@{thm[mode=Rule] Launchbury.reds.Let}}~{\\sc Let}\n%\\end{center}\n\\<close>\n\n\nsubsubsection \\<open>The denotational semantics\\<close>\n\ntext \\<open>\nThe value domain of the denotational semantics is the initial solution to\n\\[\nD = [D \\to D]_\\bot\n\\]\nas introduced in \\cite{abramsky}. The type @{typ Value}, together with the bottom value @{term_type \"\\<bottom>::Value\"}, the\ninjection @{term_type \"Fn\"} and the projection @{term \"DUMMY \\<down>Fn DUMMY\"}\\<open>::\\<close>@{typeof \"Fn_project\"},\nis constructed as a pointed chain-complete partial order from this equation by the HOLCF package.\nThe type of semantic environments is  @{typ \"var \\<Rightarrow> Value\"}.\n\nThe semantics of an expression @{term_type \"e :: exp\"} in an environment @{term \"\\<rho>\"}\\<open>::\\<close>@{typ \"var \\<Rightarrow> Value\"} is \nwritten \\mbox{@{term_type \"Rep_cfun (Denotational.ESem e) \\<rho>\"}} and defined by the following equations:\n\\begin{alignstar}\n@{thm (lhs) Denotational.ESem_simps(1)} & = @{thm (rhs) Denotational.ESem_simps(1)} \\\\\n@{thm (lhs) Denotational.ESem_simps(2)} & = @{thm (rhs) Denotational.ESem_simps(2)} \\\\\n@{thm (lhs) Denotational.ESem_simps(3)} & = @{thm (rhs) Denotational.ESem_simps(3)} \\\\\n@{thm (lhs) Denotational.ESem_simps(6)} & = @{thm (rhs) Denotational.ESem_simps(6)}.\n\\end{alignstar}\n\\<close>\n\ntext\\<open>\nThe expression @{term \"Denotational.EvalHeapSem_syn \\<Gamma> \\<rho>\"} \nmaps the evaluation function over a heap, returning an environment:\n\\begin{alignstar}\n@{thm (lhs) lookupEvalHeap'[where f = \"(\\<lambda> e. Denotational.ESem_syn e \\<rho>)\"]}\n  & = @{thm (rhs) lookupEvalHeap'[where f = \"(\\<lambda> e. Denotational.ESem_syn e \\<rho>)\"]}\n  && \\text{if } @{thm (prem 1) lookupEvalHeap'[where f = \"(\\<lambda> e. Denotational.ESem_syn e \\<rho>)\"]} \\\\\n@{thm (lhs) lookupEvalHeap_other[where f = \"(\\<lambda> e. Denotational.ESem_syn e \\<rho>)\"]}\n  & = @{thm (rhs) lookupEvalHeap_other[where f = \"(\\<lambda> e. Denotational.ESem_syn e \\<rho>)\"]}\n  && \\text{if } @{thm (prem 1) lookupEvalHeap_other[where f = \"(\\<lambda> e. Denotational.ESem_syn e \\<rho>)\"]}\n\\end{alignstar}\n\\<close>\n\ntext \\<open>\nThe semantics @{term \"Rep_cfun (Denotational.HSem \\<Gamma>) \\<rho>\"}\\<open>::\\<close>@{typ \"var \\<Rightarrow> Value\"} of a\nheap @{term \"\\<Gamma> :: heap\"}\\<open>::\\<close>@{typ heap}\nin an environment @{term \"\\<rho>\"}\\<open>::\\<close>@{typ \"var \\<Rightarrow> Value\"} is  defined by the recursive equation\n\\[ @{thm \"Denotational.HSem_eq\"} \\]\nwhere\n\\begin{alignstar}\n@{thm (lhs) override_on_apply_notin} & = @{thm (rhs) override_on_apply_notin}  && \\text{if } @{thm (prem 1) override_on_apply_notin} \\\\\n@{thm (lhs) override_on_apply_in} & = @{thm (rhs) override_on_apply_in}  && \\text{if } @{thm (prem 1) override_on_apply_in}.\n\\end{alignstar}\n\nThe semantics of the heap in the empty environment @{term \"\\<bottom>\"} is abbreviated as @{term \"Denotational.AHSem_bot \\<Gamma>\"}.\n\\<close>\n\nsubsubsection \\<open>Correctness and Adequacy\\<close>\ntext \\<open>The statement of correctness  reads:\nIf @{thm (prem 1) CorrectnessOriginal.correctness(1)} and, as a side condition,\n@{thm (prem 2) CorrectnessOriginal.correctness(1)} holds,\nthen\n\\[\n@{thm (concl) CorrectnessOriginal.correctness(1)}.\n\\]\n\\<close>\n(*\n\\]\nand\n\\[\n@{thm (concl) CorrectnessOriginal.correctness(2)}.\n\\]\nThe latter is phrased slightly different than in \\cite{launchbury}, which defines a partial relation\n@{text \"\\<le>\"} on heaps, by being more explictit on what set of variables the heaps agree.\n*)\n\ntext \\<open>The statement of adequacy reads:\n\\[\n\\text{If }\n@{thm (prem 1) adequacy}\\text{ then }@{thm (concl) adequacy}.\n\\]\n\\<close>\n\nsubsection \\<open>Differences to our previous work\\<close>\n\ntext \\<open>\nWe have previously published \\cite{breitner2013} of which the present work is a continuation. They differ in scope and focus:\n\n\\subsubsection{The treatment of $\\sqcup$}\n\nIn \\cite{breitner2013}, the question of the precise meaning of $\\sqcup$ is discussed in detail. The\noriginal paper is not clear about whether this operator denotes the least upper bound, or the\nright-sided override operator. A lemma stated in \\cite{launchbury} only holds if $\\sqcup$ is the least upper bound,\nbut with that definition, Launchbury's Theorem 2 -- the generalized correctness theorem -- is false;\na counter-example is given in \\cite{breitner2013}.\n\nWe came up with an alternative operational semantics that keeps more of the\nevaluation context in the judgments and allows the correctness theorem to be proved inductively\nwithout the problematic generalization. We proved the two operational semantics equivalent and thus\nobtained the (non-generalized) correctness of Launchbury's semantics.\n\nWe also showed that if one takes $\\sqcup$ to be the update operator, Theorem 2 holds and the proof\ngoes through as it is. Furthermore, we showed that the resulting denotational semantics are\nidentical for expressions, and can differ only for heaps. Therefore, the question of the precise\nmeaning of $\\sqcup$ can be considered of little importance and for the present work we soley work\nwith right sided updates. We also avoid the ambiguos syntax $\\sqcup$ and write\n@{term \"DUMMY ++\\<^bsub>DUMMY\\<^esub> DUMMY\"} instead (the index indicates on what set the function on the right\noverrides the function on the left). The alternative operational semantics is not included in this work.\n\n\\subsubsection{The types of environments}\n\nAnother difference is the choice of the type for environments, which map variables to semantics values.\nA naive choice is @{typ \"var \\<Rightarrow> Value\"}, but this causes problems when defining the value semantics,\nfor which\n\\[\n@{thm Denotational.ESem_simps(1)}\n\\]\nis a defining equation. The argument on the left hand side is the representative of an equivalence class\n(defined using the Nominal package), so this is only allowed if the right hand side is indeed independent\n of the actual choice of \\<open>x\\<close>. This is shown most commonly and easily if \\<open>x\\<close> is fresh in all the\nother arguments (@{term \"atom x \\<sharp> \\<rho>\"}), and indeed the Nominal package allows us to specify this as a side\ncondition to the defining equation, which is what we did in \\cite{breitner2013}.\n\nBut this convenience comes as a price: Such side-conditions are\nonly allowed if the argument has finite support (otherwise there might no variable fulfilling\n@{term \"atom x \\<sharp> \\<rho>\"}). More precisely: The type of the argument must be a member of the @{class fs} typeclass\nprovided by the Nominal package. The type @{typ \"var \\<Rightarrow> Value\"} cannot be made a member of this class,\nas there obviously are elements that have infinite support. The fix here was to introduce a new type\n constructor, \\<open>fmap\\<close>, for partial functions with finite domain. This is fine: Only functions\nwith finite domain matter in our formalisation.\n\nThe introduction of \\<open>fmap\\<close> had further consequences. The main type class of the HOLCF package,\nwhich we use to define domains and continuous functions on them, is the class @{class cpo}, of chain-complete\npartial orders. With the usual ordering on partial functions, \\<open>(var, Value) fmap\\<close> cannot be\na member of this class. The fix here is to use a different ordering and only let elements be compareable\nthat have the same domain. In our formalisation, the domain is alway known (e.g.\\ all variables\nbound on some heap), so this worked out.\n\nBut not without causing yet another issue: With this ordering, \\<open>(var, Value) fmap\\<close> is a\n@{class cpo}, but lacks a bottom element, i.e.\\ now it is no @{class pcpo}, and HOLCF's built-in operator\n@{term \"\\<mu> x. f x\"} for expressing least fixed-points, as they occur in the semantics of heaps,\nis not available. Furthermore, \\<open>\\<squnion>\\<close> is not a total function, i.e.\\ defined only on a subset of\nall possible arguments. The solution was a rather convoluted set of theories that formalize functions that\nare continuous on a specific set, fixed-points on such sets etc.\n\nIn the present work, this problems is solved in a much more elegant way. Using a small trick we defined\nthe semantics functions so that\n\\[\n@{thm Denotational.ESem_simps(1)}\n\\]\nholds unconditionally. The actual, technical definition is\n\\[\n@{thm Denotational.ESem_simps_as_defined(1)}\n\\]\nwhere the right-hand-side can be shown to be invariant of the choice of \\<open>x\\<close>, as\n@{term \"x \\<notin> fv (Lam [x]. e)\"}. Once the function is defined, the equality\n@{thm Denotational.ESem_considers_fv'} can be proved. With that, the desired equation for\n@{thm (lhs) Denotational.ESem_simps(1)} follows. The same trick is applied to the equation for\n@{thm (lhs) Denotational.ESem_simps(6)}.\n\nThis allows us to use the type @{typ \"var \\<Rightarrow> Value\"} for the semantic envionments and considerably\nsimplifies the formalization compared to \\cite{breitner2013}.\n\n\\subsubsection{No type @{type assn}}\n\nThe nominal package provides means to define types that are alpha-equivalence classes, and we use that\nto define our type @{type exp}, which contains a constructor @{term \"Let binds expr\"}. The desired type\nof the parameter for the binding is @{typ \"(var \\<times> exp) list\"}, but the Nominal package does not support\nsuch nested recursion, and requires a mutual recursive definition with a custom type (@{type assn})\nwith constructors @{term ANil} and @{term ACons} that is isomorphic to @{typ \"(var \\<times> exp) list\"}.\nIn \\cite{breitner2013}, this type and conversion functions from and to @{typ \"(var \\<times> exp) list\"}\ncluttered the whole development. In the present work we improved this by defining the type with\na ``temporary'' constructor @{term_type LetA}. Afterwards we define conversions functions and\nthe desired constructor @{term_type Let}, and re-state all lemmas produced by the Nominal package\n(such as type exhaustiveness, distinctiveness of constructors and the induction rules) with that\nconstructor. From that point on, the development is free of the crutch @{typ assn}.\n\nIn short, the notable changes in this work over \\cite{breitner2013} are:\n\\begin{itemize}\n\\item We consider \\<open>\\<squnion>\\<close> to be a right-sided update and do discuss neither the problem with\n\\<open>\\<squnion>\\<close> denoting the least uppper bound, nor possible solutions.\n\\item This, a simpler choice for the type of semantic environments and a better definition of the type for terms, considerably simplifies the\nwork.\n\\item Most importantly, this work contains a complete and formal proof of the adequacy of Launchbury's semantics.\n\\end{itemize}\n\\<close>\n\ntext\\<open>\n\\subsection{Related work}\n\nLidia Sánchez-Gil, Mercedes Hidalgo-Herrero and Yolanda Ortega-Mallén have worked on formal aspects\nof Launchbury's semantics as well.\n\nThey identified a step in his adequacy proof\nrelating the standard and the resourced denotational semantics that is not as trivial as it seems at\nfirst and worked out a detailed pen-and-paper proof \\cite{functionspaces}, where they first \nconstruct a similarity relation @{term \"DUMMY \\<triangleleft>\\<triangleright> DUMMY\"} between the standard semantic domain\n(@{type Value}) and the resourced domain (@{type CValue}) and show that the denotation semantics yield\nsimilar results (@{thm denotational_semantics_similar}), which is one step in the adequacy proof.\nWe formalized this (Sections \\ref{sec_ValueSimilarity} and \\ref{sec_Denotational-Related}), identifying\nand fixing a mistake in the paper (Lemma 2.3(3) does not hold; the problem can be fixed by applying\nan extra round of take-induction in the proof of Proposition 9).\n\nCurrently, they are working on completing the adequacy proof as outlined by Launchbury, i.e.\\ by going\nvia the alternative natural semantics given in \\cite{launchbury}, which differs from the semantics\nabove in that the application rule works with an indirection on the heap instead of a substitution\nand that the variable rule has no blackholing and no update. In \\cite{indirections}, they relate\nthe original semantics with one where indirections have been introduced. The next step, modifying\nthe variable rule, is under development. Once that is done they can close the loop and have\ncompleted Launchbury's work.\n\nThis work proves the adequacy as stated by Launchbury as well, but in contrast to his proof outline no\nalternative operational semantics is introduced. The problems of indirection vs. substitution and\nof blackholing is solved on the denotational side instead, which turned out to be much easier than\nproving the various operational semantics to be equivalent.\n\\<close>\n\n(*<*)\n\nend\n(*>*)\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/Launchbury/EverythingAdequacy.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6992544335934766, "lm_q2_score": 0.43014734858584286, "lm_q1q2_score": 0.3007824405971293}}
{"text": "theory Bisim_Subst\n   imports Bisim_Struct_Cong Close_Subst\nbegin\n\ncontext env begin\n\nabbreviation\n  bisim_subst_judge (\"_ \\<rhd> _ \\<sim>\\<^sub>s _\" [70, 70, 70] 65) where \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q \\<equiv> (\\<Psi>, P, Q) \\<in> close_subst bisim\"\nabbreviation\n  bisim_subst_nil_judge (\"_ \\<sim>\\<^sub>s _\" [70, 70] 65) where \"P \\<sim>\\<^sub>s Q \\<equiv> S_bottom' \\<rhd> P \\<sim>\\<^sub>s Q\"\n\nlemmas bisim_subst_closed[eqvt] = close_subst_closed[OF bisim_eqvt]\nlemmas bisim_subst_eqvt[simp] = close_subst_eqvt[OF bisim_eqvt]\n\nlemma bisim_subst_output_pres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   M :: 'a\n  and   N :: 'a\n  \n  assumes \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n\n  shows \"\\<Psi> \\<rhd> M\\<langle>N\\<rangle>.P \\<sim>\\<^sub>s M\\<langle>N\\<rangle>.Q\"\n  using assms\nby(force intro!: close_substI intro: close_substE bisim_output_pres)\n\n\nlemma seq_subst_input_chain[simp]:\n  fixes xvec :: \"name list\"\n  and   N    :: \"'a\"\n  and   P    :: \"('a, 'b, 'c) psi\"\n  and   \\<sigma>    :: \"(name list \\<times> 'a list) list\"\n\n  assumes \"xvec \\<sharp>* \\<sigma>\"\n\n  shows \"seq_subs' (input_chain xvec N P) \\<sigma> = input_chain xvec (subst_term.seq_subst N \\<sigma>) (seq_subs P \\<sigma>)\"\nusing assms\nby(induct xvec) auto\n\nlemma bisim_subst_input_pres:\n  fixes \\<Psi>    :: 'b\n  and   P    :: \"('a, 'b, 'c) psi\"\n  and   Q    :: \"('a, 'b, 'c) psi\"\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n\n  assumes \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n  and     \"xvec \\<sharp>* \\<Psi>\"\n  and     \"distinct xvec\"\n\n  shows \"\\<Psi> \\<rhd> M\\<lparr>\\<lambda>*xvec N\\<rparr>.P \\<sim>\\<^sub>s M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q\"\nproof(rule_tac close_substI)\n  fix \\<sigma>::\"(name list \\<times> 'a list) list\"\n  assume wf: \"well_formed_subst \\<sigma>\"\n\n  obtain p where \"(p \\<bullet> xvec) \\<sharp>* \\<sigma>\"\n             and \"(p \\<bullet> xvec) \\<sharp>* P\" and \"(p \\<bullet> xvec) \\<sharp>* Q\" and \"(p \\<bullet> xvec) \\<sharp>* \\<Psi>\" and \"(p \\<bullet> xvec) \\<sharp>* N\"\n             and S: \"set p \\<subseteq> set xvec \\<times> set (p \\<bullet> xvec)\"\n      by(rule_tac c=\"(\\<sigma>, P, Q, \\<Psi>, N)\" in name_list_avoiding) auto\n    \n  from `\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q` have \"(p \\<bullet> \\<Psi>) \\<rhd> (p \\<bullet> P) \\<sim>\\<^sub>s (p \\<bullet> Q)\"\n    by(rule bisim_subst_closed)\n  with `xvec \\<sharp>* \\<Psi>` `(p \\<bullet> xvec) \\<sharp>* \\<Psi>` S have \"\\<Psi> \\<rhd> (p \\<bullet> P) \\<sim>\\<^sub>s (p \\<bullet> Q)\"\n    by simp\n\n  {\n    fix Tvec :: \"'a list\"\n    from `\\<Psi> \\<rhd> (p \\<bullet> P) \\<sim>\\<^sub>s (p \\<bullet> Q)` have \"\\<Psi> \\<rhd> (p \\<bullet> P)[<\\<sigma>>] \\<sim>\\<^sub>s (p \\<bullet> Q)[<\\<sigma>>]\" using wf\n      by(rule close_subst_unfold)\n    moreover assume \"length xvec = length Tvec\" and \"distinct xvec\"\n    ultimately have \"\\<Psi> \\<rhd> ((p \\<bullet> P)[<\\<sigma>>])[(p \\<bullet> xvec)::=Tvec] \\<sim> ((p \\<bullet> Q)[<\\<sigma>>])[(p \\<bullet> xvec)::=Tvec]\" \n      by(drule_tac close_substE[where \\<sigma>=\"[((p \\<bullet> xvec), Tvec)]\"]) auto\n  }\n\n  with `(p \\<bullet> xvec) \\<sharp>* \\<sigma>` `distinct xvec`\n  have \"\\<Psi> \\<rhd> (M\\<lparr>\\<lambda>*(p \\<bullet> xvec) (p \\<bullet> N)\\<rparr>.(p \\<bullet> P))[<\\<sigma>>] \\<sim> (M\\<lparr>\\<lambda>*(p \\<bullet> xvec) (p \\<bullet> N)\\<rparr>.(p \\<bullet> Q))[<\\<sigma>>]\"\n    by(force intro: bisim_input_pres)\n  moreover from `(p \\<bullet> xvec) \\<sharp>* N` `(p \\<bullet> xvec) \\<sharp>* P` S have \"M\\<lparr>\\<lambda>*(p \\<bullet> xvec) (p \\<bullet> N)\\<rparr>.(p \\<bullet> P) = M\\<lparr>\\<lambda>*xvec N\\<rparr>.P\" \n    apply(simp add: psi.inject) by(rule input_chain_alpha[symmetric]) auto\n  moreover from `(p \\<bullet> xvec) \\<sharp>* N` `(p \\<bullet> xvec) \\<sharp>* Q` S have \"M\\<lparr>\\<lambda>*(p \\<bullet> xvec) (p \\<bullet> N)\\<rparr>.(p \\<bullet> Q) = M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q\"\n    apply(simp add: psi.inject) by(rule input_chain_alpha[symmetric]) auto\n  ultimately show \"\\<Psi> \\<rhd> (M\\<lparr>\\<lambda>*xvec N\\<rparr>.P)[<\\<sigma>>] \\<sim> (M\\<lparr>\\<lambda>*xvec N\\<rparr>.Q)[<\\<sigma>>]\"\n    by force\nqed\n\nlemma bisim_subst_case_pres_aux:\n  fixes \\<Psi>   :: 'b\n  and   CsP :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n  and   CsQ :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n  \n  assumes C1: \"\\<And>\\<phi> P. (\\<phi>, P) mem CsP \\<Longrightarrow> \\<exists>Q. (\\<phi>, Q) mem CsQ \\<and> guarded Q \\<and> \\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n  and     C2: \"\\<And>\\<phi> Q. (\\<phi>, Q) mem CsQ \\<Longrightarrow> \\<exists>P. (\\<phi>, P) mem CsP \\<and> guarded P \\<and> \\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n\n  shows \"\\<Psi> \\<rhd> Cases CsP \\<sim>\\<^sub>s Cases CsQ\"\nproof -\n  {\n    fix \\<sigma> :: \"(name list \\<times> 'a list) list\"\n    assume wf: \"well_formed_subst \\<sigma>\"\n\n    have \"\\<Psi> \\<rhd> Cases(case_list_seq_subst CsP \\<sigma>) \\<sim> Cases(case_list_seq_subst CsQ \\<sigma>)\"\n    proof(rule bisim_case_pres)\n      fix \\<phi> P\n      assume \"(\\<phi>, P) mem (case_list_seq_subst CsP \\<sigma>)\"\n      then obtain \\<phi>' P' where \"(\\<phi>', P') mem CsP\" and \"\\<phi> = subst_cond.seq_subst \\<phi>' \\<sigma>\" and Peq_p': \"P = (P'[<\\<sigma>>])\"\n\tby(induct CsP) force+\n      from `(\\<phi>', P') mem CsP` obtain Q' where \"(\\<phi>', Q') mem CsQ\" and \"guarded Q'\" and \"\\<Psi> \\<rhd> P' \\<sim>\\<^sub>s Q'\" by(blast dest: C1)\n      from `(\\<phi>', Q') mem CsQ` `\\<phi> = subst_cond.seq_subst \\<phi>' \\<sigma>` obtain Q where \"(\\<phi>, Q) mem (case_list_seq_subst CsQ \\<sigma>)\" and \"Q = Q'[<\\<sigma>>]\"\n\tby(induct CsQ) auto\n      with Peq_p' `guarded Q'` `\\<Psi> \\<rhd> P' \\<sim>\\<^sub>s Q'` show \"\\<exists>Q. (\\<phi>, Q) mem (case_list_seq_subst CsQ \\<sigma>) \\<and> guarded Q \\<and> \\<Psi> \\<rhd> P \\<sim> Q\" using wf\n\tby(blast dest: close_substE guarded_seq_subst)\n    next\n      fix \\<phi> Q\n      assume \"(\\<phi>, Q) mem (case_list_seq_subst CsQ \\<sigma>)\"\n      then obtain \\<phi>' Q' where \"(\\<phi>', Q') mem CsQ\" and \"\\<phi> = subst_cond.seq_subst \\<phi>' \\<sigma>\" and Qeq_q': \"Q = Q'[<\\<sigma>>]\"\n\tby(induct CsQ) force+\n      from `(\\<phi>', Q') mem CsQ` obtain P' where \"(\\<phi>', P') mem CsP\" and \"guarded P'\" and \"\\<Psi> \\<rhd> P' \\<sim>\\<^sub>s Q'\" by(blast dest: C2)\n      from `(\\<phi>', P') mem CsP` `\\<phi> = subst_cond.seq_subst \\<phi>' \\<sigma>` obtain P where \"(\\<phi>, P) mem (case_list_seq_subst CsP \\<sigma>)\" and \"P = P'[<\\<sigma>>]\"\n\tby(induct CsP) auto\n      with Qeq_q' `guarded P'` `\\<Psi> \\<rhd> P' \\<sim>\\<^sub>s Q'` show \"\\<exists>P. (\\<phi>, P) mem (case_list_seq_subst CsP \\<sigma>) \\<and> guarded P \\<and> \\<Psi> \\<rhd> P \\<sim> Q\" using wf\n\tby(blast dest: close_substE guarded_seq_subst)\n    qed\n  }\n  thus ?thesis\n    by(rule_tac close_substI) auto\nqed\n\nlemma bisim_subst_reflexive:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s P\"\nby(auto intro: close_substI bisim_reflexive)\n\nlemma bisim_subst_transitive:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n  and     \"\\<Psi> \\<rhd> Q \\<sim>\\<^sub>s R\"\n\n  shows \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s R\"\nusing assms\nby(auto intro: close_substI close_substE bisim_transitive)\n\nlemma bisim_subst_symmetric:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n\n  shows \"\\<Psi> \\<rhd> Q \\<sim>\\<^sub>s P\"\nusing assms\nby(auto intro: close_substI close_substE bisimE)\n(*\nlemma bisim_subst_case_pres:\n  fixes \\<Psi>   :: 'b\n  and   CsP :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n  and   CsQ :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n  \n  assumes \"length CsP = length CsQ\"\n  and     C: \"\\<And>(i::nat) \\<phi> P \\<phi>' Q. \\<lbrakk>i <= length CsP; (\\<phi>, P) = nth CsP i; (\\<phi>', Q) = nth CsQ i\\<rbrakk> \\<Longrightarrow> \\<phi> = \\<phi>' \\<and> \\<Psi> \\<rhd> P \\<sim> Q\"\n  shows \"\\<Psi> \\<rhd> Cases CsP \\<sim>\\<^sub>s Cases CsQ\"\nproof -\n  {\n    fix \\<phi> \n    and P\n    assume \"(\\<phi>, P) mem CsP\"\n    with `length CsP = length CsQ` have \"\\<exists>Q. (\\<phi>, Q) mem CsQ \\<and> \\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n      apply(induct n==\"length CsP\" arbitrary: CsP CsQ rule: nat.induct)\n      apply simp\n      apply simp\n      apply auto\n  }\nusing `length CsP = length CsQ`\nproof(induct n==\"length CsP\" rule: nat.induct)\n  case zero\n  thus ?case by(force intro: bisim_subst_reflexive)\nnext\n  case(Suc n)\nnext\napply auto\napply(blast intro: bisim_subst_reflexive)\napply auto\napply(simp add: nth.simps)\napply(auto simp add: nth.simps)\napply blast\napply(rule_tac bisim_subst_case_pres_aux)\napply auto\n*)\nlemma bisim_subst_par_pres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> R \\<sim>\\<^sub>s Q \\<parallel> R\"\nusing assms\nby(force intro!: close_substI intro: close_substE bisim_par_pres)\n\nlemma bisim_subst_res_pres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   x :: name\n\n  assumes \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n  and     \"x \\<sharp> \\<Psi>\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>P \\<sim>\\<^sub>s \\<lparr>\\<nu>x\\<rparr>Q\"\nproof(rule_tac close_substI)\n  fix \\<sigma> :: \"(name list \\<times> 'a list) list\"\n  assume wf: \"well_formed_subst \\<sigma>\"\n\n  obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> P\" and \"y \\<sharp> Q\" and \"y \\<sharp> \\<sigma>\"\n    by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\n  from `\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q` have \"([(x, y)] \\<bullet> \\<Psi>) \\<rhd> ([(x, y)] \\<bullet> P) \\<sim>\\<^sub>s ([(x, y)] \\<bullet> Q)\"\n    by(rule bisim_subst_closed)\n  with `x \\<sharp> \\<Psi>` `y \\<sharp> \\<Psi>` have \"\\<Psi> \\<rhd> ([(x, y)] \\<bullet> P) \\<sim>\\<^sub>s ([(x, y)] \\<bullet> Q)\"\n    by simp\n  hence \"\\<Psi> \\<rhd> ([(x, y)] \\<bullet> P)[<\\<sigma>>] \\<sim> ([(x, y)] \\<bullet> Q)[<\\<sigma>>]\" using wf\n    by(rule close_substE)\n  hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>(([(x, y)] \\<bullet> P)[<\\<sigma>>]) \\<sim> \\<lparr>\\<nu>y\\<rparr>(([(x, y)] \\<bullet> Q)[<\\<sigma>>])\" using `y \\<sharp> \\<Psi>`\n    by(rule bisim_res_pres)\n  with `y \\<sharp> P` `y \\<sharp> Q` `y \\<sharp> \\<sigma>`\n  show \"\\<Psi> \\<rhd> (\\<lparr>\\<nu>x\\<rparr>P)[<\\<sigma>>] \\<sim> (\\<lparr>\\<nu>x\\<rparr>Q)[<\\<sigma>>]\"\n    by(simp add: alpha_res)\nqed\n\nlemma bisim_subst_bang_pres:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n \n  assumes \"\\<Psi> \\<rhd> P \\<sim>\\<^sub>s Q\"\n  and     \"guarded P\"\n  and     \"guarded Q\"\n\n  shows \"\\<Psi> \\<rhd> !P \\<sim>\\<^sub>s !Q\"\nusing assms\nby(force intro!: close_substI intro: close_substE bisim_bang_pres guarded_seq_subst)\n\nlemma subst_nil[simp]:\n  fixes xvec :: \"name list\"\n  and   Tvec :: \"'a list\"\n\n  assumes \"well_formed_subst \\<sigma>\"\n  and     \"distinct xvec\"\n\n  shows \"(\\<zero>[<\\<sigma>>]) = \\<zero>\"\nusing assms\nby simp\n\nlemma bisim_subst_par_nil:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> \\<zero> \\<sim>\\<^sub>s P\" \nby(force intro: close_substI bisim_par_nil)\n\nlemma bisim_subst_par_comm:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> P \\<parallel> Q \\<sim>\\<^sub>s Q \\<parallel> P\"\napply(rule close_substI)\nby(force intro: close_substI bisim_par_comm)\n\nlemma bisim_subst_par_assoc:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n  and   R :: \"('a, 'b, 'c) psi\"\n\n  shows \"\\<Psi> \\<rhd> (P \\<parallel> Q) \\<parallel> R \\<sim>\\<^sub>s P \\<parallel> (Q \\<parallel> R)\"\napply(rule close_substI)\nby(force intro: close_substI bisim_par_assoc)\n\nlemma bisim_subst_res_nil:\n  fixes \\<Psi> :: 'b\n  and   x :: name\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>\\<zero> \\<sim>\\<^sub>s \\<zero>\"\nproof(rule close_substI)\n  fix \\<sigma>:: \"(name list \\<times> 'a list) list\"\n\n  obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<sigma>\"\n    by(generate_fresh \"name\") (auto simp add: fresh_prod)\n  have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>\\<zero> \\<sim> \\<zero>\" by(rule bisim_res_nil)\n  with `y \\<sharp> \\<sigma>`  show \"\\<Psi> \\<rhd> (\\<lparr>\\<nu>x\\<rparr>\\<zero>)[<\\<sigma>>] \\<sim> \\<zero>[<\\<sigma>>]\"\n    by(subst alpha_res[of y]) auto\nqed\n\nlemma seq_subst2:\n  fixes x :: name\n  and   P :: \"('a, 'b, 'c) psi\"\n  and \\<sigma> :: \"(name list \\<times> 'a list) list\"\n\n  assumes \"x \\<sharp> \\<sigma>\"\n  and     \"x \\<sharp> P\"\n\n  shows \"x \\<sharp> P[<\\<sigma>>]\"\n  using assms\nproof(induct \\<sigma> arbitrary: P)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a \\<sigma>)\n  then show ?case\n    by(cases a) auto\nqed\n\nnotation subst_term.seq_subst (\"_[<_>]\" [100, 100] 100)\n\nlemma bisim_subst_scope_ext:\n  fixes \\<Psi> :: 'b\n  and   x :: name\n  and   P :: \"('a, 'b, 'c) psi\"\n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> P\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q) \\<sim>\\<^sub>s P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q\" \nproof(rule close_substI)\n  fix \\<sigma>:: \"(name list \\<times> 'a list) list\"\n\n  obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<sigma>\" and \"y \\<sharp> P\" and \"y \\<sharp> Q\"\n    by(generate_fresh \"name\") (auto simp add: fresh_prod)\n  moreover from  `y \\<sharp> \\<sigma>` `y \\<sharp> P` have \"y \\<sharp> P[<\\<sigma>>]\"\n    by(rule seq_subst2)\n  hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>((P[<\\<sigma>>]) \\<parallel> (([(x, y)] \\<bullet> Q)[<\\<sigma>>])) \\<sim> (P[<\\<sigma>>]) \\<parallel> \\<lparr>\\<nu>y\\<rparr>(([(x, y)] \\<bullet> Q)[<\\<sigma>>])\"\n    by(rule bisim_scope_ext)\n  with `x \\<sharp> P` `y \\<sharp> P` `y \\<sharp> Q` `y \\<sharp> \\<sigma>` show \"\\<Psi> \\<rhd> (\\<lparr>\\<nu>x\\<rparr>(P \\<parallel> Q))[<\\<sigma>>] \\<sim> (P \\<parallel> \\<lparr>\\<nu>x\\<rparr>Q)[<\\<sigma>>]\"\n    apply(subst alpha_res[of y], simp)\n    apply(subst alpha_res[of y Q], simp)\n    by(simp add: eqvts)\nqed  \n\nlemma bisim_subst_case_push_res:\n  fixes x  :: name\n  and   \\<Psi>  :: 'b\n  and   Cs :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n\n  assumes \"x \\<sharp> map fst Cs\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(Cases Cs) \\<sim>\\<^sub>s Cases map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs\"\nproof(rule close_substI)\n  fix \\<sigma>:: \"(name list \\<times> 'a list) list\"\n\n  obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<sigma>\" and \"y \\<sharp> Cs\"\n    by(generate_fresh \"name\") (auto simp add: fresh_prod)\n  \n  {\n    fix x    :: name\n    and Cs   :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n    and \\<sigma>    :: \"(name list \\<times> 'a list) list\"\n\n    assume \"x \\<sharp> \\<sigma>\"\n\n    hence \"(Cases map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)[<\\<sigma>>] = Cases map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) (case_list_seq_subst Cs \\<sigma>)\"\n      by(induct Cs) auto\n  }\n  note C1 = this\n\n  {\n    fix x    :: name\n    and y    :: name\n    and Cs   :: \"('c \\<times> ('a, 'b, 'c) psi) list\"\n\n    assume \"x \\<sharp> map fst Cs\"\n    and    \"y \\<sharp> map fst Cs\"\n    and    \"y \\<sharp> Cs\"\n\n    hence \"(Cases map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs) = Cases map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>y\\<rparr>P)) ([(x, y)] \\<bullet> Cs)\"\n      by(induct Cs) (auto simp add: fresh_list_cons alpha_res)\n  }\n  note C2 = this\n\n  from `y \\<sharp> Cs` have \"y \\<sharp> map fst Cs\" by(induct Cs) (auto simp add: fresh_list_cons fresh_list_nil)\n  from `y \\<sharp> Cs` `y \\<sharp> \\<sigma>` `x \\<sharp> map fst Cs`  have \"y \\<sharp> map fst (case_list_seq_subst ([(x, y)] \\<bullet> Cs) \\<sigma>)\"\n    by(induct Cs) (auto intro: subst_cond.seq_subst2 simp add: fresh_list_cons fresh_list_nil fresh_prod)\n  hence \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>(Cases(case_list_seq_subst ([(x, y)] \\<bullet> Cs) \\<sigma>)) \\<sim> Cases map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>y\\<rparr>P)) (case_list_seq_subst ([(x, y)] \\<bullet> Cs) \\<sigma>)\"\n    by(rule bisim_case_push_res)\n\n  with `y \\<sharp> Cs` `x \\<sharp> map fst Cs` `y \\<sharp> map fst Cs` `y \\<sharp> \\<sigma>`\n  show \"\\<Psi> \\<rhd> (\\<lparr>\\<nu>x\\<rparr>(Cases Cs))[<\\<sigma>>] \\<sim> (Cases map (\\<lambda>(\\<phi>, P). (\\<phi>, \\<lparr>\\<nu>x\\<rparr>P)) Cs)[<\\<sigma>>]\"\n    apply(subst C2[of x Cs y])\n    apply assumption+\n    apply(subst C1)\n    apply assumption+\n    apply(subst alpha_res[of y], simp)\n    by(simp add: eqvts)\nqed\n\nlemma bisim_subst_output_push_res:\n  fixes x :: name\n  and   \\<Psi> :: 'b\n  and   M :: 'a\n  and   N :: 'a\n  and   P :: \"('a, 'b, 'c) psi\"\n\n  assumes \"x \\<sharp> M\"\n  and     \"x \\<sharp> N\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P) \\<sim>\\<^sub>s M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P\"\nproof(rule close_substI)\n  fix \\<sigma>:: \"(name list \\<times> 'a list) list\"\n\n  obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<sigma>\" and \"y \\<sharp> P\" and \"y \\<sharp> M\" and \"y \\<sharp> N\"\n    by(generate_fresh \"name\") (auto simp add: fresh_prod)\n  from `y \\<sharp> M` `y \\<sharp> \\<sigma>` have \"y \\<sharp> M[<\\<sigma>>]\" by auto\n  moreover from `y \\<sharp> N` `y \\<sharp> \\<sigma>` have \"y \\<sharp> N[<\\<sigma>>]\" by auto\n  ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>((M[<\\<sigma>>])\\<langle>(N[<\\<sigma>>])\\<rangle>.(([(x, y)] \\<bullet> P)[<\\<sigma>>])) \\<sim> (M[<\\<sigma>>])\\<langle>(N[<\\<sigma>>])\\<rangle>.(\\<lparr>\\<nu>y\\<rparr>(([(x, y)] \\<bullet> P)[<\\<sigma>>]))\"\n    by(rule bisim_output_push_res)\n  with `y \\<sharp> M` `y \\<sharp> N` `y \\<sharp> P` `x \\<sharp> M` `x \\<sharp> N` `y \\<sharp> \\<sigma>`\n  show \"\\<Psi> \\<rhd> (\\<lparr>\\<nu>x\\<rparr>(M\\<langle>N\\<rangle>.P))[<\\<sigma>>] \\<sim> (M\\<langle>N\\<rangle>.\\<lparr>\\<nu>x\\<rparr>P)[<\\<sigma>>]\"\n    apply(subst alpha_res[of y], simp)\n    apply(subst alpha_res[of y P], simp)\n    by(simp add: eqvts)\nqed\n\nlemma bisim_subst_input_push_res:\n  fixes x    :: name\n  and   \\<Psi>    :: 'b\n  and   M    :: 'a\n  and   xvec :: \"name list\"\n  and   N    :: 'a\n\n  assumes \"x \\<sharp> M\"\n  and     \"x \\<sharp> xvec\"\n  and     \"x \\<sharp> N\"\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P) \\<sim>\\<^sub>s M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P\"\nproof(rule close_substI)\n  fix \\<sigma>:: \"(name list \\<times> 'a list) list\"\n\n  obtain y::name where \"y \\<sharp> \\<Psi>\" and \"y \\<sharp> \\<sigma>\" and \"y \\<sharp> P\" and \"y \\<sharp> M\" and \"y \\<sharp> xvec\" and \"y \\<sharp> N\"\n    by(generate_fresh \"name\") (auto simp add: fresh_prod)\n  obtain p::\"name prm\" where \"(p \\<bullet> xvec) \\<sharp>* N\" and  \"(p \\<bullet> xvec) \\<sharp>* P\" and \"x \\<sharp> (p \\<bullet> xvec)\" and \"y \\<sharp> (p \\<bullet> xvec)\" and \"(p \\<bullet> xvec) \\<sharp>* \\<sigma>\"\n                         and S: \"set p \\<subseteq> set xvec \\<times> set(p \\<bullet> xvec)\"\n   by(rule_tac c=\"(N, P, x, y, \\<sigma>)\" in name_list_avoiding) auto\n    \n  from `y \\<sharp> M` `y \\<sharp> \\<sigma> ` have \"y \\<sharp> M[<\\<sigma>>]\" by auto\n  moreover note `y \\<sharp> (p \\<bullet> xvec)`\n  moreover from `y \\<sharp> N` have \"(p \\<bullet> y) \\<sharp> (p \\<bullet> N)\" by(simp add: pt_fresh_bij[OF pt_name_inst, OF at_name_inst])\n  with `y \\<sharp> xvec` `y \\<sharp> (p \\<bullet> xvec)` S have \"y \\<sharp> p \\<bullet> N\" by simp\n  hence \"y \\<sharp> (p \\<bullet> N)[<\\<sigma>>]\" using `y \\<sharp> \\<sigma>`\n    by auto\n  ultimately have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>y\\<rparr>((M[<\\<sigma>>])\\<lparr>\\<lambda>*(p \\<bullet> xvec) ((p \\<bullet> N)[<\\<sigma>>])\\<rparr>.(([(x, y)] \\<bullet> (p \\<bullet> P))[<\\<sigma>>])) \\<sim> (M[<\\<sigma>>])\\<lparr>\\<lambda>*(p \\<bullet> xvec) ((p \\<bullet> N)[<\\<sigma>>])\\<rparr>.(\\<lparr>\\<nu>y\\<rparr>(([(x, y)] \\<bullet> p \\<bullet> P)[<\\<sigma>>]))\"\n    by(rule bisim_input_push_res)\n  with `y \\<sharp> M` `y \\<sharp> N` `y \\<sharp> P` `x \\<sharp> M` `x \\<sharp> N` `y \\<sharp> xvec` `x \\<sharp> xvec` `(p \\<bullet> xvec) \\<sharp>* N` `(p \\<bullet> xvec) \\<sharp>* P` \n       `x \\<sharp> (p \\<bullet> xvec)` `y \\<sharp> (p \\<bullet> xvec)` `y \\<sharp> \\<sigma>` `(p \\<bullet> xvec) \\<sharp>* \\<sigma>` S\n  show \"\\<Psi> \\<rhd> (\\<lparr>\\<nu>x\\<rparr>(M\\<lparr>\\<lambda>*xvec N\\<rparr>.P))[<\\<sigma>>] \\<sim> (M\\<lparr>\\<lambda>*xvec N\\<rparr>.\\<lparr>\\<nu>x\\<rparr>P)[<\\<sigma>>]\"\n    apply(subst input_chain_alpha')\n    apply assumption+\n    apply(subst input_chain_alpha'[of p xvec])\n    apply(simp add: abs_fresh_star)\n    apply assumption+\n    apply(simp add: eqvts)\n    apply(subst alpha_res[of y], simp)\n    apply(simp add: input_chain_fresh)\n    apply(simp add: fresh_chain_simps)\n    apply(subst alpha_res[of y \"(p \\<bullet> P)\"])\n    apply(simp add: fresh_chain_simps)\n    by(simp add: fresh_chain_simps eqvts)\nqed\n\nlemma bisim_subst_res_comm:\n  fixes x :: name\n  and   y :: name\n\n  shows \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P) \\<sim>\\<^sub>s \\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P)\"\nproof(case_tac \"x = y\")\n  assume \"x = y\"\n  thus ?thesis by(force intro: bisim_subst_reflexive)\nnext\n  assume \"x \\<noteq> y\"\n  show ?thesis\n  proof(rule close_substI)\n  fix \\<sigma>:: \"(name list \\<times> 'a list) list\"\n\n\n    obtain x'::name where \"x' \\<sharp>  \\<Psi>\" and \"x' \\<sharp> \\<sigma>\" and \"x' \\<sharp> P\" and \"x \\<noteq> x'\" and \"y \\<noteq> x'\"\n      by(generate_fresh \"name\") (auto simp add: fresh_prod)\n    obtain y'::name where \"y' \\<sharp>  \\<Psi>\" and \"y' \\<sharp> \\<sigma>\" and \"y' \\<sharp> P\" and \"x \\<noteq> y'\" and \"y \\<noteq> y'\" and \"x' \\<noteq> y'\"\n      by(generate_fresh \"name\") (auto simp add: fresh_prod)\n\n    have \"\\<Psi> \\<rhd> \\<lparr>\\<nu>x'\\<rparr>(\\<lparr>\\<nu>y'\\<rparr>(([(x, x')] \\<bullet> [(y, y')] \\<bullet> P)[<\\<sigma>>])) \\<sim> \\<lparr>\\<nu>y'\\<rparr>(\\<lparr>\\<nu>x'\\<rparr>(([(x, x')] \\<bullet> [(y, y')] \\<bullet> P)[<\\<sigma>>]))\"\n      by(rule bisim_res_comm)\n    moreover from `x' \\<sharp> P` `y' \\<sharp> P` `x \\<noteq> y'` `x' \\<noteq> y'` have \"\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P) = \\<lparr>\\<nu>x'\\<rparr>(\\<lparr>\\<nu>y'\\<rparr>(([(x, x')] \\<bullet> [(y, y')] \\<bullet> P)))\"\n      apply(subst alpha_res[of y' P], simp)\n      by(subst alpha_res[of x']) (auto simp add: abs_fresh fresh_left calc_atm eqvts)\n    moreover from `x' \\<sharp> P` `y' \\<sharp> P` `y \\<noteq> x'` `x \\<noteq> y'` `x' \\<noteq> y'` `x \\<noteq> x'` `x \\<noteq> y` have \"\\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P) = \\<lparr>\\<nu>y'\\<rparr>(\\<lparr>\\<nu>x'\\<rparr>(([(x, x')] \\<bullet> [(y, y')] \\<bullet> P)))\"\n      apply(subst alpha_res[of x' P], simp)\n      apply(subst alpha_res[of y'], simp add: abs_fresh fresh_left calc_atm) \n      apply(simp add: eqvts calc_atm)\n      by(subst perm_compose) (simp add: calc_atm)\n\n    ultimately show \"\\<Psi> \\<rhd> (\\<lparr>\\<nu>x\\<rparr>(\\<lparr>\\<nu>y\\<rparr>P))[<\\<sigma>>] \\<sim> (\\<lparr>\\<nu>y\\<rparr>(\\<lparr>\\<nu>x\\<rparr>P))[<\\<sigma>>]\" \n      using  `x' \\<sharp> \\<sigma>` `y' \\<sharp> \\<sigma>`\n      by simp\n  qed\nqed\n\nlemma bisim_subst_ext_bang:\n  fixes \\<Psi> :: 'b\n  and   P :: \"('a, 'b, 'c) psi\"\n  \n  assumes \"guarded P\"\n\n  shows \"\\<Psi> \\<rhd> !P \\<sim>\\<^sub>s P \\<parallel> !P\"\nusing assms\nby(force intro: close_substI bang_ext guarded_seq_subst)\n\nlemma struct_cong_bisim_subst:\n  fixes P :: \"('a, 'b, 'c) psi\"  \n  and   Q :: \"('a, 'b, 'c) psi\"\n\n  assumes \"P \\<equiv>\\<^sub>s Q\"\n\n  shows \"P \\<sim>\\<^sub>s Q\"\nusing assms\nby(induct rule: struct_cong.induct)\n  (auto intro: bisim_subst_reflexive bisim_subst_symmetric bisim_subst_transitive bisim_subst_par_comm bisim_subst_par_assoc bisim_subst_par_nil bisim_subst_res_nil bisim_subst_res_comm bisim_subst_scope_ext bisim_subst_case_push_res bisim_subst_input_push_res bisim_subst_output_push_res bisim_subst_ext_bang)\n\nend\n\nend", "meta": {"author": "IlmariReissumies", "repo": "newpsi", "sha": "201517d55b6ed1632a5bff2a585367278b5bc67b", "save_path": "github-repos/isabelle/IlmariReissumies-newpsi", "path": "github-repos/isabelle/IlmariReissumies-newpsi/newpsi-201517d55b6ed1632a5bff2a585367278b5bc67b/Bisim_Subst.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5660185351961016, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.30067435139945253}}
{"text": "(*\n * Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)\n *\n * SPDX-License-Identifier: BSD-2-Clause\n *)\n\n(*\n * Tactic for solving monadic equalities, such as:\n *\n * (liftE (return 3) = returnOk 3\n *\n * Theorems of the form:\n *\n *   ((a, s') \\<in> fst (A s)) = P a s s'\n *\n * and\n *\n *   snd (A s) = P s\n *\n * are added to the \"monad_eq\" set.\n *)\ntheory MonadEq\n  imports\n    In_Monad\n    NonDetMonadVCG\nbegin\n\n(* Setup \"monad_eq\" attributes. *)\nML \\<open>\nstructure MonadEqThms = Named_Thms (\n    val name = Binding.name \"monad_eq\"\n    val description = \"monad equality-prover theorems\"\n    )\n\\<close>\nattribute_setup monad_eq = \\<open>\n  Attrib.add_del\n    (Thm.declaration_attribute MonadEqThms.add_thm)\n    (Thm.declaration_attribute MonadEqThms.del_thm)\\<close>\n  \"Monad equality-prover theorems\"\n\n(* Setup tactic. *)\n\nML \\<open>\nfun monad_eq_tac ctxt =\nlet\n  (* Set a simpset as being hidden, so warnings are not printed from it. *)\n  val ctxt' = Context_Position.set_visible false ctxt\nin\n  CHANGED (clarsimp_tac (ctxt' addsimps (MonadEqThms.get ctxt')) 1)\nend\n\\<close>\n\nmethod_setup monad_eq = \\<open>\n    Method.sections Clasimp.clasimp_modifiers >> (K (SIMPLE_METHOD o monad_eq_tac))\\<close>\n  \"prove equality on monads\"\n\nlemma monad_eq_simp_state[monad_eq]:\n  \"((A :: ('s, 'a) nondet_monad) s = B s') =\n      ((\\<forall>r t. (r, t) \\<in> fst (A s) \\<longrightarrow> (r, t) \\<in> fst (B s'))\n         \\<and> (\\<forall>r t. (r, t) \\<in> fst (B s') \\<longrightarrow> (r, t) \\<in> fst (A s))\n         \\<and> (snd (A s) = snd (B s')))\"\n  by (auto intro!: set_eqI prod_eqI)\n\nlemma monad_eq_simp[monad_eq]:\n  \"((A :: ('s, 'a) nondet_monad) = B) =\n      ((\\<forall>r t s. (r, t) \\<in> fst (A s) \\<longrightarrow> (r, t) \\<in> fst (B s))\n         \\<and> (\\<forall>r t s. (r, t) \\<in> fst (B s) \\<longrightarrow> (r, t) \\<in> fst (A s))\n         \\<and> (\\<forall>x. snd (A x) = snd (B x)))\"\n  by (auto intro!: set_eqI prod_eqI)\n\ndeclare in_monad[monad_eq]\ndeclare in_bindE[monad_eq]\n\n(* Test *)\nlemma \"returnOk 3 = liftE (return 3)\"\n  apply monad_eq\n  oops\n\nend\n", "meta": {"author": "seL4", "repo": "l4v", "sha": "9ba34e269008732d4f89fb7a7e32337ffdd09ff9", "save_path": "github-repos/isabelle/seL4-l4v", "path": "github-repos/isabelle/seL4-l4v/l4v-9ba34e269008732d4f89fb7a7e32337ffdd09ff9/lib/Monads/MonadEq.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5660185205547239, "lm_q2_score": 0.5312093733737563, "lm_q1q2_score": 0.3006743436218155}}
{"text": "(*  Title:      HOL/Auth/n_moesi_lemma_inv__3_on_rules.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_moesi Protocol Case Study*} \n\ntheory n_moesi_lemma_inv__3_on_rules imports n_moesi_lemma_on_inv__3\nbegin\nsection{*All lemmas on causal relation between inv__3*}\nlemma lemma_inv__3_on_rules:\n  assumes b1: \"r \\<in> rules N\" and b2: \"(\\<exists> p__Inv0 p__Inv2. p__Inv0\\<le>N\\<and>p__Inv2\\<le>N\\<and>p__Inv0~=p__Inv2\\<and>f=inv__3  p__Inv0 p__Inv2)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  proof -\n  have c1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rule_t1  i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rule_t2 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rul_t3 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rul_t4 N i)\\<or>\n    (\\<exists> i. i\\<le>N\\<and>r=n_rul_t5 N i)\"\n  apply (cut_tac b1, auto) done\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rule_t1  i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rule_t1Vsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rule_t2 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rule_t2Vsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rul_t3 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rul_t3Vsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rul_t4 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rul_t4Vsinv__3) done\n    }\n\n    moreover {\n      assume d1: \"(\\<exists> i. i\\<le>N\\<and>r=n_rul_t5 N i)\"\n      have \"invHoldForRule s f r (invariants N)\"\n      apply (cut_tac b2 d1, metis n_rul_t5Vsinv__3) done\n    }\n\n  ultimately show \"invHoldForRule s f r (invariants N)\"\n  by satx\nqed\n\nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/moesi/n_moesi_lemma_inv__3_on_rules.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6926419831347362, "lm_q2_score": 0.4339814648038985, "lm_q1q2_score": 0.30059378242549}}
{"text": "           (*-------------------------------------------*\n            |        CSP-Prover on Isabelle2004         |\n            |               December 2004               |\n            |                   July 2005 (modified)    |\n            |              September 2005 (modified)    |\n            |                                           |\n            |        CSP-Prover on Isabelle2005         |\n            |                October 2005  (modified)   |\n            |               November 2005  (modified)   |\n            |                  April 2006  (modified)   |\n            |                  March 2007  (modified)   |\n            |                 August 2007  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2008         |\n            |                   June 2008  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2009-2       |\n            |                October 2010  (modified)   |\n            |                                           |\n            |        CSP-Prover on Isabelle2016         |\n            |                    May 2016  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory CSP_F_contraction\nimports CSP_F_domain CSP_T.CSP_T_contraction\nbegin\n\n(*****************************************************************\n\n         1. contraction failuresfun\n         2. contraction failuresFun\n         3. contraction [[ ]]Ffun\n         4. contraction [[ ]]FFun\n\n *****************************************************************)\n\n(*=============================================================*\n |                      traces fstF                            |\n *=============================================================*)\n\nlemma non_expanding_traces_fstF:\n   \"noHide P ==> non_expanding (%M. traces P (fstF o M))\"\n(* apply (subgoal_tac \"(%M. traces P (fstF o M)) = (traces P) o (op o fstF)\") *)\napply (subgoal_tac \"(%M. traces P (fstF o M)) = (traces P) o ((o) fstF)\")\napply (simp)\napply (rule compo_non_expand)\napply (simp add: non_expanding_traces)\napply (simp add: non_expanding_op_fstF)\napply (simp add: fun_eq_iff)\ndone\n\nlemma contraction_alpha_traces_fstF:\n   \"guarded P ==> contraction_alpha (%M. traces P (fstF o M)) (1/2)\"\n(* apply (subgoal_tac \"(%M. traces P (fstF o M)) = (traces P) o (op o fstF)\") *)\napply (subgoal_tac \"(%M. traces P (fstF o M)) = (traces P) o ((o) fstF)\")\napply (simp)\napply (rule compo_contra_alpha_non_expand)\napply (simp add: contraction_alpha_traces)\napply (simp add: non_expanding_op_fstF)\napply (simp add: fun_eq_iff)\ndone\n\n(*--------------------------------*\n |        STOP,SKIP,DIV           |\n *--------------------------------*)\n\n(*** STOP ***)\n\nlemma map_alpha_failures_STOP: \n  \"0 <= alpha ==> map_alpha (failures (STOP)) alpha\"\nby (simp add: failures_iff map_alpha_Constant)\n\nlemma non_expanding_failures_STOP: \n  \"non_expanding (failures (STOP))\"\nby (simp add: non_expanding_def map_alpha_failures_STOP)\n\nlemma contraction_alpha_failures_STOP: \n  \"[| 0 <= alpha ; 1 > alpha |] ==> contraction_alpha (failures (STOP)) alpha\"\nby (simp add: failures_iff contraction_alpha_Constant)\n\n(*** SKIP ***)\n\nlemma map_alpha_failures_SKIP: \n  \"0 <= alpha ==> map_alpha (failures (SKIP)) alpha\"\nby (simp add: failures_iff map_alpha_Constant)\n\nlemma non_expanding_failures_SKIP: \n  \"non_expanding (failures (SKIP))\"\nby (simp add: non_expanding_def map_alpha_failures_SKIP)\n\nlemma contraction_alpha_failures_SKIP: \n  \"[| 0 <= alpha ; 1 > alpha |] ==> contraction_alpha (failures (SKIP)) alpha\"\nby (simp add: failures_iff contraction_alpha_Constant)\n\n(*** DIV ***)\n\nlemma map_alpha_failures_DIV: \n  \"0 <= alpha ==> map_alpha (failures (DIV)) alpha\"\nby (simp add: failures_iff map_alpha_Constant)\n\nlemma non_expanding_failures_DIV: \n  \"non_expanding (failures (DIV))\"\nby (simp add: non_expanding_def map_alpha_failures_DIV)\n\nlemma contraction_alpha_failures_DIV: \n  \"[| 0 <= alpha ; 1 > alpha |] ==> contraction_alpha (failures (DIV)) alpha\"\nby (simp add: failures_iff contraction_alpha_Constant)\n\n(*--------------------------------*\n |          Act_prefix            |\n *--------------------------------*)\n\nlemma contraction_half_failures_Act_prefix_lm: \n   \"distance (failures (a -> P) M1, failures (a -> Q) M2) * 2\n    = distance (failures P M1, failures Q M2)\"\napply (rule sym)\napply (simp add: to_distance_rs)\napply (rule rest_Suc_dist_half[simplified])\napply (rule allI)\napply (simp add: rest_setF_eq_iff)\napply (rule iffI)\n\n (* => *)\n apply (intro allI)\n apply (simp add: in_failures)\n apply (rule iffI)\n\n  (* => *)\n  apply (elim conjE exE disjE)\n   apply (simp_all)\n   apply (drule_tac x=\"sa\" in spec)\n   apply (drule_tac x=\"X\" in spec)\n   apply (simp)\n\n   apply (drule_tac x=\"sa\" in spec)\n   apply (drule_tac x=\"X\" in spec)\n   apply (simp)\n   apply (erule iffE, simp)\n   apply (insert trace_last_nil_or_unnil)\n   apply (drule_tac x=\"sa\" in spec)\n   apply (erule disjE, simp)\n   apply (elim conjE exE)\n   apply (simp add: appt_assoc_sym)\n   apply (drule mp, fast)\n   apply (simp)\n   apply (rule_tac x=\"<Ev a> ^^^ sb\" in exI)\n   apply (simp)\n\n  (* <= *)\n  apply (elim conjE exE disjE)\n   apply (simp_all)\n   apply (drule_tac x=\"sa\" in spec)\n   apply (drule_tac x=\"X\" in spec)\n   apply (simp)\n\n   apply (drule_tac x=\"sa\" in spec)\n   apply (drule_tac x=\"X\" in spec)\n   apply (simp)\n   apply (erule iffE, simp)\n   apply (drule_tac x=\"sa\" in spec)\n   apply (erule disjE, simp)\n   apply (elim conjE exE)\n   apply (simp add: appt_assoc_sym)\n   apply (drule mp, fast)\n   apply (simp)\n\n (* <= *)\n apply (intro allI)\n apply (drule_tac x=\"<Ev a> ^^^ s\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (simp add: in_failures)\n apply (rule iffI)\n\n  (* => *)\n  apply (elim conjE exE disjE)\n   apply (simp)\n   apply (erule iffE, simp)\n   apply (simp add: appt_assoc_sym)\n   apply (drule mp, force)\n   apply (force)\n\n  (* <= *)\n  apply (elim conjE exE disjE)\n   apply (simp)\n   apply (erule iffE, simp)\n   apply (simp add: appt_assoc_sym)\n   apply (drule mp, force)\n   apply (force)\ndone\n\n(***  contraction_half ***)\n\nlemma contraction_half_failures_Act_prefix: \n \"non_expanding (failures P)\n  ==> contraction_alpha (failures (a -> P)) (1 / 2)\"\napply (simp add: contraction_alpha_def non_expanding_def map_alpha_def)\napply (intro allI)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (simp add: contraction_half_failures_Act_prefix_lm)\ndone\n\n(***  contraction ***)\n\nlemma contraction_failures_Act_prefix: \n \"non_expanding (failures P)\n  ==> contraction (failures (a -> P))\"\napply (simp add: contraction_def)\napply (rule_tac x=\"1/2\" in exI)\nby (simp add: contraction_half_failures_Act_prefix)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Act_prefix: \n \"non_expanding (failures P)\n  ==> non_expanding (failures (a -> P))\"\napply (rule contraction_non_expanding)\nby (simp add: contraction_failures_Act_prefix)\n\n(*--------------------------------*\n |        Ext_pre_choice          |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma Ext_pre_choice_Act_prefix_rest_setF_sub:\n   \"[| ALL a : X.\n         failures (a -> Pf a) M1 .|. n <= failures (a -> Qf a) M2 .|. n |]\n    ==> failures (? a:X -> Pf a) M1 .|. n <=\n        failures (? a:X -> Qf a) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim conjE exE disjE, simp_all)\n\n apply (drule_tac x=\"a\" in bspec, simp)\n apply (drule_tac x=\"<Ev a> ^^^ sa\" in spec)\n apply (drule_tac x=\"Xa\" in spec)\n apply (simp)\n\n apply (drule_tac x=\"a\" in bspec, simp)\n apply (drule_tac x=\"s' ^^^ <Tick>\" in spec)\n apply (drule_tac x=\"Xa\" in spec)\n apply (auto)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma Ext_pre_choice_Act_prefix_rest_setF:\n   \"[| ALL a : X.\n         failures (a -> Pf a) M1 .|. n = failures (a -> Qf a) M2 .|. n |]\n    ==> failures (? a:X -> Pf a) M1 .|. n =\n        failures (? a:X -> Qf a) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Ext_pre_choice_Act_prefix_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Ext_pre_choice_Act_prefix_distF_nonempty:\n\"[| X ~= {} ; PQs = {(failures (a -> Pf a) M1, failures (a -> Qf a) M2)|a. a : X} |]\n ==> (EX PQ. PQ:PQs & \n             distance(failures (? a:X -> Pf a) M1, failures (? a:X -> Qf a) M2)\n          <= distance(fst PQ, snd PQ))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair)\napply (force)\n\napply (intro allI impI)\napply (rule Ext_pre_choice_Act_prefix_rest_setF)\napply (rule ballI)\napply (simp)\napply (drule_tac x=\"failures (a -> Pf a) M1\" in spec)\napply (drule_tac x=\"failures (a -> Qf a) M2\" in spec)\nby (auto)\n\n(*** contraction lemma ***)\n\nlemma contraction_half_failures_Ext_pre_choice_lm:\n  \"[| X ~= {} ; ALL a. distance (failures (Pf a) M1, failures (Qf a) M2)\n                    <= distance (x1, x2) |]\n    ==> distance (failures (? a:X -> Pf a) M1, failures (? a:X -> Qf a) M2) * 2 \n     <= distance (x1, x2)\"\napply (insert Ext_pre_choice_Act_prefix_distF_nonempty\n       [of X \"{(failures (a -> Pf a) M1, failures (a -> Qf a) M2) |a. a : X}\" \n           Pf M1 Qf M2])\napply (simp)\napply (elim conjE exE)\napply (simp)\napply (subgoal_tac \n    \"distance (failures (aa -> Pf aa) M1, failures (aa -> Qf aa) M2) * 2\n   = distance (failures (Pf aa) M1, failures (Qf aa) M2)\")\napply (drule_tac x=\"aa\" in spec)\napply (force)\nby (simp add: contraction_half_failures_Act_prefix_lm)\n\n(*** contraction_half ***)\n\nlemma contraction_half_failures_Ext_pre_choice:\n \"ALL a. non_expanding (failures (Pf a))\n  ==> contraction_alpha (failures (? a:X -> (Pf a))) (1 / 2)\"\napply (simp add: contraction_alpha_def non_expanding_def map_alpha_def)\napply (case_tac \"X = {}\")\napply (simp add: failures_iff)\nby (simp add: contraction_half_failures_Ext_pre_choice_lm)\n\n(*** Ext_pre_choice_evalT_contraction ***)\n\nlemma contraction_failures_Ext_pre_choice:\n \"ALL a. non_expanding (failures (Pf a))\n  ==> contraction (failures (? a:X -> (Pf a)))\"\napply (simp add: contraction_def)\napply (rule_tac x=\"1/2\" in exI)\nby (simp add: contraction_half_failures_Ext_pre_choice)\n\n(*** Ext_pre_choice_evalT_non_expanding ***)\n\nlemma non_expanding_failures_Ext_pre_choice:\n \"ALL a. non_expanding (failures (Pf a))\n  ==> non_expanding (failures (? a:X -> (Pf a)))\"\napply (rule contraction_non_expanding)\nby (simp add: contraction_failures_Ext_pre_choice)\n\n(*--------------------------------*\n |          Ext_choice            |\n *--------------------------------*)\n\n(*** rest_domT (subset) ***)\n\nlemma Ext_choice_rest_setF_sub:\n   \"[| traces P1 (fstF o M1) .|. n <= traces P2 (fstF o M2) .|. n ;\n       traces Q1 (fstF o M1) .|. n <= traces Q2 (fstF o M2) .|. n ;\n       failures P1 M1 .|. n <= failures P2 M2 .|. n ;\n       failures Q1 M1 .|. n <= failures Q2 M2 .|. n  |]\n    ==> failures (P1 [+] Q1) M1 .|. n <= failures (P2 [+] Q2) M2 .|. n\"\napply (simp add: subdomT_iff subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_domT)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim conjE exE disjE, simp_all)\n\n apply (rotate_tac 2)\n apply (drule_tac x=\"s' ^^^ <Tick>\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (drule mp, simp, fast)\n apply (simp)\n\n apply (rotate_tac 3)\n apply (drule_tac x=\"s' ^^^ <Tick>\" in spec)\n apply (drule_tac x=\"X\" in spec)\n apply (drule mp, simp, fast)\n apply (simp)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma Ext_choice_rest_setF:\n   \"[| traces P1 (fstF o M1) .|. n = traces P2 (fstF o M2) .|. n ;\n       traces Q1 (fstF o M1) .|. n = traces Q2 (fstF o M2) .|. n ;\n       failures P1 M1 .|. n = failures P2 M2 .|. n ;\n       failures Q1 M1 .|. n = failures Q2 M2 .|. n  |]\n    ==> failures (P1 [+] Q1) M1 .|. n = failures (P2 [+] Q2) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Ext_choice_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Ext_choice_distF:\n\"[| PQTs = {(traces P1 (fstF o M1), traces P2 (fstF o M2)), \n            (traces Q1 (fstF o M1), traces Q2 (fstF o M2))} ;\n    PQFs = {(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)} |]\n ==> (EX PQ. PQ:PQTs & \n             distance(failures (P1 [+] Q1) M1, failures (P2 [+] Q2) M2)\n          <= distance((fst PQ), (snd PQ))) |\n     (EX PQ. PQ:PQFs & \n             distance(failures (P1 [+] Q1) M1, failures (P2 [+] Q2) M2)\n          <= distance((fst PQ), (snd PQ)))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair_two)\napply (simp_all)\nby (auto intro: Ext_choice_rest_setF)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_Ext_choice_lm:\n  \"[| distance (traces P1 (fstF o M1), traces P2 (fstF o M2))\n       <= alpha * distance (x1, x2) ;\n      distance (traces Q1 (fstF o M1), traces Q2 (fstF o M2))\n       <= alpha * distance (x1, x2) ;\n      distance (failures P1 M1, failures P2 M2) <= alpha * distance (x1, x2) ;\n      distance (failures Q1 M1, failures Q2 M2) <= alpha * distance (x1, x2) |]\n    ==> distance (failures (P1 [+] Q1) M1, failures (P2 [+] Q2) M2)\n     <= alpha * distance (x1, x2)\"\napply (insert Ext_choice_distF\n       [of \"{(traces P1 (fstF o M1), traces P2 (fstF o M2)), \n             (traces Q1 (fstF o M1), traces Q2 (fstF o M2))}\"\n             P1 M1 P2 M2 Q1 Q2\n           \"{(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)}\"])\nby (auto)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Ext_choice:\n \"[| map_alpha (%M. traces P (fstF o M)) alpha ; \n     map_alpha (%M. traces Q (fstF o M)) alpha ;\n     map_alpha (failures P) alpha ;\n     map_alpha (failures Q) alpha |]\n  ==> map_alpha (failures (P [+] Q)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Ext_choice_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Ext_choice:\n \"[| non_expanding (%M. traces P (fstF o M)) ;\n     non_expanding (%M. traces Q (fstF o M)) ;\n     non_expanding (failures P) ; non_expanding (failures Q) |]\n  ==> non_expanding (failures (P [+] Q))\"\nby (simp add: non_expanding_def map_alpha_failures_Ext_choice)\n\n(*** contraction ***)\n\nlemma contraction_alpha_failures_Ext_choice:\n \"[| contraction_alpha (%M. traces P (fstF o M)) alpha ;\n     contraction_alpha (%M. traces Q (fstF o M)) alpha ;\n     contraction_alpha (failures P) alpha ; \n     contraction_alpha (failures Q) alpha|]\n  ==> contraction_alpha (failures (P [+] Q)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Ext_choice)\n\n(*--------------------------------*\n |          Int_choice            |\n *--------------------------------*)\n\n(*** rest_domT (subset) ***)\n\nlemma Int_choice_rest_setF_sub:\n   \"[| failures P1 M1 .|. n <= failures P2 M2 .|. n ;\n       failures Q1 M1 .|. n <= failures Q2 M2 .|. n  |]\n    ==> failures (P1 |~| Q1) M1 .|. n <= failures (P2 |~| Q2) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim disjE conjE exE)\nby (force)+\n\n(*** rest_setF (equal) ***)\n\nlemma Int_choice_rest_setF:\n   \"[| failures P1 M1 .|. n = failures P2 M2 .|. n ;\n       failures Q1 M1 .|. n = failures Q2 M2 .|. n  |]\n    ==> failures (P1 |~| Q1) M1 .|. n = failures (P2 |~| Q2) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Int_choice_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Int_choice_distF:\n\"PQs = {(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)}\n ==> (EX PQ. PQ:PQs & \n             distance(failures (P1 |~| Q1) M1, failures (P2 |~| Q2) M2)\n          <= distance((fst PQ), (snd PQ)))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair)\nby (auto intro: Int_choice_rest_setF)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_Int_choice_lm:\n  \"[| distance (failures P1 M1, failures P2 M2) <= alpha * distance (x1, x2) ;\n      distance (failures Q1 M1, failures Q2 M2) <= alpha * distance (x1, x2) |]\n    ==> distance (failures (P1 |~| Q1) M1, failures (P2 |~| Q2) M2)\n     <= alpha * distance (x1, x2)\"\napply (insert Int_choice_distF\n       [of \"{(failures P1 M1, failures P2 M2), \n             (failures Q1 M1, failures Q2 M2)}\" P1 M1 P2 M2 Q1 Q2])\nby (auto)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Int_choice:\n \"[| map_alpha (failures P) alpha ; map_alpha (failures Q) alpha |]\n  ==> map_alpha (failures (P |~| Q)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Int_choice_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Int_choice:\n \"[| non_expanding (failures P) ; non_expanding (failures Q) |]\n  ==> non_expanding (failures (P |~| Q))\"\nby (simp add: non_expanding_def map_alpha_failures_Int_choice)\n\n(*** contraction ***)\n\nlemma contraction_alpha_failures_Int_choice:\n \"[| contraction_alpha (failures P) alpha ; \n     contraction_alpha (failures Q) alpha|]\n  ==> contraction_alpha (failures (P |~| Q)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Int_choice)\n\n(*--------------------------------*\n |        Rep_int_choice          |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma Rep_int_choice_rest_setF_sub:\n   \"[| ALL c : sumset C.\n         failures (Pf c) M1 .|. n <= failures (Qf c) M2 .|. n |]\n    ==> failures (!! :C .. Pf) M1 .|. n <=\n        failures (!! :C .. Qf) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim conjE bexE)\napply (rule_tac x=\"c\" in bexI)\nby (auto)\n\n(*** rest_setF (equal) ***)\n\nlemma Rep_int_choice_rest_setF:\n   \"[| ALL c : sumset C.\n         failures (Pf c) M1 .|. n = failures (Qf c) M2 .|. n |]\n    ==> failures (!! :C .. Pf) M1 .|. n =\n        failures (!! :C .. Qf) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Rep_int_choice_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Rep_int_choice_distF_nonempty:\n\"[| sumset C ~= {} ; \n    PQs = {(failures (Pf c) M1, failures (Qf c) M2)|c. c : sumset C} |]\n ==> (EX PQ. PQ:PQs & \n             distance(failures (!! :C .. Pf) M1, failures (!! :C .. Qf) M2)\n          <= distance(fst PQ, snd PQ))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair)\napply (fast)\n\napply (intro allI impI)\napply (rule Rep_int_choice_rest_setF)\nby (auto)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_Rep_int_choice_lm:\n\"[| sumset C ~= {} ; \n    ALL c. distance (failures (Pf c) M1, failures (Qf c) M2) \n                  <= alpha * distance (x1, x2) |]\n ==> distance(failures (!! :C .. Pf) M1, failures (!! :C .. Qf) M2)\n  <= alpha * distance(x1, x2)\"\napply (insert Rep_int_choice_distF_nonempty)\napply (insert Rep_int_choice_distF_nonempty\n       [of C \"{(failures (Pf c) M1, failures (Qf c) M2)|c. c : sumset C}\"\n           Pf M1 Qf M2])\napply (simp)\napply (elim conjE exE, simp)\napply (drule_tac x=\"c\" in spec)\nby (force)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Rep_int_choice:\n \"ALL c. map_alpha (failures (Pf c)) alpha\n  ==> map_alpha (failures (!! :C .. Pf)) alpha\"\napply (simp add: map_alpha_def)\napply (case_tac \"sumset C = {}\")\n apply (simp add: failures_iff)\n(* apply (simp add: real_mult_order_eq) *)\napply (simp add: map_alpha_failures_Rep_int_choice_lm)\ndone\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Rep_int_choice:\n \"ALL c. non_expanding (failures (Pf c))\n  ==> non_expanding (failures (!! :C .. Pf))\"\nby (simp add: non_expanding_def map_alpha_failures_Rep_int_choice)\n\n(*** Rep_int_choice_evalT_contraction_alpha ***)\n\nlemma contraction_alpha_failures_Rep_int_choice:\n \"ALL c. contraction_alpha (failures (Pf c)) alpha \n     ==> contraction_alpha  (failures (!! :C .. Pf)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Rep_int_choice)\n\n(*--------------------------------*\n |              IF                |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma IF_rest_setF_sub:\n   \"[| failures P1 M1 .|. n <= failures P2 M2 .|. n ;\n       failures Q1 M1 .|. n <= failures Q2 M2 .|. n  |]\n    ==> failures (IF b THEN P1 ELSE Q1) M1 .|. n <= \n        failures (IF b THEN P2 ELSE Q2) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma IF_rest_setF:\n   \"[| failures P1 M1 .|. n = failures P2 M2 .|. n ;\n       failures Q1 M1 .|. n = failures Q2 M2 .|. n  |]\n    ==> failures (IF b THEN P1 ELSE Q1) M1 .|. n = \n        failures (IF b THEN P2 ELSE Q2) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: IF_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma IF_distF:\n   \"PQs = {(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)}\n    ==> (EX PQ. PQ:PQs & \n             distance(failures (IF b THEN P1 ELSE Q1) M1,\n                      failures (IF b THEN P2 ELSE Q2) M2)\n          <= distance((fst PQ), (snd PQ)))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair)\nby (auto intro: IF_rest_setF)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_IF_lm:\n  \"[| distance (failures P1 M1, failures P2 M2) <= alpha * distance (x1, x2) ;\n      distance (failures Q1 M1, failures Q2 M2) <= alpha * distance (x1, x2) |]\n    ==> distance(failures (IF b THEN P1 ELSE Q1) M1,\n                 failures (IF b THEN P2 ELSE Q2) M2)\n     <= alpha * distance (x1, x2)\"\napply (insert IF_distF\n       [of \"{(failures P1 M1, failures P2 M2), \n             (failures Q1 M1, failures Q2 M2)}\"P1 M1 P2 M2 Q1 Q2 b])\nby (auto)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_IF:\n \"[| map_alpha (failures P) alpha ; map_alpha (failures Q) alpha |]\n  ==> map_alpha (failures (IF b THEN P ELSE Q)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_IF_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_IF:\n \"[| non_expanding (failures P) ; non_expanding (failures Q) |]\n  ==> non_expanding (failures (IF b THEN P ELSE Q))\"\nby (simp add: non_expanding_def map_alpha_failures_IF)\n\n(*** contraction_alpha ***)\n\nlemma contraction_alpha_failures_IF:\n \"[| contraction_alpha (failures P) alpha ; contraction_alpha (failures Q) alpha|]\n  ==> contraction_alpha (failures (IF b THEN P ELSE Q)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_IF)\n\n(*--------------------------------*\n |           Parallel             |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma Parallel_rest_setF_sub:\n   \"[| failures P1 M1 .|. n <= failures P2 M2 .|. n ;\n       failures Q1 M1 .|. n <= failures Q2 M2 .|. n  |]\n    ==> failures (P1 |[X]| Q1) M1 .|. n <= failures (P2 |[X]| Q2) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim conjE exE)\n\napply (rule_tac x=\"Y\" in exI)\napply (rule_tac x=\"Z\" in exI)\napply (simp)\napply (rule_tac x=\"sa\" in exI)\napply (rule_tac x=\"t\" in exI)\napply (simp)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"t\" in spec)\napply (drule_tac x=\"Y\" in spec)\napply (drule_tac x=\"Z\" in spec)\n\napply (erule disjE, simp)    (* lengtht s < n *)\napply (erule par_tr_lengthtE)\napply (simp)\n\napply (elim conjE exE, simp) (* lengtht s = n *)\napply (simp add: par_tr_last)\napply (elim conjE exE, simp)\napply (erule par_tr_lengthtE)\napply (case_tac \"Suc (lengtht s'a) < n\", simp)\n apply (case_tac \"Suc (lengtht t') < n\", simp)\n apply (case_tac \"Suc (lengtht t') = n\", simp)\n apply (drule mp, force)\n apply (simp)\n apply (force)  (* contradict *)\n\n apply (case_tac \"Suc (lengtht t') < n\", simp)\n apply (drule mp)\n  apply (rule_tac x=\"s'a\" in exI, simp)\n apply (simp)\n\n apply (case_tac \"Suc (lengtht t') = n\", simp)\n apply (drule mp)\n  apply (rule_tac x=\"s'a\" in exI, simp)\n apply (drule mp)\n  apply (rule_tac x=\"t'\" in exI, simp)\n apply (simp)\n apply (force)  (* contradict *)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma Parallel_rest_setF:\n   \"[| failures P1 M1 .|. n = failures P2 M2 .|. n ;\n       failures Q1 M1 .|. n = failures Q2 M2 .|. n  |]\n    ==> failures (P1 |[X]| Q1) M1 .|. n = failures (P2 |[X]| Q2) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Parallel_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Parallel_distF:\n\"PQs = {(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)}\n ==> (EX PQ. PQ:PQs & \n             distance(failures (P1 |[X]| Q1) M1, failures (P2 |[X]| Q2) M2)\n          <= distance((fst PQ), (snd PQ)))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair)\nby (auto intro: Parallel_rest_setF)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_Parallel_lm:\n  \"[| distance (failures P1 M1, failures P2 M2) <= alpha * distance (x1, x2) ;\n      distance (failures Q1 M1, failures Q2 M2) <= alpha * distance (x1, x2) |]\n    ==> distance (failures (P1 |[X]| Q1) M1, failures (P2 |[X]| Q2) M2)\n     <= alpha * distance (x1, x2)\"\napply (insert Parallel_distF\n       [of \"{(failures P1 M1, failures P2 M2), \n             (failures Q1 M1, failures Q2 M2)}\" P1 M1 P2 M2 Q1 Q2 X])\nby (auto)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Parallel:\n \"[| map_alpha (failures P) alpha ; map_alpha (failures Q) alpha |]\n  ==> map_alpha (failures (P |[X]| Q)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Parallel_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Parallel:\n \"[| non_expanding (failures P) ; non_expanding (failures Q) |]\n  ==> non_expanding (failures (P|[X]| Q))\"\nby (simp add: non_expanding_def map_alpha_failures_Parallel)\n\n(*** contraction_alpha ***)\n\nlemma contraction_alpha_failures_Parallel:\n \"[| contraction_alpha (failures P) alpha ; \n     contraction_alpha (failures Q) alpha |]\n  ==> contraction_alpha (failures (P |[X]| Q)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Parallel)\n\n(*--------------------------------*\n |            Hiding              |\n *--------------------------------*)\n\n(* cms rules for Hiding is not necessary \n   because processes are guarded. *)\n\n(*--------------------------------*\n |           Renaming             |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma Renaming_rest_setF_sub:\n   \"failures P M1 .|. n <= failures Q M2 .|. n\n    ==> failures (P [[r]]) M1 .|. n <= failures (Q [[r]]) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_failures)\napply (elim conjE exE)\n\napply (rule_tac x=\"sa\" in exI)\napply (drule_tac x=\"sa\" in spec)\napply (drule_tac x=\"[[r]]inv X\" in spec)\napply (simp)\n\napply (erule disjE)\napply (simp add: ren_tr_lengtht)\n\napply (elim conjE exE)\napply (simp add: ren_tr_lengtht)\napply (simp add: ren_tr_appt_decompo_right)\napply (elim conjE exE, simp)\nby (fast)\n\n(*** rest_setF (equal) ***)\n\nlemma Renaming_rest_setF:\n   \"failures P M1 .|. n = failures Q M2 .|. n\n    ==> failures (P [[r]]) M1 .|. n = failures (Q [[r]]) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Renaming_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Renaming_distF:\n     \"distance(failures (P [[r]]) M1, failures (Q [[r]]) M2) <= \n      distance(failures P M1, failures Q M2)\"\napply (simp only: to_distance_rs)\napply (rule rest_distance_subset)\nby (auto intro: Renaming_rest_setF)\n\n(*** map_alphaT lemma ***)\n\nlemma map_alpha_failures_Renaming_lm:\n  \"distance(failures P M1, failures Q M2) <= alpha * distance (x1, x2)\n    ==> distance(failures (P [[r]]) M1, failures (Q [[r]]) M2)\n     <= alpha * distance(x1, x2)\"\napply (insert Renaming_distF[of P r M1 Q M2])\nby (simp)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Renaming:\n \"map_alpha (failures P) alpha\n  ==> map_alpha (failures (P [[r]])) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Renaming_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Renaming:\n \"non_expanding (failures P)\n  ==> non_expanding (failures (P [[r]]))\"\nby (simp add: non_expanding_def map_alpha_failures_Renaming)\n\n(*** contraction_alpha ***)\n\nlemma contraction_alpha_failures_Renaming:\n \"contraction_alpha (failures P) alpha\n  ==> contraction_alpha (failures (P [[r]])) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Renaming)\n\n(*--------------------------------*\n |           Seq_compo            |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma Seq_compo_rest_setF_sub:\n   \"[| traces P1 (fstF o M1) .|. n <= traces P2 (fstF o M2) .|. n ;\n       failures P1 M1 .|. n <= failures P2 M2 .|. n ;\n       failures Q1 M1 .|. n <= failures Q2 M2 .|. n  |]\n    ==> failures (P1 ;; Q1) M1 .|. n <= failures (P2 ;; Q2) M2 .|. n\"\napply (simp add: subsetF_iff)\napply (simp add: subdomT_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_rest_domT)\napply (simp add: in_failures)\napply (elim conjE exE disjE)\napply (simp_all)\n\n (* case 1 *)\n apply (rule disjI2)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n\n (* case 2 *)\n apply (rule disjI2)\n apply (rule_tac x=\"sa\" in exI)\n apply (rule_tac x=\"t\" in exI)\n apply (simp)\n apply (drule_tac x=\" sa ^^^ <Tick>\" in spec)\n apply (simp)\n\n apply (insert trace_last_nil_or_unnil)\n apply (rotate_tac -1)\n apply (drule_tac x=\"t\" in spec)\n apply (erule disjE, simp)\n  apply (rotate_tac 2)\n  apply (drule sym)\n  apply (simp)\n\n  apply (elim conjE exE, simp)\n  apply (simp add: appt_assoc_sym)\n  apply (rotate_tac 1)\n  apply (drule_tac x=\"sb ^^^ <Tick>\" in spec)\n  apply (drule_tac x=\"X\" in spec, simp)\n  apply (elim conjE)\n\n  apply (case_tac \"Suc (lengtht sb) < n\", simp)\n  apply (case_tac \"Suc (lengtht sb) = n\", simp)\n  apply (drule mp, force)\n  apply (simp)\n  apply (force)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma Seq_compo_rest_setF:\n   \"[| traces P1 (fstF o M1) .|. n = traces P2 (fstF o M2) .|. n ;\n       failures P1 M1 .|. n = failures P2 M2 .|. n ;\n       failures Q1 M1 .|. n = failures Q2 M2 .|. n  |]\n    ==> failures (P1 ;; Q1) M1 .|. n = failures (P2 ;; Q2) M2 .|. n\"\napply (rule order_antisym)\nby (simp_all add: Seq_compo_rest_setF_sub)\n\n(*** distF lemma ***)\n\nlemma Seq_compo_distF:\n\"[| PQTs = {(traces P1 (fstF o M1), traces P2 (fstF o M2))} ;\n    PQFs = {(failures P1 M1, failures P2 M2), (failures Q1 M1, failures Q2 M2)} |]\n ==> (EX PQ. PQ:PQTs & \n             distance(failures (P1 ;; Q1) M1, failures (P2 ;; Q2) M2)\n          <= distance((fst PQ), (snd PQ))) |\n     (EX PQ. PQ:PQFs & \n             distance(failures (P1 ;; Q1) M1, failures (P2 ;; Q2) M2)\n          <= distance((fst PQ), (snd PQ)))\"\napply (simp only: to_distance_rs)\napply (rule rest_to_dist_pair_two)\nby (auto intro: Seq_compo_rest_setF)\n\n(*** map_alpha F lemma ***)\n\nlemma map_alpha_failures_Seq_compo_lm:\n  \"[| distance (traces P1 (fstF o M1), traces P2 (fstF o M2)) \n      <= alpha * distance (x1, x2) ;\n      distance (failures P1 M1, failures P2 M2) <= alpha * distance (x1, x2) ;\n      distance (failures Q1 M1, failures Q2 M2) <= alpha * distance (x1, x2) |]\n    ==> distance (failures (P1 ;; Q1) M1, failures (P2 ;; Q2) M2)\n     <= alpha * distance (x1, x2)\"\napply (insert Seq_compo_distF\n       [of \"{(traces P1 (fstF o M1), traces P2 (fstF o M2))}\" P1 M1 P2 M2\n           \"{(failures P1 M1, failures P2 M2), \n             (failures Q1 M1, failures Q2 M2)}\" Q1 Q2])\nby (auto)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Seq_compo:\n \"[| map_alpha (%M. traces P (fstF o M)) alpha ; \n     map_alpha (failures P) alpha ; map_alpha (failures Q) alpha |]\n  ==> map_alpha (failures (P ;; Q)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Seq_compo_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Seq_compo:\n \"[| non_expanding (%M. traces P (fstF o M)) ;\n     non_expanding (failures P) ; non_expanding (failures Q) |]\n  ==> non_expanding (failures (P ;; Q))\"\nby (simp add: non_expanding_def map_alpha_failures_Seq_compo)\n\n(*** contraction_alpha ***)\n\nlemma contraction_alpha_failures_Seq_compo:\n \"[| contraction_alpha (%M. traces P (fstF o M)) alpha ;\n     contraction_alpha (failures P) alpha ; \n     contraction_alpha (failures Q) alpha|]\n  ==> contraction_alpha (failures (P ;; Q)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Seq_compo)\n\n(*--------------------------------*\n |       Seq_compo  (gSKIP)       |\n *--------------------------------*)\n\n(*** rest_setF (subset) ***)\n\nlemma gSKIP_Seq_compo_rest_setF_sub:\n   \"[| traces P1 (fstF o M1) .|. (Suc n) <= traces P2 (fstF o M2) .|. (Suc n) ;\n       failures P1 M1 .|. (Suc n) <= failures P2 M2 .|. (Suc n) ;\n       failures Q1 M1 .|. n <= failures Q2 M2 .|. n ;\n       <Tick> ~:t traces P1 (fstF o M1) ;\n       <Tick> ~:t traces P2 (fstF o M2) |]\n    ==> failures (P1 ;; Q1) M1 .|. (Suc n) <= failures (P2 ;; Q2) M2 .|. (Suc n)\"\napply (simp add: subsetF_iff)\napply (simp add: subdomT_iff)\napply (intro allI impI)\napply (simp add: in_rest_setF)\napply (simp add: in_rest_domT)\napply (simp add: in_failures)\napply (elim conjE exE disjE)\napply (simp_all)\n\n (* case 1 *)\n apply (insert trace_last_nil_or_unnil)\n apply (rotate_tac -1)\n apply (drule_tac x=\"sa\" in spec)\n apply (erule disjE)\n  apply (simp add: gSKIP_to_Tick_notin_traces)   (* sa = []t *)\n\n  apply (rule disjI2)                            (* sa ~= []t *)\n  apply (elim conjE exE, simp)\n  apply (rule_tac x=\"(sb ^^^ <a>)\" in exI)\n  apply (rule_tac x=\"t\" in exI)\n  apply (simp)\n\n (* case 2 *)\n apply (rotate_tac -1)\n apply (drule_tac x=\"t\" in spec)\n apply (erule disjE)   \n  apply (simp)           (* t = []t *)\n  apply (rotate_tac 5)\n  apply (drule sym)\n  apply (simp)           (* contradict noTick *)\n\n  apply (rule disjI2)    (* t ~= []t *)\n  apply (elim conjE exE, simp)\n  apply (simp add: appt_assoc_sym)\n  apply (rule_tac x=\"sa\" in exI)\n  apply (rule_tac x=\"sb ^^^ <Tick>\" in exI)\n  apply (simp add: appt_assoc)\n\n  apply (insert trace_last_nil_or_unnil)\n  apply (rotate_tac -1)\n  apply (drule_tac x=\"sa\" in spec)\n  apply (erule disjE)\n   apply (simp add: gSKIP_to_Tick_notin_traces)   (* sa = []t *)\n   apply (elim conjE exE, simp)\n                                                  (* i.e. lengtht sb < n *)\n   apply (rotate_tac 2)\n   apply (drule_tac x=\"sb ^^^ <Tick>\" in spec)\n   apply (drule_tac x=\"X\" in spec)\n   apply (drule mp)\n    apply (simp)\n    apply (case_tac \"Suc (lengtht sb) < n\", simp)\n    apply (case_tac \"Suc (lengtht sb) = n\", fast)\n    apply (force)\n   apply (simp)\ndone\n\n(*** rest_setF (equal) ***)\n\nlemma gSKIP_Seq_compo_rest_setF:\n   \"[| traces P1 (fstF o M1) .|. (Suc n) = traces P2 (fstF o M2) .|. (Suc n) ;\n       failures P1 M1 .|. (Suc n) = failures P2 M2 .|. (Suc n) ;\n       failures Q1 M1 .|. n = failures Q2 M2 .|. n ;\n       <Tick> ~:t traces P1 (fstF o M1) ;\n       <Tick> ~:t traces P2 (fstF o M2) |]\n    ==> failures (P1 ;; Q1) M1 .|. (Suc n) = failures (P2 ;; Q2) M2 .|. (Suc n)\"\napply (rule order_antisym)\nby (simp_all add: gSKIP_Seq_compo_rest_setF_sub)\n\n(*** map_alpha F lemma ***)\n\nlemma gSKIP_map_alpha_failures_Seq_compo_lm:\n  \"[| distance (traces P1 (fstF o M1), traces P2 (fstF o M2)) * 2 <= (1/2)^n ;\n      distance (failures P1 M1, failures P2 M2) * 2 <= (1/2)^n ;\n      distance (failures Q1 M1, failures Q2 M2) <= (1/2)^n ;\n       <Tick> ~:t traces P1 (fstF o M1);\n       <Tick> ~:t traces P2 (fstF o M2) |]\n    ==> distance (failures (P1 ;; Q1) M1, failures (P2 ;; Q2) M2) * 2\n     <= (1/2)^n\"\napply (insert gSKIP_Seq_compo_rest_setF[of P1 M1 n P2 M2 Q1 Q2])\napply (simp only: to_distance_rs)\napply (simp add: distance_rs_le_1)\ndone\n\n(*** map_alpha ***)\n\nlemma gSKIP_contraction_half_failures_Seq_compo:\n \"[| contraction_alpha (%M. traces P (fstF o M)) (1/2) ;\n     contraction_alpha (failures P) (1/2) ; non_expanding (failures Q) ;\n     gSKIP P |]\n  ==> contraction_alpha (failures (P ;; Q)) (1/2)\"\napply (simp add: contraction_alpha_def non_expanding_def map_alpha_def)\napply (intro allI)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\napply (drule_tac x=\"y\" in spec)\n\napply (case_tac \"x = y\", simp)\napply (simp only: to_distance_rs)\napply (simp add: distance_iff)\napply (insert gSKIP_to_Tick_notin_traces)\napply (frule_tac x=\"P\" in spec)\napply (drule_tac x=\"P\" in spec)\napply (drule_tac x=\"fstF o x\" in spec)\napply (drule_tac x=\"fstF o y\" in spec)\napply (fold to_distance_rs)\napply (simp add: gSKIP_map_alpha_failures_Seq_compo_lm)\ndone\n\n(*--------------------------------*\n |          Depth_rest            |\n *--------------------------------*)\n\n(*** rest_setF (equal) ***)\n\nlemma Depth_rest_rest_setF:\n   \"failures P M1 .|. n = failures Q M2 .|. n\n    ==> failures (P |. m) M1 .|. n = failures (Q |. m) M2 .|. n\"\napply (simp add: failures.simps)\napply (simp add: min_rs)\napply (rule rest_equal_preserve)\napply (simp)\napply (simp add: min_def)\ndone\n\n(*** distF lemma ***)\n\nlemma Depth_rest_distF:\n     \"distance(failures (P |. m) M1, failures (Q |. m) M2) <= \n      distance(failures P M1, failures Q M2)\"\napply (simp add: to_distance_rs)\napply (rule rest_distance_subset)\nby (auto intro: Depth_rest_rest_setF)\n\n(*** map_alphaT lemma ***)\n\nlemma map_alpha_failures_Depth_rest_lm:\n  \"distance(failures P M1, failures Q M2) <= alpha * distance (x1, x2)\n    ==> distance(failures (P |. m) M1, failures (Q |. m) M2)\n     <= alpha * distance(x1, x2)\"\napply (insert Depth_rest_distF[of P m M1 Q M2])\nby (simp)\n\n(*** map_alpha ***)\n\nlemma map_alpha_failures_Depth_rest:\n \"map_alpha (failures P) alpha\n  ==> map_alpha (failures (P |. n)) alpha\"\napply (simp add: map_alpha_def)\napply (intro allI)\napply (erule conjE)\napply (drule_tac x=\"x\" in spec)\napply (drule_tac x=\"y\" in spec)\nby (simp add: map_alpha_failures_Depth_rest_lm)\n\n(*** non_expanding ***)\n\nlemma non_expanding_failures_Depth_rest:\n \"non_expanding (failures P)\n  ==> non_expanding (failures (P |. n))\"\nby (simp add: non_expanding_def map_alpha_failures_Depth_rest)\n\n(*** contraction_alpha ***)\n\nlemma contraction_alpha_failures_Depth_rest:\n \"contraction_alpha (failures P) alpha\n  ==> contraction_alpha (failures (P |. n)) alpha\"\nby (simp add: contraction_alpha_def map_alpha_failures_Depth_rest)\n\n(*--------------------------------*\n |            variable            |\n *--------------------------------*)\n\n(*** non_expanding ***)\n\nlemma continuous_failures_variable_lm:\n    \"non_expanding (sndF o (%M. M p))\"\napply (rule compo_non_expand)\napply (simp add: non_expanding_sndF)\napply (simp add: non_expanding_prod_variable)\ndone\n\nlemma non_expanding_failures_variable: \n   \"non_expanding (failures ($p))\"\napply (simp add: failures_iff)\napply (simp add: continuous_failures_variable_lm[simplified comp_def])\ndone\n\n(*--------------------------------*\n |            Procfun             |\n *--------------------------------*)\n\n(*****************************************************************\n |                         non_expanding                         |\n *****************************************************************)\n\nlemma non_expanding_failures_lm:\n  \"noHide P --> non_expanding (failures P)\"\napply (induct_tac P)\napply (simp add: non_expanding_failures_STOP)\napply (simp add: non_expanding_failures_SKIP)\napply (simp add: non_expanding_failures_DIV)\napply (simp add: non_expanding_failures_Act_prefix)\napply (simp add: non_expanding_failures_Ext_pre_choice)\napply (simp add: non_expanding_failures_Ext_choice non_expanding_traces_fstF)\napply (simp add: non_expanding_failures_Int_choice)\napply (simp add: non_expanding_failures_Rep_int_choice)\napply (simp add: non_expanding_failures_IF)\napply (simp add: non_expanding_failures_Parallel)\n\n(* hiding --> const *)\napply (intro impI)\napply (subgoal_tac \"EX F. (failures (x1 -- x2) = (%M. F))\")   (* 2012 *)\napply (erule exE)\napply (simp)\napply (simp add: non_expanding_Constant)\napply (rule failures_noPN_Constant)\napply (simp)\n\napply (simp add: non_expanding_failures_Renaming)\napply (simp add: non_expanding_failures_Seq_compo non_expanding_traces_fstF)\n\n(* Depth_res *)\napply (simp add: non_expanding_failures_Depth_rest)\napply (simp add: failures_iff)\napply (simp add: zero_rs_setF)\napply (simp add: non_expanding_Constant)\n\napply (simp add: non_expanding_failures_variable)\ndone\n\nlemma non_expanding_failures: \n  \"noHide P ==> non_expanding (failures P)\"\nby (simp add: non_expanding_failures_lm)\n\n(*=============================================================*\n |                          [[P]]Ff                            |\n *=============================================================*)\n\nlemma non_expanding_semFf:\n  \"noHide P ==> non_expanding ([[P]]Ff)\"\napply (simp add: semFf_def)\napply (simp add: non_expanding_domF_decompo)\napply (simp add: non_expanding_traces_fstF)\napply (simp add: non_expanding_failures)\ndone\n\n(*=============================================================*\n |                         [[P]]Ffun                           |\n *=============================================================*)\n\nlemma non_expanding_semFfun: \n  \"noHidefun Pf ==> non_expanding ([[Pf]]Ffun)\"\napply (simp add: semFfun_def)\napply (simp add: prod_non_expand)\napply (simp add: proj_fun_def comp_def)\napply (simp add: noHidefun_def)\napply (simp add: non_expanding_semFf)\ndone\n\n(*****************************************************************\n |                         contraction                           |\n *****************************************************************)\n\nlemma contraction_alpha_failures_lm: \n  \"guarded P --> contraction_alpha (failures P) (1/2)\"\napply (induct_tac P)\napply (simp add: contraction_alpha_failures_STOP)\napply (simp add: contraction_alpha_failures_SKIP)\napply (simp add: contraction_alpha_failures_DIV)\napply (simp add: contraction_half_failures_Act_prefix\n                 non_expanding_failures)\napply (simp add: contraction_half_failures_Ext_pre_choice\n                 non_expanding_failures)\napply (simp add: contraction_alpha_failures_Ext_choice\n                 contraction_alpha_traces_fstF)\napply (simp add: contraction_alpha_failures_Int_choice)\napply (simp add: contraction_alpha_failures_Rep_int_choice)\napply (simp add: contraction_alpha_failures_Rep_int_choice)\napply (simp add: contraction_alpha_failures_IF)\napply (simp add: contraction_alpha_failures_Parallel)\n\n(* hiding --> const *)\napply (intro impI)\napply (subgoal_tac \"EX F. (failures (x1 -- x2) = (%M. F))\")  (* 2012 *)\napply (erule exE)\napply (simp add: contraction_alpha_Constant)\napply (rule failures_noPN_Constant)\napply (simp)\n\napply (simp add: contraction_alpha_failures_Renaming)\n\n(* Seq_compo *)\napply (simp)\napply (intro conjI impI)\napply (simp add: gSKIP_contraction_half_failures_Seq_compo\n                 non_expanding_failures contraction_alpha_traces_fstF)\napply (simp add: contraction_alpha_failures_Seq_compo\n                 contraction_alpha_traces_fstF)\n\n(* Depth_res *)\napply (simp add: contraction_alpha_failures_Depth_rest)\napply (simp add: failures_iff)\napply (simp add: zero_rs_setF)\napply (simp add: contraction_alpha_Constant)\n\napply (simp add: non_expanding_failures_variable)\ndone\n\nlemma contraction_alpha_failures: \n  \"guarded P ==> contraction_alpha (failures P) (1/2)\"\napply (simp add: contraction_alpha_failures_lm)\ndone\n\n(*=============================================================*\n |                          [[P]]Ff                            |\n *=============================================================*)\n\nlemma contraction_alpha_semFf:\n  \"guarded P ==> contraction_alpha ([[P]]Ff) (1/2)\"\napply (simp add: semFf_def)\napply (simp add: contraction_alpha_domF_decompo)\napply (simp add: contraction_alpha_traces_fstF)\napply (simp add: contraction_alpha_failures)\ndone\n\n(*=============================================================*\n |                         [[P]]Ffun                           |\n *=============================================================*)\n\nlemma contraction_alpha_semFfun: \n  \"guardedfun Pf ==> contraction_alpha ([[Pf]]Ffun) (1/2)\"\napply (simp add: semFfun_def)\napply (simp add: prod_contra_alpha)\napply (simp add: proj_fun_def comp_def)\napply (simp add: guardedfun_def)\napply (simp add: contraction_alpha_semFf)\ndone\n\n(*=============================================================*\n |                        contraction                          |\n *=============================================================*)\n\nlemma contraction_semFfun: \n  \"guardedfun Pf ==> contraction ([[Pf]]Ffun)\"\napply (simp add: contraction_def)\napply (rule_tac x=\"1/2\" in exI)\napply (simp add:contraction_alpha_semFfun)\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/CSP_F/CSP_F_contraction.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5964331606115021, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.300546349940298}}
{"text": "subsection \\<open>IMO 2018 SL - C3\\<close>\n\ntheory IMO_2018_SL_C3\n  imports Complex_Main\nbegin\n\n(*\nsubsubsection \\<open>General lemmas\\<close>\n\nlemma sum_list_int [simp]:\n  fixes xs :: \"nat list\"\n  shows \"(\\<Sum> x \\<leftarrow> xs. int (f x)) = int (\\<Sum> x \\<leftarrow> xs. f x)\"\n  sorry\n\nlemma sum_list_comp:\n  shows \"(\\<Sum> x \\<leftarrow> xs. f (g x)) = (\\<Sum> x \\<leftarrow> map g xs. f x)\"\n  sorry\n\nlemma lt_ceiling_frac:\n  assumes \"x < ceiling (a / b)\" \"b > 0\"\n  shows \"x * b < a\"\n  sorry\n\nlemma subset_Max:\n  fixes X :: \"nat set\"\n  assumes \"finite X\"\n  shows \"X \\<subseteq> {0..<Max X + 1}\"\n  using assms\n  sorry\n\nlemma card_Max:\n  fixes X :: \"nat set\"\n  shows \"card X \\<le> Max X + 1\"\n  sorry\n\nlemma sum_length_parts:\n  assumes \"\\<forall> i j. i < j \\<and> j < length ps \\<longrightarrow> set (filter (ps ! i) xs) \\<inter> set (filter (ps ! j) xs) = {}\"\n  shows \"sum_list (map (\\<lambda> p. length (filter p xs)) ps) \\<le> length xs\"\n  sorry\n\nlemma hd_filter:\n  assumes \"filter P xs \\<noteq> []\"\n  shows \"\\<exists> k. k < length xs \\<and> (filter P xs) ! 0 = xs ! k \\<and> P (xs ! k) \\<and> (\\<forall> k' < k. \\<not> P (xs ! k'))\"\n  sorry\n\nlemma last_filter:\n  assumes \"filter P xs \\<noteq> []\"\n  shows \"\\<exists> k. k < length xs \\<and> (filter P xs) ! (length (filter P xs) - 1) = xs ! k \\<and> P (xs ! k) \\<and> (\\<forall> k'. k < k' \\<and> k' < length xs \\<longrightarrow> \\<not> P (xs ! k'))\"\n  sorry\n\nlemma filter_tl [simp]:\n  \"filter P (tl xs) = (if P (hd xs) then tl (filter P xs) else filter P xs)\"\n  sorry\n\nlemma filter_dropWhile_not [simp]:\n  shows \"filter P (dropWhile (\\<lambda>x. \\<not> P x) xs) = filter P xs\"\n  sorry\n\nlemma inside_filter:\n  assumes \"i + 1 < length (filter P xs)\"\n  shows \"\\<exists> k1 k2. k1 < k2 \\<and> k2 < length xs \\<and> \n                  (filter P xs) ! i = xs ! k1 \\<and> \n                  (filter P xs) ! (i + 1) = xs ! k2 \\<and> \n                  P (xs ! k1) \\<and> P (xs ! k2) \\<and> \n                  (\\<forall> k'. k1 < k' \\<and> k' < k2 \\<longrightarrow> \\<not> P (xs ! k'))\"\n  sorry\n\nsubsubsection \\<open>Unlabeled states\\<close>\n*)\ntype_synonym state = \"nat list\"\n\ndefinition initial_state :: \"nat \\<Rightarrow> state\" where\n  \"initial_state n = (replicate (n + 1) 0) [0 := n]\"\n\ndefinition final_state :: \"nat \\<Rightarrow> state\" where\n  \"final_state n = (replicate (n + 1) 0) [n := n]\"\n(*\ndefinition valid_state :: \"nat \\<Rightarrow> state \\<Rightarrow> bool\" where\n   \"valid_state n state \\<longleftrightarrow> length state = n + 1 \\<and> sum_list state = n\"\n*)\n\ndefinition move :: \"nat \\<Rightarrow> nat \\<Rightarrow> state \\<Rightarrow> state\" where\n  \"move p1 p2 state = \n     (let k1 = state ! p1;                     \n          k2 = state ! p2\n       in state [p1 := k1 - 1, p2 := k2 + 1])\"\n\ndefinition valid_move' :: \"nat  \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> state \\<Rightarrow> state \\<Rightarrow> bool\" where \n  \"valid_move' n p1 p2 state state' \\<longleftrightarrow> \n      (let k1 = state ! p1\n        in k1 > 0 \\<and> p1 < p2 \\<and> p2 \\<le> p1 + k1 \\<and> p2 \\<le> n \\<and>\n           state' = move p1 p2 state)\"\n\ndefinition valid_move :: \"nat \\<Rightarrow> state \\<Rightarrow> state \\<Rightarrow> bool\" where \n  \"valid_move n state state' \\<longleftrightarrow> \n      (\\<exists> p1 p2. valid_move' n p1 p2 state state')\"\n\ndefinition valid_moves where\n  \"valid_moves n states \\<longleftrightarrow> \n      (\\<forall> i < length states - 1. valid_move n (states ! i) (states ! (i + 1)))\"\n\ndefinition valid_game where\n  \"valid_game n states \\<longleftrightarrow> \n       length states \\<ge> 2 \\<and>\n       hd states = initial_state n \\<and> \n       last states = final_state n \\<and> \n       valid_moves n states\"\n\n(*\nlemma valid_state_initial_state [simp]:\n  shows \"valid_state n (initial_state n)\"\n  sorry\n\nlemma valid_move_valid_state:\n  assumes \"valid_state n state\" \"valid_move n state state'\"\n  shows \"valid_state n state'\"\n  sorry\n\nlemma valid_moves_Nil [simp]:\n  shows \"valid_moves n []\"\n  sorry\n\nlemma valid_moves_Single [simp]:\n  shows \"valid_moves n [state]\"\n  sorry\n\nlemma valid_moves_Cons [simp]:\n  shows \"valid_moves n (state1 # state2 # states) \\<longleftrightarrow> \n         valid_move n state1 state2 \\<and> valid_moves n (state2 # states)\"\n  sorry\n\nlemma valid_moves_valid_states:\n  assumes \"valid_moves n states\" \"valid_state n (hd states)\"\n  shows \"\\<forall> state \\<in> set states. valid_state n state\"\n  sorry\n\nlemma valid_game_valid_states:\n  assumes \"valid_game n states\"\n  shows \"\\<forall> state \\<in> set states. valid_state n state\"\n  sorry\n\ndefinition move_positions where\n  \"move_positions state state' = \n    (THE (p1, p2). valid_move' (length state - 1) p1 p2 state state')\"\n\nlemma move_positions_unique:\n  assumes \"valid_state n state\" \"valid_move n state state'\"\n  shows \"\\<exists>! (p1, p2). valid_move' n p1 p2 state state'\"\n  sorry\n\nlemma valid_move'_move_positions:\n  assumes \"valid_state n state\" \"valid_move' n p1 p2 state state'\"\n  shows \"(p1, p2) = move_positions state state'\"\n  sorry\n\nlemma move_positions_valid_move':\n  assumes \"valid_state n state\" \"valid_move n state state'\"\n          \"(p1, p2) = move_positions state state'\"\n  shows \"valid_move' n p1 p2 state state'\"\n  sorry\n\nsubsubsection \\<open>Labeled states\\<close>\n\ntype_synonym labeled_state = \"(nat set) list\"\n\ndefinition initial_labeled_state :: \"nat \\<Rightarrow> labeled_state\" where\n  \"initial_labeled_state n  = (replicate (n+1) {}) [0 := {0..<n}]\"\n\ndefinition final_labeled_state :: \"nat \\<Rightarrow> labeled_state\" where\n  \"final_labeled_state n  = (replicate (n+1) {}) [n := {0..<n}]\"\n\ndefinition valid_labeled_state :: \"nat \\<Rightarrow> labeled_state \\<Rightarrow> bool\" where\n  \"valid_labeled_state n l_state \\<longleftrightarrow> \n        length l_state = n+1 \\<and>\n        (\\<forall> i j. i < j \\<and> j \\<le> n \\<longrightarrow> l_state ! i \\<inter> l_state ! j = {}) \\<and>\n        (\\<Union> (set l_state)) = {0..<n}\"\n\ndefinition labeled_move where \n  \"labeled_move p1 p2 stone l_state = \n    (let ss1 = l_state ! p1;\n         ss2 = l_state ! p2 \n      in l_state [p1 := ss1 - {stone}, p2 := ss2 \\<union> {stone}])\"\n\ndefinition valid_labeled_move' :: \"nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> nat \\<Rightarrow> labeled_state \\<Rightarrow> labeled_state \\<Rightarrow> bool\" where \n  \"valid_labeled_move' n p1 p2 stone l_state l_state' \\<longleftrightarrow> \n      (let ss1 = l_state ! p1\n        in p1 < p2 \\<and> p2 \\<le> p1 + card ss1 \\<and> p2 \\<le> n \\<and>\n           stone \\<in> ss1 \\<and> l_state' = labeled_move p1 p2 stone l_state)\"\n\ndefinition valid_labeled_move :: \"nat \\<Rightarrow> labeled_state \\<Rightarrow> labeled_state \\<Rightarrow> bool\" where \n  \"valid_labeled_move n l_state l_state' \\<longleftrightarrow> \n      (\\<exists> p1 p2 stone. valid_labeled_move' n p1 p2 stone l_state l_state')\"\n\ndefinition valid_labeled_moves where\n  \"valid_labeled_moves n l_states \\<longleftrightarrow> \n     (\\<forall> i < length l_states - 1. valid_labeled_move n (l_states ! i) (l_states ! (i + 1)))\"\n\ndefinition valid_labeled_game where\n  \"valid_labeled_game n l_states \\<longleftrightarrow> \n       length l_states \\<ge> 2 \\<and>\n       hd l_states = initial_labeled_state n \\<and> \n       last l_states = final_labeled_state n \\<and> \n       valid_labeled_moves n l_states\"\n\nlemma valid_labeled_state_initial_labeled_state [simp]:\n  shows \"valid_labeled_state n (initial_labeled_state n)\"\n  sorry\n\nlemma valid_labeled_state_final_labeled_state [simp]:\n  shows \"valid_labeled_state n (final_labeled_state n)\"\n  sorry\n\nlemma valid_labeled_move_valid_labeled_state:\n  assumes \"valid_labeled_state n l_state\" \"valid_labeled_move n l_state l_state'\"\n  shows \"valid_labeled_state n l_state'\"\n  sorry\n\nlemma valid_labeled_moves_valid_labeled_states:\n  assumes \"valid_labeled_moves n l_states\" \"valid_labeled_state n (hd l_states)\"\n  shows \"\\<forall> state \\<in> set l_states. valid_labeled_state n state\"\n  sorry\n\nlemma valid_labeled_game_valid_labeled_states:\n  assumes \"valid_labeled_game n states\"\n  shows \"\\<forall> state \\<in> set states. valid_labeled_state n state\"\n  sorry\n\ndefinition labeled_move_positions where\n  \"labeled_move_positions state state' = \n       (THE (p1, p2, stone). valid_labeled_move' (length state - 1) p1 p2 stone state state')\"\n\nlemma labeled_move_positions_unique:\n  assumes \"valid_labeled_state n state\" \"valid_labeled_move n state state'\"\n  shows \"\\<exists>! (p1, p2, stone). valid_labeled_move' n p1 p2 stone state state'\"\n  sorry\n\nlemma labeled_move_positions:\n  assumes \"valid_labeled_state n state\" \"valid_labeled_move' n p1 p2 stone state state'\"\n  shows \"labeled_move_positions state state' = (p1, p2, stone)\"\n  sorry\n\nlemma labeled_move_positions_valid_move':\n  assumes \"valid_labeled_state n state\" \"valid_labeled_move n state state'\"\n          \"labeled_move_positions state state' = (p1, p2, stone)\"\n  shows \"valid_labeled_move' n p1 p2 stone state state'\"\n  sorry\n\ndefinition stone_position :: \"labeled_state \\<Rightarrow> nat \\<Rightarrow> nat\" where\n  \"stone_position l_state stone = \n     (THE k. k < length l_state \\<and> stone \\<in> l_state ! k)\"\n\nlemma stone_position_unique:\n  assumes \"valid_labeled_state n l_state\" \"stone < n\"\n  shows \"\\<exists>! k. k < length l_state \\<and> stone \\<in> l_state ! k\"\n  sorry\n\nlemma stone_position:\n  assumes \"valid_labeled_state n l_state\" \"stone < n\"\n  shows \"stone_position l_state stone \\<le> n \\<and> \n         stone \\<in> l_state ! (stone_position l_state stone)\"\n  sorry\n\nlemma stone_positionI:\n  assumes \"valid_labeled_state n l_state\" \"stone < n\" \n          \"k < length l_state\" \"stone \\<in> l_state ! k\"\n  shows \"stone_position l_state stone = k\"\n  sorry\n\nlemma valid_labeled_move'_stone_positions:\n  assumes \"valid_labeled_state n l_state\" \"valid_labeled_move' n p1 p2 stone l_state l_state'\"\n  shows \"stone_position l_state stone = p1 \\<and> stone_position l_state' stone = p2\"\n  sorry\n\nlemma valid_labeled_move'_stone_positions_other:\n  assumes \"valid_labeled_state n l_state\" \"valid_labeled_move' n p1 p2 stone l_state l_state'\"\n  shows \"\\<forall> stone'. stone' \\<noteq> stone \\<and> stone' < n \\<longrightarrow> \n                     stone_position l_state' stone' = stone_position l_state stone'\"\n  sorry\n\nsubsubsection \\<open>Unlabel\\<close>\n\ndefinition unlabel :: \"labeled_state \\<Rightarrow> state\" where \n  \"unlabel = map card\"\n\nlemma unlabel_initial [simp]:\n  shows \"unlabel (initial_labeled_state n) = initial_state n\"\n  sorry\n\nlemma unlabel_final [simp]:\n  shows \"unlabel (final_labeled_state n) = final_state n\"\n  sorry\n\nlemma unlabel_valid:\n  assumes \"valid_labeled_state n l_state\"\n  shows \"valid_state n (unlabel l_state)\"\n  sorry\n\nlemma unlabel_valid_move':\n  assumes \"valid_labeled_state n l_state\" \"valid_labeled_move' n p1 p2 stone l_state l_state'\"\n  shows \"valid_move' n p1 p2 (unlabel l_state) (unlabel l_state') \\<and> \n         unlabel l_state' = move p1 p2 (unlabel l_state)\"\n  sorry\n\nlemma unlabel_valid_move:\n  assumes \"valid_labeled_state n l_state\" \"valid_labeled_move n l_state l_state'\"\n  shows \"valid_move n (unlabel l_state) (unlabel l_state')\"\n  sorry\n\nsubsubsection \\<open>Labeled move max stone\\<close>\n\ndefinition valid_labeled_move_max_stone :: \"nat \\<Rightarrow> labeled_state \\<Rightarrow> labeled_state \\<Rightarrow> bool\" where \n  \"valid_labeled_move_max_stone n l_state l_state' \\<longleftrightarrow> \n      (\\<exists> p1 p2. valid_labeled_move' n p1 p2 (Max (l_state ! p1)) l_state l_state')\"\n\ndefinition valid_labeled_moves_max_stone where\n  \"valid_labeled_moves_max_stone n l_states \\<longleftrightarrow> \n     (\\<forall> i < length l_states - 1. valid_labeled_move_max_stone n (l_states ! i) (l_states ! (i + 1)))\"\n\ndefinition valid_labeled_game_max_stone where\n  \"valid_labeled_game_max_stone n l_states \\<longleftrightarrow> \n       length l_states \\<ge> 2 \\<and>\n       hd l_states = initial_labeled_state n \\<and> \n       last l_states = final_labeled_state n \\<and> \n       valid_labeled_moves_max_stone n l_states\"\n\nlemma valid_labeled_moves_max_stone_Cons:\n  assumes \"valid_labeled_moves_max_stone n states\" \"valid_labeled_move_max_stone n state (hd states)\"\n  shows \"valid_labeled_moves_max_stone n (state # states)\"\n  sorry\n\nlemma valid_labeled_game_max_stone_valid_labeled_game:\n  assumes \"valid_labeled_game_max_stone n states\"\n  shows \"valid_labeled_game n states\"\n  sorry\n\nlemma valid_labeled_move_move_max_stone:\n  assumes \"valid_labeled_state n l_state\"\n          \"unlabel l_state = state\" \"valid_move' n p1 p2 state state'\"\n          \"l_state' = labeled_move p1 p2 (Max (l_state ! p1)) l_state\"\n        shows \"valid_labeled_move' n p1 p2 (Max (l_state ! p1)) l_state l_state'\"\n  sorry\n\nprimrec label_moves_max_stone where\n  \"label_moves_max_stone l_state [] = [l_state]\"\n| \"label_moves_max_stone l_state (state' # states) = \n     (let state = unlabel l_state;\n          (p1, p2) = move_positions state state';\n          l_state' = labeled_move p1 p2 (Max (l_state ! p1)) l_state\n       in l_state # label_moves_max_stone l_state' states)\"\n\nlemma hd_label_moves_max_stone [simp]:\n  shows \"hd (label_moves_max_stone l_state states) = l_state\"\n  sorry\n\nlemma valid_states_label_moves_max_stone:\n  assumes \"valid_labeled_state n l_state\" \"valid_moves n (unlabel l_state # states)\"\n  shows \"\\<forall> l_state' \\<in> set (label_moves_max_stone l_state states). valid_labeled_state n l_state'\"\n  sorry\n\nlemma unlabel_label_moves_max_stone:\n  assumes \"valid_labeled_state n l_state\"  \"valid_moves n (unlabel l_state # states)\"\n  shows \"map unlabel (label_moves_max_stone l_state states) = unlabel l_state # states\"\n  sorry\n\nlemma label_moves_max_stone_length [simp]:\n  shows \"length (label_moves_max_stone l_state states) = length states + 1\"\n  sorry\n\nlemma label_moves_max_stone_valid_moves:\n  assumes \"valid_labeled_state n l_state\" \"valid_moves n (unlabel l_state # states)\"\n  shows \"valid_labeled_moves_max_stone n (label_moves_max_stone l_state states)\"\n  sorry\n\nlemma final_labeled_state_unique:\n  assumes \"unlabel l_state = final_state n\" \"valid_labeled_state n l_state\"\n  shows \"l_state = final_labeled_state n\"\n  sorry\n\nlemma labeled_game_max_stone_length [simp]:\n  assumes \"valid_game n states\"\n  shows \"length (label_moves_max_stone (initial_labeled_state n) (tl states)) = length states\"\n  sorry\n\nlemma valid_labeled_game_max_stone:\n  assumes \"valid_game n states\"\n  shows \"valid_labeled_game_max_stone n (label_moves_max_stone (initial_labeled_state n) (tl states))\"\n  sorry\n\n\nsubsubsection \\<open>Valid labeled game move max stone length\\<close>\n\nlemma moved_from:\n  assumes \"valid_labeled_state n (hd l_states)\" \"valid_labeled_moves n l_states\"\n          \"i < j\" \"j < length l_states\" \"stone < n\"\n          \"stone_position (l_states ! i) stone \\<noteq> stone_position (l_states ! j) stone\"\n  shows \"(\\<exists> k. i \\<le> k \\<and> k < j \\<and> \n         (let (p1, p2, stone') = labeled_move_positions (l_states ! k) (l_states ! (k + 1)) in \n          stone' = stone \\<and> p1 = stone_position (l_states ! i) stone))\"\n  sorry\n\nlemma valid_labeled_game_max_stone_min_length:\n  assumes \"valid_labeled_game_max_stone n l_states\"\n  shows \"length l_states \\<ge> (\\<Sum> k \\<leftarrow> [1..<n+1]. (ceiling (n / k))) + 1\"\n  sorry\n\nsubsubsection \\<open>Valid game length\\<close>\n*)\ntheorem IMO2018SL_C3:\n  assumes \"valid_game n states\"\n  shows \"length states \\<ge> (\\<Sum> k \\<leftarrow> [1..<n+1]. (ceiling (n / k))) + 1\"\n  sorry\n\nend\n", "meta": {"author": "filipmaric", "repo": "IMO", "sha": "9fb602bf4fd5bcb5890361d194a4fb423ac266e2", "save_path": "github-repos/isabelle/filipmaric-IMO", "path": "github-repos/isabelle/filipmaric-IMO/IMO-9fb602bf4fd5bcb5890361d194a4fb423ac266e2/IMO_files/statements/IMO_2018_SL_C3.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5964331462646254, "lm_q2_score": 0.5039061705290805, "lm_q1q2_score": 0.3005463427108183}}
{"text": "theory utp_fault_rea_designs\nimports  utp_reactive\nbegin\nsubsection {*Sequential C-program alphabet*}\n\ntext {*In order to record the interaction of a sequential C program with its execution environment, \n       we extend the alphabet of UTP by two additional global state variables:\n      \\begin{itemize}   \n       \\<^item> fault: a variable of type @{typ \"'f option\"} used to record a fault of a given guard is \n         not satisfied.\n       \\<^item> abrupt: a boolean variable used to\n     \\end{itemize}\n\n*}\n\nalphabet 'f cp_vars = \"'t rp_vars\" +\n  abrupt:: bool\n  fault :: \"'f option\"\n  (*wait :: bool*)\n\ndeclare cp_vars.splits [alpha_splits]\n\nsubsubsection {*Alphabet proofs*}\ntext {*\n  The two locale interpretations below are a technicality to improve automatic\n  proof support via the predicate and relational tactics. This is to enable the\n  (re-)interpretation of state spaces to remove any occurrences of lens types\n  after the proof tactics @{method pred_simp} and @{method rel_simp}, or any\n  of their derivatives have been applied. Eventually, it would be desirable to\n  automate both interpretations as part of a custom outer command for defining\n  alphabets.\n*}\n\ninterpretation cp_vars:\n  lens_interp \"\\<lambda> (ok, wait, tr, r). \n  (ok, wait, tr, abrupt\\<^sub>v r, fault\\<^sub>v r, more r)\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\ninterpretation cp_vars_rel: lens_interp \"\\<lambda>(ok, ok', wait, tr, wait', tr', r, r').\n  (ok, ok', wait, wait', tr, tr', abrupt\\<^sub>v r, abrupt\\<^sub>v r', fault\\<^sub>v r, fault\\<^sub>v r', more r, more r')\"\napply (unfold_locales)\napply (rule injI)\napply (clarsimp)\ndone\n\nsubsubsection {*Type lifting*}\n\ntype_synonym ('t, 'f, '\\<alpha>) cp = \"('t, ('f, '\\<alpha>) cp_vars_scheme) rp\"\ntype_synonym ('t,'f,'\\<alpha>,'\\<beta>) rel_cp  = \"(('t,'f,'\\<alpha>) cp, ('t,'f,'\\<beta>) cp) rel\"\ntype_synonym ('t,'f,'\\<alpha>) hrel_cp  = \"(('t,'f,'\\<alpha>) cp) hrel\"\n\nsubsubsection {*Syntactic type setup*}\n\ntranslations\n  (type) \"('t, 'f, '\\<alpha>) cp\" <= (type) \"('t, ('f, '\\<alpha>) cp_vars_scheme) rp_vars_scheme des\"\n  (type) \"('t, 'f, '\\<alpha>) cp\" <= (type) \"('t, ('f, '\\<alpha>) cp_vars_scheme) rp_vars_ext des\"\n  (type) \"('t, 'f,'\\<alpha>,'\\<beta>) rel_cp\" <= (type) \"(('t,'f,'\\<alpha>) cp, (_,_,'\\<beta>) cp) rel\"\n\nnotation cp_vars_child_lens\\<^sub>a (\"\\<Sigma>\\<^sub>c\")\nnotation cp_vars_child_lens (\"\\<Sigma>\\<^sub>C\")\n\nsyntax\n  \"_svid_st_alpha\"  :: \"svid\" (\"\\<Sigma>\\<^sub>C\")\n  \"_svid_st_a\"  :: \"svid\" (\"\\<Sigma>\\<^sub>c\")\ntranslations\n  \"_svid_st_alpha\" => \"CONST cp_vars_child_lens\"\n   \"_svid_st_a\" => \"CONST cp_vars_child_lens\\<^sub>a\"\n\nlemma cvars_ord [usubst]:\n  \"$fault \\<prec>\\<^sub>v $fault\\<acute>\" \"$abrupt \\<prec>\\<^sub>v $abrupt\\<acute>\"  \"$ok \\<prec>\\<^sub>v $ok\\<acute>\"\n  \"$ok \\<prec>\\<^sub>v $wait\\<acute>\" \"$ok \\<prec>\\<^sub>v $wait\" \"$ok\\<acute> \\<prec>\\<^sub>v $wait\\<acute>\"  \"$ok\\<acute> \\<prec>\\<^sub>v $wait\"\n  \"$ok \\<prec>\\<^sub>v $fault\\<acute>\" \"$ok \\<prec>\\<^sub>v $fault\" \"$ok\\<acute> \\<prec>\\<^sub>v $fault\\<acute>\"  \"$ok\\<acute> \\<prec>\\<^sub>v $fault\"\n  \"$ok \\<prec>\\<^sub>v $abrupt\\<acute>\" \"$ok \\<prec>\\<^sub>v $abrupt\" \"$ok\\<acute> \\<prec>\\<^sub>v $abrupt\\<acute>\"  \"$ok\\<acute> \\<prec>\\<^sub>v $abrupt\" \n  \"$fault \\<prec>\\<^sub>v $abrupt\\<acute>\" \"$fault \\<prec>\\<^sub>v $abrupt\" \"$fault\\<acute> \\<prec>\\<^sub>v $abrupt\\<acute>\"  \"$fault\\<acute> \\<prec>\\<^sub>v $abrupt\"\n  \"$fault \\<prec>\\<^sub>v $wait\\<acute>\" \"$fault \\<prec>\\<^sub>v $wait\" \"$fault\\<acute> \\<prec>\\<^sub>v $wait\\<acute>\"  \"$fault\\<acute> \\<prec>\\<^sub>v $wait\"\n  \"$abrupt \\<prec>\\<^sub>v $wait\\<acute>\" \"$abrupt \\<prec>\\<^sub>v $wait\" \"$abrupt\\<acute> \\<prec>\\<^sub>v $wait\\<acute>\"  \"$abrupt\\<acute> \\<prec>\\<^sub>v $wait\"\n  by (simp_all add: var_name_ord_def)\n\nabbreviation abrupt_f::\"('t::ordered_cancel_monoid_diff,'f, '\\<alpha>, '\\<beta>) rel_cp \\<Rightarrow> \n                        ('t,'f, '\\<alpha>, '\\<beta>) rel_cp\"\nwhere \"abrupt_f R \\<equiv> R\\<lbrakk>false/$abrupt\\<rbrakk>\"\n\nabbreviation abrupt_t::\"('t::ordered_cancel_monoid_diff,'f, '\\<alpha>, '\\<beta>) rel_cp \\<Rightarrow> \n                        ('t,'f, '\\<alpha>, '\\<beta>) rel_cp\"\nwhere \"abrupt_t R \\<equiv> R\\<lbrakk>true/$abrupt\\<rbrakk>\"\n\nsyntax\n  \"_abrupt_f\"  :: \"logic \\<Rightarrow> logic\" (\"_\\<^sub>a\\<^sub>f\" [1000] 1000)\n  \"_abrupt_t\"  :: \"logic \\<Rightarrow> logic\" (\"_\\<^sub>a\\<^sub>t\" [1000] 1000)\n\ntranslations\n  \"P \\<^sub>a\\<^sub>f\" \\<rightleftharpoons> \"CONST usubst (CONST subst_upd CONST id (CONST ivar CONST abrupt) false) P\"\n  \"P \\<^sub>a\\<^sub>t\" \\<rightleftharpoons> \"CONST usubst (CONST subst_upd CONST id (CONST ivar CONST abrupt) true) P\"\n\nsubsection {*UTP-Relations lift and drop*}\n\nabbreviation lift_desr (\"\\<lceil>_\\<rceil>\\<^sub>C\")\nwhere \"\\<lceil>P\\<rceil>\\<^sub>C \\<equiv> P \\<oplus>\\<^sub>p (\\<Sigma>\\<^sub>C \\<times>\\<^sub>L \\<Sigma>\\<^sub>C)\"\n\nabbreviation lift_pre_desr (\"\\<lceil>_\\<rceil>\\<^sub>C\\<^sub><\")\nwhere \"\\<lceil>p\\<rceil>\\<^sub>C\\<^sub>< \\<equiv> \\<lceil>\\<lceil>p\\<rceil>\\<^sub><\\<rceil>\\<^sub>C\"\n\nabbreviation lift_post_desr (\"\\<lceil>_\\<rceil>\\<^sub>C\\<^sub>>\")\nwhere \"\\<lceil>p\\<rceil>\\<^sub>C\\<^sub>> \\<equiv> \\<lceil>\\<lceil>p\\<rceil>\\<^sub>>\\<rceil>\\<^sub>C\"\n\nabbreviation drop_desr (\"\\<lfloor>_\\<rfloor>\\<^sub>C\")\nwhere \"\\<lfloor>P\\<rfloor>\\<^sub>C \\<equiv> P \\<restriction>\\<^sub>p (\\<Sigma>\\<^sub>C \\<times>\\<^sub>L \\<Sigma>\\<^sub>C)\"\n\n\nsubsection {* Reactive lemmas *}\n\nlemma unrest_ok_lift_rea [unrest]:\n  \"$ok \\<sharp> \\<lceil>P\\<rceil>\\<^sub>C\" \"$ok\\<acute> \\<sharp> \\<lceil>P\\<rceil>\\<^sub>C\"\n  by (pred_auto)+\n\nlemma unrest_wait_lift_rea [unrest]:\n  \"$abrupt \\<sharp> \\<lceil>P\\<rceil>\\<^sub>C\" \"$abrupt\\<acute> \\<sharp> \\<lceil>P\\<rceil>\\<^sub>C\"\n  by (pred_auto)+\n\nlemma unrest_tr_lift_rea [unrest]:\n  \"$fault \\<sharp> \\<lceil>P\\<rceil>\\<^sub>C\" \"$fault\\<acute> \\<sharp> \\<lceil>P\\<rceil>\\<^sub>C\"\n  by (pred_auto)+\n\nlemma seqr_wait_true [usubst]: \"(P ;; Q) \\<^sub>a\\<^sub>t = (P \\<^sub>a\\<^sub>t ;; Q)\"\n  by (rel_auto)\n\nlemma seqr_wait_false [usubst]: \"(P ;; Q) \\<^sub>a\\<^sub>f = (P \\<^sub>a\\<^sub>f ;; Q)\"\n  by (rel_auto)\n\nsubsection{*Healthiness conditions*}\ntext {*In UTP healthiness conditions is away to express invariant on the alphabet.\n       The following healthiness condition express that programs in, wait, fault or \n       abrupt state do not progress.*}\ndefinition C3_def [upred_defs]: \"C3(P) = \n           (P \\<triangleleft>  \\<not>$wait \\<and> \\<not>$abrupt \\<and> $fault =\\<^sub>u \\<guillemotleft>None\\<guillemotright> \\<triangleright> II )\"\n\nsubsection {*exec semantics*}\ntext {*We introduce an execution semantics for the designs containing a specific values for \n       the auxiliary variables composing C-program alphabet. Under this execution function\n       we consider only \\emph{stable} initial state ie., normal initial state. \n       Since Simpl semantics is defined only for initial normal state, using this semantics\n       will allow for an equivalent semantics as the one of Simpl language.*}\n\nabbreviation\n \"Simpl P \\<equiv> C3(true \\<turnstile> (P))\"\n\nsubsection{*Control flow statements*}\n\ntext{*In the sequel we introduce the control-flow statements for C programming language.*}\n\ndefinition skip_c :: \"('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp\" (\"SKIP\")\nwhere [urel_defs]:\"SKIP = Simpl ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<not>$wait\\<acute> \\<and> \\<not>$abrupt\\<acute> \\<and> $fault\\<acute> =\\<^sub>u \\<guillemotleft>None\\<guillemotright> \\<and> \\<lceil>II\\<rceil>\\<^sub>C)\"\n\ndefinition stuck_c :: \"('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp\" (\"STUCK\")\nwhere [urel_defs]: \"STUCK = (\\<not>$ok\\<acute> \\<or> $wait\\<acute> \\<or> $abrupt\\<acute> \\<or> $fault\\<acute> \\<noteq>\\<^sub>u \\<guillemotleft>None\\<guillemotright>)\"\n\ndefinition assigns_c :: \"'\\<alpha> usubst \\<Rightarrow> ('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp\" (\"\\<langle>_\\<rangle>\\<^sub>C\")\nwhere [urel_defs]: \"assigns_c \\<sigma> = \n                    C3(\\<lceil>true\\<rceil>\\<^sub>D \\<turnstile> ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<not>$wait\\<acute> \\<and> \\<not>$abrupt\\<acute> \\<and> $fault\\<acute> =\\<^sub>u \\<guillemotleft>None\\<guillemotright> \\<and> \\<lceil>\\<langle>\\<sigma>\\<rangle>\\<^sub>a\\<rceil>\\<^sub>C))\"\n\nsubsection{*THROW*}\n\ndefinition throw_c :: \"('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp\" (\"THROW\")\nwhere [urel_defs]: \"THROW = Simpl ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<not>$wait\\<acute> \\<and> $abrupt\\<acute> \\<and> $fault\\<acute> =\\<^sub>u \\<guillemotleft>None\\<guillemotright> \\<and> \\<lceil>II\\<rceil>\\<^sub>C)\"\n\nsubsection{*Conditional*}\n\nabbreviation If_c::\"'\\<alpha> cond \\<Rightarrow>('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp \\<Rightarrow> ('t,'f,'\\<alpha>) hrel_cp \\<Rightarrow> \n                    ('t,'f,'\\<alpha>) hrel_cp\" (\"bif (_)/ then (_) else (_) eif\")where\n  \"If_c b P Q \\<equiv> (P \\<triangleleft> \\<lceil>b\\<rceil>\\<^sub>C\\<^sub>< \\<triangleright> Q)\"\n\nsubsection{*GUARD*}\n\nabbreviation guard_c :: \"'f \\<Rightarrow> '\\<alpha> cond \\<Rightarrow> ('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp\"  \nwhere \"guard_c f b \\<equiv> (bif b \n                        then SKIP \n                        else Simpl ($tr\\<acute> =\\<^sub>u $tr \\<and> \\<not>$wait\\<acute> \\<and> \\<not>$abrupt\\<acute> \\<and> $fault\\<acute> =\\<^sub>u \\<guillemotleft>Some f\\<guillemotright> \\<and> \\<lceil>II\\<rceil>\\<^sub>C) \n                      eif)\"\n\nsubsection{*Synchronisation*}\n\nabbreviation sync_c :: \"'\\<alpha> cond \\<Rightarrow> ('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp\"  \nwhere \"sync_c b \\<equiv> (bif b \n                     then SKIP \n                     else Simpl ($tr\\<acute> =\\<^sub>u $tr \\<and> $wait\\<acute> \\<and> \\<not>$abrupt\\<acute> \\<and> $fault\\<acute> =\\<^sub>u \\<guillemotleft>None\\<guillemotright> \\<and> \\<lceil>II\\<rceil>\\<^sub>C) \n                   eif)\"\n\nsubsection{*assert and assume*}\n\ndefinition rassume_c :: \"'\\<alpha> upred \\<Rightarrow> ('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp\" (\"_\\<^sup>\\<top>\\<^sup>C\" [999] 999) where\n[urel_defs]: \"rassume_c c = (bif c then SKIP else \\<top>\\<^sub>D eif)\"\n\ndefinition rassert_c :: \"'\\<alpha> upred \\<Rightarrow> ('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp\" (\"_\\<^sub>\\<bottom>\\<^sub>C\" [999] 999) where\n[urel_defs]: \"rassert_c c = (bif c then SKIP else \\<bottom>\\<^sub>D eif)\"\n\nsubsection{*Exceptions*}\n\nabbreviation catch_c :: \"('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp \\<Rightarrow> ('t,'f,'\\<alpha>) hrel_cp \\<Rightarrow> \n                         ('t,'f,'\\<alpha>) hrel_cp\" (\"try (_) catch /(_) end\")\nwhere \"try P catch Q end \\<equiv> (P ;; ((abrupt:== (\\<not> &abrupt) ;;Q) \\<triangleleft> $abrupt \\<triangleright> II))\"\n\nsubsection{*Scoping*}\n\ndefinition block_c (\"bob INIT (_) BODY /(_) RESTORE /(_) RETURN/(_) eob\") where\n[urel_defs]:\n  \"bob INIT init BODY body RESTORE restore RETURN return eob= \n    (Abs_uexpr (\\<lambda>(s, s'). \n     \\<lbrakk>init ;; body ;; Abs_uexpr (\\<lambda>(t, t').\n                       \\<lbrakk>(abrupt:== (\\<not> &abrupt) ;;restore (s, s') (t, t');; THROW) \\<triangleleft> $abrupt \\<triangleright> II;; \n         restore (s, s') (t, t');; return(s, s') (t, t')\\<rbrakk>\\<^sub>e (t, t'))\\<rbrakk>\\<^sub>e (s, s')))\" \n\nsubsection{*Loops*}\npurge_notation while (\"while\\<^sup>\\<top> _ do _ od\")\n\ndefinition While :: \"'\\<alpha> cond \\<Rightarrow> ('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp \\<Rightarrow> \n                     ('t,'f,'\\<alpha>) hrel_cp\" (\"while\\<^sup>\\<top> _ do _ od\") where\n\"While b C = (\\<nu> X \\<bullet> bif b then (C ;; X) else SKIP eif)\"\n\npurge_notation while_top (\"while _ do _ od\")\n\nabbreviation While_top :: \"'\\<alpha> cond \\<Rightarrow> ('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp \\<Rightarrow>  \n                           ('t,'f,'\\<alpha>) hrel_cp\" (\"while _ do _ od\") where\n\"while b do P od \\<equiv> while\\<^sup>\\<top> b do P od\"\n\npurge_notation while_bot (\"while\\<^sub>\\<bottom> _ do _ od\")\n\ndefinition While_bot :: \"'\\<alpha> cond \\<Rightarrow> ('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp \\<Rightarrow> \n                         ('t,'f,'\\<alpha>) hrel_cp\" (\"while\\<^sub>\\<bottom> _ do _ od\") where\n\"while\\<^sub>\\<bottom> b do P od =  (\\<mu> X \\<bullet> bif b then (P ;; X) else SKIP eif)\"\n\nsubsection{*While-loop inv*}\ntext {* While loops with invariant decoration *}\n\npurge_notation while_inv (\"while _ invr _ do _ od\" 70)\n\ndefinition While_inv :: \"'\\<alpha> cond \\<Rightarrow> '\\<alpha> cond \\<Rightarrow> ('t::ordered_cancel_monoid_diff,'f,'\\<alpha>) hrel_cp \\<Rightarrow> \n                         ('t,'f,'\\<alpha>) hrel_cp\" (\"while _ invr _ do _ od\" 70) where\n\"while b invr p do S od = while b do S od\"\n\ndeclare While_def [urel_defs]\ndeclare While_inv_def [urel_defs]\ndeclare While_bot_def [urel_defs]\n\n\nsyntax\n  \"_assignmentc\" :: \"svid_list \\<Rightarrow> uexprs \\<Rightarrow> logic\"  (infixr \"\\<Midarrow>\" 55)\n\ntranslations\n  \"_assignmentc xs vs\" => \"CONST assigns_c (_mk_usubst (CONST id) xs vs)\"\n  \"x \\<Midarrow> v\" <= \"CONST assigns_c (CONST subst_upd (CONST id) (CONST svar x) v)\"\n  \"x \\<Midarrow> v\" <= \"CONST assigns_c (CONST subst_upd (CONST id) x v)\"\n  \"x,y \\<Midarrow> u,v\" <= \"CONST assigns_c (CONST subst_upd (CONST subst_upd (CONST id) (CONST svar x) u) (CONST svar y) v)\"\n\nend", "meta": {"author": "git-vt", "repo": "orca", "sha": "92bda0f9cfe5cc680b9c405fc38f07a960087a36", "save_path": "github-repos/isabelle/git-vt-orca", "path": "github-repos/isabelle/git-vt-orca/orca-92bda0f9cfe5cc680b9c405fc38f07a960087a36/Archive/Programming-Languages-Semantics/WP11-C-semantics/src/IMP-Lenses/theories/Fault/utp_fault_rea_designs.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141572, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.30049271898234176}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\n(*\n * A theoretical framework for reasoning about non-interference\n * of monadic programs.\n *)\n\ntheory EquivValid\nimports Corres_UL\nbegin\n\nsection{* State equivalence validity *}\n\ntext{*\n\nA generalised information flow property.\n\nOften, we read in the entire state, but then only examine part of it.\nThe following property may be used to split up binds whose first part\ndoes this.\n\n@{term \"I\"} is the state relation that holds invariantly.\n\n@{term \"A\"} (also) holds between initial states.\n\n@{term \"B\"} (also) holds between final states.\n\n@{term \"P\"} holds in the initial state for @{term \"f\"}.\n\n@{term \"P'\"} holds in the initial state for @{term \"f'\"}.\n\n*}\n\ndefinition\n  equiv_valid_2 :: \"('s \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('b \\<Rightarrow> 'c \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'b) nondet_monad \\<Rightarrow> ('s,'c) nondet_monad \\<Rightarrow> bool\"\nwhere\n  \"equiv_valid_2 I A B R P P' f f' \\<equiv> \\<forall>s t.\n       P s \\<and> P' t \\<and> I s t \\<and> A s t\n     \\<longrightarrow> (\\<forall>(rva, s') \\<in> fst (f s). \\<forall>(rvb, t') \\<in> fst (f' t).\n          R rva rvb \\<and> I s' t' \\<and> B s' t')\"\n\nlemma equiv_valid_2_bind_general:\n  assumes r2: \"\\<And> rv rv'. R' rv rv' \\<Longrightarrow> equiv_valid_2 D B C R (Q rv) (Q' rv') (g rv) (g' rv')\"\n  assumes r1: \"equiv_valid_2 D A B R' P P' f f'\"\n  assumes hoare: \"\\<lbrace> S \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  assumes hoare': \"\\<lbrace> S' \\<rbrace> f' \\<lbrace> Q' \\<rbrace>\"\n  shows \"equiv_valid_2 D A C R (\\<lambda> s. P s \\<and> S s) (\\<lambda> s. P' s \\<and> S' s) (f >>= g) (f' >>= g')\"\n  using assms\n  unfolding bind_def equiv_valid_2_def valid_def\n  apply fastforce\n  done\n\n(* almost all of the time, the second relation doesn't change *)\nlemma equiv_valid_2_bind:\n  assumes r2: \"\\<And> rv rv'. R' rv rv' \\<Longrightarrow> equiv_valid_2 D A A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n  assumes r1: \"equiv_valid_2 D A A R' P P' f f'\"\n  assumes hoare: \"\\<lbrace> S \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  assumes hoare': \"\\<lbrace> S' \\<rbrace> f' \\<lbrace> Q' \\<rbrace>\"\n  shows \"equiv_valid_2 D A A R (\\<lambda> s. P s \\<and> S s) (\\<lambda> s. P' s \\<and> S' s) (f >>= g) (f' >>= g')\"\n  using assms by (blast intro: equiv_valid_2_bind_general)\n\nlemma equiv_valid_2_guard_imp:\n  assumes reads_res: \"equiv_valid_2 D A B R Q Q' f f'\"\n  assumes guard_imp: \"\\<And> s. P s \\<Longrightarrow> Q s\"\n  assumes guard_imp': \"\\<And> s. P' s \\<Longrightarrow> Q' s\"\n  shows \"equiv_valid_2 D A B R P P' f f'\"\n  using assms\n  by (fastforce simp: equiv_valid_2_def)\n\nlemma equiv_valid_2_bind_pre:\n  assumes r2: \"\\<And> rv rv'. R' rv rv' \\<Longrightarrow> equiv_valid_2 D A A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n  assumes r1: \"equiv_valid_2 D A A R' P P' f f'\"\n  assumes hoare: \"\\<lbrace> S \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  assumes hoare': \"\\<lbrace> S' \\<rbrace> f' \\<lbrace> Q' \\<rbrace>\"\n  assumes guard_imp: \"\\<And> s. T s \\<Longrightarrow> P s \\<and> S s\"\n  assumes guard_imp': \"\\<And> s. T' s \\<Longrightarrow> P' s \\<and> S' s\"\n  shows \"equiv_valid_2 D A A R T T' (f >>= g) (f' >>= g')\"\n  using assms by (blast intro: equiv_valid_2_bind[THEN equiv_valid_2_guard_imp])\n\nlemma return_ev2:\n  assumes rel: \"\\<And> s t. \\<lbrakk>P s; P' t; I s t; A s t\\<rbrakk> \\<Longrightarrow> R a b\"\n  shows \"equiv_valid_2 I A A R P P' (return a) (return b)\"\n  by(auto simp: equiv_valid_2_def return_def rel)\n\nlemma equiv_valid_2_liftE:\n  \"equiv_valid_2 D A B R P P' f f' \\<Longrightarrow>\n   equiv_valid_2 D A B (E \\<oplus> R) P P' (liftE f) (liftE f')\"\n  apply(unfold liftE_def)\n  apply(rule equiv_valid_2_guard_imp)\n  apply(rule_tac Q=\"\\<top>\\<top>\" and Q'=\"\\<top>\\<top>\" and R'=R in equiv_valid_2_bind_general)\n       apply(fastforce intro: return_ev2)\n      apply assumption\n     apply(rule wp_post_taut)+\n   by(simp_all)\n\nlemma equiv_valid_2_liftE_bindE_general:\n  assumes r2: \"\\<And> rv rv'. R' rv rv' \\<Longrightarrow> equiv_valid_2 D B C R (Q rv) (Q' rv') (g rv) (g' rv')\"\n  assumes hoare: \"\\<lbrace> S \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  assumes hoare':  \"\\<lbrace> S' \\<rbrace> f' \\<lbrace> Q' \\<rbrace>\"\n  assumes r1: \"equiv_valid_2 D A B R' P P' f f'\"\n  shows \"equiv_valid_2 D A C R (P and S) (P' and S') (liftE f >>=E g) (liftE f' >>=E g')\"\n  apply(unfold bindE_def)\n  apply(rule equiv_valid_2_guard_imp)\n  apply(rule_tac Q=\"\\<lambda> rv. K (\\<forall> v. rv \\<noteq> Inl v) and (\\<lambda> s. \\<forall> v. rv = Inr v \\<longrightarrow> Q v s)\" and Q'=\"\\<lambda> rv. K (\\<forall> v. rv \\<noteq> Inl v) and (\\<lambda> s. \\<forall> v. rv = Inr v \\<longrightarrow> Q' v s)\" in equiv_valid_2_bind_general)\n       prefer 2\n       apply(rule_tac E=\"dc\" in equiv_valid_2_liftE)\n       apply(rule r1)\n      apply(clarsimp simp: lift_def split: sum.split)\n      apply(insert r2, fastforce simp: equiv_valid_2_def)[1]\n     apply(simp add: liftE_def, wp, fastforce intro!: hoare_strengthen_post[OF hoare])\n    apply(simp add: liftE_def, wp, fastforce intro!: hoare_strengthen_post[OF hoare'])\n   by(auto)\n\nlemma equiv_valid_2_liftE_bindE:\n  assumes r2: \"\\<And> rv rv'. R' rv rv' \\<Longrightarrow> equiv_valid_2 D A A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n  assumes hoare: \"\\<lbrace> S \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  assumes hoare':  \"\\<lbrace> S' \\<rbrace> f' \\<lbrace> Q' \\<rbrace>\"\n  assumes r1: \"equiv_valid_2 D A A R' P P' f f'\"\n  shows \"equiv_valid_2 D A A R (P and S) (P' and S') (liftE f >>=E g) (liftE f' >>=E g')\"\n  using assms by(blast intro: equiv_valid_2_liftE_bindE_general)\n\nlemma equiv_valid_2_rvrel_imp:\n  \"\\<lbrakk>equiv_valid_2 I A A R P P' f f'; \\<And> s t. R s t \\<Longrightarrow> R' s t\\<rbrakk> \\<Longrightarrow>\n   equiv_valid_2 I A A R' P P' f f'\"\n  apply(fastforce simp: equiv_valid_2_def)\n  done\n\nsubsection{* Specialised fixed-state state equivalence validity *}\n\ntext{*\n\nFor resolve_address_bits and rec_del: talk about a fixed initial\nstate. Note we only do this for one of the computations; the other\nstate can be constrained by how it is related to this one by @{term\n\"I\"} and so forth.\n\nAlso captures the typical case where the relation between the return\nvalues is equality and the required preconditions are identical.\n\nwp can cope with this.\n\n*}\n\ndefinition\n  spec_equiv_valid :: \"'s \\<Rightarrow> ('s \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'b) nondet_monad \\<Rightarrow> bool\"\nwhere\n  \"spec_equiv_valid st I A B P f \\<equiv> equiv_valid_2 I A B (op =) (P and (op = st)) P f f\"\n\nabbreviation spec_equiv_valid_inv where\n  \"spec_equiv_valid_inv st I A P f \\<equiv> spec_equiv_valid st I A A P f\"\n\nsubsection{* Specialised state equivalence validity *}\n\ntext{*\n\nMost of the time we deal with the streamlined version.\n\nwp can cope with this too.\n\n*}\n\ndefinition\n  equiv_valid :: \"('s \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'b) nondet_monad \\<Rightarrow> bool\"\nwhere\n  \"equiv_valid I A B P f \\<equiv> \\<forall>st. spec_equiv_valid st I A B P f\"\n\nlemma equiv_valid_def2:\n  \"equiv_valid I A B P f = equiv_valid_2 I A B (op =) P P f f\"\n  by (simp add: equiv_valid_def spec_equiv_valid_def equiv_valid_2_def)\n\nabbreviation equiv_valid_rv where\n  \"equiv_valid_rv I A B R P f \\<equiv> equiv_valid_2 I A B R P P f f\"\n\n(* this is probably way more general than we need for all but a few special cases *)\nlemma bind_ev_general:\n  assumes reads_res_2: \"\\<And>rv. equiv_valid I B C (Q rv) (g rv)\"\n  assumes reads_res_1: \"equiv_valid I A B P' f\"\n  assumes hoare: \"\\<lbrace> P'' \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  shows \"equiv_valid I A C (\\<lambda>s. P' s \\<and> P'' s) (f >>= g)\"\n  unfolding equiv_valid_def2\n  apply (rule equiv_valid_2_bind_general[where R'=\"op =\"])\n     apply (auto intro: reads_res_1[unfolded equiv_valid_def2] reads_res_2[unfolded equiv_valid_def2])[2]\n   apply (rule hoare)\n  apply (rule hoare)\n  done\n\nlemma bind_ev:\n  assumes reads_res_2: \"\\<And>rv. equiv_valid I A A (Q rv) (g rv)\"\n  assumes reads_res_1: \"equiv_valid I A A P' f\"\n  assumes hoare: \"\\<lbrace> P'' \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  shows \"equiv_valid I A A (\\<lambda>s. P' s \\<and> P'' s) (f >>= g)\"\n  using assms by (blast intro: bind_ev_general)\n\nlemma equiv_valid_guard_imp:\n  assumes reads_res: \"equiv_valid I A B Q f\"\n  assumes guard_imp: \"\\<And> s. P s \\<Longrightarrow> Q s\"\n  shows \"equiv_valid I A B P f\"\n  using assms by (fastforce simp: equiv_valid_def2 equiv_valid_2_def)\n\nlemmas bind_ev_pre = bind_ev[THEN equiv_valid_guard_imp]\n\nlemma gen_asm_ev':\n  assumes \"Q \\<Longrightarrow> equiv_valid D A B P f\"\n  shows \"equiv_valid D A B (P and K Q) f\"\n  using assms by (fastforce simp: equiv_valid_def2 equiv_valid_2_def)\n\ndeclare K_def [simp del]\n\nlemmas gen_asm_ev =\n  gen_asm_ev'[where P=\"\\<top>\", simplified]\n  gen_asm_ev'\n  gen_asm_ev'[simplified K_def, where P=\"\\<top>\", simplified]\n  gen_asm_ev'[simplified K_def]\n\ndeclare K_def [simp]\n\ntext {*\n  This is a further streamlined version that we expect to get the most from\n  automating, and for the most part, we shouldn't need to deal with the\n  extra generality of the properties above.\n*}\nabbreviation equiv_valid_inv where\n  \"equiv_valid_inv I A P f \\<equiv> equiv_valid I A A P f\"\n\nabbreviation equiv_valid_rv_inv where\n  \"equiv_valid_rv_inv I A R P f \\<equiv> equiv_valid_rv I A A R P f\"\n\nlemma get_evrv:\n  \"equiv_valid_rv_inv I A (I And A) \\<top> get\"\n  by(auto simp: equiv_valid_2_def get_def)\n\nlemma equiv_valid_rv_bind_general:\n  assumes ev1:\n  \"equiv_valid_rv I A B W P f\"\n  assumes ev2:\n  \"\\<And> rv rv'. W rv rv' \\<Longrightarrow> equiv_valid_2 I B C R (Q rv) (Q rv') (g rv) (g rv')\"\n  assumes hoare:\n  \"\\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  shows \"equiv_valid_rv I A C R P (f >>= g)\"\n  apply(rule equiv_valid_2_guard_imp)\n  apply(rule equiv_valid_2_bind_general[OF ev2])\n       apply(assumption)\n      apply(rule ev1)\n     apply(rule hoare)\n    apply(rule hoare)\n   apply(simp_all)\n  done\n\nlemma equiv_valid_rv_bind:\n  assumes ev1:\n  \"equiv_valid_rv_inv I A W P f\"\n  assumes ev2:\n  \"\\<And> rv rv'. W rv rv' \\<Longrightarrow> equiv_valid_2 I A A R (Q rv) (Q rv') (g rv) (g rv')\"\n  assumes hoare:\n  \"\\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  shows \"equiv_valid_rv_inv I A R P (f >>= g)\"\n  using assms by(blast intro: equiv_valid_rv_bind_general)\n      \nlemma modify_ev2:\n  assumes \"\\<And> s t. \\<lbrakk>I s t; A s t; P s; P' t\\<rbrakk> \\<Longrightarrow> R () () \\<and> I (f s) (f' t) \\<and> B (f s) (f' t)\"\n  shows\n  \"equiv_valid_2 I A B R P P' (modify f) (modify f')\"\n  apply(clarsimp simp: equiv_valid_2_def in_monad)\n  using assms by auto\n\nlemma put_ev2:\n  assumes \"\\<And> s t. \\<lbrakk>I s t; A s t; P s; P' t\\<rbrakk> \\<Longrightarrow> R () () \\<and> I x x' \\<and> B x x'\"\n  shows\n  \"equiv_valid_2 I A B R P P' (put x) (put x')\"\n  apply(clarsimp simp: equiv_valid_2_def in_monad)\n  using assms by auto\n\n\nlemma get_bind_ev2:\n  assumes \"\\<And> rv rv'. \\<lbrakk>I rv rv'; A rv rv'\\<rbrakk> \\<Longrightarrow> equiv_valid_2 I A B R (P and (op = rv)) (P' and (op = rv')) (f rv) (f' rv')\"\n  shows \"equiv_valid_2 I A B R P P' (get >>= f) (get >>= f')\"\n  apply(rule equiv_valid_2_guard_imp)\n  apply(rule_tac R'=\"I And A\" in equiv_valid_2_bind_general)\n       apply(rule assms, simp+)\n      apply(rule get_evrv)\n     apply(wp get_sp)+\n   by(auto)\n\n\nlemma return_ev_pre:\n  \"equiv_valid_inv I A P (return x)\"\n  apply (simp add: equiv_valid_def2 return_ev2)\n  done\n\nlemmas return_ev = return_ev_pre[where P=\\<top>]\n\nlemma fail_ev2_l:\n  \"equiv_valid_2 I A B R P P' fail f'\"\n  by(simp add: equiv_valid_2_def fail_def)\n\nlemma fail_ev2_r:\n  \"equiv_valid_2 I A B R P P' f fail\"\n  by(simp add: equiv_valid_2_def fail_def)\n\nlemma fail_ev_pre:\n  \"equiv_valid I A B P fail\"\n  apply (simp add: equiv_valid_def2 fail_ev2_l)\n  done\n\nlemmas fail_ev = fail_ev_pre[where P=\\<top>]\n\nlemma assert_ev2:\n  \"R () () \\<Longrightarrow> equiv_valid_2 I A A R P P' (assert a) (assert b)\"\n  apply(simp add: assert_def fail_ev2_l fail_ev2_r)\n  apply(blast intro: return_ev2)\n  done\n\nlemma liftE_ev:\n  \"equiv_valid I A B P f \\<Longrightarrow> equiv_valid I A B P (liftE f)\"\n  unfolding liftE_def\n  apply (rule bind_ev_general[THEN equiv_valid_guard_imp, OF return_ev _ wp_post_taut])\n  apply fastforce+ (* schematic instantiation *)\n  done\n\nlemma if_ev:\n  assumes \"b \\<Longrightarrow> equiv_valid I A B P f\"\n  assumes \"\\<not> b \\<Longrightarrow> equiv_valid I A B Q g\"\n  shows \"equiv_valid I A B (\\<lambda>s. (b \\<longrightarrow> P s) \\<and> (\\<not>b \\<longrightarrow> Q s)) (if b then f else g)\"\n  apply (clarsimp split: if_split)\n  using assms by blast\n\nlemmas if_ev_pre = equiv_valid_guard_imp[OF if_ev]\n\nlemma assert_ev_pre:\n  \"equiv_valid_inv I A P (assert b)\"\n  apply(simp add: equiv_valid_def2 assert_ev2)\n  done\n\nlemmas assert_ev = assert_ev_pre[where P=\\<top>]\n\nlemma assert_opt_ev:\n  \"equiv_valid_inv I A \\<top> (assert_opt v)\"\n  apply (simp add: assert_opt_def return_ev fail_ev\n            split: option.split)\n  done\n\nlemma assert_opt_ev2:\n  assumes \"\\<And> a a'. \\<lbrakk>v = Some a; v' = Some a'\\<rbrakk> \\<Longrightarrow> R a a'\"\n  shows \"equiv_valid_2 I A A R \\<top> \\<top> (assert_opt v) (assert_opt v')\"\n  apply (simp add: assert_opt_def return_ev fail_ev2_l fail_ev2_r\n            split: option.split)\n  apply(intro allI impI)\n  apply(rule return_ev2)\n  apply(rule assms, assumption+)\n  done\n\nlemma select_f_ev:\n  \"equiv_valid_inv I A (K (det f)) (select_f (f x))\"\n  apply (rule gen_asm_ev)\n  apply (simp add: select_f_def equiv_valid_def2 equiv_valid_2_def det_set_iff)\n  done\n\nlemma gets_evrv:\n  \"equiv_valid_rv_inv I A R (K (\\<forall>s t. I s t \\<and> A s t \\<longrightarrow> R (f s) (f t))) (gets f)\"\n  apply (auto simp: equiv_valid_2_def in_monad)\n  done\n\nlemma gets_evrv':\n  \"equiv_valid_rv_inv I A R (\\<lambda>s. (\\<forall>t. I s t \\<and> A s t \\<longrightarrow> R (f s) (f t))) (gets f)\"\n  apply (auto simp: equiv_valid_2_def in_monad)\n  done\n\nlemma gets_evrv'':\n  \"\\<forall>s t. I s t \\<and> A s t \\<and> P s \\<and> P t \\<longrightarrow> R (f s) (f t) \\<Longrightarrow> equiv_valid_rv_inv I A R P (gets f)\"\n  apply (auto simp: equiv_valid_2_def in_monad)\n  done\n\nlemma equiv_valid_rv_guard_imp:\n  \"\\<lbrakk>equiv_valid_rv I A B R P f; \\<And> s. Q s \\<Longrightarrow> P s\\<rbrakk> \\<Longrightarrow>\n   equiv_valid_rv I A B R Q f\"\n  apply(simp add: equiv_valid_2_def)\n  apply fast\n  done\n\nlemma gets_ev:\n  shows \"equiv_valid_inv I A (\\<lambda> s. \\<forall> s t. I s t \\<and> A s t \\<longrightarrow> f s = f t) (gets f)\"\n  apply (simp add: equiv_valid_def2)\n  apply (auto intro: equiv_valid_rv_guard_imp[OF gets_evrv])\n  done\n\nlemma gets_ev':\n  shows \"equiv_valid_inv I A (\\<lambda> s. \\<forall> t. I s t \\<and> A s t \\<longrightarrow> f s = f t) (gets f)\"\n  apply (simp add: equiv_valid_def2)\n  apply (auto intro: equiv_valid_rv_guard_imp[OF gets_evrv'])\n  done\n\nlemma gets_ev'':\n  \"\\<forall>s t. I s t \\<and> A s t \\<and> P s \\<and> P t \\<longrightarrow> f s = f t \\<Longrightarrow> equiv_valid_inv I A P (gets f)\"\n  apply (simp add: equiv_valid_def2)\n  apply (auto intro: equiv_valid_rv_guard_imp[OF gets_evrv''])\n  done\n\nlemma gets_the_evrv:\n  \"equiv_valid_rv_inv I A R (K (\\<forall>s t. I s t \\<and> A s t \\<longrightarrow> R (the (f s)) (the (f t)))) (gets_the f)\"\n  unfolding gets_the_def\n  apply (rule equiv_valid_rv_bind)\n    apply(rule equiv_valid_rv_guard_imp[OF gets_evrv])\n    apply simp\n   apply(rule assert_opt_ev2)\n   apply simp\n  apply wp\n  done\n\nlemma gets_the_ev:\n  \"equiv_valid_inv I A (K (\\<forall>s t. I s t \\<and> A s t \\<longrightarrow> f s = f t)) (gets_the f)\"\n  unfolding equiv_valid_def2\n  apply(rule equiv_valid_rv_guard_imp[OF gets_the_evrv])\n  by simp\n  \nlemma throwError_ev_pre:\n  \"equiv_valid_inv I A P (throwError e)\"\n  by (auto simp: throwError_def return_ev_pre)\n\nlemmas throwError_ev = throwError_ev_pre[where P=\\<top>]\n\nlemma returnOk_ev_pre:\n  \"equiv_valid_inv I A P (returnOk v)\"\n  by (auto simp: returnOk_def return_ev_pre)\n\nlemmas returnOk_ev = returnOk_ev_pre[where P=\\<top>]\n\n(* this seems restrictive, to have the same beginning and ending state relation,\n   however, one suspects that bindE is used usually only in code that doesn't\n   modify the state, so is probably OK.. We'll see *)\nlemma bindE_ev:\n  assumes reads_res_2: \"\\<And> rv. equiv_valid_inv I A (Q rv) (g rv)\"\n  assumes reads_res_1: \"equiv_valid_inv I A P' f\"\n  assumes hoare: \"\\<lbrace> P'' \\<rbrace> f \\<lbrace> Q \\<rbrace>,-\"\n  shows \"equiv_valid_inv I A (\\<lambda>s. P' s \\<and> P'' s) (f >>=E g)\"\n  unfolding bindE_def\n  apply (rule bind_ev)\n    prefer 3\n    apply(rule hoare[unfolded validE_R_def validE_def])\n   apply(simp split: sum.split add: lift_def throwError_ev)\n   apply(blast intro!: reads_res_2)\n  apply(rule reads_res_1)\n  done\n\nlemmas bindE_ev_pre = bindE_ev[THEN equiv_valid_guard_imp]\n\n(* Of course, when we know that progress is always made, we can do better *)\nlemma liftE_bindE_ev_general:\n  assumes r2: \"\\<And> val. equiv_valid I B C (Q val) (g val)\"\n  assumes r1: \"equiv_valid I A B P f\"\n  assumes hoare: \"\\<lbrace> R \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  shows \"equiv_valid I A C (\\<lambda> s. P s \\<and> R s) (liftE f >>=E g)\"\n  apply(simp add: bindE_def)\n  apply(rule_tac Q=\"\\<lambda> rv. K (\\<forall> v. rv \\<noteq> Inl v) and (\\<lambda> s. \\<forall> v. rv = Inr v \\<longrightarrow> Q v s)\" in bind_ev_general)\n    prefer 2\n    apply(rule liftE_ev)\n    apply(rule r1)\n   apply(insert r2, fastforce simp: lift_def split: sum.split simp: equiv_valid_def2 equiv_valid_2_def)[1]\n  apply(insert hoare, fastforce simp: valid_def liftE_def return_def bind_def)\n  done\n\nlemma liftE_bindE_ev:\n  assumes r2: \"\\<And> val. equiv_valid_inv I A (Q val) (g val)\"\n  assumes r1: \"equiv_valid_inv I A P f\"\n  assumes hoare: \"\\<lbrace> R \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  shows \"equiv_valid_inv I A (\\<lambda> s. P s \\<and> R s) (liftE f >>=E g)\"\n  using assms by (blast intro: liftE_bindE_ev_general)\n\nlemmas liftE_bindE_ev_pre = liftE_bindE_ev[THEN equiv_valid_guard_imp]\n\nlemma liftM_ev:\n  assumes reads_res: \"equiv_valid I A B P g\"\n  shows \"equiv_valid I A B P (liftM f g)\"\n  apply (simp add: liftM_def)\n  apply (rule bind_ev_general[THEN equiv_valid_guard_imp, OF return_ev reads_res wp_post_taut])\n  apply simp\n  done\n\nlemma liftME_ev:\n  assumes reads_res: \"equiv_valid_inv I A P g\"\n  shows \"equiv_valid_inv I A P (liftME f g)\"\n  apply(simp add: liftME_def)\n  apply (rule bindE_ev_pre[OF returnOk_ev reads_res])\n  apply (rule hoare_True_E_R)\n  apply fast\n  done\n\nlemma whenE_ev:\n  assumes a: \"b \\<Longrightarrow> equiv_valid_inv I A P m\"\n  shows \"equiv_valid_inv I A (\\<lambda>s. b \\<longrightarrow> P s) (whenE b m)\"\n  unfolding whenE_def by (auto intro: a returnOk_ev_pre)\n\nlemma whenE_throwError_bindE_ev:\n  assumes \"\\<And> rv. \\<not> b \\<Longrightarrow> equiv_valid_inv I A P (g rv)\"\n  shows \"equiv_valid_inv I A P (whenE b (throwError e) >>=E g)\"\n  apply (rule_tac Q=\"\\<lambda> rv. P and (\\<lambda> s. \\<not> b)\" in bindE_ev_pre)\n     apply (rule gen_asm_ev)\n     apply (blast intro: assms)\n    apply (rule whenE_ev)\n    apply (rule throwError_ev)\n   apply (wp whenE_throwError_wp)\n  apply simp\n  done\n\n(* FIXME: trivially generalised *)\nlemma K_bind_ev:\n  \"equiv_valid I A B P f \\<Longrightarrow> equiv_valid I A B P (K_bind f x)\"\n  by simp\n\nsubsection{* wp setup *}\n\nlemmas splits_ev[wp_split] =\n  bind_ev_pre bindE_ev_pre\n  bind_ev bindE_ev\n  if_ev_pre\n  if_ev\n\nlemmas wp_ev[wp] =\n  return_ev_pre\n  return_ev\n  liftE_ev\n  fail_ev_pre\n  fail_ev\n  assert_opt_ev\n  assert_ev\n  gets_ev\n  gets_the_ev\n  returnOk_ev_pre\n  returnOk_ev\n  throwError_ev_pre\n  throwError_ev\n  liftM_ev\n  liftME_ev\n  whenE_ev\n  K_bind_ev\n\nsubsection{* crunch setup *}\n\nlemmas pre_ev =\n  hoare_pre\n  equiv_valid_guard_imp\n\nsubsection{* Tom instantiates wpc *}\n\nlemma wpc_helper_equiv_valid:\n  \"equiv_valid D A B Q f \\<Longrightarrow> wpc_helper (P, P') (Q, Q') (equiv_valid D A B P f)\"\n  using equiv_valid_guard_imp\n  apply (simp add: wpc_helper_def)\n  apply (blast)\n  done\n\nwpc_setup \"\\<lambda>m. equiv_valid D A B Q m\" wpc_helper_equiv_valid\n\nsubsection{* More hoare-like rules *}\n\nlemma mapM_ev_pre:\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A I (m x)\"\n  assumes invariant: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> \\<lbrace> I \\<rbrace> m x \\<lbrace> \\<lambda>_. I \\<rbrace>\"\n  assumes inv_established: \"\\<And> s. P s \\<Longrightarrow> I s\"\n  shows \"equiv_valid_inv D A P (mapM m lst)\"\n  using assms\n  apply(atomize)\n  apply(rule_tac Q=I in equiv_valid_guard_imp)\n  apply(induct lst)\n    apply(simp add: mapM_Nil return_ev_pre)\n   apply(subst mapM_Cons)\n   apply(rule bind_ev_pre[where P''=\"I\"])\n    apply(rule bind_ev[OF return_ev])\n    apply fastforce\n    apply (rule wp_post_taut)\n    apply fastforce+\n  done\n\nlemma mapM_x_ev_pre:\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A I (m x)\"\n  assumes invariant: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> \\<lbrace> I \\<rbrace> m x \\<lbrace> \\<lambda>_. I \\<rbrace>\"\n  assumes inv_established: \"\\<And> s. P s \\<Longrightarrow> I s\"\n  shows \"equiv_valid_inv D A P (mapM_x m lst)\"\n  apply(subst mapM_x_mapM)\n  apply(rule bind_ev_pre[OF return_ev mapM_ev_pre])\n  apply (blast intro: reads_res invariant inv_established wp_post_taut)+\n  done\n\nlemma mapM_ev:\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A I (m x)\"\n  assumes invariant: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> \\<lbrace> I \\<rbrace> m x \\<lbrace> \\<lambda>_. I \\<rbrace>\"\n  shows \"equiv_valid_inv D A I (mapM m lst)\"\n  using assms by (auto intro: mapM_ev_pre)\n\nlemma mapM_x_ev:\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A I (m x)\"\n  assumes invariant: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> \\<lbrace> I \\<rbrace> m x \\<lbrace> \\<lambda>_. I \\<rbrace>\"\n  shows \"equiv_valid_inv D A I (mapM_x m lst)\"\n  using assms by (auto intro: mapM_x_ev_pre)\n\n(* MOVE -- proof clagged from mapM_x_mapM *)\nlemma mapME_x_mapME:\n  \"mapME_x f l = mapME f l >>=E (\\<lambda> y. returnOk ())\"\n  apply (simp add: mapME_x_def sequenceE_x_def mapME_def sequenceE_def)\n  apply (induct l, simp_all add: Let_def bindE_assoc)\n  done\n\nlemma mapME_ev_pre:\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A I (m x)\"\n  assumes invariant: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> \\<lbrace> I \\<rbrace> m x \\<lbrace> \\<lambda>_. I \\<rbrace>,-\"\n  assumes inv_established: \"\\<And> s. P s \\<Longrightarrow> I s\"\n  shows \"equiv_valid_inv D A P (mapME m lst)\"\n  using assms\n  apply(atomize)\n  apply(rule_tac Q=I in equiv_valid_guard_imp)\n  apply(induct lst)\n    apply(simp add: mapME_Nil returnOk_ev_pre)\n   apply(subst mapME_Cons)\n   apply wp\n   apply fastforce\n   apply (rule hoare_True_E_R[where P=\"\\<top>\"])\n   apply fastforce+\n  done\n\nlemma mapME_ev:\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv I A P (m x)\"\n  assumes invariant: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> \\<lbrace> P \\<rbrace> m x \\<lbrace> \\<lambda>_. P \\<rbrace>, -\"\n  shows \"equiv_valid_inv I A P (mapME m lst)\"\n  using assms by (auto intro: mapME_ev_pre)\n\nlemma mapME_x_ev_pre:\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A I (m x)\"\n  assumes invariant: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> \\<lbrace> I \\<rbrace> m x \\<lbrace> \\<lambda>_. I \\<rbrace>,-\"\n  assumes inv_established: \"\\<And> s. P s \\<Longrightarrow> I s\"\n  shows \"equiv_valid_inv D A P (mapME_x m lst)\"\n  unfolding mapME_x_mapME\n  apply (wp assms mapME_ev_pre | simp)+\n  done\n\nlemma mapME_x_ev:\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A I (m x)\"\n  assumes invariant: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> \\<lbrace> I \\<rbrace> m x \\<lbrace> \\<lambda>_. I \\<rbrace>, -\"\n  shows \"equiv_valid_inv D A I (mapME_x m lst)\"\n  using assms by (auto intro: mapME_x_ev_pre)\n\nlemma mapM_ev':\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A (K (P x)) (m x)\"\n  shows \"equiv_valid_inv D A (K (\\<forall>x\\<in>set lst. P x)) (mapM m lst)\"\n  apply(rule mapM_ev)\n  apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n  done\n\nlemma mapM_x_ev':\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A (K (P x)) (m x)\"\n  shows \"equiv_valid_inv D A (K (\\<forall>x\\<in>set lst. P x)) (mapM_x m lst)\"\n  apply(rule mapM_x_ev)\n  apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n  done\n\nlemma mapME_ev':\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A (K (P x)) (m x)\"\n  shows \"equiv_valid_inv D A (K (\\<forall>x\\<in>set lst. P x)) (mapME m lst)\"\n  apply(rule mapME_ev)\n  apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n  done\n\nlemma mapME_x_ev':\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A (K (P x)) (m x)\"\n  shows \"equiv_valid_inv D A (K (\\<forall>x\\<in>set lst. P x)) (mapME_x m lst)\"\n  apply(rule mapME_x_ev)\n  apply(rule equiv_valid_guard_imp[OF reads_res], simp+, wp)\n  done\n\nsubsection{* Rules for the specialised validity *}\n\nlemma use_spec_ev:\n  \"(\\<And>st. spec_equiv_valid st I A B P f) \\<Longrightarrow> equiv_valid I A B P f\"\n  by (simp add: equiv_valid_def)\n\nlemma drop_spec_ev:\n  \"equiv_valid I A B P f \\<Longrightarrow> spec_equiv_valid st I A B P f\"\n  by (simp add: equiv_valid_def)\n\nlemma spec_equiv_valid_guard_imp:\n  assumes reads_res: \"spec_equiv_valid_inv s' I A P' f\"\n  assumes guard_imp: \"\\<And> s. P s \\<Longrightarrow> P' s\"\n  shows \"spec_equiv_valid_inv s' I A P f\"\n  using assms\n  by (fastforce simp: spec_equiv_valid_def equiv_valid_2_def)\n\nlemma bind_spec_ev:\n  assumes reads_res_2: \"\\<And> rv s''. (rv, s'') \\<in> fst (f s') \\<Longrightarrow> spec_equiv_valid_inv s'' I A (Q rv) (g rv)\"\n  assumes reads_res_1: \"spec_equiv_valid_inv s' I A P' f\"\n  assumes hoare: \"\\<lbrace>P''\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  shows \"spec_equiv_valid_inv s' I A (\\<lambda>s. P' s \\<and> P'' s) (f >>= g)\"\n  using reads_res_1\n  apply (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def valid_def bind_def split_def)\n  apply (erule_tac x=t in allE)\n  apply clarsimp\n  apply (erule_tac x=\"(a, b)\" in ballE)\n  apply (erule_tac x=\"(ab, bb)\" in ballE)\n  apply clarsimp\n  apply (cut_tac rv=\"ab\" and s''=\"b\" in reads_res_2)\n   apply assumption\n  apply (clarsimp simp: spec_equiv_valid_def equiv_valid_2_def)\n  apply(erule_tac x=bb in allE)\n  using hoare\n  apply (fastforce simp: valid_def)+\n  done\n\nlemma bindE_spec_ev:\n  assumes reads_res_2: \"\\<And> rv s''. (Inr rv, s'') \\<in> fst (f s') \\<Longrightarrow> spec_equiv_valid_inv s'' I A (Q rv) (g rv)\"\n  assumes reads_res_1: \"spec_equiv_valid_inv s' I A P' f\"\n  assumes hoare: \"\\<lbrace>P''\\<rbrace> f \\<lbrace>Q\\<rbrace>,-\"\n  shows \"spec_equiv_valid_inv s' I A (\\<lambda>s. P' s \\<and> P'' s) (f >>=E g)\"\n  unfolding bindE_def\n  apply (rule bind_spec_ev)\n    prefer 3\n    apply(rule hoare[simplified validE_R_def validE_def])\n   apply(simp split: sum.split add: lift_def)\n   apply(rule conjI)\n    apply(fastforce simp: spec_equiv_valid_def throwError_def return_ev2)\n   apply(fastforce simp: reads_res_2)\n  apply(rule reads_res_1)\n  done\n\nlemma if_spec_ev:\n  \"\\<lbrakk> G \\<Longrightarrow> spec_equiv_valid_inv s' I A P f;\n     \\<not> G \\<Longrightarrow> spec_equiv_valid_inv s' I A P' f'\n   \\<rbrakk>  \\<Longrightarrow> spec_equiv_valid_inv s' I A (\\<lambda>s. (G \\<longrightarrow> P s) \\<and> (\\<not> G \\<longrightarrow> P' s)) (if G then f else f')\"\n  by (cases G, simp+)\n\nlemmas splits_spec_ev[wp_split] =\n  drop_spec_ev\n  spec_equiv_valid_guard_imp[OF bind_spec_ev] spec_equiv_valid_guard_imp[OF bindE_spec_ev]\n  bind_spec_ev bindE_spec_ev\n  spec_equiv_valid_guard_imp[OF if_spec_ev] if_spec_ev\n\n(* Miscellaneous rules. *)\n\nlemma assertE_ev[wp]:\n  \"equiv_valid_inv I A \\<top> (assertE b)\"\n  unfolding assertE_def\n  apply wp\n  by simp\n\nlemma equiv_valid_2_bindE:\n  assumes g: \"\\<And>rv rv'. R' rv rv' \\<Longrightarrow>\n      equiv_valid_2 D A A (E \\<oplus> R) (Q rv) (Q' rv') (g rv) (g' rv')\"\n  assumes h1: \"\\<lbrace>S\\<rbrace> f \\<lbrace>Q\\<rbrace>,-\"\n  assumes h2: \"\\<lbrace>S'\\<rbrace> f' \\<lbrace>Q'\\<rbrace>,-\"\n  assumes f: \"equiv_valid_2 D A A (E \\<oplus> R') P P' f f'\"\n  shows \"equiv_valid_2 D A A (E \\<oplus> R) (P and S) (P' and S') (f >>=E g) (f' >>=E g')\"\n  apply(unfold bindE_def)\n  apply(rule equiv_valid_2_guard_imp)\n    apply(rule_tac R'=\"E \\<oplus> R'\" and Q=\"case_sum \\<top>\\<top> Q\" and Q'=\"case_sum \\<top>\\<top> Q'\" and S=S and S'=S' in equiv_valid_2_bind)\n       apply(clarsimp simp: lift_def split: sum.splits)\n       apply(intro impI conjI allI)\n          apply(simp add: throwError_def)\n          apply(rule return_ev2)\n          apply simp\n         apply(simp)\n        apply(simp)\n       apply(fastforce intro: g)\n      apply(rule f)\n     apply(insert h1, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n    apply(insert h2, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n   by auto\n\nlemma rel_sum_comb_equals:\n  \"((op =) \\<oplus> (op =)) = (op =)\"\n  apply(rule ext)\n  apply(rule ext)\n  apply(rename_tac a b)\n  apply(case_tac a, auto)\n  done\n\ndefinition spec_equiv_valid_2_inv where\n  \"spec_equiv_valid_2_inv s I A R P P' f f' \\<equiv> \n      equiv_valid_2 I A A R (P and (op = s)) P' f f'\"\n\nlemma spec_equiv_valid_def2:\n  \"spec_equiv_valid s I A A P f =\n   spec_equiv_valid_2_inv s I A (op =) P P f f\"\n  apply(simp add: spec_equiv_valid_def spec_equiv_valid_2_inv_def)\n  done\n\nlemma drop_spec_ev2_inv:\n  \"equiv_valid_2 I A A R P P' f f' \\<Longrightarrow> \n   spec_equiv_valid_2_inv s I A R P P' f f'\"\n  apply(simp add: spec_equiv_valid_2_inv_def)\n  apply(erule equiv_valid_2_guard_imp, auto)\n  done\n\nlemma spec_equiv_valid_2_inv_guard_imp:\n  \"\\<lbrakk>spec_equiv_valid_2_inv s I A R Q Q' f f'; \\<And> s. P s \\<Longrightarrow> Q s; \\<And> s. P' s \\<Longrightarrow> Q' s\\<rbrakk> \\<Longrightarrow>\n    spec_equiv_valid_2_inv s I A R P P' f f'\"\n  by(auto simp: spec_equiv_valid_2_inv_def equiv_valid_2_def)\n\nlemma bind_spec_ev2:\n  assumes reads_res_2: \"\\<And> rv s' rv'. \\<lbrakk>(rv, s') \\<in> fst (f s); R' rv rv'\\<rbrakk> \\<Longrightarrow> spec_equiv_valid_2_inv s' I A R (Q rv) (Q' rv') (g rv) (g' rv')\"\n  assumes reads_res_1: \"spec_equiv_valid_2_inv s I A R' P P' f f'\"\n  assumes hoare: \"\\<lbrace>S\\<rbrace> f \\<lbrace>Q\\<rbrace>\"\n  assumes hoare': \"\\<lbrace>S'\\<rbrace> f' \\<lbrace>Q'\\<rbrace>\"\n  shows \"spec_equiv_valid_2_inv s I A R (P and S) (P' and S') (f >>= g) (f' >>= g')\"\n  using reads_res_1\n  apply (clarsimp simp: spec_equiv_valid_2_inv_def equiv_valid_2_def bind_def split_def)\n  apply (erule_tac x=t in allE)\n  apply clarsimp\n  apply (drule_tac x=\"(a, b)\" in bspec, assumption)\n  apply (drule_tac x=\"(ab, bb)\" in bspec, assumption)\n  apply clarsimp\n  apply (cut_tac rv=\"a\" and s'=\"b\" in reads_res_2)\n    apply assumption\n   apply assumption\n  apply (clarsimp simp: spec_equiv_valid_2_inv_def equiv_valid_2_def)\n  apply(drule_tac x=bb in spec)\n  apply clarsimp\n  using hoare hoare'\n  apply (fastforce simp: valid_def)+\n  done\n\nlemma spec_equiv_valid_2_inv_bindE:\n  assumes g: \"\\<And>rv s' rv'. \\<lbrakk>(Inr rv, s') \\<in> fst (f s); R' rv rv'\\<rbrakk> \\<Longrightarrow>\n      spec_equiv_valid_2_inv s' I A (E \\<oplus> R) (Q rv) (Q' rv') (g rv) (g' rv')\"\n  assumes h1: \"\\<lbrace>S\\<rbrace> f \\<lbrace>Q\\<rbrace>,-\"\n  assumes h2: \"\\<lbrace>S'\\<rbrace> f' \\<lbrace>Q'\\<rbrace>,-\"\n  assumes f: \"spec_equiv_valid_2_inv s I A (E \\<oplus> R') P P' f f'\"\n  shows \"spec_equiv_valid_2_inv s I A (E \\<oplus> R) (P and S) (P' and S') (f >>=E g) (f' >>=E g')\"\n  apply(unfold bindE_def)\n  apply(rule spec_equiv_valid_2_inv_guard_imp)\n    apply(rule_tac R'=\"E \\<oplus> R'\" and Q=\"case_sum \\<top>\\<top> Q\" and Q'=\"case_sum \\<top>\\<top> Q'\" and S=S and S'=S' in bind_spec_ev2)\n       apply(clarsimp simp: lift_def split: sum.splits)\n       apply(intro impI conjI allI)\n          apply(simp add: throwError_def)\n          apply(rule drop_spec_ev2_inv[OF return_ev2])\n          apply simp\n         apply(simp)\n        apply(simp)\n       apply(fastforce intro: g)\n      apply(rule f)\n     apply(insert h1, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n    apply(insert h2, fastforce simp: valid_def validE_R_def validE_def split: sum.splits)[1]\n   by auto\n\nlemma trancl_subset_equivalence:\n  \"\\<lbrakk>(a, b) \\<in> r'\\<^sup>+; \\<forall>x. (a, x)\\<in>r'\\<^sup>+ \\<longrightarrow> Q x; \\<forall>x y. Q x \\<longrightarrow> ((y, x) \\<in> r) = ((y, x) \\<in> r')\\<rbrakk> \\<Longrightarrow> (a, b) \\<in> r\\<^sup>+\"\n  apply(induct a b rule: trancl.induct)\n   apply(blast)\n  apply(simp)\n  apply(rule_tac b=b in trancl_into_trancl)\n   apply(simp)\n  apply(erule_tac x=c in allE)\n  apply(subgoal_tac \"(a, c) \\<in> r'\\<^sup>+\")\n   apply(auto)\n   done\n\nlemma equiv_valid_rv_gets_compD:\n  \"equiv_valid_rv_inv I A R P (gets (f \\<circ> g)) \\<Longrightarrow>\n   equiv_valid_rv_inv I A (\\<lambda> rv rv'. R (f rv) (f rv')) P (gets g)\"\n  apply(clarsimp simp: equiv_valid_2_def gets_def bind_def return_def get_def)\n  done\n\n\nlemma liftE_ev2:\n  \"equiv_valid_2 I A B R P P' f f' \\<Longrightarrow>\n   equiv_valid_2 I A B (E \\<oplus> R) P P' (liftE f) (liftE f')\"\n  apply(clarsimp simp: liftE_def equiv_valid_2_def bind_def return_def)\n  apply fastforce\n  done\n\nlemma whenE_spec_ev2_inv:\n  assumes a: \"b \\<Longrightarrow> spec_equiv_valid_2_inv s I A R P P' m m'\"\n  assumes r: \"\\<And> x. R x x\"\n  shows \"spec_equiv_valid_2_inv s I A R P P' (whenE b m) (whenE b m')\"\n  unfolding whenE_def \n  apply (auto intro: a simp: returnOk_def intro!: drop_spec_ev2_inv[OF return_ev2] intro: r)\n  done\n\nlemma whenE_spec_ev:\n  assumes a: \"b \\<Longrightarrow> spec_equiv_valid_inv s I A P m\"\n  shows \"spec_equiv_valid_inv s I A P  (whenE b m) \"\n  unfolding whenE_def \n  apply (auto intro: a simp: returnOk_def intro!: drop_spec_ev[OF return_ev_pre])\n  done\n\n\nlemma spec_equiv_valid_2_inv_by_spec_equiv_valid:\n  \"\\<lbrakk>spec_equiv_valid s I A A P f; P' = P; f' = f;\n    (\\<And> a. R a a)\\<rbrakk> \\<Longrightarrow>\n       spec_equiv_valid_2_inv s I A R P P' f f'\"\n  apply(clarsimp simp: spec_equiv_valid_def spec_equiv_valid_2_inv_def)\n  apply(fastforce simp: equiv_valid_2_def)\n  done\n\nlemma mapM_ev'':\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A (P x) (m x)\"\n  assumes inv: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> \\<lbrace> \\<lambda>s. \\<forall>x\\<in>set lst. P x s \\<rbrace> m x \\<lbrace> \\<lambda>_ s. \\<forall>x\\<in>set lst. P x s \\<rbrace>\"\n  shows \"equiv_valid_inv D A (\\<lambda> s. \\<forall>x\\<in>set lst. P x s) (mapM m lst)\"\n  apply(rule mapM_ev)\n  apply(rule equiv_valid_guard_imp[OF reads_res]; simp)\n  apply(wpsimp wp: inv)\n  done\n\nlemma mapM_x_ev'':\n  assumes reads_res: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> equiv_valid_inv D A (P x) (m x)\"\n  assumes inv: \"\\<And> x. x \\<in> set lst \\<Longrightarrow> \\<lbrace> \\<lambda>s. \\<forall>x\\<in>set lst. P x s \\<rbrace> m x \\<lbrace> \\<lambda>_ s. \\<forall>x\\<in>set lst. P x s \\<rbrace>\"\n  shows \"equiv_valid_inv D A (\\<lambda> s. \\<forall>x\\<in>set lst. P x s) (mapM_x m lst)\"\n  apply(rule mapM_x_ev)\n  apply(rule equiv_valid_guard_imp[OF reads_res]; simp)\n  apply(wpsimp wp: inv)\n  done\n\nlemma catch_ev[wp]:\n  assumes ok:\n    \"equiv_valid I A A P f\"\n  assumes err:\n    \"\\<And> e. equiv_valid I A A (E e) (handler e)\" \n  assumes hoare:\n    \"\\<lbrace> P \\<rbrace> f -, \\<lbrace> E \\<rbrace>\"\n  shows\n  \"equiv_valid I A A P (f <catch> handler)\"\n  apply(simp add: catch_def)\n  apply (wp err ok | wpc | simp)+\n   apply(insert hoare[simplified validE_E_def validE_def])[1]\n   apply(simp split: sum.splits)\n  by simp\n\nlemma equiv_valid_rv_trivial:\n  assumes inv: \"\\<And> P. \\<lbrace> P \\<rbrace> f \\<lbrace> \\<lambda>_. P \\<rbrace>\"\n  shows \"equiv_valid_rv_inv I A \\<top>\\<top> \\<top> f\"\n  by(auto simp: equiv_valid_2_def dest: state_unchanged[OF inv])\n\nlemma equiv_valid_2_trivial:\n  assumes inv: \"\\<And> P. \\<lbrace> P \\<rbrace> f \\<lbrace> \\<lambda>_. P \\<rbrace>\"\n  assumes inv': \"\\<And> P. \\<lbrace> P \\<rbrace> f' \\<lbrace> \\<lambda>_. P \\<rbrace>\"\n  shows \"equiv_valid_2 I A A \\<top>\\<top> \\<top> \\<top> f f'\"\n  by(auto simp: equiv_valid_2_def dest: state_unchanged[OF inv] state_unchanged[OF inv'])\n\nlemma gen_asm_ev2_r:\n  \"\\<lbrakk>P' \\<Longrightarrow> equiv_valid_2 I A B R P Q f f'\\<rbrakk> \\<Longrightarrow>\n   equiv_valid_2 I A B R P  (Q and (K P')) f f'\"\n  apply(fastforce simp: equiv_valid_2_def)\n  done\n\nlemma gen_asm_ev2_l:\n  \"\\<lbrakk>P \\<Longrightarrow> equiv_valid_2 I A B R Q P' f f'\\<rbrakk> \\<Longrightarrow>\n   equiv_valid_2 I A B R (Q and (K P)) P' f f'\"\n  apply(fastforce simp: equiv_valid_2_def)\n  done\n\nlemma gen_asm_ev2_r':\n  \"\\<lbrakk>P' \\<Longrightarrow> equiv_valid_2 I A B R P \\<top> f f'\\<rbrakk> \\<Longrightarrow>\n   equiv_valid_2 I A B R P (\\<lambda>s. P') f f'\"\n  apply(fastforce simp: equiv_valid_2_def)\n  done\n\nlemma gen_asm_ev2_l':\n  \"\\<lbrakk>P \\<Longrightarrow> equiv_valid_2 I A B R \\<top> P' f f'\\<rbrakk> \\<Longrightarrow>\n   equiv_valid_2 I A B R (\\<lambda>s. P) P' f f'\"\n  apply(fastforce simp: equiv_valid_2_def)\n  done\n\nlemma equiv_valid_rv_liftE_bindE:\n  assumes ev1:\n  \"equiv_valid_rv_inv I A W P f\"\n  assumes ev2:\n  \"\\<And> rv rv'. W rv rv' \\<Longrightarrow> equiv_valid_2 I A A R (Q rv) (Q rv') (g rv) (g rv')\"\n  assumes hoare:\n  \"\\<lbrace> P \\<rbrace> f \\<lbrace> Q \\<rbrace>\"\n  shows \"equiv_valid_rv_inv I A R P ((liftE f) >>=E g)\"\n  apply(unfold bindE_def)\n  apply(rule_tac Q=\"\\<lambda> rv. K (\\<forall> v. rv \\<noteq> Inl v) and (\\<lambda> s. \\<forall> v. rv = Inr v \\<longrightarrow> Q v s)\" in equiv_valid_rv_bind)\n    apply(rule_tac E=\"dc\" in equiv_valid_2_liftE)\n    apply(rule ev1)\n   apply(clarsimp simp: lift_def split: sum.split)\n   apply(insert ev2, fastforce simp: equiv_valid_2_def)[1]\n  apply(insert hoare, clarsimp simp: valid_def liftE_def bind_def return_def split_def)\n  done\n\nlemma if_evrv:\n  assumes \"b \\<Longrightarrow> equiv_valid_rv_inv I A R P f\"\n  assumes \"\\<not> b \\<Longrightarrow> equiv_valid_rv_inv I A R Q g\"\n  shows \"equiv_valid_rv_inv I A R (\\<lambda>s. (b \\<longrightarrow> P s) \\<and> (\\<not>b \\<longrightarrow> Q s)) (if b then f else g)\"\n  apply (clarsimp split: if_split)\n  using assms by blast\n\nend\n", "meta": {"author": "SEL4PROJ", "repo": "jormungand", "sha": "bad97f9817b4034cd705cd295a1f86af880a7631", "save_path": "github-repos/isabelle/SEL4PROJ-jormungand", "path": "github-repos/isabelle/SEL4PROJ-jormungand/jormungand-bad97f9817b4034cd705cd295a1f86af880a7631/case_study/l4v/lib/EquivValid.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526514141571, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.3004927189823417}}
{"text": "section \\<open>Single-Invocation Corrrectness\\<close>\n\ntheory single_invocation_correctness\n  imports execution_invariants_s fixedpoints execution_invariants invContext_simps\n    state_monotonicGrowth_invariants\nbegin\n\n\ntext \\<open>This theory includes techniques to prove that a program is correct in the single-invocId semantics.\\<close>\n\ntext \\<open>\n  Start with initial state,\n  \n  then steps\n  \n  finally return and last check\n  \n  somehow automated\n\n\\<close>\n\n\nfun updateHb where\n  updateHb_nil: \"updateHb hb vis [] = hb\"\n| updateHb_cons[simp del]: \"updateHb hb vis (c#cs) = updateHb (hb \\<union> vis \\<times> {c}) (insert c vis) cs\"\n\nlemma updateHb_single: \"updateHb hb vis [c] = hb \\<union> vis \\<times> {c}\"\n  by (simp add: updateHb_cons)\n\nlemma updateHb_chain: \n  assumes \"vis' = set cs \\<union> vis\"\n  shows \"updateHb (updateHb hb vis cs) vis' [c] = updateHb hb vis (cs@[c])\"\nusing assms apply (induct cs arbitrary: hb vis vis' c )\n  by (fastforce simp add:  updateHb_cons)+\n\nlemma updateHb_simp1:\n  assumes \"x \\<notin> set cs\"\n  shows \"(x,y) \\<in> updateHb hb vis cs \\<longleftrightarrow> ((x,y) \\<in> hb \\<or> x\\<in>vis \\<and> y \\<in> set cs)\"\n  using assms proof (induct cs arbitrary: hb vis)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a cs)\n  then show ?case \n    by (auto simp add: updateHb_cons)\nqed\n\n\nlemma updateHb_simp2:\n  assumes \"y \\<notin> set cs\"\n  shows \"(x,y) \\<in> updateHb hb vis cs \\<longleftrightarrow> (x,y) \\<in> hb\"\n  using assms proof (induct cs arbitrary: hb vis)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a cs)\n  then show ?case \n    by (auto simp add: updateHb_cons)\nqed\n\nlemma updateHb_in_vis:\n  assumes \n    \"x\\<in>vis\"\n    and \"y\\<in>set cs\"\n   shows \"(x,y) \\<in> updateHb hb vis cs\"\n  using assms proof (induct cs arbitrary: hb vis)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a cs)\n  then show ?case \n    apply (auto simp add: updateHb_cons  )\n    by (metis UnI2 insert_is_Un mem_Sigma_iff singletonI updateHb_simp2)\nqed\n\nlemma updateHb_simp3:\n  assumes \n    \"cs!i = x\"\n    and \"cs!j = y\"\n    and \"i<j\"\n    and \"j<length cs\"\n   shows \"(x,y) \\<in> updateHb hb vis cs\"\n  using assms proof (induct cs arbitrary: hb vis i j)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a cs)\n  then show ?case \n    apply (auto simp add: updateHb_cons in_set_conv_nth nth_Cons' )\n    by (simp add: updateHb_in_vis)\nqed\n\nlemma updateHb_simp_distinct:\n  assumes \n    \"distinct cs\"\n  shows \"(x,y) \\<in> updateHb hb vis cs \n  \\<longleftrightarrow> ((x, y)\\<in>hb \\<or> x\\<in>vis \\<and> y\\<in>set cs \\<or> (\\<exists>i j. cs!i=x \\<and> cs!j=y \\<and> i < j \\<and> j < length cs))\"\n  using assms proof (induct cs arbitrary: hb vis)\n  case Nil\n  then show ?case by simp\nnext\n  case (Cons a cs)\n\n  have IH:\n    \"(x,y) \\<in> updateHb (hb \\<union> vis \\<times> {a}) (insert a vis) cs\n\\<longleftrightarrow> ((x, y)\\<in>(hb \\<union> vis \\<times> {a}) \\<or> x\\<in>(insert a vis) \\<and> y\\<in>set cs \\<or> (\\<exists>i j. cs!i=x \\<and> cs!j=y \\<and> i < j \\<and> j < length cs))\"\n    apply (rule Cons) using Cons.prems by auto\n\n  show ?case \n    apply (auto simp add: updateHb_cons IH )\n    apply (metis One_nat_def in_set_conv_nth list.sel(3) not_less_eq nth_Cons_0 nth_Cons_pos nth_tl zero_less_Suc)\n    apply (metis One_nat_def Suc_mono diff_Suc_1 nth_Cons_Suc)\n    apply (metis One_nat_def Suc_less_eq Suc_pred nat_neq_iff not_less_zero nth_Cons')\n    by (metis One_nat_def diff_Suc_1 gr_implies_not0 less_Suc_eq_0_disj nth_Cons')\nqed\n\n\nlemma updateHb_simp_distinct2:\n  shows \"(x,y) \\<in> updateHb hb vis cs \n  \\<longleftrightarrow> ((x, y)\\<in>hb \n      \\<or> x\\<in>vis \\<and> y\\<in>set cs \n      \\<or> before_in_list cs x y)\"\nproof (induct cs arbitrary: hb vis)\n  case Nil\n  then show ?case by auto\nnext\ncase (Cons a cs)\n  show ?case \n    by (auto simp add: updateHb_cons before_in_list_cons updateHb_simp2 Cons.hyps before_in_list_contains_r)\nqed\n\n\nlemma updateHb_simp_split:\n\"updateHb hb vis cs = hb \\<union> updateHb {} vis cs\"\nproof (induct cs arbitrary: hb vis)\n  case Nil\n  then show ?case \n    by simp\nnext\n  case (Cons a cs)\n\n  have \"updateHb hb vis (a # cs) \n      = updateHb (hb \\<union> vis \\<times> {a}) (insert a vis) cs\"\n    by (simp add: updateHb_cons)\n  also have \"... = (hb \\<union> vis \\<times> {a}) \\<union> updateHb {} (insert a vis) cs\"\n    by (meson Cons.hyps)\n  also have \"... = hb \\<union> updateHb (vis \\<times> {a}) (insert a vis) cs\"\n    using Cons.hyps by blast\n  also have \"... = hb \\<union> updateHb {} vis (a # cs) \"\n    by (simp add: updateHb_cons)\n  finally show ?case .\nqed\n\nlemma snd_updateHb:\n\"snd ` updateHb hb vis cs \\<subseteq> snd ` hb \\<union> set cs\"\n  by (smt UnI1 UnI2 image_eqI image_subset_iff prod.collapse updateHb_simp2)\n\nlemma snd_updateHb2:\n\"snd ` updateHb {} vis cs \\<subseteq> set cs\"\n  using snd_updateHb by fastforce\n\n  \n\n\nabbreviation invariant_all' :: \"('proc, 'ls, 'op, 'any) state \\<Rightarrow> bool\" where\n\"invariant_all' state \\<equiv>  invariant (prog state) (invContext' state)\"\n\n\n\nlemma use_map_le:\n  assumes \"m x \\<triangleq> y\" and \"m  \\<subseteq>\\<^sub>m m'\"\n  shows \"m' x \\<triangleq> y\"\n  using assms\n  by (metis domI map_le_def) \n\nlemma has_invocOp_forever:\n  assumes steps: \"S ~~ (i, trace) \\<leadsto>\\<^sub>S* S'\"\n    and \"invocOp S i \\<triangleq> info\"\n  shows \"invocOp S' i \\<triangleq> info\"\n\n  using assms proof (induct rule: step_s_induct)\n  case initial\n  then show ?case by auto\nnext\n  case (step tr S' a S'')\n  then have i1: \"invocOp S i \\<triangleq> info\" and  i2: \"invocOp S' i \\<triangleq> info\"\n    by auto\n\n  from \\<open>S' ~~ (i, a) \\<leadsto>\\<^sub>S S''\\<close>\n  show ?case\n  proof (induct rule: step_s.cases)\n    case (local C s ls f ls')\n    then show ?case using i2 by (auto simp add: step_s.simps state_monotonicGrowth_def elim: use_map_le )\n\n  next\n    case (newId C s ls f ls' uid)\n    then show ?case using i2 by (auto simp add: step_s.simps state_monotonicGrowth_def elim: use_map_le )\n  next\n    case (beginAtomic C s ls f ls' t C' C'' vis vis' )\n    then show ?case using i2 state_monotonicGrowth_invocOp[OF \\<open>state_monotonicGrowth s C C'\\<close>]\n      by (auto simp add: step_s.simps state_monotonicGrowth_def elim: use_map_le )\n  next\n    case (endAtomic C s ls f ls' t C' valid)\n    then show ?case using i2 by (auto simp add: step_s.simps state_monotonicGrowth_def elim: use_map_le )\n  next\n    case (dbop C s ls f Op  ls' t c res vis)\n    then show ?case using i2 by (auto simp add: step_s.simps state_monotonicGrowth_def elim: use_map_le )\n  next\n    case (invocation C s procName  initState impl C' C'' valid)\n    then show ?case using i2 by (auto simp add: step_s.simps state_monotonicGrowth_def elim: use_map_le )\n  next\n    case (return C s ls f res C' valid)\n    then show ?case using i2 by (auto simp add: step_s.simps state_monotonicGrowth_def elim: use_map_le )\n  qed\n\nqed\n\n\nlemma has_invocOp_afterOneStep:\n  assumes step: \"S ~~ (i, a) \\<leadsto>\\<^sub>S S'\"\n    and wf: \"state_wellFormed_s S i\"\n  shows \"invocOp S' i \\<noteq> None\"   \n  using step wf by (auto simp add: step_s.simps wf_s_localState_to_invocOp2,\n    meson state_monotonicGrowth_invocOp wf_s_localState_to_invocOp2)\n\n\n\nlemma has_invocOp_afterStart:\n  assumes steps: \"S ~~ (i, trace) \\<leadsto>\\<^sub>S* S'\"\n    and notEmpty: \"trace \\<noteq> []\"\n    and wf: \"state_wellFormed_s S i\"\n  shows \"invocOp S' i \\<noteq> None\"   \n  using steps notEmpty wf proof (induct rule: step_s_induct)\n  case initial\n  then show ?case\n    by simp  \nnext\n  case (step tr S a S')\n  have \"state_wellFormed_s S i\"\n    using local.wf state_wellFormed_s_def step.step steps_s_append by blast \n\n  from \\<open>S ~~ (i, a) \\<leadsto>\\<^sub>S S'\\<close> and \\<open>state_wellFormed_s S i\\<close>\n  show ?case \n    by (rule has_invocOp_afterOneStep)\nqed\n\n\nlemma invocations_only_in_beginning:\n  assumes steps: \"S ~~ (i, trace) \\<leadsto>\\<^sub>S* S'\"\n    and wf: \"state_wellFormed_s S i\"\n    and notStarted: \"invocOp S i = None\"\n    and traceLen: \"j < length trace\"\n  shows \"isAInvoc (fst (trace ! j)) \\<longleftrightarrow> j = 0\"\nproof -\n\n  from steps\n  obtain S_mid where \"S ~~ (i, take j trace) \\<leadsto>\\<^sub>S* S_mid\" and \"S_mid ~~ (i, drop j trace) \\<leadsto>\\<^sub>S* S'\"\n    using steps_s_append_simp by force\n\n\n  obtain Sa where firstStep: \"S ~~ (i, hd trace) \\<leadsto>\\<^sub>S Sa\" and afterFirstStep: \"Sa ~~ (i, tl trace) \\<leadsto>\\<^sub>S* S'\"\n    by (metis Cons_nth_drop_Suc append.assoc append_take_drop_id hd_Cons_tl snoc_eq_iff_butlast steps steps_s_cons_simp traceLen)\n\n  with notStarted\n  have startsWithInvoc: \"isAInvoc (fst (hd trace))\"\n    by (auto simp add: step_s.simps isAInvoc_def local.wf wf_s_localState_to_invocOp)\n\n\n  {\n    assume \"j = 0\"\n    then have \"isAInvoc (fst (trace ! j))\" \n      using startsWithInvoc hd_drop_conv_nth traceLen by force \n  }\n  moreover\n  {\n    assume \"j \\<noteq> 0\"\n\n    from afterFirstStep\n    obtain Sc where steps_until_after_j: \"Sa ~~ (i, take j (tl trace)) \\<leadsto>\\<^sub>S* Sc\"\n      by (metis append_take_drop_id steps_s_append_simp)\n\n\n\\<comment> \\<open>get Sb so that S Sa Sb S\\<close>\n    from steps_until_after_j\n    have \"Sa ~~ (i, (take (j-1) (tl trace))@[trace!j]) \\<leadsto>\\<^sub>S* Sc\"\n      by (metis \\<open>j \\<noteq> 0\\<close> drop_Nil drop_eq_Nil hd_drop_conv_nth leD take_eq_Nil take_hd_drop take_tl tl_append2 tl_take traceLen)\n    from this    \n    obtain Sb \n      where steps1: \"Sa ~~ (i, take (j-1) (tl trace)) \\<leadsto>\\<^sub>S* Sb\"\n        and step_j: \"Sb ~~ (i, trace ! j) \\<leadsto>\\<^sub>S Sc\"\n      by (auto simp add: steps_s_append_simp steps_s_single)\n\n    have \"invocOp Sa i \\<noteq> None\"\n      using firstStep has_invocOp_afterOneStep local.wf by blast  \n\n    then have \"invocOp Sb i \\<noteq> None\"\n      using has_invocOp_forever steps1 by blast\n\n    with step_j \n    have \"\\<not>isAInvoc (fst (trace ! j))\" \n      by (auto simp add: step_s.simps isAInvoc_def)\n  }\n  ultimately\n  show \"isAInvoc (fst (trace ! j)) \\<longleftrightarrow> j = 0\"\n    by blast\nqed    \n\nlemma initialState_noTxns1:\n  assumes initS: \"S \\<in> initialStates program i\"\n  shows \"txStatus S tx \\<noteq> Some Uncommitted\"\n  using initS by (auto simp add: initialStates_def)\n\nlemma initialState_noTxns2:\n  assumes initS: \"S \\<in> initialStates program i\"\n  shows \"currentTx S i' = None\"\n  using initS by (auto simp add: initialStates_def,\n      meson option.exhaust wellFormed_currentTx_unique_h(2))\n\n\nlemma steps_s_noOtherTx:\n  assumes steps: \"initS ~~ (i, trace) \\<leadsto>\\<^sub>S* S_fin\"\n    and initS: \"initS \\<in> initialStates program i\"\n    and \"i' \\<noteq> i\"\n  shows \"currentTx S_fin i' = None\"\n  using steps proof (induct rule: step_s_induct)\n  case initial\n  from initS\n  show \"currentTx initS i' = None\"\n    using initialState_noTxns2 by auto\n\nnext\n  case (step tr S a S')\n\n\n  from \\<open>S ~~ (i, a) \\<leadsto>\\<^sub>S S'\\<close> \n  show ?case \n    using \\<open>i' \\<noteq> i\\<close> by (auto simp add: step_s.simps \\<open>currentTx S i' = None\\<close>,\n        (meson option.exhaust wellFormed_currentTx_unique_h(2))+)\nqed\n\nlemma state_wellFormed_combine1:\n  assumes \"state_wellFormed S\"\n  and \"S ~~ (i, a) \\<leadsto> S'\"\n  and \"a\\<noteq>ACrash\"\nshows \"state_wellFormed S'\"\n  using \\<open>state_wellFormed S\\<close> proof (rule state_wellFormed_combine)\n  from \\<open>S ~~ (i, a) \\<leadsto> S'\\<close>\n  show \"S ~~ [(i,a)] \\<leadsto>* S'\"\n    by (simp add: steps_single)\n  show \"\\<And>ia. (ia, ACrash) \\<notin> set [(i, a)]\"\n    using \\<open>a\\<noteq>ACrash\\<close> by simp\nqed\n\nlemma state_wellFormed_combine_s1:\n  assumes \"state_wellFormed S\"\n  and \"S ~~ (i, a) \\<leadsto>\\<^sub>S S'\"\nshows \"state_wellFormed S'\"\nproof -\n\nfrom \\<open>S ~~ (i, a) \\<leadsto>\\<^sub>S S'\\<close> \n  show \"state_wellFormed S'\"\n  proof (induct rule: step_s.cases)\n    case (local C s ls f ok ls')\n    then have \"S ~~ (i, ALocal ok) \\<leadsto> S'\"\n      by (auto simp add: step.simps)\n    with \\<open>state_wellFormed S\\<close> show ?case \n      by (rule state_wellFormed_combine1, simp)\n  next\n    case (newId C s ls f ls' uid uidv ls'')\n    then have \"S ~~ (i, ANewId uidv) \\<leadsto> S'\"\n      by (auto simp add: step.simps)\n    with \\<open>state_wellFormed S\\<close> show ?case \n      by (rule state_wellFormed_combine1, simp)\n  next\n    case (beginAtomic C s ls f ls' t C' vis vis' newTxns )\n    then show ?case \n      by blast\n  next\n    case (endAtomic C s ls f ls' t C' valid)\n    then have \"S ~~ (i, AEndAtomic) \\<leadsto> S'\"\n      by (auto simp add: step.simps)\n    with \\<open>state_wellFormed S\\<close> show ?case \n      by (rule state_wellFormed_combine1, simp)\n  next\n    case (dbop C s ls f Op ls' t c res vis)\n    then have \"S ~~ (i, ADbOp c Op res) \\<leadsto> S'\"\n      by (auto simp add: step.simps)\n    with \\<open>state_wellFormed S\\<close> show ?case \n      by (rule state_wellFormed_combine1, simp)\n  next\n    case (invocation C s proc initState impl C' C'' valid)\n    then have \"C' ~~ (i, AInvoc proc) \\<leadsto> C''\"\n      by (auto simp add: step.simps,\n        insert wf_localState_to_invocOp, blast+)\n\n    then show ?case\n      using \\<open>state_wellFormed C'\\<close> \\<open>S' = C''\\<close> state_wellFormed_combine1 by blast\n  next\n    case (return C s ls f res C' valid)\n    then have \"S ~~ (i, AReturn res) \\<leadsto> S'\"\n      by (auto simp add: step.simps)\n    with \\<open>state_wellFormed S\\<close> show ?case \n      by (rule state_wellFormed_combine1, simp)\n  qed\nqed\n\nlemma committedCalls_allCommitted:\n  assumes wf: \"state_wellFormed S\"\n    and noUncommitted: \"\\<And>t. txStatus S t \\<noteq> Some Uncommitted\"\n  shows \"committedCalls S = dom (calls S)\"\nproof (auto simp add: committedCallsH_def isCommittedH_def )\n\n  \n\n  show \"\\<exists>y. calls S x \\<triangleq> y\"\n    if c0: \"callOrigin S x \\<triangleq> tx\"\n      and c1: \"txStatus S tx \\<triangleq> Committed\"\n    for  x tx\n    using that  by (simp add: domD domIff local.wf wellFormed_callOrigin_dom3)\n\n  \n\n  show \"\\<exists>tx. callOrigin S x \\<triangleq> tx \\<and> txStatus S tx \\<triangleq> Committed\"\n    if c0: \"calls S x \\<triangleq> y\"\n    for  x y\n  proof - \n    obtain tx where \"callOrigin S x \\<triangleq> tx\"\n      using c0 local.wf wellFormed_callOrigin_dom3 by force\n\n    moreover have \"txStatus S tx \\<triangleq> Committed\"\n      by (metis (full_types) \\<open>callOrigin S x \\<triangleq> tx\\<close> domD domIff local.wf noUncommitted txStatus.exhaust wf_no_txStatus_origin_for_nothing)\n\n\n    ultimately show \"\\<exists>tx. callOrigin S x \\<triangleq> tx \\<and> txStatus S tx \\<triangleq> Committed\"\n      by blast\n  qed\nqed\n\nlemma invContextH_same_allCommitted:\n  assumes  wf1: \"\\<And>c. (state_calls c = None) \\<longleftrightarrow> (state_callOrigin c = None)\"\n    and wf2: \"\\<And>c tx. state_callOrigin c \\<triangleq> tx \\<Longrightarrow> state_txStatus tx \\<noteq> None\"\n    and wf3: \"\\<And>a b. (a, b) \\<in> state_happensBefore \\<Longrightarrow> state_calls a \\<noteq> None\"\n    and wf4: \"\\<And>a b. (a, b) \\<in> state_happensBefore \\<Longrightarrow> state_calls b \\<noteq> None\"\n    and wf5: \"\\<And>c. (state_txOrigin c = None) \\<longleftrightarrow> (state_txStatus c = None)\"\n    and noUncommitted: \"\\<And>t. state_txStatus t \\<noteq> Some Uncommitted\"\n  shows \"invContextH state_callOrigin state_txOrigin state_txStatus state_happensBefore state_calls state_knownIds state_invocOp state_invocRes\n       = invContextH2 state_callOrigin state_txOrigin state_txStatus state_happensBefore state_calls state_knownIds state_invocOp state_invocRes\"\nproof (auto simp add: invContextH_def invContextH2_def\n  committedCallsH_def isCommittedH_def restrict_map_def restrict_relation_def\n   intro!: ext)\n  show \"\\<And>x. \\<forall>tx. state_callOrigin x \\<triangleq> tx \\<longrightarrow> state_txStatus tx \\<noteq> Some Committed \\<Longrightarrow> None = state_calls x\"\n    by (metis (full_types) noUncommitted option.exhaust_sel txStatus.exhaust wf1 wf2)\n  show \"\\<And>a b. (a, b) \\<in> state_happensBefore \\<Longrightarrow> \\<exists>tx. state_callOrigin a \\<triangleq> tx \\<and> state_txStatus tx \\<triangleq> Committed\"\n    by (metis (full_types) noUncommitted option.exhaust txStatus.exhaust wf1 wf2 wf3)\n  show \"\\<And>a b. (a, b) \\<in> state_happensBefore \\<Longrightarrow> \\<exists>tx. state_callOrigin b \\<triangleq> tx \\<and> state_txStatus tx \\<triangleq> Committed\"\n    by (metis (full_types) noUncommitted option.exhaust txStatus.exhaust wf1 wf2 wf4)\n  show \"\\<And>x. \\<forall>tx. state_callOrigin x \\<triangleq> tx \\<longrightarrow> state_txStatus tx \\<noteq> Some Committed \\<Longrightarrow> None = state_callOrigin x\"\n    by (metis (full_types) noUncommitted option.exhaust_sel txStatus.exhaust wf2)\n  show \"\\<And>x. state_txStatus x \\<noteq> Some Committed \\<Longrightarrow> None = state_txOrigin x\"\n    by (metis noUncommitted option.exhaust_sel txStatus.exhaust wf5)\nqed\n\nlemmas invContextH_same_allCommitted' = invContextH_same_allCommitted[simplified invContextH2_def]\n\n\n\nlemma invContext_same_allCommitted:\n  assumes  wf: \"state_wellFormed S\"\n    and noUncommitted: \"\\<And>t. txStatus S t \\<noteq> Some Uncommitted\"\n  shows \"invContext S\n       = invContext' S\"\nproof (rule invContextH_same_allCommitted)\n  show \"\\<And>c. (calls S c = None) = (callOrigin S c = None)\"\n  using local.wf wellFormed_callOrigin_dom3 by blast\n    show \"\\<And>c tx. callOrigin S c \\<triangleq> tx \\<Longrightarrow> txStatus S tx \\<noteq> None\"\n      by (simp add: local.wf wellFormed_state_callOrigin_txStatus)\n   show \"\\<And>a b. (a, b) \\<in> happensBefore S \\<Longrightarrow> calls S a \\<noteq> None\"\n     by (simp add: local.wf wellFormed_happensBefore_calls_l)\n   show \"\\<And>a b. (a, b) \\<in> happensBefore S \\<Longrightarrow> calls S b \\<noteq> None\"\n     by (simp add: local.wf wellFormed_happensBefore_calls_r)\n   show \"\\<And>c. (txOrigin S c = None) = (txStatus S c = None)\"\n     by (simp add: local.wf wf_transaction_status_iff_origin)\n   show \"\\<And>t. txStatus S t \\<noteq> Some Uncommitted\"\n     using noUncommitted by blast\n qed\n\nlemmas invContext_same_allCommitted' = invContext_same_allCommitted[simplified invContextH2_def]\n\n\nlemma wf_localState_currentProc_m:\n  assumes \"S ~~ tr \\<leadsto>* S'\"\n    and \"(localState S i = None \\<longleftrightarrow> currentProc S i = None)\"\n  shows \"(localState S' i = None \\<longleftrightarrow> currentProc S' i = None)\"\n  using assms proof (induct rule: steps_induct)\n  case initial\n  then show ?case by (simp add: initialState_def)\nnext\n  case (step S' tr a S'')\n  then show ?case  by (auto simp add: step.simps split: if_splits)\nqed\n\n\nlemma wf_localState_currentProc:\n  assumes \"state_wellFormed S\"\n  shows \"localState S i = None \\<longleftrightarrow> currentProc S i = None\"\n  using assms proof (induct rule: wellFormed_induct)\n  case initial\n  then show ?case by (simp add: initialState_def)\nnext\n  case (step t a s)\n  then show ?case \n    by (auto simp add: step.simps split: if_splits)\nqed\n\n\n\n\n\n\nlemma show_exists_state:\n  fixes P :: \"('proc, 'ls, 'op, 'any)state \\<Rightarrow> bool\"\n  assumes \"\\<exists>calls happensBefore prog callOrigin txOrigin\n   generatedIds knownIds invocOp invocRes txStatus\nlocalState currentProc visibleCalls currentTx. P \\<lparr>\n  calls = calls,\n  happensBefore = happensBefore,\n  callOrigin  = callOrigin,\n  txOrigin  = txOrigin,\n  knownIds  = knownIds,\n  invocOp  =invocOp,\n  invocRes =invocRes,\n  prog = prog,\n  txStatus  =txStatus,\n  generatedIds  = generatedIds,\n  localState  =localState,\n  currentProc  =currentProc,\n  visibleCalls  =visibleCalls,\n  currentTx  = currentTx\n \\<rparr>\"\n  shows \"\\<exists>S. P S\"\n  using assms by auto\n\nlemma exists_narrowL1: \"(\\<exists>x. P x \\<and> Q) \\<longleftrightarrow> (\\<exists>x. P x) \\<and> Q\" \n  by auto\n\nlemma exists_narrowL2: \"(\\<exists>x y. P x y \\<and> Q y) \\<longleftrightarrow> (\\<exists>y. (\\<exists>x. P x y) \\<and> Q y)\" \n  by auto\n\nlemma exists_narrowL3: \"(\\<exists>x y1 y2. P x y1 y2 \\<and> Q y1 y2) \\<longleftrightarrow> (\\<exists>y1 y2. (\\<exists>x. P x y1 y2) \\<and> Q y1 y2)\" \n  by auto\n\nlemma exists_narrowL4: \"(\\<exists>x y1 y2 y3. P x y1 y2 y3 \\<and> Q y1 y2 y3) \\<longleftrightarrow> (\\<exists>y1 y2 y3. (\\<exists>x. P x y1 y2 y3) \\<and> Q y1 y2 y3)\" \n  by auto\n\nlemma exists_narrowR1: \"(\\<exists>x. P \\<and> Q x) \\<longleftrightarrow> P \\<and> (\\<exists>x. Q x)\" \n  by auto\n\nlemma exists_narrowR2: \"(\\<exists>x y. P y \\<and> Q x y) \\<longleftrightarrow> (\\<exists>y. P  y \\<and> (\\<exists>x. Q x y))\" \n  by auto\n\nlemma exists_narrowR3: \"(\\<exists>x y1 y2. P y1 y2 \\<and> Q x y1 y2) \\<longleftrightarrow> (\\<exists>y1 y2. P y1 y2 \\<and> (\\<exists>x. Q x y1 y2))\" \n  by auto\n\nlemma exists_narrowR4: \"(\\<exists>x y1 y2 y3. P y1 y2 y3 \\<and> Q x y1 y2 y3) \\<longleftrightarrow> (\\<exists>y1 y2 y3. P y1 y2 y3 \\<and> (\\<exists>x. Q x y1 y2 y3))\" \n  by auto\n\nlemmas exists_narrow = \nexists_narrowL1 \nexists_narrowL2\nexists_narrowL3\nexists_narrowL4\nexists_narrowR1\nexists_narrowR2\nexists_narrowR3\nexists_narrowR4\n\nlemma prog_initial: \"prog (initialState program) = program\"\n  by (auto simp add: initialState_def)\n\n\n\n\n\n\n\n\nlemma consistentSnapshot_empty: \"consistentSnapshot S {}\"\n  by (auto simp add: consistentSnapshotH_def causallyConsistent_def transactionConsistent_def  transactionConsistent_committed_def transactionConsistent_atomic_def)\n\n\n\nlemma exists_optionI: \"x \\<noteq> None \\<Longrightarrow> \\<exists>y. x \\<triangleq> y\"\n  by auto\n\n\n\nlemma txStatus_initial: \"txStatus (initialState progr) t = None\"\n  by (simp add: initialState_def)\n\n\n\n\ndefinition initialStates' :: \"('proc::valueType, 'ls, 'op::valueType, 'any::valueType) prog \\<Rightarrow> invocId \\<Rightarrow> ('proc, 'ls, 'op, 'any) state set\"  where\n  \"initialStates' progr i \\<equiv> {\n    (S\\<lparr>localState := (localState S)(i \\<mapsto> initState),\n       currentProc := (currentProc S)(i \\<mapsto> impl),\n       visibleCalls := (visibleCalls S)(i \\<mapsto> {}),\n       invocOp := (invocOp S)(i \\<mapsto> proc)\\<rparr>) \n | S proc initState impl.\n    prog S = progr\n  \\<and> procedure progr proc = (initState, impl)  \n  \\<and> uniqueIds proc \\<subseteq> knownIds S\n  \\<and> invariant_all' S\n  \\<and> state_wellFormed S\n  \\<and> invocOp S i = None\n  \\<and> (\\<forall>tx. txStatus S tx \\<noteq> Some Uncommitted)\n  \\<and> (\\<forall>tx. txOrigin S tx \\<noteq> Some i)\n}\"\n\nlemma initialStates'_same:\n  shows \"initialStates progr i = initialStates' progr i\"\nproof(auto simp add: initialStates_def initialStates'_def, fuzzy_goal_cases A B)\n  case (A S proc initState impl)\n  then show ?case \n    by (auto simp add: invContext_same_allCommitted)\nnext\n  case (B S proc initState impl)\n  then show ?case\n    by (auto simp add: invContext_same_allCommitted intro!: exI)\nqed\n\n       \n\nend", "meta": {"author": "peterzeller", "repo": "repliss-isabelle", "sha": "f43744678cc9c5a4684e8bd0e9c83510bae1d9a4", "save_path": "github-repos/isabelle/peterzeller-repliss-isabelle", "path": "github-repos/isabelle/peterzeller-repliss-isabelle/repliss-isabelle-f43744678cc9c5a4684e8bd0e9c83510bae1d9a4/single_invocation_correctness.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5273165233795671, "lm_q2_score": 0.5698526514141571, "lm_q1q2_score": 0.3004927189823417}}
{"text": "theory Unified_PW\n  imports Refine_Imperative_HOL.Sepref Worklist_Common \"TA_Library.Subsumption_Graphs\"\nbegin\n\nhide_const wait\n\nsubsection \\<open>Utilities\\<close>\n\ndefinition take_from_set where\n  \"take_from_set s = ASSERT (s \\<noteq> {}) \\<then> SPEC (\\<lambda> (x, s'). x \\<in> s \\<and> s' = s - {x})\"\n\nlemma take_from_set_correct:\n  assumes \"s \\<noteq> {}\"\n  shows \"take_from_set s \\<le> SPEC (\\<lambda> (x, s'). x \\<in> s \\<and> s' = s - {x})\"\nusing assms unfolding take_from_set_def by simp\n\nlemmas [refine_vcg] = take_from_set_correct[THEN order.trans]\n\n\n\ndefinition take_from_mset where\n  \"take_from_mset s = ASSERT (s \\<noteq> {#}) \\<then> SPEC (\\<lambda> (x, s'). x \\<in># s \\<and> s' = s - {#x#})\"\n\nlemma take_from_mset_correct:\n  assumes \"s \\<noteq> {#}\"\n  shows \"take_from_mset s \\<le> SPEC (\\<lambda> (x, s'). x \\<in># s \\<and> s' = s - {#x#})\"\nusing assms unfolding take_from_mset_def by simp\n\nlemmas [refine_vcg] = take_from_mset_correct[THEN order.trans]\n\n\nlemma set_mset_mp: \"set_mset m \\<subseteq> s \\<Longrightarrow> n < count m x \\<Longrightarrow> x\\<in>s\"\n  by (meson count_greater_zero_iff le_less_trans subsetCE zero_le)\n\nlemma pred_not_lt_is_zero: \"(\\<not> n - Suc 0 < n) \\<longleftrightarrow> n=0\" by auto\n\nsubsection \\<open>Generalized Worklist Algorithm\\<close>\n\ncontext Search_Space_Defs_Empty\nbegin\n  definition \"reachable_subsumed S = {x' | x x'. reachable x' \\<and> \\<not> empty x' \\<and> x' \\<preceq> x \\<and> x \\<in> S}\"\n\n  definition\n    \"pw_var =\n      inv_image (\n      {(b, b'). b \\<and> \\<not> b'}\n        <*lex*>\n      {(passed', passed).\n        passed' \\<subseteq> {a. reachable a \\<and> \\<not> empty a} \\<and> passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a} \\<and>\n        reachable_subsumed passed \\<subset> reachable_subsumed passed'}\n        <*lex*>\n      measure size\n      )\n      (\\<lambda> (a, b, c). (c, a, b))\n      \"\n\n  definition \"pw_inv_frontier passed wait =\n    (\\<forall> a \\<in> passed. (\\<exists> a' \\<in> set_mset wait. a \\<preceq> a') \\<or>\n    (\\<forall> a'. E a a' \\<and> \\<not> empty a' \\<longrightarrow> (\\<exists> b' \\<in> passed \\<union> set_mset wait. a' \\<preceq> b')))\"\n\n  definition \"start_subsumed passed wait = (\\<not> empty a\\<^sub>0 \\<longrightarrow> (\\<exists> a \\<in> passed \\<union> set_mset wait. a\\<^sub>0 \\<preceq> a))\"\n\n  definition \"pw_inv \\<equiv> \\<lambda> (passed, wait, brk).\n    (brk \\<longrightarrow> (\\<exists> f. reachable f \\<and> F f)) \\<and>\n    (\\<not> brk \\<longrightarrow>\n      passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a}\n    \\<and> pw_inv_frontier passed wait\n    \\<and> (\\<forall> a \\<in> passed \\<union> set_mset wait. \\<not> F a)\n    \\<and> start_subsumed passed wait\n    \\<and> set_mset wait \\<subseteq> Collect reachable)\n    \"\n\n  definition \"add_pw_spec passed wait a \\<equiv> SPEC (\\<lambda>(passed',wait',brk).\n    if \\<exists>a'. E a a' \\<and> F a' then\n      brk\n    else\n      \\<not>brk \\<and> set_mset wait' \\<subseteq> set_mset wait \\<union> {a' . E a a'} \\<and>\n      (\\<forall> s \\<in> set_mset wait. \\<exists> s' \\<in> set_mset wait'. s \\<preceq> s') \\<and>\n      (\\<forall> s \\<in> {a' . E a a' \\<and> \\<not> empty a'}. \\<exists> s' \\<in> set_mset wait' \\<union> passed. s \\<preceq> s') \\<and>\n      (\\<forall> s \\<in> passed \\<union> {a}. \\<exists> s' \\<in> passed'. s \\<preceq> s') \\<and>\n      (passed' \\<subseteq> passed \\<union> {a} \\<union> {a' . E a a' \\<and> \\<not> empty a'} \\<and>\n      ((\\<exists> x \\<in> passed'. \\<not> (\\<exists> x' \\<in> passed. x \\<preceq> x')) \\<or> wait' \\<subseteq># wait \\<and> passed = passed')\n      )\n  )\"\n\n  definition\n    \"init_pw_spec \\<equiv>\n      SPEC (\\<lambda> (passed, wait).\n        if empty a\\<^sub>0 then passed = {} \\<and> wait \\<subseteq># {#a\\<^sub>0#} else passed \\<subseteq> {a\\<^sub>0} \\<and> wait = {#a\\<^sub>0#})\"\n\n  abbreviation subsumed_elem :: \"'a \\<Rightarrow> 'a set \\<Rightarrow> bool\"\n    where \"subsumed_elem a M \\<equiv> \\<exists> a'. a' \\<in> M \\<and> a \\<preceq> a'\"\n\n  notation\n    subsumed_elem  (\"(_/ \\<in>'' _)\" [51, 51] 50)\n\n    definition \"pw_inv_frontier' passed wait =\n      (\\<forall> a. a \\<in> passed \\<longrightarrow>\n        (a \\<in>' set_mset wait)\n      \\<or> (\\<forall> a'. E a a' \\<and> \\<not> empty a' \\<longrightarrow> (a' \\<in>' passed \\<union> set_mset wait)))\"\n\n  lemma pw_inv_frontier_frontier':\n    \"pw_inv_frontier' passed wait\" if\n    \"pw_inv_frontier passed wait\" \"passed \\<subseteq> Collect reachable\"\n    using that unfolding pw_inv_frontier'_def pw_inv_frontier_def by (blast intro: trans)\n\n  lemma\n    \"pw_inv_frontier passed wait\" if \"pw_inv_frontier' passed wait\"\n    using that unfolding pw_inv_frontier_def pw_inv_frontier'_def by blast\n\n  definition pw_algo where\n    \"pw_algo = do\n      {\n        if F a\\<^sub>0 then RETURN (True, {})\n        else if empty a\\<^sub>0 then RETURN (False, {})\n        else do {\n          (passed, wait) \\<leftarrow> init_pw_spec;\n          (passed, wait, brk) \\<leftarrow> WHILEIT pw_inv (\\<lambda> (passed, wait, brk). \\<not> brk \\<and> wait \\<noteq> {#})\n            (\\<lambda> (passed, wait, brk). do\n              {\n                (a, wait) \\<leftarrow> take_from_mset wait;\n                ASSERT (reachable a);\n                if empty a then RETURN (passed, wait, brk) else add_pw_spec passed wait a\n              }\n            )\n            (passed, wait, False);\n            RETURN (brk, passed)\n        }\n      }\n    \"\n\nend\n\nsubsubsection \\<open>Correctness Proof\\<close>\n\ninstance nat :: preorder ..\n\ncontext Search_Space_finite begin\n\n  lemma wf_worklist_var_aux:\n    \"wf {(passed', passed).\n      passed' \\<subseteq> {a. reachable a \\<and> \\<not> empty a} \\<and> passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a} \\<and>\n      reachable_subsumed passed \\<subset> reachable_subsumed passed'}\"\n  proof (rule finite_acyclic_wf, goal_cases)\n    case 1\n    have \"{(passed', passed).\n        passed' \\<subseteq> {a. reachable a \\<and> \\<not> empty a} \\<and> passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a} \\<and>\n        reachable_subsumed passed \\<subset> reachable_subsumed passed'}\n   \\<subseteq> {(passed', passed).\n        passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a} \\<and> passed' \\<subseteq> {a. reachable a \\<and> \\<not> empty a}}\"\n      unfolding reachable_subsumed_def by auto\n    moreover have \"finite \\<dots>\" using finite_reachable using [[simproc add: finite_Collect]] by simp\n    ultimately show ?case by (rule finite_subset)\n  next\n    case 2\n    term \"\\<lambda> a. card (reachable_subsumed a)\"\n    have *: \"class.preorder (\\<le>) ((<) :: nat \\<Rightarrow> nat \\<Rightarrow> bool)\"\n      by (rule preorder_class.axioms)\n    show ?case\n      thm acyclicI_order\n    proof (rule preorder.acyclicI_order[where f = \"\\<lambda> a. card (reachable_subsumed a)\"],\n           rule preorder_class.axioms, rule psubset_card_mono)\n      fix a\n      have \"reachable_subsumed a \\<subseteq> {a. reachable a \\<and> \\<not> empty a}\"\n        unfolding reachable_subsumed_def by blast\n      then show \"finite (reachable_subsumed a)\" using finite_reachable by (rule finite_subset)\n    qed auto\n  qed\n\n  lemma wf_worklist_var:\n    \"wf pw_var\"\n    unfolding pw_var_def\n    by (auto 4 3 intro: wf_worklist_var_aux finite_acyclic_wf preorder.acyclicI_order[where f = id]\n          preorder_class.axioms)\n\n  context\n  begin\n\n  private lemma aux5:\n    assumes\n      \"a' \\<in> passed'\"\n      \"a \\<in># wait\"\n      \"a \\<preceq> a'\"\n      \"start_subsumed passed wait\"\n      \"\\<forall>s\\<in>passed. \\<exists>x\\<in>passed'. s \\<preceq> x\"\n      \"\\<forall>s\\<in>#wait - {#a#}. Multiset.Bex wait' ((\\<preceq>) s)\"\n    shows \"start_subsumed passed' wait'\"\n      using assms unfolding start_subsumed_def apply clarsimp\n      by (metis Un_iff insert_DiffM2 local.trans mset_right_cancel_elem)\n\n  private lemma aux11:\n    assumes\n      \"empty a\"\n      \"start_subsumed passed wait\"\n    shows \"start_subsumed passed (wait - {#a#})\"\n      using assms unfolding start_subsumed_def\n      by auto (metis UnI2 diff_single_trivial empty_mono insert_DiffM insert_noteq_member)\n\n  lemma aux3_aux:\n    assumes \"pw_inv_frontier' passed wait\"\n      \"\\<not> b \\<in>' set_mset wait\"\n      \"E b b'\"\n      \"\\<not> empty b\" \"\\<not> empty b'\"\n      \"b \\<in>' passed\"\n      \"reachable b\" \"passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a}\"\n    shows \"b' \\<in>' passed \\<union> set_mset wait\"\n  proof -\n    from \\<open>b \\<in>' _\\<close> obtain b1 where b1: \"b \\<preceq> b1\" \"b1 \\<in> passed\"\n      by blast\n    with mono[OF this(1) \\<open>E b b'\\<close>] \\<open>passed \\<subseteq> _\\<close> \\<open>reachable b\\<close> \\<open>\\<not> empty b\\<close> obtain b1' where\n      \"E b1 b1'\" \"b' \\<preceq> b1'\"\n      by auto\n    moreover then have \"\\<not> empty b1'\"\n      using assms(5) empty_mono by blast\n    moreover from assms b1 have \"\\<not> b1 \\<in>' set_mset wait\"\n      by (blast intro: trans)\n    ultimately show ?thesis\n      using assms(1) b1\n      unfolding pw_inv_frontier'_def\n      by (blast intro: trans)\n  qed\n\n\n  private lemma pw_inv_frontier_empty_elem:\n    assumes \"pw_inv_frontier passed wait\" \"passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a}\" \"empty a\"\n    shows \"pw_inv_frontier passed (wait - {#a#})\"\n    using assms\n    unfolding pw_inv_frontier_def\n      apply auto\n    by (smt UnCI UnE diff_single_trivial empty_mono insert_DiffM2 mset_cancel_elem(1) subset_Collect_conv)\n\n  private lemma aux3:\n    assumes\n      \"set_mset wait \\<subseteq> Collect reachable\"\n      \"a \\<in># wait\"\n      \"\\<forall> s \\<in> set_mset (wait - {#a#}). \\<exists> s' \\<in> set_mset wait'. s \\<preceq> s'\"\n      \"\\<forall> s \\<in> {a'. E a a' \\<and> \\<not> empty a'}. \\<exists> s' \\<in> passed \\<union> set_mset wait'. s \\<preceq> s'\"\n      \"\\<forall> s \\<in> passed \\<union> {a}. \\<exists> s' \\<in> passed'. s \\<preceq> s'\"\n      \"passed' \\<subseteq> passed \\<union> {a} \\<union> {a' . E a a' \\<and> \\<not> empty a}\"\n      \"pw_inv_frontier passed wait\"\n      \"passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a}\"\n    shows \"pw_inv_frontier passed' wait'\"\n  proof -\n    from assms(1,2) have \"reachable a\"\n      by (simp add: subset_iff)\n    from assms have assms':\n      \"set_mset wait \\<subseteq> Collect reachable\"\n      \"a \\<in># wait\"\n      \"\\<forall> s. s \\<in>' set_mset (wait - {#a#}) \\<longrightarrow> s \\<in>' set_mset wait'\"\n      \"\\<forall> s \\<in> {a'. E a a' \\<and> \\<not> empty a'}. s \\<in>' passed \\<union> set_mset wait'\"\n      \"\\<forall> s. s \\<in>' passed \\<union> {a} \\<longrightarrow> s \\<in>' passed'\"\n      \"passed' \\<subseteq> passed \\<union> {a} \\<union> {a' . E a a'}\"\n      \"pw_inv_frontier' passed wait\"\n      \"passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a}\"\n      by (blast intro: trans pw_inv_frontier_frontier')+\n\n    show ?thesis unfolding pw_inv_frontier_def\n      apply safe\n      unfolding Bex_def\n      subgoal for b b'\n      proof (goal_cases)\n        case A: 1\n        from A(1) assms(6) consider \"b \\<in> passed\" | \"a = b\" | \"E a b\"\n          by auto\n        note cases = this\n        from cases \\<open>\\<not> b \\<in>' set_mset wait'\\<close> assms'(4) \\<open>reachable a\\<close> \\<open>passed \\<subseteq> _\\<close> have \"reachable b\"\n          by cases (auto intro: reachable_step)\n        with A(3,4) have \"\\<not> empty b\" by (auto simp: empty_E)\n        from cases this \\<open>reachable b\\<close> consider \"a = b\" | \"a \\<noteq> b\" \"b \\<in>' passed\" \"reachable b\"\n          apply cases\n          using \\<open>\\<not> b \\<in>' set_mset wait'\\<close> assms'(4)\n          by (fastforce intro: reachable_step)+\n        then consider \"b \\<preceq> a\" \"reachable b\" | \"\\<not> b \\<preceq> a\" \"b \\<in>' passed\" \"reachable b\"\n          apply cases\n          using \\<open>\\<not> b \\<in>' set_mset wait'\\<close> assms'(4) \\<open>reachable a\\<close> by fastforce+\n        then show ?case\n        proof cases\n          case 1\n          with A(3,4) have \"\\<not> empty b\"\n            by (auto simp: empty_E)\n          with mono[OF 1(1) \\<open>E b b'\\<close> 1(2) \\<open>reachable a\\<close>] obtain b1' where\n            \"E a b1'\" \"b' \\<preceq> b1'\"\n            by auto\n          with \\<open>\\<not> empty b'\\<close> have \"b1' \\<in>' passed \\<union> set_mset wait'\"\n            using assms'(4) by (auto dest: empty_mono)\n          with \\<open>b' \\<preceq> _\\<close> assms'(5) show ?thesis\n            by (auto intro: trans)\n        next\n          case 2\n          with A(3,4) have \"\\<not> empty b\"\n            by (auto simp: empty_E)\n          from 2 \\<open>\\<not> b \\<in>' set_mset wait'\\<close> assms'(2,3) have \"\\<not> b \\<in>' set_mset wait\"\n            by (metis insert_DiffM2 mset_right_cancel_elem)\n          from\n            aux3_aux[OF\n              assms'(7) this \\<open>E b b'\\<close> \\<open>\\<not> empty b\\<close> \\<open>\\<not> empty b'\\<close> \\<open>b \\<in>' passed\\<close> \\<open>reachable b\\<close> assms'(8)\n              ]\n          have \"b' \\<in>' passed \\<union> set_mset wait\" .\n          with assms'(2,3,5) show ?thesis\n            by auto (metis insert_DiffM insert_noteq_member)\n        qed\n      qed\n      done\n  qed\n\n  private lemma aux6:\n    assumes\n      \"a \\<in># wait\"\n      \"start_subsumed passed wait\"\n      \"\\<forall> s \\<in> set_mset (wait - {#a#}) \\<union> {a'. E a a' \\<and> \\<not> empty a'}. \\<exists> s' \\<in> set_mset wait'. s \\<preceq> s'\"\n    shows \"start_subsumed (insert a passed) wait'\"\n    using assms unfolding start_subsumed_def\n    apply clarsimp\n    apply (erule disjE)\n     apply blast\n    subgoal premises prems for x\n    proof (cases \"a = x\")\n      case True\n      with prems show ?thesis by simp\n    next\n      case False\n      with \\<open>x \\<in># wait\\<close> have \"x \\<in> set_mset (wait - {#a#})\"\n        by (metis insert_DiffM insert_noteq_member prems(1))\n      with prems(2,4) \\<open>_ \\<preceq> x\\<close> show ?thesis\n        by (auto dest: trans)\n    qed\n  done\n\n  lemma empty_E_star:\n    \"empty x'\" if \"E\\<^sup>*\\<^sup>* x x'\" \"reachable x\" \"empty x\"\n    using that unfolding reachable_def\n    by (induction rule: converse_rtranclp_induct)\n       (blast intro: empty_E[unfolded reachable_def] rtranclp.rtrancl_into_rtrancl)+\n\n  lemma aux4:\n    assumes \"pw_inv_frontier passed {#}\" \"reachable x\" \"start_subsumed passed {#}\"\n            \"passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a}\" \"\\<not> empty x\"\n    shows \"\\<exists> x' \\<in> passed. x \\<preceq> x'\"\n  proof -\n    from \\<open>reachable x\\<close> have \"E\\<^sup>*\\<^sup>* a\\<^sub>0 x\" by (simp add: reachable_def)\n    have \"\\<not> empty a\\<^sub>0\" using \\<open>E\\<^sup>*\\<^sup>* a\\<^sub>0 x\\<close> assms(5) empty_E_star by blast\n    with assms(3) obtain b where \"a\\<^sub>0 \\<preceq> b\" \"b \\<in> passed\" unfolding start_subsumed_def by auto\n    have \"\\<exists>x'. \\<exists> x''. E\\<^sup>*\\<^sup>* b x' \\<and> x \\<preceq> x' \\<and> x' \\<preceq> x'' \\<and> x'' \\<in> passed\" if\n                     \"E\\<^sup>*\\<^sup>* a x\"  \"a \\<preceq> b\"   \"b \\<preceq> b'\"   \"b' \\<in> passed\"\n                     \"reachable a\" \"reachable b\" for a b b'\n    using that proof (induction arbitrary: b b' rule: converse_rtranclp_induct)\n      case base\n      then show ?case by auto\n    next\n      case (step a a1 b b')\n      show ?case\n      proof (cases \"empty a\")\n        case True\n        with step.prems step.hyps have \"empty x\" by - (rule empty_E_star, auto)\n        with step.prems show ?thesis by (auto intro: empty_subsumes)\n      next\n        case False\n        with \\<open>E a a1\\<close> \\<open>a \\<preceq> b\\<close> \\<open>reachable a\\<close> \\<open>reachable b\\<close> obtain b1 where\n          \"E b b1\" \"a1 \\<preceq> b1\"\n          using mono by blast\n        show ?thesis\n        proof (cases \"empty b1\")\n          case True\n          with empty_mono \\<open>a1 \\<preceq> b1\\<close> have \"empty a1\" by blast\n          with step.prems step.hyps have \"empty x\" by - (rule empty_E_star, auto simp: reachable_def)\n          with step.prems show ?thesis by (auto intro: empty_subsumes)\n        next\n          case False\n          from \\<open>E b b1\\<close> \\<open>a1 \\<preceq> b1\\<close> obtain b1' where \"E b' b1'\" \"b1 \\<preceq> b1'\"\n            using \\<open>\\<not> empty a\\<close> empty_mono assms(4) mono step.prems by blast\n          from empty_mono[OF \\<open>\\<not> empty b1\\<close> \\<open>b1 \\<preceq> b1'\\<close>] have \"\\<not> empty b1'\"\n            by auto\n          with \\<open>E b' b1'\\<close> \\<open>b' \\<in> passed\\<close> assms(1) obtain b1'' where \"b1'' \\<in> passed\" \"b1' \\<preceq> b1''\"\n            unfolding pw_inv_frontier_def by auto\n          with \\<open>b1 \\<preceq> _\\<close> have \"b1 \\<preceq> b1''\" using trans by blast\n          with step.IH[OF \\<open>a1 \\<preceq> b1\\<close> this \\<open>b1'' \\<in> passed\\<close>] \\<open>reachable a\\<close> \\<open>E a a1\\<close> \\<open>reachable b\\<close> \\<open>E b b1\\<close>\n          obtain x' x'' where\n            \"E\\<^sup>*\\<^sup>* b1 x'\" \"x \\<preceq> x'\" \"x' \\<preceq> x''\" \"x'' \\<in> passed\"\n            by (auto intro: reachable_step)\n          moreover from \\<open>E b b1\\<close> \\<open>E\\<^sup>*\\<^sup>* b1 x'\\<close> have \"E\\<^sup>*\\<^sup>* b x'\" by auto\n          ultimately show ?thesis by auto\n        qed\n      qed\n    qed\n    from this[OF \\<open>E\\<^sup>*\\<^sup>* a\\<^sub>0 x\\<close> \\<open>a\\<^sub>0 \\<preceq> b\\<close> refl \\<open>b \\<in> _\\<close>] assms(4) \\<open>b \\<in> passed\\<close> show ?thesis\n      by (auto intro: trans)\n  qed\n\n  lemmas [intro] = reachable_step\n\n  private lemma aux7:\n    assumes\n      \"a \\<in># wait\"\n      \"set_mset wait \\<subseteq> Collect reachable\"\n      \"set_mset wait' \\<subseteq> set_mset (wait - {#a#}) \\<union> Collect (E a)\"\n      \"x \\<in># wait'\"\n    shows \"reachable x\"\n    using assms by (auto dest: in_diffD)\n\n  private lemma aux8:\n    \"x \\<in> reachable_subsumed S'\"  if \"x \\<in> reachable_subsumed S\" \"\\<forall>s\\<in>S. \\<exists>x\\<in>S'. s \\<preceq> x\"\n    using that unfolding reachable_subsumed_def by (auto intro: trans)\n\n  private lemma aux9:\n    assumes\n      \"set_mset wait' \\<subseteq> set_mset (wait - {#a#}) \\<union> Collect (E a)\"\n      \"x \\<in># wait'\" \"\\<forall>a'. E a a' \\<longrightarrow> \\<not> F a'\" \"F x\"\n      \"\\<forall>a\\<in>passed \\<union> set_mset wait. \\<not> F a\"\n    shows False\n  proof -\n    from assms(1,2) have \"x \\<in> set_mset wait \\<or> x \\<in> Collect (E a)\"\n      by (meson UnE in_diffD subsetCE)\n    with assms(3,4,5) show ?thesis\n      by auto\n  qed\n\n  private lemma aux10:\n    assumes \"\\<forall>a\\<in>passed' \\<union> set_mset wait. \\<not> F a\" \"F x\" \"x \\<in># wait - {#a#}\"\n    shows \"False\"\n    by (meson UnI2 assms in_diffD)\n\n  (* XXX Move and rename *)\n  lemma aux12:\n    \"size wait' < size wait\" if \"wait' \\<subseteq># wait - {#a#}\" \"a \\<in># wait\"\n    using that\n    by (metis\n        Diff_eq_empty_iff_mset add_diff_cancel_left' add_mset_add_single add_mset_not_empty\n        insert_subset_eq_iff mset_le_add_mset_decr_left1 mset_subset_size subset_mset_def)\n\n  lemma aux13:\n    assumes\n    \"passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a}\"\n    \"passed' \\<subseteq> insert a (passed \\<union> {a'. E a a' \\<and> \\<not> empty a'})\"\n    \"\\<not> empty a\"\n    \"reachable a\"\n    \"\\<forall>s\\<in>passed. \\<exists>x\\<in>passed'. s \\<preceq> x\"\n    \"a'' \\<in> passed'\"\n    \"\\<forall>x\\<in>passed. \\<not> a'' \\<preceq> x\"\n    shows\n    \"passed' \\<subseteq> {a. reachable a \\<and> \\<not> empty a} \\<and> reachable_subsumed passed \\<subset> reachable_subsumed passed'\n     \\<or> passed' = passed \\<and> size wait'' < size wait\"\n  proof -\n    have \"passed' \\<subseteq> {a. reachable a \\<and> \\<not> empty a}\"\n      using \\<open>passed \\<subseteq> _\\<close> \\<open>passed' \\<subseteq> _\\<close> \\<open>\\<not> empty a\\<close> \\<open>reachable a\\<close> by auto\n    moreover have \"reachable_subsumed passed \\<subset> reachable_subsumed passed'\"\n      unfolding reachable_subsumed_def apply auto\n      subgoal\n        using \\<open>\\<forall>s\\<in>passed. \\<exists>x\\<in>passed'. s \\<preceq> x\\<close> by (auto intro: trans)\n      using assms(5-) \\<open>passed' \\<subseteq> {a. reachable a \\<and> \\<not> empty a}\\<close> by auto\n    ultimately show ?thesis\n      using \\<open>passed \\<subseteq> _\\<close> unfolding pw_var_def by auto\n  qed\n\n  method solve_vc =\n    rule aux3 aux5 aux7 aux10 aux11 pw_inv_frontier_empty_elem; assumption; fail |\n    rule aux3; auto; fail | auto intro: aux9; fail | auto dest: in_diffD; fail\n\n  end \\<comment> \\<open>Context\\<close>\n\nend \\<comment> \\<open>Search Space\\<close>\n\ntheorem (in Search_Space'_finite) pw_algo_correct:\n  \"pw_algo \\<le> SPEC (\\<lambda> (brk, passed).\n    (brk \\<longleftrightarrow> F_reachable)\n  \\<and> (\\<not> brk \\<longrightarrow>\n      (\\<forall> a. reachable a \\<and> \\<not> empty a \\<longrightarrow> (\\<exists> b \\<in> passed. a \\<preceq> b))\n    \\<and> passed \\<subseteq> {a. reachable a \\<and> \\<not> empty a})\n    )\"\nproof -\n  note [simp] = size_Diff_submset pred_not_lt_is_zero\n  note [dest] = set_mset_mp\n  show ?thesis\n    unfolding pw_algo_def init_pw_spec_def add_pw_spec_def F_reachable_def\n    apply (refine_vcg wf_worklist_var)\n      (* F a\\<^sub>0*)\n             apply (auto; fail)\n      (* empty a\\<^sub>0 *)\n            subgoal\n              using empty_E_star final_non_empty unfolding reachable_def by auto\n            subgoal\n              using empty_E_star final_non_empty unfolding reachable_def by auto\n            subgoal\n              using empty_E_star final_non_empty unfolding reachable_def by auto\n            subgoal\n              using empty_E_star final_non_empty unfolding reachable_def by auto\n            subgoal\n              using empty_E_star final_non_empty unfolding reachable_def by auto\n      (* Invar start*)\n           apply (fastforce simp: pw_inv_def pw_inv_frontier_def start_subsumed_def\n                            split: if_split_asm dest: mset_subset_eqD)\n      (* Precondition for take-from-set *)\n          apply (simp; fail)\n      (* State is subsumed by passed*)\n      (* Assertion *)\n         apply (auto simp: pw_inv_def; fail)\n      (* Invariant for picking an empty wait list element *)\n        subgoal for _ passed wait _ passed' _ _ brk _ a wait'\n          by (clarsimp simp: pw_inv_def split: if_split_asm; safe; solve_vc)\n      (* Termination for picking an empty wait list element *)\n       apply (clarsimp simp: pw_var_def nonempty_has_size; fail)\n      (* Invariant for picking a non-empty wait list element *)\n      subgoal for _ passed wait _ passed' _ _ brk _ a wait'\n        by (clarsimp simp: pw_inv_def split: if_split_asm; safe; solve_vc) (* slow *)\n      (* Termination for picking a non-empty wait list element *)\n      subgoal for  _ _ _ _ passed _ wait brk _ a wait'\n        by (clarsimp simp: pw_inv_def split: if_split_asm; safe)\n           (simp_all add: aux12 aux13 pw_var_def)\n      (* I \\<and> \\<not> b \\<longrightarrow> post *)\n      using F_mono by (fastforce simp: pw_inv_def dest!: aux4 dest: final_non_empty)+\nqed\n\nlemmas (in Search_Space'_finite) [refine_vcg] = pw_algo_correct[THEN order.trans]\n\nend \\<comment> \\<open>End of Theory\\<close>", "meta": {"author": "wimmers", "repo": "munta", "sha": "62cb1a4a4dbcfcf62c365e90faba15b0012d5a12", "save_path": "github-repos/isabelle/wimmers-munta", "path": "github-repos/isabelle/wimmers-munta/munta-62cb1a4a4dbcfcf62c365e90faba15b0012d5a12/Worklist_Algorithms/Unified_PW.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.5698526368038304, "lm_q2_score": 0.5273165233795671, "lm_q1q2_score": 0.300492711278075}}
{"text": "(*  Title:      JinjaThreads/Common/SemiType.thy\n    Author:     Tobias Nipkow, Gerwin Klein, Andreas Lochbihler\n*)\n\nsection \\<open>The Jinja Type System as a Semilattice\\<close>\n\ntheory SemiType\nimports\n  WellForm\n  \"../DFA/Semilattices\"\nbegin\n\ninductive_set\n  widen1 :: \"'a prog \\<Rightarrow> (ty \\<times> ty) set\"\n  and widen1_syntax :: \"'a prog \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> bool\" (\"_ \\<turnstile> _ <\\<^sup>1 _\" [71,71,71] 70)\n  for P :: \"'a prog\"\nwhere\n  \"P \\<turnstile> C <\\<^sup>1 D \\<equiv> (C, D) \\<in> widen1 P\"\n\n| widen1_Array_Object:\n  \"P \\<turnstile> Array (Class Object) <\\<^sup>1 Class Object\"\n\n| widen1_Array_Integer:\n  \"P \\<turnstile> Array Integer <\\<^sup>1 Class Object\"\n\n| widen1_Array_Boolean:\n  \"P \\<turnstile> Array Boolean <\\<^sup>1 Class Object\"\n\n| widen1_Array_Void:\n  \"P \\<turnstile> Array Void <\\<^sup>1 Class Object\"\n\n| widen1_Class: \n  \"P \\<turnstile> C \\<prec>\\<^sup>1 D \\<Longrightarrow> P \\<turnstile> Class C <\\<^sup>1 Class D\"\n\n| widen1_Array_Array:\n  \"\\<lbrakk> P \\<turnstile> T <\\<^sup>1 U; \\<not> is_NT_Array T \\<rbrakk> \\<Longrightarrow> P \\<turnstile> Array T <\\<^sup>1 Array U\"\n\nabbreviation widen1_trancl :: \"'a prog \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> bool\" (\"_ \\<turnstile> _ <\\<^sup>+ _\" [71,71,71] 70) where\n  \"P \\<turnstile> T <\\<^sup>+ U \\<equiv> (T, U) \\<in> trancl (widen1 P)\"\n\nabbreviation widen1_rtrancl :: \"'a prog \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> bool\" (\"_ \\<turnstile> _ <\\<^sup>* _\" [71,71,71] 70) where\n  \"P \\<turnstile> T <\\<^sup>* U \\<equiv> (T, U) \\<in> rtrancl (widen1 P)\"\n\ninductive_simps widen1_simps1 [simp]:\n  \"P \\<turnstile> Integer <\\<^sup>1 T\"\n  \"P \\<turnstile> Boolean <\\<^sup>1 T\"\n  \"P \\<turnstile> Void <\\<^sup>1 T\"\n  \"P \\<turnstile> Class Object <\\<^sup>1 T\"\n  \"P \\<turnstile> NT <\\<^sup>1 U\"\n\ninductive_simps widen1_simps [simp]:\n  \"P \\<turnstile> Array (Class Object) <\\<^sup>1 T\"\n  \"P \\<turnstile> Array Integer <\\<^sup>1 T\"\n  \"P \\<turnstile> Array Boolean <\\<^sup>1 T\"\n  \"P \\<turnstile> Array Void <\\<^sup>1 T\"\n  \"P \\<turnstile> Class C <\\<^sup>1 T\"\n  \"P \\<turnstile> T <\\<^sup>1 Array U\"\n\nlemma is_type_widen1: \n  assumes icO: \"is_class P Object\"\n  shows \"P \\<turnstile> T <\\<^sup>1 U \\<Longrightarrow> is_type P T\"\nby(induct rule: widen1.induct)(auto intro: subcls_is_class icO split: ty.split dest: is_type_ground_type)\n\nlemma widen1_NT_Array:\n  assumes \"is_NT_Array T\"\n  shows \"\\<not> P \\<turnstile> T\\<lfloor>\\<rceil> <\\<^sup>1 U\"\nproof\n  assume \"P \\<turnstile> T\\<lfloor>\\<rceil> <\\<^sup>1 U\" thus False using assms\n    by(induct \"T\\<lfloor>\\<rceil>\" U arbitrary: T) auto\nqed\n\nlemma widen1_is_type:\n  assumes wfP: \"wf_prog wfmd P\"\n  shows \"(A, B) \\<in> widen1 P \\<Longrightarrow> is_type P B\"\nproof(induct rule: widen1.induct)\n  case (widen1_Class C D)\n  hence \"is_class P C\" \"is_class P D\"\n    by(auto intro: subcls_is_class converse_subcls_is_class[OF wfP])\n  thus ?case by simp\nnext\n  case (widen1_Array_Array T U)\n  thus ?case by(cases U)(auto elim: widen1.cases)\nqed(insert wfP, auto)\n\nlemma widen1_trancl_is_type:\n  assumes wfP: \"wf_prog wfmd P\"\n  shows \"(A, B) \\<in> (widen1 P)^+ \\<Longrightarrow> is_type P B\"\napply(induct rule: trancl_induct)\napply(auto intro: widen1_is_type[OF wfP])\ndone\n\nlemma single_valued_widen1:\n  assumes wf: \"wf_prog wf_md P\"\n  shows \"single_valued (widen1 P)\"\nproof(rule single_valuedI)\n  fix x y z\n  assume \"P \\<turnstile> x <\\<^sup>1 y\" \"P \\<turnstile> x <\\<^sup>1 z\"\n  thus \"y = z\"\n  proof(induct arbitrary: z rule: widen1.induct)\n    case widen1_Class\n    with single_valued_subcls1[OF wf] show ?case\n      by(auto dest: single_valuedpD)\n  next\n    case (widen1_Array_Array T U z)\n    from \\<open>P \\<turnstile> T\\<lfloor>\\<rceil> <\\<^sup>1 z\\<close> \\<open>P \\<turnstile> T <\\<^sup>1 U\\<close> \\<open>\\<not> is_NT_Array T\\<close>\n    obtain z' where z': \"z = z'\\<lfloor>\\<rceil>\" and Tz': \"P \\<turnstile> T <\\<^sup>1 z'\"\n      by(auto elim: widen1.cases)\n    with \\<open>P \\<turnstile> T <\\<^sup>1 z' \\<Longrightarrow> U = z'\\<close> have \"U = z'\" by blast\n    with z' show ?case by simp\n  qed simp_all\nqed\n\nfunction inheritance_level :: \"'a prog \\<Rightarrow> cname \\<Rightarrow> nat\" where\n  \"inheritance_level P C =\n   (if acyclicP (subcls1 P) \\<and> is_class P C \\<and> C \\<noteq> Object\n    then Suc (inheritance_level P (fst (the (class P C))))\n    else 0)\"\nby(pat_completeness, auto)\ntermination\nproof(relation \"same_fst (\\<lambda>P. acyclicP (subcls1 P)) (\\<lambda>P. {(C, C'). (subcls1 P)\\<inverse>\\<inverse> C C'})\")\n  show \"wf (same_fst (\\<lambda>P. acyclicP (subcls1 P)) (\\<lambda>P. {(C, C'). (subcls1 P)\\<inverse>\\<inverse> C C'}))\"\n    by(rule wf_same_fst)(rule acyclicP_wf_subcls1[unfolded wfP_def])\nqed(auto simp add: is_class_def intro: subcls1I)\n\nfun subtype_measure :: \"'a prog \\<Rightarrow> ty \\<Rightarrow> nat\" where\n  \"subtype_measure P (Class C) = inheritance_level P C\"\n| \"subtype_measure P (Array T) = 1 + subtype_measure P T\"\n| \"subtype_measure P T = 0\"\n\nlemma subtype_measure_measure:\n  assumes acyclic: \"acyclicP (subcls1 P)\"\n  and widen1: \"P \\<turnstile> x <\\<^sup>1 y\"\n  shows \"subtype_measure P y < subtype_measure P x\"\nusing widen1\nproof(induct rule: widen1.induct)\n  case (widen1_Class C D)\n  then obtain rest where \"is_class P C\" \"C \\<noteq> Object\" \"class P C = \\<lfloor>(D, rest)\\<rfloor>\"\n    by(auto elim!: subcls1.cases simp: is_class_def)\n  thus ?case using acyclic by(simp)\nqed(simp_all)\n\nlemma wf_converse_widen1:\n  assumes wfP: \"wf_prog wfmc P\"\n  shows \"wf ((widen1 P)^-1)\"\nproof(rule wf_subset)\n  from wfP have \"acyclicP (subcls1 P)\" by(rule acyclic_subcls1)\n  thus \"(widen1 P)\\<inverse> \\<subseteq> measure (subtype_measure P)\" \n    by(auto dest: subtype_measure_measure)\nqed simp\n\nfun super :: \"'a prog \\<Rightarrow> ty \\<Rightarrow> ty\"\nwhere\n  \"super P (Array Integer) = Class Object\"\n| \"super P (Array Boolean) = Class Object\"\n| \"super P (Array Void) = Class Object\"\n| \"super P (Array (Class C)) = (if C = Object then Class Object else Array (super P (Class C)))\"\n| \"super P (Array (Array T)) = Array (super P (Array T))\"\n| \"super P (Class C) = Class (fst (the (class P C)))\"\n\nlemma superI:\n  \"P \\<turnstile> T <\\<^sup>1 U \\<Longrightarrow> super P T = U\"\nproof(induct rule: widen1.induct)\n  case (widen1_Array_Array T U)\n  thus ?case by(cases T) auto\nqed(auto dest: subcls1D)\n\nlemma Class_widen1_super:\n  \"P \\<turnstile> Class C' <\\<^sup>1 U' \\<longleftrightarrow> is_class P C' \\<and> C' \\<noteq> Object \\<and> U' = super P (Class C')\"\n  (is \"?lhs \\<longleftrightarrow> ?rhs\")\nproof(rule iffI)\n  assume ?lhs thus ?rhs\n    by(auto intro: subcls_is_class simp add: superI simp del: super.simps)\nnext\n  assume ?rhs thus ?lhs\n    by(auto simp add: is_class_def intro: subcls1.intros)\nqed\n\nlemma super_widen1:\n  assumes icO: \"is_class P Object\"\n  shows \"P \\<turnstile> T <\\<^sup>1 U \\<longleftrightarrow> is_type P T \\<and> (case T of Class C  \\<Rightarrow> (C \\<noteq> Object \\<and> U = super P T) \n                                              | Array T' \\<Rightarrow> U = super P T \n                                              | _        \\<Rightarrow> False)\"\nproof(induct T arbitrary: U)\n  case Class thus ?case using Class_widen1_super by(simp)\nnext\n  case (Array T' U')\n  note IH = this\n  have \"P \\<turnstile> T'\\<lfloor>\\<rceil> <\\<^sup>1 U' = (is_type P (T'\\<lfloor>\\<rceil>) \\<and> U' = super P (T'\\<lfloor>\\<rceil>))\"\n  proof(rule iffI)\n    assume wd: \"P \\<turnstile> T'\\<lfloor>\\<rceil> <\\<^sup>1 U'\"\n    with icO have \"is_type P (T'\\<lfloor>\\<rceil>)\" by(rule is_type_widen1)\n    moreover from wd have \"super P (T'\\<lfloor>\\<rceil>) = U'\" by(rule superI)\n    ultimately show \"is_type P (T'\\<lfloor>\\<rceil>) \\<and> U' = super P (T'\\<lfloor>\\<rceil>)\" by simp\n  next\n    assume \"is_type P (T'\\<lfloor>\\<rceil>) \\<and> U' = super P (T'\\<lfloor>\\<rceil>)\"\n    then obtain \"is_type P (T'\\<lfloor>\\<rceil>)\" and U': \"U' = super P (T'\\<lfloor>\\<rceil>)\" ..\n    thus \"P \\<turnstile> T'\\<lfloor>\\<rceil> <\\<^sup>1 U'\"\n    proof(cases T')\n      case (Class D)\n      thus ?thesis using U' icO \\<open>is_type P (T'\\<lfloor>\\<rceil>)\\<close>\n        by(cases \"D = Object\")(auto simp add: is_class_def intro: subcls1.intros)\n    next\n      case Array thus ?thesis\n        using IH \\<open>is_type P (T'\\<lfloor>\\<rceil>)\\<close> U' by(auto simp add: ty.split_asm)\n    qed simp_all\n  qed\n  thus ?case by(simp)\nqed(simp_all)\n\ndefinition sup :: \"'c prog \\<Rightarrow> ty \\<Rightarrow> ty \\<Rightarrow> ty err\" where\n  \"sup P T U \\<equiv>\n   if is_refT T \\<and> is_refT U\n   then OK (if U = NT then T\n            else if T = NT then U\n            else exec_lub (widen1 P) (super P) T U)\n   else if (T = U) then OK T else Err\"\n\nlemma sup_def':\n  \"sup P = (\\<lambda>T U.\n   if is_refT T \\<and> is_refT U\n   then OK (if U = NT then T\n            else if T = NT then U\n            else exec_lub (widen1 P) (super P) T U)\n   else if (T = U) then OK T else Err)\"\n  by (simp add: fun_eq_iff sup_def)\n\ndefinition esl :: \"'m prog \\<Rightarrow> ty esl\"\nwhere\n  \"esl P = (types P, widen P, sup P)\"\n\nlemma order_widen [intro,simp]: \n  \"wf_prog m P \\<Longrightarrow> order (widen P)\"\nunfolding Semilat.order_def lesub_def\nby (auto intro: widen_trans widen_antisym)\n\nlemma subcls1_trancl_widen1_trancl:\n  \"(subcls1 P)^++ C D \\<Longrightarrow> P \\<turnstile> Class C <\\<^sup>+ Class D\"\nby(induct rule: tranclp_induct[consumes 1, case_names base step])\n  (auto intro: trancl_into_trancl)\n\nlemma subcls_into_widen1_rtrancl:\n  \"P \\<turnstile> C \\<preceq>\\<^sup>* D \\<Longrightarrow> P \\<turnstile> Class C <\\<^sup>* Class D\"\nby(induct rule: rtranclp_induct)(auto intro: rtrancl_into_rtrancl)\n\nlemma not_widen1_NT_Array:\n  \"P \\<turnstile> U <\\<^sup>1 T \\<Longrightarrow> \\<not> is_NT_Array T\"\nby(induct rule: widen1.induct)(auto)\n\nlemma widen1_trancl_into_Array_widen1_trancl:\n  \"\\<lbrakk> P \\<turnstile> A <\\<^sup>+ B; \\<not> is_NT_Array A \\<rbrakk> \\<Longrightarrow> P \\<turnstile> A\\<lfloor>\\<rceil> <\\<^sup>+ B\\<lfloor>\\<rceil>\"\nby(induct rule: converse_trancl_induct)\n  (auto intro: trancl_into_trancl2 widen1_Array_Array dest: not_widen1_NT_Array)\n\nlemma widen1_rtrancl_into_Array_widen1_rtrancl:\n  \"\\<lbrakk> P \\<turnstile> A <\\<^sup>* B; \\<not> is_NT_Array A \\<rbrakk> \\<Longrightarrow> P \\<turnstile> A\\<lfloor>\\<rceil> <\\<^sup>* B\\<lfloor>\\<rceil>\"\nby(blast elim: rtranclE intro: trancl_into_rtrancl widen1_trancl_into_Array_widen1_trancl rtrancl_into_trancl1)\n\nlemma Array_Object_widen1_trancl:\n  assumes wf: \"wf_prog wmdc P\"\n  and itA: \"is_type P (A\\<lfloor>\\<rceil>)\"\n  shows \"P \\<turnstile> A\\<lfloor>\\<rceil> <\\<^sup>+ Class Object\"\nusing itA\nproof(induction A)\n  case (Class C)\n  hence \"is_class P C\" by simp\n  hence \"P \\<turnstile> C \\<preceq>\\<^sup>* Object\" by(rule subcls_C_Object[OF _ wf])\n  hence \"P \\<turnstile> Class C <\\<^sup>* Class Object\" by(rule subcls_into_widen1_rtrancl)\n  hence \"P \\<turnstile> Class C\\<lfloor>\\<rceil> <\\<^sup>* Class Object\\<lfloor>\\<rceil>\"\n    by(rule widen1_rtrancl_into_Array_widen1_rtrancl) simp\n  thus ?case by(rule rtrancl_into_trancl1) simp\nnext\n  case (Array A)\n  from \\<open>is_type P (A\\<lfloor>\\<rceil>\\<lfloor>\\<rceil>)\\<close> have \"is_type P (A\\<lfloor>\\<rceil>)\" by(rule is_type_ArrayD)\n  hence \"P \\<turnstile> A\\<lfloor>\\<rceil> <\\<^sup>+ Class Object\" by(rule Array.IH)\n  moreover from \\<open>is_type P (A\\<lfloor>\\<rceil>\\<lfloor>\\<rceil>)\\<close> have \"\\<not> is_NT_Array (A\\<lfloor>\\<rceil>)\" by auto\n  ultimately have \"P \\<turnstile> A\\<lfloor>\\<rceil>\\<lfloor>\\<rceil> <\\<^sup>+ Class Object\\<lfloor>\\<rceil>\"\n    by(rule widen1_trancl_into_Array_widen1_trancl)\n  thus ?case by(rule trancl_into_trancl) simp\nqed auto\n\nlemma widen_into_widen1_trancl:\n  assumes wf: \"wf_prog wfmd P\"\n  shows \"\\<lbrakk> P \\<turnstile> A \\<le> B; A \\<noteq> B; A \\<noteq> NT; is_type P A \\<rbrakk> \\<Longrightarrow> P \\<turnstile> A <\\<^sup>+ B\"\nproof(induct rule: widen.induct)\n  case (widen_subcls C D)\n  from \\<open>Class C \\<noteq> Class D\\<close> \\<open>P \\<turnstile> C \\<preceq>\\<^sup>* D\\<close> have \"(subcls1 P)\\<^sup>+\\<^sup>+ C D\"\n    by(auto elim: rtranclp.cases intro: rtranclp_into_tranclp1)\n  thus ?case by(rule subcls1_trancl_widen1_trancl)\nnext\n  case widen_array_object thus ?case by(auto intro: Array_Object_widen1_trancl[OF wf])\nnext\n  case (widen_array_array A B)\n  hence \"P \\<turnstile> A <\\<^sup>+ B\" by(cases A) auto\n  with \\<open>is_type P (A\\<lfloor>\\<rceil>)\\<close> show ?case by(auto intro: widen1_trancl_into_Array_widen1_trancl)\nqed(auto)\n\nlemma wf_prog_impl_acc_widen:\n  assumes wfP: \"wf_prog wfmd P\"\n  shows \"acc (types P) (widen P)\"\nproof -\n  from wf_converse_widen1[OF wfP]\n  have \"wf (((widen1 P)^-1)^+)\" by(rule wf_trancl)\n\n  hence wfw1t: \"\\<And>M T. T \\<in> M \\<Longrightarrow> (\\<exists>z\\<in>M. \\<forall>y. (y, z) \\<in> ((widen1 P)\\<inverse>)\\<^sup>+ \\<longrightarrow> y \\<notin> M)\"\n    by(auto simp only: wf_eq_minimal)\n  have \"wf {(y, x). is_type P x \\<and> is_type P y \\<and> widen P x y \\<and> x \\<noteq> y}\"\n    unfolding wf_eq_minimal\n  proof(intro strip)\n    fix M and T :: ty\n    assume TM: \"T \\<in> M\"\n    show \"\\<exists>z\\<in>M. \\<forall>y. (y, z) \\<in> {(y, T). is_type P T \\<and> is_type P y \\<and> widen P T y \\<and> T \\<noteq> y} \\<longrightarrow> y \\<notin> M\"\n    proof(cases \"(\\<exists>C. Class C \\<in> M \\<and> is_class P C) \\<or> (\\<exists>U. U\\<lfloor>\\<rceil> \\<in> M \\<and> is_type P (U\\<lfloor>\\<rceil>))\")\n      case True\n      have BNTthesis: \"\\<And>B. \\<lbrakk> B \\<in> (M \\<inter> types P) - {NT} \\<rbrakk> \\<Longrightarrow> ?thesis\"\n      proof -\n        fix B\n        assume BM: \"B \\<in> M \\<inter> types P - {NT}\"\n        from wfw1t[OF BM] obtain z\n          where zM: \"z \\<in> M\"\n          and znnt: \"z \\<noteq> NT\"\n          and itz: \"is_type P z\"\n          and y: \"\\<And>y. (y, z) \\<in> ((widen1 P)\\<inverse>)\\<^sup>+ \\<Longrightarrow> y \\<notin> M \\<inter> types P - {NT}\" by blast\n        show \"?thesis B\"\n        proof(rule bexI[OF _ zM], rule allI, rule impI)\n          fix y\n          assume \"(y, z) \\<in> {(y, T). is_type P T \\<and> is_type P y \\<and> widen P T y \\<and> T \\<noteq> y}\"\n          hence Pzy: \"P \\<turnstile> z \\<le> y\" and zy: \"z \\<noteq> y\" and \"is_type P y\" by auto\n          hence \"P \\<turnstile> z <\\<^sup>+ y\" using znnt itz\n            by -(rule widen_into_widen1_trancl[OF wfP])\n          hence ynM: \"y \\<notin> M \\<inter> types P - {NT}\"\n            by -(rule y, simp add: trancl_converse)\n          thus \"y \\<notin> M\" using Pzy znnt \\<open>is_type P y\\<close> by auto\n        qed\n      qed\n      from True show ?thesis by(fastforce intro: BNTthesis)\n    next\n      case False\n      \n      hence not_is_class: \"\\<And>C. Class C \\<in> M \\<Longrightarrow> \\<not> is_class P C\"\n        and not_is_array: \"\\<And>U. U\\<lfloor>\\<rceil> \\<in> M \\<Longrightarrow> \\<not> is_type P (U\\<lfloor>\\<rceil>)\" by simp_all\n\n      show ?thesis\n      proof(cases \"\\<exists>C. Class C \\<in> M\")\n        case True\n        then obtain C where \"Class C \\<in> M\" ..\n        with not_is_class[of C] show ?thesis\n          by(blast dest: rtranclpD subcls_is_class Class_widen)\n      next\n        case False\n        show ?thesis\n        proof(cases \"\\<exists>T. Array T \\<in> M\")\n          case True\n          then obtain U where U: \"Array U \\<in> M\" ..\n          hence \"\\<not> is_type P (U\\<lfloor>\\<rceil>)\" by(rule not_is_array)\n          thus ?thesis using U by(auto simp del: is_type.simps)\n        next\n          case False\n          with \\<open>\\<not> (\\<exists>C. Class C \\<in> M)\\<close> TM\n          have \"\\<forall>y. P \\<turnstile> T \\<le> y \\<and> T \\<noteq> y \\<longrightarrow> y \\<notin> M\"\n            by(cases T)(fastforce simp add: NT_widen)+\n          thus ?thesis using TM by blast\n        qed\n      qed\n    qed\n  qed\n  thus ?thesis by(simp add: Semilat.acc_def lesssub_def lesub_def)\nqed\n\nlemmas wf_widen_acc = wf_prog_impl_acc_widen\ndeclare wf_widen_acc [intro, simp]\n\nlemma acyclic_widen1:\n  \"wf_prog wfmc P \\<Longrightarrow> acyclic (widen1 P)\"\nby(auto dest: wf_converse_widen1 wf_acyclic simp add: acyclic_converse)\n\nlemma widen1_into_widen:\n  \"(A, B) \\<in> widen1 P \\<Longrightarrow> P \\<turnstile> A \\<le> B\"\nby(induct rule: widen1.induct)(auto intro: widen.intros)\n\nlemma widen1_rtrancl_into_widen:\n  \"P \\<turnstile> A <\\<^sup>* B \\<Longrightarrow> P \\<turnstile> A \\<le> B\"\nby(induct rule: rtrancl_induct)(auto dest!: widen1_into_widen elim: widen_trans)\n\nlemma widen_eq_widen1_trancl:\n  \"\\<lbrakk> wf_prog wf_md P; T \\<noteq> NT; T \\<noteq> U; is_type P T \\<rbrakk> \\<Longrightarrow> P \\<turnstile> T \\<le> U \\<longleftrightarrow> P \\<turnstile> T <\\<^sup>+ U\"\nby(blast intro: widen_into_widen1_trancl widen1_rtrancl_into_widen trancl_into_rtrancl)\n\nlemma sup_is_type:\n  assumes wf: \"wf_prog wf_md P\"\n  and itA: \"is_type P A\"\n  and itB: \"is_type P B\"\n  and sup: \"sup P A B = OK T\"\n  shows \"is_type P T\"\nproof -\n  { assume ANT: \"A \\<noteq> NT\"\n      and BNT: \"B \\<noteq> NT\"\n      and AnB: \"A \\<noteq> B\"\n      and RTA: \"is_refT A\"\n      and RTB: \"is_refT B\"\n    with itA itB have AObject: \"P \\<turnstile> A \\<le> Class Object\"\n      and BObject: \"P \\<turnstile> B \\<le> Class Object\"\n      by(auto intro: is_refType_widen_Object[OF wf])\n    have \"is_type P (exec_lub (widen1 P) (super P) A B)\"\n    proof(cases \"A = Class Object \\<or> B = Class Object\")\n      case True\n      hence \"exec_lub (widen1 P) (super P) A B = Class Object\"\n      proof(rule disjE)\n        assume A: \"A = Class Object\"\n        moreover\n        from BObject BNT itB have \"P \\<turnstile> B <\\<^sup>* Class Object\"\n          by(cases \"B = Class Object\")(auto intro: trancl_into_rtrancl widen_into_widen1_trancl[OF wf])\n        hence \"is_ub ((widen1 P)\\<^sup>*) (Class Object) B (Class Object)\"\n          by(auto intro: is_ubI)\n        hence \"is_lub ((widen1 P)\\<^sup>*) (Class Object) B (Class Object)\"\n          by(auto simp add: is_lub_def dest: is_ubD)\n        with acyclic_widen1[OF wf]\n        have \"exec_lub (widen1 P) (super P) (Class Object) B = Class Object\"\n          by(auto intro: exec_lub_conv superI)\n        ultimately show \"exec_lub (widen1 P) (super P) A B = Class Object\" by simp\n      next\n        assume B: \"B = Class Object\"\n        moreover\n        from AObject ANT itA\n        have \"(A, Class Object) \\<in> (widen1 P)\\<^sup>*\"\n          by(cases \"A = Class Object\", auto intro: trancl_into_rtrancl widen_into_widen1_trancl[OF wf])\n        hence \"is_ub ((widen1 P)\\<^sup>*) (Class Object) A (Class Object)\"\n          by(auto intro: is_ubI)\n        hence \"is_lub ((widen1 P)\\<^sup>*) (Class Object) A (Class Object)\"\n          by(auto simp add: is_lub_def dest: is_ubD)\n        with acyclic_widen1[OF wf]\n        have \"exec_lub (widen1 P) (super P) A (Class Object) = Class Object\"\n          by(auto intro: exec_lub_conv superI)\n        ultimately show \"exec_lub (widen1 P) (super P) A B = Class Object\" by simp\n      qed\n      with wf show ?thesis by(simp)\n    next\n      case False\n      hence AnObject: \"A \\<noteq> Class Object\"\n        and BnObject: \"B \\<noteq> Class Object\" by auto\n      from widen_into_widen1_trancl[OF wf AObject AnObject ANT itA]\n      have \"P \\<turnstile> A <\\<^sup>* Class Object\" by(rule trancl_into_rtrancl)\n      moreover from widen_into_widen1_trancl[OF wf BObject BnObject BNT itB]\n      have \"P \\<turnstile> B <\\<^sup>* Class Object\" by(rule trancl_into_rtrancl)\n      ultimately have \"is_lub ((widen1 P)\\<^sup>*) A B (exec_lub (widen1 P) (super P) A B)\"\n        by(rule is_lub_exec_lub[OF single_valued_widen1[OF wf] acyclic_widen1[OF wf]])(auto intro: superI)\n      hence Aew1: \"P \\<turnstile> A <\\<^sup>* exec_lub (widen1 P) (super P) A B\"\n        by(auto simp add: is_lub_def dest!: is_ubD)\n      thus ?thesis\n      proof(rule rtranclE)\n        assume \"A = exec_lub (widen1 P) (super P) A B\"\n        with itA show ?thesis by simp\n      next\n        fix A'\n        assume \"P \\<turnstile> A' <\\<^sup>1 exec_lub (widen1 P) (super P) A B\"\n        thus ?thesis by(rule widen1_is_type[OF wf])\n      qed\n    qed }\n  with is_class_Object[OF wf] sup itA itB show ?thesis unfolding sup_def\n    by(cases \"A = B\")(auto split: if_split_asm simp add: exec_lub_refl)\nqed\n\nlemma closed_err_types:\n  assumes wfP: \"wf_prog wf_mb P\"\n  shows \"closed (err (types P)) (lift2 (sup P))\"\nproof -\n  { fix A B\n    assume it: \"is_type P A\" \"is_type P B\"\n      and \"A \\<noteq> NT\" \"B \\<noteq> NT\" \"A \\<noteq> B\"\n      and \"is_refT A\" \"is_refT B\"\n    hence \"is_type P (exec_lub (widen1 P) (super P) A B)\"\n      using sup_is_type[OF wfP it] by(simp add: sup_def) }\n  with is_class_Object[OF wfP] show ?thesis\n    unfolding closed_def plussub_def lift2_def sup_def'\n    by(auto split: err.split ty.splits)(auto simp add: exec_lub_refl)\nqed\n\nlemma widen_into_widen1_rtrancl:\n  \"\\<lbrakk>wf_prog wfmd P; widen P A B; A \\<noteq> NT; is_type P A \\<rbrakk> \\<Longrightarrow> (A, B) \\<in> (widen1 P)\\<^sup>*\"\nby(cases \"A = B\")(auto intro: trancl_into_rtrancl widen_into_widen1_trancl)\n\n\nlemma sup_widen_greater:\n  assumes wfP: \"wf_prog wf_mb P\"\n  and it1: \"is_type P t1\"\n  and it2: \"is_type P t2\"\n  and sup: \"sup P t1 t2 = OK s\"\n  shows \"widen P t1 s \\<and> widen P t2 s\"\nproof -\n  { assume t1: \"is_refT t1\"\n      and t2: \"is_refT t2\"\n      and t1NT: \"t1 \\<noteq> NT\"\n      and t2NT: \"t2 \\<noteq> NT\"\n    with it1 it2 wfP have \"P \\<turnstile> t1 \\<le> Class Object\" \"P \\<turnstile> t2 \\<le> Class Object\"\n      by(auto intro: is_refType_widen_Object)\n    with t1NT t2NT it1 it2\n    have \"P \\<turnstile> t1 <\\<^sup>* Class Object\" \"P \\<turnstile> t2 <\\<^sup>* Class Object\"\n      by(auto intro: widen_into_widen1_rtrancl[OF wfP])\n    with single_valued_widen1[OF wfP]\n    obtain u where \"is_lub ((widen1 P)^*) t1 t2 u\" \n      by (blast dest: single_valued_has_lubs)\n    hence \"P \\<turnstile> t1 \\<le> exec_lub (widen1 P) (super P) t1 t2 \\<and>\n           P \\<turnstile> t2 \\<le> exec_lub (widen1 P) (super P) t1 t2\"\n      using acyclic_widen1[OF wfP] superI[of _ _ P]\n      by(simp add: exec_lub_conv)(blast dest: is_lubD is_ubD intro: widen1_rtrancl_into_widen) }\n  with it1 it2 sup show ?thesis\n    by (cases s) (auto simp add: sup_def split: if_split_asm elim: refTE)\nqed\n\nlemma sup_widen_smallest:\n  assumes wfP: \"wf_prog wf_mb P\"\n  and itT: \"is_type P T\"\n  and itU: \"is_type P U\"\n  and TwV: \"P \\<turnstile> T \\<le> V\"\n  and UwV: \"P \\<turnstile> U \\<le> V\"\n  and sup: \"sup P T U = OK W\"\n  shows \"widen P W V\"\nproof -\n  { assume rT: \"is_refT T\"\n      and rU: \"is_refT U\"\n      and UNT: \"U \\<noteq> NT\"\n      and TNT: \"T \\<noteq> NT\"\n      and W: \"exec_lub (widen1 P) (super P) T U = W\"\n    from itU itT rT rU UNT TNT have \"P \\<turnstile> T \\<le> Class Object\" \"P \\<turnstile> U \\<le> Class Object\"\n      by(auto intro:is_refType_widen_Object[OF wfP])\n    with UNT TNT itT itU\n    have \"P \\<turnstile> T <\\<^sup>* Class Object\" \"P \\<turnstile> U <\\<^sup>* Class Object\"\n      by(auto intro: widen_into_widen1_rtrancl[OF wfP])\n    with single_valued_widen1[OF wfP]\n    obtain X where lub: \"is_lub ((widen1 P)^* ) T U X\"\n      by (blast dest: single_valued_has_lubs)   \n    with acyclic_widen1[OF wfP]\n    have \"exec_lub (widen1 P) (super P) T U = X\"\n      by (blast intro: superI exec_lub_conv)\n    also from TwV TNT UwV UNT itT itU have \"P \\<turnstile> T <\\<^sup>* V\" \"P \\<turnstile> U <\\<^sup>* V\"\n      by(auto intro: widen_into_widen1_rtrancl[OF wfP])\n    with lub have \"P \\<turnstile> X <\\<^sup>* V\"\n      by (clarsimp simp add: is_lub_def is_ub_def)\n    finally have \"P \\<turnstile> exec_lub (widen1 P) (super P) T U \\<le> V\"\n      by(rule widen1_rtrancl_into_widen)\n    with W have \"P \\<turnstile> W \\<le> V\" by simp }\n  with sup itT itU TwV UwV show ?thesis\n    by(simp add: sup_def split: if_split_asm)\nqed\n\nlemma sup_exists:\n  \"\\<lbrakk> widen P a c; widen P b c \\<rbrakk> \\<Longrightarrow> \\<exists>T. sup P a b = OK T\"\nby(cases b a rule: ty.exhaust[case_product ty.exhaust])(auto simp add: sup_def)\n\nlemma err_semilat_JType_esl:\n  assumes wf_prog: \"wf_prog wf_mb P\"\n  shows \"err_semilat (esl P)\"\nproof -\n  from wf_prog have \"order (widen P)\" ..\n  moreover from wf_prog\n  have \"closed (err (types P)) (lift2 (sup P))\"\n    by (rule closed_err_types)\n  moreover\n  from wf_prog have\n    \"(\\<forall>x\\<in>err (types P). \\<forall>y\\<in>err (types P). x \\<sqsubseteq>\\<^bsub>Err.le (widen P)\\<^esub> x \\<squnion>\\<^bsub>lift2 (sup P)\\<^esub> y) \\<and> \n     (\\<forall>x\\<in>err (types P). \\<forall>y\\<in>err (types P). y \\<sqsubseteq>\\<^bsub>Err.le (widen P)\\<^esub> x \\<squnion>\\<^bsub>lift2 (sup P)\\<^esub> y)\"\n    by(auto simp add: lesub_def plussub_def Err.le_def lift2_def sup_widen_greater split: err.split)\n  moreover from wf_prog have\n    \"\\<forall>x\\<in>err (types P). \\<forall>y\\<in>err (types P). \\<forall>z\\<in>err (types P). \n    x \\<sqsubseteq>\\<^bsub>Err.le (widen P)\\<^esub> z \\<and> y \\<sqsubseteq>\\<^bsub>Err.le (widen P)\\<^esub> z \\<longrightarrow> x \\<squnion>\\<^bsub>lift2 (sup P)\\<^esub> y \\<sqsubseteq>\\<^bsub>Err.le (widen P)\\<^esub> z\"\n    unfolding lift2_def plussub_def lesub_def Err.le_def\n    by(auto intro: sup_widen_smallest dest:sup_exists simp add: split: err.split)\n  ultimately show ?thesis by (simp add: esl_def semilat_def sl_def Err.sl_def)\nqed\n\nsubsection \\<open>Relation between @{term \"sup P T U = OK V\"} and @{term \"P \\<turnstile> lub(T, U) = V\"}\\<close>\n\nlemma sup_is_lubI:\n  assumes wf: \"wf_prog wf_md P\"\n  and it: \"is_type P T\" \"is_type P U\"\n  and sup: \"sup P T U = OK V\"\n  shows \"P \\<turnstile> lub(T, U) = V\"\nproof \n  from sup_widen_greater[OF wf it sup]\n  show \"P \\<turnstile> T \\<le> V\" \"P \\<turnstile> U \\<le> V\" by blast+\nnext\n  fix T'\n  assume \"P \\<turnstile> T \\<le> T'\" \"P \\<turnstile> U \\<le> T'\"\n  thus \"P \\<turnstile> V \\<le> T'\" using sup by(rule sup_widen_smallest[OF wf it])\nqed\n\nlemma is_lub_subD:\n  assumes wf: \"wf_prog wf_md P\"\n  and it: \"is_type P T\" \"is_type P U\"\n  and lub: \"P \\<turnstile> lub(T, U) = V\"\n  shows \"sup P T U = OK V\"\nproof -\n  from lub have \"P \\<turnstile> T \\<le> V\" \"P \\<turnstile> U \\<le> V\" by(blast dest: is_lub_upper)+\n  from sup_exists[OF this] obtain W where \"sup P T U = OK W\" by blast\n  moreover\n  with wf it have \"P \\<turnstile> lub(T, U) = W\" by(rule sup_is_lubI)\n  with lub have \"V = W\" by(auto dest: is_lub_unique[OF wf])\n  ultimately show ?thesis by simp\nqed\n\nlemma is_lub_is_type:\n  \"\\<lbrakk> wf_prog wf_md P; is_type P T; is_type P U; P \\<turnstile> lub(T, U) = V \\<rbrakk> \\<Longrightarrow> is_type P V\"\nby(frule (3) is_lub_subD)(erule (3) sup_is_type)\n\nsubsection \\<open>Code generator setup\\<close>\n\ncode_pred widen1p .\nlemmas [code] = widen1_def\n\nlemma eval_widen1p_i_i_o_conv:\n  \"Predicate.eval (widen1p_i_i_o P T) = (\\<lambda>U. P \\<turnstile> T <\\<^sup>1 U)\"\nby(auto elim: widen1p_i_i_oE intro: widen1p_i_i_oI simp add: widen1_def fun_eq_iff)\n\nlemma rtrancl_widen1_code [code_unfold]:\n  \"(widen1 P)^* = {(a, b). Predicate.holds (rtrancl_tab_FioB_i_i_i (widen1p_i_i_o P) [] a b)}\"\nby(auto simp add: fun_eq_iff Predicate.holds_eq widen1_def rtrancl_def rtranclp_eq_rtrancl_tab_nil eval_widen1p_i_i_o_conv intro!: rtrancl_tab_FioB_i_i_iI elim!: rtrancl_tab_FioB_i_i_iE)\n\ndeclare exec_lub_def [code_unfold]\n\nend\n\n", "meta": {"author": "data61", "repo": "PSL", "sha": "2a71eac0db39ad490fe4921a5ce1e4344dc43b12", "save_path": "github-repos/isabelle/data61-PSL", "path": "github-repos/isabelle/data61-PSL/PSL-2a71eac0db39ad490fe4921a5ce1e4344dc43b12/SeLFiE/Example/afp-2020-05-16/thys/JinjaThreads/Common/SemiType.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3003371864966187}}
{"text": "(*  Title:      HOL/Auth/Guard/P2.thy\n    Author:     Frederic Blanqui, University of Cambridge Computer Laboratory\n    Copyright   2002  University of Cambridge\n\nFrom G. Karjoth, N. Asokan and C. Gulcu\n\"Protecting the computation results of free-roaming agents\"\nMobiles Agents 1998, LNCS 1477.\n*)\n\nsection\\<open>Protocol P2\\<close>\n\ntheory P2 imports Guard_Public List_Msg begin\n\nsubsection\\<open>Protocol Definition\\<close>\n\n\ntext\\<open>Like P1 except the definitions of \\<open>chain\\<close>, \\<open>shop\\<close>,\n  \\<open>next_shop\\<close> and \\<open>nonce\\<close>\\<close>\n\nsubsubsection\\<open>offer chaining:\nB chains his offer for A with the head offer of L for sending it to C\\<close>\n\ndefinition chain :: \"agent => nat => agent => msg => agent => msg\" where\n\"chain B ofr A L C ==\nlet m1= sign B (Nonce ofr) in\nlet m2= Hash \\<lbrace>head L, Agent C\\<rbrace> in\n\\<lbrace>Crypt (pubK A) m1, m2\\<rbrace>\"\n\ndeclare Let_def [simp]\n\nlemma chain_inj [iff]: \"(chain B ofr A L C = chain B' ofr' A' L' C')\n= (B=B' & ofr=ofr' & A=A' & head L = head L' & C=C')\"\nby (auto simp: chain_def Let_def)\n\nlemma Nonce_in_chain [iff]: \"Nonce ofr \\<in> parts {chain B ofr A L C}\"\nby (auto simp: chain_def sign_def)\n\nsubsubsection\\<open>agent whose key is used to sign an offer\\<close>\n\nfun shop :: \"msg => msg\" where\n\"shop \\<lbrace>Crypt K \\<lbrace>B,ofr,Crypt K' H\\<rbrace>,m2\\<rbrace> = Agent (agt K')\"\n\nlemma shop_chain [simp]: \"shop (chain B ofr A L C) = Agent B\"\nby (simp add: chain_def sign_def)\n\nsubsubsection\\<open>nonce used in an offer\\<close>\n\nfun nonce :: \"msg => msg\" where\n\"nonce \\<lbrace>Crypt K \\<lbrace>B,ofr,CryptH\\<rbrace>,m2\\<rbrace> = ofr\"\n\nlemma nonce_chain [simp]: \"nonce (chain B ofr A L C) = Nonce ofr\"\nby (simp add: chain_def sign_def)\n\nsubsubsection\\<open>next shop\\<close>\n\nfun next_shop :: \"msg => agent\" where\n\"next_shop \\<lbrace>m1,Hash \\<lbrace>headL,Agent C\\<rbrace>\\<rbrace> = C\"\n\nlemma \"next_shop (chain B ofr A L C) = C\"\nby (simp add: chain_def sign_def)\n\nsubsubsection\\<open>anchor of the offer list\\<close>\n\ndefinition anchor :: \"agent => nat => agent => msg\" where\n\"anchor A n B == chain A n A (cons nil nil) B\"\n\nlemma anchor_inj [iff]:\n     \"(anchor A n B = anchor A' n' B') = (A=A' \\<and> n=n' \\<and> B=B')\"\nby (auto simp: anchor_def)\n\nlemma Nonce_in_anchor [iff]: \"Nonce n \\<in> parts {anchor A n B}\"\nby (auto simp: anchor_def)\n\nlemma shop_anchor [simp]: \"shop (anchor A n B) = Agent A\"\nby (simp add: anchor_def)\n\nsubsubsection\\<open>request event\\<close>\n\ndefinition reqm :: \"agent => nat => nat => msg => agent => msg\" where\n\"reqm A r n I B == \\<lbrace>Agent A, Number r, cons (Agent A) (cons (Agent B) I),\ncons (anchor A n B) nil\\<rbrace>\"\n\nlemma reqm_inj [iff]: \"(reqm A r n I B = reqm A' r' n' I' B')\n= (A=A' & r=r' & n=n' & I=I' & B=B')\"\nby (auto simp: reqm_def)\n\nlemma Nonce_in_reqm [iff]: \"Nonce n \\<in> parts {reqm A r n I B}\"\nby (auto simp: reqm_def)\n\ndefinition req :: \"agent => nat => nat => msg => agent => event\" where\n\"req A r n I B == Says A B (reqm A r n I B)\"\n\nlemma req_inj [iff]: \"(req A r n I B = req A' r' n' I' B')\n= (A=A' & r=r' & n=n' & I=I' & B=B')\"\nby (auto simp: req_def)\n\nsubsubsection\\<open>propose event\\<close>\n\ndefinition prom :: \"agent => nat => agent => nat => msg => msg =>\nmsg => agent => msg\" where\n\"prom B ofr A r I L J C == \\<lbrace>Agent A, Number r,\napp (J, del (Agent B, I)), cons (chain B ofr A L C) L\\<rbrace>\"\n\nlemma prom_inj [dest]: \"prom B ofr A r I L J C = prom B' ofr' A' r' I' L' J' C'\n\\<Longrightarrow> B=B' & ofr=ofr' & A=A' & r=r' & L=L' & C=C'\"\nby (auto simp: prom_def)\n\nlemma Nonce_in_prom [iff]: \"Nonce ofr \\<in> parts {prom B ofr A r I L J C}\"\nby (auto simp: prom_def)\n\ndefinition pro :: \"agent => nat => agent => nat => msg => msg =>\n                  msg => agent => event\" where\n\"pro B ofr A r I L J C == Says B C (prom B ofr A r I L J C)\"\n\nlemma pro_inj [dest]: \"pro B ofr A r I L J C = pro B' ofr' A' r' I' L' J' C'\n\\<Longrightarrow> B=B' & ofr=ofr' & A=A' & r=r' & L=L' & C=C'\"\nby (auto simp: pro_def dest: prom_inj)\n\nsubsubsection\\<open>protocol\\<close>\n\ninductive_set p2 :: \"event list set\"\nwhere\n\n  Nil: \"[] \\<in> p2\"\n\n| Fake: \"\\<lbrakk>evsf \\<in> p2; X \\<in> synth (analz (spies evsf))\\<rbrakk> \\<Longrightarrow> Says Spy B X # evsf \\<in> p2\"\n\n| Request: \"\\<lbrakk>evsr \\<in> p2; Nonce n \\<notin> used evsr; I \\<in> agl\\<rbrakk> \\<Longrightarrow> req A r n I B # evsr \\<in> p2\"\n\n| Propose: \"\\<lbrakk>evsp \\<in> p2; Says A' B \\<lbrace>Agent A,Number r,I,cons M L\\<rbrace> \\<in> set evsp;\n  I \\<in> agl; J \\<in> agl; isin (Agent C, app (J, del (Agent B, I)));\n  Nonce ofr \\<notin> used evsp\\<rbrakk> \\<Longrightarrow> pro B ofr A r I (cons M L) J C # evsp \\<in> p2\"\n\nsubsubsection\\<open>valid offer lists\\<close>\n\ninductive_set\n  valid :: \"agent \\<Rightarrow> nat \\<Rightarrow> agent \\<Rightarrow> msg set\"\n  for A :: agent and  n :: nat and B :: agent\nwhere\n  Request [intro]: \"cons (anchor A n B) nil \\<in> valid A n B\"\n\n| Propose [intro]: \"L \\<in> valid A n B\n  \\<Longrightarrow> cons (chain (next_shop (head L)) ofr A L C) L \\<in> valid A n B\"\n\nsubsubsection\\<open>basic properties of valid\\<close>\n\nlemma valid_not_empty: \"L \\<in> valid A n B \\<Longrightarrow> \\<exists>M L'. L = cons M L'\"\nby (erule valid.cases, auto)\n\nlemma valid_pos_len: \"L \\<in> valid A n B \\<Longrightarrow> 0 < len L\"\nby (erule valid.induct, auto)\n\nsubsubsection\\<open>list of offers\\<close>\n\nfun offers :: \"msg \\<Rightarrow> msg\"\nwhere\n  \"offers (cons M L) = cons \\<lbrace>shop M, nonce M\\<rbrace> (offers L)\"\n| \"offers other = nil\"\n\n\nsubsection\\<open>Properties of Protocol P2\\<close>\n\ntext\\<open>same as \\<open>P1_Prop\\<close> except that publicly verifiable forward\nintegrity is replaced by forward privacy\\<close>\n\nsubsection\\<open>strong forward integrity:\nexcept the last one, no offer can be modified\\<close>\n\nlemma strong_forward_integrity: \"\\<forall>L. Suc i < len L\n\\<longrightarrow> L \\<in> valid A n B \\<longrightarrow> repl (L,Suc i,M) \\<in> valid A n B \\<longrightarrow> M = ith (L,Suc i)\"\napply (induct i)\n(* i = 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\<lbrace>x,xa,l'a\\<rbrace> \\<in> valid A n B\" for x xa l'a)\napply (ind_cases \"\\<lbrace>x,M,l'a\\<rbrace> \\<in> valid A n B\" for x l'a)\napply (simp add: chain_def)\n(* i > 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\<lbrace>x,repl(l',Suc na,M)\\<rbrace> \\<in> valid A n B\" for x l' na)\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\<lbrace>x,l'\\<rbrace> \\<in> valid A n B\" for x l')\nby (drule_tac x=l' in spec, simp, blast)\n\nsubsection\\<open>insertion resilience:\nexcept at the beginning, no offer can be inserted\\<close>\n\nlemma chain_isnt_head [simp]: \"L \\<in> valid A n B \\<Longrightarrow>\nhead L \\<noteq> chain (next_shop (head L)) ofr A L C\"\nby (erule valid.induct, auto simp: chain_def sign_def anchor_def)\n\nlemma insertion_resilience: \"\\<forall>L. L \\<in> valid A n B \\<longrightarrow> Suc i < len L\n\\<longrightarrow> ins (L,Suc i,M) \\<notin> valid A n B\"\nsupply [[simproc del: defined_all]]\napply (induct i)\n(* i = 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\<lbrace>x,l'\\<rbrace> \\<in> valid A n B\" for x l', simp)\napply (ind_cases \"\\<lbrace>x,M,l'\\<rbrace> \\<in> valid A n B\" for x l', clarsimp)\napply (ind_cases \"\\<lbrace>head l',l'\\<rbrace> \\<in> valid A n B\" for l', simp, simp)\n(* i > 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\<lbrace>x,l'\\<rbrace> \\<in> valid A n B\" for x l')\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\<lbrace>x,ins(l',Suc na,M)\\<rbrace> \\<in> valid A n B\" for x l' na)\napply (frule len_not_empty, clarsimp)\nby (drule_tac x=l' in spec, clarsimp)\n\nsubsection\\<open>truncation resilience:\nonly shop i can truncate at offer i\\<close>\n\nlemma truncation_resilience: \"\\<forall>L. L \\<in> valid A n B \\<longrightarrow> Suc i < len L\n\\<longrightarrow> cons M (trunc (L,Suc i)) \\<in> valid A n B \\<longrightarrow> shop M = shop (ith (L,i))\"\napply (induct i)\n(* i = 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\<lbrace>x,l'\\<rbrace> \\<in> valid A n B\" for x l')\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\<lbrace>M,l'\\<rbrace> \\<in> valid A n B\" for l')\napply (frule len_not_empty, clarsimp, simp)\n(* i > 0 *)\napply clarify\napply (frule len_not_empty, clarsimp)\napply (ind_cases \"\\<lbrace>x,l'\\<rbrace> \\<in> valid A n B\" for x l')\napply (frule len_not_empty, clarsimp)\nby (drule_tac x=l' in spec, clarsimp)\n\nsubsection\\<open>declarations for tactics\\<close>\n\ndeclare knows_Spy_partsEs [elim]\ndeclare Fake_parts_insert [THEN subsetD, dest]\ndeclare initState.simps [simp del]\n\nsubsection\\<open>get components of a message\\<close>\n\nlemma get_ML [dest]: \"Says A' B \\<lbrace>A,R,I,M,L\\<rbrace> \\<in> set evs \\<Longrightarrow>\nM \\<in> parts (spies evs) \\<and> L \\<in> parts (spies evs)\"\nby blast\n\nsubsection\\<open>general properties of p2\\<close>\n\nlemma reqm_neq_prom [iff]:\n\"reqm A r n I B \\<noteq> prom B' ofr A' r' I' (cons M L) J C\"\nby (auto simp: reqm_def prom_def)\n\nlemma prom_neq_reqm [iff]:\n\"prom B' ofr A' r' I' (cons M L) J C \\<noteq> reqm A r n I B\"\nby (auto simp: reqm_def prom_def)\n\nlemma req_neq_pro [iff]: \"req A r n I B \\<noteq> pro B' ofr A' r' I' (cons M L) J C\"\nby (auto simp: req_def pro_def)\n\nlemma pro_neq_req [iff]: \"pro B' ofr A' r' I' (cons M L) J C \\<noteq> req A r n I B\"\nby (auto simp: req_def pro_def)\n\nlemma p2_has_no_Gets: \"evs \\<in> p2 \\<Longrightarrow> \\<forall>A X. Gets A X \\<notin> set evs\"\nby (erule p2.induct, auto simp: req_def pro_def)\n\nlemma p2_is_Gets_correct [iff]: \"Gets_correct p2\"\nby (auto simp: Gets_correct_def dest: p2_has_no_Gets)\n\nlemma p2_is_one_step [iff]: \"one_step p2\"\n  unfolding one_step_def by (clarify, ind_cases \"ev#evs \\<in> p2\" for ev evs, auto)\n\nlemma p2_has_only_Says' [rule_format]: \"evs \\<in> p2 \\<Longrightarrow>\nev \\<in> set evs \\<longrightarrow> (\\<exists>A B X. ev=Says A B X)\"\nby (erule p2.induct, auto simp: req_def pro_def)\n\nlemma p2_has_only_Says [iff]: \"has_only_Says p2\"\nby (auto simp: has_only_Says_def dest: p2_has_only_Says')\n\nlemma p2_is_regular [iff]: \"regular p2\"\napply (simp only: regular_def, clarify)\napply (erule_tac p2.induct)\napply (simp_all add: initState.simps knows.simps pro_def prom_def\nreq_def reqm_def anchor_def chain_def sign_def)\nby (auto dest: no_Key_in_agl no_Key_in_appdel parts_trans)\n\nsubsection\\<open>private keys are safe\\<close>\n\nlemma priK_parts_Friend_imp_bad [rule_format,dest]:\n     \"\\<lbrakk>evs \\<in> p2; Friend B \\<noteq> A\\<rbrakk>\n      \\<Longrightarrow> (Key (priK A) \\<in> parts (knows (Friend B) evs)) \\<longrightarrow> (A \\<in> bad)\"\napply (erule p2.induct)\napply (simp_all add: initState.simps knows.simps pro_def prom_def\n                req_def reqm_def anchor_def chain_def sign_def) \napply (blast dest: no_Key_in_agl)\napply (auto del: parts_invKey disjE  dest: parts_trans\n            simp add: no_Key_in_appdel)\ndone\n\nlemma priK_analz_Friend_imp_bad [rule_format,dest]:\n     \"\\<lbrakk>evs \\<in> p2; Friend B \\<noteq> A\\<rbrakk>\n\\<Longrightarrow> (Key (priK A) \\<in> analz (knows (Friend B) evs)) \\<longrightarrow> (A \\<in> bad)\"\nby auto\n\nlemma priK_notin_knows_max_Friend:\n     \"\\<lbrakk>evs \\<in> p2; A \\<notin> bad; A \\<noteq> Friend C\\<rbrakk>\n      \\<Longrightarrow> Key (priK A) \\<notin> analz (knows_max (Friend C) evs)\"\napply (rule not_parts_not_analz, simp add: knows_max_def, safe)\napply (drule_tac H=\"spies' evs\" in parts_sub)\napply (rule_tac p=p2 in knows_max'_sub_spies', simp+)\napply (drule_tac H=\"spies evs\" in parts_sub)\nby (auto dest: knows'_sub_knows [THEN subsetD] priK_notin_initState_Friend)\n\nsubsection\\<open>general guardedness properties\\<close>\n\nlemma agl_guard [intro]: \"I \\<in> agl \\<Longrightarrow> I \\<in> guard n Ks\"\nby (erule agl.induct, auto)\n\nlemma Says_to_knows_max'_guard: \"\\<lbrakk>Says A' C \\<lbrace>A'',r,I,L\\<rbrace> \\<in> set evs;\nGuard n Ks (knows_max' C evs)\\<rbrakk> \\<Longrightarrow> L \\<in> guard n Ks\"\nby (auto dest: Says_to_knows_max')\n\nlemma Says_from_knows_max'_guard: \"\\<lbrakk>Says C A' \\<lbrace>A'',r,I,L\\<rbrace> \\<in> set evs;\nGuard n Ks (knows_max' C evs)\\<rbrakk> \\<Longrightarrow> L \\<in> guard n Ks\"\nby (auto dest: Says_from_knows_max')\n\nlemma Says_Nonce_not_used_guard: \"\\<lbrakk>Says A' B \\<lbrace>A'',r,I,L\\<rbrace> \\<in> set evs;\nNonce n \\<notin> used evs\\<rbrakk> \\<Longrightarrow> L \\<in> guard n Ks\"\nby (drule not_used_not_parts, auto)\n\nsubsection\\<open>guardedness of messages\\<close>\n\nlemma chain_guard [iff]: \"chain B ofr A L C \\<in> guard n {priK A}\"\nby (case_tac \"ofr=n\", auto simp: chain_def sign_def)\n\nlemma chain_guard_Nonce_neq [intro]: \"n \\<noteq> ofr\n\\<Longrightarrow> chain B ofr A' L C \\<in> guard n {priK A}\"\nby (auto simp: chain_def sign_def)\n\nlemma anchor_guard [iff]: \"anchor A n' B \\<in> guard n {priK A}\"\nby (case_tac \"n'=n\", auto simp: anchor_def)\n\nlemma anchor_guard_Nonce_neq [intro]: \"n \\<noteq> n'\n\\<Longrightarrow> anchor A' n' B \\<in> guard n {priK A}\"\nby (auto simp: anchor_def)\n\nlemma reqm_guard [intro]: \"I \\<in> agl \\<Longrightarrow> reqm A r n' I B \\<in> guard n {priK A}\"\nby (case_tac \"n'=n\", auto simp: reqm_def)\n\nlemma reqm_guard_Nonce_neq [intro]: \"\\<lbrakk>n \\<noteq> n'; I \\<in> agl\\<rbrakk>\n\\<Longrightarrow> reqm A' r n' I B \\<in> guard n {priK A}\"\nby (auto simp: reqm_def)\n\nlemma prom_guard [intro]: \"\\<lbrakk>I \\<in> agl; J \\<in> agl; L \\<in> guard n {priK A}\\<rbrakk>\n\\<Longrightarrow> prom B ofr A r I L J C \\<in> guard n {priK A}\"\nby (auto simp: prom_def)\n\nlemma prom_guard_Nonce_neq [intro]: \"\\<lbrakk>n \\<noteq> ofr; I \\<in> agl; J \\<in> agl;\nL \\<in> guard n {priK A}\\<rbrakk> \\<Longrightarrow> prom B ofr A' r I L J C \\<in> guard n {priK A}\"\nby (auto simp: prom_def)\n\nsubsection\\<open>Nonce uniqueness\\<close>\n\nlemma uniq_Nonce_in_chain [dest]: \"Nonce k \\<in> parts {chain B ofr A L C} \\<Longrightarrow> k=ofr\"\nby (auto simp: chain_def sign_def)\n\nlemma uniq_Nonce_in_anchor [dest]: \"Nonce k \\<in> parts {anchor A n B} \\<Longrightarrow> k=n\"\nby (auto simp: anchor_def chain_def sign_def)\n\nlemma uniq_Nonce_in_reqm [dest]: \"\\<lbrakk>Nonce k \\<in> parts {reqm A r n I B};\nI \\<in> agl\\<rbrakk> \\<Longrightarrow> k=n\"\nby (auto simp: reqm_def dest: no_Nonce_in_agl)\n\nlemma uniq_Nonce_in_prom [dest]: \"\\<lbrakk>Nonce k \\<in> parts {prom B ofr A r I L J C};\nI \\<in> agl; J \\<in> agl; Nonce k \\<notin> parts {L}\\<rbrakk> \\<Longrightarrow> k=ofr\"\nby (auto simp: prom_def dest: no_Nonce_in_agl no_Nonce_in_appdel)\n\nsubsection\\<open>requests are guarded\\<close>\n\nlemma req_imp_Guard [rule_format]: \"\\<lbrakk>evs \\<in> p2; A \\<notin> bad\\<rbrakk> \\<Longrightarrow>\nreq A r n I B \\<in> set evs \\<longrightarrow> Guard n {priK A} (spies evs)\"\napply (erule p2.induct, simp)\napply (simp add: req_def knows.simps, safe)\napply (erule in_synth_Guard, erule Guard_analz, simp)\nby (auto simp: req_def pro_def dest: Says_imp_knows_Spy)\n\nlemma req_imp_Guard_Friend: \"\\<lbrakk>evs \\<in> p2; A \\<notin> bad; req A r n I B \\<in> set evs\\<rbrakk>\n\\<Longrightarrow> Guard n {priK A} (knows_max (Friend C) evs)\"\napply (rule Guard_knows_max')\napply (rule_tac H=\"spies evs\" in Guard_mono)\napply (rule req_imp_Guard, simp+)\napply (rule_tac B=\"spies' evs\" in subset_trans)\napply (rule_tac p=p2 in knows_max'_sub_spies', simp+)\nby (rule knows'_sub_knows)\n\nsubsection\\<open>propositions are guarded\\<close>\n\nlemma pro_imp_Guard [rule_format]: \"\\<lbrakk>evs \\<in> p2; B \\<notin> bad; A \\<notin> bad\\<rbrakk> \\<Longrightarrow>\npro B ofr A r I (cons M L) J C \\<in> set evs \\<longrightarrow> Guard ofr {priK A} (spies evs)\"\nsupply [[simproc del: defined_all]]\napply (erule p2.induct) (* +3 subgoals *)\n(* Nil *)\napply simp\n(* Fake *)\napply (simp add: pro_def, safe) (* +4 subgoals *)\n(* 1 *)\napply (erule in_synth_Guard, drule Guard_analz, simp, simp)\n(* 2 *)\napply simp\n(* 3 *)\napply (simp, simp add: req_def pro_def, blast)\n(* 4 *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard Nonce_not_used_Guard)\n(* 5 *)\napply simp\napply safe (* +1 subgoal *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard)\n(* 6 *)\napply (simp add: pro_def)\napply (blast dest: Says_imp_knows_Spy)\n(* Request *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard Nonce_not_used_Guard)\n(* Propose *)\napply simp\napply safe (* +1 subgoal *)\n(* 1 *)\napply (simp add: pro_def)\napply (blast dest: prom_inj Says_Nonce_not_used_guard)\n(* 2 *)\napply (simp add: pro_def)\nby (blast dest: Says_imp_knows_Spy)\n\nlemma pro_imp_Guard_Friend: \"\\<lbrakk>evs \\<in> p2; B \\<notin> bad; A \\<notin> bad;\npro B ofr A r I (cons M L) J C \\<in> set evs\\<rbrakk>\n\\<Longrightarrow> Guard ofr {priK A} (knows_max (Friend D) evs)\"\napply (rule Guard_knows_max')\napply (rule_tac H=\"spies evs\" in Guard_mono)\napply (rule pro_imp_Guard, simp+)\napply (rule_tac B=\"spies' evs\" in subset_trans)\napply (rule_tac p=p2 in knows_max'_sub_spies', simp+)\nby (rule knows'_sub_knows)\n\nsubsection\\<open>data confidentiality:\nno one other than the originator can decrypt the offers\\<close>\n\nlemma Nonce_req_notin_spies: \"\\<lbrakk>evs \\<in> p2; req A r n I B \\<in> set evs; A \\<notin> bad\\<rbrakk>\n\\<Longrightarrow> Nonce n \\<notin> analz (spies evs)\"\nby (frule req_imp_Guard, simp+, erule Guard_Nonce_analz, simp+)\n\nlemma Nonce_req_notin_knows_max_Friend: \"\\<lbrakk>evs \\<in> p2; req A r n I B \\<in> set evs;\nA \\<notin> bad; A \\<noteq> Friend C\\<rbrakk> \\<Longrightarrow> Nonce n \\<notin> analz (knows_max (Friend C) evs)\"\napply (clarify, frule_tac C=C in req_imp_Guard_Friend, simp+)\napply (simp add: knows_max_def, drule Guard_invKey_keyset, simp+)\nby (drule priK_notin_knows_max_Friend, auto simp: knows_max_def)\n\nlemma Nonce_pro_notin_spies: \"\\<lbrakk>evs \\<in> p2; B \\<notin> bad; A \\<notin> bad;\npro B ofr A r I (cons M L) J C \\<in> set evs\\<rbrakk> \\<Longrightarrow> Nonce ofr \\<notin> analz (spies evs)\"\nby (frule pro_imp_Guard, simp+, erule Guard_Nonce_analz, simp+)\n\nlemma Nonce_pro_notin_knows_max_Friend: \"\\<lbrakk>evs \\<in> p2; B \\<notin> bad; A \\<notin> bad;\nA \\<noteq> Friend D; pro B ofr A r I (cons M L) J C \\<in> set evs\\<rbrakk>\n\\<Longrightarrow> Nonce ofr \\<notin> analz (knows_max (Friend D) evs)\"\napply (clarify, frule_tac A=A in pro_imp_Guard_Friend, simp+)\napply (simp add: knows_max_def, drule Guard_invKey_keyset, simp+)\nby (drule priK_notin_knows_max_Friend, auto simp: knows_max_def)\n\nsubsection\\<open>forward privacy:\nonly the originator can know the identity of the shops\\<close>\n\nlemma forward_privacy_Spy: \"\\<lbrakk>evs \\<in> p2; B \\<notin> bad; A \\<notin> bad;\npro B ofr A r I (cons M L) J C \\<in> set evs\\<rbrakk>\n\\<Longrightarrow> sign B (Nonce ofr) \\<notin> analz (spies evs)\"\nby (auto simp:sign_def dest: Nonce_pro_notin_spies)\n\nlemma forward_privacy_Friend: \"\\<lbrakk>evs \\<in> p2; B \\<notin> bad; A \\<notin> bad; A \\<noteq> Friend D;\npro B ofr A r I (cons M L) J C \\<in> set evs\\<rbrakk>\n\\<Longrightarrow> sign B (Nonce ofr) \\<notin> analz (knows_max (Friend D) evs)\"\nby (auto simp:sign_def dest:Nonce_pro_notin_knows_max_Friend )\n\nsubsection\\<open>non repudiability: an offer signed by B has been sent by B\\<close>\n\nlemma Crypt_reqm: \"\\<lbrakk>Crypt (priK A) X \\<in> parts {reqm A' r n I B}; I \\<in> agl\\<rbrakk> \\<Longrightarrow> A=A'\"\nby (auto simp: reqm_def anchor_def chain_def sign_def dest: no_Crypt_in_agl)\n\nlemma Crypt_prom: \"\\<lbrakk>Crypt (priK A) X \\<in> parts {prom B ofr A' r I L J C};\nI \\<in> agl; J \\<in> agl\\<rbrakk> \\<Longrightarrow> A=B | Crypt (priK A) X \\<in> parts {L}\"\napply (simp add: prom_def anchor_def chain_def sign_def)\nby (blast dest: no_Crypt_in_agl no_Crypt_in_appdel)\n\nlemma Crypt_safeness: \"\\<lbrakk>evs \\<in> p2; A \\<notin> bad\\<rbrakk> \\<Longrightarrow> Crypt (priK A) X \\<in> parts (spies evs)\n\\<longrightarrow> (\\<exists>B Y. Says A B Y \\<in> set evs & Crypt (priK A) X \\<in> parts {Y})\"\napply (erule p2.induct)\n(* Nil *)\napply simp\n(* Fake *)\napply clarsimp\napply (drule_tac P=\"\\<lambda>G. Crypt (priK A) X \\<in> G\" in parts_insert_substD, simp)\napply (erule disjE)\napply (drule_tac K=\"priK A\" in Crypt_synth, simp+, blast, blast)\n(* Request *)\napply (simp add: req_def, clarify)\napply (drule_tac P=\"\\<lambda>G. Crypt (priK A) X \\<in> G\" in parts_insert_substD, simp)\napply (erule disjE)\napply (frule Crypt_reqm, simp, clarify)\napply (rule_tac x=B in exI, rule_tac x=\"reqm A r n I B\" in exI, simp, blast)\n(* Propose *)\napply (simp add: pro_def, clarify)\napply (drule_tac P=\"\\<lambda>G. Crypt (priK A) X \\<in> G\" in parts_insert_substD, simp)\napply (rotate_tac -1, erule disjE)\napply (frule Crypt_prom, simp, simp)\napply (rotate_tac -1, erule disjE)\napply (rule_tac x=C in exI)\napply (rule_tac x=\"prom B ofr Aa r I (cons M L) J C\" in exI, blast)\napply (subgoal_tac \"cons M L \\<in> parts (spies evsp)\")\napply (drule_tac G=\"{cons M L}\" and H=\"spies evsp\" in parts_trans, blast, blast)\napply (drule Says_imp_spies, rotate_tac -1, drule parts.Inj)\napply (drule parts.Snd, drule parts.Snd, drule parts.Snd)\nby auto\n\nlemma Crypt_Hash_imp_sign: \"\\<lbrakk>evs \\<in> p2; A \\<notin> bad\\<rbrakk> \\<Longrightarrow>\nCrypt (priK A) (Hash X) \\<in> parts (spies evs)\n\\<longrightarrow> (\\<exists>B Y. Says A B Y \\<in> set evs \\<and> sign A X \\<in> parts {Y})\"\napply (erule p2.induct)\n(* Nil *)\napply simp\n(* Fake *)\napply clarsimp\napply (drule_tac P=\"\\<lambda>G. Crypt (priK A) (Hash X) \\<in> G\" in parts_insert_substD)\napply simp\napply (erule disjE)\napply (drule_tac K=\"priK A\" in Crypt_synth, simp+, blast, blast)\n(* Request *)\napply (simp add: req_def, clarify)\napply (drule_tac P=\"\\<lambda>G. Crypt (priK A) (Hash X) \\<in> G\" in parts_insert_substD)\napply simp\napply (erule disjE)\napply (frule Crypt_reqm, simp+)\napply (rule_tac x=B in exI, rule_tac x=\"reqm Aa r n I B\" in exI)\napply (simp add: reqm_def sign_def anchor_def no_Crypt_in_agl)\napply (simp add: chain_def sign_def, blast)\n(* Propose *)\napply (simp add: pro_def, clarify)\napply (drule_tac P=\"\\<lambda>G. Crypt (priK A) (Hash X) \\<in> G\" in parts_insert_substD)\napply simp\napply (rotate_tac -1, erule disjE)\napply (simp add: prom_def sign_def no_Crypt_in_agl no_Crypt_in_appdel)\napply (simp add: chain_def sign_def)\napply (rotate_tac -1, erule disjE)\napply (rule_tac x=C in exI)\napply (rule_tac x=\"prom B ofr Aa r I (cons M L) J C\" in exI)\napply (simp add: prom_def chain_def sign_def)\napply (erule impE) \napply (blast dest: get_ML parts_sub) \napply (blast del: MPair_parts)+\ndone\n\nlemma sign_safeness: \"\\<lbrakk>evs \\<in> p2; A \\<notin> bad\\<rbrakk> \\<Longrightarrow> sign A X \\<in> parts (spies evs)\n\\<longrightarrow> (\\<exists>B Y. Says A B Y \\<in> set evs \\<and> sign A X \\<in> parts {Y})\"\napply (clarify, simp add: sign_def, frule parts.Snd)\napply (blast dest: Crypt_Hash_imp_sign [unfolded sign_def])\ndone\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/Guard/P2.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878555160665, "lm_q2_score": 0.4882833952958347, "lm_q1q2_score": 0.3003371864966187}}
{"text": "theory AOT_misc\n  imports AOT_NaturalNumbers\nbegin\n\nsection\\<open>Miscellaneous Theorems\\<close>\n\nAOT_theorem PossiblyNumbersEmptyPropertyImpliesZero:\n  \\<open>\\<diamond>Numbers(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]) \\<rightarrow> x = 0\\<close>\nproof(rule \"\\<rightarrow>I\")\n  AOT_have \\<open>Rigid([\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n  proof (safe intro!: \"df-rigid-rel:1\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"] \"&I\" \"cqt:2\";\n         rule RN; safe intro!: GEN \"\\<rightarrow>I\")\n    AOT_modally_strict {\n      fix x\n      AOT_assume \\<open>[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]x\\<close>\n      AOT_hence \\<open>O!x & x \\<noteq>\\<^sub>E x\\<close> by (rule \"\\<beta>\\<rightarrow>C\")\n      moreover AOT_have \\<open>x =\\<^sub>E x\\<close> using calculation[THEN \"&E\"(1)] \n        by (metis \"ord=Eequiv:1\" \"vdash-properties:10\")\n      ultimately AOT_have \\<open>x =\\<^sub>E x & \\<not>x =\\<^sub>E x\\<close>\n        by (metis \"con-dis-i-e:1\" \"con-dis-i-e:2:b\" \"intro-elim:3:a\" \"thm-neg=E\")\n      AOT_thus \\<open>\\<box>[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]x\\<close> using \"raa-cor:1\" by blast\n    }\n  qed\n  AOT_hence \\<open>\\<box>\\<forall>x (Numbers(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]) \\<rightarrow> \\<box>Numbers(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]))\\<close>\n    by (safe intro!: \"num-cont:2\"[unvarify G, THEN \"\\<rightarrow>E\"] \"cqt:2\")\n  AOT_hence \\<open>\\<forall>x \\<box>(Numbers(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]) \\<rightarrow> \\<box>Numbers(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]))\\<close>\n    using \"BFs:2\"[THEN \"\\<rightarrow>E\"] by blast\n  AOT_hence \\<open>\\<box>(Numbers(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]) \\<rightarrow> \\<box>Numbers(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]))\\<close>\n    using \"\\<forall>E\"(2) by auto\n  moreover AOT_assume \\<open>\\<diamond>Numbers(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n  ultimately AOT_have \\<open>\\<^bold>\\<A>Numbers(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n    using \"sc-eq-box-box:1\"[THEN \"\\<equiv>E\"(1), THEN \"\\<rightarrow>E\", THEN \"nec-imp-act\"[THEN \"\\<rightarrow>E\"]]\n    by blast\n  AOT_hence \\<open>Numbers(x,[\\<lambda>z \\<^bold>\\<A>[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]z])\\<close>\n    by (safe intro!: \"eq-num:1\"[unvarify G, THEN \"\\<equiv>E\"(1)] \"cqt:2\")\n  AOT_hence \\<open>x = #[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]\\<close>\n    by (safe intro!: \"eq-num:2\"[unvarify G, THEN \"\\<equiv>E\"(1)] \"cqt:2\")\n  AOT_thus \\<open>x = 0\\<close>\n    using \"cqt:2\"(1) \"rule-id-df:2:b[zero]\" \"rule=E\" \"zero:1\" by blast\nqed\n\nAOT_define Numbers' :: \\<open>\\<tau> \\<Rightarrow> \\<tau> \\<Rightarrow> \\<phi>\\<close> (\\<open>Numbers'''(_,_')\\<close>)\n  \\<open>Numbers'(x, G) \\<equiv>\\<^sub>d\\<^sub>f A!x & G\\<down> & \\<forall>F (x[F] \\<equiv> F \\<approx>\\<^sub>E G)\\<close>\nAOT_theorem Numbers'equiv: \\<open>Numbers'(x,G) \\<equiv> A!x & \\<forall>F (x[F] \\<equiv> F \\<approx>\\<^sub>E G)\\<close>\n  by (AOT_subst_def Numbers')\n     (auto intro!: \"\\<equiv>I\" \"\\<rightarrow>I\" \"&I\" \"cqt:2\" dest: \"&E\")\n\nAOT_theorem Numbers'DistinctZeroes:\n  \\<open>\\<exists>x\\<exists>y (\\<diamond>Numbers'(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]) & \\<diamond>Numbers'(y,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]) & x \\<noteq> y)\\<close>\nproof -\n  AOT_obtain w\\<^sub>1 where \\<open>\\<exists>w w\\<^sub>1 \\<noteq> w\\<close>\n    using \"two-worlds-exist:4\" \"PossibleWorld.\\<exists>E\"[rotated] by fast\n  then AOT_obtain w\\<^sub>2 where distinct_worlds: \\<open>w\\<^sub>1 \\<noteq> w\\<^sub>2\\<close>\n    using \"PossibleWorld.\\<exists>E\"[rotated] by blast\n  AOT_obtain x where x_prop:\n    \\<open>A!x & \\<forall>F (x[F] \\<equiv> w\\<^sub>1 \\<Turnstile> F \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n    using \"A-objects\"[axiom_inst] \"\\<exists>E\"[rotated] by fast\n  moreover AOT_obtain y where y_prop:\n    \\<open>A!y & \\<forall>F (y[F] \\<equiv> w\\<^sub>2 \\<Turnstile> F \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n    using \"A-objects\"[axiom_inst] \"\\<exists>E\"[rotated] by fast\n  moreover {\n    fix x w\n    AOT_assume x_prop: \\<open>A!x & \\<forall>F (x[F] \\<equiv> w \\<Turnstile> F \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n    AOT_have \\<open>\\<forall>F w \\<Turnstile> (x[F] \\<equiv> F \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n    proof(safe intro!: GEN \"conj-dist-w:4\"[unvarify p q, OF \"log-prop-prop:2\",\n                              OF \"log-prop-prop:2\",THEN \"\\<equiv>E\"(2)] \"\\<equiv>I\" \"\\<rightarrow>I\")\n      fix F\n      AOT_assume \\<open>w \\<Turnstile> x[F]\\<close>\n      AOT_hence \\<open>\\<diamond>x[F]\\<close>\n        using \"fund:1\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(2),\n                       OF \"PossibleWorld.\\<exists>I\"] by blast\n      AOT_hence \\<open>x[F]\\<close>\n        by (metis \"en-eq:3[1]\" \"intro-elim:3:a\")\n      AOT_thus \\<open>w \\<Turnstile> (F \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n        using x_prop[THEN \"&E\"(2), THEN \"\\<forall>E\"(2), THEN \"\\<equiv>E\"(1)] by blast\n    next\n      fix F\n      AOT_assume \\<open>w \\<Turnstile> (F \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n      AOT_hence \\<open>x[F]\\<close>\n        using x_prop[THEN \"&E\"(2), THEN \"\\<forall>E\"(2), THEN \"\\<equiv>E\"(2)] by blast\n      AOT_hence \\<open>\\<box>x[F]\\<close>\n        using \"pre-en-eq:1[1]\"[THEN \"\\<rightarrow>E\"] by blast\n      AOT_thus \\<open>w \\<Turnstile> x[F]\\<close>\n        using \"fund:2\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1)]\n              \"PossibleWorld.\\<forall>E\" by fast\n    qed\n    AOT_hence \\<open>w \\<Turnstile> \\<forall>F (x[F] \\<equiv> F \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n      using \"conj-dist-w:5\"[THEN \"\\<equiv>E\"(2)] by fast\n    moreover {\n      AOT_have \\<open>\\<box>[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]\\<down>\\<close>\n        by (safe intro!: RN \"cqt:2\")\n      AOT_hence \\<open>w \\<Turnstile> [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]\\<down>\\<close>\n        using \"fund:2\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1),\n                       THEN \"PossibleWorld.\\<forall>E\"] by blast\n    }\n    moreover {\n      AOT_have \\<open>\\<box>A!x\\<close>\n        using x_prop[THEN \"&E\"(1)] by (metis \"oa-facts:2\" \"\\<rightarrow>E\")\n      AOT_hence \\<open>w \\<Turnstile> A!x\\<close>\n        using \"fund:2\"[unvarify p, OF \"log-prop-prop:2\",\n                       THEN \"\\<equiv>E\"(1), THEN \"PossibleWorld.\\<forall>E\"] by blast\n    }\n    ultimately AOT_have \\<open>w \\<Turnstile> (A!x & [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]\\<down> &\n                               \\<forall>F (x[F] \\<equiv> F \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]))\\<close>\n      using \"conj-dist-w:1\"[unvarify p q, OF \"log-prop-prop:2\",\n              OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(2), OF \"&I\"] by auto\n    AOT_hence \\<open>\\<exists>w w \\<Turnstile> (A!x & [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]\\<down> &\n                        \\<forall>F (x[F] \\<equiv> F \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]))\\<close>\n      using \"PossibleWorld.\\<exists>I\" by auto\n    AOT_hence \\<open>\\<diamond>(A!x & [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]\\<down> & \\<forall>F (x[F] \\<equiv> F \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]))\\<close>\n      using \"fund:1\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(2)] by blast\n    AOT_hence \\<open>\\<diamond>Numbers'(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n      by (AOT_subst_def Numbers')\n  }\n  ultimately AOT_have \\<open>\\<diamond>Numbers'(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n                  and \\<open>\\<diamond>Numbers'(y,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\\<close>\n    by auto\n  moreover AOT_have \\<open>x \\<noteq> y\\<close>\n  proof (rule \"ab-obey:2\"[THEN \"\\<rightarrow>E\"])\n    AOT_have \\<open>\\<box>\\<not>\\<exists>u [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]u\\<close>\n    proof (safe intro!: RN \"raa-cor:2\")\n      AOT_modally_strict {\n        AOT_assume \\<open>\\<exists>u [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]u\\<close>\n        then AOT_obtain u where \\<open>[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]u\\<close>\n          using \"Ordinary.\\<exists>E\"[rotated] by blast\n        AOT_hence \\<open>O!u & u \\<noteq>\\<^sub>E u\\<close>\n          by (rule \"\\<beta>\\<rightarrow>C\")\n        AOT_hence \\<open>\\<not>(u =\\<^sub>E u)\\<close>\n          by (metis \"con-dis-taut:2\" \"intro-elim:3:d\" \"modus-tollens:1\"\n                    \"raa-cor:3\" \"thm-neg=E\")\n        AOT_hence \\<open>u =\\<^sub>E u & \\<not>u =\\<^sub>E u\\<close>\n          by (metis \"modus-tollens:1\" \"ord=Eequiv:1\" \"raa-cor:3\" Ordinary.\\<psi>)\n        AOT_thus \\<open>p & \\<not>p\\<close> for p\n          by (metis \"raa-cor:1\")\n      }\n    qed\n    AOT_hence nec_not_ex: \\<open>\\<forall>w w \\<Turnstile> \\<not>\\<exists>u [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]u\\<close>\n      using \"fund:2\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1)] by blast\n    AOT_have \\<open>\\<box>([\\<lambda>y p]x \\<equiv> p)\\<close> for x p\n      by (safe intro!: RN \"beta-C-meta\"[THEN \"\\<rightarrow>E\"] \"cqt:2\")\n    AOT_hence \\<open>\\<forall>w w \\<Turnstile> ([\\<lambda>y p]x \\<equiv> p)\\<close> for x p\n      using \"fund:2\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1)] by blast\n    AOT_hence world_prop_beta: \\<open>\\<forall>w (w \\<Turnstile> [\\<lambda>y p]x \\<equiv> w \\<Turnstile> p)\\<close> for x p\n      using \"conj-dist-w:4\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1)]\n            \"PossibleWorld.\\<forall>E\" \"PossibleWorld.\\<forall>I\" by meson\n\n    AOT_have \\<open>\\<exists>p (w\\<^sub>1 \\<Turnstile> p & \\<not>w\\<^sub>2 \\<Turnstile> p)\\<close>\n    proof(rule \"raa-cor:1\")\n      AOT_assume 0: \\<open>\\<not>\\<exists>p (w\\<^sub>1 \\<Turnstile> p & \\<not>w\\<^sub>2 \\<Turnstile> p)\\<close>\n      AOT_have 1: \\<open>w\\<^sub>1 \\<Turnstile> p \\<rightarrow> w\\<^sub>2 \\<Turnstile> p\\<close> for p\n      proof(safe intro!: GEN \"\\<rightarrow>I\")\n        AOT_assume \\<open>w\\<^sub>1 \\<Turnstile> p\\<close>\n        AOT_thus \\<open>w\\<^sub>2 \\<Turnstile> p\\<close>\n          using 0 \"con-dis-i-e:1\" \"\\<exists>I\"(2) \"raa-cor:4\" by fast\n      qed\n      moreover AOT_have \\<open>w\\<^sub>2 \\<Turnstile> p \\<rightarrow> w\\<^sub>1 \\<Turnstile> p\\<close> for p\n      proof(safe intro!: GEN \"\\<rightarrow>I\")\n        AOT_assume \\<open>w\\<^sub>2 \\<Turnstile> p\\<close>\n        AOT_hence \\<open>\\<not>w\\<^sub>2 \\<Turnstile> \\<not>p\\<close>\n          using \"coherent:2\" \"intro-elim:3:a\" by blast\n        AOT_hence \\<open>\\<not>w\\<^sub>1 \\<Turnstile> \\<not>p\\<close>\n          using 1[\"\\<forall>I\" p, THEN \"\\<forall>E\"(1), OF \"log-prop-prop:2\"]\n          by (metis \"modus-tollens:1\")\n        AOT_thus \\<open>w\\<^sub>1 \\<Turnstile> p\\<close>\n          using \"coherent:1\" \"intro-elim:3:b\" \"reductio-aa:1\" by blast\n      qed\n      ultimately AOT_have \\<open>w\\<^sub>1 \\<Turnstile> p \\<equiv> w\\<^sub>2 \\<Turnstile> p\\<close> for p\n        by (metis \"intro-elim:2\")\n      AOT_hence \\<open>w\\<^sub>1 = w\\<^sub>2\\<close>\n        using \"sit-identity\"[unconstrain s, THEN \"\\<rightarrow>E\",\n            OF PossibleWorld.\\<psi>[THEN \"world:1\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"], THEN \"&E\"(1)],\n            unconstrain s', THEN \"\\<rightarrow>E\",\n            OF PossibleWorld.\\<psi>[THEN \"world:1\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"], THEN \"&E\"(1)],\n            THEN \"\\<equiv>E\"(2)] GEN by fast\n      AOT_thus \\<open>w\\<^sub>1 = w\\<^sub>2 & \\<not>w\\<^sub>1 = w\\<^sub>2\\<close>\n        using  \"=-infix\" \"\\<equiv>\\<^sub>d\\<^sub>fE\" \"con-dis-i-e:1\" distinct_worlds by blast\n    qed\n    then AOT_obtain p where 0: \\<open>w\\<^sub>1 \\<Turnstile> p & \\<not>w\\<^sub>2 \\<Turnstile> p\\<close>\n      using \"\\<exists>E\"[rotated] by blast\n    AOT_have \\<open>y[\\<lambda>y p]\\<close>\n    proof (safe intro!: y_prop[THEN \"&E\"(2), THEN \"\\<forall>E\"(1), THEN \"\\<equiv>E\"(2)] \"cqt:2\")\n      AOT_show \\<open>w\\<^sub>2 \\<Turnstile> [\\<lambda>y p] \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]\\<close>\n      proof (safe intro!:  \"cqt:2\" \"empty-approx:1\"[unvarify F H, THEN RN,\n                  THEN \"fund:2\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1)],\n                  THEN \"PossibleWorld.\\<forall>E\",\n                  THEN \"conj-dist-w:2\"[unvarify p q, OF \"log-prop-prop:2\",\n                                       OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1)],\n                                       THEN \"\\<rightarrow>E\"]\n                  \"conj-dist-w:1\"[unvarify p q, OF \"log-prop-prop:2\",\n                                  OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(2)] \"&I\")\n        AOT_have \\<open>\\<not>w\\<^sub>2 \\<Turnstile> \\<exists>u [\\<lambda>y p]u\\<close>\n        proof (rule \"raa-cor:2\")\n          AOT_assume \\<open>w\\<^sub>2 \\<Turnstile> \\<exists>u [\\<lambda>y p]u\\<close>\n          AOT_hence \\<open>\\<exists>x w\\<^sub>2 \\<Turnstile> (O!x & [\\<lambda>y p]x)\\<close>\n            by (metis \"conj-dist-w:6\" \"intro-elim:3:a\")\n          then AOT_obtain x where \\<open>w\\<^sub>2 \\<Turnstile> (O!x & [\\<lambda>y p]x)\\<close>\n            using \"\\<exists>E\"[rotated] by blast\n          AOT_hence \\<open>w\\<^sub>2 \\<Turnstile> [\\<lambda>y p]x\\<close>\n            using \"conj-dist-w:1\"[unvarify p q, OF \"log-prop-prop:2\",\n                    OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1), THEN \"&E\"(2)] by blast\n          AOT_hence \\<open>w\\<^sub>2 \\<Turnstile> p\\<close>\n            using world_prop_beta[THEN \"PossibleWorld.\\<forall>E\", THEN \"\\<equiv>E\"(1)] by blast\n          AOT_thus \\<open>w\\<^sub>2 \\<Turnstile> p & \\<not>w\\<^sub>2 \\<Turnstile> p\\<close>\n            using 0[THEN \"&E\"(2)] \"&I\" by blast\n        qed\n        AOT_thus \\<open>w\\<^sub>2 \\<Turnstile> \\<not>\\<exists>u [\\<lambda>y p]u\\<close>\n          by (safe intro!: \"coherent:1\"[unvarify p, OF \"log-prop-prop:2\",\n                                        THEN \"\\<equiv>E\"(2)])\n      next\n        AOT_show \\<open>w\\<^sub>2 \\<Turnstile> \\<not>\\<exists>v [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]v\\<close>\n          using nec_not_ex[THEN \"PossibleWorld.\\<forall>E\"] by blast\n      qed\n    qed\n    moreover AOT_have \\<open>\\<not>x[\\<lambda>y p]\\<close>\n    proof(rule \"raa-cor:2\")\n      AOT_assume \\<open>x[\\<lambda>y p]\\<close>\n      AOT_hence \"w\\<^sub>1 \\<Turnstile> [\\<lambda>y p] \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]\"\n        using x_prop[THEN \"&E\"(2), THEN \"\\<forall>E\"(1), THEN \"\\<equiv>E\"(1)]\n              \"prop-prop2:2\" by blast\n      AOT_hence \"\\<not>w\\<^sub>1 \\<Turnstile> \\<not>[\\<lambda>y p] \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]\"\n        using \"coherent:2\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1)] by blast\n      moreover AOT_have \"w\\<^sub>1 \\<Turnstile> \\<not>([\\<lambda>y p] \\<approx>\\<^sub>E [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z])\"\n      proof (safe intro!: \"cqt:2\" \"empty-approx:2\"[unvarify F H, THEN RN,\n                    THEN \"fund:2\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1)],\n                    THEN \"PossibleWorld.\\<forall>E\",\n                    THEN \"conj-dist-w:2\"[unvarify p q, OF \"log-prop-prop:2\",\n                        OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1)], THEN \"\\<rightarrow>E\"]\n                    \"conj-dist-w:1\"[unvarify p q, OF \"log-prop-prop:2\",\n                                    OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(2)] \"&I\")\n        fix u\n        AOT_have \\<open>w\\<^sub>1 \\<Turnstile> O!u\\<close>\n          using Ordinary.\\<psi>[THEN RN,\n                  THEN \"fund:2\"[unvarify p, OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(1)],\n                  THEN \"PossibleWorld.\\<forall>E\"] by simp\n        moreover AOT_have \\<open>w\\<^sub>1 \\<Turnstile> [\\<lambda>y p]u\\<close>\n          by (safe intro!: world_prop_beta[THEN \"PossibleWorld.\\<forall>E\", THEN \"\\<equiv>E\"(2)]\n                           0[THEN \"&E\"(1)])\n        ultimately AOT_have \\<open>w\\<^sub>1 \\<Turnstile> (O!u & [\\<lambda>y p]u)\\<close>\n          using \"conj-dist-w:1\"[unvarify p q, OF \"log-prop-prop:2\",\n                                OF \"log-prop-prop:2\", THEN \"\\<equiv>E\"(2),\n                                OF \"&I\"] by blast\n        AOT_hence \\<open>\\<exists>x w\\<^sub>1 \\<Turnstile> (O!x & [\\<lambda>y p]x)\\<close>\n          by (rule \"\\<exists>I\")\n        AOT_thus \\<open>w\\<^sub>1 \\<Turnstile> \\<exists>u [\\<lambda>y p]u\\<close>\n          by (metis \"conj-dist-w:6\" \"intro-elim:3:b\")\n      next\n        AOT_show \\<open>w\\<^sub>1 \\<Turnstile> \\<not>\\<exists>v [\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]v\\<close>\n          using \"PossibleWorld.\\<forall>E\" nec_not_ex by fastforce\n      qed\n      ultimately AOT_show \\<open>p & \\<not>p\\<close> for p\n        using \"raa-cor:3\" by blast\n    qed\n    ultimately AOT_have \\<open>y[\\<lambda>y p] & \\<not>x[\\<lambda>y p]\\<close>\n      using \"&I\" by blast\n    AOT_hence \\<open>\\<exists>F (y[F] & \\<not>x[F])\\<close>\n      by (metis \"existential:1\" \"prop-prop2:2\")\n    AOT_thus \\<open>\\<exists>F (x[F] & \\<not>y[F]) \\<or> \\<exists>F (y[F] & \\<not>x[F])\\<close>\n      by (rule \"\\<or>I\")\n  qed\n  ultimately AOT_have \\<open>\\<diamond>Numbers'(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]) &\n                       \\<diamond>Numbers'(y,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]) & x \\<noteq> y\\<close>\n    using \"&I\" by blast\n  AOT_thus \\<open>\\<exists>x\\<exists>y (\\<diamond>Numbers'(x,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]) &\n                  \\<diamond>Numbers'(y,[\\<lambda>z O!z & z \\<noteq>\\<^sub>E z]) & x \\<noteq> y)\\<close>\n    using \"\\<exists>I\"(2)[where \\<beta>=x] \"\\<exists>I\"(2)[where \\<beta>=y] by auto\nqed\n\nAOT_theorem restricted_identity:\n  \\<open>x =\\<^sub>\\<R> y \\<equiv> (InDomainOf(x,\\<R>) & InDomainOf(y,\\<R>) & x = y)\\<close>\n  by (auto intro!: \"\\<equiv>I\" \"\\<rightarrow>I\" \"&I\"\n             dest: \"id-R-thm:2\"[THEN \"\\<rightarrow>E\"] \"&E\"\n                   \"id-R-thm:3\"[THEN \"\\<rightarrow>E\"]\n                   \"id-R-thm:4\"[THEN \"\\<rightarrow>E\", OF \"\\<or>I\"(1), THEN \"\\<equiv>E\"(2)])\n\nAOT_theorem induction': \\<open>\\<forall>F ([F]0 & \\<forall>n([F]n \\<rightarrow> [F]n\\<^bold>') \\<rightarrow> \\<forall>n [F]n)\\<close>\nproof(rule GEN; rule \"\\<rightarrow>I\")\n  fix F n\n  AOT_assume A: \\<open>[F]0 & \\<forall>n([F]n \\<rightarrow> [F]n\\<^bold>')\\<close>\n  AOT_have \\<open>\\<forall>n\\<forall>m([\\<bbbP>]nm \\<rightarrow> ([F]n \\<rightarrow> [F]m))\\<close>\n  proof(safe intro!: \"Number.GEN\" \"\\<rightarrow>I\")\n    fix n m\n    AOT_assume \\<open>[\\<bbbP>]nm\\<close>\n    moreover AOT_have \\<open>[\\<bbbP>]n n\\<^bold>'\\<close>\n      using \"suc-thm\".\n    ultimately AOT_have m_eq_suc_n: \\<open>m = n\\<^bold>'\\<close>\n      using \"pred-func:1\"[unvarify z, OF \"def-suc[den2]\", THEN \"\\<rightarrow>E\", OF \"&I\"]\n      by blast\n    AOT_assume \\<open>[F]n\\<close>\n    AOT_hence \\<open>[F]n\\<^bold>'\\<close>\n      using A[THEN \"&E\"(2), THEN \"Number.\\<forall>E\", THEN \"\\<rightarrow>E\"] by blast\n    AOT_thus \\<open>[F]m\\<close>\n      using m_eq_suc_n[symmetric] \"rule=E\" by fast\n  qed\n  AOT_thus \\<open>\\<forall>n[F]n\\<close>\n    using induction[THEN \"\\<forall>E\"(2), THEN \"\\<rightarrow>E\", OF \"&I\", OF A[THEN \"&E\"(1)]]\n    by simp\nqed\n\nAOT_define ExtensionOf :: \\<open>\\<tau> \\<Rightarrow> \\<Pi> \\<Rightarrow> \\<phi>\\<close> (\\<open>ExtensionOf'(_,_')\\<close>)\n  \"exten-property:1\": \\<open>ExtensionOf(x,[G]) \\<equiv>\\<^sub>d\\<^sub>f A!x & G\\<down> & \\<forall>F(x[F] \\<equiv> \\<forall>z([F]z \\<equiv> [G]z))\\<close>\n\nAOT_define OrdinaryExtensionOf :: \\<open>\\<tau> \\<Rightarrow> \\<Pi> \\<Rightarrow> \\<phi>\\<close> (\\<open>OrdinaryExtensionOf'(_,_')\\<close>)\n   \\<open>OrdinaryExtensionOf(x,[G]) \\<equiv>\\<^sub>d\\<^sub>f A!x & G\\<down> & \\<forall>F(x[F] \\<equiv> \\<forall>z(O!z \\<rightarrow> ([F]z \\<equiv> [G]z)))\\<close>\n\nAOT_theorem BeingOrdinaryExtensionOfDenotes:\n  \\<open>[\\<lambda>x OrdinaryExtensionOf(x,[G])]\\<down>\\<close>\nproof(rule \"safe-ext\"[axiom_inst, THEN \"\\<rightarrow>E\", OF \"&I\"])\n  AOT_show \\<open>[\\<lambda>x A!x & G\\<down> & [\\<lambda>x \\<forall>F(x[F] \\<equiv> \\<forall>z(O!z \\<rightarrow> ([F]z \\<equiv> [G]z)))]x]\\<down>\\<close>\n    by \"cqt:2\"\nnext\n  AOT_show \\<open>\\<box>\\<forall>x (A!x & G\\<down> & [\\<lambda>x \\<forall>F (x[F] \\<equiv> \\<forall>z (O!z \\<rightarrow> ([F]z \\<equiv> [G]z)))]x \\<equiv>\n            OrdinaryExtensionOf(x,[G]))\\<close>\n  proof(safe intro!: RN GEN)\n    AOT_modally_strict {\n      fix x\n      AOT_modally_strict {\n        AOT_have \\<open>[\\<lambda>x \\<forall>F (x[F] \\<equiv> \\<forall>z (O!z \\<rightarrow> ([F]z \\<equiv> [G]z)))]\\<down>\\<close>\n        proof (safe intro!: \"Comprehension_3\"[THEN \"\\<rightarrow>E\"] RN GEN\n                            \"\\<rightarrow>I\" \"\\<equiv>I\" Ordinary.GEN)\n          AOT_modally_strict {\n            fix F H u\n            AOT_assume \\<open>\\<box>H \\<equiv>\\<^sub>E F\\<close>\n            AOT_hence \\<open>\\<forall>u([H]u \\<equiv> [F]u)\\<close>\n              using eqE[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\", THEN \"&E\"(2)] \"qml:2\"[axiom_inst, THEN \"\\<rightarrow>E\"]\n              by blast\n            AOT_hence 0: \\<open>[H]u \\<equiv> [F]u\\<close> using \"Ordinary.\\<forall>E\" by fast\n            {\n              AOT_assume \\<open>\\<forall>u([F]u \\<equiv> [G]u)\\<close>\n              AOT_hence 1: \\<open>[F]u \\<equiv> [G]u\\<close> using \"Ordinary.\\<forall>E\" by fast\n              AOT_show \\<open>[G]u\\<close> if \\<open>[H]u\\<close> using 0 1 \"\\<equiv>E\"(1) that by blast\n              AOT_show \\<open>[H]u\\<close> if \\<open>[G]u\\<close> using 0 1 \"\\<equiv>E\"(2) that by blast\n            }\n            {\n              AOT_assume \\<open>\\<forall>u([H]u \\<equiv> [G]u)\\<close>\n              AOT_hence 1: \\<open>[H]u \\<equiv> [G]u\\<close> using \"Ordinary.\\<forall>E\" by fast\n              AOT_show \\<open>[G]u\\<close> if \\<open>[F]u\\<close> using 0 1 \"\\<equiv>E\"(1,2) that by blast \n              AOT_show \\<open>[F]u\\<close> if \\<open>[G]u\\<close> using 0 1 \"\\<equiv>E\"(1,2) that by blast \n            }\n          }\n        qed\n      }\n      AOT_thus \\<open>(A!x & G\\<down> & [\\<lambda>x \\<forall>F (x[F] \\<equiv> \\<forall>z (O!z \\<rightarrow> ([F]z \\<equiv> [G]z)))]x) \\<equiv>\n                OrdinaryExtensionOf(x,[G])\\<close>\n        apply (AOT_subst_def OrdinaryExtensionOf)\n        apply (AOT_subst \\<open>[\\<lambda>x \\<forall>F (x[F] \\<equiv> \\<forall>z (O!z \\<rightarrow> ([F]z \\<equiv> [G]z)))]x\\<close>\n                         \\<open>\\<forall>F (x[F] \\<equiv> \\<forall>z (O!z \\<rightarrow> ([F]z \\<equiv> [G]z)))\\<close>)\n        by (auto intro!: \"beta-C-meta\"[THEN \"\\<rightarrow>E\"] simp: \"oth-class-taut:3:a\")\n    }\n  qed\nqed\n\ntext\\<open>Fragments of PLM's theory of Concepts.\\<close>\n\nAOT_define FimpG :: \\<open>\\<Pi> \\<Rightarrow> \\<Pi> \\<Rightarrow> \\<phi>\\<close> (infixl \\<open>\\<Rightarrow>\\<close> 50)\n  \"F-imp-G\": \\<open>[G] \\<Rightarrow> [F] \\<equiv>\\<^sub>d\\<^sub>f F\\<down> & G\\<down> & \\<box>\\<forall>x ([G]x \\<rightarrow> [F]x)\\<close>\n\nAOT_define concept :: \\<open>\\<Pi>\\<close> (\\<open>C!\\<close>)\n  concepts: \\<open>C! =\\<^sub>d\\<^sub>f A!\\<close>\n\nAOT_register_rigid_restricted_type\n  Concept: \\<open>C!\\<kappa>\\<close>\nproof\n  AOT_modally_strict {\n    AOT_have \\<open>\\<exists>x A!x\\<close>\n      using \"o-objects-exist:2\" \"qml:2\"[axiom_inst] \"\\<rightarrow>E\" by blast\n    AOT_thus \\<open>\\<exists>x C!x\\<close>\n      using \"rule-id-df:1[zero]\"[OF concepts, OF \"oa-exist:2\"] \"rule=E\" id_sym\n      by fast\n  }\nnext\n  AOT_modally_strict {\n    AOT_show \\<open>C!\\<kappa> \\<rightarrow> \\<kappa>\\<down>\\<close> for \\<kappa>\n      using \"cqt:5:a\"[axiom_inst, THEN \"\\<rightarrow>E\", THEN \"&E\"(2)] \"\\<rightarrow>I\"\n      by blast\n  }\nnext\n  AOT_modally_strict {\n    AOT_have \\<open>\\<forall>x(A!x \\<rightarrow> \\<box>A!x)\\<close>\n      by (simp add: \"oa-facts:2\" GEN)\n    AOT_thus \\<open>\\<forall>x(C!x \\<rightarrow> \\<box>C!x)\\<close>\n      using \"rule-id-df:1[zero]\"[OF concepts, OF \"oa-exist:2\"] \"rule=E\" id_sym\n      by fast\n  }\nqed\n\nAOT_register_variable_names\n  Concept: c d e\n\nAOT_theorem \"concept-comp:1\": \\<open>\\<exists>x(C!x & \\<forall>F(x[F] \\<equiv> \\<phi>{F}))\\<close>\n    using concepts[THEN \"rule-id-df:1[zero]\", OF \"oa-exist:2\", symmetric]\n          \"A-objects\"[axiom_inst]\n          \"rule=E\" by fast\n\nAOT_theorem \"concept-comp:2\": \\<open>\\<exists>!x(C!x & \\<forall>F(x[F] \\<equiv> \\<phi>{F}))\\<close>\n    using concepts[THEN \"rule-id-df:1[zero]\", OF \"oa-exist:2\", symmetric]\n          \"A-objects!\"\n          \"rule=E\" by fast\n\nAOT_theorem \"concept-comp:3\": \\<open>\\<^bold>\\<iota>x(C!x & \\<forall>F(x[F] \\<equiv> \\<phi>{F}))\\<down>\\<close>\n  using \"concept-comp:2\" \"A-Exists:2\"[THEN \"\\<equiv>E\"(2)] \"RA[2]\" by blast\n\nAOT_theorem \"concept-comp:4\":\n  \\<open>\\<^bold>\\<iota>x(C!x & \\<forall>F(x[F] \\<equiv> \\<phi>{F})) = \\<^bold>\\<iota>x(A!x & \\<forall>F(x[F] \\<equiv> \\<phi>{F}))\\<close>\n    using \"=I\"(1)[OF \"concept-comp:3\"]\n          \"rule=E\"[rotated]\n          concepts[THEN \"rule-id-df:1[zero]\", OF \"oa-exist:2\"]\n          by fast\n\nAOT_define conceptInclusion :: \\<open>\\<tau> \\<Rightarrow> \\<tau> \\<Rightarrow> \\<phi>\\<close> (infixl \\<open>\\<preceq>\\<close> 100)\n  \"con:1\": \\<open>c \\<preceq> d \\<equiv>\\<^sub>d\\<^sub>f \\<forall>F(c[F] \\<rightarrow> d[F])\\<close>\n\n\nAOT_define conceptOf :: \\<open>\\<tau> \\<Rightarrow> \\<tau> \\<Rightarrow> \\<phi>\\<close> (\\<open>ConceptOf'(_,_')\\<close>)\n  \"concept-of-G\": \\<open>ConceptOf(c,G) \\<equiv>\\<^sub>d\\<^sub>f G\\<down> & \\<forall>F (c[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close>\n\nAOT_theorem ConceptOfOrdinaryProperty: \\<open>([H] \\<Rightarrow> O!) \\<rightarrow> [\\<lambda>x ConceptOf(x,H)]\\<down>\\<close>\nproof(rule \"\\<rightarrow>I\")\n  AOT_assume \\<open>[H] \\<Rightarrow> O!\\<close>\n  AOT_hence \\<open>\\<box>\\<forall>x([H]x \\<rightarrow> O!x)\\<close>\n    using \"F-imp-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"] \"&E\" by blast\n  AOT_hence \\<open>\\<box>\\<box>\\<forall>x([H]x \\<rightarrow> O!x)\\<close>\n    using \"S5Basic:6\"[THEN \"\\<equiv>E\"(1)] by blast\n  moreover AOT_have \\<open>\\<box>\\<box>\\<forall>x([H]x \\<rightarrow> O!x) \\<rightarrow>\n                     \\<box>\\<forall>F\\<forall>G(\\<box>(G \\<equiv>\\<^sub>E F) \\<rightarrow> ([H] \\<Rightarrow> [F] \\<equiv> [H] \\<Rightarrow> [G]))\\<close>\n  proof(rule RM; safe intro!: \"\\<rightarrow>I\" GEN \"\\<equiv>I\")\n    AOT_modally_strict {\n      fix F G\n      AOT_assume 0: \\<open>\\<box>\\<forall>x([H]x \\<rightarrow> O!x)\\<close>\n      AOT_assume \\<open>\\<box>G \\<equiv>\\<^sub>E F\\<close>\n      AOT_hence 1: \\<open>\\<box>\\<forall>u([G]u \\<equiv> [F]u)\\<close>\n        by (AOT_subst_thm eqE[THEN \"\\<equiv>Df\", THEN \"\\<equiv>S\"(1), OF \"&I\",\n              OF \"cqt:2[const_var]\"[axiom_inst],\n              OF \"cqt:2[const_var]\"[axiom_inst], symmetric])\n      {\n        AOT_assume \\<open>[H] \\<Rightarrow> [F]\\<close>\n        AOT_hence \\<open>\\<box>\\<forall>x([H]x \\<rightarrow> [F]x)\\<close>\n          using \"F-imp-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"] \"&E\" by blast\n        moreover AOT_modally_strict {\n          AOT_assume \\<open>\\<forall>x([H]x \\<rightarrow> O!x)\\<close>\n          moreover AOT_assume \\<open>\\<forall>u([G]u \\<equiv> [F]u)\\<close>\n          moreover AOT_assume \\<open>\\<forall>x([H]x \\<rightarrow> [F]x)\\<close>\n          ultimately AOT_have \\<open>[H]x \\<rightarrow> [G]x\\<close> for x\n            by (auto intro!: \"\\<rightarrow>I\" dest!: \"\\<forall>E\"(2) dest: \"\\<rightarrow>E\" \"\\<equiv>E\")\n          AOT_hence \\<open>\\<forall>x([H]x \\<rightarrow> [G]x)\\<close>\n            by (rule GEN)\n        }\n        ultimately AOT_have \\<open>\\<box>\\<forall>x([H]x \\<rightarrow> [G]x)\\<close>\n          using \"RN[prem]\"[where\n              \\<Gamma>=\"{\\<guillemotleft>\\<forall>x([H]x \\<rightarrow> O!x)\\<guillemotright>, \\<guillemotleft>\\<forall>u([G]u \\<equiv> [F]u)\\<guillemotright>, \\<guillemotleft>\\<forall>x([H]x \\<rightarrow> [F]x)\\<guillemotright>}\"]\n          using 0 1 by fast\n        AOT_thus \\<open>[H] \\<Rightarrow> [G]\\<close>\n          by (AOT_subst_def \"F-imp-G\")\n             (safe intro!: \"cqt:2\" \"&I\")\n      }\n      {\n        AOT_assume \\<open>[H] \\<Rightarrow> [G]\\<close>\n        AOT_hence \\<open>\\<box>\\<forall>x([H]x \\<rightarrow> [G]x)\\<close>\n          using \"F-imp-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"] \"&E\" by blast\n        moreover AOT_modally_strict {\n          AOT_assume \\<open>\\<forall>x([H]x \\<rightarrow> O!x)\\<close>\n          moreover AOT_assume \\<open>\\<forall>u([G]u \\<equiv> [F]u)\\<close>\n          moreover AOT_assume \\<open>\\<forall>x([H]x \\<rightarrow> [G]x)\\<close>\n          ultimately AOT_have \\<open>[H]x \\<rightarrow> [F]x\\<close> for x\n            by (auto intro!: \"\\<rightarrow>I\" dest!: \"\\<forall>E\"(2) dest: \"\\<rightarrow>E\" \"\\<equiv>E\")\n          AOT_hence \\<open>\\<forall>x([H]x \\<rightarrow> [F]x)\\<close>\n            by (rule GEN)\n        }\n        ultimately AOT_have \\<open>\\<box>\\<forall>x([H]x \\<rightarrow> [F]x)\\<close>\n          using \"RN[prem]\"[where\n              \\<Gamma>=\"{\\<guillemotleft>\\<forall>x([H]x \\<rightarrow> O!x)\\<guillemotright>, \\<guillemotleft>\\<forall>u([G]u \\<equiv> [F]u)\\<guillemotright>, \\<guillemotleft>\\<forall>x([H]x \\<rightarrow> [G]x)\\<guillemotright>}\"]\n          using 0 1 by fast\n        AOT_thus \\<open>[H] \\<Rightarrow> [F]\\<close>\n          by (AOT_subst_def \"F-imp-G\")\n             (safe intro!: \"cqt:2\" \"&I\")\n      }\n    }\n  qed\n  ultimately AOT_have \\<open>\\<box>\\<forall>F\\<forall>G(\\<box>(G \\<equiv>\\<^sub>E F) \\<rightarrow> ([H] \\<Rightarrow> [F] \\<equiv> [H] \\<Rightarrow> [G]))\\<close>\n    using \"\\<rightarrow>E\" by blast\n  AOT_hence 0: \\<open>[\\<lambda>x \\<forall>F(x[F] \\<equiv> ([H] \\<Rightarrow> [F]))]\\<down>\\<close>\n    using Comprehension_3[THEN \"\\<rightarrow>E\"] by blast\n  AOT_show \\<open>[\\<lambda>x ConceptOf(x,H)]\\<down>\\<close>\n  proof (rule \"safe-ext\"[axiom_inst, THEN \"\\<rightarrow>E\", OF \"&I\"])\n    AOT_show \\<open>[\\<lambda>x C!x & [\\<lambda>x \\<forall>F(x[F] \\<equiv> ([H] \\<Rightarrow> [F]))]x]\\<down>\\<close> by \"cqt:2\"\n  next\n    AOT_show \\<open>\\<box>\\<forall>x (C!x & [\\<lambda>x \\<forall>F (x[F] \\<equiv> [H] \\<Rightarrow> [F])]x \\<equiv> ConceptOf(x,H))\\<close>\n    proof (rule \"RN[prem]\"[where \\<Gamma>=\\<open>{\\<guillemotleft>[\\<lambda>x \\<forall>F(x[F] \\<equiv> ([H] \\<Rightarrow> [F]))]\\<down>\\<guillemotright>}\\<close>, simplified])\n      AOT_modally_strict {\n        AOT_assume 0: \\<open>[\\<lambda>x \\<forall>F (x[F] \\<equiv> [H] \\<Rightarrow> [F])]\\<down>\\<close>\n        AOT_show \\<open>\\<forall>x (C!x & [\\<lambda>x \\<forall>F (x[F] \\<equiv> [H] \\<Rightarrow> [F])]x \\<equiv> ConceptOf(x,H))\\<close>\n        proof(safe intro!: GEN \"\\<equiv>I\" \"\\<rightarrow>I\" \"&I\")\n          fix x\n          AOT_assume \\<open>C!x & [\\<lambda>x \\<forall>F (x[F] \\<equiv> [H] \\<Rightarrow> [F])]x\\<close>\n          AOT_thus \\<open>ConceptOf(x,H)\\<close>\n            by (AOT_subst_def \"concept-of-G\")\n               (auto intro!: \"&I\" \"cqt:2\" dest: \"&E\" \"\\<beta>\\<rightarrow>C\")\n        next\n          fix x\n          AOT_assume \\<open>ConceptOf(x,H)\\<close>\n          AOT_hence \\<open>C!x & (H\\<down> & \\<forall>F(x[F] \\<equiv> [H] \\<Rightarrow> [F]))\\<close>\n            by (AOT_subst_def (reverse) \"concept-of-G\")\n          AOT_thus \\<open>C!x\\<close> and \\<open>[\\<lambda>x \\<forall>F(x[F] \\<equiv> [H] \\<Rightarrow> [F])]x\\<close>\n            by (auto intro!: \"\\<beta>\\<leftarrow>C\" 0 \"cqt:2\" dest: \"&E\")\n        qed\n      }\n    next\n      AOT_show \\<open>\\<box>[\\<lambda>x \\<forall>F(x[F] \\<equiv> ([H] \\<Rightarrow> [F]))]\\<down>\\<close>\n        using \"exist-nec\"[THEN \"\\<rightarrow>E\"] 0 by blast\n    qed\n  qed\nqed\n\nAOT_theorem \"con-exists:1\": \\<open>\\<exists>c ConceptOf(c,G)\\<close>\nproof -\n  AOT_obtain c where \\<open>\\<forall>F (c[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close>\n    using \"concept-comp:1\" \"Concept.\\<exists>E\"[rotated] by meson\n  AOT_hence \\<open>ConceptOf(c,G)\\<close>\n    by (auto intro!: \"concept-of-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"] \"&I\" \"cqt:2\" Concept.\\<psi>)\n  thus ?thesis by (rule \"Concept.\\<exists>I\")\nqed\n\nAOT_theorem \"con-exists:2\": \\<open>\\<exists>!c ConceptOf(c,G)\\<close>\nproof -\n  AOT_have \\<open>\\<exists>!c \\<forall>F (c[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close>\n    using \"concept-comp:2\" by simp\n  moreover {\n    AOT_modally_strict {\n      fix x\n      AOT_assume \\<open>\\<forall>F (x[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close>\n      moreover AOT_have \\<open>[G] \\<Rightarrow> [G]\\<close>\n        by (safe intro!: \"F-imp-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"] \"&I\" \"cqt:2\" RN GEN \"\\<rightarrow>I\")\n      ultimately AOT_have \\<open>x[G]\\<close>\n        using \"\\<forall>E\"(2) \"\\<equiv>E\" by blast\n      AOT_hence \\<open>A!x\\<close>\n        using \"encoders-are-abstract\"[THEN \"\\<rightarrow>E\", OF \"\\<exists>I\"(2)] by simp\n      AOT_hence \\<open>C!x\\<close>\n        using concepts[THEN \"rule-id-df:1[zero]\", OF \"oa-exist:2\", symmetric]\n              \"rule=E\"[rotated]\n        by fast\n    }\n  }\n  ultimately show ?thesis\n    by (AOT_subst \\<open>ConceptOf(c,G)\\<close> \\<open>\\<forall>F (c[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close> for: c;\n           AOT_subst_def \"concept-of-G\")\n       (auto intro!: \"\\<equiv>I\" \"\\<rightarrow>I\" \"&I\" \"cqt:2\" Concept.\\<psi> dest: \"&E\")\nqed\n\nAOT_theorem \"con-exists:3\": \\<open>\\<^bold>\\<iota>c ConceptOf(c,G)\\<down>\\<close>\n  by (safe intro!: \"A-Exists:2\"[THEN \"\\<equiv>E\"(2)] \"con-exists:2\"[THEN \"RA[2]\"])\n\n\nAOT_define theConceptOfG :: \\<open>\\<tau> \\<Rightarrow> \\<kappa>\\<^sub>s\\<close> (\\<open>\\<^bold>c\\<^sub>_\\<close>)\n  \"concept-G\": \\<open>\\<^bold>c\\<^sub>G =\\<^sub>d\\<^sub>f \\<^bold>\\<iota>c ConceptOf(c, G)\\<close>\n\nAOT_theorem \"concept-G[den]\": \\<open>\\<^bold>c\\<^sub>G\\<down>\\<close>\n  by (auto intro!: \"rule-id-df:1\"[OF \"concept-G\"]\n                   \"t=t-proper:1\"[THEN \"\\<rightarrow>E\"]\n                   \"con-exists:3\")\n\n\nAOT_theorem \"concept-G[concept]\": \\<open>C!\\<^bold>c\\<^sub>G\\<close>\nproof -\n  AOT_have \\<open>\\<^bold>\\<A>(C!\\<^bold>c\\<^sub>G & ConceptOf(\\<^bold>c\\<^sub>G, G))\\<close>\n    by (auto intro!: \"actual-desc:2\"[unvarify x, THEN \"\\<rightarrow>E\"]\n                     \"rule-id-df:1\"[OF \"concept-G\"]\n                     \"concept-G[den]\"\n                     \"con-exists:3\")\n  AOT_hence \\<open>\\<^bold>\\<A>C!\\<^bold>c\\<^sub>G\\<close>\n    by (metis \"Act-Basic:2\" \"con-dis-i-e:2:a\" \"intro-elim:3:a\")\n  AOT_hence \\<open>\\<^bold>\\<A>A!\\<^bold>c\\<^sub>G\\<close>\n    using \"rule-id-df:1[zero]\"[OF concepts, OF \"oa-exist:2\"]\n          \"rule=E\" by fast\n  AOT_hence \\<open>A!\\<^bold>c\\<^sub>G\\<close>\n    using \"oa-facts:8\"[unvarify x, THEN \"\\<equiv>E\"(2)] \"concept-G[den]\" by blast\n  thus ?thesis\n    using \"rule-id-df:1[zero]\"[OF concepts, OF \"oa-exist:2\", symmetric]\n          \"rule=E\" by fast\nqed\n\nAOT_theorem \"conG-strict\": \\<open>\\<^bold>c\\<^sub>G = \\<^bold>\\<iota>c \\<forall>F(c[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close>\nproof (rule \"id-eq:3\"[unvarify \\<alpha> \\<beta> \\<gamma>, THEN \"\\<rightarrow>E\"])\n  AOT_have \\<open>\\<box>\\<forall>x (C!x & ConceptOf(x,G) \\<equiv> C!x & \\<forall>F (x[F] \\<equiv> [G] \\<Rightarrow> [F]))\\<close>\n    by (auto intro!: \"concept-of-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"] RN GEN \"\\<equiv>I\" \"\\<rightarrow>I\" \"&I\" \"cqt:2\"\n               dest: \"&E\";\n        auto dest: \"\\<forall>E\"(2) \"\\<equiv>E\"(1,2) dest!: \"&E\"(2) \"concept-of-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"])\n  AOT_thus \\<open>\\<^bold>c\\<^sub>G = \\<^bold>\\<iota>c ConceptOf(c, G) & \\<^bold>\\<iota>c ConceptOf(c, G) = \\<^bold>\\<iota>c \\<forall>F(c[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close>\n    by (auto intro!: \"&I\" \"rule-id-df:1\"[OF \"concept-G\"] \"con-exists:3\"\n                      \"equiv-desc-eq:3\"[THEN \"\\<rightarrow>E\"])\nqed(auto simp: \"concept-G[den]\" \"con-exists:3\" \"concept-comp:3\")\n\n\nAOT_theorem \"conG-lemma:1\": \\<open>\\<forall>F(\\<^bold>c\\<^sub>G[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close>\nproof(safe intro!: GEN \"\\<equiv>I\" \"\\<rightarrow>I\")\n  fix F\n  AOT_have \\<open>\\<^bold>\\<A>\\<forall>F(\\<^bold>c\\<^sub>G[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close>\n    using \"actual-desc:4\"[THEN \"\\<rightarrow>E\", OF \"concept-comp:3\",\n                          THEN \"Act-Basic:2\"[THEN \"\\<equiv>E\"(1)],\n                          THEN \"&E\"(2)]\n          \"conG-strict\"[symmetric] \"rule=E\" by fast\n  AOT_hence \\<open>\\<^bold>\\<A>(\\<^bold>c\\<^sub>G[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close>\n    using \"logic-actual-nec:3\"[axiom_inst, THEN \"\\<equiv>E\"(1)] \"\\<forall>E\"(2)\n    by blast\n  AOT_hence 0: \\<open>\\<^bold>\\<A>\\<^bold>c\\<^sub>G[F] \\<equiv> \\<^bold>\\<A>[G] \\<Rightarrow> [F]\\<close>\n    using \"Act-Basic:5\"[THEN \"\\<equiv>E\"(1)] by blast\n  {\n    AOT_assume \\<open>\\<^bold>c\\<^sub>G[F]\\<close>\n    AOT_hence \\<open>\\<^bold>\\<A>\\<^bold>c\\<^sub>G[F]\\<close>\n      by(safe intro!: \"en-eq:10[1]\"[unvarify x\\<^sub>1, THEN \"\\<equiv>E\"(2)]\n                      \"concept-G[den]\")\n    AOT_hence \\<open>\\<^bold>\\<A>[G] \\<Rightarrow> [F]\\<close>\n      using 0[THEN \"\\<equiv>E\"(1)] by blast\n    AOT_hence \\<open>\\<^bold>\\<A>(F\\<down> & G\\<down> & \\<box>\\<forall>x([G]x \\<rightarrow> [F]x))\\<close>\n      by (AOT_subst_def (reverse) \"F-imp-G\")\n    AOT_hence \\<open>\\<^bold>\\<A>\\<box>\\<forall>x([G]x \\<rightarrow> [F]x)\\<close>\n      using \"Act-Basic:2\"[THEN \"\\<equiv>E\"(1)] \"&E\" by blast\n    AOT_hence \\<open>\\<box>\\<forall>x([G]x \\<rightarrow> [F]x)\\<close>\n      using \"qml-act:2\"[axiom_inst, THEN \"\\<equiv>E\"(2)] by simp\n    AOT_thus \\<open>[G] \\<Rightarrow> [F]\\<close>\n      by (AOT_subst_def \"F-imp-G\"; auto intro!: \"&I\" \"cqt:2\")\n  }\n  {\n    AOT_assume \\<open>[G] \\<Rightarrow> [F]\\<close>\n    AOT_hence \\<open>\\<box>\\<forall>x([G]x \\<rightarrow> [F]x)\\<close>\n      by (safe dest!: \"F-imp-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"] \"&E\"(2))\n    AOT_hence \\<open>\\<^bold>\\<A>\\<box>\\<forall>x([G]x \\<rightarrow> [F]x)\\<close>\n      using \"qml-act:2\"[axiom_inst, THEN \"\\<equiv>E\"(1)] by simp\n    AOT_hence \\<open>\\<^bold>\\<A>(F\\<down> & G\\<down> & \\<box>\\<forall>x([G]x \\<rightarrow> [F]x))\\<close>\n      by (auto intro!: \"Act-Basic:2\"[THEN \"\\<equiv>E\"(2)] \"&I\" \"cqt:2\"\n               intro: \"RA[2]\")\n    AOT_hence \\<open>\\<^bold>\\<A>([G] \\<Rightarrow> [F])\\<close>\n      by (AOT_subst_def \"F-imp-G\")\n    AOT_hence \\<open>\\<^bold>\\<A>\\<^bold>c\\<^sub>G[F]\\<close>\n      using 0[THEN \"\\<equiv>E\"(2)] by blast\n    AOT_thus \\<open>\\<^bold>c\\<^sub>G[F]\\<close>\n      by(safe intro!: \"en-eq:10[1]\"[unvarify x\\<^sub>1, THEN \"\\<equiv>E\"(1)]\n                      \"concept-G[den]\")\n  }\nqed\n\nAOT_theorem conH_enc_ord:\n  \\<open>([H] \\<Rightarrow> O!) \\<rightarrow> \\<box>\\<forall>F \\<forall>G (\\<box>G \\<equiv>\\<^sub>E F \\<rightarrow> (\\<^bold>c\\<^sub>H[F] \\<equiv> \\<^bold>c\\<^sub>H[G]))\\<close>\nproof(rule \"\\<rightarrow>I\")\n  AOT_assume 0: \\<open>[H] \\<Rightarrow> O!\\<close>\n  AOT_have 0: \\<open>\\<box>([H] \\<Rightarrow> O!)\\<close>\n    apply (AOT_subst_def \"F-imp-G\")\n    using 0[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"[OF \"F-imp-G\"]]\n    by (auto intro!: \"KBasic:3\"[THEN \"\\<equiv>E\"(2)] \"&I\" \"exist-nec\"[THEN \"\\<rightarrow>E\"]\n               dest: \"&E\" 4[THEN \"\\<rightarrow>E\"])\n  moreover AOT_have \\<open>\\<box>([H] \\<Rightarrow> O!) \\<rightarrow> \\<box>\\<forall>F \\<forall>G (\\<box>G \\<equiv>\\<^sub>E F \\<rightarrow> (\\<^bold>c\\<^sub>H[F] \\<equiv> \\<^bold>c\\<^sub>H[G]))\\<close>\n  proof(rule RM; safe intro!: \"\\<rightarrow>I\" GEN)\n    AOT_modally_strict {\n      fix F G\n      AOT_assume \\<open>[H] \\<Rightarrow> O!\\<close>\n      AOT_hence 0: \\<open>\\<box>\\<forall>x ([H]x \\<rightarrow> O!x)\\<close>\n        by (safe dest!: \"F-imp-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"] \"&E\"(2))\n      AOT_assume 1: \\<open>\\<box>G \\<equiv>\\<^sub>E F\\<close>\n      AOT_assume \\<open>\\<^bold>c\\<^sub>H[F]\\<close>\n      AOT_hence \\<open>[H] \\<Rightarrow> [F]\\<close>\n        using \"conG-lemma:1\"[THEN \"\\<forall>E\"(2), THEN \"\\<equiv>E\"(1)] by simp\n      AOT_hence 2: \\<open>\\<box>\\<forall>x ([H]x \\<rightarrow> [F]x)\\<close>\n        by (safe dest!: \"F-imp-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"] \"&E\"(2))\n      AOT_modally_strict {\n        AOT_assume 0: \\<open>\\<forall>x ([H]x \\<rightarrow> O!x)\\<close>\n        AOT_assume 1: \\<open>\\<forall>x ([H]x \\<rightarrow> [F]x)\\<close>\n        AOT_assume 2: \\<open>G \\<equiv>\\<^sub>E F\\<close>\n        AOT_have \\<open>\\<forall>x ([H]x \\<rightarrow> [G]x)\\<close>\n        proof(safe intro!: GEN \"\\<rightarrow>I\")\n          fix x\n          AOT_assume \\<open>[H]x\\<close>\n          AOT_hence \\<open>O!x\\<close> and \\<open>[F]x\\<close>\n            using 0 1 \"\\<forall>E\"(2) \"\\<rightarrow>E\" by blast+\n          AOT_thus \\<open>[G]x\\<close>\n            using 2[THEN eqE[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"], THEN \"&E\"(2)]\n                  \"\\<forall>E\"(2) \"\\<rightarrow>E\" \"\\<equiv>E\"(2) calculation by blast\n        qed\n      }\n      AOT_hence \\<open>\\<box>\\<forall>x ([H]x \\<rightarrow> [G]x)\\<close>\n        using \"RN[prem]\"[where \\<Gamma>=\\<open>{\\<guillemotleft>\\<forall>x ([H]x \\<rightarrow> O!x)\\<guillemotright>,\n                               \\<guillemotleft>\\<forall>x ([H]x \\<rightarrow> [F]x)\\<guillemotright>,\n                               \\<guillemotleft>G \\<equiv>\\<^sub>E F\\<guillemotright>}\\<close>, simplified] 0 1 2 by fast\n      AOT_hence \\<open>[H] \\<Rightarrow> [G]\\<close>\n        by (safe intro!: \"F-imp-G\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"] \"&I\" \"cqt:2\")\n      AOT_hence \\<open>\\<^bold>c\\<^sub>H[G]\\<close>\n        using \"conG-lemma:1\"[THEN \"\\<forall>E\"(2), THEN \"\\<equiv>E\"(2)] by simp\n    } note 0 = this\n    AOT_modally_strict {\n      fix F G\n      AOT_assume \\<open>[H] \\<Rightarrow> O!\\<close>\n      moreover AOT_assume \\<open>\\<box>G \\<equiv>\\<^sub>E F\\<close>\n      moreover AOT_have \\<open>\\<box>F \\<equiv>\\<^sub>E G\\<close>\n        by (AOT_subst \\<open>F \\<equiv>\\<^sub>E G\\<close> \\<open>G \\<equiv>\\<^sub>E F\\<close>)\n            (auto intro!: calculation(2)\n                          eqE[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"]\n                          \"\\<equiv>I\" \"\\<rightarrow>I\" \"&I\" \"cqt:2\" Ordinary.GEN\n                  dest!: eqE[THEN \"\\<equiv>\\<^sub>d\\<^sub>fE\"] \"&E\"(2)\n                  dest: \"\\<equiv>E\"(1,2) \"Ordinary.\\<forall>E\")\n      ultimately AOT_show \\<open>(\\<^bold>c\\<^sub>H[F] \\<equiv> \\<^bold>c\\<^sub>H[G])\\<close>\n        using 0 \"\\<equiv>I\" \"\\<rightarrow>I\" by auto\n    }\n  qed\n  ultimately AOT_show \\<open>\\<box>\\<forall>F \\<forall>G (\\<box>G \\<equiv>\\<^sub>E F \\<rightarrow> (\\<^bold>c\\<^sub>H[F] \\<equiv> \\<^bold>c\\<^sub>H[G]))\\<close>\n    using \"\\<rightarrow>E\" by blast\nqed\n\nAOT_theorem concept_inclusion_denotes_1:\n  \\<open>([H] \\<Rightarrow> O!) \\<rightarrow> [\\<lambda>x \\<^bold>c\\<^sub>H \\<preceq> x]\\<down>\\<close>\nproof(rule \"\\<rightarrow>I\")\n  AOT_assume 0: \\<open>[H] \\<Rightarrow> O!\\<close>\n  AOT_show \\<open>[\\<lambda>x \\<^bold>c\\<^sub>H \\<preceq> x]\\<down>\\<close>\n  proof(rule \"safe-ext\"[axiom_inst, THEN \"\\<rightarrow>E\", OF \"&I\"])\n    AOT_show \\<open>[\\<lambda>x C!x & \\<forall>F(\\<^bold>c\\<^sub>H[F] \\<rightarrow> x[F])]\\<down>\\<close>\n      by (safe intro!: conjunction_denotes[THEN \"\\<rightarrow>E\", OF \"&I\"]\n                       Comprehension_2'[THEN \"\\<rightarrow>E\"]\n                       conH_enc_ord[THEN \"\\<rightarrow>E\", OF 0]) \"cqt:2\"\n  next\n    AOT_show \\<open>\\<box>\\<forall>x (C!x & \\<forall>F (\\<^bold>c\\<^sub>H[F] \\<rightarrow> x[F]) \\<equiv> \\<^bold>c\\<^sub>H \\<preceq> x)\\<close>\n      by (safe intro!: RN GEN; AOT_subst_def \"con:1\")\n         (auto intro!: \"\\<equiv>I\" \"\\<rightarrow>I\" \"&I\" \"concept-G[concept]\" dest: \"&E\")\n  qed\nqed\n\nAOT_theorem concept_inclusion_denotes_2:\n  \\<open>([H] \\<Rightarrow> O!) \\<rightarrow> [\\<lambda>x x \\<preceq> \\<^bold>c\\<^sub>H]\\<down>\\<close>\nproof(rule \"\\<rightarrow>I\")\n  AOT_assume 0: \\<open>[H] \\<Rightarrow> O!\\<close>\n  AOT_show \\<open>[\\<lambda>x x \\<preceq> \\<^bold>c\\<^sub>H]\\<down>\\<close>\n  proof(rule \"safe-ext\"[axiom_inst, THEN \"\\<rightarrow>E\", OF \"&I\"])\n    AOT_show \\<open>[\\<lambda>x C!x & \\<forall>F(x[F] \\<rightarrow> \\<^bold>c\\<^sub>H[F])]\\<down>\\<close>\n      by (safe intro!: conjunction_denotes[THEN \"\\<rightarrow>E\", OF \"&I\"]\n                       Comprehension_1'[THEN \"\\<rightarrow>E\"]\n                       conH_enc_ord[THEN \"\\<rightarrow>E\", OF 0]) \"cqt:2\"\n  next\n    AOT_show \\<open>\\<box>\\<forall>x (C!x & \\<forall>F (x[F] \\<rightarrow> \\<^bold>c\\<^sub>H[F]) \\<equiv> x \\<preceq> \\<^bold>c\\<^sub>H)\\<close>\n      by (safe intro!: RN GEN; AOT_subst_def \"con:1\")\n         (auto intro!: \"\\<equiv>I\" \"\\<rightarrow>I\" \"&I\" \"concept-G[concept]\" dest: \"&E\")\n  qed\nqed\n\nAOT_define ThickForm :: \\<open>\\<tau> \\<Rightarrow> \\<tau> \\<Rightarrow> \\<phi>\\<close> (\\<open>FormOf'(_,_')\\<close>)\n  \"tform-of\": \\<open>FormOf(x,G) \\<equiv>\\<^sub>d\\<^sub>f A!x & G\\<down> & \\<forall>F(x[F] \\<equiv> [G] \\<Rightarrow> [F])\\<close>\n\nAOT_theorem FormOfOrdinaryProperty: \\<open>([H] \\<Rightarrow> O!) \\<rightarrow> [\\<lambda>x FormOf(x,H)]\\<down>\\<close>\nproof(rule \"\\<rightarrow>I\")\n  AOT_assume 0: \\<open>[H] \\<Rightarrow> [O!]\\<close>\n  AOT_show \\<open>[\\<lambda>x FormOf(x,H)]\\<down>\\<close>\n  proof (rule \"safe-ext\"[axiom_inst, THEN \"\\<rightarrow>E\", OF \"&I\"])\n    AOT_show \\<open>[\\<lambda>x ConceptOf(x,H)]\\<down>\\<close>\n      using 0 ConceptOfOrdinaryProperty[THEN \"\\<rightarrow>E\"] by blast\n    AOT_show \\<open>\\<box>\\<forall>x (ConceptOf(x,H) \\<equiv> FormOf(x,H))\\<close>\n    proof(safe intro!: RN GEN)\n      AOT_modally_strict {\n        fix x\n        AOT_modally_strict {\n          AOT_have \\<open>A!x \\<equiv> A!x\\<close>\n            by (simp add: \"oth-class-taut:3:a\")\n          AOT_hence \\<open>C!x \\<equiv> A!x\\<close>\n            using \"rule-id-df:1[zero]\"[OF concepts, OF \"oa-exist:2\"]\n                  \"rule=E\" id_sym by fast\n        }\n        AOT_thus \\<open>ConceptOf(x,H) \\<equiv> FormOf(x,H)\\<close>\n          by (AOT_subst_def \"tform-of\";\n              AOT_subst_def \"concept-of-G\";\n              AOT_subst \\<open>C!x\\<close> \\<open>A!x\\<close>)\n             (auto intro!: \"\\<equiv>I\" \"\\<rightarrow>I\" \"&I\" dest: \"&E\")\n      }\n    qed\n  qed\nqed\n\nAOT_theorem equal_E_rigid_one_to_one: \\<open>Rigid\\<^sub>1\\<^sub>-\\<^sub>1((=\\<^sub>E))\\<close>\nproof (safe intro!: \"df-1-1:2\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"] \"&I\" \"df-1-1:1\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"]\n                    GEN \"\\<rightarrow>I\" \"df-rigid-rel:1\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"] \"=E[denotes]\")\n  fix x y z\n  AOT_assume \\<open>x =\\<^sub>E z & y =\\<^sub>E z\\<close>\n  AOT_thus \\<open>x = y\\<close>\n    by (metis \"rule=E\" \"&E\"(1) \"Conjunction Simplification\"(2)\n              \"=E-simple:2\" id_sym \"\\<rightarrow>E\")\nnext\n  AOT_have \\<open>\\<forall>x\\<forall>y \\<box>(x =\\<^sub>E y \\<rightarrow> \\<box>x =\\<^sub>E y)\\<close>\n  proof(rule GEN; rule GEN)\n    AOT_show \\<open>\\<box>(x =\\<^sub>E y \\<rightarrow> \\<box>x =\\<^sub>E y)\\<close> for x y\n      by (meson RN \"deduction-theorem\" \"id-nec3:1\" \"\\<equiv>E\"(1))\n  qed\n  AOT_hence \\<open>\\<forall>x\\<^sub>1...\\<forall>x\\<^sub>n \\<box>([(=\\<^sub>E)]x\\<^sub>1...x\\<^sub>n \\<rightarrow> \\<box>[(=\\<^sub>E)]x\\<^sub>1...x\\<^sub>n)\\<close>\n    by (rule tuple_forall[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"])\n  AOT_thus \\<open>\\<box>\\<forall>x\\<^sub>1...\\<forall>x\\<^sub>n ([(=\\<^sub>E)]x\\<^sub>1...x\\<^sub>n \\<rightarrow> \\<box>[(=\\<^sub>E)]x\\<^sub>1...x\\<^sub>n)\\<close>\n    using BF[THEN \"\\<rightarrow>E\"] by fast\nqed\n\nAOT_theorem equal_E_domain: \\<open>InDomainOf(x,(=\\<^sub>E)) \\<equiv> O!x\\<close>\nproof(safe intro!: \"\\<equiv>I\" \"\\<rightarrow>I\")\n  AOT_assume \\<open>InDomainOf(x,(=\\<^sub>E))\\<close>\n  AOT_hence \\<open>\\<exists>y x =\\<^sub>E y\\<close>\n    by (metis \"\\<equiv>\\<^sub>d\\<^sub>fE\" \"df-1-1:5\")\n  then AOT_obtain y where \\<open>x =\\<^sub>E y\\<close>\n    using \"\\<exists>E\"[rotated] by blast\n  AOT_thus \\<open>O!x\\<close>\n    using \"=E-simple:1\"[THEN \"\\<equiv>E\"(1)] \"&E\" by blast\nnext\n  AOT_assume \\<open>O!x\\<close>\n  AOT_hence \\<open>x =\\<^sub>E x\\<close>   \n    by (metis \"ord=Eequiv:1\"[THEN \"\\<rightarrow>E\"])\n  AOT_hence \\<open>\\<exists>y x =\\<^sub>E y\\<close>\n    using \"\\<exists>I\"(2) by fast\n  AOT_thus \\<open>InDomainOf(x,(=\\<^sub>E))\\<close>\n    by (metis \"\\<equiv>\\<^sub>d\\<^sub>fI\" \"df-1-1:5\")\nqed\n\nAOT_theorem shared_urelement_projection_identity:\n  assumes \\<open>\\<forall>y [\\<lambda>x (y[\\<lambda>z [R]zx])]\\<down>\\<close>\n  shows \\<open>\\<forall>F([F]a \\<equiv> [F]b) \\<rightarrow> [\\<lambda>z [R]za] = [\\<lambda>z [R]zb]\\<close>\nproof(rule \"\\<rightarrow>I\")\n  AOT_assume 0: \\<open>\\<forall>F([F]a \\<equiv> [F]b)\\<close>\n  {\n    fix z\n    AOT_have \\<open>[\\<lambda>x (z[\\<lambda>z [R]zx])]\\<down>\\<close>\n      using assms[THEN \"\\<forall>E\"(2)].\n    AOT_hence 1: \\<open>\\<forall>x \\<forall>y (\\<forall>F ([F]x \\<equiv> [F]y) \\<rightarrow> \\<box>(z[\\<lambda>z [R]zx] \\<equiv> z[\\<lambda>z [R]zy]))\\<close>\n      using \"kirchner-thm-cor:1\"[THEN \"\\<rightarrow>E\"]\n      by blast\n    AOT_have \\<open>\\<box>(z[\\<lambda>z [R]za] \\<equiv> z[\\<lambda>z [R]zb])\\<close>\n      using 1[THEN \"\\<forall>E\"(2), THEN \"\\<forall>E\"(2), THEN \"\\<rightarrow>E\", OF 0] by blast\n  }\n  AOT_hence \\<open>\\<forall>z \\<box>(z[\\<lambda>z [R]za] \\<equiv> z[\\<lambda>z [R]zb])\\<close>\n    by (rule GEN)\n  AOT_hence \\<open>\\<box>\\<forall>z(z[\\<lambda>z [R]za] \\<equiv> z[\\<lambda>z [R]zb])\\<close>\n    by (rule BF[THEN \"\\<rightarrow>E\"])\n  AOT_thus \\<open>[\\<lambda>z [R]za] = [\\<lambda>z [R]zb]\\<close>\n    by (AOT_subst_def \"identity:2\")\n       (auto intro!: \"&I\" \"cqt:2\")\nqed\n\nAOT_theorem shared_urelement_exemplification_identity:\n  assumes \\<open>\\<forall>y [\\<lambda>x (y[\\<lambda>z [G]x])]\\<down>\\<close>\n  shows \\<open>\\<forall>F([F]a \\<equiv> [F]b) \\<rightarrow> ([G]a) = ([G]b)\\<close>\nproof(rule \"\\<rightarrow>I\")\n  AOT_assume 0: \\<open>\\<forall>F([F]a \\<equiv> [F]b)\\<close>\n  {\n    fix z\n    AOT_have \\<open>[\\<lambda>x (z[\\<lambda>z [G]x])]\\<down>\\<close>\n      using assms[THEN \"\\<forall>E\"(2)].\n    AOT_hence 1: \\<open>\\<forall>x \\<forall>y (\\<forall>F ([F]x \\<equiv> [F]y) \\<rightarrow> \\<box>(z[\\<lambda>z [G]x] \\<equiv> z[\\<lambda>z [G]y]))\\<close>\n      using \"kirchner-thm-cor:1\"[THEN \"\\<rightarrow>E\"]\n      by blast\n    AOT_have \\<open>\\<box>(z[\\<lambda>z [G]a] \\<equiv> z[\\<lambda>z [G]b])\\<close>\n      using 1[THEN \"\\<forall>E\"(2), THEN \"\\<forall>E\"(2), THEN \"\\<rightarrow>E\", OF 0] by blast\n  }\n  AOT_hence \\<open>\\<forall>z \\<box>(z[\\<lambda>z [G]a] \\<equiv> z[\\<lambda>z [G]b])\\<close>\n    by (rule GEN)\n  AOT_hence \\<open>\\<box>\\<forall>z(z[\\<lambda>z [G]a] \\<equiv> z[\\<lambda>z [G]b])\\<close>\n    by (rule BF[THEN \"\\<rightarrow>E\"])\n  AOT_hence \\<open>[\\<lambda>z [G]a] = [\\<lambda>z [G]b]\\<close>\n    by (AOT_subst_def \"identity:2\")\n       (auto intro!: \"&I\" \"cqt:2\")\n  AOT_thus \\<open>([G]a) = ([G]b)\\<close>\n    by (safe intro!: \"identity:4\"[THEN \"\\<equiv>\\<^sub>d\\<^sub>fI\"] \"&I\" \"log-prop-prop:2\")\nqed\n\ntext\\<open>The assumptions of the theorems above are derivable, if the additional\n     introduction rules for the upcoming extension of @{thm \"cqt:2[lambda]\"}\n     are explicitly allowed (while they are currently not part of the\n     abstraction layer).\\<close>\nnotepad\nbegin\n  AOT_modally_strict {\n    AOT_have \\<open>\\<forall>R\\<forall>y [\\<lambda>x (y[\\<lambda>z [R]zx])]\\<down>\\<close>\n      by (safe intro!: GEN \"cqt:2\" AOT_instance_of_cqt_2_intro_next)\n    AOT_have \\<open>\\<forall>G\\<forall>y [\\<lambda>x (y[\\<lambda>z [G]x])]\\<down>\\<close>\n      by (safe intro!: GEN \"cqt:2\" AOT_instance_of_cqt_2_intro_next)\n  }\nend\n\nend\n", "meta": {"author": "ekpyron", "repo": "AOT", "sha": "3f66d0dc05933b01a70936ee63228dac8e3a118a", "save_path": "github-repos/isabelle/ekpyron-AOT", "path": "github-repos/isabelle/ekpyron-AOT/AOT-3f66d0dc05933b01a70936ee63228dac8e3a118a/AOT_misc.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6150878414043816, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3003371796061173}}
{"text": "           (*-------------------------------------------*\n            |                   Test                    |\n            |        CSP-Prover on Isabelle2005         |\n            |                  April 2006               |\n            |                                           |\n            |        CSP-Prover on Isabelle2009         |\n            |                   June 2009  (modified)   |\n            |                                           |\n            |        Yoshinao Isobe (AIST JAPAN)        |\n            *-------------------------------------------*)\n\ntheory Test_Buffer\nimports CSP_F\nbegin\n\n(*****************************************************************\n\n         1. test Buffer\n         2. verification of deadlock-free.\n         3.\n         4. \n\n *****************************************************************)\n\ndatatype Event = left real | right \"real * nat\"\ndatatype Name = Empty nat | Full real nat\ndatatype DFName = DF\n\nprimrec\n  Bufferfun :: \"Name => (Name, Event) proc\"\nwhere\n  \"Bufferfun  (Empty n)  = left ? r -> $(Full r n)\"\n |\"Bufferfun  (Full r n) = right (r,n) -> $(Empty (Suc n))\"\n\n (*\ndefs (overloaded)\nSet_Bufferfun_def [simp]: \"PNfun == Bufferfun\"\n*)\n\noverloading Set_Bufferfun == \n  \"PNfun :: (Name, Event) pnfun\"\nbegin\n  definition \"PNfun == Bufferfun\"\nend\n\ndeclare Set_Bufferfun_def [simp]\n\ndefinition\n  Buffer :: \"(Name, Event) proc\"\n  where\n  Buffer_def: \"Buffer == $(Empty 0)\"\n\n(*** Spc ***)\n\nprimrec\n  DFfun :: \"DFName => (DFName, Event) proc\"\nwhere\n  \"DFfun  DF = (! x -> $DF)\"\n(*\ndefs (overloaded)\nSet_DFfun_def [simp]: \"PNfun == DFfun\"\n*)\n\noverloading Set_DFfun == \n  \"PNfun :: (DFName, Event) pnfun\"\nbegin\n  definition \"PNfun == DFfun\"\nend\n\ndeclare Set_DFfun_def [simp]\n\n(*** To automatically unfold syntactic sugar ***)\ndeclare csp_prefix_ss_def[simp]\ndeclare inj_on_def[simp]\n\n(*********************************************************\n               guardedfun (rutine work)\n *********************************************************)\n\nlemma guardedfun_Bufferfun[simp]:\n     \"guardedfun Bufferfun\"\napply (simp add: guardedfun_def, rule)\napply (induct_tac p)\napply (simp_all)+\ndone\n\nlemma guardedfun_DFfun[simp]:\n     \"guardedfun DFfun\"\nby (simp add: guardedfun_def, rule allI, induct_tac p, simp_all)\n\n(*********************************************************\n            relation between Buffer and DF\n *********************************************************)\n\nprimrec\n  Buffer_to_DF :: \"Name => (DFName, Event) proc\"\nwhere\n  \"Buffer_to_DF (Empty n)  = $DF\"\n |\"Buffer_to_DF (Full r n) = $DF\"\n\n(*********************************************************\n               Buffer is deadlock free.\n *********************************************************)\n\n(*** manual proof ***)\n\n(*\ndefs FPmode_def [simp]: \"FPmode == CMSmode\"\n*)\n(* use the CMS approach in this example *)\n\noverloading FPmode == \n  \"FPmode :: fpmode\"\nbegin\n  definition \"FPmode == CMSmode\"\nend\n\ndeclare FPmode_def [simp]\n\nlemma manual_proof_Buffer: \n  \"$DF <=F Buffer\"\napply (simp add: Buffer_def)\napply (rule cspF_fp_induct_right[of _ _ \"Buffer_to_DF\"])\napply (simp)\napply (simp)\napply (simp)\n\napply (induct_tac p)\napply (simp_all)\n\n(* Empty *)\napply (rule cspF_rw_left)\napply (rule cspF_unwind)\napply (simp)\napply (simp)\napply (simp)\napply (rule cspF_decompo_subset)\napply (simp_all)\n\n(* Full *)\napply (rule cspF_rw_left)\napply (rule cspF_unwind)\napply (simp)\napply (simp)\napply (rule cspF_rw_right)\napply (rule cspF_step)\n\napply (simp)\napply (rule cspF_decompo_subset)\napply (simp)\napply (simp)\napply (rule cspF_reflex)\ndone\n\n(*** semi-automatic proof ***)\n\nlemma semi_auto_proof_Buffer: \"$DF <=F Buffer\"\napply (simp add: Buffer_def)\napply (rule cspF_fp_induct_right[of _ _ \"Buffer_to_DF\"])\napply (simp)+\n\napply (induct_tac p)\napply (cspF_auto, rule cspF_decompo_subset, simp_all)+\ndone\n\nend\n", "meta": {"author": "yoshinao-isobe", "repo": "CSP-Prover", "sha": "806fbe330d7e23279675a2eb351e398cb8a6e0a8", "save_path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover", "path": "github-repos/isabelle/yoshinao-isobe-CSP-Prover/CSP-Prover-806fbe330d7e23279675a2eb351e398cb8a6e0a8/Test/Test_Buffer.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6150878414043816, "lm_q2_score": 0.48828339529583464, "lm_q1q2_score": 0.3003371796061173}}
{"text": "(*  Title:      HOL/Auth/n_german_lemma_on_inv__5.thy\n    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences\n*)\n\nheader{*The n_german Protocol Case Study*} \n\ntheory n_german_lemma_on_inv__5 imports n_german_base\nbegin\nsection{*All lemmas on causal relation between inv__5 and some rule r*}\nlemma n_SendInvAckVsinv__5:\nassumes a1: \"(\\<exists> i. i\\<le>N\\<and>r=n_SendInvAck  i)\" and\na2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\<or> ?P2 s \\<or> ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\<le>N\\<and>r=n_SendInvAck  i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\<or>(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n  assume b1: \"(i=p__Inv4)\"\n  have \"((formEval (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E)) s))\\<or>((formEval (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E))) s))\" by auto\n  moreover {\n    assume c1: \"((formEval (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E)) s))\"\n    have \"?P3 s\"\n    apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const I))) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''Data'')) (IVar (Ident ''AuxData''))))))\" in exI, auto) done\n    then have \"invHoldForRule s f r (invariants N)\" by auto\n  }\n  moreover {\n    assume c1: \"((formEval (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E))) s))\"\n    have \"?P3 s\"\n    apply (cut_tac a1 a2 b1 c1, simp, rule_tac x=\"(neg (andForm (andForm (eqn (IVar (Ident ''ExGntd'')) (Const true)) (neg (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E)))) (eqn (IVar (Field (Para (Ident ''Chan2'') p__Inv4) ''Cmd'')) (Const Inv))))\" in exI, auto) done\n    then have \"invHoldForRule s f r (invariants N)\" by auto\n  }\n  ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n  assume b1: \"(i~=p__Inv4)\"\n  have \"?P2 s\"\n  proof(cut_tac a1 a2 b1, auto) qed\n  then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_RecvInvAckVsinv__5:\nassumes a1: \"(\\<exists> i. i\\<le>N\\<and>r=n_RecvInvAck  i)\" and\na2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\<or> ?P2 s \\<or> ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\<le>N\\<and>r=n_RecvInvAck  i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\<or>(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n  assume b1: \"(i=p__Inv4)\"\n  have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\<or>((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n  moreover {\n    assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n    have \"?P1 s\"\n    proof(cut_tac a1 a2 b1 c1, auto) qed\n    then have \"invHoldForRule s f r (invariants N)\" by auto\n  }\n  moreover {\n    assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n    have \"?P1 s\"\n    proof(cut_tac a1 a2 b1 c1, auto) qed\n    then have \"invHoldForRule s f r (invariants N)\" by auto\n  }\n  ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nmoreover {\n  assume b1: \"(i~=p__Inv4)\"\n  have \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\\<or>((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\" by auto\n  moreover {\n    assume c1: \"((formEval (eqn (IVar (Ident ''ExGntd'')) (Const true)) s))\"\n    have \"?P1 s\"\n    proof(cut_tac a1 a2 b1 c1, auto) qed\n    then have \"invHoldForRule s f r (invariants N)\" by auto\n  }\n  moreover {\n    assume c1: \"((formEval (neg (eqn (IVar (Ident ''ExGntd'')) (Const true))) s))\"\n    have \"?P2 s\"\n    proof(cut_tac a1 a2 b1 c1, auto) qed\n    then have \"invHoldForRule s f r (invariants N)\" by auto\n  }\n  ultimately have \"invHoldForRule s f r (invariants N)\" by satx\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendGntEVsinv__5:\nassumes a1: \"(\\<exists> i. i\\<le>N\\<and>r=n_SendGntE N i)\" and\na2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\<or> ?P2 s \\<or> ?P3 s\")\nproof -\nfrom a1 obtain i where a1:\"i\\<le>N\\<and>r=n_SendGntE N i\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\<or>(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n  assume b1: \"(i=p__Inv4)\"\n  have \"?P3 s\"\n  apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const false))))\" in exI, auto) done\n  then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n  assume b1: \"(i~=p__Inv4)\"\n  have \"?P3 s\"\n  apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Para (Ident ''ShrSet'') p__Inv4)) (Const false))))\" in exI, auto) done\n  then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_StoreVsinv__5:\nassumes a1: \"(\\<exists> i d. i\\<le>N\\<and>d\\<le>N\\<and>r=n_Store  i d)\" and\na2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\nshows \"invHoldForRule s f r (invariants N)\" (is \"?P1 s \\<or> ?P2 s \\<or> ?P3 s\")\nproof -\nfrom a1 obtain i d where a1:\"i\\<le>N\\<and>d\\<le>N\\<and>r=n_Store  i d\" apply fastforce done\nfrom a2 obtain p__Inv4 where a2:\"p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4\" apply fastforce done\nhave \"(i=p__Inv4)\\<or>(i~=p__Inv4)\" apply (cut_tac a1 a2, auto) done\nmoreover {\n  assume b1: \"(i=p__Inv4)\"\n  have \"?P3 s\"\n  apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Cache'') p__Inv4) ''State'')) (Const E))))\" in exI, auto) done\n  then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nmoreover {\n  assume b1: \"(i~=p__Inv4)\"\n  have \"?P3 s\"\n  apply (cut_tac a1 a2 b1, simp, rule_tac x=\"(neg (andForm (eqn (IVar (Field (Para (Ident ''Chan3'') p__Inv4) ''Cmd'')) (Const InvAck)) (eqn (IVar (Field (Para (Ident ''Cache'') i) ''State'')) (Const E))))\" in exI, auto) done\n  then have \"invHoldForRule s f r (invariants N)\" by auto\n}\nultimately show \"invHoldForRule s f r (invariants N)\" by satx\nqed\n\nlemma n_SendReqESVsinv__5:\n  assumes a1: \"\\<exists> i. i\\<le>N\\<and>r=n_SendReqES  i\" and\n  a2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n  \n\nlemma n_RecvGntSVsinv__5:\n  assumes a1: \"\\<exists> i. i\\<le>N\\<and>r=n_RecvGntS  i\" and\n  a2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n  \n\nlemma n_SendGntSVsinv__5:\n  assumes a1: \"\\<exists> i. i\\<le>N\\<and>r=n_SendGntS  i\" and\n  a2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n  \n\nlemma n_SendInvSVsinv__5:\n  assumes a1: \"\\<exists> i. i\\<le>N\\<and>r=n_SendInvS  i\" and\n  a2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n  \n\nlemma n_SendInvEVsinv__5:\n  assumes a1: \"\\<exists> i. i\\<le>N\\<and>r=n_SendInvE  i\" and\n  a2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n  \n\nlemma n_RecvGntEVsinv__5:\n  assumes a1: \"\\<exists> i. i\\<le>N\\<and>r=n_RecvGntE  i\" and\n  a2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n  \n\nlemma n_RecvReqVsinv__5:\n  assumes a1: \"\\<exists> i. i\\<le>N\\<and>r=n_RecvReq N i\" and\n  a2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n  \n\nlemma n_SendReqSVsinv__5:\n  assumes a1: \"\\<exists> j. j\\<le>N\\<and>r=n_SendReqS  j\" and\n  a2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n  \n\nlemma n_SendReqEIVsinv__5:\n  assumes a1: \"\\<exists> i. i\\<le>N\\<and>r=n_SendReqEI  i\" and\n  a2: \"(\\<exists> p__Inv4. p__Inv4\\<le>N\\<and>f=inv__5  p__Inv4)\"\n  shows \"invHoldForRule s f r (invariants N)\"\n  apply (rule noEffectOnRule, cut_tac a1 a2, auto) done\n  \nend\n", "meta": {"author": "paraVerifier", "repo": "paraVerifier", "sha": "5de62b433a160bf8d714e0a5085a38b9dd8899f0", "save_path": "github-repos/isabelle/paraVerifier-paraVerifier", "path": "github-repos/isabelle/paraVerifier-paraVerifier/paraVerifier-5de62b433a160bf8d714e0a5085a38b9dd8899f0/proof_scripts/german/n_german_lemma_on_inv__5.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO", "lm_q1_score": 0.6859494678483918, "lm_q2_score": 0.43782349911420193, "lm_q1q2_score": 0.3003247962289077}}
{"text": "(*  Title:      HOL/Auth/OtwayRees.thy\n    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory\n    Copyright   1996  University of Cambridge\n*)\n\nsection\\<open>The Original Otway-Rees Protocol\\<close>\n\ntheory OtwayRees imports Public begin\n\ntext\\<open>From page 244 of\n  Burrows, Abadi and Needham (1989).  A Logic of Authentication.\n  Proc. Royal Soc. 426\n\nThis is the original version, which encrypts Nonce NB.\\<close>\n\ninductive_set otway :: \"event list set\"\n  where\n   Nil:  \"[] \\<in> otway\"\n   \\<comment> \\<open>Initial trace is empty\\<close>\n | Fake: \"\\<lbrakk>evsf \\<in> otway;  X \\<in> synth (analz (knows Spy evsf)) \\<rbrakk>\n          \\<Longrightarrow> Says Spy B X  # evsf \\<in> otway\"\n   \\<comment> \\<open>The spy can say almost anything.\\<close>\n | Reception: \"\\<lbrakk>evsr \\<in> otway;  Says A B X \\<in>set evsr\\<rbrakk> \\<Longrightarrow> Gets B X # evsr \\<in> otway\"\n   \\<comment> \\<open>A message that has been sent can be received by the intended recipient.\\<close>\n | OR1:  \"\\<lbrakk>evs1 \\<in> otway;  Nonce NA \\<notin> used evs1\\<rbrakk>\n          \\<Longrightarrow> Says A B \\<lbrace>Nonce NA, Agent A, Agent B,\n                         Crypt (shrK A) \\<lbrace>Nonce NA, Agent A, Agent B\\<rbrace> \\<rbrace>\n                 # evs1 \\<in> otway\"\n  \\<comment> \\<open>Alice initiates a protocol run\\<close>\n | OR2:  \"\\<lbrakk>evs2 \\<in> otway;  Nonce NB \\<notin> used evs2;\n             Gets B \\<lbrace>Nonce NA, Agent A, Agent B, X\\<rbrace> \\<in> set evs2\\<rbrakk>\n          \\<Longrightarrow> Says B Server\n                  \\<lbrace>Nonce NA, Agent A, Agent B, X,\n                    Crypt (shrK B)\n                      \\<lbrace>Nonce NA, Nonce NB, Agent A, Agent B\\<rbrace>\\<rbrace>\n                 # evs2 \\<in> otway\"\n   \\<comment> \\<open>Bob's response to Alice's message.  Note that NB is encrypted.\\<close>\n | OR3:  \"\\<lbrakk>evs3 \\<in> otway;  Key KAB \\<notin> used evs3;\n             Gets Server\n                  \\<lbrace>Nonce NA, Agent A, Agent B,\n                    Crypt (shrK A) \\<lbrace>Nonce NA, Agent A, Agent B\\<rbrace>,\n                    Crypt (shrK B) \\<lbrace>Nonce NA, Nonce NB, Agent A, Agent B\\<rbrace>\\<rbrace>\n               \\<in> set evs3\\<rbrakk>\n          \\<Longrightarrow> Says Server B\n                  \\<lbrace>Nonce NA,\n                    Crypt (shrK A) \\<lbrace>Nonce NA, Key KAB\\<rbrace>,\n                    Crypt (shrK B) \\<lbrace>Nonce NB, Key KAB\\<rbrace>\\<rbrace>\n                 # evs3 \\<in> otway\"\n   \\<comment> \\<open>The Server receives Bob's message and checks that the three NAs\n       match.  Then he sends a new session key to Bob with a packet for forwarding to Alice\\<close>\n | OR4:  \"\\<lbrakk>evs4 \\<in> otway;  B \\<noteq> Server;\n             Says B Server \\<lbrace>Nonce NA, Agent A, Agent B, X',\n                             Crypt (shrK B)\n                                   \\<lbrace>Nonce NA, Nonce NB, Agent A, Agent B\\<rbrace>\\<rbrace>\n               \\<in> set evs4;\n             Gets B \\<lbrace>Nonce NA, X, Crypt (shrK B) \\<lbrace>Nonce NB, Key K\\<rbrace>\\<rbrace>\n               \\<in> set evs4\\<rbrakk>\n          \\<Longrightarrow> Says B A \\<lbrace>Nonce NA, X\\<rbrace> # evs4 \\<in> otway\"\n   \\<comment> \\<open>Bob receives the Server's (?) message and compares the Nonces with\n       those in the message he previously sent the Server.\n       Need @{term\"B \\<noteq> Server\"} because we allow messages to self.\\<close>\n | Oops: \"\\<lbrakk>evso \\<in> otway;\n             Says Server B \\<lbrace>Nonce NA, X, Crypt (shrK B) \\<lbrace>Nonce NB, Key K\\<rbrace>\\<rbrace>\n               \\<in> set evso\\<rbrakk>\n          \\<Longrightarrow> Notes Spy \\<lbrace>Nonce NA, Nonce NB, Key K\\<rbrace> # evso \\<in> otway\"\n   \\<comment> \\<open>This message models possible leaks of session keys.  The nonces identify the protocol run\\<close>\n\ndeclare Says_imp_analz_Spy [dest]\ndeclare parts.Body  [dest]\ndeclare analz_into_parts [dest]\ndeclare Fake_parts_insert_in_Un  [dest]\n\n\ntext\\<open>A \"possibility property\": there are traces that reach the end\\<close>\nlemma \"\\<lbrakk>B \\<noteq> Server; Key K \\<notin> used []\\<rbrakk>\n      \\<Longrightarrow> \\<exists>evs \\<in> otway.\n             Says B A \\<lbrace>Nonce NA, Crypt (shrK A) \\<lbrace>Nonce NA, Key K\\<rbrace>\\<rbrace>\n               \\<in> set evs\"\napply (intro exI bexI)\napply (rule_tac [2] otway.Nil\n                    [THEN otway.OR1, THEN otway.Reception,\n                     THEN otway.OR2, THEN otway.Reception,\n                     THEN otway.OR3, THEN otway.Reception, THEN otway.OR4]) \napply (possibility, simp add: used_Cons) \ndone\n\nlemma Gets_imp_Says [dest!]:\n     \"\\<lbrakk>Gets B X \\<in> set evs; evs \\<in> otway\\<rbrakk> \\<Longrightarrow> \\<exists>A. Says A B X \\<in> set evs\"\napply (erule rev_mp)\napply (erule otway.induct, auto)\ndone\n\n\n(** For reasoning about the encrypted portion of messages **)\n\nlemma OR2_analz_knows_Spy:\n     \"\\<lbrakk>Gets B \\<lbrace>N, Agent A, Agent B, X\\<rbrace> \\<in> set evs;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> X \\<in> analz (knows Spy evs)\"\n  by blast\n\nlemma OR4_analz_knows_Spy:\n     \"\\<lbrakk>Gets B \\<lbrace>N, X, Crypt (shrK B) X'\\<rbrace> \\<in> set evs;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> X \\<in> analz (knows Spy evs)\"\n  by blast\n\n(*These lemmas assist simplification by removing forwarded X-variables.\n  We can replace them by rewriting with parts_insert2 and proving using\n  dest: parts_cut, but the proofs become more difficult.*)\nlemmas OR2_parts_knows_Spy =\n    OR2_analz_knows_Spy [THEN analz_into_parts]\n\n(*There could be OR4_parts_knows_Spy and Oops_parts_knows_Spy, but for\n  some reason proofs work without them!*)\n\n\ntext\\<open>Theorems of the form \\<^term>\\<open>X \\<notin> parts (spies evs)\\<close> imply that\nNOBODY sends messages containing X!\\<close>\n\ntext\\<open>Spy never sees a good agent's shared key!\\<close>\nlemma Spy_see_shrK [simp]:\n     \"evs \\<in> otway \\<Longrightarrow> (Key (shrK A) \\<in> parts (knows Spy evs)) = (A \\<in> bad)\"\nby (erule otway.induct, force,\n    drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\n\n\nlemma Spy_analz_shrK [simp]:\n     \"evs \\<in> otway \\<Longrightarrow> (Key (shrK A) \\<in> analz (knows Spy evs)) = (A \\<in> bad)\"\nby auto\n\nlemma Spy_see_shrK_D [dest!]:\n     \"\\<lbrakk>Key (shrK A) \\<in> parts (knows Spy evs);  evs \\<in> otway\\<rbrakk> \\<Longrightarrow> A \\<in> bad\"\nby (blast dest: Spy_see_shrK)\n\n\nsubsection\\<open>Towards Secrecy: Proofs Involving \\<^term>\\<open>analz\\<close>\\<close>\n\ntext \\<open>Describes the form of K and NA when the Server sends this message.  Also\n  for Oops case.\\<close>\nlemma Says_Server_message_form:\n     \"\\<lbrakk>Says Server B \\<lbrace>NA, X, Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n         evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> K \\<notin> range shrK \\<and> (\\<exists>i. NA = Nonce i) \\<and> (\\<exists>j. NB = Nonce j)\"\nby (erule rev_mp, erule otway.induct, simp_all)\n\n\n(****\n The following is to prove theorems of the form\n\n  Key K \\<in> analz (insert (Key KAB) (knows Spy evs)) \\<Longrightarrow>\n  Key K \\<in> analz (knows Spy evs)\n\n A more general formula must be proved inductively.\n****)\n\n\ntext\\<open>Session keys are not used to encrypt other session keys\\<close>\n\ntext\\<open>The equality makes the induction hypothesis easier to apply\\<close>\nlemma analz_image_freshK [rule_format]:\n \"evs \\<in> otway \\<Longrightarrow>\n   \\<forall>K KK. KK \\<subseteq> -(range shrK) \\<longrightarrow>\n          (Key K \\<in> analz (Key`KK \\<union> (knows Spy evs))) =\n          (K \\<in> KK | Key K \\<in> analz (knows Spy evs))\"\napply (erule otway.induct)\napply (frule_tac [8] Says_Server_message_form)\napply (drule_tac [7] OR4_analz_knows_Spy)\napply (drule_tac [5] OR2_analz_knows_Spy, analz_freshK, spy_analz, auto) \ndone\n\nlemma analz_insert_freshK:\n  \"\\<lbrakk>evs \\<in> otway;  KAB \\<notin> range shrK\\<rbrakk> \\<Longrightarrow>\n      (Key K \\<in> analz (insert (Key KAB) (knows Spy evs))) =\n      (K = KAB | Key K \\<in> analz (knows Spy evs))\"\nby (simp only: analz_image_freshK analz_image_freshK_simps)\n\n\ntext\\<open>The Key K uniquely identifies the Server's  message.\\<close>\nlemma unique_session_keys:\n     \"\\<lbrakk>Says Server B \\<lbrace>NA, X, Crypt (shrK B) \\<lbrace>NB, K\\<rbrace>\\<rbrace>   \\<in> set evs;\n         Says Server B' \\<lbrace>NA',X',Crypt (shrK B') \\<lbrace>NB',K\\<rbrace>\\<rbrace> \\<in> set evs;\n         evs \\<in> otway\\<rbrakk> \\<Longrightarrow> X=X' \\<and> B=B' \\<and> NA=NA' \\<and> NB=NB'\"\napply (erule rev_mp)\napply (erule rev_mp)\napply (erule otway.induct, simp_all)\napply blast+  \\<comment> \\<open>OR3 and OR4\\<close>\ndone\n\n\nsubsection\\<open>Authenticity properties relating to NA\\<close>\n\ntext\\<open>Only OR1 can have caused such a part of a message to appear.\\<close>\nlemma Crypt_imp_OR1 [rule_format]:\n \"\\<lbrakk>A \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n  \\<Longrightarrow> Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace> \\<in> parts (knows Spy evs) \\<longrightarrow>\n      Says A B \\<lbrace>NA, Agent A, Agent B,\n                 Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace>\\<rbrace>\n        \\<in> set evs\"\nby (erule otway.induct, force,\n    drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\n\nlemma Crypt_imp_OR1_Gets:\n     \"\\<lbrakk>Gets B \\<lbrace>NA, Agent A, Agent B,\n                  Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs;\n         A \\<notin> bad; evs \\<in> otway\\<rbrakk>\n       \\<Longrightarrow> Says A B \\<lbrace>NA, Agent A, Agent B,\n                      Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace>\\<rbrace>\n             \\<in> set evs\"\nby (blast dest: Crypt_imp_OR1)\n\n\ntext\\<open>The Nonce NA uniquely identifies A's message\\<close>\nlemma unique_NA:\n     \"\\<lbrakk>Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace> \\<in> parts (knows Spy evs);\n         Crypt (shrK A) \\<lbrace>NA, Agent A, Agent C\\<rbrace> \\<in> parts (knows Spy evs);\n         evs \\<in> otway;  A \\<notin> bad\\<rbrakk>\n      \\<Longrightarrow> B = C\"\napply (erule rev_mp, erule rev_mp)\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\ndone\n\n\ntext\\<open>It is impossible to re-use a nonce in both OR1 and OR2.  This holds because\n  OR2 encrypts Nonce NB.  It prevents the attack that can occur in the\n  over-simplified version of this protocol: see \\<open>OtwayRees_Bad\\<close>.\\<close>\nlemma no_nonce_OR1_OR2:\n   \"\\<lbrakk>Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace> \\<in> parts (knows Spy evs);\n       A \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n    \\<Longrightarrow> Crypt (shrK A) \\<lbrace>NA', NA, Agent A', Agent A\\<rbrace> \\<notin> parts (knows Spy evs)\"\napply (erule rev_mp)\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\ndone\n\ntext\\<open>Crucial property: If the encrypted message appears, and A has used NA\n  to start a run, then it originated with the Server!\\<close>\nlemma NA_Crypt_imp_Server_msg [rule_format]:\n     \"\\<lbrakk>A \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> Says A B \\<lbrace>NA, Agent A, Agent B,\n                     Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs \\<longrightarrow>\n          Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace> \\<in> parts (knows Spy evs)\n          \\<longrightarrow> (\\<exists>NB. Says Server B\n                         \\<lbrace>NA,\n                           Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n                           Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs)\"\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all, blast)\n  subgoal \\<comment> \\<open>OR1: by freshness\\<close>\n    by blast  \n  subgoal \\<comment> \\<open>OR3\\<close>\n    by (blast dest!: no_nonce_OR1_OR2 intro: unique_NA)\n  subgoal \\<comment> \\<open>OR4\\<close>\n    by (blast intro!: Crypt_imp_OR1) \ndone\n\n\ntext\\<open>Corollary: if A receives B's OR4 message and the nonce NA agrees\n  then the key really did come from the Server!  CANNOT prove this of the\n  bad form of this protocol, even though we can prove\n  \\<open>Spy_not_see_encrypted_key\\<close>\\<close>\nlemma A_trusts_OR4:\n     \"\\<lbrakk>Says A  B \\<lbrace>NA, Agent A, Agent B,\n                     Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs;\n         Says B' A \\<lbrace>NA, Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n     A \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n  \\<Longrightarrow> \\<exists>NB. Says Server B\n               \\<lbrace>NA,\n                 Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n                 Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace>\n                 \\<in> set evs\"\nby (blast intro!: NA_Crypt_imp_Server_msg)\n\n\ntext\\<open>Crucial secrecy property: Spy does not see the keys sent in msg OR3\n    Does not in itself guarantee security: an attack could violate\n    the premises, e.g. by having \\<^term>\\<open>A=Spy\\<close>\\<close>\nlemma secrecy_lemma:\n \"\\<lbrakk>A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n  \\<Longrightarrow> Says Server B\n        \\<lbrace>NA, Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n          Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs \\<longrightarrow>\n      Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs \\<longrightarrow>\n      Key K \\<notin> analz (knows Spy evs)\"\n  apply (erule otway.induct, force, simp_all)\n  subgoal \\<comment> \\<open>Fake\\<close>\n    by spy_analz\n  subgoal \\<comment> \\<open>OR2\\<close>\n    by (drule OR2_analz_knows_Spy) (auto simp: analz_insert_eq)\n  subgoal \\<comment> \\<open>OR3\\<close>\n    by (auto simp add: analz_insert_freshK pushes)\n  subgoal \\<comment> \\<open>OR4\\<close>\n    by (drule OR4_analz_knows_Spy) (auto simp: analz_insert_eq)\n  subgoal \\<comment> \\<open>Oops\\<close>\n    by (auto simp add: Says_Server_message_form analz_insert_freshK unique_session_keys)\n  done\n\ntheorem Spy_not_see_encrypted_key:\n     \"\\<lbrakk>Says Server B\n          \\<lbrace>NA, Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n                Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n         Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest: Says_Server_message_form secrecy_lemma)\n\ntext\\<open>This form is an immediate consequence of the previous result.  It is \nsimilar to the assertions established by other methods.  It is equivalent\nto the previous result in that the Spy already has \\<^term>\\<open>analz\\<close> and\n\\<^term>\\<open>synth\\<close> at his disposal.  However, the conclusion \n\\<^term>\\<open>Key K \\<notin> knows Spy evs\\<close> appears not to be inductive: all the cases\nother than Fake are trivial, while Fake requires \n\\<^term>\\<open>Key K \\<notin> analz (knows Spy evs)\\<close>.\\<close>\nlemma Spy_not_know_encrypted_key:\n     \"\\<lbrakk>Says Server B\n          \\<lbrace>NA, Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n                Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n         Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> knows Spy evs\"\nby (blast dest: Spy_not_see_encrypted_key)\n\n\ntext\\<open>A's guarantee.  The Oops premise quantifies over NB because A cannot know\n  what it is.\\<close>\nlemma A_gets_good_key:\n     \"\\<lbrakk>Says A  B \\<lbrace>NA, Agent A, Agent B,\n                     Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs;\n         Says B' A \\<lbrace>NA, Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n         \\<forall>NB. Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest!: A_trusts_OR4 Spy_not_see_encrypted_key)\n\n\nsubsection\\<open>Authenticity properties relating to NB\\<close>\n\ntext\\<open>Only OR2 can have caused such a part of a message to appear.  We do not\n  know anything about X: it does NOT have to have the right form.\\<close>\nlemma Crypt_imp_OR2:\n     \"\\<lbrakk>Crypt (shrK B) \\<lbrace>NA, NB, Agent A, Agent B\\<rbrace> \\<in> parts (knows Spy evs);\n         B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> \\<exists>X. Says B Server\n                 \\<lbrace>NA, Agent A, Agent B, X,\n                   Crypt (shrK B) \\<lbrace>NA, NB, Agent A, Agent B\\<rbrace>\\<rbrace>\n                 \\<in> set evs\"\napply (erule rev_mp)\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all, blast+)\ndone\n\n\ntext\\<open>The Nonce NB uniquely identifies B's  message\\<close>\nlemma unique_NB:\n     \"\\<lbrakk>Crypt (shrK B) \\<lbrace>NA, NB, Agent A, Agent B\\<rbrace> \\<in> parts(knows Spy evs);\n         Crypt (shrK B) \\<lbrace>NC, NB, Agent C, Agent B\\<rbrace> \\<in> parts(knows Spy evs);\n           evs \\<in> otway;  B \\<notin> bad\\<rbrakk>\n         \\<Longrightarrow> NC = NA \\<and> C = A\"\napply (erule rev_mp, erule rev_mp)\napply (erule otway.induct, force,\n       drule_tac [4] OR2_parts_knows_Spy, simp_all)\napply blast+  \\<comment> \\<open>Fake, OR2\\<close>\ndone\n\ntext\\<open>If the encrypted message appears, and B has used Nonce NB,\n  then it originated with the Server!  Quite messy proof.\\<close>\nlemma NB_Crypt_imp_Server_msg [rule_format]:\n \"\\<lbrakk>B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n  \\<Longrightarrow> Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace> \\<in> parts (knows Spy evs)\n      \\<longrightarrow> (\\<forall>X'. Says B Server\n                     \\<lbrace>NA, Agent A, Agent B, X',\n                       Crypt (shrK B) \\<lbrace>NA, NB, Agent A, Agent B\\<rbrace>\\<rbrace>\n           \\<in> set evs\n           \\<longrightarrow> Says Server B\n                \\<lbrace>NA, Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n                      Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace>\n                    \\<in> set evs)\"\napply simp\napply (erule otway.induct, force, simp_all)\n  subgoal \\<comment> \\<open>Fake\\<close>\n    by blast \n  subgoal \\<comment> \\<open>OR2\\<close>\n    by (force dest!: OR2_parts_knows_Spy)\n  subgoal \\<comment> \\<open>OR3\\<close>\n    by (blast dest: unique_NB dest!: no_nonce_OR1_OR2)  \\<comment> \\<open>OR3\\<close>\n  subgoal \\<comment> \\<open>OR4\\<close>\n    by (blast dest!: Crypt_imp_OR2) \ndone\n\n\ntext\\<open>Guarantee for B: if it gets a message with matching NB then the Server\n  has sent the correct message.\\<close>\ntheorem B_trusts_OR3:\n     \"\\<lbrakk>Says B Server \\<lbrace>NA, Agent A, Agent B, X',\n                         Crypt (shrK B) \\<lbrace>NA, NB, Agent A, Agent B\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         Gets B \\<lbrace>NA, X, Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n         B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> Says Server B\n               \\<lbrace>NA,\n                 Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n                 Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace>\n                 \\<in> set evs\"\nby (blast intro!: NB_Crypt_imp_Server_msg)\n\n\ntext\\<open>The obvious combination of \\<open>B_trusts_OR3\\<close> with \n      \\<open>Spy_not_see_encrypted_key\\<close>\\<close>\nlemma B_gets_good_key:\n     \"\\<lbrakk>Says B Server \\<lbrace>NA, Agent A, Agent B, X',\n                         Crypt (shrK B) \\<lbrace>NA, NB, Agent A, Agent B\\<rbrace>\\<rbrace>\n           \\<in> set evs;\n         Gets B \\<lbrace>NA, X, Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n         Notes Spy \\<lbrace>NA, NB, Key K\\<rbrace> \\<notin> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n      \\<Longrightarrow> Key K \\<notin> analz (knows Spy evs)\"\nby (blast dest!: B_trusts_OR3 Spy_not_see_encrypted_key)\n\n\nlemma OR3_imp_OR2:\n     \"\\<lbrakk>Says Server B\n              \\<lbrace>NA, Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>,\n                Crypt (shrK B) \\<lbrace>NB, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n         B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n  \\<Longrightarrow> \\<exists>X. Says B Server \\<lbrace>NA, Agent A, Agent B, X,\n                            Crypt (shrK B) \\<lbrace>NA, NB, Agent A, Agent B\\<rbrace>\\<rbrace>\n              \\<in> set evs\"\napply (erule rev_mp)\napply (erule otway.induct, simp_all)\napply (blast dest!: Crypt_imp_OR2)+\ndone\n\n\ntext\\<open>After getting and checking OR4, agent A can trust that B has been active.\n  We could probably prove that X has the expected form, but that is not\n  strictly necessary for authentication.\\<close>\ntheorem A_auths_B:\n     \"\\<lbrakk>Says B' A \\<lbrace>NA, Crypt (shrK A) \\<lbrace>NA, Key K\\<rbrace>\\<rbrace> \\<in> set evs;\n         Says A  B \\<lbrace>NA, Agent A, Agent B,\n                     Crypt (shrK A) \\<lbrace>NA, Agent A, Agent B\\<rbrace>\\<rbrace> \\<in> set evs;\n         A \\<notin> bad;  B \\<notin> bad;  evs \\<in> otway\\<rbrakk>\n  \\<Longrightarrow> \\<exists>NB X. Says B Server \\<lbrace>NA, Agent A, Agent B, X,\n                               Crypt (shrK B)  \\<lbrace>NA, NB, Agent A, Agent B\\<rbrace>\\<rbrace>\n                 \\<in> set evs\"\nby (blast dest!: A_trusts_OR4 OR3_imp_OR2)\n\nend\n", "meta": {"author": "seL4", "repo": "isabelle", "sha": "e1ab32a3bb41728cd19541063283e37919978a4c", "save_path": "github-repos/isabelle/seL4-isabelle", "path": "github-repos/isabelle/seL4-isabelle/isabelle-e1ab32a3bb41728cd19541063283e37919978a4c/src/HOL/Auth/OtwayRees.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.640635854839898, "lm_q2_score": 0.46879062662624377, "lm_q1q2_score": 0.30032408382963516}}
{"text": "(*\n * Copyright 2014, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n * @TAG(NICTA_BSD)\n *)\n\n(*\n   Nondeterministic state and error monads with failure in Isabelle.\n*)\n\nchapter \"Nondeterministic State Monad with Failure\"\n\ntheory NonDetMonad\nimports \"../Lib\"\nbegin\n\ntext {*\n  \\label{c:monads}\n\n  State monads are used extensively in the seL4 specification. They are\n  defined below.\n*}\n\nsection \"The Monad\"\n\ntext {*\n  The basic type of the nondeterministic state monad with failure is\n  very similar to the normal state monad. Instead of a pair consisting\n  of result and new state, we return a set of these pairs coupled with\n  a failure flag. Each element in the set is a potential result of the\n  computation. The flag is @{const True} if there is an execution path\n  in the computation that may have failed. Conversely, if the flag is\n  @{const False}, none of the computations resulting in the returned\n  set can have failed.  *}\ntype_synonym ('s,'a) nondet_monad = \"'s \\<Rightarrow> ('a \\<times> 's) set \\<times> bool\"\n\n\ntext \\<open>\n  Print the type @{typ \"('s,'a) nondet_monad\"} instead of its unwieldy expansion.\n  Needs an AST translation in code, because it needs to check that the state variable\n  @{typ 's} occurs twice. This comparison is not guaranteed to always work as expected\n  (AST instances might have different decoration), but it does seem to work here.\n\\<close>\nprint_ast_translation \\<open>\n  let\n    fun monad_tr _ [t1, Ast.Appl [Ast.Constant @{type_syntax prod},\n                          Ast.Appl [Ast.Constant @{type_syntax set},\n                            Ast.Appl [Ast.Constant @{type_syntax prod}, t2, t3]],\n                          Ast.Constant @{type_syntax bool}]] =\n      if t3 = t1\n      then Ast.Appl [Ast.Constant @{type_syntax \"nondet_monad\"}, t1, t2]\n      else raise Match\n  in [(@{type_syntax \"fun\"}, monad_tr)] end\n\\<close>\n\n\ntext {*\n  The definition of fundamental monad functions @{text return} and\n  @{text bind}. The monad function @{text \"return x\"} does not change\n  the  state, does not fail, and returns @{text \"x\"}.\n*}\ndefinition\n  return :: \"'a \\<Rightarrow> ('s,'a) nondet_monad\" where\n  \"return a \\<equiv> \\<lambda>s. ({(a,s)},False)\"\n\ntext {*\n  The monad function @{text \"bind f g\"}, also written @{text \"f >>= g\"},\n  is the execution of @{term f} followed by the execution of @{text g}.\n  The function @{text g} takes the result value \\emph{and} the result\n  state of @{text f} as parameter. The definition says that the result of\n  the combined operation is the union of the set of sets that is created\n  by @{text g} applied to the result sets of @{text f}. The combined\n  operation may have failed, if @{text f} may have failed or @{text g} may\n  have failed on any of the results of @{text f}.\n*}\ndefinition\n  bind :: \"('s, 'a) nondet_monad \\<Rightarrow> ('a \\<Rightarrow> ('s, 'b) nondet_monad) \\<Rightarrow>\n           ('s, 'b) nondet_monad\" (infixl \">>=\" 60)\n  where\n  \"bind f g \\<equiv> \\<lambda>s. (\\<Union>(fst ` case_prod g ` fst (f s)),\n                   True \\<in> snd ` case_prod g ` fst (f s) \\<or> snd (f s))\"\n\ntext {*\n  Sometimes it is convenient to write @{text bind} in reverse order.\n*}\nabbreviation(input)\n  bind_rev :: \"('c \\<Rightarrow> ('a, 'b) nondet_monad) \\<Rightarrow> ('a, 'c) nondet_monad \\<Rightarrow>\n               ('a, 'b) nondet_monad\" (infixl \"=<<\" 60) where\n  \"g =<< f \\<equiv> f >>= g\"\n\ntext {*\n  The basic accessor functions of the state monad. @{text get} returns\n  the current state as result, does not fail, and does not change the state.\n  @{text \"put s\"} returns nothing (@{typ unit}), changes the current state\n  to @{text s} and does not fail.\n*}\ndefinition\n  get :: \"('s,'s) nondet_monad\" where\n  \"get \\<equiv> \\<lambda>s. ({(s,s)}, False)\"\n\ndefinition\n  put :: \"'s \\<Rightarrow> ('s, unit) nondet_monad\" where\n  \"put s \\<equiv> \\<lambda>_. ({((),s)}, False)\"\n\n\nsubsection \"Nondeterminism\"\n\ntext {*\n  Basic nondeterministic functions. @{text \"select A\"} chooses an element\n  of the set @{text A}, does not change the state, and does not fail\n  (even if the set is empty). @{text \"f OR g\"} executes @{text f} or\n  executes @{text g}. It retuns the union of results of @{text f} and\n  @{text g}, and may have failed if either may have failed.\n*}\ndefinition\n  select :: \"'a set \\<Rightarrow> ('s,'a) nondet_monad\" where\n  \"select A \\<equiv> \\<lambda>s. (A \\<times> {s}, False)\"\n\ndefinition\n  alternative :: \"('s,'a) nondet_monad \\<Rightarrow> ('s,'a) nondet_monad \\<Rightarrow>\n                  ('s,'a) nondet_monad\"\n  (infixl \"OR\" 20)\nwhere\n  \"f OR g \\<equiv> \\<lambda>s. (fst (f s) \\<union> fst (g s), snd (f s) \\<or> snd (g s))\"\n\ntext {* Alternative notation for @{text OR} *}\nnotation (xsymbols)  alternative (infixl \"\\<sqinter>\" 20)\n\n\ntext {* A variant of @{text select} that takes a pair. The first component\n  is a set as in normal @{text select}, the second component indicates\n  whether the execution failed. This is useful to lift monads between\n  different state spaces.\n*}\ndefinition\n  select_f :: \"'a set \\<times> bool  \\<Rightarrow> ('s,'a) nondet_monad\" where\n  \"select_f S \\<equiv> \\<lambda>s. (fst S \\<times> {s}, snd S)\"\n\ntext {* @{text select_state} takes a relationship between\n  states, and outputs nondeterministically a state\n  related to the input state. *}\n\ndefinition\n  state_select :: \"('s \\<times> 's) set \\<Rightarrow> ('s, unit) nondet_monad\"\nwhere\n  \"state_select r \\<equiv> \\<lambda>s. ((\\<lambda>x. ((), x)) ` {s'. (s, s') \\<in> r}, \\<not> (\\<exists>s'. (s, s') \\<in> r))\"\n\nsubsection \"Failure\"\n\ntext {* The monad function that always fails. Returns an empty set of\nresults and sets the failure flag. *}\ndefinition\n  fail :: \"('s, 'a) nondet_monad\" where\n \"fail \\<equiv> \\<lambda>s. ({}, True)\"\n\ntext {* Assertions: fail if the property @{text P} is not true *}\ndefinition\n  assert :: \"bool \\<Rightarrow> ('a, unit) nondet_monad\" where\n \"assert P \\<equiv> if P then return () else fail\"\n\ntext {* Fail if the value is @{const None},\n  return result @{text v} for @{term \"Some v\"} *}\ndefinition\n  assert_opt :: \"'a option \\<Rightarrow> ('b, 'a) nondet_monad\" where\n \"assert_opt v \\<equiv> case v of None \\<Rightarrow> fail | Some v \\<Rightarrow> return v\"\n\ntext {* An assertion that also can introspect the current state. *}\n\ndefinition\n  state_assert :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, unit) nondet_monad\"\nwhere\n  \"state_assert P \\<equiv> get >>= (\\<lambda>s. assert (P s))\"\n\nsubsection \"Generic functions on top of the state monad\"\n\ntext {* Apply a function to the current state and return the result\nwithout changing the state. *}\ndefinition\n  gets :: \"('s \\<Rightarrow> 'a) \\<Rightarrow> ('s, 'a) nondet_monad\" where\n \"gets f \\<equiv> get >>= (\\<lambda>s. return (f s))\"\n\ntext {* Modify the current state using the function passed in. *}\ndefinition\n  modify :: \"('s \\<Rightarrow> 's) \\<Rightarrow> ('s, unit) nondet_monad\" where\n \"modify f \\<equiv> get >>= (\\<lambda>s. put (f s))\"\n\nlemma simpler_gets_def: \"gets f = (\\<lambda>s. ({(f s, s)}, False))\"\n  apply (simp add: gets_def return_def bind_def get_def)\n  done\n\nlemma simpler_modify_def:\n  \"modify f = (\\<lambda>s. ({((), f s)}, False))\"\n  by (simp add: modify_def bind_def get_def put_def)\n\ntext {* Execute the given monad when the condition is true,\n  return @{text \"()\"} otherwise. *}\ndefinition\n  \"when\" :: \"bool \\<Rightarrow> ('s, unit) nondet_monad \\<Rightarrow>\n           ('s, unit) nondet_monad\" where\n  \"when P m \\<equiv> if P then m else return ()\"\n\ntext {* Execute the given monad unless the condition is true,\n  return @{text \"()\"} otherwise. *}\ndefinition\n  unless :: \"bool \\<Rightarrow> ('s, unit) nondet_monad \\<Rightarrow>\n            ('s, unit) nondet_monad\" where\n  \"unless P m \\<equiv> when (\\<not>P) m\"\n\ntext {*\n  Perform a test on the current state, performing the left monad if\n  the result is true or the right monad if the result is false.\n*}\ndefinition\n  condition :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'r) nondet_monad \\<Rightarrow> ('s, 'r) nondet_monad \\<Rightarrow> ('s, 'r) nondet_monad\"\nwhere\n  \"condition P L R \\<equiv> \\<lambda>s. if (P s) then (L s) else (R s)\"\n\nnotation (output)\n  condition  (\"(condition (_)//  (_)//  (_))\" [1000,1000,1000] 1000)\n\ntext {*\nApply an option valued function to the current state, fail\nif it returns @{const None}, return @{text v} if it returns\n@{term \"Some v\"}.\n*}\ndefinition\n  gets_the :: \"('s \\<Rightarrow> 'a option) \\<Rightarrow> ('s, 'a) nondet_monad\" where\n \"gets_the f \\<equiv> gets f >>= assert_opt\"\n\n\nsubsection {* The Monad Laws *}\n\ntext {* A more expanded definition of @{text bind} *}\nlemma bind_def':\n  \"(f >>= g) \\<equiv>\n       \\<lambda>s. ({(r'', s''). \\<exists>(r', s') \\<in> fst (f s). (r'', s'') \\<in> fst (g r' s') },\n                     snd (f s) \\<or> (\\<exists>(r', s') \\<in> fst (f s). snd (g r' s')))\"\n  apply (rule eq_reflection)\n  apply (auto simp add: bind_def split_def Let_def)\n  done\n\ntext {* Each monad satisfies at least the following three laws. *}\n\ntext {* @{term return} is absorbed at the left of a @{term bind},\n  applying the return value directly: *}\nlemma return_bind [simp]: \"(return x >>= f) = f x\"\n  by (simp add: return_def bind_def)\n\ntext {* @{term return} is absorbed on the right of a @{term bind} *}\nlemma bind_return [simp]: \"(m >>= return) = m\"\n  apply (rule ext)\n  apply (simp add: bind_def return_def split_def)\n  done\n\ntext {* @{term bind} is associative *}\nlemma bind_assoc:\n  fixes m :: \"('a,'b) nondet_monad\"\n  fixes f :: \"'b \\<Rightarrow> ('a,'c) nondet_monad\"\n  fixes g :: \"'c \\<Rightarrow> ('a,'d) nondet_monad\"\n  shows \"(m >>= f) >>= g  =  m >>= (\\<lambda>x. f x >>= g)\"\n  apply (unfold bind_def Let_def split_def)\n  apply (rule ext)\n  apply clarsimp\n  apply (auto intro: rev_image_eqI)\n  done\n\n\nsection {* Adding Exceptions *}\n\ntext {*\n  The type @{typ \"('s,'a) nondet_monad\"} gives us nondeterminism and\n  failure. We now extend this monad with exceptional return values\n  that abort normal execution, but can be handled explicitly.\n  We use the sum type to indicate exceptions.\n\n  In @{typ \"('s, 'e + 'a) nondet_monad\"}, @{typ \"'s\"} is the state,\n  @{typ 'e} is an exception, and @{typ 'a} is a normal return value.\n\n  This new type itself forms a monad again. Since type classes in\n  Isabelle are not powerful enough to express the class of monads,\n  we provide new names for the @{term return} and @{term bind} functions\n  in this monad. We call them @{text returnOk} (for normal return values)\n  and @{text bindE} (for composition). We also define @{text throwError}\n  to return an exceptional value.\n*}\ndefinition\n  returnOk :: \"'a \\<Rightarrow> ('s, 'e + 'a) nondet_monad\" where\n  \"returnOk \\<equiv> return o Inr\"\n\ndefinition\n  throwError :: \"'e \\<Rightarrow> ('s, 'e + 'a) nondet_monad\" where\n  \"throwError \\<equiv> return o Inl\"\n\ntext {*\n  Lifting a function over the exception type: if the input is an\n  exception, return that exception; otherwise continue execution.\n*}\ndefinition\n  lift :: \"('a \\<Rightarrow> ('s, 'e + 'b) nondet_monad) \\<Rightarrow>\n           'e +'a \\<Rightarrow> ('s, 'e + 'b) nondet_monad\"\nwhere\n  \"lift f v \\<equiv> case v of Inl e \\<Rightarrow> throwError e\n                      | Inr v' \\<Rightarrow> f v'\"\n\ntext {*\n  The definition of @{term bind} in the exception monad (new\n  name @{text bindE}): the same as normal @{term bind}, but\n  the right-hand side is skipped if the left-hand side\n  produced an exception.\n*}\ndefinition\n  bindE :: \"('s, 'e + 'a) nondet_monad \\<Rightarrow>\n            ('a \\<Rightarrow> ('s, 'e + 'b) nondet_monad) \\<Rightarrow>\n            ('s, 'e + 'b) nondet_monad\"  (infixl \">>=E\" 60)\nwhere\n  \"bindE f g \\<equiv> bind f (lift g)\"\n\n\ntext {*\n  Lifting a normal nondeterministic monad into the\n  exception monad is achieved by always returning its\n  result as normal result and never throwing an exception.\n*}\ndefinition\n  liftE :: \"('s,'a) nondet_monad \\<Rightarrow> ('s, 'e+'a) nondet_monad\"\nwhere\n  \"liftE f \\<equiv> f >>= (\\<lambda>r. return (Inr r))\"\n\n\ntext {*\n  Since the underlying type and @{text return} function changed,\n  we need new definitions for when and unless:\n*}\ndefinition\n  whenE :: \"bool \\<Rightarrow> ('s, 'e + unit) nondet_monad \\<Rightarrow>\n            ('s, 'e + unit) nondet_monad\"\n  where\n  \"whenE P f \\<equiv> if P then f else returnOk ()\"\n\ndefinition\n  unlessE :: \"bool \\<Rightarrow> ('s, 'e + unit) nondet_monad \\<Rightarrow>\n            ('s, 'e + unit) nondet_monad\"\n  where\n  \"unlessE P f \\<equiv> if P then returnOk () else f\"\n\n\ntext {*\n  Throwing an exception when the parameter is @{term None}, otherwise\n  returning @{term \"v\"} for @{term \"Some v\"}.\n*}\ndefinition\n  throw_opt :: \"'e \\<Rightarrow> 'a option \\<Rightarrow> ('s, 'e + 'a) nondet_monad\" where\n  \"throw_opt ex x \\<equiv>\n  case x of None \\<Rightarrow> throwError ex | Some v \\<Rightarrow> returnOk v\"\n\n\ntext {*\n  Failure in the exception monad is redefined in the same way\n  as @{const whenE} and @{const unlessE}, with @{term returnOk}\n  instead of @{term return}.\n*}\ndefinition\n  assertE :: \"bool \\<Rightarrow> ('a, 'e + unit) nondet_monad\" where\n \"assertE P \\<equiv> if P then returnOk () else fail\"\n\nsubsection \"Monad Laws for the Exception Monad\"\n\ntext {* More direct definition of @{const liftE}: *}\nlemma liftE_def2:\n  \"liftE f = (\\<lambda>s. ((\\<lambda>(v,s'). (Inr v, s')) ` fst (f s), snd (f s)))\"\n  by (auto simp: liftE_def return_def split_def bind_def)\n\ntext {* Left @{const returnOk} absorbtion over @{term bindE}: *}\nlemma returnOk_bindE [simp]: \"(returnOk x >>=E f) = f x\"\n  apply (unfold bindE_def returnOk_def)\n  apply (clarsimp simp: lift_def)\n  done\n\nlemma lift_return [simp]:\n  \"lift (return \\<circ> Inr) = return\"\n  by (rule ext)\n     (simp add: lift_def throwError_def split: sum.splits)\n\ntext {* Right @{const returnOk} absorbtion over @{term bindE}: *}\nlemma bindE_returnOk [simp]: \"(m >>=E returnOk) = m\"\n  by (simp add: bindE_def returnOk_def)\n\ntext {* Associativity of @{const bindE}: *}\nlemma bindE_assoc:\n  \"(m >>=E f) >>=E g = m >>=E (\\<lambda>x. f x >>=E g)\"\n  apply (simp add: bindE_def bind_assoc)\n  apply (rule arg_cong [where f=\"\\<lambda>x. m >>= x\"])\n  apply (rule ext)\n  apply (case_tac x, simp_all add: lift_def throwError_def)\n  done\n\ntext {* @{const returnOk} could also be defined via @{const liftE}: *}\nlemma returnOk_liftE:\n  \"returnOk x = liftE (return x)\"\n  by (simp add: liftE_def returnOk_def)\n\ntext {* Execution after throwing an exception is skipped: *}\nlemma throwError_bindE [simp]:\n  \"(throwError E >>=E f) = throwError E\"\n  by (simp add: bindE_def bind_def throwError_def lift_def return_def)\n\n\nsection \"Syntax\"\n\ntext {* This section defines traditional Haskell-like do-syntax\n  for the state monad in Isabelle. *}\n\nsubsection \"Syntax for the Nondeterministic State Monad\"\n\ntext {* We use @{text K_bind} to syntactically indicate the\n  case where the return argument of the left side of a @{term bind}\n  is ignored *}\ndefinition\n  K_bind_def [iff]: \"K_bind \\<equiv> \\<lambda>x y. x\"\n\nnonterminal\n  dobinds and dobind and nobind\n\nsyntax\n  \"_dobind\"    :: \"[pttrn, 'a] => dobind\"             (\"(_ <-/ _)\" 10)\n  \"\"           :: \"dobind => dobinds\"                 (\"_\")\n  \"_nobind\"    :: \"'a => dobind\"                      (\"_\")\n  \"_dobinds\"   :: \"[dobind, dobinds] => dobinds\"      (\"(_);//(_)\")\n\n  \"_do\"        :: \"[dobinds, 'a] => 'a\"               (\"(do ((_);//(_))//od)\" 100)\nsyntax (xsymbols)\n  \"_dobind\"    :: \"[pttrn, 'a] => dobind\"             (\"(_ \\<leftarrow>/ _)\" 10)\n\ntranslations\n  \"_do (_dobinds b bs) e\"  == \"_do b (_do bs e)\"\n  \"_do (_nobind b) e\"      == \"b >>= (CONST K_bind e)\"\n  \"do x <- a; e od\"        == \"a >>= (\\<lambda>x. e)\"\n\ntext {* Syntax examples: *}\nlemma \"do x \\<leftarrow> return 1;\n          return (2::nat);\n          return x\n       od =\n       return 1 >>=\n       (\\<lambda>x. return (2::nat) >>=\n            K_bind (return x))\"\n  by (rule refl)\n\nlemma \"do x \\<leftarrow> return 1;\n          return 2;\n          return x\n       od = return 1\"\n  by simp\n\nsubsection \"Syntax for the Exception Monad\"\n\ntext {*\n  Since the exception monad is a different type, we\n  need to syntactically distinguish it in the syntax.\n  We use @{text doE}/@{text odE} for this, but can re-use\n  most of the productions from @{text do}/@{text od}\n  above.\n*}\n\nsyntax\n  \"_doE\" :: \"[dobinds, 'a] => 'a\"  (\"(doE ((_);//(_))//odE)\" 100)\n\ntranslations\n  \"_doE (_dobinds b bs) e\"  == \"_doE b (_doE bs e)\"\n  \"_doE (_nobind b) e\"      == \"b >>=E (CONST K_bind e)\"\n  \"doE x <- a; e odE\"       == \"a >>=E (\\<lambda>x. e)\"\n\ntext {* Syntax examples: *}\nlemma \"doE x \\<leftarrow> returnOk 1;\n           returnOk (2::nat);\n           returnOk x\n       odE =\n       returnOk 1 >>=E\n       (\\<lambda>x. returnOk (2::nat) >>=E\n            K_bind (returnOk x))\"\n  by (rule refl)\n\nlemma \"doE x \\<leftarrow> returnOk 1;\n           returnOk 2;\n           returnOk x\n       odE = returnOk 1\"\n  by simp\n\n\n\nsection \"Library of Monadic Functions and Combinators\"\n\n\ntext {* Lifting a normal function into the monad type: *}\ndefinition\n  liftM :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('s,'a) nondet_monad \\<Rightarrow> ('s, 'b) nondet_monad\"\nwhere\n  \"liftM f m \\<equiv> do x \\<leftarrow> m; return (f x) od\"\n\ntext {* The same for the exception monad: *}\ndefinition\n  liftME :: \"('a \\<Rightarrow> 'b) \\<Rightarrow> ('s,'e+'a) nondet_monad \\<Rightarrow> ('s,'e+'b) nondet_monad\"\nwhere\n  \"liftME f m \\<equiv> doE x \\<leftarrow> m; returnOk (f x) odE\"\n\ntext {*\n  Run a sequence of monads from left to right, ignoring return values. *}\ndefinition\n  sequence_x :: \"('s, 'a) nondet_monad list \\<Rightarrow> ('s, unit) nondet_monad\"\nwhere\n  \"sequence_x xs \\<equiv> foldr (\\<lambda>x y. x >>= (\\<lambda>_. y)) xs (return ())\"\n\ntext {*\n  Map a monadic function over a list by applying it to each element\n  of the list from left to right, ignoring return values.\n*}\ndefinition\n  mapM_x :: \"('a \\<Rightarrow> ('s,'b) nondet_monad) \\<Rightarrow> 'a list \\<Rightarrow> ('s, unit) nondet_monad\"\nwhere\n  \"mapM_x f xs \\<equiv> sequence_x (map f xs)\"\n\ntext {*\n  Map a monadic function with two parameters over two lists,\n  going through both lists simultaneously, left to right, ignoring\n  return values.\n*}\ndefinition\n  zipWithM_x :: \"('a \\<Rightarrow> 'b \\<Rightarrow> ('s,'c) nondet_monad) \\<Rightarrow>\n                 'a list \\<Rightarrow> 'b list \\<Rightarrow> ('s, unit) nondet_monad\"\nwhere\n  \"zipWithM_x f xs ys \\<equiv> sequence_x (zipWith f xs ys)\"\n\n\ntext {* The same three functions as above, but returning a list of\nreturn values instead of @{text unit} *}\ndefinition\n  sequence :: \"('s, 'a) nondet_monad list \\<Rightarrow> ('s, 'a list) nondet_monad\"\nwhere\n  \"sequence xs \\<equiv> let mcons = (\\<lambda>p q. p >>= (\\<lambda>x. q >>= (\\<lambda>y. return (x#y))))\n                 in foldr mcons xs (return [])\"\n\ndefinition\n  mapM :: \"('a \\<Rightarrow> ('s,'b) nondet_monad) \\<Rightarrow> 'a list \\<Rightarrow> ('s, 'b list) nondet_monad\"\nwhere\n  \"mapM f xs \\<equiv> sequence (map f xs)\"\n\ndefinition\n  zipWithM :: \"('a \\<Rightarrow> 'b \\<Rightarrow> ('s,'c) nondet_monad) \\<Rightarrow>\n                 'a list \\<Rightarrow> 'b list \\<Rightarrow> ('s, 'c list) nondet_monad\"\nwhere\n  \"zipWithM f xs ys \\<equiv> sequence (zipWith f xs ys)\"\n\ndefinition\n  foldM :: \"('b \\<Rightarrow> 'a \\<Rightarrow> ('s, 'a) nondet_monad) \\<Rightarrow> 'b list \\<Rightarrow> 'a \\<Rightarrow> ('s, 'a) nondet_monad\"\nwhere\n  \"foldM m xs a \\<equiv> foldr (\\<lambda>p q. q >>= m p) xs (return a) \"\n\ndefinition\n  foldME ::\"('b \\<Rightarrow> 'a \\<Rightarrow> ('s,('e + 'b)) nondet_monad) \\<Rightarrow> 'b \\<Rightarrow> 'a list \\<Rightarrow> ('s, ('e + 'b)) nondet_monad\"\nwhere \"foldME m a xs \\<equiv> foldr (\\<lambda>p q. q >>=E swp m p) xs (returnOk a)\"\n\ntext {* The sequence and map functions above for the exception monad,\nwith and without lists of return value *}\ndefinition\n  sequenceE_x :: \"('s, 'e+'a) nondet_monad list \\<Rightarrow> ('s, 'e+unit) nondet_monad\"\nwhere\n  \"sequenceE_x xs \\<equiv> foldr (\\<lambda>x y. doE _ <- x; y odE) xs (returnOk ())\"\n\ndefinition\n  mapME_x :: \"('a \\<Rightarrow> ('s,'e+'b) nondet_monad) \\<Rightarrow> 'a list \\<Rightarrow>\n              ('s,'e+unit) nondet_monad\"\nwhere\n  \"mapME_x f xs \\<equiv> sequenceE_x (map f xs)\"\n\ndefinition\n  sequenceE :: \"('s, 'e+'a) nondet_monad list \\<Rightarrow> ('s, 'e+'a list) nondet_monad\"\nwhere\n  \"sequenceE xs \\<equiv> let mcons = (\\<lambda>p q. p >>=E (\\<lambda>x. q >>=E (\\<lambda>y. returnOk (x#y))))\n                 in foldr mcons xs (returnOk [])\"\n\ndefinition\n  mapME :: \"('a \\<Rightarrow> ('s,'e+'b) nondet_monad) \\<Rightarrow> 'a list \\<Rightarrow>\n              ('s,'e+'b list) nondet_monad\"\nwhere\n  \"mapME f xs \\<equiv> sequenceE (map f xs)\"\n\n\ntext {* Filtering a list using a monadic function as predicate: *}\nprimrec\n  filterM :: \"('a \\<Rightarrow> ('s, bool) nondet_monad) \\<Rightarrow> 'a list \\<Rightarrow> ('s, 'a list) nondet_monad\"\nwhere\n  \"filterM P []       = return []\"\n| \"filterM P (x # xs) = do\n     b  <- P x;\n     ys <- filterM P xs;\n     return (if b then (x # ys) else ys)\n   od\"\n\n\nsection \"Catching and Handling Exceptions\"\n\ntext {*\n  Turning an exception monad into a normal state monad\n  by catching and handling any potential exceptions:\n*}\ndefinition\n  catch :: \"('s, 'e + 'a) nondet_monad \\<Rightarrow>\n            ('e \\<Rightarrow> ('s, 'a) nondet_monad) \\<Rightarrow>\n            ('s, 'a) nondet_monad\" (infix \"<catch>\" 10)\nwhere\n  \"f <catch> handler \\<equiv>\n     do x \\<leftarrow> f;\n        case x of\n          Inr b \\<Rightarrow> return b\n        | Inl e \\<Rightarrow> handler e\n     od\"\n\ntext {*\n  Handling exceptions, but staying in the exception monad.\n  The handler may throw a type of exceptions different from\n  the left side.\n*}\ndefinition\n  handleE' :: \"('s, 'e1 + 'a) nondet_monad \\<Rightarrow>\n               ('e1 \\<Rightarrow> ('s, 'e2 + 'a) nondet_monad) \\<Rightarrow>\n               ('s, 'e2 + 'a) nondet_monad\" (infix \"<handle2>\" 10)\nwhere\n  \"f <handle2> handler \\<equiv>\n   do\n      v \\<leftarrow> f;\n      case v of\n        Inl e \\<Rightarrow> handler e\n      | Inr v' \\<Rightarrow> return (Inr v')\n   od\"\n\ntext {*\n  A type restriction of the above that is used more commonly in\n  practice: the exception handle (potentially) throws exception\n  of the same type as the left-hand side.\n*}\ndefinition\n  handleE :: \"('s, 'x + 'a) nondet_monad \\<Rightarrow>\n              ('x \\<Rightarrow> ('s, 'x + 'a) nondet_monad) \\<Rightarrow>\n              ('s, 'x + 'a) nondet_monad\" (infix \"<handle>\" 10)\nwhere\n  \"handleE \\<equiv> handleE'\"\n\n\ntext {*\n  Handling exceptions, and additionally providing a continuation\n  if the left-hand side throws no exception:\n*}\ndefinition\n  handle_elseE :: \"('s, 'e + 'a) nondet_monad \\<Rightarrow>\n                   ('e \\<Rightarrow> ('s, 'ee + 'b) nondet_monad) \\<Rightarrow>\n                   ('a \\<Rightarrow> ('s, 'ee + 'b) nondet_monad) \\<Rightarrow>\n                   ('s, 'ee + 'b) nondet_monad\"\n  (\"_ <handle> _ <else> _\" 10)\nwhere\n  \"f <handle> handler <else> continue \\<equiv>\n   do v \\<leftarrow> f;\n   case v of Inl e  \\<Rightarrow> handler e\n           | Inr v' \\<Rightarrow> continue v'\n   od\"\n\nsubsection \"Loops\"\n\ntext {*\n  Loops are handled using the following inductive predicate;\n  non-termination is represented using the failure flag of the\n  monad.\n*}\n\ninductive_set\n  whileLoop_results :: \"('r \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('r \\<Rightarrow> ('s, 'r) nondet_monad) \\<Rightarrow> ((('r \\<times> 's) option) \\<times> (('r \\<times> 's) option)) set\"\n  for C B\nwhere\n    \"\\<lbrakk> \\<not> C r s \\<rbrakk> \\<Longrightarrow> (Some (r, s), Some (r, s)) \\<in> whileLoop_results C B\"\n  | \"\\<lbrakk> C r s; snd (B r s) \\<rbrakk> \\<Longrightarrow> (Some (r, s), None) \\<in> whileLoop_results C B\"\n  | \"\\<lbrakk> C r s; (r', s') \\<in> fst (B r s); (Some (r', s'), z) \\<in> whileLoop_results C B  \\<rbrakk>\n       \\<Longrightarrow> (Some (r, s), z) \\<in> whileLoop_results C B\"\n\ninductive_cases whileLoop_results_cases_valid: \"(Some x, Some y) \\<in> whileLoop_results C B\"\ninductive_cases whileLoop_results_cases_fail: \"(Some x, None) \\<in> whileLoop_results C B\"\ninductive_simps whileLoop_results_simps: \"(Some x, y) \\<in> whileLoop_results C B\"\ninductive_simps whileLoop_results_simps_valid: \"(Some x, Some y) \\<in> whileLoop_results C B\"\ninductive_simps whileLoop_results_simps_start_fail [simp]: \"(None, x) \\<in> whileLoop_results C B\"\n\ninductive\n  whileLoop_terminates :: \"('r \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('r \\<Rightarrow> ('s, 'r) nondet_monad) \\<Rightarrow> 'r \\<Rightarrow> 's \\<Rightarrow> bool\"\n  for C B\nwhere\n    \"\\<not> C r s \\<Longrightarrow> whileLoop_terminates C B r s\"\n  | \"\\<lbrakk> C r s; \\<forall>(r', s') \\<in> fst (B r s). whileLoop_terminates C B r' s' \\<rbrakk>\n        \\<Longrightarrow> whileLoop_terminates C B r s\"\n\ninductive_cases whileLoop_terminates_cases: \"whileLoop_terminates C B r s\"\ninductive_simps whileLoop_terminates_simps: \"whileLoop_terminates C B r s\"\n\ndefinition\n  \"whileLoop C B \\<equiv> (\\<lambda>r s.\n     ({(r',s'). (Some (r, s), Some (r', s')) \\<in> whileLoop_results C B},\n        (Some (r, s), None) \\<in> whileLoop_results C B \\<or> (\\<not> whileLoop_terminates C B r s)))\"\n\nnotation (output)\n  whileLoop  (\"(whileLoop (_)//  (_))\" [1000, 1000] 1000)\n\ndefinition\n  whileLoopE :: \"('r \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> ('r \\<Rightarrow> ('s, 'e + 'r) nondet_monad)\n      \\<Rightarrow> 'r \\<Rightarrow> 's \\<Rightarrow> (('e + 'r) \\<times> 's) set \\<times> bool\"\nwhere\n  \"whileLoopE C body \\<equiv>\n      \\<lambda>r. whileLoop (\\<lambda>r s. (case r of Inr v \\<Rightarrow> C v s | _ \\<Rightarrow> False)) (lift body) (Inr r)\"\n\nnotation (output)\n  whileLoopE  (\"(whileLoopE (_)//  (_))\" [1000, 1000] 1000)\n\nsection \"Hoare Logic\"\n\nsubsection \"Validity\"\n\ntext {* This section defines a Hoare logic for partial correctness for\n  the nondeterministic state monad as well as the exception monad.\n  The logic talks only about the behaviour part of the monad and ignores\n  the failure flag.\n\n  The logic is defined semantically. Rules work directly on the\n  validity predicate.\n\n  In the nondeterministic state monad, validity is a triple of precondition,\n  monad, and postcondition. The precondition is a function from state to\n  bool (a state predicate), the postcondition is a function from return value\n  to state to bool. A triple is valid if for all states that satisfy the\n  precondition, all result values and result states that are returned by\n  the monad satisfy the postcondition. Note that if the computation returns\n  the empty set, the triple is trivially valid. This means @{term \"assert P\"}\n  does not require us to prove that @{term P} holds, but rather allows us\n  to assume @{term P}! Proving non-failure is done via separate predicate and\n  calculus (see below).\n*}\ndefinition\n  valid :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) nondet_monad \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  (\"\\<lbrace>_\\<rbrace>/ _ /\\<lbrace>_\\<rbrace>\")\nwhere\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace> \\<equiv> \\<forall>s. P s \\<longrightarrow> (\\<forall>(r,s') \\<in> fst (f s). Q r s')\"\n\ntext {*\n  We often reason about invariant predicates. The following provides shorthand syntax\n  that avoids repeating potentially long predicates.\n*}\nabbreviation (input)\n  invariant :: \"('s,'a) nondet_monad \\<Rightarrow> ('s \\<Rightarrow> bool) \\<Rightarrow> bool\" (\"_ \\<lbrace>_\\<rbrace>\" [59,0] 60)\nwhere\n  \"invariant f P \\<equiv> \\<lbrace>P\\<rbrace> f \\<lbrace>\\<lambda>_. P\\<rbrace>\"\n\ntext {*\n  Validity for the exception monad is similar and build on the standard\n  validity above. Instead of one postcondition, we have two: one for\n  normal and one for exceptional results.\n*}\ndefinition\n  validE :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'a + 'b) nondet_monad \\<Rightarrow>\n             ('b \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow>\n             ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n(\"\\<lbrace>_\\<rbrace>/ _ /(\\<lbrace>_\\<rbrace>,/ \\<lbrace>_\\<rbrace>)\")\nwhere\n  \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,\\<lbrace>E\\<rbrace> \\<equiv> \\<lbrace>P\\<rbrace> f \\<lbrace> \\<lambda>v s. case v of Inr r \\<Rightarrow> Q r s | Inl e \\<Rightarrow> E e s \\<rbrace>\"\n\n\ntext {*\n  The following two instantiations are convenient to separate reasoning\n  for exceptional and normal case.\n*}\ndefinition\n  validE_R :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'e + 'a) nondet_monad \\<Rightarrow>\n               ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n   (\"\\<lbrace>_\\<rbrace>/ _ /\\<lbrace>_\\<rbrace>, -\")\nwhere\n \"\\<lbrace>P\\<rbrace> f \\<lbrace>Q\\<rbrace>,- \\<equiv> validE P f Q (\\<lambda>x y. True)\"\n\ndefinition\n  validE_E :: \"('s \\<Rightarrow> bool) \\<Rightarrow>  ('s, 'e + 'a) nondet_monad \\<Rightarrow>\n               ('e \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n   (\"\\<lbrace>_\\<rbrace>/ _ /-, \\<lbrace>_\\<rbrace>\")\nwhere\n \"\\<lbrace>P\\<rbrace> f -,\\<lbrace>Q\\<rbrace> \\<equiv> validE P f (\\<lambda>x y. True) Q\"\n\n\ntext {* Abbreviations for trivial preconditions: *}\nabbreviation(input)\n  top :: \"'a \\<Rightarrow> bool\" (\"\\<top>\")\nwhere\n  \"\\<top> \\<equiv> \\<lambda>_. True\"\n\nabbreviation(input)\n  bottom :: \"'a \\<Rightarrow> bool\" (\"\\<bottom>\")\nwhere\n  \"\\<bottom> \\<equiv> \\<lambda>_. False\"\n\ntext {* Abbreviations for trivial postconditions (taking two arguments): *}\nabbreviation(input)\n  toptop :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (\"\\<top>\\<top>\")\nwhere\n \"\\<top>\\<top> \\<equiv> \\<lambda>_ _. True\"\n\nabbreviation(input)\n  botbot :: \"'a \\<Rightarrow> 'b \\<Rightarrow> bool\" (\"\\<bottom>\\<bottom>\")\nwhere\n \"\\<bottom>\\<bottom> \\<equiv> \\<lambda>_ _. False\"\n\ntext {*\n  Lifting @{text \"\\<and>\"} and @{text \"\\<or>\"} over two arguments.\n  Lifting @{text \"\\<and>\"} and @{text \"\\<or>\"} over one argument is already\n  defined (written @{text \"and\"} and @{text \"or\"}).\n*}\ndefinition\n  bipred_conj :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\"\n  (infixl \"And\" 96)\nwhere\n  \"bipred_conj P Q \\<equiv> \\<lambda>x y. P x y \\<and> Q x y\"\n\ndefinition\n  bipred_disj :: \"('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool) \\<Rightarrow> ('a \\<Rightarrow> 'b \\<Rightarrow> bool)\"\n  (infixl \"Or\" 91)\nwhere\n  \"bipred_disj P Q \\<equiv> \\<lambda>x y. P x y \\<or> Q x y\"\n\n\nsubsection \"Determinism\"\n\ntext {* A monad of type @{text nondet_monad} is deterministic iff it\nreturns exactly one state and result and does not fail *}\ndefinition\n  det :: \"('a,'s) nondet_monad \\<Rightarrow> bool\"\nwhere\n  \"det f \\<equiv> \\<forall>s. \\<exists>r. f s = ({r},False)\"\n\ntext {* A deterministic @{text nondet_monad} can be turned\n  into a normal state monad: *}\ndefinition\n  the_run_state :: \"('s,'a) nondet_monad \\<Rightarrow> 's \\<Rightarrow> 'a \\<times> 's\"\nwhere\n  \"the_run_state M \\<equiv> \\<lambda>s. THE s'. fst (M s) = {s'}\"\n\n\nsubsection \"Non-Failure\"\n\ntext {*\n  With the failure flag, we can formulate non-failure separately\n  from validity. A monad @{text m} does not fail under precondition\n  @{text P}, if for no start state in that precondition it sets\n  the failure flag.\n*}\ndefinition\n  no_fail :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) nondet_monad \\<Rightarrow> bool\"\nwhere\n  \"no_fail P m \\<equiv> \\<forall>s. P s \\<longrightarrow> \\<not> (snd (m s))\"\n\n\ntext {*\n  It is often desired to prove non-failure and a Hoare triple\n  simultaneously, as the reasoning is often similar. The following\n  definitions allow such reasoning to take place.\n*}\n\ndefinition\n  validNF ::\"('s \\<Rightarrow> bool) \\<Rightarrow> ('s,'a) nondet_monad \\<Rightarrow> ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n      (\"\\<lbrace>_\\<rbrace>/ _ /\\<lbrace>_\\<rbrace>!\")\nwhere\n  \"validNF P f Q \\<equiv> valid P f Q \\<and> no_fail P f\"\n\ndefinition\n  validE_NF :: \"('s \\<Rightarrow> bool) \\<Rightarrow> ('s, 'a + 'b) nondet_monad \\<Rightarrow>\n             ('b \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow>\n             ('a \\<Rightarrow> 's \\<Rightarrow> bool) \\<Rightarrow> bool\"\n  (\"\\<lbrace>_\\<rbrace>/ _ /(\\<lbrace>_\\<rbrace>,/ \\<lbrace>_\\<rbrace>!)\")\nwhere\n  \"validE_NF P f Q E \\<equiv> validE P f Q E \\<and> no_fail P f\"\n\nlemma validE_NF_alt_def:\n  \"\\<lbrace> P \\<rbrace> B \\<lbrace> Q \\<rbrace>,\\<lbrace> E \\<rbrace>! = \\<lbrace> P \\<rbrace> B \\<lbrace> \\<lambda>v s. case v of Inl e \\<Rightarrow> E e s | Inr r \\<Rightarrow> Q r s \\<rbrace>!\"\n  by (clarsimp simp: validE_NF_def validE_def validNF_def)\n\ntext {*\n  Usually, well-formed monads constructed from the primitives\n  above will have the following property: if they return an\n  empty set of results, they will have the failure flag set.\n*}\ndefinition\n  empty_fail :: \"('s,'a) nondet_monad \\<Rightarrow> bool\"\nwhere\n  \"empty_fail m \\<equiv> \\<forall>s. fst (m s) = {} \\<longrightarrow> snd (m s)\"\n\n\ntext {*\n  Useful in forcing otherwise unknown executions to have\n  the @{const empty_fail} property.\n*}\ndefinition\n  mk_ef :: \"'a set \\<times> bool \\<Rightarrow> 'a set \\<times> bool\"\nwhere\n  \"mk_ef S \\<equiv> (fst S, fst S = {} \\<or> snd S)\"\n\nsection \"Basic exception reasoning\"\n\ntext {*\n  The following predicates @{text no_throw} and @{text no_return} allow\n  reasoning that functions in the exception monad either do\n  no throw an exception or never return normally.\n*}\n\ndefinition \"no_throw P A \\<equiv> \\<lbrace> P \\<rbrace> A \\<lbrace> \\<lambda>_ _. True \\<rbrace>,\\<lbrace> \\<lambda>_ _. False \\<rbrace>\"\n\ndefinition \"no_return P A \\<equiv> \\<lbrace> P \\<rbrace> A \\<lbrace>\\<lambda>_ _. False\\<rbrace>,\\<lbrace>\\<lambda>_ _. True \\<rbrace>\"\n\nend\n", "meta": {"author": "z5146542", "repo": "TOR", "sha": "9a82d491288a6d013e0764f68e602a63e48f92cf", "save_path": "github-repos/isabelle/z5146542-TOR", "path": "github-repos/isabelle/z5146542-TOR/TOR-9a82d491288a6d013e0764f68e602a63e48f92cf/checker-verification/autocorres-1.4/lib/Monad_WP/NonDetMonad.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES", "lm_q1_score": 0.5736784220301065, "lm_q2_score": 0.523420348936324, "lm_q1q2_score": 0.30027495983623814}}
{"text": "theory OpenFlow_Serialize\nimports OpenFlow_Matches\n        OpenFlow_Action\n        Semantics_OpenFlow\n        \"../Simple_Firewall/Primitives/Primitives_toString\"\n        \"../IP_Addresses/Lib_Word_toString\"\n        \"~~/src/HOL/Library/Code_Char\"\nbegin\n\ndefinition \"serialization_test_entry \\<equiv> OFEntry 7 {EtherDst 0x1, IPv4Dst (PrefixMatch 0xA000201 32), IngressPort ''s1-lan'', L4Dst 0x50 0, L4Src 0x400 0x3FF, IPv4Proto 6, EtherType 0x800} [ModifyField_l2dst 0xA641F185E862, Forward ''s1-wan'']\"\n\n\n\nvalue \"(map (op << (1::48 word) \\<circ> op * 8) \\<circ> rev) [0..<6]\"\n\ndefinition \"serialize_mac (m::48 word) \\<equiv> (intersperse (CHR '':'') \\<circ> map (hex_string_of_word 1 \\<circ> (\\<lambda>h. (m >> h * 8) && 0xff)) \\<circ> rev) [0..<6]\"\nlemma \"serialize_mac 0xdeadbeefcafe = ''de:ad:be:ef:ca:fe''\" by eval\n\ndefinition \"serialize_action pids a \\<equiv> (case a of\n\tForward oif \\<Rightarrow> ''output:'' @ pids oif |\n\tModifyField_l2dst na \\<Rightarrow> ''mod_dl_dst:'' @ serialize_mac na)\" \n\ndefinition \"serialize_actions pids a \\<equiv> if length a = 0 then ''drop'' else (intersperse (CHR '','') \\<circ> map (serialize_action pids)) a\"\n\nlemma \"serialize_actions (\\<lambda>oif. ''42'') (ofe_action serialization_test_entry) =\n  ''mod_dl_dst:a6:41:f1:85:e8:62,output:42''\" by eval\nlemma \"serialize_actions anything [] = ''drop''\"\n  by(simp add: serialize_actions_def)\n\ndefinition \"prefix_to_string pfx \\<equiv> ipv4_cidr_toString (pfxm_prefix pfx, pfxm_length pfx)\"\n\nprimrec serialize_of_match where\n\"serialize_of_match pids (IngressPort p) = ''in_port='' @ pids p\" |\n\"serialize_of_match _ (VlanId i) = ''dl_vlan='' @ dec_string_of_word0 i\" |\n\"serialize_of_match _ (VlanPriority _) = undefined\" | (* uh, äh\\<dots> We don't use that anyway\\<dots> *)\n\"serialize_of_match _ (EtherType i) = ''dl_type=0x'' @ hex_string_of_word0 i\" |\n\"serialize_of_match _ (EtherSrc m) = ''dl_src='' @ serialize_mac m\" |\n\"serialize_of_match _ (EtherDst m) = ''dl_dst='' @ serialize_mac m\" |\n\"serialize_of_match _ (IPv4Proto i) = ''nw_proto='' @ dec_string_of_word0 i\" |\n\"serialize_of_match _ (IPv4Src p) = ''nw_src='' @ prefix_to_string p\" |\n\"serialize_of_match _ (IPv4Dst p) = ''nw_dst='' @ prefix_to_string p\" |\n\"serialize_of_match _ (L4Src i m) = ''tp_src='' @ dec_string_of_word0 i @ (if m = max_word then [] else ''/0x'' @ hex_string_of_word 3 m)\" |\n\"serialize_of_match _ (L4Dst i m) = ''tp_dst='' @ dec_string_of_word0 i @ (if m = max_word then [] else ''/0x'' @ hex_string_of_word 3 m)\"\n\ndefinition serialize_of_matches :: \"(string \\<Rightarrow> string) \\<Rightarrow> of_match_field set \\<Rightarrow> string\"\n  where\n  \"serialize_of_matches pids \\<equiv> op @ ''hard_timeout=0,idle_timeout=0,'' \\<circ> intersperse (CHR '','') \\<circ> map (serialize_of_match pids) \\<circ> sorted_list_of_set\" \n\nlemma \"serialize_of_matches pids of_matches= \n(List.append ''hard_timeout=0,idle_timeout=0,'') \n  (intersperse (CHR '','') (map (serialize_of_match pids) (sorted_list_of_set of_matches)))\"\nby (simp add: serialize_of_matches_def)\n\nexport_code serialize_of_matches checking SML (*needs \"~~/src/HOL/Library/Code_Char\"*)\n\nlemma \"serialize_of_matches (\\<lambda>oif. ''42'') (ofe_fields serialization_test_entry) =\n  ''hard_timeout=0,idle_timeout=0,in_port=42,dl_type=0x800,dl_dst=00:00:00:00:00:01,nw_proto=6,nw_dst=10.0.2.1/32,tp_src=1024/0x03ff,tp_dst=80/0x0000''\"\nby eval\n\ndefinition \"serialize_of_entry pids e \\<equiv> (case e of (OFEntry p f a) \\<Rightarrow> ''priority='' @ dec_string_of_word0 p @ '','' @ serialize_of_matches pids f @ '','' @ ''action='' @ serialize_actions pids a)\"\n\nlemma \"serialize_of_entry (the \\<circ> map_of [(''s1-lan'',''42''),(''s1-wan'',''1337'')]) serialization_test_entry =\n  ''priority=7,hard_timeout=0,idle_timeout=0,in_port=42,dl_type=0x800,dl_dst=00:00:00:00:00:01,nw_proto=6,nw_dst=10.0.2.1/32,tp_src=1024/0x03ff,tp_dst=80/0x0000,action=mod_dl_dst:a6:41:f1:85:e8:62,output:1337''\"\n  by eval\n\n\nend", "meta": {"author": "diekmann", "repo": "Iptables_Semantics", "sha": "e0a2516bd885708fce875023b474ae341cbdee29", "save_path": "github-repos/isabelle/diekmann-Iptables_Semantics", "path": "github-repos/isabelle/diekmann-Iptables_Semantics/Iptables_Semantics-e0a2516bd885708fce875023b474ae341cbdee29/thy/LOFT/OpenFlow_Serialize.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.30013776926874475}}
{"text": "theory outNotData\n\nimports Data_inc\n  begin\n\ntypedef outNot = \"{cintern}\"\n  by auto\n\n\ninstance outNot::finite\n  apply (intro_classes)\n  using type_definition.Abs_image type_definition_outNot typedef_finite_UNIV by fastforce\n\ninstantiation outNot::somechan\nbegin\ndefinition Rep_outNot_def: \"Rep = Rep_outNot\"\n\nlemma repand_range[simp]: \"range (Rep::outNot \\<Rightarrow> channel) = {cintern}\"\n  apply(subst Rep_outNot_def)\n  using type_definition.Rep_range type_definition_outNot by fastforce\n\ninstance\n  apply(intro_classes)\n  apply clarsimp\n  unfolding Rep_outNot_def by (meson Rep_outNot_inject injI)\nend\n\nlemma outNot_chdom[simp]: \"chDom TYPE (outNot) = {cintern}\"\n  by (simp add: somechandom)\n\n\n\nsection \\<open>Constructors\\<close>\n\ndefinition \"Notout \\<equiv> Abs_outNot cintern\"\n\nfree_constructors outNot for Notout\n  apply auto?  (* TODO: kann man das \"auto\" entfernen? *)\n  unfolding Notout_def\n  apply (metis Rep_outNot Rep_outNot_inverse empty_iff insert_iff)\n  apply (simp add: Abs_outNot_inject)?\n  done\n\nlemma notout_rep [simp]: \"Rep Notout = cintern\"\n  unfolding Rep_outNot_def Notout_def\n  by (simp add: Abs_outNot_inverse)\n\n\n\nsection \\<open>Preperation for locale instantiation\\<close>\n\n(* Tuple:\n      1. Value should go to port cintern. It is of type \"bool\"\n*)\n\n(* The first parameter is the converter from user-type (here bool) to \"M\" \n\n  for every type in the tuple such a function must be in the parameter. So if the tuple\n  would consist of (nat\\<times>bool) there are 2 converters required *)\n\nfun outNotChan::\"('bool \\<Rightarrow> 'a) \\<Rightarrow> ('bool) \\<Rightarrow> outNot \\<Rightarrow> 'a\" where\n\"outNotChan boolConv  (port_cintern) Notout = boolConv port_cintern\" \n\n(* Helper Function for lemmata (mostly surj). Should be hidden from the user! *)\ndefinition outNotChan_inv::\"('bool \\<Rightarrow> 'a) \\<Rightarrow> (outNot \\<Rightarrow> 'a) \\<Rightarrow> ('bool)\" where\n\"outNotChan_inv boolConv f = ((inv boolConv) (f Notout))\" \n\nlemma outNotChan_surj_helper: \n    assumes \"f Notout \\<in> range boolConv\"\n  shows \"outNotChan boolConv (outNotChan_inv boolConv f) = f\"\n  unfolding outNotChan_inv_def\n  apply(rule ext, rename_tac \"c\")\n  apply(case_tac c; simp)\n  by (auto simp add: assms f_inv_into_f)\n\nlemma outNotChan_surj: \n    assumes \"f Notout \\<in> range boolConv\"\n      shows \"f \\<in> range (outNotChan boolConv)\"\n  by (metis UNIV_I image_iff assms outNotChan_surj_helper)\n\n\nlemma outNotChan_inj: assumes \"inj boolConv\"\n  shows \"inj (outNotChan boolConv)\"\n  apply (auto simp add: inj_def)\n   by (metis assms outNotChan.simps injD)+\n\n\nsubsection \\<open>SBE\\<close>\n(* Dieses Beispiel ist zeitsychron, daher das \"Tsyn\" *)\nabbreviation \"buildNotOutSBE \\<equiv> outNotChan (Tsyn o map_option \\<B>)\" \n(* Die Signatur lautet: \"bool option \\<times> bool option \\<Rightarrow> outNot \\<Rightarrow> M\"\n    Das \"option\" kommt aus der Zeit. \"None\" = keine Nachricht *)\n\n\nlemma buildandin_ctype: \"buildNotOutSBE a c \\<in> ctype (Rep c)\"\n  apply(cases c; cases a)\n  by(auto simp add: ctype_def)\n\n\nlemma buildandin_inj: \"inj buildNotOutSBE\"\n  apply(rule outNotChan_inj)\n  by simp\n\n\nlemma buildandin_range: \"range (\\<lambda>a. buildNotOutSBE a c) = ctype (Rep c)\"\n  apply(cases c)\n  apply(auto simp add: image_iff ctype_def)\n  by (metis option.simps(9))+\n\nlemma buildandin_surj: assumes \"\\<And>c. sbe c \\<in> ctype (Rep c)\"\n  shows \"sbe \\<in> range buildNotOutSBE\"\n  apply(rule outNotChan_surj)\n   apply (metis notout_rep assms rangecintern) (* Die metis-Sachen kann man bestimmt in einen 1-Zeiler umwandeln *)\n  done\n\n\n\ninterpretation notOutSBE: sbeGen \"buildNotOutSBE\"\n  apply(unfold_locales)\n  apply(simp add: buildandin_ctype)\n  apply (simp add: buildandin_inj)\n  apply (simp add: buildandin_surj)\n  by simp\n\n\nsubsection \\<open>SB\\<close>\n\nabbreviation \"buildNotOutSB \\<equiv> outNotChan (Rep_cfun (smap (Tsyn o map_option \\<B>)))\" \n\nlemma buildNotOutSB_ctype: \"sValues\\<cdot>(buildNotOutSB a c) \\<subseteq> ctype (Rep c)\"\n  apply(cases c; cases a)\n  by (auto simp add: ctype_def smap_sValues)\n\nlemma buildNotOutSB_inj: \"inj buildNotOutSB\"\n  apply(rule outNotChan_inj, rule smap_inj)\n  by (simp)\n\nlemma smap_rang2values: assumes \"sValues\\<cdot>s \\<subseteq> range f\"\n    shows \"s \\<in> range (Rep_cfun (smap f))\"\n  using assms smap_well by force\n\nlemma buildNotOutSB_surj: assumes \"sb_well sb\"\n  shows \"sb \\<in> range buildNotOutSB\"\n  apply(rule outNotChan_surj; rule smap_rang2values; rule sbwellD)\n  apply (simp_all add: assms)\n  using rangecintern apply simp\n  done\n\n\n\ninterpretation notOutSB: sbGen \"buildNotOutSB\"\n  apply(unfold_locales)\n  apply (simp add: buildNotOutSB_ctype) \n  apply (simp add: buildNotOutSB_inj)\n  by (simp add: buildNotOutSB_surj)\n\n\nend", "meta": {"author": "yyisgladiator", "repo": "demo", "sha": "2a57300dfa7268721c78c233ee6b0a5454acce1f", "save_path": "github-repos/isabelle/yyisgladiator-demo", "path": "github-repos/isabelle/yyisgladiator-demo/demo-2a57300dfa7268721c78c233ee6b0a5454acce1f/src/demo/flasher/outNotData.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746213017459, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.30013776926874475}}
{"text": "section {*L\\_ATS\\_Sched\\_DB0*}\ntheory\n  L_ATS_Sched_DB0\n\nimports\n  L_ATS_SchedF_DB\n  L_ATS_SchedUF_DB\n  L_ATS_Sched_Basic\n\nbegin\n\nlocale ATS_Sched_DB0 =\n  ATS_Sched_Basic\n  \"TSstructure :: 'TSstructure \\<Rightarrow> bool\"\n  \"configurations :: 'TSstructure \\<Rightarrow> 'conf set\"\n  \"initial_configurations :: 'TSstructure \\<Rightarrow> 'conf set\"\n  \"step_labels :: 'TSstructure \\<Rightarrow> 'label set\"\n  \"step_relation :: 'TSstructure \\<Rightarrow> 'conf \\<Rightarrow> 'label \\<Rightarrow> 'conf \\<Rightarrow> bool\"\n  \"effects :: 'TSstructure \\<Rightarrow> 'event set\"\n  \"marking_condition :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> bool\"\n  \"marked_effect :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> 'event set\"\n  \"unmarked_effect :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> 'event set\"\n  \"fixed_schedulers :: 'TSstructure \\<Rightarrow> 'fixed_scheduler set\"\n  \"empty_fixed_scheduler :: 'TSstructure \\<Rightarrow> 'fixed_scheduler\"\n  \"fixed_scheduler_extendable :: 'TSstructure \\<Rightarrow> 'fixed_scheduler \\<Rightarrow> bool\"\n  \"scheduler_fragments :: 'TSstructure \\<Rightarrow> 'scheduler_fragment set\"\n  \"empty_scheduler_fragment :: 'TSstructure \\<Rightarrow> 'scheduler_fragment\"\n  \"join_scheduler_fragments :: 'scheduler_fragment \\<Rightarrow> 'scheduler_fragment \\<Rightarrow> 'scheduler_fragment\"\n  \"unfixed_schedulers :: 'TSstructure \\<Rightarrow> 'unfixed_scheduler set\"\n  \"empty_unfixed_scheduler :: 'TSstructure \\<Rightarrow> 'unfixed_scheduler\"\n  \"unfixed_scheduler_right_quotient :: 'unfixed_scheduler \\<Rightarrow> 'unfixed_scheduler \\<Rightarrow> 'scheduler_fragment option\"\n  \"extend_unfixed_scheduler :: 'scheduler_fragment \\<Rightarrow> 'unfixed_scheduler \\<Rightarrow> 'unfixed_scheduler\"\n  \"unfixed_scheduler_extendable :: 'TSstructure \\<Rightarrow> 'unfixed_scheduler \\<Rightarrow> bool\"\n  \"schedulers :: 'TSstructure \\<Rightarrow> 'scheduler set\"\n  \"initial_schedulers :: 'TSstructure \\<Rightarrow> 'scheduler set\"\n  \"empty_scheduler :: 'TSstructure \\<Rightarrow> 'scheduler\"\n  \"get_scheduler :: 'conf \\<Rightarrow> 'scheduler\"\n  \"extend_scheduler :: 'scheduler_fragment \\<Rightarrow> 'scheduler \\<Rightarrow> 'scheduler\"\n  \"join_fixed_scheduler_unfixed_scheduler :: 'fixed_scheduler \\<Rightarrow> 'unfixed_scheduler \\<Rightarrow> 'scheduler\"\n  +\n  ATS_SchedUF_DB\n  \"TSstructure :: 'TSstructure \\<Rightarrow> bool\"\n  \"configurations :: 'TSstructure \\<Rightarrow> 'conf set\"\n  \"initial_configurations :: 'TSstructure \\<Rightarrow> 'conf set\"\n  \"step_labels :: 'TSstructure \\<Rightarrow> 'label set\"\n  \"step_relation :: 'TSstructure \\<Rightarrow> 'conf \\<Rightarrow> 'label \\<Rightarrow> 'conf \\<Rightarrow> bool\"\n  \"effects :: 'TSstructure \\<Rightarrow> 'event set\"\n  \"marking_condition :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> bool\"\n  \"marked_effect :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> 'event set\"\n  \"unmarked_effect :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> 'event set\"\n  \"scheduler_fragments :: 'TSstructure \\<Rightarrow> 'scheduler_fragment set\"\n  \"empty_scheduler_fragment :: 'TSstructure \\<Rightarrow> 'scheduler_fragment\"\n  \"join_scheduler_fragments :: 'scheduler_fragment \\<Rightarrow> 'scheduler_fragment \\<Rightarrow> 'scheduler_fragment\"\n  \"unfixed_schedulers :: 'TSstructure \\<Rightarrow> 'unfixed_scheduler set\"\n  \"empty_unfixed_scheduler :: 'TSstructure \\<Rightarrow> 'unfixed_scheduler\"\n  \"unfixed_scheduler_right_quotient :: 'unfixed_scheduler \\<Rightarrow> 'unfixed_scheduler \\<Rightarrow> 'scheduler_fragment option\"\n  \"extend_unfixed_scheduler :: 'scheduler_fragment \\<Rightarrow> 'unfixed_scheduler \\<Rightarrow> 'unfixed_scheduler\"\n  \"unfixed_scheduler_extendable :: 'TSstructure \\<Rightarrow> 'unfixed_scheduler \\<Rightarrow> bool\"\n  \"set_unfixed_scheduler_DB :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> nat \\<Rightarrow> 'unfixed_scheduler \\<Rightarrow> 'conf\"\n  \"get_unfixed_scheduler_DB :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> nat \\<Rightarrow> 'unfixed_scheduler\"\n  +\n  ATS_SchedF_DB\n  \"TSstructure :: 'TSstructure \\<Rightarrow> bool\"\n  \"configurations :: 'TSstructure \\<Rightarrow> 'conf set\"\n  \"initial_configurations :: 'TSstructure \\<Rightarrow> 'conf set\"\n  \"step_labels :: 'TSstructure \\<Rightarrow> 'label set\"\n  \"step_relation :: 'TSstructure \\<Rightarrow> 'conf \\<Rightarrow> 'label \\<Rightarrow> 'conf \\<Rightarrow> bool\"\n  \"effects :: 'TSstructure \\<Rightarrow> 'event set\"\n  \"marking_condition :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> bool\"\n  \"marked_effect :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> 'event set\"\n  \"unmarked_effect :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> 'event set\"\n  \"fixed_schedulers :: 'TSstructure \\<Rightarrow> 'fixed_scheduler set\"\n  \"empty_fixed_scheduler :: 'TSstructure \\<Rightarrow> 'fixed_scheduler\"\n  \"fixed_scheduler_extendable :: 'TSstructure \\<Rightarrow> 'fixed_scheduler \\<Rightarrow> bool\"\n  \"get_fixed_scheduler_DB :: 'TSstructure \\<Rightarrow> ('label, 'conf) derivation \\<Rightarrow> nat \\<Rightarrow> 'fixed_scheduler\"\n  for\n    TSstructure configurations initial_configurations step_labels step_relation effects marking_condition marked_effect unmarked_effect fixed_schedulers empty_fixed_scheduler fixed_scheduler_extendable scheduler_fragments empty_scheduler_fragment join_scheduler_fragments unfixed_schedulers empty_unfixed_scheduler unfixed_scheduler_right_quotient extend_unfixed_scheduler unfixed_scheduler_extendable schedulers initial_schedulers empty_scheduler get_scheduler extend_scheduler join_fixed_scheduler_unfixed_scheduler set_unfixed_scheduler_DB get_unfixed_scheduler_DB get_fixed_scheduler_DB\n    +\n  assumes AX_join_fixed_scheduler_unfixed_scheduler_closed': \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G d\n  \\<Longrightarrow> d n \\<noteq> None\n  \\<Longrightarrow> join_fixed_scheduler_unfixed_scheduler (get_fixed_scheduler_DB G d n) (get_unfixed_scheduler_DB G d n) \\<in> schedulers G\"\n\nassumes AX_get_fixed_scheduler_DB_and_get_unfixed_scheduler_DB_vs_get_scheduler_nth: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> d n \\<noteq> None\n  \\<Longrightarrow> join_fixed_scheduler_unfixed_scheduler (get_fixed_scheduler_DB G d n) (get_unfixed_scheduler_DB G d n) = get_scheduler_nth d n\"\n\nassumes AX_sched_modification_preserves_steps: \"\n  TSstructure G\n  \\<Longrightarrow> maximum_of_domain dh n\n  \\<Longrightarrow> derivation G dh\n  \\<Longrightarrow> belongs G dh\n  \\<Longrightarrow> sUF \\<in> unfixed_schedulers G\n  \\<Longrightarrow> fixed_scheduler_extendable G sF\n  \\<Longrightarrow> unfixed_scheduler_extendable G sUF\n  \\<Longrightarrow> dh (Suc m) = Some (pair (Some e2) c2)\n  \\<Longrightarrow> dh m = Some (pair e1 c1)\n  \\<Longrightarrow> step_relation G c1 e2 c2\n  \\<Longrightarrow> step_relation G (set_unfixed_scheduler_DB G dh m (extend_unfixed_scheduler (the (unfixed_scheduler_right_quotient (get_unfixed_scheduler_DB G dh m) (get_unfixed_scheduler_DB G dh n))) sUF)) e2 (set_unfixed_scheduler_DB G dh (Suc m) (extend_unfixed_scheduler (the (unfixed_scheduler_right_quotient (get_unfixed_scheduler_DB G dh (Suc m)) (get_unfixed_scheduler_DB G dh n))) sUF))\"\n\nassumes AX_fixed_scheduler_extendable_vs_unfixed_scheduler_extendable_DB: \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G d\n  \\<Longrightarrow> d n \\<noteq> None\n  \\<Longrightarrow> sUF = get_unfixed_scheduler_DB G d n\n  \\<Longrightarrow> sF = get_fixed_scheduler_DB G d n\n  \\<Longrightarrow> fixed_scheduler_extendable G sF \\<longleftrightarrow> unfixed_scheduler_extendable G sUF\"\n\ncontext ATS_Sched_DB0 begin\n\ncorollary Nonblockingness_branching_restricted_vs_PB_Nonblockingness_branching_DB_restricted: \"\n  TSstructure G\n  \\<Longrightarrow> PB_Nonblockingness_branching_DB_restricted G = Nonblockingness_branching_restricted_DB G\"\n  apply(simp add: Nonblockingness_branching_restricted_DB_def PB_Nonblockingness_branching_DB_restricted_def Nonblockingness_pattern_def PB_Nonblockingness_RestDB_def PB_Nonblockingness_NoAdapt_def)\n  apply(rule antisym)\n   apply(clarsimp)\n   apply(rename_tac dh n)(*strict*)\n   apply(erule_tac\n      x=\"dh\"\n      in allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"n\"\n      in allE)\n   apply(clarsimp)\n   apply(case_tac \"unfixed_scheduler_extendable G (get_unfixed_scheduler_DB G dh n)\")\n    apply(rename_tac dh n)(*strict*)\n    apply(force)\n   apply(rename_tac dh n)(*strict*)\n   apply(subgoal_tac \"False\")\n    apply(rename_tac dh n)(*strict*)\n    apply(force)\n   apply(rename_tac dh n)(*strict*)\n   apply(subgoal_tac \"X\" for X)\n    apply(rename_tac dh n)(*strict*)\n    prefer 2\n    apply(rule_tac\n      G=\"G\"\n      and d=\"dh\"\n      and n=\"n\"\n      in AX_fixed_scheduler_extendable_vs_unfixed_scheduler_extendable_DB)\n        apply(rename_tac dh n)(*strict*)\n        apply(force)\n       apply(rename_tac dh n)(*strict*)\n       apply(force)\n      apply(rename_tac dh n)(*strict*)\n      apply(simp add: get_configuration_def maximum_of_domain_def)\n     apply(rename_tac dh n)(*strict*)\n     apply(force)\n    apply(rename_tac dh n)(*strict*)\n    apply(force)\n   apply(rename_tac dh n)(*strict*)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac dh n)(*strict*)\n  apply(erule_tac\n      x=\"dh\"\n      in allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"n\"\n      in allE)\n  apply(clarsimp)\n  apply(subgoal_tac \"False\")\n   apply(rename_tac dh n)(*strict*)\n   apply(force)\n  apply(rename_tac dh n)(*strict*)\n  apply(subgoal_tac \"X\" for X)\n   apply(rename_tac dh n)(*strict*)\n   prefer 2\n   apply(rule_tac\n      G=\"G\"\n      and d=\"dh\"\n      and n=\"n\"\n      in AX_fixed_scheduler_extendable_vs_unfixed_scheduler_extendable_DB)\n       apply(rename_tac dh n)(*strict*)\n       apply(force)\n      apply(rename_tac dh n)(*strict*)\n      apply(force)\n     apply(rename_tac dh n)(*strict*)\n     apply(simp add: get_configuration_def maximum_of_domain_def)\n    apply(rename_tac dh n)(*strict*)\n    apply(force)\n   apply(rename_tac dh n)(*strict*)\n   apply(force)\n  apply(rename_tac dh n)(*strict*)\n  apply(force)\n  done\n\ndefinition PB_Nonblockingness_AdaptDB :: \"\n  'TSstructure\n  \\<Rightarrow> ('label,'conf) derivation\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('label,'conf) derivation\n  \\<Rightarrow> nat\n  \\<Rightarrow> ('label,'conf) derivation\n  \\<Rightarrow> bool\"\n  where\n    \"PB_Nonblockingness_AdaptDB G dh nh dc nc dh' \\<equiv>\n  \\<exists>sUF.\n  if (unfixed_scheduler_extendable G (get_unfixed_scheduler_DB G dh nh))\n  then\n  sUF \\<in> unfixed_schedulers G\n  \\<and> unfixed_scheduler_extendable G sUF\n  \\<and> join_fixed_scheduler_unfixed_scheduler (get_fixed_scheduler_DB G dh nh) sUF = get_scheduler_nth dc 0\n  \\<and> dh' = replace_unfixed_scheduler_DB G dh sUF nh\n  else dh' = dh\"\n\ndefinition PB_Nonblockingness_linear_DB :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"PB_Nonblockingness_linear_DB G \\<equiv>\n  Nonblockingness_pattern G\n  PB_Nonblockingness_NoRest\n  PB_Nonblockingness_AdaptDB\"\n\ndefinition Nonblockingness_linear_DB :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"Nonblockingness_linear_DB G \\<equiv>\n  \\<forall>dh n.\n  derivation_initial G dh\n  \\<and> maximum_of_domain dh n\n  \\<longrightarrow> (\\<exists>dc sUF dh' n'.\n  (\n  if (unfixed_scheduler_extendable G (get_unfixed_scheduler_DB G dh n))\n  then\n  sUF \\<in> unfixed_schedulers G\n  \\<and> unfixed_scheduler_extendable G sUF\n  \\<and> join_fixed_scheduler_unfixed_scheduler (get_fixed_scheduler_DB G dh n) sUF = get_scheduler_nth dc 0\n  \\<and> dh' = replace_unfixed_scheduler_DB G dh sUF n\n  else dh' = dh\n  )\n  \\<and> derivation G dc\n  \\<and> belongs G dc\n  \\<and> maximum_of_domain dc n'\n  \\<and> derivation_append_fit dh' dc n\n  \\<and> marking_condition G (derivation_append dh' dc n))\"\n\ncorollary PB_Nonblockingness_linear_DB_vs_Nonblockingness_linear_DB: \"\n  PB_Nonblockingness_linear_DB G = Nonblockingness_linear_DB G\"\n  apply(simp add: PB_Nonblockingness_AdaptDB_def PB_Nonblockingness_linear_DB_def Nonblockingness_pattern_def Nonblockingness_linear_DB_def PB_Nonblockingness_NoRest_def)\n  apply(rule antisym)\n   apply(clarsimp)\n   apply(rename_tac dh n)(*strict*)\n   apply(erule_tac\n      x=\"dh\"\n      in allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"n\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac dh n dh' dc x)(*strict*)\n   apply(rule_tac\n      x=\"dc\"\n      in exI)\n   apply(case_tac \"unfixed_scheduler_extendable G (get_unfixed_scheduler_DB G dh n)\")\n    apply(rename_tac dh n dh' dc x)(*strict*)\n    apply(force)\n   apply(rename_tac dh n dh' dc x)(*strict*)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac dh n)(*strict*)\n  apply(erule_tac\n      x=\"dh\"\n      in allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"n\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac dh n dc sUF dh')(*strict*)\n  apply(rule_tac\n      x=\"dh'\"\n      in exI)\n  apply(rule_tac\n      x=\"dc\"\n      in exI)\n  apply(case_tac \"unfixed_scheduler_extendable G (get_unfixed_scheduler_DB G dh n)\")\n   apply(rename_tac dh n dc sUF dh')(*strict*)\n   apply(force)\n  apply(rename_tac dh n dc sUF dh')(*strict*)\n  apply(force)\n  done\n\ndefinition PB_Nonblockingness_linear_DB_restricted :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"PB_Nonblockingness_linear_DB_restricted G \\<equiv>\n  Nonblockingness_pattern G\n  PB_Nonblockingness_RestDB\n  PB_Nonblockingness_AdaptDB\"\n\ndefinition Nonblockingness_linear_restricted_DB :: \"\n  'TSstructure\n  \\<Rightarrow> bool\"\n  where\n    \"Nonblockingness_linear_restricted_DB G \\<equiv>\n  \\<forall>dh n.\n  derivation_initial G dh\n  \\<and> maximum_of_domain dh n\n  \\<and> unfixed_scheduler_extendable G (get_unfixed_scheduler_DB G dh n)\n  \\<longrightarrow> (\\<exists>dc sUF dh' n'.\n  sUF \\<in> unfixed_schedulers G\n  \\<and> unfixed_scheduler_extendable G sUF\n  \\<and> join_fixed_scheduler_unfixed_scheduler (get_fixed_scheduler_DB G dh n) sUF = get_scheduler_nth dc 0\n  \\<and> dh' = replace_unfixed_scheduler_DB G dh sUF n\n  \\<and> derivation G dc\n  \\<and> belongs G dc\n  \\<and> maximum_of_domain dc n'\n  \\<and> derivation_append_fit dh' dc n\n  \\<and> marking_condition G (derivation_append dh' dc n))\"\n\ncorollary PB_Nonblockingness_linear_DB_restricted_vs_Nonblockingness_linear_restricted_DB: \"\nPB_Nonblockingness_linear_DB_restricted G = Nonblockingness_linear_restricted_DB G\"\n  apply(simp add: PB_Nonblockingness_linear_DB_restricted_def Nonblockingness_linear_restricted_DB_def Nonblockingness_pattern_def PB_Nonblockingness_RestDB_def PB_Nonblockingness_AdaptDB_def)\n  apply(rule antisym)\n   apply(clarsimp)\n   apply(rename_tac dh n)(*strict*)\n   apply(erule_tac\n      x=\"dh\"\n      in allE)\n   apply(clarsimp)\n   apply(erule_tac\n      x=\"n\"\n      in allE)\n   apply(clarsimp)\n   apply(rename_tac dh n dc sUF x)(*strict*)\n   apply(rule_tac\n      x=\"dc\"\n      in exI)\n   apply(case_tac \"unfixed_scheduler_extendable G (get_unfixed_scheduler_DB G dh n)\")\n    apply(rename_tac dh n dc sUF x)(*strict*)\n    apply(force)\n   apply(rename_tac dh n dc sUF x)(*strict*)\n   apply(force)\n  apply(clarsimp)\n  apply(rename_tac dh n)(*strict*)\n  apply(erule_tac\n      x=\"dh\"\n      in allE)\n  apply(clarsimp)\n  apply(erule_tac\n      x=\"n\"\n      in allE)\n  apply(clarsimp)\n  apply(rename_tac dh n dc sUF x)(*strict*)\n  apply(rule_tac\n      x=\"replace_unfixed_scheduler_DB G dh sUF n\"\n      in exI)\n  apply(rule_tac\n      x=\"dc\"\n      in exI)\n  apply(case_tac \"unfixed_scheduler_extendable G (get_unfixed_scheduler_DB G dh n)\")\n   apply(rename_tac dh n dc sUF x)(*strict*)\n   apply(force)\n  apply(rename_tac dh n dc sUF x)(*strict*)\n  apply(force)\n  done\n\ntheorem Nonblockingness_linear_DB_implies_Nonblockingness_linear_restricted_DB: \"\n  TSstructure G\n  \\<Longrightarrow> Nonblockingness_linear_DB G\n  \\<Longrightarrow> Nonblockingness_linear_restricted_DB G\"\n  apply(simp add: Nonblockingness_linear_restricted_DB_def Nonblockingness_linear_DB_def)\n  apply(force)\n  done\n\nlemma map_unfixed_scheduler_DB_preserves_maximum_of_domain: \"\n  TSstructure G\n  \\<Longrightarrow> derivation G d\n  \\<Longrightarrow> maximum_of_domain d n\n  \\<Longrightarrow> d'=map_unfixed_scheduler_DB G d C\n  \\<Longrightarrow> maximum_of_domain d' n\"\n  apply(simp add: map_unfixed_scheduler_DB_def maximum_of_domain_def)\n  apply(clarsimp)\n  apply(rename_tac y)(*strict*)\n  apply(case_tac y)\n  apply(rename_tac y option b)(*strict*)\n  apply(clarsimp)\n  done\n\nlemma sched_modification_preserves_derivation_initial: \"\n  TSstructure G\n  \\<Longrightarrow> derivation_initial G dh\n  \\<Longrightarrow> maximum_of_domain dh n\n  \\<Longrightarrow> unfixed_scheduler_extendable G (get_unfixed_scheduler_DB G dh n)\n  \\<Longrightarrow> unfixed_scheduler_extendable G sUF\n  \\<Longrightarrow> sUF \\<in> unfixed_schedulers G\n  \\<Longrightarrow> dh' = map_unfixed_scheduler_DB G dh (\\<lambda>c.\n              extend_unfixed_scheduler\n              (the(unfixed_scheduler_right_quotient c (get_unfixed_scheduler_DB G dh n)))\n              sUF\n              )\n  \\<Longrightarrow> derivation_initial G dh'\"\n  apply(subgoal_tac \"fixed_scheduler_extendable G (get_fixed_scheduler_DB G dh n)\")\n   prefer 2\n   apply(rule_tac\n      t=\"fixed_scheduler_extendable G (get_fixed_scheduler_DB G dh n)\"\n      and s=\"unfixed_scheduler_extendable G (get_unfixed_scheduler_DB G dh n)\"\n      in ssubst)\n    apply(rule_tac\n      n=\"n\"\n      in AX_fixed_scheduler_extendable_vs_unfixed_scheduler_extendable_DB)\n        apply(force)\n       apply(force)\n      apply(simp add: maximum_of_domain_def)\n     apply(force)\n    apply(force)\n   apply(force)\n  apply(clarsimp)\n  apply(subgoal_tac \"belongs G dh\")\n   prefer 2\n   apply(rule derivation_initial_belongs)\n    apply(force)\n   apply(force)\n  apply(simp add: derivation_initial_def)\n  apply(clarsimp)\n  apply(simp add: map_unfixed_scheduler_DB_def)\n  apply(case_tac \"dh 0\")\n   apply(clarsimp)\n  apply(rename_tac a)(*strict*)\n  apply(clarsimp)\n  apply(case_tac a)\n  apply(rename_tac a option b)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b)(*strict*)\n  apply(rule conjI)\n   apply(rename_tac b)(*strict*)\n   prefer 2\n   apply(rule AX_set_unfixed_scheduler_DB_preserves_initial_configurations)\n         apply(rename_tac b)(*strict*)\n         apply(force)\n        apply(rename_tac b)(*strict*)\n        apply(force)\n       apply(rename_tac b)(*strict*)\n       apply(force)\n      apply(rename_tac b)(*strict*)\n      apply(force)\n     apply(rename_tac b)(*strict*)\n     apply(rule AX_extend_unfixed_scheduler_closed)\n        apply(rename_tac b)(*strict*)\n        apply(force)\n       apply(rename_tac b)(*strict*)\n       apply(rule_tac\n      n=\"n\"\n      in AX_unfixed_scheduler_right_quotient_closed_on_extendable_get_unfixed_scheduler_DB)\n            apply(rename_tac b)(*strict*)\n            apply(force)\n           apply(rename_tac b)(*strict*)\n           apply(simp add: derivation_initial_def)\n          apply(rename_tac b)(*strict*)\n          apply(simp add: maximum_of_domain_def)\n         apply(rename_tac b)(*strict*)\n         apply(force)\n        apply(rename_tac b)(*strict*)\n        apply(force)\n       apply(rename_tac b)(*strict*)\n       apply(force)\n      apply(rename_tac b)(*strict*)\n      apply(force)\n     apply(rename_tac b)(*strict*)\n     apply(force)\n    apply(rename_tac b)(*strict*)\n    apply(rule AX_get_unfixed_scheduler_DB_extendable_on_initial_configuration)\n     apply(rename_tac b)(*strict*)\n     apply(force)\n    apply(rename_tac b)(*strict*)\n    apply(simp add: derivation_initial_def)\n   apply(rename_tac b)(*strict*)\n   apply (metis AX_extend_unfixed_scheduler_preserves_unfixed_scheduler_extendable)\n  apply(rename_tac b)(*strict*)\n  apply(simp (no_asm) add: derivation_def)\n  apply(clarsimp)\n  apply(rename_tac b i)(*strict*)\n  apply(case_tac i)\n   apply(rename_tac b i)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac b i nat)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b nat)(*strict*)\n  apply(case_tac \"dh (Suc nat)\")\n   apply(rename_tac b nat)(*strict*)\n   apply(clarsimp)\n  apply(rename_tac b nat a)(*strict*)\n  apply(clarsimp)\n  apply(subgoal_tac \"\\<exists>e1 e2 c1 c2. dh nat = Some (pair e1 c1) \\<and> dh (Suc nat) = Some (pair (Some e2) c2) \\<and> step_relation G c1 e2 c2\")\n   apply(rename_tac b nat a)(*strict*)\n   prefer 2\n   apply(rule_tac\n      m=\"Suc nat\"\n      in step_detail_before_some_position)\n     apply(rename_tac b nat a)(*strict*)\n     apply(force)\n    apply(rename_tac b nat a)(*strict*)\n    apply(force)\n   apply(rename_tac b nat a)(*strict*)\n   apply(force)\n  apply(rename_tac b nat a)(*strict*)\n  apply(clarsimp)\n  apply(rename_tac b nat e1 e2 c1 c2)(*strict*)\n  apply(rule AX_sched_modification_preserves_steps)\n           apply(rename_tac b nat e1 e2 c1 c2)(*strict*)\n           apply(force)+\n  done\n\nend\n\nend\n", "meta": {"author": "ControllerSynthesis", "repo": "Isabelle", "sha": "fc776edec292363e49785e5d3a752d9f9cfcf1c9", "save_path": "github-repos/isabelle/ControllerSynthesis-Isabelle", "path": "github-repos/isabelle/ControllerSynthesis-Isabelle/Isabelle-fc776edec292363e49785e5d3a752d9f9cfcf1c9/PRJ_06_03/L_ATS_Sched_DB0.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.47657965106367595, "lm_q1q2_score": 0.30013776264555886}}
{"text": "(*\n * Copyright 2016, NICTA\n *\n * This software may be distributed and modified according to the terms of\n * the GNU General Public License version 2. Note that NO WARRANTY is provided.\n * See \"LICENSE_GPLv2.txt\" for details.\n *\n * @TAG(NICTA_GPL)\n *)\n\ntheory Correspondence\nimports UpdateSemantics\nbegin\n\nlocale correspondence =\nval: value_sem  \"val_abs_typing :: 'av \\<Rightarrow> name \\<Rightarrow> type list \\<Rightarrow> bool\" +\nupd: update_sem \"upd_abs_typing :: 'au \\<Rightarrow> name \\<Rightarrow> type list \\<Rightarrow> sigil \\<Rightarrow> 'l set \\<Rightarrow> 'l set \\<Rightarrow> bool\"\nfor val_abs_typing and upd_abs_typing\n+\nfixes abs_upd_val :: \"'au \\<Rightarrow> 'av \\<Rightarrow> name \\<Rightarrow> type list \\<Rightarrow> sigil \\<Rightarrow> 'l set \\<Rightarrow> 'l set \\<Rightarrow> bool\"\nassumes abs_upd_val_to_vval_typing: \"abs_upd_val u v n \\<tau>s s l r \\<Longrightarrow> val_abs_typing v n \\<tau>s\"\nand     abs_upd_val_to_uval_typing: \"abs_upd_val u v n \\<tau>s s l r \\<Longrightarrow> upd_abs_typing u n \\<tau>s s l r\"\nand     abs_upd_val_bang : \"\\<lbrakk> abs_upd_val au av n \\<tau>s s r w \n                            \\<rbrakk> \\<Longrightarrow> abs_upd_val au av n (map bang \\<tau>s) (bang_sigil s) (r \\<union> w) {}\"\n\ncontext correspondence\nbegin\n\ninductive upd_val_rel :: \"('f \\<Rightarrow> poly_type) \n                        \\<Rightarrow> ('f, 'au, 'l) store\n                        \\<Rightarrow> ('f, 'au, 'l) uval\n                        \\<Rightarrow> ('f, 'av) vval \n                        \\<Rightarrow> type \n                        \\<Rightarrow> 'l set\n                        \\<Rightarrow> 'l set\n                        \\<Rightarrow> bool\"  (\"_, _ \\<turnstile> _ \\<sim> _ : _ \\<langle>_, _\\<rangle>\" [30,0,0,0,0,20] 80)\nand upd_val_rel_record :: \"('f \\<Rightarrow> poly_type) \n                         \\<Rightarrow> ('f, 'au, 'l) store \n                         \\<Rightarrow> (('f, 'au, 'l) uval \\<times> repr) list\n                         \\<Rightarrow> ('f, 'av) vval list\n                         \\<Rightarrow> (type \\<times> bool) list\n                         \\<Rightarrow> 'l set\n                         \\<Rightarrow> 'l set\n                         \\<Rightarrow> bool\" (\"_, _ \\<turnstile>* _ \\<sim> _ :r _ \\<langle>_, _\\<rangle>\" [30,0,0,0,0,20] 80) where\n\n  u_v_prim     : \"\\<Xi>, \\<sigma> \\<turnstile> UPrim l \\<sim> VPrim l : TPrim (lit_type l) \\<langle>{}, {}\\<rangle>\"\n\n| u_v_product  : \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile> a \\<sim> a' : t \\<langle>r , w \\<rangle> \n                  ; \\<Xi>, \\<sigma> \\<turnstile> b \\<sim> b' : u \\<langle>r', w'\\<rangle>\n                  ; w  \\<inter> w' = {}\n                  ; w  \\<inter> r' = {}\n                  ; w' \\<inter> r  = {}\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> UProduct a b \\<sim> VProduct a' b' : TProduct t u \\<langle>r \\<union> r', w \\<union> w'\\<rangle>\"\n\n| u_v_sum      : \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile> a \\<sim> a' : t \\<langle>r, w\\<rangle>\n                  ; (g, t) \\<in> set ts \n                  ; distinct (map fst ts)\n                  ; [] \\<turnstile>* map snd ts wellformed\n                  ; map fst ts = map fst rs\n                  ; list_all2 (\\<lambda> t r. type_repr t = r) (map snd ts) (map snd rs)\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> USum g a rs \\<sim> VSum g a' : TSum ts \\<langle>r, w\\<rangle>\"\n\n\n| u_v_struct   : \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r ts \\<langle>r, w\\<rangle> \n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> URecord fs \\<sim> VRecord fs' : TRecord ts Unboxed \\<langle>r, w\\<rangle>\"  \n\n| u_v_abstract : \"\\<lbrakk> abs_upd_val a a' n ts Unboxed r w\n                  ; [] \\<turnstile>* ts wellformed\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> UAbstract a \\<sim> VAbstract a' : TCon n ts Unboxed \\<langle>r, w\\<rangle>\"\n\n| u_v_function : \"\\<lbrakk> \\<Xi> , ks , [ Some a ] \\<turnstile> f : b\n                  ; list_all2 (kinding []) ts ks\n                  ; ks \\<turnstile> a wellformed\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> UFunction f ts \\<sim> VFunction f ts : TFun (instantiate ts a) (instantiate ts b) \\<langle>{}, {}\\<rangle>\" \n\n| u_v_afun     : \"\\<lbrakk> \\<Xi> f = (ks, a, b)\n                  ; list_all2 (kinding []) ts ks\n                  ; ks \\<turnstile> TFun a b wellformed\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> UAFunction f ts \\<sim> VAFunction f ts : TFun (instantiate ts a) (instantiate ts b) \\<langle>{}, {}\\<rangle>\" \n\n| u_v_unit     : \"\\<Xi>, \\<sigma> \\<turnstile> UUnit \\<sim> VUnit : TUnit \\<langle>{}, {}\\<rangle>\"\n\n| u_v_p_rec_ro : \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r ts \\<langle>r, {}\\<rangle> \n                  ; \\<sigma> l = Some (URecord fs) \n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> UPtr l (RRecord (map (\\<lambda>(a,b). type_repr a) ts)) \\<sim> VRecord fs' : TRecord ts ReadOnly \\<langle>insert l r, {}\\<rangle>\"  \n\n| u_v_p_rec_w  : \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r ts \\<langle>r, w\\<rangle> \n                  ; \\<sigma> l = Some (URecord fs)\n                  ; l \\<notin> (w \\<union> r)\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> UPtr l (RRecord (map (\\<lambda>(a,b). type_repr a) ts)) \\<sim> VRecord fs' : TRecord ts Writable \\<langle>r, insert l w\\<rangle>\"  \n\n| u_v_p_abs_ro : \"\\<lbrakk> abs_upd_val a a' n ts ReadOnly r w\n                  ; [] \\<turnstile>* ts wellformed\n                  ; \\<sigma> l = Some (UAbstract a)\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> UPtr l (RCon n (map type_repr ts)) \\<sim> VAbstract a' : TCon n ts ReadOnly \\<langle>insert l r, {}\\<rangle>\"\n\n\n| u_v_p_abs_w  : \"\\<lbrakk> abs_upd_val a a' n ts Writable r w\n                  ; [] \\<turnstile>* ts wellformed\n                  ; \\<sigma> l = Some (UAbstract a)\n                  ; l \\<notin> (w \\<union> r)\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> UPtr l (RCon n (map type_repr ts)) \\<sim> VAbstract a' : TCon n ts Writable \\<langle>r, insert l w\\<rangle>\"\n\n| u_v_r_empty  : \"\\<Xi>, \\<sigma> \\<turnstile>* [] \\<sim> [] :r [] \\<langle>{}, {}\\<rangle>\"\n\n| u_v_r_cons1  : \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>  x  \\<sim> x'  :  t  \\<langle>r , w \\<rangle>\n                  ; \\<Xi>, \\<sigma> \\<turnstile>* xs \\<sim> xs' :r ts \\<langle>r', w'\\<rangle>  \n                  ; w  \\<inter> w' = {}\n                  ; w  \\<inter> r' = {}\n                  ; w' \\<inter> r  = {}\n                  ; type_repr t = rp\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile>* ((x,rp) # xs) \\<sim> (x' # xs') :r ((t, False) # ts) \\<langle>r \\<union> r', w \\<union> w'\\<rangle>\"\n\n| u_v_r_cons2  : \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>* xs \\<sim> xs' :r ts \\<langle>r, w\\<rangle>\n                  ; [] \\<turnstile> t wellformed\n                  ; type_repr t = rp\n                  ; uval_repr x = rp\n                  ; uval_repr_deep x = rp\n                  \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile>* ((x,rp) # xs) \\<sim> (x' # xs') :r ((t, True) # ts) \\<langle>r, w\\<rangle>\"\n\n\n\nlemma upd_val_rel_to_vval_typing:\nshows \"\\<Xi>, \\<sigma> \\<turnstile>  u  \\<sim> v  :  \\<tau>  \\<langle>r, w\\<rangle> \\<Longrightarrow> vval_typing \\<Xi> v \\<tau>\"\nand   \"\\<Xi>, \\<sigma> \\<turnstile>* us \\<sim> vs :r \\<tau>s \\<langle>r, w\\<rangle> \\<Longrightarrow> vval_typing_record \\<Xi> vs \\<tau>s\"\nusing assms proof (induct rule: upd_val_rel_upd_val_rel_record.inducts )\n     case u_v_prim     then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_product  then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_sum      then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_function then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_afun     then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_unit     then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_struct   then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_p_rec_ro then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_p_rec_w  then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_r_empty  then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_r_cons1  then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_r_cons2  then show ?case by (auto intro!: vval_typing_vval_typing_record.intros)\nnext case u_v_abstract then show ?case by (auto intro!: vval_typing_vval_typing_record.intros\n                                                        abs_upd_val_to_vval_typing)\nnext case u_v_p_abs_ro then show ?case by (auto intro!: vval_typing_vval_typing_record.intros\n                                                        abs_upd_val_to_vval_typing)\nnext case u_v_p_abs_w  then show ?case by (auto intro!: vval_typing_vval_typing_record.intros\n                                                        abs_upd_val_to_vval_typing)\nqed\n\n\nlemma upd_val_rel_to_uval_typing:\nshows \"\\<Xi>, \\<sigma> \\<turnstile>  u  \\<sim> v  :  \\<tau>  \\<langle>r, w\\<rangle> \\<Longrightarrow> uval_typing \\<Xi> \\<sigma> u \\<tau> r w\"\nand   \"\\<Xi>, \\<sigma> \\<turnstile>* us \\<sim> vs :r \\<tau>s \\<langle>r, w\\<rangle> \\<Longrightarrow> uval_typing_record \\<Xi> \\<sigma> us \\<tau>s r w\"\nusing assms proof (induct rule: upd_val_rel_upd_val_rel_record.inducts )\n     case u_v_prim     then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_product  then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_sum      then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_function then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_afun     then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_unit     then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_struct   then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_p_rec_ro then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_p_rec_w  then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_r_empty  then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_r_cons1  then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_r_cons2  then show ?case by (auto intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_abstract then show ?case by (auto intro!: uval_typing_uval_typing_record.intros\n                                                        abs_upd_val_to_uval_typing)\nnext case u_v_p_abs_ro then show ?case by (auto dest:   abs_typing_readonly [rotated 1]\n                                                        abs_upd_val_to_uval_typing\n                                                intro!: uval_typing_uval_typing_record.intros)\nnext case u_v_p_abs_w  then show ?case by (auto dest:   abs_typing_readonly [rotated 1]\n                                                        abs_upd_val_to_uval_typing\n                                                intro!: uval_typing_uval_typing_record.intros)\nqed\n\n\nlemma u_v_prim' : \"\\<tau> = lit_type l \\<Longrightarrow> l = l' \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> UPrim l \\<sim> VPrim l' : TPrim \\<tau> \\<langle>{}, {}\\<rangle>\"\n   by (simp add: u_v_prim)\n\ninductive_cases u_v_primE     [elim] : \"\\<Xi>, \\<sigma> \\<turnstile> UPrim l \\<sim> VPrim l' : TPrim \\<tau> \\<langle>r, w\\<rangle>\"\ninductive_cases u_v_functionE [elim] : \"\\<Xi>, \\<sigma> \\<turnstile> UFunction f ts \\<sim> VFunction f' ts' : TFun \\<tau> \\<rho> \\<langle>r, w\\<rangle>\"\ninductive_cases u_v_afunE     [elim] : \"\\<Xi>, \\<sigma> \\<turnstile> UAFunction f ts \\<sim> VAFunction f' ts' : TFun \\<tau> \\<rho> \\<langle>r, w\\<rangle>\"\ninductive_cases u_v_sumE      [elim] : \"\\<Xi>, \\<sigma> \\<turnstile> u \\<sim> v : TSum \\<tau>s \\<langle>r, w\\<rangle>\"\ninductive_cases u_v_productE  [elim] : \"\\<Xi>, \\<sigma> \\<turnstile> UProduct a b \\<sim> VProduct a' b' : TProduct \\<tau> \\<rho> \\<langle>r, w\\<rangle>\"\ninductive_cases u_v_recE      [elim] : \"\\<Xi>, \\<sigma> \\<turnstile> URecord fs \\<sim> VRecord fs' : \\<tau> \\<langle>r, w\\<rangle>\"\ninductive_cases u_v_p_recE    [elim] : \"\\<Xi>, \\<sigma> \\<turnstile> UPtr p rp \\<sim> VRecord fs' : TRecord fs s \\<langle>r, w\\<rangle>\"\ninductive_cases u_v_r_emptyE  [elim] : \"\\<Xi>, \\<sigma> \\<turnstile>* [] \\<sim> [] :r \\<tau>s \\<langle>r, w\\<rangle>\"\ninductive_cases u_v_r_consE   [elim] : \"\\<Xi>, \\<sigma> \\<turnstile>* (a # b) \\<sim> (a' # b') :r \\<tau>s \\<langle>r, w\\<rangle>\"\ninductive_cases u_v_r_consE'  [elim] : \"\\<Xi>, \\<sigma> \\<turnstile>* (a # b) \\<sim> xx :r \\<tau>s \\<langle>r, w\\<rangle>\"\n\ninductive upd_val_rel_all :: \"('f \\<Rightarrow> poly_type) \n                            \\<Rightarrow> ('f, 'au, 'l) store \n                            \\<Rightarrow> ('f, 'au, 'l) uval list\n                            \\<Rightarrow> ('f, 'av) vval list  \n                            \\<Rightarrow> type list \n                            \\<Rightarrow> 'l set \n                            \\<Rightarrow> 'l set \n                            \\<Rightarrow> bool\" (\"_, _ \\<turnstile>* _ \\<sim> _ : _ \\<langle>_, _\\<rangle>\" [30,0,0,0,0,0,20] 80) where\n  u_v_all_empty  : \"\\<Xi>, \\<sigma> \\<turnstile>* [] \\<sim> [] : [] \\<langle>{}, {}\\<rangle>\"\n\n| u_v_all_cons   : \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>  x  \\<sim> x'  : t  \\<langle>r , w \\<rangle>\n                    ; \\<Xi>, \\<sigma> \\<turnstile>* xs \\<sim> xs' : ts \\<langle>r', w'\\<rangle>  \n                    ; w  \\<inter> w' = {}\n                    ; w  \\<inter> r' = {}\n                    ; w' \\<inter> r  = {}\n                    \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile>* (x # xs) \\<sim> (x' # xs') : (t # ts) \\<langle>r \\<union> r', w \\<union> w'\\<rangle>\"\n\nlemma upd_val_rel_all_to_vval_typing_all:\nshows \"\\<Xi>, \\<sigma> \\<turnstile>* us \\<sim> vs : \\<tau>s  \\<langle>r, w\\<rangle> \\<Longrightarrow> vval_typing_all \\<Xi> vs \\<tau>s\"\nproof (induct rule: upd_val_rel_all.inducts)\ncase u_v_all_empty then show ?case by (simp add: vval_typing_all_def)\ncase u_v_all_cons  then show ?case by (simp add: vval_typing_all_def upd_val_rel_to_vval_typing) \nqed\n\n\nlemma upd_val_rel_all_to_uval_typing_all:\nshows \"\\<Xi>, \\<sigma> \\<turnstile>* us \\<sim> vs : \\<tau>s \\<langle>r, w\\<rangle> \\<Longrightarrow> uval_typing_all \\<Xi> \\<sigma> us \\<tau>s r w\"\nusing assms proof (induct rule: upd_val_rel_all.inducts )\ncase u_v_all_empty then show ?case by (rule)\ncase u_v_all_cons  then show ?case by (auto intro: uval_typing_all.intros\n                                            simp:  upd_val_rel_to_uval_typing)\nqed\n\ninductive u_v_matches :: \"('f \\<Rightarrow> poly_type) \n                        \\<Rightarrow> ('f, 'au, 'l) store \n                        \\<Rightarrow> ('f, 'au, 'l) uval env \n                        \\<Rightarrow> ('f, 'av) vval env\n                        \\<Rightarrow> ctx\n                        \\<Rightarrow> 'l set \n                        \\<Rightarrow> 'l set \n                        \\<Rightarrow> bool\" (\"_, _ \\<turnstile> _ \\<sim> _ matches _ \\<langle>_, _\\<rangle>\" [30,0,0,0,0,0,20] 60) where \n\n  u_v_matches_empty : \"\\<Xi>, \\<sigma> \\<turnstile> [] \\<sim> [] matches [] \\<langle>{}, {}\\<rangle>\"\n\n| u_v_matches_none  : \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile> xs \\<sim> xs' matches \\<Gamma> \\<langle>r, w\\<rangle> \n                       \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> (x # xs) \\<sim> (x' # xs') matches (None # \\<Gamma>) \\<langle>r, w\\<rangle>\"\n\n| u_v_matches_some  : \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile> x \\<sim> x' : t  \\<langle>r , w \\<rangle>\n                       ; \\<Xi>, \\<sigma> \\<turnstile> xs \\<sim> xs' matches ts \\<langle>r', w'\\<rangle>  \n                       ; w  \\<inter> w' = {}\n                       ; w  \\<inter> r' = {}\n                       ; w' \\<inter> r  = {}\n                       \\<rbrakk> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile> (x # xs) \\<sim> (x' # xs') matches (Some t # ts) \\<langle>r \\<union> r', w \\<union> w'\\<rangle>\"\n\ninductive_cases u_v_matches_consE: \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (\\<tau> # \\<tau>s) \\<langle> r , w \\<rangle>\"\n\nlemma u_v_matches_to_matches:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> us \\<sim> vs matches \\<Gamma> \\<langle>r, w\\<rangle>\"\nshows   \"val.matches \\<Xi> vs \\<Gamma>\"\nusing assms proof (induct rule: u_v_matches.inducts)\ncase u_v_matches_empty then show ?case by (simp add: matches_def)\ncase u_v_matches_none  then show ?case by (simp add: matches_def)\ncase u_v_matches_some  then show ?case by (simp add: matches_def upd_val_rel_to_vval_typing)\nqed\n\nlemma u_v_matches_to_matches_ptrs:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> us \\<sim> vs matches \\<Gamma> \\<langle>r, w\\<rangle>\"\nshows   \"matches_ptrs \\<Xi> \\<sigma> us \\<Gamma> r w\"\nusing assms proof (induct rule: u_v_matches.inducts)\ncase u_v_matches_empty then show ?case by rule\ncase u_v_matches_none  then show ?case by (auto intro: matches_ptrs_none)\ncase u_v_matches_some  then show ?case by (auto intro: matches_ptrs_some\n                                                simp: upd_val_rel_to_uval_typing)\nqed\n\ndefinition proc_env_u_v_matches :: \"(('f, 'au, 'l) uabsfuns)\n\n                                  \\<Rightarrow> (('f, 'av)    vabsfuns) \n                                  \\<Rightarrow> ('f \\<Rightarrow> poly_type) \n                                  \\<Rightarrow> bool\" \n           (\"_ \\<sim> _ matches-u-v _\" [30,20] 60) where \n  \"\\<xi> \\<sim> \\<xi>' matches-u-v \\<Xi>\n          \\<equiv> (\\<forall> f. let (K, \\<tau>i, \\<tau>o) = \\<Xi> f \n                  in (\\<forall> \\<sigma> \\<sigma>' \\<tau>s a a' v v' r w. \n                         list_all2 (kinding []) \\<tau>s K \n                      \\<longrightarrow> (\\<Xi> , \\<sigma> \\<turnstile> a \\<sim> a' : instantiate \\<tau>s \\<tau>i \\<langle>r, w\\<rangle>)\n                      \\<longrightarrow> \\<xi> f (\\<sigma>, a) (\\<sigma>', v)\n                      \\<longrightarrow> (\\<xi>' f a' v'\n                           \\<longrightarrow> (\\<exists>r' w'. (\\<Xi> , \\<sigma>' \\<turnstile> v \\<sim> v' : instantiate \\<tau>s \\<tau>o \\<langle>r', w'\\<rangle>)\n                                    \\<and> r' \\<subseteq> r \\<and> frame \\<sigma> w \\<sigma>' w'))\n                       \\<and> (\\<exists> v'. \\<xi>' f a' v')))\"\n\nlemma upd_val_rel_record:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile>* vs \\<sim> vs' : ts \\<langle>r, w\\<rangle>\"\nshows   \"\\<Xi>, \\<sigma> \\<turnstile>* (zip vs (map (type_repr) ts)) \\<sim> vs' :r zip ts (replicate (length ts) False) \\<langle>r, w\\<rangle>\"\nusing assms proof (induct rule: upd_val_rel_all.induct)\ncase u_v_all_empty  then show ?case by (auto intro: upd_val_rel_upd_val_rel_record.intros)\ncase u_v_all_cons   then show ?case by (auto intro: upd_val_rel_upd_val_rel_record.intros)\nqed\n\n\nlemma upd_val_rel_pointers_noalias:\nshows \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>  v  \\<sim> v'  :  \\<tau>  \\<langle> r , w \\<rangle> \\<rbrakk> \\<Longrightarrow> r \\<inter> w = {}\"\nand   \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>* vs \\<sim> vs' :r \\<tau>s \\<langle> r , w \\<rangle> \\<rbrakk> \\<Longrightarrow> r \\<inter> w = {}\"\nby (auto dest!: upd_val_rel_to_uval_typing  uval_typing_pointers_noalias)\n\nlemma u_v_shareable_not_writable:\nassumes \"S \\<in> k\"\nshows \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>  v  \\<sim> v'  :  \\<tau>  \\<langle> r , w \\<rangle>; K \\<turnstile>  \\<tau>  :\\<kappa>  k \\<rbrakk> \\<Longrightarrow> w = {}\"\nand   \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r \\<tau>s \\<langle> r , w \\<rangle>; K \\<turnstile>* \\<tau>s :\\<kappa>r k \\<rbrakk> \\<Longrightarrow> w = {}\"\nusing assms by (fastforce dest: upd_val_rel_to_uval_typing shareable_not_writable)+\n\nlemma u_v_discardable_not_writable:\nassumes \"D \\<in> k\"\nshows \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>  v  \\<sim> v'  :  \\<tau>  \\<langle> r , w \\<rangle>; K \\<turnstile>  \\<tau>  :\\<kappa>  k \\<rbrakk> \\<Longrightarrow> w = {}\"\nand   \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r \\<tau>s \\<langle> r , w \\<rangle>; K \\<turnstile>* \\<tau>s :\\<kappa>r k \\<rbrakk> \\<Longrightarrow> w = {}\"\nusing assms by (fastforce dest: upd_val_rel_to_uval_typing discardable_not_writable)+\n\n\nlemma u_v_discardable_not_writable_all:\nassumes \"D \\<in> k\"\nshows   \"\\<lbrakk> \\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' : \\<tau>s \\<langle> r , w \\<rangle>; K \\<turnstile>* \\<tau>s :\\<kappa> k \\<rbrakk> \\<Longrightarrow> w = {}\"\nusing assms by (fastforce dest: upd_val_rel_all_to_uval_typing_all discardable_not_writable_all)\n\nlemma u_v_escapable_no_readers:\nshows   \"\\<lbrakk> \\<Xi> , \\<sigma> \\<turnstile>  x  \\<sim> x'  :  \\<tau>  \\<langle>r, w\\<rangle> ; E \\<in> k; [] \\<turnstile>  \\<tau>  :\\<kappa>  k \\<rbrakk> \\<Longrightarrow> r = {}\"\nand     \"\\<lbrakk> \\<Xi> , \\<sigma> \\<turnstile>* xs \\<sim> xs' :r \\<tau>s \\<langle>r, w\\<rangle> ; E \\<in> k; [] \\<turnstile>* \\<tau>s :\\<kappa>r k \\<rbrakk> \\<Longrightarrow> r = {}\"\nby (auto dest: upd_val_rel_to_uval_typing escapable_no_readers)\n\nlemma u_v_tprim_no_pointers:\nassumes \"\\<Xi> , \\<sigma> \\<turnstile> u \\<sim> v : TPrim \\<tau> \\<langle>r, w\\<rangle>\"\nshows   \"r = {}\"\nand     \"w = {}\"\nusing assms by (auto dest: upd_val_rel_to_uval_typing tprim_no_pointers)\n\nlemma u_v_tfun_no_pointers:\nassumes \"\\<Xi> , \\<sigma> \\<turnstile> u \\<sim> v : TFun \\<tau> \\<rho> \\<langle>r, w\\<rangle>\"\nshows   \"r = {}\"\nand     \"w = {}\"\nusing assms by (auto dest: upd_val_rel_to_uval_typing tfun_no_pointers)\n\nlemma u_v_map_tprim_no_pointers:\nassumes \"\\<Xi> , \\<sigma> \\<turnstile>* us \\<sim> vs : map TPrim \\<tau>s \\<langle>r, w\\<rangle>\"\nshows   \"r = {}\"\nand     \"w = {}\"\nusing assms by (auto dest: upd_val_rel_all_to_uval_typing_all map_tprim_no_pointers)\n\nlemma u_v_map_tprim_no_pointers':\nassumes \"\\<Xi> , \\<sigma> \\<turnstile>* us \\<sim> vs : map TPrim \\<tau>s \\<langle>r, w\\<rangle>\"\nshows   \"\\<Xi> , \\<sigma> \\<turnstile>* us \\<sim> vs : map TPrim \\<tau>s \\<langle>{}, {}\\<rangle>\"\nusing assms by (auto dest: u_v_map_tprim_no_pointers)\n \nlemma u_v_matches_none [simp]:\nshows \"(\\<Xi>, \\<sigma> \\<turnstile> (x # xs) \\<sim> (x' # xs') matches (None # ts) \\<langle>r , w\\<rangle>)\n     = (\\<Xi>, \\<sigma> \\<turnstile> xs       \\<sim> xs'        matches ts          \\<langle>r , w\\<rangle>)\"\nproof (rule iffI) \n     assume \"\\<Xi>, \\<sigma> \\<turnstile> (x # xs) \\<sim> (x' # xs') matches (None # ts) \\<langle>r, w\\<rangle>\" \nthen show   \"\\<Xi>, \\<sigma> \\<turnstile> xs       \\<sim> xs'        matches ts          \\<langle>r, w\\<rangle>\"\n     by (auto elim: u_v_matches.cases)\n\nnext assume \"\\<Xi>, \\<sigma> \\<turnstile> xs       \\<sim> xs'        matches ts          \\<langle>r, w\\<rangle>\"\nthen show   \"\\<Xi>, \\<sigma> \\<turnstile> (x # xs) \\<sim> (x' # xs') matches (None # ts) \\<langle>r, w\\<rangle>\"\n     by (auto intro: u_v_matches.intros)\nqed\n\nlemma u_v_pointerset_helper:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> u \\<sim> v : \\<tau> \\<langle>r, w\\<rangle>\"\nand     \"r = r'\"\nand     \"w = w'\"\nshows   \"\\<Xi>, \\<sigma> \\<turnstile> u \\<sim> v : \\<tau> \\<langle>r', w'\\<rangle>\"\nusing assms by auto\n\nlemma u_v_pointerset_helper_record:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile>* us \\<sim> vs :r \\<tau>s \\<langle>r, w\\<rangle>\"\nand     \"r = r'\"\nand     \"w = w'\"\nshows   \"\\<Xi>, \\<sigma> \\<turnstile>* us \\<sim> vs :r \\<tau>s \\<langle>r', w'\\<rangle>\"\nusing assms by auto\n\nlemma u_v_pointerset_helper_matches:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> us \\<sim> vs matches \\<tau>s \\<langle>r, w\\<rangle>\"\nand     \"r = r'\"\nand     \"w = w'\"\nshows   \"\\<Xi>, \\<sigma> \\<turnstile> us \\<sim> vs matches \\<tau>s \\<langle>r', w'\\<rangle>\"\nusing assms by auto\n\nlemma upd_val_rel_bang:\nshows\" \\<Xi>, \\<sigma> \\<turnstile>  u  \\<sim> v  :  \\<tau>  \\<langle>r, w\\<rangle> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile>  u  \\<sim> v  :  bang \\<tau> \\<langle>r \\<union> w, {}\\<rangle>\"\nand   \"\\<Xi>, \\<sigma> \\<turnstile>* us \\<sim> vs :r \\<tau>s \\<langle>r, w\\<rangle> \\<Longrightarrow> \\<Xi>, \\<sigma> \\<turnstile>* us \\<sim> vs :r (map (\\<lambda> (t, b). (bang t, b)) \\<tau>s) \\<langle>r \\<union> w, {}\\<rangle>\"\nusing assms proof (induct rule: upd_val_rel_upd_val_rel_record.inducts)\n     case u_v_prim     then show ?case by (auto  intro: upd_val_rel_upd_val_rel_record.intros)\nnext case u_v_product  then show ?case by (auto  dest:  upd_val_rel_upd_val_rel_record.u_v_product \n                                                 intro: u_v_pointerset_helper)\nnext case u_v_sum      then show ?case by (auto  intro!: upd_val_rel_upd_val_rel_record.intros exI\n                                                 dest:  bang_kind\n                                                        list_all2_bang_type_helper\n                                                          [ where ts = \"map snd ts\"\n                                                            and   rs = \"map snd rs\"\n                                                            for ts rs\n                                                          , simplified])\nnext case u_v_struct   then show ?case by (auto  intro: upd_val_rel_upd_val_rel_record.intros)\nnext case u_v_abstract then show ?case by (force intro: upd_val_rel_upd_val_rel_record.intros \n                                                        abs_upd_val_bang [where s = Unboxed, simplified]\n                                                        bang_kind)\nnext case u_v_function then show ?case by (force intro: upd_val_rel_upd_val_rel_record.intros) \nnext case u_v_afun     then show ?case by (force intro: upd_val_rel_upd_val_rel_record.intros) \nnext case u_v_unit     then show ?case by (force intro: upd_val_rel_upd_val_rel_record.intros) \nnext case u_v_p_rec_ro \n  then show ?case\n    apply clarsimp\n    apply (drule upd_val_rel_to_uval_typing)\n    apply (drule uval_typing_to_kinding(2))\n    apply (frule upd_val_rel_upd_val_rel_record.u_v_p_rec_ro)\n    apply (auto dest!: kinding_all_record' bang_type_repr')\n  done\nnext case u_v_p_rec_w  \n  then show ?case\n    apply clarsimp\n    apply (drule upd_val_rel_to_uval_typing)\n    apply (drule uval_typing_to_kinding(2))\n    apply (frule upd_val_rel_upd_val_rel_record.u_v_p_rec_ro)\n    apply (auto dest!: kinding_all_record' bang_type_repr')\n  done\nnext case u_v_p_abs_ro\n  then show ?case\n    apply (clarsimp)\n    apply (frule abs_upd_val_to_uval_typing)\n    apply (drule abs_typing_readonly [rotated 1],simp,clarsimp)\n    apply (drule abs_upd_val_bang [where s = ReadOnly and w = \"{}\", simplified])\n    apply (frule bang_kind)\n    apply (force dest:upd_val_rel_upd_val_rel_record.u_v_p_abs_ro) \n  done\nnext case u_v_p_abs_w\n  then show ?case\n    apply (clarsimp)\n    apply (frule abs_upd_val_to_uval_typing)\n    apply (drule abs_upd_val_bang [where s = Writable, simplified])\n    apply (frule bang_kind)\n    apply (force dest:upd_val_rel_upd_val_rel_record.u_v_p_abs_ro) \n  done\nnext case u_v_r_empty  then show ?case by (force intro: upd_val_rel_upd_val_rel_record.intros)\nnext case u_v_r_cons1\n  then show ?case\n    apply (clarsimp)\n    apply ( drule(1) upd_val_rel_upd_val_rel_record.u_v_r_cons1\n                     [ where t = \"bang t\"\n                       and   ts = \" map (\\<lambda>(a,b).(bang a, b)) ts\"\n                       for t ts]\n          , blast, blast, blast, simp)\n    apply ( rule u_v_pointerset_helper_record\n          , (force dest: upd_val_rel_to_uval_typing uval_typing_to_kinding)+)\n  done\nnext case u_v_r_cons2  then show ?case by (force intro: upd_val_rel_upd_val_rel_record.intros bang_kind)\nqed\n\n\nlemma u_v_function_instantiate:\nassumes \"list_all2 (kinding K') ts K\"\nand     \"list_all2 (kinding []) \\<delta> K'\"\nand     \"K \\<turnstile> t wellformed\"\nand     \"K \\<turnstile> u wellformed\"\nand     \"\\<Xi>, K, [Some t] \\<turnstile> f : u\"\nshows   \"\\<Xi>, \\<sigma> \\<turnstile> UFunction f (map (instantiate \\<delta>) ts) \n              \\<sim> VFunction f (map (instantiate \\<delta>) ts) : TFun (instantiate \\<delta> (instantiate ts t))\n                                                            (instantiate \\<delta> (instantiate ts u)) \\<langle>{}, {}\\<rangle>\"\nproof -\nfrom assms have \"TFun (instantiate \\<delta> (instantiate ts t))\n                      (instantiate \\<delta> (instantiate ts u))\n               = TFun (instantiate (map (instantiate \\<delta>) ts) t)\n                      (instantiate (map (instantiate \\<delta>) ts) u)\"\n           by (force intro: instantiate_instantiate dest: list_all2_lengthD)\nwith assms show ?thesis by (force intro: upd_val_rel_upd_val_rel_record.intros \n                                         list_all2_substitutivity\n                                         kinding_kinding_all_kinding_record.intros)\nqed\n\nlemma u_v_afun_instantiate:\nassumes \"list_all2 (kinding K') ts K\"\nand     \"list_all2 (kinding []) \\<delta> K'\"\nand     \"K \\<turnstile> t wellformed\"\nand     \"K \\<turnstile> u wellformed\"\nand     \"\\<Xi> f = (K, t, u)\"\nshows   \"\\<Xi>, \\<sigma> \\<turnstile> UAFunction f (map (instantiate \\<delta>) ts) \n              \\<sim> VAFunction f (map (instantiate \\<delta>) ts) : TFun (instantiate \\<delta> (instantiate ts t))\n                                                            (instantiate \\<delta> (instantiate ts u)) \\<langle>{}, {}\\<rangle>\"\nproof -\nfrom assms have \"TFun (instantiate \\<delta> (instantiate ts t))\n                      (instantiate \\<delta> (instantiate ts u))\n               = TFun (instantiate (map (instantiate \\<delta>) ts) t)\n                      (instantiate (map (instantiate \\<delta>) ts) u)\"\n           by (force intro: instantiate_instantiate dest: list_all2_lengthD)\nwith assms show ?thesis by (force intro: upd_val_rel_upd_val_rel_record.intros \n                                         list_all2_substitutivity\n                                         kinding_kinding_all_kinding_record.intros)\nqed\n\nlemma u_v_matches_noalias:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma> \\<langle>r, w\\<rangle>\"\nshows   \"w \\<inter> r = {}\"\nusing assms by (auto dest: u_v_matches_to_matches_ptrs matches_ptrs_noalias) \n\n\nlemma u_v_matches_some_bang:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> x \\<sim> x' : t \\<langle>r, w\\<rangle>\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile> xs \\<sim> xs' matches ts \\<langle>r' \\<union> b, w'\\<rangle>\"\nand     \"w \\<inter> w' = {}\"\nand     \"w \\<inter> r' = {}\"\nand     \"w' \\<inter> r = {}\"\nshows   \"\\<Xi>, \\<sigma> \\<turnstile> (x # xs) \\<sim> (x' # xs') matches Some (bang t) # ts \\<langle>r \\<union> (r' \\<union> (b \\<union> w)), w'\\<rangle>\"\nproof - \nhave SetLemma : \"r \\<union> (r' \\<union> (b \\<union> w)) = (r \\<union> w) \\<union> (r' \\<union> b)\" by auto\nfrom assms show ?thesis by (auto simp:  SetLemma\n                                 intro: u_v_matches_some \n                                          [where w = \"{}\", simplified]\n                                        upd_val_rel_bang)\nqed \n\nlemma u_v_matches_split':\nassumes \"[] \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\" \nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma> \\<langle>r, w\\<rangle>\" \nshows   \"\\<exists>r' w' r'' w''. r = r' \\<union> r'' \n                       \\<and> w = w' \\<union> w'' \n                       \\<and> w' \\<inter> w'' = {} \n                       \\<and> (\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma>1 \\<langle>r' , w' \\<rangle>) \n                       \\<and> (\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma>2 \\<langle>r'', w''\\<rangle>)\" \nusing assms proof (induct arbitrary: \\<gamma> \\<gamma>' r w rule: split.induct)\n     case split_empty then show ?case by (fastforce elim:  u_v_matches.cases\n                                                    intro: u_v_matches.intros)\nnext case (split_cons K x a b xs as bs \\<gamma> \\<gamma>' r w) \n  then show ?case \n  proof (cases \\<Xi> \\<sigma> \\<gamma> \\<gamma>' x xs r w rule: u_v_matches_consE)\n       case 1 with split_cons show ?case   by simp\n  next case 2 with split_cons show ?thesis by (auto elim: split_comp.cases)\n  next case (3 _ _ _ rx wx _ _ rs ws)\n    with split_cons show ?thesis\n    proof (cases rule: split_comp.cases)\n         case none  with 3 show ?thesis by simp\n    next case left  with 3 show ?thesis\n      apply (clarsimp dest!: split_cons(3))\n      apply (rule_tac x = \"rx \\<union> r'\" in exI)\n      apply (rule_tac x = \"wx \\<union> w'\" in exI)\n      apply (rule_tac x = \"r''\"     in exI, rule,blast)\n      apply (rule_tac x = \"w''\"     in exI)\n      apply (force intro!: u_v_matches.intros)\n    done\n    next case right with 3 show ?thesis\n      apply (clarsimp dest!: split_cons(3))\n      apply (rule_tac x = \"r'\"       in exI)\n      apply (rule_tac x = \"w'\"       in exI)\n      apply (rule_tac x = \"rx \\<union> r''\" in exI, rule, blast)\n      apply (rule_tac x = \"wx \\<union> w''\" in exI)\n      apply (force intro!: u_v_matches.intros)\n    done\n    next case share with 3 show ?thesis\n      apply (clarsimp dest!: split_cons(3))\n      apply (drule(2) u_v_shareable_not_writable)\n      apply (clarsimp)\n      apply (rule_tac x = \"rx \\<union> r'\"  in exI)\n      apply (rule_tac x = \"w'\"       in exI)\n      apply (rule_tac x = \"rx \\<union> r''\" in exI, rule, blast)\n      apply (rule_tac x = \"w''\"      in exI)\n      apply (force intro: u_v_matches_some [where w = \"{}\", simplified])\n    done\n    qed\n  qed \nqed\n\nlemma u_v_matches_split:\nassumes \"K \\<turnstile> \\<Gamma> \\<leadsto> \\<Gamma>1 | \\<Gamma>2\" \nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>) \\<langle>r, w\\<rangle>\" \nand     \"list_all2 (kinding []) \\<tau>s K\" \nshows   \"\\<exists>r' w' r'' w''. r = r' \\<union> r'' \n                       \\<and> w = w' \\<union> w'' \n                       \\<and> w' \\<inter> w'' = {} \n                       \\<and> (\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>1) \\<langle>r' , w' \\<rangle>) \n                       \\<and> (\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>2) \\<langle>r'', w''\\<rangle>)\" \nusing assms by (auto dest:  instantiate_ctx_split \n                     intro: u_v_matches_split' [simplified])\n\n\nlemma u_v_matches_split_bang':\nassumes \"split_bang [] vs \\<Gamma> \\<Gamma>1 \\<Gamma>2\" \nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma> \\<langle>r, w\\<rangle>\" \nshows   \"\\<exists>r' w' r'' w'' b. r = r' \\<union> r'' \n                         \\<and> w' \\<inter> w'' = {} \n                         \\<and> w = w' \\<union> w'' \\<union> b\n                         \\<and> b \\<inter> (w' \\<union> w'') = {}\n                         \\<and> (\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma>1 \\<langle>r' \\<union> b, w'     \\<rangle>) \n                         \\<and> (\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma>2 \\<langle>r''   , w'' \\<union> b\\<rangle>)\" \nusing assms proof (induct arbitrary: \\<gamma> \\<gamma>' r w rule: split_bang.induct)\n     case split_bang_empty then show ?case by (fastforce elim:  u_v_matches.cases\n                                                         intro: u_v_matches.intros)\nnext case (split_bang_cons iss K x a b xs as bs \\<gamma> \\<gamma>' r w) \n  then show ?case \n  proof (cases \\<Xi> \\<sigma> \\<gamma> \\<gamma>' x xs r w rule: u_v_matches_consE)\n       case 1 with split_bang_cons show ?case   by simp\n  next case 2 with split_bang_cons show ?thesis by (auto elim: split_comp.cases)\n  next case (3 _ _ _ rx wx _ _ rs ws)\n    with split_bang_cons(2,1,3-) show ?thesis\n    proof (cases rule: split_comp.cases)\n         case none  with 3 show ?thesis by simp\n    next case left  with 3 show ?thesis\n      apply (clarsimp dest!: split_bang_cons(4))\n      apply (rule_tac x = \"rx \\<union> r'\" in exI)\n      apply (rule_tac x = \"wx \\<union> w'\" in exI)\n      apply (rule_tac x = \"r''\"     in exI, rule, blast)\n      apply (rule_tac x = \"w''\"     in exI, rule, blast)\n      apply (rule_tac x = \"ba\"      in exI)\n      apply (auto simp: Un_assoc intro!: u_v_matches.intros)\n    done\n    next case right with 3 show ?thesis\n      apply (clarsimp dest!: split_bang_cons(4))\n      apply (rule_tac x = \"r'\"       in exI)\n      apply (rule_tac x = \"w'\"       in exI)\n      apply (rule_tac x = \"rx \\<union> r''\" in exI, rule, blast)\n      apply (rule_tac x = \"wx \\<union> w''\" in exI, rule, blast)\n      apply (rule_tac x = \"ba\"       in exI)\n      apply (auto simp: Un_assoc intro!: u_v_matches.intros)\n    done\n    next case share with 3 show ?thesis\n      apply (clarsimp dest!: split_bang_cons(4))\n      apply (drule(2) u_v_shareable_not_writable)\n      apply (clarsimp)\n      apply (rule_tac x = \"rx \\<union> r'\"  in exI)\n      apply (rule_tac x = \"w'\"       in exI)\n      apply (rule_tac x = \"rx \\<union> r''\" in exI, rule, blast)\n      apply (rule_tac x = \"w''\"      in exI, rule, blast)\n      apply (rule_tac x = \"ba\"       in exI)\n      apply (auto simp: Un_assoc intro: u_v_matches_some [where w = \"{}\", simplified])\n    done\n    qed\n  qed \nnext case (split_bang_bang iss iss' K xs as bs x \\<gamma> \\<gamma>' r w)\n  then show ?case\n  proof (cases \\<Xi> \\<sigma> \\<gamma> \\<gamma>' \"Some x\" xs r w rule: u_v_matches_consE)\n       case 1 with split_bang_bang show ?case by simp\n  next case 2 with split_bang_bang show ?thesis by simp\n  next case (3 _ _ _ rx wx _ _ rs ws) with split_bang_bang show ?thesis \n    apply (clarsimp dest!: split_bang_bang(4))\n    apply (rule_tac x = \"rx \\<union> r'\"  in exI)\n    apply (rule_tac x = \"w'\"       in exI)\n    apply (rule_tac x = \"rx \\<union> r''\" in exI, rule, blast)\n    apply (rule_tac x = \"w''\"      in exI, rule, blast)\n    apply (rule_tac x = \"b \\<union> wx\"   in exI)\n    apply (auto simp:   Un_assoc\n                dest:   u_v_matches_some\n                intro!: u_v_matches_some_bang\n                intro:  u_v_pointerset_helper_matches)\n  done\n  qed\nqed\n\n\nlemma u_v_matches_split_bang:\nassumes \"split_bang K vs \\<Gamma> \\<Gamma>1 \\<Gamma>2\" \nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>) \\<langle>r, w\\<rangle>\" \nand     \"list_all2 (kinding []) \\<tau>s K\" \nshows   \"\\<exists>r' w' r'' w'' b. r = r' \\<union> r'' \n                         \\<and> w' \\<inter> w'' = {} \n                         \\<and> w = w' \\<union> w'' \\<union> b\n                         \\<and> b \\<inter> (w' \\<union> w'') = {}\n                         \\<and> (\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>1) \\<langle>r'  \\<union> b , w'     \\<rangle>) \n                         \\<and> (\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>2) \\<langle>r''     , w'' \\<union> b\\<rangle>)\" \nusing assms by (auto dest:  instantiate_ctx_split_bang\n                     intro: u_v_matches_split_bang' [simplified])\n\nlemma u_v_matches_weaken':\nassumes \"[] \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma>  \\<langle>r, w\\<rangle>\"\nshows   \"\\<exists> r'. (r' \\<subseteq> r) \\<and> (\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma>' \\<langle>r', w\\<rangle>)\"\nusing assms(1) [simplified weakening_def] and assms(2-) \nproof (induct arbitrary: \\<gamma> \\<gamma>' r w rule: list_all2_induct )\n     case Nil  then show ?case by auto\nnext case Cons then show ?case \n  proof (cases rule: weakening_comp.cases)\n       case none with Cons show ?thesis by (force elim!: u_v_matches_consE) \n  next case keep with Cons show ?thesis\n    apply (safe elim!: u_v_matches_consE dest!: Cons(3))\n    apply (rule_tac x = \"r \\<union> r'a\" in exI)\n    apply (force intro!: u_v_matches.intros)\n  done\n  next case drop with Cons show ?thesis\n    apply (safe elim!: u_v_matches_consE weakening_comp.cases dest!: Cons(3))\n    apply (frule(2) u_v_discardable_not_writable)\n    apply (clarsimp)\n    apply (rule_tac x = \"r'a\" in exI)\n    apply (force)\n  done\n  qed\nqed\n\nlemma u_v_matches_weaken:\nassumes \"K \\<turnstile> \\<Gamma> \\<leadsto>w \\<Gamma>'\" \nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>) \\<langle>r, w\\<rangle>\" \nand     \"list_all2 (kinding []) \\<tau>s K\" \nshows   \"\\<exists>r'. (r' \\<subseteq> r) \\<and> (\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>') \\<langle>r', w\\<rangle>) \" \nusing assms by (auto dest:  instantiate_ctx_weaken\n                     intro: u_v_matches_weaken' [simplified])\n\n\n\nlemma u_v_matches_cons:\nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi> , \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>) \\<langle>r', w'\\<rangle>\"\nand     \"\\<Xi> , \\<sigma> \\<turnstile> x \\<sim> x' : instantiate \\<tau>s \\<tau> \\<langle>r, w\\<rangle>\"\nand     \"w  \\<inter> w' = {}\"\nand     \"w  \\<inter> r' = {}\"\nand     \"w' \\<inter> r  = {}\"\nshows   \"\\<Xi> , \\<sigma> \\<turnstile> (x # \\<gamma>) \\<sim> (x' # \\<gamma>') matches (instantiate_ctx \\<tau>s (Some \\<tau> # \\<Gamma>)) \\<langle>r \\<union> r', w \\<union> w'\\<rangle>\"  \nusing assms by (auto intro: u_v_matches_some)\n\nlemma u_v_matches_empty:\nshows \"\\<Xi> , \\<sigma> \\<turnstile> [] \\<sim> [] matches instantiate_ctx \\<tau>s [] \\<langle>{}, {}\\<rangle>\" \nby (simp add: u_v_matches_empty instantiate_ctx_def)\n\nlemma u_v_matches_length:\nassumes \"\\<Xi> , \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma> \\<langle>r, w\\<rangle>\"\nshows   \"length \\<gamma> = length \\<Gamma>\"\nusing assms by (auto elim: u_v_matches.induct) \n\nlemma u_v_matches_empty_env:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches empty n \\<langle>r, w\\<rangle>\"\nshows   \"r = {}\"\nand     \"w = {}\"\nusing assms by (auto dest: u_v_matches_to_matches_ptrs matches_ptrs_empty_env)\n\nlemma u_v_matches_proj':\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma> \\<langle>r, w\\<rangle>\"\nand     \"[] \\<turnstile> \\<Gamma> \\<leadsto>w singleton (length \\<Gamma>) i \\<tau>\" \nand     \"i < length \\<Gamma>\"\nshows   \"\\<exists> r' \\<subseteq> r. \\<Xi>, \\<sigma> \\<turnstile> (\\<gamma> ! i) \\<sim> (\\<gamma>' ! i) : \\<tau> \\<langle>r', w\\<rangle>\"\nproof -\n  from assms obtain r' where S: \"r' \\<subseteq> r\" \n                       and   I: \"\\<Xi> , \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (singleton (length \\<Gamma>) i \\<tau>) \\<langle>r', w\\<rangle>\"\n       by (auto dest: u_v_matches_weaken')\n  from assms obtain env where \"singleton (length \\<Gamma>) i \\<tau> = env\" by simp  \n  from I [simplified this] S assms(3-) this\n  show ?thesis proof (induct arbitrary: i \\<Gamma> rule: u_v_matches.inducts )\n       case u_v_matches_empty then moreover   have \"\\<Gamma> = []\" by (simp add: empty_def)\n                                    ultimately show ?case    by simp\n  next case (u_v_matches_none  \\<Xi> \\<sigma> xs xs' \\<Gamma>' r w x x' i \\<Gamma>)\n       show ?case proof (cases i)\n            case 0       with u_v_matches_none show ?thesis by ( cases \"length \\<Gamma>\"\n                                                               , simp_all add: empty_def )\n       next case (Suc n)\n         moreover with u_v_matches_none have \"\\<Gamma>' = empty (length \\<Gamma> - 1) [n := Some \\<tau>]\"\n                                         by (cases \"length \\<Gamma>\", simp_all add: empty_def)\n         moreover with u_v_matches_none have \"length \\<Gamma> = Suc (length \\<Gamma>')\"\n                                         by (simp add: empty_def)\n         ultimately show ?thesis apply -\n                                 apply (insert u_v_matches_none)\n                                 apply (auto).\n       qed\n  next case (u_v_matches_some)\n       show ?case proof (cases i)\n            case 0 with u_v_matches_some show ?thesis\n              apply (cases \"length \\<Gamma>\", simp_all add: empty_def)\n              apply (clarsimp dest!:u_v_matches_empty_env(2) [simplified empty_def])\n              apply (blast).\n       next case (Suc n) with u_v_matches_some show ?thesis by ( cases \"length \\<Gamma>\"\n                                                                , simp_all add: empty_def )\n       qed\n  qed\nqed\n\n\n\nlemma u_v_matches_proj:\nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>) \\<langle>r, w\\<rangle>\"\nand     \"K \\<turnstile> \\<Gamma> \\<leadsto>w singleton (length \\<Gamma>) i \\<tau>\" \nand     \"i < length \\<Gamma>\"\nshows   \"\\<exists> r' \\<subseteq> r. \\<Xi>, \\<sigma> \\<turnstile> (\\<gamma> ! i) \\<sim> (\\<gamma>' ! i) : (instantiate \\<tau>s \\<tau>) \\<langle>r', w\\<rangle>\"\nusing assms by (fastforce dest:   instantiate_ctx_weaken\n                          intro!: u_v_matches_proj' [simplified])\n\nlemma u_v_matches_proj_single':\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma> \\<langle>r, w\\<rangle>\"\nand     \"i < length \\<Gamma>\"\nand     \"\\<Gamma> ! i = Some \\<tau>\"\nshows   \"\\<exists>r' w'. (r' \\<subseteq> r) \\<and> (w' \\<subseteq> w) \\<and> (\\<Xi>, \\<sigma> \\<turnstile> (\\<gamma> ! i) \\<sim> (\\<gamma>' ! i) : \\<tau> \\<langle>r', w'\\<rangle>)\"\nusing assms proof (induct arbitrary: i rule: u_v_matches.induct)\n     case u_v_matches_empty then show ?case by simp\nnext case u_v_matches_none  then show ?case\n  proof (cases i)\n       case 0   with u_v_matches_none show ?thesis by simp\n  next case Suc with u_v_matches_none show ?thesis by simp\n  qed\nnext case u_v_matches_some then show ?case\n  proof (cases i)\n       case 0   with u_v_matches_some show ?thesis by auto\n  next case Suc with u_v_matches_some show ?thesis \n    apply (clarsimp dest!: u_v_matches_some(3))\n    apply (rule_tac x = r'a in exI, rule, blast)\n    apply (rule_tac x = w'a in exI, rule, blast)\n    apply (simp)\n  done\n  qed\nqed\n\n\nlemma u_v_matches_proj_consumed':\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma> \\<langle>r, w\\<rangle>\"\nand     \"[] \\<turnstile> \\<Gamma> consumed\"\nshows   \"w = {}\"\nusing assms proof(induction rule: u_v_matches.induct)         \n     case u_v_matches_empty then show ?case by auto\nnext case u_v_matches_none  then show ?case by (simp add: empty_def weakening_def)\nnext case u_v_matches_some  then show ?case by (auto simp: weakening_def empty_def\n                                                     elim: weakening_comp.cases\n                                                     dest: u_v_discardable_not_writable)\nqed\n\n\nlemma u_v_matches_proj_consumed:\nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>) \\<langle>r, w\\<rangle>\"\nand     \"K \\<turnstile> \\<Gamma> consumed\"\nshows   \"w = {}\"\nusing assms by (auto dest:   instantiate_ctx_weaken\n                     intro!: u_v_matches_proj_consumed')\n\nlemma u_v_matches_proj_single:\nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>) \\<langle>r, w\\<rangle>\"\nand     \"i < length \\<Gamma>\"\nand     \"\\<Gamma> ! i = Some \\<tau>\"\nshows   \"\\<exists> r' w'. (r' \\<subseteq> r) \\<and> (w' \\<subseteq> w) \\<and> (\\<Xi>, \\<sigma> \\<turnstile> (\\<gamma> ! i) \\<sim> (\\<gamma>' ! i) : instantiate \\<tau>s \\<tau> \\<langle>r', w'\\<rangle>)\"\nusing assms by (auto intro!: u_v_matches_proj_single' [simplified]\n                     simp:   instantiate_ctx_def)\n\n\nsection {* procedure environment matches *}\n\nlemma proc_env_u_v_matches_abstract:\nassumes \"\\<xi> \\<sim> \\<xi>' matches-u-v \\<Xi>\"\nand     \"\\<Xi> f = (K, \\<tau>i, \\<tau>o)\"\nand     \"list_all2 (kinding []) \\<tau>s K\"\nand     \"\\<Xi> , \\<sigma> \\<turnstile> a \\<sim> a'   : instantiate \\<tau>s \\<tau>i \\<langle>r, w\\<rangle>\"\nand     \"\\<xi> f (\\<sigma>, a) (\\<sigma>', v)\"\nand     \"\\<xi>' f a' v'\"\nshows   \"\\<exists>r' w'.\n             \\<Xi> , \\<sigma>' \\<turnstile> v \\<sim> v' : instantiate \\<tau>s \\<tau>o \\<langle>r', w'\\<rangle>\n            \\<and> r' \\<subseteq> r \\<and> frame \\<sigma> w \\<sigma>' w'\"\nusing assms by (clarsimp simp: proc_env_u_v_matches_def, drule_tac x = f in spec, fastforce)\n\nsection {* frame *}\n\nlemma helper_one:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile>* vs \\<sim> vs' : map TPrim \\<tau>s \\<langle>{}, {}\\<rangle>\"\nshows \"(map (\\<lambda>vv. case vv of UPrim v \\<Rightarrow> v | _ \\<Rightarrow> LBool False) vs) =\n       (map (\\<lambda>vv. case vv of VPrim v \\<Rightarrow> v | _ \\<Rightarrow> LBool False) vs')\"\nusing assms proof (induct rule: upd_val_rel_all.inducts)\n     case u_v_all_empty then show ?case by simp\nnext case u_v_all_cons  then show ?case by (force elim: upd_val_rel.cases)\nqed    \n\nlemma helper_two:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile>* vs \\<sim> vs' : \\<tau>s \\<langle>{}, {}\\<rangle>\"\nand     \"\\<tau>s = map TPrim \\<tau>s'\"\nshows   \"map lit_type (map (\\<lambda>vv. case vv of UPrim v \\<Rightarrow> v | _ \\<Rightarrow> LBool False) vs) = \\<tau>s'\"\nusing assms proof (induct arbitrary: \\<tau>s' rule: upd_val_rel_all.inducts)\ncase u_v_all_empty then show ?case by clarsimp\nnext case u_v_all_cons  then show ?case by (fastforce elim: upd_val_rel.cases)\nqed\n\nlemma eval_prim_u_v_corres:\nassumes \"prim_op_type p = (\\<tau>s, \\<tau>)\"\nand     \"\\<Xi> , \\<sigma> \\<turnstile>* vs \\<sim> vs' : map TPrim \\<tau>s \\<langle>{}, {}\\<rangle>\"\nshows   \"\\<Xi> , \\<sigma> \\<turnstile>  eval_prim_u p vs \\<sim> eval_prim p vs' : TPrim \\<tau> \\<langle>{}, {}\\<rangle>\"\nusing assms\n  apply (simp add: eval_prim_def)\n  apply (simp add: eval_prim_u_def)\n  apply (rule u_v_prim')\n  apply (frule eval_prim_op_lit_type)\n  apply (frule helper_two, rule refl)\n  apply (assumption)\n  apply (rule sym, assumption)\n  apply (frule helper_one)\n  apply (simp)\ndone\n\nlemma upd_val_rel_valid:\nassumes \"p \\<in> (r \\<union> w)\"\nshows   \"\\<Xi> , \\<sigma> \\<turnstile>  u  \\<sim> v  :  t  \\<langle> r , w \\<rangle> \\<Longrightarrow> \\<sigma> p \\<noteq> None\"\nand     \"\\<Xi> , \\<sigma> \\<turnstile>* us \\<sim> vs :r ts \\<langle> r , w \\<rangle> \\<Longrightarrow> \\<sigma> p \\<noteq> None\"\nusing assms by (auto dest: upd_val_rel_to_uval_typing intro: uval_typing_valid [simplified])\n\nlemma u_v_matches_valid:\nassumes \"\\<Xi> , \\<sigma> \\<turnstile> u \\<sim> u' matches t \\<langle> r , w \\<rangle>\"\nand     \"p \\<in> (r \\<union> w)\"\nshows   \"\\<sigma> p \\<noteq> None\"\nusing assms by (auto dest: u_v_matches_to_matches_ptrs matches_ptrs_valid)\n\nlemma upd_val_rel_frame:\nassumes \"frame \\<sigma> w1 \\<sigma>' w2\"\nand     \"w \\<inter> w1 = {}\"\nand     \"r \\<inter> w1 = {}\"\nshows   \"\\<Xi> , \\<sigma> \\<turnstile>  u  \\<sim> v  :  t  \\<langle> r , w \\<rangle> \\<Longrightarrow> \\<Xi> , \\<sigma>' \\<turnstile>  u  \\<sim> v  : t   \\<langle> r , w \\<rangle>\"\nand     \"\\<Xi> , \\<sigma> \\<turnstile>* us \\<sim> vs :r ts \\<langle> r , w \\<rangle> \\<Longrightarrow> \\<Xi> , \\<sigma>' \\<turnstile>* us \\<sim> vs :r ts \\<langle> r , w \\<rangle>\"\nusing assms proof (induct rule:upd_val_rel_upd_val_rel_record.inducts)\n     case u_v_prim     then show ?case by (auto simp add: upd_val_rel_upd_val_rel_record.u_v_prim)\nnext case u_v_product  then show ?case by (fastforce intro!: upd_val_rel_upd_val_rel_record.u_v_product)\nnext case u_v_sum      then show ?case by (fastforce intro!: upd_val_rel_upd_val_rel_record.u_v_sum)\nnext case u_v_struct   then show ?case by (fastforce intro!: upd_val_rel_upd_val_rel_record.u_v_struct)\nnext case u_v_abstract then show ?case by (simp add: upd_val_rel_upd_val_rel_record.u_v_abstract)\nnext case u_v_function then show ?case by (simp add: upd_val_rel_upd_val_rel_record.u_v_function)\nnext case u_v_afun     then show ?case by (simp add: upd_val_rel_upd_val_rel_record.u_v_afun)\nnext case u_v_unit     then show ?case by (simp add: upd_val_rel_upd_val_rel_record.u_v_unit)\nnext case u_v_p_rec_ro then show ?case by (auto intro!: upd_val_rel_upd_val_rel_record.u_v_p_rec_ro\n                                                simp:   frame_def)\nnext case u_v_p_rec_w  then show ?case by (auto intro!: upd_val_rel_upd_val_rel_record.u_v_p_rec_w\n                                                simp:   frame_def)\nnext case u_v_p_abs_ro then show ?case by (auto intro!: upd_val_rel_upd_val_rel_record.u_v_p_abs_ro\n                                                simp:   frame_def)\nnext case u_v_p_abs_w  then show ?case by (auto intro!: upd_val_rel_upd_val_rel_record.u_v_p_abs_w\n                                                simp:   frame_def)\nnext case u_v_r_empty  then show ?case by (simp add: upd_val_rel_upd_val_rel_record.u_v_r_empty)\nnext case u_v_r_cons1  then show ?case by (force intro!: upd_val_rel_upd_val_rel_record.u_v_r_cons1\n                                                 simp: frame_def)\nnext case u_v_r_cons2  then show ?case by (simp add: upd_val_rel_upd_val_rel_record.u_v_r_cons2)\nqed\n\nlemma u_v_matches_frame:\nassumes \"\\<Xi> , \\<sigma> \\<turnstile> u \\<sim> v matches t \\<langle> r , w \\<rangle>\"\nand     \"frame \\<sigma> w1 \\<sigma>' w2\"\nand     \"w1 \\<inter> w = {}\"\nand     \"w1 \\<inter> r = {}\"\nshows   \"\\<Xi> , \\<sigma>' \\<turnstile> u \\<sim> v matches t \\<langle> r , w \\<rangle>\"\nusing assms proof (induct rule: u_v_matches.induct)\n     case u_v_matches_empty then show ?case by (simp add: u_v_matches.intros)\nnext case u_v_matches_none  then show ?case by (auto)\nnext case u_v_matches_some  then show ?case by (fast dest:   upd_val_rel_frame(1) [rotated -1]\n                                                     intro!: u_v_matches.u_v_matches_some)\nqed\n\nlemma frame_noalias_upd_val_rel :\nassumes \"frame \\<sigma> u \\<sigma>' u'\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile> v \\<sim> v' : \\<tau> \\<langle>r, w\\<rangle>\"\nshows   \"u  \\<inter> w = {} \\<Longrightarrow> u' \\<inter> w = {}\"\nand     \"u  \\<inter> r = {} \\<Longrightarrow> u' \\<inter> r = {}\"\nusing assms by (auto dest: upd_val_rel_to_uval_typing frame_noalias_uval_typing)\n\nlemma frame_noalias_u_v_matches :\nassumes \"frame \\<sigma> u \\<sigma>' u'\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma> \\<langle>r, w\\<rangle>\"\nshows   \"u  \\<inter> w = {} \\<Longrightarrow> u' \\<inter> w = {}\"\nand     \"u  \\<inter> r = {} \\<Longrightarrow> u' \\<inter> r = {}\"\nusing assms by (auto dest: u_v_matches_to_matches_ptrs frame_noalias_matches_ptrs)\n\nlemma frame_noalias_upd_val_rel' :\nassumes \"frame \\<sigma> u \\<sigma>' u'\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile> v \\<sim> v' : \\<tau> \\<langle>r, w\\<rangle>\"\nshows   \"w \\<inter> u = {} \\<Longrightarrow> w \\<inter> u' = {}\"\nand     \"r \\<inter> u = {} \\<Longrightarrow> r \\<inter> u' = {}\"\nusing assms by (auto dest: upd_val_rel_to_uval_typing frame_noalias_uval_typing)\n\n\nlemma frame_noalias_2_uv :\nassumes \"frame \\<sigma>  u \\<sigma>'  u'\"\nand     \"frame \\<sigma>' w \\<sigma>'' w'\"\nand     \"\\<Xi>, \\<sigma>  \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma>  \\<langle>r , w\\<rangle>\"\nand     \"\\<Xi>, \\<sigma>' \\<turnstile> v \\<sim> v' : \\<tau> \\<langle>r', u'\\<rangle>\"\nand     \"u \\<inter> w = {}\"\nshows   \"u' \\<inter> w' = {}\"\nproof -\nfrom assms(1,3,5) have \"u' \\<inter> w = {}\"by (rule frame_noalias_u_v_matches)\nwith assms(2,4)   show ?thesis      by (rule frame_noalias_upd_val_rel')\nqed\n\n                                                       \nlemma upd_val_rel_record_nth:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r \\<tau>s \\<langle>r, {}\\<rangle>\"\nand     \"\\<tau>s ! f = (\\<tau>, False)\"\nand     \"f < length \\<tau>s\"\nshows \"\\<exists>r' \\<subseteq> r. \\<Xi>, \\<sigma> \\<turnstile> fst (fs ! f) \\<sim> fs' ! f : \\<tau> \\<langle>r', {}\\<rangle>\"\nusing assms proof (induct fs arbitrary: fs' f r \\<tau>s)\n     case Nil  then show ?case by (fastforce elim!: upd_val_rel_record.cases) \nnext case Cons then show ?case\n  proof (cases f)\n       case 0   with Cons(2-) show ?thesis by (force elim!: u_v_r_consE')\n  next case Suc with Cons(2-) show ?thesis by (elim u_v_r_consE', auto dest!: Cons(1))\n  qed\nqed\n\n\nlemma sum_downcast_u_v:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile> USum t v xs \\<sim> VSum tv v' : TSum ts \\<langle>r, w\\<rangle>\"\nand     \"t \\<noteq> t'\"\nshows   \"\\<Xi>, \\<sigma> \\<turnstile> USum t v (filter (\\<lambda> x. fst x \\<noteq> t') xs)  \\<sim> VSum tv v' : TSum (filter (\\<lambda> x. fst x \\<noteq> t') ts) \\<langle>r, w\\<rangle>\"\nproof -\nhave 1: \"(\\<lambda> x. x \\<noteq> t') \\<circ> fst = (\\<lambda> x. fst x \\<noteq> t')\" by (auto)\nhave 2: \"map fst [ x \\<leftarrow> ts. fst x \\<noteq> t' ] = [ x \\<leftarrow> map fst ts. x \\<noteq> t' ]\"by (simp add: 1 filter_map)\nhave 3: \"[x\\<leftarrow>map fst xs . x \\<noteq> t'] = map fst [x\\<leftarrow>xs . fst x \\<noteq> t']\" by (induct xs,simp,simp)\nhave 4: \"\\<lbrakk> list_all2 (\\<lambda>t. op = (type_repr t)) (map snd ts) (map snd xs)\n         ; map fst ts = map fst xs\n         \\<rbrakk> \\<Longrightarrow> list_all2 (\\<lambda>t. op = (type_repr t)) \n                 (map snd [x\\<leftarrow>ts . fst x \\<noteq> t']) \n                 (map snd [x\\<leftarrow>xs . fst x \\<noteq> t'])\"\nby ( induct \"map snd ts\" \"map snd xs\"\n     arbitrary: ts xs\n     rule: list_all2_induct\n   , auto)\n\nfrom 1 2 assms show ?thesis apply -\n  apply (erule upd_val_rel.cases,simp_all)\n  apply (clarsimp)\n  apply (rule, simp,simp,simp)\n     apply (clarsimp, rule)\n    apply (force intro: kinding_all_subset)\n   apply (simp add: 3)\n  apply (simp add: 4)\ndone\nqed\n\nlemma upd_val_rel_record_take:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r \\<tau>s \\<langle>r, w\\<rangle>\"\nand     \"\\<tau>s ! f = (\\<tau>, False)\"\nand     \"[] \\<turnstile> \\<tau> wellformed\"\nand     \"f < length \\<tau>s\"\nshows   \"\\<exists>r' w' r'' w''. (\\<Xi>, \\<sigma> \\<turnstile>  fst (fs ! f) \\<sim> fs' ! f :  \\<tau>                     \\<langle>r' , w' \\<rangle>) \n                       \\<and> (\\<Xi>, \\<sigma> \\<turnstile>* fs           \\<sim> fs'     :r (\\<tau>s [f := (\\<tau>, True)]) \\<langle>r'', w''\\<rangle>)\n                       \\<and> r = r' \\<union> r'' \n                       \\<and> w = w' \\<union> w'' \n                       \\<and> w' \\<inter> w'' = {}\"\nusing assms proof (induct fs arbitrary: fs' f r w \\<tau>s)\n     case Nil  then show ?case by (fastforce elim: upd_val_rel_record.cases)\nnext case Cons then show ?case\n  proof (cases f)\n       case 0   with Cons(2-) show ?thesis by ( clarsimp, elim u_v_r_consE'\n                                              , auto intro!: exI\n                                                             upd_val_rel_upd_val_rel_record.intros\n                                                       simp: type_repr_uval_repr_deep(1)[OF upd_val_rel_to_uval_typing(1)]\n                                                             type_repr_uval_repr(1)[OF upd_val_rel_to_uval_typing(1)])\n  next case Suc with Cons(2-) show ?thesis\n    apply (clarsimp)\n    apply (erule u_v_r_consE')\n     apply (clarsimp, frule(2) Cons(1) [OF _ _ assms(3)])\n     apply (blast intro: upd_val_rel_upd_val_rel_record.intros)\n    apply (clarsimp, frule(2) Cons(1) [OF _ _ assms(3)])\n    apply (fastforce intro!: upd_val_rel_upd_val_rel_record.intros)\n  done\n  qed\nqed\n\nlemma upd_val_rel_record_put_taken:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile>  v  \\<sim> v'  :  t  \\<langle>r'b, w'b\\<rangle>\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r ts \\<langle>r'a, w'a\\<rangle>\"\nand     \"ts ! f = (t, True)\"\nand     \"w'b \\<inter> r'a = {}\"\nand     \"w'a \\<inter> r'b = {}\"\nand     \"w'a \\<inter> w'b = {}\"\nand     \"f < length ts\"\nshows   \"\\<Xi>, \\<sigma> \\<turnstile>* fs[f := (v, snd(fs!f))] \\<sim> fs'[f := v'] :r (ts[f := (t, False)]) \\<langle>r'a \\<union> r'b, w'a \\<union> w'b\\<rangle>\"\nusing assms proof (induct fs arbitrary: fs' f r'a w'a ts)\ncase Nil then show ?case by (auto elim!: upd_val_rel_record.cases)\nnext case Cons then show ?case\n  proof (cases f)\n       case 0   with Cons(2-) show ?thesis\n         apply (clarsimp)\n         apply (elim u_v_r_consE', simp)\n         apply (rule u_v_pointerset_helper_record, (fastforce intro!: u_v_r_cons2 u_v_r_cons1)+)\n       done\n  next case Suc with Cons(2-) show ?thesis\n         apply (clarsimp)\n         apply (elim u_v_r_consE')\n          apply (frule(1) Cons(1), simp, blast,blast,blast ,simp)\n          apply (clarsimp, rule u_v_pointerset_helper_record, force intro!: u_v_r_cons1, blast, blast) \n         apply (frule(1) Cons(1), simp, blast,blast,blast ,simp)\n         apply (clarsimp, rule u_v_pointerset_helper_record, force intro!: u_v_r_cons2, blast, blast)\n       done\n  qed\nqed\n\nlemma upd_val_rel_record_put_discardable:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile>  v  \\<sim> v'  :  t  \\<langle>r'b, w'b\\<rangle>\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r ts \\<langle>r'a, w'a\\<rangle>\"\nand     \"ts ! f = (t, False)\"\nand     \"[] \\<turnstile> t :\\<kappa> k\"\nand     \"D \\<in> k\"\nand     \"w'b \\<inter> r'a = {}\"\nand     \"w'a \\<inter> r'b = {}\"\nand     \"w'a \\<inter> w'b = {}\"\nand     \"f < length ts\"\nshows   \"\\<exists>r''a\\<subseteq> r'a. \\<Xi>, \\<sigma> \\<turnstile>* fs[f := (v, snd(fs!f))] \\<sim> fs'[f := v'] :r (ts[f := (t, False)]) \\<langle>r''a \\<union> r'b, w'a \\<union> w'b\\<rangle>\"\nusing assms proof (induct fs arbitrary: fs' f r'a w'a ts)\ncase Nil then show ?case by (auto elim!: upd_val_rel_record.cases)\nnext case Cons then show ?case\n  proof (cases f)\n       case 0   with Cons(2-) show ?thesis\n         apply (clarsimp)\n         apply (frule(2) u_v_discardable_not_writable)\n         apply (elim u_v_r_consE', simp)\n         apply (rotate_tac 3, frule(2) u_v_discardable_not_writable)\n         apply (rule_tac x = r' in exI)\n         apply (rule, blast)\n         apply (rule u_v_pointerset_helper_record,(fastforce intro!:  u_v_r_cons2 u_v_r_cons1)+)\n       done\n  next case Suc with Cons(2-) show ?thesis\n         apply (clarsimp)\n         apply (elim u_v_r_consE')\n          apply (frule(1) Cons(1), simp,blast,blast,blast,blast,blast, simp)\n          apply (clarsimp, rule_tac x = \"r \\<union> r''a\" in exI, rule, blast)\n          apply (rule u_v_pointerset_helper_record,(force intro!: u_v_r_cons2 u_v_r_cons1), blast,blast)\n         apply (frule(1) Cons(1), simp,blast,blast,blast,blast,blast, simp)\n         apply (clarsimp, rule_tac x = \"r''a\" in exI, rule, blast)\n         apply (rule u_v_pointerset_helper_record,(fastforce intro!:  u_v_r_cons2 u_v_r_cons1)+)\n    done\n  qed\nqed\n\n\nlemma upd_val_rel_record_put:\nassumes \"\\<Xi>, \\<sigma> \\<turnstile>  v \\<sim> v' :  t  \\<langle>r'b, w'b\\<rangle>\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r ts \\<langle>r'a, w'a\\<rangle>\"\nand     \"ts ! f = (t, taken)\"\nand     \"D \\<in> k \\<or> taken\"\nand     \"w'b \\<inter> r'a = {}\"\nand     \"w'a \\<inter> r'b = {}\"\nand     \"w'a \\<inter> w'b = {}\"\nand     \"f < length ts\"\nand     \"[] \\<turnstile> t :\\<kappa> k\"\nshows   \"\\<exists>r''a\\<subseteq> r'a. \\<Xi>, \\<sigma> \\<turnstile>* fs[f := (v, snd(fs!f))] \\<sim> fs'[f := v'] :r (ts[f := (t, False)]) \\<langle>r''a \\<union> r'b, w'a \\<union> w'b\\<rangle>\"\nusing assms proof (cases taken)\n     case False with assms show ?thesis by (fastforce intro!: upd_val_rel_record_put_discardable)\nnext case True  with assms show ?thesis by (fastforce intro!: upd_val_rel_record_put_taken)\nqed\n\ninductive_cases v_sem_primE   [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> (Prim p as) \\<Down> v\"\ninductive_cases v_sem_litE    [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Lit l \\<Down> v\"\ninductive_cases v_sem_funE    [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Fun e ts \\<Down> v\"\ninductive_cases v_sem_unitE   [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Unit \\<Down> v\"\ninductive_cases v_sem_promE   [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Promote a b \\<Down> v\"\ninductive_cases v_sem_castE   [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Cast a b \\<Down> v\"\ninductive_cases v_sem_esacE   [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Esac e \\<Down> v\"\ninductive_cases v_sem_splitE  [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Split e e' \\<Down> v\"\ninductive_cases v_sem_letE    [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Let e1 e2 \\<Down> v\"\ninductive_cases v_sem_letbE   [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> LetBang is e1 e2 \\<Down> v\"\ninductive_cases v_sem_takeE   [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Take e f e' \\<Down> v\"\ninductive_cases v_sem_conE    [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Con ts t e \\<Down> v\"\ninductive_cases v_sem_appE    [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> App e e' \\<Down> v\"\ninductive_cases v_sem_caseE   [elim]  : \" \\<xi> , \\<gamma> \\<turnstile> Case e t m nm \\<Down> v\"\ninductive_cases v_sem_ifE     [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> If c t e \\<Down> v\"\ninductive_cases v_sem_memberE [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Member e f \\<Down> v\"\ninductive_cases v_sem_putE    [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Put e f e' \\<Down> v\"\ninductive_cases v_sem_structE [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Struct fs ts \\<Down> v\"\ninductive_cases v_sem_tupleE  [elim!] : \" \\<xi> , \\<gamma> \\<turnstile> Tuple a b \\<Down> v\"\ninductive_cases v_sem_all_emptyE [elim!] : \" \\<xi> , \\<gamma> \\<turnstile>* [] \\<Down> v\"\ninductive_cases v_sem_all_consE  [elim!] : \" \\<xi> , \\<gamma> \\<turnstile>* x # xs \\<Down> v\"\n\nlemma u_v_p_rec_w':\nassumes \"\\<Xi>, \\<sigma> \\<turnstile>* fs \\<sim> fs' :r ts \\<langle>r, w\\<rangle>\"\nand     \"\\<sigma> l = Some (URecord fs)\"\nand     \"l \\<notin> w \\<union> r\"\nand     \"rp = (RRecord (map (\\<lambda>(a,b). type_repr a) ts)) \"\nshows   \"\\<Xi>, \\<sigma> \\<turnstile> UPtr l rp \\<sim> VRecord fs' : TRecord ts Writable \\<langle> r, insert l w \\<rangle>\"\nusing assms by (auto intro: u_v_p_rec_w)\n\ntheorem correspondence: \nassumes \"list_all2 (kinding []) \\<tau>s K\"\nand     \"proc_ctx_wellformed \\<Xi>\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches (instantiate_ctx \\<tau>s \\<Gamma>) \\<langle>r, w\\<rangle>\"\nand     \"\\<xi> \\<sim> \\<xi>' matches-u-v \\<Xi>\"\nshows   \"\\<lbrakk> \\<xi> , \\<gamma>  \\<turnstile> (\\<sigma>, specialise \\<tau>s e) \\<Down>! (\\<sigma>', v)\n         ; \\<xi>', \\<gamma>' \\<turnstile>     specialise \\<tau>s e  \\<Down>       v'\n         ; \\<Xi>, K, \\<Gamma> \\<turnstile> e : \\<tau> \n         \\<rbrakk> \\<Longrightarrow> \\<exists>r' w'. (\\<Xi> , \\<sigma>' \\<turnstile> v \\<sim> v' : instantiate \\<tau>s \\<tau> \\<langle>r', w'\\<rangle>) \n                     \\<and> r' \\<subseteq> r \n                     \\<and> frame \\<sigma> w \\<sigma>' w'\"\nand     \"\\<lbrakk> \\<xi> , \\<gamma>  \\<turnstile>* (\\<sigma>, map (specialise \\<tau>s) es) \\<Down>! (\\<sigma>', vs)\n         ; \\<xi>', \\<gamma>' \\<turnstile>*     map (specialise \\<tau>s) es  \\<Down>       vs' \n         ; \\<Xi>, K, \\<Gamma> \\<turnstile>* es : \\<tau>s'\n         \\<rbrakk> \\<Longrightarrow> \\<exists>r' w'. (\\<Xi>, \\<sigma>' \\<turnstile>* vs \\<sim> vs' : map (instantiate \\<tau>s) \\<tau>s' \\<langle>r', w'\\<rangle>)\n                     \\<and> r' \\<subseteq> r\n                     \\<and> frame \\<sigma> w \\<sigma>' w'\"\nusing assms proof (induct \"(\\<sigma>, specialise \\<tau>s e)\"        \"(\\<sigma>', v )\" \n                      and \"(\\<sigma>, map (specialise \\<tau>s) es)\" \"(\\<sigma>', vs)\" \n                      arbitrary:  e  \\<tau>s K \\<tau>   \\<Gamma> r w v  \\<sigma>' \\<sigma> \\<gamma>' v'\n                             and  es \\<tau>s K \\<tau>s' \\<Gamma> r w vs \\<sigma>' \\<sigma> \\<gamma>' vs'\n                      rule: u_sem_u_sem_all.inducts) \n     case u_sem_var       then show ?case by ( cases e, simp_all\n                                             , fastforce elim!:  typing_varE\n                                                         dest!:  u_v_matches_proj\n                                                         intro:  frame_id)\nnext case u_sem_prim      then show ?case by ( cases e, simp_all\n                                             , auto      elim!:  typing_primE\n                                                         dest!:  u_sem_prim(2)\n                                                         intro!: exI u_v_map_tprim_no_pointers' \n                                                         intro:  eval_prim_u_v_corres\n                                                         dest:   u_v_map_tprim_no_pointers)\nnext case u_sem_lit       then show ?case by ( cases e, simp_all\n                                             , fastforce dest:   u_v_matches_proj_consumed\n                                                         intro!: upd_val_rel_upd_val_rel_record.intros\n                                                                 frame_id)\nnext case u_sem_fun       then show ?case by ( cases e, simp_all\n                                             , force elim!:  typing_funE\n                                                     dest:   typing_to_kinding u_v_matches_proj_consumed\n                                                     intro!: exI u_v_function_instantiate frame_id)\nnext case u_sem_afun      then show ?case apply (cases e, simp_all)\n                                          apply (fastforce elim!:  typing_afunE v_sem_afunE\n                                                           intro!: u_v_afun_instantiate frame_id\n                                                           dest:   u_v_matches_proj_consumed).\nnext case u_sem_promote   then show ?case by ( cases e, simp_all\n                                             , fastforce elim:   u_v_sumE typing_promE\n                                                         intro!: u_v_sum\n                                                         dest:   u_sem_promote(2)\n                                                         intro:  substitutivity(2)\n                                                                  [ where ts = \"map snd ls\" for ls\n                                                                  , simplified]\n                                                         simp:   list_all2_helper)\nnext case u_sem_app\n  note IH1  = this(2)\n  and  IH2  = this(4)\n  and  IH3  = this(6)\n  and  rest = this(1,3,5,7-)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (clarsimp elim!: typing_appE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(2) u_v_matches_split, clarsimp)\n    apply (erule v_sem_appE)\n   \n    apply (frule(6) IH1, clarsimp)\n    apply (erule upd_val_rel.cases, simp_all)\n\n    apply (frule(6) IH1, clarsimp)\n\n    apply (erule u_v_functionE)\n    apply (clarsimp)\n    apply (frule(8) IH2 [OF _ _ _ _ _  u_v_matches_frame, rotated -1])\n     apply (fastforce intro!: subset_helper dest: subset_helper2 subset_helper2')\n    apply (clarsimp elim!: u_v_functionE)\n    apply (frule(4) IH3 [OF refl, rotated -1])\n     apply (force intro!: u_v_matches.intros simp: instantiate_ctx_def)\n    apply (clarsimp, auto intro!: exI\n                          intro:  frame_trans subset_helper2'\n                          dest:   frame_app [where w' = \"{}\", simplified])\n  done\nnext case u_sem_abs_app\n  note IH1  = this(2)\n  and  IH2  = this(4)\n  and  rest = this(1,3,5-)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (clarsimp elim!: typing_appE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(2) u_v_matches_split, clarsimp)\n    apply (erule v_sem_appE)\n     apply (frule(6) IH1, clarsimp)\n     apply (frule(8) IH2 [OF _ _ _ _ _ u_v_matches_frame, rotated -1])\n      apply (fastforce intro!: subset_helper dest: subset_helper2 subset_helper2')\n     apply (clarsimp elim!: u_v_afunE)\n     apply (frule(5) proc_env_u_v_matches_abstract)\n     apply (clarsimp)\n     apply (intro exI conjI, force, blast)\n     apply (force intro: frame_trans subset_helper2' dest: frame_app [where w'=\"{}\",simplified])\n    apply (frule(6) IH1, clarsimp)\n    apply (erule upd_val_rel.cases,simp_all)\n  done\nnext case u_sem_con\n  note IH   = this(2)\n  and  rest = this(1,3-)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (clarsimp elim!: typing_conE)\n    apply (frule(5) IH,clarsimp)\n    apply (clarsimp)\n    apply (auto dest: imageI [where f = \"\\<lambda>(c, t). (c, instantiate \\<tau>s t)\"]\n                intro!: exI\n                        upd_val_rel_upd_val_rel_record.intros\n                        substitutivity(2) [where ts = \"map snd ls\" for ls, simplified]\n                 simp: list_all2_helper)\n  done\nnext case u_sem_let\n  note IH1  = this(2)\n  and  IH2  = this(4)\n  and  rest = this(1,3,5-)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (clarsimp elim!: typing_letE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(2) u_v_matches_split, clarsimp)\n    apply (frule(6) IH1, clarsimp)\n    apply (frule(5) IH2 [rotated -1], clarsimp)\n    apply (rule,force)\n        apply (force intro: u_v_matches_frame)\n       apply (force dest: frame_noalias_u_v_matches(1))\n      apply (force dest!: frame_noalias_u_v_matches(2))\n     apply (blast)\n    apply (fastforce intro: frame_let simp: Un_commute)\n  done\n\nnext case u_sem_letbang\n  note IH1  = this(2)\n  and  IH2  = this(4)\n  and  rest = this(1,3,5-)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (clarsimp elim!: typing_letbE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(2) u_v_matches_split_bang, clarsimp)\n    apply (frule(6) IH1, clarsimp)\n    apply (frule(3) u_v_escapable_no_readers(1) [OF _ _ substitutivity(1)], clarsimp)\n    apply (frule(5) IH2 [rotated -1], clarsimp)\n     apply (rule, force)\n        apply (force intro: u_v_matches_frame)\n       apply (rule frame_noalias_u_v_matches(1), simp+, blast)\n      apply (rule frame_noalias_u_v_matches(2), simp+, blast)\n     apply (simp)\n    apply (clarsimp)\n    apply (auto intro!: exI\n                simp:   Un_assoc\n                intro:  frame_let\n                intro:  pointerset_helper_frame [OF _ _ refl])\n  done\n\nnext case u_sem_unit      then show ?case by ( cases e, simp_all\n                                             , auto elim!:  typing_unitE\n                                                    intro!: exI\n                                                    dest!:  u_v_matches_proj_consumed\n                                                    intro:  frame_id\n                                                            upd_val_rel_upd_val_rel_record.intros)\n\nnext case u_sem_cast      then show ?case apply ( cases e, simp_all)\n                                          apply ( slowsimp intro!: u_v_prim'\n                                                           elim!:  typing_castE\n                                                                   upd_val_rel.cases\n                                                                   upcast_valid_cast_to).\n\nnext case u_sem_tuple\n  note IH1  = this(2)\n  and  IH2  = this(4)\n  and  rest = this(1,3,5-)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (clarsimp elim!: typing_tupleE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(2) u_v_matches_split, clarsimp)\n    apply (frule(6) IH1, clarsimp)\n    apply (frule(2) u_v_matches_frame, blast)\n    apply (frule(6) IH2, clarsimp)\n    apply (frule(1) frame_app)\n\n    apply (frule(2) frame_noalias_u_v_matches(2) [where u = \"w \\<union> w'\" for w and w'])\n    apply (frule(4) upd_val_rel_frame [rotated -1, OF _ _ frame_noalias_u_v_matches(1)], blast)\n    apply (frule(4) frame_noalias_2_uv)\n    apply (blast intro!: upd_val_rel_upd_val_rel_record.intros)\n  done\nnext case u_sem_esac      then show ?case by ( cases e, simp_all\n                                             , fastforce elim!: u_v_sumE)\nnext case u_sem_case_nm\n  note IH1 = this(2)\n  and  IH2 = this(5)\n  and rest = this(1,3-4,6-)\n  have HELP:\n  \"\\<forall> ts t. ([x\\<leftarrow>map (\\<lambda>(c, t). (c, instantiate \\<tau>s t)) ts . fst x \\<noteq> t]\n         = (map (\\<lambda>(c, t). (c, instantiate \\<tau>s t)) [x\\<leftarrow>ts . fst x \\<noteq> t]))\"\n    by (clarsimp, induct_tac ts, auto  split: prod.split)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (erule typing_caseE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(2) u_v_matches_split, clarsimp)\n    apply (erule v_sem_caseE)\n     apply (force dest!: IH1 elim: upd_val_rel.cases)\n    apply (frule(6) IH1)\n    apply (clarsimp)\n    apply (frule(2) frame_noalias_u_v_matches)\n    apply (frule(1) frame_noalias_u_v_matches(2), blast)\n    apply (frule(2) u_v_matches_frame, blast)\n    apply (frule(1) sum_downcast_u_v [rotated -1])\n    apply (frule(5) IH2 [rotated -1])\n     apply (simp, rule, simp add: HELP[rule_format], blast,blast,blast,blast)\n    apply (clarsimp, auto intro!: exI intro: frame_let simp: Un_commute)\n  done\nnext case u_sem_case_m \n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (erule typing_caseE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(2) u_v_matches_split, clarsimp)\n    apply (erule v_sem_caseE)\n     apply (frule(6) IH1,clarsimp)\n     apply (frule(2) frame_noalias_u_v_matches)\n     apply (frule(1) frame_noalias_u_v_matches(2), blast)\n     apply (frule(2) u_v_matches_frame, blast)\n     apply (erule u_v_sumE, clarsimp)\n      apply (drule(1) distinct_fst [rotated 1],simp,simp)\n     apply (frule(5) IH2 [rotated -1])\n      apply (force intro!: u_v_matches_some)\n     apply (clarsimp, force intro!: exI simp: Un_commute intro: frame_let)\n    apply (force dest!: IH1 elim: upd_val_rel.cases)\n  done\nnext case (u_sem_if _ _ _ _ _ b)\n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (frule u_v_matches_noalias)\n    apply (erule typing_ifE)\n    apply (frule(2) u_v_matches_split, clarsimp)\n    apply (frule(6) IH1, clarsimp)\n    apply (erule u_v_primE)\n    apply (clarsimp)\n    apply (frule(4) IH2 [ rotated 3\n                        , where e23 (* FIXME: unstable name *) = \"if b then e2 else e3\" for e2 and e3\n                        , OF _ _ u_v_matches_frame ])\n         apply (blast, simp)\n       apply (cases b, simp, simp)+\n    apply (fastforce intro: frame_let)\n  done\nnext case u_sem_struct    then show ?case by ( cases e, simp_all\n                                             , fastforce intro!: upd_val_rel_upd_val_rel_record.intros\n                                                         intro:  upd_val_rel_record\n                                                                 [where ts = \"map (instantiate \\<tau>s) ts\"\n                                                                    for ts, simplified])\nnext case u_sem_member\n then show ?case\n   apply ( cases e\n         , simp_all )\n   apply ( clarsimp elim!: typing_memberE)\n   apply ( frule(6) u_sem_member(2)\n         , clarsimp )\n   apply ( frule(1) u_v_shareable_not_writable\n         , fastforce elim!:  kind_trecE\n                     intro!: kind_trec\n                             substitutivity\n         , clarsimp elim!: u_v_recE)\n   apply ( auto dest!: upd_val_rel_record_nth\n         , fastforce )\n done\nnext case u_sem_memb_b\n then show ?case\n   apply ( cases e\n         , simp_all )\n   apply ( clarsimp elim!: typing_memberE)\n   apply ( frule(6) u_sem_memb_b(2)\n         , clarsimp )\n   apply ( frule(1) u_v_shareable_not_writable\n         , fastforce elim!:  kind_trecE\n                     intro!: kind_trec\n                             substitutivity\n         , clarsimp)\n   apply ( erule u_v_p_recE)\n   apply ( auto dest!: upd_val_rel_record_nth\n         , fastforce )\n done\nnext case (u_sem_take _ _ _ _ _ p)\n  note IH1  = this(2)\n  and  IH2  = this(5)\n  and  rest = this(1,3-4,6-)\n  have HELP: \"\\<forall> ts f \\<tau>. (f < length ts \\<and> (ts ! f = (\\<tau>, False)) \n          \\<longrightarrow> (map (\\<lambda>(t, y). (instantiate \\<tau>s t, y)) ts ! f = (instantiate \\<tau>s \\<tau>, False)))\"\n    apply (rule allI, induct_tac ts, simp)\n    apply (simp split: prod.split)\n    apply (clarsimp)\n    apply (case_tac f, simp, simp)\n  done\n  have HELP2: \"\\<forall> \\<tau>s. ((\\<lambda>(a, b). type_repr a) \\<circ> (\\<lambda>(t, y). (instantiate \\<tau>s t, y)))\n                   = (\\<lambda>(t,y). type_repr (instantiate \\<tau>s t))\"\n  by (force split: prod.split)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (erule typing_takeE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(2) u_v_matches_split,clarsimp)\n    apply (frule(6) IH1, clarsimp)\n    apply (erule u_v_p_recE, simp_all)\n    apply (frule(2) frame_noalias_u_v_matches)\n    apply (frule(1) frame_noalias_u_v_matches(2), blast)\n    apply (frule upd_val_rel_record_take [ where \\<tau>s = \"map (\\<lambda>(t, y). (instantiate \\<tau>s t, y)) ts\" for ts\n                                         , simplified\n                                         , OF _ HELP [rule_format]],\n           force, force intro: substitutivity, force)\n    apply (elim exE conjE)\n    apply (frule(2) u_v_matches_frame, blast)\n    apply (simp, erule disjE)\n     apply (clarsimp)\n     apply (frule(3) u_v_shareable_not_writable(1) [OF _ _ substitutivity(1)], clarsimp)\n     apply (frule(5) IH2 [rotated -1], simp)\n      apply (case_tac taken)\n       apply (rule u_v_matches_some [OF _ u_v_matches_some])\n               apply (simp)\n              apply (force intro!: u_v_p_rec_w' simp: HELP2 map_update intro: list_helper [symmetric])\n             apply (simp)\n            apply (blast)\n           apply (blast)\n          apply (blast)\n         apply (blast)\n        apply (blast)\n       apply (blast)\n      apply (clarsimp)\n      apply (rule u_v_pointerset_helper_matches)\n        apply (rule u_v_matches_some [OF _ u_v_matches_some])\n                apply (simp)\n               apply (force intro!: u_v_p_rec_w' simp: list_helper HELP2 map_update intro: list_helper [symmetric])\n              apply (simp)\n             apply (blast)\n            apply (blast)\n           apply (blast)\n          apply (blast)\n         apply (blast)\n        apply (blast)\n       apply (blast)\n      apply (blast)\n     apply (clarsimp, intro exI conjI, simp, blast, force simp: Un_commute intro: frame_let)\n    apply (clarsimp)\n    apply (frule(5) IH2 [rotated -1], simp)\n     apply (rule u_v_matches_some [OF _ u_v_matches_some])\n             apply (simp)\n            apply (force intro!: u_v_p_rec_w' simp: list_helper HELP2 map_update intro: list_helper [symmetric])\n           apply (simp)\n          apply (blast)\n         apply (blast)\n        apply (blast)\n       apply (blast)\n      apply (blast)\n     apply (blast)\n    apply (clarsimp, auto intro!: exI intro: frame_let pointerset_helper_frame)\n  done    \nnext case u_sem_take_ub\n  note IH1  = this(2)\n  and  IH2  = this(4)\n  and  rest = this(1,3,5-)\n  have HELP: \"\\<forall> ts f \\<tau>. (f < length ts \\<and> (ts ! f = (\\<tau>, False)) \n          \\<longrightarrow> (map (\\<lambda>(t, y). (instantiate \\<tau>s t, y)) ts ! f = (instantiate \\<tau>s \\<tau>, False)))\"\n    apply (rule allI, induct_tac ts, simp)\n    apply (simp split: prod.split)\n    apply (clarsimp)\n    apply (case_tac f, simp, simp)\n  done\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (erule typing_takeE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(2) u_v_matches_split,clarsimp)\n    apply (frule(6) IH1, clarsimp)\n    apply (erule u_v_recE, simp_all)\n    apply (frule(2) frame_noalias_u_v_matches)\n    apply (frule(1) frame_noalias_u_v_matches(2), blast)\n    apply (clarsimp)\n    apply (frule upd_val_rel_record_take [ where \\<tau>s = \"map (\\<lambda>(t, y). (instantiate \\<tau>s t, y)) ts\" for ts\n                                         , simplified\n                                         , OF _ HELP [rule_format]], force, force intro: substitutivity, force)\n    apply (elim exE conjE)\n    apply (frule(2) u_v_matches_frame, blast)\n    apply (simp, erule disjE)\n     apply (clarsimp)\n     apply (frule(3) u_v_shareable_not_writable(1) [OF _ _ substitutivity(1)], clarsimp)\n     apply (frule(5) IH2 [rotated -1], simp)\n      apply (case_tac taken)\n       apply (rule u_v_matches_some [OF _ u_v_matches_some])\n               apply (simp)\n              apply (force intro!: u_v_struct simp: map_update)\n             apply (simp)\n            apply (blast) \n           apply (blast)\n          apply (blast)\n         apply (blast) \n        apply (blast) \n       apply (blast)\n      apply (clarsimp) \n      apply (rule u_v_pointerset_helper_matches)\n        apply (rule u_v_matches_some [OF _ u_v_matches_some])\n                apply (simp)\n               apply (force intro!: u_v_struct simp: list_helper)\n              apply (simp)\n             apply (blast) \n            apply (blast)\n           apply (blast) \n          apply (blast)\n         apply (blast) \n        apply (blast)\n       apply (blast) \n      apply (blast)\n     apply (clarsimp, intro exI conjI, simp, blast, force simp: Un_commute intro: frame_let) \n    apply (clarsimp)\n    apply (frule(5) IH2 [rotated -1], simp)\n     apply (rule u_v_matches_some [OF _ u_v_matches_some])\n             apply (simp)\n            apply (fastforce intro!: u_v_struct simp: map_update)\n           apply (simp)\n          apply (blast) \n         apply (blast)\n        apply (blast) \n       apply (blast)\n      apply (blast) \n     apply (blast)\n    apply (clarsimp, auto intro!: exI intro: frame_let pointerset_helper_frame) \n  done    \n\nnext case u_sem_put\n  note IH1  = this(2)\n  and  IH2  = this(5)\n  and  rest = this(1,3-4,6-)\n  have HELP: \"\\<forall> ts f \\<tau> taken. (f < length ts \\<longrightarrow> (ts ! f = (\\<tau>, taken) \n              \\<longrightarrow> (map (\\<lambda>(t, y). (instantiate \\<tau>s t, y)) ts ! f = (instantiate \\<tau>s \\<tau>, taken))))\"\n    apply (rule allI, induct_tac ts, simp)\n    apply (simp split: prod.split)\n    apply (clarsimp)\n    apply (case_tac f, simp, simp)\n  done\n  have HELP2: \"\\<forall> \\<tau>s. ((\\<lambda>(a, b). type_repr a) \\<circ> (\\<lambda>(t, y). (instantiate \\<tau>s t, y)))\n                   = (\\<lambda>(t,y). type_repr (instantiate \\<tau>s t))\"\n  by (force split: prod.split)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (erule typing_putE) \n    apply (frule u_v_matches_noalias)\n    apply (clarsimp)\n    apply (frule(2) u_v_matches_split,clarsimp)\n    apply (frule(6) IH1, clarsimp)\n    apply (frule(2) u_v_matches_frame,blast )\n    apply (frule(2) frame_noalias_u_v_matches)\n    apply (frule(1) frame_noalias_u_v_matches(2), blast)\n    apply (frule(6) IH2, clarsimp)\n    apply (frule(1) frame_noalias_upd_val_rel, blast)\n    apply (frule(1) frame_noalias_upd_val_rel(2), blast)\n    apply (erule u_v_p_recE, simp,clarsimp)\n    apply (drule(1) frame_app)\n    apply (drule(2) upd_val_rel_frame(2) [rotated -1], blast)\n    apply (drule(1) upd_val_rel_frame(1) [OF frame_single_update, simplified, rotated -1], blast)\n    apply (drule(2) upd_val_rel_frame(2) [OF frame_single_update, simplified, rotated -1])\n\n    apply (frule(5) upd_val_rel_record_put [ where ts = \"map (\\<lambda>(t, y). (instantiate \\<tau>s t, y)) ts\" for ts\n                                           , OF _ _ HELP [rule_format]\n                                           , simplified\n                                           ])\n        apply (fast) \n       apply (fast) \n      apply (fast) \n     apply (fastforce intro: substitutivity) \n    apply (clarsimp, intro conjI exI, rule u_v_p_rec_w')\n    apply (simp add: map_update)\n    apply (auto intro!: list_helper[symmetric] simp: HELP2 map_update frame_def)\n  done\nnext case u_sem_put_ub\n  note IH1  = this(2) \n  and  IH2  = this(4) \n  and  rest = this(1,3,5-) \n  have HELP: \"\\<forall> ts f \\<tau> taken. (f < length ts \\<longrightarrow> (ts ! f = (\\<tau>, taken) \n              \\<longrightarrow> (map (\\<lambda>(t, y). (instantiate \\<tau>s t, y)) ts ! f = (instantiate \\<tau>s \\<tau>, taken))))\" \n    apply (rule allI, induct_tac ts, simp) \n    apply (simp split: prod.split) \n    apply (clarsimp) \n    apply (case_tac f, simp, simp)\n  done \n  from rest show ?case\n    apply (cases e, simp_all) \n    apply (erule typing_putE)\n    apply (frule u_v_matches_noalias)\n    apply (clarsimp)\n    apply (frule(2) u_v_matches_split,clarsimp)\n    apply (frule(6) IH1, clarsimp)\n    apply (frule(2) u_v_matches_frame,blast )\n    apply (frule(2) frame_noalias_u_v_matches)\n    apply (frule(1) frame_noalias_u_v_matches(2), blast)\n    apply (frule(6) IH2, clarsimp)\n    apply (frule(1) frame_noalias_upd_val_rel, blast)\n    apply (frule(1) frame_noalias_upd_val_rel(2), blast)\n    apply (erule u_v_recE, simp,clarsimp)\n    apply (drule(1) frame_app)\n    apply (drule(2) upd_val_rel_frame(2) [rotated -1], blast)\n\n    apply (frule(5) upd_val_rel_record_put [ where ts = \"map (\\<lambda>(t, y). (instantiate \\<tau>s t, y)) ts\" for ts\n                                           , OF _ _ HELP [rule_format]\n                                           , simplified\n                                           ])\n        apply (fast) \n       apply (fast)\n      apply (fast) \n     apply (fastforce intro: substitutivity) \n    apply (clarsimp, auto intro!: exI u_v_struct simp: map_update frame_def) \n  done\nnext case u_sem_split\n  note IH1  = this(2)\n  and  IH2  = this(4)\n  and  rest = this(1,3,5-)\n  from rest show ?case\n    apply (cases e, simp_all)\n    apply (erule typing_splitE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(2) u_v_matches_split,clarsimp)\n    apply (frule(6) IH1, clarsimp)\n    apply (erule u_v_productE)\n    apply (frule(2) frame_noalias_u_v_matches)\n    apply (frule(1) frame_noalias_u_v_matches(2), blast)\n    apply (frule(4) IH2)\n      apply (simp)\n      apply (rule u_v_matches_some, simp, rule u_v_matches_some, simp)\n            apply (rule u_v_matches_frame, simp, simp)\n             apply (blast)\n            apply (blast)\n           apply (blast)\n          apply (blast)\n         apply (blast)\n        apply (blast)\n       apply (blast)\n      apply (blast)\n     apply (blast)\n    apply (clarsimp, auto intro!: exI intro: frame_let pointerset_helper_frame)\n  done\nnext case u_sem_all_empty then show ?case by ( cases es, simp_all\n                                             , fastforce intro!: frame_id\n                                                                 upd_val_rel_all.intros\n                                                         dest: u_v_matches_empty_env(2))\nnext case u_sem_all_cons\n  note IH1  = this(2)\n  and  IH2  = this(4)\n  and  rest = this(1,3,5-)\n  from rest show ?case\n    apply (cases es, simp_all)\n    apply (erule typing_all_consE, clarsimp)\n    apply (frule(2) u_v_matches_split, clarsimp)\n    apply (frule(6) IH1, clarsimp)\n    apply (frule u_v_matches_noalias)\n    apply (frule(8) IH2 [OF _ _ _ _ _ u_v_matches_frame, rotated -1], blast, clarsimp)\n    apply (frule(1) frame_app)\n    apply (frule(2) frame_noalias_u_v_matches(2) [where u = \"w \\<union> w'\" for w and w'])\n    apply (frule(4) upd_val_rel_frame [rotated -1, OF _ _ frame_noalias_u_v_matches(1)], blast)\n    apply (frule(4) frame_noalias_2_uv)\n    apply (blast intro!: upd_val_rel_all.intros)\n  done\n      \n\nqed\nlemmas mono_correspondence = correspondence [where \\<tau>s = \"[]\" and K = \"[]\", simplified]\n\nlemma val_executes_from_upd_executes:\nassumes \"proc_ctx_wellformed \\<Xi>\"\nand     \"\\<Xi>, \\<sigma> \\<turnstile> \\<gamma> \\<sim> \\<gamma>' matches \\<Gamma> \\<langle>r, w\\<rangle>\"\nand     \"\\<xi> \\<sim> \\<xi>' matches-u-v \\<Xi>\"\nshows   \"\\<lbrakk> \\<xi> , \\<gamma>  \\<turnstile> (\\<sigma>, e) \\<Down>! (\\<sigma>', v)\n         ; \\<Xi>, [], \\<Gamma> \\<turnstile> e : \\<tau> \n         \\<rbrakk> \\<Longrightarrow> \\<exists>v'. \\<xi>', \\<gamma>' \\<turnstile> e \\<Down> v'\"\nand     \"\\<lbrakk> \\<xi> , \\<gamma>  \\<turnstile>* (\\<sigma>, es) \\<Down>! (\\<sigma>', vs)\n         ; \\<Xi>, [], \\<Gamma> \\<turnstile>* es : \\<tau>s'\n         \\<rbrakk> \\<Longrightarrow> \\<exists>vs'. \\<xi>', \\<gamma>' \\<turnstile>* es \\<Down> vs' \"\n  using assms proof (induct \"(\\<sigma>,e)\" \"(\\<sigma>',v)\"\n    and \"(\\<sigma>,es)\" \"(\\<sigma>', vs)\" arbitrary: \\<Gamma> r w \\<sigma> e v \\<tau> \\<sigma>' \\<gamma>' and \\<Gamma> r w  \\<sigma> es vs \\<tau>s' \\<sigma>'  \\<gamma>'\n    rule: u_sem_u_sem_all.inducts)\n     case u_sem_cast\n  note IH   = this(2)\n  and  rest = this(1,3-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_castE)\n    apply (frule(3) IH, clarsimp)\n    apply (frule(2) mono_correspondence)\n    apply (auto elim: upd_val_rel.cases intro!: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_app\n  note IH1 = this(2)\n   and IH2 = this(4)\n   and IH3 = this(6)\n   and rest = this(1,3,5,7-) \n  from rest show ?case\n    apply (clarsimp elim!: typing_appE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split', clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (drule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(5) IH2 [OF _ _ u_v_matches_frame, rotated -1], blast, clarsimp)\n    apply (drule(4) mono_correspondence [rotated -1, OF _ _ u_v_matches_frame],blast,simp,simp,simp)\n    apply (clarsimp)\n    apply (erule upd_val_rel.cases [where ?a5.0=\"TFun xa \\<tau>\" for xa \\<tau>], simp_all)\n    apply (clarsimp)\n    apply (drule(1) specialisation)\n    apply (frule(1) IH3 [OF _ _ u_v_matches_frame])\n    apply (simp,rule u_v_matches_some)\n    apply (simp)\n    apply (auto simp: instantiate_ctx_def intro!: u_v_matches.intros frame_id v_sem_v_sem_all.intros)\n    done\nnext case (u_sem_abs_app _ _ _ _ _ f)\n  note IH1 = this(2)\n   and IH2 = this(4)\n   and rest = this(1,3,5-) \n  from rest show ?case\n    apply (clarsimp elim!: typing_appE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split', clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (drule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(5) IH2 [OF _ _ u_v_matches_frame, rotated -1], blast, clarsimp)\n    apply (drule(4) mono_correspondence [rotated -1, OF _ _ u_v_matches_frame],blast,simp,simp,simp)\n    apply (clarsimp)\n    apply (erule upd_val_rel.cases [where ?a5.0=\"TFun xa \\<tau>\" for xa \\<tau>], simp_all)\n    apply (clarsimp)\n    apply (simp add: proc_env_u_v_matches_def)\n    apply (drule_tac x = f in spec)\n    apply (clarsimp)\n    apply (elim allE impE, simp+)\n    apply (clarsimp)\n    apply (rule,erule(2) v_sem_abs_app)\n  done \nnext case u_sem_con then show ?case by (force intro!: v_sem_v_sem_all.intros)\nnext case u_sem_member\n  note IH = this(2)\n  and rest = this(1,3-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_memberE)\n    apply (frule(3) IH, clarsimp)\n    apply (frule(5) mono_correspondence, clarsimp)\n    apply (force elim: upd_val_rel.cases intro!: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_promote\n  note IH = this(2)\n  and rest = this(1,3-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_promE)\n    apply (frule(3) IH, clarsimp)\n    apply (frule(5) mono_correspondence, clarsimp)\n    apply (force elim: upd_val_rel.cases intro!: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_memb_b\n  note IH = this(2)\n  and rest = this(1,3-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_memberE)\n    apply (frule(3) IH, clarsimp)\n    apply (frule(5) mono_correspondence, clarsimp)\n    apply (force elim: upd_val_rel.cases intro!: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_esac\n  note IH = this(2)\n  and rest = this(1,3-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_esacE)\n    apply (frule(3) IH, clarsimp)\n    apply (frule(5) mono_correspondence, clarsimp)\n    apply (force elim: upd_val_rel.cases intro!: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_let\n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_letE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split', clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (drule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(1) IH2)\n    apply (rule)\n    apply (simp)\n    apply (erule(2) u_v_matches_frame,blast)\n    apply (erule(2) frame_noalias_u_v_matches)\n    apply (erule(1) frame_noalias_u_v_matches(2),blast)\n    apply (auto simp: instantiate_ctx_def intro!: u_v_matches.intros frame_id v_sem_v_sem_all.intros)\n  done\nnext case u_sem_letbang \n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_letbE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split_bang', clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (drule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(2) u_v_escapable_no_readers(1), clarsimp)\n    apply (frule(1) IH2)\n    apply (rule)\n    apply (simp)\n    apply (erule(1) u_v_matches_frame,blast, blast)\n    apply (erule(1) frame_noalias_u_v_matches,blast)\n    apply (erule(1) frame_noalias_u_v_matches(2),blast)\n    apply (auto simp: instantiate_ctx_def intro!: u_v_matches.intros frame_id v_sem_v_sem_all.intros)\n  done\n  \nnext case u_sem_tuple\n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_tupleE)\n    apply (frule(1) u_v_matches_split',clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (drule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(5) IH2 [OF _ _ u_v_matches_frame,rotated -1],force dest!: u_v_matches_noalias)\n    apply (force intro: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_if \n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_ifE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split',clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (frule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(2) u_v_matches_frame, blast)\n    apply (erule upd_val_rel.cases, simp_all)\n    apply (drule_tac t = \"l\" in sym)\n    apply (clarsimp)\n    apply (frule(2) IH2 [rotated 1], force simp add: split_if)\n    apply (force intro: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_split\n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_splitE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split', clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (frule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(2) u_v_matches_frame,blast)\n    apply (erule upd_val_rel.cases, simp_all)\n    apply (clarsimp)\n    apply (frule(2) IH2 [rotated -1])\n    apply (erule(2) u_v_matches_some [OF _ u_v_matches_some])\n    apply (frule(2) frame_noalias_u_v_matches,blast)\n    apply (frule(1) frame_noalias_u_v_matches(2),blast,blast)\n    apply (blast)\n    apply (frule(2) frame_noalias_u_v_matches,blast)\n    apply (frule(1) frame_noalias_u_v_matches(2),blast,blast)\n    apply (blast)\n    apply (force intro: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_case_m\n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_caseE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split',clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (frule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(2) u_v_matches_frame, blast)\n    apply (erule upd_val_rel.cases, simp_all)\n    apply (clarsimp)\n    apply (frule(2) IH2 [rotated -1])\n    apply (drule(1) distinct_fst [rotated 1],simp)\n    apply (simp)\n    apply (erule(1) u_v_matches_some)\n    apply (erule(2) frame_noalias_u_v_matches)\n    apply (erule(1) frame_noalias_u_v_matches(2),blast)\n    apply (blast)\n    apply (force intro: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_case_nm \n  note IH1 = this(2)\n  and  IH2 = this(5)\n  and rest = this(1,3-4,6-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_caseE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split',clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (frule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(2) u_v_matches_frame, blast)\n    apply (erule upd_val_rel.cases, simp_all)\n    apply (clarsimp)\n    apply (frule(2) IH2 [rotated -1])\n    apply (rule u_v_matches_some)\n    apply (rule sum_downcast_u_v)\n    apply (rule)\n    apply (simp,simp,simp,force,simp,simp,simp)\n    apply (simp)\n    apply (erule(2) frame_noalias_u_v_matches)\n    apply (erule(1) frame_noalias_u_v_matches(2),blast)\n    apply (blast)\n    apply (force intro: v_sem_v_sem_all.intros)\n  done \nnext case u_sem_take\n  note IH1 = this(2)\n  and  IH2 = this(5)\n  and rest = this(1,3-4,6-)\n  have HELP [rule_format] :\n    \"\\<forall> tsa f t x y. tsa ! f = (t,y) \\<longrightarrow> map (\\<lambda>(a, b). type_repr a) tsa = map (\\<lambda>(a, b). type_repr a) (tsa[f := (t, x)])\"\n    apply (rule allI)\n    apply (induct_tac tsa)\n    apply (auto split: nat.split) \n  done\n  from rest show ?case\n    apply (clarsimp elim!: typing_takeE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split', clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (frule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(2) u_v_matches_frame, blast)\n    apply (frule(2) frame_noalias_u_v_matches)\n    apply (frule(1) frame_noalias_u_v_matches(2),blast)\n    apply (erule upd_val_rel.cases, simp_all, clarsimp)\n    apply (frule(1) upd_val_rel_record_take, force, force)\n    apply (elim exE conjE)\n    apply (frule(2) IH2 [rotated -1])\n     apply (case_tac \"taken\")\n      apply (clarsimp)\n      apply (rule u_v_pointerset_helper_matches)\n        apply (rule u_v_matches_some, simp, rule u_v_matches_some)\n               apply (fastforce intro!: u_v_p_rec_w' simp:HELP)\n              apply (simp)\n             apply (blast) (* go get a cup of tea *)\n            apply (blast)\n           apply (blast)\n          apply (blast)\n         apply (fastforce)\n        apply (fastforce)\n       apply (simp)\n      apply (simp)\n     apply (clarsimp)\n     apply (frule(2) u_v_shareable_not_writable, clarsimp)\n     apply (rule u_v_pointerset_helper_matches)\n       apply (rule u_v_matches_some, simp, rule u_v_matches_some)\n              apply (force intro!: u_v_p_rec_w' simp: list_helper simp: HELP)\n             apply (simp)\n            apply (blast)\n           apply (blast)\n          apply (blast)\n         apply (blast)\n        apply (blast)\n       apply (blast)\n      apply (blast)\n     apply (blast)\n    apply (force intro: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_take_ub \n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  have HELP [rule_format] :\n    \"\\<forall> tsa f t x y. tsa ! f = (t,y) \\<longrightarrow> map (\\<lambda>(a, b). type_repr a) tsa = map (\\<lambda>(a, b). type_repr a) (tsa[f := (t, x)])\"\n    apply (rule allI)\n    apply (induct_tac tsa)\n    apply (auto split: nat.split) \n  done\n  from rest show ?case\n    apply (clarsimp elim!: typing_takeE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split', clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (frule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(2) u_v_matches_frame, blast)\n    apply (frule(2) frame_noalias_u_v_matches)\n    apply (frule(1) frame_noalias_u_v_matches(2),blast)\n    apply (erule upd_val_rel.cases, simp_all, clarsimp)\n    apply (frule(1) upd_val_rel_record_take, force, force)\n    apply (elim exE conjE)\n    apply (frule(2) IH2 [rotated -1])\n     apply (case_tac \"taken\")\n      apply (clarsimp)\n      apply (rule u_v_pointerset_helper_matches)\n        apply (rule u_v_matches_some, simp, rule u_v_matches_some)\n               apply (fastforce intro!: u_v_struct simp:HELP)\n              apply (simp)\n             apply (blast) (* go get a cup of tea *)\n            apply (blast)\n           apply (blast)\n          apply (blast)\n         apply (fastforce)\n        apply (fastforce)\n       apply (simp)\n      apply (simp)\n     apply (clarsimp)\n     apply (frule(2) u_v_shareable_not_writable, clarsimp)\n     apply (rule u_v_pointerset_helper_matches)\n       apply (rule u_v_matches_some, simp, rule u_v_matches_some)\n              apply (force intro!: u_v_struct simp: list_helper simp: HELP)\n             apply (simp)\n            apply (blast)\n           apply (blast)\n          apply (blast)\n         apply (blast)\n        apply (blast)\n       apply (blast)\n      apply (blast)\n     apply (blast)\n    apply (force intro: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_put\n  note IH1 = this(2)\n  and  IH2 = this(5)\n  and rest = this(1,3-4,6-)\n  from rest show ?case \n    apply (clarsimp elim!: typing_putE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split',clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (drule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(5) IH2 [OF _ _ u_v_matches_frame,rotated -1],force)\n    apply (erule upd_val_rel.cases,simp_all)\n    apply (force intro: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_put_ub\n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  from rest show ?case \n    apply (clarsimp elim!: typing_putE)\n    apply (frule u_v_matches_noalias)\n    apply (frule(1) u_v_matches_split',clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (drule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(5) IH2 [OF _ _ u_v_matches_frame,rotated -1],force)\n    apply (erule upd_val_rel.cases,simp_all)\n    apply (force intro: v_sem_v_sem_all.intros)\n  done\nnext case u_sem_all_cons\n  note IH1 = this(2)\n  and  IH2 = this(4)\n  and rest = this(1,3,5-)\n  from rest show ?case\n    apply (clarsimp elim!: typing_all_consE)\n    apply (frule(1) u_v_matches_split',clarsimp)\n    apply (frule(3) IH1, clarsimp)\n    apply (drule(5) mono_correspondence [rotated -1], clarsimp)\n    apply (frule(5) IH2 [OF _ _ u_v_matches_frame,rotated -1],force dest!: u_v_matches_noalias)\n    apply (force intro: v_sem_v_sem_all.intros)\n  done\nqed (force intro!: v_sem_v_sem_all.intros)+ \n\nend\n\nend\n\n", "meta": {"author": "crizkallah", "repo": "cogent", "sha": "cb16e8169d4389e32dc4aecf4eb9f57173264006", "save_path": "github-repos/isabelle/crizkallah-cogent", "path": "github-repos/isabelle/crizkallah-cogent/cogent-cb16e8169d4389e32dc4aecf4eb9f57173264006/cogent/isa/Correspondence.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.6297746074044134, "lm_q2_score": 0.476579651063676, "lm_q1q2_score": 0.30013776264555886}}
{"text": "theory Examples\n  imports \"../SimAsm_Syntax\"\nbegin\n\n\n\nlemma [simp]:\n  \"tag (\\<lfloor>v\\<^sub>1,\\<alpha>,f\\<rfloor>) = (\\<alpha>,f)\"\n  by (auto simp: liftg_def)\n\nlemma [simp]:\n  \"{(m, m'). m' = f m} O {(m, m'). m' = b m} = \n   {(m, m'). m' = b (f m)}\"\n  by auto\n\nlemma [simp]:\n  \"st (m(aux: f)) = st m\"\n  by (auto simp: aux_upd_def)\n\nlemma state_eq [intro]:\n  \"rg m = rg m' \\<Longrightarrow> \\<forall>x. st m (Glb x) = st m' (Glb x) \\<Longrightarrow> state_rec.more m = state_rec.more m' \\<Longrightarrow> m = m'\"\n  apply (rule state_rec.equality)\n  apply (auto simp: rg_def)\nproof -\nassume a1: \"(\\<lambda>v. st m (Reg v)) = (\\<lambda>v. st m' (Reg v))\"\n  assume a2: \"\\<forall>x. st m (Glb x) = st m' (Glb x)\"\n  assume \"state_rec.more m = state_rec.more m'\"\n  have \"\\<forall>v. st m v = st m' v\"\nusing a2 a1 by (metis (no_types) var.exhaust)\n  then show \"st m = st m'\"\n    by blast\nqed\n\nlemma wp_split:\n  assumes wf: \"transitive R\" \"reflexive R\" \n  assumes re: \"reorder_inst \\<alpha>' (\\<lfloor>UNIV,\\<beta>,f\\<^sub>1\\<rfloor>) (\\<lfloor>UNIV,\\<alpha>,f\\<^sub>2\\<rfloor>)\"\n  assumes \\<alpha>: \"\\<forall>m\\<^sub>1 m\\<^sub>2 m\\<^sub>3. (m\\<^sub>1,m\\<^sub>2) \\<in> beh \\<alpha>' \\<longrightarrow> (m\\<^sub>2,m\\<^sub>3) \\<in> step\\<^sub>t R \\<longrightarrow> ((m\\<^sub>1,f m\\<^sub>1 m\\<^sub>3) \\<in> step\\<^sub>t R \\<and> (f m\\<^sub>1 m\\<^sub>3,f m\\<^sub>2 m\\<^sub>3) \\<in> beh \\<alpha>')\"\n  assumes \\<beta>: \"\\<forall>m\\<^sub>1 m\\<^sub>2 m\\<^sub>3. (m\\<^sub>1,m\\<^sub>2) \\<in> step\\<^sub>t R \\<longrightarrow> (m\\<^sub>2,m\\<^sub>3) \\<in> beh (\\<lfloor>UNIV,\\<beta>,f\\<^sub>1\\<rfloor>) \\<longrightarrow> ((f m\\<^sub>1 m\\<^sub>2, f m\\<^sub>1 m\\<^sub>3) \\<in> beh (\\<lfloor>UNIV,\\<beta>,f\\<^sub>1\\<rfloor>) \\<and> (f m\\<^sub>1 m\\<^sub>3,m\\<^sub>3) \\<in> step\\<^sub>t R)\"\n  assumes e: \"\\<forall>m\\<^sub>1 m\\<^sub>2 m\\<^sub>3. (m\\<^sub>1,m\\<^sub>2) \\<in> beh \\<alpha>' \\<longrightarrow> (m\\<^sub>2,m\\<^sub>3) \\<in> beh (\\<lfloor>UNIV,\\<beta>,f\\<^sub>1\\<rfloor>) \\<longrightarrow> ((m\\<^sub>1,f m\\<^sub>1 m\\<^sub>3) \\<in> beh (\\<lfloor>UNIV,\\<beta>,f\\<^sub>1\\<rfloor>) \\<and> (f m\\<^sub>1 m\\<^sub>3,m\\<^sub>3) \\<in> beh (\\<lfloor>UNIV,\\<alpha>,f\\<^sub>2\\<rfloor>))\"\n  shows \"stabilize R (wp\\<^sub>\\<alpha> (\\<lfloor>UNIV,\\<beta>,f\\<^sub>1\\<rfloor>) (stabilize R (wp\\<^sub>\\<alpha> (\\<lfloor>UNIV,\\<alpha>,f\\<^sub>2\\<rfloor>) (stabilize R Q)))) \\<subseteq> \n         stabilize R (wp\\<^sub>\\<alpha> \\<alpha>' (stabilize R (wp\\<^sub>\\<alpha> (\\<lfloor>UNIV,\\<beta>,f\\<^sub>1\\<rfloor>) (stabilize R Q))))\"\n  unfolding stabilize_def wp_def\nproof (clarsimp, intro conjI impI allI, goal_cases)\n  case (1 m\\<^sub>1 m\\<^sub>2)\n  have \"vc \\<alpha>' = UNIV\" using assms by (auto simp: liftg_def)\n  then show ?case by auto\nnext\n  case (2 m\\<^sub>1 m\\<^sub>2 m\\<^sub>3 m\\<^sub>4)\n  then show ?case by (auto simp: liftg_def)\nnext\n  case (3 m\\<^sub>1 m\\<^sub>2 m\\<^sub>3 m\\<^sub>4 m\\<^sub>5 m\\<^sub>6)\n  let ?R = \"\\<lambda>(m\\<^sub>1,m\\<^sub>2). (glb m\\<^sub>1, glb m\\<^sub>2) \\<in> R \\<and> rg m\\<^sub>1 = rg m\\<^sub>2\"\n\n  have a: \"?R (m\\<^sub>1, f m\\<^sub>2 m\\<^sub>4) \\<and> (f m\\<^sub>2 m\\<^sub>4,f m\\<^sub>3 m\\<^sub>4) \\<in> beh \\<alpha>'\"\n  proof -\n    have \"?R (m\\<^sub>1, m\\<^sub>2)\" using 3 by auto\n    moreover have \"?R (m\\<^sub>2,f m\\<^sub>2 m\\<^sub>4) \\<and> (f m\\<^sub>2 m\\<^sub>4,f m\\<^sub>3 m\\<^sub>4) \\<in> beh \\<alpha>'\" \n      using \\<alpha> 3 unfolding step\\<^sub>t_def by blast\n    ultimately show ?thesis using assms(1) unfolding transitive_def by auto\n  qed\n  have b: \"(f m\\<^sub>3 m\\<^sub>4,f m\\<^sub>3 m\\<^sub>5) \\<in> beh (\\<lfloor>UNIV,\\<beta>,f\\<^sub>1\\<rfloor>) \\<and> ?R (f m\\<^sub>3 m\\<^sub>5, m\\<^sub>6)\"\n  proof -\n    have \"?R (m\\<^sub>5, m\\<^sub>6)\" using 3 by auto\n    moreover have \"(f m\\<^sub>3 m\\<^sub>4,f m\\<^sub>3 m\\<^sub>5) \\<in> beh (\\<lfloor>UNIV,\\<beta>,f\\<^sub>1\\<rfloor>) \\<and> ?R (f m\\<^sub>3 m\\<^sub>5, m\\<^sub>5)\"\n      using \\<beta> 3 unfolding step\\<^sub>t_def by simp\n    ultimately show ?thesis using assms(1) unfolding transitive_def by auto\n  qed\n  have r: \"\\<forall>m. ?R (m,m)\"\n    using assms(2) unfolding reflexive_def by simp\n  have \"(f m\\<^sub>2 m\\<^sub>4,f (f m\\<^sub>2 m\\<^sub>4) (f m\\<^sub>3 m\\<^sub>5)) \\<in> beh (\\<lfloor>UNIV,\\<beta>,f\\<^sub>1\\<rfloor>) \\<and> (f (f m\\<^sub>2 m\\<^sub>4) (f m\\<^sub>3 m\\<^sub>5),(f m\\<^sub>3 m\\<^sub>5)) \\<in> beh (\\<lfloor>UNIV,\\<alpha>,f\\<^sub>2\\<rfloor>)\"\n    using e a b by blast\n\n  thus ?case using 3(1,3) a b r by fastforce\nqed\n\nlemma chke_nil_esc' [simp]:\n  \"chke (\\<beta>, {}) (\\<lfloor>v,\\<alpha>,f\\<rfloor>) R G = chk \\<beta>  (\\<lfloor>v,\\<alpha>,f\\<rfloor>) R G\"\nproof -\n  have \"escape {} (\\<lfloor>v,\\<alpha>,f\\<rfloor>) = { (\\<lfloor>v,\\<alpha>,f\\<rfloor>) } \" by (cases \\<alpha>; auto simp: liftg_def escape_def) \n  thus ?thesis by (auto simp: chke_def)\nqed\n\nlemma a [simp]:\n  \"{(m, m'). m' = m(x :=\\<^sub>s e m)} O {(m, m'). m' = m(aux: f\\<^sub>2)} = \n   {(m, m'). m' = m(x :=\\<^sub>s e m, aux: f\\<^sub>2)}\"\n  by auto\n\nlemma rg_aux[simp]:\n  \"rg (m(aux: f)) = rg m\"\n  by (auto simp: rg_def aux_upd_def)\n\nlemma glb_aux[simp]:\n  \"glb (m(aux: f)) = (glb m)\\<lparr>state_rec.more := f m\\<rparr>\"\n  by (auto simp: aux_upd_def glb_def)\n\nlemma glb_upd[simp]:\n  \"glb (m(Glb r :=\\<^sub>s e)) = (glb m)(r :=\\<^sub>s e)\"\n  by (auto simp: glb_def st_upd_def)\n\nlemma rg_reg_upd[simp]:\n  \"rg (m(Reg r :=\\<^sub>s e)) = (rg m)(r := e)\"\n  by (auto simp: rg_def st_upd_def)\n\nlemma rg_glb_upd[simp]:\n  \"rg (m(Glb r :=\\<^sub>s e)) = rg m\"\n  by (auto simp: rg_def st_upd_def)\n\nlemma [simp]:\n  \"aux (\\<lfloor>v,\\<alpha>,f\\<rfloor>) = f\"\n  by (auto simp: liftg_def)\n\nlemma [simp]:\n  \"m(x :=\\<^sub>s st m x) = m\"\n  by (auto simp: st_upd_def)\n\nlemma [simp]:\n  \"m(x :=\\<^sub>s e, x :=\\<^sub>s e') = m(x :=\\<^sub>s e')\"\n  by (auto simp: st_upd_def)\n\nlemma [simp]:\n  \"state_rec.more (glb m) = state_rec.more m\"\n  by (auto simp: glb_def)\n\nlemma fn_eq1[simp]:\n  \"(m = m'(x := e)) = (m x = e \\<and> (\\<forall>y. y \\<noteq> x \\<longrightarrow> m y = m' y))\"\n  by auto\n\nlemma fn_eq2[simp]:\n  \"(m'(x := e) = m) = (m x = e \\<and> (\\<forall>y. y \\<noteq> x \\<longrightarrow> m y = m' y))\"\n  by auto\n\nlemma [simp]:\n  \"(st m (Glb Z) = st (glb m) Z) = True\"\n  \"(rg m R = st m (Reg R)) = True\"\n  \"(st m\\<^sub>1 (Reg R) = rg m\\<^sub>1 R) = True\"\n  by (auto simp: glb_def rg_def)\n\ndeclare expand_pairs.simps [simp del]\n\nlemma expand_pairs [simp]:\n  \"expand_pairs p l = (\\<lambda>(i,s). (expand_op (l ! i), fset s)) ` fset p\"\n  unfolding expand_pairs.simps by auto\n\nend", "meta": {"author": "UQ-PAC", "repo": "wmm-rg", "sha": "7eef2f42693cb0723a9a7a75cd7cd6f73f9bdfb2", "save_path": "github-repos/isabelle/UQ-PAC-wmm-rg", "path": "github-repos/isabelle/UQ-PAC-wmm-rg/wmm-rg-7eef2f42693cb0723a9a7a75cd7cd6f73f9bdfb2/SimAsm/Examples/Examples.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. NO\n\n", "lm_q1_score": 0.600188359260205, "lm_q2_score": 0.5, "lm_q1q2_score": 0.3000941796301025}}
{"text": "(*\n * Copyright 2019, NTU\n *\n * This software may be distributed and modified according to the terms of\n * the BSD 2-Clause license. Note that NO WARRANTY is provided.\n * See \"LICENSE_BSD2.txt\" for details.\n *\n *  Author: Albert Rizaldi, NTU Singapore\n *)\n\ntheory Slicing_Hoare\n  imports VHDL_Hoare_Complete\nbegin\n\ndatatype sig = IN | OUT\n\ndefinition slicer :: \"sig conc_stmt\" where\n  \"slicer = process {IN} : Bassign_trans OUT (Bslice IN 3 2) 1\"\n\nlemma potential_tyenv:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows \"\\<exists>ki len. 3 < len \\<and> \\<Gamma> IN = Lty ki len \\<and> \\<Gamma> OUT = Lty ki 2\"\nproof (rule seq_wt_cases(4)[OF assms])\n  assume \"bexp_wt \\<Gamma> (Bslice IN 3 2) (\\<Gamma> OUT)\"\n  then obtain ki len where \"bexp_wt \\<Gamma> (Bsig IN) (Lty ki len) \\<and> 3 < len \\<and> \\<Gamma> OUT = Lty ki 2\"\n    by (metis add_2_eq_Suc add_Suc add_Suc_right add_diff_cancel_right' bexp_wt_cases_slice(1)\n    numeral_2_eq_2 numeral_3_eq_3)\n  hence \"bexp_wt \\<Gamma> (Bsig IN) (Lty ki len)\" and \"3 < len\" and \"\\<Gamma> OUT = Lty ki 2\"\n    by auto\n  hence \"\\<Gamma> IN = Lty ki len\"\n    using bexp_wt_cases_slice(2)[OF \\<open>bexp_wt \\<Gamma> (Bsig IN) (Lty ki len)\\<close>] by metis\n  thus ?thesis\n    using \\<open>3 < len\\<close> \\<open>\\<Gamma> OUT = Lty ki 2\\<close> by blast\nqed\n\nabbreviation \"lof_wline tw sig i \\<equiv> lval_of (wline_of tw sig i)\"\n\ndefinition inv :: \"sig assn2\" where\n  \"inv tw = (\\<forall>i < fst tw. let ins = lof_wline tw IN i; idx = length ins - 1 in\n                                          lof_wline tw OUT (i + 1) = nths ins {idx - 3 .. idx - 2})\"\n\ndefinition inv' :: \"sig assn2\" where\n  \"inv' tw = (disjnt {IN} (event_of tw) \\<longrightarrow>\n              (\\<forall>i\\<ge>fst tw. let ins = lof_wline tw IN (fst tw); idx = length ins - 1 in\n                                         lof_wline tw OUT (i + 1) = nths ins {idx - 3 .. idx - 2}))\"\n\ntext \\<open>Note that we need the assumption that @{term \"type_of x = Lty ki 2\"} as there is no\nguarantee that @{term \"beval_world_raw2 tw (Bslice IN 3 2) x\"} would result in a list\nof length 2.\\<close>\n\nlemma inv_next_time:\n  assumes \"inv tw\"\n  assumes \"beval_world_raw2 tw (Bslice IN 3 2) x\" and \"type_of x = Lty ki 2\"\n  defines \"tw' \\<equiv> tw[OUT, 1 :=\\<^sub>2 x]\"\n  shows   \"inv (next_time_world tw', snd tw')\"\nproof -\n  have \"fst tw' < next_time_world tw'\"\n    using next_time_world_at_least  using nat_less_le by blast\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n  ultimately have \"fst tw < next_time_world tw'\"\n    by auto\n  have \"\\<forall>i < next_time_world tw'. let ins = lof_wline tw' IN i; idx = length ins - 1 in\n                                           lof_wline tw' OUT (i + 1) = nths ins {idx - 3 .. idx - 2}\"\n  proof (rule, rule)\n    fix i\n    let ?ins   = \"lof_wline tw IN i\"\n    let ?ins'  = \"lof_wline tw' IN i\"\n    let ?instw = \"lof_wline tw IN (fst tw)\"\n    let ?idx   = \"length ?ins - 1\"\n    let ?idx'  = \"length ?ins' - 1\"\n    let ?idxtw = \"length ?instw - 1\"\n\n    assume \"i < next_time_world tw'\"\n    hence \"i < fst tw \\<or> fst tw \\<le> i \\<and> i < next_time_world tw' - 1 \\<or> i = next_time_world tw' - 1\"\n      using \\<open>fst tw < next_time_world tw'\\<close> by auto\n    moreover\n    { assume \"i < fst tw\"\n      have \"lof_wline tw' OUT (i + 1) = lof_wline tw OUT (i + 1)\"\n        using \\<open>i < fst tw\\<close> \\<open>fst tw < next_time_world tw'\\<close> unfolding tw'_def worldline_upd2_def\n        worldline_upd_def by (simp add: discrete)\n      also have \"... = nths ?ins {?idx - 3 .. ?idx - 2}\"\n        using assms(1) \\<open>i < fst tw\\<close> unfolding inv_def Let_def by auto\n      also have \"... = nths ?ins' {?idx' - 3 .. ?idx' - 2}\"\n      proof -\n        have \"lof_wline tw' IN i = lof_wline tw IN i\"\n          using \\<open>i < fst tw\\<close> \\<open>fst tw < next_time_world tw'\\<close> unfolding tw'_def worldline_upd2_def\n          worldline_upd_def by (simp add: discrete)\n        thus ?thesis\n          by auto\n      qed\n      finally have \"lof_wline tw' OUT (i + 1) = nths ?ins' {?idx' - 3 .. ?idx' - 2}\"\n        by auto }\n    moreover\n    { assume \"fst tw \\<le> i \\<and> i < next_time_world tw' - 1\"\n      hence \"lof_wline tw' OUT (i + 1) = lof_wline tw' OUT (fst tw + 1)\"\n        using unchanged_until_next_time_world\n        by (metis (mono_tags, lifting) Suc_eq_plus1 \\<open>get_time tw = get_time tw'\\<close> le_Suc_eq le_add1\n        le_less_trans less_diff_conv)\n      have \"lof_wline tw' IN i = lof_wline tw IN (fst tw)\"\n        using unchanged_until_next_time_world\n        by (metis \\<open>get_time tw = get_time tw'\\<close> \\<open>get_time tw \\<le> i \\<and> i < next_time_world tw' - 1\\<close> \\<open>i <\n        next_time_world tw'\\<close> less_add_one tw'_def worldline_upd2_before_dly)\n      let ?instw = \"lof_wline tw IN (fst tw)\"\n      let ?idxtw = \"length ?instw - 1\"\n      have \"nths ?ins' {?idx' - 3 .. ?idx' - 2} = nths ?instw {?idxtw - 3 .. ?idxtw - 2}\"\n        using \\<open>lof_wline tw' IN i = lof_wline tw IN (fst tw)\\<close> by simp\n      have \"lof_wline tw' OUT (fst tw + 1) = lval_of x\"\n        using assms(4)  by (metis worldline_upd2_at_dly)\n      also have \"... = nths ?instw {?idxtw - 3 .. ?idxtw - 2}\"\n      proof -\n        have assms2: \"beval_world_raw (snd tw) (fst tw) (Bslice IN 3 2) x\"\n          using assms(2) unfolding beval_world_raw2_def by auto\n        have \"\\<not> is_Bv (wline_of tw IN (fst tw))\"\n          apply (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n          by (metis beval_cases(1) comp_apply state_of_world_def val.disc(2))\n        then obtain ki where \"state_of_world (snd tw) (fst tw) IN = Lv ki ?instw\"\n          unfolding state_of_world_def  by (metis comp_def val.collapse(2))\n        show \"lval_of x = nths ?instw {?idxtw - 3 .. ?idxtw - 2}\"\n          apply (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n          using \\<open>state_of_world (snd tw) (fst tw) IN = Lv ki ?instw\\<close> plus_1_eq_Suc by auto\n      qed\n      also have \"... = nths ?ins' {?idx' - 3 .. ?idx' - 2}\"\n        using \\<open>lof_wline tw' IN i = lof_wline tw IN (fst tw)\\<close>\n        by simp\n      finally have \"lof_wline tw' OUT (i + 1) = nths ?ins' {?idx' - 3 .. ?idx' - 2}\"\n        using \\<open>lof_wline tw' OUT (i + 1) = lof_wline tw' OUT (fst tw + 1)\\<close> by auto }\n    moreover\n    { assume \"i = next_time_world tw' - 1\"\n      hence \"lof_wline tw' OUT (i + 1) = lof_wline tw' OUT (next_time_world tw')\"\n        using \\<open>i < next_time_world tw'\\<close> by auto\n      also have \"... = lof_wline tw' OUT (fst tw' + 1)\"\n        by (smt Suc_eq_plus1 \\<open>get_time tw < next_time_world tw'\\<close> \\<open>get_time tw = get_time tw'\\<close>\n        comp_def dual_order.strict_trans1 less_Suc_eq_le less_not_refl snd_conv tw'_def\n        worldline_upd2_def worldline_upd_def)\n      also have \"... = lof_wline tw' OUT (fst tw + 1)\"\n        unfolding `fst tw = fst tw'` by auto\n      also have \"... = lval_of x\"\n        using assms(4)  by (metis worldline_upd2_at_dly)\n      also have \"... = nths ?instw {?idxtw - 3 .. ?idxtw - 2}\"\n      proof -\n        have assms2: \"beval_world_raw (snd tw) (fst tw) (Bslice IN 3 2) x\"\n          using assms(2) unfolding beval_world_raw2_def by auto\n        have \"\\<not> is_Bv (wline_of tw IN (fst tw))\"\n          apply (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n          by (metis beval_cases(1) comp_apply state_of_world_def val.disc(2))\n        then obtain ki where \"state_of_world (snd tw) (fst tw) IN = Lv ki ?instw\"\n          unfolding state_of_world_def  by (metis comp_def val.collapse(2))\n        show \"lval_of x = nths ?instw {?idxtw - 3 .. ?idxtw - 2}\"\n          apply (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n          using \\<open>state_of_world (snd tw) (fst tw) IN = Lv ki ?instw\\<close> plus_1_eq_Suc by auto\n      qed\n      also have \"... = nths ?ins' {?idx' - 3 .. ?idx' - 2}\"\n        by (smt \\<open>get_time tw = get_time tw'\\<close> \\<open>i < get_time tw \\<Longrightarrow> lof_wline tw' OUT (i + 1) = nths\n        (lof_wline tw' IN i) {length (lof_wline tw' IN i) - 1 - 3..length (lof_wline tw' IN i) - 1 -\n        2}\\<close> \\<open>i < next_time_world tw'\\<close> calculation comp_def not_less sig.distinct(1) snd_conv tw'_def\n        unchanged_until_next_time_world worldline_upd2_def worldline_upd_def)\n      finally have \"lof_wline tw' OUT (i + 1) = nths ?ins' {?idx' - 3 .. ?idx' - 2}\"\n        by blast }\n    ultimately show \"let ins = lof_wline tw' IN i; idx = length ins - 1 in lof_wline tw' OUT (i + 1) = nths ins {idx - 3..idx - 2}\"\n      unfolding Let_def by auto\n  qed\n  thus ?thesis\n    unfolding inv_def by auto\nqed\n\nlemma type_correctness_length:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  assumes \"wityping \\<Gamma> (snd tw)\"\n  assumes \"beval_world_raw2 tw (Bslice IN 3 2) x\"\n  shows   \"\\<exists>ki. type_of x = Lty ki 2\"\nproof -\n  obtain ki len where \"\\<Gamma> IN = Lty ki len\" and \"3 < len\"\n    using potential_tyenv[OF assms(1)] by auto\n  have *: \"beval_world_raw (snd tw) (fst tw) (Bslice IN 3 2) x\"\n    using assms(3) unfolding beval_world_raw2_def by auto\n  have \"type_of (state_of_world (snd tw) (get_time tw) IN) = Lty ki len\"\n    using assms(2) unfolding wityping_def\n    by (simp add: \\<open>\\<Gamma> IN = Lty ki len\\<close> state_of_world_def wtyping_def)\n  hence **: \"\\<And>bs. state_of_world (snd tw) (fst tw) IN = Lv ki bs \\<Longrightarrow> length bs = len\"\n    by simp\n  have ***: \"\\<And>bs. 3 < length bs  \\<Longrightarrow> length (nths bs {length bs - Suc 3..length bs - Suc 2}) = 2\"\n  proof -\n    fix bs :: \"'a list\"\n    assume \"3 < length bs\"\n    hence \"length (nths bs {length bs - Suc 3..length bs - Suc 2}) =\n                               card {i. i < length bs \\<and> i \\<in> {length bs - Suc 3..length bs - Suc 2}}\"\n      unfolding length_nths by auto\n    have \"\\<And>i. i \\<in> {length bs - Suc 3 .. length bs - Suc 2} \\<Longrightarrow> i < length bs\"\n      using \\<open>3 < length bs\\<close> by auto\n    hence \"{i. i < length bs \\<and> i \\<in> {length bs - Suc 3 .. length bs - Suc 2}} =\n           {i. i \\<in> {length bs - Suc 3 .. length bs - Suc 2}}\" (is \"?lhs = ?rhs\")\n      by auto\n    hence \"card ?lhs = card ?rhs\"\n      by auto\n    also have \"... = 2\"\n      using \\<open>3 < length bs\\<close>\n      by (metis Collect_mem_eq One_nat_def Suc_diff_Suc Suc_numeral add_diff_cancel_left'\n      add_diff_cancel_right' card_atLeastAtMost diff_less_Suc numeral_2_eq_2 plus_1_eq_Suc\n      semiring_norm(5))\n    finally have \"card ?lhs = 2\"\n      by auto\n    thus \"length (nths bs {length bs - Suc 3..length bs - Suc 2}) = 2 \"\n      using \\<open>length (nths bs {length bs - Suc 3..length bs - Suc 2}) = card {i. i < length bs \\<and> i \\<in>\n      {length bs - Suc 3..length bs - Suc 2}}\\<close> by linarith\n  qed\n  show ?thesis\n    apply (rule beval_world_raw_cases[OF *])\n    apply (erule beval_cases)+\n    using \\<open>3 < len\\<close> ** ***\n    by (metis \\<open>type_of (state_of_world (snd tw) (get_time tw) IN) = Lty ki len\\<close> ty.inject\n    type_of.simps(2))\nqed\n\nlemma slicer_seq_hoare_next_time:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)]  Bassign_trans OUT (Bslice IN 3 2) 1 [\\<lambda>tw. inv (next_time_world tw, snd tw)]\"\n  apply (rule Assign2_altI)\n  using inv_next_time type_correctness_length[OF assms] by blast\n\nlemma aux:\n  \"\\<And>tw. inv (next_time_world tw, snd tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)\"\n  unfolding inv_def Let_def by simp\n\nlemma slicer_seq_hoare_next_time_post:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows \"\\<turnstile> [\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw)]  \n              Bassign_trans OUT (Bslice IN 3 2) 1 \n           [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw)]\"\n  apply (rule Conseq2[rotated])\n    apply (rule slicer_seq_hoare_next_time[OF assms])\n  by (auto simp add: aux)\n\nlemma slicer_seq_hoare_next_time0:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows \"\\<turnstile> [\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)] Bassign_trans OUT (Bslice IN 3 2) 1 [\\<lambda>tw. inv (next_time_world tw, snd tw)]\"\n  apply (rule Assign2_altI)\n  using inv_next_time type_correctness_length[OF assms] inv_def gr_implies_not0 by metis\n\nlemma slicer_conc_hoare:\n  \"\\<And>tw. inv tw \\<and> inv' tw \\<and> disjnt {IN} (event_of tw) \\<Longrightarrow> inv (next_time_world tw, snd tw)\"\n  by (smt Slicing_Hoare.inv_def comp_apply inv'_def not_less prod.sel(1) snd_conv\n  unchanged_until_next_time_world)\n\nlemma slicer_conc_hoare2:\n  \"\\<And>tw. inv tw \\<and> inv' tw \\<and> disjnt {IN} (event_of tw) \\<Longrightarrow> \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv' (j, snd tw)\"\n  unfolding inv_def inv'_def\n  by (smt Suc_diff_1 comp_apply diff_less disjnt_insert1 dual_order.strict_trans1 event_of_alt_def\n  fst_conv gr_implies_not_zero greaterThanAtMost_iff le_Suc_eq mem_Collect_eq nat_neq_iff\n  order.strict_iff_order snd_conv unchanged_until_next_time_world zero_less_one)\n\nlemma inv'_next_time:\n  fixes tw\n  assumes \"beval_world_raw2 tw (Bslice IN 3 2) x\" and \"type_of x = Lty ki 2\"\n  defines \"tw' \\<equiv> tw[OUT, 1 :=\\<^sub>2 x]\"\n  shows   \"\\<forall>j \\<in> {fst tw' <.. next_time_world tw'}. inv' (j, snd tw')\"\n  unfolding inv'_def\nproof (rule, rule, rule, rule)\n  fix i j\n  assume \"j \\<in> {fst tw' <.. next_time_world tw'}\"\n  assume \"disjnt {IN} (event_of (j, snd tw'))\"\n  hence \"IN \\<notin> event_of (j, snd tw')\"\n    by auto\n  assume \"fst (j, snd tw') \\<le> i\"\n  hence \"j \\<le> i\"\n    by auto\n  let ?ins = \"lof_wline (j, snd tw') IN j\"\n  let ?idx = \"length ?ins - 1\"\n\n  have \"fst tw' < j\"\n    using \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close> by auto\n  moreover have \"fst tw = fst tw'\"\n    unfolding tw'_def unfolding worldline_upd2_def by auto\n  ultimately have \"fst tw < j\"\n    by auto\n  have \"wline_of tw' IN j = wline_of tw IN (fst tw)\"\n  proof -\n    have \"wline_of tw' IN j = wline_of tw' IN (j - 1)\"\n      using \\<open>IN \\<notin> event_of (j, snd tw')\\<close> unfolding event_of_alt_def\n      using \\<open>get_time tw < j\\<close> by auto\n    also have \"... = wline_of tw' IN (fst tw')\"\n      using unchanged_until_next_time_world\n      by (metis (no_types, lifting) Suc_diff_1 \\<open>j \\<in> {get_time tw'<..next_time_world tw'}\\<close>\n      gr_implies_not_zero greaterThanAtMost_iff le_0_eq less_Suc_eq_le not_less)\n    also have \"... = wline_of tw' IN (fst tw)\"\n      by (simp add: \\<open>get_time tw = get_time tw'\\<close>)\n    also have \"... = wline_of tw IN (fst tw)\"\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by simp\n    finally show \"wline_of tw' IN j = wline_of tw IN (fst tw)\"\n      by auto\n  qed\n  moreover have \"?ins = lof_wline tw' IN j\"\n    by auto\n  ultimately have \"?ins = lof_wline tw IN (fst tw)\"\n    by auto\n  have \"\\<And>i. j \\<le> i \\<Longrightarrow> lof_wline tw' OUT (i + 1) = nths ?ins {?idx - 3 .. ?idx - 2}\"\n  proof -\n    fix i\n    have assms2: \"beval_world_raw (snd tw) (fst tw) (Bslice IN 3 2) x\"\n      using assms unfolding beval_world_raw2_def by auto\n    assume \"j \\<le> i\"\n    hence \"lof_wline tw' OUT (i + 1) = lval_of x\"\n      using `fst tw < j`\n      unfolding tw'_def worldline_upd2_def worldline_upd_def by auto\n    have \"\\<not> is_Bv (wline_of tw IN (fst tw))\"\n      by (rule beval_world_raw_cases[OF assms2], erule beval_cases)\n         (metis beval_cases(1) comp_apply state_of_world_def val.disc(2))\n    then obtain ki where \"state_of_world (snd tw) (fst tw) IN = Lv ki ?ins\"\n      unfolding \\<open>?ins = lof_wline tw IN (fst tw)\\<close>state_of_world_def\n      by (metis comp_def val.collapse(2))\n    have \"lval_of x = nths ?ins {?idx - 3 .. ?idx - 2}\"\n      apply (rule beval_world_raw_cases[OF assms2])\n      apply (erule beval_cases)+\n      using \\<open>state_of_world (snd tw) (fst tw) IN = Lv ki ?ins\\<close>\n      by (metis diff_Suc_eq_diff_pred val.sel(3))\n    thus \"lof_wline tw' OUT (i + 1) = nths ?ins {?idx - 3 .. ?idx - 2}\"\n      using \\<open>lof_wline tw' OUT (i + 1) = lval_of x\\<close> by auto\n  qed\n  thus \"let ins = lof_wline (j, snd tw') IN (get_time (j, snd tw')); idx = length ins - 1 in lof_wline (j, snd tw') OUT (i + 1) = nths ins {idx - 3..idx - 2}\"\n    by (simp add: \\<open>j \\<le> i\\<close>)\nqed\n\nlemma slicer_seq_hoare_next_time1:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows \"\\<turnstile> [\\<lambda>tw. wityping \\<Gamma> (snd tw)] \n              Bassign_trans OUT (Bslice IN 3 2) 1 \n           [\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv' (j, snd tw)]\"\n  apply (rule Assign2_altI)\n  using inv'_next_time type_correctness_length[OF assms] by blast\n\nlemma slicer_conc_hoare3:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n              slicer \n           \\<lbrace>\\<lambda>tw. \\<forall>j \\<in> {fst tw <.. next_time_world tw}. inv (j, snd tw) \\<and> inv' (j, snd tw)\\<rbrace>\"\n  unfolding slicer_def\n  apply (rule Single)\n   apply (rule Conj_univ_qtfd)\n  apply (rule Conseq2[rotated])\n      apply (rule slicer_seq_hoare_next_time_post[OF assms], simp, simp)\n   apply (rule Conseq2[rotated])\n     apply (rule slicer_seq_hoare_next_time1[OF assms], simp, simp)\n  using slicer_conc_hoare aux slicer_conc_hoare2 by blast\n\nlemma slicer_conc_hoare4:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows \"\\<turnstile> \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n                slicer \n           \\<lbrace>\\<lambda>tw. \\<forall>i\\<in>{get_time tw<..next_time_world tw}. (Slicing_Hoare.inv (i, snd tw) \\<and> inv' (i, snd tw)) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule Conj2_univ_qtfd[where R=\"\\<lambda>tw. wityping \\<Gamma> (snd tw)\", unfolded snd_conv])\n   apply (rule slicer_conc_hoare3[OF assms])\n  apply (rule strengthen_pre_conc_hoare[rotated])\n  apply (rule weaken_post_conc_hoare[rotated])\n    apply (unfold slicer_def, rule single_conc_stmt_preserve_wityping_hoare[OF assms], blast)\n  by auto\n\nlemma slicer_conc_sim':\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows   \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> \n                  slicer \n              \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace>\"\n  apply (rule While)    \n  apply (unfold snd_conv, rule slicer_conc_hoare4[OF assms])\n  done\n\nlemma slicer_conc_sim2':\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows   \"\\<turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (inv tw \\<and> inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> slicer \\<lbrace>inv\\<rbrace>\"\n  using slicer_conc_sim' Conseq_sim assms by smt\n\nlemma init_sat_slicer_inv:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows   \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) slicer (\\<lambda>tw. inv tw \\<and> wityping \\<Gamma> (snd tw))\"\n  unfolding slicer_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conj)\n  unfolding snd_conv apply (rule slicer_seq_hoare_next_time0[OF assms])\n  apply (rule strengthen_precondition2)\n  by (metis assms seq_stmt_preserve_wityping_hoare)\n\nlemma init_sat_slicer_inv2:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows \"init_sim_hoare (\\<lambda>tw. wityping \\<Gamma> (snd tw)) slicer inv'\"\n  unfolding slicer_def\n  apply (rule AssignI)\n  apply (rule SingleI)\n  apply (rule Conseq2[rotated])\n    apply (rule slicer_seq_hoare_next_time1[OF assms])\n  by (auto simp add: next_time_world_at_least)\n  \nlemma init_sat_slicer_inv_comb:\n  assumes \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n  shows   \"init_sim_hoare (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) slicer (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv' tw)\"\n  apply (rule ConjI_sim)\n  apply (rule init_sat_slicer_inv[OF assms])\n  apply (rule ConseqI_sim[rotated])\n  apply (rule init_sat_slicer_inv2[OF assms])\n  by blast+\n\nlemma slicer_correctness:\n  assumes \"sim_fin w (i + 1) slicer tw'\" and \"wityping \\<Gamma> w\"\n  assumes \"conc_wt \\<Gamma> slicer\"\n  shows   \"let ins = lof_wline tw' IN i; idx = length ins - 1 in\n                                          lof_wline tw' OUT (i + 1) = nths ins {idx - 3 .. idx - 2}\"\nproof -\n  obtain tw where \"init_sim (0, w) slicer tw\" and  \"tw, i + 1, slicer \\<Rightarrow>\\<^sub>S tw'\"\n    using premises_sim_fin_obt[OF assms(1)] by auto\n  hence \"i + 1 = fst tw'\"\n    using world_maxtime_lt_fst_tres  by blast\n  have \"conc_stmt_wf slicer\"\n    unfolding conc_stmt_wf_def slicer_def by auto\n  moreover have \"nonneg_delay_conc slicer\"\n    unfolding slicer_def by auto\n  ultimately have \"init_sim_valid (\\<lambda>tw. fst tw = 0 \\<and> wityping \\<Gamma> (snd tw)) slicer (\\<lambda>tw. (inv tw \\<and> wityping \\<Gamma> (snd tw)) \\<and> inv' tw)\"\n    using init_sim_hoare_soundness[OF init_sat_slicer_inv_comb]\n    by (metis (no_types, lifting) assms(3) conc_wt_cases(1) init_sat_slicer_inv_comb\n    init_sim_hoare_soundness slicer_def strengthen_precondition_init_sim_hoare)\n  hence \"inv tw \\<and> wityping \\<Gamma> (snd tw) \\<and> inv' tw\"\n    using \\<open>init_sim (0, w) slicer tw\\<close> fst_conv assms(2) unfolding init_sim_valid_def\n    by (metis snd_conv)\n  hence \"inv tw\" and \"inv' tw\" and \"wityping \\<Gamma> (snd tw)\"\n    by auto\n  moreover have \"seq_wt \\<Gamma> (Bassign_trans OUT (Bslice IN 3 2) 1)\"\n    using assms(3) unfolding slicer_def by auto\n  moreover hence \"\\<Turnstile>\\<^sub>s \\<lbrace>\\<lambda>tw. (Slicing_Hoare.inv tw \\<and> inv' tw) \\<and> wityping \\<Gamma> (snd tw)\\<rbrace> slicer \\<lbrace>Slicing_Hoare.inv\\<rbrace>\"\n    using conc_sim_soundness[OF slicer_conc_sim2'] \\<open>conc_stmt_wf slicer\\<close> \\<open>nonneg_delay_conc slicer\\<close>\n    by auto\n  ultimately have \"inv tw'\"\n    using \\<open>tw, i + 1, slicer \\<Rightarrow>\\<^sub>S tw'\\<close> unfolding sim_hoare_valid_def by blast\n  with \\<open>i + 1 = fst tw'\\<close> show ?thesis\n    unfolding inv_def by (metis less_add_one)\nqed\n\nend", "meta": {"author": "rizaldialbert", "repo": "vhdl-semantics", "sha": "352f89c9ccdfe830c054757dfd86caeadbd67159", "save_path": "github-repos/isabelle/rizaldialbert-vhdl-semantics", "path": "github-repos/isabelle/rizaldialbert-vhdl-semantics/vhdl-semantics-352f89c9ccdfe830c054757dfd86caeadbd67159/Slicing_Hoare.thy", "lm_name": "Qwen/Qwen-72B", "lm_label": "1. YES\n2. YES\n\n", "lm_q1_score": 0.519521321952093, "lm_q2_score": 0.5774953651858118, "lm_q1q2_score": 0.30002115554253966}}